554 changed files with 66590 additions and 36575 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1 +1,5 @@
-SOURCES/qemu-8.2.0.tar.xz
+SOURCES/qemu-6.2.0.tar.xz
 SOURCES/tests_data_acpi_pc_SSDT.dimmpxm
 SOURCES/tests_data_acpi_q35_FACP.slic
 SOURCES/tests_data_acpi_q35_SSDT.dimmpxm
 SOURCES/tests_data_acpi_virt_SSDT.memhp
--- a/.qemu-kvm.metadata
+++ b/.qemu-kvm.metadata
@ -1 +1,5 @@
-1615e59b1bd68324e0819245fe003e33c14a52f9 SOURCES/qemu-8.2.0.tar.xz
+68cd61a466170115b88817e2d52db2cd7a92f43a SOURCES/qemu-6.2.0.tar.xz
 c4b34092bc5af1ba7febfca1477320fb024e8acd SOURCES/tests_data_acpi_pc_SSDT.dimmpxm
 19349e3517143bd1af56a5444e927ba37a111f72 SOURCES/tests_data_acpi_q35_FACP.slic
 4632d10ae8cedad4d5d760ed211f83f0dc81005d SOURCES/tests_data_acpi_q35_SSDT.dimmpxm
 ef12eed43cc357fb134db6fa3c7ffc83e222a97d SOURCES/tests_data_acpi_virt_SSDT.memhp
--- a/SOURCES/0001-redhat-Adding-slirp-to-the-exploded-tree.patch
+++ b/SOURCES/0001-redhat-Adding-slirp-to-the-exploded-tree.patch
--- a/SOURCES/0004-Initial-redhat-build.patch
+++ b/SOURCES/0004-Initial-redhat-build.patch
@ -1,318 +0,0 @@
 From faae70a870156f86a5cf55ca967b15d7612941ff Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 26 May 2021 10:56:02 +0200
 Subject: Initial redhat build
 This patch introduces redhat build structure in redhat subdirectory. In addition,
 several issues are fixed in QEMU tree:
 - Change of app name for sasl_server_init in VNC code from qemu to qemu-kvm
 - As we use qemu-kvm as name in all places, this is updated to be consistent
 - Man page renamed from qemu to qemu-kvm
 - man page is installed using make install so we have to fix it in qemu tree
 We disable make check due to issues with some of the tests.
 This rebase is based on qemu-kvm-8.1.0-5.el9
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 --
 Rebase changes (6.1.0):
 - Move build to .distro
 - Move changes for support file to related commit
 - Added dependency for python3-sphinx-rtd_theme
 - Removed --disable-sheepdog configure option
 - Added new hw-display modules
 - SASL initialization moved to ui/vnc-auth-sasl.c
 - Add accel-qtest-<arch> and accel-tcg-x86_64 libraries
 - Added hw-usb-host module
 - Disable new configure options (bpf, nvmm, slirp-smbd)
 - Use -pie for ksmctl build (annocheck complain fix)
 Rebase changes (6.2.0):
 - removed --disable-jemalloc and --disable-tcmalloc configure options
 - added audio-oss.so
 - added fdt requirement for x86_64
 - tests/acceptance renamed to tests/avocado
 - added multiboot_dma.bin
 - Add -Wno-string-plus-int to extra flags
 - Updated configure options
 Rebase changes (7.0.0):
 - Do not use -mlittle CFLAG on ppc64le
 - Used upstream handling issue with ui/clipboard.c
 - Use -mlittle-endian on ppc64le instead of deleteing it in configure
 - Drop --disable-libxml2 option for configure (upstream)
 - Remove vof roms
 - Disable AVX2 support
 - Use internal meson
 - Disable new configure options (dbus-display and qga-vss)
 - Change permissions on installing tests/Makefile.include
 - Remove ssh block driver
 Rebase changes (7.1.0):
 - --disable-vnc-png renamed to --disable-png (upstream)
 - removed --disable-vhost-vsock and --disable-vhost-scsi
 - capstone submodule removed
 - Temporary include capstone build
 Rebase changes (7.2.0):
 - Switch --enable-slirp=system to --enable-slirp
 - Added new configure options (blkio and sndio, both disabled)
 Rebase changes (7.2.0):
 - Fix SRPM name generation to work on Fedora 37
 - Switch back to system meson
 Rebase changes (8.0.0):
 - use enable-dtrace-backands instead of enable-dtrace-backend
 - Removed qemu virtiofsd bits
 - test/check-block.sh removed (upstream)
 - Add new --disable-* options for configure
 Rebase changes (8.1.0):
 - qmp-spec.txt installed by make
 - Removed --meson configure option
 - Add --disable-pypi
 - Removed --with-git and -with-gitsubmodules
 - Renamed --disable-pypi to --disable-downloads
 - Minor updates in README.tests
 Rebase changes (8.2.0):
 - Removed --disable-hax (upstream)
 - Added --disable-plugins configure option
 - Fixing frh.py strings
 Merged patches (6.0.0):
 - 605758c902 Limit build on Power to qemu-img and qemu-ga only
 Merged patches (6.1.0):
 - f04f91751f Use cached tarballs
 - 6581165c65 Remove message with running VM count
 - 03c3cac9fc spec-file: build qemu-kvm without SPICE and QXL
 - e0ae6c1f6c spec-file: Obsolete qemu-kvm-ui-spice
 - 9d2e9f9ecf spec: Do not build qemu-kvm-block-gluster
 - cf470b4234 spec: Do not link pcnet and ne2k_pci roms
 - e981284a6b redhat: Install the s390-netboot.img that we've built
 - 24ef557f33 spec: Remove usage of Group: tag
 - c40d69b4f4 spec: Drop %defattr usage
 - f8e98798ce spec: Clean up BuildRequires
 - 47246b43ee spec: Remove iasl BuildRequires
 - 170dc1cbe0 spec: Remove redundant 0 in conditionals
 - 8718f6fa11 spec: Add more have_XXX conditionals
 - a001269ce9 spec: Remove binutils versioned Requires
 - 34545ee641 spec: Remove diffutils BuildRequires
 - c2c82beac9 spec: Remove redundant Requires:
 - 9314c231f4 spec: Add XXX_version macros
 - c43db0bf0f spec: Add have_block_rbd
 - 3ecb0c0319 qga: drop StandardError=syslog
 - 018049dc80 Remove iscsi support
 - a2edf18777 redhat: Replace the kvm-setup.service with a /etc/modules-load.d config file
 - 387b5fbcfe redhat: Move qemu-kvm-docs dependency to qemu-kvm
 - 4ead693178 redhat: introducting qemu-kvm-hw-usbredir
 - 4dc6fc3035 redhat: use the standard vhost-user JSON path
 - 84757178b4 Fix local build
 - 8c394227dd spec: Restrict block drivers in tools
 - b6aa7c1fae Move tools to separate package
 - eafd82e509 Split qemu-pr-helper to separate package
 - 2c0182e2aa spec: RPM_BUILD_ROOT -> %{buildroot}
 - 91bd55ca13 spec: More use of %{name} instead of 'qemu-kvm'
 - 50ba299c61 spec: Use qemu-pr-helper.service from qemu.git (partial)
 - ee08d4e0a3 spec: Use %{_sourcedir} for referencing sources
 - 039e7f7d02 spec: Add tools_only
 - 884ba71617 spec: %build: Add run_configure helper
 - 8ebd864d65 spec: %build: Disable more bits with %{disable_everything} (partial)
 - f23fdb53f5 spec: %build: Add macros for some 'configure' parameters
 - fe951a8bd8 spec: %files: Move qemu-guest-agent and qemu-img earlier
 - 353b632e37 spec: %install: Remove redundant bits
 - 9d2015b752 spec: %install: Add %{modprobe_kvm_conf} macro
 - 6d05134e8c spec: %install: Remove qemu-guest-agent /etc/qemu-kvm usage
 - 985b226467 spec: %install: clean up qemu-ga section
 - dfaf9c600d spec: %install: Use a single %{tools_only} section
 - f6978ddb46 spec: Make tools_only not cross spec sections
 - 071c211098 spec: %install: Limit time spent in %{qemu_kvm_build}
 - 1b65c674be spec: misc syntactic merges with Fedora
 - 4da16294cf spec: Use Fedora's pattern for specifying rc version
 - d7ee259a79 spec: %files: don't use fine grained -docs file list
 - 64cad0c60f spec: %files: Add licenses to qemu-common too
 - c3de4f080a spec: %install: Drop python3 shebang fixup
 - 46fc216115 Update local build to work with spec file improvements
 - bab9531548 spec: Remove buildldflags
 - c8360ab6a9 spec: Use %make_build macro
 - f6966c66e9 spec: Drop make install sharedir and datadir usage
 - 86982421bc spec: use %make_install macro
 - 191c405d22 spec: parallelize `make check`
 - 251a1fb958 spec: Drop explicit --build-id
 - 44c7dda6c3 spec: use %{build_ldflags}
 - 0009a34354 Move virtiofsd to separate package
 -  34d1b200b3 Utilize --firmware configure option
 - 2800e1dd03 spec: Switch toolchain to Clang/LLVM (except process-patches.sh)
 - e8a70f500f spec: Use safe-stack for x86_64
 - e29445d50d spec: Reenable write support for VMDK etc. in tools
 - a4fe2a3e16 redhat: Disable LTO on non-x86 architectures
 Merged patches (6.2.0):
 - 333452440b remove sgabios dependency
 - 7d3633f184 enable pulseaudio
 - bd898709b0 spec: disable use of gcrypt for crypto backends in favour of gnutls
 - e4f0c6dee6 spec: Remove block-curl and block-ssh dependency
 - 4dc13bfe63 spec: Build the VDI block driver
 - d2f2ff3c74 spec: Explicitly include compress filter
 - a7d047f9c2 Move ksmtuned files to separate package
 Merged patches (7.0.0):
 - 098d4d08d0 spec: Rename qemu-kvm-hw-usbredir to qemu-kvm-device-usb-redirect
 - c2bd0d6834 spec: Split qemu-kvm-ui-opengl
 - 2c9cda805d spec: Introduce packages for virtio-gpu-* modules (changed as rhel device tree not set)
 - d0414a3e0b spec: Introduce device-display-virtio-vga* packages
 - 3534ec46d4 spec: Move usb-host module to separate package
 - ddc14d4737 spec: Move qtest accel module to tests package
 - 6f2c4befa6 spec: Extend qemu-kvm-core description
 - 6f11866e4e (rhel/rhel-9.0.0) Update to qemu-kvm-6.2.0-6.el9
 - da0a28758f ui/clipboard: fix use-after-free regression
 - 895d4d52eb spec: Remove qemu-virtiofsd
 - c8c8c8bd84 spec: Fix obsolete for spice subpackages
 - d46d2710b2 spec: Obsolete old usb redir subpackage
 - 6f52a50b68 spec: Obsolete ssh driver
 Merged patches (7.2.0):
 - 8c6834feb6 Remove opengl display device subpackages (C9S MR 124)
 - 0ecc97f29e spec: Add requires for packages with additional virtio-gpu variants (C9S MR 124)
 Merged patches (8.0.0):
 - 7754f6ba78 Minor packaging fixes
 - 401af56187 spec: Disable VDUSE
 Merged patches (8.1.0):
 - 0c2306676f Enable Linux io_uring
 - b7fa6426d5 Enable libblkio block drivers
 - 19f6d7a6f4 Fix virtio-blk-vhost-vdpa typo in spec file
 - f356cae88f spec: Build DBUS display
 - 77b763efd5 Provide elf2dmp binary in qemu-tools
 Merged patches (8.2.0):
 - cd9efa221d Enable qemu-kvm-device-usb-redirec for aarch64
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 .distro/Makefile                        |  100 +
 .distro/Makefile.common                 |   42 +
 .distro/README.tests                    |   39 +
 .distro/modules-load.conf               |    4 +
 .distro/qemu-guest-agent.service        |    1 -
 .distro/qemu-kvm.spec.template          | 4909 +++++++++++++++++++++++
 .distro/rpminspect.yaml                 |    6 +-
 .distro/scripts/extract_build_cmd.py    |   12 +
 .distro/scripts/frh.py                  |    4 +-
 .distro/scripts/process-patches.sh      |    4 +
 .gitignore                              |    1 +
 README.systemtap                        |   43 +
 scripts/qemu-guest-agent/fsfreeze-hook  |    2 +-
 scripts/systemtap/conf.d/qemu_kvm.conf  |    4 +
 scripts/systemtap/script.d/qemu_kvm.stp |    1 +
 ui/vnc-auth-sasl.c                      |    2 +-
 16 files changed, 5168 insertions(+), 6 deletions(-)
 create mode 100644 .distro/Makefile
 create mode 100644 .distro/Makefile.common
 create mode 100644 .distro/README.tests
 create mode 100644 .distro/modules-load.conf
 create mode 100644 .distro/qemu-kvm.spec.template
 create mode 100644 README.systemtap
 create mode 100644 scripts/systemtap/conf.d/qemu_kvm.conf
 create mode 100644 scripts/systemtap/script.d/qemu_kvm.stp
 diff --git a/README.systemtap b/README.systemtap
 new file mode 100644
 index 0000000000..ad913fc990
 --- /dev/null
 +++ b/README.systemtap
@@ -0,0 +1,43 @@
 +QEMU tracing using systemtap-initscript
 +---------------------------------------
 +
 +You can capture QEMU trace data all the time using systemtap-initscript.  This
 +uses SystemTap's flight recorder mode to trace all running guests to a
 +fixed-size buffer on the host.  Old trace entries are overwritten by new
 +entries when the buffer size wraps.
 +
 +1. Install the systemtap-initscript package:
 +  # yum install systemtap-initscript
 +
 +2. Install the systemtap scripts and the conf file:
 +  # cp /usr/share/qemu-kvm/systemtap/script.d/qemu_kvm.stp /etc/systemtap/script.d/
 +  # cp /usr/share/qemu-kvm/systemtap/conf.d/qemu_kvm.conf /etc/systemtap/conf.d/
 +
 +The set of trace events to enable is given in qemu_kvm.stp.  This SystemTap
 +script can be customized to add or remove trace events provided in
 +/usr/share/systemtap/tapset/qemu-kvm-simpletrace.stp.
 +
 +SystemTap customizations can be made to qemu_kvm.conf to control the flight
 +recorder buffer size and whether to store traces in memory only or disk too.
 +See stap(1) for option documentation.
 +
 +3. Start the systemtap service.
 +　# service systemtap start qemu_kvm
 +
 +4. Make the service start at boot time.
 +　# chkconfig systemtap on
 +
 +5. Confirm that the service works.
 +  # service systemtap status qemu_kvm
 +  qemu_kvm is running...
 +
 +When you want to inspect the trace buffer, perform the following steps:
 +
 +1. Dump the trace buffer.
 +  # staprun -A qemu_kvm >/tmp/trace.log
 +
 +2. Start the systemtap service because the preceding step stops the service.
 +  # service systemtap start qemu_kvm
 +
 +3. Translate the trace record to readable format.
 +  # /usr/share/qemu-kvm/simpletrace.py --no-header /usr/share/qemu-kvm/trace-events /tmp/trace.log
 diff --git a/scripts/qemu-guest-agent/fsfreeze-hook b/scripts/qemu-guest-agent/fsfreeze-hook
 index 13aafd4845..e9b84ec028 100755
 --- a/scripts/qemu-guest-agent/fsfreeze-hook
 +++ b/scripts/qemu-guest-agent/fsfreeze-hook
@@ -8,7 +8,7 @@
 # request, it is issued with "thaw" argument after filesystem is thawed.
 LOGFILE=/var/log/qga-fsfreeze-hook.log
 -FSFREEZE_D=$(dirname -- "$0")/fsfreeze-hook.d
 +FSFREEZE_D=$(dirname -- "$(realpath $0)")/fsfreeze-hook.d
 # Check whether file $1 is a backup or rpm-generated file and should be ignored
 is_ignored_file() {
 diff --git a/scripts/systemtap/conf.d/qemu_kvm.conf b/scripts/systemtap/conf.d/qemu_kvm.conf
 new file mode 100644
 index 0000000000..372d8160a4
 --- /dev/null
 +++ b/scripts/systemtap/conf.d/qemu_kvm.conf
@@ -0,0 +1,4 @@
 +# Force load uprobes (see BZ#1118352)
 +stap -e 'probe process("/usr/libexec/qemu-kvm").function("main") { printf("") }' -c true
 +
 +qemu_kvm_OPT="-s4" # per-CPU buffer size, in megabytes
 diff --git a/scripts/systemtap/script.d/qemu_kvm.stp b/scripts/systemtap/script.d/qemu_kvm.stp
 new file mode 100644
 index 0000000000..c04abf9449
 --- /dev/null
 +++ b/scripts/systemtap/script.d/qemu_kvm.stp
@@ -0,0 +1 @@
 +probe qemu.kvm.simpletrace.handle_qmp_command,qemu.kvm.simpletrace.monitor_protocol_*,qemu.kvm.simpletrace.migrate_set_state {}
 diff --git a/ui/vnc-auth-sasl.c b/ui/vnc-auth-sasl.c
 index 47fdae5b21..2a950caa2a 100644
 --- a/ui/vnc-auth-sasl.c
 +++ b/ui/vnc-auth-sasl.c
@@ -42,7 +42,7 @@
 bool vnc_sasl_server_init(Error **errp)
 {
 -    int saslErr = sasl_server_init(NULL, "qemu");
 +    int saslErr = sasl_server_init(NULL, "qemu-kvm");
     if (saslErr != SASL_OK) {
         error_setg(errp, "Failed to initialize SASL auth: %s",
 -- 
 2.39.3
--- a/SOURCES/0005-Enable-disable-devices-for-RHEL.patch
+++ b/SOURCES/0005-Enable-disable-devices-for-RHEL.patch
@ -1,912 +0,0 @@
 From 048067b4618ba1fa7c8c517185d4cd3a675eba72 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 7 Dec 2022 03:05:48 -0500
 Subject: Enable/disable devices for RHEL
 This commit adds all changes related to changes in supported devices.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 --
 Rebase notes (6.1.0):
 - Added CONFIG_TPM (except s390x)
 - default-configs moved to configs
 - Use --with-device-<ARCH> configure option to use rhel configs
 Rebase notes (6.2.0):
 - Add CONFIG_ISA_FDC
 - Do not remove -no-hpet documentation
 Rebase notes (7.0.0):
 - Added CONFIG_ARM_GIC_TCG option for aarch64
 - Fixes necessary for layout change fixes
 - Renamed CONFIG_ARM_GIC_TCG to CONFIG_ARM_GICV3_TCG
 - Removed upstream devices
 Rebase notes (7.1.0):
 - Added CONFIG_VHOST_VSOCK and CONFIG_VHOST_USER_VSOCK configs
 - Added CONFIG_CXL and CONFIG_CXL_MEM_DEVICE for aarch64 and x86_64
 - Added CONFIG_VHOST_USER_FS option (all archs)
 Rebase notes (7.2.0):
 - Removed disabling a15mpcore.c as no longer needed
 Rebase notes (8.0.0):
 - Rename CONFIG_ACPI_X86_ICH to CONFIG_ACPI_ICH9
 - Inlude qemu/error-report.h in hw/display/cirrus_vga.c
 - Change virtiofsd dependency version
 Rebase notes (8.1.0):
 - Added CONFIG_PCIE_PCI_BRIDGE for x86_64
 - Disabling tcg cpus for aarch64
 - Disable CONFIG_ARM_V7M and remove related hack
 - Moved aarch64 tcg cpu disabling from arm machine type commit
 Rebase notes (8.2.0):
 - Disabled new a710 arm64 tcg cpu
 - No longer needed hack for removal of i2c-echo
 - Disable new neoverse-v2
 - Removed CONFIG_OPENGL from x86_64 config file
 Merged patches (6.1.0):
 - c51bf45304 Remove SPICE and QXL from x86_64-rh-devices.mak
 - 02fc745601 aarch64-rh-devices: add CONFIG_PVPANIC_PCI
 - f2fe835153 aarch64-rh-devices: add CONFIG_PXB
 - b5431733ad disable CONFIG_USB_STORAGE_BOT
 - 478ba0cdf6 Disable TPM passthrough
 - 2504d68a7c aarch64: Add USB storage devices
 - 51c2a3253c disable ac97 audio
 Merged patches (6.2.0):
 - 9f2f9fa2ba disable sga device
 Merged patches (7.0.0):
 - fd7c45a5a8 redhat: Enable virtio-mem as tech-preview on x86-64
 - c9e68ea451 Enable SGX -- RH Only
 Merged patches (7.1.0):
 - 38b89dc245 pc: Move s3/s4 suspend disabling to compat (only hw/acpi/ich9.c chunk)
 - 8f663466c6 configs/devices/aarch64-softmmu: Enable CONFIG_VIRTIO_MEM
 - 1bf372717a Enable virtio-iommu-pci on aarch64
 - ae3f269458 Enable virtio-iommu-pci on x86_64
 Merged patches (8.1.0):
 - 8173d2eaba Disable unwanted new devices
 Merged patches (8.2.0):
 - b29f66431f Enable igb on x86_64
 ---
 .distro/qemu-kvm.spec.template                |  18 +--
 .../aarch64-softmmu/aarch64-rh-devices.mak    |  41 +++++++
 .../ppc64-softmmu/ppc64-rh-devices.mak        |  37 ++++++
 configs/devices/rh-virtio.mak                 |  10 ++
 .../s390x-softmmu/s390x-rh-devices.mak        |  18 +++
 .../x86_64-softmmu/x86_64-rh-devices.mak      | 110 ++++++++++++++++++
 hw/arm/virt.c                                 |   2 +
 hw/block/fdc.c                                |  10 ++
 hw/cpu/meson.build                            |   3 +-
 hw/cxl/meson.build                            |   3 +-
 hw/display/cirrus_vga.c                       |   4 +
 hw/ide/piix.c                                 |   5 +-
 hw/ide/qdev.c                                 |   9 ++
 hw/input/pckbd.c                              |   2 +
 hw/net/e1000.c                                |   2 +
 hw/ppc/spapr_cpu_core.c                       |   2 +
 hw/usb/meson.build                            |   2 +-
 hw/virtio/meson.build                         |   5 +-
 target/arm/arm-qmp-cmds.c                     |   2 +
 target/arm/cpu.c                              |   4 +
 target/arm/cpu.h                              |   3 +
 target/arm/cpu64.c                            |  12 +-
 target/arm/tcg/cpu32.c                        |   2 +
 target/arm/tcg/cpu64.c                        |   8 ++
 target/ppc/cpu-models.c                       |   9 ++
 target/s390x/cpu_models_sysemu.c              |   3 +
 target/s390x/kvm/kvm.c                        |   8 ++
 tests/qtest/arm-cpu-features.c                |   4 +
 28 files changed, 323 insertions(+), 15 deletions(-)
 create mode 100644 configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
 create mode 100644 configs/devices/ppc64-softmmu/ppc64-rh-devices.mak
 create mode 100644 configs/devices/rh-virtio.mak
 create mode 100644 configs/devices/s390x-softmmu/s390x-rh-devices.mak
 create mode 100644 configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 diff --git a/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak b/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
 new file mode 100644
 index 0000000000..aec1831199
 --- /dev/null
 +++ b/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
@@ -0,0 +1,41 @@
 +include ../rh-virtio.mak
 +
 +CONFIG_ARM_GIC_KVM=y
 +CONFIG_ARM_GICV3_TCG=y
 +CONFIG_ARM_GIC=y
 +CONFIG_ARM_SMMUV3=y
 +CONFIG_ARM_VIRT=y
 +CONFIG_CXL=y
 +CONFIG_CXL_MEM_DEVICE=y
 +CONFIG_EDID=y
 +CONFIG_PCIE_PORT=y
 +CONFIG_PCIE_PCI_BRIDGE=y
 +CONFIG_PCI_DEVICES=y
 +CONFIG_PCI_TESTDEV=y
 +CONFIG_PFLASH_CFI01=y
 +CONFIG_SCSI=y
 +CONFIG_SEMIHOSTING=y
 +CONFIG_USB=y
 +CONFIG_USB_XHCI=y
 +CONFIG_USB_XHCI_PCI=y
 +CONFIG_USB_STORAGE_CORE=y
 +CONFIG_USB_STORAGE_CLASSIC=y
 +CONFIG_VFIO=y
 +CONFIG_VFIO_PCI=y
 +CONFIG_VIRTIO_MMIO=y
 +CONFIG_VIRTIO_PCI=y
 +CONFIG_VIRTIO_MEM=y
 +CONFIG_VIRTIO_IOMMU=y
 +CONFIG_XIO3130=y
 +CONFIG_NVDIMM=y
 +CONFIG_ACPI_APEI=y
 +CONFIG_TPM=y
 +CONFIG_TPM_EMULATOR=y
 +CONFIG_TPM_TIS_SYSBUS=y
 +CONFIG_PTIMER=y
 +CONFIG_ARM_COMPATIBLE_SEMIHOSTING=y
 +CONFIG_PVPANIC_PCI=y
 +CONFIG_PXB=y
 +CONFIG_VHOST_VSOCK=y
 +CONFIG_VHOST_USER_VSOCK=y
 +CONFIG_VHOST_USER_FS=y
 diff --git a/configs/devices/ppc64-softmmu/ppc64-rh-devices.mak b/configs/devices/ppc64-softmmu/ppc64-rh-devices.mak
 new file mode 100644
 index 0000000000..dbb7d30829
 --- /dev/null
 +++ b/configs/devices/ppc64-softmmu/ppc64-rh-devices.mak
@@ -0,0 +1,37 @@
 +include ../rh-virtio.mak
 +
 +CONFIG_DIMM=y
 +CONFIG_MEM_DEVICE=y
 +CONFIG_NVDIMM=y
 +CONFIG_PCI=y
 +CONFIG_PCI_DEVICES=y
 +CONFIG_PCI_TESTDEV=y
 +CONFIG_PCI_EXPRESS=y
 +CONFIG_PSERIES=y
 +CONFIG_SCSI=y
 +CONFIG_SPAPR_VSCSI=y
 +CONFIG_TEST_DEVICES=y
 +CONFIG_USB=y
 +CONFIG_USB_OHCI=y
 +CONFIG_USB_OHCI_PCI=y
 +CONFIG_USB_SMARTCARD=y
 +CONFIG_USB_STORAGE_CORE=y
 +CONFIG_USB_STORAGE_CLASSIC=y
 +CONFIG_USB_XHCI=y
 +CONFIG_USB_XHCI_NEC=y
 +CONFIG_USB_XHCI_PCI=y
 +CONFIG_VFIO=y
 +CONFIG_VFIO_PCI=y
 +CONFIG_VGA=y
 +CONFIG_VGA_PCI=y
 +CONFIG_VHOST_USER=y
 +CONFIG_VIRTIO_PCI=y
 +CONFIG_VIRTIO_VGA=y
 +CONFIG_WDT_IB6300ESB=y
 +CONFIG_XICS=y
 +CONFIG_XIVE=y
 +CONFIG_TPM=y
 +CONFIG_TPM_SPAPR=y
 +CONFIG_TPM_EMULATOR=y
 +CONFIG_VHOST_VSOCK=y
 +CONFIG_VHOST_USER_VSOCK=y
 diff --git a/configs/devices/rh-virtio.mak b/configs/devices/rh-virtio.mak
 new file mode 100644
 index 0000000000..94ede1b5f6
 --- /dev/null
 +++ b/configs/devices/rh-virtio.mak
@@ -0,0 +1,10 @@
 +CONFIG_VIRTIO=y
 +CONFIG_VIRTIO_BALLOON=y
 +CONFIG_VIRTIO_BLK=y
 +CONFIG_VIRTIO_GPU=y
 +CONFIG_VIRTIO_INPUT=y
 +CONFIG_VIRTIO_INPUT_HOST=y
 +CONFIG_VIRTIO_NET=y
 +CONFIG_VIRTIO_RNG=y
 +CONFIG_VIRTIO_SCSI=y
 +CONFIG_VIRTIO_SERIAL=y
 diff --git a/configs/devices/s390x-softmmu/s390x-rh-devices.mak b/configs/devices/s390x-softmmu/s390x-rh-devices.mak
 new file mode 100644
 index 0000000000..69a799adbd
 --- /dev/null
 +++ b/configs/devices/s390x-softmmu/s390x-rh-devices.mak
@@ -0,0 +1,18 @@
 +include ../rh-virtio.mak
 +
 +CONFIG_PCI=y
 +CONFIG_S390_CCW_VIRTIO=y
 +CONFIG_S390_FLIC=y
 +CONFIG_S390_FLIC_KVM=y
 +CONFIG_SCLPCONSOLE=y
 +CONFIG_SCSI=y
 +CONFIG_VFIO=y
 +CONFIG_VFIO_AP=y
 +CONFIG_VFIO_CCW=y
 +CONFIG_VFIO_PCI=y
 +CONFIG_VHOST_USER=y
 +CONFIG_VIRTIO_CCW=y
 +CONFIG_WDT_DIAG288=y
 +CONFIG_VHOST_VSOCK=y
 +CONFIG_VHOST_USER_VSOCK=y
 +CONFIG_VHOST_USER_FS=y
 diff --git a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 new file mode 100644
 index 0000000000..ce5be73633
 --- /dev/null
 +++ b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
@@ -0,0 +1,110 @@
 +include ../rh-virtio.mak
 +
 +CONFIG_ACPI=y
 +CONFIG_ACPI_PCI=y
 +CONFIG_ACPI_CPU_HOTPLUG=y
 +CONFIG_ACPI_MEMORY_HOTPLUG=y
 +CONFIG_ACPI_NVDIMM=y
 +CONFIG_ACPI_SMBUS=y
 +CONFIG_ACPI_VMGENID=y
 +CONFIG_ACPI_X86=y
 +CONFIG_ACPI_ICH9=y
 +CONFIG_AHCI=y
 +CONFIG_APIC=y
 +CONFIG_APM=y
 +CONFIG_BOCHS_DISPLAY=y
 +CONFIG_CXL=y
 +CONFIG_CXL_MEM_DEVICE=y
 +CONFIG_DIMM=y
 +CONFIG_E1000E_PCI_EXPRESS=y
 +CONFIG_E1000_PCI=y
 +CONFIG_EDU=y
 +CONFIG_FDC=y
 +CONFIG_FDC_SYSBUS=y
 +CONFIG_FDC_ISA=y
 +CONFIG_FW_CFG_DMA=y
 +CONFIG_HDA=y
 +CONFIG_HYPERV=y
 +CONFIG_HYPERV_TESTDEV=y
 +CONFIG_I2C=y
 +CONFIG_I440FX=y
 +CONFIG_I8254=y
 +CONFIG_I8257=y
 +CONFIG_I8259=y
 +CONFIG_I82801B11=y
 +CONFIG_IDE_CORE=y
 +CONFIG_IDE_PCI=y
 +CONFIG_IDE_PIIX=y
 +CONFIG_IDE_QDEV=y
 +CONFIG_IGB_PCI_EXPRESS=y
 +CONFIG_IOAPIC=y
 +CONFIG_IOH3420=y
 +CONFIG_ISA_BUS=y
 +CONFIG_ISA_DEBUG=y
 +CONFIG_ISA_TESTDEV=y
 +CONFIG_LPC_ICH9=y
 +CONFIG_MC146818RTC=y
 +CONFIG_MEM_DEVICE=y
 +CONFIG_NVDIMM=y
 +CONFIG_PAM=y
 +CONFIG_PC=y
 +CONFIG_PCI=y
 +CONFIG_PCIE_PORT=y
 +CONFIG_PCI_DEVICES=y
 +CONFIG_PCI_EXPRESS=y
 +CONFIG_PCI_EXPRESS_Q35=y
 +CONFIG_PCI_I440FX=y
 +CONFIG_PCI_TESTDEV=y
 +CONFIG_PCKBD=y
 +CONFIG_PCSPK=y
 +CONFIG_PC_ACPI=y
 +CONFIG_PC_PCI=y
 +CONFIG_PCIE_PCI_BRIDGE=y
 +CONFIG_PFLASH_CFI01=y
 +CONFIG_PVPANIC_ISA=y
 +CONFIG_PXB=y
 +CONFIG_Q35=y
 +CONFIG_RTL8139_PCI=y
 +CONFIG_SCSI=y
 +CONFIG_SERIAL=y
 +CONFIG_SERIAL_ISA=y
 +CONFIG_SERIAL_PCI=y
 +CONFIG_SEV=y
 +CONFIG_SMBIOS=y
 +CONFIG_SMBUS_EEPROM=y
 +CONFIG_TEST_DEVICES=y
 +CONFIG_USB=y
 +CONFIG_USB_EHCI=y
 +CONFIG_USB_EHCI_PCI=y
 +CONFIG_USB_SMARTCARD=y
 +CONFIG_USB_STORAGE_CORE=y
 +CONFIG_USB_STORAGE_CLASSIC=y
 +CONFIG_USB_UHCI=y
 +CONFIG_USB_XHCI=y
 +CONFIG_USB_XHCI_NEC=y
 +CONFIG_USB_XHCI_PCI=y
 +CONFIG_VFIO=y
 +CONFIG_VFIO_PCI=y
 +CONFIG_VGA=y
 +CONFIG_VGA_CIRRUS=y
 +CONFIG_VGA_PCI=y
 +CONFIG_VHOST_USER=y
 +CONFIG_VHOST_USER_BLK=y
 +CONFIG_VIRTIO_MEM=y
 +CONFIG_VIRTIO_PCI=y
 +CONFIG_VIRTIO_VGA=y
 +CONFIG_VIRTIO_IOMMU=y
 +CONFIG_VMMOUSE=y
 +CONFIG_VMPORT=y
 +CONFIG_VTD=y
 +CONFIG_WDT_IB6300ESB=y
 +CONFIG_WDT_IB700=y
 +CONFIG_XIO3130=y
 +CONFIG_TPM=y
 +CONFIG_TPM_CRB=y
 +CONFIG_TPM_TIS_ISA=y
 +CONFIG_TPM_EMULATOR=y
 +CONFIG_SGX=y
 +CONFIG_VHOST_VSOCK=y
 +CONFIG_VHOST_USER_VSOCK=y
 +CONFIG_VHOST_USER_FS=y
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index be2856c018..af9ea4dd1c 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
@@ -205,6 +205,7 @@ static const int a15irqmap[] = {
 };
 static const char *valid_cpus[] = {
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 #ifdef CONFIG_TCG
     ARM_CPU_TYPE_NAME("cortex-a7"),
     ARM_CPU_TYPE_NAME("cortex-a15"),
@@ -219,6 +220,7 @@ static const char *valid_cpus[] = {
     ARM_CPU_TYPE_NAME("neoverse-n2"),
 #endif
     ARM_CPU_TYPE_NAME("cortex-a53"),
 +#endif /* disabled for RHEL */
     ARM_CPU_TYPE_NAME("cortex-a57"),
     ARM_CPU_TYPE_NAME("host"),
     ARM_CPU_TYPE_NAME("max"),
 diff --git a/hw/block/fdc.c b/hw/block/fdc.c
 index d7cc4d3ec1..12d0a60905 100644
 --- a/hw/block/fdc.c
 +++ b/hw/block/fdc.c
@@ -49,6 +49,8 @@
 #include "qom/object.h"
 #include "fdc-internal.h"
 +#include "hw/boards.h"
 +
 /********************************************************/
 /* debug Floppy devices */
@@ -2346,6 +2348,14 @@ void fdctrl_realize_common(DeviceState *dev, FDCtrl *fdctrl, Error **errp)
     FDrive *drive;
     static int command_tables_inited = 0;
 +    /* Restricted for Red Hat Enterprise Linux: */
 +    MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
 +    if (!strstr(mc->name, "-rhel7.")) {
 +        error_setg(errp, "Device %s is not supported with machine type %s",
 +                   object_get_typename(OBJECT(dev)), mc->name);
 +        return;
 +    }
 +
     if (fdctrl->fallback == FLOPPY_DRIVE_TYPE_AUTO) {
         error_setg(errp, "Cannot choose a fallback FDrive type of 'auto'");
         return;
 diff --git a/hw/cpu/meson.build b/hw/cpu/meson.build
 index 6d319947ca..91962fd863 100644
 --- a/hw/cpu/meson.build
 +++ b/hw/cpu/meson.build
@@ -1,4 +1,5 @@
 -system_ss.add(files('core.c', 'cluster.c'))
 +#system_ss.add(files('core.c', 'cluster.c'))
 +system_ss.add(files('core.c'))
 system_ss.add(when: 'CONFIG_ARM11MPCORE', if_true: files('arm11mpcore.c'))
 system_ss.add(when: 'CONFIG_REALVIEW', if_true: files('realview_mpcore.c'))
 diff --git a/hw/cxl/meson.build b/hw/cxl/meson.build
 index ea0aebf6e3..6878f06974 100644
 --- a/hw/cxl/meson.build
 +++ b/hw/cxl/meson.build
@@ -6,7 +6,8 @@ system_ss.add(when: 'CONFIG_CXL',
                    'cxl-host.c',
                    'cxl-cdat.c',
                    'cxl-events.c',
 -                   'switch-mailbox-cci.c',
 +# Disabled for 8.2.0 rebase for RHEL 9.4.0
 +#                   'switch-mailbox-cci.c',
                ),
                if_false: files(
                    'cxl-host-stubs.c',
 diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
 index b80f98b6c4..0370cf8a64 100644
 --- a/hw/display/cirrus_vga.c
 +++ b/hw/display/cirrus_vga.c
@@ -36,6 +36,7 @@
 #include "qemu/module.h"
 #include "qemu/units.h"
 #include "qemu/log.h"
 +#include "qemu/error-report.h"
 #include "sysemu/reset.h"
 #include "qapi/error.h"
 #include "trace.h"
@@ -2946,6 +2947,9 @@ static void pci_cirrus_vga_realize(PCIDevice *dev, Error **errp)
     PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(dev);
     int16_t device_id = pc->device_id;
 +    warn_report("'cirrus-vga' is deprecated, "
 +                "please use a different VGA card instead");
 +
     /*
      * Follow real hardware, cirrus card emulated has 4 MB video memory.
      * Also accept 8 MB/16 MB for backward compatibility.
 diff --git a/hw/ide/piix.c b/hw/ide/piix.c
 index 4e5e12935f..03ca06bb17 100644
 --- a/hw/ide/piix.c
 +++ b/hw/ide/piix.c
@@ -190,7 +190,8 @@ static void piix3_ide_class_init(ObjectClass *klass, void *data)
     k->device_id = PCI_DEVICE_ID_INTEL_82371SB_1;
     k->class_id = PCI_CLASS_STORAGE_IDE;
     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 -    dc->hotpluggable = false;
 +    /* Disabled for Red Hat Enterprise Linux: */
 +    dc->user_creatable = false;
 }
 static const TypeInfo piix3_ide_info = {
@@ -214,6 +215,8 @@ static void piix4_ide_class_init(ObjectClass *klass, void *data)
     k->class_id = PCI_CLASS_STORAGE_IDE;
     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->hotpluggable = false;
 +    /* Disabled for Red Hat Enterprise Linux: */
 +    dc->user_creatable = false;
 }
 static const TypeInfo piix4_ide_info = {
 diff --git a/hw/ide/qdev.c b/hw/ide/qdev.c
 index 1b3b4da01d..454bfa5783 100644
 --- a/hw/ide/qdev.c
 +++ b/hw/ide/qdev.c
@@ -283,10 +283,13 @@ static void ide_cd_realize(IDEDevice *dev, Error **errp)
     ide_dev_initfn(dev, IDE_CD, errp);
 }
 +/* Disabled for Red Hat Enterprise Linux */
 +#if 0
 static void ide_cf_realize(IDEDevice *dev, Error **errp)
 {
     ide_dev_initfn(dev, IDE_CFATA, errp);
 }
 +#endif
 #define DEFINE_IDE_DEV_PROPERTIES()                     \
     DEFINE_BLOCK_PROPERTIES(IDEDrive, dev.conf),        \
@@ -346,6 +349,8 @@ static const TypeInfo ide_cd_info = {
     .class_init    = ide_cd_class_init,
 };
 +/* Disabled for Red Hat Enterprise Linux */
 +#if 0
 static Property ide_cf_properties[] = {
     DEFINE_IDE_DEV_PROPERTIES(),
     DEFINE_BLOCK_CHS_PROPERTIES(IDEDrive, dev.conf),
@@ -371,6 +376,7 @@ static const TypeInfo ide_cf_info = {
     .instance_size = sizeof(IDEDrive),
     .class_init    = ide_cf_class_init,
 };
 +#endif
 static void ide_device_class_init(ObjectClass *klass, void *data)
 {
@@ -396,7 +402,10 @@ static void ide_register_types(void)
     type_register_static(&ide_bus_info);
     type_register_static(&ide_hd_info);
     type_register_static(&ide_cd_info);
 +/* Disabled for Red Hat Enterprise Linux */
 +#if 0
     type_register_static(&ide_cf_info);
 +#endif
     type_register_static(&ide_device_type_info);
 }
 diff --git a/hw/input/pckbd.c b/hw/input/pckbd.c
 index b92b63bedc..3b6235dde6 100644
 --- a/hw/input/pckbd.c
 +++ b/hw/input/pckbd.c
@@ -957,6 +957,8 @@ static void i8042_class_initfn(ObjectClass *klass, void *data)
     dc->vmsd = &vmstate_kbd_isa;
     adevc->build_dev_aml = i8042_build_aml;
     set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
 +    /* Disabled for Red Hat Enterprise Linux: */
 +    dc->user_creatable = false;
 }
 static const TypeInfo i8042_info = {
 diff --git a/hw/net/e1000.c b/hw/net/e1000.c
 index 8ffe1077f1..b3dfeeca4f 100644
 --- a/hw/net/e1000.c
 +++ b/hw/net/e1000.c
@@ -1746,6 +1746,7 @@ static const E1000Info e1000_devices[] = {
         .revision  = 0x03,
         .phy_id2   = E1000_PHY_ID2_8254xx_DEFAULT,
     },
 +#if 0 /* Disabled for Red Hat Enterprise Linux 7 */
     {
         .name      = "e1000-82544gc",
         .device_id = E1000_DEV_ID_82544GC_COPPER,
@@ -1758,6 +1759,7 @@ static const E1000Info e1000_devices[] = {
         .revision  = 0x03,
         .phy_id2   = E1000_PHY_ID2_8254xx_DEFAULT,
     },
 +#endif
 };
 static void e1000_register_types(void)
 diff --git a/hw/ppc/spapr_cpu_core.c b/hw/ppc/spapr_cpu_core.c
 index 91fae56573..33e0c8724c 100644
 --- a/hw/ppc/spapr_cpu_core.c
 +++ b/hw/ppc/spapr_cpu_core.c
@@ -386,10 +386,12 @@ static const TypeInfo spapr_cpu_core_type_infos[] = {
         .instance_size = sizeof(SpaprCpuCore),
         .class_size = sizeof(SpaprCpuCoreClass),
     },
 +#if 0  /* Disabled for Red Hat Enterprise Linux */
     DEFINE_SPAPR_CPU_CORE_TYPE("970_v2.2"),
     DEFINE_SPAPR_CPU_CORE_TYPE("970mp_v1.0"),
     DEFINE_SPAPR_CPU_CORE_TYPE("970mp_v1.1"),
     DEFINE_SPAPR_CPU_CORE_TYPE("power5+_v2.1"),
 +#endif
     DEFINE_SPAPR_CPU_CORE_TYPE("power7_v2.3"),
     DEFINE_SPAPR_CPU_CORE_TYPE("power7+_v2.1"),
     DEFINE_SPAPR_CPU_CORE_TYPE("power8_v2.0"),
 diff --git a/hw/usb/meson.build b/hw/usb/meson.build
 index e94149ebde..4a8adbf3dc 100644
 --- a/hw/usb/meson.build
 +++ b/hw/usb/meson.build
@@ -52,7 +52,7 @@ system_ss.add(when: 'CONFIG_USB_SMARTCARD', if_true: files('dev-smartcard-reader
 if cacard.found()
   usbsmartcard_ss = ss.source_set()
   usbsmartcard_ss.add(when: 'CONFIG_USB_SMARTCARD',
 -                      if_true: [cacard, files('ccid-card-emulated.c', 'ccid-card-passthru.c')])
 +                      if_true: [cacard, files('ccid-card-passthru.c')])
   hw_usb_modules += {'smartcard': usbsmartcard_ss}
 endif
 diff --git a/hw/virtio/meson.build b/hw/virtio/meson.build
 index c0055a7832..12e1d6c67e 100644
 --- a/hw/virtio/meson.build
 +++ b/hw/virtio/meson.build
@@ -17,8 +17,9 @@ if have_vhost
   if have_vhost_user
     # fixme - this really should be generic
     specific_virtio_ss.add(files('vhost-user.c'))
 -    system_virtio_ss.add(files('vhost-user-device.c'))
 -    system_virtio_ss.add(when: 'CONFIG_VIRTIO_PCI', if_true: files('vhost-user-device-pci.c'))
 +# Disabled for 8.2.0 rebase for RHEL 9.4.0
 +#    system_virtio_ss.add(files('vhost-user-device.c'))
 +#    system_virtio_ss.add(when: 'CONFIG_VIRTIO_PCI', if_true: files('vhost-user-device-pci.c'))
   endif
   if have_vhost_vdpa
     system_virtio_ss.add(files('vhost-vdpa.c'))
 diff --git a/target/arm/arm-qmp-cmds.c b/target/arm/arm-qmp-cmds.c
 index b53d5efe13..64989a02d1 100644
 --- a/target/arm/arm-qmp-cmds.c
 +++ b/target/arm/arm-qmp-cmds.c
@@ -231,6 +231,7 @@ CpuModelExpansionInfo *qmp_query_cpu_model_expansion(CpuModelExpansionType type,
 static void arm_cpu_add_definition(gpointer data, gpointer user_data)
 {
     ObjectClass *oc = data;
 +    CPUClass *cc = CPU_CLASS(oc);
     CpuDefinitionInfoList **cpu_list = user_data;
     CpuDefinitionInfo *info;
     const char *typename;
@@ -240,6 +241,7 @@ static void arm_cpu_add_definition(gpointer data, gpointer user_data)
     info->name = g_strndup(typename,
                            strlen(typename) - strlen("-" TYPE_ARM_CPU));
     info->q_typename = g_strdup(typename);
 +    info->deprecated = !!cc->deprecation_note;
     QAPI_LIST_PREPEND(*cpu_list, info);
 }
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index efb22a87f9..a32521ada9 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -2524,6 +2524,10 @@ static void cpu_register_class_init(ObjectClass *oc, void *data)
     acc->info = data;
     cc->gdb_core_xml_file = "arm-core.xml";
 +    
 +    if (acc->info->deprecation_note) {
 +        cc->deprecation_note = acc->info->deprecation_note;
 +    }
 }
 void arm_cpu_register(const ARMCPUInfo *info)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index a0282e0d28..7e0f0dfea7 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
@@ -34,6 +34,8 @@
 #define KVM_HAVE_MCE_INJECTION 1
 #endif
 +#define RHEL_CPU_DEPRECATION "use 'host' / 'max'"
 +
 #define EXCP_UDEF            1   /* undefined instruction */
 #define EXCP_SWI             2   /* software interrupt */
 #define EXCP_PREFETCH_ABORT  3
@@ -1120,6 +1122,7 @@ typedef struct ARMCPUInfo {
     const char *name;
     void (*initfn)(Object *obj);
     void (*class_init)(ObjectClass *oc, void *data);
 +    const char *deprecation_note;
 } ARMCPUInfo;
 /**
 diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index 1e9c6c85ae..10be900803 100644
 --- a/target/arm/cpu64.c
 +++ b/target/arm/cpu64.c
@@ -648,6 +648,7 @@ static void aarch64_a57_initfn(Object *obj)
     define_cortex_a72_a57_a53_cp_reginfo(cpu);
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void aarch64_a53_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
@@ -704,6 +705,7 @@ static void aarch64_a53_initfn(Object *obj)
     cpu->gic_pribits = 5;
     define_cortex_a72_a57_a53_cp_reginfo(cpu);
 }
 +#endif
 static void aarch64_host_initfn(Object *obj)
 {
@@ -742,8 +744,11 @@ static void aarch64_max_initfn(Object *obj)
 }
 static const ARMCPUInfo aarch64_cpus[] = {
 -    { .name = "cortex-a57",         .initfn = aarch64_a57_initfn },
 +    { .name = "cortex-a57",         .initfn = aarch64_a57_initfn,
 +      .deprecation_note = RHEL_CPU_DEPRECATION },
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
     { .name = "cortex-a53",         .initfn = aarch64_a53_initfn },
 +#endif /* disabled for RHEL */
     { .name = "max",                .initfn = aarch64_max_initfn },
 #if defined(CONFIG_KVM) || defined(CONFIG_HVF)
     { .name = "host",               .initfn = aarch64_host_initfn },
@@ -815,8 +820,13 @@ static void aarch64_cpu_instance_init(Object *obj)
 static void cpu_register_class_init(ObjectClass *oc, void *data)
 {
     ARMCPUClass *acc = ARM_CPU_CLASS(oc);
 +    CPUClass *cc = CPU_CLASS(oc);
     acc->info = data;
 +
 +    if (acc->info->deprecation_note) {
 +        cc->deprecation_note = acc->info->deprecation_note;
 +    }
 }
 void aarch64_cpu_register(const ARMCPUInfo *info)
 diff --git a/target/arm/tcg/cpu32.c b/target/arm/tcg/cpu32.c
 index d9e0e2a4dd..c5c639a6ea 100644
 --- a/target/arm/tcg/cpu32.c
 +++ b/target/arm/tcg/cpu32.c
@@ -98,6 +98,7 @@ void aa32_max_features(ARMCPU *cpu)
 /* CPU models. These are not needed for the AArch64 linux-user build. */
 #if !defined(CONFIG_USER_ONLY) || !defined(TARGET_AARCH64)
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 #if !defined(CONFIG_USER_ONLY)
 static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
 {
@@ -1189,3 +1190,4 @@ static void arm_tcg_cpu_register_types(void)
 type_init(arm_tcg_cpu_register_types)
 #endif /* !CONFIG_USER_ONLY || !TARGET_AARCH64 */
 +#endif /* disabled for RHEL */
 diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
 index fcda99e158..bd5a993ff8 100644
 --- a/target/arm/tcg/cpu64.c
 +++ b/target/arm/tcg/cpu64.c
@@ -29,6 +29,7 @@
 #include "cpu-features.h"
 #include "cpregs.h"
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static uint64_t make_ccsidr64(unsigned assoc, unsigned linesize,
                               unsigned cachesize)
 {
@@ -134,6 +135,7 @@ static void aarch64_a35_initfn(Object *obj)
     /* These values are the same with A53/A57/A72. */
     define_cortex_a72_a57_a53_cp_reginfo(cpu);
 }
 +#endif
 static void cpu_max_get_sve_max_vq(Object *obj, Visitor *v, const char *name,
                                    void *opaque, Error **errp)
@@ -223,6 +225,7 @@ static void cpu_max_get_l0gptsz(Object *obj, Visitor *v, const char *name,
 static Property arm_cpu_lpa2_property =
     DEFINE_PROP_BOOL("lpa2", ARMCPU, prop_lpa2, true);
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void aarch64_a55_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
@@ -1065,6 +1068,7 @@ static void aarch64_neoverse_n2_initfn(Object *obj)
     aarch64_add_pauth_properties(obj);
     aarch64_add_sve_properties(obj);
 }
 +#endif
 /*
  * -cpu max: a CPU with as many features enabled as our emulation supports.
@@ -1259,6 +1263,7 @@ void aarch64_max_tcg_initfn(Object *obj)
     qdev_property_add_static(DEVICE(obj), &arm_cpu_lpa2_property);
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static const ARMCPUInfo aarch64_cpus[] = {
     { .name = "cortex-a35",         .initfn = aarch64_a35_initfn },
     { .name = "cortex-a55",         .initfn = aarch64_a55_initfn },
@@ -1270,14 +1275,17 @@ static const ARMCPUInfo aarch64_cpus[] = {
     { .name = "neoverse-v1",        .initfn = aarch64_neoverse_v1_initfn },
     { .name = "neoverse-n2",        .initfn = aarch64_neoverse_n2_initfn },
 };
 +#endif
 static void aarch64_cpu_register_types(void)
 {
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
     size_t i;
     for (i = 0; i < ARRAY_SIZE(aarch64_cpus); ++i) {
         aarch64_cpu_register(&aarch64_cpus[i]);
     }
 +#endif
 }
 type_init(aarch64_cpu_register_types)
 diff --git a/target/ppc/cpu-models.c b/target/ppc/cpu-models.c
 index 7dbb47de64..69fddb05bc 100644
 --- a/target/ppc/cpu-models.c
 +++ b/target/ppc/cpu-models.c
@@ -66,6 +66,7 @@
 #define POWERPC_DEF(_name, _pvr, _type, _desc)                              \
     POWERPC_DEF_SVR(_name, _desc, _pvr, POWERPC_SVR_NONE, _type)
 +#if 0  /* Embedded and 32-bit CPUs disabled for Red Hat Enterprise Linux */
     /* Embedded PowerPC                                                      */
     /* PowerPC 405 family                                                    */
     /* PowerPC 405 cores                                                     */
@@ -698,8 +699,10 @@
                 "PowerPC 7447A v1.2 (G4)")
     POWERPC_DEF("7457a_v1.2",    CPU_POWERPC_74x7A_v12,              7455,
                 "PowerPC 7457A v1.2 (G4)")
 +#endif
     /* 64 bits PowerPC                                                       */
 #if defined(TARGET_PPC64)
 +#if 0  /* Disabled for Red Hat Enterprise Linux */
     POWERPC_DEF("970_v2.2",      CPU_POWERPC_970_v22,                970,
                 "PowerPC 970 v2.2")
     POWERPC_DEF("970fx_v1.0",    CPU_POWERPC_970FX_v10,              970,
@@ -718,6 +721,7 @@
                 "PowerPC 970MP v1.1")
     POWERPC_DEF("power5+_v2.1",  CPU_POWERPC_POWER5P_v21,            POWER5P,
                 "POWER5+ v2.1")
 +#endif
     POWERPC_DEF("power7_v2.3",   CPU_POWERPC_POWER7_v23,             POWER7,
                 "POWER7 v2.3")
     POWERPC_DEF("power7+_v2.1",  CPU_POWERPC_POWER7P_v21,            POWER7,
@@ -898,12 +902,15 @@ PowerPCCPUAlias ppc_cpu_aliases[] = {
     { "7447a", "7447a_v1.2" },
     { "7457a", "7457a_v1.2" },
     { "apollo7pm", "7457a_v1.0" },
 +#endif
 #if defined(TARGET_PPC64)
 +#if 0  /* Disabled for Red Hat Enterprise Linux */
     { "970", "970_v2.2" },
     { "970fx", "970fx_v3.1" },
     { "970mp", "970mp_v1.1" },
     { "power5+", "power5+_v2.1" },
     { "power5gs", "power5+_v2.1" },
 +#endif
     { "power7", "power7_v2.3" },
     { "power7+", "power7+_v2.1" },
     { "power8e", "power8e_v2.1" },
@@ -913,12 +920,14 @@ PowerPCCPUAlias ppc_cpu_aliases[] = {
     { "power10", "power10_v2.0" },
 #endif
 +#if 0  /* Disabled for Red Hat Enterprise Linux */
     /* Generic PowerPCs */
 #if defined(TARGET_PPC64)
     { "ppc64", "970fx_v3.1" },
 #endif
     { "ppc32", "604" },
     { "ppc", "604" },
 +#endif
     { NULL, NULL }
 };
 diff --git a/target/s390x/cpu_models_sysemu.c b/target/s390x/cpu_models_sysemu.c
 index 63981bf36b..87a4480c05 100644
 --- a/target/s390x/cpu_models_sysemu.c
 +++ b/target/s390x/cpu_models_sysemu.c
@@ -35,6 +35,9 @@ static void check_unavailable_features(const S390CPUModel *max_model,
         (max_model->def->gen == model->def->gen &&
          max_model->def->ec_ga < model->def->ec_ga)) {
         list_add_feat("type", unavailable);
 +    } else if (model->def->gen < 11 && kvm_enabled()) {
 +        /* Older CPU models are not supported on Red Hat Enterprise Linux */
 +        list_add_feat("type", unavailable);
     }
     /* detect missing features if any to properly report them */
 diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c
 index 33ab3551f4..912e493951 100644
 --- a/target/s390x/kvm/kvm.c
 +++ b/target/s390x/kvm/kvm.c
@@ -2567,6 +2567,14 @@ void kvm_s390_apply_cpu_model(const S390CPUModel *model, Error **errp)
         error_setg(errp, "KVM doesn't support CPU models");
         return;
     }
 +
 +    /* Older CPU models are not supported on Red Hat Enterprise Linux */
 +    if (model->def->gen < 11) {
 +        error_setg(errp, "KVM: Unsupported CPU type specified: %s",
 +                   MACHINE(qdev_get_machine())->cpu_type);
 +        return;
 +    }
 +
     prop.cpuid = s390_cpuid_from_cpu_model(model);
     prop.ibc = s390_ibc_from_cpu_model(model);
     /* configure cpu features indicated via STFL(e) */
 diff --git a/tests/qtest/arm-cpu-features.c b/tests/qtest/arm-cpu-features.c
 index a8a4c668ad..2458cc527c 100644
 --- a/tests/qtest/arm-cpu-features.c
 +++ b/tests/qtest/arm-cpu-features.c
@@ -451,8 +451,10 @@ static void test_query_cpu_model_expansion(const void *data)
     assert_error(qts, "host", "The CPU type 'host' requires KVM", NULL);
     /* Test expected feature presence/absence for some cpu types */
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
     assert_has_feature_enabled(qts, "cortex-a15", "pmu");
     assert_has_not_feature(qts, "cortex-a15", "aarch64");
 +#endif /* disabled for RHEL */
     /* Enabling and disabling pmu should always work. */
     assert_has_feature_enabled(qts, "max", "pmu");
@@ -469,6 +471,7 @@ static void test_query_cpu_model_expansion(const void *data)
         assert_has_feature_enabled(qts, "cortex-a57", "pmu");
         assert_has_feature_enabled(qts, "cortex-a57", "aarch64");
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
         assert_has_feature_enabled(qts, "a64fx", "pmu");
         assert_has_feature_enabled(qts, "a64fx", "aarch64");
         /*
@@ -481,6 +484,7 @@ static void test_query_cpu_model_expansion(const void *data)
                      "{ 'sve384': true }");
         assert_error(qts, "a64fx", "cannot enable sve640",
                      "{ 'sve640': true }");
 +#endif /* disabled for RHEL */
         sve_tests_default(qts, "max");
         pauth_tests_default(qts, "max");
 -- 
 2.39.3
--- a/SOURCES/0005-Initial-redhat-build.patch
+++ b/SOURCES/0005-Initial-redhat-build.patch
@ -0,0 +1,351 @@
 From 19ce5ff93ddd6b8a998348f2a5f59f603c5e11b7 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 12 Oct 2018 07:31:11 +0200
 Subject: Initial redhat build
 This patch introduces redhat build structure in redhat subdirectory. In addition,
 several issues are fixed in QEMU tree:
 - Change of app name for sasl_server_init in VNC code from qemu to qemu-kvm
  - As we use qemu-kvm as name in all places, this is updated to be consistent
 - Man page renamed from qemu to qemu-kvm
  - man page is installed using make install so we have to fix it in qemu tree
 This rebase includes changes up to qemu-kvm-6.1.0-5.el9
 Rebase notes (3.1.0):
 - added new configure options
 Rebase notes (4.0.0):
 - Added dependency to perl-Test-Harness (upstream)
 - Added dependency to python3-sphinx (upstream)
 - Change location of icons (upstream)
 - Remove .desktop file (added upstream)
 - Added qemu-trace-stap (added upstream)
 - Removed elf2dmp (added upstream)
 - Remove .buildinfo
 - Added pvh.bin rom (added upstream)
 - Added interop documentation files
 - Use python module instead of qemu.py (upstream)
 Rebase notes (4.1.0):
 - Remove edk2 files generated by build
 - Switch to rhel-8.1-candidate build target
 - Remove specs documentation
 - Switched from libssh2 to libssh
 - Add rc0 tarball usage hacks
 - Added BuildRequires for wget, rpm-build and python3-sphinx
 - Removed new unpacked files
 - Update configure line to use new options
 Rebase notes (4.2.0):
 - Disable iotest run during make check
 - README renamed to README.rst (upstream)
 - Removed ui-spice-app.so
 - Added relevant changes from "505f7f4 redhat: Adding slirp to the exploded tree"
 - Removed qemu-ga.8 install from spec file - installed by make
 - Removed spapr-rtas.bin (upstream)
 - Require newer SLOF (20191022)
 Rebase notes (5.1.0):
 - Use python3 for virtio_seg_max_adjust.py test
 - Removed qemu-trace-stap shebang from spec file
 - Added virtiofsd.1 (upstream)
 - Use out-of-tree build
 - New documentation structure (upstream)
 - Update local build
 - Removing installed qemu-storage-daemon (added upstream)
 - Removing opensbi-riscv32-sifive_u-fw_jump.bin (added upstream)
 - Disable iotests (moved from Enable make check commit)
 - Added missing configure options
 - Reorder configure options
 - qemu-pr-helper moved to /usr/libexec/ (upstream)
 - Added submodules for usb-redir, smartcard-reader and qxl display (upstream)
 - Added setting rc version in Makefile for build
 - removed --disable-vxhs configure option (removed upstream)
 - bumped required libusbx-devel version to 1.0.23
 - bumped libfdt version to 1.6.0
 Rebase notes (5.2.0 rc0):
 - Move libfdt dependency to qemu-kvm-core
 - Move manpage rename from Makefile to spec file
 - rename with-confsuffix configure option to with-suffix (upstream)
 - Bump libusbx Requires version to 1.0.234
 - Manual copy of keymaps in spec file (BZ 1875217)
 - Removed /usr/share/qemu-kvm/npcm7xx_bootrom.bin, considering it
  unpackaged for now.
 - Removed /usr/share/qemu-kvm/qboot.rom, considering unpackaged.
 - Added build dependency for meson and ninja-build
 - hw/s390/s390-pci-vfio.c hack - set NULL for g_autofree variables
 - Removed Chanelog (upstream)
 - Fix in directory used for docs (upstream add %name so we do not pass it in configure)
 - Package various .so as part of qemu-kvm-core package.
 Rebase notes (5.2.0 rc2):
 - Added fix for dtrace build on RHEL 8.4.0
 Rebase notes (5.2.0 rc3):
 - Added man page for qemu-pr-helper
 - Added new configure options
 - Update qemu-kiwi patches to v4
 Rebase notes (6.0.0):
 - update tracetool usage in spec file
 - remove qemu-storage-daemon-qmp-ref man page
 - remove qemu-storage-daemon man page
 - Added devel documentation
 - do not package virtfs-proxy-helper files
 - Use --with-git-submodules instead of --(enable|disable)-git-update
 - Minor build fixes for sending upstream
 - g_autofree initialization fixed upstream
 - Updated rc information usage
 - do not package package hw-s390x-virtio-gpu-ccw.so
 - Disable new switch options
 Rebase notes (6.1.0):
 - Fix warning issue in block.c
 - Download tarball from dist-git cache
 - Removed sheepdog driver
 - Added new display modules:
  - hw-display-virtio-gpu-gl.so
  - hw-display-virtio-gpu-pci-gl.so
  - hw-display-virtio-vga-gl.so
 - sasl fix moved from ui/vnc.c to ui/vnc-auth-sasl.c
 - Added accel-qtest-%{kvm_target} and accel-tcg-%{kvm_target}
 - Added about docs
 - Use -q option for setup
 - Added hw-usb-host.so
 - Disable new options (bpf, nvmm, slirp-smbd)
 Rebase notes (6.2.0):
 - Using internal meson
 - removed --disable-jemalloc and --disable-tcmalloc configure options
 - added audio-oss.so
 - added fdt requirement for x86_64
 - tests/acceptance renamed to tests/avocado
 - added multiboot_dma.bin
 - Removed conflict relics
 - Updated configure options
 Merged patches (3.1.0):
 - 01f0c9f RHEL8: Add disable configure options to qemu spec file
 - Spec file cleanups
 Merged patches (4.0.0):
 - aa4297c Add edk2 Requires to qemu-kvm
 - d124ff5779 Fixing brew build target
 - eb204b5 Introduce the qemu-kvm-tests rpm
 - 223cf0c Load kvm module during boot (partial)
 Merged patches (4.1.0):
 - ebb6e97 redhat: Fix LOCALVERSION creation
 - b0ab0cc redhat: enable tpmdev passthrough (not disabling tests)
 - 7cb3c4a Enable libpmem to support nvdimm
 - 8943607 qemu-kvm.spec: bump libseccomp >= 2.4.0
 - 27b7c44 rh: set CONFIG_BOCHS_DISPLAY=y for x86 (partial)
 - e1fe9fe x86_64-rh-devices: enable TPM emulation (partial)
 Merged patches (4.2.0):
 - 69e1fb2 enable virgla
 - d4f6115 enable virgl, for real this time ...
 Merged patches (5.1.0):
 - 5edf6bd Add support for rh-brew-module
 - f77d52d redhat: ship virtiofsd vhost-user device backend
 - 63f12d4 redhat: Always use module build target for rh-brew (modified)
 - 9b1e140 redhat: updating the modular target
 - 44b8bd0 spec: Fix python shenigans for tests
 Merged patches (5.2.0 rc0):
 - 9238ce7 Add support for simpletrace
 - 5797cff Remove explicit glusterfs-api dependency
 - fd62478 disable virgl
 - 0205018 redhat: link /etc/qemu-ga/fsfreeze-hook to /etc/qemu-kvm/
 - 3645097 redhat: Make all generated so files executable (not only block-*)
 Merged patches (5.2.0 rc2):
 - pjw 99657 redhat: introduces disable_everything macro into the configure call
 - pjw 99659 redhat: scripts/extract_build_cmd.py - Avoid listing empty lines
 - pjw 99658 redhat: Fixing rh-local build
 - pjw 99660 redhat: Add qemu-kiwi subpackage
 - d2e59ce redhat: add (un/pre)install systemd hooks for qemu-ga
 Merged patches (5.2.0 rc3):
 - pjw 99887 - redhat: allow Makefile rh-prep builddep to fail
 - pjw 99885 - redhat: adding rh-rpm target
 Merged patches (6.0.0):
 - 5ab9954a3b spec: find system python via meson
 - cd0f7db11f build-system: use b_staticpic=false
 - 80d2dec42c udev-kvm-check: remove the "exceeded subscription limit" message
 - 38959d51c0 redhat: Allow make to inherit params from parent make for rh-local
 - 1e0cfe458f redhat: moving all documentation files to qemu-kvm-docs
 - d7a594d02b redhat: makes qemu respect system's crypto profile
 - e2bbf1572b spec: Package qemu-storage-daemon
 - 92f10993ba spec: ui-spice sub-package
 - 8931e46069 spec: ui-opengl sub-package
 Merged patches (6.1.0):
 - 7bb57541b3 redhat: Install the s390-netboot.img that we've built
 - b4a8531f41 redhat: Fix "unversioned Obsoletes" warning
 - 141a1693c7 redhat: Move qemu-kvm-docs dependency to qemu-kvm
 - d75f59c6f9 redhat: introducting qemu-kvm-hw-usbredir
 - a934d8bf44 redhat: use the standard vhost-user JSON path
 Merged patches (6.2.0):
 - 4f3f04bbb6 spec: Remove qemu-kiwi build
 ---
 .gitignore                                 |    1 +
 .gitlab-ci.yml                             |   24 -
 .gitlab/issue_templates/bug.md             |   64 -
 .gitlab/issue_templates/feature_request.md |   32 -
 README.systemtap                           |   43 +
 meson.build                                |    4 +-
 redhat/Makefile                            |   90 +
 redhat/Makefile.common                     |   48 +
 redhat/README.tests                        |   39 +
 redhat/qemu-kvm.spec.template              | 3896 ++++++++++++++++++++
 redhat/scripts/extract_build_cmd.py        |    5 +-
 redhat/scripts/process-patches.sh          |   20 +-
 redhat/scripts/tarball_checksum.sh         |    2 +-
 redhat/udev-kvm-check.c                    |   19 +-
 scripts/qemu-guest-agent/fsfreeze-hook     |    2 +-
 scripts/systemtap/conf.d/qemu_kvm.conf     |    4 +
 scripts/systemtap/script.d/qemu_kvm.stp    |    1 +
 tests/check-block.sh                       |    2 +
 ui/vnc-auth-sasl.c                         |    2 +-
 19 files changed, 4142 insertions(+), 156 deletions(-)
 delete mode 100644 .gitlab-ci.yml
 delete mode 100644 .gitlab/issue_templates/bug.md
 delete mode 100644 .gitlab/issue_templates/feature_request.md
 create mode 100644 README.systemtap
 create mode 100644 redhat/Makefile
 create mode 100644 redhat/Makefile.common
 create mode 100644 redhat/README.tests
 create mode 100644 redhat/qemu-kvm.spec.template
 create mode 100644 scripts/systemtap/conf.d/qemu_kvm.conf
 create mode 100644 scripts/systemtap/script.d/qemu_kvm.stp
 diff --git a/README.systemtap b/README.systemtap
 new file mode 100644
 index 0000000000..ad913fc990
 --- /dev/null
 +++ b/README.systemtap
@@ -0,0 +1,43 @@
 +QEMU tracing using systemtap-initscript
 +---------------------------------------
 +
 +You can capture QEMU trace data all the time using systemtap-initscript.  This
 +uses SystemTap's flight recorder mode to trace all running guests to a
 +fixed-size buffer on the host.  Old trace entries are overwritten by new
 +entries when the buffer size wraps.
 +
 +1. Install the systemtap-initscript package:
 +  # yum install systemtap-initscript
 +
 +2. Install the systemtap scripts and the conf file:
 +  # cp /usr/share/qemu-kvm/systemtap/script.d/qemu_kvm.stp /etc/systemtap/script.d/
 +  # cp /usr/share/qemu-kvm/systemtap/conf.d/qemu_kvm.conf /etc/systemtap/conf.d/
 +
 +The set of trace events to enable is given in qemu_kvm.stp.  This SystemTap
 +script can be customized to add or remove trace events provided in
 +/usr/share/systemtap/tapset/qemu-kvm-simpletrace.stp.
 +
 +SystemTap customizations can be made to qemu_kvm.conf to control the flight
 +recorder buffer size and whether to store traces in memory only or disk too.
 +See stap(1) for option documentation.
 +
 +3. Start the systemtap service.
 +　# service systemtap start qemu_kvm
 +
 +4. Make the service start at boot time.
 +　# chkconfig systemtap on
 +
 +5. Confirm that the service works.
 +  # service systemtap status qemu_kvm
 +  qemu_kvm is running...
 +
 +When you want to inspect the trace buffer, perform the following steps:
 +
 +1. Dump the trace buffer.
 +  # staprun -A qemu_kvm >/tmp/trace.log
 +
 +2. Start the systemtap service because the preceding step stops the service.
 +  # service systemtap start qemu_kvm
 +
 +3. Translate the trace record to readable format.
