504 changed files with 69305 additions and 26141 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1 +1,5 @@
-SOURCES/qemu-9.0.0.tar.xz
+SOURCES/qemu-6.2.0.tar.xz
 SOURCES/tests_data_acpi_pc_SSDT.dimmpxm
 SOURCES/tests_data_acpi_q35_FACP.slic
 SOURCES/tests_data_acpi_q35_SSDT.dimmpxm
 SOURCES/tests_data_acpi_virt_SSDT.memhp
--- a/.qemu-kvm.metadata
+++ b/.qemu-kvm.metadata
@ -1 +1,5 @@
-6699bb03d6da21159b89668bca01c6c958b95d07 SOURCES/qemu-9.0.0.tar.xz
+68cd61a466170115b88817e2d52db2cd7a92f43a SOURCES/qemu-6.2.0.tar.xz
 c4b34092bc5af1ba7febfca1477320fb024e8acd SOURCES/tests_data_acpi_pc_SSDT.dimmpxm
 19349e3517143bd1af56a5444e927ba37a111f72 SOURCES/tests_data_acpi_q35_FACP.slic
 4632d10ae8cedad4d5d760ed211f83f0dc81005d SOURCES/tests_data_acpi_q35_SSDT.dimmpxm
 ef12eed43cc357fb134db6fa3c7ffc83e222a97d SOURCES/tests_data_acpi_virt_SSDT.memhp
--- a/SOURCES/0001-redhat-Adding-slirp-to-the-exploded-tree.patch
+++ b/SOURCES/0001-redhat-Adding-slirp-to-the-exploded-tree.patch
--- a/SOURCES/0004-Initial-redhat-build.patch
+++ b/SOURCES/0004-Initial-redhat-build.patch
@ -1,327 +0,0 @@
 From ea7dff3dbf979d7d8a85a16cf5187235143e1048 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 26 May 2021 10:56:02 +0200
 Subject: Initial redhat build
 This patch introduces redhat build structure in redhat subdirectory. In addition,
 several issues are fixed in QEMU tree:
 - Change of app name for sasl_server_init in VNC code from qemu to qemu-kvm
 - As we use qemu-kvm as name in all places, this is updated to be consistent
 - Man page renamed from qemu to qemu-kvm
 - man page is installed using make install so we have to fix it in qemu tree
 We disable make check due to issues with some of the tests.
 This rebase is based on qemu-kvm-8.2.0-11.el9
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 --
 Rebase changes (6.1.0):
 - Move build to .distro
 - Move changes for support file to related commit
 - Added dependency for python3-sphinx-rtd_theme
 - Removed --disable-sheepdog configure option
 - Added new hw-display modules
 - SASL initialization moved to ui/vnc-auth-sasl.c
 - Add accel-qtest-<arch> and accel-tcg-x86_64 libraries
 - Added hw-usb-host module
 - Disable new configure options (bpf, nvmm, slirp-smbd)
 - Use -pie for ksmctl build (annocheck complain fix)
 Rebase changes (6.2.0):
 - removed --disable-jemalloc and --disable-tcmalloc configure options
 - added audio-oss.so
 - added fdt requirement for x86_64
 - tests/acceptance renamed to tests/avocado
 - added multiboot_dma.bin
 - Add -Wno-string-plus-int to extra flags
 - Updated configure options
 Rebase changes (7.0.0):
 - Do not use -mlittle CFLAG on ppc64le
 - Used upstream handling issue with ui/clipboard.c
 - Use -mlittle-endian on ppc64le instead of deleteing it in configure
 - Drop --disable-libxml2 option for configure (upstream)
 - Remove vof roms
 - Disable AVX2 support
 - Use internal meson
 - Disable new configure options (dbus-display and qga-vss)
 - Change permissions on installing tests/Makefile.include
 - Remove ssh block driver
 Rebase changes (7.1.0):
 - --disable-vnc-png renamed to --disable-png (upstream)
 - removed --disable-vhost-vsock and --disable-vhost-scsi
 - capstone submodule removed
 - Temporary include capstone build
 Rebase changes (7.2.0):
 - Switch --enable-slirp=system to --enable-slirp
 - Added new configure options (blkio and sndio, both disabled)
 Rebase changes (7.2.0):
 - Fix SRPM name generation to work on Fedora 37
 - Switch back to system meson
 Rebase changes (8.0.0):
 - use enable-dtrace-backands instead of enable-dtrace-backend
 - Removed qemu virtiofsd bits
 - test/check-block.sh removed (upstream)
 - Add new --disable-* options for configure
 Rebase changes (8.1.0):
 - qmp-spec.txt installed by make
 - Removed --meson configure option
 - Add --disable-pypi
 - Removed --with-git and -with-gitsubmodules
 - Renamed --disable-pypi to --disable-downloads
 - Minor updates in README.tests
 Rebase changes (8.2.0):
 - Removed --disable-hax (upstream)
 - Added --disable-plugins configure option
 - Fixing frh.py strings
 Rebase notes (9.0.0):
 - Fixed qemu-kvm binary location change
 - Remove hppa-firmware64.img
 - Package stp files for utilities
 - Download subprojects on local build
 Merged patches (6.0.0):
 - 605758c902 Limit build on Power to qemu-img and qemu-ga only
 Merged patches (6.1.0):
 - f04f91751f Use cached tarballs
 - 6581165c65 Remove message with running VM count
 - 03c3cac9fc spec-file: build qemu-kvm without SPICE and QXL
 - e0ae6c1f6c spec-file: Obsolete qemu-kvm-ui-spice
 - 9d2e9f9ecf spec: Do not build qemu-kvm-block-gluster
 - cf470b4234 spec: Do not link pcnet and ne2k_pci roms
 - e981284a6b redhat: Install the s390-netboot.img that we've built
 - 24ef557f33 spec: Remove usage of Group: tag
 - c40d69b4f4 spec: Drop %defattr usage
 - f8e98798ce spec: Clean up BuildRequires
 - 47246b43ee spec: Remove iasl BuildRequires
 - 170dc1cbe0 spec: Remove redundant 0 in conditionals
 - 8718f6fa11 spec: Add more have_XXX conditionals
 - a001269ce9 spec: Remove binutils versioned Requires
 - 34545ee641 spec: Remove diffutils BuildRequires
 - c2c82beac9 spec: Remove redundant Requires:
 - 9314c231f4 spec: Add XXX_version macros
 - c43db0bf0f spec: Add have_block_rbd
 - 3ecb0c0319 qga: drop StandardError=syslog
 - 018049dc80 Remove iscsi support
 - a2edf18777 redhat: Replace the kvm-setup.service with a /etc/modules-load.d config file
 - 387b5fbcfe redhat: Move qemu-kvm-docs dependency to qemu-kvm
 - 4ead693178 redhat: introducting qemu-kvm-hw-usbredir
 - 4dc6fc3035 redhat: use the standard vhost-user JSON path
 - 84757178b4 Fix local build
 - 8c394227dd spec: Restrict block drivers in tools
 - b6aa7c1fae Move tools to separate package
 - eafd82e509 Split qemu-pr-helper to separate package
 - 2c0182e2aa spec: RPM_BUILD_ROOT -> %{buildroot}
 - 91bd55ca13 spec: More use of %{name} instead of 'qemu-kvm'
 - 50ba299c61 spec: Use qemu-pr-helper.service from qemu.git (partial)
 - ee08d4e0a3 spec: Use %{_sourcedir} for referencing sources
 - 039e7f7d02 spec: Add tools_only
 - 884ba71617 spec: %build: Add run_configure helper
 - 8ebd864d65 spec: %build: Disable more bits with %{disable_everything} (partial)
 - f23fdb53f5 spec: %build: Add macros for some 'configure' parameters
 - fe951a8bd8 spec: %files: Move qemu-guest-agent and qemu-img earlier
 - 353b632e37 spec: %install: Remove redundant bits
 - 9d2015b752 spec: %install: Add %{modprobe_kvm_conf} macro
 - 6d05134e8c spec: %install: Remove qemu-guest-agent /etc/qemu-kvm usage
 - 985b226467 spec: %install: clean up qemu-ga section
 - dfaf9c600d spec: %install: Use a single %{tools_only} section
 - f6978ddb46 spec: Make tools_only not cross spec sections
 - 071c211098 spec: %install: Limit time spent in %{qemu_kvm_build}
 - 1b65c674be spec: misc syntactic merges with Fedora
 - 4da16294cf spec: Use Fedora's pattern for specifying rc version
 - d7ee259a79 spec: %files: don't use fine grained -docs file list
 - 64cad0c60f spec: %files: Add licenses to qemu-common too
 - c3de4f080a spec: %install: Drop python3 shebang fixup
 - 46fc216115 Update local build to work with spec file improvements
 - bab9531548 spec: Remove buildldflags
 - c8360ab6a9 spec: Use %make_build macro
 - f6966c66e9 spec: Drop make install sharedir and datadir usage
 - 86982421bc spec: use %make_install macro
 - 191c405d22 spec: parallelize `make check`
 - 251a1fb958 spec: Drop explicit --build-id
 - 44c7dda6c3 spec: use %{build_ldflags}
 - 0009a34354 Move virtiofsd to separate package
 -  34d1b200b3 Utilize --firmware configure option
 - 2800e1dd03 spec: Switch toolchain to Clang/LLVM (except process-patches.sh)
 - e8a70f500f spec: Use safe-stack for x86_64
 - e29445d50d spec: Reenable write support for VMDK etc. in tools
 - a4fe2a3e16 redhat: Disable LTO on non-x86 architectures
 Merged patches (6.2.0):
 - 333452440b remove sgabios dependency
 - 7d3633f184 enable pulseaudio
 - bd898709b0 spec: disable use of gcrypt for crypto backends in favour of gnutls
 - e4f0c6dee6 spec: Remove block-curl and block-ssh dependency
 - 4dc13bfe63 spec: Build the VDI block driver
 - d2f2ff3c74 spec: Explicitly include compress filter
 - a7d047f9c2 Move ksmtuned files to separate package
 Merged patches (7.0.0):
 - 098d4d08d0 spec: Rename qemu-kvm-hw-usbredir to qemu-kvm-device-usb-redirect
 - c2bd0d6834 spec: Split qemu-kvm-ui-opengl
 - 2c9cda805d spec: Introduce packages for virtio-gpu-* modules (changed as rhel device tree not set)
 - d0414a3e0b spec: Introduce device-display-virtio-vga* packages
 - 3534ec46d4 spec: Move usb-host module to separate package
 - ddc14d4737 spec: Move qtest accel module to tests package
 - 6f2c4befa6 spec: Extend qemu-kvm-core description
 - 6f11866e4e (rhel/rhel-9.0.0) Update to qemu-kvm-6.2.0-6.el9
 - da0a28758f ui/clipboard: fix use-after-free regression
 - 895d4d52eb spec: Remove qemu-virtiofsd
 - c8c8c8bd84 spec: Fix obsolete for spice subpackages
 - d46d2710b2 spec: Obsolete old usb redir subpackage
 - 6f52a50b68 spec: Obsolete ssh driver
 Merged patches (7.2.0):
 - 8c6834feb6 Remove opengl display device subpackages (C9S MR 124)
 - 0ecc97f29e spec: Add requires for packages with additional virtio-gpu variants (C9S MR 124)
 Merged patches (8.0.0):
 - 7754f6ba78 Minor packaging fixes
 - 401af56187 spec: Disable VDUSE
 Merged patches (8.1.0):
 - 0c2306676f Enable Linux io_uring
 - b7fa6426d5 Enable libblkio block drivers
 - 19f6d7a6f4 Fix virtio-blk-vhost-vdpa typo in spec file
 - f356cae88f spec: Build DBUS display
 - 77b763efd5 Provide elf2dmp binary in qemu-tools
 Merged patches (8.2.0):
 - cd9efa221d Enable qemu-kvm-device-usb-redirec for aarch64
 Merged patches (9.0.0 rc0):
 - 25de053dbf spec: Enable zstd
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 .distro/Makefile                        |  101 +
 .distro/Makefile.common                 |   42 +
 .distro/README.tests                    |   39 +
 .distro/modules-load.conf               |    4 +
 .distro/qemu-guest-agent.service        |    1 -
 .distro/qemu-kvm.spec.template          | 5170 +++++++++++++++++++++++
 .distro/rpminspect.yaml                 |    6 +-
 .distro/scripts/extract_build_cmd.py    |   12 +
 .distro/scripts/frh.py                  |    4 +-
 .distro/scripts/process-patches.sh      |    4 +
 .gitignore                              |    1 +
 README.systemtap                        |   43 +
 scripts/qemu-guest-agent/fsfreeze-hook  |    2 +-
 scripts/systemtap/conf.d/qemu_kvm.conf  |    4 +
 scripts/systemtap/script.d/qemu_kvm.stp |    1 +
 ui/vnc-auth-sasl.c                      |    2 +-
 16 files changed, 5430 insertions(+), 6 deletions(-)
 create mode 100644 .distro/Makefile
 create mode 100644 .distro/Makefile.common
 create mode 100644 .distro/README.tests
 create mode 100644 .distro/modules-load.conf
 create mode 100644 .distro/qemu-kvm.spec.template
 create mode 100644 README.systemtap
 create mode 100644 scripts/systemtap/conf.d/qemu_kvm.conf
 create mode 100644 scripts/systemtap/script.d/qemu_kvm.stp
 diff --git a/README.systemtap b/README.systemtap
 new file mode 100644
 index 0000000000..ad913fc990
 --- /dev/null
 +++ b/README.systemtap
@@ -0,0 +1,43 @@
 +QEMU tracing using systemtap-initscript
 +---------------------------------------
 +
 +You can capture QEMU trace data all the time using systemtap-initscript.  This
 +uses SystemTap's flight recorder mode to trace all running guests to a
 +fixed-size buffer on the host.  Old trace entries are overwritten by new
 +entries when the buffer size wraps.
 +
 +1. Install the systemtap-initscript package:
 +  # yum install systemtap-initscript
 +
 +2. Install the systemtap scripts and the conf file:
 +  # cp /usr/share/qemu-kvm/systemtap/script.d/qemu_kvm.stp /etc/systemtap/script.d/
 +  # cp /usr/share/qemu-kvm/systemtap/conf.d/qemu_kvm.conf /etc/systemtap/conf.d/
 +
 +The set of trace events to enable is given in qemu_kvm.stp.  This SystemTap
 +script can be customized to add or remove trace events provided in
 +/usr/share/systemtap/tapset/qemu-kvm-simpletrace.stp.
 +
 +SystemTap customizations can be made to qemu_kvm.conf to control the flight
 +recorder buffer size and whether to store traces in memory only or disk too.
 +See stap(1) for option documentation.
 +
 +3. Start the systemtap service.
 +　# service systemtap start qemu_kvm
 +
 +4. Make the service start at boot time.
 +　# chkconfig systemtap on
 +
 +5. Confirm that the service works.
 +  # service systemtap status qemu_kvm
 +  qemu_kvm is running...
 +
 +When you want to inspect the trace buffer, perform the following steps:
 +
 +1. Dump the trace buffer.
 +  # staprun -A qemu_kvm >/tmp/trace.log
 +
 +2. Start the systemtap service because the preceding step stops the service.
 +  # service systemtap start qemu_kvm
 +
 +3. Translate the trace record to readable format.
 +  # /usr/share/qemu-kvm/simpletrace.py --no-header /usr/share/qemu-kvm/trace-events /tmp/trace.log
 diff --git a/scripts/qemu-guest-agent/fsfreeze-hook b/scripts/qemu-guest-agent/fsfreeze-hook
 index 13aafd4845..e9b84ec028 100755
 --- a/scripts/qemu-guest-agent/fsfreeze-hook
 +++ b/scripts/qemu-guest-agent/fsfreeze-hook
@@ -8,7 +8,7 @@
 # request, it is issued with "thaw" argument after filesystem is thawed.
 LOGFILE=/var/log/qga-fsfreeze-hook.log
 -FSFREEZE_D=$(dirname -- "$0")/fsfreeze-hook.d
 +FSFREEZE_D=$(dirname -- "$(realpath $0)")/fsfreeze-hook.d
 # Check whether file $1 is a backup or rpm-generated file and should be ignored
 is_ignored_file() {
 diff --git a/scripts/systemtap/conf.d/qemu_kvm.conf b/scripts/systemtap/conf.d/qemu_kvm.conf
 new file mode 100644
 index 0000000000..372d8160a4
 --- /dev/null
 +++ b/scripts/systemtap/conf.d/qemu_kvm.conf
@@ -0,0 +1,4 @@
 +# Force load uprobes (see BZ#1118352)
 +stap -e 'probe process("/usr/libexec/qemu-kvm").function("main") { printf("") }' -c true
 +
 +qemu_kvm_OPT="-s4" # per-CPU buffer size, in megabytes
 diff --git a/scripts/systemtap/script.d/qemu_kvm.stp b/scripts/systemtap/script.d/qemu_kvm.stp
 new file mode 100644
 index 0000000000..c04abf9449
 --- /dev/null
 +++ b/scripts/systemtap/script.d/qemu_kvm.stp
@@ -0,0 +1 @@
 +probe qemu.kvm.simpletrace.handle_qmp_command,qemu.kvm.simpletrace.monitor_protocol_*,qemu.kvm.simpletrace.migrate_set_state {}
 diff --git a/ui/vnc-auth-sasl.c b/ui/vnc-auth-sasl.c
 index 47fdae5b21..2a950caa2a 100644
 --- a/ui/vnc-auth-sasl.c
 +++ b/ui/vnc-auth-sasl.c
@@ -42,7 +42,7 @@
 bool vnc_sasl_server_init(Error **errp)
 {
 -    int saslErr = sasl_server_init(NULL, "qemu");
 +    int saslErr = sasl_server_init(NULL, "qemu-kvm");
     if (saslErr != SASL_OK) {
         error_setg(errp, "Failed to initialize SASL auth: %s",
 -- 
 2.39.3
--- a/SOURCES/0005-Enable-disable-devices-for-RHEL.patch
+++ b/SOURCES/0005-Enable-disable-devices-for-RHEL.patch
@ -1,902 +0,0 @@
 From 780c39975b059deaee106775b6e3a240155acea3 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 7 Dec 2022 03:05:48 -0500
 Subject: Enable/disable devices for RHEL
 This commit adds all changes related to changes in supported devices.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 --
 Rebase notes (6.1.0):
 - Added CONFIG_TPM (except s390x)
 - default-configs moved to configs
 - Use --with-device-<ARCH> configure option to use rhel configs
 Rebase notes (6.2.0):
 - Add CONFIG_ISA_FDC
 - Do not remove -no-hpet documentation
 Rebase notes (7.0.0):
 - Added CONFIG_ARM_GIC_TCG option for aarch64
 - Fixes necessary for layout change fixes
 - Renamed CONFIG_ARM_GIC_TCG to CONFIG_ARM_GICV3_TCG
 - Removed upstream devices
 Rebase notes (7.1.0):
 - Added CONFIG_VHOST_VSOCK and CONFIG_VHOST_USER_VSOCK configs
 - Added CONFIG_CXL and CONFIG_CXL_MEM_DEVICE for aarch64 and x86_64
 - Added CONFIG_VHOST_USER_FS option (all archs)
 Rebase notes (7.2.0):
 - Removed disabling a15mpcore.c as no longer needed
 Rebase notes (8.0.0):
 - Rename CONFIG_ACPI_X86_ICH to CONFIG_ACPI_ICH9
 - Inlude qemu/error-report.h in hw/display/cirrus_vga.c
 - Change virtiofsd dependency version
 Rebase notes (8.1.0):
 - Added CONFIG_PCIE_PCI_BRIDGE for x86_64
 - Disabling tcg cpus for aarch64
 - Disable CONFIG_ARM_V7M and remove related hack
 - Moved aarch64 tcg cpu disabling from arm machine type commit
 Rebase notes (8.2.0):
 - Disabled new a710 arm64 tcg cpu
 - No longer needed hack for removal of i2c-echo
 - Disable new neoverse-v2
 - Removed CONFIG_OPENGL from x86_64 config file
 Rebase notes (9.0.0 rc0):
 - Split CONFIG_IDE_QDEV to CONFIG_IDE_DEV and CONFIG_IDE_BUS (upstream change)
 Rebase notes (9.0.0 rc1):
 - Do not compile armv7 cpu types
 Merged patches (6.1.0):
 - c51bf45304 Remove SPICE and QXL from x86_64-rh-devices.mak
 - 02fc745601 aarch64-rh-devices: add CONFIG_PVPANIC_PCI
 - f2fe835153 aarch64-rh-devices: add CONFIG_PXB
 - b5431733ad disable CONFIG_USB_STORAGE_BOT
 - 478ba0cdf6 Disable TPM passthrough
 - 2504d68a7c aarch64: Add USB storage devices
 - 51c2a3253c disable ac97 audio
 Merged patches (6.2.0):
 - 9f2f9fa2ba disable sga device
 Merged patches (7.0.0):
 - fd7c45a5a8 redhat: Enable virtio-mem as tech-preview on x86-64
 - c9e68ea451 Enable SGX -- RH Only
 Merged patches (7.1.0):
 - 38b89dc245 pc: Move s3/s4 suspend disabling to compat (only hw/acpi/ich9.c chunk)
 - 8f663466c6 configs/devices/aarch64-softmmu: Enable CONFIG_VIRTIO_MEM
 - 1bf372717a Enable virtio-iommu-pci on aarch64
 - ae3f269458 Enable virtio-iommu-pci on x86_64
 Merged patches (8.1.0):
 - 8173d2eaba Disable unwanted new devices
 Merged patches (8.2.0):
 - b29f66431f Enable igb on x86_64
 Merged patches (9.0.0 rc0):
 - 3889ede5d9 Compile IOMMUFD on x86_64
 - 0beb18451f Compile IOMMUFD on s390x
 - 2b4b13f70d Compile IOMMUFD object on aarch64
 ---
 .distro/qemu-kvm.spec.template                |  18 +--
 .../aarch64-softmmu/aarch64-rh-devices.mak    |  42 +++++++
 .../ppc64-softmmu/ppc64-rh-devices.mak        |  37 ++++++
 configs/devices/rh-virtio.mak                 |  10 ++
 .../s390x-softmmu/s390x-rh-devices.mak        |  19 +++
 .../x86_64-softmmu/x86_64-rh-devices.mak      | 112 ++++++++++++++++++
 hw/arm/virt.c                                 |   2 +
 hw/block/fdc.c                                |  10 ++
 hw/cpu/meson.build                            |   3 +-
 hw/cxl/meson.build                            |   3 +-
 hw/display/cirrus_vga.c                       |   4 +
 hw/ide/piix.c                                 |   5 +-
 hw/input/pckbd.c                              |   2 +
 hw/net/e1000.c                                |   2 +
 hw/ppc/spapr_cpu_core.c                       |   2 +
 hw/usb/meson.build                            |   2 +-
 hw/virtio/meson.build                         |   6 +-
 target/arm/arm-qmp-cmds.c                     |   2 +
 target/arm/cpu.c                              |   4 +
 target/arm/cpu.h                              |   3 +
 target/arm/cpu64.c                            |  12 +-
 target/arm/tcg/cpu32.c                        |   2 +
 target/arm/tcg/cpu64.c                        |   8 ++
 target/arm/tcg/meson.build                    |   4 +-
 target/ppc/cpu-models.c                       |   9 ++
 target/s390x/cpu_models_sysemu.c              |   3 +
 target/s390x/kvm/kvm.c                        |   8 ++
 tests/qtest/arm-cpu-features.c                |   4 +
 28 files changed, 321 insertions(+), 17 deletions(-)
 create mode 100644 configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
 create mode 100644 configs/devices/ppc64-softmmu/ppc64-rh-devices.mak
 create mode 100644 configs/devices/rh-virtio.mak
 create mode 100644 configs/devices/s390x-softmmu/s390x-rh-devices.mak
 create mode 100644 configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 diff --git a/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak b/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
 new file mode 100644
 index 0000000000..b0191d3c69
 --- /dev/null
 +++ b/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
@@ -0,0 +1,42 @@
 +include ../rh-virtio.mak
 +
 +CONFIG_ARM_GIC_KVM=y
 +CONFIG_ARM_GICV3_TCG=y
 +CONFIG_ARM_GIC=y
 +CONFIG_ARM_SMMUV3=y
 +CONFIG_ARM_VIRT=y
 +CONFIG_CXL=y
 +CONFIG_CXL_MEM_DEVICE=y
 +CONFIG_EDID=y
 +CONFIG_PCIE_PORT=y
 +CONFIG_PCIE_PCI_BRIDGE=y
 +CONFIG_PCI_DEVICES=y
 +CONFIG_PCI_TESTDEV=y
 +CONFIG_PFLASH_CFI01=y
 +CONFIG_SCSI=y
 +CONFIG_SEMIHOSTING=y
 +CONFIG_USB=y
 +CONFIG_USB_XHCI=y
 +CONFIG_USB_XHCI_PCI=y
 +CONFIG_USB_STORAGE_CORE=y
 +CONFIG_USB_STORAGE_CLASSIC=y
 +CONFIG_VFIO=y
 +CONFIG_VFIO_PCI=y
 +CONFIG_VIRTIO_MMIO=y
 +CONFIG_VIRTIO_PCI=y
 +CONFIG_VIRTIO_MEM=y
 +CONFIG_VIRTIO_IOMMU=y
 +CONFIG_XIO3130=y
 +CONFIG_NVDIMM=y
 +CONFIG_ACPI_APEI=y
 +CONFIG_TPM=y
 +CONFIG_TPM_EMULATOR=y
 +CONFIG_TPM_TIS_SYSBUS=y
 +CONFIG_PTIMER=y
 +CONFIG_ARM_COMPATIBLE_SEMIHOSTING=y
 +CONFIG_PVPANIC_PCI=y
 +CONFIG_PXB=y
 +CONFIG_VHOST_VSOCK=y
 +CONFIG_VHOST_USER_VSOCK=y
 +CONFIG_VHOST_USER_FS=y
 +CONFIG_IOMMUFD=y
 diff --git a/configs/devices/ppc64-softmmu/ppc64-rh-devices.mak b/configs/devices/ppc64-softmmu/ppc64-rh-devices.mak
 new file mode 100644
 index 0000000000..dbb7d30829
 --- /dev/null
 +++ b/configs/devices/ppc64-softmmu/ppc64-rh-devices.mak
@@ -0,0 +1,37 @@
 +include ../rh-virtio.mak
 +
 +CONFIG_DIMM=y
 +CONFIG_MEM_DEVICE=y
 +CONFIG_NVDIMM=y
 +CONFIG_PCI=y
 +CONFIG_PCI_DEVICES=y
 +CONFIG_PCI_TESTDEV=y
 +CONFIG_PCI_EXPRESS=y
 +CONFIG_PSERIES=y
 +CONFIG_SCSI=y
 +CONFIG_SPAPR_VSCSI=y
 +CONFIG_TEST_DEVICES=y
 +CONFIG_USB=y
 +CONFIG_USB_OHCI=y
 +CONFIG_USB_OHCI_PCI=y
 +CONFIG_USB_SMARTCARD=y
 +CONFIG_USB_STORAGE_CORE=y
 +CONFIG_USB_STORAGE_CLASSIC=y
 +CONFIG_USB_XHCI=y
 +CONFIG_USB_XHCI_NEC=y
 +CONFIG_USB_XHCI_PCI=y
 +CONFIG_VFIO=y
 +CONFIG_VFIO_PCI=y
 +CONFIG_VGA=y
 +CONFIG_VGA_PCI=y
 +CONFIG_VHOST_USER=y
 +CONFIG_VIRTIO_PCI=y
 +CONFIG_VIRTIO_VGA=y
 +CONFIG_WDT_IB6300ESB=y
 +CONFIG_XICS=y
 +CONFIG_XIVE=y
 +CONFIG_TPM=y
 +CONFIG_TPM_SPAPR=y
 +CONFIG_TPM_EMULATOR=y
 +CONFIG_VHOST_VSOCK=y
 +CONFIG_VHOST_USER_VSOCK=y
 diff --git a/configs/devices/rh-virtio.mak b/configs/devices/rh-virtio.mak
 new file mode 100644
 index 0000000000..94ede1b5f6
 --- /dev/null
 +++ b/configs/devices/rh-virtio.mak
@@ -0,0 +1,10 @@
 +CONFIG_VIRTIO=y
 +CONFIG_VIRTIO_BALLOON=y
 +CONFIG_VIRTIO_BLK=y
 +CONFIG_VIRTIO_GPU=y
 +CONFIG_VIRTIO_INPUT=y
 +CONFIG_VIRTIO_INPUT_HOST=y
 +CONFIG_VIRTIO_NET=y
 +CONFIG_VIRTIO_RNG=y
 +CONFIG_VIRTIO_SCSI=y
 +CONFIG_VIRTIO_SERIAL=y
 diff --git a/configs/devices/s390x-softmmu/s390x-rh-devices.mak b/configs/devices/s390x-softmmu/s390x-rh-devices.mak
 new file mode 100644
 index 0000000000..24cf6dbd03
 --- /dev/null
 +++ b/configs/devices/s390x-softmmu/s390x-rh-devices.mak
@@ -0,0 +1,19 @@
 +include ../rh-virtio.mak
 +
 +CONFIG_PCI=y
 +CONFIG_S390_CCW_VIRTIO=y
 +CONFIG_S390_FLIC=y
 +CONFIG_S390_FLIC_KVM=y
 +CONFIG_SCLPCONSOLE=y
 +CONFIG_SCSI=y
 +CONFIG_VFIO=y
 +CONFIG_VFIO_AP=y
 +CONFIG_VFIO_CCW=y
 +CONFIG_VFIO_PCI=y
 +CONFIG_VHOST_USER=y
 +CONFIG_VIRTIO_CCW=y
 +CONFIG_WDT_DIAG288=y
 +CONFIG_VHOST_VSOCK=y
 +CONFIG_VHOST_USER_VSOCK=y
 +CONFIG_VHOST_USER_FS=y
 +CONFIG_IOMMUFD=y
 diff --git a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 new file mode 100644
 index 0000000000..d60ff1bcfc
 --- /dev/null
 +++ b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
@@ -0,0 +1,112 @@
 +include ../rh-virtio.mak
 +
 +CONFIG_ACPI=y
 +CONFIG_ACPI_PCI=y
 +CONFIG_ACPI_CPU_HOTPLUG=y
 +CONFIG_ACPI_MEMORY_HOTPLUG=y
 +CONFIG_ACPI_NVDIMM=y
 +CONFIG_ACPI_SMBUS=y
 +CONFIG_ACPI_VMGENID=y
 +CONFIG_ACPI_X86=y
 +CONFIG_ACPI_ICH9=y
 +CONFIG_AHCI=y
 +CONFIG_APIC=y
 +CONFIG_APM=y
 +CONFIG_BOCHS_DISPLAY=y
 +CONFIG_CXL=y
 +CONFIG_CXL_MEM_DEVICE=y
 +CONFIG_DIMM=y
 +CONFIG_E1000E_PCI_EXPRESS=y
 +CONFIG_E1000_PCI=y
 +CONFIG_EDU=y
 +CONFIG_FDC=y
 +CONFIG_FDC_SYSBUS=y
 +CONFIG_FDC_ISA=y
 +CONFIG_FW_CFG_DMA=y
 +CONFIG_HDA=y
 +CONFIG_HYPERV=y
 +CONFIG_HYPERV_TESTDEV=y
 +CONFIG_I2C=y
 +CONFIG_I440FX=y
 +CONFIG_I8254=y
 +CONFIG_I8257=y
 +CONFIG_I8259=y
 +CONFIG_I82801B11=y
 +CONFIG_IDE_CORE=y
 +CONFIG_IDE_PCI=y
 +CONFIG_IDE_PIIX=y
 +CONFIG_IDE_DEV=y
 +CONFIG_IDE_BUS=y
 +CONFIG_IGB_PCI_EXPRESS=y
 +CONFIG_IOAPIC=y
 +CONFIG_IOH3420=y
 +CONFIG_ISA_BUS=y
 +CONFIG_ISA_DEBUG=y
 +CONFIG_ISA_TESTDEV=y
 +CONFIG_LPC_ICH9=y
 +CONFIG_MC146818RTC=y
 +CONFIG_MEM_DEVICE=y
 +CONFIG_NVDIMM=y
 +CONFIG_PAM=y
 +CONFIG_PC=y
 +CONFIG_PCI=y
 +CONFIG_PCIE_PORT=y
 +CONFIG_PCI_DEVICES=y
 +CONFIG_PCI_EXPRESS=y
 +CONFIG_PCI_EXPRESS_Q35=y
 +CONFIG_PCI_I440FX=y
 +CONFIG_PCI_TESTDEV=y
 +CONFIG_PCKBD=y
 +CONFIG_PCSPK=y
 +CONFIG_PC_ACPI=y
 +CONFIG_PC_PCI=y
 +CONFIG_PCIE_PCI_BRIDGE=y
 +CONFIG_PFLASH_CFI01=y
 +CONFIG_PVPANIC_ISA=y
 +CONFIG_PXB=y
 +CONFIG_Q35=y
 +CONFIG_RTL8139_PCI=y
 +CONFIG_SCSI=y
 +CONFIG_SERIAL=y
 +CONFIG_SERIAL_ISA=y
 +CONFIG_SERIAL_PCI=y
 +CONFIG_SEV=y
 +CONFIG_SMBIOS=y
 +CONFIG_SMBUS_EEPROM=y
 +CONFIG_TEST_DEVICES=y
 +CONFIG_USB=y
 +CONFIG_USB_EHCI=y
 +CONFIG_USB_EHCI_PCI=y
 +CONFIG_USB_SMARTCARD=y
 +CONFIG_USB_STORAGE_CORE=y
 +CONFIG_USB_STORAGE_CLASSIC=y
 +CONFIG_USB_UHCI=y
 +CONFIG_USB_XHCI=y
 +CONFIG_USB_XHCI_NEC=y
 +CONFIG_USB_XHCI_PCI=y
 +CONFIG_VFIO=y
 +CONFIG_VFIO_PCI=y
 +CONFIG_VGA=y
 +CONFIG_VGA_CIRRUS=y
 +CONFIG_VGA_PCI=y
 +CONFIG_VHOST_USER=y
 +CONFIG_VHOST_USER_BLK=y
 +CONFIG_VIRTIO_MEM=y
 +CONFIG_VIRTIO_PCI=y
 +CONFIG_VIRTIO_VGA=y
 +CONFIG_VIRTIO_IOMMU=y
 +CONFIG_VMMOUSE=y
 +CONFIG_VMPORT=y
 +CONFIG_VTD=y
 +CONFIG_WDT_IB6300ESB=y
 +CONFIG_WDT_IB700=y
 +CONFIG_XIO3130=y
 +CONFIG_TPM=y
 +CONFIG_TPM_CRB=y
 +CONFIG_TPM_TIS_ISA=y
 +CONFIG_TPM_EMULATOR=y
 +CONFIG_SGX=y
 +CONFIG_VHOST_VSOCK=y
 +CONFIG_VHOST_USER_VSOCK=y
 +CONFIG_VHOST_USER_FS=y
 +CONFIG_IOMMUFD=y
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index a9a913aead..6c6d155002 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
@@ -2954,6 +2954,7 @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
     MachineClass *mc = MACHINE_CLASS(oc);
     HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(oc);
     static const char * const valid_cpu_types[] = {
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 #ifdef CONFIG_TCG
         ARM_CPU_TYPE_NAME("cortex-a7"),
         ARM_CPU_TYPE_NAME("cortex-a15"),
@@ -2971,6 +2972,7 @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
 #endif /* CONFIG_TCG */
 #ifdef TARGET_AARCH64
         ARM_CPU_TYPE_NAME("cortex-a53"),
 +#endif /* disabled for RHEL */
         ARM_CPU_TYPE_NAME("cortex-a57"),
 #if defined(CONFIG_KVM) || defined(CONFIG_HVF)
         ARM_CPU_TYPE_NAME("host"),
 diff --git a/hw/block/fdc.c b/hw/block/fdc.c
 index 6dd94e98bc..a05757fc9a 100644
 --- a/hw/block/fdc.c
 +++ b/hw/block/fdc.c
@@ -49,6 +49,8 @@
 #include "qom/object.h"
 #include "fdc-internal.h"
 +#include "hw/boards.h"
 +
 /********************************************************/
 /* debug Floppy devices */
@@ -2346,6 +2348,14 @@ void fdctrl_realize_common(DeviceState *dev, FDCtrl *fdctrl, Error **errp)
     FDrive *drive;
     static int command_tables_inited = 0;
 +    /* Restricted for Red Hat Enterprise Linux: */
 +    MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
 +    if (!strstr(mc->name, "-rhel7.")) {
 +        error_setg(errp, "Device %s is not supported with machine type %s",
 +                   object_get_typename(OBJECT(dev)), mc->name);
 +        return;
 +    }
 +
     if (fdctrl->fallback == FLOPPY_DRIVE_TYPE_AUTO) {
         error_setg(errp, "Cannot choose a fallback FDrive type of 'auto'");
         return;
 diff --git a/hw/cpu/meson.build b/hw/cpu/meson.build
 index 38cdcfbe57..e588ecfd42 100644
 --- a/hw/cpu/meson.build
 +++ b/hw/cpu/meson.build
@@ -1,4 +1,5 @@
 -system_ss.add(files('core.c', 'cluster.c'))
 +#system_ss.add(files('core.c', 'cluster.c'))
 +system_ss.add(files('core.c'))
 system_ss.add(when: 'CONFIG_ARM11MPCORE', if_true: files('arm11mpcore.c'))
 system_ss.add(when: 'CONFIG_REALVIEW', if_true: files('realview_mpcore.c'))
 diff --git a/hw/cxl/meson.build b/hw/cxl/meson.build
 index 3e375f61a9..613adb3ebb 100644
 --- a/hw/cxl/meson.build
 +++ b/hw/cxl/meson.build
@@ -6,7 +6,8 @@ system_ss.add(when: 'CONFIG_CXL',
                    'cxl-host.c',
                    'cxl-cdat.c',
                    'cxl-events.c',
 -                   'switch-mailbox-cci.c',
 +# Disabled for 8.2.0 rebase for RHEL 9.4.0
 +#                   'switch-mailbox-cci.c',
                ),
                if_false: files(
                    'cxl-host-stubs.c',
 diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
 index 150883a971..497365bd80 100644
 --- a/hw/display/cirrus_vga.c
 +++ b/hw/display/cirrus_vga.c
@@ -36,6 +36,7 @@
 #include "qemu/module.h"
 #include "qemu/units.h"
 #include "qemu/log.h"
 +#include "qemu/error-report.h"
 #include "sysemu/reset.h"
 #include "qapi/error.h"
 #include "trace.h"
@@ -2946,6 +2947,9 @@ static void pci_cirrus_vga_realize(PCIDevice *dev, Error **errp)
     PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(dev);
     int16_t device_id = pc->device_id;
 +    warn_report("'cirrus-vga' is deprecated, "
 +                "please use a different VGA card instead");
 +
     /*
      * Follow real hardware, cirrus card emulated has 4 MB video memory.
      * Also accept 8 MB/16 MB for backward compatibility.
 diff --git a/hw/ide/piix.c b/hw/ide/piix.c
 index 80efc633d3..9cb82b8eea 100644
 --- a/hw/ide/piix.c
 +++ b/hw/ide/piix.c
@@ -191,7 +191,8 @@ static void piix3_ide_class_init(ObjectClass *klass, void *data)
     k->device_id = PCI_DEVICE_ID_INTEL_82371SB_1;
     k->class_id = PCI_CLASS_STORAGE_IDE;
     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 -    dc->hotpluggable = false;
 +    /* Disabled for Red Hat Enterprise Linux: */
 +    dc->user_creatable = false;
 }
 static const TypeInfo piix3_ide_info = {
@@ -215,6 +216,8 @@ static void piix4_ide_class_init(ObjectClass *klass, void *data)
     k->class_id = PCI_CLASS_STORAGE_IDE;
     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->hotpluggable = false;
 +    /* Disabled for Red Hat Enterprise Linux: */
 +    dc->user_creatable = false;
 }
 static const TypeInfo piix4_ide_info = {
 diff --git a/hw/input/pckbd.c b/hw/input/pckbd.c
 index 74f10b640f..2e85ecf476 100644
 --- a/hw/input/pckbd.c
 +++ b/hw/input/pckbd.c
@@ -952,6 +952,8 @@ static void i8042_class_initfn(ObjectClass *klass, void *data)
     dc->vmsd = &vmstate_kbd_isa;
     adevc->build_dev_aml = i8042_build_aml;
     set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
 +    /* Disabled for Red Hat Enterprise Linux: */
 +    dc->user_creatable = false;
 }
 static const TypeInfo i8042_info = {
 diff --git a/hw/net/e1000.c b/hw/net/e1000.c
 index 43f3a4a701..267f182883 100644
 --- a/hw/net/e1000.c
 +++ b/hw/net/e1000.c
@@ -1746,6 +1746,7 @@ static const E1000Info e1000_devices[] = {
         .revision  = 0x03,
         .phy_id2   = E1000_PHY_ID2_8254xx_DEFAULT,
     },
 +#if 0 /* Disabled for Red Hat Enterprise Linux 7 */
     {
         .name      = "e1000-82544gc",
         .device_id = E1000_DEV_ID_82544GC_COPPER,
@@ -1758,6 +1759,7 @@ static const E1000Info e1000_devices[] = {
         .revision  = 0x03,
         .phy_id2   = E1000_PHY_ID2_8254xx_DEFAULT,
     },
 +#endif
 };
 static void e1000_register_types(void)
 diff --git a/hw/ppc/spapr_cpu_core.c b/hw/ppc/spapr_cpu_core.c
 index e7c9edd033..3b0a47a28c 100644
 --- a/hw/ppc/spapr_cpu_core.c
 +++ b/hw/ppc/spapr_cpu_core.c
@@ -389,10 +389,12 @@ static const TypeInfo spapr_cpu_core_type_infos[] = {
         .instance_size = sizeof(SpaprCpuCore),
         .class_size = sizeof(SpaprCpuCoreClass),
     },
 +#if 0  /* Disabled for Red Hat Enterprise Linux */
     DEFINE_SPAPR_CPU_CORE_TYPE("970_v2.2"),
     DEFINE_SPAPR_CPU_CORE_TYPE("970mp_v1.0"),
     DEFINE_SPAPR_CPU_CORE_TYPE("970mp_v1.1"),
     DEFINE_SPAPR_CPU_CORE_TYPE("power5p_v2.1"),
 +#endif
     DEFINE_SPAPR_CPU_CORE_TYPE("power7_v2.3"),
     DEFINE_SPAPR_CPU_CORE_TYPE("power7p_v2.1"),
     DEFINE_SPAPR_CPU_CORE_TYPE("power8_v2.0"),
 diff --git a/hw/usb/meson.build b/hw/usb/meson.build
 index aac3bb35f2..5411ff35df 100644
 --- a/hw/usb/meson.build
 +++ b/hw/usb/meson.build
@@ -55,7 +55,7 @@ system_ss.add(when: 'CONFIG_USB_SMARTCARD', if_true: files('dev-smartcard-reader
 if cacard.found()
   usbsmartcard_ss = ss.source_set()
   usbsmartcard_ss.add(when: 'CONFIG_USB_SMARTCARD',
 -                      if_true: [cacard, files('ccid-card-emulated.c', 'ccid-card-passthru.c')])
 +                      if_true: [cacard, files('ccid-card-passthru.c')])
   hw_usb_modules += {'smartcard': usbsmartcard_ss}
 endif
 diff --git a/hw/virtio/meson.build b/hw/virtio/meson.build
 index d7f18c96e6..aaabbb8b0b 100644
 --- a/hw/virtio/meson.build
 +++ b/hw/virtio/meson.build
@@ -20,7 +20,8 @@ if have_vhost
     system_virtio_ss.add(files('vhost-user-base.c'))
     # MMIO Stubs
 -    system_virtio_ss.add(files('vhost-user-device.c'))
 +# Disabled for 8.2.0 rebase for RHEL 9.4.0
 +#    system_virtio_ss.add(files('vhost-user-device.c'))
     system_virtio_ss.add(when: 'CONFIG_VHOST_USER_GPIO', if_true: files('vhost-user-gpio.c'))
     system_virtio_ss.add(when: 'CONFIG_VHOST_USER_I2C', if_true: files('vhost-user-i2c.c'))
     system_virtio_ss.add(when: 'CONFIG_VHOST_USER_RNG', if_true: files('vhost-user-rng.c'))
@@ -28,7 +29,8 @@ if have_vhost
     system_virtio_ss.add(when: 'CONFIG_VHOST_USER_INPUT', if_true: files('vhost-user-input.c'))
     # PCI Stubs
 -    system_virtio_ss.add(when: 'CONFIG_VIRTIO_PCI', if_true: files('vhost-user-device-pci.c'))
 +# Disabled for 8.2.0 rebase for RHEL 9.4.0
 +#    system_virtio_ss.add(when: 'CONFIG_VIRTIO_PCI', if_true: files('vhost-user-device-pci.c'))
     system_virtio_ss.add(when: ['CONFIG_VIRTIO_PCI', 'CONFIG_VHOST_USER_GPIO'],
                          if_true: files('vhost-user-gpio-pci.c'))
     system_virtio_ss.add(when: ['CONFIG_VIRTIO_PCI', 'CONFIG_VHOST_USER_I2C'],
 diff --git a/target/arm/arm-qmp-cmds.c b/target/arm/arm-qmp-cmds.c
 index 3cc8cc738b..6f21fea1f5 100644
 --- a/target/arm/arm-qmp-cmds.c
 +++ b/target/arm/arm-qmp-cmds.c
@@ -223,6 +223,7 @@ CpuModelExpansionInfo *qmp_query_cpu_model_expansion(CpuModelExpansionType type,
 static void arm_cpu_add_definition(gpointer data, gpointer user_data)
 {
     ObjectClass *oc = data;
 +    CPUClass *cc = CPU_CLASS(oc);
     CpuDefinitionInfoList **cpu_list = user_data;
     CpuDefinitionInfo *info;
     const char *typename;
@@ -231,6 +232,7 @@ static void arm_cpu_add_definition(gpointer data, gpointer user_data)
     info = g_malloc0(sizeof(*info));
     info->name = cpu_model_from_type(typename);
     info->q_typename = g_strdup(typename);
 +    info->deprecated = !!cc->deprecation_note;
     QAPI_LIST_PREPEND(*cpu_list, info);
 }
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index ab8d007a86..e5dce20f19 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -2546,6 +2546,10 @@ static void cpu_register_class_init(ObjectClass *oc, void *data)
     acc->info = data;
     cc->gdb_core_xml_file = "arm-core.xml";
 +
 +    if (acc->info->deprecation_note) {
 +        cc->deprecation_note = acc->info->deprecation_note;
 +    }
 }
 void arm_cpu_register(const ARMCPUInfo *info)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index bc0c84873f..e9472c8bb8 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
@@ -37,6 +37,8 @@
 #define KVM_HAVE_MCE_INJECTION 1
 #endif
 +#define RHEL_CPU_DEPRECATION "use 'host' / 'max'"
 +
 #define EXCP_UDEF            1   /* undefined instruction */
 #define EXCP_SWI             2   /* software interrupt */
 #define EXCP_PREFETCH_ABORT  3
@@ -1092,6 +1094,7 @@ typedef struct ARMCPUInfo {
     const char *name;
     void (*initfn)(Object *obj);
     void (*class_init)(ObjectClass *oc, void *data);
 +    const char *deprecation_note;
 } ARMCPUInfo;
 /**
 diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index 985b1efe16..46a4e80171 100644
 --- a/target/arm/cpu64.c
 +++ b/target/arm/cpu64.c
@@ -648,6 +648,7 @@ static void aarch64_a57_initfn(Object *obj)
     define_cortex_a72_a57_a53_cp_reginfo(cpu);
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void aarch64_a53_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
@@ -704,6 +705,7 @@ static void aarch64_a53_initfn(Object *obj)
     cpu->gic_pribits = 5;
     define_cortex_a72_a57_a53_cp_reginfo(cpu);
 }
 +#endif
 static void aarch64_host_initfn(Object *obj)
 {
@@ -742,8 +744,11 @@ static void aarch64_max_initfn(Object *obj)
 }
 static const ARMCPUInfo aarch64_cpus[] = {
 -    { .name = "cortex-a57",         .initfn = aarch64_a57_initfn },
 +    { .name = "cortex-a57",         .initfn = aarch64_a57_initfn,
 +      .deprecation_note = RHEL_CPU_DEPRECATION },
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
     { .name = "cortex-a53",         .initfn = aarch64_a53_initfn },
 +#endif /* disabled for RHEL */
     { .name = "max",                .initfn = aarch64_max_initfn },
 #if defined(CONFIG_KVM) || defined(CONFIG_HVF)
     { .name = "host",               .initfn = aarch64_host_initfn },
@@ -814,8 +819,13 @@ static void aarch64_cpu_instance_init(Object *obj)
 static void cpu_register_class_init(ObjectClass *oc, void *data)
 {
     ARMCPUClass *acc = ARM_CPU_CLASS(oc);
 +    CPUClass *cc = CPU_CLASS(oc);
     acc->info = data;
 +
 +    if (acc->info->deprecation_note) {
 +        cc->deprecation_note = acc->info->deprecation_note;
 +    }
 }
 void aarch64_cpu_register(const ARMCPUInfo *info)
 diff --git a/target/arm/tcg/cpu32.c b/target/arm/tcg/cpu32.c
 index de8f2be941..8896295ae3 100644
 --- a/target/arm/tcg/cpu32.c
 +++ b/target/arm/tcg/cpu32.c
@@ -92,6 +92,7 @@ void aa32_max_features(ARMCPU *cpu)
     cpu->isar.id_dfr1 = t;
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 /* CPU models. These are not needed for the AArch64 linux-user build. */
 #if !defined(CONFIG_USER_ONLY) || !defined(TARGET_AARCH64)
@@ -1037,3 +1038,4 @@ static void arm_tcg_cpu_register_types(void)
 type_init(arm_tcg_cpu_register_types)
 #endif /* !CONFIG_USER_ONLY || !TARGET_AARCH64 */
 +#endif /* disabled for RHEL */
 diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
 index 9f7a9f3d2c..7ec6851c9c 100644
 --- a/target/arm/tcg/cpu64.c
 +++ b/target/arm/tcg/cpu64.c
@@ -29,6 +29,7 @@
 #include "cpu-features.h"
 #include "cpregs.h"
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static uint64_t make_ccsidr64(unsigned assoc, unsigned linesize,
                               unsigned cachesize)
 {
@@ -134,6 +135,7 @@ static void aarch64_a35_initfn(Object *obj)
     /* These values are the same with A53/A57/A72. */
     define_cortex_a72_a57_a53_cp_reginfo(cpu);
 }
 +#endif
 static void cpu_max_get_sve_max_vq(Object *obj, Visitor *v, const char *name,
                                    void *opaque, Error **errp)
@@ -223,6 +225,7 @@ static void cpu_max_get_l0gptsz(Object *obj, Visitor *v, const char *name,
 static Property arm_cpu_lpa2_property =
     DEFINE_PROP_BOOL("lpa2", ARMCPU, prop_lpa2, true);
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void aarch64_a55_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
@@ -1065,6 +1068,7 @@ static void aarch64_neoverse_n2_initfn(Object *obj)
     aarch64_add_pauth_properties(obj);
     aarch64_add_sve_properties(obj);
 }
 +#endif
 /*
  * -cpu max: a CPU with as many features enabled as our emulation supports.
@@ -1271,6 +1275,7 @@ void aarch64_max_tcg_initfn(Object *obj)
     qdev_property_add_static(DEVICE(obj), &arm_cpu_lpa2_property);
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static const ARMCPUInfo aarch64_cpus[] = {
     { .name = "cortex-a35",         .initfn = aarch64_a35_initfn },
     { .name = "cortex-a55",         .initfn = aarch64_a55_initfn },
@@ -1282,14 +1287,17 @@ static const ARMCPUInfo aarch64_cpus[] = {
     { .name = "neoverse-v1",        .initfn = aarch64_neoverse_v1_initfn },
     { .name = "neoverse-n2",        .initfn = aarch64_neoverse_n2_initfn },
 };
 +#endif
 static void aarch64_cpu_register_types(void)
 {
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
     size_t i;
     for (i = 0; i < ARRAY_SIZE(aarch64_cpus); ++i) {
         aarch64_cpu_register(&aarch64_cpus[i]);
     }
 +#endif
 }
 type_init(aarch64_cpu_register_types)
 diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
 index 3b1a9f0fc5..6898b4de6f 100644
 --- a/target/arm/tcg/meson.build
 +++ b/target/arm/tcg/meson.build
@@ -56,5 +56,5 @@ arm_system_ss.add(files(
   'psci.c',
 ))
 -arm_system_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('cpu-v7m.c'))
 -arm_user_ss.add(when: 'TARGET_AARCH64', if_false: files('cpu-v7m.c'))
 +#arm_system_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('cpu-v7m.c'))
 +#arm_user_ss.add(when: 'TARGET_AARCH64', if_false: files('cpu-v7m.c'))
 diff --git a/target/ppc/cpu-models.c b/target/ppc/cpu-models.c
 index f2301b43f7..f77ebfcc81 100644
 --- a/target/ppc/cpu-models.c
 +++ b/target/ppc/cpu-models.c
@@ -66,6 +66,7 @@
 #define POWERPC_DEF(_name, _pvr, _type, _desc)                              \
     POWERPC_DEF_SVR(_name, _desc, _pvr, POWERPC_SVR_NONE, _type)
 +#if 0  /* Embedded and 32-bit CPUs disabled for Red Hat Enterprise Linux */
     /* Embedded PowerPC                                                      */
     /* PowerPC 405 family                                                    */
     /* PowerPC 405 cores                                                     */
@@ -698,8 +699,10 @@
                 "PowerPC 7447A v1.2 (G4)")
     POWERPC_DEF("7457a_v1.2",    CPU_POWERPC_74x7A_v12,              7455,
                 "PowerPC 7457A v1.2 (G4)")
 +#endif
     /* 64 bits PowerPC                                                       */
 #if defined(TARGET_PPC64)
 +#if 0  /* Disabled for Red Hat Enterprise Linux */
     POWERPC_DEF("970_v2.2",      CPU_POWERPC_970_v22,                970,
                 "PowerPC 970 v2.2")
     POWERPC_DEF("970fx_v1.0",    CPU_POWERPC_970FX_v10,              970,
@@ -718,6 +721,7 @@
                 "PowerPC 970MP v1.1")
     POWERPC_DEF("power5p_v2.1",  CPU_POWERPC_POWER5P_v21,            POWER5P,
                 "POWER5+ v2.1")
 +#endif
     POWERPC_DEF("power7_v2.3",   CPU_POWERPC_POWER7_v23,             POWER7,
                 "POWER7 v2.3")
     POWERPC_DEF("power7p_v2.1",  CPU_POWERPC_POWER7P_v21,            POWER7,
@@ -894,13 +898,16 @@ PowerPCCPUAlias ppc_cpu_aliases[] = {
     { "7447a", "7447a_v1.2" },
     { "7457a", "7457a_v1.2" },
     { "apollo7pm", "7457a_v1.0" },
 +#endif
 #if defined(TARGET_PPC64)
 +#if 0  /* Disabled for Red Hat Enterprise Linux */
     { "970", "970_v2.2" },
     { "970fx", "970fx_v3.1" },
     { "970mp", "970mp_v1.1" },
     { "power5+", "power5p_v2.1" },
     { "power5+_v2.1", "power5p_v2.1" },
     { "power5gs", "power5+_v2.1" },
 +#endif
     { "power7", "power7_v2.3" },
     { "power7+", "power7p_v2.1" },
     { "power7+_v2.1", "power7p_v2.1" },
@@ -911,12 +918,14 @@ PowerPCCPUAlias ppc_cpu_aliases[] = {
     { "power10", "power10_v2.0" },
 #endif
 +#if 0  /* Disabled for Red Hat Enterprise Linux */
     /* Generic PowerPCs */
 #if defined(TARGET_PPC64)
     { "ppc64", "970fx_v3.1" },
 #endif
     { "ppc32", "604" },
     { "ppc", "604" },
 +#endif
     { NULL, NULL }
 };
 diff --git a/target/s390x/cpu_models_sysemu.c b/target/s390x/cpu_models_sysemu.c
 index 2d99218069..0728bfcc20 100644
 --- a/target/s390x/cpu_models_sysemu.c
 +++ b/target/s390x/cpu_models_sysemu.c
@@ -34,6 +34,9 @@ static void check_unavailable_features(const S390CPUModel *max_model,
         (max_model->def->gen == model->def->gen &&
          max_model->def->ec_ga < model->def->ec_ga)) {
         list_add_feat("type", unavailable);
 +    } else if (model->def->gen < 11 && kvm_enabled()) {
 +        /* Older CPU models are not supported on Red Hat Enterprise Linux */
 +        list_add_feat("type", unavailable);
     }
     /* detect missing features if any to properly report them */
 diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c
 index 4ce809c5d4..55fb4855b1 100644
 --- a/target/s390x/kvm/kvm.c
 +++ b/target/s390x/kvm/kvm.c
@@ -2565,6 +2565,14 @@ void kvm_s390_apply_cpu_model(const S390CPUModel *model, Error **errp)
         error_setg(errp, "KVM doesn't support CPU models");
         return;
     }
 +
 +    /* Older CPU models are not supported on Red Hat Enterprise Linux */
 +    if (model->def->gen < 11) {
 +        error_setg(errp, "KVM: Unsupported CPU type specified: %s",
 +                   MACHINE(qdev_get_machine())->cpu_type);
 +        return;
 +    }
 +
     prop.cpuid = s390_cpuid_from_cpu_model(model);
     prop.ibc = s390_ibc_from_cpu_model(model);
     /* configure cpu features indicated via STFL(e) */
 diff --git a/tests/qtest/arm-cpu-features.c b/tests/qtest/arm-cpu-features.c
 index 9d6e6190d5..f822526acb 100644
 --- a/tests/qtest/arm-cpu-features.c
 +++ b/tests/qtest/arm-cpu-features.c
@@ -452,8 +452,10 @@ static void test_query_cpu_model_expansion(const void *data)
     assert_error(qts, "host", "The CPU type 'host' requires KVM", NULL);
     /* Test expected feature presence/absence for some cpu types */
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
     assert_has_feature_enabled(qts, "cortex-a15", "pmu");
     assert_has_not_feature(qts, "cortex-a15", "aarch64");
 +#endif /* disabled for RHEL */
     /* Enabling and disabling pmu should always work. */
     assert_has_feature_enabled(qts, "max", "pmu");
@@ -470,6 +472,7 @@ static void test_query_cpu_model_expansion(const void *data)
         assert_has_feature_enabled(qts, "cortex-a57", "pmu");
         assert_has_feature_enabled(qts, "cortex-a57", "aarch64");
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
         assert_has_feature_enabled(qts, "a64fx", "pmu");
         assert_has_feature_enabled(qts, "a64fx", "aarch64");
         /*
@@ -482,6 +485,7 @@ static void test_query_cpu_model_expansion(const void *data)
                      "{ 'sve384': true }");
         assert_error(qts, "a64fx", "cannot enable sve640",
                      "{ 'sve640': true }");
 +#endif /* disabled for RHEL */
         sve_tests_default(qts, "max");
         pauth_tests_default(qts, "max");
 -- 
 2.39.3
--- a/SOURCES/0005-Initial-redhat-build.patch
+++ b/SOURCES/0005-Initial-redhat-build.patch
@ -0,0 +1,351 @@
 From 19ce5ff93ddd6b8a998348f2a5f59f603c5e11b7 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 12 Oct 2018 07:31:11 +0200
 Subject: Initial redhat build
 This patch introduces redhat build structure in redhat subdirectory. In addition,
 several issues are fixed in QEMU tree:
 - Change of app name for sasl_server_init in VNC code from qemu to qemu-kvm
  - As we use qemu-kvm as name in all places, this is updated to be consistent
 - Man page renamed from qemu to qemu-kvm
  - man page is installed using make install so we have to fix it in qemu tree
 This rebase includes changes up to qemu-kvm-6.1.0-5.el9
 Rebase notes (3.1.0):
 - added new configure options
 Rebase notes (4.0.0):
 - Added dependency to perl-Test-Harness (upstream)
 - Added dependency to python3-sphinx (upstream)
 - Change location of icons (upstream)
 - Remove .desktop file (added upstream)
 - Added qemu-trace-stap (added upstream)
 - Removed elf2dmp (added upstream)
 - Remove .buildinfo
 - Added pvh.bin rom (added upstream)
 - Added interop documentation files
 - Use python module instead of qemu.py (upstream)
 Rebase notes (4.1.0):
 - Remove edk2 files generated by build
 - Switch to rhel-8.1-candidate build target
 - Remove specs documentation
 - Switched from libssh2 to libssh
 - Add rc0 tarball usage hacks
 - Added BuildRequires for wget, rpm-build and python3-sphinx
 - Removed new unpacked files
 - Update configure line to use new options
 Rebase notes (4.2.0):
 - Disable iotest run during make check
 - README renamed to README.rst (upstream)
 - Removed ui-spice-app.so
 - Added relevant changes from "505f7f4 redhat: Adding slirp to the exploded tree"
 - Removed qemu-ga.8 install from spec file - installed by make
 - Removed spapr-rtas.bin (upstream)
 - Require newer SLOF (20191022)
 Rebase notes (5.1.0):
 - Use python3 for virtio_seg_max_adjust.py test
 - Removed qemu-trace-stap shebang from spec file
 - Added virtiofsd.1 (upstream)
 - Use out-of-tree build
 - New documentation structure (upstream)
 - Update local build
 - Removing installed qemu-storage-daemon (added upstream)
 - Removing opensbi-riscv32-sifive_u-fw_jump.bin (added upstream)
 - Disable iotests (moved from Enable make check commit)
 - Added missing configure options
 - Reorder configure options
 - qemu-pr-helper moved to /usr/libexec/ (upstream)
 - Added submodules for usb-redir, smartcard-reader and qxl display (upstream)
 - Added setting rc version in Makefile for build
 - removed --disable-vxhs configure option (removed upstream)
 - bumped required libusbx-devel version to 1.0.23
 - bumped libfdt version to 1.6.0
 Rebase notes (5.2.0 rc0):
 - Move libfdt dependency to qemu-kvm-core
 - Move manpage rename from Makefile to spec file
 - rename with-confsuffix configure option to with-suffix (upstream)
 - Bump libusbx Requires version to 1.0.234
 - Manual copy of keymaps in spec file (BZ 1875217)
 - Removed /usr/share/qemu-kvm/npcm7xx_bootrom.bin, considering it
  unpackaged for now.
 - Removed /usr/share/qemu-kvm/qboot.rom, considering unpackaged.
 - Added build dependency for meson and ninja-build
 - hw/s390/s390-pci-vfio.c hack - set NULL for g_autofree variables
 - Removed Chanelog (upstream)
 - Fix in directory used for docs (upstream add %name so we do not pass it in configure)
 - Package various .so as part of qemu-kvm-core package.
 Rebase notes (5.2.0 rc2):
 - Added fix for dtrace build on RHEL 8.4.0
 Rebase notes (5.2.0 rc3):
 - Added man page for qemu-pr-helper
 - Added new configure options
 - Update qemu-kiwi patches to v4
 Rebase notes (6.0.0):
 - update tracetool usage in spec file
 - remove qemu-storage-daemon-qmp-ref man page
 - remove qemu-storage-daemon man page
 - Added devel documentation
 - do not package virtfs-proxy-helper files
 - Use --with-git-submodules instead of --(enable|disable)-git-update
 - Minor build fixes for sending upstream
 - g_autofree initialization fixed upstream
 - Updated rc information usage
 - do not package package hw-s390x-virtio-gpu-ccw.so
 - Disable new switch options
 Rebase notes (6.1.0):
 - Fix warning issue in block.c
 - Download tarball from dist-git cache
 - Removed sheepdog driver
 - Added new display modules:
  - hw-display-virtio-gpu-gl.so
  - hw-display-virtio-gpu-pci-gl.so
  - hw-display-virtio-vga-gl.so
 - sasl fix moved from ui/vnc.c to ui/vnc-auth-sasl.c
 - Added accel-qtest-%{kvm_target} and accel-tcg-%{kvm_target}
 - Added about docs
 - Use -q option for setup
 - Added hw-usb-host.so
 - Disable new options (bpf, nvmm, slirp-smbd)
 Rebase notes (6.2.0):
 - Using internal meson
 - removed --disable-jemalloc and --disable-tcmalloc configure options
 - added audio-oss.so
 - added fdt requirement for x86_64
 - tests/acceptance renamed to tests/avocado
 - added multiboot_dma.bin
 - Removed conflict relics
 - Updated configure options
 Merged patches (3.1.0):
 - 01f0c9f RHEL8: Add disable configure options to qemu spec file
 - Spec file cleanups
 Merged patches (4.0.0):
 - aa4297c Add edk2 Requires to qemu-kvm
 - d124ff5779 Fixing brew build target
 - eb204b5 Introduce the qemu-kvm-tests rpm
 - 223cf0c Load kvm module during boot (partial)
 Merged patches (4.1.0):
 - ebb6e97 redhat: Fix LOCALVERSION creation
 - b0ab0cc redhat: enable tpmdev passthrough (not disabling tests)
 - 7cb3c4a Enable libpmem to support nvdimm
 - 8943607 qemu-kvm.spec: bump libseccomp >= 2.4.0
 - 27b7c44 rh: set CONFIG_BOCHS_DISPLAY=y for x86 (partial)
 - e1fe9fe x86_64-rh-devices: enable TPM emulation (partial)
 Merged patches (4.2.0):
 - 69e1fb2 enable virgla
 - d4f6115 enable virgl, for real this time ...
 Merged patches (5.1.0):
 - 5edf6bd Add support for rh-brew-module
 - f77d52d redhat: ship virtiofsd vhost-user device backend
 - 63f12d4 redhat: Always use module build target for rh-brew (modified)
 - 9b1e140 redhat: updating the modular target
 - 44b8bd0 spec: Fix python shenigans for tests
 Merged patches (5.2.0 rc0):
 - 9238ce7 Add support for simpletrace
 - 5797cff Remove explicit glusterfs-api dependency
 - fd62478 disable virgl
 - 0205018 redhat: link /etc/qemu-ga/fsfreeze-hook to /etc/qemu-kvm/
 - 3645097 redhat: Make all generated so files executable (not only block-*)
 Merged patches (5.2.0 rc2):
 - pjw 99657 redhat: introduces disable_everything macro into the configure call
 - pjw 99659 redhat: scripts/extract_build_cmd.py - Avoid listing empty lines
 - pjw 99658 redhat: Fixing rh-local build
 - pjw 99660 redhat: Add qemu-kiwi subpackage
 - d2e59ce redhat: add (un/pre)install systemd hooks for qemu-ga
 Merged patches (5.2.0 rc3):
 - pjw 99887 - redhat: allow Makefile rh-prep builddep to fail
 - pjw 99885 - redhat: adding rh-rpm target
 Merged patches (6.0.0):
 - 5ab9954a3b spec: find system python via meson
 - cd0f7db11f build-system: use b_staticpic=false
 - 80d2dec42c udev-kvm-check: remove the "exceeded subscription limit" message
 - 38959d51c0 redhat: Allow make to inherit params from parent make for rh-local
 - 1e0cfe458f redhat: moving all documentation files to qemu-kvm-docs
 - d7a594d02b redhat: makes qemu respect system's crypto profile
 - e2bbf1572b spec: Package qemu-storage-daemon
 - 92f10993ba spec: ui-spice sub-package
 - 8931e46069 spec: ui-opengl sub-package
 Merged patches (6.1.0):
 - 7bb57541b3 redhat: Install the s390-netboot.img that we've built
 - b4a8531f41 redhat: Fix "unversioned Obsoletes" warning
 - 141a1693c7 redhat: Move qemu-kvm-docs dependency to qemu-kvm
 - d75f59c6f9 redhat: introducting qemu-kvm-hw-usbredir
 - a934d8bf44 redhat: use the standard vhost-user JSON path
 Merged patches (6.2.0):
 - 4f3f04bbb6 spec: Remove qemu-kiwi build
 ---
 .gitignore                                 |    1 +
 .gitlab-ci.yml                             |   24 -
 .gitlab/issue_templates/bug.md             |   64 -
 .gitlab/issue_templates/feature_request.md |   32 -
 README.systemtap                           |   43 +
 meson.build                                |    4 +-
 redhat/Makefile                            |   90 +
 redhat/Makefile.common                     |   48 +
 redhat/README.tests                        |   39 +
 redhat/qemu-kvm.spec.template              | 3896 ++++++++++++++++++++
 redhat/scripts/extract_build_cmd.py        |    5 +-
 redhat/scripts/process-patches.sh          |   20 +-
 redhat/scripts/tarball_checksum.sh         |    2 +-
 redhat/udev-kvm-check.c                    |   19 +-
 scripts/qemu-guest-agent/fsfreeze-hook     |    2 +-
 scripts/systemtap/conf.d/qemu_kvm.conf     |    4 +
 scripts/systemtap/script.d/qemu_kvm.stp    |    1 +
 tests/check-block.sh                       |    2 +
 ui/vnc-auth-sasl.c                         |    2 +-
 19 files changed, 4142 insertions(+), 156 deletions(-)
 delete mode 100644 .gitlab-ci.yml
 delete mode 100644 .gitlab/issue_templates/bug.md
 delete mode 100644 .gitlab/issue_templates/feature_request.md
 create mode 100644 README.systemtap
 create mode 100644 redhat/Makefile
 create mode 100644 redhat/Makefile.common
 create mode 100644 redhat/README.tests
 create mode 100644 redhat/qemu-kvm.spec.template
 create mode 100644 scripts/systemtap/conf.d/qemu_kvm.conf
 create mode 100644 scripts/systemtap/script.d/qemu_kvm.stp
 diff --git a/README.systemtap b/README.systemtap
 new file mode 100644
 index 0000000000..ad913fc990
 --- /dev/null
 +++ b/README.systemtap
@@ -0,0 +1,43 @@
 +QEMU tracing using systemtap-initscript
 +---------------------------------------
 +
 +You can capture QEMU trace data all the time using systemtap-initscript.  This
 +uses SystemTap's flight recorder mode to trace all running guests to a
 +fixed-size buffer on the host.  Old trace entries are overwritten by new
 +entries when the buffer size wraps.
 +
 +1. Install the systemtap-initscript package:
 +  # yum install systemtap-initscript
 +
 +2. Install the systemtap scripts and the conf file:
 +  # cp /usr/share/qemu-kvm/systemtap/script.d/qemu_kvm.stp /etc/systemtap/script.d/
 +  # cp /usr/share/qemu-kvm/systemtap/conf.d/qemu_kvm.conf /etc/systemtap/conf.d/
 +
 +The set of trace events to enable is given in qemu_kvm.stp.  This SystemTap
 +script can be customized to add or remove trace events provided in
 +/usr/share/systemtap/tapset/qemu-kvm-simpletrace.stp.
 +
 +SystemTap customizations can be made to qemu_kvm.conf to control the flight
 +recorder buffer size and whether to store traces in memory only or disk too.
 +See stap(1) for option documentation.
 +
 +3. Start the systemtap service.
 +　# service systemtap start qemu_kvm
 +
 +4. Make the service start at boot time.
 +　# chkconfig systemtap on
 +
 +5. Confirm that the service works.
 +  # service systemtap status qemu_kvm
 +  qemu_kvm is running...
 +
 +When you want to inspect the trace buffer, perform the following steps:
 +
 +1. Dump the trace buffer.
 +  # staprun -A qemu_kvm >/tmp/trace.log
 +
 +2. Start the systemtap service because the preceding step stops the service.
 +  # service systemtap start qemu_kvm
 +
 +3. Translate the trace record to readable format.
