423 changed files with 59834 additions and 18045 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1 +1,5 @@
-SOURCES/qemu-7.2.0.tar.xz
+SOURCES/qemu-6.2.0.tar.xz
+SOURCES/tests_data_acpi_pc_SSDT.dimmpxm
+SOURCES/tests_data_acpi_q35_FACP.slic
+SOURCES/tests_data_acpi_q35_SSDT.dimmpxm
+SOURCES/tests_data_acpi_virt_SSDT.memhp
--- a/.qemu-kvm.metadata
+++ b/.qemu-kvm.metadata
@ -1 +1,5 @@
-634a3e4b381cbf13085eb1568accb85cbd9d89c4 SOURCES/qemu-7.2.0.tar.xz
+68cd61a466170115b88817e2d52db2cd7a92f43a SOURCES/qemu-6.2.0.tar.xz
+c4b34092bc5af1ba7febfca1477320fb024e8acd SOURCES/tests_data_acpi_pc_SSDT.dimmpxm
+19349e3517143bd1af56a5444e927ba37a111f72 SOURCES/tests_data_acpi_q35_FACP.slic
+4632d10ae8cedad4d5d760ed211f83f0dc81005d SOURCES/tests_data_acpi_q35_SSDT.dimmpxm
+ef12eed43cc357fb134db6fa3c7ffc83e222a97d SOURCES/tests_data_acpi_virt_SSDT.memhp
--- a/SOURCES/0001-redhat-Adding-slirp-to-the-exploded-tree.patch
+++ b/SOURCES/0001-redhat-Adding-slirp-to-the-exploded-tree.patch
--- a/SOURCES/0004-Initial-redhat-build.patch
+++ b/SOURCES/0004-Initial-redhat-build.patch
@ -1,302 +0,0 @@
-From ccc4a5bdc8c2f27678312364a7c12aeafd009bb6 Mon Sep 17 00:00:00 2001
-From: Miroslav Rezanina <mrezanin@redhat.com>
-Date: Wed, 26 May 2021 10:56:02 +0200
-Subject: Initial redhat build
-
-This patch introduces redhat build structure in redhat subdirectory. In addition,
-several issues are fixed in QEMU tree:
-
- Change of app name for sasl_server_init in VNC code from qemu to qemu-kvm
- - As we use qemu-kvm as name in all places, this is updated to be consistent
- Man page renamed from qemu to qemu-kvm
- - man page is installed using make install so we have to fix it in qemu tree
-
-We disable make check due to issues with some of the tests.
-
-This rebase is based on qemu-kvm-7.1.0-7.el9
-
-Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
--
-Rebase changes (6.1.0):
- Move build to .distro
- Move changes for support file to related commit
- Added dependency for python3-sphinx-rtd_theme
- Removed --disable-sheepdog configure option
- Added new hw-display modules
- SASL initialization moved to ui/vnc-auth-sasl.c
- Add accel-qtest-<arch> and accel-tcg-x86_64 libraries
- Added hw-usb-host module
- Disable new configure options (bpf, nvmm, slirp-smbd)
- Use -pie for ksmctl build (annocheck complain fix)
-
-Rebase changes (6.2.0):
- removed --disable-jemalloc and --disable-tcmalloc configure options
- added audio-oss.so
- added fdt requirement for x86_64
- tests/acceptance renamed to tests/avocado
- added multiboot_dma.bin
- Add -Wno-string-plus-int to extra flags
- Updated configure options
-
-Rebase changes (7.0.0):
- Do not use -mlittle CFLAG on ppc64le
- Used upstream handling issue with ui/clipboard.c
- Use -mlittle-endian on ppc64le instead of deleteing it in configure
- Drop --disable-libxml2 option for configure (upstream)
- Remove vof roms
- Disable AVX2 support
- Use internal meson
- Disable new configure options (dbus-display and qga-vss)
- Change permissions on installing tests/Makefile.include
- Remove ssh block driver
-
-Rebase changes (7.1.0 rc0):
- --disable-vnc-png renamed to --disable-png (upstream)
- removed --disable-vhost-vsock and --disable-vhost-scsi
- capstone submodule removed
- Temporary include capstone build
-
-Rebase changes (7.2.0 rc0):
- Switch --enable-slirp=system to --enable-slirp
-
-Rebaes changes (7.2.0 rc2):
- Added new configure options (blkio and sndio, both disabled)
-
-Rebase changes (7.2.0):
- Fix SRPM name generation to work on Fedora 37
- Switch back to system meson
-
-Merged patches (6.0.0):
- - 605758c902 Limit build on Power to qemu-img and qemu-ga only
-
-Merged patches (6.1.0):
- f04f91751f Use cached tarballs
- 6581165c65 Remove message with running VM count
- 03c3cac9fc spec-file: build qemu-kvm without SPICE and QXL
- e0ae6c1f6c spec-file: Obsolete qemu-kvm-ui-spice
- 9d2e9f9ecf spec: Do not build qemu-kvm-block-gluster
- cf470b4234 spec: Do not link pcnet and ne2k_pci roms
- e981284a6b redhat: Install the s390-netboot.img that we've built
- 24ef557f33 spec: Remove usage of Group: tag
- c40d69b4f4 spec: Drop %defattr usage
- f8e98798ce spec: Clean up BuildRequires
- 47246b43ee spec: Remove iasl BuildRequires
- 170dc1cbe0 spec: Remove redundant 0 in conditionals
- 8718f6fa11 spec: Add more have_XXX conditionals
- a001269ce9 spec: Remove binutils versioned Requires
- 34545ee641 spec: Remove diffutils BuildRequires
- c2c82beac9 spec: Remove redundant Requires:
- 9314c231f4 spec: Add XXX_version macros
- c43db0bf0f spec: Add have_block_rbd
- 3ecb0c0319 qga: drop StandardError=syslog
- 018049dc80 Remove iscsi support
- a2edf18777 redhat: Replace the kvm-setup.service with a /etc/modules-load.d config file
- 387b5fbcfe redhat: Move qemu-kvm-docs dependency to qemu-kvm
- 4ead693178 redhat: introducting qemu-kvm-hw-usbredir
- 4dc6fc3035 redhat: use the standard vhost-user JSON path
- 84757178b4 Fix local build
- 8c394227dd spec: Restrict block drivers in tools
- b6aa7c1fae Move tools to separate package
- eafd82e509 Split qemu-pr-helper to separate package
- 2c0182e2aa spec: RPM_BUILD_ROOT -> %{buildroot}
- 91bd55ca13 spec: More use of %{name} instead of 'qemu-kvm'
- 50ba299c61 spec: Use qemu-pr-helper.service from qemu.git (partial)
- ee08d4e0a3 spec: Use %{_sourcedir} for referencing sources
- 039e7f7d02 spec: Add tools_only
- 884ba71617 spec: %build: Add run_configure helper
- 8ebd864d65 spec: %build: Disable more bits with %{disable_everything} (partial)
- f23fdb53f5 spec: %build: Add macros for some 'configure' parameters
- fe951a8bd8 spec: %files: Move qemu-guest-agent and qemu-img earlier
- 353b632e37 spec: %install: Remove redundant bits
- 9d2015b752 spec: %install: Add %{modprobe_kvm_conf} macro
- 6d05134e8c spec: %install: Remove qemu-guest-agent /etc/qemu-kvm usage
- 985b226467 spec: %install: clean up qemu-ga section
- dfaf9c600d spec: %install: Use a single %{tools_only} section
- f6978ddb46 spec: Make tools_only not cross spec sections
- 071c211098 spec: %install: Limit time spent in %{qemu_kvm_build}
- 1b65c674be spec: misc syntactic merges with Fedora
- 4da16294cf spec: Use Fedora's pattern for specifying rc version
- d7ee259a79 spec: %files: don't use fine grained -docs file list
- 64cad0c60f spec: %files: Add licenses to qemu-common too
- c3de4f080a spec: %install: Drop python3 shebang fixup
- 46fc216115 Update local build to work with spec file improvements
- bab9531548 spec: Remove buildldflags
- c8360ab6a9 spec: Use %make_build macro
- f6966c66e9 spec: Drop make install sharedir and datadir usage
- 86982421bc spec: use %make_install macro
- 191c405d22 spec: parallelize `make check`
- 251a1fb958 spec: Drop explicit --build-id
- 44c7dda6c3 spec: use %{build_ldflags}
- 0009a34354 Move virtiofsd to separate package
-  34d1b200b3 Utilize --firmware configure option
- 2800e1dd03 spec: Switch toolchain to Clang/LLVM (except process-patches.sh)
- e8a70f500f spec: Use safe-stack for x86_64
- e29445d50d spec: Reenable write support for VMDK etc. in tools
- a4fe2a3e16 redhat: Disable LTO on non-x86 architectures
-
-Merged patches (6.2.0):
- 333452440b remove sgabios dependency
- 7d3633f184 enable pulseaudio
- bd898709b0 spec: disable use of gcrypt for crypto backends in favour of gnutls
- e4f0c6dee6 spec: Remove block-curl and block-ssh dependency
- 4dc13bfe63 spec: Build the VDI block driver
- d2f2ff3c74 spec: Explicitly include compress filter
- a7d047f9c2 Move ksmtuned files to separate package
-
-Merged patches (7.0.0):
- 098d4d08d0 spec: Rename qemu-kvm-hw-usbredir to qemu-kvm-device-usb-redirect
- c2bd0d6834 spec: Split qemu-kvm-ui-opengl
- 2c9cda805d spec: Introduce packages for virtio-gpu-* modules (changed as rhel device tree not set)
- d0414a3e0b spec: Introduce device-display-virtio-vga* packages
- 3534ec46d4 spec: Move usb-host module to separate package
- ddc14d4737 spec: Move qtest accel module to tests package
- 6f2c4befa6 spec: Extend qemu-kvm-core description
- 6f11866e4e (rhel/rhel-9.0.0) Update to qemu-kvm-6.2.0-6.el9
- da0a28758f ui/clipboard: fix use-after-free regression
- 895d4d52eb spec: Remove qemu-virtiofsd
- c8c8c8bd84 spec: Fix obsolete for spice subpackages
- d46d2710b2 spec: Obsolete old usb redir subpackage
- 6f52a50b68 spec: Obsolete ssh driver
-
-Merged patches (7.2.0 rc4):
- 8c6834feb6 Remove opengl display device subpackages (C9S MR 124)
- 0ecc97f29e spec: Add requires for packages with additional virtio-gpu variants (C9S MR 124)
-
-Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
-
-fix
---
- .distro/Makefile                        |  100 +
- .distro/Makefile.common                 |   41 +
- .distro/README.tests                    |   39 +
- .distro/modules-load.conf               |    4 +
- .distro/qemu-guest-agent.service        |    1 -
- .distro/qemu-kvm.spec.template          | 4315 +++++++++++++++++++++++
- .distro/rpminspect.yaml                 |    6 +-
- .distro/scripts/extract_build_cmd.py    |   12 +
- .distro/scripts/process-patches.sh      |    4 +
- .gitignore                              |    1 +
- README.systemtap                        |   43 +
- scripts/qemu-guest-agent/fsfreeze-hook  |    2 +-
- scripts/systemtap/conf.d/qemu_kvm.conf  |    4 +
- scripts/systemtap/script.d/qemu_kvm.stp |    1 +
- tests/check-block.sh                    |    2 +
- ui/vnc-auth-sasl.c                      |    2 +-
- 16 files changed, 4573 insertions(+), 4 deletions(-)
- create mode 100644 .distro/Makefile
- create mode 100644 .distro/Makefile.common
- create mode 100644 .distro/README.tests
- create mode 100644 .distro/modules-load.conf
- create mode 100644 .distro/qemu-kvm.spec.template
- create mode 100644 README.systemtap
- create mode 100644 scripts/systemtap/conf.d/qemu_kvm.conf
- create mode 100644 scripts/systemtap/script.d/qemu_kvm.stp
-
-diff --git a/README.systemtap b/README.systemtap
-new file mode 100644
-index 0000000000..ad913fc990
--- /dev/null
-+++ b/README.systemtap
-@@ -0,0 +1,43 @@
-+QEMU tracing using systemtap-initscript
-+---------------------------------------
-+
-+You can capture QEMU trace data all the time using systemtap-initscript.  This
-+uses SystemTap's flight recorder mode to trace all running guests to a
-+fixed-size buffer on the host.  Old trace entries are overwritten by new
-+entries when the buffer size wraps.
-+
-+1. Install the systemtap-initscript package:
-+  # yum install systemtap-initscript
-+
-+2. Install the systemtap scripts and the conf file:
-+  # cp /usr/share/qemu-kvm/systemtap/script.d/qemu_kvm.stp /etc/systemtap/script.d/
-+  # cp /usr/share/qemu-kvm/systemtap/conf.d/qemu_kvm.conf /etc/systemtap/conf.d/
-+
-+The set of trace events to enable is given in qemu_kvm.stp.  This SystemTap
-+script can be customized to add or remove trace events provided in
-+/usr/share/systemtap/tapset/qemu-kvm-simpletrace.stp.
-+
-+SystemTap customizations can be made to qemu_kvm.conf to control the flight
-+recorder buffer size and whether to store traces in memory only or disk too.
-+See stap(1) for option documentation.
-+
-+3. Start the systemtap service.
-+　# service systemtap start qemu_kvm
-+
-+4. Make the service start at boot time.
-+　# chkconfig systemtap on
-+
-+5. Confirm that the service works.
-+  # service systemtap status qemu_kvm
-+  qemu_kvm is running...
-+
-+When you want to inspect the trace buffer, perform the following steps:
-+
-+1. Dump the trace buffer.
-+  # staprun -A qemu_kvm >/tmp/trace.log
-+
-+2. Start the systemtap service because the preceding step stops the service.
-+  # service systemtap start qemu_kvm
-+
-+3. Translate the trace record to readable format.
-+  # /usr/share/qemu-kvm/simpletrace.py --no-header /usr/share/qemu-kvm/trace-events /tmp/trace.log
-diff --git a/scripts/qemu-guest-agent/fsfreeze-hook b/scripts/qemu-guest-agent/fsfreeze-hook
-index 13aafd4845..e9b84ec028 100755
--- a/scripts/qemu-guest-agent/fsfreeze-hook
-+++ b/scripts/qemu-guest-agent/fsfreeze-hook
-@@ -8,7 +8,7 @@
- # request, it is issued with "thaw" argument after filesystem is thawed.
- 
- LOGFILE=/var/log/qga-fsfreeze-hook.log
-FSFREEZE_D=$(dirname -- "$0")/fsfreeze-hook.d
-+FSFREEZE_D=$(dirname -- "$(realpath $0)")/fsfreeze-hook.d
- 
- # Check whether file $1 is a backup or rpm-generated file and should be ignored
- is_ignored_file() {
-diff --git a/scripts/systemtap/conf.d/qemu_kvm.conf b/scripts/systemtap/conf.d/qemu_kvm.conf
-new file mode 100644
-index 0000000000..372d8160a4
--- /dev/null
-+++ b/scripts/systemtap/conf.d/qemu_kvm.conf
-@@ -0,0 +1,4 @@
-+# Force load uprobes (see BZ#1118352)
-+stap -e 'probe process("/usr/libexec/qemu-kvm").function("main") { printf("") }' -c true
-+
-+qemu_kvm_OPT="-s4" # per-CPU buffer size, in megabytes
-diff --git a/scripts/systemtap/script.d/qemu_kvm.stp b/scripts/systemtap/script.d/qemu_kvm.stp
-new file mode 100644
-index 0000000000..c04abf9449
--- /dev/null
-+++ b/scripts/systemtap/script.d/qemu_kvm.stp
-@@ -0,0 +1 @@
-+probe qemu.kvm.simpletrace.handle_qmp_command,qemu.kvm.simpletrace.monitor_protocol_*,qemu.kvm.simpletrace.migrate_set_state {}
-diff --git a/tests/check-block.sh b/tests/check-block.sh
-index 5de2c1ba0b..6af743f441 100755
--- a/tests/check-block.sh
-+++ b/tests/check-block.sh
-@@ -22,6 +22,8 @@ if [ -z "$(find . -name 'qemu-system-*' -print)" ]; then
-     skip "No qemu-system binary available ==> Not running the qemu-iotests."
- fi
- 
-+exit 0
-+
- cd tests/qemu-iotests
- 
- # QEMU_CHECK_BLOCK_AUTO is used to disable some unstable sub-tests
-diff --git a/ui/vnc-auth-sasl.c b/ui/vnc-auth-sasl.c
-index 47fdae5b21..2a950caa2a 100644
--- a/ui/vnc-auth-sasl.c
-+++ b/ui/vnc-auth-sasl.c
-@@ -42,7 +42,7 @@
- 
- bool vnc_sasl_server_init(Error **errp)
- {
-    int saslErr = sasl_server_init(NULL, "qemu");
-+    int saslErr = sasl_server_init(NULL, "qemu-kvm");
- 
-     if (saslErr != SASL_OK) {
-         error_setg(errp, "Failed to initialize SASL auth: %s",
-- 
-2.31.1
-
--- a/SOURCES/0005-Initial-redhat-build.patch
+++ b/SOURCES/0005-Initial-redhat-build.patch
@ -0,0 +1,351 @@
+From 19ce5ff93ddd6b8a998348f2a5f59f603c5e11b7 Mon Sep 17 00:00:00 2001
+From: Miroslav Rezanina <mrezanin@redhat.com>
+Date: Fri, 12 Oct 2018 07:31:11 +0200
+Subject: Initial redhat build
+
+This patch introduces redhat build structure in redhat subdirectory. In addition,
+several issues are fixed in QEMU tree:
+
+ - Change of app name for sasl_server_init in VNC code from qemu to qemu-kvm
+  - As we use qemu-kvm as name in all places, this is updated to be consistent
+ - Man page renamed from qemu to qemu-kvm
+  - man page is installed using make install so we have to fix it in qemu tree
+
+This rebase includes changes up to qemu-kvm-6.1.0-5.el9
+
+Rebase notes (3.1.0):
+- added new configure options
+
+Rebase notes (4.0.0):
+- Added dependency to perl-Test-Harness (upstream)
+- Added dependency to python3-sphinx (upstream)
+- Change location of icons (upstream)
+- Remove .desktop file (added upstream)
+- Added qemu-trace-stap (added upstream)
+- Removed elf2dmp (added upstream)
+- Remove .buildinfo
+- Added pvh.bin rom (added upstream)
+- Added interop documentation files
+- Use python module instead of qemu.py (upstream)
+
+Rebase notes (4.1.0):
+- Remove edk2 files generated by build
+- Switch to rhel-8.1-candidate build target
+- Remove specs documentation
+- Switched from libssh2 to libssh
+- Add rc0 tarball usage hacks
+- Added BuildRequires for wget, rpm-build and python3-sphinx
+- Removed new unpacked files
+- Update configure line to use new options
+
+Rebase notes (4.2.0):
+- Disable iotest run during make check
+- README renamed to README.rst (upstream)
+- Removed ui-spice-app.so
+- Added relevant changes from "505f7f4 redhat: Adding slirp to the exploded tree"
+- Removed qemu-ga.8 install from spec file - installed by make
+- Removed spapr-rtas.bin (upstream)
+- Require newer SLOF (20191022)
+
+Rebase notes (5.1.0):
+- Use python3 for virtio_seg_max_adjust.py test
+- Removed qemu-trace-stap shebang from spec file
+- Added virtiofsd.1 (upstream)
+- Use out-of-tree build
+- New documentation structure (upstream)
+- Update local build
+- Removing installed qemu-storage-daemon (added upstream)
+- Removing opensbi-riscv32-sifive_u-fw_jump.bin (added upstream)
+- Disable iotests (moved from Enable make check commit)
+- Added missing configure options
+- Reorder configure options
+- qemu-pr-helper moved to /usr/libexec/ (upstream)
+- Added submodules for usb-redir, smartcard-reader and qxl display (upstream)
+- Added setting rc version in Makefile for build
+- removed --disable-vxhs configure option (removed upstream)
+- bumped required libusbx-devel version to 1.0.23
+- bumped libfdt version to 1.6.0
+
+Rebase notes (5.2.0 rc0):
+- Move libfdt dependency to qemu-kvm-core
+- Move manpage rename from Makefile to spec file
+- rename with-confsuffix configure option to with-suffix (upstream)
+- Bump libusbx Requires version to 1.0.234
+- Manual copy of keymaps in spec file (BZ 1875217)
+- Removed /usr/share/qemu-kvm/npcm7xx_bootrom.bin, considering it
+  unpackaged for now.
+- Removed /usr/share/qemu-kvm/qboot.rom, considering unpackaged.
+- Added build dependency for meson and ninja-build
+- hw/s390/s390-pci-vfio.c hack - set NULL for g_autofree variables
+- Removed Chanelog (upstream)
+- Fix in directory used for docs (upstream add %name so we do not pass it in configure)
+- Package various .so as part of qemu-kvm-core package.
+
+Rebase notes (5.2.0 rc2):
+- Added fix for dtrace build on RHEL 8.4.0
+
+Rebase notes (5.2.0 rc3):
+- Added man page for qemu-pr-helper
+- Added new configure options
+- Update qemu-kiwi patches to v4
+
+Rebase notes (6.0.0):
+- update tracetool usage in spec file
+- remove qemu-storage-daemon-qmp-ref man page
+- remove qemu-storage-daemon man page
+- Added devel documentation
+- do not package virtfs-proxy-helper files
+- Use --with-git-submodules instead of --(enable|disable)-git-update
+- Minor build fixes for sending upstream
+- g_autofree initialization fixed upstream
+- Updated rc information usage
+- do not package package hw-s390x-virtio-gpu-ccw.so
+- Disable new switch options
+
+Rebase notes (6.1.0):
+- Fix warning issue in block.c
+- Download tarball from dist-git cache
+- Removed sheepdog driver
+- Added new display modules:
+  - hw-display-virtio-gpu-gl.so
+  - hw-display-virtio-gpu-pci-gl.so
+  - hw-display-virtio-vga-gl.so
+- sasl fix moved from ui/vnc.c to ui/vnc-auth-sasl.c
+- Added accel-qtest-%{kvm_target} and accel-tcg-%{kvm_target}
+- Added about docs
+- Use -q option for setup
+- Added hw-usb-host.so
+- Disable new options (bpf, nvmm, slirp-smbd)
+
+Rebase notes (6.2.0):
+- Using internal meson
+- removed --disable-jemalloc and --disable-tcmalloc configure options
+- added audio-oss.so
+- added fdt requirement for x86_64
+- tests/acceptance renamed to tests/avocado
+- added multiboot_dma.bin
+- Removed conflict relics
+- Updated configure options
+
+Merged patches (3.1.0):
+- 01f0c9f RHEL8: Add disable configure options to qemu spec file
+- Spec file cleanups
+
+Merged patches (4.0.0):
+- aa4297c Add edk2 Requires to qemu-kvm
+- d124ff5779 Fixing brew build target
+- eb204b5 Introduce the qemu-kvm-tests rpm
+- 223cf0c Load kvm module during boot (partial)
+
+Merged patches (4.1.0):
+- ebb6e97 redhat: Fix LOCALVERSION creation
+- b0ab0cc redhat: enable tpmdev passthrough (not disabling tests)
+- 7cb3c4a Enable libpmem to support nvdimm
+- 8943607 qemu-kvm.spec: bump libseccomp >= 2.4.0
+- 27b7c44 rh: set CONFIG_BOCHS_DISPLAY=y for x86 (partial)
+- e1fe9fe x86_64-rh-devices: enable TPM emulation (partial)
+
+Merged patches (4.2.0):
+- 69e1fb2 enable virgla
+- d4f6115 enable virgl, for real this time ...
+
+Merged patches (5.1.0):
+- 5edf6bd Add support for rh-brew-module
+- f77d52d redhat: ship virtiofsd vhost-user device backend
+- 63f12d4 redhat: Always use module build target for rh-brew (modified)
+- 9b1e140 redhat: updating the modular target
+- 44b8bd0 spec: Fix python shenigans for tests
+
+Merged patches (5.2.0 rc0):
+- 9238ce7 Add support for simpletrace
+- 5797cff Remove explicit glusterfs-api dependency
+- fd62478 disable virgl
+- 0205018 redhat: link /etc/qemu-ga/fsfreeze-hook to /etc/qemu-kvm/
+- 3645097 redhat: Make all generated so files executable (not only block-*)
+
+Merged patches (5.2.0 rc2):
+- pjw 99657 redhat: introduces disable_everything macro into the configure call
+- pjw 99659 redhat: scripts/extract_build_cmd.py - Avoid listing empty lines
+- pjw 99658 redhat: Fixing rh-local build
+- pjw 99660 redhat: Add qemu-kiwi subpackage
+- d2e59ce redhat: add (un/pre)install systemd hooks for qemu-ga
+
+Merged patches (5.2.0 rc3):
+- pjw 99887 - redhat: allow Makefile rh-prep builddep to fail
+- pjw 99885 - redhat: adding rh-rpm target
+
+Merged patches (6.0.0):
+- 5ab9954a3b spec: find system python via meson
+- cd0f7db11f build-system: use b_staticpic=false
+- 80d2dec42c udev-kvm-check: remove the "exceeded subscription limit" message
+- 38959d51c0 redhat: Allow make to inherit params from parent make for rh-local
+- 1e0cfe458f redhat: moving all documentation files to qemu-kvm-docs
+- d7a594d02b redhat: makes qemu respect system's crypto profile
+- e2bbf1572b spec: Package qemu-storage-daemon
+- 92f10993ba spec: ui-spice sub-package
+- 8931e46069 spec: ui-opengl sub-package
+
+Merged patches (6.1.0):
+- 7bb57541b3 redhat: Install the s390-netboot.img that we've built
+- b4a8531f41 redhat: Fix "unversioned Obsoletes" warning
+- 141a1693c7 redhat: Move qemu-kvm-docs dependency to qemu-kvm
+- d75f59c6f9 redhat: introducting qemu-kvm-hw-usbredir
+- a934d8bf44 redhat: use the standard vhost-user JSON path
+
+Merged patches (6.2.0):
+- 4f3f04bbb6 spec: Remove qemu-kiwi build
+---
+ .gitignore                                 |    1 +
+ .gitlab-ci.yml                             |   24 -
+ .gitlab/issue_templates/bug.md             |   64 -
+ .gitlab/issue_templates/feature_request.md |   32 -
+ README.systemtap                           |   43 +
+ meson.build                                |    4 +-
+ redhat/Makefile                            |   90 +
+ redhat/Makefile.common                     |   48 +
+ redhat/README.tests                        |   39 +
+ redhat/qemu-kvm.spec.template              | 3896 ++++++++++++++++++++
+ redhat/scripts/extract_build_cmd.py        |    5 +-
+ redhat/scripts/process-patches.sh          |   20 +-
+ redhat/scripts/tarball_checksum.sh         |    2 +-
+ redhat/udev-kvm-check.c                    |   19 +-
+ scripts/qemu-guest-agent/fsfreeze-hook     |    2 +-
+ scripts/systemtap/conf.d/qemu_kvm.conf     |    4 +
+ scripts/systemtap/script.d/qemu_kvm.stp    |    1 +
+ tests/check-block.sh                       |    2 +
+ ui/vnc-auth-sasl.c                         |    2 +-
+ 19 files changed, 4142 insertions(+), 156 deletions(-)
+ delete mode 100644 .gitlab-ci.yml
+ delete mode 100644 .gitlab/issue_templates/bug.md
+ delete mode 100644 .gitlab/issue_templates/feature_request.md
+ create mode 100644 README.systemtap
+ create mode 100644 redhat/Makefile
+ create mode 100644 redhat/Makefile.common
+ create mode 100644 redhat/README.tests
+ create mode 100644 redhat/qemu-kvm.spec.template
+ create mode 100644 scripts/systemtap/conf.d/qemu_kvm.conf
+ create mode 100644 scripts/systemtap/script.d/qemu_kvm.stp
+
+diff --git a/README.systemtap b/README.systemtap
+new file mode 100644
+index 0000000000..ad913fc990
+--- /dev/null
+++ b/README.systemtap
+@@ -0,0 +1,43 @@
+QEMU tracing using systemtap-initscript
+---------------------------------------
+
+You can capture QEMU trace data all the time using systemtap-initscript.  This
+uses SystemTap's flight recorder mode to trace all running guests to a
+fixed-size buffer on the host.  Old trace entries are overwritten by new
+entries when the buffer size wraps.
+
+1. Install the systemtap-initscript package:
+  # yum install systemtap-initscript
+
+2. Install the systemtap scripts and the conf file:
+  # cp /usr/share/qemu-kvm/systemtap/script.d/qemu_kvm.stp /etc/systemtap/script.d/
+  # cp /usr/share/qemu-kvm/systemtap/conf.d/qemu_kvm.conf /etc/systemtap/conf.d/
+
+The set of trace events to enable is given in qemu_kvm.stp.  This SystemTap
+script can be customized to add or remove trace events provided in
+/usr/share/systemtap/tapset/qemu-kvm-simpletrace.stp.
+
+SystemTap customizations can be made to qemu_kvm.conf to control the flight
+recorder buffer size and whether to store traces in memory only or disk too.
+See stap(1) for option documentation.
+
+3. Start the systemtap service.
+　# service systemtap start qemu_kvm
+
+4. Make the service start at boot time.
+　# chkconfig systemtap on
+
+5. Confirm that the service works.
+  # service systemtap status qemu_kvm
+  qemu_kvm is running...
+
+When you want to inspect the trace buffer, perform the following steps:
+
+1. Dump the trace buffer.
+  # staprun -A qemu_kvm >/tmp/trace.log
+
+2. Start the systemtap service because the preceding step stops the service.
+  # service systemtap start qemu_kvm
+
+3. Translate the trace record to readable format.
+  # /usr/share/qemu-kvm/simpletrace.py --no-header /usr/share/qemu-kvm/trace-events /tmp/trace.log
+diff --git a/meson.build b/meson.build
+index 96de1a6ef9..5f6ba86dbb 100644
+--- a/meson.build
+++ b/meson.build
+@@ -2108,7 +2108,9 @@ if capstone_opt == 'internal'
+     # Include all configuration defines via a header file, which will wind up
+     # as a dependency on the object file, and thus changes here will result
+     # in a rebuild.
+-    '-include', 'capstone-defs.h'
+    '-include', 'capstone-defs.h',
+
+    '-Wp,-D_GLIBCXX_ASSERTIONS',
+   ]
+ 
+   libcapstone = static_library('capstone',
+diff --git a/scripts/qemu-guest-agent/fsfreeze-hook b/scripts/qemu-guest-agent/fsfreeze-hook
+index 13aafd4845..e9b84ec028 100755
+--- a/scripts/qemu-guest-agent/fsfreeze-hook
+++ b/scripts/qemu-guest-agent/fsfreeze-hook
+@@ -8,7 +8,7 @@
+ # request, it is issued with "thaw" argument after filesystem is thawed.
+ 
+ LOGFILE=/var/log/qga-fsfreeze-hook.log
+-FSFREEZE_D=$(dirname -- "$0")/fsfreeze-hook.d
+FSFREEZE_D=$(dirname -- "$(realpath $0)")/fsfreeze-hook.d
+ 
+ # Check whether file $1 is a backup or rpm-generated file and should be ignored
+ is_ignored_file() {
+diff --git a/scripts/systemtap/conf.d/qemu_kvm.conf b/scripts/systemtap/conf.d/qemu_kvm.conf
+new file mode 100644
+index 0000000000..372d8160a4
+--- /dev/null
+++ b/scripts/systemtap/conf.d/qemu_kvm.conf
+@@ -0,0 +1,4 @@
+# Force load uprobes (see BZ#1118352)
+stap -e 'probe process("/usr/libexec/qemu-kvm").function("main") { printf("") }' -c true
+
+qemu_kvm_OPT="-s4" # per-CPU buffer size, in megabytes
+diff --git a/scripts/systemtap/script.d/qemu_kvm.stp b/scripts/systemtap/script.d/qemu_kvm.stp
+new file mode 100644
+index 0000000000..c04abf9449
+--- /dev/null
+++ b/scripts/systemtap/script.d/qemu_kvm.stp
+@@ -0,0 +1 @@
+probe qemu.kvm.simpletrace.handle_qmp_command,qemu.kvm.simpletrace.monitor_protocol_*,qemu.kvm.simpletrace.migrate_set_state {}
+diff --git a/tests/check-block.sh b/tests/check-block.sh
+index f86cb863de..6d38340d49 100755
+--- a/tests/check-block.sh
+++ b/tests/check-block.sh
+@@ -69,6 +69,8 @@ else
+     fi
+ fi
+ 
+exit 0
+
+ cd tests/qemu-iotests
+ 
+ # QEMU_CHECK_BLOCK_AUTO is used to disable some unstable sub-tests
+diff --git a/ui/vnc-auth-sasl.c b/ui/vnc-auth-sasl.c
+index 47fdae5b21..2a950caa2a 100644
+--- a/ui/vnc-auth-sasl.c
+++ b/ui/vnc-auth-sasl.c
+@@ -42,7 +42,7 @@
+ 
+ bool vnc_sasl_server_init(Error **errp)
+ {
+-    int saslErr = sasl_server_init(NULL, "qemu");
+    int saslErr = sasl_server_init(NULL, "qemu-kvm");
+ 
+     if (saslErr != SASL_OK) {
+         error_setg(errp, "Failed to initialize SASL auth: %s",
+-- 
+2.27.0
+
--- a/SOURCES/0006-Enable-disable-devices-for-RHEL.patch
+++ b/SOURCES/0006-Enable-disable-devices-for-RHEL.patch
@ -1,101 +1,174 @@
-From 90366cd2ead5a5301aaceed56477d2e6d9f1b3cd Mon Sep 17 00:00:00 2001
+From 3d5a82d172345d17e300672909835262ff9dc917 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
-Date: Wed, 7 Dec 2022 03:05:48 -0500
+Date: Wed, 2 Sep 2020 09:11:07 +0200
 Subject: Enable/disable devices for RHEL