 +  # /usr/share/qemu-kvm/simpletrace.py --no-header /usr/share/qemu-kvm/trace-events /tmp/trace.log
 diff --git a/meson.build b/meson.build
 index 96de1a6ef9..5f6ba86dbb 100644
 --- a/meson.build
 +++ b/meson.build
@@ -2108,7 +2108,9 @@ if capstone_opt == 'internal'
     # Include all configuration defines via a header file, which will wind up
     # as a dependency on the object file, and thus changes here will result
     # in a rebuild.
 -    '-include', 'capstone-defs.h'
 +    '-include', 'capstone-defs.h',
 +
 +    '-Wp,-D_GLIBCXX_ASSERTIONS',
   ]
   libcapstone = static_library('capstone',
 diff --git a/scripts/qemu-guest-agent/fsfreeze-hook b/scripts/qemu-guest-agent/fsfreeze-hook
 index 13aafd4845..e9b84ec028 100755
 --- a/scripts/qemu-guest-agent/fsfreeze-hook
 +++ b/scripts/qemu-guest-agent/fsfreeze-hook
@@ -8,7 +8,7 @@
 # request, it is issued with "thaw" argument after filesystem is thawed.
 LOGFILE=/var/log/qga-fsfreeze-hook.log
 -FSFREEZE_D=$(dirname -- "$0")/fsfreeze-hook.d
 +FSFREEZE_D=$(dirname -- "$(realpath $0)")/fsfreeze-hook.d
 # Check whether file $1 is a backup or rpm-generated file and should be ignored
 is_ignored_file() {
 diff --git a/scripts/systemtap/conf.d/qemu_kvm.conf b/scripts/systemtap/conf.d/qemu_kvm.conf
 new file mode 100644
 index 0000000000..372d8160a4
 --- /dev/null
 +++ b/scripts/systemtap/conf.d/qemu_kvm.conf
@@ -0,0 +1,4 @@
 +# Force load uprobes (see BZ#1118352)
 +stap -e 'probe process("/usr/libexec/qemu-kvm").function("main") { printf("") }' -c true
 +
 +qemu_kvm_OPT="-s4" # per-CPU buffer size, in megabytes
 diff --git a/scripts/systemtap/script.d/qemu_kvm.stp b/scripts/systemtap/script.d/qemu_kvm.stp
 new file mode 100644
 index 0000000000..c04abf9449
 --- /dev/null
 +++ b/scripts/systemtap/script.d/qemu_kvm.stp
@@ -0,0 +1 @@
 +probe qemu.kvm.simpletrace.handle_qmp_command,qemu.kvm.simpletrace.monitor_protocol_*,qemu.kvm.simpletrace.migrate_set_state {}
 diff --git a/tests/check-block.sh b/tests/check-block.sh
 index f86cb863de..6d38340d49 100755
 --- a/tests/check-block.sh
 +++ b/tests/check-block.sh
@@ -69,6 +69,8 @@ else
     fi
 fi
 +exit 0
 +
 cd tests/qemu-iotests
 # QEMU_CHECK_BLOCK_AUTO is used to disable some unstable sub-tests
 diff --git a/ui/vnc-auth-sasl.c b/ui/vnc-auth-sasl.c
 index 47fdae5b21..2a950caa2a 100644
 --- a/ui/vnc-auth-sasl.c
 +++ b/ui/vnc-auth-sasl.c
@@ -42,7 +42,7 @@
 bool vnc_sasl_server_init(Error **errp)
 {
 -    int saslErr = sasl_server_init(NULL, "qemu");
 +    int saslErr = sasl_server_init(NULL, "qemu-kvm");
     if (saslErr != SASL_OK) {
         error_setg(errp, "Failed to initialize SASL auth: %s",
 -- 
 2.27.0
--- a/SOURCES/0006-Enable-disable-devices-for-RHEL.patch
+++ b/SOURCES/0006-Enable-disable-devices-for-RHEL.patch
@ -0,0 +1,795 @@
 From 3d5a82d172345d17e300672909835262ff9dc917 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 2 Sep 2020 09:11:07 +0200
 Subject: Enable/disable devices for RHEL
 This commit adds all changes related to changes in supported devices.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 Rebase notes (qemu 3.1.0)
 - spapr_rng disabled in default_config
 - new hyperv.mak in default configs
 - Move changes from x86_64-softmmu.mak to i386-softmmu.mak
 - Added CONFIG_VIRTIO_MMIO to aarch64-softmmu.mak
 - Removed config_vga_isa.c changes as no longer needed
 - Removed new devices
 Rebase notes (4.0.0):
 - Added CONFIG_PCI_EXPRESS_GENERIC_BRIDGE for aarch64-softmmu.mak
 - Added CONFIG_ARM_VIRT for aarch64-softmmu.mak
 - Switch to KConfig (upstream)
 - Using device whitelist + without-defualt-devices option
 Rebase notes (4.1.0):
 - Added CONFIG_USB_OHCI_PCI for ppc64
 - Added CONFIG_XIVE_KVM for ppc64
 - Added CONFIG_ACPI_PCI for x86_64
 - Added CONFIG_SEMIHOSTING for aarch64
 - Cleanup aarch64 devices
 - Do not build a15mpcore.c
 - Removed ide-isa.c stub file
 - Use CONFIG_USB_EHCI_PCI on x86_64 (new upstream)
 Rebase notes (4.2.0-rc0):
 - Use conditional build for isa-superio.c (upstream change)
 - Rename PCI_PIIX to PCI_I440FX (upstream change)
 Rebase notes (4.2.0-rc3):
 - Disabled ccid-card-emulated (patch 92566)
 - Disabled vfio-pci-igd-lpc-bridge (patch 92565)
 Rebase notes (5.1.0):
 - added CONFIG_PCI_EXPRESS on ppc64 (due to upstream dependency)
 - Added CONFIG_NVDIMM
 - updated cortex-15 disabling to upstream code
 - Add CONFIG_ACPI_APEI for aarch64
 - removed obsolete hw/bt/Makefile.objs chunk
 - removed unnecessary changes in target/i386/cpu.c
 Rebase notes (5.2.0 rc0):
 - Added CONFIG_USB_XHCI_PCI on aarch64 ppc64 and x86_64
 - remove vl.c hack for no hpet
 - Enable CONFIG_PTIMER for aarch64
 - Do not package hw-display-virtio-gpu.so on s390x
 Rebase notes (5.2.0 rc1):
 - Added CONFIG_ARM_GIC for aarch64 (required for build)
 Rebase notes (weekly-210113):
 - Removed XICS_KVM, XICS_SPAPR, XIVE_KVM and XIVE_SPAPR config (removed upstream)
 Rebase notes (weekly-210120):
 - Add CONFIG_ARM_COMPATIBLE_SEMIHOSTING option
 Rebase notes (weekly-210203):
 - Rename CONFIG_PVPANIC to CONFIG_PVPANIC_ISA
 Rebase notes (weekly-210317):
 - Add new USB_STORAGE_CORE and USB_STORAGE_CLASSIC config for ppc64 and x86_64
 - Update disabling TCG cpus for AArch64
 Rebase notes (weekly-210519):
 - Do not use CONFIG_SPICE and CONFIG_OPENGL in default configs
 Rebase notes (weekly-210623):
 - Add CONFIG_TPM for archs with used TPM functionality
 Rebase notes (weekly-210714):
 - default_configs moved to configs
 Rebase notes (6.1.0 rc2):
 - Use --with-device-ARCH configure option to use redhat config files
 Rebase notes (6.2.0 rc3):
 - Do not remove -no-hpet documentation
 Merged patches (qemu 3.1.0):
 - d51e082 Re-enable CONFIG_HYPERV_TESTDEV
 - 4b889f3 Declare cirrus-vga as deprecated
 - b579d32 Do not build bluetooth support
 - 3eef52a Disable CONFIG_IPMI and CONFIG_I2C for ppc64
 - 9caf292 Disable CONFIG_CAN_BUS and CONFIG_CAN_SJA1000
 Merged patches (4.1.0):
 - 20a51f6 fdc: Revert downstream disablement of device "floppy"
 - f869cc0 fdc: Restrict floppy controllers to RHEL-7 machine types
 - 5909721 aarch64: Compile out IOH3420
 - 27b7c44 rh: set CONFIG_BOCHS_DISPLAY=y for x86 (partial)
 - 495a27d x86_64-rh-devices: add missing TPM passthrough
 - e1fe9fe x86_64-rh-devices: enable TPM emulation (partial)
 Merged patches (4.2.0):
 - f7587dd RHEL: disable hostmem-memfd
 Merged patches (5.1.0):
 - 4543a3c i386: Remove cpu64-rhel6 CPU model
 - 96533 aarch64: Remove tcg cpu types (pjw commit)
 - 559d589 Revert "RHEL: disable hostmem-memfd"
 - 441128e enable ramfb
 Merged patches (5.2.0 rc0):
 - f70eb50 RHEL-only: Enable vTPM for POWER in downstream configs
 - 69d8ae7 redhat: fix 5.0 rebase missing ISA TPM TIS
 - 8310f89 RHEL-only: Enable vTPM for ARM in downstream configs
 - 4a8ccfd Disable TPM passthrough backend on ARM
 Merged patches (6.0.0):
 - ff817df9e3 config: enable VFIO_CCW
 - 70d3924521 redhat: Add some devices for exporting upstream machine types
 - without machine type chunks
 - efac91b2b4 default-configs: Enable vhost-user-blk
 Merged patches (weekly-210630):
 - 59a178acff disable CONFIG_USB_STORAGE_BOT
 Merged patches (6.1.0 rc2):
 - 86f0025f16 aarch64: Add USB storage devices
 ---
 .../aarch64-softmmu/aarch64-rh-devices.mak    |  31 ++++++
 .../ppc64-softmmu/ppc64-rh-devices.mak        |  36 ++++++
 configs/devices/rh-virtio.mak                 |  10 ++
 .../s390x-softmmu/s390x-rh-devices.mak        |  16 +++
 .../x86_64-softmmu/x86_64-rh-devices.mak      | 104 ++++++++++++++++++
 .../x86_64-upstream-devices.mak               |   4 +
 hw/acpi/ich9.c                                |   4 +-
 hw/arm/meson.build                            |   2 +-
 hw/block/fdc.c                                |  10 ++
 hw/char/parallel.c                            |   9 ++
 hw/cpu/meson.build                            |   5 +-
 hw/display/cirrus_vga.c                       |   3 +
 hw/ide/piix.c                                 |   5 +-
 hw/input/pckbd.c                              |   2 +
 hw/net/e1000.c                                |   2 +
 hw/ppc/spapr_cpu_core.c                       |   2 +
 hw/timer/hpet.c                               |   8 ++
 hw/usb/meson.build                            |   2 +-
 redhat/qemu-kvm.spec.template                 |   9 +-
 target/arm/cpu_tcg.c                          |  10 ++
 target/ppc/cpu-models.c                       |  10 ++
 target/s390x/cpu_models_sysemu.c              |   3 +
 target/s390x/kvm/kvm.c                        |   8 ++
 23 files changed, 286 insertions(+), 9 deletions(-)
 create mode 100644 configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
 create mode 100644 configs/devices/ppc64-softmmu/ppc64-rh-devices.mak
 create mode 100644 configs/devices/rh-virtio.mak
 create mode 100644 configs/devices/s390x-softmmu/s390x-rh-devices.mak
 create mode 100644 configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 create mode 100644 configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak
 diff --git a/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak b/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
 new file mode 100644
 index 0000000000..0d4f9e6e4b
 --- /dev/null
 +++ b/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
@@ -0,0 +1,31 @@
 +include ../rh-virtio.mak
 +
 +CONFIG_ARM_GIC_KVM=y
 +CONFIG_ARM_GIC=y
 +CONFIG_ARM_SMMUV3=y
 +CONFIG_ARM_V7M=y
 +CONFIG_ARM_VIRT=y
 +CONFIG_EDID=y
 +CONFIG_PCIE_PORT=y
 +CONFIG_PCI_DEVICES=y
 +CONFIG_PCI_TESTDEV=y
 +CONFIG_PFLASH_CFI01=y
 +CONFIG_SCSI=y
 +CONFIG_SEMIHOSTING=y
 +CONFIG_USB=y
 +CONFIG_USB_XHCI=y
 +CONFIG_USB_XHCI_PCI=y
 +CONFIG_USB_STORAGE_CORE=y
 +CONFIG_USB_STORAGE_CLASSIC=y
 +CONFIG_VFIO=y
 +CONFIG_VFIO_PCI=y
 +CONFIG_VIRTIO_MMIO=y
 +CONFIG_VIRTIO_PCI=y
 +CONFIG_XIO3130=y
 +CONFIG_NVDIMM=y
 +CONFIG_ACPI_APEI=y
 +CONFIG_TPM=y
 +CONFIG_TPM_EMULATOR=y
 +CONFIG_TPM_TIS_SYSBUS=y
 +CONFIG_PTIMER=y
 +CONFIG_ARM_COMPATIBLE_SEMIHOSTING=y
 diff --git a/configs/devices/ppc64-softmmu/ppc64-rh-devices.mak b/configs/devices/ppc64-softmmu/ppc64-rh-devices.mak
 new file mode 100644
 index 0000000000..73e3ee0293
 --- /dev/null
 +++ b/configs/devices/ppc64-softmmu/ppc64-rh-devices.mak
@@ -0,0 +1,36 @@
 +include ../rh-virtio.mak
 +
 +CONFIG_DIMM=y
 +CONFIG_MEM_DEVICE=y
 +CONFIG_NVDIMM=y
 +CONFIG_PCI=y
 +CONFIG_PCI_DEVICES=y
 +CONFIG_PCI_TESTDEV=y
 +CONFIG_PCI_EXPRESS=y
 +CONFIG_PSERIES=y
 +CONFIG_SCSI=y
 +CONFIG_SPAPR_VSCSI=y
 +CONFIG_TEST_DEVICES=y
 +CONFIG_USB=y
 +CONFIG_USB_OHCI=y
 +CONFIG_USB_OHCI_PCI=y
 +CONFIG_USB_SMARTCARD=y
 +CONFIG_USB_STORAGE_CORE=y
 +CONFIG_USB_STORAGE_CLASSIC=y
 +CONFIG_USB_XHCI=y
 +CONFIG_USB_XHCI_NEC=y
 +CONFIG_USB_XHCI_PCI=y
 +CONFIG_VFIO=y
 +CONFIG_VFIO_PCI=y
 +CONFIG_VGA=y
 +CONFIG_VGA_PCI=y
 +CONFIG_VHOST_USER=y
 +CONFIG_VIRTIO_PCI=y
 +CONFIG_VIRTIO_VGA=y
 +CONFIG_WDT_IB6300ESB=y
 +CONFIG_XICS=y
 +CONFIG_XIVE=y
 +CONFIG_TPM=y
 +CONFIG_TPM_SPAPR=y
 +CONFIG_TPM_EMULATOR=y
 +CONFIG_TPM_PASSTHROUGH=y
 diff --git a/configs/devices/rh-virtio.mak b/configs/devices/rh-virtio.mak
 new file mode 100644
 index 0000000000..94ede1b5f6
 --- /dev/null
 +++ b/configs/devices/rh-virtio.mak
@@ -0,0 +1,10 @@
 +CONFIG_VIRTIO=y
 +CONFIG_VIRTIO_BALLOON=y
 +CONFIG_VIRTIO_BLK=y
 +CONFIG_VIRTIO_GPU=y
 +CONFIG_VIRTIO_INPUT=y
 +CONFIG_VIRTIO_INPUT_HOST=y
 +CONFIG_VIRTIO_NET=y
 +CONFIG_VIRTIO_RNG=y
 +CONFIG_VIRTIO_SCSI=y
 +CONFIG_VIRTIO_SERIAL=y
 diff --git a/configs/devices/s390x-softmmu/s390x-rh-devices.mak b/configs/devices/s390x-softmmu/s390x-rh-devices.mak
 new file mode 100644
 index 0000000000..165c082e87
 --- /dev/null
 +++ b/configs/devices/s390x-softmmu/s390x-rh-devices.mak
@@ -0,0 +1,16 @@
 +include ../rh-virtio.mak
 +
 +CONFIG_PCI=y
 +CONFIG_S390_CCW_VIRTIO=y
 +CONFIG_S390_FLIC=y
 +CONFIG_S390_FLIC_KVM=y
 +CONFIG_SCLPCONSOLE=y
 +CONFIG_SCSI=y
 +CONFIG_TERMINAL3270=y
 +CONFIG_VFIO=y
 +CONFIG_VFIO_AP=y
 +CONFIG_VFIO_CCW=y
 +CONFIG_VFIO_PCI=y
 +CONFIG_VHOST_USER=y
 +CONFIG_VIRTIO_CCW=y
 +CONFIG_WDT_DIAG288=y
 diff --git a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 new file mode 100644
 index 0000000000..ddf036f042
 --- /dev/null
 +++ b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
@@ -0,0 +1,104 @@
 +include ../rh-virtio.mak
 +include x86_64-upstream-devices.mak
 +
 +CONFIG_AC97=y
 +CONFIG_ACPI=y
 +CONFIG_ACPI_PCI=y
 +CONFIG_ACPI_CPU_HOTPLUG=y
 +CONFIG_ACPI_MEMORY_HOTPLUG=y
 +CONFIG_ACPI_NVDIMM=y
 +CONFIG_ACPI_SMBUS=y
 +CONFIG_ACPI_VMGENID=y
 +CONFIG_ACPI_X86=y
 +CONFIG_ACPI_X86_ICH=y
 +CONFIG_AHCI=y
 +CONFIG_APIC=y
 +CONFIG_APM=y
 +CONFIG_BOCHS_DISPLAY=y
 +CONFIG_DIMM=y
 +CONFIG_E1000E_PCI_EXPRESS=y
 +CONFIG_E1000_PCI=y
 +CONFIG_EDU=y
 +CONFIG_FDC=y
 +CONFIG_FDC_SYSBUS=y
 +CONFIG_FW_CFG_DMA=y
 +CONFIG_HDA=y
 +CONFIG_HYPERV=y
 +CONFIG_HYPERV_TESTDEV=y
 +CONFIG_I2C=y
 +CONFIG_I440FX=y
 +CONFIG_I8254=y
 +CONFIG_I8257=y
 +CONFIG_I8259=y
 +CONFIG_I82801B11=y
 +CONFIG_IDE_CORE=y
 +CONFIG_IDE_PCI=y
 +CONFIG_IDE_PIIX=y
 +CONFIG_IDE_QDEV=y
 +CONFIG_IOAPIC=y
 +CONFIG_IOH3420=y
 +CONFIG_ISA_BUS=y
 +CONFIG_ISA_DEBUG=y
 +CONFIG_ISA_TESTDEV=y
 +CONFIG_LPC_ICH9=y
 +CONFIG_MC146818RTC=y
 +CONFIG_MEM_DEVICE=y
 +CONFIG_NVDIMM=y
 +CONFIG_PAM=y
 +CONFIG_PC=y
 +CONFIG_PCI=y
 +CONFIG_PCIE_PORT=y
 +CONFIG_PCI_DEVICES=y
 +CONFIG_PCI_EXPRESS=y
 +CONFIG_PCI_EXPRESS_Q35=y
 +CONFIG_PCI_I440FX=y
 +CONFIG_PCI_TESTDEV=y
 +CONFIG_PCKBD=y
 +CONFIG_PCSPK=y
 +CONFIG_PC_ACPI=y
 +CONFIG_PC_PCI=y
 +CONFIG_PFLASH_CFI01=y
 +CONFIG_PVPANIC_ISA=y
 +CONFIG_PXB=y
 +CONFIG_Q35=y
 +CONFIG_QXL=y
 +CONFIG_RTL8139_PCI=y
 +CONFIG_SCSI=y
 +CONFIG_SERIAL=y
 +CONFIG_SERIAL_ISA=y
 +CONFIG_SERIAL_PCI=y
 +CONFIG_SEV=y
 +CONFIG_SGA=y
 +CONFIG_SMBIOS=y
 +CONFIG_SMBUS_EEPROM=y
 +CONFIG_TEST_DEVICES=y
 +CONFIG_USB=y
 +CONFIG_USB_EHCI=y
 +CONFIG_USB_EHCI_PCI=y
 +CONFIG_USB_SMARTCARD=y
 +CONFIG_USB_STORAGE_CORE=y
 +CONFIG_USB_STORAGE_CLASSIC=y
 +CONFIG_USB_UHCI=y
 +CONFIG_USB_XHCI=y
 +CONFIG_USB_XHCI_NEC=y
 +CONFIG_USB_XHCI_PCI=y
 +CONFIG_VFIO=y
 +CONFIG_VFIO_PCI=y
 +CONFIG_VGA=y
 +CONFIG_VGA_CIRRUS=y
 +CONFIG_VGA_PCI=y
 +CONFIG_VHOST_USER=y
 +CONFIG_VHOST_USER_BLK=y
 +CONFIG_VIRTIO_PCI=y
 +CONFIG_VIRTIO_VGA=y
 +CONFIG_VMMOUSE=y
 +CONFIG_VMPORT=y
 +CONFIG_VTD=y
 +CONFIG_WDT_IB6300ESB=y
 +CONFIG_WDT_IB700=y
 +CONFIG_XIO3130=y
 +CONFIG_TPM=y
 +CONFIG_TPM_CRB=y
 +CONFIG_TPM_TIS_ISA=y
 +CONFIG_TPM_EMULATOR=y
 +CONFIG_TPM_PASSTHROUGH=y
 diff --git a/configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak b/configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak
 new file mode 100644
 index 0000000000..2cd20f54d2
 --- /dev/null
 +++ b/configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak
@@ -0,0 +1,4 @@
 +# We need "isa-parallel"
 +CONFIG_PARALLEL=y
 +# We need "hpet"
 +CONFIG_HPET=y
 diff --git a/hw/acpi/ich9.c b/hw/acpi/ich9.c
 index ebe08ed831..381ef2ddcf 100644
 --- a/hw/acpi/ich9.c
 +++ b/hw/acpi/ich9.c
@@ -438,8 +438,8 @@ void ich9_pm_add_properties(Object *obj, ICH9LPCPMRegs *pm)
     static const uint32_t gpe0_len = ICH9_PMIO_GPE0_LEN;
     pm->acpi_memory_hotplug.is_enabled = true;
     pm->cpu_hotplug_legacy = true;
 -    pm->disable_s3 = 0;
 -    pm->disable_s4 = 0;
 +    pm->disable_s3 = 1;
 +    pm->disable_s4 = 1;
     pm->s4_val = 2;
     pm->use_acpi_hotplug_bridge = true;
     pm->keep_pci_slot_hpc = true;
 diff --git a/hw/arm/meson.build b/hw/arm/meson.build
 index 721a8eb8be..87ed4dd914 100644
 --- a/hw/arm/meson.build
 +++ b/hw/arm/meson.build
@@ -31,7 +31,7 @@ arm_ss.add(when: 'CONFIG_VEXPRESS', if_true: files('vexpress.c'))
 arm_ss.add(when: 'CONFIG_ZYNQ', if_true: files('xilinx_zynq.c'))
 arm_ss.add(when: 'CONFIG_SABRELITE', if_true: files('sabrelite.c'))
 -arm_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('armv7m.c'))
 +#arm_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('armv7m.c'))
 arm_ss.add(when: 'CONFIG_EXYNOS4', if_true: files('exynos4210.c'))
 arm_ss.add(when: 'CONFIG_PXA2XX', if_true: files('pxa2xx.c', 'pxa2xx_gpio.c', 'pxa2xx_pic.c'))
 arm_ss.add(when: 'CONFIG_DIGIC', if_true: files('digic.c'))
 diff --git a/hw/block/fdc.c b/hw/block/fdc.c
 index 21d18ac2e3..97fa6de423 100644
 --- a/hw/block/fdc.c
 +++ b/hw/block/fdc.c
@@ -48,6 +48,8 @@
 #include "qom/object.h"
 #include "fdc-internal.h"
 +#include "hw/boards.h"
 +
 /********************************************************/
 /* debug Floppy devices */
@@ -2337,6 +2339,14 @@ void fdctrl_realize_common(DeviceState *dev, FDCtrl *fdctrl, Error **errp)
     FDrive *drive;
     static int command_tables_inited = 0;
 +    /* Restricted for Red Hat Enterprise Linux: */
 +    MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
 +    if (!strstr(mc->name, "-rhel7.")) {
 +        error_setg(errp, "Device %s is not supported with machine type %s",
 +                   object_get_typename(OBJECT(dev)), mc->name);
 +        return;
 +    }
 +
     if (fdctrl->fallback == FLOPPY_DRIVE_TYPE_AUTO) {
         error_setg(errp, "Cannot choose a fallback FDrive type of 'auto'");
         return;
 diff --git a/hw/char/parallel.c b/hw/char/parallel.c
 index b45e67bfbb..e5f108211b 100644
 --- a/hw/char/parallel.c
 +++ b/hw/char/parallel.c
@@ -29,6 +29,7 @@
 #include "chardev/char-parallel.h"
 #include "chardev/char-fe.h"
 #include "hw/acpi/aml-build.h"
 +#include "hw/boards.h"
 #include "hw/irq.h"
 #include "hw/isa/isa.h"
 #include "hw/qdev-properties.h"
@@ -534,6 +535,14 @@ static void parallel_isa_realizefn(DeviceState *dev, Error **errp)
     int base;
     uint8_t dummy;
 +    /* Restricted for Red Hat Enterprise Linux */
 +    MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
 +    if (strstr(mc->name, "rhel")) {
 +        error_setg(errp, "Device %s is not supported with machine type %s",
 +                   object_get_typename(OBJECT(dev)), mc->name);
 +        return;
 +    }
 +
     if (!qemu_chr_fe_backend_connected(&s->chr)) {
         error_setg(errp, "Can't create parallel device, empty char device");
         return;
 diff --git a/hw/cpu/meson.build b/hw/cpu/meson.build
 index 9e52fee9e7..bb71c9f3e7 100644
 --- a/hw/cpu/meson.build
 +++ b/hw/cpu/meson.build
@@ -1,6 +1,7 @@
 -softmmu_ss.add(files('core.c', 'cluster.c'))
 +#softmmu_ss.add(files('core.c', 'cluster.c'))
 +softmmu_ss.add(files('core.c'))
 specific_ss.add(when: 'CONFIG_ARM11MPCORE', if_true: files('arm11mpcore.c'))
 specific_ss.add(when: 'CONFIG_REALVIEW', if_true: files('realview_mpcore.c'))
 specific_ss.add(when: 'CONFIG_A9MPCORE', if_true: files('a9mpcore.c'))
 -specific_ss.add(when: 'CONFIG_A15MPCORE', if_true: files('a15mpcore.c'))
 +#specific_ss.add(when: 'CONFIG_A15MPCORE', if_true: files('a15mpcore.c'))
 diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
 index fdca6ca659..fa1a7eee51 100644
 --- a/hw/display/cirrus_vga.c
 +++ b/hw/display/cirrus_vga.c
@@ -2945,6 +2945,9 @@ static void pci_cirrus_vga_realize(PCIDevice *dev, Error **errp)
      PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(dev);
      int16_t device_id = pc->device_id;
 +     warn_report("'cirrus-vga' is deprecated, "
 +                 "please use a different VGA card instead");
 +
      /* follow real hardware, cirrus card emulated has 4 MB video memory.
        Also accept 8 MB/16 MB for backward compatibility. */
      if (s->vga.vram_size_mb != 4 && s->vga.vram_size_mb != 8 &&
 diff --git a/hw/ide/piix.c b/hw/ide/piix.c
 index ce89fd0aa3..fbcf802b13 100644
 --- a/hw/ide/piix.c
 +++ b/hw/ide/piix.c
@@ -232,7 +232,8 @@ static void piix3_ide_class_init(ObjectClass *klass, void *data)
     k->device_id = PCI_DEVICE_ID_INTEL_82371SB_1;
     k->class_id = PCI_CLASS_STORAGE_IDE;
     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 -    dc->hotpluggable = false;
 +    /* Disabled for Red Hat Enterprise Linux: */
 +    dc->user_creatable = false;
 }
 static const TypeInfo piix3_ide_info = {
@@ -261,6 +262,8 @@ static void piix4_ide_class_init(ObjectClass *klass, void *data)
     k->class_id = PCI_CLASS_STORAGE_IDE;
     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->hotpluggable = false;
 +    /* Disabled for Red Hat Enterprise Linux: */
 +    dc->user_creatable = false;
 }
 static const TypeInfo piix4_ide_info = {
 diff --git a/hw/input/pckbd.c b/hw/input/pckbd.c
 index baba62f357..bc360347ea 100644
 --- a/hw/input/pckbd.c
 +++ b/hw/input/pckbd.c
@@ -796,6 +796,8 @@ static void i8042_class_initfn(ObjectClass *klass, void *data)
     dc->vmsd = &vmstate_kbd_isa;
     isa->build_aml = i8042_build_aml;
     set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
 +    /* Disabled for Red Hat Enterprise Linux: */
 +    dc->user_creatable = false;
 }
 static const TypeInfo i8042_info = {
 diff --git a/hw/net/e1000.c b/hw/net/e1000.c
 index f5bc81296d..282d01e374 100644
 --- a/hw/net/e1000.c
 +++ b/hw/net/e1000.c
@@ -1821,6 +1821,7 @@ static const E1000Info e1000_devices[] = {
         .revision  = 0x03,
         .phy_id2   = E1000_PHY_ID2_8254xx_DEFAULT,
     },
 +#if 0 /* Disabled for Red Hat Enterprise Linux 7 */
     {
         .name      = "e1000-82544gc",
         .device_id = E1000_DEV_ID_82544GC_COPPER,
@@ -1833,6 +1834,7 @@ static const E1000Info e1000_devices[] = {
         .revision  = 0x03,
         .phy_id2   = E1000_PHY_ID2_8254xx_DEFAULT,
     },
 +#endif
 };
 static void e1000_register_types(void)
 diff --git a/hw/ppc/spapr_cpu_core.c b/hw/ppc/spapr_cpu_core.c
 index 58e7341cb7..8ba34f6a1d 100644
 --- a/hw/ppc/spapr_cpu_core.c
 +++ b/hw/ppc/spapr_cpu_core.c
@@ -370,10 +370,12 @@ static const TypeInfo spapr_cpu_core_type_infos[] = {
         .instance_size = sizeof(SpaprCpuCore),
         .class_size = sizeof(SpaprCpuCoreClass),
     },
 +#if 0  /* Disabled for Red Hat Enterprise Linux */
     DEFINE_SPAPR_CPU_CORE_TYPE("970_v2.2"),
     DEFINE_SPAPR_CPU_CORE_TYPE("970mp_v1.0"),
     DEFINE_SPAPR_CPU_CORE_TYPE("970mp_v1.1"),
     DEFINE_SPAPR_CPU_CORE_TYPE("power5+_v2.1"),
 +#endif
     DEFINE_SPAPR_CPU_CORE_TYPE("power7_v2.3"),
     DEFINE_SPAPR_CPU_CORE_TYPE("power7+_v2.1"),
     DEFINE_SPAPR_CPU_CORE_TYPE("power8_v2.0"),
 diff --git a/hw/timer/hpet.c b/hw/timer/hpet.c
 index 9520471be2..202e032524 100644
 --- a/hw/timer/hpet.c
 +++ b/hw/timer/hpet.c
@@ -733,6 +733,14 @@ static void hpet_realize(DeviceState *dev, Error **errp)
     int i;
     HPETTimer *timer;
 +    /* Restricted for Red Hat Enterprise Linux */
 +    MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
 +    if (strstr(mc->name, "rhel")) {
 +        error_setg(errp, "Device %s is not supported with machine type %s",
 +                   object_get_typename(OBJECT(dev)), mc->name);
 +        return;
 +    }
 +
     if (!s->intcap) {
         warn_report("Hpet's intcap not initialized");
     }
 diff --git a/hw/usb/meson.build b/hw/usb/meson.build
 index de853d780d..0776ae6a20 100644
 --- a/hw/usb/meson.build
 +++ b/hw/usb/meson.build
@@ -52,7 +52,7 @@ softmmu_ss.add(when: 'CONFIG_USB_SMARTCARD', if_true: files('dev-smartcard-reade
 if cacard.found()
   usbsmartcard_ss = ss.source_set()
   usbsmartcard_ss.add(when: 'CONFIG_USB_SMARTCARD',
 -                      if_true: [cacard, files('ccid-card-emulated.c', 'ccid-card-passthru.c')])
 +                      if_true: [cacard, files('ccid-card-passthru.c')])
   hw_usb_modules += {'smartcard': usbsmartcard_ss}
 endif
 diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
 index 13d0e9b195..3826fa5122 100644
 --- a/target/arm/cpu_tcg.c
 +++ b/target/arm/cpu_tcg.c
@@ -22,6 +22,7 @@
 /* CPU models. These are not needed for the AArch64 linux-user build. */
 #if !defined(CONFIG_USER_ONLY) || !defined(TARGET_AARCH64)
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 #if !defined(CONFIG_USER_ONLY) && defined(CONFIG_TCG)
 static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
 {
@@ -375,6 +376,7 @@ static void cortex_a9_initfn(Object *obj)
     cpu->ccsidr[1] = 0x200fe019; /* 16k L1 icache. */
     define_arm_cp_regs(cpu, cortexa9_cp_reginfo);
 }
 +#endif /* disabled for RHEL */
 #ifndef CONFIG_USER_ONLY
 static uint64_t a15_l2ctlr_read(CPUARMState *env, const ARMCPRegInfo *ri)
@@ -400,6 +402,7 @@ static const ARMCPRegInfo cortexa15_cp_reginfo[] = {
     REGINFO_SENTINEL
 };
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void cortex_a7_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
@@ -445,6 +448,7 @@ static void cortex_a7_initfn(Object *obj)
     cpu->ccsidr[2] = 0x711fe07a; /* 4096K L2 unified cache */
     define_arm_cp_regs(cpu, cortexa15_cp_reginfo); /* Same as A15 */
 }
 +#endif /* disabled for RHEL */
 static void cortex_a15_initfn(Object *obj)
 {
@@ -488,6 +492,7 @@ static void cortex_a15_initfn(Object *obj)
     define_arm_cp_regs(cpu, cortexa15_cp_reginfo);
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void cortex_m0_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
@@ -928,6 +933,7 @@ static void arm_v7m_class_init(ObjectClass *oc, void *data)
     cc->gdb_core_xml_file = "arm-m-profile.xml";
 }
 +#endif /* disabled for RHEL */
 #ifndef TARGET_AARCH64
 /*
@@ -1007,6 +1013,7 @@ static void arm_max_initfn(Object *obj)
 #endif /* !TARGET_AARCH64 */
 static const ARMCPUInfo arm_tcg_cpus[] = {
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
     { .name = "arm926",      .initfn = arm926_initfn },
     { .name = "arm946",      .initfn = arm946_initfn },
     { .name = "arm1026",     .initfn = arm1026_initfn },
@@ -1022,7 +1029,9 @@ static const ARMCPUInfo arm_tcg_cpus[] = {
     { .name = "cortex-a7",   .initfn = cortex_a7_initfn },
     { .name = "cortex-a8",   .initfn = cortex_a8_initfn },
     { .name = "cortex-a9",   .initfn = cortex_a9_initfn },
 +#endif /* disabled for RHEL */
     { .name = "cortex-a15",  .initfn = cortex_a15_initfn },
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
     { .name = "cortex-m0",   .initfn = cortex_m0_initfn,
                              .class_init = arm_v7m_class_init },
     { .name = "cortex-m3",   .initfn = cortex_m3_initfn,
@@ -1053,6 +1062,7 @@ static const ARMCPUInfo arm_tcg_cpus[] = {
     { .name = "pxa270-b1",   .initfn = pxa270b1_initfn },
     { .name = "pxa270-c0",   .initfn = pxa270c0_initfn },
     { .name = "pxa270-c5",   .initfn = pxa270c5_initfn },
 +#endif /* disabled for RHEL */
 #ifndef TARGET_AARCH64
     { .name = "max",         .initfn = arm_max_initfn },
 #endif
 diff --git a/target/ppc/cpu-models.c b/target/ppc/cpu-models.c
 index 4baa111713..d779c4d1d5 100644
 --- a/target/ppc/cpu-models.c
 +++ b/target/ppc/cpu-models.c
@@ -66,6 +66,7 @@
 #define POWERPC_DEF(_name, _pvr, _type, _desc)                              \
     POWERPC_DEF_SVR(_name, _desc, _pvr, POWERPC_SVR_NONE, _type)
 +#if 0  /* Embedded and 32-bit CPUs disabled for Red Hat Enterprise Linux */
     /* Embedded PowerPC                                                      */
     /* PowerPC 401 family                                                    */
     POWERPC_DEF("401",           CPU_POWERPC_401,                    401,
@@ -740,8 +741,10 @@
                 "PowerPC 7447A v1.2 (G4)")
     POWERPC_DEF("7457a_v1.2",    CPU_POWERPC_74x7A_v12,              7455,
                 "PowerPC 7457A v1.2 (G4)")
 +#endif
     /* 64 bits PowerPC                                                       */
 #if defined(TARGET_PPC64)
 +#if 0  /* Disabled for Red Hat Enterprise Linux */
     POWERPC_DEF("970_v2.2",      CPU_POWERPC_970_v22,                970,
                 "PowerPC 970 v2.2")
     POWERPC_DEF("970fx_v1.0",    CPU_POWERPC_970FX_v10,              970,
@@ -760,6 +763,7 @@
                 "PowerPC 970MP v1.1")
     POWERPC_DEF("power5+_v2.1",  CPU_POWERPC_POWER5P_v21,            POWER5P,
                 "POWER5+ v2.1")
 +#endif
     POWERPC_DEF("power7_v2.3",   CPU_POWERPC_POWER7_v23,             POWER7,
                 "POWER7 v2.3")
     POWERPC_DEF("power7+_v2.1",  CPU_POWERPC_POWER7P_v21,            POWER7,
@@ -784,6 +788,7 @@
 /* PowerPC CPU aliases                                                     */
 PowerPCCPUAlias ppc_cpu_aliases[] = {
 +#if 0  /* Embedded and 32-bit CPUs disabled for Red Hat Enterprise Linux */
     { "403", "403gc" },
     { "405", "405d4" },
     { "405cr", "405crc" },
@@ -942,12 +947,15 @@ PowerPCCPUAlias ppc_cpu_aliases[] = {
     { "7447a", "7447a_v1.2" },
     { "7457a", "7457a_v1.2" },
     { "apollo7pm", "7457a_v1.0" },
 +#endif
 #if defined(TARGET_PPC64)
 +#if 0  /* Disabled for Red Hat Enterprise Linux */
     { "970", "970_v2.2" },
     { "970fx", "970fx_v3.1" },
     { "970mp", "970mp_v1.1" },
     { "power5+", "power5+_v2.1" },
     { "power5gs", "power5+_v2.1" },
 +#endif
     { "power7", "power7_v2.3" },
     { "power7+", "power7+_v2.1" },
     { "power8e", "power8e_v2.1" },
@@ -957,6 +965,7 @@ PowerPCCPUAlias ppc_cpu_aliases[] = {
     { "power10", "power10_v2.0" },
 #endif
 +#if 0  /* Disabled for Red Hat Enterprise Linux */
     /* Generic PowerPCs */
 #if defined(TARGET_PPC64)
     { "ppc64", "970fx_v3.1" },
@@ -964,5 +973,6 @@ PowerPCCPUAlias ppc_cpu_aliases[] = {
     { "ppc32", "604" },
     { "ppc", "604" },
     { "default", "604" },
 +#endif
     { NULL, NULL }
 };
 diff --git a/target/s390x/cpu_models_sysemu.c b/target/s390x/cpu_models_sysemu.c
 index 05c3ccaaff..6a04ccab1b 100644
 --- a/target/s390x/cpu_models_sysemu.c
 +++ b/target/s390x/cpu_models_sysemu.c
@@ -36,6 +36,9 @@ static void check_unavailable_features(const S390CPUModel *max_model,
         (max_model->def->gen == model->def->gen &&
          max_model->def->ec_ga < model->def->ec_ga)) {
         list_add_feat("type", unavailable);
 +    } else if (model->def->gen < 11 && kvm_enabled()) {
 +        /* Older CPU models are not supported on Red Hat Enterprise Linux */
 +        list_add_feat("type", unavailable);
     }
     /* detect missing features if any to properly report them */
 diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c
 index 5b1fdb55c4..c52434985b 100644
 --- a/target/s390x/kvm/kvm.c
 +++ b/target/s390x/kvm/kvm.c
@@ -2508,6 +2508,14 @@ void kvm_s390_apply_cpu_model(const S390CPUModel *model, Error **errp)
         error_setg(errp, "KVM doesn't support CPU models");
         return;
     }
 +
 +    /* Older CPU models are not supported on Red Hat Enterprise Linux */
 +    if (model->def->gen < 11) {
 +        error_setg(errp, "KVM: Unsupported CPU type specified: %s",
 +                   MACHINE(qdev_get_machine())->cpu_type);
 +        return;
 +    }
 +
     prop.cpuid = s390_cpuid_from_cpu_model(model);
     prop.ibc = s390_ibc_from_cpu_model(model);
     /* configure cpu features indicated via STFL(e) */
 -- 
 2.27.0
--- a/SOURCES/0006-Machine-type-related-general-changes.patch
+++ b/SOURCES/0006-Machine-type-related-general-changes.patch
@ -1,720 +0,0 @@
 From d9ff466c980d219ebf230ea24becce294c196f1f Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 11 Jan 2019 09:54:45 +0100
 Subject: Machine type related general changes
 This patch is first part of original "Add RHEL machine types" patch we
 split to allow easier review. It contains changes not related to any
 architecture.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 --
 Rebase notes (6.2.0):
 - Do not duplicate minimal_version_id for piix4_pm
 - Remove empty line chunks in serial.c
 - Remove migration.h include in serial.c
 - Update hw_compat_rhel_8_5 (from MR 66)
 Rebase notes (7.0.0):
 - Remove downstream changes leftovers in hw/rtc/mc146818rtc.c
 - Remove unnecessary change in hw/usb/hcd-uhci.c
 Rebase notes (7.1.0):
 - Moved adding rhel_old_machine_deprecation variable from s390x to general machine types commit
 - Moved adding hw_compat_rhel_8_6 struct from x86_64 to general machine types commit
 Rebase notes (8.1.0):
 - Do not modify unused vga-isa.c
 Merged patches (6.1.0):
 - f2fb42a3c6 redhat: add missing entries in hw_compat_rhel_8_4
 - 1949ec258e hw/arm/virt: Disable PL011 clock migration through hw_compat_rhel_8_3
 - a3995e2eff Remove RHEL 7.0.0 machine type (only generic changes)
 - ad3190a79b Remove RHEL 7.1.0 machine type (only generic changes)
 - 84bbe15d4e Remove RHEL 7.2.0 machine type (only generic changes)
 - 0215eb3356 Remove RHEL 7.3.0 machine types (only generic changes)
 - af69d1ca6e Remove RHEL 7.4.0 machine types (only generic changes)
 - 8f7a74ab78 Remove RHEL 7.5.0 machine types (only generic changes)
 Merged patches (6.2.0):
 - d687ac13d2 redhat: Define hw_compat_rhel_8_5
 Merged patches (7.0.0):
 - ef5afcc86d Fix virtio-net-pci* "vectors" compat
 - 168f0d56e3 compat: Update hw_compat_rhel_8_5 with 6.2.0 RC2 changes
 Merged patches (7.1.0):
 - 38b89dc245 pc: Move s3/s4 suspend disabling to compat (only hw/acpi/piix4.c chunk)
 - 1d6439527a WRB: Introduce RHEL 9.0.0 hw compat structure (only hw/core/machine.c and include/hw/boards.h chunk)
 Merged patches (7.2.0):
 - 0be2889fa2 Introduce upstream 7.0 compat changes (only applicable parts)
 Merged patches (8.0.0):
 - 21ed34787b Addd 7.2 compat bits for RHEL 9.1 machine type
 - e5c8d5d603 virtio-rng-pci: fix migration compat for vectors
 - 5a5fa77059 virtio-rng-pci: fix transitional migration compat for vectors
 Merged patches (8.1.0):
 - bd5d81d286 Add RHEL 9.2.0 compat structure (general part)
 - 1165e24c6b hw/pci: Disable PCI_ERR_UNCOR_MASK reg for machine type <= pc-q35-rhel9.2.0
 Merged patches (8.2.0):
 - 4ee284aca9 Add machine types compat bits. (partial)
 ---
 hw/acpi/piix4.c              |   2 +-
 hw/arm/virt.c                |   2 +-
 hw/core/machine.c            | 267 +++++++++++++++++++++++++++++++++++
 hw/i386/pc_piix.c            |   2 +
 hw/i386/pc_q35.c             |   2 +
 hw/net/rtl8139.c             |   4 +-
 hw/smbios/smbios.c           |  46 +++++-
 hw/timer/i8254_common.c      |   2 +-
 hw/usb/hcd-xhci-pci.c        |  59 ++++++--
 hw/usb/hcd-xhci-pci.h        |   1 +
 include/hw/boards.h          |  40 ++++++
 include/hw/firmware/smbios.h |   5 +-
 include/hw/i386/pc.h         |   3 +
 13 files changed, 413 insertions(+), 22 deletions(-)
 diff --git a/hw/acpi/piix4.c b/hw/acpi/piix4.c
 index dd523d2e4c..5050c0ba97 100644
 --- a/hw/acpi/piix4.c
 +++ b/hw/acpi/piix4.c
@@ -245,7 +245,7 @@ static bool vmstate_test_migrate_acpi_index(void *opaque, int version_id)
 static const VMStateDescription vmstate_acpi = {
     .name = "piix4_pm",
     .version_id = 3,
 -    .minimum_version_id = 3,
 +    .minimum_version_id = 2,
     .post_load = vmstate_acpi_post_load,
     .fields = (VMStateField[]) {
         VMSTATE_PCI_DEVICE(parent_obj, PIIX4PMState),
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index af9ea4dd1c..62f0f7d4d6 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
@@ -1638,7 +1638,7 @@ static void virt_build_smbios(VirtMachineState *vms)
     smbios_set_defaults("QEMU", product,
                         vmc->smbios_old_sys_ver ? "1.0" : mc->name, false,
 -                        true, SMBIOS_ENTRY_POINT_TYPE_64);
 +                        true, NULL, NULL, SMBIOS_ENTRY_POINT_TYPE_64);
     /* build the array of physical mem area from base_memmap */
     mem_array.address = vms->memmap[VIRT_MEM].base;
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index 0c17398141..446601ee30 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -57,6 +57,273 @@ GlobalProperty hw_compat_7_2[] = {
 };
 const size_t hw_compat_7_2_len = G_N_ELEMENTS(hw_compat_7_2);
 +/*
 + * RHEL only: machine types for previous major releases are deprecated
 + */
 +const char *rhel_old_machine_deprecation =
 +    "machine types for previous major releases are deprecated";
 +
 +GlobalProperty hw_compat_rhel_9_4[] = {
 +  /* hw_compat_rhel_9_4 from hw_compat_8_0 */
 +    { TYPE_VIRTIO_NET, "host_uso", "off"},
 +  /* hw_compat_rhel_9_4 from hw_compat_8_0 */
 +    { TYPE_VIRTIO_NET, "guest_uso4", "off"},
 +  /* hw_compat_rhel_9_4 from hw_compat_8_0 */
 +    { TYPE_VIRTIO_NET, "guest_uso6", "off"},
 +  /* hw_compat_rhel_9_4 from hw_compat_8_1 */
 +     { TYPE_PCI_BRIDGE, "x-pci-express-writeable-slt-bug", "true" },
 +  /* hw_compat_rhel_9_4 from hw_compat_8_1 */
 +     { "ramfb", "x-migrate", "off" },
 +  /* hw_compat_rhel_9_4 from hw_compat_8_1 */
 +     { "vfio-pci-nohotplug", "x-ramfb-migrate", "off" },
 +  /* hw_compat_rhel_9_4 from hw_compat_8_1 */
 +     { "igb", "x-pcie-flr-init", "off" },
 +};
 +const size_t hw_compat_rhel_9_4_len = G_N_ELEMENTS(hw_compat_rhel_9_4);
 +
 +GlobalProperty hw_compat_rhel_9_3[] = {
 +  /* hw_compat_rhel_9_3 from hw_compat_8_0 */
 +  { "migration", "multifd-flush-after-each-section", "on"},
 +  /* hw_compat_rhel_9_3 from hw_compat_8_0 */
 +  { TYPE_PCI_DEVICE, "x-pcie-ari-nextfn-1", "on" },
 +};
 +const size_t hw_compat_rhel_9_3_len = G_N_ELEMENTS(hw_compat_rhel_9_3);
 +
 +GlobalProperty hw_compat_rhel_9_2[] = {
 +  /* hw_compat_rhel_9_2 from hw_compat_7_2 */
 +  { "e1000e", "migrate-timadj", "off" },
 +  /* hw_compat_rhel_9_2 from hw_compat_7_2 */
 +  { "virtio-mem", "x-early-migration", "false" },
 +  /* hw_compat_rhel_9_2 from hw_compat_7_2 */
 +  { "migration", "x-preempt-pre-7-2", "true" },
 +  /* hw_compat_rhel_9_2 from hw_compat_7_2 */
 +  { TYPE_PCI_DEVICE, "x-pcie-err-unc-mask", "off" },
 +};
 +const size_t hw_compat_rhel_9_2_len = G_N_ELEMENTS(hw_compat_rhel_9_2);
 +
 +/*
 + * Mostly the same as hw_compat_7_0
 + */
 +GlobalProperty hw_compat_rhel_9_1[] = {
 +  /* hw_compat_rhel_9_1 from hw_compat_7_0 */
 +  { "arm-gicv3-common", "force-8-bit-prio", "on" },
 +  /* hw_compat_rhel_9_1 from hw_compat_7_0 */
 +  { "nvme-ns", "eui64-default", "on"},
 +  /* hw_compat_rhel_9_1 from hw_compat_7_1 */
 +  { "virtio-device", "queue_reset", "false" },
 +  /* hw_compat_rhel_9_1 bz 2155749 */
 +  { "virtio-rng-pci", "vectors", "0" },
 +  /* hw_compat_rhel_9_1 bz 2162569 */
 +  { "virtio-rng-pci-transitional", "vectors", "0" },
 +  { "virtio-rng-pci-non-transitional", "vectors", "0" },
 +};
 +const size_t hw_compat_rhel_9_1_len = G_N_ELEMENTS(hw_compat_rhel_9_1);
 +
 +/*
 + * Mostly the same as hw_compat_6_2
 + */
 +GlobalProperty hw_compat_rhel_9_0[] = {
 +    /* hw_compat_rhel_9_0 from hw_compat_6_2 */
 +    { "PIIX4_PM", "x-not-migrate-acpi-index", "on"},
 +};
 +const size_t hw_compat_rhel_9_0_len = G_N_ELEMENTS(hw_compat_rhel_9_0);
 +
 +GlobalProperty hw_compat_rhel_8_6[] = {
 +    /* hw_compat_rhel_8_6 bz 2065589 */
 +    /*
 +     * vhost-vsock device in RHEL 8 kernels doesn't support seqpacket, so
 +     * we need do disable it downstream on the latest hw_compat_rhel_8.
 +     */
 +    { "vhost-vsock-device", "seqpacket", "off" },
 +};
 +const size_t hw_compat_rhel_8_6_len = G_N_ELEMENTS(hw_compat_rhel_8_6);
 +
 +/*
 + * Mostly the same as hw_compat_6_0 and hw_compat_6_1
 + */
 +GlobalProperty hw_compat_rhel_8_5[] = {
 +    /* hw_compat_rhel_8_5 from hw_compat_6_0 */
 +    { "gpex-pcihost", "allow-unmapped-accesses", "false" },
 +    /* hw_compat_rhel_8_5 from hw_compat_6_0 */
 +    { "i8042", "extended-state", "false"},
 +    /* hw_compat_rhel_8_5 from hw_compat_6_0 */
 +    { "nvme-ns", "eui64-default", "off"},
 +    /* hw_compat_rhel_8_5 from hw_compat_6_0 */
 +    { "e1000", "init-vet", "off" },
 +    /* hw_compat_rhel_8_5 from hw_compat_6_0 */
 +    { "e1000e", "init-vet", "off" },
 +    /* hw_compat_rhel_8_5 from hw_compat_6_0 */
 +    { "vhost-vsock-device", "seqpacket", "off" },
 +    /* hw_compat_rhel_8_5 from hw_compat_6_1 */
 +    { "vhost-user-vsock-device", "seqpacket", "off" },
 +    /* hw_compat_rhel_8_5 from hw_compat_6_1 */
 +    { "nvme-ns", "shared", "off" },
 +};
 +const size_t hw_compat_rhel_8_5_len = G_N_ELEMENTS(hw_compat_rhel_8_5);
 +
 +/*
 + * Mostly the same as hw_compat_5_2
 + */
 +GlobalProperty hw_compat_rhel_8_4[] = {
 +    /* hw_compat_rhel_8_4 from hw_compat_5_2 */
 +    { "ICH9-LPC", "smm-compat", "on"},
 +    /* hw_compat_rhel_8_4 from hw_compat_5_2 */
 +    { "PIIX4_PM", "smm-compat", "on"},
 +    /* hw_compat_rhel_8_4 from hw_compat_5_2 */
 +    { "virtio-blk-device", "report-discard-granularity", "off" },
 +    /* hw_compat_rhel_8_4 from hw_compat_5_2 */
 +    /*
 +     * Upstream incorrectly had "virtio-net-pci" instead of "virtio-net-pci-base",
 +     * (https://bugzilla.redhat.com/show_bug.cgi?id=1999141)
 +     */
 +    { "virtio-net-pci-base", "vectors", "3"},
 +};
 +const size_t hw_compat_rhel_8_4_len = G_N_ELEMENTS(hw_compat_rhel_8_4);
 +
 +/*
 + * Mostly the same as hw_compat_5_1
 + */
 +GlobalProperty hw_compat_rhel_8_3[] = {
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "vhost-scsi", "num_queues", "1"},
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "vhost-user-blk", "num-queues", "1"},
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "vhost-user-scsi", "num_queues", "1"},
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "virtio-blk-device", "num-queues", "1"},
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "virtio-scsi-device", "num_queues", "1"},
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "nvme", "use-intel-id", "on"},
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "pvpanic", "events", "1"}, /* PVPANIC_PANICKED */
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "pl011", "migrate-clk", "off" },
 +    /* hw_compat_rhel_8_3 bz 1912846 */
 +    { "pci-xhci", "x-rh-late-msi-cap", "off" },
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "virtio-pci", "x-ats-page-aligned", "off"},
 +};
 +const size_t hw_compat_rhel_8_3_len = G_N_ELEMENTS(hw_compat_rhel_8_3);
 +
 +/*
 + * The same as hw_compat_4_2 + hw_compat_5_0
 + */
 +GlobalProperty hw_compat_rhel_8_2[] = {
 +    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
 +    { "virtio-blk-device", "queue-size", "128"},
 +    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
 +    { "virtio-scsi-device", "virtqueue_size", "128"},
 +    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
 +    { "virtio-blk-device", "x-enable-wce-if-config-wce", "off" },
 +    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
 +    { "virtio-blk-device", "seg-max-adjust", "off"},
 +    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
 +    { "virtio-scsi-device", "seg_max_adjust", "off"},
 +    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
 +    { "vhost-blk-device", "seg_max_adjust", "off"},
 +    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
 +    { "usb-host", "suppress-remote-wake", "off" },
 +    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
 +    { "usb-redir", "suppress-remote-wake", "off" },
 +    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
 +    { "qxl", "revision", "4" },
 +    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
 +    { "qxl-vga", "revision", "4" },
 +    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
 +    { "fw_cfg", "acpi-mr-restore", "false" },
 +    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
 +    { "virtio-device", "use-disabled-flag", "false" },
 +    /* hw_compat_rhel_8_2 from hw_compat_5_0 */
 +    { "pci-host-bridge", "x-config-reg-migration-enabled", "off" },
 +    /* hw_compat_rhel_8_2 from hw_compat_5_0 */
 +    { "virtio-balloon-device", "page-poison", "false" },
 +    /* hw_compat_rhel_8_2 from hw_compat_5_0 */
 +    { "vmport", "x-read-set-eax", "off" },
 +    /* hw_compat_rhel_8_2 from hw_compat_5_0 */
 +    { "vmport", "x-signal-unsupported-cmd", "off" },
 +    /* hw_compat_rhel_8_2 from hw_compat_5_0 */
 +    { "vmport", "x-report-vmx-type", "off" },
 +    /* hw_compat_rhel_8_2 from hw_compat_5_0 */
 +    { "vmport", "x-cmds-v2", "off" },
 +    /* hw_compat_rhel_8_2 from hw_compat_5_0 */
 +    { "virtio-device", "x-disable-legacy-check", "true" },
 +};
 +const size_t hw_compat_rhel_8_2_len = G_N_ELEMENTS(hw_compat_rhel_8_2);
 +
 +/*
 + * The same as hw_compat_4_1
 + */
 +GlobalProperty hw_compat_rhel_8_1[] = {
 +    /* hw_compat_rhel_8_1 from hw_compat_4_1 */
 +    { "virtio-pci", "x-pcie-flr-init", "off" },
 +};
 +const size_t hw_compat_rhel_8_1_len = G_N_ELEMENTS(hw_compat_rhel_8_1);
 +
 +/* The same as hw_compat_3_1
 + * format of array has been changed by:
 + *     6c36bddf5340 ("machine: Use shorter format for GlobalProperty arrays")
 + */
 +GlobalProperty hw_compat_rhel_8_0[] = {
 +    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
 +    { "pcie-root-port", "x-speed", "2_5" },
 +    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
 +    { "pcie-root-port", "x-width", "1" },
 +    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
 +    { "memory-backend-file", "x-use-canonical-path-for-ramblock-id", "true" },
 +    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
 +    { "memory-backend-memfd", "x-use-canonical-path-for-ramblock-id", "true" },
 +    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
 +    { "tpm-crb", "ppi", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
 +    { "tpm-tis", "ppi", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
 +    { "usb-kbd", "serial", "42" },
 +    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
 +    { "usb-mouse", "serial", "42" },
 +    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
 +    { "usb-tablet", "serial", "42" },
 +    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
 +    { "virtio-blk-device", "discard", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
 +    { "virtio-blk-device", "write-zeroes", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_4_0 */
 +    { "VGA",            "edid", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_4_0 */
 +    { "secondary-vga",  "edid", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_4_0 */
 +    { "bochs-display",  "edid", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_4_0 */
 +    { "virtio-vga",     "edid", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_4_0 */
 +    { "virtio-gpu-device", "edid", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_4_0 */
 +    { "virtio-device", "use-started", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_3_1 - that was added in 4.1 */
 +    { "pcie-root-port-base", "disable-acs", "true" },
 +};
 +const size_t hw_compat_rhel_8_0_len = G_N_ELEMENTS(hw_compat_rhel_8_0);
 +
 +/* The same as hw_compat_3_0 + hw_compat_2_12
 + * except that
 + *   there's nothing in 3_0
 + *   migration.decompress-error-check=off was in 7.5 from bz 1584139
 + */
 +GlobalProperty hw_compat_rhel_7_6[] = {
 +    /* hw_compat_rhel_7_6 from hw_compat_2_12 */
 +    { "hda-audio", "use-timer", "false" },
 +    /* hw_compat_rhel_7_6 from hw_compat_2_12 */
 +    { "cirrus-vga", "global-vmstate", "true" },
 +    /* hw_compat_rhel_7_6 from hw_compat_2_12 */
 +    { "VGA", "global-vmstate", "true" },
 +    /* hw_compat_rhel_7_6 from hw_compat_2_12 */
 +    { "vmware-svga", "global-vmstate", "true" },
 +    /* hw_compat_rhel_7_6 from hw_compat_2_12 */
 +    { "qxl-vga", "global-vmstate",  "true" },
 +};
 +const size_t hw_compat_rhel_7_6_len = G_N_ELEMENTS(hw_compat_rhel_7_6);
 +
 GlobalProperty hw_compat_7_1[] = {
     { "virtio-device", "queue_reset", "false" },
     { "virtio-rng-pci", "vectors", "0" },
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
 index eace854335..2a9f465619 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
@@ -238,6 +238,8 @@ static void pc_init1(MachineState *machine,
         smbios_set_defaults("QEMU", mc->desc,
                             mc->name, pcmc->smbios_legacy_mode,
                             pcmc->smbios_uuid_encoded,
 +                            pcmc->smbios_stream_product,
 +                            pcmc->smbios_stream_version,
                             pcms->smbios_entry_point_type);
     }
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
 index 4f3e5412f6..912cb0c0dc 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
@@ -206,6 +206,8 @@ static void pc_q35_init(MachineState *machine)
         smbios_set_defaults("QEMU", mc->desc,
                             mc->name, pcmc->smbios_legacy_mode,
                             pcmc->smbios_uuid_encoded,
 +                            pcmc->smbios_stream_product,
 +                            pcmc->smbios_stream_version,
                             pcms->smbios_entry_point_type);
     }
 diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
 index 4af8c66266..7dc12907ab 100644
 --- a/hw/net/rtl8139.c
 +++ b/hw/net/rtl8139.c
@@ -3169,7 +3169,7 @@ static int rtl8139_pre_save(void *opaque)
 static const VMStateDescription vmstate_rtl8139 = {
     .name = "rtl8139",
 -    .version_id = 5,
 +    .version_id = 4,
     .minimum_version_id = 3,
     .post_load = rtl8139_post_load,
     .pre_save  = rtl8139_pre_save,
@@ -3250,7 +3250,9 @@ static const VMStateDescription vmstate_rtl8139 = {
         VMSTATE_UINT32(tally_counters.TxMCol, RTL8139State),
         VMSTATE_UINT64(tally_counters.RxOkPhy, RTL8139State),
         VMSTATE_UINT64(tally_counters.RxOkBrd, RTL8139State),
 +#if 0 /* Disabled for Red Hat Enterprise Linux bz 1420195 */
         VMSTATE_UINT32_V(tally_counters.RxOkMul, RTL8139State, 5),
 +#endif
         VMSTATE_UINT16(tally_counters.TxAbt, RTL8139State),
         VMSTATE_UINT16(tally_counters.TxUndrn, RTL8139State),
 diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c
 index 2a90601ac5..7bde23e59d 100644
 --- a/hw/smbios/smbios.c
 +++ b/hw/smbios/smbios.c
@@ -58,6 +58,9 @@ static bool smbios_legacy = true;
 static bool smbios_uuid_encoded = true;
 /* end: legacy structures & constants for <= 2.0 machines */
 +/* Set to true for modern Windows 10 HardwareID-6 compat */
 +static bool smbios_type2_required;
 +
 uint8_t *smbios_tables;
 size_t smbios_tables_len;
@@ -670,7 +673,7 @@ static void smbios_build_type_1_table(void)
 static void smbios_build_type_2_table(void)
 {
 -    SMBIOS_BUILD_TABLE_PRE(2, T2_BASE, false); /* optional */
 +    SMBIOS_BUILD_TABLE_PRE(2, T2_BASE, smbios_type2_required);
     SMBIOS_TABLE_SET_STR(2, manufacturer_str, type2.manufacturer);
     SMBIOS_TABLE_SET_STR(2, product_str, type2.product);
@@ -985,7 +988,10 @@ void smbios_set_cpuid(uint32_t version, uint32_t features)
 void smbios_set_defaults(const char *manufacturer, const char *product,
                          const char *version, bool legacy_mode,
 -                         bool uuid_encoded, SmbiosEntryPointType ep_type)
 +                         bool uuid_encoded,
 +                         const char *stream_product,
 +                         const char *stream_version,
 +                         SmbiosEntryPointType ep_type)
 {
     smbios_have_defaults = true;
     smbios_legacy = legacy_mode;
@@ -1006,11 +1012,45 @@ void smbios_set_defaults(const char *manufacturer, const char *product,
         g_free(smbios_entries);
     }
 +    /*
 +     * If @stream_product & @stream_version are non-NULL, then
 +     * we're following rules for new Windows driver support.
 +     * The data we have to report is defined in this doc:
 +     *
 +     * https://docs.microsoft.com/en-us/windows-hardware/drivers/install/specifying-hardware-ids-for-a-computer
 +     *
 +     * The Windows drivers are written to expect use of the
 +     * scheme documented as "HardwareID-6" against Windows 10,
 +     * which uses SMBIOS System (Type 1) and Base Board (Type 2)
 +     * tables and will match on
 +     *
 +     *   System Manufacturer = Red Hat     (@manufacturer)
 +     *   System SKU Number = 8.2.0         (@stream_version)
 +     *   Baseboard Manufacturer = Red Hat  (@manufacturer)
 +     *   Baseboard Product = RHEL-AV       (@stream_product)
 +     *
 +     * NB, SKU must be changed with each RHEL-AV release
 +     *
 +     * Other fields can be freely used by applications using
 +     * QEMU. For example apps can use the "System product"
 +     * and "System version" to identify themselves.
 +     *
 +     * We get 'System Manufacturer' and 'Baseboard Manufacturer'
 +     */
     SMBIOS_SET_DEFAULT(type1.manufacturer, manufacturer);
     SMBIOS_SET_DEFAULT(type1.product, product);
     SMBIOS_SET_DEFAULT(type1.version, version);
 +    SMBIOS_SET_DEFAULT(type1.family, "Red Hat Enterprise Linux");
 +    if (stream_version != NULL) {
 +        SMBIOS_SET_DEFAULT(type1.sku, stream_version);
 +    }
     SMBIOS_SET_DEFAULT(type2.manufacturer, manufacturer);
 -    SMBIOS_SET_DEFAULT(type2.product, product);
 +    if (stream_product != NULL) {
 +        SMBIOS_SET_DEFAULT(type2.product, stream_product);
 +        smbios_type2_required = true;
 +    } else {
 +        SMBIOS_SET_DEFAULT(type2.product, product);
 +    }
     SMBIOS_SET_DEFAULT(type2.version, version);
     SMBIOS_SET_DEFAULT(type3.manufacturer, manufacturer);
     SMBIOS_SET_DEFAULT(type3.version, version);
 diff --git a/hw/timer/i8254_common.c b/hw/timer/i8254_common.c
 index b25da448c8..0331e84398 100644
 --- a/hw/timer/i8254_common.c
 +++ b/hw/timer/i8254_common.c
@@ -229,7 +229,7 @@ static const VMStateDescription vmstate_pit_common = {
     .pre_save = pit_dispatch_pre_save,
     .post_load = pit_dispatch_post_load,
     .fields = (VMStateField[]) {
 -        VMSTATE_UINT32_V(channels[0].irq_disabled, PITCommonState, 3),
 +        VMSTATE_UINT32(channels[0].irq_disabled, PITCommonState), /* qemu-kvm's v2 had 'flags' here */
         VMSTATE_STRUCT_ARRAY(channels, PITCommonState, 3, 2,
                              vmstate_pit_channel, PITChannelState),
         VMSTATE_INT64(channels[0].next_transition_time,
 diff --git a/hw/usb/hcd-xhci-pci.c b/hw/usb/hcd-xhci-pci.c
 index 643d4643e4..529bad9366 100644
 --- a/hw/usb/hcd-xhci-pci.c
 +++ b/hw/usb/hcd-xhci-pci.c
@@ -104,6 +104,33 @@ static int xhci_pci_vmstate_post_load(void *opaque, int version_id)
    return 0;
 }
 +/* RH bz 1912846 */
 +static bool usb_xhci_pci_add_msi(struct PCIDevice *dev, Error **errp)
 +{
 +    int ret;
 +    Error *err = NULL;
 +    XHCIPciState *s = XHCI_PCI(dev);
 +
 +    ret = msi_init(dev, 0x70, s->xhci.numintrs, true, false, &err);
 +    /*
 +     * Any error other than -ENOTSUP(board's MSI support is broken)
 +     * is a programming error
 +     */
 +    assert(!ret || ret == -ENOTSUP);
 +    if (ret && s->msi == ON_OFF_AUTO_ON) {
 +        /* Can't satisfy user's explicit msi=on request, fail */
 +        error_append_hint(&err, "You have to use msi=auto (default) or "
 +                "msi=off with this machine type.\n");
 +        error_propagate(errp, err);
 +        return true;
 +    }
 +    assert(!err || s->msi == ON_OFF_AUTO_AUTO);
 +    /* With msi=auto, we fall back to MSI off silently */
 +    error_free(err);
 +
 +    return false;
 +}
 +
 static void usb_xhci_pci_realize(struct PCIDevice *dev, Error **errp)
 {
     int ret;
@@ -125,23 +152,12 @@ static void usb_xhci_pci_realize(struct PCIDevice *dev, Error **errp)
         s->xhci.nec_quirks = true;
     }
 -    if (s->msi != ON_OFF_AUTO_OFF) {
 -        ret = msi_init(dev, 0x70, s->xhci.numintrs, true, false, &err);
 -        /*
 -         * Any error other than -ENOTSUP(board's MSI support is broken)
 -         * is a programming error
 -         */
 -        assert(!ret || ret == -ENOTSUP);
 -        if (ret && s->msi == ON_OFF_AUTO_ON) {
 -            /* Can't satisfy user's explicit msi=on request, fail */
 -            error_append_hint(&err, "You have to use msi=auto (default) or "
 -                    "msi=off with this machine type.\n");
 +    if (s->msi != ON_OFF_AUTO_OFF && s->rh_late_msi_cap) {
 +        /* This gives the behaviour from 5.2.0 onwards, lspci shows 90,a0,70 */
 +        if (usb_xhci_pci_add_msi(dev, &err)) {
             error_propagate(errp, err);
             return;
         }
 -        assert(!err || s->msi == ON_OFF_AUTO_AUTO);
 -        /* With msi=auto, we fall back to MSI off silently */
 -        error_free(err);
     }
     pci_register_bar(dev, 0,
                      PCI_BASE_ADDRESS_SPACE_MEMORY |
@@ -154,6 +170,14 @@ static void usb_xhci_pci_realize(struct PCIDevice *dev, Error **errp)
         assert(ret > 0);
     }
 +    /* RH bz 1912846 */
 +    if (s->msi != ON_OFF_AUTO_OFF && !s->rh_late_msi_cap) {
 +        /* This gives the older RH machine behaviour, lspci shows 90,70,a0 */
 +        if (usb_xhci_pci_add_msi(dev, &err)) {
 +            error_propagate(errp, err);
 +            return;
 +        }
 +    }
     if (s->msix != ON_OFF_AUTO_OFF) {
         /* TODO check for errors, and should fail when msix=on */
         msix_init(dev, s->xhci.numintrs,
@@ -198,11 +222,18 @@ static void xhci_instance_init(Object *obj)
     qdev_alias_all_properties(DEVICE(&s->xhci), obj);
 }
 +static Property xhci_pci_properties[] = {
 +    /* RH bz 1912846 */
 +    DEFINE_PROP_BOOL("x-rh-late-msi-cap", XHCIPciState, rh_late_msi_cap, true),
 +    DEFINE_PROP_END_OF_LIST()
 +};
 +
 static void xhci_class_init(ObjectClass *klass, void *data)
 {
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
 +    device_class_set_props(dc, xhci_pci_properties);
     dc->reset   = xhci_pci_reset;
     dc->vmsd    = &vmstate_xhci_pci;
     set_bit(DEVICE_CATEGORY_USB, dc->categories);
 diff --git a/hw/usb/hcd-xhci-pci.h b/hw/usb/hcd-xhci-pci.h
 index 08f70ce97c..1be7527c1b 100644
 --- a/hw/usb/hcd-xhci-pci.h
 +++ b/hw/usb/hcd-xhci-pci.h
@@ -40,6 +40,7 @@ typedef struct XHCIPciState {
     XHCIState xhci;
     OnOffAuto msi;
     OnOffAuto msix;
 +    bool      rh_late_msi_cap;  /* bz 1912846 */
 } XHCIPciState;
 #endif
 diff --git a/include/hw/boards.h b/include/hw/boards.h
 index da85f86efb..4a21eddbf9 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
@@ -503,4 +503,44 @@ extern const size_t hw_compat_2_2_len;
 extern GlobalProperty hw_compat_2_1[];
 extern const size_t hw_compat_2_1_len;
 +extern GlobalProperty hw_compat_rhel_9_4[];
 +extern const size_t hw_compat_rhel_9_4_len;
 +
 +extern GlobalProperty hw_compat_rhel_9_3[];
 +extern const size_t hw_compat_rhel_9_3_len;
 +
 +extern GlobalProperty hw_compat_rhel_9_2[];
 +extern const size_t hw_compat_rhel_9_2_len;
 +
 +extern GlobalProperty hw_compat_rhel_9_1[];
 +extern const size_t hw_compat_rhel_9_1_len;
 +
 +extern GlobalProperty hw_compat_rhel_9_0[];
 +extern const size_t hw_compat_rhel_9_0_len;
 +
 +extern GlobalProperty hw_compat_rhel_8_6[];
 +extern const size_t hw_compat_rhel_8_6_len;
 +
 +extern GlobalProperty hw_compat_rhel_8_5[];
 +extern const size_t hw_compat_rhel_8_5_len;
 +
 +extern GlobalProperty hw_compat_rhel_8_4[];
 +extern const size_t hw_compat_rhel_8_4_len;
 +
 +extern GlobalProperty hw_compat_rhel_8_3[];
 +extern const size_t hw_compat_rhel_8_3_len;
 +
 +extern GlobalProperty hw_compat_rhel_8_2[];
 +extern const size_t hw_compat_rhel_8_2_len;
 +
 +extern GlobalProperty hw_compat_rhel_8_1[];
 +extern const size_t hw_compat_rhel_8_1_len;
 +
 +extern GlobalProperty hw_compat_rhel_8_0[];
 +extern const size_t hw_compat_rhel_8_0_len;
 +
 +extern GlobalProperty hw_compat_rhel_7_6[];
 +extern const size_t hw_compat_rhel_7_6_len;
 +
 +extern const char *rhel_old_machine_deprecation;
 #endif
 diff --git a/include/hw/firmware/smbios.h b/include/hw/firmware/smbios.h
 index 7f3259a630..d24b3ccd32 100644
 --- a/include/hw/firmware/smbios.h
 +++ b/include/hw/firmware/smbios.h
@@ -294,7 +294,10 @@ void smbios_entry_add(QemuOpts *opts, Error **errp);
 void smbios_set_cpuid(uint32_t version, uint32_t features);
 void smbios_set_defaults(const char *manufacturer, const char *product,
                          const char *version, bool legacy_mode,
 -                         bool uuid_encoded, SmbiosEntryPointType ep_type);
 +                         bool uuid_encoded,
 +                         const char *stream_product,
 +                         const char *stream_version,
 +                         SmbiosEntryPointType ep_type);
 uint8_t *smbios_get_table_legacy(MachineState *ms, size_t *length);
 void smbios_get_tables(MachineState *ms,
                        const struct smbios_phys_mem_area *mem_array,
 diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
 index a10ceeabbf..037942d233 100644
 --- a/include/hw/i386/pc.h
 +++ b/include/hw/i386/pc.h
@@ -113,6 +113,9 @@ struct PCMachineClass {
     bool smbios_legacy_mode;
     bool smbios_uuid_encoded;
     SmbiosEntryPointType default_smbios_ep_type;
 +    /* New fields needed for Windows HardwareID-6 matching */
 +    const char *smbios_stream_product;
 +    const char *smbios_stream_version;
     /* RAM / address space compat: */
     bool gigabyte_align;
 -- 
 2.39.3
--- a/SOURCES/0007-Machine-type-related-general-changes.patch
+++ b/SOURCES/0007-Machine-type-related-general-changes.patch
--- a/SOURCES/0008-Add-aarch64-machine-types.patch
+++ b/SOURCES/0008-Add-aarch64-machine-types.patch
@ -1,4 +1,4 @@
-From 23f614ab0b79ec1c6f65a7f0d6993bfdfc53fd23 Mon Sep 17 00:00:00 2001
+From 670e90f5cbd92189155e079b8c6e2aafdf82d162 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 12:53:31 +0200
 Subject: Add aarch64 machine types
@ -6,74 +6,87 @@ Subject: Add aarch64 machine types
 Adding changes to add RHEL machine types for aarch64 architecture.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
---
+
-Rebase notes (6.1.0):
+Rebase notes (4.0.0):
- Use CONFIG_TPM check when using TPM structures
+- Use upstream compat handling
 Rebase notes (4.1.0-rc0):
 - Removed a15memmap (upstream)
 - Use virt_flash_create in rhel800_virt_instance_init
 Rebase notes (4.2.0-rc0):
 - Set numa_mem_supported
 Rebase notes (4.2.0-rc3):
 - aarch64: Add virt-rhel8.2.0 machine type for ARM (patch 92246)
 - aarch64: virt: Allow more than 1TB of RAM (patch 92249)
 - aarch64: virt: Allow PCDIMM instantiation (patch 92247)
 - aarch64: virt: Enhance the comment related to gic-version (patch 92248)
 Rebase notes (5.0.0):
 - Set default_ram_id in rhel_machine_class_init
 - Added setting acpi properties
 Rebase notes (5.1.0):
 - Added ras property
 - Added to virt_machine_device_unplug_cb to machine type (upstream)
 - added mte property (upstream)
 Rebase notes (weekly-210210):
 - Added support for oem fields to machine type
 Rebase notes (weekly-210303):
 - Use rhel-8.4.0 hw compat
 Rebase notes (6.0.0-rc2):
 - renamed oem-id and oem-table-id to x-oem-id and x-oem-table-id
 Rebase notes (210623):
 - Protect TPM functions by CONFIG_TPM ifdef
 Rebase notes (6.1.0-rc0):
 - Add support for default_bus_bypass_iommu
 - ea4c0b32d9 arm/virt: Register highmem and gic-version as class properties
 - 895e1fa86a hw/arm/virt: Add 8.5 and 9.0 machine types and remove older ones
-Rebase notes (7.0.0):
+Merged patches (4.0.0):
- Added dtb-kaslr-seed option
+- 7bfdb4c aarch64: Add virt-rhel8.0.0 machine type for ARM
- Set no_tcg_lpa2 to true
+- 3433e69 aarch64: Set virt-rhel8.0.0 max_cpus to 512
 - 4d20863 aarch64: Use 256MB ECAM region by default
-Rebase notes (7.1.0):
+Merged patches (4.1.0):
- replace dtb_kaslr_seed by dtb_randomness
+- c3e39ef aarch64: Add virt-rhel8.1.0 machine type for ARM
- Updated dtb_randomness comment
+- 59a46d1 aarch64: Allow ARM VIRT iommu option in RHEL8.1 machine
-Rebase notes (7.2.0):
+Merged patches (5.2.0 rc0):
- Disabled cortex-a35
+- 12990ad hw/arm: Changes to rhel820 machine
 - 46d5a79 hw/arm: Introduce rhel_virt_instance_init() helper
 - 098954a hw/arm: Add rhel830 machine type
 - ee8e99d arm: Set correct max_cpus value on virt-rhel* machine types
 - e5edd38 RHEL-only: arm/virt: Allow the TPM_TIS_SYSBUS device dynamic allocation in machvirt
 - 6d7ba66 machine types/numa: set numa_mem_supported on old machine types (partialy)
 - 25c5644 machine_types/numa: compatibility for auto_enable_numa_with_memdev (partialy)
-Rebase notes (8.0.0):
+Merged patches (6.0):
- Moved changed code from target/arm/helper.c to target/arm/arm-qmp-cmds.c
+- 078fadb5da AArch64 machine types cleanup
 - ea7b7425fa hw/arm/virt: Add 8.4 Machine type
-Rebase notes (8.1.0):
+Merged patches (weekly-210609):
- Added setting default_nic
+- 73b1578882 hw/arm/virt: Add 8.5 machine type
 - 5333038d11 hw/arm/virt: Disable PL011 clock migration through hw_compat_rhel_8_3
 - 63adb8ae86 arm/virt: Register highmem and gic-version as class properties
-Merged patches (6.2.0):
+Merged patches (weekly-211027):
- 9a3d4fde0e hw/arm/virt: Remove 9.0 machine type
+- 86e3057c0a hw: arm: virt: Add hw_compat_rhel_8_5 to 8.5 machine type
 - f7d04d6695 hw: arm: virt: Add hw_compat_rhel_8_5 to 8.5 machine type
 Merged patches (7.0.0):
 - 3b82be3dd3 redhat: virt-rhel8.5.0: Update machine type compatibility for QEMU 6.2.0 update
 - c354a86c9b hw/arm/virt: Register "iommu" as a class property
 - c1a2630dc9 hw/arm/virt: Register "its" as a class property
 - 9d8c61dc93 hw/arm/virt: Rename default_bus_bypass_iommu
 - a1d1b6eeb6 hw/arm/virt: Expose the 'RAS' option
 - 47f8fe1b82 hw/arm/virt: Add 9.0 machine type and remove 8.5 one
 - ed2346788f hw/arm/virt: Check no_tcg_its and minor style changes
 Merged patches (7.0.0):
 - f79b31bdef hw/arm/virt: Remove the dtb-kaslr-seed machine option
 - b6fca85f4a hw/arm/virt: Fix missing initialization in instance/class_init()
 Merged patches (7.1.0):
 - ac97dd4f9f RHEL-only: AArch64: Drop unsupported CPU types
 - e9c0a70664 target/arm: deprecate named CPU models
 Merged patches (7.2.0):
 - 0be2889fa2 Introduce upstream 7.0 compat changes (only applicable parts)
 Merged patches (8.0.0):
 - c1a21266d8 redhat: aarch64: add rhel9.2.0 virt machine type
 - d97cd7c513 redhat: fix virt-rhel9.2.0 compat props
 Merged patches (8.1.0):
 - bd5d81d286 Add RHEL 9.2.0 compat structure (arm part)
 - c07f666086 hw/arm/virt: Validate cluster and NUMA node boundary for RHEL machines
 Merged patches (8.2.0):
 - 4ee284aca9 Add machine types compat bits. (partial)
 ---
- hw/arm/virt.c         | 250 +++++++++++++++++++++++++++++++++++++++++-
+ hw/arm/virt.c         | 226 +++++++++++++++++++++++++++++++++++++++++-
 hw/core/machine.c     |   2 +
 include/hw/arm/virt.h |   8 ++
- 2 files changed, 257 insertions(+), 1 deletion(-)
+ 3 files changed, 235 insertions(+), 1 deletion(-)
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index 62f0f7d4d6..c541efee5e 100644
+index 5de4d9d73b..c77d26ab13 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
-@@ -82,6 +82,7 @@
+@@ -79,6 +79,7 @@
 #include "hw/char/pl011.h"
 #include "qemu/guest-random.h"
@ -81,12 +94,13 @@ index 62f0f7d4d6..c541efee5e 100644
 #define DEFINE_VIRT_MACHINE_LATEST(major, minor, latest) \
     static void virt_##major##_##minor##_class_init(ObjectClass *oc, \
                                                     void *data) \
-@@ -108,7 +109,48 @@
+@@ -105,7 +106,48 @@
     DEFINE_VIRT_MACHINE_LATEST(major, minor, true)
 #define DEFINE_VIRT_MACHINE(major, minor) \
     DEFINE_VIRT_MACHINE_LATEST(major, minor, false)
 -
 +#endif /* disabled for RHEL */
- 
+
 +#define DEFINE_RHEL_MACHINE_LATEST(m, n, s, latest)                     \
 +    static void rhel##m##n##s##_virt_class_init(ObjectClass *oc,        \
 +                                                void *data)             \
@ -130,7 +144,7 @@ index 62f0f7d4d6..c541efee5e 100644
 /* Number of external interrupt lines to configure the GIC with */
 #define NUM_IRQS 256
-@@ -2341,6 +2383,7 @@ static void machvirt_init(MachineState *machine)
+@@ -2180,6 +2222,7 @@ static void machvirt_init(MachineState *machine)
     qemu_add_machine_init_done_notifier(&vms->machine_done);
 }
@ -138,7 +152,7 @@ index 62f0f7d4d6..c541efee5e 100644
 static bool virt_get_secure(Object *obj, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
-@@ -2368,6 +2411,7 @@ static void virt_set_virt(Object *obj, bool value, Error **errp)
+@@ -2207,6 +2250,7 @@ static void virt_set_virt(Object *obj, bool value, Error **errp)
     vms->virt = value;
 }
@ -146,48 +160,15 @@ index 62f0f7d4d6..c541efee5e 100644
 static bool virt_get_highmem(Object *obj, Error **errp)
 {
-@@ -2383,6 +2427,7 @@ static void virt_set_highmem(Object *obj, bool value, Error **errp)
+@@ -2304,6 +2348,7 @@ static void virt_set_acpi(Object *obj, Visitor *v, const char *name,
-     vms->highmem = value;
+     visit_type_OnOffAuto(v, name, &vms->acpi, errp);
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
- static bool virt_get_compact_highmem(Object *obj, Error **errp)
+ static bool virt_get_ras(Object *obj, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
-@@ -2438,7 +2483,7 @@ static void virt_set_highmem_mmio(Object *obj, bool value, Error **errp)
+@@ -2331,6 +2376,7 @@ static void virt_set_mte(Object *obj, bool value, Error **errp)
     vms->highmem_mmio = value;
 }
 -
 +#endif /* disabled for RHEL */
 static bool virt_get_its(Object *obj, Error **errp)
 {
@@ -2454,6 +2499,7 @@ static void virt_set_its(Object *obj, bool value, Error **errp)
     vms->its = value;
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static bool virt_get_dtb_randomness(Object *obj, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
@@ -2467,6 +2513,7 @@ static void virt_set_dtb_randomness(Object *obj, bool value, Error **errp)
     vms->dtb_randomness = value;
 }
 +#endif /* disabled for RHEL */
 static char *virt_get_oem_id(Object *obj, Error **errp)
 {
@@ -2550,6 +2597,7 @@ static void virt_set_ras(Object *obj, bool value, Error **errp)
     vms->ras = value;
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static bool virt_get_mte(Object *obj, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
@@ -2563,6 +2611,7 @@ static void virt_set_mte(Object *obj, bool value, Error **errp)
     vms->mte = value;
 }
@ -195,7 +176,7 @@ index 62f0f7d4d6..c541efee5e 100644
 static char *virt_get_gic_version(Object *obj, Error **errp)
 {
-@@ -2935,6 +2984,7 @@ static int virt_kvm_type(MachineState *ms, const char *type_str)
+@@ -2666,6 +2712,7 @@ static int virt_kvm_type(MachineState *ms, const char *type_str)
     return fixed_ipa ? 0 : requested_pa_size;
 }
@ -203,7 +184,7 @@ index 62f0f7d4d6..c541efee5e 100644
 static void virt_machine_class_init(ObjectClass *oc, void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
-@@ -3405,3 +3455,201 @@ static void virt_machine_2_6_options(MachineClass *mc)
+@@ -3031,3 +3078,180 @@ static void virt_machine_2_6_options(MachineClass *mc)
     vmc->no_pmu = true;
 }
 DEFINE_VIRT_MACHINE(2, 6)
@ -238,13 +219,9 @@ index 62f0f7d4d6..c541efee5e 100644
 +    hc->unplug_request = virt_machine_device_unplug_request_cb;
 +    hc->unplug = virt_machine_device_unplug_cb;
 +    mc->nvdimm_supported = true;
 +    mc->smp_props.clusters_supported = true;
 +    mc->auto_enable_numa_with_memhp = true;
 +    mc->auto_enable_numa_with_memdev = true;
 +    /* platform instead of architectural choice */
 +    mc->cpu_cluster_has_numa_boundary = true;
 +    mc->default_ram_id = "mach-virt.ram";
 +    mc->default_nic = "virtio-net-pci";
 +
 +    object_class_property_add(oc, "acpi", "OnOffAuto",
 +        virt_get_acpi, virt_set_acpi,
@ -264,30 +241,6 @@ index 62f0f7d4d6..c541efee5e 100644
 +                                          "Set GIC version. "
 +                                          "Valid values are 2, 3, host and max");
 +
 +    object_class_property_add_str(oc, "iommu", virt_get_iommu, virt_set_iommu);
 +    object_class_property_set_description(oc, "iommu",
 +                                          "Set the IOMMU type. "
 +                                          "Valid values are none and smmuv3");
 +
 +    object_class_property_add_bool(oc, "default-bus-bypass-iommu",
 +                                   virt_get_default_bus_bypass_iommu,
 +                                   virt_set_default_bus_bypass_iommu);
 +    object_class_property_set_description(oc, "default-bus-bypass-iommu",
 +                                          "Set on/off to enable/disable "
 +                                          "bypass_iommu for default root bus");
 +
 +    object_class_property_add_bool(oc, "ras", virt_get_ras,
 +                                   virt_set_ras);
 +    object_class_property_set_description(oc, "ras",
 +                                          "Set on/off to enable/disable reporting host memory errors "
 +                                          "to a KVM guest using ACPI and guest external abort exceptions");
 +
 +    object_class_property_add_bool(oc, "its", virt_get_its,
 +                                   virt_set_its);
 +    object_class_property_set_description(oc, "its",
 +                                          "Set on/off to enable/disable "
 +                                          "ITS instantiation");
 +
 +    object_class_property_add_str(oc, "x-oem-id",
 +                                  virt_get_oem_id,
 +                                  virt_set_oem_id);
@ -296,7 +249,6 @@ index 62f0f7d4d6..c541efee5e 100644
 +                                          "in ACPI table header."
 +                                          "The string may be up to 6 bytes in size");
 +
 +
 +    object_class_property_add_str(oc, "x-oem-table-id",
 +                                  virt_get_oem_table_id,
 +                                  virt_set_oem_table_id);
@ -304,6 +256,10 @@ index 62f0f7d4d6..c541efee5e 100644
 +                                          "Override the default value of field OEM Table ID "
 +                                          "in ACPI table header."