 +  # /usr/share/qemu-kvm/simpletrace.py --no-header /usr/share/qemu-kvm/trace-events /tmp/trace.log
 diff --git a/meson.build b/meson.build
 index 96de1a6ef9..5f6ba86dbb 100644
 --- a/meson.build
 +++ b/meson.build
@@ -2108,7 +2108,9 @@ if capstone_opt == 'internal'
     # Include all configuration defines via a header file, which will wind up
     # as a dependency on the object file, and thus changes here will result
     # in a rebuild.
 -    '-include', 'capstone-defs.h'
 +    '-include', 'capstone-defs.h',
 +
 +    '-Wp,-D_GLIBCXX_ASSERTIONS',
   ]
   libcapstone = static_library('capstone',
 diff --git a/scripts/qemu-guest-agent/fsfreeze-hook b/scripts/qemu-guest-agent/fsfreeze-hook
 index 13aafd4845..e9b84ec028 100755
 --- a/scripts/qemu-guest-agent/fsfreeze-hook
 +++ b/scripts/qemu-guest-agent/fsfreeze-hook
@@ -8,7 +8,7 @@
 # request, it is issued with "thaw" argument after filesystem is thawed.
 LOGFILE=/var/log/qga-fsfreeze-hook.log
 -FSFREEZE_D=$(dirname -- "$0")/fsfreeze-hook.d
 +FSFREEZE_D=$(dirname -- "$(realpath $0)")/fsfreeze-hook.d
 # Check whether file $1 is a backup or rpm-generated file and should be ignored
 is_ignored_file() {
 diff --git a/scripts/systemtap/conf.d/qemu_kvm.conf b/scripts/systemtap/conf.d/qemu_kvm.conf
 new file mode 100644
 index 0000000000..372d8160a4
 --- /dev/null
 +++ b/scripts/systemtap/conf.d/qemu_kvm.conf
@@ -0,0 +1,4 @@
 +# Force load uprobes (see BZ#1118352)
 +stap -e 'probe process("/usr/libexec/qemu-kvm").function("main") { printf("") }' -c true
 +
 +qemu_kvm_OPT="-s4" # per-CPU buffer size, in megabytes
 diff --git a/scripts/systemtap/script.d/qemu_kvm.stp b/scripts/systemtap/script.d/qemu_kvm.stp
 new file mode 100644
 index 0000000000..c04abf9449
 --- /dev/null
 +++ b/scripts/systemtap/script.d/qemu_kvm.stp
@@ -0,0 +1 @@
 +probe qemu.kvm.simpletrace.handle_qmp_command,qemu.kvm.simpletrace.monitor_protocol_*,qemu.kvm.simpletrace.migrate_set_state {}
 diff --git a/tests/check-block.sh b/tests/check-block.sh
 index f86cb863de..6d38340d49 100755
 --- a/tests/check-block.sh
 +++ b/tests/check-block.sh
@@ -69,6 +69,8 @@ else
     fi
 fi
 +exit 0
 +
 cd tests/qemu-iotests
 # QEMU_CHECK_BLOCK_AUTO is used to disable some unstable sub-tests
 diff --git a/ui/vnc-auth-sasl.c b/ui/vnc-auth-sasl.c
 index 47fdae5b21..2a950caa2a 100644
 --- a/ui/vnc-auth-sasl.c
 +++ b/ui/vnc-auth-sasl.c
@@ -42,7 +42,7 @@
 bool vnc_sasl_server_init(Error **errp)
 {
 -    int saslErr = sasl_server_init(NULL, "qemu");
 +    int saslErr = sasl_server_init(NULL, "qemu-kvm");
     if (saslErr != SASL_OK) {
         error_setg(errp, "Failed to initialize SASL auth: %s",
 -- 
 2.27.0
--- a/SOURCES/0006-Enable-disable-devices-for-RHEL.patch
+++ b/SOURCES/0006-Enable-disable-devices-for-RHEL.patch
@ -0,0 +1,795 @@
 From 3d5a82d172345d17e300672909835262ff9dc917 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 2 Sep 2020 09:11:07 +0200
 Subject: Enable/disable devices for RHEL
 This commit adds all changes related to changes in supported devices.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 Rebase notes (qemu 3.1.0)
 - spapr_rng disabled in default_config
 - new hyperv.mak in default configs
 - Move changes from x86_64-softmmu.mak to i386-softmmu.mak
 - Added CONFIG_VIRTIO_MMIO to aarch64-softmmu.mak
 - Removed config_vga_isa.c changes as no longer needed
 - Removed new devices
 Rebase notes (4.0.0):
 - Added CONFIG_PCI_EXPRESS_GENERIC_BRIDGE for aarch64-softmmu.mak
 - Added CONFIG_ARM_VIRT for aarch64-softmmu.mak
 - Switch to KConfig (upstream)
 - Using device whitelist + without-defualt-devices option
 Rebase notes (4.1.0):
 - Added CONFIG_USB_OHCI_PCI for ppc64
 - Added CONFIG_XIVE_KVM for ppc64
 - Added CONFIG_ACPI_PCI for x86_64
 - Added CONFIG_SEMIHOSTING for aarch64
 - Cleanup aarch64 devices
 - Do not build a15mpcore.c
 - Removed ide-isa.c stub file
 - Use CONFIG_USB_EHCI_PCI on x86_64 (new upstream)
 Rebase notes (4.2.0-rc0):
 - Use conditional build for isa-superio.c (upstream change)
 - Rename PCI_PIIX to PCI_I440FX (upstream change)
 Rebase notes (4.2.0-rc3):
 - Disabled ccid-card-emulated (patch 92566)
 - Disabled vfio-pci-igd-lpc-bridge (patch 92565)
 Rebase notes (5.1.0):
 - added CONFIG_PCI_EXPRESS on ppc64 (due to upstream dependency)
 - Added CONFIG_NVDIMM
 - updated cortex-15 disabling to upstream code
 - Add CONFIG_ACPI_APEI for aarch64
 - removed obsolete hw/bt/Makefile.objs chunk
 - removed unnecessary changes in target/i386/cpu.c
 Rebase notes (5.2.0 rc0):
 - Added CONFIG_USB_XHCI_PCI on aarch64 ppc64 and x86_64
 - remove vl.c hack for no hpet
 - Enable CONFIG_PTIMER for aarch64
 - Do not package hw-display-virtio-gpu.so on s390x
 Rebase notes (5.2.0 rc1):
 - Added CONFIG_ARM_GIC for aarch64 (required for build)
 Rebase notes (weekly-210113):
 - Removed XICS_KVM, XICS_SPAPR, XIVE_KVM and XIVE_SPAPR config (removed upstream)
 Rebase notes (weekly-210120):
 - Add CONFIG_ARM_COMPATIBLE_SEMIHOSTING option
 Rebase notes (weekly-210203):
 - Rename CONFIG_PVPANIC to CONFIG_PVPANIC_ISA
 Rebase notes (weekly-210317):
 - Add new USB_STORAGE_CORE and USB_STORAGE_CLASSIC config for ppc64 and x86_64
 - Update disabling TCG cpus for AArch64
 Rebase notes (weekly-210519):
 - Do not use CONFIG_SPICE and CONFIG_OPENGL in default configs
 Rebase notes (weekly-210623):
 - Add CONFIG_TPM for archs with used TPM functionality
 Rebase notes (weekly-210714):
 - default_configs moved to configs
 Rebase notes (6.1.0 rc2):
 - Use --with-device-ARCH configure option to use redhat config files
 Rebase notes (6.2.0 rc3):
 - Do not remove -no-hpet documentation
 Merged patches (qemu 3.1.0):
 - d51e082 Re-enable CONFIG_HYPERV_TESTDEV
 - 4b889f3 Declare cirrus-vga as deprecated
 - b579d32 Do not build bluetooth support
 - 3eef52a Disable CONFIG_IPMI and CONFIG_I2C for ppc64
 - 9caf292 Disable CONFIG_CAN_BUS and CONFIG_CAN_SJA1000
 Merged patches (4.1.0):
 - 20a51f6 fdc: Revert downstream disablement of device "floppy"
 - f869cc0 fdc: Restrict floppy controllers to RHEL-7 machine types
 - 5909721 aarch64: Compile out IOH3420
 - 27b7c44 rh: set CONFIG_BOCHS_DISPLAY=y for x86 (partial)
 - 495a27d x86_64-rh-devices: add missing TPM passthrough
 - e1fe9fe x86_64-rh-devices: enable TPM emulation (partial)
 Merged patches (4.2.0):
 - f7587dd RHEL: disable hostmem-memfd
 Merged patches (5.1.0):
 - 4543a3c i386: Remove cpu64-rhel6 CPU model
 - 96533 aarch64: Remove tcg cpu types (pjw commit)
 - 559d589 Revert "RHEL: disable hostmem-memfd"
 - 441128e enable ramfb
 Merged patches (5.2.0 rc0):
 - f70eb50 RHEL-only: Enable vTPM for POWER in downstream configs
 - 69d8ae7 redhat: fix 5.0 rebase missing ISA TPM TIS
 - 8310f89 RHEL-only: Enable vTPM for ARM in downstream configs
 - 4a8ccfd Disable TPM passthrough backend on ARM
 Merged patches (6.0.0):
 - ff817df9e3 config: enable VFIO_CCW
 - 70d3924521 redhat: Add some devices for exporting upstream machine types
 - without machine type chunks
 - efac91b2b4 default-configs: Enable vhost-user-blk
 Merged patches (weekly-210630):
 - 59a178acff disable CONFIG_USB_STORAGE_BOT
 Merged patches (6.1.0 rc2):
 - 86f0025f16 aarch64: Add USB storage devices
 ---
 .../aarch64-softmmu/aarch64-rh-devices.mak    |  31 ++++++
 .../ppc64-softmmu/ppc64-rh-devices.mak        |  36 ++++++
 configs/devices/rh-virtio.mak                 |  10 ++
 .../s390x-softmmu/s390x-rh-devices.mak        |  16 +++
 .../x86_64-softmmu/x86_64-rh-devices.mak      | 104 ++++++++++++++++++
 .../x86_64-upstream-devices.mak               |   4 +
 hw/acpi/ich9.c                                |   4 +-
 hw/arm/meson.build                            |   2 +-
 hw/block/fdc.c                                |  10 ++
 hw/char/parallel.c                            |   9 ++
 hw/cpu/meson.build                            |   5 +-
 hw/display/cirrus_vga.c                       |   3 +
 hw/ide/piix.c                                 |   5 +-
 hw/input/pckbd.c                              |   2 +
 hw/net/e1000.c                                |   2 +
 hw/ppc/spapr_cpu_core.c                       |   2 +
 hw/timer/hpet.c                               |   8 ++
 hw/usb/meson.build                            |   2 +-
 redhat/qemu-kvm.spec.template                 |   9 +-
 target/arm/cpu_tcg.c                          |  10 ++
 target/ppc/cpu-models.c                       |  10 ++
 target/s390x/cpu_models_sysemu.c              |   3 +
 target/s390x/kvm/kvm.c                        |   8 ++
 23 files changed, 286 insertions(+), 9 deletions(-)
 create mode 100644 configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
 create mode 100644 configs/devices/ppc64-softmmu/ppc64-rh-devices.mak
 create mode 100644 configs/devices/rh-virtio.mak
 create mode 100644 configs/devices/s390x-softmmu/s390x-rh-devices.mak
 create mode 100644 configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 create mode 100644 configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak
 diff --git a/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak b/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
 new file mode 100644
 index 0000000000..0d4f9e6e4b
 --- /dev/null
 +++ b/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
@@ -0,0 +1,31 @@
 +include ../rh-virtio.mak
 +
 +CONFIG_ARM_GIC_KVM=y
 +CONFIG_ARM_GIC=y
 +CONFIG_ARM_SMMUV3=y
 +CONFIG_ARM_V7M=y
 +CONFIG_ARM_VIRT=y
 +CONFIG_EDID=y
 +CONFIG_PCIE_PORT=y
 +CONFIG_PCI_DEVICES=y
 +CONFIG_PCI_TESTDEV=y
 +CONFIG_PFLASH_CFI01=y
 +CONFIG_SCSI=y
 +CONFIG_SEMIHOSTING=y
 +CONFIG_USB=y
 +CONFIG_USB_XHCI=y
 +CONFIG_USB_XHCI_PCI=y
 +CONFIG_USB_STORAGE_CORE=y
 +CONFIG_USB_STORAGE_CLASSIC=y
 +CONFIG_VFIO=y
 +CONFIG_VFIO_PCI=y
 +CONFIG_VIRTIO_MMIO=y
 +CONFIG_VIRTIO_PCI=y
 +CONFIG_XIO3130=y
 +CONFIG_NVDIMM=y
 +CONFIG_ACPI_APEI=y
 +CONFIG_TPM=y
 +CONFIG_TPM_EMULATOR=y
 +CONFIG_TPM_TIS_SYSBUS=y
 +CONFIG_PTIMER=y
 +CONFIG_ARM_COMPATIBLE_SEMIHOSTING=y
 diff --git a/configs/devices/ppc64-softmmu/ppc64-rh-devices.mak b/configs/devices/ppc64-softmmu/ppc64-rh-devices.mak
 new file mode 100644
 index 0000000000..73e3ee0293
 --- /dev/null
 +++ b/configs/devices/ppc64-softmmu/ppc64-rh-devices.mak
@@ -0,0 +1,36 @@
 +include ../rh-virtio.mak
 +
 +CONFIG_DIMM=y
 +CONFIG_MEM_DEVICE=y
 +CONFIG_NVDIMM=y
 +CONFIG_PCI=y
 +CONFIG_PCI_DEVICES=y
 +CONFIG_PCI_TESTDEV=y
 +CONFIG_PCI_EXPRESS=y
 +CONFIG_PSERIES=y
 +CONFIG_SCSI=y
 +CONFIG_SPAPR_VSCSI=y
 +CONFIG_TEST_DEVICES=y
 +CONFIG_USB=y
 +CONFIG_USB_OHCI=y
 +CONFIG_USB_OHCI_PCI=y
 +CONFIG_USB_SMARTCARD=y
 +CONFIG_USB_STORAGE_CORE=y
 +CONFIG_USB_STORAGE_CLASSIC=y
 +CONFIG_USB_XHCI=y
 +CONFIG_USB_XHCI_NEC=y
 +CONFIG_USB_XHCI_PCI=y
 +CONFIG_VFIO=y
 +CONFIG_VFIO_PCI=y
 +CONFIG_VGA=y
 +CONFIG_VGA_PCI=y
 +CONFIG_VHOST_USER=y
 +CONFIG_VIRTIO_PCI=y
 +CONFIG_VIRTIO_VGA=y
 +CONFIG_WDT_IB6300ESB=y
 +CONFIG_XICS=y
 +CONFIG_XIVE=y
 +CONFIG_TPM=y
 +CONFIG_TPM_SPAPR=y
 +CONFIG_TPM_EMULATOR=y
 +CONFIG_TPM_PASSTHROUGH=y
 diff --git a/configs/devices/rh-virtio.mak b/configs/devices/rh-virtio.mak
 new file mode 100644
 index 0000000000..94ede1b5f6
 --- /dev/null
 +++ b/configs/devices/rh-virtio.mak
@@ -0,0 +1,10 @@
 +CONFIG_VIRTIO=y
 +CONFIG_VIRTIO_BALLOON=y
 +CONFIG_VIRTIO_BLK=y
 +CONFIG_VIRTIO_GPU=y
 +CONFIG_VIRTIO_INPUT=y
 +CONFIG_VIRTIO_INPUT_HOST=y
 +CONFIG_VIRTIO_NET=y
 +CONFIG_VIRTIO_RNG=y
 +CONFIG_VIRTIO_SCSI=y
 +CONFIG_VIRTIO_SERIAL=y
 diff --git a/configs/devices/s390x-softmmu/s390x-rh-devices.mak b/configs/devices/s390x-softmmu/s390x-rh-devices.mak
 new file mode 100644
 index 0000000000..165c082e87
 --- /dev/null
 +++ b/configs/devices/s390x-softmmu/s390x-rh-devices.mak
@@ -0,0 +1,16 @@
 +include ../rh-virtio.mak
 +
 +CONFIG_PCI=y
 +CONFIG_S390_CCW_VIRTIO=y
 +CONFIG_S390_FLIC=y
 +CONFIG_S390_FLIC_KVM=y
 +CONFIG_SCLPCONSOLE=y
 +CONFIG_SCSI=y
 +CONFIG_TERMINAL3270=y
 +CONFIG_VFIO=y
 +CONFIG_VFIO_AP=y
 +CONFIG_VFIO_CCW=y
 +CONFIG_VFIO_PCI=y
 +CONFIG_VHOST_USER=y
 +CONFIG_VIRTIO_CCW=y
 +CONFIG_WDT_DIAG288=y
 diff --git a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 new file mode 100644
 index 0000000000..ddf036f042
 --- /dev/null
 +++ b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
@@ -0,0 +1,104 @@
 +include ../rh-virtio.mak
 +include x86_64-upstream-devices.mak
 +
 +CONFIG_AC97=y
 +CONFIG_ACPI=y
 +CONFIG_ACPI_PCI=y
 +CONFIG_ACPI_CPU_HOTPLUG=y
 +CONFIG_ACPI_MEMORY_HOTPLUG=y
 +CONFIG_ACPI_NVDIMM=y
 +CONFIG_ACPI_SMBUS=y
 +CONFIG_ACPI_VMGENID=y
 +CONFIG_ACPI_X86=y
 +CONFIG_ACPI_X86_ICH=y
 +CONFIG_AHCI=y
 +CONFIG_APIC=y
 +CONFIG_APM=y
 +CONFIG_BOCHS_DISPLAY=y
 +CONFIG_DIMM=y
 +CONFIG_E1000E_PCI_EXPRESS=y
 +CONFIG_E1000_PCI=y
 +CONFIG_EDU=y
 +CONFIG_FDC=y
 +CONFIG_FDC_SYSBUS=y
 +CONFIG_FW_CFG_DMA=y
 +CONFIG_HDA=y
 +CONFIG_HYPERV=y
 +CONFIG_HYPERV_TESTDEV=y
 +CONFIG_I2C=y
 +CONFIG_I440FX=y
 +CONFIG_I8254=y
 +CONFIG_I8257=y
 +CONFIG_I8259=y
 +CONFIG_I82801B11=y
 +CONFIG_IDE_CORE=y
 +CONFIG_IDE_PCI=y
 +CONFIG_IDE_PIIX=y
 +CONFIG_IDE_QDEV=y
 +CONFIG_IOAPIC=y
 +CONFIG_IOH3420=y
 +CONFIG_ISA_BUS=y
 +CONFIG_ISA_DEBUG=y
 +CONFIG_ISA_TESTDEV=y
 +CONFIG_LPC_ICH9=y
 +CONFIG_MC146818RTC=y
 +CONFIG_MEM_DEVICE=y
 +CONFIG_NVDIMM=y
 +CONFIG_PAM=y
 +CONFIG_PC=y
 +CONFIG_PCI=y
 +CONFIG_PCIE_PORT=y
 +CONFIG_PCI_DEVICES=y
 +CONFIG_PCI_EXPRESS=y
 +CONFIG_PCI_EXPRESS_Q35=y
 +CONFIG_PCI_I440FX=y
 +CONFIG_PCI_TESTDEV=y
 +CONFIG_PCKBD=y
 +CONFIG_PCSPK=y
 +CONFIG_PC_ACPI=y
 +CONFIG_PC_PCI=y
 +CONFIG_PFLASH_CFI01=y
 +CONFIG_PVPANIC_ISA=y
 +CONFIG_PXB=y
 +CONFIG_Q35=y
 +CONFIG_QXL=y
 +CONFIG_RTL8139_PCI=y
 +CONFIG_SCSI=y
 +CONFIG_SERIAL=y
 +CONFIG_SERIAL_ISA=y
 +CONFIG_SERIAL_PCI=y
 +CONFIG_SEV=y
 +CONFIG_SGA=y
 +CONFIG_SMBIOS=y
 +CONFIG_SMBUS_EEPROM=y
 +CONFIG_TEST_DEVICES=y
 +CONFIG_USB=y
 +CONFIG_USB_EHCI=y
 +CONFIG_USB_EHCI_PCI=y
 +CONFIG_USB_SMARTCARD=y
 +CONFIG_USB_STORAGE_CORE=y
 +CONFIG_USB_STORAGE_CLASSIC=y
 +CONFIG_USB_UHCI=y
 +CONFIG_USB_XHCI=y
 +CONFIG_USB_XHCI_NEC=y
 +CONFIG_USB_XHCI_PCI=y
 +CONFIG_VFIO=y
 +CONFIG_VFIO_PCI=y
 +CONFIG_VGA=y
 +CONFIG_VGA_CIRRUS=y
 +CONFIG_VGA_PCI=y
 +CONFIG_VHOST_USER=y
 +CONFIG_VHOST_USER_BLK=y
 +CONFIG_VIRTIO_PCI=y
 +CONFIG_VIRTIO_VGA=y
 +CONFIG_VMMOUSE=y
 +CONFIG_VMPORT=y
 +CONFIG_VTD=y
 +CONFIG_WDT_IB6300ESB=y
 +CONFIG_WDT_IB700=y
 +CONFIG_XIO3130=y
 +CONFIG_TPM=y
 +CONFIG_TPM_CRB=y
 +CONFIG_TPM_TIS_ISA=y
 +CONFIG_TPM_EMULATOR=y
 +CONFIG_TPM_PASSTHROUGH=y
 diff --git a/configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak b/configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak
 new file mode 100644
 index 0000000000..2cd20f54d2
 --- /dev/null
 +++ b/configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak
@@ -0,0 +1,4 @@
 +# We need "isa-parallel"
 +CONFIG_PARALLEL=y
 +# We need "hpet"
 +CONFIG_HPET=y
 diff --git a/hw/acpi/ich9.c b/hw/acpi/ich9.c
 index ebe08ed831..381ef2ddcf 100644
 --- a/hw/acpi/ich9.c
 +++ b/hw/acpi/ich9.c
@@ -438,8 +438,8 @@ void ich9_pm_add_properties(Object *obj, ICH9LPCPMRegs *pm)
     static const uint32_t gpe0_len = ICH9_PMIO_GPE0_LEN;
     pm->acpi_memory_hotplug.is_enabled = true;
     pm->cpu_hotplug_legacy = true;
 -    pm->disable_s3 = 0;
 -    pm->disable_s4 = 0;
 +    pm->disable_s3 = 1;
 +    pm->disable_s4 = 1;
     pm->s4_val = 2;
     pm->use_acpi_hotplug_bridge = true;
     pm->keep_pci_slot_hpc = true;
 diff --git a/hw/arm/meson.build b/hw/arm/meson.build
 index 721a8eb8be..87ed4dd914 100644
 --- a/hw/arm/meson.build
 +++ b/hw/arm/meson.build
@@ -31,7 +31,7 @@ arm_ss.add(when: 'CONFIG_VEXPRESS', if_true: files('vexpress.c'))
 arm_ss.add(when: 'CONFIG_ZYNQ', if_true: files('xilinx_zynq.c'))
 arm_ss.add(when: 'CONFIG_SABRELITE', if_true: files('sabrelite.c'))
 -arm_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('armv7m.c'))
 +#arm_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('armv7m.c'))
 arm_ss.add(when: 'CONFIG_EXYNOS4', if_true: files('exynos4210.c'))
 arm_ss.add(when: 'CONFIG_PXA2XX', if_true: files('pxa2xx.c', 'pxa2xx_gpio.c', 'pxa2xx_pic.c'))
 arm_ss.add(when: 'CONFIG_DIGIC', if_true: files('digic.c'))
 diff --git a/hw/block/fdc.c b/hw/block/fdc.c
 index 21d18ac2e3..97fa6de423 100644
 --- a/hw/block/fdc.c
 +++ b/hw/block/fdc.c
@@ -48,6 +48,8 @@
 #include "qom/object.h"
 #include "fdc-internal.h"
 +#include "hw/boards.h"
 +
 /********************************************************/
 /* debug Floppy devices */
@@ -2337,6 +2339,14 @@ void fdctrl_realize_common(DeviceState *dev, FDCtrl *fdctrl, Error **errp)
     FDrive *drive;
     static int command_tables_inited = 0;
 +    /* Restricted for Red Hat Enterprise Linux: */
 +    MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
 +    if (!strstr(mc->name, "-rhel7.")) {
 +        error_setg(errp, "Device %s is not supported with machine type %s",
 +                   object_get_typename(OBJECT(dev)), mc->name);
 +        return;
 +    }
 +
     if (fdctrl->fallback == FLOPPY_DRIVE_TYPE_AUTO) {
         error_setg(errp, "Cannot choose a fallback FDrive type of 'auto'");
         return;
 diff --git a/hw/char/parallel.c b/hw/char/parallel.c
 index b45e67bfbb..e5f108211b 100644
 --- a/hw/char/parallel.c
 +++ b/hw/char/parallel.c
@@ -29,6 +29,7 @@
 #include "chardev/char-parallel.h"
 #include "chardev/char-fe.h"
 #include "hw/acpi/aml-build.h"
 +#include "hw/boards.h"
 #include "hw/irq.h"
 #include "hw/isa/isa.h"
 #include "hw/qdev-properties.h"
@@ -534,6 +535,14 @@ static void parallel_isa_realizefn(DeviceState *dev, Error **errp)
     int base;
     uint8_t dummy;
 +    /* Restricted for Red Hat Enterprise Linux */
 +    MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
 +    if (strstr(mc->name, "rhel")) {
 +        error_setg(errp, "Device %s is not supported with machine type %s",
 +                   object_get_typename(OBJECT(dev)), mc->name);
 +        return;
 +    }
 +
     if (!qemu_chr_fe_backend_connected(&s->chr)) {
         error_setg(errp, "Can't create parallel device, empty char device");
         return;
 diff --git a/hw/cpu/meson.build b/hw/cpu/meson.build
 index 9e52fee9e7..bb71c9f3e7 100644
 --- a/hw/cpu/meson.build
 +++ b/hw/cpu/meson.build
@@ -1,6 +1,7 @@
 -softmmu_ss.add(files('core.c', 'cluster.c'))
 +#softmmu_ss.add(files('core.c', 'cluster.c'))
 +softmmu_ss.add(files('core.c'))
 specific_ss.add(when: 'CONFIG_ARM11MPCORE', if_true: files('arm11mpcore.c'))
 specific_ss.add(when: 'CONFIG_REALVIEW', if_true: files('realview_mpcore.c'))
 specific_ss.add(when: 'CONFIG_A9MPCORE', if_true: files('a9mpcore.c'))
 -specific_ss.add(when: 'CONFIG_A15MPCORE', if_true: files('a15mpcore.c'))
 +#specific_ss.add(when: 'CONFIG_A15MPCORE', if_true: files('a15mpcore.c'))
 diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
 index fdca6ca659..fa1a7eee51 100644
 --- a/hw/display/cirrus_vga.c
 +++ b/hw/display/cirrus_vga.c
@@ -2945,6 +2945,9 @@ static void pci_cirrus_vga_realize(PCIDevice *dev, Error **errp)
      PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(dev);
      int16_t device_id = pc->device_id;
 +     warn_report("'cirrus-vga' is deprecated, "
 +                 "please use a different VGA card instead");
 +
      /* follow real hardware, cirrus card emulated has 4 MB video memory.
        Also accept 8 MB/16 MB for backward compatibility. */
      if (s->vga.vram_size_mb != 4 && s->vga.vram_size_mb != 8 &&
 diff --git a/hw/ide/piix.c b/hw/ide/piix.c
 index ce89fd0aa3..fbcf802b13 100644
 --- a/hw/ide/piix.c
 +++ b/hw/ide/piix.c
@@ -232,7 +232,8 @@ static void piix3_ide_class_init(ObjectClass *klass, void *data)
     k->device_id = PCI_DEVICE_ID_INTEL_82371SB_1;
     k->class_id = PCI_CLASS_STORAGE_IDE;
     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 -    dc->hotpluggable = false;
 +    /* Disabled for Red Hat Enterprise Linux: */
 +    dc->user_creatable = false;
 }
 static const TypeInfo piix3_ide_info = {
@@ -261,6 +262,8 @@ static void piix4_ide_class_init(ObjectClass *klass, void *data)
     k->class_id = PCI_CLASS_STORAGE_IDE;
     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->hotpluggable = false;
 +    /* Disabled for Red Hat Enterprise Linux: */
 +    dc->user_creatable = false;
 }
 static const TypeInfo piix4_ide_info = {
 diff --git a/hw/input/pckbd.c b/hw/input/pckbd.c
 index baba62f357..bc360347ea 100644
 --- a/hw/input/pckbd.c
 +++ b/hw/input/pckbd.c
@@ -796,6 +796,8 @@ static void i8042_class_initfn(ObjectClass *klass, void *data)
     dc->vmsd = &vmstate_kbd_isa;
     isa->build_aml = i8042_build_aml;
     set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
 +    /* Disabled for Red Hat Enterprise Linux: */
 +    dc->user_creatable = false;
 }
 static const TypeInfo i8042_info = {
 diff --git a/hw/net/e1000.c b/hw/net/e1000.c
 index f5bc81296d..282d01e374 100644
 --- a/hw/net/e1000.c
 +++ b/hw/net/e1000.c
@@ -1821,6 +1821,7 @@ static const E1000Info e1000_devices[] = {
         .revision  = 0x03,
         .phy_id2   = E1000_PHY_ID2_8254xx_DEFAULT,
     },
 +#if 0 /* Disabled for Red Hat Enterprise Linux 7 */
     {
         .name      = "e1000-82544gc",
         .device_id = E1000_DEV_ID_82544GC_COPPER,
@@ -1833,6 +1834,7 @@ static const E1000Info e1000_devices[] = {
         .revision  = 0x03,
         .phy_id2   = E1000_PHY_ID2_8254xx_DEFAULT,
     },
 +#endif
 };
 static void e1000_register_types(void)
 diff --git a/hw/ppc/spapr_cpu_core.c b/hw/ppc/spapr_cpu_core.c
 index 58e7341cb7..8ba34f6a1d 100644
 --- a/hw/ppc/spapr_cpu_core.c
 +++ b/hw/ppc/spapr_cpu_core.c
@@ -370,10 +370,12 @@ static const TypeInfo spapr_cpu_core_type_infos[] = {
         .instance_size = sizeof(SpaprCpuCore),
         .class_size = sizeof(SpaprCpuCoreClass),
     },
 +#if 0  /* Disabled for Red Hat Enterprise Linux */
     DEFINE_SPAPR_CPU_CORE_TYPE("970_v2.2"),
     DEFINE_SPAPR_CPU_CORE_TYPE("970mp_v1.0"),
     DEFINE_SPAPR_CPU_CORE_TYPE("970mp_v1.1"),
     DEFINE_SPAPR_CPU_CORE_TYPE("power5+_v2.1"),
 +#endif
     DEFINE_SPAPR_CPU_CORE_TYPE("power7_v2.3"),
     DEFINE_SPAPR_CPU_CORE_TYPE("power7+_v2.1"),
     DEFINE_SPAPR_CPU_CORE_TYPE("power8_v2.0"),
 diff --git a/hw/timer/hpet.c b/hw/timer/hpet.c
 index 9520471be2..202e032524 100644
 --- a/hw/timer/hpet.c
 +++ b/hw/timer/hpet.c
@@ -733,6 +733,14 @@ static void hpet_realize(DeviceState *dev, Error **errp)
     int i;
     HPETTimer *timer;
 +    /* Restricted for Red Hat Enterprise Linux */
 +    MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
 +    if (strstr(mc->name, "rhel")) {
 +        error_setg(errp, "Device %s is not supported with machine type %s",
 +                   object_get_typename(OBJECT(dev)), mc->name);
 +        return;
 +    }
 +
     if (!s->intcap) {
         warn_report("Hpet's intcap not initialized");
     }
 diff --git a/hw/usb/meson.build b/hw/usb/meson.build
 index de853d780d..0776ae6a20 100644
 --- a/hw/usb/meson.build
 +++ b/hw/usb/meson.build
@@ -52,7 +52,7 @@ softmmu_ss.add(when: 'CONFIG_USB_SMARTCARD', if_true: files('dev-smartcard-reade
 if cacard.found()
   usbsmartcard_ss = ss.source_set()
   usbsmartcard_ss.add(when: 'CONFIG_USB_SMARTCARD',
 -                      if_true: [cacard, files('ccid-card-emulated.c', 'ccid-card-passthru.c')])
 +                      if_true: [cacard, files('ccid-card-passthru.c')])
   hw_usb_modules += {'smartcard': usbsmartcard_ss}
 endif
 diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
 index 13d0e9b195..3826fa5122 100644
 --- a/target/arm/cpu_tcg.c
 +++ b/target/arm/cpu_tcg.c
@@ -22,6 +22,7 @@
 /* CPU models. These are not needed for the AArch64 linux-user build. */
 #if !defined(CONFIG_USER_ONLY) || !defined(TARGET_AARCH64)
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 #if !defined(CONFIG_USER_ONLY) && defined(CONFIG_TCG)
 static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
 {
@@ -375,6 +376,7 @@ static void cortex_a9_initfn(Object *obj)
     cpu->ccsidr[1] = 0x200fe019; /* 16k L1 icache. */
     define_arm_cp_regs(cpu, cortexa9_cp_reginfo);
 }
 +#endif /* disabled for RHEL */
 #ifndef CONFIG_USER_ONLY
 static uint64_t a15_l2ctlr_read(CPUARMState *env, const ARMCPRegInfo *ri)
@@ -400,6 +402,7 @@ static const ARMCPRegInfo cortexa15_cp_reginfo[] = {
     REGINFO_SENTINEL
 };
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void cortex_a7_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
@@ -445,6 +448,7 @@ static void cortex_a7_initfn(Object *obj)
     cpu->ccsidr[2] = 0x711fe07a; /* 4096K L2 unified cache */
     define_arm_cp_regs(cpu, cortexa15_cp_reginfo); /* Same as A15 */
 }
 +#endif /* disabled for RHEL */
 static void cortex_a15_initfn(Object *obj)
 {
@@ -488,6 +492,7 @@ static void cortex_a15_initfn(Object *obj)
     define_arm_cp_regs(cpu, cortexa15_cp_reginfo);
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void cortex_m0_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
@@ -928,6 +933,7 @@ static void arm_v7m_class_init(ObjectClass *oc, void *data)
     cc->gdb_core_xml_file = "arm-m-profile.xml";
 }
 +#endif /* disabled for RHEL */
 #ifndef TARGET_AARCH64
 /*
@@ -1007,6 +1013,7 @@ static void arm_max_initfn(Object *obj)
 #endif /* !TARGET_AARCH64 */
 static const ARMCPUInfo arm_tcg_cpus[] = {
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
     { .name = "arm926",      .initfn = arm926_initfn },
     { .name = "arm946",      .initfn = arm946_initfn },
     { .name = "arm1026",     .initfn = arm1026_initfn },
@@ -1022,7 +1029,9 @@ static const ARMCPUInfo arm_tcg_cpus[] = {
     { .name = "cortex-a7",   .initfn = cortex_a7_initfn },
     { .name = "cortex-a8",   .initfn = cortex_a8_initfn },
     { .name = "cortex-a9",   .initfn = cortex_a9_initfn },
 +#endif /* disabled for RHEL */
     { .name = "cortex-a15",  .initfn = cortex_a15_initfn },
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
     { .name = "cortex-m0",   .initfn = cortex_m0_initfn,
                              .class_init = arm_v7m_class_init },
     { .name = "cortex-m3",   .initfn = cortex_m3_initfn,
@@ -1053,6 +1062,7 @@ static const ARMCPUInfo arm_tcg_cpus[] = {
     { .name = "pxa270-b1",   .initfn = pxa270b1_initfn },
     { .name = "pxa270-c0",   .initfn = pxa270c0_initfn },
     { .name = "pxa270-c5",   .initfn = pxa270c5_initfn },
 +#endif /* disabled for RHEL */
 #ifndef TARGET_AARCH64
     { .name = "max",         .initfn = arm_max_initfn },
 #endif
 diff --git a/target/ppc/cpu-models.c b/target/ppc/cpu-models.c
 index 4baa111713..d779c4d1d5 100644
 --- a/target/ppc/cpu-models.c
 +++ b/target/ppc/cpu-models.c
@@ -66,6 +66,7 @@
 #define POWERPC_DEF(_name, _pvr, _type, _desc)                              \
     POWERPC_DEF_SVR(_name, _desc, _pvr, POWERPC_SVR_NONE, _type)
 +#if 0  /* Embedded and 32-bit CPUs disabled for Red Hat Enterprise Linux */
     /* Embedded PowerPC                                                      */
     /* PowerPC 401 family                                                    */
     POWERPC_DEF("401",           CPU_POWERPC_401,                    401,
@@ -740,8 +741,10 @@
                 "PowerPC 7447A v1.2 (G4)")
     POWERPC_DEF("7457a_v1.2",    CPU_POWERPC_74x7A_v12,              7455,
                 "PowerPC 7457A v1.2 (G4)")
 +#endif
     /* 64 bits PowerPC                                                       */
 #if defined(TARGET_PPC64)
 +#if 0  /* Disabled for Red Hat Enterprise Linux */
     POWERPC_DEF("970_v2.2",      CPU_POWERPC_970_v22,                970,
                 "PowerPC 970 v2.2")
     POWERPC_DEF("970fx_v1.0",    CPU_POWERPC_970FX_v10,              970,
@@ -760,6 +763,7 @@
                 "PowerPC 970MP v1.1")
     POWERPC_DEF("power5+_v2.1",  CPU_POWERPC_POWER5P_v21,            POWER5P,
                 "POWER5+ v2.1")
 +#endif
     POWERPC_DEF("power7_v2.3",   CPU_POWERPC_POWER7_v23,             POWER7,
                 "POWER7 v2.3")
     POWERPC_DEF("power7+_v2.1",  CPU_POWERPC_POWER7P_v21,            POWER7,
@@ -784,6 +788,7 @@
 /* PowerPC CPU aliases                                                     */
 PowerPCCPUAlias ppc_cpu_aliases[] = {
 +#if 0  /* Embedded and 32-bit CPUs disabled for Red Hat Enterprise Linux */
     { "403", "403gc" },
     { "405", "405d4" },
     { "405cr", "405crc" },
@@ -942,12 +947,15 @@ PowerPCCPUAlias ppc_cpu_aliases[] = {
     { "7447a", "7447a_v1.2" },
     { "7457a", "7457a_v1.2" },
     { "apollo7pm", "7457a_v1.0" },
 +#endif
 #if defined(TARGET_PPC64)
 +#if 0  /* Disabled for Red Hat Enterprise Linux */
     { "970", "970_v2.2" },
     { "970fx", "970fx_v3.1" },
     { "970mp", "970mp_v1.1" },
     { "power5+", "power5+_v2.1" },
     { "power5gs", "power5+_v2.1" },
 +#endif
     { "power7", "power7_v2.3" },
     { "power7+", "power7+_v2.1" },
     { "power8e", "power8e_v2.1" },
@@ -957,6 +965,7 @@ PowerPCCPUAlias ppc_cpu_aliases[] = {
     { "power10", "power10_v2.0" },
 #endif
 +#if 0  /* Disabled for Red Hat Enterprise Linux */
     /* Generic PowerPCs */
 #if defined(TARGET_PPC64)
     { "ppc64", "970fx_v3.1" },
@@ -964,5 +973,6 @@ PowerPCCPUAlias ppc_cpu_aliases[] = {
     { "ppc32", "604" },
     { "ppc", "604" },
     { "default", "604" },
 +#endif
     { NULL, NULL }
 };
 diff --git a/target/s390x/cpu_models_sysemu.c b/target/s390x/cpu_models_sysemu.c
 index 05c3ccaaff..6a04ccab1b 100644
 --- a/target/s390x/cpu_models_sysemu.c
 +++ b/target/s390x/cpu_models_sysemu.c
@@ -36,6 +36,9 @@ static void check_unavailable_features(const S390CPUModel *max_model,
         (max_model->def->gen == model->def->gen &&
          max_model->def->ec_ga < model->def->ec_ga)) {
         list_add_feat("type", unavailable);
 +    } else if (model->def->gen < 11 && kvm_enabled()) {
 +        /* Older CPU models are not supported on Red Hat Enterprise Linux */
 +        list_add_feat("type", unavailable);
     }
     /* detect missing features if any to properly report them */
 diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c
 index 5b1fdb55c4..c52434985b 100644
 --- a/target/s390x/kvm/kvm.c
 +++ b/target/s390x/kvm/kvm.c
@@ -2508,6 +2508,14 @@ void kvm_s390_apply_cpu_model(const S390CPUModel *model, Error **errp)
         error_setg(errp, "KVM doesn't support CPU models");
         return;
     }
 +
 +    /* Older CPU models are not supported on Red Hat Enterprise Linux */
 +    if (model->def->gen < 11) {
 +        error_setg(errp, "KVM: Unsupported CPU type specified: %s",
 +                   MACHINE(qdev_get_machine())->cpu_type);
 +        return;
 +    }
 +
     prop.cpuid = s390_cpuid_from_cpu_model(model);
     prop.ibc = s390_ibc_from_cpu_model(model);
     /* configure cpu features indicated via STFL(e) */
 -- 
 2.27.0
--- a/SOURCES/0006-Machine-type-related-general-changes.patch
+++ b/SOURCES/0006-Machine-type-related-general-changes.patch
@ -1,730 +0,0 @@
 From 8e6a30073f9c1a5d6294b2d16556522453e227e7 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 11 Jan 2019 09:54:45 +0100
 Subject: Machine type related general changes
 This patch is first part of original "Add RHEL machine types" patch we
 split to allow easier review. It contains changes not related to any
 architecture.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 --
 Rebase notes (6.2.0):
 - Do not duplicate minimal_version_id for piix4_pm
 - Remove empty line chunks in serial.c
 - Remove migration.h include in serial.c
 - Update hw_compat_rhel_8_5 (from MR 66)
 Rebase notes (7.0.0):
 - Remove downstream changes leftovers in hw/rtc/mc146818rtc.c
 - Remove unnecessary change in hw/usb/hcd-uhci.c
 Rebase notes (7.1.0):
 - Moved adding rhel_old_machine_deprecation variable from s390x to general machine types commit
 - Moved adding hw_compat_rhel_8_6 struct from x86_64 to general machine types commit
 Rebase notes (8.1.0):
 - Do not modify unused vga-isa.c
 Rebase notes (9.0.0 rc0):
 - Updated smsbios handling
 Rebase notes (9.0.0 rc4):
 - Moving downstream compat changes
 Merged patches (6.1.0):
 - f2fb42a3c6 redhat: add missing entries in hw_compat_rhel_8_4
 - 1949ec258e hw/arm/virt: Disable PL011 clock migration through hw_compat_rhel_8_3
 - a3995e2eff Remove RHEL 7.0.0 machine type (only generic changes)
 - ad3190a79b Remove RHEL 7.1.0 machine type (only generic changes)
 - 84bbe15d4e Remove RHEL 7.2.0 machine type (only generic changes)
 - 0215eb3356 Remove RHEL 7.3.0 machine types (only generic changes)
 - af69d1ca6e Remove RHEL 7.4.0 machine types (only generic changes)
 - 8f7a74ab78 Remove RHEL 7.5.0 machine types (only generic changes)
 Merged patches (6.2.0):
 - d687ac13d2 redhat: Define hw_compat_rhel_8_5
 Merged patches (7.0.0):
 - ef5afcc86d Fix virtio-net-pci* "vectors" compat
 - 168f0d56e3 compat: Update hw_compat_rhel_8_5 with 6.2.0 RC2 changes
 Merged patches (7.1.0):
 - 38b89dc245 pc: Move s3/s4 suspend disabling to compat (only hw/acpi/piix4.c chunk)
 - 1d6439527a WRB: Introduce RHEL 9.0.0 hw compat structure (only hw/core/machine.c and include/hw/boards.h chunk)
 Merged patches (7.2.0):
 - 0be2889fa2 Introduce upstream 7.0 compat changes (only applicable parts)
 Merged patches (8.0.0):
 - 21ed34787b Addd 7.2 compat bits for RHEL 9.1 machine type
 - e5c8d5d603 virtio-rng-pci: fix migration compat for vectors
 - 5a5fa77059 virtio-rng-pci: fix transitional migration compat for vectors
 Merged patches (8.1.0):
 - bd5d81d286 Add RHEL 9.2.0 compat structure (general part)
 - 1165e24c6b hw/pci: Disable PCI_ERR_UNCOR_MASK reg for machine type <= pc-q35-rhel9.2.0
 Merged patches (8.2.0):
 - 4ee284aca9 Add machine types compat bits. (partial)
 Merged patches (9.0.0 rc0):
 - 4b8fe42abc virtio-mem: default-enable "dynamic-memslots"
 ---
 hw/acpi/piix4.c              |   2 +-
 hw/arm/virt.c                |   2 +-
 hw/core/machine.c            | 269 +++++++++++++++++++++++++++++++++++
 hw/i386/fw_cfg.c             |   3 +-
 hw/net/rtl8139.c             |   4 +-
 hw/smbios/smbios.c           |  46 +++++-
 hw/timer/i8254_common.c      |   2 +-
 hw/usb/hcd-xhci-pci.c        |  59 ++++++--
 hw/usb/hcd-xhci-pci.h        |   1 +
 hw/virtio/virtio-mem.c       |   3 +-
 include/hw/boards.h          |  40 ++++++
 include/hw/firmware/smbios.h |   4 +-
 include/hw/i386/pc.h         |   3 +
 13 files changed, 414 insertions(+), 24 deletions(-)
 diff --git a/hw/acpi/piix4.c b/hw/acpi/piix4.c
 index debe1adb84..e8ddcd716e 100644
 --- a/hw/acpi/piix4.c
 +++ b/hw/acpi/piix4.c
@@ -245,7 +245,7 @@ static bool vmstate_test_migrate_acpi_index(void *opaque, int version_id)
 static const VMStateDescription vmstate_acpi = {
     .name = "piix4_pm",
     .version_id = 3,
 -    .minimum_version_id = 3,
 +    .minimum_version_id = 2,
     .post_load = vmstate_acpi_post_load,
     .fields = (const VMStateField[]) {
         VMSTATE_PCI_DEVICE(parent_obj, PIIX4PMState),
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index 6c6d155002..36e9b4b4e9 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
@@ -1651,7 +1651,7 @@ static void virt_build_smbios(VirtMachineState *vms)
     smbios_set_defaults("QEMU", product,
                         vmc->smbios_old_sys_ver ? "1.0" : mc->name,
 -                        true);
 +                        true, NULL, NULL);
     /* build the array of physical mem area from base_memmap */
     mem_array.address = vms->memmap[VIRT_MEM].base;
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index 37ede0e7d4..695cb89a46 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -296,6 +296,275 @@ GlobalProperty hw_compat_2_1[] = {
 };
 const size_t hw_compat_2_1_len = G_N_ELEMENTS(hw_compat_2_1);
 +/*
 + * RHEL only: machine types for previous major releases are deprecated
 + */
 +const char *rhel_old_machine_deprecation =
 +    "machine types for previous major releases are deprecated";
 +
 +GlobalProperty hw_compat_rhel_9_4[] = {
 +  /* hw_compat_rhel_9_4 from hw_compat_8_0 */
 +    { TYPE_VIRTIO_NET, "host_uso", "off"},
 +  /* hw_compat_rhel_9_4 from hw_compat_8_0 */
 +    { TYPE_VIRTIO_NET, "guest_uso4", "off"},
 +  /* hw_compat_rhel_9_4 from hw_compat_8_0 */
 +    { TYPE_VIRTIO_NET, "guest_uso6", "off"},
 +  /* hw_compat_rhel_9_4 from hw_compat_8_1 */
 +     { TYPE_PCI_BRIDGE, "x-pci-express-writeable-slt-bug", "true" },
 +  /* hw_compat_rhel_9_4 from hw_compat_8_1 */
 +     { "ramfb", "x-migrate", "off" },
 +  /* hw_compat_rhel_9_4 from hw_compat_8_1 */
 +     { "vfio-pci-nohotplug", "x-ramfb-migrate", "off" },
 +  /* hw_compat_rhel_9_4 from hw_compat_8_1 */
 +     { "igb", "x-pcie-flr-init", "off" },
 +  /* hw_compat_rhel_9_4 jira RHEL-24045 */
 +     { "virtio-mem", "dynamic-memslots", "off" },
 +};
 +const size_t hw_compat_rhel_9_4_len = G_N_ELEMENTS(hw_compat_rhel_9_4);
 +
 +GlobalProperty hw_compat_rhel_9_3[] = {
 +  /* hw_compat_rhel_9_3 from hw_compat_8_0 */
 +  { "migration", "multifd-flush-after-each-section", "on"},
 +  /* hw_compat_rhel_9_3 from hw_compat_8_0 */
 +  { TYPE_PCI_DEVICE, "x-pcie-ari-nextfn-1", "on" },
 +};
 +const size_t hw_compat_rhel_9_3_len = G_N_ELEMENTS(hw_compat_rhel_9_3);
 +
 +GlobalProperty hw_compat_rhel_9_2[] = {
 +  /* hw_compat_rhel_9_2 from hw_compat_7_2 */
 +  { "e1000e", "migrate-timadj", "off" },
 +  /* hw_compat_rhel_9_2 from hw_compat_7_2 */
 +  { "virtio-mem", "x-early-migration", "false" },
 +  /* hw_compat_rhel_9_2 from hw_compat_7_2 */
 +  { "migration", "x-preempt-pre-7-2", "true" },
 +  /* hw_compat_rhel_9_2 from hw_compat_7_2 */
 +  { TYPE_PCI_DEVICE, "x-pcie-err-unc-mask", "off" },
 +};
 +const size_t hw_compat_rhel_9_2_len = G_N_ELEMENTS(hw_compat_rhel_9_2);
 +
 +/*
 + * Mostly the same as hw_compat_7_0
 + */
 +GlobalProperty hw_compat_rhel_9_1[] = {
 +  /* hw_compat_rhel_9_1 from hw_compat_7_0 */
 +  { "arm-gicv3-common", "force-8-bit-prio", "on" },
 +  /* hw_compat_rhel_9_1 from hw_compat_7_0 */
 +  { "nvme-ns", "eui64-default", "on"},
 +  /* hw_compat_rhel_9_1 from hw_compat_7_1 */
 +  { "virtio-device", "queue_reset", "false" },
 +  /* hw_compat_rhel_9_1 bz 2155749 */
 +  { "virtio-rng-pci", "vectors", "0" },
 +  /* hw_compat_rhel_9_1 bz 2162569 */
 +  { "virtio-rng-pci-transitional", "vectors", "0" },
 +  { "virtio-rng-pci-non-transitional", "vectors", "0" },
 +};
 +const size_t hw_compat_rhel_9_1_len = G_N_ELEMENTS(hw_compat_rhel_9_1);
 +
 +/*
 + * Mostly the same as hw_compat_6_2
 + */
 +GlobalProperty hw_compat_rhel_9_0[] = {
 +    /* hw_compat_rhel_9_0 from hw_compat_6_2 */
 +    { "PIIX4_PM", "x-not-migrate-acpi-index", "on"},
 +};
 +const size_t hw_compat_rhel_9_0_len = G_N_ELEMENTS(hw_compat_rhel_9_0);
 +
 +GlobalProperty hw_compat_rhel_8_6[] = {
 +    /* hw_compat_rhel_8_6 bz 2065589 */
 +    /*
 +     * vhost-vsock device in RHEL 8 kernels doesn't support seqpacket, so
 +     * we need do disable it downstream on the latest hw_compat_rhel_8.
 +     */
 +    { "vhost-vsock-device", "seqpacket", "off" },
 +};
 +const size_t hw_compat_rhel_8_6_len = G_N_ELEMENTS(hw_compat_rhel_8_6);
 +
 +/*
 + * Mostly the same as hw_compat_6_0 and hw_compat_6_1
 + */
 +GlobalProperty hw_compat_rhel_8_5[] = {
 +    /* hw_compat_rhel_8_5 from hw_compat_6_0 */
 +    { "gpex-pcihost", "allow-unmapped-accesses", "false" },
 +    /* hw_compat_rhel_8_5 from hw_compat_6_0 */
 +    { "i8042", "extended-state", "false"},
 +    /* hw_compat_rhel_8_5 from hw_compat_6_0 */
 +    { "nvme-ns", "eui64-default", "off"},
 +    /* hw_compat_rhel_8_5 from hw_compat_6_0 */
 +    { "e1000", "init-vet", "off" },
 +    /* hw_compat_rhel_8_5 from hw_compat_6_0 */
 +    { "e1000e", "init-vet", "off" },
 +    /* hw_compat_rhel_8_5 from hw_compat_6_0 */
 +    { "vhost-vsock-device", "seqpacket", "off" },
 +    /* hw_compat_rhel_8_5 from hw_compat_6_1 */
 +    { "vhost-user-vsock-device", "seqpacket", "off" },
 +    /* hw_compat_rhel_8_5 from hw_compat_6_1 */
 +    { "nvme-ns", "shared", "off" },
 +};
 +const size_t hw_compat_rhel_8_5_len = G_N_ELEMENTS(hw_compat_rhel_8_5);
 +
 +/*
 + * Mostly the same as hw_compat_5_2
 + */
 +GlobalProperty hw_compat_rhel_8_4[] = {
 +    /* hw_compat_rhel_8_4 from hw_compat_5_2 */
 +    { "ICH9-LPC", "smm-compat", "on"},
 +    /* hw_compat_rhel_8_4 from hw_compat_5_2 */
 +    { "PIIX4_PM", "smm-compat", "on"},
 +    /* hw_compat_rhel_8_4 from hw_compat_5_2 */
 +    { "virtio-blk-device", "report-discard-granularity", "off" },
 +    /* hw_compat_rhel_8_4 from hw_compat_5_2 */
 +    /*
 +     * Upstream incorrectly had "virtio-net-pci" instead of "virtio-net-pci-base",
 +     * (https://bugzilla.redhat.com/show_bug.cgi?id=1999141)
 +     */
 +    { "virtio-net-pci-base", "vectors", "3"},
 +};
 +const size_t hw_compat_rhel_8_4_len = G_N_ELEMENTS(hw_compat_rhel_8_4);
 +
 +/*
 + * Mostly the same as hw_compat_5_1
 + */
 +GlobalProperty hw_compat_rhel_8_3[] = {
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "vhost-scsi", "num_queues", "1"},
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "vhost-user-blk", "num-queues", "1"},
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "vhost-user-scsi", "num_queues", "1"},
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "virtio-blk-device", "num-queues", "1"},
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "virtio-scsi-device", "num_queues", "1"},
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "nvme", "use-intel-id", "on"},
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "pvpanic", "events", "1"}, /* PVPANIC_PANICKED */
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "pl011", "migrate-clk", "off" },
 +    /* hw_compat_rhel_8_3 bz 1912846 */
 +    { "pci-xhci", "x-rh-late-msi-cap", "off" },
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "virtio-pci", "x-ats-page-aligned", "off"},
 +};
 +const size_t hw_compat_rhel_8_3_len = G_N_ELEMENTS(hw_compat_rhel_8_3);
 +
 +/*
 + * The same as hw_compat_4_2 + hw_compat_5_0
 + */
 +GlobalProperty hw_compat_rhel_8_2[] = {
 +    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
 +    { "virtio-blk-device", "queue-size", "128"},
 +    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
 +    { "virtio-scsi-device", "virtqueue_size", "128"},
 +    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
 +    { "virtio-blk-device", "x-enable-wce-if-config-wce", "off" },
 +    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
 +    { "virtio-blk-device", "seg-max-adjust", "off"},
 +    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
 +    { "virtio-scsi-device", "seg_max_adjust", "off"},
 +    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
 +    { "vhost-blk-device", "seg_max_adjust", "off"},
 +    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
 +    { "usb-host", "suppress-remote-wake", "off" },
 +    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
 +    { "usb-redir", "suppress-remote-wake", "off" },
 +    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
 +    { "qxl", "revision", "4" },
 +    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
 +    { "qxl-vga", "revision", "4" },
 +    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
 +    { "fw_cfg", "acpi-mr-restore", "false" },
 +    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
 +    { "virtio-device", "use-disabled-flag", "false" },
 +    /* hw_compat_rhel_8_2 from hw_compat_5_0 */
 +    { "pci-host-bridge", "x-config-reg-migration-enabled", "off" },
 +    /* hw_compat_rhel_8_2 from hw_compat_5_0 */
 +    { "virtio-balloon-device", "page-poison", "false" },
 +    /* hw_compat_rhel_8_2 from hw_compat_5_0 */
 +    { "vmport", "x-read-set-eax", "off" },
 +    /* hw_compat_rhel_8_2 from hw_compat_5_0 */
 +    { "vmport", "x-signal-unsupported-cmd", "off" },
 +    /* hw_compat_rhel_8_2 from hw_compat_5_0 */
 +    { "vmport", "x-report-vmx-type", "off" },
 +    /* hw_compat_rhel_8_2 from hw_compat_5_0 */
 +    { "vmport", "x-cmds-v2", "off" },
 +    /* hw_compat_rhel_8_2 from hw_compat_5_0 */
 +    { "virtio-device", "x-disable-legacy-check", "true" },
 +};
 +const size_t hw_compat_rhel_8_2_len = G_N_ELEMENTS(hw_compat_rhel_8_2);
 +
 +/*
 + * The same as hw_compat_4_1
 + */
 +GlobalProperty hw_compat_rhel_8_1[] = {
 +    /* hw_compat_rhel_8_1 from hw_compat_4_1 */
 +    { "virtio-pci", "x-pcie-flr-init", "off" },
 +};
 +const size_t hw_compat_rhel_8_1_len = G_N_ELEMENTS(hw_compat_rhel_8_1);
 +
 +/* The same as hw_compat_3_1
 + * format of array has been changed by:
 + *     6c36bddf5340 ("machine: Use shorter format for GlobalProperty arrays")
 + */
 +GlobalProperty hw_compat_rhel_8_0[] = {
 +    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
 +    { "pcie-root-port", "x-speed", "2_5" },
 +    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
 +    { "pcie-root-port", "x-width", "1" },
 +    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
 +    { "memory-backend-file", "x-use-canonical-path-for-ramblock-id", "true" },
 +    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
 +    { "memory-backend-memfd", "x-use-canonical-path-for-ramblock-id", "true" },
 +    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
 +    { "tpm-crb", "ppi", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
 +    { "tpm-tis", "ppi", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
 +    { "usb-kbd", "serial", "42" },
 +    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
 +    { "usb-mouse", "serial", "42" },
 +    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
 +    { "usb-tablet", "serial", "42" },
 +    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
 +    { "virtio-blk-device", "discard", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
 +    { "virtio-blk-device", "write-zeroes", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_4_0 */
 +    { "VGA",            "edid", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_4_0 */
 +    { "secondary-vga",  "edid", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_4_0 */
 +    { "bochs-display",  "edid", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_4_0 */
 +    { "virtio-vga",     "edid", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_4_0 */
 +    { "virtio-gpu-device", "edid", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_4_0 */
 +    { "virtio-device", "use-started", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_3_1 - that was added in 4.1 */
 +    { "pcie-root-port-base", "disable-acs", "true" },
 +};
 +const size_t hw_compat_rhel_8_0_len = G_N_ELEMENTS(hw_compat_rhel_8_0);
 +
 +/* The same as hw_compat_3_0 + hw_compat_2_12
 + * except that
 + *   there's nothing in 3_0
 + *   migration.decompress-error-check=off was in 7.5 from bz 1584139
 + */
 +GlobalProperty hw_compat_rhel_7_6[] = {
 +    /* hw_compat_rhel_7_6 from hw_compat_2_12 */
 +    { "hda-audio", "use-timer", "false" },
 +    /* hw_compat_rhel_7_6 from hw_compat_2_12 */
 +    { "cirrus-vga", "global-vmstate", "true" },
 +    /* hw_compat_rhel_7_6 from hw_compat_2_12 */
 +    { "VGA", "global-vmstate", "true" },
 +    /* hw_compat_rhel_7_6 from hw_compat_2_12 */
 +    { "vmware-svga", "global-vmstate", "true" },
 +    /* hw_compat_rhel_7_6 from hw_compat_2_12 */
 +    { "qxl-vga", "global-vmstate",  "true" },
 +};
 +const size_t hw_compat_rhel_7_6_len = G_N_ELEMENTS(hw_compat_rhel_7_6);
 +
 MachineState *current_machine;
 static char *machine_get_kernel(Object *obj, Error **errp)
 diff --git a/hw/i386/fw_cfg.c b/hw/i386/fw_cfg.c
 index d802d2787f..c7aa39a13e 100644
 --- a/hw/i386/fw_cfg.c
 +++ b/hw/i386/fw_cfg.c
@@ -64,7 +64,8 @@ void fw_cfg_build_smbios(PCMachineState *pcms, FWCfgState *fw_cfg,
     if (pcmc->smbios_defaults) {
         /* These values are guest ABI, do not change */
         smbios_set_defaults("QEMU", mc->desc, mc->name,
 -                            pcmc->smbios_uuid_encoded);
 +                            pcmc->smbios_uuid_encoded,
 +                            pcmc->smbios_stream_product, pcmc->smbios_stream_version);
     }
     /* tell smbios about cpuid version and features */
 diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
 index 897c86ec41..2d0db43f49 100644
 --- a/hw/net/rtl8139.c
 +++ b/hw/net/rtl8139.c
@@ -3169,7 +3169,7 @@ static int rtl8139_pre_save(void *opaque)
 static const VMStateDescription vmstate_rtl8139 = {
     .name = "rtl8139",
 -    .version_id = 5,
 +    .version_id = 4,
     .minimum_version_id = 3,
     .post_load = rtl8139_post_load,
     .pre_save  = rtl8139_pre_save,
@@ -3250,7 +3250,9 @@ static const VMStateDescription vmstate_rtl8139 = {
         VMSTATE_UINT32(tally_counters.TxMCol, RTL8139State),
         VMSTATE_UINT64(tally_counters.RxOkPhy, RTL8139State),
         VMSTATE_UINT64(tally_counters.RxOkBrd, RTL8139State),
 +#if 0 /* Disabled for Red Hat Enterprise Linux bz 1420195 */
         VMSTATE_UINT32_V(tally_counters.RxOkMul, RTL8139State, 5),
 +#endif
         VMSTATE_UINT16(tally_counters.TxAbt, RTL8139State),
         VMSTATE_UINT16(tally_counters.TxUndrn, RTL8139State),
 diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c
 index eed5787b15..68608a3403 100644
 --- a/hw/smbios/smbios.c
 +++ b/hw/smbios/smbios.c
@@ -39,6 +39,10 @@ size_t usr_blobs_len;
 static unsigned usr_table_max;
 static unsigned usr_table_cnt;
 +/* Set to true for modern Windows 10 HardwareID-6 compat */
 +static bool smbios_type2_required;
 +
 +
 uint8_t *smbios_tables;
 size_t smbios_tables_len;
 unsigned smbios_table_max;
@@ -629,7 +633,7 @@ static void smbios_build_type_1_table(void)
 static void smbios_build_type_2_table(void)
 {
 -    SMBIOS_BUILD_TABLE_PRE(2, T2_BASE, false); /* optional */
 +    SMBIOS_BUILD_TABLE_PRE(2, T2_BASE, smbios_type2_required);
     SMBIOS_TABLE_SET_STR(2, manufacturer_str, type2.manufacturer);
     SMBIOS_TABLE_SET_STR(2, product_str, type2.product);
@@ -1018,16 +1022,52 @@ void smbios_set_default_processor_family(uint16_t processor_family)
 void smbios_set_defaults(const char *manufacturer, const char *product,
                          const char *version,
 -                         bool uuid_encoded)
 +                         bool uuid_encoded,
 +                         const char *stream_product,
 +                         const char *stream_version)
 {
     smbios_have_defaults = true;
     smbios_uuid_encoded = uuid_encoded;
 +    /*
 +     * If @stream_product & @stream_version are non-NULL, then
 +     * we're following rules for new Windows driver support.
 +     * The data we have to report is defined in this doc:
 +     *
 +     * https://docs.microsoft.com/en-us/windows-hardware/drivers/install/specifying-hardware-ids-for-a-computer
 +     *
 +     * The Windows drivers are written to expect use of the
 +     * scheme documented as "HardwareID-6" against Windows 10,
 +     * which uses SMBIOS System (Type 1) and Base Board (Type 2)
 +     * tables and will match on
 +     *
 +     *   System Manufacturer = Red Hat     (@manufacturer)
 +     *   System SKU Number = 8.2.0         (@stream_version)
 +     *   Baseboard Manufacturer = Red Hat  (@manufacturer)
 +     *   Baseboard Product = RHEL-AV       (@stream_product)
 +     *
 +     * NB, SKU must be changed with each RHEL-AV release
 +     *
 +     * Other fields can be freely used by applications using
 +     * QEMU. For example apps can use the "System product"
 +     * and "System version" to identify themselves.
 +     *
 +     * We get 'System Manufacturer' and 'Baseboard Manufacturer'
 +     */
     SMBIOS_SET_DEFAULT(smbios_type1.manufacturer, manufacturer);
     SMBIOS_SET_DEFAULT(smbios_type1.product, product);
     SMBIOS_SET_DEFAULT(smbios_type1.version, version);
 +    SMBIOS_SET_DEFAULT(smbios_type1.family, "Red Hat Enterprise Linux");
 +    if (stream_version != NULL) {
 +        SMBIOS_SET_DEFAULT(smbios_type1.sku, stream_version);
 +    }
     SMBIOS_SET_DEFAULT(type2.manufacturer, manufacturer);
 -    SMBIOS_SET_DEFAULT(type2.product, product);
 +    if (stream_product != NULL) {
 +        SMBIOS_SET_DEFAULT(type2.product, stream_product);
 +        smbios_type2_required = true;
 +    } else {
 +        SMBIOS_SET_DEFAULT(type2.product, product);
 +    }
     SMBIOS_SET_DEFAULT(type2.version, version);
     SMBIOS_SET_DEFAULT(type3.manufacturer, manufacturer);
     SMBIOS_SET_DEFAULT(type3.version, version);
 diff --git a/hw/timer/i8254_common.c b/hw/timer/i8254_common.c
 index 28fdabc321..bad13ec224 100644
 --- a/hw/timer/i8254_common.c
 +++ b/hw/timer/i8254_common.c
@@ -229,7 +229,7 @@ static const VMStateDescription vmstate_pit_common = {
     .pre_save = pit_dispatch_pre_save,
     .post_load = pit_dispatch_post_load,
     .fields = (const VMStateField[]) {
 -        VMSTATE_UINT32_V(channels[0].irq_disabled, PITCommonState, 3),
 +        VMSTATE_UINT32(channels[0].irq_disabled, PITCommonState), /* qemu-kvm's v2 had 'flags' here */
         VMSTATE_STRUCT_ARRAY(channels, PITCommonState, 3, 2,
                              vmstate_pit_channel, PITChannelState),
         VMSTATE_INT64(channels[0].next_transition_time,
 diff --git a/hw/usb/hcd-xhci-pci.c b/hw/usb/hcd-xhci-pci.c
 index 4423983308..43b4b71fdf 100644
 --- a/hw/usb/hcd-xhci-pci.c
 +++ b/hw/usb/hcd-xhci-pci.c
@@ -104,6 +104,33 @@ static int xhci_pci_vmstate_post_load(void *opaque, int version_id)
    return 0;
 }
 +/* RH bz 1912846 */
 +static bool usb_xhci_pci_add_msi(struct PCIDevice *dev, Error **errp)
 +{
 +    int ret;
 +    Error *err = NULL;
 +    XHCIPciState *s = XHCI_PCI(dev);
 +
 +    ret = msi_init(dev, 0x70, s->xhci.numintrs, true, false, &err);
 +    /*
 +     * Any error other than -ENOTSUP(board's MSI support is broken)
 +     * is a programming error
 +     */
 +    assert(!ret || ret == -ENOTSUP);
 +    if (ret && s->msi == ON_OFF_AUTO_ON) {
 +        /* Can't satisfy user's explicit msi=on request, fail */
 +        error_append_hint(&err, "You have to use msi=auto (default) or "
 +                "msi=off with this machine type.\n");
 +        error_propagate(errp, err);
 +        return true;
 +    }
 +    assert(!err || s->msi == ON_OFF_AUTO_AUTO);
 +    /* With msi=auto, we fall back to MSI off silently */
 +    error_free(err);
 +
 +    return false;
 +}
 +
 static void usb_xhci_pci_realize(struct PCIDevice *dev, Error **errp)
 {
     int ret;
@@ -125,23 +152,12 @@ static void usb_xhci_pci_realize(struct PCIDevice *dev, Error **errp)
         s->xhci.nec_quirks = true;
     }
 -    if (s->msi != ON_OFF_AUTO_OFF) {
 -        ret = msi_init(dev, 0x70, s->xhci.numintrs, true, false, &err);
 -        /*
 -         * Any error other than -ENOTSUP(board's MSI support is broken)
 -         * is a programming error
 -         */
 -        assert(!ret || ret == -ENOTSUP);
 -        if (ret && s->msi == ON_OFF_AUTO_ON) {
 -            /* Can't satisfy user's explicit msi=on request, fail */
 -            error_append_hint(&err, "You have to use msi=auto (default) or "
 -                    "msi=off with this machine type.\n");
 +    if (s->msi != ON_OFF_AUTO_OFF && s->rh_late_msi_cap) {
 +        /* This gives the behaviour from 5.2.0 onwards, lspci shows 90,a0,70 */
 +        if (usb_xhci_pci_add_msi(dev, &err)) {
             error_propagate(errp, err);
             return;
         }
 -        assert(!err || s->msi == ON_OFF_AUTO_AUTO);
 -        /* With msi=auto, we fall back to MSI off silently */
 -        error_free(err);
     }
     pci_register_bar(dev, 0,
                      PCI_BASE_ADDRESS_SPACE_MEMORY |
@@ -154,6 +170,14 @@ static void usb_xhci_pci_realize(struct PCIDevice *dev, Error **errp)
         assert(ret > 0);
     }
 +    /* RH bz 1912846 */
 +    if (s->msi != ON_OFF_AUTO_OFF && !s->rh_late_msi_cap) {
 +        /* This gives the older RH machine behaviour, lspci shows 90,70,a0 */
 +        if (usb_xhci_pci_add_msi(dev, &err)) {
 +            error_propagate(errp, err);
 +            return;
 +        }
 +    }
     if (s->msix != ON_OFF_AUTO_OFF) {
         /* TODO check for errors, and should fail when msix=on */
         msix_init(dev, s->xhci.numintrs,
@@ -198,11 +222,18 @@ static void xhci_instance_init(Object *obj)
     qdev_alias_all_properties(DEVICE(&s->xhci), obj);
 }
 +static Property xhci_pci_properties[] = {
 +    /* RH bz 1912846 */
 +    DEFINE_PROP_BOOL("x-rh-late-msi-cap", XHCIPciState, rh_late_msi_cap, true),
 +    DEFINE_PROP_END_OF_LIST()
 +};
 +
 static void xhci_class_init(ObjectClass *klass, void *data)
 {
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
 +    device_class_set_props(dc, xhci_pci_properties);
     dc->reset   = xhci_pci_reset;
     dc->vmsd    = &vmstate_xhci_pci;
     set_bit(DEVICE_CATEGORY_USB, dc->categories);
 diff --git a/hw/usb/hcd-xhci-pci.h b/hw/usb/hcd-xhci-pci.h
 index 08f70ce97c..1be7527c1b 100644
 --- a/hw/usb/hcd-xhci-pci.h
 +++ b/hw/usb/hcd-xhci-pci.h
@@ -40,6 +40,7 @@ typedef struct XHCIPciState {
     XHCIState xhci;
     OnOffAuto msi;
     OnOffAuto msix;
 +    bool      rh_late_msi_cap;  /* bz 1912846 */
 } XHCIPciState;
 #endif
 diff --git a/hw/virtio/virtio-mem.c b/hw/virtio/virtio-mem.c
 index ffd119ebac..0e2be2219c 100644
 --- a/hw/virtio/virtio-mem.c
 +++ b/hw/virtio/virtio-mem.c
@@ -1694,8 +1694,9 @@ static Property virtio_mem_properties[] = {
 #endif
     DEFINE_PROP_BOOL(VIRTIO_MEM_EARLY_MIGRATION_PROP, VirtIOMEM,
                      early_migration, true),
 +    /* RHEL: default-enable "dynamic-memslots" (jira RHEL-24045) */
     DEFINE_PROP_BOOL(VIRTIO_MEM_DYNAMIC_MEMSLOTS_PROP, VirtIOMEM,
 -                     dynamic_memslots, false),
 +                     dynamic_memslots, true),
     DEFINE_PROP_END_OF_LIST(),
 };
 diff --git a/include/hw/boards.h b/include/hw/boards.h
 index 8b8f6d5c00..0466f9d0f3 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
@@ -512,4 +512,44 @@ extern const size_t hw_compat_2_2_len;
 extern GlobalProperty hw_compat_2_1[];
 extern const size_t hw_compat_2_1_len;
 +extern GlobalProperty hw_compat_rhel_9_4[];
 +extern const size_t hw_compat_rhel_9_4_len;
 +
 +extern GlobalProperty hw_compat_rhel_9_3[];
 +extern const size_t hw_compat_rhel_9_3_len;
 +
 +extern GlobalProperty hw_compat_rhel_9_2[];
 +extern const size_t hw_compat_rhel_9_2_len;
 +
 +extern GlobalProperty hw_compat_rhel_9_1[];
 +extern const size_t hw_compat_rhel_9_1_len;
 +
 +extern GlobalProperty hw_compat_rhel_9_0[];
 +extern const size_t hw_compat_rhel_9_0_len;
 +
 +extern GlobalProperty hw_compat_rhel_8_6[];
 +extern const size_t hw_compat_rhel_8_6_len;
 +
 +extern GlobalProperty hw_compat_rhel_8_5[];
 +extern const size_t hw_compat_rhel_8_5_len;
 +
 +extern GlobalProperty hw_compat_rhel_8_4[];
 +extern const size_t hw_compat_rhel_8_4_len;
 +
 +extern GlobalProperty hw_compat_rhel_8_3[];
 +extern const size_t hw_compat_rhel_8_3_len;
 +
 +extern GlobalProperty hw_compat_rhel_8_2[];
 +extern const size_t hw_compat_rhel_8_2_len;
 +
 +extern GlobalProperty hw_compat_rhel_8_1[];
 +extern const size_t hw_compat_rhel_8_1_len;
 +
 +extern GlobalProperty hw_compat_rhel_8_0[];
 +extern const size_t hw_compat_rhel_8_0_len;
 +
 +extern GlobalProperty hw_compat_rhel_7_6[];
 +extern const size_t hw_compat_rhel_7_6_len;
 +
 +extern const char *rhel_old_machine_deprecation;
 #endif
 diff --git a/include/hw/firmware/smbios.h b/include/hw/firmware/smbios.h
 index 8d3fb2fb3b..d9d6d7a169 100644
 --- a/include/hw/firmware/smbios.h
 +++ b/include/hw/firmware/smbios.h
@@ -332,7 +332,9 @@ void smbios_entry_add(QemuOpts *opts, Error **errp);
 void smbios_set_cpuid(uint32_t version, uint32_t features);
 void smbios_set_defaults(const char *manufacturer, const char *product,
                          const char *version,
 -                         bool uuid_encoded);
 +                         bool uuid_encoded,
 +                         const char *stream_product,
 +                         const char *stream_version);
 void smbios_set_default_processor_family(uint16_t processor_family);
 uint8_t *smbios_get_table_legacy(size_t *length, Error **errp);
 void smbios_get_tables(MachineState *ms,
 diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
 index 27a68071d7..ebd8f973f2 100644
 --- a/include/hw/i386/pc.h
 +++ b/include/hw/i386/pc.h
@@ -112,6 +112,9 @@ struct PCMachineClass {
     bool smbios_legacy_mode;
     bool smbios_uuid_encoded;
     SmbiosEntryPointType default_smbios_ep_type;
 +    /* New fields needed for Windows HardwareID-6 matching */
 +    const char *smbios_stream_product;
 +    const char *smbios_stream_version;
     /* RAM / address space compat: */
     bool gigabyte_align;
 -- 
 2.39.3
--- a/SOURCES/0007-Machine-type-related-general-changes.patch
+++ b/SOURCES/0007-Machine-type-related-general-changes.patch
--- a/SOURCES/0008-Add-aarch64-machine-types.patch
+++ b/SOURCES/0008-Add-aarch64-machine-types.patch
@ -1,4 +1,4 @@
-From cf398296f3fcee185a00f23de5deae57c97d648e Mon Sep 17 00:00:00 2001
+From 670e90f5cbd92189155e079b8c6e2aafdf82d162 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 12:53:31 +0200
 Subject: Add aarch64 machine types
@ -6,128 +6,106 @@ Subject: Add aarch64 machine types
 Adding changes to add RHEL machine types for aarch64 architecture.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
---
+
-Rebase notes (6.1.0):
+Rebase notes (4.0.0):
- Use CONFIG_TPM check when using TPM structures
+- Use upstream compat handling
 Rebase notes (4.1.0-rc0):
 - Removed a15memmap (upstream)
 - Use virt_flash_create in rhel800_virt_instance_init
 Rebase notes (4.2.0-rc0):
 - Set numa_mem_supported
 Rebase notes (4.2.0-rc3):
 - aarch64: Add virt-rhel8.2.0 machine type for ARM (patch 92246)
 - aarch64: virt: Allow more than 1TB of RAM (patch 92249)
 - aarch64: virt: Allow PCDIMM instantiation (patch 92247)
 - aarch64: virt: Enhance the comment related to gic-version (patch 92248)
 Rebase notes (5.0.0):
 - Set default_ram_id in rhel_machine_class_init
 - Added setting acpi properties
 Rebase notes (5.1.0):
 - Added ras property
 - Added to virt_machine_device_unplug_cb to machine type (upstream)
 - added mte property (upstream)
 Rebase notes (weekly-210210):
 - Added support for oem fields to machine type
 Rebase notes (weekly-210303):
 - Use rhel-8.4.0 hw compat
 Rebase notes (6.0.0-rc2):
 - renamed oem-id and oem-table-id to x-oem-id and x-oem-table-id
 Rebase notes (210623):
 - Protect TPM functions by CONFIG_TPM ifdef
 Rebase notes (6.1.0-rc0):
 - Add support for default_bus_bypass_iommu
 - ea4c0b32d9 arm/virt: Register highmem and gic-version as class properties
 - 895e1fa86a hw/arm/virt: Add 8.5 and 9.0 machine types and remove older ones
-Rebase notes (7.0.0):
+Merged patches (4.0.0):
- Added dtb-kaslr-seed option
+- 7bfdb4c aarch64: Add virt-rhel8.0.0 machine type for ARM
- Set no_tcg_lpa2 to true
+- 3433e69 aarch64: Set virt-rhel8.0.0 max_cpus to 512
 - 4d20863 aarch64: Use 256MB ECAM region by default
-Rebase notes (7.1.0):
+Merged patches (4.1.0):
- replace dtb_kaslr_seed by dtb_randomness
+- c3e39ef aarch64: Add virt-rhel8.1.0 machine type for ARM
- Updated dtb_randomness comment
+- 59a46d1 aarch64: Allow ARM VIRT iommu option in RHEL8.1 machine
-Rebase notes (7.2.0):
+Merged patches (5.2.0 rc0):
- Disabled cortex-a35
+- 12990ad hw/arm: Changes to rhel820 machine
 - 46d5a79 hw/arm: Introduce rhel_virt_instance_init() helper
 - 098954a hw/arm: Add rhel830 machine type
 - ee8e99d arm: Set correct max_cpus value on virt-rhel* machine types
 - e5edd38 RHEL-only: arm/virt: Allow the TPM_TIS_SYSBUS device dynamic allocation in machvirt
 - 6d7ba66 machine types/numa: set numa_mem_supported on old machine types (partialy)
 - 25c5644 machine_types/numa: compatibility for auto_enable_numa_with_memdev (partialy)
-Rebase notes (8.0.0):
+Merged patches (6.0):
- Moved changed code from target/arm/helper.c to target/arm/arm-qmp-cmds.c
+- 078fadb5da AArch64 machine types cleanup
 - ea7b7425fa hw/arm/virt: Add 8.4 Machine type
-Rebase notes (8.1.0):
+Merged patches (weekly-210609):
- Added setting default_nic
+- 73b1578882 hw/arm/virt: Add 8.5 machine type
 - 5333038d11 hw/arm/virt: Disable PL011 clock migration through hw_compat_rhel_8_3
 - 63adb8ae86 arm/virt: Register highmem and gic-version as class properties
-Rebase notes (9.0.0 rc0):
+Merged patches (weekly-211027):
- call arm_virt_compat_set on rhel type class_init
+- 86e3057c0a hw: arm: virt: Add hw_compat_rhel_8_5 to 8.5 machine type
 Merged patches (6.2.0):
 - 9a3d4fde0e hw/arm/virt: Remove 9.0 machine type
 - f7d04d6695 hw: arm: virt: Add hw_compat_rhel_8_5 to 8.5 machine type
 Merged patches (7.0.0):
 - 3b82be3dd3 redhat: virt-rhel8.5.0: Update machine type compatibility for QEMU 6.2.0 update
 - c354a86c9b hw/arm/virt: Register "iommu" as a class property
 - c1a2630dc9 hw/arm/virt: Register "its" as a class property
 - 9d8c61dc93 hw/arm/virt: Rename default_bus_bypass_iommu
 - a1d1b6eeb6 hw/arm/virt: Expose the 'RAS' option
 - 47f8fe1b82 hw/arm/virt: Add 9.0 machine type and remove 8.5 one
 - ed2346788f hw/arm/virt: Check no_tcg_its and minor style changes
 Merged patches (7.0.0):
 - f79b31bdef hw/arm/virt: Remove the dtb-kaslr-seed machine option
 - b6fca85f4a hw/arm/virt: Fix missing initialization in instance/class_init()
 Merged patches (7.1.0):
 - ac97dd4f9f RHEL-only: AArch64: Drop unsupported CPU types
 - e9c0a70664 target/arm: deprecate named CPU models
 Merged patches (7.2.0):
 - 0be2889fa2 Introduce upstream 7.0 compat changes (only applicable parts)
 Merged patches (8.0.0):
 - c1a21266d8 redhat: aarch64: add rhel9.2.0 virt machine type
 - d97cd7c513 redhat: fix virt-rhel9.2.0 compat props
 Merged patches (8.1.0):
 - bd5d81d286 Add RHEL 9.2.0 compat structure (arm part)
 - c07f666086 hw/arm/virt: Validate cluster and NUMA node boundary for RHEL machines
 Merged patches (8.2.0):
 - 4ee284aca9 Add machine types compat bits. (partial)
 Merged patches (9.0.0 rc0):
 - 117068376a hw/arm/virt: Fix compats
 - 8bcccfabc4 hw/arm/virt: Add properties to disable high memory regions
 - 0005a8b93a hw/arm/virt: deprecate virt-rhel9.{0,2}.0 machine types
 ---
- hw/arm/virt.c         | 299 +++++++++++++++++++++++++++++++++++++++++-
+ hw/arm/virt.c         | 226 +++++++++++++++++++++++++++++++++++++++++-
 hw/core/machine.c     |   2 +
 include/hw/arm/virt.h |   8 ++
- 2 files changed, 306 insertions(+), 1 deletion(-)
+ 3 files changed, 235 insertions(+), 1 deletion(-)
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index 36e9b4b4e9..22bc345137 100644
+index 5de4d9d73b..c77d26ab13 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
-@@ -101,6 +101,7 @@ static void arm_virt_compat_set(MachineClass *mc)
+@@ -79,6 +79,7 @@
-                      arm_virt_compat_len);
+ #include "hw/char/pl011.h"
- }
+ #include "qemu/guest-random.h"
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 #define DEFINE_VIRT_MACHINE_LATEST(major, minor, latest) \
     static void virt_##major##_##minor##_class_init(ObjectClass *oc, \
                                                     void *data) \
-@@ -128,7 +129,63 @@ static void arm_virt_compat_set(MachineClass *mc)
+@@ -105,7 +106,48 @@
     DEFINE_VIRT_MACHINE_LATEST(major, minor, true)
 #define DEFINE_VIRT_MACHINE(major, minor) \
     DEFINE_VIRT_MACHINE_LATEST(major, minor, false)
 -
 +#endif /* disabled for RHEL */
 +
 +/*
 + * This variable is for changes to properties that are RHEL specific,
 + * different to the current upstream and to be applied to the latest
 + * machine type. They may be overriden by older machine compats.
 + *
 + * virtio-net-pci variant romfiles are not needed because edk2 does
 + * fully support the pxe boot. Besides virtio romfiles are not shipped
 + * on rhel/aarch64.
 + */
 +GlobalProperty arm_rhel_compat[] = {
 +    {"virtio-net-pci", "romfile", "" },
 +    {"virtio-net-pci-transitional", "romfile", "" },
 +    {"virtio-net-pci-non-transitional", "romfile", "" },
 +};
 +const size_t arm_rhel_compat_len = G_N_ELEMENTS(arm_rhel_compat);
 +/*
 + * This cannot be called from the rhel_virt_class_init() because
 + * TYPE_RHEL_MACHINE is abstract and mc->compat_props g_ptr_array_new()
 + * only is called on virt-rhelm.n.s non abstract class init.
 + */
 +static void arm_rhel_compat_set(MachineClass *mc)
 +{
 +    compat_props_add(mc->compat_props, arm_rhel_compat,
 +                     arm_rhel_compat_len);
 +}
 +
 +#define DEFINE_RHEL_MACHINE_LATEST(m, n, s, latest)                     \
 +    static void rhel##m##n##s##_virt_class_init(ObjectClass *oc,        \
 +                                                void *data)             \
 +    {                                                                   \
 +        MachineClass *mc = MACHINE_CLASS(oc);                           \
 +        arm_rhel_compat_set(mc);                                        \
 +        rhel##m##n##s##_virt_options(mc);                               \
 +        mc->desc = "RHEL " # m "." # n "." # s " ARM Virtual Machine";  \
 +        if (latest) {                                                   \
@ -150,10 +128,23 @@ index 36e9b4b4e9..22bc345137 100644
 +    DEFINE_RHEL_MACHINE_LATEST(major, minor, subminor, true)
 +#define DEFINE_RHEL_MACHINE(major, minor, subminor)             \
 +    DEFINE_RHEL_MACHINE_LATEST(major, minor, subminor, false)
 +
 +/* This variable is for changes to properties that are RHEL specific,
 + * different to the current upstream and to be applied to the latest
 + * machine type.
 + */
 +GlobalProperty arm_rhel_compat[] = {
 +    {
 +        .driver   = "virtio-net-pci",
 +        .property = "romfile",
 +        .value    = "",
 +    },
 +};
 +const size_t arm_rhel_compat_len = G_N_ELEMENTS(arm_rhel_compat);
 /* Number of external interrupt lines to configure the GIC with */
 #define NUM_IRQS 256
-@@ -2355,6 +2412,7 @@ static void machvirt_init(MachineState *machine)
+@@ -2180,6 +2222,7 @@ static void machvirt_init(MachineState *machine)
     qemu_add_machine_init_done_notifier(&vms->machine_done);
 }
@ -161,7 +152,7 @@ index 36e9b4b4e9..22bc345137 100644
 static bool virt_get_secure(Object *obj, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
-@@ -2382,6 +2440,7 @@ static void virt_set_virt(Object *obj, bool value, Error **errp)
+@@ -2207,6 +2250,7 @@ static void virt_set_virt(Object *obj, bool value, Error **errp)
     vms->virt = value;
 }
@ -169,55 +160,15 @@ index 36e9b4b4e9..22bc345137 100644
 static bool virt_get_highmem(Object *obj, Error **errp)
 {
-@@ -2397,6 +2456,7 @@ static void virt_set_highmem(Object *obj, bool value, Error **errp)
+@@ -2304,6 +2348,7 @@ static void virt_set_acpi(Object *obj, Visitor *v, const char *name,
-     vms->highmem = value;
+     visit_type_OnOffAuto(v, name, &vms->acpi, errp);
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
- static bool virt_get_compact_highmem(Object *obj, Error **errp)
+ static bool virt_get_ras(Object *obj, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
-@@ -2410,6 +2470,7 @@ static void virt_set_compact_highmem(Object *obj, bool value, Error **errp)
+@@ -2331,6 +2376,7 @@ static void virt_set_mte(Object *obj, bool value, Error **errp)
     vms->highmem_compact = value;
 }
 +#endif /* disabled for RHEL */
 static bool virt_get_highmem_redists(Object *obj, Error **errp)
 {
@@ -2453,7 +2514,6 @@ static void virt_set_highmem_mmio(Object *obj, bool value, Error **errp)
     vms->highmem_mmio = value;
 }
 -
 static bool virt_get_its(Object *obj, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
@@ -2468,6 +2528,7 @@ static void virt_set_its(Object *obj, bool value, Error **errp)
     vms->its = value;
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static bool virt_get_dtb_randomness(Object *obj, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
@@ -2481,6 +2542,7 @@ static void virt_set_dtb_randomness(Object *obj, bool value, Error **errp)
     vms->dtb_randomness = value;
 }
 +#endif /* disabled for RHEL */
 static char *virt_get_oem_id(Object *obj, Error **errp)
 {
@@ -2564,6 +2626,7 @@ static void virt_set_ras(Object *obj, bool value, Error **errp)
     vms->ras = value;
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static bool virt_get_mte(Object *obj, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
@@ -2577,6 +2640,7 @@ static void virt_set_mte(Object *obj, bool value, Error **errp)
     vms->mte = value;
 }
@ -225,7 +176,7 @@ index 36e9b4b4e9..22bc345137 100644
 static char *virt_get_gic_version(Object *obj, Error **errp)
 {
-@@ -2949,6 +3013,7 @@ static int virt_kvm_type(MachineState *ms, const char *type_str)
+@@ -2666,6 +2712,7 @@ static int virt_kvm_type(MachineState *ms, const char *type_str)
     return fixed_ipa ? 0 : requested_pa_size;
 }
@ -233,7 +184,7 @@ index 36e9b4b4e9..22bc345137 100644
 static void virt_machine_class_init(ObjectClass *oc, void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
-@@ -3463,3 +3528,235 @@ static void virt_machine_2_6_options(MachineClass *mc)
+@@ -3031,3 +3078,180 @@ static void virt_machine_2_6_options(MachineClass *mc)
     vmc->no_pmu = true;
 }
 DEFINE_VIRT_MACHINE(2, 6)
@ -243,7 +194,6 @@ index 36e9b4b4e9..22bc345137 100644
 +{
 +    MachineClass *mc = MACHINE_CLASS(oc);
 +    HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(oc);
 +    arm_virt_compat_set(mc);
 +
 +    mc->family = "virt-rhel-Z";
 +    mc->init = machvirt_init;
@ -269,13 +219,9 @@ index 36e9b4b4e9..22bc345137 100644
 +    hc->unplug_request = virt_machine_device_unplug_request_cb;
 +    hc->unplug = virt_machine_device_unplug_cb;
 +    mc->nvdimm_supported = true;
 +    mc->smp_props.clusters_supported = true;
 +    mc->auto_enable_numa_with_memhp = true;
 +    mc->auto_enable_numa_with_memdev = true;
 +    /* platform instead of architectural choice */
 +    mc->cpu_cluster_has_numa_boundary = true;
 +    mc->default_ram_id = "mach-virt.ram";
 +    mc->default_nic = "virtio-net-pci";
 +
 +    object_class_property_add(oc, "acpi", "OnOffAuto",
 +        virt_get_acpi, virt_set_acpi,
@ -289,58 +235,12 @@ index 36e9b4b4e9..22bc345137 100644
 +                                          "Set on/off to enable/disable using "
 +                                          "physical address space above 32 bits");
 +
 +    object_class_property_add_bool(oc, "highmem-redists",
 +                                   virt_get_highmem_redists,
 +                                   virt_set_highmem_redists);
 +    object_class_property_set_description(oc, "highmem-redists",
 +                                          "Set on/off to enable/disable high "
 +                                          "memory region for GICv3 or GICv4 "
 +                                          "redistributor");
 +
 +    object_class_property_add_bool(oc, "highmem-ecam",
 +                                   virt_get_highmem_ecam,
 +                                   virt_set_highmem_ecam);
 +    object_class_property_set_description(oc, "highmem-ecam",
 +                                          "Set on/off to enable/disable high "
 +                                          "memory region for PCI ECAM");
 +
 +    object_class_property_add_bool(oc, "highmem-mmio",
 +                                   virt_get_highmem_mmio,
 +                                   virt_set_highmem_mmio);
 +    object_class_property_set_description(oc, "highmem-mmio",
 +                                          "Set on/off to enable/disable high "
 +                                          "memory region for PCI MMIO");
 +
 +    object_class_property_add_str(oc, "gic-version", virt_get_gic_version,
 +                                  virt_set_gic_version);
 +    object_class_property_set_description(oc, "gic-version",
 +                                          "Set GIC version. "
 +                                          "Valid values are 2, 3, host and max");
 +
 +    object_class_property_add_str(oc, "iommu", virt_get_iommu, virt_set_iommu);
 +    object_class_property_set_description(oc, "iommu",
 +                                          "Set the IOMMU type. "
 +                                          "Valid values are none and smmuv3");
 +
 +    object_class_property_add_bool(oc, "default-bus-bypass-iommu",
 +                                   virt_get_default_bus_bypass_iommu,
 +                                   virt_set_default_bus_bypass_iommu);
 +    object_class_property_set_description(oc, "default-bus-bypass-iommu",
 +                                          "Set on/off to enable/disable "
 +                                          "bypass_iommu for default root bus");
 +
 +    object_class_property_add_bool(oc, "ras", virt_get_ras,
 +                                   virt_set_ras);
 +    object_class_property_set_description(oc, "ras",
 +                                          "Set on/off to enable/disable reporting host memory errors "
 +                                          "to a KVM guest using ACPI and guest external abort exceptions");
 +
 +    object_class_property_add_bool(oc, "its", virt_get_its,
 +                                   virt_set_its);
 +    object_class_property_set_description(oc, "its",
 +                                          "Set on/off to enable/disable "
 +                                          "ITS instantiation");
 +
 +    object_class_property_add_str(oc, "x-oem-id",
 +                                  virt_get_oem_id,
 +                                  virt_set_oem_id);
@ -349,7 +249,6 @@ index 36e9b4b4e9..22bc345137 100644
 +                                          "in ACPI table header."
