import CS qemu-kvm-6.2.0-49.module_el8+991+097e156d

.gitignore

@@ -1 +1,5 @@
-SOURCES/qemu-4.2.0.tar.xz
+SOURCES/qemu-6.2.0.tar.xz
+SOURCES/tests_data_acpi_pc_SSDT.dimmpxm
+SOURCES/tests_data_acpi_q35_FACP.slic
+SOURCES/tests_data_acpi_q35_SSDT.dimmpxm
+SOURCES/tests_data_acpi_virt_SSDT.memhp

.qemu-kvm.metadata

@@ -1 +1,5 @@
-b27aa828a8457bd8551ae3c81b80cc365e1f6bfe SOURCES/qemu-4.2.0.tar.xz
+68cd61a466170115b88817e2d52db2cd7a92f43a SOURCES/qemu-6.2.0.tar.xz
+c4b34092bc5af1ba7febfca1477320fb024e8acd SOURCES/tests_data_acpi_pc_SSDT.dimmpxm
+19349e3517143bd1af56a5444e927ba37a111f72 SOURCES/tests_data_acpi_q35_FACP.slic
+4632d10ae8cedad4d5d760ed211f83f0dc81005d SOURCES/tests_data_acpi_q35_SSDT.dimmpxm
+ef12eed43cc357fb134db6fa3c7ffc83e222a97d SOURCES/tests_data_acpi_virt_SSDT.memhp

SOURCES/0005-Initial-redhat-build.patch

@@ -1,4 +1,4 @@
-From 4df157781801c50224373be57fa3c8c3741c0535 Mon Sep 17 00:00:00 2001
+From 19ce5ff93ddd6b8a998348f2a5f59f603c5e11b7 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 12 Oct 2018 07:31:11 +0200
 Subject: Initial redhat build
@@ -10,10 +10,8 @@ several issues are fixed in QEMU tree:
   - As we use qemu-kvm as name in all places, this is updated to be consistent
  - Man page renamed from qemu to qemu-kvm
   - man page is installed using make install so we have to fix it in qemu tree
- - Use "/share/qemu-kvm" as SHARE_SUFFIX
-  - We reconfigured our share to qemu-kvm to be consistent with used name
 
-This rebase includes changes up to qemu-kvm-4.1.0-18.el8
+This rebase includes changes up to qemu-kvm-6.1.0-5.el9
 
 Rebase notes (3.1.0):
 - added new configure options
@@ -49,6 +47,86 @@ Rebase notes (4.2.0):
 - Removed spapr-rtas.bin (upstream)
 - Require newer SLOF (20191022)
 
+Rebase notes (5.1.0):
+- Use python3 for virtio_seg_max_adjust.py test
+- Removed qemu-trace-stap shebang from spec file
+- Added virtiofsd.1 (upstream)
+- Use out-of-tree build
+- New documentation structure (upstream)
+- Update local build
+- Removing installed qemu-storage-daemon (added upstream)
+- Removing opensbi-riscv32-sifive_u-fw_jump.bin (added upstream)
+- Disable iotests (moved from Enable make check commit)
+- Added missing configure options
+- Reorder configure options
+- qemu-pr-helper moved to /usr/libexec/ (upstream)
+- Added submodules for usb-redir, smartcard-reader and qxl display (upstream)
+- Added setting rc version in Makefile for build
+- removed --disable-vxhs configure option (removed upstream)
+- bumped required libusbx-devel version to 1.0.23
+- bumped libfdt version to 1.6.0
+
+Rebase notes (5.2.0 rc0):
+- Move libfdt dependency to qemu-kvm-core
+- Move manpage rename from Makefile to spec file
+- rename with-confsuffix configure option to with-suffix (upstream)
+- Bump libusbx Requires version to 1.0.234
+- Manual copy of keymaps in spec file (BZ 1875217)
+- Removed /usr/share/qemu-kvm/npcm7xx_bootrom.bin, considering it
+  unpackaged for now.
+- Removed /usr/share/qemu-kvm/qboot.rom, considering unpackaged.
+- Added build dependency for meson and ninja-build
+- hw/s390/s390-pci-vfio.c hack - set NULL for g_autofree variables
+- Removed Chanelog (upstream)
+- Fix in directory used for docs (upstream add %name so we do not pass it in configure)
+- Package various .so as part of qemu-kvm-core package.
+
+Rebase notes (5.2.0 rc2):
+- Added fix for dtrace build on RHEL 8.4.0
+
+Rebase notes (5.2.0 rc3):
+- Added man page for qemu-pr-helper
+- Added new configure options
+- Update qemu-kiwi patches to v4
+
+Rebase notes (6.0.0):
+- update tracetool usage in spec file
+- remove qemu-storage-daemon-qmp-ref man page
+- remove qemu-storage-daemon man page
+- Added devel documentation
+- do not package virtfs-proxy-helper files
+- Use --with-git-submodules instead of --(enable|disable)-git-update
+- Minor build fixes for sending upstream
+- g_autofree initialization fixed upstream
+- Updated rc information usage
+- do not package package hw-s390x-virtio-gpu-ccw.so
+- Disable new switch options
+
+Rebase notes (6.1.0):
+- Fix warning issue in block.c
+- Download tarball from dist-git cache
+- Removed sheepdog driver
+- Added new display modules:
+  - hw-display-virtio-gpu-gl.so
+  - hw-display-virtio-gpu-pci-gl.so
+  - hw-display-virtio-vga-gl.so
+- sasl fix moved from ui/vnc.c to ui/vnc-auth-sasl.c
+- Added accel-qtest-%{kvm_target} and accel-tcg-%{kvm_target}
+- Added about docs
+- Use -q option for setup
+- Added hw-usb-host.so
+- Disable new options (bpf, nvmm, slirp-smbd)
+
+Rebase notes (6.2.0):
+- Using internal meson
+- removed --disable-jemalloc and --disable-tcmalloc configure options
+- added audio-oss.so
+- added fdt requirement for x86_64
+- tests/acceptance renamed to tests/avocado
+- added multiboot_dma.bin
+- Removed conflict relics
+- Updated configure options
+
 Merged patches (3.1.0):
 - 01f0c9f RHEL8: Add disable configure options to qemu spec file
 - Spec file cleanups
@@ -71,97 +149,203 @@ Merged patches (4.2.0):
 - 69e1fb2 enable virgla
 - d4f6115 enable virgl, for real this time ...
 
-Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
+Merged patches (5.1.0):
+- 5edf6bd Add support for rh-brew-module
+- f77d52d redhat: ship virtiofsd vhost-user device backend
+- 63f12d4 redhat: Always use module build target for rh-brew (modified)
+- 9b1e140 redhat: updating the modular target
+- 44b8bd0 spec: Fix python shenigans for tests
+
+Merged patches (5.2.0 rc0):
+- 9238ce7 Add support for simpletrace
+- 5797cff Remove explicit glusterfs-api dependency
+- fd62478 disable virgl
+- 0205018 redhat: link /etc/qemu-ga/fsfreeze-hook to /etc/qemu-kvm/
+- 3645097 redhat: Make all generated so files executable (not only block-*)
+
+Merged patches (5.2.0 rc2):
+- pjw 99657 redhat: introduces disable_everything macro into the configure call
+- pjw 99659 redhat: scripts/extract_build_cmd.py - Avoid listing empty lines
+- pjw 99658 redhat: Fixing rh-local build
+- pjw 99660 redhat: Add qemu-kiwi subpackage
+- d2e59ce redhat: add (un/pre)install systemd hooks for qemu-ga
+
+Merged patches (5.2.0 rc3):
+- pjw 99887 - redhat: allow Makefile rh-prep builddep to fail
+- pjw 99885 - redhat: adding rh-rpm target
+
+Merged patches (6.0.0):
+- 5ab9954a3b spec: find system python via meson
+- cd0f7db11f build-system: use b_staticpic=false
+- 80d2dec42c udev-kvm-check: remove the "exceeded subscription limit" message
+- 38959d51c0 redhat: Allow make to inherit params from parent make for rh-local
+- 1e0cfe458f redhat: moving all documentation files to qemu-kvm-docs
+- d7a594d02b redhat: makes qemu respect system's crypto profile
+- e2bbf1572b spec: Package qemu-storage-daemon
+- 92f10993ba spec: ui-spice sub-package
+- 8931e46069 spec: ui-opengl sub-package
+
+Merged patches (6.1.0):
+- 7bb57541b3 redhat: Install the s390-netboot.img that we've built
+- b4a8531f41 redhat: Fix "unversioned Obsoletes" warning
+- 141a1693c7 redhat: Move qemu-kvm-docs dependency to qemu-kvm
+- d75f59c6f9 redhat: introducting qemu-kvm-hw-usbredir
+- a934d8bf44 redhat: use the standard vhost-user JSON path
+
+Merged patches (6.2.0):
+- 4f3f04bbb6 spec: Remove qemu-kiwi build
 ---
- .gitignore                        |    1 +
- Makefile                          |    3 +-
- configure                         |    1 +
- os-posix.c                        |    2 +-
- redhat/Makefile                   |   82 +
- redhat/Makefile.common            |   51 +
- redhat/README.tests               |   39 +
- redhat/qemu-kvm.spec.template     | 2434 +++++++++++++++++++++++++++++
- redhat/scripts/process-patches.sh |    7 +-
- tests/Makefile.include            |    2 +-
- ui/vnc.c                          |    2 +-
- 11 files changed, 2615 insertions(+), 9 deletions(-)
+ .gitignore                                 |    1 +
+ .gitlab-ci.yml                             |   24 -
+ .gitlab/issue_templates/bug.md             |   64 -
+ .gitlab/issue_templates/feature_request.md |   32 -
+ README.systemtap                           |   43 +
+ meson.build                                |    4 +-
+ redhat/Makefile                            |   90 +
+ redhat/Makefile.common                     |   48 +
+ redhat/README.tests                        |   39 +
+ redhat/qemu-kvm.spec.template              | 3896 ++++++++++++++++++++
+ redhat/scripts/extract_build_cmd.py        |    5 +-
+ redhat/scripts/process-patches.sh          |   20 +-
+ redhat/scripts/tarball_checksum.sh         |    2 +-
+ redhat/udev-kvm-check.c                    |   19 +-
+ scripts/qemu-guest-agent/fsfreeze-hook     |    2 +-
+ scripts/systemtap/conf.d/qemu_kvm.conf     |    4 +
+ scripts/systemtap/script.d/qemu_kvm.stp    |    1 +
+ tests/check-block.sh                       |    2 +
+ ui/vnc-auth-sasl.c                         |    2 +-
+ 19 files changed, 4142 insertions(+), 156 deletions(-)
+ delete mode 100644 .gitlab-ci.yml
+ delete mode 100644 .gitlab/issue_templates/bug.md
+ delete mode 100644 .gitlab/issue_templates/feature_request.md
+ create mode 100644 README.systemtap
  create mode 100644 redhat/Makefile
  create mode 100644 redhat/Makefile.common
  create mode 100644 redhat/README.tests
  create mode 100644 redhat/qemu-kvm.spec.template
+ create mode 100644 scripts/systemtap/conf.d/qemu_kvm.conf
+ create mode 100644 scripts/systemtap/script.d/qemu_kvm.stp
 
-diff --git a/Makefile b/Makefile
-index b437a346d7..086727dbb9 100644
---- a/Makefile
-+++ b/Makefile
-@@ -512,6 +512,7 @@ CAP_CFLAGS += -DCAPSTONE_HAS_ARM
- CAP_CFLAGS += -DCAPSTONE_HAS_ARM64
- CAP_CFLAGS += -DCAPSTONE_HAS_POWERPC
- CAP_CFLAGS += -DCAPSTONE_HAS_X86
-+CAP_CFLAGS += -Wp,-D_GLIBCXX_ASSERTIONS
+diff --git a/README.systemtap b/README.systemtap
+new file mode 100644
+index 0000000000..ad913fc990
+--- /dev/null
++++ b/README.systemtap
+@@ -0,0 +1,43 @@
++QEMU tracing using systemtap-initscript
++---------------------------------------
++
++You can capture QEMU trace data all the time using systemtap-initscript.  This
++uses SystemTap's flight recorder mode to trace all running guests to a
++fixed-size buffer on the host.  Old trace entries are overwritten by new
++entries when the buffer size wraps.
++
++1. Install the systemtap-initscript package:
++  # yum install systemtap-initscript
++
++2. Install the systemtap scripts and the conf file:
++  # cp /usr/share/qemu-kvm/systemtap/script.d/qemu_kvm.stp /etc/systemtap/script.d/
++  # cp /usr/share/qemu-kvm/systemtap/conf.d/qemu_kvm.conf /etc/systemtap/conf.d/
++
++The set of trace events to enable is given in qemu_kvm.stp.  This SystemTap
++script can be customized to add or remove trace events provided in
++/usr/share/systemtap/tapset/qemu-kvm-simpletrace.stp.
++
++SystemTap customizations can be made to qemu_kvm.conf to control the flight
++recorder buffer size and whether to store traces in memory only or disk too.
++See stap(1) for option documentation.
++
++3. Start the systemtap service.
++　# service systemtap start qemu_kvm
++
++4. Make the service start at boot time.
++　# chkconfig systemtap on
++
++5. Confirm that the service works.
++  # service systemtap status qemu_kvm
++  qemu_kvm is running...
++
++When you want to inspect the trace buffer, perform the following steps:
++
++1. Dump the trace buffer.
++  # staprun -A qemu_kvm >/tmp/trace.log
++
++2. Start the systemtap service because the preceding step stops the service.
++  # service systemtap start qemu_kvm
++
++3. Translate the trace record to readable format.
++  # /usr/share/qemu-kvm/simpletrace.py --no-header /usr/share/qemu-kvm/trace-events /tmp/trace.log
+diff --git a/meson.build b/meson.build
+index 96de1a6ef9..5f6ba86dbb 100644
+--- a/meson.build
++++ b/meson.build
+@@ -2108,7 +2108,9 @@ if capstone_opt == 'internal'
+     # Include all configuration defines via a header file, which will wind up
+     # as a dependency on the object file, and thus changes here will result
+     # in a rebuild.
+-    '-include', 'capstone-defs.h'
++    '-include', 'capstone-defs.h',
++
++    '-Wp,-D_GLIBCXX_ASSERTIONS',
+   ]
  
- .PHONY: capstone/all
- capstone/all: .git-submodule-status
-@@ -826,7 +827,7 @@ install-doc: $(DOCS) install-sphinxdocs
- 	$(INSTALL_DATA) docs/interop/qemu-qmp-ref.txt "$(DESTDIR)$(qemu_docdir)"
- ifdef CONFIG_POSIX
- 	$(INSTALL_DIR) "$(DESTDIR)$(mandir)/man1"
--	$(INSTALL_DATA) qemu.1 "$(DESTDIR)$(mandir)/man1"
-+	$(INSTALL_DATA) qemu.1 "$(DESTDIR)$(mandir)/man1/qemu-kvm.1"
- 	$(INSTALL_DIR) "$(DESTDIR)$(mandir)/man7"
- 	$(INSTALL_DATA) docs/interop/qemu-qmp-ref.7 "$(DESTDIR)$(mandir)/man7"
- 	$(INSTALL_DATA) docs/qemu-block-drivers.7 "$(DESTDIR)$(mandir)/man7"
-diff --git a/configure b/configure
-index 6099be1d84..16564f8ccc 100755
---- a/configure
-+++ b/configure
-@@ -2424,6 +2424,7 @@ if test "$seccomp" != "no" ; then
-         seccomp="no"
+   libcapstone = static_library('capstone',
+diff --git a/scripts/qemu-guest-agent/fsfreeze-hook b/scripts/qemu-guest-agent/fsfreeze-hook
+index 13aafd4845..e9b84ec028 100755
+--- a/scripts/qemu-guest-agent/fsfreeze-hook
++++ b/scripts/qemu-guest-agent/fsfreeze-hook
+@@ -8,7 +8,7 @@
+ # request, it is issued with "thaw" argument after filesystem is thawed.
+ 
+ LOGFILE=/var/log/qga-fsfreeze-hook.log
+-FSFREEZE_D=$(dirname -- "$0")/fsfreeze-hook.d
++FSFREEZE_D=$(dirname -- "$(realpath $0)")/fsfreeze-hook.d
+ 
+ # Check whether file $1 is a backup or rpm-generated file and should be ignored
+ is_ignored_file() {
+diff --git a/scripts/systemtap/conf.d/qemu_kvm.conf b/scripts/systemtap/conf.d/qemu_kvm.conf
+new file mode 100644
+index 0000000000..372d8160a4
+--- /dev/null
++++ b/scripts/systemtap/conf.d/qemu_kvm.conf
+@@ -0,0 +1,4 @@
++# Force load uprobes (see BZ#1118352)
++stap -e 'probe process("/usr/libexec/qemu-kvm").function("main") { printf("") }' -c true
++
++qemu_kvm_OPT="-s4" # per-CPU buffer size, in megabytes
+diff --git a/scripts/systemtap/script.d/qemu_kvm.stp b/scripts/systemtap/script.d/qemu_kvm.stp
+new file mode 100644
+index 0000000000..c04abf9449
+--- /dev/null
++++ b/scripts/systemtap/script.d/qemu_kvm.stp
+@@ -0,0 +1 @@
++probe qemu.kvm.simpletrace.handle_qmp_command,qemu.kvm.simpletrace.monitor_protocol_*,qemu.kvm.simpletrace.migrate_set_state {}
+diff --git a/tests/check-block.sh b/tests/check-block.sh
+index f86cb863de..6d38340d49 100755
+--- a/tests/check-block.sh
++++ b/tests/check-block.sh
+@@ -69,6 +69,8 @@ else
      fi
  fi
+ 
++exit 0
 +
- ##########################################
- # xen probe
+ cd tests/qemu-iotests
  
-diff --git a/os-posix.c b/os-posix.c
-index 86cffd2c7d..1c9f86768d 100644
---- a/os-posix.c
-+++ b/os-posix.c
-@@ -83,7 +83,7 @@ void os_setup_signal_handling(void)
- /* Find a likely location for support files using the location of the binary.
-    For installed binaries this will be "$bindir/../share/qemu".  When
-    running from the build tree this will be "$bindir/../pc-bios".  */
--#define SHARE_SUFFIX "/share/qemu"
-+#define SHARE_SUFFIX "/share/qemu-kvm"
- #define BUILD_SUFFIX "/pc-bios"
- char *os_find_datadir(void)
+ # QEMU_CHECK_BLOCK_AUTO is used to disable some unstable sub-tests
+diff --git a/ui/vnc-auth-sasl.c b/ui/vnc-auth-sasl.c
+index 47fdae5b21..2a950caa2a 100644
+--- a/ui/vnc-auth-sasl.c
++++ b/ui/vnc-auth-sasl.c
+@@ -42,7 +42,7 @@
+ 
+ bool vnc_sasl_server_init(Error **errp)
  {
-diff --git a/tests/Makefile.include b/tests/Makefile.include
-index 8566f5f119..b483790cf3 100644
---- a/tests/Makefile.include
-+++ b/tests/Makefile.include
-@@ -1194,7 +1194,7 @@ check-acceptance: check-venv $(TESTS_RESULTS_DIR)
- check-qapi-schema: check-tests/qapi-schema/frontend check-tests/qapi-schema/doc-good.texi
- check-qtest: $(patsubst %,check-qtest-%, $(QTEST_TARGETS))
- check-block: $(patsubst %,check-%, $(check-block-y))
--check: check-block check-qapi-schema check-unit check-softfloat check-qtest check-decodetree
-+check: check-qapi-schema check-unit check-softfloat check-qtest check-decodetree
- check-clean:
- 	rm -rf $(check-unit-y) tests/*.o $(QEMU_IOTESTS_HELPERS-y)
- 	rm -rf $(sort $(foreach target,$(SYSEMU_TARGET_LIST), $(check-qtest-$(target)-y)) $(check-qtest-generic-y))
-diff --git a/ui/vnc.c b/ui/vnc.c
-index 87b8045afe..ecf6276f5b 100644
---- a/ui/vnc.c
-+++ b/ui/vnc.c
-@@ -3987,7 +3987,7 @@ void vnc_display_open(const char *id, Error **errp)
+-    int saslErr = sasl_server_init(NULL, "qemu");
++    int saslErr = sasl_server_init(NULL, "qemu-kvm");
  
- #ifdef CONFIG_VNC_SASL
-     if (sasl) {
--        int saslErr = sasl_server_init(NULL, "qemu");
-+        int saslErr = sasl_server_init(NULL, "qemu-kvm");
- 
-         if (saslErr != SASL_OK) {
-             error_setg(errp, "Failed to initialize SASL auth: %s",
+     if (saslErr != SASL_OK) {
+         error_setg(errp, "Failed to initialize SASL auth: %s",
 -- 
-2.21.0
+2.27.0
 

SOURCES/0007-Machine-type-related-general-changes.patch

@@ -1,4 +1,4 @@
-From 113078b23a4747b07eb363719d7cbc0af403dd2a Mon Sep 17 00:00:00 2001
+From adca046d9db670637b9bf2b24f7a4349a9fe2628 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 11 Jan 2019 09:54:45 +0100
 Subject: Machine type related general changes
@@ -20,6 +20,12 @@ Rebase changes (4.1.0):
 - Use one format for compat scructures
 - Added compat for virtio-balloon-pci.any_layout for rhel71
 
+Rebase changes (weekly-210303):
+- Added rhel 8.4.0 compat based on 5.2 compat
+
+Rebase changes (weekly-211103):
+- Do not duplicate minimal_version_id for piix4_pm
+
 Merged patches (4.0.0):
 - d4c0957 compat: Generic HW_COMPAT_RHEL7_6
 - cbac773 virtio: Make disable-legacy/disable-modern compat properties optional
@@ -33,34 +39,61 @@ Merged patches (4.2.0):
 - ca4a5e8 virtio: Make disable-legacy/disable-modern compat properties optional
 - compat: Generic hw_compat_rhel_8_1 (patch 93040/92956)
 
-Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
+Merged patches (5.1.0):
+- e6c3fbf hw/smbios: set new default SMBIOS fields for Windows driver support (partialy)
+- 8f9f4d8 compat: disable 'edid' for virtio-gpu-ccw
+
+Merged patches (5.2.0 rc0):
+- 8348642 redhat: define hw_compat_8_2
+- 45b8402 redhat: define hw_compat_8_2
+- 4effa71 redhat: Update hw_compat_8_2
+- 0e84dff virtio: skip legacy support check on machine types less than 5.1 (partialy)
+
+Merged patches (6.0.0):
+- fa0063ba67 redhat: Define hw_compat_8_3
+- d98e328c8d usb/hcd-xhci-pci: Fixup capabilities ordering (again)
+- b8a2578117 virtio: move 'use-disabled-flag' property to hw_compat_4_2
+- f7940b04c8 virtio-pci: compat page aligned ATS
+
+Merged patches (weekly-210602):
+- 26f25108c1 redhat: add missing entries in hw_compat_rhel_8_4
+
+Merged patches (weekly-211006):
+- 43c4b9bea6 redhat: Define hw_compat_rhel_8_5
 ---
- hw/acpi/ich9.c          |  16 ++++
- hw/acpi/piix4.c         |   5 +-
- hw/char/serial.c        |  16 ++++
- hw/core/machine.c       | 170 ++++++++++++++++++++++++++++++++++++++++
- hw/display/vga-isa.c    |   2 +-
- hw/net/e1000e.c         |  21 +++++
- hw/net/rtl8139.c        |   4 +-
- hw/rtc/mc146818rtc.c    |   6 ++
- hw/smbios/smbios.c      |   1 +
- hw/timer/i8254_common.c |   2 +-
- hw/usb/hcd-uhci.c       |   4 +-
- hw/usb/hcd-xhci.c       |  20 +++++
- hw/usb/hcd-xhci.h       |   2 +
- include/hw/acpi/ich9.h  |   3 +
- include/hw/boards.h     |  24 ++++++
- include/hw/usb.h        |   4 +
- migration/migration.c   |   2 +
- migration/migration.h   |   5 ++
- 18 files changed, 301 insertions(+), 6 deletions(-)
+ hw/acpi/ich9.c               |  15 ++
+ hw/acpi/piix4.c              |   6 +-
+ hw/arm/virt.c                |   2 +-
+ hw/char/serial.c             |  16 +++
+ hw/core/machine.c            | 272 +++++++++++++++++++++++++++++++++++
+ hw/display/vga-isa.c         |   2 +-
+ hw/i386/pc_piix.c            |   2 +
+ hw/i386/pc_q35.c             |   2 +
+ hw/net/e1000e.c              |  22 +++
+ hw/net/rtl8139.c             |   4 +-
+ hw/rtc/mc146818rtc.c         |   6 +
+ hw/smbios/smbios.c           |  46 +++++-
+ hw/timer/i8254_common.c      |   2 +-
+ hw/usb/hcd-uhci.c            |   4 +-
+ hw/usb/hcd-xhci-pci.c        |  59 ++++++--
+ hw/usb/hcd-xhci-pci.h        |   1 +
+ hw/usb/hcd-xhci.c            |  20 +++
+ hw/usb/hcd-xhci.h            |   2 +
+ include/hw/acpi/ich9.h       |   3 +
+ include/hw/boards.h          |  36 +++++
+ include/hw/firmware/smbios.h |   5 +-
+ include/hw/i386/pc.h         |   3 +
+ include/hw/usb.h             |   3 +
+ migration/migration.c        |   2 +
+ migration/migration.h        |   5 +
+ 25 files changed, 514 insertions(+), 26 deletions(-)
 
 diff --git a/hw/acpi/ich9.c b/hw/acpi/ich9.c
-index ab203ad448..7ec26884e8 100644
+index 381ef2ddcf..82bd805b55 100644
 --- a/hw/acpi/ich9.c
 +++ b/hw/acpi/ich9.c
-@@ -444,6 +444,18 @@ static void ich9_pm_set_enable_tco(Object *obj, bool value, Error **errp)
-     s->pm.enable_tco = value;
+@@ -433,6 +433,18 @@ static void ich9_pm_set_keep_pci_slot_hpc(Object *obj, bool value, Error **errp)
+     s->pm.keep_pci_slot_hpc = value;
  }
  
 +static bool ich9_pm_get_force_rev1_fadt(Object *obj, Error **errp)
@@ -75,33 +108,33 @@ index ab203ad448..7ec26884e8 100644
 +    s->pm.force_rev1_fadt = value;
 +}
 +
- void ich9_pm_add_properties(Object *obj, ICH9LPCPMRegs *pm, Error **errp)
+ void ich9_pm_add_properties(Object *obj, ICH9LPCPMRegs *pm)
  {
      static const uint32_t gpe0_len = ICH9_PMIO_GPE0_LEN;
-@@ -468,6 +480,10 @@ void ich9_pm_add_properties(Object *obj, ICH9LPCPMRegs *pm, Error **errp)
+@@ -457,6 +469,9 @@ void ich9_pm_add_properties(Object *obj, ICH9LPCPMRegs *pm)
+     object_property_add_bool(obj, "cpu-hotplug-legacy",
                               ich9_pm_get_cpu_hotplug_legacy,
-                              ich9_pm_set_cpu_hotplug_legacy,
-                              NULL);
+                              ich9_pm_set_cpu_hotplug_legacy);
 +    object_property_add_bool(obj, "__com.redhat_force-rev1-fadt",
 +                             ich9_pm_get_force_rev1_fadt,
-+                             ich9_pm_set_force_rev1_fadt,
-+                             NULL);
-     object_property_add(obj, ACPI_PM_PROP_S3_DISABLED, "uint8",
-                         ich9_pm_get_disable_s3,
-                         ich9_pm_set_disable_s3,
++                             ich9_pm_set_force_rev1_fadt);
+     object_property_add_uint8_ptr(obj, ACPI_PM_PROP_S3_DISABLED,
+                                   &pm->disable_s3, OBJ_PROP_FLAG_READWRITE);
+     object_property_add_uint8_ptr(obj, ACPI_PM_PROP_S4_DISABLED,
 diff --git a/hw/acpi/piix4.c b/hw/acpi/piix4.c
-index 93aec2dd2c..3a26193cbe 100644
+index f0b5fac44a..8d6011c0a3 100644
 --- a/hw/acpi/piix4.c
 +++ b/hw/acpi/piix4.c
-@@ -274,6 +274,7 @@ static const VMStateDescription vmstate_acpi = {
+@@ -278,7 +278,7 @@ static bool piix4_vmstate_need_smbus(void *opaque, int version_id)
+ static const VMStateDescription vmstate_acpi = {
      .name = "piix4_pm",
      .version_id = 3,
-     .minimum_version_id = 3,
+-    .minimum_version_id = 3,
 +    .minimum_version_id = 2,
      .post_load = vmstate_acpi_post_load,
      .fields = (VMStateField[]) {
          VMSTATE_PCI_DEVICE(parent_obj, PIIX4PMState),
-@@ -627,8 +628,8 @@ static void piix4_send_gpe(AcpiDeviceIf *adev, AcpiEventStatusBits ev)
+@@ -644,8 +644,8 @@ static void piix4_send_gpe(AcpiDeviceIf *adev, AcpiEventStatusBits ev)
  
  static Property piix4_pm_properties[] = {
      DEFINE_PROP_UINT32("smb_io_base", PIIX4PMState, smb_io_base, 0),
@@ -110,21 +143,34 @@ index 93aec2dd2c..3a26193cbe 100644
 +    DEFINE_PROP_UINT8(ACPI_PM_PROP_S3_DISABLED, PIIX4PMState, disable_s3, 1),
 +    DEFINE_PROP_UINT8(ACPI_PM_PROP_S4_DISABLED, PIIX4PMState, disable_s4, 1),
      DEFINE_PROP_UINT8(ACPI_PM_PROP_S4_VAL, PIIX4PMState, s4_val, 2),
-     DEFINE_PROP_BOOL("acpi-pci-hotplug-with-bridge-support", PIIX4PMState,
-                      use_acpi_pci_hotplug, true),
+     DEFINE_PROP_BOOL(ACPI_PM_PROP_ACPI_PCIHP_BRIDGE, PIIX4PMState,
+                      use_acpi_hotplug_bridge, true),
+diff --git a/hw/arm/virt.c b/hw/arm/virt.c
+index 30da05dfe0..5de4d9d73b 100644
+--- a/hw/arm/virt.c
++++ b/hw/arm/virt.c
+@@ -1590,7 +1590,7 @@ static void virt_build_smbios(VirtMachineState *vms)
+ 
+     smbios_set_defaults("QEMU", product,
+                         vmc->smbios_old_sys_ver ? "1.0" : mc->name, false,
+-                        true, SMBIOS_ENTRY_POINT_30);
++                        true, NULL, NULL, SMBIOS_ENTRY_POINT_30);
+ 
+     smbios_get_tables(MACHINE(vms), NULL, 0,
+                       &smbios_tables, &smbios_tables_len,
 diff --git a/hw/char/serial.c b/hw/char/serial.c
-index b4aa250950..0012f0e44d 100644
+index 7061aacbce..fe8d0afbb0 100644
 --- a/hw/char/serial.c
 +++ b/hw/char/serial.c
-@@ -34,6 +34,7 @@
- #include "sysemu/runstate.h"
- #include "qemu/error-report.h"
+@@ -37,6 +37,7 @@
  #include "trace.h"
+ #include "hw/qdev-properties.h"
+ #include "hw/qdev-properties-system.h"
 +#include "migration/migration.h"
  
- //#define DEBUG_SERIAL
+ #define UART_LCR_DLAB	0x80	/* Divisor latch access bit */
  
-@@ -703,6 +704,9 @@ static int serial_post_load(void *opaque, int version_id)
+@@ -689,6 +690,9 @@ static int serial_post_load(void *opaque, int version_id)
  static bool serial_thr_ipending_needed(void *opaque)
  {
      SerialState *s = opaque;
@@ -134,7 +180,7 @@ index b4aa250950..0012f0e44d 100644
  
      if (s->ier & UART_IER_THRI) {
          bool expected_value = ((s->iir & UART_IIR_ID) == UART_IIR_THRI);
-@@ -784,6 +788,10 @@ static const VMStateDescription vmstate_serial_xmit_fifo = {
+@@ -770,6 +774,10 @@ static const VMStateDescription vmstate_serial_xmit_fifo = {
  static bool serial_fifo_timeout_timer_needed(void *opaque)
  {
      SerialState *s = (SerialState *)opaque;
@@ -145,7 +191,7 @@ index b4aa250950..0012f0e44d 100644
      return timer_pending(s->fifo_timeout_timer);
  }
  
-@@ -801,6 +809,10 @@ static const VMStateDescription vmstate_serial_fifo_timeout_timer = {
+@@ -787,6 +795,10 @@ static const VMStateDescription vmstate_serial_fifo_timeout_timer = {
  static bool serial_timeout_ipending_needed(void *opaque)
  {
      SerialState *s = (SerialState *)opaque;
@@ -156,7 +202,7 @@ index b4aa250950..0012f0e44d 100644
      return s->timeout_ipending != 0;
  }
  
-@@ -818,6 +830,10 @@ static const VMStateDescription vmstate_serial_timeout_ipending = {
+@@ -804,6 +816,10 @@ static const VMStateDescription vmstate_serial_timeout_ipending = {
  static bool serial_poll_needed(void *opaque)
  {
      SerialState *s = (SerialState *)opaque;
@@ -168,13 +214,115 @@ index b4aa250950..0012f0e44d 100644
  }
  
 diff --git a/hw/core/machine.c b/hw/core/machine.c
-index 1689ad3bf8..e0e0eec8bf 100644
+index 53a99abc56..be4f9864cd 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
-@@ -27,6 +27,176 @@
- #include "hw/pci/pci.h"
- #include "hw/mem/nvdimm.h"
+@@ -37,6 +37,278 @@
+ #include "hw/virtio/virtio.h"
+ #include "hw/virtio/virtio-pci.h"
  
++/*
++ * Mostly the same as hw_compat_6_0
++ */
++GlobalProperty hw_compat_rhel_8_5[] = {
++    /* hw_compat_rhel_8_5 from hw_compat_6_0 */
++    { "gpex-pcihost", "allow-unmapped-accesses", "false" },
++    /* hw_compat_rhel_8_5 from hw_compat_6_0 */
++    { "i8042", "extended-state", "false"},
++    /* hw_compat_rhel_8_5 from hw_compat_6_0 */
++    { "nvme-ns", "eui64-default", "off"},
++    /* hw_compat_rhel_8_5 from hw_compat_6_0 */
++    { "e1000", "init-vet", "off" },
++    /* hw_compat_rhel_8_5 from hw_compat_6_0 */
++    { "e1000e", "init-vet", "off" },
++};
++const size_t hw_compat_rhel_8_5_len = G_N_ELEMENTS(hw_compat_rhel_8_5);
++
++/*
++ * Mostly the same as hw_compat_5_2
++ */
++GlobalProperty hw_compat_rhel_8_4[] = {
++    /* hw_compat_rhel_8_4 from hw_compat_5_2 */
++    { "ICH9-LPC", "smm-compat", "on"},
++    /* hw_compat_rhel_8_4 from hw_compat_5_2 */
++    { "PIIX4_PM", "smm-compat", "on"},
++    /* hw_compat_rhel_8_4 from hw_compat_5_2 */
++    { "virtio-blk-device", "report-discard-granularity", "off" },
++    /* hw_compat_rhel_8_4 from hw_compat_5_2 */
++    { "virtio-net-pci", "vectors", "3"},
++};
++const size_t hw_compat_rhel_8_4_len = G_N_ELEMENTS(hw_compat_rhel_8_4);
++
++/*
++ * Mostly the same as hw_compat_5_1
++ */
++GlobalProperty hw_compat_rhel_8_3[] = {
++    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
++    { "vhost-scsi", "num_queues", "1"},
++    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
++    { "vhost-user-blk", "num-queues", "1"},
++    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
++    { "vhost-user-scsi", "num_queues", "1"},
++    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
++    { "virtio-blk-device", "num-queues", "1"},
++    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
++    { "virtio-scsi-device", "num_queues", "1"},
++    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
++    { "nvme", "use-intel-id", "on"},
++    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
++    { "pvpanic", "events", "1"}, /* PVPANIC_PANICKED */
++    /* hw_compat_rhel_8_3 bz 1912846 */
++    { "pci-xhci", "x-rh-late-msi-cap", "off" },
++    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
++    { "virtio-pci", "x-ats-page-aligned", "off"},
++};
++const size_t hw_compat_rhel_8_3_len = G_N_ELEMENTS(hw_compat_rhel_8_3);
++
++/*
++ * The same as hw_compat_4_2 + hw_compat_5_0
++ */
++GlobalProperty hw_compat_rhel_8_2[] = {
++    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
++    { "virtio-blk-device", "queue-size", "128"},
++    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
++    { "virtio-scsi-device", "virtqueue_size", "128"},
++    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
++    { "virtio-blk-device", "x-enable-wce-if-config-wce", "off" },
++    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
++    { "virtio-blk-device", "seg-max-adjust", "off"},
++    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
++    { "virtio-scsi-device", "seg_max_adjust", "off"},
++    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
++    { "vhost-blk-device", "seg_max_adjust", "off"},
++    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
++    { "usb-host", "suppress-remote-wake", "off" },
++    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
++    { "usb-redir", "suppress-remote-wake", "off" },
++    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
++    { "qxl", "revision", "4" },
++    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
++    { "qxl-vga", "revision", "4" },
++    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
++    { "fw_cfg", "acpi-mr-restore", "false" },
++    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
++    { "virtio-device", "use-disabled-flag", "false" },
++    /* hw_compat_rhel_8_2 from hw_compat_5_0 */
++    { "pci-host-bridge", "x-config-reg-migration-enabled", "off" },
++    /* hw_compat_rhel_8_2 from hw_compat_5_0 */
++    { "virtio-balloon-device", "page-poison", "false" },
++    /* hw_compat_rhel_8_2 from hw_compat_5_0 */
++    { "vmport", "x-read-set-eax", "off" },
++    /* hw_compat_rhel_8_2 from hw_compat_5_0 */
++    { "vmport", "x-signal-unsupported-cmd", "off" },
++    /* hw_compat_rhel_8_2 from hw_compat_5_0 */
++    { "vmport", "x-report-vmx-type", "off" },
++    /* hw_compat_rhel_8_2 from hw_compat_5_0 */
++    { "vmport", "x-cmds-v2", "off" },
++    /* hw_compat_rhel_8_2 from hw_compat_5_0 */
++    { "virtio-device", "x-disable-legacy-check", "true" },
++};
++const size_t hw_compat_rhel_8_2_len = G_N_ELEMENTS(hw_compat_rhel_8_2);
++
 +/*
 + * The same as hw_compat_4_1
 + */
@@ -220,7 +368,7 @@ index 1689ad3bf8..e0e0eec8bf 100644
 +    /* hw_compat_rhel_8_0 from hw_compat_4_0 */
 +    { "virtio-vga",     "edid", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_4_0 */
-+    { "virtio-gpu-pci", "edid", "false" },
++    { "virtio-gpu-device", "edid", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_4_0 */
 +    { "virtio-device", "use-started", "false" },
 +    /* hw_compat_rhel_8_0 from hw_compat_3_1 - that was added in 4.1 */
@@ -345,14 +493,14 @@ index 1689ad3bf8..e0e0eec8bf 100644
 +};
 +const size_t hw_compat_rhel_7_1_len = G_N_ELEMENTS(hw_compat_rhel_7_1);
 +
- GlobalProperty hw_compat_4_1[] = {
-     { "virtio-pci", "x-pcie-flr-init", "off" },
- };
+ GlobalProperty hw_compat_6_1[] = {
+     { "vhost-user-vsock-device", "seqpacket", "off" },
+     { "nvme-ns", "shared", "off" },
 diff --git a/hw/display/vga-isa.c b/hw/display/vga-isa.c
-index 873e5e9706..d1a2efe47e 100644
+index 90851e730b..a91c5d7467 100644
 --- a/hw/display/vga-isa.c
 +++ b/hw/display/vga-isa.c
-@@ -82,7 +82,7 @@ static void vga_isa_realizefn(DeviceState *dev, Error **errp)
+@@ -85,7 +85,7 @@ static void vga_isa_realizefn(DeviceState *dev, Error **errp)
  }
  
  static Property vga_isa_properties[] = {
@@ -361,23 +509,50 @@ index 873e5e9706..d1a2efe47e 100644
      DEFINE_PROP_END_OF_LIST(),
  };
  
+diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
+index 223dd3e05d..dda3f64f19 100644
+--- a/hw/i386/pc_piix.c
++++ b/hw/i386/pc_piix.c
+@@ -177,6 +177,8 @@ static void pc_init1(MachineState *machine,
+         smbios_set_defaults("QEMU", "Standard PC (i440FX + PIIX, 1996)",
+                             mc->name, pcmc->smbios_legacy_mode,
+                             pcmc->smbios_uuid_encoded,
++                            pcmc->smbios_stream_product,
++                            pcmc->smbios_stream_version,
+                             SMBIOS_ENTRY_POINT_21);
+     }
+ 
+diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
+index e1e100316d..235054a643 100644
+--- a/hw/i386/pc_q35.c
++++ b/hw/i386/pc_q35.c
+@@ -200,6 +200,8 @@ static void pc_q35_init(MachineState *machine)
+         smbios_set_defaults("QEMU", "Standard PC (Q35 + ICH9, 2009)",
+                             mc->name, pcmc->smbios_legacy_mode,
+                             pcmc->smbios_uuid_encoded,
++                            pcmc->smbios_stream_product,
++                            pcmc->smbios_stream_version,
+                             SMBIOS_ENTRY_POINT_21);
+     }
+ 
 diff --git a/hw/net/e1000e.c b/hw/net/e1000e.c
-index b69fd7d8ad..d8be50a1ce 100644
+index ac96f7665a..d35bc1f0b0 100644
 --- a/hw/net/e1000e.c
 +++ b/hw/net/e1000e.c
-@@ -79,6 +79,11 @@ typedef struct E1000EState {
+@@ -81,6 +81,12 @@ struct E1000EState {
  
      E1000ECore core;
- 
+     bool init_vet;
++
 +    /* 7.3 had the intr_state field that was in the original e1000e code
 +     * but that was removed prior to 2.7's release
 +     */
 +    bool redhat_7_3_intr_state_enable;
 +    uint32_t redhat_7_3_intr_state;
- } E1000EState;
+ };
  
  #define E1000E_MMIO_IDX     0
-@@ -94,6 +99,10 @@ typedef struct E1000EState {
+@@ -96,6 +102,10 @@ struct E1000EState {
  #define E1000E_MSIX_TABLE   (0x0000)
  #define E1000E_MSIX_PBA     (0x2000)
  
@@ -388,7 +563,7 @@ index b69fd7d8ad..d8be50a1ce 100644
  static uint64_t
  e1000e_mmio_read(void *opaque, hwaddr addr, unsigned size)
  {
-@@ -305,6 +314,8 @@ e1000e_init_msix(E1000EState *s)
+@@ -307,6 +317,8 @@ e1000e_init_msix(E1000EState *s)
      } else {
          if (!e1000e_use_msix_vectors(s, E1000E_MSIX_VEC_NUM)) {
              msix_uninit(d, &s->msix, &s->msix);
@@ -397,7 +572,7 @@ index b69fd7d8ad..d8be50a1ce 100644
          }
      }
  }
-@@ -476,6 +487,8 @@ static void e1000e_pci_realize(PCIDevice *pci_dev, Error **errp)
+@@ -478,6 +490,8 @@ static void e1000e_pci_realize(PCIDevice *pci_dev, Error **errp)
      ret = msi_init(PCI_DEVICE(s), 0xD0, 1, true, false, NULL);
      if (ret) {
          trace_e1000e_msi_init_fail(ret);
@@ -406,7 +581,7 @@ index b69fd7d8ad..d8be50a1ce 100644
      }
  
      if (e1000e_add_pm_capability(pci_dev, e1000e_pmrb_offset,
-@@ -599,6 +612,11 @@ static const VMStateDescription e1000e_vmstate_intr_timer = {
+@@ -605,6 +619,11 @@ static const VMStateDescription e1000e_vmstate_intr_timer = {
      VMSTATE_STRUCT_ARRAY(_f, _s, _num, 0,                           \
                           e1000e_vmstate_intr_timer, E1000IntrDelayTimer)
  
@@ -418,7 +593,7 @@ index b69fd7d8ad..d8be50a1ce 100644
  static const VMStateDescription e1000e_vmstate = {
      .name = "e1000e",
      .version_id = 1,
-@@ -610,6 +628,7 @@ static const VMStateDescription e1000e_vmstate = {
+@@ -616,6 +635,7 @@ static const VMStateDescription e1000e_vmstate = {
          VMSTATE_MSIX(parent_obj, E1000EState),
  
          VMSTATE_UINT32(ioaddr, E1000EState),
@@ -426,7 +601,7 @@ index b69fd7d8ad..d8be50a1ce 100644
          VMSTATE_UINT32(core.rxbuf_min_shift, E1000EState),
          VMSTATE_UINT8(core.rx_desc_len, E1000EState),
          VMSTATE_UINT32_ARRAY(core.rxbuf_sizes, E1000EState,
-@@ -658,6 +677,8 @@ static PropertyInfo e1000e_prop_disable_vnet,
+@@ -664,6 +684,8 @@ static PropertyInfo e1000e_prop_disable_vnet,
  
  static Property e1000e_properties[] = {
      DEFINE_NIC_PROPERTIES(E1000EState, conf),
@@ -436,10 +611,10 @@ index b69fd7d8ad..d8be50a1ce 100644
                          e1000e_prop_disable_vnet, bool),
      DEFINE_PROP_SIGNED("subsys_ven", E1000EState, subsys_ven,
 diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
-index 88a97d756d..21d80e96cf 100644
+index 90b4fc63ce..3ffb9dd22c 100644
 --- a/hw/net/rtl8139.c
 +++ b/hw/net/rtl8139.c
-@@ -3177,7 +3177,7 @@ static int rtl8139_pre_save(void *opaque)
+@@ -3179,7 +3179,7 @@ static int rtl8139_pre_save(void *opaque)
  
  static const VMStateDescription vmstate_rtl8139 = {
      .name = "rtl8139",
@@ -448,7 +623,7 @@ index 88a97d756d..21d80e96cf 100644
      .minimum_version_id = 3,
      .post_load = rtl8139_post_load,
      .pre_save  = rtl8139_pre_save,
-@@ -3258,7 +3258,9 @@ static const VMStateDescription vmstate_rtl8139 = {
+@@ -3260,7 +3260,9 @@ static const VMStateDescription vmstate_rtl8139 = {
          VMSTATE_UINT32(tally_counters.TxMCol, RTL8139State),
          VMSTATE_UINT64(tally_counters.RxOkPhy, RTL8139State),
          VMSTATE_UINT64(tally_counters.RxOkBrd, RTL8139State),
@@ -459,18 +634,18 @@ index 88a97d756d..21d80e96cf 100644
          VMSTATE_UINT16(tally_counters.TxUndrn, RTL8139State),
  
 diff --git a/hw/rtc/mc146818rtc.c b/hw/rtc/mc146818rtc.c
-index 74ae74bc5c..73820517df 100644
+index 4fbafddb22..2f120c6e70 100644
 --- a/hw/rtc/mc146818rtc.c
 +++ b/hw/rtc/mc146818rtc.c
-@@ -42,6 +42,7 @@
+@@ -43,6 +43,7 @@
+ #include "qapi/qapi-events-misc-target.h"
  #include "qapi/visitor.h"
- #include "exec/address-spaces.h"
  #include "hw/rtc/mc146818rtc_regs.h"
 +#include "migration/migration.h"
  
  #ifdef TARGET_I386
  #include "qapi/qapi-commands-misc-target.h"
-@@ -820,6 +821,11 @@ static int rtc_post_load(void *opaque, int version_id)
+@@ -821,6 +822,11 @@ static int rtc_post_load(void *opaque, int version_id)
  static bool rtc_irq_reinject_on_ack_count_needed(void *opaque)
  {
      RTCState *s = (RTCState *)opaque;
@@ -483,17 +658,87 @@ index 74ae74bc5c..73820517df 100644
  }
  
 diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c
-index 11d476c4a2..e6e9355384 100644
+index 7397e56737..3a4bb894ba 100644
 --- a/hw/smbios/smbios.c
 +++ b/hw/smbios/smbios.c
-@@ -777,6 +777,7 @@ void smbios_set_defaults(const char *manufacturer, const char *product,
+@@ -57,6 +57,9 @@ static bool smbios_legacy = true;
+ static bool smbios_uuid_encoded = true;
+ /* end: legacy structures & constants for <= 2.0 machines */
+ 
++/* Set to true for modern Windows 10 HardwareID-6 compat */
++static bool smbios_type2_required;
++
+ 
+ uint8_t *smbios_tables;
+ size_t smbios_tables_len;
+@@ -619,7 +622,7 @@ static void smbios_build_type_1_table(void)
+ 
+ static void smbios_build_type_2_table(void)
+ {
+-    SMBIOS_BUILD_TABLE_PRE(2, 0x200, false); /* optional */
++    SMBIOS_BUILD_TABLE_PRE(2, 0x200, smbios_type2_required);
+ 
+     SMBIOS_TABLE_SET_STR(2, manufacturer_str, type2.manufacturer);
+     SMBIOS_TABLE_SET_STR(2, product_str, type2.product);
+@@ -888,7 +891,10 @@ void smbios_set_cpuid(uint32_t version, uint32_t features)
+ 
+ void smbios_set_defaults(const char *manufacturer, const char *product,
+                          const char *version, bool legacy_mode,
+-                         bool uuid_encoded, SmbiosEntryPointType ep_type)
++                         bool uuid_encoded,
++                         const char *stream_product,
++                         const char *stream_version,
++                         SmbiosEntryPointType ep_type)
+ {
+     smbios_have_defaults = true;
+     smbios_legacy = legacy_mode;
+@@ -909,11 +915,45 @@ void smbios_set_defaults(const char *manufacturer, const char *product,
+         g_free(smbios_entries);
+     }
+ 
++    /*
++     * If @stream_product & @stream_version are non-NULL, then
++     * we're following rules for new Windows driver support.
++     * The data we have to report is defined in this doc:
++     *
++     * https://docs.microsoft.com/en-us/windows-hardware/drivers/install/specifying-hardware-ids-for-a-computer
++     *
++     * The Windows drivers are written to expect use of the
++     * scheme documented as "HardwareID-6" against Windows 10,
++     * which uses SMBIOS System (Type 1) and Base Board (Type 2)
++     * tables and will match on
++     *
++     *   System Manufacturer = Red Hat     (@manufacturer)
++     *   System SKU Number = 8.2.0         (@stream_version)
++     *   Baseboard Manufacturer = Red Hat  (@manufacturer)
++     *   Baseboard Product = RHEL-AV       (@stream_product)
++     *
++     * NB, SKU must be changed with each RHEL-AV release
++     *
++     * Other fields can be freely used by applications using
++     * QEMU. For example apps can use the "System product"
++     * and "System version" to identify themselves.
++     *
++     * We get 'System Manufacturer' and 'Baseboard Manufacturer'
++     */
      SMBIOS_SET_DEFAULT(type1.manufacturer, manufacturer);
      SMBIOS_SET_DEFAULT(type1.product, product);
      SMBIOS_SET_DEFAULT(type1.version, version);
 +    SMBIOS_SET_DEFAULT(type1.family, "Red Hat Enterprise Linux");
++    if (stream_version != NULL) {
++        SMBIOS_SET_DEFAULT(type1.sku, stream_version);
++    }
      SMBIOS_SET_DEFAULT(type2.manufacturer, manufacturer);
-     SMBIOS_SET_DEFAULT(type2.product, product);
+-    SMBIOS_SET_DEFAULT(type2.product, product);
++    if (stream_product != NULL) {
++        SMBIOS_SET_DEFAULT(type2.product, stream_product);
++        smbios_type2_required = true;
++    } else {
++        SMBIOS_SET_DEFAULT(type2.product, product);
++    }
      SMBIOS_SET_DEFAULT(type2.version, version);
+     SMBIOS_SET_DEFAULT(type3.manufacturer, manufacturer);
+     SMBIOS_SET_DEFAULT(type3.version, version);
 diff --git a/hw/timer/i8254_common.c b/hw/timer/i8254_common.c
 index 050875b497..32935da46c 100644
 --- a/hw/timer/i8254_common.c
@@ -508,10 +753,10 @@ index 050875b497..32935da46c 100644
                               vmstate_pit_channel, PITChannelState),
          VMSTATE_INT64(channels[0].next_transition_time,
 diff --git a/hw/usb/hcd-uhci.c b/hw/usb/hcd-uhci.c
-index 23507ad3b5..9fd87a7ad9 100644
+index d1b5657d72..7930b868fa 100644
 --- a/hw/usb/hcd-uhci.c
 +++ b/hw/usb/hcd-uhci.c
-@@ -1219,12 +1219,14 @@ static void usb_uhci_common_realize(PCIDevice *dev, Error **errp)
+@@ -1166,11 +1166,13 @@ void usb_uhci_common_realize(PCIDevice *dev, Error **errp)
      UHCIState *s = UHCI(dev);
      uint8_t *pci_conf = s->dev.config;
      int i;
@@ -519,19 +764,129 @@ index 23507ad3b5..9fd87a7ad9 100644
  
      pci_conf[PCI_CLASS_PROG] = 0x00;
      /* TODO: reset value should be 0. */
-     pci_conf[USB_SBRN] = USB_RELEASE_1; // release number
- 
+     pci_conf[USB_SBRN] = USB_RELEASE_1; /* release number */
 -    pci_config_set_interrupt_pin(pci_conf, u->info.irq_pin + 1);
 +    irq_pin = u->info.irq_pin;
 +    pci_config_set_interrupt_pin(pci_conf, irq_pin + 1);
+     s->irq = pci_allocate_irq(dev);
  
      if (s->masterbus) {
-         USBPort *ports[NB_PORTS];
+diff --git a/hw/usb/hcd-xhci-pci.c b/hw/usb/hcd-xhci-pci.c
+index e934b1a5b1..e18b05e528 100644
+--- a/hw/usb/hcd-xhci-pci.c
++++ b/hw/usb/hcd-xhci-pci.c
+@@ -104,6 +104,33 @@ static int xhci_pci_vmstate_post_load(void *opaque, int version_id)
+    return 0;
+ }
+ 
++/* RH bz 1912846 */
++static bool usb_xhci_pci_add_msi(struct PCIDevice *dev, Error **errp)
++{
++    int ret;
++    Error *err = NULL;
++    XHCIPciState *s = XHCI_PCI(dev);
++
++    ret = msi_init(dev, 0x70, s->xhci.numintrs, true, false, &err);
++    /*
++     * Any error other than -ENOTSUP(board's MSI support is broken)
++     * is a programming error
++     */
++    assert(!ret || ret == -ENOTSUP);
++    if (ret && s->msi == ON_OFF_AUTO_ON) {
++        /* Can't satisfy user's explicit msi=on request, fail */
++        error_append_hint(&err, "You have to use msi=auto (default) or "
++                "msi=off with this machine type.\n");
++        error_propagate(errp, err);
++        return true;
++    }
++    assert(!err || s->msi == ON_OFF_AUTO_AUTO);
++    /* With msi=auto, we fall back to MSI off silently */
++    error_free(err);
++
++    return false;
++}
++
+ static void usb_xhci_pci_realize(struct PCIDevice *dev, Error **errp)
+ {
+     int ret;
+@@ -125,23 +152,12 @@ static void usb_xhci_pci_realize(struct PCIDevice *dev, Error **errp)
+         s->xhci.nec_quirks = true;
+     }
+ 
+-    if (s->msi != ON_OFF_AUTO_OFF) {
+-        ret = msi_init(dev, 0x70, s->xhci.numintrs, true, false, &err);
+-        /*
+-         * Any error other than -ENOTSUP(board's MSI support is broken)
+-         * is a programming error
+-         */
+-        assert(!ret || ret == -ENOTSUP);
+-        if (ret && s->msi == ON_OFF_AUTO_ON) {
+-            /* Can't satisfy user's explicit msi=on request, fail */
+-            error_append_hint(&err, "You have to use msi=auto (default) or "
+-                    "msi=off with this machine type.\n");
++    if (s->msi != ON_OFF_AUTO_OFF && s->rh_late_msi_cap) {
++        /* This gives the behaviour from 5.2.0 onwards, lspci shows 90,a0,70 */
++        if (usb_xhci_pci_add_msi(dev, &err)) {
+             error_propagate(errp, err);
+             return;
+         }
+-        assert(!err || s->msi == ON_OFF_AUTO_AUTO);
+-        /* With msi=auto, we fall back to MSI off silently */
+-        error_free(err);
+     }
+     pci_register_bar(dev, 0,
+                      PCI_BASE_ADDRESS_SPACE_MEMORY |
+@@ -154,6 +170,14 @@ static void usb_xhci_pci_realize(struct PCIDevice *dev, Error **errp)
+         assert(ret > 0);
+     }
+ 
++    /* RH bz 1912846 */
++    if (s->msi != ON_OFF_AUTO_OFF && !s->rh_late_msi_cap) {
++        /* This gives the older RH machine behaviour, lspci shows 90,70,a0 */
++        if (usb_xhci_pci_add_msi(dev, &err)) {
++            error_propagate(errp, err);
++            return;
++        }
++    }
+     if (s->msix != ON_OFF_AUTO_OFF) {
+         /* TODO check for errors, and should fail when msix=on */
+         msix_init(dev, s->xhci.numintrs,
+@@ -198,11 +222,18 @@ static void xhci_instance_init(Object *obj)
+     qdev_alias_all_properties(DEVICE(&s->xhci), obj);
+ }
+ 
++static Property xhci_pci_properties[] = {
++    /* RH bz 1912846 */
++    DEFINE_PROP_BOOL("x-rh-late-msi-cap", XHCIPciState, rh_late_msi_cap, true),
++    DEFINE_PROP_END_OF_LIST()
++};
++
+ static void xhci_class_init(ObjectClass *klass, void *data)
+ {
+     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+     DeviceClass *dc = DEVICE_CLASS(klass);
+ 
++    device_class_set_props(dc, xhci_pci_properties);
+     dc->reset   = xhci_pci_reset;
+     dc->vmsd    = &vmstate_xhci_pci;
+     set_bit(DEVICE_CATEGORY_USB, dc->categories);
+diff --git a/hw/usb/hcd-xhci-pci.h b/hw/usb/hcd-xhci-pci.h
+index c193f79443..086a1feb1e 100644
+--- a/hw/usb/hcd-xhci-pci.h
++++ b/hw/usb/hcd-xhci-pci.h
+@@ -39,6 +39,7 @@ typedef struct XHCIPciState {
+     XHCIState xhci;
+     OnOffAuto msi;
+     OnOffAuto msix;
++    bool      rh_late_msi_cap;  /* bz 1912846 */
+ } XHCIPciState;
+ 
+ #endif
 diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
-index 80988bb305..8fed2eedd6 100644
+index e01700039b..d5ea13356c 100644
 --- a/hw/usb/hcd-xhci.c
 +++ b/hw/usb/hcd-xhci.c
-@@ -3590,9 +3590,27 @@ static const VMStateDescription vmstate_xhci_slot = {
+@@ -3494,9 +3494,27 @@ static const VMStateDescription vmstate_xhci_slot = {
      }
  };
  
@@ -559,7 +914,7 @@ index 80988bb305..8fed2eedd6 100644
      .fields = (VMStateField[]) {
          VMSTATE_UINT32(type,   XHCIEvent),
          VMSTATE_UINT32(ccode,  XHCIEvent),
-@@ -3601,6 +3619,8 @@ static const VMStateDescription vmstate_xhci_event = {
+@@ -3505,6 +3523,8 @@ static const VMStateDescription vmstate_xhci_event = {
          VMSTATE_UINT32(flags,  XHCIEvent),
          VMSTATE_UINT8(slotid,  XHCIEvent),
          VMSTATE_UINT8(epid,    XHCIEvent),
@@ -569,10 +924,10 @@ index 80988bb305..8fed2eedd6 100644
      }
  };
 diff --git a/hw/usb/hcd-xhci.h b/hw/usb/hcd-xhci.h
-index 2fad4df2a7..f554b671e3 100644
+index 98f598382a..50a7b6f6c4 100644
 --- a/hw/usb/hcd-xhci.h
 +++ b/hw/usb/hcd-xhci.h
-@@ -157,6 +157,8 @@ typedef struct XHCIEvent {
+@@ -149,6 +149,8 @@ typedef struct XHCIEvent {
      uint32_t flags;
      uint8_t slotid;
      uint8_t epid;
@@ -582,11 +937,11 @@ index 2fad4df2a7..f554b671e3 100644
  
  typedef struct XHCIInterrupter {
 diff --git a/include/hw/acpi/ich9.h b/include/hw/acpi/ich9.h
-index 41568d1837..1a23ccc412 100644
+index 7ca92843c6..21abfd8447 100644
 --- a/include/hw/acpi/ich9.h
 +++ b/include/hw/acpi/ich9.h
-@@ -61,6 +61,9 @@ typedef struct ICH9LPCPMRegs {
-     uint8_t smm_enabled;
+@@ -68,6 +68,9 @@ typedef struct ICH9LPCPMRegs {
+     bool smm_compat;
      bool enable_tco;
      TCOIORegs tco_regs;
 +
@@ -596,13 +951,25 @@ index 41568d1837..1a23ccc412 100644
  
  #define ACPI_PM_PROP_TCO_ENABLED "enable_tco"
 diff --git a/include/hw/boards.h b/include/hw/boards.h
-index de45087f34..6f85a0e032 100644
+index 9c1c190104..8bba96ef2b 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
-@@ -377,4 +377,28 @@ extern const size_t hw_compat_2_2_len;
+@@ -441,4 +441,40 @@ extern const size_t hw_compat_2_2_len;
  extern GlobalProperty hw_compat_2_1[];
  extern const size_t hw_compat_2_1_len;
  
++extern GlobalProperty hw_compat_rhel_8_5[];
++extern const size_t hw_compat_rhel_8_5_len;
++
++extern GlobalProperty hw_compat_rhel_8_4[];
++extern const size_t hw_compat_rhel_8_4_len;
++
++extern GlobalProperty hw_compat_rhel_8_3[];
++extern const size_t hw_compat_rhel_8_3_len;
++
++extern GlobalProperty hw_compat_rhel_8_2[];
++extern const size_t hw_compat_rhel_8_2_len;
++
 +extern GlobalProperty hw_compat_rhel_8_1[];
 +extern const size_t hw_compat_rhel_8_1_len;
 +
@@ -628,26 +995,55 @@ index de45087f34..6f85a0e032 100644
 +extern const size_t hw_compat_rhel_7_1_len;
 +
  #endif
+diff --git a/include/hw/firmware/smbios.h b/include/hw/firmware/smbios.h
+index 5a0dd0c8cf..2cb1ec2bab 100644
+--- a/include/hw/firmware/smbios.h
++++ b/include/hw/firmware/smbios.h
+@@ -278,7 +278,10 @@ void smbios_entry_add(QemuOpts *opts, Error **errp);
+ void smbios_set_cpuid(uint32_t version, uint32_t features);
+ void smbios_set_defaults(const char *manufacturer, const char *product,
+                          const char *version, bool legacy_mode,
+-                         bool uuid_encoded, SmbiosEntryPointType ep_type);
++                         bool uuid_encoded,
++                         const char *stream_product,
++                         const char *stream_version,
++                         SmbiosEntryPointType ep_type);
+ uint8_t *smbios_get_table_legacy(MachineState *ms, size_t *length);
+ void smbios_get_tables(MachineState *ms,
+                        const struct smbios_phys_mem_area *mem_array,
+diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
+index 9ab39e428f..7ccc9a1a07 100644
+--- a/include/hw/i386/pc.h
++++ b/include/hw/i386/pc.h
+@@ -107,6 +107,9 @@ struct PCMachineClass {
+     bool smbios_defaults;
+     bool smbios_legacy_mode;
+     bool smbios_uuid_encoded;
++    /* New fields needed for Windows HardwareID-6 matching */
++    const char *smbios_stream_product;
++    const char *smbios_stream_version;
+ 
+     /* RAM / address space compat: */
+     bool gigabyte_align;
 diff --git a/include/hw/usb.h b/include/hw/usb.h
-index c24d968a19..b353438ea0 100644
+index 33668dd0a9..e6b2fe72da 100644
 --- a/include/hw/usb.h
 +++ b/include/hw/usb.h
-@@ -605,4 +605,8 @@ int usb_get_quirks(uint16_t vendor_id, uint16_t product_id,
-                    uint8_t interface_class, uint8_t interface_subclass,
-                    uint8_t interface_protocol);
+@@ -582,4 +582,7 @@ void usb_pcap_init(FILE *fp);
+ void usb_pcap_ctrl(USBPacket *p, bool setup);
+ void usb_pcap_data(USBPacket *p, bool setup);
  
-+
 +/* hcd-xhci.c -- rhel7.0.0 machine type compatibility */
 +extern bool migrate_cve_2014_5263_xhci_fields;
 +
  #endif
 diff --git a/migration/migration.c b/migration/migration.c
-index 354ad072fa..30c53c623b 100644
+index abaf6f9e3d..a87ff01b81 100644
 --- a/migration/migration.c
 +++ b/migration/migration.c
-@@ -121,6 +121,8 @@ enum mig_rp_message_type {
-     MIG_RP_MSG_MAX
- };
+@@ -164,6 +164,8 @@ INITIALIZE_MIGRATE_CAPS_SET(check_caps_background_snapshot,
+     MIGRATION_CAPABILITY_X_COLO,
+     MIGRATION_CAPABILITY_VALIDATE_UUID);
  
 +bool migrate_pre_2_2;
 +
@@ -655,10 +1051,10 @@ index 354ad072fa..30c53c623b 100644
     migrations at once.  For now we don't need to add
     dynamic creation of migration */
 diff --git a/migration/migration.h b/migration/migration.h
-index 79b3dda146..0b1b0d4df5 100644
+index 8130b703eb..d016cedd9d 100644
 --- a/migration/migration.h
 +++ b/migration/migration.h
-@@ -335,6 +335,11 @@ void init_dirty_bitmap_incoming_migration(void);
+@@ -381,6 +381,11 @@ bool check_dirty_bitmap_mig_alias_map(const BitmapMigrationNodeAliasList *bbm,
  void migrate_add_address(SocketAddress *address);
  
  int foreach_not_ignored_block(RAMBlockIterFunc func, void *opaque);
@@ -671,5 +1067,5 @@ index 79b3dda146..0b1b0d4df5 100644
  #define qemu_ram_foreach_block \
    #warning "Use foreach_not_ignored_block in migration code"
 -- 
-2.21.0
+2.27.0
 

SOURCES/0008-Add-aarch64-machine-types.patch

@@ -1,4 +1,4 @@
-From 49164264d9928f73961acbbe4d56d8dfa23d8099 Mon Sep 17 00:00:00 2001
+From 670e90f5cbd92189155e079b8c6e2aafdf82d162 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 12:53:31 +0200
 Subject: Add aarch64 machine types
@@ -7,14 +7,14 @@ Adding changes to add RHEL machine types for aarch64 architecture.
 