 +                                          "The string may be up to 8 bytes in size");
 +    object_class_property_add_bool(oc, "default_bus_bypass_iommu",
 +                                   virt_get_default_bus_bypass_iommu,
 +                                   virt_set_default_bus_bypass_iommu);
 +
 +}
 +
 +static void rhel_virt_instance_init(Object *obj)
@ -319,31 +275,28 @@ index 62f0f7d4d6..c541efee5e 100644
 +
 +    /* High memory is enabled by default */
 +    vms->highmem = true;
 +    vms->highmem_compact = !vmc->no_highmem_compact;
 +    vms->gic_version = VIRT_GIC_VERSION_NOSEL;
 +
 +    vms->highmem_ecam = !vmc->no_highmem_ecam;
 +    vms->highmem_mmio = true;
 +    vms->highmem_redists = true;
 +
 +    if (vmc->no_its) {
 +        vms->its = false;
 +    } else {
 +        /* Default allows ITS instantiation */
 +        vms->its = true;
-+
+        object_property_add_bool(obj, "its", virt_get_its,
-+        if (vmc->no_tcg_its) {
+                                 virt_set_its);
-+            vms->tcg_its = false;
+        object_property_set_description(obj, "its",
-+        } else {
+                                        "Set on/off to enable/disable "
-+            vms->tcg_its = true;
+                                        "ITS instantiation");
 +        }
 +    }
 +
 +    /* Default disallows iommu instantiation */
 +    vms->iommu = VIRT_IOMMU_NONE;
-+
+    object_property_add_str(obj, "iommu", virt_get_iommu, virt_set_iommu);
-+    /* The default root bus is attached to iommu by default */
+    object_property_set_description(obj, "iommu",
-+    vms->default_bus_bypass_iommu = false;
+                                    "Set the IOMMU type. "
 +                                    "Valid values are none and smmuv3");
 +
 +    /* Default disallows RAS instantiation and is non-configurable for RHEL */
 +    vms->ras = false;
@ -351,15 +304,13 @@ index 62f0f7d4d6..c541efee5e 100644
 +    /* MTE is disabled by default and non-configurable for RHEL */
 +    vms->mte = false;
 +
-+    /* Supply kaslr-seed and rng-seed by default, non-configurable for RHEL */
+    vms->default_bus_bypass_iommu = false;
 +    vms->dtb_randomness = true;
 +
 +    vms->irqmap = a15irqmap;
 +
 +    virt_flash_create(vms);
 +
 +    vms->oem_id = g_strndup(ACPI_BUILD_APPNAME6, 6);
 +    vms->oem_table_id = g_strndup(ACPI_BUILD_APPNAME8, 8);
 +
 +}
 +
 +static const TypeInfo rhel_machine_info = {
@ -382,34 +333,56 @@ index 62f0f7d4d6..c541efee5e 100644
 +}
 +type_init(rhel_machine_init);
 +
-+static void rhel920_virt_options(MachineClass *mc)
+static void rhel850_virt_options(MachineClass *mc)
 +{
 +    compat_props_add(mc->compat_props, arm_rhel_compat, arm_rhel_compat_len);
-+    compat_props_add(mc->compat_props, hw_compat_rhel_9_4, hw_compat_rhel_9_4_len);
+    compat_props_add(mc->compat_props, hw_compat_rhel_8_5, hw_compat_rhel_8_5_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_3, hw_compat_rhel_9_3_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_2, hw_compat_rhel_9_2_len);
 +}
-+DEFINE_RHEL_MACHINE_AS_LATEST(9, 2, 0)
+DEFINE_RHEL_MACHINE_AS_LATEST(8, 5, 0)
 +
-+static void rhel900_virt_options(MachineClass *mc)
+static void rhel840_virt_options(MachineClass *mc)
 +{
 +    rhel850_virt_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_4, hw_compat_rhel_8_4_len);
 +}
 +DEFINE_RHEL_MACHINE(8, 4, 0)
 +
 +static void rhel830_virt_options(MachineClass *mc)
 +{
 +    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
 +
-+    rhel920_virt_options(mc);
+    rhel840_virt_options(mc);
-+
+    compat_props_add(mc->compat_props, hw_compat_rhel_8_3, hw_compat_rhel_8_3_len);
-+    compat_props_add(mc->compat_props, hw_compat_rhel_9_1, hw_compat_rhel_9_1_len);
+    vmc->no_kvm_steal_time = true;
 +
 +    /* Disable FEAT_LPA2 since old kernels (<= v5.12) don't boot with that feature */
 +    vmc->no_tcg_lpa2 = true;
 +    /* Compact layout for high memory regions was introduced with 9.2.0 */
 +    vmc->no_highmem_compact = true;
 +}
-+DEFINE_RHEL_MACHINE(9, 0, 0)
+DEFINE_RHEL_MACHINE(8, 3, 0)
 +
 +static void rhel820_virt_options(MachineClass *mc)
 +{
 +    rhel830_virt_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_2, hw_compat_rhel_8_2_len);
 +    mc->numa_mem_supported = true;
 +    mc->auto_enable_numa_with_memdev = false;
 +}
 +DEFINE_RHEL_MACHINE(8, 2, 0)
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index be4f9864cd..62febde5aa 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -87,6 +87,8 @@ GlobalProperty hw_compat_rhel_8_3[] = {
     { "nvme", "use-intel-id", "on"},
     /* hw_compat_rhel_8_3 from hw_compat_5_1 */
     { "pvpanic", "events", "1"}, /* PVPANIC_PANICKED */
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "pl011", "migrate-clk", "off" },
     /* hw_compat_rhel_8_3 bz 1912846 */
     { "pci-xhci", "x-rh-late-msi-cap", "off" },
     /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
-index f69239850e..7b8abe5645 100644
+index dc6b66ffc8..9364628847 100644
 --- a/include/hw/arm/virt.h
 +++ b/include/hw/arm/virt.h
-@@ -177,9 +177,17 @@ struct VirtMachineState {
+@@ -175,9 +175,17 @@ struct VirtMachineState {
 #define VIRT_ECAM_ID(high) (high ? VIRT_HIGH_PCIE_ECAM : VIRT_PCIE_ECAM)
@ -428,5 +401,5 @@ index f69239850e..7b8abe5645 100644
 bool virt_is_acpi_enabled(VirtMachineState *vms);
 -- 
-2.39.3
+2.27.0
--- a/SOURCES/0009-Add-ppc64-machine-types.patch
+++ b/SOURCES/0009-Add-ppc64-machine-types.patch
@ -1,4 +1,4 @@
-From d03cff85f5f1b69b1a66011ebaa974ece81d31bc Mon Sep 17 00:00:00 2001
+From 3c65320ce5b8ad3bb8c0d8fd13a88c464d5c5845 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 13:27:13 +0200
 Subject: Add ppc64 machine types
@ -7,37 +7,66 @@ Adding changes to add RHEL machine types for ppc64 architecture.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
-Rebase notes (6.2.0):
+Rebase changes (4.0.0):
- Fixed rebase conflict relicts
+- remove instance options and use upstream solution
- Update machine type compat for 6.2 (from MR 66)
+- Use upstream compat handling
 - Replace SPAPR_PCI_2_7_MMIO_WIN_SIZE with value (changed upstream)
 - re-add handling of instance_options (removed upstream)
 - Use p8 as default for rhel machine types (p9 default upstream)
 - sPAPRMachineClass renamed to SpaprMachineClass (upstream)
-Merged patches (6.1.0):
+Rebase changes (4.1.0):
- c438c25ac3 redhat: Define pseries-rhel8.5.0 machine type
+- Update format for compat structures
 - a3995e2eff Remove RHEL 7.0.0 machine type (only ppc64 changes)
 - ad3190a79b Remove RHEL 7.1.0 machine type (only ppc64 changes)
 - 84bbe15d4e Remove RHEL 7.2.0 machine type (only ppc64 changes)
 - 0215eb3356 Remove RHEL 7.3.0 machine types (only ppc64 changes)
 - af69d1ca6e Remove RHEL 7.4.0 machine types (only ppc64 changes)
 - 8f7a74ab78 Remove RHEL 7.5.0 machine types (only ppc64 changes)
-Merged patches (7.1.0):
+Rebase notes (weekly-210303):
- baa6790171 target/ppc/cpu-models: Fix ppc_cpu_aliases list for RHEL
+- Use rhel-8.4.0 hw compat
 Merged patches (4.0.0):
 - 467d59a redhat: define pseries-rhel8.0.0 machine type
 Merged patches (4.1.0):
 - f21757edc target/ppc/spapr: Enable mitigations by default for pseries-4.0 machine type
 - 2511c63 redhat: sync pseries-rhel7.6.0 with rhel-av-8.0.1
 - 89f01da redhat: define pseries-rhel8.1.0 machine type
 Merged patches (4.2.0):
 - bcba728 redhat: update pseries-rhel8.1.0 machine type
 - redhat: update pseries-rhel-7.6.0 machine type (patch 93039)
 - redhat: define pseries-rhel8.2.0 machine type (patch 93041)
 Merged patches (5.1.0):
 - eb121ff spapr: Enable DD2.3 accelerated count cache flush in pseries-5.0 machine (partial)
 Merged patches (5.2.0 rc0):
 - 311a20f redhat: define pseries-rhel8.3.0 machine type
 - 1284167 ppc: Set correct max_cpus value on spapr-rhel* machine types
 - 1ab8783 redhat: update pseries-rhel8.2.0 machine type
 - b162af531a target/ppc: Add experimental option for enabling secure guests
 Merged patches (weekly-201216):
 - 943c936df3 redhat: Add spapr_machine_rhel_default_class_options()
 - 030b5e6fba redhat: Define pseries-rhel8.4.0 machine type
 Merged patches (weekly-210602):
 - b7128d8ef7 redhat: Define pseries-rhel8.5.0 machine type
 Merged patches (weekly-211006):
 - c8f68b47e9 redhat: Update pseries-rhel8.5.0
 ---
- hw/ppc/spapr.c          | 243 ++++++++++++++++++++++++++++++++++++++++
+ hw/ppc/spapr.c          | 382 ++++++++++++++++++++++++++++++++++++++++
- hw/ppc/spapr_cpu_core.c |  13 +++
+ hw/ppc/spapr_cpu_core.c |  13 ++
 include/hw/ppc/spapr.h  |   4 +
- target/ppc/compat.c     |  13 ++-
+ target/ppc/compat.c     |  13 +-
 target/ppc/cpu-models.c |   1 +
 target/ppc/cpu.h        |   1 +
- target/ppc/kvm.c        |  27 +++++
+ target/ppc/kvm.c        |  27 +++
- target/ppc/kvm_ppc.h    |  13 +++
+ target/ppc/kvm_ppc.h    |  13 ++
- 8 files changed, 314 insertions(+), 1 deletion(-)
+ 7 files changed, 452 insertions(+), 1 deletion(-)
 diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
-index df09aa9d6a..ff459e1a46 100644
+index 3b5fd749be..cace86028d 100644
 --- a/hw/ppc/spapr.c
 +++ b/hw/ppc/spapr.c
-@@ -1689,6 +1689,9 @@ static void spapr_machine_reset(MachineState *machine, ShutdownCause reason)
+@@ -1593,6 +1593,9 @@ static void spapr_machine_reset(MachineState *machine)
     pef_kvm_reset(machine->cgs, &error_fatal);
     spapr_caps_apply(spapr);
@ -47,7 +76,7 @@ index df09aa9d6a..ff459e1a46 100644
     first_ppc_cpu = POWERPC_CPU(first_cpu);
     if (kvm_enabled() && kvmppc_has_cap_mmu_radix() &&
-@@ -3397,6 +3400,20 @@ static void spapr_set_host_serial(Object *obj, const char *value, Error **errp)
+@@ -3288,6 +3291,20 @@ static void spapr_set_host_serial(Object *obj, const char *value, Error **errp)
     spapr->host_serial = g_strdup(value);
 }
@ -68,7 +97,7 @@ index df09aa9d6a..ff459e1a46 100644
 static void spapr_instance_init(Object *obj)
 {
     SpaprMachineState *spapr = SPAPR_MACHINE(obj);
-@@ -3475,6 +3492,12 @@ static void spapr_instance_init(Object *obj)
+@@ -3366,6 +3383,12 @@ static void spapr_instance_init(Object *obj)
         spapr_get_host_serial, spapr_set_host_serial);
     object_property_set_description(obj, "host-serial",
         "Host serial number to advertise in guest device tree");
@ -81,7 +110,7 @@ index df09aa9d6a..ff459e1a46 100644
 }
 static void spapr_machine_finalizefn(Object *obj)
-@@ -4734,6 +4757,7 @@ static void spapr_machine_class_init(ObjectClass *oc, void *data)
+@@ -4614,6 +4637,7 @@ static void spapr_machine_class_init(ObjectClass *oc, void *data)
     vmc->client_architecture_support = spapr_vof_client_architecture_support;
     vmc->quiesce = spapr_vof_quiesce;
     vmc->setprop = spapr_vof_setprop;
@ -89,15 +118,15 @@ index df09aa9d6a..ff459e1a46 100644
 }
 static const TypeInfo spapr_machine_info = {
-@@ -4785,6 +4809,7 @@ static void spapr_machine_latest_class_options(MachineClass *mc)
+@@ -4665,6 +4689,7 @@ static void spapr_machine_latest_class_options(MachineClass *mc)
     }                                                                \
     type_init(spapr_machine_register_##suffix)
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 /*
-  * pseries-8.2
+  * pseries-6.2
  */
-@@ -4967,6 +4992,7 @@ static void spapr_machine_4_1_class_options(MachineClass *mc)
+@@ -4781,6 +4806,7 @@ static void spapr_machine_4_1_class_options(MachineClass *mc)
 }
 DEFINE_SPAPR_MACHINE(4_1, "4.1", false);
@ -105,8 +134,8 @@ index df09aa9d6a..ff459e1a46 100644
 /*
  * pseries-4.0
-@@ -4982,6 +5008,8 @@ static bool phb_placement_4_0(SpaprMachineState *spapr, uint32_t index,
+@@ -4800,6 +4826,8 @@ static bool phb_placement_4_0(SpaprMachineState *spapr, uint32_t index,
-     }
+     *nv2atsd = 0;
     return true;
 }
 +
@ -114,7 +143,23 @@ index df09aa9d6a..ff459e1a46 100644
 static void spapr_machine_4_0_class_options(MachineClass *mc)
 {
     SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
-@@ -5306,6 +5334,221 @@ static void spapr_machine_2_1_class_options(MachineClass *mc)
+@@ -4958,6 +4986,7 @@ DEFINE_SPAPR_MACHINE(2_8, "2.8", false);
 /*
  * pseries-2.7
  */
 +#endif
 static bool phb_placement_2_7(SpaprMachineState *spapr, uint32_t index,
                               uint64_t *buid, hwaddr *pio,
@@ -5013,6 +5042,7 @@ static bool phb_placement_2_7(SpaprMachineState *spapr, uint32_t index,
     return true;
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void spapr_machine_2_7_class_options(MachineClass *mc)
 {
     SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
@@ -5127,6 +5157,358 @@ static void spapr_machine_2_1_class_options(MachineClass *mc)
     compat_props_add(mc->compat_props, hw_compat_2_1, hw_compat_2_1_len);
 }
 DEFINE_SPAPR_MACHINE(2_1, "2.1", false);
@ -138,14 +183,10 @@ index df09aa9d6a..ff459e1a46 100644
 +
 +static void spapr_machine_rhel850_class_options(MachineClass *mc)
 +{
 +    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 +
 +    /* The default machine type must apply the RHEL specific defaults */
 +    spapr_machine_rhel_default_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_5,
 +                     hw_compat_rhel_8_5_len);
 +    smc->pre_6_2_numa_affinity = true;
 +    mc->smp_props.prefer_sockets = true;
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel850, "rhel8.5.0", true);
@ -333,14 +374,155 @@ index df09aa9d6a..ff459e1a46 100644
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel760sxxm, "rhel7.6.0-sxxm", false);
 +
 +static void spapr_machine_rhel750_class_options(MachineClass *mc)
 +{
 +    spapr_machine_rhel760_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_7_5, hw_compat_rhel_7_5_len);
 +
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel750, "rhel7.5.0", false);
 +
 +/*
 + * pseries-rhel7.5.0-sxxm
 + *
 + * pseries-rhel7.5.0 with speculative execution exploit mitigations enabled by default
 + */
 +
 +static void spapr_machine_rhel750sxxm_class_options(MachineClass *mc)
 +{
 +    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 +
 +    spapr_machine_rhel750_class_options(mc);
 +    smc->default_caps.caps[SPAPR_CAP_CFPC] = SPAPR_CAP_WORKAROUND;
 +    smc->default_caps.caps[SPAPR_CAP_SBBC] = SPAPR_CAP_WORKAROUND;
 +    smc->default_caps.caps[SPAPR_CAP_IBS] = SPAPR_CAP_FIXED_CCD;
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel750sxxm, "rhel7.5.0-sxxm", false);
 +
 +/*
 + * pseries-rhel7.4.0
 + * like spapr_compat_2_9
 + */
 +GlobalProperty spapr_compat_rhel7_4[] = {
 +    { TYPE_POWERPC_CPU, "pre-2.10-migration", "on" },
 +};
 +const size_t spapr_compat_rhel7_4_len = G_N_ELEMENTS(spapr_compat_rhel7_4);
 +
 +static void spapr_machine_rhel740_class_options(MachineClass *mc)
 +{
 +    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 +
 +    spapr_machine_rhel750_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_7_4, hw_compat_rhel_7_4_len);
 +    compat_props_add(mc->compat_props, spapr_compat_rhel7_4, spapr_compat_rhel7_4_len);
 +    smc->has_power9_support = false;
 +    smc->pre_2_10_has_unused_icps = true;
 +    smc->resize_hpt_default = SPAPR_RESIZE_HPT_DISABLED;
 +    smc->default_caps.caps[SPAPR_CAP_HTM] = SPAPR_CAP_ON;
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel740, "rhel7.4.0", false);
 +
 +/*
 + * pseries-rhel7.4.0-sxxm
 + *
 + * pseries-rhel7.4.0 with speculative execution exploit mitigations enabled by default
 + */
 +
 +static void spapr_machine_rhel740sxxm_class_options(MachineClass *mc)
 +{
 +    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 +
 +    spapr_machine_rhel740_class_options(mc);
 +    smc->default_caps.caps[SPAPR_CAP_CFPC] = SPAPR_CAP_WORKAROUND;
 +    smc->default_caps.caps[SPAPR_CAP_SBBC] = SPAPR_CAP_WORKAROUND;
 +    smc->default_caps.caps[SPAPR_CAP_IBS] = SPAPR_CAP_FIXED_CCD;
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel740sxxm, "rhel7.4.0-sxxm", false);
 +
 +/*
 + * pseries-rhel7.3.0
 + * like spapr_compat_2_6/_2_7/_2_8 but "ddw" has been backported to RHEL7_3
 + */
 +GlobalProperty spapr_compat_rhel7_3[] = {
 +    { TYPE_SPAPR_PCI_HOST_BRIDGE, "mem_win_size", "0xf80000000" },
 +    { TYPE_SPAPR_PCI_HOST_BRIDGE, "mem64_win_size", "0" },
 +    { TYPE_POWERPC_CPU, "pre-2.8-migration", "on" },
 +    { TYPE_SPAPR_PCI_HOST_BRIDGE, "pre-2.8-migration", "on" },
 +    { TYPE_SPAPR_PCI_HOST_BRIDGE, "pcie-extended-configuration-space", "off" },
 +};
 +const size_t spapr_compat_rhel7_3_len = G_N_ELEMENTS(spapr_compat_rhel7_3);
 +
 +static void spapr_machine_rhel730_class_options(MachineClass *mc)
 +{
 +    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 +
 +    spapr_machine_rhel740_class_options(mc);
 +    mc->default_cpu_type = POWERPC_CPU_TYPE_NAME("power7_v2.3");
 +    mc->default_machine_opts = "modern-hotplug-events=off";
 +    compat_props_add(mc->compat_props, hw_compat_rhel_7_3, hw_compat_rhel_7_3_len);
 +    compat_props_add(mc->compat_props, spapr_compat_rhel7_3, spapr_compat_rhel7_3_len);
 +
 +    smc->phb_placement = phb_placement_2_7;
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel730, "rhel7.3.0", false);
 +
 +/*
 + * pseries-rhel7.3.0-sxxm
 + *
 + * pseries-rhel7.3.0 with speculative execution exploit mitigations enabled by default
 + */
 +
 +static void spapr_machine_rhel730sxxm_class_options(MachineClass *mc)
 +{
 +    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 +
 +    spapr_machine_rhel730_class_options(mc);
 +    smc->default_caps.caps[SPAPR_CAP_CFPC] = SPAPR_CAP_WORKAROUND;
 +    smc->default_caps.caps[SPAPR_CAP_SBBC] = SPAPR_CAP_WORKAROUND;
 +    smc->default_caps.caps[SPAPR_CAP_IBS] = SPAPR_CAP_FIXED_CCD;
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel730sxxm, "rhel7.3.0-sxxm", false);
 +
 +/*
 + * pseries-rhel7.2.0
 + */
 +/* Should be like spapr_compat_2_5 + 2_4 + 2_3, but "dynamic-reconfiguration"
 + * has been backported to RHEL7_2 so we don't need it here.
 + */
 +
 +GlobalProperty spapr_compat_rhel7_2[] = {
 +    { "spapr-vlan", "use-rx-buffer-pools", "off" },
 +    { TYPE_SPAPR_PCI_HOST_BRIDGE, "ddw", "off" },
 +};
 +const size_t spapr_compat_rhel7_2_len = G_N_ELEMENTS(spapr_compat_rhel7_2);
 +
 +static void spapr_machine_rhel720_class_options(MachineClass *mc)
 +{
 +    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 +
 +    spapr_machine_rhel730_class_options(mc);
 +    smc->use_ohci_by_default = true;
 +    mc->has_hotpluggable_cpus = NULL;
 +    compat_props_add(mc->compat_props, hw_compat_rhel_7_2, hw_compat_rhel_7_2_len);
 +    compat_props_add(mc->compat_props, spapr_compat_rhel7_2, spapr_compat_rhel7_2_len);
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel720, "rhel7.2.0", false);
 static void spapr_machine_register_types(void)
 {
 diff --git a/hw/ppc/spapr_cpu_core.c b/hw/ppc/spapr_cpu_core.c
-index 33e0c8724c..9d01663f43 100644
+index 8ba34f6a1d..78eca1c04a 100644
 --- a/hw/ppc/spapr_cpu_core.c
 +++ b/hw/ppc/spapr_cpu_core.c
-@@ -25,6 +25,7 @@
+@@ -24,6 +24,7 @@
 #include "sysemu/reset.h"
 #include "sysemu/hw_accel.h"
 #include "qemu/error-report.h"
@ -348,7 +530,7 @@ index 33e0c8724c..9d01663f43 100644
 static void spapr_reset_vcpu(PowerPCCPU *cpu)
 {
-@@ -261,6 +262,7 @@ static bool spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
+@@ -250,6 +251,7 @@ static bool spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
 {
     CPUPPCState *env = &cpu->env;
     CPUState *cs = CPU(cpu);
@ -356,9 +538,9 @@ index 33e0c8724c..9d01663f43 100644
     if (!qdev_realize(DEVICE(cpu), NULL, errp)) {
         return false;
-@@ -277,6 +279,17 @@ static bool spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
+@@ -261,6 +263,17 @@ static bool spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
-     /* Set time-base frequency to 512 MHz. vhyp must be set first. */
+     cpu_ppc_set_vhyp(cpu, PPC_VIRTUAL_HYPERVISOR(spapr));
-     cpu_ppc_tb_init(env, SPAPR_TIMEBASE_FREQ);
+     kvmppc_set_papr(cpu);
 +    if (!smc->has_power9_support &&
 +        (((spapr->max_compat_pvr &&
@ -375,7 +557,7 @@ index 33e0c8724c..9d01663f43 100644
         qdev_unrealize(DEVICE(cpu));
         return false;
 diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
-index e91791a1a9..1951d8a2a0 100644
+index ee7504b976..37a014d59c 100644
 --- a/include/hw/ppc/spapr.h
 +++ b/include/hw/ppc/spapr.h
@@ -154,6 +154,7 @@ struct SpaprMachineClass {
@ -386,18 +568,18 @@ index e91791a1a9..1951d8a2a0 100644
     bool (*phb_placement)(SpaprMachineState *spapr, uint32_t index,
                           uint64_t *buid, hwaddr *pio,
                           hwaddr *mmio32, hwaddr *mmio64,
-@@ -256,6 +257,9 @@ struct SpaprMachineState {
+@@ -237,6 +238,9 @@ struct SpaprMachineState {
     /* Set by -boot */
     char *boot_device;
- 
+ 
 +    /* Secure Guest support via x-svm-allowed */
 +    bool svm_allowed;
-+
+ 
     /*< public >*/
     char *kvm_type;
     char *host_model;
 diff --git a/target/ppc/compat.c b/target/ppc/compat.c
-index ebef2cccec..ff2c00c60e 100644
+index 7949a24f5a..f207a9ba01 100644
 --- a/target/ppc/compat.c
 +++ b/target/ppc/compat.c
@@ -114,8 +114,19 @@ static const CompatInfo *compat_by_pvr(uint32_t pvr)
@ -421,23 +603,11 @@ index ebef2cccec..ff2c00c60e 100644
 {
     const CompatInfo *compat = compat_by_pvr(compat_pvr);
     const CompatInfo *min = compat_by_pvr(min_compat_pvr);
 diff --git a/target/ppc/cpu-models.c b/target/ppc/cpu-models.c
 index 69fddb05bc..64a05aaef3 100644
 --- a/target/ppc/cpu-models.c
 +++ b/target/ppc/cpu-models.c
@@ -748,6 +748,7 @@
 /* PowerPC CPU aliases                                                     */
 PowerPCCPUAlias ppc_cpu_aliases[] = {
 +#if 0  /* Disabled for Red Hat Enterprise Linux */
     { "405", "405d4" },
     { "405cr", "405crc" },
     { "405gp", "405gpd" },
 diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
-index f8101ffa29..e799a2bee6 100644
+index e946da5f3a..23e8b76c85 100644
 --- a/target/ppc/cpu.h
 +++ b/target/ppc/cpu.h
-@@ -1635,6 +1635,7 @@ static inline int cpu_mmu_index(CPUPPCState *env, bool ifetch)
+@@ -1401,6 +1401,7 @@ static inline int cpu_mmu_index(CPUPPCState *env, bool ifetch)
 /* Compatibility modes */
 #if defined(TARGET_PPC64)
@ -446,18 +616,18 @@ index f8101ffa29..e799a2bee6 100644
                       uint32_t min_compat_pvr, uint32_t max_compat_pvr);
 bool ppc_type_check_compat(const char *cputype, uint32_t compat_pvr,
 diff --git a/target/ppc/kvm.c b/target/ppc/kvm.c
-index 9b1abe2fc4..56f1c46e8e 100644
+index dc93b99189..154888cce5 100644
 --- a/target/ppc/kvm.c
 +++ b/target/ppc/kvm.c
-@@ -89,6 +89,7 @@ static int cap_large_decr;
+@@ -90,6 +90,7 @@ static int cap_ppc_nested_kvm_hv;
 static int cap_large_decr;
 static int cap_fwnmi;
 static int cap_rpt_invalidate;
 static int cap_ail_mode_3;
 +static int cap_ppc_secure_guest;
 static uint32_t debug_inst_opcode;
-@@ -141,6 +142,7 @@ int kvm_arch_init(MachineState *ms, KVMState *s)
+@@ -137,6 +138,7 @@ int kvm_arch_init(MachineState *ms, KVMState *s)
     cap_resize_hpt = kvm_vm_check_extension(s, KVM_CAP_SPAPR_RESIZE_HPT);
     kvmppc_get_cpu_characteristics(s);
     cap_ppc_nested_kvm_hv = kvm_vm_check_extension(s, KVM_CAP_PPC_NESTED_HV);
@ -465,8 +635,8 @@ index 9b1abe2fc4..56f1c46e8e 100644
     cap_large_decr = kvmppc_get_dec_bits();
     cap_fwnmi = kvm_vm_check_extension(s, KVM_CAP_PPC_FWNMI);
     /*
-@@ -2579,6 +2581,16 @@ bool kvmppc_supports_ail_3(void)
+@@ -2563,6 +2565,16 @@ int kvmppc_has_cap_rpt_invalidate(void)
-     return cap_ail_mode_3;
+     return cap_rpt_invalidate;
 }
 +bool kvmppc_has_cap_secure_guest(void)
@ -482,9 +652,9 @@ index 9b1abe2fc4..56f1c46e8e 100644
 PowerPCCPUClass *kvm_ppc_get_host_cpu_class(void)
 {
     uint32_t host_pvr = mfpvr();
-@@ -2979,3 +2991,18 @@ bool kvm_arch_cpu_check_are_resettable(void)
+@@ -2959,3 +2971,18 @@ bool kvm_arch_cpu_check_are_resettable(void)
 void kvm_arch_accel_class_init(ObjectClass *oc)
 {
     return true;
 }
 +
 +void kvmppc_svm_allow(Error **errp)
@ -502,27 +672,27 @@ index 9b1abe2fc4..56f1c46e8e 100644
 +    }
 +}
 diff --git a/target/ppc/kvm_ppc.h b/target/ppc/kvm_ppc.h
-index 1975fb5ee6..d1017f98be 100644
+index ee9325bf9a..20dbb95989 100644
 --- a/target/ppc/kvm_ppc.h
 +++ b/target/ppc/kvm_ppc.h
-@@ -46,6 +46,7 @@ int kvmppc_booke_watchdog_enable(PowerPCCPU *cpu);
+@@ -40,6 +40,7 @@ int kvmppc_booke_watchdog_enable(PowerPCCPU *cpu);
 target_ulong kvmppc_configure_v3_mmu(PowerPCCPU *cpu,
                                      bool radix, bool gtse,
                                      uint64_t proc_tbl);
 +void kvmppc_svm_allow(Error **errp);
 #ifndef CONFIG_USER_ONLY
 bool kvmppc_spapr_use_multitce(void);
 int kvmppc_spapr_enable_inkernel_multitce(void);
- void *kvmppc_create_spapr_tce(uint32_t liobn, uint32_t page_shift,
+@@ -74,6 +75,8 @@ int kvmppc_get_cap_large_decr(void);
-@@ -79,6 +80,8 @@ int kvmppc_enable_cap_large_decr(PowerPCCPU *cpu, int enable);
+ int kvmppc_enable_cap_large_decr(PowerPCCPU *cpu, int enable);
 int kvmppc_has_cap_rpt_invalidate(void);
 bool kvmppc_supports_ail_3(void);
 int kvmppc_enable_hwrng(void);
 +bool kvmppc_has_cap_secure_guest(void);
 +int kvmppc_enable_cap_secure_guest(void);
 int kvmppc_put_books_sregs(PowerPCCPU *cpu);
 PowerPCCPUClass *kvm_ppc_get_host_cpu_class(void);
 void kvmppc_check_papr_resize_hpt(Error **errp);
-@@ -427,6 +430,16 @@ static inline bool kvmppc_supports_ail_3(void)
+@@ -393,6 +396,16 @@ static inline int kvmppc_has_cap_rpt_invalidate(void)
     return false;
 }
@ -540,5 +710,5 @@ index 1975fb5ee6..d1017f98be 100644
 {
     return -1;
 -- 
-2.39.3
+2.27.0
--- a/SOURCES/0009-Add-s390x-machine-types.patch
+++ b/SOURCES/0009-Add-s390x-machine-types.patch
@ -1,308 +0,0 @@
 From 3623043d4a923bf9f541d439c76e7874cf0fa81d Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 13:47:32 +0200
 Subject: Add s390x machine types
 Adding changes to add RHEL machine types for s390x architecture.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 --
 Rebase changes (7.1.0):
 - Moved adding rhel_old_machine_deprecation variable to general machine types commit
 Merged patches (6.1.0):
 - 64a9a5c971 hw/s390x: Remove the RHEL7-only machine type
 - 395516d62b redhat: s390x: add rhel-8.5.0 compat machine
 Merged patches (6.2.0):
 - 3bf66f4520 redhat: Add s390x machine type compatibility update for 6.1 rebase
 Merged patches (7.0.0):
 - e6ff4de4f7 redhat: Add s390x machine type compatibility handling for the rebase to v6.2
 - 4b0efa7e21 redhat: Add rhel8.6.0 and rhel9.0.0 machine types for s390x
 - dcc64971bf RHEL: mark old machine types as deprecated (partialy)
 Merged patches (7.1.0):
 - 1d6439527a WRB: Introduce RHEL 9.0.0 hw compat structure (only hw/s390x/s390-virtio-ccw.c chunk)
 - c8ad21ca31 redhat: Update s390x machine type compatibility for rebase to QEMU 7.0.0
 - 5bcf8d874c target/s390x: deprecate CPUs older than z14
 Merged patches (7.2.0):
 - 0be2889fa2 Introduce upstream 7.0 compat changes (only applicable parts)
 Merged patches (8.0.0):
 - 27c188c6a4 redhat: Update s390x machine type compatibility for QEMU 7.2.0 update
 - a932b8d429 redhat: Add new rhel-9.2.0 s390x machine type
 - ac88104bad s390x/s390-virtio-ccw: Activate zPCI features on s390-ccw-virtio-rhel8.6.0
 Merged patches (8.1.0):
 - bd5d81d286 Add RHEL 9.2.0 compat structure (s390x part)
 Merged patches (8.2.0):
 - 4ee284aca9 Add machine types compat bits. (partial)
 ---
 hw/s390x/s390-virtio-ccw.c       | 159 +++++++++++++++++++++++++++++++
 target/s390x/cpu_models.c        |  11 +++
 target/s390x/cpu_models.h        |   2 +
 target/s390x/cpu_models_sysemu.c |   2 +
 4 files changed, 174 insertions(+)
 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
 index 7262725d2e..984891b82a 100644
 --- a/hw/s390x/s390-virtio-ccw.c
 +++ b/hw/s390x/s390-virtio-ccw.c
@@ -855,6 +855,7 @@ bool css_migration_enabled(void)
     }                                                                         \
     type_init(ccw_machine_register_##suffix)
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void ccw_machine_8_2_instance_options(MachineState *machine)
 {
 }
@@ -1256,6 +1257,164 @@ static void ccw_machine_2_4_class_options(MachineClass *mc)
     compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
 }
 DEFINE_CCW_MACHINE(2_4, "2.4", false);
 +#endif
 +
 +
 +static void ccw_machine_rhel940_instance_options(MachineState *machine)
 +{
 +}
 +
 +static void ccw_machine_rhel940_class_options(MachineClass *mc)
 +{
 +}
 +DEFINE_CCW_MACHINE(rhel940, "rhel9.4.0", true);
 +
 +static void ccw_machine_rhel920_instance_options(MachineState *machine)
 +{
 +    ccw_machine_rhel940_instance_options(machine);
 +}
 +
 +static void ccw_machine_rhel920_class_options(MachineClass *mc)
 +{
 +    ccw_machine_rhel940_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_4, hw_compat_rhel_9_4_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_3, hw_compat_rhel_9_3_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_2, hw_compat_rhel_9_2_len);
 +    mc->smp_props.drawers_supported = false;    /* from ccw_machine_8_1 */
 +    mc->smp_props.books_supported = false;      /* from ccw_machine_8_1 */
 +}
 +DEFINE_CCW_MACHINE(rhel920, "rhel9.2.0", false);
 +
 +static void ccw_machine_rhel900_instance_options(MachineState *machine)
 +{
 +    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V6_2 };
 +
 +    ccw_machine_rhel920_instance_options(machine);
 +
 +    s390_set_qemu_cpu_model(0x3906, 14, 2, qemu_cpu_feat);
 +    s390_cpudef_featoff_greater(16, 1, S390_FEAT_PAIE);
 +}
 +
 +static void ccw_machine_rhel900_class_options(MachineClass *mc)
 +{
 +    S390CcwMachineClass *s390mc = S390_CCW_MACHINE_CLASS(mc);
 +    static GlobalProperty compat[] = {
 +        { TYPE_S390_PCI_DEVICE, "interpret", "off", },
 +        { TYPE_S390_PCI_DEVICE, "forwarding-assist", "off", },
 +    };
 +
 +    ccw_machine_rhel920_class_options(mc);
 +
 +    compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_1, hw_compat_rhel_9_1_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_0, hw_compat_rhel_9_0_len);
 +    s390mc->max_threads = S390_MAX_CPUS;
 +}
 +DEFINE_CCW_MACHINE(rhel900, "rhel9.0.0", false);
 +
 +static void ccw_machine_rhel860_instance_options(MachineState *machine)
 +{
 +    /* Note: The -rhel8.6.0 and -rhel9.0.0 machines are technically identical */
 +    ccw_machine_rhel900_instance_options(machine);
 +}
 +
 +static void ccw_machine_rhel860_class_options(MachineClass *mc)
 +{
 +    static GlobalProperty compat[] = {
 +        { TYPE_S390_PCI_DEVICE, "interpret", "on", },
 +        { TYPE_S390_PCI_DEVICE, "forwarding-assist", "on", },
 +    };
 +
 +    ccw_machine_rhel900_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_6, hw_compat_rhel_8_6_len);
 +    compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
 +
 +    /* All RHEL machines for prior major releases are deprecated */
 +    mc->deprecation_reason = rhel_old_machine_deprecation;
 +}
 +DEFINE_CCW_MACHINE(rhel860, "rhel8.6.0", false);
 +
 +static void ccw_machine_rhel850_instance_options(MachineState *machine)
 +{
 +    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V6_0 };
 +
 +    ccw_machine_rhel860_instance_options(machine);
 +
 +    s390_set_qemu_cpu_model(0x2964, 13, 2, qemu_cpu_feat);
 +
 +    s390_cpudef_featoff_greater(16, 1, S390_FEAT_NNPA);
 +    s390_cpudef_featoff_greater(16, 1, S390_FEAT_VECTOR_PACKED_DECIMAL_ENH2);
 +    s390_cpudef_featoff_greater(16, 1, S390_FEAT_BEAR_ENH);
 +    s390_cpudef_featoff_greater(16, 1, S390_FEAT_RDP);
 +    s390_cpudef_featoff_greater(16, 1, S390_FEAT_PAI);
 +}
 +
 +static void ccw_machine_rhel850_class_options(MachineClass *mc)
 +{
 +    static GlobalProperty compat[] = {
 +        { TYPE_S390_PCI_DEVICE, "interpret", "off", },
 +        { TYPE_S390_PCI_DEVICE, "forwarding-assist", "off", },
 +    };
 +
 +    ccw_machine_rhel860_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_5, hw_compat_rhel_8_5_len);
 +    compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
 +    mc->smp_props.prefer_sockets = true;
 +}
 +DEFINE_CCW_MACHINE(rhel850, "rhel8.5.0", false);
 +
 +static void ccw_machine_rhel840_instance_options(MachineState *machine)
 +{
 +    ccw_machine_rhel850_instance_options(machine);
 +}
 +
 +static void ccw_machine_rhel840_class_options(MachineClass *mc)
 +{
 +    ccw_machine_rhel850_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_4, hw_compat_rhel_8_4_len);
 +}
 +DEFINE_CCW_MACHINE(rhel840, "rhel8.4.0", false);
 +
 +static void ccw_machine_rhel820_instance_options(MachineState *machine)
 +{
 +    ccw_machine_rhel840_instance_options(machine);
 +}
 +
 +static void ccw_machine_rhel820_class_options(MachineClass *mc)
 +{
 +    ccw_machine_rhel840_class_options(mc);
 +    mc->fixup_ram_size = s390_fixup_ram_size;
 +    /* we did not publish a rhel8.3.0 machine */
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_3, hw_compat_rhel_8_3_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_2, hw_compat_rhel_8_2_len);
 +}
 +DEFINE_CCW_MACHINE(rhel820, "rhel8.2.0", false);
 +
 +static void ccw_machine_rhel760_instance_options(MachineState *machine)
 +{
 +    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V3_1 };
 +
 +    ccw_machine_rhel820_instance_options(machine);
 +
 +    s390_set_qemu_cpu_model(0x2827, 12, 2, qemu_cpu_feat);
 +
 +    /* The multiple-epoch facility was not available with rhel7.6.0 on z14GA1 */
 +    s390_cpudef_featoff(14, 1, S390_FEAT_MULTIPLE_EPOCH);
 +    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_QSIE);
 +    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_QTOUE);
 +    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_STOE);
 +    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_STOUE);
 +}
 +
 +static void ccw_machine_rhel760_class_options(MachineClass *mc)
 +{
 +    ccw_machine_rhel820_class_options(mc);
 +    /* We never published the s390x version of RHEL-AV 8.0 and 8.1, so add this here */
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_1, hw_compat_rhel_8_1_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_0, hw_compat_rhel_8_0_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_7_6, hw_compat_rhel_7_6_len);
 +}
 +DEFINE_CCW_MACHINE(rhel760, "rhel7.6.0", false);
 static void ccw_machine_register_types(void)
 {
 diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c
 index a63d990e4e..198b81f2c0 100644
 --- a/target/s390x/cpu_models.c
 +++ b/target/s390x/cpu_models.c
@@ -46,6 +46,9 @@
  * of a following release have been a superset of the previous release. With
  * generation 15 one base feature and one optional feature have been deprecated.
  */
 +
 +#define RHEL_CPU_DEPRECATION "use at least 'z14', or 'host' / 'qemu' / 'max'"
 +
 static S390CPUDef s390_cpu_defs[] = {
     CPUDEF_INIT(0x2064, 7, 1, 38, 0x00000000U, "z900", "IBM zSeries 900 GA1"),
     CPUDEF_INIT(0x2064, 7, 2, 38, 0x00000000U, "z900.2", "IBM zSeries 900 GA2"),
@@ -856,22 +859,30 @@ static void s390_host_cpu_model_class_init(ObjectClass *oc, void *data)
 static void s390_base_cpu_model_class_init(ObjectClass *oc, void *data)
 {
     S390CPUClass *xcc = S390_CPU_CLASS(oc);
 +    CPUClass *cc = CPU_CLASS(oc);
     /* all base models are migration safe */
     xcc->cpu_def = (const S390CPUDef *) data;
     xcc->is_migration_safe = true;
     xcc->is_static = true;
     xcc->desc = xcc->cpu_def->desc;
 +    if (xcc->cpu_def->gen < 14) {
 +        cc->deprecation_note = RHEL_CPU_DEPRECATION;
 +    }
 }
 static void s390_cpu_model_class_init(ObjectClass *oc, void *data)
 {
     S390CPUClass *xcc = S390_CPU_CLASS(oc);
 +    CPUClass *cc = CPU_CLASS(oc);
     /* model that can change between QEMU versions */
     xcc->cpu_def = (const S390CPUDef *) data;
     xcc->is_migration_safe = true;
     xcc->desc = xcc->cpu_def->desc;
 +    if (xcc->cpu_def->gen < 14) {
 +        cc->deprecation_note = RHEL_CPU_DEPRECATION;
 +    }
 }
 static void s390_qemu_cpu_model_class_init(ObjectClass *oc, void *data)
 diff --git a/target/s390x/cpu_models.h b/target/s390x/cpu_models.h
 index d7b8912989..1a806a97c4 100644
 --- a/target/s390x/cpu_models.h
 +++ b/target/s390x/cpu_models.h
@@ -38,6 +38,8 @@ typedef struct S390CPUDef {
     S390FeatBitmap full_feat;
     /* used to init full_feat from generated data */
     S390FeatInit full_init;
 +    /* if deprecated, provides a suggestion */
 +    const char *deprecation_note;
 } S390CPUDef;
 /* CPU model based on a CPU definition */
 diff --git a/target/s390x/cpu_models_sysemu.c b/target/s390x/cpu_models_sysemu.c
 index 87a4480c05..28c1b0486c 100644
 --- a/target/s390x/cpu_models_sysemu.c
 +++ b/target/s390x/cpu_models_sysemu.c
@@ -60,6 +60,7 @@ static void create_cpu_model_list(ObjectClass *klass, void *opaque)
     CpuDefinitionInfo *info;
     char *name = g_strdup(object_class_get_name(klass));
     S390CPUClass *scc = S390_CPU_CLASS(klass);
 +    CPUClass *cc = CPU_CLASS(klass);
     /* strip off the -s390x-cpu */
     g_strrstr(name, "-" TYPE_S390_CPU)[0] = 0;
@@ -69,6 +70,7 @@ static void create_cpu_model_list(ObjectClass *klass, void *opaque)
     info->migration_safe = scc->is_migration_safe;
     info->q_static = scc->is_static;
     info->q_typename = g_strdup(object_class_get_name(klass));
 +    info->deprecated = !!cc->deprecation_note;
     /* check for unavailable features */
     if (cpu_list_data->model) {
         Object *obj;
 -- 
 2.39.3
--- a/SOURCES/0010-Add-s390x-machine-types.patch
+++ b/SOURCES/0010-Add-s390x-machine-types.patch
@ -0,0 +1,165 @@
 From 4ad9a0d0582eef78946b47563eb2c5b7ddf0cbb0 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 13:47:32 +0200
 Subject: Add s390x machine types
 Adding changes to add RHEL machine types for s390x architecture.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 Rebase changes (weekly-4.1.0):
 - Use upstream compat handling
 Rebase notes (weekly-210303):
 - Use rhel-8.4.0 hw compat
 Merged patches (3.1.0):
 - 29df663 s390x/cpumodel: default enable bpb and ppa15 for z196 and later
 Merged patches (4.1.0):
 - 6c200d665b hw/s390x/s390-virtio-ccw: Add machine types for RHEL8.0.0
 Merged patches (4.2.0):
 - fb192e5 redhat: s390x: Rename s390-ccw-virtio-rhel8.0.0 to s390-ccw-virtio-rhel8.1.0
 - a9b22e8 redhat: s390x: Add proper compatibility options for the -rhel7.6.0 machine
 - hw/s390x: Add the s390-ccw-virtio-rhel8.2.0 machine types (patch 92954)
 Merged patches (weekly-201216):
 - a6ae745cce redhat: s390x: add rhel-8.4.0 compat machine
 Merged patches (weekly-210602):
 - 50835d3429 redhat: s390x: add rhel-8.5.0 compat machine
 Merged patches (weekly-211006):
 - a3bcde27fe redhat: Add s390x machine type compatibility update for 6.1 rebase
 ---
 hw/s390x/s390-virtio-ccw.c | 99 +++++++++++++++++++++++++++++++++++++-
 1 file changed, 98 insertions(+), 1 deletion(-)
 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
 index 653587ea62..181856e6cf 100644
 --- a/hw/s390x/s390-virtio-ccw.c
 +++ b/hw/s390x/s390-virtio-ccw.c
@@ -767,7 +767,7 @@ bool css_migration_enabled(void)
     {                                                                         \
         MachineClass *mc = MACHINE_CLASS(oc);                                 \
         ccw_machine_##suffix##_class_options(mc);                             \
 -        mc->desc = "VirtIO-ccw based S390 machine v" verstr;                  \
 +        mc->desc = "VirtIO-ccw based S390 machine " verstr;                   \
         if (latest) {                                                         \
             mc->alias = "s390-ccw-virtio";                                    \
             mc->is_default = true;                                            \
@@ -791,6 +791,7 @@ bool css_migration_enabled(void)
     }                                                                         \
     type_init(ccw_machine_register_##suffix)
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void ccw_machine_6_2_instance_options(MachineState *machine)
 {
 }
@@ -1100,6 +1101,102 @@ static void ccw_machine_2_4_class_options(MachineClass *mc)
     compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
 }
 DEFINE_CCW_MACHINE(2_4, "2.4", false);
 +#endif
 +
 +static void ccw_machine_rhel850_instance_options(MachineState *machine)
 +{
 +}
 +
 +static void ccw_machine_rhel850_class_options(MachineClass *mc)
 +{
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_5, hw_compat_rhel_8_5_len);
 +}
 +DEFINE_CCW_MACHINE(rhel850, "rhel8.5.0", true);
 +
 +static void ccw_machine_rhel840_instance_options(MachineState *machine)
 +{
 +    ccw_machine_rhel850_instance_options(machine);
 +}
 +
 +static void ccw_machine_rhel840_class_options(MachineClass *mc)
 +{
 +    ccw_machine_rhel850_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_4, hw_compat_rhel_8_4_len);
 +}
 +DEFINE_CCW_MACHINE(rhel840, "rhel8.4.0", false);
 +
 +static void ccw_machine_rhel820_instance_options(MachineState *machine)
 +{
 +    ccw_machine_rhel840_instance_options(machine);
 +}
 +
 +static void ccw_machine_rhel820_class_options(MachineClass *mc)
 +{
 +    ccw_machine_rhel840_class_options(mc);
 +    mc->fixup_ram_size = s390_fixup_ram_size;
 +    /* we did not publish a rhel8.3.0 machine */
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_3, hw_compat_rhel_8_3_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_2, hw_compat_rhel_8_2_len);
 +}
 +DEFINE_CCW_MACHINE(rhel820, "rhel8.2.0", false);
 +
 +static void ccw_machine_rhel760_instance_options(MachineState *machine)
 +{
 +    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V3_1 };
 +
 +    ccw_machine_rhel820_instance_options(machine);
 +
 +    s390_set_qemu_cpu_model(0x2827, 12, 2, qemu_cpu_feat);
 +
 +    /* The multiple-epoch facility was not available with rhel7.6.0 on z14GA1 */
 +    s390_cpudef_featoff(14, 1, S390_FEAT_MULTIPLE_EPOCH);
 +    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_QSIE);
 +    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_QTOUE);
 +    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_STOE);
 +    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_STOUE);
 +}
 +
 +static void ccw_machine_rhel760_class_options(MachineClass *mc)
 +{
 +    ccw_machine_rhel820_class_options(mc);
 +    /* We never published the s390x version of RHEL-AV 8.0 and 8.1, so add this here */
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_1, hw_compat_rhel_8_1_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_0, hw_compat_rhel_8_0_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_7_6, hw_compat_rhel_7_6_len);
 +}
 +DEFINE_CCW_MACHINE(rhel760, "rhel7.6.0", false);
 +
 +static void ccw_machine_rhel750_instance_options(MachineState *machine)
 +{
 +    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V2_11 };
 +    ccw_machine_rhel760_instance_options(machine);
 +
 +    /* before 2.12 we emulated the very first z900, and RHEL 7.5 is
 +       based on 2.10 */
 +    s390_set_qemu_cpu_model(0x2064, 7, 1, qemu_cpu_feat);
 +
 +    /* bpb and ppa15 were only in the full model in RHEL 7.5 */
 +    s390_cpudef_featoff_greater(11, 1, S390_FEAT_PPA15);
 +    s390_cpudef_featoff_greater(11, 1, S390_FEAT_BPB);
 +}
 +
 +GlobalProperty ccw_compat_rhel_7_5[] = {
 +        {
 +            .driver   = TYPE_SCLP_EVENT_FACILITY,
 +            .property = "allow_all_mask_sizes",
 +            .value    = "off",
 +        },
 +};
 +const size_t ccw_compat_rhel_7_5_len = G_N_ELEMENTS(ccw_compat_rhel_7_5);
 +
 +static void ccw_machine_rhel750_class_options(MachineClass *mc)
 +{
 +    ccw_machine_rhel760_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_7_5, hw_compat_rhel_7_5_len);
 +    compat_props_add(mc->compat_props, ccw_compat_rhel_7_5, ccw_compat_rhel_7_5_len);
 +    S390_CCW_MACHINE_CLASS(mc)->hpage_1m_allowed = false;
 +}
 +DEFINE_CCW_MACHINE(rhel750, "rhel7.5.0", false);
 static void ccw_machine_register_types(void)
 {
 -- 
 2.27.0
--- a/SOURCES/0010-Add-x86_64-machine-types.patch
+++ b/SOURCES/0010-Add-x86_64-machine-types.patch
@ -1,974 +0,0 @@
 From b432505cb28bc3b9b0c1849210ac6c63bca3fe37 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 13:10:31 +0200
 Subject: Add x86_64 machine types
 Adding changes to add RHEL machine types for x86_64 architecture.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 Rebase notes (6.1.0):
 - Update qemu64 cpu spec
 Rebase notes (7.0.0):
 - Reset alias for all machine-types except latest one
 Rebase notes (8.0.0):
 - remove legacy_no_rng_seed usage (removed upstream)
 Rebase notes (8.1.0):
 - default_nic_model to default_nic
 Merged patches (6.1.0):
 - 59c284ad3b x86: Add x86 rhel8.5 machine types
 - a8868b42fe redhat: x86: Enable 'kvm-asyncpf-int' by default
 - a3995e2eff Remove RHEL 7.0.0 machine type (only x86_64 changes)
 - ad3190a79b Remove RHEL 7.1.0 machine type (only x86_64 changes)
 - 84bbe15d4e Remove RHEL 7.2.0 machine type (only x86_64 changes)
 - 0215eb3356 Remove RHEL 7.3.0 machine types (only x86_64 changes)
 - af69d1ca6e Remove RHEL 7.4.0 machine types (only x86_64 changes)
 - 8f7a74ab78 Remove RHEL 7.5.0 machine types (only x86_64 changes)
 Merged patches (7.0.0):
 - eae7d8dd3c x86/rhel machine types: Add pc_rhel_8_5_compat
 - 6762f56469 x86/rhel machine types: Wire compat into q35 and i440fx
 - 5762101438 rhel machine types/x86: set prefer_sockets
 - 9ba9ddc632 x86: Add q35 RHEL 8.6.0 machine type
 - 6110d865e5 x86: Add q35 RHEL 9.0.0 machine type
 - dcc64971bf RHEL: mark old machine types as deprecated (partialy)
 - 6b396f182b RHEL: disable "seqpacket" for "vhost-vsock-device" in rhel8.6.0
 Merged patches (7.1.0):
 -  38b89dc245 pc: Move s3/s4 suspend disabling to compat (only hw/i386/pc.c chunk)
 -  1d6439527a WRB: Introduce RHEL 9.0.0 hw compat structure (x86_64 specific changes)
 - 35b5c8554f target/i386: deprecate CPUs older than x86_64-v2 ABI
 Merged patches (7.2.0):
 - 0be2889fa2 Introduce upstream 7.0 compat changes (only applicable parts)
 Merged patches (8.0.0):
 - f33ca8aed4 x86: rhel 9.2.0 machine type
 Merged patches (8.1.0):
 - bd5d81d286 Add RHEL 9.2.0 compat structure (x86_64 part)
 - c6eaf73add redhat: hw/i386/pc: Update x86 machine type compatibility for QEMU 8.0.0 update
 - 6cbf496e5e hw/acpi: Mark acpi blobs as resizable on RHEL pc machines version 7.6 and above
 Merged patches (8.2.0):
 - 4ee284aca9 Add machine types compat bits. (partial)
 - 719e2ac147 Fix x86 machine type compatibility for qemu-kvm 8.1.0
 ---
 hw/i386/pc.c               | 159 ++++++++++++++++++++-
 hw/i386/pc_piix.c          | 112 ++++++++++++++-
 hw/i386/pc_q35.c           | 285 ++++++++++++++++++++++++++++++++++++-
 include/hw/boards.h        |   2 +
 include/hw/i386/pc.h       |  33 +++++
 target/i386/cpu.c          |  21 +++
 target/i386/kvm/kvm-cpu.c  |   1 +
 target/i386/kvm/kvm.c      |   4 +
 tests/qtest/pvpanic-test.c |   5 +-
 9 files changed, 615 insertions(+), 7 deletions(-)
 diff --git a/hw/i386/pc.c b/hw/i386/pc.c
 index 29b9964733..a1faa9e92c 100644
 --- a/hw/i386/pc.c
 +++ b/hw/i386/pc.c
@@ -323,6 +323,161 @@ GlobalProperty pc_compat_2_0[] = {
 };
 const size_t pc_compat_2_0_len = G_N_ELEMENTS(pc_compat_2_0);
 +/* This macro is for changes to properties that are RHEL specific,
 + * different to the current upstream and to be applied to the latest
 + * machine type.
 + */
 +GlobalProperty pc_rhel_compat[] = {
 +    /* we don't support s3/s4 suspend */
 +    { "PIIX4_PM", "disable_s3", "1" },
 +    { "PIIX4_PM", "disable_s4", "1" },
 +    { "ICH9-LPC", "disable_s3", "1" },
 +    { "ICH9-LPC", "disable_s4", "1" },
 +
 +    { TYPE_X86_CPU, "host-phys-bits", "on" },
 +    { TYPE_X86_CPU, "host-phys-bits-limit", "48" },
 +    { TYPE_X86_CPU, "vmx-entry-load-perf-global-ctrl", "off" },
 +    { TYPE_X86_CPU, "vmx-exit-load-perf-global-ctrl", "off" },
 +    /* bz 1508330 */
 +    { "vfio-pci", "x-no-geforce-quirks", "on" },
 +    /* bz 1941397 */
 +    { TYPE_X86_CPU, "kvm-asyncpf-int", "on" },
 +};
 +const size_t pc_rhel_compat_len = G_N_ELEMENTS(pc_rhel_compat);
 +
 +GlobalProperty pc_rhel_9_3_compat[] = {
 +    /* pc_rhel_9_3_compat from pc_compat_8_0 */
 +    { "virtio-mem", "unplugged-inaccessible", "auto" },
 +};
 +const size_t pc_rhel_9_3_compat_len = G_N_ELEMENTS(pc_rhel_9_3_compat);
 +
 +GlobalProperty pc_rhel_9_2_compat[] = {
 +    /* pc_rhel_9_2_compat from pc_compat_7_2 */
 +    { "ICH9-LPC", "noreboot", "true" },
 +};
 +const size_t pc_rhel_9_2_compat_len = G_N_ELEMENTS(pc_rhel_9_2_compat);
 +
 +GlobalProperty pc_rhel_9_0_compat[] = {
 +    /* pc_rhel_9_0_compat from pc_compat_6_2 */
 +    { "virtio-mem", "unplugged-inaccessible", "off" },
 +};
 +const size_t pc_rhel_9_0_compat_len = G_N_ELEMENTS(pc_rhel_9_0_compat);
 +
 +GlobalProperty pc_rhel_8_5_compat[] = {
 +    /* pc_rhel_8_5_compat from pc_compat_6_0 */
 +    { "qemu64" "-" TYPE_X86_CPU, "family", "6" },
 +    /* pc_rhel_8_5_compat from pc_compat_6_0 */
 +    { "qemu64" "-" TYPE_X86_CPU, "model", "6" },
 +    /* pc_rhel_8_5_compat from pc_compat_6_0 */
 +    { "qemu64" "-" TYPE_X86_CPU, "stepping", "3" },
 +    /* pc_rhel_8_5_compat from pc_compat_6_0 */
 +    { TYPE_X86_CPU, "x-vendor-cpuid-only", "off" },
 +    /* pc_rhel_8_5_compat from pc_compat_6_0 */
 +    { "ICH9-LPC", ACPI_PM_PROP_ACPI_PCIHP_BRIDGE, "off" },
 +
 +    /* pc_rhel_8_5_compat from pc_compat_6_1 */
 +    { TYPE_X86_CPU, "hv-version-id-build", "0x1bbc" },
 +    /* pc_rhel_8_5_compat from pc_compat_6_1 */
 +    { TYPE_X86_CPU, "hv-version-id-major", "0x0006" },
 +    /* pc_rhel_8_5_compat from pc_compat_6_1 */
 +    { TYPE_X86_CPU, "hv-version-id-minor", "0x0001" },
 +};
 +const size_t pc_rhel_8_5_compat_len = G_N_ELEMENTS(pc_rhel_8_5_compat);
 +
 +GlobalProperty pc_rhel_8_4_compat[] = {
 +    /* pc_rhel_8_4_compat from pc_compat_5_2 */
 +    { "ICH9-LPC", "x-smi-cpu-hotunplug", "off" },
 +    { TYPE_X86_CPU, "kvm-asyncpf-int", "off" },
 +};
 +const size_t pc_rhel_8_4_compat_len = G_N_ELEMENTS(pc_rhel_8_4_compat);
 +
 +GlobalProperty pc_rhel_8_3_compat[] = {
 +    /* pc_rhel_8_3_compat from pc_compat_5_1 */
 +    { "ICH9-LPC", "x-smi-cpu-hotplug", "off" },
 +};
 +const size_t pc_rhel_8_3_compat_len = G_N_ELEMENTS(pc_rhel_8_3_compat);
 +
 +GlobalProperty pc_rhel_8_2_compat[] = {
 +    /* pc_rhel_8_2_compat from pc_compat_4_2 */
 +    { "mch", "smbase-smram", "off" },
 +};
 +const size_t pc_rhel_8_2_compat_len = G_N_ELEMENTS(pc_rhel_8_2_compat);
 +
 +/* pc_rhel_8_1_compat is empty since pc_4_1_compat is */
 +GlobalProperty pc_rhel_8_1_compat[] = { };
 +const size_t pc_rhel_8_1_compat_len = G_N_ELEMENTS(pc_rhel_8_1_compat);
 +
 +GlobalProperty pc_rhel_8_0_compat[] = {
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "intel-iommu", "dma-drain", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "Opteron_G3" "-" TYPE_X86_CPU, "rdtscp", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "Opteron_G4" "-" TYPE_X86_CPU, "rdtscp", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "Opteron_G4" "-" TYPE_X86_CPU, "npt", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "Opteron_G4" "-" TYPE_X86_CPU, "nrip-save", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "Opteron_G5" "-" TYPE_X86_CPU, "rdtscp", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "Opteron_G5" "-" TYPE_X86_CPU, "npt", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "Opteron_G5" "-" TYPE_X86_CPU, "nrip-save", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "EPYC" "-" TYPE_X86_CPU, "npt", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "EPYC" "-" TYPE_X86_CPU, "nrip-save", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "EPYC-IBPB" "-" TYPE_X86_CPU, "npt", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "EPYC-IBPB" "-" TYPE_X86_CPU, "nrip-save", "off" },
 +    /** The mpx=on entries from pc_compat_3_1 are in pc_rhel_7_6_compat **/
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "Cascadelake-Server" "-" TYPE_X86_CPU, "stepping", "5" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { TYPE_X86_CPU, "x-intel-pt-auto-level", "off" },
 +};
 +const size_t pc_rhel_8_0_compat_len = G_N_ELEMENTS(pc_rhel_8_0_compat);
 +
 +/* Similar to PC_COMPAT_3_0 + PC_COMPAT_2_12, but:
 + * all of the 2_12 stuff was already in 7.6 from bz 1481253
 + * x-migrate-smi-count comes from PC_COMPAT_2_11 but
 + * is really tied to kernel version so keep it off on 7.x
 + * machine types irrespective of host.
 + */
 +GlobalProperty pc_rhel_7_6_compat[] = {
 +    /* pc_rhel_7_6_compat from pc_compat_3_0 */
 +    { TYPE_X86_CPU, "x-hv-synic-kvm-only", "on" },
 +    /* pc_rhel_7_6_compat from pc_compat_3_0 */
 +    { "Skylake-Server" "-" TYPE_X86_CPU, "pku", "off" },
 +    /* pc_rhel_7_6_compat from pc_compat_3_0 */
 +    { "Skylake-Server-IBRS" "-" TYPE_X86_CPU, "pku", "off" },
 +    /* pc_rhel_7_6_compat from pc_compat_2_11 */
 +    { TYPE_X86_CPU, "x-migrate-smi-count", "off" },
 +    /* pc_rhel_7_6_compat from pc_compat_2_11 */
 +    { "Skylake-Client" "-" TYPE_X86_CPU, "mpx", "on" },
 +    /* pc_rhel_7_6_compat from pc_compat_2_11 */
 +    { "Skylake-Client-IBRS" "-" TYPE_X86_CPU, "mpx", "on" },
 +    /* pc_rhel_7_6_compat from pc_compat_2_11 */
 +    { "Skylake-Server" "-" TYPE_X86_CPU, "mpx", "on" },
 +    /* pc_rhel_7_6_compat from pc_compat_2_11 */
 +    { "Skylake-Server-IBRS" "-" TYPE_X86_CPU, "mpx", "on" },
 +    /* pc_rhel_7_6_compat from pc_compat_2_11 */
 +    { "Cascadelake-Server" "-" TYPE_X86_CPU, "mpx", "on" },
 +    /* pc_rhel_7_6_compat from pc_compat_2_11 */
 +    { "Icelake-Client" "-" TYPE_X86_CPU, "mpx", "on" },
 +    /* pc_rhel_7_6_compat from pc_compat_2_11 */
 +    { "Icelake-Server" "-" TYPE_X86_CPU, "mpx", "on" },
 +};
 +const size_t pc_rhel_7_6_compat_len = G_N_ELEMENTS(pc_rhel_7_6_compat);
 +
 +/*
 + * The PC_RHEL_*_COMPAT serve the same purpose for RHEL-7 machine
 + * types as the PC_COMPAT_* do for upstream types.
 + * PC_RHEL_7_*_COMPAT apply both to i440fx and q35 types.
 + */
 +
 GSIState *pc_gsi_create(qemu_irq **irqs, bool pci_enabled)
 {
     GSIState *s;
@@ -1826,6 +1981,7 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
     pcmc->kvmclock_create_always = true;
     pcmc->resizable_acpi_blob = true;
     assert(!mc->get_hotplug_handler);
 +    mc->async_pf_vmexit_disable = false;
     mc->get_hotplug_handler = pc_get_hotplug_handler;
     mc->hotplug_allowed = pc_hotplug_allowed;
     mc->cpu_index_to_instance_props = x86_cpu_index_to_props;
@@ -1836,7 +1992,8 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
     mc->has_hotpluggable_cpus = true;
     mc->default_boot_order = "cad";
     mc->block_default_type = IF_IDE;
 -    mc->max_cpus = 255;
 +    /* 240: max CPU count for RHEL */
 +    mc->max_cpus = 240;
     mc->reset = pc_machine_reset;
     mc->wakeup = pc_machine_wakeup;
     hc->pre_plug = pc_machine_device_pre_plug_cb;
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
 index 2a9f465619..44038391fb 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
@@ -53,6 +53,7 @@
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "sysemu/xen.h"
 +#include "migration/migration.h"
 #ifdef CONFIG_XEN
 #include <xen/hvm/hvm_info_table.h>
 #include "hw/xen/xen_pt.h"
@@ -235,8 +236,8 @@ static void pc_init1(MachineState *machine,
     if (pcmc->smbios_defaults) {
         MachineClass *mc = MACHINE_GET_CLASS(machine);
         /* These values are guest ABI, do not change */
 -        smbios_set_defaults("QEMU", mc->desc,
 -                            mc->name, pcmc->smbios_legacy_mode,
 +        smbios_set_defaults("Red Hat", "KVM",
 +                            mc->desc, pcmc->smbios_legacy_mode,
                             pcmc->smbios_uuid_encoded,
                             pcmc->smbios_stream_product,
                             pcmc->smbios_stream_version,
@@ -453,6 +454,7 @@ static void pc_set_south_bridge(Object *obj, int value, Error **errp)
  * hw_compat_*, pc_compat_*, or * pc_*_machine_options().
