427 changed files with 72979 additions and 7680 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1,31 +1,5 @@
-/qemu-3.1.0.tar.xz
+SOURCES/qemu-6.2.0.tar.xz
-/qemu-4.0.0.tar.xz
+SOURCES/tests_data_acpi_pc_SSDT.dimmpxm
-/qemu-4.1.0-rc4.tar.xz
+SOURCES/tests_data_acpi_q35_FACP.slic
-/qemu-4.1.0.tar.xz
+SOURCES/tests_data_acpi_q35_SSDT.dimmpxm
-/qemu-4.2.0-rc1.tar.xz
+SOURCES/tests_data_acpi_virt_SSDT.memhp
 /qemu-4.2.0-rc4.tar.xz
 /qemu-4.2.0.tar.xz
 /qemu-5.0.0-rc0.tar.xz
 /qemu-5.0.0-rc1.tar.xz
 /qemu-5.0.0-rc2.tar.xz
 /qemu-5.0.0-rc3.tar.xz
 /qemu-5.0.0-rc4.tar.xz
 /qemu-5.0.0.tar.xz
 /qemu-5.1.0.tar.xz
 /qemu-5.2.0-rc1.tar.xz
 /qemu-5.2.0-rc3.tar.xz
 /qemu-5.2.0.tar.xz
 /qemu-6.0.0.tar.xz
 /qemu-kvm*.src.rpm
 /patches.*
 /*.orig
 /qemu-6.1.0.tar.xz
 /qemu-6.2.0.tar.xz
 /qemu-7.0.0.tar.xz
 /capstone.tar.gz
 /qemu-7.1.0.tar.xz
 /qemu-7.2.0.tar.xz
 /qemu-8.0.0.tar.xz
 /qemu-8.1.0.tar.xz
 /qemu-8.2.0.tar.xz
 /qemu-9.0.0.tar.xz
--- a/.qemu-kvm.metadata
+++ b/.qemu-kvm.metadata
@ -0,0 +1,5 @@
 68cd61a466170115b88817e2d52db2cd7a92f43a SOURCES/qemu-6.2.0.tar.xz
 c4b34092bc5af1ba7febfca1477320fb024e8acd SOURCES/tests_data_acpi_pc_SSDT.dimmpxm
 19349e3517143bd1af56a5444e927ba37a111f72 SOURCES/tests_data_acpi_q35_FACP.slic
 4632d10ae8cedad4d5d760ed211f83f0dc81005d SOURCES/tests_data_acpi_q35_SSDT.dimmpxm
 ef12eed43cc357fb134db6fa3c7ffc83e222a97d SOURCES/tests_data_acpi_virt_SSDT.memhp
--- a/0004-Initial-redhat-build.patch
+++ b/0004-Initial-redhat-build.patch
@ -1,138 +0,0 @@
 From 91262ecfbd218a95dab8491e4226674f79debf5a Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 26 May 2021 10:56:02 +0200
 Subject: Initial redhat build
 This patch introduces redhat build structure in redhat subdirectory. In addition,
 several issues are fixed in QEMU tree:
 - Change of app name for sasl_server_init in VNC code from qemu to qemu-kvm
 - As we use qemu-kvm as name in all places, this is updated to be consistent
 - Man page renamed from qemu to qemu-kvm
 - man page is installed using make install so we have to fix it in qemu tree
 We disable make check due to issues with some of the tests.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 .distro/Makefile                        |  101 ++
 .distro/Makefile.common                 |   42 +
 .distro/README.tests                    |   39 +
 .distro/modules-load.conf               |    4 +
 .distro/qemu-guest-agent.service        |    1 -
 .distro/qemu-kvm.spec.template          | 1250 +++++++++++++++++++++++
 .distro/rpminspect.yaml                 |    6 +-
 .distro/scripts/extract_build_cmd.py    |   12 +
 .distro/scripts/frh.py                  |    4 +-
 .distro/scripts/process-patches.sh      |    4 +
 .gitignore                              |    1 +
 README.systemtap                        |   43 +
 scripts/qemu-guest-agent/fsfreeze-hook  |    2 +-
 scripts/systemtap/conf.d/qemu_kvm.conf  |    4 +
 scripts/systemtap/script.d/qemu_kvm.stp |    1 +
 ui/vnc-auth-sasl.c                      |    2 +-
 16 files changed, 1510 insertions(+), 6 deletions(-)
 create mode 100644 .distro/Makefile
 create mode 100644 .distro/Makefile.common
 create mode 100644 .distro/README.tests
 create mode 100644 .distro/modules-load.conf
 create mode 100644 .distro/qemu-kvm.spec.template
 create mode 100644 README.systemtap
 create mode 100644 scripts/systemtap/conf.d/qemu_kvm.conf
 create mode 100644 scripts/systemtap/script.d/qemu_kvm.stp
 diff --git a/README.systemtap b/README.systemtap
 new file mode 100644
 index 0000000000..ad913fc990
 --- /dev/null
 +++ b/README.systemtap
@@ -0,0 +1,43 @@
 +QEMU tracing using systemtap-initscript
 +---------------------------------------
 +
 +You can capture QEMU trace data all the time using systemtap-initscript.  This
 +uses SystemTap's flight recorder mode to trace all running guests to a
 +fixed-size buffer on the host.  Old trace entries are overwritten by new
 +entries when the buffer size wraps.
 +
 +1. Install the systemtap-initscript package:
 +  # yum install systemtap-initscript
 +
 +2. Install the systemtap scripts and the conf file:
 +  # cp /usr/share/qemu-kvm/systemtap/script.d/qemu_kvm.stp /etc/systemtap/script.d/
 +  # cp /usr/share/qemu-kvm/systemtap/conf.d/qemu_kvm.conf /etc/systemtap/conf.d/
 +
 +The set of trace events to enable is given in qemu_kvm.stp.  This SystemTap
 +script can be customized to add or remove trace events provided in
 +/usr/share/systemtap/tapset/qemu-kvm-simpletrace.stp.
 +
 +SystemTap customizations can be made to qemu_kvm.conf to control the flight
 +recorder buffer size and whether to store traces in memory only or disk too.
 +See stap(1) for option documentation.
 +
 +3. Start the systemtap service.
 +　# service systemtap start qemu_kvm
 +
 +4. Make the service start at boot time.
 +　# chkconfig systemtap on
 +
 +5. Confirm that the service works.
 +  # service systemtap status qemu_kvm
 +  qemu_kvm is running...
 +
 +When you want to inspect the trace buffer, perform the following steps:
 +
 +1. Dump the trace buffer.
 +  # staprun -A qemu_kvm >/tmp/trace.log
 +
 +2. Start the systemtap service because the preceding step stops the service.
 +  # service systemtap start qemu_kvm
 +
 +3. Translate the trace record to readable format.
 +  # /usr/share/qemu-kvm/simpletrace.py --no-header /usr/share/qemu-kvm/trace-events /tmp/trace.log
 diff --git a/scripts/qemu-guest-agent/fsfreeze-hook b/scripts/qemu-guest-agent/fsfreeze-hook
 index 13aafd4845..e9b84ec028 100755
 --- a/scripts/qemu-guest-agent/fsfreeze-hook
 +++ b/scripts/qemu-guest-agent/fsfreeze-hook
@@ -8,7 +8,7 @@
 # request, it is issued with "thaw" argument after filesystem is thawed.
 LOGFILE=/var/log/qga-fsfreeze-hook.log
 -FSFREEZE_D=$(dirname -- "$0")/fsfreeze-hook.d
 +FSFREEZE_D=$(dirname -- "$(realpath $0)")/fsfreeze-hook.d
 # Check whether file $1 is a backup or rpm-generated file and should be ignored
 is_ignored_file() {
 diff --git a/scripts/systemtap/conf.d/qemu_kvm.conf b/scripts/systemtap/conf.d/qemu_kvm.conf
 new file mode 100644
 index 0000000000..372d8160a4
 --- /dev/null
 +++ b/scripts/systemtap/conf.d/qemu_kvm.conf
@@ -0,0 +1,4 @@
 +# Force load uprobes (see BZ#1118352)
 +stap -e 'probe process("/usr/libexec/qemu-kvm").function("main") { printf("") }' -c true
 +
 +qemu_kvm_OPT="-s4" # per-CPU buffer size, in megabytes
 diff --git a/scripts/systemtap/script.d/qemu_kvm.stp b/scripts/systemtap/script.d/qemu_kvm.stp
 new file mode 100644
 index 0000000000..c04abf9449
 --- /dev/null
 +++ b/scripts/systemtap/script.d/qemu_kvm.stp
@@ -0,0 +1 @@
 +probe qemu.kvm.simpletrace.handle_qmp_command,qemu.kvm.simpletrace.monitor_protocol_*,qemu.kvm.simpletrace.migrate_set_state {}
 diff --git a/ui/vnc-auth-sasl.c b/ui/vnc-auth-sasl.c
 index 47fdae5b21..2a950caa2a 100644
 --- a/ui/vnc-auth-sasl.c
 +++ b/ui/vnc-auth-sasl.c
@@ -42,7 +42,7 @@
 bool vnc_sasl_server_init(Error **errp)
 {
 -    int saslErr = sasl_server_init(NULL, "qemu");
 +    int saslErr = sasl_server_init(NULL, "qemu-kvm");
     if (saslErr != SASL_OK) {
         error_setg(errp, "Failed to initialize SASL auth: %s",
 -- 
 2.39.3
--- a/0005-Enable-disable-devices-for-RHEL.patch
+++ b/0005-Enable-disable-devices-for-RHEL.patch
@ -1,740 +0,0 @@
 From 8e767ade83e18995692d3554b6b71c9e15b51d89 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 7 Dec 2022 03:05:48 -0500
 Subject: Enable/disable devices for RHEL
 This commit adds all changes related to changes in supported devices.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 .distro/qemu-kvm.spec.template                |  18 +--
 .../aarch64-softmmu/aarch64-rh-devices.mak    |  42 +++++++
 .../ppc64-softmmu/ppc64-rh-devices.mak        |  37 ++++++
 configs/devices/rh-virtio.mak                 |  10 ++
 .../s390x-softmmu/s390x-rh-devices.mak        |  19 +++
 .../x86_64-softmmu/x86_64-rh-devices.mak      | 112 ++++++++++++++++++
 hw/arm/virt.c                                 |   2 +
 hw/block/fdc.c                                |  10 ++
 hw/cpu/meson.build                            |   3 +-
 hw/cxl/meson.build                            |   3 +-
 hw/display/cirrus_vga.c                       |   4 +
 hw/ide/piix.c                                 |   5 +-
 hw/input/pckbd.c                              |   2 +
 hw/net/e1000.c                                |   2 +
 hw/usb/meson.build                            |   2 +-
 hw/virtio/meson.build                         |   6 +-
 target/arm/arm-qmp-cmds.c                     |   2 +
 target/arm/cpu.c                              |   4 +
 target/arm/cpu.h                              |   3 +
 target/arm/cpu64.c                            |  12 +-
 target/arm/tcg/cpu32.c                        |   2 +
 target/arm/tcg/cpu64.c                        |   8 ++
 target/arm/tcg/meson.build                    |   2 +-
 target/s390x/cpu_models_sysemu.c              |   3 +
 target/s390x/kvm/kvm.c                        |   8 ++
 tests/qtest/arm-cpu-features.c                |   4 +
 26 files changed, 309 insertions(+), 16 deletions(-)
 create mode 100644 configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
 create mode 100644 configs/devices/ppc64-softmmu/ppc64-rh-devices.mak
 create mode 100644 configs/devices/rh-virtio.mak
 create mode 100644 configs/devices/s390x-softmmu/s390x-rh-devices.mak
 create mode 100644 configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 diff --git a/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak b/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
 new file mode 100644
 index 0000000000..b0191d3c69
 --- /dev/null
 +++ b/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
@@ -0,0 +1,42 @@
 +include ../rh-virtio.mak
 +
 +CONFIG_ARM_GIC_KVM=y
 +CONFIG_ARM_GICV3_TCG=y
 +CONFIG_ARM_GIC=y
 +CONFIG_ARM_SMMUV3=y
 +CONFIG_ARM_VIRT=y
 +CONFIG_CXL=y
 +CONFIG_CXL_MEM_DEVICE=y
 +CONFIG_EDID=y
 +CONFIG_PCIE_PORT=y
 +CONFIG_PCIE_PCI_BRIDGE=y
 +CONFIG_PCI_DEVICES=y
 +CONFIG_PCI_TESTDEV=y
 +CONFIG_PFLASH_CFI01=y
 +CONFIG_SCSI=y
 +CONFIG_SEMIHOSTING=y
 +CONFIG_USB=y
 +CONFIG_USB_XHCI=y
 +CONFIG_USB_XHCI_PCI=y
 +CONFIG_USB_STORAGE_CORE=y
 +CONFIG_USB_STORAGE_CLASSIC=y
 +CONFIG_VFIO=y
 +CONFIG_VFIO_PCI=y
 +CONFIG_VIRTIO_MMIO=y
 +CONFIG_VIRTIO_PCI=y
 +CONFIG_VIRTIO_MEM=y
 +CONFIG_VIRTIO_IOMMU=y
 +CONFIG_XIO3130=y
 +CONFIG_NVDIMM=y
 +CONFIG_ACPI_APEI=y
 +CONFIG_TPM=y
 +CONFIG_TPM_EMULATOR=y
 +CONFIG_TPM_TIS_SYSBUS=y
 +CONFIG_PTIMER=y
 +CONFIG_ARM_COMPATIBLE_SEMIHOSTING=y
 +CONFIG_PVPANIC_PCI=y
 +CONFIG_PXB=y
 +CONFIG_VHOST_VSOCK=y
 +CONFIG_VHOST_USER_VSOCK=y
 +CONFIG_VHOST_USER_FS=y
 +CONFIG_IOMMUFD=y
 diff --git a/configs/devices/ppc64-softmmu/ppc64-rh-devices.mak b/configs/devices/ppc64-softmmu/ppc64-rh-devices.mak
 new file mode 100644
 index 0000000000..dbb7d30829
 --- /dev/null
 +++ b/configs/devices/ppc64-softmmu/ppc64-rh-devices.mak
@@ -0,0 +1,37 @@
 +include ../rh-virtio.mak
 +
 +CONFIG_DIMM=y
 +CONFIG_MEM_DEVICE=y
 +CONFIG_NVDIMM=y
 +CONFIG_PCI=y
 +CONFIG_PCI_DEVICES=y
 +CONFIG_PCI_TESTDEV=y
 +CONFIG_PCI_EXPRESS=y
 +CONFIG_PSERIES=y
 +CONFIG_SCSI=y
 +CONFIG_SPAPR_VSCSI=y
 +CONFIG_TEST_DEVICES=y
 +CONFIG_USB=y
 +CONFIG_USB_OHCI=y
 +CONFIG_USB_OHCI_PCI=y
 +CONFIG_USB_SMARTCARD=y
 +CONFIG_USB_STORAGE_CORE=y
 +CONFIG_USB_STORAGE_CLASSIC=y
 +CONFIG_USB_XHCI=y
 +CONFIG_USB_XHCI_NEC=y
 +CONFIG_USB_XHCI_PCI=y
 +CONFIG_VFIO=y
 +CONFIG_VFIO_PCI=y
 +CONFIG_VGA=y
 +CONFIG_VGA_PCI=y
 +CONFIG_VHOST_USER=y
 +CONFIG_VIRTIO_PCI=y
 +CONFIG_VIRTIO_VGA=y
 +CONFIG_WDT_IB6300ESB=y
 +CONFIG_XICS=y
 +CONFIG_XIVE=y
 +CONFIG_TPM=y
 +CONFIG_TPM_SPAPR=y
 +CONFIG_TPM_EMULATOR=y
 +CONFIG_VHOST_VSOCK=y
 +CONFIG_VHOST_USER_VSOCK=y
 diff --git a/configs/devices/rh-virtio.mak b/configs/devices/rh-virtio.mak
 new file mode 100644
 index 0000000000..94ede1b5f6
 --- /dev/null
 +++ b/configs/devices/rh-virtio.mak
@@ -0,0 +1,10 @@
 +CONFIG_VIRTIO=y
 +CONFIG_VIRTIO_BALLOON=y
 +CONFIG_VIRTIO_BLK=y
 +CONFIG_VIRTIO_GPU=y
 +CONFIG_VIRTIO_INPUT=y
 +CONFIG_VIRTIO_INPUT_HOST=y
 +CONFIG_VIRTIO_NET=y
 +CONFIG_VIRTIO_RNG=y
 +CONFIG_VIRTIO_SCSI=y
 +CONFIG_VIRTIO_SERIAL=y
 diff --git a/configs/devices/s390x-softmmu/s390x-rh-devices.mak b/configs/devices/s390x-softmmu/s390x-rh-devices.mak
 new file mode 100644
 index 0000000000..24cf6dbd03
 --- /dev/null
 +++ b/configs/devices/s390x-softmmu/s390x-rh-devices.mak
@@ -0,0 +1,19 @@
 +include ../rh-virtio.mak
 +
 +CONFIG_PCI=y
 +CONFIG_S390_CCW_VIRTIO=y
 +CONFIG_S390_FLIC=y
 +CONFIG_S390_FLIC_KVM=y
 +CONFIG_SCLPCONSOLE=y
 +CONFIG_SCSI=y
 +CONFIG_VFIO=y
 +CONFIG_VFIO_AP=y
 +CONFIG_VFIO_CCW=y
 +CONFIG_VFIO_PCI=y
 +CONFIG_VHOST_USER=y
 +CONFIG_VIRTIO_CCW=y
 +CONFIG_WDT_DIAG288=y
 +CONFIG_VHOST_VSOCK=y
 +CONFIG_VHOST_USER_VSOCK=y
 +CONFIG_VHOST_USER_FS=y
 +CONFIG_IOMMUFD=y
 diff --git a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 new file mode 100644
 index 0000000000..d60ff1bcfc
 --- /dev/null
 +++ b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
@@ -0,0 +1,112 @@
 +include ../rh-virtio.mak
 +
 +CONFIG_ACPI=y
 +CONFIG_ACPI_PCI=y
 +CONFIG_ACPI_CPU_HOTPLUG=y
 +CONFIG_ACPI_MEMORY_HOTPLUG=y
 +CONFIG_ACPI_NVDIMM=y
 +CONFIG_ACPI_SMBUS=y
 +CONFIG_ACPI_VMGENID=y
 +CONFIG_ACPI_X86=y
 +CONFIG_ACPI_ICH9=y
 +CONFIG_AHCI=y
 +CONFIG_APIC=y
 +CONFIG_APM=y
 +CONFIG_BOCHS_DISPLAY=y
 +CONFIG_CXL=y
 +CONFIG_CXL_MEM_DEVICE=y
 +CONFIG_DIMM=y
 +CONFIG_E1000E_PCI_EXPRESS=y
 +CONFIG_E1000_PCI=y
 +CONFIG_EDU=y
 +CONFIG_FDC=y
 +CONFIG_FDC_SYSBUS=y
 +CONFIG_FDC_ISA=y
 +CONFIG_FW_CFG_DMA=y
 +CONFIG_HDA=y
 +CONFIG_HYPERV=y
 +CONFIG_HYPERV_TESTDEV=y
 +CONFIG_I2C=y
 +CONFIG_I440FX=y
 +CONFIG_I8254=y
 +CONFIG_I8257=y
 +CONFIG_I8259=y
 +CONFIG_I82801B11=y
 +CONFIG_IDE_CORE=y
 +CONFIG_IDE_PCI=y
 +CONFIG_IDE_PIIX=y
 +CONFIG_IDE_DEV=y
 +CONFIG_IDE_BUS=y
 +CONFIG_IGB_PCI_EXPRESS=y
 +CONFIG_IOAPIC=y
 +CONFIG_IOH3420=y
 +CONFIG_ISA_BUS=y
 +CONFIG_ISA_DEBUG=y
 +CONFIG_ISA_TESTDEV=y
 +CONFIG_LPC_ICH9=y
 +CONFIG_MC146818RTC=y
 +CONFIG_MEM_DEVICE=y
 +CONFIG_NVDIMM=y
 +CONFIG_PAM=y
 +CONFIG_PC=y
 +CONFIG_PCI=y
 +CONFIG_PCIE_PORT=y
 +CONFIG_PCI_DEVICES=y
 +CONFIG_PCI_EXPRESS=y
 +CONFIG_PCI_EXPRESS_Q35=y
 +CONFIG_PCI_I440FX=y
 +CONFIG_PCI_TESTDEV=y
 +CONFIG_PCKBD=y
 +CONFIG_PCSPK=y
 +CONFIG_PC_ACPI=y
 +CONFIG_PC_PCI=y
 +CONFIG_PCIE_PCI_BRIDGE=y
 +CONFIG_PFLASH_CFI01=y
 +CONFIG_PVPANIC_ISA=y
 +CONFIG_PXB=y
 +CONFIG_Q35=y
 +CONFIG_RTL8139_PCI=y
 +CONFIG_SCSI=y
 +CONFIG_SERIAL=y
 +CONFIG_SERIAL_ISA=y
 +CONFIG_SERIAL_PCI=y
 +CONFIG_SEV=y
 +CONFIG_SMBIOS=y
 +CONFIG_SMBUS_EEPROM=y
 +CONFIG_TEST_DEVICES=y
 +CONFIG_USB=y
 +CONFIG_USB_EHCI=y
 +CONFIG_USB_EHCI_PCI=y
 +CONFIG_USB_SMARTCARD=y
 +CONFIG_USB_STORAGE_CORE=y
 +CONFIG_USB_STORAGE_CLASSIC=y
 +CONFIG_USB_UHCI=y
 +CONFIG_USB_XHCI=y
 +CONFIG_USB_XHCI_NEC=y
 +CONFIG_USB_XHCI_PCI=y
 +CONFIG_VFIO=y
 +CONFIG_VFIO_PCI=y
 +CONFIG_VGA=y
 +CONFIG_VGA_CIRRUS=y
 +CONFIG_VGA_PCI=y
 +CONFIG_VHOST_USER=y
 +CONFIG_VHOST_USER_BLK=y
 +CONFIG_VIRTIO_MEM=y
 +CONFIG_VIRTIO_PCI=y
 +CONFIG_VIRTIO_VGA=y
 +CONFIG_VIRTIO_IOMMU=y
 +CONFIG_VMMOUSE=y
 +CONFIG_VMPORT=y
 +CONFIG_VTD=y
 +CONFIG_WDT_IB6300ESB=y
 +CONFIG_WDT_IB700=y
 +CONFIG_XIO3130=y
 +CONFIG_TPM=y
 +CONFIG_TPM_CRB=y
 +CONFIG_TPM_TIS_ISA=y
 +CONFIG_TPM_EMULATOR=y
 +CONFIG_SGX=y
 +CONFIG_VHOST_VSOCK=y
 +CONFIG_VHOST_USER_VSOCK=y
 +CONFIG_VHOST_USER_FS=y
 +CONFIG_IOMMUFD=y
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index a9a913aead..6c6d155002 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
@@ -2954,6 +2954,7 @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
     MachineClass *mc = MACHINE_CLASS(oc);
     HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(oc);
     static const char * const valid_cpu_types[] = {
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 #ifdef CONFIG_TCG
         ARM_CPU_TYPE_NAME("cortex-a7"),
         ARM_CPU_TYPE_NAME("cortex-a15"),
@@ -2971,6 +2972,7 @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
 #endif /* CONFIG_TCG */
 #ifdef TARGET_AARCH64
         ARM_CPU_TYPE_NAME("cortex-a53"),
 +#endif /* disabled for RHEL */
         ARM_CPU_TYPE_NAME("cortex-a57"),
 #if defined(CONFIG_KVM) || defined(CONFIG_HVF)
         ARM_CPU_TYPE_NAME("host"),
 diff --git a/hw/block/fdc.c b/hw/block/fdc.c
 index 6dd94e98bc..a05757fc9a 100644
 --- a/hw/block/fdc.c
 +++ b/hw/block/fdc.c
@@ -49,6 +49,8 @@
 #include "qom/object.h"
 #include "fdc-internal.h"
 +#include "hw/boards.h"
 +
 /********************************************************/
 /* debug Floppy devices */
@@ -2346,6 +2348,14 @@ void fdctrl_realize_common(DeviceState *dev, FDCtrl *fdctrl, Error **errp)
     FDrive *drive;
     static int command_tables_inited = 0;
 +    /* Restricted for Red Hat Enterprise Linux: */
 +    MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
 +    if (!strstr(mc->name, "-rhel7.")) {
 +        error_setg(errp, "Device %s is not supported with machine type %s",
 +                   object_get_typename(OBJECT(dev)), mc->name);
 +        return;
 +    }
 +
     if (fdctrl->fallback == FLOPPY_DRIVE_TYPE_AUTO) {
         error_setg(errp, "Cannot choose a fallback FDrive type of 'auto'");
         return;
 diff --git a/hw/cpu/meson.build b/hw/cpu/meson.build
 index 38cdcfbe57..e588ecfd42 100644
 --- a/hw/cpu/meson.build
 +++ b/hw/cpu/meson.build
@@ -1,4 +1,5 @@
 -system_ss.add(files('core.c', 'cluster.c'))
 +#system_ss.add(files('core.c', 'cluster.c'))
 +system_ss.add(files('core.c'))
 system_ss.add(when: 'CONFIG_ARM11MPCORE', if_true: files('arm11mpcore.c'))
 system_ss.add(when: 'CONFIG_REALVIEW', if_true: files('realview_mpcore.c'))
 diff --git a/hw/cxl/meson.build b/hw/cxl/meson.build
 index 3e375f61a9..613adb3ebb 100644
 --- a/hw/cxl/meson.build
 +++ b/hw/cxl/meson.build
@@ -6,7 +6,8 @@ system_ss.add(when: 'CONFIG_CXL',
                    'cxl-host.c',
                    'cxl-cdat.c',
                    'cxl-events.c',
 -                   'switch-mailbox-cci.c',
 +# Disabled for 8.2.0 rebase for RHEL 9.4.0
 +#                   'switch-mailbox-cci.c',
                ),
                if_false: files(
                    'cxl-host-stubs.c',
 diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
 index 150883a971..497365bd80 100644
 --- a/hw/display/cirrus_vga.c
 +++ b/hw/display/cirrus_vga.c
@@ -36,6 +36,7 @@
 #include "qemu/module.h"
 #include "qemu/units.h"
 #include "qemu/log.h"
 +#include "qemu/error-report.h"
 #include "sysemu/reset.h"
 #include "qapi/error.h"
 #include "trace.h"
@@ -2946,6 +2947,9 @@ static void pci_cirrus_vga_realize(PCIDevice *dev, Error **errp)
     PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(dev);
     int16_t device_id = pc->device_id;
 +    warn_report("'cirrus-vga' is deprecated, "
 +                "please use a different VGA card instead");
 +
     /*
      * Follow real hardware, cirrus card emulated has 4 MB video memory.
      * Also accept 8 MB/16 MB for backward compatibility.
 diff --git a/hw/ide/piix.c b/hw/ide/piix.c
 index 80efc633d3..9cb82b8eea 100644
 --- a/hw/ide/piix.c
 +++ b/hw/ide/piix.c
@@ -191,7 +191,8 @@ static void piix3_ide_class_init(ObjectClass *klass, void *data)
     k->device_id = PCI_DEVICE_ID_INTEL_82371SB_1;
     k->class_id = PCI_CLASS_STORAGE_IDE;
     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 -    dc->hotpluggable = false;
 +    /* Disabled for Red Hat Enterprise Linux: */
 +    dc->user_creatable = false;
 }
 static const TypeInfo piix3_ide_info = {
@@ -215,6 +216,8 @@ static void piix4_ide_class_init(ObjectClass *klass, void *data)
     k->class_id = PCI_CLASS_STORAGE_IDE;
     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->hotpluggable = false;
 +    /* Disabled for Red Hat Enterprise Linux: */
 +    dc->user_creatable = false;
 }
 static const TypeInfo piix4_ide_info = {
 diff --git a/hw/input/pckbd.c b/hw/input/pckbd.c
 index 74f10b640f..2e85ecf476 100644
 --- a/hw/input/pckbd.c
 +++ b/hw/input/pckbd.c
@@ -952,6 +952,8 @@ static void i8042_class_initfn(ObjectClass *klass, void *data)
     dc->vmsd = &vmstate_kbd_isa;
     adevc->build_dev_aml = i8042_build_aml;
     set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
 +    /* Disabled for Red Hat Enterprise Linux: */
 +    dc->user_creatable = false;
 }
 static const TypeInfo i8042_info = {
 diff --git a/hw/net/e1000.c b/hw/net/e1000.c
 index 43f3a4a701..267f182883 100644
 --- a/hw/net/e1000.c
 +++ b/hw/net/e1000.c
@@ -1746,6 +1746,7 @@ static const E1000Info e1000_devices[] = {
         .revision  = 0x03,
         .phy_id2   = E1000_PHY_ID2_8254xx_DEFAULT,
     },
 +#if 0 /* Disabled for Red Hat Enterprise Linux 7 */
     {
         .name      = "e1000-82544gc",
         .device_id = E1000_DEV_ID_82544GC_COPPER,
@@ -1758,6 +1759,7 @@ static const E1000Info e1000_devices[] = {
         .revision  = 0x03,
         .phy_id2   = E1000_PHY_ID2_8254xx_DEFAULT,
     },
 +#endif
 };
 static void e1000_register_types(void)
 diff --git a/hw/usb/meson.build b/hw/usb/meson.build
 index aac3bb35f2..5411ff35df 100644
 --- a/hw/usb/meson.build
 +++ b/hw/usb/meson.build
@@ -55,7 +55,7 @@ system_ss.add(when: 'CONFIG_USB_SMARTCARD', if_true: files('dev-smartcard-reader
 if cacard.found()
   usbsmartcard_ss = ss.source_set()
   usbsmartcard_ss.add(when: 'CONFIG_USB_SMARTCARD',
 -                      if_true: [cacard, files('ccid-card-emulated.c', 'ccid-card-passthru.c')])
 +                      if_true: [cacard, files('ccid-card-passthru.c')])
   hw_usb_modules += {'smartcard': usbsmartcard_ss}
 endif
 diff --git a/hw/virtio/meson.build b/hw/virtio/meson.build
 index d7f18c96e6..aaabbb8b0b 100644
 --- a/hw/virtio/meson.build
 +++ b/hw/virtio/meson.build
@@ -20,7 +20,8 @@ if have_vhost
     system_virtio_ss.add(files('vhost-user-base.c'))
     # MMIO Stubs
 -    system_virtio_ss.add(files('vhost-user-device.c'))
 +# Disabled for 8.2.0 rebase for RHEL 9.4.0
 +#    system_virtio_ss.add(files('vhost-user-device.c'))
     system_virtio_ss.add(when: 'CONFIG_VHOST_USER_GPIO', if_true: files('vhost-user-gpio.c'))
     system_virtio_ss.add(when: 'CONFIG_VHOST_USER_I2C', if_true: files('vhost-user-i2c.c'))
     system_virtio_ss.add(when: 'CONFIG_VHOST_USER_RNG', if_true: files('vhost-user-rng.c'))
@@ -28,7 +29,8 @@ if have_vhost
     system_virtio_ss.add(when: 'CONFIG_VHOST_USER_INPUT', if_true: files('vhost-user-input.c'))
     # PCI Stubs
 -    system_virtio_ss.add(when: 'CONFIG_VIRTIO_PCI', if_true: files('vhost-user-device-pci.c'))
 +# Disabled for 8.2.0 rebase for RHEL 9.4.0
 +#    system_virtio_ss.add(when: 'CONFIG_VIRTIO_PCI', if_true: files('vhost-user-device-pci.c'))
     system_virtio_ss.add(when: ['CONFIG_VIRTIO_PCI', 'CONFIG_VHOST_USER_GPIO'],
                          if_true: files('vhost-user-gpio-pci.c'))
     system_virtio_ss.add(when: ['CONFIG_VIRTIO_PCI', 'CONFIG_VHOST_USER_I2C'],
 diff --git a/target/arm/arm-qmp-cmds.c b/target/arm/arm-qmp-cmds.c
 index 3cc8cc738b..6f21fea1f5 100644
 --- a/target/arm/arm-qmp-cmds.c
 +++ b/target/arm/arm-qmp-cmds.c
@@ -223,6 +223,7 @@ CpuModelExpansionInfo *qmp_query_cpu_model_expansion(CpuModelExpansionType type,
 static void arm_cpu_add_definition(gpointer data, gpointer user_data)
 {
     ObjectClass *oc = data;
 +    CPUClass *cc = CPU_CLASS(oc);
     CpuDefinitionInfoList **cpu_list = user_data;
     CpuDefinitionInfo *info;
     const char *typename;
@@ -231,6 +232,7 @@ static void arm_cpu_add_definition(gpointer data, gpointer user_data)
     info = g_malloc0(sizeof(*info));
     info->name = cpu_model_from_type(typename);
     info->q_typename = g_strdup(typename);
 +    info->deprecated = !!cc->deprecation_note;
     QAPI_LIST_PREPEND(*cpu_list, info);
 }
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index ab8d007a86..e5dce20f19 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -2546,6 +2546,10 @@ static void cpu_register_class_init(ObjectClass *oc, void *data)
     acc->info = data;
     cc->gdb_core_xml_file = "arm-core.xml";
 +
 +    if (acc->info->deprecation_note) {
 +        cc->deprecation_note = acc->info->deprecation_note;
 +    }
 }
 void arm_cpu_register(const ARMCPUInfo *info)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index bc0c84873f..e9472c8bb8 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
@@ -37,6 +37,8 @@
 #define KVM_HAVE_MCE_INJECTION 1
 #endif
 +#define RHEL_CPU_DEPRECATION "use 'host' / 'max'"
 +
 #define EXCP_UDEF            1   /* undefined instruction */
 #define EXCP_SWI             2   /* software interrupt */
 #define EXCP_PREFETCH_ABORT  3
@@ -1092,6 +1094,7 @@ typedef struct ARMCPUInfo {
     const char *name;
     void (*initfn)(Object *obj);
     void (*class_init)(ObjectClass *oc, void *data);
 +    const char *deprecation_note;
 } ARMCPUInfo;
 /**
 diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index 985b1efe16..46a4e80171 100644
 --- a/target/arm/cpu64.c
 +++ b/target/arm/cpu64.c
@@ -648,6 +648,7 @@ static void aarch64_a57_initfn(Object *obj)
     define_cortex_a72_a57_a53_cp_reginfo(cpu);
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void aarch64_a53_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
@@ -704,6 +705,7 @@ static void aarch64_a53_initfn(Object *obj)
     cpu->gic_pribits = 5;
     define_cortex_a72_a57_a53_cp_reginfo(cpu);
 }
 +#endif
 static void aarch64_host_initfn(Object *obj)
 {
@@ -742,8 +744,11 @@ static void aarch64_max_initfn(Object *obj)
 }
 static const ARMCPUInfo aarch64_cpus[] = {
 -    { .name = "cortex-a57",         .initfn = aarch64_a57_initfn },
 +    { .name = "cortex-a57",         .initfn = aarch64_a57_initfn,
 +      .deprecation_note = RHEL_CPU_DEPRECATION },
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
     { .name = "cortex-a53",         .initfn = aarch64_a53_initfn },
 +#endif /* disabled for RHEL */
     { .name = "max",                .initfn = aarch64_max_initfn },
 #if defined(CONFIG_KVM) || defined(CONFIG_HVF)
     { .name = "host",               .initfn = aarch64_host_initfn },
@@ -814,8 +819,13 @@ static void aarch64_cpu_instance_init(Object *obj)
 static void cpu_register_class_init(ObjectClass *oc, void *data)
 {
     ARMCPUClass *acc = ARM_CPU_CLASS(oc);
 +    CPUClass *cc = CPU_CLASS(oc);
     acc->info = data;
 +
 +    if (acc->info->deprecation_note) {
 +        cc->deprecation_note = acc->info->deprecation_note;
 +    }
 }
 void aarch64_cpu_register(const ARMCPUInfo *info)
 diff --git a/target/arm/tcg/cpu32.c b/target/arm/tcg/cpu32.c
 index de8f2be941..8896295ae3 100644
 --- a/target/arm/tcg/cpu32.c
 +++ b/target/arm/tcg/cpu32.c
@@ -92,6 +92,7 @@ void aa32_max_features(ARMCPU *cpu)
     cpu->isar.id_dfr1 = t;
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 /* CPU models. These are not needed for the AArch64 linux-user build. */
 #if !defined(CONFIG_USER_ONLY) || !defined(TARGET_AARCH64)
@@ -1037,3 +1038,4 @@ static void arm_tcg_cpu_register_types(void)
 type_init(arm_tcg_cpu_register_types)
 #endif /* !CONFIG_USER_ONLY || !TARGET_AARCH64 */
 +#endif /* disabled for RHEL */
 diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
 index 9f7a9f3d2c..7ec6851c9c 100644
 --- a/target/arm/tcg/cpu64.c
 +++ b/target/arm/tcg/cpu64.c
@@ -29,6 +29,7 @@
 #include "cpu-features.h"
 #include "cpregs.h"
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static uint64_t make_ccsidr64(unsigned assoc, unsigned linesize,
                               unsigned cachesize)
 {
@@ -134,6 +135,7 @@ static void aarch64_a35_initfn(Object *obj)
     /* These values are the same with A53/A57/A72. */
     define_cortex_a72_a57_a53_cp_reginfo(cpu);
 }
 +#endif
 static void cpu_max_get_sve_max_vq(Object *obj, Visitor *v, const char *name,
                                    void *opaque, Error **errp)
@@ -223,6 +225,7 @@ static void cpu_max_get_l0gptsz(Object *obj, Visitor *v, const char *name,
 static Property arm_cpu_lpa2_property =
     DEFINE_PROP_BOOL("lpa2", ARMCPU, prop_lpa2, true);
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void aarch64_a55_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
@@ -1065,6 +1068,7 @@ static void aarch64_neoverse_n2_initfn(Object *obj)
     aarch64_add_pauth_properties(obj);
     aarch64_add_sve_properties(obj);
 }
 +#endif
 /*
  * -cpu max: a CPU with as many features enabled as our emulation supports.
@@ -1271,6 +1275,7 @@ void aarch64_max_tcg_initfn(Object *obj)
     qdev_property_add_static(DEVICE(obj), &arm_cpu_lpa2_property);
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static const ARMCPUInfo aarch64_cpus[] = {
     { .name = "cortex-a35",         .initfn = aarch64_a35_initfn },
     { .name = "cortex-a55",         .initfn = aarch64_a55_initfn },
@@ -1282,14 +1287,17 @@ static const ARMCPUInfo aarch64_cpus[] = {
     { .name = "neoverse-v1",        .initfn = aarch64_neoverse_v1_initfn },
     { .name = "neoverse-n2",        .initfn = aarch64_neoverse_n2_initfn },
 };
 +#endif
 static void aarch64_cpu_register_types(void)
 {
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
     size_t i;
     for (i = 0; i < ARRAY_SIZE(aarch64_cpus); ++i) {
         aarch64_cpu_register(&aarch64_cpus[i]);
     }
 +#endif
 }
 type_init(aarch64_cpu_register_types)
 diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
 index 3b1a9f0fc5..6c95d99181 100644
 --- a/target/arm/tcg/meson.build
 +++ b/target/arm/tcg/meson.build
@@ -56,5 +56,5 @@ arm_system_ss.add(files(
   'psci.c',
 ))
 -arm_system_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('cpu-v7m.c'))
 +#arm_system_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('cpu-v7m.c'))
 arm_user_ss.add(when: 'TARGET_AARCH64', if_false: files('cpu-v7m.c'))
 diff --git a/target/s390x/cpu_models_sysemu.c b/target/s390x/cpu_models_sysemu.c
 index 2d99218069..0728bfcc20 100644
 --- a/target/s390x/cpu_models_sysemu.c
 +++ b/target/s390x/cpu_models_sysemu.c
@@ -34,6 +34,9 @@ static void check_unavailable_features(const S390CPUModel *max_model,
         (max_model->def->gen == model->def->gen &&
          max_model->def->ec_ga < model->def->ec_ga)) {
         list_add_feat("type", unavailable);
 +    } else if (model->def->gen < 11 && kvm_enabled()) {
 +        /* Older CPU models are not supported on Red Hat Enterprise Linux */
 +        list_add_feat("type", unavailable);
     }
     /* detect missing features if any to properly report them */
 diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c
 index 4ce809c5d4..55fb4855b1 100644
 --- a/target/s390x/kvm/kvm.c
 +++ b/target/s390x/kvm/kvm.c
@@ -2565,6 +2565,14 @@ void kvm_s390_apply_cpu_model(const S390CPUModel *model, Error **errp)
         error_setg(errp, "KVM doesn't support CPU models");
         return;
     }
 +
 +    /* Older CPU models are not supported on Red Hat Enterprise Linux */
 +    if (model->def->gen < 11) {
 +        error_setg(errp, "KVM: Unsupported CPU type specified: %s",
 +                   MACHINE(qdev_get_machine())->cpu_type);
 +        return;
 +    }
 +
     prop.cpuid = s390_cpuid_from_cpu_model(model);
     prop.ibc = s390_ibc_from_cpu_model(model);
     /* configure cpu features indicated via STFL(e) */
 diff --git a/tests/qtest/arm-cpu-features.c b/tests/qtest/arm-cpu-features.c
 index 9d6e6190d5..f822526acb 100644
 --- a/tests/qtest/arm-cpu-features.c
 +++ b/tests/qtest/arm-cpu-features.c
@@ -452,8 +452,10 @@ static void test_query_cpu_model_expansion(const void *data)
     assert_error(qts, "host", "The CPU type 'host' requires KVM", NULL);
     /* Test expected feature presence/absence for some cpu types */
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
     assert_has_feature_enabled(qts, "cortex-a15", "pmu");
     assert_has_not_feature(qts, "cortex-a15", "aarch64");
 +#endif /* disabled for RHEL */
     /* Enabling and disabling pmu should always work. */
     assert_has_feature_enabled(qts, "max", "pmu");
@@ -470,6 +472,7 @@ static void test_query_cpu_model_expansion(const void *data)
         assert_has_feature_enabled(qts, "cortex-a57", "pmu");
         assert_has_feature_enabled(qts, "cortex-a57", "aarch64");
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
         assert_has_feature_enabled(qts, "a64fx", "pmu");
         assert_has_feature_enabled(qts, "a64fx", "aarch64");
         /*
@@ -482,6 +485,7 @@ static void test_query_cpu_model_expansion(const void *data)
                      "{ 'sve384': true }");
         assert_error(qts, "a64fx", "cannot enable sve640",
                      "{ 'sve640': true }");
 +#endif /* disabled for RHEL */
         sve_tests_default(qts, "max");
         pauth_tests_default(qts, "max");
 -- 
 2.39.3
--- a/0006-Machine-type-related-general-changes.patch
+++ b/0006-Machine-type-related-general-changes.patch
@ -1,668 +0,0 @@
 From 802da738d5231ef56d25f4ffcfa6e7d97698ee72 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 11 Jan 2019 09:54:45 +0100
 Subject: Machine type related general changes
 This patch is first part of original "Add RHEL machine types" patch we
 split to allow easier review. It contains changes not related to any
 architecture.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/acpi/piix4.c              |   2 +-
 hw/arm/virt.c                |   2 +-
 hw/core/machine.c            | 269 +++++++++++++++++++++++++++++++++++
 hw/i386/fw_cfg.c             |   3 +-
 hw/net/rtl8139.c             |   4 +-
 hw/smbios/smbios.c           |  46 +++++-
 hw/timer/i8254_common.c      |   2 +-
 hw/usb/hcd-xhci-pci.c        |  59 ++++++--
 hw/usb/hcd-xhci-pci.h        |   1 +
 hw/virtio/virtio-mem.c       |   3 +-
 include/hw/boards.h          |  40 ++++++
 include/hw/firmware/smbios.h |   4 +-
 include/hw/i386/pc.h         |   3 +
 13 files changed, 414 insertions(+), 24 deletions(-)
 diff --git a/hw/acpi/piix4.c b/hw/acpi/piix4.c
 index debe1adb84..e8ddcd716e 100644
 --- a/hw/acpi/piix4.c
 +++ b/hw/acpi/piix4.c
@@ -245,7 +245,7 @@ static bool vmstate_test_migrate_acpi_index(void *opaque, int version_id)
 static const VMStateDescription vmstate_acpi = {
     .name = "piix4_pm",
     .version_id = 3,
 -    .minimum_version_id = 3,
 +    .minimum_version_id = 2,
     .post_load = vmstate_acpi_post_load,
     .fields = (const VMStateField[]) {
         VMSTATE_PCI_DEVICE(parent_obj, PIIX4PMState),
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index 6c6d155002..36e9b4b4e9 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
@@ -1651,7 +1651,7 @@ static void virt_build_smbios(VirtMachineState *vms)
     smbios_set_defaults("QEMU", product,
                         vmc->smbios_old_sys_ver ? "1.0" : mc->name,
 -                        true);
 +                        true, NULL, NULL);
     /* build the array of physical mem area from base_memmap */
     mem_array.address = vms->memmap[VIRT_MEM].base;
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index 37ede0e7d4..695cb89a46 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -296,6 +296,275 @@ GlobalProperty hw_compat_2_1[] = {
 };
 const size_t hw_compat_2_1_len = G_N_ELEMENTS(hw_compat_2_1);
 +/*
 + * RHEL only: machine types for previous major releases are deprecated
 + */
 +const char *rhel_old_machine_deprecation =
 +    "machine types for previous major releases are deprecated";
 +
 +GlobalProperty hw_compat_rhel_9_4[] = {
 +  /* hw_compat_rhel_9_4 from hw_compat_8_0 */
 +    { TYPE_VIRTIO_NET, "host_uso", "off"},
 +  /* hw_compat_rhel_9_4 from hw_compat_8_0 */
 +    { TYPE_VIRTIO_NET, "guest_uso4", "off"},
 +  /* hw_compat_rhel_9_4 from hw_compat_8_0 */
 +    { TYPE_VIRTIO_NET, "guest_uso6", "off"},
 +  /* hw_compat_rhel_9_4 from hw_compat_8_1 */
 +     { TYPE_PCI_BRIDGE, "x-pci-express-writeable-slt-bug", "true" },
 +  /* hw_compat_rhel_9_4 from hw_compat_8_1 */
 +     { "ramfb", "x-migrate", "off" },
 +  /* hw_compat_rhel_9_4 from hw_compat_8_1 */
 +     { "vfio-pci-nohotplug", "x-ramfb-migrate", "off" },
 +  /* hw_compat_rhel_9_4 from hw_compat_8_1 */
 +     { "igb", "x-pcie-flr-init", "off" },
 +  /* hw_compat_rhel_9_4 jira RHEL-24045 */
 +     { "virtio-mem", "dynamic-memslots", "off" },
 +};
 +const size_t hw_compat_rhel_9_4_len = G_N_ELEMENTS(hw_compat_rhel_9_4);
 +
 +GlobalProperty hw_compat_rhel_9_3[] = {
 +  /* hw_compat_rhel_9_3 from hw_compat_8_0 */
 +  { "migration", "multifd-flush-after-each-section", "on"},
 +  /* hw_compat_rhel_9_3 from hw_compat_8_0 */
 +  { TYPE_PCI_DEVICE, "x-pcie-ari-nextfn-1", "on" },
 +};
 +const size_t hw_compat_rhel_9_3_len = G_N_ELEMENTS(hw_compat_rhel_9_3);
 +
 +GlobalProperty hw_compat_rhel_9_2[] = {
 +  /* hw_compat_rhel_9_2 from hw_compat_7_2 */
 +  { "e1000e", "migrate-timadj", "off" },
 +  /* hw_compat_rhel_9_2 from hw_compat_7_2 */
 +  { "virtio-mem", "x-early-migration", "false" },
 +  /* hw_compat_rhel_9_2 from hw_compat_7_2 */
 +  { "migration", "x-preempt-pre-7-2", "true" },
 +  /* hw_compat_rhel_9_2 from hw_compat_7_2 */
 +  { TYPE_PCI_DEVICE, "x-pcie-err-unc-mask", "off" },
 +};
 +const size_t hw_compat_rhel_9_2_len = G_N_ELEMENTS(hw_compat_rhel_9_2);
 +
 +/*
 + * Mostly the same as hw_compat_7_0
 + */
 +GlobalProperty hw_compat_rhel_9_1[] = {
 +  /* hw_compat_rhel_9_1 from hw_compat_7_0 */
 +  { "arm-gicv3-common", "force-8-bit-prio", "on" },
 +  /* hw_compat_rhel_9_1 from hw_compat_7_0 */
 +  { "nvme-ns", "eui64-default", "on"},
 +  /* hw_compat_rhel_9_1 from hw_compat_7_1 */
 +  { "virtio-device", "queue_reset", "false" },
 +  /* hw_compat_rhel_9_1 bz 2155749 */
 +  { "virtio-rng-pci", "vectors", "0" },
 +  /* hw_compat_rhel_9_1 bz 2162569 */
 +  { "virtio-rng-pci-transitional", "vectors", "0" },
 +  { "virtio-rng-pci-non-transitional", "vectors", "0" },
 +};
 +const size_t hw_compat_rhel_9_1_len = G_N_ELEMENTS(hw_compat_rhel_9_1);
 +
 +/*
 + * Mostly the same as hw_compat_6_2
 + */
 +GlobalProperty hw_compat_rhel_9_0[] = {
 +    /* hw_compat_rhel_9_0 from hw_compat_6_2 */
 +    { "PIIX4_PM", "x-not-migrate-acpi-index", "on"},
 +};
 +const size_t hw_compat_rhel_9_0_len = G_N_ELEMENTS(hw_compat_rhel_9_0);
 +
 +GlobalProperty hw_compat_rhel_8_6[] = {
 +    /* hw_compat_rhel_8_6 bz 2065589 */
 +    /*
 +     * vhost-vsock device in RHEL 8 kernels doesn't support seqpacket, so
 +     * we need do disable it downstream on the latest hw_compat_rhel_8.
 +     */
 +    { "vhost-vsock-device", "seqpacket", "off" },
 +};
 +const size_t hw_compat_rhel_8_6_len = G_N_ELEMENTS(hw_compat_rhel_8_6);
 +
 +/*
 + * Mostly the same as hw_compat_6_0 and hw_compat_6_1
 + */
 +GlobalProperty hw_compat_rhel_8_5[] = {
 +    /* hw_compat_rhel_8_5 from hw_compat_6_0 */
 +    { "gpex-pcihost", "allow-unmapped-accesses", "false" },
 +    /* hw_compat_rhel_8_5 from hw_compat_6_0 */
 +    { "i8042", "extended-state", "false"},
 +    /* hw_compat_rhel_8_5 from hw_compat_6_0 */
 +    { "nvme-ns", "eui64-default", "off"},
 +    /* hw_compat_rhel_8_5 from hw_compat_6_0 */
 +    { "e1000", "init-vet", "off" },
 +    /* hw_compat_rhel_8_5 from hw_compat_6_0 */
 +    { "e1000e", "init-vet", "off" },
 +    /* hw_compat_rhel_8_5 from hw_compat_6_0 */
 +    { "vhost-vsock-device", "seqpacket", "off" },
 +    /* hw_compat_rhel_8_5 from hw_compat_6_1 */
 +    { "vhost-user-vsock-device", "seqpacket", "off" },
 +    /* hw_compat_rhel_8_5 from hw_compat_6_1 */
 +    { "nvme-ns", "shared", "off" },
 +};
 +const size_t hw_compat_rhel_8_5_len = G_N_ELEMENTS(hw_compat_rhel_8_5);
 +
 +/*
 + * Mostly the same as hw_compat_5_2
 + */
 +GlobalProperty hw_compat_rhel_8_4[] = {
 +    /* hw_compat_rhel_8_4 from hw_compat_5_2 */
 +    { "ICH9-LPC", "smm-compat", "on"},
 +    /* hw_compat_rhel_8_4 from hw_compat_5_2 */
 +    { "PIIX4_PM", "smm-compat", "on"},
 +    /* hw_compat_rhel_8_4 from hw_compat_5_2 */
 +    { "virtio-blk-device", "report-discard-granularity", "off" },
 +    /* hw_compat_rhel_8_4 from hw_compat_5_2 */
 +    /*
 +     * Upstream incorrectly had "virtio-net-pci" instead of "virtio-net-pci-base",
 +     * (https://bugzilla.redhat.com/show_bug.cgi?id=1999141)
 +     */
 +    { "virtio-net-pci-base", "vectors", "3"},
 +};
 +const size_t hw_compat_rhel_8_4_len = G_N_ELEMENTS(hw_compat_rhel_8_4);
 +
 +/*
 + * Mostly the same as hw_compat_5_1
 + */
 +GlobalProperty hw_compat_rhel_8_3[] = {
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "vhost-scsi", "num_queues", "1"},
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "vhost-user-blk", "num-queues", "1"},
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "vhost-user-scsi", "num_queues", "1"},
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "virtio-blk-device", "num-queues", "1"},
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "virtio-scsi-device", "num_queues", "1"},
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "nvme", "use-intel-id", "on"},
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "pvpanic", "events", "1"}, /* PVPANIC_PANICKED */
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "pl011", "migrate-clk", "off" },
 +    /* hw_compat_rhel_8_3 bz 1912846 */
 +    { "pci-xhci", "x-rh-late-msi-cap", "off" },
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "virtio-pci", "x-ats-page-aligned", "off"},
 +};
 +const size_t hw_compat_rhel_8_3_len = G_N_ELEMENTS(hw_compat_rhel_8_3);
 +
 +/*
 + * The same as hw_compat_4_2 + hw_compat_5_0
 + */
 +GlobalProperty hw_compat_rhel_8_2[] = {
 +    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
 +    { "virtio-blk-device", "queue-size", "128"},
 +    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
 +    { "virtio-scsi-device", "virtqueue_size", "128"},
 +    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
 +    { "virtio-blk-device", "x-enable-wce-if-config-wce", "off" },
 +    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
 +    { "virtio-blk-device", "seg-max-adjust", "off"},
 +    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
 +    { "virtio-scsi-device", "seg_max_adjust", "off"},
 +    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
 +    { "vhost-blk-device", "seg_max_adjust", "off"},
 +    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
 +    { "usb-host", "suppress-remote-wake", "off" },
 +    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
 +    { "usb-redir", "suppress-remote-wake", "off" },
 +    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
 +    { "qxl", "revision", "4" },
 +    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
 +    { "qxl-vga", "revision", "4" },
 +    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
 +    { "fw_cfg", "acpi-mr-restore", "false" },
 +    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
 +    { "virtio-device", "use-disabled-flag", "false" },
 +    /* hw_compat_rhel_8_2 from hw_compat_5_0 */
 +    { "pci-host-bridge", "x-config-reg-migration-enabled", "off" },
 +    /* hw_compat_rhel_8_2 from hw_compat_5_0 */
 +    { "virtio-balloon-device", "page-poison", "false" },
 +    /* hw_compat_rhel_8_2 from hw_compat_5_0 */
 +    { "vmport", "x-read-set-eax", "off" },
 +    /* hw_compat_rhel_8_2 from hw_compat_5_0 */
 +    { "vmport", "x-signal-unsupported-cmd", "off" },
 +    /* hw_compat_rhel_8_2 from hw_compat_5_0 */
 +    { "vmport", "x-report-vmx-type", "off" },
 +    /* hw_compat_rhel_8_2 from hw_compat_5_0 */
 +    { "vmport", "x-cmds-v2", "off" },
 +    /* hw_compat_rhel_8_2 from hw_compat_5_0 */
 +    { "virtio-device", "x-disable-legacy-check", "true" },
 +};
 +const size_t hw_compat_rhel_8_2_len = G_N_ELEMENTS(hw_compat_rhel_8_2);
 +
 +/*
 + * The same as hw_compat_4_1
 + */
 +GlobalProperty hw_compat_rhel_8_1[] = {
 +    /* hw_compat_rhel_8_1 from hw_compat_4_1 */
 +    { "virtio-pci", "x-pcie-flr-init", "off" },
 +};
 +const size_t hw_compat_rhel_8_1_len = G_N_ELEMENTS(hw_compat_rhel_8_1);
 +
 +/* The same as hw_compat_3_1
 + * format of array has been changed by:
 + *     6c36bddf5340 ("machine: Use shorter format for GlobalProperty arrays")
 + */
 +GlobalProperty hw_compat_rhel_8_0[] = {
 +    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
 +    { "pcie-root-port", "x-speed", "2_5" },
 +    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
 +    { "pcie-root-port", "x-width", "1" },
 +    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
 +    { "memory-backend-file", "x-use-canonical-path-for-ramblock-id", "true" },
 +    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
 +    { "memory-backend-memfd", "x-use-canonical-path-for-ramblock-id", "true" },
 +    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
 +    { "tpm-crb", "ppi", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
 +    { "tpm-tis", "ppi", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
 +    { "usb-kbd", "serial", "42" },
 +    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
 +    { "usb-mouse", "serial", "42" },
 +    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
 +    { "usb-tablet", "serial", "42" },
 +    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
 +    { "virtio-blk-device", "discard", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
 +    { "virtio-blk-device", "write-zeroes", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_4_0 */
 +    { "VGA",            "edid", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_4_0 */
 +    { "secondary-vga",  "edid", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_4_0 */
 +    { "bochs-display",  "edid", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_4_0 */
 +    { "virtio-vga",     "edid", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_4_0 */
 +    { "virtio-gpu-device", "edid", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_4_0 */
 +    { "virtio-device", "use-started", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_3_1 - that was added in 4.1 */
 +    { "pcie-root-port-base", "disable-acs", "true" },
 +};
 +const size_t hw_compat_rhel_8_0_len = G_N_ELEMENTS(hw_compat_rhel_8_0);
 +
 +/* The same as hw_compat_3_0 + hw_compat_2_12
 + * except that
 + *   there's nothing in 3_0
 + *   migration.decompress-error-check=off was in 7.5 from bz 1584139
 + */
 +GlobalProperty hw_compat_rhel_7_6[] = {
 +    /* hw_compat_rhel_7_6 from hw_compat_2_12 */
 +    { "hda-audio", "use-timer", "false" },
 +    /* hw_compat_rhel_7_6 from hw_compat_2_12 */
 +    { "cirrus-vga", "global-vmstate", "true" },
 +    /* hw_compat_rhel_7_6 from hw_compat_2_12 */
 +    { "VGA", "global-vmstate", "true" },
 +    /* hw_compat_rhel_7_6 from hw_compat_2_12 */
 +    { "vmware-svga", "global-vmstate", "true" },
 +    /* hw_compat_rhel_7_6 from hw_compat_2_12 */
 +    { "qxl-vga", "global-vmstate",  "true" },
 +};
 +const size_t hw_compat_rhel_7_6_len = G_N_ELEMENTS(hw_compat_rhel_7_6);
 +
 MachineState *current_machine;
 static char *machine_get_kernel(Object *obj, Error **errp)
 diff --git a/hw/i386/fw_cfg.c b/hw/i386/fw_cfg.c
 index d802d2787f..c7aa39a13e 100644
 --- a/hw/i386/fw_cfg.c
 +++ b/hw/i386/fw_cfg.c
@@ -64,7 +64,8 @@ void fw_cfg_build_smbios(PCMachineState *pcms, FWCfgState *fw_cfg,
     if (pcmc->smbios_defaults) {
         /* These values are guest ABI, do not change */
         smbios_set_defaults("QEMU", mc->desc, mc->name,
 -                            pcmc->smbios_uuid_encoded);
 +                            pcmc->smbios_uuid_encoded,
 +                            pcmc->smbios_stream_product, pcmc->smbios_stream_version);
     }
     /* tell smbios about cpuid version and features */
 diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
 index 897c86ec41..2d0db43f49 100644
 --- a/hw/net/rtl8139.c
 +++ b/hw/net/rtl8139.c
@@ -3169,7 +3169,7 @@ static int rtl8139_pre_save(void *opaque)
 static const VMStateDescription vmstate_rtl8139 = {
     .name = "rtl8139",
 -    .version_id = 5,
 +    .version_id = 4,
     .minimum_version_id = 3,
     .post_load = rtl8139_post_load,
     .pre_save  = rtl8139_pre_save,
@@ -3250,7 +3250,9 @@ static const VMStateDescription vmstate_rtl8139 = {
         VMSTATE_UINT32(tally_counters.TxMCol, RTL8139State),
         VMSTATE_UINT64(tally_counters.RxOkPhy, RTL8139State),
         VMSTATE_UINT64(tally_counters.RxOkBrd, RTL8139State),
 +#if 0 /* Disabled for Red Hat Enterprise Linux bz 1420195 */
         VMSTATE_UINT32_V(tally_counters.RxOkMul, RTL8139State, 5),
 +#endif
         VMSTATE_UINT16(tally_counters.TxAbt, RTL8139State),
         VMSTATE_UINT16(tally_counters.TxUndrn, RTL8139State),
 diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c
 index eed5787b15..68608a3403 100644
 --- a/hw/smbios/smbios.c
 +++ b/hw/smbios/smbios.c
@@ -39,6 +39,10 @@ size_t usr_blobs_len;
 static unsigned usr_table_max;
 static unsigned usr_table_cnt;
 +/* Set to true for modern Windows 10 HardwareID-6 compat */
 +static bool smbios_type2_required;
 +
 +
 uint8_t *smbios_tables;
 size_t smbios_tables_len;
 unsigned smbios_table_max;
@@ -629,7 +633,7 @@ static void smbios_build_type_1_table(void)
 static void smbios_build_type_2_table(void)
 {
 -    SMBIOS_BUILD_TABLE_PRE(2, T2_BASE, false); /* optional */
 +    SMBIOS_BUILD_TABLE_PRE(2, T2_BASE, smbios_type2_required);
     SMBIOS_TABLE_SET_STR(2, manufacturer_str, type2.manufacturer);
     SMBIOS_TABLE_SET_STR(2, product_str, type2.product);
@@ -1018,16 +1022,52 @@ void smbios_set_default_processor_family(uint16_t processor_family)
 void smbios_set_defaults(const char *manufacturer, const char *product,
                          const char *version,
 -                         bool uuid_encoded)
 +                         bool uuid_encoded,
 +                         const char *stream_product,
 +                         const char *stream_version)
 {
     smbios_have_defaults = true;
     smbios_uuid_encoded = uuid_encoded;
 +    /*
 +     * If @stream_product & @stream_version are non-NULL, then
 +     * we're following rules for new Windows driver support.
 +     * The data we have to report is defined in this doc:
 +     *
 +     * https://docs.microsoft.com/en-us/windows-hardware/drivers/install/specifying-hardware-ids-for-a-computer
 +     *
 +     * The Windows drivers are written to expect use of the
 +     * scheme documented as "HardwareID-6" against Windows 10,
 +     * which uses SMBIOS System (Type 1) and Base Board (Type 2)
 +     * tables and will match on
 +     *
 +     *   System Manufacturer = Red Hat     (@manufacturer)
 +     *   System SKU Number = 8.2.0         (@stream_version)
 +     *   Baseboard Manufacturer = Red Hat  (@manufacturer)
 +     *   Baseboard Product = RHEL-AV       (@stream_product)
 +     *
 +     * NB, SKU must be changed with each RHEL-AV release
 +     *
 +     * Other fields can be freely used by applications using
 +     * QEMU. For example apps can use the "System product"
 +     * and "System version" to identify themselves.
 +     *
 +     * We get 'System Manufacturer' and 'Baseboard Manufacturer'
 +     */
     SMBIOS_SET_DEFAULT(smbios_type1.manufacturer, manufacturer);
     SMBIOS_SET_DEFAULT(smbios_type1.product, product);
     SMBIOS_SET_DEFAULT(smbios_type1.version, version);
 +    SMBIOS_SET_DEFAULT(smbios_type1.family, "Red Hat Enterprise Linux");
 +    if (stream_version != NULL) {
 +        SMBIOS_SET_DEFAULT(smbios_type1.sku, stream_version);
 +    }
     SMBIOS_SET_DEFAULT(type2.manufacturer, manufacturer);
 -    SMBIOS_SET_DEFAULT(type2.product, product);
 +    if (stream_product != NULL) {
 +        SMBIOS_SET_DEFAULT(type2.product, stream_product);
 +        smbios_type2_required = true;
 +    } else {
 +        SMBIOS_SET_DEFAULT(type2.product, product);
 +    }
     SMBIOS_SET_DEFAULT(type2.version, version);
     SMBIOS_SET_DEFAULT(type3.manufacturer, manufacturer);
     SMBIOS_SET_DEFAULT(type3.version, version);
 diff --git a/hw/timer/i8254_common.c b/hw/timer/i8254_common.c
 index 28fdabc321..bad13ec224 100644
 --- a/hw/timer/i8254_common.c
 +++ b/hw/timer/i8254_common.c
@@ -229,7 +229,7 @@ static const VMStateDescription vmstate_pit_common = {
     .pre_save = pit_dispatch_pre_save,
     .post_load = pit_dispatch_post_load,
     .fields = (const VMStateField[]) {
 -        VMSTATE_UINT32_V(channels[0].irq_disabled, PITCommonState, 3),
 +        VMSTATE_UINT32(channels[0].irq_disabled, PITCommonState), /* qemu-kvm's v2 had 'flags' here */
         VMSTATE_STRUCT_ARRAY(channels, PITCommonState, 3, 2,
                              vmstate_pit_channel, PITChannelState),
         VMSTATE_INT64(channels[0].next_transition_time,
 diff --git a/hw/usb/hcd-xhci-pci.c b/hw/usb/hcd-xhci-pci.c
 index 4423983308..43b4b71fdf 100644
 --- a/hw/usb/hcd-xhci-pci.c
 +++ b/hw/usb/hcd-xhci-pci.c
@@ -104,6 +104,33 @@ static int xhci_pci_vmstate_post_load(void *opaque, int version_id)
    return 0;
 }
 +/* RH bz 1912846 */
 +static bool usb_xhci_pci_add_msi(struct PCIDevice *dev, Error **errp)
 +{
 +    int ret;
 +    Error *err = NULL;
 +    XHCIPciState *s = XHCI_PCI(dev);
 +
 +    ret = msi_init(dev, 0x70, s->xhci.numintrs, true, false, &err);
 +    /*
 +     * Any error other than -ENOTSUP(board's MSI support is broken)
 +     * is a programming error
 +     */
 +    assert(!ret || ret == -ENOTSUP);
 +    if (ret && s->msi == ON_OFF_AUTO_ON) {
 +        /* Can't satisfy user's explicit msi=on request, fail */
 +        error_append_hint(&err, "You have to use msi=auto (default) or "
 +                "msi=off with this machine type.\n");
 +        error_propagate(errp, err);
 +        return true;
 +    }
 +    assert(!err || s->msi == ON_OFF_AUTO_AUTO);
 +    /* With msi=auto, we fall back to MSI off silently */
 +    error_free(err);
 +
 +    return false;
 +}
 +
 static void usb_xhci_pci_realize(struct PCIDevice *dev, Error **errp)
 {
     int ret;
@@ -125,23 +152,12 @@ static void usb_xhci_pci_realize(struct PCIDevice *dev, Error **errp)
         s->xhci.nec_quirks = true;
     }
 -    if (s->msi != ON_OFF_AUTO_OFF) {
 -        ret = msi_init(dev, 0x70, s->xhci.numintrs, true, false, &err);
 -        /*
 -         * Any error other than -ENOTSUP(board's MSI support is broken)
 -         * is a programming error
 -         */
 -        assert(!ret || ret == -ENOTSUP);
 -        if (ret && s->msi == ON_OFF_AUTO_ON) {
 -            /* Can't satisfy user's explicit msi=on request, fail */
 -            error_append_hint(&err, "You have to use msi=auto (default) or "
 -                    "msi=off with this machine type.\n");
 +    if (s->msi != ON_OFF_AUTO_OFF && s->rh_late_msi_cap) {
 +        /* This gives the behaviour from 5.2.0 onwards, lspci shows 90,a0,70 */
 +        if (usb_xhci_pci_add_msi(dev, &err)) {
             error_propagate(errp, err);
             return;
         }
 -        assert(!err || s->msi == ON_OFF_AUTO_AUTO);
 -        /* With msi=auto, we fall back to MSI off silently */
 -        error_free(err);
     }
     pci_register_bar(dev, 0,
                      PCI_BASE_ADDRESS_SPACE_MEMORY |
@@ -154,6 +170,14 @@ static void usb_xhci_pci_realize(struct PCIDevice *dev, Error **errp)
         assert(ret > 0);
     }
 +    /* RH bz 1912846 */
 +    if (s->msi != ON_OFF_AUTO_OFF && !s->rh_late_msi_cap) {
 +        /* This gives the older RH machine behaviour, lspci shows 90,70,a0 */
 +        if (usb_xhci_pci_add_msi(dev, &err)) {
 +            error_propagate(errp, err);
 +            return;
 +        }
 +    }
     if (s->msix != ON_OFF_AUTO_OFF) {
         /* TODO check for errors, and should fail when msix=on */
         msix_init(dev, s->xhci.numintrs,
@@ -198,11 +222,18 @@ static void xhci_instance_init(Object *obj)
     qdev_alias_all_properties(DEVICE(&s->xhci), obj);
 }
 +static Property xhci_pci_properties[] = {
 +    /* RH bz 1912846 */
 +    DEFINE_PROP_BOOL("x-rh-late-msi-cap", XHCIPciState, rh_late_msi_cap, true),
 +    DEFINE_PROP_END_OF_LIST()
 +};
 +
 static void xhci_class_init(ObjectClass *klass, void *data)
 {
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
 +    device_class_set_props(dc, xhci_pci_properties);
     dc->reset   = xhci_pci_reset;
     dc->vmsd    = &vmstate_xhci_pci;
     set_bit(DEVICE_CATEGORY_USB, dc->categories);
 diff --git a/hw/usb/hcd-xhci-pci.h b/hw/usb/hcd-xhci-pci.h
 index 08f70ce97c..1be7527c1b 100644
 --- a/hw/usb/hcd-xhci-pci.h
 +++ b/hw/usb/hcd-xhci-pci.h
@@ -40,6 +40,7 @@ typedef struct XHCIPciState {
     XHCIState xhci;
     OnOffAuto msi;
     OnOffAuto msix;
 +    bool      rh_late_msi_cap;  /* bz 1912846 */
 } XHCIPciState;
 #endif
 diff --git a/hw/virtio/virtio-mem.c b/hw/virtio/virtio-mem.c
 index ffd119ebac..0e2be2219c 100644
 --- a/hw/virtio/virtio-mem.c
 +++ b/hw/virtio/virtio-mem.c
@@ -1694,8 +1694,9 @@ static Property virtio_mem_properties[] = {
 #endif
     DEFINE_PROP_BOOL(VIRTIO_MEM_EARLY_MIGRATION_PROP, VirtIOMEM,
                      early_migration, true),
 +    /* RHEL: default-enable "dynamic-memslots" (jira RHEL-24045) */
     DEFINE_PROP_BOOL(VIRTIO_MEM_DYNAMIC_MEMSLOTS_PROP, VirtIOMEM,
 -                     dynamic_memslots, false),
 +                     dynamic_memslots, true),
     DEFINE_PROP_END_OF_LIST(),
 };
 diff --git a/include/hw/boards.h b/include/hw/boards.h
 index 8b8f6d5c00..0466f9d0f3 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
@@ -512,4 +512,44 @@ extern const size_t hw_compat_2_2_len;
 extern GlobalProperty hw_compat_2_1[];
 extern const size_t hw_compat_2_1_len;
 +extern GlobalProperty hw_compat_rhel_9_4[];
 +extern const size_t hw_compat_rhel_9_4_len;
 +
 +extern GlobalProperty hw_compat_rhel_9_3[];
 +extern const size_t hw_compat_rhel_9_3_len;
 +
 +extern GlobalProperty hw_compat_rhel_9_2[];
 +extern const size_t hw_compat_rhel_9_2_len;
 +
 +extern GlobalProperty hw_compat_rhel_9_1[];
 +extern const size_t hw_compat_rhel_9_1_len;
 +
 +extern GlobalProperty hw_compat_rhel_9_0[];
 +extern const size_t hw_compat_rhel_9_0_len;
 +
 +extern GlobalProperty hw_compat_rhel_8_6[];
 +extern const size_t hw_compat_rhel_8_6_len;
 +
 +extern GlobalProperty hw_compat_rhel_8_5[];
 +extern const size_t hw_compat_rhel_8_5_len;
 +
 +extern GlobalProperty hw_compat_rhel_8_4[];
 +extern const size_t hw_compat_rhel_8_4_len;
 +
 +extern GlobalProperty hw_compat_rhel_8_3[];
 +extern const size_t hw_compat_rhel_8_3_len;
 +
 +extern GlobalProperty hw_compat_rhel_8_2[];
 +extern const size_t hw_compat_rhel_8_2_len;
 +
 +extern GlobalProperty hw_compat_rhel_8_1[];
 +extern const size_t hw_compat_rhel_8_1_len;
 +
 +extern GlobalProperty hw_compat_rhel_8_0[];
 +extern const size_t hw_compat_rhel_8_0_len;
 +
 +extern GlobalProperty hw_compat_rhel_7_6[];
 +extern const size_t hw_compat_rhel_7_6_len;
 +
 +extern const char *rhel_old_machine_deprecation;
 #endif
 diff --git a/include/hw/firmware/smbios.h b/include/hw/firmware/smbios.h
 index 8d3fb2fb3b..d9d6d7a169 100644
 --- a/include/hw/firmware/smbios.h
 +++ b/include/hw/firmware/smbios.h
@@ -332,7 +332,9 @@ void smbios_entry_add(QemuOpts *opts, Error **errp);
 void smbios_set_cpuid(uint32_t version, uint32_t features);
 void smbios_set_defaults(const char *manufacturer, const char *product,
                          const char *version,
 -                         bool uuid_encoded);
 +                         bool uuid_encoded,
 +                         const char *stream_product,
 +                         const char *stream_version);
 void smbios_set_default_processor_family(uint16_t processor_family);
 uint8_t *smbios_get_table_legacy(size_t *length, Error **errp);
 void smbios_get_tables(MachineState *ms,
 diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
 index 27a68071d7..ebd8f973f2 100644
 --- a/include/hw/i386/pc.h
 +++ b/include/hw/i386/pc.h
@@ -112,6 +112,9 @@ struct PCMachineClass {
     bool smbios_legacy_mode;
     bool smbios_uuid_encoded;
     SmbiosEntryPointType default_smbios_ep_type;
 +    /* New fields needed for Windows HardwareID-6 matching */
 +    const char *smbios_stream_product;
 +    const char *smbios_stream_version;
     /* RAM / address space compat: */
     bool gigabyte_align;
 -- 
 2.39.3
--- a/0008-Add-s390x-machine-types.patch
+++ b/0008-Add-s390x-machine-types.patch
@ -1,273 +0,0 @@
 From fa1d70b9a9cfe020e7ebe7798ebb70314658ccf7 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 13:47:32 +0200
 Subject: Add s390x machine types
 Adding changes to add RHEL machine types for s390x architecture.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/s390x/s390-virtio-ccw.c       | 159 +++++++++++++++++++++++++++++++
 target/s390x/cpu_models.c        |  11 +++
 target/s390x/cpu_models.h        |   2 +
 target/s390x/cpu_models_sysemu.c |   2 +
 4 files changed, 174 insertions(+)
 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
 index b1dcb3857f..ff753a29e0 100644
 --- a/hw/s390x/s390-virtio-ccw.c
 +++ b/hw/s390x/s390-virtio-ccw.c
@@ -859,6 +859,7 @@ bool css_migration_enabled(void)
     }                                                                         \
     type_init(ccw_machine_register_##suffix)
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void ccw_machine_9_0_instance_options(MachineState *machine)
 {
 }
@@ -1272,6 +1273,164 @@ static void ccw_machine_2_4_class_options(MachineClass *mc)
     compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
 }
 DEFINE_CCW_MACHINE(2_4, "2.4", false);
 +#endif
 +
 +
 +static void ccw_machine_rhel940_instance_options(MachineState *machine)
 +{
 +}
 +
 +static void ccw_machine_rhel940_class_options(MachineClass *mc)
 +{
 +}
 +DEFINE_CCW_MACHINE(rhel940, "rhel9.4.0", true);
 +
 +static void ccw_machine_rhel920_instance_options(MachineState *machine)
 +{
 +    ccw_machine_rhel940_instance_options(machine);
 +}
 +
 +static void ccw_machine_rhel920_class_options(MachineClass *mc)
 +{
 +    ccw_machine_rhel940_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_4, hw_compat_rhel_9_4_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_3, hw_compat_rhel_9_3_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_2, hw_compat_rhel_9_2_len);
 +    mc->smp_props.drawers_supported = false;    /* from ccw_machine_8_1 */
 +    mc->smp_props.books_supported = false;      /* from ccw_machine_8_1 */
 +}
 +DEFINE_CCW_MACHINE(rhel920, "rhel9.2.0", false);
 +
 +static void ccw_machine_rhel900_instance_options(MachineState *machine)
 +{
 +    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V6_2 };
 +
 +    ccw_machine_rhel920_instance_options(machine);
 +
 +    s390_set_qemu_cpu_model(0x3906, 14, 2, qemu_cpu_feat);
 +    s390_cpudef_featoff_greater(16, 1, S390_FEAT_PAIE);
 +}
 +
 +static void ccw_machine_rhel900_class_options(MachineClass *mc)
 +{
 +    S390CcwMachineClass *s390mc = S390_CCW_MACHINE_CLASS(mc);
 +    static GlobalProperty compat[] = {
 +        { TYPE_S390_PCI_DEVICE, "interpret", "off", },
 +        { TYPE_S390_PCI_DEVICE, "forwarding-assist", "off", },
 +    };
 +
 +    ccw_machine_rhel920_class_options(mc);
 +
 +    compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_1, hw_compat_rhel_9_1_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_0, hw_compat_rhel_9_0_len);
 +    s390mc->max_threads = S390_MAX_CPUS;
 +}
 +DEFINE_CCW_MACHINE(rhel900, "rhel9.0.0", false);
 +
 +static void ccw_machine_rhel860_instance_options(MachineState *machine)
 +{
 +    /* Note: The -rhel8.6.0 and -rhel9.0.0 machines are technically identical */
 +    ccw_machine_rhel900_instance_options(machine);
 +}
 +
 +static void ccw_machine_rhel860_class_options(MachineClass *mc)
 +{
 +    static GlobalProperty compat[] = {
 +        { TYPE_S390_PCI_DEVICE, "interpret", "on", },
 +        { TYPE_S390_PCI_DEVICE, "forwarding-assist", "on", },
 +    };
 +
 +    ccw_machine_rhel900_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_6, hw_compat_rhel_8_6_len);
 +    compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
 +
 +    /* All RHEL machines for prior major releases are deprecated */
 +    mc->deprecation_reason = rhel_old_machine_deprecation;
 +}
 +DEFINE_CCW_MACHINE(rhel860, "rhel8.6.0", false);
 +
 +static void ccw_machine_rhel850_instance_options(MachineState *machine)
 +{
 +    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V6_0 };
 +
 +    ccw_machine_rhel860_instance_options(machine);
 +
 +    s390_set_qemu_cpu_model(0x2964, 13, 2, qemu_cpu_feat);
 +
 +    s390_cpudef_featoff_greater(16, 1, S390_FEAT_NNPA);
 +    s390_cpudef_featoff_greater(16, 1, S390_FEAT_VECTOR_PACKED_DECIMAL_ENH2);
 +    s390_cpudef_featoff_greater(16, 1, S390_FEAT_BEAR_ENH);
 +    s390_cpudef_featoff_greater(16, 1, S390_FEAT_RDP);
 +    s390_cpudef_featoff_greater(16, 1, S390_FEAT_PAI);
 +}
 +
 +static void ccw_machine_rhel850_class_options(MachineClass *mc)
 +{
 +    static GlobalProperty compat[] = {
 +        { TYPE_S390_PCI_DEVICE, "interpret", "off", },
 +        { TYPE_S390_PCI_DEVICE, "forwarding-assist", "off", },
 +    };
 +
 +    ccw_machine_rhel860_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_5, hw_compat_rhel_8_5_len);
 +    compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
 +    mc->smp_props.prefer_sockets = true;
 +}
 +DEFINE_CCW_MACHINE(rhel850, "rhel8.5.0", false);
 +
 +static void ccw_machine_rhel840_instance_options(MachineState *machine)
 +{
 +    ccw_machine_rhel850_instance_options(machine);
 +}
 +
 +static void ccw_machine_rhel840_class_options(MachineClass *mc)
 +{
 +    ccw_machine_rhel850_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_4, hw_compat_rhel_8_4_len);
 +}
 +DEFINE_CCW_MACHINE(rhel840, "rhel8.4.0", false);
 +
 +static void ccw_machine_rhel820_instance_options(MachineState *machine)
 +{
 +    ccw_machine_rhel840_instance_options(machine);
 +}
 +
 +static void ccw_machine_rhel820_class_options(MachineClass *mc)
 +{
 +    ccw_machine_rhel840_class_options(mc);
 +    mc->fixup_ram_size = s390_fixup_ram_size;
 +    /* we did not publish a rhel8.3.0 machine */
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_3, hw_compat_rhel_8_3_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_2, hw_compat_rhel_8_2_len);
 +}
 +DEFINE_CCW_MACHINE(rhel820, "rhel8.2.0", false);
 +
 +static void ccw_machine_rhel760_instance_options(MachineState *machine)
 +{
 +    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V3_1 };
 +
 +    ccw_machine_rhel820_instance_options(machine);
 +
 +    s390_set_qemu_cpu_model(0x2827, 12, 2, qemu_cpu_feat);
 +
 +    /* The multiple-epoch facility was not available with rhel7.6.0 on z14GA1 */
 +    s390_cpudef_featoff(14, 1, S390_FEAT_MULTIPLE_EPOCH);
 +    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_QSIE);
 +    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_QTOUE);
 +    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_STOE);
 +    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_STOUE);
 +}
 +
 +static void ccw_machine_rhel760_class_options(MachineClass *mc)
 +{
 +    ccw_machine_rhel820_class_options(mc);
 +    /* We never published the s390x version of RHEL-AV 8.0 and 8.1, so add this here */
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_1, hw_compat_rhel_8_1_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_0, hw_compat_rhel_8_0_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_7_6, hw_compat_rhel_7_6_len);
 +}
 +DEFINE_CCW_MACHINE(rhel760, "rhel7.6.0", false);
 static void ccw_machine_register_types(void)
 {
 diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c
 index 8ed3bb6a27..370b3b3065 100644
 --- a/target/s390x/cpu_models.c
 +++ b/target/s390x/cpu_models.c
@@ -46,6 +46,9 @@
  * of a following release have been a superset of the previous release. With
  * generation 15 one base feature and one optional feature have been deprecated.