 This commit adds all changes related to changes in supported devices.

 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
--
-Rebase notes (6.1.0):
- Added CONFIG_TPM (except s390x)
- default-configs moved to configs
- Use --with-device-<ARCH> configure option to use rhel configs

-Rebase notes (6.2.0):
- Add CONFIG_ISA_FDC
+Rebase notes (qemu 3.1.0)
+- spapr_rng disabled in default_config
+- new hyperv.mak in default configs
+- Move changes from x86_64-softmmu.mak to i386-softmmu.mak
+- Added CONFIG_VIRTIO_MMIO to aarch64-softmmu.mak
+- Removed config_vga_isa.c changes as no longer needed
+- Removed new devices
+
+Rebase notes (4.0.0):
+- Added CONFIG_PCI_EXPRESS_GENERIC_BRIDGE for aarch64-softmmu.mak
+- Added CONFIG_ARM_VIRT for aarch64-softmmu.mak
+- Switch to KConfig (upstream)
+ - Using device whitelist + without-defualt-devices option
+
+Rebase notes (4.1.0):
+- Added CONFIG_USB_OHCI_PCI for ppc64
+- Added CONFIG_XIVE_KVM for ppc64
+- Added CONFIG_ACPI_PCI for x86_64
+- Added CONFIG_SEMIHOSTING for aarch64
+- Cleanup aarch64 devices
+- Do not build a15mpcore.c
+- Removed ide-isa.c stub file
+- Use CONFIG_USB_EHCI_PCI on x86_64 (new upstream)
+
+Rebase notes (4.2.0-rc0):
+- Use conditional build for isa-superio.c (upstream change)
+- Rename PCI_PIIX to PCI_I440FX (upstream change)
+
+Rebase notes (4.2.0-rc3):
+- Disabled ccid-card-emulated (patch 92566)
+- Disabled vfio-pci-igd-lpc-bridge (patch 92565)
+
+Rebase notes (5.1.0):
+- added CONFIG_PCI_EXPRESS on ppc64 (due to upstream dependency)
+- Added CONFIG_NVDIMM
+- updated cortex-15 disabling to upstream code
+- Add CONFIG_ACPI_APEI for aarch64
+- removed obsolete hw/bt/Makefile.objs chunk
+- removed unnecessary changes in target/i386/cpu.c
+
+Rebase notes (5.2.0 rc0):
+- Added CONFIG_USB_XHCI_PCI on aarch64 ppc64 and x86_64
+- remove vl.c hack for no hpet
+- Enable CONFIG_PTIMER for aarch64
+- Do not package hw-display-virtio-gpu.so on s390x
+
+Rebase notes (5.2.0 rc1):
+- Added CONFIG_ARM_GIC for aarch64 (required for build)
+
+Rebase notes (weekly-210113):
+- Removed XICS_KVM, XICS_SPAPR, XIVE_KVM and XIVE_SPAPR config (removed upstream)
+
+Rebase notes (weekly-210120):
+- Add CONFIG_ARM_COMPATIBLE_SEMIHOSTING option
+
+Rebase notes (weekly-210203):
+- Rename CONFIG_PVPANIC to CONFIG_PVPANIC_ISA
+
+Rebase notes (weekly-210317):
+- Add new USB_STORAGE_CORE and USB_STORAGE_CLASSIC config for ppc64 and x86_64
+- Update disabling TCG cpus for AArch64
+
+Rebase notes (weekly-210519):
+- Do not use CONFIG_SPICE and CONFIG_OPENGL in default configs
+
+Rebase notes (weekly-210623):
+- Add CONFIG_TPM for archs with used TPM functionality
+
+Rebase notes (weekly-210714):
+- default_configs moved to configs
+
+Rebase notes (6.1.0 rc2):
+- Use --with-device-ARCH configure option to use redhat config files
+
+Rebase notes (6.2.0 rc3):
 - Do not remove -no-hpet documentation
+Merged patches (qemu 3.1.0):
+- d51e082 Re-enable CONFIG_HYPERV_TESTDEV
+- 4b889f3 Declare cirrus-vga as deprecated
+- b579d32 Do not build bluetooth support
+- 3eef52a Disable CONFIG_IPMI and CONFIG_I2C for ppc64
+- 9caf292 Disable CONFIG_CAN_BUS and CONFIG_CAN_SJA1000

-Rebase notes (7.0.0):
- Added CONFIG_ARM_GIC_TCG option for aarch64
- Fixes necessary for layout change fixes
- Renamed CONFIG_ARM_GIC_TCG to CONFIG_ARM_GICV3_TCG
- Removed upstream devices
+Merged patches (4.1.0):
+- 20a51f6 fdc: Revert downstream disablement of device "floppy"
+- f869cc0 fdc: Restrict floppy controllers to RHEL-7 machine types
+- 5909721 aarch64: Compile out IOH3420
+- 27b7c44 rh: set CONFIG_BOCHS_DISPLAY=y for x86 (partial)
+- 495a27d x86_64-rh-devices: add missing TPM passthrough
+- e1fe9fe x86_64-rh-devices: enable TPM emulation (partial)

-Rebase notes (7.1.0 rc0):
- Added CONFIG_VHOST_VSOCK and CONFIG_VHOST_USER_VSOCK configs
- Added CONFIG_CXL and CONFIG_CXL_MEM_DEVICE for aarch64 and x86_64
+Merged patches (4.2.0):
+- f7587dd RHEL: disable hostmem-memfd

-Rebase notes (7.1.0 rc3):
- Added CONFIG_VHOST_USER_FS option (all archs)
+Merged patches (5.1.0):
+- 4543a3c i386: Remove cpu64-rhel6 CPU model
+- 96533 aarch64: Remove tcg cpu types (pjw commit)
+- 559d589 Revert "RHEL: disable hostmem-memfd"
+- 441128e enable ramfb

-Rebase notes (7.2.0 rc20):
- Removed disabling a15mpcore.c as no longer needed
+Merged patches (5.2.0 rc0):
+- f70eb50 RHEL-only: Enable vTPM for POWER in downstream configs
+- 69d8ae7 redhat: fix 5.0 rebase missing ISA TPM TIS
+- 8310f89 RHEL-only: Enable vTPM for ARM in downstream configs
+- 4a8ccfd Disable TPM passthrough backend on ARM

-Merged patches (6.1.0):
- c51bf45304 Remove SPICE and QXL from x86_64-rh-devices.mak
- 02fc745601 aarch64-rh-devices: add CONFIG_PVPANIC_PCI
- f2fe835153 aarch64-rh-devices: add CONFIG_PXB
- b5431733ad disable CONFIG_USB_STORAGE_BOT
- 478ba0cdf6 Disable TPM passthrough
- 2504d68a7c aarch64: Add USB storage devices
- 51c2a3253c disable ac97 audio
+Merged patches (6.0.0):
+- ff817df9e3 config: enable VFIO_CCW
+- 70d3924521 redhat: Add some devices for exporting upstream machine types
+ - without machine type chunks
+- efac91b2b4 default-configs: Enable vhost-user-blk

-Merged patches (6.2.0):
- 9f2f9fa2ba disable sga device
+Merged patches (weekly-210630):
+- 59a178acff disable CONFIG_USB_STORAGE_BOT

-Merged patches (7.0.0):
- fd7c45a5a8 redhat: Enable virtio-mem as tech-preview on x86-64
- c9e68ea451 Enable SGX -- RH Only
-
-Merged patches (7.1.0 rc0):
- 38b89dc245 pc: Move s3/s4 suspend disabling to compat (only hw/acpi/ich9.c chunk)
- 8f663466c6 configs/devices/aarch64-softmmu: Enable CONFIG_VIRTIO_MEM
- 1bf372717a Enable virtio-iommu-pci on aarch64
- ae3f269458 Enable virtio-iommu-pci on x86_64
+Merged patches (6.1.0 rc2):
+- 86f0025f16 aarch64: Add USB storage devices
 ---
- .distro/qemu-kvm.spec.template                |  18 +--
- .../aarch64-softmmu/aarch64-rh-devices.mak    |  41 +++++++
- .../ppc64-softmmu/ppc64-rh-devices.mak        |  37 ++++++
+ .../aarch64-softmmu/aarch64-rh-devices.mak    |  31 ++++++
+ .../ppc64-softmmu/ppc64-rh-devices.mak        |  36 ++++++
 configs/devices/rh-virtio.mak                 |  10 ++
- .../s390x-softmmu/s390x-rh-devices.mak        |  18 +++
- .../x86_64-softmmu/x86_64-rh-devices.mak      | 109 ++++++++++++++++++
+ .../s390x-softmmu/s390x-rh-devices.mak        |  16 +++
+ .../x86_64-softmmu/x86_64-rh-devices.mak      | 104 ++++++++++++++++++
+ .../x86_64-upstream-devices.mak               |   4 +
+ hw/acpi/ich9.c                                |   4 +-
 hw/arm/meson.build                            |   2 +-
 hw/block/fdc.c                                |  10 ++
- hw/cpu/meson.build                            |   3 +-
- hw/display/cirrus_vga.c                       |   5 +-
+ hw/char/parallel.c                            |   9 ++
+ hw/cpu/meson.build                            |   5 +-
+ hw/display/cirrus_vga.c                       |   3 +
 hw/ide/piix.c                                 |   5 +-
 hw/input/pckbd.c                              |   2 +
 hw/net/e1000.c                                |   2 +
 hw/ppc/spapr_cpu_core.c                       |   2 +
+ hw/timer/hpet.c                               |   8 ++
 hw/usb/meson.build                            |   2 +-
+ redhat/qemu-kvm.spec.template                 |   9 +-
 target/arm/cpu_tcg.c                          |  10 ++
- target/ppc/cpu-models.c                       |   9 ++
+ target/ppc/cpu-models.c                       |  10 ++
 target/s390x/cpu_models_sysemu.c              |   3 +
 target/s390x/kvm/kvm.c                        |   8 ++
- 19 files changed, 283 insertions(+), 13 deletions(-)
+ 23 files changed, 286 insertions(+), 9 deletions(-)
 create mode 100644 configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
 create mode 100644 configs/devices/ppc64-softmmu/ppc64-rh-devices.mak
 create mode 100644 configs/devices/rh-virtio.mak
 create mode 100644 configs/devices/s390x-softmmu/s390x-rh-devices.mak
 create mode 100644 configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
+ create mode 100644 configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak

 diff --git a/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak b/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
 new file mode 100644
-index 0000000000..720ec0cb57
+index 0000000000..0d4f9e6e4b
 --- /dev/null
 +++ b/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
-@@ -0,0 +1,41 @@
+@@ -0,0 +1,31 @@
 +include ../rh-virtio.mak
 +
 +CONFIG_ARM_GIC_KVM=y
-+CONFIG_ARM_GICV3_TCG=y
 +CONFIG_ARM_GIC=y
 +CONFIG_ARM_SMMUV3=y
 +CONFIG_ARM_V7M=y
 +CONFIG_ARM_VIRT=y
-+CONFIG_CXL=y
-+CONFIG_CXL_MEM_DEVICE=y
 +CONFIG_EDID=y
 +CONFIG_PCIE_PORT=y
 +CONFIG_PCI_DEVICES=y
@ -112,8 +185,6 @@ index 0000000000..720ec0cb57
 +CONFIG_VFIO_PCI=y
 +CONFIG_VIRTIO_MMIO=y
 +CONFIG_VIRTIO_PCI=y
-+CONFIG_VIRTIO_MEM=y
-+CONFIG_VIRTIO_IOMMU=y
 +CONFIG_XIO3130=y
 +CONFIG_NVDIMM=y
 +CONFIG_ACPI_APEI=y
@ -122,17 +193,12 @@ index 0000000000..720ec0cb57
 +CONFIG_TPM_TIS_SYSBUS=y
 +CONFIG_PTIMER=y
 +CONFIG_ARM_COMPATIBLE_SEMIHOSTING=y
-+CONFIG_PVPANIC_PCI=y
-+CONFIG_PXB=y
-+CONFIG_VHOST_VSOCK=y
-+CONFIG_VHOST_USER_VSOCK=y
-+CONFIG_VHOST_USER_FS=y
 diff --git a/configs/devices/ppc64-softmmu/ppc64-rh-devices.mak b/configs/devices/ppc64-softmmu/ppc64-rh-devices.mak
 new file mode 100644
-index 0000000000..dbb7d30829
+index 0000000000..73e3ee0293
 --- /dev/null
 +++ b/configs/devices/ppc64-softmmu/ppc64-rh-devices.mak
-@@ -0,0 +1,37 @@
+@@ -0,0 +1,36 @@
 +include ../rh-virtio.mak
 +
 +CONFIG_DIMM=y
@ -168,8 +234,7 @@ index 0000000000..dbb7d30829
 +CONFIG_TPM=y
 +CONFIG_TPM_SPAPR=y
 +CONFIG_TPM_EMULATOR=y
-+CONFIG_VHOST_VSOCK=y
-+CONFIG_VHOST_USER_VSOCK=y
+CONFIG_TPM_PASSTHROUGH=y
 diff --git a/configs/devices/rh-virtio.mak b/configs/devices/rh-virtio.mak
 new file mode 100644
 index 0000000000..94ede1b5f6
@ -188,10 +253,10 @@ index 0000000000..94ede1b5f6
 +CONFIG_VIRTIO_SERIAL=y
 diff --git a/configs/devices/s390x-softmmu/s390x-rh-devices.mak b/configs/devices/s390x-softmmu/s390x-rh-devices.mak
 new file mode 100644
-index 0000000000..69a799adbd
+index 0000000000..165c082e87
 --- /dev/null
 +++ b/configs/devices/s390x-softmmu/s390x-rh-devices.mak
-@@ -0,0 +1,18 @@
+@@ -0,0 +1,16 @@
 +include ../rh-virtio.mak
 +
 +CONFIG_PCI=y
@ -200,6 +265,7 @@ index 0000000000..69a799adbd
 +CONFIG_S390_FLIC_KVM=y
 +CONFIG_SCLPCONSOLE=y
 +CONFIG_SCSI=y
+CONFIG_TERMINAL3270=y
 +CONFIG_VFIO=y
 +CONFIG_VFIO_AP=y
 +CONFIG_VFIO_CCW=y
@ -207,17 +273,16 @@ index 0000000000..69a799adbd
 +CONFIG_VHOST_USER=y
 +CONFIG_VIRTIO_CCW=y
 +CONFIG_WDT_DIAG288=y
-+CONFIG_VHOST_VSOCK=y
-+CONFIG_VHOST_USER_VSOCK=y
-+CONFIG_VHOST_USER_FS=y
 diff --git a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 new file mode 100644
-index 0000000000..10cb0a14e0
+index 0000000000..ddf036f042
 --- /dev/null
 +++ b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
-@@ -0,0 +1,109 @@
+@@ -0,0 +1,104 @@
 +include ../rh-virtio.mak
+include x86_64-upstream-devices.mak
 +
+CONFIG_AC97=y
 +CONFIG_ACPI=y
 +CONFIG_ACPI_PCI=y
 +CONFIG_ACPI_CPU_HOTPLUG=y
@ -231,15 +296,12 @@ index 0000000000..10cb0a14e0
 +CONFIG_APIC=y
 +CONFIG_APM=y
 +CONFIG_BOCHS_DISPLAY=y
-+CONFIG_CXL=y
-+CONFIG_CXL_MEM_DEVICE=y
 +CONFIG_DIMM=y
 +CONFIG_E1000E_PCI_EXPRESS=y
 +CONFIG_E1000_PCI=y
 +CONFIG_EDU=y
 +CONFIG_FDC=y
 +CONFIG_FDC_SYSBUS=y
-+CONFIG_FDC_ISA=y
 +CONFIG_FW_CFG_DMA=y
 +CONFIG_HDA=y
 +CONFIG_HYPERV=y
@ -263,7 +325,6 @@ index 0000000000..10cb0a14e0
 +CONFIG_MC146818RTC=y
 +CONFIG_MEM_DEVICE=y
 +CONFIG_NVDIMM=y
-+CONFIG_OPENGL=y
 +CONFIG_PAM=y
 +CONFIG_PC=y
 +CONFIG_PCI=y
@ -281,12 +342,14 @@ index 0000000000..10cb0a14e0
 +CONFIG_PVPANIC_ISA=y
 +CONFIG_PXB=y
 +CONFIG_Q35=y
+CONFIG_QXL=y
 +CONFIG_RTL8139_PCI=y
 +CONFIG_SCSI=y
 +CONFIG_SERIAL=y
 +CONFIG_SERIAL_ISA=y
 +CONFIG_SERIAL_PCI=y
 +CONFIG_SEV=y
+CONFIG_SGA=y
 +CONFIG_SMBIOS=y
 +CONFIG_SMBUS_EEPROM=y
 +CONFIG_TEST_DEVICES=y
@ -307,10 +370,8 @@ index 0000000000..10cb0a14e0
 +CONFIG_VGA_PCI=y
 +CONFIG_VHOST_USER=y
 +CONFIG_VHOST_USER_BLK=y
-+CONFIG_VIRTIO_MEM=y
 +CONFIG_VIRTIO_PCI=y
 +CONFIG_VIRTIO_VGA=y
-+CONFIG_VIRTIO_IOMMU=y
 +CONFIG_VMMOUSE=y
 +CONFIG_VMPORT=y
 +CONFIG_VTD=y
@ -321,15 +382,37 @@ index 0000000000..10cb0a14e0
 +CONFIG_TPM_CRB=y
 +CONFIG_TPM_TIS_ISA=y
 +CONFIG_TPM_EMULATOR=y
-+CONFIG_SGX=y
-+CONFIG_VHOST_VSOCK=y
-+CONFIG_VHOST_USER_VSOCK=y
-+CONFIG_VHOST_USER_FS=y
+CONFIG_TPM_PASSTHROUGH=y
+diff --git a/configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak b/configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak
+new file mode 100644
+index 0000000000..2cd20f54d2
+--- /dev/null
+++ b/configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak
+@@ -0,0 +1,4 @@
+# We need "isa-parallel"
+CONFIG_PARALLEL=y
+# We need "hpet"
+CONFIG_HPET=y
+diff --git a/hw/acpi/ich9.c b/hw/acpi/ich9.c
+index ebe08ed831..381ef2ddcf 100644
+--- a/hw/acpi/ich9.c
+++ b/hw/acpi/ich9.c
+@@ -438,8 +438,8 @@ void ich9_pm_add_properties(Object *obj, ICH9LPCPMRegs *pm)
+     static const uint32_t gpe0_len = ICH9_PMIO_GPE0_LEN;
+     pm->acpi_memory_hotplug.is_enabled = true;
+     pm->cpu_hotplug_legacy = true;
+-    pm->disable_s3 = 0;
+-    pm->disable_s4 = 0;
+    pm->disable_s3 = 1;
+    pm->disable_s4 = 1;
+     pm->s4_val = 2;
+     pm->use_acpi_hotplug_bridge = true;
+     pm->keep_pci_slot_hpc = true;
 diff --git a/hw/arm/meson.build b/hw/arm/meson.build
-index 92f9f6e000..c5e94c997c 100644
+index 721a8eb8be..87ed4dd914 100644
 --- a/hw/arm/meson.build
 +++ b/hw/arm/meson.build
-@@ -30,7 +30,7 @@ arm_ss.add(when: 'CONFIG_VEXPRESS', if_true: files('vexpress.c'))
+@@ -31,7 +31,7 @@ arm_ss.add(when: 'CONFIG_VEXPRESS', if_true: files('vexpress.c'))
 arm_ss.add(when: 'CONFIG_ZYNQ', if_true: files('xilinx_zynq.c'))
 arm_ss.add(when: 'CONFIG_SABRELITE', if_true: files('sabrelite.c'))
 