  */
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void pc_compat_2_3_fn(MachineState *machine)
 {
     X86MachineState *x86ms = X86_MACHINE(machine);
@@ -970,3 +972,109 @@ static void xenfv_3_1_machine_options(MachineClass *m)
 DEFINE_PC_MACHINE(xenfv, "xenfv-3.1", pc_xen_hvm_init,
                   xenfv_3_1_machine_options);
 #endif
 +#endif  /* Disabled for Red Hat Enterprise Linux */
 +
 +/* Red Hat Enterprise Linux machine types */
 +
 +/* Options for the latest rhel7 machine type */
 +static void pc_machine_rhel7_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    m->family = "pc_piix_Y";
 +    m->default_machine_opts = "firmware=bios-256k.bin,hpet=off";
 +    pcmc->pci_root_uid = 0;
 +    pcmc->resizable_acpi_blob = true;
 +    m->default_nic = "e1000";
 +    m->default_display = "std";
 +    m->no_parallel = 1;
 +    m->numa_mem_supported = true;
 +    m->auto_enable_numa_with_memdev = false;
 +    machine_class_allow_dynamic_sysbus_dev(m, TYPE_RAMFB_DEVICE);
 +    compat_props_add(m->compat_props, pc_rhel_compat, pc_rhel_compat_len);
 +    m->alias = "pc";
 +    m->is_default = 1;
 +    m->smp_props.prefer_sockets = true;
 +}
 +
 +static void pc_init_rhel760(MachineState *machine)
 +{
 +    pc_init1(machine, TYPE_I440FX_PCI_HOST_BRIDGE, \
 +             TYPE_I440FX_PCI_DEVICE);
 +}
 +
 +static void pc_machine_rhel760_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    ObjectClass *oc = OBJECT_CLASS(m);
 +    pc_machine_rhel7_options(m);
 +    m->desc = "RHEL 7.6.0 PC (i440FX + PIIX, 1996)";
 +    m->async_pf_vmexit_disable = true;
 +    m->smbus_no_migration_support = true;
 +
 +    /* All RHEL machines for prior major releases are deprecated */
 +    m->deprecation_reason = rhel_old_machine_deprecation;
 +
 +    pcmc->pvh_enabled = false;
 +    pcmc->default_cpu_version = CPU_VERSION_LEGACY;
 +    pcmc->kvmclock_create_always = false;
 +    /* From pc_i440fx_5_1_machine_options() */
 +    pcmc->pci_root_uid = 1;
 +    /* From pc_i440fx_7_0_machine_options() */
 +    pcmc->enforce_amd_1tb_hole = false;
 +    /* From pc_i440fx_8_0_machine_options() */
 +    pcmc->default_smbios_ep_type = SMBIOS_ENTRY_POINT_TYPE_32;
 +    /* Introduced in QEMU 8.2 */
 +    pcmc->default_south_bridge = TYPE_PIIX3_DEVICE;
 +
 +    object_class_property_add_enum(oc, "x-south-bridge", "PCSouthBridgeOption",
 +                                   &PCSouthBridgeOption_lookup,
 +                                   pc_get_south_bridge,
 +                                   pc_set_south_bridge);
 +    object_class_property_set_description(oc, "x-south-bridge",
 +                                     "Use a different south bridge than PIIX3");
 +
 +
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_4,
 +                     hw_compat_rhel_9_4_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_3,
 +                     hw_compat_rhel_9_3_len);
 +    compat_props_add(m->compat_props, pc_rhel_9_3_compat,
 +                     pc_rhel_9_3_compat_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_2,
 +                     hw_compat_rhel_9_2_len);
 +    compat_props_add(m->compat_props, pc_rhel_9_2_compat,
 +                     pc_rhel_9_2_compat_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_1,
 +                     hw_compat_rhel_9_1_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_0,
 +                     hw_compat_rhel_9_0_len);
 +    compat_props_add(m->compat_props, pc_rhel_9_0_compat,
 +                     pc_rhel_9_0_compat_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_6,
 +                     hw_compat_rhel_8_6_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_5,
 +                     hw_compat_rhel_8_5_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_5_compat,
 +                     pc_rhel_8_5_compat_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_4,
 +                     hw_compat_rhel_8_4_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_4_compat,
 +                     pc_rhel_8_4_compat_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_3,
 +                     hw_compat_rhel_8_3_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_3_compat,
 +                     pc_rhel_8_3_compat_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_2,
 +                     hw_compat_rhel_8_2_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_2_compat,
 +                     pc_rhel_8_2_compat_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_1, hw_compat_rhel_8_1_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_1_compat, pc_rhel_8_1_compat_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_0, hw_compat_rhel_8_0_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_0_compat, pc_rhel_8_0_compat_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_7_6, hw_compat_rhel_7_6_len);
 +    compat_props_add(m->compat_props, pc_rhel_7_6_compat, pc_rhel_7_6_compat_len);
 +}
 +
 +DEFINE_PC_MACHINE(rhel760, "pc-i440fx-rhel7.6.0", pc_init_rhel760,
 +                  pc_machine_rhel760_options);
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
 index 912cb0c0dc..6387df97c8 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
@@ -203,8 +203,8 @@ static void pc_q35_init(MachineState *machine)
     if (pcmc->smbios_defaults) {
         /* These values are guest ABI, do not change */
 -        smbios_set_defaults("QEMU", mc->desc,
 -                            mc->name, pcmc->smbios_legacy_mode,
 +        smbios_set_defaults("Red Hat", "KVM",
 +                            mc->desc, pcmc->smbios_legacy_mode,
                             pcmc->smbios_uuid_encoded,
                             pcmc->smbios_stream_product,
                             pcmc->smbios_stream_version,
@@ -363,6 +363,7 @@ static void pc_q35_init(MachineState *machine)
     DEFINE_PC_MACHINE(suffix, name, pc_init_##suffix, optionfn)
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void pc_q35_machine_options(MachineClass *m)
 {
     PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
@@ -699,3 +700,283 @@ static void pc_q35_2_4_machine_options(MachineClass *m)
 DEFINE_Q35_MACHINE(v2_4, "pc-q35-2.4", NULL,
                    pc_q35_2_4_machine_options);
 +#endif  /* Disabled for Red Hat Enterprise Linux */
 +
 +/* Red Hat Enterprise Linux machine types */
 +
 +/* Options for the latest rhel q35 machine type */
 +static void pc_q35_machine_rhel_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pcmc->pci_root_uid = 0;
 +    m->default_nic = "e1000e";
 +    m->family = "pc_q35_Z";
 +    m->units_per_default_bus = 1;
 +    m->default_machine_opts = "firmware=bios-256k.bin,hpet=off";
 +    m->default_display = "std";
 +    m->no_floppy = 1;
 +    m->no_parallel = 1;
 +    pcmc->default_cpu_version = 1;
 +    machine_class_allow_dynamic_sysbus_dev(m, TYPE_AMD_IOMMU_DEVICE);
 +    machine_class_allow_dynamic_sysbus_dev(m, TYPE_INTEL_IOMMU_DEVICE);
 +    machine_class_allow_dynamic_sysbus_dev(m, TYPE_RAMFB_DEVICE);
 +    m->alias = "q35";
 +    m->max_cpus = 710;
 +    compat_props_add(m->compat_props, pc_rhel_compat, pc_rhel_compat_len);
 +}
 +
 +static void pc_q35_init_rhel940(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel940_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel_options(m);
 +    m->desc = "RHEL-9.4.0 PC (Q35 + ICH9, 2009)";
 +    pcmc->smbios_stream_product = "RHEL";
 +    pcmc->smbios_stream_version = "9.4.0";
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel940, "pc-q35-rhel9.4.0", pc_q35_init_rhel940,
 +                  pc_q35_machine_rhel940_options);
 +
 +
 +static void pc_q35_init_rhel920(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel920_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel940_options(m);
 +    m->desc = "RHEL-9.2.0 PC (Q35 + ICH9, 2009)";
 +    m->alias = NULL;
 +    pcmc->smbios_stream_product = "RHEL";
 +    pcmc->smbios_stream_version = "9.2.0";
 +
 +    /* From pc_q35_8_0_machine_options() */
 +    pcmc->default_smbios_ep_type = SMBIOS_ENTRY_POINT_TYPE_32;
 +
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_4,
 +                     hw_compat_rhel_9_4_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_3,
 +                     hw_compat_rhel_9_3_len);
 +    compat_props_add(m->compat_props, pc_rhel_9_3_compat,
 +                     pc_rhel_9_3_compat_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_2,
 +                     hw_compat_rhel_9_2_len);
 +    compat_props_add(m->compat_props, pc_rhel_9_2_compat,
 +                     pc_rhel_9_2_compat_len);
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel920, "pc-q35-rhel9.2.0", pc_q35_init_rhel920,
 +                  pc_q35_machine_rhel920_options);
 +
 +static void pc_q35_init_rhel900(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel900_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel920_options(m);
 +    m->desc = "RHEL-9.0.0 PC (Q35 + ICH9, 2009)";
 +    m->alias = NULL;
 +    pcmc->smbios_stream_product = "RHEL";
 +    pcmc->smbios_stream_version = "9.0.0";
 +    pcmc->enforce_amd_1tb_hole = false;
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_1,
 +                     hw_compat_rhel_9_1_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_0,
 +                     hw_compat_rhel_9_0_len);
 +    compat_props_add(m->compat_props, pc_rhel_9_0_compat,
 +                     pc_rhel_9_0_compat_len);
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel900, "pc-q35-rhel9.0.0", pc_q35_init_rhel900,
 +                  pc_q35_machine_rhel900_options);
 +
 +static void pc_q35_init_rhel860(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel860_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel900_options(m);
 +    m->desc = "RHEL-8.6.0 PC (Q35 + ICH9, 2009)";
 +    m->alias = NULL;
 +
 +    /* All RHEL machines for prior major releases are deprecated */
 +    m->deprecation_reason = rhel_old_machine_deprecation;
 +
 +    pcmc->smbios_stream_product = "RHEL-AV";
 +    pcmc->smbios_stream_version = "8.6.0";
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_6,
 +                     hw_compat_rhel_8_6_len);
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel860, "pc-q35-rhel8.6.0", pc_q35_init_rhel860,
 +                  pc_q35_machine_rhel860_options);
 +
 +
 +static void pc_q35_init_rhel850(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel850_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel860_options(m);
 +    m->desc = "RHEL-8.5.0 PC (Q35 + ICH9, 2009)";
 +    m->alias = NULL;
 +    pcmc->smbios_stream_product = "RHEL-AV";
 +    pcmc->smbios_stream_version = "8.5.0";
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_5,
 +                     hw_compat_rhel_8_5_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_5_compat,
 +                     pc_rhel_8_5_compat_len);
 +    m->smp_props.prefer_sockets = true;
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel850, "pc-q35-rhel8.5.0", pc_q35_init_rhel850,
 +                  pc_q35_machine_rhel850_options);
 +
 +
 +static void pc_q35_init_rhel840(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel840_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel850_options(m);
 +    m->desc = "RHEL-8.4.0 PC (Q35 + ICH9, 2009)";
 +    m->alias = NULL;
 +    pcmc->smbios_stream_product = "RHEL-AV";
 +    pcmc->smbios_stream_version = "8.4.0";
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_4,
 +                     hw_compat_rhel_8_4_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_4_compat,
 +                     pc_rhel_8_4_compat_len);
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel840, "pc-q35-rhel8.4.0", pc_q35_init_rhel840,
 +                  pc_q35_machine_rhel840_options);
 +
 +
 +static void pc_q35_init_rhel830(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel830_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel840_options(m);
 +    m->desc = "RHEL-8.3.0 PC (Q35 + ICH9, 2009)";
 +    m->alias = NULL;
 +    pcmc->smbios_stream_product = "RHEL-AV";
 +    pcmc->smbios_stream_version = "8.3.0";
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_3,
 +                     hw_compat_rhel_8_3_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_3_compat,
 +                     pc_rhel_8_3_compat_len);
 +    /* From pc_q35_5_1_machine_options() */
 +    pcmc->kvmclock_create_always = false;
 +    /* From pc_q35_5_1_machine_options() */
 +    pcmc->pci_root_uid = 1;
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel830, "pc-q35-rhel8.3.0", pc_q35_init_rhel830,
 +                  pc_q35_machine_rhel830_options);
 +
 +static void pc_q35_init_rhel820(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel820_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel830_options(m);
 +    m->desc = "RHEL-8.2.0 PC (Q35 + ICH9, 2009)";
 +    m->alias = NULL;
 +    m->numa_mem_supported = true;
 +    m->auto_enable_numa_with_memdev = false;
 +    pcmc->smbios_stream_product = "RHEL-AV";
 +    pcmc->smbios_stream_version = "8.2.0";
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_2,
 +                     hw_compat_rhel_8_2_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_2_compat,
 +                     pc_rhel_8_2_compat_len);
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel820, "pc-q35-rhel8.2.0", pc_q35_init_rhel820,
 +                  pc_q35_machine_rhel820_options);
 +
 +static void pc_q35_init_rhel810(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel810_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel820_options(m);
 +    m->desc = "RHEL-8.1.0 PC (Q35 + ICH9, 2009)";
 +    m->alias = NULL;
 +    pcmc->smbios_stream_product = NULL;
 +    pcmc->smbios_stream_version = NULL;
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_1, hw_compat_rhel_8_1_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_1_compat, pc_rhel_8_1_compat_len);
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel810, "pc-q35-rhel8.1.0", pc_q35_init_rhel810,
 +                  pc_q35_machine_rhel810_options);
 +
 +static void pc_q35_init_rhel800(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel800_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel810_options(m);
 +    m->desc = "RHEL-8.0.0 PC (Q35 + ICH9, 2009)";
 +    m->smbus_no_migration_support = true;
 +    m->alias = NULL;
 +    pcmc->pvh_enabled = false;
 +    pcmc->default_cpu_version = CPU_VERSION_LEGACY;
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_0, hw_compat_rhel_8_0_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_0_compat, pc_rhel_8_0_compat_len);
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel800, "pc-q35-rhel8.0.0", pc_q35_init_rhel800,
 +                  pc_q35_machine_rhel800_options);
 +
 +static void pc_q35_init_rhel760(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel760_options(MachineClass *m)
 +{
 +    pc_q35_machine_rhel800_options(m);
 +    m->alias = NULL;
 +    m->desc = "RHEL-7.6.0 PC (Q35 + ICH9, 2009)";
 +    m->async_pf_vmexit_disable = true;
 +    compat_props_add(m->compat_props, hw_compat_rhel_7_6, hw_compat_rhel_7_6_len);
 +    compat_props_add(m->compat_props, pc_rhel_7_6_compat, pc_rhel_7_6_compat_len);
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel760, "pc-q35-rhel7.6.0", pc_q35_init_rhel760,
 +                  pc_q35_machine_rhel760_options);
 diff --git a/include/hw/boards.h b/include/hw/boards.h
 index 4a21eddbf9..4edfdb0ddb 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
@@ -277,6 +277,8 @@ struct MachineClass {
     strList *allowed_dynamic_sysbus_devices;
     bool auto_enable_numa_with_memhp;
     bool auto_enable_numa_with_memdev;
 +    /* RHEL only */
 +    bool async_pf_vmexit_disable;
     bool ignore_boot_device_suffixes;
     bool smbus_no_migration_support;
     bool nvdimm_supported;
 diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
 index 037942d233..37644ede7e 100644
 --- a/include/hw/i386/pc.h
 +++ b/include/hw/i386/pc.h
@@ -314,6 +314,39 @@ extern const size_t pc_compat_1_4_len;
 int pc_machine_kvm_type(MachineState *machine, const char *vm_type);
 +extern GlobalProperty pc_rhel_compat[];
 +extern const size_t pc_rhel_compat_len;
 +
 +extern GlobalProperty pc_rhel_9_3_compat[];
 +extern const size_t pc_rhel_9_3_compat_len;
 +
 +extern GlobalProperty pc_rhel_9_2_compat[];
 +extern const size_t pc_rhel_9_2_compat_len;
 +
 +extern GlobalProperty pc_rhel_9_0_compat[];
 +extern const size_t pc_rhel_9_0_compat_len;
 +
 +extern GlobalProperty pc_rhel_8_5_compat[];
 +extern const size_t pc_rhel_8_5_compat_len;
 +
 +extern GlobalProperty pc_rhel_8_4_compat[];
 +extern const size_t pc_rhel_8_4_compat_len;
 +
 +extern GlobalProperty pc_rhel_8_3_compat[];
 +extern const size_t pc_rhel_8_3_compat_len;
 +
 +extern GlobalProperty pc_rhel_8_2_compat[];
 +extern const size_t pc_rhel_8_2_compat_len;
 +
 +extern GlobalProperty pc_rhel_8_1_compat[];
 +extern const size_t pc_rhel_8_1_compat_len;
 +
 +extern GlobalProperty pc_rhel_8_0_compat[];
 +extern const size_t pc_rhel_8_0_compat_len;
 +
 +extern GlobalProperty pc_rhel_7_6_compat[];
 +extern const size_t pc_rhel_7_6_compat_len;
 +
 #define DEFINE_PC_MACHINE(suffix, namestr, initfn, optsfn) \
     static void pc_machine_##suffix##_class_init(ObjectClass *oc, void *data) \
     { \
 diff --git a/target/i386/cpu.c b/target/i386/cpu.c
 index cd16cb893d..93203d9b91 100644
 --- a/target/i386/cpu.c
 +++ b/target/i386/cpu.c
@@ -2190,9 +2190,13 @@ static const CPUCaches epyc_genoa_cache_info = {
  *  PT in VMX operation
  */
 +#define RHEL_CPU_DEPRECATION \
 +    "use at least 'Nehalem' / 'Opteron_G4', or 'host' / 'max'"
 +
 static const X86CPUDefinition builtin_x86_defs[] = {
     {
         .name = "qemu64",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 0xd,
         .vendor = CPUID_VENDOR_AMD,
         .family = 15,
@@ -2213,6 +2217,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "phenom",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 5,
         .vendor = CPUID_VENDOR_AMD,
         .family = 16,
@@ -2245,6 +2250,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "core2duo",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 10,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -2287,6 +2293,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "kvm64",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 0xd,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 15,
@@ -2328,6 +2335,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "qemu32",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 4,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -2342,6 +2350,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "kvm32",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 5,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 15,
@@ -2372,6 +2381,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "coreduo",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 10,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -2405,6 +2415,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "486",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 1,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 4,
@@ -2417,6 +2428,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "pentium",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 1,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 5,
@@ -2429,6 +2441,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "pentium2",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 2,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -2441,6 +2454,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "pentium3",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 3,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -2453,6 +2467,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "athlon",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 2,
         .vendor = CPUID_VENDOR_AMD,
         .family = 6,
@@ -2468,6 +2483,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "n270",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 10,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -2493,6 +2509,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "Conroe",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 10,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -2533,6 +2550,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "Penryn",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 10,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -4394,6 +4412,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "Opteron_G1",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 5,
         .vendor = CPUID_VENDOR_AMD,
         .family = 15,
@@ -4414,6 +4433,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "Opteron_G2",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 5,
         .vendor = CPUID_VENDOR_AMD,
         .family = 15,
@@ -4436,6 +4456,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "Opteron_G3",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 5,
         .vendor = CPUID_VENDOR_AMD,
         .family = 16,
 diff --git a/target/i386/kvm/kvm-cpu.c b/target/i386/kvm/kvm-cpu.c
 index 9c791b7b05..b91af5051f 100644
 --- a/target/i386/kvm/kvm-cpu.c
 +++ b/target/i386/kvm/kvm-cpu.c
@@ -138,6 +138,7 @@ static PropValue kvm_default_props[] = {
     { "acpi", "off" },
     { "monitor", "off" },
     { "svm", "off" },
 +    { "kvm-pv-unhalt", "on" },
     { NULL, NULL },
 };
 diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
 index 4ce80555b4..9d41edf01e 100644
 --- a/target/i386/kvm/kvm.c
 +++ b/target/i386/kvm/kvm.c
@@ -3711,6 +3711,7 @@ static int kvm_get_msrs(X86CPU *cpu)
     struct kvm_msr_entry *msrs = cpu->kvm_msr_buf->entries;
     int ret, i;
     uint64_t mtrr_top_bits;
 +    MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
     kvm_msr_buf_reset(cpu);
@@ -4065,6 +4066,9 @@ static int kvm_get_msrs(X86CPU *cpu)
             break;
         case MSR_KVM_ASYNC_PF_EN:
             env->async_pf_en_msr = msrs[i].data;
 +            if (mc->async_pf_vmexit_disable) {
 +                env->async_pf_en_msr &= ~(1ULL << 2);
 +            }
             break;
         case MSR_KVM_ASYNC_PF_INT:
             env->async_pf_int_msr = msrs[i].data;
 diff --git a/tests/qtest/pvpanic-test.c b/tests/qtest/pvpanic-test.c
 index 78f1cf8186..ac954c9b06 100644
 --- a/tests/qtest/pvpanic-test.c
 +++ b/tests/qtest/pvpanic-test.c
@@ -17,7 +17,7 @@ static void test_panic_nopause(void)
     QDict *response, *data;
     QTestState *qts;
 -    qts = qtest_init("-device pvpanic -action panic=none");
 +    qts = qtest_init("-M q35 -device pvpanic -action panic=none");
     val = qtest_inb(qts, 0x505);
     g_assert_cmpuint(val, ==, 3);
@@ -40,7 +40,8 @@ static void test_panic(void)
     QDict *response, *data;
     QTestState *qts;
 -    qts = qtest_init("-device pvpanic -action panic=pause");
 +    /* RHEL: Use q35 */
 +    qts = qtest_init("-M q35 -device pvpanic -action panic=pause");
     val = qtest_inb(qts, 0x505);
     g_assert_cmpuint(val, ==, 3);
 -- 
 2.39.3
--- a/SOURCES/0011-Add-x86_64-machine-types.patch
+++ b/SOURCES/0011-Add-x86_64-machine-types.patch
--- a/SOURCES/0011-Enable-make-check.patch
+++ b/SOURCES/0011-Enable-make-check.patch
@ -1,270 +0,0 @@
 From 66a0510405e5142a1f9e38e0770aa0f10aed3e03 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 2 Sep 2020 09:39:41 +0200
 Subject: Enable make check
 Fixing tests after device disabling and machine types changes and enabling
 make check run during build.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 Rebase changes (6.1.0):
 - removed unnecessary test changes
 Rebase changes (6.2.0):
 - new way of disabling bios-table-test
 Rebase changes (7.0.0):
 - Disable testing virtio-iommu-pci
 - Rename default_bus_bypass_iommu property to default-bus-bypass-iommu
 - Disable qtest-bios-table for aarch64
 - Removed redhat chunks for boot-serial-test.c, cdrom-test.c and cpu-plug-test.c qtests
 - Do not disable boot-order-test, prom-env-test and boot-serial-test qtests
 - Use rhel machine type for new intel hda qtest
 - Remove unnecessary changes in iotest 051
 - Remove changes in bios-tables-test.c and prom-env-test.c qtests
 Rebase changes (7.1.0):
 - Disable bcm2835-dma-test (added upstream)
 Rebase changes (8.0.0):
 - Removed chunks for disabling bios-table-test (protected upstream)
 - Disable new qemu-iotests execution
 - Revert change in tco qtest (blocking test run)
 Rebase changes (8.1.0):
 - Do not disable device-plug-test for s390x
 Rebase changes (8.2.0 rc1):
 - Remove unneeded hack in qtest/usb-hcd-xhci-test.c
 Merged patches (6.1.0):
 - 2f129df7d3 redhat: Enable the 'test-block-iothread' test again
 Merged patches (7.1.0):
 - 64d736640e RHEL-only: tests/avocado: Switch aarch64 tests from a53 to a57
 Merged patches (8.1.0):
 - f468163234 iotests: Use alternative CPU type that is not deprecated in RHEL
 ---
 .distro/qemu-kvm.spec.template      |  4 ++--
 tests/avocado/replay_kernel.py      |  2 +-
 tests/avocado/reverse_debugging.py  |  2 +-
 tests/avocado/tcg_plugins.py        |  6 ++---
 tests/qemu-iotests/meson.build      | 34 ++++++++++++++---------------
 tests/qemu-iotests/testenv.py       |  3 +++
 tests/qtest/fuzz-e1000e-test.c      |  2 +-
 tests/qtest/fuzz-virtio-scsi-test.c |  2 +-
 tests/qtest/intel-hda-test.c        |  2 +-
 tests/qtest/libqos/meson.build      |  2 +-
 tests/qtest/lpc-ich9-test.c         |  2 +-
 tests/qtest/meson.build             |  1 -
 tests/qtest/virtio-net-failover.c   |  1 +
 13 files changed, 33 insertions(+), 30 deletions(-)
 diff --git a/tests/avocado/replay_kernel.py b/tests/avocado/replay_kernel.py
 index c37afa662c..61c95a2198 100644
 --- a/tests/avocado/replay_kernel.py
 +++ b/tests/avocado/replay_kernel.py
@@ -153,7 +153,7 @@ def test_aarch64_virt(self):
         """
         :avocado: tags=arch:aarch64
         :avocado: tags=machine:virt
 -        :avocado: tags=cpu:cortex-a53
 +        :avocado: tags=cpu:cortex-a57
         """
         kernel_url = ('https://archives.fedoraproject.org/pub/archive/fedora'
                       '/linux/releases/29/Everything/aarch64/os/images/pxeboot'
 diff --git a/tests/avocado/reverse_debugging.py b/tests/avocado/reverse_debugging.py
 index 4cce5a5598..e9248a04a2 100644
 --- a/tests/avocado/reverse_debugging.py
 +++ b/tests/avocado/reverse_debugging.py
@@ -230,7 +230,7 @@ def test_aarch64_virt(self):
         """
         :avocado: tags=arch:aarch64
         :avocado: tags=machine:virt
 -        :avocado: tags=cpu:cortex-a53
 +        :avocado: tags=cpu:cortex-a57
         """
         kernel_url = ('https://archives.fedoraproject.org/pub/archive/fedora'
                       '/linux/releases/29/Everything/aarch64/os/images/pxeboot'
 diff --git a/tests/avocado/tcg_plugins.py b/tests/avocado/tcg_plugins.py
 index 15fd87b2c1..f0d9d89c93 100644
 --- a/tests/avocado/tcg_plugins.py
 +++ b/tests/avocado/tcg_plugins.py
@@ -66,7 +66,7 @@ def test_aarch64_virt_insn(self):
         :avocado: tags=accel:tcg
         :avocado: tags=arch:aarch64
         :avocado: tags=machine:virt
 -        :avocado: tags=cpu:cortex-a53
 +        :avocado: tags=cpu:cortex-a57
         """
         kernel_path = self._grab_aarch64_kernel()
         kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
@@ -96,7 +96,7 @@ def test_aarch64_virt_insn_icount(self):
         :avocado: tags=accel:tcg
         :avocado: tags=arch:aarch64
         :avocado: tags=machine:virt
 -        :avocado: tags=cpu:cortex-a53
 +        :avocado: tags=cpu:cortex-a57
         """
         kernel_path = self._grab_aarch64_kernel()
         kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
@@ -126,7 +126,7 @@ def test_aarch64_virt_mem_icount(self):
         :avocado: tags=accel:tcg
         :avocado: tags=arch:aarch64
         :avocado: tags=machine:virt
 -        :avocado: tags=cpu:cortex-a53
 +        :avocado: tags=cpu:cortex-a57
         """
         kernel_path = self._grab_aarch64_kernel()
         kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
 diff --git a/tests/qemu-iotests/meson.build b/tests/qemu-iotests/meson.build
 index 53847cb98f..a2abdb650e 100644
 --- a/tests/qemu-iotests/meson.build
 +++ b/tests/qemu-iotests/meson.build
@@ -51,21 +51,21 @@ foreach format, speed: qemu_iotests_formats
       check: true,
   )
 -  foreach item: rc.stdout().strip().split()
 -      args = [qemu_iotests_check_cmd,
 -              '-tap', '-' + format, item,
 -              '--source-dir', meson.current_source_dir(),
 -              '--build-dir', meson.current_build_dir()]
 -      # Some individual tests take as long as 45 seconds
 -      # Bump the timeout to 3 minutes for some headroom
 -      # on slow machines to minimize spurious failures
 -      test('io-' + format + '-' + item,
 -           python,
 -           args: args,
 -           depends: qemu_iotests_binaries,
 -           env: qemu_iotests_env,
 -           protocol: 'tap',
 -           timeout: 180,
 -           suite: suites)
 -  endforeach
 +#  foreach item: rc.stdout().strip().split()
 +#      args = [qemu_iotests_check_cmd,
 +#              '-tap', '-' + format, item,
 +#              '--source-dir', meson.current_source_dir(),
 +#              '--build-dir', meson.current_build_dir()]
 +#      # Some individual tests take as long as 45 seconds
 +#      # Bump the timeout to 3 minutes for some headroom
 +#      # on slow machines to minimize spurious failures
 +#      test('io-' + format + '-' + item,
 +#           python,
 +#           args: args,
 +#           depends: qemu_iotests_binaries,
 +#           env: qemu_iotests_env,
 +#           protocol: 'tap',
 +#           timeout: 180,
 +#           suite: suites)
 +#  endforeach
 endforeach
 diff --git a/tests/qemu-iotests/testenv.py b/tests/qemu-iotests/testenv.py
 index 3ff38f2661..cab9a2bd6c 100644
 --- a/tests/qemu-iotests/testenv.py
 +++ b/tests/qemu-iotests/testenv.py
@@ -244,6 +244,9 @@ def __init__(self, source_dir: str, build_dir: str,
             if self.qemu_prog.endswith(f'qemu-system-{suffix}'):
                 self.qemu_options += f' -machine {machine}'
 +        if self.qemu_prog.endswith('qemu-system-x86_64'):
 +            self.qemu_options += ' -cpu Nehalem'
 +
         # QEMU_DEFAULT_MACHINE
         self.qemu_default_machine = get_default_machine(self.qemu_prog)
 diff --git a/tests/qtest/fuzz-e1000e-test.c b/tests/qtest/fuzz-e1000e-test.c
 index 5052883fb6..b5286f4b12 100644
 --- a/tests/qtest/fuzz-e1000e-test.c
 +++ b/tests/qtest/fuzz-e1000e-test.c
@@ -17,7 +17,7 @@ static void test_lp1879531_eth_get_rss_ex_dst_addr(void)
 {
     QTestState *s;
 -    s = qtest_init("-nographic -monitor none -serial none -M pc-q35-5.0");
 +    s = qtest_init("-nographic -monitor none -serial none -M pc-q35-rhel8.4.0");
     qtest_outl(s, 0xcf8, 0x80001010);
     qtest_outl(s, 0xcfc, 0xe1020000);
 diff --git a/tests/qtest/fuzz-virtio-scsi-test.c b/tests/qtest/fuzz-virtio-scsi-test.c
 index e37b48b2cc..88647da054 100644
 --- a/tests/qtest/fuzz-virtio-scsi-test.c
 +++ b/tests/qtest/fuzz-virtio-scsi-test.c
@@ -19,7 +19,7 @@ static void test_mmio_oob_from_memory_region_cache(void)
 {
     QTestState *s;
 -    s = qtest_init("-M pc-q35-5.2 -m 512M "
 +    s = qtest_init("-M pc-q35-rhel8.4.0 -m 512M "
                    "-device virtio-scsi,num_queues=8,addr=03.0 ");
     qtest_outl(s, 0xcf8, 0x80001811);
 diff --git a/tests/qtest/intel-hda-test.c b/tests/qtest/intel-hda-test.c
 index 663bb6c485..2efc43e3f7 100644
 --- a/tests/qtest/intel-hda-test.c
 +++ b/tests/qtest/intel-hda-test.c
@@ -42,7 +42,7 @@ static void test_issue542_ich6(void)
 {
     QTestState *s;
 -    s = qtest_init("-nographic -nodefaults -M pc-q35-6.2 "
 +    s = qtest_init("-nographic -nodefaults -M pc-q35-rhel9.0.0 "
                    AUDIODEV
                    "-device intel-hda,id=" HDA_ID CODEC_DEVICES);
 diff --git a/tests/qtest/libqos/meson.build b/tests/qtest/libqos/meson.build
 index 90aae42a22..9bc4e41af0 100644
 --- a/tests/qtest/libqos/meson.build
 +++ b/tests/qtest/libqos/meson.build
@@ -44,7 +44,7 @@ libqos_srcs = files(
         'virtio-rng.c',
         'virtio-scsi.c',
         'virtio-serial.c',
 -        'virtio-iommu.c',
 +#        'virtio-iommu.c',
         'virtio-gpio.c',
         'virtio-scmi.c',
         'generic-pcihost.c',
 diff --git a/tests/qtest/lpc-ich9-test.c b/tests/qtest/lpc-ich9-test.c
 index 8ac95b89f7..cd2102555c 100644
 --- a/tests/qtest/lpc-ich9-test.c
 +++ b/tests/qtest/lpc-ich9-test.c
@@ -15,7 +15,7 @@ static void test_lp1878642_pci_bus_get_irq_level_assert(void)
 {
     QTestState *s;
 -    s = qtest_init("-M pc-q35-5.0 "
 +    s = qtest_init("-M pc-q35-rhel8.4.0 "
                    "-nographic -monitor none -serial none");
     qtest_outl(s, 0xcf8, 0x8000f840); /* PMBASE */
 diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
 index 47dabf91d0..0bdfa3a821 100644
 --- a/tests/qtest/meson.build
 +++ b/tests/qtest/meson.build
@@ -97,7 +97,6 @@ qtests_i386 = \
    'drive_del-test',
    'tco-test',
    'cpu-plug-test',
 -   'q35-test',
    'vmgenid-test',
    'migration-test',
    'test-x86-cpuid-compat',
 diff --git a/tests/qtest/virtio-net-failover.c b/tests/qtest/virtio-net-failover.c
 index 0d40bc1f2d..4c633c1584 100644
 --- a/tests/qtest/virtio-net-failover.c
 +++ b/tests/qtest/virtio-net-failover.c
@@ -26,6 +26,7 @@
 #define PCI_SEL_BASE            0x0010
 #define BASE_MACHINE "-M q35 -nodefaults " \
 +    "-global ICH9-LPC.acpi-pci-hotplug-with-bridge-support=on " \
     "-device pcie-root-port,id=root0,addr=0x1,bus=pcie.0,chassis=1 " \
     "-device pcie-root-port,id=root1,addr=0x2,bus=pcie.0,chassis=2 "
 -- 
 2.39.3
--- a/SOURCES/0012-Enable-make-check.patch
+++ b/SOURCES/0012-Enable-make-check.patch
@ -0,0 +1,407 @@
 From 740a2dd943a2e0fcd41a9cd8eb94a136f8f49fa2 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 2 Sep 2020 09:39:41 +0200
 Subject: Enable make check
 Fixing tests after device disabling and machine types changes and enabling
 make check run during build.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 Rebase changes (4.0.0):
 - Remove testing for pseries-2.7 in endianess test
 - Disable device-plug-test on s390x as it use disabled device
 - Do not run cpu-plug-tests on 7.3 and older machine types
 Rebase changes (4.1.0-rc0):
 - removed iotests 068
 Rebase changes (4.1.0-rc1):
 - remove all 205 tests (unstable)
 Rebase changes (4.2.0-rc0):
 - partially disable hd-geo-test (requires lsi53c895a)
 Rebase changes (5.1.0-rc1):
 - Disable qtest/q35-test (uses upstream machine types)
 - Do not run iotests on make checka
 - Enabled iotests 071 and 099
 Rebase changes (5.2.0 rc0):
 - Disable cdrom tests (unsupported devices) on x86_64
 - disable fuzz test
 Rebase changes (6.0.0):
 - Disabled xlnx-can-test
 - Disable pxb-pcie subtest for bios-table-test
 - Replace qtest usage of upstream q35 machine type with pc-q35-rhel8.4.0
 - Not run cdrom-test on aarch64
 Rebase changes (6.1.0):
 - Remove unnecessary test disabling changes
 Rebase changes (weekly-211006):
 - New handling for bios-table-test (disabled downstream)
 Merged patches (4.0.0):
 - f7ffd13 Remove 7 qcow2 and luks iotests that are taking > 25 sec to run during the fast train build proce
 Merged patches (4.1.0-rc0):
 - 41288ff redhat: Remove raw iotest 205
 ---
 redhat/qemu-kvm.spec.template       |  2 +-
 tests/qemu-iotests/051              |  8 ++++----
 tests/qtest/bios-tables-test.c      |  5 ++++-
 tests/qtest/boot-serial-test.c      |  6 +++++-
 tests/qtest/cdrom-test.c            |  4 ++++
 tests/qtest/cpu-plug-test.c         |  4 ++--
 tests/qtest/fuzz-e1000e-test.c      |  2 +-
 tests/qtest/fuzz-virtio-scsi-test.c |  2 +-
 tests/qtest/hd-geo-test.c           |  4 ++++
 tests/qtest/lpc-ich9-test.c         |  2 +-
 tests/qtest/meson.build             | 13 ++++---------
 tests/qtest/prom-env-test.c         |  4 ++++
 tests/qtest/test-x86-cpuid-compat.c |  2 ++
 tests/qtest/usb-hcd-xhci-test.c     |  4 ++++
 14 files changed, 41 insertions(+), 21 deletions(-)
 diff --git a/tests/qemu-iotests/051 b/tests/qemu-iotests/051
 index 1d2fa93a11..c8a2815f54 100755
 --- a/tests/qemu-iotests/051
 +++ b/tests/qemu-iotests/051
@@ -174,9 +174,9 @@ run_qemu -drive if=virtio
 case "$QEMU_DEFAULT_MACHINE" in
     pc)
         run_qemu -drive if=none,id=disk -device ide-cd,drive=disk
 -        run_qemu -drive if=none,id=disk -device lsi53c895a -device scsi-cd,drive=disk
 +#        run_qemu -drive if=none,id=disk -device lsi53c895a -device scsi-cd,drive=disk
         run_qemu -drive if=none,id=disk -device ide-hd,drive=disk
 -        run_qemu -drive if=none,id=disk -device lsi53c895a -device scsi-hd,drive=disk
 +#        run_qemu -drive if=none,id=disk -device lsi53c895a -device scsi-hd,drive=disk
         ;;
      *)
         ;;
@@ -225,9 +225,9 @@ run_qemu -drive file="$TEST_IMG",if=virtio,readonly=on
 case "$QEMU_DEFAULT_MACHINE" in
     pc)
         run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device ide-cd,drive=disk
 -        run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device lsi53c895a -device scsi-cd,drive=disk
 +#        run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device lsi53c895a -device scsi-cd,drive=disk
         run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device ide-hd,drive=disk
 -        run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device lsi53c895a -device scsi-hd,drive=disk
 +#        run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device lsi53c895a -device scsi-hd,drive=disk
         ;;
      *)
         ;;
 diff --git a/tests/qtest/bios-tables-test.c b/tests/qtest/bios-tables-test.c
 index 258874167e..16d8304cde 100644
 --- a/tests/qtest/bios-tables-test.c
 +++ b/tests/qtest/bios-tables-test.c
@@ -1372,6 +1372,7 @@ static void test_acpi_virt_tcg_numamem(void)
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void test_acpi_virt_tcg_pxb(void)
 {
     test_data data = {
@@ -1403,6 +1404,7 @@ static void test_acpi_virt_tcg_pxb(void)
     free_test_data(&data);
 }
 +#endif
 static void test_acpi_tcg_acpi_hmat(const char *machine)
 {
@@ -1644,7 +1646,8 @@ int main(int argc, char *argv[])
             qtest_add_func("acpi/virt", test_acpi_virt_tcg);
             qtest_add_func("acpi/virt/numamem", test_acpi_virt_tcg_numamem);
             qtest_add_func("acpi/virt/memhp", test_acpi_virt_tcg_memhp);
 -            qtest_add_func("acpi/virt/pxb", test_acpi_virt_tcg_pxb);
 +            /* Disabled for Red Hat Enterprise Linux
 +            qtest_add_func("acpi/virt/pxb", test_acpi_virt_tcg_pxb); */
             qtest_add_func("acpi/virt/oem-fields", test_acpi_oem_fields_virt);
         }
     }
 diff --git a/tests/qtest/boot-serial-test.c b/tests/qtest/boot-serial-test.c
 index 83828ba270..294476b959 100644
 --- a/tests/qtest/boot-serial-test.c
 +++ b/tests/qtest/boot-serial-test.c
@@ -148,19 +148,23 @@ static testdef_t tests[] = {
     { "ppc", "g3beige", "", "PowerPC,750" },
     { "ppc", "mac99", "", "PowerPC,G4" },
     { "ppc", "sam460ex", "-m 256", "DRAM:  256 MiB" },
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
     { "ppc64", "ppce500", "", "U-Boot" },
     { "ppc64", "40p", "-m 192", "Memory: 192M" },
     { "ppc64", "mac99", "", "PowerPC,970FX" },
 +#endif
     { "ppc64", "pseries",
       "-machine " PSERIES_DEFAULT_CAPABILITIES,
       "Open Firmware" },
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
     { "ppc64", "powernv8", "", "OPAL" },
     { "ppc64", "powernv9", "", "OPAL" },
     { "ppc64", "sam460ex", "-device e1000", "8086  100e" },
 +#endif
     { "i386", "isapc", "-cpu qemu32 -device sga", "SGABIOS" },
     { "i386", "pc", "-device sga", "SGABIOS" },
     { "i386", "q35", "-device sga", "SGABIOS" },
 -    { "x86_64", "isapc", "-cpu qemu32 -device sga", "SGABIOS" },
 +    { "x86_64", "pc", "-cpu qemu32 -device sga", "SGABIOS" },
     { "x86_64", "q35", "-device sga", "SGABIOS" },
     { "sparc", "LX", "", "TMS390S10" },
     { "sparc", "SS-4", "", "MB86904" },
 diff --git a/tests/qtest/cdrom-test.c b/tests/qtest/cdrom-test.c
 index 5af944a5fb..69d9bac38a 100644
 --- a/tests/qtest/cdrom-test.c
 +++ b/tests/qtest/cdrom-test.c
@@ -140,6 +140,7 @@ static void add_x86_tests(void)
         qtest_add_data_func("cdrom/boot/isapc", "-M isapc "
                             "-drive if=ide,media=cdrom,file=", test_cdboot);
     }
 +#if 0  /* Disabled for Red Hat Enterprise Linux */
     qtest_add_data_func("cdrom/boot/am53c974",
                         "-device am53c974 -device scsi-cd,drive=cd1 "
                         "-drive if=none,id=cd1,format=raw,file=", test_cdboot);
@@ -155,6 +156,7 @@ static void add_x86_tests(void)
     qtest_add_data_func("cdrom/boot/megasas-gen2", "-M q35 "
                         "-device megasas-gen2 -device scsi-cd,drive=cd1 "
                         "-blockdev file,node-name=cd1,filename=", test_cdboot);
 +#endif
 }
 static void add_s390x_tests(void)
@@ -220,6 +222,7 @@ int main(int argc, char **argv)
             "magnum", "malta", "pica61", NULL
         };
         add_cdrom_param_tests(mips64machines);
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
     } else if (g_str_equal(arch, "arm") || g_str_equal(arch, "aarch64")) {
         const char *armmachines[] = {
             "realview-eb", "realview-eb-mpcore", "realview-pb-a8",
@@ -227,6 +230,7 @@ int main(int argc, char **argv)
             "vexpress-a9", "virt", NULL
         };
         add_cdrom_param_tests(armmachines);
 +#endif
     } else {
         const char *nonemachine[] = { "none", NULL };
         add_cdrom_param_tests(nonemachine);
 diff --git a/tests/qtest/cpu-plug-test.c b/tests/qtest/cpu-plug-test.c
 index a1c689414b..a8f076711c 100644
 --- a/tests/qtest/cpu-plug-test.c
 +++ b/tests/qtest/cpu-plug-test.c
@@ -110,8 +110,8 @@ static void add_pseries_test_case(const char *mname)
     char *path;
     PlugTestData *data;
 -    if (!g_str_has_prefix(mname, "pseries-") ||
 -        (g_str_has_prefix(mname, "pseries-2.") && atoi(&mname[10]) < 7)) {
 +    if (!g_str_has_prefix(mname, "pseries-rhel") ||
 +        (g_str_has_prefix(mname, "pseries-rhel7.") && atoi(&mname[14]) < 4)) {
         return;
     }
     data = g_new(PlugTestData, 1);
 diff --git a/tests/qtest/fuzz-e1000e-test.c b/tests/qtest/fuzz-e1000e-test.c
 index 66229e6096..947fba73b7 100644
 --- a/tests/qtest/fuzz-e1000e-test.c
 +++ b/tests/qtest/fuzz-e1000e-test.c
@@ -17,7 +17,7 @@ static void test_lp1879531_eth_get_rss_ex_dst_addr(void)
 {
     QTestState *s;
 -    s = qtest_init("-nographic -monitor none -serial none -M pc-q35-5.0");
 +    s = qtest_init("-nographic -monitor none -serial none -M pc-q35-rhel8.4.0");
     qtest_outl(s, 0xcf8, 0x80001010);
     qtest_outl(s, 0xcfc, 0xe1020000);
 diff --git a/tests/qtest/fuzz-virtio-scsi-test.c b/tests/qtest/fuzz-virtio-scsi-test.c
 index aaf6d10e18..43727d62ac 100644
 --- a/tests/qtest/fuzz-virtio-scsi-test.c
 +++ b/tests/qtest/fuzz-virtio-scsi-test.c
@@ -19,7 +19,7 @@ static void test_mmio_oob_from_memory_region_cache(void)
 {
     QTestState *s;
 -    s = qtest_init("-M pc-q35-5.2 -display none -m 512M "
 +    s = qtest_init("-M pc-q35-rhel8.4.0 -display none -m 512M "
                    "-device virtio-scsi,num_queues=8,addr=03.0 ");
     qtest_outl(s, 0xcf8, 0x80001811);
 diff --git a/tests/qtest/hd-geo-test.c b/tests/qtest/hd-geo-test.c
 index 113126ae06..999ef2aace 100644
 --- a/tests/qtest/hd-geo-test.c
 +++ b/tests/qtest/hd-geo-test.c
@@ -737,6 +737,7 @@ static void test_override_ide(void)
     test_override(args, expected);
 }
 +#if 0 /* Require lsi53c895a - not supported on RHEL */
 static void test_override_scsi(void)
 {
     TestArgs *args = create_args();
@@ -781,6 +782,7 @@ static void test_override_scsi_2_controllers(void)
     add_scsi_disk(args, 3, 1, 0, 1, 2, 0, 1, 0);
     test_override(args, expected);
 }
 +#endif
 static void test_override_virtio_blk(void)
 {
@@ -960,9 +962,11 @@ int main(int argc, char **argv)
     qtest_add_func("hd-geo/ide/device/user/chst", test_ide_device_user_chst);
     if (have_qemu_img()) {
         qtest_add_func("hd-geo/override/ide", test_override_ide);
 +#if 0 /* Require lsi53c895a - not supported on RHEL */
         qtest_add_func("hd-geo/override/scsi", test_override_scsi);
         qtest_add_func("hd-geo/override/scsi_2_controllers",
                        test_override_scsi_2_controllers);
 +#endif
         qtest_add_func("hd-geo/override/virtio_blk", test_override_virtio_blk);
         qtest_add_func("hd-geo/override/zero_chs", test_override_zero_chs);
         qtest_add_func("hd-geo/override/scsi_hot_unplug",
 diff --git a/tests/qtest/lpc-ich9-test.c b/tests/qtest/lpc-ich9-test.c
 index fe0bef9980..7a9d51579b 100644
 --- a/tests/qtest/lpc-ich9-test.c
 +++ b/tests/qtest/lpc-ich9-test.c
@@ -15,7 +15,7 @@ static void test_lp1878642_pci_bus_get_irq_level_assert(void)
 {
     QTestState *s;
 -    s = qtest_init("-M pc-q35-5.0 "
 +    s = qtest_init("-M pc-q35-rhel8.4.0 "
                    "-nographic -monitor none -serial none");
     qtest_outl(s, 0xcf8, 0x8000f840); /* PMBASE */
 diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
 index c9d8458062..049e06c057 100644
 --- a/tests/qtest/meson.build
 +++ b/tests/qtest/meson.build
@@ -68,7 +68,6 @@ qtests_i386 = \
   (config_all_devices.has_key('CONFIG_RTL8139_PCI') ? ['rtl8139-test'] : []) +              \
   (config_all_devices.has_key('CONFIG_E1000E_PCI_EXPRESS') ? ['fuzz-e1000e-test'] : []) +   \
   (config_all_devices.has_key('CONFIG_ESP_PCI') ? ['am53c974-test'] : []) +                 \
 -  (unpack_edk2_blobs ? ['bios-tables-test'] : []) +                                         \
   qtests_pci +                                                                              \
   ['fdc-test',
    'ide-test',
@@ -81,7 +80,6 @@ qtests_i386 = \
    'drive_del-test',
    'tco-test',
    'cpu-plug-test',
 -   'q35-test',
    'vmgenid-test',
    'migration-test',
    'test-x86-cpuid-compat',
@@ -130,17 +128,15 @@ qtests_mips64el = \
 qtests_ppc = \
   (config_all_devices.has_key('CONFIG_ISA_TESTDEV') ? ['endianness-test'] : []) +            \
 -  (config_all_devices.has_key('CONFIG_M48T59') ? ['m48t59-test'] : []) +                     \
 -  ['boot-order-test', 'prom-env-test', 'boot-serial-test']                 \
 +  (config_all_devices.has_key('CONFIG_M48T59') ? ['m48t59-test'] : [])
 qtests_ppc64 = \
   (config_all_devices.has_key('CONFIG_PSERIES') ? ['device-plug-test'] : []) +               \
   (config_all_devices.has_key('CONFIG_POWERNV') ? ['pnv-xscom-test'] : []) +                 \
   (config_all_devices.has_key('CONFIG_PSERIES') ? ['rtas-test'] : []) +                      \
 -  (slirp.found() ? ['pxe-test', 'test-netfilter'] : []) +              \
 +  (slirp.found() ? ['pxe-test'] : []) +              \
   (config_all_devices.has_key('CONFIG_USB_UHCI') ? ['usb-hcd-uhci-test'] : []) +             \
   (config_all_devices.has_key('CONFIG_USB_XHCI_NEC') ? ['usb-hcd-xhci-test'] : []) +         \
 -  (config_host.has_key('CONFIG_POSIX') ? ['test-filter-mirror'] : []) +                      \
   qtests_pci + ['migration-test', 'numa-test', 'cpu-plug-test', 'drive_del-test']
 qtests_sh4 = (config_all_devices.has_key('CONFIG_ISA_TESTDEV') ? ['endianness-test'] : [])
@@ -186,8 +182,8 @@ qtests_aarch64 = \
   ['arm-cpu-features',
    'numa-test',
    'boot-serial-test',
 -   'xlnx-can-test',
 -   'fuzz-xlnx-dp-test',
 +#   'xlnx-can-test',
 +#   'fuzz-xlnx-dp-test',
    'migration-test']
 qtests_s390x = \
@@ -196,7 +192,6 @@ qtests_s390x = \
   (config_host.has_key('CONFIG_POSIX') ? ['test-filter-redirector'] : []) +                     \
   ['boot-serial-test',
    'drive_del-test',
 -   'device-plug-test',
    'virtio-ccw-test',
    'cpu-plug-test',
    'migration-test']
 diff --git a/tests/qtest/prom-env-test.c b/tests/qtest/prom-env-test.c
 index f41d80154a..f8dc478ce8 100644
 --- a/tests/qtest/prom-env-test.c
 +++ b/tests/qtest/prom-env-test.c
@@ -89,10 +89,14 @@ int main(int argc, char *argv[])
     if (!strcmp(arch, "ppc")) {
         add_tests(ppc_machines);
     } else if (!strcmp(arch, "ppc64")) {
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
         add_tests(ppc_machines);
         if (g_test_slow()) {
 +#endif
             qtest_add_data_func("prom-env/pseries", "pseries", test_machine);
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
         }
 +#endif
     } else if (!strcmp(arch, "sparc")) {
         add_tests(sparc_machines);
     } else if (!strcmp(arch, "sparc64")) {
 diff --git a/tests/qtest/test-x86-cpuid-compat.c b/tests/qtest/test-x86-cpuid-compat.c
 index f28848e06e..6b2fd398a2 100644
 --- a/tests/qtest/test-x86-cpuid-compat.c
 +++ b/tests/qtest/test-x86-cpuid-compat.c
@@ -300,6 +300,7 @@ int main(int argc, char **argv)
                    "-cpu 486,xlevel2=0xC0000002,xstore=on",
                    "xlevel2", 0xC0000002);
 +#if 0 /* Disabled in Red Hat Enterprise Linux */
     /* Check compatibility of old machine-types that didn't
      * auto-increase level/xlevel/xlevel2: */
@@ -350,6 +351,7 @@ int main(int argc, char **argv)
     add_cpuid_test("x86/cpuid/xlevel-compat/pc-i440fx-2.4/npt-on",
                    "-machine pc-i440fx-2.4 -cpu SandyBridge,svm=on,npt=on",
                    "xlevel", 0x80000008);
 +#endif
     /* Test feature parsing */
     add_feature_test("x86/cpuid/features/plus",
 diff --git a/tests/qtest/usb-hcd-xhci-test.c b/tests/qtest/usb-hcd-xhci-test.c
 index 10ef9d2a91..3855873050 100644
 --- a/tests/qtest/usb-hcd-xhci-test.c
 +++ b/tests/qtest/usb-hcd-xhci-test.c
@@ -21,6 +21,7 @@ static void test_xhci_hotplug(void)
     usb_test_hotplug(global_qtest, "xhci", "1", NULL);
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void test_usb_uas_hotplug(void)
 {
     QTestState *qts = global_qtest;
@@ -36,6 +37,7 @@ static void test_usb_uas_hotplug(void)
     qtest_qmp_device_del(qts, "scsihd");
     qtest_qmp_device_del(qts, "uas");
 }
 +#endif
 static void test_usb_ccid_hotplug(void)
 {
@@ -56,7 +58,9 @@ int main(int argc, char **argv)
     qtest_add_func("/xhci/pci/init", test_xhci_init);
     qtest_add_func("/xhci/pci/hotplug", test_xhci_hotplug);
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
     qtest_add_func("/xhci/pci/hotplug/usb-uas", test_usb_uas_hotplug);
 +#endif
     qtest_add_func("/xhci/pci/hotplug/usb-ccid", test_usb_ccid_hotplug);
     qtest_start("-device nec-usb-xhci,id=xhci"
 -- 
 2.27.0
--- a/SOURCES/0013-vfio-cap-number-of-devices-that-can-be-assigned.patch
+++ b/SOURCES/0013-vfio-cap-number-of-devices-that-can-be-assigned.patch
@ -1,4 +1,4 @@
-From a27cfa0b407bd806ce389a7c69d0130bcfd35244 Mon Sep 17 00:00:00 2001
+From e9ebc159a9acf108e1ec6f622be3f256cf14aba7 Mon Sep 17 00:00:00 2001
 From: Bandan Das <bsd@redhat.com>
 Date: Tue, 3 Dec 2013 20:05:13 +0100
 Subject: vfio: cap number of devices that can be assigned
@ -22,46 +22,42 @@ for other uses. Stepping down a bit, the number 32 arbitrarily
 matches the number of slots on a PCI bus and is also a nice power
 of two.
 Count of slots increased to 509 later so we could increase limit
 to 64 as some usecases require more than 32 devices.
 Signed-off-by: Bandan Das <bsd@redhat.com>
-Rebase changes (231025):
+Rebase notes (2.8.0):
- Update to upstream changes
+- removed return value for vfio_realize (commit 1a22aca)
 Merged patches (2.9.0):
 - 17eb774 vfio: Use error_setg when reporting max assigned device overshoot
 Merged patches (4.1.0-rc3):
 - 2b89558 vfio: increase the cap on number of assigned devices to 64
 ---
- hw/vfio/pci.c | 31 ++++++++++++++++++++++++++++++-
+ hw/vfio/pci.c | 29 ++++++++++++++++++++++++++++-
 hw/vfio/pci.h |  1 +
- 2 files changed, 31 insertions(+), 1 deletion(-)
+ 2 files changed, 29 insertions(+), 1 deletion(-)
 diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
-index c62c02f7b6..ec98080f28 100644
+index 7b45353ce2..eb725a3aee 100644
 --- a/hw/vfio/pci.c
 +++ b/hw/vfio/pci.c
-@@ -48,6 +48,9 @@
+@@ -45,6 +45,9 @@
- /* Protected by BQL */
+ 
- static KVMRouteChange vfio_route_change;
+ #define TYPE_VFIO_PCI_NOHOTPLUG "vfio-pci-nohotplug"
 +/* RHEL only: Set once for the first assigned dev */
 +static uint16_t device_limit;
 +
 static void vfio_disable_interrupts(VFIOPCIDevice *vdev);
 static void vfio_mmap_set_enabled(VFIOPCIDevice *vdev, bool enabled);
- static void vfio_msi_disable_common(VFIOPCIDevice *vdev);
+ 
-@@ -3076,14 +3079,37 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
+@@ -2807,9 +2810,30 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
- {
+     ssize_t len;
     VFIOPCIDevice *vdev = VFIO_PCI(pdev);
     VFIODevice *vbasedev = &vdev->vbasedev;
 +    VFIODevice *vbasedev_iter;
 +    VFIOGroup *group;
     char *tmp, *subsys;
     Error *err = NULL;
     struct stat st;
     int groupid;
 -    int i, ret;
 +    int ret, i = 0;
     bool is_mdev;
     char uuid[UUID_STR_LEN];
     char *name;
 +    if (device_limit && device_limit != vdev->assigned_device_limit) {
 +            error_setg(errp, "Assigned device limit has been redefined. "
@ -84,10 +80,10 @@ index c62c02f7b6..ec98080f28 100644
 +        return;
 +    }
 +
-     if (!vbasedev->sysfsdev) {
+     if (!vdev->vbasedev.sysfsdev) {
         if (!(~vdev->host.domain || ~vdev->host.bus ||
               ~vdev->host.slot || ~vdev->host.function)) {
-@@ -3501,6 +3527,9 @@ static Property vfio_pci_dev_properties[] = {
+@@ -3246,6 +3270,9 @@ static Property vfio_pci_dev_properties[] = {
     DEFINE_PROP_BOOL("x-no-kvm-msix", VFIOPCIDevice, no_kvm_msix, false),
     DEFINE_PROP_BOOL("x-no-geforce-quirks", VFIOPCIDevice,
                      no_geforce_quirks, false),
@ -98,10 +94,10 @@ index c62c02f7b6..ec98080f28 100644
                      false),
     DEFINE_PROP_BOOL("x-no-vfio-ioeventfd", VFIOPCIDevice, no_vfio_ioeventfd,
 diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
-index fba8737ab2..eb74d9de2d 100644
+index 64777516d1..e0fe6ca97e 100644
 --- a/hw/vfio/pci.h
 +++ b/hw/vfio/pci.h
-@@ -142,6 +142,7 @@ struct VFIOPCIDevice {
+@@ -139,6 +139,7 @@ struct VFIOPCIDevice {
     EventNotifier err_notifier;
     EventNotifier req_notifier;
     int (*resetfn)(struct VFIOPCIDevice *);
@ -110,5 +106,5 @@ index fba8737ab2..eb74d9de2d 100644
     uint32_t device_id;
     uint32_t sub_vendor_id;
 -- 
-2.39.3
+2.27.0
--- a/SOURCES/0014-Add-support-statement-to-help-output.patch
+++ b/SOURCES/0014-Add-support-statement-to-help-output.patch
@ -1,4 +1,4 @@
-From 424f14d123fe1043518758605d94ed5ba50e52ad Mon Sep 17 00:00:00 2001
+From b736b0c41dd62ed6f874a7b33ca1d4f9ceab4573 Mon Sep 17 00:00:00 2001
 From: Eduardo Habkost <ehabkost@redhat.com>
 Date: Wed, 4 Dec 2013 18:53:17 +0100
 Subject: Add support statement to -help output
@ -17,14 +17,14 @@ as unsupported by Red Hat, and advising users to use libvirt instead.
 Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
 ---
- system/vl.c | 9 +++++++++
+ softmmu/vl.c | 9 +++++++++
 1 file changed, 9 insertions(+)
-diff --git a/system/vl.c b/system/vl.c
+diff --git a/softmmu/vl.c b/softmmu/vl.c
-index 2bcd9efb9a..93635ffc5b 100644
+index 620a1f1367..d46b8fb4ab 100644
--- a/system/vl.c
+--- a/softmmu/vl.c
-+++ b/system/vl.c
+++ b/softmmu/vl.c
-@@ -870,9 +870,17 @@ static void version(void)
+@@ -827,9 +827,17 @@ static void version(void)
            QEMU_COPYRIGHT "\n");
 }
@ -41,8 +41,8 @@ index 2bcd9efb9a..93635ffc5b 100644
 +    print_rh_warning();
     printf("usage: %s [options] [disk_image]\n\n"
            "'disk_image' is a raw hard disk image for IDE hard disk 0\n\n",
-             g_get_prgname());
+             error_get_progname());
-@@ -898,6 +906,7 @@ static void help(int exitcode)
+@@ -855,6 +863,7 @@ static void help(int exitcode)
            "\n"
            QEMU_HELP_BOTTOM "\n");
@ -51,5 +51,5 @@ index 2bcd9efb9a..93635ffc5b 100644
 }
 -- 
-2.39.3
+2.27.0
--- a/SOURCES/0014-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
+++ b/SOURCES/0014-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
@ -1,61 +0,0 @@
 From c683ff4a770b77dbe707413840918a46f67fa825 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 8 Jul 2020 08:35:50 +0200
 Subject: Use qemu-kvm in documentation instead of qemu-system-<arch>
 Patchwork-id: 62380
 O-Subject: [RHEV-7.1 qemu-kvm-rhev PATCHv4] Use qemu-kvm in documentation instead of qemu-system-i386
 Bugzilla: 1140620
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 RH-Acked-by: Markus Armbruster <armbru@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 From: Miroslav Rezanina <mrezanin@redhat.com>
 We change the name and location of qemu-kvm binaries. Update documentation
 to reflect this change. Only architectures available in RHEL are updated.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 docs/defs.rst.inc |  4 ++--
 qemu-options.hx   | 10 +++++-----
 2 files changed, 7 insertions(+), 7 deletions(-)
 diff --git a/docs/defs.rst.inc b/docs/defs.rst.inc
 index 52d6454b93..d74dbdeca9 100644
 --- a/docs/defs.rst.inc
 +++ b/docs/defs.rst.inc
@@ -9,7 +9,7 @@
    but the manpages will end up misrendered with following normal text
    incorrectly in boldface.
 -.. |qemu_system| replace:: qemu-system-x86_64
 -.. |qemu_system_x86| replace:: qemu-system-x86_64
 +.. |qemu_system| replace:: qemu-kvm
 +.. |qemu_system_x86| replace:: qemu-kvm
 .. |I2C| replace:: I\ :sup:`2`\ C
 .. |I2S| replace:: I\ :sup:`2`\ S
 diff --git a/qemu-options.hx b/qemu-options.hx
 index 42fd09e4de..557118cb1f 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
@@ -3469,11 +3469,11 @@ SRST
     ::
 -        qemu -m 512 -object memory-backend-file,id=mem,size=512M,mem-path=/hugetlbfs,share=on \
 -             -numa node,memdev=mem \
 -             -chardev socket,id=chr0,path=/path/to/socket \
 -             -netdev type=vhost-user,id=net0,chardev=chr0 \
 -             -device virtio-net-pci,netdev=net0
 +        qemu-kvm -m 512 -object memory-backend-file,id=mem,size=512M,mem-path=/hugetlbfs,share=on \
 +                 -numa node,memdev=mem \
 +                 -chardev socket,id=chr0,path=/path/to/socket \
 +                 -netdev type=vhost-user,id=net0,chardev=chr0 \
 +                 -device virtio-net-pci,netdev=net0
 ``-netdev vhost-vdpa[,vhostdev=/path/to/dev][,vhostfd=h]``
     Establish a vhost-vdpa netdev.
 -- 
 2.39.3
--- a/SOURCES/0015-globally-limit-the-maximum-number-of-CPUs.patch
+++ b/SOURCES/0015-globally-limit-the-maximum-number-of-CPUs.patch
@ -0,0 +1,65 @@
 From 9a7621819821ee88d2f99d6b629fd87aa9a07758 Mon Sep 17 00:00:00 2001
 From: Andrew Jones <drjones@redhat.com>
 Date: Tue, 21 Jan 2014 10:46:52 +0100
 Subject: globally limit the maximum number of CPUs
 We now globally limit the number of VCPUs.
 Especially, there is no way one can specify more than
 max_cpus VCPUs for a VM.
 This allows us the restore the ppc max_cpus limitation to the upstream
 default and minimize the ppc hack in kvm-all.c.
 Signed-off-by: David Hildenbrand <david@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 Signed-off-by: Danilo Cesar Lemes de Paula <ddepaula@redhat.com>
 Rebase notes (2.11.0):
 - Removed CONFIG_RHV reference
 - Update commit log
 Merged patches (2.11.0):
 - 92fef14623 redhat: remove manual max_cpus limitations for ppc
 - bb722e9eff redhat: globally limit the maximum number of CPUs
 - fdeef3c1c7 RHEL: Set vcpus hard limit to 240 for Power
 - 0584216921 Match POWER max cpus to x86
 Signed-off-by: Andrew Jones <drjones@redhat.com>
 Merged patches (5.1.0):
 - redhat: globally limit the maximum number of CPUs
 - redhat: remove manual max_cpus limitations for ppc
 - use recommended max vcpu count
 Merged patches (5.2.0 rc0):
 - f8a4123 vl: Remove downstream-only MAX_RHEL_CPUS code
 ---
 accel/kvm/kvm-all.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)
 diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
 index eecd8031cf..8f2a53438f 100644
 --- a/accel/kvm/kvm-all.c
 +++ b/accel/kvm/kvm-all.c
@@ -2423,6 +2423,18 @@ static int kvm_init(MachineState *ms)
     soft_vcpus_limit = kvm_recommended_vcpus(s);
     hard_vcpus_limit = kvm_max_vcpus(s);
 +#ifdef HOST_PPC64
 +    /*
 +     * On POWER, the kernel advertises a soft limit based on the
 +     * number of CPU threads on the host.  We want to allow exceeding
 +     * this for testing purposes, so we don't want to set hard limit
 +     * to soft limit as on x86.
 +     */
 +#else
 +    /* RHEL doesn't support nr_vcpus > soft_vcpus_limit */
 +    hard_vcpus_limit = soft_vcpus_limit;
 +#endif
 +
     while (nc->name) {
         if (nc->num > soft_vcpus_limit) {
             warn_report("Number of %s cpus requested (%d) exceeds "
 -- 
 2.27.0
--- a/SOURCES/0015-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch
+++ b/SOURCES/0015-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch
@ -1,77 +0,0 @@
 From 776bff1be5e98982a9bbc8345ff27274ff5b8c0f Mon Sep 17 00:00:00 2001
 From: Kevin Wolf <kwolf@redhat.com>
 Date: Fri, 20 Aug 2021 18:25:12 +0200
 Subject: qcow2: Deprecation warning when opening v2 images rw
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Kevin Wolf <kwolf@redhat.com>
 RH-MergeRequest: 37: qcow2: Deprecation warning when opening v2 images rw
 RH-Commit: [1/1] f450d0ae32d35063b28c72c4f2d2ebb9e6d8db3e (kmwolf/centos-qemu-kvm)
 RH-Bugzilla: 1951814
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Hanna Reitz <hreitz@redhat.com>
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 qcow2 v3 has been around for a long time (since QEMU 1.1/RHEL 7), so
 there is no real reason any more to use it. People still using it might
 do so unintentionally. Warn about it and suggest upgrading during the
 RHEL 9 timeframe so that the code can possibly be disabled in RHEL 10.
 The warning is restricted to read-write mode and the system emulator.
 The primary motivation for not having it in qemu-img is that 'qemu-img
 amend' for upgrades would warn otherwise. It also avoids having to make
 too many changes to the test suite.
 bdrv_uses_whitelist() is used as a proxy for deciding whether we are
 running in a tool or the system emulator. This is not entirely clean,
 but it's what is available and the same function qcow2_do_open() already
 uses it this way for another warning.
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 patch_name: kvm-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch
 present_in_specfile: true
 location_in_specfile: 116
 ---
 Rebase notes (6.1.0):
 - Replace bs->read_only with bdrv_is_read_only
 ---
 block/qcow2.c                    | 6 ++++++
 tests/qemu-iotests/common.filter | 1 +
 2 files changed, 7 insertions(+)
 diff --git a/block/qcow2.c b/block/qcow2.c
 index 13e032bd5e..7968735346 100644
 --- a/block/qcow2.c
 +++ b/block/qcow2.c
@@ -1358,6 +1358,12 @@ qcow2_do_open(BlockDriverState *bs, QDict *options, int flags,
         ret = -ENOTSUP;
         goto fail;
     }
 +    if (header.version < 3 && !bdrv_is_read_only(bs) && bdrv_uses_whitelist()) {
 +        warn_report_once("qcow2 v2 images are deprecated and may not be "
 +                         "supported in future versions. Please consider "
 +                         "upgrading the image with 'qemu-img amend "
 +                         "-o compat=v3'.");
 +    }
     s->qcow_version = header.version;
 diff --git a/tests/qemu-iotests/common.filter b/tests/qemu-iotests/common.filter
 index 2846c83808..83472953a2 100644
 --- a/tests/qemu-iotests/common.filter
 +++ b/tests/qemu-iotests/common.filter
@@ -83,6 +83,7 @@ _filter_qemu()
 {
     gsed -e "s#\\(^\\|(qemu) \\)$(basename $QEMU_PROG):#\1QEMU_PROG:#" \
         -e 's#^QEMU [0-9]\+\.[0-9]\+\.[0-9]\+ monitor#QEMU X.Y.Z monitor#' \
 +        -e "/qcow2 v2 images are deprecated/d" \
         -e $'s#\r##' # QEMU monitor uses \r\n line endings
 }
 -- 
 2.39.3
--- a/SOURCES/0016-Introduce-RHEL-9.4.0-qemu-kvm-machine-type-for-aarch.patch
+++ b/SOURCES/0016-Introduce-RHEL-9.4.0-qemu-kvm-machine-type-for-aarch.patch
@ -1,44 +0,0 @@
 From 3b9b38339346ebfaf3e8ddf0822eba1cc9e78408 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Thu, 14 Dec 2023 04:42:01 -0500
 Subject: Introduce RHEL 9.4.0 qemu-kvm machine type for aarch64
 Jira: https://issues.redhat.com/browse/RHEL-17168
 Adding new machine type to support enabling new features.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/arm/virt.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index c541efee5e..0b17c94ad7 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
@@ -3630,14 +3630,21 @@ static void rhel_machine_init(void)
 }
 type_init(rhel_machine_init);
 +static void rhel940_virt_options(MachineClass *mc)
 +{
 +}
 +DEFINE_RHEL_MACHINE_AS_LATEST(9, 4, 0)
 +
 static void rhel920_virt_options(MachineClass *mc)
 {
 +    rhel940_virt_options(mc);
 +
     compat_props_add(mc->compat_props, arm_rhel_compat, arm_rhel_compat_len);
     compat_props_add(mc->compat_props, hw_compat_rhel_9_4, hw_compat_rhel_9_4_len);
     compat_props_add(mc->compat_props, hw_compat_rhel_9_3, hw_compat_rhel_9_3_len);
     compat_props_add(mc->compat_props, hw_compat_rhel_9_2, hw_compat_rhel_9_2_len);
 }
 -DEFINE_RHEL_MACHINE_AS_LATEST(9, 2, 0)
 +DEFINE_RHEL_MACHINE(9, 2, 0)
 static void rhel900_virt_options(MachineClass *mc)
 {
 -- 
 2.39.3
--- a/SOURCES/0016-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
+++ b/SOURCES/0016-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
@ -0,0 +1,126 @@
 From 0d3fc0b4c5773c6cabb0a58c064475f76eb6ac1e Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 8 Jul 2020 08:35:50 +0200
 Subject: Use qemu-kvm in documentation instead of qemu-system-<arch>
 Patchwork-id: 62380
 O-Subject: [RHEV-7.1 qemu-kvm-rhev PATCHv4] Use qemu-kvm in documentation instead of qemu-system-i386
 Bugzilla: 1140620
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 RH-Acked-by: Markus Armbruster <armbru@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 From: Miroslav Rezanina <mrezanin@redhat.com>
 We change the name and location of qemu-kvm binaries. Update documentation
 to reflect this change. Only architectures available in RHEL are updated.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 Rebase notes (5.1.0 rc0):
 - qemu-block-drivers.texi converted to qemu-block-drivers.rst (upstream)
 Rebase notes (5.2.0 rc0):
 - rewrite patch to new docs structure
 ---
 docs/defs.rst.inc              |  4 ++--
 docs/tools/qemu-trace-stap.rst | 14 +++++++-------
 qemu-options.hx                | 10 +++++-----
 3 files changed, 14 insertions(+), 14 deletions(-)
 diff --git a/docs/defs.rst.inc b/docs/defs.rst.inc
 index 52d6454b93..d74dbdeca9 100644
 --- a/docs/defs.rst.inc
 +++ b/docs/defs.rst.inc
@@ -9,7 +9,7 @@
    but the manpages will end up misrendered with following normal text
    incorrectly in boldface.
 -.. |qemu_system| replace:: qemu-system-x86_64
 -.. |qemu_system_x86| replace:: qemu-system-x86_64
 +.. |qemu_system| replace:: qemu-kvm
 +.. |qemu_system_x86| replace:: qemu-kvm
 .. |I2C| replace:: I\ :sup:`2`\ C
 .. |I2S| replace:: I\ :sup:`2`\ S
 diff --git a/docs/tools/qemu-trace-stap.rst b/docs/tools/qemu-trace-stap.rst
 index d53073b52b..9e93df084f 100644
 --- a/docs/tools/qemu-trace-stap.rst
 +++ b/docs/tools/qemu-trace-stap.rst
@@ -46,19 +46,19 @@ The following commands are valid:
   any of the listed names. If no *PATTERN* is given, the all possible
   probes will be listed.
 -  For example, to list all probes available in the ``qemu-system-x86_64``
 +  For example, to list all probes available in the ``qemu-kvm``
   binary:
   ::
 -    $ qemu-trace-stap list qemu-system-x86_64
 +    $ qemu-trace-stap list qemu-kvm
   To filter the list to only cover probes related to QEMU's cryptographic
   subsystem, in a binary outside ``$PATH``
   ::
 -    $ qemu-trace-stap list /opt/qemu/4.0.0/bin/qemu-system-x86_64 'qcrypto*'
 +    $ qemu-trace-stap list /opt/qemu/4.0.0/bin/qemu-kvm 'qcrypto*'
 .. option:: run OPTIONS BINARY PATTERN...
@@ -90,18 +90,18 @@ The following commands are valid:
     Restrict the tracing session so that it only triggers for the process
     identified by *PID*.
 -  For example, to monitor all processes executing ``qemu-system-x86_64``
 +  For example, to monitor all processes executing ``qemu-kvm``
   as found on ``$PATH``, displaying all I/O related probes:
   ::
 -    $ qemu-trace-stap run qemu-system-x86_64 'qio*'
 +    $ qemu-trace-stap run qemu-kvm 'qio*'
   To monitor only the QEMU process with PID 1732
   ::
 -    $ qemu-trace-stap run --pid=1732 qemu-system-x86_64 'qio*'
 +    $ qemu-trace-stap run --pid=1732 qemu-kvm 'qio*'
   To monitor QEMU processes running an alternative binary outside of
   ``$PATH``, displaying verbose information about setup of the
@@ -109,7 +109,7 @@ The following commands are valid:
   ::
 -    $ qemu-trace-stap -v run /opt/qemu/4.0.0/qemu-system-x86_64 'qio*'
 +    $ qemu-trace-stap -v run /opt/qemu/4.0.0/qemu-kvm 'qio*'
 See also
 --------
 diff --git a/qemu-options.hx b/qemu-options.hx
 index ae2c6dbbfc..94c4a8dbaf 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
@@ -3150,11 +3150,11 @@ SRST
     ::
 -        qemu -m 512 -object memory-backend-file,id=mem,size=512M,mem-path=/hugetlbfs,share=on \
 -             -numa node,memdev=mem \
 -             -chardev socket,id=chr0,path=/path/to/socket \
 -             -netdev type=vhost-user,id=net0,chardev=chr0 \
 -             -device virtio-net-pci,netdev=net0
 +        qemu-kvm -m 512 -object memory-backend-file,id=mem,size=512M,mem-path=/hugetlbfs,share=on \
 +                 -numa node,memdev=mem \
 +                 -chardev socket,id=chr0,path=/path/to/socket \
 +                 -netdev type=vhost-user,id=net0,chardev=chr0 \
 +                 -device virtio-net-pci,netdev=net0
 ``-netdev vhost-vdpa,vhostdev=/path/to/dev``
     Establish a vhost-vdpa netdev.
 -- 
 2.27.0
--- a/SOURCES/0017-virtio-scsi-Reject-scsi-cd-if-data-plane-enabled-RHE.patch
+++ b/SOURCES/0017-virtio-scsi-Reject-scsi-cd-if-data-plane-enabled-RHE.patch
@ -0,0 +1,66 @@
 From d95768c039a2bf6b68422f83a8d55dad41bd3181 Mon Sep 17 00:00:00 2001
 From: Fam Zheng <famz@redhat.com>
 Date: Wed, 14 Jun 2017 15:37:01 +0200
 Subject: virtio-scsi: Reject scsi-cd if data plane enabled [RHEL only]
 RH-Author: Fam Zheng <famz@redhat.com>
 Message-id: <20170614153701.14757-1-famz@redhat.com>
 Patchwork-id: 75613
 O-Subject: [RHV-7.4 qemu-kvm-rhev PATCH v3] virtio-scsi: Reject scsi-cd if data plane enabled [RHEL only]
 Bugzilla: 1378816
 RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Max Reitz <mreitz@redhat.com>
 We need a fix for RHEL 7.4 and 7.3.z, but unfortunately upstream isn't
 ready. If it were, the changes will be too invasive. To have an idea:
 https://lists.gnu.org/archive/html/qemu-devel/2017-05/msg05400.html
 is an incomplete attempt to fix part of the issue, and the remaining
 work unfortunately involve even more complex changes.
 As a band-aid, this partially reverts the effect of ef8875b
 (virtio-scsi: Remove op blocker for dataplane, since v2.7). We cannot
 simply revert that commit as a whole because we already shipped it in
 qemu-kvm-rhev 7.3, since when, block jobs has been possible.  We should
 only block what has been broken.  Also, faithfully reverting the above
 commit means adding back the removed op blocker, but that is not enough,
 because it still crashes when inserting media into an initially empty
 scsi-cd.
 All in all, scsi-cd on virtio-scsi-dataplane has basically been unusable
 unless the scsi-cd never enters an empty state, so, disable it
 altogether.  Otherwise it would be much more difficult to avoid
 crashing.
 Signed-off-by: Fam Zheng <famz@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/scsi/virtio-scsi.c | 9 +++++++++
 1 file changed, 9 insertions(+)
 diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
 index 51fd09522a..a35257c35a 100644
 --- a/hw/scsi/virtio-scsi.c
 +++ b/hw/scsi/virtio-scsi.c
@@ -896,6 +896,15 @@ static void virtio_scsi_hotplug(HotplugHandler *hotplug_dev, DeviceState *dev,
     AioContext *old_context;
     int ret;
 +    /* XXX: Remove this check once block backend is capable of handling
 +     * AioContext change upon eject/insert.
 +     * s->ctx is NULL if ioeventfd is off, s->ctx is qemu_get_aio_context() if
 +     * data plane is not used, both cases are safe for scsi-cd. */
 +    if (s->ctx && s->ctx != qemu_get_aio_context() &&
 +        object_dynamic_cast(OBJECT(dev), "scsi-cd")) {
 +        error_setg(errp, "scsi-cd is not supported by data plane");
 +        return;
 +    }
     if (s->ctx && !s->dataplane_fenced) {
         if (blk_op_is_blocked(sd->conf.blk, BLOCK_OP_TYPE_DATAPLANE, errp)) {
             return;
 -- 
 2.27.0
--- a/SOURCES/0018-BZ1653590-Require-at-least-64kiB-pages-for-downstrea.patch
+++ b/SOURCES/0018-BZ1653590-Require-at-least-64kiB-pages-for-downstrea.patch
@ -0,0 +1,60 @@
 From 92bb62c47eab021f8dabecd09b5fbc1706e6a29c Mon Sep 17 00:00:00 2001
 From: David Gibson <dgibson@redhat.com>
 Date: Wed, 6 Feb 2019 03:58:56 +0000
 Subject: BZ1653590: Require at least 64kiB pages for downstream guests & hosts
 RH-Author: David Gibson <dgibson@redhat.com>
 Message-id: <20190206035856.19058-1-dgibson@redhat.com>
 Patchwork-id: 84246
 O-Subject: [RHELAV-8.0/rhel qemu-kvm PATCH] BZ1653590: Require at least 64kiB pages for downstream guests & hosts
 Bugzilla: 1653590
 RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
 RH-Acked-by: Serhii Popovych <spopovyc@redhat.com>
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 Most current POWER guests require 64kiB page support, so that's the default
 for the cap-hpt-max-pagesize option in qemu which limits available guest
 page sizes.  We warn if the value is set smaller than that, but don't
 outright fail upstream, because we need to allow for the possibility of
 guest (and/or host) kernels configured for 4kiB page sizes.
 Downstream, however, we simply don't support 4kiB pagesize configured
 kernels in guest or host, so we can have qemu simply error out in this
 situation.
 Testing: Attempted to start a guest with cap-hpt-max-page-size=4k and verified
         it failed immediately with a qemu error
 Signed-off-by: David Gibson <dgibson@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/ppc/spapr_caps.c | 7 +++++++
 1 file changed, 7 insertions(+)
 diff --git a/hw/ppc/spapr_caps.c b/hw/ppc/spapr_caps.c
 index ed7c077a0d..48a8efe678 100644
 --- a/hw/ppc/spapr_caps.c
 +++ b/hw/ppc/spapr_caps.c
@@ -332,12 +332,19 @@ bool spapr_check_pagesize(SpaprMachineState *spapr, hwaddr pagesize,
 static void cap_hpt_maxpagesize_apply(SpaprMachineState *spapr,
                                       uint8_t val, Error **errp)
 {
 +#if 0 /* disabled for RHEL */
     if (val < 12) {
         error_setg(errp, "Require at least 4kiB hpt-max-page-size");
         return;
     } else if (val < 16) {
         warn_report("Many guests require at least 64kiB hpt-max-page-size");
     }
 +#else /* Only page sizes >=64kiB supported for RHEL */
 +    if (val < 16) {
 +        error_setg(errp, "Require at least 64kiB hpt-max-page-size");
 +        return;
 +    }
 +#endif
     spapr_check_pagesize(spapr, qemu_minrampagesize(), errp);
 }
 -- 
 2.27.0
--- a/SOURCES/0019-compat-Update-hw_compat_rhel_8_5.patch
+++ b/SOURCES/0019-compat-Update-hw_compat_rhel_8_5.patch
@ -0,0 +1,53 @@
 From a9b5da617c29f48199cbea08d6a1c083877dce10 Mon Sep 17 00:00:00 2001
 From: Laurent Vivier <lvivier@redhat.com>
 Date: Mon, 15 Nov 2021 14:22:29 +0100
 Subject: compat: Update hw_compat_rhel_8_5
 RH-Author: Laurent Vivier <lvivier@redhat.com>
 RH-MergeRequest: 66: redhat: Update pseries-rhel8.5.0 machine type
 RH-Commit: [1/2] 232f2ad2b29d250fbdb8fcea9d814704c575ba2b
 RH-Bugzilla: 2022608
 RH-Acked-by: Eric Auger <eric.auger@redhat.com>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: Greg Kurz <gkurz@redhat.com>
 Add properties from hw_compat_6_1 as it already includes the ones from
 hw_compat_6_0. Add a lately added property from 6.0 too.
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 --
 Rebase notes (6.2.0 rc3):
 - Included compatc changes introduced in RC2
 ---
 hw/core/machine.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index 62febde5aa..736c765c30 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -38,7 +38,7 @@
 #include "hw/virtio/virtio-pci.h"
 /*
 - * Mostly the same as hw_compat_6_0
 + * Mostly the same as hw_compat_6_0 and hw_compat_6_1
  */
 GlobalProperty hw_compat_rhel_8_5[] = {
     /* hw_compat_rhel_8_5 from hw_compat_6_0 */
@@ -51,6 +51,12 @@ GlobalProperty hw_compat_rhel_8_5[] = {
     { "e1000", "init-vet", "off" },
     /* hw_compat_rhel_8_5 from hw_compat_6_0 */
     { "e1000e", "init-vet", "off" },
 +    /* hw_compat_rhel_8_5 from hw_compat_6_0 */
 +    { "vhost-vsock-device", "seqpacket", "off" },
 +    /* hw_compat_rhel_8_5 from hw_compat_6_1 */
 +    { "vhost-user-vsock-device", "seqpacket", "off" },
 +    /* hw_compat_rhel_8_5 from hw_compat_6_1 */
 +    { "nvme-ns", "shared", "off" },
 };
 const size_t hw_compat_rhel_8_5_len = G_N_ELEMENTS(hw_compat_rhel_8_5);
 -- 
 2.27.0
--- a/SOURCES/0020-redhat-Update-pseries-rhel8.5.0-machine-type.patch
+++ b/SOURCES/0020-redhat-Update-pseries-rhel8.5.0-machine-type.patch
@ -0,0 +1,43 @@
 From 82358c35f04f026820b3907069a6c19cd95b654d Mon Sep 17 00:00:00 2001
 From: Laurent Vivier <lvivier@redhat.com>
 Date: Mon, 15 Nov 2021 14:25:33 +0100
 Subject: redhat: Update pseries-rhel8.5.0 machine type
 RH-Author: Laurent Vivier <lvivier@redhat.com>
 RH-MergeRequest: 66: redhat: Update pseries-rhel8.5.0 machine type
 RH-Commit: [2/2] 36f7ad1ea56baaaecb139875ad0a90a6470196be
 RH-Bugzilla: 2022608
 RH-Acked-by: Eric Auger <eric.auger@redhat.com>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: Greg Kurz <gkurz@redhat.com>
 `
 We don't introduce a new machine type for rhel8.6.0 but we need
 to keep compatibility with rhel8.5.0 machine type.
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 ---
 hw/ppc/spapr.c | 4 ++++
 1 file changed, 4 insertions(+)
 diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
 index cace86028d..2f27888d8a 100644
 --- a/hw/ppc/spapr.c
 +++ b/hw/ppc/spapr.c
@@ -5177,10 +5177,14 @@ static void spapr_machine_rhel_default_class_options(MachineClass *mc)
 static void spapr_machine_rhel850_class_options(MachineClass *mc)
 {
 +    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 +
     /* The default machine type must apply the RHEL specific defaults */
     spapr_machine_rhel_default_class_options(mc);
     compat_props_add(mc->compat_props, hw_compat_rhel_8_5,
                      hw_compat_rhel_8_5_len);
 +    smc->pre_6_2_numa_affinity = true;
 +    mc->smp_props.prefer_sockets = true;
 }
 DEFINE_SPAPR_MACHINE(rhel850, "rhel8.5.0", true);
 -- 
 2.27.0
--- a/SOURCES/0021-redhat-virt-rhel8.5.0-Update-machine-type-compatibil.patch
+++ b/SOURCES/0021-redhat-virt-rhel8.5.0-Update-machine-type-compatibil.patch
@ -0,0 +1,51 @@
 From ce73e939b993cc6be170cdb5d3f2068270593f2b Mon Sep 17 00:00:00 2001
 From: Eric Auger <eric.auger@redhat.com>
 Date: Tue, 16 Nov 2021 17:03:07 +0100
 Subject: redhat: virt-rhel8.5.0: Update machine type compatibility for QEMU
 6.2.0 update
 RH-Author: Eric Auger <eric.auger@redhat.com>
 RH-MergeRequest: 75: redhat: virt-rhel8.5.0: Update machine type compatibility for QEMU 6.2.0 update
 RH-Commit: [21/21] f027d13654944e3d34e3356affe7af952eec2bed
 RH-Bugzilla: 2022607
 RH-Acked-by: Gavin Shan <gshan@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: Andrew Jones <drjones@redhat.com>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
 To keep compatibility with 8.5-AV machine type we need to
 turn few new options on by default:
 smp_props.prefer_sockets, no_cpu_topology, no_tcg_its
 TESTED: migrate from rhel-av-8.5.0 to rhel-8.6.0 and vice-versa
 with upstream fix: 33a0c404fb  hw/intc/arm_gicv3_its: Revert version
 increments in vmstate_its
 Signed-off-by: Eric Auger <eric.auger@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/arm/virt.c | 5 +++++
 1 file changed, 5 insertions(+)
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index c77d26ab13..e8941afd01 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
@@ -3225,8 +3225,13 @@ type_init(rhel_machine_init);
 static void rhel850_virt_options(MachineClass *mc)
 {
 +    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
 +
     compat_props_add(mc->compat_props, arm_rhel_compat, arm_rhel_compat_len);
     compat_props_add(mc->compat_props, hw_compat_rhel_8_5, hw_compat_rhel_8_5_len);
 +    mc->smp_props.prefer_sockets = true;
 +    vmc->no_cpu_topology = true;
 +    vmc->no_tcg_its = true;
 }
 DEFINE_RHEL_MACHINE_AS_LATEST(8, 5, 0)
 -- 
 2.27.0
--- a/SOURCES/0022-Fix-virtio-net-pci-vectors-compat.patch
+++ b/SOURCES/0022-Fix-virtio-net-pci-vectors-compat.patch
@ -0,0 +1,45 @@
 From f9643b6934657292aae0b830627b1e5f9b8cbaa1 Mon Sep 17 00:00:00 2001
 From: Eduardo Habkost <ehabkost@redhat.com>
 Date: Tue, 19 Oct 2021 13:17:06 -0400
 Subject: Fix virtio-net-pci* "vectors" compat
 RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-MergeRequest: 77: 8.6/6.2 mt fixes
 RH-Commit: [21/23] 8ad581932275d2698a99f31bec40b14f1dbd3d2e
 RH-Bugzilla: 2026443
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 hw_compat_rhel_8_4 has an issue: it affects only "virtio-net-pci"
 but not "virtio-net-pci-transitional" and
 "virtio-net-pci-non-transitional".  The solution is to use the
 "virtio-net-pci-base" type in compat_props.
 An equivalent fix will be submitted for hw_compat_5_2 upstream.
 Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
 (cherry picked from commit d45823ab0d0138b2fbaf2ed1e1896d2052f3ccb3)
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/core/machine.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index 736c765c30..024b025fc2 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -71,7 +71,11 @@ GlobalProperty hw_compat_rhel_8_4[] = {
     /* hw_compat_rhel_8_4 from hw_compat_5_2 */
     { "virtio-blk-device", "report-discard-granularity", "off" },
     /* hw_compat_rhel_8_4 from hw_compat_5_2 */
 -    { "virtio-net-pci", "vectors", "3"},
 +    /*
 +     * Upstream incorrectly had "virtio-net-pci" instead of "virtio-net-pci-base",
 +     * (https://bugzilla.redhat.com/show_bug.cgi?id=1999141)
 +     */
 +    { "virtio-net-pci-base", "vectors", "3"},
 };
 const size_t hw_compat_rhel_8_4_len = G_N_ELEMENTS(hw_compat_rhel_8_4);
 -- 
 2.27.0
--- a/SOURCES/0023-x86-rhel-machine-types-Add-pc_rhel_8_5_compat.patch
+++ b/SOURCES/0023-x86-rhel-machine-types-Add-pc_rhel_8_5_compat.patch
@ -0,0 +1,73 @@
 From 7ad8814e583dcc7dc23e3e8398570243b8f176a1 Mon Sep 17 00:00:00 2001
 From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
 Date: Tue, 23 Nov 2021 17:57:42 +0000
 Subject: x86/rhel machine types: Add pc_rhel_8_5_compat
 RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-MergeRequest: 77: 8.6/6.2 mt fixes
 RH-Commit: [22/23] 8bf555c5d78f344b97ffd5c888c7a7bed592d9d0
 RH-Bugzilla: 2026443
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 Add pc_rhel_8_5_compat as the merge of pc_compat_6_1 and pc_compat_6_0
 (since 8.5 was based on 6.0).
 Note, x-keep-pci-slot-hpc flipped back and forward, leaving it out
 looks like it leaves us with the original.
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/i386/pc.c         | 21 +++++++++++++++++++++
 include/hw/i386/pc.h |  3 +++
 2 files changed, 24 insertions(+)
 diff --git a/hw/i386/pc.c b/hw/i386/pc.c
 index e8109954ca..4c08a1971c 100644
 --- a/hw/i386/pc.c
 +++ b/hw/i386/pc.c
@@ -387,6 +387,27 @@ GlobalProperty pc_rhel_compat[] = {
 };
 const size_t pc_rhel_compat_len = G_N_ELEMENTS(pc_rhel_compat);
 +GlobalProperty pc_rhel_8_5_compat[] = {
 +    /* pc_rhel_8_5_compat from pc_compat_6_0 */
 +    { "qemu64" "-" TYPE_X86_CPU, "family", "6" },
 +    /* pc_rhel_8_5_compat from pc_compat_6_0 */
 +    { "qemu64" "-" TYPE_X86_CPU, "model", "6" },
 +    /* pc_rhel_8_5_compat from pc_compat_6_0 */
 +    { "qemu64" "-" TYPE_X86_CPU, "stepping", "3" },
 +    /* pc_rhel_8_5_compat from pc_compat_6_0 */
 +    { TYPE_X86_CPU, "x-vendor-cpuid-only", "off" },
 +    /* pc_rhel_8_5_compat from pc_compat_6_0 */
 +    { "ICH9-LPC", ACPI_PM_PROP_ACPI_PCIHP_BRIDGE, "off" },
 +
 +    /* pc_rhel_8_5_compat from pc_compat_6_1 */
 +    { TYPE_X86_CPU, "hv-version-id-build", "0x1bbc" },
 +    /* pc_rhel_8_5_compat from pc_compat_6_1 */
 +    { TYPE_X86_CPU, "hv-version-id-major", "0x0006" },
 +    /* pc_rhel_8_5_compat from pc_compat_6_1 */
 +    { TYPE_X86_CPU, "hv-version-id-minor", "0x0001" },
 +};
 +const size_t pc_rhel_8_5_compat_len = G_N_ELEMENTS(pc_rhel_8_5_compat);
 +
 GlobalProperty pc_rhel_8_4_compat[] = {
     /* pc_rhel_8_4_compat from pc_compat_5_2 */
     { "ICH9-LPC", "x-smi-cpu-hotunplug", "off" },
 diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
 index d0544ee119..9e8bfb69f8 100644
 --- a/include/hw/i386/pc.h
 +++ b/include/hw/i386/pc.h
@@ -286,6 +286,9 @@ extern const size_t pc_compat_1_4_len;
 extern GlobalProperty pc_rhel_compat[];
 extern const size_t pc_rhel_compat_len;
 +extern GlobalProperty pc_rhel_8_5_compat[];
 +extern const size_t pc_rhel_8_5_compat_len;
 +
 extern GlobalProperty pc_rhel_8_4_compat[];
 extern const size_t pc_rhel_8_4_compat_len;
 -- 
 2.27.0
--- a/SOURCES/0024-x86-rhel-machine-types-Wire-compat-into-q35-and-i440.patch
+++ b/SOURCES/0024-x86-rhel-machine-types-Wire-compat-into-q35-and-i440.patch
@ -0,0 +1,54 @@
 From 7bd99eebadfdbea6a76585b526e7cab1ee8b1fde Mon Sep 17 00:00:00 2001
 From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
 Date: Tue, 23 Nov 2021 18:07:49 +0000
 Subject: x86/rhel machine types: Wire compat into q35 and i440fx
 RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-MergeRequest: 77: 8.6/6.2 mt fixes
 RH-Commit: [23/23] fc3861aeccc943b434231193ef45ffbc0b3cf6c6
 RH-Bugzilla: 2026443
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 Wire the pc_rhel_8_5 compat data into both piix and q35
 to keep the existing machine types compatible.
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/i386/pc_piix.c | 4 ++++
 hw/i386/pc_q35.c  | 4 ++++
 2 files changed, 8 insertions(+)
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
 index 2885edffe9..37fab00733 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
@@ -1040,6 +1040,10 @@ static void pc_machine_rhel760_options(MachineClass *m)
     pcmc->kvmclock_create_always = false;
     /* From pc_i440fx_5_1_machine_options() */
     pcmc->pci_root_uid = 1;
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_5,
 +                     hw_compat_rhel_8_5_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_5_compat,
 +                     pc_rhel_8_5_compat_len);
     compat_props_add(m->compat_props, hw_compat_rhel_8_4,
                      hw_compat_rhel_8_4_len);
     compat_props_add(m->compat_props, pc_rhel_8_4_compat,
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
 index c67418b6a9..78876e1101 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
@@ -658,6 +658,10 @@ static void pc_q35_machine_rhel850_options(MachineClass *m)
     m->desc = "RHEL-8.5.0 PC (Q35 + ICH9, 2009)";
     pcmc->smbios_stream_product = "RHEL-AV";
     pcmc->smbios_stream_version = "8.5.0";
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_5,
 +                     hw_compat_rhel_8_5_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_5_compat,
 +                     pc_rhel_8_5_compat_len);
 }
 DEFINE_PC_MACHINE(q35_rhel850, "pc-q35-rhel8.5.0", pc_q35_init_rhel850,
 -- 
 2.27.0
--- a/SOURCES/0025-redhat-Add-s390x-machine-type-compatibility-handling.patch
+++ b/SOURCES/0025-redhat-Add-s390x-machine-type-compatibility-handling.patch
@ -0,0 +1,58 @@
 From 265a57f2955b7f0b65e3f57f89aa1ff2541d3f73 Mon Sep 17 00:00:00 2001
 From: Thomas Huth <thuth@redhat.com>
 Date: Fri, 26 Nov 2021 09:37:11 +0100
 Subject: redhat: Add s390x machine type compatibility handling for the rebase
 to v6.2
 RH-Author: Thomas Huth <thuth@redhat.com>
 RH-MergeRequest: 80: Add s390x machine type compatibility handling for the rebase to v6.2
 RH-Commit: [26/26] c45cf594604f6dd23954696b9c84d2025e328d11
 RH-Bugzilla: 2022602
 RH-Acked-by: David Hildenbrand <david@redhat.com>
 RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 Add compatibility handling for the rhel8.5.0 machine type (and
 recursively older, of course).