  */
 +
 +#define RHEL_CPU_DEPRECATION "use at least 'z14', or 'host' / 'qemu' / 'max'"
 +
 static S390CPUDef s390_cpu_defs[] = {
     CPUDEF_INIT(0x2064, 7, 1, 38, 0x00000000U, "z900", "IBM zSeries 900 GA1"),
     CPUDEF_INIT(0x2064, 7, 2, 38, 0x00000000U, "z900.2", "IBM zSeries 900 GA2"),
@@ -866,22 +869,30 @@ static void s390_host_cpu_model_class_init(ObjectClass *oc, void *data)
 static void s390_base_cpu_model_class_init(ObjectClass *oc, void *data)
 {
     S390CPUClass *xcc = S390_CPU_CLASS(oc);
 +    CPUClass *cc = CPU_CLASS(oc);
     /* all base models are migration safe */
     xcc->cpu_def = (const S390CPUDef *) data;
     xcc->is_migration_safe = true;
     xcc->is_static = true;
     xcc->desc = xcc->cpu_def->desc;
 +    if (xcc->cpu_def->gen < 14) {
 +        cc->deprecation_note = RHEL_CPU_DEPRECATION;
 +    }
 }
 static void s390_cpu_model_class_init(ObjectClass *oc, void *data)
 {
     S390CPUClass *xcc = S390_CPU_CLASS(oc);
 +    CPUClass *cc = CPU_CLASS(oc);
     /* model that can change between QEMU versions */
     xcc->cpu_def = (const S390CPUDef *) data;
     xcc->is_migration_safe = true;
     xcc->desc = xcc->cpu_def->desc;
 +    if (xcc->cpu_def->gen < 14) {
 +        cc->deprecation_note = RHEL_CPU_DEPRECATION;
 +    }
 }
 static void s390_qemu_cpu_model_class_init(ObjectClass *oc, void *data)
 diff --git a/target/s390x/cpu_models.h b/target/s390x/cpu_models.h
 index d7b8912989..1a806a97c4 100644
 --- a/target/s390x/cpu_models.h
 +++ b/target/s390x/cpu_models.h
@@ -38,6 +38,8 @@ typedef struct S390CPUDef {
     S390FeatBitmap full_feat;
     /* used to init full_feat from generated data */
     S390FeatInit full_init;
 +    /* if deprecated, provides a suggestion */
 +    const char *deprecation_note;
 } S390CPUDef;
 /* CPU model based on a CPU definition */
 diff --git a/target/s390x/cpu_models_sysemu.c b/target/s390x/cpu_models_sysemu.c
 index 0728bfcc20..ca2e5d91e2 100644
 --- a/target/s390x/cpu_models_sysemu.c
 +++ b/target/s390x/cpu_models_sysemu.c
@@ -59,6 +59,7 @@ static void create_cpu_model_list(ObjectClass *klass, void *opaque)
     CpuDefinitionInfo *info;
     char *name = g_strdup(object_class_get_name(klass));
     S390CPUClass *scc = S390_CPU_CLASS(klass);
 +    CPUClass *cc = CPU_CLASS(klass);
     /* strip off the -s390x-cpu */
     g_strrstr(name, "-" TYPE_S390_CPU)[0] = 0;
@@ -68,6 +69,7 @@ static void create_cpu_model_list(ObjectClass *klass, void *opaque)
     info->migration_safe = scc->is_migration_safe;
     info->q_static = scc->is_static;
     info->q_typename = g_strdup(object_class_get_name(klass));
 +    info->deprecated = !!cc->deprecation_note;
     /* check for unavailable features */
     if (cpu_list_data->model) {
         Object *obj;
 -- 
 2.39.3
--- a/0009-Add-x86_64-machine-types.patch
+++ b/0009-Add-x86_64-machine-types.patch
@ -1,920 +0,0 @@
 From ec10588d2f5d748005e0dca42b299ae15868a900 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 13:10:31 +0200
 Subject: Add x86_64 machine types
 Adding changes to add RHEL machine types for x86_64 architecture.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/i386/fw_cfg.c           |   2 +-
 hw/i386/pc.c               | 159 ++++++++++++++++++++-
 hw/i386/pc_piix.c          | 109 ++++++++++++++
 hw/i386/pc_q35.c           | 285 +++++++++++++++++++++++++++++++++++++
 include/hw/boards.h        |   2 +
 include/hw/i386/pc.h       |  33 +++++
 target/i386/cpu.c          |  21 +++
 target/i386/kvm/kvm-cpu.c  |   1 +
 target/i386/kvm/kvm.c      |   4 +
 tests/qtest/pvpanic-test.c |   5 +-
 10 files changed, 617 insertions(+), 4 deletions(-)
 diff --git a/hw/i386/fw_cfg.c b/hw/i386/fw_cfg.c
 index c7aa39a13e..283c3f4c16 100644
 --- a/hw/i386/fw_cfg.c
 +++ b/hw/i386/fw_cfg.c
@@ -63,7 +63,7 @@ void fw_cfg_build_smbios(PCMachineState *pcms, FWCfgState *fw_cfg,
     if (pcmc->smbios_defaults) {
         /* These values are guest ABI, do not change */
 -        smbios_set_defaults("QEMU", mc->desc, mc->name,
 +        smbios_set_defaults("Red Hat", "KVM", mc->desc,
                             pcmc->smbios_uuid_encoded,
                             pcmc->smbios_stream_product, pcmc->smbios_stream_version);
     }
 diff --git a/hw/i386/pc.c b/hw/i386/pc.c
 index 5c21b0c4db..4a154c1a9a 100644
 --- a/hw/i386/pc.c
 +++ b/hw/i386/pc.c
@@ -326,6 +326,161 @@ GlobalProperty pc_compat_2_0[] = {
 };
 const size_t pc_compat_2_0_len = G_N_ELEMENTS(pc_compat_2_0);
 +/* This macro is for changes to properties that are RHEL specific,
 + * different to the current upstream and to be applied to the latest
 + * machine type.
 + */
 +GlobalProperty pc_rhel_compat[] = {
 +    /* we don't support s3/s4 suspend */
 +    { "PIIX4_PM", "disable_s3", "1" },
 +    { "PIIX4_PM", "disable_s4", "1" },
 +    { "ICH9-LPC", "disable_s3", "1" },
 +    { "ICH9-LPC", "disable_s4", "1" },
 +
 +    { TYPE_X86_CPU, "host-phys-bits", "on" },
 +    { TYPE_X86_CPU, "host-phys-bits-limit", "48" },
 +    { TYPE_X86_CPU, "vmx-entry-load-perf-global-ctrl", "off" },
 +    { TYPE_X86_CPU, "vmx-exit-load-perf-global-ctrl", "off" },
 +    /* bz 1508330 */
 +    { "vfio-pci", "x-no-geforce-quirks", "on" },
 +    /* bz 1941397 */
 +    { TYPE_X86_CPU, "kvm-asyncpf-int", "on" },
 +};
 +const size_t pc_rhel_compat_len = G_N_ELEMENTS(pc_rhel_compat);
 +
 +GlobalProperty pc_rhel_9_3_compat[] = {
 +    /* pc_rhel_9_3_compat from pc_compat_8_0 */
 +    { "virtio-mem", "unplugged-inaccessible", "auto" },
 +};
 +const size_t pc_rhel_9_3_compat_len = G_N_ELEMENTS(pc_rhel_9_3_compat);
 +
 +GlobalProperty pc_rhel_9_2_compat[] = {
 +    /* pc_rhel_9_2_compat from pc_compat_7_2 */
 +    { "ICH9-LPC", "noreboot", "true" },
 +};
 +const size_t pc_rhel_9_2_compat_len = G_N_ELEMENTS(pc_rhel_9_2_compat);
 +
 +GlobalProperty pc_rhel_9_0_compat[] = {
 +    /* pc_rhel_9_0_compat from pc_compat_6_2 */
 +    { "virtio-mem", "unplugged-inaccessible", "off" },
 +};
 +const size_t pc_rhel_9_0_compat_len = G_N_ELEMENTS(pc_rhel_9_0_compat);
 +
 +GlobalProperty pc_rhel_8_5_compat[] = {
 +    /* pc_rhel_8_5_compat from pc_compat_6_0 */
 +    { "qemu64" "-" TYPE_X86_CPU, "family", "6" },
 +    /* pc_rhel_8_5_compat from pc_compat_6_0 */
 +    { "qemu64" "-" TYPE_X86_CPU, "model", "6" },
 +    /* pc_rhel_8_5_compat from pc_compat_6_0 */
 +    { "qemu64" "-" TYPE_X86_CPU, "stepping", "3" },
 +    /* pc_rhel_8_5_compat from pc_compat_6_0 */
 +    { TYPE_X86_CPU, "x-vendor-cpuid-only", "off" },
 +    /* pc_rhel_8_5_compat from pc_compat_6_0 */
 +    { "ICH9-LPC", ACPI_PM_PROP_ACPI_PCIHP_BRIDGE, "off" },
 +
 +    /* pc_rhel_8_5_compat from pc_compat_6_1 */
 +    { TYPE_X86_CPU, "hv-version-id-build", "0x1bbc" },
 +    /* pc_rhel_8_5_compat from pc_compat_6_1 */
 +    { TYPE_X86_CPU, "hv-version-id-major", "0x0006" },
 +    /* pc_rhel_8_5_compat from pc_compat_6_1 */
 +    { TYPE_X86_CPU, "hv-version-id-minor", "0x0001" },
 +};
 +const size_t pc_rhel_8_5_compat_len = G_N_ELEMENTS(pc_rhel_8_5_compat);
 +
 +GlobalProperty pc_rhel_8_4_compat[] = {
 +    /* pc_rhel_8_4_compat from pc_compat_5_2 */
 +    { "ICH9-LPC", "x-smi-cpu-hotunplug", "off" },
 +    { TYPE_X86_CPU, "kvm-asyncpf-int", "off" },
 +};
 +const size_t pc_rhel_8_4_compat_len = G_N_ELEMENTS(pc_rhel_8_4_compat);
 +
 +GlobalProperty pc_rhel_8_3_compat[] = {
 +    /* pc_rhel_8_3_compat from pc_compat_5_1 */
 +    { "ICH9-LPC", "x-smi-cpu-hotplug", "off" },
 +};
 +const size_t pc_rhel_8_3_compat_len = G_N_ELEMENTS(pc_rhel_8_3_compat);
 +
 +GlobalProperty pc_rhel_8_2_compat[] = {
 +    /* pc_rhel_8_2_compat from pc_compat_4_2 */
 +    { "mch", "smbase-smram", "off" },
 +};
 +const size_t pc_rhel_8_2_compat_len = G_N_ELEMENTS(pc_rhel_8_2_compat);
 +
 +/* pc_rhel_8_1_compat is empty since pc_4_1_compat is */
 +GlobalProperty pc_rhel_8_1_compat[] = { };
 +const size_t pc_rhel_8_1_compat_len = G_N_ELEMENTS(pc_rhel_8_1_compat);
 +
 +GlobalProperty pc_rhel_8_0_compat[] = {
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "intel-iommu", "dma-drain", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "Opteron_G3" "-" TYPE_X86_CPU, "rdtscp", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "Opteron_G4" "-" TYPE_X86_CPU, "rdtscp", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "Opteron_G4" "-" TYPE_X86_CPU, "npt", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "Opteron_G4" "-" TYPE_X86_CPU, "nrip-save", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "Opteron_G5" "-" TYPE_X86_CPU, "rdtscp", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "Opteron_G5" "-" TYPE_X86_CPU, "npt", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "Opteron_G5" "-" TYPE_X86_CPU, "nrip-save", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "EPYC" "-" TYPE_X86_CPU, "npt", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "EPYC" "-" TYPE_X86_CPU, "nrip-save", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "EPYC-IBPB" "-" TYPE_X86_CPU, "npt", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "EPYC-IBPB" "-" TYPE_X86_CPU, "nrip-save", "off" },
 +    /** The mpx=on entries from pc_compat_3_1 are in pc_rhel_7_6_compat **/
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "Cascadelake-Server" "-" TYPE_X86_CPU, "stepping", "5" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { TYPE_X86_CPU, "x-intel-pt-auto-level", "off" },
 +};
 +const size_t pc_rhel_8_0_compat_len = G_N_ELEMENTS(pc_rhel_8_0_compat);
 +
 +/* Similar to PC_COMPAT_3_0 + PC_COMPAT_2_12, but:
 + * all of the 2_12 stuff was already in 7.6 from bz 1481253
 + * x-migrate-smi-count comes from PC_COMPAT_2_11 but
 + * is really tied to kernel version so keep it off on 7.x
 + * machine types irrespective of host.
 + */
 +GlobalProperty pc_rhel_7_6_compat[] = {
 +    /* pc_rhel_7_6_compat from pc_compat_3_0 */
 +    { TYPE_X86_CPU, "x-hv-synic-kvm-only", "on" },
 +    /* pc_rhel_7_6_compat from pc_compat_3_0 */
 +    { "Skylake-Server" "-" TYPE_X86_CPU, "pku", "off" },
 +    /* pc_rhel_7_6_compat from pc_compat_3_0 */
 +    { "Skylake-Server-IBRS" "-" TYPE_X86_CPU, "pku", "off" },
 +    /* pc_rhel_7_6_compat from pc_compat_2_11 */
 +    { TYPE_X86_CPU, "x-migrate-smi-count", "off" },
 +    /* pc_rhel_7_6_compat from pc_compat_2_11 */
 +    { "Skylake-Client" "-" TYPE_X86_CPU, "mpx", "on" },
 +    /* pc_rhel_7_6_compat from pc_compat_2_11 */
 +    { "Skylake-Client-IBRS" "-" TYPE_X86_CPU, "mpx", "on" },
 +    /* pc_rhel_7_6_compat from pc_compat_2_11 */
 +    { "Skylake-Server" "-" TYPE_X86_CPU, "mpx", "on" },
 +    /* pc_rhel_7_6_compat from pc_compat_2_11 */
 +    { "Skylake-Server-IBRS" "-" TYPE_X86_CPU, "mpx", "on" },
 +    /* pc_rhel_7_6_compat from pc_compat_2_11 */
 +    { "Cascadelake-Server" "-" TYPE_X86_CPU, "mpx", "on" },
 +    /* pc_rhel_7_6_compat from pc_compat_2_11 */
 +    { "Icelake-Client" "-" TYPE_X86_CPU, "mpx", "on" },
 +    /* pc_rhel_7_6_compat from pc_compat_2_11 */
 +    { "Icelake-Server" "-" TYPE_X86_CPU, "mpx", "on" },
 +};
 +const size_t pc_rhel_7_6_compat_len = G_N_ELEMENTS(pc_rhel_7_6_compat);
 +
 +/*
 + * The PC_RHEL_*_COMPAT serve the same purpose for RHEL-7 machine
 + * types as the PC_COMPAT_* do for upstream types.
 + * PC_RHEL_7_*_COMPAT apply both to i440fx and q35 types.
 + */
 +
 GSIState *pc_gsi_create(qemu_irq **irqs, bool pci_enabled)
 {
     GSIState *s;
@@ -1813,6 +1968,7 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
     pcmc->resizable_acpi_blob = true;
     x86mc->apic_xrupt_override = true;
     assert(!mc->get_hotplug_handler);
 +    mc->async_pf_vmexit_disable = false;
     mc->get_hotplug_handler = pc_get_hotplug_handler;
     mc->hotplug_allowed = pc_hotplug_allowed;
     mc->cpu_index_to_instance_props = x86_cpu_index_to_props;
@@ -1823,7 +1979,8 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
     mc->has_hotpluggable_cpus = true;
     mc->default_boot_order = "cad";
     mc->block_default_type = IF_IDE;
 -    mc->max_cpus = 255;
 +    /* 240: max CPU count for RHEL */
 +    mc->max_cpus = 240;
     mc->reset = pc_machine_reset;
     mc->wakeup = pc_machine_wakeup;
     hc->pre_plug = pc_machine_device_pre_plug_cb;
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
 index 18ba076609..a647262d63 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
@@ -52,6 +52,7 @@
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "sysemu/xen.h"
 +#include "migration/migration.h"
 #ifdef CONFIG_XEN
 #include <xen/hvm/hvm_info_table.h>
 #include "hw/xen/xen_pt.h"
@@ -422,6 +423,7 @@ static void pc_set_south_bridge(Object *obj, int value, Error **errp)
  * hw_compat_*, pc_compat_*, or * pc_*_machine_options().
  */
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void pc_compat_2_3_fn(MachineState *machine)
 {
     X86MachineState *x86ms = X86_MACHINE(machine);
@@ -951,3 +953,110 @@ static void xenfv_3_1_machine_options(MachineClass *m)
 DEFINE_PC_MACHINE(xenfv, "xenfv-3.1", pc_xen_hvm_init,
                   xenfv_3_1_machine_options);
 #endif
 +#endif  /* Disabled for Red Hat Enterprise Linux */
 +
 +/* Red Hat Enterprise Linux machine types */
 +
 +/* Options for the latest rhel7 machine type */
 +static void pc_machine_rhel7_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    m->family = "pc_piix_Y";
 +    m->default_machine_opts = "firmware=bios-256k.bin,hpet=off";
 +    pcmc->pci_root_uid = 0;
 +    pcmc->resizable_acpi_blob = true;
 +    m->default_nic = "e1000";
 +    m->default_display = "std";
 +    m->no_parallel = 1;
 +    m->numa_mem_supported = true;
 +    m->auto_enable_numa_with_memdev = false;
 +    machine_class_allow_dynamic_sysbus_dev(m, TYPE_RAMFB_DEVICE);
 +    compat_props_add(m->compat_props, pc_rhel_compat, pc_rhel_compat_len);
 +    m->alias = "pc";
 +    m->is_default = 1;
 +    m->smp_props.prefer_sockets = true;
 +}
 +
 +static void pc_init_rhel760(MachineState *machine)
 +{
 +    pc_init1(machine, TYPE_I440FX_PCI_DEVICE);
 +}
 +
 +static void pc_machine_rhel760_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    ObjectClass *oc = OBJECT_CLASS(m);
 +    pc_machine_rhel7_options(m);
 +    m->desc = "RHEL 7.6.0 PC (i440FX + PIIX, 1996)";
 +    m->async_pf_vmexit_disable = true;
 +    m->smbus_no_migration_support = true;
 +
 +    /* All RHEL machines for prior major releases are deprecated */
 +    m->deprecation_reason = rhel_old_machine_deprecation;
 +
 +    pcmc->pvh_enabled = false;
 +    pcmc->default_cpu_version = CPU_VERSION_LEGACY;
 +    pcmc->kvmclock_create_always = false;
 +    /* From pc_i440fx_5_1_machine_options() */
 +    pcmc->pci_root_uid = 1;
 +    /* From pc_i440fx_7_0_machine_options() */
 +    pcmc->enforce_amd_1tb_hole = false;
 +    /* From pc_i440fx_8_0_machine_options() */
 +    pcmc->default_smbios_ep_type = SMBIOS_ENTRY_POINT_TYPE_32;
 +    /* From pc_i440fx_8_1_machine_options() */
 +    pcmc->broken_32bit_mem_addr_check = true;
 +    /* Introduced in QEMU 8.2 */
 +    pcmc->default_south_bridge = TYPE_PIIX3_DEVICE;
 +
 +    object_class_property_add_enum(oc, "x-south-bridge", "PCSouthBridgeOption",
 +                                   &PCSouthBridgeOption_lookup,
 +                                   pc_get_south_bridge,
 +                                   pc_set_south_bridge);
 +    object_class_property_set_description(oc, "x-south-bridge",
 +                                     "Use a different south bridge than PIIX3");
 +
 +
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_4,
 +                     hw_compat_rhel_9_4_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_3,
 +                     hw_compat_rhel_9_3_len);
 +    compat_props_add(m->compat_props, pc_rhel_9_3_compat,
 +                     pc_rhel_9_3_compat_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_2,
 +                     hw_compat_rhel_9_2_len);
 +    compat_props_add(m->compat_props, pc_rhel_9_2_compat,
 +                     pc_rhel_9_2_compat_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_1,
 +                     hw_compat_rhel_9_1_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_0,
 +                     hw_compat_rhel_9_0_len);
 +    compat_props_add(m->compat_props, pc_rhel_9_0_compat,
 +                     pc_rhel_9_0_compat_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_6,
 +                     hw_compat_rhel_8_6_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_5,
 +                     hw_compat_rhel_8_5_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_5_compat,
 +                     pc_rhel_8_5_compat_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_4,
 +                     hw_compat_rhel_8_4_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_4_compat,
 +                     pc_rhel_8_4_compat_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_3,
 +                     hw_compat_rhel_8_3_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_3_compat,
 +                     pc_rhel_8_3_compat_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_2,
 +                     hw_compat_rhel_8_2_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_2_compat,
 +                     pc_rhel_8_2_compat_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_1, hw_compat_rhel_8_1_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_1_compat, pc_rhel_8_1_compat_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_0, hw_compat_rhel_8_0_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_0_compat, pc_rhel_8_0_compat_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_7_6, hw_compat_rhel_7_6_len);
 +    compat_props_add(m->compat_props, pc_rhel_7_6_compat, pc_rhel_7_6_compat_len);
 +}
 +
 +DEFINE_PC_MACHINE(rhel760, "pc-i440fx-rhel7.6.0", pc_init_rhel760,
 +                  pc_machine_rhel760_options);
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
 index c7bc8a2041..e872dc7e46 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
@@ -341,6 +341,7 @@ static void pc_q35_init(MachineState *machine)
     DEFINE_PC_MACHINE(suffix, name, pc_init_##suffix, optionfn)
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void pc_q35_machine_options(MachineClass *m)
 {
     PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
@@ -693,3 +694,287 @@ static void pc_q35_2_4_machine_options(MachineClass *m)
 DEFINE_Q35_MACHINE(v2_4, "pc-q35-2.4", NULL,
                    pc_q35_2_4_machine_options);
 +#endif  /* Disabled for Red Hat Enterprise Linux */
 +
 +/* Red Hat Enterprise Linux machine types */
 +
 +/* Options for the latest rhel q35 machine type */
 +static void pc_q35_machine_rhel_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pcmc->pci_root_uid = 0;
 +    m->default_nic = "e1000e";
 +    m->family = "pc_q35_Z";
 +    m->units_per_default_bus = 1;
 +    m->default_machine_opts = "firmware=bios-256k.bin,hpet=off";
 +    m->default_display = "std";
 +    m->no_floppy = 1;
 +    m->no_parallel = 1;
 +    pcmc->default_cpu_version = 1;
 +    machine_class_allow_dynamic_sysbus_dev(m, TYPE_AMD_IOMMU_DEVICE);
 +    machine_class_allow_dynamic_sysbus_dev(m, TYPE_INTEL_IOMMU_DEVICE);
 +    machine_class_allow_dynamic_sysbus_dev(m, TYPE_RAMFB_DEVICE);
 +    m->alias = "q35";
 +    m->max_cpus = 710;
 +    compat_props_add(m->compat_props, pc_rhel_compat, pc_rhel_compat_len);
 +    compat_props_add(m->compat_props,
 +                     pc_q35_compat_defaults, pc_q35_compat_defaults_len);
 +}
 +
 +static void pc_q35_init_rhel940(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel940_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel_options(m);
 +    m->desc = "RHEL-9.4.0 PC (Q35 + ICH9, 2009)";
 +    pcmc->smbios_stream_product = "RHEL";
 +    pcmc->smbios_stream_version = "9.4.0";
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel940, "pc-q35-rhel9.4.0", pc_q35_init_rhel940,
 +                  pc_q35_machine_rhel940_options);
 +
 +
 +static void pc_q35_init_rhel920(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel920_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel940_options(m);
 +    m->desc = "RHEL-9.2.0 PC (Q35 + ICH9, 2009)";
 +    m->alias = NULL;
 +    pcmc->smbios_stream_product = "RHEL";
 +    pcmc->smbios_stream_version = "9.2.0";
 +
 +    /* From pc_q35_8_0_machine_options() */
 +    pcmc->default_smbios_ep_type = SMBIOS_ENTRY_POINT_TYPE_32;
 +    /* From pc_q35_8_1_machine_options() */
 +    pcmc->broken_32bit_mem_addr_check = true;
 +
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_4,
 +                     hw_compat_rhel_9_4_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_3,
 +                     hw_compat_rhel_9_3_len);
 +    compat_props_add(m->compat_props, pc_rhel_9_3_compat,
 +                     pc_rhel_9_3_compat_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_2,
 +                     hw_compat_rhel_9_2_len);
 +    compat_props_add(m->compat_props, pc_rhel_9_2_compat,
 +                     pc_rhel_9_2_compat_len);
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel920, "pc-q35-rhel9.2.0", pc_q35_init_rhel920,
 +                  pc_q35_machine_rhel920_options);
 +
 +static void pc_q35_init_rhel900(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel900_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel920_options(m);
 +    m->desc = "RHEL-9.0.0 PC (Q35 + ICH9, 2009)";
 +    m->alias = NULL;
 +    pcmc->smbios_stream_product = "RHEL";
 +    pcmc->smbios_stream_version = "9.0.0";
 +    pcmc->enforce_amd_1tb_hole = false;
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_1,
 +                     hw_compat_rhel_9_1_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_0,
 +                     hw_compat_rhel_9_0_len);
 +    compat_props_add(m->compat_props, pc_rhel_9_0_compat,
 +                     pc_rhel_9_0_compat_len);
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel900, "pc-q35-rhel9.0.0", pc_q35_init_rhel900,
 +                  pc_q35_machine_rhel900_options);
 +
 +static void pc_q35_init_rhel860(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel860_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel900_options(m);
 +    m->desc = "RHEL-8.6.0 PC (Q35 + ICH9, 2009)";
 +    m->alias = NULL;
 +
 +    /* All RHEL machines for prior major releases are deprecated */
 +    m->deprecation_reason = rhel_old_machine_deprecation;
 +
 +    pcmc->smbios_stream_product = "RHEL-AV";
 +    pcmc->smbios_stream_version = "8.6.0";
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_6,
 +                     hw_compat_rhel_8_6_len);
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel860, "pc-q35-rhel8.6.0", pc_q35_init_rhel860,
 +                  pc_q35_machine_rhel860_options);
 +
 +
 +static void pc_q35_init_rhel850(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel850_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel860_options(m);
 +    m->desc = "RHEL-8.5.0 PC (Q35 + ICH9, 2009)";
 +    m->alias = NULL;
 +    pcmc->smbios_stream_product = "RHEL-AV";
 +    pcmc->smbios_stream_version = "8.5.0";
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_5,
 +                     hw_compat_rhel_8_5_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_5_compat,
 +                     pc_rhel_8_5_compat_len);
 +    m->smp_props.prefer_sockets = true;
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel850, "pc-q35-rhel8.5.0", pc_q35_init_rhel850,
 +                  pc_q35_machine_rhel850_options);
 +
 +
 +static void pc_q35_init_rhel840(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel840_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel850_options(m);
 +    m->desc = "RHEL-8.4.0 PC (Q35 + ICH9, 2009)";
 +    m->alias = NULL;
 +    pcmc->smbios_stream_product = "RHEL-AV";
 +    pcmc->smbios_stream_version = "8.4.0";
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_4,
 +                     hw_compat_rhel_8_4_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_4_compat,
 +                     pc_rhel_8_4_compat_len);
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel840, "pc-q35-rhel8.4.0", pc_q35_init_rhel840,
 +                  pc_q35_machine_rhel840_options);
 +
 +
 +static void pc_q35_init_rhel830(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel830_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel840_options(m);
 +    m->desc = "RHEL-8.3.0 PC (Q35 + ICH9, 2009)";
 +    m->alias = NULL;
 +    pcmc->smbios_stream_product = "RHEL-AV";
 +    pcmc->smbios_stream_version = "8.3.0";
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_3,
 +                     hw_compat_rhel_8_3_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_3_compat,
 +                     pc_rhel_8_3_compat_len);
 +    /* From pc_q35_5_1_machine_options() */
 +    pcmc->kvmclock_create_always = false;
 +    /* From pc_q35_5_1_machine_options() */
 +    pcmc->pci_root_uid = 1;
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel830, "pc-q35-rhel8.3.0", pc_q35_init_rhel830,
 +                  pc_q35_machine_rhel830_options);
 +
 +static void pc_q35_init_rhel820(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel820_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel830_options(m);
 +    m->desc = "RHEL-8.2.0 PC (Q35 + ICH9, 2009)";
 +    m->alias = NULL;
 +    m->numa_mem_supported = true;
 +    m->auto_enable_numa_with_memdev = false;
 +    pcmc->smbios_stream_product = "RHEL-AV";
 +    pcmc->smbios_stream_version = "8.2.0";
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_2,
 +                     hw_compat_rhel_8_2_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_2_compat,
 +                     pc_rhel_8_2_compat_len);
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel820, "pc-q35-rhel8.2.0", pc_q35_init_rhel820,
 +                  pc_q35_machine_rhel820_options);
 +
 +static void pc_q35_init_rhel810(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel810_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel820_options(m);
 +    m->desc = "RHEL-8.1.0 PC (Q35 + ICH9, 2009)";
 +    m->alias = NULL;
 +    pcmc->smbios_stream_product = NULL;
 +    pcmc->smbios_stream_version = NULL;
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_1, hw_compat_rhel_8_1_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_1_compat, pc_rhel_8_1_compat_len);
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel810, "pc-q35-rhel8.1.0", pc_q35_init_rhel810,
 +                  pc_q35_machine_rhel810_options);
 +
 +static void pc_q35_init_rhel800(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel800_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel810_options(m);
 +    m->desc = "RHEL-8.0.0 PC (Q35 + ICH9, 2009)";
 +    m->smbus_no_migration_support = true;
 +    m->alias = NULL;
 +    pcmc->pvh_enabled = false;
 +    pcmc->default_cpu_version = CPU_VERSION_LEGACY;
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_0, hw_compat_rhel_8_0_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_0_compat, pc_rhel_8_0_compat_len);
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel800, "pc-q35-rhel8.0.0", pc_q35_init_rhel800,
 +                  pc_q35_machine_rhel800_options);
 +
 +static void pc_q35_init_rhel760(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel760_options(MachineClass *m)
 +{
 +    pc_q35_machine_rhel800_options(m);
 +    m->alias = NULL;
 +    m->desc = "RHEL-7.6.0 PC (Q35 + ICH9, 2009)";
 +    m->async_pf_vmexit_disable = true;
 +    compat_props_add(m->compat_props, hw_compat_rhel_7_6, hw_compat_rhel_7_6_len);
 +    compat_props_add(m->compat_props, pc_rhel_7_6_compat, pc_rhel_7_6_compat_len);
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel760, "pc-q35-rhel7.6.0", pc_q35_init_rhel760,
 +                  pc_q35_machine_rhel760_options);
 diff --git a/include/hw/boards.h b/include/hw/boards.h
 index 0466f9d0f3..46b8725c41 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
@@ -283,6 +283,8 @@ struct MachineClass {
     strList *allowed_dynamic_sysbus_devices;
     bool auto_enable_numa_with_memhp;
     bool auto_enable_numa_with_memdev;
 +    /* RHEL only */
 +    bool async_pf_vmexit_disable;
     bool ignore_boot_device_suffixes;
     bool smbus_no_migration_support;
     bool nvdimm_supported;
 diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
 index ebd8f973f2..a984c951ad 100644
 --- a/include/hw/i386/pc.h
 +++ b/include/hw/i386/pc.h
@@ -291,6 +291,39 @@ extern const size_t pc_compat_2_1_len;
 extern GlobalProperty pc_compat_2_0[];
 extern const size_t pc_compat_2_0_len;
 +extern GlobalProperty pc_rhel_compat[];
 +extern const size_t pc_rhel_compat_len;
 +
 +extern GlobalProperty pc_rhel_9_3_compat[];
 +extern const size_t pc_rhel_9_3_compat_len;
 +
 +extern GlobalProperty pc_rhel_9_2_compat[];
 +extern const size_t pc_rhel_9_2_compat_len;
 +
 +extern GlobalProperty pc_rhel_9_0_compat[];
 +extern const size_t pc_rhel_9_0_compat_len;
 +
 +extern GlobalProperty pc_rhel_8_5_compat[];
 +extern const size_t pc_rhel_8_5_compat_len;
 +
 +extern GlobalProperty pc_rhel_8_4_compat[];
 +extern const size_t pc_rhel_8_4_compat_len;
 +
 +extern GlobalProperty pc_rhel_8_3_compat[];
 +extern const size_t pc_rhel_8_3_compat_len;
 +
 +extern GlobalProperty pc_rhel_8_2_compat[];
 +extern const size_t pc_rhel_8_2_compat_len;
 +
 +extern GlobalProperty pc_rhel_8_1_compat[];
 +extern const size_t pc_rhel_8_1_compat_len;
 +
 +extern GlobalProperty pc_rhel_8_0_compat[];
 +extern const size_t pc_rhel_8_0_compat_len;
 +
 +extern GlobalProperty pc_rhel_7_6_compat[];
 +extern const size_t pc_rhel_7_6_compat_len;
 +
 #define DEFINE_PC_MACHINE(suffix, namestr, initfn, optsfn) \
     static void pc_machine_##suffix##_class_init(ObjectClass *oc, void *data) \
     { \
 diff --git a/target/i386/cpu.c b/target/i386/cpu.c
 index 33760a2ee1..be7b0663cd 100644
 --- a/target/i386/cpu.c
 +++ b/target/i386/cpu.c
@@ -2190,9 +2190,13 @@ static const CPUCaches epyc_genoa_cache_info = {
  *  PT in VMX operation
  */
 +#define RHEL_CPU_DEPRECATION \
 +    "use at least 'Nehalem' / 'Opteron_G4', or 'host' / 'max'"
 +
 static const X86CPUDefinition builtin_x86_defs[] = {
     {
         .name = "qemu64",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 0xd,
         .vendor = CPUID_VENDOR_AMD,
         .family = 15,
@@ -2213,6 +2217,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "phenom",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 5,
         .vendor = CPUID_VENDOR_AMD,
         .family = 16,
@@ -2245,6 +2250,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "core2duo",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 10,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -2287,6 +2293,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "kvm64",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 0xd,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 15,
@@ -2328,6 +2335,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "qemu32",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 4,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -2342,6 +2350,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "kvm32",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 5,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 15,
@@ -2372,6 +2381,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "coreduo",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 10,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -2405,6 +2415,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "486",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 1,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 4,
@@ -2417,6 +2428,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "pentium",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 1,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 5,
@@ -2429,6 +2441,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "pentium2",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 2,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -2441,6 +2454,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "pentium3",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 3,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -2453,6 +2467,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "athlon",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 2,
         .vendor = CPUID_VENDOR_AMD,
         .family = 6,
@@ -2468,6 +2483,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "n270",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 10,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -2493,6 +2509,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "Conroe",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 10,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -2533,6 +2550,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "Penryn",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 10,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -4394,6 +4412,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "Opteron_G1",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 5,
         .vendor = CPUID_VENDOR_AMD,
         .family = 15,
@@ -4414,6 +4433,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "Opteron_G2",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 5,
         .vendor = CPUID_VENDOR_AMD,
         .family = 15,
@@ -4436,6 +4456,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "Opteron_G3",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 5,
         .vendor = CPUID_VENDOR_AMD,
         .family = 16,
 diff --git a/target/i386/kvm/kvm-cpu.c b/target/i386/kvm/kvm-cpu.c
 index 9c791b7b05..b91af5051f 100644
 --- a/target/i386/kvm/kvm-cpu.c
 +++ b/target/i386/kvm/kvm-cpu.c
@@ -138,6 +138,7 @@ static PropValue kvm_default_props[] = {
     { "acpi", "off" },
     { "monitor", "off" },
     { "svm", "off" },
 +    { "kvm-pv-unhalt", "on" },
     { NULL, NULL },
 };
 diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
 index e68cbe9293..739f33db47 100644
 --- a/target/i386/kvm/kvm.c
 +++ b/target/i386/kvm/kvm.c
@@ -3715,6 +3715,7 @@ static int kvm_get_msrs(X86CPU *cpu)
     struct kvm_msr_entry *msrs = cpu->kvm_msr_buf->entries;
     int ret, i;
     uint64_t mtrr_top_bits;
 +    MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
     kvm_msr_buf_reset(cpu);
@@ -4069,6 +4070,9 @@ static int kvm_get_msrs(X86CPU *cpu)
             break;
         case MSR_KVM_ASYNC_PF_EN:
             env->async_pf_en_msr = msrs[i].data;
 +            if (mc->async_pf_vmexit_disable) {
 +                env->async_pf_en_msr &= ~(1ULL << 2);
 +            }
             break;
         case MSR_KVM_ASYNC_PF_INT:
             env->async_pf_int_msr = msrs[i].data;
 diff --git a/tests/qtest/pvpanic-test.c b/tests/qtest/pvpanic-test.c
 index 78f1cf8186..ac954c9b06 100644
 --- a/tests/qtest/pvpanic-test.c
 +++ b/tests/qtest/pvpanic-test.c
@@ -17,7 +17,7 @@ static void test_panic_nopause(void)
     QDict *response, *data;
     QTestState *qts;
 -    qts = qtest_init("-device pvpanic -action panic=none");
 +    qts = qtest_init("-M q35 -device pvpanic -action panic=none");
     val = qtest_inb(qts, 0x505);
     g_assert_cmpuint(val, ==, 3);
@@ -40,7 +40,8 @@ static void test_panic(void)
     QDict *response, *data;
     QTestState *qts;
 -    qts = qtest_init("-device pvpanic -action panic=pause");
 +    /* RHEL: Use q35 */
 +    qts = qtest_init("-M q35 -device pvpanic -action panic=pause");
     val = qtest_inb(qts, 0x505);
     g_assert_cmpuint(val, ==, 3);
 -- 
 2.39.3
--- a/0010-Enable-make-check.patch
+++ b/0010-Enable-make-check.patch
@ -1,231 +0,0 @@
 From 241ad69d849fce983685fc754fc0572c5b737cbe Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 2 Sep 2020 09:39:41 +0200
 Subject: Enable make check
 Fixing tests after device disabling and machine types changes and enabling
 make check run during build.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 .distro/qemu-kvm.spec.template      |  4 ++--
 tests/avocado/replay_kernel.py      |  2 +-
 tests/avocado/reverse_debugging.py  |  2 +-
 tests/avocado/tcg_plugins.py        |  6 ++---
 tests/qemu-iotests/meson.build      | 34 ++++++++++++++---------------
 tests/qemu-iotests/testenv.py       |  3 +++
 tests/qtest/fuzz-e1000e-test.c      |  2 +-
 tests/qtest/fuzz-virtio-scsi-test.c |  2 +-
 tests/qtest/intel-hda-test.c        |  2 +-
 tests/qtest/libqos/meson.build      |  2 +-
 tests/qtest/lpc-ich9-test.c         |  2 +-
 tests/qtest/meson.build             |  1 -
 tests/qtest/virtio-net-failover.c   |  1 +
 13 files changed, 33 insertions(+), 30 deletions(-)
 diff --git a/tests/avocado/replay_kernel.py b/tests/avocado/replay_kernel.py
 index 10d99403a4..c3422ea1e4 100644
 --- a/tests/avocado/replay_kernel.py
 +++ b/tests/avocado/replay_kernel.py
@@ -166,7 +166,7 @@ def test_aarch64_virt(self):
         """
         :avocado: tags=arch:aarch64
         :avocado: tags=machine:virt
 -        :avocado: tags=cpu:cortex-a53
 +        :avocado: tags=cpu:cortex-a57
         """
         kernel_url = ('https://archives.fedoraproject.org/pub/archive/fedora'
                       '/linux/releases/29/Everything/aarch64/os/images/pxeboot'
 diff --git a/tests/avocado/reverse_debugging.py b/tests/avocado/reverse_debugging.py
 index 92855a02a5..87822074b6 100644
 --- a/tests/avocado/reverse_debugging.py
 +++ b/tests/avocado/reverse_debugging.py
@@ -230,7 +230,7 @@ def test_aarch64_virt(self):
         """
         :avocado: tags=arch:aarch64
         :avocado: tags=machine:virt
 -        :avocado: tags=cpu:cortex-a53
 +        :avocado: tags=cpu:cortex-a57
         """
         kernel_url = ('https://archives.fedoraproject.org/pub/archive/fedora'
                       '/linux/releases/29/Everything/aarch64/os/images/pxeboot'
 diff --git a/tests/avocado/tcg_plugins.py b/tests/avocado/tcg_plugins.py
 index 15fd87b2c1..f0d9d89c93 100644
 --- a/tests/avocado/tcg_plugins.py
 +++ b/tests/avocado/tcg_plugins.py
@@ -66,7 +66,7 @@ def test_aarch64_virt_insn(self):
         :avocado: tags=accel:tcg
         :avocado: tags=arch:aarch64
         :avocado: tags=machine:virt
 -        :avocado: tags=cpu:cortex-a53
 +        :avocado: tags=cpu:cortex-a57
         """
         kernel_path = self._grab_aarch64_kernel()
         kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
@@ -96,7 +96,7 @@ def test_aarch64_virt_insn_icount(self):
         :avocado: tags=accel:tcg
         :avocado: tags=arch:aarch64
         :avocado: tags=machine:virt
 -        :avocado: tags=cpu:cortex-a53
 +        :avocado: tags=cpu:cortex-a57
         """
         kernel_path = self._grab_aarch64_kernel()
         kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
@@ -126,7 +126,7 @@ def test_aarch64_virt_mem_icount(self):
         :avocado: tags=accel:tcg
         :avocado: tags=arch:aarch64
         :avocado: tags=machine:virt
 -        :avocado: tags=cpu:cortex-a53
 +        :avocado: tags=cpu:cortex-a57
         """
         kernel_path = self._grab_aarch64_kernel()
         kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
 diff --git a/tests/qemu-iotests/meson.build b/tests/qemu-iotests/meson.build
 index fad340ad59..3c0d5241f6 100644
 --- a/tests/qemu-iotests/meson.build
 +++ b/tests/qemu-iotests/meson.build
@@ -51,21 +51,21 @@ foreach format, speed: qemu_iotests_formats
       check: true,
   )
 -  foreach item: rc.stdout().strip().split()
 -      args = [qemu_iotests_check_cmd,
 -              '-tap', '-' + format, item,
 -              '--source-dir', meson.current_source_dir(),
 -              '--build-dir', meson.current_build_dir()]
 -      # Some individual tests take as long as 45 seconds
 -      # Bump the timeout to 3 minutes for some headroom
 -      # on slow machines to minimize spurious failures
 -      test('io-' + format + '-' + item,
 -           python,
 -           args: args,
 -           depends: qemu_iotests_binaries,
 -           env: qemu_iotests_env,
 -           protocol: 'tap',
 -           timeout: 180,
 -           suite: suites)
 -  endforeach
 +#  foreach item: rc.stdout().strip().split()
 +#      args = [qemu_iotests_check_cmd,
 +#              '-tap', '-' + format, item,
 +#              '--source-dir', meson.current_source_dir(),
 +#              '--build-dir', meson.current_build_dir()]
 +#      # Some individual tests take as long as 45 seconds
 +#      # Bump the timeout to 3 minutes for some headroom
 +#      # on slow machines to minimize spurious failures
 +#      test('io-' + format + '-' + item,
 +#           python,
 +#           args: args,
 +#           depends: qemu_iotests_binaries,
 +#           env: qemu_iotests_env,
 +#           protocol: 'tap',
 +#           timeout: 180,
 +#           suite: suites)
 +#  endforeach
 endforeach
 diff --git a/tests/qemu-iotests/testenv.py b/tests/qemu-iotests/testenv.py
 index 588f30a4f1..3929a3634f 100644
 --- a/tests/qemu-iotests/testenv.py
 +++ b/tests/qemu-iotests/testenv.py
@@ -244,6 +244,9 @@ def __init__(self, source_dir: str, build_dir: str,
             if self.qemu_prog.endswith(f'qemu-system-{suffix}'):
                 self.qemu_options += f' -machine {machine}'
 +        if self.qemu_prog.endswith('qemu-system-x86_64'):
 +            self.qemu_options += ' -cpu Nehalem'
 +
         # QEMU_DEFAULT_MACHINE
         self.qemu_default_machine = get_default_machine(self.qemu_prog)
 diff --git a/tests/qtest/fuzz-e1000e-test.c b/tests/qtest/fuzz-e1000e-test.c
 index 5052883fb6..8242190170 100644
 --- a/tests/qtest/fuzz-e1000e-test.c
 +++ b/tests/qtest/fuzz-e1000e-test.c
@@ -17,7 +17,7 @@ static void test_lp1879531_eth_get_rss_ex_dst_addr(void)
 {
     QTestState *s;
 -    s = qtest_init("-nographic -monitor none -serial none -M pc-q35-5.0");
 +    s = qtest_init("-nographic -monitor none -serial none -M pc-q35-rhel9.4.0");
     qtest_outl(s, 0xcf8, 0x80001010);
     qtest_outl(s, 0xcfc, 0xe1020000);
 diff --git a/tests/qtest/fuzz-virtio-scsi-test.c b/tests/qtest/fuzz-virtio-scsi-test.c
 index e37b48b2cc..9f1965b530 100644
 --- a/tests/qtest/fuzz-virtio-scsi-test.c
 +++ b/tests/qtest/fuzz-virtio-scsi-test.c
@@ -19,7 +19,7 @@ static void test_mmio_oob_from_memory_region_cache(void)
 {
     QTestState *s;
 -    s = qtest_init("-M pc-q35-5.2 -m 512M "
 +    s = qtest_init("-M pc-q35-rhel9.4.0 -m 512M "
                    "-device virtio-scsi,num_queues=8,addr=03.0 ");
     qtest_outl(s, 0xcf8, 0x80001811);
 diff --git a/tests/qtest/intel-hda-test.c b/tests/qtest/intel-hda-test.c
 index 663bb6c485..2efc43e3f7 100644
 --- a/tests/qtest/intel-hda-test.c
 +++ b/tests/qtest/intel-hda-test.c
@@ -42,7 +42,7 @@ static void test_issue542_ich6(void)
 {
     QTestState *s;
 -    s = qtest_init("-nographic -nodefaults -M pc-q35-6.2 "
 +    s = qtest_init("-nographic -nodefaults -M pc-q35-rhel9.0.0 "
                    AUDIODEV
                    "-device intel-hda,id=" HDA_ID CODEC_DEVICES);
 diff --git a/tests/qtest/libqos/meson.build b/tests/qtest/libqos/meson.build
 index 3aed6efcb8..119613237e 100644
 --- a/tests/qtest/libqos/meson.build
 +++ b/tests/qtest/libqos/meson.build
@@ -44,7 +44,7 @@ libqos_srcs = files(
         'virtio-rng.c',
         'virtio-scsi.c',
         'virtio-serial.c',
 -        'virtio-iommu.c',
 +#        'virtio-iommu.c',
         'virtio-gpio.c',
         'virtio-scmi.c',
         'generic-pcihost.c',
 diff --git a/tests/qtest/lpc-ich9-test.c b/tests/qtest/lpc-ich9-test.c
 index 8ac95b89f7..0e118b76eb 100644
 --- a/tests/qtest/lpc-ich9-test.c
 +++ b/tests/qtest/lpc-ich9-test.c
@@ -15,7 +15,7 @@ static void test_lp1878642_pci_bus_get_irq_level_assert(void)
 {
     QTestState *s;
 -    s = qtest_init("-M pc-q35-5.0 "
 +    s = qtest_init("-M pc-q35-rhel9.4.0 "
                    "-nographic -monitor none -serial none");
     qtest_outl(s, 0xcf8, 0x8000f840); /* PMBASE */
 diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
 index 36c5c13a7b..a2887d6057 100644
 --- a/tests/qtest/meson.build
 +++ b/tests/qtest/meson.build
@@ -101,7 +101,6 @@ qtests_i386 = \
    'drive_del-test',
    'tco-test',
    'cpu-plug-test',
 -   'q35-test',
    'vmgenid-test',
    'migration-test',
    'test-x86-cpuid-compat',
 diff --git a/tests/qtest/virtio-net-failover.c b/tests/qtest/virtio-net-failover.c
 index 73dfabc272..a9dd304781 100644
 --- a/tests/qtest/virtio-net-failover.c
 +++ b/tests/qtest/virtio-net-failover.c
@@ -26,6 +26,7 @@
 #define PCI_SEL_BASE            0x0010
 #define BASE_MACHINE "-M q35 -nodefaults " \
 +    "-global ICH9-LPC.acpi-pci-hotplug-with-bridge-support=on " \
     "-device pcie-root-port,id=root0,addr=0x1,bus=pcie.0,chassis=1 " \
     "-device pcie-root-port,id=root1,addr=0x2,bus=pcie.0,chassis=2 "
 -- 
 2.39.3
--- a/0013-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
+++ b/0013-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
@ -1,52 +0,0 @@
 From ec651d300d350a37219b09f5baab827ae6891006 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 8 Jul 2020 08:35:50 +0200
 Subject: Use qemu-kvm in documentation instead of qemu-system-<arch>
 We change the name and location of qemu-kvm binaries. Update documentation
 to reflect this change. Only architectures available in RHEL are updated.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 docs/defs.rst.inc |  4 ++--
 qemu-options.hx   | 10 +++++-----
 2 files changed, 7 insertions(+), 7 deletions(-)
 diff --git a/docs/defs.rst.inc b/docs/defs.rst.inc
 index 52d6454b93..d74dbdeca9 100644
 --- a/docs/defs.rst.inc
 +++ b/docs/defs.rst.inc
@@ -9,7 +9,7 @@
    but the manpages will end up misrendered with following normal text
    incorrectly in boldface.
 -.. |qemu_system| replace:: qemu-system-x86_64
 -.. |qemu_system_x86| replace:: qemu-system-x86_64
 +.. |qemu_system| replace:: qemu-kvm
 +.. |qemu_system_x86| replace:: qemu-kvm
 .. |I2C| replace:: I\ :sup:`2`\ C
 .. |I2S| replace:: I\ :sup:`2`\ S
 diff --git a/qemu-options.hx b/qemu-options.hx
 index 8ce85d4559..4fc27ee2e2 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
@@ -3493,11 +3493,11 @@ SRST
     ::
 -        qemu -m 512 -object memory-backend-file,id=mem,size=512M,mem-path=/hugetlbfs,share=on \
 -             -numa node,memdev=mem \
 -             -chardev socket,id=chr0,path=/path/to/socket \
 -             -netdev type=vhost-user,id=net0,chardev=chr0 \
 -             -device virtio-net-pci,netdev=net0
 +        qemu-kvm -m 512 -object memory-backend-file,id=mem,size=512M,mem-path=/hugetlbfs,share=on \
 +                 -numa node,memdev=mem \
 +                 -chardev socket,id=chr0,path=/path/to/socket \
 +                 -netdev type=vhost-user,id=net0,chardev=chr0 \
 +                 -device virtio-net-pci,netdev=net0
 ``-netdev vhost-vdpa[,vhostdev=/path/to/dev][,vhostfd=h]``
     Establish a vhost-vdpa netdev.
 -- 
 2.39.3
--- a/0014-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch
+++ b/0014-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch
@ -1,58 +0,0 @@
 From 080f22d8fb8ca63996f1b6ecb3637033529d8016 Mon Sep 17 00:00:00 2001
 From: Kevin Wolf <kwolf@redhat.com>
 Date: Fri, 20 Aug 2021 18:25:12 +0200
 Subject: qcow2: Deprecation warning when opening v2 images rw
 qcow2 v3 has been around for a long time (since QEMU 1.1/RHEL 7), so
 there is no real reason any more to use it. People still using it might
 do so unintentionally. Warn about it and suggest upgrading during the
 RHEL 9 timeframe so that the code can possibly be disabled in RHEL 10.
 The warning is restricted to read-write mode and the system emulator.
 The primary motivation for not having it in qemu-img is that 'qemu-img
 amend' for upgrades would warn otherwise. It also avoids having to make
 too many changes to the test suite.
 bdrv_uses_whitelist() is used as a proxy for deciding whether we are
 running in a tool or the system emulator. This is not entirely clean,
 but it's what is available and the same function qcow2_do_open() already
 uses it this way for another warning.
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
 block/qcow2.c                    | 6 ++++++
 tests/qemu-iotests/common.filter | 1 +
 2 files changed, 7 insertions(+)
 diff --git a/block/qcow2.c b/block/qcow2.c
 index 956128b409..0e8b2f7518 100644
 --- a/block/qcow2.c
 +++ b/block/qcow2.c
@@ -1358,6 +1358,12 @@ qcow2_do_open(BlockDriverState *bs, QDict *options, int flags,
         ret = -ENOTSUP;
         goto fail;
     }
 +    if (header.version < 3 && !bdrv_is_read_only(bs) && bdrv_uses_whitelist()) {
 +        warn_report_once("qcow2 v2 images are deprecated and may not be "
 +                         "supported in future versions. Please consider "
 +                         "upgrading the image with 'qemu-img amend "
 +                         "-o compat=v3'.");
 +    }
     s->qcow_version = header.version;
 diff --git a/tests/qemu-iotests/common.filter b/tests/qemu-iotests/common.filter
 index 2846c83808..83472953a2 100644
 --- a/tests/qemu-iotests/common.filter
 +++ b/tests/qemu-iotests/common.filter
@@ -83,6 +83,7 @@ _filter_qemu()
 {
     gsed -e "s#\\(^\\|(qemu) \\)$(basename $QEMU_PROG):#\1QEMU_PROG:#" \
         -e 's#^QEMU [0-9]\+\.[0-9]\+\.[0-9]\+ monitor#QEMU X.Y.Z monitor#' \
 +        -e "/qcow2 v2 images are deprecated/d" \
         -e $'s#\r##' # QEMU monitor uses \r\n line endings
 }
 -- 
 2.39.3
--- a/0015-Add-upstream-compatibility-bits.patch
+++ b/0015-Add-upstream-compatibility-bits.patch
@ -1,145 +0,0 @@
 From 043ad5ce9789dbbfe1a888de58f6039ea7ae47a4 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 20 Mar 2024 05:34:32 -0400
 Subject: Add upstream compatibility bits
 Adding new compats structure for changes introduced during rebase to QEMU 9.0.0.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 Rebase notes (9.0.0 rc2):
 - Add aw-bits setting for aarch compat record (overwritten for 9.4 and older)
 ---
 hw/arm/virt.c              |  6 ++++--
 hw/core/machine.c          | 10 ++++++++++
 hw/i386/pc_piix.c          |  3 ++-
 hw/i386/pc_q35.c           |  3 +++
 hw/s390x/s390-virtio-ccw.c |  1 +
 include/hw/boards.h        |  3 +++
 6 files changed, 23 insertions(+), 3 deletions(-)
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index 22bc345137..3f0496cdb9 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
@@ -85,6 +85,7 @@
 #include "hw/char/pl011.h"
 #include "qemu/guest-random.h"
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static GlobalProperty arm_virt_compat[] = {
     { TYPE_VIRTIO_IOMMU_PCI, "aw-bits", "48" },
 };
@@ -101,7 +102,6 @@ static void arm_virt_compat_set(MachineClass *mc)
                      arm_virt_compat_len);
 }
 -#if 0 /* Disabled for Red Hat Enterprise Linux */
 #define DEFINE_VIRT_MACHINE_LATEST(major, minor, latest) \
     static void virt_##major##_##minor##_class_init(ObjectClass *oc, \
                                                     void *data) \
@@ -144,6 +144,8 @@ GlobalProperty arm_rhel_compat[] = {
     {"virtio-net-pci", "romfile", "" },
     {"virtio-net-pci-transitional", "romfile", "" },
     {"virtio-net-pci-non-transitional", "romfile", "" },
 +    /* arm_rhel_compat from arm_virt_compat, added for 9.0.0 rebase */
 +    { TYPE_VIRTIO_IOMMU_PCI, "aw-bits", "48" },
 };
 const size_t arm_rhel_compat_len = G_N_ELEMENTS(arm_rhel_compat);
@@ -3534,7 +3536,6 @@ static void rhel_machine_class_init(ObjectClass *oc, void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(oc);
 -    arm_virt_compat_set(mc);
     mc->family = "virt-rhel-Z";
     mc->init = machvirt_init;
@@ -3728,6 +3729,7 @@ type_init(rhel_machine_init);
 static void rhel940_virt_options(MachineClass *mc)
 {
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_5, hw_compat_rhel_9_5_len);
 }
 DEFINE_RHEL_MACHINE_AS_LATEST(9, 4, 0)
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index 695cb89a46..0f256d9633 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -302,6 +302,16 @@ const size_t hw_compat_2_1_len = G_N_ELEMENTS(hw_compat_2_1);
 const char *rhel_old_machine_deprecation =
     "machine types for previous major releases are deprecated";
 +GlobalProperty hw_compat_rhel_9_5[] = {
 +  /* hw_compat_rhel_9_5 from hw_compat_8_2 */
 +    { "migration", "zero-page-detection", "legacy"},
 +  /* hw_compat_rhel_9_5 from hw_compat_8_2 */
 +    { TYPE_VIRTIO_IOMMU_PCI, "granule", "4k" },
 +  /* hw_compat_rhel_9_5 from hw_compat_8_2 */
 +    { TYPE_VIRTIO_IOMMU_PCI, "aw-bits", "64" },
 +};
 +const size_t hw_compat_rhel_9_5_len = G_N_ELEMENTS(hw_compat_rhel_9_5);
 +
 GlobalProperty hw_compat_rhel_9_4[] = {
   /* hw_compat_rhel_9_4 from hw_compat_8_0 */
     { TYPE_VIRTIO_NET, "host_uso", "off"},
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
 index a647262d63..6b260682eb 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
@@ -1015,7 +1015,8 @@ static void pc_machine_rhel760_options(MachineClass *m)
     object_class_property_set_description(oc, "x-south-bridge",
                                      "Use a different south bridge than PIIX3");
 -
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_5,
 +		     hw_compat_rhel_9_5_len);
     compat_props_add(m->compat_props, hw_compat_rhel_9_4,
                      hw_compat_rhel_9_4_len);
     compat_props_add(m->compat_props, hw_compat_rhel_9_3,
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
 index e872dc7e46..2b54944c0f 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
@@ -733,6 +733,9 @@ static void pc_q35_machine_rhel940_options(MachineClass *m)
     m->desc = "RHEL-9.4.0 PC (Q35 + ICH9, 2009)";
     pcmc->smbios_stream_product = "RHEL";
     pcmc->smbios_stream_version = "9.4.0";
 +
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_5,
 +		     hw_compat_rhel_9_5_len);
 }
 DEFINE_PC_MACHINE(q35_rhel940, "pc-q35-rhel9.4.0", pc_q35_init_rhel940,
 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
 index ff753a29e0..9ad54682c6 100644
 --- a/hw/s390x/s390-virtio-ccw.c
 +++ b/hw/s390x/s390-virtio-ccw.c
@@ -1282,6 +1282,7 @@ static void ccw_machine_rhel940_instance_options(MachineState *machine)
 static void ccw_machine_rhel940_class_options(MachineClass *mc)
 {
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_5, hw_compat_rhel_9_5_len);
 }
 DEFINE_CCW_MACHINE(rhel940, "rhel9.4.0", true);
 diff --git a/include/hw/boards.h b/include/hw/boards.h
 index 46b8725c41..cca62f906b 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
@@ -514,6 +514,9 @@ extern const size_t hw_compat_2_2_len;
 extern GlobalProperty hw_compat_2_1[];
 extern const size_t hw_compat_2_1_len;
 +extern GlobalProperty hw_compat_rhel_9_5[];
 +extern const size_t hw_compat_rhel_9_5_len;
 +
 extern GlobalProperty hw_compat_rhel_9_4[];
 extern const size_t hw_compat_rhel_9_4_len;
 -- 
 2.39.3
--- a/0016-Disable-FDC-devices.patch
+++ b/0016-Disable-FDC-devices.patch
@ -1,29 +0,0 @@
 From f24c7a1feef2a6f153582c06f10871b78a014bf1 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 26 Apr 2024 05:58:31 -0400
 Subject: Disable FDC devices
 ---
 configs/devices/x86_64-softmmu/x86_64-rh-devices.mak | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
 diff --git a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 index d60ff1bcfc..ee75bb4c21 100644
 --- a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 +++ b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
@@ -19,9 +19,9 @@ CONFIG_DIMM=y
 CONFIG_E1000E_PCI_EXPRESS=y
 CONFIG_E1000_PCI=y
 CONFIG_EDU=y
 -CONFIG_FDC=y
 -CONFIG_FDC_SYSBUS=y
 -CONFIG_FDC_ISA=y
 +#CONFIG_FDC=y
 +#CONFIG_FDC_SYSBUS=y
 +#CONFIG_FDC_ISA=y
 CONFIG_FW_CFG_DMA=y
 CONFIG_HDA=y
 CONFIG_HYPERV=y
 -- 
 2.39.3
--- a/0017-Disable-vga-cirrus-device.patch
+++ b/0017-Disable-vga-cirrus-device.patch
@ -1,24 +0,0 @@
 From fe8c6cb1cecb3cde16871c4ec7368e4d004fa42a Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 26 Apr 2024 05:59:53 -0400
 Subject: Disable vga-cirrus device
 ---
 configs/devices/x86_64-softmmu/x86_64-rh-devices.mak | 1 -
 1 file changed, 1 deletion(-)
 diff --git a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 index ee75bb4c21..fe69f04ead 100644
 --- a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 +++ b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
@@ -87,7 +87,6 @@ CONFIG_USB_XHCI_PCI=y
 CONFIG_VFIO=y
 CONFIG_VFIO_PCI=y
 CONFIG_VGA=y
 -CONFIG_VGA_CIRRUS=y
 CONFIG_VGA_PCI=y
 CONFIG_VHOST_USER=y
 CONFIG_VHOST_USER_BLK=y
 -- 
 2.39.3
--- a/SOURCES/0001-redhat-Adding-slirp-to-the-exploded-tree.patch
+++ b/SOURCES/0001-redhat-Adding-slirp-to-the-exploded-tree.patch
--- a/SOURCES/0005-Initial-redhat-build.patch
+++ b/SOURCES/0005-Initial-redhat-build.patch
@ -0,0 +1,351 @@
 From 19ce5ff93ddd6b8a998348f2a5f59f603c5e11b7 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 12 Oct 2018 07:31:11 +0200
 Subject: Initial redhat build
 This patch introduces redhat build structure in redhat subdirectory. In addition,
 several issues are fixed in QEMU tree:
 - Change of app name for sasl_server_init in VNC code from qemu to qemu-kvm
  - As we use qemu-kvm as name in all places, this is updated to be consistent
 - Man page renamed from qemu to qemu-kvm
  - man page is installed using make install so we have to fix it in qemu tree
 This rebase includes changes up to qemu-kvm-6.1.0-5.el9
 Rebase notes (3.1.0):
 - added new configure options
 Rebase notes (4.0.0):
 - Added dependency to perl-Test-Harness (upstream)
 - Added dependency to python3-sphinx (upstream)
 - Change location of icons (upstream)
 - Remove .desktop file (added upstream)
 - Added qemu-trace-stap (added upstream)
 - Removed elf2dmp (added upstream)
 - Remove .buildinfo
 - Added pvh.bin rom (added upstream)
 - Added interop documentation files
 - Use python module instead of qemu.py (upstream)
 Rebase notes (4.1.0):
 - Remove edk2 files generated by build
 - Switch to rhel-8.1-candidate build target
 - Remove specs documentation
 - Switched from libssh2 to libssh
 - Add rc0 tarball usage hacks
 - Added BuildRequires for wget, rpm-build and python3-sphinx
 - Removed new unpacked files
 - Update configure line to use new options
 Rebase notes (4.2.0):
 - Disable iotest run during make check
 - README renamed to README.rst (upstream)
 - Removed ui-spice-app.so
 - Added relevant changes from "505f7f4 redhat: Adding slirp to the exploded tree"
 - Removed qemu-ga.8 install from spec file - installed by make
 - Removed spapr-rtas.bin (upstream)
 - Require newer SLOF (20191022)
 Rebase notes (5.1.0):
 - Use python3 for virtio_seg_max_adjust.py test
 - Removed qemu-trace-stap shebang from spec file
 - Added virtiofsd.1 (upstream)
 - Use out-of-tree build
 - New documentation structure (upstream)
 - Update local build
 - Removing installed qemu-storage-daemon (added upstream)
 - Removing opensbi-riscv32-sifive_u-fw_jump.bin (added upstream)
 - Disable iotests (moved from Enable make check commit)
 - Added missing configure options
 - Reorder configure options
 - qemu-pr-helper moved to /usr/libexec/ (upstream)
 - Added submodules for usb-redir, smartcard-reader and qxl display (upstream)
 - Added setting rc version in Makefile for build
 - removed --disable-vxhs configure option (removed upstream)
 - bumped required libusbx-devel version to 1.0.23
 - bumped libfdt version to 1.6.0
 Rebase notes (5.2.0 rc0):
 - Move libfdt dependency to qemu-kvm-core
 - Move manpage rename from Makefile to spec file
 - rename with-confsuffix configure option to with-suffix (upstream)
 - Bump libusbx Requires version to 1.0.234
 - Manual copy of keymaps in spec file (BZ 1875217)
 - Removed /usr/share/qemu-kvm/npcm7xx_bootrom.bin, considering it
  unpackaged for now.
 - Removed /usr/share/qemu-kvm/qboot.rom, considering unpackaged.
 - Added build dependency for meson and ninja-build
 - hw/s390/s390-pci-vfio.c hack - set NULL for g_autofree variables
 - Removed Chanelog (upstream)
 - Fix in directory used for docs (upstream add %name so we do not pass it in configure)
 - Package various .so as part of qemu-kvm-core package.