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 
-Rebase changes (4.0.0):
+Rebase notes (4.0.0):
 - Use upstream compat handling
 
-Rebase changes (4.1.0-rc0):
+Rebase notes (4.1.0-rc0):
 - Removed a15memmap (upstream)
 - Use virt_flash_create in rhel800_virt_instance_init
 
-Rebase changes (4.2.0-rc0):
+Rebase notes (4.2.0-rc0):
 - Set numa_mem_supported
 
 Rebase notes (4.2.0-rc3):
@@ -23,6 +23,30 @@ Rebase notes (4.2.0-rc3):
 - aarch64: virt: Allow PCDIMM instantiation (patch 92247)
 - aarch64: virt: Enhance the comment related to gic-version (patch 92248)
 
+Rebase notes (5.0.0):
+- Set default_ram_id in rhel_machine_class_init
+- Added setting acpi properties
+
+Rebase notes (5.1.0):
+- Added ras property
+- Added to virt_machine_device_unplug_cb to machine type (upstream)
+- added mte property (upstream)
+
+Rebase notes (weekly-210210):
+- Added support for oem fields to machine type
+
+Rebase notes (weekly-210303):
+- Use rhel-8.4.0 hw compat
+
+Rebase notes (6.0.0-rc2):
+- renamed oem-id and oem-table-id to x-oem-id and x-oem-table-id
+
+Rebase notes (210623):
+- Protect TPM functions by CONFIG_TPM ifdef
+
+Rebase notes (6.1.0-rc0):
+- Add support for default_bus_bypass_iommu
+
 Merged patches (4.0.0):
 - 7bfdb4c aarch64: Add virt-rhel8.0.0 machine type for ARM
 - 3433e69 aarch64: Set virt-rhel8.0.0 max_cpus to 512
@@ -32,25 +56,45 @@ Merged patches (4.1.0):
 - c3e39ef aarch64: Add virt-rhel8.1.0 machine type for ARM
 - 59a46d1 aarch64: Allow ARM VIRT iommu option in RHEL8.1 machine
 
-Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
+Merged patches (5.2.0 rc0):
+- 12990ad hw/arm: Changes to rhel820 machine
+- 46d5a79 hw/arm: Introduce rhel_virt_instance_init() helper
+- 098954a hw/arm: Add rhel830 machine type
+- ee8e99d arm: Set correct max_cpus value on virt-rhel* machine types
+- e5edd38 RHEL-only: arm/virt: Allow the TPM_TIS_SYSBUS device dynamic allocation in machvirt
+- 6d7ba66 machine types/numa: set numa_mem_supported on old machine types (partialy)
+- 25c5644 machine_types/numa: compatibility for auto_enable_numa_with_memdev (partialy)
+
+Merged patches (6.0):
+- 078fadb5da AArch64 machine types cleanup
+- ea7b7425fa hw/arm/virt: Add 8.4 Machine type
+
+Merged patches (weekly-210609):
+- 73b1578882 hw/arm/virt: Add 8.5 machine type
+- 5333038d11 hw/arm/virt: Disable PL011 clock migration through hw_compat_rhel_8_3
+- 63adb8ae86 arm/virt: Register highmem and gic-version as class properties
+
+Merged patches (weekly-211027):
+- 86e3057c0a hw: arm: virt: Add hw_compat_rhel_8_5 to 8.5 machine type
 ---
- hw/arm/virt.c         | 161 +++++++++++++++++++++++++++++++++++++++++-
- include/hw/arm/virt.h |  11 +++
- 2 files changed, 171 insertions(+), 1 deletion(-)
+ hw/arm/virt.c         | 226 +++++++++++++++++++++++++++++++++++++++++-
+ hw/core/machine.c     |   2 +
+ include/hw/arm/virt.h |   8 ++
+ 3 files changed, 235 insertions(+), 1 deletion(-)
 
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index d4bedc2607..e10839100e 100644
+index 5de4d9d73b..c77d26ab13 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
-@@ -72,6 +72,7 @@
- #include "hw/mem/nvdimm.h"
- #include "hw/acpi/generic_event_device.h"
+@@ -79,6 +79,7 @@
+ #include "hw/char/pl011.h"
+ #include "qemu/guest-random.h"
  
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
  #define DEFINE_VIRT_MACHINE_LATEST(major, minor, latest) \
      static void virt_##major##_##minor##_class_init(ObjectClass *oc, \
                                                      void *data) \
-@@ -98,7 +99,49 @@
+@@ -105,7 +106,48 @@
      DEFINE_VIRT_MACHINE_LATEST(major, minor, true)
  #define DEFINE_VIRT_MACHINE(major, minor) \
      DEFINE_VIRT_MACHINE_LATEST(major, minor, false)
@@ -72,7 +116,6 @@ index d4bedc2607..e10839100e 100644
 +    static const TypeInfo rhel##m##n##s##_machvirt_info = {             \
 +        .name = MACHINE_TYPE_NAME("virt-rhel" # m "." # n "." # s),     \
 +        .parent = TYPE_RHEL_MACHINE,                                    \
-+        .instance_init = rhel##m##n##s##_virt_instance_init,            \
 +        .class_init = rhel##m##n##s##_virt_class_init,                  \
 +    };                                                                  \
 +    static void rhel##m##n##s##_machvirt_init(void)                     \
@@ -101,7 +144,7 @@ index d4bedc2607..e10839100e 100644
  
  /* Number of external interrupt lines to configure the GIC with */
  #define NUM_IRQS 256
-@@ -1763,6 +1806,7 @@ static void machvirt_init(MachineState *machine)
+@@ -2180,6 +2222,7 @@ static void machvirt_init(MachineState *machine)
      qemu_add_machine_init_done_notifier(&vms->machine_done);
  }
  
@@ -109,23 +152,39 @@ index d4bedc2607..e10839100e 100644
  static bool virt_get_secure(Object *obj, Error **errp)
  {
      VirtMachineState *vms = VIRT_MACHINE(obj);
-@@ -1791,6 +1835,7 @@ static void virt_set_virt(Object *obj, bool value, Error **errp)
+@@ -2207,6 +2250,7 @@ static void virt_set_virt(Object *obj, bool value, Error **errp)
+ 
      vms->virt = value;
  }
- 
 +#endif /* disabled for RHEL */
+ 
  static bool virt_get_highmem(Object *obj, Error **errp)
+ {
+@@ -2304,6 +2348,7 @@ static void virt_set_acpi(Object *obj, Visitor *v, const char *name,
+     visit_type_OnOffAuto(v, name, &vms->acpi, errp);
+ }
+ 
++#if 0 /* Disabled for Red Hat Enterprise Linux */
+ static bool virt_get_ras(Object *obj, Error **errp)
  {
      VirtMachineState *vms = VIRT_MACHINE(obj);
-@@ -2022,6 +2067,7 @@ static int virt_kvm_type(MachineState *ms, const char *type_str)
-     return requested_pa_size > 40 ? requested_pa_size : 0;
+@@ -2331,6 +2376,7 @@ static void virt_set_mte(Object *obj, bool value, Error **errp)
+ 
+     vms->mte = value;
+ }
++#endif /* disabled for RHEL */
+ 
+ static char *virt_get_gic_version(Object *obj, Error **errp)
+ {
+@@ -2666,6 +2712,7 @@ static int virt_kvm_type(MachineState *ms, const char *type_str)
+     return fixed_ipa ? 0 : requested_pa_size;
  }
  
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
  static void virt_machine_class_init(ObjectClass *oc, void *data)
  {
      MachineClass *mc = MACHINE_CLASS(oc);
-@@ -2258,3 +2304,116 @@ static void virt_machine_2_6_options(MachineClass *mc)
+@@ -3031,3 +3078,180 @@ static void virt_machine_2_6_options(MachineClass *mc)
      vmc->no_pmu = true;
  }
  DEFINE_VIRT_MACHINE(2, 6)
@@ -138,11 +197,11 @@ index d4bedc2607..e10839100e 100644
 +
 +    mc->family = "virt-rhel-Z";
 +    mc->init = machvirt_init;
-+    /* Start with max_cpus set to 512, which is the maximum supported by KVM.
-+     * The value may be reduced later when we have more information about the
-+     * configuration of the particular instance.
-+     */
-+    mc->max_cpus = 512;
++    /* Maximum supported VCPU count for all virt-rhel* machines */
++    mc->max_cpus = 384;
++#ifdef CONFIG_TPM
++    machine_class_allow_dynamic_sysbus_dev(mc, TYPE_TPM_TIS_SYSBUS);
++#endif
 +    mc->block_default_type = IF_VIRTIO;
 +    mc->no_cdrom = 1;
 +    mc->pci_allow_0_address = true;
@@ -158,8 +217,100 @@ index d4bedc2607..e10839100e 100644
 +    hc->pre_plug = virt_machine_device_pre_plug_cb;
 +    hc->plug = virt_machine_device_plug_cb;
 +    hc->unplug_request = virt_machine_device_unplug_request_cb;
-+    mc->numa_mem_supported = true;
++    hc->unplug = virt_machine_device_unplug_cb;
++    mc->nvdimm_supported = true;
 +    mc->auto_enable_numa_with_memhp = true;
++    mc->auto_enable_numa_with_memdev = true;
++    mc->default_ram_id = "mach-virt.ram";
++
++    object_class_property_add(oc, "acpi", "OnOffAuto",
++        virt_get_acpi, virt_set_acpi,
++        NULL, NULL);
++    object_class_property_set_description(oc, "acpi",
++        "Enable ACPI");
++
++    object_class_property_add_bool(oc, "highmem", virt_get_highmem,
++                                   virt_set_highmem);
++    object_class_property_set_description(oc, "highmem",
++                                          "Set on/off to enable/disable using "
++                                          "physical address space above 32 bits");
++
++    object_class_property_add_str(oc, "gic-version", virt_get_gic_version,
++                                  virt_set_gic_version);
++    object_class_property_set_description(oc, "gic-version",
++                                          "Set GIC version. "
++                                          "Valid values are 2, 3, host and max");
++
++    object_class_property_add_str(oc, "x-oem-id",
++                                  virt_get_oem_id,
++                                  virt_set_oem_id);
++    object_class_property_set_description(oc, "x-oem-id",
++                                          "Override the default value of field OEMID "
++                                          "in ACPI table header."
++                                          "The string may be up to 6 bytes in size");
++
++    object_class_property_add_str(oc, "x-oem-table-id",
++                                  virt_get_oem_table_id,
++                                  virt_set_oem_table_id);
++    object_class_property_set_description(oc, "x-oem-table-id",
++                                          "Override the default value of field OEM Table ID "
++                                          "in ACPI table header."
++                                          "The string may be up to 8 bytes in size");
++    object_class_property_add_bool(oc, "default_bus_bypass_iommu",
++                                   virt_get_default_bus_bypass_iommu,
++                                   virt_set_default_bus_bypass_iommu);
++
++}
++
++static void rhel_virt_instance_init(Object *obj)
++{
++    VirtMachineState *vms = VIRT_MACHINE(obj);
++    VirtMachineClass *vmc = VIRT_MACHINE_GET_CLASS(vms);
++
++    /* EL3 is disabled by default and non-configurable for RHEL */
++    vms->secure = false;
++
++    /* EL2 is disabled by default and non-configurable for RHEL */
++    vms->virt = false;
++
++    /* High memory is enabled by default */
++    vms->highmem = true;
++    vms->gic_version = VIRT_GIC_VERSION_NOSEL;
++
++    vms->highmem_ecam = !vmc->no_highmem_ecam;
++
++    if (vmc->no_its) {
++        vms->its = false;
++    } else {
++        /* Default allows ITS instantiation */
++        vms->its = true;
++        object_property_add_bool(obj, "its", virt_get_its,
++                                 virt_set_its);
++        object_property_set_description(obj, "its",
++                                        "Set on/off to enable/disable "
++                                        "ITS instantiation");
++    }
++
++    /* Default disallows iommu instantiation */
++    vms->iommu = VIRT_IOMMU_NONE;
++    object_property_add_str(obj, "iommu", virt_get_iommu, virt_set_iommu);
++    object_property_set_description(obj, "iommu",
++                                    "Set the IOMMU type. "
++                                    "Valid values are none and smmuv3");
++
++    /* Default disallows RAS instantiation and is non-configurable for RHEL */
++    vms->ras = false;
++
++    /* MTE is disabled by default and non-configurable for RHEL */
++    vms->mte = false;
++
++    vms->default_bus_bypass_iommu = false;
++    vms->irqmap = a15irqmap;
++
++    virt_flash_create(vms);
++    vms->oem_id = g_strndup(ACPI_BUILD_APPNAME6, 6);
++    vms->oem_table_id = g_strndup(ACPI_BUILD_APPNAME8, 8);
++
 +}
 +
 +static const TypeInfo rhel_machine_info = {
@@ -169,6 +320,7 @@ index d4bedc2607..e10839100e 100644
 +    .instance_size = sizeof(VirtMachineState),
 +    .class_size    = sizeof(VirtMachineClass),
 +    .class_init    = rhel_machine_class_init,
++    .instance_init = rhel_virt_instance_init,
 +    .interfaces = (InterfaceInfo[]) {
 +         { TYPE_HOTPLUG_HANDLER },
 +         { }
@@ -181,96 +333,73 @@ index d4bedc2607..e10839100e 100644
 +}
 +type_init(rhel_machine_init);
 +
-+static void rhel820_virt_instance_init(Object *obj)
++static void rhel850_virt_options(MachineClass *mc)
 +{
-+    VirtMachineState *vms = VIRT_MACHINE(obj);
-+    VirtMachineClass *vmc = VIRT_MACHINE_GET_CLASS(vms);
-+
-+    /* EL3 is disabled by default and non-configurable for RHEL */
-+    vms->secure = false;
-+    /* EL2 is disabled by default and non-configurable for RHEL */
-+    vms->virt = false;
-+    /* High memory is enabled by default for RHEL */
-+    vms->highmem = true;
-+    object_property_add_bool(obj, "highmem", virt_get_highmem,
-+                             virt_set_highmem, NULL);
-+    object_property_set_description(obj, "highmem",
-+                                    "Set on/off to enable/disable using "
-+                                    "physical address space above 32 bits",
-+                                    NULL);
-+    /*
-+     * Default GIC type is still v2, but became configurable for RHEL. We
-+     * keep v2 instead of max as TCG CI test cases require an MSI controller
-+     * and there is no userspace ITS MSI emulation available.
-+     */
-+    vms->gic_version = 2;
-+    object_property_add_str(obj, "gic-version", virt_get_gic_version,
-+                        virt_set_gic_version, NULL);
-+    object_property_set_description(obj, "gic-version",
-+                                    "Set GIC version. "
-+                                    "Valid values are 2, 3 and host", NULL);
-+
-+    vms->highmem_ecam = !vmc->no_highmem_ecam;
-+
-+    if (vmc->no_its) {
-+        vms->its = false;
-+    } else {
-+        /* Default allows ITS instantiation */
-+        vms->its = true;
-+        object_property_add_bool(obj, "its", virt_get_its,
-+                                 virt_set_its, NULL);
-+        object_property_set_description(obj, "its",
-+                                        "Set on/off to enable/disable "
-+                                        "ITS instantiation",
-+                                        NULL);
-+    }
-+
-+    /* Default disallows iommu instantiation */
-+    vms->iommu = VIRT_IOMMU_NONE;
-+    object_property_add_str(obj, "iommu", virt_get_iommu, virt_set_iommu, NULL);
-+    object_property_set_description(obj, "iommu",
-+                                    "Set the IOMMU type. "
-+                                    "Valid values are none and smmuv3",
-+                                    NULL);
-+
-+    vms->irqmap=a15irqmap;
-+    virt_flash_create(vms);
++    compat_props_add(mc->compat_props, arm_rhel_compat, arm_rhel_compat_len);
++    compat_props_add(mc->compat_props, hw_compat_rhel_8_5, hw_compat_rhel_8_5_len);
 +}
++DEFINE_RHEL_MACHINE_AS_LATEST(8, 5, 0)
++
++static void rhel840_virt_options(MachineClass *mc)
++{
++    rhel850_virt_options(mc);
++    compat_props_add(mc->compat_props, hw_compat_rhel_8_4, hw_compat_rhel_8_4_len);
++}
++DEFINE_RHEL_MACHINE(8, 4, 0)
++
++static void rhel830_virt_options(MachineClass *mc)
++{
++    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
++
++    rhel840_virt_options(mc);
++    compat_props_add(mc->compat_props, hw_compat_rhel_8_3, hw_compat_rhel_8_3_len);
++    vmc->no_kvm_steal_time = true;
++}
++DEFINE_RHEL_MACHINE(8, 3, 0)
 +
 +static void rhel820_virt_options(MachineClass *mc)
 +{
-+    compat_props_add(mc->compat_props, arm_rhel_compat, arm_rhel_compat_len);
++    rhel830_virt_options(mc);
++    compat_props_add(mc->compat_props, hw_compat_rhel_8_2, hw_compat_rhel_8_2_len);
++    mc->numa_mem_supported = true;
++    mc->auto_enable_numa_with_memdev = false;
 +}
-+DEFINE_RHEL_MACHINE_AS_LATEST(8, 2, 0)
++DEFINE_RHEL_MACHINE(8, 2, 0)
+diff --git a/hw/core/machine.c b/hw/core/machine.c
+index be4f9864cd..62febde5aa 100644
+--- a/hw/core/machine.c
++++ b/hw/core/machine.c
+@@ -87,6 +87,8 @@ GlobalProperty hw_compat_rhel_8_3[] = {
+     { "nvme", "use-intel-id", "on"},
+     /* hw_compat_rhel_8_3 from hw_compat_5_1 */
+     { "pvpanic", "events", "1"}, /* PVPANIC_PANICKED */
++    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
++    { "pl011", "migrate-clk", "off" },
+     /* hw_compat_rhel_8_3 bz 1912846 */
+     { "pci-xhci", "x-rh-late-msi-cap", "off" },
+     /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
-index 0b41083e9d..53fdf16563 100644
+index dc6b66ffc8..9364628847 100644
 --- a/include/hw/arm/virt.h
 +++ b/include/hw/arm/virt.h
-@@ -142,6 +142,7 @@ typedef struct {
+@@ -175,9 +175,17 @@ struct VirtMachineState {
  
  #define VIRT_ECAM_ID(high) (high ? VIRT_HIGH_PCIE_ECAM : VIRT_PCIE_ECAM)
  
 +#if 0 /* disabled for Red Hat Enterprise Linux */
  #define TYPE_VIRT_MACHINE   MACHINE_TYPE_NAME("virt")
- #define VIRT_MACHINE(obj) \
-     OBJECT_CHECK(VirtMachineState, (obj), TYPE_VIRT_MACHINE)
-@@ -150,6 +151,16 @@ typedef struct {
- #define VIRT_MACHINE_CLASS(klass) \
-     OBJECT_CLASS_CHECK(VirtMachineClass, klass, TYPE_VIRT_MACHINE)
+ OBJECT_DECLARE_TYPE(VirtMachineState, VirtMachineClass, VIRT_MACHINE)
  
 +#else
 +#define TYPE_RHEL_MACHINE MACHINE_TYPE_NAME("virt-rhel")
-+#define VIRT_MACHINE(obj) \
-+    OBJECT_CHECK(VirtMachineState, (obj), TYPE_RHEL_MACHINE)
-+#define VIRT_MACHINE_GET_CLASS(obj) \
-+    OBJECT_GET_CLASS(VirtMachineClass, obj, TYPE_RHEL_MACHINE)
-+#define VIRT_MACHINE_CLASS(klass) \
-+    OBJECT_CLASS_CHECK(VirtMachineClass, klass, TYPE_RHEL_MACHINE)
++typedef struct VirtMachineClass VirtMachineClass;
++typedef struct VirtMachineState VirtMachineState;
++DECLARE_OBJ_CHECKERS(VirtMachineState, VirtMachineClass, VIRT_MACHINE, TYPE_RHEL_MACHINE)
 +#endif
 +
  void virt_acpi_setup(VirtMachineState *vms);
+ bool virt_is_acpi_enabled(VirtMachineState *vms);
  
- /* Return the number of used redistributor regions  */
 -- 
-2.21.0
+2.27.0
 

SOURCES/0009-Add-ppc64-machine-types.patch

@@ -1,4 +1,4 @@
-From 136eae41007e2e5b0d693cc656f3ec36cbabf16f Mon Sep 17 00:00:00 2001
+From 3c65320ce5b8ad3bb8c0d8fd13a88c464d5c5845 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 13:27:13 +0200
 Subject: Add ppc64 machine types
@@ -18,6 +18,9 @@ Rebase changes (4.0.0):
 Rebase changes (4.1.0):
 - Update format for compat structures
 
+Rebase notes (weekly-210303):
+- Use rhel-8.4.0 hw compat
+
 Merged patches (4.0.0):
 - 467d59a redhat: define pseries-rhel8.0.0 machine type
 
@@ -31,36 +34,99 @@ Merged patches (4.2.0):
 - redhat: update pseries-rhel-7.6.0 machine type (patch 93039)
 - redhat: define pseries-rhel8.2.0 machine type (patch 93041)
 
-Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
+Merged patches (5.1.0):
+- eb121ff spapr: Enable DD2.3 accelerated count cache flush in pseries-5.0 machine (partial)
+
+Merged patches (5.2.0 rc0):
+- 311a20f redhat: define pseries-rhel8.3.0 machine type
+- 1284167 ppc: Set correct max_cpus value on spapr-rhel* machine types
+- 1ab8783 redhat: update pseries-rhel8.2.0 machine type
+- b162af531a target/ppc: Add experimental option for enabling secure guests
+
+Merged patches (weekly-201216):
+- 943c936df3 redhat: Add spapr_machine_rhel_default_class_options()
+- 030b5e6fba redhat: Define pseries-rhel8.4.0 machine type
+
+Merged patches (weekly-210602):
+- b7128d8ef7 redhat: Define pseries-rhel8.5.0 machine type
+
+Merged patches (weekly-211006):
+- c8f68b47e9 redhat: Update pseries-rhel8.5.0
 ---
- hw/ppc/spapr.c          | 278 ++++++++++++++++++++++++++++++++++++++++
+ hw/ppc/spapr.c          | 382 ++++++++++++++++++++++++++++++++++++++++
  hw/ppc/spapr_cpu_core.c |  13 ++
- include/hw/ppc/spapr.h  |   1 +
+ include/hw/ppc/spapr.h  |   4 +
  target/ppc/compat.c     |  13 +-
  target/ppc/cpu.h        |   1 +
- 5 files changed, 305 insertions(+), 1 deletion(-)
+ target/ppc/kvm.c        |  27 +++
+ target/ppc/kvm_ppc.h    |  13 ++
+ 7 files changed, 452 insertions(+), 1 deletion(-)
 
 diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
-index e076f6023c..8749c72066 100644
+index 3b5fd749be..cace86028d 100644
 --- a/hw/ppc/spapr.c
 +++ b/hw/ppc/spapr.c
-@@ -4447,6 +4447,7 @@ static void spapr_machine_class_init(ObjectClass *oc, void *data)
-     smc->linux_pci_probe = true;
-     smc->smp_threads_vsmt = true;
-     smc->nr_xirqs = SPAPR_NR_XIRQS;
+@@ -1593,6 +1593,9 @@ static void spapr_machine_reset(MachineState *machine)
+ 
+     pef_kvm_reset(machine->cgs, &error_fatal);
+     spapr_caps_apply(spapr);
++    if (spapr->svm_allowed) {
++        kvmppc_svm_allow(&error_fatal);
++    }
+ 
+     first_ppc_cpu = POWERPC_CPU(first_cpu);
+     if (kvm_enabled() && kvmppc_has_cap_mmu_radix() &&
+@@ -3288,6 +3291,20 @@ static void spapr_set_host_serial(Object *obj, const char *value, Error **errp)
+     spapr->host_serial = g_strdup(value);
+ }
+ 
++static bool spapr_get_svm_allowed(Object *obj, Error **errp)
++{
++    SpaprMachineState *spapr = SPAPR_MACHINE(obj);
++
++    return spapr->svm_allowed;
++}
++
++static void spapr_set_svm_allowed(Object *obj, bool value, Error **errp)
++{
++    SpaprMachineState *spapr = SPAPR_MACHINE(obj);
++
++    spapr->svm_allowed = value;
++}
++
+ static void spapr_instance_init(Object *obj)
+ {
+     SpaprMachineState *spapr = SPAPR_MACHINE(obj);
+@@ -3366,6 +3383,12 @@ static void spapr_instance_init(Object *obj)
+         spapr_get_host_serial, spapr_set_host_serial);
+     object_property_set_description(obj, "host-serial",
+         "Host serial number to advertise in guest device tree");
++    object_property_add_bool(obj, "x-svm-allowed",
++                            spapr_get_svm_allowed,
++                            spapr_set_svm_allowed);
++    object_property_set_description(obj, "x-svm-allowed",
++                                    "Allow the guest to become a Secure Guest"
++                                    " (experimental only)");
+ }
+ 
+ static void spapr_machine_finalizefn(Object *obj)
+@@ -4614,6 +4637,7 @@ static void spapr_machine_class_init(ObjectClass *oc, void *data)
+     vmc->client_architecture_support = spapr_vof_client_architecture_support;
+     vmc->quiesce = spapr_vof_quiesce;
+     vmc->setprop = spapr_vof_setprop;
 +    smc->has_power9_support = true;
  }
  
  static const TypeInfo spapr_machine_info = {
-@@ -4491,6 +4492,7 @@ static const TypeInfo spapr_machine_info = {
+@@ -4665,6 +4689,7 @@ static void spapr_machine_latest_class_options(MachineClass *mc)
      }                                                                \
      type_init(spapr_machine_register_##suffix)
  
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
  /*
-  * pseries-4.2
+  * pseries-6.2
   */
-@@ -4520,6 +4522,7 @@ static void spapr_machine_4_1_class_options(MachineClass *mc)
+@@ -4781,6 +4806,7 @@ static void spapr_machine_4_1_class_options(MachineClass *mc)
  }
  
  DEFINE_SPAPR_MACHINE(4_1, "4.1", false);
@@ -68,46 +134,126 @@ index e076f6023c..8749c72066 100644
  
  /*
   * pseries-4.0
-@@ -4536,6 +4539,7 @@ static void phb_placement_4_0(SpaprMachineState *spapr, uint32_t index,
+@@ -4800,6 +4826,8 @@ static bool phb_placement_4_0(SpaprMachineState *spapr, uint32_t index,
      *nv2atsd = 0;
+     return true;
  }
- 
++
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
  static void spapr_machine_4_0_class_options(MachineClass *mc)
  {
      SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
-@@ -4695,6 +4699,7 @@ DEFINE_SPAPR_MACHINE(2_8, "2.8", false);
+@@ -4958,6 +4986,7 @@ DEFINE_SPAPR_MACHINE(2_8, "2.8", false);
  /*
   * pseries-2.7
   */
 +#endif
  
- static void phb_placement_2_7(SpaprMachineState *spapr, uint32_t index,
+ static bool phb_placement_2_7(SpaprMachineState *spapr, uint32_t index,
                                uint64_t *buid, hwaddr *pio,
-@@ -4749,6 +4754,7 @@ static void phb_placement_2_7(SpaprMachineState *spapr, uint32_t index,
-     *nv2atsd = 0;
+@@ -5013,6 +5042,7 @@ static bool phb_placement_2_7(SpaprMachineState *spapr, uint32_t index,
+     return true;
  }
  
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
  static void spapr_machine_2_7_class_options(MachineClass *mc)
  {
      SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
-@@ -4863,6 +4869,278 @@ static void spapr_machine_2_1_class_options(MachineClass *mc)
+@@ -5127,6 +5157,358 @@ static void spapr_machine_2_1_class_options(MachineClass *mc)
      compat_props_add(mc->compat_props, hw_compat_2_1, hw_compat_2_1_len);
  }
  DEFINE_SPAPR_MACHINE(2_1, "2.1", false);
 +#endif
 +
++static void spapr_machine_rhel_default_class_options(MachineClass *mc)
++{
++    /*
++     * Defaults for the latest behaviour inherited from the base class
++     * can be overriden here for all pseries-rhel* machines.
++     */
++
++    /* Maximum supported VCPU count */
++    mc->max_cpus = 384;
++}
++
++/*
++ * pseries-rhel8.5.0
++ * like pseries-6.0
++ */
++
++static void spapr_machine_rhel850_class_options(MachineClass *mc)
++{
++    /* The default machine type must apply the RHEL specific defaults */
++    spapr_machine_rhel_default_class_options(mc);
++    compat_props_add(mc->compat_props, hw_compat_rhel_8_5,
++                     hw_compat_rhel_8_5_len);
++}
++
++DEFINE_SPAPR_MACHINE(rhel850, "rhel8.5.0", true);
++
++/*
++ * pseries-rhel8.4.0
++ * like pseries-5.2
++ */
++
++static void spapr_machine_rhel840_class_options(MachineClass *mc)
++{
++    spapr_machine_rhel850_class_options(mc);
++    compat_props_add(mc->compat_props, hw_compat_rhel_8_4,
++                     hw_compat_rhel_8_4_len);
++}
++
++DEFINE_SPAPR_MACHINE(rhel840, "rhel8.4.0", false);
++
++/*
++ * pseries-rhel8.3.0
++ * like pseries-5.1
++ */
++
++static void spapr_machine_rhel830_class_options(MachineClass *mc)
++{
++    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
++
++    spapr_machine_rhel840_class_options(mc);
++    compat_props_add(mc->compat_props, hw_compat_rhel_8_3,
++                     hw_compat_rhel_8_3_len);
++
++    /* from pseries-5.1 */
++    smc->pre_5_2_numa_associativity = true;
++}
++
++DEFINE_SPAPR_MACHINE(rhel830, "rhel8.3.0", false);
++
 +/*
 + * pseries-rhel8.2.0
++ * like pseries-4.2 + pseries-5.0
++ * except SPAPR_CAP_CCF_ASSIST that has been backported to pseries-rhel8.1.0
 + */
 +
 +static void spapr_machine_rhel820_class_options(MachineClass *mc)
 +{
-+    /* Defaults for the latest behaviour inherited from the base class */
++    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
++    /* from pseries-5.0 */
++    static GlobalProperty compat[] = {
++        { TYPE_SPAPR_PCI_HOST_BRIDGE, "pre-5.1-associativity", "on" },
++    };
++
++    spapr_machine_rhel830_class_options(mc);
++    compat_props_add(mc->compat_props, hw_compat_rhel_8_2,
++                     hw_compat_rhel_8_2_len);
++    compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
++
++    /* from pseries-4.2 */
++    smc->default_caps.caps[SPAPR_CAP_FWNMI] = SPAPR_CAP_OFF;
++    smc->rma_limit = 16 * GiB;
++    mc->nvdimm_supported = false;
++
++    /* from pseries-5.0 */
++    mc->numa_mem_supported = true;
++    smc->pre_5_1_assoc_refpoints = true;
 +}
 +
-+DEFINE_SPAPR_MACHINE(rhel820, "rhel8.2.0", true);
++DEFINE_SPAPR_MACHINE(rhel820, "rhel8.2.0", false);
 +
 +/*
 + * pseries-rhel8.1.0
@@ -131,6 +277,8 @@ index e076f6023c..8749c72066 100644
 +                     hw_compat_rhel_8_1_len);
 +    compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
 +
++    /* from pseries-4.2 */
++    smc->default_caps.caps[SPAPR_CAP_CCF_ASSIST] = SPAPR_CAP_OFF;
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel810, "rhel8.1.0", false);
@@ -270,7 +418,6 @@ index e076f6023c..8749c72066 100644
 +    spapr_machine_rhel750_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_7_4, hw_compat_rhel_7_4_len);
 +    compat_props_add(mc->compat_props, spapr_compat_rhel7_4, spapr_compat_rhel7_4_len);
-+    mc->numa_auto_assign_ram = numa_legacy_auto_assign_ram;
 +    smc->has_power9_support = false;
 +    smc->pre_2_10_has_unused_icps = true;
 +    smc->resize_hpt_default = SPAPR_RESIZE_HPT_DISABLED;
@@ -372,7 +519,7 @@ index e076f6023c..8749c72066 100644
  static void spapr_machine_register_types(void)
  {
 diff --git a/hw/ppc/spapr_cpu_core.c b/hw/ppc/spapr_cpu_core.c
-index 301cd7b4e4..ba5a8fb82b 100644
+index 8ba34f6a1d..78eca1c04a 100644
 --- a/hw/ppc/spapr_cpu_core.c
 +++ b/hw/ppc/spapr_cpu_core.c
 @@ -24,6 +24,7 @@
@@ -383,15 +530,15 @@ index 301cd7b4e4..ba5a8fb82b 100644
  
  static void spapr_reset_vcpu(PowerPCCPU *cpu)
  {
-@@ -242,6 +243,7 @@ static void spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
+@@ -250,6 +251,7 @@ static bool spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
+ {
      CPUPPCState *env = &cpu->env;
      CPUState *cs = CPU(cpu);
-     Error *local_err = NULL;
 +    SpaprMachineClass *smc = SPAPR_MACHINE_GET_CLASS(spapr);
  
-     object_property_set_bool(OBJECT(cpu), true, "realized", &local_err);
-     if (local_err) {
-@@ -254,6 +256,17 @@ static void spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
+     if (!qdev_realize(DEVICE(cpu), NULL, errp)) {
+         return false;
+@@ -261,6 +263,17 @@ static bool spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
      cpu_ppc_set_vhyp(cpu, PPC_VIRTUAL_HYPERVISOR(spapr));
      kvmppc_set_papr(cpu);
  
@@ -403,29 +550,39 @@ index 301cd7b4e4..ba5a8fb82b 100644
 +           ppc_check_compat(cpu, CPU_POWERPC_LOGICAL_3_00, 0, 0)))) {
 +        error_set(errp, ERROR_CLASS_DEVICE_NOT_FOUND,
 +                  "POWER9 CPU is not supported by this machine class");
-+        return;
++        return false;
 +    }
 +
-     if (spapr_irq_cpu_intc_create(spapr, cpu, &local_err) < 0) {
-         goto error_intc_create;
-     }
+     if (spapr_irq_cpu_intc_create(spapr, cpu, errp) < 0) {
+         qdev_unrealize(DEVICE(cpu));
+         return false;
 diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
-index d5ab5ea7b2..aa89cc4a95 100644
+index ee7504b976..37a014d59c 100644
 --- a/include/hw/ppc/spapr.h
 +++ b/include/hw/ppc/spapr.h
-@@ -125,6 +125,7 @@ struct SpaprMachineClass {
-     bool linux_pci_probe;
-     bool smp_threads_vsmt; /* set VSMT to smp_threads by default */
+@@ -154,6 +154,7 @@ struct SpaprMachineClass {
+     bool pre_5_2_numa_associativity;
+     bool pre_6_2_numa_affinity;
  
 +    bool has_power9_support;
-     void (*phb_placement)(SpaprMachineState *spapr, uint32_t index,
-                           uint64_t *buid, hwaddr *pio, 
+     bool (*phb_placement)(SpaprMachineState *spapr, uint32_t index,
+                           uint64_t *buid, hwaddr *pio,
                            hwaddr *mmio32, hwaddr *mmio64,
+@@ -237,6 +238,9 @@ struct SpaprMachineState {
+ 
+     /* Set by -boot */
+     char *boot_device;
++ 
++    /* Secure Guest support via x-svm-allowed */
++    bool svm_allowed;
+ 
+     /*< public >*/
+     char *kvm_type;
 diff --git a/target/ppc/compat.c b/target/ppc/compat.c
-index 7de4bf3122..3e2e35342d 100644
+index 7949a24f5a..f207a9ba01 100644
 --- a/target/ppc/compat.c
 +++ b/target/ppc/compat.c
-@@ -105,8 +105,19 @@ static const CompatInfo *compat_by_pvr(uint32_t pvr)
+@@ -114,8 +114,19 @@ static const CompatInfo *compat_by_pvr(uint32_t pvr)
      return NULL;
  }
  
@@ -447,10 +604,10 @@ index 7de4bf3122..3e2e35342d 100644
      const CompatInfo *compat = compat_by_pvr(compat_pvr);
      const CompatInfo *min = compat_by_pvr(min_compat_pvr);
 diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
-index e3e82327b7..5c53801cfd 100644
+index e946da5f3a..23e8b76c85 100644
 --- a/target/ppc/cpu.h
 +++ b/target/ppc/cpu.h
-@@ -1367,6 +1367,7 @@ static inline int cpu_mmu_index(CPUPPCState *env, bool ifetch)
+@@ -1401,6 +1401,7 @@ static inline int cpu_mmu_index(CPUPPCState *env, bool ifetch)
  
  /* Compatibility modes */
  #if defined(TARGET_PPC64)
@@ -458,6 +615,100 @@ index e3e82327b7..5c53801cfd 100644
  bool ppc_check_compat(PowerPCCPU *cpu, uint32_t compat_pvr,
                        uint32_t min_compat_pvr, uint32_t max_compat_pvr);
  bool ppc_type_check_compat(const char *cputype, uint32_t compat_pvr,
+diff --git a/target/ppc/kvm.c b/target/ppc/kvm.c
+index dc93b99189..154888cce5 100644
+--- a/target/ppc/kvm.c
++++ b/target/ppc/kvm.c
+@@ -90,6 +90,7 @@ static int cap_ppc_nested_kvm_hv;
+ static int cap_large_decr;
+ static int cap_fwnmi;
+ static int cap_rpt_invalidate;
++static int cap_ppc_secure_guest;
+ 
+ static uint32_t debug_inst_opcode;
+ 
+@@ -137,6 +138,7 @@ int kvm_arch_init(MachineState *ms, KVMState *s)
+     cap_resize_hpt = kvm_vm_check_extension(s, KVM_CAP_SPAPR_RESIZE_HPT);
+     kvmppc_get_cpu_characteristics(s);
+     cap_ppc_nested_kvm_hv = kvm_vm_check_extension(s, KVM_CAP_PPC_NESTED_HV);
++    cap_ppc_secure_guest = kvm_vm_check_extension(s, KVM_CAP_PPC_SECURE_GUEST);
+     cap_large_decr = kvmppc_get_dec_bits();
+     cap_fwnmi = kvm_vm_check_extension(s, KVM_CAP_PPC_FWNMI);
+     /*
+@@ -2563,6 +2565,16 @@ int kvmppc_has_cap_rpt_invalidate(void)
+     return cap_rpt_invalidate;
+ }
+ 
++bool kvmppc_has_cap_secure_guest(void)
++{
++    return !!cap_ppc_secure_guest;
++}
++
++int kvmppc_enable_cap_secure_guest(void)
++{
++    return kvm_vm_enable_cap(kvm_state, KVM_CAP_PPC_SECURE_GUEST, 0, 1);
++}
++
+ PowerPCCPUClass *kvm_ppc_get_host_cpu_class(void)
+ {
+     uint32_t host_pvr = mfpvr();
+@@ -2959,3 +2971,18 @@ bool kvm_arch_cpu_check_are_resettable(void)
+ {
+     return true;
+ }
++
++void kvmppc_svm_allow(Error **errp)
++{
++    if (!kvm_enabled()) {
++        error_setg(errp, "No PEF support in tcg, try x-svm-allowed=off");
++        return;
++    }
++
++    if (!kvmppc_has_cap_secure_guest()) {
++        error_setg(errp, "KVM implementation does not support secure guests, "
++                   "try x-svm-allowed=off");
++    } else if (kvmppc_enable_cap_secure_guest() < 0) {
++        error_setg(errp, "Error enabling x-svm-allowed, try x-svm-allowed=off");
++    }
++}
+diff --git a/target/ppc/kvm_ppc.h b/target/ppc/kvm_ppc.h
+index ee9325bf9a..20dbb95989 100644
+--- a/target/ppc/kvm_ppc.h
++++ b/target/ppc/kvm_ppc.h
+@@ -40,6 +40,7 @@ int kvmppc_booke_watchdog_enable(PowerPCCPU *cpu);
+ target_ulong kvmppc_configure_v3_mmu(PowerPCCPU *cpu,
+                                      bool radix, bool gtse,
+                                      uint64_t proc_tbl);
++void kvmppc_svm_allow(Error **errp);
+ #ifndef CONFIG_USER_ONLY
+ bool kvmppc_spapr_use_multitce(void);
+ int kvmppc_spapr_enable_inkernel_multitce(void);
+@@ -74,6 +75,8 @@ int kvmppc_get_cap_large_decr(void);
+ int kvmppc_enable_cap_large_decr(PowerPCCPU *cpu, int enable);
+ int kvmppc_has_cap_rpt_invalidate(void);
+ int kvmppc_enable_hwrng(void);
++bool kvmppc_has_cap_secure_guest(void);
++int kvmppc_enable_cap_secure_guest(void);
+ int kvmppc_put_books_sregs(PowerPCCPU *cpu);
+ PowerPCCPUClass *kvm_ppc_get_host_cpu_class(void);
+ void kvmppc_check_papr_resize_hpt(Error **errp);
+@@ -393,6 +396,16 @@ static inline int kvmppc_has_cap_rpt_invalidate(void)
+     return false;
+ }
+ 
++static inline bool kvmppc_has_cap_secure_guest(void)
++{
++    return false;
++}
++
++static inline int kvmppc_enable_cap_secure_guest(void)
++{
++    return -1;
++}
++
+ static inline int kvmppc_enable_hwrng(void)
+ {
+     return -1;
 -- 
-2.21.0
+2.27.0
 

SOURCES/0010-Add-s390x-machine-types.patch

@@ -1,4 +1,4 @@
-From 0842700b3a01891c316e9169fa651f26714cafa5 Mon Sep 17 00:00:00 2001
+From 4ad9a0d0582eef78946b47563eb2c5b7ddf0cbb0 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 13:47:32 +0200
 Subject: Add s390x machine types
@@ -10,6 +10,9 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 Rebase changes (weekly-4.1.0):
 - Use upstream compat handling
 
+Rebase notes (weekly-210303):
+- Use rhel-8.4.0 hw compat
+
 Merged patches (3.1.0):
 - 29df663 s390x/cpumodel: default enable bpb and ppa15 for z196 and later
 
@@ -21,16 +24,23 @@ Merged patches (4.2.0):
 - a9b22e8 redhat: s390x: Add proper compatibility options for the -rhel7.6.0 machine
 - hw/s390x: Add the s390-ccw-virtio-rhel8.2.0 machine types (patch 92954)
 
-Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
+Merged patches (weekly-201216):
+- a6ae745cce redhat: s390x: add rhel-8.4.0 compat machine
+
+Merged patches (weekly-210602):
+- 50835d3429 redhat: s390x: add rhel-8.5.0 compat machine
+
+Merged patches (weekly-211006):
+- a3bcde27fe redhat: Add s390x machine type compatibility update for 6.1 rebase
 ---
- hw/s390x/s390-virtio-ccw.c | 70 +++++++++++++++++++++++++++++++++++++-
- 1 file changed, 69 insertions(+), 1 deletion(-)
+ hw/s390x/s390-virtio-ccw.c | 99 +++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 98 insertions(+), 1 deletion(-)
 
 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
-index d3edeef0ad..c2c83d2fce 100644
+index 653587ea62..181856e6cf 100644
 --- a/hw/s390x/s390-virtio-ccw.c
 +++ b/hw/s390x/s390-virtio-ccw.c
-@@ -615,7 +615,7 @@ bool css_migration_enabled(void)
+@@ -767,7 +767,7 @@ bool css_migration_enabled(void)
      {                                                                         \
          MachineClass *mc = MACHINE_CLASS(oc);                                 \
          ccw_machine_##suffix##_class_options(mc);                             \
@@ -38,29 +48,57 @@ index d3edeef0ad..c2c83d2fce 100644
 +        mc->desc = "VirtIO-ccw based S390 machine " verstr;                   \
          if (latest) {                                                         \
              mc->alias = "s390-ccw-virtio";                                    \
-             mc->is_default = 1;                                               \
-@@ -639,6 +639,7 @@ bool css_migration_enabled(void)
+             mc->is_default = true;                                            \
+@@ -791,6 +791,7 @@ bool css_migration_enabled(void)
      }                                                                         \
      type_init(ccw_machine_register_##suffix)
  
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
- static void ccw_machine_4_2_instance_options(MachineState *machine)
+ static void ccw_machine_6_2_instance_options(MachineState *machine)
  {
  }
-@@ -866,6 +867,73 @@ static void ccw_machine_2_4_class_options(MachineClass *mc)
+@@ -1100,6 +1101,102 @@ static void ccw_machine_2_4_class_options(MachineClass *mc)
      compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
  }
  DEFINE_CCW_MACHINE(2_4, "2.4", false);
 +#endif
 +
++static void ccw_machine_rhel850_instance_options(MachineState *machine)
++{
++}
++
++static void ccw_machine_rhel850_class_options(MachineClass *mc)
++{
++    compat_props_add(mc->compat_props, hw_compat_rhel_8_5, hw_compat_rhel_8_5_len);
++}
++DEFINE_CCW_MACHINE(rhel850, "rhel8.5.0", true);
++
++static void ccw_machine_rhel840_instance_options(MachineState *machine)
++{
++    ccw_machine_rhel850_instance_options(machine);
++}
++
++static void ccw_machine_rhel840_class_options(MachineClass *mc)
++{
++    ccw_machine_rhel850_class_options(mc);
++    compat_props_add(mc->compat_props, hw_compat_rhel_8_4, hw_compat_rhel_8_4_len);
++}
++DEFINE_CCW_MACHINE(rhel840, "rhel8.4.0", false);
++
 +static void ccw_machine_rhel820_instance_options(MachineState *machine)
 +{
++    ccw_machine_rhel840_instance_options(machine);
 +}
 +
 +static void ccw_machine_rhel820_class_options(MachineClass *mc)
 +{
++    ccw_machine_rhel840_class_options(mc);
++    mc->fixup_ram_size = s390_fixup_ram_size;
++    /* we did not publish a rhel8.3.0 machine */
++    compat_props_add(mc->compat_props, hw_compat_rhel_8_3, hw_compat_rhel_8_3_len);
++    compat_props_add(mc->compat_props, hw_compat_rhel_8_2, hw_compat_rhel_8_2_len);
 +}
-+DEFINE_CCW_MACHINE(rhel820, "rhel8.2.0", true);
++DEFINE_CCW_MACHINE(rhel820, "rhel8.2.0", false);
 +
 +static void ccw_machine_rhel760_instance_options(MachineState *machine)
 +{
@@ -82,6 +120,7 @@ index d3edeef0ad..c2c83d2fce 100644
 +{
 +    ccw_machine_rhel820_class_options(mc);
 +    /* We never published the s390x version of RHEL-AV 8.0 and 8.1, so add this here */
++    compat_props_add(mc->compat_props, hw_compat_rhel_8_1, hw_compat_rhel_8_1_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_0, hw_compat_rhel_8_0_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_7_6, hw_compat_rhel_7_6_len);
 +}
@@ -115,12 +154,12 @@ index d3edeef0ad..c2c83d2fce 100644
 +    ccw_machine_rhel760_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_7_5, hw_compat_rhel_7_5_len);
 +    compat_props_add(mc->compat_props, ccw_compat_rhel_7_5, ccw_compat_rhel_7_5_len);
-+    S390_MACHINE_CLASS(mc)->hpage_1m_allowed = false;
++    S390_CCW_MACHINE_CLASS(mc)->hpage_1m_allowed = false;
 +}
 +DEFINE_CCW_MACHINE(rhel750, "rhel7.5.0", false);
  
  static void ccw_machine_register_types(void)
  {
 -- 
-2.21.0
+2.27.0
 

SOURCES/0011-Add-x86_64-machine-types.patch

@@ -1,4 +1,4 @@
-From 2ebaeca6e26950f401a8169d1324be2bafd11741 Mon Sep 17 00:00:00 2001
+From c2b3564ce466bc5069bf9f5b0694025c68b0858d Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 13:10:31 +0200
 Subject: Add x86_64 machine types
@@ -19,6 +19,15 @@ Rebase notes (4.1.0):
 Rebase notes (4.2.0-rc2):
 - Use X86MachineClass for save_tsc_khz (upstream change)
 
+Rebase notes (weekly-210303):
+- Use rhel-8.4.0 hw compat
+
+Rebase notes (weekly-210519):
+- kvm_default_props moved to new file (upstream)
+
+Rebase notes (6.2.0-rc0):
+- linuxboot_dma_enabled moved to X86MachineState
+
 Merged patches (4.1.0):
 - f4dc802 pc: 7.5 compat entries
 - 456ed3e pc: PC_RHEL7_6_COMPAT
@@ -37,23 +46,75 @@ Merged patches (4.2.0):
 - 0784125 x86 machine types: add pc-q35-rhel8.1.0
 - machines/x86: Add rhel 8.2 machine type (patch 92959)
 
-Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
----
- hw/i386/acpi-build.c |   3 +
- hw/i386/pc.c         | 263 ++++++++++++++++++++++++++++++++++++++++++-
- hw/i386/pc_piix.c    | 210 +++++++++++++++++++++++++++++++++-
- hw/i386/pc_q35.c     | 156 ++++++++++++++++++++++++-
- include/hw/boards.h  |   2 +
- include/hw/i386/pc.h |  33 ++++++
- target/i386/cpu.c    |   9 +-
- target/i386/kvm.c    |   4 +
- 8 files changed, 673 insertions(+), 7 deletions(-)
+Merged patches (5.1.0):
+- 481357e RHEL: hw/i386: disable nested PERF_GLOBAL_CTRL MSR support
+- e6c3fbf hw/smbios: set new default SMBIOS fields for Windows driver support (partialy)
 
+Merged patches (5.2.0 rc0):
+- b02c9f5 x86: Add 8.3.0 x86_64 machine type
+- f2edc4f q35: Set max_cpus to 512
+- 6d7ba66 machine types/numa: set numa_mem_supported on old machine types (partialy)
+- 25c5644 machine_types/numa: compatibility for auto_enable_numa_with_memdev (partialy)
+- e2d3209 x86: lpc9: let firmware negotiate 'CPU hotplug with SMI' features (partialy)
+
+Merged patches (weekly-210120):
+- d0afeaa0c4 RHEL: Switch pvpanic test to q35
+- e19cdad83c 8.4 x86 machine type
+
+Merged patches (weekly-210203):
+- 96f8781bd6 q35: Increase max_cpus to 710 on pc-q35-rhel8* machine types
+
+Merged patches (weekly-210224):
+- 70d3924521 redhat: Add some devices for exporting upstream machine types
+ - machine type chunks only
+
+Merged patches (6.0.0 rc0):
+- 031c690804 i386/acpi: restore device paths for pre-5.1 vms
+
+Merged patches (weekly-210623):
+- 64c350696f x86: Add x86 rhel8.5 machine types
+- 1c8fe5e164 redhat: x86: Enable 'kvm-asyncpf-int' by default
+
+Merged patches (weekly-210714):
+- 618e2424ed redhat: Expose upstream machines pc-4.2 and pc-2.11
+- c4d1aa8bf2 redhat: Enable FDC device for upstream machines too
+- 66882f9a32 redhat: Add hw_compat_4_2_extra and apply to upstream machines
+
+Fix machine type
+---
+ hw/block/fdc.c             |   5 +-
+ hw/i386/acpi-build.c       |   3 +
+ hw/i386/pc.c               | 298 ++++++++++++++++++++++++++++++++++++-
+ hw/i386/pc_piix.c          | 274 +++++++++++++++++++++++++++++++++-
+ hw/i386/pc_q35.c           | 234 ++++++++++++++++++++++++++++-
+ include/hw/boards.h        |   2 +
+ include/hw/i386/pc.h       |  45 ++++++
+ target/i386/kvm/kvm-cpu.c  |   1 +
+ target/i386/kvm/kvm.c      |   4 +
+ tests/qtest/pvpanic-test.c |   5 +-
+ 10 files changed, 862 insertions(+), 9 deletions(-)
+
+diff --git a/hw/block/fdc.c b/hw/block/fdc.c
+index 97fa6de423..63042ef030 100644
+--- a/hw/block/fdc.c
++++ b/hw/block/fdc.c
+@@ -2341,7 +2341,10 @@ void fdctrl_realize_common(DeviceState *dev, FDCtrl *fdctrl, Error **errp)
+ 
+     /* Restricted for Red Hat Enterprise Linux: */
+     MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
+-    if (!strstr(mc->name, "-rhel7.")) {
++    if (!strstr(mc->name, "-rhel7.") &&
++        /* Exported two upstream machine types allows FDC too */
++        strcmp(mc->name, "pc-i440fx-4.2") &&
++        strcmp(mc->name, "pc-i440fx-2.11")) {
+         error_setg(errp, "Device %s is not supported with machine type %s",
+                    object_get_typename(OBJECT(dev)), mc->name);
+         return;
 diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
-index 12ff55fcfb..64001893ab 100644
+index a99c6e4fe3..447ea35275 100644
 --- a/hw/i386/acpi-build.c
 +++ b/hw/i386/acpi-build.c
-@@ -204,6 +204,9 @@ static void acpi_get_pm_info(MachineState *machine, AcpiPmInfo *pm)
+@@ -230,6 +230,9 @@ static void acpi_get_pm_info(MachineState *machine, AcpiPmInfo *pm)
          pm->fadt.reset_reg = r;
          pm->fadt.reset_val = 0xf;
          pm->fadt.flags |= 1 << ACPI_FADT_F_RESET_REG_SUP;
@@ -61,13 +122,13 @@ index 12ff55fcfb..64001893ab 100644
 +                                     "__com.redhat_force-rev1-fadt", NULL))
 +            pm->fadt.rev = 1;
          pm->cpu_hp_io_base = ICH9_CPU_HOTPLUG_IO_BASE;
-     }
- 
+         pm->smi_on_cpuhp =
+             !!(smi_features & BIT_ULL(ICH9_LPC_SMI_F_CPU_HOTPLUG_BIT));
 diff --git a/hw/i386/pc.c b/hw/i386/pc.c
-index ac08e63604..61e70e4811 100644
+index a2ef40ecbc..e8109954ca 100644
 --- a/hw/i386/pc.c
 +++ b/hw/i386/pc.c
-@@ -344,6 +344,261 @@ GlobalProperty pc_compat_1_4[] = {
+@@ -371,6 +371,296 @@ GlobalProperty pc_compat_1_4[] = {
  };
  const size_t pc_compat_1_4_len = G_N_ELEMENTS(pc_compat_1_4);
  
@@ -78,11 +139,34 @@ index ac08e63604..61e70e4811 100644
 +GlobalProperty pc_rhel_compat[] = {
 +    { TYPE_X86_CPU, "host-phys-bits", "on" },
 +    { TYPE_X86_CPU, "host-phys-bits-limit", "48" },
++    { TYPE_X86_CPU, "vmx-entry-load-perf-global-ctrl", "off" },
++    { TYPE_X86_CPU, "vmx-exit-load-perf-global-ctrl", "off" },
 +    /* bz 1508330 */ 
 +    { "vfio-pci", "x-no-geforce-quirks", "on" },
++    /* bz 1941397 */
++    { TYPE_X86_CPU, "kvm-asyncpf-int", "on" },
 +};
 +const size_t pc_rhel_compat_len = G_N_ELEMENTS(pc_rhel_compat);
 +
++GlobalProperty pc_rhel_8_4_compat[] = {
++    /* pc_rhel_8_4_compat from pc_compat_5_2 */
++    { "ICH9-LPC", "x-smi-cpu-hotunplug", "off" },
++    { TYPE_X86_CPU, "kvm-asyncpf-int", "off" },
++};
++const size_t pc_rhel_8_4_compat_len = G_N_ELEMENTS(pc_rhel_8_4_compat);
++
++GlobalProperty pc_rhel_8_3_compat[] = {
++    /* pc_rhel_8_3_compat from pc_compat_5_1 */
++    { "ICH9-LPC", "x-smi-cpu-hotplug", "off" },
++};
++const size_t pc_rhel_8_3_compat_len = G_N_ELEMENTS(pc_rhel_8_3_compat);
++
++GlobalProperty pc_rhel_8_2_compat[] = {
++    /* pc_rhel_8_2_compat from pc_compat_4_2 */
++    { "mch", "smbase-smram", "off" },
++};
++const size_t pc_rhel_8_2_compat_len = G_N_ELEMENTS(pc_rhel_8_2_compat);
++
 +/* pc_rhel_8_1_compat is empty since pc_4_1_compat is */
 +GlobalProperty pc_rhel_8_1_compat[] = { };
 +const size_t pc_rhel_8_1_compat_len = G_N_ELEMENTS(pc_rhel_8_1_compat);
@@ -326,10 +410,22 @@ index ac08e63604..61e70e4811 100644
 +};
 +const size_t pc_rhel_7_0_compat_len = G_N_ELEMENTS(pc_rhel_7_0_compat);
 +
- void gsi_handler(void *opaque, int n, int level)
++/*
++ * RHEL: These properties only apply to the RHEL exported machine types
++ * pc-4.2/2.11 for the purpose to have a limited upstream machines support
++ * which can be migrated to RHEL.  Let's avoid touching hw_compat_4_2 directly
++ * so that we can have some isolation against the upstream code.
++ */
++GlobalProperty hw_compat_4_2_extra[] = {
++    /* By default enlarge the default virtio-net-pci ROM to 512KB. */
++    { "virtio-net-pci", "romsize", "0x80000" },
++};
++const size_t hw_compat_4_2_extra_len = G_N_ELEMENTS(hw_compat_4_2_extra);
++
+ GSIState *pc_gsi_create(qemu_irq **irqs, bool pci_enabled)
  {
-     GSIState *s = opaque;
-@@ -1225,7 +1480,8 @@ void pc_memory_init(PCMachineState *pcms,
+     GSIState *s;
+@@ -904,7 +1194,8 @@ void pc_memory_init(PCMachineState *pcms,
      option_rom_mr = g_malloc(sizeof(*option_rom_mr));
      memory_region_init_ram(option_rom_mr, NULL, "pc.rom", PC_ROM_SIZE,
                             &error_fatal);
@@ -339,18 +435,18 @@ index ac08e63604..61e70e4811 100644
          memory_region_set_readonly(option_rom_mr, true);
      }
      memory_region_add_subregion_overlap(rom_memory,
-@@ -2198,6 +2454,8 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
-     pcmc->linuxboot_dma_enabled = true;
+@@ -1694,6 +1985,8 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
      pcmc->pvh_enabled = true;
+     pcmc->kvmclock_create_always = true;
      assert(!mc->get_hotplug_handler);
 +    pcmc->pc_rom_ro = true;
 +    mc->async_pf_vmexit_disable = false;
      mc->get_hotplug_handler = pc_get_hotplug_handler;
      mc->hotplug_allowed = pc_hotplug_allowed;
      mc->cpu_index_to_instance_props = x86_cpu_index_to_props;
-@@ -2209,7 +2467,8 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
-     mc->hot_add_cpu = pc_hot_add_cpu;
-     mc->smp_parse = pc_smp_parse;
+@@ -1704,7 +1997,8 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
+     mc->has_hotpluggable_cpus = true;
+     mc->default_boot_order = "cad";
      mc->block_default_type = IF_IDE;
 -    mc->max_cpus = 255;
 +    /* 240: max CPU count for RHEL */
@@ -359,18 +455,18 @@ index ac08e63604..61e70e4811 100644
      mc->wakeup = pc_machine_wakeup;
      hc->pre_plug = pc_machine_device_pre_plug_cb;
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
-index 1bd70d1abb..bd7fdb99bb 100644
+index dda3f64f19..2885edffe9 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
-@@ -53,6 +53,7 @@
- #include "cpu.h"
+@@ -50,6 +50,7 @@
  #include "qapi/error.h"
  #include "qemu/error-report.h"
+ #include "sysemu/xen.h"
 +#include "migration/migration.h"
  #ifdef CONFIG_XEN
  #include <xen/hvm/hvm_info_table.h>
  #include "hw/xen/xen_pt.h"
-@@ -173,8 +174,8 @@ static void pc_init1(MachineState *machine,
+@@ -174,8 +175,8 @@ static void pc_init1(MachineState *machine,
      if (pcmc->smbios_defaults) {
          MachineClass *mc = MACHINE_GET_CLASS(machine);
          /* These values are guest ABI, do not change */
@@ -379,19 +475,191 @@ index 1bd70d1abb..bd7fdb99bb 100644
 +        smbios_set_defaults("Red Hat", "KVM",
 +                            mc->desc, pcmc->smbios_legacy_mode,
                              pcmc->smbios_uuid_encoded,
-                             SMBIOS_ENTRY_POINT_21);
-     }
-@@ -307,6 +308,7 @@ else {
+                             pcmc->smbios_stream_product,
+                             pcmc->smbios_stream_version,
+@@ -314,6 +315,15 @@ static void pc_init1(MachineState *machine,
   * hw_compat_*, pc_compat_*, or * pc_*_machine_options().
   */
  
++/*
++ * NOTE!  Not all the upstream machine types are disabled for RHEL.  For
++ * providing a very limited support for upstream machine types, pc machines
++ * 2.11 and 4.2 are exposed explicitly.  This will make the below "#if" macros
++ * a bit messed up, but please read this comment first so that we can have a
++ * rough understanding of what we're going to do.
++ */
++
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
  static void pc_compat_2_3_fn(MachineState *machine)
  {
-     PCMachineState *pcms = PC_MACHINE(machine);
-@@ -1026,3 +1028,207 @@ static void xenfv_machine_options(MachineClass *m)
- DEFINE_PC_MACHINE(xenfv, "xenfv", pc_xen_hvm_init,
-                   xenfv_machine_options);
+     X86MachineState *x86ms = X86_MACHINE(machine);
+@@ -389,6 +399,8 @@ static void pc_xen_hvm_init(MachineState *machine)
+ }
+ #endif
+ 
++#endif /* Disabled for Red Hat Enterprise Linux */
++
+ #define DEFINE_I440FX_MACHINE(suffix, name, compatfn, optionfn) \
+     static void pc_init_##suffix(MachineState *machine) \
+     { \
+@@ -424,8 +436,10 @@ static void pc_i440fx_6_2_machine_options(MachineClass *m)
+     pcmc->default_cpu_version = 1;
+ }
+ 
++#if 0 /* Disabled for Red Hat Enterprise Linux */
+ DEFINE_I440FX_MACHINE(v6_2, "pc-i440fx-6.2", NULL,
+                       pc_i440fx_6_2_machine_options);
++#endif /* Disabled for Red Hat Enterprise Linux */
+ 
+ static void pc_i440fx_6_1_machine_options(MachineClass *m)
+ {
+@@ -437,8 +451,10 @@ static void pc_i440fx_6_1_machine_options(MachineClass *m)
+     m->smp_props.prefer_sockets = true;
+ }
+ 
++#if 0 /* Disabled for Red Hat Enterprise Linux */
+ DEFINE_I440FX_MACHINE(v6_1, "pc-i440fx-6.1", NULL,
+                       pc_i440fx_6_1_machine_options);
++#endif /* Disabled for Red Hat Enterprise Linux */
+ 
+ static void pc_i440fx_6_0_machine_options(MachineClass *m)
+ {
+@@ -449,8 +465,10 @@ static void pc_i440fx_6_0_machine_options(MachineClass *m)
+     compat_props_add(m->compat_props, pc_compat_6_0, pc_compat_6_0_len);
+ }
+ 
++#if 0 /* Disabled for Red Hat Enterprise Linux */
+ DEFINE_I440FX_MACHINE(v6_0, "pc-i440fx-6.0", NULL,
+                       pc_i440fx_6_0_machine_options);
++#endif /* Disabled for Red Hat Enterprise Linux */
+ 
+ static void pc_i440fx_5_2_machine_options(MachineClass *m)
+ {
+@@ -461,8 +479,10 @@ static void pc_i440fx_5_2_machine_options(MachineClass *m)
+     compat_props_add(m->compat_props, pc_compat_5_2, pc_compat_5_2_len);
+ }
+ 
++#if 0 /* Disabled for Red Hat Enterprise Linux */
+ DEFINE_I440FX_MACHINE(v5_2, "pc-i440fx-5.2", NULL,
+                       pc_i440fx_5_2_machine_options);
++#endif /* Disabled for Red Hat Enterprise Linux */
+ 
+ static void pc_i440fx_5_1_machine_options(MachineClass *m)
+ {
+@@ -477,8 +497,10 @@ static void pc_i440fx_5_1_machine_options(MachineClass *m)
+     pcmc->pci_root_uid = 1;
+ }
+ 
++#if 0 /* Disabled for Red Hat Enterprise Linux */
+ DEFINE_I440FX_MACHINE(v5_1, "pc-i440fx-5.1", NULL,
+                       pc_i440fx_5_1_machine_options);
++#endif /* Disabled for Red Hat Enterprise Linux */
+ 
+ static void pc_i440fx_5_0_machine_options(MachineClass *m)
+ {
+@@ -491,8 +513,10 @@ static void pc_i440fx_5_0_machine_options(MachineClass *m)
+     m->auto_enable_numa_with_memdev = false;
+ }
+ 
++#if 0 /* Disabled for Red Hat Enterprise Linux */
+ DEFINE_I440FX_MACHINE(v5_0, "pc-i440fx-5.0", NULL,
+                       pc_i440fx_5_0_machine_options);
++#endif /* Disabled for Red Hat Enterprise Linux */
+ 
+ static void pc_i440fx_4_2_machine_options(MachineClass *m)
+ {
+@@ -501,8 +525,21 @@ static void pc_i440fx_4_2_machine_options(MachineClass *m)
+     m->is_default = false;
+     compat_props_add(m->compat_props, hw_compat_4_2, hw_compat_4_2_len);
+     compat_props_add(m->compat_props, pc_compat_4_2, pc_compat_4_2_len);
++
++    /*
++     * RHEL: Mark all upstream machines as deprecated because they're not
++     * supported by RHEL, even if exported.
++     */
++    m->deprecation_reason = "Not supported by RHEL";
++    /*
++     * RHEL: Specific compat properties to have limited support for upstream
++     * machines exported.
++     */
++    compat_props_add(m->compat_props, hw_compat_4_2_extra,
++                     hw_compat_4_2_extra_len);
+ }
+ 
++/* RHEL: Export pc-4.2 */
+ DEFINE_I440FX_MACHINE(v4_2, "pc-i440fx-4.2", NULL,
+                       pc_i440fx_4_2_machine_options);
+ 
+@@ -515,8 +552,10 @@ static void pc_i440fx_4_1_machine_options(MachineClass *m)
+     compat_props_add(m->compat_props, pc_compat_4_1, pc_compat_4_1_len);
+ }
+ 
++#if 0 /* Disabled for Red Hat Enterprise Linux */
+ DEFINE_I440FX_MACHINE(v4_1, "pc-i440fx-4.1", NULL,
+                       pc_i440fx_4_1_machine_options);
++#endif /* Disabled for Red Hat Enterprise Linux */
+ 
+ static void pc_i440fx_4_0_machine_options(MachineClass *m)
+ {
+@@ -529,8 +568,10 @@ static void pc_i440fx_4_0_machine_options(MachineClass *m)
+     compat_props_add(m->compat_props, pc_compat_4_0, pc_compat_4_0_len);
+ }
+ 
++#if 0 /* Disabled for Red Hat Enterprise Linux */
+ DEFINE_I440FX_MACHINE(v4_0, "pc-i440fx-4.0", NULL,
+                       pc_i440fx_4_0_machine_options);
++#endif /* Disabled for Red Hat Enterprise Linux */
+ 
+ static void pc_i440fx_3_1_machine_options(MachineClass *m)
+ {
+@@ -546,8 +587,10 @@ static void pc_i440fx_3_1_machine_options(MachineClass *m)
+     compat_props_add(m->compat_props, pc_compat_3_1, pc_compat_3_1_len);
+ }
+ 
++#if 0 /* Disabled for Red Hat Enterprise Linux */
+ DEFINE_I440FX_MACHINE(v3_1, "pc-i440fx-3.1", NULL,
+                       pc_i440fx_3_1_machine_options);
++#endif /* Disabled for Red Hat Enterprise Linux */
+ 
+ static void pc_i440fx_3_0_machine_options(MachineClass *m)
+ {
+@@ -556,8 +599,10 @@ static void pc_i440fx_3_0_machine_options(MachineClass *m)
+     compat_props_add(m->compat_props, pc_compat_3_0, pc_compat_3_0_len);
+ }
+ 
++#if 0 /* Disabled for Red Hat Enterprise Linux */
+ DEFINE_I440FX_MACHINE(v3_0, "pc-i440fx-3.0", NULL,
+                       pc_i440fx_3_0_machine_options);
++#endif /* Disabled for Red Hat Enterprise Linux */
+ 
+ static void pc_i440fx_2_12_machine_options(MachineClass *m)
+ {
+@@ -566,8 +611,10 @@ static void pc_i440fx_2_12_machine_options(MachineClass *m)
+     compat_props_add(m->compat_props, pc_compat_2_12, pc_compat_2_12_len);
+ }
+ 
++#if 0 /* Disabled for Red Hat Enterprise Linux */
+ DEFINE_I440FX_MACHINE(v2_12, "pc-i440fx-2.12", NULL,
+                       pc_i440fx_2_12_machine_options);
++#endif /* Disabled for Red Hat Enterprise Linux */
+ 
+ static void pc_i440fx_2_11_machine_options(MachineClass *m)
+ {
+@@ -576,9 +623,11 @@ static void pc_i440fx_2_11_machine_options(MachineClass *m)
+     compat_props_add(m->compat_props, pc_compat_2_11, pc_compat_2_11_len);
+ }
+ 
++/* RHEL: Export pc-2.11 */
+ DEFINE_I440FX_MACHINE(v2_11, "pc-i440fx-2.11", NULL,
+                       pc_i440fx_2_11_machine_options);
+ 
++#if 0 /* Disabled for Red Hat Enterprise Linux */
+ static void pc_i440fx_2_10_machine_options(MachineClass *m)
+ {
+     pc_i440fx_2_11_machine_options(m);
+@@ -951,3 +1000,224 @@ static void xenfv_3_1_machine_options(MachineClass *m)
+ DEFINE_PC_MACHINE(xenfv, "xenfv-3.1", pc_xen_hvm_init,
+                   xenfv_3_1_machine_options);
  #endif
 +#endif  /* Disabled for Red Hat Enterprise Linux */
 +
@@ -402,10 +670,13 @@ index 1bd70d1abb..bd7fdb99bb 100644
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    m->family = "pc_piix_Y";
-+    m->default_machine_opts = "firmware=bios-256k.bin";
++    m->default_machine_opts = "firmware=bios-256k.bin,hpet=off";
 +    pcmc->default_nic_model = "e1000";
++    pcmc->pci_root_uid = 0;
 +    m->default_display = "std";
 +    m->no_parallel = 1;
++    m->numa_mem_supported = true;
++    m->auto_enable_numa_with_memdev = false;
 +    machine_class_allow_dynamic_sysbus_dev(m, TYPE_RAMFB_DEVICE);
 +    compat_props_add(m->compat_props, pc_rhel_compat, pc_rhel_compat_len);
 +    m->alias = "pc";
@@ -427,6 +698,21 @@ index 1bd70d1abb..bd7fdb99bb 100644
 +    m->smbus_no_migration_support = true;
 +    pcmc->pvh_enabled = false;
 +    pcmc->default_cpu_version = CPU_VERSION_LEGACY;
++    pcmc->kvmclock_create_always = false;
++    /* From pc_i440fx_5_1_machine_options() */
++    pcmc->pci_root_uid = 1;
++    compat_props_add(m->compat_props, hw_compat_rhel_8_4,
++                     hw_compat_rhel_8_4_len);
++    compat_props_add(m->compat_props, pc_rhel_8_4_compat,
++                     pc_rhel_8_4_compat_len);
++    compat_props_add(m->compat_props, hw_compat_rhel_8_3,
++                     hw_compat_rhel_8_3_len);
++    compat_props_add(m->compat_props, pc_rhel_8_3_compat,
++                     pc_rhel_8_3_compat_len);
++    compat_props_add(m->compat_props, hw_compat_rhel_8_2,
++                     hw_compat_rhel_8_2_len);
++    compat_props_add(m->compat_props, pc_rhel_8_2_compat,
++                     pc_rhel_8_2_compat_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_1, hw_compat_rhel_8_1_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_1_compat, pc_rhel_8_1_compat_len);
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_0, hw_compat_rhel_8_0_len);
@@ -469,7 +755,6 @@ index 1bd70d1abb..bd7fdb99bb 100644
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_machine_rhel750_options(m);
 +    m->desc = "RHEL 7.4.0 PC (i440FX + PIIX, 1996)";
-+    m->numa_auto_assign_ram = numa_legacy_auto_assign_ram;
 +    pcmc->pc_rom_ro = false;
 +    compat_props_add(m->compat_props, hw_compat_rhel_7_4, hw_compat_rhel_7_4_len);
 +    compat_props_add(m->compat_props, pc_rhel_7_4_compat, pc_rhel_7_4_compat_len);
@@ -486,10 +771,10 @@ index 1bd70d1abb..bd7fdb99bb 100644
 +
 +static void pc_machine_rhel730_options(MachineClass *m)
 +{
-+    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
++    X86MachineClass *x86mc = X86_MACHINE_CLASS(m);
 +    pc_machine_rhel740_options(m);
 +    m->desc = "RHEL 7.3.0 PC (i440FX + PIIX, 1996)";
-+    pcmc->linuxboot_dma_enabled = false;
++    x86mc->fwcfg_dma_enabled = false;
 +    compat_props_add(m->compat_props, hw_compat_rhel_7_3, hw_compat_rhel_7_3_len);
 +    compat_props_add(m->compat_props, pc_rhel_7_3_compat, pc_rhel_7_3_compat_len);
 +}
@@ -598,7 +883,7 @@ index 1bd70d1abb..bd7fdb99bb 100644
 +DEFINE_PC_MACHINE(rhel700, "pc-i440fx-rhel7.0.0", pc_init_rhel700,
 +                  pc_machine_rhel700_options);
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
-index 385e5cffb1..7531d8ed76 100644
+index 235054a643..c67418b6a9 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
 @@ -197,8 +197,8 @@ static void pc_q35_init(MachineState *machine)
@@ -610,9 +895,9 @@ index 385e5cffb1..7531d8ed76 100644
 +        smbios_set_defaults("Red Hat", "KVM",
 +                            mc->desc, pcmc->smbios_legacy_mode,
                              pcmc->smbios_uuid_encoded,
-                             SMBIOS_ENTRY_POINT_21);
-     }
-@@ -330,6 +330,7 @@ static void pc_q35_init(MachineState *machine)
+                             pcmc->smbios_stream_product,
+                             pcmc->smbios_stream_version,
+@@ -342,6 +342,7 @@ static void pc_q35_init(MachineState *machine)
      DEFINE_PC_MACHINE(suffix, name, pc_init_##suffix, optionfn)
  
  
@@ -620,7 +905,7 @@ index 385e5cffb1..7531d8ed76 100644
  static void pc_q35_machine_options(MachineClass *m)
  {
      PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-@@ -533,3 +534,154 @@ static void pc_q35_2_4_machine_options(MachineClass *m)
+@@ -620,3 +621,232 @@ static void pc_q35_2_4_machine_options(MachineClass *m)
  
  DEFINE_Q35_MACHINE(v2_4, "pc-q35-2.4", NULL,
                     pc_q35_2_4_machine_options);
@@ -633,9 +918,10 @@ index 385e5cffb1..7531d8ed76 100644
 +{
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pcmc->default_nic_model = "e1000e";
++    pcmc->pci_root_uid = 0;
 +    m->family = "pc_q35_Z";
 +    m->units_per_default_bus = 1;
-+    m->default_machine_opts = "firmware=bios-256k.bin";
++    m->default_machine_opts = "firmware=bios-256k.bin,hpet=off";
 +    m->default_display = "std";
 +    m->no_floppy = 1;
 +    m->no_parallel = 1;
@@ -644,10 +930,76 @@ index 385e5cffb1..7531d8ed76 100644
 +    machine_class_allow_dynamic_sysbus_dev(m, TYPE_INTEL_IOMMU_DEVICE);
 +    machine_class_allow_dynamic_sysbus_dev(m, TYPE_RAMFB_DEVICE);
 +    m->alias = "q35";
-+    m->max_cpus = 384;
++    m->max_cpus = 710;
 +    compat_props_add(m->compat_props, pc_rhel_compat, pc_rhel_compat_len);
 +}
 +
++static void pc_q35_init_rhel850(MachineState *machine)
++{
++    pc_q35_init(machine);
++}
++
++static void pc_q35_machine_rhel850_options(MachineClass *m)
++{
++    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
++    pc_q35_machine_rhel_options(m);
++    m->desc = "RHEL-8.5.0 PC (Q35 + ICH9, 2009)";
++    pcmc->smbios_stream_product = "RHEL-AV";
++    pcmc->smbios_stream_version = "8.5.0";
++}
++
++DEFINE_PC_MACHINE(q35_rhel850, "pc-q35-rhel8.5.0", pc_q35_init_rhel850,
++                  pc_q35_machine_rhel850_options);
++
++
++static void pc_q35_init_rhel840(MachineState *machine)
++{
++    pc_q35_init(machine);
++}
++
++static void pc_q35_machine_rhel840_options(MachineClass *m)
++{
++    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
++    pc_q35_machine_rhel850_options(m);
++    m->desc = "RHEL-8.4.0 PC (Q35 + ICH9, 2009)";
++    m->alias = NULL;
++    pcmc->smbios_stream_product = "RHEL-AV";
++    pcmc->smbios_stream_version = "8.4.0";
++    compat_props_add(m->compat_props, hw_compat_rhel_8_4,
++                     hw_compat_rhel_8_4_len);
++    compat_props_add(m->compat_props, pc_rhel_8_4_compat,
++                     pc_rhel_8_4_compat_len);
++}
++
++DEFINE_PC_MACHINE(q35_rhel840, "pc-q35-rhel8.4.0", pc_q35_init_rhel840,
++                  pc_q35_machine_rhel840_options);
++
++
++static void pc_q35_init_rhel830(MachineState *machine)
++{
++    pc_q35_init(machine);
++}
++
++static void pc_q35_machine_rhel830_options(MachineClass *m)
++{
++    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
++    pc_q35_machine_rhel840_options(m);
++    m->desc = "RHEL-8.3.0 PC (Q35 + ICH9, 2009)";
++    pcmc->smbios_stream_product = "RHEL-AV";
++    pcmc->smbios_stream_version = "8.3.0";
++    compat_props_add(m->compat_props, hw_compat_rhel_8_3,
++                     hw_compat_rhel_8_3_len);
++    compat_props_add(m->compat_props, pc_rhel_8_3_compat,
++                     pc_rhel_8_3_compat_len);
++    /* From pc_q35_5_1_machine_options() */
++    pcmc->kvmclock_create_always = false;
++    /* From pc_q35_5_1_machine_options() */
++    pcmc->pci_root_uid = 1;
++}
++
++DEFINE_PC_MACHINE(q35_rhel830, "pc-q35-rhel8.3.0", pc_q35_init_rhel830,
++                  pc_q35_machine_rhel830_options);
++
 +static void pc_q35_init_rhel820(MachineState *machine)
 +{
 +    pc_q35_init(machine);
@@ -655,8 +1007,17 @@ index 385e5cffb1..7531d8ed76 100644
 +
 +static void pc_q35_machine_rhel820_options(MachineClass *m)
 +{
-+    pc_q35_machine_rhel_options(m);
++    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
++    pc_q35_machine_rhel830_options(m);
 +    m->desc = "RHEL-8.2.0 PC (Q35 + ICH9, 2009)";
++    m->numa_mem_supported = true;
++    m->auto_enable_numa_with_memdev = false;
++    pcmc->smbios_stream_product = "RHEL-AV";
++    pcmc->smbios_stream_version = "8.2.0";
++    compat_props_add(m->compat_props, hw_compat_rhel_8_2,
++                     hw_compat_rhel_8_2_len);
++    compat_props_add(m->compat_props, pc_rhel_8_2_compat,
++                     pc_rhel_8_2_compat_len);
 +}
 +
 +DEFINE_PC_MACHINE(q35_rhel820, "pc-q35-rhel8.2.0", pc_q35_init_rhel820,
@@ -669,9 +1030,12 @@ index 385e5cffb1..7531d8ed76 100644
 +
 +static void pc_q35_machine_rhel810_options(MachineClass *m)
 +{
++    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel820_options(m);
 +    m->desc = "RHEL-8.1.0 PC (Q35 + ICH9, 2009)";
 +    m->alias = NULL;
++    pcmc->smbios_stream_product = NULL;
++    pcmc->smbios_stream_version = NULL;
 +    compat_props_add(m->compat_props, hw_compat_rhel_8_1, hw_compat_rhel_8_1_len);
 +    compat_props_add(m->compat_props, pc_rhel_8_1_compat, pc_rhel_8_1_compat_len);
 +}
@@ -748,7 +1112,6 @@ index 385e5cffb1..7531d8ed76 100644
 +    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel750_options(m);
 +    m->desc = "RHEL-7.4.0 PC (Q35 + ICH9, 2009)";
-+    m->numa_auto_assign_ram = numa_legacy_auto_assign_ram;
 +    pcmc->pc_rom_ro = false;
 +    compat_props_add(m->compat_props, hw_compat_rhel_7_4, hw_compat_rhel_7_4_len);
 +    compat_props_add(m->compat_props, pc_rhel_7_4_compat, pc_rhel_7_4_compat_len);
@@ -764,11 +1127,11 @@ index 385e5cffb1..7531d8ed76 100644
 +
 +static void pc_q35_machine_rhel730_options(MachineClass *m)
 +{
-+    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
++    X86MachineClass *x86mc = X86_MACHINE_CLASS(m);
 +    pc_q35_machine_rhel740_options(m);
 +    m->desc = "RHEL-7.3.0 PC (Q35 + ICH9, 2009)";
 +    m->max_cpus = 255;
-+    pcmc->linuxboot_dma_enabled = false;
++    x86mc->fwcfg_dma_enabled = false;
 +    compat_props_add(m->compat_props, hw_compat_rhel_7_3, hw_compat_rhel_7_3_len);
 +    compat_props_add(m->compat_props, pc_rhel_7_3_compat, pc_rhel_7_3_compat_len);
 +}
@@ -776,39 +1139,48 @@ index 385e5cffb1..7531d8ed76 100644
 +DEFINE_PC_MACHINE(q35_rhel730, "pc-q35-rhel7.3.0", pc_q35_init_rhel730,
 +                  pc_q35_machine_rhel730_options);
 diff --git a/include/hw/boards.h b/include/hw/boards.h
-index 6f85a0e032..2920bdef5b 100644
+index 8bba96ef2b..04e8759815 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
-@@ -222,6 +222,8 @@ struct MachineClass {
-     const char **valid_cpu_types;
+@@ -263,6 +263,8 @@ struct MachineClass {
      strList *allowed_dynamic_sysbus_devices;
      bool auto_enable_numa_with_memhp;
+     bool auto_enable_numa_with_memdev;
 +    /* RHEL only */
 +    bool async_pf_vmexit_disable;
-     void (*numa_auto_assign_ram)(MachineClass *mc, NodeInfo *nodes,
-                                  int nb_nodes, ram_addr_t size);
      bool ignore_boot_device_suffixes;
+     bool smbus_no_migration_support;
+     bool nvdimm_supported;
 diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
-index 1f86eba3f9..2e362c8faa 100644
+index 7ccc9a1a07..d0544ee119 100644
 --- a/include/hw/i386/pc.h
 +++ b/include/hw/i386/pc.h
-@@ -124,6 +124,9 @@ typedef struct PCMachineClass {
+@@ -125,6 +125,9 @@ struct PCMachineClass {
  