 Based on the following upstream commits:
 463e50da8b - s390x/cpumodel: Bump up QEMU model to a stripped-down IBM z14 GA2
 30e398f796 - s390x/cpumodel: Add more feature to gen16 default model
 4a0af2930a - machine: Prefer cores over sockets in smp parsing since 6.2
 2b52619994 - machine: Move smp_prefer_sockets to struct SMPCompatProps
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 ---
 hw/s390x/s390-virtio-ccw.c | 10 ++++++++++
 1 file changed, 10 insertions(+)
 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
 index 181856e6cf..cf13c457d6 100644
 --- a/hw/s390x/s390-virtio-ccw.c
 +++ b/hw/s390x/s390-virtio-ccw.c
@@ -1105,11 +1105,21 @@ DEFINE_CCW_MACHINE(2_4, "2.4", false);
 static void ccw_machine_rhel850_instance_options(MachineState *machine)
 {
 +    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V6_0 };
 +
 +    s390_set_qemu_cpu_model(0x2964, 13, 2, qemu_cpu_feat);
 +
 +    s390_cpudef_featoff_greater(16, 1, S390_FEAT_NNPA);
 +    s390_cpudef_featoff_greater(16, 1, S390_FEAT_VECTOR_PACKED_DECIMAL_ENH2);
 +    s390_cpudef_featoff_greater(16, 1, S390_FEAT_BEAR_ENH);
 +    s390_cpudef_featoff_greater(16, 1, S390_FEAT_RDP);
 +    s390_cpudef_featoff_greater(16, 1, S390_FEAT_PAI);
 }
 static void ccw_machine_rhel850_class_options(MachineClass *mc)
 {
     compat_props_add(mc->compat_props, hw_compat_rhel_8_5, hw_compat_rhel_8_5_len);
 +    mc->smp_props.prefer_sockets = true;
 }
 DEFINE_CCW_MACHINE(rhel850, "rhel8.5.0", true);
 -- 
 2.27.0
--- a/SOURCES/81-kvm-rhel.rules
+++ b/SOURCES/81-kvm-rhel.rules
@ -0,0 +1 @@
 DEVPATH=="*/kvm", ACTION=="change", RUN+="/lib/udev/udev-kvm-check $env{COUNT} $env{EVENT}"
--- a/SOURCES/85-kvm.preset
+++ b/SOURCES/85-kvm.preset
@ -0,0 +1,5 @@
 # Enable kvm-setup by default.  This can have odd side effects on
 # PowerNV systems that aren't intended as KVM hosts, but at present we
 # only support RHEL on PowerNV for the purpose of being a RHEV host.
 enable kvm-setup.service
--- a/SOURCES/README.tests
+++ b/SOURCES/README.tests
@ -28,7 +28,7 @@ avocado_qemu tests:
 The avocado_qemu tests can be executed by running the following avocado command:
 avocado run -p qemu_bin=/usr/libexec/qemu-kvm /usr/lib64/qemu-kvm/tests/acceptance/
 Avocado needs to be installed separately using either pip or from source as
-Avocado is not being packaged for RHEL.
+Avocado is not being packaged for RHEL-8.
 qemu-iotests:
 symlinks to corresponding binaries need to be created for QEMU_PROG,
@ -36,4 +36,4 @@ QEMU_IO_PROG, QEMU_IMG_PROG, and QEMU_NBD_PROG before the iotests can be
 executed.
 The primary purpose of this package is to make these tests available to be
-executed as gating tests for the qemu-kvm in the RHEL OSCI environment.
+executed as gating tests for the virt module in the RHEL-8 OSCI environment.
--- a/SOURCES/ksm.service
+++ b/SOURCES/ksm.service
@ -0,0 +1,13 @@
 [Unit]
 Description=Kernel Samepage Merging
 ConditionPathExists=/sys/kernel/mm/ksm
 [Service]
 Type=oneshot
 RemainAfterExit=yes
 EnvironmentFile=-/etc/sysconfig/ksm
 ExecStart=/usr/libexec/ksmctl start
 ExecStop=/usr/libexec/ksmctl stop
 [Install]
 WantedBy=multi-user.target
--- a/SOURCES/ksm.sysconfig
+++ b/SOURCES/ksm.sysconfig
@ -0,0 +1,4 @@
 # The maximum number of unswappable kernel pages
 # which may be allocated by ksm (0 for unlimited)
 # If unset, defaults to half of total memory
 # KSM_MAX_KERNEL_PAGES=
--- a/SOURCES/ksmctl.c
+++ b/SOURCES/ksmctl.c
@ -0,0 +1,77 @@
 /* Start/stop KSM, for systemd.
 * Copyright (C) 2009, 2011 Red Hat, Inc.
 * Written by Paolo Bonzini <pbonzini@redhat.com>.
 * Based on the original sysvinit script by Dan Kenigsberg <danken@redhat.com>
 * This file is distributed under the GNU General Public License, version 2
 * or later.  */
 #include <unistd.h>
 #include <stdio.h>
 #include <limits.h>
 #include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
 #define KSM_MAX_KERNEL_PAGES_FILE "/sys/kernel/mm/ksm/max_kernel_pages"
 #define KSM_RUN_FILE		  "/sys/kernel/mm/ksm/run"
 char *program_name;
 int usage(void)
 {
 	fprintf(stderr, "Usage: %s {start|stop}\n", program_name);
 	return 1;
 }
 int write_value(uint64_t value, char *filename)
 {
 	FILE *fp;
 	if (!(fp = fopen(filename, "w")) ||
 	    fprintf(fp, "%llu\n", (unsigned long long) value) == EOF ||
 	    fflush(fp) == EOF ||
 	    fclose(fp) == EOF)
 		return 1;
 	return 0;
 }
 uint64_t ksm_max_kernel_pages()
 {
 	char *var = getenv("KSM_MAX_KERNEL_PAGES");
 	char *endptr;
 	uint64_t value;
 	if (var && *var) {
 		value = strtoll(var, &endptr, 0);
 		if (value < LLONG_MAX && !*endptr)
 			return value;
 	}
 	/* Unless KSM_MAX_KERNEL_PAGES is set, let KSM munch up to half of
 	 * total memory.  */
 	return sysconf(_SC_PHYS_PAGES) / 2;
 }
 int start(void)
 {
 	if (access(KSM_MAX_KERNEL_PAGES_FILE, R_OK) >= 0)
 		write_value(ksm_max_kernel_pages(), KSM_MAX_KERNEL_PAGES_FILE);
 	return write_value(1, KSM_RUN_FILE);
 }
 int stop(void)
 {
 	return write_value(0, KSM_RUN_FILE);
 }
 int main(int argc, char **argv)
 {
 	program_name = argv[0];
 	if (argc < 2) {
 		return usage();
 	} else if (!strcmp(argv[1], "start")) {
 		return start();
 	} else if (!strcmp(argv[1], "stop")) {
 		return stop();
 	} else {
 		return usage();
 	}
 }
--- a/SOURCES/ksmtuned
+++ b/SOURCES/ksmtuned
@ -0,0 +1,139 @@
 #!/bin/bash
 #
 # Copyright 2009 Red Hat, Inc. and/or its affiliates.
 # Released under the GPL
 #
 # Author:      Dan Kenigsberg <danken@redhat.com>
 #
 # ksmtuned - a simple script that controls whether (and with what vigor) ksm
 # should search for duplicated pages.
 #
 # starts ksm when memory commited to qemu processes exceeds a threshold, and
 # make ksm work harder and harder untill memory load falls below that
 # threshold.
 #
 # send SIGUSR1 to this process right after a new qemu process is started, or
 # following its death, to retune ksm accordingly
 #
 # needs testing and ironing. contact danken@redhat.com if something breaks.
 if [ -f /etc/ksmtuned.conf ]; then
    . /etc/ksmtuned.conf
 fi
 debug() {
    if [ -n "$DEBUG" ]; then
        s="`/bin/date`: $*"
        [ -n "$LOGFILE" ] && echo "$s" >> "$LOGFILE" || echo "$s"
    fi
 }
 KSM_MONITOR_INTERVAL=${KSM_MONITOR_INTERVAL:-60}
 KSM_NPAGES_BOOST=${KSM_NPAGES_BOOST:-300}
 KSM_NPAGES_DECAY=${KSM_NPAGES_DECAY:--50}
 KSM_NPAGES_MIN=${KSM_NPAGES_MIN:-64}
 KSM_NPAGES_MAX=${KSM_NPAGES_MAX:-1250}
 # millisecond sleep between ksm scans for 16Gb server. Smaller servers sleep
 # more, bigger sleep less.
 KSM_SLEEP_MSEC=${KSM_SLEEP_MSEC:-10}
 KSM_THRES_COEF=${KSM_THRES_COEF:-20}
 KSM_THRES_CONST=${KSM_THRES_CONST:-2048}
 total=`awk '/^MemTotal:/ {print $2}' /proc/meminfo`
 debug total $total
 npages=0
 sleep=$[KSM_SLEEP_MSEC * 16 * 1024 * 1024 / total]
 [ $sleep -le 10 ] && sleep=10
 debug sleep $sleep
 thres=$[total * KSM_THRES_COEF / 100]
 if [ $KSM_THRES_CONST -gt $thres ]; then
    thres=$KSM_THRES_CONST
 fi
 debug thres $thres
 KSMCTL () {
    case x$1 in
        xstop)
            echo 0 > /sys/kernel/mm/ksm/run
            ;;
        xstart)
            echo $2 > /sys/kernel/mm/ksm/pages_to_scan
            echo $3 > /sys/kernel/mm/ksm/sleep_millisecs
            echo 1 > /sys/kernel/mm/ksm/run
            ;;
    esac
 }
 committed_memory () {
    # calculate how much memory is committed to running qemu processes
    local pidlist
    pidlist=$(pgrep -d ' ' -- '^qemu(-(kvm|system-.+)|:.{1,11})$')
    if [ -n "$pidlist" ]; then
        ps -p "$pidlist" -o rsz=
    fi | awk '{ sum += $1 }; END { print 0+sum }'
 }
 free_memory () {
    awk '/^(MemFree|Buffers|Cached):/ {free += $2}; END {print free}' \
                /proc/meminfo
 }
 increase_npages() {
    local delta
    delta=${1:-0}
    npages=$[npages + delta]
    if [ $npages -lt $KSM_NPAGES_MIN ]; then
        npages=$KSM_NPAGES_MIN
    elif [ $npages -gt $KSM_NPAGES_MAX ]; then
        npages=$KSM_NPAGES_MAX
    fi
    echo $npages
 }
 adjust () {
    local free committed
    free=`free_memory`
    committed=`committed_memory`
    debug committed $committed free $free
    if [ $[committed + thres] -lt $total -a $free -gt $thres ]; then
        KSMCTL stop
        debug "$[committed + thres] < $total and free > $thres, stop ksm"
        return 1
    fi
    debug "$[committed + thres] > $total, start ksm"
    if [ $free -lt $thres ]; then
        npages=`increase_npages $KSM_NPAGES_BOOST`
        debug "$free < $thres, boost"
    else
        npages=`increase_npages $KSM_NPAGES_DECAY`
        debug "$free > $thres, decay"
    fi
    KSMCTL start $npages $sleep
    debug "KSMCTL start $npages $sleep"
    return 0
 }
 function nothing () {
    :
 }
 loop () {
    trap nothing SIGUSR1
    while true
    do
        sleep $KSM_MONITOR_INTERVAL &
        wait $!
        adjust
    done
 }
 PIDFILE=${PIDFILE-/var/run/ksmtune.pid}
 if touch "$PIDFILE"; then
  loop &
  echo $! > "$PIDFILE"
 fi
--- a/SOURCES/ksmtuned.conf
+++ b/SOURCES/ksmtuned.conf
@ -0,0 +1,21 @@
 # Configuration file for ksmtuned.
 # How long ksmtuned should sleep between tuning adjustments
 # KSM_MONITOR_INTERVAL=60
 # Millisecond sleep between ksm scans for 16Gb server.
 # Smaller servers sleep more, bigger sleep less.
 # KSM_SLEEP_MSEC=10
 # KSM_NPAGES_BOOST=300
 # KSM_NPAGES_DECAY=-50
 # KSM_NPAGES_MIN=64
 # KSM_NPAGES_MAX=1250
 # KSM_THRES_COEF=20
 # KSM_THRES_CONST=2048
 # uncomment the following if you want ksmtuned debug info
 # LOGFILE=/var/log/ksmtuned
 # DEBUG=1
--- a/SOURCES/ksmtuned.service
+++ b/SOURCES/ksmtuned.service
@ -0,0 +1,12 @@
 [Unit]
 Description=Kernel Samepage Merging (KSM) Tuning Daemon
 After=ksm.service
 Requires=ksm.service
 [Service]
 ExecStart=/usr/sbin/ksmtuned
 ExecReload=/bin/kill -USR1 $MAINPID
 Type=forking
 [Install]
 WantedBy=multi-user.target
--- a/SOURCES/kvm-Add-dirty-sync-missed-zero-copy-migration-stat.patch
+++ b/SOURCES/kvm-Add-dirty-sync-missed-zero-copy-migration-stat.patch
@ -0,0 +1,87 @@
 From cd49a32e9c9e33efc51652b68180a07683814b4d Mon Sep 17 00:00:00 2001
 From: Leonardo Bras <leobras@redhat.com>
 Date: Mon, 11 Jul 2022 18:11:12 -0300
 Subject: [PATCH 4/9] Add dirty-sync-missed-zero-copy migration stat
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Leonardo Brás <leobras@redhat.com>
 RH-MergeRequest: 201: Zero-copy-send fixes + improvements
 RH-Commit: [4/8] 56cce61cf95aafc8dafae7531b43c166084abfec
 RH-Bugzilla: 2110203
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 Acked-by: Markus Armbruster <armbru@redhat.com>
 Acked-by: Peter Xu <peterx@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 Message-Id: <20220711211112.18951-3-leobras@redhat.com>
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 (cherry picked from commit cf20c897338067ab4b70a4596fdccaf90c7e29a1)
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 ---
 migration/migration.c | 2 ++
 monitor/hmp-cmds.c    | 5 +++++
 qapi/migration.json   | 7 ++++++-
 3 files changed, 13 insertions(+), 1 deletion(-)
 diff --git a/migration/migration.c b/migration/migration.c
 index e100b30f00..952a26c5c2 100644
 --- a/migration/migration.c
 +++ b/migration/migration.c
@@ -1012,6 +1012,8 @@ static void populate_ram_info(MigrationInfo *info, MigrationState *s)
     info->ram->normal_bytes = ram_counters.normal * page_size;
     info->ram->mbps = s->mbps;
     info->ram->dirty_sync_count = ram_counters.dirty_sync_count;
 +    info->ram->dirty_sync_missed_zero_copy =
 +            ram_counters.dirty_sync_missed_zero_copy;
     info->ram->postcopy_requests = ram_counters.postcopy_requests;
     info->ram->page_size = page_size;
     info->ram->multifd_bytes = ram_counters.multifd_bytes;
 diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
 index 8c384dc1b2..f7216ab5d0 100644
 --- a/monitor/hmp-cmds.c
 +++ b/monitor/hmp-cmds.c
@@ -305,6 +305,11 @@ void hmp_info_migrate(Monitor *mon, const QDict *qdict)
             monitor_printf(mon, "postcopy ram: %" PRIu64 " kbytes\n",
                            info->ram->postcopy_bytes >> 10);
         }
 +        if (info->ram->dirty_sync_missed_zero_copy) {
 +            monitor_printf(mon,
 +                           "Zero-copy-send fallbacks happened: %" PRIu64 " times\n",
 +                           info->ram->dirty_sync_missed_zero_copy);
 +        }
     }
     if (info->has_disk) {
 diff --git a/qapi/migration.json b/qapi/migration.json
 index c8ec260ab0..94bc5c69db 100644
 --- a/qapi/migration.json
 +++ b/qapi/migration.json
@@ -55,6 +55,10 @@
 # @postcopy-bytes: The number of bytes sent during the post-copy phase
 #                  (since 7.0).
 #
 +# @dirty-sync-missed-zero-copy: Number of times dirty RAM synchronization could
 +#                               not avoid copying dirty pages. This is between
 +#                               0 and @dirty-sync-count * @multifd-channels.
 +#                               (since 7.1)
 # Since: 0.14
 ##
 { 'struct': 'MigrationStats',
@@ -65,7 +69,8 @@
            'postcopy-requests' : 'int', 'page-size' : 'int',
            'multifd-bytes' : 'uint64', 'pages-per-second' : 'uint64',
            'precopy-bytes' : 'uint64', 'downtime-bytes' : 'uint64',
 -           'postcopy-bytes' : 'uint64' } }
 +           'postcopy-bytes' : 'uint64',
 +           'dirty-sync-missed-zero-copy' : 'uint64' } }
 ##
 # @XBZRLECacheStats:
 -- 
 2.31.1
--- a/SOURCES/kvm-Compile-IOMMUFD-object-on-aarch64.patch
+++ b/SOURCES/kvm-Compile-IOMMUFD-object-on-aarch64.patch
@ -1,37 +0,0 @@
 From 363d6aedc82314a70bdfbe9fa23b7e8fdda50138 Mon Sep 17 00:00:00 2001
 From: Eric Auger <eric.auger@redhat.com>
 Date: Thu, 11 Jan 2024 12:26:19 -0500
 Subject: [PATCH 066/101] Compile IOMMUFD object on aarch64
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Eric Auger <eric.auger@redhat.com>
 RH-MergeRequest: 211: IOMMUFD backend backport
 RH-Jira: RHEL-19302 RHEL-21057
 RH-Acked-by: Cédric Le Goater <clg@redhat.com>
 RH-Acked-by: Sebastian Ott <sebott@redhat.com>
 RH-Commit: [65/67] 9358030fdd499c5fe122dee3bb4f114966fac9c2 (eauger1/centos-qemu-kvm)
 Upstream: RHEL only
 Compiles the IOMMUFD object on aarch64 to be able to use
 the IOMMUFD VFIO backend.
 Signed-off-by: Eric Auger <eric.auger@redhat.com>
 ---
 configs/devices/aarch64-softmmu/aarch64-rh-devices.mak | 1 +
 1 file changed, 1 insertion(+)
 diff --git a/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak b/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
 index aec1831199..b0191d3c69 100644
 --- a/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
 +++ b/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
@@ -39,3 +39,4 @@ CONFIG_PXB=y
 CONFIG_VHOST_VSOCK=y
 CONFIG_VHOST_USER_VSOCK=y
 CONFIG_VHOST_USER_FS=y
 +CONFIG_IOMMUFD=y
 -- 
 2.39.3
--- a/SOURCES/kvm-Compile-IOMMUFD-on-s390x.patch
+++ b/SOURCES/kvm-Compile-IOMMUFD-on-s390x.patch
@ -1,37 +0,0 @@
 From c1e9ddf8d0ea6d358fcaa5cacd3a91920f36e73b Mon Sep 17 00:00:00 2001
 From: Eric Auger <eric.auger@redhat.com>
 Date: Thu, 11 Jan 2024 12:33:17 -0500
 Subject: [PATCH 067/101] Compile IOMMUFD on s390x
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Eric Auger <eric.auger@redhat.com>
 RH-MergeRequest: 211: IOMMUFD backend backport
 RH-Jira: RHEL-19302 RHEL-21057
 RH-Acked-by: Cédric Le Goater <clg@redhat.com>
 RH-Acked-by: Sebastian Ott <sebott@redhat.com>
 RH-Commit: [66/67] d3004aafca2bb76d817ac99c3d65973b8fbd4557 (eauger1/centos-qemu-kvm)
 Upstream: RHEL only
 Compiles the IOMMUFD object on s390x to be able to use
 the IOMMUFD VFIO backend.
 Signed-off-by: Eric Auger <eric.auger@redhat.com>
 ---
 configs/devices/s390x-softmmu/s390x-rh-devices.mak | 1 +
 1 file changed, 1 insertion(+)
 diff --git a/configs/devices/s390x-softmmu/s390x-rh-devices.mak b/configs/devices/s390x-softmmu/s390x-rh-devices.mak
 index 69a799adbd..24cf6dbd03 100644
 --- a/configs/devices/s390x-softmmu/s390x-rh-devices.mak
 +++ b/configs/devices/s390x-softmmu/s390x-rh-devices.mak
@@ -16,3 +16,4 @@ CONFIG_WDT_DIAG288=y
 CONFIG_VHOST_VSOCK=y
 CONFIG_VHOST_USER_VSOCK=y
 CONFIG_VHOST_USER_FS=y
 +CONFIG_IOMMUFD=y
 -- 
 2.39.3
--- a/SOURCES/kvm-Compile-IOMMUFD-on-x86_64.patch
+++ b/SOURCES/kvm-Compile-IOMMUFD-on-x86_64.patch
@ -1,37 +0,0 @@
 From be2c3d9bbee1bdec061c901f507bc999fa40a53e Mon Sep 17 00:00:00 2001
 From: Eric Auger <eric.auger@redhat.com>
 Date: Thu, 11 Jan 2024 12:34:44 -0500
 Subject: [PATCH 068/101] Compile IOMMUFD on x86_64
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Eric Auger <eric.auger@redhat.com>
 RH-MergeRequest: 211: IOMMUFD backend backport
 RH-Jira: RHEL-19302 RHEL-21057
 RH-Acked-by: Cédric Le Goater <clg@redhat.com>
 RH-Acked-by: Sebastian Ott <sebott@redhat.com>
 RH-Commit: [67/67] 411d48a5cc7ce1f05be793fd9a89c143ce34c91a (eauger1/centos-qemu-kvm)
 Upstream: RHEL only
 Compiles the IOMMUFD object on s390x to be able to use
 the IOMMUFD VFIO backend.
 Signed-off-by: Eric Auger <eric.auger@redhat.com>
 ---
 configs/devices/x86_64-softmmu/x86_64-rh-devices.mak | 1 +
 1 file changed, 1 insertion(+)
 diff --git a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 index ce5be73633..ba41108e0c 100644
 --- a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 +++ b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
@@ -108,3 +108,4 @@ CONFIG_SGX=y
 CONFIG_VHOST_VSOCK=y
 CONFIG_VHOST_USER_VSOCK=y
 CONFIG_VHOST_USER_FS=y
 +CONFIG_IOMMUFD=y
 -- 
 2.39.3
--- a/SOURCES/kvm-Enable-SGX-RH-Only.patch
+++ b/SOURCES/kvm-Enable-SGX-RH-Only.patch
@ -0,0 +1,28 @@
 From db6e042fe4fdc1a1bbf562a46b15d4d8e33e2fa6 Mon Sep 17 00:00:00 2001
 From: Paul Lai <plai@redhat.com>
 Date: Tue, 25 Jan 2022 15:16:22 -0500
 Subject: [PATCH 4/7] Enable SGX  -- RH Only
 RH-Author: Paul Lai <None>
 RH-MergeRequest: 111: numa: Enable numa for SGX EPC sections
 RH-Commit: [4/5] cea874f29984897ef1232fb7749c13203c888034
 RH-Bugzilla: 1518984
 RH-Acked-by: Paolo Bonzini <None>
 RH-Acked-by: Bandan Das <None>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 ---
 configs/devices/x86_64-softmmu/x86_64-rh-devices.mak | 1 +
 1 file changed, 1 insertion(+)
 diff --git a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 index ddf036f042..fdbbdf9742 100644
 --- a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 +++ b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
@@ -102,3 +102,4 @@ CONFIG_TPM_CRB=y
 CONFIG_TPM_TIS_ISA=y
 CONFIG_TPM_EMULATOR=y
 CONFIG_TPM_PASSTHROUGH=y
 +CONFIG_SGX=y
 -- 
 2.27.0
--- a/SOURCES/kvm-Fix-scanout-version-with-pc-q35-rhel9.4.0.patch
+++ b/SOURCES/kvm-Fix-scanout-version-with-pc-q35-rhel9.4.0.patch
@ -1,128 +0,0 @@
 From ef212eb3026a2460f6502a76afa3baedeb74d975 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
 Date: Tue, 6 Aug 2024 14:14:27 +0400
 Subject: [PATCH 1/5] Fix scanout version with pc-q35-rhel9.4.0
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Marc-André Lureau <marcandre.lureau@redhat.com>
 RH-MergeRequest: 383: Fix scanout version with pc-q35-rhel9.4.0
 RH-Jira: RHEL-53565
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [1/1] ed2860cfb933654b0046c1b59f78d2e50146bd6c
 Resolves: https://issues.redhat.com/browse/RHEL-52940
 Introduce hw_compat_rhel_9_4_extra so that pc-q35-rhel9.4.0 has
 x-scanout-vmstate-version=1
 Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
 ---
 hw/arm/virt.c              |  1 +
 hw/core/machine.c          | 13 +++++++++++--
 hw/i386/pc_piix.c          |  2 ++
 hw/i386/pc_q35.c           |  3 +++
 hw/s390x/s390-virtio-ccw.c |  1 +
 include/hw/boards.h        |  3 +++
 6 files changed, 21 insertions(+), 2 deletions(-)
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index e4a66affcb..851eff6b28 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
@@ -3670,6 +3670,7 @@ type_init(rhel_machine_init);
 static void rhel940_virt_options(MachineClass *mc)
 {
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_4_extra, hw_compat_rhel_9_4_extra_len);
 }
 DEFINE_RHEL_MACHINE_AS_LATEST(9, 4, 0)
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index c8c460c916..fe0a28ef3b 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -64,6 +64,17 @@ const size_t hw_compat_7_2_len = G_N_ELEMENTS(hw_compat_7_2);
 const char *rhel_old_machine_deprecation =
     "machine types for previous major releases are deprecated";
 +/*
 + * rhel_9_4_extra is used for <= 9.4 machines.
 + *
 + * (for compatibility and historical reasons, rhel_9_4 is used for <= 9.2 too)
 + */
 +GlobalProperty hw_compat_rhel_9_4_extra[] = {
 +    /* hw_compat_rhel_9_4_extra from hw_compat_8_2 */
 +    { "virtio-gpu-device", "x-scanout-vmstate-version", "1" },
 +};
 +const size_t hw_compat_rhel_9_4_extra_len = G_N_ELEMENTS(hw_compat_rhel_9_4_extra);
 +
 GlobalProperty hw_compat_rhel_9_4[] = {
   /* hw_compat_rhel_9_4 from hw_compat_8_0 */
     { TYPE_VIRTIO_NET, "host_uso", "off"},
@@ -81,8 +92,6 @@ GlobalProperty hw_compat_rhel_9_4[] = {
      { "igb", "x-pcie-flr-init", "off" },
   /* hw_compat_rhel_9_4 jira RHEL-24045 */
      { "virtio-mem", "dynamic-memslots", "off" },
 -  /* hw_compat_rhel_9_4 from hw_compat_8_1 */
 -    { "virtio-gpu-device", "x-scanout-vmstate-version", "1" },
 };
 const size_t hw_compat_rhel_9_4_len = G_N_ELEMENTS(hw_compat_rhel_9_4);
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
 index 54d1c58bce..c846673d87 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
@@ -1031,6 +1031,8 @@ static void pc_machine_rhel760_options(MachineClass *m)
                                      "Use a different south bridge than PIIX3");
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_4_extra,
 +                     hw_compat_rhel_9_4_extra_len);
     compat_props_add(m->compat_props, hw_compat_rhel_9_4,
                      hw_compat_rhel_9_4_len);
     compat_props_add(m->compat_props, hw_compat_rhel_9_3,
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
 index cd5fb7380e..02bc3d515f 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
@@ -731,6 +731,9 @@ static void pc_q35_machine_rhel940_options(MachineClass *m)
     m->desc = "RHEL-9.4.0 PC (Q35 + ICH9, 2009)";
     pcmc->smbios_stream_product = "RHEL";
     pcmc->smbios_stream_version = "9.4.0";
 +
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_4_extra,
 +                     hw_compat_rhel_9_4_extra_len);
 }
 DEFINE_PC_MACHINE(q35_rhel940, "pc-q35-rhel9.4.0", pc_q35_init_rhel940,
 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
 index 24f4773179..cc6087c37a 100644
 --- a/hw/s390x/s390-virtio-ccw.c
 +++ b/hw/s390x/s390-virtio-ccw.c
@@ -1277,6 +1277,7 @@ static void ccw_machine_rhel940_instance_options(MachineState *machine)
 static void ccw_machine_rhel940_class_options(MachineClass *mc)
 {
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_4_extra, hw_compat_rhel_9_4_extra_len);
 }
 DEFINE_CCW_MACHINE(rhel940, "rhel9.4.0", true);
 diff --git a/include/hw/boards.h b/include/hw/boards.h
 index 4edfdb0ddb..e6ae0e61cf 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
@@ -505,6 +505,9 @@ extern const size_t hw_compat_2_2_len;
 extern GlobalProperty hw_compat_2_1[];
 extern const size_t hw_compat_2_1_len;
 +extern GlobalProperty hw_compat_rhel_9_4_extra[];
 +extern const size_t hw_compat_rhel_9_4_extra_len;
 +
 extern GlobalProperty hw_compat_rhel_9_4[];
 extern const size_t hw_compat_rhel_9_4_len;
 -- 
 2.39.3
--- a/SOURCES/kvm-Fix-thread-pool-size-default-value-in-the-man-page.patch
+++ b/SOURCES/kvm-Fix-thread-pool-size-default-value-in-the-man-page.patch
@ -0,0 +1,36 @@
 From a707eff49800045d07afbcd8a74617c50b960151 Mon Sep 17 00:00:00 2001
 From: German Maglione <gmaglione@redhat.com>
 Date: Thu, 10 Oct 2024 13:23:25 +0200
 Subject: [PATCH] Fix thread-pool-size default value in the man page
 RH-Author: German Maglione <None>
 RH-MergeRequest: 417: Fix thread-pool-size default value in the man page
 RH-Jira: RHEL-26197
 RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
 RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
 RH-Commit: [1/1] bdf22ed4600ac7f02a4b08c54f162b1f89c44a99
 The current --thread-pool-size default value is 0, let's reflect it
 in the man page.
 Signed-off-by: German Maglione <gmaglione@redhat.com>
 ---
 docs/tools/virtiofsd.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/docs/tools/virtiofsd.rst b/docs/tools/virtiofsd.rst
 index 07ac0be551..fb3d59c449 100644
 --- a/docs/tools/virtiofsd.rst
 +++ b/docs/tools/virtiofsd.rst
@@ -120,7 +120,7 @@ Options
 .. option:: --thread-pool-size=NUM
   Restrict the number of worker threads per request queue to NUM.  The default
 -  is 64.
 +  is 0.
 .. option:: --cache=none|auto|always
 -- 
 2.45.2
--- a/SOURCES/kvm-Implement-SMBIOS-type-9-v2.6.patch
+++ b/SOURCES/kvm-Implement-SMBIOS-type-9-v2.6.patch
@ -1,155 +0,0 @@
 From 5c639f8ce65183ce8e44ee8e0230e9d627a440d7 Mon Sep 17 00:00:00 2001
 From: Igor Mammedov <imammedo@redhat.com>
 Date: Wed, 21 Feb 2024 17:00:27 +0000
 Subject: [PATCH 05/20] Implement SMBIOS type 9 v2.6
 RH-Author: Igor Mammedov <imammedo@redhat.com>
 RH-MergeRequest: 230: Workaround Windows failing to find 64bit SMBIOS entry point with SeaBIOS
 RH-Jira: RHEL-21705
 RH-Acked-by: MST <mst@redhat.com>
 RH-Acked-by: Ani Sinha <None>
 RH-Commit: [3/18] ead230527d93938907a561cf5b985ee4f54d82b1
 JIRA: https://issues.redhat.com/browse/RHEL-21705
 Author: Felix Wu <flwu@google.com>
    Signed-off-by: Felix Wu <flwu@google.com>
    Signed-off-by: Nabih Estefan <nabihestefan@google.com>
    Message-Id: <20240221170027.1027325-3-nabihestefan@google.com>
    Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 (cherry picked from commit 04f143d828845d0fd52dd4a52664d81a4f5431f7)
 Signed-off-by: Igor Mammedov <imammedo@redhat.com>
 ---
 hw/smbios/smbios.c           | 49 +++++++++++++++++++++++++++++++++---
 include/hw/firmware/smbios.h |  4 +++
 qemu-options.hx              |  2 +-
 3 files changed, 51 insertions(+), 4 deletions(-)
 diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c
 index 4f5637d445..074705fa4c 100644
 --- a/hw/smbios/smbios.c
 +++ b/hw/smbios/smbios.c
@@ -124,7 +124,7 @@ static QTAILQ_HEAD(, type8_instance) type8 = QTAILQ_HEAD_INITIALIZER(type8);
 /* type 9 instance for parsing */
 struct type9_instance {
 -    const char *slot_designation;
 +    const char *slot_designation, *pcidev;
     uint8_t slot_type, slot_data_bus_width, current_usage, slot_length,
             slot_characteristics1, slot_characteristics2;
     uint16_t slot_id;
@@ -427,6 +427,11 @@ static const QemuOptDesc qemu_smbios_type9_opts[] = {
         .type = QEMU_OPT_NUMBER,
         .help = "slot characteristics2, see the spec",
     },
 +    {
 +        .name = "pci_device",
 +        .type = QEMU_OPT_STRING,
 +        .help = "PCI device, if provided."
 +    }
 };
 static const QemuOptDesc qemu_smbios_type11_opts[] = {
@@ -851,7 +856,7 @@ static void smbios_build_type_8_table(void)
     }
 }
 -static void smbios_build_type_9_table(void)
 +static void smbios_build_type_9_table(Error **errp)
 {
     unsigned instance = 0;
     struct type9_instance *t9;
@@ -868,6 +873,43 @@ static void smbios_build_type_9_table(void)
         t->slot_characteristics1 = t9->slot_characteristics1;
         t->slot_characteristics2 = t9->slot_characteristics2;
 +        if (t9->pcidev) {
 +            PCIDevice *pdev = NULL;
 +            int rc = pci_qdev_find_device(t9->pcidev, &pdev);
 +            if (rc != 0) {
 +                error_setg(errp,
 +                           "No PCI device %s for SMBIOS type 9 entry %s",
 +                           t9->pcidev, t9->slot_designation);
 +                return;
 +            }
 +            /*
 +             * We only handle the case were the device is attached to
 +             * the PCI root bus. The general case is more complex as
 +             * bridges are enumerated later and the table would need
 +             * to be updated at this moment.
 +             */
 +            if (!pci_bus_is_root(pci_get_bus(pdev))) {
 +                error_setg(errp,
 +                           "Cannot create type 9 entry for PCI device %s: "
 +                           "not attached to the root bus",
 +                           t9->pcidev);
 +                return;
 +            }
 +            t->segment_group_number = cpu_to_le16(0);
 +            t->bus_number = pci_dev_bus_num(pdev);
 +            t->device_number = pdev->devfn;
 +        } else {
 +            /*
 +             * Per SMBIOS spec, For slots that are not of the PCI, AGP, PCI-X,
 +             * or PCI-Express type that do not have bus/device/function
 +             * information, 0FFh should be populated in the fields of Segment
 +             * Group Number, Bus Number, Device/Function Number.
 +             */
 +            t->segment_group_number = 0xff;
 +            t->bus_number = 0xff;
 +            t->device_number = 0xff;
 +        }
 +
         SMBIOS_BUILD_TABLE_POST;
         instance++;
     }
@@ -1222,7 +1264,7 @@ void smbios_get_tables(MachineState *ms,
         }
         smbios_build_type_8_table();
 -        smbios_build_type_9_table();
 +        smbios_build_type_9_table(errp);
         smbios_build_type_11_table();
 #define MAX_DIMM_SZ (16 * GiB)
@@ -1568,6 +1610,7 @@ void smbios_entry_add(QemuOpts *opts, Error **errp)
             t->slot_id = qemu_opt_get_number(opts, "slot_id", 0);
             t->slot_characteristics1 = qemu_opt_get_number(opts, "slot_characteristics1", 0);
             t->slot_characteristics2 = qemu_opt_get_number(opts, "slot_characteristics2", 0);
 +            save_opt(&t->pcidev, opts, "pcidev");
             QTAILQ_INSERT_TAIL(&type9, t, next);
             return;
         }
 diff --git a/include/hw/firmware/smbios.h b/include/hw/firmware/smbios.h
 index 6bbd5a4c20..f8dd07fe4c 100644
 --- a/include/hw/firmware/smbios.h
 +++ b/include/hw/firmware/smbios.h
@@ -222,6 +222,10 @@ struct smbios_type_9 {
     uint16_t slot_id;
     uint8_t slot_characteristics1;
     uint8_t slot_characteristics2;
 +    /* SMBIOS spec v2.6+ */
 +    uint16_t segment_group_number;
 +    uint8_t bus_number;
 +    uint8_t device_number;
 } QEMU_PACKED;
 /* SMBIOS type 11 - OEM strings */
 diff --git a/qemu-options.hx b/qemu-options.hx
 index 94cacc2c63..93364e1765 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
@@ -2710,7 +2710,7 @@ SRST
 ``-smbios type=4[,sock_pfx=str][,manufacturer=str][,version=str][,serial=str][,asset=str][,part=str][,processor-id=%d]``
     Specify SMBIOS type 4 fields
 -``-smbios type=9[,slot_designation=str][,slot_type=%d][,slot_data_bus_width=%d][,current_usage=%d][,slot_length=%d][,slot_id=%d][,slot_characteristics1=%d][,slot_characteristics12=%d]``
 +``-smbios type=9[,slot_designation=str][,slot_type=%d][,slot_data_bus_width=%d][,current_usage=%d][,slot_length=%d][,slot_id=%d][,slot_characteristics1=%d][,slot_characteristics12=%d][,pci_device=str]``
     Specify SMBIOS type 9 fields
 ``-smbios type=11[,value=str][,path=filename]``
 -- 
 2.39.3
--- a/SOURCES/kvm-Implement-base-of-SMBIOS-type-9-descriptor.patch
+++ b/SOURCES/kvm-Implement-base-of-SMBIOS-type-9-descriptor.patch
@ -1,218 +0,0 @@
 From 84fc607d678bd72397a41d706e91fa241fd97266 Mon Sep 17 00:00:00 2001
 From: Igor Mammedov <imammedo@redhat.com>
 Date: Wed, 21 Feb 2024 17:00:26 +0000
 Subject: [PATCH 04/20] Implement base of SMBIOS type 9 descriptor.
 RH-Author: Igor Mammedov <imammedo@redhat.com>
 RH-MergeRequest: 230: Workaround Windows failing to find 64bit SMBIOS entry point with SeaBIOS
 RH-Jira: RHEL-21705
 RH-Acked-by: MST <mst@redhat.com>
 RH-Acked-by: Ani Sinha <None>
 RH-Commit: [2/18] 2678cc080bfbf3357fa2f94ceaf42fc61b690d32
 JIRA: https://issues.redhat.com/browse/RHEL-21705
 commit: 735eee07d1f963635d3c3bf9f5e4bf1bc000870e
 Author: Felix Wu <flwu@google.com>
    Version 2.1+.
    Signed-off-by: Felix Wu <flwu@google.com>
    Signed-off-by: Nabih Estefan <nabihestefan@google.com>
    Message-Id: <20240221170027.1027325-2-nabihestefan@google.com>
    Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Igor Mammedov <imammedo@redhat.com>
 ---
 hw/smbios/smbios.c           | 99 ++++++++++++++++++++++++++++++++++++
 include/hw/firmware/smbios.h | 13 +++++
 qemu-options.hx              |  3 ++
 3 files changed, 115 insertions(+)
 diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c
 index 7bde23e59d..4f5637d445 100644
 --- a/hw/smbios/smbios.c
 +++ b/hw/smbios/smbios.c
@@ -122,6 +122,16 @@ struct type8_instance {
 };
 static QTAILQ_HEAD(, type8_instance) type8 = QTAILQ_HEAD_INITIALIZER(type8);
 +/* type 9 instance for parsing */
 +struct type9_instance {
 +    const char *slot_designation;
 +    uint8_t slot_type, slot_data_bus_width, current_usage, slot_length,
 +            slot_characteristics1, slot_characteristics2;
 +    uint16_t slot_id;
 +    QTAILQ_ENTRY(type9_instance) next;
 +};
 +static QTAILQ_HEAD(, type9_instance) type9 = QTAILQ_HEAD_INITIALIZER(type9);
 +
 static struct {
     size_t nvalues;
     char **values;
@@ -371,6 +381,54 @@ static const QemuOptDesc qemu_smbios_type8_opts[] = {
     },
 };
 +static const QemuOptDesc qemu_smbios_type9_opts[] = {
 +    {
 +        .name = "type",
 +        .type = QEMU_OPT_NUMBER,
 +        .help = "SMBIOS element type",
 +    },
 +    {
 +        .name = "slot_designation",
 +        .type = QEMU_OPT_STRING,
 +        .help = "string number for reference designation",
 +    },
 +    {
 +        .name = "slot_type",
 +        .type = QEMU_OPT_NUMBER,
 +        .help = "connector type",
 +    },
 +    {
 +        .name = "slot_data_bus_width",
 +        .type = QEMU_OPT_NUMBER,
 +        .help = "port type",
 +    },
 +    {
 +        .name = "current_usage",
 +        .type = QEMU_OPT_NUMBER,
 +        .help = "current usage",
 +    },
 +    {
 +        .name = "slot_length",
 +        .type = QEMU_OPT_NUMBER,
 +        .help = "system slot length",
 +    },
 +    {
 +        .name = "slot_id",
 +        .type = QEMU_OPT_NUMBER,
 +        .help = "system slot id",
 +    },
 +    {
 +        .name = "slot_characteristics1",
 +        .type = QEMU_OPT_NUMBER,
 +        .help = "slot characteristics1, see the spec",
 +    },
 +    {
 +        .name = "slot_characteristics2",
 +        .type = QEMU_OPT_NUMBER,
 +        .help = "slot characteristics2, see the spec",
 +    },
 +};
 +
 static const QemuOptDesc qemu_smbios_type11_opts[] = {
     {
         .name = "value",
@@ -594,6 +652,7 @@ bool smbios_skip_table(uint8_t type, bool required_table)
 #define T2_BASE 0x200
 #define T3_BASE 0x300
 #define T4_BASE 0x400
 +#define T9_BASE 0x900
 #define T11_BASE 0xe00
 #define T16_BASE 0x1000
@@ -792,6 +851,28 @@ static void smbios_build_type_8_table(void)
     }
 }
 +static void smbios_build_type_9_table(void)
 +{
 +    unsigned instance = 0;
 +    struct type9_instance *t9;
 +
 +    QTAILQ_FOREACH(t9, &type9, next) {
 +        SMBIOS_BUILD_TABLE_PRE(9, T9_BASE + instance, true);
 +
 +        SMBIOS_TABLE_SET_STR(9, slot_designation, t9->slot_designation);
 +        t->slot_type = t9->slot_type;
 +        t->slot_data_bus_width = t9->slot_data_bus_width;
 +        t->current_usage = t9->current_usage;
 +        t->slot_length = t9->slot_length;
 +        t->slot_id = t9->slot_id;
 +        t->slot_characteristics1 = t9->slot_characteristics1;
 +        t->slot_characteristics2 = t9->slot_characteristics2;
 +
 +        SMBIOS_BUILD_TABLE_POST;
 +        instance++;
 +    }
 +}
 +
 static void smbios_build_type_11_table(void)
 {
     char count_str[128];
@@ -1141,6 +1222,7 @@ void smbios_get_tables(MachineState *ms,
         }
         smbios_build_type_8_table();
 +        smbios_build_type_9_table();
         smbios_build_type_11_table();
 #define MAX_DIMM_SZ (16 * GiB)
@@ -1472,6 +1554,23 @@ void smbios_entry_add(QemuOpts *opts, Error **errp)
             t8_i->port_type = qemu_opt_get_number(opts, "port_type", 0);
             QTAILQ_INSERT_TAIL(&type8, t8_i, next);
             return;
 +        case 9: {
 +            if (!qemu_opts_validate(opts, qemu_smbios_type9_opts, errp)) {
 +                return;
 +            }
 +            struct type9_instance *t;
 +            t = g_new0(struct type9_instance, 1);
 +            save_opt(&t->slot_designation, opts, "slot_designation");
 +            t->slot_type = qemu_opt_get_number(opts, "slot_type", 0);
 +            t->slot_data_bus_width = qemu_opt_get_number(opts, "slot_data_bus_width", 0);
 +            t->current_usage = qemu_opt_get_number(opts, "current_usage", 0);
 +            t->slot_length = qemu_opt_get_number(opts, "slot_length", 0);
 +            t->slot_id = qemu_opt_get_number(opts, "slot_id", 0);
 +            t->slot_characteristics1 = qemu_opt_get_number(opts, "slot_characteristics1", 0);
 +            t->slot_characteristics2 = qemu_opt_get_number(opts, "slot_characteristics2", 0);
 +            QTAILQ_INSERT_TAIL(&type9, t, next);
 +            return;
 +        }
         case 11:
             if (!qemu_opts_validate(opts, qemu_smbios_type11_opts, errp)) {
                 return;
 diff --git a/include/hw/firmware/smbios.h b/include/hw/firmware/smbios.h
 index d24b3ccd32..6bbd5a4c20 100644
 --- a/include/hw/firmware/smbios.h
 +++ b/include/hw/firmware/smbios.h
@@ -211,6 +211,19 @@ struct smbios_type_8 {
     uint8_t port_type;
 } QEMU_PACKED;
 +/* SMBIOS type 9 - System Slots (v2.1+) */
 +struct smbios_type_9 {
 +    struct smbios_structure_header header;
 +    uint8_t slot_designation;
 +    uint8_t slot_type;
 +    uint8_t slot_data_bus_width;
 +    uint8_t current_usage;
 +    uint8_t slot_length;
 +    uint16_t slot_id;
 +    uint8_t slot_characteristics1;
 +    uint8_t slot_characteristics2;
 +} QEMU_PACKED;
 +
 /* SMBIOS type 11 - OEM strings */
 struct smbios_type_11 {
     struct smbios_structure_header header;
 diff --git a/qemu-options.hx b/qemu-options.hx
 index 0814f43066..94cacc2c63 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
@@ -2710,6 +2710,9 @@ SRST
 ``-smbios type=4[,sock_pfx=str][,manufacturer=str][,version=str][,serial=str][,asset=str][,part=str][,processor-id=%d]``
     Specify SMBIOS type 4 fields
 +``-smbios type=9[,slot_designation=str][,slot_type=%d][,slot_data_bus_width=%d][,current_usage=%d][,slot_length=%d][,slot_id=%d][,slot_characteristics1=%d][,slot_characteristics12=%d]``
 +    Specify SMBIOS type 9 fields
 +
 ``-smbios type=11[,value=str][,path=filename]``
     Specify SMBIOS type 11 fields
 -- 
 2.39.3
--- a/SOURCES/kvm-KVM-keep-track-of-running-ioctls.patch
+++ b/SOURCES/kvm-KVM-keep-track-of-running-ioctls.patch
@ -0,0 +1,82 @@
 From 9bacf8c4104ff3cff2e0e2c2179ec4fda633167f Mon Sep 17 00:00:00 2001
 From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date: Mon, 16 Jan 2023 07:51:08 -0500
 Subject: [PATCH 05/11] KVM: keep track of running ioctls
 RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-MergeRequest: 247: accel: introduce accelerator blocker API
 RH-Bugzilla: 2161188
 RH-Acked-by: David Hildenbrand <david@redhat.com>
 RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [2/3] 357508389e2a0fd996206b406e9e235e50b5f0b6
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2161188
 commit a27dd2de68f37ba96fe164a42121daa5f0750afc
 Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date:   Fri Nov 11 10:47:57 2022 -0500
    KVM: keep track of running ioctls
    Using the new accel-blocker API, mark where ioctls are being called
    in KVM. Next, we will implement the critical section that will take
    care of performing memslots modifications atomically, therefore
    preventing any new ioctl from running and allowing the running ones
    to finish.
    Signed-off-by: David Hildenbrand <david@redhat.com>
    Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
    Message-Id: <20221111154758.1372674-3-eesposit@redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 ---
 accel/kvm/kvm-all.c | 7 +++++++
 1 file changed, 7 insertions(+)
 diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
 index 8f2a53438f..221aadfda7 100644
 --- a/accel/kvm/kvm-all.c
 +++ b/accel/kvm/kvm-all.c
@@ -2337,6 +2337,7 @@ static int kvm_init(MachineState *ms)
     assert(TARGET_PAGE_SIZE <= qemu_real_host_page_size);
     s->sigmask_len = 8;
 +    accel_blocker_init();
 #ifdef KVM_CAP_SET_GUEST_DEBUG
     QTAILQ_INIT(&s->kvm_sw_breakpoints);
@@ -3018,7 +3019,9 @@ int kvm_vm_ioctl(KVMState *s, int type, ...)
     va_end(ap);
     trace_kvm_vm_ioctl(type, arg);
 +    accel_ioctl_begin();
     ret = ioctl(s->vmfd, type, arg);
 +    accel_ioctl_end();
     if (ret == -1) {
         ret = -errno;
     }
@@ -3036,7 +3039,9 @@ int kvm_vcpu_ioctl(CPUState *cpu, int type, ...)
     va_end(ap);
     trace_kvm_vcpu_ioctl(cpu->cpu_index, type, arg);
 +    accel_cpu_ioctl_begin(cpu);
     ret = ioctl(cpu->kvm_fd, type, arg);
 +    accel_cpu_ioctl_end(cpu);
     if (ret == -1) {
         ret = -errno;
     }
@@ -3054,7 +3059,9 @@ int kvm_device_ioctl(int fd, int type, ...)
     va_end(ap);
     trace_kvm_device_ioctl(fd, type, arg);
 +    accel_ioctl_begin();
     ret = ioctl(fd, type, arg);
 +    accel_ioctl_end();
     if (ret == -1) {
         ret = -errno;
     }
 -- 
 2.37.3
--- a/SOURCES/kvm-KVM-x86-workaround-invalid-CPUID-0xD-9-info-on-some-.patch
+++ b/SOURCES/kvm-KVM-x86-workaround-invalid-CPUID-0xD-9-info-on-some-.patch
@ -0,0 +1,109 @@
 From ea5299b5dde7d0b6b2f93cb646e6a24c9f105466 Mon Sep 17 00:00:00 2001
 From: Paolo Bonzini <pbonzini@redhat.com>
 Date: Wed, 23 Mar 2022 12:33:25 +0100
 Subject: [PATCH 13/24] KVM: x86: workaround invalid CPUID[0xD,9] info on some
 AMD processors
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Paul Lai <plai@redhat.com>
 RH-MergeRequest: 176: Enable KVM AMX support
 RH-Commit: [13/13] 38f147c911258e84e01336271ebd23a1c24371fc
 RH-Bugzilla: 1916415
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
 Some AMD processors expose the PKRU extended save state even if they do not have
 the related PKU feature in CPUID.  Worse, when they do they report a size of
 64, whereas the expected size of the PKRU extended save state is 8, therefore
 the esa->size == eax assertion does not hold.
 The state is already ignored by KVM_GET_SUPPORTED_CPUID because it
 was not enabled in the host XCR0.  However, QEMU kvm_cpu_xsave_init()
 runs before QEMU invokes arch_prctl() to enable dynamically-enabled
 save states such as XTILEDATA, and KVM_GET_SUPPORTED_CPUID hides save
 states that have yet to be enabled.  Therefore, kvm_cpu_xsave_init()
 needs to consult the host CPUID instead of KVM_GET_SUPPORTED_CPUID,
 and dies with an assertion failure.
 When setting up the ExtSaveArea array to match the host, ignore features that
 KVM does not report as supported.  This will cause QEMU to skip the incorrect
 CPUID leaf instead of tripping the assertion.
 Closes: https://gitlab.com/qemu-project/qemu/-/issues/916
 Reported-by: Daniel P. Berrangé <berrange@redhat.com>
 Analyzed-by: Yang Zhong <yang.zhong@intel.com>
 Reported-by: Peter Krempa <pkrempa@redhat.com>
 Tested-by: Daniel P. Berrangé <berrange@redhat.com>
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 (cherry picked from commit 58f7db26f21c690cf9a669c314cfd7371506084a)
 Signed-off-by: Paul Lai <plai@redhat.com>
 ---
 target/i386/cpu.c         |  4 ++--
 target/i386/cpu.h         |  2 ++
 target/i386/kvm/kvm-cpu.c | 19 ++++++++++++-------
 3 files changed, 16 insertions(+), 9 deletions(-)
 diff --git a/target/i386/cpu.c b/target/i386/cpu.c
 index 09e08f7f38..0543b846ff 100644
 --- a/target/i386/cpu.c
 +++ b/target/i386/cpu.c
@@ -4980,8 +4980,8 @@ CpuDefinitionInfoList *qmp_query_cpu_definitions(Error **errp)
     return cpu_list;
 }
 -static uint64_t x86_cpu_get_supported_feature_word(FeatureWord w,
 -                                                   bool migratable_only)
 +uint64_t x86_cpu_get_supported_feature_word(FeatureWord w,
 +                                            bool migratable_only)
 {
     FeatureWordInfo *wi = &feature_word_info[w];
     uint64_t r = 0;
 diff --git a/target/i386/cpu.h b/target/i386/cpu.h
 index 8ab2a4042a..006b735fe4 100644
 --- a/target/i386/cpu.h
 +++ b/target/i386/cpu.h
@@ -604,6 +604,8 @@ typedef enum FeatureWord {
 } FeatureWord;
 typedef uint64_t FeatureWordArray[FEATURE_WORDS];
 +uint64_t x86_cpu_get_supported_feature_word(FeatureWord w,
 +                                            bool migratable_only);
 /* cpuid_features bits */
 #define CPUID_FP87 (1U << 0)
 diff --git a/target/i386/kvm/kvm-cpu.c b/target/i386/kvm/kvm-cpu.c
 index bdc967c484..74c1396a93 100644
 --- a/target/i386/kvm/kvm-cpu.c
 +++ b/target/i386/kvm/kvm-cpu.c
@@ -99,13 +99,18 @@ static void kvm_cpu_xsave_init(void)
     for (i = XSTATE_SSE_BIT + 1; i < XSAVE_STATE_AREA_COUNT; i++) {
         ExtSaveArea *esa = &x86_ext_save_areas[i];
 -        if (esa->size) {
 -            host_cpuid(0xd, i, &eax, &ebx, &ecx, &edx);
 -            if (eax != 0) {
 -                assert(esa->size == eax);
 -                esa->offset = ebx;
 -                esa->ecx = ecx;
 -            }
 +        if (!esa->size) {
 +            continue;
 +        }
 +        if ((x86_cpu_get_supported_feature_word(esa->feature, false) & esa->bits)
 +            != esa->bits) {
 +            continue;
 +        }
 +        host_cpuid(0xd, i, &eax, &ebx, &ecx, &edx);
 +        if (eax != 0) {
 +            assert(esa->size == eax);
 +            esa->offset = ebx;
 +            esa->ecx = ecx;
         }
     }
 }
 -- 
 2.35.3
--- a/SOURCES/kvm-MAINTAINERS-split-out-s390x-sections.patch
+++ b/SOURCES/kvm-MAINTAINERS-split-out-s390x-sections.patch
@ -0,0 +1,181 @@
 From 440ee491240f2f02f9a6082d8aad98d88c1039dd Mon Sep 17 00:00:00 2001
 From: Thomas Huth <thuth@redhat.com>
 Date: Mon, 15 Jan 2024 14:00:04 +0100
 Subject: [PATCH 1/5] MAINTAINERS: split out s390x sections
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Thomas Huth <thuth@redhat.com>
 RH-MergeRequest: 348: s390x: Provide some more useful information if decryption of a PV image fails
 RH-Jira: RHEL-18214
 RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
 RH-Acked-by: Cédric Le Goater <clg@redhat.com>
 RH-Commit: [1/5] a71a3c11922481f97c36570e361088d17474e481
 JIRA: https://issues.redhat.com/browse/RHEL-18214
 commit 56e34834029c7c6862cb0095d95ad83c50485f88
 Author: Cornelia Huck <cohuck@redhat.com>
 Date:   Wed Dec 22 11:55:48 2021 +0100
    MAINTAINERS: split out s390x sections
    Split out some more specialized devices etc., so that we can build
    smarter lists of people to be put on cc: in the future.
    Signed-off-by: Cornelia Huck <cohuck@redhat.com>
    Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
    Acked-by: David Hildenbrand <david@redhat.com>
    Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
    Acked-by: Thomas Huth <thuth@redhat.com>
    Acked-by: Halil Pasic <pasic@linux.ibm.com>
    Acked-by: Eric Farman <farman@linux.ibm.com>
    Message-Id: <20211222105548.356852-1-cohuck@redhat.com>
    Signed-off-by: Thomas Huth <thuth@redhat.com>
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 ---
 MAINTAINERS | 85 ++++++++++++++++++++++++++++++++++++++++++++++-------
 1 file changed, 74 insertions(+), 11 deletions(-)
 diff --git a/MAINTAINERS b/MAINTAINERS
 index 7543eb4d59..b893206fc3 100644
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
@@ -297,7 +297,6 @@ M: David Hildenbrand <david@redhat.com>
 S: Maintained
 F: target/s390x/
 F: target/s390x/tcg
 -F: target/s390x/cpu_models_*.[ch]
 F: hw/s390x/
 F: disas/s390.c
 F: tests/tcg/s390x/
@@ -396,16 +395,10 @@ M: Halil Pasic <pasic@linux.ibm.com>
 M: Christian Borntraeger <borntraeger@de.ibm.com>
 S: Supported
 F: target/s390x/kvm/
 -F: target/s390x/ioinst.[ch]
 F: target/s390x/machine.c
 F: target/s390x/sigp.c
 -F: target/s390x/cpu_features*.[ch]
 -F: target/s390x/cpu_models.[ch]
 F: hw/s390x/pv.c
 F: include/hw/s390x/pv.h
 -F: hw/intc/s390_flic.c
 -F: hw/intc/s390_flic_kvm.c
 -F: include/hw/s390x/s390_flic.h
 F: gdb-xml/s390*.xml
 T: git https://github.com/borntraeger/qemu.git s390-next
 L: qemu-s390x@nongnu.org
@@ -1529,12 +1522,8 @@ S390 Virtio-ccw
 M: Halil Pasic <pasic@linux.ibm.com>
 M: Christian Borntraeger <borntraeger@de.ibm.com>
 S: Supported
 -F: hw/char/sclp*.[hc]
 -F: hw/char/terminal3270.c
 F: hw/s390x/
 F: include/hw/s390x/
 -F: hw/watchdog/wdt_diag288.c
 -F: include/hw/watchdog/wdt_diag288.h
 F: configs/devices/s390x-softmmu/default.mak
 F: tests/avocado/machine_s390_ccw_virtio.py
 T: git https://github.com/borntraeger/qemu.git s390-next
@@ -1559,6 +1548,37 @@ F: hw/s390x/s390-pci*
 F: include/hw/s390x/s390-pci*
 L: qemu-s390x@nongnu.org
 +S390 channel subsystem
 +M: Halil Pasic <pasic@linux.ibm.com>
 +M: Christian Borntraeger <borntraeger@linux.ibm.com>
 +S: Supported
 +F: hw/s390x/ccw-device.[ch]
 +F: hw/s390x/css.c
 +F: hw/s390x/css-bridge.c
 +F: include/hw/s390x/css.h
 +F: include/hw/s390x/css-bridge.h
 +F: include/hw/s390x/ioinst.h
 +F: target/s390x/ioinst.c
 +L: qemu-s390x@nongnu.org
 +
 +S390 CPU models
 +M: David Hildenbrand <david@redhat.com>
 +S: Maintained
 +F: target/s390x/cpu_features*.[ch]
 +F: target/s390x/cpu_models.[ch]
 +L: qemu-s390x@nongnu.org
 +
 +S390 SCLP-backed devices
 +M: Halil Pasic <pasic@linux.ibm.com>
 +M: Christian Borntraeger <borntraeger@linux.ibm.com>
 +S: Supported
 +F: include/hw/s390x/event-facility.h
 +F: include/hw/s390x/sclp.h
 +F: hw/char/sclp*.[hc]
 +F: hw/s390x/event-facility.c
 +F: hw/s390x/sclp*.c
 +L: qemu-s390x@nongnu.org
 +
 X86 Machines
 ------------
 PC
@@ -1956,6 +1976,7 @@ M: Halil Pasic <pasic@linux.ibm.com>
 S: Supported
 F: hw/s390x/virtio-ccw*.[hc]
 F: hw/s390x/vhost-vsock-ccw.c
 +F: hw/s390x/vhost-user-fs-ccw.c
 T: git https://gitlab.com/cohuck/qemu.git s390-next
 T: git https://github.com/borntraeger/qemu.git s390-next
 L: qemu-s390x@nongnu.org
@@ -2294,6 +2315,48 @@ F: hw/timer/mips_gictimer.c
 F: include/hw/intc/mips_gic.h
 F: include/hw/timer/mips_gictimer.h
 +S390 3270 device
 +M: Halil Pasic <pasic@linux.ibm.com>
 +M: Christian Borntraeger <borntraeger@linux.ibm.com>
 +S: Odd fixes
 +F: include/hw/s390x/3270-ccw.h
 +F: hw/char/terminal3270.c
 +F: hw/s390x/3270-ccw.c
 +L: qemu-s390x@nongnu.org
 +
 +S390 diag 288 watchdog
 +M: Halil Pasic <pasic@linux.ibm.com>
 +M: Christian Borntraeger <borntraeger@linux.ibm.com>
 +S: Supported
 +F: hw/watchdog/wdt_diag288.c
 +F: include/hw/watchdog/wdt_diag288.h
 +L: qemu-s390x@nongnu.org
 +
 +S390 storage key device
 +M: Halil Pasic <pasic@linux.ibm.com>
 +M: Christian Borntraeger <borntraeger@linux.ibm.com>
 +S: Supported
 +F: hw/s390x/storage-keys.h
 +F: hw/390x/s390-skeys*.c
 +L: qemu-s390x@nongnu.org
 +
 +S390 storage attribute device
 +M: Halil Pasic <pasic@linux.ibm.com>
 +M: Christian Borntraeger <borntraeger@linux.ibm.com>
 +S: Supported
 +F: hw/s390x/storage-attributes.h
 +F: hw/s390/s390-stattrib*.c
 +L: qemu-s390x@nongnu.org
 +
 +S390 floating interrupt controller
 +M: Halil Pasic <pasic@linux.ibm.com>
 +M: Christian Borntraeger <borntraeger@linux.ibm.com>
 +M: David Hildenbrand <david@redhat.com>
 +S: Supported
 +F: hw/intc/s390_flic*.c
 +F: include/hw/s390x/s390_flic.h
 +L: qemu-s390x@nongnu.org
 +
 Subsystems
 ----------
 Overall Audio backends
 -- 
 2.41.0
--- a/SOURCES/kvm-QIOChannel-Add-flags-on-io_writev-and-introduce-io_f.patch
+++ b/SOURCES/kvm-QIOChannel-Add-flags-on-io_writev-and-introduce-io_f.patch
@ -0,0 +1,420 @@
 From 7eeec7c008e947bc3e1fed682791092b408852c6 Mon Sep 17 00:00:00 2001
 From: Leonardo Bras <leobras@redhat.com>
 Date: Wed, 18 May 2022 02:52:24 -0300
 Subject: [PATCH 17/37] QIOChannel: Add flags on io_writev and introduce
 io_flush callback
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Leonardo Brás <leobras@redhat.com>
 RH-MergeRequest: 191: MSG_ZEROCOPY + Multifd @ rhel8.7
 RH-Commit: [17/26] 7bde4e79fd3f76a6cc84d9cacf50420584ddd35c
 RH-Bugzilla: 2072049
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Add flags to io_writev and introduce io_flush as optional callback to
 QIOChannelClass, allowing the implementation of zero copy writes by
 subclasses.
 How to use them:
 - Write data using qio_channel_writev*(...,QIO_CHANNEL_WRITE_FLAG_ZERO_COPY),
 - Wait write completion with qio_channel_flush().
 Notes:
 As some zero copy write implementations work asynchronously, it's
 recommended to keep the write buffer untouched until the return of
 qio_channel_flush(), to avoid the risk of sending an updated buffer
 instead of the buffer state during write.
 As io_flush callback is optional, if a subclass does not implement it, then:
 - io_flush will return 0 without changing anything.
 Also, some functions like qio_channel_writev_full_all() were adapted to
 receive a flag parameter. That allows shared code between zero copy and
 non-zero copy writev, and also an easier implementation on new flags.
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 Reviewed-by: Peter Xu <peterx@redhat.com>
 Reviewed-by: Juan Quintela <quintela@redhat.com>
 Message-Id: <20220513062836.965425-3-leobras@redhat.com>
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 (cherry picked from commit b88651cb4d4fa416fdbb6afaf5b26ec8c035eaad)
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 ---
 chardev/char-io.c                   |  2 +-
 hw/remote/mpqemu-link.c             |  2 +-
 include/io/channel.h                | 38 +++++++++++++++++++++-
 io/channel-buffer.c                 |  1 +
 io/channel-command.c                |  1 +
 io/channel-file.c                   |  1 +
 io/channel-socket.c                 |  2 ++
 io/channel-tls.c                    |  1 +
 io/channel-websock.c                |  1 +
 io/channel.c                        | 49 +++++++++++++++++++++++------
 migration/rdma.c                    |  1 +
 scsi/pr-manager-helper.c            |  2 +-
 tests/unit/test-io-channel-socket.c |  1 +
 13 files changed, 88 insertions(+), 14 deletions(-)
 diff --git a/chardev/char-io.c b/chardev/char-io.c
 index 8ced184160..4451128cba 100644
 --- a/chardev/char-io.c
 +++ b/chardev/char-io.c
@@ -122,7 +122,7 @@ int io_channel_send_full(QIOChannel *ioc,
         ret = qio_channel_writev_full(
             ioc, &iov, 1,
 -            fds, nfds, NULL);
 +            fds, nfds, 0, NULL);
         if (ret == QIO_CHANNEL_ERR_BLOCK) {
             if (offset) {
                 return offset;
 diff --git a/hw/remote/mpqemu-link.c b/hw/remote/mpqemu-link.c
 index 7e841820e5..e8f556bd27 100644
 --- a/hw/remote/mpqemu-link.c
 +++ b/hw/remote/mpqemu-link.c
@@ -69,7 +69,7 @@ bool mpqemu_msg_send(MPQemuMsg *msg, QIOChannel *ioc, Error **errp)
     }
     if (!qio_channel_writev_full_all(ioc, send, G_N_ELEMENTS(send),
 -                                    fds, nfds, errp)) {
 +                                    fds, nfds, 0, errp)) {
         ret = true;
     } else {
         trace_mpqemu_send_io_error(msg->cmd, msg->size, nfds);
 diff --git a/include/io/channel.h b/include/io/channel.h
 index 88988979f8..c680ee7480 100644
 --- a/include/io/channel.h
 +++ b/include/io/channel.h
@@ -32,12 +32,15 @@ OBJECT_DECLARE_TYPE(QIOChannel, QIOChannelClass,
 #define QIO_CHANNEL_ERR_BLOCK -2
 +#define QIO_CHANNEL_WRITE_FLAG_ZERO_COPY 0x1
 +
 typedef enum QIOChannelFeature QIOChannelFeature;
 enum QIOChannelFeature {
     QIO_CHANNEL_FEATURE_FD_PASS,
     QIO_CHANNEL_FEATURE_SHUTDOWN,
     QIO_CHANNEL_FEATURE_LISTEN,
 +    QIO_CHANNEL_FEATURE_WRITE_ZERO_COPY,
 };
@@ -104,6 +107,7 @@ struct QIOChannelClass {
                          size_t niov,
                          int *fds,
                          size_t nfds,
 +                         int flags,
                          Error **errp);
     ssize_t (*io_readv)(QIOChannel *ioc,
                         const struct iovec *iov,
@@ -136,6 +140,8 @@ struct QIOChannelClass {
                                   IOHandler *io_read,
                                   IOHandler *io_write,
                                   void *opaque);
 +    int (*io_flush)(QIOChannel *ioc,
 +                    Error **errp);
 };
 /* General I/O handling functions */
@@ -228,6 +234,7 @@ ssize_t qio_channel_readv_full(QIOChannel *ioc,
  * @niov: the length of the @iov array
  * @fds: an array of file handles to send
  * @nfds: number of file handles in @fds
 + * @flags: write flags (QIO_CHANNEL_WRITE_FLAG_*)
  * @errp: pointer to a NULL-initialized error object
  *
  * Write data to the IO channel, reading it from the
@@ -260,6 +267,7 @@ ssize_t qio_channel_writev_full(QIOChannel *ioc,
                                 size_t niov,
                                 int *fds,
                                 size_t nfds,
 +                                int flags,
                                 Error **errp);
 /**
@@ -837,6 +845,7 @@ int qio_channel_readv_full_all(QIOChannel *ioc,
  * @niov: the length of the @iov array
  * @fds: an array of file handles to send
  * @nfds: number of file handles in @fds
 + * @flags: write flags (QIO_CHANNEL_WRITE_FLAG_*)
  * @errp: pointer to a NULL-initialized error object
  *
  *
@@ -846,6 +855,14 @@ int qio_channel_readv_full_all(QIOChannel *ioc,
  * to be written, yielding from the current coroutine
  * if required.
  *
 + * If QIO_CHANNEL_WRITE_FLAG_ZERO_COPY is passed in flags,
 + * instead of waiting for all requested data to be written,
 + * this function will wait until it's all queued for writing.
 + * In this case, if the buffer gets changed between queueing and
 + * sending, the updated buffer will be sent. If this is not a
 + * desired behavior, it's suggested to call qio_channel_flush()
 + * before reusing the buffer.
 + *
  * Returns: 0 if all bytes were written, or -1 on error
  */
@@ -853,6 +870,25 @@ int qio_channel_writev_full_all(QIOChannel *ioc,
                                 const struct iovec *iov,
                                 size_t niov,
                                 int *fds, size_t nfds,
 -                                Error **errp);
 +                                int flags, Error **errp);
 +
 +/**
 + * qio_channel_flush:
 + * @ioc: the channel object
 + * @errp: pointer to a NULL-initialized error object
 + *
 + * Will block until every packet queued with
 + * qio_channel_writev_full() + QIO_CHANNEL_WRITE_FLAG_ZERO_COPY
 + * is sent, or return in case of any error.
 + *
 + * If not implemented, acts as a no-op, and returns 0.
 + *
 + * Returns -1 if any error is found,
 + *          1 if every send failed to use zero copy.
 + *          0 otherwise.
 + */
 +
 +int qio_channel_flush(QIOChannel *ioc,
 +                      Error **errp);
 #endif /* QIO_CHANNEL_H */
 diff --git a/io/channel-buffer.c b/io/channel-buffer.c
 index baa4e2b089..bf52011be2 100644
 --- a/io/channel-buffer.c
 +++ b/io/channel-buffer.c
@@ -81,6 +81,7 @@ static ssize_t qio_channel_buffer_writev(QIOChannel *ioc,
                                          size_t niov,
                                          int *fds,
                                          size_t nfds,
 +                                         int flags,
                                          Error **errp)
 {
     QIOChannelBuffer *bioc = QIO_CHANNEL_BUFFER(ioc);
 diff --git a/io/channel-command.c b/io/channel-command.c
 index b2a9e27138..5ff1691bad 100644
 --- a/io/channel-command.c
 +++ b/io/channel-command.c
@@ -258,6 +258,7 @@ static ssize_t qio_channel_command_writev(QIOChannel *ioc,
                                           size_t niov,
                                           int *fds,
                                           size_t nfds,
 +                                          int flags,
                                           Error **errp)
 {
     QIOChannelCommand *cioc = QIO_CHANNEL_COMMAND(ioc);
 diff --git a/io/channel-file.c b/io/channel-file.c
 index c4bf799a80..348a48545e 100644
 --- a/io/channel-file.c
 +++ b/io/channel-file.c
@@ -114,6 +114,7 @@ static ssize_t qio_channel_file_writev(QIOChannel *ioc,
                                        size_t niov,
                                        int *fds,
                                        size_t nfds,
 +                                       int flags,
                                        Error **errp)
 {
     QIOChannelFile *fioc = QIO_CHANNEL_FILE(ioc);
 diff --git a/io/channel-socket.c b/io/channel-socket.c
 index 606ec97cf7..bfbd64787e 100644
 --- a/io/channel-socket.c
 +++ b/io/channel-socket.c
@@ -525,6 +525,7 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
                                          size_t niov,
                                          int *fds,
                                          size_t nfds,
 +                                         int flags,
                                          Error **errp)
 {
     QIOChannelSocket *sioc = QIO_CHANNEL_SOCKET(ioc);
@@ -620,6 +621,7 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
                                          size_t niov,
                                          int *fds,
                                          size_t nfds,
 +                                         int flags,
                                          Error **errp)
 {
     QIOChannelSocket *sioc = QIO_CHANNEL_SOCKET(ioc);
 diff --git a/io/channel-tls.c b/io/channel-tls.c
 index 2ae1b92fc0..4ce890a538 100644
 --- a/io/channel-tls.c
 +++ b/io/channel-tls.c
@@ -301,6 +301,7 @@ static ssize_t qio_channel_tls_writev(QIOChannel *ioc,
                                       size_t niov,
                                       int *fds,
                                       size_t nfds,
 +                                      int flags,
                                       Error **errp)
 {
     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
 diff --git a/io/channel-websock.c b/io/channel-websock.c
 index 70889bb54d..035dd6075b 100644
 --- a/io/channel-websock.c
 +++ b/io/channel-websock.c
@@ -1127,6 +1127,7 @@ static ssize_t qio_channel_websock_writev(QIOChannel *ioc,
                                           size_t niov,
                                           int *fds,
                                           size_t nfds,
 +                                          int flags,
                                           Error **errp)
 {
     QIOChannelWebsock *wioc = QIO_CHANNEL_WEBSOCK(ioc);
 diff --git a/io/channel.c b/io/channel.c
 index e8b019dc36..0640941ac5 100644
 --- a/io/channel.c
 +++ b/io/channel.c
@@ -72,18 +72,32 @@ ssize_t qio_channel_writev_full(QIOChannel *ioc,
                                 size_t niov,
                                 int *fds,
                                 size_t nfds,
 +                                int flags,
                                 Error **errp)
 {
     QIOChannelClass *klass = QIO_CHANNEL_GET_CLASS(ioc);
 -    if ((fds || nfds) &&
 -        !qio_channel_has_feature(ioc, QIO_CHANNEL_FEATURE_FD_PASS)) {
 +    if (fds || nfds) {
 +        if (!qio_channel_has_feature(ioc, QIO_CHANNEL_FEATURE_FD_PASS)) {
 +            error_setg_errno(errp, EINVAL,
 +                             "Channel does not support file descriptor passing");
 +            return -1;
 +        }
 +        if (flags & QIO_CHANNEL_WRITE_FLAG_ZERO_COPY) {
 +            error_setg_errno(errp, EINVAL,
 +                             "Zero Copy does not support file descriptor passing");
 +            return -1;
 +        }
 +    }
 +
 +    if ((flags & QIO_CHANNEL_WRITE_FLAG_ZERO_COPY) &&
 +        !qio_channel_has_feature(ioc, QIO_CHANNEL_FEATURE_WRITE_ZERO_COPY)) {
         error_setg_errno(errp, EINVAL,
 -                         "Channel does not support file descriptor passing");
 +                         "Requested Zero Copy feature is not available");
         return -1;
     }
 -    return klass->io_writev(ioc, iov, niov, fds, nfds, errp);
 +    return klass->io_writev(ioc, iov, niov, fds, nfds, flags, errp);
 }
@@ -217,14 +231,14 @@ int qio_channel_writev_all(QIOChannel *ioc,
                            size_t niov,
                            Error **errp)
 {
 -    return qio_channel_writev_full_all(ioc, iov, niov, NULL, 0, errp);
 +    return qio_channel_writev_full_all(ioc, iov, niov, NULL, 0, 0, errp);
 }
 int qio_channel_writev_full_all(QIOChannel *ioc,
                                 const struct iovec *iov,
                                 size_t niov,
                                 int *fds, size_t nfds,
 -                                Error **errp)
 +                                int flags, Error **errp)
 {
     int ret = -1;
     struct iovec *local_iov = g_new(struct iovec, niov);
@@ -237,8 +251,10 @@ int qio_channel_writev_full_all(QIOChannel *ioc,
     while (nlocal_iov > 0) {
         ssize_t len;
 -        len = qio_channel_writev_full(ioc, local_iov, nlocal_iov, fds, nfds,
 -                                      errp);
 +
 +        len = qio_channel_writev_full(ioc, local_iov, nlocal_iov, fds,
 +                                            nfds, flags, errp);
 +
         if (len == QIO_CHANNEL_ERR_BLOCK) {
             if (qemu_in_coroutine()) {
                 qio_channel_yield(ioc, G_IO_OUT);
@@ -277,7 +293,7 @@ ssize_t qio_channel_writev(QIOChannel *ioc,
                            size_t niov,
                            Error **errp)
 {
 -    return qio_channel_writev_full(ioc, iov, niov, NULL, 0, errp);
 +    return qio_channel_writev_full(ioc, iov, niov, NULL, 0, 0, errp);
 }
@@ -297,7 +313,7 @@ ssize_t qio_channel_write(QIOChannel *ioc,
                           Error **errp)
 {
     struct iovec iov = { .iov_base = (char *)buf, .iov_len = buflen };
 -    return qio_channel_writev_full(ioc, &iov, 1, NULL, 0, errp);
 +    return qio_channel_writev_full(ioc, &iov, 1, NULL, 0, 0, errp);
 }
@@ -473,6 +489,19 @@ off_t qio_channel_io_seek(QIOChannel *ioc,
     return klass->io_seek(ioc, offset, whence, errp);
 }
 +int qio_channel_flush(QIOChannel *ioc,
 +                                Error **errp)
 +{
 +    QIOChannelClass *klass = QIO_CHANNEL_GET_CLASS(ioc);
 +
 +    if (!klass->io_flush ||
 +        !qio_channel_has_feature(ioc, QIO_CHANNEL_FEATURE_WRITE_ZERO_COPY)) {
 +        return 0;
 +    }
 +
 +    return klass->io_flush(ioc, errp);
 +}
 +
 static void qio_channel_restart_read(void *opaque)
 {
 diff --git a/migration/rdma.c b/migration/rdma.c
 index f5d3bbe7e9..54acd2000e 100644
 --- a/migration/rdma.c
 +++ b/migration/rdma.c
@@ -2833,6 +2833,7 @@ static ssize_t qio_channel_rdma_writev(QIOChannel *ioc,
                                        size_t niov,
                                        int *fds,
                                        size_t nfds,
 +                                       int flags,
                                        Error **errp)
 {
     QIOChannelRDMA *rioc = QIO_CHANNEL_RDMA(ioc);
 diff --git a/scsi/pr-manager-helper.c b/scsi/pr-manager-helper.c
 index 451c7631b7..3be52a98d5 100644
 --- a/scsi/pr-manager-helper.c
 +++ b/scsi/pr-manager-helper.c
@@ -77,7 +77,7 @@ static int pr_manager_helper_write(PRManagerHelper *pr_mgr,
         iov.iov_base = (void *)buf;
         iov.iov_len = sz;
         n_written = qio_channel_writev_full(QIO_CHANNEL(pr_mgr->ioc), &iov, 1,
 -                                            nfds ? &fd : NULL, nfds, errp);
 +                                            nfds ? &fd : NULL, nfds, 0, errp);
         if (n_written <= 0) {
             assert(n_written != QIO_CHANNEL_ERR_BLOCK);
 diff --git a/tests/unit/test-io-channel-socket.c b/tests/unit/test-io-channel-socket.c
 index c49eec1f03..6713886d02 100644
 --- a/tests/unit/test-io-channel-socket.c
 +++ b/tests/unit/test-io-channel-socket.c
@@ -444,6 +444,7 @@ static void test_io_channel_unix_fd_pass(void)
                             G_N_ELEMENTS(iosend),
                             fdsend,
                             G_N_ELEMENTS(fdsend),
 +                            0,
                             &error_abort);
     qio_channel_readv_full(dst,
 -- 
 2.35.3
--- a/SOURCES/kvm-QIOChannelSocket-Add-support-for-MSG_ZEROCOPY-IPV6.patch
+++ b/SOURCES/kvm-QIOChannelSocket-Add-support-for-MSG_ZEROCOPY-IPV6.patch
@ -0,0 +1,56 @@
 From a6c4aed18a027ce8e107fdf9184e9ea43a86f843 Mon Sep 17 00:00:00 2001
 From: Leonardo Bras <leobras@redhat.com>
 Date: Thu, 4 Aug 2022 04:10:43 -0300
 Subject: [PATCH 8/9] QIOChannelSocket: Add support for MSG_ZEROCOPY + IPV6
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Leonardo Brás <leobras@redhat.com>
 RH-MergeRequest: 201: Zero-copy-send fixes + improvements
 RH-Commit: [8/8] 6e26ee7c9ebaedb07623313cb0678816867751dd
 RH-Bugzilla: 2110203
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 For using MSG_ZEROCOPY, there are two steps:
 1 - io_writev() the packet, which enqueues the packet for sending, and
 2 - io_flush(), which gets confirmation that all packets got correctly sent
 Currently, if MSG_ZEROCOPY is used to send packets over IPV6, no error will
 be reported in (1), but it will fail in the first time (2) happens.
 This happens because (2) currently checks for cmsg_level & cmsg_type
 associated with IPV4 only, before reporting any error.
 Add checks for cmsg_level & cmsg_type associated with IPV6, and thus enable
 support for MSG_ZEROCOPY + IPV6
 Fixes: 2bc58ffc29 ("QIOChannelSocket: Implement io_writev zero copy flag & io_flush for CONFIG_LINUX")
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
 (cherry picked from commit 5258a7e2c0677d16e9e1d06845f60171adf0b290)
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 ---
 io/channel-socket.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/io/channel-socket.c b/io/channel-socket.c
 index cf0d67c51b..6010ad7017 100644
 --- a/io/channel-socket.c
 +++ b/io/channel-socket.c
@@ -747,8 +747,8 @@ static int qio_channel_socket_flush(QIOChannel *ioc,
         }
         cm = CMSG_FIRSTHDR(&msg);
 -        if (cm->cmsg_level != SOL_IP &&
 -            cm->cmsg_type != IP_RECVERR) {
 +        if (cm->cmsg_level != SOL_IP   && cm->cmsg_type != IP_RECVERR &&
 +            cm->cmsg_level != SOL_IPV6 && cm->cmsg_type != IPV6_RECVERR) {
             error_setg_errno(errp, EPROTOTYPE,
                              "Wrong cmsg in errqueue");
             return -1;
 -- 
 2.31.1
--- a/SOURCES/kvm-QIOChannelSocket-Fix-zero-copy-flush-returning-code-.patch
+++ b/SOURCES/kvm-QIOChannelSocket-Fix-zero-copy-flush-returning-code-.patch
@ -0,0 +1,65 @@
 From 905cc8032fc63619efb3f0a8c9754b7190bcc43a Mon Sep 17 00:00:00 2001
 From: Leonardo Bras <leobras@redhat.com>
 Date: Mon, 11 Jul 2022 18:11:11 -0300
 Subject: [PATCH 3/9] QIOChannelSocket: Fix zero-copy flush returning code 1
 when nothing sent
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Leonardo Brás <leobras@redhat.com>
 RH-MergeRequest: 201: Zero-copy-send fixes + improvements
 RH-Commit: [3/8] 1ad707702fa26cd4d0fa1870c21f5f26ae93ff97
 RH-Bugzilla: 2110203
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 If flush is called when no buffer was sent with MSG_ZEROCOPY, it currently
 returns 1. This return code should be used only when Linux fails to use
 MSG_ZEROCOPY on a lot of sendmsg().