 Rebase notes (5.2.0 rc2):
 - Added fix for dtrace build on RHEL 8.4.0
 Rebase notes (5.2.0 rc3):
 - Added man page for qemu-pr-helper
 - Added new configure options
 - Update qemu-kiwi patches to v4
 Rebase notes (6.0.0):
 - update tracetool usage in spec file
 - remove qemu-storage-daemon-qmp-ref man page
 - remove qemu-storage-daemon man page
 - Added devel documentation
 - do not package virtfs-proxy-helper files
 - Use --with-git-submodules instead of --(enable|disable)-git-update
 - Minor build fixes for sending upstream
 - g_autofree initialization fixed upstream
 - Updated rc information usage
 - do not package package hw-s390x-virtio-gpu-ccw.so
 - Disable new switch options
 Rebase notes (6.1.0):
 - Fix warning issue in block.c
 - Download tarball from dist-git cache
 - Removed sheepdog driver
 - Added new display modules:
  - hw-display-virtio-gpu-gl.so
  - hw-display-virtio-gpu-pci-gl.so
  - hw-display-virtio-vga-gl.so
 - sasl fix moved from ui/vnc.c to ui/vnc-auth-sasl.c
 - Added accel-qtest-%{kvm_target} and accel-tcg-%{kvm_target}
 - Added about docs
 - Use -q option for setup
 - Added hw-usb-host.so
 - Disable new options (bpf, nvmm, slirp-smbd)
 Rebase notes (6.2.0):
 - Using internal meson
 - removed --disable-jemalloc and --disable-tcmalloc configure options
 - added audio-oss.so
 - added fdt requirement for x86_64
 - tests/acceptance renamed to tests/avocado
 - added multiboot_dma.bin
 - Removed conflict relics
 - Updated configure options
 Merged patches (3.1.0):
 - 01f0c9f RHEL8: Add disable configure options to qemu spec file
 - Spec file cleanups
 Merged patches (4.0.0):
 - aa4297c Add edk2 Requires to qemu-kvm
 - d124ff5779 Fixing brew build target
 - eb204b5 Introduce the qemu-kvm-tests rpm
 - 223cf0c Load kvm module during boot (partial)
 Merged patches (4.1.0):
 - ebb6e97 redhat: Fix LOCALVERSION creation
 - b0ab0cc redhat: enable tpmdev passthrough (not disabling tests)
 - 7cb3c4a Enable libpmem to support nvdimm
 - 8943607 qemu-kvm.spec: bump libseccomp >= 2.4.0
 - 27b7c44 rh: set CONFIG_BOCHS_DISPLAY=y for x86 (partial)
 - e1fe9fe x86_64-rh-devices: enable TPM emulation (partial)
 Merged patches (4.2.0):
 - 69e1fb2 enable virgla
 - d4f6115 enable virgl, for real this time ...
 Merged patches (5.1.0):
 - 5edf6bd Add support for rh-brew-module
 - f77d52d redhat: ship virtiofsd vhost-user device backend
 - 63f12d4 redhat: Always use module build target for rh-brew (modified)
 - 9b1e140 redhat: updating the modular target
 - 44b8bd0 spec: Fix python shenigans for tests
 Merged patches (5.2.0 rc0):
 - 9238ce7 Add support for simpletrace
 - 5797cff Remove explicit glusterfs-api dependency
 - fd62478 disable virgl
 - 0205018 redhat: link /etc/qemu-ga/fsfreeze-hook to /etc/qemu-kvm/
 - 3645097 redhat: Make all generated so files executable (not only block-*)
 Merged patches (5.2.0 rc2):
 - pjw 99657 redhat: introduces disable_everything macro into the configure call
 - pjw 99659 redhat: scripts/extract_build_cmd.py - Avoid listing empty lines
 - pjw 99658 redhat: Fixing rh-local build
 - pjw 99660 redhat: Add qemu-kiwi subpackage
 - d2e59ce redhat: add (un/pre)install systemd hooks for qemu-ga
 Merged patches (5.2.0 rc3):
 - pjw 99887 - redhat: allow Makefile rh-prep builddep to fail
 - pjw 99885 - redhat: adding rh-rpm target
 Merged patches (6.0.0):
 - 5ab9954a3b spec: find system python via meson
 - cd0f7db11f build-system: use b_staticpic=false
 - 80d2dec42c udev-kvm-check: remove the "exceeded subscription limit" message
 - 38959d51c0 redhat: Allow make to inherit params from parent make for rh-local
 - 1e0cfe458f redhat: moving all documentation files to qemu-kvm-docs
 - d7a594d02b redhat: makes qemu respect system's crypto profile
 - e2bbf1572b spec: Package qemu-storage-daemon
 - 92f10993ba spec: ui-spice sub-package
 - 8931e46069 spec: ui-opengl sub-package
 Merged patches (6.1.0):
 - 7bb57541b3 redhat: Install the s390-netboot.img that we've built
 - b4a8531f41 redhat: Fix "unversioned Obsoletes" warning
 - 141a1693c7 redhat: Move qemu-kvm-docs dependency to qemu-kvm
 - d75f59c6f9 redhat: introducting qemu-kvm-hw-usbredir
 - a934d8bf44 redhat: use the standard vhost-user JSON path
 Merged patches (6.2.0):
 - 4f3f04bbb6 spec: Remove qemu-kiwi build
 ---
 .gitignore                                 |    1 +
 .gitlab-ci.yml                             |   24 -
 .gitlab/issue_templates/bug.md             |   64 -
 .gitlab/issue_templates/feature_request.md |   32 -
 README.systemtap                           |   43 +
 meson.build                                |    4 +-
 redhat/Makefile                            |   90 +
 redhat/Makefile.common                     |   48 +
 redhat/README.tests                        |   39 +
 redhat/qemu-kvm.spec.template              | 3896 ++++++++++++++++++++
 redhat/scripts/extract_build_cmd.py        |    5 +-
 redhat/scripts/process-patches.sh          |   20 +-
 redhat/scripts/tarball_checksum.sh         |    2 +-
 redhat/udev-kvm-check.c                    |   19 +-
 scripts/qemu-guest-agent/fsfreeze-hook     |    2 +-
 scripts/systemtap/conf.d/qemu_kvm.conf     |    4 +
 scripts/systemtap/script.d/qemu_kvm.stp    |    1 +
 tests/check-block.sh                       |    2 +
 ui/vnc-auth-sasl.c                         |    2 +-
 19 files changed, 4142 insertions(+), 156 deletions(-)
 delete mode 100644 .gitlab-ci.yml
 delete mode 100644 .gitlab/issue_templates/bug.md
 delete mode 100644 .gitlab/issue_templates/feature_request.md
 create mode 100644 README.systemtap
 create mode 100644 redhat/Makefile
 create mode 100644 redhat/Makefile.common
 create mode 100644 redhat/README.tests
 create mode 100644 redhat/qemu-kvm.spec.template
 create mode 100644 scripts/systemtap/conf.d/qemu_kvm.conf
 create mode 100644 scripts/systemtap/script.d/qemu_kvm.stp
 diff --git a/README.systemtap b/README.systemtap
 new file mode 100644
 index 0000000000..ad913fc990
 --- /dev/null
 +++ b/README.systemtap
@@ -0,0 +1,43 @@
 +QEMU tracing using systemtap-initscript
 +---------------------------------------
 +
 +You can capture QEMU trace data all the time using systemtap-initscript.  This
 +uses SystemTap's flight recorder mode to trace all running guests to a
 +fixed-size buffer on the host.  Old trace entries are overwritten by new
 +entries when the buffer size wraps.
 +
 +1. Install the systemtap-initscript package:
 +  # yum install systemtap-initscript
 +
 +2. Install the systemtap scripts and the conf file:
 +  # cp /usr/share/qemu-kvm/systemtap/script.d/qemu_kvm.stp /etc/systemtap/script.d/
 +  # cp /usr/share/qemu-kvm/systemtap/conf.d/qemu_kvm.conf /etc/systemtap/conf.d/
 +
 +The set of trace events to enable is given in qemu_kvm.stp.  This SystemTap
 +script can be customized to add or remove trace events provided in
 +/usr/share/systemtap/tapset/qemu-kvm-simpletrace.stp.
 +
 +SystemTap customizations can be made to qemu_kvm.conf to control the flight
 +recorder buffer size and whether to store traces in memory only or disk too.
 +See stap(1) for option documentation.
 +
 +3. Start the systemtap service.
 +　# service systemtap start qemu_kvm
 +
 +4. Make the service start at boot time.
 +　# chkconfig systemtap on
 +
 +5. Confirm that the service works.
 +  # service systemtap status qemu_kvm
 +  qemu_kvm is running...
 +
 +When you want to inspect the trace buffer, perform the following steps:
 +
 +1. Dump the trace buffer.
 +  # staprun -A qemu_kvm >/tmp/trace.log
 +
 +2. Start the systemtap service because the preceding step stops the service.
 +  # service systemtap start qemu_kvm
 +
 +3. Translate the trace record to readable format.
 +  # /usr/share/qemu-kvm/simpletrace.py --no-header /usr/share/qemu-kvm/trace-events /tmp/trace.log
 diff --git a/meson.build b/meson.build
 index 96de1a6ef9..5f6ba86dbb 100644
 --- a/meson.build
 +++ b/meson.build
@@ -2108,7 +2108,9 @@ if capstone_opt == 'internal'
     # Include all configuration defines via a header file, which will wind up
     # as a dependency on the object file, and thus changes here will result
     # in a rebuild.
 -    '-include', 'capstone-defs.h'
 +    '-include', 'capstone-defs.h',
 +
 +    '-Wp,-D_GLIBCXX_ASSERTIONS',
   ]
   libcapstone = static_library('capstone',
 diff --git a/scripts/qemu-guest-agent/fsfreeze-hook b/scripts/qemu-guest-agent/fsfreeze-hook
 index 13aafd4845..e9b84ec028 100755
 --- a/scripts/qemu-guest-agent/fsfreeze-hook
 +++ b/scripts/qemu-guest-agent/fsfreeze-hook
@@ -8,7 +8,7 @@
 # request, it is issued with "thaw" argument after filesystem is thawed.
 LOGFILE=/var/log/qga-fsfreeze-hook.log
 -FSFREEZE_D=$(dirname -- "$0")/fsfreeze-hook.d
 +FSFREEZE_D=$(dirname -- "$(realpath $0)")/fsfreeze-hook.d
 # Check whether file $1 is a backup or rpm-generated file and should be ignored
 is_ignored_file() {
 diff --git a/scripts/systemtap/conf.d/qemu_kvm.conf b/scripts/systemtap/conf.d/qemu_kvm.conf
 new file mode 100644
 index 0000000000..372d8160a4
 --- /dev/null
 +++ b/scripts/systemtap/conf.d/qemu_kvm.conf
@@ -0,0 +1,4 @@
 +# Force load uprobes (see BZ#1118352)
 +stap -e 'probe process("/usr/libexec/qemu-kvm").function("main") { printf("") }' -c true
 +
 +qemu_kvm_OPT="-s4" # per-CPU buffer size, in megabytes
 diff --git a/scripts/systemtap/script.d/qemu_kvm.stp b/scripts/systemtap/script.d/qemu_kvm.stp
 new file mode 100644
 index 0000000000..c04abf9449
 --- /dev/null
 +++ b/scripts/systemtap/script.d/qemu_kvm.stp
@@ -0,0 +1 @@
 +probe qemu.kvm.simpletrace.handle_qmp_command,qemu.kvm.simpletrace.monitor_protocol_*,qemu.kvm.simpletrace.migrate_set_state {}
 diff --git a/tests/check-block.sh b/tests/check-block.sh
 index f86cb863de..6d38340d49 100755
 --- a/tests/check-block.sh
 +++ b/tests/check-block.sh
@@ -69,6 +69,8 @@ else
     fi
 fi
 +exit 0
 +
 cd tests/qemu-iotests
 # QEMU_CHECK_BLOCK_AUTO is used to disable some unstable sub-tests
 diff --git a/ui/vnc-auth-sasl.c b/ui/vnc-auth-sasl.c
 index 47fdae5b21..2a950caa2a 100644
 --- a/ui/vnc-auth-sasl.c
 +++ b/ui/vnc-auth-sasl.c
@@ -42,7 +42,7 @@
 bool vnc_sasl_server_init(Error **errp)
 {
 -    int saslErr = sasl_server_init(NULL, "qemu");
 +    int saslErr = sasl_server_init(NULL, "qemu-kvm");
     if (saslErr != SASL_OK) {
         error_setg(errp, "Failed to initialize SASL auth: %s",
 -- 
 2.27.0
--- a/SOURCES/0006-Enable-disable-devices-for-RHEL.patch
+++ b/SOURCES/0006-Enable-disable-devices-for-RHEL.patch
@ -0,0 +1,795 @@
 From 3d5a82d172345d17e300672909835262ff9dc917 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 2 Sep 2020 09:11:07 +0200
 Subject: Enable/disable devices for RHEL
 This commit adds all changes related to changes in supported devices.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 Rebase notes (qemu 3.1.0)
 - spapr_rng disabled in default_config
 - new hyperv.mak in default configs
 - Move changes from x86_64-softmmu.mak to i386-softmmu.mak
 - Added CONFIG_VIRTIO_MMIO to aarch64-softmmu.mak
 - Removed config_vga_isa.c changes as no longer needed
 - Removed new devices
 Rebase notes (4.0.0):
 - Added CONFIG_PCI_EXPRESS_GENERIC_BRIDGE for aarch64-softmmu.mak
 - Added CONFIG_ARM_VIRT for aarch64-softmmu.mak
 - Switch to KConfig (upstream)
 - Using device whitelist + without-defualt-devices option
 Rebase notes (4.1.0):
 - Added CONFIG_USB_OHCI_PCI for ppc64
 - Added CONFIG_XIVE_KVM for ppc64
 - Added CONFIG_ACPI_PCI for x86_64
 - Added CONFIG_SEMIHOSTING for aarch64
 - Cleanup aarch64 devices
 - Do not build a15mpcore.c
 - Removed ide-isa.c stub file
 - Use CONFIG_USB_EHCI_PCI on x86_64 (new upstream)
 Rebase notes (4.2.0-rc0):
 - Use conditional build for isa-superio.c (upstream change)
 - Rename PCI_PIIX to PCI_I440FX (upstream change)
 Rebase notes (4.2.0-rc3):
 - Disabled ccid-card-emulated (patch 92566)
 - Disabled vfio-pci-igd-lpc-bridge (patch 92565)
 Rebase notes (5.1.0):
 - added CONFIG_PCI_EXPRESS on ppc64 (due to upstream dependency)
 - Added CONFIG_NVDIMM
 - updated cortex-15 disabling to upstream code
 - Add CONFIG_ACPI_APEI for aarch64
 - removed obsolete hw/bt/Makefile.objs chunk
 - removed unnecessary changes in target/i386/cpu.c
 Rebase notes (5.2.0 rc0):
 - Added CONFIG_USB_XHCI_PCI on aarch64 ppc64 and x86_64
 - remove vl.c hack for no hpet
 - Enable CONFIG_PTIMER for aarch64
 - Do not package hw-display-virtio-gpu.so on s390x
 Rebase notes (5.2.0 rc1):
 - Added CONFIG_ARM_GIC for aarch64 (required for build)
 Rebase notes (weekly-210113):
 - Removed XICS_KVM, XICS_SPAPR, XIVE_KVM and XIVE_SPAPR config (removed upstream)
 Rebase notes (weekly-210120):
 - Add CONFIG_ARM_COMPATIBLE_SEMIHOSTING option
 Rebase notes (weekly-210203):
 - Rename CONFIG_PVPANIC to CONFIG_PVPANIC_ISA
 Rebase notes (weekly-210317):
 - Add new USB_STORAGE_CORE and USB_STORAGE_CLASSIC config for ppc64 and x86_64
 - Update disabling TCG cpus for AArch64
 Rebase notes (weekly-210519):
 - Do not use CONFIG_SPICE and CONFIG_OPENGL in default configs
 Rebase notes (weekly-210623):
 - Add CONFIG_TPM for archs with used TPM functionality
 Rebase notes (weekly-210714):
 - default_configs moved to configs
 Rebase notes (6.1.0 rc2):
 - Use --with-device-ARCH configure option to use redhat config files
 Rebase notes (6.2.0 rc3):
 - Do not remove -no-hpet documentation
 Merged patches (qemu 3.1.0):
 - d51e082 Re-enable CONFIG_HYPERV_TESTDEV
 - 4b889f3 Declare cirrus-vga as deprecated
 - b579d32 Do not build bluetooth support
 - 3eef52a Disable CONFIG_IPMI and CONFIG_I2C for ppc64
 - 9caf292 Disable CONFIG_CAN_BUS and CONFIG_CAN_SJA1000
 Merged patches (4.1.0):
 - 20a51f6 fdc: Revert downstream disablement of device "floppy"
 - f869cc0 fdc: Restrict floppy controllers to RHEL-7 machine types
 - 5909721 aarch64: Compile out IOH3420
 - 27b7c44 rh: set CONFIG_BOCHS_DISPLAY=y for x86 (partial)
 - 495a27d x86_64-rh-devices: add missing TPM passthrough
 - e1fe9fe x86_64-rh-devices: enable TPM emulation (partial)
 Merged patches (4.2.0):
 - f7587dd RHEL: disable hostmem-memfd
 Merged patches (5.1.0):
 - 4543a3c i386: Remove cpu64-rhel6 CPU model
 - 96533 aarch64: Remove tcg cpu types (pjw commit)
 - 559d589 Revert "RHEL: disable hostmem-memfd"
 - 441128e enable ramfb
 Merged patches (5.2.0 rc0):
 - f70eb50 RHEL-only: Enable vTPM for POWER in downstream configs
 - 69d8ae7 redhat: fix 5.0 rebase missing ISA TPM TIS
 - 8310f89 RHEL-only: Enable vTPM for ARM in downstream configs
 - 4a8ccfd Disable TPM passthrough backend on ARM
 Merged patches (6.0.0):
 - ff817df9e3 config: enable VFIO_CCW
 - 70d3924521 redhat: Add some devices for exporting upstream machine types
 - without machine type chunks
 - efac91b2b4 default-configs: Enable vhost-user-blk
 Merged patches (weekly-210630):
 - 59a178acff disable CONFIG_USB_STORAGE_BOT
 Merged patches (6.1.0 rc2):
 - 86f0025f16 aarch64: Add USB storage devices
 ---
 .../aarch64-softmmu/aarch64-rh-devices.mak    |  31 ++++++
 .../ppc64-softmmu/ppc64-rh-devices.mak        |  36 ++++++
 configs/devices/rh-virtio.mak                 |  10 ++
 .../s390x-softmmu/s390x-rh-devices.mak        |  16 +++
 .../x86_64-softmmu/x86_64-rh-devices.mak      | 104 ++++++++++++++++++
 .../x86_64-upstream-devices.mak               |   4 +
 hw/acpi/ich9.c                                |   4 +-
 hw/arm/meson.build                            |   2 +-
 hw/block/fdc.c                                |  10 ++
 hw/char/parallel.c                            |   9 ++
 hw/cpu/meson.build                            |   5 +-
 hw/display/cirrus_vga.c                       |   3 +
 hw/ide/piix.c                                 |   5 +-
 hw/input/pckbd.c                              |   2 +
 hw/net/e1000.c                                |   2 +
 hw/ppc/spapr_cpu_core.c                       |   2 +
 hw/timer/hpet.c                               |   8 ++
 hw/usb/meson.build                            |   2 +-
 redhat/qemu-kvm.spec.template                 |   9 +-
 target/arm/cpu_tcg.c                          |  10 ++
 target/ppc/cpu-models.c                       |  10 ++
 target/s390x/cpu_models_sysemu.c              |   3 +
 target/s390x/kvm/kvm.c                        |   8 ++
 23 files changed, 286 insertions(+), 9 deletions(-)
 create mode 100644 configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
 create mode 100644 configs/devices/ppc64-softmmu/ppc64-rh-devices.mak
 create mode 100644 configs/devices/rh-virtio.mak
 create mode 100644 configs/devices/s390x-softmmu/s390x-rh-devices.mak
 create mode 100644 configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 create mode 100644 configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak
 diff --git a/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak b/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
 new file mode 100644
 index 0000000000..0d4f9e6e4b
 --- /dev/null
 +++ b/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
@@ -0,0 +1,31 @@
 +include ../rh-virtio.mak
 +
 +CONFIG_ARM_GIC_KVM=y
 +CONFIG_ARM_GIC=y
 +CONFIG_ARM_SMMUV3=y
 +CONFIG_ARM_V7M=y
 +CONFIG_ARM_VIRT=y
 +CONFIG_EDID=y
 +CONFIG_PCIE_PORT=y
 +CONFIG_PCI_DEVICES=y
 +CONFIG_PCI_TESTDEV=y
 +CONFIG_PFLASH_CFI01=y
 +CONFIG_SCSI=y
 +CONFIG_SEMIHOSTING=y
 +CONFIG_USB=y
 +CONFIG_USB_XHCI=y
 +CONFIG_USB_XHCI_PCI=y
 +CONFIG_USB_STORAGE_CORE=y
 +CONFIG_USB_STORAGE_CLASSIC=y
 +CONFIG_VFIO=y
 +CONFIG_VFIO_PCI=y
 +CONFIG_VIRTIO_MMIO=y
 +CONFIG_VIRTIO_PCI=y
 +CONFIG_XIO3130=y
 +CONFIG_NVDIMM=y
 +CONFIG_ACPI_APEI=y
 +CONFIG_TPM=y
 +CONFIG_TPM_EMULATOR=y
 +CONFIG_TPM_TIS_SYSBUS=y
 +CONFIG_PTIMER=y
 +CONFIG_ARM_COMPATIBLE_SEMIHOSTING=y
 diff --git a/configs/devices/ppc64-softmmu/ppc64-rh-devices.mak b/configs/devices/ppc64-softmmu/ppc64-rh-devices.mak
 new file mode 100644
 index 0000000000..73e3ee0293
 --- /dev/null
 +++ b/configs/devices/ppc64-softmmu/ppc64-rh-devices.mak
@@ -0,0 +1,36 @@
 +include ../rh-virtio.mak
 +
 +CONFIG_DIMM=y
 +CONFIG_MEM_DEVICE=y
 +CONFIG_NVDIMM=y
 +CONFIG_PCI=y
 +CONFIG_PCI_DEVICES=y
 +CONFIG_PCI_TESTDEV=y
 +CONFIG_PCI_EXPRESS=y
 +CONFIG_PSERIES=y
 +CONFIG_SCSI=y
 +CONFIG_SPAPR_VSCSI=y
 +CONFIG_TEST_DEVICES=y
 +CONFIG_USB=y
 +CONFIG_USB_OHCI=y
 +CONFIG_USB_OHCI_PCI=y
 +CONFIG_USB_SMARTCARD=y
 +CONFIG_USB_STORAGE_CORE=y
 +CONFIG_USB_STORAGE_CLASSIC=y
 +CONFIG_USB_XHCI=y
 +CONFIG_USB_XHCI_NEC=y
 +CONFIG_USB_XHCI_PCI=y
 +CONFIG_VFIO=y
 +CONFIG_VFIO_PCI=y
 +CONFIG_VGA=y
 +CONFIG_VGA_PCI=y
 +CONFIG_VHOST_USER=y
 +CONFIG_VIRTIO_PCI=y
 +CONFIG_VIRTIO_VGA=y
 +CONFIG_WDT_IB6300ESB=y
 +CONFIG_XICS=y
 +CONFIG_XIVE=y
 +CONFIG_TPM=y
 +CONFIG_TPM_SPAPR=y
 +CONFIG_TPM_EMULATOR=y
 +CONFIG_TPM_PASSTHROUGH=y
 diff --git a/configs/devices/rh-virtio.mak b/configs/devices/rh-virtio.mak
 new file mode 100644
 index 0000000000..94ede1b5f6
 --- /dev/null
 +++ b/configs/devices/rh-virtio.mak
@@ -0,0 +1,10 @@
 +CONFIG_VIRTIO=y
 +CONFIG_VIRTIO_BALLOON=y
 +CONFIG_VIRTIO_BLK=y
 +CONFIG_VIRTIO_GPU=y
 +CONFIG_VIRTIO_INPUT=y
 +CONFIG_VIRTIO_INPUT_HOST=y
 +CONFIG_VIRTIO_NET=y
 +CONFIG_VIRTIO_RNG=y
 +CONFIG_VIRTIO_SCSI=y
 +CONFIG_VIRTIO_SERIAL=y
 diff --git a/configs/devices/s390x-softmmu/s390x-rh-devices.mak b/configs/devices/s390x-softmmu/s390x-rh-devices.mak
 new file mode 100644
 index 0000000000..165c082e87
 --- /dev/null
 +++ b/configs/devices/s390x-softmmu/s390x-rh-devices.mak
@@ -0,0 +1,16 @@
 +include ../rh-virtio.mak
 +
 +CONFIG_PCI=y
 +CONFIG_S390_CCW_VIRTIO=y
 +CONFIG_S390_FLIC=y
 +CONFIG_S390_FLIC_KVM=y
 +CONFIG_SCLPCONSOLE=y
 +CONFIG_SCSI=y
 +CONFIG_TERMINAL3270=y
 +CONFIG_VFIO=y
 +CONFIG_VFIO_AP=y
 +CONFIG_VFIO_CCW=y
 +CONFIG_VFIO_PCI=y
 +CONFIG_VHOST_USER=y
 +CONFIG_VIRTIO_CCW=y
 +CONFIG_WDT_DIAG288=y
 diff --git a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 new file mode 100644
 index 0000000000..ddf036f042
 --- /dev/null
 +++ b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
@@ -0,0 +1,104 @@
 +include ../rh-virtio.mak
 +include x86_64-upstream-devices.mak
 +
 +CONFIG_AC97=y
 +CONFIG_ACPI=y
 +CONFIG_ACPI_PCI=y
 +CONFIG_ACPI_CPU_HOTPLUG=y
 +CONFIG_ACPI_MEMORY_HOTPLUG=y
 +CONFIG_ACPI_NVDIMM=y
 +CONFIG_ACPI_SMBUS=y
 +CONFIG_ACPI_VMGENID=y
 +CONFIG_ACPI_X86=y
 +CONFIG_ACPI_X86_ICH=y
 +CONFIG_AHCI=y
 +CONFIG_APIC=y
 +CONFIG_APM=y
 +CONFIG_BOCHS_DISPLAY=y
 +CONFIG_DIMM=y
 +CONFIG_E1000E_PCI_EXPRESS=y
 +CONFIG_E1000_PCI=y
 +CONFIG_EDU=y
 +CONFIG_FDC=y
 +CONFIG_FDC_SYSBUS=y
 +CONFIG_FW_CFG_DMA=y
 +CONFIG_HDA=y
 +CONFIG_HYPERV=y
 +CONFIG_HYPERV_TESTDEV=y
 +CONFIG_I2C=y
 +CONFIG_I440FX=y
 +CONFIG_I8254=y
 +CONFIG_I8257=y
 +CONFIG_I8259=y
 +CONFIG_I82801B11=y
 +CONFIG_IDE_CORE=y
 +CONFIG_IDE_PCI=y
 +CONFIG_IDE_PIIX=y
 +CONFIG_IDE_QDEV=y
 +CONFIG_IOAPIC=y
 +CONFIG_IOH3420=y
 +CONFIG_ISA_BUS=y
 +CONFIG_ISA_DEBUG=y
 +CONFIG_ISA_TESTDEV=y
 +CONFIG_LPC_ICH9=y
 +CONFIG_MC146818RTC=y
 +CONFIG_MEM_DEVICE=y
 +CONFIG_NVDIMM=y
 +CONFIG_PAM=y
 +CONFIG_PC=y
 +CONFIG_PCI=y
 +CONFIG_PCIE_PORT=y
 +CONFIG_PCI_DEVICES=y
 +CONFIG_PCI_EXPRESS=y
 +CONFIG_PCI_EXPRESS_Q35=y
 +CONFIG_PCI_I440FX=y
 +CONFIG_PCI_TESTDEV=y
 +CONFIG_PCKBD=y
 +CONFIG_PCSPK=y
 +CONFIG_PC_ACPI=y
 +CONFIG_PC_PCI=y
 +CONFIG_PFLASH_CFI01=y
 +CONFIG_PVPANIC_ISA=y
 +CONFIG_PXB=y
 +CONFIG_Q35=y
 +CONFIG_QXL=y
 +CONFIG_RTL8139_PCI=y
 +CONFIG_SCSI=y
 +CONFIG_SERIAL=y
 +CONFIG_SERIAL_ISA=y
 +CONFIG_SERIAL_PCI=y
 +CONFIG_SEV=y
 +CONFIG_SGA=y
 +CONFIG_SMBIOS=y
 +CONFIG_SMBUS_EEPROM=y
 +CONFIG_TEST_DEVICES=y
 +CONFIG_USB=y
 +CONFIG_USB_EHCI=y
 +CONFIG_USB_EHCI_PCI=y
 +CONFIG_USB_SMARTCARD=y
 +CONFIG_USB_STORAGE_CORE=y
 +CONFIG_USB_STORAGE_CLASSIC=y
 +CONFIG_USB_UHCI=y
 +CONFIG_USB_XHCI=y
 +CONFIG_USB_XHCI_NEC=y
 +CONFIG_USB_XHCI_PCI=y
 +CONFIG_VFIO=y
 +CONFIG_VFIO_PCI=y
 +CONFIG_VGA=y
 +CONFIG_VGA_CIRRUS=y
 +CONFIG_VGA_PCI=y
 +CONFIG_VHOST_USER=y
 +CONFIG_VHOST_USER_BLK=y
 +CONFIG_VIRTIO_PCI=y
 +CONFIG_VIRTIO_VGA=y
 +CONFIG_VMMOUSE=y
 +CONFIG_VMPORT=y
 +CONFIG_VTD=y
 +CONFIG_WDT_IB6300ESB=y
 +CONFIG_WDT_IB700=y
 +CONFIG_XIO3130=y
 +CONFIG_TPM=y
 +CONFIG_TPM_CRB=y
 +CONFIG_TPM_TIS_ISA=y
 +CONFIG_TPM_EMULATOR=y
 +CONFIG_TPM_PASSTHROUGH=y
 diff --git a/configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak b/configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak
 new file mode 100644
 index 0000000000..2cd20f54d2
 --- /dev/null
 +++ b/configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak
@@ -0,0 +1,4 @@
 +# We need "isa-parallel"
 +CONFIG_PARALLEL=y
 +# We need "hpet"
 +CONFIG_HPET=y
 diff --git a/hw/acpi/ich9.c b/hw/acpi/ich9.c
 index ebe08ed831..381ef2ddcf 100644
 --- a/hw/acpi/ich9.c
 +++ b/hw/acpi/ich9.c
@@ -438,8 +438,8 @@ void ich9_pm_add_properties(Object *obj, ICH9LPCPMRegs *pm)
     static const uint32_t gpe0_len = ICH9_PMIO_GPE0_LEN;
     pm->acpi_memory_hotplug.is_enabled = true;
     pm->cpu_hotplug_legacy = true;
 -    pm->disable_s3 = 0;
 -    pm->disable_s4 = 0;
 +    pm->disable_s3 = 1;
 +    pm->disable_s4 = 1;
     pm->s4_val = 2;
     pm->use_acpi_hotplug_bridge = true;
     pm->keep_pci_slot_hpc = true;
 diff --git a/hw/arm/meson.build b/hw/arm/meson.build
 index 721a8eb8be..87ed4dd914 100644
 --- a/hw/arm/meson.build
 +++ b/hw/arm/meson.build
@@ -31,7 +31,7 @@ arm_ss.add(when: 'CONFIG_VEXPRESS', if_true: files('vexpress.c'))
 arm_ss.add(when: 'CONFIG_ZYNQ', if_true: files('xilinx_zynq.c'))
 arm_ss.add(when: 'CONFIG_SABRELITE', if_true: files('sabrelite.c'))
 -arm_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('armv7m.c'))
 +#arm_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('armv7m.c'))
 arm_ss.add(when: 'CONFIG_EXYNOS4', if_true: files('exynos4210.c'))
 arm_ss.add(when: 'CONFIG_PXA2XX', if_true: files('pxa2xx.c', 'pxa2xx_gpio.c', 'pxa2xx_pic.c'))
 arm_ss.add(when: 'CONFIG_DIGIC', if_true: files('digic.c'))
 diff --git a/hw/block/fdc.c b/hw/block/fdc.c
 index 21d18ac2e3..97fa6de423 100644
 --- a/hw/block/fdc.c
 +++ b/hw/block/fdc.c
@@ -48,6 +48,8 @@
 #include "qom/object.h"
 #include "fdc-internal.h"
 +#include "hw/boards.h"
 +
 /********************************************************/
 /* debug Floppy devices */
@@ -2337,6 +2339,14 @@ void fdctrl_realize_common(DeviceState *dev, FDCtrl *fdctrl, Error **errp)
     FDrive *drive;
     static int command_tables_inited = 0;
 +    /* Restricted for Red Hat Enterprise Linux: */
 +    MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
 +    if (!strstr(mc->name, "-rhel7.")) {
 +        error_setg(errp, "Device %s is not supported with machine type %s",
 +                   object_get_typename(OBJECT(dev)), mc->name);
 +        return;
 +    }
 +
     if (fdctrl->fallback == FLOPPY_DRIVE_TYPE_AUTO) {
         error_setg(errp, "Cannot choose a fallback FDrive type of 'auto'");
         return;
 diff --git a/hw/char/parallel.c b/hw/char/parallel.c
 index b45e67bfbb..e5f108211b 100644
 --- a/hw/char/parallel.c
 +++ b/hw/char/parallel.c
@@ -29,6 +29,7 @@
 #include "chardev/char-parallel.h"
 #include "chardev/char-fe.h"
 #include "hw/acpi/aml-build.h"
 +#include "hw/boards.h"
 #include "hw/irq.h"
 #include "hw/isa/isa.h"
 #include "hw/qdev-properties.h"
@@ -534,6 +535,14 @@ static void parallel_isa_realizefn(DeviceState *dev, Error **errp)
     int base;
     uint8_t dummy;
 +    /* Restricted for Red Hat Enterprise Linux */
 +    MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
 +    if (strstr(mc->name, "rhel")) {
 +        error_setg(errp, "Device %s is not supported with machine type %s",
 +                   object_get_typename(OBJECT(dev)), mc->name);
 +        return;
 +    }
 +
     if (!qemu_chr_fe_backend_connected(&s->chr)) {
         error_setg(errp, "Can't create parallel device, empty char device");
         return;
 diff --git a/hw/cpu/meson.build b/hw/cpu/meson.build
 index 9e52fee9e7..bb71c9f3e7 100644
 --- a/hw/cpu/meson.build
 +++ b/hw/cpu/meson.build
@@ -1,6 +1,7 @@
 -softmmu_ss.add(files('core.c', 'cluster.c'))
 +#softmmu_ss.add(files('core.c', 'cluster.c'))
 +softmmu_ss.add(files('core.c'))
 specific_ss.add(when: 'CONFIG_ARM11MPCORE', if_true: files('arm11mpcore.c'))
 specific_ss.add(when: 'CONFIG_REALVIEW', if_true: files('realview_mpcore.c'))
 specific_ss.add(when: 'CONFIG_A9MPCORE', if_true: files('a9mpcore.c'))
 -specific_ss.add(when: 'CONFIG_A15MPCORE', if_true: files('a15mpcore.c'))
 +#specific_ss.add(when: 'CONFIG_A15MPCORE', if_true: files('a15mpcore.c'))
 diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
 index fdca6ca659..fa1a7eee51 100644
 --- a/hw/display/cirrus_vga.c
 +++ b/hw/display/cirrus_vga.c
@@ -2945,6 +2945,9 @@ static void pci_cirrus_vga_realize(PCIDevice *dev, Error **errp)
      PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(dev);
      int16_t device_id = pc->device_id;
 +     warn_report("'cirrus-vga' is deprecated, "
 +                 "please use a different VGA card instead");
 +
      /* follow real hardware, cirrus card emulated has 4 MB video memory.
        Also accept 8 MB/16 MB for backward compatibility. */
      if (s->vga.vram_size_mb != 4 && s->vga.vram_size_mb != 8 &&
 diff --git a/hw/ide/piix.c b/hw/ide/piix.c
 index ce89fd0aa3..fbcf802b13 100644
 --- a/hw/ide/piix.c
 +++ b/hw/ide/piix.c
@@ -232,7 +232,8 @@ static void piix3_ide_class_init(ObjectClass *klass, void *data)
     k->device_id = PCI_DEVICE_ID_INTEL_82371SB_1;
     k->class_id = PCI_CLASS_STORAGE_IDE;
     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 -    dc->hotpluggable = false;
 +    /* Disabled for Red Hat Enterprise Linux: */
 +    dc->user_creatable = false;
 }
 static const TypeInfo piix3_ide_info = {
@@ -261,6 +262,8 @@ static void piix4_ide_class_init(ObjectClass *klass, void *data)
     k->class_id = PCI_CLASS_STORAGE_IDE;
     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->hotpluggable = false;
 +    /* Disabled for Red Hat Enterprise Linux: */
 +    dc->user_creatable = false;
 }
 static const TypeInfo piix4_ide_info = {
 diff --git a/hw/input/pckbd.c b/hw/input/pckbd.c
 index baba62f357..bc360347ea 100644
 --- a/hw/input/pckbd.c
 +++ b/hw/input/pckbd.c
@@ -796,6 +796,8 @@ static void i8042_class_initfn(ObjectClass *klass, void *data)
     dc->vmsd = &vmstate_kbd_isa;
     isa->build_aml = i8042_build_aml;
     set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
 +    /* Disabled for Red Hat Enterprise Linux: */
 +    dc->user_creatable = false;
 }
 static const TypeInfo i8042_info = {
 diff --git a/hw/net/e1000.c b/hw/net/e1000.c
 index f5bc81296d..282d01e374 100644
 --- a/hw/net/e1000.c
 +++ b/hw/net/e1000.c
@@ -1821,6 +1821,7 @@ static const E1000Info e1000_devices[] = {
         .revision  = 0x03,
         .phy_id2   = E1000_PHY_ID2_8254xx_DEFAULT,
     },
 +#if 0 /* Disabled for Red Hat Enterprise Linux 7 */
     {
         .name      = "e1000-82544gc",
         .device_id = E1000_DEV_ID_82544GC_COPPER,
@@ -1833,6 +1834,7 @@ static const E1000Info e1000_devices[] = {
         .revision  = 0x03,
         .phy_id2   = E1000_PHY_ID2_8254xx_DEFAULT,
     },
 +#endif
 };
 static void e1000_register_types(void)
 diff --git a/hw/ppc/spapr_cpu_core.c b/hw/ppc/spapr_cpu_core.c
 index 58e7341cb7..8ba34f6a1d 100644
 --- a/hw/ppc/spapr_cpu_core.c
 +++ b/hw/ppc/spapr_cpu_core.c
@@ -370,10 +370,12 @@ static const TypeInfo spapr_cpu_core_type_infos[] = {
         .instance_size = sizeof(SpaprCpuCore),
         .class_size = sizeof(SpaprCpuCoreClass),
     },
 +#if 0  /* Disabled for Red Hat Enterprise Linux */
     DEFINE_SPAPR_CPU_CORE_TYPE("970_v2.2"),
     DEFINE_SPAPR_CPU_CORE_TYPE("970mp_v1.0"),
     DEFINE_SPAPR_CPU_CORE_TYPE("970mp_v1.1"),
     DEFINE_SPAPR_CPU_CORE_TYPE("power5+_v2.1"),
 +#endif
     DEFINE_SPAPR_CPU_CORE_TYPE("power7_v2.3"),
     DEFINE_SPAPR_CPU_CORE_TYPE("power7+_v2.1"),
     DEFINE_SPAPR_CPU_CORE_TYPE("power8_v2.0"),
 diff --git a/hw/timer/hpet.c b/hw/timer/hpet.c
 index 9520471be2..202e032524 100644
 --- a/hw/timer/hpet.c
 +++ b/hw/timer/hpet.c
@@ -733,6 +733,14 @@ static void hpet_realize(DeviceState *dev, Error **errp)
     int i;
     HPETTimer *timer;
 +    /* Restricted for Red Hat Enterprise Linux */
 +    MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
 +    if (strstr(mc->name, "rhel")) {
 +        error_setg(errp, "Device %s is not supported with machine type %s",
 +                   object_get_typename(OBJECT(dev)), mc->name);
 +        return;
 +    }
 +
     if (!s->intcap) {
         warn_report("Hpet's intcap not initialized");
     }
 diff --git a/hw/usb/meson.build b/hw/usb/meson.build
 index de853d780d..0776ae6a20 100644
 --- a/hw/usb/meson.build
 +++ b/hw/usb/meson.build
@@ -52,7 +52,7 @@ softmmu_ss.add(when: 'CONFIG_USB_SMARTCARD', if_true: files('dev-smartcard-reade
 if cacard.found()
   usbsmartcard_ss = ss.source_set()
   usbsmartcard_ss.add(when: 'CONFIG_USB_SMARTCARD',
 -                      if_true: [cacard, files('ccid-card-emulated.c', 'ccid-card-passthru.c')])
 +                      if_true: [cacard, files('ccid-card-passthru.c')])
   hw_usb_modules += {'smartcard': usbsmartcard_ss}
 endif
 diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
 index 13d0e9b195..3826fa5122 100644
 --- a/target/arm/cpu_tcg.c
 +++ b/target/arm/cpu_tcg.c
@@ -22,6 +22,7 @@
 /* CPU models. These are not needed for the AArch64 linux-user build. */
 #if !defined(CONFIG_USER_ONLY) || !defined(TARGET_AARCH64)
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 #if !defined(CONFIG_USER_ONLY) && defined(CONFIG_TCG)
 static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
 {
@@ -375,6 +376,7 @@ static void cortex_a9_initfn(Object *obj)
     cpu->ccsidr[1] = 0x200fe019; /* 16k L1 icache. */
     define_arm_cp_regs(cpu, cortexa9_cp_reginfo);
 }
 +#endif /* disabled for RHEL */
 #ifndef CONFIG_USER_ONLY
 static uint64_t a15_l2ctlr_read(CPUARMState *env, const ARMCPRegInfo *ri)
@@ -400,6 +402,7 @@ static const ARMCPRegInfo cortexa15_cp_reginfo[] = {
     REGINFO_SENTINEL
 };
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void cortex_a7_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
@@ -445,6 +448,7 @@ static void cortex_a7_initfn(Object *obj)
     cpu->ccsidr[2] = 0x711fe07a; /* 4096K L2 unified cache */
     define_arm_cp_regs(cpu, cortexa15_cp_reginfo); /* Same as A15 */
 }
 +#endif /* disabled for RHEL */
 static void cortex_a15_initfn(Object *obj)
 {
@@ -488,6 +492,7 @@ static void cortex_a15_initfn(Object *obj)
     define_arm_cp_regs(cpu, cortexa15_cp_reginfo);
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void cortex_m0_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
@@ -928,6 +933,7 @@ static void arm_v7m_class_init(ObjectClass *oc, void *data)
     cc->gdb_core_xml_file = "arm-m-profile.xml";
 }
 +#endif /* disabled for RHEL */
 #ifndef TARGET_AARCH64
 /*
@@ -1007,6 +1013,7 @@ static void arm_max_initfn(Object *obj)
 #endif /* !TARGET_AARCH64 */
 static const ARMCPUInfo arm_tcg_cpus[] = {
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
     { .name = "arm926",      .initfn = arm926_initfn },
     { .name = "arm946",      .initfn = arm946_initfn },
     { .name = "arm1026",     .initfn = arm1026_initfn },
@@ -1022,7 +1029,9 @@ static const ARMCPUInfo arm_tcg_cpus[] = {
     { .name = "cortex-a7",   .initfn = cortex_a7_initfn },
     { .name = "cortex-a8",   .initfn = cortex_a8_initfn },
     { .name = "cortex-a9",   .initfn = cortex_a9_initfn },
 +#endif /* disabled for RHEL */
     { .name = "cortex-a15",  .initfn = cortex_a15_initfn },
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
     { .name = "cortex-m0",   .initfn = cortex_m0_initfn,
                              .class_init = arm_v7m_class_init },
     { .name = "cortex-m3",   .initfn = cortex_m3_initfn,
@@ -1053,6 +1062,7 @@ static const ARMCPUInfo arm_tcg_cpus[] = {
     { .name = "pxa270-b1",   .initfn = pxa270b1_initfn },
     { .name = "pxa270-c0",   .initfn = pxa270c0_initfn },
     { .name = "pxa270-c5",   .initfn = pxa270c5_initfn },
 +#endif /* disabled for RHEL */
 #ifndef TARGET_AARCH64
     { .name = "max",         .initfn = arm_max_initfn },
 #endif
 diff --git a/target/ppc/cpu-models.c b/target/ppc/cpu-models.c
 index 4baa111713..d779c4d1d5 100644
 --- a/target/ppc/cpu-models.c
 +++ b/target/ppc/cpu-models.c
@@ -66,6 +66,7 @@
 #define POWERPC_DEF(_name, _pvr, _type, _desc)                              \
     POWERPC_DEF_SVR(_name, _desc, _pvr, POWERPC_SVR_NONE, _type)
 +#if 0  /* Embedded and 32-bit CPUs disabled for Red Hat Enterprise Linux */
     /* Embedded PowerPC                                                      */
     /* PowerPC 401 family                                                    */
     POWERPC_DEF("401",           CPU_POWERPC_401,                    401,
@@ -740,8 +741,10 @@
                 "PowerPC 7447A v1.2 (G4)")
     POWERPC_DEF("7457a_v1.2",    CPU_POWERPC_74x7A_v12,              7455,
                 "PowerPC 7457A v1.2 (G4)")
 +#endif
     /* 64 bits PowerPC                                                       */
 #if defined(TARGET_PPC64)
 +#if 0  /* Disabled for Red Hat Enterprise Linux */
     POWERPC_DEF("970_v2.2",      CPU_POWERPC_970_v22,                970,
                 "PowerPC 970 v2.2")
     POWERPC_DEF("970fx_v1.0",    CPU_POWERPC_970FX_v10,              970,
@@ -760,6 +763,7 @@
                 "PowerPC 970MP v1.1")
     POWERPC_DEF("power5+_v2.1",  CPU_POWERPC_POWER5P_v21,            POWER5P,
                 "POWER5+ v2.1")
 +#endif
     POWERPC_DEF("power7_v2.3",   CPU_POWERPC_POWER7_v23,             POWER7,
                 "POWER7 v2.3")
     POWERPC_DEF("power7+_v2.1",  CPU_POWERPC_POWER7P_v21,            POWER7,
@@ -784,6 +788,7 @@
 /* PowerPC CPU aliases                                                     */
 PowerPCCPUAlias ppc_cpu_aliases[] = {
 +#if 0  /* Embedded and 32-bit CPUs disabled for Red Hat Enterprise Linux */
     { "403", "403gc" },
     { "405", "405d4" },
     { "405cr", "405crc" },
@@ -942,12 +947,15 @@ PowerPCCPUAlias ppc_cpu_aliases[] = {
     { "7447a", "7447a_v1.2" },
     { "7457a", "7457a_v1.2" },
     { "apollo7pm", "7457a_v1.0" },
 +#endif
 #if defined(TARGET_PPC64)
 +#if 0  /* Disabled for Red Hat Enterprise Linux */
     { "970", "970_v2.2" },
     { "970fx", "970fx_v3.1" },
     { "970mp", "970mp_v1.1" },
     { "power5+", "power5+_v2.1" },
     { "power5gs", "power5+_v2.1" },
 +#endif
     { "power7", "power7_v2.3" },
     { "power7+", "power7+_v2.1" },
     { "power8e", "power8e_v2.1" },
@@ -957,6 +965,7 @@ PowerPCCPUAlias ppc_cpu_aliases[] = {
     { "power10", "power10_v2.0" },
 #endif
 +#if 0  /* Disabled for Red Hat Enterprise Linux */
     /* Generic PowerPCs */
 #if defined(TARGET_PPC64)
     { "ppc64", "970fx_v3.1" },
@@ -964,5 +973,6 @@ PowerPCCPUAlias ppc_cpu_aliases[] = {
     { "ppc32", "604" },
     { "ppc", "604" },
     { "default", "604" },
 +#endif
     { NULL, NULL }
 };
 diff --git a/target/s390x/cpu_models_sysemu.c b/target/s390x/cpu_models_sysemu.c
 index 05c3ccaaff..6a04ccab1b 100644
 --- a/target/s390x/cpu_models_sysemu.c
 +++ b/target/s390x/cpu_models_sysemu.c
@@ -36,6 +36,9 @@ static void check_unavailable_features(const S390CPUModel *max_model,
         (max_model->def->gen == model->def->gen &&
          max_model->def->ec_ga < model->def->ec_ga)) {
         list_add_feat("type", unavailable);
 +    } else if (model->def->gen < 11 && kvm_enabled()) {
 +        /* Older CPU models are not supported on Red Hat Enterprise Linux */
 +        list_add_feat("type", unavailable);
     }
     /* detect missing features if any to properly report them */
 diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c
 index 5b1fdb55c4..c52434985b 100644
 --- a/target/s390x/kvm/kvm.c
 +++ b/target/s390x/kvm/kvm.c
@@ -2508,6 +2508,14 @@ void kvm_s390_apply_cpu_model(const S390CPUModel *model, Error **errp)
         error_setg(errp, "KVM doesn't support CPU models");
         return;
     }
 +
 +    /* Older CPU models are not supported on Red Hat Enterprise Linux */
 +    if (model->def->gen < 11) {
 +        error_setg(errp, "KVM: Unsupported CPU type specified: %s",
 +                   MACHINE(qdev_get_machine())->cpu_type);
 +        return;
 +    }
 +
     prop.cpuid = s390_cpuid_from_cpu_model(model);
     prop.ibc = s390_ibc_from_cpu_model(model);
     /* configure cpu features indicated via STFL(e) */
 -- 
 2.27.0
--- a/SOURCES/0007-Machine-type-related-general-changes.patch
+++ b/SOURCES/0007-Machine-type-related-general-changes.patch
--- a/SOURCES/0008-Add-aarch64-machine-types.patch
+++ b/SOURCES/0008-Add-aarch64-machine-types.patch
@ -1,4 +1,4 @@
-From 3afc6e4cb6725d01b8f89207701bca199c9ecc9f Mon Sep 17 00:00:00 2001
+From 670e90f5cbd92189155e079b8c6e2aafdf82d162 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 12:53:31 +0200
 Subject: Add aarch64 machine types
@ -6,62 +6,106 @@ Subject: Add aarch64 machine types
 Adding changes to add RHEL machine types for aarch64 architecture.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 Rebase notes (4.0.0):
 - Use upstream compat handling
 Rebase notes (4.1.0-rc0):
 - Removed a15memmap (upstream)
 - Use virt_flash_create in rhel800_virt_instance_init
 Rebase notes (4.2.0-rc0):
 - Set numa_mem_supported
 Rebase notes (4.2.0-rc3):
 - aarch64: Add virt-rhel8.2.0 machine type for ARM (patch 92246)
 - aarch64: virt: Allow more than 1TB of RAM (patch 92249)
 - aarch64: virt: Allow PCDIMM instantiation (patch 92247)
 - aarch64: virt: Enhance the comment related to gic-version (patch 92248)
 Rebase notes (5.0.0):
 - Set default_ram_id in rhel_machine_class_init
 - Added setting acpi properties
 Rebase notes (5.1.0):
 - Added ras property
 - Added to virt_machine_device_unplug_cb to machine type (upstream)
 - added mte property (upstream)
 Rebase notes (weekly-210210):
 - Added support for oem fields to machine type
 Rebase notes (weekly-210303):
 - Use rhel-8.4.0 hw compat
 Rebase notes (6.0.0-rc2):
 - renamed oem-id and oem-table-id to x-oem-id and x-oem-table-id
 Rebase notes (210623):
 - Protect TPM functions by CONFIG_TPM ifdef
 Rebase notes (6.1.0-rc0):
 - Add support for default_bus_bypass_iommu
 Merged patches (4.0.0):
 - 7bfdb4c aarch64: Add virt-rhel8.0.0 machine type for ARM
 - 3433e69 aarch64: Set virt-rhel8.0.0 max_cpus to 512
 - 4d20863 aarch64: Use 256MB ECAM region by default
 Merged patches (4.1.0):
 - c3e39ef aarch64: Add virt-rhel8.1.0 machine type for ARM
 - 59a46d1 aarch64: Allow ARM VIRT iommu option in RHEL8.1 machine
 Merged patches (5.2.0 rc0):
 - 12990ad hw/arm: Changes to rhel820 machine
 - 46d5a79 hw/arm: Introduce rhel_virt_instance_init() helper
 - 098954a hw/arm: Add rhel830 machine type
 - ee8e99d arm: Set correct max_cpus value on virt-rhel* machine types
 - e5edd38 RHEL-only: arm/virt: Allow the TPM_TIS_SYSBUS device dynamic allocation in machvirt
 - 6d7ba66 machine types/numa: set numa_mem_supported on old machine types (partialy)
 - 25c5644 machine_types/numa: compatibility for auto_enable_numa_with_memdev (partialy)
 Merged patches (6.0):
 - 078fadb5da AArch64 machine types cleanup
 - ea7b7425fa hw/arm/virt: Add 8.4 Machine type
 Merged patches (weekly-210609):
 - 73b1578882 hw/arm/virt: Add 8.5 machine type
 - 5333038d11 hw/arm/virt: Disable PL011 clock migration through hw_compat_rhel_8_3
 - 63adb8ae86 arm/virt: Register highmem and gic-version as class properties
 Merged patches (weekly-211027):
 - 86e3057c0a hw: arm: virt: Add hw_compat_rhel_8_5 to 8.5 machine type
 ---
- hw/arm/virt.c         | 299 +++++++++++++++++++++++++++++++++++++++++-
+ hw/arm/virt.c         | 226 +++++++++++++++++++++++++++++++++++++++++-
 hw/core/machine.c     |   2 +
 include/hw/arm/virt.h |   8 ++
- 2 files changed, 306 insertions(+), 1 deletion(-)
+ 3 files changed, 235 insertions(+), 1 deletion(-)
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index 36e9b4b4e9..22bc345137 100644
+index 5de4d9d73b..c77d26ab13 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
-@@ -101,6 +101,7 @@ static void arm_virt_compat_set(MachineClass *mc)
+@@ -79,6 +79,7 @@
-                      arm_virt_compat_len);
+ #include "hw/char/pl011.h"
- }
+ #include "qemu/guest-random.h"
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 #define DEFINE_VIRT_MACHINE_LATEST(major, minor, latest) \
     static void virt_##major##_##minor##_class_init(ObjectClass *oc, \
                                                     void *data) \
-@@ -128,7 +129,63 @@ static void arm_virt_compat_set(MachineClass *mc)
+@@ -105,7 +106,48 @@
     DEFINE_VIRT_MACHINE_LATEST(major, minor, true)
 #define DEFINE_VIRT_MACHINE(major, minor) \
     DEFINE_VIRT_MACHINE_LATEST(major, minor, false)
 -
 +#endif /* disabled for RHEL */
 +
 +/*
 + * This variable is for changes to properties that are RHEL specific,
 + * different to the current upstream and to be applied to the latest
 + * machine type. They may be overriden by older machine compats.
 + *
 + * virtio-net-pci variant romfiles are not needed because edk2 does
 + * fully support the pxe boot. Besides virtio romfiles are not shipped
 + * on rhel/aarch64.
 + */
 +GlobalProperty arm_rhel_compat[] = {
 +    {"virtio-net-pci", "romfile", "" },
 +    {"virtio-net-pci-transitional", "romfile", "" },
 +    {"virtio-net-pci-non-transitional", "romfile", "" },
 +};
 +const size_t arm_rhel_compat_len = G_N_ELEMENTS(arm_rhel_compat);
 +/*
 + * This cannot be called from the rhel_virt_class_init() because
 + * TYPE_RHEL_MACHINE is abstract and mc->compat_props g_ptr_array_new()
 + * only is called on virt-rhelm.n.s non abstract class init.
 + */
 +static void arm_rhel_compat_set(MachineClass *mc)
 +{
 +    compat_props_add(mc->compat_props, arm_rhel_compat,
 +                     arm_rhel_compat_len);
 +}
 +
 +#define DEFINE_RHEL_MACHINE_LATEST(m, n, s, latest)                     \
 +    static void rhel##m##n##s##_virt_class_init(ObjectClass *oc,        \
 +                                                void *data)             \
 +    {                                                                   \
 +        MachineClass *mc = MACHINE_CLASS(oc);                           \
 +        arm_rhel_compat_set(mc);                                        \
 +        rhel##m##n##s##_virt_options(mc);                               \
 +        mc->desc = "RHEL " # m "." # n "." # s " ARM Virtual Machine";  \
 +        if (latest) {                                                   \
@ -84,10 +128,23 @@ index 36e9b4b4e9..22bc345137 100644
 +    DEFINE_RHEL_MACHINE_LATEST(major, minor, subminor, true)
 +#define DEFINE_RHEL_MACHINE(major, minor, subminor)             \
 +    DEFINE_RHEL_MACHINE_LATEST(major, minor, subminor, false)
 +
 +/* This variable is for changes to properties that are RHEL specific,
 + * different to the current upstream and to be applied to the latest
 + * machine type.
 + */
 +GlobalProperty arm_rhel_compat[] = {
 +    {
 +        .driver   = "virtio-net-pci",
 +        .property = "romfile",
 +        .value    = "",
 +    },
 +};
 +const size_t arm_rhel_compat_len = G_N_ELEMENTS(arm_rhel_compat);
 /* Number of external interrupt lines to configure the GIC with */
 #define NUM_IRQS 256
-@@ -2355,6 +2412,7 @@ static void machvirt_init(MachineState *machine)
+@@ -2180,6 +2222,7 @@ static void machvirt_init(MachineState *machine)
     qemu_add_machine_init_done_notifier(&vms->machine_done);
 }
@ -95,7 +152,7 @@ index 36e9b4b4e9..22bc345137 100644
 static bool virt_get_secure(Object *obj, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
-@@ -2382,6 +2440,7 @@ static void virt_set_virt(Object *obj, bool value, Error **errp)
+@@ -2207,6 +2250,7 @@ static void virt_set_virt(Object *obj, bool value, Error **errp)
     vms->virt = value;
 }
@ -103,55 +160,15 @@ index 36e9b4b4e9..22bc345137 100644
 static bool virt_get_highmem(Object *obj, Error **errp)
 {
-@@ -2397,6 +2456,7 @@ static void virt_set_highmem(Object *obj, bool value, Error **errp)
+@@ -2304,6 +2348,7 @@ static void virt_set_acpi(Object *obj, Visitor *v, const char *name,
-     vms->highmem = value;
+     visit_type_OnOffAuto(v, name, &vms->acpi, errp);
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
- static bool virt_get_compact_highmem(Object *obj, Error **errp)
+ static bool virt_get_ras(Object *obj, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
-@@ -2410,6 +2470,7 @@ static void virt_set_compact_highmem(Object *obj, bool value, Error **errp)
+@@ -2331,6 +2376,7 @@ static void virt_set_mte(Object *obj, bool value, Error **errp)
     vms->highmem_compact = value;
 }
 +#endif /* disabled for RHEL */
 static bool virt_get_highmem_redists(Object *obj, Error **errp)
 {
@@ -2453,7 +2514,6 @@ static void virt_set_highmem_mmio(Object *obj, bool value, Error **errp)
     vms->highmem_mmio = value;
 }
 -
 static bool virt_get_its(Object *obj, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
@@ -2468,6 +2528,7 @@ static void virt_set_its(Object *obj, bool value, Error **errp)
     vms->its = value;
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static bool virt_get_dtb_randomness(Object *obj, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
@@ -2481,6 +2542,7 @@ static void virt_set_dtb_randomness(Object *obj, bool value, Error **errp)
     vms->dtb_randomness = value;
 }
 +#endif /* disabled for RHEL */
 static char *virt_get_oem_id(Object *obj, Error **errp)
 {
@@ -2564,6 +2626,7 @@ static void virt_set_ras(Object *obj, bool value, Error **errp)
     vms->ras = value;
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static bool virt_get_mte(Object *obj, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
@@ -2577,6 +2640,7 @@ static void virt_set_mte(Object *obj, bool value, Error **errp)
     vms->mte = value;
 }
@ -159,7 +176,7 @@ index 36e9b4b4e9..22bc345137 100644
 static char *virt_get_gic_version(Object *obj, Error **errp)
 {
-@@ -2949,6 +3013,7 @@ static int virt_kvm_type(MachineState *ms, const char *type_str)
+@@ -2666,6 +2712,7 @@ static int virt_kvm_type(MachineState *ms, const char *type_str)
     return fixed_ipa ? 0 : requested_pa_size;
 }
@ -167,7 +184,7 @@ index 36e9b4b4e9..22bc345137 100644
 static void virt_machine_class_init(ObjectClass *oc, void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
-@@ -3463,3 +3528,235 @@ static void virt_machine_2_6_options(MachineClass *mc)
+@@ -3031,3 +3078,180 @@ static void virt_machine_2_6_options(MachineClass *mc)
     vmc->no_pmu = true;
 }
 DEFINE_VIRT_MACHINE(2, 6)
@ -177,7 +194,6 @@ index 36e9b4b4e9..22bc345137 100644
 +{
 +    MachineClass *mc = MACHINE_CLASS(oc);
 +    HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(oc);
 +    arm_virt_compat_set(mc);
 +
 +    mc->family = "virt-rhel-Z";
 +    mc->init = machvirt_init;
@ -203,13 +219,9 @@ index 36e9b4b4e9..22bc345137 100644
 +    hc->unplug_request = virt_machine_device_unplug_request_cb;
 +    hc->unplug = virt_machine_device_unplug_cb;
 +    mc->nvdimm_supported = true;
 +    mc->smp_props.clusters_supported = true;
 +    mc->auto_enable_numa_with_memhp = true;
 +    mc->auto_enable_numa_with_memdev = true;
 +    /* platform instead of architectural choice */
 +    mc->cpu_cluster_has_numa_boundary = true;
 +    mc->default_ram_id = "mach-virt.ram";
 +    mc->default_nic = "virtio-net-pci";
 +
 +    object_class_property_add(oc, "acpi", "OnOffAuto",
 +        virt_get_acpi, virt_set_acpi,
@ -223,58 +235,12 @@ index 36e9b4b4e9..22bc345137 100644
 +                                          "Set on/off to enable/disable using "
 +                                          "physical address space above 32 bits");
 +
 +    object_class_property_add_bool(oc, "highmem-redists",
 +                                   virt_get_highmem_redists,
 +                                   virt_set_highmem_redists);
 +    object_class_property_set_description(oc, "highmem-redists",
 +                                          "Set on/off to enable/disable high "
 +                                          "memory region for GICv3 or GICv4 "
 +                                          "redistributor");
 +
 +    object_class_property_add_bool(oc, "highmem-ecam",
 +                                   virt_get_highmem_ecam,
 +                                   virt_set_highmem_ecam);
 +    object_class_property_set_description(oc, "highmem-ecam",
 +                                          "Set on/off to enable/disable high "
 +                                          "memory region for PCI ECAM");
 +
 +    object_class_property_add_bool(oc, "highmem-mmio",
 +                                   virt_get_highmem_mmio,
 +                                   virt_set_highmem_mmio);
 +    object_class_property_set_description(oc, "highmem-mmio",
 +                                          "Set on/off to enable/disable high "
 +                                          "memory region for PCI MMIO");
 +
 +    object_class_property_add_str(oc, "gic-version", virt_get_gic_version,
 +                                  virt_set_gic_version);
 +    object_class_property_set_description(oc, "gic-version",
 +                                          "Set GIC version. "
 +                                          "Valid values are 2, 3, host and max");
 +
 +    object_class_property_add_str(oc, "iommu", virt_get_iommu, virt_set_iommu);
 +    object_class_property_set_description(oc, "iommu",
 +                                          "Set the IOMMU type. "
 +                                          "Valid values are none and smmuv3");
 +
 +    object_class_property_add_bool(oc, "default-bus-bypass-iommu",
 +                                   virt_get_default_bus_bypass_iommu,
 +                                   virt_set_default_bus_bypass_iommu);
 +    object_class_property_set_description(oc, "default-bus-bypass-iommu",
 +                                          "Set on/off to enable/disable "
 +                                          "bypass_iommu for default root bus");
 +
 +    object_class_property_add_bool(oc, "ras", virt_get_ras,
 +                                   virt_set_ras);
 +    object_class_property_set_description(oc, "ras",
 +                                          "Set on/off to enable/disable reporting host memory errors "
 +                                          "to a KVM guest using ACPI and guest external abort exceptions");
 +
 +    object_class_property_add_bool(oc, "its", virt_get_its,
 +                                   virt_set_its);
 +    object_class_property_set_description(oc, "its",
 +                                          "Set on/off to enable/disable "
 +                                          "ITS instantiation");
 +
 +    object_class_property_add_str(oc, "x-oem-id",
 +                                  virt_get_oem_id,
 +                                  virt_set_oem_id);
@ -283,7 +249,6 @@ index 36e9b4b4e9..22bc345137 100644
 +                                          "in ACPI table header."
 +                                          "The string may be up to 6 bytes in size");
 +
 +
 +    object_class_property_add_str(oc, "x-oem-table-id",
 +                                  virt_get_oem_table_id,
 +                                  virt_set_oem_table_id);
@ -291,6 +256,10 @@ index 36e9b4b4e9..22bc345137 100644
 +                                          "Override the default value of field OEM Table ID "
 +                                          "in ACPI table header."
 +                                          "The string may be up to 8 bytes in size");
 +    object_class_property_add_bool(oc, "default_bus_bypass_iommu",
 +                                   virt_get_default_bus_bypass_iommu,
 +                                   virt_set_default_bus_bypass_iommu);
 +
 +}
 +
 +static void rhel_virt_instance_init(Object *obj)
@ -306,31 +275,28 @@ index 36e9b4b4e9..22bc345137 100644
 +
 +    /* High memory is enabled by default */
 +    vms->highmem = true;
 +    vms->highmem_compact = !vmc->no_highmem_compact;
 +    vms->gic_version = VIRT_GIC_VERSION_NOSEL;
 +
 +    vms->highmem_ecam = !vmc->no_highmem_ecam;
 +    vms->highmem_mmio = true;
 +    vms->highmem_redists = true;
 +
 +    if (vmc->no_its) {
 +        vms->its = false;
 +    } else {
 +        /* Default allows ITS instantiation */
 +        vms->its = true;
-+
+        object_property_add_bool(obj, "its", virt_get_its,
-+        if (vmc->no_tcg_its) {
+                                 virt_set_its);
-+            vms->tcg_its = false;
+        object_property_set_description(obj, "its",
-+        } else {
+                                        "Set on/off to enable/disable "
-+            vms->tcg_its = true;
+                                        "ITS instantiation");
 +        }
 +    }
 +
 +    /* Default disallows iommu instantiation */
 +    vms->iommu = VIRT_IOMMU_NONE;
-+
+    object_property_add_str(obj, "iommu", virt_get_iommu, virt_set_iommu);
-+    /* The default root bus is attached to iommu by default */
+    object_property_set_description(obj, "iommu",
-+    vms->default_bus_bypass_iommu = false;
+                                    "Set the IOMMU type. "
 +                                    "Valid values are none and smmuv3");
 +
 +    /* Default disallows RAS instantiation and is non-configurable for RHEL */
 +    vms->ras = false;
@ -338,15 +304,13 @@ index 36e9b4b4e9..22bc345137 100644
 +    /* MTE is disabled by default and non-configurable for RHEL */
 +    vms->mte = false;
 +
-+    /* Supply kaslr-seed and rng-seed by default, non-configurable for RHEL */
+    vms->default_bus_bypass_iommu = false;
 +    vms->dtb_randomness = true;
 +
 +    vms->irqmap = a15irqmap;
 +
 +    virt_flash_create(vms);
 +
 +    vms->oem_id = g_strndup(ACPI_BUILD_APPNAME6, 6);
 +    vms->oem_table_id = g_strndup(ACPI_BUILD_APPNAME8, 8);
 +
 +}
 +
 +static const TypeInfo rhel_machine_info = {
@ -369,45 +333,56 @@ index 36e9b4b4e9..22bc345137 100644
 +}
 +type_init(rhel_machine_init);
 +
-+static void rhel940_virt_options(MachineClass *mc)
+static void rhel850_virt_options(MachineClass *mc)
 +{
 +    compat_props_add(mc->compat_props, arm_rhel_compat, arm_rhel_compat_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_5, hw_compat_rhel_8_5_len);
 +}
-+DEFINE_RHEL_MACHINE_AS_LATEST(9, 4, 0)
+DEFINE_RHEL_MACHINE_AS_LATEST(8, 5, 0)
 +
-+static void rhel920_virt_options(MachineClass *mc)
+static void rhel840_virt_options(MachineClass *mc)
 +{
-+    rhel940_virt_options(mc);
+    rhel850_virt_options(mc);
-+
+    compat_props_add(mc->compat_props, hw_compat_rhel_8_4, hw_compat_rhel_8_4_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_4, hw_compat_rhel_9_4_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_3, hw_compat_rhel_9_3_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_2, hw_compat_rhel_9_2_len);
 +
 +    /* RHEL 9.4 is the first supported release */
 +    mc->deprecation_reason =
 +        "machine types for versions prior to 9.4 are deprecated";
 +}
-+DEFINE_RHEL_MACHINE(9, 2, 0)
+DEFINE_RHEL_MACHINE(8, 4, 0)
 +
-+static void rhel900_virt_options(MachineClass *mc)
+static void rhel830_virt_options(MachineClass *mc)
 +{
 +    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
 +
-+    rhel920_virt_options(mc);
+    rhel840_virt_options(mc);
-+
+    compat_props_add(mc->compat_props, hw_compat_rhel_8_3, hw_compat_rhel_8_3_len);
-+    compat_props_add(mc->compat_props, hw_compat_rhel_9_1, hw_compat_rhel_9_1_len);
+    vmc->no_kvm_steal_time = true;
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_0, hw_compat_rhel_9_0_len);
 +
 +    /* Disable FEAT_LPA2 since old kernels (<= v5.12) don't boot with that feature */
 +    vmc->no_tcg_lpa2 = true;
 +    /* Compact layout for high memory regions was introduced with 9.2.0 */
 +    vmc->no_highmem_compact = true;
 +}
-+DEFINE_RHEL_MACHINE(9, 0, 0)
+DEFINE_RHEL_MACHINE(8, 3, 0)
 +
 +static void rhel820_virt_options(MachineClass *mc)
 +{
 +    rhel830_virt_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_2, hw_compat_rhel_8_2_len);
 +    mc->numa_mem_supported = true;
 +    mc->auto_enable_numa_with_memdev = false;
 +}
 +DEFINE_RHEL_MACHINE(8, 2, 0)
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index be4f9864cd..62febde5aa 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -87,6 +87,8 @@ GlobalProperty hw_compat_rhel_8_3[] = {
     { "nvme", "use-intel-id", "on"},
     /* hw_compat_rhel_8_3 from hw_compat_5_1 */
     { "pvpanic", "events", "1"}, /* PVPANIC_PANICKED */
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "pl011", "migrate-clk", "off" },
     /* hw_compat_rhel_8_3 bz 1912846 */
     { "pci-xhci", "x-rh-late-msi-cap", "off" },
     /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
-index bb486d36b1..237fc77bda 100644
+index dc6b66ffc8..9364628847 100644
 --- a/include/hw/arm/virt.h
 +++ b/include/hw/arm/virt.h
-@@ -179,9 +179,17 @@ struct VirtMachineState {
+@@ -175,9 +175,17 @@ struct VirtMachineState {
 #define VIRT_ECAM_ID(high) (high ? VIRT_HIGH_PCIE_ECAM : VIRT_PCIE_ECAM)
@ -426,5 +401,5 @@ index bb486d36b1..237fc77bda 100644
 bool virt_is_acpi_enabled(VirtMachineState *vms);
 -- 
-2.39.3
+2.27.0
--- a/SOURCES/0009-Add-ppc64-machine-types.patch
+++ b/SOURCES/0009-Add-ppc64-machine-types.patch
@ -0,0 +1,714 @@
 From 3c65320ce5b8ad3bb8c0d8fd13a88c464d5c5845 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 13:27:13 +0200
 Subject: Add ppc64 machine types
 Adding changes to add RHEL machine types for ppc64 architecture.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 Rebase changes (4.0.0):
 - remove instance options and use upstream solution
 - Use upstream compat handling
 - Replace SPAPR_PCI_2_7_MMIO_WIN_SIZE with value (changed upstream)
 - re-add handling of instance_options (removed upstream)
 - Use p8 as default for rhel machine types (p9 default upstream)
 - sPAPRMachineClass renamed to SpaprMachineClass (upstream)
 Rebase changes (4.1.0):
 - Update format for compat structures
 Rebase notes (weekly-210303):
 - Use rhel-8.4.0 hw compat
 Merged patches (4.0.0):
 - 467d59a redhat: define pseries-rhel8.0.0 machine type
 Merged patches (4.1.0):
 - f21757edc target/ppc/spapr: Enable mitigations by default for pseries-4.0 machine type
 - 2511c63 redhat: sync pseries-rhel7.6.0 with rhel-av-8.0.1
 - 89f01da redhat: define pseries-rhel8.1.0 machine type
 Merged patches (4.2.0):
 - bcba728 redhat: update pseries-rhel8.1.0 machine type
 - redhat: update pseries-rhel-7.6.0 machine type (patch 93039)
 - redhat: define pseries-rhel8.2.0 machine type (patch 93041)
 Merged patches (5.1.0):
 - eb121ff spapr: Enable DD2.3 accelerated count cache flush in pseries-5.0 machine (partial)
 Merged patches (5.2.0 rc0):
 - 311a20f redhat: define pseries-rhel8.3.0 machine type
 - 1284167 ppc: Set correct max_cpus value on spapr-rhel* machine types
 - 1ab8783 redhat: update pseries-rhel8.2.0 machine type
 - b162af531a target/ppc: Add experimental option for enabling secure guests
 Merged patches (weekly-201216):
 - 943c936df3 redhat: Add spapr_machine_rhel_default_class_options()
 - 030b5e6fba redhat: Define pseries-rhel8.4.0 machine type
 Merged patches (weekly-210602):
 - b7128d8ef7 redhat: Define pseries-rhel8.5.0 machine type
 Merged patches (weekly-211006):
 - c8f68b47e9 redhat: Update pseries-rhel8.5.0
 ---
 hw/ppc/spapr.c          | 382 ++++++++++++++++++++++++++++++++++++++++
 hw/ppc/spapr_cpu_core.c |  13 ++
 include/hw/ppc/spapr.h  |   4 +
 target/ppc/compat.c     |  13 +-
 target/ppc/cpu.h        |   1 +
 target/ppc/kvm.c        |  27 +++
 target/ppc/kvm_ppc.h    |  13 ++
 7 files changed, 452 insertions(+), 1 deletion(-)
 diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
 index 3b5fd749be..cace86028d 100644
 --- a/hw/ppc/spapr.c
 +++ b/hw/ppc/spapr.c
@@ -1593,6 +1593,9 @@ static void spapr_machine_reset(MachineState *machine)
     pef_kvm_reset(machine->cgs, &error_fatal);
     spapr_caps_apply(spapr);
 +    if (spapr->svm_allowed) {
 +        kvmppc_svm_allow(&error_fatal);
 +    }
     first_ppc_cpu = POWERPC_CPU(first_cpu);
     if (kvm_enabled() && kvmppc_has_cap_mmu_radix() &&
@@ -3288,6 +3291,20 @@ static void spapr_set_host_serial(Object *obj, const char *value, Error **errp)
     spapr->host_serial = g_strdup(value);
 }
 +static bool spapr_get_svm_allowed(Object *obj, Error **errp)
 +{
 +    SpaprMachineState *spapr = SPAPR_MACHINE(obj);
 +
 +    return spapr->svm_allowed;
 +}
 +
 +static void spapr_set_svm_allowed(Object *obj, bool value, Error **errp)
 +{
 +    SpaprMachineState *spapr = SPAPR_MACHINE(obj);
 +
 +    spapr->svm_allowed = value;
 +}
 +
 static void spapr_instance_init(Object *obj)
 {
     SpaprMachineState *spapr = SPAPR_MACHINE(obj);
@@ -3366,6 +3383,12 @@ static void spapr_instance_init(Object *obj)
         spapr_get_host_serial, spapr_set_host_serial);
     object_property_set_description(obj, "host-serial",
         "Host serial number to advertise in guest device tree");
 +    object_property_add_bool(obj, "x-svm-allowed",
 +                            spapr_get_svm_allowed,
 +                            spapr_set_svm_allowed);
 +    object_property_set_description(obj, "x-svm-allowed",
 +                                    "Allow the guest to become a Secure Guest"
 +                                    " (experimental only)");
 }
 static void spapr_machine_finalizefn(Object *obj)
@@ -4614,6 +4637,7 @@ static void spapr_machine_class_init(ObjectClass *oc, void *data)
     vmc->client_architecture_support = spapr_vof_client_architecture_support;
     vmc->quiesce = spapr_vof_quiesce;
     vmc->setprop = spapr_vof_setprop;
 +    smc->has_power9_support = true;
 }
 static const TypeInfo spapr_machine_info = {
@@ -4665,6 +4689,7 @@ static void spapr_machine_latest_class_options(MachineClass *mc)
     }                                                                \
     type_init(spapr_machine_register_##suffix)
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 /*
  * pseries-6.2
  */
@@ -4781,6 +4806,7 @@ static void spapr_machine_4_1_class_options(MachineClass *mc)
 }
 DEFINE_SPAPR_MACHINE(4_1, "4.1", false);
 +#endif
 /*
  * pseries-4.0
@@ -4800,6 +4826,8 @@ static bool phb_placement_4_0(SpaprMachineState *spapr, uint32_t index,
     *nv2atsd = 0;
     return true;
 }
 +
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void spapr_machine_4_0_class_options(MachineClass *mc)
 {
     SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
@@ -4958,6 +4986,7 @@ DEFINE_SPAPR_MACHINE(2_8, "2.8", false);
 /*
  * pseries-2.7
  */
 +#endif
 static bool phb_placement_2_7(SpaprMachineState *spapr, uint32_t index,
                               uint64_t *buid, hwaddr *pio,
@@ -5013,6 +5042,7 @@ static bool phb_placement_2_7(SpaprMachineState *spapr, uint32_t index,
     return true;
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void spapr_machine_2_7_class_options(MachineClass *mc)
 {
     SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
@@ -5127,6 +5157,358 @@ static void spapr_machine_2_1_class_options(MachineClass *mc)
     compat_props_add(mc->compat_props, hw_compat_2_1, hw_compat_2_1_len);
 }
 DEFINE_SPAPR_MACHINE(2_1, "2.1", false);
 +#endif
 +
 +static void spapr_machine_rhel_default_class_options(MachineClass *mc)
 +{
 +    /*
 +     * Defaults for the latest behaviour inherited from the base class
 +     * can be overriden here for all pseries-rhel* machines.