-     /* use PVH to load kernels that support this feature */
-     bool pvh_enabled;
-+   
+     /* create kvmclock device even when KVM PV features are not exposed */
+     bool kvmclock_create_always;
++
 +    /* RH only, see bz 1489800 */
 +    bool pc_rom_ro;
- } PCMachineClass;
+ };
  
  #define TYPE_PC_MACHINE "generic-pc-machine"
-@@ -300,6 +303,36 @@ extern const size_t pc_compat_1_5_len;
+@@ -280,6 +283,48 @@ extern const size_t pc_compat_1_5_len;
  extern GlobalProperty pc_compat_1_4[];
  extern const size_t pc_compat_1_4_len;
  
 +extern GlobalProperty pc_rhel_compat[];
 +extern const size_t pc_rhel_compat_len;
 +
++extern GlobalProperty pc_rhel_8_4_compat[];
++extern const size_t pc_rhel_8_4_compat_len;
++
++extern GlobalProperty pc_rhel_8_3_compat[];
++extern const size_t pc_rhel_8_3_compat_len;
++
++extern GlobalProperty pc_rhel_8_2_compat[];
++extern const size_t pc_rhel_8_2_compat_len;
++
 +extern GlobalProperty pc_rhel_8_1_compat[];
 +extern const size_t pc_rhel_8_1_compat_len;
 +
@@ -835,34 +1207,18 @@ index 1f86eba3f9..2e362c8faa 100644
 +
 +extern GlobalProperty pc_rhel_7_0_compat[];
 +extern const size_t pc_rhel_7_0_compat_len;
++
++extern GlobalProperty hw_compat_4_2_extra[];
++extern const size_t hw_compat_4_2_extra_len;
 +
  /* Helper for setting model-id for CPU models that changed model-id
   * depending on QEMU versions up to QEMU 2.4.
   */
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index 1b7880ae3a..790db778ab 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -1829,11 +1829,17 @@ static CPUCaches epyc_cache_info = {
- 
- static X86CPUDefinition builtin_x86_defs[] = {
-     {
-+        /* qemu64 is the default CPU model for all *-rhel7.* machine-types.
-+         * The default on RHEL-6 was cpu64-rhel6.
-+         * libvirt assumes that qemu64 is the default for _all_ machine-types,
-+         * so we should try to keep qemu64 and cpu64-rhel6 as similar as
-+         * possible.
-+         */
-         .name = "qemu64",
-         .level = 0xd,
-         .vendor = CPUID_VENDOR_AMD,
-         .family = 6,
--        .model = 6,
-+        .model = 13,
-         .stepping = 3,
-         .features[FEAT_1_EDX] = CPUID_SSE2 | CPUID_SSE | CPUID_FXSR |
-             CPUID_MMX | CPUID_CLFLUSH | CPUID_PSE36 | CPUID_PAT | CPUID_CMOV |
-@@ -3932,6 +3938,7 @@ static PropValue kvm_default_props[] = {
+diff --git a/target/i386/kvm/kvm-cpu.c b/target/i386/kvm/kvm-cpu.c
+index d95028018e..7b004065ae 100644
+--- a/target/i386/kvm/kvm-cpu.c
++++ b/target/i386/kvm/kvm-cpu.c
+@@ -131,6 +131,7 @@ static PropValue kvm_default_props[] = {
      { "acpi", "off" },
      { "monitor", "off" },
      { "svm", "off" },
@@ -870,11 +1226,11 @@ index 1b7880ae3a..790db778ab 100644
      { NULL, NULL },
  };
  
-diff --git a/target/i386/kvm.c b/target/i386/kvm.c
-index 1d10046a6c..86d9a1f364 100644
---- a/target/i386/kvm.c
-+++ b/target/i386/kvm.c
-@@ -3079,6 +3079,7 @@ static int kvm_get_msrs(X86CPU *cpu)
+diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
+index 5a698bde19..a668f521ac 100644
+--- a/target/i386/kvm/kvm.c
++++ b/target/i386/kvm/kvm.c
+@@ -3336,6 +3336,7 @@ static int kvm_get_msrs(X86CPU *cpu)
      struct kvm_msr_entry *msrs = cpu->kvm_msr_buf->entries;
      int ret, i;
      uint64_t mtrr_top_bits;
@@ -882,7 +1238,7 @@ index 1d10046a6c..86d9a1f364 100644
  
      kvm_msr_buf_reset(cpu);
  
-@@ -3388,6 +3389,9 @@ static int kvm_get_msrs(X86CPU *cpu)
+@@ -3665,6 +3666,9 @@ static int kvm_get_msrs(X86CPU *cpu)
              break;
          case MSR_KVM_ASYNC_PF_EN:
              env->async_pf_en_msr = msrs[i].data;
@@ -890,8 +1246,31 @@ index 1d10046a6c..86d9a1f364 100644
 +                env->async_pf_en_msr &= ~(1ULL << 2);
 +            }
              break;
-         case MSR_KVM_PV_EOI_EN:
-             env->pv_eoi_en_msr = msrs[i].data;
+         case MSR_KVM_ASYNC_PF_INT:
+             env->async_pf_int_msr = msrs[i].data;
+diff --git a/tests/qtest/pvpanic-test.c b/tests/qtest/pvpanic-test.c
+index 6dcad2db49..580c2c43d2 100644
+--- a/tests/qtest/pvpanic-test.c
++++ b/tests/qtest/pvpanic-test.c
+@@ -17,7 +17,7 @@ static void test_panic_nopause(void)
+     QDict *response, *data;
+     QTestState *qts;
+ 
+-    qts = qtest_init("-device pvpanic -action panic=none");
++    qts = qtest_init("-M q35 -device pvpanic -action panic=none");
+ 
+     val = qtest_inb(qts, 0x505);
+     g_assert_cmpuint(val, ==, 3);
+@@ -40,7 +40,8 @@ static void test_panic(void)
+     QDict *response, *data;
+     QTestState *qts;
+ 
+-    qts = qtest_init("-device pvpanic -action panic=pause");
++    /* RHEL: Use q35 */
++    qts = qtest_init("-M q35 -device pvpanic -action panic=pause");
+ 
+     val = qtest_inb(qts, 0x505);
+     g_assert_cmpuint(val, ==, 3);
 -- 
-2.21.0
+2.27.0
 

SOURCES/0012-Enable-make-check.patch

@@ -1,6 +1,6 @@
-From 154215041df085271a780a2989f4f481226e3e34 Mon Sep 17 00:00:00 2001
+From 740a2dd943a2e0fcd41a9cd8eb94a136f8f49fa2 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
-Date: Fri, 19 Oct 2018 13:48:41 +0200
+Date: Wed, 2 Sep 2020 09:39:41 +0200
 Subject: Enable make check
 
 Fixing tests after device disabling and machine types changes and enabling
@@ -22,74 +22,112 @@ Rebase changes (4.1.0-rc1):
 Rebase changes (4.2.0-rc0):
 - partially disable hd-geo-test (requires lsi53c895a)
 
+Rebase changes (5.1.0-rc1):
+- Disable qtest/q35-test (uses upstream machine types)
+- Do not run iotests on make checka
+- Enabled iotests 071 and 099
+
+Rebase changes (5.2.0 rc0):
+- Disable cdrom tests (unsupported devices) on x86_64
+- disable fuzz test
+
+Rebase changes (6.0.0):
+- Disabled xlnx-can-test
+- Disable pxb-pcie subtest for bios-table-test
+- Replace qtest usage of upstream q35 machine type with pc-q35-rhel8.4.0
+- Not run cdrom-test on aarch64
+
+Rebase changes (6.1.0):
+- Remove unnecessary test disabling changes
+
+Rebase changes (weekly-211006):
+- New handling for bios-table-test (disabled downstream)
+
 Merged patches (4.0.0):
 - f7ffd13 Remove 7 qcow2 and luks iotests that are taking > 25 sec to run during the fast train build proce
 
 Merged patches (4.1.0-rc0):
 - 41288ff redhat: Remove raw iotest 205
-
-Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
- redhat/qemu-kvm.spec.template |  2 +-
- tests/Makefile.include        | 10 +++++-----
- tests/boot-serial-test.c      |  6 +++++-
- tests/cpu-plug-test.c         |  4 ++--
- tests/e1000-test.c            |  2 ++
- tests/hd-geo-test.c           |  4 ++++
- tests/prom-env-test.c         |  4 ++++
- tests/qemu-iotests/051        | 12 ++++++------
- tests/qemu-iotests/group      |  4 ++--
- tests/test-x86-cpuid-compat.c |  2 ++
- tests/usb-hcd-xhci-test.c     |  4 ++++
- 11 files changed, 37 insertions(+), 17 deletions(-)
+ redhat/qemu-kvm.spec.template       |  2 +-
+ tests/qemu-iotests/051              |  8 ++++----
+ tests/qtest/bios-tables-test.c      |  5 ++++-
+ tests/qtest/boot-serial-test.c      |  6 +++++-
+ tests/qtest/cdrom-test.c            |  4 ++++
+ tests/qtest/cpu-plug-test.c         |  4 ++--
+ tests/qtest/fuzz-e1000e-test.c      |  2 +-
+ tests/qtest/fuzz-virtio-scsi-test.c |  2 +-
+ tests/qtest/hd-geo-test.c           |  4 ++++
+ tests/qtest/lpc-ich9-test.c         |  2 +-
+ tests/qtest/meson.build             | 13 ++++---------
+ tests/qtest/prom-env-test.c         |  4 ++++
+ tests/qtest/test-x86-cpuid-compat.c |  2 ++
+ tests/qtest/usb-hcd-xhci-test.c     |  4 ++++
+ 14 files changed, 41 insertions(+), 21 deletions(-)
 
-diff --git a/tests/Makefile.include b/tests/Makefile.include
-index b483790cf3..53bdbdfee0 100644
---- a/tests/Makefile.include
-+++ b/tests/Makefile.include
-@@ -172,7 +172,7 @@ check-qtest-i386-y += tests/ide-test$(EXESUF)
- check-qtest-i386-y += tests/ahci-test$(EXESUF)
- check-qtest-i386-y += tests/hd-geo-test$(EXESUF)
- check-qtest-i386-y += tests/boot-order-test$(EXESUF)
--check-qtest-i386-y += tests/bios-tables-test$(EXESUF)
-+#check-qtest-i386-y += tests/bios-tables-test$(EXESUF)
- check-qtest-i386-$(CONFIG_SGA) += tests/boot-serial-test$(EXESUF)
- check-qtest-i386-$(CONFIG_SLIRP) += tests/pxe-test$(EXESUF)
- check-qtest-i386-y += tests/rtc-test$(EXESUF)
-@@ -230,7 +230,7 @@ check-qtest-mips64el-$(CONFIG_VGA) += tests/display-vga-test$(EXESUF)
- check-qtest-moxie-y += tests/boot-serial-test$(EXESUF)
+diff --git a/tests/qemu-iotests/051 b/tests/qemu-iotests/051
+index 1d2fa93a11..c8a2815f54 100755
+--- a/tests/qemu-iotests/051
++++ b/tests/qemu-iotests/051
+@@ -174,9 +174,9 @@ run_qemu -drive if=virtio
+ case "$QEMU_DEFAULT_MACHINE" in
+     pc)
+         run_qemu -drive if=none,id=disk -device ide-cd,drive=disk
+-        run_qemu -drive if=none,id=disk -device lsi53c895a -device scsi-cd,drive=disk
++#        run_qemu -drive if=none,id=disk -device lsi53c895a -device scsi-cd,drive=disk
+         run_qemu -drive if=none,id=disk -device ide-hd,drive=disk
+-        run_qemu -drive if=none,id=disk -device lsi53c895a -device scsi-hd,drive=disk
++#        run_qemu -drive if=none,id=disk -device lsi53c895a -device scsi-hd,drive=disk
+         ;;
+      *)
+         ;;
+@@ -225,9 +225,9 @@ run_qemu -drive file="$TEST_IMG",if=virtio,readonly=on
+ case "$QEMU_DEFAULT_MACHINE" in
+     pc)
+         run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device ide-cd,drive=disk
+-        run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device lsi53c895a -device scsi-cd,drive=disk
++#        run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device lsi53c895a -device scsi-cd,drive=disk
+         run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device ide-hd,drive=disk
+-        run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device lsi53c895a -device scsi-hd,drive=disk
++#        run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device lsi53c895a -device scsi-hd,drive=disk
+         ;;
+      *)
+         ;;
+diff --git a/tests/qtest/bios-tables-test.c b/tests/qtest/bios-tables-test.c
+index 258874167e..16d8304cde 100644
+--- a/tests/qtest/bios-tables-test.c
++++ b/tests/qtest/bios-tables-test.c
+@@ -1372,6 +1372,7 @@ static void test_acpi_virt_tcg_numamem(void)
  
- check-qtest-ppc-$(CONFIG_ISA_TESTDEV) = tests/endianness-test$(EXESUF)
--check-qtest-ppc-y += tests/boot-order-test$(EXESUF)
-+#check-qtest-ppc-y += tests/boot-order-test$(EXESUF)
- check-qtest-ppc-y += tests/prom-env-test$(EXESUF)
- check-qtest-ppc-y += tests/drive_del-test$(EXESUF)
- check-qtest-ppc-y += tests/boot-serial-test$(EXESUF)
-@@ -244,8 +244,8 @@ check-qtest-ppc64-$(CONFIG_PSERIES) += tests/rtas-test$(EXESUF)
- check-qtest-ppc64-$(CONFIG_SLIRP) += tests/pxe-test$(EXESUF)
- check-qtest-ppc64-$(CONFIG_USB_UHCI) += tests/usb-hcd-uhci-test$(EXESUF)
- check-qtest-ppc64-$(CONFIG_USB_XHCI_NEC) += tests/usb-hcd-xhci-test$(EXESUF)
--check-qtest-ppc64-$(CONFIG_SLIRP) += tests/test-netfilter$(EXESUF)
--check-qtest-ppc64-$(CONFIG_POSIX) += tests/test-filter-mirror$(EXESUF)
-+#check-qtest-ppc64-$(CONFIG_SLIRP) += tests/test-netfilter$(EXESUF)
-+#check-qtest-ppc64-$(CONFIG_POSIX) += tests/test-filter-mirror$(EXESUF)
- check-qtest-ppc64-$(CONFIG_RTL8139_PCI) += tests/test-filter-redirector$(EXESUF)
- check-qtest-ppc64-$(CONFIG_VGA) += tests/display-vga-test$(EXESUF)
- check-qtest-ppc64-y += tests/numa-test$(EXESUF)
-@@ -291,7 +291,7 @@ check-qtest-s390x-$(CONFIG_SLIRP) += tests/test-netfilter$(EXESUF)
- check-qtest-s390x-$(CONFIG_POSIX) += tests/test-filter-mirror$(EXESUF)
- check-qtest-s390x-$(CONFIG_POSIX) += tests/test-filter-redirector$(EXESUF)
- check-qtest-s390x-y += tests/drive_del-test$(EXESUF)
--check-qtest-s390x-y += tests/device-plug-test$(EXESUF)
-+#check-qtest-s390x-y += tests/device-plug-test$(EXESUF)
- check-qtest-s390x-y += tests/virtio-ccw-test$(EXESUF)
- check-qtest-s390x-y += tests/cpu-plug-test$(EXESUF)
- check-qtest-s390x-y += tests/migration-test$(EXESUF)
-diff --git a/tests/boot-serial-test.c b/tests/boot-serial-test.c
-index d3a54a0ba5..33ce72b89c 100644
---- a/tests/boot-serial-test.c
-+++ b/tests/boot-serial-test.c
-@@ -108,19 +108,23 @@ static testdef_t tests[] = {
+ }
+ 
++#if 0 /* Disabled for Red Hat Enterprise Linux */
+ static void test_acpi_virt_tcg_pxb(void)
+ {
+     test_data data = {
+@@ -1403,6 +1404,7 @@ static void test_acpi_virt_tcg_pxb(void)
+ 
+     free_test_data(&data);
+ }
++#endif
+ 
+ static void test_acpi_tcg_acpi_hmat(const char *machine)
+ {
+@@ -1644,7 +1646,8 @@ int main(int argc, char *argv[])
+             qtest_add_func("acpi/virt", test_acpi_virt_tcg);
+             qtest_add_func("acpi/virt/numamem", test_acpi_virt_tcg_numamem);
+             qtest_add_func("acpi/virt/memhp", test_acpi_virt_tcg_memhp);
+-            qtest_add_func("acpi/virt/pxb", test_acpi_virt_tcg_pxb);
++            /* Disabled for Red Hat Enterprise Linux
++            qtest_add_func("acpi/virt/pxb", test_acpi_virt_tcg_pxb); */
+             qtest_add_func("acpi/virt/oem-fields", test_acpi_oem_fields_virt);
+         }
+     }
+diff --git a/tests/qtest/boot-serial-test.c b/tests/qtest/boot-serial-test.c
+index 83828ba270..294476b959 100644
+--- a/tests/qtest/boot-serial-test.c
++++ b/tests/qtest/boot-serial-test.c
+@@ -148,19 +148,23 @@ static testdef_t tests[] = {
      { "ppc", "g3beige", "", "PowerPC,750" },
      { "ppc", "mac99", "", "PowerPC,G4" },
      { "ppc", "sam460ex", "-m 256", "DRAM:  256 MiB" },
@@ -99,7 +137,7 @@ index d3a54a0ba5..33ce72b89c 100644
      { "ppc64", "mac99", "", "PowerPC,970FX" },
 +#endif
      { "ppc64", "pseries",
-       "-machine cap-cfpc=broken,cap-sbbc=broken,cap-ibs=broken",
+       "-machine " PSERIES_DEFAULT_CAPABILITIES,
        "Open Firmware" },
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
      { "ppc64", "powernv8", "", "OPAL" },
@@ -114,11 +152,47 @@ index d3a54a0ba5..33ce72b89c 100644
      { "x86_64", "q35", "-device sga", "SGABIOS" },
      { "sparc", "LX", "", "TMS390S10" },
      { "sparc", "SS-4", "", "MB86904" },
-diff --git a/tests/cpu-plug-test.c b/tests/cpu-plug-test.c
-index 30e514bbfb..a04beae1c6 100644
---- a/tests/cpu-plug-test.c
-+++ b/tests/cpu-plug-test.c
-@@ -185,8 +185,8 @@ static void add_pseries_test_case(const char *mname)
+diff --git a/tests/qtest/cdrom-test.c b/tests/qtest/cdrom-test.c
+index 5af944a5fb..69d9bac38a 100644
+--- a/tests/qtest/cdrom-test.c
++++ b/tests/qtest/cdrom-test.c
+@@ -140,6 +140,7 @@ static void add_x86_tests(void)
+         qtest_add_data_func("cdrom/boot/isapc", "-M isapc "
+                             "-drive if=ide,media=cdrom,file=", test_cdboot);
+     }
++#if 0  /* Disabled for Red Hat Enterprise Linux */
+     qtest_add_data_func("cdrom/boot/am53c974",
+                         "-device am53c974 -device scsi-cd,drive=cd1 "
+                         "-drive if=none,id=cd1,format=raw,file=", test_cdboot);
+@@ -155,6 +156,7 @@ static void add_x86_tests(void)
+     qtest_add_data_func("cdrom/boot/megasas-gen2", "-M q35 "
+                         "-device megasas-gen2 -device scsi-cd,drive=cd1 "
+                         "-blockdev file,node-name=cd1,filename=", test_cdboot);
++#endif
+ }
+ 
+ static void add_s390x_tests(void)
+@@ -220,6 +222,7 @@ int main(int argc, char **argv)
+             "magnum", "malta", "pica61", NULL
+         };
+         add_cdrom_param_tests(mips64machines);
++#if 0 /* Disabled for Red Hat Enterprise Linux */
+     } else if (g_str_equal(arch, "arm") || g_str_equal(arch, "aarch64")) {
+         const char *armmachines[] = {
+             "realview-eb", "realview-eb-mpcore", "realview-pb-a8",
+@@ -227,6 +230,7 @@ int main(int argc, char **argv)
+             "vexpress-a9", "virt", NULL
+         };
+         add_cdrom_param_tests(armmachines);
++#endif
+     } else {
+         const char *nonemachine[] = { "none", NULL };
+         add_cdrom_param_tests(nonemachine);
+diff --git a/tests/qtest/cpu-plug-test.c b/tests/qtest/cpu-plug-test.c
+index a1c689414b..a8f076711c 100644
+--- a/tests/qtest/cpu-plug-test.c
++++ b/tests/qtest/cpu-plug-test.c
+@@ -110,8 +110,8 @@ static void add_pseries_test_case(const char *mname)
      char *path;
      PlugTestData *data;
  
@@ -129,27 +203,37 @@ index 30e514bbfb..a04beae1c6 100644
          return;
      }
      data = g_new(PlugTestData, 1);
-diff --git a/tests/e1000-test.c b/tests/e1000-test.c
-index c387984ef6..c89112d6f8 100644
---- a/tests/e1000-test.c
-+++ b/tests/e1000-test.c
-@@ -22,9 +22,11 @@ struct QE1000 {
+diff --git a/tests/qtest/fuzz-e1000e-test.c b/tests/qtest/fuzz-e1000e-test.c
+index 66229e6096..947fba73b7 100644
+--- a/tests/qtest/fuzz-e1000e-test.c
++++ b/tests/qtest/fuzz-e1000e-test.c
+@@ -17,7 +17,7 @@ static void test_lp1879531_eth_get_rss_ex_dst_addr(void)
+ {
+     QTestState *s;
  
- static const char *models[] = {
-     "e1000",
-+#if 0 /* Disabled for Red Hat Enterprise Linux */
-     "e1000-82540em",
-     "e1000-82544gc",
-     "e1000-82545em",
-+#endif
- };
+-    s = qtest_init("-nographic -monitor none -serial none -M pc-q35-5.0");
++    s = qtest_init("-nographic -monitor none -serial none -M pc-q35-rhel8.4.0");
  
- static void *e1000_get_driver(void *obj, const char *interface)
-diff --git a/tests/hd-geo-test.c b/tests/hd-geo-test.c
-index 7e86c5416c..cc068bad87 100644
---- a/tests/hd-geo-test.c
-+++ b/tests/hd-geo-test.c
-@@ -732,6 +732,7 @@ static void test_override_ide(void)
+     qtest_outl(s, 0xcf8, 0x80001010);
+     qtest_outl(s, 0xcfc, 0xe1020000);
+diff --git a/tests/qtest/fuzz-virtio-scsi-test.c b/tests/qtest/fuzz-virtio-scsi-test.c
+index aaf6d10e18..43727d62ac 100644
+--- a/tests/qtest/fuzz-virtio-scsi-test.c
++++ b/tests/qtest/fuzz-virtio-scsi-test.c
+@@ -19,7 +19,7 @@ static void test_mmio_oob_from_memory_region_cache(void)
+ {
+     QTestState *s;
+ 
+-    s = qtest_init("-M pc-q35-5.2 -display none -m 512M "
++    s = qtest_init("-M pc-q35-rhel8.4.0 -display none -m 512M "
+                    "-device virtio-scsi,num_queues=8,addr=03.0 ");
+ 
+     qtest_outl(s, 0xcf8, 0x80001811);
+diff --git a/tests/qtest/hd-geo-test.c b/tests/qtest/hd-geo-test.c
+index 113126ae06..999ef2aace 100644
+--- a/tests/qtest/hd-geo-test.c
++++ b/tests/qtest/hd-geo-test.c
+@@ -737,6 +737,7 @@ static void test_override_ide(void)
      test_override(args, expected);
  }
  
@@ -157,7 +241,7 @@ index 7e86c5416c..cc068bad87 100644
  static void test_override_scsi(void)
  {
      TestArgs *args = create_args();
-@@ -776,6 +777,7 @@ static void test_override_scsi_2_controllers(void)
+@@ -781,6 +782,7 @@ static void test_override_scsi_2_controllers(void)
      add_scsi_disk(args, 3, 1, 0, 1, 2, 0, 1, 0);
      test_override(args, expected);
  }
@@ -165,7 +249,7 @@ index 7e86c5416c..cc068bad87 100644
  
  static void test_override_virtio_blk(void)
  {
-@@ -951,9 +953,11 @@ int main(int argc, char **argv)
+@@ -960,9 +962,11 @@ int main(int argc, char **argv)
      qtest_add_func("hd-geo/ide/device/user/chst", test_ide_device_user_chst);
      if (have_qemu_img()) {
          qtest_add_func("hd-geo/override/ide", test_override_ide);
@@ -177,11 +261,83 @@ index 7e86c5416c..cc068bad87 100644
          qtest_add_func("hd-geo/override/virtio_blk", test_override_virtio_blk);
          qtest_add_func("hd-geo/override/zero_chs", test_override_zero_chs);
          qtest_add_func("hd-geo/override/scsi_hot_unplug",
-diff --git a/tests/prom-env-test.c b/tests/prom-env-test.c
-index 61bc1d1e7b..028d45c7d7 100644
---- a/tests/prom-env-test.c
-+++ b/tests/prom-env-test.c
-@@ -88,10 +88,14 @@ int main(int argc, char *argv[])
+diff --git a/tests/qtest/lpc-ich9-test.c b/tests/qtest/lpc-ich9-test.c
+index fe0bef9980..7a9d51579b 100644
+--- a/tests/qtest/lpc-ich9-test.c
++++ b/tests/qtest/lpc-ich9-test.c
+@@ -15,7 +15,7 @@ static void test_lp1878642_pci_bus_get_irq_level_assert(void)
+ {
+     QTestState *s;
+ 
+-    s = qtest_init("-M pc-q35-5.0 "
++    s = qtest_init("-M pc-q35-rhel8.4.0 "
+                    "-nographic -monitor none -serial none");
+ 
+     qtest_outl(s, 0xcf8, 0x8000f840); /* PMBASE */
+diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
+index c9d8458062..049e06c057 100644
+--- a/tests/qtest/meson.build
++++ b/tests/qtest/meson.build
+@@ -68,7 +68,6 @@ qtests_i386 = \
+   (config_all_devices.has_key('CONFIG_RTL8139_PCI') ? ['rtl8139-test'] : []) +              \
+   (config_all_devices.has_key('CONFIG_E1000E_PCI_EXPRESS') ? ['fuzz-e1000e-test'] : []) +   \
+   (config_all_devices.has_key('CONFIG_ESP_PCI') ? ['am53c974-test'] : []) +                 \
+-  (unpack_edk2_blobs ? ['bios-tables-test'] : []) +                                         \
+   qtests_pci +                                                                              \
+   ['fdc-test',
+    'ide-test',
+@@ -81,7 +80,6 @@ qtests_i386 = \
+    'drive_del-test',
+    'tco-test',
+    'cpu-plug-test',
+-   'q35-test',
+    'vmgenid-test',
+    'migration-test',
+    'test-x86-cpuid-compat',
+@@ -130,17 +128,15 @@ qtests_mips64el = \
+ 
+ qtests_ppc = \
+   (config_all_devices.has_key('CONFIG_ISA_TESTDEV') ? ['endianness-test'] : []) +            \
+-  (config_all_devices.has_key('CONFIG_M48T59') ? ['m48t59-test'] : []) +                     \
+-  ['boot-order-test', 'prom-env-test', 'boot-serial-test']                 \
++  (config_all_devices.has_key('CONFIG_M48T59') ? ['m48t59-test'] : [])
+ 
+ qtests_ppc64 = \
+   (config_all_devices.has_key('CONFIG_PSERIES') ? ['device-plug-test'] : []) +               \
+   (config_all_devices.has_key('CONFIG_POWERNV') ? ['pnv-xscom-test'] : []) +                 \
+   (config_all_devices.has_key('CONFIG_PSERIES') ? ['rtas-test'] : []) +                      \
+-  (slirp.found() ? ['pxe-test', 'test-netfilter'] : []) +              \
++  (slirp.found() ? ['pxe-test'] : []) +              \
+   (config_all_devices.has_key('CONFIG_USB_UHCI') ? ['usb-hcd-uhci-test'] : []) +             \
+   (config_all_devices.has_key('CONFIG_USB_XHCI_NEC') ? ['usb-hcd-xhci-test'] : []) +         \
+-  (config_host.has_key('CONFIG_POSIX') ? ['test-filter-mirror'] : []) +                      \
+   qtests_pci + ['migration-test', 'numa-test', 'cpu-plug-test', 'drive_del-test']
+ 
+ qtests_sh4 = (config_all_devices.has_key('CONFIG_ISA_TESTDEV') ? ['endianness-test'] : [])
+@@ -186,8 +182,8 @@ qtests_aarch64 = \
+   ['arm-cpu-features',
+    'numa-test',
+    'boot-serial-test',
+-   'xlnx-can-test',
+-   'fuzz-xlnx-dp-test',
++#   'xlnx-can-test',
++#   'fuzz-xlnx-dp-test',
+    'migration-test']
+ 
+ qtests_s390x = \
+@@ -196,7 +192,6 @@ qtests_s390x = \
+   (config_host.has_key('CONFIG_POSIX') ? ['test-filter-redirector'] : []) +                     \
+   ['boot-serial-test',
+    'drive_del-test',
+-   'device-plug-test',
+    'virtio-ccw-test',
+    'cpu-plug-test',
+    'migration-test']
+diff --git a/tests/qtest/prom-env-test.c b/tests/qtest/prom-env-test.c
+index f41d80154a..f8dc478ce8 100644
+--- a/tests/qtest/prom-env-test.c
++++ b/tests/qtest/prom-env-test.c
+@@ -89,10 +89,14 @@ int main(int argc, char *argv[])
      if (!strcmp(arch, "ppc")) {
          add_tests(ppc_machines);
      } else if (!strcmp(arch, "ppc64")) {
@@ -196,68 +352,12 @@ index 61bc1d1e7b..028d45c7d7 100644
      } else if (!strcmp(arch, "sparc")) {
          add_tests(sparc_machines);
      } else if (!strcmp(arch, "sparc64")) {
-diff --git a/tests/qemu-iotests/051 b/tests/qemu-iotests/051
-index 53bcdbc911..b387e0c233 100755
---- a/tests/qemu-iotests/051
-+++ b/tests/qemu-iotests/051
-@@ -181,11 +181,11 @@ run_qemu -drive if=virtio
- case "$QEMU_DEFAULT_MACHINE" in
-     pc)
-         run_qemu -drive if=none,id=disk -device ide-cd,drive=disk
--        run_qemu -drive if=none,id=disk -device lsi53c895a -device scsi-cd,drive=disk
-+#        run_qemu -drive if=none,id=disk -device lsi53c895a -device scsi-cd,drive=disk
-         run_qemu -drive if=none,id=disk -device ide-drive,drive=disk
-         run_qemu -drive if=none,id=disk -device ide-hd,drive=disk
--        run_qemu -drive if=none,id=disk -device lsi53c895a -device scsi-disk,drive=disk
--        run_qemu -drive if=none,id=disk -device lsi53c895a -device scsi-hd,drive=disk
-+#        run_qemu -drive if=none,id=disk -device lsi53c895a -device scsi-disk,drive=disk
-+#        run_qemu -drive if=none,id=disk -device lsi53c895a -device scsi-hd,drive=disk
-         ;;
-      *)
-         ;;
-@@ -234,11 +234,11 @@ run_qemu -drive file="$TEST_IMG",if=virtio,readonly=on
- case "$QEMU_DEFAULT_MACHINE" in
-     pc)
-         run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device ide-cd,drive=disk
--        run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device lsi53c895a -device scsi-cd,drive=disk
-+#        run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device lsi53c895a -device scsi-cd,drive=disk
-         run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device ide-drive,drive=disk
-         run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device ide-hd,drive=disk
--        run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device lsi53c895a -device scsi-disk,drive=disk
--        run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device lsi53c895a -device scsi-hd,drive=disk
-+#        run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device lsi53c895a -device scsi-disk,drive=disk
-+#        run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device lsi53c895a -device scsi-hd,drive=disk
-         ;;
-      *)
-         ;;
-diff --git a/tests/qemu-iotests/group b/tests/qemu-iotests/group
-index 6b10a6a762..06cc734b26 100644
---- a/tests/qemu-iotests/group
-+++ b/tests/qemu-iotests/group
-@@ -92,7 +92,7 @@
- 068 rw quick
- 069 rw auto quick
- 070 rw quick
--071 rw auto quick
-+# 071 rw auto quick -- requires whitelisted blkverify
- 072 rw auto quick
- 073 rw auto quick
- 074 rw auto quick
-@@ -120,7 +120,7 @@
- 096 rw quick
- 097 rw auto backing
- 098 rw auto backing quick
--099 rw auto quick
-+# 099 rw auto quick  -- requires whitelisted blkverify
- # 100 was removed, do not reuse
- 101 rw quick
- 102 rw quick
-diff --git a/tests/test-x86-cpuid-compat.c b/tests/test-x86-cpuid-compat.c
-index 772287bdb4..e7c075ed98 100644
---- a/tests/test-x86-cpuid-compat.c
-+++ b/tests/test-x86-cpuid-compat.c
+diff --git a/tests/qtest/test-x86-cpuid-compat.c b/tests/qtest/test-x86-cpuid-compat.c
+index f28848e06e..6b2fd398a2 100644
+--- a/tests/qtest/test-x86-cpuid-compat.c
++++ b/tests/qtest/test-x86-cpuid-compat.c
 @@ -300,6 +300,7 @@ int main(int argc, char **argv)
-                    "-cpu 486,xlevel2=0xC0000002,+xstore",
+                    "-cpu 486,xlevel2=0xC0000002,xstore=on",
                     "xlevel2", 0xC0000002);
  
 +#if 0 /* Disabled in Red Hat Enterprise Linux */
@@ -266,16 +366,16 @@ index 772287bdb4..e7c075ed98 100644
  
 @@ -350,6 +351,7 @@ int main(int argc, char **argv)
      add_cpuid_test("x86/cpuid/xlevel-compat/pc-i440fx-2.4/npt-on",
-                    "-machine pc-i440fx-2.4 -cpu SandyBridge,+npt",
+                    "-machine pc-i440fx-2.4 -cpu SandyBridge,svm=on,npt=on",
                     "xlevel", 0x80000008);
 +#endif
  
      /* Test feature parsing */
      add_feature_test("x86/cpuid/features/plus",
-diff --git a/tests/usb-hcd-xhci-test.c b/tests/usb-hcd-xhci-test.c
+diff --git a/tests/qtest/usb-hcd-xhci-test.c b/tests/qtest/usb-hcd-xhci-test.c
 index 10ef9d2a91..3855873050 100644
---- a/tests/usb-hcd-xhci-test.c
-+++ b/tests/usb-hcd-xhci-test.c
+--- a/tests/qtest/usb-hcd-xhci-test.c
++++ b/tests/qtest/usb-hcd-xhci-test.c
 @@ -21,6 +21,7 @@ static void test_xhci_hotplug(void)
      usb_test_hotplug(global_qtest, "xhci", "1", NULL);
  }
@@ -303,5 +403,5 @@ index 10ef9d2a91..3855873050 100644
  
      qtest_start("-device nec-usb-xhci,id=xhci"
 -- 
-2.21.0
+2.27.0
 

SOURCES/0013-vfio-cap-number-of-devices-that-can-be-assigned.patch

@@ -1,4 +1,4 @@
-From de433da59448eaad4ac1b902d07d57b57f922aff Mon Sep 17 00:00:00 2001
+From e9ebc159a9acf108e1ec6f622be3f256cf14aba7 Mon Sep 17 00:00:00 2001
 From: Bandan Das <bsd@redhat.com>
 Date: Tue, 3 Dec 2013 20:05:13 +0100
 Subject: vfio: cap number of devices that can be assigned
@@ -32,20 +32,16 @@ Merged patches (2.9.0):
 
  Merged patches (4.1.0-rc3):
 - 2b89558 vfio: increase the cap on number of assigned devices to 64
-
-(cherry picked from commit 9fa3c9fc6dfcde76d80db1aa601b2d577f72ceec)
-(cherry picked from commit 3cb35556dc7d994f203d732fe952f95fcdb03c0a)
-Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
  hw/vfio/pci.c | 29 ++++++++++++++++++++++++++++-
  hw/vfio/pci.h |  1 +
  2 files changed, 29 insertions(+), 1 deletion(-)
 
 diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
-index c8534d3035..309535f306 100644
+index 7b45353ce2..eb725a3aee 100644
 --- a/hw/vfio/pci.c
 +++ b/hw/vfio/pci.c
-@@ -47,6 +47,9 @@
+@@ -45,6 +45,9 @@
  
  #define TYPE_VFIO_PCI_NOHOTPLUG "vfio-pci-nohotplug"
  
@@ -55,7 +51,7 @@ index c8534d3035..309535f306 100644
  static void vfio_disable_interrupts(VFIOPCIDevice *vdev);
  static void vfio_mmap_set_enabled(VFIOPCIDevice *vdev, bool enabled);
  
-@@ -2722,9 +2725,30 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
+@@ -2807,9 +2810,30 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
      ssize_t len;
      struct stat st;
      int groupid;
@@ -87,7 +83,7 @@ index c8534d3035..309535f306 100644
      if (!vdev->vbasedev.sysfsdev) {
          if (!(~vdev->host.domain || ~vdev->host.bus ||
                ~vdev->host.slot || ~vdev->host.function)) {
-@@ -3167,6 +3191,9 @@ static Property vfio_pci_dev_properties[] = {
+@@ -3246,6 +3270,9 @@ static Property vfio_pci_dev_properties[] = {
      DEFINE_PROP_BOOL("x-no-kvm-msix", VFIOPCIDevice, no_kvm_msix, false),
      DEFINE_PROP_BOOL("x-no-geforce-quirks", VFIOPCIDevice,
                       no_geforce_quirks, false),
@@ -98,10 +94,10 @@ index c8534d3035..309535f306 100644
                       false),
      DEFINE_PROP_BOOL("x-no-vfio-ioeventfd", VFIOPCIDevice, no_vfio_ioeventfd,
 diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
-index 35626cd63e..0cd4803aee 100644
+index 64777516d1..e0fe6ca97e 100644
 --- a/hw/vfio/pci.h
 +++ b/hw/vfio/pci.h
-@@ -135,6 +135,7 @@ typedef struct VFIOPCIDevice {
+@@ -139,6 +139,7 @@ struct VFIOPCIDevice {
      EventNotifier err_notifier;
      EventNotifier req_notifier;
      int (*resetfn)(struct VFIOPCIDevice *);
@@ -110,5 +106,5 @@ index 35626cd63e..0cd4803aee 100644
      uint32_t device_id;
      uint32_t sub_vendor_id;
 -- 
-2.21.0
+2.27.0
 

SOURCES/0014-Add-support-statement-to-help-output.patch

@@ -1,4 +1,4 @@
-From 2754dd8da8975757753fd491985d5e7b36966106 Mon Sep 17 00:00:00 2001
+From b736b0c41dd62ed6f874a7b33ca1d4f9ceab4573 Mon Sep 17 00:00:00 2001
 From: Eduardo Habkost <ehabkost@redhat.com>
 Date: Wed, 4 Dec 2013 18:53:17 +0100
 Subject: Add support statement to -help output
@@ -16,18 +16,15 @@ Add support statement to -help output, reporting direct qemu-kvm usage
 as unsupported by Red Hat, and advising users to use libvirt instead.
 
 Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
-(cherry picked from commit 2a07700936e39856cc9f149c6a6517f0715536a6)
-(cherry picked from commit 5dd2f4706e2fef945771949e59a8fcc1b5452de9)
-Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
- vl.c | 9 +++++++++
+ softmmu/vl.c | 9 +++++++++
  1 file changed, 9 insertions(+)
 
-diff --git a/vl.c b/vl.c
-index 668a34577e..9f3e7e7733 100644
---- a/vl.c
-+++ b/vl.c
-@@ -1822,9 +1822,17 @@ static void version(void)
+diff --git a/softmmu/vl.c b/softmmu/vl.c
+index 620a1f1367..d46b8fb4ab 100644
+--- a/softmmu/vl.c
++++ b/softmmu/vl.c
+@@ -827,9 +827,17 @@ static void version(void)
             QEMU_COPYRIGHT "\n");
  }
  
@@ -45,7 +42,7 @@ index 668a34577e..9f3e7e7733 100644
      printf("usage: %s [options] [disk_image]\n\n"
             "'disk_image' is a raw hard disk image for IDE hard disk 0\n\n",
              error_get_progname());
-@@ -1841,6 +1849,7 @@ static void help(int exitcode)
+@@ -855,6 +863,7 @@ static void help(int exitcode)
             "\n"
             QEMU_HELP_BOTTOM "\n");
  
@@ -54,5 +51,5 @@ index 668a34577e..9f3e7e7733 100644
  }
  
 -- 
-2.21.0
+2.27.0
 

SOURCES/0015-globally-limit-the-maximum-number-of-CPUs.patch

@@ -1,4 +1,4 @@
-From c9c3cf721b0e9e359418f64c2a5121c3f8b5d27a Mon Sep 17 00:00:00 2001
+From 9a7621819821ee88d2f99d6b629fd87aa9a07758 Mon Sep 17 00:00:00 2001
 From: Andrew Jones <drjones@redhat.com>
 Date: Tue, 21 Jan 2014 10:46:52 +0100
 Subject: globally limit the maximum number of CPUs
@@ -25,67 +25,23 @@ Merged patches (2.11.0):
 - 0584216921 Match POWER max cpus to x86
 
 Signed-off-by: Andrew Jones <drjones@redhat.com>
-(cherry picked from commit a4ceb63bdc5cbac19f5f633ec761b9de0dedb55e)
-(cherry picked from commit a1f26d85171b4d554225150053700e93ba6eba10)
 
-redhat: globally limit the maximum number of CPUs
+Merged patches (5.1.0):
+- redhat: globally limit the maximum number of CPUs
+- redhat: remove manual max_cpus limitations for ppc
+- use recommended max vcpu count
 
-RH-Author: David Hildenbrand <david@redhat.com>
-Message-id: <20180109103253.24517-2-david@redhat.com>
-Patchwork-id: 78531
-O-Subject: [RHEL-7.5 qemu-kvm-ma PATCH v2 1/2] redhat: globally limit the maximum number of CPUs
-Bugzilla: 1527449
-RH-Acked-by: David Gibson <dgibson@redhat.com>
-RH-Acked-by: Thomas Huth <thuth@redhat.com>
-RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
-
-Upstream-status: n/a
-
-For RHEL, we support 240, for RHV up to 384 VCPUs. Let's limit this
-globally instead of fixing up all machines. This way, we can easily
-change (increase) the product specific levels later.
-
-Signed-off-by: David Hildenbrand <david@redhat.com>
-Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
-
-redhat: remove manual max_cpus limitations for ppc
-
-RH-Author: David Hildenbrand <david@redhat.com>
-Message-id: <20180109103253.24517-3-david@redhat.com>
-Patchwork-id: 78532
-O-Subject: [RHEL-7.5 qemu-kvm-ma PATCH v2 2/2] redhat: remove manual max_cpus limitations for ppc
-Bugzilla: 1527449
-RH-Acked-by: David Gibson <dgibson@redhat.com>
-RH-Acked-by: Thomas Huth <thuth@redhat.com>
-RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
-
-Upstream-status: n/a
-
-RH-Author: Andrew Jones <drjones@redhat.com>
-Message-id: <1390301212-15344-1-git-send-email-drjones@redhat.com>
-Patchwork-id: 56862
-O-Subject: [RHEL7.0 qemu-kvm PATCH v6] use recommended max vcpu count
-Bugzilla: 998708
-RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
-RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
-RH-Acked-by: Marcelo Tosatti <mtosatti@redhat.com>
-
-The recommended vcpu max limit (KVM_CAP_NR_VCPUS) should be used instead
-of the actual max vcpu limit (KVM_CAP_MAX_VCPUS) to give an error.
-
-This commit matches the limit to current KVM_CAP_NR_VCPUS value.
-
-Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
+Merged patches (5.2.0 rc0):
+- f8a4123 vl: Remove downstream-only MAX_RHEL_CPUS code
 ---
  accel/kvm/kvm-all.c | 12 ++++++++++++
- vl.c                | 18 ++++++++++++++++++
- 2 files changed, 30 insertions(+)
+ 1 file changed, 12 insertions(+)
 
 diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
-index ca00daa2f5..dc3ed7f04e 100644
+index eecd8031cf..8f2a53438f 100644
 --- a/accel/kvm/kvm-all.c
 +++ b/accel/kvm/kvm-all.c
-@@ -1943,6 +1943,18 @@ static int kvm_init(MachineState *ms)
+@@ -2423,6 +2423,18 @@ static int kvm_init(MachineState *ms)
      soft_vcpus_limit = kvm_recommended_vcpus(s);
      hard_vcpus_limit = kvm_max_vcpus(s);
  
@@ -104,49 +60,6 @@ index ca00daa2f5..dc3ed7f04e 100644
      while (nc->name) {
          if (nc->num > soft_vcpus_limit) {
              warn_report("Number of %s cpus requested (%d) exceeds "
-diff --git a/vl.c b/vl.c
-index 9f3e7e7733..1550aa2aaa 100644
---- a/vl.c
-+++ b/vl.c
-@@ -134,6 +134,8 @@ int main(int argc, char **argv)
- 
- #define MAX_VIRTIO_CONSOLES 1
- 
-+#define RHEL_MAX_CPUS 384
-+
- static const char *data_dir[16];
- static int data_dir_idx;
- const char *bios_name = NULL;
-@@ -1339,6 +1341,20 @@ static MachineClass *find_default_machine(GSList *machines)
-     return NULL;
- }
- 
-+/* Maximum number of CPUs limited for Red Hat Enterprise Linux */
-+static void limit_max_cpus_in_machines(void)
-+{
-+    GSList *el, *machines = object_class_get_list(TYPE_MACHINE, false);
-+
-+    for (el = machines; el; el = el->next) {
-+        MachineClass *mc = el->data;
-+
-+        if (mc->max_cpus > RHEL_MAX_CPUS) {
-+            mc->max_cpus = RHEL_MAX_CPUS;
-+        }
-+    }
-+}
-+
- static int machine_help_func(QemuOpts *opts, MachineState *machine)
- {
-     ObjectProperty *prop;
-@@ -3857,6 +3873,8 @@ int main(int argc, char **argv, char **envp)
-                      "mutually exclusive");
-         exit(EXIT_FAILURE);
-     }
-+    /* Maximum number of CPUs limited for Red Hat Enterprise Linux */
-+    limit_max_cpus_in_machines();
- 
-     configure_rtc(qemu_find_opts_singleton("rtc"));
- 
 -- 
-2.21.0
+2.27.0
 

SOURCES/0016-Add-support-for-simpletrace.patch

@@ -1,121 +0,0 @@
-From 26128b3ede339e292a3c50a84e3248af46ecd0ec Mon Sep 17 00:00:00 2001
-From: Miroslav Rezanina <mrezanin@redhat.com>
-Date: Thu, 8 Oct 2015 09:50:17 +0200
-Subject: Add support for simpletrace
-
-As simpletrace is upstream, we just need to properly handle it during rpmbuild.
-
-Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
-
-Rebase notes (3.1.0):
-- Fixed python 2 to python3 switch
-
-Rebase notes (2.9.0):
-- Added group argument for tracetool.py (upstream)
-
-Rebase notes (2.8.0):
-- Changed tracetool.py parameters
-
-Merged patches (2.3.0):
-- db959d6 redhat/qemu-kvm.spec.template: Install qemu-kvm-simpletrace.stp
-- 5292fc3 trace: add SystemTap init scripts for simpletrace bridge
-- eda9e5e simpletrace: install simpletrace.py
-- 85c4c8f trace: add systemtap-initscript README file to RPM
-
-Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
----
- .gitignore                              |  2 ++
- Makefile                                |  4 +++
- README.systemtap                        | 43 +++++++++++++++++++++++++
- redhat/qemu-kvm.spec.template           | 26 ++++++++++++++-
- scripts/systemtap/conf.d/qemu_kvm.conf  |  4 +++
- scripts/systemtap/script.d/qemu_kvm.stp |  1 +
- 6 files changed, 79 insertions(+), 1 deletion(-)
- create mode 100644 README.systemtap
- create mode 100644 scripts/systemtap/conf.d/qemu_kvm.conf
- create mode 100644 scripts/systemtap/script.d/qemu_kvm.stp
-
-diff --git a/Makefile b/Makefile
-index 086727dbb9..4254950f7f 100644
---- a/Makefile
-+++ b/Makefile
-@@ -939,6 +939,10 @@ endif
- 		$(INSTALL_DATA) $(SRC_PATH)/pc-bios/keymaps/$$x "$(DESTDIR)$(qemu_datadir)/keymaps"; \
- 	done
- 	$(INSTALL_DATA) $(BUILD_DIR)/trace-events-all "$(DESTDIR)$(qemu_datadir)/trace-events-all"
-+	$(INSTALL_DIR) "$(DESTDIR)$(qemu_datadir)/systemtap/script.d"
-+	$(INSTALL_DATA) $(SRC_PATH)/scripts/systemtap/script.d/qemu_kvm.stp "$(DESTDIR)$(qemu_datadir)/systemtap/script.d/"
-+	$(INSTALL_DIR) "$(DESTDIR)$(qemu_datadir)/systemtap/conf.d"
-+	$(INSTALL_DATA) $(SRC_PATH)/scripts/systemtap/conf.d/qemu_kvm.conf "$(DESTDIR)$(qemu_datadir)/systemtap/conf.d/"
- 
- .PHONY: ctags
- ctags:
-diff --git a/README.systemtap b/README.systemtap
-new file mode 100644
-index 0000000000..ad913fc990
---- /dev/null
-+++ b/README.systemtap
-@@ -0,0 +1,43 @@
-+QEMU tracing using systemtap-initscript
-+---------------------------------------
-+
-+You can capture QEMU trace data all the time using systemtap-initscript.  This
-+uses SystemTap's flight recorder mode to trace all running guests to a
-+fixed-size buffer on the host.  Old trace entries are overwritten by new
-+entries when the buffer size wraps.
-+
-+1. Install the systemtap-initscript package:
-+  # yum install systemtap-initscript
-+
-+2. Install the systemtap scripts and the conf file:
-+  # cp /usr/share/qemu-kvm/systemtap/script.d/qemu_kvm.stp /etc/systemtap/script.d/
-+  # cp /usr/share/qemu-kvm/systemtap/conf.d/qemu_kvm.conf /etc/systemtap/conf.d/
-+
-+The set of trace events to enable is given in qemu_kvm.stp.  This SystemTap
-+script can be customized to add or remove trace events provided in
-+/usr/share/systemtap/tapset/qemu-kvm-simpletrace.stp.
-+
-+SystemTap customizations can be made to qemu_kvm.conf to control the flight
-+recorder buffer size and whether to store traces in memory only or disk too.
-+See stap(1) for option documentation.
-+
-+3. Start the systemtap service.
-+　# service systemtap start qemu_kvm
-+
-+4. Make the service start at boot time.
-+　# chkconfig systemtap on
-+
-+5. Confirm that the service works.
-+  # service systemtap status qemu_kvm
-+  qemu_kvm is running...
-+
-+When you want to inspect the trace buffer, perform the following steps:
-+
-+1. Dump the trace buffer.
-+  # staprun -A qemu_kvm >/tmp/trace.log
-+
-+2. Start the systemtap service because the preceding step stops the service.
-+  # service systemtap start qemu_kvm
-+
-+3. Translate the trace record to readable format.
-+  # /usr/share/qemu-kvm/simpletrace.py --no-header /usr/share/qemu-kvm/trace-events /tmp/trace.log
-diff --git a/scripts/systemtap/conf.d/qemu_kvm.conf b/scripts/systemtap/conf.d/qemu_kvm.conf
-new file mode 100644
-index 0000000000..372d8160a4
---- /dev/null
-+++ b/scripts/systemtap/conf.d/qemu_kvm.conf
-@@ -0,0 +1,4 @@
-+# Force load uprobes (see BZ#1118352)
-+stap -e 'probe process("/usr/libexec/qemu-kvm").function("main") { printf("") }' -c true
-+
-+qemu_kvm_OPT="-s4" # per-CPU buffer size, in megabytes
-diff --git a/scripts/systemtap/script.d/qemu_kvm.stp b/scripts/systemtap/script.d/qemu_kvm.stp
-new file mode 100644
-index 0000000000..c04abf9449
---- /dev/null
-+++ b/scripts/systemtap/script.d/qemu_kvm.stp
-@@ -0,0 +1 @@
-+probe qemu.kvm.simpletrace.handle_qmp_command,qemu.kvm.simpletrace.monitor_protocol_*,qemu.kvm.simpletrace.migrate_set_state {}
--- 
-2.21.0
-

SOURCES/0016-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch

@@ -0,0 +1,126 @@
+From 0d3fc0b4c5773c6cabb0a58c064475f76eb6ac1e Mon Sep 17 00:00:00 2001
+From: Miroslav Rezanina <mrezanin@redhat.com>
+Date: Wed, 8 Jul 2020 08:35:50 +0200
+Subject: Use qemu-kvm in documentation instead of qemu-system-<arch>
+
+Patchwork-id: 62380
+O-Subject: [RHEV-7.1 qemu-kvm-rhev PATCHv4] Use qemu-kvm in documentation instead of qemu-system-i386
+Bugzilla: 1140620
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Acked-by: Markus Armbruster <armbru@redhat.com>
+RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+
+From: Miroslav Rezanina <mrezanin@redhat.com>
+
+We change the name and location of qemu-kvm binaries. Update documentation
+to reflect this change. Only architectures available in RHEL are updated.
+
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+
+Rebase notes (5.1.0 rc0):
+ - qemu-block-drivers.texi converted to qemu-block-drivers.rst (upstream)
+
+Rebase notes (5.2.0 rc0):
+ - rewrite patch to new docs structure
+---
+ docs/defs.rst.inc              |  4 ++--
+ docs/tools/qemu-trace-stap.rst | 14 +++++++-------
+ qemu-options.hx                | 10 +++++-----
+ 3 files changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/docs/defs.rst.inc b/docs/defs.rst.inc
+index 52d6454b93..d74dbdeca9 100644
+--- a/docs/defs.rst.inc
++++ b/docs/defs.rst.inc
+@@ -9,7 +9,7 @@
+    but the manpages will end up misrendered with following normal text
+    incorrectly in boldface.
+ 
+-.. |qemu_system| replace:: qemu-system-x86_64
+-.. |qemu_system_x86| replace:: qemu-system-x86_64
++.. |qemu_system| replace:: qemu-kvm
++.. |qemu_system_x86| replace:: qemu-kvm
+ .. |I2C| replace:: I\ :sup:`2`\ C
+ .. |I2S| replace:: I\ :sup:`2`\ S
+diff --git a/docs/tools/qemu-trace-stap.rst b/docs/tools/qemu-trace-stap.rst
+index d53073b52b..9e93df084f 100644
+--- a/docs/tools/qemu-trace-stap.rst
++++ b/docs/tools/qemu-trace-stap.rst
+@@ -46,19 +46,19 @@ The following commands are valid:
+   any of the listed names. If no *PATTERN* is given, the all possible
+   probes will be listed.
+ 
+-  For example, to list all probes available in the ``qemu-system-x86_64``
++  For example, to list all probes available in the ``qemu-kvm``
+   binary:
+ 
+   ::
+ 
+-    $ qemu-trace-stap list qemu-system-x86_64
++    $ qemu-trace-stap list qemu-kvm
+ 
+   To filter the list to only cover probes related to QEMU's cryptographic
+   subsystem, in a binary outside ``$PATH``
+ 
+   ::
+ 
+-    $ qemu-trace-stap list /opt/qemu/4.0.0/bin/qemu-system-x86_64 'qcrypto*'
++    $ qemu-trace-stap list /opt/qemu/4.0.0/bin/qemu-kvm 'qcrypto*'
+ 
+ .. option:: run OPTIONS BINARY PATTERN...
+ 
+@@ -90,18 +90,18 @@ The following commands are valid:
+     Restrict the tracing session so that it only triggers for the process
+     identified by *PID*.
+ 
+-  For example, to monitor all processes executing ``qemu-system-x86_64``
++  For example, to monitor all processes executing ``qemu-kvm``
+   as found on ``$PATH``, displaying all I/O related probes:
+ 
+   ::
+ 
+-    $ qemu-trace-stap run qemu-system-x86_64 'qio*'
++    $ qemu-trace-stap run qemu-kvm 'qio*'
+ 
+   To monitor only the QEMU process with PID 1732
+ 
+   ::
+ 
+-    $ qemu-trace-stap run --pid=1732 qemu-system-x86_64 'qio*'
++    $ qemu-trace-stap run --pid=1732 qemu-kvm 'qio*'
+ 
+   To monitor QEMU processes running an alternative binary outside of
+   ``$PATH``, displaying verbose information about setup of the
+@@ -109,7 +109,7 @@ The following commands are valid:
+ 
+   ::
+ 
+-    $ qemu-trace-stap -v run /opt/qemu/4.0.0/qemu-system-x86_64 'qio*'
++    $ qemu-trace-stap -v run /opt/qemu/4.0.0/qemu-kvm 'qio*'
+ 
+ See also
+ --------
+diff --git a/qemu-options.hx b/qemu-options.hx
+index ae2c6dbbfc..94c4a8dbaf 100644
+--- a/qemu-options.hx
++++ b/qemu-options.hx
+@@ -3150,11 +3150,11 @@ SRST
+ 
+     ::
+ 
+-        qemu -m 512 -object memory-backend-file,id=mem,size=512M,mem-path=/hugetlbfs,share=on \
+-             -numa node,memdev=mem \
+-             -chardev socket,id=chr0,path=/path/to/socket \
+-             -netdev type=vhost-user,id=net0,chardev=chr0 \
+-             -device virtio-net-pci,netdev=net0
++        qemu-kvm -m 512 -object memory-backend-file,id=mem,size=512M,mem-path=/hugetlbfs,share=on \
++                 -numa node,memdev=mem \
++                 -chardev socket,id=chr0,path=/path/to/socket \
++                 -netdev type=vhost-user,id=net0,chardev=chr0 \
++                 -device virtio-net-pci,netdev=net0
+ 
+ ``-netdev vhost-vdpa,vhostdev=/path/to/dev``
+     Establish a vhost-vdpa netdev.
+-- 
+2.27.0
+

SOURCES/0017-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch

@@ -1,118 +0,0 @@
-From 97ed62562b883c384346bfef3e1c7e379f03ccab Mon Sep 17 00:00:00 2001
-From: Miroslav Rezanina <mrezanin@redhat.com>
-Date: Fri, 30 Nov 2018 09:11:03 +0100
-Subject: Use qemu-kvm in documentation instead of qemu-system-<arch>
-
-Patchwork-id: 62380
-O-Subject: [RHEV-7.1 qemu-kvm-rhev PATCHv4] Use qemu-kvm in documentation instead of qemu-system-i386
-Bugzilla: 1140620
-RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
-RH-Acked-by: Markus Armbruster <armbru@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-
-From: Miroslav Rezanina <mrezanin@redhat.com>
-
-We change the name and location of qemu-kvm binaries. Update documentation
-to reflect this change. Only architectures available in RHEL are updated.
-
-Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
-Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
----
- docs/qemu-block-drivers.texi |  2 +-
- docs/qemu-cpu-models.texi    |  2 +-
- qemu-doc.texi                |  6 +++---
- qemu-options.hx              | 16 ++++++++--------
- 4 files changed, 13 insertions(+), 13 deletions(-)
-
-diff --git a/docs/qemu-block-drivers.texi b/docs/qemu-block-drivers.texi
-index 2c7ea49c32..5d0afb3dee 100644
---- a/docs/qemu-block-drivers.texi
-+++ b/docs/qemu-block-drivers.texi
-@@ -2,7 +2,7 @@
- QEMU block driver reference manual
- @c man end
- 
--@set qemu_system qemu-system-x86_64
-+@set qemu_system qemu-kvm
- 
- @c man begin DESCRIPTION
- 
-diff --git a/docs/qemu-cpu-models.texi b/docs/qemu-cpu-models.texi
-index f88a1def0d..c82cf8fab7 100644
---- a/docs/qemu-cpu-models.texi
-+++ b/docs/qemu-cpu-models.texi
-@@ -2,7 +2,7 @@
- QEMU / KVM CPU model configuration
- @c man end
- 
--@set qemu_system_x86 qemu-system-x86_64
-+@set qemu_system_x86 qemu-kvm
- 
- @c man begin DESCRIPTION
- 
-diff --git a/qemu-doc.texi b/qemu-doc.texi
-index 3ddf5c0a68..d460f8d2c0 100644
---- a/qemu-doc.texi
-+++ b/qemu-doc.texi
-@@ -11,8 +11,8 @@
- @paragraphindent 0
- @c %**end of header
- 
--@set qemu_system qemu-system-x86_64
--@set qemu_system_x86 qemu-system-x86_64
-+@set qemu_system qemu-kvm
-+@set qemu_system_x86 qemu-kvm
- 
- @ifinfo
- @direntry
-@@ -1827,7 +1827,7 @@ Set the initial VGA graphic mode. The default is 800x600x32.
- Set OpenBIOS variables in NVRAM, for example:
- 
- @example
--qemu-system-ppc -prom-env 'auto-boot?=false' \
-+qemu-kvm -prom-env 'auto-boot?=false' \
-  -prom-env 'boot-device=hd:2,\yaboot' \
-  -prom-env 'boot-args=conf=hd:2,\yaboot.conf'
- @end example
-diff --git a/qemu-options.hx b/qemu-options.hx
-index fc17aca631..df1d27b6f2 100644
---- a/qemu-options.hx
-+++ b/qemu-options.hx
-@@ -2737,11 +2737,11 @@ be created for multiqueue vhost-user.
- 
- Example:
- @example
--qemu -m 512 -object memory-backend-file,id=mem,size=512M,mem-path=/hugetlbfs,share=on \
--     -numa node,memdev=mem \
--     -chardev socket,id=chr0,path=/path/to/socket \
--     -netdev type=vhost-user,id=net0,chardev=chr0 \
--     -device virtio-net-pci,netdev=net0
-+qemu-kvm -m 512 -object memory-backend-file,id=mem,size=512M,mem-path=/hugetlbfs,share=on \
-+         -numa node,memdev=mem \
-+         -chardev socket,id=chr0,path=/path/to/socket \
-+         -netdev type=vhost-user,id=net0,chardev=chr0 \
-+         -device virtio-net-pci,netdev=net0
- @end example
- 
- @item -netdev hubport,id=@var{id},hubid=@var{hubid}[,netdev=@var{nd}]
-@@ -3631,14 +3631,14 @@ ETEXI
- 
- DEF("realtime", HAS_ARG, QEMU_OPTION_realtime,
-     "-realtime [mlock=on|off]\n"
--    "                run qemu with realtime features\n"
-+    "                run qemu-kvm with realtime features\n"
-     "                mlock=on|off controls mlock support (default: on)\n",
-     QEMU_ARCH_ALL)
- STEXI
- @item -realtime mlock=on|off
- @findex -realtime
--Run qemu with realtime features.
--mlocking qemu and guest memory can be enabled via @option{mlock=on}
-+Run qemu-kvm with realtime features.
-+mlocking qemu-kvm and guest memory can be enabled via @option{mlock=on}
- (enabled by default).
- ETEXI
- 
--- 
-2.21.0
-

SOURCES/0017-virtio-scsi-Reject-scsi-cd-if-data-plane-enabled-RHE.patch

@@ -1,4 +1,4 @@
-From 3fab8f5e8a9e190c1ed6916ac13c7c4d65e874b7 Mon Sep 17 00:00:00 2001
+From d95768c039a2bf6b68422f83a8d55dad41bd3181 Mon Sep 17 00:00:00 2001
 From: Fam Zheng <famz@redhat.com>
 Date: Wed, 14 Jun 2017 15:37:01 +0200
 Subject: virtio-scsi: Reject scsi-cd if data plane enabled [RHEL only]
@@ -36,20 +36,17 @@ crashing.
 