 +                                          "The string may be up to 6 bytes in size");
 +
 +
 +    object_class_property_add_str(oc, "x-oem-table-id",
 +                                  virt_get_oem_table_id,
 +                                  virt_set_oem_table_id);
@ -357,6 +256,10 @@ index 36e9b4b4e9..22bc345137 100644
 +                                          "Override the default value of field OEM Table ID "
 +                                          "in ACPI table header."
 +                                          "The string may be up to 8 bytes in size");
 +    object_class_property_add_bool(oc, "default_bus_bypass_iommu",
 +                                   virt_get_default_bus_bypass_iommu,
 +                                   virt_set_default_bus_bypass_iommu);
 +
 +}
 +
 +static void rhel_virt_instance_init(Object *obj)
@ -372,31 +275,28 @@ index 36e9b4b4e9..22bc345137 100644
 +
 +    /* High memory is enabled by default */
 +    vms->highmem = true;
 +    vms->highmem_compact = !vmc->no_highmem_compact;
 +    vms->gic_version = VIRT_GIC_VERSION_NOSEL;
 +
 +    vms->highmem_ecam = !vmc->no_highmem_ecam;
 +    vms->highmem_mmio = true;
 +    vms->highmem_redists = true;
 +
 +    if (vmc->no_its) {
 +        vms->its = false;
 +    } else {
 +        /* Default allows ITS instantiation */
 +        vms->its = true;
-+
+        object_property_add_bool(obj, "its", virt_get_its,
-+        if (vmc->no_tcg_its) {
+                                 virt_set_its);
-+            vms->tcg_its = false;
+        object_property_set_description(obj, "its",
-+        } else {
+                                        "Set on/off to enable/disable "
-+            vms->tcg_its = true;
+                                        "ITS instantiation");
 +        }
 +    }
 +
 +    /* Default disallows iommu instantiation */
 +    vms->iommu = VIRT_IOMMU_NONE;
-+
+    object_property_add_str(obj, "iommu", virt_get_iommu, virt_set_iommu);
-+    /* The default root bus is attached to iommu by default */
+    object_property_set_description(obj, "iommu",
-+    vms->default_bus_bypass_iommu = false;
+                                    "Set the IOMMU type. "
 +                                    "Valid values are none and smmuv3");
 +
 +    /* Default disallows RAS instantiation and is non-configurable for RHEL */
 +    vms->ras = false;
@ -404,15 +304,13 @@ index 36e9b4b4e9..22bc345137 100644
 +    /* MTE is disabled by default and non-configurable for RHEL */
 +    vms->mte = false;
 +
-+    /* Supply kaslr-seed and rng-seed by default, non-configurable for RHEL */
+    vms->default_bus_bypass_iommu = false;
 +    vms->dtb_randomness = true;
 +
 +    vms->irqmap = a15irqmap;
 +
 +    virt_flash_create(vms);
 +
 +    vms->oem_id = g_strndup(ACPI_BUILD_APPNAME6, 6);
 +    vms->oem_table_id = g_strndup(ACPI_BUILD_APPNAME8, 8);
 +
 +}
 +
 +static const TypeInfo rhel_machine_info = {
@ -435,45 +333,56 @@ index 36e9b4b4e9..22bc345137 100644
 +}
 +type_init(rhel_machine_init);
 +
-+static void rhel940_virt_options(MachineClass *mc)
+static void rhel850_virt_options(MachineClass *mc)
 +{
 +    compat_props_add(mc->compat_props, arm_rhel_compat, arm_rhel_compat_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_5, hw_compat_rhel_8_5_len);
 +}
-+DEFINE_RHEL_MACHINE_AS_LATEST(9, 4, 0)
+DEFINE_RHEL_MACHINE_AS_LATEST(8, 5, 0)
 +
-+static void rhel920_virt_options(MachineClass *mc)
+static void rhel840_virt_options(MachineClass *mc)
 +{
-+    rhel940_virt_options(mc);
+    rhel850_virt_options(mc);
-+
+    compat_props_add(mc->compat_props, hw_compat_rhel_8_4, hw_compat_rhel_8_4_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_4, hw_compat_rhel_9_4_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_3, hw_compat_rhel_9_3_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_2, hw_compat_rhel_9_2_len);
 +
 +    /* RHEL 9.4 is the first supported release */
 +    mc->deprecation_reason =
 +        "machine types for versions prior to 9.4 are deprecated";
 +}
-+DEFINE_RHEL_MACHINE(9, 2, 0)
+DEFINE_RHEL_MACHINE(8, 4, 0)
 +
-+static void rhel900_virt_options(MachineClass *mc)
+static void rhel830_virt_options(MachineClass *mc)
 +{
 +    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
 +
-+    rhel920_virt_options(mc);
+    rhel840_virt_options(mc);
-+
+    compat_props_add(mc->compat_props, hw_compat_rhel_8_3, hw_compat_rhel_8_3_len);
-+    compat_props_add(mc->compat_props, hw_compat_rhel_9_1, hw_compat_rhel_9_1_len);
+    vmc->no_kvm_steal_time = true;
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_0, hw_compat_rhel_9_0_len);
 +
 +    /* Disable FEAT_LPA2 since old kernels (<= v5.12) don't boot with that feature */
 +    vmc->no_tcg_lpa2 = true;
 +    /* Compact layout for high memory regions was introduced with 9.2.0 */
 +    vmc->no_highmem_compact = true;
 +}
-+DEFINE_RHEL_MACHINE(9, 0, 0)
+DEFINE_RHEL_MACHINE(8, 3, 0)
 +
 +static void rhel820_virt_options(MachineClass *mc)
 +{
 +    rhel830_virt_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_2, hw_compat_rhel_8_2_len);
 +    mc->numa_mem_supported = true;
 +    mc->auto_enable_numa_with_memdev = false;
 +}
 +DEFINE_RHEL_MACHINE(8, 2, 0)
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index be4f9864cd..62febde5aa 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -87,6 +87,8 @@ GlobalProperty hw_compat_rhel_8_3[] = {
     { "nvme", "use-intel-id", "on"},
     /* hw_compat_rhel_8_3 from hw_compat_5_1 */
     { "pvpanic", "events", "1"}, /* PVPANIC_PANICKED */
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "pl011", "migrate-clk", "off" },
     /* hw_compat_rhel_8_3 bz 1912846 */
     { "pci-xhci", "x-rh-late-msi-cap", "off" },
     /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
-index bb486d36b1..237fc77bda 100644
+index dc6b66ffc8..9364628847 100644
 --- a/include/hw/arm/virt.h
 +++ b/include/hw/arm/virt.h
-@@ -179,9 +179,17 @@ struct VirtMachineState {
+@@ -175,9 +175,17 @@ struct VirtMachineState {
 #define VIRT_ECAM_ID(high) (high ? VIRT_HIGH_PCIE_ECAM : VIRT_PCIE_ECAM)
@ -492,5 +401,5 @@ index bb486d36b1..237fc77bda 100644
 bool virt_is_acpi_enabled(VirtMachineState *vms);
 -- 
-2.39.3
+2.27.0
--- a/SOURCES/0009-Add-ppc64-machine-types.patch
+++ b/SOURCES/0009-Add-ppc64-machine-types.patch
@ -1,4 +1,4 @@
-From fb905dbe5b51ed899062ef99a2dd7f238d3e3384 Mon Sep 17 00:00:00 2001
+From 3c65320ce5b8ad3bb8c0d8fd13a88c464d5c5845 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 13:27:13 +0200
 Subject: Add ppc64 machine types
@ -7,47 +7,76 @@ Adding changes to add RHEL machine types for ppc64 architecture.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
-Rebase notes (6.2.0):
+Rebase changes (4.0.0):
- Fixed rebase conflict relicts
+- remove instance options and use upstream solution
- Update machine type compat for 6.2 (from MR 66)
+- Use upstream compat handling
 - Replace SPAPR_PCI_2_7_MMIO_WIN_SIZE with value (changed upstream)
 - re-add handling of instance_options (removed upstream)
 - Use p8 as default for rhel machine types (p9 default upstream)
 - sPAPRMachineClass renamed to SpaprMachineClass (upstream)
-Merged patches (6.1.0):
+Rebase changes (4.1.0):
- c438c25ac3 redhat: Define pseries-rhel8.5.0 machine type
+- Update format for compat structures
 - a3995e2eff Remove RHEL 7.0.0 machine type (only ppc64 changes)
 - ad3190a79b Remove RHEL 7.1.0 machine type (only ppc64 changes)
 - 84bbe15d4e Remove RHEL 7.2.0 machine type (only ppc64 changes)
 - 0215eb3356 Remove RHEL 7.3.0 machine types (only ppc64 changes)
 - af69d1ca6e Remove RHEL 7.4.0 machine types (only ppc64 changes)
 - 8f7a74ab78 Remove RHEL 7.5.0 machine types (only ppc64 changes)
-Merged patches (7.1.0):
+Rebase notes (weekly-210303):
- baa6790171 target/ppc/cpu-models: Fix ppc_cpu_aliases list for RHEL
+- Use rhel-8.4.0 hw compat
 Merged patches (4.0.0):
 - 467d59a redhat: define pseries-rhel8.0.0 machine type
 Merged patches (4.1.0):
 - f21757edc target/ppc/spapr: Enable mitigations by default for pseries-4.0 machine type
 - 2511c63 redhat: sync pseries-rhel7.6.0 with rhel-av-8.0.1
 - 89f01da redhat: define pseries-rhel8.1.0 machine type
 Merged patches (4.2.0):
 - bcba728 redhat: update pseries-rhel8.1.0 machine type
 - redhat: update pseries-rhel-7.6.0 machine type (patch 93039)
 - redhat: define pseries-rhel8.2.0 machine type (patch 93041)
 Merged patches (5.1.0):
 - eb121ff spapr: Enable DD2.3 accelerated count cache flush in pseries-5.0 machine (partial)
 Merged patches (5.2.0 rc0):
 - 311a20f redhat: define pseries-rhel8.3.0 machine type
 - 1284167 ppc: Set correct max_cpus value on spapr-rhel* machine types
 - 1ab8783 redhat: update pseries-rhel8.2.0 machine type
 - b162af531a target/ppc: Add experimental option for enabling secure guests
 Merged patches (weekly-201216):
 - 943c936df3 redhat: Add spapr_machine_rhel_default_class_options()
 - 030b5e6fba redhat: Define pseries-rhel8.4.0 machine type
 Merged patches (weekly-210602):
 - b7128d8ef7 redhat: Define pseries-rhel8.5.0 machine type
 Merged patches (weekly-211006):
 - c8f68b47e9 redhat: Update pseries-rhel8.5.0
 ---
- hw/ppc/spapr.c          | 243 ++++++++++++++++++++++++++++++++++++++++
+ hw/ppc/spapr.c          | 382 ++++++++++++++++++++++++++++++++++++++++
- hw/ppc/spapr_cpu_core.c |  13 +++
+ hw/ppc/spapr_cpu_core.c |  13 ++
 include/hw/ppc/spapr.h  |   4 +
- target/ppc/compat.c     |  13 ++-
+ target/ppc/compat.c     |  13 +-
 target/ppc/cpu-models.c |   1 +
 target/ppc/cpu.h        |   1 +
- target/ppc/kvm.c        |  27 +++++
+ target/ppc/kvm.c        |  27 +++
- target/ppc/kvm_ppc.h    |  13 +++
+ target/ppc/kvm_ppc.h    |  13 ++
- 8 files changed, 314 insertions(+), 1 deletion(-)
+ 7 files changed, 452 insertions(+), 1 deletion(-)
 diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
-index e9bc97fee0..a258d81846 100644
+index 3b5fd749be..cace86028d 100644
 --- a/hw/ppc/spapr.c
 +++ b/hw/ppc/spapr.c
-@@ -1718,6 +1718,9 @@ static void spapr_machine_reset(MachineState *machine, ShutdownCause reason)
+@@ -1593,6 +1593,9 @@ static void spapr_machine_reset(MachineState *machine)
     pef_kvm_reset(machine->cgs, &error_fatal);
     spapr_caps_apply(spapr);
     spapr_nested_reset(spapr);
 +    if (spapr->svm_allowed) {
 +        kvmppc_svm_allow(&error_fatal);
 +    }
     first_ppc_cpu = POWERPC_CPU(first_cpu);
     if (kvm_enabled() && kvmppc_has_cap_mmu_radix() &&
-@@ -3421,6 +3424,20 @@ static void spapr_set_host_serial(Object *obj, const char *value, Error **errp)
+@@ -3288,6 +3291,20 @@ static void spapr_set_host_serial(Object *obj, const char *value, Error **errp)
     spapr->host_serial = g_strdup(value);
 }
@ -68,7 +97,7 @@ index e9bc97fee0..a258d81846 100644
 static void spapr_instance_init(Object *obj)
 {
     SpaprMachineState *spapr = SPAPR_MACHINE(obj);
-@@ -3499,6 +3516,12 @@ static void spapr_instance_init(Object *obj)
+@@ -3366,6 +3383,12 @@ static void spapr_instance_init(Object *obj)
         spapr_get_host_serial, spapr_set_host_serial);
     object_property_set_description(obj, "host-serial",
         "Host serial number to advertise in guest device tree");
@ -81,7 +110,7 @@ index e9bc97fee0..a258d81846 100644
 }
 static void spapr_machine_finalizefn(Object *obj)
-@@ -4754,6 +4777,7 @@ static void spapr_machine_class_init(ObjectClass *oc, void *data)
+@@ -4614,6 +4637,7 @@ static void spapr_machine_class_init(ObjectClass *oc, void *data)
     vmc->client_architecture_support = spapr_vof_client_architecture_support;
     vmc->quiesce = spapr_vof_quiesce;
     vmc->setprop = spapr_vof_setprop;
@ -89,15 +118,15 @@ index e9bc97fee0..a258d81846 100644
 }
 static const TypeInfo spapr_machine_info = {
-@@ -4805,6 +4829,7 @@ static void spapr_machine_latest_class_options(MachineClass *mc)
+@@ -4665,6 +4689,7 @@ static void spapr_machine_latest_class_options(MachineClass *mc)
     }                                                                \
     type_init(spapr_machine_register_##suffix)
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 /*
-  * pseries-9.0
+  * pseries-6.2
  */
-@@ -4998,6 +5023,7 @@ static void spapr_machine_4_1_class_options(MachineClass *mc)
+@@ -4781,6 +4806,7 @@ static void spapr_machine_4_1_class_options(MachineClass *mc)
 }
 DEFINE_SPAPR_MACHINE(4_1, "4.1", false);
@ -105,8 +134,8 @@ index e9bc97fee0..a258d81846 100644
 /*
  * pseries-4.0
-@@ -5013,6 +5039,8 @@ static bool phb_placement_4_0(SpaprMachineState *spapr, uint32_t index,
+@@ -4800,6 +4826,8 @@ static bool phb_placement_4_0(SpaprMachineState *spapr, uint32_t index,
-     }
+     *nv2atsd = 0;
     return true;
 }
 +
@ -114,7 +143,23 @@ index e9bc97fee0..a258d81846 100644
 static void spapr_machine_4_0_class_options(MachineClass *mc)
 {
     SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
-@@ -5338,6 +5366,221 @@ static void spapr_machine_2_1_class_options(MachineClass *mc)
+@@ -4958,6 +4986,7 @@ DEFINE_SPAPR_MACHINE(2_8, "2.8", false);
 /*
  * pseries-2.7
  */
 +#endif
 static bool phb_placement_2_7(SpaprMachineState *spapr, uint32_t index,
                               uint64_t *buid, hwaddr *pio,
@@ -5013,6 +5042,7 @@ static bool phb_placement_2_7(SpaprMachineState *spapr, uint32_t index,
     return true;
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void spapr_machine_2_7_class_options(MachineClass *mc)
 {
     SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
@@ -5127,6 +5157,358 @@ static void spapr_machine_2_1_class_options(MachineClass *mc)
     compat_props_add(mc->compat_props, hw_compat_2_1, hw_compat_2_1_len);
 }
 DEFINE_SPAPR_MACHINE(2_1, "2.1", false);
@ -138,14 +183,10 @@ index e9bc97fee0..a258d81846 100644
 +
 +static void spapr_machine_rhel850_class_options(MachineClass *mc)
 +{
 +    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 +
 +    /* The default machine type must apply the RHEL specific defaults */
 +    spapr_machine_rhel_default_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_5,
 +                     hw_compat_rhel_8_5_len);
 +    smc->pre_6_2_numa_affinity = true;
 +    mc->smp_props.prefer_sockets = true;
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel850, "rhel8.5.0", true);
@ -333,14 +374,155 @@ index e9bc97fee0..a258d81846 100644
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel760sxxm, "rhel7.6.0-sxxm", false);
 +
 +static void spapr_machine_rhel750_class_options(MachineClass *mc)
 +{
 +    spapr_machine_rhel760_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_7_5, hw_compat_rhel_7_5_len);
 +
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel750, "rhel7.5.0", false);
 +
 +/*
 + * pseries-rhel7.5.0-sxxm
 + *
 + * pseries-rhel7.5.0 with speculative execution exploit mitigations enabled by default
 + */
 +
 +static void spapr_machine_rhel750sxxm_class_options(MachineClass *mc)
 +{
 +    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 +
 +    spapr_machine_rhel750_class_options(mc);
 +    smc->default_caps.caps[SPAPR_CAP_CFPC] = SPAPR_CAP_WORKAROUND;
 +    smc->default_caps.caps[SPAPR_CAP_SBBC] = SPAPR_CAP_WORKAROUND;
 +    smc->default_caps.caps[SPAPR_CAP_IBS] = SPAPR_CAP_FIXED_CCD;
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel750sxxm, "rhel7.5.0-sxxm", false);
 +
 +/*
 + * pseries-rhel7.4.0
 + * like spapr_compat_2_9
 + */
 +GlobalProperty spapr_compat_rhel7_4[] = {
 +    { TYPE_POWERPC_CPU, "pre-2.10-migration", "on" },
 +};
 +const size_t spapr_compat_rhel7_4_len = G_N_ELEMENTS(spapr_compat_rhel7_4);
 +
 +static void spapr_machine_rhel740_class_options(MachineClass *mc)
 +{
 +    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 +
 +    spapr_machine_rhel750_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_7_4, hw_compat_rhel_7_4_len);
 +    compat_props_add(mc->compat_props, spapr_compat_rhel7_4, spapr_compat_rhel7_4_len);
 +    smc->has_power9_support = false;
 +    smc->pre_2_10_has_unused_icps = true;
 +    smc->resize_hpt_default = SPAPR_RESIZE_HPT_DISABLED;
 +    smc->default_caps.caps[SPAPR_CAP_HTM] = SPAPR_CAP_ON;
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel740, "rhel7.4.0", false);
 +
 +/*
 + * pseries-rhel7.4.0-sxxm
 + *
 + * pseries-rhel7.4.0 with speculative execution exploit mitigations enabled by default
 + */
 +
 +static void spapr_machine_rhel740sxxm_class_options(MachineClass *mc)
 +{
 +    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 +
 +    spapr_machine_rhel740_class_options(mc);
 +    smc->default_caps.caps[SPAPR_CAP_CFPC] = SPAPR_CAP_WORKAROUND;
 +    smc->default_caps.caps[SPAPR_CAP_SBBC] = SPAPR_CAP_WORKAROUND;
 +    smc->default_caps.caps[SPAPR_CAP_IBS] = SPAPR_CAP_FIXED_CCD;
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel740sxxm, "rhel7.4.0-sxxm", false);
 +
 +/*
 + * pseries-rhel7.3.0
 + * like spapr_compat_2_6/_2_7/_2_8 but "ddw" has been backported to RHEL7_3
 + */
 +GlobalProperty spapr_compat_rhel7_3[] = {
 +    { TYPE_SPAPR_PCI_HOST_BRIDGE, "mem_win_size", "0xf80000000" },
 +    { TYPE_SPAPR_PCI_HOST_BRIDGE, "mem64_win_size", "0" },
 +    { TYPE_POWERPC_CPU, "pre-2.8-migration", "on" },
 +    { TYPE_SPAPR_PCI_HOST_BRIDGE, "pre-2.8-migration", "on" },
 +    { TYPE_SPAPR_PCI_HOST_BRIDGE, "pcie-extended-configuration-space", "off" },
 +};
 +const size_t spapr_compat_rhel7_3_len = G_N_ELEMENTS(spapr_compat_rhel7_3);
 +
 +static void spapr_machine_rhel730_class_options(MachineClass *mc)
 +{
 +    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 +
 +    spapr_machine_rhel740_class_options(mc);
 +    mc->default_cpu_type = POWERPC_CPU_TYPE_NAME("power7_v2.3");
 +    mc->default_machine_opts = "modern-hotplug-events=off";
 +    compat_props_add(mc->compat_props, hw_compat_rhel_7_3, hw_compat_rhel_7_3_len);
 +    compat_props_add(mc->compat_props, spapr_compat_rhel7_3, spapr_compat_rhel7_3_len);
 +
 +    smc->phb_placement = phb_placement_2_7;
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel730, "rhel7.3.0", false);
 +
 +/*
 + * pseries-rhel7.3.0-sxxm
 + *
 + * pseries-rhel7.3.0 with speculative execution exploit mitigations enabled by default
 + */
 +
 +static void spapr_machine_rhel730sxxm_class_options(MachineClass *mc)
 +{
 +    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 +
 +    spapr_machine_rhel730_class_options(mc);
 +    smc->default_caps.caps[SPAPR_CAP_CFPC] = SPAPR_CAP_WORKAROUND;
 +    smc->default_caps.caps[SPAPR_CAP_SBBC] = SPAPR_CAP_WORKAROUND;
 +    smc->default_caps.caps[SPAPR_CAP_IBS] = SPAPR_CAP_FIXED_CCD;
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel730sxxm, "rhel7.3.0-sxxm", false);
 +
 +/*
 + * pseries-rhel7.2.0
 + */
 +/* Should be like spapr_compat_2_5 + 2_4 + 2_3, but "dynamic-reconfiguration"
 + * has been backported to RHEL7_2 so we don't need it here.
 + */
 +
 +GlobalProperty spapr_compat_rhel7_2[] = {
 +    { "spapr-vlan", "use-rx-buffer-pools", "off" },
 +    { TYPE_SPAPR_PCI_HOST_BRIDGE, "ddw", "off" },
 +};
 +const size_t spapr_compat_rhel7_2_len = G_N_ELEMENTS(spapr_compat_rhel7_2);
 +
 +static void spapr_machine_rhel720_class_options(MachineClass *mc)
 +{
 +    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 +
 +    spapr_machine_rhel730_class_options(mc);
 +    smc->use_ohci_by_default = true;
 +    mc->has_hotpluggable_cpus = NULL;
 +    compat_props_add(mc->compat_props, hw_compat_rhel_7_2, hw_compat_rhel_7_2_len);
 +    compat_props_add(mc->compat_props, spapr_compat_rhel7_2, spapr_compat_rhel7_2_len);
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel720, "rhel7.2.0", false);
 static void spapr_machine_register_types(void)
 {
 diff --git a/hw/ppc/spapr_cpu_core.c b/hw/ppc/spapr_cpu_core.c
-index 3b0a47a28c..375e0c8e45 100644
+index 8ba34f6a1d..78eca1c04a 100644
 --- a/hw/ppc/spapr_cpu_core.c
 +++ b/hw/ppc/spapr_cpu_core.c
-@@ -25,6 +25,7 @@
+@@ -24,6 +24,7 @@
 #include "sysemu/reset.h"
 #include "sysemu/hw_accel.h"
 #include "qemu/error-report.h"
@ -348,7 +530,7 @@ index 3b0a47a28c..375e0c8e45 100644
 static void spapr_reset_vcpu(PowerPCCPU *cpu)
 {
-@@ -264,6 +265,7 @@ static bool spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
+@@ -250,6 +251,7 @@ static bool spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
 {
     CPUPPCState *env = &cpu->env;
     CPUState *cs = CPU(cpu);
@ -356,9 +538,9 @@ index 3b0a47a28c..375e0c8e45 100644
     if (!qdev_realize(DEVICE(cpu), NULL, errp)) {
         return false;
-@@ -280,6 +282,17 @@ static bool spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
+@@ -261,6 +263,17 @@ static bool spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
-     /* Set time-base frequency to 512 MHz. vhyp must be set first. */
+     cpu_ppc_set_vhyp(cpu, PPC_VIRTUAL_HYPERVISOR(spapr));
-     cpu_ppc_tb_init(env, SPAPR_TIMEBASE_FREQ);
+     kvmppc_set_papr(cpu);
 +    if (!smc->has_power9_support &&
 +        (((spapr->max_compat_pvr &&
@ -375,10 +557,10 @@ index 3b0a47a28c..375e0c8e45 100644
         qdev_unrealize(DEVICE(cpu));
         return false;
 diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
-index 4aaf23d28f..3233c54d11 100644
+index ee7504b976..37a014d59c 100644
 --- a/include/hw/ppc/spapr.h
 +++ b/include/hw/ppc/spapr.h
-@@ -157,6 +157,7 @@ struct SpaprMachineClass {
+@@ -154,6 +154,7 @@ struct SpaprMachineClass {
     bool pre_5_2_numa_associativity;
     bool pre_6_2_numa_affinity;
@ -386,18 +568,18 @@ index 4aaf23d28f..3233c54d11 100644
     bool (*phb_placement)(SpaprMachineState *spapr, uint32_t index,
                           uint64_t *buid, hwaddr *pio,
                           hwaddr *mmio32, hwaddr *mmio64,
-@@ -259,6 +260,9 @@ struct SpaprMachineState {
+@@ -237,6 +238,9 @@ struct SpaprMachineState {
     /* Set by -boot */
     char *boot_device;
- 
+ 
 +    /* Secure Guest support via x-svm-allowed */
 +    bool svm_allowed;
-+
+ 
     /*< public >*/
     char *kvm_type;
     char *host_model;
 diff --git a/target/ppc/compat.c b/target/ppc/compat.c
-index ebef2cccec..ff2c00c60e 100644
+index 7949a24f5a..f207a9ba01 100644
 --- a/target/ppc/compat.c
 +++ b/target/ppc/compat.c
@@ -114,8 +114,19 @@ static const CompatInfo *compat_by_pvr(uint32_t pvr)
@ -421,23 +603,11 @@ index ebef2cccec..ff2c00c60e 100644
 {
     const CompatInfo *compat = compat_by_pvr(compat_pvr);
     const CompatInfo *min = compat_by_pvr(min_compat_pvr);
 diff --git a/target/ppc/cpu-models.c b/target/ppc/cpu-models.c
 index f77ebfcc81..18e9422006 100644
 --- a/target/ppc/cpu-models.c
 +++ b/target/ppc/cpu-models.c
@@ -744,6 +744,7 @@
 /* PowerPC CPU aliases                                                     */
 PowerPCCPUAlias ppc_cpu_aliases[] = {
 +#if 0  /* Disabled for Red Hat Enterprise Linux */
     { "405", "405d4" },
     { "405cr", "405crc" },
     { "405gp", "405gpd" },
 diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
-index 67e6b2effd..11187aeb93 100644
+index e946da5f3a..23e8b76c85 100644
 --- a/target/ppc/cpu.h
 +++ b/target/ppc/cpu.h
-@@ -1655,6 +1655,7 @@ static inline int ppc_env_mmu_index(CPUPPCState *env, bool ifetch)
+@@ -1401,6 +1401,7 @@ static inline int cpu_mmu_index(CPUPPCState *env, bool ifetch)
 /* Compatibility modes */
 #if defined(TARGET_PPC64)
@ -446,18 +616,18 @@ index 67e6b2effd..11187aeb93 100644
                       uint32_t min_compat_pvr, uint32_t max_compat_pvr);
 bool ppc_type_check_compat(const char *cputype, uint32_t compat_pvr,
 diff --git a/target/ppc/kvm.c b/target/ppc/kvm.c
-index 8231feb2d4..59f640cf7b 100644
+index dc93b99189..154888cce5 100644
 --- a/target/ppc/kvm.c
 +++ b/target/ppc/kvm.c
-@@ -89,6 +89,7 @@ static int cap_large_decr;
+@@ -90,6 +90,7 @@ static int cap_ppc_nested_kvm_hv;
 static int cap_large_decr;
 static int cap_fwnmi;
 static int cap_rpt_invalidate;
 static int cap_ail_mode_3;
 +static int cap_ppc_secure_guest;
 static uint32_t debug_inst_opcode;
-@@ -141,6 +142,7 @@ int kvm_arch_init(MachineState *ms, KVMState *s)
+@@ -137,6 +138,7 @@ int kvm_arch_init(MachineState *ms, KVMState *s)
     cap_resize_hpt = kvm_vm_check_extension(s, KVM_CAP_SPAPR_RESIZE_HPT);
     kvmppc_get_cpu_characteristics(s);
     cap_ppc_nested_kvm_hv = kvm_vm_check_extension(s, KVM_CAP_PPC_NESTED_HV);
@ -465,8 +635,8 @@ index 8231feb2d4..59f640cf7b 100644
     cap_large_decr = kvmppc_get_dec_bits();
     cap_fwnmi = kvm_vm_check_extension(s, KVM_CAP_PPC_FWNMI);
     /*
-@@ -2564,6 +2566,16 @@ bool kvmppc_supports_ail_3(void)
+@@ -2563,6 +2565,16 @@ int kvmppc_has_cap_rpt_invalidate(void)
-     return cap_ail_mode_3;
+     return cap_rpt_invalidate;
 }
 +bool kvmppc_has_cap_secure_guest(void)
@ -482,9 +652,9 @@ index 8231feb2d4..59f640cf7b 100644
 PowerPCCPUClass *kvm_ppc_get_host_cpu_class(void)
 {
     uint32_t host_pvr = mfpvr();
-@@ -2964,3 +2976,18 @@ bool kvm_arch_cpu_check_are_resettable(void)
+@@ -2959,3 +2971,18 @@ bool kvm_arch_cpu_check_are_resettable(void)
 void kvm_arch_accel_class_init(ObjectClass *oc)
 {
     return true;
 }
 +
 +void kvmppc_svm_allow(Error **errp)
@ -502,27 +672,27 @@ index 8231feb2d4..59f640cf7b 100644
 +    }
 +}
 diff --git a/target/ppc/kvm_ppc.h b/target/ppc/kvm_ppc.h
-index 1975fb5ee6..d1017f98be 100644
+index ee9325bf9a..20dbb95989 100644
 --- a/target/ppc/kvm_ppc.h
 +++ b/target/ppc/kvm_ppc.h
-@@ -46,6 +46,7 @@ int kvmppc_booke_watchdog_enable(PowerPCCPU *cpu);
+@@ -40,6 +40,7 @@ int kvmppc_booke_watchdog_enable(PowerPCCPU *cpu);
 target_ulong kvmppc_configure_v3_mmu(PowerPCCPU *cpu,
                                      bool radix, bool gtse,
                                      uint64_t proc_tbl);
 +void kvmppc_svm_allow(Error **errp);
 #ifndef CONFIG_USER_ONLY
 bool kvmppc_spapr_use_multitce(void);
 int kvmppc_spapr_enable_inkernel_multitce(void);
- void *kvmppc_create_spapr_tce(uint32_t liobn, uint32_t page_shift,
+@@ -74,6 +75,8 @@ int kvmppc_get_cap_large_decr(void);
-@@ -79,6 +80,8 @@ int kvmppc_enable_cap_large_decr(PowerPCCPU *cpu, int enable);
+ int kvmppc_enable_cap_large_decr(PowerPCCPU *cpu, int enable);
 int kvmppc_has_cap_rpt_invalidate(void);
 bool kvmppc_supports_ail_3(void);
 int kvmppc_enable_hwrng(void);
 +bool kvmppc_has_cap_secure_guest(void);
 +int kvmppc_enable_cap_secure_guest(void);
 int kvmppc_put_books_sregs(PowerPCCPU *cpu);
 PowerPCCPUClass *kvm_ppc_get_host_cpu_class(void);
 void kvmppc_check_papr_resize_hpt(Error **errp);
-@@ -427,6 +430,16 @@ static inline bool kvmppc_supports_ail_3(void)
+@@ -393,6 +396,16 @@ static inline int kvmppc_has_cap_rpt_invalidate(void)
     return false;
 }
@ -540,5 +710,5 @@ index 1975fb5ee6..d1017f98be 100644
 {
     return -1;
 -- 
-2.39.3
+2.27.0
--- a/SOURCES/0009-Add-s390x-machine-types.patch
+++ b/SOURCES/0009-Add-s390x-machine-types.patch
@ -1,308 +0,0 @@
 From 04178c77cfe188b4eed9c08a0bf66842e61fe5dc Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 13:47:32 +0200
 Subject: Add s390x machine types
 Adding changes to add RHEL machine types for s390x architecture.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 --
 Rebase changes (7.1.0):
 - Moved adding rhel_old_machine_deprecation variable to general machine types commit
 Merged patches (6.1.0):
 - 64a9a5c971 hw/s390x: Remove the RHEL7-only machine type
 - 395516d62b redhat: s390x: add rhel-8.5.0 compat machine
 Merged patches (6.2.0):
 - 3bf66f4520 redhat: Add s390x machine type compatibility update for 6.1 rebase
 Merged patches (7.0.0):
 - e6ff4de4f7 redhat: Add s390x machine type compatibility handling for the rebase to v6.2
 - 4b0efa7e21 redhat: Add rhel8.6.0 and rhel9.0.0 machine types for s390x
 - dcc64971bf RHEL: mark old machine types as deprecated (partialy)
 Merged patches (7.1.0):
 - 1d6439527a WRB: Introduce RHEL 9.0.0 hw compat structure (only hw/s390x/s390-virtio-ccw.c chunk)
 - c8ad21ca31 redhat: Update s390x machine type compatibility for rebase to QEMU 7.0.0
 - 5bcf8d874c target/s390x: deprecate CPUs older than z14
 Merged patches (7.2.0):
 - 0be2889fa2 Introduce upstream 7.0 compat changes (only applicable parts)
 Merged patches (8.0.0):
 - 27c188c6a4 redhat: Update s390x machine type compatibility for QEMU 7.2.0 update
 - a932b8d429 redhat: Add new rhel-9.2.0 s390x machine type
 - ac88104bad s390x/s390-virtio-ccw: Activate zPCI features on s390-ccw-virtio-rhel8.6.0
 Merged patches (8.1.0):
 - bd5d81d286 Add RHEL 9.2.0 compat structure (s390x part)
 Merged patches (8.2.0):
 - 4ee284aca9 Add machine types compat bits. (partial)
 ---
 hw/s390x/s390-virtio-ccw.c       | 159 +++++++++++++++++++++++++++++++
 target/s390x/cpu_models.c        |  11 +++
 target/s390x/cpu_models.h        |   2 +
 target/s390x/cpu_models_sysemu.c |   2 +
 4 files changed, 174 insertions(+)
 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
 index b1dcb3857f..ff753a29e0 100644
 --- a/hw/s390x/s390-virtio-ccw.c
 +++ b/hw/s390x/s390-virtio-ccw.c
@@ -859,6 +859,7 @@ bool css_migration_enabled(void)
     }                                                                         \
     type_init(ccw_machine_register_##suffix)
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void ccw_machine_9_0_instance_options(MachineState *machine)
 {
 }
@@ -1272,6 +1273,164 @@ static void ccw_machine_2_4_class_options(MachineClass *mc)
     compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
 }
 DEFINE_CCW_MACHINE(2_4, "2.4", false);
 +#endif
 +
 +
 +static void ccw_machine_rhel940_instance_options(MachineState *machine)
 +{
 +}
 +
 +static void ccw_machine_rhel940_class_options(MachineClass *mc)
 +{
 +}
 +DEFINE_CCW_MACHINE(rhel940, "rhel9.4.0", true);
 +
 +static void ccw_machine_rhel920_instance_options(MachineState *machine)
 +{
 +    ccw_machine_rhel940_instance_options(machine);
 +}
 +
 +static void ccw_machine_rhel920_class_options(MachineClass *mc)
 +{
 +    ccw_machine_rhel940_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_4, hw_compat_rhel_9_4_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_3, hw_compat_rhel_9_3_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_2, hw_compat_rhel_9_2_len);
 +    mc->smp_props.drawers_supported = false;    /* from ccw_machine_8_1 */
 +    mc->smp_props.books_supported = false;      /* from ccw_machine_8_1 */
 +}
 +DEFINE_CCW_MACHINE(rhel920, "rhel9.2.0", false);
 +
 +static void ccw_machine_rhel900_instance_options(MachineState *machine)
 +{
 +    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V6_2 };
 +
 +    ccw_machine_rhel920_instance_options(machine);
 +
 +    s390_set_qemu_cpu_model(0x3906, 14, 2, qemu_cpu_feat);
 +    s390_cpudef_featoff_greater(16, 1, S390_FEAT_PAIE);
 +}
 +
 +static void ccw_machine_rhel900_class_options(MachineClass *mc)
 +{
 +    S390CcwMachineClass *s390mc = S390_CCW_MACHINE_CLASS(mc);
 +    static GlobalProperty compat[] = {
 +        { TYPE_S390_PCI_DEVICE, "interpret", "off", },
 +        { TYPE_S390_PCI_DEVICE, "forwarding-assist", "off", },
 +    };
 +
 +    ccw_machine_rhel920_class_options(mc);
 +
 +    compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_1, hw_compat_rhel_9_1_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_0, hw_compat_rhel_9_0_len);
 +    s390mc->max_threads = S390_MAX_CPUS;
 +}
 +DEFINE_CCW_MACHINE(rhel900, "rhel9.0.0", false);
 +
 +static void ccw_machine_rhel860_instance_options(MachineState *machine)
 +{
 +    /* Note: The -rhel8.6.0 and -rhel9.0.0 machines are technically identical */
 +    ccw_machine_rhel900_instance_options(machine);
 +}
 +
 +static void ccw_machine_rhel860_class_options(MachineClass *mc)
 +{
 +    static GlobalProperty compat[] = {
 +        { TYPE_S390_PCI_DEVICE, "interpret", "on", },
 +        { TYPE_S390_PCI_DEVICE, "forwarding-assist", "on", },
 +    };
 +
 +    ccw_machine_rhel900_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_6, hw_compat_rhel_8_6_len);
 +    compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
 +
 +    /* All RHEL machines for prior major releases are deprecated */
 +    mc->deprecation_reason = rhel_old_machine_deprecation;
 +}
 +DEFINE_CCW_MACHINE(rhel860, "rhel8.6.0", false);
 +
 +static void ccw_machine_rhel850_instance_options(MachineState *machine)
 +{
 +    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V6_0 };
 +
 +    ccw_machine_rhel860_instance_options(machine);
 +
 +    s390_set_qemu_cpu_model(0x2964, 13, 2, qemu_cpu_feat);
 +
 +    s390_cpudef_featoff_greater(16, 1, S390_FEAT_NNPA);
 +    s390_cpudef_featoff_greater(16, 1, S390_FEAT_VECTOR_PACKED_DECIMAL_ENH2);
 +    s390_cpudef_featoff_greater(16, 1, S390_FEAT_BEAR_ENH);
 +    s390_cpudef_featoff_greater(16, 1, S390_FEAT_RDP);
 +    s390_cpudef_featoff_greater(16, 1, S390_FEAT_PAI);
 +}
 +
 +static void ccw_machine_rhel850_class_options(MachineClass *mc)
 +{
 +    static GlobalProperty compat[] = {
 +        { TYPE_S390_PCI_DEVICE, "interpret", "off", },
 +        { TYPE_S390_PCI_DEVICE, "forwarding-assist", "off", },
 +    };
 +
 +    ccw_machine_rhel860_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_5, hw_compat_rhel_8_5_len);
 +    compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
 +    mc->smp_props.prefer_sockets = true;
 +}
 +DEFINE_CCW_MACHINE(rhel850, "rhel8.5.0", false);
 +
 +static void ccw_machine_rhel840_instance_options(MachineState *machine)
 +{
 +    ccw_machine_rhel850_instance_options(machine);
 +}
 +
 +static void ccw_machine_rhel840_class_options(MachineClass *mc)
 +{
 +    ccw_machine_rhel850_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_4, hw_compat_rhel_8_4_len);
 +}
 +DEFINE_CCW_MACHINE(rhel840, "rhel8.4.0", false);
 +
 +static void ccw_machine_rhel820_instance_options(MachineState *machine)
 +{
 +    ccw_machine_rhel840_instance_options(machine);
 +}
 +
 +static void ccw_machine_rhel820_class_options(MachineClass *mc)
 +{
 +    ccw_machine_rhel840_class_options(mc);
 +    mc->fixup_ram_size = s390_fixup_ram_size;
 +    /* we did not publish a rhel8.3.0 machine */
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_3, hw_compat_rhel_8_3_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_2, hw_compat_rhel_8_2_len);
 +}
 +DEFINE_CCW_MACHINE(rhel820, "rhel8.2.0", false);
 +
 +static void ccw_machine_rhel760_instance_options(MachineState *machine)
 +{
 +    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V3_1 };
 +
 +    ccw_machine_rhel820_instance_options(machine);
 +
 +    s390_set_qemu_cpu_model(0x2827, 12, 2, qemu_cpu_feat);
 +
 +    /* The multiple-epoch facility was not available with rhel7.6.0 on z14GA1 */
 +    s390_cpudef_featoff(14, 1, S390_FEAT_MULTIPLE_EPOCH);
 +    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_QSIE);
 +    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_QTOUE);
 +    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_STOE);
 +    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_STOUE);
 +}
 +
 +static void ccw_machine_rhel760_class_options(MachineClass *mc)
 +{
 +    ccw_machine_rhel820_class_options(mc);
 +    /* We never published the s390x version of RHEL-AV 8.0 and 8.1, so add this here */
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_1, hw_compat_rhel_8_1_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_0, hw_compat_rhel_8_0_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_7_6, hw_compat_rhel_7_6_len);
 +}
 +DEFINE_CCW_MACHINE(rhel760, "rhel7.6.0", false);
 static void ccw_machine_register_types(void)
 {
 diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c
 index 8ed3bb6a27..370b3b3065 100644
 --- a/target/s390x/cpu_models.c
 +++ b/target/s390x/cpu_models.c
@@ -46,6 +46,9 @@
  * of a following release have been a superset of the previous release. With
  * generation 15 one base feature and one optional feature have been deprecated.
  */
 +
 +#define RHEL_CPU_DEPRECATION "use at least 'z14', or 'host' / 'qemu' / 'max'"
 +
 static S390CPUDef s390_cpu_defs[] = {
     CPUDEF_INIT(0x2064, 7, 1, 38, 0x00000000U, "z900", "IBM zSeries 900 GA1"),
     CPUDEF_INIT(0x2064, 7, 2, 38, 0x00000000U, "z900.2", "IBM zSeries 900 GA2"),
@@ -866,22 +869,30 @@ static void s390_host_cpu_model_class_init(ObjectClass *oc, void *data)
 static void s390_base_cpu_model_class_init(ObjectClass *oc, void *data)
 {
     S390CPUClass *xcc = S390_CPU_CLASS(oc);
 +    CPUClass *cc = CPU_CLASS(oc);
     /* all base models are migration safe */
     xcc->cpu_def = (const S390CPUDef *) data;
     xcc->is_migration_safe = true;
     xcc->is_static = true;
     xcc->desc = xcc->cpu_def->desc;
 +    if (xcc->cpu_def->gen < 14) {
 +        cc->deprecation_note = RHEL_CPU_DEPRECATION;
 +    }
 }
 static void s390_cpu_model_class_init(ObjectClass *oc, void *data)
 {
     S390CPUClass *xcc = S390_CPU_CLASS(oc);
 +    CPUClass *cc = CPU_CLASS(oc);
     /* model that can change between QEMU versions */
     xcc->cpu_def = (const S390CPUDef *) data;
     xcc->is_migration_safe = true;
     xcc->desc = xcc->cpu_def->desc;
 +    if (xcc->cpu_def->gen < 14) {
 +        cc->deprecation_note = RHEL_CPU_DEPRECATION;
 +    }
 }
 static void s390_qemu_cpu_model_class_init(ObjectClass *oc, void *data)
 diff --git a/target/s390x/cpu_models.h b/target/s390x/cpu_models.h
 index d7b8912989..1a806a97c4 100644
 --- a/target/s390x/cpu_models.h
 +++ b/target/s390x/cpu_models.h
@@ -38,6 +38,8 @@ typedef struct S390CPUDef {
     S390FeatBitmap full_feat;
     /* used to init full_feat from generated data */
     S390FeatInit full_init;
 +    /* if deprecated, provides a suggestion */
 +    const char *deprecation_note;
 } S390CPUDef;
 /* CPU model based on a CPU definition */
 diff --git a/target/s390x/cpu_models_sysemu.c b/target/s390x/cpu_models_sysemu.c
 index 0728bfcc20..ca2e5d91e2 100644
 --- a/target/s390x/cpu_models_sysemu.c
 +++ b/target/s390x/cpu_models_sysemu.c
@@ -59,6 +59,7 @@ static void create_cpu_model_list(ObjectClass *klass, void *opaque)
     CpuDefinitionInfo *info;
     char *name = g_strdup(object_class_get_name(klass));
     S390CPUClass *scc = S390_CPU_CLASS(klass);
 +    CPUClass *cc = CPU_CLASS(klass);
     /* strip off the -s390x-cpu */
     g_strrstr(name, "-" TYPE_S390_CPU)[0] = 0;
@@ -68,6 +69,7 @@ static void create_cpu_model_list(ObjectClass *klass, void *opaque)
     info->migration_safe = scc->is_migration_safe;
     info->q_static = scc->is_static;
     info->q_typename = g_strdup(object_class_get_name(klass));
 +    info->deprecated = !!cc->deprecation_note;
     /* check for unavailable features */
     if (cpu_list_data->model) {
         Object *obj;
 -- 
 2.39.3
--- a/SOURCES/0010-Add-s390x-machine-types.patch
+++ b/SOURCES/0010-Add-s390x-machine-types.patch
@ -0,0 +1,165 @@
 From 4ad9a0d0582eef78946b47563eb2c5b7ddf0cbb0 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 13:47:32 +0200
 Subject: Add s390x machine types
 Adding changes to add RHEL machine types for s390x architecture.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 Rebase changes (weekly-4.1.0):
 - Use upstream compat handling
 Rebase notes (weekly-210303):
 - Use rhel-8.4.0 hw compat
 Merged patches (3.1.0):
 - 29df663 s390x/cpumodel: default enable bpb and ppa15 for z196 and later
 Merged patches (4.1.0):
 - 6c200d665b hw/s390x/s390-virtio-ccw: Add machine types for RHEL8.0.0
 Merged patches (4.2.0):
 - fb192e5 redhat: s390x: Rename s390-ccw-virtio-rhel8.0.0 to s390-ccw-virtio-rhel8.1.0
 - a9b22e8 redhat: s390x: Add proper compatibility options for the -rhel7.6.0 machine
 - hw/s390x: Add the s390-ccw-virtio-rhel8.2.0 machine types (patch 92954)
 Merged patches (weekly-201216):
 - a6ae745cce redhat: s390x: add rhel-8.4.0 compat machine
 Merged patches (weekly-210602):
 - 50835d3429 redhat: s390x: add rhel-8.5.0 compat machine
 Merged patches (weekly-211006):
 - a3bcde27fe redhat: Add s390x machine type compatibility update for 6.1 rebase
 ---
 hw/s390x/s390-virtio-ccw.c | 99 +++++++++++++++++++++++++++++++++++++-
 1 file changed, 98 insertions(+), 1 deletion(-)
 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
 index 653587ea62..181856e6cf 100644
 --- a/hw/s390x/s390-virtio-ccw.c
 +++ b/hw/s390x/s390-virtio-ccw.c
@@ -767,7 +767,7 @@ bool css_migration_enabled(void)
     {                                                                         \
         MachineClass *mc = MACHINE_CLASS(oc);                                 \
         ccw_machine_##suffix##_class_options(mc);                             \
 -        mc->desc = "VirtIO-ccw based S390 machine v" verstr;                  \
 +        mc->desc = "VirtIO-ccw based S390 machine " verstr;                   \
         if (latest) {                                                         \
             mc->alias = "s390-ccw-virtio";                                    \
             mc->is_default = true;                                            \
@@ -791,6 +791,7 @@ bool css_migration_enabled(void)
     }                                                                         \
     type_init(ccw_machine_register_##suffix)
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void ccw_machine_6_2_instance_options(MachineState *machine)
 {
 }
@@ -1100,6 +1101,102 @@ static void ccw_machine_2_4_class_options(MachineClass *mc)
     compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
 }
 DEFINE_CCW_MACHINE(2_4, "2.4", false);
 +#endif
 +
 +static void ccw_machine_rhel850_instance_options(MachineState *machine)
 +{
 +}
 +
 +static void ccw_machine_rhel850_class_options(MachineClass *mc)
 +{
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_5, hw_compat_rhel_8_5_len);
 +}
 +DEFINE_CCW_MACHINE(rhel850, "rhel8.5.0", true);
 +
 +static void ccw_machine_rhel840_instance_options(MachineState *machine)
 +{
 +    ccw_machine_rhel850_instance_options(machine);
 +}
 +
 +static void ccw_machine_rhel840_class_options(MachineClass *mc)
 +{
 +    ccw_machine_rhel850_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_4, hw_compat_rhel_8_4_len);
 +}
 +DEFINE_CCW_MACHINE(rhel840, "rhel8.4.0", false);
 +
 +static void ccw_machine_rhel820_instance_options(MachineState *machine)
 +{
 +    ccw_machine_rhel840_instance_options(machine);
 +}
 +
 +static void ccw_machine_rhel820_class_options(MachineClass *mc)
 +{
 +    ccw_machine_rhel840_class_options(mc);
 +    mc->fixup_ram_size = s390_fixup_ram_size;
 +    /* we did not publish a rhel8.3.0 machine */
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_3, hw_compat_rhel_8_3_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_2, hw_compat_rhel_8_2_len);
 +}
 +DEFINE_CCW_MACHINE(rhel820, "rhel8.2.0", false);
 +
 +static void ccw_machine_rhel760_instance_options(MachineState *machine)
 +{
 +    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V3_1 };
 +
 +    ccw_machine_rhel820_instance_options(machine);
 +
 +    s390_set_qemu_cpu_model(0x2827, 12, 2, qemu_cpu_feat);
 +
 +    /* The multiple-epoch facility was not available with rhel7.6.0 on z14GA1 */
 +    s390_cpudef_featoff(14, 1, S390_FEAT_MULTIPLE_EPOCH);
 +    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_QSIE);
 +    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_QTOUE);
 +    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_STOE);
 +    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_STOUE);
 +}
 +
 +static void ccw_machine_rhel760_class_options(MachineClass *mc)
 +{
 +    ccw_machine_rhel820_class_options(mc);
 +    /* We never published the s390x version of RHEL-AV 8.0 and 8.1, so add this here */
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_1, hw_compat_rhel_8_1_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_0, hw_compat_rhel_8_0_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_7_6, hw_compat_rhel_7_6_len);
 +}
 +DEFINE_CCW_MACHINE(rhel760, "rhel7.6.0", false);
 +
 +static void ccw_machine_rhel750_instance_options(MachineState *machine)
 +{
 +    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V2_11 };
 +    ccw_machine_rhel760_instance_options(machine);
 +
 +    /* before 2.12 we emulated the very first z900, and RHEL 7.5 is
 +       based on 2.10 */
 +    s390_set_qemu_cpu_model(0x2064, 7, 1, qemu_cpu_feat);
 +
 +    /* bpb and ppa15 were only in the full model in RHEL 7.5 */
 +    s390_cpudef_featoff_greater(11, 1, S390_FEAT_PPA15);
 +    s390_cpudef_featoff_greater(11, 1, S390_FEAT_BPB);
 +}
 +
 +GlobalProperty ccw_compat_rhel_7_5[] = {
 +        {
 +            .driver   = TYPE_SCLP_EVENT_FACILITY,
 +            .property = "allow_all_mask_sizes",
 +            .value    = "off",
 +        },
 +};
 +const size_t ccw_compat_rhel_7_5_len = G_N_ELEMENTS(ccw_compat_rhel_7_5);
 +
 +static void ccw_machine_rhel750_class_options(MachineClass *mc)
 +{
 +    ccw_machine_rhel760_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_7_5, hw_compat_rhel_7_5_len);
 +    compat_props_add(mc->compat_props, ccw_compat_rhel_7_5, ccw_compat_rhel_7_5_len);
 +    S390_CCW_MACHINE_CLASS(mc)->hpage_1m_allowed = false;
 +}
 +DEFINE_CCW_MACHINE(rhel750, "rhel7.5.0", false);
 static void ccw_machine_register_types(void)
 {
 -- 
 2.27.0
--- a/SOURCES/0010-Add-x86_64-machine-types.patch
+++ b/SOURCES/0010-Add-x86_64-machine-types.patch
@ -1,974 +0,0 @@
 From 3c88acb005806ad2386ab6c94a8831151f624738 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 13:10:31 +0200
 Subject: Add x86_64 machine types
 Adding changes to add RHEL machine types for x86_64 architecture.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 Rebase notes (6.1.0):
 - Update qemu64 cpu spec
 Rebase notes (7.0.0):
 - Reset alias for all machine-types except latest one
 Rebase notes (8.0.0):
 - remove legacy_no_rng_seed usage (removed upstream)
 Rebase notes (8.1.0):
 - default_nic_model to default_nic
 Merged patches (6.1.0):
 - 59c284ad3b x86: Add x86 rhel8.5 machine types
 - a8868b42fe redhat: x86: Enable 'kvm-asyncpf-int' by default
 - a3995e2eff Remove RHEL 7.0.0 machine type (only x86_64 changes)
 - ad3190a79b Remove RHEL 7.1.0 machine type (only x86_64 changes)
 - 84bbe15d4e Remove RHEL 7.2.0 machine type (only x86_64 changes)
 - 0215eb3356 Remove RHEL 7.3.0 machine types (only x86_64 changes)
 - af69d1ca6e Remove RHEL 7.4.0 machine types (only x86_64 changes)
 - 8f7a74ab78 Remove RHEL 7.5.0 machine types (only x86_64 changes)
 Merged patches (7.0.0):
 - eae7d8dd3c x86/rhel machine types: Add pc_rhel_8_5_compat
 - 6762f56469 x86/rhel machine types: Wire compat into q35 and i440fx
 - 5762101438 rhel machine types/x86: set prefer_sockets
 - 9ba9ddc632 x86: Add q35 RHEL 8.6.0 machine type
 - 6110d865e5 x86: Add q35 RHEL 9.0.0 machine type
 - dcc64971bf RHEL: mark old machine types as deprecated (partialy)
 - 6b396f182b RHEL: disable "seqpacket" for "vhost-vsock-device" in rhel8.6.0
 Merged patches (7.1.0):
 -  38b89dc245 pc: Move s3/s4 suspend disabling to compat (only hw/i386/pc.c chunk)
 -  1d6439527a WRB: Introduce RHEL 9.0.0 hw compat structure (x86_64 specific changes)
 - 35b5c8554f target/i386: deprecate CPUs older than x86_64-v2 ABI
 Merged patches (7.2.0):
 - 0be2889fa2 Introduce upstream 7.0 compat changes (only applicable parts)
 Merged patches (8.0.0):
 - f33ca8aed4 x86: rhel 9.2.0 machine type
 Merged patches (8.1.0):
 - bd5d81d286 Add RHEL 9.2.0 compat structure (x86_64 part)
 - c6eaf73add redhat: hw/i386/pc: Update x86 machine type compatibility for QEMU 8.0.0 update
 - 6cbf496e5e hw/acpi: Mark acpi blobs as resizable on RHEL pc machines version 7.6 and above
 Merged patches (8.2.0):
 - 4ee284aca9 Add machine types compat bits. (partial)
 - 719e2ac147 Fix x86 machine type compatibility for qemu-kvm 8.1.0
 Merged patches (9.0.0 rc0):
 - 9149e2bc8f x86: rhel 9.2.0 machine type compat fix
 ---
 hw/i386/fw_cfg.c           |   2 +-
 hw/i386/pc.c               | 159 ++++++++++++++++++++-
 hw/i386/pc_piix.c          | 109 ++++++++++++++
 hw/i386/pc_q35.c           | 285 +++++++++++++++++++++++++++++++++++++
 include/hw/boards.h        |   2 +
 include/hw/i386/pc.h       |  33 +++++
 target/i386/cpu.c          |  21 +++
 target/i386/kvm/kvm-cpu.c  |   1 +
 target/i386/kvm/kvm.c      |   4 +
 tests/qtest/pvpanic-test.c |   5 +-
 10 files changed, 617 insertions(+), 4 deletions(-)
 diff --git a/hw/i386/fw_cfg.c b/hw/i386/fw_cfg.c
 index c7aa39a13e..283c3f4c16 100644
 --- a/hw/i386/fw_cfg.c
 +++ b/hw/i386/fw_cfg.c
@@ -63,7 +63,7 @@ void fw_cfg_build_smbios(PCMachineState *pcms, FWCfgState *fw_cfg,
     if (pcmc->smbios_defaults) {
         /* These values are guest ABI, do not change */
 -        smbios_set_defaults("QEMU", mc->desc, mc->name,
 +        smbios_set_defaults("Red Hat", "KVM", mc->desc,
                             pcmc->smbios_uuid_encoded,
                             pcmc->smbios_stream_product, pcmc->smbios_stream_version);
     }
 diff --git a/hw/i386/pc.c b/hw/i386/pc.c
 index 5c21b0c4db..4a154c1a9a 100644
 --- a/hw/i386/pc.c
 +++ b/hw/i386/pc.c
@@ -326,6 +326,161 @@ GlobalProperty pc_compat_2_0[] = {
 };
 const size_t pc_compat_2_0_len = G_N_ELEMENTS(pc_compat_2_0);
 +/* This macro is for changes to properties that are RHEL specific,
 + * different to the current upstream and to be applied to the latest
 + * machine type.
 + */
 +GlobalProperty pc_rhel_compat[] = {
 +    /* we don't support s3/s4 suspend */
 +    { "PIIX4_PM", "disable_s3", "1" },
 +    { "PIIX4_PM", "disable_s4", "1" },
 +    { "ICH9-LPC", "disable_s3", "1" },
 +    { "ICH9-LPC", "disable_s4", "1" },
 +
 +    { TYPE_X86_CPU, "host-phys-bits", "on" },
 +    { TYPE_X86_CPU, "host-phys-bits-limit", "48" },
 +    { TYPE_X86_CPU, "vmx-entry-load-perf-global-ctrl", "off" },
 +    { TYPE_X86_CPU, "vmx-exit-load-perf-global-ctrl", "off" },
 +    /* bz 1508330 */
 +    { "vfio-pci", "x-no-geforce-quirks", "on" },
 +    /* bz 1941397 */
 +    { TYPE_X86_CPU, "kvm-asyncpf-int", "on" },
 +};
 +const size_t pc_rhel_compat_len = G_N_ELEMENTS(pc_rhel_compat);
 +
 +GlobalProperty pc_rhel_9_3_compat[] = {
 +    /* pc_rhel_9_3_compat from pc_compat_8_0 */
 +    { "virtio-mem", "unplugged-inaccessible", "auto" },
 +};
 +const size_t pc_rhel_9_3_compat_len = G_N_ELEMENTS(pc_rhel_9_3_compat);
 +
 +GlobalProperty pc_rhel_9_2_compat[] = {
 +    /* pc_rhel_9_2_compat from pc_compat_7_2 */
 +    { "ICH9-LPC", "noreboot", "true" },
 +};
 +const size_t pc_rhel_9_2_compat_len = G_N_ELEMENTS(pc_rhel_9_2_compat);
 +
 +GlobalProperty pc_rhel_9_0_compat[] = {
 +    /* pc_rhel_9_0_compat from pc_compat_6_2 */
 +    { "virtio-mem", "unplugged-inaccessible", "off" },
 +};
 +const size_t pc_rhel_9_0_compat_len = G_N_ELEMENTS(pc_rhel_9_0_compat);
 +
 +GlobalProperty pc_rhel_8_5_compat[] = {
 +    /* pc_rhel_8_5_compat from pc_compat_6_0 */
 +    { "qemu64" "-" TYPE_X86_CPU, "family", "6" },
 +    /* pc_rhel_8_5_compat from pc_compat_6_0 */
 +    { "qemu64" "-" TYPE_X86_CPU, "model", "6" },
 +    /* pc_rhel_8_5_compat from pc_compat_6_0 */
 +    { "qemu64" "-" TYPE_X86_CPU, "stepping", "3" },
 +    /* pc_rhel_8_5_compat from pc_compat_6_0 */
 +    { TYPE_X86_CPU, "x-vendor-cpuid-only", "off" },
 +    /* pc_rhel_8_5_compat from pc_compat_6_0 */
 +    { "ICH9-LPC", ACPI_PM_PROP_ACPI_PCIHP_BRIDGE, "off" },
 +
 +    /* pc_rhel_8_5_compat from pc_compat_6_1 */
 +    { TYPE_X86_CPU, "hv-version-id-build", "0x1bbc" },
 +    /* pc_rhel_8_5_compat from pc_compat_6_1 */
 +    { TYPE_X86_CPU, "hv-version-id-major", "0x0006" },
 +    /* pc_rhel_8_5_compat from pc_compat_6_1 */
 +    { TYPE_X86_CPU, "hv-version-id-minor", "0x0001" },
 +};
 +const size_t pc_rhel_8_5_compat_len = G_N_ELEMENTS(pc_rhel_8_5_compat);
 +
 +GlobalProperty pc_rhel_8_4_compat[] = {
 +    /* pc_rhel_8_4_compat from pc_compat_5_2 */
 +    { "ICH9-LPC", "x-smi-cpu-hotunplug", "off" },
 +    { TYPE_X86_CPU, "kvm-asyncpf-int", "off" },
 +};
 +const size_t pc_rhel_8_4_compat_len = G_N_ELEMENTS(pc_rhel_8_4_compat);
 +
 +GlobalProperty pc_rhel_8_3_compat[] = {
 +    /* pc_rhel_8_3_compat from pc_compat_5_1 */
 +    { "ICH9-LPC", "x-smi-cpu-hotplug", "off" },
 +};
 +const size_t pc_rhel_8_3_compat_len = G_N_ELEMENTS(pc_rhel_8_3_compat);
 +
 +GlobalProperty pc_rhel_8_2_compat[] = {
 +    /* pc_rhel_8_2_compat from pc_compat_4_2 */
 +    { "mch", "smbase-smram", "off" },
 +};
 +const size_t pc_rhel_8_2_compat_len = G_N_ELEMENTS(pc_rhel_8_2_compat);
 +
 +/* pc_rhel_8_1_compat is empty since pc_4_1_compat is */
 +GlobalProperty pc_rhel_8_1_compat[] = { };
 +const size_t pc_rhel_8_1_compat_len = G_N_ELEMENTS(pc_rhel_8_1_compat);
 +
 +GlobalProperty pc_rhel_8_0_compat[] = {
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "intel-iommu", "dma-drain", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "Opteron_G3" "-" TYPE_X86_CPU, "rdtscp", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "Opteron_G4" "-" TYPE_X86_CPU, "rdtscp", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "Opteron_G4" "-" TYPE_X86_CPU, "npt", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "Opteron_G4" "-" TYPE_X86_CPU, "nrip-save", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "Opteron_G5" "-" TYPE_X86_CPU, "rdtscp", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "Opteron_G5" "-" TYPE_X86_CPU, "npt", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "Opteron_G5" "-" TYPE_X86_CPU, "nrip-save", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "EPYC" "-" TYPE_X86_CPU, "npt", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "EPYC" "-" TYPE_X86_CPU, "nrip-save", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "EPYC-IBPB" "-" TYPE_X86_CPU, "npt", "off" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "EPYC-IBPB" "-" TYPE_X86_CPU, "nrip-save", "off" },
 +    /** The mpx=on entries from pc_compat_3_1 are in pc_rhel_7_6_compat **/
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { "Cascadelake-Server" "-" TYPE_X86_CPU, "stepping", "5" },
 +    /* pc_rhel_8_0_compat from pc_compat_3_1 */
 +    { TYPE_X86_CPU, "x-intel-pt-auto-level", "off" },
 +};
 +const size_t pc_rhel_8_0_compat_len = G_N_ELEMENTS(pc_rhel_8_0_compat);
 +
 +/* Similar to PC_COMPAT_3_0 + PC_COMPAT_2_12, but:
 + * all of the 2_12 stuff was already in 7.6 from bz 1481253
 + * x-migrate-smi-count comes from PC_COMPAT_2_11 but
 + * is really tied to kernel version so keep it off on 7.x
 + * machine types irrespective of host.
 + */
 +GlobalProperty pc_rhel_7_6_compat[] = {
 +    /* pc_rhel_7_6_compat from pc_compat_3_0 */
 +    { TYPE_X86_CPU, "x-hv-synic-kvm-only", "on" },
 +    /* pc_rhel_7_6_compat from pc_compat_3_0 */
 +    { "Skylake-Server" "-" TYPE_X86_CPU, "pku", "off" },
 +    /* pc_rhel_7_6_compat from pc_compat_3_0 */
 +    { "Skylake-Server-IBRS" "-" TYPE_X86_CPU, "pku", "off" },
 +    /* pc_rhel_7_6_compat from pc_compat_2_11 */
 +    { TYPE_X86_CPU, "x-migrate-smi-count", "off" },
 +    /* pc_rhel_7_6_compat from pc_compat_2_11 */
 +    { "Skylake-Client" "-" TYPE_X86_CPU, "mpx", "on" },
 +    /* pc_rhel_7_6_compat from pc_compat_2_11 */
 +    { "Skylake-Client-IBRS" "-" TYPE_X86_CPU, "mpx", "on" },
 +    /* pc_rhel_7_6_compat from pc_compat_2_11 */
 +    { "Skylake-Server" "-" TYPE_X86_CPU, "mpx", "on" },
 +    /* pc_rhel_7_6_compat from pc_compat_2_11 */
 +    { "Skylake-Server-IBRS" "-" TYPE_X86_CPU, "mpx", "on" },
 +    /* pc_rhel_7_6_compat from pc_compat_2_11 */
 +    { "Cascadelake-Server" "-" TYPE_X86_CPU, "mpx", "on" },
 +    /* pc_rhel_7_6_compat from pc_compat_2_11 */
 +    { "Icelake-Client" "-" TYPE_X86_CPU, "mpx", "on" },
 +    /* pc_rhel_7_6_compat from pc_compat_2_11 */
 +    { "Icelake-Server" "-" TYPE_X86_CPU, "mpx", "on" },
 +};
 +const size_t pc_rhel_7_6_compat_len = G_N_ELEMENTS(pc_rhel_7_6_compat);
 +
 +/*
 + * The PC_RHEL_*_COMPAT serve the same purpose for RHEL-7 machine
 + * types as the PC_COMPAT_* do for upstream types.
 + * PC_RHEL_7_*_COMPAT apply both to i440fx and q35 types.
 + */
 +
 GSIState *pc_gsi_create(qemu_irq **irqs, bool pci_enabled)
 {
     GSIState *s;
@@ -1813,6 +1968,7 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
     pcmc->resizable_acpi_blob = true;
     x86mc->apic_xrupt_override = true;
     assert(!mc->get_hotplug_handler);
 +    mc->async_pf_vmexit_disable = false;
     mc->get_hotplug_handler = pc_get_hotplug_handler;
     mc->hotplug_allowed = pc_hotplug_allowed;
     mc->cpu_index_to_instance_props = x86_cpu_index_to_props;
@@ -1823,7 +1979,8 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
     mc->has_hotpluggable_cpus = true;
     mc->default_boot_order = "cad";
     mc->block_default_type = IF_IDE;
 -    mc->max_cpus = 255;
 +    /* 240: max CPU count for RHEL */
 +    mc->max_cpus = 240;
     mc->reset = pc_machine_reset;
     mc->wakeup = pc_machine_wakeup;
     hc->pre_plug = pc_machine_device_pre_plug_cb;
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
 index 18ba076609..a647262d63 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
@@ -52,6 +52,7 @@
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "sysemu/xen.h"
 +#include "migration/migration.h"
 #ifdef CONFIG_XEN
 #include <xen/hvm/hvm_info_table.h>
 #include "hw/xen/xen_pt.h"
@@ -422,6 +423,7 @@ static void pc_set_south_bridge(Object *obj, int value, Error **errp)
  * hw_compat_*, pc_compat_*, or * pc_*_machine_options().