 +     */
 +
 +    /* Maximum supported VCPU count */
 +    mc->max_cpus = 384;
 +}
 +
 +/*
 + * pseries-rhel8.5.0
 + * like pseries-6.0
 + */
 +
 +static void spapr_machine_rhel850_class_options(MachineClass *mc)
 +{
 +    /* The default machine type must apply the RHEL specific defaults */
 +    spapr_machine_rhel_default_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_5,
 +                     hw_compat_rhel_8_5_len);
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel850, "rhel8.5.0", true);
 +
 +/*
 + * pseries-rhel8.4.0
 + * like pseries-5.2
 + */
 +
 +static void spapr_machine_rhel840_class_options(MachineClass *mc)
 +{
 +    spapr_machine_rhel850_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_4,
 +                     hw_compat_rhel_8_4_len);
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel840, "rhel8.4.0", false);
 +
 +/*
 + * pseries-rhel8.3.0
 + * like pseries-5.1
 + */
 +
 +static void spapr_machine_rhel830_class_options(MachineClass *mc)
 +{
 +    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 +
 +    spapr_machine_rhel840_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_3,
 +                     hw_compat_rhel_8_3_len);
 +
 +    /* from pseries-5.1 */
 +    smc->pre_5_2_numa_associativity = true;
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel830, "rhel8.3.0", false);
 +
 +/*
 + * pseries-rhel8.2.0
 + * like pseries-4.2 + pseries-5.0
 + * except SPAPR_CAP_CCF_ASSIST that has been backported to pseries-rhel8.1.0
 + */
 +
 +static void spapr_machine_rhel820_class_options(MachineClass *mc)
 +{
 +    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 +    /* from pseries-5.0 */
 +    static GlobalProperty compat[] = {
 +        { TYPE_SPAPR_PCI_HOST_BRIDGE, "pre-5.1-associativity", "on" },
 +    };
 +
 +    spapr_machine_rhel830_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_2,
 +                     hw_compat_rhel_8_2_len);
 +    compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
 +
 +    /* from pseries-4.2 */
 +    smc->default_caps.caps[SPAPR_CAP_FWNMI] = SPAPR_CAP_OFF;
 +    smc->rma_limit = 16 * GiB;
 +    mc->nvdimm_supported = false;
 +
 +    /* from pseries-5.0 */
 +    mc->numa_mem_supported = true;
 +    smc->pre_5_1_assoc_refpoints = true;
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel820, "rhel8.2.0", false);
 +
 +/*
 + * pseries-rhel8.1.0
 + * like pseries-4.1
 + */
 +
 +static void spapr_machine_rhel810_class_options(MachineClass *mc)
 +{
 +    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 +    static GlobalProperty compat[] = {
 +        /* Only allow 4kiB and 64kiB IOMMU pagesizes */
 +        { TYPE_SPAPR_PCI_HOST_BRIDGE, "pgsz", "0x11000" },
 +    };
 +
 +    spapr_machine_rhel820_class_options(mc);
 +
 +    /* from pseries-4.1 */
 +    smc->linux_pci_probe = false;
 +    smc->smp_threads_vsmt = false;
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_1,
 +                     hw_compat_rhel_8_1_len);
 +    compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
 +
 +    /* from pseries-4.2 */
 +    smc->default_caps.caps[SPAPR_CAP_CCF_ASSIST] = SPAPR_CAP_OFF;
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel810, "rhel8.1.0", false);
 +
 +/*
 + * pseries-rhel8.0.0
 + * like pseries-3.1 and pseries-4.0
 + * except SPAPR_CAP_CFPC, SPAPR_CAP_SBBC and SPAPR_CAP_IBS
 + * that have been backported to pseries-rhel8.0.0
 + */
 +
 +static void spapr_machine_rhel800_class_options(MachineClass *mc)
 +{
 +    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 +
 +    spapr_machine_rhel810_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_0,
 +                     hw_compat_rhel_8_0_len);
 +
 +    /* pseries-4.0 */
 +    smc->phb_placement = phb_placement_4_0;
 +    smc->irq = &spapr_irq_xics;
 +    smc->pre_4_1_migration = true;
 +
 +    /* pseries-3.1 */
 +    mc->default_cpu_type = POWERPC_CPU_TYPE_NAME("power8_v2.0");
 +    smc->update_dt_enabled = false;
 +    smc->dr_phb_enabled = false;
 +    smc->broken_host_serial_model = true;
 +    smc->default_caps.caps[SPAPR_CAP_LARGE_DECREMENTER] = SPAPR_CAP_OFF;
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel800, "rhel8.0.0", false);
 +
 +/*
 + * pseries-rhel7.6.0
 + * like spapr_compat_2_12 and spapr_compat_3_0
 + * spapr_compat_0 is empty
 + */
 +GlobalProperty spapr_compat_rhel7_6[] = {
 +    { TYPE_POWERPC_CPU, "pre-3.0-migration", "on" },
 +    { TYPE_SPAPR_CPU_CORE, "pre-3.0-migration", "on" },
 +};
 +const size_t spapr_compat_rhel7_6_len = G_N_ELEMENTS(spapr_compat_rhel7_6);
 +
 +
 +static void spapr_machine_rhel760_class_options(MachineClass *mc)
 +{
 +    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 +
 +    spapr_machine_rhel800_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_7_6, hw_compat_rhel_7_6_len);
 +    compat_props_add(mc->compat_props, spapr_compat_rhel7_6, spapr_compat_rhel7_6_len);
 +
 +    /* from spapr_machine_3_0_class_options() */
 +    smc->legacy_irq_allocation = true;
 +    smc->nr_xirqs = 0x400;
 +    smc->irq = &spapr_irq_xics_legacy;
 +
 +    /* from spapr_machine_2_12_class_options() */
 +    /* We depend on kvm_enabled() to choose a default value for the
 +     * hpt-max-page-size capability. Of course we can't do it here
 +     * because this is too early and the HW accelerator isn't initialzed
 +     * yet. Postpone this to machine init (see default_caps_with_cpu()).
 +     */
 +    smc->default_caps.caps[SPAPR_CAP_HPT_MAXPAGESIZE] = 0;
 +
 +    /* SPAPR_CAP_WORKAROUND enabled in pseries-rhel800 by
 +     * f21757edc554
 +     * "Enable mitigations by default for pseries-4.0 machine type")
 +     */
 +    smc->default_caps.caps[SPAPR_CAP_CFPC] = SPAPR_CAP_BROKEN;
 +    smc->default_caps.caps[SPAPR_CAP_SBBC] = SPAPR_CAP_BROKEN;
 +    smc->default_caps.caps[SPAPR_CAP_IBS] = SPAPR_CAP_BROKEN;
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel760, "rhel7.6.0", false);
 +
 +/*
 + * pseries-rhel7.6.0-sxxm
 + *
 + * pseries-rhel7.6.0 with speculative execution exploit mitigations enabled by default
 + */
 +
 +static void spapr_machine_rhel760sxxm_class_options(MachineClass *mc)
 +{
 +    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 +
 +    spapr_machine_rhel760_class_options(mc);
 +    smc->default_caps.caps[SPAPR_CAP_CFPC] = SPAPR_CAP_WORKAROUND;
 +    smc->default_caps.caps[SPAPR_CAP_SBBC] = SPAPR_CAP_WORKAROUND;
 +    smc->default_caps.caps[SPAPR_CAP_IBS] = SPAPR_CAP_FIXED_CCD;
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel760sxxm, "rhel7.6.0-sxxm", false);
 +
 +static void spapr_machine_rhel750_class_options(MachineClass *mc)
 +{
 +    spapr_machine_rhel760_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_7_5, hw_compat_rhel_7_5_len);
 +
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel750, "rhel7.5.0", false);
 +
 +/*
 + * pseries-rhel7.5.0-sxxm
 + *
 + * pseries-rhel7.5.0 with speculative execution exploit mitigations enabled by default
 + */
 +
 +static void spapr_machine_rhel750sxxm_class_options(MachineClass *mc)
 +{
 +    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 +
 +    spapr_machine_rhel750_class_options(mc);
 +    smc->default_caps.caps[SPAPR_CAP_CFPC] = SPAPR_CAP_WORKAROUND;
 +    smc->default_caps.caps[SPAPR_CAP_SBBC] = SPAPR_CAP_WORKAROUND;
 +    smc->default_caps.caps[SPAPR_CAP_IBS] = SPAPR_CAP_FIXED_CCD;
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel750sxxm, "rhel7.5.0-sxxm", false);
 +
 +/*
 + * pseries-rhel7.4.0
 + * like spapr_compat_2_9
 + */
 +GlobalProperty spapr_compat_rhel7_4[] = {
 +    { TYPE_POWERPC_CPU, "pre-2.10-migration", "on" },
 +};
 +const size_t spapr_compat_rhel7_4_len = G_N_ELEMENTS(spapr_compat_rhel7_4);
 +
 +static void spapr_machine_rhel740_class_options(MachineClass *mc)
 +{
 +    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 +
 +    spapr_machine_rhel750_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_7_4, hw_compat_rhel_7_4_len);
 +    compat_props_add(mc->compat_props, spapr_compat_rhel7_4, spapr_compat_rhel7_4_len);
 +    smc->has_power9_support = false;
 +    smc->pre_2_10_has_unused_icps = true;
 +    smc->resize_hpt_default = SPAPR_RESIZE_HPT_DISABLED;
 +    smc->default_caps.caps[SPAPR_CAP_HTM] = SPAPR_CAP_ON;
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel740, "rhel7.4.0", false);
 +
 +/*
 + * pseries-rhel7.4.0-sxxm
 + *
 + * pseries-rhel7.4.0 with speculative execution exploit mitigations enabled by default
 + */
 +
 +static void spapr_machine_rhel740sxxm_class_options(MachineClass *mc)
 +{
 +    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 +
 +    spapr_machine_rhel740_class_options(mc);
 +    smc->default_caps.caps[SPAPR_CAP_CFPC] = SPAPR_CAP_WORKAROUND;
 +    smc->default_caps.caps[SPAPR_CAP_SBBC] = SPAPR_CAP_WORKAROUND;
 +    smc->default_caps.caps[SPAPR_CAP_IBS] = SPAPR_CAP_FIXED_CCD;
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel740sxxm, "rhel7.4.0-sxxm", false);
 +
 +/*
 + * pseries-rhel7.3.0
 + * like spapr_compat_2_6/_2_7/_2_8 but "ddw" has been backported to RHEL7_3
 + */
 +GlobalProperty spapr_compat_rhel7_3[] = {
 +    { TYPE_SPAPR_PCI_HOST_BRIDGE, "mem_win_size", "0xf80000000" },
 +    { TYPE_SPAPR_PCI_HOST_BRIDGE, "mem64_win_size", "0" },
 +    { TYPE_POWERPC_CPU, "pre-2.8-migration", "on" },
 +    { TYPE_SPAPR_PCI_HOST_BRIDGE, "pre-2.8-migration", "on" },
 +    { TYPE_SPAPR_PCI_HOST_BRIDGE, "pcie-extended-configuration-space", "off" },
 +};
 +const size_t spapr_compat_rhel7_3_len = G_N_ELEMENTS(spapr_compat_rhel7_3);
 +
 +static void spapr_machine_rhel730_class_options(MachineClass *mc)
 +{
 +    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 +
 +    spapr_machine_rhel740_class_options(mc);
 +    mc->default_cpu_type = POWERPC_CPU_TYPE_NAME("power7_v2.3");
 +    mc->default_machine_opts = "modern-hotplug-events=off";
 +    compat_props_add(mc->compat_props, hw_compat_rhel_7_3, hw_compat_rhel_7_3_len);
 +    compat_props_add(mc->compat_props, spapr_compat_rhel7_3, spapr_compat_rhel7_3_len);
 +
 +    smc->phb_placement = phb_placement_2_7;
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel730, "rhel7.3.0", false);
 +
 +/*
 + * pseries-rhel7.3.0-sxxm
 + *
 + * pseries-rhel7.3.0 with speculative execution exploit mitigations enabled by default
 + */
 +
 +static void spapr_machine_rhel730sxxm_class_options(MachineClass *mc)
 +{
 +    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 +
 +    spapr_machine_rhel730_class_options(mc);
 +    smc->default_caps.caps[SPAPR_CAP_CFPC] = SPAPR_CAP_WORKAROUND;
 +    smc->default_caps.caps[SPAPR_CAP_SBBC] = SPAPR_CAP_WORKAROUND;
 +    smc->default_caps.caps[SPAPR_CAP_IBS] = SPAPR_CAP_FIXED_CCD;
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel730sxxm, "rhel7.3.0-sxxm", false);
 +
 +/*
 + * pseries-rhel7.2.0
 + */
 +/* Should be like spapr_compat_2_5 + 2_4 + 2_3, but "dynamic-reconfiguration"
 + * has been backported to RHEL7_2 so we don't need it here.
 + */
 +
 +GlobalProperty spapr_compat_rhel7_2[] = {
 +    { "spapr-vlan", "use-rx-buffer-pools", "off" },
 +    { TYPE_SPAPR_PCI_HOST_BRIDGE, "ddw", "off" },
 +};
 +const size_t spapr_compat_rhel7_2_len = G_N_ELEMENTS(spapr_compat_rhel7_2);
 +
 +static void spapr_machine_rhel720_class_options(MachineClass *mc)
 +{
 +    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 +
 +    spapr_machine_rhel730_class_options(mc);
 +    smc->use_ohci_by_default = true;
 +    mc->has_hotpluggable_cpus = NULL;
 +    compat_props_add(mc->compat_props, hw_compat_rhel_7_2, hw_compat_rhel_7_2_len);
 +    compat_props_add(mc->compat_props, spapr_compat_rhel7_2, spapr_compat_rhel7_2_len);
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel720, "rhel7.2.0", false);
 static void spapr_machine_register_types(void)
 {
 diff --git a/hw/ppc/spapr_cpu_core.c b/hw/ppc/spapr_cpu_core.c
 index 8ba34f6a1d..78eca1c04a 100644
 --- a/hw/ppc/spapr_cpu_core.c
 +++ b/hw/ppc/spapr_cpu_core.c
@@ -24,6 +24,7 @@
 #include "sysemu/reset.h"
 #include "sysemu/hw_accel.h"
 #include "qemu/error-report.h"
 +#include "cpu-models.h"
 static void spapr_reset_vcpu(PowerPCCPU *cpu)
 {
@@ -250,6 +251,7 @@ static bool spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
 {
     CPUPPCState *env = &cpu->env;
     CPUState *cs = CPU(cpu);
 +    SpaprMachineClass *smc = SPAPR_MACHINE_GET_CLASS(spapr);
     if (!qdev_realize(DEVICE(cpu), NULL, errp)) {
         return false;
@@ -261,6 +263,17 @@ static bool spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
     cpu_ppc_set_vhyp(cpu, PPC_VIRTUAL_HYPERVISOR(spapr));
     kvmppc_set_papr(cpu);
 +    if (!smc->has_power9_support &&
 +        (((spapr->max_compat_pvr &&
 +           ppc_compat_cmp(spapr->max_compat_pvr,
 +                          CPU_POWERPC_LOGICAL_3_00) >= 0)) ||
 +          (!spapr->max_compat_pvr &&
 +           ppc_check_compat(cpu, CPU_POWERPC_LOGICAL_3_00, 0, 0)))) {
 +        error_set(errp, ERROR_CLASS_DEVICE_NOT_FOUND,
 +                  "POWER9 CPU is not supported by this machine class");
 +        return false;
 +    }
 +
     if (spapr_irq_cpu_intc_create(spapr, cpu, errp) < 0) {
         qdev_unrealize(DEVICE(cpu));
         return false;
 diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
 index ee7504b976..37a014d59c 100644
 --- a/include/hw/ppc/spapr.h
 +++ b/include/hw/ppc/spapr.h
@@ -154,6 +154,7 @@ struct SpaprMachineClass {
     bool pre_5_2_numa_associativity;
     bool pre_6_2_numa_affinity;
 +    bool has_power9_support;
     bool (*phb_placement)(SpaprMachineState *spapr, uint32_t index,
                           uint64_t *buid, hwaddr *pio,
                           hwaddr *mmio32, hwaddr *mmio64,
@@ -237,6 +238,9 @@ struct SpaprMachineState {
     /* Set by -boot */
     char *boot_device;
 + 
 +    /* Secure Guest support via x-svm-allowed */
 +    bool svm_allowed;
     /*< public >*/
     char *kvm_type;
 diff --git a/target/ppc/compat.c b/target/ppc/compat.c
 index 7949a24f5a..f207a9ba01 100644
 --- a/target/ppc/compat.c
 +++ b/target/ppc/compat.c
@@ -114,8 +114,19 @@ static const CompatInfo *compat_by_pvr(uint32_t pvr)
     return NULL;
 }
 +long ppc_compat_cmp(uint32_t pvr1, uint32_t pvr2)
 +{
 +    const CompatInfo *compat1 = compat_by_pvr(pvr1);
 +    const CompatInfo *compat2 = compat_by_pvr(pvr2);
 +
 +    g_assert(compat1);
 +    g_assert(compat2);
 +
 +    return compat1 - compat2;
 +}
 +
 static bool pcc_compat(PowerPCCPUClass *pcc, uint32_t compat_pvr,
 -                       uint32_t min_compat_pvr, uint32_t max_compat_pvr)
 +                      uint32_t min_compat_pvr, uint32_t max_compat_pvr)
 {
     const CompatInfo *compat = compat_by_pvr(compat_pvr);
     const CompatInfo *min = compat_by_pvr(min_compat_pvr);
 diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
 index e946da5f3a..23e8b76c85 100644
 --- a/target/ppc/cpu.h
 +++ b/target/ppc/cpu.h
@@ -1401,6 +1401,7 @@ static inline int cpu_mmu_index(CPUPPCState *env, bool ifetch)
 /* Compatibility modes */
 #if defined(TARGET_PPC64)
 +long ppc_compat_cmp(uint32_t pvr1, uint32_t pvr2);
 bool ppc_check_compat(PowerPCCPU *cpu, uint32_t compat_pvr,
                       uint32_t min_compat_pvr, uint32_t max_compat_pvr);
 bool ppc_type_check_compat(const char *cputype, uint32_t compat_pvr,
 diff --git a/target/ppc/kvm.c b/target/ppc/kvm.c
 index dc93b99189..154888cce5 100644
 --- a/target/ppc/kvm.c
 +++ b/target/ppc/kvm.c
@@ -90,6 +90,7 @@ static int cap_ppc_nested_kvm_hv;
 static int cap_large_decr;
 static int cap_fwnmi;
 static int cap_rpt_invalidate;
 +static int cap_ppc_secure_guest;
 static uint32_t debug_inst_opcode;
@@ -137,6 +138,7 @@ int kvm_arch_init(MachineState *ms, KVMState *s)
     cap_resize_hpt = kvm_vm_check_extension(s, KVM_CAP_SPAPR_RESIZE_HPT);
     kvmppc_get_cpu_characteristics(s);
     cap_ppc_nested_kvm_hv = kvm_vm_check_extension(s, KVM_CAP_PPC_NESTED_HV);
 +    cap_ppc_secure_guest = kvm_vm_check_extension(s, KVM_CAP_PPC_SECURE_GUEST);
     cap_large_decr = kvmppc_get_dec_bits();
     cap_fwnmi = kvm_vm_check_extension(s, KVM_CAP_PPC_FWNMI);
     /*
@@ -2563,6 +2565,16 @@ int kvmppc_has_cap_rpt_invalidate(void)
     return cap_rpt_invalidate;
 }
 +bool kvmppc_has_cap_secure_guest(void)
 +{
 +    return !!cap_ppc_secure_guest;
 +}
 +
 +int kvmppc_enable_cap_secure_guest(void)
 +{
 +    return kvm_vm_enable_cap(kvm_state, KVM_CAP_PPC_SECURE_GUEST, 0, 1);
 +}
 +
 PowerPCCPUClass *kvm_ppc_get_host_cpu_class(void)
 {
     uint32_t host_pvr = mfpvr();
@@ -2959,3 +2971,18 @@ bool kvm_arch_cpu_check_are_resettable(void)
 {
     return true;
 }
 +
 +void kvmppc_svm_allow(Error **errp)
 +{
 +    if (!kvm_enabled()) {
 +        error_setg(errp, "No PEF support in tcg, try x-svm-allowed=off");
 +        return;
 +    }
 +
 +    if (!kvmppc_has_cap_secure_guest()) {
 +        error_setg(errp, "KVM implementation does not support secure guests, "
 +                   "try x-svm-allowed=off");
 +    } else if (kvmppc_enable_cap_secure_guest() < 0) {
 +        error_setg(errp, "Error enabling x-svm-allowed, try x-svm-allowed=off");
 +    }
 +}
 diff --git a/target/ppc/kvm_ppc.h b/target/ppc/kvm_ppc.h
 index ee9325bf9a..20dbb95989 100644
 --- a/target/ppc/kvm_ppc.h
 +++ b/target/ppc/kvm_ppc.h
@@ -40,6 +40,7 @@ int kvmppc_booke_watchdog_enable(PowerPCCPU *cpu);
 target_ulong kvmppc_configure_v3_mmu(PowerPCCPU *cpu,
                                      bool radix, bool gtse,
                                      uint64_t proc_tbl);
 +void kvmppc_svm_allow(Error **errp);
 #ifndef CONFIG_USER_ONLY
 bool kvmppc_spapr_use_multitce(void);
 int kvmppc_spapr_enable_inkernel_multitce(void);
@@ -74,6 +75,8 @@ int kvmppc_get_cap_large_decr(void);
 int kvmppc_enable_cap_large_decr(PowerPCCPU *cpu, int enable);
 int kvmppc_has_cap_rpt_invalidate(void);
 int kvmppc_enable_hwrng(void);
 +bool kvmppc_has_cap_secure_guest(void);
 +int kvmppc_enable_cap_secure_guest(void);
 int kvmppc_put_books_sregs(PowerPCCPU *cpu);
 PowerPCCPUClass *kvm_ppc_get_host_cpu_class(void);
 void kvmppc_check_papr_resize_hpt(Error **errp);
@@ -393,6 +396,16 @@ static inline int kvmppc_has_cap_rpt_invalidate(void)
     return false;
 }
 +static inline bool kvmppc_has_cap_secure_guest(void)
 +{
 +    return false;
 +}
 +
 +static inline int kvmppc_enable_cap_secure_guest(void)
 +{
 +    return -1;
 +}
 +
 static inline int kvmppc_enable_hwrng(void)
 {
     return -1;
 -- 
 2.27.0
--- a/SOURCES/0010-Add-s390x-machine-types.patch
+++ b/SOURCES/0010-Add-s390x-machine-types.patch
@ -0,0 +1,165 @@
 From 4ad9a0d0582eef78946b47563eb2c5b7ddf0cbb0 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 13:47:32 +0200
 Subject: Add s390x machine types
 Adding changes to add RHEL machine types for s390x architecture.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 Rebase changes (weekly-4.1.0):
 - Use upstream compat handling
 Rebase notes (weekly-210303):
 - Use rhel-8.4.0 hw compat
 Merged patches (3.1.0):
 - 29df663 s390x/cpumodel: default enable bpb and ppa15 for z196 and later
 Merged patches (4.1.0):
 - 6c200d665b hw/s390x/s390-virtio-ccw: Add machine types for RHEL8.0.0
 Merged patches (4.2.0):
 - fb192e5 redhat: s390x: Rename s390-ccw-virtio-rhel8.0.0 to s390-ccw-virtio-rhel8.1.0
 - a9b22e8 redhat: s390x: Add proper compatibility options for the -rhel7.6.0 machine
 - hw/s390x: Add the s390-ccw-virtio-rhel8.2.0 machine types (patch 92954)
 Merged patches (weekly-201216):
 - a6ae745cce redhat: s390x: add rhel-8.4.0 compat machine
 Merged patches (weekly-210602):
 - 50835d3429 redhat: s390x: add rhel-8.5.0 compat machine
 Merged patches (weekly-211006):
 - a3bcde27fe redhat: Add s390x machine type compatibility update for 6.1 rebase
 ---
 hw/s390x/s390-virtio-ccw.c | 99 +++++++++++++++++++++++++++++++++++++-
 1 file changed, 98 insertions(+), 1 deletion(-)
 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
 index 653587ea62..181856e6cf 100644
 --- a/hw/s390x/s390-virtio-ccw.c
 +++ b/hw/s390x/s390-virtio-ccw.c
@@ -767,7 +767,7 @@ bool css_migration_enabled(void)
     {                                                                         \
         MachineClass *mc = MACHINE_CLASS(oc);                                 \
         ccw_machine_##suffix##_class_options(mc);                             \
 -        mc->desc = "VirtIO-ccw based S390 machine v" verstr;                  \
 +        mc->desc = "VirtIO-ccw based S390 machine " verstr;                   \
         if (latest) {                                                         \
             mc->alias = "s390-ccw-virtio";                                    \
             mc->is_default = true;                                            \
@@ -791,6 +791,7 @@ bool css_migration_enabled(void)
     }                                                                         \
     type_init(ccw_machine_register_##suffix)
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void ccw_machine_6_2_instance_options(MachineState *machine)
 {
 }
@@ -1100,6 +1101,102 @@ static void ccw_machine_2_4_class_options(MachineClass *mc)
     compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
 }
 DEFINE_CCW_MACHINE(2_4, "2.4", false);
 +#endif
 +
 +static void ccw_machine_rhel850_instance_options(MachineState *machine)
 +{
 +}
 +
 +static void ccw_machine_rhel850_class_options(MachineClass *mc)
 +{
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_5, hw_compat_rhel_8_5_len);
 +}
 +DEFINE_CCW_MACHINE(rhel850, "rhel8.5.0", true);
 +
 +static void ccw_machine_rhel840_instance_options(MachineState *machine)
 +{
 +    ccw_machine_rhel850_instance_options(machine);
 +}
 +
 +static void ccw_machine_rhel840_class_options(MachineClass *mc)
 +{
 +    ccw_machine_rhel850_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_4, hw_compat_rhel_8_4_len);
 +}
 +DEFINE_CCW_MACHINE(rhel840, "rhel8.4.0", false);
 +
 +static void ccw_machine_rhel820_instance_options(MachineState *machine)
 +{
 +    ccw_machine_rhel840_instance_options(machine);
 +}
 +
 +static void ccw_machine_rhel820_class_options(MachineClass *mc)
 +{
 +    ccw_machine_rhel840_class_options(mc);
 +    mc->fixup_ram_size = s390_fixup_ram_size;
 +    /* we did not publish a rhel8.3.0 machine */
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_3, hw_compat_rhel_8_3_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_2, hw_compat_rhel_8_2_len);
 +}
 +DEFINE_CCW_MACHINE(rhel820, "rhel8.2.0", false);
 +
 +static void ccw_machine_rhel760_instance_options(MachineState *machine)
 +{
 +    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V3_1 };
 +
 +    ccw_machine_rhel820_instance_options(machine);
 +
 +    s390_set_qemu_cpu_model(0x2827, 12, 2, qemu_cpu_feat);
 +
 +    /* The multiple-epoch facility was not available with rhel7.6.0 on z14GA1 */
 +    s390_cpudef_featoff(14, 1, S390_FEAT_MULTIPLE_EPOCH);
 +    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_QSIE);
 +    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_QTOUE);
 +    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_STOE);
 +    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_STOUE);
 +}
 +
 +static void ccw_machine_rhel760_class_options(MachineClass *mc)
 +{
 +    ccw_machine_rhel820_class_options(mc);
 +    /* We never published the s390x version of RHEL-AV 8.0 and 8.1, so add this here */
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_1, hw_compat_rhel_8_1_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_0, hw_compat_rhel_8_0_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_7_6, hw_compat_rhel_7_6_len);
 +}
 +DEFINE_CCW_MACHINE(rhel760, "rhel7.6.0", false);
 +
 +static void ccw_machine_rhel750_instance_options(MachineState *machine)
 +{
 +    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V2_11 };
 +    ccw_machine_rhel760_instance_options(machine);
 +
 +    /* before 2.12 we emulated the very first z900, and RHEL 7.5 is
 +       based on 2.10 */
 +    s390_set_qemu_cpu_model(0x2064, 7, 1, qemu_cpu_feat);
 +
 +    /* bpb and ppa15 were only in the full model in RHEL 7.5 */
 +    s390_cpudef_featoff_greater(11, 1, S390_FEAT_PPA15);
 +    s390_cpudef_featoff_greater(11, 1, S390_FEAT_BPB);
 +}
 +
 +GlobalProperty ccw_compat_rhel_7_5[] = {
 +        {
 +            .driver   = TYPE_SCLP_EVENT_FACILITY,
 +            .property = "allow_all_mask_sizes",
 +            .value    = "off",
 +        },
 +};
 +const size_t ccw_compat_rhel_7_5_len = G_N_ELEMENTS(ccw_compat_rhel_7_5);
 +
 +static void ccw_machine_rhel750_class_options(MachineClass *mc)
 +{
 +    ccw_machine_rhel760_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_7_5, hw_compat_rhel_7_5_len);
 +    compat_props_add(mc->compat_props, ccw_compat_rhel_7_5, ccw_compat_rhel_7_5_len);
 +    S390_CCW_MACHINE_CLASS(mc)->hpage_1m_allowed = false;
 +}
 +DEFINE_CCW_MACHINE(rhel750, "rhel7.5.0", false);
 static void ccw_machine_register_types(void)
 {
 -- 
 2.27.0
--- a/SOURCES/0011-Add-x86_64-machine-types.patch
+++ b/SOURCES/0011-Add-x86_64-machine-types.patch
--- a/SOURCES/0012-Enable-make-check.patch
+++ b/SOURCES/0012-Enable-make-check.patch
@ -0,0 +1,407 @@
 From 740a2dd943a2e0fcd41a9cd8eb94a136f8f49fa2 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 2 Sep 2020 09:39:41 +0200
 Subject: Enable make check
 Fixing tests after device disabling and machine types changes and enabling
 make check run during build.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 Rebase changes (4.0.0):
 - Remove testing for pseries-2.7 in endianess test
 - Disable device-plug-test on s390x as it use disabled device
 - Do not run cpu-plug-tests on 7.3 and older machine types
 Rebase changes (4.1.0-rc0):
 - removed iotests 068
 Rebase changes (4.1.0-rc1):
 - remove all 205 tests (unstable)
 Rebase changes (4.2.0-rc0):
 - partially disable hd-geo-test (requires lsi53c895a)
 Rebase changes (5.1.0-rc1):
 - Disable qtest/q35-test (uses upstream machine types)
 - Do not run iotests on make checka
 - Enabled iotests 071 and 099
 Rebase changes (5.2.0 rc0):
 - Disable cdrom tests (unsupported devices) on x86_64
 - disable fuzz test
 Rebase changes (6.0.0):
 - Disabled xlnx-can-test
 - Disable pxb-pcie subtest for bios-table-test
 - Replace qtest usage of upstream q35 machine type with pc-q35-rhel8.4.0
 - Not run cdrom-test on aarch64
 Rebase changes (6.1.0):
 - Remove unnecessary test disabling changes
 Rebase changes (weekly-211006):
 - New handling for bios-table-test (disabled downstream)
 Merged patches (4.0.0):
 - f7ffd13 Remove 7 qcow2 and luks iotests that are taking > 25 sec to run during the fast train build proce
 Merged patches (4.1.0-rc0):
 - 41288ff redhat: Remove raw iotest 205
 ---
 redhat/qemu-kvm.spec.template       |  2 +-
 tests/qemu-iotests/051              |  8 ++++----
 tests/qtest/bios-tables-test.c      |  5 ++++-
 tests/qtest/boot-serial-test.c      |  6 +++++-
 tests/qtest/cdrom-test.c            |  4 ++++
 tests/qtest/cpu-plug-test.c         |  4 ++--
 tests/qtest/fuzz-e1000e-test.c      |  2 +-
 tests/qtest/fuzz-virtio-scsi-test.c |  2 +-
 tests/qtest/hd-geo-test.c           |  4 ++++
 tests/qtest/lpc-ich9-test.c         |  2 +-
 tests/qtest/meson.build             | 13 ++++---------
 tests/qtest/prom-env-test.c         |  4 ++++
 tests/qtest/test-x86-cpuid-compat.c |  2 ++
 tests/qtest/usb-hcd-xhci-test.c     |  4 ++++
 14 files changed, 41 insertions(+), 21 deletions(-)
 diff --git a/tests/qemu-iotests/051 b/tests/qemu-iotests/051
 index 1d2fa93a11..c8a2815f54 100755
 --- a/tests/qemu-iotests/051
 +++ b/tests/qemu-iotests/051
@@ -174,9 +174,9 @@ run_qemu -drive if=virtio
 case "$QEMU_DEFAULT_MACHINE" in
     pc)
         run_qemu -drive if=none,id=disk -device ide-cd,drive=disk
 -        run_qemu -drive if=none,id=disk -device lsi53c895a -device scsi-cd,drive=disk
 +#        run_qemu -drive if=none,id=disk -device lsi53c895a -device scsi-cd,drive=disk
         run_qemu -drive if=none,id=disk -device ide-hd,drive=disk
 -        run_qemu -drive if=none,id=disk -device lsi53c895a -device scsi-hd,drive=disk
 +#        run_qemu -drive if=none,id=disk -device lsi53c895a -device scsi-hd,drive=disk
         ;;
      *)
         ;;
@@ -225,9 +225,9 @@ run_qemu -drive file="$TEST_IMG",if=virtio,readonly=on
 case "$QEMU_DEFAULT_MACHINE" in
     pc)
         run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device ide-cd,drive=disk
 -        run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device lsi53c895a -device scsi-cd,drive=disk
 +#        run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device lsi53c895a -device scsi-cd,drive=disk
         run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device ide-hd,drive=disk
 -        run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device lsi53c895a -device scsi-hd,drive=disk
 +#        run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device lsi53c895a -device scsi-hd,drive=disk
         ;;
      *)
         ;;
 diff --git a/tests/qtest/bios-tables-test.c b/tests/qtest/bios-tables-test.c
 index 258874167e..16d8304cde 100644
 --- a/tests/qtest/bios-tables-test.c
 +++ b/tests/qtest/bios-tables-test.c
@@ -1372,6 +1372,7 @@ static void test_acpi_virt_tcg_numamem(void)
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void test_acpi_virt_tcg_pxb(void)
 {
     test_data data = {
@@ -1403,6 +1404,7 @@ static void test_acpi_virt_tcg_pxb(void)
     free_test_data(&data);
 }
 +#endif
 static void test_acpi_tcg_acpi_hmat(const char *machine)
 {
@@ -1644,7 +1646,8 @@ int main(int argc, char *argv[])
             qtest_add_func("acpi/virt", test_acpi_virt_tcg);
             qtest_add_func("acpi/virt/numamem", test_acpi_virt_tcg_numamem);
             qtest_add_func("acpi/virt/memhp", test_acpi_virt_tcg_memhp);
 -            qtest_add_func("acpi/virt/pxb", test_acpi_virt_tcg_pxb);
 +            /* Disabled for Red Hat Enterprise Linux
 +            qtest_add_func("acpi/virt/pxb", test_acpi_virt_tcg_pxb); */
             qtest_add_func("acpi/virt/oem-fields", test_acpi_oem_fields_virt);
         }
     }
 diff --git a/tests/qtest/boot-serial-test.c b/tests/qtest/boot-serial-test.c
 index 83828ba270..294476b959 100644
 --- a/tests/qtest/boot-serial-test.c
 +++ b/tests/qtest/boot-serial-test.c
@@ -148,19 +148,23 @@ static testdef_t tests[] = {
     { "ppc", "g3beige", "", "PowerPC,750" },
     { "ppc", "mac99", "", "PowerPC,G4" },
     { "ppc", "sam460ex", "-m 256", "DRAM:  256 MiB" },
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
     { "ppc64", "ppce500", "", "U-Boot" },
     { "ppc64", "40p", "-m 192", "Memory: 192M" },
     { "ppc64", "mac99", "", "PowerPC,970FX" },
 +#endif
     { "ppc64", "pseries",
       "-machine " PSERIES_DEFAULT_CAPABILITIES,
       "Open Firmware" },
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
     { "ppc64", "powernv8", "", "OPAL" },
     { "ppc64", "powernv9", "", "OPAL" },
     { "ppc64", "sam460ex", "-device e1000", "8086  100e" },
 +#endif
     { "i386", "isapc", "-cpu qemu32 -device sga", "SGABIOS" },
     { "i386", "pc", "-device sga", "SGABIOS" },
     { "i386", "q35", "-device sga", "SGABIOS" },
 -    { "x86_64", "isapc", "-cpu qemu32 -device sga", "SGABIOS" },
 +    { "x86_64", "pc", "-cpu qemu32 -device sga", "SGABIOS" },
     { "x86_64", "q35", "-device sga", "SGABIOS" },
     { "sparc", "LX", "", "TMS390S10" },
     { "sparc", "SS-4", "", "MB86904" },
 diff --git a/tests/qtest/cdrom-test.c b/tests/qtest/cdrom-test.c
 index 5af944a5fb..69d9bac38a 100644
 --- a/tests/qtest/cdrom-test.c
 +++ b/tests/qtest/cdrom-test.c
@@ -140,6 +140,7 @@ static void add_x86_tests(void)
         qtest_add_data_func("cdrom/boot/isapc", "-M isapc "
                             "-drive if=ide,media=cdrom,file=", test_cdboot);
     }
 +#if 0  /* Disabled for Red Hat Enterprise Linux */
     qtest_add_data_func("cdrom/boot/am53c974",
                         "-device am53c974 -device scsi-cd,drive=cd1 "
                         "-drive if=none,id=cd1,format=raw,file=", test_cdboot);
@@ -155,6 +156,7 @@ static void add_x86_tests(void)
     qtest_add_data_func("cdrom/boot/megasas-gen2", "-M q35 "
                         "-device megasas-gen2 -device scsi-cd,drive=cd1 "
                         "-blockdev file,node-name=cd1,filename=", test_cdboot);
 +#endif
 }
 static void add_s390x_tests(void)
@@ -220,6 +222,7 @@ int main(int argc, char **argv)
             "magnum", "malta", "pica61", NULL
         };
         add_cdrom_param_tests(mips64machines);
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
     } else if (g_str_equal(arch, "arm") || g_str_equal(arch, "aarch64")) {
         const char *armmachines[] = {
             "realview-eb", "realview-eb-mpcore", "realview-pb-a8",
@@ -227,6 +230,7 @@ int main(int argc, char **argv)
             "vexpress-a9", "virt", NULL
         };
         add_cdrom_param_tests(armmachines);
 +#endif
     } else {
         const char *nonemachine[] = { "none", NULL };
         add_cdrom_param_tests(nonemachine);
 diff --git a/tests/qtest/cpu-plug-test.c b/tests/qtest/cpu-plug-test.c
 index a1c689414b..a8f076711c 100644
 --- a/tests/qtest/cpu-plug-test.c
 +++ b/tests/qtest/cpu-plug-test.c
@@ -110,8 +110,8 @@ static void add_pseries_test_case(const char *mname)
     char *path;
     PlugTestData *data;
 -    if (!g_str_has_prefix(mname, "pseries-") ||
 -        (g_str_has_prefix(mname, "pseries-2.") && atoi(&mname[10]) < 7)) {
 +    if (!g_str_has_prefix(mname, "pseries-rhel") ||
 +        (g_str_has_prefix(mname, "pseries-rhel7.") && atoi(&mname[14]) < 4)) {
         return;
     }
     data = g_new(PlugTestData, 1);
 diff --git a/tests/qtest/fuzz-e1000e-test.c b/tests/qtest/fuzz-e1000e-test.c
 index 66229e6096..947fba73b7 100644
 --- a/tests/qtest/fuzz-e1000e-test.c
 +++ b/tests/qtest/fuzz-e1000e-test.c
@@ -17,7 +17,7 @@ static void test_lp1879531_eth_get_rss_ex_dst_addr(void)
 {
     QTestState *s;
 -    s = qtest_init("-nographic -monitor none -serial none -M pc-q35-5.0");
 +    s = qtest_init("-nographic -monitor none -serial none -M pc-q35-rhel8.4.0");
     qtest_outl(s, 0xcf8, 0x80001010);
     qtest_outl(s, 0xcfc, 0xe1020000);
 diff --git a/tests/qtest/fuzz-virtio-scsi-test.c b/tests/qtest/fuzz-virtio-scsi-test.c
 index aaf6d10e18..43727d62ac 100644
 --- a/tests/qtest/fuzz-virtio-scsi-test.c
 +++ b/tests/qtest/fuzz-virtio-scsi-test.c
@@ -19,7 +19,7 @@ static void test_mmio_oob_from_memory_region_cache(void)
 {
     QTestState *s;
 -    s = qtest_init("-M pc-q35-5.2 -display none -m 512M "
 +    s = qtest_init("-M pc-q35-rhel8.4.0 -display none -m 512M "
                    "-device virtio-scsi,num_queues=8,addr=03.0 ");
     qtest_outl(s, 0xcf8, 0x80001811);
 diff --git a/tests/qtest/hd-geo-test.c b/tests/qtest/hd-geo-test.c
 index 113126ae06..999ef2aace 100644
 --- a/tests/qtest/hd-geo-test.c
 +++ b/tests/qtest/hd-geo-test.c
@@ -737,6 +737,7 @@ static void test_override_ide(void)
     test_override(args, expected);
 }
 +#if 0 /* Require lsi53c895a - not supported on RHEL */
 static void test_override_scsi(void)
 {
     TestArgs *args = create_args();
@@ -781,6 +782,7 @@ static void test_override_scsi_2_controllers(void)
     add_scsi_disk(args, 3, 1, 0, 1, 2, 0, 1, 0);
     test_override(args, expected);
 }
 +#endif
 static void test_override_virtio_blk(void)
 {
@@ -960,9 +962,11 @@ int main(int argc, char **argv)
     qtest_add_func("hd-geo/ide/device/user/chst", test_ide_device_user_chst);
     if (have_qemu_img()) {
         qtest_add_func("hd-geo/override/ide", test_override_ide);
 +#if 0 /* Require lsi53c895a - not supported on RHEL */
         qtest_add_func("hd-geo/override/scsi", test_override_scsi);
         qtest_add_func("hd-geo/override/scsi_2_controllers",
                        test_override_scsi_2_controllers);
 +#endif
         qtest_add_func("hd-geo/override/virtio_blk", test_override_virtio_blk);
         qtest_add_func("hd-geo/override/zero_chs", test_override_zero_chs);
         qtest_add_func("hd-geo/override/scsi_hot_unplug",
 diff --git a/tests/qtest/lpc-ich9-test.c b/tests/qtest/lpc-ich9-test.c
 index fe0bef9980..7a9d51579b 100644
 --- a/tests/qtest/lpc-ich9-test.c
 +++ b/tests/qtest/lpc-ich9-test.c
@@ -15,7 +15,7 @@ static void test_lp1878642_pci_bus_get_irq_level_assert(void)
 {
     QTestState *s;
 -    s = qtest_init("-M pc-q35-5.0 "
 +    s = qtest_init("-M pc-q35-rhel8.4.0 "
                    "-nographic -monitor none -serial none");
     qtest_outl(s, 0xcf8, 0x8000f840); /* PMBASE */
 diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
 index c9d8458062..049e06c057 100644
 --- a/tests/qtest/meson.build
 +++ b/tests/qtest/meson.build
@@ -68,7 +68,6 @@ qtests_i386 = \
   (config_all_devices.has_key('CONFIG_RTL8139_PCI') ? ['rtl8139-test'] : []) +              \
   (config_all_devices.has_key('CONFIG_E1000E_PCI_EXPRESS') ? ['fuzz-e1000e-test'] : []) +   \
   (config_all_devices.has_key('CONFIG_ESP_PCI') ? ['am53c974-test'] : []) +                 \
 -  (unpack_edk2_blobs ? ['bios-tables-test'] : []) +                                         \
   qtests_pci +                                                                              \
   ['fdc-test',
    'ide-test',
@@ -81,7 +80,6 @@ qtests_i386 = \
    'drive_del-test',
    'tco-test',
    'cpu-plug-test',
 -   'q35-test',
    'vmgenid-test',
    'migration-test',
    'test-x86-cpuid-compat',
@@ -130,17 +128,15 @@ qtests_mips64el = \
 qtests_ppc = \
   (config_all_devices.has_key('CONFIG_ISA_TESTDEV') ? ['endianness-test'] : []) +            \
 -  (config_all_devices.has_key('CONFIG_M48T59') ? ['m48t59-test'] : []) +                     \
 -  ['boot-order-test', 'prom-env-test', 'boot-serial-test']                 \
 +  (config_all_devices.has_key('CONFIG_M48T59') ? ['m48t59-test'] : [])
 qtests_ppc64 = \
   (config_all_devices.has_key('CONFIG_PSERIES') ? ['device-plug-test'] : []) +               \
   (config_all_devices.has_key('CONFIG_POWERNV') ? ['pnv-xscom-test'] : []) +                 \
   (config_all_devices.has_key('CONFIG_PSERIES') ? ['rtas-test'] : []) +                      \
 -  (slirp.found() ? ['pxe-test', 'test-netfilter'] : []) +              \
 +  (slirp.found() ? ['pxe-test'] : []) +              \
   (config_all_devices.has_key('CONFIG_USB_UHCI') ? ['usb-hcd-uhci-test'] : []) +             \
   (config_all_devices.has_key('CONFIG_USB_XHCI_NEC') ? ['usb-hcd-xhci-test'] : []) +         \
 -  (config_host.has_key('CONFIG_POSIX') ? ['test-filter-mirror'] : []) +                      \
   qtests_pci + ['migration-test', 'numa-test', 'cpu-plug-test', 'drive_del-test']
 qtests_sh4 = (config_all_devices.has_key('CONFIG_ISA_TESTDEV') ? ['endianness-test'] : [])
@@ -186,8 +182,8 @@ qtests_aarch64 = \
   ['arm-cpu-features',
    'numa-test',
    'boot-serial-test',
 -   'xlnx-can-test',
 -   'fuzz-xlnx-dp-test',
 +#   'xlnx-can-test',
 +#   'fuzz-xlnx-dp-test',
    'migration-test']
 qtests_s390x = \
@@ -196,7 +192,6 @@ qtests_s390x = \
   (config_host.has_key('CONFIG_POSIX') ? ['test-filter-redirector'] : []) +                     \
   ['boot-serial-test',
    'drive_del-test',
 -   'device-plug-test',
    'virtio-ccw-test',
    'cpu-plug-test',
    'migration-test']
 diff --git a/tests/qtest/prom-env-test.c b/tests/qtest/prom-env-test.c
 index f41d80154a..f8dc478ce8 100644
 --- a/tests/qtest/prom-env-test.c
 +++ b/tests/qtest/prom-env-test.c
@@ -89,10 +89,14 @@ int main(int argc, char *argv[])
     if (!strcmp(arch, "ppc")) {
         add_tests(ppc_machines);
     } else if (!strcmp(arch, "ppc64")) {
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
         add_tests(ppc_machines);
         if (g_test_slow()) {
 +#endif
             qtest_add_data_func("prom-env/pseries", "pseries", test_machine);
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
         }
 +#endif
     } else if (!strcmp(arch, "sparc")) {
         add_tests(sparc_machines);
     } else if (!strcmp(arch, "sparc64")) {
 diff --git a/tests/qtest/test-x86-cpuid-compat.c b/tests/qtest/test-x86-cpuid-compat.c
 index f28848e06e..6b2fd398a2 100644
 --- a/tests/qtest/test-x86-cpuid-compat.c
 +++ b/tests/qtest/test-x86-cpuid-compat.c
@@ -300,6 +300,7 @@ int main(int argc, char **argv)
                    "-cpu 486,xlevel2=0xC0000002,xstore=on",
                    "xlevel2", 0xC0000002);
 +#if 0 /* Disabled in Red Hat Enterprise Linux */
     /* Check compatibility of old machine-types that didn't
      * auto-increase level/xlevel/xlevel2: */
@@ -350,6 +351,7 @@ int main(int argc, char **argv)
     add_cpuid_test("x86/cpuid/xlevel-compat/pc-i440fx-2.4/npt-on",
                    "-machine pc-i440fx-2.4 -cpu SandyBridge,svm=on,npt=on",
                    "xlevel", 0x80000008);
 +#endif
     /* Test feature parsing */
     add_feature_test("x86/cpuid/features/plus",
 diff --git a/tests/qtest/usb-hcd-xhci-test.c b/tests/qtest/usb-hcd-xhci-test.c
 index 10ef9d2a91..3855873050 100644
 --- a/tests/qtest/usb-hcd-xhci-test.c
 +++ b/tests/qtest/usb-hcd-xhci-test.c
@@ -21,6 +21,7 @@ static void test_xhci_hotplug(void)
     usb_test_hotplug(global_qtest, "xhci", "1", NULL);
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void test_usb_uas_hotplug(void)
 {
     QTestState *qts = global_qtest;
@@ -36,6 +37,7 @@ static void test_usb_uas_hotplug(void)
     qtest_qmp_device_del(qts, "scsihd");
     qtest_qmp_device_del(qts, "uas");
 }
 +#endif
 static void test_usb_ccid_hotplug(void)
 {
@@ -56,7 +58,9 @@ int main(int argc, char **argv)
     qtest_add_func("/xhci/pci/init", test_xhci_init);
     qtest_add_func("/xhci/pci/hotplug", test_xhci_hotplug);
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
     qtest_add_func("/xhci/pci/hotplug/usb-uas", test_usb_uas_hotplug);
 +#endif
     qtest_add_func("/xhci/pci/hotplug/usb-ccid", test_usb_ccid_hotplug);
     qtest_start("-device nec-usb-xhci,id=xhci"
 -- 
 2.27.0
--- a/SOURCES/0013-vfio-cap-number-of-devices-that-can-be-assigned.patch
+++ b/SOURCES/0013-vfio-cap-number-of-devices-that-can-be-assigned.patch
@ -1,8 +1,17 @@
-From 8ba1a6d1a432e2ae82ae532253c2b254e6ce82a7 Mon Sep 17 00:00:00 2001
+From e9ebc159a9acf108e1ec6f622be3f256cf14aba7 Mon Sep 17 00:00:00 2001
 From: Bandan Das <bsd@redhat.com>
 Date: Tue, 3 Dec 2013 20:05:13 +0100
 Subject: vfio: cap number of devices that can be assigned
 RH-Author: Bandan Das <bsd@redhat.com>
 Message-id: <1386101113-31560-3-git-send-email-bsd@redhat.com>
 Patchwork-id: 55984
 O-Subject: [PATCH RHEL7 qemu-kvm v2 2/2] vfio: cap number of devices that can be assigned
 Bugzilla: 678368
 RH-Acked-by: Alex Williamson <alex.williamson@redhat.com>
 RH-Acked-by: Marcelo Tosatti <mtosatti@redhat.com>
 RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
 Go through all groups to get count of total number of devices
 active to enforce limit
@ -13,42 +22,42 @@ for other uses. Stepping down a bit, the number 32 arbitrarily
 matches the number of slots on a PCI bus and is also a nice power
 of two.
 Count of slots increased to 509 later so we could increase limit
 to 64 as some usecases require more than 32 devices.
 Signed-off-by: Bandan Das <bsd@redhat.com>
 Rebase notes (2.8.0):
 - removed return value for vfio_realize (commit 1a22aca)
 Merged patches (2.9.0):
 - 17eb774 vfio: Use error_setg when reporting max assigned device overshoot
 Merged patches (4.1.0-rc3):
 - 2b89558 vfio: increase the cap on number of assigned devices to 64
 ---
- hw/vfio/pci.c | 31 ++++++++++++++++++++++++++++++-
+ hw/vfio/pci.c | 29 ++++++++++++++++++++++++++++-
 hw/vfio/pci.h |  1 +
- 2 files changed, 31 insertions(+), 1 deletion(-)
+ 2 files changed, 29 insertions(+), 1 deletion(-)
 diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
-index 64780d1b79..57ac63c10c 100644
+index 7b45353ce2..eb725a3aee 100644
 --- a/hw/vfio/pci.c
 +++ b/hw/vfio/pci.c
-@@ -50,6 +50,9 @@
+@@ -45,6 +45,9 @@
- /* Protected by BQL */
+ 
- static KVMRouteChange vfio_route_change;
+ #define TYPE_VFIO_PCI_NOHOTPLUG "vfio-pci-nohotplug"
 +/* RHEL only: Set once for the first assigned dev */
 +static uint16_t device_limit;
 +
 static void vfio_disable_interrupts(VFIOPCIDevice *vdev);
 static void vfio_mmap_set_enabled(VFIOPCIDevice *vdev, bool enabled);
- static void vfio_msi_disable_common(VFIOPCIDevice *vdev);
+ 
-@@ -2946,13 +2949,36 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
+@@ -2807,9 +2810,30 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
-     ERRP_GUARD();
+     ssize_t len;
-     VFIOPCIDevice *vdev = VFIO_PCI(pdev);
+     struct stat st;
-     VFIODevice *vbasedev = &vdev->vbasedev;
+     int groupid;
 +    VFIODevice *vbasedev_iter;
 +    VFIOGroup *group;
     char *tmp, *subsys;
     Error *err = NULL;
 -    int i, ret;
 +    int ret, i = 0;
     bool is_mdev;
     char uuid[UUID_STR_LEN];
     char *name;
 +    if (device_limit && device_limit != vdev->assigned_device_limit) {
 +            error_setg(errp, "Assigned device limit has been redefined. "
@ -71,10 +80,10 @@ index 64780d1b79..57ac63c10c 100644
 +        return;
 +    }
 +
-     if (vbasedev->fd < 0 && !vbasedev->sysfsdev) {
+     if (!vdev->vbasedev.sysfsdev) {
         if (!(~vdev->host.domain || ~vdev->host.bus ||
               ~vdev->host.slot || ~vdev->host.function)) {
-@@ -3370,6 +3396,9 @@ static Property vfio_pci_dev_properties[] = {
+@@ -3246,6 +3270,9 @@ static Property vfio_pci_dev_properties[] = {
     DEFINE_PROP_BOOL("x-no-kvm-msix", VFIOPCIDevice, no_kvm_msix, false),
     DEFINE_PROP_BOOL("x-no-geforce-quirks", VFIOPCIDevice,
                      no_geforce_quirks, false),
@ -85,10 +94,10 @@ index 64780d1b79..57ac63c10c 100644
                      false),
     DEFINE_PROP_BOOL("x-no-vfio-ioeventfd", VFIOPCIDevice, no_vfio_ioeventfd,
 diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
-index 6e64a2654e..b7de39c010 100644
+index 64777516d1..e0fe6ca97e 100644
 --- a/hw/vfio/pci.h
 +++ b/hw/vfio/pci.h
-@@ -142,6 +142,7 @@ struct VFIOPCIDevice {
+@@ -139,6 +139,7 @@ struct VFIOPCIDevice {
     EventNotifier err_notifier;
     EventNotifier req_notifier;
     int (*resetfn)(struct VFIOPCIDevice *);
@ -97,5 +106,5 @@ index 6e64a2654e..b7de39c010 100644
     uint32_t device_id;
     uint32_t sub_vendor_id;
 -- 
-2.39.3
+2.27.0
--- a/SOURCES/0014-Add-support-statement-to-help-output.patch
+++ b/SOURCES/0014-Add-support-statement-to-help-output.patch
@ -1,21 +1,30 @@
-From 7bc7a2d39bb2c00bcc8e573f05e629f5f21edc35 Mon Sep 17 00:00:00 2001
+From b736b0c41dd62ed6f874a7b33ca1d4f9ceab4573 Mon Sep 17 00:00:00 2001
 From: Eduardo Habkost <ehabkost@redhat.com>
 Date: Wed, 4 Dec 2013 18:53:17 +0100
 Subject: Add support statement to -help output
 RH-Author: Eduardo Habkost <ehabkost@redhat.com>
 Message-id: <1386183197-27761-1-git-send-email-ehabkost@redhat.com>
 Patchwork-id: 55994
 O-Subject: [qemu-kvm RHEL7 PATCH] Add support statement to -help output
 Bugzilla: 972773
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: knoel@redhat.com
 RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
 Add support statement to -help output, reporting direct qemu-kvm usage
 as unsupported by Red Hat, and advising users to use libvirt instead.
 Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
 ---
- system/vl.c | 9 +++++++++
+ softmmu/vl.c | 9 +++++++++
 1 file changed, 9 insertions(+)
-diff --git a/system/vl.c b/system/vl.c
+diff --git a/softmmu/vl.c b/softmmu/vl.c
-index c644222982..03c3b0aa94 100644
+index 620a1f1367..d46b8fb4ab 100644
--- a/system/vl.c
+--- a/softmmu/vl.c
-+++ b/system/vl.c
+++ b/softmmu/vl.c
-@@ -869,9 +869,17 @@ static void version(void)
+@@ -827,9 +827,17 @@ static void version(void)
            QEMU_COPYRIGHT "\n");
 }
@ -32,8 +41,8 @@ index c644222982..03c3b0aa94 100644
 +    print_rh_warning();
     printf("usage: %s [options] [disk_image]\n\n"
            "'disk_image' is a raw hard disk image for IDE hard disk 0\n\n",
-             g_get_prgname());
+             error_get_progname());
-@@ -897,6 +905,7 @@ static void help(int exitcode)
+@@ -855,6 +863,7 @@ static void help(int exitcode)
            "\n"
            QEMU_HELP_BOTTOM "\n");
@ -42,5 +51,5 @@ index c644222982..03c3b0aa94 100644
 }
 -- 
-2.39.3
+2.27.0
--- a/SOURCES/0015-globally-limit-the-maximum-number-of-CPUs.patch
+++ b/SOURCES/0015-globally-limit-the-maximum-number-of-CPUs.patch
@ -0,0 +1,65 @@
 From 9a7621819821ee88d2f99d6b629fd87aa9a07758 Mon Sep 17 00:00:00 2001
 From: Andrew Jones <drjones@redhat.com>
 Date: Tue, 21 Jan 2014 10:46:52 +0100
 Subject: globally limit the maximum number of CPUs
 We now globally limit the number of VCPUs.
 Especially, there is no way one can specify more than
 max_cpus VCPUs for a VM.
 This allows us the restore the ppc max_cpus limitation to the upstream
 default and minimize the ppc hack in kvm-all.c.
 Signed-off-by: David Hildenbrand <david@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 Signed-off-by: Danilo Cesar Lemes de Paula <ddepaula@redhat.com>
 Rebase notes (2.11.0):
 - Removed CONFIG_RHV reference
 - Update commit log
 Merged patches (2.11.0):
 - 92fef14623 redhat: remove manual max_cpus limitations for ppc
 - bb722e9eff redhat: globally limit the maximum number of CPUs
 - fdeef3c1c7 RHEL: Set vcpus hard limit to 240 for Power
 - 0584216921 Match POWER max cpus to x86
 Signed-off-by: Andrew Jones <drjones@redhat.com>
 Merged patches (5.1.0):
 - redhat: globally limit the maximum number of CPUs
 - redhat: remove manual max_cpus limitations for ppc
 - use recommended max vcpu count
 Merged patches (5.2.0 rc0):
 - f8a4123 vl: Remove downstream-only MAX_RHEL_CPUS code
 ---
 accel/kvm/kvm-all.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)
 diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
 index eecd8031cf..8f2a53438f 100644
 --- a/accel/kvm/kvm-all.c
 +++ b/accel/kvm/kvm-all.c
@@ -2423,6 +2423,18 @@ static int kvm_init(MachineState *ms)
     soft_vcpus_limit = kvm_recommended_vcpus(s);
     hard_vcpus_limit = kvm_max_vcpus(s);
 +#ifdef HOST_PPC64
 +    /*
 +     * On POWER, the kernel advertises a soft limit based on the
 +     * number of CPU threads on the host.  We want to allow exceeding
 +     * this for testing purposes, so we don't want to set hard limit
 +     * to soft limit as on x86.
 +     */
 +#else
 +    /* RHEL doesn't support nr_vcpus > soft_vcpus_limit */
 +    hard_vcpus_limit = soft_vcpus_limit;
 +#endif
 +
     while (nc->name) {
         if (nc->num > soft_vcpus_limit) {
             warn_report("Number of %s cpus requested (%d) exceeds "
 -- 
 2.27.0
--- a/SOURCES/0016-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
+++ b/SOURCES/0016-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
@ -0,0 +1,126 @@
 From 0d3fc0b4c5773c6cabb0a58c064475f76eb6ac1e Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 8 Jul 2020 08:35:50 +0200
 Subject: Use qemu-kvm in documentation instead of qemu-system-<arch>
 Patchwork-id: 62380
 O-Subject: [RHEV-7.1 qemu-kvm-rhev PATCHv4] Use qemu-kvm in documentation instead of qemu-system-i386
 Bugzilla: 1140620
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 RH-Acked-by: Markus Armbruster <armbru@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 From: Miroslav Rezanina <mrezanin@redhat.com>
 We change the name and location of qemu-kvm binaries. Update documentation
 to reflect this change. Only architectures available in RHEL are updated.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 Rebase notes (5.1.0 rc0):
 - qemu-block-drivers.texi converted to qemu-block-drivers.rst (upstream)
 Rebase notes (5.2.0 rc0):
 - rewrite patch to new docs structure
 ---
 docs/defs.rst.inc              |  4 ++--
 docs/tools/qemu-trace-stap.rst | 14 +++++++-------
 qemu-options.hx                | 10 +++++-----
 3 files changed, 14 insertions(+), 14 deletions(-)
 diff --git a/docs/defs.rst.inc b/docs/defs.rst.inc
 index 52d6454b93..d74dbdeca9 100644
 --- a/docs/defs.rst.inc
 +++ b/docs/defs.rst.inc
@@ -9,7 +9,7 @@
    but the manpages will end up misrendered with following normal text
    incorrectly in boldface.
 -.. |qemu_system| replace:: qemu-system-x86_64
 -.. |qemu_system_x86| replace:: qemu-system-x86_64
 +.. |qemu_system| replace:: qemu-kvm
 +.. |qemu_system_x86| replace:: qemu-kvm
 .. |I2C| replace:: I\ :sup:`2`\ C
 .. |I2S| replace:: I\ :sup:`2`\ S
 diff --git a/docs/tools/qemu-trace-stap.rst b/docs/tools/qemu-trace-stap.rst
 index d53073b52b..9e93df084f 100644
 --- a/docs/tools/qemu-trace-stap.rst
 +++ b/docs/tools/qemu-trace-stap.rst
@@ -46,19 +46,19 @@ The following commands are valid:
   any of the listed names. If no *PATTERN* is given, the all possible
   probes will be listed.
 -  For example, to list all probes available in the ``qemu-system-x86_64``
 +  For example, to list all probes available in the ``qemu-kvm``
   binary:
   ::
 -    $ qemu-trace-stap list qemu-system-x86_64
 +    $ qemu-trace-stap list qemu-kvm
   To filter the list to only cover probes related to QEMU's cryptographic
   subsystem, in a binary outside ``$PATH``
   ::
 -    $ qemu-trace-stap list /opt/qemu/4.0.0/bin/qemu-system-x86_64 'qcrypto*'
 +    $ qemu-trace-stap list /opt/qemu/4.0.0/bin/qemu-kvm 'qcrypto*'
 .. option:: run OPTIONS BINARY PATTERN...
@@ -90,18 +90,18 @@ The following commands are valid:
     Restrict the tracing session so that it only triggers for the process
     identified by *PID*.
 -  For example, to monitor all processes executing ``qemu-system-x86_64``
 +  For example, to monitor all processes executing ``qemu-kvm``
   as found on ``$PATH``, displaying all I/O related probes:
   ::
 -    $ qemu-trace-stap run qemu-system-x86_64 'qio*'
 +    $ qemu-trace-stap run qemu-kvm 'qio*'
   To monitor only the QEMU process with PID 1732
   ::
 -    $ qemu-trace-stap run --pid=1732 qemu-system-x86_64 'qio*'
 +    $ qemu-trace-stap run --pid=1732 qemu-kvm 'qio*'
   To monitor QEMU processes running an alternative binary outside of
   ``$PATH``, displaying verbose information about setup of the
@@ -109,7 +109,7 @@ The following commands are valid:
   ::
 -    $ qemu-trace-stap -v run /opt/qemu/4.0.0/qemu-system-x86_64 'qio*'
 +    $ qemu-trace-stap -v run /opt/qemu/4.0.0/qemu-kvm 'qio*'
 See also
 --------
 diff --git a/qemu-options.hx b/qemu-options.hx
 index ae2c6dbbfc..94c4a8dbaf 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
@@ -3150,11 +3150,11 @@ SRST
     ::
 -        qemu -m 512 -object memory-backend-file,id=mem,size=512M,mem-path=/hugetlbfs,share=on \
 -             -numa node,memdev=mem \
 -             -chardev socket,id=chr0,path=/path/to/socket \
 -             -netdev type=vhost-user,id=net0,chardev=chr0 \
 -             -device virtio-net-pci,netdev=net0
 +        qemu-kvm -m 512 -object memory-backend-file,id=mem,size=512M,mem-path=/hugetlbfs,share=on \
 +                 -numa node,memdev=mem \
 +                 -chardev socket,id=chr0,path=/path/to/socket \
 +                 -netdev type=vhost-user,id=net0,chardev=chr0 \
 +                 -device virtio-net-pci,netdev=net0
 ``-netdev vhost-vdpa,vhostdev=/path/to/dev``
     Establish a vhost-vdpa netdev.
 -- 
 2.27.0
--- a/SOURCES/0017-virtio-scsi-Reject-scsi-cd-if-data-plane-enabled-RHE.patch
+++ b/SOURCES/0017-virtio-scsi-Reject-scsi-cd-if-data-plane-enabled-RHE.patch
@ -0,0 +1,66 @@
 From d95768c039a2bf6b68422f83a8d55dad41bd3181 Mon Sep 17 00:00:00 2001
 From: Fam Zheng <famz@redhat.com>
 Date: Wed, 14 Jun 2017 15:37:01 +0200
 Subject: virtio-scsi: Reject scsi-cd if data plane enabled [RHEL only]
 RH-Author: Fam Zheng <famz@redhat.com>
 Message-id: <20170614153701.14757-1-famz@redhat.com>
 Patchwork-id: 75613
 O-Subject: [RHV-7.4 qemu-kvm-rhev PATCH v3] virtio-scsi: Reject scsi-cd if data plane enabled [RHEL only]
 Bugzilla: 1378816
 RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Max Reitz <mreitz@redhat.com>
 We need a fix for RHEL 7.4 and 7.3.z, but unfortunately upstream isn't
 ready. If it were, the changes will be too invasive. To have an idea:
 https://lists.gnu.org/archive/html/qemu-devel/2017-05/msg05400.html
 is an incomplete attempt to fix part of the issue, and the remaining
 work unfortunately involve even more complex changes.
 As a band-aid, this partially reverts the effect of ef8875b
 (virtio-scsi: Remove op blocker for dataplane, since v2.7). We cannot
 simply revert that commit as a whole because we already shipped it in
 qemu-kvm-rhev 7.3, since when, block jobs has been possible.  We should
 only block what has been broken.  Also, faithfully reverting the above
 commit means adding back the removed op blocker, but that is not enough,
 because it still crashes when inserting media into an initially empty
 scsi-cd.
 All in all, scsi-cd on virtio-scsi-dataplane has basically been unusable
 unless the scsi-cd never enters an empty state, so, disable it
 altogether.  Otherwise it would be much more difficult to avoid
 crashing.
 Signed-off-by: Fam Zheng <famz@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/scsi/virtio-scsi.c | 9 +++++++++
 1 file changed, 9 insertions(+)
 diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
 index 51fd09522a..a35257c35a 100644
 --- a/hw/scsi/virtio-scsi.c
 +++ b/hw/scsi/virtio-scsi.c
@@ -896,6 +896,15 @@ static void virtio_scsi_hotplug(HotplugHandler *hotplug_dev, DeviceState *dev,
     AioContext *old_context;
     int ret;
 +    /* XXX: Remove this check once block backend is capable of handling
 +     * AioContext change upon eject/insert.
 +     * s->ctx is NULL if ioeventfd is off, s->ctx is qemu_get_aio_context() if
 +     * data plane is not used, both cases are safe for scsi-cd. */
 +    if (s->ctx && s->ctx != qemu_get_aio_context() &&
 +        object_dynamic_cast(OBJECT(dev), "scsi-cd")) {
 +        error_setg(errp, "scsi-cd is not supported by data plane");
 +        return;
 +    }
     if (s->ctx && !s->dataplane_fenced) {
         if (blk_op_is_blocked(sd->conf.blk, BLOCK_OP_TYPE_DATAPLANE, errp)) {
             return;
 -- 
 2.27.0
--- a/SOURCES/0018-BZ1653590-Require-at-least-64kiB-pages-for-downstrea.patch
+++ b/SOURCES/0018-BZ1653590-Require-at-least-64kiB-pages-for-downstrea.patch
@ -0,0 +1,60 @@
 From 92bb62c47eab021f8dabecd09b5fbc1706e6a29c Mon Sep 17 00:00:00 2001
 From: David Gibson <dgibson@redhat.com>
 Date: Wed, 6 Feb 2019 03:58:56 +0000
 Subject: BZ1653590: Require at least 64kiB pages for downstream guests & hosts
 RH-Author: David Gibson <dgibson@redhat.com>
 Message-id: <20190206035856.19058-1-dgibson@redhat.com>
 Patchwork-id: 84246
 O-Subject: [RHELAV-8.0/rhel qemu-kvm PATCH] BZ1653590: Require at least 64kiB pages for downstream guests & hosts
 Bugzilla: 1653590
 RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
 RH-Acked-by: Serhii Popovych <spopovyc@redhat.com>
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 Most current POWER guests require 64kiB page support, so that's the default
 for the cap-hpt-max-pagesize option in qemu which limits available guest
 page sizes.  We warn if the value is set smaller than that, but don't
 outright fail upstream, because we need to allow for the possibility of
 guest (and/or host) kernels configured for 4kiB page sizes.