@ -339,10 +422,10 @@ index 92f9f6e000..c5e94c997c 100644
 arm_ss.add(when: 'CONFIG_PXA2XX', if_true: files('pxa2xx.c', 'pxa2xx_gpio.c', 'pxa2xx_pic.c'))
 arm_ss.add(when: 'CONFIG_DIGIC', if_true: files('digic.c'))
 diff --git a/hw/block/fdc.c b/hw/block/fdc.c
-index 64ae4a6899..9b8e782c19 100644
+index 21d18ac2e3..97fa6de423 100644
 --- a/hw/block/fdc.c
 +++ b/hw/block/fdc.c
-@@ -49,6 +49,8 @@
+@@ -48,6 +48,8 @@
 #include "qom/object.h"
 #include "fdc-internal.h"
 
@ -351,7 +434,7 @@ index 64ae4a6899..9b8e782c19 100644
 /********************************************************/
 /* debug Floppy devices */
 
-@@ -2346,6 +2348,14 @@ void fdctrl_realize_common(DeviceState *dev, FDCtrl *fdctrl, Error **errp)
+@@ -2337,6 +2339,14 @@ void fdctrl_realize_common(DeviceState *dev, FDCtrl *fdctrl, Error **errp)
     FDrive *drive;
     static int command_tables_inited = 0;
 
@ -366,38 +449,66 @@ index 64ae4a6899..9b8e782c19 100644
     if (fdctrl->fallback == FLOPPY_DRIVE_TYPE_AUTO) {
         error_setg(errp, "Cannot choose a fallback FDrive type of 'auto'");
         return;
+diff --git a/hw/char/parallel.c b/hw/char/parallel.c
+index b45e67bfbb..e5f108211b 100644
+--- a/hw/char/parallel.c
+++ b/hw/char/parallel.c
+@@ -29,6 +29,7 @@
+ #include "chardev/char-parallel.h"
+ #include "chardev/char-fe.h"
+ #include "hw/acpi/aml-build.h"
+#include "hw/boards.h"
+ #include "hw/irq.h"
+ #include "hw/isa/isa.h"
+ #include "hw/qdev-properties.h"
+@@ -534,6 +535,14 @@ static void parallel_isa_realizefn(DeviceState *dev, Error **errp)
+     int base;
+     uint8_t dummy;
+ 
+    /* Restricted for Red Hat Enterprise Linux */
+    MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
+    if (strstr(mc->name, "rhel")) {
+        error_setg(errp, "Device %s is not supported with machine type %s",
+                   object_get_typename(OBJECT(dev)), mc->name);
+        return;
+    }
+
+     if (!qemu_chr_fe_backend_connected(&s->chr)) {
+         error_setg(errp, "Can't create parallel device, empty char device");
+         return;
 diff --git a/hw/cpu/meson.build b/hw/cpu/meson.build
-index 9e52fee9e7..87c209a754 100644
+index 9e52fee9e7..bb71c9f3e7 100644
 --- a/hw/cpu/meson.build
 +++ b/hw/cpu/meson.build
-@@ -1,4 +1,5 @@
+@@ -1,6 +1,7 @@
 -softmmu_ss.add(files('core.c', 'cluster.c'))
 +#softmmu_ss.add(files('core.c', 'cluster.c'))
 +softmmu_ss.add(files('core.c'))
 
 specific_ss.add(when: 'CONFIG_ARM11MPCORE', if_true: files('arm11mpcore.c'))
 specific_ss.add(when: 'CONFIG_REALVIEW', if_true: files('realview_mpcore.c'))
+ specific_ss.add(when: 'CONFIG_A9MPCORE', if_true: files('a9mpcore.c'))
+-specific_ss.add(when: 'CONFIG_A15MPCORE', if_true: files('a15mpcore.c'))
+#specific_ss.add(when: 'CONFIG_A15MPCORE', if_true: files('a15mpcore.c'))
 diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
-index 6e8c747c46..1948ebee8e 100644
+index fdca6ca659..fa1a7eee51 100644
 --- a/hw/display/cirrus_vga.c
 +++ b/hw/display/cirrus_vga.c
-@@ -2946,7 +2946,10 @@ static void pci_cirrus_vga_realize(PCIDevice *dev, Error **errp)
-     PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(dev);
-     int16_t device_id = pc->device_id;
+@@ -2945,6 +2945,9 @@ static void pci_cirrus_vga_realize(PCIDevice *dev, Error **errp)
+      PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(dev);
+      int16_t device_id = pc->device_id;
 
-    /*
 +     warn_report("'cirrus-vga' is deprecated, "
 +                 "please use a different VGA card instead");
 +
-+     /*
-      * Follow real hardware, cirrus card emulated has 4 MB video memory.
-      * Also accept 8 MB/16 MB for backward compatibility.
-      */
+      /* follow real hardware, cirrus card emulated has 4 MB video memory.
+        Also accept 8 MB/16 MB for backward compatibility. */
+      if (s->vga.vram_size_mb != 4 && s->vga.vram_size_mb != 8 &&
 diff --git a/hw/ide/piix.c b/hw/ide/piix.c
-index 267dbf37db..87fcda4062 100644
+index ce89fd0aa3..fbcf802b13 100644
 --- a/hw/ide/piix.c
 +++ b/hw/ide/piix.c
-@@ -199,7 +199,8 @@ static void piix3_ide_class_init(ObjectClass *klass, void *data)
+@@ -232,7 +232,8 @@ static void piix3_ide_class_init(ObjectClass *klass, void *data)
     k->device_id = PCI_DEVICE_ID_INTEL_82371SB_1;
     k->class_id = PCI_CLASS_STORAGE_IDE;
     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
@ -407,7 +518,7 @@ index 267dbf37db..87fcda4062 100644
 }
 
 static const TypeInfo piix3_ide_info = {
-@@ -222,6 +223,8 @@ static void piix4_ide_class_init(ObjectClass *klass, void *data)
+@@ -261,6 +262,8 @@ static void piix4_ide_class_init(ObjectClass *klass, void *data)
     k->class_id = PCI_CLASS_STORAGE_IDE;
     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
     dc->hotpluggable = false;
@ -417,12 +528,12 @@ index 267dbf37db..87fcda4062 100644
 
 static const TypeInfo piix4_ide_info = {
 diff --git a/hw/input/pckbd.c b/hw/input/pckbd.c
-index b92b63bedc..3b6235dde6 100644
+index baba62f357..bc360347ea 100644
 --- a/hw/input/pckbd.c
 +++ b/hw/input/pckbd.c
-@@ -957,6 +957,8 @@ static void i8042_class_initfn(ObjectClass *klass, void *data)
+@@ -796,6 +796,8 @@ static void i8042_class_initfn(ObjectClass *klass, void *data)
     dc->vmsd = &vmstate_kbd_isa;
-     adevc->build_dev_aml = i8042_build_aml;
+     isa->build_aml = i8042_build_aml;
     set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
 +    /* Disabled for Red Hat Enterprise Linux: */
 +    dc->user_creatable = false;
@ -430,10 +541,10 @@ index b92b63bedc..3b6235dde6 100644
 
 static const TypeInfo i8042_info = {
 diff --git a/hw/net/e1000.c b/hw/net/e1000.c
-index e26e0a64c1..41492fae79 100644
+index f5bc81296d..282d01e374 100644
 --- a/hw/net/e1000.c
 +++ b/hw/net/e1000.c
-@@ -1824,6 +1824,7 @@ static const E1000Info e1000_devices[] = {
+@@ -1821,6 +1821,7 @@ static const E1000Info e1000_devices[] = {
         .revision  = 0x03,
         .phy_id2   = E1000_PHY_ID2_8254xx_DEFAULT,
     },
@ -441,7 +552,7 @@ index e26e0a64c1..41492fae79 100644
     {
         .name      = "e1000-82544gc",
         .device_id = E1000_DEV_ID_82544GC_COPPER,
-@@ -1836,6 +1837,7 @@ static const E1000Info e1000_devices[] = {
+@@ -1833,6 +1834,7 @@ static const E1000Info e1000_devices[] = {
         .revision  = 0x03,
         .phy_id2   = E1000_PHY_ID2_8254xx_DEFAULT,
     },
@ -450,10 +561,10 @@ index e26e0a64c1..41492fae79 100644
 
 static void e1000_register_types(void)
 diff --git a/hw/ppc/spapr_cpu_core.c b/hw/ppc/spapr_cpu_core.c
-index 8a4861f45a..fcb5dfe792 100644
+index 58e7341cb7..8ba34f6a1d 100644
 --- a/hw/ppc/spapr_cpu_core.c
 +++ b/hw/ppc/spapr_cpu_core.c
-@@ -379,10 +379,12 @@ static const TypeInfo spapr_cpu_core_type_infos[] = {
+@@ -370,10 +370,12 @@ static const TypeInfo spapr_cpu_core_type_infos[] = {
         .instance_size = sizeof(SpaprCpuCore),
         .class_size = sizeof(SpaprCpuCoreClass),
     },
@ -466,8 +577,27 @@ index 8a4861f45a..fcb5dfe792 100644
     DEFINE_SPAPR_CPU_CORE_TYPE("power7_v2.3"),
     DEFINE_SPAPR_CPU_CORE_TYPE("power7+_v2.1"),
     DEFINE_SPAPR_CPU_CORE_TYPE("power8_v2.0"),
+diff --git a/hw/timer/hpet.c b/hw/timer/hpet.c
+index 9520471be2..202e032524 100644
+--- a/hw/timer/hpet.c
+++ b/hw/timer/hpet.c
+@@ -733,6 +733,14 @@ static void hpet_realize(DeviceState *dev, Error **errp)
+     int i;
+     HPETTimer *timer;
+ 
+    /* Restricted for Red Hat Enterprise Linux */
+    MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
+    if (strstr(mc->name, "rhel")) {
+        error_setg(errp, "Device %s is not supported with machine type %s",
+                   object_get_typename(OBJECT(dev)), mc->name);
+        return;
+    }
+
+     if (!s->intcap) {
+         warn_report("Hpet's intcap not initialized");
+     }
 diff --git a/hw/usb/meson.build b/hw/usb/meson.build
-index 793df42e21..cd3c305471 100644
+index de853d780d..0776ae6a20 100644
 --- a/hw/usb/meson.build
 +++ b/hw/usb/meson.build
@@ -52,7 +52,7 @@ softmmu_ss.add(when: 'CONFIG_USB_SMARTCARD', if_true: files('dev-smartcard-reade
@ -480,10 +610,10 @@ index 793df42e21..cd3c305471 100644
 endif
 
 diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
-index 9a2cef7d05..a528ff9a3d 100644
+index 13d0e9b195..3826fa5122 100644
 --- a/target/arm/cpu_tcg.c
 +++ b/target/arm/cpu_tcg.c
-@@ -151,6 +151,7 @@ void define_cortex_a72_a57_a53_cp_reginfo(ARMCPU *cpu)
+@@ -22,6 +22,7 @@
 /* CPU models. These are not needed for the AArch64 linux-user build. */
 #if !defined(CONFIG_USER_ONLY) || !defined(TARGET_AARCH64)
 
@ -491,31 +621,31 @@ index 9a2cef7d05..a528ff9a3d 100644
 #if !defined(CONFIG_USER_ONLY) && defined(CONFIG_TCG)
 static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
 {
-@@ -504,6 +505,7 @@ static void cortex_a9_initfn(Object *obj)
-     cpu->isar.reset_pmcr_el0 = 0x41093000;
+@@ -375,6 +376,7 @@ static void cortex_a9_initfn(Object *obj)
+     cpu->ccsidr[1] = 0x200fe019; /* 16k L1 icache. */
     define_arm_cp_regs(cpu, cortexa9_cp_reginfo);
 }
 +#endif /* disabled for RHEL */
 
 #ifndef CONFIG_USER_ONLY
 static uint64_t a15_l2ctlr_read(CPUARMState *env, const ARMCPRegInfo *ri)
-@@ -528,6 +530,7 @@ static const ARMCPRegInfo cortexa15_cp_reginfo[] = {
-       .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+@@ -400,6 +402,7 @@ static const ARMCPRegInfo cortexa15_cp_reginfo[] = {
+     REGINFO_SENTINEL
 };
 
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 static void cortex_a7_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
-@@ -576,6 +579,7 @@ static void cortex_a7_initfn(Object *obj)
-     cpu->isar.reset_pmcr_el0 = 0x41072000;
+@@ -445,6 +448,7 @@ static void cortex_a7_initfn(Object *obj)
+     cpu->ccsidr[2] = 0x711fe07a; /* 4096K L2 unified cache */
     define_arm_cp_regs(cpu, cortexa15_cp_reginfo); /* Same as A15 */
 }
 +#endif /* disabled for RHEL */
 
 static void cortex_a15_initfn(Object *obj)
 {
-@@ -624,6 +628,7 @@ static void cortex_a15_initfn(Object *obj)
+@@ -488,6 +492,7 @@ static void cortex_a15_initfn(Object *obj)
     define_arm_cp_regs(cpu, cortexa15_cp_reginfo);
 }
 
@ -523,7 +653,7 @@ index 9a2cef7d05..a528ff9a3d 100644
 static void cortex_m0_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
-@@ -1065,6 +1070,7 @@ static void arm_v7m_class_init(ObjectClass *oc, void *data)
+@@ -928,6 +933,7 @@ static void arm_v7m_class_init(ObjectClass *oc, void *data)
 
     cc->gdb_core_xml_file = "arm-m-profile.xml";
 }
@ -531,7 +661,7 @@ index 9a2cef7d05..a528ff9a3d 100644
 
 #ifndef TARGET_AARCH64
 /*
-@@ -1132,6 +1138,7 @@ static void arm_max_initfn(Object *obj)
+@@ -1007,6 +1013,7 @@ static void arm_max_initfn(Object *obj)
 #endif /* !TARGET_AARCH64 */
 
 static const ARMCPUInfo arm_tcg_cpus[] = {
@ -539,7 +669,7 @@ index 9a2cef7d05..a528ff9a3d 100644
     { .name = "arm926",      .initfn = arm926_initfn },
     { .name = "arm946",      .initfn = arm946_initfn },
     { .name = "arm1026",     .initfn = arm1026_initfn },
-@@ -1147,7 +1154,9 @@ static const ARMCPUInfo arm_tcg_cpus[] = {
+@@ -1022,7 +1029,9 @@ static const ARMCPUInfo arm_tcg_cpus[] = {
     { .name = "cortex-a7",   .initfn = cortex_a7_initfn },
     { .name = "cortex-a8",   .initfn = cortex_a8_initfn },
     { .name = "cortex-a9",   .initfn = cortex_a9_initfn },
@ -549,7 +679,7 @@ index 9a2cef7d05..a528ff9a3d 100644
     { .name = "cortex-m0",   .initfn = cortex_m0_initfn,
                              .class_init = arm_v7m_class_init },
     { .name = "cortex-m3",   .initfn = cortex_m3_initfn,
-@@ -1178,6 +1187,7 @@ static const ARMCPUInfo arm_tcg_cpus[] = {
+@@ -1053,6 +1062,7 @@ static const ARMCPUInfo arm_tcg_cpus[] = {
     { .name = "pxa270-b1",   .initfn = pxa270b1_initfn },
     { .name = "pxa270-c0",   .initfn = pxa270c0_initfn },
     { .name = "pxa270-c5",   .initfn = pxa270c5_initfn },
@ -558,7 +688,7 @@ index 9a2cef7d05..a528ff9a3d 100644
     { .name = "max",         .initfn = arm_max_initfn },
 #endif
 diff --git a/target/ppc/cpu-models.c b/target/ppc/cpu-models.c
-index 912b037c63..cd3ff700ac 100644
+index 4baa111713..d779c4d1d5 100644
 --- a/target/ppc/cpu-models.c
 +++ b/target/ppc/cpu-models.c
@@ -66,6 +66,7 @@
@ -567,9 +697,9 @@ index 912b037c63..cd3ff700ac 100644
 
 +#if 0  /* Embedded and 32-bit CPUs disabled for Red Hat Enterprise Linux */
     /* Embedded PowerPC                                                      */
-     /* PowerPC 405 family                                                    */
-     /* PowerPC 405 cores                                                     */
-@@ -698,8 +699,10 @@
+     /* PowerPC 401 family                                                    */
+     POWERPC_DEF("401",           CPU_POWERPC_401,                    401,
+@@ -740,8 +741,10 @@
                 "PowerPC 7447A v1.2 (G4)")
     POWERPC_DEF("7457a_v1.2",    CPU_POWERPC_74x7A_v12,              7455,
                 "PowerPC 7457A v1.2 (G4)")
@ -580,7 +710,7 @@ index 912b037c63..cd3ff700ac 100644
     POWERPC_DEF("970_v2.2",      CPU_POWERPC_970_v22,                970,
                 "PowerPC 970 v2.2")
     POWERPC_DEF("970fx_v1.0",    CPU_POWERPC_970FX_v10,              970,
-@@ -718,6 +721,7 @@
+@@ -760,6 +763,7 @@
                 "PowerPC 970MP v1.1")
     POWERPC_DEF("power5+_v2.1",  CPU_POWERPC_POWER5P_v21,            POWER5P,
                 "POWER5+ v2.1")
@ -588,7 +718,15 @@ index 912b037c63..cd3ff700ac 100644
     POWERPC_DEF("power7_v2.3",   CPU_POWERPC_POWER7_v23,             POWER7,
                 "POWER7 v2.3")
     POWERPC_DEF("power7+_v2.1",  CPU_POWERPC_POWER7P_v21,            POWER7,
-@@ -896,12 +900,15 @@ PowerPCCPUAlias ppc_cpu_aliases[] = {
+@@ -784,6 +788,7 @@
+ /* PowerPC CPU aliases                                                     */
+ 
+ PowerPCCPUAlias ppc_cpu_aliases[] = {
+#if 0  /* Embedded and 32-bit CPUs disabled for Red Hat Enterprise Linux */
+     { "403", "403gc" },
+     { "405", "405d4" },
+     { "405cr", "405crc" },
+@@ -942,12 +947,15 @@ PowerPCCPUAlias ppc_cpu_aliases[] = {
     { "7447a", "7447a_v1.2" },
     { "7457a", "7457a_v1.2" },
     { "apollo7pm", "7457a_v1.0" },
@ -604,7 +742,7 @@ index 912b037c63..cd3ff700ac 100644
     { "power7", "power7_v2.3" },
     { "power7+", "power7+_v2.1" },
     { "power8e", "power8e_v2.1" },
-@@ -911,12 +918,14 @@ PowerPCCPUAlias ppc_cpu_aliases[] = {
+@@ -957,6 +965,7 @@ PowerPCCPUAlias ppc_cpu_aliases[] = {
     { "power10", "power10_v2.0" },
 #endif
 
@ -612,18 +750,18 @@ index 912b037c63..cd3ff700ac 100644
     /* Generic PowerPCs */
 #if defined(TARGET_PPC64)
     { "ppc64", "970fx_v3.1" },
- #endif
+@@ -964,5 +973,6 @@ PowerPCCPUAlias ppc_cpu_aliases[] = {
     { "ppc32", "604" },
     { "ppc", "604" },
+     { "default", "604" },
 +#endif
- 
     { NULL, NULL }
 };
 diff --git a/target/s390x/cpu_models_sysemu.c b/target/s390x/cpu_models_sysemu.c
-index d8a141a023..d086b1c39c 100644
+index 05c3ccaaff..6a04ccab1b 100644
 --- a/target/s390x/cpu_models_sysemu.c
 +++ b/target/s390x/cpu_models_sysemu.c
-@@ -35,6 +35,9 @@ static void check_unavailable_features(const S390CPUModel *max_model,
+@@ -36,6 +36,9 @@ static void check_unavailable_features(const S390CPUModel *max_model,
         (max_model->def->gen == model->def->gen &&
          max_model->def->ec_ga < model->def->ec_ga)) {
         list_add_feat("type", unavailable);
@ -634,10 +772,10 @@ index d8a141a023..d086b1c39c 100644
 
     /* detect missing features if any to properly report them */
 diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c
-index 3ac7ec9acf..97da1a6424 100644
+index 5b1fdb55c4..c52434985b 100644
 --- a/target/s390x/kvm/kvm.c
 +++ b/target/s390x/kvm/kvm.c
-@@ -2529,6 +2529,14 @@ void kvm_s390_apply_cpu_model(const S390CPUModel *model, Error **errp)
+@@ -2508,6 +2508,14 @@ void kvm_s390_apply_cpu_model(const S390CPUModel *model, Error **errp)
         error_setg(errp, "KVM doesn't support CPU models");
         return;
     }
@ -653,5 +791,5 @@ index 3ac7ec9acf..97da1a6424 100644
     prop.ibc = s390_ibc_from_cpu_model(model);
     /* configure cpu features indicated via STFL(e) */
 -- 
-2.31.1
+2.27.0