 Signed-off-by: Fam Zheng <famz@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
-(cherry picked from commit b0caf00bbc35c7d89e02999bdce86e1f867728e8)
-(cherry picked from commit c9c4f117d8b507c2f86035c282d537c0a327364f)
-(cherry picked from commit 5d586bb2543337f0ff172c6ce942dba3acbcedff)
 Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 ---
  hw/scsi/virtio-scsi.c | 9 +++++++++
  1 file changed, 9 insertions(+)
 
 diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
-index e8b2b64d09..54108c0056 100644
+index 51fd09522a..a35257c35a 100644
 --- a/hw/scsi/virtio-scsi.c
 +++ b/hw/scsi/virtio-scsi.c
-@@ -808,6 +808,15 @@ static void virtio_scsi_hotplug(HotplugHandler *hotplug_dev, DeviceState *dev,
-     SCSIDevice *sd = SCSI_DEVICE(dev);
+@@ -896,6 +896,15 @@ static void virtio_scsi_hotplug(HotplugHandler *hotplug_dev, DeviceState *dev,
+     AioContext *old_context;
      int ret;
  
 +    /* XXX: Remove this check once block backend is capable of handling
@@ -65,5 +62,5 @@ index e8b2b64d09..54108c0056 100644
          if (blk_op_is_blocked(sd->conf.blk, BLOCK_OP_TYPE_DATAPLANE, errp)) {
              return;
 -- 
-2.21.0
+2.27.0
 

SOURCES/0018-BZ1653590-Require-at-least-64kiB-pages-for-downstrea.patch

@@ -1,4 +1,4 @@
-From 148e9e80a3a430615b552075082fad22d007d851 Mon Sep 17 00:00:00 2001
+From 92bb62c47eab021f8dabecd09b5fbc1706e6a29c Mon Sep 17 00:00:00 2001
 From: David Gibson <dgibson@redhat.com>
 Date: Wed, 6 Feb 2019 03:58:56 +0000
 Subject: BZ1653590: Require at least 64kiB pages for downstream guests & hosts
@@ -32,10 +32,10 @@ Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
  1 file changed, 7 insertions(+)
 
 diff --git a/hw/ppc/spapr_caps.c b/hw/ppc/spapr_caps.c
-index 481dfd2a27..805f38533e 100644
+index ed7c077a0d..48a8efe678 100644
 --- a/hw/ppc/spapr_caps.c
 +++ b/hw/ppc/spapr_caps.c
-@@ -351,12 +351,19 @@ void spapr_check_pagesize(SpaprMachineState *spapr, hwaddr pagesize,
+@@ -332,12 +332,19 @@ bool spapr_check_pagesize(SpaprMachineState *spapr, hwaddr pagesize,
  static void cap_hpt_maxpagesize_apply(SpaprMachineState *spapr,
                                        uint8_t val, Error **errp)
  {
@@ -56,5 +56,5 @@ index 481dfd2a27..805f38533e 100644
      spapr_check_pagesize(spapr, qemu_minrampagesize(), errp);
  }
 -- 
-2.21.0
+2.27.0
 

SOURCES/0018-usb-xhci-Fix-PCI-capability-order.patch

@@ -1,96 +0,0 @@
-From b13a7d3527c5c91e7a50236de30a2244b8453911 Mon Sep 17 00:00:00 2001
-From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
-Date: Fri, 5 May 2017 19:06:14 +0200
-Subject: usb-xhci: Fix PCI capability order
-
-RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
-Message-id: <20170505190614.15987-2-dgilbert@redhat.com>
-Patchwork-id: 75038
-O-Subject: [RHEL-7.4 qemu-kvm-rhev PATCH 1/1] usb-xhci: Fix PCI capability order
-Bugzilla: 1447874
-RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
-RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-RH-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
-RH-Acked-by: Juan Quintela <quintela@redhat.com>
-
-From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
-
-Upstream commit 1108b2f8a9 in 2.7.0 changed the order
-of the PCI capability chain in the XHCI pci device in the case
-where the device has the PCIe endpoint capability (i.e. only
-older machine types, pc-i440fx-2.0 upstream, pc-i440fx-rhel7.0.0
-apparently for us).
-
-Changing the order breaks migration compatibility; fixing this
-upstream would mean breaking the same case going from 2.7.0->current
-that currently works 2.7.0->2.9.0 - so upstream it's a choice
-of two breakages.
-
-Since we never released 2.7.0/2.8.0 we can fix this downstream.
-
-This reverts the order so that we create the capabilities in the
-order:
-   PCIe
-   MSI
-   MSI-X
-
-The symptom is:
-qemu-kvm: get_pci_config_device: Bad config data: i=0x71 read: a0 device: 0 cmask: ff wmask: 0 w1cmask:0
-qemu-kvm: Failed to load PCIDevice:config
-qemu-kvm: Failed to load xhci:parent_obj
-qemu-kvm: error while loading state for instance 0x0 of device '0000:00:0d.0/xhci'
-qemu-kvm: load of migration failed: Invalid argument
-
-Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
-Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
-
---
-Rebase notes (2.9.0):
-- Change in assert condition (upstream)
-
-(cherry picked from commit aad727a5ecde1ad4935eb8427604d4df5a1f1f35)
-(cherry picked from commit 2dd7402227e77d748a7375233ac9e7feab244bda)
-
-Conflicts:
-	hw/usb/hcd-xhci.c
-
-(cherry picked from commit a42f86dc906cc7d2c16d02bf125ed76847b469cb)
-(cherry picked from commit 992ab2e4f6e15d3e51bc716763aa8d6f45c6d29d)
-Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
----
- hw/usb/hcd-xhci.c | 12 ++++++------
- 1 file changed, 6 insertions(+), 6 deletions(-)
-
-diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
-index 8fed2eedd6..d2b9744030 100644
---- a/hw/usb/hcd-xhci.c
-+++ b/hw/usb/hcd-xhci.c
-@@ -3403,6 +3403,12 @@ static void usb_xhci_realize(struct PCIDevice *dev, Error **errp)
-         xhci->max_pstreams_mask = 0;
-     }
- 
-+    if (pci_bus_is_express(pci_get_bus(dev)) ||
-+        xhci_get_flag(xhci, XHCI_FLAG_FORCE_PCIE_ENDCAP)) {
-+        ret = pcie_endpoint_cap_init(dev, 0xa0);
-+        assert(ret > 0);
-+    }
-+
-     if (xhci->msi != ON_OFF_AUTO_OFF) {
-         ret = msi_init(dev, 0x70, xhci->numintrs, true, false, &err);
-         /* Any error other than -ENOTSUP(board's MSI support is broken)
-@@ -3451,12 +3457,6 @@ static void usb_xhci_realize(struct PCIDevice *dev, Error **errp)
-                      PCI_BASE_ADDRESS_SPACE_MEMORY|PCI_BASE_ADDRESS_MEM_TYPE_64,
-                      &xhci->mem);
- 
--    if (pci_bus_is_express(pci_get_bus(dev)) ||
--        xhci_get_flag(xhci, XHCI_FLAG_FORCE_PCIE_ENDCAP)) {
--        ret = pcie_endpoint_cap_init(dev, 0xa0);
--        assert(ret > 0);
--    }
--
-     if (xhci->msix != ON_OFF_AUTO_OFF) {
-         /* TODO check for errors, and should fail when msix=on */
-         msix_init(dev, xhci->numintrs,
--- 
-2.21.0
-

SOURCES/0019-compat-Update-hw_compat_rhel_8_5.patch

@@ -0,0 +1,53 @@
+From a9b5da617c29f48199cbea08d6a1c083877dce10 Mon Sep 17 00:00:00 2001
+From: Laurent Vivier <lvivier@redhat.com>
+Date: Mon, 15 Nov 2021 14:22:29 +0100
+Subject: compat: Update hw_compat_rhel_8_5
+
+RH-Author: Laurent Vivier <lvivier@redhat.com>
+RH-MergeRequest: 66: redhat: Update pseries-rhel8.5.0 machine type
+RH-Commit: [1/2] 232f2ad2b29d250fbdb8fcea9d814704c575ba2b
+RH-Bugzilla: 2022608
+RH-Acked-by: Eric Auger <eric.auger@redhat.com>
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Greg Kurz <gkurz@redhat.com>
+
+Add properties from hw_compat_6_1 as it already includes the ones from
+hw_compat_6_0. Add a lately added property from 6.0 too.
+
+Signed-off-by: Laurent Vivier <lvivier@redhat.com>
+--
+Rebase notes (6.2.0 rc3):
+- Included compatc changes introduced in RC2
+---
+ hw/core/machine.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/hw/core/machine.c b/hw/core/machine.c
+index 62febde5aa..736c765c30 100644
+--- a/hw/core/machine.c
++++ b/hw/core/machine.c
+@@ -38,7 +38,7 @@
+ #include "hw/virtio/virtio-pci.h"
+ 
+ /*
+- * Mostly the same as hw_compat_6_0
++ * Mostly the same as hw_compat_6_0 and hw_compat_6_1
+  */
+ GlobalProperty hw_compat_rhel_8_5[] = {
+     /* hw_compat_rhel_8_5 from hw_compat_6_0 */
+@@ -51,6 +51,12 @@ GlobalProperty hw_compat_rhel_8_5[] = {
+     { "e1000", "init-vet", "off" },
+     /* hw_compat_rhel_8_5 from hw_compat_6_0 */
+     { "e1000e", "init-vet", "off" },
++    /* hw_compat_rhel_8_5 from hw_compat_6_0 */
++    { "vhost-vsock-device", "seqpacket", "off" },
++    /* hw_compat_rhel_8_5 from hw_compat_6_1 */
++    { "vhost-user-vsock-device", "seqpacket", "off" },
++    /* hw_compat_rhel_8_5 from hw_compat_6_1 */
++    { "nvme-ns", "shared", "off" },
+ };
+ const size_t hw_compat_rhel_8_5_len = G_N_ELEMENTS(hw_compat_rhel_8_5);
+ 
+-- 
+2.27.0
+

SOURCES/0020-redhat-Update-pseries-rhel8.5.0-machine-type.patch

@@ -0,0 +1,43 @@
+From 82358c35f04f026820b3907069a6c19cd95b654d Mon Sep 17 00:00:00 2001
+From: Laurent Vivier <lvivier@redhat.com>
+Date: Mon, 15 Nov 2021 14:25:33 +0100
+Subject: redhat: Update pseries-rhel8.5.0 machine type
+
+RH-Author: Laurent Vivier <lvivier@redhat.com>
+RH-MergeRequest: 66: redhat: Update pseries-rhel8.5.0 machine type
+RH-Commit: [2/2] 36f7ad1ea56baaaecb139875ad0a90a6470196be
+RH-Bugzilla: 2022608
+RH-Acked-by: Eric Auger <eric.auger@redhat.com>
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Greg Kurz <gkurz@redhat.com>
+`
+We don't introduce a new machine type for rhel8.6.0 but we need
+to keep compatibility with rhel8.5.0 machine type.
+
+Signed-off-by: Laurent Vivier <lvivier@redhat.com>
+---
+ hw/ppc/spapr.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
+index cace86028d..2f27888d8a 100644
+--- a/hw/ppc/spapr.c
++++ b/hw/ppc/spapr.c
+@@ -5177,10 +5177,14 @@ static void spapr_machine_rhel_default_class_options(MachineClass *mc)
+ 
+ static void spapr_machine_rhel850_class_options(MachineClass *mc)
+ {
++    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
++
+     /* The default machine type must apply the RHEL specific defaults */
+     spapr_machine_rhel_default_class_options(mc);
+     compat_props_add(mc->compat_props, hw_compat_rhel_8_5,
+                      hw_compat_rhel_8_5_len);
++    smc->pre_6_2_numa_affinity = true;
++    mc->smp_props.prefer_sockets = true;
+ }
+ 
+ DEFINE_SPAPR_MACHINE(rhel850, "rhel8.5.0", true);
+-- 
+2.27.0
+

SOURCES/0021-Using-ip_deq-after-m_free-might-read-pointers-from-a.patch

@@ -1,61 +0,0 @@
-From ab9ebc29bb9bb142e73a160750a451d40bfe9746 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
-Date: Mon, 16 Sep 2019 17:07:00 +0100
-Subject: Using ip_deq after m_free might read pointers from an allocation
- reuse.
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: <20190916170700.647-2-philmd@redhat.com>
-Patchwork-id: 90470
-O-Subject: [RHEL-AV-8.1.0 qemu-kvm PATCH 1/1] Using ip_deq after m_free might read pointers from an allocation reuse.
-Bugzilla: 1749737
-RH-Acked-by: Danilo de Paula <ddepaula@redhat.com>
-RH-Acked-by: John Snow <jsnow@redhat.com>
-
-From: Samuel Thibault <samuel.thibault@ens-lyon.org>
-
-This would be difficult to exploit, but that is still related with
-CVE-2019-14378 which generates fragmented IP packets that would trigger this
-issue and at least produce a DoS.
-
-Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
-(cherry picked from libslirp commit c59279437eda91841b9d26079c70b8a540d41204)
-Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-
-Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
----
- slirp/src/ip_input.c | 7 +++++--
- 1 file changed, 5 insertions(+), 2 deletions(-)
-
-diff --git a/slirp/src/ip_input.c b/slirp/src/ip_input.c
-index 8c75d91495..df1c846ade 100644
---- a/slirp/src/ip_input.c
-+++ b/slirp/src/ip_input.c
-@@ -292,6 +292,7 @@ static struct ip *ip_reass(Slirp *slirp, struct ip *ip, struct ipq *fp)
-      */
-     while (q != (struct ipasfrag *)&fp->frag_link &&
-            ip->ip_off + ip->ip_len > q->ipf_off) {
-+        struct ipasfrag *prev;
-         i = (ip->ip_off + ip->ip_len) - q->ipf_off;
-         if (i < q->ipf_len) {
-             q->ipf_len -= i;
-@@ -299,9 +300,11 @@ static struct ip *ip_reass(Slirp *slirp, struct ip *ip, struct ipq *fp)
-             m_adj(dtom(slirp, q), i);
-             break;
-         }
-+        prev = q;
-         q = q->ipf_next;
--        m_free(dtom(slirp, q->ipf_prev));
--        ip_deq(q->ipf_prev);
-+        ip_deq(prev);
-+        m_free(dtom(slirp, prev));
-+
-     }
- 
- insert:
--- 
-2.21.0
-

SOURCES/0021-redhat-virt-rhel8.5.0-Update-machine-type-compatibil.patch

@@ -0,0 +1,51 @@
+From ce73e939b993cc6be170cdb5d3f2068270593f2b Mon Sep 17 00:00:00 2001
+From: Eric Auger <eric.auger@redhat.com>
+Date: Tue, 16 Nov 2021 17:03:07 +0100
+Subject: redhat: virt-rhel8.5.0: Update machine type compatibility for QEMU
+ 6.2.0 update
+
+RH-Author: Eric Auger <eric.auger@redhat.com>
+RH-MergeRequest: 75: redhat: virt-rhel8.5.0: Update machine type compatibility for QEMU 6.2.0 update
+RH-Commit: [21/21] f027d13654944e3d34e3356affe7af952eec2bed
+RH-Bugzilla: 2022607
+RH-Acked-by: Gavin Shan <gshan@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Acked-by: Andrew Jones <drjones@redhat.com>
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
+
+To keep compatibility with 8.5-AV machine type we need to
+turn few new options on by default:
+smp_props.prefer_sockets, no_cpu_topology, no_tcg_its
+
+TESTED: migrate from rhel-av-8.5.0 to rhel-8.6.0 and vice-versa
+with upstream fix: 33a0c404fb  hw/intc/arm_gicv3_its: Revert version
+increments in vmstate_its
+
+Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ hw/arm/virt.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/hw/arm/virt.c b/hw/arm/virt.c
+index c77d26ab13..e8941afd01 100644
+--- a/hw/arm/virt.c
++++ b/hw/arm/virt.c
+@@ -3225,8 +3225,13 @@ type_init(rhel_machine_init);
+ 
+ static void rhel850_virt_options(MachineClass *mc)
+ {
++    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
++
+     compat_props_add(mc->compat_props, arm_rhel_compat, arm_rhel_compat_len);
+     compat_props_add(mc->compat_props, hw_compat_rhel_8_5, hw_compat_rhel_8_5_len);
++    mc->smp_props.prefer_sockets = true;
++    vmc->no_cpu_topology = true;
++    vmc->no_tcg_its = true;
+ }
+ DEFINE_RHEL_MACHINE_AS_LATEST(8, 5, 0)
+ 
+-- 
+2.27.0
+

SOURCES/0022-Fix-virtio-net-pci-vectors-compat.patch

@@ -0,0 +1,45 @@
+From f9643b6934657292aae0b830627b1e5f9b8cbaa1 Mon Sep 17 00:00:00 2001
+From: Eduardo Habkost <ehabkost@redhat.com>
+Date: Tue, 19 Oct 2021 13:17:06 -0400
+Subject: Fix virtio-net-pci* "vectors" compat
+
+RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
+RH-MergeRequest: 77: 8.6/6.2 mt fixes
+RH-Commit: [21/23] 8ad581932275d2698a99f31bec40b14f1dbd3d2e
+RH-Bugzilla: 2026443
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+
+hw_compat_rhel_8_4 has an issue: it affects only "virtio-net-pci"
+but not "virtio-net-pci-transitional" and
+"virtio-net-pci-non-transitional".  The solution is to use the
+"virtio-net-pci-base" type in compat_props.
+
+An equivalent fix will be submitted for hw_compat_5_2 upstream.
+
+Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
+(cherry picked from commit d45823ab0d0138b2fbaf2ed1e1896d2052f3ccb3)
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ hw/core/machine.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/hw/core/machine.c b/hw/core/machine.c
+index 736c765c30..024b025fc2 100644
+--- a/hw/core/machine.c
++++ b/hw/core/machine.c
+@@ -71,7 +71,11 @@ GlobalProperty hw_compat_rhel_8_4[] = {
+     /* hw_compat_rhel_8_4 from hw_compat_5_2 */
+     { "virtio-blk-device", "report-discard-granularity", "off" },
+     /* hw_compat_rhel_8_4 from hw_compat_5_2 */
+-    { "virtio-net-pci", "vectors", "3"},
++    /*
++     * Upstream incorrectly had "virtio-net-pci" instead of "virtio-net-pci-base",
++     * (https://bugzilla.redhat.com/show_bug.cgi?id=1999141)
++     */
++    { "virtio-net-pci-base", "vectors", "3"},
+ };
+ const size_t hw_compat_rhel_8_4_len = G_N_ELEMENTS(hw_compat_rhel_8_4);
+ 
+-- 
+2.27.0
+

SOURCES/0023-x86-rhel-machine-types-Add-pc_rhel_8_5_compat.patch

@@ -0,0 +1,73 @@
+From 7ad8814e583dcc7dc23e3e8398570243b8f176a1 Mon Sep 17 00:00:00 2001
+From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
+Date: Tue, 23 Nov 2021 17:57:42 +0000
+Subject: x86/rhel machine types: Add pc_rhel_8_5_compat
+
+RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
+RH-MergeRequest: 77: 8.6/6.2 mt fixes
+RH-Commit: [22/23] 8bf555c5d78f344b97ffd5c888c7a7bed592d9d0
+RH-Bugzilla: 2026443
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+
+Add pc_rhel_8_5_compat as the merge of pc_compat_6_1 and pc_compat_6_0
+(since 8.5 was based on 6.0).
+
+Note, x-keep-pci-slot-hpc flipped back and forward, leaving it out
+looks like it leaves us with the original.
+
+Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ hw/i386/pc.c         | 21 +++++++++++++++++++++
+ include/hw/i386/pc.h |  3 +++
+ 2 files changed, 24 insertions(+)
+
+diff --git a/hw/i386/pc.c b/hw/i386/pc.c
+index e8109954ca..4c08a1971c 100644
+--- a/hw/i386/pc.c
++++ b/hw/i386/pc.c
+@@ -387,6 +387,27 @@ GlobalProperty pc_rhel_compat[] = {
+ };
+ const size_t pc_rhel_compat_len = G_N_ELEMENTS(pc_rhel_compat);
+ 
++GlobalProperty pc_rhel_8_5_compat[] = {
++    /* pc_rhel_8_5_compat from pc_compat_6_0 */
++    { "qemu64" "-" TYPE_X86_CPU, "family", "6" },
++    /* pc_rhel_8_5_compat from pc_compat_6_0 */
++    { "qemu64" "-" TYPE_X86_CPU, "model", "6" },
++    /* pc_rhel_8_5_compat from pc_compat_6_0 */
++    { "qemu64" "-" TYPE_X86_CPU, "stepping", "3" },
++    /* pc_rhel_8_5_compat from pc_compat_6_0 */
++    { TYPE_X86_CPU, "x-vendor-cpuid-only", "off" },
++    /* pc_rhel_8_5_compat from pc_compat_6_0 */
++    { "ICH9-LPC", ACPI_PM_PROP_ACPI_PCIHP_BRIDGE, "off" },
++
++    /* pc_rhel_8_5_compat from pc_compat_6_1 */
++    { TYPE_X86_CPU, "hv-version-id-build", "0x1bbc" },
++    /* pc_rhel_8_5_compat from pc_compat_6_1 */
++    { TYPE_X86_CPU, "hv-version-id-major", "0x0006" },
++    /* pc_rhel_8_5_compat from pc_compat_6_1 */
++    { TYPE_X86_CPU, "hv-version-id-minor", "0x0001" },
++};
++const size_t pc_rhel_8_5_compat_len = G_N_ELEMENTS(pc_rhel_8_5_compat);
++
+ GlobalProperty pc_rhel_8_4_compat[] = {
+     /* pc_rhel_8_4_compat from pc_compat_5_2 */
+     { "ICH9-LPC", "x-smi-cpu-hotunplug", "off" },
+diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
+index d0544ee119..9e8bfb69f8 100644
+--- a/include/hw/i386/pc.h
++++ b/include/hw/i386/pc.h
+@@ -286,6 +286,9 @@ extern const size_t pc_compat_1_4_len;
+ extern GlobalProperty pc_rhel_compat[];
+ extern const size_t pc_rhel_compat_len;
+ 
++extern GlobalProperty pc_rhel_8_5_compat[];
++extern const size_t pc_rhel_8_5_compat_len;
++
+ extern GlobalProperty pc_rhel_8_4_compat[];
+ extern const size_t pc_rhel_8_4_compat_len;
+ 
+-- 
+2.27.0
+

SOURCES/0024-x86-rhel-machine-types-Wire-compat-into-q35-and-i440.patch

@@ -0,0 +1,54 @@
+From 7bd99eebadfdbea6a76585b526e7cab1ee8b1fde Mon Sep 17 00:00:00 2001
+From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
+Date: Tue, 23 Nov 2021 18:07:49 +0000
+Subject: x86/rhel machine types: Wire compat into q35 and i440fx
+
+RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
+RH-MergeRequest: 77: 8.6/6.2 mt fixes
+RH-Commit: [23/23] fc3861aeccc943b434231193ef45ffbc0b3cf6c6
+RH-Bugzilla: 2026443
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+
+Wire the pc_rhel_8_5 compat data into both piix and q35
+to keep the existing machine types compatible.
+
+Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ hw/i386/pc_piix.c | 4 ++++
+ hw/i386/pc_q35.c  | 4 ++++
+ 2 files changed, 8 insertions(+)
+
+diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
+index 2885edffe9..37fab00733 100644
+--- a/hw/i386/pc_piix.c
++++ b/hw/i386/pc_piix.c
+@@ -1040,6 +1040,10 @@ static void pc_machine_rhel760_options(MachineClass *m)
+     pcmc->kvmclock_create_always = false;
+     /* From pc_i440fx_5_1_machine_options() */
+     pcmc->pci_root_uid = 1;
++    compat_props_add(m->compat_props, hw_compat_rhel_8_5,
++                     hw_compat_rhel_8_5_len);
++    compat_props_add(m->compat_props, pc_rhel_8_5_compat,
++                     pc_rhel_8_5_compat_len);
+     compat_props_add(m->compat_props, hw_compat_rhel_8_4,
+                      hw_compat_rhel_8_4_len);
+     compat_props_add(m->compat_props, pc_rhel_8_4_compat,
+diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
+index c67418b6a9..78876e1101 100644
+--- a/hw/i386/pc_q35.c
++++ b/hw/i386/pc_q35.c
+@@ -658,6 +658,10 @@ static void pc_q35_machine_rhel850_options(MachineClass *m)
+     m->desc = "RHEL-8.5.0 PC (Q35 + ICH9, 2009)";
+     pcmc->smbios_stream_product = "RHEL-AV";
+     pcmc->smbios_stream_version = "8.5.0";
++    compat_props_add(m->compat_props, hw_compat_rhel_8_5,
++                     hw_compat_rhel_8_5_len);
++    compat_props_add(m->compat_props, pc_rhel_8_5_compat,
++                     pc_rhel_8_5_compat_len);
+ }
+ 
+ DEFINE_PC_MACHINE(q35_rhel850, "pc-q35-rhel8.5.0", pc_q35_init_rhel850,
+-- 
+2.27.0
+

SOURCES/0025-redhat-Add-s390x-machine-type-compatibility-handling.patch

@@ -0,0 +1,58 @@
+From 265a57f2955b7f0b65e3f57f89aa1ff2541d3f73 Mon Sep 17 00:00:00 2001
+From: Thomas Huth <thuth@redhat.com>
+Date: Fri, 26 Nov 2021 09:37:11 +0100
+Subject: redhat: Add s390x machine type compatibility handling for the rebase
+ to v6.2
+
+RH-Author: Thomas Huth <thuth@redhat.com>
+RH-MergeRequest: 80: Add s390x machine type compatibility handling for the rebase to v6.2
+RH-Commit: [26/26] c45cf594604f6dd23954696b9c84d2025e328d11
+RH-Bugzilla: 2022602
+RH-Acked-by: David Hildenbrand <david@redhat.com>
+RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+
+Add compatibility handling for the rhel8.5.0 machine type (and
+recursively older, of course).
+
+Based on the following upstream commits:
+
+ 463e50da8b - s390x/cpumodel: Bump up QEMU model to a stripped-down IBM z14 GA2
+ 30e398f796 - s390x/cpumodel: Add more feature to gen16 default model
+ 4a0af2930a - machine: Prefer cores over sockets in smp parsing since 6.2
+ 2b52619994 - machine: Move smp_prefer_sockets to struct SMPCompatProps
+
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+---
+ hw/s390x/s390-virtio-ccw.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
+index 181856e6cf..cf13c457d6 100644
+--- a/hw/s390x/s390-virtio-ccw.c
++++ b/hw/s390x/s390-virtio-ccw.c
+@@ -1105,11 +1105,21 @@ DEFINE_CCW_MACHINE(2_4, "2.4", false);
+ 
+ static void ccw_machine_rhel850_instance_options(MachineState *machine)
+ {
++    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V6_0 };
++
++    s390_set_qemu_cpu_model(0x2964, 13, 2, qemu_cpu_feat);
++
++    s390_cpudef_featoff_greater(16, 1, S390_FEAT_NNPA);
++    s390_cpudef_featoff_greater(16, 1, S390_FEAT_VECTOR_PACKED_DECIMAL_ENH2);
++    s390_cpudef_featoff_greater(16, 1, S390_FEAT_BEAR_ENH);
++    s390_cpudef_featoff_greater(16, 1, S390_FEAT_RDP);
++    s390_cpudef_featoff_greater(16, 1, S390_FEAT_PAI);
+ }
+ 
+ static void ccw_machine_rhel850_class_options(MachineClass *mc)
+ {
+     compat_props_add(mc->compat_props, hw_compat_rhel_8_5, hw_compat_rhel_8_5_len);
++    mc->smp_props.prefer_sockets = true;
+ }
+ DEFINE_CCW_MACHINE(rhel850, "rhel8.5.0", true);
+ 
+-- 
+2.27.0
+

SOURCES/kvm-ACPI-add-expected-files-for-HMAT-tests-acpihmat.patch

@@ -1,41 +0,0 @@
-From ff8529dcbf86b3a086d64dd630cf6a687603c571 Mon Sep 17 00:00:00 2001
-From: "plai@redhat.com" <plai@redhat.com>
-Date: Thu, 21 May 2020 23:56:55 +0100
-Subject: [PATCH 12/12] ACPI: add expected files for HMAT tests (acpihmat)
-
-RH-Author: plai@redhat.com
-Message-id: <20200521235655.27141-12-plai@redhat.com>
-Patchwork-id: 96742
-O-Subject: [RHEL8.2.1 AV qemu-kvm PATCH 11/11] ACPI: add expected files for HMAT tests (acpihmat)
-Bugzilla: 1600217
-RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
-RH-Acked-by: Eduardo Habkost <ehabkost@redhat.com>
-
-From: "Michael S. Tsirkin" <mst@redhat.com>
-
-Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
-(cherry picked from commit 48892c6c8def6624a0ed57e2bd6c2a0a9878b973)
-Signed-off-by: Paul Lai <plai@redhat.com>
-Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
----
- tests/bios-tables-test-allowed-diff.h | 8 --------
- 1 file changed, 8 deletions(-)
-
-diff --git a/tests/bios-tables-test-allowed-diff.h b/tests/bios-tables-test-allowed-diff.h
-index 3c9e0c9..dfb8523 100644
---- a/tests/bios-tables-test-allowed-diff.h
-+++ b/tests/bios-tables-test-allowed-diff.h
-@@ -1,9 +1 @@
- /* List of comma-separated changed AML files to ignore */
--"tests/data/acpi/pc/APIC.acpihmat",
--"tests/data/acpi/pc/SRAT.acpihmat",
--"tests/data/acpi/pc/HMAT.acpihmat",
--"tests/data/acpi/pc/DSDT.acpihmat",
--"tests/data/acpi/q35/APIC.acpihmat",
--"tests/data/acpi/q35/SRAT.acpihmat",
--"tests/data/acpi/q35/HMAT.acpihmat",
--"tests/data/acpi/q35/DSDT.acpihmat",
--- 
-1.8.3.1
-

SOURCES/kvm-Add-dirty-sync-missed-zero-copy-migration-stat.patch

@@ -0,0 +1,87 @@
+From cd49a32e9c9e33efc51652b68180a07683814b4d Mon Sep 17 00:00:00 2001
+From: Leonardo Bras <leobras@redhat.com>
+Date: Mon, 11 Jul 2022 18:11:12 -0300
+Subject: [PATCH 4/9] Add dirty-sync-missed-zero-copy migration stat
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Leonardo Brás <leobras@redhat.com>
+RH-MergeRequest: 201: Zero-copy-send fixes + improvements
+RH-Commit: [4/8] 56cce61cf95aafc8dafae7531b43c166084abfec
+RH-Bugzilla: 2110203
+RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+RH-Acked-by: Peter Xu <peterx@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+
+Signed-off-by: Leonardo Bras <leobras@redhat.com>
+Acked-by: Markus Armbruster <armbru@redhat.com>
+Acked-by: Peter Xu <peterx@redhat.com>
+Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
+Message-Id: <20220711211112.18951-3-leobras@redhat.com>
+Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+(cherry picked from commit cf20c897338067ab4b70a4596fdccaf90c7e29a1)
+Signed-off-by: Leonardo Bras <leobras@redhat.com>
+---
+ migration/migration.c | 2 ++
+ monitor/hmp-cmds.c    | 5 +++++
+ qapi/migration.json   | 7 ++++++-
+ 3 files changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/migration/migration.c b/migration/migration.c
+index e100b30f00..952a26c5c2 100644
+--- a/migration/migration.c
++++ b/migration/migration.c
+@@ -1012,6 +1012,8 @@ static void populate_ram_info(MigrationInfo *info, MigrationState *s)
+     info->ram->normal_bytes = ram_counters.normal * page_size;
+     info->ram->mbps = s->mbps;
+     info->ram->dirty_sync_count = ram_counters.dirty_sync_count;
++    info->ram->dirty_sync_missed_zero_copy =
++            ram_counters.dirty_sync_missed_zero_copy;
+     info->ram->postcopy_requests = ram_counters.postcopy_requests;
+     info->ram->page_size = page_size;
+     info->ram->multifd_bytes = ram_counters.multifd_bytes;
+diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
+index 8c384dc1b2..f7216ab5d0 100644
+--- a/monitor/hmp-cmds.c
++++ b/monitor/hmp-cmds.c
+@@ -305,6 +305,11 @@ void hmp_info_migrate(Monitor *mon, const QDict *qdict)
+             monitor_printf(mon, "postcopy ram: %" PRIu64 " kbytes\n",
+                            info->ram->postcopy_bytes >> 10);
+         }
++        if (info->ram->dirty_sync_missed_zero_copy) {
++            monitor_printf(mon,
++                           "Zero-copy-send fallbacks happened: %" PRIu64 " times\n",
++                           info->ram->dirty_sync_missed_zero_copy);
++        }
+     }
+ 
+     if (info->has_disk) {
+diff --git a/qapi/migration.json b/qapi/migration.json
+index c8ec260ab0..94bc5c69db 100644
+--- a/qapi/migration.json
++++ b/qapi/migration.json
+@@ -55,6 +55,10 @@
+ # @postcopy-bytes: The number of bytes sent during the post-copy phase
+ #                  (since 7.0).
+ #
++# @dirty-sync-missed-zero-copy: Number of times dirty RAM synchronization could
++#                               not avoid copying dirty pages. This is between
++#                               0 and @dirty-sync-count * @multifd-channels.
++#                               (since 7.1)
+ # Since: 0.14
+ ##
+ { 'struct': 'MigrationStats',
+@@ -65,7 +69,8 @@
+            'postcopy-requests' : 'int', 'page-size' : 'int',
+            'multifd-bytes' : 'uint64', 'pages-per-second' : 'uint64',
+            'precopy-bytes' : 'uint64', 'downtime-bytes' : 'uint64',
+-           'postcopy-bytes' : 'uint64' } }
++           'postcopy-bytes' : 'uint64',
++           'dirty-sync-missed-zero-copy' : 'uint64' } }
+ 
+ ##
+ # @XBZRLECacheStats:
+-- 
+2.31.1
+

SOURCES/kvm-Add-mtod_check.patch

@@ -1,68 +0,0 @@
-From 52bf635da30c75d0fdb0a3e7e7b9a2483ca033fc Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
-Date: Thu, 29 Jul 2021 04:55:59 -0400
-Subject: [PATCH 05/14] Add mtod_check()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Marc-André Lureau <marcandre.lureau@redhat.com>
-Message-id: <20210708082537.1550263-2-marcandre.lureau@redhat.com>
-Patchwork-id: 101819
-O-Subject: [RHEL-8.5.0 qemu-kvm PATCH 1/8] Add mtod_check()
-Bugzilla: 1970819 1970835 1970843 1970853
-RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
-RH-Acked-by: Eric Blake <eblake@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-
-From: Marc-André Lureau <marcandre.lureau@redhat.com>
-
-Recent security issues demonstrate the lack of safety care when casting
-a mbuf to a particular structure type. At least, it should check that
-the buffer is large enough. The following patches will make use of this
-function.
-
-Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
-
-(cherry picked from commit 93e645e72a056ec0b2c16e0299fc5c6b94e4ca17)
-Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
-Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
----
- slirp/src/mbuf.c | 11 +++++++++++
- slirp/src/mbuf.h |  1 +
- 2 files changed, 12 insertions(+)
-
-diff --git a/slirp/src/mbuf.c b/slirp/src/mbuf.c
-index 4fd62282a9..6d0653ed3d 100644
---- a/slirp/src/mbuf.c
-+++ b/slirp/src/mbuf.c
-@@ -222,3 +222,14 @@ struct mbuf *dtom(Slirp *slirp, void *dat)
- 
-     return (struct mbuf *)0;
- }
-+
-+void *mtod_check(struct mbuf *m, size_t len)
-+{
-+    if (m->m_len >= len) {
-+        return m->m_data;
-+    }
-+
-+    DEBUG_ERROR("mtod failed");
-+
-+    return NULL;
-+}
-diff --git a/slirp/src/mbuf.h b/slirp/src/mbuf.h
-index 546e7852c5..2015e3232f 100644
---- a/slirp/src/mbuf.h
-+++ b/slirp/src/mbuf.h
-@@ -118,6 +118,7 @@ void m_inc(struct mbuf *, int);
- void m_adj(struct mbuf *, int);
- int m_copy(struct mbuf *, struct mbuf *, int, int);
- struct mbuf *dtom(Slirp *, void *);
-+void *mtod_check(struct mbuf *, size_t len);
- 
- static inline void ifs_init(struct mbuf *ifm)
- {
--- 
-2.27.0
-

SOURCES/kvm-Compress-lines-for-immediate-return.patch

@@ -1,242 +0,0 @@
-From 5cf6dd33456c4e7e2a8849f458ce234fb5bb290c Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Fri, 25 Jun 2021 17:41:03 -0400
-Subject: [PATCH 3/4] Compress lines for immediate return
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-Message-id: <20210625174104.44313-2-kwolf@redhat.com>
-Patchwork-id: 101777
-O-Subject: [RHEL-8.5.0 qemu-kvm PATCH 1/2] Compress lines for immediate return
-Bugzilla: 1970912
-RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Acked-by: Thomas Huth <thuth@redhat.com>
-
-From: Simran Singhal <singhalsimran0@gmail.com>
-
-Compress two lines into a single line if immediate return statement is found.
-
-It also remove variables progress, val, data, ret and sock
-as they are no longer needed.
-
-Remove space between function "mixer_load" and '(' to fix the
-checkpatch.pl error:-
-ERROR: space prohibited between function name and open parenthesis '('
-
-Done using following coccinelle script:
-@@
-local idexpression ret;
-expression e;
-@@
-
--ret =
-+return
-     e;
--return ret;
-
-Signed-off-by: Simran Singhal <singhalsimran0@gmail.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-Id: <20200401165314.GA3213@simran-Inspiron-5558>
-[lv: in handle_aiocb_write_zeroes_unmap() move "int ret" inside the #ifdef]
-Signed-off-by: Laurent Vivier <laurent@vivier.eu>
-(cherry picked from commit b3ac2b94cdc939a90d5a22338ae507689e2cfab0)
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
----
- block/file-posix.c      | 8 +++-----
- block/nfs.c             | 3 +--
- block/nvme.c            | 4 +---
- block/vhdx.c            | 3 +--
- hw/audio/ac97.c         | 4 +---
- hw/audio/adlib.c        | 5 +----
- hw/display/cirrus_vga.c | 4 +---
- migration/ram.c         | 4 +---
- ui/gtk.c                | 3 +--
- util/qemu-sockets.c     | 5 +----
- 10 files changed, 12 insertions(+), 31 deletions(-)
-
-diff --git a/block/file-posix.c b/block/file-posix.c
-index 371572f1b0..837edcf027 100644
---- a/block/file-posix.c
-+++ b/block/file-posix.c
-@@ -1626,13 +1626,12 @@ static int handle_aiocb_write_zeroes_unmap(void *opaque)
- {
-     RawPosixAIOData *aiocb = opaque;
-     BDRVRawState *s G_GNUC_UNUSED = aiocb->bs->opaque;
--    int ret;
- 
-     /* First try to write zeros and unmap at the same time */
- 
- #ifdef CONFIG_FALLOCATE_PUNCH_HOLE
--    ret = do_fallocate(s->fd, FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE,
--                       aiocb->aio_offset, aiocb->aio_nbytes);
-+    int ret = do_fallocate(s->fd, FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE,
-+                           aiocb->aio_offset, aiocb->aio_nbytes);
-     if (ret != -ENOTSUP) {
-         return ret;
-     }
-@@ -1640,8 +1639,7 @@ static int handle_aiocb_write_zeroes_unmap(void *opaque)
- 
-     /* If we couldn't manage to unmap while guaranteed that the area reads as
-      * all-zero afterwards, just write zeroes without unmapping */
--    ret = handle_aiocb_write_zeroes(aiocb);
--    return ret;
-+    return handle_aiocb_write_zeroes(aiocb);
- }
- 
- #ifndef HAVE_COPY_FILE_RANGE
-diff --git a/block/nfs.c b/block/nfs.c
-index 2393fbfe6b..18c0a73694 100644
---- a/block/nfs.c
-+++ b/block/nfs.c
-@@ -623,8 +623,7 @@ static int nfs_file_open(BlockDriverState *bs, QDict *options, int flags,
-     }
- 
-     bs->total_sectors = ret;
--    ret = 0;
--    return ret;
-+    return 0;
- }
- 
- static QemuOptsList nfs_create_opts = {
-diff --git a/block/nvme.c b/block/nvme.c
-index 7b7c0cc5d6..eb2f54dd9d 100644
---- a/block/nvme.c
-+++ b/block/nvme.c
-@@ -575,11 +575,9 @@ static bool nvme_poll_cb(void *opaque)
- {
-     EventNotifier *e = opaque;
-     BDRVNVMeState *s = container_of(e, BDRVNVMeState, irq_notifier);
--    bool progress = false;
- 
-     trace_nvme_poll_cb(s);
--    progress = nvme_poll_queues(s);
--    return progress;
-+    return nvme_poll_queues(s);
- }
- 
- static int nvme_init(BlockDriverState *bs, const char *device, int namespace,
-diff --git a/block/vhdx.c b/block/vhdx.c
-index 21497f7318..a427e47f10 100644
---- a/block/vhdx.c
-+++ b/block/vhdx.c
-@@ -411,8 +411,7 @@ int vhdx_update_headers(BlockDriverState *bs, BDRVVHDXState *s,
-     if (ret < 0) {
-         return ret;
-     }
--    ret = vhdx_update_header(bs, s, generate_data_write_guid, log_guid);
--    return ret;
-+    return vhdx_update_header(bs, s, generate_data_write_guid, log_guid);
- }
- 
- /* opens the specified header block from the VHDX file header section */
-diff --git a/hw/audio/ac97.c b/hw/audio/ac97.c
-index a136b97f68..a2cfae52b3 100644
---- a/hw/audio/ac97.c
-+++ b/hw/audio/ac97.c
-@@ -574,11 +574,9 @@ static uint32_t nam_readb (void *opaque, uint32_t addr)
- static uint32_t nam_readw (void *opaque, uint32_t addr)
- {
-     AC97LinkState *s = opaque;
--    uint32_t val = ~0U;
-     uint32_t index = addr;
-     s->cas = 0;
--    val = mixer_load (s, index);
--    return val;
-+    return mixer_load(s, index);
- }
- 
- static uint32_t nam_readl (void *opaque, uint32_t addr)
-diff --git a/hw/audio/adlib.c b/hw/audio/adlib.c
-index cb4178d861..5779d09815 100644
---- a/hw/audio/adlib.c
-+++ b/hw/audio/adlib.c
-@@ -120,13 +120,10 @@ static void adlib_write(void *opaque, uint32_t nport, uint32_t val)
- static uint32_t adlib_read(void *opaque, uint32_t nport)
- {
-     AdlibState *s = opaque;
--    uint8_t data;
-     int a = nport & 3;
- 
-     adlib_kill_timers (s);
--    data = OPLRead (s->opl, a);
--
--    return data;
-+    return OPLRead (s->opl, a);
- }
- 
- static void timer_handler (void *opaque, int c, double interval_Sec)
-diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
-index 93afa26fda..a52d3094b9 100644
---- a/hw/display/cirrus_vga.c
-+++ b/hw/display/cirrus_vga.c
-@@ -2411,12 +2411,10 @@ static uint64_t cirrus_linear_bitblt_read(void *opaque,
-                                           unsigned size)
- {
-     CirrusVGAState *s = opaque;
--    uint32_t ret;
- 
-     /* XXX handle bitblt */
-     (void)s;
--    ret = 0xff;
--    return ret;
-+    return 0xff;
- }
- 
- static void cirrus_linear_bitblt_write(void *opaque,
-diff --git a/migration/ram.c b/migration/ram.c
-index 5344c7d59e..92c506d13c 100644
---- a/migration/ram.c
-+++ b/migration/ram.c
-@@ -3101,9 +3101,7 @@ int ram_postcopy_send_discard_bitmap(MigrationState *ms)
-     }
-     trace_ram_postcopy_send_discard_bitmap();
- 
--    ret = postcopy_each_ram_send_discard(ms);
--
--    return ret;
-+    return postcopy_each_ram_send_discard(ms);
- }
- 
- /**
-diff --git a/ui/gtk.c b/ui/gtk.c
-index 692ccc7bbb..e032e3c36f 100644
---- a/ui/gtk.c
-+++ b/ui/gtk.c
-@@ -1649,8 +1649,7 @@ static GSList *gd_vc_menu_init(GtkDisplayState *s, VirtualConsole *vc,
-                      G_CALLBACK(gd_menu_switch_vc), s);
-     gtk_menu_shell_append(GTK_MENU_SHELL(view_menu), vc->menu_item);
- 
--    group = gtk_radio_menu_item_get_group(GTK_RADIO_MENU_ITEM(vc->menu_item));
--    return group;
-+    return gtk_radio_menu_item_get_group(GTK_RADIO_MENU_ITEM(vc->menu_item));
- }
- 
- #if defined(CONFIG_VTE)
-diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
-index bcc06d0e01..86c48b9fa5 100644
---- a/util/qemu-sockets.c
-+++ b/util/qemu-sockets.c
-@@ -765,15 +765,12 @@ static int vsock_connect_addr(const struct sockaddr_vm *svm, Error **errp)
- static int vsock_connect_saddr(VsockSocketAddress *vaddr, Error **errp)
- {
-     struct sockaddr_vm svm;
--    int sock = -1;
- 
-     if (!vsock_parse_vaddr_to_sockaddr(vaddr, &svm, errp)) {
-         return -1;
-     }
- 
--    sock = vsock_connect_addr(&svm, errp);
--
--    return sock;
-+    return vsock_connect_addr(&svm, errp);
- }
- 
- static int vsock_listen_saddr(VsockSocketAddress *vaddr,
--- 
-2.27.0
-

SOURCES/kvm-Don-t-leak-memory-when-reallocation-fails.patch

@@ -1,58 +0,0 @@
-From bcb6107f98d7b1edf687d7afd552a4528b7e673b Mon Sep 17 00:00:00 2001
-From: jmaloy <jmaloy@redhat.com>
-Date: Tue, 12 May 2020 21:15:13 +0100
-Subject: [PATCH 2/7] Don't leak memory when reallocation fails.
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: jmaloy <jmaloy@redhat.com>
-Message-id: <20200512211514.1398384-2-jmaloy@redhat.com>
-Patchwork-id: 96412
-O-Subject: [RHEL-AV-8.2.1 qemu-kvm PATCH 1/2] Don't leak memory when reallocation fails.
-Bugzilla: 1749737
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Acked-by: Thomas Huth <thuth@redhat.com>
-RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-
-From: Jindrich Novy <jnovy@redhat.com>
-
-Signed-off-by: Jindrich Novy <jnovy@redhat.com>
-[ Marc-André - modified to use a temporary variable ]
-Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
-(cherry picked from libslirp commit d171af3732a0610a25334b06b77fa547bd677918)
-Signed-off-by: Jon Maloy <jmaloy@redhat.com>
-
-Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
----
- slirp/src/sbuf.c | 11 +++++++----
- 1 file changed, 7 insertions(+), 4 deletions(-)
-
-diff --git a/slirp/src/sbuf.c b/slirp/src/sbuf.c
-index abced48..0569c34 100644
---- a/slirp/src/sbuf.c
-+++ b/slirp/src/sbuf.c
-@@ -39,13 +39,16 @@ void sbreserve(struct sbuf *sb, int size)
-     if (sb->sb_data) {
-         /* Already alloced, realloc if necessary */
-         if (sb->sb_datalen != size) {
--            sb->sb_wptr = sb->sb_rptr = sb->sb_data =
--                (char *)realloc(sb->sb_data, size);
-+            char *new = realloc(sb->sb_data, size);
-             sb->sb_cc = 0;
--            if (sb->sb_wptr)
-+            if (new) {
-+                sb->sb_data = sb->sb_wptr = sb->sb_rptr = new;
-                 sb->sb_datalen = size;
--            else
-+            } else {
-+                free(sb->sb_data);
-+                sb->sb_data = sb->sb_wptr = sb->sb_rptr = NULL;
-                 sb->sb_datalen = 0;
-+            }
-         }
-     } else {
-         sb->sb_wptr = sb->sb_rptr = sb->sb_data = (char *)malloc(size);
--- 
-1.8.3.1
-

SOURCES/kvm-Drop-bogus-IPv6-messages.patch

@@ -1,51 +0,0 @@
-From 89c4300c97739aa3291f0322037bb65068e08d41 Mon Sep 17 00:00:00 2001
-From: Jon Maloy <jmaloy@redhat.com>
-Date: Tue, 19 Jan 2021 23:34:33 -0500
-Subject: [PATCH] Drop bogus IPv6 messages
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Jon Maloy <jmaloy@redhat.com>
-Message-id: <20210119233433.1352902-2-jmaloy@redhat.com>
-Patchwork-id: 100695
-O-Subject: [RHEL-8.4.0 qemu-kvm PATCH 1/1] Drop bogus IPv6 messages
-Bugzilla: 1918054
-RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
-RH-Acked-by: Thomas Huth <thuth@redhat.com>
-RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-
-From: Ralf Haferkamp <rhafer@suse.com>
-
-Drop IPv6 message shorter than what's mentioned in the payload
-length header (+ the size of the IPv6 header). They're invalid an could
-lead to data leakage in icmp6_send_echoreply().
-
-(cherry picked from libslirp commit c7ede54cbd2e2b25385325600958ba0124e31cc0)
-Signed-off-by: Jon Maloy <jmaloy@redhat.com>
-Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
----
- slirp/src/ip6_input.c | 7 +++++++
- 1 file changed, 7 insertions(+)
-
-diff --git a/slirp/src/ip6_input.c b/slirp/src/ip6_input.c
-index d9d2b7e9cd4..0f2b17853ad 100644
---- a/slirp/src/ip6_input.c
-+++ b/slirp/src/ip6_input.c
-@@ -49,6 +49,13 @@ void ip6_input(struct mbuf *m)
-         goto bad;
-     }
- 
-+    // Check if the message size is big enough to hold what's
-+    // set in the payload length header. If not this is an invalid
-+    // packet
-+    if (m->m_len < ntohs(ip6->ip_pl) + sizeof(struct ip6)) {
-+        goto bad;
-+    }
-+
-     /* check ip_ttl for a correct ICMP reply */
-     if (ip6->ip_hl == 0) {
-         icmp6_send_error(m, ICMP6_TIMXCEED, ICMP6_TIMXCEED_INTRANS);
--- 
-2.27.0
-

SOURCES/kvm-Enable-SGX-RH-Only.patch

@@ -0,0 +1,28 @@
+From db6e042fe4fdc1a1bbf562a46b15d4d8e33e2fa6 Mon Sep 17 00:00:00 2001
+From: Paul Lai <plai@redhat.com>
+Date: Tue, 25 Jan 2022 15:16:22 -0500
+Subject: [PATCH 4/7] Enable SGX  -- RH Only
+
+RH-Author: Paul Lai <None>
+RH-MergeRequest: 111: numa: Enable numa for SGX EPC sections
+RH-Commit: [4/5] cea874f29984897ef1232fb7749c13203c888034
+RH-Bugzilla: 1518984
+RH-Acked-by: Paolo Bonzini <None>
+RH-Acked-by: Bandan Das <None>
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+---
+ configs/devices/x86_64-softmmu/x86_64-rh-devices.mak | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
+index ddf036f042..fdbbdf9742 100644
+--- a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
++++ b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
+@@ -102,3 +102,4 @@ CONFIG_TPM_CRB=y
+ CONFIG_TPM_TIS_ISA=y
+ CONFIG_TPM_EMULATOR=y
+ CONFIG_TPM_PASSTHROUGH=y
++CONFIG_SGX=y
+-- 
+2.27.0
+

SOURCES/kvm-Fix-DHCP-broken-in-libslirp-v4.6.0.patch

@@ -1,59 +0,0 @@
-From d0c668aa0ad255c3598267816154874541ac2943 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
-Date: Thu, 29 Jul 2021 04:56:42 -0400
-Subject: [PATCH 12/14] Fix "DHCP broken in libslirp v4.6.0"
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Marc-André Lureau <marcandre.lureau@redhat.com>
-Message-id: <20210708082537.1550263-9-marcandre.lureau@redhat.com>
-Patchwork-id: 101824
-O-Subject: [RHEL-8.5.0 qemu-kvm PATCH 8/8] Fix "DHCP broken in libslirp v4.6.0"
-Bugzilla: 1970819 1970835 1970843 1970853
-RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
-RH-Acked-by: Eric Blake <eblake@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-
-From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
-
-Fix issue 48
-
-Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
-
-(cherry picked from commit c9f314f6e315a5518432761fea864196a290f799)
-[ minor conflict fix due to indentation change ]
-Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
-Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
----
- slirp/src/bootp.c | 12 ++++++------
- 1 file changed, 6 insertions(+), 6 deletions(-)
-
-diff --git a/slirp/src/bootp.c b/slirp/src/bootp.c
-index 5789187166..3e4af075f1 100644
---- a/slirp/src/bootp.c
-+++ b/slirp/src/bootp.c
-@@ -354,14 +354,14 @@ static void bootp_reply(Slirp *slirp,
-         q += sizeof(nak_msg) - 1;
-     }
-     assert(q < end);
--    *q =
--RFC1533_END
--;
-+    *q = RFC1533_END;
- 
--daddr.sin_addr.s_addr = 0xffffffffu;
-+    daddr.sin_addr.s_addr = 0xffffffffu;
- 
--m->m_len = sizeof(struct bootp_t) - sizeof(struct ip) - sizeof(struct udphdr);
--udp_output(NULL, m, &saddr, &daddr, IPTOS_LOWDELAY);
-+    assert ((q - rbp->bp_vend + 1) <= DHCP_OPT_LEN);
-+
-+    m->m_len = sizeof(struct bootp_t) + (q - rbp->bp_vend + 1) - sizeof(struct ip) - sizeof(struct udphdr);
-+    udp_output(NULL, m, &saddr, &daddr, IPTOS_LOWDELAY);
- }
- 
- void bootp_input(struct mbuf *m)
--- 
-2.27.0
-

SOURCES/kvm-Fix-use-afte-free-in-ip_reass-CVE-2020-1983.patch

@@ -1,60 +0,0 @@
-From a33ea192428d9c9307f1140f3e25631a6ef7657c Mon Sep 17 00:00:00 2001
-From: Jon Maloy <jmaloy@redhat.com>
-Date: Sat, 20 Jun 2020 15:02:59 -0400
-Subject: [PATCH 12/12] Fix use-afte-free in ip_reass() (CVE-2020-1983)
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Jon Maloy <jmaloy@redhat.com>
-Message-id: <20200620150259.3352467-2-jmaloy@redhat.com>
-Patchwork-id: 97678
-O-Subject: [RHEL-8.3.0 qemu-kvm PATCH 1/1] Fix use-afte-free in ip_reass() (CVE-2020-1983)
-Bugzilla: 1838070
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-
-From: Marc-André Lureau <marcandre.lureau@redhat.com>
-
-The q pointer is updated when the mbuf data is moved from m_dat to
-m_ext.
-
-m_ext buffer may also be realloc()'ed and moved during m_cat():
-q should also be updated in this case.
-
-Reported-by: Aviv Sasson <asasson@paloaltonetworks.com>
-Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
-Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
-
-(cherry picked from libslirp commit 9bd6c5913271eabcb7768a58197ed3301fe19f2d)
-Signed-off-by: Jon Maloy <jmaloy@redhat.com>
-Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
----
- slirp/src/ip_input.c | 5 ++---
- 1 file changed, 2 insertions(+), 3 deletions(-)
-
-diff --git a/slirp/src/ip_input.c b/slirp/src/ip_input.c
-index df1c846ade..0f5d522ec1 100644
---- a/slirp/src/ip_input.c
-+++ b/slirp/src/ip_input.c
-@@ -329,7 +329,7 @@ insert:
-     q = fp->frag_link.next;
-     m = dtom(slirp, q);
- 
--    int was_ext = m->m_flags & M_EXT;
-+    int delta = (char *)q - (m->m_flags & M_EXT ? m->m_ext : m->m_dat);
- 
-     q = (struct ipasfrag *)q->ipf_next;
-     while (q != (struct ipasfrag *)&fp->frag_link) {
-@@ -353,8 +353,7 @@ insert:
-      * the old buffer (in the mbuf), so we must point ip
-      * into the new buffer.
-      */
--    if (!was_ext && m->m_flags & M_EXT) {
--        int delta = (char *)q - m->m_dat;
-+    if (m->m_flags & M_EXT) {
-         q = (struct ipasfrag *)(m->m_ext + delta);
-     }
- 
--- 
-2.27.0
-

SOURCES/kvm-KVM-keep-track-of-running-ioctls.patch

@@ -0,0 +1,82 @@
+From 9bacf8c4104ff3cff2e0e2c2179ec4fda633167f Mon Sep 17 00:00:00 2001
+From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+Date: Mon, 16 Jan 2023 07:51:08 -0500
+Subject: [PATCH 05/11] KVM: keep track of running ioctls
+
+RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+RH-MergeRequest: 247: accel: introduce accelerator blocker API
+RH-Bugzilla: 2161188
+RH-Acked-by: David Hildenbrand <david@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [2/3] 357508389e2a0fd996206b406e9e235e50b5f0b6
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2161188
+
+commit a27dd2de68f37ba96fe164a42121daa5f0750afc
+Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+Date:   Fri Nov 11 10:47:57 2022 -0500
+
+    KVM: keep track of running ioctls
+
+    Using the new accel-blocker API, mark where ioctls are being called
+    in KVM. Next, we will implement the critical section that will take
+    care of performing memslots modifications atomically, therefore
+    preventing any new ioctl from running and allowing the running ones
+    to finish.
+
+    Signed-off-by: David Hildenbrand <david@redhat.com>
+    Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+    Message-Id: <20221111154758.1372674-3-eesposit@redhat.com>
+    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+
+Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+---
+ accel/kvm/kvm-all.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
+index 8f2a53438f..221aadfda7 100644
+--- a/accel/kvm/kvm-all.c
++++ b/accel/kvm/kvm-all.c
+@@ -2337,6 +2337,7 @@ static int kvm_init(MachineState *ms)
+     assert(TARGET_PAGE_SIZE <= qemu_real_host_page_size);
+ 
+     s->sigmask_len = 8;
++    accel_blocker_init();
+ 
+ #ifdef KVM_CAP_SET_GUEST_DEBUG
+     QTAILQ_INIT(&s->kvm_sw_breakpoints);
+@@ -3018,7 +3019,9 @@ int kvm_vm_ioctl(KVMState *s, int type, ...)
+     va_end(ap);
+ 
+     trace_kvm_vm_ioctl(type, arg);
++    accel_ioctl_begin();
+     ret = ioctl(s->vmfd, type, arg);
++    accel_ioctl_end();
+     if (ret == -1) {
+         ret = -errno;
+     }
+@@ -3036,7 +3039,9 @@ int kvm_vcpu_ioctl(CPUState *cpu, int type, ...)
+     va_end(ap);
+ 
+     trace_kvm_vcpu_ioctl(cpu->cpu_index, type, arg);
++    accel_cpu_ioctl_begin(cpu);
+     ret = ioctl(cpu->kvm_fd, type, arg);
++    accel_cpu_ioctl_end(cpu);
+     if (ret == -1) {
+         ret = -errno;
+     }
+@@ -3054,7 +3059,9 @@ int kvm_device_ioctl(int fd, int type, ...)
+     va_end(ap);
+ 
+     trace_kvm_device_ioctl(fd, type, arg);
++    accel_ioctl_begin();
+     ret = ioctl(fd, type, arg);
++    accel_ioctl_end();
+     if (ret == -1) {
+         ret = -errno;
+     }
+-- 
+2.37.3
+

SOURCES/kvm-KVM-x86-workaround-invalid-CPUID-0xD-9-info-on-some-.patch

@@ -0,0 +1,109 @@
+From ea5299b5dde7d0b6b2f93cb646e6a24c9f105466 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Wed, 23 Mar 2022 12:33:25 +0100
+Subject: [PATCH 13/24] KVM: x86: workaround invalid CPUID[0xD,9] info on some
+ AMD processors
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Paul Lai <plai@redhat.com>
+RH-MergeRequest: 176: Enable KVM AMX support
+RH-Commit: [13/13] 38f147c911258e84e01336271ebd23a1c24371fc
+RH-Bugzilla: 1916415
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
+RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+
+Some AMD processors expose the PKRU extended save state even if they do not have
+the related PKU feature in CPUID.  Worse, when they do they report a size of
+64, whereas the expected size of the PKRU extended save state is 8, therefore
+the esa->size == eax assertion does not hold.
+
+The state is already ignored by KVM_GET_SUPPORTED_CPUID because it
+was not enabled in the host XCR0.  However, QEMU kvm_cpu_xsave_init()
+runs before QEMU invokes arch_prctl() to enable dynamically-enabled
+save states such as XTILEDATA, and KVM_GET_SUPPORTED_CPUID hides save
+states that have yet to be enabled.  Therefore, kvm_cpu_xsave_init()
+needs to consult the host CPUID instead of KVM_GET_SUPPORTED_CPUID,
+and dies with an assertion failure.
+
+When setting up the ExtSaveArea array to match the host, ignore features that
+KVM does not report as supported.  This will cause QEMU to skip the incorrect
+CPUID leaf instead of tripping the assertion.
+
+Closes: https://gitlab.com/qemu-project/qemu/-/issues/916
+Reported-by: Daniel P. Berrangé <berrange@redhat.com>
+Analyzed-by: Yang Zhong <yang.zhong@intel.com>
+Reported-by: Peter Krempa <pkrempa@redhat.com>
+Tested-by: Daniel P. Berrangé <berrange@redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 58f7db26f21c690cf9a669c314cfd7371506084a)
+Signed-off-by: Paul Lai <plai@redhat.com>
+---
+ target/i386/cpu.c         |  4 ++--
+ target/i386/cpu.h         |  2 ++
+ target/i386/kvm/kvm-cpu.c | 19 ++++++++++++-------
+ 3 files changed, 16 insertions(+), 9 deletions(-)
+
+diff --git a/target/i386/cpu.c b/target/i386/cpu.c
+index 09e08f7f38..0543b846ff 100644
+--- a/target/i386/cpu.c
++++ b/target/i386/cpu.c
+@@ -4980,8 +4980,8 @@ CpuDefinitionInfoList *qmp_query_cpu_definitions(Error **errp)
+     return cpu_list;
+ }
+ 
+-static uint64_t x86_cpu_get_supported_feature_word(FeatureWord w,
+-                                                   bool migratable_only)
++uint64_t x86_cpu_get_supported_feature_word(FeatureWord w,
++                                            bool migratable_only)
+ {
+     FeatureWordInfo *wi = &feature_word_info[w];
+     uint64_t r = 0;
+diff --git a/target/i386/cpu.h b/target/i386/cpu.h
+index 8ab2a4042a..006b735fe4 100644
+--- a/target/i386/cpu.h
++++ b/target/i386/cpu.h
+@@ -604,6 +604,8 @@ typedef enum FeatureWord {
+ } FeatureWord;
+ 
+ typedef uint64_t FeatureWordArray[FEATURE_WORDS];
++uint64_t x86_cpu_get_supported_feature_word(FeatureWord w,
++                                            bool migratable_only);
+ 
+ /* cpuid_features bits */
+ #define CPUID_FP87 (1U << 0)
+diff --git a/target/i386/kvm/kvm-cpu.c b/target/i386/kvm/kvm-cpu.c
+index bdc967c484..74c1396a93 100644
+--- a/target/i386/kvm/kvm-cpu.c
++++ b/target/i386/kvm/kvm-cpu.c
+@@ -99,13 +99,18 @@ static void kvm_cpu_xsave_init(void)
+     for (i = XSTATE_SSE_BIT + 1; i < XSAVE_STATE_AREA_COUNT; i++) {
+         ExtSaveArea *esa = &x86_ext_save_areas[i];
+ 
+-        if (esa->size) {
+-            host_cpuid(0xd, i, &eax, &ebx, &ecx, &edx);
+-            if (eax != 0) {
+-                assert(esa->size == eax);
+-                esa->offset = ebx;
+-                esa->ecx = ecx;
+-            }
++        if (!esa->size) {
++            continue;
++        }
++        if ((x86_cpu_get_supported_feature_word(esa->feature, false) & esa->bits)
++            != esa->bits) {
++            continue;
++        }
++        host_cpuid(0xd, i, &eax, &ebx, &ecx, &edx);
++        if (eax != 0) {
++            assert(esa->size == eax);
++            esa->offset = ebx;
++            esa->ecx = ecx;
+         }
+     }
+ }
+-- 
+2.35.3
+

SOURCES/kvm-MAINTAINERS-fix-qcow2-bitmap.c-under-Dirty-Bitmaps-h.patch

@@ -1,55 +0,0 @@
-From e3bec8c83459a68ae0c08e2ae0f1dbef24872d59 Mon Sep 17 00:00:00 2001
-From: Eric Blake <eblake@redhat.com>
-Date: Tue, 2 Jun 2020 02:34:09 +0100
-Subject: [PATCH 04/26] MAINTAINERS: fix qcow2-bitmap.c under Dirty Bitmaps
- header
-
-RH-Author: Eric Blake <eblake@redhat.com>
-Message-id: <20200602023420.2133649-2-eblake@redhat.com>
-Patchwork-id: 97068
-O-Subject: [RHEL-AV-8.2.1 qemu-kvm PATCH 01/12] MAINTAINERS: fix qcow2-bitmap.c under Dirty Bitmaps header
-Bugzilla: 1779893 1779904
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Acked-by: Max Reitz <mreitz@redhat.com>
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-
-From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-
-Somehow I wrote not full path to the file. Fix that.
-
-Also, while being here, rearrange entries, so that includes go first,
-then block, than migration, than util.
-
-Fixes: 052db8e71444d
-Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 00637c6b0b67694127cc01dd75f3626da23acdaa)
-Signed-off-by: Eric Blake <eblake@redhat.com>
-Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
----
- MAINTAINERS | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/MAINTAINERS b/MAINTAINERS
-index d1b3e26..3a81ac9 100644
---- a/MAINTAINERS
-+++ b/MAINTAINERS
-@@ -1873,12 +1873,12 @@ M: John Snow <jsnow@redhat.com>
- R: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
- L: qemu-block@nongnu.org
- S: Supported
--F: util/hbitmap.c
--F: block/dirty-bitmap.c
- F: include/qemu/hbitmap.h
- F: include/block/dirty-bitmap.h
--F: qcow2-bitmap.c
-+F: block/dirty-bitmap.c
-+F: block/qcow2-bitmap.c
- F: migration/block-dirty-bitmap.c
-+F: util/hbitmap.c
- F: tests/test-hbitmap.c
- F: docs/interop/bitmaps.rst
- T: git https://github.com/jnsnow/qemu.git bitmaps
--- 
-1.8.3.1
-

SOURCES/kvm-MAINTAINERS-split-out-s390x-sections.patch

@@ -0,0 +1,181 @@
+From 440ee491240f2f02f9a6082d8aad98d88c1039dd Mon Sep 17 00:00:00 2001
+From: Thomas Huth <thuth@redhat.com>
+Date: Mon, 15 Jan 2024 14:00:04 +0100
+Subject: [PATCH 1/5] MAINTAINERS: split out s390x sections
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Thomas Huth <thuth@redhat.com>
+RH-MergeRequest: 348: s390x: Provide some more useful information if decryption of a PV image fails
+RH-Jira: RHEL-18214
+RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
+RH-Acked-by: Cédric Le Goater <clg@redhat.com>
+RH-Commit: [1/5] a71a3c11922481f97c36570e361088d17474e481
+
+JIRA: https://issues.redhat.com/browse/RHEL-18214
+
+commit 56e34834029c7c6862cb0095d95ad83c50485f88
+Author: Cornelia Huck <cohuck@redhat.com>
+Date:   Wed Dec 22 11:55:48 2021 +0100
+
+    MAINTAINERS: split out s390x sections
+
+    Split out some more specialized devices etc., so that we can build
+    smarter lists of people to be put on cc: in the future.
+
+    Signed-off-by: Cornelia Huck <cohuck@redhat.com>
+    Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+    Acked-by: David Hildenbrand <david@redhat.com>
+    Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
+    Acked-by: Thomas Huth <thuth@redhat.com>
+    Acked-by: Halil Pasic <pasic@linux.ibm.com>
+    Acked-by: Eric Farman <farman@linux.ibm.com>
+    Message-Id: <20211222105548.356852-1-cohuck@redhat.com>
+    Signed-off-by: Thomas Huth <thuth@redhat.com>
+
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+---
+ MAINTAINERS | 85 ++++++++++++++++++++++++++++++++++++++++++++++-------
+ 1 file changed, 74 insertions(+), 11 deletions(-)
+
+diff --git a/MAINTAINERS b/MAINTAINERS
+index 7543eb4d59..b893206fc3 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -297,7 +297,6 @@ M: David Hildenbrand <david@redhat.com>
+ S: Maintained
+ F: target/s390x/
+ F: target/s390x/tcg
+-F: target/s390x/cpu_models_*.[ch]
+ F: hw/s390x/
+ F: disas/s390.c
+ F: tests/tcg/s390x/
+@@ -396,16 +395,10 @@ M: Halil Pasic <pasic@linux.ibm.com>
+ M: Christian Borntraeger <borntraeger@de.ibm.com>
+ S: Supported
+ F: target/s390x/kvm/
+-F: target/s390x/ioinst.[ch]
+ F: target/s390x/machine.c
+ F: target/s390x/sigp.c
+-F: target/s390x/cpu_features*.[ch]
+-F: target/s390x/cpu_models.[ch]
+ F: hw/s390x/pv.c
+ F: include/hw/s390x/pv.h
+-F: hw/intc/s390_flic.c
+-F: hw/intc/s390_flic_kvm.c
+-F: include/hw/s390x/s390_flic.h
+ F: gdb-xml/s390*.xml
+ T: git https://github.com/borntraeger/qemu.git s390-next
+ L: qemu-s390x@nongnu.org
+@@ -1529,12 +1522,8 @@ S390 Virtio-ccw
+ M: Halil Pasic <pasic@linux.ibm.com>
+ M: Christian Borntraeger <borntraeger@de.ibm.com>
+ S: Supported
+-F: hw/char/sclp*.[hc]
+-F: hw/char/terminal3270.c
+ F: hw/s390x/
+ F: include/hw/s390x/
+-F: hw/watchdog/wdt_diag288.c
+-F: include/hw/watchdog/wdt_diag288.h
+ F: configs/devices/s390x-softmmu/default.mak
+ F: tests/avocado/machine_s390_ccw_virtio.py
+ T: git https://github.com/borntraeger/qemu.git s390-next
+@@ -1559,6 +1548,37 @@ F: hw/s390x/s390-pci*
+ F: include/hw/s390x/s390-pci*
+ L: qemu-s390x@nongnu.org
+ 
++S390 channel subsystem
++M: Halil Pasic <pasic@linux.ibm.com>
++M: Christian Borntraeger <borntraeger@linux.ibm.com>
++S: Supported
++F: hw/s390x/ccw-device.[ch]
++F: hw/s390x/css.c
++F: hw/s390x/css-bridge.c
++F: include/hw/s390x/css.h
++F: include/hw/s390x/css-bridge.h
++F: include/hw/s390x/ioinst.h
++F: target/s390x/ioinst.c
++L: qemu-s390x@nongnu.org
++
++S390 CPU models
++M: David Hildenbrand <david@redhat.com>
++S: Maintained
++F: target/s390x/cpu_features*.[ch]
++F: target/s390x/cpu_models.[ch]
++L: qemu-s390x@nongnu.org
++
++S390 SCLP-backed devices
++M: Halil Pasic <pasic@linux.ibm.com>
++M: Christian Borntraeger <borntraeger@linux.ibm.com>
++S: Supported
++F: include/hw/s390x/event-facility.h
++F: include/hw/s390x/sclp.h
++F: hw/char/sclp*.[hc]
++F: hw/s390x/event-facility.c
++F: hw/s390x/sclp*.c
++L: qemu-s390x@nongnu.org
++
+ X86 Machines
+ ------------
+ PC
+@@ -1956,6 +1976,7 @@ M: Halil Pasic <pasic@linux.ibm.com>
+ S: Supported
+ F: hw/s390x/virtio-ccw*.[hc]
+ F: hw/s390x/vhost-vsock-ccw.c
++F: hw/s390x/vhost-user-fs-ccw.c
+ T: git https://gitlab.com/cohuck/qemu.git s390-next
+ T: git https://github.com/borntraeger/qemu.git s390-next
+ L: qemu-s390x@nongnu.org
+@@ -2294,6 +2315,48 @@ F: hw/timer/mips_gictimer.c
+ F: include/hw/intc/mips_gic.h
+ F: include/hw/timer/mips_gictimer.h
+ 
++S390 3270 device
++M: Halil Pasic <pasic@linux.ibm.com>
++M: Christian Borntraeger <borntraeger@linux.ibm.com>
++S: Odd fixes
++F: include/hw/s390x/3270-ccw.h
++F: hw/char/terminal3270.c
++F: hw/s390x/3270-ccw.c
++L: qemu-s390x@nongnu.org
++
++S390 diag 288 watchdog
++M: Halil Pasic <pasic@linux.ibm.com>
++M: Christian Borntraeger <borntraeger@linux.ibm.com>
++S: Supported
++F: hw/watchdog/wdt_diag288.c
++F: include/hw/watchdog/wdt_diag288.h
++L: qemu-s390x@nongnu.org
++
++S390 storage key device
++M: Halil Pasic <pasic@linux.ibm.com>
++M: Christian Borntraeger <borntraeger@linux.ibm.com>
++S: Supported
++F: hw/s390x/storage-keys.h
++F: hw/390x/s390-skeys*.c
++L: qemu-s390x@nongnu.org
++
++S390 storage attribute device
++M: Halil Pasic <pasic@linux.ibm.com>
++M: Christian Borntraeger <borntraeger@linux.ibm.com>
++S: Supported
++F: hw/s390x/storage-attributes.h
++F: hw/s390/s390-stattrib*.c
++L: qemu-s390x@nongnu.org
++
++S390 floating interrupt controller
++M: Halil Pasic <pasic@linux.ibm.com>
++M: Christian Borntraeger <borntraeger@linux.ibm.com>
++M: David Hildenbrand <david@redhat.com>
++S: Supported
++F: hw/intc/s390_flic*.c
++F: include/hw/s390x/s390_flic.h
++L: qemu-s390x@nongnu.org
++
+ Subsystems
+ ----------
+ Overall Audio backends
+-- 
+2.41.0
+

SOURCES/kvm-QIOChannel-Add-flags-on-io_writev-and-introduce-io_f.patch

@@ -0,0 +1,420 @@
+From 7eeec7c008e947bc3e1fed682791092b408852c6 Mon Sep 17 00:00:00 2001
+From: Leonardo Bras <leobras@redhat.com>
+Date: Wed, 18 May 2022 02:52:24 -0300
+Subject: [PATCH 17/37] QIOChannel: Add flags on io_writev and introduce
+ io_flush callback
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Leonardo Brás <leobras@redhat.com>
+RH-MergeRequest: 191: MSG_ZEROCOPY + Multifd @ rhel8.7
+RH-Commit: [17/26] 7bde4e79fd3f76a6cc84d9cacf50420584ddd35c
+RH-Bugzilla: 2072049
+RH-Acked-by: Peter Xu <peterx@redhat.com>
+RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
+RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+
+Add flags to io_writev and introduce io_flush as optional callback to
+QIOChannelClass, allowing the implementation of zero copy writes by
+subclasses.
+
+How to use them:
+- Write data using qio_channel_writev*(...,QIO_CHANNEL_WRITE_FLAG_ZERO_COPY),
+- Wait write completion with qio_channel_flush().
+
+Notes:
+As some zero copy write implementations work asynchronously, it's
+recommended to keep the write buffer untouched until the return of
+qio_channel_flush(), to avoid the risk of sending an updated buffer
+instead of the buffer state during write.
+
+As io_flush callback is optional, if a subclass does not implement it, then:
+- io_flush will return 0 without changing anything.
+
+Also, some functions like qio_channel_writev_full_all() were adapted to
+receive a flag parameter. That allows shared code between zero copy and
+non-zero copy writev, and also an easier implementation on new flags.
+
+Signed-off-by: Leonardo Bras <leobras@redhat.com>
+Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
+Reviewed-by: Peter Xu <peterx@redhat.com>
+Reviewed-by: Juan Quintela <quintela@redhat.com>
+Message-Id: <20220513062836.965425-3-leobras@redhat.com>
+Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+(cherry picked from commit b88651cb4d4fa416fdbb6afaf5b26ec8c035eaad)
+Signed-off-by: Leonardo Bras <leobras@redhat.com>
+---
+ chardev/char-io.c                   |  2 +-
+ hw/remote/mpqemu-link.c             |  2 +-
+ include/io/channel.h                | 38 +++++++++++++++++++++-
+ io/channel-buffer.c                 |  1 +
+ io/channel-command.c                |  1 +
+ io/channel-file.c                   |  1 +
+ io/channel-socket.c                 |  2 ++
+ io/channel-tls.c                    |  1 +
+ io/channel-websock.c                |  1 +
+ io/channel.c                        | 49 +++++++++++++++++++++++------
+ migration/rdma.c                    |  1 +
+ scsi/pr-manager-helper.c            |  2 +-
+ tests/unit/test-io-channel-socket.c |  1 +
+ 13 files changed, 88 insertions(+), 14 deletions(-)
+
+diff --git a/chardev/char-io.c b/chardev/char-io.c
+index 8ced184160..4451128cba 100644
+--- a/chardev/char-io.c
++++ b/chardev/char-io.c
+@@ -122,7 +122,7 @@ int io_channel_send_full(QIOChannel *ioc,
+ 
+         ret = qio_channel_writev_full(
+             ioc, &iov, 1,
+-            fds, nfds, NULL);
++            fds, nfds, 0, NULL);
+         if (ret == QIO_CHANNEL_ERR_BLOCK) {
+             if (offset) {
+                 return offset;
+diff --git a/hw/remote/mpqemu-link.c b/hw/remote/mpqemu-link.c
+index 7e841820e5..e8f556bd27 100644
+--- a/hw/remote/mpqemu-link.c
++++ b/hw/remote/mpqemu-link.c
+@@ -69,7 +69,7 @@ bool mpqemu_msg_send(MPQemuMsg *msg, QIOChannel *ioc, Error **errp)
+     }
+ 
+     if (!qio_channel_writev_full_all(ioc, send, G_N_ELEMENTS(send),
+-                                    fds, nfds, errp)) {
++                                    fds, nfds, 0, errp)) {
+         ret = true;
+     } else {
+         trace_mpqemu_send_io_error(msg->cmd, msg->size, nfds);
+diff --git a/include/io/channel.h b/include/io/channel.h
+index 88988979f8..c680ee7480 100644
+--- a/include/io/channel.h
++++ b/include/io/channel.h
+@@ -32,12 +32,15 @@ OBJECT_DECLARE_TYPE(QIOChannel, QIOChannelClass,
+ 
+ #define QIO_CHANNEL_ERR_BLOCK -2
+ 
++#define QIO_CHANNEL_WRITE_FLAG_ZERO_COPY 0x1
++
+ typedef enum QIOChannelFeature QIOChannelFeature;
+ 
+ enum QIOChannelFeature {
+     QIO_CHANNEL_FEATURE_FD_PASS,
+     QIO_CHANNEL_FEATURE_SHUTDOWN,
+     QIO_CHANNEL_FEATURE_LISTEN,
++    QIO_CHANNEL_FEATURE_WRITE_ZERO_COPY,
+ };
+ 
+ 
+@@ -104,6 +107,7 @@ struct QIOChannelClass {
+                          size_t niov,
+                          int *fds,
+                          size_t nfds,
++                         int flags,
+                          Error **errp);
+     ssize_t (*io_readv)(QIOChannel *ioc,
+                         const struct iovec *iov,
+@@ -136,6 +140,8 @@ struct QIOChannelClass {
+                                   IOHandler *io_read,
+                                   IOHandler *io_write,
+                                   void *opaque);
++    int (*io_flush)(QIOChannel *ioc,
++                    Error **errp);
+ };
+ 
+ /* General I/O handling functions */
+@@ -228,6 +234,7 @@ ssize_t qio_channel_readv_full(QIOChannel *ioc,
+  * @niov: the length of the @iov array
+  * @fds: an array of file handles to send
+  * @nfds: number of file handles in @fds
++ * @flags: write flags (QIO_CHANNEL_WRITE_FLAG_*)
+  * @errp: pointer to a NULL-initialized error object
+  *
+  * Write data to the IO channel, reading it from the
+@@ -260,6 +267,7 @@ ssize_t qio_channel_writev_full(QIOChannel *ioc,
+                                 size_t niov,
+                                 int *fds,
+                                 size_t nfds,
++                                int flags,
+                                 Error **errp);
+ 
+ /**
+@@ -837,6 +845,7 @@ int qio_channel_readv_full_all(QIOChannel *ioc,
+  * @niov: the length of the @iov array
+  * @fds: an array of file handles to send
+  * @nfds: number of file handles in @fds
++ * @flags: write flags (QIO_CHANNEL_WRITE_FLAG_*)
+  * @errp: pointer to a NULL-initialized error object
+  *
+  *
+@@ -846,6 +855,14 @@ int qio_channel_readv_full_all(QIOChannel *ioc,
+  * to be written, yielding from the current coroutine
+  * if required.
+  *
++ * If QIO_CHANNEL_WRITE_FLAG_ZERO_COPY is passed in flags,
++ * instead of waiting for all requested data to be written,
++ * this function will wait until it's all queued for writing.
++ * In this case, if the buffer gets changed between queueing and
++ * sending, the updated buffer will be sent. If this is not a
++ * desired behavior, it's suggested to call qio_channel_flush()
++ * before reusing the buffer.
++ *
+  * Returns: 0 if all bytes were written, or -1 on error
+  */
+ 
+@@ -853,6 +870,25 @@ int qio_channel_writev_full_all(QIOChannel *ioc,
+                                 const struct iovec *iov,
+                                 size_t niov,
+                                 int *fds, size_t nfds,
+-                                Error **errp);
++                                int flags, Error **errp);
++
++/**
++ * qio_channel_flush:
++ * @ioc: the channel object
++ * @errp: pointer to a NULL-initialized error object
++ *
++ * Will block until every packet queued with
++ * qio_channel_writev_full() + QIO_CHANNEL_WRITE_FLAG_ZERO_COPY
++ * is sent, or return in case of any error.
++ *
++ * If not implemented, acts as a no-op, and returns 0.
++ *
++ * Returns -1 if any error is found,
++ *          1 if every send failed to use zero copy.
++ *          0 otherwise.
++ */
++
++int qio_channel_flush(QIOChannel *ioc,
++                      Error **errp);
+ 
+ #endif /* QIO_CHANNEL_H */
+diff --git a/io/channel-buffer.c b/io/channel-buffer.c
+index baa4e2b089..bf52011be2 100644
+--- a/io/channel-buffer.c
++++ b/io/channel-buffer.c
+@@ -81,6 +81,7 @@ static ssize_t qio_channel_buffer_writev(QIOChannel *ioc,
+                                          size_t niov,
+                                          int *fds,
+                                          size_t nfds,
++                                         int flags,
+                                          Error **errp)
+ {
+     QIOChannelBuffer *bioc = QIO_CHANNEL_BUFFER(ioc);
+diff --git a/io/channel-command.c b/io/channel-command.c
+index b2a9e27138..5ff1691bad 100644
+--- a/io/channel-command.c
++++ b/io/channel-command.c
+@@ -258,6 +258,7 @@ static ssize_t qio_channel_command_writev(QIOChannel *ioc,
+                                           size_t niov,
+                                           int *fds,
+                                           size_t nfds,
++                                          int flags,
+                                           Error **errp)
+ {
+     QIOChannelCommand *cioc = QIO_CHANNEL_COMMAND(ioc);
+diff --git a/io/channel-file.c b/io/channel-file.c
+index c4bf799a80..348a48545e 100644
+--- a/io/channel-file.c
++++ b/io/channel-file.c
+@@ -114,6 +114,7 @@ static ssize_t qio_channel_file_writev(QIOChannel *ioc,
+                                        size_t niov,
+                                        int *fds,
+                                        size_t nfds,
++                                       int flags,
+                                        Error **errp)
+ {
+     QIOChannelFile *fioc = QIO_CHANNEL_FILE(ioc);
+diff --git a/io/channel-socket.c b/io/channel-socket.c
+index 606ec97cf7..bfbd64787e 100644
+--- a/io/channel-socket.c
++++ b/io/channel-socket.c
+@@ -525,6 +525,7 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
+                                          size_t niov,
+                                          int *fds,
+                                          size_t nfds,
++                                         int flags,
+                                          Error **errp)
+ {
+     QIOChannelSocket *sioc = QIO_CHANNEL_SOCKET(ioc);
+@@ -620,6 +621,7 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
+                                          size_t niov,
+                                          int *fds,
+                                          size_t nfds,
++                                         int flags,
+                                          Error **errp)
+ {
+     QIOChannelSocket *sioc = QIO_CHANNEL_SOCKET(ioc);
+diff --git a/io/channel-tls.c b/io/channel-tls.c
+index 2ae1b92fc0..4ce890a538 100644
+--- a/io/channel-tls.c
++++ b/io/channel-tls.c
+@@ -301,6 +301,7 @@ static ssize_t qio_channel_tls_writev(QIOChannel *ioc,
+                                       size_t niov,
+                                       int *fds,
+                                       size_t nfds,
++                                      int flags,
+                                       Error **errp)
+ {
+     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
+diff --git a/io/channel-websock.c b/io/channel-websock.c
+index 70889bb54d..035dd6075b 100644
+--- a/io/channel-websock.c
++++ b/io/channel-websock.c
+@@ -1127,6 +1127,7 @@ static ssize_t qio_channel_websock_writev(QIOChannel *ioc,
+                                           size_t niov,
+                                           int *fds,
+                                           size_t nfds,
++                                          int flags,
+                                           Error **errp)
+ {
+     QIOChannelWebsock *wioc = QIO_CHANNEL_WEBSOCK(ioc);
+diff --git a/io/channel.c b/io/channel.c
+index e8b019dc36..0640941ac5 100644
+--- a/io/channel.c
++++ b/io/channel.c
+@@ -72,18 +72,32 @@ ssize_t qio_channel_writev_full(QIOChannel *ioc,
+                                 size_t niov,
+                                 int *fds,
+                                 size_t nfds,
++                                int flags,
+                                 Error **errp)
+ {
+     QIOChannelClass *klass = QIO_CHANNEL_GET_CLASS(ioc);
+ 
+-    if ((fds || nfds) &&
+-        !qio_channel_has_feature(ioc, QIO_CHANNEL_FEATURE_FD_PASS)) {
++    if (fds || nfds) {
++        if (!qio_channel_has_feature(ioc, QIO_CHANNEL_FEATURE_FD_PASS)) {
++            error_setg_errno(errp, EINVAL,
++                             "Channel does not support file descriptor passing");
++            return -1;
++        }
++        if (flags & QIO_CHANNEL_WRITE_FLAG_ZERO_COPY) {
++            error_setg_errno(errp, EINVAL,
++                             "Zero Copy does not support file descriptor passing");
++            return -1;
++        }
++    }
++
++    if ((flags & QIO_CHANNEL_WRITE_FLAG_ZERO_COPY) &&
++        !qio_channel_has_feature(ioc, QIO_CHANNEL_FEATURE_WRITE_ZERO_COPY)) {
+         error_setg_errno(errp, EINVAL,
+-                         "Channel does not support file descriptor passing");
++                         "Requested Zero Copy feature is not available");
+         return -1;
+     }
+ 
+-    return klass->io_writev(ioc, iov, niov, fds, nfds, errp);
++    return klass->io_writev(ioc, iov, niov, fds, nfds, flags, errp);
+ }
+ 
+ 
+@@ -217,14 +231,14 @@ int qio_channel_writev_all(QIOChannel *ioc,
+                            size_t niov,
+                            Error **errp)
+ {
+-    return qio_channel_writev_full_all(ioc, iov, niov, NULL, 0, errp);
++    return qio_channel_writev_full_all(ioc, iov, niov, NULL, 0, 0, errp);
+ }
+ 
+ int qio_channel_writev_full_all(QIOChannel *ioc,
+                                 const struct iovec *iov,
+                                 size_t niov,
+                                 int *fds, size_t nfds,
+-                                Error **errp)
++                                int flags, Error **errp)
+ {
+     int ret = -1;
+     struct iovec *local_iov = g_new(struct iovec, niov);
+@@ -237,8 +251,10 @@ int qio_channel_writev_full_all(QIOChannel *ioc,
+ 
+     while (nlocal_iov > 0) {
+         ssize_t len;
+-        len = qio_channel_writev_full(ioc, local_iov, nlocal_iov, fds, nfds,
+-                                      errp);
++
++        len = qio_channel_writev_full(ioc, local_iov, nlocal_iov, fds,
++                                            nfds, flags, errp);
++
+         if (len == QIO_CHANNEL_ERR_BLOCK) {
+             if (qemu_in_coroutine()) {
+                 qio_channel_yield(ioc, G_IO_OUT);
+@@ -277,7 +293,7 @@ ssize_t qio_channel_writev(QIOChannel *ioc,
+                            size_t niov,
+                            Error **errp)
+ {
+-    return qio_channel_writev_full(ioc, iov, niov, NULL, 0, errp);
++    return qio_channel_writev_full(ioc, iov, niov, NULL, 0, 0, errp);
+ }
+ 
+ 
+@@ -297,7 +313,7 @@ ssize_t qio_channel_write(QIOChannel *ioc,
+                           Error **errp)
+ {
+     struct iovec iov = { .iov_base = (char *)buf, .iov_len = buflen };
+-    return qio_channel_writev_full(ioc, &iov, 1, NULL, 0, errp);
++    return qio_channel_writev_full(ioc, &iov, 1, NULL, 0, 0, errp);
+ }
+ 
+ 
+@@ -473,6 +489,19 @@ off_t qio_channel_io_seek(QIOChannel *ioc,
+     return klass->io_seek(ioc, offset, whence, errp);
+ }
+ 
++int qio_channel_flush(QIOChannel *ioc,
++                                Error **errp)
++{
++    QIOChannelClass *klass = QIO_CHANNEL_GET_CLASS(ioc);
++
++    if (!klass->io_flush ||
++        !qio_channel_has_feature(ioc, QIO_CHANNEL_FEATURE_WRITE_ZERO_COPY)) {
++        return 0;
++    }
++
++    return klass->io_flush(ioc, errp);
++}
++
+ 
+ static void qio_channel_restart_read(void *opaque)
+ {
+diff --git a/migration/rdma.c b/migration/rdma.c
+index f5d3bbe7e9..54acd2000e 100644
+--- a/migration/rdma.c
++++ b/migration/rdma.c
+@@ -2833,6 +2833,7 @@ static ssize_t qio_channel_rdma_writev(QIOChannel *ioc,
+                                        size_t niov,
+                                        int *fds,
+                                        size_t nfds,
++                                       int flags,
+                                        Error **errp)
+ {
+     QIOChannelRDMA *rioc = QIO_CHANNEL_RDMA(ioc);
+diff --git a/scsi/pr-manager-helper.c b/scsi/pr-manager-helper.c
+index 451c7631b7..3be52a98d5 100644
+--- a/scsi/pr-manager-helper.c
++++ b/scsi/pr-manager-helper.c
+@@ -77,7 +77,7 @@ static int pr_manager_helper_write(PRManagerHelper *pr_mgr,
+         iov.iov_base = (void *)buf;
+         iov.iov_len = sz;
+         n_written = qio_channel_writev_full(QIO_CHANNEL(pr_mgr->ioc), &iov, 1,
+-                                            nfds ? &fd : NULL, nfds, errp);
++                                            nfds ? &fd : NULL, nfds, 0, errp);
+ 
+         if (n_written <= 0) {
+             assert(n_written != QIO_CHANNEL_ERR_BLOCK);
+diff --git a/tests/unit/test-io-channel-socket.c b/tests/unit/test-io-channel-socket.c
+index c49eec1f03..6713886d02 100644
+--- a/tests/unit/test-io-channel-socket.c
++++ b/tests/unit/test-io-channel-socket.c
+@@ -444,6 +444,7 @@ static void test_io_channel_unix_fd_pass(void)
+                             G_N_ELEMENTS(iosend),
+                             fdsend,
+                             G_N_ELEMENTS(fdsend),
++                            0,
+                             &error_abort);
+ 
+     qio_channel_readv_full(dst,
+-- 
+2.35.3
+