 Downstream, however, we simply don't support 4kiB pagesize configured
 kernels in guest or host, so we can have qemu simply error out in this
 situation.
 Testing: Attempted to start a guest with cap-hpt-max-page-size=4k and verified
         it failed immediately with a qemu error
 Signed-off-by: David Gibson <dgibson@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/ppc/spapr_caps.c | 7 +++++++
 1 file changed, 7 insertions(+)
 diff --git a/hw/ppc/spapr_caps.c b/hw/ppc/spapr_caps.c
 index ed7c077a0d..48a8efe678 100644
 --- a/hw/ppc/spapr_caps.c
 +++ b/hw/ppc/spapr_caps.c
@@ -332,12 +332,19 @@ bool spapr_check_pagesize(SpaprMachineState *spapr, hwaddr pagesize,
 static void cap_hpt_maxpagesize_apply(SpaprMachineState *spapr,
                                       uint8_t val, Error **errp)
 {
 +#if 0 /* disabled for RHEL */
     if (val < 12) {
         error_setg(errp, "Require at least 4kiB hpt-max-page-size");
         return;
     } else if (val < 16) {
         warn_report("Many guests require at least 64kiB hpt-max-page-size");
     }
 +#else /* Only page sizes >=64kiB supported for RHEL */
 +    if (val < 16) {
 +        error_setg(errp, "Require at least 64kiB hpt-max-page-size");
 +        return;
 +    }
 +#endif
     spapr_check_pagesize(spapr, qemu_minrampagesize(), errp);
 }
 -- 
 2.27.0
--- a/SOURCES/0019-compat-Update-hw_compat_rhel_8_5.patch
+++ b/SOURCES/0019-compat-Update-hw_compat_rhel_8_5.patch
@ -0,0 +1,53 @@
 From a9b5da617c29f48199cbea08d6a1c083877dce10 Mon Sep 17 00:00:00 2001
 From: Laurent Vivier <lvivier@redhat.com>
 Date: Mon, 15 Nov 2021 14:22:29 +0100
 Subject: compat: Update hw_compat_rhel_8_5
 RH-Author: Laurent Vivier <lvivier@redhat.com>
 RH-MergeRequest: 66: redhat: Update pseries-rhel8.5.0 machine type
 RH-Commit: [1/2] 232f2ad2b29d250fbdb8fcea9d814704c575ba2b
 RH-Bugzilla: 2022608
 RH-Acked-by: Eric Auger <eric.auger@redhat.com>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: Greg Kurz <gkurz@redhat.com>
 Add properties from hw_compat_6_1 as it already includes the ones from
 hw_compat_6_0. Add a lately added property from 6.0 too.
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 --
 Rebase notes (6.2.0 rc3):
 - Included compatc changes introduced in RC2
 ---
 hw/core/machine.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index 62febde5aa..736c765c30 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -38,7 +38,7 @@
 #include "hw/virtio/virtio-pci.h"
 /*
 - * Mostly the same as hw_compat_6_0
 + * Mostly the same as hw_compat_6_0 and hw_compat_6_1
  */
 GlobalProperty hw_compat_rhel_8_5[] = {
     /* hw_compat_rhel_8_5 from hw_compat_6_0 */
@@ -51,6 +51,12 @@ GlobalProperty hw_compat_rhel_8_5[] = {
     { "e1000", "init-vet", "off" },
     /* hw_compat_rhel_8_5 from hw_compat_6_0 */
     { "e1000e", "init-vet", "off" },
 +    /* hw_compat_rhel_8_5 from hw_compat_6_0 */
 +    { "vhost-vsock-device", "seqpacket", "off" },
 +    /* hw_compat_rhel_8_5 from hw_compat_6_1 */
 +    { "vhost-user-vsock-device", "seqpacket", "off" },
 +    /* hw_compat_rhel_8_5 from hw_compat_6_1 */
 +    { "nvme-ns", "shared", "off" },
 };
 const size_t hw_compat_rhel_8_5_len = G_N_ELEMENTS(hw_compat_rhel_8_5);
 -- 
 2.27.0
--- a/SOURCES/0020-redhat-Update-pseries-rhel8.5.0-machine-type.patch
+++ b/SOURCES/0020-redhat-Update-pseries-rhel8.5.0-machine-type.patch
@ -0,0 +1,43 @@
 From 82358c35f04f026820b3907069a6c19cd95b654d Mon Sep 17 00:00:00 2001
 From: Laurent Vivier <lvivier@redhat.com>
 Date: Mon, 15 Nov 2021 14:25:33 +0100
 Subject: redhat: Update pseries-rhel8.5.0 machine type
 RH-Author: Laurent Vivier <lvivier@redhat.com>
 RH-MergeRequest: 66: redhat: Update pseries-rhel8.5.0 machine type
 RH-Commit: [2/2] 36f7ad1ea56baaaecb139875ad0a90a6470196be
 RH-Bugzilla: 2022608
 RH-Acked-by: Eric Auger <eric.auger@redhat.com>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: Greg Kurz <gkurz@redhat.com>
 `
 We don't introduce a new machine type for rhel8.6.0 but we need
 to keep compatibility with rhel8.5.0 machine type.
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 ---
 hw/ppc/spapr.c | 4 ++++
 1 file changed, 4 insertions(+)
 diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
 index cace86028d..2f27888d8a 100644
 --- a/hw/ppc/spapr.c
 +++ b/hw/ppc/spapr.c
@@ -5177,10 +5177,14 @@ static void spapr_machine_rhel_default_class_options(MachineClass *mc)
 static void spapr_machine_rhel850_class_options(MachineClass *mc)
 {
 +    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 +
     /* The default machine type must apply the RHEL specific defaults */
     spapr_machine_rhel_default_class_options(mc);
     compat_props_add(mc->compat_props, hw_compat_rhel_8_5,
                      hw_compat_rhel_8_5_len);
 +    smc->pre_6_2_numa_affinity = true;
 +    mc->smp_props.prefer_sockets = true;
 }
 DEFINE_SPAPR_MACHINE(rhel850, "rhel8.5.0", true);
 -- 
 2.27.0
--- a/SOURCES/0021-redhat-virt-rhel8.5.0-Update-machine-type-compatibil.patch
+++ b/SOURCES/0021-redhat-virt-rhel8.5.0-Update-machine-type-compatibil.patch
@ -0,0 +1,51 @@
 From ce73e939b993cc6be170cdb5d3f2068270593f2b Mon Sep 17 00:00:00 2001
 From: Eric Auger <eric.auger@redhat.com>
 Date: Tue, 16 Nov 2021 17:03:07 +0100
 Subject: redhat: virt-rhel8.5.0: Update machine type compatibility for QEMU
 6.2.0 update
 RH-Author: Eric Auger <eric.auger@redhat.com>
 RH-MergeRequest: 75: redhat: virt-rhel8.5.0: Update machine type compatibility for QEMU 6.2.0 update
 RH-Commit: [21/21] f027d13654944e3d34e3356affe7af952eec2bed
 RH-Bugzilla: 2022607
 RH-Acked-by: Gavin Shan <gshan@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: Andrew Jones <drjones@redhat.com>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
 To keep compatibility with 8.5-AV machine type we need to
 turn few new options on by default:
 smp_props.prefer_sockets, no_cpu_topology, no_tcg_its
 TESTED: migrate from rhel-av-8.5.0 to rhel-8.6.0 and vice-versa
 with upstream fix: 33a0c404fb  hw/intc/arm_gicv3_its: Revert version
 increments in vmstate_its
 Signed-off-by: Eric Auger <eric.auger@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/arm/virt.c | 5 +++++
 1 file changed, 5 insertions(+)
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index c77d26ab13..e8941afd01 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
@@ -3225,8 +3225,13 @@ type_init(rhel_machine_init);
 static void rhel850_virt_options(MachineClass *mc)
 {
 +    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
 +
     compat_props_add(mc->compat_props, arm_rhel_compat, arm_rhel_compat_len);
     compat_props_add(mc->compat_props, hw_compat_rhel_8_5, hw_compat_rhel_8_5_len);
 +    mc->smp_props.prefer_sockets = true;
 +    vmc->no_cpu_topology = true;
 +    vmc->no_tcg_its = true;
 }
 DEFINE_RHEL_MACHINE_AS_LATEST(8, 5, 0)
 -- 
 2.27.0
--- a/SOURCES/0022-Fix-virtio-net-pci-vectors-compat.patch
+++ b/SOURCES/0022-Fix-virtio-net-pci-vectors-compat.patch
@ -0,0 +1,45 @@
 From f9643b6934657292aae0b830627b1e5f9b8cbaa1 Mon Sep 17 00:00:00 2001
 From: Eduardo Habkost <ehabkost@redhat.com>
 Date: Tue, 19 Oct 2021 13:17:06 -0400
 Subject: Fix virtio-net-pci* "vectors" compat
 RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-MergeRequest: 77: 8.6/6.2 mt fixes
 RH-Commit: [21/23] 8ad581932275d2698a99f31bec40b14f1dbd3d2e
 RH-Bugzilla: 2026443
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 hw_compat_rhel_8_4 has an issue: it affects only "virtio-net-pci"
 but not "virtio-net-pci-transitional" and
 "virtio-net-pci-non-transitional".  The solution is to use the
 "virtio-net-pci-base" type in compat_props.
 An equivalent fix will be submitted for hw_compat_5_2 upstream.
 Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
 (cherry picked from commit d45823ab0d0138b2fbaf2ed1e1896d2052f3ccb3)
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/core/machine.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index 736c765c30..024b025fc2 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -71,7 +71,11 @@ GlobalProperty hw_compat_rhel_8_4[] = {
     /* hw_compat_rhel_8_4 from hw_compat_5_2 */
     { "virtio-blk-device", "report-discard-granularity", "off" },
     /* hw_compat_rhel_8_4 from hw_compat_5_2 */
 -    { "virtio-net-pci", "vectors", "3"},
 +    /*
 +     * Upstream incorrectly had "virtio-net-pci" instead of "virtio-net-pci-base",
 +     * (https://bugzilla.redhat.com/show_bug.cgi?id=1999141)
 +     */
 +    { "virtio-net-pci-base", "vectors", "3"},
 };
 const size_t hw_compat_rhel_8_4_len = G_N_ELEMENTS(hw_compat_rhel_8_4);
 -- 
 2.27.0
--- a/SOURCES/0023-x86-rhel-machine-types-Add-pc_rhel_8_5_compat.patch
+++ b/SOURCES/0023-x86-rhel-machine-types-Add-pc_rhel_8_5_compat.patch
@ -0,0 +1,73 @@
 From 7ad8814e583dcc7dc23e3e8398570243b8f176a1 Mon Sep 17 00:00:00 2001
 From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
 Date: Tue, 23 Nov 2021 17:57:42 +0000
 Subject: x86/rhel machine types: Add pc_rhel_8_5_compat
 RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-MergeRequest: 77: 8.6/6.2 mt fixes
 RH-Commit: [22/23] 8bf555c5d78f344b97ffd5c888c7a7bed592d9d0
 RH-Bugzilla: 2026443
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 Add pc_rhel_8_5_compat as the merge of pc_compat_6_1 and pc_compat_6_0
 (since 8.5 was based on 6.0).
 Note, x-keep-pci-slot-hpc flipped back and forward, leaving it out
 looks like it leaves us with the original.
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/i386/pc.c         | 21 +++++++++++++++++++++
 include/hw/i386/pc.h |  3 +++
 2 files changed, 24 insertions(+)
 diff --git a/hw/i386/pc.c b/hw/i386/pc.c
 index e8109954ca..4c08a1971c 100644
 --- a/hw/i386/pc.c
 +++ b/hw/i386/pc.c
@@ -387,6 +387,27 @@ GlobalProperty pc_rhel_compat[] = {
 };
 const size_t pc_rhel_compat_len = G_N_ELEMENTS(pc_rhel_compat);
 +GlobalProperty pc_rhel_8_5_compat[] = {
 +    /* pc_rhel_8_5_compat from pc_compat_6_0 */
 +    { "qemu64" "-" TYPE_X86_CPU, "family", "6" },
 +    /* pc_rhel_8_5_compat from pc_compat_6_0 */
 +    { "qemu64" "-" TYPE_X86_CPU, "model", "6" },
 +    /* pc_rhel_8_5_compat from pc_compat_6_0 */
 +    { "qemu64" "-" TYPE_X86_CPU, "stepping", "3" },
 +    /* pc_rhel_8_5_compat from pc_compat_6_0 */
 +    { TYPE_X86_CPU, "x-vendor-cpuid-only", "off" },
 +    /* pc_rhel_8_5_compat from pc_compat_6_0 */
 +    { "ICH9-LPC", ACPI_PM_PROP_ACPI_PCIHP_BRIDGE, "off" },
 +
 +    /* pc_rhel_8_5_compat from pc_compat_6_1 */
 +    { TYPE_X86_CPU, "hv-version-id-build", "0x1bbc" },
 +    /* pc_rhel_8_5_compat from pc_compat_6_1 */
 +    { TYPE_X86_CPU, "hv-version-id-major", "0x0006" },
 +    /* pc_rhel_8_5_compat from pc_compat_6_1 */
 +    { TYPE_X86_CPU, "hv-version-id-minor", "0x0001" },
 +};
 +const size_t pc_rhel_8_5_compat_len = G_N_ELEMENTS(pc_rhel_8_5_compat);
 +
 GlobalProperty pc_rhel_8_4_compat[] = {
     /* pc_rhel_8_4_compat from pc_compat_5_2 */
     { "ICH9-LPC", "x-smi-cpu-hotunplug", "off" },
 diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
 index d0544ee119..9e8bfb69f8 100644
 --- a/include/hw/i386/pc.h
 +++ b/include/hw/i386/pc.h
@@ -286,6 +286,9 @@ extern const size_t pc_compat_1_4_len;
 extern GlobalProperty pc_rhel_compat[];
 extern const size_t pc_rhel_compat_len;
 +extern GlobalProperty pc_rhel_8_5_compat[];
 +extern const size_t pc_rhel_8_5_compat_len;
 +
 extern GlobalProperty pc_rhel_8_4_compat[];
 extern const size_t pc_rhel_8_4_compat_len;
 -- 
 2.27.0
--- a/SOURCES/0024-x86-rhel-machine-types-Wire-compat-into-q35-and-i440.patch
+++ b/SOURCES/0024-x86-rhel-machine-types-Wire-compat-into-q35-and-i440.patch
@ -0,0 +1,54 @@
 From 7bd99eebadfdbea6a76585b526e7cab1ee8b1fde Mon Sep 17 00:00:00 2001
 From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
 Date: Tue, 23 Nov 2021 18:07:49 +0000
 Subject: x86/rhel machine types: Wire compat into q35 and i440fx
 RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-MergeRequest: 77: 8.6/6.2 mt fixes
 RH-Commit: [23/23] fc3861aeccc943b434231193ef45ffbc0b3cf6c6
 RH-Bugzilla: 2026443
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 Wire the pc_rhel_8_5 compat data into both piix and q35
 to keep the existing machine types compatible.
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/i386/pc_piix.c | 4 ++++
 hw/i386/pc_q35.c  | 4 ++++
 2 files changed, 8 insertions(+)
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
 index 2885edffe9..37fab00733 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
@@ -1040,6 +1040,10 @@ static void pc_machine_rhel760_options(MachineClass *m)
     pcmc->kvmclock_create_always = false;
     /* From pc_i440fx_5_1_machine_options() */
     pcmc->pci_root_uid = 1;
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_5,
 +                     hw_compat_rhel_8_5_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_5_compat,
 +                     pc_rhel_8_5_compat_len);
     compat_props_add(m->compat_props, hw_compat_rhel_8_4,
                      hw_compat_rhel_8_4_len);
     compat_props_add(m->compat_props, pc_rhel_8_4_compat,
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
 index c67418b6a9..78876e1101 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
@@ -658,6 +658,10 @@ static void pc_q35_machine_rhel850_options(MachineClass *m)
     m->desc = "RHEL-8.5.0 PC (Q35 + ICH9, 2009)";
     pcmc->smbios_stream_product = "RHEL-AV";
     pcmc->smbios_stream_version = "8.5.0";
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_5,
 +                     hw_compat_rhel_8_5_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_5_compat,
 +                     pc_rhel_8_5_compat_len);
 }
 DEFINE_PC_MACHINE(q35_rhel850, "pc-q35-rhel8.5.0", pc_q35_init_rhel850,
 -- 
 2.27.0
--- a/SOURCES/0025-redhat-Add-s390x-machine-type-compatibility-handling.patch
+++ b/SOURCES/0025-redhat-Add-s390x-machine-type-compatibility-handling.patch
@ -0,0 +1,58 @@
 From 265a57f2955b7f0b65e3f57f89aa1ff2541d3f73 Mon Sep 17 00:00:00 2001
 From: Thomas Huth <thuth@redhat.com>
 Date: Fri, 26 Nov 2021 09:37:11 +0100
 Subject: redhat: Add s390x machine type compatibility handling for the rebase
 to v6.2
 RH-Author: Thomas Huth <thuth@redhat.com>
 RH-MergeRequest: 80: Add s390x machine type compatibility handling for the rebase to v6.2
 RH-Commit: [26/26] c45cf594604f6dd23954696b9c84d2025e328d11
 RH-Bugzilla: 2022602
 RH-Acked-by: David Hildenbrand <david@redhat.com>
 RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 Add compatibility handling for the rhel8.5.0 machine type (and
 recursively older, of course).
 Based on the following upstream commits:
 463e50da8b - s390x/cpumodel: Bump up QEMU model to a stripped-down IBM z14 GA2
 30e398f796 - s390x/cpumodel: Add more feature to gen16 default model
 4a0af2930a - machine: Prefer cores over sockets in smp parsing since 6.2
 2b52619994 - machine: Move smp_prefer_sockets to struct SMPCompatProps
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 ---
 hw/s390x/s390-virtio-ccw.c | 10 ++++++++++
 1 file changed, 10 insertions(+)
 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
 index 181856e6cf..cf13c457d6 100644
 --- a/hw/s390x/s390-virtio-ccw.c
 +++ b/hw/s390x/s390-virtio-ccw.c
@@ -1105,11 +1105,21 @@ DEFINE_CCW_MACHINE(2_4, "2.4", false);
 static void ccw_machine_rhel850_instance_options(MachineState *machine)
 {
 +    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V6_0 };
 +
 +    s390_set_qemu_cpu_model(0x2964, 13, 2, qemu_cpu_feat);
 +
 +    s390_cpudef_featoff_greater(16, 1, S390_FEAT_NNPA);
 +    s390_cpudef_featoff_greater(16, 1, S390_FEAT_VECTOR_PACKED_DECIMAL_ENH2);
 +    s390_cpudef_featoff_greater(16, 1, S390_FEAT_BEAR_ENH);
 +    s390_cpudef_featoff_greater(16, 1, S390_FEAT_RDP);
 +    s390_cpudef_featoff_greater(16, 1, S390_FEAT_PAI);
 }
 static void ccw_machine_rhel850_class_options(MachineClass *mc)
 {
     compat_props_add(mc->compat_props, hw_compat_rhel_8_5, hw_compat_rhel_8_5_len);
 +    mc->smp_props.prefer_sockets = true;
 }
 DEFINE_CCW_MACHINE(rhel850, "rhel8.5.0", true);
 -- 
 2.27.0
--- a/SOURCES/81-kvm-rhel.rules
+++ b/SOURCES/81-kvm-rhel.rules
@ -0,0 +1 @@
 DEVPATH=="*/kvm", ACTION=="change", RUN+="/lib/udev/udev-kvm-check $env{COUNT} $env{EVENT}"
--- a/SOURCES/85-kvm.preset
+++ b/SOURCES/85-kvm.preset
@ -0,0 +1,5 @@
 # Enable kvm-setup by default.  This can have odd side effects on
 # PowerNV systems that aren't intended as KVM hosts, but at present we
 # only support RHEL on PowerNV for the purpose of being a RHEV host.
 enable kvm-setup.service
--- a/SOURCES/95-kvm-memlock.conf
+++ b/SOURCES/95-kvm-memlock.conf
--- a/SOURCES/99-qemu-guest-agent.rules
+++ b/SOURCES/99-qemu-guest-agent.rules
--- a/SOURCES/README.tests
+++ b/SOURCES/README.tests
@ -28,7 +28,7 @@ avocado_qemu tests:
 The avocado_qemu tests can be executed by running the following avocado command:
 avocado run -p qemu_bin=/usr/libexec/qemu-kvm /usr/lib64/qemu-kvm/tests/acceptance/
 Avocado needs to be installed separately using either pip or from source as
-Avocado is not being packaged for RHEL.
+Avocado is not being packaged for RHEL-8.
 qemu-iotests:
 symlinks to corresponding binaries need to be created for QEMU_PROG,
@ -36,4 +36,4 @@ QEMU_IO_PROG, QEMU_IMG_PROG, and QEMU_NBD_PROG before the iotests can be
 executed.
 The primary purpose of this package is to make these tests available to be
-executed as gating tests for the qemu-kvm in the RHEL OSCI environment.
+executed as gating tests for the virt module in the RHEL-8 OSCI environment.
--- a/SOURCES/bridge.conf
+++ b/SOURCES/bridge.conf
--- a/SOURCES/ksm.service
+++ b/SOURCES/ksm.service
@ -0,0 +1,13 @@
 [Unit]
 Description=Kernel Samepage Merging
 ConditionPathExists=/sys/kernel/mm/ksm
 [Service]
 Type=oneshot
 RemainAfterExit=yes
 EnvironmentFile=-/etc/sysconfig/ksm
 ExecStart=/usr/libexec/ksmctl start
 ExecStop=/usr/libexec/ksmctl stop
 [Install]
 WantedBy=multi-user.target
--- a/SOURCES/ksm.sysconfig
+++ b/SOURCES/ksm.sysconfig
@ -0,0 +1,4 @@
 # The maximum number of unswappable kernel pages
 # which may be allocated by ksm (0 for unlimited)
 # If unset, defaults to half of total memory
 # KSM_MAX_KERNEL_PAGES=
--- a/SOURCES/ksmctl.c
+++ b/SOURCES/ksmctl.c
@ -0,0 +1,77 @@
 /* Start/stop KSM, for systemd.
 * Copyright (C) 2009, 2011 Red Hat, Inc.
 * Written by Paolo Bonzini <pbonzini@redhat.com>.
 * Based on the original sysvinit script by Dan Kenigsberg <danken@redhat.com>
 * This file is distributed under the GNU General Public License, version 2
 * or later.  */
 #include <unistd.h>
 #include <stdio.h>
 #include <limits.h>
 #include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
 #define KSM_MAX_KERNEL_PAGES_FILE "/sys/kernel/mm/ksm/max_kernel_pages"
 #define KSM_RUN_FILE		  "/sys/kernel/mm/ksm/run"
 char *program_name;
 int usage(void)
 {
 	fprintf(stderr, "Usage: %s {start|stop}\n", program_name);
 	return 1;
 }
 int write_value(uint64_t value, char *filename)
 {
 	FILE *fp;
 	if (!(fp = fopen(filename, "w")) ||
 	    fprintf(fp, "%llu\n", (unsigned long long) value) == EOF ||
 	    fflush(fp) == EOF ||
 	    fclose(fp) == EOF)
 		return 1;
 	return 0;
 }
 uint64_t ksm_max_kernel_pages()
 {
 	char *var = getenv("KSM_MAX_KERNEL_PAGES");
 	char *endptr;
 	uint64_t value;
 	if (var && *var) {
 		value = strtoll(var, &endptr, 0);
 		if (value < LLONG_MAX && !*endptr)
 			return value;
 	}
 	/* Unless KSM_MAX_KERNEL_PAGES is set, let KSM munch up to half of
 	 * total memory.  */
 	return sysconf(_SC_PHYS_PAGES) / 2;
 }
 int start(void)
 {
 	if (access(KSM_MAX_KERNEL_PAGES_FILE, R_OK) >= 0)
 		write_value(ksm_max_kernel_pages(), KSM_MAX_KERNEL_PAGES_FILE);
 	return write_value(1, KSM_RUN_FILE);
 }
 int stop(void)
 {
 	return write_value(0, KSM_RUN_FILE);
 }
 int main(int argc, char **argv)
 {
 	program_name = argv[0];
 	if (argc < 2) {
 		return usage();
 	} else if (!strcmp(argv[1], "start")) {
 		return start();
 	} else if (!strcmp(argv[1], "stop")) {
 		return stop();
 	} else {
 		return usage();
 	}
 }
--- a/SOURCES/ksmtuned
+++ b/SOURCES/ksmtuned
@ -0,0 +1,139 @@
 #!/bin/bash
 #
 # Copyright 2009 Red Hat, Inc. and/or its affiliates.
 # Released under the GPL
 #
 # Author:      Dan Kenigsberg <danken@redhat.com>
 #
 # ksmtuned - a simple script that controls whether (and with what vigor) ksm
 # should search for duplicated pages.
 #
 # starts ksm when memory commited to qemu processes exceeds a threshold, and
 # make ksm work harder and harder untill memory load falls below that
 # threshold.
 #
 # send SIGUSR1 to this process right after a new qemu process is started, or
 # following its death, to retune ksm accordingly
 #
 # needs testing and ironing. contact danken@redhat.com if something breaks.
 if [ -f /etc/ksmtuned.conf ]; then
    . /etc/ksmtuned.conf
 fi
 debug() {
    if [ -n "$DEBUG" ]; then
        s="`/bin/date`: $*"
        [ -n "$LOGFILE" ] && echo "$s" >> "$LOGFILE" || echo "$s"
    fi
 }
 KSM_MONITOR_INTERVAL=${KSM_MONITOR_INTERVAL:-60}
 KSM_NPAGES_BOOST=${KSM_NPAGES_BOOST:-300}
 KSM_NPAGES_DECAY=${KSM_NPAGES_DECAY:--50}
 KSM_NPAGES_MIN=${KSM_NPAGES_MIN:-64}
 KSM_NPAGES_MAX=${KSM_NPAGES_MAX:-1250}
 # millisecond sleep between ksm scans for 16Gb server. Smaller servers sleep
 # more, bigger sleep less.
 KSM_SLEEP_MSEC=${KSM_SLEEP_MSEC:-10}
 KSM_THRES_COEF=${KSM_THRES_COEF:-20}
 KSM_THRES_CONST=${KSM_THRES_CONST:-2048}
 total=`awk '/^MemTotal:/ {print $2}' /proc/meminfo`
 debug total $total
 npages=0
 sleep=$[KSM_SLEEP_MSEC * 16 * 1024 * 1024 / total]
 [ $sleep -le 10 ] && sleep=10
 debug sleep $sleep
 thres=$[total * KSM_THRES_COEF / 100]
 if [ $KSM_THRES_CONST -gt $thres ]; then
    thres=$KSM_THRES_CONST
 fi
 debug thres $thres
 KSMCTL () {
    case x$1 in
        xstop)
            echo 0 > /sys/kernel/mm/ksm/run
            ;;
        xstart)
            echo $2 > /sys/kernel/mm/ksm/pages_to_scan
            echo $3 > /sys/kernel/mm/ksm/sleep_millisecs
            echo 1 > /sys/kernel/mm/ksm/run
            ;;
    esac
 }
 committed_memory () {
    # calculate how much memory is committed to running qemu processes
    local pidlist
    pidlist=$(pgrep -d ' ' -- '^qemu(-(kvm|system-.+)|:.{1,11})$')
    if [ -n "$pidlist" ]; then
        ps -p "$pidlist" -o rsz=
    fi | awk '{ sum += $1 }; END { print 0+sum }'
 }
 free_memory () {
    awk '/^(MemFree|Buffers|Cached):/ {free += $2}; END {print free}' \
                /proc/meminfo
 }
 increase_npages() {
    local delta
    delta=${1:-0}
    npages=$[npages + delta]
    if [ $npages -lt $KSM_NPAGES_MIN ]; then
        npages=$KSM_NPAGES_MIN
    elif [ $npages -gt $KSM_NPAGES_MAX ]; then
        npages=$KSM_NPAGES_MAX
    fi
    echo $npages
 }
 adjust () {
    local free committed
    free=`free_memory`
    committed=`committed_memory`
    debug committed $committed free $free
    if [ $[committed + thres] -lt $total -a $free -gt $thres ]; then
        KSMCTL stop
        debug "$[committed + thres] < $total and free > $thres, stop ksm"
        return 1
    fi
    debug "$[committed + thres] > $total, start ksm"
    if [ $free -lt $thres ]; then
        npages=`increase_npages $KSM_NPAGES_BOOST`
        debug "$free < $thres, boost"
    else
        npages=`increase_npages $KSM_NPAGES_DECAY`
        debug "$free > $thres, decay"
    fi
    KSMCTL start $npages $sleep
    debug "KSMCTL start $npages $sleep"
    return 0
 }
 function nothing () {
    :
 }
 loop () {
    trap nothing SIGUSR1
    while true
    do
        sleep $KSM_MONITOR_INTERVAL &
        wait $!
        adjust
    done
 }
 PIDFILE=${PIDFILE-/var/run/ksmtune.pid}
 if touch "$PIDFILE"; then
  loop &
  echo $! > "$PIDFILE"
 fi
--- a/SOURCES/ksmtuned.conf
+++ b/SOURCES/ksmtuned.conf
@ -0,0 +1,21 @@
 # Configuration file for ksmtuned.
 # How long ksmtuned should sleep between tuning adjustments
 # KSM_MONITOR_INTERVAL=60
 # Millisecond sleep between ksm scans for 16Gb server.
 # Smaller servers sleep more, bigger sleep less.
 # KSM_SLEEP_MSEC=10
 # KSM_NPAGES_BOOST=300
 # KSM_NPAGES_DECAY=-50
 # KSM_NPAGES_MIN=64
 # KSM_NPAGES_MAX=1250
 # KSM_THRES_COEF=20
 # KSM_THRES_CONST=2048
 # uncomment the following if you want ksmtuned debug info
 # LOGFILE=/var/log/ksmtuned
 # DEBUG=1
--- a/SOURCES/ksmtuned.service
+++ b/SOURCES/ksmtuned.service
@ -0,0 +1,12 @@
 [Unit]
 Description=Kernel Samepage Merging (KSM) Tuning Daemon
 After=ksm.service
 Requires=ksm.service
 [Service]
 ExecStart=/usr/sbin/ksmtuned
 ExecReload=/bin/kill -USR1 $MAINPID
 Type=forking
 [Install]
 WantedBy=multi-user.target
--- a/SOURCES/kvm-Add-dirty-sync-missed-zero-copy-migration-stat.patch
+++ b/SOURCES/kvm-Add-dirty-sync-missed-zero-copy-migration-stat.patch
@ -0,0 +1,87 @@
 From cd49a32e9c9e33efc51652b68180a07683814b4d Mon Sep 17 00:00:00 2001
 From: Leonardo Bras <leobras@redhat.com>
 Date: Mon, 11 Jul 2022 18:11:12 -0300
 Subject: [PATCH 4/9] Add dirty-sync-missed-zero-copy migration stat
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Leonardo Brás <leobras@redhat.com>
 RH-MergeRequest: 201: Zero-copy-send fixes + improvements
 RH-Commit: [4/8] 56cce61cf95aafc8dafae7531b43c166084abfec
 RH-Bugzilla: 2110203
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 Acked-by: Markus Armbruster <armbru@redhat.com>
 Acked-by: Peter Xu <peterx@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 Message-Id: <20220711211112.18951-3-leobras@redhat.com>
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 (cherry picked from commit cf20c897338067ab4b70a4596fdccaf90c7e29a1)
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 ---
 migration/migration.c | 2 ++
 monitor/hmp-cmds.c    | 5 +++++
 qapi/migration.json   | 7 ++++++-
 3 files changed, 13 insertions(+), 1 deletion(-)
 diff --git a/migration/migration.c b/migration/migration.c
 index e100b30f00..952a26c5c2 100644
 --- a/migration/migration.c
 +++ b/migration/migration.c
@@ -1012,6 +1012,8 @@ static void populate_ram_info(MigrationInfo *info, MigrationState *s)
     info->ram->normal_bytes = ram_counters.normal * page_size;
     info->ram->mbps = s->mbps;
     info->ram->dirty_sync_count = ram_counters.dirty_sync_count;
 +    info->ram->dirty_sync_missed_zero_copy =
 +            ram_counters.dirty_sync_missed_zero_copy;
     info->ram->postcopy_requests = ram_counters.postcopy_requests;
     info->ram->page_size = page_size;
     info->ram->multifd_bytes = ram_counters.multifd_bytes;
 diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
 index 8c384dc1b2..f7216ab5d0 100644
 --- a/monitor/hmp-cmds.c
 +++ b/monitor/hmp-cmds.c
@@ -305,6 +305,11 @@ void hmp_info_migrate(Monitor *mon, const QDict *qdict)
             monitor_printf(mon, "postcopy ram: %" PRIu64 " kbytes\n",
                            info->ram->postcopy_bytes >> 10);
         }
 +        if (info->ram->dirty_sync_missed_zero_copy) {
 +            monitor_printf(mon,
 +                           "Zero-copy-send fallbacks happened: %" PRIu64 " times\n",
 +                           info->ram->dirty_sync_missed_zero_copy);
 +        }
     }
     if (info->has_disk) {
 diff --git a/qapi/migration.json b/qapi/migration.json
 index c8ec260ab0..94bc5c69db 100644
 --- a/qapi/migration.json
 +++ b/qapi/migration.json
@@ -55,6 +55,10 @@
 # @postcopy-bytes: The number of bytes sent during the post-copy phase
 #                  (since 7.0).
 #
 +# @dirty-sync-missed-zero-copy: Number of times dirty RAM synchronization could
 +#                               not avoid copying dirty pages. This is between
 +#                               0 and @dirty-sync-count * @multifd-channels.
 +#                               (since 7.1)
 # Since: 0.14
 ##
 { 'struct': 'MigrationStats',
@@ -65,7 +69,8 @@
            'postcopy-requests' : 'int', 'page-size' : 'int',
            'multifd-bytes' : 'uint64', 'pages-per-second' : 'uint64',
            'precopy-bytes' : 'uint64', 'downtime-bytes' : 'uint64',
 -           'postcopy-bytes' : 'uint64' } }
 +           'postcopy-bytes' : 'uint64',
 +           'dirty-sync-missed-zero-copy' : 'uint64' } }
 ##
 # @XBZRLECacheStats:
 -- 
 2.31.1
--- a/SOURCES/kvm-Enable-SGX-RH-Only.patch
+++ b/SOURCES/kvm-Enable-SGX-RH-Only.patch
@ -0,0 +1,28 @@
 From db6e042fe4fdc1a1bbf562a46b15d4d8e33e2fa6 Mon Sep 17 00:00:00 2001
 From: Paul Lai <plai@redhat.com>
 Date: Tue, 25 Jan 2022 15:16:22 -0500
 Subject: [PATCH 4/7] Enable SGX  -- RH Only
 RH-Author: Paul Lai <None>
 RH-MergeRequest: 111: numa: Enable numa for SGX EPC sections
 RH-Commit: [4/5] cea874f29984897ef1232fb7749c13203c888034
 RH-Bugzilla: 1518984
 RH-Acked-by: Paolo Bonzini <None>
 RH-Acked-by: Bandan Das <None>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 ---
 configs/devices/x86_64-softmmu/x86_64-rh-devices.mak | 1 +
 1 file changed, 1 insertion(+)
 diff --git a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 index ddf036f042..fdbbdf9742 100644
 --- a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 +++ b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
@@ -102,3 +102,4 @@ CONFIG_TPM_CRB=y
 CONFIG_TPM_TIS_ISA=y
 CONFIG_TPM_EMULATOR=y
 CONFIG_TPM_PASSTHROUGH=y
 +CONFIG_SGX=y
 -- 
 2.27.0
--- a/SOURCES/kvm-Fix-thread-pool-size-default-value-in-the-man-page.patch
+++ b/SOURCES/kvm-Fix-thread-pool-size-default-value-in-the-man-page.patch
@ -0,0 +1,36 @@
 From a707eff49800045d07afbcd8a74617c50b960151 Mon Sep 17 00:00:00 2001
 From: German Maglione <gmaglione@redhat.com>
 Date: Thu, 10 Oct 2024 13:23:25 +0200
 Subject: [PATCH] Fix thread-pool-size default value in the man page
 RH-Author: German Maglione <None>
 RH-MergeRequest: 417: Fix thread-pool-size default value in the man page
 RH-Jira: RHEL-26197
 RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
 RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
 RH-Commit: [1/1] bdf22ed4600ac7f02a4b08c54f162b1f89c44a99
 The current --thread-pool-size default value is 0, let's reflect it
 in the man page.
 Signed-off-by: German Maglione <gmaglione@redhat.com>
 ---
 docs/tools/virtiofsd.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/docs/tools/virtiofsd.rst b/docs/tools/virtiofsd.rst
 index 07ac0be551..fb3d59c449 100644
 --- a/docs/tools/virtiofsd.rst
 +++ b/docs/tools/virtiofsd.rst
@@ -120,7 +120,7 @@ Options
 .. option:: --thread-pool-size=NUM
   Restrict the number of worker threads per request queue to NUM.  The default
 -  is 64.
 +  is 0.
 .. option:: --cache=none|auto|always
 -- 
 2.45.2
--- a/SOURCES/kvm-KVM-keep-track-of-running-ioctls.patch
+++ b/SOURCES/kvm-KVM-keep-track-of-running-ioctls.patch
@ -0,0 +1,82 @@
 From 9bacf8c4104ff3cff2e0e2c2179ec4fda633167f Mon Sep 17 00:00:00 2001
 From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date: Mon, 16 Jan 2023 07:51:08 -0500
 Subject: [PATCH 05/11] KVM: keep track of running ioctls
 RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-MergeRequest: 247: accel: introduce accelerator blocker API
 RH-Bugzilla: 2161188
 RH-Acked-by: David Hildenbrand <david@redhat.com>
 RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [2/3] 357508389e2a0fd996206b406e9e235e50b5f0b6
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2161188
 commit a27dd2de68f37ba96fe164a42121daa5f0750afc
 Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date:   Fri Nov 11 10:47:57 2022 -0500
    KVM: keep track of running ioctls
    Using the new accel-blocker API, mark where ioctls are being called
    in KVM. Next, we will implement the critical section that will take
    care of performing memslots modifications atomically, therefore
    preventing any new ioctl from running and allowing the running ones
    to finish.
    Signed-off-by: David Hildenbrand <david@redhat.com>
    Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
    Message-Id: <20221111154758.1372674-3-eesposit@redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 ---
 accel/kvm/kvm-all.c | 7 +++++++
 1 file changed, 7 insertions(+)
 diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
 index 8f2a53438f..221aadfda7 100644
 --- a/accel/kvm/kvm-all.c
 +++ b/accel/kvm/kvm-all.c
@@ -2337,6 +2337,7 @@ static int kvm_init(MachineState *ms)
     assert(TARGET_PAGE_SIZE <= qemu_real_host_page_size);
     s->sigmask_len = 8;
 +    accel_blocker_init();
 #ifdef KVM_CAP_SET_GUEST_DEBUG
     QTAILQ_INIT(&s->kvm_sw_breakpoints);
@@ -3018,7 +3019,9 @@ int kvm_vm_ioctl(KVMState *s, int type, ...)
     va_end(ap);
     trace_kvm_vm_ioctl(type, arg);
 +    accel_ioctl_begin();
     ret = ioctl(s->vmfd, type, arg);
 +    accel_ioctl_end();
     if (ret == -1) {
         ret = -errno;
     }
@@ -3036,7 +3039,9 @@ int kvm_vcpu_ioctl(CPUState *cpu, int type, ...)
     va_end(ap);
     trace_kvm_vcpu_ioctl(cpu->cpu_index, type, arg);
 +    accel_cpu_ioctl_begin(cpu);
     ret = ioctl(cpu->kvm_fd, type, arg);
 +    accel_cpu_ioctl_end(cpu);
     if (ret == -1) {
         ret = -errno;
     }
@@ -3054,7 +3059,9 @@ int kvm_device_ioctl(int fd, int type, ...)
     va_end(ap);
     trace_kvm_device_ioctl(fd, type, arg);
 +    accel_ioctl_begin();
     ret = ioctl(fd, type, arg);
 +    accel_ioctl_end();
     if (ret == -1) {
         ret = -errno;
     }
 -- 
 2.37.3
--- a/SOURCES/kvm-KVM-x86-workaround-invalid-CPUID-0xD-9-info-on-some-.patch
+++ b/SOURCES/kvm-KVM-x86-workaround-invalid-CPUID-0xD-9-info-on-some-.patch
@ -0,0 +1,109 @@
 From ea5299b5dde7d0b6b2f93cb646e6a24c9f105466 Mon Sep 17 00:00:00 2001
 From: Paolo Bonzini <pbonzini@redhat.com>
 Date: Wed, 23 Mar 2022 12:33:25 +0100
 Subject: [PATCH 13/24] KVM: x86: workaround invalid CPUID[0xD,9] info on some
 AMD processors
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Paul Lai <plai@redhat.com>
 RH-MergeRequest: 176: Enable KVM AMX support
 RH-Commit: [13/13] 38f147c911258e84e01336271ebd23a1c24371fc
 RH-Bugzilla: 1916415
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
 Some AMD processors expose the PKRU extended save state even if they do not have
 the related PKU feature in CPUID.  Worse, when they do they report a size of
 64, whereas the expected size of the PKRU extended save state is 8, therefore
 the esa->size == eax assertion does not hold.
 The state is already ignored by KVM_GET_SUPPORTED_CPUID because it
 was not enabled in the host XCR0.  However, QEMU kvm_cpu_xsave_init()
 runs before QEMU invokes arch_prctl() to enable dynamically-enabled
 save states such as XTILEDATA, and KVM_GET_SUPPORTED_CPUID hides save
 states that have yet to be enabled.  Therefore, kvm_cpu_xsave_init()
 needs to consult the host CPUID instead of KVM_GET_SUPPORTED_CPUID,
 and dies with an assertion failure.
 When setting up the ExtSaveArea array to match the host, ignore features that
 KVM does not report as supported.  This will cause QEMU to skip the incorrect
 CPUID leaf instead of tripping the assertion.
 Closes: https://gitlab.com/qemu-project/qemu/-/issues/916
 Reported-by: Daniel P. Berrangé <berrange@redhat.com>
 Analyzed-by: Yang Zhong <yang.zhong@intel.com>
 Reported-by: Peter Krempa <pkrempa@redhat.com>
 Tested-by: Daniel P. Berrangé <berrange@redhat.com>
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 (cherry picked from commit 58f7db26f21c690cf9a669c314cfd7371506084a)
 Signed-off-by: Paul Lai <plai@redhat.com>
 ---
 target/i386/cpu.c         |  4 ++--
 target/i386/cpu.h         |  2 ++
 target/i386/kvm/kvm-cpu.c | 19 ++++++++++++-------
 3 files changed, 16 insertions(+), 9 deletions(-)
 diff --git a/target/i386/cpu.c b/target/i386/cpu.c
 index 09e08f7f38..0543b846ff 100644
 --- a/target/i386/cpu.c
 +++ b/target/i386/cpu.c
@@ -4980,8 +4980,8 @@ CpuDefinitionInfoList *qmp_query_cpu_definitions(Error **errp)
     return cpu_list;
 }
 -static uint64_t x86_cpu_get_supported_feature_word(FeatureWord w,
 -                                                   bool migratable_only)
 +uint64_t x86_cpu_get_supported_feature_word(FeatureWord w,
 +                                            bool migratable_only)
 {
     FeatureWordInfo *wi = &feature_word_info[w];
     uint64_t r = 0;
 diff --git a/target/i386/cpu.h b/target/i386/cpu.h
 index 8ab2a4042a..006b735fe4 100644
 --- a/target/i386/cpu.h
 +++ b/target/i386/cpu.h
@@ -604,6 +604,8 @@ typedef enum FeatureWord {
 } FeatureWord;
 typedef uint64_t FeatureWordArray[FEATURE_WORDS];
 +uint64_t x86_cpu_get_supported_feature_word(FeatureWord w,
 +                                            bool migratable_only);
 /* cpuid_features bits */
 #define CPUID_FP87 (1U << 0)
 diff --git a/target/i386/kvm/kvm-cpu.c b/target/i386/kvm/kvm-cpu.c
 index bdc967c484..74c1396a93 100644
 --- a/target/i386/kvm/kvm-cpu.c
 +++ b/target/i386/kvm/kvm-cpu.c
@@ -99,13 +99,18 @@ static void kvm_cpu_xsave_init(void)
     for (i = XSTATE_SSE_BIT + 1; i < XSAVE_STATE_AREA_COUNT; i++) {
         ExtSaveArea *esa = &x86_ext_save_areas[i];
 -        if (esa->size) {
 -            host_cpuid(0xd, i, &eax, &ebx, &ecx, &edx);
 -            if (eax != 0) {
 -                assert(esa->size == eax);
 -                esa->offset = ebx;
 -                esa->ecx = ecx;
 -            }
 +        if (!esa->size) {
 +            continue;
 +        }
 +        if ((x86_cpu_get_supported_feature_word(esa->feature, false) & esa->bits)
 +            != esa->bits) {
 +            continue;
 +        }
 +        host_cpuid(0xd, i, &eax, &ebx, &ecx, &edx);
 +        if (eax != 0) {
 +            assert(esa->size == eax);
 +            esa->offset = ebx;
 +            esa->ecx = ecx;
         }
     }
 }
 -- 
 2.35.3
--- a/SOURCES/kvm-MAINTAINERS-split-out-s390x-sections.patch
+++ b/SOURCES/kvm-MAINTAINERS-split-out-s390x-sections.patch
@ -0,0 +1,181 @@
 From 440ee491240f2f02f9a6082d8aad98d88c1039dd Mon Sep 17 00:00:00 2001
 From: Thomas Huth <thuth@redhat.com>
 Date: Mon, 15 Jan 2024 14:00:04 +0100
 Subject: [PATCH 1/5] MAINTAINERS: split out s390x sections
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Thomas Huth <thuth@redhat.com>
 RH-MergeRequest: 348: s390x: Provide some more useful information if decryption of a PV image fails
 RH-Jira: RHEL-18214
 RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
 RH-Acked-by: Cédric Le Goater <clg@redhat.com>
 RH-Commit: [1/5] a71a3c11922481f97c36570e361088d17474e481
 JIRA: https://issues.redhat.com/browse/RHEL-18214
 commit 56e34834029c7c6862cb0095d95ad83c50485f88
 Author: Cornelia Huck <cohuck@redhat.com>
 Date:   Wed Dec 22 11:55:48 2021 +0100
    MAINTAINERS: split out s390x sections
    Split out some more specialized devices etc., so that we can build
    smarter lists of people to be put on cc: in the future.
    Signed-off-by: Cornelia Huck <cohuck@redhat.com>
    Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
    Acked-by: David Hildenbrand <david@redhat.com>
    Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
    Acked-by: Thomas Huth <thuth@redhat.com>
    Acked-by: Halil Pasic <pasic@linux.ibm.com>
    Acked-by: Eric Farman <farman@linux.ibm.com>
    Message-Id: <20211222105548.356852-1-cohuck@redhat.com>
    Signed-off-by: Thomas Huth <thuth@redhat.com>
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 ---
 MAINTAINERS | 85 ++++++++++++++++++++++++++++++++++++++++++++++-------
 1 file changed, 74 insertions(+), 11 deletions(-)
 diff --git a/MAINTAINERS b/MAINTAINERS
 index 7543eb4d59..b893206fc3 100644
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
@@ -297,7 +297,6 @@ M: David Hildenbrand <david@redhat.com>
 S: Maintained
 F: target/s390x/
 F: target/s390x/tcg
 -F: target/s390x/cpu_models_*.[ch]
 F: hw/s390x/
 F: disas/s390.c
 F: tests/tcg/s390x/
@@ -396,16 +395,10 @@ M: Halil Pasic <pasic@linux.ibm.com>
 M: Christian Borntraeger <borntraeger@de.ibm.com>
 S: Supported
 F: target/s390x/kvm/
 -F: target/s390x/ioinst.[ch]
 F: target/s390x/machine.c
 F: target/s390x/sigp.c
 -F: target/s390x/cpu_features*.[ch]
 -F: target/s390x/cpu_models.[ch]
 F: hw/s390x/pv.c
 F: include/hw/s390x/pv.h
 -F: hw/intc/s390_flic.c
 -F: hw/intc/s390_flic_kvm.c
 -F: include/hw/s390x/s390_flic.h
 F: gdb-xml/s390*.xml
 T: git https://github.com/borntraeger/qemu.git s390-next
 L: qemu-s390x@nongnu.org
@@ -1529,12 +1522,8 @@ S390 Virtio-ccw
 M: Halil Pasic <pasic@linux.ibm.com>
 M: Christian Borntraeger <borntraeger@de.ibm.com>
 S: Supported
 -F: hw/char/sclp*.[hc]
 -F: hw/char/terminal3270.c
 F: hw/s390x/
 F: include/hw/s390x/
 -F: hw/watchdog/wdt_diag288.c
 -F: include/hw/watchdog/wdt_diag288.h
 F: configs/devices/s390x-softmmu/default.mak
 F: tests/avocado/machine_s390_ccw_virtio.py
 T: git https://github.com/borntraeger/qemu.git s390-next
@@ -1559,6 +1548,37 @@ F: hw/s390x/s390-pci*
 F: include/hw/s390x/s390-pci*
 L: qemu-s390x@nongnu.org
 +S390 channel subsystem
 +M: Halil Pasic <pasic@linux.ibm.com>
 +M: Christian Borntraeger <borntraeger@linux.ibm.com>
 +S: Supported
 +F: hw/s390x/ccw-device.[ch]
 +F: hw/s390x/css.c
 +F: hw/s390x/css-bridge.c
 +F: include/hw/s390x/css.h
 +F: include/hw/s390x/css-bridge.h
 +F: include/hw/s390x/ioinst.h
 +F: target/s390x/ioinst.c
 +L: qemu-s390x@nongnu.org
 +
 +S390 CPU models
 +M: David Hildenbrand <david@redhat.com>
 +S: Maintained
 +F: target/s390x/cpu_features*.[ch]
 +F: target/s390x/cpu_models.[ch]
 +L: qemu-s390x@nongnu.org
 +
 +S390 SCLP-backed devices
 +M: Halil Pasic <pasic@linux.ibm.com>
 +M: Christian Borntraeger <borntraeger@linux.ibm.com>
 +S: Supported
 +F: include/hw/s390x/event-facility.h
 +F: include/hw/s390x/sclp.h
 +F: hw/char/sclp*.[hc]
 +F: hw/s390x/event-facility.c
 +F: hw/s390x/sclp*.c
 +L: qemu-s390x@nongnu.org
 +
 X86 Machines
 ------------
 PC
@@ -1956,6 +1976,7 @@ M: Halil Pasic <pasic@linux.ibm.com>
 S: Supported
 F: hw/s390x/virtio-ccw*.[hc]
 F: hw/s390x/vhost-vsock-ccw.c
 +F: hw/s390x/vhost-user-fs-ccw.c
 T: git https://gitlab.com/cohuck/qemu.git s390-next
 T: git https://github.com/borntraeger/qemu.git s390-next
 L: qemu-s390x@nongnu.org
@@ -2294,6 +2315,48 @@ F: hw/timer/mips_gictimer.c
 F: include/hw/intc/mips_gic.h
 F: include/hw/timer/mips_gictimer.h
 +S390 3270 device
 +M: Halil Pasic <pasic@linux.ibm.com>
 +M: Christian Borntraeger <borntraeger@linux.ibm.com>
 +S: Odd fixes
 +F: include/hw/s390x/3270-ccw.h
 +F: hw/char/terminal3270.c
 +F: hw/s390x/3270-ccw.c
 +L: qemu-s390x@nongnu.org
 +
 +S390 diag 288 watchdog
 +M: Halil Pasic <pasic@linux.ibm.com>
 +M: Christian Borntraeger <borntraeger@linux.ibm.com>
 +S: Supported
 +F: hw/watchdog/wdt_diag288.c
 +F: include/hw/watchdog/wdt_diag288.h
 +L: qemu-s390x@nongnu.org
 +
 +S390 storage key device
 +M: Halil Pasic <pasic@linux.ibm.com>
 +M: Christian Borntraeger <borntraeger@linux.ibm.com>
 +S: Supported
 +F: hw/s390x/storage-keys.h
 +F: hw/390x/s390-skeys*.c
 +L: qemu-s390x@nongnu.org
 +
 +S390 storage attribute device
 +M: Halil Pasic <pasic@linux.ibm.com>
 +M: Christian Borntraeger <borntraeger@linux.ibm.com>
 +S: Supported
 +F: hw/s390x/storage-attributes.h
 +F: hw/s390/s390-stattrib*.c
 +L: qemu-s390x@nongnu.org
 +
 +S390 floating interrupt controller
 +M: Halil Pasic <pasic@linux.ibm.com>
 +M: Christian Borntraeger <borntraeger@linux.ibm.com>
 +M: David Hildenbrand <david@redhat.com>
 +S: Supported
 +F: hw/intc/s390_flic*.c
 +F: include/hw/s390x/s390_flic.h
 +L: qemu-s390x@nongnu.org
 +
 Subsystems
 ----------
 Overall Audio backends
 -- 
 2.41.0
--- a/SOURCES/kvm-QIOChannel-Add-flags-on-io_writev-and-introduce-io_f.patch
+++ b/SOURCES/kvm-QIOChannel-Add-flags-on-io_writev-and-introduce-io_f.patch
@ -0,0 +1,420 @@
 From 7eeec7c008e947bc3e1fed682791092b408852c6 Mon Sep 17 00:00:00 2001
 From: Leonardo Bras <leobras@redhat.com>
 Date: Wed, 18 May 2022 02:52:24 -0300
 Subject: [PATCH 17/37] QIOChannel: Add flags on io_writev and introduce
 io_flush callback
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Leonardo Brás <leobras@redhat.com>
 RH-MergeRequest: 191: MSG_ZEROCOPY + Multifd @ rhel8.7
 RH-Commit: [17/26] 7bde4e79fd3f76a6cc84d9cacf50420584ddd35c
 RH-Bugzilla: 2072049
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Add flags to io_writev and introduce io_flush as optional callback to
 QIOChannelClass, allowing the implementation of zero copy writes by
 subclasses.
 How to use them:
 - Write data using qio_channel_writev*(...,QIO_CHANNEL_WRITE_FLAG_ZERO_COPY),
 - Wait write completion with qio_channel_flush().
 Notes:
 As some zero copy write implementations work asynchronously, it's
 recommended to keep the write buffer untouched until the return of
 qio_channel_flush(), to avoid the risk of sending an updated buffer
 instead of the buffer state during write.
 As io_flush callback is optional, if a subclass does not implement it, then:
 - io_flush will return 0 without changing anything.
 Also, some functions like qio_channel_writev_full_all() were adapted to
 receive a flag parameter. That allows shared code between zero copy and
 non-zero copy writev, and also an easier implementation on new flags.
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 Reviewed-by: Peter Xu <peterx@redhat.com>
 Reviewed-by: Juan Quintela <quintela@redhat.com>
 Message-Id: <20220513062836.965425-3-leobras@redhat.com>
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 (cherry picked from commit b88651cb4d4fa416fdbb6afaf5b26ec8c035eaad)
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 ---
 chardev/char-io.c                   |  2 +-
 hw/remote/mpqemu-link.c             |  2 +-
 include/io/channel.h                | 38 +++++++++++++++++++++-
 io/channel-buffer.c                 |  1 +
 io/channel-command.c                |  1 +
 io/channel-file.c                   |  1 +
 io/channel-socket.c                 |  2 ++
 io/channel-tls.c                    |  1 +
 io/channel-websock.c                |  1 +
 io/channel.c                        | 49 +++++++++++++++++++++++------
 migration/rdma.c                    |  1 +
 scsi/pr-manager-helper.c            |  2 +-
 tests/unit/test-io-channel-socket.c |  1 +
 13 files changed, 88 insertions(+), 14 deletions(-)
 diff --git a/chardev/char-io.c b/chardev/char-io.c
 index 8ced184160..4451128cba 100644
 --- a/chardev/char-io.c
 +++ b/chardev/char-io.c
@@ -122,7 +122,7 @@ int io_channel_send_full(QIOChannel *ioc,
         ret = qio_channel_writev_full(
             ioc, &iov, 1,
 -            fds, nfds, NULL);
 +            fds, nfds, 0, NULL);
         if (ret == QIO_CHANNEL_ERR_BLOCK) {
             if (offset) {
                 return offset;
 diff --git a/hw/remote/mpqemu-link.c b/hw/remote/mpqemu-link.c
 index 7e841820e5..e8f556bd27 100644
 --- a/hw/remote/mpqemu-link.c
 +++ b/hw/remote/mpqemu-link.c
@@ -69,7 +69,7 @@ bool mpqemu_msg_send(MPQemuMsg *msg, QIOChannel *ioc, Error **errp)
     }
     if (!qio_channel_writev_full_all(ioc, send, G_N_ELEMENTS(send),
 -                                    fds, nfds, errp)) {
 +                                    fds, nfds, 0, errp)) {
         ret = true;
     } else {
         trace_mpqemu_send_io_error(msg->cmd, msg->size, nfds);
 diff --git a/include/io/channel.h b/include/io/channel.h
 index 88988979f8..c680ee7480 100644
 --- a/include/io/channel.h
 +++ b/include/io/channel.h
@@ -32,12 +32,15 @@ OBJECT_DECLARE_TYPE(QIOChannel, QIOChannelClass,
 #define QIO_CHANNEL_ERR_BLOCK -2
 +#define QIO_CHANNEL_WRITE_FLAG_ZERO_COPY 0x1
 +
 typedef enum QIOChannelFeature QIOChannelFeature;
 enum QIOChannelFeature {
     QIO_CHANNEL_FEATURE_FD_PASS,
     QIO_CHANNEL_FEATURE_SHUTDOWN,
     QIO_CHANNEL_FEATURE_LISTEN,
 +    QIO_CHANNEL_FEATURE_WRITE_ZERO_COPY,
 };
@@ -104,6 +107,7 @@ struct QIOChannelClass {
                          size_t niov,
                          int *fds,
                          size_t nfds,
 +                         int flags,
                          Error **errp);
     ssize_t (*io_readv)(QIOChannel *ioc,
                         const struct iovec *iov,
@@ -136,6 +140,8 @@ struct QIOChannelClass {
                                   IOHandler *io_read,
                                   IOHandler *io_write,
                                   void *opaque);
 +    int (*io_flush)(QIOChannel *ioc,
 +                    Error **errp);
 };
 /* General I/O handling functions */
@@ -228,6 +234,7 @@ ssize_t qio_channel_readv_full(QIOChannel *ioc,
  * @niov: the length of the @iov array
  * @fds: an array of file handles to send
  * @nfds: number of file handles in @fds
 + * @flags: write flags (QIO_CHANNEL_WRITE_FLAG_*)
  * @errp: pointer to a NULL-initialized error object
  *
  * Write data to the IO channel, reading it from the
@@ -260,6 +267,7 @@ ssize_t qio_channel_writev_full(QIOChannel *ioc,
                                 size_t niov,
                                 int *fds,
                                 size_t nfds,
 +                                int flags,
                                 Error **errp);
 /**
@@ -837,6 +845,7 @@ int qio_channel_readv_full_all(QIOChannel *ioc,
  * @niov: the length of the @iov array
  * @fds: an array of file handles to send
  * @nfds: number of file handles in @fds
 + * @flags: write flags (QIO_CHANNEL_WRITE_FLAG_*)
  * @errp: pointer to a NULL-initialized error object
  *
  *
@@ -846,6 +855,14 @@ int qio_channel_readv_full_all(QIOChannel *ioc,
  * to be written, yielding from the current coroutine
  * if required.
  *
 + * If QIO_CHANNEL_WRITE_FLAG_ZERO_COPY is passed in flags,
 + * instead of waiting for all requested data to be written,
 + * this function will wait until it's all queued for writing.
 + * In this case, if the buffer gets changed between queueing and
 + * sending, the updated buffer will be sent. If this is not a
 + * desired behavior, it's suggested to call qio_channel_flush()
 + * before reusing the buffer.
 + *
  * Returns: 0 if all bytes were written, or -1 on error
  */
@@ -853,6 +870,25 @@ int qio_channel_writev_full_all(QIOChannel *ioc,
                                 const struct iovec *iov,
                                 size_t niov,
                                 int *fds, size_t nfds,
 -                                Error **errp);
 +                                int flags, Error **errp);
 +
 +/**
 + * qio_channel_flush:
 + * @ioc: the channel object
 + * @errp: pointer to a NULL-initialized error object
 + *
 + * Will block until every packet queued with
 + * qio_channel_writev_full() + QIO_CHANNEL_WRITE_FLAG_ZERO_COPY
 + * is sent, or return in case of any error.
 + *
 + * If not implemented, acts as a no-op, and returns 0.
 + *
 + * Returns -1 if any error is found,
 + *          1 if every send failed to use zero copy.
 + *          0 otherwise.
 + */
 +
 +int qio_channel_flush(QIOChannel *ioc,
 +                      Error **errp);
 #endif /* QIO_CHANNEL_H */
 diff --git a/io/channel-buffer.c b/io/channel-buffer.c
 index baa4e2b089..bf52011be2 100644
 --- a/io/channel-buffer.c
 +++ b/io/channel-buffer.c
@@ -81,6 +81,7 @@ static ssize_t qio_channel_buffer_writev(QIOChannel *ioc,
                                          size_t niov,
                                          int *fds,
                                          size_t nfds,
 +                                         int flags,
                                          Error **errp)
 {
     QIOChannelBuffer *bioc = QIO_CHANNEL_BUFFER(ioc);
 diff --git a/io/channel-command.c b/io/channel-command.c
 index b2a9e27138..5ff1691bad 100644
 --- a/io/channel-command.c
 +++ b/io/channel-command.c
@@ -258,6 +258,7 @@ static ssize_t qio_channel_command_writev(QIOChannel *ioc,
                                           size_t niov,
                                           int *fds,
                                           size_t nfds,
 +                                          int flags,
                                           Error **errp)
 {
     QIOChannelCommand *cioc = QIO_CHANNEL_COMMAND(ioc);
 diff --git a/io/channel-file.c b/io/channel-file.c
 index c4bf799a80..348a48545e 100644
 --- a/io/channel-file.c
 +++ b/io/channel-file.c
@@ -114,6 +114,7 @@ static ssize_t qio_channel_file_writev(QIOChannel *ioc,
                                        size_t niov,
                                        int *fds,
                                        size_t nfds,
 +                                       int flags,
                                        Error **errp)
 {
     QIOChannelFile *fioc = QIO_CHANNEL_FILE(ioc);
 diff --git a/io/channel-socket.c b/io/channel-socket.c
 index 606ec97cf7..bfbd64787e 100644
 --- a/io/channel-socket.c
 +++ b/io/channel-socket.c
@@ -525,6 +525,7 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
                                          size_t niov,
                                          int *fds,
                                          size_t nfds,
 +                                         int flags,
                                          Error **errp)
 {
     QIOChannelSocket *sioc = QIO_CHANNEL_SOCKET(ioc);
@@ -620,6 +621,7 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
                                          size_t niov,
                                          int *fds,
                                          size_t nfds,
 +                                         int flags,
                                          Error **errp)
 {
     QIOChannelSocket *sioc = QIO_CHANNEL_SOCKET(ioc);
 diff --git a/io/channel-tls.c b/io/channel-tls.c
 index 2ae1b92fc0..4ce890a538 100644
 --- a/io/channel-tls.c
 +++ b/io/channel-tls.c
@@ -301,6 +301,7 @@ static ssize_t qio_channel_tls_writev(QIOChannel *ioc,
                                       size_t niov,
                                       int *fds,
                                       size_t nfds,
 +                                      int flags,
                                       Error **errp)
 {
     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
 diff --git a/io/channel-websock.c b/io/channel-websock.c
 index 70889bb54d..035dd6075b 100644
 --- a/io/channel-websock.c
 +++ b/io/channel-websock.c
@@ -1127,6 +1127,7 @@ static ssize_t qio_channel_websock_writev(QIOChannel *ioc,
                                           size_t niov,
                                           int *fds,
                                           size_t nfds,
 +                                          int flags,
                                           Error **errp)
 {
     QIOChannelWebsock *wioc = QIO_CHANNEL_WEBSOCK(ioc);
 diff --git a/io/channel.c b/io/channel.c
 index e8b019dc36..0640941ac5 100644
 --- a/io/channel.c
 +++ b/io/channel.c
@@ -72,18 +72,32 @@ ssize_t qio_channel_writev_full(QIOChannel *ioc,
                                 size_t niov,
                                 int *fds,
                                 size_t nfds,
 +                                int flags,
                                 Error **errp)
 {
     QIOChannelClass *klass = QIO_CHANNEL_GET_CLASS(ioc);
 -    if ((fds || nfds) &&
 -        !qio_channel_has_feature(ioc, QIO_CHANNEL_FEATURE_FD_PASS)) {
 +    if (fds || nfds) {
 +        if (!qio_channel_has_feature(ioc, QIO_CHANNEL_FEATURE_FD_PASS)) {
 +            error_setg_errno(errp, EINVAL,
 +                             "Channel does not support file descriptor passing");
 +            return -1;
 +        }
 +        if (flags & QIO_CHANNEL_WRITE_FLAG_ZERO_COPY) {
 +            error_setg_errno(errp, EINVAL,
 +                             "Zero Copy does not support file descriptor passing");
 +            return -1;
 +        }
 +    }
 +
 +    if ((flags & QIO_CHANNEL_WRITE_FLAG_ZERO_COPY) &&
 +        !qio_channel_has_feature(ioc, QIO_CHANNEL_FEATURE_WRITE_ZERO_COPY)) {
         error_setg_errno(errp, EINVAL,
 -                         "Channel does not support file descriptor passing");
 +                         "Requested Zero Copy feature is not available");
         return -1;
     }
 -    return klass->io_writev(ioc, iov, niov, fds, nfds, errp);
 +    return klass->io_writev(ioc, iov, niov, fds, nfds, flags, errp);
 }
@@ -217,14 +231,14 @@ int qio_channel_writev_all(QIOChannel *ioc,
                            size_t niov,
                            Error **errp)
 {
 -    return qio_channel_writev_full_all(ioc, iov, niov, NULL, 0, errp);
 +    return qio_channel_writev_full_all(ioc, iov, niov, NULL, 0, 0, errp);
 }
 int qio_channel_writev_full_all(QIOChannel *ioc,
                                 const struct iovec *iov,
                                 size_t niov,
                                 int *fds, size_t nfds,
 -                                Error **errp)
 +                                int flags, Error **errp)
 {
     int ret = -1;
     struct iovec *local_iov = g_new(struct iovec, niov);
@@ -237,8 +251,10 @@ int qio_channel_writev_full_all(QIOChannel *ioc,
     while (nlocal_iov > 0) {
         ssize_t len;
 -        len = qio_channel_writev_full(ioc, local_iov, nlocal_iov, fds, nfds,
 -                                      errp);
 +
 +        len = qio_channel_writev_full(ioc, local_iov, nlocal_iov, fds,
 +                                            nfds, flags, errp);
 +
         if (len == QIO_CHANNEL_ERR_BLOCK) {
             if (qemu_in_coroutine()) {
                 qio_channel_yield(ioc, G_IO_OUT);
@@ -277,7 +293,7 @@ ssize_t qio_channel_writev(QIOChannel *ioc,
                            size_t niov,
                            Error **errp)
 {
 -    return qio_channel_writev_full(ioc, iov, niov, NULL, 0, errp);
 +    return qio_channel_writev_full(ioc, iov, niov, NULL, 0, 0, errp);
 }
@@ -297,7 +313,7 @@ ssize_t qio_channel_write(QIOChannel *ioc,
                           Error **errp)
 {
     struct iovec iov = { .iov_base = (char *)buf, .iov_len = buflen };
 -    return qio_channel_writev_full(ioc, &iov, 1, NULL, 0, errp);
 +    return qio_channel_writev_full(ioc, &iov, 1, NULL, 0, 0, errp);
 }
@@ -473,6 +489,19 @@ off_t qio_channel_io_seek(QIOChannel *ioc,
     return klass->io_seek(ioc, offset, whence, errp);
 }
 +int qio_channel_flush(QIOChannel *ioc,
 +                                Error **errp)
 +{
 +    QIOChannelClass *klass = QIO_CHANNEL_GET_CLASS(ioc);
 +
 +    if (!klass->io_flush ||
 +        !qio_channel_has_feature(ioc, QIO_CHANNEL_FEATURE_WRITE_ZERO_COPY)) {
 +        return 0;
 +    }
 +
 +    return klass->io_flush(ioc, errp);
 +}
 +
 static void qio_channel_restart_read(void *opaque)
 {
 diff --git a/migration/rdma.c b/migration/rdma.c
 index f5d3bbe7e9..54acd2000e 100644
 --- a/migration/rdma.c
 +++ b/migration/rdma.c
@@ -2833,6 +2833,7 @@ static ssize_t qio_channel_rdma_writev(QIOChannel *ioc,
                                        size_t niov,
                                        int *fds,
                                        size_t nfds,
 +                                       int flags,
                                        Error **errp)
 {
     QIOChannelRDMA *rioc = QIO_CHANNEL_RDMA(ioc);
 diff --git a/scsi/pr-manager-helper.c b/scsi/pr-manager-helper.c
 index 451c7631b7..3be52a98d5 100644
 --- a/scsi/pr-manager-helper.c
 +++ b/scsi/pr-manager-helper.c
@@ -77,7 +77,7 @@ static int pr_manager_helper_write(PRManagerHelper *pr_mgr,
         iov.iov_base = (void *)buf;
         iov.iov_len = sz;
         n_written = qio_channel_writev_full(QIO_CHANNEL(pr_mgr->ioc), &iov, 1,
 -                                            nfds ? &fd : NULL, nfds, errp);
 +                                            nfds ? &fd : NULL, nfds, 0, errp);
         if (n_written <= 0) {
             assert(n_written != QIO_CHANNEL_ERR_BLOCK);
 diff --git a/tests/unit/test-io-channel-socket.c b/tests/unit/test-io-channel-socket.c
 index c49eec1f03..6713886d02 100644
 --- a/tests/unit/test-io-channel-socket.c
 +++ b/tests/unit/test-io-channel-socket.c
@@ -444,6 +444,7 @@ static void test_io_channel_unix_fd_pass(void)
                             G_N_ELEMENTS(iosend),
                             fdsend,
                             G_N_ELEMENTS(fdsend),
 +                            0,
                             &error_abort);
     qio_channel_readv_full(dst,
 -- 
 2.35.3
--- a/SOURCES/kvm-QIOChannelSocket-Add-support-for-MSG_ZEROCOPY-IPV6.patch
+++ b/SOURCES/kvm-QIOChannelSocket-Add-support-for-MSG_ZEROCOPY-IPV6.patch
@ -0,0 +1,56 @@
 From a6c4aed18a027ce8e107fdf9184e9ea43a86f843 Mon Sep 17 00:00:00 2001
 From: Leonardo Bras <leobras@redhat.com>
 Date: Thu, 4 Aug 2022 04:10:43 -0300
 Subject: [PATCH 8/9] QIOChannelSocket: Add support for MSG_ZEROCOPY + IPV6
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Leonardo Brás <leobras@redhat.com>
 RH-MergeRequest: 201: Zero-copy-send fixes + improvements
 RH-Commit: [8/8] 6e26ee7c9ebaedb07623313cb0678816867751dd
 RH-Bugzilla: 2110203
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 For using MSG_ZEROCOPY, there are two steps:
 1 - io_writev() the packet, which enqueues the packet for sending, and
 2 - io_flush(), which gets confirmation that all packets got correctly sent
 Currently, if MSG_ZEROCOPY is used to send packets over IPV6, no error will
 be reported in (1), but it will fail in the first time (2) happens.
 This happens because (2) currently checks for cmsg_level & cmsg_type
 associated with IPV4 only, before reporting any error.
 Add checks for cmsg_level & cmsg_type associated with IPV6, and thus enable
 support for MSG_ZEROCOPY + IPV6
 Fixes: 2bc58ffc29 ("QIOChannelSocket: Implement io_writev zero copy flag & io_flush for CONFIG_LINUX")
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
 (cherry picked from commit 5258a7e2c0677d16e9e1d06845f60171adf0b290)
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 ---
 io/channel-socket.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/io/channel-socket.c b/io/channel-socket.c
 index cf0d67c51b..6010ad7017 100644
 --- a/io/channel-socket.c
 +++ b/io/channel-socket.c
@@ -747,8 +747,8 @@ static int qio_channel_socket_flush(QIOChannel *ioc,
         }
         cm = CMSG_FIRSTHDR(&msg);
 -        if (cm->cmsg_level != SOL_IP &&
 -            cm->cmsg_type != IP_RECVERR) {
 +        if (cm->cmsg_level != SOL_IP   && cm->cmsg_type != IP_RECVERR &&
 +            cm->cmsg_level != SOL_IPV6 && cm->cmsg_type != IPV6_RECVERR) {
             error_setg_errno(errp, EPROTOTYPE,
                              "Wrong cmsg in errqueue");
             return -1;
 -- 
 2.31.1
--- a/SOURCES/kvm-QIOChannelSocket-Fix-zero-copy-flush-returning-code-.patch
+++ b/SOURCES/kvm-QIOChannelSocket-Fix-zero-copy-flush-returning-code-.patch
@ -0,0 +1,65 @@
 From 905cc8032fc63619efb3f0a8c9754b7190bcc43a Mon Sep 17 00:00:00 2001
 From: Leonardo Bras <leobras@redhat.com>
 Date: Mon, 11 Jul 2022 18:11:11 -0300
 Subject: [PATCH 3/9] QIOChannelSocket: Fix zero-copy flush returning code 1
 when nothing sent
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Leonardo Brás <leobras@redhat.com>
 RH-MergeRequest: 201: Zero-copy-send fixes + improvements
 RH-Commit: [3/8] 1ad707702fa26cd4d0fa1870c21f5f26ae93ff97
 RH-Bugzilla: 2110203
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 If flush is called when no buffer was sent with MSG_ZEROCOPY, it currently
 returns 1. This return code should be used only when Linux fails to use
 MSG_ZEROCOPY on a lot of sendmsg().