  */
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void pc_compat_2_3_fn(MachineState *machine)
 {
     X86MachineState *x86ms = X86_MACHINE(machine);
@@ -951,3 +953,110 @@ static void xenfv_3_1_machine_options(MachineClass *m)
 DEFINE_PC_MACHINE(xenfv, "xenfv-3.1", pc_xen_hvm_init,
                   xenfv_3_1_machine_options);
 #endif
 +#endif  /* Disabled for Red Hat Enterprise Linux */
 +
 +/* Red Hat Enterprise Linux machine types */
 +
 +/* Options for the latest rhel7 machine type */
 +static void pc_machine_rhel7_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    m->family = "pc_piix_Y";
 +    m->default_machine_opts = "firmware=bios-256k.bin,hpet=off";
 +    pcmc->pci_root_uid = 0;
 +    pcmc->resizable_acpi_blob = true;
 +    m->default_nic = "e1000";
 +    m->default_display = "std";
 +    m->no_parallel = 1;
 +    m->numa_mem_supported = true;
 +    m->auto_enable_numa_with_memdev = false;
 +    machine_class_allow_dynamic_sysbus_dev(m, TYPE_RAMFB_DEVICE);
 +    compat_props_add(m->compat_props, pc_rhel_compat, pc_rhel_compat_len);
 +    m->alias = "pc";
 +    m->is_default = 1;
 +    m->smp_props.prefer_sockets = true;
 +}
 +
 +static void pc_init_rhel760(MachineState *machine)
 +{
 +    pc_init1(machine, TYPE_I440FX_PCI_DEVICE);
 +}
 +
 +static void pc_machine_rhel760_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    ObjectClass *oc = OBJECT_CLASS(m);
 +    pc_machine_rhel7_options(m);
 +    m->desc = "RHEL 7.6.0 PC (i440FX + PIIX, 1996)";
 +    m->async_pf_vmexit_disable = true;
 +    m->smbus_no_migration_support = true;
 +
 +    /* All RHEL machines for prior major releases are deprecated */
 +    m->deprecation_reason = rhel_old_machine_deprecation;
 +
 +    pcmc->pvh_enabled = false;
 +    pcmc->default_cpu_version = CPU_VERSION_LEGACY;
 +    pcmc->kvmclock_create_always = false;
 +    /* From pc_i440fx_5_1_machine_options() */
 +    pcmc->pci_root_uid = 1;
 +    /* From pc_i440fx_7_0_machine_options() */
 +    pcmc->enforce_amd_1tb_hole = false;
 +    /* From pc_i440fx_8_0_machine_options() */
 +    pcmc->default_smbios_ep_type = SMBIOS_ENTRY_POINT_TYPE_32;
 +    /* From pc_i440fx_8_1_machine_options() */
 +    pcmc->broken_32bit_mem_addr_check = true;
 +    /* Introduced in QEMU 8.2 */
 +    pcmc->default_south_bridge = TYPE_PIIX3_DEVICE;
 +
 +    object_class_property_add_enum(oc, "x-south-bridge", "PCSouthBridgeOption",
 +                                   &PCSouthBridgeOption_lookup,
 +                                   pc_get_south_bridge,
 +                                   pc_set_south_bridge);
 +    object_class_property_set_description(oc, "x-south-bridge",
 +                                     "Use a different south bridge than PIIX3");
 +
 +
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_4,
 +                     hw_compat_rhel_9_4_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_3,
 +                     hw_compat_rhel_9_3_len);
 +    compat_props_add(m->compat_props, pc_rhel_9_3_compat,
 +                     pc_rhel_9_3_compat_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_2,
 +                     hw_compat_rhel_9_2_len);
 +    compat_props_add(m->compat_props, pc_rhel_9_2_compat,
 +                     pc_rhel_9_2_compat_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_1,
 +                     hw_compat_rhel_9_1_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_0,
 +                     hw_compat_rhel_9_0_len);
 +    compat_props_add(m->compat_props, pc_rhel_9_0_compat,
 +                     pc_rhel_9_0_compat_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_6,
 +                     hw_compat_rhel_8_6_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_5,
 +                     hw_compat_rhel_8_5_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_5_compat,
 +                     pc_rhel_8_5_compat_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_4,
 +                     hw_compat_rhel_8_4_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_4_compat,
 +                     pc_rhel_8_4_compat_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_3,
 +                     hw_compat_rhel_8_3_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_3_compat,
 +                     pc_rhel_8_3_compat_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_2,
 +                     hw_compat_rhel_8_2_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_2_compat,
 +                     pc_rhel_8_2_compat_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_1, hw_compat_rhel_8_1_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_1_compat, pc_rhel_8_1_compat_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_0, hw_compat_rhel_8_0_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_0_compat, pc_rhel_8_0_compat_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_7_6, hw_compat_rhel_7_6_len);
 +    compat_props_add(m->compat_props, pc_rhel_7_6_compat, pc_rhel_7_6_compat_len);
 +}
 +
 +DEFINE_PC_MACHINE(rhel760, "pc-i440fx-rhel7.6.0", pc_init_rhel760,
 +                  pc_machine_rhel760_options);
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
 index c7bc8a2041..e872dc7e46 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
@@ -341,6 +341,7 @@ static void pc_q35_init(MachineState *machine)
     DEFINE_PC_MACHINE(suffix, name, pc_init_##suffix, optionfn)
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void pc_q35_machine_options(MachineClass *m)
 {
     PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
@@ -693,3 +694,287 @@ static void pc_q35_2_4_machine_options(MachineClass *m)
 DEFINE_Q35_MACHINE(v2_4, "pc-q35-2.4", NULL,
                    pc_q35_2_4_machine_options);
 +#endif  /* Disabled for Red Hat Enterprise Linux */
 +
 +/* Red Hat Enterprise Linux machine types */
 +
 +/* Options for the latest rhel q35 machine type */
 +static void pc_q35_machine_rhel_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pcmc->pci_root_uid = 0;
 +    m->default_nic = "e1000e";
 +    m->family = "pc_q35_Z";
 +    m->units_per_default_bus = 1;
 +    m->default_machine_opts = "firmware=bios-256k.bin,hpet=off";
 +    m->default_display = "std";
 +    m->no_floppy = 1;
 +    m->no_parallel = 1;
 +    pcmc->default_cpu_version = 1;
 +    machine_class_allow_dynamic_sysbus_dev(m, TYPE_AMD_IOMMU_DEVICE);
 +    machine_class_allow_dynamic_sysbus_dev(m, TYPE_INTEL_IOMMU_DEVICE);
 +    machine_class_allow_dynamic_sysbus_dev(m, TYPE_RAMFB_DEVICE);
 +    m->alias = "q35";
 +    m->max_cpus = 710;
 +    compat_props_add(m->compat_props, pc_rhel_compat, pc_rhel_compat_len);
 +    compat_props_add(m->compat_props,
 +                     pc_q35_compat_defaults, pc_q35_compat_defaults_len);
 +}
 +
 +static void pc_q35_init_rhel940(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel940_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel_options(m);
 +    m->desc = "RHEL-9.4.0 PC (Q35 + ICH9, 2009)";
 +    pcmc->smbios_stream_product = "RHEL";
 +    pcmc->smbios_stream_version = "9.4.0";
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel940, "pc-q35-rhel9.4.0", pc_q35_init_rhel940,
 +                  pc_q35_machine_rhel940_options);
 +
 +
 +static void pc_q35_init_rhel920(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel920_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel940_options(m);
 +    m->desc = "RHEL-9.2.0 PC (Q35 + ICH9, 2009)";
 +    m->alias = NULL;
 +    pcmc->smbios_stream_product = "RHEL";
 +    pcmc->smbios_stream_version = "9.2.0";
 +
 +    /* From pc_q35_8_0_machine_options() */
 +    pcmc->default_smbios_ep_type = SMBIOS_ENTRY_POINT_TYPE_32;
 +    /* From pc_q35_8_1_machine_options() */
 +    pcmc->broken_32bit_mem_addr_check = true;
 +
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_4,
 +                     hw_compat_rhel_9_4_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_3,
 +                     hw_compat_rhel_9_3_len);
 +    compat_props_add(m->compat_props, pc_rhel_9_3_compat,
 +                     pc_rhel_9_3_compat_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_2,
 +                     hw_compat_rhel_9_2_len);
 +    compat_props_add(m->compat_props, pc_rhel_9_2_compat,
 +                     pc_rhel_9_2_compat_len);
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel920, "pc-q35-rhel9.2.0", pc_q35_init_rhel920,
 +                  pc_q35_machine_rhel920_options);
 +
 +static void pc_q35_init_rhel900(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel900_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel920_options(m);
 +    m->desc = "RHEL-9.0.0 PC (Q35 + ICH9, 2009)";
 +    m->alias = NULL;
 +    pcmc->smbios_stream_product = "RHEL";
 +    pcmc->smbios_stream_version = "9.0.0";
 +    pcmc->enforce_amd_1tb_hole = false;
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_1,
 +                     hw_compat_rhel_9_1_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_0,
 +                     hw_compat_rhel_9_0_len);
 +    compat_props_add(m->compat_props, pc_rhel_9_0_compat,
 +                     pc_rhel_9_0_compat_len);
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel900, "pc-q35-rhel9.0.0", pc_q35_init_rhel900,
 +                  pc_q35_machine_rhel900_options);
 +
 +static void pc_q35_init_rhel860(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel860_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel900_options(m);
 +    m->desc = "RHEL-8.6.0 PC (Q35 + ICH9, 2009)";
 +    m->alias = NULL;
 +
 +    /* All RHEL machines for prior major releases are deprecated */
 +    m->deprecation_reason = rhel_old_machine_deprecation;
 +
 +    pcmc->smbios_stream_product = "RHEL-AV";
 +    pcmc->smbios_stream_version = "8.6.0";
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_6,
 +                     hw_compat_rhel_8_6_len);
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel860, "pc-q35-rhel8.6.0", pc_q35_init_rhel860,
 +                  pc_q35_machine_rhel860_options);
 +
 +
 +static void pc_q35_init_rhel850(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel850_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel860_options(m);
 +    m->desc = "RHEL-8.5.0 PC (Q35 + ICH9, 2009)";
 +    m->alias = NULL;
 +    pcmc->smbios_stream_product = "RHEL-AV";
 +    pcmc->smbios_stream_version = "8.5.0";
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_5,
 +                     hw_compat_rhel_8_5_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_5_compat,
 +                     pc_rhel_8_5_compat_len);
 +    m->smp_props.prefer_sockets = true;
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel850, "pc-q35-rhel8.5.0", pc_q35_init_rhel850,
 +                  pc_q35_machine_rhel850_options);
 +
 +
 +static void pc_q35_init_rhel840(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel840_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel850_options(m);
 +    m->desc = "RHEL-8.4.0 PC (Q35 + ICH9, 2009)";
 +    m->alias = NULL;
 +    pcmc->smbios_stream_product = "RHEL-AV";
 +    pcmc->smbios_stream_version = "8.4.0";
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_4,
 +                     hw_compat_rhel_8_4_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_4_compat,
 +                     pc_rhel_8_4_compat_len);
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel840, "pc-q35-rhel8.4.0", pc_q35_init_rhel840,
 +                  pc_q35_machine_rhel840_options);
 +
 +
 +static void pc_q35_init_rhel830(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel830_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel840_options(m);
 +    m->desc = "RHEL-8.3.0 PC (Q35 + ICH9, 2009)";
 +    m->alias = NULL;
 +    pcmc->smbios_stream_product = "RHEL-AV";
 +    pcmc->smbios_stream_version = "8.3.0";
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_3,
 +                     hw_compat_rhel_8_3_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_3_compat,
 +                     pc_rhel_8_3_compat_len);
 +    /* From pc_q35_5_1_machine_options() */
 +    pcmc->kvmclock_create_always = false;
 +    /* From pc_q35_5_1_machine_options() */
 +    pcmc->pci_root_uid = 1;
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel830, "pc-q35-rhel8.3.0", pc_q35_init_rhel830,
 +                  pc_q35_machine_rhel830_options);
 +
 +static void pc_q35_init_rhel820(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel820_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel830_options(m);
 +    m->desc = "RHEL-8.2.0 PC (Q35 + ICH9, 2009)";
 +    m->alias = NULL;
 +    m->numa_mem_supported = true;
 +    m->auto_enable_numa_with_memdev = false;
 +    pcmc->smbios_stream_product = "RHEL-AV";
 +    pcmc->smbios_stream_version = "8.2.0";
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_2,
 +                     hw_compat_rhel_8_2_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_2_compat,
 +                     pc_rhel_8_2_compat_len);
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel820, "pc-q35-rhel8.2.0", pc_q35_init_rhel820,
 +                  pc_q35_machine_rhel820_options);
 +
 +static void pc_q35_init_rhel810(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel810_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel820_options(m);
 +    m->desc = "RHEL-8.1.0 PC (Q35 + ICH9, 2009)";
 +    m->alias = NULL;
 +    pcmc->smbios_stream_product = NULL;
 +    pcmc->smbios_stream_version = NULL;
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_1, hw_compat_rhel_8_1_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_1_compat, pc_rhel_8_1_compat_len);
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel810, "pc-q35-rhel8.1.0", pc_q35_init_rhel810,
 +                  pc_q35_machine_rhel810_options);
 +
 +static void pc_q35_init_rhel800(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel800_options(MachineClass *m)
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel810_options(m);
 +    m->desc = "RHEL-8.0.0 PC (Q35 + ICH9, 2009)";
 +    m->smbus_no_migration_support = true;
 +    m->alias = NULL;
 +    pcmc->pvh_enabled = false;
 +    pcmc->default_cpu_version = CPU_VERSION_LEGACY;
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_0, hw_compat_rhel_8_0_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_0_compat, pc_rhel_8_0_compat_len);
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel800, "pc-q35-rhel8.0.0", pc_q35_init_rhel800,
 +                  pc_q35_machine_rhel800_options);
 +
 +static void pc_q35_init_rhel760(MachineState *machine)
 +{
 +    pc_q35_init(machine);
 +}
 +
 +static void pc_q35_machine_rhel760_options(MachineClass *m)
 +{
 +    pc_q35_machine_rhel800_options(m);
 +    m->alias = NULL;
 +    m->desc = "RHEL-7.6.0 PC (Q35 + ICH9, 2009)";
 +    m->async_pf_vmexit_disable = true;
 +    compat_props_add(m->compat_props, hw_compat_rhel_7_6, hw_compat_rhel_7_6_len);
 +    compat_props_add(m->compat_props, pc_rhel_7_6_compat, pc_rhel_7_6_compat_len);
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel760, "pc-q35-rhel7.6.0", pc_q35_init_rhel760,
 +                  pc_q35_machine_rhel760_options);
 diff --git a/include/hw/boards.h b/include/hw/boards.h
 index 0466f9d0f3..46b8725c41 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
@@ -283,6 +283,8 @@ struct MachineClass {
     strList *allowed_dynamic_sysbus_devices;
     bool auto_enable_numa_with_memhp;
     bool auto_enable_numa_with_memdev;
 +    /* RHEL only */
 +    bool async_pf_vmexit_disable;
     bool ignore_boot_device_suffixes;
     bool smbus_no_migration_support;
     bool nvdimm_supported;
 diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
 index ebd8f973f2..a984c951ad 100644
 --- a/include/hw/i386/pc.h
 +++ b/include/hw/i386/pc.h
@@ -291,6 +291,39 @@ extern const size_t pc_compat_2_1_len;
 extern GlobalProperty pc_compat_2_0[];
 extern const size_t pc_compat_2_0_len;
 +extern GlobalProperty pc_rhel_compat[];
 +extern const size_t pc_rhel_compat_len;
 +
 +extern GlobalProperty pc_rhel_9_3_compat[];
 +extern const size_t pc_rhel_9_3_compat_len;
 +
 +extern GlobalProperty pc_rhel_9_2_compat[];
 +extern const size_t pc_rhel_9_2_compat_len;
 +
 +extern GlobalProperty pc_rhel_9_0_compat[];
 +extern const size_t pc_rhel_9_0_compat_len;
 +
 +extern GlobalProperty pc_rhel_8_5_compat[];
 +extern const size_t pc_rhel_8_5_compat_len;
 +
 +extern GlobalProperty pc_rhel_8_4_compat[];
 +extern const size_t pc_rhel_8_4_compat_len;
 +
 +extern GlobalProperty pc_rhel_8_3_compat[];
 +extern const size_t pc_rhel_8_3_compat_len;
 +
 +extern GlobalProperty pc_rhel_8_2_compat[];
 +extern const size_t pc_rhel_8_2_compat_len;
 +
 +extern GlobalProperty pc_rhel_8_1_compat[];
 +extern const size_t pc_rhel_8_1_compat_len;
 +
 +extern GlobalProperty pc_rhel_8_0_compat[];
 +extern const size_t pc_rhel_8_0_compat_len;
 +
 +extern GlobalProperty pc_rhel_7_6_compat[];
 +extern const size_t pc_rhel_7_6_compat_len;
 +
 #define DEFINE_PC_MACHINE(suffix, namestr, initfn, optsfn) \
     static void pc_machine_##suffix##_class_init(ObjectClass *oc, void *data) \
     { \
 diff --git a/target/i386/cpu.c b/target/i386/cpu.c
 index 33760a2ee1..be7b0663cd 100644
 --- a/target/i386/cpu.c
 +++ b/target/i386/cpu.c
@@ -2190,9 +2190,13 @@ static const CPUCaches epyc_genoa_cache_info = {
  *  PT in VMX operation
  */
 +#define RHEL_CPU_DEPRECATION \
 +    "use at least 'Nehalem' / 'Opteron_G4', or 'host' / 'max'"
 +
 static const X86CPUDefinition builtin_x86_defs[] = {
     {
         .name = "qemu64",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 0xd,
         .vendor = CPUID_VENDOR_AMD,
         .family = 15,
@@ -2213,6 +2217,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "phenom",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 5,
         .vendor = CPUID_VENDOR_AMD,
         .family = 16,
@@ -2245,6 +2250,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "core2duo",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 10,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -2287,6 +2293,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "kvm64",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 0xd,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 15,
@@ -2328,6 +2335,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "qemu32",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 4,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -2342,6 +2350,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "kvm32",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 5,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 15,
@@ -2372,6 +2381,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "coreduo",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 10,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -2405,6 +2415,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "486",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 1,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 4,
@@ -2417,6 +2428,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "pentium",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 1,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 5,
@@ -2429,6 +2441,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "pentium2",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 2,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -2441,6 +2454,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "pentium3",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 3,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -2453,6 +2467,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "athlon",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 2,
         .vendor = CPUID_VENDOR_AMD,
         .family = 6,
@@ -2468,6 +2483,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "n270",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 10,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -2493,6 +2509,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "Conroe",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 10,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -2533,6 +2550,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "Penryn",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 10,
         .vendor = CPUID_VENDOR_INTEL,
         .family = 6,
@@ -4394,6 +4412,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "Opteron_G1",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 5,
         .vendor = CPUID_VENDOR_AMD,
         .family = 15,
@@ -4414,6 +4433,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "Opteron_G2",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 5,
         .vendor = CPUID_VENDOR_AMD,
         .family = 15,
@@ -4436,6 +4456,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
     },
     {
         .name = "Opteron_G3",
 +        .deprecation_note = RHEL_CPU_DEPRECATION,
         .level = 5,
         .vendor = CPUID_VENDOR_AMD,
         .family = 16,
 diff --git a/target/i386/kvm/kvm-cpu.c b/target/i386/kvm/kvm-cpu.c
 index 9c791b7b05..b91af5051f 100644
 --- a/target/i386/kvm/kvm-cpu.c
 +++ b/target/i386/kvm/kvm-cpu.c
@@ -138,6 +138,7 @@ static PropValue kvm_default_props[] = {
     { "acpi", "off" },
     { "monitor", "off" },
     { "svm", "off" },
 +    { "kvm-pv-unhalt", "on" },
     { NULL, NULL },
 };
 diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
 index e68cbe9293..739f33db47 100644
 --- a/target/i386/kvm/kvm.c
 +++ b/target/i386/kvm/kvm.c
@@ -3715,6 +3715,7 @@ static int kvm_get_msrs(X86CPU *cpu)
     struct kvm_msr_entry *msrs = cpu->kvm_msr_buf->entries;
     int ret, i;
     uint64_t mtrr_top_bits;
 +    MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
     kvm_msr_buf_reset(cpu);
@@ -4069,6 +4070,9 @@ static int kvm_get_msrs(X86CPU *cpu)
             break;
         case MSR_KVM_ASYNC_PF_EN:
             env->async_pf_en_msr = msrs[i].data;
 +            if (mc->async_pf_vmexit_disable) {
 +                env->async_pf_en_msr &= ~(1ULL << 2);
 +            }
             break;
         case MSR_KVM_ASYNC_PF_INT:
             env->async_pf_int_msr = msrs[i].data;
 diff --git a/tests/qtest/pvpanic-test.c b/tests/qtest/pvpanic-test.c
 index 78f1cf8186..ac954c9b06 100644
 --- a/tests/qtest/pvpanic-test.c
 +++ b/tests/qtest/pvpanic-test.c
@@ -17,7 +17,7 @@ static void test_panic_nopause(void)
     QDict *response, *data;
     QTestState *qts;
 -    qts = qtest_init("-device pvpanic -action panic=none");
 +    qts = qtest_init("-M q35 -device pvpanic -action panic=none");
     val = qtest_inb(qts, 0x505);
     g_assert_cmpuint(val, ==, 3);
@@ -40,7 +40,8 @@ static void test_panic(void)
     QDict *response, *data;
     QTestState *qts;
 -    qts = qtest_init("-device pvpanic -action panic=pause");
 +    /* RHEL: Use q35 */
 +    qts = qtest_init("-M q35 -device pvpanic -action panic=pause");
     val = qtest_inb(qts, 0x505);
     g_assert_cmpuint(val, ==, 3);
 -- 
 2.39.3
--- a/SOURCES/0011-Add-x86_64-machine-types.patch
+++ b/SOURCES/0011-Add-x86_64-machine-types.patch
--- a/SOURCES/0011-Enable-make-check.patch
+++ b/SOURCES/0011-Enable-make-check.patch
@ -1,270 +0,0 @@
 From 5768cf6811842e5c59da3b752f60659a9d6b5ba1 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 2 Sep 2020 09:39:41 +0200
 Subject: Enable make check
 Fixing tests after device disabling and machine types changes and enabling
 make check run during build.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 Rebase changes (6.1.0):
 - removed unnecessary test changes
 Rebase changes (6.2.0):
 - new way of disabling bios-table-test
 Rebase changes (7.0.0):
 - Disable testing virtio-iommu-pci
 - Rename default_bus_bypass_iommu property to default-bus-bypass-iommu
 - Disable qtest-bios-table for aarch64
 - Removed redhat chunks for boot-serial-test.c, cdrom-test.c and cpu-plug-test.c qtests
 - Do not disable boot-order-test, prom-env-test and boot-serial-test qtests
 - Use rhel machine type for new intel hda qtest
 - Remove unnecessary changes in iotest 051
 - Remove changes in bios-tables-test.c and prom-env-test.c qtests
 Rebase changes (7.1.0):
 - Disable bcm2835-dma-test (added upstream)
 Rebase changes (8.0.0):
 - Removed chunks for disabling bios-table-test (protected upstream)
 - Disable new qemu-iotests execution
 - Revert change in tco qtest (blocking test run)
 Rebase changes (8.1.0):
 - Do not disable device-plug-test for s390x
 Rebase changes (8.2.0 rc1):
 - Remove unneeded hack in qtest/usb-hcd-xhci-test.c
 Merged patches (6.1.0):
 - 2f129df7d3 redhat: Enable the 'test-block-iothread' test again
 Merged patches (7.1.0):
 - 64d736640e RHEL-only: tests/avocado: Switch aarch64 tests from a53 to a57
 Merged patches (8.1.0):
 - f468163234 iotests: Use alternative CPU type that is not deprecated in RHEL
 ---
 .distro/qemu-kvm.spec.template      |  4 ++--
 tests/avocado/replay_kernel.py      |  2 +-
 tests/avocado/reverse_debugging.py  |  2 +-
 tests/avocado/tcg_plugins.py        |  6 ++---
 tests/qemu-iotests/meson.build      | 34 ++++++++++++++---------------
 tests/qemu-iotests/testenv.py       |  3 +++
 tests/qtest/fuzz-e1000e-test.c      |  2 +-
 tests/qtest/fuzz-virtio-scsi-test.c |  2 +-
 tests/qtest/intel-hda-test.c        |  2 +-
 tests/qtest/libqos/meson.build      |  2 +-
 tests/qtest/lpc-ich9-test.c         |  2 +-
 tests/qtest/meson.build             |  1 -
 tests/qtest/virtio-net-failover.c   |  1 +
 13 files changed, 33 insertions(+), 30 deletions(-)
 diff --git a/tests/avocado/replay_kernel.py b/tests/avocado/replay_kernel.py
 index 10d99403a4..c3422ea1e4 100644
 --- a/tests/avocado/replay_kernel.py
 +++ b/tests/avocado/replay_kernel.py
@@ -166,7 +166,7 @@ def test_aarch64_virt(self):
         """
         :avocado: tags=arch:aarch64
         :avocado: tags=machine:virt
 -        :avocado: tags=cpu:cortex-a53
 +        :avocado: tags=cpu:cortex-a57
         """
         kernel_url = ('https://archives.fedoraproject.org/pub/archive/fedora'
                       '/linux/releases/29/Everything/aarch64/os/images/pxeboot'
 diff --git a/tests/avocado/reverse_debugging.py b/tests/avocado/reverse_debugging.py
 index 92855a02a5..87822074b6 100644
 --- a/tests/avocado/reverse_debugging.py
 +++ b/tests/avocado/reverse_debugging.py
@@ -230,7 +230,7 @@ def test_aarch64_virt(self):
         """
         :avocado: tags=arch:aarch64
         :avocado: tags=machine:virt
 -        :avocado: tags=cpu:cortex-a53
 +        :avocado: tags=cpu:cortex-a57
         """
         kernel_url = ('https://archives.fedoraproject.org/pub/archive/fedora'
                       '/linux/releases/29/Everything/aarch64/os/images/pxeboot'
 diff --git a/tests/avocado/tcg_plugins.py b/tests/avocado/tcg_plugins.py
 index 15fd87b2c1..f0d9d89c93 100644
 --- a/tests/avocado/tcg_plugins.py
 +++ b/tests/avocado/tcg_plugins.py
@@ -66,7 +66,7 @@ def test_aarch64_virt_insn(self):
         :avocado: tags=accel:tcg
         :avocado: tags=arch:aarch64
         :avocado: tags=machine:virt
 -        :avocado: tags=cpu:cortex-a53
 +        :avocado: tags=cpu:cortex-a57
         """
         kernel_path = self._grab_aarch64_kernel()
         kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
@@ -96,7 +96,7 @@ def test_aarch64_virt_insn_icount(self):
         :avocado: tags=accel:tcg
         :avocado: tags=arch:aarch64
         :avocado: tags=machine:virt
 -        :avocado: tags=cpu:cortex-a53
 +        :avocado: tags=cpu:cortex-a57
         """
         kernel_path = self._grab_aarch64_kernel()
         kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
@@ -126,7 +126,7 @@ def test_aarch64_virt_mem_icount(self):
         :avocado: tags=accel:tcg
         :avocado: tags=arch:aarch64
         :avocado: tags=machine:virt
 -        :avocado: tags=cpu:cortex-a53
 +        :avocado: tags=cpu:cortex-a57
         """
         kernel_path = self._grab_aarch64_kernel()
         kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
 diff --git a/tests/qemu-iotests/meson.build b/tests/qemu-iotests/meson.build
 index fad340ad59..3c0d5241f6 100644
 --- a/tests/qemu-iotests/meson.build
 +++ b/tests/qemu-iotests/meson.build
@@ -51,21 +51,21 @@ foreach format, speed: qemu_iotests_formats
       check: true,
   )
 -  foreach item: rc.stdout().strip().split()
 -      args = [qemu_iotests_check_cmd,
 -              '-tap', '-' + format, item,
 -              '--source-dir', meson.current_source_dir(),
 -              '--build-dir', meson.current_build_dir()]
 -      # Some individual tests take as long as 45 seconds
 -      # Bump the timeout to 3 minutes for some headroom
 -      # on slow machines to minimize spurious failures
 -      test('io-' + format + '-' + item,
 -           python,
 -           args: args,
 -           depends: qemu_iotests_binaries,
 -           env: qemu_iotests_env,
 -           protocol: 'tap',
 -           timeout: 180,
 -           suite: suites)
 -  endforeach
 +#  foreach item: rc.stdout().strip().split()
 +#      args = [qemu_iotests_check_cmd,
 +#              '-tap', '-' + format, item,
 +#              '--source-dir', meson.current_source_dir(),
 +#              '--build-dir', meson.current_build_dir()]
 +#      # Some individual tests take as long as 45 seconds
 +#      # Bump the timeout to 3 minutes for some headroom
 +#      # on slow machines to minimize spurious failures
 +#      test('io-' + format + '-' + item,
 +#           python,
 +#           args: args,
 +#           depends: qemu_iotests_binaries,
 +#           env: qemu_iotests_env,
 +#           protocol: 'tap',
 +#           timeout: 180,
 +#           suite: suites)
 +#  endforeach
 endforeach
 diff --git a/tests/qemu-iotests/testenv.py b/tests/qemu-iotests/testenv.py
 index 588f30a4f1..3929a3634f 100644
 --- a/tests/qemu-iotests/testenv.py
 +++ b/tests/qemu-iotests/testenv.py
@@ -244,6 +244,9 @@ def __init__(self, source_dir: str, build_dir: str,
             if self.qemu_prog.endswith(f'qemu-system-{suffix}'):
                 self.qemu_options += f' -machine {machine}'
 +        if self.qemu_prog.endswith('qemu-system-x86_64'):
 +            self.qemu_options += ' -cpu Nehalem'
 +
         # QEMU_DEFAULT_MACHINE
         self.qemu_default_machine = get_default_machine(self.qemu_prog)
 diff --git a/tests/qtest/fuzz-e1000e-test.c b/tests/qtest/fuzz-e1000e-test.c
 index 5052883fb6..b5286f4b12 100644
 --- a/tests/qtest/fuzz-e1000e-test.c
 +++ b/tests/qtest/fuzz-e1000e-test.c
@@ -17,7 +17,7 @@ static void test_lp1879531_eth_get_rss_ex_dst_addr(void)
 {
     QTestState *s;
 -    s = qtest_init("-nographic -monitor none -serial none -M pc-q35-5.0");
 +    s = qtest_init("-nographic -monitor none -serial none -M pc-q35-rhel8.4.0");
     qtest_outl(s, 0xcf8, 0x80001010);
     qtest_outl(s, 0xcfc, 0xe1020000);
 diff --git a/tests/qtest/fuzz-virtio-scsi-test.c b/tests/qtest/fuzz-virtio-scsi-test.c
 index e37b48b2cc..88647da054 100644
 --- a/tests/qtest/fuzz-virtio-scsi-test.c
 +++ b/tests/qtest/fuzz-virtio-scsi-test.c
@@ -19,7 +19,7 @@ static void test_mmio_oob_from_memory_region_cache(void)
 {
     QTestState *s;
 -    s = qtest_init("-M pc-q35-5.2 -m 512M "
 +    s = qtest_init("-M pc-q35-rhel8.4.0 -m 512M "
                    "-device virtio-scsi,num_queues=8,addr=03.0 ");
     qtest_outl(s, 0xcf8, 0x80001811);
 diff --git a/tests/qtest/intel-hda-test.c b/tests/qtest/intel-hda-test.c
 index 663bb6c485..2efc43e3f7 100644
 --- a/tests/qtest/intel-hda-test.c
 +++ b/tests/qtest/intel-hda-test.c
@@ -42,7 +42,7 @@ static void test_issue542_ich6(void)
 {
     QTestState *s;
 -    s = qtest_init("-nographic -nodefaults -M pc-q35-6.2 "
 +    s = qtest_init("-nographic -nodefaults -M pc-q35-rhel9.0.0 "
                    AUDIODEV
                    "-device intel-hda,id=" HDA_ID CODEC_DEVICES);
 diff --git a/tests/qtest/libqos/meson.build b/tests/qtest/libqos/meson.build
 index 3aed6efcb8..119613237e 100644
 --- a/tests/qtest/libqos/meson.build
 +++ b/tests/qtest/libqos/meson.build
@@ -44,7 +44,7 @@ libqos_srcs = files(
         'virtio-rng.c',
         'virtio-scsi.c',
         'virtio-serial.c',
 -        'virtio-iommu.c',
 +#        'virtio-iommu.c',
         'virtio-gpio.c',
         'virtio-scmi.c',
         'generic-pcihost.c',
 diff --git a/tests/qtest/lpc-ich9-test.c b/tests/qtest/lpc-ich9-test.c
 index 8ac95b89f7..cd2102555c 100644
 --- a/tests/qtest/lpc-ich9-test.c
 +++ b/tests/qtest/lpc-ich9-test.c
@@ -15,7 +15,7 @@ static void test_lp1878642_pci_bus_get_irq_level_assert(void)
 {
     QTestState *s;
 -    s = qtest_init("-M pc-q35-5.0 "
 +    s = qtest_init("-M pc-q35-rhel8.4.0 "
                    "-nographic -monitor none -serial none");
     qtest_outl(s, 0xcf8, 0x8000f840); /* PMBASE */
 diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
 index 36c5c13a7b..a2887d6057 100644
 --- a/tests/qtest/meson.build
 +++ b/tests/qtest/meson.build
@@ -101,7 +101,6 @@ qtests_i386 = \
    'drive_del-test',
    'tco-test',
    'cpu-plug-test',
 -   'q35-test',
    'vmgenid-test',
    'migration-test',
    'test-x86-cpuid-compat',
 diff --git a/tests/qtest/virtio-net-failover.c b/tests/qtest/virtio-net-failover.c
 index 73dfabc272..a9dd304781 100644
 --- a/tests/qtest/virtio-net-failover.c
 +++ b/tests/qtest/virtio-net-failover.c
@@ -26,6 +26,7 @@
 #define PCI_SEL_BASE            0x0010
 #define BASE_MACHINE "-M q35 -nodefaults " \
 +    "-global ICH9-LPC.acpi-pci-hotplug-with-bridge-support=on " \
     "-device pcie-root-port,id=root0,addr=0x1,bus=pcie.0,chassis=1 " \
     "-device pcie-root-port,id=root1,addr=0x2,bus=pcie.0,chassis=2 "
 -- 
 2.39.3
--- a/SOURCES/0012-Enable-make-check.patch
+++ b/SOURCES/0012-Enable-make-check.patch
@ -0,0 +1,407 @@
 From 740a2dd943a2e0fcd41a9cd8eb94a136f8f49fa2 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 2 Sep 2020 09:39:41 +0200
 Subject: Enable make check
 Fixing tests after device disabling and machine types changes and enabling
 make check run during build.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 Rebase changes (4.0.0):
 - Remove testing for pseries-2.7 in endianess test
 - Disable device-plug-test on s390x as it use disabled device
 - Do not run cpu-plug-tests on 7.3 and older machine types
 Rebase changes (4.1.0-rc0):
 - removed iotests 068
 Rebase changes (4.1.0-rc1):
 - remove all 205 tests (unstable)
 Rebase changes (4.2.0-rc0):
 - partially disable hd-geo-test (requires lsi53c895a)
 Rebase changes (5.1.0-rc1):
 - Disable qtest/q35-test (uses upstream machine types)
 - Do not run iotests on make checka
 - Enabled iotests 071 and 099
 Rebase changes (5.2.0 rc0):
 - Disable cdrom tests (unsupported devices) on x86_64
 - disable fuzz test
 Rebase changes (6.0.0):
 - Disabled xlnx-can-test
 - Disable pxb-pcie subtest for bios-table-test
 - Replace qtest usage of upstream q35 machine type with pc-q35-rhel8.4.0
 - Not run cdrom-test on aarch64
 Rebase changes (6.1.0):
 - Remove unnecessary test disabling changes
 Rebase changes (weekly-211006):
 - New handling for bios-table-test (disabled downstream)
 Merged patches (4.0.0):
 - f7ffd13 Remove 7 qcow2 and luks iotests that are taking > 25 sec to run during the fast train build proce
 Merged patches (4.1.0-rc0):
 - 41288ff redhat: Remove raw iotest 205
 ---
 redhat/qemu-kvm.spec.template       |  2 +-
 tests/qemu-iotests/051              |  8 ++++----
 tests/qtest/bios-tables-test.c      |  5 ++++-
 tests/qtest/boot-serial-test.c      |  6 +++++-
 tests/qtest/cdrom-test.c            |  4 ++++
 tests/qtest/cpu-plug-test.c         |  4 ++--
 tests/qtest/fuzz-e1000e-test.c      |  2 +-
 tests/qtest/fuzz-virtio-scsi-test.c |  2 +-
 tests/qtest/hd-geo-test.c           |  4 ++++
 tests/qtest/lpc-ich9-test.c         |  2 +-
 tests/qtest/meson.build             | 13 ++++---------
 tests/qtest/prom-env-test.c         |  4 ++++
 tests/qtest/test-x86-cpuid-compat.c |  2 ++
 tests/qtest/usb-hcd-xhci-test.c     |  4 ++++
 14 files changed, 41 insertions(+), 21 deletions(-)
 diff --git a/tests/qemu-iotests/051 b/tests/qemu-iotests/051
 index 1d2fa93a11..c8a2815f54 100755
 --- a/tests/qemu-iotests/051
 +++ b/tests/qemu-iotests/051
@@ -174,9 +174,9 @@ run_qemu -drive if=virtio
 case "$QEMU_DEFAULT_MACHINE" in
     pc)
         run_qemu -drive if=none,id=disk -device ide-cd,drive=disk
 -        run_qemu -drive if=none,id=disk -device lsi53c895a -device scsi-cd,drive=disk
 +#        run_qemu -drive if=none,id=disk -device lsi53c895a -device scsi-cd,drive=disk
         run_qemu -drive if=none,id=disk -device ide-hd,drive=disk
 -        run_qemu -drive if=none,id=disk -device lsi53c895a -device scsi-hd,drive=disk
 +#        run_qemu -drive if=none,id=disk -device lsi53c895a -device scsi-hd,drive=disk
         ;;
      *)
         ;;
@@ -225,9 +225,9 @@ run_qemu -drive file="$TEST_IMG",if=virtio,readonly=on
 case "$QEMU_DEFAULT_MACHINE" in
     pc)
         run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device ide-cd,drive=disk
 -        run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device lsi53c895a -device scsi-cd,drive=disk
 +#        run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device lsi53c895a -device scsi-cd,drive=disk
         run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device ide-hd,drive=disk
 -        run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device lsi53c895a -device scsi-hd,drive=disk
 +#        run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device lsi53c895a -device scsi-hd,drive=disk
         ;;
      *)
         ;;
 diff --git a/tests/qtest/bios-tables-test.c b/tests/qtest/bios-tables-test.c
 index 258874167e..16d8304cde 100644
 --- a/tests/qtest/bios-tables-test.c
 +++ b/tests/qtest/bios-tables-test.c
@@ -1372,6 +1372,7 @@ static void test_acpi_virt_tcg_numamem(void)
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void test_acpi_virt_tcg_pxb(void)
 {
     test_data data = {
@@ -1403,6 +1404,7 @@ static void test_acpi_virt_tcg_pxb(void)
     free_test_data(&data);
 }
 +#endif
 static void test_acpi_tcg_acpi_hmat(const char *machine)
 {
@@ -1644,7 +1646,8 @@ int main(int argc, char *argv[])
             qtest_add_func("acpi/virt", test_acpi_virt_tcg);
             qtest_add_func("acpi/virt/numamem", test_acpi_virt_tcg_numamem);
             qtest_add_func("acpi/virt/memhp", test_acpi_virt_tcg_memhp);
 -            qtest_add_func("acpi/virt/pxb", test_acpi_virt_tcg_pxb);
 +            /* Disabled for Red Hat Enterprise Linux
 +            qtest_add_func("acpi/virt/pxb", test_acpi_virt_tcg_pxb); */
             qtest_add_func("acpi/virt/oem-fields", test_acpi_oem_fields_virt);
         }
     }
 diff --git a/tests/qtest/boot-serial-test.c b/tests/qtest/boot-serial-test.c
 index 83828ba270..294476b959 100644
 --- a/tests/qtest/boot-serial-test.c
 +++ b/tests/qtest/boot-serial-test.c
@@ -148,19 +148,23 @@ static testdef_t tests[] = {
     { "ppc", "g3beige", "", "PowerPC,750" },
     { "ppc", "mac99", "", "PowerPC,G4" },
     { "ppc", "sam460ex", "-m 256", "DRAM:  256 MiB" },
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
     { "ppc64", "ppce500", "", "U-Boot" },
     { "ppc64", "40p", "-m 192", "Memory: 192M" },
     { "ppc64", "mac99", "", "PowerPC,970FX" },
 +#endif
     { "ppc64", "pseries",
       "-machine " PSERIES_DEFAULT_CAPABILITIES,
       "Open Firmware" },
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
     { "ppc64", "powernv8", "", "OPAL" },
     { "ppc64", "powernv9", "", "OPAL" },
     { "ppc64", "sam460ex", "-device e1000", "8086  100e" },
 +#endif
     { "i386", "isapc", "-cpu qemu32 -device sga", "SGABIOS" },
     { "i386", "pc", "-device sga", "SGABIOS" },
     { "i386", "q35", "-device sga", "SGABIOS" },
 -    { "x86_64", "isapc", "-cpu qemu32 -device sga", "SGABIOS" },
 +    { "x86_64", "pc", "-cpu qemu32 -device sga", "SGABIOS" },
     { "x86_64", "q35", "-device sga", "SGABIOS" },
     { "sparc", "LX", "", "TMS390S10" },
     { "sparc", "SS-4", "", "MB86904" },
 diff --git a/tests/qtest/cdrom-test.c b/tests/qtest/cdrom-test.c
 index 5af944a5fb..69d9bac38a 100644
 --- a/tests/qtest/cdrom-test.c
 +++ b/tests/qtest/cdrom-test.c
@@ -140,6 +140,7 @@ static void add_x86_tests(void)
         qtest_add_data_func("cdrom/boot/isapc", "-M isapc "
                             "-drive if=ide,media=cdrom,file=", test_cdboot);
     }
 +#if 0  /* Disabled for Red Hat Enterprise Linux */
     qtest_add_data_func("cdrom/boot/am53c974",
                         "-device am53c974 -device scsi-cd,drive=cd1 "
                         "-drive if=none,id=cd1,format=raw,file=", test_cdboot);
@@ -155,6 +156,7 @@ static void add_x86_tests(void)
     qtest_add_data_func("cdrom/boot/megasas-gen2", "-M q35 "
                         "-device megasas-gen2 -device scsi-cd,drive=cd1 "
                         "-blockdev file,node-name=cd1,filename=", test_cdboot);
 +#endif
 }
 static void add_s390x_tests(void)
@@ -220,6 +222,7 @@ int main(int argc, char **argv)
             "magnum", "malta", "pica61", NULL
         };
         add_cdrom_param_tests(mips64machines);
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
     } else if (g_str_equal(arch, "arm") || g_str_equal(arch, "aarch64")) {
         const char *armmachines[] = {
             "realview-eb", "realview-eb-mpcore", "realview-pb-a8",
@@ -227,6 +230,7 @@ int main(int argc, char **argv)
             "vexpress-a9", "virt", NULL
         };
         add_cdrom_param_tests(armmachines);
 +#endif
     } else {
         const char *nonemachine[] = { "none", NULL };
         add_cdrom_param_tests(nonemachine);
 diff --git a/tests/qtest/cpu-plug-test.c b/tests/qtest/cpu-plug-test.c
 index a1c689414b..a8f076711c 100644
 --- a/tests/qtest/cpu-plug-test.c
 +++ b/tests/qtest/cpu-plug-test.c
@@ -110,8 +110,8 @@ static void add_pseries_test_case(const char *mname)
     char *path;
     PlugTestData *data;
 -    if (!g_str_has_prefix(mname, "pseries-") ||
 -        (g_str_has_prefix(mname, "pseries-2.") && atoi(&mname[10]) < 7)) {
 +    if (!g_str_has_prefix(mname, "pseries-rhel") ||
 +        (g_str_has_prefix(mname, "pseries-rhel7.") && atoi(&mname[14]) < 4)) {
         return;
     }
     data = g_new(PlugTestData, 1);
 diff --git a/tests/qtest/fuzz-e1000e-test.c b/tests/qtest/fuzz-e1000e-test.c
 index 66229e6096..947fba73b7 100644
 --- a/tests/qtest/fuzz-e1000e-test.c
 +++ b/tests/qtest/fuzz-e1000e-test.c
@@ -17,7 +17,7 @@ static void test_lp1879531_eth_get_rss_ex_dst_addr(void)
 {
     QTestState *s;
 -    s = qtest_init("-nographic -monitor none -serial none -M pc-q35-5.0");
 +    s = qtest_init("-nographic -monitor none -serial none -M pc-q35-rhel8.4.0");
     qtest_outl(s, 0xcf8, 0x80001010);
     qtest_outl(s, 0xcfc, 0xe1020000);
 diff --git a/tests/qtest/fuzz-virtio-scsi-test.c b/tests/qtest/fuzz-virtio-scsi-test.c
 index aaf6d10e18..43727d62ac 100644
 --- a/tests/qtest/fuzz-virtio-scsi-test.c
 +++ b/tests/qtest/fuzz-virtio-scsi-test.c
@@ -19,7 +19,7 @@ static void test_mmio_oob_from_memory_region_cache(void)
 {
     QTestState *s;
 -    s = qtest_init("-M pc-q35-5.2 -display none -m 512M "
 +    s = qtest_init("-M pc-q35-rhel8.4.0 -display none -m 512M "
                    "-device virtio-scsi,num_queues=8,addr=03.0 ");
     qtest_outl(s, 0xcf8, 0x80001811);
 diff --git a/tests/qtest/hd-geo-test.c b/tests/qtest/hd-geo-test.c
 index 113126ae06..999ef2aace 100644
 --- a/tests/qtest/hd-geo-test.c
 +++ b/tests/qtest/hd-geo-test.c
@@ -737,6 +737,7 @@ static void test_override_ide(void)
     test_override(args, expected);
 }
 +#if 0 /* Require lsi53c895a - not supported on RHEL */
 static void test_override_scsi(void)
 {
     TestArgs *args = create_args();
@@ -781,6 +782,7 @@ static void test_override_scsi_2_controllers(void)
     add_scsi_disk(args, 3, 1, 0, 1, 2, 0, 1, 0);
     test_override(args, expected);
 }
 +#endif
 static void test_override_virtio_blk(void)
 {
@@ -960,9 +962,11 @@ int main(int argc, char **argv)
     qtest_add_func("hd-geo/ide/device/user/chst", test_ide_device_user_chst);
     if (have_qemu_img()) {
         qtest_add_func("hd-geo/override/ide", test_override_ide);
 +#if 0 /* Require lsi53c895a - not supported on RHEL */
         qtest_add_func("hd-geo/override/scsi", test_override_scsi);
         qtest_add_func("hd-geo/override/scsi_2_controllers",
                        test_override_scsi_2_controllers);
 +#endif
         qtest_add_func("hd-geo/override/virtio_blk", test_override_virtio_blk);
         qtest_add_func("hd-geo/override/zero_chs", test_override_zero_chs);
         qtest_add_func("hd-geo/override/scsi_hot_unplug",
 diff --git a/tests/qtest/lpc-ich9-test.c b/tests/qtest/lpc-ich9-test.c
 index fe0bef9980..7a9d51579b 100644
 --- a/tests/qtest/lpc-ich9-test.c
 +++ b/tests/qtest/lpc-ich9-test.c
@@ -15,7 +15,7 @@ static void test_lp1878642_pci_bus_get_irq_level_assert(void)
 {
     QTestState *s;
 -    s = qtest_init("-M pc-q35-5.0 "
 +    s = qtest_init("-M pc-q35-rhel8.4.0 "
                    "-nographic -monitor none -serial none");
     qtest_outl(s, 0xcf8, 0x8000f840); /* PMBASE */
 diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
 index c9d8458062..049e06c057 100644
 --- a/tests/qtest/meson.build
 +++ b/tests/qtest/meson.build
@@ -68,7 +68,6 @@ qtests_i386 = \
   (config_all_devices.has_key('CONFIG_RTL8139_PCI') ? ['rtl8139-test'] : []) +              \
   (config_all_devices.has_key('CONFIG_E1000E_PCI_EXPRESS') ? ['fuzz-e1000e-test'] : []) +   \
   (config_all_devices.has_key('CONFIG_ESP_PCI') ? ['am53c974-test'] : []) +                 \
 -  (unpack_edk2_blobs ? ['bios-tables-test'] : []) +                                         \
   qtests_pci +                                                                              \
   ['fdc-test',
    'ide-test',
@@ -81,7 +80,6 @@ qtests_i386 = \
    'drive_del-test',
    'tco-test',
    'cpu-plug-test',
 -   'q35-test',
    'vmgenid-test',
    'migration-test',
    'test-x86-cpuid-compat',
@@ -130,17 +128,15 @@ qtests_mips64el = \
 qtests_ppc = \
   (config_all_devices.has_key('CONFIG_ISA_TESTDEV') ? ['endianness-test'] : []) +            \
 -  (config_all_devices.has_key('CONFIG_M48T59') ? ['m48t59-test'] : []) +                     \
 -  ['boot-order-test', 'prom-env-test', 'boot-serial-test']                 \
 +  (config_all_devices.has_key('CONFIG_M48T59') ? ['m48t59-test'] : [])
 qtests_ppc64 = \
   (config_all_devices.has_key('CONFIG_PSERIES') ? ['device-plug-test'] : []) +               \
   (config_all_devices.has_key('CONFIG_POWERNV') ? ['pnv-xscom-test'] : []) +                 \
   (config_all_devices.has_key('CONFIG_PSERIES') ? ['rtas-test'] : []) +                      \
 -  (slirp.found() ? ['pxe-test', 'test-netfilter'] : []) +              \
 +  (slirp.found() ? ['pxe-test'] : []) +              \
   (config_all_devices.has_key('CONFIG_USB_UHCI') ? ['usb-hcd-uhci-test'] : []) +             \
   (config_all_devices.has_key('CONFIG_USB_XHCI_NEC') ? ['usb-hcd-xhci-test'] : []) +         \
 -  (config_host.has_key('CONFIG_POSIX') ? ['test-filter-mirror'] : []) +                      \
   qtests_pci + ['migration-test', 'numa-test', 'cpu-plug-test', 'drive_del-test']
 qtests_sh4 = (config_all_devices.has_key('CONFIG_ISA_TESTDEV') ? ['endianness-test'] : [])
@@ -186,8 +182,8 @@ qtests_aarch64 = \
   ['arm-cpu-features',
    'numa-test',
    'boot-serial-test',
 -   'xlnx-can-test',
 -   'fuzz-xlnx-dp-test',
 +#   'xlnx-can-test',
 +#   'fuzz-xlnx-dp-test',
    'migration-test']
 qtests_s390x = \
@@ -196,7 +192,6 @@ qtests_s390x = \
   (config_host.has_key('CONFIG_POSIX') ? ['test-filter-redirector'] : []) +                     \
   ['boot-serial-test',
    'drive_del-test',
 -   'device-plug-test',
    'virtio-ccw-test',
    'cpu-plug-test',
    'migration-test']
 diff --git a/tests/qtest/prom-env-test.c b/tests/qtest/prom-env-test.c
 index f41d80154a..f8dc478ce8 100644
 --- a/tests/qtest/prom-env-test.c
 +++ b/tests/qtest/prom-env-test.c
@@ -89,10 +89,14 @@ int main(int argc, char *argv[])
     if (!strcmp(arch, "ppc")) {
         add_tests(ppc_machines);
     } else if (!strcmp(arch, "ppc64")) {
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
         add_tests(ppc_machines);
         if (g_test_slow()) {
 +#endif
             qtest_add_data_func("prom-env/pseries", "pseries", test_machine);
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
         }
 +#endif
     } else if (!strcmp(arch, "sparc")) {
         add_tests(sparc_machines);
     } else if (!strcmp(arch, "sparc64")) {
 diff --git a/tests/qtest/test-x86-cpuid-compat.c b/tests/qtest/test-x86-cpuid-compat.c
 index f28848e06e..6b2fd398a2 100644
 --- a/tests/qtest/test-x86-cpuid-compat.c
 +++ b/tests/qtest/test-x86-cpuid-compat.c
@@ -300,6 +300,7 @@ int main(int argc, char **argv)
                    "-cpu 486,xlevel2=0xC0000002,xstore=on",
                    "xlevel2", 0xC0000002);
 +#if 0 /* Disabled in Red Hat Enterprise Linux */
     /* Check compatibility of old machine-types that didn't
      * auto-increase level/xlevel/xlevel2: */
@@ -350,6 +351,7 @@ int main(int argc, char **argv)
     add_cpuid_test("x86/cpuid/xlevel-compat/pc-i440fx-2.4/npt-on",
                    "-machine pc-i440fx-2.4 -cpu SandyBridge,svm=on,npt=on",
                    "xlevel", 0x80000008);
 +#endif
     /* Test feature parsing */
     add_feature_test("x86/cpuid/features/plus",
 diff --git a/tests/qtest/usb-hcd-xhci-test.c b/tests/qtest/usb-hcd-xhci-test.c
 index 10ef9d2a91..3855873050 100644
 --- a/tests/qtest/usb-hcd-xhci-test.c
 +++ b/tests/qtest/usb-hcd-xhci-test.c
@@ -21,6 +21,7 @@ static void test_xhci_hotplug(void)
     usb_test_hotplug(global_qtest, "xhci", "1", NULL);
 }
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void test_usb_uas_hotplug(void)
 {
     QTestState *qts = global_qtest;
@@ -36,6 +37,7 @@ static void test_usb_uas_hotplug(void)
     qtest_qmp_device_del(qts, "scsihd");
     qtest_qmp_device_del(qts, "uas");
 }
 +#endif
 static void test_usb_ccid_hotplug(void)
 {
@@ -56,7 +58,9 @@ int main(int argc, char **argv)
     qtest_add_func("/xhci/pci/init", test_xhci_init);
     qtest_add_func("/xhci/pci/hotplug", test_xhci_hotplug);
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
     qtest_add_func("/xhci/pci/hotplug/usb-uas", test_usb_uas_hotplug);
 +#endif
     qtest_add_func("/xhci/pci/hotplug/usb-ccid", test_usb_ccid_hotplug);
     qtest_start("-device nec-usb-xhci,id=xhci"
 -- 
 2.27.0
--- a/SOURCES/0013-vfio-cap-number-of-devices-that-can-be-assigned.patch
+++ b/SOURCES/0013-vfio-cap-number-of-devices-that-can-be-assigned.patch
@ -1,4 +1,4 @@
-From e06a905d726fc20ea6bd95dff1bd0ffe97ebb202 Mon Sep 17 00:00:00 2001
+From e9ebc159a9acf108e1ec6f622be3f256cf14aba7 Mon Sep 17 00:00:00 2001
 From: Bandan Das <bsd@redhat.com>
 Date: Tue, 3 Dec 2013 20:05:13 +0100
 Subject: vfio: cap number of devices that can be assigned
@ -22,45 +22,42 @@ for other uses. Stepping down a bit, the number 32 arbitrarily
 matches the number of slots on a PCI bus and is also a nice power
 of two.
 Count of slots increased to 509 later so we could increase limit
 to 64 as some usecases require more than 32 devices.
 Signed-off-by: Bandan Das <bsd@redhat.com>
-Rebase changes (8.2.0):
+Rebase notes (2.8.0):
- Update to upstream changes
+- removed return value for vfio_realize (commit 1a22aca)
 Merged patches (2.9.0):
 - 17eb774 vfio: Use error_setg when reporting max assigned device overshoot
 Merged patches (4.1.0-rc3):
 - 2b89558 vfio: increase the cap on number of assigned devices to 64
 ---
- hw/vfio/pci.c | 31 ++++++++++++++++++++++++++++++-
+ hw/vfio/pci.c | 29 ++++++++++++++++++++++++++++-
 hw/vfio/pci.h |  1 +
- 2 files changed, 31 insertions(+), 1 deletion(-)
+ 2 files changed, 29 insertions(+), 1 deletion(-)
 diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
-index 64780d1b79..57ac63c10c 100644
+index 7b45353ce2..eb725a3aee 100644
 --- a/hw/vfio/pci.c
 +++ b/hw/vfio/pci.c
-@@ -50,6 +50,9 @@
+@@ -45,6 +45,9 @@
- /* Protected by BQL */
+ 
- static KVMRouteChange vfio_route_change;
+ #define TYPE_VFIO_PCI_NOHOTPLUG "vfio-pci-nohotplug"
 +/* RHEL only: Set once for the first assigned dev */
 +static uint16_t device_limit;
 +
 static void vfio_disable_interrupts(VFIOPCIDevice *vdev);
 static void vfio_mmap_set_enabled(VFIOPCIDevice *vdev, bool enabled);
- static void vfio_msi_disable_common(VFIOPCIDevice *vdev);
+ 
-@@ -2946,13 +2949,36 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
+@@ -2807,9 +2810,30 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
-     ERRP_GUARD();
+     ssize_t len;
-     VFIOPCIDevice *vdev = VFIO_PCI(pdev);
+     struct stat st;
-     VFIODevice *vbasedev = &vdev->vbasedev;
+     int groupid;
 +    VFIODevice *vbasedev_iter;
 +    VFIOGroup *group;
     char *tmp, *subsys;
     Error *err = NULL;
 -    int i, ret;
 +    int ret, i = 0;
     bool is_mdev;
     char uuid[UUID_STR_LEN];
     char *name;
 +    if (device_limit && device_limit != vdev->assigned_device_limit) {
 +            error_setg(errp, "Assigned device limit has been redefined. "
@ -83,10 +80,10 @@ index 64780d1b79..57ac63c10c 100644
 +        return;
 +    }
 +
-     if (vbasedev->fd < 0 && !vbasedev->sysfsdev) {
+     if (!vdev->vbasedev.sysfsdev) {
         if (!(~vdev->host.domain || ~vdev->host.bus ||
               ~vdev->host.slot || ~vdev->host.function)) {
-@@ -3370,6 +3396,9 @@ static Property vfio_pci_dev_properties[] = {
+@@ -3246,6 +3270,9 @@ static Property vfio_pci_dev_properties[] = {
     DEFINE_PROP_BOOL("x-no-kvm-msix", VFIOPCIDevice, no_kvm_msix, false),
     DEFINE_PROP_BOOL("x-no-geforce-quirks", VFIOPCIDevice,
                      no_geforce_quirks, false),
@ -97,10 +94,10 @@ index 64780d1b79..57ac63c10c 100644
                      false),
     DEFINE_PROP_BOOL("x-no-vfio-ioeventfd", VFIOPCIDevice, no_vfio_ioeventfd,
 diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
-index 6e64a2654e..b7de39c010 100644
+index 64777516d1..e0fe6ca97e 100644
 --- a/hw/vfio/pci.h
 +++ b/hw/vfio/pci.h
-@@ -142,6 +142,7 @@ struct VFIOPCIDevice {
+@@ -139,6 +139,7 @@ struct VFIOPCIDevice {
     EventNotifier err_notifier;
     EventNotifier req_notifier;
     int (*resetfn)(struct VFIOPCIDevice *);
@ -109,5 +106,5 @@ index 6e64a2654e..b7de39c010 100644
     uint32_t device_id;
     uint32_t sub_vendor_id;
 -- 
-2.39.3
+2.27.0
--- a/SOURCES/0014-Add-support-statement-to-help-output.patch
+++ b/SOURCES/0014-Add-support-statement-to-help-output.patch
@ -1,4 +1,4 @@
-From b467dc6a24ef41fa574260429807711f6802a54d Mon Sep 17 00:00:00 2001
+From b736b0c41dd62ed6f874a7b33ca1d4f9ceab4573 Mon Sep 17 00:00:00 2001
 From: Eduardo Habkost <ehabkost@redhat.com>
 Date: Wed, 4 Dec 2013 18:53:17 +0100
 Subject: Add support statement to -help output
@ -17,14 +17,14 @@ as unsupported by Red Hat, and advising users to use libvirt instead.
 Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
 ---
- system/vl.c | 9 +++++++++
+ softmmu/vl.c | 9 +++++++++
 1 file changed, 9 insertions(+)
-diff --git a/system/vl.c b/system/vl.c
+diff --git a/softmmu/vl.c b/softmmu/vl.c
-index c644222982..03c3b0aa94 100644
+index 620a1f1367..d46b8fb4ab 100644
--- a/system/vl.c
+--- a/softmmu/vl.c
-+++ b/system/vl.c
+++ b/softmmu/vl.c
-@@ -869,9 +869,17 @@ static void version(void)
+@@ -827,9 +827,17 @@ static void version(void)
            QEMU_COPYRIGHT "\n");
 }
@ -41,8 +41,8 @@ index c644222982..03c3b0aa94 100644
 +    print_rh_warning();
     printf("usage: %s [options] [disk_image]\n\n"
            "'disk_image' is a raw hard disk image for IDE hard disk 0\n\n",
-             g_get_prgname());
+             error_get_progname());
-@@ -897,6 +905,7 @@ static void help(int exitcode)
+@@ -855,6 +863,7 @@ static void help(int exitcode)
            "\n"
            QEMU_HELP_BOTTOM "\n");
@ -51,5 +51,5 @@ index c644222982..03c3b0aa94 100644
 }
 -- 
-2.39.3
+2.27.0
--- a/SOURCES/0014-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
+++ b/SOURCES/0014-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
@ -1,61 +0,0 @@
 From 20cc3a6d9bce3e40d165f865b5e398c300cae7bf Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 8 Jul 2020 08:35:50 +0200
 Subject: Use qemu-kvm in documentation instead of qemu-system-<arch>
 Patchwork-id: 62380
 O-Subject: [RHEV-7.1 qemu-kvm-rhev PATCHv4] Use qemu-kvm in documentation instead of qemu-system-i386
 Bugzilla: 1140620
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 RH-Acked-by: Markus Armbruster <armbru@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 From: Miroslav Rezanina <mrezanin@redhat.com>
 We change the name and location of qemu-kvm binaries. Update documentation
 to reflect this change. Only architectures available in RHEL are updated.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 docs/defs.rst.inc |  4 ++--
 qemu-options.hx   | 10 +++++-----
 2 files changed, 7 insertions(+), 7 deletions(-)
 diff --git a/docs/defs.rst.inc b/docs/defs.rst.inc
 index 52d6454b93..d74dbdeca9 100644
 --- a/docs/defs.rst.inc
 +++ b/docs/defs.rst.inc
@@ -9,7 +9,7 @@
    but the manpages will end up misrendered with following normal text
    incorrectly in boldface.
 -.. |qemu_system| replace:: qemu-system-x86_64
 -.. |qemu_system_x86| replace:: qemu-system-x86_64
 +.. |qemu_system| replace:: qemu-kvm
 +.. |qemu_system_x86| replace:: qemu-kvm
 .. |I2C| replace:: I\ :sup:`2`\ C
 .. |I2S| replace:: I\ :sup:`2`\ S
 diff --git a/qemu-options.hx b/qemu-options.hx
 index 8ce85d4559..4fc27ee2e2 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
@@ -3493,11 +3493,11 @@ SRST
     ::
 -        qemu -m 512 -object memory-backend-file,id=mem,size=512M,mem-path=/hugetlbfs,share=on \
 -             -numa node,memdev=mem \
 -             -chardev socket,id=chr0,path=/path/to/socket \
 -             -netdev type=vhost-user,id=net0,chardev=chr0 \
 -             -device virtio-net-pci,netdev=net0
 +        qemu-kvm -m 512 -object memory-backend-file,id=mem,size=512M,mem-path=/hugetlbfs,share=on \
 +                 -numa node,memdev=mem \
 +                 -chardev socket,id=chr0,path=/path/to/socket \
 +                 -netdev type=vhost-user,id=net0,chardev=chr0 \
 +                 -device virtio-net-pci,netdev=net0
 ``-netdev vhost-vdpa[,vhostdev=/path/to/dev][,vhostfd=h]``
     Establish a vhost-vdpa netdev.
 -- 
 2.39.3
--- a/SOURCES/0015-globally-limit-the-maximum-number-of-CPUs.patch
+++ b/SOURCES/0015-globally-limit-the-maximum-number-of-CPUs.patch
@ -0,0 +1,65 @@
 From 9a7621819821ee88d2f99d6b629fd87aa9a07758 Mon Sep 17 00:00:00 2001
 From: Andrew Jones <drjones@redhat.com>
 Date: Tue, 21 Jan 2014 10:46:52 +0100
 Subject: globally limit the maximum number of CPUs
 We now globally limit the number of VCPUs.
 Especially, there is no way one can specify more than
 max_cpus VCPUs for a VM.
 This allows us the restore the ppc max_cpus limitation to the upstream
 default and minimize the ppc hack in kvm-all.c.
 Signed-off-by: David Hildenbrand <david@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 Signed-off-by: Danilo Cesar Lemes de Paula <ddepaula@redhat.com>
 Rebase notes (2.11.0):
 - Removed CONFIG_RHV reference
 - Update commit log
 Merged patches (2.11.0):
 - 92fef14623 redhat: remove manual max_cpus limitations for ppc
 - bb722e9eff redhat: globally limit the maximum number of CPUs
 - fdeef3c1c7 RHEL: Set vcpus hard limit to 240 for Power
 - 0584216921 Match POWER max cpus to x86
 Signed-off-by: Andrew Jones <drjones@redhat.com>
 Merged patches (5.1.0):
 - redhat: globally limit the maximum number of CPUs
 - redhat: remove manual max_cpus limitations for ppc
 - use recommended max vcpu count
 Merged patches (5.2.0 rc0):
 - f8a4123 vl: Remove downstream-only MAX_RHEL_CPUS code
 ---
 accel/kvm/kvm-all.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)
 diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
 index eecd8031cf..8f2a53438f 100644
 --- a/accel/kvm/kvm-all.c
 +++ b/accel/kvm/kvm-all.c
@@ -2423,6 +2423,18 @@ static int kvm_init(MachineState *ms)
     soft_vcpus_limit = kvm_recommended_vcpus(s);
     hard_vcpus_limit = kvm_max_vcpus(s);
 +#ifdef HOST_PPC64
 +    /*
 +     * On POWER, the kernel advertises a soft limit based on the
 +     * number of CPU threads on the host.  We want to allow exceeding
 +     * this for testing purposes, so we don't want to set hard limit
 +     * to soft limit as on x86.
 +     */
 +#else
 +    /* RHEL doesn't support nr_vcpus > soft_vcpus_limit */
 +    hard_vcpus_limit = soft_vcpus_limit;
 +#endif
 +
     while (nc->name) {
         if (nc->num > soft_vcpus_limit) {
             warn_report("Number of %s cpus requested (%d) exceeds "
 -- 
 2.27.0
--- a/SOURCES/0015-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch
+++ b/SOURCES/0015-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch
@ -1,77 +0,0 @@
 From 2f9fdd21ecf2810d0d83a8125ce0cc1e75dbb13a Mon Sep 17 00:00:00 2001
 From: Kevin Wolf <kwolf@redhat.com>
 Date: Fri, 20 Aug 2021 18:25:12 +0200
 Subject: qcow2: Deprecation warning when opening v2 images rw
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Kevin Wolf <kwolf@redhat.com>
 RH-MergeRequest: 37: qcow2: Deprecation warning when opening v2 images rw
 RH-Commit: [1/1] f450d0ae32d35063b28c72c4f2d2ebb9e6d8db3e (kmwolf/centos-qemu-kvm)
 RH-Bugzilla: 1951814
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Hanna Reitz <hreitz@redhat.com>
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 qcow2 v3 has been around for a long time (since QEMU 1.1/RHEL 7), so
 there is no real reason any more to use it. People still using it might
 do so unintentionally. Warn about it and suggest upgrading during the
 RHEL 9 timeframe so that the code can possibly be disabled in RHEL 10.
 The warning is restricted to read-write mode and the system emulator.
 The primary motivation for not having it in qemu-img is that 'qemu-img
 amend' for upgrades would warn otherwise. It also avoids having to make
 too many changes to the test suite.
 bdrv_uses_whitelist() is used as a proxy for deciding whether we are
 running in a tool or the system emulator. This is not entirely clean,
 but it's what is available and the same function qcow2_do_open() already
 uses it this way for another warning.
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 patch_name: kvm-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch
 present_in_specfile: true
 location_in_specfile: 116
 ---
 Rebase notes (6.1.0):
 - Replace bs->read_only with bdrv_is_read_only
 ---
 block/qcow2.c                    | 6 ++++++
 tests/qemu-iotests/common.filter | 1 +
 2 files changed, 7 insertions(+)
 diff --git a/block/qcow2.c b/block/qcow2.c
 index 956128b409..0e8b2f7518 100644
 --- a/block/qcow2.c
 +++ b/block/qcow2.c
@@ -1358,6 +1358,12 @@ qcow2_do_open(BlockDriverState *bs, QDict *options, int flags,
         ret = -ENOTSUP;
         goto fail;
     }
 +    if (header.version < 3 && !bdrv_is_read_only(bs) && bdrv_uses_whitelist()) {
 +        warn_report_once("qcow2 v2 images are deprecated and may not be "
 +                         "supported in future versions. Please consider "
 +                         "upgrading the image with 'qemu-img amend "
 +                         "-o compat=v3'.");
 +    }
     s->qcow_version = header.version;
 diff --git a/tests/qemu-iotests/common.filter b/tests/qemu-iotests/common.filter
 index 2846c83808..83472953a2 100644
 --- a/tests/qemu-iotests/common.filter
 +++ b/tests/qemu-iotests/common.filter
@@ -83,6 +83,7 @@ _filter_qemu()
 {
     gsed -e "s#\\(^\\|(qemu) \\)$(basename $QEMU_PROG):#\1QEMU_PROG:#" \
         -e 's#^QEMU [0-9]\+\.[0-9]\+\.[0-9]\+ monitor#QEMU X.Y.Z monitor#' \
 +        -e "/qcow2 v2 images are deprecated/d" \
         -e $'s#\r##' # QEMU monitor uses \r\n line endings
 }
 -- 
 2.39.3
--- a/SOURCES/0016-Add-upstream-compatibility-bits.patch
+++ b/SOURCES/0016-Add-upstream-compatibility-bits.patch
@ -1,121 +0,0 @@
 From 59470e8ab849f22b407f55292e540e16a8cad01a Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 20 Mar 2024 05:34:32 -0400
 Subject: Add upstream compatibility bits
 Adding new compats structure for changes introduced during rebase to QEMU 9.0.0.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 Rebase notes (9.0.0 rc2):
 - Add aw-bits setting for aarch compat record (overwritten for 9.4 and older)
 ---
 hw/arm/virt.c              |  3 +++
 hw/core/machine.c          | 10 ++++++++++
 hw/i386/pc_piix.c          |  3 ++-
 hw/i386/pc_q35.c           |  3 +++
 hw/s390x/s390-virtio-ccw.c |  1 +
 include/hw/boards.h        |  3 +++
 6 files changed, 22 insertions(+), 1 deletion(-)
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index 22bc345137..f1af9495c6 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
@@ -144,6 +144,8 @@ GlobalProperty arm_rhel_compat[] = {
     {"virtio-net-pci", "romfile", "" },
     {"virtio-net-pci-transitional", "romfile", "" },
     {"virtio-net-pci-non-transitional", "romfile", "" },
 +    /* arm_rhel_compat from arm_virt_compat, added for 9.0.0 rebase */
 +    { TYPE_VIRTIO_IOMMU_PCI, "aw-bits", "48" },
 };
 const size_t arm_rhel_compat_len = G_N_ELEMENTS(arm_rhel_compat);
@@ -3728,6 +3730,7 @@ type_init(rhel_machine_init);
 static void rhel940_virt_options(MachineClass *mc)
 {
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_5, hw_compat_rhel_9_5_len);
 }
 DEFINE_RHEL_MACHINE_AS_LATEST(9, 4, 0)
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index 695cb89a46..0f256d9633 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -302,6 +302,16 @@ const size_t hw_compat_2_1_len = G_N_ELEMENTS(hw_compat_2_1);
 const char *rhel_old_machine_deprecation =
     "machine types for previous major releases are deprecated";
 +GlobalProperty hw_compat_rhel_9_5[] = {
 +  /* hw_compat_rhel_9_5 from hw_compat_8_2 */
 +    { "migration", "zero-page-detection", "legacy"},
 +  /* hw_compat_rhel_9_5 from hw_compat_8_2 */
 +    { TYPE_VIRTIO_IOMMU_PCI, "granule", "4k" },
 +  /* hw_compat_rhel_9_5 from hw_compat_8_2 */
 +    { TYPE_VIRTIO_IOMMU_PCI, "aw-bits", "64" },
 +};
 +const size_t hw_compat_rhel_9_5_len = G_N_ELEMENTS(hw_compat_rhel_9_5);
 +
 GlobalProperty hw_compat_rhel_9_4[] = {
   /* hw_compat_rhel_9_4 from hw_compat_8_0 */
     { TYPE_VIRTIO_NET, "host_uso", "off"},
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
 index a647262d63..6b260682eb 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
@@ -1015,7 +1015,8 @@ static void pc_machine_rhel760_options(MachineClass *m)
     object_class_property_set_description(oc, "x-south-bridge",
                                      "Use a different south bridge than PIIX3");
 -
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_5,
 +		     hw_compat_rhel_9_5_len);
     compat_props_add(m->compat_props, hw_compat_rhel_9_4,
                      hw_compat_rhel_9_4_len);
     compat_props_add(m->compat_props, hw_compat_rhel_9_3,
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
 index e872dc7e46..2b54944c0f 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
@@ -733,6 +733,9 @@ static void pc_q35_machine_rhel940_options(MachineClass *m)
     m->desc = "RHEL-9.4.0 PC (Q35 + ICH9, 2009)";
     pcmc->smbios_stream_product = "RHEL";
     pcmc->smbios_stream_version = "9.4.0";
 +
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_5,
 +		     hw_compat_rhel_9_5_len);
 }
 DEFINE_PC_MACHINE(q35_rhel940, "pc-q35-rhel9.4.0", pc_q35_init_rhel940,
 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
 index ff753a29e0..9ad54682c6 100644
 --- a/hw/s390x/s390-virtio-ccw.c
 +++ b/hw/s390x/s390-virtio-ccw.c
@@ -1282,6 +1282,7 @@ static void ccw_machine_rhel940_instance_options(MachineState *machine)
 static void ccw_machine_rhel940_class_options(MachineClass *mc)
 {
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_5, hw_compat_rhel_9_5_len);
 }
 DEFINE_CCW_MACHINE(rhel940, "rhel9.4.0", true);
 diff --git a/include/hw/boards.h b/include/hw/boards.h
 index 46b8725c41..cca62f906b 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
@@ -514,6 +514,9 @@ extern const size_t hw_compat_2_2_len;
 extern GlobalProperty hw_compat_2_1[];
 extern const size_t hw_compat_2_1_len;
 +extern GlobalProperty hw_compat_rhel_9_5[];
 +extern const size_t hw_compat_rhel_9_5_len;
 +
 extern GlobalProperty hw_compat_rhel_9_4[];
 extern const size_t hw_compat_rhel_9_4_len;
 -- 
 2.39.3
--- a/SOURCES/0016-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
+++ b/SOURCES/0016-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
@ -0,0 +1,126 @@
 From 0d3fc0b4c5773c6cabb0a58c064475f76eb6ac1e Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 8 Jul 2020 08:35:50 +0200
 Subject: Use qemu-kvm in documentation instead of qemu-system-<arch>
 Patchwork-id: 62380
 O-Subject: [RHEV-7.1 qemu-kvm-rhev PATCHv4] Use qemu-kvm in documentation instead of qemu-system-i386
 Bugzilla: 1140620
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 RH-Acked-by: Markus Armbruster <armbru@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 From: Miroslav Rezanina <mrezanin@redhat.com>
 We change the name and location of qemu-kvm binaries. Update documentation
 to reflect this change. Only architectures available in RHEL are updated.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 Rebase notes (5.1.0 rc0):
 - qemu-block-drivers.texi converted to qemu-block-drivers.rst (upstream)
 Rebase notes (5.2.0 rc0):
 - rewrite patch to new docs structure
 ---
 docs/defs.rst.inc              |  4 ++--
 docs/tools/qemu-trace-stap.rst | 14 +++++++-------
 qemu-options.hx                | 10 +++++-----
 3 files changed, 14 insertions(+), 14 deletions(-)
 diff --git a/docs/defs.rst.inc b/docs/defs.rst.inc
 index 52d6454b93..d74dbdeca9 100644
 --- a/docs/defs.rst.inc
 +++ b/docs/defs.rst.inc
@@ -9,7 +9,7 @@
    but the manpages will end up misrendered with following normal text
    incorrectly in boldface.
 -.. |qemu_system| replace:: qemu-system-x86_64
 -.. |qemu_system_x86| replace:: qemu-system-x86_64
 +.. |qemu_system| replace:: qemu-kvm
 +.. |qemu_system_x86| replace:: qemu-kvm
 .. |I2C| replace:: I\ :sup:`2`\ C
 .. |I2S| replace:: I\ :sup:`2`\ S
 diff --git a/docs/tools/qemu-trace-stap.rst b/docs/tools/qemu-trace-stap.rst
 index d53073b52b..9e93df084f 100644
 --- a/docs/tools/qemu-trace-stap.rst
 +++ b/docs/tools/qemu-trace-stap.rst
@@ -46,19 +46,19 @@ The following commands are valid:
   any of the listed names. If no *PATTERN* is given, the all possible
   probes will be listed.
 -  For example, to list all probes available in the ``qemu-system-x86_64``
 +  For example, to list all probes available in the ``qemu-kvm``
   binary:
   ::
 -    $ qemu-trace-stap list qemu-system-x86_64
 +    $ qemu-trace-stap list qemu-kvm
   To filter the list to only cover probes related to QEMU's cryptographic
   subsystem, in a binary outside ``$PATH``
   ::
 -    $ qemu-trace-stap list /opt/qemu/4.0.0/bin/qemu-system-x86_64 'qcrypto*'
 +    $ qemu-trace-stap list /opt/qemu/4.0.0/bin/qemu-kvm 'qcrypto*'
 .. option:: run OPTIONS BINARY PATTERN...
@@ -90,18 +90,18 @@ The following commands are valid:
     Restrict the tracing session so that it only triggers for the process
     identified by *PID*.
 -  For example, to monitor all processes executing ``qemu-system-x86_64``
 +  For example, to monitor all processes executing ``qemu-kvm``
   as found on ``$PATH``, displaying all I/O related probes:
   ::
 -    $ qemu-trace-stap run qemu-system-x86_64 'qio*'
 +    $ qemu-trace-stap run qemu-kvm 'qio*'
   To monitor only the QEMU process with PID 1732
   ::
 -    $ qemu-trace-stap run --pid=1732 qemu-system-x86_64 'qio*'
 +    $ qemu-trace-stap run --pid=1732 qemu-kvm 'qio*'
   To monitor QEMU processes running an alternative binary outside of
   ``$PATH``, displaying verbose information about setup of the
@@ -109,7 +109,7 @@ The following commands are valid:
   ::
 -    $ qemu-trace-stap -v run /opt/qemu/4.0.0/qemu-system-x86_64 'qio*'
 +    $ qemu-trace-stap -v run /opt/qemu/4.0.0/qemu-kvm 'qio*'
 See also
 --------
 diff --git a/qemu-options.hx b/qemu-options.hx
 index ae2c6dbbfc..94c4a8dbaf 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
@@ -3150,11 +3150,11 @@ SRST
     ::
 -        qemu -m 512 -object memory-backend-file,id=mem,size=512M,mem-path=/hugetlbfs,share=on \
 -             -numa node,memdev=mem \
 -             -chardev socket,id=chr0,path=/path/to/socket \
 -             -netdev type=vhost-user,id=net0,chardev=chr0 \
 -             -device virtio-net-pci,netdev=net0
 +        qemu-kvm -m 512 -object memory-backend-file,id=mem,size=512M,mem-path=/hugetlbfs,share=on \
 +                 -numa node,memdev=mem \
 +                 -chardev socket,id=chr0,path=/path/to/socket \
 +                 -netdev type=vhost-user,id=net0,chardev=chr0 \
 +                 -device virtio-net-pci,netdev=net0
 ``-netdev vhost-vdpa,vhostdev=/path/to/dev``
     Establish a vhost-vdpa netdev.
 -- 
 2.27.0
--- a/SOURCES/0017-virtio-scsi-Reject-scsi-cd-if-data-plane-enabled-RHE.patch
+++ b/SOURCES/0017-virtio-scsi-Reject-scsi-cd-if-data-plane-enabled-RHE.patch
@ -0,0 +1,66 @@
 From d95768c039a2bf6b68422f83a8d55dad41bd3181 Mon Sep 17 00:00:00 2001
 From: Fam Zheng <famz@redhat.com>
 Date: Wed, 14 Jun 2017 15:37:01 +0200
 Subject: virtio-scsi: Reject scsi-cd if data plane enabled [RHEL only]
 RH-Author: Fam Zheng <famz@redhat.com>
 Message-id: <20170614153701.14757-1-famz@redhat.com>
 Patchwork-id: 75613
 O-Subject: [RHV-7.4 qemu-kvm-rhev PATCH v3] virtio-scsi: Reject scsi-cd if data plane enabled [RHEL only]
 Bugzilla: 1378816
 RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Max Reitz <mreitz@redhat.com>
 We need a fix for RHEL 7.4 and 7.3.z, but unfortunately upstream isn't
 ready. If it were, the changes will be too invasive. To have an idea:
 https://lists.gnu.org/archive/html/qemu-devel/2017-05/msg05400.html
 is an incomplete attempt to fix part of the issue, and the remaining
 work unfortunately involve even more complex changes.
 As a band-aid, this partially reverts the effect of ef8875b
 (virtio-scsi: Remove op blocker for dataplane, since v2.7). We cannot
 simply revert that commit as a whole because we already shipped it in
 qemu-kvm-rhev 7.3, since when, block jobs has been possible.  We should
 only block what has been broken.  Also, faithfully reverting the above
 commit means adding back the removed op blocker, but that is not enough,
 because it still crashes when inserting media into an initially empty
 scsi-cd.
 All in all, scsi-cd on virtio-scsi-dataplane has basically been unusable
 unless the scsi-cd never enters an empty state, so, disable it
 altogether.  Otherwise it would be much more difficult to avoid
 crashing.
 Signed-off-by: Fam Zheng <famz@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/scsi/virtio-scsi.c | 9 +++++++++
 1 file changed, 9 insertions(+)
 diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
 index 51fd09522a..a35257c35a 100644
 --- a/hw/scsi/virtio-scsi.c
 +++ b/hw/scsi/virtio-scsi.c
@@ -896,6 +896,15 @@ static void virtio_scsi_hotplug(HotplugHandler *hotplug_dev, DeviceState *dev,
     AioContext *old_context;
     int ret;
 +    /* XXX: Remove this check once block backend is capable of handling
 +     * AioContext change upon eject/insert.
 +     * s->ctx is NULL if ioeventfd is off, s->ctx is qemu_get_aio_context() if
 +     * data plane is not used, both cases are safe for scsi-cd. */
 +    if (s->ctx && s->ctx != qemu_get_aio_context() &&
 +        object_dynamic_cast(OBJECT(dev), "scsi-cd")) {
 +        error_setg(errp, "scsi-cd is not supported by data plane");
 +        return;
 +    }
     if (s->ctx && !s->dataplane_fenced) {
         if (blk_op_is_blocked(sd->conf.blk, BLOCK_OP_TYPE_DATAPLANE, errp)) {
             return;
 -- 
 2.27.0
--- a/SOURCES/0017-x86-rhel-9.4.0-machine-type-compat-fix.patch
+++ b/SOURCES/0017-x86-rhel-9.4.0-machine-type-compat-fix.patch
@ -1,30 +0,0 @@
 From ba574acacf679850e337ec2d5e7836b8277cf393 Mon Sep 17 00:00:00 2001
 From: Sebastian Ott <sebott@redhat.com>
 Date: Thu, 18 Apr 2024 15:04:28 +0200
 Subject: x86: rhel 9.4.0 machine type compat fix
 Fix up the compatibility for 9.4.0. Ensure that pc-q35-rhel9.4.0
 still uses SMBIOS 3.X by default.
 Signed-off-by: Sebastian Ott <sebott@redhat.com>
 ---
 hw/i386/pc_q35.c | 3 +++
 1 file changed, 3 insertions(+)
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
 index 2b54944c0f..2f11f9af7d 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
@@ -734,6 +734,9 @@ static void pc_q35_machine_rhel940_options(MachineClass *m)
     pcmc->smbios_stream_product = "RHEL";
     pcmc->smbios_stream_version = "9.4.0";
 +    /* From pc_q35_8_2_machine_options() - use SMBIOS 3.X by default */
 +    pcmc->default_smbios_ep_type = SMBIOS_ENTRY_POINT_TYPE_64;
 +
     compat_props_add(m->compat_props, hw_compat_rhel_9_5,
 		     hw_compat_rhel_9_5_len);
 }
 -- 
 2.39.3
--- a/SOURCES/0018-BZ1653590-Require-at-least-64kiB-pages-for-downstrea.patch
+++ b/SOURCES/0018-BZ1653590-Require-at-least-64kiB-pages-for-downstrea.patch
@ -0,0 +1,60 @@
 From 92bb62c47eab021f8dabecd09b5fbc1706e6a29c Mon Sep 17 00:00:00 2001
 From: David Gibson <dgibson@redhat.com>
 Date: Wed, 6 Feb 2019 03:58:56 +0000
 Subject: BZ1653590: Require at least 64kiB pages for downstream guests & hosts
 RH-Author: David Gibson <dgibson@redhat.com>
 Message-id: <20190206035856.19058-1-dgibson@redhat.com>
 Patchwork-id: 84246
 O-Subject: [RHELAV-8.0/rhel qemu-kvm PATCH] BZ1653590: Require at least 64kiB pages for downstream guests & hosts
 Bugzilla: 1653590
 RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
 RH-Acked-by: Serhii Popovych <spopovyc@redhat.com>
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 Most current POWER guests require 64kiB page support, so that's the default
 for the cap-hpt-max-pagesize option in qemu which limits available guest
 page sizes.  We warn if the value is set smaller than that, but don't
 outright fail upstream, because we need to allow for the possibility of
 guest (and/or host) kernels configured for 4kiB page sizes.
 Downstream, however, we simply don't support 4kiB pagesize configured
 kernels in guest or host, so we can have qemu simply error out in this
 situation.
 Testing: Attempted to start a guest with cap-hpt-max-page-size=4k and verified
         it failed immediately with a qemu error
 Signed-off-by: David Gibson <dgibson@redhat.com>
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
 hw/ppc/spapr_caps.c | 7 +++++++
 1 file changed, 7 insertions(+)
 diff --git a/hw/ppc/spapr_caps.c b/hw/ppc/spapr_caps.c
 index ed7c077a0d..48a8efe678 100644
 --- a/hw/ppc/spapr_caps.c
 +++ b/hw/ppc/spapr_caps.c
@@ -332,12 +332,19 @@ bool spapr_check_pagesize(SpaprMachineState *spapr, hwaddr pagesize,
 static void cap_hpt_maxpagesize_apply(SpaprMachineState *spapr,
                                       uint8_t val, Error **errp)
 {
 +#if 0 /* disabled for RHEL */
     if (val < 12) {
         error_setg(errp, "Require at least 4kiB hpt-max-page-size");
         return;
     } else if (val < 16) {
         warn_report("Many guests require at least 64kiB hpt-max-page-size");
     }
 +#else /* Only page sizes >=64kiB supported for RHEL */
 +    if (val < 16) {
 +        error_setg(errp, "Require at least 64kiB hpt-max-page-size");
 +        return;
 +    }
 +#endif
     spapr_check_pagesize(spapr, qemu_minrampagesize(), errp);
 }
 -- 
 2.27.0
--- a/SOURCES/0019-compat-Update-hw_compat_rhel_8_5.patch
+++ b/SOURCES/0019-compat-Update-hw_compat_rhel_8_5.patch
@ -0,0 +1,53 @@
 From a9b5da617c29f48199cbea08d6a1c083877dce10 Mon Sep 17 00:00:00 2001
 From: Laurent Vivier <lvivier@redhat.com>
 Date: Mon, 15 Nov 2021 14:22:29 +0100
 Subject: compat: Update hw_compat_rhel_8_5
 RH-Author: Laurent Vivier <lvivier@redhat.com>
 RH-MergeRequest: 66: redhat: Update pseries-rhel8.5.0 machine type
 RH-Commit: [1/2] 232f2ad2b29d250fbdb8fcea9d814704c575ba2b
 RH-Bugzilla: 2022608
 RH-Acked-by: Eric Auger <eric.auger@redhat.com>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: Greg Kurz <gkurz@redhat.com>
 Add properties from hw_compat_6_1 as it already includes the ones from
 hw_compat_6_0. Add a lately added property from 6.0 too.
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 --
 Rebase notes (6.2.0 rc3):
 - Included compatc changes introduced in RC2
 ---
 hw/core/machine.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index 62febde5aa..736c765c30 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -38,7 +38,7 @@
 #include "hw/virtio/virtio-pci.h"
 /*
 - * Mostly the same as hw_compat_6_0
 + * Mostly the same as hw_compat_6_0 and hw_compat_6_1
  */
 GlobalProperty hw_compat_rhel_8_5[] = {
     /* hw_compat_rhel_8_5 from hw_compat_6_0 */
@@ -51,6 +51,12 @@ GlobalProperty hw_compat_rhel_8_5[] = {
     { "e1000", "init-vet", "off" },
     /* hw_compat_rhel_8_5 from hw_compat_6_0 */
     { "e1000e", "init-vet", "off" },
 +    /* hw_compat_rhel_8_5 from hw_compat_6_0 */
 +    { "vhost-vsock-device", "seqpacket", "off" },
 +    /* hw_compat_rhel_8_5 from hw_compat_6_1 */
 +    { "vhost-user-vsock-device", "seqpacket", "off" },
 +    /* hw_compat_rhel_8_5 from hw_compat_6_1 */
 +    { "nvme-ns", "shared", "off" },
 };
 const size_t hw_compat_rhel_8_5_len = G_N_ELEMENTS(hw_compat_rhel_8_5);
 -- 
 2.27.0
--- a/SOURCES/0020-redhat-Update-pseries-rhel8.5.0-machine-type.patch
+++ b/SOURCES/0020-redhat-Update-pseries-rhel8.5.0-machine-type.patch
@ -0,0 +1,43 @@
 From 82358c35f04f026820b3907069a6c19cd95b654d Mon Sep 17 00:00:00 2001
 From: Laurent Vivier <lvivier@redhat.com>
 Date: Mon, 15 Nov 2021 14:25:33 +0100
 Subject: redhat: Update pseries-rhel8.5.0 machine type
 RH-Author: Laurent Vivier <lvivier@redhat.com>
 RH-MergeRequest: 66: redhat: Update pseries-rhel8.5.0 machine type
 RH-Commit: [2/2] 36f7ad1ea56baaaecb139875ad0a90a6470196be
 RH-Bugzilla: 2022608
 RH-Acked-by: Eric Auger <eric.auger@redhat.com>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: Greg Kurz <gkurz@redhat.com>
 `
 We don't introduce a new machine type for rhel8.6.0 but we need
 to keep compatibility with rhel8.5.0 machine type.
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 ---
 hw/ppc/spapr.c | 4 ++++
 1 file changed, 4 insertions(+)
 diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
 index cace86028d..2f27888d8a 100644
 --- a/hw/ppc/spapr.c
 +++ b/hw/ppc/spapr.c
@@ -5177,10 +5177,14 @@ static void spapr_machine_rhel_default_class_options(MachineClass *mc)
 static void spapr_machine_rhel850_class_options(MachineClass *mc)
 {
 +    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 +
     /* The default machine type must apply the RHEL specific defaults */
     spapr_machine_rhel_default_class_options(mc);
     compat_props_add(mc->compat_props, hw_compat_rhel_8_5,
                      hw_compat_rhel_8_5_len);
 +    smc->pre_6_2_numa_affinity = true;
 +    mc->smp_props.prefer_sockets = true;
 }
 DEFINE_SPAPR_MACHINE(rhel850, "rhel8.5.0", true);
 -- 
 2.27.0
--- a/SOURCES/0021-redhat-virt-rhel8.5.0-Update-machine-type-compatibil.patch
+++ b/SOURCES/0021-redhat-virt-rhel8.5.0-Update-machine-type-compatibil.patch
@ -0,0 +1,51 @@
 From ce73e939b993cc6be170cdb5d3f2068270593f2b Mon Sep 17 00:00:00 2001
 From: Eric Auger <eric.auger@redhat.com>
 Date: Tue, 16 Nov 2021 17:03:07 +0100
 Subject: redhat: virt-rhel8.5.0: Update machine type compatibility for QEMU
 6.2.0 update
 RH-Author: Eric Auger <eric.auger@redhat.com>
 RH-MergeRequest: 75: redhat: virt-rhel8.5.0: Update machine type compatibility for QEMU 6.2.0 update
 RH-Commit: [21/21] f027d13654944e3d34e3356affe7af952eec2bed
 RH-Bugzilla: 2022607
 RH-Acked-by: Gavin Shan <gshan@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: Andrew Jones <drjones@redhat.com>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
 To keep compatibility with 8.5-AV machine type we need to
 turn few new options on by default:
 smp_props.prefer_sockets, no_cpu_topology, no_tcg_its
 TESTED: migrate from rhel-av-8.5.0 to rhel-8.6.0 and vice-versa
 with upstream fix: 33a0c404fb  hw/intc/arm_gicv3_its: Revert version
 increments in vmstate_its
 Signed-off-by: Eric Auger <eric.auger@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/arm/virt.c | 5 +++++
 1 file changed, 5 insertions(+)
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index c77d26ab13..e8941afd01 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
@@ -3225,8 +3225,13 @@ type_init(rhel_machine_init);
 static void rhel850_virt_options(MachineClass *mc)
 {
 +    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
 +
     compat_props_add(mc->compat_props, arm_rhel_compat, arm_rhel_compat_len);
     compat_props_add(mc->compat_props, hw_compat_rhel_8_5, hw_compat_rhel_8_5_len);
 +    mc->smp_props.prefer_sockets = true;
 +    vmc->no_cpu_topology = true;
 +    vmc->no_tcg_its = true;
 }
 DEFINE_RHEL_MACHINE_AS_LATEST(8, 5, 0)
 -- 
 2.27.0
--- a/SOURCES/0022-Fix-virtio-net-pci-vectors-compat.patch
+++ b/SOURCES/0022-Fix-virtio-net-pci-vectors-compat.patch
@ -0,0 +1,45 @@
 From f9643b6934657292aae0b830627b1e5f9b8cbaa1 Mon Sep 17 00:00:00 2001
 From: Eduardo Habkost <ehabkost@redhat.com>
 Date: Tue, 19 Oct 2021 13:17:06 -0400
 Subject: Fix virtio-net-pci* "vectors" compat
 RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-MergeRequest: 77: 8.6/6.2 mt fixes
 RH-Commit: [21/23] 8ad581932275d2698a99f31bec40b14f1dbd3d2e
 RH-Bugzilla: 2026443
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 hw_compat_rhel_8_4 has an issue: it affects only "virtio-net-pci"
 but not "virtio-net-pci-transitional" and
 "virtio-net-pci-non-transitional".  The solution is to use the
 "virtio-net-pci-base" type in compat_props.
 An equivalent fix will be submitted for hw_compat_5_2 upstream.
 Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
 (cherry picked from commit d45823ab0d0138b2fbaf2ed1e1896d2052f3ccb3)
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/core/machine.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index 736c765c30..024b025fc2 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -71,7 +71,11 @@ GlobalProperty hw_compat_rhel_8_4[] = {
     /* hw_compat_rhel_8_4 from hw_compat_5_2 */
     { "virtio-blk-device", "report-discard-granularity", "off" },
     /* hw_compat_rhel_8_4 from hw_compat_5_2 */
 -    { "virtio-net-pci", "vectors", "3"},
 +    /*
 +     * Upstream incorrectly had "virtio-net-pci" instead of "virtio-net-pci-base",
 +     * (https://bugzilla.redhat.com/show_bug.cgi?id=1999141)
 +     */
 +    { "virtio-net-pci-base", "vectors", "3"},
 };
 const size_t hw_compat_rhel_8_4_len = G_N_ELEMENTS(hw_compat_rhel_8_4);
 -- 
 2.27.0
--- a/SOURCES/0023-x86-rhel-machine-types-Add-pc_rhel_8_5_compat.patch
+++ b/SOURCES/0023-x86-rhel-machine-types-Add-pc_rhel_8_5_compat.patch
@ -0,0 +1,73 @@
 From 7ad8814e583dcc7dc23e3e8398570243b8f176a1 Mon Sep 17 00:00:00 2001
 From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
 Date: Tue, 23 Nov 2021 17:57:42 +0000
 Subject: x86/rhel machine types: Add pc_rhel_8_5_compat
 RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-MergeRequest: 77: 8.6/6.2 mt fixes
 RH-Commit: [22/23] 8bf555c5d78f344b97ffd5c888c7a7bed592d9d0
 RH-Bugzilla: 2026443
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 Add pc_rhel_8_5_compat as the merge of pc_compat_6_1 and pc_compat_6_0
 (since 8.5 was based on 6.0).
 Note, x-keep-pci-slot-hpc flipped back and forward, leaving it out
 looks like it leaves us with the original.
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/i386/pc.c         | 21 +++++++++++++++++++++
 include/hw/i386/pc.h |  3 +++
 2 files changed, 24 insertions(+)
 diff --git a/hw/i386/pc.c b/hw/i386/pc.c
 index e8109954ca..4c08a1971c 100644
 --- a/hw/i386/pc.c
 +++ b/hw/i386/pc.c
@@ -387,6 +387,27 @@ GlobalProperty pc_rhel_compat[] = {
 };
 const size_t pc_rhel_compat_len = G_N_ELEMENTS(pc_rhel_compat);
 +GlobalProperty pc_rhel_8_5_compat[] = {
 +    /* pc_rhel_8_5_compat from pc_compat_6_0 */
 +    { "qemu64" "-" TYPE_X86_CPU, "family", "6" },
 +    /* pc_rhel_8_5_compat from pc_compat_6_0 */
 +    { "qemu64" "-" TYPE_X86_CPU, "model", "6" },
 +    /* pc_rhel_8_5_compat from pc_compat_6_0 */
 +    { "qemu64" "-" TYPE_X86_CPU, "stepping", "3" },
 +    /* pc_rhel_8_5_compat from pc_compat_6_0 */
 +    { TYPE_X86_CPU, "x-vendor-cpuid-only", "off" },
 +    /* pc_rhel_8_5_compat from pc_compat_6_0 */
 +    { "ICH9-LPC", ACPI_PM_PROP_ACPI_PCIHP_BRIDGE, "off" },
 +
 +    /* pc_rhel_8_5_compat from pc_compat_6_1 */
 +    { TYPE_X86_CPU, "hv-version-id-build", "0x1bbc" },
 +    /* pc_rhel_8_5_compat from pc_compat_6_1 */
 +    { TYPE_X86_CPU, "hv-version-id-major", "0x0006" },
 +    /* pc_rhel_8_5_compat from pc_compat_6_1 */
 +    { TYPE_X86_CPU, "hv-version-id-minor", "0x0001" },
 +};
 +const size_t pc_rhel_8_5_compat_len = G_N_ELEMENTS(pc_rhel_8_5_compat);
 +
 GlobalProperty pc_rhel_8_4_compat[] = {
     /* pc_rhel_8_4_compat from pc_compat_5_2 */
     { "ICH9-LPC", "x-smi-cpu-hotunplug", "off" },
 diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
 index d0544ee119..9e8bfb69f8 100644
 --- a/include/hw/i386/pc.h
 +++ b/include/hw/i386/pc.h
@@ -286,6 +286,9 @@ extern const size_t pc_compat_1_4_len;
 extern GlobalProperty pc_rhel_compat[];
 extern const size_t pc_rhel_compat_len;
 +extern GlobalProperty pc_rhel_8_5_compat[];
 +extern const size_t pc_rhel_8_5_compat_len;
 +
 extern GlobalProperty pc_rhel_8_4_compat[];
 extern const size_t pc_rhel_8_4_compat_len;
 -- 
 2.27.0
--- a/SOURCES/0024-x86-rhel-machine-types-Wire-compat-into-q35-and-i440.patch
+++ b/SOURCES/0024-x86-rhel-machine-types-Wire-compat-into-q35-and-i440.patch
@ -0,0 +1,54 @@
 From 7bd99eebadfdbea6a76585b526e7cab1ee8b1fde Mon Sep 17 00:00:00 2001
 From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
 Date: Tue, 23 Nov 2021 18:07:49 +0000
 Subject: x86/rhel machine types: Wire compat into q35 and i440fx
 RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-MergeRequest: 77: 8.6/6.2 mt fixes
 RH-Commit: [23/23] fc3861aeccc943b434231193ef45ffbc0b3cf6c6
 RH-Bugzilla: 2026443
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 Wire the pc_rhel_8_5 compat data into both piix and q35
 to keep the existing machine types compatible.
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 hw/i386/pc_piix.c | 4 ++++
 hw/i386/pc_q35.c  | 4 ++++
 2 files changed, 8 insertions(+)
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
 index 2885edffe9..37fab00733 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
@@ -1040,6 +1040,10 @@ static void pc_machine_rhel760_options(MachineClass *m)
     pcmc->kvmclock_create_always = false;
     /* From pc_i440fx_5_1_machine_options() */
     pcmc->pci_root_uid = 1;
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_5,
 +                     hw_compat_rhel_8_5_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_5_compat,
 +                     pc_rhel_8_5_compat_len);
     compat_props_add(m->compat_props, hw_compat_rhel_8_4,
                      hw_compat_rhel_8_4_len);
     compat_props_add(m->compat_props, pc_rhel_8_4_compat,
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
 index c67418b6a9..78876e1101 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
@@ -658,6 +658,10 @@ static void pc_q35_machine_rhel850_options(MachineClass *m)
     m->desc = "RHEL-8.5.0 PC (Q35 + ICH9, 2009)";
     pcmc->smbios_stream_product = "RHEL-AV";
     pcmc->smbios_stream_version = "8.5.0";
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_5,
 +                     hw_compat_rhel_8_5_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_5_compat,
 +                     pc_rhel_8_5_compat_len);
 }
 DEFINE_PC_MACHINE(q35_rhel850, "pc-q35-rhel8.5.0", pc_q35_init_rhel850,
 -- 
 2.27.0
--- a/SOURCES/0025-redhat-Add-s390x-machine-type-compatibility-handling.patch
+++ b/SOURCES/0025-redhat-Add-s390x-machine-type-compatibility-handling.patch
@ -0,0 +1,58 @@
 From 265a57f2955b7f0b65e3f57f89aa1ff2541d3f73 Mon Sep 17 00:00:00 2001
 From: Thomas Huth <thuth@redhat.com>
 Date: Fri, 26 Nov 2021 09:37:11 +0100
 Subject: redhat: Add s390x machine type compatibility handling for the rebase
 to v6.2
 RH-Author: Thomas Huth <thuth@redhat.com>
 RH-MergeRequest: 80: Add s390x machine type compatibility handling for the rebase to v6.2
 RH-Commit: [26/26] c45cf594604f6dd23954696b9c84d2025e328d11
 RH-Bugzilla: 2022602
 RH-Acked-by: David Hildenbrand <david@redhat.com>
 RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 Add compatibility handling for the rhel8.5.0 machine type (and
 recursively older, of course).
 Based on the following upstream commits:
 463e50da8b - s390x/cpumodel: Bump up QEMU model to a stripped-down IBM z14 GA2
 30e398f796 - s390x/cpumodel: Add more feature to gen16 default model
 4a0af2930a - machine: Prefer cores over sockets in smp parsing since 6.2
 2b52619994 - machine: Move smp_prefer_sockets to struct SMPCompatProps
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 ---
 hw/s390x/s390-virtio-ccw.c | 10 ++++++++++
 1 file changed, 10 insertions(+)
 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
 index 181856e6cf..cf13c457d6 100644
 --- a/hw/s390x/s390-virtio-ccw.c
 +++ b/hw/s390x/s390-virtio-ccw.c
@@ -1105,11 +1105,21 @@ DEFINE_CCW_MACHINE(2_4, "2.4", false);
 static void ccw_machine_rhel850_instance_options(MachineState *machine)
 {
 +    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V6_0 };
 +
 +    s390_set_qemu_cpu_model(0x2964, 13, 2, qemu_cpu_feat);
 +
 +    s390_cpudef_featoff_greater(16, 1, S390_FEAT_NNPA);
 +    s390_cpudef_featoff_greater(16, 1, S390_FEAT_VECTOR_PACKED_DECIMAL_ENH2);
 +    s390_cpudef_featoff_greater(16, 1, S390_FEAT_BEAR_ENH);
 +    s390_cpudef_featoff_greater(16, 1, S390_FEAT_RDP);
 +    s390_cpudef_featoff_greater(16, 1, S390_FEAT_PAI);
 }
 static void ccw_machine_rhel850_class_options(MachineClass *mc)
 {
     compat_props_add(mc->compat_props, hw_compat_rhel_8_5, hw_compat_rhel_8_5_len);
 +    mc->smp_props.prefer_sockets = true;
 }
 DEFINE_CCW_MACHINE(rhel850, "rhel8.5.0", true);
 -- 
 2.27.0
--- a/SOURCES/81-kvm-rhel.rules
+++ b/SOURCES/81-kvm-rhel.rules
@ -0,0 +1 @@
 DEVPATH=="*/kvm", ACTION=="change", RUN+="/lib/udev/udev-kvm-check $env{COUNT} $env{EVENT}"
--- a/SOURCES/85-kvm.preset
+++ b/SOURCES/85-kvm.preset
@ -0,0 +1,5 @@
 # Enable kvm-setup by default.  This can have odd side effects on
 # PowerNV systems that aren't intended as KVM hosts, but at present we
 # only support RHEL on PowerNV for the purpose of being a RHEV host.
 enable kvm-setup.service
--- a/SOURCES/README.tests
+++ b/SOURCES/README.tests
@ -28,7 +28,7 @@ avocado_qemu tests:
 The avocado_qemu tests can be executed by running the following avocado command:
 avocado run -p qemu_bin=/usr/libexec/qemu-kvm /usr/lib64/qemu-kvm/tests/acceptance/
 Avocado needs to be installed separately using either pip or from source as
-Avocado is not being packaged for RHEL.
+Avocado is not being packaged for RHEL-8.
 qemu-iotests:
 symlinks to corresponding binaries need to be created for QEMU_PROG,
@ -36,4 +36,4 @@ QEMU_IO_PROG, QEMU_IMG_PROG, and QEMU_NBD_PROG before the iotests can be
 executed.
 The primary purpose of this package is to make these tests available to be
-executed as gating tests for the qemu-kvm in the RHEL OSCI environment.
+executed as gating tests for the virt module in the RHEL-8 OSCI environment.
--- a/SOURCES/ksm.service
+++ b/SOURCES/ksm.service
@ -0,0 +1,13 @@
 [Unit]
 Description=Kernel Samepage Merging
 ConditionPathExists=/sys/kernel/mm/ksm
 [Service]
 Type=oneshot
 RemainAfterExit=yes
 EnvironmentFile=-/etc/sysconfig/ksm
 ExecStart=/usr/libexec/ksmctl start
 ExecStop=/usr/libexec/ksmctl stop
 [Install]
 WantedBy=multi-user.target
--- a/SOURCES/ksm.sysconfig
+++ b/SOURCES/ksm.sysconfig
@ -0,0 +1,4 @@
 # The maximum number of unswappable kernel pages
 # which may be allocated by ksm (0 for unlimited)
 # If unset, defaults to half of total memory
 # KSM_MAX_KERNEL_PAGES=
--- a/SOURCES/ksmctl.c
+++ b/SOURCES/ksmctl.c
@ -0,0 +1,77 @@
 /* Start/stop KSM, for systemd.
 * Copyright (C) 2009, 2011 Red Hat, Inc.
 * Written by Paolo Bonzini <pbonzini@redhat.com>.
 * Based on the original sysvinit script by Dan Kenigsberg <danken@redhat.com>
 * This file is distributed under the GNU General Public License, version 2
 * or later.  */
 #include <unistd.h>
 #include <stdio.h>
 #include <limits.h>
 #include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
 #define KSM_MAX_KERNEL_PAGES_FILE "/sys/kernel/mm/ksm/max_kernel_pages"
 #define KSM_RUN_FILE		  "/sys/kernel/mm/ksm/run"
 char *program_name;
 int usage(void)
 {
 	fprintf(stderr, "Usage: %s {start|stop}\n", program_name);
 	return 1;
 }
 int write_value(uint64_t value, char *filename)
 {
 	FILE *fp;
 	if (!(fp = fopen(filename, "w")) ||
 	    fprintf(fp, "%llu\n", (unsigned long long) value) == EOF ||
 	    fflush(fp) == EOF ||
 	    fclose(fp) == EOF)
 		return 1;
 	return 0;
 }
 uint64_t ksm_max_kernel_pages()
 {
 	char *var = getenv("KSM_MAX_KERNEL_PAGES");
 	char *endptr;
 	uint64_t value;
 	if (var && *var) {
 		value = strtoll(var, &endptr, 0);
 		if (value < LLONG_MAX && !*endptr)
 			return value;
 	}
 	/* Unless KSM_MAX_KERNEL_PAGES is set, let KSM munch up to half of
 	 * total memory.  */
 	return sysconf(_SC_PHYS_PAGES) / 2;
 }
 int start(void)
 {
 	if (access(KSM_MAX_KERNEL_PAGES_FILE, R_OK) >= 0)
 		write_value(ksm_max_kernel_pages(), KSM_MAX_KERNEL_PAGES_FILE);
 	return write_value(1, KSM_RUN_FILE);
 }
 int stop(void)
 {
 	return write_value(0, KSM_RUN_FILE);
 }
 int main(int argc, char **argv)
 {
 	program_name = argv[0];
 	if (argc < 2) {
 		return usage();
 	} else if (!strcmp(argv[1], "start")) {
 		return start();
 	} else if (!strcmp(argv[1], "stop")) {
 		return stop();
 	} else {
 		return usage();
 	}
 }
--- a/SOURCES/ksmtuned
+++ b/SOURCES/ksmtuned
@ -0,0 +1,139 @@
 #!/bin/bash
 #
 # Copyright 2009 Red Hat, Inc. and/or its affiliates.
 # Released under the GPL
 #
 # Author:      Dan Kenigsberg <danken@redhat.com>
 #
 # ksmtuned - a simple script that controls whether (and with what vigor) ksm
 # should search for duplicated pages.
 #
 # starts ksm when memory commited to qemu processes exceeds a threshold, and
 # make ksm work harder and harder untill memory load falls below that
 # threshold.
 #
 # send SIGUSR1 to this process right after a new qemu process is started, or
 # following its death, to retune ksm accordingly
 #
 # needs testing and ironing. contact danken@redhat.com if something breaks.
 if [ -f /etc/ksmtuned.conf ]; then
    . /etc/ksmtuned.conf
 fi
 debug() {
    if [ -n "$DEBUG" ]; then
        s="`/bin/date`: $*"
        [ -n "$LOGFILE" ] && echo "$s" >> "$LOGFILE" || echo "$s"
    fi
 }
 KSM_MONITOR_INTERVAL=${KSM_MONITOR_INTERVAL:-60}
 KSM_NPAGES_BOOST=${KSM_NPAGES_BOOST:-300}
 KSM_NPAGES_DECAY=${KSM_NPAGES_DECAY:--50}
 KSM_NPAGES_MIN=${KSM_NPAGES_MIN:-64}
 KSM_NPAGES_MAX=${KSM_NPAGES_MAX:-1250}
 # millisecond sleep between ksm scans for 16Gb server. Smaller servers sleep
 # more, bigger sleep less.
 KSM_SLEEP_MSEC=${KSM_SLEEP_MSEC:-10}
 KSM_THRES_COEF=${KSM_THRES_COEF:-20}
 KSM_THRES_CONST=${KSM_THRES_CONST:-2048}
 total=`awk '/^MemTotal:/ {print $2}' /proc/meminfo`
 debug total $total
 npages=0
 sleep=$[KSM_SLEEP_MSEC * 16 * 1024 * 1024 / total]
 [ $sleep -le 10 ] && sleep=10
 debug sleep $sleep
 thres=$[total * KSM_THRES_COEF / 100]
 if [ $KSM_THRES_CONST -gt $thres ]; then
    thres=$KSM_THRES_CONST
 fi
 debug thres $thres
 KSMCTL () {
    case x$1 in
        xstop)
            echo 0 > /sys/kernel/mm/ksm/run
            ;;
        xstart)
            echo $2 > /sys/kernel/mm/ksm/pages_to_scan
            echo $3 > /sys/kernel/mm/ksm/sleep_millisecs
            echo 1 > /sys/kernel/mm/ksm/run
            ;;
    esac
 }
 committed_memory () {
    # calculate how much memory is committed to running qemu processes
    local pidlist
    pidlist=$(pgrep -d ' ' -- '^qemu(-(kvm|system-.+)|:.{1,11})$')
    if [ -n "$pidlist" ]; then
        ps -p "$pidlist" -o rsz=
    fi | awk '{ sum += $1 }; END { print 0+sum }'
 }
 free_memory () {
    awk '/^(MemFree|Buffers|Cached):/ {free += $2}; END {print free}' \
                /proc/meminfo
 }
 increase_npages() {
    local delta
    delta=${1:-0}
    npages=$[npages + delta]
    if [ $npages -lt $KSM_NPAGES_MIN ]; then
        npages=$KSM_NPAGES_MIN
    elif [ $npages -gt $KSM_NPAGES_MAX ]; then
        npages=$KSM_NPAGES_MAX
    fi
    echo $npages
 }
 adjust () {
    local free committed
    free=`free_memory`
    committed=`committed_memory`
    debug committed $committed free $free
    if [ $[committed + thres] -lt $total -a $free -gt $thres ]; then
        KSMCTL stop
        debug "$[committed + thres] < $total and free > $thres, stop ksm"
        return 1
    fi
    debug "$[committed + thres] > $total, start ksm"
    if [ $free -lt $thres ]; then
        npages=`increase_npages $KSM_NPAGES_BOOST`
        debug "$free < $thres, boost"
    else
        npages=`increase_npages $KSM_NPAGES_DECAY`
        debug "$free > $thres, decay"
    fi
    KSMCTL start $npages $sleep
    debug "KSMCTL start $npages $sleep"
    return 0
 }
 function nothing () {
    :
 }
 loop () {
    trap nothing SIGUSR1
    while true
    do
        sleep $KSM_MONITOR_INTERVAL &
        wait $!
        adjust
    done
 }
 PIDFILE=${PIDFILE-/var/run/ksmtune.pid}
 if touch "$PIDFILE"; then
  loop &
  echo $! > "$PIDFILE"
 fi
--- a/SOURCES/ksmtuned.conf
+++ b/SOURCES/ksmtuned.conf
@ -0,0 +1,21 @@
 # Configuration file for ksmtuned.
 # How long ksmtuned should sleep between tuning adjustments
 # KSM_MONITOR_INTERVAL=60
 # Millisecond sleep between ksm scans for 16Gb server.
 # Smaller servers sleep more, bigger sleep less.
 # KSM_SLEEP_MSEC=10
 # KSM_NPAGES_BOOST=300
 # KSM_NPAGES_DECAY=-50
 # KSM_NPAGES_MIN=64
 # KSM_NPAGES_MAX=1250
 # KSM_THRES_COEF=20
 # KSM_THRES_CONST=2048
 # uncomment the following if you want ksmtuned debug info
 # LOGFILE=/var/log/ksmtuned
 # DEBUG=1
--- a/SOURCES/ksmtuned.service
+++ b/SOURCES/ksmtuned.service
@ -0,0 +1,12 @@
 [Unit]
 Description=Kernel Samepage Merging (KSM) Tuning Daemon
 After=ksm.service
 Requires=ksm.service
 [Service]
 ExecStart=/usr/sbin/ksmtuned
 ExecReload=/bin/kill -USR1 $MAINPID
 Type=forking
 [Install]
 WantedBy=multi-user.target
--- a/SOURCES/kvm-Add-dirty-sync-missed-zero-copy-migration-stat.patch
+++ b/SOURCES/kvm-Add-dirty-sync-missed-zero-copy-migration-stat.patch
@ -0,0 +1,87 @@
 From cd49a32e9c9e33efc51652b68180a07683814b4d Mon Sep 17 00:00:00 2001
 From: Leonardo Bras <leobras@redhat.com>
 Date: Mon, 11 Jul 2022 18:11:12 -0300
 Subject: [PATCH 4/9] Add dirty-sync-missed-zero-copy migration stat
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Leonardo Brás <leobras@redhat.com>
 RH-MergeRequest: 201: Zero-copy-send fixes + improvements
 RH-Commit: [4/8] 56cce61cf95aafc8dafae7531b43c166084abfec
 RH-Bugzilla: 2110203
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 Acked-by: Markus Armbruster <armbru@redhat.com>
 Acked-by: Peter Xu <peterx@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 Message-Id: <20220711211112.18951-3-leobras@redhat.com>
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 (cherry picked from commit cf20c897338067ab4b70a4596fdccaf90c7e29a1)
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 ---
 migration/migration.c | 2 ++
 monitor/hmp-cmds.c    | 5 +++++
 qapi/migration.json   | 7 ++++++-
 3 files changed, 13 insertions(+), 1 deletion(-)
 diff --git a/migration/migration.c b/migration/migration.c
 index e100b30f00..952a26c5c2 100644
 --- a/migration/migration.c
 +++ b/migration/migration.c
@@ -1012,6 +1012,8 @@ static void populate_ram_info(MigrationInfo *info, MigrationState *s)
     info->ram->normal_bytes = ram_counters.normal * page_size;
     info->ram->mbps = s->mbps;
     info->ram->dirty_sync_count = ram_counters.dirty_sync_count;
 +    info->ram->dirty_sync_missed_zero_copy =
 +            ram_counters.dirty_sync_missed_zero_copy;
     info->ram->postcopy_requests = ram_counters.postcopy_requests;
     info->ram->page_size = page_size;
     info->ram->multifd_bytes = ram_counters.multifd_bytes;
 diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
 index 8c384dc1b2..f7216ab5d0 100644
 --- a/monitor/hmp-cmds.c
 +++ b/monitor/hmp-cmds.c
@@ -305,6 +305,11 @@ void hmp_info_migrate(Monitor *mon, const QDict *qdict)
             monitor_printf(mon, "postcopy ram: %" PRIu64 " kbytes\n",
                            info->ram->postcopy_bytes >> 10);
         }
 +        if (info->ram->dirty_sync_missed_zero_copy) {
 +            monitor_printf(mon,
 +                           "Zero-copy-send fallbacks happened: %" PRIu64 " times\n",
 +                           info->ram->dirty_sync_missed_zero_copy);
 +        }
     }
     if (info->has_disk) {
 diff --git a/qapi/migration.json b/qapi/migration.json
 index c8ec260ab0..94bc5c69db 100644
 --- a/qapi/migration.json
 +++ b/qapi/migration.json
@@ -55,6 +55,10 @@
 # @postcopy-bytes: The number of bytes sent during the post-copy phase
 #                  (since 7.0).
 #
 +# @dirty-sync-missed-zero-copy: Number of times dirty RAM synchronization could
 +#                               not avoid copying dirty pages. This is between
 +#                               0 and @dirty-sync-count * @multifd-channels.
 +#                               (since 7.1)
 # Since: 0.14
 ##
 { 'struct': 'MigrationStats',
@@ -65,7 +69,8 @@
            'postcopy-requests' : 'int', 'page-size' : 'int',
            'multifd-bytes' : 'uint64', 'pages-per-second' : 'uint64',
            'precopy-bytes' : 'uint64', 'downtime-bytes' : 'uint64',
 -           'postcopy-bytes' : 'uint64' } }
 +           'postcopy-bytes' : 'uint64',
 +           'dirty-sync-missed-zero-copy' : 'uint64' } }
 ##
 # @XBZRLECacheStats:
 -- 
 2.31.1
--- a/SOURCES/kvm-Enable-SGX-RH-Only.patch
+++ b/SOURCES/kvm-Enable-SGX-RH-Only.patch
@ -0,0 +1,28 @@
 From db6e042fe4fdc1a1bbf562a46b15d4d8e33e2fa6 Mon Sep 17 00:00:00 2001
 From: Paul Lai <plai@redhat.com>
 Date: Tue, 25 Jan 2022 15:16:22 -0500
 Subject: [PATCH 4/7] Enable SGX  -- RH Only
 RH-Author: Paul Lai <None>
 RH-MergeRequest: 111: numa: Enable numa for SGX EPC sections
 RH-Commit: [4/5] cea874f29984897ef1232fb7749c13203c888034
 RH-Bugzilla: 1518984
 RH-Acked-by: Paolo Bonzini <None>
 RH-Acked-by: Bandan Das <None>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 ---
 configs/devices/x86_64-softmmu/x86_64-rh-devices.mak | 1 +
 1 file changed, 1 insertion(+)
 diff --git a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 index ddf036f042..fdbbdf9742 100644
 --- a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 +++ b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
@@ -102,3 +102,4 @@ CONFIG_TPM_CRB=y
 CONFIG_TPM_TIS_ISA=y
 CONFIG_TPM_EMULATOR=y
 CONFIG_TPM_PASSTHROUGH=y
 +CONFIG_SGX=y
 -- 
 2.27.0
--- a/SOURCES/kvm-Fix-thread-pool-size-default-value-in-the-man-page.patch
+++ b/SOURCES/kvm-Fix-thread-pool-size-default-value-in-the-man-page.patch
@ -0,0 +1,36 @@
 From a707eff49800045d07afbcd8a74617c50b960151 Mon Sep 17 00:00:00 2001
 From: German Maglione <gmaglione@redhat.com>
 Date: Thu, 10 Oct 2024 13:23:25 +0200
 Subject: [PATCH] Fix thread-pool-size default value in the man page
 RH-Author: German Maglione <None>
 RH-MergeRequest: 417: Fix thread-pool-size default value in the man page
 RH-Jira: RHEL-26197
 RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
 RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
 RH-Commit: [1/1] bdf22ed4600ac7f02a4b08c54f162b1f89c44a99
 The current --thread-pool-size default value is 0, let's reflect it
 in the man page.
 Signed-off-by: German Maglione <gmaglione@redhat.com>
 ---
 docs/tools/virtiofsd.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/docs/tools/virtiofsd.rst b/docs/tools/virtiofsd.rst
 index 07ac0be551..fb3d59c449 100644
 --- a/docs/tools/virtiofsd.rst
 +++ b/docs/tools/virtiofsd.rst
@@ -120,7 +120,7 @@ Options
 .. option:: --thread-pool-size=NUM
   Restrict the number of worker threads per request queue to NUM.  The default
 -  is 64.
 +  is 0.
 .. option:: --cache=none|auto|always
 -- 
 2.45.2
--- a/SOURCES/kvm-HostMem-Add-mechanism-to-opt-in-kvm-guest-memfd-via-.patch
+++ b/SOURCES/kvm-HostMem-Add-mechanism-to-opt-in-kvm-guest-memfd-via-.patch
@ -1,139 +0,0 @@
 From 93ea86ac8849ad9ca365b1646313dde9a34ba59c Mon Sep 17 00:00:00 2001
 From: Xiaoyao Li <xiaoyao.li@intel.com>
 Date: Wed, 20 Mar 2024 03:39:03 -0500
 Subject: [PATCH 031/100] HostMem: Add mechanism to opt in kvm guest memfd via
 MachineState
 RH-Author: Paolo Bonzini <pbonzini@redhat.com>
 RH-MergeRequest: 245: SEV-SNP support
 RH-Jira: RHEL-39544
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Bandan Das <bdas@redhat.com>
 RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
 RH-Commit: [31/91] 43ce32aef954479cdb736301d1adcb919602c321 (bonzini/rhel-qemu-kvm)
 Add a new member "guest_memfd" to memory backends. When it's set
 to true, it enables RAM_GUEST_MEMFD in ram_flags, thus private kvm
 guest_memfd will be allocated during RAMBlock allocation.
 Memory backend's @guest_memfd is wired with @require_guest_memfd
 field of MachineState. It avoid looking up the machine in phymem.c.
 MachineState::require_guest_memfd is supposed to be set by any VMs
 that requires KVM guest memfd as private memory, e.g., TDX VM.
 Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
 Reviewed-by: David Hildenbrand <david@redhat.com>
 Message-ID: <20240320083945.991426-8-michael.roth@amd.com>
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 (cherry picked from commit 37662d85b0b7dded0ebdf6747bef6c3bb7ed6a0c)
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 ---
 backends/hostmem-file.c  | 1 +
 backends/hostmem-memfd.c | 1 +
 backends/hostmem-ram.c   | 1 +
 backends/hostmem.c       | 1 +
 hw/core/machine.c        | 5 +++++
 include/hw/boards.h      | 2 ++
 include/sysemu/hostmem.h | 1 +
 7 files changed, 12 insertions(+)
 diff --git a/backends/hostmem-file.c b/backends/hostmem-file.c
 index ac3e433cbd..3c69db7946 100644
 --- a/backends/hostmem-file.c
 +++ b/backends/hostmem-file.c
@@ -85,6 +85,7 @@ file_backend_memory_alloc(HostMemoryBackend *backend, Error **errp)
     ram_flags |= fb->readonly ? RAM_READONLY_FD : 0;
     ram_flags |= fb->rom == ON_OFF_AUTO_ON ? RAM_READONLY : 0;
     ram_flags |= backend->reserve ? 0 : RAM_NORESERVE;
 +    ram_flags |= backend->guest_memfd ? RAM_GUEST_MEMFD : 0;
     ram_flags |= fb->is_pmem ? RAM_PMEM : 0;
     ram_flags |= RAM_NAMED_FILE;
     return memory_region_init_ram_from_file(&backend->mr, OBJECT(backend), name,
 diff --git a/backends/hostmem-memfd.c b/backends/hostmem-memfd.c
 index 3923ea9364..745ead0034 100644
 --- a/backends/hostmem-memfd.c
 +++ b/backends/hostmem-memfd.c
@@ -55,6 +55,7 @@ memfd_backend_memory_alloc(HostMemoryBackend *backend, Error **errp)
     name = host_memory_backend_get_name(backend);
     ram_flags = backend->share ? RAM_SHARED : 0;
     ram_flags |= backend->reserve ? 0 : RAM_NORESERVE;
 +    ram_flags |= backend->guest_memfd ? RAM_GUEST_MEMFD : 0;
     return memory_region_init_ram_from_fd(&backend->mr, OBJECT(backend), name,
                                           backend->size, ram_flags, fd, 0, errp);
 }
 diff --git a/backends/hostmem-ram.c b/backends/hostmem-ram.c
 index d121249f0f..f7d81af783 100644
 --- a/backends/hostmem-ram.c
 +++ b/backends/hostmem-ram.c
@@ -30,6 +30,7 @@ ram_backend_memory_alloc(HostMemoryBackend *backend, Error **errp)
     name = host_memory_backend_get_name(backend);
     ram_flags = backend->share ? RAM_SHARED : 0;
     ram_flags |= backend->reserve ? 0 : RAM_NORESERVE;
 +    ram_flags |= backend->guest_memfd ? RAM_GUEST_MEMFD : 0;
     return memory_region_init_ram_flags_nomigrate(&backend->mr, OBJECT(backend),
                                                   name, backend->size,
                                                   ram_flags, errp);
 diff --git a/backends/hostmem.c b/backends/hostmem.c
 index 81a72ce40b..eb9682b4a8 100644
 --- a/backends/hostmem.c
 +++ b/backends/hostmem.c
@@ -277,6 +277,7 @@ static void host_memory_backend_init(Object *obj)
     /* TODO: convert access to globals to compat properties */
     backend->merge = machine_mem_merge(machine);
     backend->dump = machine_dump_guest_core(machine);
 +    backend->guest_memfd = machine_require_guest_memfd(machine);
     backend->reserve = true;
     backend->prealloc_threads = machine->smp.cpus;
 }
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index 92609aae27..07b994e136 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -1480,6 +1480,11 @@ bool machine_mem_merge(MachineState *machine)
     return machine->mem_merge;
 }
 +bool machine_require_guest_memfd(MachineState *machine)
 +{
 +    return machine->require_guest_memfd;
 +}
 +
 static char *cpu_slot_to_string(const CPUArchId *cpu)
 {
     GString *s = g_string_new(NULL);
 diff --git a/include/hw/boards.h b/include/hw/boards.h
 index cca62f906b..815a1c4b26 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
@@ -36,6 +36,7 @@ bool machine_usb(MachineState *machine);
 int machine_phandle_start(MachineState *machine);
 bool machine_dump_guest_core(MachineState *machine);
 bool machine_mem_merge(MachineState *machine);
 +bool machine_require_guest_memfd(MachineState *machine);
 HotpluggableCPUList *machine_query_hotpluggable_cpus(MachineState *machine);
 void machine_set_cpu_numa_node(MachineState *machine,
                                const CpuInstanceProperties *props,
@@ -372,6 +373,7 @@ struct MachineState {
     char *dt_compatible;
     bool dump_guest_core;
     bool mem_merge;
 +    bool require_guest_memfd;
     bool usb;
     bool usb_disabled;
     char *firmware;
 diff --git a/include/sysemu/hostmem.h b/include/sysemu/hostmem.h
 index 0e411aaa29..04b884bf42 100644
 --- a/include/sysemu/hostmem.h
 +++ b/include/sysemu/hostmem.h
@@ -74,6 +74,7 @@ struct HostMemoryBackend {
     uint64_t size;
     bool merge, dump, use_canonical_path;
     bool prealloc, is_mapped, share, reserve;
 +    bool guest_memfd;
     uint32_t prealloc_threads;
     ThreadContext *prealloc_context;
     DECLARE_BITMAP(host_nodes, MAX_NODES + 1);
 -- 
 2.39.3
--- a/SOURCES/kvm-KVM-keep-track-of-running-ioctls.patch
+++ b/SOURCES/kvm-KVM-keep-track-of-running-ioctls.patch
@ -0,0 +1,82 @@
 From 9bacf8c4104ff3cff2e0e2c2179ec4fda633167f Mon Sep 17 00:00:00 2001
 From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date: Mon, 16 Jan 2023 07:51:08 -0500
 Subject: [PATCH 05/11] KVM: keep track of running ioctls
 RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-MergeRequest: 247: accel: introduce accelerator blocker API
 RH-Bugzilla: 2161188
 RH-Acked-by: David Hildenbrand <david@redhat.com>
 RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [2/3] 357508389e2a0fd996206b406e9e235e50b5f0b6
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2161188
 commit a27dd2de68f37ba96fe164a42121daa5f0750afc
 Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date:   Fri Nov 11 10:47:57 2022 -0500
    KVM: keep track of running ioctls
    Using the new accel-blocker API, mark where ioctls are being called
    in KVM. Next, we will implement the critical section that will take
    care of performing memslots modifications atomically, therefore
    preventing any new ioctl from running and allowing the running ones
    to finish.
    Signed-off-by: David Hildenbrand <david@redhat.com>
    Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
    Message-Id: <20221111154758.1372674-3-eesposit@redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 ---
 accel/kvm/kvm-all.c | 7 +++++++
 1 file changed, 7 insertions(+)
 diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
 index 8f2a53438f..221aadfda7 100644
 --- a/accel/kvm/kvm-all.c
 +++ b/accel/kvm/kvm-all.c
@@ -2337,6 +2337,7 @@ static int kvm_init(MachineState *ms)
     assert(TARGET_PAGE_SIZE <= qemu_real_host_page_size);
     s->sigmask_len = 8;
 +    accel_blocker_init();
 #ifdef KVM_CAP_SET_GUEST_DEBUG
     QTAILQ_INIT(&s->kvm_sw_breakpoints);
@@ -3018,7 +3019,9 @@ int kvm_vm_ioctl(KVMState *s, int type, ...)
     va_end(ap);
     trace_kvm_vm_ioctl(type, arg);
 +    accel_ioctl_begin();
     ret = ioctl(s->vmfd, type, arg);
 +    accel_ioctl_end();
     if (ret == -1) {
         ret = -errno;
     }
@@ -3036,7 +3039,9 @@ int kvm_vcpu_ioctl(CPUState *cpu, int type, ...)
     va_end(ap);
     trace_kvm_vcpu_ioctl(cpu->cpu_index, type, arg);
 +    accel_cpu_ioctl_begin(cpu);
     ret = ioctl(cpu->kvm_fd, type, arg);
 +    accel_cpu_ioctl_end(cpu);
     if (ret == -1) {
         ret = -errno;
     }
@@ -3054,7 +3059,9 @@ int kvm_device_ioctl(int fd, int type, ...)
     va_end(ap);
     trace_kvm_device_ioctl(fd, type, arg);
 +    accel_ioctl_begin();
     ret = ioctl(fd, type, arg);
 +    accel_ioctl_end();
     if (ret == -1) {
         ret = -errno;
     }
 -- 
 2.37.3
--- a/SOURCES/kvm-KVM-remove-kvm_arch_cpu_check_are_resettable.patch
+++ b/SOURCES/kvm-KVM-remove-kvm_arch_cpu_check_are_resettable.patch
@ -1,203 +0,0 @@
 From c46ac3db0a4db60e667edeabc9ed451c6e8e0ccf Mon Sep 17 00:00:00 2001
 From: Paolo Bonzini <pbonzini@redhat.com>
 Date: Mon, 18 Mar 2024 14:41:33 -0400
 Subject: [PATCH 020/100] KVM: remove kvm_arch_cpu_check_are_resettable
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Paolo Bonzini <pbonzini@redhat.com>
 RH-MergeRequest: 245: SEV-SNP support
 RH-Jira: RHEL-39544
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Bandan Das <bdas@redhat.com>
 RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
 RH-Commit: [20/91] d7745bd1a0ed1b215847f150f4a1bb2e912beabc (bonzini/rhel-qemu-kvm)
 Board reset requires writing a fresh CPU state.  As far as KVM is
 concerned, the only thing that blocks reset is that CPU state is
 encrypted; therefore, kvm_cpus_are_resettable() can simply check
 if that is the case.
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 (cherry picked from commit a99c0c66ebe7d8db3af6f16689ade9375247e43e)
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 ---
 accel/kvm/kvm-accel-ops.c  |  2 +-
 accel/kvm/kvm-all.c        |  5 -----
 include/sysemu/kvm.h       | 10 ----------
 target/arm/kvm.c           |  5 -----
 target/i386/kvm/kvm.c      |  5 -----
 target/loongarch/kvm/kvm.c |  5 -----
 target/mips/kvm.c          |  5 -----
 target/ppc/kvm.c           |  5 -----
 target/riscv/kvm/kvm-cpu.c |  5 -----
 target/s390x/kvm/kvm.c     |  5 -----
 10 files changed, 1 insertion(+), 51 deletions(-)
 diff --git a/accel/kvm/kvm-accel-ops.c b/accel/kvm/kvm-accel-ops.c
 index b3c946dc4b..74e3c5785b 100644
 --- a/accel/kvm/kvm-accel-ops.c
 +++ b/accel/kvm/kvm-accel-ops.c
@@ -82,7 +82,7 @@ static bool kvm_vcpu_thread_is_idle(CPUState *cpu)
 static bool kvm_cpus_are_resettable(void)
 {
 -    return !kvm_enabled() || kvm_cpu_check_are_resettable();
 +    return !kvm_enabled() || !kvm_state->guest_state_protected;
 }
 #ifdef KVM_CAP_SET_GUEST_DEBUG
 diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
 index ec0f6df7c5..b51e09a583 100644
 --- a/accel/kvm/kvm-all.c
 +++ b/accel/kvm/kvm-all.c
@@ -2696,11 +2696,6 @@ void kvm_flush_coalesced_mmio_buffer(void)
     s->coalesced_flush_in_progress = false;
 }
 -bool kvm_cpu_check_are_resettable(void)
 -{
 -    return kvm_arch_cpu_check_are_resettable();
 -}
 -
 static void do_kvm_cpu_synchronize_state(CPUState *cpu, run_on_cpu_data arg)
 {
     if (!cpu->vcpu_dirty && !kvm_state->guest_state_protected) {
 diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
 index 302e8f6f1e..54f4d83a37 100644
 --- a/include/sysemu/kvm.h
 +++ b/include/sysemu/kvm.h
@@ -525,16 +525,6 @@ int kvm_get_one_reg(CPUState *cs, uint64_t id, void *target);
 /* Notify resamplefd for EOI of specific interrupts. */
 void kvm_resample_fd_notify(int gsi);
 -/**
 - * kvm_cpu_check_are_resettable - return whether CPUs can be reset
 - *
 - * Returns: true: CPUs are resettable
 - *          false: CPUs are not resettable
 - */
 -bool kvm_cpu_check_are_resettable(void);
 -
 -bool kvm_arch_cpu_check_are_resettable(void);
 -
 bool kvm_dirty_ring_enabled(void);
 uint32_t kvm_dirty_ring_size(void);
 diff --git a/target/arm/kvm.c b/target/arm/kvm.c
 index ab85d628a8..21ebbf3b8f 100644
 --- a/target/arm/kvm.c
 +++ b/target/arm/kvm.c
@@ -1598,11 +1598,6 @@ int kvm_arch_msi_data_to_gsi(uint32_t data)
     return (data - 32) & 0xffff;
 }
 -bool kvm_arch_cpu_check_are_resettable(void)
 -{
 -    return true;
 -}
 -
 static void kvm_arch_get_eager_split_size(Object *obj, Visitor *v,
                                           const char *name, void *opaque,
                                           Error **errp)
 diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
 index e271652620..a12207a8ee 100644
 --- a/target/i386/kvm/kvm.c
 +++ b/target/i386/kvm/kvm.c
@@ -5623,11 +5623,6 @@ bool kvm_has_waitpkg(void)
     return has_msr_umwait;
 }
 -bool kvm_arch_cpu_check_are_resettable(void)
 -{
 -    return !sev_es_enabled();
 -}
 -
 #define ARCH_REQ_XCOMP_GUEST_PERM       0x1025
 void kvm_request_xsave_components(X86CPU *cpu, uint64_t mask)
 diff --git a/target/loongarch/kvm/kvm.c b/target/loongarch/kvm/kvm.c
 index d630cc39cb..8224d94333 100644
 --- a/target/loongarch/kvm/kvm.c
 +++ b/target/loongarch/kvm/kvm.c
@@ -733,11 +733,6 @@ bool kvm_arch_stop_on_emulation_error(CPUState *cs)
     return true;
 }
 -bool kvm_arch_cpu_check_are_resettable(void)
 -{
 -    return true;
 -}
 -
 int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
 {
     int ret = 0;
 diff --git a/target/mips/kvm.c b/target/mips/kvm.c
 index 6c52e59f55..a631ab544f 100644
 --- a/target/mips/kvm.c
 +++ b/target/mips/kvm.c
@@ -1273,11 +1273,6 @@ int kvm_arch_get_default_type(MachineState *machine)
     return -1;
 }
 -bool kvm_arch_cpu_check_are_resettable(void)
 -{
 -    return true;
 -}
 -
 void kvm_arch_accel_class_init(ObjectClass *oc)
 {
 }
 diff --git a/target/ppc/kvm.c b/target/ppc/kvm.c
 index 59f640cf7b..9d9d9f0d79 100644
 --- a/target/ppc/kvm.c
 +++ b/target/ppc/kvm.c
@@ -2968,11 +2968,6 @@ void kvmppc_set_reg_tb_offset(PowerPCCPU *cpu, int64_t tb_offset)
     }
 }
 -bool kvm_arch_cpu_check_are_resettable(void)
 -{
 -    return true;
 -}
 -
 void kvm_arch_accel_class_init(ObjectClass *oc)
 {
 }
 diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
 index 6a6c6cae80..49d2f3ad58 100644
 --- a/target/riscv/kvm/kvm-cpu.c
 +++ b/target/riscv/kvm/kvm-cpu.c
@@ -1475,11 +1475,6 @@ void kvm_riscv_set_irq(RISCVCPU *cpu, int irq, int level)
     }
 }
 -bool kvm_arch_cpu_check_are_resettable(void)
 -{
 -    return true;
 -}
 -
 static int aia_mode;
 static const char *kvm_aia_mode_str(uint64_t mode)
 diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c
 index 55fb4855b1..4db59658e1 100644
 --- a/target/s390x/kvm/kvm.c
 +++ b/target/s390x/kvm/kvm.c
@@ -2630,11 +2630,6 @@ void kvm_s390_stop_interrupt(S390CPU *cpu)
     kvm_s390_vcpu_interrupt(cpu, &irq);
 }
 -bool kvm_arch_cpu_check_are_resettable(void)
 -{
 -    return true;
 -}
 -
 int kvm_s390_get_zpci_op(void)
 {
     return cap_zpci_op;
 -- 
 2.39.3
--- a/SOURCES/kvm-KVM-track-whether-guest-state-is-encrypted.patch
+++ b/SOURCES/kvm-KVM-track-whether-guest-state-is-encrypted.patch
@ -1,127 +0,0 @@
 From 50399796da938c4ea7c69058fde84695bce9d794 Mon Sep 17 00:00:00 2001
 From: Paolo Bonzini <pbonzini@redhat.com>
 Date: Mon, 18 Mar 2024 14:41:10 -0400
 Subject: [PATCH 019/100] KVM: track whether guest state is encrypted
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Paolo Bonzini <pbonzini@redhat.com>
 RH-MergeRequest: 245: SEV-SNP support
 RH-Jira: RHEL-39544
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Bandan Das <bdas@redhat.com>
 RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
 RH-Commit: [19/91] 685b9c54d43d0043d15c33d13afc3a420cbe139b (bonzini/rhel-qemu-kvm)
 So far, KVM has allowed KVM_GET/SET_* ioctls to execute even if the
 guest state is encrypted, in which case they do nothing.  For the new
 API using VM types, instead, the ioctls will fail which is a safer and
 more robust approach.
 The new API will be the only one available for SEV-SNP and TDX, but it
 is also usable for SEV and SEV-ES.  In preparation for that, require
 architecture-specific KVM code to communicate the point at which guest
 state is protected (which must be after kvm_cpu_synchronize_post_init(),
 though that might change in the future in order to suppor migration).
 From that point, skip reading registers so that cpu->vcpu_dirty is
 never true: if it ever becomes true, kvm_arch_put_registers() will
 fail miserably.
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 (cherry picked from commit 5c3131c392f84c660033d511ec39872d8beb4b1e)
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 ---
 accel/kvm/kvm-all.c      | 17 ++++++++++++++---
 include/sysemu/kvm.h     |  2 ++
 include/sysemu/kvm_int.h |  1 +
 target/i386/sev.c        |  1 +
 4 files changed, 18 insertions(+), 3 deletions(-)
 diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
 index 931f74256e..ec0f6df7c5 100644
 --- a/accel/kvm/kvm-all.c
 +++ b/accel/kvm/kvm-all.c
@@ -2703,7 +2703,7 @@ bool kvm_cpu_check_are_resettable(void)
 static void do_kvm_cpu_synchronize_state(CPUState *cpu, run_on_cpu_data arg)
 {
 -    if (!cpu->vcpu_dirty) {
 +    if (!cpu->vcpu_dirty && !kvm_state->guest_state_protected) {
         int ret = kvm_arch_get_registers(cpu);
         if (ret) {
             error_report("Failed to get registers: %s", strerror(-ret));
@@ -2717,7 +2717,7 @@ static void do_kvm_cpu_synchronize_state(CPUState *cpu, run_on_cpu_data arg)
 void kvm_cpu_synchronize_state(CPUState *cpu)
 {
 -    if (!cpu->vcpu_dirty) {
 +    if (!cpu->vcpu_dirty && !kvm_state->guest_state_protected) {
         run_on_cpu(cpu, do_kvm_cpu_synchronize_state, RUN_ON_CPU_NULL);
     }
 }
@@ -2752,7 +2752,13 @@ static void do_kvm_cpu_synchronize_post_init(CPUState *cpu, run_on_cpu_data arg)
 void kvm_cpu_synchronize_post_init(CPUState *cpu)
 {
 -    run_on_cpu(cpu, do_kvm_cpu_synchronize_post_init, RUN_ON_CPU_NULL);
 +    if (!kvm_state->guest_state_protected) {
 +        /*
 +         * This runs before the machine_init_done notifiers, and is the last
 +         * opportunity to synchronize the state of confidential guests.
 +         */
 +        run_on_cpu(cpu, do_kvm_cpu_synchronize_post_init, RUN_ON_CPU_NULL);
 +    }
 }
 static void do_kvm_cpu_synchronize_pre_loadvm(CPUState *cpu, run_on_cpu_data arg)
@@ -4099,3 +4105,8 @@ void query_stats_schemas_cb(StatsSchemaList **result, Error **errp)
         query_stats_schema_vcpu(first_cpu, &stats_args);
     }
 }
 +
 +void kvm_mark_guest_state_protected(void)
 +{
 +    kvm_state->guest_state_protected = true;
 +}
 diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
 index fad9a7e8ff..302e8f6f1e 100644
 --- a/include/sysemu/kvm.h
 +++ b/include/sysemu/kvm.h
@@ -539,6 +539,8 @@ bool kvm_dirty_ring_enabled(void);
 uint32_t kvm_dirty_ring_size(void);
 +void kvm_mark_guest_state_protected(void);
 +
 /**
  * kvm_hwpoisoned_mem - indicate if there is any hwpoisoned page
  * reported for the VM.
 diff --git a/include/sysemu/kvm_int.h b/include/sysemu/kvm_int.h
 index 882e37e12c..3496be7997 100644
 --- a/include/sysemu/kvm_int.h
 +++ b/include/sysemu/kvm_int.h
@@ -87,6 +87,7 @@ struct KVMState
     bool kernel_irqchip_required;
     OnOffAuto kernel_irqchip_split;
     bool sync_mmu;
 +    bool guest_state_protected;
     uint64_t manual_dirty_log_protect;
     /* The man page (and posix) say ioctl numbers are signed int, but
      * they're not.  Linux, glibc and *BSD all treat ioctl numbers as
 diff --git a/target/i386/sev.c b/target/i386/sev.c
 index b8f79d34d1..c49a8fd55e 100644
 --- a/target/i386/sev.c
 +++ b/target/i386/sev.c
@@ -755,6 +755,7 @@ sev_launch_get_measure(Notifier *notifier, void *unused)
         if (ret) {
             exit(1);
         }
 +        kvm_mark_guest_state_protected();
     }
     /* query the measurement blob length */
 -- 
 2.39.3
--- a/SOURCES/kvm-KVM-x86-workaround-invalid-CPUID-0xD-9-info-on-some-.patch
+++ b/SOURCES/kvm-KVM-x86-workaround-invalid-CPUID-0xD-9-info-on-some-.patch
@ -0,0 +1,109 @@
 From ea5299b5dde7d0b6b2f93cb646e6a24c9f105466 Mon Sep 17 00:00:00 2001
 From: Paolo Bonzini <pbonzini@redhat.com>
 Date: Wed, 23 Mar 2022 12:33:25 +0100
 Subject: [PATCH 13/24] KVM: x86: workaround invalid CPUID[0xD,9] info on some
 AMD processors
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Paul Lai <plai@redhat.com>
 RH-MergeRequest: 176: Enable KVM AMX support
 RH-Commit: [13/13] 38f147c911258e84e01336271ebd23a1c24371fc
 RH-Bugzilla: 1916415
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
 Some AMD processors expose the PKRU extended save state even if they do not have
 the related PKU feature in CPUID.  Worse, when they do they report a size of
 64, whereas the expected size of the PKRU extended save state is 8, therefore
 the esa->size == eax assertion does not hold.
 The state is already ignored by KVM_GET_SUPPORTED_CPUID because it
 was not enabled in the host XCR0.  However, QEMU kvm_cpu_xsave_init()
 runs before QEMU invokes arch_prctl() to enable dynamically-enabled
 save states such as XTILEDATA, and KVM_GET_SUPPORTED_CPUID hides save
 states that have yet to be enabled.  Therefore, kvm_cpu_xsave_init()
 needs to consult the host CPUID instead of KVM_GET_SUPPORTED_CPUID,
 and dies with an assertion failure.
 When setting up the ExtSaveArea array to match the host, ignore features that
 KVM does not report as supported.  This will cause QEMU to skip the incorrect
 CPUID leaf instead of tripping the assertion.
 Closes: https://gitlab.com/qemu-project/qemu/-/issues/916
 Reported-by: Daniel P. Berrangé <berrange@redhat.com>
 Analyzed-by: Yang Zhong <yang.zhong@intel.com>
 Reported-by: Peter Krempa <pkrempa@redhat.com>
 Tested-by: Daniel P. Berrangé <berrange@redhat.com>
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 (cherry picked from commit 58f7db26f21c690cf9a669c314cfd7371506084a)
 Signed-off-by: Paul Lai <plai@redhat.com>
 ---
 target/i386/cpu.c         |  4 ++--
 target/i386/cpu.h         |  2 ++
 target/i386/kvm/kvm-cpu.c | 19 ++++++++++++-------
 3 files changed, 16 insertions(+), 9 deletions(-)
 diff --git a/target/i386/cpu.c b/target/i386/cpu.c
 index 09e08f7f38..0543b846ff 100644
 --- a/target/i386/cpu.c
 +++ b/target/i386/cpu.c
@@ -4980,8 +4980,8 @@ CpuDefinitionInfoList *qmp_query_cpu_definitions(Error **errp)
     return cpu_list;
 }
 -static uint64_t x86_cpu_get_supported_feature_word(FeatureWord w,
 -                                                   bool migratable_only)
 +uint64_t x86_cpu_get_supported_feature_word(FeatureWord w,
 +                                            bool migratable_only)
 {
     FeatureWordInfo *wi = &feature_word_info[w];
     uint64_t r = 0;
 diff --git a/target/i386/cpu.h b/target/i386/cpu.h
 index 8ab2a4042a..006b735fe4 100644
 --- a/target/i386/cpu.h
 +++ b/target/i386/cpu.h
@@ -604,6 +604,8 @@ typedef enum FeatureWord {
 } FeatureWord;
 typedef uint64_t FeatureWordArray[FEATURE_WORDS];
 +uint64_t x86_cpu_get_supported_feature_word(FeatureWord w,
 +                                            bool migratable_only);
 /* cpuid_features bits */
 #define CPUID_FP87 (1U << 0)
 diff --git a/target/i386/kvm/kvm-cpu.c b/target/i386/kvm/kvm-cpu.c
 index bdc967c484..74c1396a93 100644
 --- a/target/i386/kvm/kvm-cpu.c
 +++ b/target/i386/kvm/kvm-cpu.c
@@ -99,13 +99,18 @@ static void kvm_cpu_xsave_init(void)
     for (i = XSTATE_SSE_BIT + 1; i < XSAVE_STATE_AREA_COUNT; i++) {
         ExtSaveArea *esa = &x86_ext_save_areas[i];
 -        if (esa->size) {
 -            host_cpuid(0xd, i, &eax, &ebx, &ecx, &edx);
 -            if (eax != 0) {
 -                assert(esa->size == eax);
 -                esa->offset = ebx;
 -                esa->ecx = ecx;
 -            }
 +        if (!esa->size) {
 +            continue;
 +        }
 +        if ((x86_cpu_get_supported_feature_word(esa->feature, false) & esa->bits)
 +            != esa->bits) {
 +            continue;
 +        }
 +        host_cpuid(0xd, i, &eax, &ebx, &ecx, &edx);
 +        if (eax != 0) {
 +            assert(esa->size == eax);
 +            esa->offset = ebx;
 +            esa->ecx = ecx;
         }
     }
 }
 -- 
 2.35.3
--- a/SOURCES/kvm-MAINTAINERS-split-out-s390x-sections.patch
+++ b/SOURCES/kvm-MAINTAINERS-split-out-s390x-sections.patch
@ -0,0 +1,181 @@
 From 440ee491240f2f02f9a6082d8aad98d88c1039dd Mon Sep 17 00:00:00 2001
 From: Thomas Huth <thuth@redhat.com>
 Date: Mon, 15 Jan 2024 14:00:04 +0100
 Subject: [PATCH 1/5] MAINTAINERS: split out s390x sections
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Thomas Huth <thuth@redhat.com>
 RH-MergeRequest: 348: s390x: Provide some more useful information if decryption of a PV image fails
 RH-Jira: RHEL-18214
 RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
 RH-Acked-by: Cédric Le Goater <clg@redhat.com>
 RH-Commit: [1/5] a71a3c11922481f97c36570e361088d17474e481
 JIRA: https://issues.redhat.com/browse/RHEL-18214
 commit 56e34834029c7c6862cb0095d95ad83c50485f88
 Author: Cornelia Huck <cohuck@redhat.com>
 Date:   Wed Dec 22 11:55:48 2021 +0100
    MAINTAINERS: split out s390x sections
    Split out some more specialized devices etc., so that we can build
    smarter lists of people to be put on cc: in the future.
    Signed-off-by: Cornelia Huck <cohuck@redhat.com>
    Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
    Acked-by: David Hildenbrand <david@redhat.com>
    Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
    Acked-by: Thomas Huth <thuth@redhat.com>
    Acked-by: Halil Pasic <pasic@linux.ibm.com>
    Acked-by: Eric Farman <farman@linux.ibm.com>
    Message-Id: <20211222105548.356852-1-cohuck@redhat.com>
    Signed-off-by: Thomas Huth <thuth@redhat.com>
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 ---
 MAINTAINERS | 85 ++++++++++++++++++++++++++++++++++++++++++++++-------
 1 file changed, 74 insertions(+), 11 deletions(-)
 diff --git a/MAINTAINERS b/MAINTAINERS
 index 7543eb4d59..b893206fc3 100644
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
@@ -297,7 +297,6 @@ M: David Hildenbrand <david@redhat.com>
 S: Maintained
 F: target/s390x/
 F: target/s390x/tcg
 -F: target/s390x/cpu_models_*.[ch]
 F: hw/s390x/
 F: disas/s390.c
 F: tests/tcg/s390x/
@@ -396,16 +395,10 @@ M: Halil Pasic <pasic@linux.ibm.com>
 M: Christian Borntraeger <borntraeger@de.ibm.com>
 S: Supported
 F: target/s390x/kvm/
 -F: target/s390x/ioinst.[ch]
 F: target/s390x/machine.c
 F: target/s390x/sigp.c
 -F: target/s390x/cpu_features*.[ch]
 -F: target/s390x/cpu_models.[ch]
 F: hw/s390x/pv.c
 F: include/hw/s390x/pv.h
 -F: hw/intc/s390_flic.c
 -F: hw/intc/s390_flic_kvm.c
 -F: include/hw/s390x/s390_flic.h
 F: gdb-xml/s390*.xml
 T: git https://github.com/borntraeger/qemu.git s390-next
 L: qemu-s390x@nongnu.org
@@ -1529,12 +1522,8 @@ S390 Virtio-ccw
 M: Halil Pasic <pasic@linux.ibm.com>
 M: Christian Borntraeger <borntraeger@de.ibm.com>
 S: Supported
 -F: hw/char/sclp*.[hc]
 -F: hw/char/terminal3270.c
 F: hw/s390x/
 F: include/hw/s390x/
 -F: hw/watchdog/wdt_diag288.c
 -F: include/hw/watchdog/wdt_diag288.h
 F: configs/devices/s390x-softmmu/default.mak
 F: tests/avocado/machine_s390_ccw_virtio.py
 T: git https://github.com/borntraeger/qemu.git s390-next
@@ -1559,6 +1548,37 @@ F: hw/s390x/s390-pci*
 F: include/hw/s390x/s390-pci*
 L: qemu-s390x@nongnu.org
 +S390 channel subsystem
 +M: Halil Pasic <pasic@linux.ibm.com>
 +M: Christian Borntraeger <borntraeger@linux.ibm.com>
 +S: Supported
 +F: hw/s390x/ccw-device.[ch]
 +F: hw/s390x/css.c
 +F: hw/s390x/css-bridge.c
 +F: include/hw/s390x/css.h
 +F: include/hw/s390x/css-bridge.h
 +F: include/hw/s390x/ioinst.h
 +F: target/s390x/ioinst.c
 +L: qemu-s390x@nongnu.org
 +
 +S390 CPU models
 +M: David Hildenbrand <david@redhat.com>
 +S: Maintained
 +F: target/s390x/cpu_features*.[ch]
 +F: target/s390x/cpu_models.[ch]
 +L: qemu-s390x@nongnu.org
 +
 +S390 SCLP-backed devices
 +M: Halil Pasic <pasic@linux.ibm.com>
 +M: Christian Borntraeger <borntraeger@linux.ibm.com>
 +S: Supported
 +F: include/hw/s390x/event-facility.h
 +F: include/hw/s390x/sclp.h
 +F: hw/char/sclp*.[hc]
 +F: hw/s390x/event-facility.c
 +F: hw/s390x/sclp*.c
 +L: qemu-s390x@nongnu.org
 +
 X86 Machines
 ------------
 PC
@@ -1956,6 +1976,7 @@ M: Halil Pasic <pasic@linux.ibm.com>
 S: Supported
 F: hw/s390x/virtio-ccw*.[hc]
 F: hw/s390x/vhost-vsock-ccw.c
 +F: hw/s390x/vhost-user-fs-ccw.c
 T: git https://gitlab.com/cohuck/qemu.git s390-next
 T: git https://github.com/borntraeger/qemu.git s390-next
 L: qemu-s390x@nongnu.org
@@ -2294,6 +2315,48 @@ F: hw/timer/mips_gictimer.c
 F: include/hw/intc/mips_gic.h
 F: include/hw/timer/mips_gictimer.h
 +S390 3270 device
 +M: Halil Pasic <pasic@linux.ibm.com>
 +M: Christian Borntraeger <borntraeger@linux.ibm.com>
 +S: Odd fixes
 +F: include/hw/s390x/3270-ccw.h
 +F: hw/char/terminal3270.c
 +F: hw/s390x/3270-ccw.c
 +L: qemu-s390x@nongnu.org
 +
 +S390 diag 288 watchdog
 +M: Halil Pasic <pasic@linux.ibm.com>
 +M: Christian Borntraeger <borntraeger@linux.ibm.com>
 +S: Supported
 +F: hw/watchdog/wdt_diag288.c
 +F: include/hw/watchdog/wdt_diag288.h
 +L: qemu-s390x@nongnu.org
 +
 +S390 storage key device
 +M: Halil Pasic <pasic@linux.ibm.com>
 +M: Christian Borntraeger <borntraeger@linux.ibm.com>
 +S: Supported
 +F: hw/s390x/storage-keys.h
 +F: hw/390x/s390-skeys*.c
 +L: qemu-s390x@nongnu.org
 +
 +S390 storage attribute device
 +M: Halil Pasic <pasic@linux.ibm.com>
 +M: Christian Borntraeger <borntraeger@linux.ibm.com>
 +S: Supported
 +F: hw/s390x/storage-attributes.h
 +F: hw/s390/s390-stattrib*.c
 +L: qemu-s390x@nongnu.org
 +
 +S390 floating interrupt controller
 +M: Halil Pasic <pasic@linux.ibm.com>
 +M: Christian Borntraeger <borntraeger@linux.ibm.com>
 +M: David Hildenbrand <david@redhat.com>
 +S: Supported
 +F: hw/intc/s390_flic*.c
 +F: include/hw/s390x/s390_flic.h
 +L: qemu-s390x@nongnu.org
 +
 Subsystems
 ----------
 Overall Audio backends
 -- 
 2.41.0
--- a/SOURCES/kvm-QIOChannel-Add-flags-on-io_writev-and-introduce-io_f.patch
+++ b/SOURCES/kvm-QIOChannel-Add-flags-on-io_writev-and-introduce-io_f.patch
@ -0,0 +1,420 @@
 From 7eeec7c008e947bc3e1fed682791092b408852c6 Mon Sep 17 00:00:00 2001
 From: Leonardo Bras <leobras@redhat.com>
 Date: Wed, 18 May 2022 02:52:24 -0300
 Subject: [PATCH 17/37] QIOChannel: Add flags on io_writev and introduce
 io_flush callback
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Leonardo Brás <leobras@redhat.com>
 RH-MergeRequest: 191: MSG_ZEROCOPY + Multifd @ rhel8.7
 RH-Commit: [17/26] 7bde4e79fd3f76a6cc84d9cacf50420584ddd35c
 RH-Bugzilla: 2072049
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Add flags to io_writev and introduce io_flush as optional callback to
 QIOChannelClass, allowing the implementation of zero copy writes by
 subclasses.
 How to use them:
 - Write data using qio_channel_writev*(...,QIO_CHANNEL_WRITE_FLAG_ZERO_COPY),
 - Wait write completion with qio_channel_flush().
 Notes:
 As some zero copy write implementations work asynchronously, it's
 recommended to keep the write buffer untouched until the return of
 qio_channel_flush(), to avoid the risk of sending an updated buffer
 instead of the buffer state during write.
 As io_flush callback is optional, if a subclass does not implement it, then:
 - io_flush will return 0 without changing anything.
 Also, some functions like qio_channel_writev_full_all() were adapted to
 receive a flag parameter. That allows shared code between zero copy and
 non-zero copy writev, and also an easier implementation on new flags.
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 Reviewed-by: Peter Xu <peterx@redhat.com>
 Reviewed-by: Juan Quintela <quintela@redhat.com>
 Message-Id: <20220513062836.965425-3-leobras@redhat.com>
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 (cherry picked from commit b88651cb4d4fa416fdbb6afaf5b26ec8c035eaad)
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 ---
 chardev/char-io.c                   |  2 +-
 hw/remote/mpqemu-link.c             |  2 +-
 include/io/channel.h                | 38 +++++++++++++++++++++-
 io/channel-buffer.c                 |  1 +
 io/channel-command.c                |  1 +
 io/channel-file.c                   |  1 +
 io/channel-socket.c                 |  2 ++
 io/channel-tls.c                    |  1 +
 io/channel-websock.c                |  1 +
 io/channel.c                        | 49 +++++++++++++++++++++++------
 migration/rdma.c                    |  1 +
 scsi/pr-manager-helper.c            |  2 +-
 tests/unit/test-io-channel-socket.c |  1 +
 13 files changed, 88 insertions(+), 14 deletions(-)
 diff --git a/chardev/char-io.c b/chardev/char-io.c
 index 8ced184160..4451128cba 100644
 --- a/chardev/char-io.c
 +++ b/chardev/char-io.c
@@ -122,7 +122,7 @@ int io_channel_send_full(QIOChannel *ioc,
         ret = qio_channel_writev_full(
             ioc, &iov, 1,
 -            fds, nfds, NULL);
 +            fds, nfds, 0, NULL);
         if (ret == QIO_CHANNEL_ERR_BLOCK) {
             if (offset) {
                 return offset;
 diff --git a/hw/remote/mpqemu-link.c b/hw/remote/mpqemu-link.c
 index 7e841820e5..e8f556bd27 100644
 --- a/hw/remote/mpqemu-link.c
 +++ b/hw/remote/mpqemu-link.c
@@ -69,7 +69,7 @@ bool mpqemu_msg_send(MPQemuMsg *msg, QIOChannel *ioc, Error **errp)
     }
     if (!qio_channel_writev_full_all(ioc, send, G_N_ELEMENTS(send),
 -                                    fds, nfds, errp)) {
 +                                    fds, nfds, 0, errp)) {
         ret = true;
     } else {
         trace_mpqemu_send_io_error(msg->cmd, msg->size, nfds);
 diff --git a/include/io/channel.h b/include/io/channel.h
 index 88988979f8..c680ee7480 100644
 --- a/include/io/channel.h
 +++ b/include/io/channel.h
@@ -32,12 +32,15 @@ OBJECT_DECLARE_TYPE(QIOChannel, QIOChannelClass,
 #define QIO_CHANNEL_ERR_BLOCK -2
 +#define QIO_CHANNEL_WRITE_FLAG_ZERO_COPY 0x1
 +
 typedef enum QIOChannelFeature QIOChannelFeature;
 enum QIOChannelFeature {
     QIO_CHANNEL_FEATURE_FD_PASS,
     QIO_CHANNEL_FEATURE_SHUTDOWN,
     QIO_CHANNEL_FEATURE_LISTEN,
 +    QIO_CHANNEL_FEATURE_WRITE_ZERO_COPY,
 };
@@ -104,6 +107,7 @@ struct QIOChannelClass {
                          size_t niov,
                          int *fds,
                          size_t nfds,
 +                         int flags,
                          Error **errp);
     ssize_t (*io_readv)(QIOChannel *ioc,
                         const struct iovec *iov,
@@ -136,6 +140,8 @@ struct QIOChannelClass {
                                   IOHandler *io_read,
                                   IOHandler *io_write,
                                   void *opaque);
 +    int (*io_flush)(QIOChannel *ioc,
 +                    Error **errp);
 };
 /* General I/O handling functions */
@@ -228,6 +234,7 @@ ssize_t qio_channel_readv_full(QIOChannel *ioc,
  * @niov: the length of the @iov array
  * @fds: an array of file handles to send
  * @nfds: number of file handles in @fds
 + * @flags: write flags (QIO_CHANNEL_WRITE_FLAG_*)
  * @errp: pointer to a NULL-initialized error object
  *
  * Write data to the IO channel, reading it from the
@@ -260,6 +267,7 @@ ssize_t qio_channel_writev_full(QIOChannel *ioc,
                                 size_t niov,
                                 int *fds,
                                 size_t nfds,
 +                                int flags,
                                 Error **errp);
 /**
@@ -837,6 +845,7 @@ int qio_channel_readv_full_all(QIOChannel *ioc,
  * @niov: the length of the @iov array
  * @fds: an array of file handles to send
  * @nfds: number of file handles in @fds
 + * @flags: write flags (QIO_CHANNEL_WRITE_FLAG_*)
  * @errp: pointer to a NULL-initialized error object
  *
  *
@@ -846,6 +855,14 @@ int qio_channel_readv_full_all(QIOChannel *ioc,
  * to be written, yielding from the current coroutine
  * if required.
  *
 + * If QIO_CHANNEL_WRITE_FLAG_ZERO_COPY is passed in flags,
 + * instead of waiting for all requested data to be written,
 + * this function will wait until it's all queued for writing.
 + * In this case, if the buffer gets changed between queueing and
 + * sending, the updated buffer will be sent. If this is not a
 + * desired behavior, it's suggested to call qio_channel_flush()
 + * before reusing the buffer.
 + *
  * Returns: 0 if all bytes were written, or -1 on error
  */
@@ -853,6 +870,25 @@ int qio_channel_writev_full_all(QIOChannel *ioc,
                                 const struct iovec *iov,
                                 size_t niov,
                                 int *fds, size_t nfds,
 -                                Error **errp);
 +                                int flags, Error **errp);
 +
 +/**
 + * qio_channel_flush:
 + * @ioc: the channel object
 + * @errp: pointer to a NULL-initialized error object
 + *
 + * Will block until every packet queued with
 + * qio_channel_writev_full() + QIO_CHANNEL_WRITE_FLAG_ZERO_COPY
 + * is sent, or return in case of any error.
 + *
 + * If not implemented, acts as a no-op, and returns 0.
 + *
 + * Returns -1 if any error is found,
 + *          1 if every send failed to use zero copy.
 + *          0 otherwise.
 + */
 +
 +int qio_channel_flush(QIOChannel *ioc,
 +                      Error **errp);
 #endif /* QIO_CHANNEL_H */
 diff --git a/io/channel-buffer.c b/io/channel-buffer.c
 index baa4e2b089..bf52011be2 100644
 --- a/io/channel-buffer.c
 +++ b/io/channel-buffer.c
@@ -81,6 +81,7 @@ static ssize_t qio_channel_buffer_writev(QIOChannel *ioc,
                                          size_t niov,
                                          int *fds,
                                          size_t nfds,
 +                                         int flags,
                                          Error **errp)
 {
     QIOChannelBuffer *bioc = QIO_CHANNEL_BUFFER(ioc);
 diff --git a/io/channel-command.c b/io/channel-command.c
 index b2a9e27138..5ff1691bad 100644
 --- a/io/channel-command.c
 +++ b/io/channel-command.c
@@ -258,6 +258,7 @@ static ssize_t qio_channel_command_writev(QIOChannel *ioc,
                                           size_t niov,
                                           int *fds,
                                           size_t nfds,
 +                                          int flags,
                                           Error **errp)
 {
     QIOChannelCommand *cioc = QIO_CHANNEL_COMMAND(ioc);
 diff --git a/io/channel-file.c b/io/channel-file.c
 index c4bf799a80..348a48545e 100644
 --- a/io/channel-file.c
 +++ b/io/channel-file.c
@@ -114,6 +114,7 @@ static ssize_t qio_channel_file_writev(QIOChannel *ioc,
                                        size_t niov,
                                        int *fds,
                                        size_t nfds,
 +                                       int flags,
                                        Error **errp)
 {
     QIOChannelFile *fioc = QIO_CHANNEL_FILE(ioc);
 diff --git a/io/channel-socket.c b/io/channel-socket.c
 index 606ec97cf7..bfbd64787e 100644
 --- a/io/channel-socket.c
 +++ b/io/channel-socket.c
@@ -525,6 +525,7 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
                                          size_t niov,
                                          int *fds,
                                          size_t nfds,
 +                                         int flags,
                                          Error **errp)
 {
     QIOChannelSocket *sioc = QIO_CHANNEL_SOCKET(ioc);
@@ -620,6 +621,7 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
                                          size_t niov,
                                          int *fds,
                                          size_t nfds,
 +                                         int flags,
                                          Error **errp)
 {
     QIOChannelSocket *sioc = QIO_CHANNEL_SOCKET(ioc);
 diff --git a/io/channel-tls.c b/io/channel-tls.c
 index 2ae1b92fc0..4ce890a538 100644
 --- a/io/channel-tls.c
 +++ b/io/channel-tls.c
@@ -301,6 +301,7 @@ static ssize_t qio_channel_tls_writev(QIOChannel *ioc,
                                       size_t niov,
                                       int *fds,
                                       size_t nfds,
 +                                      int flags,
                                       Error **errp)
 {
     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
 diff --git a/io/channel-websock.c b/io/channel-websock.c
 index 70889bb54d..035dd6075b 100644
 --- a/io/channel-websock.c
 +++ b/io/channel-websock.c
@@ -1127,6 +1127,7 @@ static ssize_t qio_channel_websock_writev(QIOChannel *ioc,
                                           size_t niov,
                                           int *fds,
                                           size_t nfds,
 +                                          int flags,
                                           Error **errp)
 {
     QIOChannelWebsock *wioc = QIO_CHANNEL_WEBSOCK(ioc);
 diff --git a/io/channel.c b/io/channel.c
 index e8b019dc36..0640941ac5 100644
 --- a/io/channel.c
 +++ b/io/channel.c
@@ -72,18 +72,32 @@ ssize_t qio_channel_writev_full(QIOChannel *ioc,
                                 size_t niov,
                                 int *fds,
                                 size_t nfds,
 +                                int flags,
                                 Error **errp)
 {
     QIOChannelClass *klass = QIO_CHANNEL_GET_CLASS(ioc);
 -    if ((fds || nfds) &&
 -        !qio_channel_has_feature(ioc, QIO_CHANNEL_FEATURE_FD_PASS)) {
 +    if (fds || nfds) {
 +        if (!qio_channel_has_feature(ioc, QIO_CHANNEL_FEATURE_FD_PASS)) {
 +            error_setg_errno(errp, EINVAL,
 +                             "Channel does not support file descriptor passing");
 +            return -1;
 +        }
 +        if (flags & QIO_CHANNEL_WRITE_FLAG_ZERO_COPY) {
 +            error_setg_errno(errp, EINVAL,
 +                             "Zero Copy does not support file descriptor passing");
 +            return -1;
 +        }
 +    }
 +
 +    if ((flags & QIO_CHANNEL_WRITE_FLAG_ZERO_COPY) &&
 +        !qio_channel_has_feature(ioc, QIO_CHANNEL_FEATURE_WRITE_ZERO_COPY)) {
         error_setg_errno(errp, EINVAL,
 -                         "Channel does not support file descriptor passing");
 +                         "Requested Zero Copy feature is not available");
         return -1;
     }
 -    return klass->io_writev(ioc, iov, niov, fds, nfds, errp);
 +    return klass->io_writev(ioc, iov, niov, fds, nfds, flags, errp);
 }
@@ -217,14 +231,14 @@ int qio_channel_writev_all(QIOChannel *ioc,
                            size_t niov,
                            Error **errp)
 {
 -    return qio_channel_writev_full_all(ioc, iov, niov, NULL, 0, errp);
 +    return qio_channel_writev_full_all(ioc, iov, niov, NULL, 0, 0, errp);
 }
 int qio_channel_writev_full_all(QIOChannel *ioc,
                                 const struct iovec *iov,
                                 size_t niov,
                                 int *fds, size_t nfds,
 -                                Error **errp)
 +                                int flags, Error **errp)
 {
     int ret = -1;
     struct iovec *local_iov = g_new(struct iovec, niov);
@@ -237,8 +251,10 @@ int qio_channel_writev_full_all(QIOChannel *ioc,
     while (nlocal_iov > 0) {
         ssize_t len;
 -        len = qio_channel_writev_full(ioc, local_iov, nlocal_iov, fds, nfds,
 -                                      errp);
 +
 +        len = qio_channel_writev_full(ioc, local_iov, nlocal_iov, fds,
 +                                            nfds, flags, errp);
 +
         if (len == QIO_CHANNEL_ERR_BLOCK) {
             if (qemu_in_coroutine()) {
                 qio_channel_yield(ioc, G_IO_OUT);
@@ -277,7 +293,7 @@ ssize_t qio_channel_writev(QIOChannel *ioc,
                            size_t niov,
                            Error **errp)
 {
 -    return qio_channel_writev_full(ioc, iov, niov, NULL, 0, errp);
 +    return qio_channel_writev_full(ioc, iov, niov, NULL, 0, 0, errp);
 }
@@ -297,7 +313,7 @@ ssize_t qio_channel_write(QIOChannel *ioc,
                           Error **errp)
 {
     struct iovec iov = { .iov_base = (char *)buf, .iov_len = buflen };
 -    return qio_channel_writev_full(ioc, &iov, 1, NULL, 0, errp);
 +    return qio_channel_writev_full(ioc, &iov, 1, NULL, 0, 0, errp);
 }
@@ -473,6 +489,19 @@ off_t qio_channel_io_seek(QIOChannel *ioc,
     return klass->io_seek(ioc, offset, whence, errp);
 }
 +int qio_channel_flush(QIOChannel *ioc,
 +                                Error **errp)
 +{
 +    QIOChannelClass *klass = QIO_CHANNEL_GET_CLASS(ioc);
 +
 +    if (!klass->io_flush ||
 +        !qio_channel_has_feature(ioc, QIO_CHANNEL_FEATURE_WRITE_ZERO_COPY)) {
 +        return 0;
 +    }
 +
 +    return klass->io_flush(ioc, errp);
 +}
 +
 static void qio_channel_restart_read(void *opaque)
 {
 diff --git a/migration/rdma.c b/migration/rdma.c
 index f5d3bbe7e9..54acd2000e 100644
 --- a/migration/rdma.c
 +++ b/migration/rdma.c
@@ -2833,6 +2833,7 @@ static ssize_t qio_channel_rdma_writev(QIOChannel *ioc,
                                        size_t niov,
                                        int *fds,
                                        size_t nfds,
 +                                       int flags,
                                        Error **errp)
 {
     QIOChannelRDMA *rioc = QIO_CHANNEL_RDMA(ioc);
 diff --git a/scsi/pr-manager-helper.c b/scsi/pr-manager-helper.c
 index 451c7631b7..3be52a98d5 100644
 --- a/scsi/pr-manager-helper.c
 +++ b/scsi/pr-manager-helper.c
@@ -77,7 +77,7 @@ static int pr_manager_helper_write(PRManagerHelper *pr_mgr,
         iov.iov_base = (void *)buf;
         iov.iov_len = sz;
         n_written = qio_channel_writev_full(QIO_CHANNEL(pr_mgr->ioc), &iov, 1,
 -                                            nfds ? &fd : NULL, nfds, errp);
 +                                            nfds ? &fd : NULL, nfds, 0, errp);
         if (n_written <= 0) {
             assert(n_written != QIO_CHANNEL_ERR_BLOCK);
 diff --git a/tests/unit/test-io-channel-socket.c b/tests/unit/test-io-channel-socket.c
 index c49eec1f03..6713886d02 100644
 --- a/tests/unit/test-io-channel-socket.c
 +++ b/tests/unit/test-io-channel-socket.c
@@ -444,6 +444,7 @@ static void test_io_channel_unix_fd_pass(void)
                             G_N_ELEMENTS(iosend),
                             fdsend,
                             G_N_ELEMENTS(fdsend),
 +                            0,
                             &error_abort);
     qio_channel_readv_full(dst,
 -- 
 2.35.3
--- a/SOURCES/kvm-QIOChannelSocket-Add-support-for-MSG_ZEROCOPY-IPV6.patch
+++ b/SOURCES/kvm-QIOChannelSocket-Add-support-for-MSG_ZEROCOPY-IPV6.patch
@ -0,0 +1,56 @@
 From a6c4aed18a027ce8e107fdf9184e9ea43a86f843 Mon Sep 17 00:00:00 2001
 From: Leonardo Bras <leobras@redhat.com>
 Date: Thu, 4 Aug 2022 04:10:43 -0300
 Subject: [PATCH 8/9] QIOChannelSocket: Add support for MSG_ZEROCOPY + IPV6
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Leonardo Brás <leobras@redhat.com>
 RH-MergeRequest: 201: Zero-copy-send fixes + improvements
 RH-Commit: [8/8] 6e26ee7c9ebaedb07623313cb0678816867751dd
 RH-Bugzilla: 2110203
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 For using MSG_ZEROCOPY, there are two steps:
 1 - io_writev() the packet, which enqueues the packet for sending, and
 2 - io_flush(), which gets confirmation that all packets got correctly sent
 Currently, if MSG_ZEROCOPY is used to send packets over IPV6, no error will
 be reported in (1), but it will fail in the first time (2) happens.
 This happens because (2) currently checks for cmsg_level & cmsg_type
 associated with IPV4 only, before reporting any error.