SOURCES/kvm-QIOChannelSocket-Add-support-for-MSG_ZEROCOPY-IPV6.patch

@@ -0,0 +1,56 @@
+From a6c4aed18a027ce8e107fdf9184e9ea43a86f843 Mon Sep 17 00:00:00 2001
+From: Leonardo Bras <leobras@redhat.com>
+Date: Thu, 4 Aug 2022 04:10:43 -0300
+Subject: [PATCH 8/9] QIOChannelSocket: Add support for MSG_ZEROCOPY + IPV6
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Leonardo Brás <leobras@redhat.com>
+RH-MergeRequest: 201: Zero-copy-send fixes + improvements
+RH-Commit: [8/8] 6e26ee7c9ebaedb07623313cb0678816867751dd
+RH-Bugzilla: 2110203
+RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+RH-Acked-by: Peter Xu <peterx@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+
+For using MSG_ZEROCOPY, there are two steps:
+1 - io_writev() the packet, which enqueues the packet for sending, and
+2 - io_flush(), which gets confirmation that all packets got correctly sent
+
+Currently, if MSG_ZEROCOPY is used to send packets over IPV6, no error will
+be reported in (1), but it will fail in the first time (2) happens.
+
+This happens because (2) currently checks for cmsg_level & cmsg_type
+associated with IPV4 only, before reporting any error.
+
+Add checks for cmsg_level & cmsg_type associated with IPV6, and thus enable
+support for MSG_ZEROCOPY + IPV6
+
+Fixes: 2bc58ffc29 ("QIOChannelSocket: Implement io_writev zero copy flag & io_flush for CONFIG_LINUX")
+Signed-off-by: Leonardo Bras <leobras@redhat.com>
+Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
+(cherry picked from commit 5258a7e2c0677d16e9e1d06845f60171adf0b290)
+Signed-off-by: Leonardo Bras <leobras@redhat.com>
+---
+ io/channel-socket.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/io/channel-socket.c b/io/channel-socket.c
+index cf0d67c51b..6010ad7017 100644
+--- a/io/channel-socket.c
++++ b/io/channel-socket.c
+@@ -747,8 +747,8 @@ static int qio_channel_socket_flush(QIOChannel *ioc,
+         }
+ 
+         cm = CMSG_FIRSTHDR(&msg);
+-        if (cm->cmsg_level != SOL_IP &&
+-            cm->cmsg_type != IP_RECVERR) {
++        if (cm->cmsg_level != SOL_IP   && cm->cmsg_type != IP_RECVERR &&
++            cm->cmsg_level != SOL_IPV6 && cm->cmsg_type != IPV6_RECVERR) {
+             error_setg_errno(errp, EPROTOTYPE,
+                              "Wrong cmsg in errqueue");
+             return -1;
+-- 
+2.31.1
+

SOURCES/kvm-QIOChannelSocket-Fix-zero-copy-flush-returning-code-.patch

@@ -0,0 +1,65 @@
+From 905cc8032fc63619efb3f0a8c9754b7190bcc43a Mon Sep 17 00:00:00 2001
+From: Leonardo Bras <leobras@redhat.com>
+Date: Mon, 11 Jul 2022 18:11:11 -0300
+Subject: [PATCH 3/9] QIOChannelSocket: Fix zero-copy flush returning code 1
+ when nothing sent
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Leonardo Brás <leobras@redhat.com>
+RH-MergeRequest: 201: Zero-copy-send fixes + improvements
+RH-Commit: [3/8] 1ad707702fa26cd4d0fa1870c21f5f26ae93ff97
+RH-Bugzilla: 2110203
+RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+RH-Acked-by: Peter Xu <peterx@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+
+If flush is called when no buffer was sent with MSG_ZEROCOPY, it currently
+returns 1. This return code should be used only when Linux fails to use
+MSG_ZEROCOPY on a lot of sendmsg().
+
+Fix this by returning early from flush if no sendmsg(...,MSG_ZEROCOPY)
+was attempted.
+
+Fixes: 2bc58ffc2926 ("QIOChannelSocket: Implement io_writev zero copy flag & io_flush for CONFIG_LINUX")
+Signed-off-by: Leonardo Bras <leobras@redhat.com>
+Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
+Acked-by: Daniel P. Berrangé <berrange@redhat.com>
+Reviewed-by: Juan Quintela <quintela@redhat.com>
+Reviewed-by: Peter Xu <peterx@redhat.com>
+Message-Id: <20220711211112.18951-2-leobras@redhat.com>
+Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+(cherry picked from commit 927f93e099c4f9184e60a1bc61624ac2d04d0223)
+Signed-off-by: Leonardo Bras <leobras@redhat.com>
+---
+ io/channel-socket.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/io/channel-socket.c b/io/channel-socket.c
+index df858da924..cf0d67c51b 100644
+--- a/io/channel-socket.c
++++ b/io/channel-socket.c
+@@ -717,12 +717,18 @@ static int qio_channel_socket_flush(QIOChannel *ioc,
+     struct cmsghdr *cm;
+     char control[CMSG_SPACE(sizeof(*serr))];
+     int received;
+-    int ret = 1;
++    int ret;
++
++    if (sioc->zero_copy_queued == sioc->zero_copy_sent) {
++        return 0;
++    }
+ 
+     msg.msg_control = control;
+     msg.msg_controllen = sizeof(control);
+     memset(control, 0, sizeof(control));
+ 
++    ret = 1;
++
+     while (sioc->zero_copy_sent < sioc->zero_copy_queued) {
+         received = recvmsg(sioc->fd, &msg, MSG_ERRQUEUE);
+         if (received < 0) {
+-- 
+2.31.1
+

SOURCES/kvm-QIOChannelSocket-Fix-zero-copy-send-so-socket-flush-.patch

@@ -0,0 +1,58 @@
+From c1fd32d93ae42fcf3c1a25f4d56e669f251087d8 Mon Sep 17 00:00:00 2001
+From: Leonardo Bras <leobras@redhat.com>
+Date: Mon, 20 Jun 2022 02:39:43 -0300
+Subject: [PATCH 25/37] QIOChannelSocket: Fix zero-copy send so socket flush
+ works
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Leonardo Brás <leobras@redhat.com>
+RH-MergeRequest: 191: MSG_ZEROCOPY + Multifd @ rhel8.7
+RH-Commit: [25/26] 3ede94f3269e21c3ace073ed1a6f24696315bcbb
+RH-Bugzilla: 2072049
+RH-Acked-by: Peter Xu <peterx@redhat.com>
+RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
+RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+
+Somewhere between v6 and v7 the of the zero-copy-send patchset a crucial
+part of the flushing mechanism got missing: incrementing zero_copy_queued.
+
+Without that, the flushing interface becomes a no-op, and there is no
+guarantee the buffer is really sent.
+
+This can go as bad as causing a corruption in RAM during migration.
+
+Fixes: 2bc58ffc2926 ("QIOChannelSocket: Implement io_writev zero copy flag & io_flush for CONFIG_LINUX")
+Reported-by: 徐闯 <xuchuangxclwt@bytedance.com>
+Signed-off-by: Leonardo Bras <leobras@redhat.com>
+Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
+Reviewed-by: Peter Xu <peterx@redhat.com>
+Reviewed-by: Juan Quintela <quintela@redhat.com>
+Signed-off-by: Juan Quintela <quintela@redhat.com>
+Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+(cherry picked from commit 4f5a09714c983a3471fd12e3c7f3196e95c650c1)
+Signed-off-by: Leonardo Bras <leobras@redhat.com>
+---
+ io/channel-socket.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/io/channel-socket.c b/io/channel-socket.c
+index 7d37b39de7..df858da924 100644
+--- a/io/channel-socket.c
++++ b/io/channel-socket.c
+@@ -612,6 +612,11 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
+                          "Unable to write to socket");
+         return -1;
+     }
++
++    if (flags & QIO_CHANNEL_WRITE_FLAG_ZERO_COPY) {
++        sioc->zero_copy_queued++;
++    }
++
+     return ret;
+ }
+ #else /* WIN32 */
+-- 
+2.35.3
+

SOURCES/kvm-QIOChannelSocket-Implement-io_writev-zero-copy-flag-.patch

@@ -0,0 +1,249 @@
+From 5fd7af93a06adaddbae719aabbaf912159f4fb28 Mon Sep 17 00:00:00 2001
+From: Leonardo Bras <leobras@redhat.com>
+Date: Wed, 18 May 2022 02:52:25 -0300
+Subject: [PATCH 18/37] QIOChannelSocket: Implement io_writev zero copy flag &
+ io_flush for CONFIG_LINUX
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Leonardo Brás <leobras@redhat.com>
+RH-MergeRequest: 191: MSG_ZEROCOPY + Multifd @ rhel8.7
+RH-Commit: [18/26] 6f65c8c879a5df57213b541d58285b65178f8547
+RH-Bugzilla: 2072049
+RH-Acked-by: Peter Xu <peterx@redhat.com>
+RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
+RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+
+For CONFIG_LINUX, implement the new zero copy flag and the optional callback
+io_flush on QIOChannelSocket, but enables it only when MSG_ZEROCOPY
+feature is available in the host kernel, which is checked on
+qio_channel_socket_connect_sync()
+
+qio_channel_socket_flush() was implemented by counting how many times
+sendmsg(...,MSG_ZEROCOPY) was successfully called, and then reading the
+socket's error queue, in order to find how many of them finished sending.
+Flush will loop until those counters are the same, or until some error occurs.
+
+Notes on using writev() with QIO_CHANNEL_WRITE_FLAG_ZERO_COPY:
+1: Buffer
+- As MSG_ZEROCOPY tells the kernel to use the same user buffer to avoid copying,
+some caution is necessary to avoid overwriting any buffer before it's sent.
+If something like this happen, a newer version of the buffer may be sent instead.
+- If this is a problem, it's recommended to call qio_channel_flush() before freeing
+or re-using the buffer.
+
+2: Locked memory
+- When using MSG_ZERCOCOPY, the buffer memory will be locked after queued, and
+unlocked after it's sent.
+- Depending on the size of each buffer, and how often it's sent, it may require
+a larger amount of locked memory than usually available to non-root user.
+- If the required amount of locked memory is not available, writev_zero_copy
+will return an error, which can abort an operation like migration,
+- Because of this, when an user code wants to add zero copy as a feature, it
+requires a mechanism to disable it, so it can still be accessible to less
+privileged users.
+
+Signed-off-by: Leonardo Bras <leobras@redhat.com>
+Reviewed-by: Peter Xu <peterx@redhat.com>
+Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
+Reviewed-by: Juan Quintela <quintela@redhat.com>
+Message-Id: <20220513062836.965425-4-leobras@redhat.com>
+Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+(cherry picked from commit 2bc58ffc2926a4efdd03edfb5909861fefc68c3d)
+Signed-off-by: Leonardo Bras <leobras@redhat.com>
+---
+ include/io/channel-socket.h |   2 +
+ io/channel-socket.c         | 116 ++++++++++++++++++++++++++++++++++--
+ 2 files changed, 114 insertions(+), 4 deletions(-)
+
+diff --git a/include/io/channel-socket.h b/include/io/channel-socket.h
+index e747e63514..513c428fe4 100644
+--- a/include/io/channel-socket.h
++++ b/include/io/channel-socket.h
+@@ -47,6 +47,8 @@ struct QIOChannelSocket {
+     socklen_t localAddrLen;
+     struct sockaddr_storage remoteAddr;
+     socklen_t remoteAddrLen;
++    ssize_t zero_copy_queued;
++    ssize_t zero_copy_sent;
+ };
+ 
+ 
+diff --git a/io/channel-socket.c b/io/channel-socket.c
+index bfbd64787e..38a46ba213 100644
+--- a/io/channel-socket.c
++++ b/io/channel-socket.c
+@@ -26,6 +26,14 @@
+ #include "io/channel-watch.h"
+ #include "trace.h"
+ #include "qapi/clone-visitor.h"
++#ifdef CONFIG_LINUX
++#include <linux/errqueue.h>
++#include <sys/socket.h>
++
++#if (defined(MSG_ZEROCOPY) && defined(SO_ZEROCOPY))
++#define QEMU_MSG_ZEROCOPY
++#endif
++#endif
+ 
+ #define SOCKET_MAX_FDS 16
+ 
+@@ -55,6 +63,8 @@ qio_channel_socket_new(void)
+ 
+     sioc = QIO_CHANNEL_SOCKET(object_new(TYPE_QIO_CHANNEL_SOCKET));
+     sioc->fd = -1;
++    sioc->zero_copy_queued = 0;
++    sioc->zero_copy_sent = 0;
+ 
+     ioc = QIO_CHANNEL(sioc);
+     qio_channel_set_feature(ioc, QIO_CHANNEL_FEATURE_SHUTDOWN);
+@@ -154,6 +164,16 @@ int qio_channel_socket_connect_sync(QIOChannelSocket *ioc,
+         return -1;
+     }
+ 
++#ifdef QEMU_MSG_ZEROCOPY
++    int ret, v = 1;
++    ret = setsockopt(fd, SOL_SOCKET, SO_ZEROCOPY, &v, sizeof(v));
++    if (ret == 0) {
++        /* Zero copy available on host */
++        qio_channel_set_feature(QIO_CHANNEL(ioc),
++                                QIO_CHANNEL_FEATURE_WRITE_ZERO_COPY);
++    }
++#endif
++
+     return 0;
+ }
+ 
+@@ -534,6 +554,7 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
+     char control[CMSG_SPACE(sizeof(int) * SOCKET_MAX_FDS)];
+     size_t fdsize = sizeof(int) * nfds;
+     struct cmsghdr *cmsg;
++    int sflags = 0;
+ 
+     memset(control, 0, CMSG_SPACE(sizeof(int) * SOCKET_MAX_FDS));
+ 
+@@ -558,15 +579,31 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
+         memcpy(CMSG_DATA(cmsg), fds, fdsize);
+     }
+ 
++#ifdef QEMU_MSG_ZEROCOPY
++    if (flags & QIO_CHANNEL_WRITE_FLAG_ZERO_COPY) {
++        sflags = MSG_ZEROCOPY;
++    }
++#endif
++
+  retry:
+-    ret = sendmsg(sioc->fd, &msg, 0);
++    ret = sendmsg(sioc->fd, &msg, sflags);
+     if (ret <= 0) {
+-        if (errno == EAGAIN) {
++        switch (errno) {
++        case EAGAIN:
+             return QIO_CHANNEL_ERR_BLOCK;
+-        }
+-        if (errno == EINTR) {
++        case EINTR:
+             goto retry;
++#ifdef QEMU_MSG_ZEROCOPY
++        case ENOBUFS:
++            if (sflags & MSG_ZEROCOPY) {
++                error_setg_errno(errp, errno,
++                                 "Process can't lock enough memory for using MSG_ZEROCOPY");
++                return -1;
++            }
++            break;
++#endif
+         }
++
+         error_setg_errno(errp, errno,
+                          "Unable to write to socket");
+         return -1;
+@@ -660,6 +697,74 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
+ }
+ #endif /* WIN32 */
+ 
++
++#ifdef QEMU_MSG_ZEROCOPY
++static int qio_channel_socket_flush(QIOChannel *ioc,
++                                    Error **errp)
++{
++    QIOChannelSocket *sioc = QIO_CHANNEL_SOCKET(ioc);
++    struct msghdr msg = {};
++    struct sock_extended_err *serr;
++    struct cmsghdr *cm;
++    char control[CMSG_SPACE(sizeof(*serr))];
++    int received;
++    int ret = 1;
++
++    msg.msg_control = control;
++    msg.msg_controllen = sizeof(control);
++    memset(control, 0, sizeof(control));
++
++    while (sioc->zero_copy_sent < sioc->zero_copy_queued) {
++        received = recvmsg(sioc->fd, &msg, MSG_ERRQUEUE);
++        if (received < 0) {
++            switch (errno) {
++            case EAGAIN:
++                /* Nothing on errqueue, wait until something is available */
++                qio_channel_wait(ioc, G_IO_ERR);
++                continue;
++            case EINTR:
++                continue;
++            default:
++                error_setg_errno(errp, errno,
++                                 "Unable to read errqueue");
++                return -1;
++            }
++        }
++
++        cm = CMSG_FIRSTHDR(&msg);
++        if (cm->cmsg_level != SOL_IP &&
++            cm->cmsg_type != IP_RECVERR) {
++            error_setg_errno(errp, EPROTOTYPE,
++                             "Wrong cmsg in errqueue");
++            return -1;
++        }
++
++        serr = (void *) CMSG_DATA(cm);
++        if (serr->ee_errno != SO_EE_ORIGIN_NONE) {
++            error_setg_errno(errp, serr->ee_errno,
++                             "Error on socket");
++            return -1;
++        }
++        if (serr->ee_origin != SO_EE_ORIGIN_ZEROCOPY) {
++            error_setg_errno(errp, serr->ee_origin,
++                             "Error not from zero copy");
++            return -1;
++        }
++
++        /* No errors, count successfully finished sendmsg()*/
++        sioc->zero_copy_sent += serr->ee_data - serr->ee_info + 1;
++
++        /* If any sendmsg() succeeded using zero copy, return 0 at the end */
++        if (serr->ee_code != SO_EE_CODE_ZEROCOPY_COPIED) {
++            ret = 0;
++        }
++    }
++
++    return ret;
++}
++
++#endif /* QEMU_MSG_ZEROCOPY */
++
+ static int
+ qio_channel_socket_set_blocking(QIOChannel *ioc,
+                                 bool enabled,
+@@ -789,6 +894,9 @@ static void qio_channel_socket_class_init(ObjectClass *klass,
+     ioc_klass->io_set_delay = qio_channel_socket_set_delay;
+     ioc_klass->io_create_watch = qio_channel_socket_create_watch;
+     ioc_klass->io_set_aio_fd_handler = qio_channel_socket_set_aio_fd_handler;
++#ifdef QEMU_MSG_ZEROCOPY
++    ioc_klass->io_flush = qio_channel_socket_flush;
++#endif
+ }
+ 
+ static const TypeInfo qio_channel_socket_info = {
+-- 
+2.35.3
+

SOURCES/kvm-QIOChannelSocket-Introduce-assert-and-reduce-ifdefs-.patch

@@ -0,0 +1,82 @@
+From cbfaf86331c2b2e01a2083303b7554672bf991b7 Mon Sep 17 00:00:00 2001
+From: Leonardo Bras <leobras@redhat.com>
+Date: Mon, 20 Jun 2022 02:39:42 -0300
+Subject: [PATCH 24/37] QIOChannelSocket: Introduce assert and reduce ifdefs to
+ improve readability
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Leonardo Brás <leobras@redhat.com>
+RH-MergeRequest: 191: MSG_ZEROCOPY + Multifd @ rhel8.7
+RH-Commit: [24/26] b50e2e65307149f247155a7f7a032dc99e57718d
+RH-Bugzilla: 2072049
+RH-Acked-by: Peter Xu <peterx@redhat.com>
+RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
+RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+
+During implementation of MSG_ZEROCOPY feature, a lot of #ifdefs were
+introduced, particularly at qio_channel_socket_writev().
+
+Rewrite some of those changes so it's easier to read.
+
+Also, introduce an assert to help detect incorrect zero-copy usage is when
+it's disabled on build.
+
+Signed-off-by: Leonardo Bras <leobras@redhat.com>
+Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
+Reviewed-by: Juan Quintela <quintela@redhat.com>
+Reviewed-by: Peter Xu <peterx@redhat.com>
+Signed-off-by: Juan Quintela <quintela@redhat.com>
+Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+  dgilbert: Fixed up thinko'd g_assert_unreachable->g_assert_not_reached
+(cherry picked from commit 803ca43e4c7fcf32f9f68c118301ccd0c83ece3f)
+Signed-off-by: Leonardo Bras <leobras@redhat.com>
+---
+ io/channel-socket.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/io/channel-socket.c b/io/channel-socket.c
+index 38a46ba213..7d37b39de7 100644
+--- a/io/channel-socket.c
++++ b/io/channel-socket.c
+@@ -579,11 +579,17 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
+         memcpy(CMSG_DATA(cmsg), fds, fdsize);
+     }
+ 
+-#ifdef QEMU_MSG_ZEROCOPY
+     if (flags & QIO_CHANNEL_WRITE_FLAG_ZERO_COPY) {
++#ifdef QEMU_MSG_ZEROCOPY
+         sflags = MSG_ZEROCOPY;
+-    }
++#else
++        /*
++         * We expect QIOChannel class entry point to have
++         * blocked this code path already
++         */
++        g_assert_not_reached();
+ #endif
++    }
+ 
+  retry:
+     ret = sendmsg(sioc->fd, &msg, sflags);
+@@ -593,15 +599,13 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
+             return QIO_CHANNEL_ERR_BLOCK;
+         case EINTR:
+             goto retry;
+-#ifdef QEMU_MSG_ZEROCOPY
+         case ENOBUFS:
+-            if (sflags & MSG_ZEROCOPY) {
++            if (flags & QIO_CHANNEL_WRITE_FLAG_ZERO_COPY) {
+                 error_setg_errno(errp, errno,
+                                  "Process can't lock enough memory for using MSG_ZEROCOPY");
+                 return -1;
+             }
+             break;
+-#endif
+         }
+ 
+         error_setg_errno(errp, errno,
+-- 
+2.35.3
+

SOURCES/kvm-RHEL-Enable-x-not-migrate-acpi-index-for-all-pre-RHE.patch

@@ -0,0 +1,43 @@
+From f1480fe9a4054113ddacd218961e29f31c33d329 Mon Sep 17 00:00:00 2001
+From: Peter Xu <peterx@redhat.com>
+Date: Wed, 6 Sep 2023 16:29:23 -0400
+Subject: [PATCH 2/3] RHEL: Enable "x-not-migrate-acpi-index" for all pre-RHEL8
+ guests
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Peter Xu <peterx@redhat.com>
+RH-MergeRequest: 343: acpi: fix acpi_index migration
+RH-Jira: RHEL-20189
+RH-Acked-by: Leonardo Brás <leobras@redhat.com>
+RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
+RH-Acked-by: Prasad Pandit <None>
+RH-Commit: [2/2] 0a26a71236e68dd7feb5d2063254090e3852d6ba
+
+The acpi index migration is simply broken before for all pre-RHEL8
+branches.  Don't migrate it for all of them.
+
+Signed-off-by: Peter Xu <peterx@redhat.com>
+---
+ hw/core/machine.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/hw/core/machine.c b/hw/core/machine.c
+index 2724f6848a..6650a3d7b7 100644
+--- a/hw/core/machine.c
++++ b/hw/core/machine.c
+@@ -44,6 +44,10 @@ GlobalProperty hw_compat_rhel_8_6[] = {
+      * we need do disable it downstream on the latest hw_compat_rhel_8.
+      */
+     { "vhost-vsock-device", "seqpacket", "off" },
++    /*
++     * RHEL-2186: all rhel8 machines should not migrate acpi index.
++     */
++    { "PIIX4_PM", "x-not-migrate-acpi-index", "on"},
+ };
+ const size_t hw_compat_rhel_8_6_len = G_N_ELEMENTS(hw_compat_rhel_8_6);
+ 
+-- 
+2.41.0
+

SOURCES/kvm-RHEL-disable-seqpacket-for-vhost-vsock-device-in-rhe.patch

@@ -0,0 +1,107 @@
+From e0e4f01c6f4fb5881960f72ae4e80951b711131e Mon Sep 17 00:00:00 2001
+From: Stefano Garzarella <sgarzare@redhat.com>
+Date: Thu, 24 Mar 2022 16:04:57 +0100
+Subject: [PATCH 1/5] RHEL: disable "seqpacket" for "vhost-vsock-device" in
+ rhel8.6.0
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Stefano Garzarella <sgarzare@redhat.com>
+RH-MergeRequest: 136: RHEL: disable "seqpacket" for "vhost-vsock-device" in rhel8.6.0 [rhel-8.7.0]
+RH-Commit: [1/1] d82ea09e123679521503689f7d9af1c03dc71bfc
+RH-Bugzilla: 2068202
+RH-Acked-by: Jason Wang <None>
+RH-Acked-by: Eugenio Pérez <None>
+RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+
+vhost-vsock device in RHEL 8 kernels doesn't support seqpacket.
+To avoid problems when migrating a VM from RHEL 9 host, we need to
+disable it in rhel8-* machine types.
+
+Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
+---
+ hw/core/machine.c          | 10 ++++++++++
+ hw/i386/pc_piix.c          |  2 ++
+ hw/i386/pc_q35.c           |  2 ++
+ hw/s390x/s390-virtio-ccw.c |  1 +
+ include/hw/boards.h        |  3 +++
+ 5 files changed, 18 insertions(+)
+
+diff --git a/hw/core/machine.c b/hw/core/machine.c
+index 024b025fc2..76fcabec7a 100644
+--- a/hw/core/machine.c
++++ b/hw/core/machine.c
+@@ -37,6 +37,16 @@
+ #include "hw/virtio/virtio.h"
+ #include "hw/virtio/virtio-pci.h"
+ 
++GlobalProperty hw_compat_rhel_8_6[] = {
++    /* hw_compat_rhel_8_6 bz 2068202 */
++    /*
++     * vhost-vsock device in RHEL 8 kernels doesn't support seqpacket, so
++     * we need do disable it downstream on the latest hw_compat_rhel_8.
++     */
++    { "vhost-vsock-device", "seqpacket", "off" },
++};
++const size_t hw_compat_rhel_8_6_len = G_N_ELEMENTS(hw_compat_rhel_8_6);
++
+ /*
+  * Mostly the same as hw_compat_6_0 and hw_compat_6_1
+  */
+diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
+index f03a8f0db8..ab6d03e07a 100644
+--- a/hw/i386/pc_piix.c
++++ b/hw/i386/pc_piix.c
+@@ -998,6 +998,8 @@ static void pc_machine_rhel760_options(MachineClass *m)
+     pcmc->kvmclock_create_always = false;
+     /* From pc_i440fx_5_1_machine_options() */
+     pcmc->pci_root_uid = 1;
++    compat_props_add(m->compat_props, hw_compat_rhel_8_6,
++                     hw_compat_rhel_8_6_len);
+     compat_props_add(m->compat_props, hw_compat_rhel_8_5,
+                      hw_compat_rhel_8_5_len);
+     compat_props_add(m->compat_props, pc_rhel_8_5_compat,
+diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
+index 5559261d9e..882fe7a68d 100644
+--- a/hw/i386/pc_q35.c
++++ b/hw/i386/pc_q35.c
+@@ -658,6 +658,8 @@ static void pc_q35_machine_rhel860_options(MachineClass *m)
+     m->desc = "RHEL-8.6.0 PC (Q35 + ICH9, 2009)";
+     pcmc->smbios_stream_product = "RHEL-AV";
+     pcmc->smbios_stream_version = "8.6.0";
++    compat_props_add(m->compat_props, hw_compat_rhel_8_6,
++                     hw_compat_rhel_8_6_len);
+ }
+ 
+ DEFINE_PC_MACHINE(q35_rhel860, "pc-q35-rhel8.6.0", pc_q35_init_rhel860,
+diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
+index 9795eb9406..bec270598b 100644
+--- a/hw/s390x/s390-virtio-ccw.c
++++ b/hw/s390x/s390-virtio-ccw.c
+@@ -1109,6 +1109,7 @@ static void ccw_machine_rhel860_instance_options(MachineState *machine)
+ 
+ static void ccw_machine_rhel860_class_options(MachineClass *mc)
+ {
++    compat_props_add(mc->compat_props, hw_compat_rhel_8_6, hw_compat_rhel_8_6_len);
+ }
+ DEFINE_CCW_MACHINE(rhel860, "rhel8.6.0", true);
+ 
+diff --git a/include/hw/boards.h b/include/hw/boards.h
+index 04e8759815..4ddb798144 100644
+--- a/include/hw/boards.h
++++ b/include/hw/boards.h
+@@ -443,6 +443,9 @@ extern const size_t hw_compat_2_2_len;
+ extern GlobalProperty hw_compat_2_1[];
+ extern const size_t hw_compat_2_1_len;
+ 
++extern GlobalProperty hw_compat_rhel_8_6[];
++extern const size_t hw_compat_rhel_8_6_len;
++
+ extern GlobalProperty hw_compat_rhel_8_5[];
+ extern const size_t hw_compat_rhel_8_5_len;
+ 
+-- 
+2.27.0
+

SOURCES/kvm-RHEL-hw-i386-disable-nested-PERF_GLOBAL_CTRL-MSR-sup.patch

@@ -1,53 +0,0 @@
-From 481357ea8ae32b6894860c296cf6a2898260195f Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Fri, 17 Jan 2020 13:18:27 +0100
-Subject: [PATCH 4/4] RHEL: hw/i386: disable nested PERF_GLOBAL_CTRL MSR
- support
-
-RH-Author: Paolo Bonzini <pbonzini@redhat.com>
-Message-id: <20200117131827.20361-1-pbonzini@redhat.com>
-Patchwork-id: 93405
-O-Subject: [RHEL-AV-8.2.0 qemu-kvm PATCH v3] RHEL: hw/i386: disable nested PERF_GLOBAL_CTRL MSR support
-Bugzilla: 1559846
-RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
-RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-
-BZ: 1559846
-BRANCH: rhel-av-8.2.0
-BREW: 25775160
-UPSTREAM: RHEL only
-
-Nested PERF_GLOBAL_CTRL support is not present in the 8.2 kernel.  Drop the
-features via compat properties, they will be moved to 8.2 machine type compat
-properties in the 8.3 timeframe.
-
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
----
-	No change, for v2 I mistakenly wrote "origin/rhel-av-8.2.0" as the
-	branch. :(
-
- hw/i386/pc.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
----
- hw/i386/pc.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/hw/i386/pc.c b/hw/i386/pc.c
-index 61e70e4..73a0f11 100644
---- a/hw/i386/pc.c
-+++ b/hw/i386/pc.c
-@@ -351,6 +351,8 @@ const size_t pc_compat_1_4_len = G_N_ELEMENTS(pc_compat_1_4);
- GlobalProperty pc_rhel_compat[] = {
-     { TYPE_X86_CPU, "host-phys-bits", "on" },
-     { TYPE_X86_CPU, "host-phys-bits-limit", "48" },
-+    { TYPE_X86_CPU, "vmx-entry-load-perf-global-ctrl", "off" },
-+    { TYPE_X86_CPU, "vmx-exit-load-perf-global-ctrl", "off" },
-     /* bz 1508330 */ 
-     { "vfio-pci", "x-no-geforce-quirks", "on" },
- };
--- 
-1.8.3.1
-

SOURCES/kvm-Reallocate-dirty_bmap-when-we-change-a-slot.patch

@@ -1,115 +0,0 @@
-From c477581ccc6962651d4d6c702a6c3e2fcc5e4205 Mon Sep 17 00:00:00 2001
-From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
-Date: Thu, 2 Jan 2020 11:56:51 +0000
-Subject: [PATCH 2/2] kvm: Reallocate dirty_bmap when we change a slot
-
-RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
-Message-id: <20200102115651.140177-1-dgilbert@redhat.com>
-Patchwork-id: 93256
-O-Subject: [RHEL-AV-8.2.0 qemu-kvm PATCH 1/1] kvm: Reallocate dirty_bmap when we change a slot
-Bugzilla: 1772774
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
-
-From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
-
-bz: https://bugzilla.redhat.com/show_bug.cgi?id=1772774
-brew: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=25575691
-branch: rhel-av-8.2.0
-
-kvm_set_phys_mem can be called to reallocate a slot by something the
-guest does (e.g. writing to PAM and other chipset registers).
-This can happen in the middle of a migration, and if we're unlucky
-it can now happen between the split 'sync' and 'clear'; the clear
-asserts if there's no bmap to clear.   Recreate the bmap whenever
-we change the slot, keeping the clear path happy.
-
-Typically this is triggered by the guest rebooting during a migrate.
-
-Corresponds to:
-https://bugzilla.redhat.com/show_bug.cgi?id=1772774
-https://bugzilla.redhat.com/show_bug.cgi?id=1771032
-
-Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
-Reviewed-by: Peter Xu <peterx@redhat.com>
-(cherry picked from commit 9b3a31c745b61758aaa5466a3a9fc0526d409188)
-Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
----
- accel/kvm/kvm-all.c | 44 +++++++++++++++++++++++++++++---------------
- 1 file changed, 29 insertions(+), 15 deletions(-)
-
-diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
-index dc3ed7f..5007bda 100644
---- a/accel/kvm/kvm-all.c
-+++ b/accel/kvm/kvm-all.c
-@@ -518,6 +518,27 @@ static int kvm_get_dirty_pages_log_range(MemoryRegionSection *section,
- 
- #define ALIGN(x, y)  (((x)+(y)-1) & ~((y)-1))
- 
-+/* Allocate the dirty bitmap for a slot  */
-+static void kvm_memslot_init_dirty_bitmap(KVMSlot *mem)
-+{
-+    /*
-+     * XXX bad kernel interface alert
-+     * For dirty bitmap, kernel allocates array of size aligned to
-+     * bits-per-long.  But for case when the kernel is 64bits and
-+     * the userspace is 32bits, userspace can't align to the same
-+     * bits-per-long, since sizeof(long) is different between kernel
-+     * and user space.  This way, userspace will provide buffer which
-+     * may be 4 bytes less than the kernel will use, resulting in
-+     * userspace memory corruption (which is not detectable by valgrind
-+     * too, in most cases).
-+     * So for now, let's align to 64 instead of HOST_LONG_BITS here, in
-+     * a hope that sizeof(long) won't become >8 any time soon.
-+     */
-+    hwaddr bitmap_size = ALIGN(((mem->memory_size) >> TARGET_PAGE_BITS),
-+                                        /*HOST_LONG_BITS*/ 64) / 8;
-+    mem->dirty_bmap = g_malloc0(bitmap_size);
-+}
-+
- /**
-  * kvm_physical_sync_dirty_bitmap - Sync dirty bitmap from kernel space
-  *
-@@ -550,23 +571,9 @@ static int kvm_physical_sync_dirty_bitmap(KVMMemoryListener *kml,
-             goto out;
-         }
- 
--        /* XXX bad kernel interface alert
--         * For dirty bitmap, kernel allocates array of size aligned to
--         * bits-per-long.  But for case when the kernel is 64bits and
--         * the userspace is 32bits, userspace can't align to the same
--         * bits-per-long, since sizeof(long) is different between kernel
--         * and user space.  This way, userspace will provide buffer which
--         * may be 4 bytes less than the kernel will use, resulting in
--         * userspace memory corruption (which is not detectable by valgrind
--         * too, in most cases).
--         * So for now, let's align to 64 instead of HOST_LONG_BITS here, in
--         * a hope that sizeof(long) won't become >8 any time soon.
--         */
-         if (!mem->dirty_bmap) {
--            hwaddr bitmap_size = ALIGN(((mem->memory_size) >> TARGET_PAGE_BITS),
--                                        /*HOST_LONG_BITS*/ 64) / 8;
-             /* Allocate on the first log_sync, once and for all */
--            mem->dirty_bmap = g_malloc0(bitmap_size);
-+            kvm_memslot_init_dirty_bitmap(mem);
-         }
- 
-         d.dirty_bitmap = mem->dirty_bmap;
-@@ -1067,6 +1074,13 @@ static void kvm_set_phys_mem(KVMMemoryListener *kml,
-         mem->ram = ram;
-         mem->flags = kvm_mem_flags(mr);
- 
-+        if (mem->flags & KVM_MEM_LOG_DIRTY_PAGES) {
-+            /*
-+             * Reallocate the bmap; it means it doesn't disappear in
-+             * middle of a migrate.
-+             */
-+            kvm_memslot_init_dirty_bitmap(mem);
-+        }
-         err = kvm_set_user_memory_region(kml, mem, true);
-         if (err) {
-             fprintf(stderr, "%s: error registering slot: %s\n", __func__,
--- 
-1.8.3.1
-

SOURCES/kvm-Replace-remaining-malloc-free-user-with-glib.patch

@@ -1,118 +0,0 @@
-From c012dc9b501d96a2ff54a8a7a182726043b69aeb Mon Sep 17 00:00:00 2001
-From: jmaloy <jmaloy@redhat.com>
-Date: Tue, 12 May 2020 21:15:14 +0100
-Subject: [PATCH 3/7] Replace remaining malloc/free user with glib
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: jmaloy <jmaloy@redhat.com>
-Message-id: <20200512211514.1398384-3-jmaloy@redhat.com>
-Patchwork-id: 96413
-O-Subject: [RHEL-AV-8.2.1 qemu-kvm PATCH 2/2] Replace remaining malloc/free user with glib
-Bugzilla: 1749737
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Acked-by: Thomas Huth <thuth@redhat.com>
-RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-
-From: Marc-André Lureau <marcandre.lureau@redhat.com>
-
-glib mem functions are already used in various places. Let's not mix
-the two, and instead abort on OOM conditions.
-
-Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
-(cherry picked from libslirp commit 3a494648526be4eb96cba739a816a60e933ffd14)
-Signed-off-by: Jon Maloy <jmaloy@redhat.com>
-
-Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
----
- slirp/src/sbuf.c     | 21 ++++++---------------
- slirp/src/socket.c   |  2 +-
- slirp/src/tcp_subr.c |  8 ++------
- 3 files changed, 9 insertions(+), 22 deletions(-)
-
-diff --git a/slirp/src/sbuf.c b/slirp/src/sbuf.c
-index 0569c34..eab87f3 100644
---- a/slirp/src/sbuf.c
-+++ b/slirp/src/sbuf.c
-@@ -9,7 +9,7 @@ static void sbappendsb(struct sbuf *sb, struct mbuf *m);
- 
- void sbfree(struct sbuf *sb)
- {
--    free(sb->sb_data);
-+    g_free(sb->sb_data);
- }
- 
- bool sbdrop(struct sbuf *sb, int num)
-@@ -39,24 +39,15 @@ void sbreserve(struct sbuf *sb, int size)
-     if (sb->sb_data) {
-         /* Already alloced, realloc if necessary */
-         if (sb->sb_datalen != size) {
--            char *new = realloc(sb->sb_data, size);
-+            char *new = g_realloc(sb->sb_data, size);
-             sb->sb_cc = 0;
--            if (new) {
--                sb->sb_data = sb->sb_wptr = sb->sb_rptr = new;
--                sb->sb_datalen = size;
--            } else {
--                free(sb->sb_data);
--                sb->sb_data = sb->sb_wptr = sb->sb_rptr = NULL;
--                sb->sb_datalen = 0;
--            }
-+            sb->sb_data = sb->sb_wptr = sb->sb_rptr = new;
-+            sb->sb_datalen = size;
-         }
-     } else {
--        sb->sb_wptr = sb->sb_rptr = sb->sb_data = (char *)malloc(size);
-+        sb->sb_wptr = sb->sb_rptr = sb->sb_data = g_malloc(size);
-         sb->sb_cc = 0;
--        if (sb->sb_wptr)
--            sb->sb_datalen = size;
--        else
--            sb->sb_datalen = 0;
-+        sb->sb_datalen = size;
-     }
- }
- 
-diff --git a/slirp/src/socket.c b/slirp/src/socket.c
-index 34daffc..ace18bf 100644
---- a/slirp/src/socket.c
-+++ b/slirp/src/socket.c
-@@ -95,7 +95,7 @@ void sofree(struct socket *so)
-         remque(so); /* crashes if so is not in a queue */
- 
-     if (so->so_tcpcb) {
--        free(so->so_tcpcb);
-+        g_free(so->so_tcpcb);
-     }
-     g_free(so);
- }
-diff --git a/slirp/src/tcp_subr.c b/slirp/src/tcp_subr.c
-index 26d4ead..4e5a801 100644
---- a/slirp/src/tcp_subr.c
-+++ b/slirp/src/tcp_subr.c
-@@ -255,11 +255,7 @@ struct tcpcb *tcp_newtcpcb(struct socket *so)
- {
-     register struct tcpcb *tp;
- 
--    tp = (struct tcpcb *)malloc(sizeof(*tp));
--    if (tp == NULL)
--        return ((struct tcpcb *)0);
--
--    memset((char *)tp, 0, sizeof(struct tcpcb));
-+    tp = g_new0(struct tcpcb, 1);
-     tp->seg_next = tp->seg_prev = (struct tcpiphdr *)tp;
-     tp->t_maxseg = (so->so_ffamily == AF_INET) ? TCP_MSS : TCP6_MSS;
- 
-@@ -330,7 +326,7 @@ struct tcpcb *tcp_close(struct tcpcb *tp)
-         remque(tcpiphdr2qlink(tcpiphdr_prev(t)));
-         m_free(m);
-     }
--    free(tp);
-+    g_free(tp);
-     so->so_tcpcb = NULL;
-     /* clobber input socket cache if we're closing the cached connection */
-     if (so == slirp->tcp_last_so)
--- 
-1.8.3.1
-

SOURCES/kvm-Revert-RHEL-disable-hostmem-memfd.patch

@@ -1,58 +0,0 @@
-From 559d5899473dea180ced39a32bfbfbf2310c6e04 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
-Date: Mon, 25 May 2020 15:33:06 +0100
-Subject: [PATCH 4/7] Revert "RHEL: disable hostmem-memfd"
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Marc-André Lureau <marcandre.lureau@redhat.com>
-Message-id: <20200525153306.15373-1-marcandre.lureau@redhat.com>
-Patchwork-id: 96747
-O-Subject: [RHEL-AV-8.2.1 qemu-kvm PATCH] Revert "RHEL: disable hostmem-memfd"
-Bugzilla: 1839030
-RH-Acked-by: Daniel P. Berrange <berrange@redhat.com>
-RH-Acked-by: Sergio Lopez Pascual <slp@redhat.com>
-RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
-
-BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1839030
-BRANCH: rhel-av-8.2.1
-UPSTREAM: RHEL-only
-BREW: http://brewweb.devel.redhat.com/brew/taskinfo?taskID=28817132
-
-This reverts commit f7587ddb9a2731bf678a24156b6285dda79a4b2b.
-
-Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
-Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
----
- backends/Makefile.objs | 3 +--
- util/memfd.c           | 2 +-
- 2 files changed, 2 insertions(+), 3 deletions(-)
-
-diff --git a/backends/Makefile.objs b/backends/Makefile.objs
-index f328d40..f069111 100644
---- a/backends/Makefile.objs
-+++ b/backends/Makefile.objs
-@@ -16,5 +16,4 @@ endif
- 
- common-obj-$(call land,$(CONFIG_VHOST_USER),$(CONFIG_VIRTIO)) += vhost-user.o
- 
--# RHEL: disable memfd
--# common-obj-$(CONFIG_LINUX) += hostmem-memfd.o
-+common-obj-$(CONFIG_LINUX) += hostmem-memfd.o
-diff --git a/util/memfd.c b/util/memfd.c
-index 3303ec9..4a3c07e 100644
---- a/util/memfd.c
-+++ b/util/memfd.c
-@@ -193,7 +193,7 @@ bool qemu_memfd_alloc_check(void)
-  */
- bool qemu_memfd_check(unsigned int flags)
- {
--#if 0 /* RHEL: memfd support disabled */
-+#ifdef CONFIG_LINUX
-     int mfd = memfd_create("test", flags | MFD_CLOEXEC);
- 
-     if (mfd >= 0) {
--- 
-1.8.3.1
-

SOURCES/kvm-Revert-mirror-Don-t-let-an-operation-wait-for-itself.patch

@@ -1,121 +0,0 @@
-From 71b5267ed33f9e60bc98acbabcbed62f01a96ff4 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Mon, 30 Mar 2020 11:19:23 +0100
-Subject: [PATCH 3/4] Revert "mirror: Don't let an operation wait for itself"
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-Message-id: <20200330111924.22938-2-kwolf@redhat.com>
-Patchwork-id: 94464
-O-Subject: [RHEL-AV-8.2.0 qemu-kvm PATCH 1/2] Revert "mirror: Don't let an operation wait for itself"
-Bugzilla: 1794692
-RH-Acked-by: Maxim Levitsky <mlevitsk@redhat.com>
-RH-Acked-by: Danilo de Paula <ddepaula@redhat.com>
-RH-Acked-by: Max Reitz <mreitz@redhat.com>
-
-This reverts commit 7e6c4ff792734e196c8ca82564c56b5e7c6288ca.
-
-The fix was incomplete as it only protected against requests waiting for
-themselves, but not against requests waiting for each other. We need a
-different solution.
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Message-Id: <20200326153628.4869-2-kwolf@redhat.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 9178f4fe5f083064f5c91f04d98c815ce5a5af1c)
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
----
- block/mirror.c | 21 +++++++++------------
- 1 file changed, 9 insertions(+), 12 deletions(-)
-
-diff --git a/block/mirror.c b/block/mirror.c
-index cacbc70..8959e42 100644
---- a/block/mirror.c
-+++ b/block/mirror.c
-@@ -283,14 +283,11 @@ static int mirror_cow_align(MirrorBlockJob *s, int64_t *offset,
- }
- 
- static inline void coroutine_fn
--mirror_wait_for_any_operation(MirrorBlockJob *s, MirrorOp *self, bool active)
-+mirror_wait_for_any_operation(MirrorBlockJob *s, bool active)
- {
-     MirrorOp *op;
- 
-     QTAILQ_FOREACH(op, &s->ops_in_flight, next) {
--        if (self == op) {
--            continue;
--        }
-         /* Do not wait on pseudo ops, because it may in turn wait on
-          * some other operation to start, which may in fact be the
-          * caller of this function.  Since there is only one pseudo op
-@@ -305,10 +302,10 @@ mirror_wait_for_any_operation(MirrorBlockJob *s, MirrorOp *self, bool active)
- }
- 
- static inline void coroutine_fn
--mirror_wait_for_free_in_flight_slot(MirrorBlockJob *s, MirrorOp *self)
-+mirror_wait_for_free_in_flight_slot(MirrorBlockJob *s)
- {
-     /* Only non-active operations use up in-flight slots */
--    mirror_wait_for_any_operation(s, self, false);
-+    mirror_wait_for_any_operation(s, false);
- }
- 
- /* Perform a mirror copy operation.
-@@ -351,7 +348,7 @@ static void coroutine_fn mirror_co_read(void *opaque)
- 
-     while (s->buf_free_count < nb_chunks) {
-         trace_mirror_yield_in_flight(s, op->offset, s->in_flight);
--        mirror_wait_for_free_in_flight_slot(s, op);
-+        mirror_wait_for_free_in_flight_slot(s);
-     }
- 
-     /* Now make a QEMUIOVector taking enough granularity-sized chunks
-@@ -558,7 +555,7 @@ static uint64_t coroutine_fn mirror_iteration(MirrorBlockJob *s)
- 
-         while (s->in_flight >= MAX_IN_FLIGHT) {
-             trace_mirror_yield_in_flight(s, offset, s->in_flight);
--            mirror_wait_for_free_in_flight_slot(s, pseudo_op);
-+            mirror_wait_for_free_in_flight_slot(s);
-         }
- 
-         if (s->ret < 0) {
-@@ -612,7 +609,7 @@ static void mirror_free_init(MirrorBlockJob *s)
- static void coroutine_fn mirror_wait_for_all_io(MirrorBlockJob *s)
- {
-     while (s->in_flight > 0) {
--        mirror_wait_for_free_in_flight_slot(s, NULL);
-+        mirror_wait_for_free_in_flight_slot(s);
-     }
- }
- 
-@@ -797,7 +794,7 @@ static int coroutine_fn mirror_dirty_init(MirrorBlockJob *s)
-             if (s->in_flight >= MAX_IN_FLIGHT) {
-                 trace_mirror_yield(s, UINT64_MAX, s->buf_free_count,
-                                    s->in_flight);
--                mirror_wait_for_free_in_flight_slot(s, NULL);
-+                mirror_wait_for_free_in_flight_slot(s);
-                 continue;
-             }
- 
-@@ -950,7 +947,7 @@ static int coroutine_fn mirror_run(Job *job, Error **errp)
-         /* Do not start passive operations while there are active
-          * writes in progress */
-         while (s->in_active_write_counter) {
--            mirror_wait_for_any_operation(s, NULL, true);
-+            mirror_wait_for_any_operation(s, true);
-         }
- 
-         if (s->ret < 0) {
-@@ -976,7 +973,7 @@ static int coroutine_fn mirror_run(Job *job, Error **errp)
-             if (s->in_flight >= MAX_IN_FLIGHT || s->buf_free_count == 0 ||
-                 (cnt == 0 && s->in_flight > 0)) {
-                 trace_mirror_yield(s, cnt, s->buf_free_count, s->in_flight);
--                mirror_wait_for_free_in_flight_slot(s, NULL);
-+                mirror_wait_for_free_in_flight_slot(s);
-                 continue;
-             } else if (cnt != 0) {
-                 delay_ns = mirror_iteration(s);
--- 
-1.8.3.1
-

SOURCES/kvm-Revert-redhat-Add-hw_compat_4_2_extra-and-apply-to-u.patch

@@ -0,0 +1,93 @@
+From e626dc16d130c724c400b99a93daad0a9abeae59 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 22 Mar 2022 19:23:36 -0400
+Subject: [PATCH 01/18] Revert "redhat: Add hw_compat_4_2_extra and apply to
+ upstream machines"
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 131: Revert "redhat: Add hw_compat_4_2_extra and apply to upstream machines"
+RH-Commit: [1/3] 47b7d9e5062f5e215d5ed1a3ecdc1a87ac3fa630 (jmaloy/qemu-kvm)
+RH-Bugzilla: 2062613
+RH-Acked-by: Peter Xu <peterx@redhat.com>
+RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+
+BZ: https://bugzilla.redhat.com/2062613
+UPSTREAM: no
+BREW: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=44038000
+
+commit dc2e9ec1e014950c7918e23a3e9b0096b34a4a92
+Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
+Date:   Wed Mar 9 10:31:53 2022 +0000
+
+    Revert "redhat: Add hw_compat_4_2_extra and apply to upstream machines"
+
+    This reverts commit 66882f9a3230246409f3918424aca26add5c034a.
+    We no longer need these compat machines it was added for.
+
+    Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+
+(cherry picked from commit dc2e9ec1e014950c7918e23a3e9b0096b34a4a92)
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ hw/i386/pc.c         | 12 ------------
+ hw/i386/pc_piix.c    |  6 ------
+ include/hw/i386/pc.h |  3 ---
+ 3 files changed, 21 deletions(-)
+
+diff --git a/hw/i386/pc.c b/hw/i386/pc.c
+index 4c08a1971c..357257349b 100644
+--- a/hw/i386/pc.c
++++ b/hw/i386/pc.c
+@@ -670,18 +670,6 @@ GlobalProperty pc_rhel_7_0_compat[] = {
+ };
+ const size_t pc_rhel_7_0_compat_len = G_N_ELEMENTS(pc_rhel_7_0_compat);
+ 
+-/*
+- * RHEL: These properties only apply to the RHEL exported machine types
+- * pc-4.2/2.11 for the purpose to have a limited upstream machines support
+- * which can be migrated to RHEL.  Let's avoid touching hw_compat_4_2 directly
+- * so that we can have some isolation against the upstream code.
+- */
+-GlobalProperty hw_compat_4_2_extra[] = {
+-    /* By default enlarge the default virtio-net-pci ROM to 512KB. */
+-    { "virtio-net-pci", "romsize", "0x80000" },
+-};
+-const size_t hw_compat_4_2_extra_len = G_N_ELEMENTS(hw_compat_4_2_extra);
+-
+ GSIState *pc_gsi_create(qemu_irq **irqs, bool pci_enabled)
+ {
+     GSIState *s;
+diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
+index c30057c443..7b7076cbc7 100644
+--- a/hw/i386/pc_piix.c
++++ b/hw/i386/pc_piix.c
+@@ -531,12 +531,6 @@ static void pc_i440fx_4_2_machine_options(MachineClass *m)
+      * supported by RHEL, even if exported.
+      */
+     m->deprecation_reason = "Not supported by RHEL";
+-    /*
+-     * RHEL: Specific compat properties to have limited support for upstream
+-     * machines exported.
+-     */
+-    compat_props_add(m->compat_props, hw_compat_4_2_extra,
+-                     hw_compat_4_2_extra_len);
+ }
+ 
+ /* RHEL: Export pc-4.2 */
+diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
+index 9e8bfb69f8..4a593acb50 100644
+--- a/include/hw/i386/pc.h
++++ b/include/hw/i386/pc.h
+@@ -325,9 +325,6 @@ extern const size_t pc_rhel_7_1_compat_len;
+ extern GlobalProperty pc_rhel_7_0_compat[];
+ extern const size_t pc_rhel_7_0_compat_len;
+ 
+-extern GlobalProperty hw_compat_4_2_extra[];
+-extern const size_t hw_compat_4_2_extra_len;
+-
+ /* Helper for setting model-id for CPU models that changed model-id
+  * depending on QEMU versions up to QEMU 2.4.
+  */
+-- 
+2.27.0
+

SOURCES/kvm-Revert-redhat-Add-some-devices-for-exporting-upstrea.patch

@@ -0,0 +1,128 @@
+From 96edd15df257f1d1496397a6fac24b4316570d7e Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Thu, 14 Apr 2022 16:45:30 -0400
+Subject: [PATCH 1/3] Revert redhat: Add some devices for exporting upstream
+ machine types
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 156: Revert redhat: Add some devices for exporting upstream machine types
+RH-Commit: [1/1] f25d0da3a181136917ead82f5a5c59efe3fa445a (jmaloy/qemu-kvm)
+RH-Bugzilla: 2065043
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Peter Xu <peterx@redhat.com>
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2065043
+Upstream: no
+
+Manual revert of commit 70d3924521c9bfd912bcf1a1fc76f49eb377de46, since
+the directory structure looks different from rhel-av-8.4.0.z where
+this commit is taken from. Besides, x86_64-softmmu.mak looks totally
+different and should not be affected by this reversal.
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ configs/devices/x86_64-softmmu/x86_64-rh-devices.mak     | 1 -
+ .../devices/x86_64-softmmu/x86_64-upstream-devices.mak   | 4 ----
+ hw/char/parallel.c                                       | 9 ---------
+ hw/i386/pc_piix.c                                        | 2 +-
+ hw/i386/pc_q35.c                                         | 2 +-
+ hw/timer/hpet.c                                          | 8 --------
+ 6 files changed, 2 insertions(+), 24 deletions(-)
+ delete mode 100644 configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak
+
+diff --git a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
+index fdbbdf9742..31ce08edab 100644
+--- a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
++++ b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
+@@ -1,5 +1,4 @@
+ include ../rh-virtio.mak
+-include x86_64-upstream-devices.mak
+ 
+ CONFIG_AC97=y
+ CONFIG_ACPI=y
+diff --git a/configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak b/configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak
+deleted file mode 100644
+index 2cd20f54d2..0000000000
+--- a/configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak
++++ /dev/null
+@@ -1,4 +0,0 @@
+-# We need "isa-parallel"
+-CONFIG_PARALLEL=y
+-# We need "hpet"
+-CONFIG_HPET=y
+diff --git a/hw/char/parallel.c b/hw/char/parallel.c
+index e5f108211b..b45e67bfbb 100644
+--- a/hw/char/parallel.c
++++ b/hw/char/parallel.c
+@@ -29,7 +29,6 @@
+ #include "chardev/char-parallel.h"
+ #include "chardev/char-fe.h"
+ #include "hw/acpi/aml-build.h"
+-#include "hw/boards.h"
+ #include "hw/irq.h"
+ #include "hw/isa/isa.h"
+ #include "hw/qdev-properties.h"
+@@ -535,14 +534,6 @@ static void parallel_isa_realizefn(DeviceState *dev, Error **errp)
+     int base;
+     uint8_t dummy;
+ 
+-    /* Restricted for Red Hat Enterprise Linux */
+-    MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
+-    if (strstr(mc->name, "rhel")) {
+-        error_setg(errp, "Device %s is not supported with machine type %s",
+-                   object_get_typename(OBJECT(dev)), mc->name);
+-        return;
+-    }
+-
+     if (!qemu_chr_fe_backend_connected(&s->chr)) {
+         error_setg(errp, "Can't create parallel device, empty char device");
+         return;
+diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
+index ab6d03e07a..5f101c8748 100644
+--- a/hw/i386/pc_piix.c
++++ b/hw/i386/pc_piix.c
+@@ -966,7 +966,7 @@ static void pc_machine_rhel7_options(MachineClass *m)
+ {
+     PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
+     m->family = "pc_piix_Y";
+-    m->default_machine_opts = "firmware=bios-256k.bin,hpet=off";
++    m->default_machine_opts = "firmware=bios-256k.bin";
+     pcmc->default_nic_model = "e1000";
+     pcmc->pci_root_uid = 0;
+     m->default_display = "std";
+diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
+index 882fe7a68d..73b0d0d317 100644
+--- a/hw/i386/pc_q35.c
++++ b/hw/i386/pc_q35.c
+@@ -633,7 +633,7 @@ static void pc_q35_machine_rhel_options(MachineClass *m)
+     pcmc->pci_root_uid = 0;
+     m->family = "pc_q35_Z";
+     m->units_per_default_bus = 1;
+-    m->default_machine_opts = "firmware=bios-256k.bin,hpet=off";
++    m->default_machine_opts = "firmware=bios-256k.bin";
+     m->default_display = "std";
+     m->no_floppy = 1;
+     m->no_parallel = 1;
+diff --git a/hw/timer/hpet.c b/hw/timer/hpet.c
+index 202e032524..9520471be2 100644
+--- a/hw/timer/hpet.c
++++ b/hw/timer/hpet.c
+@@ -733,14 +733,6 @@ static void hpet_realize(DeviceState *dev, Error **errp)
+     int i;
+     HPETTimer *timer;
+ 
+-    /* Restricted for Red Hat Enterprise Linux */
+-    MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
+-    if (strstr(mc->name, "rhel")) {
+-        error_setg(errp, "Device %s is not supported with machine type %s",
+-                   object_get_typename(OBJECT(dev)), mc->name);
+-        return;
+-    }
+-
+     if (!s->intcap) {
+         warn_report("Hpet's intcap not initialized");
+     }
+-- 
+2.35.1
+

SOURCES/kvm-Revert-redhat-Enable-FDC-device-for-upstream-machine.patch

@@ -0,0 +1,53 @@
+From 5bf8f1d69fea1225e927fbb3efe549a2a9d47d92 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 22 Mar 2022 19:23:36 -0400
+Subject: [PATCH 02/18] Revert "redhat: Enable FDC device for upstream machines
+ too"
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 131: Revert "redhat: Add hw_compat_4_2_extra and apply to upstream machines"
+RH-Commit: [2/3] 4e3c945e3de9bb9d9a6d24115f0719168c9669fe (jmaloy/qemu-kvm)
+RH-Bugzilla: 2062613
+RH-Acked-by: Peter Xu <peterx@redhat.com>
+RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+
+BZ: https://bugzilla.redhat.com/2062613
+UPSTREAM: no
+BREW: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=44038000
+
+commit 597cb6ca1da4a3eea77c1e4928f55203a1d5c70c
+Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
+Date:   Wed Mar 9 10:32:39 2022 +0000
+
+    Revert "redhat: Enable FDC device for upstream machines too"
+
+    This reverts commit c4d1aa8bf21fe98da94a9cff30b7c25bed12c17f.
+    We no longer need these compat machines it was added for.
+
+  Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+
+(cherry picked from commit 597cb6ca1da4a3eea77c1e4928f55203a1d5c70c)
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ hw/block/fdc.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/hw/block/fdc.c b/hw/block/fdc.c
+index 63042ef030..97fa6de423 100644
+--- a/hw/block/fdc.c
++++ b/hw/block/fdc.c
+@@ -2341,10 +2341,7 @@ void fdctrl_realize_common(DeviceState *dev, FDCtrl *fdctrl, Error **errp)
+ 
+     /* Restricted for Red Hat Enterprise Linux: */
+     MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
+-    if (!strstr(mc->name, "-rhel7.") &&
+-        /* Exported two upstream machine types allows FDC too */
+-        strcmp(mc->name, "pc-i440fx-4.2") &&
+-        strcmp(mc->name, "pc-i440fx-2.11")) {
++    if (!strstr(mc->name, "-rhel7.")) {
+         error_setg(errp, "Device %s is not supported with machine type %s",
+                    object_get_typename(OBJECT(dev)), mc->name);
+         return;
+-- 
+2.27.0
+

SOURCES/kvm-Revert-redhat-Expose-upstream-machines-pc-4.2-and-pc.patch

@@ -0,0 +1,191 @@
+From ee3cae3bb349469edcf725a1c5161521e95dcb9f Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 22 Mar 2022 19:23:36 -0400
+Subject: [PATCH 03/18] Revert "redhat: Expose upstream machines pc-4.2 and
+ pc-2.11"
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 131: Revert "redhat: Add hw_compat_4_2_extra and apply to upstream machines"
+RH-Commit: [3/3] 35cee68034580f81b3aa916921eecd2fdfa7dd15 (jmaloy/qemu-kvm)
+RH-Bugzilla: 2062613
+RH-Acked-by: Peter Xu <peterx@redhat.com>
+RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+
+BZ: https://bugzilla.redhat.com/2062613
+UPSTREAM: no
+BREW: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=44038000
+
+commit f3b50d6d4ae0be9e64aafe6a15f5423bab4899e9
+Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
+Date:   Wed Mar 9 10:34:58 2022 +0000
+
+    Revert "redhat: Expose upstream machines pc-4.2 and pc-2.11"
+    This reverts commit 618e2424edba499d52cd26cf8363bc2dd85ef149.
+    We no longer need these compat machines.
+
+    Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+
+(cherry picked from commit f3b50d6d4ae0be9e64aafe6a15f5423bab4899e9)
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ hw/i386/pc_piix.c | 37 -------------------------------------
+ 1 file changed, 37 deletions(-)
+
+diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
+index 7b7076cbc7..f03a8f0db8 100644
+--- a/hw/i386/pc_piix.c
++++ b/hw/i386/pc_piix.c
+@@ -315,14 +315,6 @@ static void pc_init1(MachineState *machine,
+  * hw_compat_*, pc_compat_*, or * pc_*_machine_options().
+  */
+ 
+-/*
+- * NOTE!  Not all the upstream machine types are disabled for RHEL.  For
+- * providing a very limited support for upstream machine types, pc machines
+- * 2.11 and 4.2 are exposed explicitly.  This will make the below "#if" macros
+- * a bit messed up, but please read this comment first so that we can have a
+- * rough understanding of what we're going to do.
+- */
+-
+ #if 0 /* Disabled for Red Hat Enterprise Linux */
+ static void pc_compat_2_3_fn(MachineState *machine)
+ {
+@@ -399,8 +391,6 @@ static void pc_xen_hvm_init(MachineState *machine)
+ }
+ #endif
+ 
+-#endif /* Disabled for Red Hat Enterprise Linux */
+-
+ #define DEFINE_I440FX_MACHINE(suffix, name, compatfn, optionfn) \
+     static void pc_init_##suffix(MachineState *machine) \
+     { \
+@@ -465,10 +455,8 @@ static void pc_i440fx_6_0_machine_options(MachineClass *m)
+     compat_props_add(m->compat_props, pc_compat_6_0, pc_compat_6_0_len);
+ }
+ 
+-#if 0 /* Disabled for Red Hat Enterprise Linux */
+ DEFINE_I440FX_MACHINE(v6_0, "pc-i440fx-6.0", NULL,
+                       pc_i440fx_6_0_machine_options);
+-#endif /* Disabled for Red Hat Enterprise Linux */
+ 
+ static void pc_i440fx_5_2_machine_options(MachineClass *m)
+ {
+@@ -479,10 +467,8 @@ static void pc_i440fx_5_2_machine_options(MachineClass *m)
+     compat_props_add(m->compat_props, pc_compat_5_2, pc_compat_5_2_len);
+ }
+ 
+-#if 0 /* Disabled for Red Hat Enterprise Linux */
+ DEFINE_I440FX_MACHINE(v5_2, "pc-i440fx-5.2", NULL,
+                       pc_i440fx_5_2_machine_options);
+-#endif /* Disabled for Red Hat Enterprise Linux */
+ 
+ static void pc_i440fx_5_1_machine_options(MachineClass *m)
+ {
+@@ -497,10 +483,8 @@ static void pc_i440fx_5_1_machine_options(MachineClass *m)
+     pcmc->pci_root_uid = 1;
+ }
+ 
+-#if 0 /* Disabled for Red Hat Enterprise Linux */
+ DEFINE_I440FX_MACHINE(v5_1, "pc-i440fx-5.1", NULL,
+                       pc_i440fx_5_1_machine_options);
+-#endif /* Disabled for Red Hat Enterprise Linux */
+ 
+ static void pc_i440fx_5_0_machine_options(MachineClass *m)
+ {
+@@ -513,10 +497,8 @@ static void pc_i440fx_5_0_machine_options(MachineClass *m)
+     m->auto_enable_numa_with_memdev = false;
+ }
+ 
+-#if 0 /* Disabled for Red Hat Enterprise Linux */
+ DEFINE_I440FX_MACHINE(v5_0, "pc-i440fx-5.0", NULL,
+                       pc_i440fx_5_0_machine_options);
+-#endif /* Disabled for Red Hat Enterprise Linux */
+ 
+ static void pc_i440fx_4_2_machine_options(MachineClass *m)
+ {
+@@ -525,15 +507,8 @@ static void pc_i440fx_4_2_machine_options(MachineClass *m)
+     m->is_default = false;
+     compat_props_add(m->compat_props, hw_compat_4_2, hw_compat_4_2_len);
+     compat_props_add(m->compat_props, pc_compat_4_2, pc_compat_4_2_len);
+-
+-    /*
+-     * RHEL: Mark all upstream machines as deprecated because they're not
+-     * supported by RHEL, even if exported.
+-     */
+-    m->deprecation_reason = "Not supported by RHEL";
+ }
+ 
+-/* RHEL: Export pc-4.2 */
+ DEFINE_I440FX_MACHINE(v4_2, "pc-i440fx-4.2", NULL,
+                       pc_i440fx_4_2_machine_options);
+ 
+@@ -546,10 +521,8 @@ static void pc_i440fx_4_1_machine_options(MachineClass *m)
+     compat_props_add(m->compat_props, pc_compat_4_1, pc_compat_4_1_len);
+ }
+ 
+-#if 0 /* Disabled for Red Hat Enterprise Linux */
+ DEFINE_I440FX_MACHINE(v4_1, "pc-i440fx-4.1", NULL,
+                       pc_i440fx_4_1_machine_options);
+-#endif /* Disabled for Red Hat Enterprise Linux */
+ 
+ static void pc_i440fx_4_0_machine_options(MachineClass *m)
+ {
+@@ -562,10 +535,8 @@ static void pc_i440fx_4_0_machine_options(MachineClass *m)
+     compat_props_add(m->compat_props, pc_compat_4_0, pc_compat_4_0_len);
+ }
+ 
+-#if 0 /* Disabled for Red Hat Enterprise Linux */
+ DEFINE_I440FX_MACHINE(v4_0, "pc-i440fx-4.0", NULL,
+                       pc_i440fx_4_0_machine_options);
+-#endif /* Disabled for Red Hat Enterprise Linux */
+ 
+ static void pc_i440fx_3_1_machine_options(MachineClass *m)
+ {
+@@ -581,10 +552,8 @@ static void pc_i440fx_3_1_machine_options(MachineClass *m)
+     compat_props_add(m->compat_props, pc_compat_3_1, pc_compat_3_1_len);
+ }
+ 
+-#if 0 /* Disabled for Red Hat Enterprise Linux */
+ DEFINE_I440FX_MACHINE(v3_1, "pc-i440fx-3.1", NULL,
+                       pc_i440fx_3_1_machine_options);
+-#endif /* Disabled for Red Hat Enterprise Linux */
+ 
+ static void pc_i440fx_3_0_machine_options(MachineClass *m)
+ {
+@@ -593,10 +562,8 @@ static void pc_i440fx_3_0_machine_options(MachineClass *m)
+     compat_props_add(m->compat_props, pc_compat_3_0, pc_compat_3_0_len);
+ }
+ 
+-#if 0 /* Disabled for Red Hat Enterprise Linux */
+ DEFINE_I440FX_MACHINE(v3_0, "pc-i440fx-3.0", NULL,
+                       pc_i440fx_3_0_machine_options);
+-#endif /* Disabled for Red Hat Enterprise Linux */
+ 
+ static void pc_i440fx_2_12_machine_options(MachineClass *m)
+ {
+@@ -605,10 +572,8 @@ static void pc_i440fx_2_12_machine_options(MachineClass *m)
+     compat_props_add(m->compat_props, pc_compat_2_12, pc_compat_2_12_len);
+ }
+ 
+-#if 0 /* Disabled for Red Hat Enterprise Linux */
+ DEFINE_I440FX_MACHINE(v2_12, "pc-i440fx-2.12", NULL,
+                       pc_i440fx_2_12_machine_options);
+-#endif /* Disabled for Red Hat Enterprise Linux */
+ 
+ static void pc_i440fx_2_11_machine_options(MachineClass *m)
+ {
+@@ -617,11 +582,9 @@ static void pc_i440fx_2_11_machine_options(MachineClass *m)
+     compat_props_add(m->compat_props, pc_compat_2_11, pc_compat_2_11_len);
+ }
+ 
+-/* RHEL: Export pc-2.11 */
+ DEFINE_I440FX_MACHINE(v2_11, "pc-i440fx-2.11", NULL,
+                       pc_i440fx_2_11_machine_options);
+ 
+-#if 0 /* Disabled for Red Hat Enterprise Linux */
+ static void pc_i440fx_2_10_machine_options(MachineClass *m)
+ {
+     pc_i440fx_2_11_machine_options(m);
+-- 
+2.27.0
+