--- a/SOURCES/0006-Machine-type-related-general-changes.patch
+++ b/SOURCES/0006-Machine-type-related-general-changes.patch
@ -1,665 +0,0 @@
-From 0208f38671b9de4036c0d56142a7f22e5091bae0 Mon Sep 17 00:00:00 2001
-From: Miroslav Rezanina <mrezanin@redhat.com>
-Date: Fri, 11 Jan 2019 09:54:45 +0100
-Subject: Machine type related general changes
-
-This patch is first part of original "Add RHEL machine types" patch we
-split to allow easier review. It contains changes not related to any
-architecture.
-
-Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
--
-Rebase notes (6.2.0):
- Do not duplicate minimal_version_id for piix4_pm
- Remove empty line chunks in serial.c
- Remove migration.h include in serial.c
- Update hw_compat_rhel_8_5 (from MR 66)
-
-Rebase notes (7.0.0):
- Remove downstream changes leftovers in hw/rtc/mc146818rtc.c
- Remove unnecessary change in hw/usb/hcd-uhci.c
-
-Rebase notes (7.1.0 rc0):
- Moved adding rhel_old_machine_deprecation variable from s390x to general machine types commit
- Moved adding hw_compat_rhel_8_6 struct from x86_64 to general machine types commit
-
-Merged patches (6.1.0):
- f2fb42a3c6 redhat: add missing entries in hw_compat_rhel_8_4
- 1949ec258e hw/arm/virt: Disable PL011 clock migration through hw_compat_rhel_8_3
- a3995e2eff Remove RHEL 7.0.0 machine type (only generic changes)
- ad3190a79b Remove RHEL 7.1.0 machine type (only generic changes)
- 84bbe15d4e Remove RHEL 7.2.0 machine type (only generic changes)
- 0215eb3356 Remove RHEL 7.3.0 machine types (only generic changes)
- af69d1ca6e Remove RHEL 7.4.0 machine types (only generic changes)
- 8f7a74ab78 Remove RHEL 7.5.0 machine types (only generic changes)
-
-Merged patches (6.2.0):
- d687ac13d2 redhat: Define hw_compat_rhel_8_5
-
-Merged patches (7.0.0):
- ef5afcc86d Fix virtio-net-pci* "vectors" compat
- 168f0d56e3 compat: Update hw_compat_rhel_8_5 with 6.2.0 RC2 changes
-
-Merged patches (7.1.0 rc0):
- 38b89dc245 pc: Move s3/s4 suspend disabling to compat (only hw/acpi/piix4.c chunk)
- 1d6439527a WRB: Introduce RHEL 9.0.0 hw compat structure (only hw/core/machine.c and include/hw/boards.h chunk)
-
-Merged patches (7.2.0 rc0):
- 0be2889fa2 Introduce upstream 7.0 compat changes (only applicable parts)
---
- hw/acpi/piix4.c              |   2 +-
- hw/arm/virt.c                |   2 +-
- hw/core/machine.c            | 222 +++++++++++++++++++++++++++++++++++
- hw/display/vga-isa.c         |   2 +-
- hw/i386/pc_piix.c            |   2 +
- hw/i386/pc_q35.c             |   2 +
- hw/net/rtl8139.c             |   4 +-
- hw/smbios/smbios.c           |  46 +++++++-
- hw/timer/i8254_common.c      |   2 +-
- hw/usb/hcd-xhci-pci.c        |  59 +++++++---
- hw/usb/hcd-xhci-pci.h        |   1 +
- include/hw/boards.h          |  31 +++++
- include/hw/firmware/smbios.h |   5 +-
- include/hw/i386/pc.h         |   3 +
- 14 files changed, 360 insertions(+), 23 deletions(-)
-
-diff --git a/hw/acpi/piix4.c b/hw/acpi/piix4.c
-index 0a81f1ad93..dbfb362a8f 100644
--- a/hw/acpi/piix4.c
-+++ b/hw/acpi/piix4.c
-@@ -248,7 +248,7 @@ static bool vmstate_test_migrate_acpi_index(void *opaque, int version_id)
- static const VMStateDescription vmstate_acpi = {
-     .name = "piix4_pm",
-     .version_id = 3,
-    .minimum_version_id = 3,
-+    .minimum_version_id = 2,
-     .post_load = vmstate_acpi_post_load,
-     .fields = (VMStateField[]) {
-         VMSTATE_PCI_DEVICE(parent_obj, PIIX4PMState),
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index b871350856..d633300fdc 100644
--- a/hw/arm/virt.c
-+++ b/hw/arm/virt.c
-@@ -1619,7 +1619,7 @@ static void virt_build_smbios(VirtMachineState *vms)
- 
-     smbios_set_defaults("QEMU", product,
-                         vmc->smbios_old_sys_ver ? "1.0" : mc->name, false,
-                        true, SMBIOS_ENTRY_POINT_TYPE_64);
-+                        true, NULL, NULL, SMBIOS_ENTRY_POINT_TYPE_64);
- 
-     smbios_get_tables(MACHINE(vms), NULL, 0,
-                       &smbios_tables, &smbios_tables_len,
-diff --git a/hw/core/machine.c b/hw/core/machine.c
-index 8d34caa31d..9edec1ca05 100644
--- a/hw/core/machine.c
-+++ b/hw/core/machine.c
-@@ -40,6 +40,228 @@
- #include "hw/virtio/virtio-pci.h"
- #include "qom/object_interfaces.h"
- 
-+/*
-+ * RHEL only: machine types for previous major releases are deprecated
-+ */
-+const char *rhel_old_machine_deprecation =
-+    "machine types for previous major releases are deprecated";
-+
-+/*
-+ * Mostly the same as hw_compat_7_0
-+ */
-+GlobalProperty hw_compat_rhel_9_1[] = {
-+  /* hw_compat_rhel_9_1 from hw_compat_7_0 */
-+  { "arm-gicv3-common", "force-8-bit-prio", "on" },
-+  /* hw_compat_rhel_9_1 from hw_compat_7_0 */
-+  { "nvme-ns", "eui64-default", "on"},
-+};
-+const size_t hw_compat_rhel_9_1_len = G_N_ELEMENTS(hw_compat_rhel_9_1);
-+
-+/*
-+ * Mostly the same as hw_compat_6_2
-+ */
-+GlobalProperty hw_compat_rhel_9_0[] = {
-+    /* hw_compat_rhel_9_0 from hw_compat_6_2 */
-+    { "PIIX4_PM", "x-not-migrate-acpi-index", "on"},
-+};
-+const size_t hw_compat_rhel_9_0_len = G_N_ELEMENTS(hw_compat_rhel_9_0);
-+
-+GlobalProperty hw_compat_rhel_8_6[] = {
-+    /* hw_compat_rhel_8_6 bz 2065589 */
-+    /*
-+     * vhost-vsock device in RHEL 8 kernels doesn't support seqpacket, so
-+     * we need do disable it downstream on the latest hw_compat_rhel_8.
-+     */
-+    { "vhost-vsock-device", "seqpacket", "off" },
-+};
-+const size_t hw_compat_rhel_8_6_len = G_N_ELEMENTS(hw_compat_rhel_8_6);
-+
-+/*
-+ * Mostly the same as hw_compat_6_0 and hw_compat_6_1
-+ */
-+GlobalProperty hw_compat_rhel_8_5[] = {
-+    /* hw_compat_rhel_8_5 from hw_compat_6_0 */
-+    { "gpex-pcihost", "allow-unmapped-accesses", "false" },
-+    /* hw_compat_rhel_8_5 from hw_compat_6_0 */
-+    { "i8042", "extended-state", "false"},
-+    /* hw_compat_rhel_8_5 from hw_compat_6_0 */
-+    { "nvme-ns", "eui64-default", "off"},
-+    /* hw_compat_rhel_8_5 from hw_compat_6_0 */
-+    { "e1000", "init-vet", "off" },
-+    /* hw_compat_rhel_8_5 from hw_compat_6_0 */
-+    { "e1000e", "init-vet", "off" },
-+    /* hw_compat_rhel_8_5 from hw_compat_6_0 */
-+    { "vhost-vsock-device", "seqpacket", "off" },
-+    /* hw_compat_rhel_8_5 from hw_compat_6_1 */
-+    { "vhost-user-vsock-device", "seqpacket", "off" },
-+    /* hw_compat_rhel_8_5 from hw_compat_6_1 */
-+    { "nvme-ns", "shared", "off" },
-+};
-+const size_t hw_compat_rhel_8_5_len = G_N_ELEMENTS(hw_compat_rhel_8_5);
-+
-+/*
-+ * Mostly the same as hw_compat_5_2
-+ */
-+GlobalProperty hw_compat_rhel_8_4[] = {
-+    /* hw_compat_rhel_8_4 from hw_compat_5_2 */
-+    { "ICH9-LPC", "smm-compat", "on"},
-+    /* hw_compat_rhel_8_4 from hw_compat_5_2 */
-+    { "PIIX4_PM", "smm-compat", "on"},
-+    /* hw_compat_rhel_8_4 from hw_compat_5_2 */
-+    { "virtio-blk-device", "report-discard-granularity", "off" },
-+    /* hw_compat_rhel_8_4 from hw_compat_5_2 */
-+    /*
-+     * Upstream incorrectly had "virtio-net-pci" instead of "virtio-net-pci-base",
-+     * (https://bugzilla.redhat.com/show_bug.cgi?id=1999141)
-+     */
-+    { "virtio-net-pci-base", "vectors", "3"},
-+};
-+const size_t hw_compat_rhel_8_4_len = G_N_ELEMENTS(hw_compat_rhel_8_4);
-+
-+/*
-+ * Mostly the same as hw_compat_5_1
-+ */
-+GlobalProperty hw_compat_rhel_8_3[] = {
-+    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
-+    { "vhost-scsi", "num_queues", "1"},
-+    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
-+    { "vhost-user-blk", "num-queues", "1"},
-+    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
-+    { "vhost-user-scsi", "num_queues", "1"},
-+    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
-+    { "virtio-blk-device", "num-queues", "1"},
-+    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
-+    { "virtio-scsi-device", "num_queues", "1"},
-+    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
-+    { "nvme", "use-intel-id", "on"},
-+    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
-+    { "pvpanic", "events", "1"}, /* PVPANIC_PANICKED */
-+    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
-+    { "pl011", "migrate-clk", "off" },
-+    /* hw_compat_rhel_8_3 bz 1912846 */
-+    { "pci-xhci", "x-rh-late-msi-cap", "off" },
-+    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
-+    { "virtio-pci", "x-ats-page-aligned", "off"},
-+};
-+const size_t hw_compat_rhel_8_3_len = G_N_ELEMENTS(hw_compat_rhel_8_3);
-+
-+/*
-+ * The same as hw_compat_4_2 + hw_compat_5_0
-+ */
-+GlobalProperty hw_compat_rhel_8_2[] = {
-+    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
-+    { "virtio-blk-device", "queue-size", "128"},
-+    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
-+    { "virtio-scsi-device", "virtqueue_size", "128"},
-+    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
-+    { "virtio-blk-device", "x-enable-wce-if-config-wce", "off" },
-+    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
-+    { "virtio-blk-device", "seg-max-adjust", "off"},
-+    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
-+    { "virtio-scsi-device", "seg_max_adjust", "off"},
-+    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
-+    { "vhost-blk-device", "seg_max_adjust", "off"},
-+    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
-+    { "usb-host", "suppress-remote-wake", "off" },
-+    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
-+    { "usb-redir", "suppress-remote-wake", "off" },
-+    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
-+    { "qxl", "revision", "4" },
-+    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
-+    { "qxl-vga", "revision", "4" },
-+    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
-+    { "fw_cfg", "acpi-mr-restore", "false" },
-+    /* hw_compat_rhel_8_2 from hw_compat_4_2 */
-+    { "virtio-device", "use-disabled-flag", "false" },
-+    /* hw_compat_rhel_8_2 from hw_compat_5_0 */
-+    { "pci-host-bridge", "x-config-reg-migration-enabled", "off" },
-+    /* hw_compat_rhel_8_2 from hw_compat_5_0 */
-+    { "virtio-balloon-device", "page-poison", "false" },
-+    /* hw_compat_rhel_8_2 from hw_compat_5_0 */
-+    { "vmport", "x-read-set-eax", "off" },
-+    /* hw_compat_rhel_8_2 from hw_compat_5_0 */
-+    { "vmport", "x-signal-unsupported-cmd", "off" },
-+    /* hw_compat_rhel_8_2 from hw_compat_5_0 */
-+    { "vmport", "x-report-vmx-type", "off" },
-+    /* hw_compat_rhel_8_2 from hw_compat_5_0 */
-+    { "vmport", "x-cmds-v2", "off" },
-+    /* hw_compat_rhel_8_2 from hw_compat_5_0 */
-+    { "virtio-device", "x-disable-legacy-check", "true" },
-+};
-+const size_t hw_compat_rhel_8_2_len = G_N_ELEMENTS(hw_compat_rhel_8_2);
-+
-+/*
-+ * The same as hw_compat_4_1
-+ */
-+GlobalProperty hw_compat_rhel_8_1[] = {
-+    /* hw_compat_rhel_8_1 from hw_compat_4_1 */
-+    { "virtio-pci", "x-pcie-flr-init", "off" },
-+};
-+const size_t hw_compat_rhel_8_1_len = G_N_ELEMENTS(hw_compat_rhel_8_1);
-+
-+/* The same as hw_compat_3_1
-+ * format of array has been changed by:
-+ *     6c36bddf5340 ("machine: Use shorter format for GlobalProperty arrays")
-+ */
-+GlobalProperty hw_compat_rhel_8_0[] = {
-+    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
-+    { "pcie-root-port", "x-speed", "2_5" },
-+    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
-+    { "pcie-root-port", "x-width", "1" },
-+    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
-+    { "memory-backend-file", "x-use-canonical-path-for-ramblock-id", "true" },
-+    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
-+    { "memory-backend-memfd", "x-use-canonical-path-for-ramblock-id", "true" },
-+    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
-+    { "tpm-crb", "ppi", "false" },
-+    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
-+    { "tpm-tis", "ppi", "false" },
-+    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
-+    { "usb-kbd", "serial", "42" },
-+    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
-+    { "usb-mouse", "serial", "42" },
-+    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
-+    { "usb-tablet", "serial", "42" },
-+    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
-+    { "virtio-blk-device", "discard", "false" },
-+    /* hw_compat_rhel_8_0 from hw_compat_3_1 */
-+    { "virtio-blk-device", "write-zeroes", "false" },
-+    /* hw_compat_rhel_8_0 from hw_compat_4_0 */
-+    { "VGA",            "edid", "false" },
-+    /* hw_compat_rhel_8_0 from hw_compat_4_0 */
-+    { "secondary-vga",  "edid", "false" },
-+    /* hw_compat_rhel_8_0 from hw_compat_4_0 */
-+    { "bochs-display",  "edid", "false" },
-+    /* hw_compat_rhel_8_0 from hw_compat_4_0 */
-+    { "virtio-vga",     "edid", "false" },
-+    /* hw_compat_rhel_8_0 from hw_compat_4_0 */
-+    { "virtio-gpu-device", "edid", "false" },
-+    /* hw_compat_rhel_8_0 from hw_compat_4_0 */
-+    { "virtio-device", "use-started", "false" },
-+    /* hw_compat_rhel_8_0 from hw_compat_3_1 - that was added in 4.1 */
-+    { "pcie-root-port-base", "disable-acs", "true" },
-+};
-+const size_t hw_compat_rhel_8_0_len = G_N_ELEMENTS(hw_compat_rhel_8_0);
-+
-+/* The same as hw_compat_3_0 + hw_compat_2_12
-+ * except that
-+ *   there's nothing in 3_0
-+ *   migration.decompress-error-check=off was in 7.5 from bz 1584139
-+ */
-+GlobalProperty hw_compat_rhel_7_6[] = {
-+    /* hw_compat_rhel_7_6 from hw_compat_2_12 */
-+    { "hda-audio", "use-timer", "false" },
-+    /* hw_compat_rhel_7_6 from hw_compat_2_12 */
-+    { "cirrus-vga", "global-vmstate", "true" },
-+    /* hw_compat_rhel_7_6 from hw_compat_2_12 */
-+    { "VGA", "global-vmstate", "true" },
-+    /* hw_compat_rhel_7_6 from hw_compat_2_12 */
-+    { "vmware-svga", "global-vmstate", "true" },
-+    /* hw_compat_rhel_7_6 from hw_compat_2_12 */
-+    { "qxl-vga", "global-vmstate",  "true" },
-+};
-+const size_t hw_compat_rhel_7_6_len = G_N_ELEMENTS(hw_compat_rhel_7_6);
-+
- GlobalProperty hw_compat_7_1[] = {
-     { "virtio-device", "queue_reset", "false" },
- };
-diff --git a/hw/display/vga-isa.c b/hw/display/vga-isa.c
-index 2a5437d803..0db2c2b2a1 100644
--- a/hw/display/vga-isa.c
-+++ b/hw/display/vga-isa.c
-@@ -89,7 +89,7 @@ static void vga_isa_realizefn(DeviceState *dev, Error **errp)
- }
- 
- static Property vga_isa_properties[] = {
-    DEFINE_PROP_UINT32("vgamem_mb", ISAVGAState, state.vram_size_mb, 8),
-+    DEFINE_PROP_UINT32("vgamem_mb", ISAVGAState, state.vram_size_mb, 16),
-     DEFINE_PROP_END_OF_LIST(),
- };
- 
-diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
-index 0ad0ed1603..0985ff67d2 100644
--- a/hw/i386/pc_piix.c
-+++ b/hw/i386/pc_piix.c
-@@ -187,6 +187,8 @@ static void pc_init1(MachineState *machine,
-         smbios_set_defaults("QEMU", "Standard PC (i440FX + PIIX, 1996)",
-                             mc->name, pcmc->smbios_legacy_mode,
-                             pcmc->smbios_uuid_encoded,
-+                            pcmc->smbios_stream_product,
-+                            pcmc->smbios_stream_version,
-                             pcms->smbios_entry_point_type);
-     }
- 
-diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
-index a496bd6e74..ea582254e3 100644
--- a/hw/i386/pc_q35.c
-+++ b/hw/i386/pc_q35.c
-@@ -201,6 +201,8 @@ static void pc_q35_init(MachineState *machine)
-         smbios_set_defaults("QEMU", "Standard PC (Q35 + ICH9, 2009)",
-                             mc->name, pcmc->smbios_legacy_mode,
-                             pcmc->smbios_uuid_encoded,
-+                            pcmc->smbios_stream_product,
-+                            pcmc->smbios_stream_version,
-                             pcms->smbios_entry_point_type);
-     }
- 
-diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
-index 700b1b66b6..13693aeb4f 100644
--- a/hw/net/rtl8139.c
-+++ b/hw/net/rtl8139.c
-@@ -3178,7 +3178,7 @@ static int rtl8139_pre_save(void *opaque)
- 
- static const VMStateDescription vmstate_rtl8139 = {
-     .name = "rtl8139",
-    .version_id = 5,
-+    .version_id = 4,
-     .minimum_version_id = 3,
-     .post_load = rtl8139_post_load,
-     .pre_save  = rtl8139_pre_save,
-@@ -3259,7 +3259,9 @@ static const VMStateDescription vmstate_rtl8139 = {
-         VMSTATE_UINT32(tally_counters.TxMCol, RTL8139State),
-         VMSTATE_UINT64(tally_counters.RxOkPhy, RTL8139State),
-         VMSTATE_UINT64(tally_counters.RxOkBrd, RTL8139State),
-+#if 0 /* Disabled for Red Hat Enterprise Linux bz 1420195 */
-         VMSTATE_UINT32_V(tally_counters.RxOkMul, RTL8139State, 5),
-+#endif
-         VMSTATE_UINT16(tally_counters.TxAbt, RTL8139State),
-         VMSTATE_UINT16(tally_counters.TxUndrn, RTL8139State),
- 
-diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c
-index b4243de735..c5ad69237e 100644
--- a/hw/smbios/smbios.c
-+++ b/hw/smbios/smbios.c
-@@ -57,6 +57,9 @@ static bool smbios_legacy = true;
- static bool smbios_uuid_encoded = true;
- /* end: legacy structures & constants for <= 2.0 machines */
- 
-+/* Set to true for modern Windows 10 HardwareID-6 compat */
-+static bool smbios_type2_required;
-+
- 
- uint8_t *smbios_tables;
- size_t smbios_tables_len;
-@@ -669,7 +672,7 @@ static void smbios_build_type_1_table(void)
- 
- static void smbios_build_type_2_table(void)
- {
-    SMBIOS_BUILD_TABLE_PRE(2, T2_BASE, false); /* optional */
-+    SMBIOS_BUILD_TABLE_PRE(2, T2_BASE, smbios_type2_required);
- 
-     SMBIOS_TABLE_SET_STR(2, manufacturer_str, type2.manufacturer);
-     SMBIOS_TABLE_SET_STR(2, product_str, type2.product);
-@@ -977,7 +980,10 @@ void smbios_set_cpuid(uint32_t version, uint32_t features)
- 
- void smbios_set_defaults(const char *manufacturer, const char *product,
-                          const char *version, bool legacy_mode,
-                         bool uuid_encoded, SmbiosEntryPointType ep_type)
-+                         bool uuid_encoded,
-+                         const char *stream_product,
-+                         const char *stream_version,
-+                         SmbiosEntryPointType ep_type)
- {
-     smbios_have_defaults = true;
-     smbios_legacy = legacy_mode;
-@@ -998,11 +1004,45 @@ void smbios_set_defaults(const char *manufacturer, const char *product,
-         g_free(smbios_entries);
-     }
- 
-+    /*
-+     * If @stream_product & @stream_version are non-NULL, then
-+     * we're following rules for new Windows driver support.
-+     * The data we have to report is defined in this doc:
-+     *
-+     * https://docs.microsoft.com/en-us/windows-hardware/drivers/install/specifying-hardware-ids-for-a-computer
-+     *
-+     * The Windows drivers are written to expect use of the
-+     * scheme documented as "HardwareID-6" against Windows 10,
-+     * which uses SMBIOS System (Type 1) and Base Board (Type 2)
-+     * tables and will match on
-+     *
-+     *   System Manufacturer = Red Hat     (@manufacturer)
-+     *   System SKU Number = 8.2.0         (@stream_version)
-+     *   Baseboard Manufacturer = Red Hat  (@manufacturer)
-+     *   Baseboard Product = RHEL-AV       (@stream_product)
-+     *
-+     * NB, SKU must be changed with each RHEL-AV release
-+     *
-+     * Other fields can be freely used by applications using
-+     * QEMU. For example apps can use the "System product"
-+     * and "System version" to identify themselves.
-+     *
-+     * We get 'System Manufacturer' and 'Baseboard Manufacturer'
-+     */
-     SMBIOS_SET_DEFAULT(type1.manufacturer, manufacturer);
-     SMBIOS_SET_DEFAULT(type1.product, product);
-     SMBIOS_SET_DEFAULT(type1.version, version);
-+    SMBIOS_SET_DEFAULT(type1.family, "Red Hat Enterprise Linux");
-+    if (stream_version != NULL) {
-+        SMBIOS_SET_DEFAULT(type1.sku, stream_version);
-+    }
-     SMBIOS_SET_DEFAULT(type2.manufacturer, manufacturer);
-    SMBIOS_SET_DEFAULT(type2.product, product);
-+    if (stream_product != NULL) {
-+        SMBIOS_SET_DEFAULT(type2.product, stream_product);
-+        smbios_type2_required = true;
-+    } else {
-+        SMBIOS_SET_DEFAULT(type2.product, product);
-+    }
-     SMBIOS_SET_DEFAULT(type2.version, version);
-     SMBIOS_SET_DEFAULT(type3.manufacturer, manufacturer);
-     SMBIOS_SET_DEFAULT(type3.version, version);
-diff --git a/hw/timer/i8254_common.c b/hw/timer/i8254_common.c
-index 050875b497..32935da46c 100644
--- a/hw/timer/i8254_common.c
-+++ b/hw/timer/i8254_common.c
-@@ -231,7 +231,7 @@ static const VMStateDescription vmstate_pit_common = {
-     .pre_save = pit_dispatch_pre_save,
-     .post_load = pit_dispatch_post_load,
-     .fields = (VMStateField[]) {
-        VMSTATE_UINT32_V(channels[0].irq_disabled, PITCommonState, 3),
-+        VMSTATE_UINT32(channels[0].irq_disabled, PITCommonState), /* qemu-kvm's v2 had 'flags' here */
-         VMSTATE_STRUCT_ARRAY(channels, PITCommonState, 3, 2,
-                              vmstate_pit_channel, PITChannelState),
-         VMSTATE_INT64(channels[0].next_transition_time,
-diff --git a/hw/usb/hcd-xhci-pci.c b/hw/usb/hcd-xhci-pci.c
-index 643d4643e4..529bad9366 100644
--- a/hw/usb/hcd-xhci-pci.c
-+++ b/hw/usb/hcd-xhci-pci.c
-@@ -104,6 +104,33 @@ static int xhci_pci_vmstate_post_load(void *opaque, int version_id)
-    return 0;
- }
- 
-+/* RH bz 1912846 */
-+static bool usb_xhci_pci_add_msi(struct PCIDevice *dev, Error **errp)
-+{
-+    int ret;
-+    Error *err = NULL;
-+    XHCIPciState *s = XHCI_PCI(dev);
-+
-+    ret = msi_init(dev, 0x70, s->xhci.numintrs, true, false, &err);
-+    /*
-+     * Any error other than -ENOTSUP(board's MSI support is broken)
-+     * is a programming error
-+     */
-+    assert(!ret || ret == -ENOTSUP);
-+    if (ret && s->msi == ON_OFF_AUTO_ON) {
-+        /* Can't satisfy user's explicit msi=on request, fail */
-+        error_append_hint(&err, "You have to use msi=auto (default) or "
-+                "msi=off with this machine type.\n");
-+        error_propagate(errp, err);
-+        return true;
-+    }
-+    assert(!err || s->msi == ON_OFF_AUTO_AUTO);
-+    /* With msi=auto, we fall back to MSI off silently */
-+    error_free(err);
-+
-+    return false;
-+}
-+
- static void usb_xhci_pci_realize(struct PCIDevice *dev, Error **errp)
- {
-     int ret;
-@@ -125,23 +152,12 @@ static void usb_xhci_pci_realize(struct PCIDevice *dev, Error **errp)
-         s->xhci.nec_quirks = true;
-     }
- 
-    if (s->msi != ON_OFF_AUTO_OFF) {
-        ret = msi_init(dev, 0x70, s->xhci.numintrs, true, false, &err);
-        /*
-         * Any error other than -ENOTSUP(board's MSI support is broken)
-         * is a programming error
-         */
-        assert(!ret || ret == -ENOTSUP);
-        if (ret && s->msi == ON_OFF_AUTO_ON) {
-            /* Can't satisfy user's explicit msi=on request, fail */
-            error_append_hint(&err, "You have to use msi=auto (default) or "
-                    "msi=off with this machine type.\n");
-+    if (s->msi != ON_OFF_AUTO_OFF && s->rh_late_msi_cap) {
-+        /* This gives the behaviour from 5.2.0 onwards, lspci shows 90,a0,70 */
-+        if (usb_xhci_pci_add_msi(dev, &err)) {
-             error_propagate(errp, err);
-             return;
-         }
-        assert(!err || s->msi == ON_OFF_AUTO_AUTO);
-        /* With msi=auto, we fall back to MSI off silently */
-        error_free(err);
-     }
-     pci_register_bar(dev, 0,
-                      PCI_BASE_ADDRESS_SPACE_MEMORY |
-@@ -154,6 +170,14 @@ static void usb_xhci_pci_realize(struct PCIDevice *dev, Error **errp)
-         assert(ret > 0);
-     }
- 
-+    /* RH bz 1912846 */
-+    if (s->msi != ON_OFF_AUTO_OFF && !s->rh_late_msi_cap) {
-+        /* This gives the older RH machine behaviour, lspci shows 90,70,a0 */
-+        if (usb_xhci_pci_add_msi(dev, &err)) {
-+            error_propagate(errp, err);
-+            return;
-+        }
-+    }
-     if (s->msix != ON_OFF_AUTO_OFF) {
-         /* TODO check for errors, and should fail when msix=on */
-         msix_init(dev, s->xhci.numintrs,
-@@ -198,11 +222,18 @@ static void xhci_instance_init(Object *obj)
-     qdev_alias_all_properties(DEVICE(&s->xhci), obj);
- }
- 
-+static Property xhci_pci_properties[] = {
-+    /* RH bz 1912846 */
-+    DEFINE_PROP_BOOL("x-rh-late-msi-cap", XHCIPciState, rh_late_msi_cap, true),
-+    DEFINE_PROP_END_OF_LIST()
-+};
-+
- static void xhci_class_init(ObjectClass *klass, void *data)
- {
-     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
-     DeviceClass *dc = DEVICE_CLASS(klass);
- 
-+    device_class_set_props(dc, xhci_pci_properties);
-     dc->reset   = xhci_pci_reset;
-     dc->vmsd    = &vmstate_xhci_pci;
-     set_bit(DEVICE_CATEGORY_USB, dc->categories);
-diff --git a/hw/usb/hcd-xhci-pci.h b/hw/usb/hcd-xhci-pci.h
-index c193f79443..086a1feb1e 100644
--- a/hw/usb/hcd-xhci-pci.h
-+++ b/hw/usb/hcd-xhci-pci.h
-@@ -39,6 +39,7 @@ typedef struct XHCIPciState {
-     XHCIState xhci;
-     OnOffAuto msi;
-     OnOffAuto msix;
-+    bool      rh_late_msi_cap;  /* bz 1912846 */
- } XHCIPciState;
- 
- #endif
-diff --git a/include/hw/boards.h b/include/hw/boards.h
-index 90f1dd3aeb..2209d4e416 100644
--- a/include/hw/boards.h
-+++ b/include/hw/boards.h
-@@ -454,4 +454,35 @@ extern const size_t hw_compat_2_2_len;
- extern GlobalProperty hw_compat_2_1[];
- extern const size_t hw_compat_2_1_len;
- 
-+extern GlobalProperty hw_compat_rhel_9_1[];
-+extern const size_t hw_compat_rhel_9_1_len;
-+
-+extern GlobalProperty hw_compat_rhel_9_0[];
-+extern const size_t hw_compat_rhel_9_0_len;
-+
-+extern GlobalProperty hw_compat_rhel_8_6[];
-+extern const size_t hw_compat_rhel_8_6_len;
-+
-+extern GlobalProperty hw_compat_rhel_8_5[];
-+extern const size_t hw_compat_rhel_8_5_len;
-+
-+extern GlobalProperty hw_compat_rhel_8_4[];
-+extern const size_t hw_compat_rhel_8_4_len;
-+
-+extern GlobalProperty hw_compat_rhel_8_3[];
-+extern const size_t hw_compat_rhel_8_3_len;
-+
-+extern GlobalProperty hw_compat_rhel_8_2[];
-+extern const size_t hw_compat_rhel_8_2_len;
-+
-+extern GlobalProperty hw_compat_rhel_8_1[];
-+extern const size_t hw_compat_rhel_8_1_len;
-+
-+extern GlobalProperty hw_compat_rhel_8_0[];
-+extern const size_t hw_compat_rhel_8_0_len;
-+
-+extern GlobalProperty hw_compat_rhel_7_6[];
-+extern const size_t hw_compat_rhel_7_6_len;
-+
-+extern const char *rhel_old_machine_deprecation;
- #endif
-diff --git a/include/hw/firmware/smbios.h b/include/hw/firmware/smbios.h
-index 7f3259a630..d24b3ccd32 100644
--- a/include/hw/firmware/smbios.h
-+++ b/include/hw/firmware/smbios.h
-@@ -294,7 +294,10 @@ void smbios_entry_add(QemuOpts *opts, Error **errp);
- void smbios_set_cpuid(uint32_t version, uint32_t features);
- void smbios_set_defaults(const char *manufacturer, const char *product,
-                          const char *version, bool legacy_mode,
-                         bool uuid_encoded, SmbiosEntryPointType ep_type);
-+                         bool uuid_encoded,
-+                         const char *stream_product,
-+                         const char *stream_version,
-+                         SmbiosEntryPointType ep_type);
- uint8_t *smbios_get_table_legacy(MachineState *ms, size_t *length);
- void smbios_get_tables(MachineState *ms,
-                        const struct smbios_phys_mem_area *mem_array,
-diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
-index c95333514e..3754eaa97d 100644
--- a/include/hw/i386/pc.h
-+++ b/include/hw/i386/pc.h
-@@ -112,6 +112,9 @@ struct PCMachineClass {
-     bool smbios_defaults;
-     bool smbios_legacy_mode;
-     bool smbios_uuid_encoded;
-+    /* New fields needed for Windows HardwareID-6 matching */
-+    const char *smbios_stream_product;
-+    const char *smbios_stream_version;
- 
-     /* RAM / address space compat: */
-     bool gigabyte_align;
-- 
-2.31.1
-
--- a/SOURCES/0007-Add-aarch64-machine-types.patch
+++ b/SOURCES/0007-Add-aarch64-machine-types.patch
@ -1,675 +0,0 @@
-From 8501581c99760ed8a800d0c98eeb17a4bf450366 Mon Sep 17 00:00:00 2001
-From: Miroslav Rezanina <mrezanin@redhat.com>
-Date: Fri, 19 Oct 2018 12:53:31 +0200
-Subject: Add aarch64 machine types
-
-Adding changes to add RHEL machine types for aarch64 architecture.
-
-Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
---
-Rebase notes (6.1.0):
- Use CONFIG_TPM check when using TPM structures
- Add support for default_bus_bypass_iommu
- ea4c0b32d9 arm/virt: Register highmem and gic-version as class properties
- 895e1fa86a hw/arm/virt: Add 8.5 and 9.0 machine types and remove older ones
-
-Rebase notes (7.0.0):
- Added dtb-kaslr-seed option
- Set no_tcg_lpa2 to true
-
-Rebase notes (7.1.0 rc0):
- replace dtb_kaslr_seed by dtb_randomness
-
-Rebase notes (7.1.0 rc3):
- Updated dtb_randomness comment
-
-Rebase notes (7.2.0 rc0):
- Disabled cortex-a35
-
-Merged patches (6.2.0):
- 9a3d4fde0e hw/arm/virt: Remove 9.0 machine type
- f7d04d6695 hw: arm: virt: Add hw_compat_rhel_8_5 to 8.5 machine type
-
-Merged patches (7.0.0):
- 3b82be3dd3 redhat: virt-rhel8.5.0: Update machine type compatibility for QEMU 6.2.0 update
- c354a86c9b hw/arm/virt: Register "iommu" as a class property
- c1a2630dc9 hw/arm/virt: Register "its" as a class property
- 9d8c61dc93 hw/arm/virt: Rename default_bus_bypass_iommu
- a1d1b6eeb6 hw/arm/virt: Expose the 'RAS' option
- 47f8fe1b82 hw/arm/virt: Add 9.0 machine type and remove 8.5 one
- ed2346788f hw/arm/virt: Check no_tcg_its and minor style changes
-
-Merged patches (7.0.0):
- f79b31bdef hw/arm/virt: Remove the dtb-kaslr-seed machine option
- b6fca85f4a hw/arm/virt: Fix missing initialization in instance/class_init()
-
-Merged patches (7.1.0 rc0):
- ac97dd4f9f RHEL-only: AArch64: Drop unsupported CPU types
- e9c0a70664 target/arm: deprecate named CPU models
-
-Merged patches (7.2.0 rc0):
- 0be2889fa2 Introduce upstream 7.0 compat changes (only applicable parts)
---
- hw/arm/virt.c                  | 237 ++++++++++++++++++++++++++++++++-
- include/hw/arm/virt.h          |   8 ++
- target/arm/cpu-qom.h           |   1 +
- target/arm/cpu.c               |   5 +
- target/arm/cpu.h               |   2 +
- target/arm/cpu64.c             |  16 ++-
- target/arm/cpu_tcg.c           |  12 +-
- target/arm/helper.c            |   2 +
- tests/qtest/arm-cpu-features.c |   6 +
- 9 files changed, 277 insertions(+), 12 deletions(-)
-
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index d633300fdc..dfcab40a73 100644
--- a/hw/arm/virt.c
-+++ b/hw/arm/virt.c
-@@ -80,6 +80,7 @@
- #include "hw/char/pl011.h"
- #include "qemu/guest-random.h"
- 
-+#if 0 /* Disabled for Red Hat Enterprise Linux */
- #define DEFINE_VIRT_MACHINE_LATEST(major, minor, latest) \
-     static void virt_##major##_##minor##_class_init(ObjectClass *oc, \
-                                                     void *data) \
-@@ -106,7 +107,48 @@
-     DEFINE_VIRT_MACHINE_LATEST(major, minor, true)
- #define DEFINE_VIRT_MACHINE(major, minor) \
-     DEFINE_VIRT_MACHINE_LATEST(major, minor, false)
-
-+#endif /* disabled for RHEL */
-+
-+#define DEFINE_RHEL_MACHINE_LATEST(m, n, s, latest)                     \
-+    static void rhel##m##n##s##_virt_class_init(ObjectClass *oc,        \
-+                                                void *data)             \
-+    {                                                                   \
-+        MachineClass *mc = MACHINE_CLASS(oc);                           \
-+        rhel##m##n##s##_virt_options(mc);                               \
-+        mc->desc = "RHEL " # m "." # n "." # s " ARM Virtual Machine";  \
-+        if (latest) {                                                   \
-+            mc->alias = "virt";                                         \
-+            mc->is_default = 1;                                         \
-+        }                                                               \
-+    }                                                                   \
-+    static const TypeInfo rhel##m##n##s##_machvirt_info = {             \
-+        .name = MACHINE_TYPE_NAME("virt-rhel" # m "." # n "." # s),     \
-+        .parent = TYPE_RHEL_MACHINE,                                    \
-+        .class_init = rhel##m##n##s##_virt_class_init,                  \
-+    };                                                                  \
-+    static void rhel##m##n##s##_machvirt_init(void)                     \
-+    {                                                                   \
-+        type_register_static(&rhel##m##n##s##_machvirt_info);           \
-+    }                                                                   \
-+    type_init(rhel##m##n##s##_machvirt_init);
-+
-+#define DEFINE_RHEL_MACHINE_AS_LATEST(major, minor, subminor)   \
-+    DEFINE_RHEL_MACHINE_LATEST(major, minor, subminor, true)
-+#define DEFINE_RHEL_MACHINE(major, minor, subminor)             \
-+    DEFINE_RHEL_MACHINE_LATEST(major, minor, subminor, false)
-+
-+/* This variable is for changes to properties that are RHEL specific,
-+ * different to the current upstream and to be applied to the latest
-+ * machine type.
-+ */
-+GlobalProperty arm_rhel_compat[] = {
-+    {
-+        .driver   = "virtio-net-pci",
-+        .property = "romfile",
-+        .value    = "",
-+    },
-+};
-+const size_t arm_rhel_compat_len = G_N_ELEMENTS(arm_rhel_compat);
- 
- /* Number of external interrupt lines to configure the GIC with */
- #define NUM_IRQS 256
-@@ -197,15 +239,19 @@ static const int a15irqmap[] = {
- };
- 
- static const char *valid_cpus[] = {
-+#if 0 /* Disabled for Red Hat Enterprise Linux */
-     ARM_CPU_TYPE_NAME("cortex-a7"),
-     ARM_CPU_TYPE_NAME("cortex-a15"),
-     ARM_CPU_TYPE_NAME("cortex-a35"),
-     ARM_CPU_TYPE_NAME("cortex-a53"),
-+#endif /* disabled for RHEL */
-     ARM_CPU_TYPE_NAME("cortex-a57"),
-+#if 0 /* Disabled for Red Hat Enterprise Linux */
-     ARM_CPU_TYPE_NAME("cortex-a72"),
-     ARM_CPU_TYPE_NAME("cortex-a76"),
-     ARM_CPU_TYPE_NAME("a64fx"),
-     ARM_CPU_TYPE_NAME("neoverse-n1"),
-+#endif /* disabled for RHEL */
-     ARM_CPU_TYPE_NAME("host"),
-     ARM_CPU_TYPE_NAME("max"),
- };
-@@ -2290,6 +2336,7 @@ static void machvirt_init(MachineState *machine)
-     qemu_add_machine_init_done_notifier(&vms->machine_done);
- }
- 
-+#if 0 /* Disabled for Red Hat Enterprise Linux */
- static bool virt_get_secure(Object *obj, Error **errp)
- {
-     VirtMachineState *vms = VIRT_MACHINE(obj);
-@@ -2317,6 +2364,7 @@ static void virt_set_virt(Object *obj, bool value, Error **errp)
- 
-     vms->virt = value;
- }
-+#endif /* disabled for RHEL */
- 
- static bool virt_get_highmem(Object *obj, Error **errp)
- {
-@@ -2346,6 +2394,7 @@ static void virt_set_its(Object *obj, bool value, Error **errp)
-     vms->its = value;
- }
- 
-+#if 0 /* Disabled for Red Hat Enterprise Linux */
- static bool virt_get_dtb_randomness(Object *obj, Error **errp)
- {
-     VirtMachineState *vms = VIRT_MACHINE(obj);
-@@ -2359,6 +2408,7 @@ static void virt_set_dtb_randomness(Object *obj, bool value, Error **errp)
- 
-     vms->dtb_randomness = value;
- }
-+#endif /* disabled for RHEL */
- 
- static char *virt_get_oem_id(Object *obj, Error **errp)
- {
-@@ -2442,6 +2492,7 @@ static void virt_set_ras(Object *obj, bool value, Error **errp)
-     vms->ras = value;
- }
- 
-+#if 0 /* Disabled for Red Hat Enterprise Linux */
- static bool virt_get_mte(Object *obj, Error **errp)
- {
-     VirtMachineState *vms = VIRT_MACHINE(obj);
-@@ -2455,6 +2506,7 @@ static void virt_set_mte(Object *obj, bool value, Error **errp)
- 
-     vms->mte = value;
- }
-+#endif /* disabled for RHEL */
- 
- static char *virt_get_gic_version(Object *obj, Error **errp)
- {