 Add checks for cmsg_level & cmsg_type associated with IPV6, and thus enable
 support for MSG_ZEROCOPY + IPV6
 Fixes: 2bc58ffc29 ("QIOChannelSocket: Implement io_writev zero copy flag & io_flush for CONFIG_LINUX")
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
 (cherry picked from commit 5258a7e2c0677d16e9e1d06845f60171adf0b290)
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 ---
 io/channel-socket.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/io/channel-socket.c b/io/channel-socket.c
 index cf0d67c51b..6010ad7017 100644
 --- a/io/channel-socket.c
 +++ b/io/channel-socket.c
@@ -747,8 +747,8 @@ static int qio_channel_socket_flush(QIOChannel *ioc,
         }
         cm = CMSG_FIRSTHDR(&msg);
 -        if (cm->cmsg_level != SOL_IP &&
 -            cm->cmsg_type != IP_RECVERR) {
 +        if (cm->cmsg_level != SOL_IP   && cm->cmsg_type != IP_RECVERR &&
 +            cm->cmsg_level != SOL_IPV6 && cm->cmsg_type != IPV6_RECVERR) {
             error_setg_errno(errp, EPROTOTYPE,
                              "Wrong cmsg in errqueue");
             return -1;
 -- 
 2.31.1
--- a/SOURCES/kvm-QIOChannelSocket-Fix-zero-copy-flush-returning-code-.patch
+++ b/SOURCES/kvm-QIOChannelSocket-Fix-zero-copy-flush-returning-code-.patch
@ -0,0 +1,65 @@
 From 905cc8032fc63619efb3f0a8c9754b7190bcc43a Mon Sep 17 00:00:00 2001
 From: Leonardo Bras <leobras@redhat.com>
 Date: Mon, 11 Jul 2022 18:11:11 -0300
 Subject: [PATCH 3/9] QIOChannelSocket: Fix zero-copy flush returning code 1
 when nothing sent
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Leonardo Brás <leobras@redhat.com>
 RH-MergeRequest: 201: Zero-copy-send fixes + improvements
 RH-Commit: [3/8] 1ad707702fa26cd4d0fa1870c21f5f26ae93ff97
 RH-Bugzilla: 2110203
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 If flush is called when no buffer was sent with MSG_ZEROCOPY, it currently
 returns 1. This return code should be used only when Linux fails to use
 MSG_ZEROCOPY on a lot of sendmsg().
 Fix this by returning early from flush if no sendmsg(...,MSG_ZEROCOPY)
 was attempted.
 Fixes: 2bc58ffc2926 ("QIOChannelSocket: Implement io_writev zero copy flag & io_flush for CONFIG_LINUX")
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 Acked-by: Daniel P. Berrangé <berrange@redhat.com>
 Reviewed-by: Juan Quintela <quintela@redhat.com>
 Reviewed-by: Peter Xu <peterx@redhat.com>
 Message-Id: <20220711211112.18951-2-leobras@redhat.com>
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 (cherry picked from commit 927f93e099c4f9184e60a1bc61624ac2d04d0223)
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 ---
 io/channel-socket.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)
 diff --git a/io/channel-socket.c b/io/channel-socket.c
 index df858da924..cf0d67c51b 100644
 --- a/io/channel-socket.c
 +++ b/io/channel-socket.c
@@ -717,12 +717,18 @@ static int qio_channel_socket_flush(QIOChannel *ioc,
     struct cmsghdr *cm;
     char control[CMSG_SPACE(sizeof(*serr))];
     int received;
 -    int ret = 1;
 +    int ret;
 +
 +    if (sioc->zero_copy_queued == sioc->zero_copy_sent) {
 +        return 0;
 +    }
     msg.msg_control = control;
     msg.msg_controllen = sizeof(control);
     memset(control, 0, sizeof(control));
 +    ret = 1;
 +
     while (sioc->zero_copy_sent < sioc->zero_copy_queued) {
         received = recvmsg(sioc->fd, &msg, MSG_ERRQUEUE);
         if (received < 0) {
 -- 
 2.31.1
--- a/SOURCES/kvm-QIOChannelSocket-Fix-zero-copy-send-so-socket-flush-.patch
+++ b/SOURCES/kvm-QIOChannelSocket-Fix-zero-copy-send-so-socket-flush-.patch
@ -0,0 +1,58 @@
 From c1fd32d93ae42fcf3c1a25f4d56e669f251087d8 Mon Sep 17 00:00:00 2001
 From: Leonardo Bras <leobras@redhat.com>
 Date: Mon, 20 Jun 2022 02:39:43 -0300
 Subject: [PATCH 25/37] QIOChannelSocket: Fix zero-copy send so socket flush
 works
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Leonardo Brás <leobras@redhat.com>
 RH-MergeRequest: 191: MSG_ZEROCOPY + Multifd @ rhel8.7
 RH-Commit: [25/26] 3ede94f3269e21c3ace073ed1a6f24696315bcbb
 RH-Bugzilla: 2072049
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Somewhere between v6 and v7 the of the zero-copy-send patchset a crucial
 part of the flushing mechanism got missing: incrementing zero_copy_queued.
 Without that, the flushing interface becomes a no-op, and there is no
 guarantee the buffer is really sent.
 This can go as bad as causing a corruption in RAM during migration.
 Fixes: 2bc58ffc2926 ("QIOChannelSocket: Implement io_writev zero copy flag & io_flush for CONFIG_LINUX")
 Reported-by: 徐闯 <xuchuangxclwt@bytedance.com>
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 Reviewed-by: Peter Xu <peterx@redhat.com>
 Reviewed-by: Juan Quintela <quintela@redhat.com>
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 (cherry picked from commit 4f5a09714c983a3471fd12e3c7f3196e95c650c1)
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 ---
 io/channel-socket.c | 5 +++++
 1 file changed, 5 insertions(+)
 diff --git a/io/channel-socket.c b/io/channel-socket.c
 index 7d37b39de7..df858da924 100644
 --- a/io/channel-socket.c
 +++ b/io/channel-socket.c
@@ -612,6 +612,11 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
                          "Unable to write to socket");
         return -1;
     }
 +
 +    if (flags & QIO_CHANNEL_WRITE_FLAG_ZERO_COPY) {
 +        sioc->zero_copy_queued++;
 +    }
 +
     return ret;
 }
 #else /* WIN32 */
 -- 
 2.35.3
--- a/SOURCES/kvm-QIOChannelSocket-Implement-io_writev-zero-copy-flag-.patch
+++ b/SOURCES/kvm-QIOChannelSocket-Implement-io_writev-zero-copy-flag-.patch
@ -0,0 +1,249 @@
 From 5fd7af93a06adaddbae719aabbaf912159f4fb28 Mon Sep 17 00:00:00 2001
 From: Leonardo Bras <leobras@redhat.com>
 Date: Wed, 18 May 2022 02:52:25 -0300
 Subject: [PATCH 18/37] QIOChannelSocket: Implement io_writev zero copy flag &
 io_flush for CONFIG_LINUX
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Leonardo Brás <leobras@redhat.com>
 RH-MergeRequest: 191: MSG_ZEROCOPY + Multifd @ rhel8.7
 RH-Commit: [18/26] 6f65c8c879a5df57213b541d58285b65178f8547
 RH-Bugzilla: 2072049
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 For CONFIG_LINUX, implement the new zero copy flag and the optional callback
 io_flush on QIOChannelSocket, but enables it only when MSG_ZEROCOPY
 feature is available in the host kernel, which is checked on
 qio_channel_socket_connect_sync()
 qio_channel_socket_flush() was implemented by counting how many times
 sendmsg(...,MSG_ZEROCOPY) was successfully called, and then reading the
 socket's error queue, in order to find how many of them finished sending.
 Flush will loop until those counters are the same, or until some error occurs.
 Notes on using writev() with QIO_CHANNEL_WRITE_FLAG_ZERO_COPY:
 1: Buffer
 - As MSG_ZEROCOPY tells the kernel to use the same user buffer to avoid copying,
 some caution is necessary to avoid overwriting any buffer before it's sent.
 If something like this happen, a newer version of the buffer may be sent instead.
 - If this is a problem, it's recommended to call qio_channel_flush() before freeing
 or re-using the buffer.
 2: Locked memory
 - When using MSG_ZERCOCOPY, the buffer memory will be locked after queued, and
 unlocked after it's sent.
 - Depending on the size of each buffer, and how often it's sent, it may require
 a larger amount of locked memory than usually available to non-root user.
 - If the required amount of locked memory is not available, writev_zero_copy
 will return an error, which can abort an operation like migration,
 - Because of this, when an user code wants to add zero copy as a feature, it
 requires a mechanism to disable it, so it can still be accessible to less
 privileged users.
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 Reviewed-by: Peter Xu <peterx@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 Reviewed-by: Juan Quintela <quintela@redhat.com>
 Message-Id: <20220513062836.965425-4-leobras@redhat.com>
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 (cherry picked from commit 2bc58ffc2926a4efdd03edfb5909861fefc68c3d)
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 ---
 include/io/channel-socket.h |   2 +
 io/channel-socket.c         | 116 ++++++++++++++++++++++++++++++++++--
 2 files changed, 114 insertions(+), 4 deletions(-)
 diff --git a/include/io/channel-socket.h b/include/io/channel-socket.h
 index e747e63514..513c428fe4 100644
 --- a/include/io/channel-socket.h
 +++ b/include/io/channel-socket.h
@@ -47,6 +47,8 @@ struct QIOChannelSocket {
     socklen_t localAddrLen;
     struct sockaddr_storage remoteAddr;
     socklen_t remoteAddrLen;
 +    ssize_t zero_copy_queued;
 +    ssize_t zero_copy_sent;
 };
 diff --git a/io/channel-socket.c b/io/channel-socket.c
 index bfbd64787e..38a46ba213 100644
 --- a/io/channel-socket.c
 +++ b/io/channel-socket.c
@@ -26,6 +26,14 @@
 #include "io/channel-watch.h"
 #include "trace.h"
 #include "qapi/clone-visitor.h"
 +#ifdef CONFIG_LINUX
 +#include <linux/errqueue.h>
 +#include <sys/socket.h>
 +
 +#if (defined(MSG_ZEROCOPY) && defined(SO_ZEROCOPY))
 +#define QEMU_MSG_ZEROCOPY
 +#endif
 +#endif
 #define SOCKET_MAX_FDS 16
@@ -55,6 +63,8 @@ qio_channel_socket_new(void)
     sioc = QIO_CHANNEL_SOCKET(object_new(TYPE_QIO_CHANNEL_SOCKET));
     sioc->fd = -1;
 +    sioc->zero_copy_queued = 0;
 +    sioc->zero_copy_sent = 0;
     ioc = QIO_CHANNEL(sioc);
     qio_channel_set_feature(ioc, QIO_CHANNEL_FEATURE_SHUTDOWN);
@@ -154,6 +164,16 @@ int qio_channel_socket_connect_sync(QIOChannelSocket *ioc,
         return -1;
     }
 +#ifdef QEMU_MSG_ZEROCOPY
 +    int ret, v = 1;
 +    ret = setsockopt(fd, SOL_SOCKET, SO_ZEROCOPY, &v, sizeof(v));
 +    if (ret == 0) {
 +        /* Zero copy available on host */
 +        qio_channel_set_feature(QIO_CHANNEL(ioc),
 +                                QIO_CHANNEL_FEATURE_WRITE_ZERO_COPY);
 +    }
 +#endif
 +
     return 0;
 }
@@ -534,6 +554,7 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
     char control[CMSG_SPACE(sizeof(int) * SOCKET_MAX_FDS)];
     size_t fdsize = sizeof(int) * nfds;
     struct cmsghdr *cmsg;
 +    int sflags = 0;
     memset(control, 0, CMSG_SPACE(sizeof(int) * SOCKET_MAX_FDS));
@@ -558,15 +579,31 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
         memcpy(CMSG_DATA(cmsg), fds, fdsize);
     }
 +#ifdef QEMU_MSG_ZEROCOPY
 +    if (flags & QIO_CHANNEL_WRITE_FLAG_ZERO_COPY) {
 +        sflags = MSG_ZEROCOPY;
 +    }
 +#endif
 +
  retry:
 -    ret = sendmsg(sioc->fd, &msg, 0);
 +    ret = sendmsg(sioc->fd, &msg, sflags);
     if (ret <= 0) {
 -        if (errno == EAGAIN) {
 +        switch (errno) {
 +        case EAGAIN:
             return QIO_CHANNEL_ERR_BLOCK;
 -        }
 -        if (errno == EINTR) {
 +        case EINTR:
             goto retry;
 +#ifdef QEMU_MSG_ZEROCOPY
 +        case ENOBUFS:
 +            if (sflags & MSG_ZEROCOPY) {
 +                error_setg_errno(errp, errno,
 +                                 "Process can't lock enough memory for using MSG_ZEROCOPY");
 +                return -1;
 +            }
 +            break;
 +#endif
         }
 +
         error_setg_errno(errp, errno,
                          "Unable to write to socket");
         return -1;
@@ -660,6 +697,74 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
 }
 #endif /* WIN32 */
 +
 +#ifdef QEMU_MSG_ZEROCOPY
 +static int qio_channel_socket_flush(QIOChannel *ioc,
 +                                    Error **errp)
 +{
 +    QIOChannelSocket *sioc = QIO_CHANNEL_SOCKET(ioc);
 +    struct msghdr msg = {};
 +    struct sock_extended_err *serr;
 +    struct cmsghdr *cm;
 +    char control[CMSG_SPACE(sizeof(*serr))];
 +    int received;
 +    int ret = 1;
 +
 +    msg.msg_control = control;
 +    msg.msg_controllen = sizeof(control);
 +    memset(control, 0, sizeof(control));
 +
 +    while (sioc->zero_copy_sent < sioc->zero_copy_queued) {
 +        received = recvmsg(sioc->fd, &msg, MSG_ERRQUEUE);
 +        if (received < 0) {
 +            switch (errno) {
 +            case EAGAIN:
 +                /* Nothing on errqueue, wait until something is available */
 +                qio_channel_wait(ioc, G_IO_ERR);
 +                continue;
 +            case EINTR:
 +                continue;
 +            default:
 +                error_setg_errno(errp, errno,
 +                                 "Unable to read errqueue");
 +                return -1;
 +            }
 +        }
 +
 +        cm = CMSG_FIRSTHDR(&msg);
 +        if (cm->cmsg_level != SOL_IP &&
 +            cm->cmsg_type != IP_RECVERR) {
 +            error_setg_errno(errp, EPROTOTYPE,
 +                             "Wrong cmsg in errqueue");
 +            return -1;
 +        }
 +
 +        serr = (void *) CMSG_DATA(cm);
 +        if (serr->ee_errno != SO_EE_ORIGIN_NONE) {
 +            error_setg_errno(errp, serr->ee_errno,
 +                             "Error on socket");
 +            return -1;
 +        }
 +        if (serr->ee_origin != SO_EE_ORIGIN_ZEROCOPY) {
 +            error_setg_errno(errp, serr->ee_origin,
 +                             "Error not from zero copy");
 +            return -1;
 +        }
 +
 +        /* No errors, count successfully finished sendmsg()*/
 +        sioc->zero_copy_sent += serr->ee_data - serr->ee_info + 1;
 +
 +        /* If any sendmsg() succeeded using zero copy, return 0 at the end */
 +        if (serr->ee_code != SO_EE_CODE_ZEROCOPY_COPIED) {
 +            ret = 0;
 +        }
 +    }
 +
 +    return ret;
 +}
 +
 +#endif /* QEMU_MSG_ZEROCOPY */
 +
 static int
 qio_channel_socket_set_blocking(QIOChannel *ioc,
                                 bool enabled,
@@ -789,6 +894,9 @@ static void qio_channel_socket_class_init(ObjectClass *klass,
     ioc_klass->io_set_delay = qio_channel_socket_set_delay;
     ioc_klass->io_create_watch = qio_channel_socket_create_watch;
     ioc_klass->io_set_aio_fd_handler = qio_channel_socket_set_aio_fd_handler;
 +#ifdef QEMU_MSG_ZEROCOPY
 +    ioc_klass->io_flush = qio_channel_socket_flush;
 +#endif
 }
 static const TypeInfo qio_channel_socket_info = {
 -- 
 2.35.3
--- a/SOURCES/kvm-QIOChannelSocket-Introduce-assert-and-reduce-ifdefs-.patch
+++ b/SOURCES/kvm-QIOChannelSocket-Introduce-assert-and-reduce-ifdefs-.patch
@ -0,0 +1,82 @@
 From cbfaf86331c2b2e01a2083303b7554672bf991b7 Mon Sep 17 00:00:00 2001
 From: Leonardo Bras <leobras@redhat.com>
 Date: Mon, 20 Jun 2022 02:39:42 -0300
 Subject: [PATCH 24/37] QIOChannelSocket: Introduce assert and reduce ifdefs to
 improve readability
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Leonardo Brás <leobras@redhat.com>
 RH-MergeRequest: 191: MSG_ZEROCOPY + Multifd @ rhel8.7
 RH-Commit: [24/26] b50e2e65307149f247155a7f7a032dc99e57718d
 RH-Bugzilla: 2072049
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 During implementation of MSG_ZEROCOPY feature, a lot of #ifdefs were
 introduced, particularly at qio_channel_socket_writev().
 Rewrite some of those changes so it's easier to read.
 Also, introduce an assert to help detect incorrect zero-copy usage is when
 it's disabled on build.
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 Reviewed-by: Juan Quintela <quintela@redhat.com>
 Reviewed-by: Peter Xu <peterx@redhat.com>
 Signed-off-by: Juan Quintela <quintela@redhat.com>
 Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
  dgilbert: Fixed up thinko'd g_assert_unreachable->g_assert_not_reached
 (cherry picked from commit 803ca43e4c7fcf32f9f68c118301ccd0c83ece3f)
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 ---
 io/channel-socket.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)
 diff --git a/io/channel-socket.c b/io/channel-socket.c
 index 38a46ba213..7d37b39de7 100644
 --- a/io/channel-socket.c
 +++ b/io/channel-socket.c
@@ -579,11 +579,17 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
         memcpy(CMSG_DATA(cmsg), fds, fdsize);
     }
 -#ifdef QEMU_MSG_ZEROCOPY
     if (flags & QIO_CHANNEL_WRITE_FLAG_ZERO_COPY) {
 +#ifdef QEMU_MSG_ZEROCOPY
         sflags = MSG_ZEROCOPY;
 -    }
 +#else
 +        /*
 +         * We expect QIOChannel class entry point to have
 +         * blocked this code path already
 +         */
 +        g_assert_not_reached();
 #endif
 +    }
  retry:
     ret = sendmsg(sioc->fd, &msg, sflags);
@@ -593,15 +599,13 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
             return QIO_CHANNEL_ERR_BLOCK;
         case EINTR:
             goto retry;
 -#ifdef QEMU_MSG_ZEROCOPY
         case ENOBUFS:
 -            if (sflags & MSG_ZEROCOPY) {
 +            if (flags & QIO_CHANNEL_WRITE_FLAG_ZERO_COPY) {
                 error_setg_errno(errp, errno,
                                  "Process can't lock enough memory for using MSG_ZEROCOPY");
                 return -1;
             }
             break;
 -#endif
         }
         error_setg_errno(errp, errno,
 -- 
 2.35.3
--- a/SOURCES/kvm-RAMBlock-Add-support-of-KVM-private-guest-memfd.patch
+++ b/SOURCES/kvm-RAMBlock-Add-support-of-KVM-private-guest-memfd.patch
@ -1,329 +0,0 @@
 From f4b01d645926faab2cab86fadb7398c26d6b8285 Mon Sep 17 00:00:00 2001
 From: Xiaoyao Li <xiaoyao.li@intel.com>
 Date: Wed, 20 Mar 2024 03:39:02 -0500
 Subject: [PATCH 028/100] RAMBlock: Add support of KVM private guest memfd
 RH-Author: Paolo Bonzini <pbonzini@redhat.com>
 RH-MergeRequest: 245: SEV-SNP support
 RH-Jira: RHEL-39544
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Bandan Das <bdas@redhat.com>
 RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
 RH-Commit: [28/91] 95fdf196afcb67113834c20fa354ee1397411bfd (bonzini/rhel-qemu-kvm)
 Add KVM guest_memfd support to RAMBlock so both normal hva based memory
 and kvm guest memfd based private memory can be associated in one RAMBlock.
 Introduce new flag RAM_GUEST_MEMFD. When it's set, it calls KVM ioctl to
 create private guest_memfd during RAMBlock setup.
 Allocating a new RAM_GUEST_MEMFD flag to instruct the setup of guest memfd
 is more flexible and extensible than simply relying on the VM type because
 in the future we may have the case that not all the memory of a VM need
 guest memfd. As a benefit, it also avoid getting MachineState in memory
 subsystem.
 Note, RAM_GUEST_MEMFD is supposed to be set for memory backends of
 confidential guests, such as TDX VM. How and when to set it for memory
 backends will be implemented in the following patches.
 Introduce memory_region_has_guest_memfd() to query if the MemoryRegion has
 KVM guest_memfd allocated.
 Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
 Reviewed-by: David Hildenbrand <david@redhat.com>
 Message-ID: <20240320083945.991426-7-michael.roth@amd.com>
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 (cherry picked from commit 15f7a80c49cb3637f62fa37fa4a17da913bd91ff)
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 ---
 accel/kvm/kvm-all.c     | 28 ++++++++++++++++++++++++++++
 accel/stubs/kvm-stub.c  |  5 +++++
 include/exec/memory.h   | 20 +++++++++++++++++---
 include/exec/ram_addr.h |  2 +-
 include/exec/ramblock.h |  1 +
 include/sysemu/kvm.h    |  2 ++
 system/memory.c         |  5 +++++
 system/physmem.c        | 34 +++++++++++++++++++++++++++++++---
 8 files changed, 90 insertions(+), 7 deletions(-)
 diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
 index 272e945f52..a7b9a127dd 100644
 --- a/accel/kvm/kvm-all.c
 +++ b/accel/kvm/kvm-all.c
@@ -92,6 +92,7 @@ static bool kvm_has_guest_debug;
 static int kvm_sstep_flags;
 static bool kvm_immediate_exit;
 static uint64_t kvm_supported_memory_attributes;
 +static bool kvm_guest_memfd_supported;
 static hwaddr kvm_max_slot_size = ~0;
 static const KVMCapabilityInfo kvm_required_capabilites[] = {
@@ -2419,6 +2420,11 @@ static int kvm_init(MachineState *ms)
     }
     kvm_supported_memory_attributes = kvm_check_extension(s, KVM_CAP_MEMORY_ATTRIBUTES);
 +    kvm_guest_memfd_supported =
 +        kvm_check_extension(s, KVM_CAP_GUEST_MEMFD) &&
 +        kvm_check_extension(s, KVM_CAP_USER_MEMORY2) &&
 +        (kvm_supported_memory_attributes & KVM_MEMORY_ATTRIBUTE_PRIVATE);
 +
     kvm_immediate_exit = kvm_check_extension(s, KVM_CAP_IMMEDIATE_EXIT);
     s->nr_slots = kvm_check_extension(s, KVM_CAP_NR_MEMSLOTS);
@@ -4138,3 +4144,25 @@ void kvm_mark_guest_state_protected(void)
 {
     kvm_state->guest_state_protected = true;
 }
 +
 +int kvm_create_guest_memfd(uint64_t size, uint64_t flags, Error **errp)
 +{
 +    int fd;
 +    struct kvm_create_guest_memfd guest_memfd = {
 +        .size = size,
 +        .flags = flags,
 +    };
 +
 +    if (!kvm_guest_memfd_supported) {
 +        error_setg(errp, "KVM does not support guest_memfd");
 +        return -1;
 +    }
 +
 +    fd = kvm_vm_ioctl(kvm_state, KVM_CREATE_GUEST_MEMFD, &guest_memfd);
 +    if (fd < 0) {
 +        error_setg_errno(errp, errno, "Error creating KVM guest_memfd");
 +        return -1;
 +    }
 +
 +    return fd;
 +}
 diff --git a/accel/stubs/kvm-stub.c b/accel/stubs/kvm-stub.c
 index ca38172884..8e0eb22e61 100644
 --- a/accel/stubs/kvm-stub.c
 +++ b/accel/stubs/kvm-stub.c
@@ -129,3 +129,8 @@ bool kvm_hwpoisoned_mem(void)
 {
     return false;
 }
 +
 +int kvm_create_guest_memfd(uint64_t size, uint64_t flags, Error **errp)
 +{
 +    return -ENOSYS;
 +}
 diff --git a/include/exec/memory.h b/include/exec/memory.h
 index 8626a355b3..679a847685 100644
 --- a/include/exec/memory.h
 +++ b/include/exec/memory.h
@@ -243,6 +243,9 @@ typedef struct IOMMUTLBEvent {
 /* RAM FD is opened read-only */
 #define RAM_READONLY_FD (1 << 11)
 +/* RAM can be private that has kvm guest memfd backend */
 +#define RAM_GUEST_MEMFD   (1 << 12)
 +
 static inline void iommu_notifier_init(IOMMUNotifier *n, IOMMUNotify fn,
                                        IOMMUNotifierFlag flags,
                                        hwaddr start, hwaddr end,
@@ -1307,7 +1310,8 @@ bool memory_region_init_ram_nomigrate(MemoryRegion *mr,
  * @name: Region name, becomes part of RAMBlock name used in migration stream
  *        must be unique within any device
  * @size: size of the region.
 - * @ram_flags: RamBlock flags. Supported flags: RAM_SHARED, RAM_NORESERVE.
 + * @ram_flags: RamBlock flags. Supported flags: RAM_SHARED, RAM_NORESERVE,
 + *             RAM_GUEST_MEMFD.
  * @errp: pointer to Error*, to store an error if it happens.
  *
  * Note that this function does not do anything to cause the data in the
@@ -1369,7 +1373,7 @@ bool memory_region_init_resizeable_ram(MemoryRegion *mr,
  *         (getpagesize()) will be used.
  * @ram_flags: RamBlock flags. Supported flags: RAM_SHARED, RAM_PMEM,
  *             RAM_NORESERVE, RAM_PROTECTED, RAM_NAMED_FILE, RAM_READONLY,
 - *             RAM_READONLY_FD
 + *             RAM_READONLY_FD, RAM_GUEST_MEMFD
  * @path: the path in which to allocate the RAM.
  * @offset: offset within the file referenced by path
  * @errp: pointer to Error*, to store an error if it happens.
@@ -1399,7 +1403,7 @@ bool memory_region_init_ram_from_file(MemoryRegion *mr,
  * @size: size of the region.
  * @ram_flags: RamBlock flags. Supported flags: RAM_SHARED, RAM_PMEM,
  *             RAM_NORESERVE, RAM_PROTECTED, RAM_NAMED_FILE, RAM_READONLY,
 - *             RAM_READONLY_FD
 + *             RAM_READONLY_FD, RAM_GUEST_MEMFD
  * @fd: the fd to mmap.
  * @offset: offset within the file referenced by fd
  * @errp: pointer to Error*, to store an error if it happens.
@@ -1722,6 +1726,16 @@ static inline bool memory_region_is_romd(MemoryRegion *mr)
  */
 bool memory_region_is_protected(MemoryRegion *mr);
 +/**
 + * memory_region_has_guest_memfd: check whether a memory region has guest_memfd
 + *     associated
 + *
 + * Returns %true if a memory region's ram_block has valid guest_memfd assigned.
 + *
 + * @mr: the memory region being queried
 + */
 +bool memory_region_has_guest_memfd(MemoryRegion *mr);
 +
 /**
  * memory_region_get_iommu: check whether a memory region is an iommu
  *
 diff --git a/include/exec/ram_addr.h b/include/exec/ram_addr.h
 index de45ba7bc9..07c8f86375 100644
 --- a/include/exec/ram_addr.h
 +++ b/include/exec/ram_addr.h
@@ -110,7 +110,7 @@ long qemu_maxrampagesize(void);
  *  @mr: the memory region where the ram block is
  *  @ram_flags: RamBlock flags. Supported flags: RAM_SHARED, RAM_PMEM,
  *              RAM_NORESERVE, RAM_PROTECTED, RAM_NAMED_FILE, RAM_READONLY,
 - *              RAM_READONLY_FD
 + *              RAM_READONLY_FD, RAM_GUEST_MEMFD
  *  @mem_path or @fd: specify the backing file or device
  *  @offset: Offset into target file
  *  @errp: pointer to Error*, to store an error if it happens
 diff --git a/include/exec/ramblock.h b/include/exec/ramblock.h
 index 848915ea5b..459c8917de 100644
 --- a/include/exec/ramblock.h
 +++ b/include/exec/ramblock.h
@@ -41,6 +41,7 @@ struct RAMBlock {
     QLIST_HEAD(, RAMBlockNotifier) ramblock_notifiers;
     int fd;
     uint64_t fd_offset;
 +    int guest_memfd;
     size_t page_size;
     /* dirty bitmap used during migration */
     unsigned long *bmap;
 diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
 index f114ff6986..9e4ab7ae89 100644
 --- a/include/sysemu/kvm.h
 +++ b/include/sysemu/kvm.h
@@ -537,6 +537,8 @@ void kvm_mark_guest_state_protected(void);
  */
 bool kvm_hwpoisoned_mem(void);
 +int kvm_create_guest_memfd(uint64_t size, uint64_t flags, Error **errp);
 +
 int kvm_set_memory_attributes_private(hwaddr start, uint64_t size);
 int kvm_set_memory_attributes_shared(hwaddr start, uint64_t size);
 diff --git a/system/memory.c b/system/memory.c
 index a229a79988..c756950c0c 100644
 --- a/system/memory.c
 +++ b/system/memory.c
@@ -1850,6 +1850,11 @@ bool memory_region_is_protected(MemoryRegion *mr)
     return mr->ram && (mr->ram_block->flags & RAM_PROTECTED);
 }
 +bool memory_region_has_guest_memfd(MemoryRegion *mr)
 +{
 +    return mr->ram_block && mr->ram_block->guest_memfd >= 0;
 +}
 +
 uint8_t memory_region_get_dirty_log_mask(MemoryRegion *mr)
 {
     uint8_t mask = mr->dirty_log_mask;
 diff --git a/system/physmem.c b/system/physmem.c
 index a4fe3d2bf8..f5dfa20e57 100644
 --- a/system/physmem.c
 +++ b/system/physmem.c
@@ -1808,6 +1808,7 @@ static void ram_block_add(RAMBlock *new_block, Error **errp)
     const bool shared = qemu_ram_is_shared(new_block);
     RAMBlock *block;
     RAMBlock *last_block = NULL;
 +    bool free_on_error = false;
     ram_addr_t old_ram_size, new_ram_size;
     Error *err = NULL;
@@ -1837,6 +1838,19 @@ static void ram_block_add(RAMBlock *new_block, Error **errp)
                 return;
             }
             memory_try_enable_merging(new_block->host, new_block->max_length);
 +            free_on_error = true;
 +        }
 +    }
 +
 +    if (new_block->flags & RAM_GUEST_MEMFD) {
 +        assert(kvm_enabled());
 +        assert(new_block->guest_memfd < 0);
 +
 +        new_block->guest_memfd = kvm_create_guest_memfd(new_block->max_length,
 +                                                        0, errp);
 +        if (new_block->guest_memfd < 0) {
 +            qemu_mutex_unlock_ramlist();
 +            goto out_free;
         }
     }
@@ -1888,6 +1902,13 @@ static void ram_block_add(RAMBlock *new_block, Error **errp)
         ram_block_notify_add(new_block->host, new_block->used_length,
                              new_block->max_length);
     }
 +    return;
 +
 +out_free:
 +    if (free_on_error) {
 +        qemu_anon_ram_free(new_block->host, new_block->max_length);
 +        new_block->host = NULL;
 +    }
 }
 #ifdef CONFIG_POSIX
@@ -1902,7 +1923,7 @@ RAMBlock *qemu_ram_alloc_from_fd(ram_addr_t size, MemoryRegion *mr,
     /* Just support these ram flags by now. */
     assert((ram_flags & ~(RAM_SHARED | RAM_PMEM | RAM_NORESERVE |
                           RAM_PROTECTED | RAM_NAMED_FILE | RAM_READONLY |
 -                          RAM_READONLY_FD)) == 0);
 +                          RAM_READONLY_FD | RAM_GUEST_MEMFD)) == 0);
     if (xen_enabled()) {
         error_setg(errp, "-mem-path not supported with Xen");
@@ -1939,6 +1960,7 @@ RAMBlock *qemu_ram_alloc_from_fd(ram_addr_t size, MemoryRegion *mr,
     new_block->used_length = size;
     new_block->max_length = size;
     new_block->flags = ram_flags;
 +    new_block->guest_memfd = -1;
     new_block->host = file_ram_alloc(new_block, size, fd, !file_size, offset,
                                      errp);
     if (!new_block->host) {
@@ -2018,7 +2040,7 @@ RAMBlock *qemu_ram_alloc_internal(ram_addr_t size, ram_addr_t max_size,
     int align;
     assert((ram_flags & ~(RAM_SHARED | RAM_RESIZEABLE | RAM_PREALLOC |
 -                          RAM_NORESERVE)) == 0);
 +                          RAM_NORESERVE | RAM_GUEST_MEMFD)) == 0);
     assert(!host ^ (ram_flags & RAM_PREALLOC));
     align = qemu_real_host_page_size();
@@ -2033,6 +2055,7 @@ RAMBlock *qemu_ram_alloc_internal(ram_addr_t size, ram_addr_t max_size,
     new_block->max_length = max_size;
     assert(max_size >= size);
     new_block->fd = -1;
 +    new_block->guest_memfd = -1;
     new_block->page_size = qemu_real_host_page_size();
     new_block->host = host;
     new_block->flags = ram_flags;
@@ -2055,7 +2078,7 @@ RAMBlock *qemu_ram_alloc_from_ptr(ram_addr_t size, void *host,
 RAMBlock *qemu_ram_alloc(ram_addr_t size, uint32_t ram_flags,
                          MemoryRegion *mr, Error **errp)
 {
 -    assert((ram_flags & ~(RAM_SHARED | RAM_NORESERVE)) == 0);
 +    assert((ram_flags & ~(RAM_SHARED | RAM_NORESERVE | RAM_GUEST_MEMFD)) == 0);
     return qemu_ram_alloc_internal(size, size, NULL, NULL, ram_flags, mr, errp);
 }
@@ -2083,6 +2106,11 @@ static void reclaim_ramblock(RAMBlock *block)
     } else {
         qemu_anon_ram_free(block->host, block->max_length);
     }
 +
 +    if (block->guest_memfd >= 0) {
 +        close(block->guest_memfd);
 +    }
 +
     g_free(block);
 }
 -- 
 2.39.3
--- a/SOURCES/kvm-RAMBlock-make-guest_memfd-require-uncoordinated-disc.patch
+++ b/SOURCES/kvm-RAMBlock-make-guest_memfd-require-uncoordinated-disc.patch
@ -1,82 +0,0 @@
 From bd289293604d6f33e9fb89196f0b19117ce81f89 Mon Sep 17 00:00:00 2001
 From: Paolo Bonzini <pbonzini@redhat.com>
 Date: Wed, 20 Mar 2024 17:45:29 +0100
 Subject: [PATCH 032/100] RAMBlock: make guest_memfd require uncoordinated
 discard
 RH-Author: Paolo Bonzini <pbonzini@redhat.com>
 RH-MergeRequest: 245: SEV-SNP support
 RH-Jira: RHEL-39544
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Bandan Das <bdas@redhat.com>
 RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
 RH-Commit: [32/91] 0c005849026c334737b88cbd20a0ac237dfca37e (bonzini/rhel-qemu-kvm)
 Some subsystems like VFIO might disable ram block discard, but guest_memfd
 uses discard operations to implement conversions between private and
 shared memory.  Because of this, sequences like the following can result
 in stale IOMMU mappings:
 1. allocate shared page
 2. convert page shared->private
 3. discard shared page
 4. convert page private->shared
 5. allocate shared page
 6. issue DMA operations against that shared page
 This is not a use-after-free, because after step 3 VFIO is still pinning
 the page.  However, DMA operations in step 6 will hit the old mapping
 that was allocated in step 1.
 Address this by taking ram_block_discard_is_enabled() into account when
 deciding whether or not to discard pages.
 Since kvm_convert_memory()/guest_memfd doesn't implement a
 RamDiscardManager handler to convey and replay discard operations,
 this is a case of uncoordinated discard, which is blocked/released
 by ram_block_discard_require().  Interestingly, this function had
 no use so far.
 Alternative approaches would be to block discard of shared pages, but
 this would cause guests to consume twice the memory if they use VFIO;
 or to implement a RamDiscardManager and only block uncoordinated
 discard, i.e. use ram_block_coordinated_discard_require().
 [Commit message mostly by Michael Roth <michael.roth@amd.com>]
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 (cherry picked from commit 852f0048f3ea9f14de18eb279a99fccb6d250e8f)
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 ---
 system/physmem.c | 8 ++++++++
 1 file changed, 8 insertions(+)
 diff --git a/system/physmem.c b/system/physmem.c
 index f5dfa20e57..5ebcf5be11 100644
 --- a/system/physmem.c
 +++ b/system/physmem.c
@@ -1846,6 +1846,13 @@ static void ram_block_add(RAMBlock *new_block, Error **errp)
         assert(kvm_enabled());
         assert(new_block->guest_memfd < 0);
 +        if (ram_block_discard_require(true) < 0) {
 +            error_setg_errno(errp, errno,
 +                             "cannot set up private guest memory: discard currently blocked");
 +            error_append_hint(errp, "Are you using assigned devices?\n");
 +            goto out_free;
 +        }
 +
         new_block->guest_memfd = kvm_create_guest_memfd(new_block->max_length,
                                                         0, errp);
         if (new_block->guest_memfd < 0) {
@@ -2109,6 +2116,7 @@ static void reclaim_ramblock(RAMBlock *block)
     if (block->guest_memfd >= 0) {
         close(block->guest_memfd);
 +        ram_block_discard_require(false);
     }
     g_free(block);
 -- 
 2.39.3
--- a/SOURCES/kvm-RHEL-Enable-x-not-migrate-acpi-index-for-all-pre-RHE.patch
+++ b/SOURCES/kvm-RHEL-Enable-x-not-migrate-acpi-index-for-all-pre-RHE.patch
@ -0,0 +1,43 @@
 From f1480fe9a4054113ddacd218961e29f31c33d329 Mon Sep 17 00:00:00 2001
 From: Peter Xu <peterx@redhat.com>
 Date: Wed, 6 Sep 2023 16:29:23 -0400
 Subject: [PATCH 2/3] RHEL: Enable "x-not-migrate-acpi-index" for all pre-RHEL8
 guests
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Peter Xu <peterx@redhat.com>
 RH-MergeRequest: 343: acpi: fix acpi_index migration
 RH-Jira: RHEL-20189
 RH-Acked-by: Leonardo Brás <leobras@redhat.com>
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 RH-Acked-by: Prasad Pandit <None>
 RH-Commit: [2/2] 0a26a71236e68dd7feb5d2063254090e3852d6ba
 The acpi index migration is simply broken before for all pre-RHEL8
 branches.  Don't migrate it for all of them.
 Signed-off-by: Peter Xu <peterx@redhat.com>
 ---
 hw/core/machine.c | 4 ++++
 1 file changed, 4 insertions(+)
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index 2724f6848a..6650a3d7b7 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -44,6 +44,10 @@ GlobalProperty hw_compat_rhel_8_6[] = {
      * we need do disable it downstream on the latest hw_compat_rhel_8.
      */
     { "vhost-vsock-device", "seqpacket", "off" },
 +    /*
 +     * RHEL-2186: all rhel8 machines should not migrate acpi index.
 +     */
 +    { "PIIX4_PM", "x-not-migrate-acpi-index", "on"},
 };
 const size_t hw_compat_rhel_8_6_len = G_N_ELEMENTS(hw_compat_rhel_8_6);
 -- 
 2.41.0
--- a/SOURCES/kvm-RHEL-disable-seqpacket-for-vhost-vsock-device-in-rhe.patch
+++ b/SOURCES/kvm-RHEL-disable-seqpacket-for-vhost-vsock-device-in-rhe.patch
@ -0,0 +1,107 @@
 From e0e4f01c6f4fb5881960f72ae4e80951b711131e Mon Sep 17 00:00:00 2001
 From: Stefano Garzarella <sgarzare@redhat.com>
 Date: Thu, 24 Mar 2022 16:04:57 +0100
 Subject: [PATCH 1/5] RHEL: disable "seqpacket" for "vhost-vsock-device" in
 rhel8.6.0
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Stefano Garzarella <sgarzare@redhat.com>
 RH-MergeRequest: 136: RHEL: disable "seqpacket" for "vhost-vsock-device" in rhel8.6.0 [rhel-8.7.0]
 RH-Commit: [1/1] d82ea09e123679521503689f7d9af1c03dc71bfc
 RH-Bugzilla: 2068202
 RH-Acked-by: Jason Wang <None>
 RH-Acked-by: Eugenio Pérez <None>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 vhost-vsock device in RHEL 8 kernels doesn't support seqpacket.
 To avoid problems when migrating a VM from RHEL 9 host, we need to
 disable it in rhel8-* machine types.
 Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
 ---
 hw/core/machine.c          | 10 ++++++++++
 hw/i386/pc_piix.c          |  2 ++
 hw/i386/pc_q35.c           |  2 ++
 hw/s390x/s390-virtio-ccw.c |  1 +
 include/hw/boards.h        |  3 +++
 5 files changed, 18 insertions(+)
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index 024b025fc2..76fcabec7a 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -37,6 +37,16 @@
 #include "hw/virtio/virtio.h"
 #include "hw/virtio/virtio-pci.h"
 +GlobalProperty hw_compat_rhel_8_6[] = {
 +    /* hw_compat_rhel_8_6 bz 2068202 */
 +    /*
 +     * vhost-vsock device in RHEL 8 kernels doesn't support seqpacket, so
 +     * we need do disable it downstream on the latest hw_compat_rhel_8.
 +     */
 +    { "vhost-vsock-device", "seqpacket", "off" },
 +};
 +const size_t hw_compat_rhel_8_6_len = G_N_ELEMENTS(hw_compat_rhel_8_6);
 +
 /*
  * Mostly the same as hw_compat_6_0 and hw_compat_6_1
  */
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
 index f03a8f0db8..ab6d03e07a 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
@@ -998,6 +998,8 @@ static void pc_machine_rhel760_options(MachineClass *m)
     pcmc->kvmclock_create_always = false;
     /* From pc_i440fx_5_1_machine_options() */
     pcmc->pci_root_uid = 1;
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_6,
 +                     hw_compat_rhel_8_6_len);
     compat_props_add(m->compat_props, hw_compat_rhel_8_5,
                      hw_compat_rhel_8_5_len);
     compat_props_add(m->compat_props, pc_rhel_8_5_compat,
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
 index 5559261d9e..882fe7a68d 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
@@ -658,6 +658,8 @@ static void pc_q35_machine_rhel860_options(MachineClass *m)
     m->desc = "RHEL-8.6.0 PC (Q35 + ICH9, 2009)";
     pcmc->smbios_stream_product = "RHEL-AV";
     pcmc->smbios_stream_version = "8.6.0";
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_6,
 +                     hw_compat_rhel_8_6_len);
 }
 DEFINE_PC_MACHINE(q35_rhel860, "pc-q35-rhel8.6.0", pc_q35_init_rhel860,
 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
 index 9795eb9406..bec270598b 100644
 --- a/hw/s390x/s390-virtio-ccw.c
 +++ b/hw/s390x/s390-virtio-ccw.c
@@ -1109,6 +1109,7 @@ static void ccw_machine_rhel860_instance_options(MachineState *machine)
 static void ccw_machine_rhel860_class_options(MachineClass *mc)
 {
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_6, hw_compat_rhel_8_6_len);
 }
 DEFINE_CCW_MACHINE(rhel860, "rhel8.6.0", true);
 diff --git a/include/hw/boards.h b/include/hw/boards.h
 index 04e8759815..4ddb798144 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
@@ -443,6 +443,9 @@ extern const size_t hw_compat_2_2_len;
 extern GlobalProperty hw_compat_2_1[];
 extern const size_t hw_compat_2_1_len;
 +extern GlobalProperty hw_compat_rhel_8_6[];
 +extern const size_t hw_compat_rhel_8_6_len;
 +
 extern GlobalProperty hw_compat_rhel_8_5[];
 extern const size_t hw_compat_rhel_8_5_len;
 -- 
 2.27.0
--- a/SOURCES/kvm-Revert-monitor-use-aio_co_reschedule_self.patch
+++ b/SOURCES/kvm-Revert-monitor-use-aio_co_reschedule_self.patch
@ -1,67 +0,0 @@
 From d4e6f7105b00ba2536d5d733b7c03116f28ce116 Mon Sep 17 00:00:00 2001
 From: Stefan Hajnoczi <stefanha@redhat.com>
 Date: Mon, 6 May 2024 15:06:21 -0400
 Subject: [PATCH 2/5] Revert "monitor: use aio_co_reschedule_self()"
 RH-Author: Kevin Wolf <kwolf@redhat.com>
 RH-MergeRequest: 248: Revert "monitor: use aio_co_reschedule_self()"
 RH-Jira: RHEL-34618 RHEL-38697
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [1/2] b6a2ebd4a69dbcd2bd56c61e7c747f8f8f42337e (kmwolf/centos-qemu-kvm)
 Commit 1f25c172f837 ("monitor: use aio_co_reschedule_self()") was a code
 cleanup that uses aio_co_reschedule_self() instead of open coding
 coroutine rescheduling.
 Bug RHEL-34618 was reported and Kevin Wolf <kwolf@redhat.com> identified
 the root cause. I missed that aio_co_reschedule_self() ->
 qemu_get_current_aio_context() only knows about
 qemu_aio_context/IOThread AioContexts and not about iohandler_ctx. It
 does not function correctly when going back from the iohandler_ctx to
 qemu_aio_context.
 Go back to open coding the AioContext transitions to avoid this bug.
 This reverts commit 1f25c172f83704e350c0829438d832384084a74d.
 Cc: qemu-stable@nongnu.org
 Buglink: https://issues.redhat.com/browse/RHEL-34618
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Message-ID: <20240506190622.56095-2-stefanha@redhat.com>
 Reviewed-by: Kevin Wolf <kwolf@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit 719c6819ed9a9838520fa732f9861918dc693bda)
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
 qapi/qmp-dispatch.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)
 diff --git a/qapi/qmp-dispatch.c b/qapi/qmp-dispatch.c
 index f3488afeef..176b549473 100644
 --- a/qapi/qmp-dispatch.c
 +++ b/qapi/qmp-dispatch.c
@@ -212,7 +212,8 @@ QDict *coroutine_mixed_fn qmp_dispatch(const QmpCommandList *cmds, QObject *requ
              * executing the command handler so that it can make progress if it
              * involves an AIO_WAIT_WHILE().
              */
 -            aio_co_reschedule_self(qemu_get_aio_context());
 +            aio_co_schedule(qemu_get_aio_context(), qemu_coroutine_self());
 +            qemu_coroutine_yield();
         }
         monitor_set_cur(qemu_coroutine_self(), cur_mon);
@@ -226,7 +227,9 @@ QDict *coroutine_mixed_fn qmp_dispatch(const QmpCommandList *cmds, QObject *requ
              * Move back to iohandler_ctx so that nested event loops for
              * qemu_aio_context don't start new monitor commands.
              */
 -            aio_co_reschedule_self(iohandler_get_aio_context());
 +            aio_co_schedule(iohandler_get_aio_context(),
 +                            qemu_coroutine_self());
 +            qemu_coroutine_yield();
         }
     } else {
        /*
 -- 
 2.39.3
--- a/SOURCES/kvm-Revert-redhat-Add-hw_compat_4_2_extra-and-apply-to-u.patch
+++ b/SOURCES/kvm-Revert-redhat-Add-hw_compat_4_2_extra-and-apply-to-u.patch
@ -0,0 +1,93 @@
 From e626dc16d130c724c400b99a93daad0a9abeae59 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Tue, 22 Mar 2022 19:23:36 -0400
 Subject: [PATCH 01/18] Revert "redhat: Add hw_compat_4_2_extra and apply to
 upstream machines"
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 131: Revert "redhat: Add hw_compat_4_2_extra and apply to upstream machines"
 RH-Commit: [1/3] 47b7d9e5062f5e215d5ed1a3ecdc1a87ac3fa630 (jmaloy/qemu-kvm)
 RH-Bugzilla: 2062613
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 BZ: https://bugzilla.redhat.com/2062613
 UPSTREAM: no
 BREW: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=44038000
 commit dc2e9ec1e014950c7918e23a3e9b0096b34a4a92
 Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Date:   Wed Mar 9 10:31:53 2022 +0000
    Revert "redhat: Add hw_compat_4_2_extra and apply to upstream machines"
    This reverts commit 66882f9a3230246409f3918424aca26add5c034a.
    We no longer need these compat machines it was added for.
    Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 (cherry picked from commit dc2e9ec1e014950c7918e23a3e9b0096b34a4a92)
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 hw/i386/pc.c         | 12 ------------
 hw/i386/pc_piix.c    |  6 ------
 include/hw/i386/pc.h |  3 ---
 3 files changed, 21 deletions(-)
 diff --git a/hw/i386/pc.c b/hw/i386/pc.c
 index 4c08a1971c..357257349b 100644
 --- a/hw/i386/pc.c
 +++ b/hw/i386/pc.c
@@ -670,18 +670,6 @@ GlobalProperty pc_rhel_7_0_compat[] = {
 };
 const size_t pc_rhel_7_0_compat_len = G_N_ELEMENTS(pc_rhel_7_0_compat);
 -/*
 - * RHEL: These properties only apply to the RHEL exported machine types
 - * pc-4.2/2.11 for the purpose to have a limited upstream machines support
 - * which can be migrated to RHEL.  Let's avoid touching hw_compat_4_2 directly
 - * so that we can have some isolation against the upstream code.
 - */
 -GlobalProperty hw_compat_4_2_extra[] = {
 -    /* By default enlarge the default virtio-net-pci ROM to 512KB. */
 -    { "virtio-net-pci", "romsize", "0x80000" },
 -};
 -const size_t hw_compat_4_2_extra_len = G_N_ELEMENTS(hw_compat_4_2_extra);
 -
 GSIState *pc_gsi_create(qemu_irq **irqs, bool pci_enabled)
 {
     GSIState *s;
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
 index c30057c443..7b7076cbc7 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
@@ -531,12 +531,6 @@ static void pc_i440fx_4_2_machine_options(MachineClass *m)
      * supported by RHEL, even if exported.
      */
     m->deprecation_reason = "Not supported by RHEL";
 -    /*
 -     * RHEL: Specific compat properties to have limited support for upstream
 -     * machines exported.
 -     */
 -    compat_props_add(m->compat_props, hw_compat_4_2_extra,
 -                     hw_compat_4_2_extra_len);
 }
 /* RHEL: Export pc-4.2 */
 diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
 index 9e8bfb69f8..4a593acb50 100644
 --- a/include/hw/i386/pc.h
 +++ b/include/hw/i386/pc.h
@@ -325,9 +325,6 @@ extern const size_t pc_rhel_7_1_compat_len;
 extern GlobalProperty pc_rhel_7_0_compat[];
 extern const size_t pc_rhel_7_0_compat_len;
 -extern GlobalProperty hw_compat_4_2_extra[];
 -extern const size_t hw_compat_4_2_extra_len;
 -
 /* Helper for setting model-id for CPU models that changed model-id
  * depending on QEMU versions up to QEMU 2.4.
  */
 -- 
 2.27.0
--- a/SOURCES/kvm-Revert-redhat-Add-some-devices-for-exporting-upstrea.patch
+++ b/SOURCES/kvm-Revert-redhat-Add-some-devices-for-exporting-upstrea.patch
@ -0,0 +1,128 @@
 From 96edd15df257f1d1496397a6fac24b4316570d7e Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Thu, 14 Apr 2022 16:45:30 -0400
 Subject: [PATCH 1/3] Revert redhat: Add some devices for exporting upstream
 machine types
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 156: Revert redhat: Add some devices for exporting upstream machine types
 RH-Commit: [1/1] f25d0da3a181136917ead82f5a5c59efe3fa445a (jmaloy/qemu-kvm)
 RH-Bugzilla: 2065043
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2065043
 Upstream: no
 Manual revert of commit 70d3924521c9bfd912bcf1a1fc76f49eb377de46, since
 the directory structure looks different from rhel-av-8.4.0.z where
 this commit is taken from. Besides, x86_64-softmmu.mak looks totally
 different and should not be affected by this reversal.
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 configs/devices/x86_64-softmmu/x86_64-rh-devices.mak     | 1 -
 .../devices/x86_64-softmmu/x86_64-upstream-devices.mak   | 4 ----
 hw/char/parallel.c                                       | 9 ---------
 hw/i386/pc_piix.c                                        | 2 +-
 hw/i386/pc_q35.c                                         | 2 +-
 hw/timer/hpet.c                                          | 8 --------
 6 files changed, 2 insertions(+), 24 deletions(-)
 delete mode 100644 configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak
 diff --git a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 index fdbbdf9742..31ce08edab 100644
 --- a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 +++ b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
@@ -1,5 +1,4 @@
 include ../rh-virtio.mak
 -include x86_64-upstream-devices.mak
 CONFIG_AC97=y
 CONFIG_ACPI=y
 diff --git a/configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak b/configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak
 deleted file mode 100644
 index 2cd20f54d2..0000000000
 --- a/configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak
 +++ /dev/null
@@ -1,4 +0,0 @@
 -# We need "isa-parallel"
 -CONFIG_PARALLEL=y
 -# We need "hpet"
 -CONFIG_HPET=y
 diff --git a/hw/char/parallel.c b/hw/char/parallel.c
 index e5f108211b..b45e67bfbb 100644
 --- a/hw/char/parallel.c
 +++ b/hw/char/parallel.c
@@ -29,7 +29,6 @@
 #include "chardev/char-parallel.h"
 #include "chardev/char-fe.h"
 #include "hw/acpi/aml-build.h"
 -#include "hw/boards.h"
 #include "hw/irq.h"
 #include "hw/isa/isa.h"
 #include "hw/qdev-properties.h"
@@ -535,14 +534,6 @@ static void parallel_isa_realizefn(DeviceState *dev, Error **errp)
     int base;
     uint8_t dummy;
 -    /* Restricted for Red Hat Enterprise Linux */
 -    MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
 -    if (strstr(mc->name, "rhel")) {
 -        error_setg(errp, "Device %s is not supported with machine type %s",
 -                   object_get_typename(OBJECT(dev)), mc->name);
 -        return;
 -    }
 -
     if (!qemu_chr_fe_backend_connected(&s->chr)) {
         error_setg(errp, "Can't create parallel device, empty char device");
         return;
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
 index ab6d03e07a..5f101c8748 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
@@ -966,7 +966,7 @@ static void pc_machine_rhel7_options(MachineClass *m)
 {
     PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
     m->family = "pc_piix_Y";
 -    m->default_machine_opts = "firmware=bios-256k.bin,hpet=off";
 +    m->default_machine_opts = "firmware=bios-256k.bin";
     pcmc->default_nic_model = "e1000";
     pcmc->pci_root_uid = 0;
     m->default_display = "std";
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
 index 882fe7a68d..73b0d0d317 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
@@ -633,7 +633,7 @@ static void pc_q35_machine_rhel_options(MachineClass *m)
     pcmc->pci_root_uid = 0;
     m->family = "pc_q35_Z";
     m->units_per_default_bus = 1;
 -    m->default_machine_opts = "firmware=bios-256k.bin,hpet=off";
 +    m->default_machine_opts = "firmware=bios-256k.bin";
     m->default_display = "std";
     m->no_floppy = 1;
     m->no_parallel = 1;
 diff --git a/hw/timer/hpet.c b/hw/timer/hpet.c
 index 202e032524..9520471be2 100644
 --- a/hw/timer/hpet.c
 +++ b/hw/timer/hpet.c
@@ -733,14 +733,6 @@ static void hpet_realize(DeviceState *dev, Error **errp)
     int i;
     HPETTimer *timer;
 -    /* Restricted for Red Hat Enterprise Linux */
 -    MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
 -    if (strstr(mc->name, "rhel")) {
 -        error_setg(errp, "Device %s is not supported with machine type %s",
 -                   object_get_typename(OBJECT(dev)), mc->name);
 -        return;
 -    }
 -
     if (!s->intcap) {
         warn_report("Hpet's intcap not initialized");
     }
 -- 
 2.35.1
--- a/SOURCES/kvm-Revert-redhat-Enable-FDC-device-for-upstream-machine.patch
+++ b/SOURCES/kvm-Revert-redhat-Enable-FDC-device-for-upstream-machine.patch
@ -0,0 +1,53 @@
 From 5bf8f1d69fea1225e927fbb3efe549a2a9d47d92 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Tue, 22 Mar 2022 19:23:36 -0400
 Subject: [PATCH 02/18] Revert "redhat: Enable FDC device for upstream machines
 too"
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 131: Revert "redhat: Add hw_compat_4_2_extra and apply to upstream machines"
 RH-Commit: [2/3] 4e3c945e3de9bb9d9a6d24115f0719168c9669fe (jmaloy/qemu-kvm)
 RH-Bugzilla: 2062613
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 BZ: https://bugzilla.redhat.com/2062613
 UPSTREAM: no
 BREW: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=44038000
 commit 597cb6ca1da4a3eea77c1e4928f55203a1d5c70c
 Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Date:   Wed Mar 9 10:32:39 2022 +0000
    Revert "redhat: Enable FDC device for upstream machines too"
    This reverts commit c4d1aa8bf21fe98da94a9cff30b7c25bed12c17f.
    We no longer need these compat machines it was added for.
  Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 (cherry picked from commit 597cb6ca1da4a3eea77c1e4928f55203a1d5c70c)
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 hw/block/fdc.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)
 diff --git a/hw/block/fdc.c b/hw/block/fdc.c
 index 63042ef030..97fa6de423 100644
 --- a/hw/block/fdc.c
 +++ b/hw/block/fdc.c
@@ -2341,10 +2341,7 @@ void fdctrl_realize_common(DeviceState *dev, FDCtrl *fdctrl, Error **errp)
     /* Restricted for Red Hat Enterprise Linux: */
     MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
 -    if (!strstr(mc->name, "-rhel7.") &&
 -        /* Exported two upstream machine types allows FDC too */
 -        strcmp(mc->name, "pc-i440fx-4.2") &&
 -        strcmp(mc->name, "pc-i440fx-2.11")) {
 +    if (!strstr(mc->name, "-rhel7.")) {
         error_setg(errp, "Device %s is not supported with machine type %s",
                    object_get_typename(OBJECT(dev)), mc->name);
         return;
 -- 
 2.27.0
--- a/SOURCES/kvm-Revert-redhat-Expose-upstream-machines-pc-4.2-and-pc.patch
+++ b/SOURCES/kvm-Revert-redhat-Expose-upstream-machines-pc-4.2-and-pc.patch
@ -0,0 +1,191 @@
 From ee3cae3bb349469edcf725a1c5161521e95dcb9f Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Tue, 22 Mar 2022 19:23:36 -0400
 Subject: [PATCH 03/18] Revert "redhat: Expose upstream machines pc-4.2 and
 pc-2.11"
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 131: Revert "redhat: Add hw_compat_4_2_extra and apply to upstream machines"
 RH-Commit: [3/3] 35cee68034580f81b3aa916921eecd2fdfa7dd15 (jmaloy/qemu-kvm)
 RH-Bugzilla: 2062613
 RH-Acked-by: Peter Xu <peterx@redhat.com>
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 BZ: https://bugzilla.redhat.com/2062613
 UPSTREAM: no
 BREW: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=44038000
 commit f3b50d6d4ae0be9e64aafe6a15f5423bab4899e9
 Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Date:   Wed Mar 9 10:34:58 2022 +0000
    Revert "redhat: Expose upstream machines pc-4.2 and pc-2.11"
    This reverts commit 618e2424edba499d52cd26cf8363bc2dd85ef149.
    We no longer need these compat machines.
    Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 (cherry picked from commit f3b50d6d4ae0be9e64aafe6a15f5423bab4899e9)
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 hw/i386/pc_piix.c | 37 -------------------------------------
 1 file changed, 37 deletions(-)
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
 index 7b7076cbc7..f03a8f0db8 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
@@ -315,14 +315,6 @@ static void pc_init1(MachineState *machine,
  * hw_compat_*, pc_compat_*, or * pc_*_machine_options().
  */
 -/*
 - * NOTE!  Not all the upstream machine types are disabled for RHEL.  For
 - * providing a very limited support for upstream machine types, pc machines
 - * 2.11 and 4.2 are exposed explicitly.  This will make the below "#if" macros
 - * a bit messed up, but please read this comment first so that we can have a
 - * rough understanding of what we're going to do.
 - */
 -
 #if 0 /* Disabled for Red Hat Enterprise Linux */
 static void pc_compat_2_3_fn(MachineState *machine)
 {
@@ -399,8 +391,6 @@ static void pc_xen_hvm_init(MachineState *machine)
 }
 #endif
 -#endif /* Disabled for Red Hat Enterprise Linux */
 -
 #define DEFINE_I440FX_MACHINE(suffix, name, compatfn, optionfn) \
     static void pc_init_##suffix(MachineState *machine) \
     { \
@@ -465,10 +455,8 @@ static void pc_i440fx_6_0_machine_options(MachineClass *m)
     compat_props_add(m->compat_props, pc_compat_6_0, pc_compat_6_0_len);
 }
 -#if 0 /* Disabled for Red Hat Enterprise Linux */
 DEFINE_I440FX_MACHINE(v6_0, "pc-i440fx-6.0", NULL,
                       pc_i440fx_6_0_machine_options);
 -#endif /* Disabled for Red Hat Enterprise Linux */
 static void pc_i440fx_5_2_machine_options(MachineClass *m)
 {
@@ -479,10 +467,8 @@ static void pc_i440fx_5_2_machine_options(MachineClass *m)
     compat_props_add(m->compat_props, pc_compat_5_2, pc_compat_5_2_len);
 }
 -#if 0 /* Disabled for Red Hat Enterprise Linux */
 DEFINE_I440FX_MACHINE(v5_2, "pc-i440fx-5.2", NULL,
                       pc_i440fx_5_2_machine_options);
 -#endif /* Disabled for Red Hat Enterprise Linux */
 static void pc_i440fx_5_1_machine_options(MachineClass *m)
 {
@@ -497,10 +483,8 @@ static void pc_i440fx_5_1_machine_options(MachineClass *m)
     pcmc->pci_root_uid = 1;
 }
 -#if 0 /* Disabled for Red Hat Enterprise Linux */
 DEFINE_I440FX_MACHINE(v5_1, "pc-i440fx-5.1", NULL,
                       pc_i440fx_5_1_machine_options);
 -#endif /* Disabled for Red Hat Enterprise Linux */
 static void pc_i440fx_5_0_machine_options(MachineClass *m)
 {
@@ -513,10 +497,8 @@ static void pc_i440fx_5_0_machine_options(MachineClass *m)
     m->auto_enable_numa_with_memdev = false;
 }
 -#if 0 /* Disabled for Red Hat Enterprise Linux */
 DEFINE_I440FX_MACHINE(v5_0, "pc-i440fx-5.0", NULL,
                       pc_i440fx_5_0_machine_options);
 -#endif /* Disabled for Red Hat Enterprise Linux */
 static void pc_i440fx_4_2_machine_options(MachineClass *m)
 {
@@ -525,15 +507,8 @@ static void pc_i440fx_4_2_machine_options(MachineClass *m)
     m->is_default = false;
     compat_props_add(m->compat_props, hw_compat_4_2, hw_compat_4_2_len);
     compat_props_add(m->compat_props, pc_compat_4_2, pc_compat_4_2_len);
 -
 -    /*
 -     * RHEL: Mark all upstream machines as deprecated because they're not
 -     * supported by RHEL, even if exported.
 -     */
 -    m->deprecation_reason = "Not supported by RHEL";
 }
 -/* RHEL: Export pc-4.2 */
 DEFINE_I440FX_MACHINE(v4_2, "pc-i440fx-4.2", NULL,
                       pc_i440fx_4_2_machine_options);
@@ -546,10 +521,8 @@ static void pc_i440fx_4_1_machine_options(MachineClass *m)
     compat_props_add(m->compat_props, pc_compat_4_1, pc_compat_4_1_len);
 }
 -#if 0 /* Disabled for Red Hat Enterprise Linux */
 DEFINE_I440FX_MACHINE(v4_1, "pc-i440fx-4.1", NULL,
                       pc_i440fx_4_1_machine_options);
 -#endif /* Disabled for Red Hat Enterprise Linux */
 static void pc_i440fx_4_0_machine_options(MachineClass *m)
 {
@@ -562,10 +535,8 @@ static void pc_i440fx_4_0_machine_options(MachineClass *m)
     compat_props_add(m->compat_props, pc_compat_4_0, pc_compat_4_0_len);
 }
 -#if 0 /* Disabled for Red Hat Enterprise Linux */
 DEFINE_I440FX_MACHINE(v4_0, "pc-i440fx-4.0", NULL,
                       pc_i440fx_4_0_machine_options);
 -#endif /* Disabled for Red Hat Enterprise Linux */
 static void pc_i440fx_3_1_machine_options(MachineClass *m)
 {
@@ -581,10 +552,8 @@ static void pc_i440fx_3_1_machine_options(MachineClass *m)
     compat_props_add(m->compat_props, pc_compat_3_1, pc_compat_3_1_len);
 }
 -#if 0 /* Disabled for Red Hat Enterprise Linux */
 DEFINE_I440FX_MACHINE(v3_1, "pc-i440fx-3.1", NULL,
                       pc_i440fx_3_1_machine_options);
 -#endif /* Disabled for Red Hat Enterprise Linux */
 static void pc_i440fx_3_0_machine_options(MachineClass *m)
 {
@@ -593,10 +562,8 @@ static void pc_i440fx_3_0_machine_options(MachineClass *m)
     compat_props_add(m->compat_props, pc_compat_3_0, pc_compat_3_0_len);
 }
 -#if 0 /* Disabled for Red Hat Enterprise Linux */
 DEFINE_I440FX_MACHINE(v3_0, "pc-i440fx-3.0", NULL,
                       pc_i440fx_3_0_machine_options);
 -#endif /* Disabled for Red Hat Enterprise Linux */
 static void pc_i440fx_2_12_machine_options(MachineClass *m)
 {
@@ -605,10 +572,8 @@ static void pc_i440fx_2_12_machine_options(MachineClass *m)
     compat_props_add(m->compat_props, pc_compat_2_12, pc_compat_2_12_len);
 }
 -#if 0 /* Disabled for Red Hat Enterprise Linux */
 DEFINE_I440FX_MACHINE(v2_12, "pc-i440fx-2.12", NULL,
                       pc_i440fx_2_12_machine_options);
 -#endif /* Disabled for Red Hat Enterprise Linux */
 static void pc_i440fx_2_11_machine_options(MachineClass *m)
 {
@@ -617,11 +582,9 @@ static void pc_i440fx_2_11_machine_options(MachineClass *m)
     compat_props_add(m->compat_props, pc_compat_2_11, pc_compat_2_11_len);
 }
 -/* RHEL: Export pc-2.11 */
 DEFINE_I440FX_MACHINE(v2_11, "pc-i440fx-2.11", NULL,
                       pc_i440fx_2_11_machine_options);
 -#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void pc_i440fx_2_10_machine_options(MachineClass *m)
 {
     pc_i440fx_2_11_machine_options(m);
 -- 
 2.27.0
--- a/SOURCES/kvm-Revert-x86-rhel-9.4.0-machine-type-compat-fix.patch
+++ b/SOURCES/kvm-Revert-x86-rhel-9.4.0-machine-type-compat-fix.patch
@ -1,38 +0,0 @@
 From bcbc897cb19b3a6523de611f48f6bac6cea16c97 Mon Sep 17 00:00:00 2001
 From: Sebastian Ott <sebott@redhat.com>
 Date: Thu, 2 May 2024 13:17:03 +0200
 Subject: [PATCH 2/2] Revert "x86: rhel 9.4.0 machine type compat fix"
 RH-Author: Sebastian Ott <sebott@redhat.com>
 RH-MergeRequest: 237: Revert "x86: rhel 9.4.0 machine type compat fix"
 RH-Jira: RHEL-30362
 RH-Acked-by: Ani Sinha <anisinha@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [1/1] 858ec153e65e96c39ca4db17ed93fd58c77dc2eb (seott1/cos-qemu-kvm)
 This reverts commit c46e44f0f4e861fe412ce679b0b0204881c1c2f5.
 pc-q35-rhel9.4.0 and newer should stay with SMBIOS_ENTRY_POINT_TYPE_AUTO.
 Signed-off-by: Sebastian Ott <sebott@redhat.com>
 ---
 hw/i386/pc_q35.c | 3 ---
 1 file changed, 3 deletions(-)
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
 index 2f11f9af7d..2b54944c0f 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
@@ -734,9 +734,6 @@ static void pc_q35_machine_rhel940_options(MachineClass *m)
     pcmc->smbios_stream_product = "RHEL";
     pcmc->smbios_stream_version = "9.4.0";
 -    /* From pc_q35_8_2_machine_options() - use SMBIOS 3.X by default */
 -    pcmc->default_smbios_ep_type = SMBIOS_ENTRY_POINT_TYPE_64;
 -
     compat_props_add(m->compat_props, hw_compat_rhel_9_5,
 		     hw_compat_rhel_9_5_len);
 }
 -- 
 2.39.3
--- a/SOURCES/kvm-Update-linux-headers-to-v6.0-rc4.patch
+++ b/SOURCES/kvm-Update-linux-headers-to-v6.0-rc4.patch
@ -0,0 +1,171 @@
 From 10fc28b61a6fba1e6dc44fd544cf31c7f313c622 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
 Date: Fri, 28 Oct 2022 17:48:00 +0100
 Subject: [PATCH 05/42] Update linux headers to v6.0-rc4
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Cédric Le Goater <clg@redhat.com>
 RH-MergeRequest: 226: s390: Enhanced Interpretation for PCI Functions and Secure Execution guest dump
 RH-Bugzilla: 1664378 2043909
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
 RH-Commit: [5/41] ca55f497d1bf1e72179330f8f613781bf999d898
 Based on upstream commit d525f73f9186a5bc641b8caf0b2c9bb94e5aa963
 ("Update linux headers to v6.0-rc4"), but this is focusing only on the
 ZPCI and protected dump changes.
 Signed-off-by: Cédric Le Goater <clg@redhat.com>
 ---
 linux-headers/linux/kvm.h       | 87 +++++++++++++++++++++++++++++++++
 linux-headers/linux/vfio_zdev.h |  7 +++
 2 files changed, 94 insertions(+)
 diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h
 index 0d05d02ee4..c65930288c 100644
 --- a/linux-headers/linux/kvm.h
 +++ b/linux-headers/linux/kvm.h
@@ -1150,6 +1150,9 @@ struct kvm_ppc_resize_hpt {
 #define KVM_CAP_DISABLE_QUIRKS2 213
 /* #define KVM_CAP_VM_TSC_CONTROL 214 */
 #define KVM_CAP_SYSTEM_EVENT_DATA 215
 +#define KVM_CAP_S390_PROTECTED_DUMP 217
 +#define KVM_CAP_S390_ZPCI_OP 221
 +#define KVM_CAP_S390_CPU_TOPOLOGY 222
 #ifdef KVM_CAP_IRQ_ROUTING
@@ -1651,6 +1654,55 @@ struct kvm_s390_pv_unp {
 	__u64 tweak;
 };
 +enum pv_cmd_dmp_id {
 +	KVM_PV_DUMP_INIT,
 +	KVM_PV_DUMP_CONFIG_STOR_STATE,
 +	KVM_PV_DUMP_COMPLETE,
 +	KVM_PV_DUMP_CPU,
 +};
 +
 +struct kvm_s390_pv_dmp {
 +	__u64 subcmd;
 +	__u64 buff_addr;
 +	__u64 buff_len;
 +	__u64 gaddr;		/* For dump storage state */
 +	__u64 reserved[4];
 +};
 +
 +enum pv_cmd_info_id {
 +	KVM_PV_INFO_VM,
 +	KVM_PV_INFO_DUMP,
 +};
 +
 +struct kvm_s390_pv_info_dump {
 +	__u64 dump_cpu_buffer_len;
 +	__u64 dump_config_mem_buffer_per_1m;
 +	__u64 dump_config_finalize_len;
 +};
 +
 +struct kvm_s390_pv_info_vm {
 +	__u64 inst_calls_list[4];
 +	__u64 max_cpus;
 +	__u64 max_guests;
 +	__u64 max_guest_addr;
 +	__u64 feature_indication;
 +};
 +
 +struct kvm_s390_pv_info_header {
 +	__u32 id;
 +	__u32 len_max;
 +	__u32 len_written;
 +	__u32 reserved;
 +};
 +
 +struct kvm_s390_pv_info {
 +	struct kvm_s390_pv_info_header header;
 +	union {
 +		struct kvm_s390_pv_info_dump dump;
 +		struct kvm_s390_pv_info_vm vm;
 +	};
 +};
 +
 enum pv_cmd_id {
 	KVM_PV_ENABLE,
 	KVM_PV_DISABLE,
@@ -1659,6 +1711,8 @@ enum pv_cmd_id {
 	KVM_PV_VERIFY,
 	KVM_PV_PREP_RESET,
 	KVM_PV_UNSHARE_ALL,
 +	KVM_PV_INFO,
 +	KVM_PV_DUMP,
 };
 struct kvm_pv_cmd {
@@ -2066,4 +2120,37 @@ struct kvm_stats_desc {
 /* Available with KVM_CAP_XSAVE2 */
 #define KVM_GET_XSAVE2		  _IOR(KVMIO,  0xcf, struct kvm_xsave)
 +/* Available with KVM_CAP_S390_PROTECTED_DUMP */
 +#define KVM_S390_PV_CPU_COMMAND	_IOWR(KVMIO, 0xd0, struct kvm_pv_cmd)
 +
 +/* Available with KVM_CAP_S390_ZPCI_OP */
 +#define KVM_S390_ZPCI_OP         _IOW(KVMIO,  0xd1, struct kvm_s390_zpci_op)
 +
 +struct kvm_s390_zpci_op {
 +	/* in */
 +	__u32 fh;               /* target device */
 +	__u8  op;               /* operation to perform */
 +	__u8  pad[3];
 +	union {
 +		/* for KVM_S390_ZPCIOP_REG_AEN */
 +		struct {
 +			__u64 ibv;      /* Guest addr of interrupt bit vector */
 +			__u64 sb;       /* Guest addr of summary bit */
 +			__u32 flags;
 +			__u32 noi;      /* Number of interrupts */
 +			__u8 isc;       /* Guest interrupt subclass */
 +			__u8 sbo;       /* Offset of guest summary bit vector */
 +			__u16 pad;
 +		} reg_aen;
 +		__u64 reserved[8];
 +	} u;
 +};
 +
 +/* types for kvm_s390_zpci_op->op */
 +#define KVM_S390_ZPCIOP_REG_AEN                0
 +#define KVM_S390_ZPCIOP_DEREG_AEN      1
 +
 +/* flags for kvm_s390_zpci_op->u.reg_aen.flags */
 +#define KVM_S390_ZPCIOP_REGAEN_HOST    (1 << 0)
 +
 #endif /* __LINUX_KVM_H */
 diff --git a/linux-headers/linux/vfio_zdev.h b/linux-headers/linux/vfio_zdev.h
 index b4309397b6..77f2aff1f2 100644
 --- a/linux-headers/linux/vfio_zdev.h
 +++ b/linux-headers/linux/vfio_zdev.h
@@ -29,6 +29,9 @@ struct vfio_device_info_cap_zpci_base {
 	__u16 fmb_length;	/* Measurement Block Length (in bytes) */
 	__u8 pft;		/* PCI Function Type */
 	__u8 gid;		/* PCI function group ID */
 +	/* End of version 1 */
 +	__u32 fh;		/* PCI function handle */
 +	/* End of version 2 */
 };
 /**
@@ -47,6 +50,10 @@ struct vfio_device_info_cap_zpci_group {
 	__u16 noi;		/* Maximum number of MSIs */
 	__u16 maxstbl;		/* Maximum Store Block Length */
 	__u8 version;		/* Supported PCI Version */
 +	/* End of version 1 */
 +	__u8 reserved;
 +	__u16 imaxstbl;		/* Maximum Interpreted Store Block Length */
 +	/* End of version 2 */
 };
 /**
 -- 
 2.37.3
--- a/SOURCES/kvm-accel-introduce-accelerator-blocker-API.patch
+++ b/SOURCES/kvm-accel-introduce-accelerator-blocker-API.patch
@ -0,0 +1,349 @@
 From a5e7bb1f7a88efb5574266a76e80fd7604d19921 Mon Sep 17 00:00:00 2001
 From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date: Mon, 16 Jan 2023 07:49:59 -0500
 Subject: [PATCH 04/11] accel: introduce accelerator blocker API
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-MergeRequest: 247: accel: introduce accelerator blocker API
 RH-Bugzilla: 2161188
 RH-Acked-by: David Hildenbrand <david@redhat.com>
 RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [1/3] 9d3d7f9554974a79042c915763288cce07aef135
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2161188
 commit bd688fc93120fb3e28aa70e3dfdf567ccc1e0bc1
 Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date:   Fri Nov 11 10:47:56 2022 -0500
    accel: introduce accelerator blocker API
    This API allows the accelerators to prevent vcpus from issuing
    new ioctls while execting a critical section marked with the
    accel_ioctl_inhibit_begin/end functions.
    Note that all functions submitting ioctls must mark where the
    ioctl is being called with accel_{cpu_}ioctl_begin/end().
    This API requires the caller to always hold the BQL.
    API documentation is in sysemu/accel-blocker.h
    Internally, it uses a QemuLockCnt together with a per-CPU QemuLockCnt
    (to minimize cache line bouncing) to keep avoid that new ioctls
    run when the critical section starts, and a QemuEvent to wait
    that all running ioctls finish.
    Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
    Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
    Message-Id: <20221111154758.1372674-2-eesposit@redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 Conflicts:
 	util/meson.build: files are missing in rhel 8.8.0
 	namely int128.c, memalign.c and interval-tree.c
 Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 ---
 accel/accel-blocker.c          | 154 +++++++++++++++++++++++++++++++++
 accel/meson.build              |   2 +-
 hw/core/cpu-common.c           |   2 +
 include/hw/core/cpu.h          |   3 +
 include/sysemu/accel-blocker.h |  56 ++++++++++++
 util/meson.build               |   2 +-
 6 files changed, 217 insertions(+), 2 deletions(-)
 create mode 100644 accel/accel-blocker.c
 create mode 100644 include/sysemu/accel-blocker.h
 diff --git a/accel/accel-blocker.c b/accel/accel-blocker.c
 new file mode 100644
 index 0000000000..1e7f423462
 --- /dev/null
 +++ b/accel/accel-blocker.c
@@ -0,0 +1,154 @@
 +/*
 + * Lock to inhibit accelerator ioctls
 + *
 + * Copyright (c) 2022 Red Hat Inc.
 + *
 + * Author: Emanuele Giuseppe Esposito       <eesposit@redhat.com>
 + *
 + * Permission is hereby granted, free of charge, to any person obtaining a copy
 + * of this software and associated documentation files (the "Software"), to deal
 + * in the Software without restriction, including without limitation the rights
 + * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 + * copies of the Software, and to permit persons to whom the Software is
 + * furnished to do so, subject to the following conditions:
 + *
 + * The above copyright notice and this permission notice shall be included in
 + * all copies or substantial portions of the Software.
 + *
 + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 + * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 + * THE SOFTWARE.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qemu/thread.h"
 +#include "qemu/main-loop.h"
 +#include "hw/core/cpu.h"
 +#include "sysemu/accel-blocker.h"
 +
 +static QemuLockCnt accel_in_ioctl_lock;
 +static QemuEvent accel_in_ioctl_event;
 +
 +void accel_blocker_init(void)
 +{
 +    qemu_lockcnt_init(&accel_in_ioctl_lock);
 +    qemu_event_init(&accel_in_ioctl_event, false);
 +}
 +
 +void accel_ioctl_begin(void)
 +{
 +    if (likely(qemu_mutex_iothread_locked())) {
 +        return;
 +    }
 +
 +    /* block if lock is taken in kvm_ioctl_inhibit_begin() */
 +    qemu_lockcnt_inc(&accel_in_ioctl_lock);
 +}
 +
 +void accel_ioctl_end(void)
 +{
 +    if (likely(qemu_mutex_iothread_locked())) {
 +        return;
 +    }
 +
 +    qemu_lockcnt_dec(&accel_in_ioctl_lock);
 +    /* change event to SET. If event was BUSY, wake up all waiters */
 +    qemu_event_set(&accel_in_ioctl_event);
 +}
 +
 +void accel_cpu_ioctl_begin(CPUState *cpu)
 +{
 +    if (unlikely(qemu_mutex_iothread_locked())) {
 +        return;
 +    }
 +
 +    /* block if lock is taken in kvm_ioctl_inhibit_begin() */
 +    qemu_lockcnt_inc(&cpu->in_ioctl_lock);
 +}
 +
 +void accel_cpu_ioctl_end(CPUState *cpu)
 +{
 +    if (unlikely(qemu_mutex_iothread_locked())) {
 +        return;
 +    }
 +
 +    qemu_lockcnt_dec(&cpu->in_ioctl_lock);
 +    /* change event to SET. If event was BUSY, wake up all waiters */
 +    qemu_event_set(&accel_in_ioctl_event);
 +}
 +
 +static bool accel_has_to_wait(void)
 +{
 +    CPUState *cpu;
 +    bool needs_to_wait = false;
 +
 +    CPU_FOREACH(cpu) {
 +        if (qemu_lockcnt_count(&cpu->in_ioctl_lock)) {
 +            /* exit the ioctl, if vcpu is running it */
 +            qemu_cpu_kick(cpu);
 +            needs_to_wait = true;
 +        }
 +    }
 +
 +    return needs_to_wait || qemu_lockcnt_count(&accel_in_ioctl_lock);
 +}
 +
 +void accel_ioctl_inhibit_begin(void)
 +{
 +    CPUState *cpu;
 +
 +    /*
 +     * We allow to inhibit only when holding the BQL, so we can identify
 +     * when an inhibitor wants to issue an ioctl easily.
 +     */
 +    g_assert(qemu_mutex_iothread_locked());
 +
 +    /* Block further invocations of the ioctls outside the BQL.  */
 +    CPU_FOREACH(cpu) {
 +        qemu_lockcnt_lock(&cpu->in_ioctl_lock);
 +    }
 +    qemu_lockcnt_lock(&accel_in_ioctl_lock);
 +
 +    /* Keep waiting until there are running ioctls */
 +    while (true) {
 +
 +        /* Reset event to FREE. */
 +        qemu_event_reset(&accel_in_ioctl_event);
 +
 +        if (accel_has_to_wait()) {
 +            /*
 +             * If event is still FREE, and there are ioctls still in progress,
 +             * wait.
 +             *
 +             *  If an ioctl finishes before qemu_event_wait(), it will change
 +             * the event state to SET. This will prevent qemu_event_wait() from
 +             * blocking, but it's not a problem because if other ioctls are
 +             * still running the loop will iterate once more and reset the event
 +             * status to FREE so that it can wait properly.