 Fix this by returning early from flush if no sendmsg(...,MSG_ZEROCOPY)
 was attempted.
 Fixes: 2bc58ffc2926 ("QIOChannelSocket: Implement io_writev zero copy flag & io_flush for CONFIG_LINUX")
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 Acked-by: Daniel P. Berrangé <berrange@redhat.com>
 Reviewed-by: Juan Quintela <quintela@redhat.com>
 Reviewed-by: Peter Xu <peterx@redhat.com>
 Message-Id: <20220711211112.18951-2-leobras@redhat.com>
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 (cherry picked from commit 927f93e099c4f9184e60a1bc61624ac2d04d0223)
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 ---
 io/channel-socket.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)
 diff --git a/io/channel-socket.c b/io/channel-socket.c
 index df858da924..cf0d67c51b 100644
 --- a/io/channel-socket.c
 +++ b/io/channel-socket.c
@@ -717,12 +717,18 @@ static int qio_channel_socket_flush(QIOChannel *ioc,
     struct cmsghdr *cm;
     char control[CMSG_SPACE(sizeof(*serr))];
     int received;
 -    int ret = 1;
 +    int ret;
 +
 +    if (sioc->zero_copy_queued == sioc->zero_copy_sent) {
 +        return 0;
 +    }
     msg.msg_control = control;
     msg.msg_controllen = sizeof(control);
     memset(control, 0, sizeof(control));
 +    ret = 1;
 +
     while (sioc->zero_copy_sent < sioc->zero_copy_queued) {
         received = recvmsg(sioc->fd, &msg, MSG_ERRQUEUE);
         if (received < 0) {
 -- 
 2.31.1
--- a/SOURCES/kvm-QIOChannelSocket-Fix-zero-copy-send-so-socket-flush-.patch
+++ b/SOURCES/kvm-QIOChannelSocket-Fix-zero-copy-send-so-socket-flush-.patch
@ -0,0 +1,58 @@
 From c1fd32d93ae42fcf3c1a25f4d56e669f251087d8 Mon Sep 17 00:00:00 2001
 From: Leonardo Bras <leobras@redhat.com>
 Date: Mon, 20 Jun 2022 02:39:43 -0300
 Subject: [PATCH 25/37] QIOChannelSocket: Fix zero-copy send so socket flush
 works
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Leonardo Brás <leobras@redhat.com>
 RH-MergeRequest: 191: MSG_ZEROCOPY + Multifd @ rhel8.7
 RH-Commit: [25/26] 3ede94f3269e21c3ace073ed1a6f24696315bcbb
 RH-Bugzilla: 2072049
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Somewhere between v6 and v7 the of the zero-copy-send patchset a crucial
 part of the flushing mechanism got missing: incrementing zero_copy_queued.
 Without that, the flushing interface becomes a no-op, and there is no
 guarantee the buffer is really sent.
 This can go as bad as causing a corruption in RAM during migration.
 Fixes: 2bc58ffc2926 ("QIOChannelSocket: Implement io_writev zero copy flag & io_flush for CONFIG_LINUX")
 Reported-by: 徐闯 <xuchuangxclwt@bytedance.com>
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 Reviewed-by: Peter Xu <peterx@redhat.com>
 Reviewed-by: Juan Quintela <quintela@redhat.com>
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 (cherry picked from commit 4f5a09714c983a3471fd12e3c7f3196e95c650c1)
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 ---
 io/channel-socket.c | 5 +++++
 1 file changed, 5 insertions(+)
 diff --git a/io/channel-socket.c b/io/channel-socket.c
 index 7d37b39de7..df858da924 100644
 --- a/io/channel-socket.c
 +++ b/io/channel-socket.c
@@ -612,6 +612,11 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
                          "Unable to write to socket");
         return -1;
     }
 +
 +    if (flags & QIO_CHANNEL_WRITE_FLAG_ZERO_COPY) {
 +        sioc->zero_copy_queued++;
 +    }
 +
     return ret;
 }
 #else /* WIN32 */
 -- 
 2.35.3
--- a/SOURCES/kvm-QIOChannelSocket-Implement-io_writev-zero-copy-flag-.patch
+++ b/SOURCES/kvm-QIOChannelSocket-Implement-io_writev-zero-copy-flag-.patch
@ -0,0 +1,249 @@
 From 5fd7af93a06adaddbae719aabbaf912159f4fb28 Mon Sep 17 00:00:00 2001
 From: Leonardo Bras <leobras@redhat.com>
 Date: Wed, 18 May 2022 02:52:25 -0300
 Subject: [PATCH 18/37] QIOChannelSocket: Implement io_writev zero copy flag &
 io_flush for CONFIG_LINUX
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Leonardo Brás <leobras@redhat.com>
 RH-MergeRequest: 191: MSG_ZEROCOPY + Multifd @ rhel8.7
 RH-Commit: [18/26] 6f65c8c879a5df57213b541d58285b65178f8547
 RH-Bugzilla: 2072049
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 For CONFIG_LINUX, implement the new zero copy flag and the optional callback
 io_flush on QIOChannelSocket, but enables it only when MSG_ZEROCOPY
 feature is available in the host kernel, which is checked on
 qio_channel_socket_connect_sync()
 qio_channel_socket_flush() was implemented by counting how many times
 sendmsg(...,MSG_ZEROCOPY) was successfully called, and then reading the
 socket's error queue, in order to find how many of them finished sending.
 Flush will loop until those counters are the same, or until some error occurs.
 Notes on using writev() with QIO_CHANNEL_WRITE_FLAG_ZERO_COPY:
 1: Buffer
 - As MSG_ZEROCOPY tells the kernel to use the same user buffer to avoid copying,
 some caution is necessary to avoid overwriting any buffer before it's sent.
 If something like this happen, a newer version of the buffer may be sent instead.
 - If this is a problem, it's recommended to call qio_channel_flush() before freeing
 or re-using the buffer.
 2: Locked memory
 - When using MSG_ZERCOCOPY, the buffer memory will be locked after queued, and
 unlocked after it's sent.
 - Depending on the size of each buffer, and how often it's sent, it may require
 a larger amount of locked memory than usually available to non-root user.
 - If the required amount of locked memory is not available, writev_zero_copy
 will return an error, which can abort an operation like migration,
 - Because of this, when an user code wants to add zero copy as a feature, it
 requires a mechanism to disable it, so it can still be accessible to less
 privileged users.
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 Reviewed-by: Peter Xu <peterx@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 Reviewed-by: Juan Quintela <quintela@redhat.com>
 Message-Id: <20220513062836.965425-4-leobras@redhat.com>
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 (cherry picked from commit 2bc58ffc2926a4efdd03edfb5909861fefc68c3d)
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 ---
 include/io/channel-socket.h |   2 +
 io/channel-socket.c         | 116 ++++++++++++++++++++++++++++++++++--
 2 files changed, 114 insertions(+), 4 deletions(-)
 diff --git a/include/io/channel-socket.h b/include/io/channel-socket.h
 index e747e63514..513c428fe4 100644
 --- a/include/io/channel-socket.h
 +++ b/include/io/channel-socket.h
@@ -47,6 +47,8 @@ struct QIOChannelSocket {
     socklen_t localAddrLen;
     struct sockaddr_storage remoteAddr;
     socklen_t remoteAddrLen;
 +    ssize_t zero_copy_queued;
 +    ssize_t zero_copy_sent;
 };
 diff --git a/io/channel-socket.c b/io/channel-socket.c
 index bfbd64787e..38a46ba213 100644
 --- a/io/channel-socket.c
 +++ b/io/channel-socket.c
@@ -26,6 +26,14 @@
 #include "io/channel-watch.h"
 #include "trace.h"
 #include "qapi/clone-visitor.h"
 +#ifdef CONFIG_LINUX
 +#include <linux/errqueue.h>
 +#include <sys/socket.h>
 +
 +#if (defined(MSG_ZEROCOPY) && defined(SO_ZEROCOPY))
 +#define QEMU_MSG_ZEROCOPY
 +#endif
 +#endif
 #define SOCKET_MAX_FDS 16
@@ -55,6 +63,8 @@ qio_channel_socket_new(void)
     sioc = QIO_CHANNEL_SOCKET(object_new(TYPE_QIO_CHANNEL_SOCKET));
     sioc->fd = -1;
 +    sioc->zero_copy_queued = 0;
 +    sioc->zero_copy_sent = 0;
     ioc = QIO_CHANNEL(sioc);
     qio_channel_set_feature(ioc, QIO_CHANNEL_FEATURE_SHUTDOWN);
@@ -154,6 +164,16 @@ int qio_channel_socket_connect_sync(QIOChannelSocket *ioc,
         return -1;
     }
 +#ifdef QEMU_MSG_ZEROCOPY
 +    int ret, v = 1;
 +    ret = setsockopt(fd, SOL_SOCKET, SO_ZEROCOPY, &v, sizeof(v));
 +    if (ret == 0) {
 +        /* Zero copy available on host */
 +        qio_channel_set_feature(QIO_CHANNEL(ioc),
 +                                QIO_CHANNEL_FEATURE_WRITE_ZERO_COPY);
 +    }
 +#endif
 +
     return 0;
 }
@@ -534,6 +554,7 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
     char control[CMSG_SPACE(sizeof(int) * SOCKET_MAX_FDS)];
     size_t fdsize = sizeof(int) * nfds;
     struct cmsghdr *cmsg;
 +    int sflags = 0;
     memset(control, 0, CMSG_SPACE(sizeof(int) * SOCKET_MAX_FDS));
@@ -558,15 +579,31 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
         memcpy(CMSG_DATA(cmsg), fds, fdsize);
     }
 +#ifdef QEMU_MSG_ZEROCOPY
 +    if (flags & QIO_CHANNEL_WRITE_FLAG_ZERO_COPY) {
 +        sflags = MSG_ZEROCOPY;
 +    }
 +#endif
 +
  retry:
 -    ret = sendmsg(sioc->fd, &msg, 0);
 +    ret = sendmsg(sioc->fd, &msg, sflags);
     if (ret <= 0) {
 -        if (errno == EAGAIN) {
 +        switch (errno) {
 +        case EAGAIN:
             return QIO_CHANNEL_ERR_BLOCK;
 -        }
 -        if (errno == EINTR) {
 +        case EINTR:
             goto retry;
 +#ifdef QEMU_MSG_ZEROCOPY
 +        case ENOBUFS:
 +            if (sflags & MSG_ZEROCOPY) {
 +                error_setg_errno(errp, errno,
 +                                 "Process can't lock enough memory for using MSG_ZEROCOPY");
 +                return -1;
 +            }
 +            break;
 +#endif
         }
 +
         error_setg_errno(errp, errno,
                          "Unable to write to socket");
         return -1;
@@ -660,6 +697,74 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
 }
 #endif /* WIN32 */
 +
 +#ifdef QEMU_MSG_ZEROCOPY
 +static int qio_channel_socket_flush(QIOChannel *ioc,
 +                                    Error **errp)
 +{
 +    QIOChannelSocket *sioc = QIO_CHANNEL_SOCKET(ioc);
 +    struct msghdr msg = {};
 +    struct sock_extended_err *serr;
 +    struct cmsghdr *cm;
 +    char control[CMSG_SPACE(sizeof(*serr))];
 +    int received;
 +    int ret = 1;
 +
 +    msg.msg_control = control;
 +    msg.msg_controllen = sizeof(control);
 +    memset(control, 0, sizeof(control));
 +
 +    while (sioc->zero_copy_sent < sioc->zero_copy_queued) {
 +        received = recvmsg(sioc->fd, &msg, MSG_ERRQUEUE);
 +        if (received < 0) {
 +            switch (errno) {
 +            case EAGAIN:
 +                /* Nothing on errqueue, wait until something is available */
 +                qio_channel_wait(ioc, G_IO_ERR);
 +                continue;
 +            case EINTR:
 +                continue;
 +            default:
 +                error_setg_errno(errp, errno,
 +                                 "Unable to read errqueue");
 +                return -1;
 +            }
 +        }
 +
 +        cm = CMSG_FIRSTHDR(&msg);
 +        if (cm->cmsg_level != SOL_IP &&
 +            cm->cmsg_type != IP_RECVERR) {
 +            error_setg_errno(errp, EPROTOTYPE,
 +                             "Wrong cmsg in errqueue");
 +            return -1;
 +        }
 +
 +        serr = (void *) CMSG_DATA(cm);
 +        if (serr->ee_errno != SO_EE_ORIGIN_NONE) {
 +            error_setg_errno(errp, serr->ee_errno,
 +                             "Error on socket");
 +            return -1;
 +        }
 +        if (serr->ee_origin != SO_EE_ORIGIN_ZEROCOPY) {
 +            error_setg_errno(errp, serr->ee_origin,
 +                             "Error not from zero copy");
 +            return -1;
 +        }
 +
 +        /* No errors, count successfully finished sendmsg()*/
 +        sioc->zero_copy_sent += serr->ee_data - serr->ee_info + 1;
 +
 +        /* If any sendmsg() succeeded using zero copy, return 0 at the end */
 +        if (serr->ee_code != SO_EE_CODE_ZEROCOPY_COPIED) {
 +            ret = 0;
 +        }
 +    }
 +
 +    return ret;
 +}
 +
 +#endif /* QEMU_MSG_ZEROCOPY */
 +
 static int
 qio_channel_socket_set_blocking(QIOChannel *ioc,
                                 bool enabled,
@@ -789,6 +894,9 @@ static void qio_channel_socket_class_init(ObjectClass *klass,
     ioc_klass->io_set_delay = qio_channel_socket_set_delay;
     ioc_klass->io_create_watch = qio_channel_socket_create_watch;
     ioc_klass->io_set_aio_fd_handler = qio_channel_socket_set_aio_fd_handler;
 +#ifdef QEMU_MSG_ZEROCOPY
 +    ioc_klass->io_flush = qio_channel_socket_flush;
 +#endif
 }
 static const TypeInfo qio_channel_socket_info = {
 -- 
 2.35.3
--- a/SOURCES/kvm-QIOChannelSocket-Introduce-assert-and-reduce-ifdefs-.patch
+++ b/SOURCES/kvm-QIOChannelSocket-Introduce-assert-and-reduce-ifdefs-.patch
@ -0,0 +1,82 @@
 From cbfaf86331c2b2e01a2083303b7554672bf991b7 Mon Sep 17 00:00:00 2001
 From: Leonardo Bras <leobras@redhat.com>
 Date: Mon, 20 Jun 2022 02:39:42 -0300
 Subject: [PATCH 24/37] QIOChannelSocket: Introduce assert and reduce ifdefs to
 improve readability
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Leonardo Brás <leobras@redhat.com>
 RH-MergeRequest: 191: MSG_ZEROCOPY + Multifd @ rhel8.7
 RH-Commit: [24/26] b50e2e65307149f247155a7f7a032dc99e57718d
 RH-Bugzilla: 2072049
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 During implementation of MSG_ZEROCOPY feature, a lot of #ifdefs were
 introduced, particularly at qio_channel_socket_writev().
 Rewrite some of those changes so it's easier to read.
 Also, introduce an assert to help detect incorrect zero-copy usage is when
 it's disabled on build.
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 Reviewed-by: Juan Quintela <quintela@redhat.com>
 Reviewed-by: Peter Xu <peterx@redhat.com>
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
  dgilbert: Fixed up thinko'd g_assert_unreachable->g_assert_not_reached
 (cherry picked from commit 803ca43e4c7fcf32f9f68c118301ccd0c83ece3f)
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 ---
 io/channel-socket.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)
 diff --git a/io/channel-socket.c b/io/channel-socket.c
 index 38a46ba213..7d37b39de7 100644
 --- a/io/channel-socket.c
 +++ b/io/channel-socket.c
@@ -579,11 +579,17 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
         memcpy(CMSG_DATA(cmsg), fds, fdsize);
     }
 -#ifdef QEMU_MSG_ZEROCOPY
     if (flags & QIO_CHANNEL_WRITE_FLAG_ZERO_COPY) {
 +#ifdef QEMU_MSG_ZEROCOPY
         sflags = MSG_ZEROCOPY;
 -    }
 +#else
 +        /*
 +         * We expect QIOChannel class entry point to have
 +         * blocked this code path already
 +         */
 +        g_assert_not_reached();
 #endif
 +    }
  retry:
     ret = sendmsg(sioc->fd, &msg, sflags);
@@ -593,15 +599,13 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
             return QIO_CHANNEL_ERR_BLOCK;
         case EINTR:
             goto retry;
 -#ifdef QEMU_MSG_ZEROCOPY
         case ENOBUFS:
 -            if (sflags & MSG_ZEROCOPY) {
 +            if (flags & QIO_CHANNEL_WRITE_FLAG_ZERO_COPY) {
                 error_setg_errno(errp, errno,
                                  "Process can't lock enough memory for using MSG_ZEROCOPY");
                 return -1;
             }
             break;
 -#endif
         }
         error_setg_errno(errp, errno,
 -- 
 2.35.3
--- a/SOURCES/kvm-RHEL-Enable-x-not-migrate-acpi-index-for-all-pre-RHE.patch
+++ b/SOURCES/kvm-RHEL-Enable-x-not-migrate-acpi-index-for-all-pre-RHE.patch
@ -0,0 +1,43 @@
 From f1480fe9a4054113ddacd218961e29f31c33d329 Mon Sep 17 00:00:00 2001
 From: Peter Xu <peterx@redhat.com>
 Date: Wed, 6 Sep 2023 16:29:23 -0400
 Subject: [PATCH 2/3] RHEL: Enable "x-not-migrate-acpi-index" for all pre-RHEL8
 guests
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Peter Xu <peterx@redhat.com>
 RH-MergeRequest: 343: acpi: fix acpi_index migration
 RH-Jira: RHEL-20189
 RH-Acked-by: Leonardo Brás <leobras@redhat.com>
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 RH-Acked-by: Prasad Pandit <None>
 RH-Commit: [2/2] 0a26a71236e68dd7feb5d2063254090e3852d6ba
 The acpi index migration is simply broken before for all pre-RHEL8
 branches.  Don't migrate it for all of them.
 Signed-off-by: Peter Xu <peterx@redhat.com>
 ---
 hw/core/machine.c | 4 ++++
 1 file changed, 4 insertions(+)
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index 2724f6848a..6650a3d7b7 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -44,6 +44,10 @@ GlobalProperty hw_compat_rhel_8_6[] = {
      * we need do disable it downstream on the latest hw_compat_rhel_8.
      */
     { "vhost-vsock-device", "seqpacket", "off" },
 +    /*
 +     * RHEL-2186: all rhel8 machines should not migrate acpi index.
 +     */
 +    { "PIIX4_PM", "x-not-migrate-acpi-index", "on"},
 };
 const size_t hw_compat_rhel_8_6_len = G_N_ELEMENTS(hw_compat_rhel_8_6);
 -- 
 2.41.0
--- a/SOURCES/kvm-RHEL-disable-seqpacket-for-vhost-vsock-device-in-rhe.patch
+++ b/SOURCES/kvm-RHEL-disable-seqpacket-for-vhost-vsock-device-in-rhe.patch
@ -0,0 +1,107 @@
 From e0e4f01c6f4fb5881960f72ae4e80951b711131e Mon Sep 17 00:00:00 2001
 From: Stefano Garzarella <sgarzare@redhat.com>
 Date: Thu, 24 Mar 2022 16:04:57 +0100
 Subject: [PATCH 1/5] RHEL: disable "seqpacket" for "vhost-vsock-device" in
 rhel8.6.0
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Stefano Garzarella <sgarzare@redhat.com>
 RH-MergeRequest: 136: RHEL: disable "seqpacket" for "vhost-vsock-device" in rhel8.6.0 [rhel-8.7.0]
 RH-Commit: [1/1] d82ea09e123679521503689f7d9af1c03dc71bfc
 RH-Bugzilla: 2068202
 RH-Acked-by: Jason Wang <None>
 RH-Acked-by: Eugenio Pérez <None>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 vhost-vsock device in RHEL 8 kernels doesn't support seqpacket.
 To avoid problems when migrating a VM from RHEL 9 host, we need to
 disable it in rhel8-* machine types.
 Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
 ---
 hw/core/machine.c          | 10 ++++++++++
 hw/i386/pc_piix.c          |  2 ++
 hw/i386/pc_q35.c           |  2 ++
 hw/s390x/s390-virtio-ccw.c |  1 +
 include/hw/boards.h        |  3 +++
 5 files changed, 18 insertions(+)
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index 024b025fc2..76fcabec7a 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -37,6 +37,16 @@
 #include "hw/virtio/virtio.h"
 #include "hw/virtio/virtio-pci.h"
 +GlobalProperty hw_compat_rhel_8_6[] = {
 +    /* hw_compat_rhel_8_6 bz 2068202 */
 +    /*
 +     * vhost-vsock device in RHEL 8 kernels doesn't support seqpacket, so
 +     * we need do disable it downstream on the latest hw_compat_rhel_8.
 +     */
 +    { "vhost-vsock-device", "seqpacket", "off" },
 +};
 +const size_t hw_compat_rhel_8_6_len = G_N_ELEMENTS(hw_compat_rhel_8_6);
 +
 /*
  * Mostly the same as hw_compat_6_0 and hw_compat_6_1
  */
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
 index f03a8f0db8..ab6d03e07a 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
@@ -998,6 +998,8 @@ static void pc_machine_rhel760_options(MachineClass *m)
     pcmc->kvmclock_create_always = false;
     /* From pc_i440fx_5_1_machine_options() */
     pcmc->pci_root_uid = 1;
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_6,
 +                     hw_compat_rhel_8_6_len);
     compat_props_add(m->compat_props, hw_compat_rhel_8_5,
                      hw_compat_rhel_8_5_len);
     compat_props_add(m->compat_props, pc_rhel_8_5_compat,
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
 index 5559261d9e..882fe7a68d 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
@@ -658,6 +658,8 @@ static void pc_q35_machine_rhel860_options(MachineClass *m)
     m->desc = "RHEL-8.6.0 PC (Q35 + ICH9, 2009)";
     pcmc->smbios_stream_product = "RHEL-AV";
     pcmc->smbios_stream_version = "8.6.0";
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_6,
 +                     hw_compat_rhel_8_6_len);
 }
 DEFINE_PC_MACHINE(q35_rhel860, "pc-q35-rhel8.6.0", pc_q35_init_rhel860,
 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
 index 9795eb9406..bec270598b 100644
 --- a/hw/s390x/s390-virtio-ccw.c
 +++ b/hw/s390x/s390-virtio-ccw.c
@@ -1109,6 +1109,7 @@ static void ccw_machine_rhel860_instance_options(MachineState *machine)
 static void ccw_machine_rhel860_class_options(MachineClass *mc)
 {
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_6, hw_compat_rhel_8_6_len);
 }
 DEFINE_CCW_MACHINE(rhel860, "rhel8.6.0", true);
 diff --git a/include/hw/boards.h b/include/hw/boards.h
 index 04e8759815..4ddb798144 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
@@ -443,6 +443,9 @@ extern const size_t hw_compat_2_2_len;
 extern GlobalProperty hw_compat_2_1[];
 extern const size_t hw_compat_2_1_len;
 +extern GlobalProperty hw_compat_rhel_8_6[];
 +extern const size_t hw_compat_rhel_8_6_len;
 +
 extern GlobalProperty hw_compat_rhel_8_5[];
 extern const size_t hw_compat_rhel_8_5_len;
 -- 
 2.27.0
--- a/SOURCES/kvm-Revert-redhat-Add-hw_compat_4_2_extra-and-apply-to-u.patch
+++ b/SOURCES/kvm-Revert-redhat-Add-hw_compat_4_2_extra-and-apply-to-u.patch
@ -0,0 +1,93 @@
 From e626dc16d130c724c400b99a93daad0a9abeae59 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Tue, 22 Mar 2022 19:23:36 -0400
 Subject: [PATCH 01/18] Revert "redhat: Add hw_compat_4_2_extra and apply to
 upstream machines"
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 131: Revert "redhat: Add hw_compat_4_2_extra and apply to upstream machines"
 RH-Commit: [1/3] 47b7d9e5062f5e215d5ed1a3ecdc1a87ac3fa630 (jmaloy/qemu-kvm)
 RH-Bugzilla: 2062613
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 BZ: https://bugzilla.redhat.com/2062613
 UPSTREAM: no
 BREW: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=44038000
 commit dc2e9ec1e014950c7918e23a3e9b0096b34a4a92
 Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Date:   Wed Mar 9 10:31:53 2022 +0000
    Revert "redhat: Add hw_compat_4_2_extra and apply to upstream machines"
    This reverts commit 66882f9a3230246409f3918424aca26add5c034a.
    We no longer need these compat machines it was added for.
    Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 (cherry picked from commit dc2e9ec1e014950c7918e23a3e9b0096b34a4a92)
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 hw/i386/pc.c         | 12 ------------
 hw/i386/pc_piix.c    |  6 ------
 include/hw/i386/pc.h |  3 ---
 3 files changed, 21 deletions(-)
 diff --git a/hw/i386/pc.c b/hw/i386/pc.c
 index 4c08a1971c..357257349b 100644
 --- a/hw/i386/pc.c
 +++ b/hw/i386/pc.c
@@ -670,18 +670,6 @@ GlobalProperty pc_rhel_7_0_compat[] = {
 };
 const size_t pc_rhel_7_0_compat_len = G_N_ELEMENTS(pc_rhel_7_0_compat);
 -/*
 - * RHEL: These properties only apply to the RHEL exported machine types
 - * pc-4.2/2.11 for the purpose to have a limited upstream machines support
 - * which can be migrated to RHEL.  Let's avoid touching hw_compat_4_2 directly
 - * so that we can have some isolation against the upstream code.
 - */
 -GlobalProperty hw_compat_4_2_extra[] = {
 -    /* By default enlarge the default virtio-net-pci ROM to 512KB. */
 -    { "virtio-net-pci", "romsize", "0x80000" },
 -};
 -const size_t hw_compat_4_2_extra_len = G_N_ELEMENTS(hw_compat_4_2_extra);
 -
 GSIState *pc_gsi_create(qemu_irq **irqs, bool pci_enabled)
 {
     GSIState *s;
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
 index c30057c443..7b7076cbc7 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
@@ -531,12 +531,6 @@ static void pc_i440fx_4_2_machine_options(MachineClass *m)
      * supported by RHEL, even if exported.
      */
     m->deprecation_reason = "Not supported by RHEL";
 -    /*
 -     * RHEL: Specific compat properties to have limited support for upstream
 -     * machines exported.
 -     */
 -    compat_props_add(m->compat_props, hw_compat_4_2_extra,
 -                     hw_compat_4_2_extra_len);
 }
 /* RHEL: Export pc-4.2 */
 diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
 index 9e8bfb69f8..4a593acb50 100644
 --- a/include/hw/i386/pc.h
 +++ b/include/hw/i386/pc.h
@@ -325,9 +325,6 @@ extern const size_t pc_rhel_7_1_compat_len;
 extern GlobalProperty pc_rhel_7_0_compat[];
 extern const size_t pc_rhel_7_0_compat_len;
 -extern GlobalProperty hw_compat_4_2_extra[];
 -extern const size_t hw_compat_4_2_extra_len;
 -
 /* Helper for setting model-id for CPU models that changed model-id
  * depending on QEMU versions up to QEMU 2.4.
  */
 -- 
 2.27.0
--- a/SOURCES/kvm-Revert-redhat-Add-some-devices-for-exporting-upstrea.patch
+++ b/SOURCES/kvm-Revert-redhat-Add-some-devices-for-exporting-upstrea.patch
@ -0,0 +1,128 @@
 From 96edd15df257f1d1496397a6fac24b4316570d7e Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Thu, 14 Apr 2022 16:45:30 -0400
 Subject: [PATCH 1/3] Revert redhat: Add some devices for exporting upstream
 machine types
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 156: Revert redhat: Add some devices for exporting upstream machine types
 RH-Commit: [1/1] f25d0da3a181136917ead82f5a5c59efe3fa445a (jmaloy/qemu-kvm)
 RH-Bugzilla: 2065043
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2065043
 Upstream: no
 Manual revert of commit 70d3924521c9bfd912bcf1a1fc76f49eb377de46, since
 the directory structure looks different from rhel-av-8.4.0.z where
 this commit is taken from. Besides, x86_64-softmmu.mak looks totally
 different and should not be affected by this reversal.
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 configs/devices/x86_64-softmmu/x86_64-rh-devices.mak     | 1 -
 .../devices/x86_64-softmmu/x86_64-upstream-devices.mak   | 4 ----
 hw/char/parallel.c                                       | 9 ---------
 hw/i386/pc_piix.c                                        | 2 +-
 hw/i386/pc_q35.c                                         | 2 +-
 hw/timer/hpet.c                                          | 8 --------
 6 files changed, 2 insertions(+), 24 deletions(-)
 delete mode 100644 configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak
 diff --git a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 index fdbbdf9742..31ce08edab 100644
 --- a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 +++ b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
@@ -1,5 +1,4 @@
 include ../rh-virtio.mak
 -include x86_64-upstream-devices.mak
 CONFIG_AC97=y
 CONFIG_ACPI=y
 diff --git a/configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak b/configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak
 deleted file mode 100644
 index 2cd20f54d2..0000000000
 --- a/configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak
 +++ /dev/null
@@ -1,4 +0,0 @@
 -# We need "isa-parallel"
 -CONFIG_PARALLEL=y
 -# We need "hpet"
 -CONFIG_HPET=y
 diff --git a/hw/char/parallel.c b/hw/char/parallel.c
 index e5f108211b..b45e67bfbb 100644
 --- a/hw/char/parallel.c
 +++ b/hw/char/parallel.c
@@ -29,7 +29,6 @@
 #include "chardev/char-parallel.h"
 #include "chardev/char-fe.h"
 #include "hw/acpi/aml-build.h"
 -#include "hw/boards.h"
 #include "hw/irq.h"
 #include "hw/isa/isa.h"
 #include "hw/qdev-properties.h"
@@ -535,14 +534,6 @@ static void parallel_isa_realizefn(DeviceState *dev, Error **errp)
     int base;
     uint8_t dummy;
 -    /* Restricted for Red Hat Enterprise Linux */
 -    MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
 -    if (strstr(mc->name, "rhel")) {
 -        error_setg(errp, "Device %s is not supported with machine type %s",
 -                   object_get_typename(OBJECT(dev)), mc->name);
 -        return;
 -    }
 -
     if (!qemu_chr_fe_backend_connected(&s->chr)) {
         error_setg(errp, "Can't create parallel device, empty char device");
         return;
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
 index ab6d03e07a..5f101c8748 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
@@ -966,7 +966,7 @@ static void pc_machine_rhel7_options(MachineClass *m)
 {
     PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
     m->family = "pc_piix_Y";
 -    m->default_machine_opts = "firmware=bios-256k.bin,hpet=off";
 +    m->default_machine_opts = "firmware=bios-256k.bin";
     pcmc->default_nic_model = "e1000";
     pcmc->pci_root_uid = 0;
     m->default_display = "std";
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
 index 882fe7a68d..73b0d0d317 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
@@ -633,7 +633,7 @@ static void pc_q35_machine_rhel_options(MachineClass *m)
     pcmc->pci_root_uid = 0;
     m->family = "pc_q35_Z";
     m->units_per_default_bus = 1;
 -    m->default_machine_opts = "firmware=bios-256k.bin,hpet=off";
 +    m->default_machine_opts = "firmware=bios-256k.bin";
     m->default_display = "std";
     m->no_floppy = 1;
     m->no_parallel = 1;
 diff --git a/hw/timer/hpet.c b/hw/timer/hpet.c
 index 202e032524..9520471be2 100644
 --- a/hw/timer/hpet.c
 +++ b/hw/timer/hpet.c
@@ -733,14 +733,6 @@ static void hpet_realize(DeviceState *dev, Error **errp)
     int i;
     HPETTimer *timer;
 -    /* Restricted for Red Hat Enterprise Linux */
 -    MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
 -    if (strstr(mc->name, "rhel")) {
 -        error_setg(errp, "Device %s is not supported with machine type %s",
 -                   object_get_typename(OBJECT(dev)), mc->name);
 -        return;
 -    }
 -
     if (!s->intcap) {
         warn_report("Hpet's intcap not initialized");
     }
 -- 
 2.35.1
--- a/SOURCES/kvm-Revert-redhat-Enable-FDC-device-for-upstream-machine.patch
+++ b/SOURCES/kvm-Revert-redhat-Enable-FDC-device-for-upstream-machine.patch
@ -0,0 +1,53 @@
 From 5bf8f1d69fea1225e927fbb3efe549a2a9d47d92 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Tue, 22 Mar 2022 19:23:36 -0400
 Subject: [PATCH 02/18] Revert "redhat: Enable FDC device for upstream machines
 too"
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 131: Revert "redhat: Add hw_compat_4_2_extra and apply to upstream machines"
 RH-Commit: [2/3] 4e3c945e3de9bb9d9a6d24115f0719168c9669fe (jmaloy/qemu-kvm)
 RH-Bugzilla: 2062613
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 BZ: https://bugzilla.redhat.com/2062613
 UPSTREAM: no
 BREW: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=44038000
 commit 597cb6ca1da4a3eea77c1e4928f55203a1d5c70c
 Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Date:   Wed Mar 9 10:32:39 2022 +0000
    Revert "redhat: Enable FDC device for upstream machines too"
    This reverts commit c4d1aa8bf21fe98da94a9cff30b7c25bed12c17f.
    We no longer need these compat machines it was added for.
  Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 (cherry picked from commit 597cb6ca1da4a3eea77c1e4928f55203a1d5c70c)
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 hw/block/fdc.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)
 diff --git a/hw/block/fdc.c b/hw/block/fdc.c
 index 63042ef030..97fa6de423 100644
 --- a/hw/block/fdc.c
 +++ b/hw/block/fdc.c
@@ -2341,10 +2341,7 @@ void fdctrl_realize_common(DeviceState *dev, FDCtrl *fdctrl, Error **errp)
     /* Restricted for Red Hat Enterprise Linux: */
     MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
 -    if (!strstr(mc->name, "-rhel7.") &&
 -        /* Exported two upstream machine types allows FDC too */
 -        strcmp(mc->name, "pc-i440fx-4.2") &&
 -        strcmp(mc->name, "pc-i440fx-2.11")) {
 +    if (!strstr(mc->name, "-rhel7.")) {
         error_setg(errp, "Device %s is not supported with machine type %s",
                    object_get_typename(OBJECT(dev)), mc->name);
         return;
 -- 
 2.27.0
--- a/SOURCES/kvm-Revert-redhat-Expose-upstream-machines-pc-4.2-and-pc.patch
+++ b/SOURCES/kvm-Revert-redhat-Expose-upstream-machines-pc-4.2-and-pc.patch
@ -0,0 +1,191 @@
 From ee3cae3bb349469edcf725a1c5161521e95dcb9f Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Tue, 22 Mar 2022 19:23:36 -0400
 Subject: [PATCH 03/18] Revert "redhat: Expose upstream machines pc-4.2 and
 pc-2.11"
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 131: Revert "redhat: Add hw_compat_4_2_extra and apply to upstream machines"
 RH-Commit: [3/3] 35cee68034580f81b3aa916921eecd2fdfa7dd15 (jmaloy/qemu-kvm)
 RH-Bugzilla: 2062613
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 BZ: https://bugzilla.redhat.com/2062613
 UPSTREAM: no
 BREW: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=44038000
 commit f3b50d6d4ae0be9e64aafe6a15f5423bab4899e9
 Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Date:   Wed Mar 9 10:34:58 2022 +0000
    Revert "redhat: Expose upstream machines pc-4.2 and pc-2.11"
    This reverts commit 618e2424edba499d52cd26cf8363bc2dd85ef149.
    We no longer need these compat machines.
    Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 (cherry picked from commit f3b50d6d4ae0be9e64aafe6a15f5423bab4899e9)
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 hw/i386/pc_piix.c | 37 -------------------------------------
 1 file changed, 37 deletions(-)
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
 index 7b7076cbc7..f03a8f0db8 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
@@ -315,14 +315,6 @@ static void pc_init1(MachineState *machine,
  * hw_compat_*, pc_compat_*, or * pc_*_machine_options().
  */
 -/*
 - * NOTE!  Not all the upstream machine types are disabled for RHEL.  For
 - * providing a very limited support for upstream machine types, pc machines
 - * 2.11 and 4.2 are exposed explicitly.  This will make the below "#if" macros
 - * a bit messed up, but please read this comment first so that we can have a
 - * rough understanding of what we're going to do.
 - */
 -
 #if 0 /* Disabled for Red Hat Enterprise Linux */
 static void pc_compat_2_3_fn(MachineState *machine)
 {
@@ -399,8 +391,6 @@ static void pc_xen_hvm_init(MachineState *machine)
 }
 #endif
 -#endif /* Disabled for Red Hat Enterprise Linux */
 -
 #define DEFINE_I440FX_MACHINE(suffix, name, compatfn, optionfn) \
     static void pc_init_##suffix(MachineState *machine) \
     { \
@@ -465,10 +455,8 @@ static void pc_i440fx_6_0_machine_options(MachineClass *m)
     compat_props_add(m->compat_props, pc_compat_6_0, pc_compat_6_0_len);
 }
 -#if 0 /* Disabled for Red Hat Enterprise Linux */
 DEFINE_I440FX_MACHINE(v6_0, "pc-i440fx-6.0", NULL,
                       pc_i440fx_6_0_machine_options);
 -#endif /* Disabled for Red Hat Enterprise Linux */
 static void pc_i440fx_5_2_machine_options(MachineClass *m)
 {
@@ -479,10 +467,8 @@ static void pc_i440fx_5_2_machine_options(MachineClass *m)
     compat_props_add(m->compat_props, pc_compat_5_2, pc_compat_5_2_len);
 }
 -#if 0 /* Disabled for Red Hat Enterprise Linux */
 DEFINE_I440FX_MACHINE(v5_2, "pc-i440fx-5.2", NULL,
                       pc_i440fx_5_2_machine_options);
 -#endif /* Disabled for Red Hat Enterprise Linux */
 static void pc_i440fx_5_1_machine_options(MachineClass *m)
 {
@@ -497,10 +483,8 @@ static void pc_i440fx_5_1_machine_options(MachineClass *m)
     pcmc->pci_root_uid = 1;
 }
 -#if 0 /* Disabled for Red Hat Enterprise Linux */
 DEFINE_I440FX_MACHINE(v5_1, "pc-i440fx-5.1", NULL,
                       pc_i440fx_5_1_machine_options);
 -#endif /* Disabled for Red Hat Enterprise Linux */
 static void pc_i440fx_5_0_machine_options(MachineClass *m)
 {
@@ -513,10 +497,8 @@ static void pc_i440fx_5_0_machine_options(MachineClass *m)
     m->auto_enable_numa_with_memdev = false;
 }
 -#if 0 /* Disabled for Red Hat Enterprise Linux */
 DEFINE_I440FX_MACHINE(v5_0, "pc-i440fx-5.0", NULL,
                       pc_i440fx_5_0_machine_options);
 -#endif /* Disabled for Red Hat Enterprise Linux */
 static void pc_i440fx_4_2_machine_options(MachineClass *m)
 {
@@ -525,15 +507,8 @@ static void pc_i440fx_4_2_machine_options(MachineClass *m)
     m->is_default = false;
     compat_props_add(m->compat_props, hw_compat_4_2, hw_compat_4_2_len);
     compat_props_add(m->compat_props, pc_compat_4_2, pc_compat_4_2_len);
 -
 -    /*
 -     * RHEL: Mark all upstream machines as deprecated because they're not
 -     * supported by RHEL, even if exported.
 -     */
 -    m->deprecation_reason = "Not supported by RHEL";
 }
 -/* RHEL: Export pc-4.2 */
 DEFINE_I440FX_MACHINE(v4_2, "pc-i440fx-4.2", NULL,
                       pc_i440fx_4_2_machine_options);
@@ -546,10 +521,8 @@ static void pc_i440fx_4_1_machine_options(MachineClass *m)
     compat_props_add(m->compat_props, pc_compat_4_1, pc_compat_4_1_len);
 }
 -#if 0 /* Disabled for Red Hat Enterprise Linux */
 DEFINE_I440FX_MACHINE(v4_1, "pc-i440fx-4.1", NULL,
                       pc_i440fx_4_1_machine_options);
 -#endif /* Disabled for Red Hat Enterprise Linux */
 static void pc_i440fx_4_0_machine_options(MachineClass *m)
 {
@@ -562,10 +535,8 @@ static void pc_i440fx_4_0_machine_options(MachineClass *m)
     compat_props_add(m->compat_props, pc_compat_4_0, pc_compat_4_0_len);
 }
 -#if 0 /* Disabled for Red Hat Enterprise Linux */
 DEFINE_I440FX_MACHINE(v4_0, "pc-i440fx-4.0", NULL,
                       pc_i440fx_4_0_machine_options);
 -#endif /* Disabled for Red Hat Enterprise Linux */
 static void pc_i440fx_3_1_machine_options(MachineClass *m)
 {
@@ -581,10 +552,8 @@ static void pc_i440fx_3_1_machine_options(MachineClass *m)
     compat_props_add(m->compat_props, pc_compat_3_1, pc_compat_3_1_len);
 }
 -#if 0 /* Disabled for Red Hat Enterprise Linux */
 DEFINE_I440FX_MACHINE(v3_1, "pc-i440fx-3.1", NULL,
                       pc_i440fx_3_1_machine_options);
 -#endif /* Disabled for Red Hat Enterprise Linux */
 static void pc_i440fx_3_0_machine_options(MachineClass *m)
 {
@@ -593,10 +562,8 @@ static void pc_i440fx_3_0_machine_options(MachineClass *m)
     compat_props_add(m->compat_props, pc_compat_3_0, pc_compat_3_0_len);
 }
 -#if 0 /* Disabled for Red Hat Enterprise Linux */
 DEFINE_I440FX_MACHINE(v3_0, "pc-i440fx-3.0", NULL,
                       pc_i440fx_3_0_machine_options);
 -#endif /* Disabled for Red Hat Enterprise Linux */
 static void pc_i440fx_2_12_machine_options(MachineClass *m)
 {
@@ -605,10 +572,8 @@ static void pc_i440fx_2_12_machine_options(MachineClass *m)
     compat_props_add(m->compat_props, pc_compat_2_12, pc_compat_2_12_len);
 }
 -#if 0 /* Disabled for Red Hat Enterprise Linux */
 DEFINE_I440FX_MACHINE(v2_12, "pc-i440fx-2.12", NULL,
                       pc_i440fx_2_12_machine_options);
 -#endif /* Disabled for Red Hat Enterprise Linux */
 static void pc_i440fx_2_11_machine_options(MachineClass *m)
 {
@@ -617,11 +582,9 @@ static void pc_i440fx_2_11_machine_options(MachineClass *m)
     compat_props_add(m->compat_props, pc_compat_2_11, pc_compat_2_11_len);
 }
 -/* RHEL: Export pc-2.11 */
 DEFINE_I440FX_MACHINE(v2_11, "pc-i440fx-2.11", NULL,
                       pc_i440fx_2_11_machine_options);
 -#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void pc_i440fx_2_10_machine_options(MachineClass *m)
 {
     pc_i440fx_2_11_machine_options(m);
 -- 
 2.27.0
--- a/SOURCES/kvm-Update-linux-headers-to-v6.0-rc4.patch
+++ b/SOURCES/kvm-Update-linux-headers-to-v6.0-rc4.patch
@ -0,0 +1,171 @@
 From 10fc28b61a6fba1e6dc44fd544cf31c7f313c622 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
 Date: Fri, 28 Oct 2022 17:48:00 +0100
 Subject: [PATCH 05/42] Update linux headers to v6.0-rc4
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Cédric Le Goater <clg@redhat.com>
 RH-MergeRequest: 226: s390: Enhanced Interpretation for PCI Functions and Secure Execution guest dump
 RH-Bugzilla: 1664378 2043909
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
 RH-Commit: [5/41] ca55f497d1bf1e72179330f8f613781bf999d898
 Based on upstream commit d525f73f9186a5bc641b8caf0b2c9bb94e5aa963
 ("Update linux headers to v6.0-rc4"), but this is focusing only on the
 ZPCI and protected dump changes.
 Signed-off-by: Cédric Le Goater <clg@redhat.com>
 ---
 linux-headers/linux/kvm.h       | 87 +++++++++++++++++++++++++++++++++
 linux-headers/linux/vfio_zdev.h |  7 +++
 2 files changed, 94 insertions(+)
 diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h
 index 0d05d02ee4..c65930288c 100644
 --- a/linux-headers/linux/kvm.h
 +++ b/linux-headers/linux/kvm.h
@@ -1150,6 +1150,9 @@ struct kvm_ppc_resize_hpt {
 #define KVM_CAP_DISABLE_QUIRKS2 213
 /* #define KVM_CAP_VM_TSC_CONTROL 214 */
 #define KVM_CAP_SYSTEM_EVENT_DATA 215
 +#define KVM_CAP_S390_PROTECTED_DUMP 217
 +#define KVM_CAP_S390_ZPCI_OP 221
 +#define KVM_CAP_S390_CPU_TOPOLOGY 222
 #ifdef KVM_CAP_IRQ_ROUTING
@@ -1651,6 +1654,55 @@ struct kvm_s390_pv_unp {
 	__u64 tweak;
 };
 +enum pv_cmd_dmp_id {
 +	KVM_PV_DUMP_INIT,
 +	KVM_PV_DUMP_CONFIG_STOR_STATE,
 +	KVM_PV_DUMP_COMPLETE,
 +	KVM_PV_DUMP_CPU,
 +};
 +
 +struct kvm_s390_pv_dmp {
 +	__u64 subcmd;
 +	__u64 buff_addr;
 +	__u64 buff_len;
 +	__u64 gaddr;		/* For dump storage state */
 +	__u64 reserved[4];
 +};
 +
 +enum pv_cmd_info_id {
 +	KVM_PV_INFO_VM,
 +	KVM_PV_INFO_DUMP,
 +};
 +
 +struct kvm_s390_pv_info_dump {
 +	__u64 dump_cpu_buffer_len;
 +	__u64 dump_config_mem_buffer_per_1m;
 +	__u64 dump_config_finalize_len;
 +};
 +
 +struct kvm_s390_pv_info_vm {
 +	__u64 inst_calls_list[4];
 +	__u64 max_cpus;
 +	__u64 max_guests;
 +	__u64 max_guest_addr;
 +	__u64 feature_indication;
 +};
 +
 +struct kvm_s390_pv_info_header {
 +	__u32 id;
 +	__u32 len_max;
 +	__u32 len_written;
 +	__u32 reserved;
 +};
 +
 +struct kvm_s390_pv_info {
 +	struct kvm_s390_pv_info_header header;
 +	union {
 +		struct kvm_s390_pv_info_dump dump;
 +		struct kvm_s390_pv_info_vm vm;
 +	};
 +};
 +
 enum pv_cmd_id {
 	KVM_PV_ENABLE,
 	KVM_PV_DISABLE,
@@ -1659,6 +1711,8 @@ enum pv_cmd_id {
 	KVM_PV_VERIFY,
 	KVM_PV_PREP_RESET,
 	KVM_PV_UNSHARE_ALL,
 +	KVM_PV_INFO,
 +	KVM_PV_DUMP,
 };
 struct kvm_pv_cmd {
@@ -2066,4 +2120,37 @@ struct kvm_stats_desc {
 /* Available with KVM_CAP_XSAVE2 */
 #define KVM_GET_XSAVE2		  _IOR(KVMIO,  0xcf, struct kvm_xsave)
 +/* Available with KVM_CAP_S390_PROTECTED_DUMP */
 +#define KVM_S390_PV_CPU_COMMAND	_IOWR(KVMIO, 0xd0, struct kvm_pv_cmd)
 +
 +/* Available with KVM_CAP_S390_ZPCI_OP */
 +#define KVM_S390_ZPCI_OP         _IOW(KVMIO,  0xd1, struct kvm_s390_zpci_op)
 +
 +struct kvm_s390_zpci_op {
 +	/* in */
 +	__u32 fh;               /* target device */
 +	__u8  op;               /* operation to perform */
 +	__u8  pad[3];
 +	union {
 +		/* for KVM_S390_ZPCIOP_REG_AEN */
 +		struct {
 +			__u64 ibv;      /* Guest addr of interrupt bit vector */
 +			__u64 sb;       /* Guest addr of summary bit */
 +			__u32 flags;
 +			__u32 noi;      /* Number of interrupts */
 +			__u8 isc;       /* Guest interrupt subclass */
 +			__u8 sbo;       /* Offset of guest summary bit vector */
 +			__u16 pad;
 +		} reg_aen;
 +		__u64 reserved[8];
 +	} u;
 +};
 +
 +/* types for kvm_s390_zpci_op->op */
 +#define KVM_S390_ZPCIOP_REG_AEN                0
 +#define KVM_S390_ZPCIOP_DEREG_AEN      1
 +
 +/* flags for kvm_s390_zpci_op->u.reg_aen.flags */
 +#define KVM_S390_ZPCIOP_REGAEN_HOST    (1 << 0)
 +
 #endif /* __LINUX_KVM_H */
 diff --git a/linux-headers/linux/vfio_zdev.h b/linux-headers/linux/vfio_zdev.h
 index b4309397b6..77f2aff1f2 100644
 --- a/linux-headers/linux/vfio_zdev.h
 +++ b/linux-headers/linux/vfio_zdev.h
@@ -29,6 +29,9 @@ struct vfio_device_info_cap_zpci_base {
 	__u16 fmb_length;	/* Measurement Block Length (in bytes) */
 	__u8 pft;		/* PCI Function Type */
 	__u8 gid;		/* PCI function group ID */
 +	/* End of version 1 */
 +	__u32 fh;		/* PCI function handle */
 +	/* End of version 2 */
 };
 /**
@@ -47,6 +50,10 @@ struct vfio_device_info_cap_zpci_group {
 	__u16 noi;		/* Maximum number of MSIs */
 	__u16 maxstbl;		/* Maximum Store Block Length */
 	__u8 version;		/* Supported PCI Version */
 +	/* End of version 1 */
 +	__u8 reserved;
 +	__u16 imaxstbl;		/* Maximum Interpreted Store Block Length */
 +	/* End of version 2 */
 };
 /**
 -- 
 2.37.3
--- a/SOURCES/kvm-accel-introduce-accelerator-blocker-API.patch
+++ b/SOURCES/kvm-accel-introduce-accelerator-blocker-API.patch
@ -0,0 +1,349 @@
 From a5e7bb1f7a88efb5574266a76e80fd7604d19921 Mon Sep 17 00:00:00 2001
 From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date: Mon, 16 Jan 2023 07:49:59 -0500
 Subject: [PATCH 04/11] accel: introduce accelerator blocker API
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-MergeRequest: 247: accel: introduce accelerator blocker API
 RH-Bugzilla: 2161188
 RH-Acked-by: David Hildenbrand <david@redhat.com>
 RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [1/3] 9d3d7f9554974a79042c915763288cce07aef135
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2161188
 commit bd688fc93120fb3e28aa70e3dfdf567ccc1e0bc1
 Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date:   Fri Nov 11 10:47:56 2022 -0500
    accel: introduce accelerator blocker API
    This API allows the accelerators to prevent vcpus from issuing
    new ioctls while execting a critical section marked with the
    accel_ioctl_inhibit_begin/end functions.
    Note that all functions submitting ioctls must mark where the
    ioctl is being called with accel_{cpu_}ioctl_begin/end().
    This API requires the caller to always hold the BQL.
    API documentation is in sysemu/accel-blocker.h
    Internally, it uses a QemuLockCnt together with a per-CPU QemuLockCnt
    (to minimize cache line bouncing) to keep avoid that new ioctls
    run when the critical section starts, and a QemuEvent to wait
    that all running ioctls finish.
    Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
    Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
    Message-Id: <20221111154758.1372674-2-eesposit@redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 Conflicts:
 	util/meson.build: files are missing in rhel 8.8.0
 	namely int128.c, memalign.c and interval-tree.c
 Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 ---
 accel/accel-blocker.c          | 154 +++++++++++++++++++++++++++++++++
 accel/meson.build              |   2 +-
 hw/core/cpu-common.c           |   2 +
 include/hw/core/cpu.h          |   3 +
 include/sysemu/accel-blocker.h |  56 ++++++++++++
 util/meson.build               |   2 +-
 6 files changed, 217 insertions(+), 2 deletions(-)
 create mode 100644 accel/accel-blocker.c
 create mode 100644 include/sysemu/accel-blocker.h
 diff --git a/accel/accel-blocker.c b/accel/accel-blocker.c
 new file mode 100644
 index 0000000000..1e7f423462
 --- /dev/null
 +++ b/accel/accel-blocker.c
@@ -0,0 +1,154 @@
 +/*
 + * Lock to inhibit accelerator ioctls
 + *
 + * Copyright (c) 2022 Red Hat Inc.
 + *
 + * Author: Emanuele Giuseppe Esposito       <eesposit@redhat.com>
 + *
 + * Permission is hereby granted, free of charge, to any person obtaining a copy
 + * of this software and associated documentation files (the "Software"), to deal
 + * in the Software without restriction, including without limitation the rights
 + * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 + * copies of the Software, and to permit persons to whom the Software is
 + * furnished to do so, subject to the following conditions:
 + *
 + * The above copyright notice and this permission notice shall be included in
 + * all copies or substantial portions of the Software.
 + *
 + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 + * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 + * THE SOFTWARE.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qemu/thread.h"
 +#include "qemu/main-loop.h"
 +#include "hw/core/cpu.h"
 +#include "sysemu/accel-blocker.h"
 +
 +static QemuLockCnt accel_in_ioctl_lock;
 +static QemuEvent accel_in_ioctl_event;
 +
 +void accel_blocker_init(void)
 +{
 +    qemu_lockcnt_init(&accel_in_ioctl_lock);
 +    qemu_event_init(&accel_in_ioctl_event, false);
 +}
 +
 +void accel_ioctl_begin(void)
 +{
 +    if (likely(qemu_mutex_iothread_locked())) {
 +        return;
 +    }
 +
 +    /* block if lock is taken in kvm_ioctl_inhibit_begin() */
 +    qemu_lockcnt_inc(&accel_in_ioctl_lock);
 +}
 +
 +void accel_ioctl_end(void)
 +{
 +    if (likely(qemu_mutex_iothread_locked())) {
 +        return;
 +    }
 +
 +    qemu_lockcnt_dec(&accel_in_ioctl_lock);
 +    /* change event to SET. If event was BUSY, wake up all waiters */
 +    qemu_event_set(&accel_in_ioctl_event);
 +}
 +
 +void accel_cpu_ioctl_begin(CPUState *cpu)
 +{
 +    if (unlikely(qemu_mutex_iothread_locked())) {
 +        return;
 +    }
 +
 +    /* block if lock is taken in kvm_ioctl_inhibit_begin() */
 +    qemu_lockcnt_inc(&cpu->in_ioctl_lock);
 +}
 +
 +void accel_cpu_ioctl_end(CPUState *cpu)
 +{
 +    if (unlikely(qemu_mutex_iothread_locked())) {
 +        return;
 +    }
 +
 +    qemu_lockcnt_dec(&cpu->in_ioctl_lock);
 +    /* change event to SET. If event was BUSY, wake up all waiters */
 +    qemu_event_set(&accel_in_ioctl_event);
 +}
 +
 +static bool accel_has_to_wait(void)
 +{
 +    CPUState *cpu;
 +    bool needs_to_wait = false;
 +
 +    CPU_FOREACH(cpu) {
 +        if (qemu_lockcnt_count(&cpu->in_ioctl_lock)) {
 +            /* exit the ioctl, if vcpu is running it */
 +            qemu_cpu_kick(cpu);
 +            needs_to_wait = true;
 +        }
 +    }
 +
 +    return needs_to_wait || qemu_lockcnt_count(&accel_in_ioctl_lock);
 +}
 +
 +void accel_ioctl_inhibit_begin(void)
 +{
 +    CPUState *cpu;
 +
 +    /*
 +     * We allow to inhibit only when holding the BQL, so we can identify
 +     * when an inhibitor wants to issue an ioctl easily.
 +     */
 +    g_assert(qemu_mutex_iothread_locked());
 +
 +    /* Block further invocations of the ioctls outside the BQL.  */
 +    CPU_FOREACH(cpu) {
 +        qemu_lockcnt_lock(&cpu->in_ioctl_lock);
 +    }
 +    qemu_lockcnt_lock(&accel_in_ioctl_lock);
 +
 +    /* Keep waiting until there are running ioctls */
 +    while (true) {
 +
 +        /* Reset event to FREE. */
 +        qemu_event_reset(&accel_in_ioctl_event);
 +
 +        if (accel_has_to_wait()) {
 +            /*
 +             * If event is still FREE, and there are ioctls still in progress,
 +             * wait.
 +             *
 +             *  If an ioctl finishes before qemu_event_wait(), it will change
 +             * the event state to SET. This will prevent qemu_event_wait() from
 +             * blocking, but it's not a problem because if other ioctls are
 +             * still running the loop will iterate once more and reset the event
 +             * status to FREE so that it can wait properly.
 +             *
 +             * If an ioctls finishes while qemu_event_wait() is blocking, then
 +             * it will be waken up, but also here the while loop makes sure
 +             * to re-enter the wait if there are other running ioctls.
 +             */
 +            qemu_event_wait(&accel_in_ioctl_event);
 +        } else {
 +            /* No ioctl is running */
 +            return;
 +        }
 +    }
 +}
 +
 +void accel_ioctl_inhibit_end(void)
 +{
 +    CPUState *cpu;
 +
 +    qemu_lockcnt_unlock(&accel_in_ioctl_lock);
 +    CPU_FOREACH(cpu) {
 +        qemu_lockcnt_unlock(&cpu->in_ioctl_lock);
 +    }
 +}
 +
 diff --git a/accel/meson.build b/accel/meson.build
 index dfd808d2c8..801b4d44e8 100644
 --- a/accel/meson.build
 +++ b/accel/meson.build
@@ -1,4 +1,4 @@
 -specific_ss.add(files('accel-common.c'))
 +specific_ss.add(files('accel-common.c', 'accel-blocker.c'))
 softmmu_ss.add(files('accel-softmmu.c'))
 user_ss.add(files('accel-user.c'))
 diff --git a/hw/core/cpu-common.c b/hw/core/cpu-common.c
 index 9e3241b430..b6e83acf0a 100644
 --- a/hw/core/cpu-common.c
 +++ b/hw/core/cpu-common.c
@@ -238,6 +238,7 @@ static void cpu_common_initfn(Object *obj)
     cpu->nr_threads = 1;
     qemu_mutex_init(&cpu->work_mutex);
 +    qemu_lockcnt_init(&cpu->in_ioctl_lock);
     QSIMPLEQ_INIT(&cpu->work_list);
     QTAILQ_INIT(&cpu->breakpoints);
     QTAILQ_INIT(&cpu->watchpoints);
@@ -249,6 +250,7 @@ static void cpu_common_finalize(Object *obj)
 {
     CPUState *cpu = CPU(obj);
 +    qemu_lockcnt_destroy(&cpu->in_ioctl_lock);
     qemu_mutex_destroy(&cpu->work_mutex);
 }
 diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
 index e948e81f1a..49d9c73f97 100644
 --- a/include/hw/core/cpu.h
 +++ b/include/hw/core/cpu.h
@@ -383,6 +383,9 @@ struct CPUState {
     uint32_t kvm_fetch_index;
     uint64_t dirty_pages;
 +    /* Use by accel-block: CPU is executing an ioctl() */
 +    QemuLockCnt in_ioctl_lock;
 +
     /* Used for events with 'vcpu' and *without* the 'disabled' properties */
     DECLARE_BITMAP(trace_dstate_delayed, CPU_TRACE_DSTATE_MAX_EVENTS);
     DECLARE_BITMAP(trace_dstate, CPU_TRACE_DSTATE_MAX_EVENTS);
 diff --git a/include/sysemu/accel-blocker.h b/include/sysemu/accel-blocker.h
 new file mode 100644
 index 0000000000..72020529ef
 --- /dev/null
 +++ b/include/sysemu/accel-blocker.h
@@ -0,0 +1,56 @@
 +/*
 + * Accelerator blocking API, to prevent new ioctls from starting and wait the
 + * running ones finish.
 + * This mechanism differs from pause/resume_all_vcpus() in that it does not
 + * release the BQL.
 + *
 + *  Copyright (c) 2022 Red Hat Inc.
 + *
 + * Author: Emanuele Giuseppe Esposito       <eesposit@redhat.com>
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + */
 +#ifndef ACCEL_BLOCKER_H
 +#define ACCEL_BLOCKER_H
 +
 +#include "qemu/osdep.h"
 +#include "sysemu/cpus.h"
 +
 +extern void accel_blocker_init(void);
 +
 +/*
 + * accel_{cpu_}ioctl_begin/end:
 + * Mark when ioctl is about to run or just finished.
 + *
 + * accel_{cpu_}ioctl_begin will block after accel_ioctl_inhibit_begin() is
 + * called, preventing new ioctls to run. They will continue only after
 + * accel_ioctl_inibith_end().
 + */
 +extern void accel_ioctl_begin(void);
 +extern void accel_ioctl_end(void);
 +extern void accel_cpu_ioctl_begin(CPUState *cpu);
 +extern void accel_cpu_ioctl_end(CPUState *cpu);
 +
 +/*
 + * accel_ioctl_inhibit_begin: start critical section
 + *
 + * This function makes sure that:
 + * 1) incoming accel_{cpu_}ioctl_begin() calls block
 + * 2) wait that all ioctls that were already running reach
 + *    accel_{cpu_}ioctl_end(), kicking vcpus if necessary.
 + *
 + * This allows the caller to access shared data or perform operations without
 + * worrying of concurrent vcpus accesses.
 + */
 +extern void accel_ioctl_inhibit_begin(void);
 +
 +/*
 + * accel_ioctl_inhibit_end: end critical section started by
 + * accel_ioctl_inhibit_begin()
 + *
 + * This function allows blocked accel_{cpu_}ioctl_begin() to continue.
 + */
 +extern void accel_ioctl_inhibit_end(void);
 +
 +#endif /* ACCEL_BLOCKER_H */
 diff --git a/util/meson.build b/util/meson.build
 index 05b593055a..b5f153b0e8 100644
 --- a/util/meson.build
 +++ b/util/meson.build
@@ -48,6 +48,7 @@ util_ss.add(files('transactions.c'))
 util_ss.add(when: 'CONFIG_POSIX', if_true: files('drm.c'))
 util_ss.add(files('guest-random.c'))
 util_ss.add(files('yank.c'))
 +util_ss.add(files('lockcnt.c'))
 if have_user
   util_ss.add(files('selfmap.c'))
@@ -69,7 +70,6 @@ if have_block
   util_ss.add(files('hexdump.c'))
   util_ss.add(files('iova-tree.c'))
   util_ss.add(files('iov.c', 'qemu-sockets.c', 'uri.c'))
 -  util_ss.add(files('lockcnt.c'))
   util_ss.add(files('main-loop.c'))
   util_ss.add(files('nvdimm-utils.c'))
   util_ss.add(files('qemu-coroutine.c', 'qemu-coroutine-lock.c', 'qemu-coroutine-io.c'))
 -- 
 2.37.3
--- a/SOURCES/kvm-acpi-fix-OEM-ID-OEM-Table-ID-padding.patch
+++ b/SOURCES/kvm-acpi-fix-OEM-ID-OEM-Table-ID-padding.patch
@ -0,0 +1,78 @@
 From af082f3499de265d123157d097b5c84981e0aa63 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Wed, 30 Mar 2022 14:52:34 -0400
 Subject: [PATCH 15/18] acpi: fix OEM ID/OEM Table ID padding
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 141: acpi: fix QEMU crash when started with SLIC table
 RH-Commit: [7/10] 51ea859cbe12b5a902d529ab589d18757d98f71d (jmaloy/qemu-kvm)
 RH-Bugzilla: 2062611
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2062611
 Upstream: Merged
 commit 748c030f360a940fe0c9382c8ca1649096c3a80d
 Author: Igor Mammedov <imammedo@redhat.com>
 Date:   Wed Jan 12 08:03:31 2022 -0500
    acpi: fix OEM ID/OEM Table ID padding
    Commit [2] broke original '\0' padding of OEM ID and OEM Table ID
    fields in headers of ACPI tables. While it doesn't have impact on
    default values since QEMU uses 6 and 8 characters long values
    respectively, it broke usecase where IDs are provided on QEMU CLI.
    It shouldn't affect guest (but may cause licensing verification
    issues in guest OS).
    One of the broken usecases is user supplied SLIC table with IDs
    shorter than max possible length, where [2] mangles IDs with extra
    spaces in RSDT and FADT tables whereas guest OS expects those to
    mirror the respective values of the used SLIC table.
    Fix it by replacing whitespace padding with '\0' padding in
    accordance with [1] and expectations of guest OS
    1) ACPI spec, v2.0b
           17.2 AML Grammar Definition
           ...
           //OEM ID of up to 6 characters. If the OEM ID is
           //shorter than 6 characters, it can be terminated
           //with a NULL character.
    2)
    Fixes: 602b458201 ("acpi: Permit OEM ID and OEM table ID fields to be changed")
    Resolves: https://gitlab.com/qemu-project/qemu/-/issues/707
    Reported-by: Dmitry V. Orekhov <dima.orekhov@gmail.com>
    Signed-off-by: Igor Mammedov <imammedo@redhat.com>
    Cc: qemu-stable@nongnu.org
    Message-Id: <20220112130332.1648664-4-imammedo@redhat.com>
    Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
    Reviewed-by: Ani Sinha <ani@anisinha.ca>
    Tested-by: Dmitry V. Orekhov dima.orekhov@gmail.com
 (cherry picked from commit 748c030f360a940fe0c9382c8ca1649096c3a80d)
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 hw/acpi/aml-build.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/hw/acpi/aml-build.c b/hw/acpi/aml-build.c
 index b3b3310df3..65148d5b9d 100644
 --- a/hw/acpi/aml-build.c
 +++ b/hw/acpi/aml-build.c
@@ -1724,9 +1724,9 @@ void acpi_table_begin(AcpiTable *desc, GArray *array)
     build_append_int_noprefix(array, 0, 4); /* Length */
     build_append_int_noprefix(array, desc->rev, 1); /* Revision */
     build_append_int_noprefix(array, 0, 1); /* Checksum */
 -    build_append_padded_str(array, desc->oem_id, 6, ' '); /* OEMID */
 +    build_append_padded_str(array, desc->oem_id, 6, '\0'); /* OEMID */
     /* OEM Table ID */
 -    build_append_padded_str(array, desc->oem_table_id, 8, ' ');
 +    build_append_padded_str(array, desc->oem_table_id, 8, '\0');
     build_append_int_noprefix(array, 1, 4); /* OEM Revision */
     g_array_append_vals(array, ACPI_BUILD_APPNAME8, 4); /* Creator ID */
     build_append_int_noprefix(array, 1, 4); /* Creator Revision */
 -- 
 2.27.0
--- a/SOURCES/kvm-acpi-fix-QEMU-crash-when-started-with-SLIC-table.patch
+++ b/SOURCES/kvm-acpi-fix-QEMU-crash-when-started-with-SLIC-table.patch
@ -0,0 +1,108 @@
 From 4e8fb957a349558648d5cddb80a89460bc97439e Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Wed, 30 Mar 2022 14:52:34 -0400
 Subject: [PATCH 09/18] acpi: fix QEMU crash when started with SLIC table
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 141: acpi: fix QEMU crash when started with SLIC table
 RH-Commit: [1/10] 0c34e80346c33da4f220d9c486b120c35005144e (jmaloy/qemu-kvm)
 RH-Bugzilla: 2062611
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2062611
 Upstream: Merged
 commit 8cdb99af45365727ac17f45239a9b8c1d5155c6d)
 Author: Igor Mammedov <imammedo@redhat.com>
 Date:   Mon Dec 27 14:31:17 2021 -0500
    acpi: fix QEMU crash when started with SLIC table
    if QEMU is started with used provided SLIC table blob,
      -acpitable sig=SLIC,oem_id='CRASH ',oem_table_id="ME",oem_rev=00002210,asl_compiler_id="",asl_compiler_rev=00000000,data=/dev/null
    it will assert with:
      hw/acpi/aml-build.c:61:build_append_padded_str: assertion failed: (len <= maxlen)
    and following backtrace:
      ...
      build_append_padded_str (array=0x555556afe320, str=0x555556afdb2e "CRASH ME", maxlen=0x6, pad=0x20) at hw/acpi/aml-build.c:61
      acpi_table_begin (desc=0x7fffffffd1b0, array=0x555556afe320) at hw/acpi/aml-build.c:1727
      build_fadt (tbl=0x555556afe320, linker=0x555557ca3830, f=0x7fffffffd318, oem_id=0x555556afdb2e "CRASH ME", oem_table_id=0x555556afdb34 "ME") at hw/acpi/aml-build.c:2064
      ...
    which happens due to acpi_table_begin() expecting NULL terminated
    oem_id and oem_table_id strings, which is normally the case, but
    in case of user provided SLIC table, oem_id points to table's blob
    directly and as result oem_id became longer than expected.
    Fix issue by handling oem_id consistently and make acpi_get_slic_oem()
    return NULL terminated strings.
    PS:
    After [1] refactoring, oem_id semantics became inconsistent, where
    NULL terminated string was coming from machine and old way pointer
    into byte array coming from -acpitable option. That used to work
    since build_header() wasn't expecting NULL terminated string and
    blindly copied the 1st 6 bytes only.
    However commit [2] broke that by replacing build_header() with
    acpi_table_begin(), which was expecting NULL terminated string
    and was checking oem_id size.
    1) 602b45820 ("acpi: Permit OEM ID and OEM table ID fields to be changed")
    2)
    Fixes: 4b56e1e4eb08 ("acpi: build_fadt: use acpi_table_begin()/acpi_table_end() instead of build_header()")
    Resolves: https://gitlab.com/qemu-project/qemu/-/issues/786
    Signed-off-by: Igor Mammedov <imammedo@redhat.com>
    Message-Id: <20211227193120.1084176-2-imammedo@redhat.com>
    Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
    Tested-by: Denis Lisov <dennis.lissov@gmail.com>
    Tested-by: Alexander Tsoy <alexander@tsoy.me>
    Cc: qemu-stable@nongnu.org
    Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 (cherry picked from commit 8cdb99af45365727ac17f45239a9b8c1d5155c6d)
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 hw/acpi/core.c       | 4 ++--
 hw/i386/acpi-build.c | 2 ++
 2 files changed, 4 insertions(+), 2 deletions(-)
 diff --git a/hw/acpi/core.c b/hw/acpi/core.c
 index 1e004d0078..3e811bf03c 100644
 --- a/hw/acpi/core.c
 +++ b/hw/acpi/core.c
@@ -345,8 +345,8 @@ int acpi_get_slic_oem(AcpiSlicOem *oem)
         struct acpi_table_header *hdr = (void *)(u - sizeof(hdr->_length));
         if (memcmp(hdr->sig, "SLIC", 4) == 0) {
 -            oem->id = hdr->oem_id;
 -            oem->table_id = hdr->oem_table_id;
 +            oem->id = g_strndup(hdr->oem_id, 6);
 +            oem->table_id = g_strndup(hdr->oem_table_id, 8);
             return 0;
         }
     }
 diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
 index a4478e77b7..acc4869db0 100644
 --- a/hw/i386/acpi-build.c
 +++ b/hw/i386/acpi-build.c
@@ -2726,6 +2726,8 @@ void acpi_build(AcpiBuildTables *tables, MachineState *machine)
     /* Cleanup memory that's no longer used. */
     g_array_free(table_offsets, true);
 +    g_free(slic_oem.id);
 +    g_free(slic_oem.table_id);
 }
 static void acpi_ram_update(MemoryRegion *mr, GArray *data)
 -- 
 2.27.0
--- a/SOURCES/kvm-acpi-fix-acpi_index-migration.patch
+++ b/SOURCES/kvm-acpi-fix-acpi_index-migration.patch
@ -0,0 +1,165 @@
 From 3deffc03c2e9b0053eec5aeb5b5d633dfe29f499 Mon Sep 17 00:00:00 2001
 From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
 Date: Wed, 6 Apr 2022 14:58:12 -0400
 Subject: [PATCH 1/3] acpi: fix acpi_index migration
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Peter Xu <peterx@redhat.com>
 RH-MergeRequest: 343: acpi: fix acpi_index migration
 RH-Jira: RHEL-20189
 RH-Acked-by: Leonardo Brás <leobras@redhat.com>
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 RH-Acked-by: Prasad Pandit <None>
 RH-Commit: [1/2] c5b9cdf5791cd856207b7df7e2ef5df360ec8de4
 vmstate_acpi_pcihp_use_acpi_index() was expecting AcpiPciHpState
 as state but it actually received PIIX4PMState, because
 VMSTATE_PCI_HOTPLUG is a macro and not another struct.
 So it ended up accessing random pointer, which resulted
 in 'false' return value and acpi_index field wasn't ever
 sent.
 However in 7.0 that pointer de-references to value > 0, and
 destination QEMU starts to expect the field which isn't
 sent in migratioon stream from older QEMU (6.2 and older).
 As result migration fails with:
  qemu-system-x86_64: Missing section footer for 0000:00:01.3/piix4_pm
  qemu-system-x86_64: load of migration failed: Invalid argument
 In addition with QEMU-6.2, destination due to not expected
 state, also never expects the acpi_index field in migration
 stream.
 Q35 is not affected as it always sends/expects the field as
 long as acpi based PCI hotplug is enabled.
 Fix issue by introducing compat knob to never send/expect
 acpi_index in migration stream for 6.2 and older PC machine
 types and always send it for 7.0 and newer PC machine types.