-@@ -2886,6 +2938,7 @@ static int virt_kvm_type(MachineState *ms, const char *type_str)
-     return fixed_ipa ? 0 : requested_pa_size;
- }
- 
-+#if 0 /* Disabled for Red Hat Enterprise Linux */
- static void virt_machine_class_init(ObjectClass *oc, void *data)
- {
-     MachineClass *mc = MACHINE_CLASS(oc);
-@@ -3294,3 +3347,185 @@ static void virt_machine_2_6_options(MachineClass *mc)
-     vmc->no_pmu = true;
- }
- DEFINE_VIRT_MACHINE(2, 6)
-+#endif /* disabled for RHEL */
-+
-+static void rhel_machine_class_init(ObjectClass *oc, void *data)
-+{
-+    MachineClass *mc = MACHINE_CLASS(oc);
-+    HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(oc);
-+
-+    mc->family = "virt-rhel-Z";
-+    mc->init = machvirt_init;
-+    /* Maximum supported VCPU count for all virt-rhel* machines */
-+    mc->max_cpus = 384;
-+#ifdef CONFIG_TPM
-+    machine_class_allow_dynamic_sysbus_dev(mc, TYPE_TPM_TIS_SYSBUS);
-+#endif
-+    mc->block_default_type = IF_VIRTIO;
-+    mc->no_cdrom = 1;
-+    mc->pci_allow_0_address = true;
-+    /* We know we will never create a pre-ARMv7 CPU which needs 1K pages */
-+    mc->minimum_page_bits = 12;
-+    mc->possible_cpu_arch_ids = virt_possible_cpu_arch_ids;
-+    mc->cpu_index_to_instance_props = virt_cpu_index_to_props;
-+    mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a57");
-+    mc->get_default_cpu_node_id = virt_get_default_cpu_node_id;
-+    mc->kvm_type = virt_kvm_type;
-+    assert(!mc->get_hotplug_handler);
-+    mc->get_hotplug_handler = virt_machine_get_hotplug_handler;
-+    hc->pre_plug = virt_machine_device_pre_plug_cb;
-+    hc->plug = virt_machine_device_plug_cb;
-+    hc->unplug_request = virt_machine_device_unplug_request_cb;
-+    hc->unplug = virt_machine_device_unplug_cb;
-+    mc->nvdimm_supported = true;
-+    mc->smp_props.clusters_supported = true;
-+    mc->auto_enable_numa_with_memhp = true;
-+    mc->auto_enable_numa_with_memdev = true;
-+    mc->default_ram_id = "mach-virt.ram";
-+
-+    object_class_property_add(oc, "acpi", "OnOffAuto",
-+        virt_get_acpi, virt_set_acpi,
-+        NULL, NULL);
-+    object_class_property_set_description(oc, "acpi",
-+        "Enable ACPI");
-+
-+    object_class_property_add_bool(oc, "highmem", virt_get_highmem,
-+                                   virt_set_highmem);
-+    object_class_property_set_description(oc, "highmem",
-+                                          "Set on/off to enable/disable using "
-+                                          "physical address space above 32 bits");
-+
-+    object_class_property_add_str(oc, "gic-version", virt_get_gic_version,
-+                                  virt_set_gic_version);
-+    object_class_property_set_description(oc, "gic-version",
-+                                          "Set GIC version. "
-+                                          "Valid values are 2, 3, host and max");
-+
-+    object_class_property_add_str(oc, "iommu", virt_get_iommu, virt_set_iommu);
-+    object_class_property_set_description(oc, "iommu",
-+                                          "Set the IOMMU type. "
-+                                          "Valid values are none and smmuv3");
-+
-+    object_class_property_add_bool(oc, "default-bus-bypass-iommu",
-+                                   virt_get_default_bus_bypass_iommu,
-+                                   virt_set_default_bus_bypass_iommu);
-+    object_class_property_set_description(oc, "default-bus-bypass-iommu",
-+                                          "Set on/off to enable/disable "
-+                                          "bypass_iommu for default root bus");
-+
-+    object_class_property_add_bool(oc, "ras", virt_get_ras,
-+                                   virt_set_ras);
-+    object_class_property_set_description(oc, "ras",
-+                                          "Set on/off to enable/disable reporting host memory errors "
-+                                          "to a KVM guest using ACPI and guest external abort exceptions");
-+
-+    object_class_property_add_bool(oc, "its", virt_get_its,
-+                                   virt_set_its);
-+    object_class_property_set_description(oc, "its",
-+                                          "Set on/off to enable/disable "
-+                                          "ITS instantiation");
-+
-+    object_class_property_add_str(oc, "x-oem-id",
-+                                  virt_get_oem_id,
-+                                  virt_set_oem_id);
-+    object_class_property_set_description(oc, "x-oem-id",
-+                                          "Override the default value of field OEMID "
-+                                          "in ACPI table header."
-+                                          "The string may be up to 6 bytes in size");
-+
-+
-+    object_class_property_add_str(oc, "x-oem-table-id",
-+                                  virt_get_oem_table_id,
-+                                  virt_set_oem_table_id);
-+    object_class_property_set_description(oc, "x-oem-table-id",
-+                                          "Override the default value of field OEM Table ID "
-+                                          "in ACPI table header."
-+                                          "The string may be up to 8 bytes in size");
-+}
-+
-+static void rhel_virt_instance_init(Object *obj)
-+{
-+    VirtMachineState *vms = VIRT_MACHINE(obj);
-+    VirtMachineClass *vmc = VIRT_MACHINE_GET_CLASS(vms);
-+
-+    /* EL3 is disabled by default and non-configurable for RHEL */
-+    vms->secure = false;
-+
-+    /* EL2 is disabled by default and non-configurable for RHEL */
-+    vms->virt = false;
-+
-+    /* High memory is enabled by default */
-+    vms->highmem = true;
-+    vms->gic_version = VIRT_GIC_VERSION_NOSEL;
-+
-+    vms->highmem_ecam = !vmc->no_highmem_ecam;
-+    vms->highmem_mmio = true;
-+    vms->highmem_redists = true;
-+
-+    if (vmc->no_its) {
-+        vms->its = false;
-+    } else {
-+        /* Default allows ITS instantiation */
-+        vms->its = true;
-+
-+        if (vmc->no_tcg_its) {
-+            vms->tcg_its = false;
-+        } else {
-+            vms->tcg_its = true;
-+        }
-+    }
-+
-+    /* Default disallows iommu instantiation */
-+    vms->iommu = VIRT_IOMMU_NONE;
-+
-+    /* The default root bus is attached to iommu by default */
-+    vms->default_bus_bypass_iommu = false;
-+
-+    /* Default disallows RAS instantiation and is non-configurable for RHEL */
-+    vms->ras = false;
-+
-+    /* MTE is disabled by default and non-configurable for RHEL */
-+    vms->mte = false;
-+
-+    /* Supply kaslr-seed and rng-seed by default, non-configurable for RHEL */
-+    vms->dtb_randomness = true;
-+
-+    vms->irqmap = a15irqmap;
-+
-+    virt_flash_create(vms);
-+
-+    vms->oem_id = g_strndup(ACPI_BUILD_APPNAME6, 6);
-+    vms->oem_table_id = g_strndup(ACPI_BUILD_APPNAME8, 8);
-+}
-+
-+static const TypeInfo rhel_machine_info = {
-+    .name          = TYPE_RHEL_MACHINE,
-+    .parent        = TYPE_MACHINE,
-+    .abstract      = true,
-+    .instance_size = sizeof(VirtMachineState),
-+    .class_size    = sizeof(VirtMachineClass),
-+    .class_init    = rhel_machine_class_init,
-+    .instance_init = rhel_virt_instance_init,
-+    .interfaces = (InterfaceInfo[]) {
-+         { TYPE_HOTPLUG_HANDLER },
-+         { }
-+    },
-+};
-+
-+static void rhel_machine_init(void)
-+{
-+    type_register_static(&rhel_machine_info);
-+}
-+type_init(rhel_machine_init);
-+
-+static void rhel900_virt_options(MachineClass *mc)
-+{
-+    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
-+
-+    compat_props_add(mc->compat_props, arm_rhel_compat, arm_rhel_compat_len);
-+    compat_props_add(mc->compat_props, hw_compat_rhel_9_1, hw_compat_rhel_9_1_len);
-+
-+    /* Disable FEAT_LPA2 since old kernels (<= v5.12) don't boot with that feature */
-+    vmc->no_tcg_lpa2 = true;
-+}
-+DEFINE_RHEL_MACHINE_AS_LATEST(9, 0, 0)
-diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
-index 6ec479ca2b..22b54ec510 100644
--- a/include/hw/arm/virt.h
-+++ b/include/hw/arm/virt.h
-@@ -180,9 +180,17 @@ struct VirtMachineState {
- 
- #define VIRT_ECAM_ID(high) (high ? VIRT_HIGH_PCIE_ECAM : VIRT_PCIE_ECAM)
- 
-+#if 0 /* disabled for Red Hat Enterprise Linux */
- #define TYPE_VIRT_MACHINE   MACHINE_TYPE_NAME("virt")
- OBJECT_DECLARE_TYPE(VirtMachineState, VirtMachineClass, VIRT_MACHINE)
- 
-+#else
-+#define TYPE_RHEL_MACHINE MACHINE_TYPE_NAME("virt-rhel")
-+typedef struct VirtMachineClass VirtMachineClass;
-+typedef struct VirtMachineState VirtMachineState;
-+DECLARE_OBJ_CHECKERS(VirtMachineState, VirtMachineClass, VIRT_MACHINE, TYPE_RHEL_MACHINE)
-+#endif
-+
- void virt_acpi_setup(VirtMachineState *vms);
- bool virt_is_acpi_enabled(VirtMachineState *vms);
- 
-diff --git a/target/arm/cpu-qom.h b/target/arm/cpu-qom.h
-index 64c44cef2d..82e97249bc 100644
--- a/target/arm/cpu-qom.h
-+++ b/target/arm/cpu-qom.h
-@@ -35,6 +35,7 @@ typedef struct ARMCPUInfo {
-     const char *name;
-     void (*initfn)(Object *obj);
-     void (*class_init)(ObjectClass *oc, void *data);
-+    const char *deprecation_note;
- } ARMCPUInfo;
- 
- void arm_cpu_register(const ARMCPUInfo *info);
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-index 38d066c294..a845814bfb 100644
--- a/target/arm/cpu.c
-+++ b/target/arm/cpu.c
-@@ -2250,8 +2250,13 @@ static void arm_cpu_instance_init(Object *obj)
- static void cpu_register_class_init(ObjectClass *oc, void *data)
- {
-     ARMCPUClass *acc = ARM_CPU_CLASS(oc);
-+    CPUClass *cc = CPU_CLASS(oc);
- 
-     acc->info = data;
-+
-+    if (acc->info->deprecation_note) {
-+        cc->deprecation_note = acc->info->deprecation_note;
-+    }
- }
- 
- void arm_cpu_register(const ARMCPUInfo *info)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-index 9aeed3c848..f9f504d89e 100644
--- a/target/arm/cpu.h
-+++ b/target/arm/cpu.h
-@@ -34,6 +34,8 @@
- #define KVM_HAVE_MCE_INJECTION 1
- #endif
- 
-+#define RHEL_CPU_DEPRECATION "use 'host' / 'max'"
-+
- #define EXCP_UDEF            1   /* undefined instruction */
- #define EXCP_SWI             2   /* software interrupt */
- #define EXCP_PREFETCH_ABORT  3
-diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
-index 3d74f134f5..4b330a52b5 100644
--- a/target/arm/cpu64.c
-+++ b/target/arm/cpu64.c
-@@ -36,6 +36,7 @@
- #include "hw/qdev-properties.h"
- #include "internals.h"
- 
-+#if 0 /* Disabled for Red Hat Enterprise Linux */
- static void aarch64_a35_initfn(Object *obj)
- {
-     ARMCPU *cpu = ARM_CPU(obj);
-@@ -115,6 +116,7 @@ static void aarch64_a35_initfn(Object *obj)
-     /* These values are the same with A53/A57/A72. */
-     define_cortex_a72_a57_a53_cp_reginfo(cpu);
- }
-+#endif /* disabled for RHEL */
- 
- void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
- {
-@@ -735,6 +737,7 @@ static void aarch64_a57_initfn(Object *obj)
-     define_cortex_a72_a57_a53_cp_reginfo(cpu);
- }
- 
-+#if 0 /* Disabled for Red Hat Enterprise Linux */
- static void aarch64_a53_initfn(Object *obj)
- {
-     ARMCPU *cpu = ARM_CPU(obj);
-@@ -1033,6 +1036,7 @@ static void aarch64_neoverse_n1_initfn(Object *obj)
-     /* From D5.1 AArch64 PMU register summary */
-     cpu->isar.reset_pmcr_el0 = 0x410c3000;
- }
-+#endif /* disabled for RHEL */
- 
- static void aarch64_host_initfn(Object *obj)
- {
-@@ -1240,13 +1244,18 @@ static void aarch64_max_initfn(Object *obj)
- }
- 
- static const ARMCPUInfo aarch64_cpus[] = {
-+#if 0 /* Disabled for Red Hat Enterprise Linux */
-     { .name = "cortex-a35",         .initfn = aarch64_a35_initfn },
-    { .name = "cortex-a57",         .initfn = aarch64_a57_initfn },
-+#endif /* disabled for RHEL */
-+    { .name = "cortex-a57",         .initfn = aarch64_a57_initfn,
-+      .deprecation_note = RHEL_CPU_DEPRECATION },
-+#if 0 /* Disabled for Red Hat Enterprise Linux */
-     { .name = "cortex-a53",         .initfn = aarch64_a53_initfn },
-     { .name = "cortex-a72",         .initfn = aarch64_a72_initfn },
-     { .name = "cortex-a76",         .initfn = aarch64_a76_initfn },
-     { .name = "a64fx",              .initfn = aarch64_a64fx_initfn },
-     { .name = "neoverse-n1",        .initfn = aarch64_neoverse_n1_initfn },
-+#endif /* disabled for RHEL */
-     { .name = "max",                .initfn = aarch64_max_initfn },
- #if defined(CONFIG_KVM) || defined(CONFIG_HVF)
-     { .name = "host",               .initfn = aarch64_host_initfn },
-@@ -1318,8 +1327,13 @@ static void aarch64_cpu_instance_init(Object *obj)
- static void cpu_register_class_init(ObjectClass *oc, void *data)
- {
-     ARMCPUClass *acc = ARM_CPU_CLASS(oc);
-+    CPUClass *cc = CPU_CLASS(oc);
- 
-     acc->info = data;
-+
-+    if (acc->info->deprecation_note) {
-+        cc->deprecation_note = acc->info->deprecation_note;
-+    }
- }
- 
- void aarch64_cpu_register(const ARMCPUInfo *info)
-diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
-index a528ff9a3d..053f70e399 100644
--- a/target/arm/cpu_tcg.c
-+++ b/target/arm/cpu_tcg.c
-@@ -148,10 +148,10 @@ void define_cortex_a72_a57_a53_cp_reginfo(ARMCPU *cpu)
- }
- #endif /* !CONFIG_USER_ONLY */
- 
-+#if 0 /* Disabled for Red Hat Enterprise Linux */
- /* CPU models. These are not needed for the AArch64 linux-user build. */
- #if !defined(CONFIG_USER_ONLY) || !defined(TARGET_AARCH64)
- 
-#if 0 /* Disabled for Red Hat Enterprise Linux */
- #if !defined(CONFIG_USER_ONLY) && defined(CONFIG_TCG)
- static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
- {
-@@ -505,7 +505,6 @@ static void cortex_a9_initfn(Object *obj)
-     cpu->isar.reset_pmcr_el0 = 0x41093000;
-     define_arm_cp_regs(cpu, cortexa9_cp_reginfo);
- }
-#endif /* disabled for RHEL */
- 
- #ifndef CONFIG_USER_ONLY
- static uint64_t a15_l2ctlr_read(CPUARMState *env, const ARMCPRegInfo *ri)
-@@ -530,7 +529,6 @@ static const ARMCPRegInfo cortexa15_cp_reginfo[] = {
-       .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
- };
- 
-#if 0 /* Disabled for Red Hat Enterprise Linux */
- static void cortex_a7_initfn(Object *obj)
- {
-     ARMCPU *cpu = ARM_CPU(obj);
-@@ -579,7 +577,6 @@ static void cortex_a7_initfn(Object *obj)
-     cpu->isar.reset_pmcr_el0 = 0x41072000;
-     define_arm_cp_regs(cpu, cortexa15_cp_reginfo); /* Same as A15 */
- }
-#endif /* disabled for RHEL */
- 
- static void cortex_a15_initfn(Object *obj)
- {
-@@ -628,7 +625,6 @@ static void cortex_a15_initfn(Object *obj)
-     define_arm_cp_regs(cpu, cortexa15_cp_reginfo);
- }
- 
-#if 0 /* Disabled for Red Hat Enterprise Linux */
- static void cortex_m0_initfn(Object *obj)
- {
-     ARMCPU *cpu = ARM_CPU(obj);
-@@ -1070,7 +1066,6 @@ static void arm_v7m_class_init(ObjectClass *oc, void *data)
- 
-     cc->gdb_core_xml_file = "arm-m-profile.xml";
- }
-#endif /* disabled for RHEL */
- 
- #ifndef TARGET_AARCH64
- /*
-@@ -1138,7 +1133,6 @@ static void arm_max_initfn(Object *obj)
- #endif /* !TARGET_AARCH64 */
- 
- static const ARMCPUInfo arm_tcg_cpus[] = {
-#if 0 /* Disabled for Red Hat Enterprise Linux */
-     { .name = "arm926",      .initfn = arm926_initfn },
-     { .name = "arm946",      .initfn = arm946_initfn },
-     { .name = "arm1026",     .initfn = arm1026_initfn },
-@@ -1154,9 +1148,7 @@ static const ARMCPUInfo arm_tcg_cpus[] = {
-     { .name = "cortex-a7",   .initfn = cortex_a7_initfn },
-     { .name = "cortex-a8",   .initfn = cortex_a8_initfn },
-     { .name = "cortex-a9",   .initfn = cortex_a9_initfn },
-#endif /* disabled for RHEL */
-     { .name = "cortex-a15",  .initfn = cortex_a15_initfn },
-#if 0 /* Disabled for Red Hat Enterprise Linux */
-     { .name = "cortex-m0",   .initfn = cortex_m0_initfn,
-                              .class_init = arm_v7m_class_init },
-     { .name = "cortex-m3",   .initfn = cortex_m3_initfn,
-@@ -1187,7 +1179,6 @@ static const ARMCPUInfo arm_tcg_cpus[] = {
-     { .name = "pxa270-b1",   .initfn = pxa270b1_initfn },
-     { .name = "pxa270-c0",   .initfn = pxa270c0_initfn },
-     { .name = "pxa270-c5",   .initfn = pxa270c5_initfn },
-#endif /* disabled for RHEL */
- #ifndef TARGET_AARCH64
-     { .name = "max",         .initfn = arm_max_initfn },
- #endif
-@@ -1215,3 +1206,4 @@ static void arm_tcg_cpu_register_types(void)
- type_init(arm_tcg_cpu_register_types)
- 
- #endif /* !CONFIG_USER_ONLY || !TARGET_AARCH64 */
-+#endif /* disabled for RHEL */
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index d8c8223ec3..ad9d235773 100644
--- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -8476,6 +8476,7 @@ void arm_cpu_list(void)
- static void arm_cpu_add_definition(gpointer data, gpointer user_data)
- {
-     ObjectClass *oc = data;
-+    CPUClass *cc = CPU_CLASS(oc);
-     CpuDefinitionInfoList **cpu_list = user_data;
-     CpuDefinitionInfo *info;
-     const char *typename;
-@@ -8485,6 +8486,7 @@ static void arm_cpu_add_definition(gpointer data, gpointer user_data)
-     info->name = g_strndup(typename,
-                            strlen(typename) - strlen("-" TYPE_ARM_CPU));
-     info->q_typename = g_strdup(typename);
-+    info->deprecated = !!cc->deprecation_note;
- 
-     QAPI_LIST_PREPEND(*cpu_list, info);
- }
-diff --git a/tests/qtest/arm-cpu-features.c b/tests/qtest/arm-cpu-features.c
-index 5a14527386..a3579fc303 100644
--- a/tests/qtest/arm-cpu-features.c
-+++ b/tests/qtest/arm-cpu-features.c
-@@ -440,8 +440,10 @@ static void test_query_cpu_model_expansion(const void *data)
-     assert_error(qts, "host", "The CPU type 'host' requires KVM", NULL);
- 
-     /* Test expected feature presence/absence for some cpu types */
-+#if 0 /* Disabled for Red Hat Enterprise Linux */
-     assert_has_feature_enabled(qts, "cortex-a15", "pmu");
-     assert_has_not_feature(qts, "cortex-a15", "aarch64");
-+#endif /* disabled for RHEL */
- 
-     /* Enabling and disabling pmu should always work. */
-     assert_has_feature_enabled(qts, "max", "pmu");
-@@ -458,6 +460,7 @@ static void test_query_cpu_model_expansion(const void *data)
-         assert_has_feature_enabled(qts, "cortex-a57", "pmu");
-         assert_has_feature_enabled(qts, "cortex-a57", "aarch64");
- 
-+#if 0 /* Disabled for Red Hat Enterprise Linux */
-         assert_has_feature_enabled(qts, "a64fx", "pmu");
-         assert_has_feature_enabled(qts, "a64fx", "aarch64");
-         /*
-@@ -470,6 +473,7 @@ static void test_query_cpu_model_expansion(const void *data)
-                      "{ 'sve384': true }");
-         assert_error(qts, "a64fx", "cannot enable sve640",
-                      "{ 'sve640': true }");
-+#endif /* disabled for RHEL */
- 
-         sve_tests_default(qts, "max");
-         pauth_tests_default(qts, "max");
-@@ -505,9 +509,11 @@ static void test_query_cpu_model_expansion_kvm(const void *data)
-         QDict *resp;
-         char *error;
- 
-+#if 0 /* Disabled for Red Hat Enterprise Linux */
-         assert_error(qts, "cortex-a15",
-             "We cannot guarantee the CPU type 'cortex-a15' works "
-             "with KVM on this host", NULL);
-+#endif /* disabled for RHEL */
- 
-         assert_has_feature_enabled(qts, "host", "aarch64");
- 
-- 
-2.31.1
-
--- a/SOURCES/0007-Machine-type-related-general-changes.patch
+++ b/SOURCES/0007-Machine-type-related-general-changes.patch
--- a/SOURCES/0008-Add-aarch64-machine-types.patch
+++ b/SOURCES/0008-Add-aarch64-machine-types.patch
@ -0,0 +1,405 @@
+From 670e90f5cbd92189155e079b8c6e2aafdf82d162 Mon Sep 17 00:00:00 2001
+From: Miroslav Rezanina <mrezanin@redhat.com>
+Date: Fri, 19 Oct 2018 12:53:31 +0200
+Subject: Add aarch64 machine types
+
+Adding changes to add RHEL machine types for aarch64 architecture.
+
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+
+Rebase notes (4.0.0):
+- Use upstream compat handling
+
+Rebase notes (4.1.0-rc0):
+- Removed a15memmap (upstream)
+- Use virt_flash_create in rhel800_virt_instance_init
+
+Rebase notes (4.2.0-rc0):
+- Set numa_mem_supported
+
+Rebase notes (4.2.0-rc3):
+- aarch64: Add virt-rhel8.2.0 machine type for ARM (patch 92246)
+- aarch64: virt: Allow more than 1TB of RAM (patch 92249)
+- aarch64: virt: Allow PCDIMM instantiation (patch 92247)
+- aarch64: virt: Enhance the comment related to gic-version (patch 92248)
+
+Rebase notes (5.0.0):
+- Set default_ram_id in rhel_machine_class_init
+- Added setting acpi properties
+
+Rebase notes (5.1.0):
+- Added ras property
+- Added to virt_machine_device_unplug_cb to machine type (upstream)
+- added mte property (upstream)
+
+Rebase notes (weekly-210210):
+- Added support for oem fields to machine type
+
+Rebase notes (weekly-210303):
+- Use rhel-8.4.0 hw compat
+
+Rebase notes (6.0.0-rc2):
+- renamed oem-id and oem-table-id to x-oem-id and x-oem-table-id
+
+Rebase notes (210623):
+- Protect TPM functions by CONFIG_TPM ifdef
+
+Rebase notes (6.1.0-rc0):
+- Add support for default_bus_bypass_iommu
+
+Merged patches (4.0.0):
+- 7bfdb4c aarch64: Add virt-rhel8.0.0 machine type for ARM
+- 3433e69 aarch64: Set virt-rhel8.0.0 max_cpus to 512
+- 4d20863 aarch64: Use 256MB ECAM region by default
+
+Merged patches (4.1.0):
+- c3e39ef aarch64: Add virt-rhel8.1.0 machine type for ARM
+- 59a46d1 aarch64: Allow ARM VIRT iommu option in RHEL8.1 machine
+
+Merged patches (5.2.0 rc0):
+- 12990ad hw/arm: Changes to rhel820 machine
+- 46d5a79 hw/arm: Introduce rhel_virt_instance_init() helper
+- 098954a hw/arm: Add rhel830 machine type
+- ee8e99d arm: Set correct max_cpus value on virt-rhel* machine types
+- e5edd38 RHEL-only: arm/virt: Allow the TPM_TIS_SYSBUS device dynamic allocation in machvirt
+- 6d7ba66 machine types/numa: set numa_mem_supported on old machine types (partialy)
+- 25c5644 machine_types/numa: compatibility for auto_enable_numa_with_memdev (partialy)
+
+Merged patches (6.0):
+- 078fadb5da AArch64 machine types cleanup
+- ea7b7425fa hw/arm/virt: Add 8.4 Machine type
+
+Merged patches (weekly-210609):
+- 73b1578882 hw/arm/virt: Add 8.5 machine type
+- 5333038d11 hw/arm/virt: Disable PL011 clock migration through hw_compat_rhel_8_3
+- 63adb8ae86 arm/virt: Register highmem and gic-version as class properties
+
+Merged patches (weekly-211027):
+- 86e3057c0a hw: arm: virt: Add hw_compat_rhel_8_5 to 8.5 machine type
+---
+ hw/arm/virt.c         | 226 +++++++++++++++++++++++++++++++++++++++++-
+ hw/core/machine.c     |   2 +
+ include/hw/arm/virt.h |   8 ++
+ 3 files changed, 235 insertions(+), 1 deletion(-)
+
+diff --git a/hw/arm/virt.c b/hw/arm/virt.c
+index 5de4d9d73b..c77d26ab13 100644
+--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
+@@ -79,6 +79,7 @@
+ #include "hw/char/pl011.h"
+ #include "qemu/guest-random.h"
+ 
+#if 0 /* Disabled for Red Hat Enterprise Linux */
+ #define DEFINE_VIRT_MACHINE_LATEST(major, minor, latest) \
+     static void virt_##major##_##minor##_class_init(ObjectClass *oc, \
+                                                     void *data) \
+@@ -105,7 +106,48 @@
+     DEFINE_VIRT_MACHINE_LATEST(major, minor, true)
+ #define DEFINE_VIRT_MACHINE(major, minor) \
+     DEFINE_VIRT_MACHINE_LATEST(major, minor, false)
+-
+#endif /* disabled for RHEL */
+
+#define DEFINE_RHEL_MACHINE_LATEST(m, n, s, latest)                     \
+    static void rhel##m##n##s##_virt_class_init(ObjectClass *oc,        \
+                                                void *data)             \
+    {                                                                   \
+        MachineClass *mc = MACHINE_CLASS(oc);                           \
+        rhel##m##n##s##_virt_options(mc);                               \
+        mc->desc = "RHEL " # m "." # n "." # s " ARM Virtual Machine";  \
+        if (latest) {                                                   \
+            mc->alias = "virt";                                         \
+            mc->is_default = 1;                                         \
+        }                                                               \
+    }                                                                   \
+    static const TypeInfo rhel##m##n##s##_machvirt_info = {             \
+        .name = MACHINE_TYPE_NAME("virt-rhel" # m "." # n "." # s),     \
+        .parent = TYPE_RHEL_MACHINE,                                    \
+        .class_init = rhel##m##n##s##_virt_class_init,                  \
+    };                                                                  \
+    static void rhel##m##n##s##_machvirt_init(void)                     \
+    {                                                                   \
+        type_register_static(&rhel##m##n##s##_machvirt_info);           \
+    }                                                                   \
+    type_init(rhel##m##n##s##_machvirt_init);
+
+#define DEFINE_RHEL_MACHINE_AS_LATEST(major, minor, subminor)   \
+    DEFINE_RHEL_MACHINE_LATEST(major, minor, subminor, true)
+#define DEFINE_RHEL_MACHINE(major, minor, subminor)             \
+    DEFINE_RHEL_MACHINE_LATEST(major, minor, subminor, false)
+
+/* This variable is for changes to properties that are RHEL specific,
+ * different to the current upstream and to be applied to the latest
+ * machine type.
+ */
+GlobalProperty arm_rhel_compat[] = {
+    {
+        .driver   = "virtio-net-pci",
+        .property = "romfile",
+        .value    = "",
+    },
+};
+const size_t arm_rhel_compat_len = G_N_ELEMENTS(arm_rhel_compat);
+ 
+ /* Number of external interrupt lines to configure the GIC with */
+ #define NUM_IRQS 256
+@@ -2180,6 +2222,7 @@ static void machvirt_init(MachineState *machine)
+     qemu_add_machine_init_done_notifier(&vms->machine_done);
+ }
+ 
+#if 0 /* Disabled for Red Hat Enterprise Linux */
+ static bool virt_get_secure(Object *obj, Error **errp)
+ {
+     VirtMachineState *vms = VIRT_MACHINE(obj);
+@@ -2207,6 +2250,7 @@ static void virt_set_virt(Object *obj, bool value, Error **errp)
+ 
+     vms->virt = value;
+ }
+#endif /* disabled for RHEL */
+ 
+ static bool virt_get_highmem(Object *obj, Error **errp)
+ {
+@@ -2304,6 +2348,7 @@ static void virt_set_acpi(Object *obj, Visitor *v, const char *name,
+     visit_type_OnOffAuto(v, name, &vms->acpi, errp);
+ }
+ 
+#if 0 /* Disabled for Red Hat Enterprise Linux */
+ static bool virt_get_ras(Object *obj, Error **errp)
+ {
+     VirtMachineState *vms = VIRT_MACHINE(obj);
+@@ -2331,6 +2376,7 @@ static void virt_set_mte(Object *obj, bool value, Error **errp)
+ 
+     vms->mte = value;
+ }
+#endif /* disabled for RHEL */
+ 
+ static char *virt_get_gic_version(Object *obj, Error **errp)
+ {
+@@ -2666,6 +2712,7 @@ static int virt_kvm_type(MachineState *ms, const char *type_str)
+     return fixed_ipa ? 0 : requested_pa_size;
+ }
+ 
+#if 0 /* Disabled for Red Hat Enterprise Linux */
+ static void virt_machine_class_init(ObjectClass *oc, void *data)
+ {
+     MachineClass *mc = MACHINE_CLASS(oc);
+@@ -3031,3 +3078,180 @@ static void virt_machine_2_6_options(MachineClass *mc)
+     vmc->no_pmu = true;
+ }
+ DEFINE_VIRT_MACHINE(2, 6)
+#endif /* disabled for RHEL */
+
+static void rhel_machine_class_init(ObjectClass *oc, void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(oc);
+
+    mc->family = "virt-rhel-Z";
+    mc->init = machvirt_init;
+    /* Maximum supported VCPU count for all virt-rhel* machines */
+    mc->max_cpus = 384;
+#ifdef CONFIG_TPM
+    machine_class_allow_dynamic_sysbus_dev(mc, TYPE_TPM_TIS_SYSBUS);
+#endif
+    mc->block_default_type = IF_VIRTIO;
+    mc->no_cdrom = 1;
+    mc->pci_allow_0_address = true;
+    /* We know we will never create a pre-ARMv7 CPU which needs 1K pages */
+    mc->minimum_page_bits = 12;
+    mc->possible_cpu_arch_ids = virt_possible_cpu_arch_ids;
+    mc->cpu_index_to_instance_props = virt_cpu_index_to_props;
+    mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a57");
+    mc->get_default_cpu_node_id = virt_get_default_cpu_node_id;
+    mc->kvm_type = virt_kvm_type;
+    assert(!mc->get_hotplug_handler);
+    mc->get_hotplug_handler = virt_machine_get_hotplug_handler;
+    hc->pre_plug = virt_machine_device_pre_plug_cb;
+    hc->plug = virt_machine_device_plug_cb;
+    hc->unplug_request = virt_machine_device_unplug_request_cb;
+    hc->unplug = virt_machine_device_unplug_cb;
+    mc->nvdimm_supported = true;
+    mc->auto_enable_numa_with_memhp = true;
+    mc->auto_enable_numa_with_memdev = true;
+    mc->default_ram_id = "mach-virt.ram";
+
+    object_class_property_add(oc, "acpi", "OnOffAuto",
+        virt_get_acpi, virt_set_acpi,
+        NULL, NULL);
+    object_class_property_set_description(oc, "acpi",
+        "Enable ACPI");
+
+    object_class_property_add_bool(oc, "highmem", virt_get_highmem,
+                                   virt_set_highmem);
+    object_class_property_set_description(oc, "highmem",
+                                          "Set on/off to enable/disable using "
+                                          "physical address space above 32 bits");
+
+    object_class_property_add_str(oc, "gic-version", virt_get_gic_version,
+                                  virt_set_gic_version);
+    object_class_property_set_description(oc, "gic-version",
+                                          "Set GIC version. "
+                                          "Valid values are 2, 3, host and max");
+
+    object_class_property_add_str(oc, "x-oem-id",
+                                  virt_get_oem_id,
+                                  virt_set_oem_id);
+    object_class_property_set_description(oc, "x-oem-id",
+                                          "Override the default value of field OEMID "
+                                          "in ACPI table header."
+                                          "The string may be up to 6 bytes in size");
+
+    object_class_property_add_str(oc, "x-oem-table-id",
+                                  virt_get_oem_table_id,
+                                  virt_set_oem_table_id);
+    object_class_property_set_description(oc, "x-oem-table-id",
+                                          "Override the default value of field OEM Table ID "
+                                          "in ACPI table header."
+                                          "The string may be up to 8 bytes in size");
+    object_class_property_add_bool(oc, "default_bus_bypass_iommu",
+                                   virt_get_default_bus_bypass_iommu,
+                                   virt_set_default_bus_bypass_iommu);
+
+}
+
+static void rhel_virt_instance_init(Object *obj)
+{
+    VirtMachineState *vms = VIRT_MACHINE(obj);
+    VirtMachineClass *vmc = VIRT_MACHINE_GET_CLASS(vms);
+
+    /* EL3 is disabled by default and non-configurable for RHEL */
+    vms->secure = false;
+
+    /* EL2 is disabled by default and non-configurable for RHEL */
+    vms->virt = false;
+
+    /* High memory is enabled by default */
+    vms->highmem = true;
+    vms->gic_version = VIRT_GIC_VERSION_NOSEL;
+
+    vms->highmem_ecam = !vmc->no_highmem_ecam;
+
+    if (vmc->no_its) {
+        vms->its = false;
+    } else {
+        /* Default allows ITS instantiation */
+        vms->its = true;
+        object_property_add_bool(obj, "its", virt_get_its,
+                                 virt_set_its);
+        object_property_set_description(obj, "its",
+                                        "Set on/off to enable/disable "
+                                        "ITS instantiation");
+    }
+
+    /* Default disallows iommu instantiation */
+    vms->iommu = VIRT_IOMMU_NONE;
+    object_property_add_str(obj, "iommu", virt_get_iommu, virt_set_iommu);
+    object_property_set_description(obj, "iommu",
+                                    "Set the IOMMU type. "
+                                    "Valid values are none and smmuv3");
+
+    /* Default disallows RAS instantiation and is non-configurable for RHEL */
+    vms->ras = false;
+
+    /* MTE is disabled by default and non-configurable for RHEL */
+    vms->mte = false;
+
+    vms->default_bus_bypass_iommu = false;
+    vms->irqmap = a15irqmap;
+
+    virt_flash_create(vms);
+    vms->oem_id = g_strndup(ACPI_BUILD_APPNAME6, 6);
+    vms->oem_table_id = g_strndup(ACPI_BUILD_APPNAME8, 8);
+
+}
+
+static const TypeInfo rhel_machine_info = {
+    .name          = TYPE_RHEL_MACHINE,
+    .parent        = TYPE_MACHINE,
+    .abstract      = true,
+    .instance_size = sizeof(VirtMachineState),
+    .class_size    = sizeof(VirtMachineClass),
+    .class_init    = rhel_machine_class_init,
+    .instance_init = rhel_virt_instance_init,
+    .interfaces = (InterfaceInfo[]) {
+         { TYPE_HOTPLUG_HANDLER },
+         { }
+    },
+};
+
+static void rhel_machine_init(void)
+{
+    type_register_static(&rhel_machine_info);
+}
+type_init(rhel_machine_init);
+
+static void rhel850_virt_options(MachineClass *mc)
+{
+    compat_props_add(mc->compat_props, arm_rhel_compat, arm_rhel_compat_len);
+    compat_props_add(mc->compat_props, hw_compat_rhel_8_5, hw_compat_rhel_8_5_len);
+}
+DEFINE_RHEL_MACHINE_AS_LATEST(8, 5, 0)
+
+static void rhel840_virt_options(MachineClass *mc)
+{
+    rhel850_virt_options(mc);
+    compat_props_add(mc->compat_props, hw_compat_rhel_8_4, hw_compat_rhel_8_4_len);
+}
+DEFINE_RHEL_MACHINE(8, 4, 0)
+
+static void rhel830_virt_options(MachineClass *mc)
+{
+    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
+
+    rhel840_virt_options(mc);
+    compat_props_add(mc->compat_props, hw_compat_rhel_8_3, hw_compat_rhel_8_3_len);
+    vmc->no_kvm_steal_time = true;
+}
+DEFINE_RHEL_MACHINE(8, 3, 0)
+
+static void rhel820_virt_options(MachineClass *mc)
+{
+    rhel830_virt_options(mc);
+    compat_props_add(mc->compat_props, hw_compat_rhel_8_2, hw_compat_rhel_8_2_len);
+    mc->numa_mem_supported = true;
+    mc->auto_enable_numa_with_memdev = false;
+}
+DEFINE_RHEL_MACHINE(8, 2, 0)
+diff --git a/hw/core/machine.c b/hw/core/machine.c
+index be4f9864cd..62febde5aa 100644
+--- a/hw/core/machine.c
+++ b/hw/core/machine.c
+@@ -87,6 +87,8 @@ GlobalProperty hw_compat_rhel_8_3[] = {
+     { "nvme", "use-intel-id", "on"},
+     /* hw_compat_rhel_8_3 from hw_compat_5_1 */
+     { "pvpanic", "events", "1"}, /* PVPANIC_PANICKED */
+    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
+    { "pl011", "migrate-clk", "off" },
+     /* hw_compat_rhel_8_3 bz 1912846 */
+     { "pci-xhci", "x-rh-late-msi-cap", "off" },
+     /* hw_compat_rhel_8_3 from hw_compat_5_1 */
+diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
+index dc6b66ffc8..9364628847 100644
+--- a/include/hw/arm/virt.h
+++ b/include/hw/arm/virt.h
+@@ -175,9 +175,17 @@ struct VirtMachineState {
+ 
+ #define VIRT_ECAM_ID(high) (high ? VIRT_HIGH_PCIE_ECAM : VIRT_PCIE_ECAM)
+ 
+#if 0 /* disabled for Red Hat Enterprise Linux */
+ #define TYPE_VIRT_MACHINE   MACHINE_TYPE_NAME("virt")
+ OBJECT_DECLARE_TYPE(VirtMachineState, VirtMachineClass, VIRT_MACHINE)
+ 
+#else
+#define TYPE_RHEL_MACHINE MACHINE_TYPE_NAME("virt-rhel")
+typedef struct VirtMachineClass VirtMachineClass;
+typedef struct VirtMachineState VirtMachineState;
+DECLARE_OBJ_CHECKERS(VirtMachineState, VirtMachineClass, VIRT_MACHINE, TYPE_RHEL_MACHINE)
+#endif
+
+ void virt_acpi_setup(VirtMachineState *vms);
+ bool virt_is_acpi_enabled(VirtMachineState *vms);
+ 
+-- 
+2.27.0
+
--- a/SOURCES/0009-Add-ppc64-machine-types.patch
+++ b/SOURCES/0009-Add-ppc64-machine-types.patch
@ -1,4 +1,4 @@
-From 2c523f1b6c9470e1cd517ba99e414cde02727e16 Mon Sep 17 00:00:00 2001
+From 3c65320ce5b8ad3bb8c0d8fd13a88c464d5c5845 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 13:27:13 +0200
 Subject: Add ppc64 machine types
@ -7,37 +7,66 @@ Adding changes to add RHEL machine types for ppc64 architecture.