 +             *
 +             * If an ioctls finishes while qemu_event_wait() is blocking, then
 +             * it will be waken up, but also here the while loop makes sure
 +             * to re-enter the wait if there are other running ioctls.
 +             */
 +            qemu_event_wait(&accel_in_ioctl_event);
 +        } else {
 +            /* No ioctl is running */
 +            return;
 +        }
 +    }
 +}
 +
 +void accel_ioctl_inhibit_end(void)
 +{
 +    CPUState *cpu;
 +
 +    qemu_lockcnt_unlock(&accel_in_ioctl_lock);
 +    CPU_FOREACH(cpu) {
 +        qemu_lockcnt_unlock(&cpu->in_ioctl_lock);
 +    }
 +}
 +
 diff --git a/accel/meson.build b/accel/meson.build
 index dfd808d2c8..801b4d44e8 100644
 --- a/accel/meson.build
 +++ b/accel/meson.build
@@ -1,4 +1,4 @@
 -specific_ss.add(files('accel-common.c'))
 +specific_ss.add(files('accel-common.c', 'accel-blocker.c'))
 softmmu_ss.add(files('accel-softmmu.c'))
 user_ss.add(files('accel-user.c'))
 diff --git a/hw/core/cpu-common.c b/hw/core/cpu-common.c
 index 9e3241b430..b6e83acf0a 100644
 --- a/hw/core/cpu-common.c
 +++ b/hw/core/cpu-common.c
@@ -238,6 +238,7 @@ static void cpu_common_initfn(Object *obj)
     cpu->nr_threads = 1;
     qemu_mutex_init(&cpu->work_mutex);
 +    qemu_lockcnt_init(&cpu->in_ioctl_lock);
     QSIMPLEQ_INIT(&cpu->work_list);
     QTAILQ_INIT(&cpu->breakpoints);
     QTAILQ_INIT(&cpu->watchpoints);
@@ -249,6 +250,7 @@ static void cpu_common_finalize(Object *obj)
 {
     CPUState *cpu = CPU(obj);
 +    qemu_lockcnt_destroy(&cpu->in_ioctl_lock);
     qemu_mutex_destroy(&cpu->work_mutex);
 }
 diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
 index e948e81f1a..49d9c73f97 100644
 --- a/include/hw/core/cpu.h
 +++ b/include/hw/core/cpu.h
@@ -383,6 +383,9 @@ struct CPUState {
     uint32_t kvm_fetch_index;
     uint64_t dirty_pages;
 +    /* Use by accel-block: CPU is executing an ioctl() */
 +    QemuLockCnt in_ioctl_lock;
 +
     /* Used for events with 'vcpu' and *without* the 'disabled' properties */
     DECLARE_BITMAP(trace_dstate_delayed, CPU_TRACE_DSTATE_MAX_EVENTS);
     DECLARE_BITMAP(trace_dstate, CPU_TRACE_DSTATE_MAX_EVENTS);
 diff --git a/include/sysemu/accel-blocker.h b/include/sysemu/accel-blocker.h
 new file mode 100644
 index 0000000000..72020529ef
 --- /dev/null
 +++ b/include/sysemu/accel-blocker.h
@@ -0,0 +1,56 @@
 +/*
 + * Accelerator blocking API, to prevent new ioctls from starting and wait the
 + * running ones finish.
 + * This mechanism differs from pause/resume_all_vcpus() in that it does not
 + * release the BQL.
 + *
 + *  Copyright (c) 2022 Red Hat Inc.
 + *
 + * Author: Emanuele Giuseppe Esposito       <eesposit@redhat.com>
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + */
 +#ifndef ACCEL_BLOCKER_H
 +#define ACCEL_BLOCKER_H
 +
 +#include "qemu/osdep.h"
 +#include "sysemu/cpus.h"
 +
 +extern void accel_blocker_init(void);
 +
 +/*
 + * accel_{cpu_}ioctl_begin/end:
 + * Mark when ioctl is about to run or just finished.
 + *
 + * accel_{cpu_}ioctl_begin will block after accel_ioctl_inhibit_begin() is
 + * called, preventing new ioctls to run. They will continue only after
 + * accel_ioctl_inibith_end().
 + */
 +extern void accel_ioctl_begin(void);
 +extern void accel_ioctl_end(void);
 +extern void accel_cpu_ioctl_begin(CPUState *cpu);
 +extern void accel_cpu_ioctl_end(CPUState *cpu);
 +
 +/*
 + * accel_ioctl_inhibit_begin: start critical section
 + *
 + * This function makes sure that:
 + * 1) incoming accel_{cpu_}ioctl_begin() calls block
 + * 2) wait that all ioctls that were already running reach
 + *    accel_{cpu_}ioctl_end(), kicking vcpus if necessary.
 + *
 + * This allows the caller to access shared data or perform operations without
 + * worrying of concurrent vcpus accesses.
 + */
 +extern void accel_ioctl_inhibit_begin(void);
 +
 +/*
 + * accel_ioctl_inhibit_end: end critical section started by
 + * accel_ioctl_inhibit_begin()
 + *
 + * This function allows blocked accel_{cpu_}ioctl_begin() to continue.
 + */
 +extern void accel_ioctl_inhibit_end(void);
 +
 +#endif /* ACCEL_BLOCKER_H */
 diff --git a/util/meson.build b/util/meson.build
 index 05b593055a..b5f153b0e8 100644
 --- a/util/meson.build
 +++ b/util/meson.build
@@ -48,6 +48,7 @@ util_ss.add(files('transactions.c'))
 util_ss.add(when: 'CONFIG_POSIX', if_true: files('drm.c'))
 util_ss.add(files('guest-random.c'))
 util_ss.add(files('yank.c'))
 +util_ss.add(files('lockcnt.c'))
 if have_user
   util_ss.add(files('selfmap.c'))
@@ -69,7 +70,6 @@ if have_block
   util_ss.add(files('hexdump.c'))
   util_ss.add(files('iova-tree.c'))
   util_ss.add(files('iov.c', 'qemu-sockets.c', 'uri.c'))
 -  util_ss.add(files('lockcnt.c'))
   util_ss.add(files('main-loop.c'))
   util_ss.add(files('nvdimm-utils.c'))
   util_ss.add(files('qemu-coroutine.c', 'qemu-coroutine-lock.c', 'qemu-coroutine-io.c'))
 -- 
 2.37.3
--- a/SOURCES/kvm-acpi-fix-OEM-ID-OEM-Table-ID-padding.patch
+++ b/SOURCES/kvm-acpi-fix-OEM-ID-OEM-Table-ID-padding.patch
@ -0,0 +1,78 @@
 From af082f3499de265d123157d097b5c84981e0aa63 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Wed, 30 Mar 2022 14:52:34 -0400
 Subject: [PATCH 15/18] acpi: fix OEM ID/OEM Table ID padding
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 141: acpi: fix QEMU crash when started with SLIC table
 RH-Commit: [7/10] 51ea859cbe12b5a902d529ab589d18757d98f71d (jmaloy/qemu-kvm)
 RH-Bugzilla: 2062611
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2062611
 Upstream: Merged
 commit 748c030f360a940fe0c9382c8ca1649096c3a80d
 Author: Igor Mammedov <imammedo@redhat.com>
 Date:   Wed Jan 12 08:03:31 2022 -0500
    acpi: fix OEM ID/OEM Table ID padding
    Commit [2] broke original '\0' padding of OEM ID and OEM Table ID
    fields in headers of ACPI tables. While it doesn't have impact on
    default values since QEMU uses 6 and 8 characters long values
    respectively, it broke usecase where IDs are provided on QEMU CLI.
    It shouldn't affect guest (but may cause licensing verification
    issues in guest OS).
    One of the broken usecases is user supplied SLIC table with IDs
    shorter than max possible length, where [2] mangles IDs with extra
    spaces in RSDT and FADT tables whereas guest OS expects those to
    mirror the respective values of the used SLIC table.
    Fix it by replacing whitespace padding with '\0' padding in
    accordance with [1] and expectations of guest OS
    1) ACPI spec, v2.0b
           17.2 AML Grammar Definition
           ...
           //OEM ID of up to 6 characters. If the OEM ID is
           //shorter than 6 characters, it can be terminated
           //with a NULL character.
    2)
    Fixes: 602b458201 ("acpi: Permit OEM ID and OEM table ID fields to be changed")
    Resolves: https://gitlab.com/qemu-project/qemu/-/issues/707
    Reported-by: Dmitry V. Orekhov <dima.orekhov@gmail.com>
    Signed-off-by: Igor Mammedov <imammedo@redhat.com>
    Cc: qemu-stable@nongnu.org
    Message-Id: <20220112130332.1648664-4-imammedo@redhat.com>
    Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
    Reviewed-by: Ani Sinha <ani@anisinha.ca>
    Tested-by: Dmitry V. Orekhov dima.orekhov@gmail.com
 (cherry picked from commit 748c030f360a940fe0c9382c8ca1649096c3a80d)
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 hw/acpi/aml-build.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/hw/acpi/aml-build.c b/hw/acpi/aml-build.c
 index b3b3310df3..65148d5b9d 100644
 --- a/hw/acpi/aml-build.c
 +++ b/hw/acpi/aml-build.c
@@ -1724,9 +1724,9 @@ void acpi_table_begin(AcpiTable *desc, GArray *array)
     build_append_int_noprefix(array, 0, 4); /* Length */
     build_append_int_noprefix(array, desc->rev, 1); /* Revision */
     build_append_int_noprefix(array, 0, 1); /* Checksum */
 -    build_append_padded_str(array, desc->oem_id, 6, ' '); /* OEMID */
 +    build_append_padded_str(array, desc->oem_id, 6, '\0'); /* OEMID */
     /* OEM Table ID */
 -    build_append_padded_str(array, desc->oem_table_id, 8, ' ');
 +    build_append_padded_str(array, desc->oem_table_id, 8, '\0');
     build_append_int_noprefix(array, 1, 4); /* OEM Revision */
     g_array_append_vals(array, ACPI_BUILD_APPNAME8, 4); /* Creator ID */
     build_append_int_noprefix(array, 1, 4); /* Creator Revision */
 -- 
 2.27.0
--- a/SOURCES/kvm-acpi-fix-QEMU-crash-when-started-with-SLIC-table.patch
+++ b/SOURCES/kvm-acpi-fix-QEMU-crash-when-started-with-SLIC-table.patch
@ -0,0 +1,108 @@
 From 4e8fb957a349558648d5cddb80a89460bc97439e Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Wed, 30 Mar 2022 14:52:34 -0400
 Subject: [PATCH 09/18] acpi: fix QEMU crash when started with SLIC table
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 141: acpi: fix QEMU crash when started with SLIC table
 RH-Commit: [1/10] 0c34e80346c33da4f220d9c486b120c35005144e (jmaloy/qemu-kvm)
 RH-Bugzilla: 2062611
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2062611
 Upstream: Merged
 commit 8cdb99af45365727ac17f45239a9b8c1d5155c6d)
 Author: Igor Mammedov <imammedo@redhat.com>
 Date:   Mon Dec 27 14:31:17 2021 -0500
    acpi: fix QEMU crash when started with SLIC table
    if QEMU is started with used provided SLIC table blob,
      -acpitable sig=SLIC,oem_id='CRASH ',oem_table_id="ME",oem_rev=00002210,asl_compiler_id="",asl_compiler_rev=00000000,data=/dev/null
    it will assert with:
      hw/acpi/aml-build.c:61:build_append_padded_str: assertion failed: (len <= maxlen)
    and following backtrace:
      ...
      build_append_padded_str (array=0x555556afe320, str=0x555556afdb2e "CRASH ME", maxlen=0x6, pad=0x20) at hw/acpi/aml-build.c:61
      acpi_table_begin (desc=0x7fffffffd1b0, array=0x555556afe320) at hw/acpi/aml-build.c:1727
      build_fadt (tbl=0x555556afe320, linker=0x555557ca3830, f=0x7fffffffd318, oem_id=0x555556afdb2e "CRASH ME", oem_table_id=0x555556afdb34 "ME") at hw/acpi/aml-build.c:2064
      ...
    which happens due to acpi_table_begin() expecting NULL terminated
    oem_id and oem_table_id strings, which is normally the case, but
    in case of user provided SLIC table, oem_id points to table's blob
    directly and as result oem_id became longer than expected.
    Fix issue by handling oem_id consistently and make acpi_get_slic_oem()
    return NULL terminated strings.
    PS:
    After [1] refactoring, oem_id semantics became inconsistent, where
    NULL terminated string was coming from machine and old way pointer
    into byte array coming from -acpitable option. That used to work
    since build_header() wasn't expecting NULL terminated string and
    blindly copied the 1st 6 bytes only.
    However commit [2] broke that by replacing build_header() with
    acpi_table_begin(), which was expecting NULL terminated string
    and was checking oem_id size.
    1) 602b45820 ("acpi: Permit OEM ID and OEM table ID fields to be changed")
    2)
    Fixes: 4b56e1e4eb08 ("acpi: build_fadt: use acpi_table_begin()/acpi_table_end() instead of build_header()")
    Resolves: https://gitlab.com/qemu-project/qemu/-/issues/786
    Signed-off-by: Igor Mammedov <imammedo@redhat.com>
    Message-Id: <20211227193120.1084176-2-imammedo@redhat.com>
    Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
    Tested-by: Denis Lisov <dennis.lissov@gmail.com>
    Tested-by: Alexander Tsoy <alexander@tsoy.me>
    Cc: qemu-stable@nongnu.org
    Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 (cherry picked from commit 8cdb99af45365727ac17f45239a9b8c1d5155c6d)
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 hw/acpi/core.c       | 4 ++--
 hw/i386/acpi-build.c | 2 ++
 2 files changed, 4 insertions(+), 2 deletions(-)
 diff --git a/hw/acpi/core.c b/hw/acpi/core.c
 index 1e004d0078..3e811bf03c 100644
 --- a/hw/acpi/core.c
 +++ b/hw/acpi/core.c
@@ -345,8 +345,8 @@ int acpi_get_slic_oem(AcpiSlicOem *oem)
         struct acpi_table_header *hdr = (void *)(u - sizeof(hdr->_length));
         if (memcmp(hdr->sig, "SLIC", 4) == 0) {
 -            oem->id = hdr->oem_id;
 -            oem->table_id = hdr->oem_table_id;
 +            oem->id = g_strndup(hdr->oem_id, 6);
 +            oem->table_id = g_strndup(hdr->oem_table_id, 8);
             return 0;
         }
     }
 diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
 index a4478e77b7..acc4869db0 100644
 --- a/hw/i386/acpi-build.c
 +++ b/hw/i386/acpi-build.c
@@ -2726,6 +2726,8 @@ void acpi_build(AcpiBuildTables *tables, MachineState *machine)
     /* Cleanup memory that's no longer used. */
     g_array_free(table_offsets, true);
 +    g_free(slic_oem.id);
 +    g_free(slic_oem.table_id);
 }
 static void acpi_ram_update(MemoryRegion *mr, GArray *data)
 -- 
 2.27.0
--- a/SOURCES/kvm-acpi-fix-acpi_index-migration.patch
+++ b/SOURCES/kvm-acpi-fix-acpi_index-migration.patch
@ -0,0 +1,165 @@
 From 3deffc03c2e9b0053eec5aeb5b5d633dfe29f499 Mon Sep 17 00:00:00 2001
 From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
 Date: Wed, 6 Apr 2022 14:58:12 -0400
 Subject: [PATCH 1/3] acpi: fix acpi_index migration
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Peter Xu <peterx@redhat.com>
 RH-MergeRequest: 343: acpi: fix acpi_index migration
 RH-Jira: RHEL-20189
 RH-Acked-by: Leonardo Brás <leobras@redhat.com>
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 RH-Acked-by: Prasad Pandit <None>
 RH-Commit: [1/2] c5b9cdf5791cd856207b7df7e2ef5df360ec8de4
 vmstate_acpi_pcihp_use_acpi_index() was expecting AcpiPciHpState
 as state but it actually received PIIX4PMState, because
 VMSTATE_PCI_HOTPLUG is a macro and not another struct.
 So it ended up accessing random pointer, which resulted
 in 'false' return value and acpi_index field wasn't ever
 sent.
 However in 7.0 that pointer de-references to value > 0, and
 destination QEMU starts to expect the field which isn't
 sent in migratioon stream from older QEMU (6.2 and older).
 As result migration fails with:
  qemu-system-x86_64: Missing section footer for 0000:00:01.3/piix4_pm
  qemu-system-x86_64: load of migration failed: Invalid argument
 In addition with QEMU-6.2, destination due to not expected
 state, also never expects the acpi_index field in migration
 stream.
 Q35 is not affected as it always sends/expects the field as
 long as acpi based PCI hotplug is enabled.
 Fix issue by introducing compat knob to never send/expect
 acpi_index in migration stream for 6.2 and older PC machine
 types and always send it for 7.0 and newer PC machine types.
 Diagnosed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Fixes: b32bd76 ("pci: introduce acpi-index property for PCI device")
 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/932
 Signed-off-by: Igor Mammedov <imammedo@redhat.com>
 Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 (cherry picked from commit a83c2844903c45aa7d32cdd17305f23ce2c56ab9)
 Signed-off-by: Peter Xu <peterx@redhat.com>
 ---
 hw/acpi/acpi-pci-hotplug-stub.c |  4 ----
 hw/acpi/pcihp.c                 |  6 ------
 hw/acpi/piix4.c                 | 15 ++++++++++++++-
 hw/core/machine.c               |  5 +++++
 include/hw/acpi/pcihp.h         |  2 --
 5 files changed, 19 insertions(+), 13 deletions(-)
 diff --git a/hw/acpi/acpi-pci-hotplug-stub.c b/hw/acpi/acpi-pci-hotplug-stub.c
 index 734e4c5986..a43f6dafc9 100644
 --- a/hw/acpi/acpi-pci-hotplug-stub.c
 +++ b/hw/acpi/acpi-pci-hotplug-stub.c
@@ -41,7 +41,3 @@ void acpi_pcihp_reset(AcpiPciHpState *s, bool acpihp_root_off)
     return;
 }
 -bool vmstate_acpi_pcihp_use_acpi_index(void *opaque, int version_id)
 -{
 -    return false;
 -}
 diff --git a/hw/acpi/pcihp.c b/hw/acpi/pcihp.c
 index be0e846b34..ec861661c3 100644
 --- a/hw/acpi/pcihp.c
 +++ b/hw/acpi/pcihp.c
@@ -559,12 +559,6 @@ void acpi_pcihp_init(Object *owner, AcpiPciHpState *s, PCIBus *root_bus,
                                    OBJ_PROP_FLAG_READ);
 }
 -bool vmstate_acpi_pcihp_use_acpi_index(void *opaque, int version_id)
 -{
 -     AcpiPciHpState *s = opaque;
 -     return s->acpi_index;
 -}
 -
 const VMStateDescription vmstate_acpi_pcihp_pci_status = {
     .name = "acpi_pcihp_pci_status",
     .version_id = 1,
 diff --git a/hw/acpi/piix4.c b/hw/acpi/piix4.c
 index 8d6011c0a3..033e75ce5b 100644
 --- a/hw/acpi/piix4.c
 +++ b/hw/acpi/piix4.c
@@ -82,6 +82,7 @@ struct PIIX4PMState {
     AcpiPciHpState acpi_pci_hotplug;
     bool use_acpi_hotplug_bridge;
     bool use_acpi_root_pci_hotplug;
 +    bool not_migrate_acpi_index;
     uint8_t disable_s3;
     uint8_t disable_s4;
@@ -269,6 +270,16 @@ static bool piix4_vmstate_need_smbus(void *opaque, int version_id)
     return pm_smbus_vmstate_needed();
 }
 +/*
 + * This is a fudge to turn off the acpi_index field,
 + * whose test was always broken on piix4 with 6.2 and older machine types.
 + */
 +static bool vmstate_test_migrate_acpi_index(void *opaque, int version_id)
 +{
 +    PIIX4PMState *s = PIIX4_PM(opaque);
 +    return s->use_acpi_hotplug_bridge && !s->not_migrate_acpi_index;
 +}
 +
 /* qemu-kvm 1.2 uses version 3 but advertised as 2
  * To support incoming qemu-kvm 1.2 migration, change version_id
  * and minimum_version_id to 2 below (which breaks migration from
@@ -299,7 +310,7 @@ static const VMStateDescription vmstate_acpi = {
             struct AcpiPciHpPciStatus),
         VMSTATE_PCI_HOTPLUG(acpi_pci_hotplug, PIIX4PMState,
                             vmstate_test_use_acpi_hotplug_bridge,
 -                            vmstate_acpi_pcihp_use_acpi_index),
 +                            vmstate_test_migrate_acpi_index),
         VMSTATE_END_OF_LIST()
     },
     .subsections = (const VMStateDescription*[]) {
@@ -654,6 +665,8 @@ static Property piix4_pm_properties[] = {
     DEFINE_PROP_BOOL("memory-hotplug-support", PIIX4PMState,
                      acpi_memory_hotplug.is_enabled, true),
     DEFINE_PROP_BOOL("smm-compat", PIIX4PMState, smm_compat, false),
 +    DEFINE_PROP_BOOL("x-not-migrate-acpi-index", PIIX4PMState,
 +                      not_migrate_acpi_index, false),
     DEFINE_PROP_END_OF_LIST(),
 };
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index 76fcabec7a..2724f6848a 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -331,6 +331,11 @@ GlobalProperty hw_compat_rhel_7_1[] = {
 };
 const size_t hw_compat_rhel_7_1_len = G_N_ELEMENTS(hw_compat_rhel_7_1);
 +GlobalProperty hw_compat_6_2[] = {
 +    { "PIIX4_PM", "x-not-migrate-acpi-index", "on"},
 +};
 +const size_t hw_compat_6_2_len = G_N_ELEMENTS(hw_compat_6_2);
 +
 GlobalProperty hw_compat_6_1[] = {
     { "vhost-user-vsock-device", "seqpacket", "off" },
     { "nvme-ns", "shared", "off" },
 diff --git a/include/hw/acpi/pcihp.h b/include/hw/acpi/pcihp.h
 index af1a169fc3..7e268c2c9c 100644
 --- a/include/hw/acpi/pcihp.h
 +++ b/include/hw/acpi/pcihp.h
@@ -73,8 +73,6 @@ void acpi_pcihp_reset(AcpiPciHpState *s, bool acpihp_root_off);
 extern const VMStateDescription vmstate_acpi_pcihp_pci_status;
 -bool vmstate_acpi_pcihp_use_acpi_index(void *opaque, int version_id);
 -
 #define VMSTATE_PCI_HOTPLUG(pcihp, state, test_pcihp, test_acpi_index) \
         VMSTATE_UINT32_TEST(pcihp.hotplug_select, state, \
                             test_pcihp), \
 -- 
 2.41.0
--- a/SOURCES/kvm-acpi-pcihp-pcie-set-power-on-cap-on-parent-slot.patch
+++ b/SOURCES/kvm-acpi-pcihp-pcie-set-power-on-cap-on-parent-slot.patch
@ -0,0 +1,140 @@
 From c9ceb175667cdeead59384a97a812367ae19c570 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Wed, 23 Mar 2022 13:21:40 -0400
 Subject: [PATCH 06/18] acpi: pcihp: pcie: set power on cap on parent slot
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 134: pci: expose TYPE_XIO3130_DOWNSTREAM name
 RH-Commit: [2/2] d883872647a6e90ec573140b2c171f3f53b600ab (jmaloy/qemu-kvm)
 RH-Bugzilla: 2062610
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 RH-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
 BZ: https://bugzilla.redhat.com/2062610
 UPSTREAM: merged
 BREW: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=44038138
 commit 6b0969f1ec825984cd74619f0730be421b0c46fb
 Author: Igor Mammedov <imammedo@redhat.com>
 Date:   Tue Mar 1 10:11:59 2022 -0500
    acpi: pcihp: pcie: set power on cap on parent slot
    on creation a PCIDevice has power turned on at the end of pci_qdev_realize()
    however later on if PCIe slot isn't populated with any children
    it's power is turned off. It's fine if native hotplug is used
    as plug callback will power slot on among other things.
    However when ACPI hotplug is enabled it replaces native PCIe plug
    callbacks with ACPI specific ones (acpi_pcihp_device_*plug_cb) and
    as result slot stays powered off. It works fine as ACPI hotplug
    on guest side takes care of enumerating/initializing hotplugged
    device. But when later guest is migrated, call chain introduced by]
    commit d5daff7d312 (pcie: implement slot power control for pcie root ports)
       pcie_cap_slot_post_load()
           -> pcie_cap_update_power()
               -> pcie_set_power_device()
                   -> pci_set_power()
                       -> pci_update_mappings()
    will disable earlier initialized BARs for the hotplugged device
    in powered off slot due to commit 23786d13441 (pci: implement power state)
    which disables BARs if power is off.
    Fix it by setting PCI_EXP_SLTCTL_PCC to PCI_EXP_SLTCTL_PWR_ON
    on slot (root port/downstream port) at the time a device
    hotplugged into it. As result PCI_EXP_SLTCTL_PWR_ON is migrated
    to target and above call chain keeps device plugged into it
    powered on.
    Fixes: d5daff7d312 ("pcie: implement slot power control for pcie root ports")
    Fixes: 23786d13441 ("pci: implement power state")
    Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2053584
    Suggested-by: "Michael S. Tsirkin" <mst@redhat.com>
    Signed-off-by: Igor Mammedov <imammedo@redhat.com>
    Message-Id: <20220301151200.3507298-3-imammedo@redhat.com>
    Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 (cherry picked from commit 6b0969f1ec825984cd74619f0730be421b0c46fb)
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 hw/acpi/pcihp.c       | 12 +++++++++++-
 hw/pci/pcie.c         | 11 +++++++++++
 include/hw/pci/pcie.h |  1 +
 3 files changed, 23 insertions(+), 1 deletion(-)
 diff --git a/hw/acpi/pcihp.c b/hw/acpi/pcihp.c
 index a5e182dd3a..be0e846b34 100644
 --- a/hw/acpi/pcihp.c
 +++ b/hw/acpi/pcihp.c
@@ -32,6 +32,7 @@
 #include "hw/pci/pci_bridge.h"
 #include "hw/pci/pci_host.h"
 #include "hw/pci/pcie_port.h"
 +#include "hw/pci-bridge/xio3130_downstream.h"
 #include "hw/i386/acpi-build.h"
 #include "hw/acpi/acpi.h"
 #include "hw/pci/pci_bus.h"
@@ -341,6 +342,8 @@ void acpi_pcihp_device_plug_cb(HotplugHandler *hotplug_dev, AcpiPciHpState *s,
 {
     PCIDevice *pdev = PCI_DEVICE(dev);
     int slot = PCI_SLOT(pdev->devfn);
 +    PCIDevice *bridge;
 +    PCIBus *bus;
     int bsel;
     /* Don't send event when device is enabled during qemu machine creation:
@@ -370,7 +373,14 @@ void acpi_pcihp_device_plug_cb(HotplugHandler *hotplug_dev, AcpiPciHpState *s,
         return;
     }
 -    bsel = acpi_pcihp_get_bsel(pci_get_bus(pdev));
 +    bus = pci_get_bus(pdev);
 +    bridge = pci_bridge_get_device(bus);
 +    if (object_dynamic_cast(OBJECT(bridge), TYPE_PCIE_ROOT_PORT) ||
 +        object_dynamic_cast(OBJECT(bridge), TYPE_XIO3130_DOWNSTREAM)) {
 +        pcie_cap_slot_enable_power(bridge);
 +    }
 +
 +    bsel = acpi_pcihp_get_bsel(bus);
     g_assert(bsel >= 0);
     s->acpi_pcihp_pci_status[bsel].up |= (1U << slot);
     acpi_send_event(DEVICE(hotplug_dev), ACPI_PCI_HOTPLUG_STATUS);
 diff --git a/hw/pci/pcie.c b/hw/pci/pcie.c
 index d7d73a31e4..996f0e24fe 100644
 --- a/hw/pci/pcie.c
 +++ b/hw/pci/pcie.c
@@ -366,6 +366,17 @@ static void hotplug_event_clear(PCIDevice *dev)
     }
 }
 +void pcie_cap_slot_enable_power(PCIDevice *dev)
 +{
 +    uint8_t *exp_cap = dev->config + dev->exp.exp_cap;
 +    uint32_t sltcap = pci_get_long(exp_cap + PCI_EXP_SLTCAP);
 +
 +    if (sltcap & PCI_EXP_SLTCAP_PCP) {
 +        pci_set_word_by_mask(exp_cap + PCI_EXP_SLTCTL,
 +                             PCI_EXP_SLTCTL_PCC, PCI_EXP_SLTCTL_PWR_ON);
 +    }
 +}
 +
 static void pcie_set_power_device(PCIBus *bus, PCIDevice *dev, void *opaque)
 {
     bool *power = opaque;
 diff --git a/include/hw/pci/pcie.h b/include/hw/pci/pcie.h
 index 6063bee0ec..c27368d077 100644
 --- a/include/hw/pci/pcie.h
 +++ b/include/hw/pci/pcie.h
@@ -112,6 +112,7 @@ void pcie_cap_slot_write_config(PCIDevice *dev,
                                 uint32_t addr, uint32_t val, int len);
 int pcie_cap_slot_post_load(void *opaque, int version_id);
 void pcie_cap_slot_push_attention_button(PCIDevice *dev);
 +void pcie_cap_slot_enable_power(PCIDevice *dev);
 void pcie_cap_root_init(PCIDevice *dev);
 void pcie_cap_root_reset(PCIDevice *dev);
 -- 
 2.27.0
--- a/SOURCES/kvm-acpi-validate-hotplug-selector-on-access.patch
+++ b/SOURCES/kvm-acpi-validate-hotplug-selector-on-access.patch
@ -0,0 +1,51 @@
 From 529a5d908f5d16714b8ae0a51eaaaa84994dfae8 Mon Sep 17 00:00:00 2001
 From: "Michael S. Tsirkin" <mst@redhat.com>
 Date: Tue, 21 Dec 2021 09:45:44 -0500
 Subject: [PATCH 1/2] acpi: validate hotplug selector on access
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 97: acpi: validate hotplug selector on access
 RH-Commit: [1/1] 79bcfb0df0091e2b716d2e1c545f047b3409c26c (jmaloy/qemu-kvm)
 RH-Bugzilla: 2036580
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
 RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
 When bus is looked up on a pci write, we didn't
 validate that the lookup succeeded.
 Fuzzers thus can trigger QEMU crash by dereferencing the NULL
 bus pointer.
 Fixes: b32bd763a1 ("pci: introduce acpi-index property for PCI device")
 Fixes: CVE-2021-4158
 Cc: "Igor Mammedov" <imammedo@redhat.com>
 Fixes: https://gitlab.com/qemu-project/qemu/-/issues/770
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Ani Sinha <ani@anisinha.ca>
 (cherry picked from commit 9bd6565ccee68f72d5012e24646e12a1c662827e)
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 hw/acpi/pcihp.c | 3 +++
 1 file changed, 3 insertions(+)
 diff --git a/hw/acpi/pcihp.c b/hw/acpi/pcihp.c
 index 30405b5113..a5e182dd3a 100644
 --- a/hw/acpi/pcihp.c
 +++ b/hw/acpi/pcihp.c
@@ -491,6 +491,9 @@ static void pci_write(void *opaque, hwaddr addr, uint64_t data,
         }
         bus = acpi_pcihp_find_hotplug_bus(s, s->hotplug_select);
 +        if (!bus) {
 +            break;
 +        }
         QTAILQ_FOREACH_SAFE(kid, &bus->qbus.children, sibling, next) {
             Object *o = OBJECT(kid->child);
             PCIDevice *dev = PCI_DEVICE(o);
 -- 
 2.27.0
--- a/SOURCES/kvm-aio-wait-switch-to-smp_mb__after_rmw.patch
+++ b/SOURCES/kvm-aio-wait-switch-to-smp_mb__after_rmw.patch
@ -0,0 +1,50 @@
 From 953c5c0982b61b0a3f8f03452844b5487eb22fc7 Mon Sep 17 00:00:00 2001
 From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date: Thu, 9 Mar 2023 08:13:17 -0500
 Subject: [PATCH 06/13] aio-wait: switch to smp_mb__after_rmw()
 RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-MergeRequest: 263: qatomic: add smp_mb__before/after_rmw()
 RH-Bugzilla: 2168472
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: Eric Auger <eric.auger@redhat.com>
 RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
 RH-Acked-by: David Hildenbrand <david@redhat.com>
 RH-Commit: [6/10] 9f30f97754139ffd18d36b2350f9ed4e59ac496e
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2168472
 commit b532526a07ef3b903ead2e055fe6cc87b41057a3
 Author: Paolo Bonzini <pbonzini@redhat.com>
 Date:   Fri Mar 3 11:03:52 2023 +0100
    aio-wait: switch to smp_mb__after_rmw()
    The barrier comes after an atomic increment, so it is enough to use
    smp_mb__after_rmw(); this avoids a double barrier on x86 systems.
    Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
    Reviewed-by: David Hildenbrand <david@redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 ---
 include/block/aio-wait.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/include/block/aio-wait.h b/include/block/aio-wait.h
 index 54840f8622..03b6394c78 100644
 --- a/include/block/aio-wait.h
 +++ b/include/block/aio-wait.h
@@ -82,7 +82,7 @@ extern AioWait global_aio_wait;
     /* Increment wait_->num_waiters before evaluating cond. */     \
     qatomic_inc(&wait_->num_waiters);                              \
     /* Paired with smp_mb in aio_wait_kick(). */                   \
 -    smp_mb();                                                      \
 +    smp_mb__after_rmw();                                           \
     if (ctx_ && in_aio_context_home_thread(ctx_)) {                \
         while ((cond)) {                                           \
             aio_poll(ctx_, true);                                  \
 -- 
 2.37.3
--- a/SOURCES/kvm-aio-warn-about-iohandler_ctx-special-casing.patch
+++ b/SOURCES/kvm-aio-warn-about-iohandler_ctx-special-casing.patch
@ -1,64 +0,0 @@
 From 0e3934e89ad1dda21681f64ff38da69b07d1b531 Mon Sep 17 00:00:00 2001
 From: Stefan Hajnoczi <stefanha@redhat.com>
 Date: Mon, 6 May 2024 15:06:22 -0400
 Subject: [PATCH 3/5] aio: warn about iohandler_ctx special casing
 RH-Author: Kevin Wolf <kwolf@redhat.com>
 RH-MergeRequest: 248: Revert "monitor: use aio_co_reschedule_self()"
 RH-Jira: RHEL-34618 RHEL-38697
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [2/2] cc316d70b2c187ee0412d6560ca1a03e381a69c1 (kmwolf/centos-qemu-kvm)
 The main loop has two AioContexts: qemu_aio_context and iohandler_ctx.
 The main loop runs them both, but nested aio_poll() calls on
 qemu_aio_context exclude iohandler_ctx.
 Which one should qemu_get_current_aio_context() return when called from
 the main loop? Document that it's always qemu_aio_context.
 This has subtle effects on functions that use
 qemu_get_current_aio_context(). For example, aio_co_reschedule_self()
 does not work when moving from iohandler_ctx to qemu_aio_context because
 qemu_get_current_aio_context() does not differentiate these two
 AioContexts.
 Document this in order to reduce the chance of future bugs.
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Message-ID: <20240506190622.56095-3-stefanha@redhat.com>
 Reviewed-by: Kevin Wolf <kwolf@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit e669e800fc9ef8806af5c5578249ab758a4f8a5a)
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
 include/block/aio.h | 6 ++++++
 1 file changed, 6 insertions(+)
 diff --git a/include/block/aio.h b/include/block/aio.h
 index 8378553eb9..4ee81936ed 100644
 --- a/include/block/aio.h
 +++ b/include/block/aio.h
@@ -629,6 +629,9 @@ void aio_co_schedule(AioContext *ctx, Coroutine *co);
  *
  * Move the currently running coroutine to new_ctx. If the coroutine is already
  * running in new_ctx, do nothing.
 + *
 + * Note that this function cannot reschedule from iohandler_ctx to
 + * qemu_aio_context.
  */
 void coroutine_fn aio_co_reschedule_self(AioContext *new_ctx);
@@ -661,6 +664,9 @@ void aio_co_enter(AioContext *ctx, Coroutine *co);
  * If called from an IOThread this will be the IOThread's AioContext.  If
  * called from the main thread or with the "big QEMU lock" taken it
  * will be the main loop AioContext.
 + *
 + * Note that the return value is never the main loop's iohandler_ctx and the
 + * return value is the main loop AioContext instead.
  */
 AioContext *qemu_get_current_aio_context(void);
 -- 
 2.39.3
--- a/SOURCES/kvm-aio_wait_kick-add-missing-memory-barrier.patch
+++ b/SOURCES/kvm-aio_wait_kick-add-missing-memory-barrier.patch
@ -0,0 +1,86 @@
 From d7eae0ff4c7f7f7bf10f10272adf7c6971c0db9b Mon Sep 17 00:00:00 2001
 From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date: Thu, 9 Mar 2023 09:26:35 -0500
 Subject: [PATCH 01/13] aio_wait_kick: add missing memory barrier
 RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-MergeRequest: 263: qatomic: add smp_mb__before/after_rmw()
 RH-Bugzilla: 2168472
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: Eric Auger <eric.auger@redhat.com>
 RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
 RH-Acked-by: David Hildenbrand <david@redhat.com>
 RH-Commit: [1/10] eb774aee79864052e14e706d931e52e7bd1162c8
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2168472
 commit 7455ff1aa01564cc175db5b2373e610503ad4411
 Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date:   Tue May 24 13:30:54 2022 -0400
    aio_wait_kick: add missing memory barrier
    It seems that aio_wait_kick always required a memory barrier
    or atomic operation in the caller, but nobody actually
    took care of doing it.
    Let's put the barrier in the function instead, and pair it
    with another one in AIO_WAIT_WHILE. Read aio_wait_kick()
    comment for further explanation.
    Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
    Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
    Message-Id: <20220524173054.12651-1-eesposit@redhat.com>
    Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
    Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
    Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 ---
 include/block/aio-wait.h |  2 ++
 util/aio-wait.c          | 16 +++++++++++++++-
 2 files changed, 17 insertions(+), 1 deletion(-)
 diff --git a/include/block/aio-wait.h b/include/block/aio-wait.h
 index b39eefb38d..54840f8622 100644
 --- a/include/block/aio-wait.h
 +++ b/include/block/aio-wait.h
@@ -81,6 +81,8 @@ extern AioWait global_aio_wait;
     AioContext *ctx_ = (ctx);                                      \
     /* Increment wait_->num_waiters before evaluating cond. */     \
     qatomic_inc(&wait_->num_waiters);                              \
 +    /* Paired with smp_mb in aio_wait_kick(). */                   \
 +    smp_mb();                                                      \
     if (ctx_ && in_aio_context_home_thread(ctx_)) {                \
         while ((cond)) {                                           \
             aio_poll(ctx_, true);                                  \
 diff --git a/util/aio-wait.c b/util/aio-wait.c
 index bdb3d3af22..98c5accd29 100644
 --- a/util/aio-wait.c
 +++ b/util/aio-wait.c
@@ -35,7 +35,21 @@ static void dummy_bh_cb(void *opaque)
 void aio_wait_kick(void)
 {
 -    /* The barrier (or an atomic op) is in the caller.  */
 +    /*
 +     * Paired with smp_mb in AIO_WAIT_WHILE. Here we have:
 +     * write(condition);
 +     * aio_wait_kick() {
 +     *      smp_mb();
 +     *      read(num_waiters);
 +     * }
 +     *
 +     * And in AIO_WAIT_WHILE:
 +     * write(num_waiters);
 +     * smp_mb();
 +     * read(condition);
 +     */
 +    smp_mb();
 +
     if (qatomic_read(&global_aio_wait.num_waiters)) {
         aio_bh_schedule_oneshot(qemu_get_aio_context(), dummy_bh_cb, NULL);
     }
 -- 
 2.37.3
--- a/SOURCES/kvm-apic-disable-reentrancy-detection-for-apic-msi.patch
+++ b/SOURCES/kvm-apic-disable-reentrancy-detection-for-apic-msi.patch
@ -0,0 +1,56 @@
 From 47d027147694fde94dd73305ee53b6a136cbeced Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Tue, 9 May 2023 10:29:03 -0400
 Subject: [PATCH 08/15] apic: disable reentrancy detection for apic-msi
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 277: memory: prevent dma-reentracy issues
 RH-Bugzilla: 1999236
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [8/12] 25c3cf99b00cd9adc10d6e7afa9c3e3b7da08de2 (redhat/rhel/src/qemu-kvm/jons-qemu-kvm-2)
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1999236
 Upstream: Merged
 CVE: CVE-2021-3750
 commit 50795ee051a342c681a9b45671c552fbd6274db8
 Author: Alexander Bulekov <alxndr@bu.edu>
 Date:   Thu Apr 27 17:10:13 2023 -0400
    apic: disable reentrancy detection for apic-msi
    As the code is designed for re-entrant calls to apic-msi, mark apic-msi
    as reentrancy-safe.
    Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
    Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
    Message-Id: <20230427211013.2994127-9-alxndr@bu.edu>
    Signed-off-by: Thomas Huth <thuth@redhat.com>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 hw/intc/apic.c | 7 +++++++
 1 file changed, 7 insertions(+)
 diff --git a/hw/intc/apic.c b/hw/intc/apic.c
 index 3df11c34d6..a7c2b301a8 100644
 --- a/hw/intc/apic.c
 +++ b/hw/intc/apic.c
@@ -883,6 +883,13 @@ static void apic_realize(DeviceState *dev, Error **errp)
     memory_region_init_io(&s->io_memory, OBJECT(s), &apic_io_ops, s, "apic-msi",
                           APIC_SPACE_SIZE);
 +    /*
 +     * apic-msi's apic_mem_write can call into ioapic_eoi_broadcast, which can
 +     * write back to apic-msi. As such mark the apic-msi region re-entrancy
 +     * safe.
 +     */
 +    s->io_memory.disable_reentrancy_guard = true;
 +
     s->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, apic_timer, s);
     local_apics[s->id] = s;
 -- 
 2.37.3
--- a/SOURCES/kvm-async-Add-an-optional-reentrancy-guard-to-the-BH-API.patch
+++ b/SOURCES/kvm-async-Add-an-optional-reentrancy-guard-to-the-BH-API.patch
@ -0,0 +1,235 @@
 From 8996ac4369de7e0cb6f911db6f47c3e4ae88c8aa Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Tue, 9 May 2023 10:29:03 -0400
 Subject: [PATCH 02/15] async: Add an optional reentrancy guard to the BH API
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 277: memory: prevent dma-reentracy issues
 RH-Bugzilla: 1999236
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [2/12] b03f247e242a6cdb3eebec36477234ac77dcd20c (redhat/rhel/src/qemu-kvm/jons-qemu-kvm-2)
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1999236
 Upstream: Merged
 CVE: CVE-2021-3750
 Conflict: The file block/graph-lock.h, inluded from include/block/aio.h,
          doesn't exist in this code version. The code compiles without
          issues if this include is just omitted, so we do that.
 commit 9c86c97f12c060bf7484dd931f38634e166a81f0
 Author: Alexander Bulekov <alxndr@bu.edu>
 Date:   Thu Apr 27 17:10:07 2023 -0400
    async: Add an optional reentrancy guard to the BH API
    Devices can pass their MemoryReentrancyGuard (from their DeviceState),
    when creating new BHes. Then, the async API will toggle the guard
    before/after calling the BH call-back. This prevents bh->mmio reentrancy
    issues.
    Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
    Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
    Message-Id: <20230427211013.2994127-3-alxndr@bu.edu>
    [thuth: Fix "line over 90 characters" checkpatch.pl error]
    Signed-off-by: Thomas Huth <thuth@redhat.com>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 docs/devel/multiple-iothreads.txt |  7 +++++++
 include/block/aio.h               | 18 ++++++++++++++++--
 include/qemu/main-loop.h          |  7 +++++--
 tests/unit/ptimer-test-stubs.c    |  3 ++-
 util/async.c                      | 18 +++++++++++++++++-
 util/main-loop.c                  |  6 ++++--
 util/trace-events                 |  1 +
 7 files changed, 52 insertions(+), 8 deletions(-)
 diff --git a/docs/devel/multiple-iothreads.txt b/docs/devel/multiple-iothreads.txt
 index aeb997bed5..a11576bc74 100644
 --- a/docs/devel/multiple-iothreads.txt
 +++ b/docs/devel/multiple-iothreads.txt
@@ -61,6 +61,7 @@ There are several old APIs that use the main loop AioContext:
  * LEGACY qemu_aio_set_event_notifier() - monitor an event notifier
  * LEGACY timer_new_ms() - create a timer
  * LEGACY qemu_bh_new() - create a BH
 + * LEGACY qemu_bh_new_guarded() - create a BH with a device re-entrancy guard
  * LEGACY qemu_aio_wait() - run an event loop iteration
 Since they implicitly work on the main loop they cannot be used in code that
@@ -72,8 +73,14 @@ Instead, use the AioContext functions directly (see include/block/aio.h):
  * aio_set_event_notifier() - monitor an event notifier
  * aio_timer_new() - create a timer
  * aio_bh_new() - create a BH
 + * aio_bh_new_guarded() - create a BH with a device re-entrancy guard
  * aio_poll() - run an event loop iteration
 +The qemu_bh_new_guarded/aio_bh_new_guarded APIs accept a "MemReentrancyGuard"
 +argument, which is used to check for and prevent re-entrancy problems. For
 +BHs associated with devices, the reentrancy-guard is contained in the
 +corresponding DeviceState and named "mem_reentrancy_guard".
 +
 The AioContext can be obtained from the IOThread using
 iothread_get_aio_context() or for the main loop using qemu_get_aio_context().
 Code that takes an AioContext argument works both in IOThreads or the main
 diff --git a/include/block/aio.h b/include/block/aio.h
 index 47fbe9d81f..c7da152985 100644
 --- a/include/block/aio.h
 +++ b/include/block/aio.h
@@ -22,6 +22,8 @@
 #include "qemu/event_notifier.h"
 #include "qemu/thread.h"
 #include "qemu/timer.h"
 +#include "hw/qdev-core.h"
 +
 typedef struct BlockAIOCB BlockAIOCB;
 typedef void BlockCompletionFunc(void *opaque, int ret);
@@ -321,9 +323,11 @@ void aio_bh_schedule_oneshot_full(AioContext *ctx, QEMUBHFunc *cb, void *opaque,
  * is opaque and must be allocated prior to its use.
  *
  * @name: A human-readable identifier for debugging purposes.
 + * @reentrancy_guard: A guard set when entering a cb to prevent
 + * device-reentrancy issues
  */
 QEMUBH *aio_bh_new_full(AioContext *ctx, QEMUBHFunc *cb, void *opaque,
 -                        const char *name);
 +                        const char *name, MemReentrancyGuard *reentrancy_guard);
 /**
  * aio_bh_new: Allocate a new bottom half structure
@@ -332,7 +336,17 @@ QEMUBH *aio_bh_new_full(AioContext *ctx, QEMUBHFunc *cb, void *opaque,
  * string.
  */
 #define aio_bh_new(ctx, cb, opaque) \
 -    aio_bh_new_full((ctx), (cb), (opaque), (stringify(cb)))
 +    aio_bh_new_full((ctx), (cb), (opaque), (stringify(cb)), NULL)
 +
 +/**
 + * aio_bh_new_guarded: Allocate a new bottom half structure with a
 + * reentrancy_guard
 + *
 + * A convenience wrapper for aio_bh_new_full() that uses the cb as the name
 + * string.
 + */
 +#define aio_bh_new_guarded(ctx, cb, opaque, guard) \
 +    aio_bh_new_full((ctx), (cb), (opaque), (stringify(cb)), guard)
 /**
  * aio_notify: Force processing of pending events.
 diff --git a/include/qemu/main-loop.h b/include/qemu/main-loop.h
 index 8dbc6fcb89..85dd5ada9e 100644
 --- a/include/qemu/main-loop.h
 +++ b/include/qemu/main-loop.h
@@ -294,9 +294,12 @@ void qemu_cond_timedwait_iothread(QemuCond *cond, int ms);
 void qemu_fd_register(int fd);
 +#define qemu_bh_new_guarded(cb, opaque, guard) \
 +    qemu_bh_new_full((cb), (opaque), (stringify(cb)), guard)
 #define qemu_bh_new(cb, opaque) \
 -    qemu_bh_new_full((cb), (opaque), (stringify(cb)))
 -QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name);
 +    qemu_bh_new_full((cb), (opaque), (stringify(cb)), NULL)
 +QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name,
 +                         MemReentrancyGuard *reentrancy_guard);
 void qemu_bh_schedule_idle(QEMUBH *bh);
 enum {
 diff --git a/tests/unit/ptimer-test-stubs.c b/tests/unit/ptimer-test-stubs.c
 index 2a3ef58799..a7a2d08e7e 100644
 --- a/tests/unit/ptimer-test-stubs.c
 +++ b/tests/unit/ptimer-test-stubs.c
@@ -108,7 +108,8 @@ int64_t qemu_clock_deadline_ns_all(QEMUClockType type, int attr_mask)
     return deadline;
 }
 -QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name)
 +QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name,
 +                         MemReentrancyGuard *reentrancy_guard)
 {
     QEMUBH *bh = g_new(QEMUBH, 1);
 diff --git a/util/async.c b/util/async.c
 index 2a63bf90f2..1fff02e7fc 100644
 --- a/util/async.c
 +++ b/util/async.c
@@ -62,6 +62,7 @@ struct QEMUBH {
     void *opaque;
     QSLIST_ENTRY(QEMUBH) next;
     unsigned flags;
 +    MemReentrancyGuard *reentrancy_guard;
 };
 /* Called concurrently from any thread */
@@ -127,7 +128,7 @@ void aio_bh_schedule_oneshot_full(AioContext *ctx, QEMUBHFunc *cb,
 }
 QEMUBH *aio_bh_new_full(AioContext *ctx, QEMUBHFunc *cb, void *opaque,
 -                        const char *name)
 +                        const char *name, MemReentrancyGuard *reentrancy_guard)
 {
     QEMUBH *bh;
     bh = g_new(QEMUBH, 1);
@@ -136,13 +137,28 @@ QEMUBH *aio_bh_new_full(AioContext *ctx, QEMUBHFunc *cb, void *opaque,
         .cb = cb,
         .opaque = opaque,
         .name = name,
 +        .reentrancy_guard = reentrancy_guard,
     };
     return bh;
 }
 void aio_bh_call(QEMUBH *bh)
 {
 +    bool last_engaged_in_io = false;
 +
 +    if (bh->reentrancy_guard) {
 +        last_engaged_in_io = bh->reentrancy_guard->engaged_in_io;
 +        if (bh->reentrancy_guard->engaged_in_io) {
 +            trace_reentrant_aio(bh->ctx, bh->name);
 +        }
 +        bh->reentrancy_guard->engaged_in_io = true;
 +    }
 +
     bh->cb(bh->opaque);
 +
 +    if (bh->reentrancy_guard) {
 +        bh->reentrancy_guard->engaged_in_io = last_engaged_in_io;
 +    }
 }
 /* Multiple occurrences of aio_bh_poll cannot be called concurrently. */
 diff --git a/util/main-loop.c b/util/main-loop.c
 index 06b18b195c..1eacf04691 100644
 --- a/util/main-loop.c
 +++ b/util/main-loop.c
@@ -544,9 +544,11 @@ void main_loop_wait(int nonblocking)
 /* Functions to operate on the main QEMU AioContext.  */
 -QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name)
 +QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name,
 +                         MemReentrancyGuard *reentrancy_guard)
 {
 -    return aio_bh_new_full(qemu_aio_context, cb, opaque, name);
 +    return aio_bh_new_full(qemu_aio_context, cb, opaque, name,
 +                           reentrancy_guard);
 }
 /*
 diff --git a/util/trace-events b/util/trace-events
 index c8f53d7d9f..dc3b1eb3bf 100644
 --- a/util/trace-events
 +++ b/util/trace-events
@@ -11,6 +11,7 @@ poll_remove(void *ctx, void *node, int fd) "ctx %p node %p fd %d"
 # async.c
 aio_co_schedule(void *ctx, void *co) "ctx %p co %p"
 aio_co_schedule_bh_cb(void *ctx, void *co) "ctx %p co %p"
 +reentrant_aio(void *ctx, const char *name) "ctx %p name %s"
 # thread-pool.c
 thread_pool_submit(void *pool, void *req, void *opaque) "pool %p req %p opaque %p"
 -- 
 2.37.3
--- a/SOURCES/kvm-async-avoid-use-after-free-on-re-entrancy-guard.patch
+++ b/SOURCES/kvm-async-avoid-use-after-free-on-re-entrancy-guard.patch
@ -0,0 +1,71 @@
 From d754050d260e2ad890cecd975df6e163c531b40e Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Tue, 9 May 2023 10:29:03 -0400
 Subject: [PATCH 09/15] async: avoid use-after-free on re-entrancy guard
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 277: memory: prevent dma-reentracy issues
 RH-Bugzilla: 1999236
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [9/12] d357650e581c3921bbfe3e2fde5e3f55853b5fab (redhat/rhel/src/qemu-kvm/jons-qemu-kvm-2)
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1999236
 Upstream: Merged
 CVE: CVE-2021-3750
 commit 7915bd06f25e1803778081161bf6fa10c42dc7cd
 Author: Alexander Bulekov <alxndr@bu.edu>
 Date:   Mon May 1 10:19:56 2023 -0400
    async: avoid use-after-free on re-entrancy guard
    A BH callback can free the BH, causing a use-after-free in aio_bh_call.
    Fix that by keeping a local copy of the re-entrancy guard pointer.
    Buglink: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58513
    Fixes: 9c86c97f12 ("async: Add an optional reentrancy guard to the BH API")
    Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
    Message-Id: <20230501141956.3444868-1-alxndr@bu.edu>
    Reviewed-by: Thomas Huth <thuth@redhat.com>
    Signed-off-by: Thomas Huth <thuth@redhat.com>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 util/async.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)
 diff --git a/util/async.c b/util/async.c
 index 1fff02e7fc..ffe0541c3b 100644
 --- a/util/async.c
 +++ b/util/async.c
@@ -146,18 +146,20 @@ void aio_bh_call(QEMUBH *bh)
 {
     bool last_engaged_in_io = false;
 -    if (bh->reentrancy_guard) {
 -        last_engaged_in_io = bh->reentrancy_guard->engaged_in_io;
 -        if (bh->reentrancy_guard->engaged_in_io) {
 +    /* Make a copy of the guard-pointer as cb may free the bh */
 +    MemReentrancyGuard *reentrancy_guard = bh->reentrancy_guard;
 +    if (reentrancy_guard) {
 +        last_engaged_in_io = reentrancy_guard->engaged_in_io;
 +        if (reentrancy_guard->engaged_in_io) {
             trace_reentrant_aio(bh->ctx, bh->name);
         }
 -        bh->reentrancy_guard->engaged_in_io = true;
 +        reentrancy_guard->engaged_in_io = true;
     }
     bh->cb(bh->opaque);
 -    if (bh->reentrancy_guard) {
 -        bh->reentrancy_guard->engaged_in_io = last_engaged_in_io;
 +    if (reentrancy_guard) {
 +        reentrancy_guard->engaged_in_io = last_engaged_in_io;
     }
 }
 -- 
 2.37.3
--- a/SOURCES/kvm-async-clarify-usage-of-barriers-in-the-polling-case.patch
+++ b/SOURCES/kvm-async-clarify-usage-of-barriers-in-the-polling-case.patch
@ -0,0 +1,66 @@
 From 187eb7a418af93375e42298d06e231e2bec3cf00 Mon Sep 17 00:00:00 2001
 From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date: Thu, 9 Mar 2023 08:15:42 -0500
 Subject: [PATCH 10/13] async: clarify usage of barriers in the polling case
 RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-MergeRequest: 263: qatomic: add smp_mb__before/after_rmw()
 RH-Bugzilla: 2168472
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: Eric Auger <eric.auger@redhat.com>
 RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
 RH-Acked-by: David Hildenbrand <david@redhat.com>
 RH-Commit: [10/10] 3be07ccc6137a0336becfe63a818d9cbadb38e9c
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2168472
 commit 6229438cca037d42f44a96d38feb15cb102a444f
 Author: Paolo Bonzini <pbonzini@redhat.com>
 Date:   Mon Mar 6 10:43:52 2023 +0100
    async: clarify usage of barriers in the polling case
    Explain that aio_context_notifier_poll() relies on
    aio_notify_accept() to catch all the memory writes that were
    done before ctx->notified was set to true.
    Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
    Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 ---
 util/async.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)
 diff --git a/util/async.c b/util/async.c
 index 795fe699b6..2a63bf90f2 100644
 --- a/util/async.c
 +++ b/util/async.c
@@ -463,8 +463,9 @@ void aio_notify_accept(AioContext *ctx)
     qatomic_set(&ctx->notified, false);
     /*
 -     * Write ctx->notified before reading e.g. bh->flags.  Pairs with smp_wmb
 -     * in aio_notify.
 +     * Order reads of ctx->notified (in aio_context_notifier_poll()) and the
 +     * above clearing of ctx->notified before reads of e.g. bh->flags.  Pairs
 +     * with smp_wmb() in aio_notify.
      */
     smp_mb();
 }
@@ -487,6 +488,11 @@ static bool aio_context_notifier_poll(void *opaque)
     EventNotifier *e = opaque;
     AioContext *ctx = container_of(e, AioContext, notifier);
 +    /*
 +     * No need for load-acquire because we just want to kick the
 +     * event loop.  aio_notify_accept() takes care of synchronizing
 +     * the event loop with the producers.
 +     */
     return qatomic_read(&ctx->notified);
 }
 -- 
 2.37.3
--- a/SOURCES/kvm-async-update-documentation-of-the-memory-barriers.patch
+++ b/SOURCES/kvm-async-update-documentation-of-the-memory-barriers.patch
@ -0,0 +1,111 @@
 From ea3856bb545d19499602830cdc3076d83a981e7a Mon Sep 17 00:00:00 2001
 From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date: Thu, 9 Mar 2023 08:15:36 -0500
 Subject: [PATCH 09/13] async: update documentation of the memory barriers
 RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-MergeRequest: 263: qatomic: add smp_mb__before/after_rmw()
 RH-Bugzilla: 2168472
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Acked-by: Eric Auger <eric.auger@redhat.com>
 RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
 RH-Acked-by: David Hildenbrand <david@redhat.com>
 RH-Commit: [9/10] d471da2acf7a107cf75f3327c5e8d7456307160e
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2168472
 commit 8dd48650b43dfde4ebea34191ac267e474bcc29e
 Author: Paolo Bonzini <pbonzini@redhat.com>
 Date:   Mon Mar 6 10:15:06 2023 +0100
    async: update documentation of the memory barriers
    Ever since commit 8c6b0356b539 ("util/async: make bh_aio_poll() O(1)",
    2020-02-22), synchronization between qemu_bh_schedule() and aio_bh_poll()
    is happening when the bottom half is enqueued in the bh_list; not
    when the flags are set.  Update the documentation to match.
    Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 ---
 util/async.c | 33 +++++++++++++++++++--------------
 1 file changed, 19 insertions(+), 14 deletions(-)
 diff --git a/util/async.c b/util/async.c
 index 6f6717a34b..795fe699b6 100644
 --- a/util/async.c
 +++ b/util/async.c
@@ -71,14 +71,21 @@ static void aio_bh_enqueue(QEMUBH *bh, unsigned new_flags)
     unsigned old_flags;
     /*
 -     * The memory barrier implicit in qatomic_fetch_or makes sure that:
 -     * 1. idle & any writes needed by the callback are done before the
 -     *    locations are read in the aio_bh_poll.
 -     * 2. ctx is loaded before the callback has a chance to execute and bh
 -     *    could be freed.
 +     * Synchronizes with atomic_fetch_and() in aio_bh_dequeue(), ensuring that
 +     * insertion starts after BH_PENDING is set.
      */
     old_flags = qatomic_fetch_or(&bh->flags, BH_PENDING | new_flags);
 +
     if (!(old_flags & BH_PENDING)) {
 +        /*
 +         * At this point the bottom half becomes visible to aio_bh_poll().
 +         * This insertion thus synchronizes with QSLIST_MOVE_ATOMIC in
 +         * aio_bh_poll(), ensuring that:
 +         * 1. any writes needed by the callback are visible from the callback
 +         *    after aio_bh_dequeue() returns bh.
 +         * 2. ctx is loaded before the callback has a chance to execute and bh
 +         *    could be freed.
 +         */
         QSLIST_INSERT_HEAD_ATOMIC(&ctx->bh_list, bh, next);
     }
@@ -97,11 +104,8 @@ static QEMUBH *aio_bh_dequeue(BHList *head, unsigned *flags)
     QSLIST_REMOVE_HEAD(head, next);
     /*
 -     * The qatomic_and is paired with aio_bh_enqueue().  The implicit memory
 -     * barrier ensures that the callback sees all writes done by the scheduling
 -     * thread.  It also ensures that the scheduling thread sees the cleared
 -     * flag before bh->cb has run, and thus will call aio_notify again if
 -     * necessary.
 +     * Synchronizes with qatomic_fetch_or() in aio_bh_enqueue(), ensuring that
 +     * the removal finishes before BH_PENDING is reset.
      */
     *flags = qatomic_fetch_and(&bh->flags,
                               ~(BH_PENDING | BH_SCHEDULED | BH_IDLE));
@@ -148,6 +152,7 @@ int aio_bh_poll(AioContext *ctx)
     BHListSlice *s;
     int ret = 0;
 +    /* Synchronizes with QSLIST_INSERT_HEAD_ATOMIC in aio_bh_enqueue().  */
     QSLIST_MOVE_ATOMIC(&slice.bh_list, &ctx->bh_list);
     QSIMPLEQ_INSERT_TAIL(&ctx->bh_slice_list, &slice, next);
@@ -437,15 +442,15 @@ LuringState *aio_get_linux_io_uring(AioContext *ctx)
 void aio_notify(AioContext *ctx)
 {
     /*
 -     * Write e.g. bh->flags before writing ctx->notified.  Pairs with smp_mb in
 -     * aio_notify_accept.
 +     * Write e.g. ctx->bh_list before writing ctx->notified.  Pairs with
 +     * smp_mb() in aio_notify_accept().
      */
     smp_wmb();
     qatomic_set(&ctx->notified, true);
     /*
 -     * Write ctx->notified before reading ctx->notify_me.  Pairs
 -     * with smp_mb in aio_ctx_prepare or aio_poll.
 +     * Write ctx->notified (and also ctx->bh_list) before reading ctx->notify_me.
 +     * Pairs with smp_mb() in aio_ctx_prepare or aio_poll.
      */
     smp_mb();
     if (qatomic_read(&ctx->notify_me)) {
 -- 
 2.37.3
--- a/SOURCES/kvm-backends-hostmem-Fix-support-of-memory-backend-memfd.patch
+++ b/SOURCES/kvm-backends-hostmem-Fix-support-of-memory-backend-memfd.patch
@ -0,0 +1,71 @@
 From 60da56e3685969493ae483c3cc2c66af13d00baf Mon Sep 17 00:00:00 2001
 From: Thomas Huth <thuth@redhat.com>
 Date: Wed, 10 Aug 2022 14:57:18 +0200
 Subject: [PATCH 1/3] backends/hostmem: Fix support of memory-backend-memfd in
 qemu_maxrampagesize()
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Cédric Le Goater <None>
 RH-MergeRequest: 221: backends/hostmem: Fix support of memory-backend-memfd in qemu_maxrampagesize()
 RH-Bugzilla: 2117149
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: David Hildenbrand <david@redhat.com>
 RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
 RH-Commit: [1/1] b5a1047750af32c0a261b8385ea0e819eb16681a
 It is currently not possible yet to use "memory-backend-memfd" on s390x
 with hugepages enabled. This problem is caused by qemu_maxrampagesize()
 not taking memory-backend-memfd objects into account yet, so the code
 in s390_memory_init() fails to enable the huge page support there via
 s390_set_max_pagesize(). Fix it by generalizing the code, so that it
 looks at qemu_ram_pagesize(memdev->mr.ram_block) instead of re-trying
 to get the information from the filesystem.
 Suggested-by: David Hildenbrand <david@redhat.com>
 Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2116496
 Message-Id: <20220810125720.3849835-2-thuth@redhat.com>
 Reviewed-by: David Hildenbrand <david@redhat.com>
 Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 (cherry picked from commit 8be934b70e923104da883b990dee18f02552d40e)
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2117149
 [clg: Resolved conflict on qemu_real_host_page_size() ]
 Signed-off-by: Cédric Le Goater <clg@redhat.com>
 ---
 backends/hostmem.c | 14 ++------------
 1 file changed, 2 insertions(+), 12 deletions(-)
 diff --git a/backends/hostmem.c b/backends/hostmem.c
 index 4c05862ed5..0c4654ea85 100644
 --- a/backends/hostmem.c
 +++ b/backends/hostmem.c
@@ -305,22 +305,12 @@ bool host_memory_backend_is_mapped(HostMemoryBackend *backend)
     return backend->is_mapped;
 }
 -#ifdef __linux__
 size_t host_memory_backend_pagesize(HostMemoryBackend *memdev)
 {
 -    Object *obj = OBJECT(memdev);
 -    char *path = object_property_get_str(obj, "mem-path", NULL);
 -    size_t pagesize = qemu_mempath_getpagesize(path);
 -
 -    g_free(path);
 +    size_t pagesize = qemu_ram_pagesize(memdev->mr.ram_block);
 +    g_assert(pagesize >= qemu_real_host_page_size);
     return pagesize;
 }
 -#else
 -size_t host_memory_backend_pagesize(HostMemoryBackend *memdev)
 -{
 -    return qemu_real_host_page_size;
 -}
 -#endif
 static void
 host_memory_backend_memory_complete(UserCreatable *uc, Error **errp)
 -- 
 2.35.3
--- a/SOURCES/kvm-bcm2835_property-disable-reentrancy-detection-for-io.patch
+++ b/SOURCES/kvm-bcm2835_property-disable-reentrancy-detection-for-io.patch
@ -0,0 +1,58 @@
 From 7715635d018351e0a5c4c25aec2c71a2fe3b9e69 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Tue, 9 May 2023 10:29:03 -0400
 Subject: [PATCH 06/15] bcm2835_property: disable reentrancy detection for
 iomem
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 277: memory: prevent dma-reentracy issues
 RH-Bugzilla: 1999236
 RH-Acked-by: Thomas Huth <thuth@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [6/12] 4d6187430ca1c4309a36824c0c6815d2a763db1a (redhat/rhel/src/qemu-kvm/jons-qemu-kvm-2)
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1999236
 Upstream: Merged
 CVE: CVE-2021-3750
 commit 985c4a4e547afb9573b6bd6843d20eb2c3d1d1cd
 Author: Alexander Bulekov <alxndr@bu.edu>
 Date:   Thu Apr 27 17:10:11 2023 -0400
    bcm2835_property: disable reentrancy detection for iomem
    As the code is designed for re-entrant calls from bcm2835_property to
    bcm2835_mbox and back into bcm2835_property, mark iomem as
    reentrancy-safe.
    Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
    Reviewed-by: Thomas Huth <thuth@redhat.com>
    Message-Id: <20230427211013.2994127-7-alxndr@bu.edu>
    Signed-off-by: Thomas Huth <thuth@redhat.com>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 hw/misc/bcm2835_property.c | 7 +++++++
 1 file changed, 7 insertions(+)
 diff --git a/hw/misc/bcm2835_property.c b/hw/misc/bcm2835_property.c
 index 73941bdae9..022b5a849c 100644
 --- a/hw/misc/bcm2835_property.c
 +++ b/hw/misc/bcm2835_property.c
@@ -377,6 +377,13 @@ static void bcm2835_property_init(Object *obj)
     memory_region_init_io(&s->iomem, OBJECT(s), &bcm2835_property_ops, s,
                           TYPE_BCM2835_PROPERTY, 0x10);
 +
 +    /*
 +     * bcm2835_property_ops call into bcm2835_mbox, which in-turn reads from
 +     * iomem. As such, mark iomem as re-entracy safe.
 +     */
 +    s->iomem.disable_reentrancy_guard = true;
 +
     sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
     sysbus_init_irq(SYS_BUS_DEVICE(s), &s->mbox_irq);
 }
 -- 
 2.37.3
--- a/SOURCES/kvm-block-Collapse-padded-I-O-vecs-exceeding-IOV_MAX.patch
+++ b/SOURCES/kvm-block-Collapse-padded-I-O-vecs-exceeding-IOV_MAX.patch
@ -0,0 +1,359 @@
 From 1f7520baa6f0bf02ccba2ebfe7d1d5bf6520f95a Mon Sep 17 00:00:00 2001
 From: Hanna Czenczek <hreitz@redhat.com>
 Date: Tue, 11 Apr 2023 19:34:16 +0200
 Subject: [PATCH 2/5] block: Collapse padded I/O vecs exceeding IOV_MAX
 RH-Author: Hanna Czenczek <hreitz@redhat.com>
 RH-MergeRequest: 291: block: Split padded I/O vectors exceeding IOV_MAX
 RH-Bugzilla: 2141964
 RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Commit: [2/5] 1d86ce8398e4ab66e308a686f9855c963e52b0a9
 When processing vectored guest requests that are not aligned to the
 storage request alignment, we pad them by adding head and/or tail
 buffers for a read-modify-write cycle.
 The guest can submit I/O vectors up to IOV_MAX (1024) in length, but
 with this padding, the vector can exceed that limit.  As of
 4c002cef0e9abe7135d7916c51abce47f7fc1ee2 ("util/iov: make
 qemu_iovec_init_extended() honest"), we refuse to pad vectors beyond the
 limit, instead returning an error to the guest.
 To the guest, this appears as a random I/O error.  We should not return
 an I/O error to the guest when it issued a perfectly valid request.
 Before 4c002cef0e9abe7135d7916c51abce47f7fc1ee2, we just made the vector
 longer than IOV_MAX, which generally seems to work (because the guest
 assumes a smaller alignment than we really have, file-posix's
 raw_co_prw() will generally see bdrv_qiov_is_aligned() return false, and
 so emulate the request, so that the IOV_MAX does not matter).  However,
 that does not seem exactly great.
 I see two ways to fix this problem:
 1. We split such long requests into two requests.
 2. We join some elements of the vector into new buffers to make it
   shorter.
 I am wary of (1), because it seems like it may have unintended side
 effects.
 (2) on the other hand seems relatively simple to implement, with
 hopefully few side effects, so this patch does that.
 To do this, the use of qemu_iovec_init_extended() in bdrv_pad_request()
 is effectively replaced by the new function bdrv_create_padded_qiov(),
 which not only wraps the request IOV with padding head/tail, but also
 ensures that the resulting vector will not have more than IOV_MAX
 elements.  Putting that functionality into qemu_iovec_init_extended() is
 infeasible because it requires allocating a bounce buffer; doing so
 would require many more parameters (buffer alignment, how to initialize
 the buffer, and out parameters like the buffer, its length, and the
 original elements), which is not reasonable.
 Conversely, it is not difficult to move qemu_iovec_init_extended()'s
 functionality into bdrv_create_padded_qiov() by using public
 qemu_iovec_* functions, so that is what this patch does.
 Because bdrv_pad_request() was the only "serious" user of
 qemu_iovec_init_extended(), the next patch will remove the latter
 function, so the functionality is not implemented twice.
 Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2141964
 Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 Message-Id: <20230411173418.19549-3-hreitz@redhat.com>
 Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
 (cherry picked from commit 18743311b829cafc1737a5f20bc3248d5f91ee2a)
 Conflicts:
 	block/io.c: Downstream bdrv_pad_request() has no @flags
        parameter.
 Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 ---
 block/io.c | 166 ++++++++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 151 insertions(+), 15 deletions(-)
 diff --git a/block/io.c b/block/io.c
 index c3e7301613..0fe8f0dd40 100644
 --- a/block/io.c
 +++ b/block/io.c
@@ -1624,6 +1624,14 @@ out:
  * @merge_reads is true for small requests,
  * if @buf_len == @head + bytes + @tail. In this case it is possible that both
  * head and tail exist but @buf_len == align and @tail_buf == @buf.
 + *
 + * @write is true for write requests, false for read requests.
 + *
 + * If padding makes the vector too long (exceeding IOV_MAX), then we need to
 + * merge existing vector elements into a single one.  @collapse_bounce_buf acts
 + * as the bounce buffer in such cases.  @pre_collapse_qiov has the pre-collapse
 + * I/O vector elements so for read requests, the data can be copied back after
 + * the read is done.
  */
 typedef struct BdrvRequestPadding {
     uint8_t *buf;
@@ -1632,11 +1640,17 @@ typedef struct BdrvRequestPadding {
     size_t head;
     size_t tail;
     bool merge_reads;
 +    bool write;
     QEMUIOVector local_qiov;
 +
 +    uint8_t *collapse_bounce_buf;
 +    size_t collapse_len;
 +    QEMUIOVector pre_collapse_qiov;
 } BdrvRequestPadding;
 static bool bdrv_init_padding(BlockDriverState *bs,
                               int64_t offset, int64_t bytes,
 +                              bool write,
                               BdrvRequestPadding *pad)
 {
     int64_t align = bs->bl.request_alignment;
@@ -1668,6 +1682,8 @@ static bool bdrv_init_padding(BlockDriverState *bs,
         pad->tail_buf = pad->buf + pad->buf_len - align;
     }
 +    pad->write = write;
 +
     return true;
 }
@@ -1733,8 +1749,23 @@ zero_mem:
     return 0;
 }
 -static void bdrv_padding_destroy(BdrvRequestPadding *pad)
 +/**
 + * Free *pad's associated buffers, and perform any necessary finalization steps.
 + */
 +static void bdrv_padding_finalize(BdrvRequestPadding *pad)
 {
 +    if (pad->collapse_bounce_buf) {
 +        if (!pad->write) {
 +            /*
 +             * If padding required elements in the vector to be collapsed into a
 +             * bounce buffer, copy the bounce buffer content back
 +             */
 +            qemu_iovec_from_buf(&pad->pre_collapse_qiov, 0,
 +                                pad->collapse_bounce_buf, pad->collapse_len);
 +        }
 +        qemu_vfree(pad->collapse_bounce_buf);
 +        qemu_iovec_destroy(&pad->pre_collapse_qiov);
 +    }
     if (pad->buf) {
         qemu_vfree(pad->buf);
         qemu_iovec_destroy(&pad->local_qiov);
@@ -1742,6 +1773,101 @@ static void bdrv_padding_destroy(BdrvRequestPadding *pad)
     memset(pad, 0, sizeof(*pad));
 }
 +/*
 + * Create pad->local_qiov by wrapping @iov in the padding head and tail, while
 + * ensuring that the resulting vector will not exceed IOV_MAX elements.
 + *
 + * To ensure this, when necessary, the first two or three elements of @iov are
 + * merged into pad->collapse_bounce_buf and replaced by a reference to that
 + * bounce buffer in pad->local_qiov.
 + *
 + * After performing a read request, the data from the bounce buffer must be
 + * copied back into pad->pre_collapse_qiov (e.g. by bdrv_padding_finalize()).
 + */
 +static int bdrv_create_padded_qiov(BlockDriverState *bs,
 +                                   BdrvRequestPadding *pad,
 +                                   struct iovec *iov, int niov,
 +                                   size_t iov_offset, size_t bytes)
 +{
 +    int padded_niov, surplus_count, collapse_count;
 +
 +    /* Assert this invariant */
 +    assert(niov <= IOV_MAX);
 +
 +    /*
 +     * Cannot pad if resulting length would exceed SIZE_MAX.  Returning an error
 +     * to the guest is not ideal, but there is little else we can do.  At least
 +     * this will practically never happen on 64-bit systems.
 +     */
 +    if (SIZE_MAX - pad->head < bytes ||
 +        SIZE_MAX - pad->head - bytes < pad->tail)
 +    {
 +        return -EINVAL;
 +    }
 +
 +    /* Length of the resulting IOV if we just concatenated everything */
 +    padded_niov = !!pad->head + niov + !!pad->tail;
 +
 +    qemu_iovec_init(&pad->local_qiov, MIN(padded_niov, IOV_MAX));
 +
 +    if (pad->head) {
 +        qemu_iovec_add(&pad->local_qiov, pad->buf, pad->head);
 +    }
 +
 +    /*
 +     * If padded_niov > IOV_MAX, we cannot just concatenate everything.
 +     * Instead, merge the first two or three elements of @iov to reduce the
 +     * number of vector elements as necessary.
 +     */
 +    if (padded_niov > IOV_MAX) {
 +        /*
 +         * Only head and tail can have lead to the number of entries exceeding
 +         * IOV_MAX, so we can exceed it by the head and tail at most.  We need
 +         * to reduce the number of elements by `surplus_count`, so we merge that
 +         * many elements plus one into one element.
 +         */
 +        surplus_count = padded_niov - IOV_MAX;
 +        assert(surplus_count <= !!pad->head + !!pad->tail);
 +        collapse_count = surplus_count + 1;
 +
 +        /*
 +         * Move the elements to collapse into `pad->pre_collapse_qiov`, then
 +         * advance `iov` (and associated variables) by those elements.
 +         */
 +        qemu_iovec_init(&pad->pre_collapse_qiov, collapse_count);
 +        qemu_iovec_concat_iov(&pad->pre_collapse_qiov, iov,
 +                              collapse_count, iov_offset, SIZE_MAX);
 +        iov += collapse_count;
 +        iov_offset = 0;
 +        niov -= collapse_count;
 +        bytes -= pad->pre_collapse_qiov.size;
 +
 +        /*
 +         * Construct the bounce buffer to match the length of the to-collapse
 +         * vector elements, and for write requests, initialize it with the data
 +         * from those elements.  Then add it to `pad->local_qiov`.
 +         */
 +        pad->collapse_len = pad->pre_collapse_qiov.size;
 +        pad->collapse_bounce_buf = qemu_blockalign(bs, pad->collapse_len);
 +        if (pad->write) {
 +            qemu_iovec_to_buf(&pad->pre_collapse_qiov, 0,
 +                              pad->collapse_bounce_buf, pad->collapse_len);
 +        }
 +        qemu_iovec_add(&pad->local_qiov,
 +                       pad->collapse_bounce_buf, pad->collapse_len);
 +    }
 +
 +    qemu_iovec_concat_iov(&pad->local_qiov, iov, niov, iov_offset, bytes);
 +
 +    if (pad->tail) {
 +        qemu_iovec_add(&pad->local_qiov,
 +                       pad->buf + pad->buf_len - pad->tail, pad->tail);
 +    }
 +
 +    assert(pad->local_qiov.niov == MIN(padded_niov, IOV_MAX));
 +    return 0;
 +}
 +
 /*
  * bdrv_pad_request
  *
@@ -1749,6 +1875,8 @@ static void bdrv_padding_destroy(BdrvRequestPadding *pad)
  * read of padding, bdrv_padding_rmw_read() should be called separately if
  * needed.
  *
 + * @write is true for write requests, false for read requests.
 + *
  * Request parameters (@qiov, &qiov_offset, &offset, &bytes) are in-out:
  *  - on function start they represent original request
  *  - on failure or when padding is not needed they are unchanged
@@ -1757,25 +1885,33 @@ static void bdrv_padding_destroy(BdrvRequestPadding *pad)
 static int bdrv_pad_request(BlockDriverState *bs,
                             QEMUIOVector **qiov, size_t *qiov_offset,
                             int64_t *offset, int64_t *bytes,
 +                            bool write,
                             BdrvRequestPadding *pad, bool *padded)
 {
     int ret;
 +    struct iovec *sliced_iov;
 +    int sliced_niov;
 +    size_t sliced_head, sliced_tail;
     bdrv_check_qiov_request(*offset, *bytes, *qiov, *qiov_offset, &error_abort);
 -    if (!bdrv_init_padding(bs, *offset, *bytes, pad)) {
 +    if (!bdrv_init_padding(bs, *offset, *bytes, write, pad)) {
         if (padded) {
             *padded = false;
         }
         return 0;
     }
 -    ret = qemu_iovec_init_extended(&pad->local_qiov, pad->buf, pad->head,
 -                                   *qiov, *qiov_offset, *bytes,
 -                                   pad->buf + pad->buf_len - pad->tail,
 -                                   pad->tail);
 +    sliced_iov = qemu_iovec_slice(*qiov, *qiov_offset, *bytes,
 +                                  &sliced_head, &sliced_tail,
 +                                  &sliced_niov);
 +
 +    /* Guaranteed by bdrv_check_qiov_request() */
 +    assert(*bytes <= SIZE_MAX);
 +    ret = bdrv_create_padded_qiov(bs, pad, sliced_iov, sliced_niov,
 +                                  sliced_head, *bytes);
     if (ret < 0) {
 -        bdrv_padding_destroy(pad);
 +        bdrv_padding_finalize(pad);
         return ret;
     }
     *bytes += pad->head + pad->tail;
@@ -1836,8 +1972,8 @@ int coroutine_fn bdrv_co_preadv_part(BdrvChild *child,
         flags |= BDRV_REQ_COPY_ON_READ;
     }
 -    ret = bdrv_pad_request(bs, &qiov, &qiov_offset, &offset, &bytes, &pad,
 -                           NULL);
 +    ret = bdrv_pad_request(bs, &qiov, &qiov_offset, &offset, &bytes, false,
 +                           &pad, NULL);
     if (ret < 0) {
         goto fail;
     }
@@ -1847,7 +1983,7 @@ int coroutine_fn bdrv_co_preadv_part(BdrvChild *child,
                               bs->bl.request_alignment,
                               qiov, qiov_offset, flags);
     tracked_request_end(&req);
 -    bdrv_padding_destroy(&pad);
 +    bdrv_padding_finalize(&pad);
 fail:
     bdrv_dec_in_flight(bs);
@@ -2167,7 +2303,7 @@ static int coroutine_fn bdrv_co_do_zero_pwritev(BdrvChild *child,
     bool padding;
     BdrvRequestPadding pad;
 -    padding = bdrv_init_padding(bs, offset, bytes, &pad);
 +    padding = bdrv_init_padding(bs, offset, bytes, true, &pad);
     if (padding) {
         bdrv_make_request_serialising(req, align);
@@ -2214,7 +2350,7 @@ static int coroutine_fn bdrv_co_do_zero_pwritev(BdrvChild *child,
     }
 out:
 -    bdrv_padding_destroy(&pad);
 +    bdrv_padding_finalize(&pad);
     return ret;
 }
@@ -2280,8 +2416,8 @@ int coroutine_fn bdrv_co_pwritev_part(BdrvChild *child,
          * bdrv_co_do_zero_pwritev() does aligning by itself, so, we do
          * alignment only if there is no ZERO flag.