 Fix this by returning early from flush if no sendmsg(...,MSG_ZEROCOPY)
 was attempted.
 Fixes: 2bc58ffc2926 ("QIOChannelSocket: Implement io_writev zero copy flag & io_flush for CONFIG_LINUX")
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 Acked-by: Daniel P. Berrangé <berrange@redhat.com>
 Reviewed-by: Juan Quintela <quintela@redhat.com>
 Reviewed-by: Peter Xu <peterx@redhat.com>
 Message-Id: <20220711211112.18951-2-leobras@redhat.com>
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 (cherry picked from commit 927f93e099c4f9184e60a1bc61624ac2d04d0223)
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 ---
 io/channel-socket.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)
 diff --git a/io/channel-socket.c b/io/channel-socket.c
 index df858da924..cf0d67c51b 100644
 --- a/io/channel-socket.c
 +++ b/io/channel-socket.c
@@ -717,12 +717,18 @@ static int qio_channel_socket_flush(QIOChannel *ioc,
     struct cmsghdr *cm;
     char control[CMSG_SPACE(sizeof(*serr))];
     int received;
 -    int ret = 1;
 +    int ret;
 +
 +    if (sioc->zero_copy_queued == sioc->zero_copy_sent) {
 +        return 0;
 +    }
     msg.msg_control = control;
     msg.msg_controllen = sizeof(control);
     memset(control, 0, sizeof(control));
 +    ret = 1;
 +
     while (sioc->zero_copy_sent < sioc->zero_copy_queued) {
         received = recvmsg(sioc->fd, &msg, MSG_ERRQUEUE);
         if (received < 0) {
 -- 
 2.31.1
--- a/SOURCES/kvm-QIOChannelSocket-Fix-zero-copy-send-so-socket-flush-.patch
+++ b/SOURCES/kvm-QIOChannelSocket-Fix-zero-copy-send-so-socket-flush-.patch
@ -0,0 +1,58 @@
 From c1fd32d93ae42fcf3c1a25f4d56e669f251087d8 Mon Sep 17 00:00:00 2001
 From: Leonardo Bras <leobras@redhat.com>
 Date: Mon, 20 Jun 2022 02:39:43 -0300
 Subject: [PATCH 25/37] QIOChannelSocket: Fix zero-copy send so socket flush
 works
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Leonardo Brás <leobras@redhat.com>
 RH-MergeRequest: 191: MSG_ZEROCOPY + Multifd @ rhel8.7
 RH-Commit: [25/26] 3ede94f3269e21c3ace073ed1a6f24696315bcbb
 RH-Bugzilla: 2072049
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Somewhere between v6 and v7 the of the zero-copy-send patchset a crucial
 part of the flushing mechanism got missing: incrementing zero_copy_queued.
 Without that, the flushing interface becomes a no-op, and there is no
 guarantee the buffer is really sent.
 This can go as bad as causing a corruption in RAM during migration.
 Fixes: 2bc58ffc2926 ("QIOChannelSocket: Implement io_writev zero copy flag & io_flush for CONFIG_LINUX")
 Reported-by: 徐闯 <xuchuangxclwt@bytedance.com>
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 Reviewed-by: Peter Xu <peterx@redhat.com>
 Reviewed-by: Juan Quintela <quintela@redhat.com>
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 (cherry picked from commit 4f5a09714c983a3471fd12e3c7f3196e95c650c1)
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 ---
 io/channel-socket.c | 5 +++++
 1 file changed, 5 insertions(+)
 diff --git a/io/channel-socket.c b/io/channel-socket.c
 index 7d37b39de7..df858da924 100644
 --- a/io/channel-socket.c
 +++ b/io/channel-socket.c
@@ -612,6 +612,11 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
                          "Unable to write to socket");
         return -1;
     }
 +
 +    if (flags & QIO_CHANNEL_WRITE_FLAG_ZERO_COPY) {
 +        sioc->zero_copy_queued++;
 +    }
 +
     return ret;
 }
 #else /* WIN32 */
 -- 
 2.35.3
--- a/SOURCES/kvm-QIOChannelSocket-Implement-io_writev-zero-copy-flag-.patch
+++ b/SOURCES/kvm-QIOChannelSocket-Implement-io_writev-zero-copy-flag-.patch
@ -0,0 +1,249 @@
 From 5fd7af93a06adaddbae719aabbaf912159f4fb28 Mon Sep 17 00:00:00 2001
 From: Leonardo Bras <leobras@redhat.com>
 Date: Wed, 18 May 2022 02:52:25 -0300
 Subject: [PATCH 18/37] QIOChannelSocket: Implement io_writev zero copy flag &
 io_flush for CONFIG_LINUX
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Leonardo Brás <leobras@redhat.com>
 RH-MergeRequest: 191: MSG_ZEROCOPY + Multifd @ rhel8.7
 RH-Commit: [18/26] 6f65c8c879a5df57213b541d58285b65178f8547
 RH-Bugzilla: 2072049
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 For CONFIG_LINUX, implement the new zero copy flag and the optional callback
 io_flush on QIOChannelSocket, but enables it only when MSG_ZEROCOPY
 feature is available in the host kernel, which is checked on
 qio_channel_socket_connect_sync()
 qio_channel_socket_flush() was implemented by counting how many times
 sendmsg(...,MSG_ZEROCOPY) was successfully called, and then reading the
 socket's error queue, in order to find how many of them finished sending.
 Flush will loop until those counters are the same, or until some error occurs.
 Notes on using writev() with QIO_CHANNEL_WRITE_FLAG_ZERO_COPY:
 1: Buffer
 - As MSG_ZEROCOPY tells the kernel to use the same user buffer to avoid copying,
 some caution is necessary to avoid overwriting any buffer before it's sent.
 If something like this happen, a newer version of the buffer may be sent instead.
 - If this is a problem, it's recommended to call qio_channel_flush() before freeing
 or re-using the buffer.
 2: Locked memory
 - When using MSG_ZERCOCOPY, the buffer memory will be locked after queued, and
 unlocked after it's sent.
 - Depending on the size of each buffer, and how often it's sent, it may require
 a larger amount of locked memory than usually available to non-root user.
 - If the required amount of locked memory is not available, writev_zero_copy
 will return an error, which can abort an operation like migration,
 - Because of this, when an user code wants to add zero copy as a feature, it
 requires a mechanism to disable it, so it can still be accessible to less
 privileged users.
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 Reviewed-by: Peter Xu <peterx@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 Reviewed-by: Juan Quintela <quintela@redhat.com>
 Message-Id: <20220513062836.965425-4-leobras@redhat.com>
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 (cherry picked from commit 2bc58ffc2926a4efdd03edfb5909861fefc68c3d)
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 ---
 include/io/channel-socket.h |   2 +
 io/channel-socket.c         | 116 ++++++++++++++++++++++++++++++++++--
 2 files changed, 114 insertions(+), 4 deletions(-)
 diff --git a/include/io/channel-socket.h b/include/io/channel-socket.h
 index e747e63514..513c428fe4 100644
 --- a/include/io/channel-socket.h
 +++ b/include/io/channel-socket.h
@@ -47,6 +47,8 @@ struct QIOChannelSocket {
     socklen_t localAddrLen;
     struct sockaddr_storage remoteAddr;
     socklen_t remoteAddrLen;
 +    ssize_t zero_copy_queued;
 +    ssize_t zero_copy_sent;
 };
 diff --git a/io/channel-socket.c b/io/channel-socket.c
 index bfbd64787e..38a46ba213 100644
 --- a/io/channel-socket.c
 +++ b/io/channel-socket.c
@@ -26,6 +26,14 @@
 #include "io/channel-watch.h"
 #include "trace.h"
 #include "qapi/clone-visitor.h"
 +#ifdef CONFIG_LINUX
 +#include <linux/errqueue.h>
 +#include <sys/socket.h>
 +
 +#if (defined(MSG_ZEROCOPY) && defined(SO_ZEROCOPY))
 +#define QEMU_MSG_ZEROCOPY
 +#endif
 +#endif
 #define SOCKET_MAX_FDS 16
@@ -55,6 +63,8 @@ qio_channel_socket_new(void)
     sioc = QIO_CHANNEL_SOCKET(object_new(TYPE_QIO_CHANNEL_SOCKET));
     sioc->fd = -1;
 +    sioc->zero_copy_queued = 0;
 +    sioc->zero_copy_sent = 0;
     ioc = QIO_CHANNEL(sioc);
     qio_channel_set_feature(ioc, QIO_CHANNEL_FEATURE_SHUTDOWN);
@@ -154,6 +164,16 @@ int qio_channel_socket_connect_sync(QIOChannelSocket *ioc,
         return -1;
     }
 +#ifdef QEMU_MSG_ZEROCOPY
 +    int ret, v = 1;
 +    ret = setsockopt(fd, SOL_SOCKET, SO_ZEROCOPY, &v, sizeof(v));
 +    if (ret == 0) {
 +        /* Zero copy available on host */
 +        qio_channel_set_feature(QIO_CHANNEL(ioc),
 +                                QIO_CHANNEL_FEATURE_WRITE_ZERO_COPY);
 +    }
 +#endif
 +
     return 0;
 }
@@ -534,6 +554,7 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
     char control[CMSG_SPACE(sizeof(int) * SOCKET_MAX_FDS)];
     size_t fdsize = sizeof(int) * nfds;
     struct cmsghdr *cmsg;
 +    int sflags = 0;
     memset(control, 0, CMSG_SPACE(sizeof(int) * SOCKET_MAX_FDS));
@@ -558,15 +579,31 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
         memcpy(CMSG_DATA(cmsg), fds, fdsize);
     }
 +#ifdef QEMU_MSG_ZEROCOPY
 +    if (flags & QIO_CHANNEL_WRITE_FLAG_ZERO_COPY) {
 +        sflags = MSG_ZEROCOPY;
 +    }
 +#endif
 +
  retry:
 -    ret = sendmsg(sioc->fd, &msg, 0);
 +    ret = sendmsg(sioc->fd, &msg, sflags);
     if (ret <= 0) {
 -        if (errno == EAGAIN) {
 +        switch (errno) {
 +        case EAGAIN:
             return QIO_CHANNEL_ERR_BLOCK;
 -        }
 -        if (errno == EINTR) {
 +        case EINTR:
             goto retry;
 +#ifdef QEMU_MSG_ZEROCOPY
 +        case ENOBUFS:
 +            if (sflags & MSG_ZEROCOPY) {
 +                error_setg_errno(errp, errno,
 +                                 "Process can't lock enough memory for using MSG_ZEROCOPY");
 +                return -1;
 +            }
 +            break;
 +#endif
         }
 +
         error_setg_errno(errp, errno,
                          "Unable to write to socket");
         return -1;
@@ -660,6 +697,74 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
 }
 #endif /* WIN32 */
 +
 +#ifdef QEMU_MSG_ZEROCOPY
 +static int qio_channel_socket_flush(QIOChannel *ioc,
 +                                    Error **errp)
 +{
 +    QIOChannelSocket *sioc = QIO_CHANNEL_SOCKET(ioc);
 +    struct msghdr msg = {};
 +    struct sock_extended_err *serr;
 +    struct cmsghdr *cm;
 +    char control[CMSG_SPACE(sizeof(*serr))];
 +    int received;
 +    int ret = 1;
 +
 +    msg.msg_control = control;
 +    msg.msg_controllen = sizeof(control);
 +    memset(control, 0, sizeof(control));
 +
 +    while (sioc->zero_copy_sent < sioc->zero_copy_queued) {
 +        received = recvmsg(sioc->fd, &msg, MSG_ERRQUEUE);
 +        if (received < 0) {
 +            switch (errno) {
 +            case EAGAIN:
 +                /* Nothing on errqueue, wait until something is available */
 +                qio_channel_wait(ioc, G_IO_ERR);
 +                continue;
 +            case EINTR:
 +                continue;
 +            default:
 +                error_setg_errno(errp, errno,
 +                                 "Unable to read errqueue");
 +                return -1;
 +            }
 +        }
 +
 +        cm = CMSG_FIRSTHDR(&msg);
 +        if (cm->cmsg_level != SOL_IP &&
 +            cm->cmsg_type != IP_RECVERR) {
 +            error_setg_errno(errp, EPROTOTYPE,
 +                             "Wrong cmsg in errqueue");
 +            return -1;
 +        }
 +
 +        serr = (void *) CMSG_DATA(cm);
 +        if (serr->ee_errno != SO_EE_ORIGIN_NONE) {
 +            error_setg_errno(errp, serr->ee_errno,
 +                             "Error on socket");
 +            return -1;
 +        }
 +        if (serr->ee_origin != SO_EE_ORIGIN_ZEROCOPY) {
 +            error_setg_errno(errp, serr->ee_origin,
 +                             "Error not from zero copy");
 +            return -1;
 +        }
 +
 +        /* No errors, count successfully finished sendmsg()*/
 +        sioc->zero_copy_sent += serr->ee_data - serr->ee_info + 1;
 +
 +        /* If any sendmsg() succeeded using zero copy, return 0 at the end */
 +        if (serr->ee_code != SO_EE_CODE_ZEROCOPY_COPIED) {
 +            ret = 0;
 +        }
 +    }
 +
 +    return ret;
 +}
 +
 +#endif /* QEMU_MSG_ZEROCOPY */
 +
 static int
 qio_channel_socket_set_blocking(QIOChannel *ioc,
                                 bool enabled,
@@ -789,6 +894,9 @@ static void qio_channel_socket_class_init(ObjectClass *klass,
     ioc_klass->io_set_delay = qio_channel_socket_set_delay;
     ioc_klass->io_create_watch = qio_channel_socket_create_watch;
     ioc_klass->io_set_aio_fd_handler = qio_channel_socket_set_aio_fd_handler;
 +#ifdef QEMU_MSG_ZEROCOPY
 +    ioc_klass->io_flush = qio_channel_socket_flush;
 +#endif
 }
 static const TypeInfo qio_channel_socket_info = {
 -- 
 2.35.3
--- a/SOURCES/kvm-QIOChannelSocket-Introduce-assert-and-reduce-ifdefs-.patch
+++ b/SOURCES/kvm-QIOChannelSocket-Introduce-assert-and-reduce-ifdefs-.patch
@ -0,0 +1,82 @@
 From cbfaf86331c2b2e01a2083303b7554672bf991b7 Mon Sep 17 00:00:00 2001
 From: Leonardo Bras <leobras@redhat.com>
 Date: Mon, 20 Jun 2022 02:39:42 -0300
 Subject: [PATCH 24/37] QIOChannelSocket: Introduce assert and reduce ifdefs to
 improve readability
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Leonardo Brás <leobras@redhat.com>
 RH-MergeRequest: 191: MSG_ZEROCOPY + Multifd @ rhel8.7
 RH-Commit: [24/26] b50e2e65307149f247155a7f7a032dc99e57718d
 RH-Bugzilla: 2072049
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 During implementation of MSG_ZEROCOPY feature, a lot of #ifdefs were
 introduced, particularly at qio_channel_socket_writev().
 Rewrite some of those changes so it's easier to read.
 Also, introduce an assert to help detect incorrect zero-copy usage is when
 it's disabled on build.
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 Reviewed-by: Juan Quintela <quintela@redhat.com>
 Reviewed-by: Peter Xu <peterx@redhat.com>
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
  dgilbert: Fixed up thinko'd g_assert_unreachable->g_assert_not_reached
 (cherry picked from commit 803ca43e4c7fcf32f9f68c118301ccd0c83ece3f)
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 ---
 io/channel-socket.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)
 diff --git a/io/channel-socket.c b/io/channel-socket.c
 index 38a46ba213..7d37b39de7 100644
 --- a/io/channel-socket.c
 +++ b/io/channel-socket.c
@@ -579,11 +579,17 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
         memcpy(CMSG_DATA(cmsg), fds, fdsize);
     }
 -#ifdef QEMU_MSG_ZEROCOPY
     if (flags & QIO_CHANNEL_WRITE_FLAG_ZERO_COPY) {
 +#ifdef QEMU_MSG_ZEROCOPY
         sflags = MSG_ZEROCOPY;
 -    }
 +#else
 +        /*
 +         * We expect QIOChannel class entry point to have
 +         * blocked this code path already
 +         */
 +        g_assert_not_reached();
 #endif
 +    }
  retry:
     ret = sendmsg(sioc->fd, &msg, sflags);
@@ -593,15 +599,13 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
             return QIO_CHANNEL_ERR_BLOCK;
         case EINTR:
             goto retry;
 -#ifdef QEMU_MSG_ZEROCOPY
         case ENOBUFS:
 -            if (sflags & MSG_ZEROCOPY) {
 +            if (flags & QIO_CHANNEL_WRITE_FLAG_ZERO_COPY) {
                 error_setg_errno(errp, errno,
                                  "Process can't lock enough memory for using MSG_ZEROCOPY");
                 return -1;
             }
             break;
 -#endif
         }
         error_setg_errno(errp, errno,
 -- 
 2.35.3
--- a/SOURCES/kvm-RHEL-Enable-x-not-migrate-acpi-index-for-all-pre-RHE.patch
+++ b/SOURCES/kvm-RHEL-Enable-x-not-migrate-acpi-index-for-all-pre-RHE.patch
@ -0,0 +1,43 @@
 From f1480fe9a4054113ddacd218961e29f31c33d329 Mon Sep 17 00:00:00 2001
 From: Peter Xu <peterx@redhat.com>
 Date: Wed, 6 Sep 2023 16:29:23 -0400
 Subject: [PATCH 2/3] RHEL: Enable "x-not-migrate-acpi-index" for all pre-RHEL8
 guests
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Peter Xu <peterx@redhat.com>
 RH-MergeRequest: 343: acpi: fix acpi_index migration
 RH-Jira: RHEL-20189
 RH-Acked-by: Leonardo Brás <leobras@redhat.com>
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 RH-Acked-by: Prasad Pandit <None>
 RH-Commit: [2/2] 0a26a71236e68dd7feb5d2063254090e3852d6ba
 The acpi index migration is simply broken before for all pre-RHEL8
 branches.  Don't migrate it for all of them.
 Signed-off-by: Peter Xu <peterx@redhat.com>
 ---
 hw/core/machine.c | 4 ++++
 1 file changed, 4 insertions(+)
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index 2724f6848a..6650a3d7b7 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -44,6 +44,10 @@ GlobalProperty hw_compat_rhel_8_6[] = {
      * we need do disable it downstream on the latest hw_compat_rhel_8.
      */
     { "vhost-vsock-device", "seqpacket", "off" },
 +    /*
 +     * RHEL-2186: all rhel8 machines should not migrate acpi index.
 +     */
 +    { "PIIX4_PM", "x-not-migrate-acpi-index", "on"},
 };
 const size_t hw_compat_rhel_8_6_len = G_N_ELEMENTS(hw_compat_rhel_8_6);
 -- 
 2.41.0
--- a/SOURCES/kvm-RHEL-disable-seqpacket-for-vhost-vsock-device-in-rhe.patch
+++ b/SOURCES/kvm-RHEL-disable-seqpacket-for-vhost-vsock-device-in-rhe.patch
@ -0,0 +1,107 @@
 From e0e4f01c6f4fb5881960f72ae4e80951b711131e Mon Sep 17 00:00:00 2001
 From: Stefano Garzarella <sgarzare@redhat.com>
 Date: Thu, 24 Mar 2022 16:04:57 +0100
 Subject: [PATCH 1/5] RHEL: disable "seqpacket" for "vhost-vsock-device" in
 rhel8.6.0
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Stefano Garzarella <sgarzare@redhat.com>
 RH-MergeRequest: 136: RHEL: disable "seqpacket" for "vhost-vsock-device" in rhel8.6.0 [rhel-8.7.0]
 RH-Commit: [1/1] d82ea09e123679521503689f7d9af1c03dc71bfc
 RH-Bugzilla: 2068202
 RH-Acked-by: Jason Wang <None>
 RH-Acked-by: Eugenio Pérez <None>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 vhost-vsock device in RHEL 8 kernels doesn't support seqpacket.
 To avoid problems when migrating a VM from RHEL 9 host, we need to
 disable it in rhel8-* machine types.
 Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
 ---
 hw/core/machine.c          | 10 ++++++++++
 hw/i386/pc_piix.c          |  2 ++
 hw/i386/pc_q35.c           |  2 ++
 hw/s390x/s390-virtio-ccw.c |  1 +
 include/hw/boards.h        |  3 +++
 5 files changed, 18 insertions(+)
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index 024b025fc2..76fcabec7a 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -37,6 +37,16 @@
 #include "hw/virtio/virtio.h"
 #include "hw/virtio/virtio-pci.h"
 +GlobalProperty hw_compat_rhel_8_6[] = {
 +    /* hw_compat_rhel_8_6 bz 2068202 */
 +    /*
 +     * vhost-vsock device in RHEL 8 kernels doesn't support seqpacket, so
 +     * we need do disable it downstream on the latest hw_compat_rhel_8.
 +     */
 +    { "vhost-vsock-device", "seqpacket", "off" },
 +};
 +const size_t hw_compat_rhel_8_6_len = G_N_ELEMENTS(hw_compat_rhel_8_6);
 +
 /*
  * Mostly the same as hw_compat_6_0 and hw_compat_6_1
  */
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
 index f03a8f0db8..ab6d03e07a 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
@@ -998,6 +998,8 @@ static void pc_machine_rhel760_options(MachineClass *m)
     pcmc->kvmclock_create_always = false;
     /* From pc_i440fx_5_1_machine_options() */
     pcmc->pci_root_uid = 1;
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_6,
 +                     hw_compat_rhel_8_6_len);
     compat_props_add(m->compat_props, hw_compat_rhel_8_5,
                      hw_compat_rhel_8_5_len);
     compat_props_add(m->compat_props, pc_rhel_8_5_compat,
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
 index 5559261d9e..882fe7a68d 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
@@ -658,6 +658,8 @@ static void pc_q35_machine_rhel860_options(MachineClass *m)
     m->desc = "RHEL-8.6.0 PC (Q35 + ICH9, 2009)";
     pcmc->smbios_stream_product = "RHEL-AV";
     pcmc->smbios_stream_version = "8.6.0";
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_6,
 +                     hw_compat_rhel_8_6_len);
 }
 DEFINE_PC_MACHINE(q35_rhel860, "pc-q35-rhel8.6.0", pc_q35_init_rhel860,
 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
 index 9795eb9406..bec270598b 100644
 --- a/hw/s390x/s390-virtio-ccw.c
 +++ b/hw/s390x/s390-virtio-ccw.c
@@ -1109,6 +1109,7 @@ static void ccw_machine_rhel860_instance_options(MachineState *machine)
 static void ccw_machine_rhel860_class_options(MachineClass *mc)
 {
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_6, hw_compat_rhel_8_6_len);
 }
 DEFINE_CCW_MACHINE(rhel860, "rhel8.6.0", true);
 diff --git a/include/hw/boards.h b/include/hw/boards.h
 index 04e8759815..4ddb798144 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
@@ -443,6 +443,9 @@ extern const size_t hw_compat_2_2_len;
 extern GlobalProperty hw_compat_2_1[];
 extern const size_t hw_compat_2_1_len;
 +extern GlobalProperty hw_compat_rhel_8_6[];
 +extern const size_t hw_compat_rhel_8_6_len;
 +
 extern GlobalProperty hw_compat_rhel_8_5[];
 extern const size_t hw_compat_rhel_8_5_len;
 -- 
 2.27.0
--- a/SOURCES/kvm-Revert-chardev-char-socket-Fix-TLS-io-channels-sendi.patch
+++ b/SOURCES/kvm-Revert-chardev-char-socket-Fix-TLS-io-channels-sendi.patch
@ -1,60 +0,0 @@
 From 2e0e4355b2d4edb66b7d8c198339e17940abd682 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
 Date: Mon, 18 Mar 2024 13:03:19 +0000
 Subject: [PATCH 2/3] Revert "chardev/char-socket: Fix TLS io channels sending
 too much data to the backend"
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Daniel P. Berrangé <berrange@redhat.com>
 RH-MergeRequest: 233: Fix handling of TLS sessions in chardevs
 RH-Jira: RHEL-24614
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
 RH-Commit: [2/3] 1cb3d72b86ced0f70a09dfa0d325ae8a85db1b2b (berrange/centos-src-qemu)
 This commit results in unexpected termination of the TLS connection.
 When 'fd_can_read' returns 0, the code goes on to pass a zero length
 buffer to qio_channel_read. The TLS impl calls into gnutls_recv()
 with this zero length buffer, at which point GNUTLS returns an error
 GNUTLS_E_INVALID_REQUEST. This is treated as fatal by QEMU's TLS code
 resulting in the connection being torn down by the chardev.
 Simply skipping the qio_channel_read when the buffer length is zero
 is also not satisfactory, as it results in a high CPU burn busy loop
 massively slowing QEMU's functionality.
 The proper solution is to avoid tcp_chr_read being called at all
 unless the frontend is able to accept more data. This will be done
 in a followup commit.
 This reverts commit 462945cd22d2bcd233401ed3aa167d83a8e35b05
 Reviewed-by: Thomas Huth <thuth@redhat.com>
 Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
 (cherry picked from commit e8ee827ffdb86ebbd5f5213a1f78123c25a90864)
 ---
 chardev/char-socket.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
 diff --git a/chardev/char-socket.c b/chardev/char-socket.c
 index f48d341ebc..51d0943fce 100644
 --- a/chardev/char-socket.c
 +++ b/chardev/char-socket.c
@@ -492,9 +492,9 @@ static gboolean tcp_chr_read(QIOChannel *chan, GIOCondition cond, void *opaque)
         s->max_size <= 0) {
         return TRUE;
     }
 -    len = tcp_chr_read_poll(opaque);
 -    if (len > sizeof(buf)) {
 -        len = sizeof(buf);
 +    len = sizeof(buf);
 +    if (len > s->max_size) {
 +        len = s->max_size;
     }
     size = tcp_chr_recv(chr, (void *)buf, len);
     if (size == 0 || (size == -1 && errno != EAGAIN)) {
 -- 
 2.39.3
--- a/SOURCES/kvm-Revert-chardev-use-a-child-source-for-qio-input-sour.patch
+++ b/SOURCES/kvm-Revert-chardev-use-a-child-source-for-qio-input-sour.patch
@ -1,216 +0,0 @@
 From ab5a33d57b48e35388928e388bb6e6479bc77651 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
 Date: Mon, 18 Mar 2024 17:08:30 +0000
 Subject: [PATCH 3/3] Revert "chardev: use a child source for qio input source"
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Daniel P. Berrangé <berrange@redhat.com>
 RH-MergeRequest: 233: Fix handling of TLS sessions in chardevs
 RH-Jira: RHEL-24614
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
 RH-Commit: [3/3] b58e6c19c2b11d5d28db31cf1386226fb01d195e (berrange/centos-src-qemu)
 This reverts commit a7077b8e354d90fec26c2921aa2dea85b90dff90,
 and add comments to explain why child sources cannot be used.
 When a GSource is added as a child of another GSource, if its
 'prepare' function indicates readiness, then the parent's
 'prepare' function will never be run. The io_watch_poll_prepare
 absolutely *must* be run on every iteration of the main loop,
 to ensure that the chardev backend doesn't feed data to the
 frontend that it is unable to consume.
 At the time a7077b8e354d90fec26c2921aa2dea85b90dff90 was made,
 all the child GSource impls were relying on poll'ing an FD,
 so their 'prepare' functions would never indicate readiness
 ahead of poll() being invoked. So the buggy behaviour was
 not noticed and lay dormant.
 Relatively recently the QIOChannelTLS impl introduced a
 level 2 child GSource, which checks with GNUTLS whether it
 has cached any data that was decoded but not yet consumed:
  commit ffda5db65aef42266a5053a4be34515106c4c7ee
  Author: Antoine Damhet <antoine.damhet@shadow.tech>
  Date:   Tue Nov 15 15:23:29 2022 +0100
    io/channel-tls: fix handling of bigger read buffers
    Since the TLS backend can read more data from the underlying QIOChannel
    we introduce a minimal child GSource to notify if we still have more
    data available to be read.
    Signed-off-by: Antoine Damhet <antoine.damhet@shadow.tech>
    Signed-off-by: Charles Frey <charles.frey@shadow.tech>
    Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
 With this, it is now quite common for the 'prepare' function
 on a QIOChannelTLS GSource to indicate immediate readiness,
 bypassing the parent GSource 'prepare' function. IOW, the
 critical 'io_watch_poll_prepare' is being skipped on some
 iterations of the main loop. As a result chardev frontend
 asserts are now being triggered as they are fed data they
 are not ready to consume.
 A reproducer is as follows:
 * In terminal 1 run a GNUTLS *echo* server
   $ gnutls-serv --echo \
                 --x509cafile ca-cert.pem \
                 --x509keyfile server-key.pem \
 		 --x509certfile server-cert.pem \
 		 -p 9000
 * In terminal 2 run a QEMU guest
   $ qemu-system-s390x \
       -nodefaults \
       -display none \
       -object tls-creds-x509,id=tls0,dir=$PWD,endpoint=client \
       -chardev socket,id=con0,host=localhost,port=9000,tls-creds=tls0 \
       -device sclpconsole,chardev=con0 \
       -hda Fedora-Cloud-Base-39-1.5.s390x.qcow2
 After the previous patch revert, but before this patch revert,
 this scenario will crash:
  qemu-system-s390x: ../hw/char/sclpconsole.c:73: chr_read: Assertion
  `size <= SIZE_BUFFER_VT220 - scon->iov_data_len' failed.
 This assert indicates that 'tcp_chr_read' was called without
 'tcp_chr_read_poll' having first been checked for ability to
 receive more data
 QEMU's use of a 'prepare' function to create/delete another
 GSource is rather a hack and not normally the kind of thing that
 is expected to be done by a GSource. There is no mechanism to
 force GLib to always run the 'prepare' function of a parent
 GSource. The best option is to simply not use the child source
 concept, and go back to the functional approach previously
 relied on.
 Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
 Reviewed-by: Thomas Huth <thuth@redhat.com>
 Tested-by: Thomas Huth <thuth@redhat.com>
 Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
 (cherry picked from commit 038b4217884c6f297278bb1ec6f0463c6c8221de)
 ---
 chardev/char-io.c | 56 ++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 51 insertions(+), 5 deletions(-)
 diff --git a/chardev/char-io.c b/chardev/char-io.c
 index 4451128cba..dab77b112e 100644
 --- a/chardev/char-io.c
 +++ b/chardev/char-io.c
@@ -33,6 +33,7 @@ typedef struct IOWatchPoll {
     IOCanReadHandler *fd_can_read;
     GSourceFunc fd_read;
     void *opaque;
 +    GMainContext *context;
 } IOWatchPoll;
 static IOWatchPoll *io_watch_poll_from_source(GSource *source)
@@ -50,28 +51,59 @@ static gboolean io_watch_poll_prepare(GSource *source,
         return FALSE;
     }
 +    /*
 +     * We do not register the QIOChannel watch as a child GSource.
 +     * The 'prepare' function on the parent GSource will be
 +     * skipped if a child GSource's 'prepare' function indicates
 +     * readiness. We need this prepare function be guaranteed
 +     * to run on *every* iteration of the main loop, because
 +     * it is critical to ensure we remove the QIOChannel watch
 +     * if 'fd_can_read' indicates the frontend cannot receive
 +     * more data.
 +     */
     if (now_active) {
         iwp->src = qio_channel_create_watch(
             iwp->ioc, G_IO_IN | G_IO_ERR | G_IO_HUP | G_IO_NVAL);
         g_source_set_callback(iwp->src, iwp->fd_read, iwp->opaque, NULL);
 -        g_source_add_child_source(source, iwp->src);
 -        g_source_unref(iwp->src);
 +        g_source_attach(iwp->src, iwp->context);
     } else {
 -        g_source_remove_child_source(source, iwp->src);
 +        g_source_destroy(iwp->src);
 +        g_source_unref(iwp->src);
         iwp->src = NULL;
     }
     return FALSE;
 }
 +static gboolean io_watch_poll_check(GSource *source)
 +{
 +    return FALSE;
 +}
 +
 static gboolean io_watch_poll_dispatch(GSource *source, GSourceFunc callback,
                                        gpointer user_data)
 {
 -    return G_SOURCE_CONTINUE;
 +    abort();
 +}
 +
 +static void io_watch_poll_finalize(GSource *source)
 +{
 +    /*
 +     * Due to a glib bug, removing the last reference to a source
 +     * inside a finalize callback causes recursive locking (and a
 +     * deadlock).  This is not a problem inside other callbacks,
 +     * including dispatch callbacks, so we call io_remove_watch_poll
 +     * to remove this source.  At this point, iwp->src must
 +     * be NULL, or we would leak it.
 +     */
 +    IOWatchPoll *iwp = io_watch_poll_from_source(source);
 +    assert(iwp->src == NULL);
 }
 static GSourceFuncs io_watch_poll_funcs = {
     .prepare = io_watch_poll_prepare,
 +    .check = io_watch_poll_check,
     .dispatch = io_watch_poll_dispatch,
 +    .finalize = io_watch_poll_finalize,
 };
 GSource *io_add_watch_poll(Chardev *chr,
@@ -91,6 +123,7 @@ GSource *io_add_watch_poll(Chardev *chr,
     iwp->ioc = ioc;
     iwp->fd_read = (GSourceFunc) fd_read;
     iwp->src = NULL;
 +    iwp->context = context;
     name = g_strdup_printf("chardev-iowatch-%s", chr->label);
     g_source_set_name((GSource *)iwp, name);
@@ -101,10 +134,23 @@ GSource *io_add_watch_poll(Chardev *chr,
     return (GSource *)iwp;
 }
 +static void io_remove_watch_poll(GSource *source)
 +{
 +    IOWatchPoll *iwp;
 +
 +    iwp = io_watch_poll_from_source(source);
 +    if (iwp->src) {
 +        g_source_destroy(iwp->src);
 +        g_source_unref(iwp->src);
 +        iwp->src = NULL;
 +    }
 +    g_source_destroy(&iwp->parent);
 +}
 +
 void remove_fd_in_watch(Chardev *chr)
 {
     if (chr->gsource) {
 -        g_source_destroy(chr->gsource);
 +        io_remove_watch_poll(chr->gsource);
         chr->gsource = NULL;
     }
 }
 -- 
 2.39.3
--- a/SOURCES/kvm-Revert-redhat-Add-hw_compat_4_2_extra-and-apply-to-u.patch
+++ b/SOURCES/kvm-Revert-redhat-Add-hw_compat_4_2_extra-and-apply-to-u.patch
@ -0,0 +1,93 @@
 From e626dc16d130c724c400b99a93daad0a9abeae59 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Tue, 22 Mar 2022 19:23:36 -0400
 Subject: [PATCH 01/18] Revert "redhat: Add hw_compat_4_2_extra and apply to
 upstream machines"
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 131: Revert "redhat: Add hw_compat_4_2_extra and apply to upstream machines"
 RH-Commit: [1/3] 47b7d9e5062f5e215d5ed1a3ecdc1a87ac3fa630 (jmaloy/qemu-kvm)
 RH-Bugzilla: 2062613
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 BZ: https://bugzilla.redhat.com/2062613
 UPSTREAM: no
 BREW: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=44038000
 commit dc2e9ec1e014950c7918e23a3e9b0096b34a4a92
 Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Date:   Wed Mar 9 10:31:53 2022 +0000
    Revert "redhat: Add hw_compat_4_2_extra and apply to upstream machines"
    This reverts commit 66882f9a3230246409f3918424aca26add5c034a.
    We no longer need these compat machines it was added for.
    Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 (cherry picked from commit dc2e9ec1e014950c7918e23a3e9b0096b34a4a92)
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 hw/i386/pc.c         | 12 ------------
 hw/i386/pc_piix.c    |  6 ------
 include/hw/i386/pc.h |  3 ---
 3 files changed, 21 deletions(-)
 diff --git a/hw/i386/pc.c b/hw/i386/pc.c
 index 4c08a1971c..357257349b 100644
 --- a/hw/i386/pc.c
 +++ b/hw/i386/pc.c
@@ -670,18 +670,6 @@ GlobalProperty pc_rhel_7_0_compat[] = {
 };
 const size_t pc_rhel_7_0_compat_len = G_N_ELEMENTS(pc_rhel_7_0_compat);
 -/*
 - * RHEL: These properties only apply to the RHEL exported machine types
 - * pc-4.2/2.11 for the purpose to have a limited upstream machines support
 - * which can be migrated to RHEL.  Let's avoid touching hw_compat_4_2 directly
 - * so that we can have some isolation against the upstream code.
 - */
 -GlobalProperty hw_compat_4_2_extra[] = {
 -    /* By default enlarge the default virtio-net-pci ROM to 512KB. */
 -    { "virtio-net-pci", "romsize", "0x80000" },
 -};
 -const size_t hw_compat_4_2_extra_len = G_N_ELEMENTS(hw_compat_4_2_extra);
 -
 GSIState *pc_gsi_create(qemu_irq **irqs, bool pci_enabled)
 {
     GSIState *s;
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
 index c30057c443..7b7076cbc7 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
@@ -531,12 +531,6 @@ static void pc_i440fx_4_2_machine_options(MachineClass *m)
      * supported by RHEL, even if exported.
      */
     m->deprecation_reason = "Not supported by RHEL";
 -    /*
 -     * RHEL: Specific compat properties to have limited support for upstream
 -     * machines exported.
 -     */
 -    compat_props_add(m->compat_props, hw_compat_4_2_extra,
 -                     hw_compat_4_2_extra_len);
 }
 /* RHEL: Export pc-4.2 */
 diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
 index 9e8bfb69f8..4a593acb50 100644
 --- a/include/hw/i386/pc.h
 +++ b/include/hw/i386/pc.h
@@ -325,9 +325,6 @@ extern const size_t pc_rhel_7_1_compat_len;
 extern GlobalProperty pc_rhel_7_0_compat[];
 extern const size_t pc_rhel_7_0_compat_len;
 -extern GlobalProperty hw_compat_4_2_extra[];
 -extern const size_t hw_compat_4_2_extra_len;
 -
 /* Helper for setting model-id for CPU models that changed model-id
  * depending on QEMU versions up to QEMU 2.4.
  */
 -- 
 2.27.0
--- a/SOURCES/kvm-Revert-redhat-Add-some-devices-for-exporting-upstrea.patch
+++ b/SOURCES/kvm-Revert-redhat-Add-some-devices-for-exporting-upstrea.patch
@ -0,0 +1,128 @@
 From 96edd15df257f1d1496397a6fac24b4316570d7e Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Thu, 14 Apr 2022 16:45:30 -0400
 Subject: [PATCH 1/3] Revert redhat: Add some devices for exporting upstream
 machine types
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 156: Revert redhat: Add some devices for exporting upstream machine types
 RH-Commit: [1/1] f25d0da3a181136917ead82f5a5c59efe3fa445a (jmaloy/qemu-kvm)
 RH-Bugzilla: 2065043
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2065043
 Upstream: no
 Manual revert of commit 70d3924521c9bfd912bcf1a1fc76f49eb377de46, since
 the directory structure looks different from rhel-av-8.4.0.z where
 this commit is taken from. Besides, x86_64-softmmu.mak looks totally
 different and should not be affected by this reversal.
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 configs/devices/x86_64-softmmu/x86_64-rh-devices.mak     | 1 -
 .../devices/x86_64-softmmu/x86_64-upstream-devices.mak   | 4 ----
 hw/char/parallel.c                                       | 9 ---------
 hw/i386/pc_piix.c                                        | 2 +-
 hw/i386/pc_q35.c                                         | 2 +-
 hw/timer/hpet.c                                          | 8 --------
 6 files changed, 2 insertions(+), 24 deletions(-)
 delete mode 100644 configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak
 diff --git a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 index fdbbdf9742..31ce08edab 100644
 --- a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 +++ b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
@@ -1,5 +1,4 @@
 include ../rh-virtio.mak
 -include x86_64-upstream-devices.mak
 CONFIG_AC97=y
 CONFIG_ACPI=y
 diff --git a/configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak b/configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak
 deleted file mode 100644
 index 2cd20f54d2..0000000000
 --- a/configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak
 +++ /dev/null
@@ -1,4 +0,0 @@
 -# We need "isa-parallel"
 -CONFIG_PARALLEL=y
 -# We need "hpet"
 -CONFIG_HPET=y
 diff --git a/hw/char/parallel.c b/hw/char/parallel.c
 index e5f108211b..b45e67bfbb 100644
 --- a/hw/char/parallel.c
 +++ b/hw/char/parallel.c
@@ -29,7 +29,6 @@
 #include "chardev/char-parallel.h"
 #include "chardev/char-fe.h"
 #include "hw/acpi/aml-build.h"
 -#include "hw/boards.h"
 #include "hw/irq.h"
 #include "hw/isa/isa.h"
 #include "hw/qdev-properties.h"
@@ -535,14 +534,6 @@ static void parallel_isa_realizefn(DeviceState *dev, Error **errp)
     int base;
     uint8_t dummy;
 -    /* Restricted for Red Hat Enterprise Linux */
 -    MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
 -    if (strstr(mc->name, "rhel")) {
 -        error_setg(errp, "Device %s is not supported with machine type %s",
 -                   object_get_typename(OBJECT(dev)), mc->name);
 -        return;
 -    }
 -
     if (!qemu_chr_fe_backend_connected(&s->chr)) {
         error_setg(errp, "Can't create parallel device, empty char device");
         return;
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
 index ab6d03e07a..5f101c8748 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
@@ -966,7 +966,7 @@ static void pc_machine_rhel7_options(MachineClass *m)
 {
     PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
     m->family = "pc_piix_Y";
 -    m->default_machine_opts = "firmware=bios-256k.bin,hpet=off";
 +    m->default_machine_opts = "firmware=bios-256k.bin";
     pcmc->default_nic_model = "e1000";
     pcmc->pci_root_uid = 0;
     m->default_display = "std";
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
 index 882fe7a68d..73b0d0d317 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
@@ -633,7 +633,7 @@ static void pc_q35_machine_rhel_options(MachineClass *m)
     pcmc->pci_root_uid = 0;
     m->family = "pc_q35_Z";
     m->units_per_default_bus = 1;
 -    m->default_machine_opts = "firmware=bios-256k.bin,hpet=off";
 +    m->default_machine_opts = "firmware=bios-256k.bin";
     m->default_display = "std";
     m->no_floppy = 1;
     m->no_parallel = 1;
 diff --git a/hw/timer/hpet.c b/hw/timer/hpet.c
 index 202e032524..9520471be2 100644
 --- a/hw/timer/hpet.c
 +++ b/hw/timer/hpet.c
@@ -733,14 +733,6 @@ static void hpet_realize(DeviceState *dev, Error **errp)
     int i;
     HPETTimer *timer;
 -    /* Restricted for Red Hat Enterprise Linux */
 -    MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
 -    if (strstr(mc->name, "rhel")) {
 -        error_setg(errp, "Device %s is not supported with machine type %s",
 -                   object_get_typename(OBJECT(dev)), mc->name);
 -        return;
 -    }
 -
     if (!s->intcap) {
         warn_report("Hpet's intcap not initialized");
     }
 -- 
 2.35.1
--- a/SOURCES/kvm-Revert-redhat-Enable-FDC-device-for-upstream-machine.patch
+++ b/SOURCES/kvm-Revert-redhat-Enable-FDC-device-for-upstream-machine.patch
@ -0,0 +1,53 @@
 From 5bf8f1d69fea1225e927fbb3efe549a2a9d47d92 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Tue, 22 Mar 2022 19:23:36 -0400
 Subject: [PATCH 02/18] Revert "redhat: Enable FDC device for upstream machines
 too"
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 131: Revert "redhat: Add hw_compat_4_2_extra and apply to upstream machines"
 RH-Commit: [2/3] 4e3c945e3de9bb9d9a6d24115f0719168c9669fe (jmaloy/qemu-kvm)
 RH-Bugzilla: 2062613
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 BZ: https://bugzilla.redhat.com/2062613
 UPSTREAM: no
 BREW: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=44038000
 commit 597cb6ca1da4a3eea77c1e4928f55203a1d5c70c
 Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Date:   Wed Mar 9 10:32:39 2022 +0000
    Revert "redhat: Enable FDC device for upstream machines too"
    This reverts commit c4d1aa8bf21fe98da94a9cff30b7c25bed12c17f.
    We no longer need these compat machines it was added for.
  Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 (cherry picked from commit 597cb6ca1da4a3eea77c1e4928f55203a1d5c70c)
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 hw/block/fdc.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)
 diff --git a/hw/block/fdc.c b/hw/block/fdc.c
 index 63042ef030..97fa6de423 100644
 --- a/hw/block/fdc.c
 +++ b/hw/block/fdc.c
@@ -2341,10 +2341,7 @@ void fdctrl_realize_common(DeviceState *dev, FDCtrl *fdctrl, Error **errp)
     /* Restricted for Red Hat Enterprise Linux: */
     MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
 -    if (!strstr(mc->name, "-rhel7.") &&
 -        /* Exported two upstream machine types allows FDC too */
 -        strcmp(mc->name, "pc-i440fx-4.2") &&
 -        strcmp(mc->name, "pc-i440fx-2.11")) {
 +    if (!strstr(mc->name, "-rhel7.")) {
         error_setg(errp, "Device %s is not supported with machine type %s",
                    object_get_typename(OBJECT(dev)), mc->name);
         return;
 -- 
 2.27.0
--- a/SOURCES/kvm-Revert-redhat-Expose-upstream-machines-pc-4.2-and-pc.patch
+++ b/SOURCES/kvm-Revert-redhat-Expose-upstream-machines-pc-4.2-and-pc.patch
@ -0,0 +1,191 @@
 From ee3cae3bb349469edcf725a1c5161521e95dcb9f Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Tue, 22 Mar 2022 19:23:36 -0400
 Subject: [PATCH 03/18] Revert "redhat: Expose upstream machines pc-4.2 and
 pc-2.11"
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 131: Revert "redhat: Add hw_compat_4_2_extra and apply to upstream machines"
 RH-Commit: [3/3] 35cee68034580f81b3aa916921eecd2fdfa7dd15 (jmaloy/qemu-kvm)
 RH-Bugzilla: 2062613
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 BZ: https://bugzilla.redhat.com/2062613
 UPSTREAM: no
 BREW: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=44038000
 commit f3b50d6d4ae0be9e64aafe6a15f5423bab4899e9
 Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Date:   Wed Mar 9 10:34:58 2022 +0000
    Revert "redhat: Expose upstream machines pc-4.2 and pc-2.11"
    This reverts commit 618e2424edba499d52cd26cf8363bc2dd85ef149.
    We no longer need these compat machines.
    Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 (cherry picked from commit f3b50d6d4ae0be9e64aafe6a15f5423bab4899e9)
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 hw/i386/pc_piix.c | 37 -------------------------------------
 1 file changed, 37 deletions(-)
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
 index 7b7076cbc7..f03a8f0db8 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
@@ -315,14 +315,6 @@ static void pc_init1(MachineState *machine,
  * hw_compat_*, pc_compat_*, or * pc_*_machine_options().
  */
 -/*
 - * NOTE!  Not all the upstream machine types are disabled for RHEL.  For
 - * providing a very limited support for upstream machine types, pc machines
 - * 2.11 and 4.2 are exposed explicitly.  This will make the below "#if" macros
 - * a bit messed up, but please read this comment first so that we can have a
 - * rough understanding of what we're going to do.
 - */
 -
 #if 0 /* Disabled for Red Hat Enterprise Linux */
 static void pc_compat_2_3_fn(MachineState *machine)
 {
@@ -399,8 +391,6 @@ static void pc_xen_hvm_init(MachineState *machine)
 }
 #endif
 -#endif /* Disabled for Red Hat Enterprise Linux */
 -
 #define DEFINE_I440FX_MACHINE(suffix, name, compatfn, optionfn) \
     static void pc_init_##suffix(MachineState *machine) \
     { \
@@ -465,10 +455,8 @@ static void pc_i440fx_6_0_machine_options(MachineClass *m)
     compat_props_add(m->compat_props, pc_compat_6_0, pc_compat_6_0_len);
 }
 -#if 0 /* Disabled for Red Hat Enterprise Linux */
 DEFINE_I440FX_MACHINE(v6_0, "pc-i440fx-6.0", NULL,
                       pc_i440fx_6_0_machine_options);
 -#endif /* Disabled for Red Hat Enterprise Linux */
 static void pc_i440fx_5_2_machine_options(MachineClass *m)
 {
@@ -479,10 +467,8 @@ static void pc_i440fx_5_2_machine_options(MachineClass *m)
     compat_props_add(m->compat_props, pc_compat_5_2, pc_compat_5_2_len);
 }
 -#if 0 /* Disabled for Red Hat Enterprise Linux */
 DEFINE_I440FX_MACHINE(v5_2, "pc-i440fx-5.2", NULL,
                       pc_i440fx_5_2_machine_options);
 -#endif /* Disabled for Red Hat Enterprise Linux */
 static void pc_i440fx_5_1_machine_options(MachineClass *m)
 {
@@ -497,10 +483,8 @@ static void pc_i440fx_5_1_machine_options(MachineClass *m)
     pcmc->pci_root_uid = 1;
 }
 -#if 0 /* Disabled for Red Hat Enterprise Linux */
 DEFINE_I440FX_MACHINE(v5_1, "pc-i440fx-5.1", NULL,
                       pc_i440fx_5_1_machine_options);
 -#endif /* Disabled for Red Hat Enterprise Linux */
 static void pc_i440fx_5_0_machine_options(MachineClass *m)
 {
@@ -513,10 +497,8 @@ static void pc_i440fx_5_0_machine_options(MachineClass *m)
     m->auto_enable_numa_with_memdev = false;
 }
 -#if 0 /* Disabled for Red Hat Enterprise Linux */
 DEFINE_I440FX_MACHINE(v5_0, "pc-i440fx-5.0", NULL,
                       pc_i440fx_5_0_machine_options);
 -#endif /* Disabled for Red Hat Enterprise Linux */
 static void pc_i440fx_4_2_machine_options(MachineClass *m)
 {
@@ -525,15 +507,8 @@ static void pc_i440fx_4_2_machine_options(MachineClass *m)
     m->is_default = false;
     compat_props_add(m->compat_props, hw_compat_4_2, hw_compat_4_2_len);
     compat_props_add(m->compat_props, pc_compat_4_2, pc_compat_4_2_len);
 -
 -    /*
 -     * RHEL: Mark all upstream machines as deprecated because they're not
 -     * supported by RHEL, even if exported.
 -     */
 -    m->deprecation_reason = "Not supported by RHEL";
 }
 -/* RHEL: Export pc-4.2 */
 DEFINE_I440FX_MACHINE(v4_2, "pc-i440fx-4.2", NULL,
                       pc_i440fx_4_2_machine_options);
@@ -546,10 +521,8 @@ static void pc_i440fx_4_1_machine_options(MachineClass *m)
     compat_props_add(m->compat_props, pc_compat_4_1, pc_compat_4_1_len);
 }
 -#if 0 /* Disabled for Red Hat Enterprise Linux */
 DEFINE_I440FX_MACHINE(v4_1, "pc-i440fx-4.1", NULL,
                       pc_i440fx_4_1_machine_options);
 -#endif /* Disabled for Red Hat Enterprise Linux */
 static void pc_i440fx_4_0_machine_options(MachineClass *m)
 {
@@ -562,10 +535,8 @@ static void pc_i440fx_4_0_machine_options(MachineClass *m)
     compat_props_add(m->compat_props, pc_compat_4_0, pc_compat_4_0_len);
 }
 -#if 0 /* Disabled for Red Hat Enterprise Linux */
 DEFINE_I440FX_MACHINE(v4_0, "pc-i440fx-4.0", NULL,
                       pc_i440fx_4_0_machine_options);
 -#endif /* Disabled for Red Hat Enterprise Linux */
 static void pc_i440fx_3_1_machine_options(MachineClass *m)
 {
@@ -581,10 +552,8 @@ static void pc_i440fx_3_1_machine_options(MachineClass *m)
     compat_props_add(m->compat_props, pc_compat_3_1, pc_compat_3_1_len);
 }
 -#if 0 /* Disabled for Red Hat Enterprise Linux */
 DEFINE_I440FX_MACHINE(v3_1, "pc-i440fx-3.1", NULL,
                       pc_i440fx_3_1_machine_options);
 -#endif /* Disabled for Red Hat Enterprise Linux */
 static void pc_i440fx_3_0_machine_options(MachineClass *m)
 {
@@ -593,10 +562,8 @@ static void pc_i440fx_3_0_machine_options(MachineClass *m)
     compat_props_add(m->compat_props, pc_compat_3_0, pc_compat_3_0_len);
 }
 -#if 0 /* Disabled for Red Hat Enterprise Linux */
 DEFINE_I440FX_MACHINE(v3_0, "pc-i440fx-3.0", NULL,
                       pc_i440fx_3_0_machine_options);
 -#endif /* Disabled for Red Hat Enterprise Linux */
 static void pc_i440fx_2_12_machine_options(MachineClass *m)
 {
@@ -605,10 +572,8 @@ static void pc_i440fx_2_12_machine_options(MachineClass *m)
     compat_props_add(m->compat_props, pc_compat_2_12, pc_compat_2_12_len);
 }
 -#if 0 /* Disabled for Red Hat Enterprise Linux */
 DEFINE_I440FX_MACHINE(v2_12, "pc-i440fx-2.12", NULL,
                       pc_i440fx_2_12_machine_options);
 -#endif /* Disabled for Red Hat Enterprise Linux */
 static void pc_i440fx_2_11_machine_options(MachineClass *m)
 {
@@ -617,11 +582,9 @@ static void pc_i440fx_2_11_machine_options(MachineClass *m)
     compat_props_add(m->compat_props, pc_compat_2_11, pc_compat_2_11_len);
 }
 -/* RHEL: Export pc-2.11 */
 DEFINE_I440FX_MACHINE(v2_11, "pc-i440fx-2.11", NULL,
                       pc_i440fx_2_11_machine_options);
 -#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void pc_i440fx_2_10_machine_options(MachineClass *m)
 {
     pc_i440fx_2_11_machine_options(m);
 -- 
 2.27.0
--- a/SOURCES/kvm-Update-linux-headers-to-v6.0-rc4.patch
+++ b/SOURCES/kvm-Update-linux-headers-to-v6.0-rc4.patch
@ -0,0 +1,171 @@
 From 10fc28b61a6fba1e6dc44fd544cf31c7f313c622 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
 Date: Fri, 28 Oct 2022 17:48:00 +0100
 Subject: [PATCH 05/42] Update linux headers to v6.0-rc4
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Cédric Le Goater <clg@redhat.com>
 RH-MergeRequest: 226: s390: Enhanced Interpretation for PCI Functions and Secure Execution guest dump
 RH-Bugzilla: 1664378 2043909
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
 RH-Commit: [5/41] ca55f497d1bf1e72179330f8f613781bf999d898
 Based on upstream commit d525f73f9186a5bc641b8caf0b2c9bb94e5aa963
 ("Update linux headers to v6.0-rc4"), but this is focusing only on the
 ZPCI and protected dump changes.
 Signed-off-by: Cédric Le Goater <clg@redhat.com>
 ---
 linux-headers/linux/kvm.h       | 87 +++++++++++++++++++++++++++++++++
 linux-headers/linux/vfio_zdev.h |  7 +++
 2 files changed, 94 insertions(+)
 diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h
 index 0d05d02ee4..c65930288c 100644
 --- a/linux-headers/linux/kvm.h
 +++ b/linux-headers/linux/kvm.h
@@ -1150,6 +1150,9 @@ struct kvm_ppc_resize_hpt {
 #define KVM_CAP_DISABLE_QUIRKS2 213
 /* #define KVM_CAP_VM_TSC_CONTROL 214 */
 #define KVM_CAP_SYSTEM_EVENT_DATA 215
 +#define KVM_CAP_S390_PROTECTED_DUMP 217
 +#define KVM_CAP_S390_ZPCI_OP 221
 +#define KVM_CAP_S390_CPU_TOPOLOGY 222
 #ifdef KVM_CAP_IRQ_ROUTING
@@ -1651,6 +1654,55 @@ struct kvm_s390_pv_unp {
 	__u64 tweak;
 };
 +enum pv_cmd_dmp_id {
 +	KVM_PV_DUMP_INIT,
 +	KVM_PV_DUMP_CONFIG_STOR_STATE,
 +	KVM_PV_DUMP_COMPLETE,
 +	KVM_PV_DUMP_CPU,
 +};
 +
 +struct kvm_s390_pv_dmp {
 +	__u64 subcmd;
 +	__u64 buff_addr;
 +	__u64 buff_len;
 +	__u64 gaddr;		/* For dump storage state */
 +	__u64 reserved[4];
 +};
 +
 +enum pv_cmd_info_id {
 +	KVM_PV_INFO_VM,
 +	KVM_PV_INFO_DUMP,
 +};
 +
 +struct kvm_s390_pv_info_dump {
 +	__u64 dump_cpu_buffer_len;
 +	__u64 dump_config_mem_buffer_per_1m;
 +	__u64 dump_config_finalize_len;
 +};
 +
 +struct kvm_s390_pv_info_vm {
 +	__u64 inst_calls_list[4];
 +	__u64 max_cpus;
 +	__u64 max_guests;
 +	__u64 max_guest_addr;
 +	__u64 feature_indication;
 +};
 +
 +struct kvm_s390_pv_info_header {
 +	__u32 id;
 +	__u32 len_max;
 +	__u32 len_written;
 +	__u32 reserved;
 +};
 +
 +struct kvm_s390_pv_info {
 +	struct kvm_s390_pv_info_header header;
 +	union {
 +		struct kvm_s390_pv_info_dump dump;
 +		struct kvm_s390_pv_info_vm vm;
 +	};
 +};
 +
 enum pv_cmd_id {
 	KVM_PV_ENABLE,
 	KVM_PV_DISABLE,
@@ -1659,6 +1711,8 @@ enum pv_cmd_id {
 	KVM_PV_VERIFY,
 	KVM_PV_PREP_RESET,
 	KVM_PV_UNSHARE_ALL,
 +	KVM_PV_INFO,
 +	KVM_PV_DUMP,
 };
 struct kvm_pv_cmd {
@@ -2066,4 +2120,37 @@ struct kvm_stats_desc {
 /* Available with KVM_CAP_XSAVE2 */
 #define KVM_GET_XSAVE2		  _IOR(KVMIO,  0xcf, struct kvm_xsave)
 +/* Available with KVM_CAP_S390_PROTECTED_DUMP */
 +#define KVM_S390_PV_CPU_COMMAND	_IOWR(KVMIO, 0xd0, struct kvm_pv_cmd)
 +
 +/* Available with KVM_CAP_S390_ZPCI_OP */
 +#define KVM_S390_ZPCI_OP         _IOW(KVMIO,  0xd1, struct kvm_s390_zpci_op)
 +
 +struct kvm_s390_zpci_op {
 +	/* in */
 +	__u32 fh;               /* target device */
 +	__u8  op;               /* operation to perform */
 +	__u8  pad[3];
 +	union {
 +		/* for KVM_S390_ZPCIOP_REG_AEN */
 +		struct {
 +			__u64 ibv;      /* Guest addr of interrupt bit vector */
 +			__u64 sb;       /* Guest addr of summary bit */
 +			__u32 flags;
 +			__u32 noi;      /* Number of interrupts */
 +			__u8 isc;       /* Guest interrupt subclass */
 +			__u8 sbo;       /* Offset of guest summary bit vector */
 +			__u16 pad;
 +		} reg_aen;
 +		__u64 reserved[8];
 +	} u;
 +};
 +
 +/* types for kvm_s390_zpci_op->op */
 +#define KVM_S390_ZPCIOP_REG_AEN                0
 +#define KVM_S390_ZPCIOP_DEREG_AEN      1
 +
 +/* flags for kvm_s390_zpci_op->u.reg_aen.flags */
 +#define KVM_S390_ZPCIOP_REGAEN_HOST    (1 << 0)
 +
 #endif /* __LINUX_KVM_H */
 diff --git a/linux-headers/linux/vfio_zdev.h b/linux-headers/linux/vfio_zdev.h
 index b4309397b6..77f2aff1f2 100644
 --- a/linux-headers/linux/vfio_zdev.h
 +++ b/linux-headers/linux/vfio_zdev.h
@@ -29,6 +29,9 @@ struct vfio_device_info_cap_zpci_base {
 	__u16 fmb_length;	/* Measurement Block Length (in bytes) */
 	__u8 pft;		/* PCI Function Type */
 	__u8 gid;		/* PCI function group ID */
 +	/* End of version 1 */
 +	__u32 fh;		/* PCI function handle */
 +	/* End of version 2 */
 };
 /**
@@ -47,6 +50,10 @@ struct vfio_device_info_cap_zpci_group {
 	__u16 noi;		/* Maximum number of MSIs */
 	__u16 maxstbl;		/* Maximum Store Block Length */
 	__u8 version;		/* Supported PCI Version */
 +	/* End of version 1 */
 +	__u8 reserved;
 +	__u16 imaxstbl;		/* Maximum Interpreted Store Block Length */
 +	/* End of version 2 */
 };
 /**
 -- 
 2.37.3
--- a/SOURCES/kvm-accel-introduce-accelerator-blocker-API.patch
+++ b/SOURCES/kvm-accel-introduce-accelerator-blocker-API.patch
@ -0,0 +1,349 @@
 From a5e7bb1f7a88efb5574266a76e80fd7604d19921 Mon Sep 17 00:00:00 2001
 From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date: Mon, 16 Jan 2023 07:49:59 -0500
 Subject: [PATCH 04/11] accel: introduce accelerator blocker API
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-MergeRequest: 247: accel: introduce accelerator blocker API
 RH-Bugzilla: 2161188
 RH-Acked-by: David Hildenbrand <david@redhat.com>
 RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [1/3] 9d3d7f9554974a79042c915763288cce07aef135
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2161188
 commit bd688fc93120fb3e28aa70e3dfdf567ccc1e0bc1
 Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date:   Fri Nov 11 10:47:56 2022 -0500
    accel: introduce accelerator blocker API
    This API allows the accelerators to prevent vcpus from issuing
    new ioctls while execting a critical section marked with the
    accel_ioctl_inhibit_begin/end functions.
    Note that all functions submitting ioctls must mark where the
    ioctl is being called with accel_{cpu_}ioctl_begin/end().
    This API requires the caller to always hold the BQL.
    API documentation is in sysemu/accel-blocker.h
    Internally, it uses a QemuLockCnt together with a per-CPU QemuLockCnt
    (to minimize cache line bouncing) to keep avoid that new ioctls
    run when the critical section starts, and a QemuEvent to wait
    that all running ioctls finish.
    Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
    Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
    Message-Id: <20221111154758.1372674-2-eesposit@redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 Conflicts:
 	util/meson.build: files are missing in rhel 8.8.0
 	namely int128.c, memalign.c and interval-tree.c
 Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 ---
 accel/accel-blocker.c          | 154 +++++++++++++++++++++++++++++++++
 accel/meson.build              |   2 +-
 hw/core/cpu-common.c           |   2 +
 include/hw/core/cpu.h          |   3 +
 include/sysemu/accel-blocker.h |  56 ++++++++++++
 util/meson.build               |   2 +-
 6 files changed, 217 insertions(+), 2 deletions(-)
 create mode 100644 accel/accel-blocker.c
 create mode 100644 include/sysemu/accel-blocker.h
 diff --git a/accel/accel-blocker.c b/accel/accel-blocker.c
 new file mode 100644
 index 0000000000..1e7f423462
 --- /dev/null
 +++ b/accel/accel-blocker.c
@@ -0,0 +1,154 @@
 +/*
 + * Lock to inhibit accelerator ioctls
 + *
 + * Copyright (c) 2022 Red Hat Inc.
 + *
 + * Author: Emanuele Giuseppe Esposito       <eesposit@redhat.com>
 + *
 + * Permission is hereby granted, free of charge, to any person obtaining a copy
 + * of this software and associated documentation files (the "Software"), to deal
 + * in the Software without restriction, including without limitation the rights
 + * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 + * copies of the Software, and to permit persons to whom the Software is
 + * furnished to do so, subject to the following conditions:
 + *
 + * The above copyright notice and this permission notice shall be included in
 + * all copies or substantial portions of the Software.
 + *
 + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 + * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 + * THE SOFTWARE.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qemu/thread.h"
 +#include "qemu/main-loop.h"
 +#include "hw/core/cpu.h"
 +#include "sysemu/accel-blocker.h"
 +
 +static QemuLockCnt accel_in_ioctl_lock;
 +static QemuEvent accel_in_ioctl_event;
 +
 +void accel_blocker_init(void)
 +{
 +    qemu_lockcnt_init(&accel_in_ioctl_lock);
 +    qemu_event_init(&accel_in_ioctl_event, false);
 +}
 +
 +void accel_ioctl_begin(void)
 +{
 +    if (likely(qemu_mutex_iothread_locked())) {
 +        return;
 +    }
 +
 +    /* block if lock is taken in kvm_ioctl_inhibit_begin() */
 +    qemu_lockcnt_inc(&accel_in_ioctl_lock);
 +}
 +
 +void accel_ioctl_end(void)
 +{
 +    if (likely(qemu_mutex_iothread_locked())) {
 +        return;
 +    }
 +
 +    qemu_lockcnt_dec(&accel_in_ioctl_lock);
 +    /* change event to SET. If event was BUSY, wake up all waiters */
 +    qemu_event_set(&accel_in_ioctl_event);
 +}
 +
 +void accel_cpu_ioctl_begin(CPUState *cpu)
 +{
 +    if (unlikely(qemu_mutex_iothread_locked())) {
 +        return;
 +    }
 +
 +    /* block if lock is taken in kvm_ioctl_inhibit_begin() */
 +    qemu_lockcnt_inc(&cpu->in_ioctl_lock);
 +}
 +
 +void accel_cpu_ioctl_end(CPUState *cpu)
 +{
 +    if (unlikely(qemu_mutex_iothread_locked())) {
 +        return;
 +    }
 +
 +    qemu_lockcnt_dec(&cpu->in_ioctl_lock);
 +    /* change event to SET. If event was BUSY, wake up all waiters */
 +    qemu_event_set(&accel_in_ioctl_event);
 +}
 +
 +static bool accel_has_to_wait(void)
 +{
 +    CPUState *cpu;
 +    bool needs_to_wait = false;
 +
 +    CPU_FOREACH(cpu) {
 +        if (qemu_lockcnt_count(&cpu->in_ioctl_lock)) {
 +            /* exit the ioctl, if vcpu is running it */
 +            qemu_cpu_kick(cpu);
 +            needs_to_wait = true;
 +        }
 +    }
 +
 +    return needs_to_wait || qemu_lockcnt_count(&accel_in_ioctl_lock);
 +}
 +
 +void accel_ioctl_inhibit_begin(void)
 +{
 +    CPUState *cpu;
 +
 +    /*
 +     * We allow to inhibit only when holding the BQL, so we can identify
 +     * when an inhibitor wants to issue an ioctl easily.
 +     */
 +    g_assert(qemu_mutex_iothread_locked());
 +
 +    /* Block further invocations of the ioctls outside the BQL.  */
 +    CPU_FOREACH(cpu) {
 +        qemu_lockcnt_lock(&cpu->in_ioctl_lock);
 +    }
 +    qemu_lockcnt_lock(&accel_in_ioctl_lock);
 +
 +    /* Keep waiting until there are running ioctls */
 +    while (true) {
 +
 +        /* Reset event to FREE. */
 +        qemu_event_reset(&accel_in_ioctl_event);
 +
 +        if (accel_has_to_wait()) {
 +            /*
 +             * If event is still FREE, and there are ioctls still in progress,
 +             * wait.
 +             *
 +             *  If an ioctl finishes before qemu_event_wait(), it will change
 +             * the event state to SET. This will prevent qemu_event_wait() from
 +             * blocking, but it's not a problem because if other ioctls are
 +             * still running the loop will iterate once more and reset the event
 +             * status to FREE so that it can wait properly.
 +             *
 +             * If an ioctls finishes while qemu_event_wait() is blocking, then
 +             * it will be waken up, but also here the while loop makes sure
 +             * to re-enter the wait if there are other running ioctls.
 +             */
 +            qemu_event_wait(&accel_in_ioctl_event);
 +        } else {
 +            /* No ioctl is running */
 +            return;
 +        }
 +    }
 +}
 +
 +void accel_ioctl_inhibit_end(void)
 +{
 +    CPUState *cpu;
 +
 +    qemu_lockcnt_unlock(&accel_in_ioctl_lock);
 +    CPU_FOREACH(cpu) {
 +        qemu_lockcnt_unlock(&cpu->in_ioctl_lock);
 +    }
 +}
 +
 diff --git a/accel/meson.build b/accel/meson.build
 index dfd808d2c8..801b4d44e8 100644
 --- a/accel/meson.build
 +++ b/accel/meson.build
@@ -1,4 +1,4 @@
 -specific_ss.add(files('accel-common.c'))
 +specific_ss.add(files('accel-common.c', 'accel-blocker.c'))
 softmmu_ss.add(files('accel-softmmu.c'))
 user_ss.add(files('accel-user.c'))
 diff --git a/hw/core/cpu-common.c b/hw/core/cpu-common.c
 index 9e3241b430..b6e83acf0a 100644
 --- a/hw/core/cpu-common.c
 +++ b/hw/core/cpu-common.c
@@ -238,6 +238,7 @@ static void cpu_common_initfn(Object *obj)
     cpu->nr_threads = 1;
     qemu_mutex_init(&cpu->work_mutex);
 +    qemu_lockcnt_init(&cpu->in_ioctl_lock);
     QSIMPLEQ_INIT(&cpu->work_list);
     QTAILQ_INIT(&cpu->breakpoints);
     QTAILQ_INIT(&cpu->watchpoints);
@@ -249,6 +250,7 @@ static void cpu_common_finalize(Object *obj)
 {
     CPUState *cpu = CPU(obj);
 +    qemu_lockcnt_destroy(&cpu->in_ioctl_lock);
     qemu_mutex_destroy(&cpu->work_mutex);
 }
 diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
 index e948e81f1a..49d9c73f97 100644
 --- a/include/hw/core/cpu.h
 +++ b/include/hw/core/cpu.h
@@ -383,6 +383,9 @@ struct CPUState {
     uint32_t kvm_fetch_index;
     uint64_t dirty_pages;
 +    /* Use by accel-block: CPU is executing an ioctl() */
 +    QemuLockCnt in_ioctl_lock;
 +
     /* Used for events with 'vcpu' and *without* the 'disabled' properties */
     DECLARE_BITMAP(trace_dstate_delayed, CPU_TRACE_DSTATE_MAX_EVENTS);
     DECLARE_BITMAP(trace_dstate, CPU_TRACE_DSTATE_MAX_EVENTS);
 diff --git a/include/sysemu/accel-blocker.h b/include/sysemu/accel-blocker.h
 new file mode 100644
 index 0000000000..72020529ef
 --- /dev/null
 +++ b/include/sysemu/accel-blocker.h
@@ -0,0 +1,56 @@
 +/*
 + * Accelerator blocking API, to prevent new ioctls from starting and wait the
 + * running ones finish.
 + * This mechanism differs from pause/resume_all_vcpus() in that it does not
 + * release the BQL.
 + *
 + *  Copyright (c) 2022 Red Hat Inc.
 + *
 + * Author: Emanuele Giuseppe Esposito       <eesposit@redhat.com>
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + */
 +#ifndef ACCEL_BLOCKER_H
 +#define ACCEL_BLOCKER_H
 +
 +#include "qemu/osdep.h"
 +#include "sysemu/cpus.h"
 +
 +extern void accel_blocker_init(void);
 +
 +/*
 + * accel_{cpu_}ioctl_begin/end:
 + * Mark when ioctl is about to run or just finished.
 + *
 + * accel_{cpu_}ioctl_begin will block after accel_ioctl_inhibit_begin() is
 + * called, preventing new ioctls to run. They will continue only after
 + * accel_ioctl_inibith_end().
 + */
 +extern void accel_ioctl_begin(void);
 +extern void accel_ioctl_end(void);
 +extern void accel_cpu_ioctl_begin(CPUState *cpu);
 +extern void accel_cpu_ioctl_end(CPUState *cpu);
 +
 +/*
 + * accel_ioctl_inhibit_begin: start critical section
 + *
 + * This function makes sure that:
 + * 1) incoming accel_{cpu_}ioctl_begin() calls block
 + * 2) wait that all ioctls that were already running reach
 + *    accel_{cpu_}ioctl_end(), kicking vcpus if necessary.
 + *
 + * This allows the caller to access shared data or perform operations without
 + * worrying of concurrent vcpus accesses.
 + */
 +extern void accel_ioctl_inhibit_begin(void);
 +
 +/*
 + * accel_ioctl_inhibit_end: end critical section started by
 + * accel_ioctl_inhibit_begin()
 + *
 + * This function allows blocked accel_{cpu_}ioctl_begin() to continue.
 + */
 +extern void accel_ioctl_inhibit_end(void);
 +
 +#endif /* ACCEL_BLOCKER_H */
 diff --git a/util/meson.build b/util/meson.build
 index 05b593055a..b5f153b0e8 100644
 --- a/util/meson.build
 +++ b/util/meson.build
@@ -48,6 +48,7 @@ util_ss.add(files('transactions.c'))
 util_ss.add(when: 'CONFIG_POSIX', if_true: files('drm.c'))
 util_ss.add(files('guest-random.c'))
 util_ss.add(files('yank.c'))
 +util_ss.add(files('lockcnt.c'))
 if have_user
   util_ss.add(files('selfmap.c'))
@@ -69,7 +70,6 @@ if have_block
   util_ss.add(files('hexdump.c'))
   util_ss.add(files('iova-tree.c'))
   util_ss.add(files('iov.c', 'qemu-sockets.c', 'uri.c'))
 -  util_ss.add(files('lockcnt.c'))
   util_ss.add(files('main-loop.c'))
   util_ss.add(files('nvdimm-utils.c'))
   util_ss.add(files('qemu-coroutine.c', 'qemu-coroutine-lock.c', 'qemu-coroutine-io.c'))
 -- 
 2.37.3
--- a/SOURCES/kvm-acpi-fix-OEM-ID-OEM-Table-ID-padding.patch
+++ b/SOURCES/kvm-acpi-fix-OEM-ID-OEM-Table-ID-padding.patch
@ -0,0 +1,78 @@
 From af082f3499de265d123157d097b5c84981e0aa63 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Wed, 30 Mar 2022 14:52:34 -0400
 Subject: [PATCH 15/18] acpi: fix OEM ID/OEM Table ID padding
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 141: acpi: fix QEMU crash when started with SLIC table
 RH-Commit: [7/10] 51ea859cbe12b5a902d529ab589d18757d98f71d (jmaloy/qemu-kvm)
 RH-Bugzilla: 2062611
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2062611
 Upstream: Merged
 commit 748c030f360a940fe0c9382c8ca1649096c3a80d
 Author: Igor Mammedov <imammedo@redhat.com>
 Date:   Wed Jan 12 08:03:31 2022 -0500
    acpi: fix OEM ID/OEM Table ID padding
    Commit [2] broke original '\0' padding of OEM ID and OEM Table ID
    fields in headers of ACPI tables. While it doesn't have impact on
    default values since QEMU uses 6 and 8 characters long values
    respectively, it broke usecase where IDs are provided on QEMU CLI.
    It shouldn't affect guest (but may cause licensing verification
    issues in guest OS).
    One of the broken usecases is user supplied SLIC table with IDs
    shorter than max possible length, where [2] mangles IDs with extra
    spaces in RSDT and FADT tables whereas guest OS expects those to
    mirror the respective values of the used SLIC table.
    Fix it by replacing whitespace padding with '\0' padding in
    accordance with [1] and expectations of guest OS
    1) ACPI spec, v2.0b
           17.2 AML Grammar Definition
           ...
           //OEM ID of up to 6 characters. If the OEM ID is
           //shorter than 6 characters, it can be terminated
           //with a NULL character.
    2)
    Fixes: 602b458201 ("acpi: Permit OEM ID and OEM table ID fields to be changed")
    Resolves: https://gitlab.com/qemu-project/qemu/-/issues/707
    Reported-by: Dmitry V. Orekhov <dima.orekhov@gmail.com>
    Signed-off-by: Igor Mammedov <imammedo@redhat.com>
    Cc: qemu-stable@nongnu.org
    Message-Id: <20220112130332.1648664-4-imammedo@redhat.com>
    Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
    Reviewed-by: Ani Sinha <ani@anisinha.ca>
    Tested-by: Dmitry V. Orekhov dima.orekhov@gmail.com
 (cherry picked from commit 748c030f360a940fe0c9382c8ca1649096c3a80d)
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 hw/acpi/aml-build.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/hw/acpi/aml-build.c b/hw/acpi/aml-build.c
 index b3b3310df3..65148d5b9d 100644
 --- a/hw/acpi/aml-build.c
 +++ b/hw/acpi/aml-build.c
@@ -1724,9 +1724,9 @@ void acpi_table_begin(AcpiTable *desc, GArray *array)
     build_append_int_noprefix(array, 0, 4); /* Length */
     build_append_int_noprefix(array, desc->rev, 1); /* Revision */
     build_append_int_noprefix(array, 0, 1); /* Checksum */
 -    build_append_padded_str(array, desc->oem_id, 6, ' '); /* OEMID */
 +    build_append_padded_str(array, desc->oem_id, 6, '\0'); /* OEMID */
     /* OEM Table ID */
 -    build_append_padded_str(array, desc->oem_table_id, 8, ' ');
 +    build_append_padded_str(array, desc->oem_table_id, 8, '\0');
     build_append_int_noprefix(array, 1, 4); /* OEM Revision */
     g_array_append_vals(array, ACPI_BUILD_APPNAME8, 4); /* Creator ID */
     build_append_int_noprefix(array, 1, 4); /* Creator Revision */
 -- 
 2.27.0
--- a/SOURCES/kvm-acpi-fix-QEMU-crash-when-started-with-SLIC-table.patch
+++ b/SOURCES/kvm-acpi-fix-QEMU-crash-when-started-with-SLIC-table.patch
@ -0,0 +1,108 @@
 From 4e8fb957a349558648d5cddb80a89460bc97439e Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Wed, 30 Mar 2022 14:52:34 -0400
 Subject: [PATCH 09/18] acpi: fix QEMU crash when started with SLIC table
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 141: acpi: fix QEMU crash when started with SLIC table
 RH-Commit: [1/10] 0c34e80346c33da4f220d9c486b120c35005144e (jmaloy/qemu-kvm)
 RH-Bugzilla: 2062611
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2062611
 Upstream: Merged
 commit 8cdb99af45365727ac17f45239a9b8c1d5155c6d)
 Author: Igor Mammedov <imammedo@redhat.com>
 Date:   Mon Dec 27 14:31:17 2021 -0500
    acpi: fix QEMU crash when started with SLIC table
    if QEMU is started with used provided SLIC table blob,
      -acpitable sig=SLIC,oem_id='CRASH ',oem_table_id="ME",oem_rev=00002210,asl_compiler_id="",asl_compiler_rev=00000000,data=/dev/null
    it will assert with:
      hw/acpi/aml-build.c:61:build_append_padded_str: assertion failed: (len <= maxlen)
    and following backtrace:
      ...
      build_append_padded_str (array=0x555556afe320, str=0x555556afdb2e "CRASH ME", maxlen=0x6, pad=0x20) at hw/acpi/aml-build.c:61
      acpi_table_begin (desc=0x7fffffffd1b0, array=0x555556afe320) at hw/acpi/aml-build.c:1727
      build_fadt (tbl=0x555556afe320, linker=0x555557ca3830, f=0x7fffffffd318, oem_id=0x555556afdb2e "CRASH ME", oem_table_id=0x555556afdb34 "ME") at hw/acpi/aml-build.c:2064
      ...
    which happens due to acpi_table_begin() expecting NULL terminated
    oem_id and oem_table_id strings, which is normally the case, but
    in case of user provided SLIC table, oem_id points to table's blob
    directly and as result oem_id became longer than expected.
    Fix issue by handling oem_id consistently and make acpi_get_slic_oem()
    return NULL terminated strings.
    PS:
    After [1] refactoring, oem_id semantics became inconsistent, where
    NULL terminated string was coming from machine and old way pointer
    into byte array coming from -acpitable option. That used to work
    since build_header() wasn't expecting NULL terminated string and
    blindly copied the 1st 6 bytes only.
    However commit [2] broke that by replacing build_header() with
    acpi_table_begin(), which was expecting NULL terminated string
    and was checking oem_id size.