 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>

-Rebase notes (6.2.0):
- Fixed rebase conflict relicts
- Update machine type compat for 6.2 (from MR 66)
+Rebase changes (4.0.0):
+- remove instance options and use upstream solution
+- Use upstream compat handling
+- Replace SPAPR_PCI_2_7_MMIO_WIN_SIZE with value (changed upstream)
+- re-add handling of instance_options (removed upstream)
+- Use p8 as default for rhel machine types (p9 default upstream)
+- sPAPRMachineClass renamed to SpaprMachineClass (upstream)

-Merged patches (6.1.0):
- c438c25ac3 redhat: Define pseries-rhel8.5.0 machine type
- a3995e2eff Remove RHEL 7.0.0 machine type (only ppc64 changes)
- ad3190a79b Remove RHEL 7.1.0 machine type (only ppc64 changes)
- 84bbe15d4e Remove RHEL 7.2.0 machine type (only ppc64 changes)
- 0215eb3356 Remove RHEL 7.3.0 machine types (only ppc64 changes)
- af69d1ca6e Remove RHEL 7.4.0 machine types (only ppc64 changes)
- 8f7a74ab78 Remove RHEL 7.5.0 machine types (only ppc64 changes)
+Rebase changes (4.1.0):
+- Update format for compat structures

-Merged patches (7.1.0 rc0):
- baa6790171 target/ppc/cpu-models: Fix ppc_cpu_aliases list for RHEL
+Rebase notes (weekly-210303):
+- Use rhel-8.4.0 hw compat
+
+Merged patches (4.0.0):
+- 467d59a redhat: define pseries-rhel8.0.0 machine type
+
+Merged patches (4.1.0):
+- f21757edc target/ppc/spapr: Enable mitigations by default for pseries-4.0 machine type
+- 2511c63 redhat: sync pseries-rhel7.6.0 with rhel-av-8.0.1
+- 89f01da redhat: define pseries-rhel8.1.0 machine type
+
+Merged patches (4.2.0):
+- bcba728 redhat: update pseries-rhel8.1.0 machine type
+- redhat: update pseries-rhel-7.6.0 machine type (patch 93039)
+- redhat: define pseries-rhel8.2.0 machine type (patch 93041)
+
+Merged patches (5.1.0):
+- eb121ff spapr: Enable DD2.3 accelerated count cache flush in pseries-5.0 machine (partial)
+
+Merged patches (5.2.0 rc0):
+- 311a20f redhat: define pseries-rhel8.3.0 machine type
+- 1284167 ppc: Set correct max_cpus value on spapr-rhel* machine types
+- 1ab8783 redhat: update pseries-rhel8.2.0 machine type
+- b162af531a target/ppc: Add experimental option for enabling secure guests
+
+Merged patches (weekly-201216):
+- 943c936df3 redhat: Add spapr_machine_rhel_default_class_options()
+- 030b5e6fba redhat: Define pseries-rhel8.4.0 machine type
+
+Merged patches (weekly-210602):
+- b7128d8ef7 redhat: Define pseries-rhel8.5.0 machine type
+
+Merged patches (weekly-211006):
+- c8f68b47e9 redhat: Update pseries-rhel8.5.0
 ---
- hw/ppc/spapr.c          | 243 ++++++++++++++++++++++++++++++++++++++++
- hw/ppc/spapr_cpu_core.c |  13 +++
+ hw/ppc/spapr.c          | 382 ++++++++++++++++++++++++++++++++++++++++
+ hw/ppc/spapr_cpu_core.c |  13 ++
 include/hw/ppc/spapr.h  |   4 +
- target/ppc/compat.c     |  13 ++-
- target/ppc/cpu-models.c |   1 +
+ target/ppc/compat.c     |  13 +-
 target/ppc/cpu.h        |   1 +
- target/ppc/kvm.c        |  27 +++++
- target/ppc/kvm_ppc.h    |  13 +++
- 8 files changed, 314 insertions(+), 1 deletion(-)
+ target/ppc/kvm.c        |  27 +++
+ target/ppc/kvm_ppc.h    |  13 ++
+ 7 files changed, 452 insertions(+), 1 deletion(-)

 diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
-index 66b414d2e9..499eb49253 100644
+index 3b5fd749be..cace86028d 100644
 --- a/hw/ppc/spapr.c
 +++ b/hw/ppc/spapr.c
-@@ -1633,6 +1633,9 @@ static void spapr_machine_reset(MachineState *machine, ShutdownCause reason)
+@@ -1593,6 +1593,9 @@ static void spapr_machine_reset(MachineState *machine)
 
     pef_kvm_reset(machine->cgs, &error_fatal);
     spapr_caps_apply(spapr);
@ -47,7 +76,7 @@ index 66b414d2e9..499eb49253 100644
 
     first_ppc_cpu = POWERPC_CPU(first_cpu);
     if (kvm_enabled() && kvmppc_has_cap_mmu_radix() &&
-@@ -3347,6 +3350,20 @@ static void spapr_set_host_serial(Object *obj, const char *value, Error **errp)
+@@ -3288,6 +3291,20 @@ static void spapr_set_host_serial(Object *obj, const char *value, Error **errp)
     spapr->host_serial = g_strdup(value);
 }
 