SOURCES/kvm-Update-linux-headers-to-v6.0-rc4.patch

@@ -0,0 +1,171 @@
+From 10fc28b61a6fba1e6dc44fd544cf31c7f313c622 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
+Date: Fri, 28 Oct 2022 17:48:00 +0100
+Subject: [PATCH 05/42] Update linux headers to v6.0-rc4
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Cédric Le Goater <clg@redhat.com>
+RH-MergeRequest: 226: s390: Enhanced Interpretation for PCI Functions and Secure Execution guest dump
+RH-Bugzilla: 1664378 2043909
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
+RH-Commit: [5/41] ca55f497d1bf1e72179330f8f613781bf999d898
+
+Based on upstream commit d525f73f9186a5bc641b8caf0b2c9bb94e5aa963
+("Update linux headers to v6.0-rc4"), but this is focusing only on the
+ZPCI and protected dump changes.
+
+Signed-off-by: Cédric Le Goater <clg@redhat.com>
+---
+ linux-headers/linux/kvm.h       | 87 +++++++++++++++++++++++++++++++++
+ linux-headers/linux/vfio_zdev.h |  7 +++
+ 2 files changed, 94 insertions(+)
+
+diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h
+index 0d05d02ee4..c65930288c 100644
+--- a/linux-headers/linux/kvm.h
++++ b/linux-headers/linux/kvm.h
+@@ -1150,6 +1150,9 @@ struct kvm_ppc_resize_hpt {
+ #define KVM_CAP_DISABLE_QUIRKS2 213
+ /* #define KVM_CAP_VM_TSC_CONTROL 214 */
+ #define KVM_CAP_SYSTEM_EVENT_DATA 215
++#define KVM_CAP_S390_PROTECTED_DUMP 217
++#define KVM_CAP_S390_ZPCI_OP 221
++#define KVM_CAP_S390_CPU_TOPOLOGY 222
+ 
+ #ifdef KVM_CAP_IRQ_ROUTING
+ 
+@@ -1651,6 +1654,55 @@ struct kvm_s390_pv_unp {
+ 	__u64 tweak;
+ };
+ 
++enum pv_cmd_dmp_id {
++	KVM_PV_DUMP_INIT,
++	KVM_PV_DUMP_CONFIG_STOR_STATE,
++	KVM_PV_DUMP_COMPLETE,
++	KVM_PV_DUMP_CPU,
++};
++
++struct kvm_s390_pv_dmp {
++	__u64 subcmd;
++	__u64 buff_addr;
++	__u64 buff_len;
++	__u64 gaddr;		/* For dump storage state */
++	__u64 reserved[4];
++};
++
++enum pv_cmd_info_id {
++	KVM_PV_INFO_VM,
++	KVM_PV_INFO_DUMP,
++};
++
++struct kvm_s390_pv_info_dump {
++	__u64 dump_cpu_buffer_len;
++	__u64 dump_config_mem_buffer_per_1m;
++	__u64 dump_config_finalize_len;
++};
++
++struct kvm_s390_pv_info_vm {
++	__u64 inst_calls_list[4];
++	__u64 max_cpus;
++	__u64 max_guests;
++	__u64 max_guest_addr;
++	__u64 feature_indication;
++};
++
++struct kvm_s390_pv_info_header {
++	__u32 id;
++	__u32 len_max;
++	__u32 len_written;
++	__u32 reserved;
++};
++
++struct kvm_s390_pv_info {
++	struct kvm_s390_pv_info_header header;
++	union {
++		struct kvm_s390_pv_info_dump dump;
++		struct kvm_s390_pv_info_vm vm;
++	};
++};
++
+ enum pv_cmd_id {
+ 	KVM_PV_ENABLE,
+ 	KVM_PV_DISABLE,
+@@ -1659,6 +1711,8 @@ enum pv_cmd_id {
+ 	KVM_PV_VERIFY,
+ 	KVM_PV_PREP_RESET,
+ 	KVM_PV_UNSHARE_ALL,
++	KVM_PV_INFO,
++	KVM_PV_DUMP,
+ };
+ 
+ struct kvm_pv_cmd {
+@@ -2066,4 +2120,37 @@ struct kvm_stats_desc {
+ /* Available with KVM_CAP_XSAVE2 */
+ #define KVM_GET_XSAVE2		  _IOR(KVMIO,  0xcf, struct kvm_xsave)
+ 
++/* Available with KVM_CAP_S390_PROTECTED_DUMP */
++#define KVM_S390_PV_CPU_COMMAND	_IOWR(KVMIO, 0xd0, struct kvm_pv_cmd)
++
++/* Available with KVM_CAP_S390_ZPCI_OP */
++#define KVM_S390_ZPCI_OP         _IOW(KVMIO,  0xd1, struct kvm_s390_zpci_op)
++
++struct kvm_s390_zpci_op {
++	/* in */
++	__u32 fh;               /* target device */
++	__u8  op;               /* operation to perform */
++	__u8  pad[3];
++	union {
++		/* for KVM_S390_ZPCIOP_REG_AEN */
++		struct {
++			__u64 ibv;      /* Guest addr of interrupt bit vector */
++			__u64 sb;       /* Guest addr of summary bit */
++			__u32 flags;
++			__u32 noi;      /* Number of interrupts */
++			__u8 isc;       /* Guest interrupt subclass */
++			__u8 sbo;       /* Offset of guest summary bit vector */
++			__u16 pad;
++		} reg_aen;
++		__u64 reserved[8];
++	} u;
++};
++
++/* types for kvm_s390_zpci_op->op */
++#define KVM_S390_ZPCIOP_REG_AEN                0
++#define KVM_S390_ZPCIOP_DEREG_AEN      1
++
++/* flags for kvm_s390_zpci_op->u.reg_aen.flags */
++#define KVM_S390_ZPCIOP_REGAEN_HOST    (1 << 0)
++
+ #endif /* __LINUX_KVM_H */
+diff --git a/linux-headers/linux/vfio_zdev.h b/linux-headers/linux/vfio_zdev.h
+index b4309397b6..77f2aff1f2 100644
+--- a/linux-headers/linux/vfio_zdev.h
++++ b/linux-headers/linux/vfio_zdev.h
+@@ -29,6 +29,9 @@ struct vfio_device_info_cap_zpci_base {
+ 	__u16 fmb_length;	/* Measurement Block Length (in bytes) */
+ 	__u8 pft;		/* PCI Function Type */
+ 	__u8 gid;		/* PCI function group ID */
++	/* End of version 1 */
++	__u32 fh;		/* PCI function handle */
++	/* End of version 2 */
+ };
+ 
+ /**
+@@ -47,6 +50,10 @@ struct vfio_device_info_cap_zpci_group {
+ 	__u16 noi;		/* Maximum number of MSIs */
+ 	__u16 maxstbl;		/* Maximum Store Block Length */
+ 	__u8 version;		/* Supported PCI Version */
++	/* End of version 1 */
++	__u8 reserved;
++	__u16 imaxstbl;		/* Maximum Interpreted Store Block Length */
++	/* End of version 2 */
+ };
+ 
+ /**
+-- 
+2.37.3
+

SOURCES/kvm-Virtiofsd-fix-memory-leak-on-fuse-queueinfo.patch

@@ -1,63 +0,0 @@
-From ceb6d97674b8bc9a072db1be4167411bc0ee48d7 Mon Sep 17 00:00:00 2001
-From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
-Date: Mon, 27 Jan 2020 19:02:02 +0100
-Subject: [PATCH 091/116] Virtiofsd: fix memory leak on fuse queueinfo
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
-Message-id: <20200127190227.40942-88-dgilbert@redhat.com>
-Patchwork-id: 93542
-O-Subject: [RHEL-AV-8.2 qemu-kvm PATCH 087/112] Virtiofsd: fix memory leak on fuse queueinfo
-Bugzilla: 1694164
-RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Acked-by: Sergio Lopez Pascual <slp@redhat.com>
-
-From: Liu Bo <bo.liu@linux.alibaba.com>
-
-For fuse's queueinfo, both queueinfo array and queueinfos are allocated in
-fv_queue_set_started() but not cleaned up when the daemon process quits.
-
-This fixes the leak in proper places.
-
-Signed-off-by: Liu Bo <bo.liu@linux.alibaba.com>
-Signed-off-by: Eric Ren <renzhen@linux.alibaba.com>
-Reviewed-by: Misono Tomohiro <misono.tomohiro@jp.fujitsu.com>
-Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
-(cherry picked from commit 740b0b700a6338a1cf60c26229651ac5f6724944)
-Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
----
- tools/virtiofsd/fuse_virtio.c | 8 ++++++++
- 1 file changed, 8 insertions(+)
-
-diff --git a/tools/virtiofsd/fuse_virtio.c b/tools/virtiofsd/fuse_virtio.c
-index b7948de..fb8d6d1 100644
---- a/tools/virtiofsd/fuse_virtio.c
-+++ b/tools/virtiofsd/fuse_virtio.c
-@@ -625,6 +625,8 @@ static void fv_queue_cleanup_thread(struct fv_VuDev *vud, int qidx)
-     }
-     close(ourqi->kill_fd);
-     ourqi->kick_fd = -1;
-+    free(vud->qi[qidx]);
-+    vud->qi[qidx] = NULL;
- }
- 
- /* Callback from libvhost-user on start or stop of a queue */
-@@ -884,6 +886,12 @@ int virtio_session_mount(struct fuse_session *se)
- void virtio_session_close(struct fuse_session *se)
- {
-     close(se->vu_socketfd);
-+
-+    if (!se->virtio_dev) {
-+        return;
-+    }
-+
-+    free(se->virtio_dev->qi);
-     free(se->virtio_dev);
-     se->virtio_dev = NULL;
- }
--- 
-1.8.3.1
-

SOURCES/kvm-accel-introduce-accelerator-blocker-API.patch

@@ -0,0 +1,349 @@
+From a5e7bb1f7a88efb5574266a76e80fd7604d19921 Mon Sep 17 00:00:00 2001
+From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+Date: Mon, 16 Jan 2023 07:49:59 -0500
+Subject: [PATCH 04/11] accel: introduce accelerator blocker API
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+RH-MergeRequest: 247: accel: introduce accelerator blocker API
+RH-Bugzilla: 2161188
+RH-Acked-by: David Hildenbrand <david@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [1/3] 9d3d7f9554974a79042c915763288cce07aef135
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2161188
+
+commit bd688fc93120fb3e28aa70e3dfdf567ccc1e0bc1
+Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+Date:   Fri Nov 11 10:47:56 2022 -0500
+
+    accel: introduce accelerator blocker API
+
+    This API allows the accelerators to prevent vcpus from issuing
+    new ioctls while execting a critical section marked with the
+    accel_ioctl_inhibit_begin/end functions.
+
+    Note that all functions submitting ioctls must mark where the
+    ioctl is being called with accel_{cpu_}ioctl_begin/end().
+
+    This API requires the caller to always hold the BQL.
+    API documentation is in sysemu/accel-blocker.h
+
+    Internally, it uses a QemuLockCnt together with a per-CPU QemuLockCnt
+    (to minimize cache line bouncing) to keep avoid that new ioctls
+    run when the critical section starts, and a QemuEvent to wait
+    that all running ioctls finish.
+
+    Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+    Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+    Message-Id: <20221111154758.1372674-2-eesposit@redhat.com>
+    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+
+Conflicts:
+	util/meson.build: files are missing in rhel 8.8.0
+	namely int128.c, memalign.c and interval-tree.c
+
+Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+---
+ accel/accel-blocker.c          | 154 +++++++++++++++++++++++++++++++++
+ accel/meson.build              |   2 +-
+ hw/core/cpu-common.c           |   2 +
+ include/hw/core/cpu.h          |   3 +
+ include/sysemu/accel-blocker.h |  56 ++++++++++++
+ util/meson.build               |   2 +-
+ 6 files changed, 217 insertions(+), 2 deletions(-)
+ create mode 100644 accel/accel-blocker.c
+ create mode 100644 include/sysemu/accel-blocker.h
+
+diff --git a/accel/accel-blocker.c b/accel/accel-blocker.c
+new file mode 100644
+index 0000000000..1e7f423462
+--- /dev/null
++++ b/accel/accel-blocker.c
+@@ -0,0 +1,154 @@
++/*
++ * Lock to inhibit accelerator ioctls
++ *
++ * Copyright (c) 2022 Red Hat Inc.
++ *
++ * Author: Emanuele Giuseppe Esposito       <eesposit@redhat.com>
++ *
++ * Permission is hereby granted, free of charge, to any person obtaining a copy
++ * of this software and associated documentation files (the "Software"), to deal
++ * in the Software without restriction, including without limitation the rights
++ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
++ * copies of the Software, and to permit persons to whom the Software is
++ * furnished to do so, subject to the following conditions:
++ *
++ * The above copyright notice and this permission notice shall be included in
++ * all copies or substantial portions of the Software.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
++ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
++ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
++ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
++ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
++ * THE SOFTWARE.
++ */
++
++#include "qemu/osdep.h"
++#include "qemu/thread.h"
++#include "qemu/main-loop.h"
++#include "hw/core/cpu.h"
++#include "sysemu/accel-blocker.h"
++
++static QemuLockCnt accel_in_ioctl_lock;
++static QemuEvent accel_in_ioctl_event;
++
++void accel_blocker_init(void)
++{
++    qemu_lockcnt_init(&accel_in_ioctl_lock);
++    qemu_event_init(&accel_in_ioctl_event, false);
++}
++
++void accel_ioctl_begin(void)
++{
++    if (likely(qemu_mutex_iothread_locked())) {
++        return;
++    }
++
++    /* block if lock is taken in kvm_ioctl_inhibit_begin() */
++    qemu_lockcnt_inc(&accel_in_ioctl_lock);
++}
++
++void accel_ioctl_end(void)
++{
++    if (likely(qemu_mutex_iothread_locked())) {
++        return;
++    }
++
++    qemu_lockcnt_dec(&accel_in_ioctl_lock);
++    /* change event to SET. If event was BUSY, wake up all waiters */
++    qemu_event_set(&accel_in_ioctl_event);
++}
++
++void accel_cpu_ioctl_begin(CPUState *cpu)
++{
++    if (unlikely(qemu_mutex_iothread_locked())) {
++        return;
++    }
++
++    /* block if lock is taken in kvm_ioctl_inhibit_begin() */
++    qemu_lockcnt_inc(&cpu->in_ioctl_lock);
++}
++
++void accel_cpu_ioctl_end(CPUState *cpu)
++{
++    if (unlikely(qemu_mutex_iothread_locked())) {
++        return;
++    }
++
++    qemu_lockcnt_dec(&cpu->in_ioctl_lock);
++    /* change event to SET. If event was BUSY, wake up all waiters */
++    qemu_event_set(&accel_in_ioctl_event);
++}
++
++static bool accel_has_to_wait(void)
++{
++    CPUState *cpu;
++    bool needs_to_wait = false;
++
++    CPU_FOREACH(cpu) {
++        if (qemu_lockcnt_count(&cpu->in_ioctl_lock)) {
++            /* exit the ioctl, if vcpu is running it */
++            qemu_cpu_kick(cpu);
++            needs_to_wait = true;
++        }
++    }
++
++    return needs_to_wait || qemu_lockcnt_count(&accel_in_ioctl_lock);
++}
++
++void accel_ioctl_inhibit_begin(void)
++{
++    CPUState *cpu;
++
++    /*
++     * We allow to inhibit only when holding the BQL, so we can identify
++     * when an inhibitor wants to issue an ioctl easily.
++     */
++    g_assert(qemu_mutex_iothread_locked());
++
++    /* Block further invocations of the ioctls outside the BQL.  */
++    CPU_FOREACH(cpu) {
++        qemu_lockcnt_lock(&cpu->in_ioctl_lock);
++    }
++    qemu_lockcnt_lock(&accel_in_ioctl_lock);
++
++    /* Keep waiting until there are running ioctls */
++    while (true) {
++
++        /* Reset event to FREE. */
++        qemu_event_reset(&accel_in_ioctl_event);
++
++        if (accel_has_to_wait()) {
++            /*
++             * If event is still FREE, and there are ioctls still in progress,
++             * wait.
++             *
++             *  If an ioctl finishes before qemu_event_wait(), it will change
++             * the event state to SET. This will prevent qemu_event_wait() from
++             * blocking, but it's not a problem because if other ioctls are
++             * still running the loop will iterate once more and reset the event
++             * status to FREE so that it can wait properly.
++             *
++             * If an ioctls finishes while qemu_event_wait() is blocking, then
++             * it will be waken up, but also here the while loop makes sure
++             * to re-enter the wait if there are other running ioctls.
++             */
++            qemu_event_wait(&accel_in_ioctl_event);
++        } else {
++            /* No ioctl is running */
++            return;
++        }
++    }
++}
++
++void accel_ioctl_inhibit_end(void)
++{
++    CPUState *cpu;
++
++    qemu_lockcnt_unlock(&accel_in_ioctl_lock);
++    CPU_FOREACH(cpu) {
++        qemu_lockcnt_unlock(&cpu->in_ioctl_lock);
++    }
++}
++
+diff --git a/accel/meson.build b/accel/meson.build
+index dfd808d2c8..801b4d44e8 100644
+--- a/accel/meson.build
++++ b/accel/meson.build
+@@ -1,4 +1,4 @@
+-specific_ss.add(files('accel-common.c'))
++specific_ss.add(files('accel-common.c', 'accel-blocker.c'))
+ softmmu_ss.add(files('accel-softmmu.c'))
+ user_ss.add(files('accel-user.c'))
+ 
+diff --git a/hw/core/cpu-common.c b/hw/core/cpu-common.c
+index 9e3241b430..b6e83acf0a 100644
+--- a/hw/core/cpu-common.c
++++ b/hw/core/cpu-common.c
+@@ -238,6 +238,7 @@ static void cpu_common_initfn(Object *obj)
+     cpu->nr_threads = 1;
+ 
+     qemu_mutex_init(&cpu->work_mutex);
++    qemu_lockcnt_init(&cpu->in_ioctl_lock);
+     QSIMPLEQ_INIT(&cpu->work_list);
+     QTAILQ_INIT(&cpu->breakpoints);
+     QTAILQ_INIT(&cpu->watchpoints);
+@@ -249,6 +250,7 @@ static void cpu_common_finalize(Object *obj)
+ {
+     CPUState *cpu = CPU(obj);
+ 
++    qemu_lockcnt_destroy(&cpu->in_ioctl_lock);
+     qemu_mutex_destroy(&cpu->work_mutex);
+ }
+ 
+diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
+index e948e81f1a..49d9c73f97 100644
+--- a/include/hw/core/cpu.h
++++ b/include/hw/core/cpu.h
+@@ -383,6 +383,9 @@ struct CPUState {
+     uint32_t kvm_fetch_index;
+     uint64_t dirty_pages;
+ 
++    /* Use by accel-block: CPU is executing an ioctl() */
++    QemuLockCnt in_ioctl_lock;
++
+     /* Used for events with 'vcpu' and *without* the 'disabled' properties */
+     DECLARE_BITMAP(trace_dstate_delayed, CPU_TRACE_DSTATE_MAX_EVENTS);
+     DECLARE_BITMAP(trace_dstate, CPU_TRACE_DSTATE_MAX_EVENTS);
+diff --git a/include/sysemu/accel-blocker.h b/include/sysemu/accel-blocker.h
+new file mode 100644
+index 0000000000..72020529ef
+--- /dev/null
++++ b/include/sysemu/accel-blocker.h
+@@ -0,0 +1,56 @@
++/*
++ * Accelerator blocking API, to prevent new ioctls from starting and wait the
++ * running ones finish.
++ * This mechanism differs from pause/resume_all_vcpus() in that it does not
++ * release the BQL.
++ *
++ *  Copyright (c) 2022 Red Hat Inc.
++ *
++ * Author: Emanuele Giuseppe Esposito       <eesposit@redhat.com>
++ *
++ * This work is licensed under the terms of the GNU GPL, version 2 or later.
++ * See the COPYING file in the top-level directory.
++ */
++#ifndef ACCEL_BLOCKER_H
++#define ACCEL_BLOCKER_H
++
++#include "qemu/osdep.h"
++#include "sysemu/cpus.h"
++
++extern void accel_blocker_init(void);
++
++/*
++ * accel_{cpu_}ioctl_begin/end:
++ * Mark when ioctl is about to run or just finished.
++ *
++ * accel_{cpu_}ioctl_begin will block after accel_ioctl_inhibit_begin() is
++ * called, preventing new ioctls to run. They will continue only after
++ * accel_ioctl_inibith_end().
++ */
++extern void accel_ioctl_begin(void);
++extern void accel_ioctl_end(void);
++extern void accel_cpu_ioctl_begin(CPUState *cpu);
++extern void accel_cpu_ioctl_end(CPUState *cpu);
++
++/*
++ * accel_ioctl_inhibit_begin: start critical section
++ *
++ * This function makes sure that:
++ * 1) incoming accel_{cpu_}ioctl_begin() calls block
++ * 2) wait that all ioctls that were already running reach
++ *    accel_{cpu_}ioctl_end(), kicking vcpus if necessary.
++ *
++ * This allows the caller to access shared data or perform operations without
++ * worrying of concurrent vcpus accesses.
++ */
++extern void accel_ioctl_inhibit_begin(void);
++
++/*
++ * accel_ioctl_inhibit_end: end critical section started by
++ * accel_ioctl_inhibit_begin()
++ *
++ * This function allows blocked accel_{cpu_}ioctl_begin() to continue.
++ */
++extern void accel_ioctl_inhibit_end(void);
++
++#endif /* ACCEL_BLOCKER_H */
+diff --git a/util/meson.build b/util/meson.build
+index 05b593055a..b5f153b0e8 100644
+--- a/util/meson.build
++++ b/util/meson.build
+@@ -48,6 +48,7 @@ util_ss.add(files('transactions.c'))
+ util_ss.add(when: 'CONFIG_POSIX', if_true: files('drm.c'))
+ util_ss.add(files('guest-random.c'))
+ util_ss.add(files('yank.c'))
++util_ss.add(files('lockcnt.c'))
+ 
+ if have_user
+   util_ss.add(files('selfmap.c'))
+@@ -69,7 +70,6 @@ if have_block
+   util_ss.add(files('hexdump.c'))
+   util_ss.add(files('iova-tree.c'))
+   util_ss.add(files('iov.c', 'qemu-sockets.c', 'uri.c'))
+-  util_ss.add(files('lockcnt.c'))
+   util_ss.add(files('main-loop.c'))
+   util_ss.add(files('nvdimm-utils.c'))
+   util_ss.add(files('qemu-coroutine.c', 'qemu-coroutine-lock.c', 'qemu-coroutine-io.c'))
+-- 
+2.37.3
+

SOURCES/kvm-acpi-accept-byte-and-word-access-to-core-ACPI-regist.patch

@@ -1,82 +0,0 @@
-From dcac680adb6b8624f14eda3e812521bddbe8ecea Mon Sep 17 00:00:00 2001
-From: Jon Maloy <jmaloy@redhat.com>
-Date: Wed, 21 Apr 2021 22:30:04 -0400
-Subject: [PATCH 5/7] acpi: accept byte and word access to core ACPI registers
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Jon Maloy <jmaloy@redhat.com>
-Message-id: <20210421223006.19650-5-jmaloy@redhat.com>
-Patchwork-id: 101482
-O-Subject: [RHEL-8.5.0 qemu-kvm PATCH v2 4/6] acpi: accept byte and word access to core ACPI registers
-Bugzilla: 1842478
-RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
-RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
-
-From: Michael Tokarev <mjt@tls.msk.ru>
-
-All ISA registers should be accessible as bytes, words or dwords
-(if wide enough).  Fix the access constraints for acpi-pm-evt,
-acpi-pm-tmr & acpi-cnt registers.
-
-Fixes: 5d971f9e67 (memory: Revert "memory: accept mismatching sizes in memory_region_access_valid")
-Fixes: afafe4bbe0 (apci: switch cnt to memory api)
-Fixes: 77d58b1e47 (apci: switch timer to memory api)
-Fixes: b5a7c024d2 (apci: switch evt to memory api)
-Buglink: https://lore.kernel.org/xen-devel/20200630170913.123646-1-anthony.perard@citrix.com/T/
-Buglink: https://bugs.debian.org/964793
-BugLink: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=964247
-BugLink: https://bugs.launchpad.net/bugs/1886318
-Reported-By: Simon John <git@the-jedi.co.uk>
-Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
-Message-Id: <20200720160627.15491-1-mjt@msgid.tls.msk.ru>
-Cc: qemu-stable@nongnu.org
-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
-
-(cherry picked from commit dba04c3488c4699f5afe96f66e448b1d447cf3fb)
-Signed-off-by: Jon Maloy <jmaloy@redhat.com>
-Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
----
- hw/acpi/core.c | 9 ++++++---
- 1 file changed, 6 insertions(+), 3 deletions(-)
-
-diff --git a/hw/acpi/core.c b/hw/acpi/core.c
-index 45cbed49ab..d85052c34a 100644
---- a/hw/acpi/core.c
-+++ b/hw/acpi/core.c
-@@ -461,7 +461,8 @@ static void acpi_pm_evt_write(void *opaque, hwaddr addr, uint64_t val,
- static const MemoryRegionOps acpi_pm_evt_ops = {
-     .read = acpi_pm_evt_read,
-     .write = acpi_pm_evt_write,
--    .valid.min_access_size = 2,
-+    .impl.min_access_size = 2,
-+    .valid.min_access_size = 1,
-     .valid.max_access_size = 2,
-     .endianness = DEVICE_LITTLE_ENDIAN,
- };
-@@ -530,7 +531,8 @@ static void acpi_pm_tmr_write(void *opaque, hwaddr addr, uint64_t val,
- static const MemoryRegionOps acpi_pm_tmr_ops = {
-     .read = acpi_pm_tmr_read,
-     .write = acpi_pm_tmr_write,
--    .valid.min_access_size = 4,
-+    .impl.min_access_size = 4,
-+    .valid.min_access_size = 1,
-     .valid.max_access_size = 4,
-     .endianness = DEVICE_LITTLE_ENDIAN,
- };
-@@ -602,7 +604,8 @@ static void acpi_pm_cnt_write(void *opaque, hwaddr addr, uint64_t val,
- static const MemoryRegionOps acpi_pm_cnt_ops = {
-     .read = acpi_pm_cnt_read,
-     .write = acpi_pm_cnt_write,
--    .valid.min_access_size = 2,
-+    .impl.min_access_size = 2,
-+    .valid.min_access_size = 1,
-     .valid.max_access_size = 2,
-     .endianness = DEVICE_LITTLE_ENDIAN,
- };
--- 
-2.27.0
-

SOURCES/kvm-acpi-fix-OEM-ID-OEM-Table-ID-padding.patch

@@ -0,0 +1,78 @@
+From af082f3499de265d123157d097b5c84981e0aa63 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Wed, 30 Mar 2022 14:52:34 -0400
+Subject: [PATCH 15/18] acpi: fix OEM ID/OEM Table ID padding
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 141: acpi: fix QEMU crash when started with SLIC table
+RH-Commit: [7/10] 51ea859cbe12b5a902d529ab589d18757d98f71d (jmaloy/qemu-kvm)
+RH-Bugzilla: 2062611
+RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2062611
+Upstream: Merged
+
+commit 748c030f360a940fe0c9382c8ca1649096c3a80d
+Author: Igor Mammedov <imammedo@redhat.com>
+Date:   Wed Jan 12 08:03:31 2022 -0500
+
+    acpi: fix OEM ID/OEM Table ID padding
+
+    Commit [2] broke original '\0' padding of OEM ID and OEM Table ID
+    fields in headers of ACPI tables. While it doesn't have impact on
+    default values since QEMU uses 6 and 8 characters long values
+    respectively, it broke usecase where IDs are provided on QEMU CLI.
+    It shouldn't affect guest (but may cause licensing verification
+    issues in guest OS).
+    One of the broken usecases is user supplied SLIC table with IDs
+    shorter than max possible length, where [2] mangles IDs with extra
+    spaces in RSDT and FADT tables whereas guest OS expects those to
+    mirror the respective values of the used SLIC table.
+
+    Fix it by replacing whitespace padding with '\0' padding in
+    accordance with [1] and expectations of guest OS
+
+    1) ACPI spec, v2.0b
+           17.2 AML Grammar Definition
+           ...
+           //OEM ID of up to 6 characters. If the OEM ID is
+           //shorter than 6 characters, it can be terminated
+           //with a NULL character.
+
+    2)
+    Fixes: 602b458201 ("acpi: Permit OEM ID and OEM table ID fields to be changed")
+    Resolves: https://gitlab.com/qemu-project/qemu/-/issues/707
+    Reported-by: Dmitry V. Orekhov <dima.orekhov@gmail.com>
+    Signed-off-by: Igor Mammedov <imammedo@redhat.com>
+    Cc: qemu-stable@nongnu.org
+    Message-Id: <20220112130332.1648664-4-imammedo@redhat.com>
+    Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+    Reviewed-by: Ani Sinha <ani@anisinha.ca>
+    Tested-by: Dmitry V. Orekhov dima.orekhov@gmail.com
+
+(cherry picked from commit 748c030f360a940fe0c9382c8ca1649096c3a80d)
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ hw/acpi/aml-build.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/hw/acpi/aml-build.c b/hw/acpi/aml-build.c
+index b3b3310df3..65148d5b9d 100644
+--- a/hw/acpi/aml-build.c
++++ b/hw/acpi/aml-build.c
+@@ -1724,9 +1724,9 @@ void acpi_table_begin(AcpiTable *desc, GArray *array)
+     build_append_int_noprefix(array, 0, 4); /* Length */
+     build_append_int_noprefix(array, desc->rev, 1); /* Revision */
+     build_append_int_noprefix(array, 0, 1); /* Checksum */
+-    build_append_padded_str(array, desc->oem_id, 6, ' '); /* OEMID */
++    build_append_padded_str(array, desc->oem_id, 6, '\0'); /* OEMID */
+     /* OEM Table ID */
+-    build_append_padded_str(array, desc->oem_table_id, 8, ' ');
++    build_append_padded_str(array, desc->oem_table_id, 8, '\0');
+     build_append_int_noprefix(array, 1, 4); /* OEM Revision */
+     g_array_append_vals(array, ACPI_BUILD_APPNAME8, 4); /* Creator ID */
+     build_append_int_noprefix(array, 1, 4); /* Creator Revision */
+-- 
+2.27.0
+

SOURCES/kvm-acpi-fix-QEMU-crash-when-started-with-SLIC-table.patch

@@ -0,0 +1,108 @@
+From 4e8fb957a349558648d5cddb80a89460bc97439e Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Wed, 30 Mar 2022 14:52:34 -0400
+Subject: [PATCH 09/18] acpi: fix QEMU crash when started with SLIC table
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 141: acpi: fix QEMU crash when started with SLIC table
+RH-Commit: [1/10] 0c34e80346c33da4f220d9c486b120c35005144e (jmaloy/qemu-kvm)
+RH-Bugzilla: 2062611
+RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2062611
+Upstream: Merged
+
+commit 8cdb99af45365727ac17f45239a9b8c1d5155c6d)
+Author: Igor Mammedov <imammedo@redhat.com>
+Date:   Mon Dec 27 14:31:17 2021 -0500
+
+    acpi: fix QEMU crash when started with SLIC table
+
+    if QEMU is started with used provided SLIC table blob,
+
+      -acpitable sig=SLIC,oem_id='CRASH ',oem_table_id="ME",oem_rev=00002210,asl_compiler_id="",asl_compiler_rev=00000000,data=/dev/null
+    it will assert with:
+
+      hw/acpi/aml-build.c:61:build_append_padded_str: assertion failed: (len <= maxlen)
+
+    and following backtrace:
+
+      ...
+      build_append_padded_str (array=0x555556afe320, str=0x555556afdb2e "CRASH ME", maxlen=0x6, pad=0x20) at hw/acpi/aml-build.c:61
+      acpi_table_begin (desc=0x7fffffffd1b0, array=0x555556afe320) at hw/acpi/aml-build.c:1727
+      build_fadt (tbl=0x555556afe320, linker=0x555557ca3830, f=0x7fffffffd318, oem_id=0x555556afdb2e "CRASH ME", oem_table_id=0x555556afdb34 "ME") at hw/acpi/aml-build.c:2064
+      ...
+
+    which happens due to acpi_table_begin() expecting NULL terminated
+    oem_id and oem_table_id strings, which is normally the case, but
+    in case of user provided SLIC table, oem_id points to table's blob
+    directly and as result oem_id became longer than expected.
+
+    Fix issue by handling oem_id consistently and make acpi_get_slic_oem()
+    return NULL terminated strings.
+
+    PS:
+    After [1] refactoring, oem_id semantics became inconsistent, where
+    NULL terminated string was coming from machine and old way pointer
+    into byte array coming from -acpitable option. That used to work
+    since build_header() wasn't expecting NULL terminated string and
+    blindly copied the 1st 6 bytes only.
+
+    However commit [2] broke that by replacing build_header() with
+    acpi_table_begin(), which was expecting NULL terminated string
+    and was checking oem_id size.
+
+    1) 602b45820 ("acpi: Permit OEM ID and OEM table ID fields to be changed")
+    2)
+    Fixes: 4b56e1e4eb08 ("acpi: build_fadt: use acpi_table_begin()/acpi_table_end() instead of build_header()")
+    Resolves: https://gitlab.com/qemu-project/qemu/-/issues/786
+    Signed-off-by: Igor Mammedov <imammedo@redhat.com>
+    Message-Id: <20211227193120.1084176-2-imammedo@redhat.com>
+    Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+    Tested-by: Denis Lisov <dennis.lissov@gmail.com>
+    Tested-by: Alexander Tsoy <alexander@tsoy.me>
+    Cc: qemu-stable@nongnu.org
+    Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+
+(cherry picked from commit 8cdb99af45365727ac17f45239a9b8c1d5155c6d)
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ hw/acpi/core.c       | 4 ++--
+ hw/i386/acpi-build.c | 2 ++
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/hw/acpi/core.c b/hw/acpi/core.c
+index 1e004d0078..3e811bf03c 100644
+--- a/hw/acpi/core.c
++++ b/hw/acpi/core.c
+@@ -345,8 +345,8 @@ int acpi_get_slic_oem(AcpiSlicOem *oem)
+         struct acpi_table_header *hdr = (void *)(u - sizeof(hdr->_length));
+ 
+         if (memcmp(hdr->sig, "SLIC", 4) == 0) {
+-            oem->id = hdr->oem_id;
+-            oem->table_id = hdr->oem_table_id;
++            oem->id = g_strndup(hdr->oem_id, 6);
++            oem->table_id = g_strndup(hdr->oem_table_id, 8);
+             return 0;
+         }
+     }
+diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
+index a4478e77b7..acc4869db0 100644
+--- a/hw/i386/acpi-build.c
++++ b/hw/i386/acpi-build.c
+@@ -2726,6 +2726,8 @@ void acpi_build(AcpiBuildTables *tables, MachineState *machine)
+ 
+     /* Cleanup memory that's no longer used. */
+     g_array_free(table_offsets, true);
++    g_free(slic_oem.id);
++    g_free(slic_oem.table_id);
+ }
+ 
+ static void acpi_ram_update(MemoryRegion *mr, GArray *data)
+-- 
+2.27.0
+

SOURCES/kvm-acpi-fix-acpi_index-migration.patch

@@ -0,0 +1,165 @@
+From 3deffc03c2e9b0053eec5aeb5b5d633dfe29f499 Mon Sep 17 00:00:00 2001
+From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
+Date: Wed, 6 Apr 2022 14:58:12 -0400
+Subject: [PATCH 1/3] acpi: fix acpi_index migration
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Peter Xu <peterx@redhat.com>
+RH-MergeRequest: 343: acpi: fix acpi_index migration
+RH-Jira: RHEL-20189
+RH-Acked-by: Leonardo Brás <leobras@redhat.com>
+RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
+RH-Acked-by: Prasad Pandit <None>
+RH-Commit: [1/2] c5b9cdf5791cd856207b7df7e2ef5df360ec8de4
+
+vmstate_acpi_pcihp_use_acpi_index() was expecting AcpiPciHpState
+as state but it actually received PIIX4PMState, because
+VMSTATE_PCI_HOTPLUG is a macro and not another struct.
+So it ended up accessing random pointer, which resulted
+in 'false' return value and acpi_index field wasn't ever
+sent.
+
+However in 7.0 that pointer de-references to value > 0, and
+destination QEMU starts to expect the field which isn't
+sent in migratioon stream from older QEMU (6.2 and older).
+As result migration fails with:
+  qemu-system-x86_64: Missing section footer for 0000:00:01.3/piix4_pm
+  qemu-system-x86_64: load of migration failed: Invalid argument
+
+In addition with QEMU-6.2, destination due to not expected
+state, also never expects the acpi_index field in migration
+stream.
+
+Q35 is not affected as it always sends/expects the field as
+long as acpi based PCI hotplug is enabled.
+
+Fix issue by introducing compat knob to never send/expect
+acpi_index in migration stream for 6.2 and older PC machine
+types and always send it for 7.0 and newer PC machine types.
+
+Diagnosed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+Fixes: b32bd76 ("pci: introduce acpi-index property for PCI device")
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/932
+Signed-off-by: Igor Mammedov <imammedo@redhat.com>
+Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+(cherry picked from commit a83c2844903c45aa7d32cdd17305f23ce2c56ab9)
+Signed-off-by: Peter Xu <peterx@redhat.com>
+---
+ hw/acpi/acpi-pci-hotplug-stub.c |  4 ----
+ hw/acpi/pcihp.c                 |  6 ------
+ hw/acpi/piix4.c                 | 15 ++++++++++++++-
+ hw/core/machine.c               |  5 +++++
+ include/hw/acpi/pcihp.h         |  2 --
+ 5 files changed, 19 insertions(+), 13 deletions(-)
+
+diff --git a/hw/acpi/acpi-pci-hotplug-stub.c b/hw/acpi/acpi-pci-hotplug-stub.c
+index 734e4c5986..a43f6dafc9 100644
+--- a/hw/acpi/acpi-pci-hotplug-stub.c
++++ b/hw/acpi/acpi-pci-hotplug-stub.c
+@@ -41,7 +41,3 @@ void acpi_pcihp_reset(AcpiPciHpState *s, bool acpihp_root_off)
+     return;
+ }
+ 
+-bool vmstate_acpi_pcihp_use_acpi_index(void *opaque, int version_id)
+-{
+-    return false;
+-}
+diff --git a/hw/acpi/pcihp.c b/hw/acpi/pcihp.c
+index be0e846b34..ec861661c3 100644
+--- a/hw/acpi/pcihp.c
++++ b/hw/acpi/pcihp.c
+@@ -559,12 +559,6 @@ void acpi_pcihp_init(Object *owner, AcpiPciHpState *s, PCIBus *root_bus,
+                                    OBJ_PROP_FLAG_READ);
+ }
+ 
+-bool vmstate_acpi_pcihp_use_acpi_index(void *opaque, int version_id)
+-{
+-     AcpiPciHpState *s = opaque;
+-     return s->acpi_index;
+-}
+-
+ const VMStateDescription vmstate_acpi_pcihp_pci_status = {
+     .name = "acpi_pcihp_pci_status",
+     .version_id = 1,
+diff --git a/hw/acpi/piix4.c b/hw/acpi/piix4.c
+index 8d6011c0a3..033e75ce5b 100644
+--- a/hw/acpi/piix4.c
++++ b/hw/acpi/piix4.c
+@@ -82,6 +82,7 @@ struct PIIX4PMState {
+     AcpiPciHpState acpi_pci_hotplug;
+     bool use_acpi_hotplug_bridge;
+     bool use_acpi_root_pci_hotplug;
++    bool not_migrate_acpi_index;
+ 
+     uint8_t disable_s3;
+     uint8_t disable_s4;
+@@ -269,6 +270,16 @@ static bool piix4_vmstate_need_smbus(void *opaque, int version_id)
+     return pm_smbus_vmstate_needed();
+ }
+ 
++/*
++ * This is a fudge to turn off the acpi_index field,
++ * whose test was always broken on piix4 with 6.2 and older machine types.
++ */
++static bool vmstate_test_migrate_acpi_index(void *opaque, int version_id)
++{
++    PIIX4PMState *s = PIIX4_PM(opaque);
++    return s->use_acpi_hotplug_bridge && !s->not_migrate_acpi_index;
++}
++
+ /* qemu-kvm 1.2 uses version 3 but advertised as 2
+  * To support incoming qemu-kvm 1.2 migration, change version_id
+  * and minimum_version_id to 2 below (which breaks migration from
+@@ -299,7 +310,7 @@ static const VMStateDescription vmstate_acpi = {
+             struct AcpiPciHpPciStatus),
+         VMSTATE_PCI_HOTPLUG(acpi_pci_hotplug, PIIX4PMState,
+                             vmstate_test_use_acpi_hotplug_bridge,
+-                            vmstate_acpi_pcihp_use_acpi_index),
++                            vmstate_test_migrate_acpi_index),
+         VMSTATE_END_OF_LIST()
+     },
+     .subsections = (const VMStateDescription*[]) {
+@@ -654,6 +665,8 @@ static Property piix4_pm_properties[] = {
+     DEFINE_PROP_BOOL("memory-hotplug-support", PIIX4PMState,
+                      acpi_memory_hotplug.is_enabled, true),
+     DEFINE_PROP_BOOL("smm-compat", PIIX4PMState, smm_compat, false),
++    DEFINE_PROP_BOOL("x-not-migrate-acpi-index", PIIX4PMState,
++                      not_migrate_acpi_index, false),
+     DEFINE_PROP_END_OF_LIST(),
+ };
+ 
+diff --git a/hw/core/machine.c b/hw/core/machine.c
+index 76fcabec7a..2724f6848a 100644
+--- a/hw/core/machine.c
++++ b/hw/core/machine.c
+@@ -331,6 +331,11 @@ GlobalProperty hw_compat_rhel_7_1[] = {
+ };
+ const size_t hw_compat_rhel_7_1_len = G_N_ELEMENTS(hw_compat_rhel_7_1);
+ 
++GlobalProperty hw_compat_6_2[] = {
++    { "PIIX4_PM", "x-not-migrate-acpi-index", "on"},
++};
++const size_t hw_compat_6_2_len = G_N_ELEMENTS(hw_compat_6_2);
++
+ GlobalProperty hw_compat_6_1[] = {
+     { "vhost-user-vsock-device", "seqpacket", "off" },
+     { "nvme-ns", "shared", "off" },
+diff --git a/include/hw/acpi/pcihp.h b/include/hw/acpi/pcihp.h
+index af1a169fc3..7e268c2c9c 100644
+--- a/include/hw/acpi/pcihp.h
++++ b/include/hw/acpi/pcihp.h
+@@ -73,8 +73,6 @@ void acpi_pcihp_reset(AcpiPciHpState *s, bool acpihp_root_off);
+ 
+ extern const VMStateDescription vmstate_acpi_pcihp_pci_status;
+ 
+-bool vmstate_acpi_pcihp_use_acpi_index(void *opaque, int version_id);
+-
+ #define VMSTATE_PCI_HOTPLUG(pcihp, state, test_pcihp, test_acpi_index) \
+         VMSTATE_UINT32_TEST(pcihp.hotplug_select, state, \
+                             test_pcihp), \
+-- 
+2.41.0
+

SOURCES/kvm-acpi-pcihp-pcie-set-power-on-cap-on-parent-slot.patch

@@ -0,0 +1,140 @@
+From c9ceb175667cdeead59384a97a812367ae19c570 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Wed, 23 Mar 2022 13:21:40 -0400
+Subject: [PATCH 06/18] acpi: pcihp: pcie: set power on cap on parent slot
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 134: pci: expose TYPE_XIO3130_DOWNSTREAM name
+RH-Commit: [2/2] d883872647a6e90ec573140b2c171f3f53b600ab (jmaloy/qemu-kvm)
+RH-Bugzilla: 2062610
+RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
+RH-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
+
+BZ: https://bugzilla.redhat.com/2062610
+UPSTREAM: merged
+BREW: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=44038138
+
+commit 6b0969f1ec825984cd74619f0730be421b0c46fb
+Author: Igor Mammedov <imammedo@redhat.com>
+Date:   Tue Mar 1 10:11:59 2022 -0500
+
+    acpi: pcihp: pcie: set power on cap on parent slot
+
+    on creation a PCIDevice has power turned on at the end of pci_qdev_realize()
+    however later on if PCIe slot isn't populated with any children
+    it's power is turned off. It's fine if native hotplug is used
+    as plug callback will power slot on among other things.
+    However when ACPI hotplug is enabled it replaces native PCIe plug
+    callbacks with ACPI specific ones (acpi_pcihp_device_*plug_cb) and
+    as result slot stays powered off. It works fine as ACPI hotplug
+    on guest side takes care of enumerating/initializing hotplugged
+    device. But when later guest is migrated, call chain introduced by]
+    commit d5daff7d312 (pcie: implement slot power control for pcie root ports)
+
+       pcie_cap_slot_post_load()
+           -> pcie_cap_update_power()
+               -> pcie_set_power_device()
+                   -> pci_set_power()
+                       -> pci_update_mappings()
+
+    will disable earlier initialized BARs for the hotplugged device
+    in powered off slot due to commit 23786d13441 (pci: implement power state)
+    which disables BARs if power is off.
+
+    Fix it by setting PCI_EXP_SLTCTL_PCC to PCI_EXP_SLTCTL_PWR_ON
+    on slot (root port/downstream port) at the time a device
+    hotplugged into it. As result PCI_EXP_SLTCTL_PWR_ON is migrated
+    to target and above call chain keeps device plugged into it
+    powered on.
+
+    Fixes: d5daff7d312 ("pcie: implement slot power control for pcie root ports")
+    Fixes: 23786d13441 ("pci: implement power state")
+    Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2053584
+    Suggested-by: "Michael S. Tsirkin" <mst@redhat.com>
+    Signed-off-by: Igor Mammedov <imammedo@redhat.com>
+    Message-Id: <20220301151200.3507298-3-imammedo@redhat.com>
+    Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+
+(cherry picked from commit 6b0969f1ec825984cd74619f0730be421b0c46fb)
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ hw/acpi/pcihp.c       | 12 +++++++++++-
+ hw/pci/pcie.c         | 11 +++++++++++
+ include/hw/pci/pcie.h |  1 +
+ 3 files changed, 23 insertions(+), 1 deletion(-)
+
+diff --git a/hw/acpi/pcihp.c b/hw/acpi/pcihp.c
+index a5e182dd3a..be0e846b34 100644
+--- a/hw/acpi/pcihp.c
++++ b/hw/acpi/pcihp.c
+@@ -32,6 +32,7 @@
+ #include "hw/pci/pci_bridge.h"
+ #include "hw/pci/pci_host.h"
+ #include "hw/pci/pcie_port.h"
++#include "hw/pci-bridge/xio3130_downstream.h"
+ #include "hw/i386/acpi-build.h"
+ #include "hw/acpi/acpi.h"
+ #include "hw/pci/pci_bus.h"
+@@ -341,6 +342,8 @@ void acpi_pcihp_device_plug_cb(HotplugHandler *hotplug_dev, AcpiPciHpState *s,
+ {
+     PCIDevice *pdev = PCI_DEVICE(dev);
+     int slot = PCI_SLOT(pdev->devfn);
++    PCIDevice *bridge;
++    PCIBus *bus;
+     int bsel;
+ 
+     /* Don't send event when device is enabled during qemu machine creation:
+@@ -370,7 +373,14 @@ void acpi_pcihp_device_plug_cb(HotplugHandler *hotplug_dev, AcpiPciHpState *s,
+         return;
+     }
+ 
+-    bsel = acpi_pcihp_get_bsel(pci_get_bus(pdev));
++    bus = pci_get_bus(pdev);
++    bridge = pci_bridge_get_device(bus);
++    if (object_dynamic_cast(OBJECT(bridge), TYPE_PCIE_ROOT_PORT) ||
++        object_dynamic_cast(OBJECT(bridge), TYPE_XIO3130_DOWNSTREAM)) {
++        pcie_cap_slot_enable_power(bridge);
++    }
++
++    bsel = acpi_pcihp_get_bsel(bus);
+     g_assert(bsel >= 0);
+     s->acpi_pcihp_pci_status[bsel].up |= (1U << slot);
+     acpi_send_event(DEVICE(hotplug_dev), ACPI_PCI_HOTPLUG_STATUS);
+diff --git a/hw/pci/pcie.c b/hw/pci/pcie.c
+index d7d73a31e4..996f0e24fe 100644
+--- a/hw/pci/pcie.c
++++ b/hw/pci/pcie.c
+@@ -366,6 +366,17 @@ static void hotplug_event_clear(PCIDevice *dev)
+     }
+ }
+ 
++void pcie_cap_slot_enable_power(PCIDevice *dev)
++{
++    uint8_t *exp_cap = dev->config + dev->exp.exp_cap;
++    uint32_t sltcap = pci_get_long(exp_cap + PCI_EXP_SLTCAP);
++
++    if (sltcap & PCI_EXP_SLTCAP_PCP) {
++        pci_set_word_by_mask(exp_cap + PCI_EXP_SLTCTL,
++                             PCI_EXP_SLTCTL_PCC, PCI_EXP_SLTCTL_PWR_ON);
++    }
++}
++
+ static void pcie_set_power_device(PCIBus *bus, PCIDevice *dev, void *opaque)
+ {
+     bool *power = opaque;
+diff --git a/include/hw/pci/pcie.h b/include/hw/pci/pcie.h
+index 6063bee0ec..c27368d077 100644
+--- a/include/hw/pci/pcie.h
++++ b/include/hw/pci/pcie.h
+@@ -112,6 +112,7 @@ void pcie_cap_slot_write_config(PCIDevice *dev,
+                                 uint32_t addr, uint32_t val, int len);
+ int pcie_cap_slot_post_load(void *opaque, int version_id);
+ void pcie_cap_slot_push_attention_button(PCIDevice *dev);
++void pcie_cap_slot_enable_power(PCIDevice *dev);
+ 
+ void pcie_cap_root_init(PCIDevice *dev);
+ void pcie_cap_root_reset(PCIDevice *dev);
+-- 
+2.27.0
+

SOURCES/kvm-acpi-validate-hotplug-selector-on-access.patch

@@ -0,0 +1,51 @@
+From 529a5d908f5d16714b8ae0a51eaaaa84994dfae8 Mon Sep 17 00:00:00 2001
+From: "Michael S. Tsirkin" <mst@redhat.com>
+Date: Tue, 21 Dec 2021 09:45:44 -0500
+Subject: [PATCH 1/2] acpi: validate hotplug selector on access
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 97: acpi: validate hotplug selector on access
+RH-Commit: [1/1] 79bcfb0df0091e2b716d2e1c545f047b3409c26c (jmaloy/qemu-kvm)
+RH-Bugzilla: 2036580
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
+RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
+
+When bus is looked up on a pci write, we didn't
+validate that the lookup succeeded.
+Fuzzers thus can trigger QEMU crash by dereferencing the NULL
+bus pointer.
+
+Fixes: b32bd763a1 ("pci: introduce acpi-index property for PCI device")
+Fixes: CVE-2021-4158
+Cc: "Igor Mammedov" <imammedo@redhat.com>
+Fixes: https://gitlab.com/qemu-project/qemu/-/issues/770
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Ani Sinha <ani@anisinha.ca>
+(cherry picked from commit 9bd6565ccee68f72d5012e24646e12a1c662827e)
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ hw/acpi/pcihp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/hw/acpi/pcihp.c b/hw/acpi/pcihp.c
+index 30405b5113..a5e182dd3a 100644
+--- a/hw/acpi/pcihp.c
++++ b/hw/acpi/pcihp.c
+@@ -491,6 +491,9 @@ static void pci_write(void *opaque, hwaddr addr, uint64_t data,
+         }
+ 
+         bus = acpi_pcihp_find_hotplug_bus(s, s->hotplug_select);
++        if (!bus) {
++            break;
++        }
+         QTAILQ_FOREACH_SAFE(kid, &bus->qbus.children, sibling, next) {
+             Object *o = OBJECT(kid->child);
+             PCIDevice *dev = PCI_DEVICE(o);
+-- 
+2.27.0
+

SOURCES/kvm-aio-posix-completely-stop-polling-when-disabled.patch

@@ -1,104 +0,0 @@
-From 4b4fb1cccb8e0307658cee3bc90c77e5f1dde60a Mon Sep 17 00:00:00 2001
-From: Thomas Huth <thuth@redhat.com>
-Date: Fri, 9 Oct 2020 10:08:49 -0400
-Subject: [PATCH 13/14] aio-posix: completely stop polling when disabled
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-Message-id: <20201009100849.264994-10-thuth@redhat.com>
-Patchwork-id: 98603
-O-Subject: [RHEL-8.4.0 qemu-kvm PATCH 9/9] aio-posix: completely stop polling when disabled
-Bugzilla: 1846975
-RH-Acked-by: Jens Freimann <jfreimann@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
-
-From: Stefan Hajnoczi <stefanha@redhat.com>
-
-One iteration of polling is always performed even when polling is
-disabled.  This is done because:
-1. Userspace polling is cheaper than making a syscall.  We might get
-   lucky.
-2. We must poll once more after polling has stopped in case an event
-   occurred while stopping polling.
-
-However, there are downsides:
-1. Polling becomes a bottleneck when the number of event sources is very
-   high.  It's more efficient to monitor fds in that case.
-2. A high-frequency polling event source can starve non-polling event
-   sources because ppoll(2)/epoll(7) is never invoked.
-
-This patch removes the forced polling iteration so that poll_ns=0 really
-means no polling.
-
-IOPS increases from 10k to 60k when the guest has 100
-virtio-blk-pci,num-queues=32 devices and 1 virtio-blk-pci,num-queues=1
-device because the large number of event sources being polled slows down
-the event loop.
-
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Link: https://lore.kernel.org/r/20200305170806.1313245-2-stefanha@redhat.com
-Message-Id: <20200305170806.1313245-2-stefanha@redhat.com>
-(cherry picked from commit e4346192f1c2e1683a807b46efac47ef0cf9b545)
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
----
- util/aio-posix.c | 22 +++++++++++++++-------
- 1 file changed, 15 insertions(+), 7 deletions(-)
-
-diff --git a/util/aio-posix.c b/util/aio-posix.c
-index a4977f538e..abc396d030 100644
---- a/util/aio-posix.c
-+++ b/util/aio-posix.c
-@@ -340,12 +340,13 @@ void aio_set_event_notifier_poll(AioContext *ctx,
-                     (IOHandler *)io_poll_end);
- }
- 
--static void poll_set_started(AioContext *ctx, bool started)
-+static bool poll_set_started(AioContext *ctx, bool started)
- {
-     AioHandler *node;
-+    bool progress = false;
- 
-     if (started == ctx->poll_started) {
--        return;
-+        return false;
-     }
- 
-     ctx->poll_started = started;
-@@ -367,8 +368,15 @@ static void poll_set_started(AioContext *ctx, bool started)
-         if (fn) {
-             fn(node->opaque);
-         }
-+
-+        /* Poll one last time in case ->io_poll_end() raced with the event */
-+        if (!started) {
-+            progress = node->io_poll(node->opaque) || progress;
-+        }
-     }
-     qemu_lockcnt_dec(&ctx->list_lock);
-+
-+    return progress;
- }
- 
- 
-@@ -599,12 +607,12 @@ static bool try_poll_mode(AioContext *ctx, int64_t *timeout)
-         }
-     }
- 
--    poll_set_started(ctx, false);
-+    if (poll_set_started(ctx, false)) {
-+        *timeout = 0;
-+        return true;
-+    }
- 
--    /* Even if we don't run busy polling, try polling once in case it can make
--     * progress and the caller will be able to avoid ppoll(2)/epoll_wait(2).
--     */
--    return run_poll_handlers_once(ctx, timeout);
-+    return false;
- }
- 
- bool aio_poll(AioContext *ctx, bool blocking)
--- 
-2.27.0
-

SOURCES/kvm-aio-wait-delegate-polling-of-main-AioContext-if-BQL-.patch

@@ -1,132 +0,0 @@
-From b474155fdc38f86f516c14ba9a6f934616d589ef Mon Sep 17 00:00:00 2001
-From: Andrew Jones <drjones@redhat.com>
-Date: Wed, 4 Aug 2021 03:27:22 -0400
-Subject: [PATCH 1/2] aio-wait: delegate polling of main AioContext if BQL not
- held
-
-RH-Author: Andrew Jones <drjones@redhat.com>
-Message-id: <20210729134448.4995-2-drjones@redhat.com>
-Patchwork-id: 101935
-O-Subject: [RHEL-8.5.0 qemu-kvm PATCH v2 1/2] aio-wait: delegate polling of main AioContext if BQL not held
-Bugzilla: 1969848
-RH-Acked-by: Gavin Shan <gshan@redhat.com>
-RH-Acked-by: Auger Eric <eric.auger@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-
-From: Paolo Bonzini <pbonzini@redhat.com>
-
-Any thread that is not a iothread returns NULL for qemu_get_current_aio_context().
-As a result, it would also return true for
-in_aio_context_home_thread(qemu_get_aio_context()), causing
-AIO_WAIT_WHILE to invoke aio_poll() directly.  This is incorrect
-if the BQL is not held, because aio_poll() does not expect to
-run concurrently from multiple threads, and it can actually
-happen when savevm writes to the vmstate file from the
-migration thread.
-
-Therefore, restrict in_aio_context_home_thread to return true
-for the main AioContext only if the BQL is held.
-
-The function is moved to aio-wait.h because it is mostly used
-there and to avoid a circular reference between main-loop.h
-and block/aio.h.
-
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Message-Id: <20200407140746.8041-5-pbonzini@redhat.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit 3c18a92dc4b55ca8cc37a755ed119f11c0f34099)
-Signed-off-by: Andrew Jones <drjones@redhat.com>
-Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
----
- include/block/aio-wait.h | 22 ++++++++++++++++++++++
- include/block/aio.h      | 29 ++++++++++-------------------
- 2 files changed, 32 insertions(+), 19 deletions(-)
-
-diff --git a/include/block/aio-wait.h b/include/block/aio-wait.h
-index afeeb18f95..716d2639df 100644
---- a/include/block/aio-wait.h
-+++ b/include/block/aio-wait.h
-@@ -26,6 +26,7 @@
- #define QEMU_AIO_WAIT_H
- 
- #include "block/aio.h"
-+#include "qemu/main-loop.h"
- 
- /**
-  * AioWait:
-@@ -124,4 +125,25 @@ void aio_wait_kick(void);
-  */
- void aio_wait_bh_oneshot(AioContext *ctx, QEMUBHFunc *cb, void *opaque);
- 
-+/**
-+ * in_aio_context_home_thread:
-+ * @ctx: the aio context
-+ *
-+ * Return whether we are running in the thread that normally runs @ctx.  Note
-+ * that acquiring/releasing ctx does not affect the outcome, each AioContext
-+ * still only has one home thread that is responsible for running it.
-+ */
-+static inline bool in_aio_context_home_thread(AioContext *ctx)
-+{
-+    if (ctx == qemu_get_current_aio_context()) {
-+        return true;
-+    }
-+
-+    if (ctx == qemu_get_aio_context()) {
-+        return qemu_mutex_iothread_locked();
-+    } else {
-+        return false;
-+    }
-+}
-+
- #endif /* QEMU_AIO_WAIT_H */
-diff --git a/include/block/aio.h b/include/block/aio.h
-index 6b0d52f732..9d28e247df 100644
---- a/include/block/aio.h
-+++ b/include/block/aio.h
-@@ -60,12 +60,16 @@ struct AioContext {
-     QLIST_HEAD(, AioHandler) aio_handlers;
- 
-     /* Used to avoid unnecessary event_notifier_set calls in aio_notify;
--     * accessed with atomic primitives.  If this field is 0, everything
--     * (file descriptors, bottom halves, timers) will be re-evaluated
--     * before the next blocking poll(), thus the event_notifier_set call
--     * can be skipped.  If it is non-zero, you may need to wake up a
--     * concurrent aio_poll or the glib main event loop, making
--     * event_notifier_set necessary.
-+     * only written from the AioContext home thread, or under the BQL in
-+     * the case of the main AioContext.  However, it is read from any
-+     * thread so it is still accessed with atomic primitives.
-+     *
-+     * If this field is 0, everything (file descriptors, bottom halves,
-+     * timers) will be re-evaluated before the next blocking poll() or
-+     * io_uring wait; therefore, the event_notifier_set call can be
-+     * skipped.  If it is non-zero, you may need to wake up a concurrent
-+     * aio_poll or the glib main event loop, making event_notifier_set
-+     * necessary.
-      *
-      * Bit 0 is reserved for GSource usage of the AioContext, and is 1
-      * between a call to aio_ctx_prepare and the next call to aio_ctx_check.
-@@ -580,19 +584,6 @@ void aio_co_enter(AioContext *ctx, struct Coroutine *co);
-  */
- AioContext *qemu_get_current_aio_context(void);
- 
--/**
-- * in_aio_context_home_thread:
-- * @ctx: the aio context
-- *
-- * Return whether we are running in the thread that normally runs @ctx.  Note
-- * that acquiring/releasing ctx does not affect the outcome, each AioContext
-- * still only has one home thread that is responsible for running it.
-- */
--static inline bool in_aio_context_home_thread(AioContext *ctx)
--{
--    return ctx == qemu_get_current_aio_context();
--}
--
- /**
-  * aio_context_setup:
-  * @ctx: the aio context
--- 
-2.27.0
-

SOURCES/kvm-aio-wait-switch-to-smp_mb__after_rmw.patch

@@ -0,0 +1,50 @@
+From 953c5c0982b61b0a3f8f03452844b5487eb22fc7 Mon Sep 17 00:00:00 2001
+From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+Date: Thu, 9 Mar 2023 08:13:17 -0500
+Subject: [PATCH 06/13] aio-wait: switch to smp_mb__after_rmw()
+
+RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+RH-MergeRequest: 263: qatomic: add smp_mb__before/after_rmw()
+RH-Bugzilla: 2168472
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Eric Auger <eric.auger@redhat.com>
+RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+RH-Acked-by: David Hildenbrand <david@redhat.com>
+RH-Commit: [6/10] 9f30f97754139ffd18d36b2350f9ed4e59ac496e
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2168472
+
+commit b532526a07ef3b903ead2e055fe6cc87b41057a3
+Author: Paolo Bonzini <pbonzini@redhat.com>
+Date:   Fri Mar 3 11:03:52 2023 +0100
+
+    aio-wait: switch to smp_mb__after_rmw()
+
+    The barrier comes after an atomic increment, so it is enough to use
+    smp_mb__after_rmw(); this avoids a double barrier on x86 systems.
+
+    Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+    Reviewed-by: David Hildenbrand <david@redhat.com>
+    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+
+Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+---
+ include/block/aio-wait.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/block/aio-wait.h b/include/block/aio-wait.h
+index 54840f8622..03b6394c78 100644
+--- a/include/block/aio-wait.h
++++ b/include/block/aio-wait.h
+@@ -82,7 +82,7 @@ extern AioWait global_aio_wait;
+     /* Increment wait_->num_waiters before evaluating cond. */     \
+     qatomic_inc(&wait_->num_waiters);                              \
+     /* Paired with smp_mb in aio_wait_kick(). */                   \
+-    smp_mb();                                                      \
++    smp_mb__after_rmw();                                           \
+     if (ctx_ && in_aio_context_home_thread(ctx_)) {                \
+         while ((cond)) {                                           \
+             aio_poll(ctx_, true);                                  \
+-- 
+2.37.3
+

SOURCES/kvm-aio_wait_kick-add-missing-memory-barrier.patch

@@ -0,0 +1,86 @@
+From d7eae0ff4c7f7f7bf10f10272adf7c6971c0db9b Mon Sep 17 00:00:00 2001
+From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+Date: Thu, 9 Mar 2023 09:26:35 -0500
+Subject: [PATCH 01/13] aio_wait_kick: add missing memory barrier
+
+RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+RH-MergeRequest: 263: qatomic: add smp_mb__before/after_rmw()
+RH-Bugzilla: 2168472
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Eric Auger <eric.auger@redhat.com>
+RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+RH-Acked-by: David Hildenbrand <david@redhat.com>
+RH-Commit: [1/10] eb774aee79864052e14e706d931e52e7bd1162c8
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2168472
+
+commit 7455ff1aa01564cc175db5b2373e610503ad4411
+Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+Date:   Tue May 24 13:30:54 2022 -0400
+
+    aio_wait_kick: add missing memory barrier
+
+    It seems that aio_wait_kick always required a memory barrier
+    or atomic operation in the caller, but nobody actually
+    took care of doing it.
+
+    Let's put the barrier in the function instead, and pair it
+    with another one in AIO_WAIT_WHILE. Read aio_wait_kick()
+    comment for further explanation.
+
+    Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
+    Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+    Message-Id: <20220524173054.12651-1-eesposit@redhat.com>
+    Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
+    Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+    Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+
+Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+---
+ include/block/aio-wait.h |  2 ++
+ util/aio-wait.c          | 16 +++++++++++++++-
+ 2 files changed, 17 insertions(+), 1 deletion(-)
+
+diff --git a/include/block/aio-wait.h b/include/block/aio-wait.h
+index b39eefb38d..54840f8622 100644
+--- a/include/block/aio-wait.h
++++ b/include/block/aio-wait.h
+@@ -81,6 +81,8 @@ extern AioWait global_aio_wait;
+     AioContext *ctx_ = (ctx);                                      \
+     /* Increment wait_->num_waiters before evaluating cond. */     \
+     qatomic_inc(&wait_->num_waiters);                              \
++    /* Paired with smp_mb in aio_wait_kick(). */                   \
++    smp_mb();                                                      \
+     if (ctx_ && in_aio_context_home_thread(ctx_)) {                \
+         while ((cond)) {                                           \
+             aio_poll(ctx_, true);                                  \
+diff --git a/util/aio-wait.c b/util/aio-wait.c
+index bdb3d3af22..98c5accd29 100644
+--- a/util/aio-wait.c
++++ b/util/aio-wait.c
+@@ -35,7 +35,21 @@ static void dummy_bh_cb(void *opaque)
+ 
+ void aio_wait_kick(void)
+ {
+-    /* The barrier (or an atomic op) is in the caller.  */
++    /*
++     * Paired with smp_mb in AIO_WAIT_WHILE. Here we have:
++     * write(condition);
++     * aio_wait_kick() {
++     *      smp_mb();
++     *      read(num_waiters);
++     * }
++     *
++     * And in AIO_WAIT_WHILE:
++     * write(num_waiters);
++     * smp_mb();
++     * read(condition);
++     */
++    smp_mb();
++
+     if (qatomic_read(&global_aio_wait.num_waiters)) {
+         aio_bh_schedule_oneshot(qemu_get_aio_context(), dummy_bh_cb, NULL);
+     }
+-- 
+2.37.3
+

SOURCES/kvm-apic-Use-32bit-APIC-ID-for-migration-instance-ID.patch

@@ -1,62 +0,0 @@
-From 0d5a09173eb75b7e56122c2aefb2646a2be58400 Mon Sep 17 00:00:00 2001
-From: Peter Xu <peterx@redhat.com>
-Date: Fri, 31 Jan 2020 17:12:57 +0000
-Subject: [PATCH 15/15] apic: Use 32bit APIC ID for migration instance ID
-
-RH-Author: Peter Xu <peterx@redhat.com>
-Message-id: <20200131171257.1066593-4-peterx@redhat.com>
-Patchwork-id: 93628
-O-Subject: [RHEL-AV-8.2.0 qemu-kvm PATCH 3/3] apic: Use 32bit APIC ID for migration instance ID
-Bugzilla: 1529231
-RH-Acked-by: Eduardo Habkost <ehabkost@redhat.com>
-RH-Acked-by: Juan Quintela <quintela@redhat.com>
-RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
-
-Migration is silently broken now with x2apic config like this:
-
-     -smp 200,maxcpus=288,sockets=2,cores=72,threads=2 \
-     -device intel-iommu,intremap=on,eim=on
-
-After migration, the guest kernel could hang at anything, due to
-x2apic bit not migrated correctly in IA32_APIC_BASE on some vcpus, so
-any operations related to x2apic could be broken then (e.g., RDMSR on
-x2apic MSRs could fail because KVM would think that the vcpu hasn't
-enabled x2apic at all).
-
-The issue is that the x2apic bit was never applied correctly for vcpus
-whose ID > 255 when migrate completes, and that's because when we
-migrate APIC we use the APICCommonState.id as instance ID of the
-migration stream, while that's too short for x2apic.
-
-Let's use the newly introduced initial_apic_id for that.
-
-Signed-off-by: Peter Xu <peterx@redhat.com>
-Reviewed-by: Juan Quintela <quintela@redhat.com>
-Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
-Signed-off-by: Juan Quintela <quintela@redhat.com>
-(cherry picked from commit 0ab994867c365db21e15f9503922c79234d8e40e)
-Signed-off-by: Peter Xu <peterx@redhat.com>
-Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
----
- hw/intc/apic_common.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/hw/intc/apic_common.c b/hw/intc/apic_common.c
-index 54b8731..b5dbeb6 100644
---- a/hw/intc/apic_common.c
-+++ b/hw/intc/apic_common.c
-@@ -268,7 +268,10 @@ static void apic_common_realize(DeviceState *dev, Error **errp)
-     APICCommonState *s = APIC_COMMON(dev);
-     APICCommonClass *info;
-     static DeviceState *vapic;
--    uint32_t instance_id = s->id;
-+    uint32_t instance_id = s->initial_apic_id;
-+
-+    /* Normally initial APIC ID should be no more than hundreds */
-+    assert(instance_id != VMSTATE_INSTANCE_ID_ANY);
- 
-     info = APIC_COMMON_GET_CLASS(s);
-     info->realize(dev, errp);
--- 
-1.8.3.1
-

SOURCES/kvm-apic-disable-reentrancy-detection-for-apic-msi.patch

@@ -0,0 +1,56 @@
+From 47d027147694fde94dd73305ee53b6a136cbeced Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 9 May 2023 10:29:03 -0400
+Subject: [PATCH 08/15] apic: disable reentrancy detection for apic-msi
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 277: memory: prevent dma-reentracy issues
+RH-Bugzilla: 1999236
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [8/12] 25c3cf99b00cd9adc10d6e7afa9c3e3b7da08de2 (redhat/rhel/src/qemu-kvm/jons-qemu-kvm-2)
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1999236
+Upstream: Merged
+CVE: CVE-2021-3750
+
+commit 50795ee051a342c681a9b45671c552fbd6274db8
+Author: Alexander Bulekov <alxndr@bu.edu>
+Date:   Thu Apr 27 17:10:13 2023 -0400
+
+    apic: disable reentrancy detection for apic-msi
+
+    As the code is designed for re-entrant calls to apic-msi, mark apic-msi
+    as reentrancy-safe.
+
+    Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
+    Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
+    Message-Id: <20230427211013.2994127-9-alxndr@bu.edu>
+    Signed-off-by: Thomas Huth <thuth@redhat.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ hw/intc/apic.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/hw/intc/apic.c b/hw/intc/apic.c
+index 3df11c34d6..a7c2b301a8 100644
+--- a/hw/intc/apic.c
++++ b/hw/intc/apic.c
+@@ -883,6 +883,13 @@ static void apic_realize(DeviceState *dev, Error **errp)
+     memory_region_init_io(&s->io_memory, OBJECT(s), &apic_io_ops, s, "apic-msi",
+                           APIC_SPACE_SIZE);
+ 
++    /*
++     * apic-msi's apic_mem_write can call into ioapic_eoi_broadcast, which can
++     * write back to apic-msi. As such mark the apic-msi region re-entrancy
++     * safe.
++     */
++    s->io_memory.disable_reentrancy_guard = true;
++
+     s->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, apic_timer, s);
+     local_apics[s->id] = s;
+ 
+-- 
+2.37.3
+