    1) 602b45820 ("acpi: Permit OEM ID and OEM table ID fields to be changed")
    2)
    Fixes: 4b56e1e4eb08 ("acpi: build_fadt: use acpi_table_begin()/acpi_table_end() instead of build_header()")
    Resolves: https://gitlab.com/qemu-project/qemu/-/issues/786
    Signed-off-by: Igor Mammedov <imammedo@redhat.com>
    Message-Id: <20211227193120.1084176-2-imammedo@redhat.com>
    Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
    Tested-by: Denis Lisov <dennis.lissov@gmail.com>
    Tested-by: Alexander Tsoy <alexander@tsoy.me>
    Cc: qemu-stable@nongnu.org
    Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 (cherry picked from commit 8cdb99af45365727ac17f45239a9b8c1d5155c6d)
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 hw/acpi/core.c       | 4 ++--
 hw/i386/acpi-build.c | 2 ++
 2 files changed, 4 insertions(+), 2 deletions(-)
 diff --git a/hw/acpi/core.c b/hw/acpi/core.c
 index 1e004d0078..3e811bf03c 100644
 --- a/hw/acpi/core.c
 +++ b/hw/acpi/core.c
@@ -345,8 +345,8 @@ int acpi_get_slic_oem(AcpiSlicOem *oem)
         struct acpi_table_header *hdr = (void *)(u - sizeof(hdr->_length));
         if (memcmp(hdr->sig, "SLIC", 4) == 0) {
 -            oem->id = hdr->oem_id;
 -            oem->table_id = hdr->oem_table_id;
 +            oem->id = g_strndup(hdr->oem_id, 6);
 +            oem->table_id = g_strndup(hdr->oem_table_id, 8);
             return 0;
         }
     }
 diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
 index a4478e77b7..acc4869db0 100644
 --- a/hw/i386/acpi-build.c
 +++ b/hw/i386/acpi-build.c
@@ -2726,6 +2726,8 @@ void acpi_build(AcpiBuildTables *tables, MachineState *machine)
     /* Cleanup memory that's no longer used. */
     g_array_free(table_offsets, true);
 +    g_free(slic_oem.id);
 +    g_free(slic_oem.table_id);
 }
 static void acpi_ram_update(MemoryRegion *mr, GArray *data)
 -- 
 2.27.0
--- a/SOURCES/kvm-acpi-fix-acpi_index-migration.patch
+++ b/SOURCES/kvm-acpi-fix-acpi_index-migration.patch
@ -0,0 +1,165 @@
 From 3deffc03c2e9b0053eec5aeb5b5d633dfe29f499 Mon Sep 17 00:00:00 2001
 From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
 Date: Wed, 6 Apr 2022 14:58:12 -0400
 Subject: [PATCH 1/3] acpi: fix acpi_index migration
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Peter Xu <peterx@redhat.com>
 RH-MergeRequest: 343: acpi: fix acpi_index migration
 RH-Jira: RHEL-20189
 RH-Acked-by: Leonardo Brás <leobras@redhat.com>
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 RH-Acked-by: Prasad Pandit <None>
 RH-Commit: [1/2] c5b9cdf5791cd856207b7df7e2ef5df360ec8de4
 vmstate_acpi_pcihp_use_acpi_index() was expecting AcpiPciHpState
 as state but it actually received PIIX4PMState, because
 VMSTATE_PCI_HOTPLUG is a macro and not another struct.
 So it ended up accessing random pointer, which resulted
 in 'false' return value and acpi_index field wasn't ever
 sent.
 However in 7.0 that pointer de-references to value > 0, and
 destination QEMU starts to expect the field which isn't
 sent in migratioon stream from older QEMU (6.2 and older).
 As result migration fails with:
  qemu-system-x86_64: Missing section footer for 0000:00:01.3/piix4_pm
  qemu-system-x86_64: load of migration failed: Invalid argument
 In addition with QEMU-6.2, destination due to not expected
 state, also never expects the acpi_index field in migration
 stream.
 Q35 is not affected as it always sends/expects the field as
 long as acpi based PCI hotplug is enabled.
 Fix issue by introducing compat knob to never send/expect
 acpi_index in migration stream for 6.2 and older PC machine
 types and always send it for 7.0 and newer PC machine types.
 Diagnosed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Fixes: b32bd76 ("pci: introduce acpi-index property for PCI device")
 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/932
 Signed-off-by: Igor Mammedov <imammedo@redhat.com>
 Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 (cherry picked from commit a83c2844903c45aa7d32cdd17305f23ce2c56ab9)
 Signed-off-by: Peter Xu <peterx@redhat.com>
 ---
 hw/acpi/acpi-pci-hotplug-stub.c |  4 ----
 hw/acpi/pcihp.c                 |  6 ------
 hw/acpi/piix4.c                 | 15 ++++++++++++++-
 hw/core/machine.c               |  5 +++++
 include/hw/acpi/pcihp.h         |  2 --
 5 files changed, 19 insertions(+), 13 deletions(-)
 diff --git a/hw/acpi/acpi-pci-hotplug-stub.c b/hw/acpi/acpi-pci-hotplug-stub.c
 index 734e4c5986..a43f6dafc9 100644
 --- a/hw/acpi/acpi-pci-hotplug-stub.c
 +++ b/hw/acpi/acpi-pci-hotplug-stub.c
@@ -41,7 +41,3 @@ void acpi_pcihp_reset(AcpiPciHpState *s, bool acpihp_root_off)
     return;
 }
 -bool vmstate_acpi_pcihp_use_acpi_index(void *opaque, int version_id)
 -{
 -    return false;
 -}
 diff --git a/hw/acpi/pcihp.c b/hw/acpi/pcihp.c
 index be0e846b34..ec861661c3 100644
 --- a/hw/acpi/pcihp.c
 +++ b/hw/acpi/pcihp.c
@@ -559,12 +559,6 @@ void acpi_pcihp_init(Object *owner, AcpiPciHpState *s, PCIBus *root_bus,
                                    OBJ_PROP_FLAG_READ);
 }
 -bool vmstate_acpi_pcihp_use_acpi_index(void *opaque, int version_id)
 -{
 -     AcpiPciHpState *s = opaque;
 -     return s->acpi_index;
 -}
 -
 const VMStateDescription vmstate_acpi_pcihp_pci_status = {
     .name = "acpi_pcihp_pci_status",
     .version_id = 1,
 diff --git a/hw/acpi/piix4.c b/hw/acpi/piix4.c
 index 8d6011c0a3..033e75ce5b 100644
 --- a/hw/acpi/piix4.c
 +++ b/hw/acpi/piix4.c
@@ -82,6 +82,7 @@ struct PIIX4PMState {
     AcpiPciHpState acpi_pci_hotplug;
     bool use_acpi_hotplug_bridge;
     bool use_acpi_root_pci_hotplug;
 +    bool not_migrate_acpi_index;
     uint8_t disable_s3;
     uint8_t disable_s4;
@@ -269,6 +270,16 @@ static bool piix4_vmstate_need_smbus(void *opaque, int version_id)
     return pm_smbus_vmstate_needed();
 }
 +/*
 + * This is a fudge to turn off the acpi_index field,
 + * whose test was always broken on piix4 with 6.2 and older machine types.
 + */
 +static bool vmstate_test_migrate_acpi_index(void *opaque, int version_id)
 +{
 +    PIIX4PMState *s = PIIX4_PM(opaque);
 +    return s->use_acpi_hotplug_bridge && !s->not_migrate_acpi_index;
 +}
 +
 /* qemu-kvm 1.2 uses version 3 but advertised as 2
  * To support incoming qemu-kvm 1.2 migration, change version_id
  * and minimum_version_id to 2 below (which breaks migration from
@@ -299,7 +310,7 @@ static const VMStateDescription vmstate_acpi = {
             struct AcpiPciHpPciStatus),
         VMSTATE_PCI_HOTPLUG(acpi_pci_hotplug, PIIX4PMState,
                             vmstate_test_use_acpi_hotplug_bridge,
 -                            vmstate_acpi_pcihp_use_acpi_index),
 +                            vmstate_test_migrate_acpi_index),
         VMSTATE_END_OF_LIST()
     },
     .subsections = (const VMStateDescription*[]) {
@@ -654,6 +665,8 @@ static Property piix4_pm_properties[] = {
     DEFINE_PROP_BOOL("memory-hotplug-support", PIIX4PMState,
                      acpi_memory_hotplug.is_enabled, true),
     DEFINE_PROP_BOOL("smm-compat", PIIX4PMState, smm_compat, false),
 +    DEFINE_PROP_BOOL("x-not-migrate-acpi-index", PIIX4PMState,
 +                      not_migrate_acpi_index, false),
     DEFINE_PROP_END_OF_LIST(),
 };
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index 76fcabec7a..2724f6848a 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -331,6 +331,11 @@ GlobalProperty hw_compat_rhel_7_1[] = {
 };
 const size_t hw_compat_rhel_7_1_len = G_N_ELEMENTS(hw_compat_rhel_7_1);
 +GlobalProperty hw_compat_6_2[] = {
 +    { "PIIX4_PM", "x-not-migrate-acpi-index", "on"},
 +};
 +const size_t hw_compat_6_2_len = G_N_ELEMENTS(hw_compat_6_2);
 +
 GlobalProperty hw_compat_6_1[] = {
     { "vhost-user-vsock-device", "seqpacket", "off" },
     { "nvme-ns", "shared", "off" },
 diff --git a/include/hw/acpi/pcihp.h b/include/hw/acpi/pcihp.h
 index af1a169fc3..7e268c2c9c 100644
 --- a/include/hw/acpi/pcihp.h
 +++ b/include/hw/acpi/pcihp.h
@@ -73,8 +73,6 @@ void acpi_pcihp_reset(AcpiPciHpState *s, bool acpihp_root_off);
 extern const VMStateDescription vmstate_acpi_pcihp_pci_status;
 -bool vmstate_acpi_pcihp_use_acpi_index(void *opaque, int version_id);
 -
 #define VMSTATE_PCI_HOTPLUG(pcihp, state, test_pcihp, test_acpi_index) \
         VMSTATE_UINT32_TEST(pcihp.hotplug_select, state, \
                             test_pcihp), \
 -- 
 2.41.0
--- a/SOURCES/kvm-acpi-pcihp-pcie-set-power-on-cap-on-parent-slot.patch
+++ b/SOURCES/kvm-acpi-pcihp-pcie-set-power-on-cap-on-parent-slot.patch
@ -0,0 +1,140 @@
 From c9ceb175667cdeead59384a97a812367ae19c570 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Wed, 23 Mar 2022 13:21:40 -0400
 Subject: [PATCH 06/18] acpi: pcihp: pcie: set power on cap on parent slot
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 134: pci: expose TYPE_XIO3130_DOWNSTREAM name
 RH-Commit: [2/2] d883872647a6e90ec573140b2c171f3f53b600ab (jmaloy/qemu-kvm)
 RH-Bugzilla: 2062610
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 RH-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
 BZ: https://bugzilla.redhat.com/2062610
 UPSTREAM: merged
 BREW: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=44038138
 commit 6b0969f1ec825984cd74619f0730be421b0c46fb
 Author: Igor Mammedov <imammedo@redhat.com>
 Date:   Tue Mar 1 10:11:59 2022 -0500
    acpi: pcihp: pcie: set power on cap on parent slot
    on creation a PCIDevice has power turned on at the end of pci_qdev_realize()
    however later on if PCIe slot isn't populated with any children
    it's power is turned off. It's fine if native hotplug is used
    as plug callback will power slot on among other things.
    However when ACPI hotplug is enabled it replaces native PCIe plug
    callbacks with ACPI specific ones (acpi_pcihp_device_*plug_cb) and
    as result slot stays powered off. It works fine as ACPI hotplug
    on guest side takes care of enumerating/initializing hotplugged
    device. But when later guest is migrated, call chain introduced by]
    commit d5daff7d312 (pcie: implement slot power control for pcie root ports)
       pcie_cap_slot_post_load()
           -> pcie_cap_update_power()
               -> pcie_set_power_device()
                   -> pci_set_power()
                       -> pci_update_mappings()
    will disable earlier initialized BARs for the hotplugged device
    in powered off slot due to commit 23786d13441 (pci: implement power state)
    which disables BARs if power is off.
    Fix it by setting PCI_EXP_SLTCTL_PCC to PCI_EXP_SLTCTL_PWR_ON
    on slot (root port/downstream port) at the time a device
    hotplugged into it. As result PCI_EXP_SLTCTL_PWR_ON is migrated
    to target and above call chain keeps device plugged into it
    powered on.
    Fixes: d5daff7d312 ("pcie: implement slot power control for pcie root ports")
    Fixes: 23786d13441 ("pci: implement power state")
    Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2053584
    Suggested-by: "Michael S. Tsirkin" <mst@redhat.com>
    Signed-off-by: Igor Mammedov <imammedo@redhat.com>
    Message-Id: <20220301151200.3507298-3-imammedo@redhat.com>
    Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 (cherry picked from commit 6b0969f1ec825984cd74619f0730be421b0c46fb)
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 hw/acpi/pcihp.c       | 12 +++++++++++-
 hw/pci/pcie.c         | 11 +++++++++++
 include/hw/pci/pcie.h |  1 +
 3 files changed, 23 insertions(+), 1 deletion(-)
 diff --git a/hw/acpi/pcihp.c b/hw/acpi/pcihp.c
 index a5e182dd3a..be0e846b34 100644
 --- a/hw/acpi/pcihp.c
 +++ b/hw/acpi/pcihp.c
@@ -32,6 +32,7 @@
 #include "hw/pci/pci_bridge.h"
 #include "hw/pci/pci_host.h"
 #include "hw/pci/pcie_port.h"
 +#include "hw/pci-bridge/xio3130_downstream.h"
 #include "hw/i386/acpi-build.h"
 #include "hw/acpi/acpi.h"
 #include "hw/pci/pci_bus.h"
@@ -341,6 +342,8 @@ void acpi_pcihp_device_plug_cb(HotplugHandler *hotplug_dev, AcpiPciHpState *s,
 {
     PCIDevice *pdev = PCI_DEVICE(dev);
     int slot = PCI_SLOT(pdev->devfn);
 +    PCIDevice *bridge;
 +    PCIBus *bus;
     int bsel;
     /* Don't send event when device is enabled during qemu machine creation:
@@ -370,7 +373,14 @@ void acpi_pcihp_device_plug_cb(HotplugHandler *hotplug_dev, AcpiPciHpState *s,
         return;
     }
 -    bsel = acpi_pcihp_get_bsel(pci_get_bus(pdev));
 +    bus = pci_get_bus(pdev);
 +    bridge = pci_bridge_get_device(bus);
 +    if (object_dynamic_cast(OBJECT(bridge), TYPE_PCIE_ROOT_PORT) ||
 +        object_dynamic_cast(OBJECT(bridge), TYPE_XIO3130_DOWNSTREAM)) {
 +        pcie_cap_slot_enable_power(bridge);
 +    }
 +
 +    bsel = acpi_pcihp_get_bsel(bus);
     g_assert(bsel >= 0);
     s->acpi_pcihp_pci_status[bsel].up |= (1U << slot);
     acpi_send_event(DEVICE(hotplug_dev), ACPI_PCI_HOTPLUG_STATUS);
 diff --git a/hw/pci/pcie.c b/hw/pci/pcie.c
 index d7d73a31e4..996f0e24fe 100644
 --- a/hw/pci/pcie.c
 +++ b/hw/pci/pcie.c
@@ -366,6 +366,17 @@ static void hotplug_event_clear(PCIDevice *dev)
     }
 }
 +void pcie_cap_slot_enable_power(PCIDevice *dev)
 +{
 +    uint8_t *exp_cap = dev->config + dev->exp.exp_cap;
 +    uint32_t sltcap = pci_get_long(exp_cap + PCI_EXP_SLTCAP);
 +
 +    if (sltcap & PCI_EXP_SLTCAP_PCP) {
 +        pci_set_word_by_mask(exp_cap + PCI_EXP_SLTCTL,
 +                             PCI_EXP_SLTCTL_PCC, PCI_EXP_SLTCTL_PWR_ON);
 +    }
 +}
 +
 static void pcie_set_power_device(PCIBus *bus, PCIDevice *dev, void *opaque)
 {
     bool *power = opaque;
 diff --git a/include/hw/pci/pcie.h b/include/hw/pci/pcie.h
 index 6063bee0ec..c27368d077 100644
 --- a/include/hw/pci/pcie.h
 +++ b/include/hw/pci/pcie.h
@@ -112,6 +112,7 @@ void pcie_cap_slot_write_config(PCIDevice *dev,
                                 uint32_t addr, uint32_t val, int len);
 int pcie_cap_slot_post_load(void *opaque, int version_id);
 void pcie_cap_slot_push_attention_button(PCIDevice *dev);
 +void pcie_cap_slot_enable_power(PCIDevice *dev);
 void pcie_cap_root_init(PCIDevice *dev);
 void pcie_cap_root_reset(PCIDevice *dev);
 -- 
 2.27.0
--- a/SOURCES/kvm-acpi-validate-hotplug-selector-on-access.patch
+++ b/SOURCES/kvm-acpi-validate-hotplug-selector-on-access.patch
@ -0,0 +1,51 @@
 From 529a5d908f5d16714b8ae0a51eaaaa84994dfae8 Mon Sep 17 00:00:00 2001
 From: "Michael S. Tsirkin" <mst@redhat.com>
 Date: Tue, 21 Dec 2021 09:45:44 -0500
 Subject: [PATCH 1/2] acpi: validate hotplug selector on access
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 97: acpi: validate hotplug selector on access
 RH-Commit: [1/1] 79bcfb0df0091e2b716d2e1c545f047b3409c26c (jmaloy/qemu-kvm)
 RH-Bugzilla: 2036580
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 When bus is looked up on a pci write, we didn't
 validate that the lookup succeeded.
 Fuzzers thus can trigger QEMU crash by dereferencing the NULL
 bus pointer.
 Fixes: b32bd763a1 ("pci: introduce acpi-index property for PCI device")
 Fixes: CVE-2021-4158
 Cc: "Igor Mammedov" <imammedo@redhat.com>
 Fixes: https://gitlab.com/qemu-project/qemu/-/issues/770
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Ani Sinha <ani@anisinha.ca>
 (cherry picked from commit 9bd6565ccee68f72d5012e24646e12a1c662827e)
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 hw/acpi/pcihp.c | 3 +++
 1 file changed, 3 insertions(+)
 diff --git a/hw/acpi/pcihp.c b/hw/acpi/pcihp.c
 index 30405b5113..a5e182dd3a 100644
 --- a/hw/acpi/pcihp.c
 +++ b/hw/acpi/pcihp.c
@@ -491,6 +491,9 @@ static void pci_write(void *opaque, hwaddr addr, uint64_t data,
         }
         bus = acpi_pcihp_find_hotplug_bus(s, s->hotplug_select);
 +        if (!bus) {
 +            break;
 +        }
         QTAILQ_FOREACH_SAFE(kid, &bus->qbus.children, sibling, next) {
             Object *o = OBJECT(kid->child);
             PCIDevice *dev = PCI_DEVICE(o);
 -- 
 2.27.0
--- a/SOURCES/kvm-aio-make-aio_context_acquire-aio_context_release-a-n.patch
+++ b/SOURCES/kvm-aio-make-aio_context_acquire-aio_context_release-a-n.patch
@ -1,60 +0,0 @@
 From 6b5cfed21e20b372090046a934387255ff4bda58 Mon Sep 17 00:00:00 2001
 From: Stefan Hajnoczi <stefanha@redhat.com>
 Date: Tue, 5 Dec 2023 13:20:01 -0500
 Subject: [PATCH 084/101] aio: make aio_context_acquire()/aio_context_release()
 a no-op
 RH-Author: Kevin Wolf <kwolf@redhat.com>
 RH-MergeRequest: 214: Remove AioContext lock
 RH-Jira: RHEL-15965
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Commit: [15/26] 723dcada900aaf08862e8221921be22506b561a8 (kmwolf/centos-qemu-kvm)
 aio_context_acquire()/aio_context_release() has been replaced by
 fine-grained locking to protect state shared by multiple threads. The
 AioContext lock still plays the role of balancing locking in
 AIO_WAIT_WHILE() and many functions in QEMU either require that the
 AioContext lock is held or not held for this reason. In other words, the
 AioContext lock is purely there for consistency with itself and serves
 no real purpose anymore.
 Stop actually acquiring/releasing the lock in
 aio_context_acquire()/aio_context_release() so that subsequent patches
 can remove callers across the codebase incrementally.
 I have performed "make check" and qemu-iotests stress tests across
 x86-64, ppc64le, and aarch64 to confirm that there are no failures as a
 result of eliminating the lock.
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Reviewed-by: Eric Blake <eblake@redhat.com>
 Acked-by: Kevin Wolf <kwolf@redhat.com>
 Message-ID: <20231205182011.1976568-5-stefanha@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
 util/async.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/util/async.c b/util/async.c
 index 8f90ddc304..04ee83d220 100644
 --- a/util/async.c
 +++ b/util/async.c
@@ -725,12 +725,12 @@ void aio_context_unref(AioContext *ctx)
 void aio_context_acquire(AioContext *ctx)
 {
 -    qemu_rec_mutex_lock(&ctx->lock);
 +    /* TODO remove this function */
 }
 void aio_context_release(AioContext *ctx)
 {
 -    qemu_rec_mutex_unlock(&ctx->lock);
 +    /* TODO remove this function */
 }
 QEMU_DEFINE_STATIC_CO_TLS(AioContext *, my_aiocontext)
 -- 
 2.39.3
--- a/SOURCES/kvm-aio-remove-aio_context_acquire-aio_context_release-A.patch
+++ b/SOURCES/kvm-aio-remove-aio_context_acquire-aio_context_release-A.patch
@ -1,102 +0,0 @@
 From 14913d8970090c8914dc19dad14f3b9f91985ec3 Mon Sep 17 00:00:00 2001
 From: Stefan Hajnoczi <stefanha@redhat.com>
 Date: Tue, 5 Dec 2023 13:20:07 -0500
 Subject: [PATCH 090/101] aio: remove
 aio_context_acquire()/aio_context_release() API
 RH-Author: Kevin Wolf <kwolf@redhat.com>
 RH-MergeRequest: 214: Remove AioContext lock
 RH-Jira: RHEL-15965
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Commit: [21/26] 4b6d4afcac79d3248a6722b063b5fc777dc418df (kmwolf/centos-qemu-kvm)
 Delete these functions because nothing calls these functions anymore.
 I introduced these APIs in commit 98563fc3ec44 ("aio: add
 aio_context_acquire() and aio_context_release()") in 2014. It's with a
 sigh of relief that I delete these APIs almost 10 years later.
 Thanks to Paolo Bonzini's vision for multi-queue QEMU, we got an
 understanding of where the code needed to go in order to remove the
 limitations that the original dataplane and the IOThread/AioContext
 approach that followed it.
 Emanuele Giuseppe Esposito had the splendid determination to convert
 large parts of the codebase so that they no longer needed the AioContext
 lock. This was a painstaking process, both in the actual code changes
 required and the iterations of code review that Emanuele eked out of
 Kevin and me over many months.
 Kevin Wolf tackled multitudes of graph locking conversions to protect
 in-flight I/O from run-time changes to the block graph as well as the
 clang Thread Safety Analysis annotations that allow the compiler to
 check whether the graph lock is being used correctly.
 And me, well, I'm just here to add some pizzazz to the QEMU multi-queue
 block layer :). Thank you to everyone who helped with this effort,
 including Eric Blake, code reviewer extraordinaire, and others who I've
 forgotten to mention.
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Reviewed-by: Eric Blake <eblake@redhat.com>
 Message-ID: <20231205182011.1976568-11-stefanha@redhat.com>
 Reviewed-by: Kevin Wolf <kwolf@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
 include/block/aio.h | 17 -----------------
 util/async.c        | 10 ----------
 2 files changed, 27 deletions(-)
 diff --git a/include/block/aio.h b/include/block/aio.h
 index f08b358077..af05512a7d 100644
 --- a/include/block/aio.h
 +++ b/include/block/aio.h
@@ -278,23 +278,6 @@ void aio_context_ref(AioContext *ctx);
  */
 void aio_context_unref(AioContext *ctx);
 -/* Take ownership of the AioContext.  If the AioContext will be shared between
 - * threads, and a thread does not want to be interrupted, it will have to
 - * take ownership around calls to aio_poll().  Otherwise, aio_poll()
 - * automatically takes care of calling aio_context_acquire and
 - * aio_context_release.
 - *
 - * Note that this is separate from bdrv_drained_begin/bdrv_drained_end.  A
 - * thread still has to call those to avoid being interrupted by the guest.
 - *
 - * Bottom halves, timers and callbacks can be created or removed without
 - * acquiring the AioContext.
 - */
 -void aio_context_acquire(AioContext *ctx);
 -
 -/* Relinquish ownership of the AioContext. */
 -void aio_context_release(AioContext *ctx);
 -
 /**
  * aio_bh_schedule_oneshot_full: Allocate a new bottom half structure that will
  * run only once and as soon as possible.
 diff --git a/util/async.c b/util/async.c
 index dfd44ef612..460529057c 100644
 --- a/util/async.c
 +++ b/util/async.c
@@ -719,16 +719,6 @@ void aio_context_unref(AioContext *ctx)
     g_source_unref(&ctx->source);
 }
 -void aio_context_acquire(AioContext *ctx)
 -{
 -    /* TODO remove this function */
 -}
 -
 -void aio_context_release(AioContext *ctx)
 -{
 -    /* TODO remove this function */
 -}
 -
 QEMU_DEFINE_STATIC_CO_TLS(AioContext *, my_aiocontext)
 AioContext *qemu_get_current_aio_context(void)
 -- 
 2.39.3
--- a/SOURCES/kvm-aio-wait-draw-equivalence-between-AIO_WAIT_WHILE-and.patch
+++ b/SOURCES/kvm-aio-wait-draw-equivalence-between-AIO_WAIT_WHILE-and.patch
@ -1,81 +0,0 @@
 From e1e2f3972065c4b5d6fcf37e0e1c4fb92a0d5260 Mon Sep 17 00:00:00 2001
 From: Stefan Hajnoczi <stefanha@redhat.com>
 Date: Tue, 5 Dec 2023 13:20:06 -0500
 Subject: [PATCH 089/101] aio-wait: draw equivalence between AIO_WAIT_WHILE()
 and AIO_WAIT_WHILE_UNLOCKED()
 RH-Author: Kevin Wolf <kwolf@redhat.com>
 RH-MergeRequest: 214: Remove AioContext lock
 RH-Jira: RHEL-15965
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Commit: [20/26] 20e49777869714c99769263103f1b0c2c370cfcd (kmwolf/centos-qemu-kvm)
 Now that the AioContext lock no longer exists, AIO_WAIT_WHILE() and
 AIO_WAIT_WHILE_UNLOCKED() are equivalent.
 A future patch will get rid of AIO_WAIT_WHILE_UNLOCKED().
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Reviewed-by: Eric Blake <eblake@redhat.com>
 Message-ID: <20231205182011.1976568-10-stefanha@redhat.com>
 Reviewed-by: Kevin Wolf <kwolf@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
 include/block/aio-wait.h | 16 ++++------------
 1 file changed, 4 insertions(+), 12 deletions(-)
 diff --git a/include/block/aio-wait.h b/include/block/aio-wait.h
 index 5449b6d742..157f105916 100644
 --- a/include/block/aio-wait.h
 +++ b/include/block/aio-wait.h
@@ -63,9 +63,6 @@ extern AioWait global_aio_wait;
  * @ctx: the aio context, or NULL if multiple aio contexts (for which the
  *       caller does not hold a lock) are involved in the polling condition.
  * @cond: wait while this conditional expression is true
 - * @unlock: whether to unlock and then lock again @ctx. This applies
 - * only when waiting for another AioContext from the main loop.
 - * Otherwise it's ignored.
  *
  * Wait while a condition is true.  Use this to implement synchronous
  * operations that require event loop activity.
@@ -78,7 +75,7 @@ extern AioWait global_aio_wait;
  * wait on conditions between two IOThreads since that could lead to deadlock,
  * go via the main loop instead.
  */
 -#define AIO_WAIT_WHILE_INTERNAL(ctx, cond, unlock) ({              \
 +#define AIO_WAIT_WHILE_INTERNAL(ctx, cond) ({                      \
     bool waited_ = false;                                          \
     AioWait *wait_ = &global_aio_wait;                             \
     AioContext *ctx_ = (ctx);                                      \
@@ -95,13 +92,7 @@ extern AioWait global_aio_wait;
         assert(qemu_get_current_aio_context() ==                   \
                qemu_get_aio_context());                            \
         while ((cond)) {                                           \
 -            if (unlock && ctx_) {                                  \
 -                aio_context_release(ctx_);                         \
 -            }                                                      \
             aio_poll(qemu_get_aio_context(), true);                \
 -            if (unlock && ctx_) {                                  \
 -                aio_context_acquire(ctx_);                         \
 -            }                                                      \
             waited_ = true;                                        \
         }                                                          \
     }                                                              \
@@ -109,10 +100,11 @@ extern AioWait global_aio_wait;
     waited_; })
 #define AIO_WAIT_WHILE(ctx, cond)                                  \
 -    AIO_WAIT_WHILE_INTERNAL(ctx, cond, true)
 +    AIO_WAIT_WHILE_INTERNAL(ctx, cond)
 +/* TODO replace this with AIO_WAIT_WHILE() in a future patch */
 #define AIO_WAIT_WHILE_UNLOCKED(ctx, cond)                         \
 -    AIO_WAIT_WHILE_INTERNAL(ctx, cond, false)
 +    AIO_WAIT_WHILE_INTERNAL(ctx, cond)
 /**
  * aio_wait_kick:
 -- 
 2.39.3
--- a/SOURCES/kvm-aio-wait-switch-to-smp_mb__after_rmw.patch
+++ b/SOURCES/kvm-aio-wait-switch-to-smp_mb__after_rmw.patch
@ -0,0 +1,50 @@
 From 953c5c0982b61b0a3f8f03452844b5487eb22fc7 Mon Sep 17 00:00:00 2001
 From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date: Thu, 9 Mar 2023 08:13:17 -0500
 Subject: [PATCH 06/13] aio-wait: switch to smp_mb__after_rmw()
 RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-MergeRequest: 263: qatomic: add smp_mb__before/after_rmw()
 RH-Bugzilla: 2168472
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: Eric Auger <eric.auger@redhat.com>
 RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
 RH-Acked-by: David Hildenbrand <david@redhat.com>
 RH-Commit: [6/10] 9f30f97754139ffd18d36b2350f9ed4e59ac496e
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2168472
 commit b532526a07ef3b903ead2e055fe6cc87b41057a3
 Author: Paolo Bonzini <pbonzini@redhat.com>
 Date:   Fri Mar 3 11:03:52 2023 +0100
    aio-wait: switch to smp_mb__after_rmw()
    The barrier comes after an atomic increment, so it is enough to use
    smp_mb__after_rmw(); this avoids a double barrier on x86 systems.
    Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
    Reviewed-by: David Hildenbrand <david@redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 ---
 include/block/aio-wait.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/include/block/aio-wait.h b/include/block/aio-wait.h
 index 54840f8622..03b6394c78 100644
 --- a/include/block/aio-wait.h
 +++ b/include/block/aio-wait.h
@@ -82,7 +82,7 @@ extern AioWait global_aio_wait;
     /* Increment wait_->num_waiters before evaluating cond. */     \
     qatomic_inc(&wait_->num_waiters);                              \
     /* Paired with smp_mb in aio_wait_kick(). */                   \
 -    smp_mb();                                                      \
 +    smp_mb__after_rmw();                                           \
     if (ctx_ && in_aio_context_home_thread(ctx_)) {                \
         while ((cond)) {                                           \
             aio_poll(ctx_, true);                                  \
 -- 
 2.37.3
--- a/SOURCES/kvm-aio_wait_kick-add-missing-memory-barrier.patch
+++ b/SOURCES/kvm-aio_wait_kick-add-missing-memory-barrier.patch
@ -0,0 +1,86 @@
 From d7eae0ff4c7f7f7bf10f10272adf7c6971c0db9b Mon Sep 17 00:00:00 2001
 From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date: Thu, 9 Mar 2023 09:26:35 -0500
 Subject: [PATCH 01/13] aio_wait_kick: add missing memory barrier
 RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-MergeRequest: 263: qatomic: add smp_mb__before/after_rmw()
 RH-Bugzilla: 2168472
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: Eric Auger <eric.auger@redhat.com>
 RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
 RH-Acked-by: David Hildenbrand <david@redhat.com>
 RH-Commit: [1/10] eb774aee79864052e14e706d931e52e7bd1162c8
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2168472
 commit 7455ff1aa01564cc175db5b2373e610503ad4411
 Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date:   Tue May 24 13:30:54 2022 -0400
    aio_wait_kick: add missing memory barrier
    It seems that aio_wait_kick always required a memory barrier
    or atomic operation in the caller, but nobody actually
    took care of doing it.
    Let's put the barrier in the function instead, and pair it
    with another one in AIO_WAIT_WHILE. Read aio_wait_kick()
    comment for further explanation.
    Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
    Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
    Message-Id: <20220524173054.12651-1-eesposit@redhat.com>
    Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
    Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
    Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 ---
 include/block/aio-wait.h |  2 ++
 util/aio-wait.c          | 16 +++++++++++++++-
 2 files changed, 17 insertions(+), 1 deletion(-)
 diff --git a/include/block/aio-wait.h b/include/block/aio-wait.h
 index b39eefb38d..54840f8622 100644
 --- a/include/block/aio-wait.h
 +++ b/include/block/aio-wait.h
@@ -81,6 +81,8 @@ extern AioWait global_aio_wait;
     AioContext *ctx_ = (ctx);                                      \
     /* Increment wait_->num_waiters before evaluating cond. */     \
     qatomic_inc(&wait_->num_waiters);                              \
 +    /* Paired with smp_mb in aio_wait_kick(). */                   \
 +    smp_mb();                                                      \
     if (ctx_ && in_aio_context_home_thread(ctx_)) {                \
         while ((cond)) {                                           \
             aio_poll(ctx_, true);                                  \
 diff --git a/util/aio-wait.c b/util/aio-wait.c
 index bdb3d3af22..98c5accd29 100644
 --- a/util/aio-wait.c
 +++ b/util/aio-wait.c
@@ -35,7 +35,21 @@ static void dummy_bh_cb(void *opaque)
 void aio_wait_kick(void)
 {
 -    /* The barrier (or an atomic op) is in the caller.  */
 +    /*
 +     * Paired with smp_mb in AIO_WAIT_WHILE. Here we have:
 +     * write(condition);
 +     * aio_wait_kick() {
 +     *      smp_mb();
 +     *      read(num_waiters);
 +     * }
 +     *
 +     * And in AIO_WAIT_WHILE:
 +     * write(num_waiters);
 +     * smp_mb();
 +     * read(condition);
 +     */
 +    smp_mb();
 +
     if (qatomic_read(&global_aio_wait.num_waiters)) {
         aio_bh_schedule_oneshot(qemu_get_aio_context(), dummy_bh_cb, NULL);
     }
 -- 
 2.37.3
--- a/SOURCES/kvm-apic-disable-reentrancy-detection-for-apic-msi.patch
+++ b/SOURCES/kvm-apic-disable-reentrancy-detection-for-apic-msi.patch
@ -0,0 +1,56 @@
 From 47d027147694fde94dd73305ee53b6a136cbeced Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Tue, 9 May 2023 10:29:03 -0400
 Subject: [PATCH 08/15] apic: disable reentrancy detection for apic-msi
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 277: memory: prevent dma-reentracy issues
 RH-Bugzilla: 1999236
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [8/12] 25c3cf99b00cd9adc10d6e7afa9c3e3b7da08de2 (redhat/rhel/src/qemu-kvm/jons-qemu-kvm-2)
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1999236
 Upstream: Merged
 CVE: CVE-2021-3750
 commit 50795ee051a342c681a9b45671c552fbd6274db8
 Author: Alexander Bulekov <alxndr@bu.edu>
 Date:   Thu Apr 27 17:10:13 2023 -0400
    apic: disable reentrancy detection for apic-msi
    As the code is designed for re-entrant calls to apic-msi, mark apic-msi
    as reentrancy-safe.
    Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
    Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
    Message-Id: <20230427211013.2994127-9-alxndr@bu.edu>
    Signed-off-by: Thomas Huth <thuth@redhat.com>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 hw/intc/apic.c | 7 +++++++
 1 file changed, 7 insertions(+)
 diff --git a/hw/intc/apic.c b/hw/intc/apic.c
 index 3df11c34d6..a7c2b301a8 100644
 --- a/hw/intc/apic.c
 +++ b/hw/intc/apic.c
@@ -883,6 +883,13 @@ static void apic_realize(DeviceState *dev, Error **errp)
     memory_region_init_io(&s->io_memory, OBJECT(s), &apic_io_ops, s, "apic-msi",
                           APIC_SPACE_SIZE);
 +    /*
 +     * apic-msi's apic_mem_write can call into ioapic_eoi_broadcast, which can
 +     * write back to apic-msi. As such mark the apic-msi region re-entrancy
 +     * safe.
 +     */
 +    s->io_memory.disable_reentrancy_guard = true;
 +
     s->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, apic_timer, s);
     local_apics[s->id] = s;
 -- 
 2.37.3
--- a/SOURCES/kvm-async-Add-an-optional-reentrancy-guard-to-the-BH-API.patch
+++ b/SOURCES/kvm-async-Add-an-optional-reentrancy-guard-to-the-BH-API.patch
@ -0,0 +1,235 @@
 From 8996ac4369de7e0cb6f911db6f47c3e4ae88c8aa Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Tue, 9 May 2023 10:29:03 -0400
 Subject: [PATCH 02/15] async: Add an optional reentrancy guard to the BH API
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 277: memory: prevent dma-reentracy issues
 RH-Bugzilla: 1999236
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [2/12] b03f247e242a6cdb3eebec36477234ac77dcd20c (redhat/rhel/src/qemu-kvm/jons-qemu-kvm-2)
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1999236
 Upstream: Merged
 CVE: CVE-2021-3750
 Conflict: The file block/graph-lock.h, inluded from include/block/aio.h,
          doesn't exist in this code version. The code compiles without
          issues if this include is just omitted, so we do that.
 commit 9c86c97f12c060bf7484dd931f38634e166a81f0
 Author: Alexander Bulekov <alxndr@bu.edu>
 Date:   Thu Apr 27 17:10:07 2023 -0400
    async: Add an optional reentrancy guard to the BH API
    Devices can pass their MemoryReentrancyGuard (from their DeviceState),
    when creating new BHes. Then, the async API will toggle the guard
    before/after calling the BH call-back. This prevents bh->mmio reentrancy
    issues.
    Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
    Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
    Message-Id: <20230427211013.2994127-3-alxndr@bu.edu>
    [thuth: Fix "line over 90 characters" checkpatch.pl error]
    Signed-off-by: Thomas Huth <thuth@redhat.com>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 docs/devel/multiple-iothreads.txt |  7 +++++++
 include/block/aio.h               | 18 ++++++++++++++++--
 include/qemu/main-loop.h          |  7 +++++--
 tests/unit/ptimer-test-stubs.c    |  3 ++-
 util/async.c                      | 18 +++++++++++++++++-
 util/main-loop.c                  |  6 ++++--
 util/trace-events                 |  1 +
 7 files changed, 52 insertions(+), 8 deletions(-)
 diff --git a/docs/devel/multiple-iothreads.txt b/docs/devel/multiple-iothreads.txt
 index aeb997bed5..a11576bc74 100644
 --- a/docs/devel/multiple-iothreads.txt
 +++ b/docs/devel/multiple-iothreads.txt
@@ -61,6 +61,7 @@ There are several old APIs that use the main loop AioContext:
  * LEGACY qemu_aio_set_event_notifier() - monitor an event notifier
  * LEGACY timer_new_ms() - create a timer
  * LEGACY qemu_bh_new() - create a BH
 + * LEGACY qemu_bh_new_guarded() - create a BH with a device re-entrancy guard
  * LEGACY qemu_aio_wait() - run an event loop iteration
 Since they implicitly work on the main loop they cannot be used in code that
@@ -72,8 +73,14 @@ Instead, use the AioContext functions directly (see include/block/aio.h):
  * aio_set_event_notifier() - monitor an event notifier
  * aio_timer_new() - create a timer
  * aio_bh_new() - create a BH
 + * aio_bh_new_guarded() - create a BH with a device re-entrancy guard
  * aio_poll() - run an event loop iteration
 +The qemu_bh_new_guarded/aio_bh_new_guarded APIs accept a "MemReentrancyGuard"
 +argument, which is used to check for and prevent re-entrancy problems. For
 +BHs associated with devices, the reentrancy-guard is contained in the
 +corresponding DeviceState and named "mem_reentrancy_guard".
 +
 The AioContext can be obtained from the IOThread using
 iothread_get_aio_context() or for the main loop using qemu_get_aio_context().
 Code that takes an AioContext argument works both in IOThreads or the main
 diff --git a/include/block/aio.h b/include/block/aio.h
 index 47fbe9d81f..c7da152985 100644
 --- a/include/block/aio.h
 +++ b/include/block/aio.h
@@ -22,6 +22,8 @@
 #include "qemu/event_notifier.h"
 #include "qemu/thread.h"
 #include "qemu/timer.h"
 +#include "hw/qdev-core.h"
 +
 typedef struct BlockAIOCB BlockAIOCB;
 typedef void BlockCompletionFunc(void *opaque, int ret);
@@ -321,9 +323,11 @@ void aio_bh_schedule_oneshot_full(AioContext *ctx, QEMUBHFunc *cb, void *opaque,
  * is opaque and must be allocated prior to its use.
  *
  * @name: A human-readable identifier for debugging purposes.
 + * @reentrancy_guard: A guard set when entering a cb to prevent
 + * device-reentrancy issues
  */
 QEMUBH *aio_bh_new_full(AioContext *ctx, QEMUBHFunc *cb, void *opaque,
 -                        const char *name);
 +                        const char *name, MemReentrancyGuard *reentrancy_guard);
 /**
  * aio_bh_new: Allocate a new bottom half structure
@@ -332,7 +336,17 @@ QEMUBH *aio_bh_new_full(AioContext *ctx, QEMUBHFunc *cb, void *opaque,
  * string.
  */
 #define aio_bh_new(ctx, cb, opaque) \
 -    aio_bh_new_full((ctx), (cb), (opaque), (stringify(cb)))
 +    aio_bh_new_full((ctx), (cb), (opaque), (stringify(cb)), NULL)
 +
 +/**
 + * aio_bh_new_guarded: Allocate a new bottom half structure with a
 + * reentrancy_guard
 + *
 + * A convenience wrapper for aio_bh_new_full() that uses the cb as the name
 + * string.
 + */
 +#define aio_bh_new_guarded(ctx, cb, opaque, guard) \
 +    aio_bh_new_full((ctx), (cb), (opaque), (stringify(cb)), guard)
 /**
  * aio_notify: Force processing of pending events.
 diff --git a/include/qemu/main-loop.h b/include/qemu/main-loop.h
 index 8dbc6fcb89..85dd5ada9e 100644
 --- a/include/qemu/main-loop.h
 +++ b/include/qemu/main-loop.h
@@ -294,9 +294,12 @@ void qemu_cond_timedwait_iothread(QemuCond *cond, int ms);
 void qemu_fd_register(int fd);
 +#define qemu_bh_new_guarded(cb, opaque, guard) \
 +    qemu_bh_new_full((cb), (opaque), (stringify(cb)), guard)
 #define qemu_bh_new(cb, opaque) \
 -    qemu_bh_new_full((cb), (opaque), (stringify(cb)))
 -QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name);
 +    qemu_bh_new_full((cb), (opaque), (stringify(cb)), NULL)
 +QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name,
 +                         MemReentrancyGuard *reentrancy_guard);
 void qemu_bh_schedule_idle(QEMUBH *bh);
 enum {
 diff --git a/tests/unit/ptimer-test-stubs.c b/tests/unit/ptimer-test-stubs.c
 index 2a3ef58799..a7a2d08e7e 100644
 --- a/tests/unit/ptimer-test-stubs.c
 +++ b/tests/unit/ptimer-test-stubs.c
@@ -108,7 +108,8 @@ int64_t qemu_clock_deadline_ns_all(QEMUClockType type, int attr_mask)
     return deadline;
 }
 -QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name)
 +QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name,
 +                         MemReentrancyGuard *reentrancy_guard)
 {
     QEMUBH *bh = g_new(QEMUBH, 1);
 diff --git a/util/async.c b/util/async.c
 index 2a63bf90f2..1fff02e7fc 100644
 --- a/util/async.c
 +++ b/util/async.c
@@ -62,6 +62,7 @@ struct QEMUBH {
     void *opaque;
     QSLIST_ENTRY(QEMUBH) next;
     unsigned flags;
 +    MemReentrancyGuard *reentrancy_guard;
 };
 /* Called concurrently from any thread */
@@ -127,7 +128,7 @@ void aio_bh_schedule_oneshot_full(AioContext *ctx, QEMUBHFunc *cb,
 }
 QEMUBH *aio_bh_new_full(AioContext *ctx, QEMUBHFunc *cb, void *opaque,
 -                        const char *name)
 +                        const char *name, MemReentrancyGuard *reentrancy_guard)
 {
     QEMUBH *bh;
     bh = g_new(QEMUBH, 1);
@@ -136,13 +137,28 @@ QEMUBH *aio_bh_new_full(AioContext *ctx, QEMUBHFunc *cb, void *opaque,
         .cb = cb,
         .opaque = opaque,
         .name = name,
 +        .reentrancy_guard = reentrancy_guard,
     };
     return bh;
 }
 void aio_bh_call(QEMUBH *bh)
 {
 +    bool last_engaged_in_io = false;
 +
 +    if (bh->reentrancy_guard) {
 +        last_engaged_in_io = bh->reentrancy_guard->engaged_in_io;
 +        if (bh->reentrancy_guard->engaged_in_io) {
 +            trace_reentrant_aio(bh->ctx, bh->name);
 +        }
 +        bh->reentrancy_guard->engaged_in_io = true;
 +    }
 +
     bh->cb(bh->opaque);
 +
 +    if (bh->reentrancy_guard) {
 +        bh->reentrancy_guard->engaged_in_io = last_engaged_in_io;
 +    }
 }
 /* Multiple occurrences of aio_bh_poll cannot be called concurrently. */
 diff --git a/util/main-loop.c b/util/main-loop.c
 index 06b18b195c..1eacf04691 100644
 --- a/util/main-loop.c
 +++ b/util/main-loop.c
@@ -544,9 +544,11 @@ void main_loop_wait(int nonblocking)
 /* Functions to operate on the main QEMU AioContext.  */
 -QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name)
 +QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name,
 +                         MemReentrancyGuard *reentrancy_guard)
 {
 -    return aio_bh_new_full(qemu_aio_context, cb, opaque, name);
 +    return aio_bh_new_full(qemu_aio_context, cb, opaque, name,
 +                           reentrancy_guard);
 }
 /*
 diff --git a/util/trace-events b/util/trace-events
 index c8f53d7d9f..dc3b1eb3bf 100644
 --- a/util/trace-events
 +++ b/util/trace-events
@@ -11,6 +11,7 @@ poll_remove(void *ctx, void *node, int fd) "ctx %p node %p fd %d"
 # async.c
 aio_co_schedule(void *ctx, void *co) "ctx %p co %p"
 aio_co_schedule_bh_cb(void *ctx, void *co) "ctx %p co %p"
 +reentrant_aio(void *ctx, const char *name) "ctx %p name %s"
 # thread-pool.c
 thread_pool_submit(void *pool, void *req, void *opaque) "pool %p req %p opaque %p"
 -- 
 2.37.3
--- a/SOURCES/kvm-async-avoid-use-after-free-on-re-entrancy-guard.patch
+++ b/SOURCES/kvm-async-avoid-use-after-free-on-re-entrancy-guard.patch
@ -0,0 +1,71 @@
 From d754050d260e2ad890cecd975df6e163c531b40e Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Tue, 9 May 2023 10:29:03 -0400
 Subject: [PATCH 09/15] async: avoid use-after-free on re-entrancy guard
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 277: memory: prevent dma-reentracy issues
 RH-Bugzilla: 1999236
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [9/12] d357650e581c3921bbfe3e2fde5e3f55853b5fab (redhat/rhel/src/qemu-kvm/jons-qemu-kvm-2)
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1999236
 Upstream: Merged
 CVE: CVE-2021-3750
 commit 7915bd06f25e1803778081161bf6fa10c42dc7cd
 Author: Alexander Bulekov <alxndr@bu.edu>
 Date:   Mon May 1 10:19:56 2023 -0400
    async: avoid use-after-free on re-entrancy guard
    A BH callback can free the BH, causing a use-after-free in aio_bh_call.
    Fix that by keeping a local copy of the re-entrancy guard pointer.
    Buglink: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58513
    Fixes: 9c86c97f12 ("async: Add an optional reentrancy guard to the BH API")
    Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
    Message-Id: <20230501141956.3444868-1-alxndr@bu.edu>
    Reviewed-by: Thomas Huth <thuth@redhat.com>
    Signed-off-by: Thomas Huth <thuth@redhat.com>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 util/async.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)
 diff --git a/util/async.c b/util/async.c
 index 1fff02e7fc..ffe0541c3b 100644
 --- a/util/async.c
 +++ b/util/async.c
@@ -146,18 +146,20 @@ void aio_bh_call(QEMUBH *bh)
 {
     bool last_engaged_in_io = false;
 -    if (bh->reentrancy_guard) {
 -        last_engaged_in_io = bh->reentrancy_guard->engaged_in_io;
 -        if (bh->reentrancy_guard->engaged_in_io) {
 +    /* Make a copy of the guard-pointer as cb may free the bh */
 +    MemReentrancyGuard *reentrancy_guard = bh->reentrancy_guard;
 +    if (reentrancy_guard) {
 +        last_engaged_in_io = reentrancy_guard->engaged_in_io;
 +        if (reentrancy_guard->engaged_in_io) {
             trace_reentrant_aio(bh->ctx, bh->name);
         }
 -        bh->reentrancy_guard->engaged_in_io = true;
 +        reentrancy_guard->engaged_in_io = true;
     }
     bh->cb(bh->opaque);
 -    if (bh->reentrancy_guard) {
 -        bh->reentrancy_guard->engaged_in_io = last_engaged_in_io;
 +    if (reentrancy_guard) {
 +        reentrancy_guard->engaged_in_io = last_engaged_in_io;
     }
 }
 -- 
 2.37.3
--- a/SOURCES/kvm-async-clarify-usage-of-barriers-in-the-polling-case.patch
+++ b/SOURCES/kvm-async-clarify-usage-of-barriers-in-the-polling-case.patch
@ -0,0 +1,66 @@
 From 187eb7a418af93375e42298d06e231e2bec3cf00 Mon Sep 17 00:00:00 2001
 From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date: Thu, 9 Mar 2023 08:15:42 -0500
 Subject: [PATCH 10/13] async: clarify usage of barriers in the polling case
 RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-MergeRequest: 263: qatomic: add smp_mb__before/after_rmw()
 RH-Bugzilla: 2168472
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: Eric Auger <eric.auger@redhat.com>
 RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
 RH-Acked-by: David Hildenbrand <david@redhat.com>
 RH-Commit: [10/10] 3be07ccc6137a0336becfe63a818d9cbadb38e9c
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2168472
 commit 6229438cca037d42f44a96d38feb15cb102a444f
 Author: Paolo Bonzini <pbonzini@redhat.com>
 Date:   Mon Mar 6 10:43:52 2023 +0100
    async: clarify usage of barriers in the polling case
    Explain that aio_context_notifier_poll() relies on
    aio_notify_accept() to catch all the memory writes that were
    done before ctx->notified was set to true.
    Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
    Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 ---
 util/async.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)
 diff --git a/util/async.c b/util/async.c
 index 795fe699b6..2a63bf90f2 100644
 --- a/util/async.c
 +++ b/util/async.c
@@ -463,8 +463,9 @@ void aio_notify_accept(AioContext *ctx)
     qatomic_set(&ctx->notified, false);
     /*
 -     * Write ctx->notified before reading e.g. bh->flags.  Pairs with smp_wmb
 -     * in aio_notify.
 +     * Order reads of ctx->notified (in aio_context_notifier_poll()) and the
 +     * above clearing of ctx->notified before reads of e.g. bh->flags.  Pairs
 +     * with smp_wmb() in aio_notify.
      */
     smp_mb();
 }
@@ -487,6 +488,11 @@ static bool aio_context_notifier_poll(void *opaque)
     EventNotifier *e = opaque;
     AioContext *ctx = container_of(e, AioContext, notifier);
 +    /*
 +     * No need for load-acquire because we just want to kick the
 +     * event loop.  aio_notify_accept() takes care of synchronizing
 +     * the event loop with the producers.
 +     */
     return qatomic_read(&ctx->notified);
 }
 -- 
 2.37.3
--- a/SOURCES/kvm-async-update-documentation-of-the-memory-barriers.patch
+++ b/SOURCES/kvm-async-update-documentation-of-the-memory-barriers.patch
@ -0,0 +1,111 @@
 From ea3856bb545d19499602830cdc3076d83a981e7a Mon Sep 17 00:00:00 2001
 From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date: Thu, 9 Mar 2023 08:15:36 -0500
 Subject: [PATCH 09/13] async: update documentation of the memory barriers
 RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-MergeRequest: 263: qatomic: add smp_mb__before/after_rmw()
 RH-Bugzilla: 2168472
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: Eric Auger <eric.auger@redhat.com>
 RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
 RH-Acked-by: David Hildenbrand <david@redhat.com>
 RH-Commit: [9/10] d471da2acf7a107cf75f3327c5e8d7456307160e
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2168472
 commit 8dd48650b43dfde4ebea34191ac267e474bcc29e
 Author: Paolo Bonzini <pbonzini@redhat.com>
 Date:   Mon Mar 6 10:15:06 2023 +0100
    async: update documentation of the memory barriers
    Ever since commit 8c6b0356b539 ("util/async: make bh_aio_poll() O(1)",
    2020-02-22), synchronization between qemu_bh_schedule() and aio_bh_poll()
    is happening when the bottom half is enqueued in the bh_list; not
    when the flags are set.  Update the documentation to match.
    Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 ---
 util/async.c | 33 +++++++++++++++++++--------------
 1 file changed, 19 insertions(+), 14 deletions(-)
 diff --git a/util/async.c b/util/async.c
 index 6f6717a34b..795fe699b6 100644
 --- a/util/async.c
 +++ b/util/async.c
@@ -71,14 +71,21 @@ static void aio_bh_enqueue(QEMUBH *bh, unsigned new_flags)
     unsigned old_flags;
     /*
 -     * The memory barrier implicit in qatomic_fetch_or makes sure that:
 -     * 1. idle & any writes needed by the callback are done before the
 -     *    locations are read in the aio_bh_poll.
 -     * 2. ctx is loaded before the callback has a chance to execute and bh
 -     *    could be freed.
 +     * Synchronizes with atomic_fetch_and() in aio_bh_dequeue(), ensuring that
 +     * insertion starts after BH_PENDING is set.
      */
     old_flags = qatomic_fetch_or(&bh->flags, BH_PENDING | new_flags);
 +
     if (!(old_flags & BH_PENDING)) {
 +        /*
 +         * At this point the bottom half becomes visible to aio_bh_poll().
 +         * This insertion thus synchronizes with QSLIST_MOVE_ATOMIC in
 +         * aio_bh_poll(), ensuring that:
 +         * 1. any writes needed by the callback are visible from the callback
 +         *    after aio_bh_dequeue() returns bh.
 +         * 2. ctx is loaded before the callback has a chance to execute and bh
 +         *    could be freed.
 +         */
         QSLIST_INSERT_HEAD_ATOMIC(&ctx->bh_list, bh, next);
     }
@@ -97,11 +104,8 @@ static QEMUBH *aio_bh_dequeue(BHList *head, unsigned *flags)
     QSLIST_REMOVE_HEAD(head, next);
     /*
 -     * The qatomic_and is paired with aio_bh_enqueue().  The implicit memory
 -     * barrier ensures that the callback sees all writes done by the scheduling
 -     * thread.  It also ensures that the scheduling thread sees the cleared
 -     * flag before bh->cb has run, and thus will call aio_notify again if
 -     * necessary.
 +     * Synchronizes with qatomic_fetch_or() in aio_bh_enqueue(), ensuring that
 +     * the removal finishes before BH_PENDING is reset.
      */
     *flags = qatomic_fetch_and(&bh->flags,
                               ~(BH_PENDING | BH_SCHEDULED | BH_IDLE));
@@ -148,6 +152,7 @@ int aio_bh_poll(AioContext *ctx)
     BHListSlice *s;
     int ret = 0;
 +    /* Synchronizes with QSLIST_INSERT_HEAD_ATOMIC in aio_bh_enqueue().  */
     QSLIST_MOVE_ATOMIC(&slice.bh_list, &ctx->bh_list);
     QSIMPLEQ_INSERT_TAIL(&ctx->bh_slice_list, &slice, next);
@@ -437,15 +442,15 @@ LuringState *aio_get_linux_io_uring(AioContext *ctx)
 void aio_notify(AioContext *ctx)
 {
     /*
 -     * Write e.g. bh->flags before writing ctx->notified.  Pairs with smp_mb in
 -     * aio_notify_accept.
 +     * Write e.g. ctx->bh_list before writing ctx->notified.  Pairs with
 +     * smp_mb() in aio_notify_accept().
      */
     smp_wmb();
     qatomic_set(&ctx->notified, true);
     /*
 -     * Write ctx->notified before reading ctx->notify_me.  Pairs
 -     * with smp_mb in aio_ctx_prepare or aio_poll.
 +     * Write ctx->notified (and also ctx->bh_list) before reading ctx->notify_me.
 +     * Pairs with smp_mb() in aio_ctx_prepare or aio_poll.
      */
     smp_mb();
     if (qatomic_read(&ctx->notify_me)) {
 -- 
 2.37.3
--- a/SOURCES/kvm-backends-hostmem-Fix-support-of-memory-backend-memfd.patch
+++ b/SOURCES/kvm-backends-hostmem-Fix-support-of-memory-backend-memfd.patch
@ -0,0 +1,71 @@
 From 60da56e3685969493ae483c3cc2c66af13d00baf Mon Sep 17 00:00:00 2001
 From: Thomas Huth <thuth@redhat.com>
 Date: Wed, 10 Aug 2022 14:57:18 +0200
 Subject: [PATCH 1/3] backends/hostmem: Fix support of memory-backend-memfd in
 qemu_maxrampagesize()
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Cédric Le Goater <None>
 RH-MergeRequest: 221: backends/hostmem: Fix support of memory-backend-memfd in qemu_maxrampagesize()
 RH-Bugzilla: 2117149
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: David Hildenbrand <david@redhat.com>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Commit: [1/1] b5a1047750af32c0a261b8385ea0e819eb16681a
 It is currently not possible yet to use "memory-backend-memfd" on s390x
 with hugepages enabled. This problem is caused by qemu_maxrampagesize()
 not taking memory-backend-memfd objects into account yet, so the code
 in s390_memory_init() fails to enable the huge page support there via
 s390_set_max_pagesize(). Fix it by generalizing the code, so that it
 looks at qemu_ram_pagesize(memdev->mr.ram_block) instead of re-trying
 to get the information from the filesystem.
 Suggested-by: David Hildenbrand <david@redhat.com>
 Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2116496
 Message-Id: <20220810125720.3849835-2-thuth@redhat.com>
 Reviewed-by: David Hildenbrand <david@redhat.com>
 Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 (cherry picked from commit 8be934b70e923104da883b990dee18f02552d40e)
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2117149
 [clg: Resolved conflict on qemu_real_host_page_size() ]
 Signed-off-by: Cédric Le Goater <clg@redhat.com>
 ---
 backends/hostmem.c | 14 ++------------
 1 file changed, 2 insertions(+), 12 deletions(-)
 diff --git a/backends/hostmem.c b/backends/hostmem.c
 index 4c05862ed5..0c4654ea85 100644
 --- a/backends/hostmem.c
 +++ b/backends/hostmem.c
@@ -305,22 +305,12 @@ bool host_memory_backend_is_mapped(HostMemoryBackend *backend)
     return backend->is_mapped;
 }
 -#ifdef __linux__
 size_t host_memory_backend_pagesize(HostMemoryBackend *memdev)
 {
 -    Object *obj = OBJECT(memdev);
 -    char *path = object_property_get_str(obj, "mem-path", NULL);
 -    size_t pagesize = qemu_mempath_getpagesize(path);
 -
 -    g_free(path);
 +    size_t pagesize = qemu_ram_pagesize(memdev->mr.ram_block);
 +    g_assert(pagesize >= qemu_real_host_page_size);
     return pagesize;
 }
 -#else
 -size_t host_memory_backend_pagesize(HostMemoryBackend *memdev)
 -{
 -    return qemu_real_host_page_size;
 -}
 -#endif
 static void
 host_memory_backend_memory_complete(UserCreatable *uc, Error **errp)
 -- 
 2.35.3
--- a/SOURCES/kvm-backends-iommufd-Introduce-the-iommufd-object.patch
+++ b/SOURCES/kvm-backends-iommufd-Introduce-the-iommufd-object.patch
@ -1,476 +0,0 @@
 From 0d8255c98b3ef6f603ff0279592d3e91de26de0e Mon Sep 17 00:00:00 2001
 From: Eric Auger <eric.auger@redhat.com>
 Date: Tue, 21 Nov 2023 16:44:00 +0800
 Subject: [PATCH 021/101] backends/iommufd: Introduce the iommufd object
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Eric Auger <eric.auger@redhat.com>
 RH-MergeRequest: 211: IOMMUFD backend backport
 RH-Jira: RHEL-19302 RHEL-21057
 RH-Acked-by: Cédric Le Goater <clg@redhat.com>
 RH-Acked-by: Sebastian Ott <sebott@redhat.com>
 RH-Commit: [20/67] 8a56344ab4a2126f248bfa492ccddd19265f39be (eauger1/centos-qemu-kvm)
 Introduce an iommufd object which allows the interaction
 with the host /dev/iommu device.
 The /dev/iommu can have been already pre-opened outside of qemu,
 in which case the fd can be passed directly along with the
 iommufd object:
 This allows the iommufd object to be shared accross several
 subsystems (VFIO, VDPA, ...). For example, libvirt would open
 the /dev/iommu once.
 If no fd is passed along with the iommufd object, the /dev/iommu
 is opened by the qemu code.
 Suggested-by: Alex Williamson <alex.williamson@redhat.com>
 Signed-off-by: Eric Auger <eric.auger@redhat.com>
 Signed-off-by: Yi Liu <yi.l.liu@intel.com>
 Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
 Reviewed-by: Cédric Le Goater <clg@redhat.com>
 Tested-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Nicolin Chen <nicolinc@nvidia.com>
 Signed-off-by: Cédric Le Goater <clg@redhat.com>
 (cherry picked from commit 6e6d8ac62b5b38dc9d4b69ffdf073f0a0b43b7be)
 Signed-off-by: Eric Auger <eric.auger@redhat.com>
 ---
 MAINTAINERS              |   8 ++
 backends/Kconfig         |   4 +
 backends/iommufd.c       | 245 +++++++++++++++++++++++++++++++++++++++
 backends/meson.build     |   1 +
 backends/trace-events    |  10 ++
 include/sysemu/iommufd.h |  38 ++++++
 qapi/qom.json            |  19 +++
 qemu-options.hx          |  12 ++
 8 files changed, 337 insertions(+)
 create mode 100644 backends/iommufd.c
 create mode 100644 include/sysemu/iommufd.h
 diff --git a/MAINTAINERS b/MAINTAINERS
 index 695e0bd34f..a5a446914a 100644
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
@@ -2167,6 +2167,14 @@ F: hw/vfio/ap.c
 F: docs/system/s390x/vfio-ap.rst
 L: qemu-s390x@nongnu.org
 +iommufd
 +M: Yi Liu <yi.l.liu@intel.com>
 +M: Eric Auger <eric.auger@redhat.com>
 +M: Zhenzhong Duan <zhenzhong.duan@intel.com>
 +S: Supported
 +F: backends/iommufd.c
 +F: include/sysemu/iommufd.h
 +
 vhost
 M: Michael S. Tsirkin <mst@redhat.com>
 S: Supported
 diff --git a/backends/Kconfig b/backends/Kconfig
 index f35abc1609..2cb23f62fa 100644
 --- a/backends/Kconfig
 +++ b/backends/Kconfig
@@ -1 +1,5 @@
 source tpm/Kconfig
 +
 +config IOMMUFD
 +    bool
 +    depends on VFIO
 diff --git a/backends/iommufd.c b/backends/iommufd.c
 new file mode 100644
 index 0000000000..ba58a0eb0d
 --- /dev/null
 +++ b/backends/iommufd.c
@@ -0,0 +1,245 @@
 +/*
 + * iommufd container backend
 + *
 + * Copyright (C) 2023 Intel Corporation.
 + * Copyright Red Hat, Inc. 2023
 + *
 + * Authors: Yi Liu <yi.l.liu@intel.com>
 + *          Eric Auger <eric.auger@redhat.com>
 + *
 + * SPDX-License-Identifier: GPL-2.0-or-later
 + */
 +
 +#include "qemu/osdep.h"
 +#include "sysemu/iommufd.h"
 +#include "qapi/error.h"
 +#include "qapi/qmp/qerror.h"
 +#include "qemu/module.h"
 +#include "qom/object_interfaces.h"
 +#include "qemu/error-report.h"
 +#include "monitor/monitor.h"
 +#include "trace.h"
 +#include <sys/ioctl.h>
 +#include <linux/iommufd.h>
 +
 +static void iommufd_backend_init(Object *obj)
 +{
 +    IOMMUFDBackend *be = IOMMUFD_BACKEND(obj);
 +
 +    be->fd = -1;
 +    be->users = 0;
 +    be->owned = true;
 +    qemu_mutex_init(&be->lock);
 +}
 +
 +static void iommufd_backend_finalize(Object *obj)
 +{
 +    IOMMUFDBackend *be = IOMMUFD_BACKEND(obj);
 +
 +    if (be->owned) {
 +        close(be->fd);
 +        be->fd = -1;
 +    }
 +}
 +
 +static void iommufd_backend_set_fd(Object *obj, const char *str, Error **errp)
 +{
 +    IOMMUFDBackend *be = IOMMUFD_BACKEND(obj);
 +    int fd = -1;
 +
 +    fd = monitor_fd_param(monitor_cur(), str, errp);
 +    if (fd == -1) {
 +        error_prepend(errp, "Could not parse remote object fd %s:", str);
 +        return;
 +    }
 +    qemu_mutex_lock(&be->lock);
 +    be->fd = fd;
 +    be->owned = false;
 +    qemu_mutex_unlock(&be->lock);
 +    trace_iommu_backend_set_fd(be->fd);
 +}
 +
 +static bool iommufd_backend_can_be_deleted(UserCreatable *uc)
 +{
 +    IOMMUFDBackend *be = IOMMUFD_BACKEND(uc);
 +
 +    return !be->users;
 +}
 +
 +static void iommufd_backend_class_init(ObjectClass *oc, void *data)
 +{
 +    UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
 +
 +    ucc->can_be_deleted = iommufd_backend_can_be_deleted;
 +
 +    object_class_property_add_str(oc, "fd", NULL, iommufd_backend_set_fd);
 +}
 +
 +int iommufd_backend_connect(IOMMUFDBackend *be, Error **errp)
 +{
 +    int fd, ret = 0;
 +
 +    qemu_mutex_lock(&be->lock);
 +    if (be->users == UINT32_MAX) {
 +        error_setg(errp, "too many connections");
 +        ret = -E2BIG;
 +        goto out;
 +    }
 +    if (be->owned && !be->users) {
 +        fd = qemu_open_old("/dev/iommu", O_RDWR);
 +        if (fd < 0) {
 +            error_setg_errno(errp, errno, "/dev/iommu opening failed");
 +            ret = fd;
 +            goto out;
 +        }
 +        be->fd = fd;
 +    }
 +    be->users++;
 +out:
 +    trace_iommufd_backend_connect(be->fd, be->owned,
 +                                  be->users, ret);
 +    qemu_mutex_unlock(&be->lock);
 +    return ret;
 +}
 +
 +void iommufd_backend_disconnect(IOMMUFDBackend *be)
 +{
 +    qemu_mutex_lock(&be->lock);
 +    if (!be->users) {
 +        goto out;
 +    }
 +    be->users--;
 +    if (!be->users && be->owned) {
 +        close(be->fd);
 +        be->fd = -1;
 +    }
 +out:
 +    trace_iommufd_backend_disconnect(be->fd, be->users);
 +    qemu_mutex_unlock(&be->lock);
 +}
 +
 +int iommufd_backend_alloc_ioas(IOMMUFDBackend *be, uint32_t *ioas_id,
 +                               Error **errp)
 +{
 +    int ret, fd = be->fd;
 +    struct iommu_ioas_alloc alloc_data  = {
 +        .size = sizeof(alloc_data),
 +        .flags = 0,
 +    };
 +
 +    ret = ioctl(fd, IOMMU_IOAS_ALLOC, &alloc_data);
 +    if (ret) {
 +        error_setg_errno(errp, errno, "Failed to allocate ioas");
 +        return ret;
 +    }
 +
 +    *ioas_id = alloc_data.out_ioas_id;
 +    trace_iommufd_backend_alloc_ioas(fd, *ioas_id, ret);
 +
 +    return ret;
 +}
 +
 +void iommufd_backend_free_id(IOMMUFDBackend *be, uint32_t id)
 +{
 +    int ret, fd = be->fd;
 +    struct iommu_destroy des = {
 +        .size = sizeof(des),
 +        .id = id,
 +    };
 +
 +    ret = ioctl(fd, IOMMU_DESTROY, &des);
 +    trace_iommufd_backend_free_id(fd, id, ret);
 +    if (ret) {
 +        error_report("Failed to free id: %u %m", id);
 +    }
 +}
 +
 +int iommufd_backend_map_dma(IOMMUFDBackend *be, uint32_t ioas_id, hwaddr iova,
 +                            ram_addr_t size, void *vaddr, bool readonly)
 +{
 +    int ret, fd = be->fd;
 +    struct iommu_ioas_map map = {
 +        .size = sizeof(map),
 +        .flags = IOMMU_IOAS_MAP_READABLE |
 +                 IOMMU_IOAS_MAP_FIXED_IOVA,
 +        .ioas_id = ioas_id,
 +        .__reserved = 0,
 +        .user_va = (uintptr_t)vaddr,
 +        .iova = iova,
 +        .length = size,
 +    };
 +
 +    if (!readonly) {
 +        map.flags |= IOMMU_IOAS_MAP_WRITEABLE;
 +    }
 +
 +    ret = ioctl(fd, IOMMU_IOAS_MAP, &map);
 +    trace_iommufd_backend_map_dma(fd, ioas_id, iova, size,
 +                                  vaddr, readonly, ret);
 +    if (ret) {
 +        ret = -errno;
 +
 +        /* TODO: Not support mapping hardware PCI BAR region for now. */
 +        if (errno == EFAULT) {
 +            warn_report("IOMMU_IOAS_MAP failed: %m, PCI BAR?");
 +        } else {
 +            error_report("IOMMU_IOAS_MAP failed: %m");
 +        }
 +    }
 +    return ret;
 +}
 +
 +int iommufd_backend_unmap_dma(IOMMUFDBackend *be, uint32_t ioas_id,
 +                              hwaddr iova, ram_addr_t size)
 +{
 +    int ret, fd = be->fd;
 +    struct iommu_ioas_unmap unmap = {
 +        .size = sizeof(unmap),
 +        .ioas_id = ioas_id,
 +        .iova = iova,
 +        .length = size,
 +    };
 +
 +    ret = ioctl(fd, IOMMU_IOAS_UNMAP, &unmap);
 +    /*
 +     * IOMMUFD takes mapping as some kind of object, unmapping
 +     * nonexistent mapping is treated as deleting a nonexistent
 +     * object and return ENOENT. This is different from legacy
 +     * backend which allows it. vIOMMU may trigger a lot of
 +     * redundant unmapping, to avoid flush the log, treat them
 +     * as succeess for IOMMUFD just like legacy backend.
 +     */
 +    if (ret && errno == ENOENT) {
 +        trace_iommufd_backend_unmap_dma_non_exist(fd, ioas_id, iova, size, ret);
 +        ret = 0;
 +    } else {
 +        trace_iommufd_backend_unmap_dma(fd, ioas_id, iova, size, ret);
 +    }
 +
 +    if (ret) {
 +        ret = -errno;
 +        error_report("IOMMU_IOAS_UNMAP failed: %m");
 +    }
 +    return ret;
 +}
 +
 +static const TypeInfo iommufd_backend_info = {
 +    .name = TYPE_IOMMUFD_BACKEND,
 +    .parent = TYPE_OBJECT,
 +    .instance_size = sizeof(IOMMUFDBackend),
 +    .instance_init = iommufd_backend_init,
 +    .instance_finalize = iommufd_backend_finalize,
 +    .class_size = sizeof(IOMMUFDBackendClass),
 +    .class_init = iommufd_backend_class_init,
 +    .interfaces = (InterfaceInfo[]) {
 +        { TYPE_USER_CREATABLE },
 +        { }
 +    }
 +};
 +
 +static void register_types(void)
 +{
 +    type_register_static(&iommufd_backend_info);
 +}
 +
 +type_init(register_types);
 diff --git a/backends/meson.build b/backends/meson.build
 index 914c7c4afb..9a5cea480d 100644
 --- a/backends/meson.build
 +++ b/backends/meson.build
@@ -20,6 +20,7 @@ if have_vhost_user
   system_ss.add(when: 'CONFIG_VIRTIO', if_true: files('vhost-user.c'))
 endif
 system_ss.add(when: 'CONFIG_VIRTIO_CRYPTO', if_true: files('cryptodev-vhost.c'))
 +system_ss.add(when: 'CONFIG_IOMMUFD', if_true: files('iommufd.c'))
 if have_vhost_user_crypto
   system_ss.add(when: 'CONFIG_VIRTIO_CRYPTO', if_true: files('cryptodev-vhost-user.c'))
 endif
 diff --git a/backends/trace-events b/backends/trace-events
 index 652eb76a57..d45c6e31a6 100644
 --- a/backends/trace-events
 +++ b/backends/trace-events
@@ -5,3 +5,13 @@ dbus_vmstate_pre_save(void)
 dbus_vmstate_post_load(int version_id) "version_id: %d"
 dbus_vmstate_loading(const char *id) "id: %s"
 dbus_vmstate_saving(const char *id) "id: %s"
 +
 +# iommufd.c
 +iommufd_backend_connect(int fd, bool owned, uint32_t users, int ret) "fd=%d owned=%d users=%d (%d)"
 +iommufd_backend_disconnect(int fd, uint32_t users) "fd=%d users=%d"
 +iommu_backend_set_fd(int fd) "pre-opened /dev/iommu fd=%d"
 +iommufd_backend_map_dma(int iommufd, uint32_t ioas, uint64_t iova, uint64_t size, void *vaddr, bool readonly, int ret) " iommufd=%d ioas=%d iova=0x%"PRIx64" size=0x%"PRIx64" addr=%p readonly=%d (%d)"
 +iommufd_backend_unmap_dma_non_exist(int iommufd, uint32_t ioas, uint64_t iova, uint64_t size, int ret) " Unmap nonexistent mapping: iommufd=%d ioas=%d iova=0x%"PRIx64" size=0x%"PRIx64" (%d)"
 +iommufd_backend_unmap_dma(int iommufd, uint32_t ioas, uint64_t iova, uint64_t size, int ret) " iommufd=%d ioas=%d iova=0x%"PRIx64" size=0x%"PRIx64" (%d)"
 +iommufd_backend_alloc_ioas(int iommufd, uint32_t ioas, int ret) " iommufd=%d ioas=%d (%d)"
 +iommufd_backend_free_id(int iommufd, uint32_t id, int ret) " iommufd=%d id=%d (%d)"
 diff --git a/include/sysemu/iommufd.h b/include/sysemu/iommufd.h
 new file mode 100644
 index 0000000000..9c5524b0ed
 --- /dev/null
 +++ b/include/sysemu/iommufd.h
@@ -0,0 +1,38 @@
 +#ifndef SYSEMU_IOMMUFD_H
 +#define SYSEMU_IOMMUFD_H
 +
 +#include "qom/object.h"
 +#include "qemu/thread.h"
 +#include "exec/hwaddr.h"
 +#include "exec/cpu-common.h"
 +
 +#define TYPE_IOMMUFD_BACKEND "iommufd"
 +OBJECT_DECLARE_TYPE(IOMMUFDBackend, IOMMUFDBackendClass, IOMMUFD_BACKEND)
 +
 +struct IOMMUFDBackendClass {
 +    ObjectClass parent_class;
 +};
 +
 +struct IOMMUFDBackend {
 +    Object parent;
 +
 +    /*< protected >*/
 +    int fd;            /* /dev/iommu file descriptor */
 +    bool owned;        /* is the /dev/iommu opened internally */
 +    QemuMutex lock;
 +    uint32_t users;
 +
 +    /*< public >*/
 +};
 +
 +int iommufd_backend_connect(IOMMUFDBackend *be, Error **errp);
 +void iommufd_backend_disconnect(IOMMUFDBackend *be);
 +
 +int iommufd_backend_alloc_ioas(IOMMUFDBackend *be, uint32_t *ioas_id,
 +                               Error **errp);
 +void iommufd_backend_free_id(IOMMUFDBackend *be, uint32_t id);
 +int iommufd_backend_map_dma(IOMMUFDBackend *be, uint32_t ioas_id, hwaddr iova,
 +                            ram_addr_t size, void *vaddr, bool readonly);
 +int iommufd_backend_unmap_dma(IOMMUFDBackend *be, uint32_t ioas_id,
 +                              hwaddr iova, ram_addr_t size);
 +#endif
 diff --git a/qapi/qom.json b/qapi/qom.json
 index c53ef978ff..95516ba325 100644
 --- a/qapi/qom.json
 +++ b/qapi/qom.json
@@ -794,6 +794,23 @@
 { 'struct': 'VfioUserServerProperties',
   'data': { 'socket': 'SocketAddress', 'device': 'str' } }
 +##
 +# @IOMMUFDProperties:
 +#
 +# Properties for iommufd objects.
 +#
 +# @fd: file descriptor name previously passed via 'getfd' command,
 +#     which represents a pre-opened /dev/iommu.  This allows the
 +#     iommufd object to be shared accross several subsystems
 +#     (VFIO, VDPA, ...), and the file descriptor to be shared
 +#     with other process, e.g. DPDK.  (default: QEMU opens
 +#     /dev/iommu by itself)
 +#
 +# Since: 9.0
 +##
 +{ 'struct': 'IOMMUFDProperties',
 +  'data': { '*fd': 'str' } }
 +
 ##
 # @RngProperties:
 #
@@ -934,6 +951,7 @@
     'input-barrier',
     { 'name': 'input-linux',
       'if': 'CONFIG_LINUX' },
 +    'iommufd',
     'iothread',
     'main-loop',
     { 'name': 'memory-backend-epc',
@@ -1003,6 +1021,7 @@
       'input-barrier':              'InputBarrierProperties',
       'input-linux':                { 'type': 'InputLinuxProperties',
                                       'if': 'CONFIG_LINUX' },
 +      'iommufd':                    'IOMMUFDProperties',
       'iothread':                   'IothreadProperties',
       'main-loop':                  'MainLoopProperties',
       'memory-backend-epc':         { 'type': 'MemoryBackendEpcProperties',
 diff --git a/qemu-options.hx b/qemu-options.hx
 index 557118cb1f..0814f43066 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
@@ -5224,6 +5224,18 @@ SRST
         The ``share`` boolean option is on by default with memfd.
 +    ``-object iommufd,id=id[,fd=fd]``
 +        Creates an iommufd backend which allows control of DMA mapping
 +        through the ``/dev/iommu`` device.
 +
 +        The ``id`` parameter is a unique ID which frontends (such as
 +        vfio-pci of vdpa) will use to connect with the iommufd backend.
 +
 +        The ``fd`` parameter is an optional pre-opened file descriptor
 +        resulting from ``/dev/iommu`` opening. Usually the iommufd is shared
 +        across all subsystems, bringing the benefit of centralized
 +        reference counting.
 +
     ``-object rng-builtin,id=id``
         Creates a random number generator backend which obtains entropy
         from QEMU builtin functions. The ``id`` parameter is a unique ID
 -- 
 2.39.3
--- a/SOURCES/kvm-backends-iommufd-Remove-check-on-number-of-backend-u.patch
+++ b/SOURCES/kvm-backends-iommufd-Remove-check-on-number-of-backend-u.patch
@ -1,47 +0,0 @@
 From da9a24793e876f6f2727d57f939d882be26a47b8 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
 Date: Fri, 22 Dec 2023 08:55:23 +0100
 Subject: [PATCH 064/101] backends/iommufd: Remove check on number of backend
 users
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Eric Auger <eric.auger@redhat.com>
 RH-MergeRequest: 211: IOMMUFD backend backport
 RH-Jira: RHEL-19302 RHEL-21057
 RH-Acked-by: Cédric Le Goater <clg@redhat.com>
 RH-Acked-by: Sebastian Ott <sebott@redhat.com>
 RH-Commit: [63/67] ac4d4589d1f2de5ac3f0adfd8d1f27dbf6bbfdee (eauger1/centos-qemu-kvm)
 QOM already has a ref count on objects and it will assert much
 earlier, when INT_MAX is reached.
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
 Signed-off-by: Cédric Le Goater <clg@redhat.com>
 (cherry picked from commit c2ab3a6f7411c895e538e8350fee8948ac07c1a0)
 Signed-off-by: Eric Auger <eric.auger@redhat.com>
 ---
 backends/iommufd.c | 5 -----
 1 file changed, 5 deletions(-)
 diff --git a/backends/iommufd.c b/backends/iommufd.c
 index ba58a0eb0d..393c0d9a37 100644
 --- a/backends/iommufd.c
 +++ b/backends/iommufd.c
@@ -80,11 +80,6 @@ int iommufd_backend_connect(IOMMUFDBackend *be, Error **errp)
     int fd, ret = 0;
     qemu_mutex_lock(&be->lock);
 -    if (be->users == UINT32_MAX) {
 -        error_setg(errp, "too many connections");
 -        ret = -E2BIG;
 -        goto out;
 -    }
     if (be->owned && !be->users) {
         fd = qemu_open_old("/dev/iommu", O_RDWR);
         if (fd < 0) {
 -- 
 2.39.3
--- a/SOURCES/kvm-backends-iommufd-Remove-mutex.patch
+++ b/SOURCES/kvm-backends-iommufd-Remove-mutex.patch
@ -1,112 +0,0 @@
 From 92aff3cc1a412de01e9563802fa48848eae5283f Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
 Date: Thu, 21 Dec 2023 16:58:41 +0100
 Subject: [PATCH 065/101] backends/iommufd: Remove mutex
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Eric Auger <eric.auger@redhat.com>
 RH-MergeRequest: 211: IOMMUFD backend backport
 RH-Jira: RHEL-19302 RHEL-21057
 RH-Acked-by: Cédric Le Goater <clg@redhat.com>
 RH-Acked-by: Sebastian Ott <sebott@redhat.com>
 RH-Commit: [64/67] 65518432b18f18ceadafe1b0698cdaa962e84f61 (eauger1/centos-qemu-kvm)
 Coverity reports a concurrent data access violation because be->users
 is being accessed in iommufd_backend_can_be_deleted() without holding
 the mutex.