@ -68,7 +97,7 @@ index 66b414d2e9..499eb49253 100644
 static void spapr_instance_init(Object *obj)
 {
     SpaprMachineState *spapr = SPAPR_MACHINE(obj);
-@@ -3425,6 +3442,12 @@ static void spapr_instance_init(Object *obj)
+@@ -3366,6 +3383,12 @@ static void spapr_instance_init(Object *obj)
         spapr_get_host_serial, spapr_set_host_serial);
     object_property_set_description(obj, "host-serial",
         "Host serial number to advertise in guest device tree");
@ -81,7 +110,7 @@ index 66b414d2e9..499eb49253 100644
 }
 
 static void spapr_machine_finalizefn(Object *obj)
-@@ -4682,6 +4705,7 @@ static void spapr_machine_class_init(ObjectClass *oc, void *data)
+@@ -4614,6 +4637,7 @@ static void spapr_machine_class_init(ObjectClass *oc, void *data)
     vmc->client_architecture_support = spapr_vof_client_architecture_support;
     vmc->quiesce = spapr_vof_quiesce;
     vmc->setprop = spapr_vof_setprop;
@ -89,15 +118,15 @@ index 66b414d2e9..499eb49253 100644
 }
 
 static const TypeInfo spapr_machine_info = {
-@@ -4733,6 +4757,7 @@ static void spapr_machine_latest_class_options(MachineClass *mc)
+@@ -4665,6 +4689,7 @@ static void spapr_machine_latest_class_options(MachineClass *mc)
     }                                                                \
     type_init(spapr_machine_register_##suffix)
 
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
 /*
-  * pseries-7.2
+  * pseries-6.2
  */
-@@ -4882,6 +4907,7 @@ static void spapr_machine_4_1_class_options(MachineClass *mc)
+@@ -4781,6 +4806,7 @@ static void spapr_machine_4_1_class_options(MachineClass *mc)
 }
 
 DEFINE_SPAPR_MACHINE(4_1, "4.1", false);
@ -105,7 +134,7 @@ index 66b414d2e9..499eb49253 100644
 
 /*
  * pseries-4.0
-@@ -4901,6 +4927,8 @@ static bool phb_placement_4_0(SpaprMachineState *spapr, uint32_t index,
+@@ -4800,6 +4826,8 @@ static bool phb_placement_4_0(SpaprMachineState *spapr, uint32_t index,
     *nv2atsd = 0;
     return true;
 }
@ -114,7 +143,23 @@ index 66b414d2e9..499eb49253 100644
 static void spapr_machine_4_0_class_options(MachineClass *mc)
 {
     SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
-@@ -5228,6 +5256,221 @@ static void spapr_machine_2_1_class_options(MachineClass *mc)
+@@ -4958,6 +4986,7 @@ DEFINE_SPAPR_MACHINE(2_8, "2.8", false);
+ /*
+  * pseries-2.7
+  */
+#endif
+ 
+ static bool phb_placement_2_7(SpaprMachineState *spapr, uint32_t index,
+                               uint64_t *buid, hwaddr *pio,
+@@ -5013,6 +5042,7 @@ static bool phb_placement_2_7(SpaprMachineState *spapr, uint32_t index,
+     return true;
+ }
+ 
+#if 0 /* Disabled for Red Hat Enterprise Linux */
+ static void spapr_machine_2_7_class_options(MachineClass *mc)
+ {
+     SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
+@@ -5127,6 +5157,358 @@ static void spapr_machine_2_1_class_options(MachineClass *mc)
     compat_props_add(mc->compat_props, hw_compat_2_1, hw_compat_2_1_len);
 }
 DEFINE_SPAPR_MACHINE(2_1, "2.1", false);
@ -138,14 +183,10 @@ index 66b414d2e9..499eb49253 100644
 +
 +static void spapr_machine_rhel850_class_options(MachineClass *mc)
 +{
-+    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
-+
 +    /* The default machine type must apply the RHEL specific defaults */
 +    spapr_machine_rhel_default_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_5,
 +                     hw_compat_rhel_8_5_len);
-+    smc->pre_6_2_numa_affinity = true;
-+    mc->smp_props.prefer_sockets = true;
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel850, "rhel8.5.0", true);
@ -333,14 +374,155 @@ index 66b414d2e9..499eb49253 100644
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel760sxxm, "rhel7.6.0-sxxm", false);
+
+static void spapr_machine_rhel750_class_options(MachineClass *mc)
+{
+    spapr_machine_rhel760_class_options(mc);
+    compat_props_add(mc->compat_props, hw_compat_rhel_7_5, hw_compat_rhel_7_5_len);
+
+}
+
+DEFINE_SPAPR_MACHINE(rhel750, "rhel7.5.0", false);
+
+/*
+ * pseries-rhel7.5.0-sxxm
+ *
+ * pseries-rhel7.5.0 with speculative execution exploit mitigations enabled by default
+ */
+
+static void spapr_machine_rhel750sxxm_class_options(MachineClass *mc)
+{
+    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
+
+    spapr_machine_rhel750_class_options(mc);
+    smc->default_caps.caps[SPAPR_CAP_CFPC] = SPAPR_CAP_WORKAROUND;
+    smc->default_caps.caps[SPAPR_CAP_SBBC] = SPAPR_CAP_WORKAROUND;
+    smc->default_caps.caps[SPAPR_CAP_IBS] = SPAPR_CAP_FIXED_CCD;
+}
+
+DEFINE_SPAPR_MACHINE(rhel750sxxm, "rhel7.5.0-sxxm", false);
+
+/*
+ * pseries-rhel7.4.0
+ * like spapr_compat_2_9
+ */
+GlobalProperty spapr_compat_rhel7_4[] = {
+    { TYPE_POWERPC_CPU, "pre-2.10-migration", "on" },
+};
+const size_t spapr_compat_rhel7_4_len = G_N_ELEMENTS(spapr_compat_rhel7_4);
+
+static void spapr_machine_rhel740_class_options(MachineClass *mc)
+{
+    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
+
+    spapr_machine_rhel750_class_options(mc);
+    compat_props_add(mc->compat_props, hw_compat_rhel_7_4, hw_compat_rhel_7_4_len);
+    compat_props_add(mc->compat_props, spapr_compat_rhel7_4, spapr_compat_rhel7_4_len);
+    smc->has_power9_support = false;
+    smc->pre_2_10_has_unused_icps = true;
+    smc->resize_hpt_default = SPAPR_RESIZE_HPT_DISABLED;
+    smc->default_caps.caps[SPAPR_CAP_HTM] = SPAPR_CAP_ON;
+}
+
+DEFINE_SPAPR_MACHINE(rhel740, "rhel7.4.0", false);
+
+/*
+ * pseries-rhel7.4.0-sxxm
+ *
+ * pseries-rhel7.4.0 with speculative execution exploit mitigations enabled by default
+ */
+
+static void spapr_machine_rhel740sxxm_class_options(MachineClass *mc)
+{
+    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
+
+    spapr_machine_rhel740_class_options(mc);
+    smc->default_caps.caps[SPAPR_CAP_CFPC] = SPAPR_CAP_WORKAROUND;
+    smc->default_caps.caps[SPAPR_CAP_SBBC] = SPAPR_CAP_WORKAROUND;
+    smc->default_caps.caps[SPAPR_CAP_IBS] = SPAPR_CAP_FIXED_CCD;
+}
+
+DEFINE_SPAPR_MACHINE(rhel740sxxm, "rhel7.4.0-sxxm", false);
+
+/*
+ * pseries-rhel7.3.0
+ * like spapr_compat_2_6/_2_7/_2_8 but "ddw" has been backported to RHEL7_3
+ */
+GlobalProperty spapr_compat_rhel7_3[] = {
+    { TYPE_SPAPR_PCI_HOST_BRIDGE, "mem_win_size", "0xf80000000" },
+    { TYPE_SPAPR_PCI_HOST_BRIDGE, "mem64_win_size", "0" },
+    { TYPE_POWERPC_CPU, "pre-2.8-migration", "on" },
+    { TYPE_SPAPR_PCI_HOST_BRIDGE, "pre-2.8-migration", "on" },
+    { TYPE_SPAPR_PCI_HOST_BRIDGE, "pcie-extended-configuration-space", "off" },
+};
+const size_t spapr_compat_rhel7_3_len = G_N_ELEMENTS(spapr_compat_rhel7_3);
+
+static void spapr_machine_rhel730_class_options(MachineClass *mc)
+{
+    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
+
+    spapr_machine_rhel740_class_options(mc);
+    mc->default_cpu_type = POWERPC_CPU_TYPE_NAME("power7_v2.3");
+    mc->default_machine_opts = "modern-hotplug-events=off";
+    compat_props_add(mc->compat_props, hw_compat_rhel_7_3, hw_compat_rhel_7_3_len);
+    compat_props_add(mc->compat_props, spapr_compat_rhel7_3, spapr_compat_rhel7_3_len);
+
+    smc->phb_placement = phb_placement_2_7;
+}
+
+DEFINE_SPAPR_MACHINE(rhel730, "rhel7.3.0", false);
+
+/*
+ * pseries-rhel7.3.0-sxxm
+ *
+ * pseries-rhel7.3.0 with speculative execution exploit mitigations enabled by default
+ */
+
+static void spapr_machine_rhel730sxxm_class_options(MachineClass *mc)
+{
+    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
+
+    spapr_machine_rhel730_class_options(mc);
+    smc->default_caps.caps[SPAPR_CAP_CFPC] = SPAPR_CAP_WORKAROUND;
+    smc->default_caps.caps[SPAPR_CAP_SBBC] = SPAPR_CAP_WORKAROUND;
+    smc->default_caps.caps[SPAPR_CAP_IBS] = SPAPR_CAP_FIXED_CCD;
+}
+
+DEFINE_SPAPR_MACHINE(rhel730sxxm, "rhel7.3.0-sxxm", false);
+
+/*
+ * pseries-rhel7.2.0
+ */
+/* Should be like spapr_compat_2_5 + 2_4 + 2_3, but "dynamic-reconfiguration"
+ * has been backported to RHEL7_2 so we don't need it here.
+ */
+
+GlobalProperty spapr_compat_rhel7_2[] = {
+    { "spapr-vlan", "use-rx-buffer-pools", "off" },
+    { TYPE_SPAPR_PCI_HOST_BRIDGE, "ddw", "off" },
+};
+const size_t spapr_compat_rhel7_2_len = G_N_ELEMENTS(spapr_compat_rhel7_2);
+
+static void spapr_machine_rhel720_class_options(MachineClass *mc)
+{
+    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
+
+    spapr_machine_rhel730_class_options(mc);
+    smc->use_ohci_by_default = true;
+    mc->has_hotpluggable_cpus = NULL;
+    compat_props_add(mc->compat_props, hw_compat_rhel_7_2, hw_compat_rhel_7_2_len);
+    compat_props_add(mc->compat_props, spapr_compat_rhel7_2, spapr_compat_rhel7_2_len);
+}
+
+DEFINE_SPAPR_MACHINE(rhel720, "rhel7.2.0", false);
 
 static void spapr_machine_register_types(void)
 {
 diff --git a/hw/ppc/spapr_cpu_core.c b/hw/ppc/spapr_cpu_core.c
-index fcb5dfe792..ab8fb5bf62 100644
+index 8ba34f6a1d..78eca1c04a 100644
 --- a/hw/ppc/spapr_cpu_core.c
 +++ b/hw/ppc/spapr_cpu_core.c
-@@ -25,6 +25,7 @@
+@@ -24,6 +24,7 @@
 #include "sysemu/reset.h"
 #include "sysemu/hw_accel.h"
 #include "qemu/error-report.h"
@ -348,7 +530,7 @@ index fcb5dfe792..ab8fb5bf62 100644
 
 static void spapr_reset_vcpu(PowerPCCPU *cpu)
 {
-@@ -259,6 +260,7 @@ static bool spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
+@@ -250,6 +251,7 @@ static bool spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
 {
     CPUPPCState *env = &cpu->env;
     CPUState *cs = CPU(cpu);
@ -356,9 +538,9 @@ index fcb5dfe792..ab8fb5bf62 100644
 
     if (!qdev_realize(DEVICE(cpu), NULL, errp)) {
         return false;
-@@ -270,6 +272,17 @@ static bool spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
-     /* Set time-base frequency to 512 MHz. vhyp must be set first. */
-     cpu_ppc_tb_init(env, SPAPR_TIMEBASE_FREQ);
+@@ -261,6 +263,17 @@ static bool spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
+     cpu_ppc_set_vhyp(cpu, PPC_VIRTUAL_HYPERVISOR(spapr));
+     kvmppc_set_papr(cpu);
 
 +    if (!smc->has_power9_support &&
 +        (((spapr->max_compat_pvr &&
@ -375,7 +557,7 @@ index fcb5dfe792..ab8fb5bf62 100644
         qdev_unrealize(DEVICE(cpu));
         return false;
 diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
-index 04a95669ab..d5f4cf5e03 100644
+index ee7504b976..37a014d59c 100644
 --- a/include/hw/ppc/spapr.h
 +++ b/include/hw/ppc/spapr.h
@@ -154,6 +154,7 @@ struct SpaprMachineClass {
@ -386,16 +568,16 @@ index 04a95669ab..d5f4cf5e03 100644
     bool (*phb_placement)(SpaprMachineState *spapr, uint32_t index,
                           uint64_t *buid, hwaddr *pio,
                           hwaddr *mmio32, hwaddr *mmio64,
-@@ -256,6 +257,9 @@ struct SpaprMachineState {
+@@ -237,6 +238,9 @@ struct SpaprMachineState {
+ 
     /* Set by -boot */
     char *boot_device;
- 
+ 
 +    /* Secure Guest support via x-svm-allowed */
 +    bool svm_allowed;
-+
+ 
     /*< public >*/
     char *kvm_type;
-     char *host_model;
 diff --git a/target/ppc/compat.c b/target/ppc/compat.c
 index 7949a24f5a..f207a9ba01 100644
 --- a/target/ppc/compat.c
@ -421,23 +603,11 @@ index 7949a24f5a..f207a9ba01 100644
 {
     const CompatInfo *compat = compat_by_pvr(compat_pvr);
     const CompatInfo *min = compat_by_pvr(min_compat_pvr);
-diff --git a/target/ppc/cpu-models.c b/target/ppc/cpu-models.c
-index cd3ff700ac..1cb49c8087 100644
--- a/target/ppc/cpu-models.c
-+++ b/target/ppc/cpu-models.c
-@@ -746,6 +746,7 @@
- /* PowerPC CPU aliases                                                     */
- 
- PowerPCCPUAlias ppc_cpu_aliases[] = {
-+#if 0  /* Disabled for Red Hat Enterprise Linux */
-     { "405", "405d4" },
-     { "405cr", "405crc" },
-     { "405gp", "405gpd" },
 diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
-index 81d4263a07..508fbed90b 100644
+index e946da5f3a..23e8b76c85 100644
 --- a/target/ppc/cpu.h
 +++ b/target/ppc/cpu.h
-@@ -1467,6 +1467,7 @@ static inline int cpu_mmu_index(CPUPPCState *env, bool ifetch)
+@@ -1401,6 +1401,7 @@ static inline int cpu_mmu_index(CPUPPCState *env, bool ifetch)
 
 /* Compatibility modes */
 #if defined(TARGET_PPC64)
@ -446,10 +616,10 @@ index 81d4263a07..508fbed90b 100644
                       uint32_t min_compat_pvr, uint32_t max_compat_pvr);
 bool ppc_type_check_compat(const char *cputype, uint32_t compat_pvr,
 diff --git a/target/ppc/kvm.c b/target/ppc/kvm.c
-index 7c25348b7b..83671c955f 100644
+index dc93b99189..154888cce5 100644
 --- a/target/ppc/kvm.c
 +++ b/target/ppc/kvm.c
-@@ -89,6 +89,7 @@ static int cap_ppc_nested_kvm_hv;
+@@ -90,6 +90,7 @@ static int cap_ppc_nested_kvm_hv;
 static int cap_large_decr;
 static int cap_fwnmi;
 static int cap_rpt_invalidate;
@ -457,7 +627,7 @@ index 7c25348b7b..83671c955f 100644
 
 static uint32_t debug_inst_opcode;
 
-@@ -136,6 +137,7 @@ int kvm_arch_init(MachineState *ms, KVMState *s)
+@@ -137,6 +138,7 @@ int kvm_arch_init(MachineState *ms, KVMState *s)
     cap_resize_hpt = kvm_vm_check_extension(s, KVM_CAP_SPAPR_RESIZE_HPT);
     kvmppc_get_cpu_characteristics(s);
     cap_ppc_nested_kvm_hv = kvm_vm_check_extension(s, KVM_CAP_PPC_NESTED_HV);
@ -465,7 +635,7 @@ index 7c25348b7b..83671c955f 100644
     cap_large_decr = kvmppc_get_dec_bits();
     cap_fwnmi = kvm_vm_check_extension(s, KVM_CAP_PPC_FWNMI);
     /*
-@@ -2570,6 +2572,16 @@ int kvmppc_has_cap_rpt_invalidate(void)
+@@ -2563,6 +2565,16 @@ int kvmppc_has_cap_rpt_invalidate(void)
     return cap_rpt_invalidate;
 }
 
@ -482,9 +652,9 @@ index 7c25348b7b..83671c955f 100644
 PowerPCCPUClass *kvm_ppc_get_host_cpu_class(void)
 {
     uint32_t host_pvr = mfpvr();
-@@ -2970,3 +2982,18 @@ bool kvm_arch_cpu_check_are_resettable(void)
- void kvm_arch_accel_class_init(ObjectClass *oc)
+@@ -2959,3 +2971,18 @@ bool kvm_arch_cpu_check_are_resettable(void)
 {
+     return true;
 }
 +
 +void kvmppc_svm_allow(Error **errp)
@ -540,5 +710,5 @@ index ee9325bf9a..20dbb95989 100644
 {
     return -1;
 -- 
-2.31.1
+2.27.0