SOURCES/kvm-async-Add-an-optional-reentrancy-guard-to-the-BH-API.patch

@@ -0,0 +1,235 @@
+From 8996ac4369de7e0cb6f911db6f47c3e4ae88c8aa Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 9 May 2023 10:29:03 -0400
+Subject: [PATCH 02/15] async: Add an optional reentrancy guard to the BH API
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 277: memory: prevent dma-reentracy issues
+RH-Bugzilla: 1999236
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [2/12] b03f247e242a6cdb3eebec36477234ac77dcd20c (redhat/rhel/src/qemu-kvm/jons-qemu-kvm-2)
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1999236
+Upstream: Merged
+CVE: CVE-2021-3750
+Conflict: The file block/graph-lock.h, inluded from include/block/aio.h,
+          doesn't exist in this code version. The code compiles without
+          issues if this include is just omitted, so we do that.
+
+commit 9c86c97f12c060bf7484dd931f38634e166a81f0
+Author: Alexander Bulekov <alxndr@bu.edu>
+Date:   Thu Apr 27 17:10:07 2023 -0400
+
+    async: Add an optional reentrancy guard to the BH API
+
+    Devices can pass their MemoryReentrancyGuard (from their DeviceState),
+    when creating new BHes. Then, the async API will toggle the guard
+    before/after calling the BH call-back. This prevents bh->mmio reentrancy
+    issues.
+
+    Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
+    Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
+    Message-Id: <20230427211013.2994127-3-alxndr@bu.edu>
+    [thuth: Fix "line over 90 characters" checkpatch.pl error]
+    Signed-off-by: Thomas Huth <thuth@redhat.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ docs/devel/multiple-iothreads.txt |  7 +++++++
+ include/block/aio.h               | 18 ++++++++++++++++--
+ include/qemu/main-loop.h          |  7 +++++--
+ tests/unit/ptimer-test-stubs.c    |  3 ++-
+ util/async.c                      | 18 +++++++++++++++++-
+ util/main-loop.c                  |  6 ++++--
+ util/trace-events                 |  1 +
+ 7 files changed, 52 insertions(+), 8 deletions(-)
+
+diff --git a/docs/devel/multiple-iothreads.txt b/docs/devel/multiple-iothreads.txt
+index aeb997bed5..a11576bc74 100644
+--- a/docs/devel/multiple-iothreads.txt
++++ b/docs/devel/multiple-iothreads.txt
+@@ -61,6 +61,7 @@ There are several old APIs that use the main loop AioContext:
+  * LEGACY qemu_aio_set_event_notifier() - monitor an event notifier
+  * LEGACY timer_new_ms() - create a timer
+  * LEGACY qemu_bh_new() - create a BH
++ * LEGACY qemu_bh_new_guarded() - create a BH with a device re-entrancy guard
+  * LEGACY qemu_aio_wait() - run an event loop iteration
+ 
+ Since they implicitly work on the main loop they cannot be used in code that
+@@ -72,8 +73,14 @@ Instead, use the AioContext functions directly (see include/block/aio.h):
+  * aio_set_event_notifier() - monitor an event notifier
+  * aio_timer_new() - create a timer
+  * aio_bh_new() - create a BH
++ * aio_bh_new_guarded() - create a BH with a device re-entrancy guard
+  * aio_poll() - run an event loop iteration
+ 
++The qemu_bh_new_guarded/aio_bh_new_guarded APIs accept a "MemReentrancyGuard"
++argument, which is used to check for and prevent re-entrancy problems. For
++BHs associated with devices, the reentrancy-guard is contained in the
++corresponding DeviceState and named "mem_reentrancy_guard".
++
+ The AioContext can be obtained from the IOThread using
+ iothread_get_aio_context() or for the main loop using qemu_get_aio_context().
+ Code that takes an AioContext argument works both in IOThreads or the main
+diff --git a/include/block/aio.h b/include/block/aio.h
+index 47fbe9d81f..c7da152985 100644
+--- a/include/block/aio.h
++++ b/include/block/aio.h
+@@ -22,6 +22,8 @@
+ #include "qemu/event_notifier.h"
+ #include "qemu/thread.h"
+ #include "qemu/timer.h"
++#include "hw/qdev-core.h"
++
+ 
+ typedef struct BlockAIOCB BlockAIOCB;
+ typedef void BlockCompletionFunc(void *opaque, int ret);
+@@ -321,9 +323,11 @@ void aio_bh_schedule_oneshot_full(AioContext *ctx, QEMUBHFunc *cb, void *opaque,
+  * is opaque and must be allocated prior to its use.
+  *
+  * @name: A human-readable identifier for debugging purposes.
++ * @reentrancy_guard: A guard set when entering a cb to prevent
++ * device-reentrancy issues
+  */
+ QEMUBH *aio_bh_new_full(AioContext *ctx, QEMUBHFunc *cb, void *opaque,
+-                        const char *name);
++                        const char *name, MemReentrancyGuard *reentrancy_guard);
+ 
+ /**
+  * aio_bh_new: Allocate a new bottom half structure
+@@ -332,7 +336,17 @@ QEMUBH *aio_bh_new_full(AioContext *ctx, QEMUBHFunc *cb, void *opaque,
+  * string.
+  */
+ #define aio_bh_new(ctx, cb, opaque) \
+-    aio_bh_new_full((ctx), (cb), (opaque), (stringify(cb)))
++    aio_bh_new_full((ctx), (cb), (opaque), (stringify(cb)), NULL)
++
++/**
++ * aio_bh_new_guarded: Allocate a new bottom half structure with a
++ * reentrancy_guard
++ *
++ * A convenience wrapper for aio_bh_new_full() that uses the cb as the name
++ * string.
++ */
++#define aio_bh_new_guarded(ctx, cb, opaque, guard) \
++    aio_bh_new_full((ctx), (cb), (opaque), (stringify(cb)), guard)
+ 
+ /**
+  * aio_notify: Force processing of pending events.
+diff --git a/include/qemu/main-loop.h b/include/qemu/main-loop.h
+index 8dbc6fcb89..85dd5ada9e 100644
+--- a/include/qemu/main-loop.h
++++ b/include/qemu/main-loop.h
+@@ -294,9 +294,12 @@ void qemu_cond_timedwait_iothread(QemuCond *cond, int ms);
+ 
+ void qemu_fd_register(int fd);
+ 
++#define qemu_bh_new_guarded(cb, opaque, guard) \
++    qemu_bh_new_full((cb), (opaque), (stringify(cb)), guard)
+ #define qemu_bh_new(cb, opaque) \
+-    qemu_bh_new_full((cb), (opaque), (stringify(cb)))
+-QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name);
++    qemu_bh_new_full((cb), (opaque), (stringify(cb)), NULL)
++QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name,
++                         MemReentrancyGuard *reentrancy_guard);
+ void qemu_bh_schedule_idle(QEMUBH *bh);
+ 
+ enum {
+diff --git a/tests/unit/ptimer-test-stubs.c b/tests/unit/ptimer-test-stubs.c
+index 2a3ef58799..a7a2d08e7e 100644
+--- a/tests/unit/ptimer-test-stubs.c
++++ b/tests/unit/ptimer-test-stubs.c
+@@ -108,7 +108,8 @@ int64_t qemu_clock_deadline_ns_all(QEMUClockType type, int attr_mask)
+     return deadline;
+ }
+ 
+-QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name)
++QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name,
++                         MemReentrancyGuard *reentrancy_guard)
+ {
+     QEMUBH *bh = g_new(QEMUBH, 1);
+ 
+diff --git a/util/async.c b/util/async.c
+index 2a63bf90f2..1fff02e7fc 100644
+--- a/util/async.c
++++ b/util/async.c
+@@ -62,6 +62,7 @@ struct QEMUBH {
+     void *opaque;
+     QSLIST_ENTRY(QEMUBH) next;
+     unsigned flags;
++    MemReentrancyGuard *reentrancy_guard;
+ };
+ 
+ /* Called concurrently from any thread */
+@@ -127,7 +128,7 @@ void aio_bh_schedule_oneshot_full(AioContext *ctx, QEMUBHFunc *cb,
+ }
+ 
+ QEMUBH *aio_bh_new_full(AioContext *ctx, QEMUBHFunc *cb, void *opaque,
+-                        const char *name)
++                        const char *name, MemReentrancyGuard *reentrancy_guard)
+ {
+     QEMUBH *bh;
+     bh = g_new(QEMUBH, 1);
+@@ -136,13 +137,28 @@ QEMUBH *aio_bh_new_full(AioContext *ctx, QEMUBHFunc *cb, void *opaque,
+         .cb = cb,
+         .opaque = opaque,
+         .name = name,
++        .reentrancy_guard = reentrancy_guard,
+     };
+     return bh;
+ }
+ 
+ void aio_bh_call(QEMUBH *bh)
+ {
++    bool last_engaged_in_io = false;
++
++    if (bh->reentrancy_guard) {
++        last_engaged_in_io = bh->reentrancy_guard->engaged_in_io;
++        if (bh->reentrancy_guard->engaged_in_io) {
++            trace_reentrant_aio(bh->ctx, bh->name);
++        }
++        bh->reentrancy_guard->engaged_in_io = true;
++    }
++
+     bh->cb(bh->opaque);
++
++    if (bh->reentrancy_guard) {
++        bh->reentrancy_guard->engaged_in_io = last_engaged_in_io;
++    }
+ }
+ 
+ /* Multiple occurrences of aio_bh_poll cannot be called concurrently. */
+diff --git a/util/main-loop.c b/util/main-loop.c
+index 06b18b195c..1eacf04691 100644
+--- a/util/main-loop.c
++++ b/util/main-loop.c
+@@ -544,9 +544,11 @@ void main_loop_wait(int nonblocking)
+ 
+ /* Functions to operate on the main QEMU AioContext.  */
+ 
+-QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name)
++QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name,
++                         MemReentrancyGuard *reentrancy_guard)
+ {
+-    return aio_bh_new_full(qemu_aio_context, cb, opaque, name);
++    return aio_bh_new_full(qemu_aio_context, cb, opaque, name,
++                           reentrancy_guard);
+ }
+ 
+ /*
+diff --git a/util/trace-events b/util/trace-events
+index c8f53d7d9f..dc3b1eb3bf 100644
+--- a/util/trace-events
++++ b/util/trace-events
+@@ -11,6 +11,7 @@ poll_remove(void *ctx, void *node, int fd) "ctx %p node %p fd %d"
+ # async.c
+ aio_co_schedule(void *ctx, void *co) "ctx %p co %p"
+ aio_co_schedule_bh_cb(void *ctx, void *co) "ctx %p co %p"
++reentrant_aio(void *ctx, const char *name) "ctx %p name %s"
+ 
+ # thread-pool.c
+ thread_pool_submit(void *pool, void *req, void *opaque) "pool %p req %p opaque %p"
+-- 
+2.37.3
+

SOURCES/kvm-async-avoid-use-after-free-on-re-entrancy-guard.patch

@@ -0,0 +1,71 @@
+From d754050d260e2ad890cecd975df6e163c531b40e Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 9 May 2023 10:29:03 -0400
+Subject: [PATCH 09/15] async: avoid use-after-free on re-entrancy guard
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 277: memory: prevent dma-reentracy issues
+RH-Bugzilla: 1999236
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [9/12] d357650e581c3921bbfe3e2fde5e3f55853b5fab (redhat/rhel/src/qemu-kvm/jons-qemu-kvm-2)
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1999236
+Upstream: Merged
+CVE: CVE-2021-3750
+
+commit 7915bd06f25e1803778081161bf6fa10c42dc7cd
+Author: Alexander Bulekov <alxndr@bu.edu>
+Date:   Mon May 1 10:19:56 2023 -0400
+
+    async: avoid use-after-free on re-entrancy guard
+
+    A BH callback can free the BH, causing a use-after-free in aio_bh_call.
+    Fix that by keeping a local copy of the re-entrancy guard pointer.
+
+    Buglink: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58513
+    Fixes: 9c86c97f12 ("async: Add an optional reentrancy guard to the BH API")
+    Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
+    Message-Id: <20230501141956.3444868-1-alxndr@bu.edu>
+    Reviewed-by: Thomas Huth <thuth@redhat.com>
+    Signed-off-by: Thomas Huth <thuth@redhat.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ util/async.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/util/async.c b/util/async.c
+index 1fff02e7fc..ffe0541c3b 100644
+--- a/util/async.c
++++ b/util/async.c
+@@ -146,18 +146,20 @@ void aio_bh_call(QEMUBH *bh)
+ {
+     bool last_engaged_in_io = false;
+ 
+-    if (bh->reentrancy_guard) {
+-        last_engaged_in_io = bh->reentrancy_guard->engaged_in_io;
+-        if (bh->reentrancy_guard->engaged_in_io) {
++    /* Make a copy of the guard-pointer as cb may free the bh */
++    MemReentrancyGuard *reentrancy_guard = bh->reentrancy_guard;
++    if (reentrancy_guard) {
++        last_engaged_in_io = reentrancy_guard->engaged_in_io;
++        if (reentrancy_guard->engaged_in_io) {
+             trace_reentrant_aio(bh->ctx, bh->name);
+         }
+-        bh->reentrancy_guard->engaged_in_io = true;
++        reentrancy_guard->engaged_in_io = true;
+     }
+ 
+     bh->cb(bh->opaque);
+ 
+-    if (bh->reentrancy_guard) {
+-        bh->reentrancy_guard->engaged_in_io = last_engaged_in_io;
++    if (reentrancy_guard) {
++        reentrancy_guard->engaged_in_io = last_engaged_in_io;
+     }
+ }
+ 
+-- 
+2.37.3
+

SOURCES/kvm-async-clarify-usage-of-barriers-in-the-polling-case.patch

@@ -0,0 +1,66 @@
+From 187eb7a418af93375e42298d06e231e2bec3cf00 Mon Sep 17 00:00:00 2001
+From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+Date: Thu, 9 Mar 2023 08:15:42 -0500
+Subject: [PATCH 10/13] async: clarify usage of barriers in the polling case
+
+RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+RH-MergeRequest: 263: qatomic: add smp_mb__before/after_rmw()
+RH-Bugzilla: 2168472
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Eric Auger <eric.auger@redhat.com>
+RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+RH-Acked-by: David Hildenbrand <david@redhat.com>
+RH-Commit: [10/10] 3be07ccc6137a0336becfe63a818d9cbadb38e9c
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2168472
+
+commit 6229438cca037d42f44a96d38feb15cb102a444f
+Author: Paolo Bonzini <pbonzini@redhat.com>
+Date:   Mon Mar 6 10:43:52 2023 +0100
+
+    async: clarify usage of barriers in the polling case
+
+    Explain that aio_context_notifier_poll() relies on
+    aio_notify_accept() to catch all the memory writes that were
+    done before ctx->notified was set to true.
+
+    Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+    Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+
+Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+---
+ util/async.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/util/async.c b/util/async.c
+index 795fe699b6..2a63bf90f2 100644
+--- a/util/async.c
++++ b/util/async.c
+@@ -463,8 +463,9 @@ void aio_notify_accept(AioContext *ctx)
+     qatomic_set(&ctx->notified, false);
+ 
+     /*
+-     * Write ctx->notified before reading e.g. bh->flags.  Pairs with smp_wmb
+-     * in aio_notify.
++     * Order reads of ctx->notified (in aio_context_notifier_poll()) and the
++     * above clearing of ctx->notified before reads of e.g. bh->flags.  Pairs
++     * with smp_wmb() in aio_notify.
+      */
+     smp_mb();
+ }
+@@ -487,6 +488,11 @@ static bool aio_context_notifier_poll(void *opaque)
+     EventNotifier *e = opaque;
+     AioContext *ctx = container_of(e, AioContext, notifier);
+ 
++    /*
++     * No need for load-acquire because we just want to kick the
++     * event loop.  aio_notify_accept() takes care of synchronizing
++     * the event loop with the producers.
++     */
+     return qatomic_read(&ctx->notified);
+ }
+ 
+-- 
+2.37.3
+

SOURCES/kvm-async-update-documentation-of-the-memory-barriers.patch

@@ -0,0 +1,111 @@
+From ea3856bb545d19499602830cdc3076d83a981e7a Mon Sep 17 00:00:00 2001
+From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+Date: Thu, 9 Mar 2023 08:15:36 -0500
+Subject: [PATCH 09/13] async: update documentation of the memory barriers
+
+RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+RH-MergeRequest: 263: qatomic: add smp_mb__before/after_rmw()
+RH-Bugzilla: 2168472
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Eric Auger <eric.auger@redhat.com>
+RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+RH-Acked-by: David Hildenbrand <david@redhat.com>
+RH-Commit: [9/10] d471da2acf7a107cf75f3327c5e8d7456307160e
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2168472
+
+commit 8dd48650b43dfde4ebea34191ac267e474bcc29e
+Author: Paolo Bonzini <pbonzini@redhat.com>
+Date:   Mon Mar 6 10:15:06 2023 +0100
+
+    async: update documentation of the memory barriers
+
+    Ever since commit 8c6b0356b539 ("util/async: make bh_aio_poll() O(1)",
+    2020-02-22), synchronization between qemu_bh_schedule() and aio_bh_poll()
+    is happening when the bottom half is enqueued in the bh_list; not
+    when the flags are set.  Update the documentation to match.
+
+    Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+
+Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+---
+ util/async.c | 33 +++++++++++++++++++--------------
+ 1 file changed, 19 insertions(+), 14 deletions(-)
+
+diff --git a/util/async.c b/util/async.c
+index 6f6717a34b..795fe699b6 100644
+--- a/util/async.c
++++ b/util/async.c
+@@ -71,14 +71,21 @@ static void aio_bh_enqueue(QEMUBH *bh, unsigned new_flags)
+     unsigned old_flags;
+ 
+     /*
+-     * The memory barrier implicit in qatomic_fetch_or makes sure that:
+-     * 1. idle & any writes needed by the callback are done before the
+-     *    locations are read in the aio_bh_poll.
+-     * 2. ctx is loaded before the callback has a chance to execute and bh
+-     *    could be freed.
++     * Synchronizes with atomic_fetch_and() in aio_bh_dequeue(), ensuring that
++     * insertion starts after BH_PENDING is set.
+      */
+     old_flags = qatomic_fetch_or(&bh->flags, BH_PENDING | new_flags);
++
+     if (!(old_flags & BH_PENDING)) {
++        /*
++         * At this point the bottom half becomes visible to aio_bh_poll().
++         * This insertion thus synchronizes with QSLIST_MOVE_ATOMIC in
++         * aio_bh_poll(), ensuring that:
++         * 1. any writes needed by the callback are visible from the callback
++         *    after aio_bh_dequeue() returns bh.
++         * 2. ctx is loaded before the callback has a chance to execute and bh
++         *    could be freed.
++         */
+         QSLIST_INSERT_HEAD_ATOMIC(&ctx->bh_list, bh, next);
+     }
+ 
+@@ -97,11 +104,8 @@ static QEMUBH *aio_bh_dequeue(BHList *head, unsigned *flags)
+     QSLIST_REMOVE_HEAD(head, next);
+ 
+     /*
+-     * The qatomic_and is paired with aio_bh_enqueue().  The implicit memory
+-     * barrier ensures that the callback sees all writes done by the scheduling
+-     * thread.  It also ensures that the scheduling thread sees the cleared
+-     * flag before bh->cb has run, and thus will call aio_notify again if
+-     * necessary.
++     * Synchronizes with qatomic_fetch_or() in aio_bh_enqueue(), ensuring that
++     * the removal finishes before BH_PENDING is reset.
+      */
+     *flags = qatomic_fetch_and(&bh->flags,
+                               ~(BH_PENDING | BH_SCHEDULED | BH_IDLE));
+@@ -148,6 +152,7 @@ int aio_bh_poll(AioContext *ctx)
+     BHListSlice *s;
+     int ret = 0;
+ 
++    /* Synchronizes with QSLIST_INSERT_HEAD_ATOMIC in aio_bh_enqueue().  */
+     QSLIST_MOVE_ATOMIC(&slice.bh_list, &ctx->bh_list);
+     QSIMPLEQ_INSERT_TAIL(&ctx->bh_slice_list, &slice, next);
+ 
+@@ -437,15 +442,15 @@ LuringState *aio_get_linux_io_uring(AioContext *ctx)
+ void aio_notify(AioContext *ctx)
+ {
+     /*
+-     * Write e.g. bh->flags before writing ctx->notified.  Pairs with smp_mb in
+-     * aio_notify_accept.
++     * Write e.g. ctx->bh_list before writing ctx->notified.  Pairs with
++     * smp_mb() in aio_notify_accept().
+      */
+     smp_wmb();
+     qatomic_set(&ctx->notified, true);
+ 
+     /*
+-     * Write ctx->notified before reading ctx->notify_me.  Pairs
+-     * with smp_mb in aio_ctx_prepare or aio_poll.
++     * Write ctx->notified (and also ctx->bh_list) before reading ctx->notify_me.
++     * Pairs with smp_mb() in aio_ctx_prepare or aio_poll.
+      */
+     smp_mb();
+     if (qatomic_read(&ctx->notify_me)) {
+-- 
+2.37.3
+

SOURCES/kvm-async-use-explicit-memory-barriers.patch

@@ -1,183 +0,0 @@
-From 82a02aec3a8b3c2ac925d0b71ea4c35aa5d6463b Mon Sep 17 00:00:00 2001
-From: Andrew Jones <drjones@redhat.com>
-Date: Wed, 4 Aug 2021 03:27:24 -0400
-Subject: [PATCH 2/2] async: use explicit memory barriers
-
-RH-Author: Andrew Jones <drjones@redhat.com>
-Message-id: <20210729134448.4995-3-drjones@redhat.com>
-Patchwork-id: 101937
-O-Subject: [RHEL-8.5.0 qemu-kvm PATCH v2 2/2] async: use explicit memory barriers
-Bugzilla: 1969848
-RH-Acked-by: Gavin Shan <gshan@redhat.com>
-RH-Acked-by: Auger Eric <eric.auger@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-
-From: Paolo Bonzini <pbonzini@redhat.com>
-
-When using C11 atomics, non-seqcst reads and writes do not participate
-in the total order of seqcst operations.  In util/async.c and util/aio-posix.c,
-in particular, the pattern that we use
-
-          write ctx->notify_me                 write bh->scheduled
-          read bh->scheduled                   read ctx->notify_me
-          if !bh->scheduled, sleep             if ctx->notify_me, notify
-
-needs to use seqcst operations for both the write and the read.  In
-general this is something that we do not want, because there can be
-many sources that are polled in addition to bottom halves.  The
-alternative is to place a seqcst memory barrier between the write
-and the read.  This also comes with a disadvantage, in that the
-memory barrier is implicit on strongly-ordered architectures and
-it wastes a few dozen clock cycles.
-
-Fortunately, ctx->notify_me is never written concurrently by two
-threads, so we can assert that and relax the writes to ctx->notify_me.
-The resulting solution works and performs well on both aarch64 and x86.
-
-Note that the atomic_set/atomic_read combination is not an atomic
-read-modify-write, and therefore it is even weaker than C11 ATOMIC_RELAXED;
-on x86, ATOMIC_RELAXED compiles to a locked operation.
-
-Analyzed-by: Ying Fang <fangying1@huawei.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Tested-by: Ying Fang <fangying1@huawei.com>
-Message-Id: <20200407140746.8041-6-pbonzini@redhat.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit 5710a3e09f9b85801e5ce70797a4a511e5fc9e2c)
-Signed-off-by: Andrew Jones <drjones@redhat.com>
-Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
----
- util/aio-posix.c | 16 ++++++++++++++--
- util/aio-win32.c | 17 ++++++++++++++---
- util/async.c     | 16 ++++++++++++----
- 3 files changed, 40 insertions(+), 9 deletions(-)
-
-diff --git a/util/aio-posix.c b/util/aio-posix.c
-index abc396d030..8cfb25650d 100644
---- a/util/aio-posix.c
-+++ b/util/aio-posix.c
-@@ -624,6 +624,11 @@ bool aio_poll(AioContext *ctx, bool blocking)
-     int64_t timeout;
-     int64_t start = 0;
- 
-+    /*
-+     * There cannot be two concurrent aio_poll calls for the same AioContext (or
-+     * an aio_poll concurrent with a GSource prepare/check/dispatch callback).
-+     * We rely on this below to avoid slow locked accesses to ctx->notify_me.
-+     */
-     assert(in_aio_context_home_thread(ctx));
- 
-     /* aio_notify can avoid the expensive event_notifier_set if
-@@ -634,7 +639,13 @@ bool aio_poll(AioContext *ctx, bool blocking)
-      * so disable the optimization now.
-      */
-     if (blocking) {
--        atomic_add(&ctx->notify_me, 2);
-+        atomic_set(&ctx->notify_me, atomic_read(&ctx->notify_me) + 2);
-+        /*
-+         * Write ctx->notify_me before computing the timeout
-+         * (reading bottom half flags, etc.).  Pairs with
-+         * smp_mb in aio_notify().
-+         */
-+        smp_mb();
-     }
- 
-     qemu_lockcnt_inc(&ctx->list_lock);
-@@ -679,7 +690,8 @@ bool aio_poll(AioContext *ctx, bool blocking)
-     }
- 
-     if (blocking) {
--        atomic_sub(&ctx->notify_me, 2);
-+        /* Finish the poll before clearing the flag.  */
-+        atomic_store_release(&ctx->notify_me, atomic_read(&ctx->notify_me) - 2);
-         aio_notify_accept(ctx);
-     }
- 
-diff --git a/util/aio-win32.c b/util/aio-win32.c
-index a23b9c364d..729d533faf 100644
---- a/util/aio-win32.c
-+++ b/util/aio-win32.c
-@@ -321,6 +321,12 @@ bool aio_poll(AioContext *ctx, bool blocking)
-     int count;
-     int timeout;
- 
-+    /*
-+     * There cannot be two concurrent aio_poll calls for the same AioContext (or
-+     * an aio_poll concurrent with a GSource prepare/check/dispatch callback).
-+     * We rely on this below to avoid slow locked accesses to ctx->notify_me.
-+     */
-+    assert(in_aio_context_home_thread(ctx));
-     progress = false;
- 
-     /* aio_notify can avoid the expensive event_notifier_set if
-@@ -331,7 +337,13 @@ bool aio_poll(AioContext *ctx, bool blocking)
-      * so disable the optimization now.
-      */
-     if (blocking) {
--        atomic_add(&ctx->notify_me, 2);
-+        atomic_set(&ctx->notify_me, atomic_read(&ctx->notify_me) + 2);
-+        /*
-+         * Write ctx->notify_me before computing the timeout
-+         * (reading bottom half flags, etc.).  Pairs with
-+         * smp_mb in aio_notify().
-+         */
-+        smp_mb();
-     }
- 
-     qemu_lockcnt_inc(&ctx->list_lock);
-@@ -364,8 +376,7 @@ bool aio_poll(AioContext *ctx, bool blocking)
-         ret = WaitForMultipleObjects(count, events, FALSE, timeout);
-         if (blocking) {
-             assert(first);
--            assert(in_aio_context_home_thread(ctx));
--            atomic_sub(&ctx->notify_me, 2);
-+            atomic_store_release(&ctx->notify_me, atomic_read(&ctx->notify_me) - 2);
-             aio_notify_accept(ctx);
-         }
- 
-diff --git a/util/async.c b/util/async.c
-index b1fa5319e5..c65c58bbc9 100644
---- a/util/async.c
-+++ b/util/async.c
-@@ -220,7 +220,14 @@ aio_ctx_prepare(GSource *source, gint    *timeout)
- {
-     AioContext *ctx = (AioContext *) source;
- 
--    atomic_or(&ctx->notify_me, 1);
-+    atomic_set(&ctx->notify_me, atomic_read(&ctx->notify_me) | 1);
-+
-+    /*
-+     * Write ctx->notify_me before computing the timeout
-+     * (reading bottom half flags, etc.).  Pairs with
-+     * smp_mb in aio_notify().
-+     */
-+    smp_mb();
- 
-     /* We assume there is no timeout already supplied */
-     *timeout = qemu_timeout_ns_to_ms(aio_compute_timeout(ctx));
-@@ -238,7 +245,8 @@ aio_ctx_check(GSource *source)
-     AioContext *ctx = (AioContext *) source;
-     QEMUBH *bh;
- 
--    atomic_and(&ctx->notify_me, ~1);
-+    /* Finish computing the timeout before clearing the flag.  */
-+    atomic_store_release(&ctx->notify_me, atomic_read(&ctx->notify_me) & ~1);
-     aio_notify_accept(ctx);
- 
-     for (bh = ctx->first_bh; bh; bh = bh->next) {
-@@ -343,10 +351,10 @@ LinuxAioState *aio_get_linux_aio(AioContext *ctx)
- void aio_notify(AioContext *ctx)
- {
-     /* Write e.g. bh->scheduled before reading ctx->notify_me.  Pairs
--     * with atomic_or in aio_ctx_prepare or atomic_add in aio_poll.
-+     * with smp_mb in aio_ctx_prepare or aio_poll.
-      */
-     smp_mb();
--    if (ctx->notify_me) {
-+    if (atomic_read(&ctx->notify_me)) {
-         event_notifier_set(&ctx->notifier);
-         atomic_mb_set(&ctx->notified, true);
-     }
--- 
-2.27.0
-

SOURCES/kvm-audio-audio_generic_get_buffer_in-should-honor-size.patch

@@ -1,53 +0,0 @@
-From 96c8fcafa7325cd0e8a23a743a55f0ad0aa9f79b Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Thu, 18 Mar 2021 09:13:42 -0400
-Subject: [PATCH 5/5] audio: audio_generic_get_buffer_in should honor *size
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Gerd Hoffmann <kraxel@redhat.com>
-Message-id: <20210318091342.3232471-2-kraxel@redhat.com>
-Patchwork-id: 101352
-O-Subject: [RHEL-8.4.0 qemu-kvm PATCH 1/1] audio: audio_generic_get_buffer_in should honor *size
-Bugzilla: 1932823
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Acked-by: Danilo de Paula <ddepaula@redhat.com>
-RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-
-From: Volker Rümelin <vr_qemu@t-online.de>
-
-The function generic_get_buffer_in currently ignores the *size
-parameter and may return a buffer larger than *size.
-
-As a result the variable samples in function
-audio_pcm_hw_run_in may underflow. The while loop then most
-likely will never termiate.
-
-Buglink: http://bugs.debian.org/948658
-Signed-off-by: Volker Rümelin <vr_qemu@t-online.de>
-Message-Id: <20200123074943.6699-9-vr_qemu@t-online.de>
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
-(cherry picked from commit 599eac4e5a41e828645594097daee39373acc3c0)
-Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
----
- audio/audio.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/audio/audio.c b/audio/audio.c
-index 56fae55047..39a62fc62a 100644
---- a/audio/audio.c
-+++ b/audio/audio.c
-@@ -1402,7 +1402,8 @@ void *audio_generic_get_buffer_in(HWVoiceIn *hw, size_t *size)
-     }
-     assert(start >= 0 && start < hw->size_emul);
- 
--    *size = MIN(hw->pending_emul, hw->size_emul - start);
-+    *size = MIN(*size, hw->pending_emul);
-+    *size = MIN(*size, hw->size_emul - start);
-     return hw->buf_emul + start;
- }
- 
--- 
-2.27.0
-

SOURCES/kvm-backends-hostmem-Fix-support-of-memory-backend-memfd.patch

@@ -0,0 +1,71 @@
+From 60da56e3685969493ae483c3cc2c66af13d00baf Mon Sep 17 00:00:00 2001
+From: Thomas Huth <thuth@redhat.com>
+Date: Wed, 10 Aug 2022 14:57:18 +0200
+Subject: [PATCH 1/3] backends/hostmem: Fix support of memory-backend-memfd in
+ qemu_maxrampagesize()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Cédric Le Goater <None>
+RH-MergeRequest: 221: backends/hostmem: Fix support of memory-backend-memfd in qemu_maxrampagesize()
+RH-Bugzilla: 2117149
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: David Hildenbrand <david@redhat.com>
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Commit: [1/1] b5a1047750af32c0a261b8385ea0e819eb16681a
+
+It is currently not possible yet to use "memory-backend-memfd" on s390x
+with hugepages enabled. This problem is caused by qemu_maxrampagesize()
+not taking memory-backend-memfd objects into account yet, so the code
+in s390_memory_init() fails to enable the huge page support there via
+s390_set_max_pagesize(). Fix it by generalizing the code, so that it
+looks at qemu_ram_pagesize(memdev->mr.ram_block) instead of re-trying
+to get the information from the filesystem.
+
+Suggested-by: David Hildenbrand <david@redhat.com>
+Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2116496
+Message-Id: <20220810125720.3849835-2-thuth@redhat.com>
+Reviewed-by: David Hildenbrand <david@redhat.com>
+Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+(cherry picked from commit 8be934b70e923104da883b990dee18f02552d40e)
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2117149
+[clg: Resolved conflict on qemu_real_host_page_size() ]
+Signed-off-by: Cédric Le Goater <clg@redhat.com>
+---
+ backends/hostmem.c | 14 ++------------
+ 1 file changed, 2 insertions(+), 12 deletions(-)
+
+diff --git a/backends/hostmem.c b/backends/hostmem.c
+index 4c05862ed5..0c4654ea85 100644
+--- a/backends/hostmem.c
++++ b/backends/hostmem.c
+@@ -305,22 +305,12 @@ bool host_memory_backend_is_mapped(HostMemoryBackend *backend)
+     return backend->is_mapped;
+ }
+ 
+-#ifdef __linux__
+ size_t host_memory_backend_pagesize(HostMemoryBackend *memdev)
+ {
+-    Object *obj = OBJECT(memdev);
+-    char *path = object_property_get_str(obj, "mem-path", NULL);
+-    size_t pagesize = qemu_mempath_getpagesize(path);
+-
+-    g_free(path);
++    size_t pagesize = qemu_ram_pagesize(memdev->mr.ram_block);
++    g_assert(pagesize >= qemu_real_host_page_size);
+     return pagesize;
+ }
+-#else
+-size_t host_memory_backend_pagesize(HostMemoryBackend *memdev)
+-{
+-    return qemu_real_host_page_size;
+-}
+-#endif
+ 
+ static void
+ host_memory_backend_memory_complete(UserCreatable *uc, Error **errp)
+-- 
+2.35.3
+

SOURCES/kvm-backup-Improve-error-for-bdrv_getlength-failure.patch

@@ -1,51 +0,0 @@
-From fba183faf8ce819262a1a47f8531ea68051cdce7 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Wed, 3 Jun 2020 16:03:19 +0100
-Subject: [PATCH 20/26] backup: Improve error for bdrv_getlength() failure
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-Message-id: <20200603160325.67506-6-kwolf@redhat.com>
-Patchwork-id: 97103
-O-Subject: [RHEL-AV-8.2.1 qemu-kvm PATCH v2 05/11] backup: Improve error for bdrv_getlength() failure
-Bugzilla: 1778593
-RH-Acked-by: Eric Blake <eblake@redhat.com>
-RH-Acked-by: Max Reitz <mreitz@redhat.com>
-RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
-
-bdrv_get_device_name() will be an empty string with modern management
-tools that don't use -drive. Use bdrv_get_device_or_node_name() instead
-so that the node name is used if the BlockBackend is anonymous.
-
-While at it, start with upper case to make the message consistent with
-the rest of the function.
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Reviewed-by: Alberto Garcia <berto@igalia.com>
-Message-Id: <20200430142755.315494-3-kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 58226634c4b02af7b10862f7fbd3610a344bfb7f)
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
----
- block/backup.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/block/backup.c b/block/backup.c
-index ec50946..7c6ddd2 100644
---- a/block/backup.c
-+++ b/block/backup.c
-@@ -408,8 +408,8 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
- 
-     len = bdrv_getlength(bs);
-     if (len < 0) {
--        error_setg_errno(errp, -len, "unable to get length for '%s'",
--                         bdrv_get_device_name(bs));
-+        error_setg_errno(errp, -len, "Unable to get length for '%s'",
-+                         bdrv_get_device_or_node_name(bs));
-         goto error;
-     }
- 
--- 
-1.8.3.1
-

SOURCES/kvm-backup-Make-sure-that-source-and-target-size-match.patch

@@ -1,124 +0,0 @@
-From e56abd782be8bb41bb07c0317d008f95ec9a8ee5 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Wed, 3 Jun 2020 16:03:20 +0100
-Subject: [PATCH 21/26] backup: Make sure that source and target size match
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-Message-id: <20200603160325.67506-7-kwolf@redhat.com>
-Patchwork-id: 97107
-O-Subject: [RHEL-AV-8.2.1 qemu-kvm PATCH v2 06/11] backup: Make sure that source and target size match
-Bugzilla: 1778593
-RH-Acked-by: Eric Blake <eblake@redhat.com>
-RH-Acked-by: Max Reitz <mreitz@redhat.com>
-RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
-
-Since the introduction of a backup filter node in commit 00e30f05d, the
-backup block job crashes when the target image is smaller than the
-source image because it will try to write after the end of the target
-node without having BLK_PERM_RESIZE. (Previously, the BlockBackend layer
-would have caught this and errored out gracefully.)
-
-We can fix this and even do better than the old behaviour: Check that
-source and target have the same image size at the start of the block job
-and unshare BLK_PERM_RESIZE. (This permission was already unshared
-before the same commit 00e30f05d, but the BlockBackend that was used to
-make the restriction was removed without a replacement.) This will
-immediately error out when starting the job instead of only when writing
-to a block that doesn't exist in the target.
-
-Longer target than source would technically work because we would never
-write to blocks that don't exist, but semantically these are invalid,
-too, because a backup is supposed to create a copy, not just an image
-that starts with a copy.
-
-Fixes: 00e30f05de1d19586345ec373970ef4c192c6270
-Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1778593
-Cc: qemu-stable@nongnu.org
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Message-Id: <20200430142755.315494-4-kwolf@redhat.com>
-Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 958a04bd32af18d9a207bcc78046e56a202aebc2)
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
----
- block/backup-top.c | 14 +++++++++-----
- block/backup.c     | 14 +++++++++++++-
- 2 files changed, 22 insertions(+), 6 deletions(-)
-
-diff --git a/block/backup-top.c b/block/backup-top.c
-index b8d863f..6756091 100644
---- a/block/backup-top.c
-+++ b/block/backup-top.c
-@@ -143,8 +143,10 @@ static void backup_top_child_perm(BlockDriverState *bs, BdrvChild *c,
-          *
-          * Share write to target (child_file), to not interfere
-          * with guest writes to its disk which may be in target backing chain.
-+         * Can't resize during a backup block job because we check the size
-+         * only upfront.
-          */
--        *nshared = BLK_PERM_ALL;
-+        *nshared = BLK_PERM_ALL & ~BLK_PERM_RESIZE;
-         *nperm = BLK_PERM_WRITE;
-     } else {
-         /* Source child */
-@@ -154,7 +156,7 @@ static void backup_top_child_perm(BlockDriverState *bs, BdrvChild *c,
-         if (perm & BLK_PERM_WRITE) {
-             *nperm = *nperm | BLK_PERM_CONSISTENT_READ;
-         }
--        *nshared &= ~BLK_PERM_WRITE;
-+        *nshared &= ~(BLK_PERM_WRITE | BLK_PERM_RESIZE);
-     }
- }
- 
-@@ -187,10 +189,12 @@ BlockDriverState *bdrv_backup_top_append(BlockDriverState *source,
- {
-     Error *local_err = NULL;
-     BDRVBackupTopState *state;
--    BlockDriverState *top = bdrv_new_open_driver(&bdrv_backup_top_filter,
--                                                 filter_node_name,
--                                                 BDRV_O_RDWR, errp);
-+    BlockDriverState *top;
-+
-+    assert(source->total_sectors == target->total_sectors);
- 
-+    top = bdrv_new_open_driver(&bdrv_backup_top_filter, filter_node_name,
-+                               BDRV_O_RDWR, errp);
-     if (!top) {
-         return NULL;
-     }
-diff --git a/block/backup.c b/block/backup.c
-index 7c6ddd2..821c9fb 100644
---- a/block/backup.c
-+++ b/block/backup.c
-@@ -348,7 +348,7 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
-                   BlockCompletionFunc *cb, void *opaque,
-                   JobTxn *txn, Error **errp)
- {
--    int64_t len;
-+    int64_t len, target_len;
-     BackupBlockJob *job = NULL;
-     int64_t cluster_size;
-     BdrvRequestFlags write_flags;
-@@ -413,6 +413,18 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
-         goto error;
-     }
- 
-+    target_len = bdrv_getlength(target);
-+    if (target_len < 0) {
-+        error_setg_errno(errp, -target_len, "Unable to get length for '%s'",
-+                         bdrv_get_device_or_node_name(bs));
-+        goto error;
-+    }
-+
-+    if (target_len != len) {
-+        error_setg(errp, "Source and target image have different sizes");
-+        goto error;
-+    }
-+
-     cluster_size = backup_calculate_cluster_size(target, errp);
-     if (cluster_size < 0) {
-         goto error;
--- 
-1.8.3.1
-

SOURCES/kvm-backup-don-t-acquire-aio_context-in-backup_clean.patch

@@ -1,57 +0,0 @@
-From 619b3aac9790a7ca7c01846144395a318a9ab250 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Wed, 8 Apr 2020 17:29:14 +0100
-Subject: [PATCH 3/6] backup: don't acquire aio_context in backup_clean
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-Message-id: <20200408172917.18712-4-kwolf@redhat.com>
-Patchwork-id: 94596
-O-Subject: [RHEL-AV-8.2.0 qemu-kvm PATCH 3/6] backup: don't acquire aio_context in backup_clean
-Bugzilla: 1817621
-RH-Acked-by: Eric Blake <eblake@redhat.com>
-RH-Acked-by: Danilo de Paula <ddepaula@redhat.com>
-RH-Acked-by: Max Reitz <mreitz@redhat.com>
-
-From: Stefan Reiter <s.reiter@proxmox.com>
-
-All code-paths leading to backup_clean (via job_clean) have the job's
-context already acquired. The job's context is guaranteed to be the same
-as the one used by backup_top via backup_job_create.
-
-Since the previous logic effectively acquired the lock twice, this
-broke cleanup of backups for disks using IO threads, since the BDRV_POLL_WHILE
-in bdrv_backup_top_drop -> bdrv_do_drained_begin would only release the lock
-once, thus deadlocking with the IO thread.
-
-This is a partial revert of 0abf2581717a19.
-
-Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
-Reviewed-by: Max Reitz <mreitz@redhat.com>
-Message-Id: <20200407115651.69472-4-s.reiter@proxmox.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit eca0f3524a4eb57d03a56b0cbcef5527a0981ce4)
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
----
- block/backup.c | 4 ----
- 1 file changed, 4 deletions(-)
-
-diff --git a/block/backup.c b/block/backup.c
-index 1383e21..ec50946 100644
---- a/block/backup.c
-+++ b/block/backup.c
-@@ -135,11 +135,7 @@ static void backup_abort(Job *job)
- static void backup_clean(Job *job)
- {
-     BackupBlockJob *s = container_of(job, BackupBlockJob, common.job);
--    AioContext *aio_context = bdrv_get_aio_context(s->backup_top);
--
--    aio_context_acquire(aio_context);
-     bdrv_backup_top_drop(s->backup_top);
--    aio_context_release(aio_context);
- }
- 
- void backup_do_checkpoint(BlockJob *job, Error **errp)
--- 
-1.8.3.1
-

SOURCES/kvm-backup-top-Begin-drain-earlier.patch

@@ -1,56 +0,0 @@
-From bc78ee07bf400cbff0021367e05d308870471710 Mon Sep 17 00:00:00 2001
-From: Sergio Lopez Pascual <slp@redhat.com>
-Date: Fri, 7 Feb 2020 11:27:45 +0000
-Subject: [PATCH 12/18] backup-top: Begin drain earlier
-
-RH-Author: Sergio Lopez Pascual <slp@redhat.com>
-Message-id: <20200207112749.25073-6-slp@redhat.com>
-Patchwork-id: 93757
-O-Subject: [RHEL-AV-8.2.0 qemu-kvm PATCH v2 5/9] backup-top: Begin drain earlier
-Bugzilla: 1745606 1746217 1773517 1779036 1782111 1782175 1783965
-RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
-RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
-RH-Acked-by: Max Reitz <mreitz@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-
-From: Max Reitz <mreitz@redhat.com>
-
-When dropping backup-top, we need to drain the node before freeing the
-BlockCopyState.  Otherwise, requests may still be in flight and then the
-assertion in shres_destroy() will fail.
-
-(This becomes visible in intermittent failure of 056.)
-
-Cc: qemu-stable@nongnu.org
-Signed-off-by: Max Reitz <mreitz@redhat.com>
-Message-id: 20191219182638.104621-1-mreitz@redhat.com
-Signed-off-by: Max Reitz <mreitz@redhat.com>
-(cherry picked from commit 503ca1262bab2c11c533a4816d1ff4297d4f58a6)
-Signed-off-by: Sergio Lopez <slp@redhat.com>
-Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
----
- block/backup-top.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/block/backup-top.c b/block/backup-top.c
-index 7cdb1f8..818d3f2 100644
---- a/block/backup-top.c
-+++ b/block/backup-top.c
-@@ -257,12 +257,12 @@ void bdrv_backup_top_drop(BlockDriverState *bs)
-     BDRVBackupTopState *s = bs->opaque;
-     AioContext *aio_context = bdrv_get_aio_context(bs);
- 
--    block_copy_state_free(s->bcs);
--
-     aio_context_acquire(aio_context);
- 
-     bdrv_drained_begin(bs);
- 
-+    block_copy_state_free(s->bcs);
-+
-     s->active = false;
-     bdrv_child_refresh_perms(bs, bs->backing, &error_abort);
-     bdrv_replace_node(bs, backing_bs(bs), &error_abort);
--- 
-1.8.3.1
-

SOURCES/kvm-bcm2835_property-disable-reentrancy-detection-for-io.patch

@@ -0,0 +1,58 @@
+From 7715635d018351e0a5c4c25aec2c71a2fe3b9e69 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 9 May 2023 10:29:03 -0400
+Subject: [PATCH 06/15] bcm2835_property: disable reentrancy detection for
+ iomem
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 277: memory: prevent dma-reentracy issues
+RH-Bugzilla: 1999236
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [6/12] 4d6187430ca1c4309a36824c0c6815d2a763db1a (redhat/rhel/src/qemu-kvm/jons-qemu-kvm-2)
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1999236
+Upstream: Merged
+CVE: CVE-2021-3750
+
+commit 985c4a4e547afb9573b6bd6843d20eb2c3d1d1cd
+Author: Alexander Bulekov <alxndr@bu.edu>
+Date:   Thu Apr 27 17:10:11 2023 -0400
+
+    bcm2835_property: disable reentrancy detection for iomem
+
+    As the code is designed for re-entrant calls from bcm2835_property to
+    bcm2835_mbox and back into bcm2835_property, mark iomem as
+    reentrancy-safe.
+
+    Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
+    Reviewed-by: Thomas Huth <thuth@redhat.com>
+    Message-Id: <20230427211013.2994127-7-alxndr@bu.edu>
+    Signed-off-by: Thomas Huth <thuth@redhat.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ hw/misc/bcm2835_property.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/hw/misc/bcm2835_property.c b/hw/misc/bcm2835_property.c
+index 73941bdae9..022b5a849c 100644
+--- a/hw/misc/bcm2835_property.c
++++ b/hw/misc/bcm2835_property.c
+@@ -377,6 +377,13 @@ static void bcm2835_property_init(Object *obj)
+ 
+     memory_region_init_io(&s->iomem, OBJECT(s), &bcm2835_property_ops, s,
+                           TYPE_BCM2835_PROPERTY, 0x10);
++
++    /*
++     * bcm2835_property_ops call into bcm2835_mbox, which in-turn reads from
++     * iomem. As such, mark iomem as re-entracy safe.
++     */
++    s->iomem.disable_reentrancy_guard = true;
++
+     sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
+     sysbus_init_irq(SYS_BUS_DEVICE(s), &s->mbox_irq);
+ }
+-- 
+2.37.3
+

SOURCES/kvm-block-Activate-recursively-even-for-already-active-n.patch

@@ -1,116 +0,0 @@
-From 0ef6691ce8964bb2bbd677756c4e594793ca3ad8 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Fri, 7 Feb 2020 11:24:01 +0000
-Subject: [PATCH 04/18] block: Activate recursively even for already active
- nodes
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-Message-id: <20200207112404.25198-4-kwolf@redhat.com>
-Patchwork-id: 93749
-O-Subject: [RHEL-AV-8.2.0 qemu-kvm PATCH v2 3/6] block: Activate recursively even for already active nodes
-Bugzilla: 1781637
-RH-Acked-by: Sergio Lopez Pascual <slp@redhat.com>
-RH-Acked-by: Max Reitz <mreitz@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-
-bdrv_invalidate_cache_all() assumes that all nodes in a given subtree
-are either active or inactive when it starts. Therefore, as soon as it
-arrives at an already active node, it stops.
-
-However, this assumption is wrong. For example, it's possible to take a
-snapshot of an inactive node, which results in an active overlay over an
-inactive backing file. The active overlay is probably also the root node
-of an inactive BlockBackend (blk->disable_perm == true).
-
-In this case, bdrv_invalidate_cache_all() does not need to do anything
-to activate the overlay node, but it still needs to recurse into the
-children and the parents to make sure that after returning success,
-really everything is activated.
-
-Cc: qemu-stable@nongnu.org
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Reviewed-by: Max Reitz <mreitz@redhat.com>
-(cherry picked from commit 7bb4941ace471fc7dd6ded4749b95b9622baa6ed)
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
----
- block.c | 50 ++++++++++++++++++++++++--------------------------
- 1 file changed, 24 insertions(+), 26 deletions(-)
-
-diff --git a/block.c b/block.c
-index 473eb6e..2e5e8b6 100644
---- a/block.c
-+++ b/block.c
-@@ -5335,10 +5335,6 @@ static void coroutine_fn bdrv_co_invalidate_cache(BlockDriverState *bs,
-         return;
-     }
- 
--    if (!(bs->open_flags & BDRV_O_INACTIVE)) {
--        return;
--    }
--
-     QLIST_FOREACH(child, &bs->children, next) {
-         bdrv_co_invalidate_cache(child->bs, &local_err);
-         if (local_err) {
-@@ -5360,34 +5356,36 @@ static void coroutine_fn bdrv_co_invalidate_cache(BlockDriverState *bs,
-      * just keep the extended permissions for the next time that an activation
-      * of the image is tried.
-      */
--    bs->open_flags &= ~BDRV_O_INACTIVE;
--    bdrv_get_cumulative_perm(bs, &perm, &shared_perm);
--    ret = bdrv_check_perm(bs, NULL, perm, shared_perm, NULL, NULL, &local_err);
--    if (ret < 0) {
--        bs->open_flags |= BDRV_O_INACTIVE;
--        error_propagate(errp, local_err);
--        return;
--    }
--    bdrv_set_perm(bs, perm, shared_perm);
--
--    if (bs->drv->bdrv_co_invalidate_cache) {
--        bs->drv->bdrv_co_invalidate_cache(bs, &local_err);
--        if (local_err) {
-+    if (bs->open_flags & BDRV_O_INACTIVE) {
-+        bs->open_flags &= ~BDRV_O_INACTIVE;
-+        bdrv_get_cumulative_perm(bs, &perm, &shared_perm);
-+        ret = bdrv_check_perm(bs, NULL, perm, shared_perm, NULL, NULL, &local_err);
-+        if (ret < 0) {
-             bs->open_flags |= BDRV_O_INACTIVE;
-             error_propagate(errp, local_err);
-             return;
-         }
--    }
-+        bdrv_set_perm(bs, perm, shared_perm);
- 
--    FOR_EACH_DIRTY_BITMAP(bs, bm) {
--        bdrv_dirty_bitmap_skip_store(bm, false);
--    }
-+        if (bs->drv->bdrv_co_invalidate_cache) {
-+            bs->drv->bdrv_co_invalidate_cache(bs, &local_err);
-+            if (local_err) {
-+                bs->open_flags |= BDRV_O_INACTIVE;
-+                error_propagate(errp, local_err);
-+                return;
-+            }
-+        }
- 
--    ret = refresh_total_sectors(bs, bs->total_sectors);
--    if (ret < 0) {
--        bs->open_flags |= BDRV_O_INACTIVE;
--        error_setg_errno(errp, -ret, "Could not refresh total sector count");
--        return;
-+        FOR_EACH_DIRTY_BITMAP(bs, bm) {
-+            bdrv_dirty_bitmap_skip_store(bm, false);
-+        }
-+
-+        ret = refresh_total_sectors(bs, bs->total_sectors);
-+        if (ret < 0) {
-+            bs->open_flags |= BDRV_O_INACTIVE;
-+            error_setg_errno(errp, -ret, "Could not refresh total sector count");
-+            return;
-+        }
-     }
- 
-     QLIST_FOREACH(parent, &bs->parents, next_parent) {
--- 
-1.8.3.1
-

SOURCES/kvm-block-Add-flags-to-BlockDriver.bdrv_co_truncate.patch

@@ -1,283 +0,0 @@
-From 13e2076f5c4adbc9a3f96c8978150aa5e423e14a Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Mon, 8 Jun 2020 15:01:30 +0100
-Subject: [PATCH 02/17] block: Add flags to BlockDriver.bdrv_co_truncate()
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-Message-id: <20200608150140.38218-2-kwolf@redhat.com>
-Patchwork-id: 97448
-O-Subject: [RHEL-AV-8.2.1 qemu-kvm PATCH 01/11] block: Add flags to BlockDriver.bdrv_co_truncate()
-Bugzilla: 1780574
-RH-Acked-by: Sergio Lopez Pascual <slp@redhat.com>
-RH-Acked-by: Eric Blake <eblake@redhat.com>
-RH-Acked-by: Max Reitz <mreitz@redhat.com>
-
-This adds a new BdrvRequestFlags parameter to the .bdrv_co_truncate()
-driver callbacks, and a supported_truncate_flags field in
-BlockDriverState that allows drivers to advertise support for request
-flags in the context of truncate.
-
-For now, we always pass 0 and no drivers declare support for any flag.
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Reviewed-by: Alberto Garcia <berto@igalia.com>
-Reviewed-by: Max Reitz <mreitz@redhat.com>
-Message-Id: <20200424125448.63318-2-kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 92b92799dc8662b6f71809100a4aabc1ae408ebb)
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
----
- block/crypto.c              |  3 ++-
- block/file-posix.c          |  2 +-
- block/file-win32.c          |  2 +-
- block/gluster.c             |  1 +
- block/io.c                  |  8 +++++++-
- block/iscsi.c               |  2 +-
- block/nfs.c                 |  3 ++-
- block/qcow2.c               |  2 +-
- block/qed.c                 |  1 +
- block/raw-format.c          |  2 +-
- block/rbd.c                 |  1 +
- block/sheepdog.c            |  4 ++--
- block/ssh.c                 |  2 +-
- include/block/block_int.h   | 10 +++++++++-
- tests/test-block-iothread.c |  3 ++-
- 15 files changed, 33 insertions(+), 13 deletions(-)
-
-diff --git a/block/crypto.c b/block/crypto.c
-index 5e3b15c..6e4b726 100644
---- a/block/crypto.c
-+++ b/block/crypto.c
-@@ -299,7 +299,8 @@ static int block_crypto_co_create_generic(BlockDriverState *bs,
- 
- static int coroutine_fn
- block_crypto_co_truncate(BlockDriverState *bs, int64_t offset, bool exact,
--                         PreallocMode prealloc, Error **errp)
-+                         PreallocMode prealloc, BdrvRequestFlags flags,
-+                         Error **errp)
- {
-     BlockCrypto *crypto = bs->opaque;
-     uint64_t payload_offset =
-diff --git a/block/file-posix.c b/block/file-posix.c
-index 1609598..7551e8d 100644
---- a/block/file-posix.c
-+++ b/block/file-posix.c
-@@ -2021,7 +2021,7 @@ raw_regular_truncate(BlockDriverState *bs, int fd, int64_t offset,
- 
- static int coroutine_fn raw_co_truncate(BlockDriverState *bs, int64_t offset,
-                                         bool exact, PreallocMode prealloc,
--                                        Error **errp)
-+                                        BdrvRequestFlags flags, Error **errp)
- {
-     BDRVRawState *s = bs->opaque;
-     struct stat st;
-diff --git a/block/file-win32.c b/block/file-win32.c
-index 1585983..a6b0dda 100644
---- a/block/file-win32.c
-+++ b/block/file-win32.c
-@@ -469,7 +469,7 @@ static void raw_close(BlockDriverState *bs)
- 
- static int coroutine_fn raw_co_truncate(BlockDriverState *bs, int64_t offset,
-                                         bool exact, PreallocMode prealloc,
--                                        Error **errp)
-+                                        BdrvRequestFlags flags, Error **errp)
- {
-     BDRVRawState *s = bs->opaque;
-     LONG low, high;
-diff --git a/block/gluster.c b/block/gluster.c
-index 0aa1f2c..d06df90 100644
---- a/block/gluster.c
-+++ b/block/gluster.c
-@@ -1228,6 +1228,7 @@ static coroutine_fn int qemu_gluster_co_truncate(BlockDriverState *bs,
-                                                  int64_t offset,
-                                                  bool exact,
-                                                  PreallocMode prealloc,
-+                                                 BdrvRequestFlags flags,
-                                                  Error **errp)
- {
-     BDRVGlusterState *s = bs->opaque;
-diff --git a/block/io.c b/block/io.c
-index f75777f..549e5a4 100644
---- a/block/io.c
-+++ b/block/io.c
-@@ -3320,6 +3320,7 @@ int coroutine_fn bdrv_co_truncate(BdrvChild *child, int64_t offset, bool exact,
-     BlockDriverState *bs = child->bs;
-     BlockDriver *drv = bs->drv;
-     BdrvTrackedRequest req;
-+    BdrvRequestFlags flags = 0;
-     int64_t old_size, new_bytes;
-     int ret;
- 
-@@ -3370,7 +3371,12 @@ int coroutine_fn bdrv_co_truncate(BdrvChild *child, int64_t offset, bool exact,
-     }
- 
-     if (drv->bdrv_co_truncate) {
--        ret = drv->bdrv_co_truncate(bs, offset, exact, prealloc, errp);
-+        if (flags & ~bs->supported_truncate_flags) {
-+            error_setg(errp, "Block driver does not support requested flags");
-+            ret = -ENOTSUP;
-+            goto out;
-+        }
-+        ret = drv->bdrv_co_truncate(bs, offset, exact, prealloc, flags, errp);
-     } else if (bs->file && drv->is_filter) {
-         ret = bdrv_co_truncate(bs->file, offset, exact, prealloc, errp);
-     } else {
-diff --git a/block/iscsi.c b/block/iscsi.c
-index 16b0716..0bea2d3 100644
---- a/block/iscsi.c
-+++ b/block/iscsi.c
-@@ -2125,7 +2125,7 @@ static void iscsi_reopen_commit(BDRVReopenState *reopen_state)
- 
- static int coroutine_fn iscsi_co_truncate(BlockDriverState *bs, int64_t offset,
-                                           bool exact, PreallocMode prealloc,
--                                          Error **errp)
-+                                          BdrvRequestFlags flags, Error **errp)
- {
-     IscsiLun *iscsilun = bs->opaque;
-     int64_t cur_length;
-diff --git a/block/nfs.c b/block/nfs.c
-index cc2413d..2393fbf 100644
---- a/block/nfs.c
-+++ b/block/nfs.c
-@@ -755,7 +755,8 @@ static int64_t nfs_get_allocated_file_size(BlockDriverState *bs)
- 
- static int coroutine_fn
- nfs_file_co_truncate(BlockDriverState *bs, int64_t offset, bool exact,
--                     PreallocMode prealloc, Error **errp)
-+                     PreallocMode prealloc, BdrvRequestFlags flags,
-+                     Error **errp)
- {
-     NFSClient *client = bs->opaque;
-     int ret;
-diff --git a/block/qcow2.c b/block/qcow2.c
-index dbd870a..977445e 100644
---- a/block/qcow2.c
-+++ b/block/qcow2.c
-@@ -3948,7 +3948,7 @@ fail:
- 
- static int coroutine_fn qcow2_co_truncate(BlockDriverState *bs, int64_t offset,
-                                           bool exact, PreallocMode prealloc,
--                                          Error **errp)
-+                                          BdrvRequestFlags flags, Error **errp)
- {
-     BDRVQcow2State *s = bs->opaque;
-     uint64_t old_length;
-diff --git a/block/qed.c b/block/qed.c
-index 1af9b3c..fb6100b 100644
---- a/block/qed.c
-+++ b/block/qed.c
-@@ -1467,6 +1467,7 @@ static int coroutine_fn bdrv_qed_co_truncate(BlockDriverState *bs,
-                                              int64_t offset,
-                                              bool exact,
-                                              PreallocMode prealloc,
-+                                             BdrvRequestFlags flags,
-                                              Error **errp)
- {
-     BDRVQEDState *s = bs->opaque;
-diff --git a/block/raw-format.c b/block/raw-format.c
-index 4bb54f4..f994c4a 100644
---- a/block/raw-format.c
-+++ b/block/raw-format.c
-@@ -371,7 +371,7 @@ static void raw_refresh_limits(BlockDriverState *bs, Error **errp)
- 
- static int coroutine_fn raw_co_truncate(BlockDriverState *bs, int64_t offset,
-                                         bool exact, PreallocMode prealloc,
--                                        Error **errp)
-+                                        BdrvRequestFlags flags, Error **errp)
- {
-     BDRVRawState *s = bs->opaque;
- 
-diff --git a/block/rbd.c b/block/rbd.c
-index 8847259..fcdb60a 100644
---- a/block/rbd.c
-+++ b/block/rbd.c
-@@ -1090,6 +1090,7 @@ static int coroutine_fn qemu_rbd_co_truncate(BlockDriverState *bs,
-                                              int64_t offset,
-                                              bool exact,
-                                              PreallocMode prealloc,
-+                                             BdrvRequestFlags flags,
-                                              Error **errp)
- {
-     int r;
-diff --git a/block/sheepdog.c b/block/sheepdog.c
-index a8a7e32..077aed8 100644
---- a/block/sheepdog.c
-+++ b/block/sheepdog.c
-@@ -2288,7 +2288,7 @@ static int64_t sd_getlength(BlockDriverState *bs)
- 
- static int coroutine_fn sd_co_truncate(BlockDriverState *bs, int64_t offset,
-                                        bool exact, PreallocMode prealloc,
--                                       Error **errp)
-+                                       BdrvRequestFlags flags, Error **errp)
- {
-     BDRVSheepdogState *s = bs->opaque;
-     int ret, fd;
-@@ -2604,7 +2604,7 @@ static coroutine_fn int sd_co_writev(BlockDriverState *bs, int64_t sector_num,
- 
-     assert(!flags);
-     if (offset > s->inode.vdi_size) {
--        ret = sd_co_truncate(bs, offset, false, PREALLOC_MODE_OFF, NULL);
-+        ret = sd_co_truncate(bs, offset, false, PREALLOC_MODE_OFF, 0, NULL);
-         if (ret < 0) {
-             return ret;
-         }
-diff --git a/block/ssh.c b/block/ssh.c
-index 84e9282..9eb33df 100644
---- a/block/ssh.c
-+++ b/block/ssh.c
-@@ -1298,7 +1298,7 @@ static int64_t ssh_getlength(BlockDriverState *bs)
- 
- static int coroutine_fn ssh_co_truncate(BlockDriverState *bs, int64_t offset,
-                                         bool exact, PreallocMode prealloc,
--                                        Error **errp)
-+                                        BdrvRequestFlags flags, Error **errp)
- {
-     BDRVSSHState *s = bs->opaque;
- 
-diff --git a/include/block/block_int.h b/include/block/block_int.h
-index 876a83d..41f13ec 100644
---- a/include/block/block_int.h
-+++ b/include/block/block_int.h
-@@ -356,7 +356,7 @@ struct BlockDriver {
-      */
-     int coroutine_fn (*bdrv_co_truncate)(BlockDriverState *bs, int64_t offset,
-                                          bool exact, PreallocMode prealloc,
--                                         Error **errp);
-+                                         BdrvRequestFlags flags, Error **errp);
- 
-     int64_t (*bdrv_getlength)(BlockDriverState *bs);
-     bool has_variable_length;
-@@ -849,6 +849,14 @@ struct BlockDriverState {
-     /* Flags honored during pwrite_zeroes (so far: BDRV_REQ_FUA,
-      * BDRV_REQ_MAY_UNMAP, BDRV_REQ_WRITE_UNCHANGED) */
-     unsigned int supported_zero_flags;
-+    /*
-+     * Flags honoured during truncate (so far: BDRV_REQ_ZERO_WRITE).
-+     *
-+     * If BDRV_REQ_ZERO_WRITE is given, the truncate operation must make sure
-+     * that any added space reads as all zeros. If this can't be guaranteed,
-+     * the operation must fail.
-+     */
-+    unsigned int supported_truncate_flags;
- 
-     /* the following member gives a name to every node on the bs graph. */
-     char node_name[32];
-diff --git a/tests/test-block-iothread.c b/tests/test-block-iothread.c
-index 0c86180..2f3b763 100644
---- a/tests/test-block-iothread.c
-+++ b/tests/test-block-iothread.c
-@@ -46,7 +46,8 @@ static int coroutine_fn bdrv_test_co_pdiscard(BlockDriverState *bs,
- 
- static int coroutine_fn
- bdrv_test_co_truncate(BlockDriverState *bs, int64_t offset, bool exact,
--                      PreallocMode prealloc, Error **errp)
-+                      PreallocMode prealloc, BdrvRequestFlags flags,
-+                      Error **errp)
- {
-     return 0;
- }
--- 
-1.8.3.1
-

SOURCES/kvm-block-Add-flags-to-bdrv-_co-_truncate.patch

@@ -1,353 +0,0 @@
-From 50127f0ff9e13a15fd5bfeb2662e2404ff20f364 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Mon, 8 Jun 2020 15:01:31 +0100
-Subject: [PATCH 03/17] block: Add flags to bdrv(_co)_truncate()
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-Message-id: <20200608150140.38218-3-kwolf@redhat.com>
-Patchwork-id: 97445
-O-Subject: [RHEL-AV-8.2.1 qemu-kvm PATCH 02/11] block: Add flags to bdrv(_co)_truncate()
-Bugzilla: 1780574
-RH-Acked-by: Sergio Lopez Pascual <slp@redhat.com>
-RH-Acked-by: Eric Blake <eblake@redhat.com>
-RH-Acked-by: Max Reitz <mreitz@redhat.com>
-
-Now that block drivers can support flags for .bdrv_co_truncate, expose
-the parameter in the node level interfaces bdrv_co_truncate() and
-bdrv_truncate().
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Reviewed-by: Alberto Garcia <berto@igalia.com>
-Reviewed-by: Max Reitz <mreitz@redhat.com>
-Message-Id: <20200424125448.63318-3-kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 7b8e4857426f2e2de2441749996c6161b550bada)
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
----
- block/block-backend.c       |  2 +-
- block/crypto.c              |  2 +-
- block/io.c                  | 12 +++++++-----
- block/parallels.c           |  6 +++---
- block/qcow.c                |  4 ++--
- block/qcow2-refcount.c      |  2 +-
- block/qcow2.c               | 15 +++++++++------
- block/raw-format.c          |  2 +-
- block/vhdx-log.c            |  2 +-
- block/vhdx.c                |  2 +-
- block/vmdk.c                |  2 +-
- include/block/block.h       |  5 +++--
- tests/test-block-iothread.c |  6 +++---
- 13 files changed, 34 insertions(+), 28 deletions(-)
-
-diff --git a/block/block-backend.c b/block/block-backend.c
-index 38ae413..8be2006 100644
---- a/block/block-backend.c
-+++ b/block/block-backend.c
-@@ -2144,7 +2144,7 @@ int blk_truncate(BlockBackend *blk, int64_t offset, bool exact,
-         return -ENOMEDIUM;
-     }
- 
--    return bdrv_truncate(blk->root, offset, exact, prealloc, errp);
-+    return bdrv_truncate(blk->root, offset, exact, prealloc, 0, errp);
- }
- 
- int blk_save_vmstate(BlockBackend *blk, const uint8_t *buf,
-diff --git a/block/crypto.c b/block/crypto.c
-index 6e4b726..fcb4a97 100644
---- a/block/crypto.c
-+++ b/block/crypto.c
-@@ -313,7 +313,7 @@ block_crypto_co_truncate(BlockDriverState *bs, int64_t offset, bool exact,
- 
-     offset += payload_offset;
- 
--    return bdrv_co_truncate(bs->file, offset, exact, prealloc, errp);
-+    return bdrv_co_truncate(bs->file, offset, exact, prealloc, 0, errp);
- }
- 
- static void block_crypto_close(BlockDriverState *bs)
-diff --git a/block/io.c b/block/io.c
-index 549e5a4..3235ce5 100644
---- a/block/io.c
-+++ b/block/io.c
-@@ -3315,12 +3315,12 @@ static void bdrv_parent_cb_resize(BlockDriverState *bs)
-  * 'offset' bytes in length.
-  */
- int coroutine_fn bdrv_co_truncate(BdrvChild *child, int64_t offset, bool exact,
--                                  PreallocMode prealloc, Error **errp)
-+                                  PreallocMode prealloc, BdrvRequestFlags flags,
-+                                  Error **errp)
- {
-     BlockDriverState *bs = child->bs;
-     BlockDriver *drv = bs->drv;
-     BdrvTrackedRequest req;
--    BdrvRequestFlags flags = 0;
-     int64_t old_size, new_bytes;
-     int ret;
- 
-@@ -3378,7 +3378,7 @@ int coroutine_fn bdrv_co_truncate(BdrvChild *child, int64_t offset, bool exact,
-         }
-         ret = drv->bdrv_co_truncate(bs, offset, exact, prealloc, flags, errp);
-     } else if (bs->file && drv->is_filter) {
--        ret = bdrv_co_truncate(bs->file, offset, exact, prealloc, errp);
-+        ret = bdrv_co_truncate(bs->file, offset, exact, prealloc, flags, errp);
-     } else {
-         error_setg(errp, "Image format driver does not support resize");
-         ret = -ENOTSUP;
-@@ -3411,6 +3411,7 @@ typedef struct TruncateCo {
-     int64_t offset;
-     bool exact;
-     PreallocMode prealloc;
-+    BdrvRequestFlags flags;
-     Error **errp;
-     int ret;
- } TruncateCo;
-@@ -3419,12 +3420,12 @@ static void coroutine_fn bdrv_truncate_co_entry(void *opaque)
- {
-     TruncateCo *tco = opaque;
-     tco->ret = bdrv_co_truncate(tco->child, tco->offset, tco->exact,
--                                tco->prealloc, tco->errp);
-+                                tco->prealloc, tco->flags, tco->errp);
-     aio_wait_kick();
- }
- 
- int bdrv_truncate(BdrvChild *child, int64_t offset, bool exact,
--                  PreallocMode prealloc, Error **errp)
-+                  PreallocMode prealloc, BdrvRequestFlags flags, Error **errp)
- {
-     Coroutine *co;
-     TruncateCo tco = {
-@@ -3432,6 +3433,7 @@ int bdrv_truncate(BdrvChild *child, int64_t offset, bool exact,
-         .offset     = offset,
-         .exact      = exact,
-         .prealloc   = prealloc,
-+        .flags      = flags,
-         .errp       = errp,
-         .ret        = NOT_DONE,
-     };
-diff --git a/block/parallels.c b/block/parallels.c
-index 6d4ed77..2be92cf 100644
---- a/block/parallels.c
-+++ b/block/parallels.c
-@@ -203,7 +203,7 @@ static int64_t allocate_clusters(BlockDriverState *bs, int64_t sector_num,
-         } else {
-             ret = bdrv_truncate(bs->file,
-                                 (s->data_end + space) << BDRV_SECTOR_BITS,
--                                false, PREALLOC_MODE_OFF, NULL);
-+                                false, PREALLOC_MODE_OFF, 0, NULL);
-         }
-         if (ret < 0) {
-             return ret;
-@@ -493,7 +493,7 @@ static int coroutine_fn parallels_co_check(BlockDriverState *bs,
-              * That means we have to pass exact=true.
-              */
-             ret = bdrv_truncate(bs->file, res->image_end_offset, true,
--                                PREALLOC_MODE_OFF, &local_err);
-+                                PREALLOC_MODE_OFF, 0, &local_err);
-             if (ret < 0) {
-                 error_report_err(local_err);
-                 res->check_errors++;
-@@ -889,7 +889,7 @@ static void parallels_close(BlockDriverState *bs)
- 
-         /* errors are ignored, so we might as well pass exact=true */
-         bdrv_truncate(bs->file, s->data_end << BDRV_SECTOR_BITS, true,
--                      PREALLOC_MODE_OFF, NULL);
-+                      PREALLOC_MODE_OFF, 0, NULL);
-     }
- 
-     g_free(s->bat_dirty_bmap);
-diff --git a/block/qcow.c b/block/qcow.c
-index 8973e4e..6b5f226 100644
---- a/block/qcow.c
-+++ b/block/qcow.c
-@@ -480,7 +480,7 @@ static int get_cluster_offset(BlockDriverState *bs,
-                     return -E2BIG;
-                 }
-                 ret = bdrv_truncate(bs->file, cluster_offset + s->cluster_size,
--                                    false, PREALLOC_MODE_OFF, NULL);
-+                                    false, PREALLOC_MODE_OFF, 0, NULL);
-                 if (ret < 0) {
-                     return ret;
-                 }
-@@ -1035,7 +1035,7 @@ static int qcow_make_empty(BlockDriverState *bs)
-             l1_length) < 0)
-         return -1;
-     ret = bdrv_truncate(bs->file, s->l1_table_offset + l1_length, false,
--                        PREALLOC_MODE_OFF, NULL);
-+                        PREALLOC_MODE_OFF, 0, NULL);
-     if (ret < 0)
-         return ret;
- 
-diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c
-index f67ac6b..3a90d75 100644
---- a/block/qcow2-refcount.c
-+++ b/block/qcow2-refcount.c
-@@ -2017,7 +2017,7 @@ static int check_refblocks(BlockDriverState *bs, BdrvCheckResult *res,
-                 }
- 
-                 ret = bdrv_truncate(bs->file, offset + s->cluster_size, false,
--                                    PREALLOC_MODE_OFF, &local_err);
-+                                    PREALLOC_MODE_OFF, 0, &local_err);
-                 if (ret < 0) {
-                     error_report_err(local_err);
-                     goto resize_fail;
-diff --git a/block/qcow2.c b/block/qcow2.c
-index 977445e..c0fdcb9 100644
---- a/block/qcow2.c
-+++ b/block/qcow2.c
-@@ -3082,7 +3082,7 @@ static int coroutine_fn preallocate_co(BlockDriverState *bs, uint64_t offset,
-             mode = PREALLOC_MODE_OFF;
-         }
-         ret = bdrv_co_truncate(s->data_file, host_offset + cur_bytes, false,
--                               mode, errp);
-+                               mode, 0, errp);
-         if (ret < 0) {
-             return ret;
-         }
-@@ -4044,7 +4044,7 @@ static int coroutine_fn qcow2_co_truncate(BlockDriverState *bs, int64_t offset,
-              * always fulfilled, so there is no need to pass it on.)
-              */
-             bdrv_co_truncate(bs->file, (last_cluster + 1) * s->cluster_size,
--                             false, PREALLOC_MODE_OFF, &local_err);
-+                             false, PREALLOC_MODE_OFF, 0, &local_err);
-             if (local_err) {
-                 warn_reportf_err(local_err,
-                                  "Failed to truncate the tail of the image: ");
-@@ -4066,7 +4066,8 @@ static int coroutine_fn qcow2_co_truncate(BlockDriverState *bs, int64_t offset,
-              * file should be resized to the exact target size, too,
-              * so we pass @exact here.
-              */
--            ret = bdrv_co_truncate(s->data_file, offset, exact, prealloc, errp);
-+            ret = bdrv_co_truncate(s->data_file, offset, exact, prealloc, 0,
-+                                   errp);
-             if (ret < 0) {
-                 goto fail;
-             }
-@@ -4152,7 +4153,8 @@ static int coroutine_fn qcow2_co_truncate(BlockDriverState *bs, int64_t offset,
-         new_file_size = allocation_start +
-                         nb_new_data_clusters * s->cluster_size;
-         /* Image file grows, so @exact does not matter */
--        ret = bdrv_co_truncate(bs->file, new_file_size, false, prealloc, errp);
-+        ret = bdrv_co_truncate(bs->file, new_file_size, false, prealloc, 0,
-+                               errp);
-         if (ret < 0) {
-             error_prepend(errp, "Failed to resize underlying file: ");
-             qcow2_free_clusters(bs, allocation_start,
-@@ -4255,7 +4257,8 @@ qcow2_co_pwritev_compressed_part(BlockDriverState *bs,
-         if (len < 0) {
-             return len;
-         }
--        return bdrv_co_truncate(bs->file, len, false, PREALLOC_MODE_OFF, NULL);
-+        return bdrv_co_truncate(bs->file, len, false, PREALLOC_MODE_OFF, 0,
-+                                NULL);
-     }
- 
-     if (offset_into_cluster(s, offset)) {
-@@ -4493,7 +4496,7 @@ static int make_completely_empty(BlockDriverState *bs)
-     }
- 
-     ret = bdrv_truncate(bs->file, (3 + l1_clusters) * s->cluster_size, false,
--                        PREALLOC_MODE_OFF, &local_err);
-+                        PREALLOC_MODE_OFF, 0, &local_err);
-     if (ret < 0) {
-         error_report_err(local_err);
-         goto fail;
-diff --git a/block/raw-format.c b/block/raw-format.c
-index f994c4a..c3acf9a 100644
---- a/block/raw-format.c
-+++ b/block/raw-format.c
-@@ -387,7 +387,7 @@ static int coroutine_fn raw_co_truncate(BlockDriverState *bs, int64_t offset,
- 
-     s->size = offset;
-     offset += s->offset;
--    return bdrv_co_truncate(bs->file, offset, exact, prealloc, errp);
-+    return bdrv_co_truncate(bs->file, offset, exact, prealloc, 0, errp);
- }
- 
- static void raw_eject(BlockDriverState *bs, bool eject_flag)
-diff --git a/block/vhdx-log.c b/block/vhdx-log.c
-index 13a49c2..404fb5f 100644
---- a/block/vhdx-log.c
-+++ b/block/vhdx-log.c
-@@ -558,7 +558,7 @@ static int vhdx_log_flush(BlockDriverState *bs, BDRVVHDXState *s,
-                     goto exit;
-                 }
-                 ret = bdrv_truncate(bs->file, new_file_size, false,
--                                    PREALLOC_MODE_OFF, NULL);
-+                                    PREALLOC_MODE_OFF, 0, NULL);
-                 if (ret < 0) {
-                     goto exit;
-                 }
-diff --git a/block/vhdx.c b/block/vhdx.c
-index 33e57cd..5dfbb20 100644
---- a/block/vhdx.c
-+++ b/block/vhdx.c
-@@ -1264,7 +1264,7 @@ static int vhdx_allocate_block(BlockDriverState *bs, BDRVVHDXState *s,
-     }
- 
-     return bdrv_truncate(bs->file, *new_offset + s->block_size, false,
--                         PREALLOC_MODE_OFF, NULL);
-+                         PREALLOC_MODE_OFF, 0, NULL);
- }
- 
- /*
-diff --git a/block/vmdk.c b/block/vmdk.c
-index eb726f2..1bbf937 100644
---- a/block/vmdk.c
-+++ b/block/vmdk.c
-@@ -2077,7 +2077,7 @@ vmdk_co_pwritev_compressed(BlockDriverState *bs, uint64_t offset,
-             }
-             length = QEMU_ALIGN_UP(length, BDRV_SECTOR_SIZE);
-             ret = bdrv_truncate(s->extents[i].file, length, false,
--                                PREALLOC_MODE_OFF, NULL);
-+                                PREALLOC_MODE_OFF, 0, NULL);
-             if (ret < 0) {
-                 return ret;
-             }
-diff --git a/include/block/block.h b/include/block/block.h
-index b2a3074..4913596 100644
---- a/include/block/block.h
-+++ b/include/block/block.h
-@@ -348,9 +348,10 @@ BlockDriverState *bdrv_find_backing_image(BlockDriverState *bs,
- void bdrv_refresh_filename(BlockDriverState *bs);
- 
- int coroutine_fn bdrv_co_truncate(BdrvChild *child, int64_t offset, bool exact,
--                                  PreallocMode prealloc, Error **errp);
-+                                  PreallocMode prealloc, BdrvRequestFlags flags,
-+                                  Error **errp);
- int bdrv_truncate(BdrvChild *child, int64_t offset, bool exact,
--                  PreallocMode prealloc, Error **errp);
-+                  PreallocMode prealloc, BdrvRequestFlags flags, Error **errp);
- 
- int64_t bdrv_nb_sectors(BlockDriverState *bs);
- int64_t bdrv_getlength(BlockDriverState *bs);
-diff --git a/tests/test-block-iothread.c b/tests/test-block-iothread.c
-index 2f3b763..71e9bce 100644
---- a/tests/test-block-iothread.c
-+++ b/tests/test-block-iothread.c
-@@ -186,18 +186,18 @@ static void test_sync_op_truncate(BdrvChild *c)
-     int ret;
- 
-     /* Normal success path */
--    ret = bdrv_truncate(c, 65536, false, PREALLOC_MODE_OFF, NULL);
-+    ret = bdrv_truncate(c, 65536, false, PREALLOC_MODE_OFF, 0, NULL);
-     g_assert_cmpint(ret, ==, 0);
- 
-     /* Early error: Negative offset */
--    ret = bdrv_truncate(c, -2, false, PREALLOC_MODE_OFF, NULL);
-+    ret = bdrv_truncate(c, -2, false, PREALLOC_MODE_OFF, 0, NULL);
-     g_assert_cmpint(ret, ==, -EINVAL);
- 
-     /* Error: Read-only image */
-     c->bs->read_only = true;
-     c->bs->open_flags &= ~BDRV_O_RDWR;
- 
--    ret = bdrv_truncate(c, 65536, false, PREALLOC_MODE_OFF, NULL);
-+    ret = bdrv_truncate(c, 65536, false, PREALLOC_MODE_OFF, 0, NULL);
-     g_assert_cmpint(ret, ==, -EACCES);
- 
-     c->bs->read_only = false;
--- 
-1.8.3.1
-