 Diagnosed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Fixes: b32bd76 ("pci: introduce acpi-index property for PCI device")
 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/932
 Signed-off-by: Igor Mammedov <imammedo@redhat.com>
 Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 (cherry picked from commit a83c2844903c45aa7d32cdd17305f23ce2c56ab9)
 Signed-off-by: Peter Xu <peterx@redhat.com>
 ---
 hw/acpi/acpi-pci-hotplug-stub.c |  4 ----
 hw/acpi/pcihp.c                 |  6 ------
 hw/acpi/piix4.c                 | 15 ++++++++++++++-
 hw/core/machine.c               |  5 +++++
 include/hw/acpi/pcihp.h         |  2 --
 5 files changed, 19 insertions(+), 13 deletions(-)
 diff --git a/hw/acpi/acpi-pci-hotplug-stub.c b/hw/acpi/acpi-pci-hotplug-stub.c
 index 734e4c5986..a43f6dafc9 100644
 --- a/hw/acpi/acpi-pci-hotplug-stub.c
 +++ b/hw/acpi/acpi-pci-hotplug-stub.c
@@ -41,7 +41,3 @@ void acpi_pcihp_reset(AcpiPciHpState *s, bool acpihp_root_off)
     return;
 }
 -bool vmstate_acpi_pcihp_use_acpi_index(void *opaque, int version_id)
 -{
 -    return false;
 -}
 diff --git a/hw/acpi/pcihp.c b/hw/acpi/pcihp.c
 index be0e846b34..ec861661c3 100644
 --- a/hw/acpi/pcihp.c
 +++ b/hw/acpi/pcihp.c
@@ -559,12 +559,6 @@ void acpi_pcihp_init(Object *owner, AcpiPciHpState *s, PCIBus *root_bus,
                                    OBJ_PROP_FLAG_READ);
 }
 -bool vmstate_acpi_pcihp_use_acpi_index(void *opaque, int version_id)
 -{
 -     AcpiPciHpState *s = opaque;
 -     return s->acpi_index;
 -}
 -
 const VMStateDescription vmstate_acpi_pcihp_pci_status = {
     .name = "acpi_pcihp_pci_status",
     .version_id = 1,
 diff --git a/hw/acpi/piix4.c b/hw/acpi/piix4.c
 index 8d6011c0a3..033e75ce5b 100644
 --- a/hw/acpi/piix4.c
 +++ b/hw/acpi/piix4.c
@@ -82,6 +82,7 @@ struct PIIX4PMState {
     AcpiPciHpState acpi_pci_hotplug;
     bool use_acpi_hotplug_bridge;
     bool use_acpi_root_pci_hotplug;
 +    bool not_migrate_acpi_index;
     uint8_t disable_s3;
     uint8_t disable_s4;
@@ -269,6 +270,16 @@ static bool piix4_vmstate_need_smbus(void *opaque, int version_id)
     return pm_smbus_vmstate_needed();
 }
 +/*
 + * This is a fudge to turn off the acpi_index field,
 + * whose test was always broken on piix4 with 6.2 and older machine types.
 + */
 +static bool vmstate_test_migrate_acpi_index(void *opaque, int version_id)
 +{
 +    PIIX4PMState *s = PIIX4_PM(opaque);
 +    return s->use_acpi_hotplug_bridge && !s->not_migrate_acpi_index;
 +}
 +
 /* qemu-kvm 1.2 uses version 3 but advertised as 2
  * To support incoming qemu-kvm 1.2 migration, change version_id
  * and minimum_version_id to 2 below (which breaks migration from
@@ -299,7 +310,7 @@ static const VMStateDescription vmstate_acpi = {
             struct AcpiPciHpPciStatus),
         VMSTATE_PCI_HOTPLUG(acpi_pci_hotplug, PIIX4PMState,
                             vmstate_test_use_acpi_hotplug_bridge,
 -                            vmstate_acpi_pcihp_use_acpi_index),
 +                            vmstate_test_migrate_acpi_index),
         VMSTATE_END_OF_LIST()
     },
     .subsections = (const VMStateDescription*[]) {
@@ -654,6 +665,8 @@ static Property piix4_pm_properties[] = {
     DEFINE_PROP_BOOL("memory-hotplug-support", PIIX4PMState,
                      acpi_memory_hotplug.is_enabled, true),
     DEFINE_PROP_BOOL("smm-compat", PIIX4PMState, smm_compat, false),
 +    DEFINE_PROP_BOOL("x-not-migrate-acpi-index", PIIX4PMState,
 +                      not_migrate_acpi_index, false),
     DEFINE_PROP_END_OF_LIST(),
 };
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index 76fcabec7a..2724f6848a 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -331,6 +331,11 @@ GlobalProperty hw_compat_rhel_7_1[] = {
 };
 const size_t hw_compat_rhel_7_1_len = G_N_ELEMENTS(hw_compat_rhel_7_1);
 +GlobalProperty hw_compat_6_2[] = {
 +    { "PIIX4_PM", "x-not-migrate-acpi-index", "on"},
 +};
 +const size_t hw_compat_6_2_len = G_N_ELEMENTS(hw_compat_6_2);
 +
 GlobalProperty hw_compat_6_1[] = {
     { "vhost-user-vsock-device", "seqpacket", "off" },
     { "nvme-ns", "shared", "off" },
 diff --git a/include/hw/acpi/pcihp.h b/include/hw/acpi/pcihp.h
 index af1a169fc3..7e268c2c9c 100644
 --- a/include/hw/acpi/pcihp.h
 +++ b/include/hw/acpi/pcihp.h
@@ -73,8 +73,6 @@ void acpi_pcihp_reset(AcpiPciHpState *s, bool acpihp_root_off);
 extern const VMStateDescription vmstate_acpi_pcihp_pci_status;
 -bool vmstate_acpi_pcihp_use_acpi_index(void *opaque, int version_id);
 -
 #define VMSTATE_PCI_HOTPLUG(pcihp, state, test_pcihp, test_acpi_index) \
         VMSTATE_UINT32_TEST(pcihp.hotplug_select, state, \
                             test_pcihp), \
 -- 
 2.41.0
--- a/SOURCES/kvm-acpi-pcihp-pcie-set-power-on-cap-on-parent-slot.patch
+++ b/SOURCES/kvm-acpi-pcihp-pcie-set-power-on-cap-on-parent-slot.patch
@ -0,0 +1,140 @@
 From c9ceb175667cdeead59384a97a812367ae19c570 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Wed, 23 Mar 2022 13:21:40 -0400
 Subject: [PATCH 06/18] acpi: pcihp: pcie: set power on cap on parent slot
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 134: pci: expose TYPE_XIO3130_DOWNSTREAM name
 RH-Commit: [2/2] d883872647a6e90ec573140b2c171f3f53b600ab (jmaloy/qemu-kvm)
 RH-Bugzilla: 2062610
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 RH-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
 BZ: https://bugzilla.redhat.com/2062610
 UPSTREAM: merged
 BREW: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=44038138
 commit 6b0969f1ec825984cd74619f0730be421b0c46fb
 Author: Igor Mammedov <imammedo@redhat.com>
 Date:   Tue Mar 1 10:11:59 2022 -0500
    acpi: pcihp: pcie: set power on cap on parent slot
    on creation a PCIDevice has power turned on at the end of pci_qdev_realize()
    however later on if PCIe slot isn't populated with any children
    it's power is turned off. It's fine if native hotplug is used
    as plug callback will power slot on among other things.
    However when ACPI hotplug is enabled it replaces native PCIe plug
    callbacks with ACPI specific ones (acpi_pcihp_device_*plug_cb) and
    as result slot stays powered off. It works fine as ACPI hotplug
    on guest side takes care of enumerating/initializing hotplugged
    device. But when later guest is migrated, call chain introduced by]
    commit d5daff7d312 (pcie: implement slot power control for pcie root ports)
       pcie_cap_slot_post_load()
           -> pcie_cap_update_power()
               -> pcie_set_power_device()
                   -> pci_set_power()
                       -> pci_update_mappings()
    will disable earlier initialized BARs for the hotplugged device
    in powered off slot due to commit 23786d13441 (pci: implement power state)
    which disables BARs if power is off.
    Fix it by setting PCI_EXP_SLTCTL_PCC to PCI_EXP_SLTCTL_PWR_ON
    on slot (root port/downstream port) at the time a device
    hotplugged into it. As result PCI_EXP_SLTCTL_PWR_ON is migrated
    to target and above call chain keeps device plugged into it
    powered on.
    Fixes: d5daff7d312 ("pcie: implement slot power control for pcie root ports")
    Fixes: 23786d13441 ("pci: implement power state")
    Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2053584
    Suggested-by: "Michael S. Tsirkin" <mst@redhat.com>
    Signed-off-by: Igor Mammedov <imammedo@redhat.com>
    Message-Id: <20220301151200.3507298-3-imammedo@redhat.com>
    Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 (cherry picked from commit 6b0969f1ec825984cd74619f0730be421b0c46fb)
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 hw/acpi/pcihp.c       | 12 +++++++++++-
 hw/pci/pcie.c         | 11 +++++++++++
 include/hw/pci/pcie.h |  1 +
 3 files changed, 23 insertions(+), 1 deletion(-)
 diff --git a/hw/acpi/pcihp.c b/hw/acpi/pcihp.c
 index a5e182dd3a..be0e846b34 100644
 --- a/hw/acpi/pcihp.c
 +++ b/hw/acpi/pcihp.c
@@ -32,6 +32,7 @@
 #include "hw/pci/pci_bridge.h"
 #include "hw/pci/pci_host.h"
 #include "hw/pci/pcie_port.h"
 +#include "hw/pci-bridge/xio3130_downstream.h"
 #include "hw/i386/acpi-build.h"
 #include "hw/acpi/acpi.h"
 #include "hw/pci/pci_bus.h"
@@ -341,6 +342,8 @@ void acpi_pcihp_device_plug_cb(HotplugHandler *hotplug_dev, AcpiPciHpState *s,
 {
     PCIDevice *pdev = PCI_DEVICE(dev);
     int slot = PCI_SLOT(pdev->devfn);
 +    PCIDevice *bridge;
 +    PCIBus *bus;
     int bsel;
     /* Don't send event when device is enabled during qemu machine creation:
@@ -370,7 +373,14 @@ void acpi_pcihp_device_plug_cb(HotplugHandler *hotplug_dev, AcpiPciHpState *s,
         return;
     }
 -    bsel = acpi_pcihp_get_bsel(pci_get_bus(pdev));
 +    bus = pci_get_bus(pdev);
 +    bridge = pci_bridge_get_device(bus);
 +    if (object_dynamic_cast(OBJECT(bridge), TYPE_PCIE_ROOT_PORT) ||
 +        object_dynamic_cast(OBJECT(bridge), TYPE_XIO3130_DOWNSTREAM)) {
 +        pcie_cap_slot_enable_power(bridge);
 +    }
 +
 +    bsel = acpi_pcihp_get_bsel(bus);
     g_assert(bsel >= 0);
     s->acpi_pcihp_pci_status[bsel].up |= (1U << slot);
     acpi_send_event(DEVICE(hotplug_dev), ACPI_PCI_HOTPLUG_STATUS);
 diff --git a/hw/pci/pcie.c b/hw/pci/pcie.c
 index d7d73a31e4..996f0e24fe 100644
 --- a/hw/pci/pcie.c
 +++ b/hw/pci/pcie.c
@@ -366,6 +366,17 @@ static void hotplug_event_clear(PCIDevice *dev)
     }
 }
 +void pcie_cap_slot_enable_power(PCIDevice *dev)
 +{
 +    uint8_t *exp_cap = dev->config + dev->exp.exp_cap;
 +    uint32_t sltcap = pci_get_long(exp_cap + PCI_EXP_SLTCAP);
 +
 +    if (sltcap & PCI_EXP_SLTCAP_PCP) {
 +        pci_set_word_by_mask(exp_cap + PCI_EXP_SLTCTL,
 +                             PCI_EXP_SLTCTL_PCC, PCI_EXP_SLTCTL_PWR_ON);
 +    }
 +}
 +
 static void pcie_set_power_device(PCIBus *bus, PCIDevice *dev, void *opaque)
 {
     bool *power = opaque;
 diff --git a/include/hw/pci/pcie.h b/include/hw/pci/pcie.h
 index 6063bee0ec..c27368d077 100644
 --- a/include/hw/pci/pcie.h
 +++ b/include/hw/pci/pcie.h
@@ -112,6 +112,7 @@ void pcie_cap_slot_write_config(PCIDevice *dev,
                                 uint32_t addr, uint32_t val, int len);
 int pcie_cap_slot_post_load(void *opaque, int version_id);
 void pcie_cap_slot_push_attention_button(PCIDevice *dev);
 +void pcie_cap_slot_enable_power(PCIDevice *dev);
 void pcie_cap_root_init(PCIDevice *dev);
 void pcie_cap_root_reset(PCIDevice *dev);
 -- 
 2.27.0
--- a/SOURCES/kvm-acpi-validate-hotplug-selector-on-access.patch
+++ b/SOURCES/kvm-acpi-validate-hotplug-selector-on-access.patch
@ -0,0 +1,51 @@
 From 529a5d908f5d16714b8ae0a51eaaaa84994dfae8 Mon Sep 17 00:00:00 2001
 From: "Michael S. Tsirkin" <mst@redhat.com>
 Date: Tue, 21 Dec 2021 09:45:44 -0500
 Subject: [PATCH 1/2] acpi: validate hotplug selector on access
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 97: acpi: validate hotplug selector on access
 RH-Commit: [1/1] 79bcfb0df0091e2b716d2e1c545f047b3409c26c (jmaloy/qemu-kvm)
 RH-Bugzilla: 2036580
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 When bus is looked up on a pci write, we didn't
 validate that the lookup succeeded.
 Fuzzers thus can trigger QEMU crash by dereferencing the NULL
 bus pointer.
 Fixes: b32bd763a1 ("pci: introduce acpi-index property for PCI device")
 Fixes: CVE-2021-4158
 Cc: "Igor Mammedov" <imammedo@redhat.com>
 Fixes: https://gitlab.com/qemu-project/qemu/-/issues/770
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Ani Sinha <ani@anisinha.ca>
 (cherry picked from commit 9bd6565ccee68f72d5012e24646e12a1c662827e)
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 hw/acpi/pcihp.c | 3 +++
 1 file changed, 3 insertions(+)
 diff --git a/hw/acpi/pcihp.c b/hw/acpi/pcihp.c
 index 30405b5113..a5e182dd3a 100644
 --- a/hw/acpi/pcihp.c
 +++ b/hw/acpi/pcihp.c
@@ -491,6 +491,9 @@ static void pci_write(void *opaque, hwaddr addr, uint64_t data,
         }
         bus = acpi_pcihp_find_hotplug_bus(s, s->hotplug_select);
 +        if (!bus) {
 +            break;
 +        }
         QTAILQ_FOREACH_SAFE(kid, &bus->qbus.children, sibling, next) {
             Object *o = OBJECT(kid->child);
             PCIDevice *dev = PCI_DEVICE(o);
 -- 
 2.27.0
--- a/SOURCES/kvm-aio-wait-switch-to-smp_mb__after_rmw.patch
+++ b/SOURCES/kvm-aio-wait-switch-to-smp_mb__after_rmw.patch
@ -0,0 +1,50 @@
 From 953c5c0982b61b0a3f8f03452844b5487eb22fc7 Mon Sep 17 00:00:00 2001
 From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date: Thu, 9 Mar 2023 08:13:17 -0500
 Subject: [PATCH 06/13] aio-wait: switch to smp_mb__after_rmw()
 RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-MergeRequest: 263: qatomic: add smp_mb__before/after_rmw()
 RH-Bugzilla: 2168472
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: Eric Auger <eric.auger@redhat.com>
 RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
 RH-Acked-by: David Hildenbrand <david@redhat.com>
 RH-Commit: [6/10] 9f30f97754139ffd18d36b2350f9ed4e59ac496e
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2168472
 commit b532526a07ef3b903ead2e055fe6cc87b41057a3
 Author: Paolo Bonzini <pbonzini@redhat.com>
 Date:   Fri Mar 3 11:03:52 2023 +0100
    aio-wait: switch to smp_mb__after_rmw()
    The barrier comes after an atomic increment, so it is enough to use
    smp_mb__after_rmw(); this avoids a double barrier on x86 systems.
    Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
    Reviewed-by: David Hildenbrand <david@redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 ---
 include/block/aio-wait.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/include/block/aio-wait.h b/include/block/aio-wait.h
 index 54840f8622..03b6394c78 100644
 --- a/include/block/aio-wait.h
 +++ b/include/block/aio-wait.h
@@ -82,7 +82,7 @@ extern AioWait global_aio_wait;
     /* Increment wait_->num_waiters before evaluating cond. */     \
     qatomic_inc(&wait_->num_waiters);                              \
     /* Paired with smp_mb in aio_wait_kick(). */                   \
 -    smp_mb();                                                      \
 +    smp_mb__after_rmw();                                           \
     if (ctx_ && in_aio_context_home_thread(ctx_)) {                \
         while ((cond)) {                                           \
             aio_poll(ctx_, true);                                  \
 -- 
 2.37.3
--- a/SOURCES/kvm-aio_wait_kick-add-missing-memory-barrier.patch
+++ b/SOURCES/kvm-aio_wait_kick-add-missing-memory-barrier.patch
@ -0,0 +1,86 @@
 From d7eae0ff4c7f7f7bf10f10272adf7c6971c0db9b Mon Sep 17 00:00:00 2001
 From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date: Thu, 9 Mar 2023 09:26:35 -0500
 Subject: [PATCH 01/13] aio_wait_kick: add missing memory barrier
 RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-MergeRequest: 263: qatomic: add smp_mb__before/after_rmw()
 RH-Bugzilla: 2168472
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: Eric Auger <eric.auger@redhat.com>
 RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
 RH-Acked-by: David Hildenbrand <david@redhat.com>
 RH-Commit: [1/10] eb774aee79864052e14e706d931e52e7bd1162c8
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2168472
 commit 7455ff1aa01564cc175db5b2373e610503ad4411
 Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date:   Tue May 24 13:30:54 2022 -0400
    aio_wait_kick: add missing memory barrier
    It seems that aio_wait_kick always required a memory barrier
    or atomic operation in the caller, but nobody actually
    took care of doing it.
    Let's put the barrier in the function instead, and pair it
    with another one in AIO_WAIT_WHILE. Read aio_wait_kick()
    comment for further explanation.
    Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
    Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
    Message-Id: <20220524173054.12651-1-eesposit@redhat.com>
    Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
    Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
    Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 ---
 include/block/aio-wait.h |  2 ++
 util/aio-wait.c          | 16 +++++++++++++++-
 2 files changed, 17 insertions(+), 1 deletion(-)
 diff --git a/include/block/aio-wait.h b/include/block/aio-wait.h
 index b39eefb38d..54840f8622 100644
 --- a/include/block/aio-wait.h
 +++ b/include/block/aio-wait.h
@@ -81,6 +81,8 @@ extern AioWait global_aio_wait;
     AioContext *ctx_ = (ctx);                                      \
     /* Increment wait_->num_waiters before evaluating cond. */     \
     qatomic_inc(&wait_->num_waiters);                              \
 +    /* Paired with smp_mb in aio_wait_kick(). */                   \
 +    smp_mb();                                                      \
     if (ctx_ && in_aio_context_home_thread(ctx_)) {                \
         while ((cond)) {                                           \
             aio_poll(ctx_, true);                                  \
 diff --git a/util/aio-wait.c b/util/aio-wait.c
 index bdb3d3af22..98c5accd29 100644
 --- a/util/aio-wait.c
 +++ b/util/aio-wait.c
@@ -35,7 +35,21 @@ static void dummy_bh_cb(void *opaque)
 void aio_wait_kick(void)
 {
 -    /* The barrier (or an atomic op) is in the caller.  */
 +    /*
 +     * Paired with smp_mb in AIO_WAIT_WHILE. Here we have:
 +     * write(condition);
 +     * aio_wait_kick() {
 +     *      smp_mb();
 +     *      read(num_waiters);
 +     * }
 +     *
 +     * And in AIO_WAIT_WHILE:
 +     * write(num_waiters);
 +     * smp_mb();
 +     * read(condition);
 +     */
 +    smp_mb();
 +
     if (qatomic_read(&global_aio_wait.num_waiters)) {
         aio_bh_schedule_oneshot(qemu_get_aio_context(), dummy_bh_cb, NULL);
     }
 -- 
 2.37.3
--- a/SOURCES/kvm-apic-disable-reentrancy-detection-for-apic-msi.patch
+++ b/SOURCES/kvm-apic-disable-reentrancy-detection-for-apic-msi.patch
@ -0,0 +1,56 @@
 From 47d027147694fde94dd73305ee53b6a136cbeced Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Tue, 9 May 2023 10:29:03 -0400
 Subject: [PATCH 08/15] apic: disable reentrancy detection for apic-msi
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 277: memory: prevent dma-reentracy issues
 RH-Bugzilla: 1999236
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [8/12] 25c3cf99b00cd9adc10d6e7afa9c3e3b7da08de2 (redhat/rhel/src/qemu-kvm/jons-qemu-kvm-2)
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1999236
 Upstream: Merged
 CVE: CVE-2021-3750
 commit 50795ee051a342c681a9b45671c552fbd6274db8
 Author: Alexander Bulekov <alxndr@bu.edu>
 Date:   Thu Apr 27 17:10:13 2023 -0400
    apic: disable reentrancy detection for apic-msi
    As the code is designed for re-entrant calls to apic-msi, mark apic-msi
    as reentrancy-safe.
    Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
    Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
    Message-Id: <20230427211013.2994127-9-alxndr@bu.edu>
    Signed-off-by: Thomas Huth <thuth@redhat.com>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 hw/intc/apic.c | 7 +++++++
 1 file changed, 7 insertions(+)
 diff --git a/hw/intc/apic.c b/hw/intc/apic.c
 index 3df11c34d6..a7c2b301a8 100644
 --- a/hw/intc/apic.c
 +++ b/hw/intc/apic.c
@@ -883,6 +883,13 @@ static void apic_realize(DeviceState *dev, Error **errp)
     memory_region_init_io(&s->io_memory, OBJECT(s), &apic_io_ops, s, "apic-msi",
                           APIC_SPACE_SIZE);
 +    /*
 +     * apic-msi's apic_mem_write can call into ioapic_eoi_broadcast, which can
 +     * write back to apic-msi. As such mark the apic-msi region re-entrancy
 +     * safe.
 +     */
 +    s->io_memory.disable_reentrancy_guard = true;
 +
     s->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, apic_timer, s);
     local_apics[s->id] = s;
 -- 
 2.37.3
--- a/SOURCES/kvm-async-Add-an-optional-reentrancy-guard-to-the-BH-API.patch
+++ b/SOURCES/kvm-async-Add-an-optional-reentrancy-guard-to-the-BH-API.patch
@ -0,0 +1,235 @@
 From 8996ac4369de7e0cb6f911db6f47c3e4ae88c8aa Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Tue, 9 May 2023 10:29:03 -0400
 Subject: [PATCH 02/15] async: Add an optional reentrancy guard to the BH API
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 277: memory: prevent dma-reentracy issues
 RH-Bugzilla: 1999236
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [2/12] b03f247e242a6cdb3eebec36477234ac77dcd20c (redhat/rhel/src/qemu-kvm/jons-qemu-kvm-2)
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1999236
 Upstream: Merged
 CVE: CVE-2021-3750
 Conflict: The file block/graph-lock.h, inluded from include/block/aio.h,
          doesn't exist in this code version. The code compiles without
          issues if this include is just omitted, so we do that.
 commit 9c86c97f12c060bf7484dd931f38634e166a81f0
 Author: Alexander Bulekov <alxndr@bu.edu>
 Date:   Thu Apr 27 17:10:07 2023 -0400
    async: Add an optional reentrancy guard to the BH API
    Devices can pass their MemoryReentrancyGuard (from their DeviceState),
    when creating new BHes. Then, the async API will toggle the guard
    before/after calling the BH call-back. This prevents bh->mmio reentrancy
    issues.
    Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
    Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
    Message-Id: <20230427211013.2994127-3-alxndr@bu.edu>
    [thuth: Fix "line over 90 characters" checkpatch.pl error]
    Signed-off-by: Thomas Huth <thuth@redhat.com>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 docs/devel/multiple-iothreads.txt |  7 +++++++
 include/block/aio.h               | 18 ++++++++++++++++--
 include/qemu/main-loop.h          |  7 +++++--
 tests/unit/ptimer-test-stubs.c    |  3 ++-
 util/async.c                      | 18 +++++++++++++++++-
 util/main-loop.c                  |  6 ++++--
 util/trace-events                 |  1 +
 7 files changed, 52 insertions(+), 8 deletions(-)
 diff --git a/docs/devel/multiple-iothreads.txt b/docs/devel/multiple-iothreads.txt
 index aeb997bed5..a11576bc74 100644
 --- a/docs/devel/multiple-iothreads.txt
 +++ b/docs/devel/multiple-iothreads.txt
@@ -61,6 +61,7 @@ There are several old APIs that use the main loop AioContext:
  * LEGACY qemu_aio_set_event_notifier() - monitor an event notifier
  * LEGACY timer_new_ms() - create a timer
  * LEGACY qemu_bh_new() - create a BH
 + * LEGACY qemu_bh_new_guarded() - create a BH with a device re-entrancy guard
  * LEGACY qemu_aio_wait() - run an event loop iteration
 Since they implicitly work on the main loop they cannot be used in code that
@@ -72,8 +73,14 @@ Instead, use the AioContext functions directly (see include/block/aio.h):
  * aio_set_event_notifier() - monitor an event notifier
  * aio_timer_new() - create a timer
  * aio_bh_new() - create a BH
 + * aio_bh_new_guarded() - create a BH with a device re-entrancy guard
  * aio_poll() - run an event loop iteration
 +The qemu_bh_new_guarded/aio_bh_new_guarded APIs accept a "MemReentrancyGuard"
 +argument, which is used to check for and prevent re-entrancy problems. For
 +BHs associated with devices, the reentrancy-guard is contained in the
 +corresponding DeviceState and named "mem_reentrancy_guard".
 +
 The AioContext can be obtained from the IOThread using
 iothread_get_aio_context() or for the main loop using qemu_get_aio_context().
 Code that takes an AioContext argument works both in IOThreads or the main
 diff --git a/include/block/aio.h b/include/block/aio.h
 index 47fbe9d81f..c7da152985 100644
 --- a/include/block/aio.h
 +++ b/include/block/aio.h
@@ -22,6 +22,8 @@
 #include "qemu/event_notifier.h"
 #include "qemu/thread.h"
 #include "qemu/timer.h"
 +#include "hw/qdev-core.h"
 +
 typedef struct BlockAIOCB BlockAIOCB;
 typedef void BlockCompletionFunc(void *opaque, int ret);
@@ -321,9 +323,11 @@ void aio_bh_schedule_oneshot_full(AioContext *ctx, QEMUBHFunc *cb, void *opaque,
  * is opaque and must be allocated prior to its use.
  *
  * @name: A human-readable identifier for debugging purposes.
 + * @reentrancy_guard: A guard set when entering a cb to prevent
 + * device-reentrancy issues
  */
 QEMUBH *aio_bh_new_full(AioContext *ctx, QEMUBHFunc *cb, void *opaque,
 -                        const char *name);
 +                        const char *name, MemReentrancyGuard *reentrancy_guard);
 /**
  * aio_bh_new: Allocate a new bottom half structure
@@ -332,7 +336,17 @@ QEMUBH *aio_bh_new_full(AioContext *ctx, QEMUBHFunc *cb, void *opaque,
  * string.
  */
 #define aio_bh_new(ctx, cb, opaque) \
 -    aio_bh_new_full((ctx), (cb), (opaque), (stringify(cb)))
 +    aio_bh_new_full((ctx), (cb), (opaque), (stringify(cb)), NULL)
 +
 +/**
 + * aio_bh_new_guarded: Allocate a new bottom half structure with a
 + * reentrancy_guard
 + *
 + * A convenience wrapper for aio_bh_new_full() that uses the cb as the name
 + * string.
 + */
 +#define aio_bh_new_guarded(ctx, cb, opaque, guard) \
 +    aio_bh_new_full((ctx), (cb), (opaque), (stringify(cb)), guard)
 /**
  * aio_notify: Force processing of pending events.
 diff --git a/include/qemu/main-loop.h b/include/qemu/main-loop.h
 index 8dbc6fcb89..85dd5ada9e 100644
 --- a/include/qemu/main-loop.h
 +++ b/include/qemu/main-loop.h
@@ -294,9 +294,12 @@ void qemu_cond_timedwait_iothread(QemuCond *cond, int ms);
 void qemu_fd_register(int fd);
 +#define qemu_bh_new_guarded(cb, opaque, guard) \
 +    qemu_bh_new_full((cb), (opaque), (stringify(cb)), guard)
 #define qemu_bh_new(cb, opaque) \
 -    qemu_bh_new_full((cb), (opaque), (stringify(cb)))
 -QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name);
 +    qemu_bh_new_full((cb), (opaque), (stringify(cb)), NULL)
 +QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name,
 +                         MemReentrancyGuard *reentrancy_guard);
 void qemu_bh_schedule_idle(QEMUBH *bh);
 enum {
 diff --git a/tests/unit/ptimer-test-stubs.c b/tests/unit/ptimer-test-stubs.c
 index 2a3ef58799..a7a2d08e7e 100644
 --- a/tests/unit/ptimer-test-stubs.c
 +++ b/tests/unit/ptimer-test-stubs.c
@@ -108,7 +108,8 @@ int64_t qemu_clock_deadline_ns_all(QEMUClockType type, int attr_mask)
     return deadline;
 }
 -QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name)
 +QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name,
 +                         MemReentrancyGuard *reentrancy_guard)
 {
     QEMUBH *bh = g_new(QEMUBH, 1);
 diff --git a/util/async.c b/util/async.c
 index 2a63bf90f2..1fff02e7fc 100644
 --- a/util/async.c
 +++ b/util/async.c
@@ -62,6 +62,7 @@ struct QEMUBH {
     void *opaque;
     QSLIST_ENTRY(QEMUBH) next;
     unsigned flags;
 +    MemReentrancyGuard *reentrancy_guard;
 };
 /* Called concurrently from any thread */
@@ -127,7 +128,7 @@ void aio_bh_schedule_oneshot_full(AioContext *ctx, QEMUBHFunc *cb,
 }
 QEMUBH *aio_bh_new_full(AioContext *ctx, QEMUBHFunc *cb, void *opaque,
 -                        const char *name)
 +                        const char *name, MemReentrancyGuard *reentrancy_guard)
 {
     QEMUBH *bh;
     bh = g_new(QEMUBH, 1);
@@ -136,13 +137,28 @@ QEMUBH *aio_bh_new_full(AioContext *ctx, QEMUBHFunc *cb, void *opaque,
         .cb = cb,
         .opaque = opaque,
         .name = name,
 +        .reentrancy_guard = reentrancy_guard,
     };
     return bh;
 }
 void aio_bh_call(QEMUBH *bh)
 {
 +    bool last_engaged_in_io = false;
 +
 +    if (bh->reentrancy_guard) {
 +        last_engaged_in_io = bh->reentrancy_guard->engaged_in_io;
 +        if (bh->reentrancy_guard->engaged_in_io) {
 +            trace_reentrant_aio(bh->ctx, bh->name);
 +        }
 +        bh->reentrancy_guard->engaged_in_io = true;
 +    }
 +
     bh->cb(bh->opaque);
 +
 +    if (bh->reentrancy_guard) {
 +        bh->reentrancy_guard->engaged_in_io = last_engaged_in_io;
 +    }
 }
 /* Multiple occurrences of aio_bh_poll cannot be called concurrently. */
 diff --git a/util/main-loop.c b/util/main-loop.c
 index 06b18b195c..1eacf04691 100644
 --- a/util/main-loop.c
 +++ b/util/main-loop.c
@@ -544,9 +544,11 @@ void main_loop_wait(int nonblocking)
 /* Functions to operate on the main QEMU AioContext.  */
 -QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name)
 +QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name,
 +                         MemReentrancyGuard *reentrancy_guard)
 {
 -    return aio_bh_new_full(qemu_aio_context, cb, opaque, name);
 +    return aio_bh_new_full(qemu_aio_context, cb, opaque, name,
 +                           reentrancy_guard);
 }
 /*
 diff --git a/util/trace-events b/util/trace-events
 index c8f53d7d9f..dc3b1eb3bf 100644
 --- a/util/trace-events
 +++ b/util/trace-events
@@ -11,6 +11,7 @@ poll_remove(void *ctx, void *node, int fd) "ctx %p node %p fd %d"
 # async.c
 aio_co_schedule(void *ctx, void *co) "ctx %p co %p"
 aio_co_schedule_bh_cb(void *ctx, void *co) "ctx %p co %p"
 +reentrant_aio(void *ctx, const char *name) "ctx %p name %s"
 # thread-pool.c
 thread_pool_submit(void *pool, void *req, void *opaque) "pool %p req %p opaque %p"
 -- 
 2.37.3
--- a/SOURCES/kvm-async-avoid-use-after-free-on-re-entrancy-guard.patch
+++ b/SOURCES/kvm-async-avoid-use-after-free-on-re-entrancy-guard.patch
@ -0,0 +1,71 @@
 From d754050d260e2ad890cecd975df6e163c531b40e Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Tue, 9 May 2023 10:29:03 -0400
 Subject: [PATCH 09/15] async: avoid use-after-free on re-entrancy guard
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 277: memory: prevent dma-reentracy issues
 RH-Bugzilla: 1999236
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [9/12] d357650e581c3921bbfe3e2fde5e3f55853b5fab (redhat/rhel/src/qemu-kvm/jons-qemu-kvm-2)
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1999236
 Upstream: Merged
 CVE: CVE-2021-3750
 commit 7915bd06f25e1803778081161bf6fa10c42dc7cd
 Author: Alexander Bulekov <alxndr@bu.edu>
 Date:   Mon May 1 10:19:56 2023 -0400
    async: avoid use-after-free on re-entrancy guard
    A BH callback can free the BH, causing a use-after-free in aio_bh_call.
    Fix that by keeping a local copy of the re-entrancy guard pointer.
    Buglink: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58513
    Fixes: 9c86c97f12 ("async: Add an optional reentrancy guard to the BH API")
    Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
    Message-Id: <20230501141956.3444868-1-alxndr@bu.edu>
    Reviewed-by: Thomas Huth <thuth@redhat.com>
    Signed-off-by: Thomas Huth <thuth@redhat.com>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 util/async.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)
 diff --git a/util/async.c b/util/async.c
 index 1fff02e7fc..ffe0541c3b 100644
 --- a/util/async.c
 +++ b/util/async.c
@@ -146,18 +146,20 @@ void aio_bh_call(QEMUBH *bh)
 {
     bool last_engaged_in_io = false;
 -    if (bh->reentrancy_guard) {
 -        last_engaged_in_io = bh->reentrancy_guard->engaged_in_io;
 -        if (bh->reentrancy_guard->engaged_in_io) {
 +    /* Make a copy of the guard-pointer as cb may free the bh */
 +    MemReentrancyGuard *reentrancy_guard = bh->reentrancy_guard;
 +    if (reentrancy_guard) {
 +        last_engaged_in_io = reentrancy_guard->engaged_in_io;
 +        if (reentrancy_guard->engaged_in_io) {
             trace_reentrant_aio(bh->ctx, bh->name);
         }
 -        bh->reentrancy_guard->engaged_in_io = true;
 +        reentrancy_guard->engaged_in_io = true;
     }
     bh->cb(bh->opaque);
 -    if (bh->reentrancy_guard) {
 -        bh->reentrancy_guard->engaged_in_io = last_engaged_in_io;
 +    if (reentrancy_guard) {
 +        reentrancy_guard->engaged_in_io = last_engaged_in_io;
     }
 }
 -- 
 2.37.3
--- a/SOURCES/kvm-async-clarify-usage-of-barriers-in-the-polling-case.patch
+++ b/SOURCES/kvm-async-clarify-usage-of-barriers-in-the-polling-case.patch
@ -0,0 +1,66 @@
 From 187eb7a418af93375e42298d06e231e2bec3cf00 Mon Sep 17 00:00:00 2001
 From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date: Thu, 9 Mar 2023 08:15:42 -0500
 Subject: [PATCH 10/13] async: clarify usage of barriers in the polling case
 RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-MergeRequest: 263: qatomic: add smp_mb__before/after_rmw()
 RH-Bugzilla: 2168472
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: Eric Auger <eric.auger@redhat.com>
 RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
 RH-Acked-by: David Hildenbrand <david@redhat.com>
 RH-Commit: [10/10] 3be07ccc6137a0336becfe63a818d9cbadb38e9c
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2168472
 commit 6229438cca037d42f44a96d38feb15cb102a444f
 Author: Paolo Bonzini <pbonzini@redhat.com>
 Date:   Mon Mar 6 10:43:52 2023 +0100
    async: clarify usage of barriers in the polling case
    Explain that aio_context_notifier_poll() relies on
    aio_notify_accept() to catch all the memory writes that were
    done before ctx->notified was set to true.
    Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
    Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 ---
 util/async.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)
 diff --git a/util/async.c b/util/async.c
 index 795fe699b6..2a63bf90f2 100644
 --- a/util/async.c
 +++ b/util/async.c
@@ -463,8 +463,9 @@ void aio_notify_accept(AioContext *ctx)
     qatomic_set(&ctx->notified, false);
     /*
 -     * Write ctx->notified before reading e.g. bh->flags.  Pairs with smp_wmb
 -     * in aio_notify.
 +     * Order reads of ctx->notified (in aio_context_notifier_poll()) and the
 +     * above clearing of ctx->notified before reads of e.g. bh->flags.  Pairs
 +     * with smp_wmb() in aio_notify.
      */
     smp_mb();
 }
@@ -487,6 +488,11 @@ static bool aio_context_notifier_poll(void *opaque)
     EventNotifier *e = opaque;
     AioContext *ctx = container_of(e, AioContext, notifier);
 +    /*
 +     * No need for load-acquire because we just want to kick the
 +     * event loop.  aio_notify_accept() takes care of synchronizing
 +     * the event loop with the producers.
 +     */
     return qatomic_read(&ctx->notified);
 }
 -- 
 2.37.3
--- a/SOURCES/kvm-async-update-documentation-of-the-memory-barriers.patch
+++ b/SOURCES/kvm-async-update-documentation-of-the-memory-barriers.patch
@ -0,0 +1,111 @@
 From ea3856bb545d19499602830cdc3076d83a981e7a Mon Sep 17 00:00:00 2001
 From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date: Thu, 9 Mar 2023 08:15:36 -0500
 Subject: [PATCH 09/13] async: update documentation of the memory barriers
 RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-MergeRequest: 263: qatomic: add smp_mb__before/after_rmw()
 RH-Bugzilla: 2168472
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: Eric Auger <eric.auger@redhat.com>
 RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
 RH-Acked-by: David Hildenbrand <david@redhat.com>
 RH-Commit: [9/10] d471da2acf7a107cf75f3327c5e8d7456307160e
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2168472
 commit 8dd48650b43dfde4ebea34191ac267e474bcc29e
 Author: Paolo Bonzini <pbonzini@redhat.com>
 Date:   Mon Mar 6 10:15:06 2023 +0100
    async: update documentation of the memory barriers
    Ever since commit 8c6b0356b539 ("util/async: make bh_aio_poll() O(1)",
    2020-02-22), synchronization between qemu_bh_schedule() and aio_bh_poll()
    is happening when the bottom half is enqueued in the bh_list; not
    when the flags are set.  Update the documentation to match.
    Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 ---
 util/async.c | 33 +++++++++++++++++++--------------
 1 file changed, 19 insertions(+), 14 deletions(-)
 diff --git a/util/async.c b/util/async.c
 index 6f6717a34b..795fe699b6 100644
 --- a/util/async.c
 +++ b/util/async.c
@@ -71,14 +71,21 @@ static void aio_bh_enqueue(QEMUBH *bh, unsigned new_flags)
     unsigned old_flags;
     /*
 -     * The memory barrier implicit in qatomic_fetch_or makes sure that:
 -     * 1. idle & any writes needed by the callback are done before the
 -     *    locations are read in the aio_bh_poll.
 -     * 2. ctx is loaded before the callback has a chance to execute and bh
 -     *    could be freed.
 +     * Synchronizes with atomic_fetch_and() in aio_bh_dequeue(), ensuring that
 +     * insertion starts after BH_PENDING is set.
      */
     old_flags = qatomic_fetch_or(&bh->flags, BH_PENDING | new_flags);
 +
     if (!(old_flags & BH_PENDING)) {
 +        /*
 +         * At this point the bottom half becomes visible to aio_bh_poll().
 +         * This insertion thus synchronizes with QSLIST_MOVE_ATOMIC in
 +         * aio_bh_poll(), ensuring that:
 +         * 1. any writes needed by the callback are visible from the callback
 +         *    after aio_bh_dequeue() returns bh.
 +         * 2. ctx is loaded before the callback has a chance to execute and bh
 +         *    could be freed.
 +         */
         QSLIST_INSERT_HEAD_ATOMIC(&ctx->bh_list, bh, next);
     }
@@ -97,11 +104,8 @@ static QEMUBH *aio_bh_dequeue(BHList *head, unsigned *flags)
     QSLIST_REMOVE_HEAD(head, next);
     /*
 -     * The qatomic_and is paired with aio_bh_enqueue().  The implicit memory
 -     * barrier ensures that the callback sees all writes done by the scheduling
 -     * thread.  It also ensures that the scheduling thread sees the cleared
 -     * flag before bh->cb has run, and thus will call aio_notify again if
 -     * necessary.
 +     * Synchronizes with qatomic_fetch_or() in aio_bh_enqueue(), ensuring that
 +     * the removal finishes before BH_PENDING is reset.
      */
     *flags = qatomic_fetch_and(&bh->flags,
                               ~(BH_PENDING | BH_SCHEDULED | BH_IDLE));
@@ -148,6 +152,7 @@ int aio_bh_poll(AioContext *ctx)
     BHListSlice *s;
     int ret = 0;
 +    /* Synchronizes with QSLIST_INSERT_HEAD_ATOMIC in aio_bh_enqueue().  */
     QSLIST_MOVE_ATOMIC(&slice.bh_list, &ctx->bh_list);
     QSIMPLEQ_INSERT_TAIL(&ctx->bh_slice_list, &slice, next);
@@ -437,15 +442,15 @@ LuringState *aio_get_linux_io_uring(AioContext *ctx)
 void aio_notify(AioContext *ctx)
 {
     /*
 -     * Write e.g. bh->flags before writing ctx->notified.  Pairs with smp_mb in
 -     * aio_notify_accept.
 +     * Write e.g. ctx->bh_list before writing ctx->notified.  Pairs with
 +     * smp_mb() in aio_notify_accept().
      */
     smp_wmb();
     qatomic_set(&ctx->notified, true);
     /*
 -     * Write ctx->notified before reading ctx->notify_me.  Pairs
 -     * with smp_mb in aio_ctx_prepare or aio_poll.
 +     * Write ctx->notified (and also ctx->bh_list) before reading ctx->notify_me.
 +     * Pairs with smp_mb() in aio_ctx_prepare or aio_poll.
      */
     smp_mb();
     if (qatomic_read(&ctx->notify_me)) {
 -- 
 2.37.3
--- a/SOURCES/kvm-backends-hostmem-Fix-support-of-memory-backend-memfd.patch
+++ b/SOURCES/kvm-backends-hostmem-Fix-support-of-memory-backend-memfd.patch
@ -0,0 +1,71 @@
 From 60da56e3685969493ae483c3cc2c66af13d00baf Mon Sep 17 00:00:00 2001
 From: Thomas Huth <thuth@redhat.com>
 Date: Wed, 10 Aug 2022 14:57:18 +0200
 Subject: [PATCH 1/3] backends/hostmem: Fix support of memory-backend-memfd in
 qemu_maxrampagesize()
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Cédric Le Goater <None>
 RH-MergeRequest: 221: backends/hostmem: Fix support of memory-backend-memfd in qemu_maxrampagesize()
 RH-Bugzilla: 2117149
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: David Hildenbrand <david@redhat.com>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Commit: [1/1] b5a1047750af32c0a261b8385ea0e819eb16681a
 It is currently not possible yet to use "memory-backend-memfd" on s390x
 with hugepages enabled. This problem is caused by qemu_maxrampagesize()
 not taking memory-backend-memfd objects into account yet, so the code
 in s390_memory_init() fails to enable the huge page support there via
 s390_set_max_pagesize(). Fix it by generalizing the code, so that it
 looks at qemu_ram_pagesize(memdev->mr.ram_block) instead of re-trying
 to get the information from the filesystem.
 Suggested-by: David Hildenbrand <david@redhat.com>
 Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2116496
 Message-Id: <20220810125720.3849835-2-thuth@redhat.com>
 Reviewed-by: David Hildenbrand <david@redhat.com>
 Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 (cherry picked from commit 8be934b70e923104da883b990dee18f02552d40e)
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2117149
 [clg: Resolved conflict on qemu_real_host_page_size() ]
 Signed-off-by: Cédric Le Goater <clg@redhat.com>
 ---
 backends/hostmem.c | 14 ++------------
 1 file changed, 2 insertions(+), 12 deletions(-)
 diff --git a/backends/hostmem.c b/backends/hostmem.c
 index 4c05862ed5..0c4654ea85 100644
 --- a/backends/hostmem.c
 +++ b/backends/hostmem.c
@@ -305,22 +305,12 @@ bool host_memory_backend_is_mapped(HostMemoryBackend *backend)
     return backend->is_mapped;
 }
 -#ifdef __linux__
 size_t host_memory_backend_pagesize(HostMemoryBackend *memdev)
 {
 -    Object *obj = OBJECT(memdev);
 -    char *path = object_property_get_str(obj, "mem-path", NULL);
 -    size_t pagesize = qemu_mempath_getpagesize(path);
 -
 -    g_free(path);
 +    size_t pagesize = qemu_ram_pagesize(memdev->mr.ram_block);
 +    g_assert(pagesize >= qemu_real_host_page_size);
     return pagesize;
 }
 -#else
 -size_t host_memory_backend_pagesize(HostMemoryBackend *memdev)
 -{
 -    return qemu_real_host_page_size;
 -}
 -#endif
 static void
 host_memory_backend_memory_complete(UserCreatable *uc, Error **errp)
 -- 
 2.35.3
--- a/SOURCES/kvm-bcm2835_property-disable-reentrancy-detection-for-io.patch
+++ b/SOURCES/kvm-bcm2835_property-disable-reentrancy-detection-for-io.patch
@ -0,0 +1,58 @@
 From 7715635d018351e0a5c4c25aec2c71a2fe3b9e69 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Tue, 9 May 2023 10:29:03 -0400
 Subject: [PATCH 06/15] bcm2835_property: disable reentrancy detection for
 iomem
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 277: memory: prevent dma-reentracy issues
 RH-Bugzilla: 1999236
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [6/12] 4d6187430ca1c4309a36824c0c6815d2a763db1a (redhat/rhel/src/qemu-kvm/jons-qemu-kvm-2)
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1999236
 Upstream: Merged
 CVE: CVE-2021-3750
 commit 985c4a4e547afb9573b6bd6843d20eb2c3d1d1cd
 Author: Alexander Bulekov <alxndr@bu.edu>
 Date:   Thu Apr 27 17:10:11 2023 -0400
    bcm2835_property: disable reentrancy detection for iomem
    As the code is designed for re-entrant calls from bcm2835_property to
    bcm2835_mbox and back into bcm2835_property, mark iomem as
    reentrancy-safe.
    Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
    Reviewed-by: Thomas Huth <thuth@redhat.com>
    Message-Id: <20230427211013.2994127-7-alxndr@bu.edu>
    Signed-off-by: Thomas Huth <thuth@redhat.com>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 hw/misc/bcm2835_property.c | 7 +++++++
 1 file changed, 7 insertions(+)
 diff --git a/hw/misc/bcm2835_property.c b/hw/misc/bcm2835_property.c
 index 73941bdae9..022b5a849c 100644
 --- a/hw/misc/bcm2835_property.c
 +++ b/hw/misc/bcm2835_property.c
@@ -377,6 +377,13 @@ static void bcm2835_property_init(Object *obj)
     memory_region_init_io(&s->iomem, OBJECT(s), &bcm2835_property_ops, s,
                           TYPE_BCM2835_PROPERTY, 0x10);
 +
 +    /*
 +     * bcm2835_property_ops call into bcm2835_mbox, which in-turn reads from
 +     * iomem. As such, mark iomem as re-entracy safe.
 +     */
 +    s->iomem.disable_reentrancy_guard = true;
 +
     sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
     sysbus_init_irq(SYS_BUS_DEVICE(s), &s->mbox_irq);
 }
 -- 
 2.37.3
--- a/SOURCES/kvm-block-Collapse-padded-I-O-vecs-exceeding-IOV_MAX.patch
+++ b/SOURCES/kvm-block-Collapse-padded-I-O-vecs-exceeding-IOV_MAX.patch
@ -0,0 +1,359 @@
 From 1f7520baa6f0bf02ccba2ebfe7d1d5bf6520f95a Mon Sep 17 00:00:00 2001
 From: Hanna Czenczek <hreitz@redhat.com>
 Date: Tue, 11 Apr 2023 19:34:16 +0200
 Subject: [PATCH 2/5] block: Collapse padded I/O vecs exceeding IOV_MAX
 RH-Author: Hanna Czenczek <hreitz@redhat.com>
 RH-MergeRequest: 291: block: Split padded I/O vectors exceeding IOV_MAX
 RH-Bugzilla: 2141964
 RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Commit: [2/5] 1d86ce8398e4ab66e308a686f9855c963e52b0a9
 When processing vectored guest requests that are not aligned to the
 storage request alignment, we pad them by adding head and/or tail
 buffers for a read-modify-write cycle.
 The guest can submit I/O vectors up to IOV_MAX (1024) in length, but
 with this padding, the vector can exceed that limit.  As of
 4c002cef0e9abe7135d7916c51abce47f7fc1ee2 ("util/iov: make
 qemu_iovec_init_extended() honest"), we refuse to pad vectors beyond the
 limit, instead returning an error to the guest.
 To the guest, this appears as a random I/O error.  We should not return
 an I/O error to the guest when it issued a perfectly valid request.
 Before 4c002cef0e9abe7135d7916c51abce47f7fc1ee2, we just made the vector
 longer than IOV_MAX, which generally seems to work (because the guest
 assumes a smaller alignment than we really have, file-posix's
 raw_co_prw() will generally see bdrv_qiov_is_aligned() return false, and
 so emulate the request, so that the IOV_MAX does not matter).  However,
 that does not seem exactly great.
 I see two ways to fix this problem:
 1. We split such long requests into two requests.
 2. We join some elements of the vector into new buffers to make it
   shorter.
 I am wary of (1), because it seems like it may have unintended side
 effects.
 (2) on the other hand seems relatively simple to implement, with
 hopefully few side effects, so this patch does that.
 To do this, the use of qemu_iovec_init_extended() in bdrv_pad_request()
 is effectively replaced by the new function bdrv_create_padded_qiov(),
 which not only wraps the request IOV with padding head/tail, but also
 ensures that the resulting vector will not have more than IOV_MAX
 elements.  Putting that functionality into qemu_iovec_init_extended() is
 infeasible because it requires allocating a bounce buffer; doing so
 would require many more parameters (buffer alignment, how to initialize
 the buffer, and out parameters like the buffer, its length, and the
 original elements), which is not reasonable.
 Conversely, it is not difficult to move qemu_iovec_init_extended()'s
 functionality into bdrv_create_padded_qiov() by using public
 qemu_iovec_* functions, so that is what this patch does.
 Because bdrv_pad_request() was the only "serious" user of
 qemu_iovec_init_extended(), the next patch will remove the latter
 function, so the functionality is not implemented twice.
 Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2141964
 Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 Message-Id: <20230411173418.19549-3-hreitz@redhat.com>
 Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
 (cherry picked from commit 18743311b829cafc1737a5f20bc3248d5f91ee2a)
 Conflicts:
 	block/io.c: Downstream bdrv_pad_request() has no @flags
        parameter.
 Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 ---
 block/io.c | 166 ++++++++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 151 insertions(+), 15 deletions(-)
 diff --git a/block/io.c b/block/io.c
 index c3e7301613..0fe8f0dd40 100644
 --- a/block/io.c
 +++ b/block/io.c
@@ -1624,6 +1624,14 @@ out:
  * @merge_reads is true for small requests,
  * if @buf_len == @head + bytes + @tail. In this case it is possible that both
  * head and tail exist but @buf_len == align and @tail_buf == @buf.
 + *
 + * @write is true for write requests, false for read requests.
 + *
 + * If padding makes the vector too long (exceeding IOV_MAX), then we need to
 + * merge existing vector elements into a single one.  @collapse_bounce_buf acts
 + * as the bounce buffer in such cases.  @pre_collapse_qiov has the pre-collapse
 + * I/O vector elements so for read requests, the data can be copied back after
 + * the read is done.
  */
 typedef struct BdrvRequestPadding {
     uint8_t *buf;
@@ -1632,11 +1640,17 @@ typedef struct BdrvRequestPadding {
     size_t head;
     size_t tail;
     bool merge_reads;
 +    bool write;
     QEMUIOVector local_qiov;
 +
 +    uint8_t *collapse_bounce_buf;
 +    size_t collapse_len;
 +    QEMUIOVector pre_collapse_qiov;
 } BdrvRequestPadding;
 static bool bdrv_init_padding(BlockDriverState *bs,
                               int64_t offset, int64_t bytes,
 +                              bool write,
                               BdrvRequestPadding *pad)
 {
     int64_t align = bs->bl.request_alignment;
@@ -1668,6 +1682,8 @@ static bool bdrv_init_padding(BlockDriverState *bs,
         pad->tail_buf = pad->buf + pad->buf_len - align;
     }
 +    pad->write = write;
 +
     return true;
 }
@@ -1733,8 +1749,23 @@ zero_mem:
     return 0;
 }
 -static void bdrv_padding_destroy(BdrvRequestPadding *pad)
 +/**
 + * Free *pad's associated buffers, and perform any necessary finalization steps.
 + */
 +static void bdrv_padding_finalize(BdrvRequestPadding *pad)
 {
 +    if (pad->collapse_bounce_buf) {
 +        if (!pad->write) {
 +            /*
 +             * If padding required elements in the vector to be collapsed into a
 +             * bounce buffer, copy the bounce buffer content back
 +             */
 +            qemu_iovec_from_buf(&pad->pre_collapse_qiov, 0,
 +                                pad->collapse_bounce_buf, pad->collapse_len);
 +        }
 +        qemu_vfree(pad->collapse_bounce_buf);
 +        qemu_iovec_destroy(&pad->pre_collapse_qiov);
 +    }
     if (pad->buf) {
         qemu_vfree(pad->buf);
         qemu_iovec_destroy(&pad->local_qiov);
@@ -1742,6 +1773,101 @@ static void bdrv_padding_destroy(BdrvRequestPadding *pad)
     memset(pad, 0, sizeof(*pad));
 }
 +/*
 + * Create pad->local_qiov by wrapping @iov in the padding head and tail, while
 + * ensuring that the resulting vector will not exceed IOV_MAX elements.
 + *
 + * To ensure this, when necessary, the first two or three elements of @iov are
 + * merged into pad->collapse_bounce_buf and replaced by a reference to that
 + * bounce buffer in pad->local_qiov.
 + *
 + * After performing a read request, the data from the bounce buffer must be
 + * copied back into pad->pre_collapse_qiov (e.g. by bdrv_padding_finalize()).
 + */
 +static int bdrv_create_padded_qiov(BlockDriverState *bs,
 +                                   BdrvRequestPadding *pad,
 +                                   struct iovec *iov, int niov,
 +                                   size_t iov_offset, size_t bytes)
 +{
 +    int padded_niov, surplus_count, collapse_count;
 +
 +    /* Assert this invariant */
 +    assert(niov <= IOV_MAX);
 +
 +    /*
 +     * Cannot pad if resulting length would exceed SIZE_MAX.  Returning an error
 +     * to the guest is not ideal, but there is little else we can do.  At least
 +     * this will practically never happen on 64-bit systems.
 +     */
 +    if (SIZE_MAX - pad->head < bytes ||
 +        SIZE_MAX - pad->head - bytes < pad->tail)
 +    {
 +        return -EINVAL;
 +    }
 +
 +    /* Length of the resulting IOV if we just concatenated everything */
 +    padded_niov = !!pad->head + niov + !!pad->tail;
 +
 +    qemu_iovec_init(&pad->local_qiov, MIN(padded_niov, IOV_MAX));
 +
 +    if (pad->head) {
 +        qemu_iovec_add(&pad->local_qiov, pad->buf, pad->head);
 +    }
 +
 +    /*
 +     * If padded_niov > IOV_MAX, we cannot just concatenate everything.
 +     * Instead, merge the first two or three elements of @iov to reduce the
 +     * number of vector elements as necessary.
 +     */
 +    if (padded_niov > IOV_MAX) {
 +        /*
 +         * Only head and tail can have lead to the number of entries exceeding
 +         * IOV_MAX, so we can exceed it by the head and tail at most.  We need
 +         * to reduce the number of elements by `surplus_count`, so we merge that
 +         * many elements plus one into one element.
 +         */
 +        surplus_count = padded_niov - IOV_MAX;
 +        assert(surplus_count <= !!pad->head + !!pad->tail);
 +        collapse_count = surplus_count + 1;
 +
 +        /*
 +         * Move the elements to collapse into `pad->pre_collapse_qiov`, then
 +         * advance `iov` (and associated variables) by those elements.
 +         */
 +        qemu_iovec_init(&pad->pre_collapse_qiov, collapse_count);
 +        qemu_iovec_concat_iov(&pad->pre_collapse_qiov, iov,
 +                              collapse_count, iov_offset, SIZE_MAX);
 +        iov += collapse_count;
 +        iov_offset = 0;
 +        niov -= collapse_count;
 +        bytes -= pad->pre_collapse_qiov.size;
 +
 +        /*
 +         * Construct the bounce buffer to match the length of the to-collapse
 +         * vector elements, and for write requests, initialize it with the data
 +         * from those elements.  Then add it to `pad->local_qiov`.
 +         */
 +        pad->collapse_len = pad->pre_collapse_qiov.size;
 +        pad->collapse_bounce_buf = qemu_blockalign(bs, pad->collapse_len);
 +        if (pad->write) {
 +            qemu_iovec_to_buf(&pad->pre_collapse_qiov, 0,
 +                              pad->collapse_bounce_buf, pad->collapse_len);
 +        }
 +        qemu_iovec_add(&pad->local_qiov,
 +                       pad->collapse_bounce_buf, pad->collapse_len);
 +    }
 +
 +    qemu_iovec_concat_iov(&pad->local_qiov, iov, niov, iov_offset, bytes);
 +
 +    if (pad->tail) {
 +        qemu_iovec_add(&pad->local_qiov,
 +                       pad->buf + pad->buf_len - pad->tail, pad->tail);
 +    }
 +
 +    assert(pad->local_qiov.niov == MIN(padded_niov, IOV_MAX));
 +    return 0;
 +}
 +
 /*
  * bdrv_pad_request
  *
@@ -1749,6 +1875,8 @@ static void bdrv_padding_destroy(BdrvRequestPadding *pad)
  * read of padding, bdrv_padding_rmw_read() should be called separately if
  * needed.
  *
 + * @write is true for write requests, false for read requests.
 + *
  * Request parameters (@qiov, &qiov_offset, &offset, &bytes) are in-out:
  *  - on function start they represent original request
  *  - on failure or when padding is not needed they are unchanged
@@ -1757,25 +1885,33 @@ static void bdrv_padding_destroy(BdrvRequestPadding *pad)
 static int bdrv_pad_request(BlockDriverState *bs,
                             QEMUIOVector **qiov, size_t *qiov_offset,
                             int64_t *offset, int64_t *bytes,
 +                            bool write,
                             BdrvRequestPadding *pad, bool *padded)
 {
     int ret;
 +    struct iovec *sliced_iov;
 +    int sliced_niov;
 +    size_t sliced_head, sliced_tail;
     bdrv_check_qiov_request(*offset, *bytes, *qiov, *qiov_offset, &error_abort);
 -    if (!bdrv_init_padding(bs, *offset, *bytes, pad)) {
 +    if (!bdrv_init_padding(bs, *offset, *bytes, write, pad)) {
         if (padded) {
             *padded = false;
         }
         return 0;
     }
 -    ret = qemu_iovec_init_extended(&pad->local_qiov, pad->buf, pad->head,
 -                                   *qiov, *qiov_offset, *bytes,
 -                                   pad->buf + pad->buf_len - pad->tail,
 -                                   pad->tail);
 +    sliced_iov = qemu_iovec_slice(*qiov, *qiov_offset, *bytes,
 +                                  &sliced_head, &sliced_tail,
 +                                  &sliced_niov);
 +
 +    /* Guaranteed by bdrv_check_qiov_request() */
 +    assert(*bytes <= SIZE_MAX);
 +    ret = bdrv_create_padded_qiov(bs, pad, sliced_iov, sliced_niov,
 +                                  sliced_head, *bytes);
     if (ret < 0) {
 -        bdrv_padding_destroy(pad);
 +        bdrv_padding_finalize(pad);
         return ret;
     }
     *bytes += pad->head + pad->tail;
@@ -1836,8 +1972,8 @@ int coroutine_fn bdrv_co_preadv_part(BdrvChild *child,
         flags |= BDRV_REQ_COPY_ON_READ;
     }
 -    ret = bdrv_pad_request(bs, &qiov, &qiov_offset, &offset, &bytes, &pad,
 -                           NULL);
 +    ret = bdrv_pad_request(bs, &qiov, &qiov_offset, &offset, &bytes, false,
 +                           &pad, NULL);
     if (ret < 0) {
         goto fail;
     }
@@ -1847,7 +1983,7 @@ int coroutine_fn bdrv_co_preadv_part(BdrvChild *child,
                               bs->bl.request_alignment,
                               qiov, qiov_offset, flags);
     tracked_request_end(&req);
 -    bdrv_padding_destroy(&pad);
 +    bdrv_padding_finalize(&pad);
 fail:
     bdrv_dec_in_flight(bs);
@@ -2167,7 +2303,7 @@ static int coroutine_fn bdrv_co_do_zero_pwritev(BdrvChild *child,
     bool padding;
     BdrvRequestPadding pad;
 -    padding = bdrv_init_padding(bs, offset, bytes, &pad);
 +    padding = bdrv_init_padding(bs, offset, bytes, true, &pad);
     if (padding) {
         bdrv_make_request_serialising(req, align);
@@ -2214,7 +2350,7 @@ static int coroutine_fn bdrv_co_do_zero_pwritev(BdrvChild *child,
     }
 out:
 -    bdrv_padding_destroy(&pad);
 +    bdrv_padding_finalize(&pad);
     return ret;
 }
@@ -2280,8 +2416,8 @@ int coroutine_fn bdrv_co_pwritev_part(BdrvChild *child,
          * bdrv_co_do_zero_pwritev() does aligning by itself, so, we do
          * alignment only if there is no ZERO flag.
          */
 -        ret = bdrv_pad_request(bs, &qiov, &qiov_offset, &offset, &bytes, &pad,
 -                               &padded);
 +        ret = bdrv_pad_request(bs, &qiov, &qiov_offset, &offset, &bytes, true,
 +                               &pad, &padded);
         if (ret < 0) {
             return ret;
         }
@@ -2310,7 +2446,7 @@ int coroutine_fn bdrv_co_pwritev_part(BdrvChild *child,
     ret = bdrv_aligned_pwritev(child, &req, offset, bytes, align,
                                qiov, qiov_offset, flags);
 -    bdrv_padding_destroy(&pad);
 +    bdrv_padding_finalize(&pad);
 out:
     tracked_request_end(&req);
 -- 
 2.39.3
--- a/SOURCES/kvm-block-Fix-pad_request-s-request-restriction.patch
+++ b/SOURCES/kvm-block-Fix-pad_request-s-request-restriction.patch
@ -0,0 +1,75 @@
 From b9866279996ee065cb524bf30bc70e22efbab303 Mon Sep 17 00:00:00 2001
 From: Hanna Czenczek <hreitz@redhat.com>
 Date: Fri, 14 Jul 2023 10:59:38 +0200
 Subject: [PATCH 5/5] block: Fix pad_request's request restriction
 RH-Author: Hanna Czenczek <hreitz@redhat.com>
 RH-MergeRequest: 291: block: Split padded I/O vectors exceeding IOV_MAX
 RH-Bugzilla: 2141964
 RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Commit: [5/5] f9188bd089d6c67185ea1accde20d491a2ed3193
 bdrv_pad_request() relies on requests' lengths not to exceed SIZE_MAX,
 which bdrv_check_qiov_request() does not guarantee.
 bdrv_check_request32() however will guarantee this, and both of
 bdrv_pad_request()'s callers (bdrv_co_preadv_part() and
 bdrv_co_pwritev_part()) already run it before calling
 bdrv_pad_request().  Therefore, bdrv_pad_request() can safely call
 bdrv_check_request32() without expecting error, too.
 In effect, this patch will not change guest-visible behavior.  It is a
 clean-up to tighten a condition to match what is guaranteed by our
 callers, and which exists purely to show clearly why the subsequent
 assertion (`assert(*bytes <= SIZE_MAX)`) is always true.
 Note there is a difference between the interfaces of
 bdrv_check_qiov_request() and bdrv_check_request32(): The former takes
 an errp, the latter does not, so we can no longer just pass
 &error_abort.  Instead, we need to check the returned value.  While we
 do expect success (because the callers have already run this function),
 an assert(ret == 0) is not much simpler than just to return an error if
 it occurs, so let us handle errors by returning them up the stack now.
 Reported-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 Message-id: 20230714085938.202730-1-hreitz@redhat.com
 Fixes: 18743311b829cafc1737a5f20bc3248d5f91ee2a
       ("block: Collapse padded I/O vecs exceeding IOV_MAX")
 Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 ---
 block/io.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)
 diff --git a/block/io.c b/block/io.c
 index 0fe8f0dd40..8ae57728a6 100644
 --- a/block/io.c
 +++ b/block/io.c
@@ -1893,7 +1893,11 @@ static int bdrv_pad_request(BlockDriverState *bs,
     int sliced_niov;
     size_t sliced_head, sliced_tail;
 -    bdrv_check_qiov_request(*offset, *bytes, *qiov, *qiov_offset, &error_abort);
 +    /* Should have been checked by the caller already */
 +    ret = bdrv_check_request32(*offset, *bytes, *qiov, *qiov_offset);
 +    if (ret < 0) {
 +        return ret;
 +    }
     if (!bdrv_init_padding(bs, *offset, *bytes, write, pad)) {
         if (padded) {
@@ -1906,7 +1910,7 @@ static int bdrv_pad_request(BlockDriverState *bs,
                                   &sliced_head, &sliced_tail,
                                   &sliced_niov);
 -    /* Guaranteed by bdrv_check_qiov_request() */
 +    /* Guaranteed by bdrv_check_request32() */
     assert(*bytes <= SIZE_MAX);
     ret = bdrv_create_padded_qiov(bs, pad, sliced_iov, sliced_niov,
                                   sliced_head, *bytes);
 -- 
 2.39.3
--- a/SOURCES/kvm-block-Lock-AioContext-for-drain_end-in-blockdev-reop.patch
+++ b/SOURCES/kvm-block-Lock-AioContext-for-drain_end-in-blockdev-reop.patch
@ -0,0 +1,63 @@
 From b21fa5ecd9acf2b91839a2915fb4bb39dac4c803 Mon Sep 17 00:00:00 2001
 From: Kevin Wolf <kwolf@redhat.com>
 Date: Thu, 3 Feb 2022 15:05:33 +0100
 Subject: [PATCH 2/5] block: Lock AioContext for drain_end in blockdev-reopen
 RH-Author: Kevin Wolf <kwolf@redhat.com>
 RH-MergeRequest: 142: block: Lock AioContext for drain_end in blockdev-reopen
 RH-Commit: [1/2] 98de3b5987f88ea6b4b503f623d6c4475574e037
 RH-Bugzilla: 2067118
 RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Hanna Reitz <hreitz@redhat.com>
 bdrv_subtree_drained_end() requires the caller to hold the AioContext
 lock for the drained node. Not doing this for nodes outside of the main
 AioContext leads to crashes when AIO_WAIT_WHILE() needs to wait and
 tries to temporarily release the lock.
 Fixes: 3908b7a8994fa5ef7a89aa58cd5a02fc58141592
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2046659
 Reported-by: Qing Wang <qinwang@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 Message-Id: <20220203140534.36522-2-kwolf@redhat.com>
 Reviewed-by: Hanna Reitz <hreitz@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit aba8205be0707b9d108e32254e186ba88107a869)
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
 blockdev.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)
 diff --git a/blockdev.c b/blockdev.c
 index b35072644e..565f6a81fd 100644
 --- a/blockdev.c
 +++ b/blockdev.c
@@ -3562,6 +3562,7 @@ void qmp_blockdev_reopen(BlockdevOptionsList *reopen_list, Error **errp)
 {
     BlockReopenQueue *queue = NULL;
     GSList *drained = NULL;
 +    GSList *p;
     /* Add each one of the BDS that we want to reopen to the queue */
     for (; reopen_list != NULL; reopen_list = reopen_list->next) {
@@ -3611,7 +3612,15 @@ void qmp_blockdev_reopen(BlockdevOptionsList *reopen_list, Error **errp)
 fail:
     bdrv_reopen_queue_free(queue);
 -    g_slist_free_full(drained, (GDestroyNotify) bdrv_subtree_drained_end);
 +    for (p = drained; p; p = p->next) {
 +        BlockDriverState *bs = p->data;
 +        AioContext *ctx = bdrv_get_aio_context(bs);
 +
 +        aio_context_acquire(ctx);
 +        bdrv_subtree_drained_end(bs);
 +        aio_context_release(ctx);
 +    }
 +    g_slist_free(drained);
 }
 void qmp_blockdev_del(const char *node_name, Error **errp)
 -- 
 2.27.0
--- a/SOURCES/kvm-block-Make-bdrv_refresh_limits-non-recursive.patch
+++ b/SOURCES/kvm-block-Make-bdrv_refresh_limits-non-recursive.patch
@ -0,0 +1,78 @@
 From 6348063b91b2370cc27153fd58fd11a6681631f6 Mon Sep 17 00:00:00 2001
 From: Hanna Reitz <hreitz@redhat.com>
 Date: Wed, 16 Feb 2022 11:53:53 +0100
 Subject: [PATCH 22/24] block: Make bdrv_refresh_limits() non-recursive
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Hanna Reitz <hreitz@redhat.com>
 RH-MergeRequest: 189: block: Make bdrv_refresh_limits() non-recursive
 RH-Commit: [1/3] 1a1fe37f8d8f0344dd8639d6cc9d884d1aff9096
 RH-Bugzilla: 2072932
 RH-Acked-by: Eric Blake <eblake@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 bdrv_refresh_limits() recurses down to the node's children.  That does
 not seem necessary: When we refresh limits on some node, and then
 recurse down and were to change one of its children's BlockLimits, then
 that would mean we noticed the changed limits by pure chance.  The fact
 that we refresh the parent's limits has nothing to do with it, so the
 reason for the change probably happened before this point in time, and
 we should have refreshed the limits then.
 Consequently, we should actually propagate block limits changes upwards,
 not downwards.  That is a separate and pre-existing issue, though, and
 so will not be addressed in this patch.
 The problem with recursing is that bdrv_refresh_limits() is not atomic.
 It begins with zeroing BDS.bl, and only then sets proper, valid limits.
 If we do not drain all nodes whose limits are refreshed, then concurrent
 I/O requests can encounter invalid request_alignment values and crash
 qemu.  Therefore, a recursing bdrv_refresh_limits() requires the whole
 subtree to be drained, which is currently not ensured by most callers.
 A non-recursive bdrv_refresh_limits() only requires the node in question
 to not receive I/O requests, and this is done by most callers in some
 way or another:
 - bdrv_open_driver() deals with a new node with no parents yet
 - bdrv_set_file_or_backing_noperm() acts on a drained node
 - bdrv_reopen_commit() acts only on drained nodes
 - bdrv_append() should in theory require the node to be drained; in
  practice most callers just lock the AioContext, which should at least
  be enough to prevent concurrent I/O requests from accessing invalid
  limits
 So we can resolve the bug by making bdrv_refresh_limits() non-recursive.
 Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1879437
 Signed-off-by: Hanna Reitz <hreitz@redhat.com>
 Reviewed-by: Eric Blake <eblake@redhat.com>
 Message-Id: <20220216105355.30729-2-hreitz@redhat.com>
 Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit 4d378bbd831bdd2f6e6adcd4ea5b77b6effaa627)
 Signed-off-by: Hanna Reitz <hreitz@redhat.com>
 ---
 block/io.c | 4 ----
 1 file changed, 4 deletions(-)
 diff --git a/block/io.c b/block/io.c
 index 4e4cb556c5..c3e7301613 100644
 --- a/block/io.c
 +++ b/block/io.c
@@ -189,10 +189,6 @@ void bdrv_refresh_limits(BlockDriverState *bs, Transaction *tran, Error **errp)
     QLIST_FOREACH(c, &bs->children, next) {
         if (c->role & (BDRV_CHILD_DATA | BDRV_CHILD_FILTERED | BDRV_CHILD_COW))
         {
 -            bdrv_refresh_limits(c->bs, tran, errp);
 -            if (*errp) {
 -                return;
 -            }
             bdrv_merge_limits(&bs->bl, &c->bs->bl);
             have_limits = true;
         }
 -- 
 2.35.3
--- a/SOURCES/kvm-block-Parse-filenames-only-when-explicitly-requested.patch
+++ b/SOURCES/kvm-block-Parse-filenames-only-when-explicitly-requested.patch
@ -1,16 +1,31 @@
-From 53153ebcf066e962cd73d7fcfeca53039be2a945 Mon Sep 17 00:00:00 2001
+From c4ba1f1755031a0ac2f600ed8c17e7dcb6b2b857 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
+From: Jon Maloy <jmaloy@redhat.com>
-Date: Thu, 25 Apr 2024 14:56:02 +0200
+Date: Wed, 5 Jun 2024 19:56:51 -0400
-Subject: [PATCH 4/4] block: Parse filenames only when explicitly requested
+Subject: [PATCH 5/5] block: Parse filenames only when explicitly requested
-RH-Author: Hana Czenczek <hczenczek@redhat.com>
+RH-Author: Jon Maloy <jmaloy@redhat.com>
-RH-MergeRequest: 1: CVE 2024-4467 (PRDSC)
+RH-MergeRequest: 5: EMBARGOED CVE-2024-4467 for rhel-8.10.z (PRDSC)
-RH-Jira: RHEL-46239
+RH-Jira: RHEL-35616
 RH-CVE: CVE-2024-4467
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Acked-by: Eric Blake <eblake@redhat.com>
+RH-Commit: [5/5] a3e197add64fc6950c4ac576e34d833dfae7ee34
-RH-Commit: [4/4] f44c2941d4419e60f16dea3e9adca164e75aa78d
+
 Conflicts: - brdv_open_child_common(): bdrv_graph_wrlock/unlock()
             don't exist in this code version. We ignore them.
 	     bdrv_open_inherit(): no_coroutine_fn/GRAPH_UNLOCKED
             doesn't exist. We ignore it.