 However, these routines are called from the QEMU main thread when a
 device is created. In this case, the code paths should be protected by
 the BQL lock and it should be safe to drop the IOMMUFD backend mutex.
 Simply remove it.
 Fixes: CID 1531550
 Fixes: CID 1531549
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
 Signed-off-by: Cédric Le Goater <clg@redhat.com>
 (cherry picked from commit 19368b1905b4b917e915526fcbd5bfa3f7439451)
 Signed-off-by: Eric Auger <eric.auger@redhat.com>
 ---
 backends/iommufd.c       | 7 -------
 include/sysemu/iommufd.h | 2 --
 2 files changed, 9 deletions(-)
 diff --git a/backends/iommufd.c b/backends/iommufd.c
 index 393c0d9a37..1ef683c7b0 100644
 --- a/backends/iommufd.c
 +++ b/backends/iommufd.c
@@ -29,7 +29,6 @@ static void iommufd_backend_init(Object *obj)
     be->fd = -1;
     be->users = 0;
     be->owned = true;
 -    qemu_mutex_init(&be->lock);
 }
 static void iommufd_backend_finalize(Object *obj)
@@ -52,10 +51,8 @@ static void iommufd_backend_set_fd(Object *obj, const char *str, Error **errp)
         error_prepend(errp, "Could not parse remote object fd %s:", str);
         return;
     }
 -    qemu_mutex_lock(&be->lock);
     be->fd = fd;
     be->owned = false;
 -    qemu_mutex_unlock(&be->lock);
     trace_iommu_backend_set_fd(be->fd);
 }
@@ -79,7 +76,6 @@ int iommufd_backend_connect(IOMMUFDBackend *be, Error **errp)
 {
     int fd, ret = 0;
 -    qemu_mutex_lock(&be->lock);
     if (be->owned && !be->users) {
         fd = qemu_open_old("/dev/iommu", O_RDWR);
         if (fd < 0) {
@@ -93,13 +89,11 @@ int iommufd_backend_connect(IOMMUFDBackend *be, Error **errp)
 out:
     trace_iommufd_backend_connect(be->fd, be->owned,
                                   be->users, ret);
 -    qemu_mutex_unlock(&be->lock);
     return ret;
 }
 void iommufd_backend_disconnect(IOMMUFDBackend *be)
 {
 -    qemu_mutex_lock(&be->lock);
     if (!be->users) {
         goto out;
     }
@@ -110,7 +104,6 @@ void iommufd_backend_disconnect(IOMMUFDBackend *be)
     }
 out:
     trace_iommufd_backend_disconnect(be->fd, be->users);
 -    qemu_mutex_unlock(&be->lock);
 }
 int iommufd_backend_alloc_ioas(IOMMUFDBackend *be, uint32_t *ioas_id,
 diff --git a/include/sysemu/iommufd.h b/include/sysemu/iommufd.h
 index 9c5524b0ed..9af27ebd6c 100644
 --- a/include/sysemu/iommufd.h
 +++ b/include/sysemu/iommufd.h
@@ -2,7 +2,6 @@
 #define SYSEMU_IOMMUFD_H
 #include "qom/object.h"
 -#include "qemu/thread.h"
 #include "exec/hwaddr.h"
 #include "exec/cpu-common.h"
@@ -19,7 +18,6 @@ struct IOMMUFDBackend {
     /*< protected >*/
     int fd;            /* /dev/iommu file descriptor */
     bool owned;        /* is the /dev/iommu opened internally */
 -    QemuMutex lock;
     uint32_t users;
     /*< public >*/
 -- 
 2.39.3
--- a/SOURCES/kvm-bcm2835_property-disable-reentrancy-detection-for-io.patch
+++ b/SOURCES/kvm-bcm2835_property-disable-reentrancy-detection-for-io.patch
@ -0,0 +1,58 @@
 From 7715635d018351e0a5c4c25aec2c71a2fe3b9e69 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Tue, 9 May 2023 10:29:03 -0400
 Subject: [PATCH 06/15] bcm2835_property: disable reentrancy detection for
 iomem
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 277: memory: prevent dma-reentracy issues
 RH-Bugzilla: 1999236
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [6/12] 4d6187430ca1c4309a36824c0c6815d2a763db1a (redhat/rhel/src/qemu-kvm/jons-qemu-kvm-2)
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1999236
 Upstream: Merged
 CVE: CVE-2021-3750
 commit 985c4a4e547afb9573b6bd6843d20eb2c3d1d1cd
 Author: Alexander Bulekov <alxndr@bu.edu>
 Date:   Thu Apr 27 17:10:11 2023 -0400
    bcm2835_property: disable reentrancy detection for iomem
    As the code is designed for re-entrant calls from bcm2835_property to
    bcm2835_mbox and back into bcm2835_property, mark iomem as
    reentrancy-safe.
    Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
    Reviewed-by: Thomas Huth <thuth@redhat.com>
    Message-Id: <20230427211013.2994127-7-alxndr@bu.edu>
    Signed-off-by: Thomas Huth <thuth@redhat.com>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 hw/misc/bcm2835_property.c | 7 +++++++
 1 file changed, 7 insertions(+)
 diff --git a/hw/misc/bcm2835_property.c b/hw/misc/bcm2835_property.c
 index 73941bdae9..022b5a849c 100644
 --- a/hw/misc/bcm2835_property.c
 +++ b/hw/misc/bcm2835_property.c
@@ -377,6 +377,13 @@ static void bcm2835_property_init(Object *obj)
     memory_region_init_io(&s->iomem, OBJECT(s), &bcm2835_property_ops, s,
                           TYPE_BCM2835_PROPERTY, 0x10);
 +
 +    /*
 +     * bcm2835_property_ops call into bcm2835_mbox, which in-turn reads from
 +     * iomem. As such, mark iomem as re-entracy safe.
 +     */
 +    s->iomem.disable_reentrancy_guard = true;
 +
     sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
     sysbus_init_irq(SYS_BUS_DEVICE(s), &s->mbox_irq);
 }
 -- 
 2.37.3
--- a/SOURCES/kvm-block-Collapse-padded-I-O-vecs-exceeding-IOV_MAX.patch
+++ b/SOURCES/kvm-block-Collapse-padded-I-O-vecs-exceeding-IOV_MAX.patch
@ -0,0 +1,359 @@
 From 1f7520baa6f0bf02ccba2ebfe7d1d5bf6520f95a Mon Sep 17 00:00:00 2001
 From: Hanna Czenczek <hreitz@redhat.com>
 Date: Tue, 11 Apr 2023 19:34:16 +0200
 Subject: [PATCH 2/5] block: Collapse padded I/O vecs exceeding IOV_MAX
 RH-Author: Hanna Czenczek <hreitz@redhat.com>
 RH-MergeRequest: 291: block: Split padded I/O vectors exceeding IOV_MAX
 RH-Bugzilla: 2141964
 RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Commit: [2/5] 1d86ce8398e4ab66e308a686f9855c963e52b0a9
 When processing vectored guest requests that are not aligned to the
 storage request alignment, we pad them by adding head and/or tail
 buffers for a read-modify-write cycle.
 The guest can submit I/O vectors up to IOV_MAX (1024) in length, but
 with this padding, the vector can exceed that limit.  As of
 4c002cef0e9abe7135d7916c51abce47f7fc1ee2 ("util/iov: make
 qemu_iovec_init_extended() honest"), we refuse to pad vectors beyond the
 limit, instead returning an error to the guest.
 To the guest, this appears as a random I/O error.  We should not return
 an I/O error to the guest when it issued a perfectly valid request.
 Before 4c002cef0e9abe7135d7916c51abce47f7fc1ee2, we just made the vector
 longer than IOV_MAX, which generally seems to work (because the guest
 assumes a smaller alignment than we really have, file-posix's
 raw_co_prw() will generally see bdrv_qiov_is_aligned() return false, and
 so emulate the request, so that the IOV_MAX does not matter).  However,
 that does not seem exactly great.
 I see two ways to fix this problem:
 1. We split such long requests into two requests.
 2. We join some elements of the vector into new buffers to make it
   shorter.
 I am wary of (1), because it seems like it may have unintended side
 effects.
 (2) on the other hand seems relatively simple to implement, with
 hopefully few side effects, so this patch does that.
 To do this, the use of qemu_iovec_init_extended() in bdrv_pad_request()
 is effectively replaced by the new function bdrv_create_padded_qiov(),
 which not only wraps the request IOV with padding head/tail, but also
 ensures that the resulting vector will not have more than IOV_MAX
 elements.  Putting that functionality into qemu_iovec_init_extended() is
 infeasible because it requires allocating a bounce buffer; doing so
 would require many more parameters (buffer alignment, how to initialize
 the buffer, and out parameters like the buffer, its length, and the
 original elements), which is not reasonable.
 Conversely, it is not difficult to move qemu_iovec_init_extended()'s
 functionality into bdrv_create_padded_qiov() by using public
 qemu_iovec_* functions, so that is what this patch does.
 Because bdrv_pad_request() was the only "serious" user of
 qemu_iovec_init_extended(), the next patch will remove the latter
 function, so the functionality is not implemented twice.
 Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2141964
 Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 Message-Id: <20230411173418.19549-3-hreitz@redhat.com>
 Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
 (cherry picked from commit 18743311b829cafc1737a5f20bc3248d5f91ee2a)
 Conflicts:
 	block/io.c: Downstream bdrv_pad_request() has no @flags
        parameter.
 Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 ---
 block/io.c | 166 ++++++++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 151 insertions(+), 15 deletions(-)
 diff --git a/block/io.c b/block/io.c
 index c3e7301613..0fe8f0dd40 100644
 --- a/block/io.c
 +++ b/block/io.c
@@ -1624,6 +1624,14 @@ out:
  * @merge_reads is true for small requests,
  * if @buf_len == @head + bytes + @tail. In this case it is possible that both
  * head and tail exist but @buf_len == align and @tail_buf == @buf.
 + *
 + * @write is true for write requests, false for read requests.
 + *
 + * If padding makes the vector too long (exceeding IOV_MAX), then we need to
 + * merge existing vector elements into a single one.  @collapse_bounce_buf acts
 + * as the bounce buffer in such cases.  @pre_collapse_qiov has the pre-collapse
 + * I/O vector elements so for read requests, the data can be copied back after
 + * the read is done.
  */
 typedef struct BdrvRequestPadding {
     uint8_t *buf;
@@ -1632,11 +1640,17 @@ typedef struct BdrvRequestPadding {
     size_t head;
     size_t tail;
     bool merge_reads;
 +    bool write;
     QEMUIOVector local_qiov;
 +
 +    uint8_t *collapse_bounce_buf;
 +    size_t collapse_len;
 +    QEMUIOVector pre_collapse_qiov;
 } BdrvRequestPadding;
 static bool bdrv_init_padding(BlockDriverState *bs,
                               int64_t offset, int64_t bytes,
 +                              bool write,
                               BdrvRequestPadding *pad)
 {
     int64_t align = bs->bl.request_alignment;
@@ -1668,6 +1682,8 @@ static bool bdrv_init_padding(BlockDriverState *bs,
         pad->tail_buf = pad->buf + pad->buf_len - align;
     }
 +    pad->write = write;
 +
     return true;
 }
@@ -1733,8 +1749,23 @@ zero_mem:
     return 0;
 }
 -static void bdrv_padding_destroy(BdrvRequestPadding *pad)
 +/**
 + * Free *pad's associated buffers, and perform any necessary finalization steps.
 + */
 +static void bdrv_padding_finalize(BdrvRequestPadding *pad)
 {
 +    if (pad->collapse_bounce_buf) {
 +        if (!pad->write) {
 +            /*
 +             * If padding required elements in the vector to be collapsed into a
 +             * bounce buffer, copy the bounce buffer content back
 +             */
 +            qemu_iovec_from_buf(&pad->pre_collapse_qiov, 0,
 +                                pad->collapse_bounce_buf, pad->collapse_len);
 +        }
 +        qemu_vfree(pad->collapse_bounce_buf);
 +        qemu_iovec_destroy(&pad->pre_collapse_qiov);
 +    }
     if (pad->buf) {
         qemu_vfree(pad->buf);
         qemu_iovec_destroy(&pad->local_qiov);
@@ -1742,6 +1773,101 @@ static void bdrv_padding_destroy(BdrvRequestPadding *pad)
     memset(pad, 0, sizeof(*pad));
 }
 +/*
 + * Create pad->local_qiov by wrapping @iov in the padding head and tail, while
 + * ensuring that the resulting vector will not exceed IOV_MAX elements.
 + *
 + * To ensure this, when necessary, the first two or three elements of @iov are
 + * merged into pad->collapse_bounce_buf and replaced by a reference to that
 + * bounce buffer in pad->local_qiov.
 + *
 + * After performing a read request, the data from the bounce buffer must be
 + * copied back into pad->pre_collapse_qiov (e.g. by bdrv_padding_finalize()).
 + */
 +static int bdrv_create_padded_qiov(BlockDriverState *bs,
 +                                   BdrvRequestPadding *pad,
 +                                   struct iovec *iov, int niov,
 +                                   size_t iov_offset, size_t bytes)
 +{
 +    int padded_niov, surplus_count, collapse_count;
 +
 +    /* Assert this invariant */
 +    assert(niov <= IOV_MAX);
 +
 +    /*
 +     * Cannot pad if resulting length would exceed SIZE_MAX.  Returning an error
 +     * to the guest is not ideal, but there is little else we can do.  At least
 +     * this will practically never happen on 64-bit systems.
 +     */
 +    if (SIZE_MAX - pad->head < bytes ||
 +        SIZE_MAX - pad->head - bytes < pad->tail)
 +    {
 +        return -EINVAL;
 +    }
 +
 +    /* Length of the resulting IOV if we just concatenated everything */
 +    padded_niov = !!pad->head + niov + !!pad->tail;
 +
 +    qemu_iovec_init(&pad->local_qiov, MIN(padded_niov, IOV_MAX));
 +
 +    if (pad->head) {
 +        qemu_iovec_add(&pad->local_qiov, pad->buf, pad->head);
 +    }
 +
 +    /*
 +     * If padded_niov > IOV_MAX, we cannot just concatenate everything.
 +     * Instead, merge the first two or three elements of @iov to reduce the
 +     * number of vector elements as necessary.
 +     */
 +    if (padded_niov > IOV_MAX) {
 +        /*
 +         * Only head and tail can have lead to the number of entries exceeding
 +         * IOV_MAX, so we can exceed it by the head and tail at most.  We need
 +         * to reduce the number of elements by `surplus_count`, so we merge that
 +         * many elements plus one into one element.
 +         */
 +        surplus_count = padded_niov - IOV_MAX;
 +        assert(surplus_count <= !!pad->head + !!pad->tail);
 +        collapse_count = surplus_count + 1;
 +
 +        /*
 +         * Move the elements to collapse into `pad->pre_collapse_qiov`, then
 +         * advance `iov` (and associated variables) by those elements.
 +         */
 +        qemu_iovec_init(&pad->pre_collapse_qiov, collapse_count);
 +        qemu_iovec_concat_iov(&pad->pre_collapse_qiov, iov,
 +                              collapse_count, iov_offset, SIZE_MAX);
 +        iov += collapse_count;
 +        iov_offset = 0;
 +        niov -= collapse_count;
 +        bytes -= pad->pre_collapse_qiov.size;
 +
 +        /*
 +         * Construct the bounce buffer to match the length of the to-collapse
 +         * vector elements, and for write requests, initialize it with the data
 +         * from those elements.  Then add it to `pad->local_qiov`.
 +         */
 +        pad->collapse_len = pad->pre_collapse_qiov.size;
 +        pad->collapse_bounce_buf = qemu_blockalign(bs, pad->collapse_len);
 +        if (pad->write) {
 +            qemu_iovec_to_buf(&pad->pre_collapse_qiov, 0,
 +                              pad->collapse_bounce_buf, pad->collapse_len);
 +        }
 +        qemu_iovec_add(&pad->local_qiov,
 +                       pad->collapse_bounce_buf, pad->collapse_len);
 +    }
 +
 +    qemu_iovec_concat_iov(&pad->local_qiov, iov, niov, iov_offset, bytes);
 +
 +    if (pad->tail) {
 +        qemu_iovec_add(&pad->local_qiov,
 +                       pad->buf + pad->buf_len - pad->tail, pad->tail);
 +    }
 +
 +    assert(pad->local_qiov.niov == MIN(padded_niov, IOV_MAX));
 +    return 0;
 +}
 +
 /*
  * bdrv_pad_request
  *
@@ -1749,6 +1875,8 @@ static void bdrv_padding_destroy(BdrvRequestPadding *pad)
  * read of padding, bdrv_padding_rmw_read() should be called separately if
  * needed.
  *
 + * @write is true for write requests, false for read requests.
 + *
  * Request parameters (@qiov, &qiov_offset, &offset, &bytes) are in-out:
  *  - on function start they represent original request
  *  - on failure or when padding is not needed they are unchanged
@@ -1757,25 +1885,33 @@ static void bdrv_padding_destroy(BdrvRequestPadding *pad)
 static int bdrv_pad_request(BlockDriverState *bs,
                             QEMUIOVector **qiov, size_t *qiov_offset,
                             int64_t *offset, int64_t *bytes,
 +                            bool write,
                             BdrvRequestPadding *pad, bool *padded)
 {
     int ret;
 +    struct iovec *sliced_iov;
 +    int sliced_niov;
 +    size_t sliced_head, sliced_tail;
     bdrv_check_qiov_request(*offset, *bytes, *qiov, *qiov_offset, &error_abort);
 -    if (!bdrv_init_padding(bs, *offset, *bytes, pad)) {
 +    if (!bdrv_init_padding(bs, *offset, *bytes, write, pad)) {
         if (padded) {
             *padded = false;
         }
         return 0;
     }
 -    ret = qemu_iovec_init_extended(&pad->local_qiov, pad->buf, pad->head,
 -                                   *qiov, *qiov_offset, *bytes,
 -                                   pad->buf + pad->buf_len - pad->tail,
 -                                   pad->tail);
 +    sliced_iov = qemu_iovec_slice(*qiov, *qiov_offset, *bytes,
 +                                  &sliced_head, &sliced_tail,
 +                                  &sliced_niov);
 +
 +    /* Guaranteed by bdrv_check_qiov_request() */
 +    assert(*bytes <= SIZE_MAX);
 +    ret = bdrv_create_padded_qiov(bs, pad, sliced_iov, sliced_niov,
 +                                  sliced_head, *bytes);
     if (ret < 0) {
 -        bdrv_padding_destroy(pad);
 +        bdrv_padding_finalize(pad);
         return ret;
     }
     *bytes += pad->head + pad->tail;
@@ -1836,8 +1972,8 @@ int coroutine_fn bdrv_co_preadv_part(BdrvChild *child,
         flags |= BDRV_REQ_COPY_ON_READ;
     }
 -    ret = bdrv_pad_request(bs, &qiov, &qiov_offset, &offset, &bytes, &pad,
 -                           NULL);
 +    ret = bdrv_pad_request(bs, &qiov, &qiov_offset, &offset, &bytes, false,
 +                           &pad, NULL);
     if (ret < 0) {
         goto fail;
     }
@@ -1847,7 +1983,7 @@ int coroutine_fn bdrv_co_preadv_part(BdrvChild *child,
                               bs->bl.request_alignment,
                               qiov, qiov_offset, flags);
     tracked_request_end(&req);
 -    bdrv_padding_destroy(&pad);
 +    bdrv_padding_finalize(&pad);
 fail:
     bdrv_dec_in_flight(bs);
@@ -2167,7 +2303,7 @@ static int coroutine_fn bdrv_co_do_zero_pwritev(BdrvChild *child,
     bool padding;
     BdrvRequestPadding pad;
 -    padding = bdrv_init_padding(bs, offset, bytes, &pad);
 +    padding = bdrv_init_padding(bs, offset, bytes, true, &pad);
     if (padding) {
         bdrv_make_request_serialising(req, align);
@@ -2214,7 +2350,7 @@ static int coroutine_fn bdrv_co_do_zero_pwritev(BdrvChild *child,
     }
 out:
 -    bdrv_padding_destroy(&pad);
 +    bdrv_padding_finalize(&pad);
     return ret;
 }
@@ -2280,8 +2416,8 @@ int coroutine_fn bdrv_co_pwritev_part(BdrvChild *child,
          * bdrv_co_do_zero_pwritev() does aligning by itself, so, we do
          * alignment only if there is no ZERO flag.
          */
 -        ret = bdrv_pad_request(bs, &qiov, &qiov_offset, &offset, &bytes, &pad,
 -                               &padded);
 +        ret = bdrv_pad_request(bs, &qiov, &qiov_offset, &offset, &bytes, true,
 +                               &pad, &padded);
         if (ret < 0) {
             return ret;
         }
@@ -2310,7 +2446,7 @@ int coroutine_fn bdrv_co_pwritev_part(BdrvChild *child,
     ret = bdrv_aligned_pwritev(child, &req, offset, bytes, align,
                                qiov, qiov_offset, flags);
 -    bdrv_padding_destroy(&pad);
 +    bdrv_padding_finalize(&pad);
 out:
     tracked_request_end(&req);
 -- 
 2.39.3
--- a/SOURCES/kvm-block-Fix-pad_request-s-request-restriction.patch
+++ b/SOURCES/kvm-block-Fix-pad_request-s-request-restriction.patch
@ -0,0 +1,75 @@
 From b9866279996ee065cb524bf30bc70e22efbab303 Mon Sep 17 00:00:00 2001
 From: Hanna Czenczek <hreitz@redhat.com>
 Date: Fri, 14 Jul 2023 10:59:38 +0200
 Subject: [PATCH 5/5] block: Fix pad_request's request restriction
 RH-Author: Hanna Czenczek <hreitz@redhat.com>
 RH-MergeRequest: 291: block: Split padded I/O vectors exceeding IOV_MAX
 RH-Bugzilla: 2141964
 RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Commit: [5/5] f9188bd089d6c67185ea1accde20d491a2ed3193
 bdrv_pad_request() relies on requests' lengths not to exceed SIZE_MAX,
 which bdrv_check_qiov_request() does not guarantee.
 bdrv_check_request32() however will guarantee this, and both of
 bdrv_pad_request()'s callers (bdrv_co_preadv_part() and
 bdrv_co_pwritev_part()) already run it before calling
 bdrv_pad_request().  Therefore, bdrv_pad_request() can safely call
 bdrv_check_request32() without expecting error, too.
 In effect, this patch will not change guest-visible behavior.  It is a
 clean-up to tighten a condition to match what is guaranteed by our
 callers, and which exists purely to show clearly why the subsequent
 assertion (`assert(*bytes <= SIZE_MAX)`) is always true.
 Note there is a difference between the interfaces of
 bdrv_check_qiov_request() and bdrv_check_request32(): The former takes
 an errp, the latter does not, so we can no longer just pass
 &error_abort.  Instead, we need to check the returned value.  While we
 do expect success (because the callers have already run this function),
 an assert(ret == 0) is not much simpler than just to return an error if
 it occurs, so let us handle errors by returning them up the stack now.
 Reported-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 Message-id: 20230714085938.202730-1-hreitz@redhat.com
 Fixes: 18743311b829cafc1737a5f20bc3248d5f91ee2a
       ("block: Collapse padded I/O vecs exceeding IOV_MAX")
 Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 ---
 block/io.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)
 diff --git a/block/io.c b/block/io.c
 index 0fe8f0dd40..8ae57728a6 100644
 --- a/block/io.c
 +++ b/block/io.c
@@ -1893,7 +1893,11 @@ static int bdrv_pad_request(BlockDriverState *bs,
     int sliced_niov;
     size_t sliced_head, sliced_tail;
 -    bdrv_check_qiov_request(*offset, *bytes, *qiov, *qiov_offset, &error_abort);
 +    /* Should have been checked by the caller already */
 +    ret = bdrv_check_request32(*offset, *bytes, *qiov, *qiov_offset);
 +    if (ret < 0) {
 +        return ret;
 +    }
     if (!bdrv_init_padding(bs, *offset, *bytes, write, pad)) {
         if (padded) {
@@ -1906,7 +1910,7 @@ static int bdrv_pad_request(BlockDriverState *bs,
                                   &sliced_head, &sliced_tail,
                                   &sliced_niov);
 -    /* Guaranteed by bdrv_check_qiov_request() */
 +    /* Guaranteed by bdrv_check_request32() */
     assert(*bytes <= SIZE_MAX);
     ret = bdrv_create_padded_qiov(bs, pad, sliced_iov, sliced_niov,
                                   sliced_head, *bytes);
 -- 
 2.39.3
--- a/SOURCES/kvm-block-Lock-AioContext-for-drain_end-in-blockdev-reop.patch
+++ b/SOURCES/kvm-block-Lock-AioContext-for-drain_end-in-blockdev-reop.patch
@ -0,0 +1,63 @@
 From b21fa5ecd9acf2b91839a2915fb4bb39dac4c803 Mon Sep 17 00:00:00 2001
 From: Kevin Wolf <kwolf@redhat.com>
 Date: Thu, 3 Feb 2022 15:05:33 +0100
 Subject: [PATCH 2/5] block: Lock AioContext for drain_end in blockdev-reopen
 RH-Author: Kevin Wolf <kwolf@redhat.com>
 RH-MergeRequest: 142: block: Lock AioContext for drain_end in blockdev-reopen
 RH-Commit: [1/2] 98de3b5987f88ea6b4b503f623d6c4475574e037
 RH-Bugzilla: 2067118
 RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Hanna Reitz <hreitz@redhat.com>
 bdrv_subtree_drained_end() requires the caller to hold the AioContext
 lock for the drained node. Not doing this for nodes outside of the main
 AioContext leads to crashes when AIO_WAIT_WHILE() needs to wait and
 tries to temporarily release the lock.
 Fixes: 3908b7a8994fa5ef7a89aa58cd5a02fc58141592
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2046659
 Reported-by: Qing Wang <qinwang@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 Message-Id: <20220203140534.36522-2-kwolf@redhat.com>
 Reviewed-by: Hanna Reitz <hreitz@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit aba8205be0707b9d108e32254e186ba88107a869)
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
 blockdev.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)
 diff --git a/blockdev.c b/blockdev.c
 index b35072644e..565f6a81fd 100644
 --- a/blockdev.c
 +++ b/blockdev.c
@@ -3562,6 +3562,7 @@ void qmp_blockdev_reopen(BlockdevOptionsList *reopen_list, Error **errp)
 {
     BlockReopenQueue *queue = NULL;
     GSList *drained = NULL;
 +    GSList *p;
     /* Add each one of the BDS that we want to reopen to the queue */
     for (; reopen_list != NULL; reopen_list = reopen_list->next) {
@@ -3611,7 +3612,15 @@ void qmp_blockdev_reopen(BlockdevOptionsList *reopen_list, Error **errp)
 fail:
     bdrv_reopen_queue_free(queue);
 -    g_slist_free_full(drained, (GDestroyNotify) bdrv_subtree_drained_end);
 +    for (p = drained; p; p = p->next) {
 +        BlockDriverState *bs = p->data;
 +        AioContext *ctx = bdrv_get_aio_context(bs);
 +
 +        aio_context_acquire(ctx);
 +        bdrv_subtree_drained_end(bs);
 +        aio_context_release(ctx);
 +    }
 +    g_slist_free(drained);
 }
 void qmp_blockdev_del(const char *node_name, Error **errp)
 -- 
 2.27.0
--- a/SOURCES/kvm-block-Make-bdrv_refresh_limits-non-recursive.patch
+++ b/SOURCES/kvm-block-Make-bdrv_refresh_limits-non-recursive.patch
@ -0,0 +1,78 @@
 From 6348063b91b2370cc27153fd58fd11a6681631f6 Mon Sep 17 00:00:00 2001
 From: Hanna Reitz <hreitz@redhat.com>
 Date: Wed, 16 Feb 2022 11:53:53 +0100
 Subject: [PATCH 22/24] block: Make bdrv_refresh_limits() non-recursive
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Hanna Reitz <hreitz@redhat.com>
 RH-MergeRequest: 189: block: Make bdrv_refresh_limits() non-recursive
 RH-Commit: [1/3] 1a1fe37f8d8f0344dd8639d6cc9d884d1aff9096
 RH-Bugzilla: 2072932
 RH-Acked-by: Eric Blake <eblake@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 bdrv_refresh_limits() recurses down to the node's children.  That does
 not seem necessary: When we refresh limits on some node, and then
 recurse down and were to change one of its children's BlockLimits, then
 that would mean we noticed the changed limits by pure chance.  The fact
 that we refresh the parent's limits has nothing to do with it, so the
 reason for the change probably happened before this point in time, and
 we should have refreshed the limits then.
 Consequently, we should actually propagate block limits changes upwards,
 not downwards.  That is a separate and pre-existing issue, though, and
 so will not be addressed in this patch.
 The problem with recursing is that bdrv_refresh_limits() is not atomic.
 It begins with zeroing BDS.bl, and only then sets proper, valid limits.
 If we do not drain all nodes whose limits are refreshed, then concurrent
 I/O requests can encounter invalid request_alignment values and crash
 qemu.  Therefore, a recursing bdrv_refresh_limits() requires the whole
 subtree to be drained, which is currently not ensured by most callers.
 A non-recursive bdrv_refresh_limits() only requires the node in question
 to not receive I/O requests, and this is done by most callers in some
 way or another:
 - bdrv_open_driver() deals with a new node with no parents yet
 - bdrv_set_file_or_backing_noperm() acts on a drained node
 - bdrv_reopen_commit() acts only on drained nodes
 - bdrv_append() should in theory require the node to be drained; in
  practice most callers just lock the AioContext, which should at least
  be enough to prevent concurrent I/O requests from accessing invalid
  limits
 So we can resolve the bug by making bdrv_refresh_limits() non-recursive.
 Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1879437
 Signed-off-by: Hanna Reitz <hreitz@redhat.com>
 Reviewed-by: Eric Blake <eblake@redhat.com>
 Message-Id: <20220216105355.30729-2-hreitz@redhat.com>
 Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit 4d378bbd831bdd2f6e6adcd4ea5b77b6effaa627)
 Signed-off-by: Hanna Reitz <hreitz@redhat.com>
 ---
 block/io.c | 4 ----
 1 file changed, 4 deletions(-)
 diff --git a/block/io.c b/block/io.c
 index 4e4cb556c5..c3e7301613 100644
 --- a/block/io.c
 +++ b/block/io.c
@@ -189,10 +189,6 @@ void bdrv_refresh_limits(BlockDriverState *bs, Transaction *tran, Error **errp)
     QLIST_FOREACH(c, &bs->children, next) {
         if (c->role & (BDRV_CHILD_DATA | BDRV_CHILD_FILTERED | BDRV_CHILD_COW))
         {
 -            bdrv_refresh_limits(c->bs, tran, errp);
 -            if (*errp) {
 -                return;
 -            }
             bdrv_merge_limits(&bs->bl, &c->bs->bl);
             have_limits = true;
         }
 -- 
 2.35.3
--- a/SOURCES/kvm-block-Parse-filenames-only-when-explicitly-requested.patch
+++ b/SOURCES/kvm-block-Parse-filenames-only-when-explicitly-requested.patch
@ -1,18 +1,27 @@
-From 5c35b7d631e9cdf75512b9e1a0b5d48e8fd768d9 Mon Sep 17 00:00:00 2001
+From c4ba1f1755031a0ac2f600ed8c17e7dcb6b2b857 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Wed, 5 Jun 2024 19:56:51 -0400
-Subject: [PATCH 4/4] block: Parse filenames only when explicitly requested
+Subject: [PATCH 5/5] block: Parse filenames only when explicitly requested
 RH-Author: Jon Maloy <jmaloy@redhat.com>
-RH-MergeRequest: 2: EMBARGOED CVE-2024-4467 for rhel-9.4.z (PRDSC)
+RH-MergeRequest: 5: EMBARGOED CVE-2024-4467 for rhel-8.10.z (PRDSC)
-RH-Jira: https://issues.redhat.com/browse/RHEL-35610
+RH-Jira: RHEL-35616
 RH-CVE: CVE-2024-4467
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Acked-by: Hanna Czenczek <hczenczek@redhat.com>
+RH-Commit: [5/5] a3e197add64fc6950c4ac576e34d833dfae7ee34
 RH-Commit: [4/4] 6f71e6a07bd5a9f8352db920f498f5fa5a2cdbfb
-commit f44c2941d4419e60f16dea3e9adca164e75aa78d (origin/cve-2024-4467-hreitz-rhel-9.5.0)
+Conflicts: - brdv_open_child_common(): bdrv_graph_wrlock/unlock()
             don't exist in this code version. We ignore them.
 	     bdrv_open_inherit(): no_coroutine_fn/GRAPH_UNLOCKED
             doesn't exist. We ignore it.
           - Changes to bdrv_open_file_child() didn't apply cleanly,
             but fixing it is straight-forward.
           - GLOBAL_STATE_CODE() not present in this code. Ignoring it.
           - bdrv_open_file_child(): Need to continue setting of
 	     parent->file.
 commit f44c2941d4419e60f16dea3e9adca164e75aa78d
 Author: Kevin Wolf <kwolf@redhat.com>
 Date:   Thu Apr 25 14:56:02 2024 +0200
@ -50,14 +59,14 @@ Date:   Thu Apr 25 14:56:02 2024 +0200
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
- block.c | 90 ++++++++++++++++++++++++++++++++++++---------------------
+ block.c | 81 +++++++++++++++++++++++++++++++++++++++------------------
- 1 file changed, 57 insertions(+), 33 deletions(-)
+ 1 file changed, 56 insertions(+), 25 deletions(-)
 diff --git a/block.c b/block.c
-index a097772238..8b6aa4a65c 100644
+index 889f878565..ddebf50efa 100644
 --- a/block.c
 +++ b/block.c
-@@ -86,6 +86,7 @@ static BlockDriverState *bdrv_open_inherit(const char *filename,
+@@ -82,6 +82,7 @@ static BlockDriverState *bdrv_open_inherit(const char *filename,
                                            BlockDriverState *parent,
                                            const BdrvChildClass *child_class,
                                            BdrvChildRole child_role,
@ -65,7 +74,7 @@ index a097772238..8b6aa4a65c 100644
                                            Error **errp);
 static bool bdrv_recurse_has_child(BlockDriverState *bs,
-@@ -2035,7 +2036,8 @@ static void parse_json_protocol(QDict *options, const char **pfilename,
+@@ -1926,7 +1927,8 @@ static void parse_json_protocol(QDict *options, const char **pfilename,
  * block driver has been specified explicitly.
  */
 static int bdrv_fill_options(QDict **options, const char *filename,
@ -75,7 +84,7 @@ index a097772238..8b6aa4a65c 100644
 {
     const char *drvname;
     bool protocol = *flags & BDRV_O_PROTOCOL;
-@@ -2077,7 +2079,7 @@ static int bdrv_fill_options(QDict **options, const char *filename,
+@@ -1966,7 +1968,7 @@ static int bdrv_fill_options(QDict **options, const char *filename,
     if (protocol && filename) {
         if (!qdict_haskey(*options, "filename")) {
             qdict_put_str(*options, "filename", filename);
@ -84,7 +93,7 @@ index a097772238..8b6aa4a65c 100644
         } else {
             error_setg(errp, "Can't specify 'file' and 'filename' options at "
                              "the same time");
-@@ -3639,7 +3641,8 @@ int bdrv_open_backing_file(BlockDriverState *bs, QDict *parent_options,
+@@ -3439,7 +3441,8 @@ int bdrv_open_backing_file(BlockDriverState *bs, QDict *parent_options,
     }
     backing_hd = bdrv_open_inherit(backing_filename, reference, options, 0, bs,
@ -94,7 +103,7 @@ index a097772238..8b6aa4a65c 100644
     if (!backing_hd) {
         bs->open_flags |= BDRV_O_NO_BACKING;
         error_prepend(errp, "Could not open backing file: ");
-@@ -3673,7 +3676,8 @@ free_exit:
+@@ -3472,7 +3475,8 @@ free_exit:
 static BlockDriverState *
 bdrv_open_child_bs(const char *filename, QDict *options, const char *bdref_key,
                    BlockDriverState *parent, const BdrvChildClass *child_class,
@ -104,7 +113,7 @@ index a097772238..8b6aa4a65c 100644
 {
     BlockDriverState *bs = NULL;
     QDict *image_options;
-@@ -3704,7 +3708,8 @@ bdrv_open_child_bs(const char *filename, QDict *options, const char *bdref_key,
+@@ -3503,7 +3507,8 @@ bdrv_open_child_bs(const char *filename, QDict *options, const char *bdref_key,
     }
     bs = bdrv_open_inherit(filename, reference, image_options, 0,
@ -114,7 +123,7 @@ index a097772238..8b6aa4a65c 100644
     if (!bs) {
         goto done;
     }
-@@ -3714,6 +3719,33 @@ done:
+@@ -3513,6 +3518,29 @@ done:
     return bs;
 }
@ -129,18 +138,14 @@ index a097772238..8b6aa4a65c 100644
 +    BlockDriverState *bs;
 +    BdrvChild *child;
 +
 +    GLOBAL_STATE_CODE();
 +
 +    bs = bdrv_open_child_bs(filename, options, bdref_key, parent, child_class,
 +                            child_role, allow_none, parse_filename, errp);
 +    if (bs == NULL) {
 +        return NULL;
 +    }
 +
 +    bdrv_graph_wrlock();
 +    child = bdrv_attach_child(parent, bs, bdref_key, child_class, child_role,
 +                              errp);
 +    bdrv_graph_wrunlock();
 +
 +    return child;
 +}
@ -148,14 +153,11 @@ index a097772238..8b6aa4a65c 100644
 /*
  * Opens a disk image whose options are given as BlockdevRef in another block
  * device's options.
-@@ -3737,27 +3769,15 @@ BdrvChild *bdrv_open_child(const char *filename,
+@@ -3534,20 +3562,17 @@ BdrvChild *bdrv_open_child(const char *filename,
                            BdrvChildRole child_role,
                            bool allow_none, Error **errp)
 {
 -    BlockDriverState *bs;
 -    BdrvChild *child;
 -
 -    GLOBAL_STATE_CODE();
 -
 -    bs = bdrv_open_child_bs(filename, options, bdref_key, parent, child_class,
 -                            child_role, allow_none, errp);
@ -163,12 +165,8 @@ index a097772238..8b6aa4a65c 100644
 -        return NULL;
 -    }
 -
-    bdrv_graph_wrlock();
+-    return bdrv_attach_child(parent, bs, bdref_key, child_class, child_role,
 -    child = bdrv_attach_child(parent, bs, bdref_key, child_class, child_role,
 -                             errp);
 -    bdrv_graph_wrunlock();
 -
 -    return child;
 +    return bdrv_open_child_common(filename, options, bdref_key, parent,
 +                                  child_class, child_role, allow_none, false,
 +                                  errp);
@ -179,21 +177,24 @@ index a097772238..8b6aa4a65c 100644
 + * This does mostly the same as bdrv_open_child(), but for opening the primary
 + * child of a node. A notable difference from bdrv_open_child() is that it
 + * enables filename parsing for protocol names (including json:).
-  *
+ *
-  * @parent can move to a different AioContext in this function.
+ * @parent can move to a different AioContext in this function.
  */
-@@ -3772,8 +3792,8 @@ int bdrv_open_file_child(const char *filename,
+ int bdrv_open_file_child(const char *filename,
                          QDict *options, const char *bdref_key,
@@ -3558,8 +3583,9 @@ int bdrv_open_file_child(const char *filename,
     role = parent->drv->is_filter ?
         (BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY) : BDRV_CHILD_IMAGE;
-    if (!bdrv_open_child(filename, options, bdref_key, parent,
+-    parent->file = bdrv_open_child(filename, options, bdref_key, parent,
-                         &child_of_bds, role, false, errp))
+-                                   &child_of_bds, role, false, errp);
-+    if (!bdrv_open_child_common(filename, options, bdref_key, parent,
+    parent->file = bdrv_open_child_common(filename, options, bdref_key, parent,
-+                                &child_of_bds, role, false, true, errp))
+                                          &child_of_bds, role, false, true,
-     {
+                                          errp);
-         return -EINVAL;
+ 
     return parent->file ? 0 : -EINVAL;
 }
-@@ -3818,7 +3838,8 @@ BlockDriverState *bdrv_open_blockdev_ref(BlockdevRef *ref, Error **errp)
+@@ -3599,7 +3625,8 @@ BlockDriverState *bdrv_open_blockdev_ref(BlockdevRef *ref, Error **errp)
     }
@ -203,16 +204,15 @@ index a097772238..8b6aa4a65c 100644
     obj = NULL;
     qobject_unref(obj);
     visit_free(v);
-@@ -3907,7 +3928,7 @@ static BlockDriverState * no_coroutine_fn
+@@ -3690,6 +3717,7 @@ static BlockDriverState *bdrv_open_inherit(const char *filename,
- bdrv_open_inherit(const char *filename, const char *reference, QDict *options,
+                                            BlockDriverState *parent,
-                   int flags, BlockDriverState *parent,
+                                            const BdrvChildClass *child_class,
-                   const BdrvChildClass *child_class, BdrvChildRole child_role,
+                                            BdrvChildRole child_role,
-                  Error **errp)
+                                           bool parse_filename,
-+                  bool parse_filename, Error **errp)
+                                            Error **errp)
 {
     int ret;
-     BlockBackend *file = NULL;
+@@ -3733,9 +3761,11 @@ static BlockDriverState *bdrv_open_inherit(const char *filename,
@@ -3955,9 +3976,11 @@ bdrv_open_inherit(const char *filename, const char *reference, QDict *options,
     }
     /* json: syntax counts as explicit options, as if in the QDict */
@ -227,7 +227,7 @@ index a097772238..8b6aa4a65c 100644
     }
     bs->explicit_options = qdict_clone_shallow(options);
-@@ -3982,7 +4005,8 @@ bdrv_open_inherit(const char *filename, const char *reference, QDict *options,
+@@ -3760,7 +3790,8 @@ static BlockDriverState *bdrv_open_inherit(const char *filename,
                                      parent->open_flags, parent->options);
     }
@ -237,7 +237,7 @@ index a097772238..8b6aa4a65c 100644
     if (ret < 0) {
         goto fail;
     }
-@@ -4051,7 +4075,7 @@ bdrv_open_inherit(const char *filename, const char *reference, QDict *options,
+@@ -3829,7 +3860,7 @@ static BlockDriverState *bdrv_open_inherit(const char *filename,
         file_bs = bdrv_open_child_bs(filename, options, "file", bs,
                                      &child_of_bds, BDRV_CHILD_IMAGE,
@ -246,9 +246,9 @@ index a097772238..8b6aa4a65c 100644
         if (local_err) {
             goto fail;
         }
-@@ -4200,7 +4224,7 @@ BlockDriverState *bdrv_open(const char *filename, const char *reference,
+@@ -3974,7 +4005,7 @@ BlockDriverState *bdrv_open(const char *filename, const char *reference,
-     GLOBAL_STATE_CODE();
+                             QDict *options, int flags, Error **errp)
- 
+ {
     return bdrv_open_inherit(filename, reference, options, flags, NULL,
 -                             NULL, 0, errp);
 +                             NULL, 0, true, errp);
--- a/SOURCES/kvm-block-backend-Allow-concurrent-context-changes.patch
+++ b/SOURCES/kvm-block-backend-Allow-concurrent-context-changes.patch
@ -1,104 +0,0 @@
 From afa842e9fdf6e1d6e5d5785679a22779632142bd Mon Sep 17 00:00:00 2001
 From: Hanna Czenczek <hreitz@redhat.com>
 Date: Fri, 2 Feb 2024 15:47:54 +0100
 Subject: [PATCH 03/22] block-backend: Allow concurrent context changes
 RH-Author: Hanna Czenczek <hreitz@redhat.com>
 RH-MergeRequest: 222: Allow concurrent BlockBackend context changes
 RH-Jira: RHEL-24593
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Commit: [1/2] 9e1b535f60f7afa94a0817dc3e71136e41631c71 (hreitz/qemu-kvm-c-9-s)
 Since AioContext locks have been removed, a BlockBackend's AioContext
 may really change at any time (only exception is that it is often
 confined to a drained section, as noted in this patch).  Therefore,
 blk_get_aio_context() cannot rely on its root node's context always
 matching that of the BlockBackend.
 In practice, whether they match does not matter anymore anyway: Requests
 can be sent to BDSs from any context, so anyone who requests the BB's
 context should have no reason to require the root node to have the same
 context.  Therefore, we can and should remove the assertion to that
 effect.
 In addition, because the context can be set and queried from different
 threads concurrently, it has to be accessed with atomic operations.
 Buglink: https://issues.redhat.com/browse/RHEL-19381
 Suggested-by: Kevin Wolf <kwolf@redhat.com>
 Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 Message-ID: <20240202144755.671354-2-hreitz@redhat.com>
 Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
 Reviewed-by: Kevin Wolf <kwolf@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit ad893672027ffe26db498947d70cde6d4f58a111)
 ---
 block/block-backend.c | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)
 diff --git a/block/block-backend.c b/block/block-backend.c
 index 209eb07528..9c4de79e6b 100644
 --- a/block/block-backend.c
 +++ b/block/block-backend.c
@@ -44,7 +44,7 @@ struct BlockBackend {
     char *name;
     int refcnt;
     BdrvChild *root;
 -    AioContext *ctx;
 +    AioContext *ctx; /* access with atomic operations only */
     DriveInfo *legacy_dinfo;    /* null unless created by drive_new() */
     QTAILQ_ENTRY(BlockBackend) link;         /* for block_backends */
     QTAILQ_ENTRY(BlockBackend) monitor_link; /* for monitor_block_backends */
@@ -2414,22 +2414,22 @@ void blk_op_unblock_all(BlockBackend *blk, Error *reason)
     }
 }
 +/**
 + * Return BB's current AioContext.  Note that this context may change
 + * concurrently at any time, with one exception: If the BB has a root node
 + * attached, its context will only change through bdrv_try_change_aio_context(),
 + * which creates a drained section.  Therefore, incrementing such a BB's
 + * in-flight counter will prevent its context from changing.
 + */
 AioContext *blk_get_aio_context(BlockBackend *blk)
 {
 -    BlockDriverState *bs;
     IO_CODE();
     if (!blk) {
         return qemu_get_aio_context();
     }
 -    bs = blk_bs(blk);
 -    if (bs) {
 -        AioContext *ctx = bdrv_get_aio_context(blk_bs(blk));
 -        assert(ctx == blk->ctx);
 -    }
 -
 -    return blk->ctx;
 +    return qatomic_read(&blk->ctx);
 }
 int blk_set_aio_context(BlockBackend *blk, AioContext *new_context,
@@ -2442,7 +2442,7 @@ int blk_set_aio_context(BlockBackend *blk, AioContext *new_context,
     GLOBAL_STATE_CODE();
     if (!bs) {
 -        blk->ctx = new_context;
 +        qatomic_set(&blk->ctx, new_context);
         return 0;
     }
@@ -2471,7 +2471,7 @@ static void blk_root_set_aio_ctx_commit(void *opaque)
     AioContext *new_context = s->new_ctx;
     ThrottleGroupMember *tgm = &blk->public.throttle_group_member;
 -    blk->ctx = new_context;
 +    qatomic_set(&blk->ctx, new_context);
     if (tgm->throttle_state) {
         throttle_group_detach_aio_context(tgm);
         throttle_group_attach_aio_context(tgm, new_context);
 -- 
 2.39.3
--- a/SOURCES/kvm-block-backend-prevent-dangling-BDS-pointers-across-a.patch
+++ b/SOURCES/kvm-block-backend-prevent-dangling-BDS-pointers-across-a.patch
@ -0,0 +1,129 @@
 From bf4c15a3debbe68b6eb25c52174843470a9c014f Mon Sep 17 00:00:00 2001
 From: Stefan Hajnoczi <stefanha@redhat.com>
 Date: Tue, 11 Jan 2022 15:36:12 +0000
 Subject: [PATCH 3/6] block-backend: prevent dangling BDS pointers across
 aio_poll()
 RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
 RH-MergeRequest: 109: block-backend: prevent dangling BDS pointers across aio_poll()
 RH-Commit: [1/2] da5a59eddff0dc10be7de8e291fa675143d11d73
 RH-Bugzilla: 2021778 2036178
 RH-Acked-by: Hanna Reitz <hreitz@redhat.com>
 RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 The BlockBackend root child can change when aio_poll() is invoked. This
 happens when a temporary filter node is removed upon blockjob
 completion, for example.
 Functions in block/block-backend.c must be aware of this when using a
 blk_bs() pointer across aio_poll() because the BlockDriverState refcnt
 may reach 0, resulting in a stale pointer.
 One example is scsi_device_purge_requests(), which calls blk_drain() to
 wait for in-flight requests to cancel. If the backup blockjob is active,
 then the BlockBackend root child is a temporary filter BDS owned by the
 blockjob. The blockjob can complete during bdrv_drained_begin() and the
 last reference to the BDS is released when the temporary filter node is
 removed. This results in a use-after-free when blk_drain() calls
 bdrv_drained_end(bs) on the dangling pointer.
 Explicitly hold a reference to bs across block APIs that invoke
 aio_poll().
 Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2021778
 Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2036178
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Message-Id: <20220111153613.25453-2-stefanha@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit 1e3552dbd28359d35967b7c28dc86cde1bc29205)
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
 block/block-backend.c | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)
 diff --git a/block/block-backend.c b/block/block-backend.c
 index 12ef80ea17..23e727199b 100644
 --- a/block/block-backend.c
 +++ b/block/block-backend.c
@@ -822,16 +822,22 @@ BlockBackend *blk_by_public(BlockBackendPublic *public)
 void blk_remove_bs(BlockBackend *blk)
 {
     ThrottleGroupMember *tgm = &blk->public.throttle_group_member;
 -    BlockDriverState *bs;
     BdrvChild *root;
     notifier_list_notify(&blk->remove_bs_notifiers, blk);
     if (tgm->throttle_state) {
 -        bs = blk_bs(blk);
 +        BlockDriverState *bs = blk_bs(blk);
 +
 +        /*
 +         * Take a ref in case blk_bs() changes across bdrv_drained_begin(), for
 +         * example, if a temporary filter node is removed by a blockjob.
 +         */
 +        bdrv_ref(bs);
         bdrv_drained_begin(bs);
         throttle_group_detach_aio_context(tgm);
         throttle_group_attach_aio_context(tgm, qemu_get_aio_context());
         bdrv_drained_end(bs);
 +        bdrv_unref(bs);
     }
     blk_update_root_state(blk);
@@ -1705,6 +1711,7 @@ void blk_drain(BlockBackend *blk)
     BlockDriverState *bs = blk_bs(blk);
     if (bs) {
 +        bdrv_ref(bs);
         bdrv_drained_begin(bs);
     }
@@ -1714,6 +1721,7 @@ void blk_drain(BlockBackend *blk)
     if (bs) {
         bdrv_drained_end(bs);
 +        bdrv_unref(bs);
     }
 }
@@ -2044,10 +2052,13 @@ static int blk_do_set_aio_context(BlockBackend *blk, AioContext *new_context,
     int ret;
     if (bs) {
 +        bdrv_ref(bs);
 +
         if (update_root_node) {
             ret = bdrv_child_try_set_aio_context(bs, new_context, blk->root,
                                                  errp);
             if (ret < 0) {
 +                bdrv_unref(bs);
                 return ret;
             }
         }
@@ -2057,6 +2068,8 @@ static int blk_do_set_aio_context(BlockBackend *blk, AioContext *new_context,
             throttle_group_attach_aio_context(tgm, new_context);
             bdrv_drained_end(bs);
         }
 +
 +        bdrv_unref(bs);
     }
     blk->ctx = new_context;
@@ -2326,11 +2339,13 @@ void blk_io_limits_disable(BlockBackend *blk)
     ThrottleGroupMember *tgm = &blk->public.throttle_group_member;
     assert(tgm->throttle_state);
     if (bs) {
 +        bdrv_ref(bs);
         bdrv_drained_begin(bs);
     }
     throttle_group_unregister_tgm(tgm);
     if (bs) {
         bdrv_drained_end(bs);
 +        bdrv_unref(bs);
     }
 }
 -- 
 2.27.0
--- a/SOURCES/kvm-block-coroutine-wrapper-use-qemu_get_current_aio_con.patch
+++ b/SOURCES/kvm-block-coroutine-wrapper-use-qemu_get_current_aio_con.patch
@ -1,69 +0,0 @@
 From b1a68aebadecd7d339cf5eaffeda15099c998528 Mon Sep 17 00:00:00 2001
 From: Stefan Hajnoczi <stefanha@redhat.com>
 Date: Tue, 12 Sep 2023 19:10:37 -0400
 Subject: [PATCH 095/101] block-coroutine-wrapper: use
 qemu_get_current_aio_context()
 RH-Author: Kevin Wolf <kwolf@redhat.com>
 RH-MergeRequest: 214: Remove AioContext lock
 RH-Jira: RHEL-15965
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Commit: [26/26] cde767bcdc626e90721792e3889952057a548ac5 (kmwolf/centos-qemu-kvm)
 Use qemu_get_current_aio_context() in mixed wrappers and coroutine
 wrappers so that code runs in the caller's AioContext instead of moving
 to the BlockDriverState's AioContext. This change is necessary for the
 multi-queue block layer where any thread can call into the block layer.
 Most wrappers are IO_CODE where it's safe to use the current AioContext
 nowadays. BlockDrivers and the core block layer use their own locks and
 no longer depend on the AioContext lock for thread-safety.
 The bdrv_create() wrapper invokes GLOBAL_STATE code. Using the current
 AioContext is safe because this code is only called with the BQL held
 from the main loop thread.
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Message-ID: <20230912231037.826804-6-stefanha@redhat.com>
 Reviewed-by: Eric Blake <eblake@redhat.com>
 Reviewed-by: Kevin Wolf <kwolf@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
 scripts/block-coroutine-wrapper.py | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)
 diff --git a/scripts/block-coroutine-wrapper.py b/scripts/block-coroutine-wrapper.py
 index c9c09fcacd..dbbde99e39 100644
 --- a/scripts/block-coroutine-wrapper.py
 +++ b/scripts/block-coroutine-wrapper.py
@@ -92,8 +92,6 @@ def __init__(self, wrapper_type: str, return_type: str, name: str,
                                  f"{self.name}")
             self.target_name = f'{subsystem}_{subname}'
 -        self.ctx = self.gen_ctx()
 -
         self.get_result = 's->ret = '
         self.ret = 'return s.ret;'
         self.co_ret = 'return '
@@ -167,7 +165,7 @@ def create_mixed_wrapper(func: FuncDecl) -> str:
         {func.co_ret}{name}({ func.gen_list('{name}') });
     }} else {{
         {struct_name} s = {{
 -            .poll_state.ctx = {func.ctx},
 +            .poll_state.ctx = qemu_get_current_aio_context(),
             .poll_state.in_progress = true,
 { func.gen_block('            .{name} = {name},') }
@@ -191,7 +189,7 @@ def create_co_wrapper(func: FuncDecl) -> str:
 {func.return_type} {func.name}({ func.gen_list('{decl}') })
 {{
     {struct_name} s = {{
 -        .poll_state.ctx = {func.ctx},
 +        .poll_state.ctx = qemu_get_current_aio_context(),
         .poll_state.in_progress = true,
 { func.gen_block('        .{name} = {name},') }
 -- 
 2.39.3
--- a/SOURCES/kvm-block-file-posix-set-up-Linux-AIO-and-io_uring-in-th.patch
+++ b/SOURCES/kvm-block-file-posix-set-up-Linux-AIO-and-io_uring-in-th.patch
@ -1,217 +0,0 @@
 From 25cce5df341861e8ba8ec57722558e2dee3ce56a Mon Sep 17 00:00:00 2001
 From: Stefan Hajnoczi <stefanha@redhat.com>
 Date: Thu, 14 Sep 2023 10:00:58 -0400
 Subject: [PATCH 073/101] block/file-posix: set up Linux AIO and io_uring in
 the current thread
 RH-Author: Kevin Wolf <kwolf@redhat.com>
 RH-MergeRequest: 214: Remove AioContext lock
 RH-Jira: RHEL-15965
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Commit: [4/26] 74c7daf805daefe706378308c3afeb28d861164b (kmwolf/centos-qemu-kvm)
 The file-posix block driver currently only sets up Linux AIO and
 io_uring in the BDS's AioContext. In the multi-queue block layer we must
 be able to submit I/O requests in AioContexts that do not have Linux AIO
 and io_uring set up yet since any thread can call into the block driver.
 Set up Linux AIO and io_uring for the current AioContext during request
 submission. We lose the ability to return an error from
 .bdrv_file_open() when Linux AIO and io_uring setup fails (e.g. due to
 resource limits). Instead the user only gets warnings and we fall back
 to aio=threads. This is still better than a fatal error after startup.
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Message-ID: <20230914140101.1065008-2-stefanha@redhat.com>
 Reviewed-by: Kevin Wolf <kwolf@redhat.com>
 Reviewed-by: Eric Blake <eblake@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
 block/file-posix.c | 103 ++++++++++++++++++++++-----------------------
 1 file changed, 51 insertions(+), 52 deletions(-)
 diff --git a/block/file-posix.c b/block/file-posix.c
 index b862406c71..35684f7e21 100644
 --- a/block/file-posix.c
 +++ b/block/file-posix.c
@@ -712,17 +712,11 @@ static int raw_open_common(BlockDriverState *bs, QDict *options,
 #ifdef CONFIG_LINUX_AIO
      /* Currently Linux does AIO only for files opened with O_DIRECT */
 -    if (s->use_linux_aio) {
 -        if (!(s->open_flags & O_DIRECT)) {
 -            error_setg(errp, "aio=native was specified, but it requires "
 -                             "cache.direct=on, which was not specified.");
 -            ret = -EINVAL;
 -            goto fail;
 -        }
 -        if (!aio_setup_linux_aio(bdrv_get_aio_context(bs), errp)) {
 -            error_prepend(errp, "Unable to use native AIO: ");
 -            goto fail;
 -        }
 +    if (s->use_linux_aio && !(s->open_flags & O_DIRECT)) {
 +        error_setg(errp, "aio=native was specified, but it requires "
 +                         "cache.direct=on, which was not specified.");
 +        ret = -EINVAL;
 +        goto fail;
     }
 #else
     if (s->use_linux_aio) {
@@ -733,14 +727,7 @@ static int raw_open_common(BlockDriverState *bs, QDict *options,
     }
 #endif /* !defined(CONFIG_LINUX_AIO) */
 -#ifdef CONFIG_LINUX_IO_URING
 -    if (s->use_linux_io_uring) {
 -        if (!aio_setup_linux_io_uring(bdrv_get_aio_context(bs), errp)) {
 -            error_prepend(errp, "Unable to use io_uring: ");
 -            goto fail;
 -        }
 -    }
 -#else
 +#ifndef CONFIG_LINUX_IO_URING
     if (s->use_linux_io_uring) {
         error_setg(errp, "aio=io_uring was specified, but is not supported "
                          "in this build.");
@@ -2444,6 +2431,48 @@ static bool bdrv_qiov_is_aligned(BlockDriverState *bs, QEMUIOVector *qiov)
     return true;
 }
 +#ifdef CONFIG_LINUX_IO_URING
 +static inline bool raw_check_linux_io_uring(BDRVRawState *s)
 +{
 +    Error *local_err = NULL;
 +    AioContext *ctx;
 +
 +    if (!s->use_linux_io_uring) {
 +        return false;
 +    }
 +
 +    ctx = qemu_get_current_aio_context();
 +    if (unlikely(!aio_setup_linux_io_uring(ctx, &local_err))) {
 +        error_reportf_err(local_err, "Unable to use linux io_uring, "
 +                                     "falling back to thread pool: ");
 +        s->use_linux_io_uring = false;
 +        return false;
 +    }
 +    return true;
 +}
 +#endif
 +
 +#ifdef CONFIG_LINUX_AIO
 +static inline bool raw_check_linux_aio(BDRVRawState *s)
 +{
 +    Error *local_err = NULL;
 +    AioContext *ctx;
 +
 +    if (!s->use_linux_aio) {
 +        return false;
 +    }
 +
 +    ctx = qemu_get_current_aio_context();
 +    if (unlikely(!aio_setup_linux_aio(ctx, &local_err))) {
 +        error_reportf_err(local_err, "Unable to use Linux AIO, "
 +                                     "falling back to thread pool: ");
 +        s->use_linux_aio = false;
 +        return false;
 +    }
 +    return true;
 +}
 +#endif
 +
 static int coroutine_fn raw_co_prw(BlockDriverState *bs, int64_t *offset_ptr,
                                    uint64_t bytes, QEMUIOVector *qiov, int type)
 {
@@ -2474,13 +2503,13 @@ static int coroutine_fn raw_co_prw(BlockDriverState *bs, int64_t *offset_ptr,
     if (s->needs_alignment && !bdrv_qiov_is_aligned(bs, qiov)) {
         type |= QEMU_AIO_MISALIGNED;
 #ifdef CONFIG_LINUX_IO_URING
 -    } else if (s->use_linux_io_uring) {
 +    } else if (raw_check_linux_io_uring(s)) {
         assert(qiov->size == bytes);
         ret = luring_co_submit(bs, s->fd, offset, qiov, type);
         goto out;
 #endif
 #ifdef CONFIG_LINUX_AIO
 -    } else if (s->use_linux_aio) {
 +    } else if (raw_check_linux_aio(s)) {
         assert(qiov->size == bytes);
         ret = laio_co_submit(s->fd, offset, qiov, type,
                               s->aio_max_batch);
@@ -2567,39 +2596,13 @@ static int coroutine_fn raw_co_flush_to_disk(BlockDriverState *bs)
     };
 #ifdef CONFIG_LINUX_IO_URING
 -    if (s->use_linux_io_uring) {
 +    if (raw_check_linux_io_uring(s)) {
         return luring_co_submit(bs, s->fd, 0, NULL, QEMU_AIO_FLUSH);
     }
 #endif
     return raw_thread_pool_submit(handle_aiocb_flush, &acb);
 }
 -static void raw_aio_attach_aio_context(BlockDriverState *bs,
 -                                       AioContext *new_context)
 -{
 -    BDRVRawState __attribute__((unused)) *s = bs->opaque;
 -#ifdef CONFIG_LINUX_AIO
 -    if (s->use_linux_aio) {
 -        Error *local_err = NULL;
 -        if (!aio_setup_linux_aio(new_context, &local_err)) {
 -            error_reportf_err(local_err, "Unable to use native AIO, "
 -                                         "falling back to thread pool: ");
 -            s->use_linux_aio = false;
 -        }
 -    }
 -#endif
 -#ifdef CONFIG_LINUX_IO_URING
 -    if (s->use_linux_io_uring) {
 -        Error *local_err = NULL;
 -        if (!aio_setup_linux_io_uring(new_context, &local_err)) {
 -            error_reportf_err(local_err, "Unable to use linux io_uring, "
 -                                         "falling back to thread pool: ");
 -            s->use_linux_io_uring = false;
 -        }
 -    }
 -#endif
 -}
 -
 static void raw_close(BlockDriverState *bs)
 {
     BDRVRawState *s = bs->opaque;
@@ -3896,7 +3899,6 @@ BlockDriver bdrv_file = {
     .bdrv_co_copy_range_from = raw_co_copy_range_from,
     .bdrv_co_copy_range_to  = raw_co_copy_range_to,
     .bdrv_refresh_limits = raw_refresh_limits,
 -    .bdrv_attach_aio_context = raw_aio_attach_aio_context,
     .bdrv_co_truncate                   = raw_co_truncate,
     .bdrv_co_getlength                  = raw_co_getlength,
@@ -4266,7 +4268,6 @@ static BlockDriver bdrv_host_device = {
     .bdrv_co_copy_range_from = raw_co_copy_range_from,
     .bdrv_co_copy_range_to  = raw_co_copy_range_to,
     .bdrv_refresh_limits = raw_refresh_limits,
 -    .bdrv_attach_aio_context = raw_aio_attach_aio_context,
     .bdrv_co_truncate                   = raw_co_truncate,
     .bdrv_co_getlength                  = raw_co_getlength,
@@ -4402,7 +4403,6 @@ static BlockDriver bdrv_host_cdrom = {
     .bdrv_co_pwritev        = raw_co_pwritev,
     .bdrv_co_flush_to_disk  = raw_co_flush_to_disk,
     .bdrv_refresh_limits    = cdrom_refresh_limits,
 -    .bdrv_attach_aio_context = raw_aio_attach_aio_context,
     .bdrv_co_truncate                   = raw_co_truncate,
     .bdrv_co_getlength                  = raw_co_getlength,
@@ -4528,7 +4528,6 @@ static BlockDriver bdrv_host_cdrom = {
     .bdrv_co_pwritev        = raw_co_pwritev,
     .bdrv_co_flush_to_disk  = raw_co_flush_to_disk,
     .bdrv_refresh_limits    = cdrom_refresh_limits,
 -    .bdrv_attach_aio_context = raw_aio_attach_aio_context,
     .bdrv_co_truncate                   = raw_co_truncate,
     .bdrv_co_getlength                  = raw_co_getlength,
 -- 
 2.39.3
--- a/SOURCES/kvm-block-introduce-bdrv_open_file_child-helper.patch
+++ b/SOURCES/kvm-block-introduce-bdrv_open_file_child-helper.patch
@ -0,0 +1,566 @@
 From 996680dd6d5afd51918e600126dbfed4dfe89e05 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Sun, 9 Jun 2024 23:08:39 -0400
 Subject: [PATCH 4/5] block: introduce bdrv_open_file_child() helper
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 5: EMBARGOED CVE-2024-4467 for rhel-8.10.z (PRDSC)
 RH-Jira: RHEL-35616
 RH-CVE: CVE-2024-4467
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Commit: [4/5] 9f582a9aff740eb9ec6f64bfec94854038d8545f
 Conflicts: - copy-before-write.c::cbw_copy() is an older version than
             upstream, but introduction of the new function is
 	     straight-forward.
           - include/block/block-global-state.h doesn't exist in this
             code version. Adding the prototype to
             include/block/block.h instead.
           - struct BlockDriver has no field 'filtered_child_is_backing'
             We remove the corresponding assert() in the new function.
 commit 83930780325b144a5908c45b3957b9b6457b3831
 Author: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
 Date:   Tue Jul 26 23:11:21 2022 +0300
    block: introduce bdrv_open_file_child() helper
    Almost all drivers call bdrv_open_child() similarly. Let's create a
    helper for this.
    The only not updated drivers that call bdrv_open_child() to set
    bs->file are raw-format and snapshot-access:
        raw-format sometimes want to have filtered child but
            don't set drv->is_filter to true.
        snapshot-access wants only DATA | PRIMARY
    Possibly we should implement drv->is_filter_func() handler, to consider
    raw-format as filter when it works as filter.. But it's another story.
    Note also, that we decrease assignments to bs->file in code: it helps
    us restrict modifying this field in further commit.
    Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
    Reviewed-by: Hanna Reitz <hreitz@redhat.com>
    Message-Id: <20220726201134.924743-3-vsementsov@yandex-team.ru>
    Reviewed-by: Kevin Wolf <kwolf@redhat.com>
    Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 block.c                   | 18 ++++++++++++++++++
 block/blkdebug.c          |  9 +++------
 block/blklogwrites.c      |  7 ++-----
 block/blkreplay.c         |  7 ++-----
 block/blkverify.c         |  9 +++------
 block/bochs.c             |  7 +++----
 block/cloop.c             |  7 +++----
 block/copy-before-write.c |  9 ++++-----
 block/copy-on-read.c      |  9 ++++-----
 block/crypto.c            | 11 ++++++-----
 block/dmg.c               |  7 +++----
 block/filter-compress.c   |  8 +++-----
 block/parallels.c         |  7 +++----
 block/preallocate.c       |  9 ++++-----
 block/qcow.c              |  6 ++----
 block/qcow2.c             |  8 ++++----
 block/qed.c               |  8 ++++----
 block/replication.c       |  8 +++-----
 block/throttle.c          |  8 +++-----
 block/vdi.c               |  7 +++----
 block/vhdx.c              |  7 +++----
 block/vmdk.c              |  7 +++----
 block/vpc.c               |  7 +++----
 include/block/block.h     |  3 +++
 24 files changed, 92 insertions(+), 101 deletions(-)
 diff --git a/block.c b/block.c
 index 0ac5b163d2..889f878565 100644
 --- a/block.c
 +++ b/block.c
@@ -3546,6 +3546,24 @@ BdrvChild *bdrv_open_child(const char *filename,
                              errp);
 }
 +/*
 + * Wrapper on bdrv_open_child() for most popular case: open primary child of bs.
 + */
 +int bdrv_open_file_child(const char *filename,
 +                         QDict *options, const char *bdref_key,
 +                         BlockDriverState *parent, Error **errp)
 +{
 +    BdrvChildRole role;
 +
 +    role = parent->drv->is_filter ?
 +        (BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY) : BDRV_CHILD_IMAGE;
 +
 +    parent->file = bdrv_open_child(filename, options, bdref_key, parent,
 +                                   &child_of_bds, role, false, errp);
 +
 +    return parent->file ? 0 : -EINVAL;
 +}
 +
 /*
  * TODO Future callers may need to specify parent/child_class in order for
  * option inheritance to work. Existing callers use it for the root node.
 diff --git a/block/blkdebug.c b/block/blkdebug.c
 index bbf2948703..5fcfc8ac6f 100644
 --- a/block/blkdebug.c
 +++ b/block/blkdebug.c
@@ -503,12 +503,9 @@ static int blkdebug_open(BlockDriverState *bs, QDict *options, int flags,
     }
     /* Open the image file */
 -    bs->file = bdrv_open_child(qemu_opt_get(opts, "x-image"), options, "image",
 -                               bs, &child_of_bds,
 -                               BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
 -                               false, errp);
 -    if (!bs->file) {
 -        ret = -EINVAL;
 +    ret = bdrv_open_file_child(qemu_opt_get(opts, "x-image"), options, "image",
 +                               bs, errp);
 +    if (ret < 0) {
         goto out;
     }
 diff --git a/block/blklogwrites.c b/block/blklogwrites.c
 index f7a251e91f..f66a617eb3 100644
 --- a/block/blklogwrites.c
 +++ b/block/blklogwrites.c
@@ -155,11 +155,8 @@ static int blk_log_writes_open(BlockDriverState *bs, QDict *options, int flags,
     }
     /* Open the file */
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY, false,
 -                               errp);
 -    if (!bs->file) {
 -        ret = -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
         goto fail;
     }
 diff --git a/block/blkreplay.c b/block/blkreplay.c
 index dcbe780ddb..76a0b8d12a 100644
 --- a/block/blkreplay.c
 +++ b/block/blkreplay.c
@@ -26,11 +26,8 @@ static int blkreplay_open(BlockDriverState *bs, QDict *options, int flags,
     int ret;
     /* Open the image file */
 -    bs->file = bdrv_open_child(NULL, options, "image", bs, &child_of_bds,
 -                               BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
 -                               false, errp);
 -    if (!bs->file) {
 -        ret = -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "image", bs, errp);
 +    if (ret < 0) {
         goto fail;
     }
 diff --git a/block/blkverify.c b/block/blkverify.c
 index d1facf5ba9..920e891684 100644
 --- a/block/blkverify.c
 +++ b/block/blkverify.c
@@ -121,12 +121,9 @@ static int blkverify_open(BlockDriverState *bs, QDict *options, int flags,
     }
     /* Open the raw file */
 -    bs->file = bdrv_open_child(qemu_opt_get(opts, "x-raw"), options, "raw",
 -                               bs, &child_of_bds,
 -                               BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
 -                               false, errp);
 -    if (!bs->file) {
 -        ret = -EINVAL;
 +    ret = bdrv_open_file_child(qemu_opt_get(opts, "x-raw"), options, "raw",
 +                               bs, errp);
 +    if (ret < 0) {
         goto fail;
     }
 diff --git a/block/bochs.c b/block/bochs.c
 index 4d68658087..b2dc06bbfd 100644
 --- a/block/bochs.c
 +++ b/block/bochs.c
@@ -110,10 +110,9 @@ static int bochs_open(BlockDriverState *bs, QDict *options, int flags,
         return ret;
     }
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_IMAGE, false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     ret = bdrv_pread(bs->file, 0, &bochs, sizeof(bochs));
 diff --git a/block/cloop.c b/block/cloop.c
 index b8c6d0eccd..bee87da173 100644
 --- a/block/cloop.c
 +++ b/block/cloop.c
@@ -71,10 +71,9 @@ static int cloop_open(BlockDriverState *bs, QDict *options, int flags,
         return ret;
     }
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_IMAGE, false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     /* read header */
 diff --git a/block/copy-before-write.c b/block/copy-before-write.c
 index c30a5ff8de..8aa2cb6a85 100644
 --- a/block/copy-before-write.c
 +++ b/block/copy-before-write.c
@@ -150,12 +150,11 @@ static int cbw_open(BlockDriverState *bs, QDict *options, int flags,
 {
     BDRVCopyBeforeWriteState *s = bs->opaque;
     BdrvDirtyBitmap *copy_bitmap;
 +    int ret;
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
 -                               false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     s->target = bdrv_open_child(NULL, options, "target", bs, &child_of_bds,
 diff --git a/block/copy-on-read.c b/block/copy-on-read.c
 index 1fc7fb3333..815ac1d835 100644
 --- a/block/copy-on-read.c
 +++ b/block/copy-on-read.c
@@ -41,12 +41,11 @@ static int cor_open(BlockDriverState *bs, QDict *options, int flags,
     BDRVStateCOR *state = bs->opaque;
     /* Find a bottom node name, if any */
     const char *bottom_node = qdict_get_try_str(options, "bottom");
 +    int ret;
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
 -                               false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     bs->supported_read_flags = BDRV_REQ_PREFETCH;
 diff --git a/block/crypto.c b/block/crypto.c
 index c8ba4681e2..abfce39230 100644
 --- a/block/crypto.c
 +++ b/block/crypto.c
@@ -260,15 +260,14 @@ static int block_crypto_open_generic(QCryptoBlockFormat format,
 {
     BlockCrypto *crypto = bs->opaque;
     QemuOpts *opts = NULL;
 -    int ret = -EINVAL;
 +    int ret;
     QCryptoBlockOpenOptions *open_opts = NULL;
     unsigned int cflags = 0;
     QDict *cryptoopts = NULL;
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_IMAGE, false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     bs->supported_write_flags = BDRV_REQ_FUA &
@@ -276,6 +275,7 @@ static int block_crypto_open_generic(QCryptoBlockFormat format,
     opts = qemu_opts_create(opts_spec, NULL, 0, &error_abort);
     if (!qemu_opts_absorb_qdict(opts, options, errp)) {
 +        ret = -EINVAL;
         goto cleanup;
     }
@@ -284,6 +284,7 @@ static int block_crypto_open_generic(QCryptoBlockFormat format,
     open_opts = block_crypto_open_opts_init(cryptoopts, errp);
     if (!open_opts) {
 +        ret = -EINVAL;
         goto cleanup;
     }
 diff --git a/block/dmg.c b/block/dmg.c
 index 447901fbb8..38c363dd39 100644
 --- a/block/dmg.c
 +++ b/block/dmg.c
@@ -439,10 +439,9 @@ static int dmg_open(BlockDriverState *bs, QDict *options, int flags,
         return ret;
     }
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_IMAGE, false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     block_module_load_one("dmg-bz2");
 diff --git a/block/filter-compress.c b/block/filter-compress.c
 index d5be538619..305716c86c 100644
 --- a/block/filter-compress.c
 +++ b/block/filter-compress.c
@@ -30,11 +30,9 @@
 static int compress_open(BlockDriverState *bs, QDict *options, int flags,
                          Error **errp)
 {
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
 -                               false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    int ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     if (!bs->file->bs->drv || !block_driver_can_compress(bs->file->bs->drv)) {
 diff --git a/block/parallels.c b/block/parallels.c
 index 6ebad2a2bb..ed4debd899 100644
 --- a/block/parallels.c
 +++ b/block/parallels.c
@@ -735,10 +735,9 @@ static int parallels_open(BlockDriverState *bs, QDict *options, int flags,
     Error *local_err = NULL;
     char *buf;
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_IMAGE, false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     ret = bdrv_pread(bs->file, 0, &ph, sizeof(ph));
 diff --git a/block/preallocate.c b/block/preallocate.c
 index 1d4233f730..332408bdc9 100644
 --- a/block/preallocate.c
 +++ b/block/preallocate.c
@@ -134,6 +134,7 @@ static int preallocate_open(BlockDriverState *bs, QDict *options, int flags,
                             Error **errp)
 {
     BDRVPreallocateState *s = bs->opaque;
 +    int ret;
     /*
      * s->data_end and friends should be initialized on permission update.
@@ -141,11 +142,9 @@ static int preallocate_open(BlockDriverState *bs, QDict *options, int flags,
      */
     s->file_end = s->zero_start = s->data_end = -EINVAL;
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
 -                               false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     if (!preallocate_absorb_opts(&s->opts, options, bs->file->bs, errp)) {
 diff --git a/block/qcow.c b/block/qcow.c
 index c39940f33e..544a17261f 100644
 --- a/block/qcow.c
 +++ b/block/qcow.c
@@ -120,10 +120,8 @@ static int qcow_open(BlockDriverState *bs, QDict *options, int flags,
     qdict_extract_subqdict(options, &encryptopts, "encrypt.");
     encryptfmt = qdict_get_try_str(encryptopts, "format");
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_IMAGE, false, errp);
 -    if (!bs->file) {
 -        ret = -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
         goto fail;
     }
 diff --git a/block/qcow2.c b/block/qcow2.c
 index 6ee1919612..29ea157e6b 100644
 --- a/block/qcow2.c
 +++ b/block/qcow2.c
@@ -1907,11 +1907,11 @@ static int qcow2_open(BlockDriverState *bs, QDict *options, int flags,
         .errp = errp,
         .ret = -EINPROGRESS
     };
 +    int ret;
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_IMAGE, false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     /* Initialise locks */
 diff --git a/block/qed.c b/block/qed.c
 index 558d3646c4..e3b06a3d00 100644
 --- a/block/qed.c
 +++ b/block/qed.c
@@ -558,11 +558,11 @@ static int bdrv_qed_open(BlockDriverState *bs, QDict *options, int flags,
         .errp = errp,
         .ret = -EINPROGRESS
     };
 +    int ret;
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_IMAGE, false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     bdrv_qed_init_state(bs);
 diff --git a/block/replication.c b/block/replication.c
 index 55c8f894aa..2f17397764 100644
 --- a/block/replication.c
 +++ b/block/replication.c
@@ -88,11 +88,9 @@ static int replication_open(BlockDriverState *bs, QDict *options,
     const char *mode;
     const char *top_id;
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
 -                               false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     ret = -EINVAL;
 diff --git a/block/throttle.c b/block/throttle.c
 index 6e8d52fa24..4fb5798c27 100644
 --- a/block/throttle.c
 +++ b/block/throttle.c
@@ -78,11 +78,9 @@ static int throttle_open(BlockDriverState *bs, QDict *options,
     char *group;
     int ret;
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
 -                               false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     bs->supported_write_flags = bs->file->bs->supported_write_flags |
                                 BDRV_REQ_WRITE_UNCHANGED;
 diff --git a/block/vdi.c b/block/vdi.c
 index bdc58d726e..c50c0ed61f 100644
 --- a/block/vdi.c
 +++ b/block/vdi.c
@@ -376,10 +376,9 @@ static int vdi_open(BlockDriverState *bs, QDict *options, int flags,
     int ret;
     QemuUUID uuid_link, uuid_parent;
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_IMAGE, false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     logout("\n");
 diff --git a/block/vhdx.c b/block/vhdx.c
 index 356ec4c455..e7d6d7509a 100644
 --- a/block/vhdx.c
 +++ b/block/vhdx.c
@@ -996,10 +996,9 @@ static int vhdx_open(BlockDriverState *bs, QDict *options, int flags,
     uint64_t signature;
     Error *local_err = NULL;
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_IMAGE, false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     s->bat = NULL;
 diff --git a/block/vmdk.c b/block/vmdk.c
 index 0dfab6e941..7d7e56b36c 100644
 --- a/block/vmdk.c
 +++ b/block/vmdk.c
@@ -1262,10 +1262,9 @@ static int vmdk_open(BlockDriverState *bs, QDict *options, int flags,
     BDRVVmdkState *s = bs->opaque;
     uint32_t magic;
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_IMAGE, false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     buf = vmdk_read_desc(bs->file, 0, errp);
 diff --git a/block/vpc.c b/block/vpc.c
 index 297a26262a..430cab1cbb 100644
 --- a/block/vpc.c
 +++ b/block/vpc.c
@@ -232,10 +232,9 @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags,
     int ret;
     int64_t bs_size;
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_IMAGE, false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     opts = qemu_opts_create(&vpc_runtime_opts, NULL, 0, &error_abort);
 diff --git a/include/block/block.h b/include/block/block.h
 index e5dd22b034..f885f113ef 100644
 --- a/include/block/block.h
 +++ b/include/block/block.h
@@ -376,6 +376,9 @@ BdrvChild *bdrv_open_child(const char *filename,
                            const BdrvChildClass *child_class,
                            BdrvChildRole child_role,
                            bool allow_none, Error **errp);
 +int bdrv_open_file_child(const char *filename,
 +                         QDict *options, const char *bdref_key,
 +                         BlockDriverState *parent, Error **errp);
 BlockDriverState *bdrv_open_blockdev_ref(BlockdevRef *ref, Error **errp);
 int bdrv_set_backing_hd(BlockDriverState *bs, BlockDriverState *backing_hd,
                         Error **errp);
 -- 
 2.39.3
--- a/Show More
+++ b/Show More
		`@ -0,0 +1 @@`
							`DEVPATH=="*/kvm", ACTION=="change", RUN+="/lib/udev/udev-kvm-check $env{COUNT} $env{EVENT}"`