SOURCES/kvm-block-Call-attention-to-truncation-of-long-NBD-expor.patch

@@ -1,105 +0,0 @@
-From c8ecaea34f03b8ddda7d2b41b0d6f397469c8959 Mon Sep 17 00:00:00 2001
-From: Eric Blake <eblake@redhat.com>
-Date: Wed, 10 Jun 2020 18:32:02 -0400
-Subject: [PATCH 2/2] block: Call attention to truncation of long NBD exports
-
-RH-Author: Eric Blake <eblake@redhat.com>
-Message-id: <20200610183202.3780750-3-eblake@redhat.com>
-Patchwork-id: 97495
-O-Subject: [RHEL-AV-8.2.1 qemu-kvm PATCH 2/2] block: Call attention to truncation of long NBD exports
-Bugzilla: 1845384
-RH-Acked-by: Sergio Lopez Pascual <slp@redhat.com>
-RH-Acked-by: Max Reitz <mreitz@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-
-Commit 93676c88 relaxed our NBD client code to request export names up
-to the NBD protocol maximum of 4096 bytes without NUL terminator, even
-though the block layer can't store anything longer than 4096 bytes
-including NUL terminator for display to the user.  Since this means
-there are some export names where we have to truncate things, we can
-at least try to make the truncation a bit more obvious for the user.
-Note that in spite of the truncated display name, we can still
-communicate with an NBD server using such a long export name; this was
-deemed nicer than refusing to even connect to such a server (since the
-server may not be under our control, and since determining our actual
-length limits gets tricky when nbd://host:port/export and
-nbd+unix:///export?socket=/path are themselves variable-length
-expansions beyond the export name but count towards the block layer
-name length).
-
-Reported-by: Xueqiang Wei <xuwei@redhat.com>
-Fixes: https://bugzilla.redhat.com/1843684
-Signed-off-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Message-Id: <20200610163741.3745251-3-eblake@redhat.com>
-(cherry picked from commit 5c86bdf1208916ece0b87e1151c9b48ee54faa3e)
-Signed-off-by: Eric Blake <eblake@redhat.com>
-Signed-off-by: Eduardo Lima (Etrunko) <etrunko@redhat.com>
----
- block.c     |  7 +++++--
- block/nbd.c | 21 +++++++++++++--------
- 2 files changed, 18 insertions(+), 10 deletions(-)
-
-diff --git a/block.c b/block.c
-index 12c8941879..57740d312e 100644
---- a/block.c
-+++ b/block.c
-@@ -6683,8 +6683,11 @@ void bdrv_refresh_filename(BlockDriverState *bs)
-         pstrcpy(bs->filename, sizeof(bs->filename), bs->exact_filename);
-     } else {
-         QString *json = qobject_to_json(QOBJECT(bs->full_open_options));
--        snprintf(bs->filename, sizeof(bs->filename), "json:%s",
--                 qstring_get_str(json));
-+        if (snprintf(bs->filename, sizeof(bs->filename), "json:%s",
-+                     qstring_get_str(json)) >= sizeof(bs->filename)) {
-+            /* Give user a hint if we truncated things. */
-+            strcpy(bs->filename + sizeof(bs->filename) - 4, "...");
-+        }
-         qobject_unref(json);
-     }
- }
-diff --git a/block/nbd.c b/block/nbd.c
-index 927915d93d..5bb154017d 100644
---- a/block/nbd.c
-+++ b/block/nbd.c
-@@ -1978,6 +1978,7 @@ static void nbd_refresh_filename(BlockDriverState *bs)
- {
-     BDRVNBDState *s = bs->opaque;
-     const char *host = NULL, *port = NULL, *path = NULL;
-+    size_t len = 0;
- 
-     if (s->saddr->type == SOCKET_ADDRESS_TYPE_INET) {
-         const InetSocketAddress *inet = &s->saddr->u.inet;
-@@ -1990,17 +1991,21 @@ static void nbd_refresh_filename(BlockDriverState *bs)
-     } /* else can't represent as pseudo-filename */
- 
-     if (path && s->export) {
--        snprintf(bs->exact_filename, sizeof(bs->exact_filename),
--                 "nbd+unix:///%s?socket=%s", s->export, path);
-+        len = snprintf(bs->exact_filename, sizeof(bs->exact_filename),
-+                       "nbd+unix:///%s?socket=%s", s->export, path);
-     } else if (path && !s->export) {
--        snprintf(bs->exact_filename, sizeof(bs->exact_filename),
--                 "nbd+unix://?socket=%s", path);
-+        len = snprintf(bs->exact_filename, sizeof(bs->exact_filename),
-+                       "nbd+unix://?socket=%s", path);
-     } else if (host && s->export) {
--        snprintf(bs->exact_filename, sizeof(bs->exact_filename),
--                 "nbd://%s:%s/%s", host, port, s->export);
-+        len = snprintf(bs->exact_filename, sizeof(bs->exact_filename),
-+                       "nbd://%s:%s/%s", host, port, s->export);
-     } else if (host && !s->export) {
--        snprintf(bs->exact_filename, sizeof(bs->exact_filename),
--                 "nbd://%s:%s", host, port);
-+        len = snprintf(bs->exact_filename, sizeof(bs->exact_filename),
-+                       "nbd://%s:%s", host, port);
-+    }
-+    if (len > sizeof(bs->exact_filename)) {
-+        /* Name is too long to represent exactly, so leave it empty. */
-+        bs->exact_filename[0] = '\0';
-     }
- }
- 
--- 
-2.27.0
-

SOURCES/kvm-block-Collapse-padded-I-O-vecs-exceeding-IOV_MAX.patch

@@ -0,0 +1,359 @@
+From 1f7520baa6f0bf02ccba2ebfe7d1d5bf6520f95a Mon Sep 17 00:00:00 2001
+From: Hanna Czenczek <hreitz@redhat.com>
+Date: Tue, 11 Apr 2023 19:34:16 +0200
+Subject: [PATCH 2/5] block: Collapse padded I/O vecs exceeding IOV_MAX
+
+RH-Author: Hanna Czenczek <hreitz@redhat.com>
+RH-MergeRequest: 291: block: Split padded I/O vectors exceeding IOV_MAX
+RH-Bugzilla: 2141964
+RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+RH-Commit: [2/5] 1d86ce8398e4ab66e308a686f9855c963e52b0a9
+
+When processing vectored guest requests that are not aligned to the
+storage request alignment, we pad them by adding head and/or tail
+buffers for a read-modify-write cycle.
+
+The guest can submit I/O vectors up to IOV_MAX (1024) in length, but
+with this padding, the vector can exceed that limit.  As of
+4c002cef0e9abe7135d7916c51abce47f7fc1ee2 ("util/iov: make
+qemu_iovec_init_extended() honest"), we refuse to pad vectors beyond the
+limit, instead returning an error to the guest.
+
+To the guest, this appears as a random I/O error.  We should not return
+an I/O error to the guest when it issued a perfectly valid request.
+
+Before 4c002cef0e9abe7135d7916c51abce47f7fc1ee2, we just made the vector
+longer than IOV_MAX, which generally seems to work (because the guest
+assumes a smaller alignment than we really have, file-posix's
+raw_co_prw() will generally see bdrv_qiov_is_aligned() return false, and
+so emulate the request, so that the IOV_MAX does not matter).  However,
+that does not seem exactly great.
+
+I see two ways to fix this problem:
+1. We split such long requests into two requests.
+2. We join some elements of the vector into new buffers to make it
+   shorter.
+
+I am wary of (1), because it seems like it may have unintended side
+effects.
+
+(2) on the other hand seems relatively simple to implement, with
+hopefully few side effects, so this patch does that.
+
+To do this, the use of qemu_iovec_init_extended() in bdrv_pad_request()
+is effectively replaced by the new function bdrv_create_padded_qiov(),
+which not only wraps the request IOV with padding head/tail, but also
+ensures that the resulting vector will not have more than IOV_MAX
+elements.  Putting that functionality into qemu_iovec_init_extended() is
+infeasible because it requires allocating a bounce buffer; doing so
+would require many more parameters (buffer alignment, how to initialize
+the buffer, and out parameters like the buffer, its length, and the
+original elements), which is not reasonable.
+
+Conversely, it is not difficult to move qemu_iovec_init_extended()'s
+functionality into bdrv_create_padded_qiov() by using public
+qemu_iovec_* functions, so that is what this patch does.
+
+Because bdrv_pad_request() was the only "serious" user of
+qemu_iovec_init_extended(), the next patch will remove the latter
+function, so the functionality is not implemented twice.
+
+Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2141964
+Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
+Message-Id: <20230411173418.19549-3-hreitz@redhat.com>
+Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
+(cherry picked from commit 18743311b829cafc1737a5f20bc3248d5f91ee2a)
+
+Conflicts:
+	block/io.c: Downstream bdrv_pad_request() has no @flags
+        parameter.
+
+Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
+---
+ block/io.c | 166 ++++++++++++++++++++++++++++++++++++++++++++++++-----
+ 1 file changed, 151 insertions(+), 15 deletions(-)
+
+diff --git a/block/io.c b/block/io.c
+index c3e7301613..0fe8f0dd40 100644
+--- a/block/io.c
++++ b/block/io.c
+@@ -1624,6 +1624,14 @@ out:
+  * @merge_reads is true for small requests,
+  * if @buf_len == @head + bytes + @tail. In this case it is possible that both
+  * head and tail exist but @buf_len == align and @tail_buf == @buf.
++ *
++ * @write is true for write requests, false for read requests.
++ *
++ * If padding makes the vector too long (exceeding IOV_MAX), then we need to
++ * merge existing vector elements into a single one.  @collapse_bounce_buf acts
++ * as the bounce buffer in such cases.  @pre_collapse_qiov has the pre-collapse
++ * I/O vector elements so for read requests, the data can be copied back after
++ * the read is done.
+  */
+ typedef struct BdrvRequestPadding {
+     uint8_t *buf;
+@@ -1632,11 +1640,17 @@ typedef struct BdrvRequestPadding {
+     size_t head;
+     size_t tail;
+     bool merge_reads;
++    bool write;
+     QEMUIOVector local_qiov;
++
++    uint8_t *collapse_bounce_buf;
++    size_t collapse_len;
++    QEMUIOVector pre_collapse_qiov;
+ } BdrvRequestPadding;
+ 
+ static bool bdrv_init_padding(BlockDriverState *bs,
+                               int64_t offset, int64_t bytes,
++                              bool write,
+                               BdrvRequestPadding *pad)
+ {
+     int64_t align = bs->bl.request_alignment;
+@@ -1668,6 +1682,8 @@ static bool bdrv_init_padding(BlockDriverState *bs,
+         pad->tail_buf = pad->buf + pad->buf_len - align;
+     }
+ 
++    pad->write = write;
++
+     return true;
+ }
+ 
+@@ -1733,8 +1749,23 @@ zero_mem:
+     return 0;
+ }
+ 
+-static void bdrv_padding_destroy(BdrvRequestPadding *pad)
++/**
++ * Free *pad's associated buffers, and perform any necessary finalization steps.
++ */
++static void bdrv_padding_finalize(BdrvRequestPadding *pad)
+ {
++    if (pad->collapse_bounce_buf) {
++        if (!pad->write) {
++            /*
++             * If padding required elements in the vector to be collapsed into a
++             * bounce buffer, copy the bounce buffer content back
++             */
++            qemu_iovec_from_buf(&pad->pre_collapse_qiov, 0,
++                                pad->collapse_bounce_buf, pad->collapse_len);
++        }
++        qemu_vfree(pad->collapse_bounce_buf);
++        qemu_iovec_destroy(&pad->pre_collapse_qiov);
++    }
+     if (pad->buf) {
+         qemu_vfree(pad->buf);
+         qemu_iovec_destroy(&pad->local_qiov);
+@@ -1742,6 +1773,101 @@ static void bdrv_padding_destroy(BdrvRequestPadding *pad)
+     memset(pad, 0, sizeof(*pad));
+ }
+ 
++/*
++ * Create pad->local_qiov by wrapping @iov in the padding head and tail, while
++ * ensuring that the resulting vector will not exceed IOV_MAX elements.
++ *
++ * To ensure this, when necessary, the first two or three elements of @iov are
++ * merged into pad->collapse_bounce_buf and replaced by a reference to that
++ * bounce buffer in pad->local_qiov.
++ *
++ * After performing a read request, the data from the bounce buffer must be
++ * copied back into pad->pre_collapse_qiov (e.g. by bdrv_padding_finalize()).
++ */
++static int bdrv_create_padded_qiov(BlockDriverState *bs,
++                                   BdrvRequestPadding *pad,
++                                   struct iovec *iov, int niov,
++                                   size_t iov_offset, size_t bytes)
++{
++    int padded_niov, surplus_count, collapse_count;
++
++    /* Assert this invariant */
++    assert(niov <= IOV_MAX);
++
++    /*
++     * Cannot pad if resulting length would exceed SIZE_MAX.  Returning an error
++     * to the guest is not ideal, but there is little else we can do.  At least
++     * this will practically never happen on 64-bit systems.
++     */
++    if (SIZE_MAX - pad->head < bytes ||
++        SIZE_MAX - pad->head - bytes < pad->tail)
++    {
++        return -EINVAL;
++    }
++
++    /* Length of the resulting IOV if we just concatenated everything */
++    padded_niov = !!pad->head + niov + !!pad->tail;
++
++    qemu_iovec_init(&pad->local_qiov, MIN(padded_niov, IOV_MAX));
++
++    if (pad->head) {
++        qemu_iovec_add(&pad->local_qiov, pad->buf, pad->head);
++    }
++
++    /*
++     * If padded_niov > IOV_MAX, we cannot just concatenate everything.
++     * Instead, merge the first two or three elements of @iov to reduce the
++     * number of vector elements as necessary.
++     */
++    if (padded_niov > IOV_MAX) {
++        /*
++         * Only head and tail can have lead to the number of entries exceeding
++         * IOV_MAX, so we can exceed it by the head and tail at most.  We need
++         * to reduce the number of elements by `surplus_count`, so we merge that
++         * many elements plus one into one element.
++         */
++        surplus_count = padded_niov - IOV_MAX;
++        assert(surplus_count <= !!pad->head + !!pad->tail);
++        collapse_count = surplus_count + 1;
++
++        /*
++         * Move the elements to collapse into `pad->pre_collapse_qiov`, then
++         * advance `iov` (and associated variables) by those elements.
++         */
++        qemu_iovec_init(&pad->pre_collapse_qiov, collapse_count);
++        qemu_iovec_concat_iov(&pad->pre_collapse_qiov, iov,
++                              collapse_count, iov_offset, SIZE_MAX);
++        iov += collapse_count;
++        iov_offset = 0;
++        niov -= collapse_count;
++        bytes -= pad->pre_collapse_qiov.size;
++
++        /*
++         * Construct the bounce buffer to match the length of the to-collapse
++         * vector elements, and for write requests, initialize it with the data
++         * from those elements.  Then add it to `pad->local_qiov`.
++         */
++        pad->collapse_len = pad->pre_collapse_qiov.size;
++        pad->collapse_bounce_buf = qemu_blockalign(bs, pad->collapse_len);
++        if (pad->write) {
++            qemu_iovec_to_buf(&pad->pre_collapse_qiov, 0,
++                              pad->collapse_bounce_buf, pad->collapse_len);
++        }
++        qemu_iovec_add(&pad->local_qiov,
++                       pad->collapse_bounce_buf, pad->collapse_len);
++    }
++
++    qemu_iovec_concat_iov(&pad->local_qiov, iov, niov, iov_offset, bytes);
++
++    if (pad->tail) {
++        qemu_iovec_add(&pad->local_qiov,
++                       pad->buf + pad->buf_len - pad->tail, pad->tail);
++    }
++
++    assert(pad->local_qiov.niov == MIN(padded_niov, IOV_MAX));
++    return 0;
++}
++
+ /*
+  * bdrv_pad_request
+  *
+@@ -1749,6 +1875,8 @@ static void bdrv_padding_destroy(BdrvRequestPadding *pad)
+  * read of padding, bdrv_padding_rmw_read() should be called separately if
+  * needed.
+  *
++ * @write is true for write requests, false for read requests.
++ *
+  * Request parameters (@qiov, &qiov_offset, &offset, &bytes) are in-out:
+  *  - on function start they represent original request
+  *  - on failure or when padding is not needed they are unchanged
+@@ -1757,25 +1885,33 @@ static void bdrv_padding_destroy(BdrvRequestPadding *pad)
+ static int bdrv_pad_request(BlockDriverState *bs,
+                             QEMUIOVector **qiov, size_t *qiov_offset,
+                             int64_t *offset, int64_t *bytes,
++                            bool write,
+                             BdrvRequestPadding *pad, bool *padded)
+ {
+     int ret;
++    struct iovec *sliced_iov;
++    int sliced_niov;
++    size_t sliced_head, sliced_tail;
+ 
+     bdrv_check_qiov_request(*offset, *bytes, *qiov, *qiov_offset, &error_abort);
+ 
+-    if (!bdrv_init_padding(bs, *offset, *bytes, pad)) {
++    if (!bdrv_init_padding(bs, *offset, *bytes, write, pad)) {
+         if (padded) {
+             *padded = false;
+         }
+         return 0;
+     }
+ 
+-    ret = qemu_iovec_init_extended(&pad->local_qiov, pad->buf, pad->head,
+-                                   *qiov, *qiov_offset, *bytes,
+-                                   pad->buf + pad->buf_len - pad->tail,
+-                                   pad->tail);
++    sliced_iov = qemu_iovec_slice(*qiov, *qiov_offset, *bytes,
++                                  &sliced_head, &sliced_tail,
++                                  &sliced_niov);
++
++    /* Guaranteed by bdrv_check_qiov_request() */
++    assert(*bytes <= SIZE_MAX);
++    ret = bdrv_create_padded_qiov(bs, pad, sliced_iov, sliced_niov,
++                                  sliced_head, *bytes);
+     if (ret < 0) {
+-        bdrv_padding_destroy(pad);
++        bdrv_padding_finalize(pad);
+         return ret;
+     }
+     *bytes += pad->head + pad->tail;
+@@ -1836,8 +1972,8 @@ int coroutine_fn bdrv_co_preadv_part(BdrvChild *child,
+         flags |= BDRV_REQ_COPY_ON_READ;
+     }
+ 
+-    ret = bdrv_pad_request(bs, &qiov, &qiov_offset, &offset, &bytes, &pad,
+-                           NULL);
++    ret = bdrv_pad_request(bs, &qiov, &qiov_offset, &offset, &bytes, false,
++                           &pad, NULL);
+     if (ret < 0) {
+         goto fail;
+     }
+@@ -1847,7 +1983,7 @@ int coroutine_fn bdrv_co_preadv_part(BdrvChild *child,
+                               bs->bl.request_alignment,
+                               qiov, qiov_offset, flags);
+     tracked_request_end(&req);
+-    bdrv_padding_destroy(&pad);
++    bdrv_padding_finalize(&pad);
+ 
+ fail:
+     bdrv_dec_in_flight(bs);
+@@ -2167,7 +2303,7 @@ static int coroutine_fn bdrv_co_do_zero_pwritev(BdrvChild *child,
+     bool padding;
+     BdrvRequestPadding pad;
+ 
+-    padding = bdrv_init_padding(bs, offset, bytes, &pad);
++    padding = bdrv_init_padding(bs, offset, bytes, true, &pad);
+     if (padding) {
+         bdrv_make_request_serialising(req, align);
+ 
+@@ -2214,7 +2350,7 @@ static int coroutine_fn bdrv_co_do_zero_pwritev(BdrvChild *child,
+     }
+ 
+ out:
+-    bdrv_padding_destroy(&pad);
++    bdrv_padding_finalize(&pad);
+ 
+     return ret;
+ }
+@@ -2280,8 +2416,8 @@ int coroutine_fn bdrv_co_pwritev_part(BdrvChild *child,
+          * bdrv_co_do_zero_pwritev() does aligning by itself, so, we do
+          * alignment only if there is no ZERO flag.
+          */
+-        ret = bdrv_pad_request(bs, &qiov, &qiov_offset, &offset, &bytes, &pad,
+-                               &padded);
++        ret = bdrv_pad_request(bs, &qiov, &qiov_offset, &offset, &bytes, true,
++                               &pad, &padded);
+         if (ret < 0) {
+             return ret;
+         }
+@@ -2310,7 +2446,7 @@ int coroutine_fn bdrv_co_pwritev_part(BdrvChild *child,
+     ret = bdrv_aligned_pwritev(child, &req, offset, bytes, align,
+                                qiov, qiov_offset, flags);
+ 
+-    bdrv_padding_destroy(&pad);
++    bdrv_padding_finalize(&pad);
+ 
+ out:
+     tracked_request_end(&req);
+-- 
+2.39.3
+

SOURCES/kvm-block-Fix-blk-in_flight-during-blk_wait_while_draine.patch

@@ -1,84 +0,0 @@
-From f17b37b58a57d849d2ff5fa04f149d9415803a39 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Wed, 8 Apr 2020 17:29:17 +0100
-Subject: [PATCH 6/6] block: Fix blk->in_flight during blk_wait_while_drained()
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-Message-id: <20200408172917.18712-7-kwolf@redhat.com>
-Patchwork-id: 94599
-O-Subject: [RHEL-AV-8.2.0 qemu-kvm PATCH 6/6] block: Fix blk->in_flight during blk_wait_while_drained()
-Bugzilla: 1817621
-RH-Acked-by: Eric Blake <eblake@redhat.com>
-RH-Acked-by: Danilo de Paula <ddepaula@redhat.com>
-RH-Acked-by: Max Reitz <mreitz@redhat.com>
-
-Waiting in blk_wait_while_drained() while blk->in_flight is increased
-for the current request is wrong because it will cause the drain
-operation to deadlock.
-
-This patch makes sure that blk_wait_while_drained() is called with
-blk->in_flight increased exactly once for the current request, and that
-it temporarily decreases the counter while it waits.
-
-Fixes: cf3129323f900ef5ddbccbe86e4fa801e88c566e
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Reviewed-by: Max Reitz <mreitz@redhat.com>
-Message-Id: <20200407121259.21350-4-kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 7f16476fab14fc32388e0ebae793f64673848efa)
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
----
- block/block-backend.c | 17 +++++------------
- 1 file changed, 5 insertions(+), 12 deletions(-)
-
-diff --git a/block/block-backend.c b/block/block-backend.c
-index 610dbfa..38ae413 100644
---- a/block/block-backend.c
-+++ b/block/block-backend.c
-@@ -1140,10 +1140,15 @@ static int blk_check_byte_request(BlockBackend *blk, int64_t offset,
-     return 0;
- }
- 
-+/* To be called between exactly one pair of blk_inc/dec_in_flight() */
- static void coroutine_fn blk_wait_while_drained(BlockBackend *blk)
- {
-+    assert(blk->in_flight > 0);
-+
-     if (blk->quiesce_counter && !blk->disable_request_queuing) {
-+        blk_dec_in_flight(blk);
-         qemu_co_queue_wait(&blk->queued_requests, NULL);
-+        blk_inc_in_flight(blk);
-     }
- }
- 
-@@ -1418,12 +1423,6 @@ static void blk_aio_read_entry(void *opaque)
-     BlkRwCo *rwco = &acb->rwco;
-     QEMUIOVector *qiov = rwco->iobuf;
- 
--    if (rwco->blk->quiesce_counter) {
--        blk_dec_in_flight(rwco->blk);
--        blk_wait_while_drained(rwco->blk);
--        blk_inc_in_flight(rwco->blk);
--    }
--
-     assert(qiov->size == acb->bytes);
-     rwco->ret = blk_do_preadv(rwco->blk, rwco->offset, acb->bytes,
-                               qiov, rwco->flags);
-@@ -1436,12 +1435,6 @@ static void blk_aio_write_entry(void *opaque)
-     BlkRwCo *rwco = &acb->rwco;
-     QEMUIOVector *qiov = rwco->iobuf;
- 
--    if (rwco->blk->quiesce_counter) {
--        blk_dec_in_flight(rwco->blk);
--        blk_wait_while_drained(rwco->blk);
--        blk_inc_in_flight(rwco->blk);
--    }
--
-     assert(!qiov || qiov->size == acb->bytes);
-     rwco->ret = blk_do_pwritev_part(rwco->blk, rwco->offset, acb->bytes,
-                                     qiov, 0, rwco->flags);
--- 
-1.8.3.1
-

SOURCES/kvm-block-Fix-cross-AioContext-blockdev-snapshot.patch

@@ -1,91 +0,0 @@
-From 5774af5a3c713d0c93010c30453812eae6a749cd Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Fri, 13 Mar 2020 12:34:37 +0000
-Subject: [PATCH 17/20] block: Fix cross-AioContext blockdev-snapshot
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-Message-id: <20200313123439.10548-12-kwolf@redhat.com>
-Patchwork-id: 94286
-O-Subject: [RHEL-AV-8.2.0 qemu-kvm PATCH v2 11/13] block: Fix cross-AioContext blockdev-snapshot
-Bugzilla: 1790482 1805143
-RH-Acked-by: John Snow <jsnow@redhat.com>
-RH-Acked-by: Daniel P. Berrange <berrange@redhat.com>
-RH-Acked-by: Peter Krempa <pkrempa@redhat.com>
-
-external_snapshot_prepare() tries to move the overlay to the AioContext
-of the backing file (the snapshotted node). However, it's possible that
-this doesn't work, but the backing file can instead be moved to the
-overlay's AioContext (e.g. opening the backing chain for a mirror
-target).
-
-bdrv_append() already indirectly uses bdrv_attach_node(), which takes
-care to move nodes to make sure they use the same AioContext and which
-tries both directions.
-
-So the problem has a simple fix: Just delete the unnecessary extra
-bdrv_try_set_aio_context() call in external_snapshot_prepare() and
-instead assert in bdrv_append() that both nodes were indeed moved to the
-same AioContext.
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Message-Id: <20200310113831.27293-6-kwolf@redhat.com>
-Tested-by: Peter Krempa <pkrempa@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 30dd65f307b647eef8156c4a33bd007823ef85cb)
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
----
- block.c    |  1 +
- blockdev.c | 16 ----------------
- 2 files changed, 1 insertion(+), 16 deletions(-)
-
-diff --git a/block.c b/block.c
-index 354d388..ec29b1e 100644
---- a/block.c
-+++ b/block.c
-@@ -4327,6 +4327,7 @@ void bdrv_replace_node(BlockDriverState *from, BlockDriverState *to,
-     bdrv_ref(from);
- 
-     assert(qemu_get_current_aio_context() == qemu_get_aio_context());
-+    assert(bdrv_get_aio_context(from) == bdrv_get_aio_context(to));
-     bdrv_drained_begin(from);
- 
-     /* Put all parents into @list and calculate their cumulative permissions */
-diff --git a/blockdev.c b/blockdev.c
-index 7918533..c8d4b51 100644
---- a/blockdev.c
-+++ b/blockdev.c
-@@ -1535,9 +1535,7 @@ static void external_snapshot_prepare(BlkActionState *common,
-                              DO_UPCAST(ExternalSnapshotState, common, common);
-     TransactionAction *action = common->action;
-     AioContext *aio_context;
--    AioContext *old_context;
-     uint64_t perm, shared;
--    int ret;
- 
-     /* 'blockdev-snapshot' and 'blockdev-snapshot-sync' have similar
-      * purpose but a different set of parameters */
-@@ -1678,20 +1676,6 @@ static void external_snapshot_prepare(BlkActionState *common,
-         goto out;
-     }
- 
--    /* Honor bdrv_try_set_aio_context() context acquisition requirements. */
--    old_context = bdrv_get_aio_context(state->new_bs);
--    aio_context_release(aio_context);
--    aio_context_acquire(old_context);
--
--    ret = bdrv_try_set_aio_context(state->new_bs, aio_context, errp);
--
--    aio_context_release(old_context);
--    aio_context_acquire(aio_context);
--
--    if (ret < 0) {
--        goto out;
--    }
--
-     /* This removes our old bs and adds the new bs. This is an operation that
-      * can fail, so we need to do it in .prepare; undoing it for abort is
-      * always possible. */
--- 
-1.8.3.1
-

SOURCES/kvm-block-Fix-leak-in-bdrv_create_file_fallback.patch

@@ -1,60 +0,0 @@
-From 05452efd7e0fb0522099ae09a396f8f97e66014a Mon Sep 17 00:00:00 2001
-From: Maxim Levitsky <mlevitsk@redhat.com>
-Date: Wed, 11 Mar 2020 10:51:47 +0000
-Subject: [PATCH 06/20] block: Fix leak in bdrv_create_file_fallback()
-
-RH-Author: Maxim Levitsky <mlevitsk@redhat.com>
-Message-id: <20200311105147.13208-7-mlevitsk@redhat.com>
-Patchwork-id: 94229
-O-Subject: [RHEL-AV-8.2.0 qemu-kvm PATCH v2 6/6] block: Fix leak in bdrv_create_file_fallback()
-Bugzilla: 1640894
-RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
-RH-Acked-by: John Snow <jsnow@redhat.com>
-RH-Acked-by: Max Reitz <mreitz@redhat.com>
-
-From: Max Reitz <mreitz@redhat.com>
-
-@options is leaked by the first two return statements in this function.
-
-Note that blk_new_open() takes the reference to @options even on
-failure, so all we need to do to fix the leak is to move the QDict
-allocation down to where we actually need it.
-
-Reported-by: Coverity (CID 1419884)
-Fixes: fd17146cd93d1704cd96d7c2757b325fc7aac6fd
-       ("block: Generic file creation fallback")
-Signed-off-by: Max Reitz <mreitz@redhat.com>
-Message-Id: <20200225155618.133412-1-mreitz@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit eeea1faa099f82328f5831cf252f8ce0a59a9287)
-Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
-
-Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
----
- block.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/block.c b/block.c
-index 3beec7f..e1a4e38 100644
---- a/block.c
-+++ b/block.c
-@@ -600,7 +600,7 @@ static int bdrv_create_file_fallback(const char *filename, BlockDriver *drv,
-                                      QemuOpts *opts, Error **errp)
- {
-     BlockBackend *blk;
--    QDict *options = qdict_new();
-+    QDict *options;
-     int64_t size = 0;
-     char *buf = NULL;
-     PreallocMode prealloc;
-@@ -623,6 +623,7 @@ static int bdrv_create_file_fallback(const char *filename, BlockDriver *drv,
-         return -ENOTSUP;
-     }
- 
-+    options = qdict_new();
-     qdict_put_str(options, "driver", drv->format_name);
- 
-     blk = blk_new_open(filename, NULL, options,
--- 
-1.8.3.1
-

SOURCES/kvm-block-Fix-pad_request-s-request-restriction.patch

@@ -0,0 +1,75 @@
+From b9866279996ee065cb524bf30bc70e22efbab303 Mon Sep 17 00:00:00 2001
+From: Hanna Czenczek <hreitz@redhat.com>
+Date: Fri, 14 Jul 2023 10:59:38 +0200
+Subject: [PATCH 5/5] block: Fix pad_request's request restriction
+
+RH-Author: Hanna Czenczek <hreitz@redhat.com>
+RH-MergeRequest: 291: block: Split padded I/O vectors exceeding IOV_MAX
+RH-Bugzilla: 2141964
+RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+RH-Commit: [5/5] f9188bd089d6c67185ea1accde20d491a2ed3193
+
+bdrv_pad_request() relies on requests' lengths not to exceed SIZE_MAX,
+which bdrv_check_qiov_request() does not guarantee.
+
+bdrv_check_request32() however will guarantee this, and both of
+bdrv_pad_request()'s callers (bdrv_co_preadv_part() and
+bdrv_co_pwritev_part()) already run it before calling
+bdrv_pad_request().  Therefore, bdrv_pad_request() can safely call
+bdrv_check_request32() without expecting error, too.
+
+In effect, this patch will not change guest-visible behavior.  It is a
+clean-up to tighten a condition to match what is guaranteed by our
+callers, and which exists purely to show clearly why the subsequent
+assertion (`assert(*bytes <= SIZE_MAX)`) is always true.
+
+Note there is a difference between the interfaces of
+bdrv_check_qiov_request() and bdrv_check_request32(): The former takes
+an errp, the latter does not, so we can no longer just pass
+&error_abort.  Instead, we need to check the returned value.  While we
+do expect success (because the callers have already run this function),
+an assert(ret == 0) is not much simpler than just to return an error if
+it occurs, so let us handle errors by returning them up the stack now.
+
+Reported-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
+Message-id: 20230714085938.202730-1-hreitz@redhat.com
+Fixes: 18743311b829cafc1737a5f20bc3248d5f91ee2a
+       ("block: Collapse padded I/O vecs exceeding IOV_MAX")
+Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
+---
+ block/io.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/block/io.c b/block/io.c
+index 0fe8f0dd40..8ae57728a6 100644
+--- a/block/io.c
++++ b/block/io.c
+@@ -1893,7 +1893,11 @@ static int bdrv_pad_request(BlockDriverState *bs,
+     int sliced_niov;
+     size_t sliced_head, sliced_tail;
+ 
+-    bdrv_check_qiov_request(*offset, *bytes, *qiov, *qiov_offset, &error_abort);
++    /* Should have been checked by the caller already */
++    ret = bdrv_check_request32(*offset, *bytes, *qiov, *qiov_offset);
++    if (ret < 0) {
++        return ret;
++    }
+ 
+     if (!bdrv_init_padding(bs, *offset, *bytes, write, pad)) {
+         if (padded) {
+@@ -1906,7 +1910,7 @@ static int bdrv_pad_request(BlockDriverState *bs,
+                                   &sliced_head, &sliced_tail,
+                                   &sliced_niov);
+ 
+-    /* Guaranteed by bdrv_check_qiov_request() */
++    /* Guaranteed by bdrv_check_request32() */
+     assert(*bytes <= SIZE_MAX);
+     ret = bdrv_create_padded_qiov(bs, pad, sliced_iov, sliced_niov,
+                                   sliced_head, *bytes);
+-- 
+2.39.3
+

SOURCES/kvm-block-Generic-file-creation-fallback.patch

@@ -1,227 +0,0 @@
-From 882d09226b7f45b72c5b7763c4c4aba182e0f8a1 Mon Sep 17 00:00:00 2001
-From: Maxim Levitsky <mlevitsk@redhat.com>
-Date: Wed, 11 Mar 2020 10:51:43 +0000
-Subject: [PATCH 02/20] block: Generic file creation fallback
-
-RH-Author: Maxim Levitsky <mlevitsk@redhat.com>
-Message-id: <20200311105147.13208-3-mlevitsk@redhat.com>
-Patchwork-id: 94227
-O-Subject: [RHEL-AV-8.2.0 qemu-kvm PATCH v2 2/6] block: Generic file creation fallback
-Bugzilla: 1640894
-RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
-RH-Acked-by: John Snow <jsnow@redhat.com>
-RH-Acked-by: Max Reitz <mreitz@redhat.com>
-
-From: Max Reitz <mreitz@redhat.com>
-
-If a protocol driver does not support image creation, we can see whether
-maybe the file exists already.  If so, just truncating it will be
-sufficient.
-
-Signed-off-by: Max Reitz <mreitz@redhat.com>
-Message-Id: <20200122164532.178040-3-mreitz@redhat.com>
-Signed-off-by: Max Reitz <mreitz@redhat.com>
-(cherry picked from commit fd17146cd93d1704cd96d7c2757b325fc7aac6fd)
-Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
-Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
----
- block.c | 159 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-----
- 1 file changed, 147 insertions(+), 12 deletions(-)
-
-diff --git a/block.c b/block.c
-index 2e5e8b6..3beec7f 100644
---- a/block.c
-+++ b/block.c
-@@ -532,20 +532,139 @@ out:
-     return ret;
- }
- 
--int bdrv_create_file(const char *filename, QemuOpts *opts, Error **errp)
-+/**
-+ * Helper function for bdrv_create_file_fallback(): Resize @blk to at
-+ * least the given @minimum_size.
-+ *
-+ * On success, return @blk's actual length.
-+ * Otherwise, return -errno.
-+ */
-+static int64_t create_file_fallback_truncate(BlockBackend *blk,
-+                                             int64_t minimum_size, Error **errp)
- {
--    BlockDriver *drv;
-+    Error *local_err = NULL;
-+    int64_t size;
-+    int ret;
-+
-+    ret = blk_truncate(blk, minimum_size, false, PREALLOC_MODE_OFF, &local_err);
-+    if (ret < 0 && ret != -ENOTSUP) {
-+        error_propagate(errp, local_err);
-+        return ret;
-+    }
-+
-+    size = blk_getlength(blk);
-+    if (size < 0) {
-+        error_free(local_err);
-+        error_setg_errno(errp, -size,
-+                         "Failed to inquire the new image file's length");
-+        return size;
-+    }
-+
-+    if (size < minimum_size) {
-+        /* Need to grow the image, but we failed to do that */
-+        error_propagate(errp, local_err);
-+        return -ENOTSUP;
-+    }
-+
-+    error_free(local_err);
-+    local_err = NULL;
-+
-+    return size;
-+}
-+
-+/**
-+ * Helper function for bdrv_create_file_fallback(): Zero the first
-+ * sector to remove any potentially pre-existing image header.
-+ */
-+static int create_file_fallback_zero_first_sector(BlockBackend *blk,
-+                                                  int64_t current_size,
-+                                                  Error **errp)
-+{
-+    int64_t bytes_to_clear;
-+    int ret;
-+
-+    bytes_to_clear = MIN(current_size, BDRV_SECTOR_SIZE);
-+    if (bytes_to_clear) {
-+        ret = blk_pwrite_zeroes(blk, 0, bytes_to_clear, BDRV_REQ_MAY_UNMAP);
-+        if (ret < 0) {
-+            error_setg_errno(errp, -ret,
-+                             "Failed to clear the new image's first sector");
-+            return ret;
-+        }
-+    }
-+
-+    return 0;
-+}
-+
-+static int bdrv_create_file_fallback(const char *filename, BlockDriver *drv,
-+                                     QemuOpts *opts, Error **errp)
-+{
-+    BlockBackend *blk;
-+    QDict *options = qdict_new();
-+    int64_t size = 0;
-+    char *buf = NULL;
-+    PreallocMode prealloc;
-     Error *local_err = NULL;
-     int ret;
- 
-+    size = qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0);
-+    buf = qemu_opt_get_del(opts, BLOCK_OPT_PREALLOC);
-+    prealloc = qapi_enum_parse(&PreallocMode_lookup, buf,
-+                               PREALLOC_MODE_OFF, &local_err);
-+    g_free(buf);
-+    if (local_err) {
-+        error_propagate(errp, local_err);
-+        return -EINVAL;
-+    }
-+
-+    if (prealloc != PREALLOC_MODE_OFF) {
-+        error_setg(errp, "Unsupported preallocation mode '%s'",
-+                   PreallocMode_str(prealloc));
-+        return -ENOTSUP;
-+    }
-+
-+    qdict_put_str(options, "driver", drv->format_name);
-+
-+    blk = blk_new_open(filename, NULL, options,
-+                       BDRV_O_RDWR | BDRV_O_RESIZE, errp);
-+    if (!blk) {
-+        error_prepend(errp, "Protocol driver '%s' does not support image "
-+                      "creation, and opening the image failed: ",
-+                      drv->format_name);
-+        return -EINVAL;
-+    }
-+
-+    size = create_file_fallback_truncate(blk, size, errp);
-+    if (size < 0) {
-+        ret = size;
-+        goto out;
-+    }
-+
-+    ret = create_file_fallback_zero_first_sector(blk, size, errp);
-+    if (ret < 0) {
-+        goto out;
-+    }
-+
-+    ret = 0;
-+out:
-+    blk_unref(blk);
-+    return ret;
-+}
-+
-+int bdrv_create_file(const char *filename, QemuOpts *opts, Error **errp)
-+{
-+    BlockDriver *drv;
-+
-     drv = bdrv_find_protocol(filename, true, errp);
-     if (drv == NULL) {
-         return -ENOENT;
-     }
- 
--    ret = bdrv_create(drv, filename, opts, &local_err);
--    error_propagate(errp, local_err);
--    return ret;
-+    if (drv->bdrv_co_create_opts) {
-+        return bdrv_create(drv, filename, opts, errp);
-+    } else {
-+        return bdrv_create_file_fallback(filename, drv, opts, errp);
-+    }
- }
- 
- /**
-@@ -1422,6 +1541,24 @@ QemuOptsList bdrv_runtime_opts = {
-     },
- };
- 
-+static QemuOptsList fallback_create_opts = {
-+    .name = "fallback-create-opts",
-+    .head = QTAILQ_HEAD_INITIALIZER(fallback_create_opts.head),
-+    .desc = {
-+        {
-+            .name = BLOCK_OPT_SIZE,
-+            .type = QEMU_OPT_SIZE,
-+            .help = "Virtual disk size"
-+        },
-+        {
-+            .name = BLOCK_OPT_PREALLOC,
-+            .type = QEMU_OPT_STRING,
-+            .help = "Preallocation mode (allowed values: off)"
-+        },
-+        { /* end of list */ }
-+    }
-+};
-+
- /*
-  * Common part for opening disk images and files
-  *
-@@ -5743,14 +5880,12 @@ void bdrv_img_create(const char *filename, const char *fmt,
-         return;
-     }
- 
--    if (!proto_drv->create_opts) {
--        error_setg(errp, "Protocol driver '%s' does not support image creation",
--                   proto_drv->format_name);
--        return;
--    }
--
-     create_opts = qemu_opts_append(create_opts, drv->create_opts);
--    create_opts = qemu_opts_append(create_opts, proto_drv->create_opts);
-+    if (proto_drv->create_opts) {
-+        create_opts = qemu_opts_append(create_opts, proto_drv->create_opts);
-+    } else {
-+        create_opts = qemu_opts_append(create_opts, &fallback_create_opts);
-+    }
- 
-     /* Create parameter list with default values */
-     opts = qemu_opts_create(create_opts, NULL, 0, &error_abort);
--- 
-1.8.3.1
-

SOURCES/kvm-block-Increase-BB.in_flight-for-coroutine-and-sync-i.patch

@@ -1,295 +0,0 @@
-From 52cc1d1cd2f695c5761d65baec961d14552a79ed Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Wed, 8 Apr 2020 17:29:16 +0100
-Subject: [PATCH 5/6] block: Increase BB.in_flight for coroutine and sync
- interfaces
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-Message-id: <20200408172917.18712-6-kwolf@redhat.com>
-Patchwork-id: 94600
-O-Subject: [RHEL-AV-8.2.0 qemu-kvm PATCH 5/6] block: Increase BB.in_flight for coroutine and sync interfaces
-Bugzilla: 1817621
-RH-Acked-by: Eric Blake <eblake@redhat.com>
-RH-Acked-by: Danilo de Paula <ddepaula@redhat.com>
-RH-Acked-by: Max Reitz <mreitz@redhat.com>
-
-External callers of blk_co_*() and of the synchronous blk_*() functions
-don't currently increase the BlockBackend.in_flight counter, but calls
-from blk_aio_*() do, so there is an inconsistency whether the counter
-has been increased or not.
-
-This patch moves the actual operations to static functions that can
-later know they will always be called with in_flight increased exactly
-once, even for external callers using the blk_co_*() coroutine
-interfaces.
-
-If the public blk_co_*() interface is unused, remove it.
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Message-Id: <20200407121259.21350-3-kwolf@redhat.com>
-Reviewed-by: Max Reitz <mreitz@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit fbb92b6798894d3bf62fe3578d99fa62c720b242)
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
----
- block/block-backend.c          | 103 ++++++++++++++++++++++++++++++++---------
- include/sysemu/block-backend.h |   1 -
- 2 files changed, 80 insertions(+), 24 deletions(-)
-
-diff --git a/block/block-backend.c b/block/block-backend.c
-index 17b2e87..610dbfa 100644
---- a/block/block-backend.c
-+++ b/block/block-backend.c
-@@ -1147,9 +1147,10 @@ static void coroutine_fn blk_wait_while_drained(BlockBackend *blk)
-     }
- }
- 
--int coroutine_fn blk_co_preadv(BlockBackend *blk, int64_t offset,
--                               unsigned int bytes, QEMUIOVector *qiov,
--                               BdrvRequestFlags flags)
-+/* To be called between exactly one pair of blk_inc/dec_in_flight() */
-+static int coroutine_fn
-+blk_do_preadv(BlockBackend *blk, int64_t offset, unsigned int bytes,
-+              QEMUIOVector *qiov, BdrvRequestFlags flags)
- {
-     int ret;
-     BlockDriverState *bs;
-@@ -1178,10 +1179,24 @@ int coroutine_fn blk_co_preadv(BlockBackend *blk, int64_t offset,
-     return ret;
- }
- 
--int coroutine_fn blk_co_pwritev_part(BlockBackend *blk, int64_t offset,
--                                     unsigned int bytes,
--                                     QEMUIOVector *qiov, size_t qiov_offset,
--                                     BdrvRequestFlags flags)
-+int coroutine_fn blk_co_preadv(BlockBackend *blk, int64_t offset,
-+                               unsigned int bytes, QEMUIOVector *qiov,
-+                               BdrvRequestFlags flags)
-+{
-+    int ret;
-+
-+    blk_inc_in_flight(blk);
-+    ret = blk_do_preadv(blk, offset, bytes, qiov, flags);
-+    blk_dec_in_flight(blk);
-+
-+    return ret;
-+}
-+
-+/* To be called between exactly one pair of blk_inc/dec_in_flight() */
-+static int coroutine_fn
-+blk_do_pwritev_part(BlockBackend *blk, int64_t offset, unsigned int bytes,
-+                    QEMUIOVector *qiov, size_t qiov_offset,
-+                    BdrvRequestFlags flags)
- {
-     int ret;
-     BlockDriverState *bs;
-@@ -1214,6 +1229,20 @@ int coroutine_fn blk_co_pwritev_part(BlockBackend *blk, int64_t offset,
-     return ret;
- }
- 
-+int coroutine_fn blk_co_pwritev_part(BlockBackend *blk, int64_t offset,
-+                                     unsigned int bytes,
-+                                     QEMUIOVector *qiov, size_t qiov_offset,
-+                                     BdrvRequestFlags flags)
-+{
-+    int ret;
-+
-+    blk_inc_in_flight(blk);
-+    ret = blk_do_pwritev_part(blk, offset, bytes, qiov, qiov_offset, flags);
-+    blk_dec_in_flight(blk);
-+
-+    return ret;
-+}
-+
- int coroutine_fn blk_co_pwritev(BlockBackend *blk, int64_t offset,
-                                 unsigned int bytes, QEMUIOVector *qiov,
-                                 BdrvRequestFlags flags)
-@@ -1234,7 +1263,7 @@ static void blk_read_entry(void *opaque)
-     BlkRwCo *rwco = opaque;
-     QEMUIOVector *qiov = rwco->iobuf;
- 
--    rwco->ret = blk_co_preadv(rwco->blk, rwco->offset, qiov->size,
-+    rwco->ret = blk_do_preadv(rwco->blk, rwco->offset, qiov->size,
-                               qiov, rwco->flags);
-     aio_wait_kick();
- }
-@@ -1244,8 +1273,8 @@ static void blk_write_entry(void *opaque)
-     BlkRwCo *rwco = opaque;
-     QEMUIOVector *qiov = rwco->iobuf;
- 
--    rwco->ret = blk_co_pwritev(rwco->blk, rwco->offset, qiov->size,
--                               qiov, rwco->flags);
-+    rwco->ret = blk_do_pwritev_part(rwco->blk, rwco->offset, qiov->size,
-+                                    qiov, 0, rwco->flags);
-     aio_wait_kick();
- }
- 
-@@ -1262,6 +1291,7 @@ static int blk_prw(BlockBackend *blk, int64_t offset, uint8_t *buf,
-         .ret    = NOT_DONE,
-     };
- 
-+    blk_inc_in_flight(blk);
-     if (qemu_in_coroutine()) {
-         /* Fast-path if already in coroutine context */
-         co_entry(&rwco);
-@@ -1270,6 +1300,7 @@ static int blk_prw(BlockBackend *blk, int64_t offset, uint8_t *buf,
-         bdrv_coroutine_enter(blk_bs(blk), co);
-         BDRV_POLL_WHILE(blk_bs(blk), rwco.ret == NOT_DONE);
-     }
-+    blk_dec_in_flight(blk);
- 
-     return rwco.ret;
- }
-@@ -1394,7 +1425,7 @@ static void blk_aio_read_entry(void *opaque)
-     }
- 
-     assert(qiov->size == acb->bytes);
--    rwco->ret = blk_co_preadv(rwco->blk, rwco->offset, acb->bytes,
-+    rwco->ret = blk_do_preadv(rwco->blk, rwco->offset, acb->bytes,
-                               qiov, rwco->flags);
-     blk_aio_complete(acb);
- }
-@@ -1412,8 +1443,8 @@ static void blk_aio_write_entry(void *opaque)
-     }
- 
-     assert(!qiov || qiov->size == acb->bytes);
--    rwco->ret = blk_co_pwritev(rwco->blk, rwco->offset, acb->bytes,
--                               qiov, rwco->flags);
-+    rwco->ret = blk_do_pwritev_part(rwco->blk, rwco->offset, acb->bytes,
-+                                    qiov, 0, rwco->flags);
-     blk_aio_complete(acb);
- }
- 
-@@ -1498,7 +1529,9 @@ void blk_aio_cancel_async(BlockAIOCB *acb)
-     bdrv_aio_cancel_async(acb);
- }
- 
--int blk_co_ioctl(BlockBackend *blk, unsigned long int req, void *buf)
-+/* To be called between exactly one pair of blk_inc/dec_in_flight() */
-+static int coroutine_fn
-+blk_do_ioctl(BlockBackend *blk, unsigned long int req, void *buf)
- {
-     blk_wait_while_drained(blk);
- 
-@@ -1514,8 +1547,7 @@ static void blk_ioctl_entry(void *opaque)
-     BlkRwCo *rwco = opaque;
-     QEMUIOVector *qiov = rwco->iobuf;
- 
--    rwco->ret = blk_co_ioctl(rwco->blk, rwco->offset,
--                             qiov->iov[0].iov_base);
-+    rwco->ret = blk_do_ioctl(rwco->blk, rwco->offset, qiov->iov[0].iov_base);
-     aio_wait_kick();
- }
- 
-@@ -1529,7 +1561,7 @@ static void blk_aio_ioctl_entry(void *opaque)
-     BlkAioEmAIOCB *acb = opaque;
-     BlkRwCo *rwco = &acb->rwco;
- 
--    rwco->ret = blk_co_ioctl(rwco->blk, rwco->offset, rwco->iobuf);
-+    rwco->ret = blk_do_ioctl(rwco->blk, rwco->offset, rwco->iobuf);
- 
-     blk_aio_complete(acb);
- }
-@@ -1540,7 +1572,9 @@ BlockAIOCB *blk_aio_ioctl(BlockBackend *blk, unsigned long int req, void *buf,
-     return blk_aio_prwv(blk, req, 0, buf, blk_aio_ioctl_entry, 0, cb, opaque);
- }
- 
--int blk_co_pdiscard(BlockBackend *blk, int64_t offset, int bytes)
-+/* To be called between exactly one pair of blk_inc/dec_in_flight() */
-+static int coroutine_fn
-+blk_do_pdiscard(BlockBackend *blk, int64_t offset, int bytes)
- {
-     int ret;
- 
-@@ -1559,7 +1593,7 @@ static void blk_aio_pdiscard_entry(void *opaque)
-     BlkAioEmAIOCB *acb = opaque;
-     BlkRwCo *rwco = &acb->rwco;
- 
--    rwco->ret = blk_co_pdiscard(rwco->blk, rwco->offset, acb->bytes);
-+    rwco->ret = blk_do_pdiscard(rwco->blk, rwco->offset, acb->bytes);
-     blk_aio_complete(acb);
- }
- 
-@@ -1571,12 +1605,23 @@ BlockAIOCB *blk_aio_pdiscard(BlockBackend *blk,
-                         cb, opaque);
- }
- 
-+int coroutine_fn blk_co_pdiscard(BlockBackend *blk, int64_t offset, int bytes)
-+{
-+    int ret;
-+
-+    blk_inc_in_flight(blk);
-+    ret = blk_do_pdiscard(blk, offset, bytes);
-+    blk_dec_in_flight(blk);
-+
-+    return ret;
-+}
-+
- static void blk_pdiscard_entry(void *opaque)
- {
-     BlkRwCo *rwco = opaque;
-     QEMUIOVector *qiov = rwco->iobuf;
- 
--    rwco->ret = blk_co_pdiscard(rwco->blk, rwco->offset, qiov->size);
-+    rwco->ret = blk_do_pdiscard(rwco->blk, rwco->offset, qiov->size);
-     aio_wait_kick();
- }
- 
-@@ -1585,7 +1630,8 @@ int blk_pdiscard(BlockBackend *blk, int64_t offset, int bytes)
-     return blk_prw(blk, offset, NULL, bytes, blk_pdiscard_entry, 0);
- }
- 
--int blk_co_flush(BlockBackend *blk)
-+/* To be called between exactly one pair of blk_inc/dec_in_flight() */
-+static int coroutine_fn blk_do_flush(BlockBackend *blk)
- {
-     blk_wait_while_drained(blk);
- 
-@@ -1601,7 +1647,7 @@ static void blk_aio_flush_entry(void *opaque)
-     BlkAioEmAIOCB *acb = opaque;
-     BlkRwCo *rwco = &acb->rwco;
- 
--    rwco->ret = blk_co_flush(rwco->blk);
-+    rwco->ret = blk_do_flush(rwco->blk);
-     blk_aio_complete(acb);
- }
- 
-@@ -1611,10 +1657,21 @@ BlockAIOCB *blk_aio_flush(BlockBackend *blk,
-     return blk_aio_prwv(blk, 0, 0, NULL, blk_aio_flush_entry, 0, cb, opaque);
- }
- 
-+int coroutine_fn blk_co_flush(BlockBackend *blk)
-+{
-+    int ret;
-+
-+    blk_inc_in_flight(blk);
-+    ret = blk_do_flush(blk);
-+    blk_dec_in_flight(blk);
-+
-+    return ret;
-+}
-+
- static void blk_flush_entry(void *opaque)
- {
-     BlkRwCo *rwco = opaque;
--    rwco->ret = blk_co_flush(rwco->blk);
-+    rwco->ret = blk_do_flush(rwco->blk);
-     aio_wait_kick();
- }
- 
-diff --git a/include/sysemu/block-backend.h b/include/sysemu/block-backend.h
-index b198dec..9bbdbd6 100644
---- a/include/sysemu/block-backend.h
-+++ b/include/sysemu/block-backend.h
-@@ -171,7 +171,6 @@ BlockAIOCB *blk_aio_pdiscard(BlockBackend *blk, int64_t offset, int bytes,
-                              BlockCompletionFunc *cb, void *opaque);
- void blk_aio_cancel(BlockAIOCB *acb);
- void blk_aio_cancel_async(BlockAIOCB *acb);
--int blk_co_ioctl(BlockBackend *blk, unsigned long int req, void *buf);
- int blk_ioctl(BlockBackend *blk, unsigned long int req, void *buf);
- BlockAIOCB *blk_aio_ioctl(BlockBackend *blk, unsigned long int req, void *buf,
-                           BlockCompletionFunc *cb, void *opaque);
--- 
-1.8.3.1
-

SOURCES/kvm-block-Introduce-bdrv_reopen_commit_post-step.patch

@@ -1,65 +0,0 @@
-From f7dd953c2d0380cef3c351afb03d68c6fcda1dca Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Fri, 13 Mar 2020 12:34:28 +0000
-Subject: [PATCH 08/20] block: Introduce 'bdrv_reopen_commit_post' step
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-Message-id: <20200313123439.10548-3-kwolf@redhat.com>
-Patchwork-id: 94278
-O-Subject: [RHEL-AV-8.2.0 qemu-kvm PATCH v2 02/13] block: Introduce 'bdrv_reopen_commit_post' step
-Bugzilla: 1790482 1805143
-RH-Acked-by: John Snow <jsnow@redhat.com>
-RH-Acked-by: Daniel P. Berrange <berrange@redhat.com>
-RH-Acked-by: Peter Krempa <pkrempa@redhat.com>
-
-From: Peter Krempa <pkrempa@redhat.com>
-
-Add another step in the reopen process where driver can execute code
-after permission changes are comitted.
-
-Signed-off-by: Peter Krempa <pkrempa@redhat.com>
-Message-Id: <adc02cf591c3cb34e98e33518eb1c540a0f27db1.1582893284.git.pkrempa@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 17e1e2be5f9e84e0298e28e70675655b43e225ea)
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
----
- block.c                   | 9 +++++++++
- include/block/block_int.h | 1 +
- 2 files changed, 10 insertions(+)
-
-diff --git a/block.c b/block.c
-index e1a4e38..a744bb5 100644
---- a/block.c
-+++ b/block.c
-@@ -3657,6 +3657,15 @@ cleanup_perm:
-             }
-         }
-     }
-+
-+    if (ret == 0) {
-+        QTAILQ_FOREACH_REVERSE(bs_entry, bs_queue, entry) {
-+            BlockDriverState *bs = bs_entry->state.bs;
-+
-+            if (bs->drv->bdrv_reopen_commit_post)
-+                bs->drv->bdrv_reopen_commit_post(&bs_entry->state);
-+        }
-+    }
- cleanup:
-     QTAILQ_FOREACH_SAFE(bs_entry, bs_queue, entry, next) {
-         if (ret) {
-diff --git a/include/block/block_int.h b/include/block/block_int.h
-index dd033d0..c168690 100644
---- a/include/block/block_int.h
-+++ b/include/block/block_int.h
-@@ -123,6 +123,7 @@ struct BlockDriver {
-     int (*bdrv_reopen_prepare)(BDRVReopenState *reopen_state,
-                                BlockReopenQueue *queue, Error **errp);
-     void (*bdrv_reopen_commit)(BDRVReopenState *reopen_state);
-+    void (*bdrv_reopen_commit_post)(BDRVReopenState *reopen_state);
-     void (*bdrv_reopen_abort)(BDRVReopenState *reopen_state);
-     void (*bdrv_join_options)(QDict *options, QDict *old_options);
- 
--- 
-1.8.3.1
-

SOURCES/kvm-block-Lock-AioContext-for-drain_end-in-blockdev-reop.patch

@@ -0,0 +1,63 @@
+From b21fa5ecd9acf2b91839a2915fb4bb39dac4c803 Mon Sep 17 00:00:00 2001
+From: Kevin Wolf <kwolf@redhat.com>
+Date: Thu, 3 Feb 2022 15:05:33 +0100
+Subject: [PATCH 2/5] block: Lock AioContext for drain_end in blockdev-reopen
+
+RH-Author: Kevin Wolf <kwolf@redhat.com>
+RH-MergeRequest: 142: block: Lock AioContext for drain_end in blockdev-reopen
+RH-Commit: [1/2] 98de3b5987f88ea6b4b503f623d6c4475574e037
+RH-Bugzilla: 2067118
+RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+RH-Acked-by: Hanna Reitz <hreitz@redhat.com>
+
+bdrv_subtree_drained_end() requires the caller to hold the AioContext
+lock for the drained node. Not doing this for nodes outside of the main
+AioContext leads to crashes when AIO_WAIT_WHILE() needs to wait and
+tries to temporarily release the lock.
+
+Fixes: 3908b7a8994fa5ef7a89aa58cd5a02fc58141592
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2046659
+Reported-by: Qing Wang <qinwang@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+Message-Id: <20220203140534.36522-2-kwolf@redhat.com>
+Reviewed-by: Hanna Reitz <hreitz@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit aba8205be0707b9d108e32254e186ba88107a869)
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ blockdev.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/blockdev.c b/blockdev.c
+index b35072644e..565f6a81fd 100644
+--- a/blockdev.c
++++ b/blockdev.c
+@@ -3562,6 +3562,7 @@ void qmp_blockdev_reopen(BlockdevOptionsList *reopen_list, Error **errp)
+ {
+     BlockReopenQueue *queue = NULL;
+     GSList *drained = NULL;
++    GSList *p;
+ 
+     /* Add each one of the BDS that we want to reopen to the queue */
+     for (; reopen_list != NULL; reopen_list = reopen_list->next) {
+@@ -3611,7 +3612,15 @@ void qmp_blockdev_reopen(BlockdevOptionsList *reopen_list, Error **errp)
+ 
+ fail:
+     bdrv_reopen_queue_free(queue);
+-    g_slist_free_full(drained, (GDestroyNotify) bdrv_subtree_drained_end);
++    for (p = drained; p; p = p->next) {
++        BlockDriverState *bs = p->data;
++        AioContext *ctx = bdrv_get_aio_context(bs);
++
++        aio_context_acquire(ctx);
++        bdrv_subtree_drained_end(bs);
++        aio_context_release(ctx);
++    }
++    g_slist_free(drained);
+ }
+ 
+ void qmp_blockdev_del(const char *node_name, Error **errp)
+-- 
+2.27.0
+

SOURCES/kvm-block-Make-bdrv_get_cumulative_perm-public.patch

@@ -1,67 +0,0 @@
-From 294ab4c4963295556d12ac15150b48c8536175a7 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Fri, 13 Mar 2020 12:34:33 +0000
-Subject: [PATCH 13/20] block: Make bdrv_get_cumulative_perm() public
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-Message-id: <20200313123439.10548-8-kwolf@redhat.com>
-Patchwork-id: 94287
-O-Subject: [RHEL-AV-8.2.0 qemu-kvm PATCH v2 07/13] block: Make bdrv_get_cumulative_perm() public
-Bugzilla: 1790482 1805143
-RH-Acked-by: John Snow <jsnow@redhat.com>
-RH-Acked-by: Daniel P. Berrange <berrange@redhat.com>
-RH-Acked-by: Peter Krempa <pkrempa@redhat.com>
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Message-Id: <20200310113831.27293-2-kwolf@redhat.com>
-Reviewed-by: Peter Krempa <pkrempa@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit c7a0f2be8f95b220cdadbba9a9236eaf115951dc)
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
----
- block.c                   | 6 ++----
- include/block/block_int.h | 3 +++
- 2 files changed, 5 insertions(+), 4 deletions(-)
-
-diff --git a/block.c b/block.c
-index 39e4647..354d388 100644
---- a/block.c
-+++ b/block.c
-@@ -1850,8 +1850,6 @@ static int bdrv_child_check_perm(BdrvChild *c, BlockReopenQueue *q,
-                                  bool *tighten_restrictions, Error **errp);
- static void bdrv_child_abort_perm_update(BdrvChild *c);
- static void bdrv_child_set_perm(BdrvChild *c, uint64_t perm, uint64_t shared);
--static void bdrv_get_cumulative_perm(BlockDriverState *bs, uint64_t *perm,
--                                     uint64_t *shared_perm);
- 
- typedef struct BlockReopenQueueEntry {
-      bool prepared;
-@@ -2075,8 +2073,8 @@ static void bdrv_set_perm(BlockDriverState *bs, uint64_t cumulative_perms,
-     }
- }
- 
--static void bdrv_get_cumulative_perm(BlockDriverState *bs, uint64_t *perm,
--                                     uint64_t *shared_perm)
-+void bdrv_get_cumulative_perm(BlockDriverState *bs, uint64_t *perm,
-+                              uint64_t *shared_perm)
- {
-     BdrvChild *c;
-     uint64_t cumulative_perms = 0;
-diff --git a/include/block/block_int.h b/include/block/block_int.h
-index c168690..96e327b 100644
---- a/include/block/block_int.h
-+++ b/include/block/block_int.h
-@@ -1228,6 +1228,9 @@ BdrvChild *bdrv_root_attach_child(BlockDriverState *child_bs,
-                                   void *opaque, Error **errp);
- void bdrv_root_unref_child(BdrvChild *child);
- 
-+void bdrv_get_cumulative_perm(BlockDriverState *bs, uint64_t *perm,
-+                              uint64_t *shared_perm);
-+
- /**
-  * Sets a BdrvChild's permissions.  Avoid if the parent is a BDS; use
-  * bdrv_child_refresh_perms() instead and make the parent's
--- 
-1.8.3.1
-

SOURCES/kvm-block-Make-bdrv_refresh_limits-non-recursive.patch

@@ -0,0 +1,78 @@
+From 6348063b91b2370cc27153fd58fd11a6681631f6 Mon Sep 17 00:00:00 2001
+From: Hanna Reitz <hreitz@redhat.com>
+Date: Wed, 16 Feb 2022 11:53:53 +0100
+Subject: [PATCH 22/24] block: Make bdrv_refresh_limits() non-recursive
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Hanna Reitz <hreitz@redhat.com>
+RH-MergeRequest: 189: block: Make bdrv_refresh_limits() non-recursive
+RH-Commit: [1/3] 1a1fe37f8d8f0344dd8639d6cc9d884d1aff9096
+RH-Bugzilla: 2072932
+RH-Acked-by: Eric Blake <eblake@redhat.com>
+RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
+
+bdrv_refresh_limits() recurses down to the node's children.  That does
+not seem necessary: When we refresh limits on some node, and then
+recurse down and were to change one of its children's BlockLimits, then
+that would mean we noticed the changed limits by pure chance.  The fact
+that we refresh the parent's limits has nothing to do with it, so the
+reason for the change probably happened before this point in time, and
+we should have refreshed the limits then.
+
+Consequently, we should actually propagate block limits changes upwards,
+not downwards.  That is a separate and pre-existing issue, though, and
+so will not be addressed in this patch.
+
+The problem with recursing is that bdrv_refresh_limits() is not atomic.
+It begins with zeroing BDS.bl, and only then sets proper, valid limits.
+If we do not drain all nodes whose limits are refreshed, then concurrent
+I/O requests can encounter invalid request_alignment values and crash
+qemu.  Therefore, a recursing bdrv_refresh_limits() requires the whole
+subtree to be drained, which is currently not ensured by most callers.
+
+A non-recursive bdrv_refresh_limits() only requires the node in question
+to not receive I/O requests, and this is done by most callers in some
+way or another:
+- bdrv_open_driver() deals with a new node with no parents yet
+- bdrv_set_file_or_backing_noperm() acts on a drained node
+- bdrv_reopen_commit() acts only on drained nodes
+- bdrv_append() should in theory require the node to be drained; in
+  practice most callers just lock the AioContext, which should at least
+  be enough to prevent concurrent I/O requests from accessing invalid
+  limits
+
+So we can resolve the bug by making bdrv_refresh_limits() non-recursive.
+
+Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1879437
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+Reviewed-by: Eric Blake <eblake@redhat.com>
+Message-Id: <20220216105355.30729-2-hreitz@redhat.com>
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit 4d378bbd831bdd2f6e6adcd4ea5b77b6effaa627)
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+---
+ block/io.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/block/io.c b/block/io.c
+index 4e4cb556c5..c3e7301613 100644
+--- a/block/io.c
++++ b/block/io.c
+@@ -189,10 +189,6 @@ void bdrv_refresh_limits(BlockDriverState *bs, Transaction *tran, Error **errp)
+     QLIST_FOREACH(c, &bs->children, next) {
+         if (c->role & (BDRV_CHILD_DATA | BDRV_CHILD_FILTERED | BDRV_CHILD_COW))
+         {
+-            bdrv_refresh_limits(c->bs, tran, errp);
+-            if (*errp) {
+-                return;
+-            }
+             bdrv_merge_limits(&bs->bl, &c->bs->bl);
+             have_limits = true;
+         }
+-- 
+2.35.3
+