           - Changes to bdrv_open_file_child() didn't apply cleanly,
             but fixing it is straight-forward.
           - GLOBAL_STATE_CODE() not present in this code. Ignoring it.
           - bdrv_open_file_child(): Need to continue setting of
 	     parent->file.
 commit f44c2941d4419e60f16dea3e9adca164e75aa78d
 Author: Kevin Wolf <kwolf@redhat.com>
 Date:   Thu Apr 25 14:56:02 2024 +0200
    block: Parse filenames only when explicitly requested
    When handling image filenames from legacy options such as -drive or from
    tools, these filenames are parsed for protocol prefixes, including for
@ -41,15 +56,17 @@ Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
    Reviewed-by: Hanna Czenczek <hreitz@redhat.com>
    Upstream: N/A, embargoed
    Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
- block.c | 90 ++++++++++++++++++++++++++++++++++++---------------------
+ block.c | 81 +++++++++++++++++++++++++++++++++++++++------------------
- 1 file changed, 57 insertions(+), 33 deletions(-)
+ 1 file changed, 56 insertions(+), 25 deletions(-)
 diff --git a/block.c b/block.c
-index 468cf5e67d..50bdd197b7 100644
+index 889f878565..ddebf50efa 100644
 --- a/block.c
 +++ b/block.c
-@@ -86,6 +86,7 @@ static BlockDriverState *bdrv_open_inherit(const char *filename,
+@@ -82,6 +82,7 @@ static BlockDriverState *bdrv_open_inherit(const char *filename,
                                            BlockDriverState *parent,
                                            const BdrvChildClass *child_class,
                                            BdrvChildRole child_role,
@ -57,7 +74,7 @@ index 468cf5e67d..50bdd197b7 100644
                                            Error **errp);
 static bool bdrv_recurse_has_child(BlockDriverState *bs,
-@@ -2058,7 +2059,8 @@ static void parse_json_protocol(QDict *options, const char **pfilename,
+@@ -1926,7 +1927,8 @@ static void parse_json_protocol(QDict *options, const char **pfilename,
  * block driver has been specified explicitly.
  */
 static int bdrv_fill_options(QDict **options, const char *filename,
@ -67,7 +84,7 @@ index 468cf5e67d..50bdd197b7 100644
 {
     const char *drvname;
     bool protocol = *flags & BDRV_O_PROTOCOL;
-@@ -2100,7 +2102,7 @@ static int bdrv_fill_options(QDict **options, const char *filename,
+@@ -1966,7 +1968,7 @@ static int bdrv_fill_options(QDict **options, const char *filename,
     if (protocol && filename) {
         if (!qdict_haskey(*options, "filename")) {
             qdict_put_str(*options, "filename", filename);
@ -76,7 +93,7 @@ index 468cf5e67d..50bdd197b7 100644
         } else {
             error_setg(errp, "Can't specify 'file' and 'filename' options at "
                              "the same time");
-@@ -3663,7 +3665,8 @@ int bdrv_open_backing_file(BlockDriverState *bs, QDict *parent_options,
+@@ -3439,7 +3441,8 @@ int bdrv_open_backing_file(BlockDriverState *bs, QDict *parent_options,
     }
     backing_hd = bdrv_open_inherit(backing_filename, reference, options, 0, bs,
@ -86,7 +103,7 @@ index 468cf5e67d..50bdd197b7 100644
     if (!backing_hd) {
         bs->open_flags |= BDRV_O_NO_BACKING;
         error_prepend(errp, "Could not open backing file: ");
-@@ -3697,7 +3700,8 @@ free_exit:
+@@ -3472,7 +3475,8 @@ free_exit:
 static BlockDriverState *
 bdrv_open_child_bs(const char *filename, QDict *options, const char *bdref_key,
                    BlockDriverState *parent, const BdrvChildClass *child_class,
@ -96,7 +113,7 @@ index 468cf5e67d..50bdd197b7 100644
 {
     BlockDriverState *bs = NULL;
     QDict *image_options;
-@@ -3728,7 +3732,8 @@ bdrv_open_child_bs(const char *filename, QDict *options, const char *bdref_key,
+@@ -3503,7 +3507,8 @@ bdrv_open_child_bs(const char *filename, QDict *options, const char *bdref_key,
     }
     bs = bdrv_open_inherit(filename, reference, image_options, 0,
@ -106,7 +123,7 @@ index 468cf5e67d..50bdd197b7 100644
     if (!bs) {
         goto done;
     }
-@@ -3738,6 +3743,33 @@ done:
+@@ -3513,6 +3518,29 @@ done:
     return bs;
 }
@ -121,18 +138,14 @@ index 468cf5e67d..50bdd197b7 100644
 +    BlockDriverState *bs;
 +    BdrvChild *child;
 +
 +    GLOBAL_STATE_CODE();
 +
 +    bs = bdrv_open_child_bs(filename, options, bdref_key, parent, child_class,
 +                            child_role, allow_none, parse_filename, errp);
 +    if (bs == NULL) {
 +        return NULL;
 +    }
 +
 +    bdrv_graph_wrlock();
 +    child = bdrv_attach_child(parent, bs, bdref_key, child_class, child_role,
 +                              errp);
 +    bdrv_graph_wrunlock();
 +
 +    return child;
 +}
@ -140,14 +153,11 @@ index 468cf5e67d..50bdd197b7 100644
 /*
  * Opens a disk image whose options are given as BlockdevRef in another block
  * device's options.
-@@ -3761,27 +3793,15 @@ BdrvChild *bdrv_open_child(const char *filename,
+@@ -3534,20 +3562,17 @@ BdrvChild *bdrv_open_child(const char *filename,
                            BdrvChildRole child_role,
                            bool allow_none, Error **errp)
 {
 -    BlockDriverState *bs;
 -    BdrvChild *child;
 -
 -    GLOBAL_STATE_CODE();
 -
 -    bs = bdrv_open_child_bs(filename, options, bdref_key, parent, child_class,
 -                            child_role, allow_none, errp);
@ -155,12 +165,8 @@ index 468cf5e67d..50bdd197b7 100644
 -        return NULL;
 -    }
 -
-    bdrv_graph_wrlock();
+-    return bdrv_attach_child(parent, bs, bdref_key, child_class, child_role,
 -    child = bdrv_attach_child(parent, bs, bdref_key, child_class, child_role,
 -                             errp);
 -    bdrv_graph_wrunlock();
 -
 -    return child;
 +    return bdrv_open_child_common(filename, options, bdref_key, parent,
 +                                  child_class, child_role, allow_none, false,
 +                                  errp);
@ -171,21 +177,24 @@ index 468cf5e67d..50bdd197b7 100644
 + * This does mostly the same as bdrv_open_child(), but for opening the primary
 + * child of a node. A notable difference from bdrv_open_child() is that it
 + * enables filename parsing for protocol names (including json:).
-  *
+ *
-  * @parent can move to a different AioContext in this function.
+ * @parent can move to a different AioContext in this function.
  */
-@@ -3796,8 +3816,8 @@ int bdrv_open_file_child(const char *filename,
+ int bdrv_open_file_child(const char *filename,
                          QDict *options, const char *bdref_key,
@@ -3558,8 +3583,9 @@ int bdrv_open_file_child(const char *filename,
     role = parent->drv->is_filter ?
         (BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY) : BDRV_CHILD_IMAGE;
-    if (!bdrv_open_child(filename, options, bdref_key, parent,
+-    parent->file = bdrv_open_child(filename, options, bdref_key, parent,
-                         &child_of_bds, role, false, errp))
+-                                   &child_of_bds, role, false, errp);
-+    if (!bdrv_open_child_common(filename, options, bdref_key, parent,
+    parent->file = bdrv_open_child_common(filename, options, bdref_key, parent,
-+                                &child_of_bds, role, false, true, errp))
+                                          &child_of_bds, role, false, true,
-     {
+                                          errp);
-         return -EINVAL;
+ 
     return parent->file ? 0 : -EINVAL;
 }
-@@ -3842,7 +3862,8 @@ BlockDriverState *bdrv_open_blockdev_ref(BlockdevRef *ref, Error **errp)
+@@ -3599,7 +3625,8 @@ BlockDriverState *bdrv_open_blockdev_ref(BlockdevRef *ref, Error **errp)
     }
@ -195,16 +204,15 @@ index 468cf5e67d..50bdd197b7 100644
     obj = NULL;
     qobject_unref(obj);
     visit_free(v);
-@@ -3932,7 +3953,7 @@ static BlockDriverState * no_coroutine_fn
+@@ -3690,6 +3717,7 @@ static BlockDriverState *bdrv_open_inherit(const char *filename,
- bdrv_open_inherit(const char *filename, const char *reference, QDict *options,
+                                            BlockDriverState *parent,
-                   int flags, BlockDriverState *parent,
+                                            const BdrvChildClass *child_class,
-                   const BdrvChildClass *child_class, BdrvChildRole child_role,
+                                            BdrvChildRole child_role,
-                  Error **errp)
+                                           bool parse_filename,
-+                  bool parse_filename, Error **errp)
+                                            Error **errp)
 {
     int ret;
-     BlockBackend *file = NULL;
+@@ -3733,9 +3761,11 @@ static BlockDriverState *bdrv_open_inherit(const char *filename,
@@ -3980,9 +4001,11 @@ bdrv_open_inherit(const char *filename, const char *reference, QDict *options,
     }
     /* json: syntax counts as explicit options, as if in the QDict */
@ -219,7 +227,7 @@ index 468cf5e67d..50bdd197b7 100644
     }
     bs->explicit_options = qdict_clone_shallow(options);
-@@ -4007,7 +4030,8 @@ bdrv_open_inherit(const char *filename, const char *reference, QDict *options,
+@@ -3760,7 +3790,8 @@ static BlockDriverState *bdrv_open_inherit(const char *filename,
                                      parent->open_flags, parent->options);
     }
@ -229,7 +237,7 @@ index 468cf5e67d..50bdd197b7 100644
     if (ret < 0) {
         goto fail;
     }
-@@ -4076,7 +4100,7 @@ bdrv_open_inherit(const char *filename, const char *reference, QDict *options,
+@@ -3829,7 +3860,7 @@ static BlockDriverState *bdrv_open_inherit(const char *filename,
         file_bs = bdrv_open_child_bs(filename, options, "file", bs,
                                      &child_of_bds, BDRV_CHILD_IMAGE,
@ -238,9 +246,9 @@ index 468cf5e67d..50bdd197b7 100644
         if (local_err) {
             goto fail;
         }
-@@ -4225,7 +4249,7 @@ BlockDriverState *bdrv_open(const char *filename, const char *reference,
+@@ -3974,7 +4005,7 @@ BlockDriverState *bdrv_open(const char *filename, const char *reference,
-     GLOBAL_STATE_CODE();
+                             QDict *options, int flags, Error **errp)
- 
+ {
     return bdrv_open_inherit(filename, reference, options, flags, NULL,
 -                             NULL, 0, errp);
 +                             NULL, 0, true, errp);
--- a/SOURCES/kvm-block-backend-prevent-dangling-BDS-pointers-across-a.patch
+++ b/SOURCES/kvm-block-backend-prevent-dangling-BDS-pointers-across-a.patch
@ -0,0 +1,129 @@
 From bf4c15a3debbe68b6eb25c52174843470a9c014f Mon Sep 17 00:00:00 2001
 From: Stefan Hajnoczi <stefanha@redhat.com>
 Date: Tue, 11 Jan 2022 15:36:12 +0000
 Subject: [PATCH 3/6] block-backend: prevent dangling BDS pointers across
 aio_poll()
 RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
 RH-MergeRequest: 109: block-backend: prevent dangling BDS pointers across aio_poll()
 RH-Commit: [1/2] da5a59eddff0dc10be7de8e291fa675143d11d73
 RH-Bugzilla: 2021778 2036178
 RH-Acked-by: Hanna Reitz <hreitz@redhat.com>
 RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 The BlockBackend root child can change when aio_poll() is invoked. This
 happens when a temporary filter node is removed upon blockjob
 completion, for example.
 Functions in block/block-backend.c must be aware of this when using a
 blk_bs() pointer across aio_poll() because the BlockDriverState refcnt
 may reach 0, resulting in a stale pointer.
 One example is scsi_device_purge_requests(), which calls blk_drain() to
 wait for in-flight requests to cancel. If the backup blockjob is active,
 then the BlockBackend root child is a temporary filter BDS owned by the
 blockjob. The blockjob can complete during bdrv_drained_begin() and the
 last reference to the BDS is released when the temporary filter node is
 removed. This results in a use-after-free when blk_drain() calls
 bdrv_drained_end(bs) on the dangling pointer.
 Explicitly hold a reference to bs across block APIs that invoke
 aio_poll().
 Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2021778
 Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2036178
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Message-Id: <20220111153613.25453-2-stefanha@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit 1e3552dbd28359d35967b7c28dc86cde1bc29205)
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
 block/block-backend.c | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)
 diff --git a/block/block-backend.c b/block/block-backend.c
 index 12ef80ea17..23e727199b 100644
 --- a/block/block-backend.c
 +++ b/block/block-backend.c
@@ -822,16 +822,22 @@ BlockBackend *blk_by_public(BlockBackendPublic *public)
 void blk_remove_bs(BlockBackend *blk)
 {
     ThrottleGroupMember *tgm = &blk->public.throttle_group_member;
 -    BlockDriverState *bs;
     BdrvChild *root;
     notifier_list_notify(&blk->remove_bs_notifiers, blk);
     if (tgm->throttle_state) {
 -        bs = blk_bs(blk);
 +        BlockDriverState *bs = blk_bs(blk);
 +
 +        /*
 +         * Take a ref in case blk_bs() changes across bdrv_drained_begin(), for
 +         * example, if a temporary filter node is removed by a blockjob.
 +         */
 +        bdrv_ref(bs);
         bdrv_drained_begin(bs);
         throttle_group_detach_aio_context(tgm);
         throttle_group_attach_aio_context(tgm, qemu_get_aio_context());
         bdrv_drained_end(bs);
 +        bdrv_unref(bs);
     }
     blk_update_root_state(blk);
@@ -1705,6 +1711,7 @@ void blk_drain(BlockBackend *blk)
     BlockDriverState *bs = blk_bs(blk);
     if (bs) {
 +        bdrv_ref(bs);
         bdrv_drained_begin(bs);
     }
@@ -1714,6 +1721,7 @@ void blk_drain(BlockBackend *blk)
     if (bs) {
         bdrv_drained_end(bs);
 +        bdrv_unref(bs);
     }
 }
@@ -2044,10 +2052,13 @@ static int blk_do_set_aio_context(BlockBackend *blk, AioContext *new_context,
     int ret;
     if (bs) {
 +        bdrv_ref(bs);
 +
         if (update_root_node) {
             ret = bdrv_child_try_set_aio_context(bs, new_context, blk->root,
                                                  errp);
             if (ret < 0) {
 +                bdrv_unref(bs);
                 return ret;
             }
         }
@@ -2057,6 +2068,8 @@ static int blk_do_set_aio_context(BlockBackend *blk, AioContext *new_context,
             throttle_group_attach_aio_context(tgm, new_context);
             bdrv_drained_end(bs);
         }
 +
 +        bdrv_unref(bs);
     }
     blk->ctx = new_context;
@@ -2326,11 +2339,13 @@ void blk_io_limits_disable(BlockBackend *blk)
     ThrottleGroupMember *tgm = &blk->public.throttle_group_member;
     assert(tgm->throttle_state);
     if (bs) {
 +        bdrv_ref(bs);
         bdrv_drained_begin(bs);
     }
     throttle_group_unregister_tgm(tgm);
     if (bs) {
         bdrv_drained_end(bs);
 +        bdrv_unref(bs);
     }
 }
 -- 
 2.27.0
--- a/SOURCES/kvm-block-introduce-bdrv_open_file_child-helper.patch
+++ b/SOURCES/kvm-block-introduce-bdrv_open_file_child-helper.patch
@ -0,0 +1,566 @@
 From 996680dd6d5afd51918e600126dbfed4dfe89e05 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Sun, 9 Jun 2024 23:08:39 -0400
 Subject: [PATCH 4/5] block: introduce bdrv_open_file_child() helper
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 5: EMBARGOED CVE-2024-4467 for rhel-8.10.z (PRDSC)
 RH-Jira: RHEL-35616
 RH-CVE: CVE-2024-4467
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Commit: [4/5] 9f582a9aff740eb9ec6f64bfec94854038d8545f
 Conflicts: - copy-before-write.c::cbw_copy() is an older version than
             upstream, but introduction of the new function is
 	     straight-forward.
           - include/block/block-global-state.h doesn't exist in this
             code version. Adding the prototype to
             include/block/block.h instead.
           - struct BlockDriver has no field 'filtered_child_is_backing'
             We remove the corresponding assert() in the new function.
 commit 83930780325b144a5908c45b3957b9b6457b3831
 Author: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
 Date:   Tue Jul 26 23:11:21 2022 +0300
    block: introduce bdrv_open_file_child() helper
    Almost all drivers call bdrv_open_child() similarly. Let's create a
    helper for this.
    The only not updated drivers that call bdrv_open_child() to set
    bs->file are raw-format and snapshot-access:
        raw-format sometimes want to have filtered child but
            don't set drv->is_filter to true.
        snapshot-access wants only DATA | PRIMARY
    Possibly we should implement drv->is_filter_func() handler, to consider
    raw-format as filter when it works as filter.. But it's another story.
    Note also, that we decrease assignments to bs->file in code: it helps
    us restrict modifying this field in further commit.
    Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
    Reviewed-by: Hanna Reitz <hreitz@redhat.com>
    Message-Id: <20220726201134.924743-3-vsementsov@yandex-team.ru>
    Reviewed-by: Kevin Wolf <kwolf@redhat.com>
    Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 block.c                   | 18 ++++++++++++++++++
 block/blkdebug.c          |  9 +++------
 block/blklogwrites.c      |  7 ++-----
 block/blkreplay.c         |  7 ++-----
 block/blkverify.c         |  9 +++------
 block/bochs.c             |  7 +++----
 block/cloop.c             |  7 +++----
 block/copy-before-write.c |  9 ++++-----
 block/copy-on-read.c      |  9 ++++-----
 block/crypto.c            | 11 ++++++-----
 block/dmg.c               |  7 +++----
 block/filter-compress.c   |  8 +++-----
 block/parallels.c         |  7 +++----
 block/preallocate.c       |  9 ++++-----
 block/qcow.c              |  6 ++----
 block/qcow2.c             |  8 ++++----
 block/qed.c               |  8 ++++----
 block/replication.c       |  8 +++-----
 block/throttle.c          |  8 +++-----
 block/vdi.c               |  7 +++----
 block/vhdx.c              |  7 +++----
 block/vmdk.c              |  7 +++----
 block/vpc.c               |  7 +++----
 include/block/block.h     |  3 +++
 24 files changed, 92 insertions(+), 101 deletions(-)
 diff --git a/block.c b/block.c
 index 0ac5b163d2..889f878565 100644
 --- a/block.c
 +++ b/block.c
@@ -3546,6 +3546,24 @@ BdrvChild *bdrv_open_child(const char *filename,
                              errp);
 }
 +/*
 + * Wrapper on bdrv_open_child() for most popular case: open primary child of bs.
 + */
 +int bdrv_open_file_child(const char *filename,
 +                         QDict *options, const char *bdref_key,
 +                         BlockDriverState *parent, Error **errp)
 +{
 +    BdrvChildRole role;
 +
 +    role = parent->drv->is_filter ?
 +        (BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY) : BDRV_CHILD_IMAGE;
 +
 +    parent->file = bdrv_open_child(filename, options, bdref_key, parent,
 +                                   &child_of_bds, role, false, errp);
 +
 +    return parent->file ? 0 : -EINVAL;
 +}
 +
 /*
  * TODO Future callers may need to specify parent/child_class in order for
  * option inheritance to work. Existing callers use it for the root node.
 diff --git a/block/blkdebug.c b/block/blkdebug.c
 index bbf2948703..5fcfc8ac6f 100644
 --- a/block/blkdebug.c
 +++ b/block/blkdebug.c
@@ -503,12 +503,9 @@ static int blkdebug_open(BlockDriverState *bs, QDict *options, int flags,
     }
     /* Open the image file */
 -    bs->file = bdrv_open_child(qemu_opt_get(opts, "x-image"), options, "image",
 -                               bs, &child_of_bds,
 -                               BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
 -                               false, errp);
 -    if (!bs->file) {
 -        ret = -EINVAL;
 +    ret = bdrv_open_file_child(qemu_opt_get(opts, "x-image"), options, "image",
 +                               bs, errp);
 +    if (ret < 0) {
         goto out;
     }
 diff --git a/block/blklogwrites.c b/block/blklogwrites.c
 index f7a251e91f..f66a617eb3 100644
 --- a/block/blklogwrites.c
 +++ b/block/blklogwrites.c
@@ -155,11 +155,8 @@ static int blk_log_writes_open(BlockDriverState *bs, QDict *options, int flags,
     }
     /* Open the file */
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY, false,
 -                               errp);
 -    if (!bs->file) {
 -        ret = -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
         goto fail;
     }
 diff --git a/block/blkreplay.c b/block/blkreplay.c
 index dcbe780ddb..76a0b8d12a 100644
 --- a/block/blkreplay.c
 +++ b/block/blkreplay.c
@@ -26,11 +26,8 @@ static int blkreplay_open(BlockDriverState *bs, QDict *options, int flags,
     int ret;
     /* Open the image file */
 -    bs->file = bdrv_open_child(NULL, options, "image", bs, &child_of_bds,
 -                               BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
 -                               false, errp);
 -    if (!bs->file) {
 -        ret = -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "image", bs, errp);
 +    if (ret < 0) {
         goto fail;
     }
 diff --git a/block/blkverify.c b/block/blkverify.c
 index d1facf5ba9..920e891684 100644
 --- a/block/blkverify.c
 +++ b/block/blkverify.c
@@ -121,12 +121,9 @@ static int blkverify_open(BlockDriverState *bs, QDict *options, int flags,
     }
     /* Open the raw file */
 -    bs->file = bdrv_open_child(qemu_opt_get(opts, "x-raw"), options, "raw",
 -                               bs, &child_of_bds,
 -                               BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
 -                               false, errp);
 -    if (!bs->file) {
 -        ret = -EINVAL;
 +    ret = bdrv_open_file_child(qemu_opt_get(opts, "x-raw"), options, "raw",
 +                               bs, errp);
 +    if (ret < 0) {
         goto fail;
     }
 diff --git a/block/bochs.c b/block/bochs.c
 index 4d68658087..b2dc06bbfd 100644
 --- a/block/bochs.c
 +++ b/block/bochs.c
@@ -110,10 +110,9 @@ static int bochs_open(BlockDriverState *bs, QDict *options, int flags,
         return ret;
     }
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_IMAGE, false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     ret = bdrv_pread(bs->file, 0, &bochs, sizeof(bochs));
 diff --git a/block/cloop.c b/block/cloop.c
 index b8c6d0eccd..bee87da173 100644
 --- a/block/cloop.c
 +++ b/block/cloop.c
@@ -71,10 +71,9 @@ static int cloop_open(BlockDriverState *bs, QDict *options, int flags,
         return ret;
     }
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_IMAGE, false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     /* read header */
 diff --git a/block/copy-before-write.c b/block/copy-before-write.c
 index c30a5ff8de..8aa2cb6a85 100644
 --- a/block/copy-before-write.c
 +++ b/block/copy-before-write.c
@@ -150,12 +150,11 @@ static int cbw_open(BlockDriverState *bs, QDict *options, int flags,
 {
     BDRVCopyBeforeWriteState *s = bs->opaque;
     BdrvDirtyBitmap *copy_bitmap;
 +    int ret;
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
 -                               false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     s->target = bdrv_open_child(NULL, options, "target", bs, &child_of_bds,
 diff --git a/block/copy-on-read.c b/block/copy-on-read.c
 index 1fc7fb3333..815ac1d835 100644
 --- a/block/copy-on-read.c
 +++ b/block/copy-on-read.c
@@ -41,12 +41,11 @@ static int cor_open(BlockDriverState *bs, QDict *options, int flags,
     BDRVStateCOR *state = bs->opaque;
     /* Find a bottom node name, if any */
     const char *bottom_node = qdict_get_try_str(options, "bottom");
 +    int ret;
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
 -                               false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     bs->supported_read_flags = BDRV_REQ_PREFETCH;
 diff --git a/block/crypto.c b/block/crypto.c
 index c8ba4681e2..abfce39230 100644
 --- a/block/crypto.c
 +++ b/block/crypto.c
@@ -260,15 +260,14 @@ static int block_crypto_open_generic(QCryptoBlockFormat format,
 {
     BlockCrypto *crypto = bs->opaque;
     QemuOpts *opts = NULL;
 -    int ret = -EINVAL;
 +    int ret;
     QCryptoBlockOpenOptions *open_opts = NULL;
     unsigned int cflags = 0;
     QDict *cryptoopts = NULL;
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_IMAGE, false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     bs->supported_write_flags = BDRV_REQ_FUA &
@@ -276,6 +275,7 @@ static int block_crypto_open_generic(QCryptoBlockFormat format,
     opts = qemu_opts_create(opts_spec, NULL, 0, &error_abort);
     if (!qemu_opts_absorb_qdict(opts, options, errp)) {
 +        ret = -EINVAL;
         goto cleanup;
     }
@@ -284,6 +284,7 @@ static int block_crypto_open_generic(QCryptoBlockFormat format,
     open_opts = block_crypto_open_opts_init(cryptoopts, errp);
     if (!open_opts) {
 +        ret = -EINVAL;
         goto cleanup;
     }
 diff --git a/block/dmg.c b/block/dmg.c
 index 447901fbb8..38c363dd39 100644
 --- a/block/dmg.c
 +++ b/block/dmg.c
@@ -439,10 +439,9 @@ static int dmg_open(BlockDriverState *bs, QDict *options, int flags,
         return ret;
     }
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_IMAGE, false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     block_module_load_one("dmg-bz2");
 diff --git a/block/filter-compress.c b/block/filter-compress.c
 index d5be538619..305716c86c 100644
 --- a/block/filter-compress.c
 +++ b/block/filter-compress.c
@@ -30,11 +30,9 @@
 static int compress_open(BlockDriverState *bs, QDict *options, int flags,
                          Error **errp)
 {
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
 -                               false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    int ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     if (!bs->file->bs->drv || !block_driver_can_compress(bs->file->bs->drv)) {
 diff --git a/block/parallels.c b/block/parallels.c
 index 6ebad2a2bb..ed4debd899 100644
 --- a/block/parallels.c
 +++ b/block/parallels.c
@@ -735,10 +735,9 @@ static int parallels_open(BlockDriverState *bs, QDict *options, int flags,
     Error *local_err = NULL;
     char *buf;
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_IMAGE, false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     ret = bdrv_pread(bs->file, 0, &ph, sizeof(ph));
 diff --git a/block/preallocate.c b/block/preallocate.c
 index 1d4233f730..332408bdc9 100644
 --- a/block/preallocate.c
 +++ b/block/preallocate.c
@@ -134,6 +134,7 @@ static int preallocate_open(BlockDriverState *bs, QDict *options, int flags,
                             Error **errp)
 {
     BDRVPreallocateState *s = bs->opaque;
 +    int ret;
     /*
      * s->data_end and friends should be initialized on permission update.
@@ -141,11 +142,9 @@ static int preallocate_open(BlockDriverState *bs, QDict *options, int flags,
      */
     s->file_end = s->zero_start = s->data_end = -EINVAL;
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
 -                               false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     if (!preallocate_absorb_opts(&s->opts, options, bs->file->bs, errp)) {
 diff --git a/block/qcow.c b/block/qcow.c
 index c39940f33e..544a17261f 100644
 --- a/block/qcow.c
 +++ b/block/qcow.c
@@ -120,10 +120,8 @@ static int qcow_open(BlockDriverState *bs, QDict *options, int flags,
     qdict_extract_subqdict(options, &encryptopts, "encrypt.");
     encryptfmt = qdict_get_try_str(encryptopts, "format");
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_IMAGE, false, errp);
 -    if (!bs->file) {
 -        ret = -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
         goto fail;
     }
 diff --git a/block/qcow2.c b/block/qcow2.c
 index 6ee1919612..29ea157e6b 100644
 --- a/block/qcow2.c
 +++ b/block/qcow2.c
@@ -1907,11 +1907,11 @@ static int qcow2_open(BlockDriverState *bs, QDict *options, int flags,
         .errp = errp,
         .ret = -EINPROGRESS
     };
 +    int ret;
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_IMAGE, false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     /* Initialise locks */
 diff --git a/block/qed.c b/block/qed.c
 index 558d3646c4..e3b06a3d00 100644
 --- a/block/qed.c
 +++ b/block/qed.c
@@ -558,11 +558,11 @@ static int bdrv_qed_open(BlockDriverState *bs, QDict *options, int flags,
         .errp = errp,
         .ret = -EINPROGRESS
     };
 +    int ret;
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_IMAGE, false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     bdrv_qed_init_state(bs);
 diff --git a/block/replication.c b/block/replication.c
 index 55c8f894aa..2f17397764 100644
 --- a/block/replication.c
 +++ b/block/replication.c
@@ -88,11 +88,9 @@ static int replication_open(BlockDriverState *bs, QDict *options,
     const char *mode;
     const char *top_id;
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
 -                               false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     ret = -EINVAL;
 diff --git a/block/throttle.c b/block/throttle.c
 index 6e8d52fa24..4fb5798c27 100644
 --- a/block/throttle.c
 +++ b/block/throttle.c
@@ -78,11 +78,9 @@ static int throttle_open(BlockDriverState *bs, QDict *options,
     char *group;
     int ret;
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
 -                               false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     bs->supported_write_flags = bs->file->bs->supported_write_flags |
                                 BDRV_REQ_WRITE_UNCHANGED;
 diff --git a/block/vdi.c b/block/vdi.c
 index bdc58d726e..c50c0ed61f 100644
 --- a/block/vdi.c
 +++ b/block/vdi.c
@@ -376,10 +376,9 @@ static int vdi_open(BlockDriverState *bs, QDict *options, int flags,
     int ret;
     QemuUUID uuid_link, uuid_parent;
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_IMAGE, false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     logout("\n");
 diff --git a/block/vhdx.c b/block/vhdx.c
 index 356ec4c455..e7d6d7509a 100644
 --- a/block/vhdx.c
 +++ b/block/vhdx.c
@@ -996,10 +996,9 @@ static int vhdx_open(BlockDriverState *bs, QDict *options, int flags,
     uint64_t signature;
     Error *local_err = NULL;
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_IMAGE, false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     s->bat = NULL;
 diff --git a/block/vmdk.c b/block/vmdk.c
 index 0dfab6e941..7d7e56b36c 100644
 --- a/block/vmdk.c
 +++ b/block/vmdk.c
@@ -1262,10 +1262,9 @@ static int vmdk_open(BlockDriverState *bs, QDict *options, int flags,
     BDRVVmdkState *s = bs->opaque;
     uint32_t magic;
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_IMAGE, false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     buf = vmdk_read_desc(bs->file, 0, errp);
 diff --git a/block/vpc.c b/block/vpc.c
 index 297a26262a..430cab1cbb 100644
 --- a/block/vpc.c
 +++ b/block/vpc.c
@@ -232,10 +232,9 @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags,
     int ret;
     int64_t bs_size;
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_IMAGE, false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     opts = qemu_opts_create(&vpc_runtime_opts, NULL, 0, &error_abort);
 diff --git a/include/block/block.h b/include/block/block.h
 index e5dd22b034..f885f113ef 100644
 --- a/include/block/block.h
 +++ b/include/block/block.h
@@ -376,6 +376,9 @@ BdrvChild *bdrv_open_child(const char *filename,
                            const BdrvChildClass *child_class,
                            BdrvChildRole child_role,
                            bool allow_none, Error **errp);
 +int bdrv_open_file_child(const char *filename,
 +                         QDict *options, const char *bdref_key,
 +                         BlockDriverState *parent, Error **errp);
 BlockDriverState *bdrv_open_blockdev_ref(BlockdevRef *ref, Error **errp);
 int bdrv_set_backing_hd(BlockDriverState *bs, BlockDriverState *backing_hd,
                         Error **errp);
 -- 
 2.39.3
--- a/SOURCES/kvm-block-io-Update-BSC-only-if-want_zero-is-true.patch
+++ b/SOURCES/kvm-block-io-Update-BSC-only-if-want_zero-is-true.patch
@ -0,0 +1,56 @@
 From 4c6eff78f4b31ec4bd7b42440396760d19fde63e Mon Sep 17 00:00:00 2001
 From: Hanna Reitz <hreitz@redhat.com>
 Date: Tue, 18 Jan 2022 17:59:59 +0100
 Subject: [PATCH 6/7] block/io: Update BSC only if want_zero is true
 RH-Author: Hanna Reitz <hreitz@redhat.com>
 RH-MergeRequest: 112: block/io: Update BSC only if want_zero is true
 RH-Commit: [1/2] a202de1f52110d1e871c3b5b58f2d9e9b5d17570
 RH-Bugzilla: 2041480
 RH-Acked-by: Eric Blake <eblake@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 We update the block-status cache whenever we get new information from a
 bdrv_co_block_status() call to the block driver.  However, if we have
 passed want_zero=false to that call, it may flag areas containing zeroes
 as data, and so we would update the block-status cache with wrong
 information.
 Therefore, we should not update the cache with want_zero=false.
 Reported-by: Nir Soffer <nsoffer@redhat.com>
 Fixes: 0bc329fbb00 ("block: block-status cache for data regions")
 Reviewed-by: Nir Soffer <nsoffer@redhat.com>
 Cc: qemu-stable@nongnu.org
 Signed-off-by: Hanna Reitz <hreitz@redhat.com>
 Message-Id: <20220118170000.49423-2-hreitz@redhat.com>
 Reviewed-by: Eric Blake <eblake@redhat.com>
 Signed-off-by: Eric Blake <eblake@redhat.com>
 (cherry picked from commit 113b727ce788335cf76f65355d670c9bc130fd75)
 Signed-off-by: Hanna Reitz <hreitz@redhat.com>
 ---
 block/io.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)
 diff --git a/block/io.c b/block/io.c
 index bb0a254def..4e4cb556c5 100644
 --- a/block/io.c
 +++ b/block/io.c
@@ -2497,8 +2497,12 @@ static int coroutine_fn bdrv_co_block_status(BlockDriverState *bs,
              * non-protocol nodes, and then it is never used.  However, filling
              * the cache requires an RCU update, so double check here to avoid
              * such an update if possible.
 +             *
 +             * Check want_zero, because we only want to update the cache when we
 +             * have accurate information about what is zero and what is data.
              */
 -            if (ret == (BDRV_BLOCK_DATA | BDRV_BLOCK_OFFSET_VALID) &&
 +            if (want_zero &&
 +                ret == (BDRV_BLOCK_DATA | BDRV_BLOCK_OFFSET_VALID) &&
                 QLIST_EMPTY(&bs->children))
             {
                 /*
 -- 
 2.27.0
--- a/SOURCES/kvm-block-mirror-Do-not-wait-for-active-writes.patch
+++ b/SOURCES/kvm-block-mirror-Do-not-wait-for-active-writes.patch
@ -0,0 +1,153 @@
 From 192f956f2b0761f270070555f8feb1f0544e5558 Mon Sep 17 00:00:00 2001
 From: Hanna Reitz <hreitz@redhat.com>
 Date: Wed, 9 Nov 2022 17:54:48 +0100
 Subject: [PATCH 01/11] block/mirror: Do not wait for active writes
 RH-Author: Hanna Czenczek <hreitz@redhat.com>
 RH-MergeRequest: 246: block/mirror: Make active mirror progress even under full load
 RH-Bugzilla: 2125119
 RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Commit: [1/3] 652d1e55b954f13eaec2c86f58735d4942837e16
 Waiting for all active writes to settle before daring to create a
 background copying operation means that we will never do background
 operations while the guest does anything (in write-blocking mode), and
 therefore cannot converge.  Yes, we also will not diverge, but actually
 converging would be even nicer.
 It is unclear why we did decide to wait for all active writes to settle
 before creating a background operation, but it just does not seem
 necessary.  Active writes will put themselves into the in_flight bitmap
 and thus properly block actually conflicting background requests.
 It is important for active requests to wait on overlapping background
 requests, which we do in active_write_prepare().  However, so far it was
 not documented why it is important.  Add such documentation now, and
 also to the other call of mirror_wait_on_conflicts(), so that it becomes
 more clear why and when requests need to actively wait for other
 requests to settle.
 Another thing to note is that of course we need to ensure that there are
 no active requests when the job completes, but that is done by virtue of
 the BDS being drained anyway, so there cannot be any active requests at
 that point.
 With this change, we will need to explicitly keep track of how many
 bytes are in flight in active requests so that
 job_progress_set_remaining() in mirror_run() can set the correct number
 of remaining bytes.
 Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2123297
 Signed-off-by: Hanna Reitz <hreitz@redhat.com>
 Message-Id: <20221109165452.67927-2-hreitz@redhat.com>
 Reviewed-by: Kevin Wolf <kwolf@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit d69a879bdf1aed586478eaa161ee064fe1b92f1a)
 Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 ---
 block/mirror.c | 37 ++++++++++++++++++++++++++++++-------
 1 file changed, 30 insertions(+), 7 deletions(-)
 diff --git a/block/mirror.c b/block/mirror.c
 index efec2c7674..282f428cb7 100644
 --- a/block/mirror.c
 +++ b/block/mirror.c
@@ -81,6 +81,7 @@ typedef struct MirrorBlockJob {
     int max_iov;
     bool initial_zeroing_ongoing;
     int in_active_write_counter;
 +    int64_t active_write_bytes_in_flight;
     bool prepared;
     bool in_drain;
 } MirrorBlockJob;
@@ -493,6 +494,13 @@ static uint64_t coroutine_fn mirror_iteration(MirrorBlockJob *s)
     }
     bdrv_dirty_bitmap_unlock(s->dirty_bitmap);
 +    /*
 +     * Wait for concurrent requests to @offset.  The next loop will limit the
 +     * copied area based on in_flight_bitmap so we only copy an area that does
 +     * not overlap with concurrent in-flight requests.  Still, we would like to
 +     * copy something, so wait until there are at least no more requests to the
 +     * very beginning of the area.
 +     */
     mirror_wait_on_conflicts(NULL, s, offset, 1);
     job_pause_point(&s->common.job);
@@ -993,12 +1001,6 @@ static int coroutine_fn mirror_run(Job *job, Error **errp)
         int64_t cnt, delta;
         bool should_complete;
 -        /* Do not start passive operations while there are active
 -         * writes in progress */
 -        while (s->in_active_write_counter) {
 -            mirror_wait_for_any_operation(s, true);
 -        }
 -
         if (s->ret < 0) {
             ret = s->ret;
             goto immediate_exit;
@@ -1015,7 +1017,9 @@ static int coroutine_fn mirror_run(Job *job, Error **errp)
         /* cnt is the number of dirty bytes remaining and s->bytes_in_flight is
          * the number of bytes currently being processed; together those are
          * the current remaining operation length */
 -        job_progress_set_remaining(&s->common.job, s->bytes_in_flight + cnt);
 +        job_progress_set_remaining(&s->common.job,
 +                                   s->bytes_in_flight + cnt +
 +                                   s->active_write_bytes_in_flight);
         /* Note that even when no rate limit is applied we need to yield
          * periodically with no pending I/O so that bdrv_drain_all() returns.
@@ -1073,6 +1077,10 @@ static int coroutine_fn mirror_run(Job *job, Error **errp)
             s->in_drain = true;
             bdrv_drained_begin(bs);
 +
 +            /* Must be zero because we are drained */
 +            assert(s->in_active_write_counter == 0);
 +
             cnt = bdrv_get_dirty_count(s->dirty_bitmap);
             if (cnt > 0 || mirror_flush(s) < 0) {
                 bdrv_drained_end(bs);
@@ -1306,6 +1314,7 @@ do_sync_target_write(MirrorBlockJob *job, MirrorMethod method,
     }
     job_progress_increase_remaining(&job->common.job, bytes);
 +    job->active_write_bytes_in_flight += bytes;
     switch (method) {
     case MIRROR_METHOD_COPY:
@@ -1327,6 +1336,7 @@ do_sync_target_write(MirrorBlockJob *job, MirrorMethod method,
         abort();
     }
 +    job->active_write_bytes_in_flight -= bytes;
     if (ret >= 0) {
         job_progress_update(&job->common.job, bytes);
     } else {
@@ -1375,6 +1385,19 @@ static MirrorOp *coroutine_fn active_write_prepare(MirrorBlockJob *s,
     s->in_active_write_counter++;
 +    /*
 +     * Wait for concurrent requests affecting the area.  If there are already
 +     * running requests that are copying off now-to-be stale data in the area,
 +     * we must wait for them to finish before we begin writing fresh data to the
 +     * target so that the write operations appear in the correct order.
 +     * Note that background requests (see mirror_iteration()) in contrast only
 +     * wait for conflicting requests at the start of the dirty area, and then
 +     * (based on the in_flight_bitmap) truncate the area to copy so it will not
 +     * conflict with any requests beyond that.  For active writes, however, we
 +     * cannot truncate that area.  The request from our parent must be blocked
 +     * until the area is copied in full.  Therefore, we must wait for the whole
 +     * area to become free of concurrent requests.
 +     */
     mirror_wait_on_conflicts(op, s, offset, bytes);
     bitmap_set(s->in_flight_bitmap, start_chunk, end_chunk - start_chunk);
 -- 
 2.37.3
--- a/SOURCES/kvm-block-mirror-Drop-mirror_wait_for_any_operation.patch
+++ b/SOURCES/kvm-block-mirror-Drop-mirror_wait_for_any_operation.patch
@ -0,0 +1,76 @@
 From 57c79ed20cb73aa9aa4dd7487379b85ea3f936f6 Mon Sep 17 00:00:00 2001
 From: Hanna Reitz <hreitz@redhat.com>
 Date: Wed, 9 Nov 2022 17:54:49 +0100
 Subject: [PATCH 02/11] block/mirror: Drop mirror_wait_for_any_operation()
 RH-Author: Hanna Czenczek <hreitz@redhat.com>
 RH-MergeRequest: 246: block/mirror: Make active mirror progress even under full load
 RH-Bugzilla: 2125119
 RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Commit: [2/3] dec37883bcc491441ae08d9592d1ec26a47765c0
 mirror_wait_for_free_in_flight_slot() is the only remaining user of
 mirror_wait_for_any_operation(), so inline the latter into the former.
 Signed-off-by: Hanna Reitz <hreitz@redhat.com>
 Message-Id: <20221109165452.67927-3-hreitz@redhat.com>
 Reviewed-by: Kevin Wolf <kwolf@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit eb994912993077f178ccb43b20e422ecf9ae4ac7)
 Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 ---
 block/mirror.c | 21 ++++++++-------------
 1 file changed, 8 insertions(+), 13 deletions(-)
 diff --git a/block/mirror.c b/block/mirror.c
 index 282f428cb7..6b02555ad7 100644
 --- a/block/mirror.c
 +++ b/block/mirror.c
@@ -304,19 +304,21 @@ static int mirror_cow_align(MirrorBlockJob *s, int64_t *offset,
 }
 static inline void coroutine_fn
 -mirror_wait_for_any_operation(MirrorBlockJob *s, bool active)
 +mirror_wait_for_free_in_flight_slot(MirrorBlockJob *s)
 {
     MirrorOp *op;
     QTAILQ_FOREACH(op, &s->ops_in_flight, next) {
 -        /* Do not wait on pseudo ops, because it may in turn wait on
 +        /*
 +         * Do not wait on pseudo ops, because it may in turn wait on
          * some other operation to start, which may in fact be the
          * caller of this function.  Since there is only one pseudo op
          * at any given time, we will always find some real operation
 -         * to wait on. */
 -        if (!op->is_pseudo_op && op->is_in_flight &&
 -            op->is_active_write == active)
 -        {
 +         * to wait on.
 +         * Also, do not wait on active operations, because they do not
 +         * use up in-flight slots.
 +         */
 +        if (!op->is_pseudo_op && op->is_in_flight && !op->is_active_write) {
             qemu_co_queue_wait(&op->waiting_requests, NULL);
             return;
         }
@@ -324,13 +326,6 @@ mirror_wait_for_any_operation(MirrorBlockJob *s, bool active)
     abort();
 }
 -static inline void coroutine_fn
 -mirror_wait_for_free_in_flight_slot(MirrorBlockJob *s)
 -{
 -    /* Only non-active operations use up in-flight slots */
 -    mirror_wait_for_any_operation(s, false);
 -}
 -
 /* Perform a mirror copy operation.
  *
  * *op->bytes_handled is set to the number of bytes copied after and
 -- 
 2.37.3
--- a/SOURCES/kvm-block-mirror-Fix-NULL-s-job-in-active-writes.patch
+++ b/SOURCES/kvm-block-mirror-Fix-NULL-s-job-in-active-writes.patch
@ -0,0 +1,75 @@
 From b1f5aa5a342a25dc558ee9d435fed0643fe5155f Mon Sep 17 00:00:00 2001
 From: Hanna Reitz <hreitz@redhat.com>
 Date: Wed, 9 Nov 2022 17:54:50 +0100
 Subject: [PATCH 03/11] block/mirror: Fix NULL s->job in active writes
 RH-Author: Hanna Czenczek <hreitz@redhat.com>
 RH-MergeRequest: 246: block/mirror: Make active mirror progress even under full load
 RH-Bugzilla: 2125119
 RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Commit: [3/3] 49d7ebd15667151a6e14228a8260cfdd0aa27a78
 There is a small gap in mirror_start_job() before putting the mirror
 filter node into the block graph (bdrv_append() call) and the actual job
 being created.  Before the job is created, MirrorBDSOpaque.job is NULL.
 It is possible that requests come in when bdrv_drained_end() is called,
 and those requests would see MirrorBDSOpaque.job == NULL.  Have our
 filter node handle that case gracefully.
 Signed-off-by: Hanna Reitz <hreitz@redhat.com>
 Message-Id: <20221109165452.67927-4-hreitz@redhat.com>
 Reviewed-by: Kevin Wolf <kwolf@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit da93d5c84e56e6b4e84aa8e98b6b984c9b6bb528)
 Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 ---
 block/mirror.c | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)
 diff --git a/block/mirror.c b/block/mirror.c
 index 6b02555ad7..50289fca49 100644
 --- a/block/mirror.c
 +++ b/block/mirror.c
@@ -1438,11 +1438,13 @@ static int coroutine_fn bdrv_mirror_top_do_write(BlockDriverState *bs,
     MirrorOp *op = NULL;
     MirrorBDSOpaque *s = bs->opaque;
     int ret = 0;
 -    bool copy_to_target;
 +    bool copy_to_target = false;
 -    copy_to_target = s->job->ret >= 0 &&
 -                     !job_is_cancelled(&s->job->common.job) &&
 -                     s->job->copy_mode == MIRROR_COPY_MODE_WRITE_BLOCKING;
 +    if (s->job) {
 +        copy_to_target = s->job->ret >= 0 &&
 +                         !job_is_cancelled(&s->job->common.job) &&
 +                         s->job->copy_mode == MIRROR_COPY_MODE_WRITE_BLOCKING;
 +    }
     if (copy_to_target) {
         op = active_write_prepare(s->job, offset, bytes);
@@ -1487,11 +1489,13 @@ static int coroutine_fn bdrv_mirror_top_pwritev(BlockDriverState *bs,
     QEMUIOVector bounce_qiov;
     void *bounce_buf;
     int ret = 0;
 -    bool copy_to_target;
 +    bool copy_to_target = false;
 -    copy_to_target = s->job->ret >= 0 &&
 -                     !job_is_cancelled(&s->job->common.job) &&
 -                     s->job->copy_mode == MIRROR_COPY_MODE_WRITE_BLOCKING;
 +    if (s->job) {
 +        copy_to_target = s->job->ret >= 0 &&
 +                         !job_is_cancelled(&s->job->common.job) &&
 +                         s->job->copy_mode == MIRROR_COPY_MODE_WRITE_BLOCKING;
 +    }
     if (copy_to_target) {
         /* The guest might concurrently modify the data to write; but
 -- 
 2.37.3
--- a/SOURCES/kvm-block-move-bdrv_qiov_is_aligned-to-file-posix.patch
+++ b/SOURCES/kvm-block-move-bdrv_qiov_is_aligned-to-file-posix.patch
@ -0,0 +1,104 @@
 From 636e32b4c570ddb20266b6672311174353644f0e Mon Sep 17 00:00:00 2001
 From: Keith Busch <kbusch@kernel.org>
 Date: Thu, 29 Sep 2022 13:05:22 -0700
 Subject: [PATCH 1/2] block: move bdrv_qiov_is_aligned to file-posix
 RH-Author: Kevin Wolf <kwolf@redhat.com>
 RH-MergeRequest: 411: block: Fix iov_len check in bdrv_qiov_is_aligned()
 RH-Jira: RHEL-60553
 RH-Acked-by: Eric Blake <eblake@redhat.com>
 RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
 RH-Commit: [1/2] 682c1b81b42959d9d91e0f68cd70e9753e53a279
 There is only user of bdrv_qiov_is_aligned(), so move the alignment
 function to there and make it static.
 Signed-off-by: Keith Busch <kbusch@kernel.org>
 Message-Id: <20220929200523.3218710-2-kbusch@meta.com>
 Reviewed-by: Kevin Wolf <kwolf@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit a7c5f67a78569f8c275ea4ea9962e9c79b9d03cb)
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
 block/file-posix.c    | 20 ++++++++++++++++++++
 block/io.c            | 20 --------------------
 include/block/block.h |  1 -
 3 files changed, 20 insertions(+), 21 deletions(-)
 diff --git a/block/file-posix.c b/block/file-posix.c
 index b283093e5b..b404e1544f 100644
 --- a/block/file-posix.c
 +++ b/block/file-posix.c
@@ -2051,6 +2051,26 @@ static int coroutine_fn raw_thread_pool_submit(BlockDriverState *bs,
     return thread_pool_submit_co(pool, func, arg);
 }
 +/*
 + * Check if all memory in this vector is sector aligned.
 + */
 +static bool bdrv_qiov_is_aligned(BlockDriverState *bs, QEMUIOVector *qiov)
 +{
 +    int i;
 +    size_t alignment = bdrv_min_mem_align(bs);
 +
 +    for (i = 0; i < qiov->niov; i++) {
 +        if ((uintptr_t) qiov->iov[i].iov_base % alignment) {
 +            return false;
 +        }
 +        if (qiov->iov[i].iov_len % alignment) {
 +            return false;
 +        }
 +    }
 +
 +    return true;
 +}
 +
 static int coroutine_fn raw_co_prw(BlockDriverState *bs, uint64_t offset,
                                    uint64_t bytes, QEMUIOVector *qiov, int type)
 {
 diff --git a/block/io.c b/block/io.c
 index 8ae57728a6..639e171eff 100644
 --- a/block/io.c
 +++ b/block/io.c
@@ -3375,26 +3375,6 @@ void *qemu_try_blockalign0(BlockDriverState *bs, size_t size)
     return mem;
 }
 -/*
 - * Check if all memory in this vector is sector aligned.
 - */
 -bool bdrv_qiov_is_aligned(BlockDriverState *bs, QEMUIOVector *qiov)
 -{
 -    int i;
 -    size_t alignment = bdrv_min_mem_align(bs);
 -
 -    for (i = 0; i < qiov->niov; i++) {
 -        if ((uintptr_t) qiov->iov[i].iov_base % alignment) {
 -            return false;
 -        }
 -        if (qiov->iov[i].iov_len % alignment) {
 -            return false;
 -        }
 -    }
 -
 -    return true;
 -}
 -
 void bdrv_io_plug(BlockDriverState *bs)
 {
     BdrvChild *child;
 diff --git a/include/block/block.h b/include/block/block.h
 index f885f113ef..09b374b496 100644
 --- a/include/block/block.h
 +++ b/include/block/block.h
@@ -622,7 +622,6 @@ void *qemu_blockalign(BlockDriverState *bs, size_t size);
 void *qemu_blockalign0(BlockDriverState *bs, size_t size);
 void *qemu_try_blockalign(BlockDriverState *bs, size_t size);
 void *qemu_try_blockalign0(BlockDriverState *bs, size_t size);
 -bool bdrv_qiov_is_aligned(BlockDriverState *bs, QEMUIOVector *qiov);
 void bdrv_enable_copy_on_read(BlockDriverState *bs);
 void bdrv_disable_copy_on_read(BlockDriverState *bs);
 -- 
 2.45.2
--- a/SOURCES/kvm-block-nbd-Assert-there-are-no-timers-when-closed.patch
+++ b/SOURCES/kvm-block-nbd-Assert-there-are-no-timers-when-closed.patch
@ -0,0 +1,52 @@
 From d5a85fcf996948d1154e88e9ee3b4e8c64ec2694 Mon Sep 17 00:00:00 2001
 From: Hanna Reitz <hreitz@redhat.com>
 Date: Fri, 4 Feb 2022 12:10:08 +0100
 Subject: [PATCH 2/6] block/nbd: Assert there are no timers when closed
 RH-Author: Hanna Reitz <hreitz@redhat.com>
 RH-MergeRequest: 117: block/nbd: Handle AioContext changes
 RH-Commit: [2/6] 995795ae9844a7d2b28cb1e57fd7fe81482d0205
 RH-Bugzilla: 2035185
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Eric Blake <eblake@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 Our two timers must not remain armed beyond nbd_clear_bdrvstate(), or
 they will access freed data when they fire.
 This patch is separate from the patches that actually fix the issue
 (HEAD^^ and HEAD^) so that you can run the associated regression iotest
 (281) on a configuration that reproducibly exposes the bug.
 Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Signed-off-by: Hanna Reitz <hreitz@redhat.com>
 Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 (cherry picked from commit 8a39c381e5e407d2fe5500324323f90a8540fa90)
 Conflict:
 - block/nbd.c: open_timer was introduced after the 6.2 release (for
  nbd's @open-timeout parameter), and has not been backported, so drop
  the assertion that it is NULL
 Signed-off-by: Hanna Reitz <hreitz@redhat.com>
 ---
 block/nbd.c | 3 +++
 1 file changed, 3 insertions(+)
 diff --git a/block/nbd.c b/block/nbd.c
 index b8e5a9b4cc..aab20125d8 100644
 --- a/block/nbd.c
 +++ b/block/nbd.c
@@ -108,6 +108,9 @@ static void nbd_clear_bdrvstate(BlockDriverState *bs)
     yank_unregister_instance(BLOCKDEV_YANK_INSTANCE(bs->node_name));
 +    /* Must not leave timers behind that would access freed data */
 +    assert(!s->reconnect_delay_timer);
 +
     object_unref(OBJECT(s->tlscreds));
     qapi_free_SocketAddress(s->saddr);
     s->saddr = NULL;
 -- 
 2.27.0
--- a/SOURCES/kvm-block-nbd-Delete-reconnect-delay-timer-when-done.patch
+++ b/SOURCES/kvm-block-nbd-Delete-reconnect-delay-timer-when-done.patch
@ -0,0 +1,54 @@
 From 8e23c0f208c6bd5bb64c4f6e4863b93fa6f4e9de Mon Sep 17 00:00:00 2001
 From: Hanna Reitz <hreitz@redhat.com>
 Date: Fri, 4 Feb 2022 12:10:06 +0100
 Subject: [PATCH 1/6] block/nbd: Delete reconnect delay timer when done
 RH-Author: Hanna Reitz <hreitz@redhat.com>
 RH-MergeRequest: 117: block/nbd: Handle AioContext changes
 RH-Commit: [1/6] 70814602a8a43a7c14857d76266d82b1aa5174a9
 RH-Bugzilla: 2035185
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Eric Blake <eblake@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 We start the reconnect delay timer to cancel the reconnection attempt
 after a while.  Once nbd_co_do_establish_connection() has returned, this
 attempt is over, and we no longer need the timer.
 Delete it before returning from nbd_reconnect_attempt(), so that it does
 not persist beyond the I/O request that was paused for reconnecting; we
 do not want it to fire in a drained section, because all sort of things
 can happen in such a section (e.g. the AioContext might be changed, and
 we do not want the timer to fire in the wrong context; or the BDS might
 even be deleted, and so the timer CB would access already-freed data).
 Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Signed-off-by: Hanna Reitz <hreitz@redhat.com>
 Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 (cherry picked from commit 3ce1fc16bad9c3f8b7b10b451a224d6d76e5c551)
 Signed-off-by: Hanna Reitz <hreitz@redhat.com>
 ---
 block/nbd.c | 7 +++++++
 1 file changed, 7 insertions(+)
 diff --git a/block/nbd.c b/block/nbd.c
 index 5ef462db1b..b8e5a9b4cc 100644
 --- a/block/nbd.c
 +++ b/block/nbd.c
@@ -353,6 +353,13 @@ static coroutine_fn void nbd_reconnect_attempt(BDRVNBDState *s)
     }
     nbd_co_do_establish_connection(s->bs, NULL);
 +
 +    /*
 +     * The reconnect attempt is done (maybe successfully, maybe not), so
 +     * we no longer need this timer.  Delete it so it will not outlive
 +     * this I/O request (so draining removes all timers).
 +     */
 +    reconnect_delay_timer_del(s);
 }
 static coroutine_fn int nbd_receive_replies(BDRVNBDState *s, uint64_t handle)
 -- 
 2.27.0
--- a/SOURCES/kvm-block-nbd-Move-s-ioc-on-AioContext-change.patch
+++ b/SOURCES/kvm-block-nbd-Move-s-ioc-on-AioContext-change.patch
@ -0,0 +1,107 @@
 From c7f63e7bbc5119d92775e20d1ebbf8280c78b732 Mon Sep 17 00:00:00 2001
 From: Hanna Reitz <hreitz@redhat.com>
 Date: Fri, 4 Feb 2022 12:10:11 +0100
 Subject: [PATCH 5/6] block/nbd: Move s->ioc on AioContext change
 RH-Author: Hanna Reitz <hreitz@redhat.com>
 RH-MergeRequest: 117: block/nbd: Handle AioContext changes
 RH-Commit: [5/6] 107757b9fbadfb832c75521317108525daa4174e
 RH-Bugzilla: 2035185
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Eric Blake <eblake@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 s->ioc must always be attached to the NBD node's AioContext.  If that
 context changes, s->ioc must be attached to the new context.
 Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2033626
 Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Signed-off-by: Hanna Reitz <hreitz@redhat.com>
 Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 (cherry picked from commit e15f3a66c830e3fce99c9d56c493c2f7078a1225)
 Conflict:
 - block/nbd.c: open_timer was added after the 6.2 release, so we need
  not (and cannot) assert it is NULL here.
 Signed-off-by: Hanna Reitz <hreitz@redhat.com>
 ---
 block/nbd.c | 41 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)
 diff --git a/block/nbd.c b/block/nbd.c
 index aab20125d8..a3896c7f5f 100644
 --- a/block/nbd.c
 +++ b/block/nbd.c
@@ -2003,6 +2003,38 @@ static void nbd_cancel_in_flight(BlockDriverState *bs)
     nbd_co_establish_connection_cancel(s->conn);
 }
 +static void nbd_attach_aio_context(BlockDriverState *bs,
 +                                   AioContext *new_context)
 +{
 +    BDRVNBDState *s = bs->opaque;
 +
 +    /*
 +     * The reconnect_delay_timer is scheduled in I/O paths when the
 +     * connection is lost, to cancel the reconnection attempt after a
 +     * given time.  Once this attempt is done (successfully or not),
 +     * nbd_reconnect_attempt() ensures the timer is deleted before the
 +     * respective I/O request is resumed.
 +     * Since the AioContext can only be changed when a node is drained,
 +     * the reconnect_delay_timer cannot be active here.
 +     */
 +    assert(!s->reconnect_delay_timer);
 +
 +    if (s->ioc) {
 +        qio_channel_attach_aio_context(s->ioc, new_context);
 +    }
 +}
 +
 +static void nbd_detach_aio_context(BlockDriverState *bs)
 +{
 +    BDRVNBDState *s = bs->opaque;
 +
 +    assert(!s->reconnect_delay_timer);
 +
 +    if (s->ioc) {
 +        qio_channel_detach_aio_context(s->ioc);
 +    }
 +}
 +
 static BlockDriver bdrv_nbd = {
     .format_name                = "nbd",
     .protocol_name              = "nbd",
@@ -2026,6 +2058,9 @@ static BlockDriver bdrv_nbd = {
     .bdrv_dirname               = nbd_dirname,
     .strong_runtime_opts        = nbd_strong_runtime_opts,
     .bdrv_cancel_in_flight      = nbd_cancel_in_flight,
 +
 +    .bdrv_attach_aio_context    = nbd_attach_aio_context,
 +    .bdrv_detach_aio_context    = nbd_detach_aio_context,
 };
 static BlockDriver bdrv_nbd_tcp = {
@@ -2051,6 +2086,9 @@ static BlockDriver bdrv_nbd_tcp = {
     .bdrv_dirname               = nbd_dirname,
     .strong_runtime_opts        = nbd_strong_runtime_opts,
     .bdrv_cancel_in_flight      = nbd_cancel_in_flight,
 +
 +    .bdrv_attach_aio_context    = nbd_attach_aio_context,
 +    .bdrv_detach_aio_context    = nbd_detach_aio_context,
 };
 static BlockDriver bdrv_nbd_unix = {
@@ -2076,6 +2114,9 @@ static BlockDriver bdrv_nbd_unix = {
     .bdrv_dirname               = nbd_dirname,
     .strong_runtime_opts        = nbd_strong_runtime_opts,
     .bdrv_cancel_in_flight      = nbd_cancel_in_flight,
 +
 +    .bdrv_attach_aio_context    = nbd_attach_aio_context,
 +    .bdrv_detach_aio_context    = nbd_detach_aio_context,
 };
 static void bdrv_nbd_init(void)
 -- 
 2.27.0
--- a/SOURCES/kvm-block-rbd-fix-handling-of-holes-in-.bdrv_co_block_st.patch
+++ b/SOURCES/kvm-block-rbd-fix-handling-of-holes-in-.bdrv_co_block_st.patch
@ -0,0 +1,59 @@
 From f4b7133d7aeb1d0b9115d01b5cff4df7f6b24e78 Mon Sep 17 00:00:00 2001
 From: Peter Lieven <pl@kamp.de>
 Date: Thu, 13 Jan 2022 15:44:25 +0100
 Subject: [PATCH 5/6] block/rbd: fix handling of holes in .bdrv_co_block_status
 RH-Author: Stefano Garzarella <sgarzare@redhat.com>
 RH-MergeRequest: 110: block/rbd: fix handling of holes in .bdrv_co_block_status
 RH-Commit: [1/2] 352656a5c77cc7855b476c3559a10c6aa64a4f58
 RH-Bugzilla: 2037135
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Hanna Reitz <hreitz@redhat.com>
 the assumption that we can't hit a hole if we do not diff against a snapshot was wrong.
 We can see a hole in an image if we diff against base if there exists an older snapshot
 of the image and we have discarded blocks in the image where the snapshot has data.
 Fix this by simply handling a hole like an unallocated area. There are no callbacks
 for unallocated areas so just bail out if we hit a hole.
 Fixes: 0347a8fd4c3faaedf119be04c197804be40a384b
 Suggested-by: Ilya Dryomov <idryomov@gmail.com>
 Cc: qemu-stable@nongnu.org
 Signed-off-by: Peter Lieven <pl@kamp.de>
 Message-Id: <20220113144426.4036493-2-pl@kamp.de>
 Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
 Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit 9e302f64bb407a9bb097b626da97228c2654cfee)
 Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
 ---
 block/rbd.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)
 diff --git a/block/rbd.c b/block/rbd.c
 index def96292e0..20bb896c4a 100644
 --- a/block/rbd.c
 +++ b/block/rbd.c
@@ -1279,11 +1279,11 @@ static int qemu_rbd_diff_iterate_cb(uint64_t offs, size_t len,
     RBDDiffIterateReq *req = opaque;
     assert(req->offs + req->bytes <= offs);
 -    /*
 -     * we do not diff against a snapshot so we should never receive a callback
 -     * for a hole.
 -     */
 -    assert(exists);
 +
 +    /* treat a hole like an unallocated area and bail out */
 +    if (!exists) {
 +        return 0;
 +    }
     if (!req->exists && offs > req->offs) {
         /*
 -- 
 2.27.0
--- a/SOURCES/kvm-block-rbd-workaround-for-ceph-issue-53784.patch
+++ b/SOURCES/kvm-block-rbd-workaround-for-ceph-issue-53784.patch
@ -0,0 +1,103 @@
 From 8c50eedf03d8e62acd387b9aa9369dadcea9324c Mon Sep 17 00:00:00 2001
 From: Peter Lieven <pl@kamp.de>
 Date: Thu, 13 Jan 2022 15:44:26 +0100
 Subject: [PATCH 6/6] block/rbd: workaround for ceph issue #53784
 RH-Author: Stefano Garzarella <sgarzare@redhat.com>
 RH-MergeRequest: 110: block/rbd: fix handling of holes in .bdrv_co_block_status
 RH-Commit: [2/2] 1384557462e89bb539d0d25a1a471ad738fb9e89
 RH-Bugzilla: 2037135
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Hanna Reitz <hreitz@redhat.com>
 librbd had a bug until early 2022 that affected all versions of ceph that
 supported fast-diff. This bug results in reporting of incorrect offsets
 if the offset parameter to rbd_diff_iterate2 is not object aligned.
 This patch works around this bug for pre Quincy versions of librbd.
 Fixes: 0347a8fd4c3faaedf119be04c197804be40a384b
 Cc: qemu-stable@nongnu.org
 Signed-off-by: Peter Lieven <pl@kamp.de>
 Message-Id: <20220113144426.4036493-3-pl@kamp.de>
 Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
 Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
 Tested-by: Stefano Garzarella <sgarzare@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit fc176116cdea816ceb8dd969080b2b95f58edbc0)
 Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
 ---
 block/rbd.c | 42 ++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 40 insertions(+), 2 deletions(-)
 diff --git a/block/rbd.c b/block/rbd.c
 index 20bb896c4a..8f183eba2a 100644
 --- a/block/rbd.c
 +++ b/block/rbd.c
@@ -1320,6 +1320,7 @@ static int coroutine_fn qemu_rbd_co_block_status(BlockDriverState *bs,
     int status, r;
     RBDDiffIterateReq req = { .offs = offset };
     uint64_t features, flags;
 +    uint64_t head = 0;
     assert(offset + bytes <= s->image_size);
@@ -1347,7 +1348,43 @@ static int coroutine_fn qemu_rbd_co_block_status(BlockDriverState *bs,
         return status;
     }
 -    r = rbd_diff_iterate2(s->image, NULL, offset, bytes, true, true,
 +#if LIBRBD_VERSION_CODE < LIBRBD_VERSION(1, 17, 0)
 +    /*
 +     * librbd had a bug until early 2022 that affected all versions of ceph that
 +     * supported fast-diff. This bug results in reporting of incorrect offsets
 +     * if the offset parameter to rbd_diff_iterate2 is not object aligned.
 +     * Work around this bug by rounding down the offset to object boundaries.
 +     * This is OK because we call rbd_diff_iterate2 with whole_object = true.
 +     * However, this workaround only works for non cloned images with default
 +     * striping.
 +     *
 +     * See: https://tracker.ceph.com/issues/53784
 +     */
 +
 +    /* check if RBD image has non-default striping enabled */
 +    if (features & RBD_FEATURE_STRIPINGV2) {
 +        return status;
 +    }
 +
 +#pragma GCC diagnostic push
 +#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
 +    /*
 +     * check if RBD image is a clone (= has a parent).
 +     *
 +     * rbd_get_parent_info is deprecated from Nautilus onwards, but the
 +     * replacement rbd_get_parent is not present in Luminous and Mimic.
 +     */
 +    if (rbd_get_parent_info(s->image, NULL, 0, NULL, 0, NULL, 0) != -ENOENT) {
 +        return status;
 +    }
 +#pragma GCC diagnostic pop
 +
 +    head = req.offs & (s->object_size - 1);
 +    req.offs -= head;
 +    bytes += head;
 +#endif
 +
 +    r = rbd_diff_iterate2(s->image, NULL, req.offs, bytes, true, true,
                           qemu_rbd_diff_iterate_cb, &req);
     if (r < 0 && r != QEMU_RBD_EXIT_DIFF_ITERATE2) {
         return status;
@@ -1366,7 +1403,8 @@ static int coroutine_fn qemu_rbd_co_block_status(BlockDriverState *bs,
         status = BDRV_BLOCK_ZERO | BDRV_BLOCK_OFFSET_VALID;
     }
 -    *pnum = req.bytes;
 +    assert(req.bytes > head);
 +    *pnum = req.bytes - head;
     return status;
 }
 -- 
 2.27.0
--- a/SOURCES/kvm-block-use-the-request-length-for-iov-alignment.patch
+++ b/SOURCES/kvm-block-use-the-request-length-for-iov-alignment.patch
@ -0,0 +1,48 @@
 From 9009b674a01dc0cd92c319c87714b5aca6e639f8 Mon Sep 17 00:00:00 2001
 From: Keith Busch <kbusch@kernel.org>
 Date: Thu, 29 Sep 2022 13:05:23 -0700
 Subject: [PATCH 2/2] block: use the request length for iov alignment
 RH-Author: Kevin Wolf <kwolf@redhat.com>
 RH-MergeRequest: 411: block: Fix iov_len check in bdrv_qiov_is_aligned()
 RH-Jira: RHEL-60553
 RH-Acked-by: Eric Blake <eblake@redhat.com>
 RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
 RH-Commit: [2/2] 0e01d51cfb21ca43283626c2367e5c5d0d531736
 An iov length needs to be aligned to the logical block size, which may
 be larger than the memory alignment.
 Tested-by: Jens Axboe <axboe@kernel.dk>
 Signed-off-by: Keith Busch <kbusch@kernel.org>
 Message-Id: <20220929200523.3218710-3-kbusch@meta.com>
 Reviewed-by: Kevin Wolf <kwolf@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit 25474d90aa50bd32e0de395a33d8de42dd6f2aef)
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
 block/file-posix.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
 diff --git a/block/file-posix.c b/block/file-posix.c
 index b404e1544f..b84c5725cc 100644
 --- a/block/file-posix.c
 +++ b/block/file-posix.c
@@ -2058,12 +2058,13 @@ static bool bdrv_qiov_is_aligned(BlockDriverState *bs, QEMUIOVector *qiov)
 {
     int i;
     size_t alignment = bdrv_min_mem_align(bs);
 +    size_t len = bs->bl.request_alignment;
     for (i = 0; i < qiov->niov; i++) {
         if ((uintptr_t) qiov->iov[i].iov_base % alignment) {
             return false;
         }
 -        if (qiov->iov[i].iov_len % alignment) {
 +        if (qiov->iov[i].iov_len % len) {
             return false;
         }
     }
 -- 
 2.45.2
--- a/SOURCES/kvm-checkpatch-add-qemu_bh_new-aio_bh_new-checks.patch
+++ b/SOURCES/kvm-checkpatch-add-qemu_bh_new-aio_bh_new-checks.patch
@ -0,0 +1,56 @@
 From 866a3b56f6a2d43f3cf7b3313fb41808bc5e6e1f Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Tue, 9 May 2023 10:29:03 -0400
 Subject: [PATCH 03/15] checkpatch: add qemu_bh_new/aio_bh_new checks
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 277: memory: prevent dma-reentracy issues
 RH-Bugzilla: 1999236
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [3/12] 620b480b0878c18223f3cc103450bc16aa6d7e21 (redhat/rhel/src/qemu-kvm/jons-qemu-kvm-2)
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1999236
 Upstream: Merged
 CVE: CVE-2021-3750
 commit ef56ffbdd6b0605dc1e305611287b948c970e236
 Author: Alexander Bulekov <alxndr@bu.edu>
 Date:   Thu Apr 27 17:10:08 2023 -0400
    checkpatch: add qemu_bh_new/aio_bh_new checks
    Advise authors to use the _guarded versions of the APIs, instead.
    Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
    Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
    Message-Id: <20230427211013.2994127-4-alxndr@bu.edu>
    Signed-off-by: Thomas Huth <thuth@redhat.com>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 scripts/checkpatch.pl | 8 ++++++++
 1 file changed, 8 insertions(+)
 diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
 index cb8eff233e..b2428e80cc 100755
 --- a/scripts/checkpatch.pl
 +++ b/scripts/checkpatch.pl
@@ -2858,6 +2858,14 @@ sub process {
 		if ($line =~ /\bsignal\s*\(/ && !($line =~ /SIG_(?:IGN|DFL)/)) {
 			ERROR("use sigaction to establish signal handlers; signal is not portable\n" . $herecurr);
 		}
 +# recommend qemu_bh_new_guarded instead of qemu_bh_new
 +        if ($realfile =~ /.*\/hw\/.*/ && $line =~ /\bqemu_bh_new\s*\(/) {
 +			ERROR("use qemu_bh_new_guarded() instead of qemu_bh_new() to avoid reentrancy problems\n" . $herecurr);
 +		}
 +# recommend aio_bh_new_guarded instead of aio_bh_new
 +        if ($realfile =~ /.*\/hw\/.*/ && $line =~ /\baio_bh_new\s*\(/) {
 +			ERROR("use aio_bh_new_guarded() instead of aio_bh_new() to avoid reentrancy problems\n" . $herecurr);
 +		}
 # check for module_init(), use category-specific init macros explicitly please
 		if ($line =~ /^module_init\s*\(/) {
 			ERROR("please use block_init(), type_init() etc. instead of module_init()\n" . $herecurr);
 -- 
 2.37.3
--- a/Show More
+++ b/Show More
		`@ -0,0 +1 @@`
							`DEVPATH=="*/kvm", ACTION=="change", RUN+="/lib/udev/udev-kvm-check $env{COUNT} $env{EVENT}"`