          */
 -        ret = bdrv_pad_request(bs, &qiov, &qiov_offset, &offset, &bytes, &pad,
 -                               &padded);
 +        ret = bdrv_pad_request(bs, &qiov, &qiov_offset, &offset, &bytes, true,
 +                               &pad, &padded);
         if (ret < 0) {
             return ret;
         }
@@ -2310,7 +2446,7 @@ int coroutine_fn bdrv_co_pwritev_part(BdrvChild *child,
     ret = bdrv_aligned_pwritev(child, &req, offset, bytes, align,
                                qiov, qiov_offset, flags);
 -    bdrv_padding_destroy(&pad);
 +    bdrv_padding_finalize(&pad);
 out:
     tracked_request_end(&req);
 -- 
 2.39.3
--- a/SOURCES/kvm-block-Fix-pad_request-s-request-restriction.patch
+++ b/SOURCES/kvm-block-Fix-pad_request-s-request-restriction.patch
@ -0,0 +1,75 @@
 From b9866279996ee065cb524bf30bc70e22efbab303 Mon Sep 17 00:00:00 2001
 From: Hanna Czenczek <hreitz@redhat.com>
 Date: Fri, 14 Jul 2023 10:59:38 +0200
 Subject: [PATCH 5/5] block: Fix pad_request's request restriction
 RH-Author: Hanna Czenczek <hreitz@redhat.com>
 RH-MergeRequest: 291: block: Split padded I/O vectors exceeding IOV_MAX
 RH-Bugzilla: 2141964
 RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Commit: [5/5] f9188bd089d6c67185ea1accde20d491a2ed3193
 bdrv_pad_request() relies on requests' lengths not to exceed SIZE_MAX,
 which bdrv_check_qiov_request() does not guarantee.
 bdrv_check_request32() however will guarantee this, and both of
 bdrv_pad_request()'s callers (bdrv_co_preadv_part() and
 bdrv_co_pwritev_part()) already run it before calling
 bdrv_pad_request().  Therefore, bdrv_pad_request() can safely call
 bdrv_check_request32() without expecting error, too.
 In effect, this patch will not change guest-visible behavior.  It is a
 clean-up to tighten a condition to match what is guaranteed by our
 callers, and which exists purely to show clearly why the subsequent
 assertion (`assert(*bytes <= SIZE_MAX)`) is always true.
 Note there is a difference between the interfaces of
 bdrv_check_qiov_request() and bdrv_check_request32(): The former takes
 an errp, the latter does not, so we can no longer just pass
 &error_abort.  Instead, we need to check the returned value.  While we
 do expect success (because the callers have already run this function),
 an assert(ret == 0) is not much simpler than just to return an error if
 it occurs, so let us handle errors by returning them up the stack now.
 Reported-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 Message-id: 20230714085938.202730-1-hreitz@redhat.com
 Fixes: 18743311b829cafc1737a5f20bc3248d5f91ee2a
       ("block: Collapse padded I/O vecs exceeding IOV_MAX")
 Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 ---
 block/io.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)
 diff --git a/block/io.c b/block/io.c
 index 0fe8f0dd40..8ae57728a6 100644
 --- a/block/io.c
 +++ b/block/io.c
@@ -1893,7 +1893,11 @@ static int bdrv_pad_request(BlockDriverState *bs,
     int sliced_niov;
     size_t sliced_head, sliced_tail;
 -    bdrv_check_qiov_request(*offset, *bytes, *qiov, *qiov_offset, &error_abort);
 +    /* Should have been checked by the caller already */
 +    ret = bdrv_check_request32(*offset, *bytes, *qiov, *qiov_offset);
 +    if (ret < 0) {
 +        return ret;
 +    }
     if (!bdrv_init_padding(bs, *offset, *bytes, write, pad)) {
         if (padded) {
@@ -1906,7 +1910,7 @@ static int bdrv_pad_request(BlockDriverState *bs,
                                   &sliced_head, &sliced_tail,
                                   &sliced_niov);
 -    /* Guaranteed by bdrv_check_qiov_request() */
 +    /* Guaranteed by bdrv_check_request32() */
     assert(*bytes <= SIZE_MAX);
     ret = bdrv_create_padded_qiov(bs, pad, sliced_iov, sliced_niov,
                                   sliced_head, *bytes);
 -- 
 2.39.3
--- a/SOURCES/kvm-block-Lock-AioContext-for-drain_end-in-blockdev-reop.patch
+++ b/SOURCES/kvm-block-Lock-AioContext-for-drain_end-in-blockdev-reop.patch
@ -0,0 +1,63 @@
 From b21fa5ecd9acf2b91839a2915fb4bb39dac4c803 Mon Sep 17 00:00:00 2001
 From: Kevin Wolf <kwolf@redhat.com>
 Date: Thu, 3 Feb 2022 15:05:33 +0100
 Subject: [PATCH 2/5] block: Lock AioContext for drain_end in blockdev-reopen
 RH-Author: Kevin Wolf <kwolf@redhat.com>
 RH-MergeRequest: 142: block: Lock AioContext for drain_end in blockdev-reopen
 RH-Commit: [1/2] 98de3b5987f88ea6b4b503f623d6c4475574e037
 RH-Bugzilla: 2067118
 RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Hanna Reitz <hreitz@redhat.com>
 bdrv_subtree_drained_end() requires the caller to hold the AioContext
 lock for the drained node. Not doing this for nodes outside of the main
 AioContext leads to crashes when AIO_WAIT_WHILE() needs to wait and
 tries to temporarily release the lock.
 Fixes: 3908b7a8994fa5ef7a89aa58cd5a02fc58141592
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2046659
 Reported-by: Qing Wang <qinwang@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 Message-Id: <20220203140534.36522-2-kwolf@redhat.com>
 Reviewed-by: Hanna Reitz <hreitz@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit aba8205be0707b9d108e32254e186ba88107a869)
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
 blockdev.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)
 diff --git a/blockdev.c b/blockdev.c
 index b35072644e..565f6a81fd 100644
 --- a/blockdev.c
 +++ b/blockdev.c
@@ -3562,6 +3562,7 @@ void qmp_blockdev_reopen(BlockdevOptionsList *reopen_list, Error **errp)
 {
     BlockReopenQueue *queue = NULL;
     GSList *drained = NULL;
 +    GSList *p;
     /* Add each one of the BDS that we want to reopen to the queue */
     for (; reopen_list != NULL; reopen_list = reopen_list->next) {
@@ -3611,7 +3612,15 @@ void qmp_blockdev_reopen(BlockdevOptionsList *reopen_list, Error **errp)
 fail:
     bdrv_reopen_queue_free(queue);
 -    g_slist_free_full(drained, (GDestroyNotify) bdrv_subtree_drained_end);
 +    for (p = drained; p; p = p->next) {
 +        BlockDriverState *bs = p->data;
 +        AioContext *ctx = bdrv_get_aio_context(bs);
 +
 +        aio_context_acquire(ctx);
 +        bdrv_subtree_drained_end(bs);
 +        aio_context_release(ctx);
 +    }
 +    g_slist_free(drained);
 }
 void qmp_blockdev_del(const char *node_name, Error **errp)
 -- 
 2.27.0
--- a/SOURCES/kvm-block-Make-bdrv_refresh_limits-non-recursive.patch
+++ b/SOURCES/kvm-block-Make-bdrv_refresh_limits-non-recursive.patch
@ -0,0 +1,78 @@
 From 6348063b91b2370cc27153fd58fd11a6681631f6 Mon Sep 17 00:00:00 2001
 From: Hanna Reitz <hreitz@redhat.com>
 Date: Wed, 16 Feb 2022 11:53:53 +0100
 Subject: [PATCH 22/24] block: Make bdrv_refresh_limits() non-recursive
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Hanna Reitz <hreitz@redhat.com>
 RH-MergeRequest: 189: block: Make bdrv_refresh_limits() non-recursive
 RH-Commit: [1/3] 1a1fe37f8d8f0344dd8639d6cc9d884d1aff9096
 RH-Bugzilla: 2072932
 RH-Acked-by: Eric Blake <eblake@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 bdrv_refresh_limits() recurses down to the node's children.  That does
 not seem necessary: When we refresh limits on some node, and then
 recurse down and were to change one of its children's BlockLimits, then
 that would mean we noticed the changed limits by pure chance.  The fact
 that we refresh the parent's limits has nothing to do with it, so the
 reason for the change probably happened before this point in time, and
 we should have refreshed the limits then.
 Consequently, we should actually propagate block limits changes upwards,
 not downwards.  That is a separate and pre-existing issue, though, and
 so will not be addressed in this patch.
 The problem with recursing is that bdrv_refresh_limits() is not atomic.
 It begins with zeroing BDS.bl, and only then sets proper, valid limits.
 If we do not drain all nodes whose limits are refreshed, then concurrent
 I/O requests can encounter invalid request_alignment values and crash
 qemu.  Therefore, a recursing bdrv_refresh_limits() requires the whole
 subtree to be drained, which is currently not ensured by most callers.
 A non-recursive bdrv_refresh_limits() only requires the node in question
 to not receive I/O requests, and this is done by most callers in some
 way or another:
 - bdrv_open_driver() deals with a new node with no parents yet
 - bdrv_set_file_or_backing_noperm() acts on a drained node
 - bdrv_reopen_commit() acts only on drained nodes
 - bdrv_append() should in theory require the node to be drained; in
  practice most callers just lock the AioContext, which should at least
  be enough to prevent concurrent I/O requests from accessing invalid
  limits
 So we can resolve the bug by making bdrv_refresh_limits() non-recursive.
 Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1879437
 Signed-off-by: Hanna Reitz <hreitz@redhat.com>
 Reviewed-by: Eric Blake <eblake@redhat.com>
 Message-Id: <20220216105355.30729-2-hreitz@redhat.com>
 Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit 4d378bbd831bdd2f6e6adcd4ea5b77b6effaa627)
 Signed-off-by: Hanna Reitz <hreitz@redhat.com>
 ---
 block/io.c | 4 ----
 1 file changed, 4 deletions(-)
 diff --git a/block/io.c b/block/io.c
 index 4e4cb556c5..c3e7301613 100644
 --- a/block/io.c
 +++ b/block/io.c
@@ -189,10 +189,6 @@ void bdrv_refresh_limits(BlockDriverState *bs, Transaction *tran, Error **errp)
     QLIST_FOREACH(c, &bs->children, next) {
         if (c->role & (BDRV_CHILD_DATA | BDRV_CHILD_FILTERED | BDRV_CHILD_COW))
         {
 -            bdrv_refresh_limits(c->bs, tran, errp);
 -            if (*errp) {
 -                return;
 -            }
             bdrv_merge_limits(&bs->bl, &c->bs->bl);
             have_limits = true;
         }
 -- 
 2.35.3
--- a/SOURCES/kvm-block-Parse-filenames-only-when-explicitly-requested.patch
+++ b/SOURCES/kvm-block-Parse-filenames-only-when-explicitly-requested.patch
@ -1,16 +1,31 @@
-From 2ee645a339e9ef9cd92620a8b784d18d512326be Mon Sep 17 00:00:00 2001
+From c4ba1f1755031a0ac2f600ed8c17e7dcb6b2b857 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
+From: Jon Maloy <jmaloy@redhat.com>
-Date: Thu, 25 Apr 2024 14:56:02 +0200
+Date: Wed, 5 Jun 2024 19:56:51 -0400
-Subject: [PATCH 4/4] block: Parse filenames only when explicitly requested
+Subject: [PATCH 5/5] block: Parse filenames only when explicitly requested
-RH-Author: Hana Czenczek <hczenczek@redhat.com>
+RH-Author: Jon Maloy <jmaloy@redhat.com>
-RH-MergeRequest: 1: CVE 2024-4467 (PRDSC)
+RH-MergeRequest: 5: EMBARGOED CVE-2024-4467 for rhel-8.10.z (PRDSC)
-RH-Jira: RHEL-35611
+RH-Jira: RHEL-35616
 RH-CVE: CVE-2024-4467
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Acked-by: Eric Blake <eblake@redhat.com>
+RH-Commit: [5/5] a3e197add64fc6950c4ac576e34d833dfae7ee34
-RH-Commit: [4/4] f44c2941d4419e60f16dea3e9adca164e75aa78d
+
 Conflicts: - brdv_open_child_common(): bdrv_graph_wrlock/unlock()
             don't exist in this code version. We ignore them.
 	     bdrv_open_inherit(): no_coroutine_fn/GRAPH_UNLOCKED
             doesn't exist. We ignore it.
           - Changes to bdrv_open_file_child() didn't apply cleanly,
             but fixing it is straight-forward.
           - GLOBAL_STATE_CODE() not present in this code. Ignoring it.
           - bdrv_open_file_child(): Need to continue setting of
 	     parent->file.
 commit f44c2941d4419e60f16dea3e9adca164e75aa78d
 Author: Kevin Wolf <kwolf@redhat.com>
 Date:   Thu Apr 25 14:56:02 2024 +0200
    block: Parse filenames only when explicitly requested
    When handling image filenames from legacy options such as -drive or from
    tools, these filenames are parsed for protocol prefixes, including for
@ -41,15 +56,17 @@ Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
    Reviewed-by: Hanna Czenczek <hreitz@redhat.com>
    Upstream: N/A, embargoed
    Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
- block.c | 90 ++++++++++++++++++++++++++++++++++++---------------------
+ block.c | 81 +++++++++++++++++++++++++++++++++++++++------------------
- 1 file changed, 57 insertions(+), 33 deletions(-)
+ 1 file changed, 56 insertions(+), 25 deletions(-)
 diff --git a/block.c b/block.c
-index 468cf5e67d..50bdd197b7 100644
+index 889f878565..ddebf50efa 100644
 --- a/block.c
 +++ b/block.c
-@@ -86,6 +86,7 @@ static BlockDriverState *bdrv_open_inherit(const char *filename,
+@@ -82,6 +82,7 @@ static BlockDriverState *bdrv_open_inherit(const char *filename,
                                            BlockDriverState *parent,
                                            const BdrvChildClass *child_class,
                                            BdrvChildRole child_role,
@ -57,7 +74,7 @@ index 468cf5e67d..50bdd197b7 100644
                                            Error **errp);
 static bool bdrv_recurse_has_child(BlockDriverState *bs,
-@@ -2058,7 +2059,8 @@ static void parse_json_protocol(QDict *options, const char **pfilename,
+@@ -1926,7 +1927,8 @@ static void parse_json_protocol(QDict *options, const char **pfilename,
  * block driver has been specified explicitly.
  */
 static int bdrv_fill_options(QDict **options, const char *filename,
@ -67,7 +84,7 @@ index 468cf5e67d..50bdd197b7 100644
 {
     const char *drvname;
     bool protocol = *flags & BDRV_O_PROTOCOL;
-@@ -2100,7 +2102,7 @@ static int bdrv_fill_options(QDict **options, const char *filename,
+@@ -1966,7 +1968,7 @@ static int bdrv_fill_options(QDict **options, const char *filename,
     if (protocol && filename) {
         if (!qdict_haskey(*options, "filename")) {
             qdict_put_str(*options, "filename", filename);
@ -76,7 +93,7 @@ index 468cf5e67d..50bdd197b7 100644
         } else {
             error_setg(errp, "Can't specify 'file' and 'filename' options at "
                              "the same time");
-@@ -3663,7 +3665,8 @@ int bdrv_open_backing_file(BlockDriverState *bs, QDict *parent_options,
+@@ -3439,7 +3441,8 @@ int bdrv_open_backing_file(BlockDriverState *bs, QDict *parent_options,
     }
     backing_hd = bdrv_open_inherit(backing_filename, reference, options, 0, bs,
@ -86,7 +103,7 @@ index 468cf5e67d..50bdd197b7 100644
     if (!backing_hd) {
         bs->open_flags |= BDRV_O_NO_BACKING;
         error_prepend(errp, "Could not open backing file: ");
-@@ -3697,7 +3700,8 @@ free_exit:
+@@ -3472,7 +3475,8 @@ free_exit:
 static BlockDriverState *
 bdrv_open_child_bs(const char *filename, QDict *options, const char *bdref_key,
                    BlockDriverState *parent, const BdrvChildClass *child_class,
@ -96,7 +113,7 @@ index 468cf5e67d..50bdd197b7 100644
 {
     BlockDriverState *bs = NULL;
     QDict *image_options;
-@@ -3728,7 +3732,8 @@ bdrv_open_child_bs(const char *filename, QDict *options, const char *bdref_key,
+@@ -3503,7 +3507,8 @@ bdrv_open_child_bs(const char *filename, QDict *options, const char *bdref_key,
     }
     bs = bdrv_open_inherit(filename, reference, image_options, 0,
@ -106,7 +123,7 @@ index 468cf5e67d..50bdd197b7 100644
     if (!bs) {
         goto done;
     }
-@@ -3738,6 +3743,33 @@ done:
+@@ -3513,6 +3518,29 @@ done:
     return bs;
 }
@ -121,18 +138,14 @@ index 468cf5e67d..50bdd197b7 100644
 +    BlockDriverState *bs;
 +    BdrvChild *child;
 +
 +    GLOBAL_STATE_CODE();
 +
 +    bs = bdrv_open_child_bs(filename, options, bdref_key, parent, child_class,
 +                            child_role, allow_none, parse_filename, errp);
 +    if (bs == NULL) {
 +        return NULL;
 +    }
 +
 +    bdrv_graph_wrlock();
 +    child = bdrv_attach_child(parent, bs, bdref_key, child_class, child_role,
 +                              errp);
 +    bdrv_graph_wrunlock();
 +
 +    return child;
 +}
@ -140,14 +153,11 @@ index 468cf5e67d..50bdd197b7 100644
 /*
  * Opens a disk image whose options are given as BlockdevRef in another block
  * device's options.
-@@ -3761,27 +3793,15 @@ BdrvChild *bdrv_open_child(const char *filename,
+@@ -3534,20 +3562,17 @@ BdrvChild *bdrv_open_child(const char *filename,
                            BdrvChildRole child_role,
                            bool allow_none, Error **errp)
 {
 -    BlockDriverState *bs;
 -    BdrvChild *child;
 -
 -    GLOBAL_STATE_CODE();
 -
 -    bs = bdrv_open_child_bs(filename, options, bdref_key, parent, child_class,
 -                            child_role, allow_none, errp);
@ -155,12 +165,8 @@ index 468cf5e67d..50bdd197b7 100644
 -        return NULL;
 -    }
 -
-    bdrv_graph_wrlock();
+-    return bdrv_attach_child(parent, bs, bdref_key, child_class, child_role,
 -    child = bdrv_attach_child(parent, bs, bdref_key, child_class, child_role,
 -                             errp);
 -    bdrv_graph_wrunlock();
 -
 -    return child;
 +    return bdrv_open_child_common(filename, options, bdref_key, parent,
 +                                  child_class, child_role, allow_none, false,
 +                                  errp);
@ -171,21 +177,24 @@ index 468cf5e67d..50bdd197b7 100644
 + * This does mostly the same as bdrv_open_child(), but for opening the primary
 + * child of a node. A notable difference from bdrv_open_child() is that it
 + * enables filename parsing for protocol names (including json:).
-  *
+ *
-  * @parent can move to a different AioContext in this function.
+ * @parent can move to a different AioContext in this function.
  */
-@@ -3796,8 +3816,8 @@ int bdrv_open_file_child(const char *filename,
+ int bdrv_open_file_child(const char *filename,
                          QDict *options, const char *bdref_key,
@@ -3558,8 +3583,9 @@ int bdrv_open_file_child(const char *filename,
     role = parent->drv->is_filter ?
         (BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY) : BDRV_CHILD_IMAGE;
-    if (!bdrv_open_child(filename, options, bdref_key, parent,
+-    parent->file = bdrv_open_child(filename, options, bdref_key, parent,
-                         &child_of_bds, role, false, errp))
+-                                   &child_of_bds, role, false, errp);
-+    if (!bdrv_open_child_common(filename, options, bdref_key, parent,
+    parent->file = bdrv_open_child_common(filename, options, bdref_key, parent,
-+                                &child_of_bds, role, false, true, errp))
+                                          &child_of_bds, role, false, true,
-     {
+                                          errp);
-         return -EINVAL;
+ 
     return parent->file ? 0 : -EINVAL;
 }
-@@ -3842,7 +3862,8 @@ BlockDriverState *bdrv_open_blockdev_ref(BlockdevRef *ref, Error **errp)
+@@ -3599,7 +3625,8 @@ BlockDriverState *bdrv_open_blockdev_ref(BlockdevRef *ref, Error **errp)
     }
@ -195,16 +204,15 @@ index 468cf5e67d..50bdd197b7 100644
     obj = NULL;
     qobject_unref(obj);
     visit_free(v);
-@@ -3932,7 +3953,7 @@ static BlockDriverState * no_coroutine_fn
+@@ -3690,6 +3717,7 @@ static BlockDriverState *bdrv_open_inherit(const char *filename,
- bdrv_open_inherit(const char *filename, const char *reference, QDict *options,
+                                            BlockDriverState *parent,
-                   int flags, BlockDriverState *parent,
+                                            const BdrvChildClass *child_class,
-                   const BdrvChildClass *child_class, BdrvChildRole child_role,
+                                            BdrvChildRole child_role,
-                  Error **errp)
+                                           bool parse_filename,
-+                  bool parse_filename, Error **errp)
+                                            Error **errp)
 {
     int ret;
-     BlockBackend *file = NULL;
+@@ -3733,9 +3761,11 @@ static BlockDriverState *bdrv_open_inherit(const char *filename,
@@ -3980,9 +4001,11 @@ bdrv_open_inherit(const char *filename, const char *reference, QDict *options,
     }
     /* json: syntax counts as explicit options, as if in the QDict */
@ -219,7 +227,7 @@ index 468cf5e67d..50bdd197b7 100644
     }
     bs->explicit_options = qdict_clone_shallow(options);
-@@ -4007,7 +4030,8 @@ bdrv_open_inherit(const char *filename, const char *reference, QDict *options,
+@@ -3760,7 +3790,8 @@ static BlockDriverState *bdrv_open_inherit(const char *filename,
                                      parent->open_flags, parent->options);
     }
@ -229,7 +237,7 @@ index 468cf5e67d..50bdd197b7 100644
     if (ret < 0) {
         goto fail;
     }
-@@ -4076,7 +4100,7 @@ bdrv_open_inherit(const char *filename, const char *reference, QDict *options,
+@@ -3829,7 +3860,7 @@ static BlockDriverState *bdrv_open_inherit(const char *filename,
         file_bs = bdrv_open_child_bs(filename, options, "file", bs,
                                      &child_of_bds, BDRV_CHILD_IMAGE,
@ -238,9 +246,9 @@ index 468cf5e67d..50bdd197b7 100644
         if (local_err) {
             goto fail;
         }
-@@ -4225,7 +4249,7 @@ BlockDriverState *bdrv_open(const char *filename, const char *reference,
+@@ -3974,7 +4005,7 @@ BlockDriverState *bdrv_open(const char *filename, const char *reference,
-     GLOBAL_STATE_CODE();
+                             QDict *options, int flags, Error **errp)
- 
+ {
     return bdrv_open_inherit(filename, reference, options, flags, NULL,
 -                             NULL, 0, errp);
 +                             NULL, 0, true, errp);
--- a/SOURCES/kvm-block-backend-prevent-dangling-BDS-pointers-across-a.patch
+++ b/SOURCES/kvm-block-backend-prevent-dangling-BDS-pointers-across-a.patch
@ -0,0 +1,129 @@
 From bf4c15a3debbe68b6eb25c52174843470a9c014f Mon Sep 17 00:00:00 2001
 From: Stefan Hajnoczi <stefanha@redhat.com>
 Date: Tue, 11 Jan 2022 15:36:12 +0000
 Subject: [PATCH 3/6] block-backend: prevent dangling BDS pointers across
 aio_poll()
 RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
 RH-MergeRequest: 109: block-backend: prevent dangling BDS pointers across aio_poll()
 RH-Commit: [1/2] da5a59eddff0dc10be7de8e291fa675143d11d73
 RH-Bugzilla: 2021778 2036178
 RH-Acked-by: Hanna Reitz <hreitz@redhat.com>
 RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 The BlockBackend root child can change when aio_poll() is invoked. This
 happens when a temporary filter node is removed upon blockjob
 completion, for example.
 Functions in block/block-backend.c must be aware of this when using a
 blk_bs() pointer across aio_poll() because the BlockDriverState refcnt
 may reach 0, resulting in a stale pointer.
 One example is scsi_device_purge_requests(), which calls blk_drain() to
 wait for in-flight requests to cancel. If the backup blockjob is active,
 then the BlockBackend root child is a temporary filter BDS owned by the
 blockjob. The blockjob can complete during bdrv_drained_begin() and the
 last reference to the BDS is released when the temporary filter node is
 removed. This results in a use-after-free when blk_drain() calls
 bdrv_drained_end(bs) on the dangling pointer.
 Explicitly hold a reference to bs across block APIs that invoke
 aio_poll().
 Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2021778
 Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2036178
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Message-Id: <20220111153613.25453-2-stefanha@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit 1e3552dbd28359d35967b7c28dc86cde1bc29205)
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
 block/block-backend.c | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)
 diff --git a/block/block-backend.c b/block/block-backend.c
 index 12ef80ea17..23e727199b 100644
 --- a/block/block-backend.c
 +++ b/block/block-backend.c
@@ -822,16 +822,22 @@ BlockBackend *blk_by_public(BlockBackendPublic *public)
 void blk_remove_bs(BlockBackend *blk)
 {
     ThrottleGroupMember *tgm = &blk->public.throttle_group_member;
 -    BlockDriverState *bs;
     BdrvChild *root;
     notifier_list_notify(&blk->remove_bs_notifiers, blk);
     if (tgm->throttle_state) {
 -        bs = blk_bs(blk);
 +        BlockDriverState *bs = blk_bs(blk);
 +
 +        /*
 +         * Take a ref in case blk_bs() changes across bdrv_drained_begin(), for
 +         * example, if a temporary filter node is removed by a blockjob.
 +         */
 +        bdrv_ref(bs);
         bdrv_drained_begin(bs);
         throttle_group_detach_aio_context(tgm);
         throttle_group_attach_aio_context(tgm, qemu_get_aio_context());
         bdrv_drained_end(bs);
 +        bdrv_unref(bs);
     }
     blk_update_root_state(blk);
@@ -1705,6 +1711,7 @@ void blk_drain(BlockBackend *blk)
     BlockDriverState *bs = blk_bs(blk);
     if (bs) {
 +        bdrv_ref(bs);
         bdrv_drained_begin(bs);
     }
@@ -1714,6 +1721,7 @@ void blk_drain(BlockBackend *blk)
     if (bs) {
         bdrv_drained_end(bs);
 +        bdrv_unref(bs);
     }
 }
@@ -2044,10 +2052,13 @@ static int blk_do_set_aio_context(BlockBackend *blk, AioContext *new_context,
     int ret;
     if (bs) {
 +        bdrv_ref(bs);
 +
         if (update_root_node) {
             ret = bdrv_child_try_set_aio_context(bs, new_context, blk->root,
                                                  errp);
             if (ret < 0) {
 +                bdrv_unref(bs);
                 return ret;
             }
         }
@@ -2057,6 +2068,8 @@ static int blk_do_set_aio_context(BlockBackend *blk, AioContext *new_context,
             throttle_group_attach_aio_context(tgm, new_context);
             bdrv_drained_end(bs);
         }
 +
 +        bdrv_unref(bs);
     }
     blk->ctx = new_context;
@@ -2326,11 +2339,13 @@ void blk_io_limits_disable(BlockBackend *blk)
     ThrottleGroupMember *tgm = &blk->public.throttle_group_member;
     assert(tgm->throttle_state);
     if (bs) {
 +        bdrv_ref(bs);
         bdrv_drained_begin(bs);
     }
     throttle_group_unregister_tgm(tgm);
     if (bs) {
         bdrv_drained_end(bs);
 +        bdrv_unref(bs);
     }
 }
 -- 
 2.27.0
--- a/SOURCES/kvm-block-crypto-create-ciphers-on-demand.patch
+++ b/SOURCES/kvm-block-crypto-create-ciphers-on-demand.patch
@ -1,330 +0,0 @@
 From a67edfb4b591acdffc5b4987601a30224376996f Mon Sep 17 00:00:00 2001
 From: Stefan Hajnoczi <stefanha@redhat.com>
 Date: Mon, 27 May 2024 11:58:50 -0400
 Subject: [PATCH 4/5] block/crypto: create ciphers on demand
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
 RH-MergeRequest: 251: block/crypto: create ciphers on demand
 RH-Jira: RHEL-36159
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [1/2] 22a4c87fef774cad98a6f5a79f27df50a208013d (stefanha/centos-stream-qemu-kvm)
 Ciphers are pre-allocated by qcrypto_block_init_cipher() depending on
 the given number of threads. The -device
 virtio-blk-pci,iothread-vq-mapping= feature allows users to assign
 multiple IOThreads to a virtio-blk device, but the association between
 the virtio-blk device and the block driver happens after the block
 driver is already open.
 When the number of threads given to qcrypto_block_init_cipher() is
 smaller than the actual number of threads at runtime, the
 block->n_free_ciphers > 0 assertion in qcrypto_block_pop_cipher() can
 fail.
 Get rid of qcrypto_block_init_cipher() n_thread's argument and allocate
 ciphers on demand.
 Reported-by: Qing Wang <qinwang@redhat.com>
 Buglink: https://issues.redhat.com/browse/RHEL-36159
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Message-ID: <20240527155851.892885-2-stefanha@redhat.com>
 Reviewed-by: Kevin Wolf <kwolf@redhat.com>
 Acked-by: Daniel P. Berrangé <berrange@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit af206c284e4c1b17cdfb0f17e898b288c0fc1751)
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
 crypto/block-luks.c |   3 +-
 crypto/block-qcow.c |   2 +-
 crypto/block.c      | 111 ++++++++++++++++++++++++++------------------
 crypto/blockpriv.h  |  12 +++--
 4 files changed, 78 insertions(+), 50 deletions(-)
 diff --git a/crypto/block-luks.c b/crypto/block-luks.c
 index 3ee928fb5a..3357852c0a 100644
 --- a/crypto/block-luks.c
 +++ b/crypto/block-luks.c
@@ -1262,7 +1262,6 @@ qcrypto_block_luks_open(QCryptoBlock *block,
                                       luks->cipher_mode,
                                       masterkey,
                                       luks->header.master_key_len,
 -                                      n_threads,
                                       errp) < 0) {
             goto fail;
         }
@@ -1456,7 +1455,7 @@ qcrypto_block_luks_create(QCryptoBlock *block,
     /* Setup the block device payload encryption objects */
     if (qcrypto_block_init_cipher(block, luks_opts.cipher_alg,
                                   luks_opts.cipher_mode, masterkey,
 -                                  luks->header.master_key_len, 1, errp) < 0) {
 +                                  luks->header.master_key_len, errp) < 0) {
         goto error;
     }
 diff --git a/crypto/block-qcow.c b/crypto/block-qcow.c
 index 4d7cf36a8f..02305058e3 100644
 --- a/crypto/block-qcow.c
 +++ b/crypto/block-qcow.c
@@ -75,7 +75,7 @@ qcrypto_block_qcow_init(QCryptoBlock *block,
     ret = qcrypto_block_init_cipher(block, QCRYPTO_CIPHER_ALG_AES_128,
                                     QCRYPTO_CIPHER_MODE_CBC,
                                     keybuf, G_N_ELEMENTS(keybuf),
 -                                    n_threads, errp);
 +                                    errp);
     if (ret < 0) {
         ret = -ENOTSUP;
         goto fail;
 diff --git a/crypto/block.c b/crypto/block.c
 index 506ea1d1a3..ba6d1cebc7 100644
 --- a/crypto/block.c
 +++ b/crypto/block.c
@@ -20,6 +20,7 @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 +#include "qemu/lockable.h"
 #include "blockpriv.h"
 #include "block-qcow.h"
 #include "block-luks.h"
@@ -57,6 +58,8 @@ QCryptoBlock *qcrypto_block_open(QCryptoBlockOpenOptions *options,
 {
     QCryptoBlock *block = g_new0(QCryptoBlock, 1);
 +    qemu_mutex_init(&block->mutex);
 +
     block->format = options->format;
     if (options->format >= G_N_ELEMENTS(qcrypto_block_drivers) ||
@@ -76,8 +79,6 @@ QCryptoBlock *qcrypto_block_open(QCryptoBlockOpenOptions *options,
         return NULL;
     }
 -    qemu_mutex_init(&block->mutex);
 -
     return block;
 }
@@ -92,6 +93,8 @@ QCryptoBlock *qcrypto_block_create(QCryptoBlockCreateOptions *options,
 {
     QCryptoBlock *block = g_new0(QCryptoBlock, 1);
 +    qemu_mutex_init(&block->mutex);
 +
     block->format = options->format;
     if (options->format >= G_N_ELEMENTS(qcrypto_block_drivers) ||
@@ -111,8 +114,6 @@ QCryptoBlock *qcrypto_block_create(QCryptoBlockCreateOptions *options,
         return NULL;
     }
 -    qemu_mutex_init(&block->mutex);
 -
     return block;
 }
@@ -227,37 +228,42 @@ QCryptoCipher *qcrypto_block_get_cipher(QCryptoBlock *block)
      * This function is used only in test with one thread (it's safe to skip
      * pop/push interface), so it's enough to assert it here:
      */
 -    assert(block->n_ciphers <= 1);
 -    return block->ciphers ? block->ciphers[0] : NULL;
 +    assert(block->max_free_ciphers <= 1);
 +    return block->free_ciphers ? block->free_ciphers[0] : NULL;
 }
 -static QCryptoCipher *qcrypto_block_pop_cipher(QCryptoBlock *block)
 +static QCryptoCipher *qcrypto_block_pop_cipher(QCryptoBlock *block,
 +                                               Error **errp)
 {
 -    QCryptoCipher *cipher;
 -
 -    qemu_mutex_lock(&block->mutex);
 -
 -    assert(block->n_free_ciphers > 0);
 -    block->n_free_ciphers--;
 -    cipher = block->ciphers[block->n_free_ciphers];
 -
 -    qemu_mutex_unlock(&block->mutex);
 +    /* Usually there is a free cipher available */
 +    WITH_QEMU_LOCK_GUARD(&block->mutex) {
 +        if (block->n_free_ciphers > 0) {
 +            block->n_free_ciphers--;
 +            return block->free_ciphers[block->n_free_ciphers];
 +        }
 +    }
 -    return cipher;
 +    /* Otherwise allocate a new cipher */
 +    return qcrypto_cipher_new(block->alg, block->mode, block->key,
 +                              block->nkey, errp);
 }
 static void qcrypto_block_push_cipher(QCryptoBlock *block,
                                       QCryptoCipher *cipher)
 {
 -    qemu_mutex_lock(&block->mutex);
 +    QEMU_LOCK_GUARD(&block->mutex);
 -    assert(block->n_free_ciphers < block->n_ciphers);
 -    block->ciphers[block->n_free_ciphers] = cipher;
 -    block->n_free_ciphers++;
 +    if (block->n_free_ciphers == block->max_free_ciphers) {
 +        block->max_free_ciphers++;
 +        block->free_ciphers = g_renew(QCryptoCipher *,
 +                                      block->free_ciphers,
 +                                      block->max_free_ciphers);
 +    }
 -    qemu_mutex_unlock(&block->mutex);
 +    block->free_ciphers[block->n_free_ciphers] = cipher;
 +    block->n_free_ciphers++;
 }
@@ -265,24 +271,31 @@ int qcrypto_block_init_cipher(QCryptoBlock *block,
                               QCryptoCipherAlgorithm alg,
                               QCryptoCipherMode mode,
                               const uint8_t *key, size_t nkey,
 -                              size_t n_threads, Error **errp)
 +                              Error **errp)
 {
 -    size_t i;
 +    QCryptoCipher *cipher;
 -    assert(!block->ciphers && !block->n_ciphers && !block->n_free_ciphers);
 +    assert(!block->free_ciphers && !block->max_free_ciphers &&
 +           !block->n_free_ciphers);
 -    block->ciphers = g_new0(QCryptoCipher *, n_threads);
 +    /* Stash away cipher parameters for qcrypto_block_pop_cipher() */
 +    block->alg = alg;
 +    block->mode = mode;
 +    block->key = g_memdup2(key, nkey);
 +    block->nkey = nkey;
 -    for (i = 0; i < n_threads; i++) {
 -        block->ciphers[i] = qcrypto_cipher_new(alg, mode, key, nkey, errp);
 -        if (!block->ciphers[i]) {
 -            qcrypto_block_free_cipher(block);
 -            return -1;
 -        }
 -        block->n_ciphers++;
 -        block->n_free_ciphers++;
 +    /*
 +     * Create a new cipher to validate the parameters now. This reduces the
 +     * chance of cipher creation failing at I/O time.
 +     */
 +    cipher = qcrypto_block_pop_cipher(block, errp);
 +    if (!cipher) {
 +        g_free(block->key);
 +        block->key = NULL;
 +        return -1;
     }
 +    qcrypto_block_push_cipher(block, cipher);
     return 0;
 }
@@ -291,19 +304,23 @@ void qcrypto_block_free_cipher(QCryptoBlock *block)
 {
     size_t i;
 -    if (!block->ciphers) {
 +    g_free(block->key);
 +    block->key = NULL;
 +
 +    if (!block->free_ciphers) {
         return;
     }
 -    assert(block->n_ciphers == block->n_free_ciphers);
 +    /* All popped ciphers were eventually pushed back */
 +    assert(block->n_free_ciphers == block->max_free_ciphers);
 -    for (i = 0; i < block->n_ciphers; i++) {
 -        qcrypto_cipher_free(block->ciphers[i]);
 +    for (i = 0; i < block->max_free_ciphers; i++) {
 +        qcrypto_cipher_free(block->free_ciphers[i]);
     }
 -    g_free(block->ciphers);
 -    block->ciphers = NULL;
 -    block->n_ciphers = block->n_free_ciphers = 0;
 +    g_free(block->free_ciphers);
 +    block->free_ciphers = NULL;
 +    block->max_free_ciphers = block->n_free_ciphers = 0;
 }
 QCryptoIVGen *qcrypto_block_get_ivgen(QCryptoBlock *block)
@@ -311,7 +328,7 @@ QCryptoIVGen *qcrypto_block_get_ivgen(QCryptoBlock *block)
     /* ivgen should be accessed under mutex. However, this function is used only
      * in test with one thread, so it's enough to assert it here:
      */
 -    assert(block->n_ciphers <= 1);
 +    assert(block->max_free_ciphers <= 1);
     return block->ivgen;
 }
@@ -446,7 +463,10 @@ int qcrypto_block_decrypt_helper(QCryptoBlock *block,
                                  Error **errp)
 {
     int ret;
 -    QCryptoCipher *cipher = qcrypto_block_pop_cipher(block);
 +    QCryptoCipher *cipher = qcrypto_block_pop_cipher(block, errp);
 +    if (!cipher) {
 +        return -1;
 +    }
     ret = do_qcrypto_block_cipher_encdec(cipher, block->niv, block->ivgen,
                                          &block->mutex, sectorsize, offset, buf,
@@ -465,7 +485,10 @@ int qcrypto_block_encrypt_helper(QCryptoBlock *block,
                                  Error **errp)
 {
     int ret;
 -    QCryptoCipher *cipher = qcrypto_block_pop_cipher(block);
 +    QCryptoCipher *cipher = qcrypto_block_pop_cipher(block, errp);
 +    if (!cipher) {
 +        return -1;
 +    }
     ret = do_qcrypto_block_cipher_encdec(cipher, block->niv, block->ivgen,
                                          &block->mutex, sectorsize, offset, buf,
 diff --git a/crypto/blockpriv.h b/crypto/blockpriv.h
 index 836f3b4726..4bf6043d5d 100644
 --- a/crypto/blockpriv.h
 +++ b/crypto/blockpriv.h
@@ -32,8 +32,14 @@ struct QCryptoBlock {
     const QCryptoBlockDriver *driver;
     void *opaque;
 -    QCryptoCipher **ciphers;
 -    size_t n_ciphers;
 +    /* Cipher parameters */
 +    QCryptoCipherAlgorithm alg;
 +    QCryptoCipherMode mode;
 +    uint8_t *key;
 +    size_t nkey;
 +
 +    QCryptoCipher **free_ciphers;
 +    size_t max_free_ciphers;
     size_t n_free_ciphers;
     QCryptoIVGen *ivgen;
     QemuMutex mutex;
@@ -130,7 +136,7 @@ int qcrypto_block_init_cipher(QCryptoBlock *block,
                               QCryptoCipherAlgorithm alg,
                               QCryptoCipherMode mode,
                               const uint8_t *key, size_t nkey,
 -                              size_t n_threads, Error **errp);
 +                              Error **errp);
 void qcrypto_block_free_cipher(QCryptoBlock *block);
 -- 
 2.39.3
--- a/SOURCES/kvm-block-introduce-bdrv_open_file_child-helper.patch
+++ b/SOURCES/kvm-block-introduce-bdrv_open_file_child-helper.patch
@ -0,0 +1,566 @@
 From 996680dd6d5afd51918e600126dbfed4dfe89e05 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Sun, 9 Jun 2024 23:08:39 -0400
 Subject: [PATCH 4/5] block: introduce bdrv_open_file_child() helper
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 5: EMBARGOED CVE-2024-4467 for rhel-8.10.z (PRDSC)
 RH-Jira: RHEL-35616
 RH-CVE: CVE-2024-4467
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Commit: [4/5] 9f582a9aff740eb9ec6f64bfec94854038d8545f
 Conflicts: - copy-before-write.c::cbw_copy() is an older version than
             upstream, but introduction of the new function is
 	     straight-forward.
           - include/block/block-global-state.h doesn't exist in this
             code version. Adding the prototype to
             include/block/block.h instead.
           - struct BlockDriver has no field 'filtered_child_is_backing'
             We remove the corresponding assert() in the new function.
 commit 83930780325b144a5908c45b3957b9b6457b3831
 Author: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
 Date:   Tue Jul 26 23:11:21 2022 +0300
    block: introduce bdrv_open_file_child() helper
    Almost all drivers call bdrv_open_child() similarly. Let's create a
    helper for this.
    The only not updated drivers that call bdrv_open_child() to set
    bs->file are raw-format and snapshot-access:
        raw-format sometimes want to have filtered child but
            don't set drv->is_filter to true.
        snapshot-access wants only DATA | PRIMARY
    Possibly we should implement drv->is_filter_func() handler, to consider
    raw-format as filter when it works as filter.. But it's another story.
    Note also, that we decrease assignments to bs->file in code: it helps
    us restrict modifying this field in further commit.
    Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
    Reviewed-by: Hanna Reitz <hreitz@redhat.com>
    Message-Id: <20220726201134.924743-3-vsementsov@yandex-team.ru>
    Reviewed-by: Kevin Wolf <kwolf@redhat.com>
    Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 block.c                   | 18 ++++++++++++++++++
 block/blkdebug.c          |  9 +++------
 block/blklogwrites.c      |  7 ++-----
 block/blkreplay.c         |  7 ++-----
 block/blkverify.c         |  9 +++------
 block/bochs.c             |  7 +++----
 block/cloop.c             |  7 +++----
 block/copy-before-write.c |  9 ++++-----
 block/copy-on-read.c      |  9 ++++-----
 block/crypto.c            | 11 ++++++-----
 block/dmg.c               |  7 +++----
 block/filter-compress.c   |  8 +++-----
 block/parallels.c         |  7 +++----
 block/preallocate.c       |  9 ++++-----
 block/qcow.c              |  6 ++----
 block/qcow2.c             |  8 ++++----
 block/qed.c               |  8 ++++----
 block/replication.c       |  8 +++-----
 block/throttle.c          |  8 +++-----
 block/vdi.c               |  7 +++----
 block/vhdx.c              |  7 +++----
 block/vmdk.c              |  7 +++----
 block/vpc.c               |  7 +++----
 include/block/block.h     |  3 +++
 24 files changed, 92 insertions(+), 101 deletions(-)
 diff --git a/block.c b/block.c
 index 0ac5b163d2..889f878565 100644
 --- a/block.c
 +++ b/block.c
@@ -3546,6 +3546,24 @@ BdrvChild *bdrv_open_child(const char *filename,
                              errp);
 }
 +/*
 + * Wrapper on bdrv_open_child() for most popular case: open primary child of bs.
 + */
 +int bdrv_open_file_child(const char *filename,
 +                         QDict *options, const char *bdref_key,
 +                         BlockDriverState *parent, Error **errp)
 +{
 +    BdrvChildRole role;
 +
 +    role = parent->drv->is_filter ?
 +        (BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY) : BDRV_CHILD_IMAGE;
 +
 +    parent->file = bdrv_open_child(filename, options, bdref_key, parent,
 +                                   &child_of_bds, role, false, errp);
 +
 +    return parent->file ? 0 : -EINVAL;
 +}
 +
 /*
  * TODO Future callers may need to specify parent/child_class in order for
  * option inheritance to work. Existing callers use it for the root node.
 diff --git a/block/blkdebug.c b/block/blkdebug.c
 index bbf2948703..5fcfc8ac6f 100644
 --- a/block/blkdebug.c
 +++ b/block/blkdebug.c
@@ -503,12 +503,9 @@ static int blkdebug_open(BlockDriverState *bs, QDict *options, int flags,
     }
     /* Open the image file */
 -    bs->file = bdrv_open_child(qemu_opt_get(opts, "x-image"), options, "image",
 -                               bs, &child_of_bds,
 -                               BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
 -                               false, errp);
 -    if (!bs->file) {
 -        ret = -EINVAL;
 +    ret = bdrv_open_file_child(qemu_opt_get(opts, "x-image"), options, "image",
 +                               bs, errp);
 +    if (ret < 0) {
         goto out;
     }
 diff --git a/block/blklogwrites.c b/block/blklogwrites.c
 index f7a251e91f..f66a617eb3 100644
 --- a/block/blklogwrites.c
 +++ b/block/blklogwrites.c
@@ -155,11 +155,8 @@ static int blk_log_writes_open(BlockDriverState *bs, QDict *options, int flags,
     }
     /* Open the file */
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY, false,
 -                               errp);
 -    if (!bs->file) {
 -        ret = -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
         goto fail;
     }
 diff --git a/block/blkreplay.c b/block/blkreplay.c
 index dcbe780ddb..76a0b8d12a 100644
 --- a/block/blkreplay.c
 +++ b/block/blkreplay.c
@@ -26,11 +26,8 @@ static int blkreplay_open(BlockDriverState *bs, QDict *options, int flags,
     int ret;
     /* Open the image file */
 -    bs->file = bdrv_open_child(NULL, options, "image", bs, &child_of_bds,
 -                               BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
 -                               false, errp);
 -    if (!bs->file) {
 -        ret = -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "image", bs, errp);
 +    if (ret < 0) {
         goto fail;
     }
 diff --git a/block/blkverify.c b/block/blkverify.c
 index d1facf5ba9..920e891684 100644
 --- a/block/blkverify.c
 +++ b/block/blkverify.c
@@ -121,12 +121,9 @@ static int blkverify_open(BlockDriverState *bs, QDict *options, int flags,
     }
     /* Open the raw file */
 -    bs->file = bdrv_open_child(qemu_opt_get(opts, "x-raw"), options, "raw",
 -                               bs, &child_of_bds,
 -                               BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
 -                               false, errp);
 -    if (!bs->file) {
 -        ret = -EINVAL;
 +    ret = bdrv_open_file_child(qemu_opt_get(opts, "x-raw"), options, "raw",
 +                               bs, errp);
 +    if (ret < 0) {
         goto fail;
     }
 diff --git a/block/bochs.c b/block/bochs.c
 index 4d68658087..b2dc06bbfd 100644
 --- a/block/bochs.c
 +++ b/block/bochs.c
@@ -110,10 +110,9 @@ static int bochs_open(BlockDriverState *bs, QDict *options, int flags,
         return ret;
     }
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_IMAGE, false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     ret = bdrv_pread(bs->file, 0, &bochs, sizeof(bochs));
 diff --git a/block/cloop.c b/block/cloop.c
 index b8c6d0eccd..bee87da173 100644
 --- a/block/cloop.c
 +++ b/block/cloop.c
@@ -71,10 +71,9 @@ static int cloop_open(BlockDriverState *bs, QDict *options, int flags,
         return ret;
     }
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_IMAGE, false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     /* read header */
 diff --git a/block/copy-before-write.c b/block/copy-before-write.c
 index c30a5ff8de..8aa2cb6a85 100644
 --- a/block/copy-before-write.c
 +++ b/block/copy-before-write.c
@@ -150,12 +150,11 @@ static int cbw_open(BlockDriverState *bs, QDict *options, int flags,
 {
     BDRVCopyBeforeWriteState *s = bs->opaque;
     BdrvDirtyBitmap *copy_bitmap;
 +    int ret;
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
 -                               false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     s->target = bdrv_open_child(NULL, options, "target", bs, &child_of_bds,
 diff --git a/block/copy-on-read.c b/block/copy-on-read.c
 index 1fc7fb3333..815ac1d835 100644
 --- a/block/copy-on-read.c
 +++ b/block/copy-on-read.c
@@ -41,12 +41,11 @@ static int cor_open(BlockDriverState *bs, QDict *options, int flags,
     BDRVStateCOR *state = bs->opaque;
     /* Find a bottom node name, if any */
     const char *bottom_node = qdict_get_try_str(options, "bottom");
 +    int ret;
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
 -                               false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     bs->supported_read_flags = BDRV_REQ_PREFETCH;
 diff --git a/block/crypto.c b/block/crypto.c
 index c8ba4681e2..abfce39230 100644
 --- a/block/crypto.c
 +++ b/block/crypto.c
@@ -260,15 +260,14 @@ static int block_crypto_open_generic(QCryptoBlockFormat format,
 {
     BlockCrypto *crypto = bs->opaque;
     QemuOpts *opts = NULL;
 -    int ret = -EINVAL;
 +    int ret;
     QCryptoBlockOpenOptions *open_opts = NULL;
     unsigned int cflags = 0;
     QDict *cryptoopts = NULL;
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_IMAGE, false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     bs->supported_write_flags = BDRV_REQ_FUA &
@@ -276,6 +275,7 @@ static int block_crypto_open_generic(QCryptoBlockFormat format,
     opts = qemu_opts_create(opts_spec, NULL, 0, &error_abort);
     if (!qemu_opts_absorb_qdict(opts, options, errp)) {
 +        ret = -EINVAL;
         goto cleanup;
     }
@@ -284,6 +284,7 @@ static int block_crypto_open_generic(QCryptoBlockFormat format,
     open_opts = block_crypto_open_opts_init(cryptoopts, errp);
     if (!open_opts) {
 +        ret = -EINVAL;
         goto cleanup;
     }
 diff --git a/block/dmg.c b/block/dmg.c
 index 447901fbb8..38c363dd39 100644
 --- a/block/dmg.c
 +++ b/block/dmg.c
@@ -439,10 +439,9 @@ static int dmg_open(BlockDriverState *bs, QDict *options, int flags,
         return ret;
     }
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_IMAGE, false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     block_module_load_one("dmg-bz2");
 diff --git a/block/filter-compress.c b/block/filter-compress.c
 index d5be538619..305716c86c 100644
 --- a/block/filter-compress.c
 +++ b/block/filter-compress.c
@@ -30,11 +30,9 @@
 static int compress_open(BlockDriverState *bs, QDict *options, int flags,
                          Error **errp)
 {
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
 -                               false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    int ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     if (!bs->file->bs->drv || !block_driver_can_compress(bs->file->bs->drv)) {
 diff --git a/block/parallels.c b/block/parallels.c
 index 6ebad2a2bb..ed4debd899 100644
 --- a/block/parallels.c
 +++ b/block/parallels.c
@@ -735,10 +735,9 @@ static int parallels_open(BlockDriverState *bs, QDict *options, int flags,
     Error *local_err = NULL;
     char *buf;
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_IMAGE, false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     ret = bdrv_pread(bs->file, 0, &ph, sizeof(ph));
 diff --git a/block/preallocate.c b/block/preallocate.c
 index 1d4233f730..332408bdc9 100644
 --- a/block/preallocate.c
 +++ b/block/preallocate.c
@@ -134,6 +134,7 @@ static int preallocate_open(BlockDriverState *bs, QDict *options, int flags,
                             Error **errp)
 {
     BDRVPreallocateState *s = bs->opaque;
 +    int ret;
     /*
      * s->data_end and friends should be initialized on permission update.
@@ -141,11 +142,9 @@ static int preallocate_open(BlockDriverState *bs, QDict *options, int flags,
      */
     s->file_end = s->zero_start = s->data_end = -EINVAL;
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
 -                               false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     if (!preallocate_absorb_opts(&s->opts, options, bs->file->bs, errp)) {
 diff --git a/block/qcow.c b/block/qcow.c
 index c39940f33e..544a17261f 100644
 --- a/block/qcow.c
 +++ b/block/qcow.c
@@ -120,10 +120,8 @@ static int qcow_open(BlockDriverState *bs, QDict *options, int flags,
     qdict_extract_subqdict(options, &encryptopts, "encrypt.");
     encryptfmt = qdict_get_try_str(encryptopts, "format");
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_IMAGE, false, errp);
 -    if (!bs->file) {
 -        ret = -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
         goto fail;
     }
 diff --git a/block/qcow2.c b/block/qcow2.c
 index 6ee1919612..29ea157e6b 100644
 --- a/block/qcow2.c
 +++ b/block/qcow2.c
@@ -1907,11 +1907,11 @@ static int qcow2_open(BlockDriverState *bs, QDict *options, int flags,
         .errp = errp,
         .ret = -EINPROGRESS
     };
 +    int ret;
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_IMAGE, false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     /* Initialise locks */
 diff --git a/block/qed.c b/block/qed.c
 index 558d3646c4..e3b06a3d00 100644
 --- a/block/qed.c
 +++ b/block/qed.c
@@ -558,11 +558,11 @@ static int bdrv_qed_open(BlockDriverState *bs, QDict *options, int flags,
         .errp = errp,
         .ret = -EINPROGRESS
     };
 +    int ret;
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_IMAGE, false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     bdrv_qed_init_state(bs);
 diff --git a/block/replication.c b/block/replication.c
 index 55c8f894aa..2f17397764 100644
 --- a/block/replication.c
 +++ b/block/replication.c
@@ -88,11 +88,9 @@ static int replication_open(BlockDriverState *bs, QDict *options,
     const char *mode;
     const char *top_id;
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
 -                               false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     ret = -EINVAL;
 diff --git a/block/throttle.c b/block/throttle.c
 index 6e8d52fa24..4fb5798c27 100644
 --- a/block/throttle.c
 +++ b/block/throttle.c
@@ -78,11 +78,9 @@ static int throttle_open(BlockDriverState *bs, QDict *options,
     char *group;
     int ret;
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
 -                               false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     bs->supported_write_flags = bs->file->bs->supported_write_flags |
                                 BDRV_REQ_WRITE_UNCHANGED;
 diff --git a/block/vdi.c b/block/vdi.c
 index bdc58d726e..c50c0ed61f 100644
 --- a/block/vdi.c
 +++ b/block/vdi.c
@@ -376,10 +376,9 @@ static int vdi_open(BlockDriverState *bs, QDict *options, int flags,
     int ret;
     QemuUUID uuid_link, uuid_parent;
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_IMAGE, false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     logout("\n");
 diff --git a/block/vhdx.c b/block/vhdx.c
 index 356ec4c455..e7d6d7509a 100644
 --- a/block/vhdx.c
 +++ b/block/vhdx.c
@@ -996,10 +996,9 @@ static int vhdx_open(BlockDriverState *bs, QDict *options, int flags,
     uint64_t signature;
     Error *local_err = NULL;
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_IMAGE, false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     s->bat = NULL;
 diff --git a/block/vmdk.c b/block/vmdk.c
 index 0dfab6e941..7d7e56b36c 100644
 --- a/block/vmdk.c
 +++ b/block/vmdk.c
@@ -1262,10 +1262,9 @@ static int vmdk_open(BlockDriverState *bs, QDict *options, int flags,
     BDRVVmdkState *s = bs->opaque;
     uint32_t magic;
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_IMAGE, false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     buf = vmdk_read_desc(bs->file, 0, errp);
 diff --git a/block/vpc.c b/block/vpc.c
 index 297a26262a..430cab1cbb 100644
 --- a/block/vpc.c
 +++ b/block/vpc.c
@@ -232,10 +232,9 @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags,
     int ret;
     int64_t bs_size;
 -    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 -                               BDRV_CHILD_IMAGE, false, errp);
 -    if (!bs->file) {
 -        return -EINVAL;
 +    ret = bdrv_open_file_child(NULL, options, "file", bs, errp);
 +    if (ret < 0) {
 +        return ret;
     }
     opts = qemu_opts_create(&vpc_runtime_opts, NULL, 0, &error_abort);
 diff --git a/include/block/block.h b/include/block/block.h
 index e5dd22b034..f885f113ef 100644
 --- a/include/block/block.h
 +++ b/include/block/block.h
@@ -376,6 +376,9 @@ BdrvChild *bdrv_open_child(const char *filename,
                            const BdrvChildClass *child_class,
                            BdrvChildRole child_role,
                            bool allow_none, Error **errp);
 +int bdrv_open_file_child(const char *filename,
 +                         QDict *options, const char *bdref_key,
 +                         BlockDriverState *parent, Error **errp);
 BlockDriverState *bdrv_open_blockdev_ref(BlockdevRef *ref, Error **errp);
 int bdrv_set_backing_hd(BlockDriverState *bs, BlockDriverState *backing_hd,
                         Error **errp);
 -- 
 2.39.3
--- a/SOURCES/kvm-block-io-Update-BSC-only-if-want_zero-is-true.patch
+++ b/SOURCES/kvm-block-io-Update-BSC-only-if-want_zero-is-true.patch
@ -0,0 +1,56 @@
 From 4c6eff78f4b31ec4bd7b42440396760d19fde63e Mon Sep 17 00:00:00 2001
 From: Hanna Reitz <hreitz@redhat.com>
 Date: Tue, 18 Jan 2022 17:59:59 +0100
 Subject: [PATCH 6/7] block/io: Update BSC only if want_zero is true
 RH-Author: Hanna Reitz <hreitz@redhat.com>
 RH-MergeRequest: 112: block/io: Update BSC only if want_zero is true
 RH-Commit: [1/2] a202de1f52110d1e871c3b5b58f2d9e9b5d17570
 RH-Bugzilla: 2041480
 RH-Acked-by: Eric Blake <eblake@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 We update the block-status cache whenever we get new information from a
 bdrv_co_block_status() call to the block driver.  However, if we have
 passed want_zero=false to that call, it may flag areas containing zeroes
 as data, and so we would update the block-status cache with wrong
 information.
 Therefore, we should not update the cache with want_zero=false.
 Reported-by: Nir Soffer <nsoffer@redhat.com>
 Fixes: 0bc329fbb00 ("block: block-status cache for data regions")
 Reviewed-by: Nir Soffer <nsoffer@redhat.com>
 Cc: qemu-stable@nongnu.org
 Signed-off-by: Hanna Reitz <hreitz@redhat.com>
 Message-Id: <20220118170000.49423-2-hreitz@redhat.com>
 Reviewed-by: Eric Blake <eblake@redhat.com>
 Signed-off-by: Eric Blake <eblake@redhat.com>
 (cherry picked from commit 113b727ce788335cf76f65355d670c9bc130fd75)
 Signed-off-by: Hanna Reitz <hreitz@redhat.com>
 ---
 block/io.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)
 diff --git a/block/io.c b/block/io.c
 index bb0a254def..4e4cb556c5 100644
 --- a/block/io.c
 +++ b/block/io.c
@@ -2497,8 +2497,12 @@ static int coroutine_fn bdrv_co_block_status(BlockDriverState *bs,
              * non-protocol nodes, and then it is never used.  However, filling
              * the cache requires an RCU update, so double check here to avoid
              * such an update if possible.
 +             *
 +             * Check want_zero, because we only want to update the cache when we
 +             * have accurate information about what is zero and what is data.
              */
 -            if (ret == (BDRV_BLOCK_DATA | BDRV_BLOCK_OFFSET_VALID) &&
 +            if (want_zero &&
 +                ret == (BDRV_BLOCK_DATA | BDRV_BLOCK_OFFSET_VALID) &&
                 QLIST_EMPTY(&bs->children))
             {
                 /*
 -- 
 2.27.0
--- a/SOURCES/kvm-block-mirror-Do-not-wait-for-active-writes.patch
+++ b/SOURCES/kvm-block-mirror-Do-not-wait-for-active-writes.patch
@ -0,0 +1,153 @@
 From 192f956f2b0761f270070555f8feb1f0544e5558 Mon Sep 17 00:00:00 2001
 From: Hanna Reitz <hreitz@redhat.com>
 Date: Wed, 9 Nov 2022 17:54:48 +0100
 Subject: [PATCH 01/11] block/mirror: Do not wait for active writes
 RH-Author: Hanna Czenczek <hreitz@redhat.com>
 RH-MergeRequest: 246: block/mirror: Make active mirror progress even under full load
 RH-Bugzilla: 2125119
 RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Commit: [1/3] 652d1e55b954f13eaec2c86f58735d4942837e16
 Waiting for all active writes to settle before daring to create a
 background copying operation means that we will never do background
 operations while the guest does anything (in write-blocking mode), and
 therefore cannot converge.  Yes, we also will not diverge, but actually
 converging would be even nicer.
 It is unclear why we did decide to wait for all active writes to settle
 before creating a background operation, but it just does not seem
 necessary.  Active writes will put themselves into the in_flight bitmap
 and thus properly block actually conflicting background requests.
 It is important for active requests to wait on overlapping background
 requests, which we do in active_write_prepare().  However, so far it was
 not documented why it is important.  Add such documentation now, and
 also to the other call of mirror_wait_on_conflicts(), so that it becomes
 more clear why and when requests need to actively wait for other
 requests to settle.
 Another thing to note is that of course we need to ensure that there are
 no active requests when the job completes, but that is done by virtue of
 the BDS being drained anyway, so there cannot be any active requests at
 that point.
 With this change, we will need to explicitly keep track of how many
 bytes are in flight in active requests so that
 job_progress_set_remaining() in mirror_run() can set the correct number
 of remaining bytes.
 Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2123297
 Signed-off-by: Hanna Reitz <hreitz@redhat.com>
 Message-Id: <20221109165452.67927-2-hreitz@redhat.com>
 Reviewed-by: Kevin Wolf <kwolf@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit d69a879bdf1aed586478eaa161ee064fe1b92f1a)
 Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 ---
 block/mirror.c | 37 ++++++++++++++++++++++++++++++-------
 1 file changed, 30 insertions(+), 7 deletions(-)
 diff --git a/block/mirror.c b/block/mirror.c
 index efec2c7674..282f428cb7 100644
 --- a/block/mirror.c
 +++ b/block/mirror.c
@@ -81,6 +81,7 @@ typedef struct MirrorBlockJob {
     int max_iov;
     bool initial_zeroing_ongoing;
     int in_active_write_counter;
 +    int64_t active_write_bytes_in_flight;
     bool prepared;
     bool in_drain;
 } MirrorBlockJob;
@@ -493,6 +494,13 @@ static uint64_t coroutine_fn mirror_iteration(MirrorBlockJob *s)
     }
     bdrv_dirty_bitmap_unlock(s->dirty_bitmap);
 +    /*
 +     * Wait for concurrent requests to @offset.  The next loop will limit the
 +     * copied area based on in_flight_bitmap so we only copy an area that does
 +     * not overlap with concurrent in-flight requests.  Still, we would like to
 +     * copy something, so wait until there are at least no more requests to the
 +     * very beginning of the area.
 +     */
     mirror_wait_on_conflicts(NULL, s, offset, 1);
     job_pause_point(&s->common.job);
@@ -993,12 +1001,6 @@ static int coroutine_fn mirror_run(Job *job, Error **errp)
         int64_t cnt, delta;
         bool should_complete;
 -        /* Do not start passive operations while there are active
 -         * writes in progress */
 -        while (s->in_active_write_counter) {
 -            mirror_wait_for_any_operation(s, true);
 -        }
 -
         if (s->ret < 0) {
             ret = s->ret;
             goto immediate_exit;
@@ -1015,7 +1017,9 @@ static int coroutine_fn mirror_run(Job *job, Error **errp)
         /* cnt is the number of dirty bytes remaining and s->bytes_in_flight is
          * the number of bytes currently being processed; together those are
          * the current remaining operation length */
 -        job_progress_set_remaining(&s->common.job, s->bytes_in_flight + cnt);
 +        job_progress_set_remaining(&s->common.job,
 +                                   s->bytes_in_flight + cnt +
 +                                   s->active_write_bytes_in_flight);
         /* Note that even when no rate limit is applied we need to yield
          * periodically with no pending I/O so that bdrv_drain_all() returns.
@@ -1073,6 +1077,10 @@ static int coroutine_fn mirror_run(Job *job, Error **errp)
             s->in_drain = true;
             bdrv_drained_begin(bs);
 +
 +            /* Must be zero because we are drained */
 +            assert(s->in_active_write_counter == 0);
 +
             cnt = bdrv_get_dirty_count(s->dirty_bitmap);
             if (cnt > 0 || mirror_flush(s) < 0) {
                 bdrv_drained_end(bs);
@@ -1306,6 +1314,7 @@ do_sync_target_write(MirrorBlockJob *job, MirrorMethod method,
     }
     job_progress_increase_remaining(&job->common.job, bytes);
 +    job->active_write_bytes_in_flight += bytes;
     switch (method) {
     case MIRROR_METHOD_COPY:
@@ -1327,6 +1336,7 @@ do_sync_target_write(MirrorBlockJob *job, MirrorMethod method,
         abort();
     }
 +    job->active_write_bytes_in_flight -= bytes;
     if (ret >= 0) {
         job_progress_update(&job->common.job, bytes);
     } else {
@@ -1375,6 +1385,19 @@ static MirrorOp *coroutine_fn active_write_prepare(MirrorBlockJob *s,
     s->in_active_write_counter++;
 +    /*
 +     * Wait for concurrent requests affecting the area.  If there are already
 +     * running requests that are copying off now-to-be stale data in the area,
 +     * we must wait for them to finish before we begin writing fresh data to the
 +     * target so that the write operations appear in the correct order.
 +     * Note that background requests (see mirror_iteration()) in contrast only
 +     * wait for conflicting requests at the start of the dirty area, and then
 +     * (based on the in_flight_bitmap) truncate the area to copy so it will not
 +     * conflict with any requests beyond that.  For active writes, however, we
 +     * cannot truncate that area.  The request from our parent must be blocked
 +     * until the area is copied in full.  Therefore, we must wait for the whole
 +     * area to become free of concurrent requests.
 +     */
     mirror_wait_on_conflicts(op, s, offset, bytes);
     bitmap_set(s->in_flight_bitmap, start_chunk, end_chunk - start_chunk);
 -- 
 2.37.3
--- a/SOURCES/kvm-block-mirror-Drop-mirror_wait_for_any_operation.patch
+++ b/SOURCES/kvm-block-mirror-Drop-mirror_wait_for_any_operation.patch
@ -0,0 +1,76 @@
 From 57c79ed20cb73aa9aa4dd7487379b85ea3f936f6 Mon Sep 17 00:00:00 2001
 From: Hanna Reitz <hreitz@redhat.com>
 Date: Wed, 9 Nov 2022 17:54:49 +0100
 Subject: [PATCH 02/11] block/mirror: Drop mirror_wait_for_any_operation()
 RH-Author: Hanna Czenczek <hreitz@redhat.com>
 RH-MergeRequest: 246: block/mirror: Make active mirror progress even under full load
 RH-Bugzilla: 2125119
 RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Commit: [2/3] dec37883bcc491441ae08d9592d1ec26a47765c0
 mirror_wait_for_free_in_flight_slot() is the only remaining user of
 mirror_wait_for_any_operation(), so inline the latter into the former.
 Signed-off-by: Hanna Reitz <hreitz@redhat.com>
 Message-Id: <20221109165452.67927-3-hreitz@redhat.com>
 Reviewed-by: Kevin Wolf <kwolf@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit eb994912993077f178ccb43b20e422ecf9ae4ac7)
 Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 ---
 block/mirror.c | 21 ++++++++-------------
 1 file changed, 8 insertions(+), 13 deletions(-)
 diff --git a/block/mirror.c b/block/mirror.c
 index 282f428cb7..6b02555ad7 100644
 --- a/block/mirror.c
 +++ b/block/mirror.c
@@ -304,19 +304,21 @@ static int mirror_cow_align(MirrorBlockJob *s, int64_t *offset,
 }
 static inline void coroutine_fn
 -mirror_wait_for_any_operation(MirrorBlockJob *s, bool active)
 +mirror_wait_for_free_in_flight_slot(MirrorBlockJob *s)
 {
     MirrorOp *op;
     QTAILQ_FOREACH(op, &s->ops_in_flight, next) {
 -        /* Do not wait on pseudo ops, because it may in turn wait on
 +        /*
 +         * Do not wait on pseudo ops, because it may in turn wait on
          * some other operation to start, which may in fact be the
          * caller of this function.  Since there is only one pseudo op
          * at any given time, we will always find some real operation
 -         * to wait on. */
 -        if (!op->is_pseudo_op && op->is_in_flight &&
 -            op->is_active_write == active)
 -        {
 +         * to wait on.
 +         * Also, do not wait on active operations, because they do not
 +         * use up in-flight slots.
 +         */
 +        if (!op->is_pseudo_op && op->is_in_flight && !op->is_active_write) {
             qemu_co_queue_wait(&op->waiting_requests, NULL);
             return;
         }
@@ -324,13 +326,6 @@ mirror_wait_for_any_operation(MirrorBlockJob *s, bool active)
     abort();
 }
 -static inline void coroutine_fn
 -mirror_wait_for_free_in_flight_slot(MirrorBlockJob *s)
 -{
 -    /* Only non-active operations use up in-flight slots */
 -    mirror_wait_for_any_operation(s, false);
 -}
 -
 /* Perform a mirror copy operation.
  *
  * *op->bytes_handled is set to the number of bytes copied after and
 -- 
 2.37.3
--- a/SOURCES/kvm-block-mirror-Fix-NULL-s-job-in-active-writes.patch
+++ b/SOURCES/kvm-block-mirror-Fix-NULL-s-job-in-active-writes.patch
@ -0,0 +1,75 @@
 From b1f5aa5a342a25dc558ee9d435fed0643fe5155f Mon Sep 17 00:00:00 2001
 From: Hanna Reitz <hreitz@redhat.com>
 Date: Wed, 9 Nov 2022 17:54:50 +0100
 Subject: [PATCH 03/11] block/mirror: Fix NULL s->job in active writes
 RH-Author: Hanna Czenczek <hreitz@redhat.com>
 RH-MergeRequest: 246: block/mirror: Make active mirror progress even under full load
 RH-Bugzilla: 2125119
 RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Commit: [3/3] 49d7ebd15667151a6e14228a8260cfdd0aa27a78
 There is a small gap in mirror_start_job() before putting the mirror
 filter node into the block graph (bdrv_append() call) and the actual job
 being created.  Before the job is created, MirrorBDSOpaque.job is NULL.
 It is possible that requests come in when bdrv_drained_end() is called,
 and those requests would see MirrorBDSOpaque.job == NULL.  Have our
 filter node handle that case gracefully.
 Signed-off-by: Hanna Reitz <hreitz@redhat.com>
 Message-Id: <20221109165452.67927-4-hreitz@redhat.com>
 Reviewed-by: Kevin Wolf <kwolf@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit da93d5c84e56e6b4e84aa8e98b6b984c9b6bb528)
 Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 ---
 block/mirror.c | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)
 diff --git a/block/mirror.c b/block/mirror.c
 index 6b02555ad7..50289fca49 100644
 --- a/block/mirror.c
 +++ b/block/mirror.c
@@ -1438,11 +1438,13 @@ static int coroutine_fn bdrv_mirror_top_do_write(BlockDriverState *bs,
     MirrorOp *op = NULL;
     MirrorBDSOpaque *s = bs->opaque;
     int ret = 0;
 -    bool copy_to_target;
 +    bool copy_to_target = false;
 -    copy_to_target = s->job->ret >= 0 &&
 -                     !job_is_cancelled(&s->job->common.job) &&
 -                     s->job->copy_mode == MIRROR_COPY_MODE_WRITE_BLOCKING;
 +    if (s->job) {
 +        copy_to_target = s->job->ret >= 0 &&
 +                         !job_is_cancelled(&s->job->common.job) &&
 +                         s->job->copy_mode == MIRROR_COPY_MODE_WRITE_BLOCKING;
 +    }
     if (copy_to_target) {
         op = active_write_prepare(s->job, offset, bytes);
@@ -1487,11 +1489,13 @@ static int coroutine_fn bdrv_mirror_top_pwritev(BlockDriverState *bs,
     QEMUIOVector bounce_qiov;
     void *bounce_buf;
     int ret = 0;
 -    bool copy_to_target;
 +    bool copy_to_target = false;
 -    copy_to_target = s->job->ret >= 0 &&
 -                     !job_is_cancelled(&s->job->common.job) &&
 -                     s->job->copy_mode == MIRROR_COPY_MODE_WRITE_BLOCKING;
 +    if (s->job) {
 +        copy_to_target = s->job->ret >= 0 &&
 +                         !job_is_cancelled(&s->job->common.job) &&
 +                         s->job->copy_mode == MIRROR_COPY_MODE_WRITE_BLOCKING;
 +    }
     if (copy_to_target) {
         /* The guest might concurrently modify the data to write; but
 -- 
 2.37.3
--- a/SOURCES/kvm-block-move-bdrv_qiov_is_aligned-to-file-posix.patch
+++ b/SOURCES/kvm-block-move-bdrv_qiov_is_aligned-to-file-posix.patch
@ -0,0 +1,104 @@
 From 636e32b4c570ddb20266b6672311174353644f0e Mon Sep 17 00:00:00 2001
 From: Keith Busch <kbusch@kernel.org>
 Date: Thu, 29 Sep 2022 13:05:22 -0700
 Subject: [PATCH 1/2] block: move bdrv_qiov_is_aligned to file-posix
 RH-Author: Kevin Wolf <kwolf@redhat.com>
 RH-MergeRequest: 411: block: Fix iov_len check in bdrv_qiov_is_aligned()
 RH-Jira: RHEL-60553
 RH-Acked-by: Eric Blake <eblake@redhat.com>
 RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
 RH-Commit: [1/2] 682c1b81b42959d9d91e0f68cd70e9753e53a279
 There is only user of bdrv_qiov_is_aligned(), so move the alignment
 function to there and make it static.
 Signed-off-by: Keith Busch <kbusch@kernel.org>
 Message-Id: <20220929200523.3218710-2-kbusch@meta.com>
 Reviewed-by: Kevin Wolf <kwolf@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit a7c5f67a78569f8c275ea4ea9962e9c79b9d03cb)
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
 block/file-posix.c    | 20 ++++++++++++++++++++
 block/io.c            | 20 --------------------
 include/block/block.h |  1 -
 3 files changed, 20 insertions(+), 21 deletions(-)
 diff --git a/block/file-posix.c b/block/file-posix.c
 index b283093e5b..b404e1544f 100644
 --- a/block/file-posix.c
 +++ b/block/file-posix.c
@@ -2051,6 +2051,26 @@ static int coroutine_fn raw_thread_pool_submit(BlockDriverState *bs,
     return thread_pool_submit_co(pool, func, arg);
 }
 +/*
 + * Check if all memory in this vector is sector aligned.
 + */
 +static bool bdrv_qiov_is_aligned(BlockDriverState *bs, QEMUIOVector *qiov)
 +{
 +    int i;
 +    size_t alignment = bdrv_min_mem_align(bs);
 +
 +    for (i = 0; i < qiov->niov; i++) {
 +        if ((uintptr_t) qiov->iov[i].iov_base % alignment) {
 +            return false;
 +        }
 +        if (qiov->iov[i].iov_len % alignment) {
 +            return false;
 +        }
 +    }
 +
 +    return true;
 +}
 +
 static int coroutine_fn raw_co_prw(BlockDriverState *bs, uint64_t offset,
                                    uint64_t bytes, QEMUIOVector *qiov, int type)
 {
 diff --git a/block/io.c b/block/io.c
 index 8ae57728a6..639e171eff 100644
 --- a/block/io.c
 +++ b/block/io.c
@@ -3375,26 +3375,6 @@ void *qemu_try_blockalign0(BlockDriverState *bs, size_t size)
     return mem;
 }
 -/*
 - * Check if all memory in this vector is sector aligned.
 - */
 -bool bdrv_qiov_is_aligned(BlockDriverState *bs, QEMUIOVector *qiov)
 -{
 -    int i;
 -    size_t alignment = bdrv_min_mem_align(bs);
 -
 -    for (i = 0; i < qiov->niov; i++) {
 -        if ((uintptr_t) qiov->iov[i].iov_base % alignment) {
 -            return false;
 -        }
 -        if (qiov->iov[i].iov_len % alignment) {
 -            return false;
 -        }
 -    }
 -
 -    return true;
 -}
 -
 void bdrv_io_plug(BlockDriverState *bs)
 {
     BdrvChild *child;
 diff --git a/include/block/block.h b/include/block/block.h
 index f885f113ef..09b374b496 100644
 --- a/include/block/block.h
 +++ b/include/block/block.h
@@ -622,7 +622,6 @@ void *qemu_blockalign(BlockDriverState *bs, size_t size);
 void *qemu_blockalign0(BlockDriverState *bs, size_t size);
 void *qemu_try_blockalign(BlockDriverState *bs, size_t size);
 void *qemu_try_blockalign0(BlockDriverState *bs, size_t size);
 -bool bdrv_qiov_is_aligned(BlockDriverState *bs, QEMUIOVector *qiov);
 void bdrv_enable_copy_on_read(BlockDriverState *bs);
 void bdrv_disable_copy_on_read(BlockDriverState *bs);
 -- 
 2.45.2
--- a/SOURCES/kvm-block-nbd-Assert-there-are-no-timers-when-closed.patch
+++ b/SOURCES/kvm-block-nbd-Assert-there-are-no-timers-when-closed.patch
@ -0,0 +1,52 @@
 From d5a85fcf996948d1154e88e9ee3b4e8c64ec2694 Mon Sep 17 00:00:00 2001
 From: Hanna Reitz <hreitz@redhat.com>
 Date: Fri, 4 Feb 2022 12:10:08 +0100
 Subject: [PATCH 2/6] block/nbd: Assert there are no timers when closed
 RH-Author: Hanna Reitz <hreitz@redhat.com>
 RH-MergeRequest: 117: block/nbd: Handle AioContext changes
 RH-Commit: [2/6] 995795ae9844a7d2b28cb1e57fd7fe81482d0205
 RH-Bugzilla: 2035185
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Eric Blake <eblake@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 Our two timers must not remain armed beyond nbd_clear_bdrvstate(), or
 they will access freed data when they fire.
 This patch is separate from the patches that actually fix the issue
 (HEAD^^ and HEAD^) so that you can run the associated regression iotest
 (281) on a configuration that reproducibly exposes the bug.
 Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Signed-off-by: Hanna Reitz <hreitz@redhat.com>
 Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 (cherry picked from commit 8a39c381e5e407d2fe5500324323f90a8540fa90)
 Conflict:
 - block/nbd.c: open_timer was introduced after the 6.2 release (for
  nbd's @open-timeout parameter), and has not been backported, so drop
  the assertion that it is NULL
 Signed-off-by: Hanna Reitz <hreitz@redhat.com>
 ---
 block/nbd.c | 3 +++
 1 file changed, 3 insertions(+)
 diff --git a/block/nbd.c b/block/nbd.c
 index b8e5a9b4cc..aab20125d8 100644
 --- a/block/nbd.c
 +++ b/block/nbd.c
@@ -108,6 +108,9 @@ static void nbd_clear_bdrvstate(BlockDriverState *bs)
     yank_unregister_instance(BLOCKDEV_YANK_INSTANCE(bs->node_name));
 +    /* Must not leave timers behind that would access freed data */
 +    assert(!s->reconnect_delay_timer);
 +
     object_unref(OBJECT(s->tlscreds));
     qapi_free_SocketAddress(s->saddr);
     s->saddr = NULL;
 -- 
 2.27.0
--- a/SOURCES/kvm-block-nbd-Delete-reconnect-delay-timer-when-done.patch
+++ b/SOURCES/kvm-block-nbd-Delete-reconnect-delay-timer-when-done.patch
@ -0,0 +1,54 @@
 From 8e23c0f208c6bd5bb64c4f6e4863b93fa6f4e9de Mon Sep 17 00:00:00 2001
 From: Hanna Reitz <hreitz@redhat.com>
 Date: Fri, 4 Feb 2022 12:10:06 +0100
 Subject: [PATCH 1/6] block/nbd: Delete reconnect delay timer when done
 RH-Author: Hanna Reitz <hreitz@redhat.com>
 RH-MergeRequest: 117: block/nbd: Handle AioContext changes
 RH-Commit: [1/6] 70814602a8a43a7c14857d76266d82b1aa5174a9
 RH-Bugzilla: 2035185
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Eric Blake <eblake@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 We start the reconnect delay timer to cancel the reconnection attempt
 after a while.  Once nbd_co_do_establish_connection() has returned, this
 attempt is over, and we no longer need the timer.
 Delete it before returning from nbd_reconnect_attempt(), so that it does
 not persist beyond the I/O request that was paused for reconnecting; we
 do not want it to fire in a drained section, because all sort of things
 can happen in such a section (e.g. the AioContext might be changed, and
 we do not want the timer to fire in the wrong context; or the BDS might
 even be deleted, and so the timer CB would access already-freed data).
 Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Signed-off-by: Hanna Reitz <hreitz@redhat.com>
 Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 (cherry picked from commit 3ce1fc16bad9c3f8b7b10b451a224d6d76e5c551)
 Signed-off-by: Hanna Reitz <hreitz@redhat.com>
 ---
 block/nbd.c | 7 +++++++
 1 file changed, 7 insertions(+)
 diff --git a/block/nbd.c b/block/nbd.c
 index 5ef462db1b..b8e5a9b4cc 100644
 --- a/block/nbd.c
 +++ b/block/nbd.c
@@ -353,6 +353,13 @@ static coroutine_fn void nbd_reconnect_attempt(BDRVNBDState *s)
     }
     nbd_co_do_establish_connection(s->bs, NULL);
 +
 +    /*
 +     * The reconnect attempt is done (maybe successfully, maybe not), so
 +     * we no longer need this timer.  Delete it so it will not outlive
 +     * this I/O request (so draining removes all timers).
 +     */
 +    reconnect_delay_timer_del(s);
 }
 static coroutine_fn int nbd_receive_replies(BDRVNBDState *s, uint64_t handle)
 -- 
 2.27.0
--- a/Show More
+++ b/Show More
		`@ -0,0 +1 @@`
							`DEVPATH=="*/kvm", ACTION=="change", RUN+="/lib/udev/udev-kvm-check $env{COUNT} $env{EVENT}"`