--- a/SOURCES/0009-Add-s390x-machine-types.patch
+++ b/SOURCES/0009-Add-s390x-machine-types.patch
@ -1,246 +0,0 @@
-From 1973257ed781a93943f27f1518933e8c09c50f88 Mon Sep 17 00:00:00 2001
-From: Miroslav Rezanina <mrezanin@redhat.com>
-Date: Fri, 19 Oct 2018 13:47:32 +0200
-Subject: Add s390x machine types
-
-Adding changes to add RHEL machine types for s390x architecture.
-
-Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
--
-
-Rebase changes (7.1.0 rc0):
- Moved adding rhel_old_machine_deprecation variable to general machine types commit
-
-Merged patches (6.1.0):
- 64a9a5c971 hw/s390x: Remove the RHEL7-only machine type
- 395516d62b redhat: s390x: add rhel-8.5.0 compat machine
-
-Merged patches (6.2.0):
- 3bf66f4520 redhat: Add s390x machine type compatibility update for 6.1 rebase
-
-Merged patches (7.0.0):
- e6ff4de4f7 redhat: Add s390x machine type compatibility handling for the rebase to v6.2
- 4b0efa7e21 redhat: Add rhel8.6.0 and rhel9.0.0 machine types for s390x
- dcc64971bf RHEL: mark old machine types as deprecated (partialy)
-
-Merged patches (7.1.0 rc0):
- 1d6439527a WRB: Introduce RHEL 9.0.0 hw compat structure (only hw/s390x/s390-virtio-ccw.c chunk)
- c8ad21ca31 redhat: Update s390x machine type compatibility for rebase to QEMU 7.0.0
- 5bcf8d874c target/s390x: deprecate CPUs older than z14
-
-Merged patches (7.2.0 rc0):
- 0be2889fa2 Introduce upstream 7.0 compat changes (only applicable parts)
---
- hw/s390x/s390-virtio-ccw.c       | 108 +++++++++++++++++++++++++++++++
- target/s390x/cpu_models.c        |  11 ++++
- target/s390x/cpu_models.h        |   2 +
- target/s390x/cpu_models_sysemu.c |   2 +
- 4 files changed, 123 insertions(+)
-
-diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
-index 2e64ffab45..8d5221fbb1 100644
--- a/hw/s390x/s390-virtio-ccw.c
-+++ b/hw/s390x/s390-virtio-ccw.c
-@@ -823,6 +823,7 @@ bool css_migration_enabled(void)
-     }                                                                         \
-     type_init(ccw_machine_register_##suffix)
- 
-+#if 0 /* Disabled for Red Hat Enterprise Linux */
- static void ccw_machine_7_2_instance_options(MachineState *machine)
- {
- }
-@@ -1186,6 +1187,113 @@ static void ccw_machine_2_4_class_options(MachineClass *mc)
-     compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
- }
- DEFINE_CCW_MACHINE(2_4, "2.4", false);
-+#endif
-+
-+
-+static void ccw_machine_rhel900_instance_options(MachineState *machine)
-+{
-+    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V6_2 };
-+
-+    s390_set_qemu_cpu_model(0x3906, 14, 2, qemu_cpu_feat);
-+}
-+
-+static void ccw_machine_rhel900_class_options(MachineClass *mc)
-+{
-+    compat_props_add(mc->compat_props, hw_compat_rhel_9_1, hw_compat_rhel_9_1_len);
-+    compat_props_add(mc->compat_props, hw_compat_rhel_9_0, hw_compat_rhel_9_0_len);
-+}
-+DEFINE_CCW_MACHINE(rhel900, "rhel9.0.0", true);
-+
-+static void ccw_machine_rhel860_instance_options(MachineState *machine)
-+{
-+    /* Note: The -rhel8.6.0 and -rhel9.0.0 machines are technically identical */
-+    ccw_machine_rhel900_instance_options(machine);
-+}
-+
-+static void ccw_machine_rhel860_class_options(MachineClass *mc)
-+{
-+    ccw_machine_rhel900_class_options(mc);
-+
-+    /* All RHEL machines for prior major releases are deprecated */
-+    mc->deprecation_reason = rhel_old_machine_deprecation;
-+}
-+DEFINE_CCW_MACHINE(rhel860, "rhel8.6.0", false);
-+
-+static void ccw_machine_rhel850_instance_options(MachineState *machine)
-+{
-+    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V6_0 };
-+
-+    ccw_machine_rhel860_instance_options(machine);
-+
-+    s390_set_qemu_cpu_model(0x2964, 13, 2, qemu_cpu_feat);
-+
-+    s390_cpudef_featoff_greater(16, 1, S390_FEAT_NNPA);
-+    s390_cpudef_featoff_greater(16, 1, S390_FEAT_VECTOR_PACKED_DECIMAL_ENH2);
-+    s390_cpudef_featoff_greater(16, 1, S390_FEAT_BEAR_ENH);
-+    s390_cpudef_featoff_greater(16, 1, S390_FEAT_RDP);
-+    s390_cpudef_featoff_greater(16, 1, S390_FEAT_PAI);
-+}
-+
-+static void ccw_machine_rhel850_class_options(MachineClass *mc)
-+{
-+    ccw_machine_rhel860_class_options(mc);
-+    compat_props_add(mc->compat_props, hw_compat_rhel_8_5, hw_compat_rhel_8_5_len);
-+    mc->smp_props.prefer_sockets = true;
-+}
-+DEFINE_CCW_MACHINE(rhel850, "rhel8.5.0", false);
-+
-+static void ccw_machine_rhel840_instance_options(MachineState *machine)
-+{
-+    ccw_machine_rhel850_instance_options(machine);
-+}
-+
-+static void ccw_machine_rhel840_class_options(MachineClass *mc)
-+{
-+    ccw_machine_rhel850_class_options(mc);
-+    compat_props_add(mc->compat_props, hw_compat_rhel_8_4, hw_compat_rhel_8_4_len);
-+}
-+DEFINE_CCW_MACHINE(rhel840, "rhel8.4.0", false);
-+
-+static void ccw_machine_rhel820_instance_options(MachineState *machine)
-+{
-+    ccw_machine_rhel840_instance_options(machine);
-+}
-+
-+static void ccw_machine_rhel820_class_options(MachineClass *mc)
-+{
-+    ccw_machine_rhel840_class_options(mc);
-+    mc->fixup_ram_size = s390_fixup_ram_size;
-+    /* we did not publish a rhel8.3.0 machine */
-+    compat_props_add(mc->compat_props, hw_compat_rhel_8_3, hw_compat_rhel_8_3_len);
-+    compat_props_add(mc->compat_props, hw_compat_rhel_8_2, hw_compat_rhel_8_2_len);
-+}
-+DEFINE_CCW_MACHINE(rhel820, "rhel8.2.0", false);
-+
-+static void ccw_machine_rhel760_instance_options(MachineState *machine)
-+{
-+    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V3_1 };
-+
-+    ccw_machine_rhel820_instance_options(machine);
-+
-+    s390_set_qemu_cpu_model(0x2827, 12, 2, qemu_cpu_feat);
-+
-+    /* The multiple-epoch facility was not available with rhel7.6.0 on z14GA1 */
-+    s390_cpudef_featoff(14, 1, S390_FEAT_MULTIPLE_EPOCH);
-+    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_QSIE);
-+    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_QTOUE);
-+    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_STOE);
-+    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_STOUE);
-+}
-+
-+static void ccw_machine_rhel760_class_options(MachineClass *mc)
-+{
-+    ccw_machine_rhel820_class_options(mc);
-+    /* We never published the s390x version of RHEL-AV 8.0 and 8.1, so add this here */
-+    compat_props_add(mc->compat_props, hw_compat_rhel_8_1, hw_compat_rhel_8_1_len);
-+    compat_props_add(mc->compat_props, hw_compat_rhel_8_0, hw_compat_rhel_8_0_len);
-+    compat_props_add(mc->compat_props, hw_compat_rhel_7_6, hw_compat_rhel_7_6_len);
-+}
-+DEFINE_CCW_MACHINE(rhel760, "rhel7.6.0", false);
- 
- static void ccw_machine_register_types(void)
- {
-diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c
-index c3a4f80633..739770dc15 100644
--- a/target/s390x/cpu_models.c
-+++ b/target/s390x/cpu_models.c
-@@ -45,6 +45,9 @@
-  * of a following release have been a superset of the previous release. With
-  * generation 15 one base feature and one optional feature have been deprecated.
-  */
-+
-+#define RHEL_CPU_DEPRECATION "use at least 'z14', or 'host' / 'qemu' / 'max'"
-+
- static S390CPUDef s390_cpu_defs[] = {
-     CPUDEF_INIT(0x2064, 7, 1, 38, 0x00000000U, "z900", "IBM zSeries 900 GA1"),
-     CPUDEF_INIT(0x2064, 7, 2, 38, 0x00000000U, "z900.2", "IBM zSeries 900 GA2"),
-@@ -854,22 +857,30 @@ static void s390_host_cpu_model_class_init(ObjectClass *oc, void *data)
- static void s390_base_cpu_model_class_init(ObjectClass *oc, void *data)
- {
-     S390CPUClass *xcc = S390_CPU_CLASS(oc);
-+    CPUClass *cc = CPU_CLASS(oc);
- 
-     /* all base models are migration safe */
-     xcc->cpu_def = (const S390CPUDef *) data;
-     xcc->is_migration_safe = true;
-     xcc->is_static = true;
-     xcc->desc = xcc->cpu_def->desc;
-+    if (xcc->cpu_def->gen < 14) {
-+        cc->deprecation_note = RHEL_CPU_DEPRECATION;
-+    }
- }
- 
- static void s390_cpu_model_class_init(ObjectClass *oc, void *data)
- {
-     S390CPUClass *xcc = S390_CPU_CLASS(oc);
-+    CPUClass *cc = CPU_CLASS(oc);
- 
-     /* model that can change between QEMU versions */
-     xcc->cpu_def = (const S390CPUDef *) data;
-     xcc->is_migration_safe = true;
-     xcc->desc = xcc->cpu_def->desc;
-+    if (xcc->cpu_def->gen < 14) {
-+        cc->deprecation_note = RHEL_CPU_DEPRECATION;
-+    }
- }
- 
- static void s390_qemu_cpu_model_class_init(ObjectClass *oc, void *data)
-diff --git a/target/s390x/cpu_models.h b/target/s390x/cpu_models.h
-index fb1adc8b21..d76745afa9 100644
--- a/target/s390x/cpu_models.h
-+++ b/target/s390x/cpu_models.h
-@@ -38,6 +38,8 @@ struct S390CPUDef {
-     S390FeatBitmap full_feat;
-     /* used to init full_feat from generated data */
-     S390FeatInit full_init;
-+    /* if deprecated, provides a suggestion */
-+    const char *deprecation_note;
- };
- 
- /* CPU model based on a CPU definition */
-diff --git a/target/s390x/cpu_models_sysemu.c b/target/s390x/cpu_models_sysemu.c
-index d086b1c39c..1b9cc66405 100644
--- a/target/s390x/cpu_models_sysemu.c
-+++ b/target/s390x/cpu_models_sysemu.c
-@@ -60,6 +60,7 @@ static void create_cpu_model_list(ObjectClass *klass, void *opaque)
-     CpuDefinitionInfo *info;
-     char *name = g_strdup(object_class_get_name(klass));
-     S390CPUClass *scc = S390_CPU_CLASS(klass);
-+    CPUClass *cc = CPU_CLASS(klass);
- 
-     /* strip off the -s390x-cpu */
-     g_strrstr(name, "-" TYPE_S390_CPU)[0] = 0;
-@@ -69,6 +70,7 @@ static void create_cpu_model_list(ObjectClass *klass, void *opaque)
-     info->migration_safe = scc->is_migration_safe;
-     info->q_static = scc->is_static;
-     info->q_typename = g_strdup(object_class_get_name(klass));
-+    info->deprecated = !!cc->deprecation_note;
-     /* check for unavailable features */
-     if (cpu_list_data->model) {
-         Object *obj;
-- 
-2.31.1
-
--- a/SOURCES/0010-Add-s390x-machine-types.patch
+++ b/SOURCES/0010-Add-s390x-machine-types.patch
@ -0,0 +1,165 @@
+From 4ad9a0d0582eef78946b47563eb2c5b7ddf0cbb0 Mon Sep 17 00:00:00 2001
+From: Miroslav Rezanina <mrezanin@redhat.com>
+Date: Fri, 19 Oct 2018 13:47:32 +0200
+Subject: Add s390x machine types
+
+Adding changes to add RHEL machine types for s390x architecture.
+
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+
+Rebase changes (weekly-4.1.0):
+- Use upstream compat handling
+
+Rebase notes (weekly-210303):
+- Use rhel-8.4.0 hw compat
+
+Merged patches (3.1.0):
+- 29df663 s390x/cpumodel: default enable bpb and ppa15 for z196 and later
+
+Merged patches (4.1.0):
+- 6c200d665b hw/s390x/s390-virtio-ccw: Add machine types for RHEL8.0.0
+
+Merged patches (4.2.0):
+- fb192e5 redhat: s390x: Rename s390-ccw-virtio-rhel8.0.0 to s390-ccw-virtio-rhel8.1.0
+- a9b22e8 redhat: s390x: Add proper compatibility options for the -rhel7.6.0 machine
+- hw/s390x: Add the s390-ccw-virtio-rhel8.2.0 machine types (patch 92954)
+
+Merged patches (weekly-201216):
+- a6ae745cce redhat: s390x: add rhel-8.4.0 compat machine
+
+Merged patches (weekly-210602):
+- 50835d3429 redhat: s390x: add rhel-8.5.0 compat machine
+
+Merged patches (weekly-211006):
+- a3bcde27fe redhat: Add s390x machine type compatibility update for 6.1 rebase
+---
+ hw/s390x/s390-virtio-ccw.c | 99 +++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 98 insertions(+), 1 deletion(-)
+
+diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
+index 653587ea62..181856e6cf 100644
+--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
+@@ -767,7 +767,7 @@ bool css_migration_enabled(void)
+     {                                                                         \
+         MachineClass *mc = MACHINE_CLASS(oc);                                 \
+         ccw_machine_##suffix##_class_options(mc);                             \
+-        mc->desc = "VirtIO-ccw based S390 machine v" verstr;                  \
+        mc->desc = "VirtIO-ccw based S390 machine " verstr;                   \
+         if (latest) {                                                         \
+             mc->alias = "s390-ccw-virtio";                                    \
+             mc->is_default = true;                                            \
+@@ -791,6 +791,7 @@ bool css_migration_enabled(void)
+     }                                                                         \
+     type_init(ccw_machine_register_##suffix)
+ 
+#if 0 /* Disabled for Red Hat Enterprise Linux */
+ static void ccw_machine_6_2_instance_options(MachineState *machine)
+ {
+ }
+@@ -1100,6 +1101,102 @@ static void ccw_machine_2_4_class_options(MachineClass *mc)
+     compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
+ }
+ DEFINE_CCW_MACHINE(2_4, "2.4", false);
+#endif
+
+static void ccw_machine_rhel850_instance_options(MachineState *machine)
+{
+}
+
+static void ccw_machine_rhel850_class_options(MachineClass *mc)
+{
+    compat_props_add(mc->compat_props, hw_compat_rhel_8_5, hw_compat_rhel_8_5_len);
+}
+DEFINE_CCW_MACHINE(rhel850, "rhel8.5.0", true);
+
+static void ccw_machine_rhel840_instance_options(MachineState *machine)
+{
+    ccw_machine_rhel850_instance_options(machine);
+}
+
+static void ccw_machine_rhel840_class_options(MachineClass *mc)
+{
+    ccw_machine_rhel850_class_options(mc);
+    compat_props_add(mc->compat_props, hw_compat_rhel_8_4, hw_compat_rhel_8_4_len);
+}
+DEFINE_CCW_MACHINE(rhel840, "rhel8.4.0", false);
+
+static void ccw_machine_rhel820_instance_options(MachineState *machine)
+{
+    ccw_machine_rhel840_instance_options(machine);
+}
+
+static void ccw_machine_rhel820_class_options(MachineClass *mc)
+{
+    ccw_machine_rhel840_class_options(mc);
+    mc->fixup_ram_size = s390_fixup_ram_size;
+    /* we did not publish a rhel8.3.0 machine */
+    compat_props_add(mc->compat_props, hw_compat_rhel_8_3, hw_compat_rhel_8_3_len);
+    compat_props_add(mc->compat_props, hw_compat_rhel_8_2, hw_compat_rhel_8_2_len);
+}
+DEFINE_CCW_MACHINE(rhel820, "rhel8.2.0", false);
+
+static void ccw_machine_rhel760_instance_options(MachineState *machine)
+{
+    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V3_1 };
+
+    ccw_machine_rhel820_instance_options(machine);
+
+    s390_set_qemu_cpu_model(0x2827, 12, 2, qemu_cpu_feat);
+
+    /* The multiple-epoch facility was not available with rhel7.6.0 on z14GA1 */
+    s390_cpudef_featoff(14, 1, S390_FEAT_MULTIPLE_EPOCH);
+    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_QSIE);
+    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_QTOUE);
+    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_STOE);
+    s390_cpudef_featoff(14, 1, S390_FEAT_PTFF_STOUE);
+}
+
+static void ccw_machine_rhel760_class_options(MachineClass *mc)
+{
+    ccw_machine_rhel820_class_options(mc);
+    /* We never published the s390x version of RHEL-AV 8.0 and 8.1, so add this here */
+    compat_props_add(mc->compat_props, hw_compat_rhel_8_1, hw_compat_rhel_8_1_len);
+    compat_props_add(mc->compat_props, hw_compat_rhel_8_0, hw_compat_rhel_8_0_len);
+    compat_props_add(mc->compat_props, hw_compat_rhel_7_6, hw_compat_rhel_7_6_len);
+}
+DEFINE_CCW_MACHINE(rhel760, "rhel7.6.0", false);
+
+static void ccw_machine_rhel750_instance_options(MachineState *machine)
+{
+    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V2_11 };
+    ccw_machine_rhel760_instance_options(machine);
+
+    /* before 2.12 we emulated the very first z900, and RHEL 7.5 is
+       based on 2.10 */
+    s390_set_qemu_cpu_model(0x2064, 7, 1, qemu_cpu_feat);
+
+    /* bpb and ppa15 were only in the full model in RHEL 7.5 */
+    s390_cpudef_featoff_greater(11, 1, S390_FEAT_PPA15);
+    s390_cpudef_featoff_greater(11, 1, S390_FEAT_BPB);
+}
+
+GlobalProperty ccw_compat_rhel_7_5[] = {
+        {
+            .driver   = TYPE_SCLP_EVENT_FACILITY,
+            .property = "allow_all_mask_sizes",
+            .value    = "off",
+        },
+};
+const size_t ccw_compat_rhel_7_5_len = G_N_ELEMENTS(ccw_compat_rhel_7_5);
+
+static void ccw_machine_rhel750_class_options(MachineClass *mc)
+{
+    ccw_machine_rhel760_class_options(mc);
+    compat_props_add(mc->compat_props, hw_compat_rhel_7_5, hw_compat_rhel_7_5_len);
+    compat_props_add(mc->compat_props, ccw_compat_rhel_7_5, ccw_compat_rhel_7_5_len);
+    S390_CCW_MACHINE_CLASS(mc)->hpage_1m_allowed = false;
+}
+DEFINE_CCW_MACHINE(rhel750, "rhel7.5.0", false);
+ 
+ static void ccw_machine_register_types(void)
+ {
+-- 
+2.27.0
+
--- a/SOURCES/0010-Add-x86_64-machine-types.patch
+++ b/SOURCES/0010-Add-x86_64-machine-types.patch
@ -1,874 +0,0 @@
-From 0935624ccdddc286d6eeeb0c1b70d78983c21aa2 Mon Sep 17 00:00:00 2001
-From: Miroslav Rezanina <mrezanin@redhat.com>
-Date: Fri, 19 Oct 2018 13:10:31 +0200
-Subject: Add x86_64 machine types
-
-Adding changes to add RHEL machine types for x86_64 architecture.
-
-Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
-
-Rebase notes (6.1.0):
- Update qemu64 cpu spec
-
-Rebase notes (7.0.0):
- Reset alias for all machine-types except latest one
-
-Merged patches (6.1.0):
- 59c284ad3b x86: Add x86 rhel8.5 machine types
- a8868b42fe redhat: x86: Enable 'kvm-asyncpf-int' by default
- a3995e2eff Remove RHEL 7.0.0 machine type (only x86_64 changes)
- ad3190a79b Remove RHEL 7.1.0 machine type (only x86_64 changes)
- 84bbe15d4e Remove RHEL 7.2.0 machine type (only x86_64 changes)
- 0215eb3356 Remove RHEL 7.3.0 machine types (only x86_64 changes)
- af69d1ca6e Remove RHEL 7.4.0 machine types (only x86_64 changes)
- 8f7a74ab78 Remove RHEL 7.5.0 machine types (only x86_64 changes)
-
-Merged patches (7.0.0):
- eae7d8dd3c x86/rhel machine types: Add pc_rhel_8_5_compat
- 6762f56469 x86/rhel machine types: Wire compat into q35 and i440fx
- 5762101438 rhel machine types/x86: set prefer_sockets
- 9ba9ddc632 x86: Add q35 RHEL 8.6.0 machine type
- 6110d865e5 x86: Add q35 RHEL 9.0.0 machine type
- dcc64971bf RHEL: mark old machine types as deprecated (partialy)
- 6b396f182b RHEL: disable "seqpacket" for "vhost-vsock-device" in rhel8.6.0
-
-Merged patches (7.1.0 rc0):
-  38b89dc245 pc: Move s3/s4 suspend disabling to compat (only hw/i386/pc.c chunk)
-  1d6439527a WRB: Introduce RHEL 9.0.0 hw compat structure (x86_64 specific changes)
- 35b5c8554f target/i386: deprecate CPUs older than x86_64-v2 ABI
-
-Merged patches (7.2.0 rc0):
- 0be2889fa2 Introduce upstream 7.0 compat changes (only applicable parts)
---
- hw/i386/pc.c               | 147 ++++++++++++++++++++++-
- hw/i386/pc_piix.c          |  86 +++++++++++++-
- hw/i386/pc_q35.c           | 234 ++++++++++++++++++++++++++++++++++++-
- hw/s390x/s390-virtio-ccw.c |   1 +
- include/hw/boards.h        |   2 +
- include/hw/i386/pc.h       |  27 +++++
- target/i386/cpu.c          |  21 ++++
- target/i386/kvm/kvm-cpu.c  |   1 +
- target/i386/kvm/kvm.c      |   4 +
- tests/qtest/pvpanic-test.c |   5 +-
- 10 files changed, 521 insertions(+), 7 deletions(-)
-
-diff --git a/hw/i386/pc.c b/hw/i386/pc.c
-index 546b703cb4..c7b1350e64 100644
--- a/hw/i386/pc.c
-+++ b/hw/i386/pc.c
-@@ -393,6 +393,149 @@ GlobalProperty pc_compat_1_4[] = {
- };
- const size_t pc_compat_1_4_len = G_N_ELEMENTS(pc_compat_1_4);
- 
-+/* This macro is for changes to properties that are RHEL specific,
-+ * different to the current upstream and to be applied to the latest
-+ * machine type.
-+ */
-+GlobalProperty pc_rhel_compat[] = {
-+    /* we don't support s3/s4 suspend */
-+    { "PIIX4_PM", "disable_s3", "1" },
-+    { "PIIX4_PM", "disable_s4", "1" },
-+    { "ICH9-LPC", "disable_s3", "1" },
-+    { "ICH9-LPC", "disable_s4", "1" },
-+
-+    { TYPE_X86_CPU, "host-phys-bits", "on" },
-+    { TYPE_X86_CPU, "host-phys-bits-limit", "48" },
-+    { TYPE_X86_CPU, "vmx-entry-load-perf-global-ctrl", "off" },
-+    { TYPE_X86_CPU, "vmx-exit-load-perf-global-ctrl", "off" },
-+    /* bz 1508330 */ 
-+    { "vfio-pci", "x-no-geforce-quirks", "on" },
-+    /* bz 1941397 */
-+    { TYPE_X86_CPU, "kvm-asyncpf-int", "on" },
-+};
-+const size_t pc_rhel_compat_len = G_N_ELEMENTS(pc_rhel_compat);
-+
-+GlobalProperty pc_rhel_9_0_compat[] = {
-+    /* pc_rhel_9_0_compat from pc_compat_6_2 */
-+    { "virtio-mem", "unplugged-inaccessible", "off" },
-+};
-+const size_t pc_rhel_9_0_compat_len = G_N_ELEMENTS(pc_rhel_9_0_compat);
-+
-+GlobalProperty pc_rhel_8_5_compat[] = {
-+    /* pc_rhel_8_5_compat from pc_compat_6_0 */
-+    { "qemu64" "-" TYPE_X86_CPU, "family", "6" },
-+    /* pc_rhel_8_5_compat from pc_compat_6_0 */
-+    { "qemu64" "-" TYPE_X86_CPU, "model", "6" },
-+    /* pc_rhel_8_5_compat from pc_compat_6_0 */
-+    { "qemu64" "-" TYPE_X86_CPU, "stepping", "3" },
-+    /* pc_rhel_8_5_compat from pc_compat_6_0 */
-+    { TYPE_X86_CPU, "x-vendor-cpuid-only", "off" },
-+    /* pc_rhel_8_5_compat from pc_compat_6_0 */
-+    { "ICH9-LPC", ACPI_PM_PROP_ACPI_PCIHP_BRIDGE, "off" },
-+
-+    /* pc_rhel_8_5_compat from pc_compat_6_1 */
-+    { TYPE_X86_CPU, "hv-version-id-build", "0x1bbc" },
-+    /* pc_rhel_8_5_compat from pc_compat_6_1 */
-+    { TYPE_X86_CPU, "hv-version-id-major", "0x0006" },
-+    /* pc_rhel_8_5_compat from pc_compat_6_1 */
-+    { TYPE_X86_CPU, "hv-version-id-minor", "0x0001" },
-+};
-+const size_t pc_rhel_8_5_compat_len = G_N_ELEMENTS(pc_rhel_8_5_compat);
-+
-+GlobalProperty pc_rhel_8_4_compat[] = {
-+    /* pc_rhel_8_4_compat from pc_compat_5_2 */
-+    { "ICH9-LPC", "x-smi-cpu-hotunplug", "off" },
-+    { TYPE_X86_CPU, "kvm-asyncpf-int", "off" },
-+};
-+const size_t pc_rhel_8_4_compat_len = G_N_ELEMENTS(pc_rhel_8_4_compat);
-+
-+GlobalProperty pc_rhel_8_3_compat[] = {
-+    /* pc_rhel_8_3_compat from pc_compat_5_1 */
-+    { "ICH9-LPC", "x-smi-cpu-hotplug", "off" },
-+};
-+const size_t pc_rhel_8_3_compat_len = G_N_ELEMENTS(pc_rhel_8_3_compat);
-+
-+GlobalProperty pc_rhel_8_2_compat[] = {
-+    /* pc_rhel_8_2_compat from pc_compat_4_2 */
-+    { "mch", "smbase-smram", "off" },
-+};
-+const size_t pc_rhel_8_2_compat_len = G_N_ELEMENTS(pc_rhel_8_2_compat);
-+
-+/* pc_rhel_8_1_compat is empty since pc_4_1_compat is */
-+GlobalProperty pc_rhel_8_1_compat[] = { };
-+const size_t pc_rhel_8_1_compat_len = G_N_ELEMENTS(pc_rhel_8_1_compat);
-+
-+GlobalProperty pc_rhel_8_0_compat[] = {
-+    /* pc_rhel_8_0_compat from pc_compat_3_1 */
-+    { "intel-iommu", "dma-drain", "off" },
-+    /* pc_rhel_8_0_compat from pc_compat_3_1 */
-+    { "Opteron_G3" "-" TYPE_X86_CPU, "rdtscp", "off" },
-+    /* pc_rhel_8_0_compat from pc_compat_3_1 */
-+    { "Opteron_G4" "-" TYPE_X86_CPU, "rdtscp", "off" },
-+    /* pc_rhel_8_0_compat from pc_compat_3_1 */
-+    { "Opteron_G4" "-" TYPE_X86_CPU, "npt", "off" },
-+    /* pc_rhel_8_0_compat from pc_compat_3_1 */
-+    { "Opteron_G4" "-" TYPE_X86_CPU, "nrip-save", "off" },
-+    /* pc_rhel_8_0_compat from pc_compat_3_1 */
-+    { "Opteron_G5" "-" TYPE_X86_CPU, "rdtscp", "off" },
-+    /* pc_rhel_8_0_compat from pc_compat_3_1 */
-+    { "Opteron_G5" "-" TYPE_X86_CPU, "npt", "off" },
-+    /* pc_rhel_8_0_compat from pc_compat_3_1 */
-+    { "Opteron_G5" "-" TYPE_X86_CPU, "nrip-save", "off" },
-+    /* pc_rhel_8_0_compat from pc_compat_3_1 */
-+    { "EPYC" "-" TYPE_X86_CPU, "npt", "off" },
-+    /* pc_rhel_8_0_compat from pc_compat_3_1 */
-+    { "EPYC" "-" TYPE_X86_CPU, "nrip-save", "off" },
-+    /* pc_rhel_8_0_compat from pc_compat_3_1 */
-+    { "EPYC-IBPB" "-" TYPE_X86_CPU, "npt", "off" },
-+    /* pc_rhel_8_0_compat from pc_compat_3_1 */
-+    { "EPYC-IBPB" "-" TYPE_X86_CPU, "nrip-save", "off" },
-+    /** The mpx=on entries from pc_compat_3_1 are in pc_rhel_7_6_compat **/
-+    /* pc_rhel_8_0_compat from pc_compat_3_1 */
-+    { "Cascadelake-Server" "-" TYPE_X86_CPU, "stepping", "5" },
-+    /* pc_rhel_8_0_compat from pc_compat_3_1 */
-+    { TYPE_X86_CPU, "x-intel-pt-auto-level", "off" },
-+};
-+const size_t pc_rhel_8_0_compat_len = G_N_ELEMENTS(pc_rhel_8_0_compat);
-+
-+/* Similar to PC_COMPAT_3_0 + PC_COMPAT_2_12, but:
-+ * all of the 2_12 stuff was already in 7.6 from bz 1481253
-+ * x-migrate-smi-count comes from PC_COMPAT_2_11 but
-+ * is really tied to kernel version so keep it off on 7.x
-+ * machine types irrespective of host.
-+ */
-+GlobalProperty pc_rhel_7_6_compat[] = {
-+    /* pc_rhel_7_6_compat from pc_compat_3_0 */ 
-+    { TYPE_X86_CPU, "x-hv-synic-kvm-only", "on" },
-+    /* pc_rhel_7_6_compat from pc_compat_3_0 */ 
-+    { "Skylake-Server" "-" TYPE_X86_CPU, "pku", "off" },
-+    /* pc_rhel_7_6_compat from pc_compat_3_0 */ 
-+    { "Skylake-Server-IBRS" "-" TYPE_X86_CPU, "pku", "off" },
-+    /* pc_rhel_7_6_compat from pc_compat_2_11 */ 
-+    { TYPE_X86_CPU, "x-migrate-smi-count", "off" },
-+    /* pc_rhel_7_6_compat from pc_compat_2_11 */ 
-+    { "Skylake-Client" "-" TYPE_X86_CPU, "mpx", "on" },
-+    /* pc_rhel_7_6_compat from pc_compat_2_11 */ 
-+    { "Skylake-Client-IBRS" "-" TYPE_X86_CPU, "mpx", "on" },
-+    /* pc_rhel_7_6_compat from pc_compat_2_11 */ 
-+    { "Skylake-Server" "-" TYPE_X86_CPU, "mpx", "on" },
-+    /* pc_rhel_7_6_compat from pc_compat_2_11 */ 
-+    { "Skylake-Server-IBRS" "-" TYPE_X86_CPU, "mpx", "on" },
-+    /* pc_rhel_7_6_compat from pc_compat_2_11 */ 
-+    { "Cascadelake-Server" "-" TYPE_X86_CPU, "mpx", "on" },
-+    /* pc_rhel_7_6_compat from pc_compat_2_11 */ 
-+    { "Icelake-Client" "-" TYPE_X86_CPU, "mpx", "on" },
-+    /* pc_rhel_7_6_compat from pc_compat_2_11 */ 
-+    { "Icelake-Server" "-" TYPE_X86_CPU, "mpx", "on" },
-+};
-+const size_t pc_rhel_7_6_compat_len = G_N_ELEMENTS(pc_rhel_7_6_compat);
-+
-+/*
-+ * The PC_RHEL_*_COMPAT serve the same purpose for RHEL-7 machine
-+ * types as the PC_COMPAT_* do for upstream types.
-+ * PC_RHEL_7_*_COMPAT apply both to i440fx and q35 types.
-+ */
-+
- GSIState *pc_gsi_create(qemu_irq **irqs, bool pci_enabled)
- {
-     GSIState *s;
-@@ -1907,6 +2050,7 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
-     pcmc->pvh_enabled = true;
-     pcmc->kvmclock_create_always = true;
-     assert(!mc->get_hotplug_handler);
-+    mc->async_pf_vmexit_disable = false;
-     mc->get_hotplug_handler = pc_get_hotplug_handler;
-     mc->hotplug_allowed = pc_hotplug_allowed;
-     mc->cpu_index_to_instance_props = x86_cpu_index_to_props;
-@@ -1917,7 +2061,8 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
-     mc->has_hotpluggable_cpus = true;
-     mc->default_boot_order = "cad";
-     mc->block_default_type = IF_IDE;
-    mc->max_cpus = 255;
-+    /* 240: max CPU count for RHEL */
-+    mc->max_cpus = 240;
-     mc->reset = pc_machine_reset;
-     mc->wakeup = pc_machine_wakeup;
-     hc->pre_plug = pc_machine_device_pre_plug_cb;
-diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
-index 0985ff67d2..173a1fd10b 100644
--- a/hw/i386/pc_piix.c
-+++ b/hw/i386/pc_piix.c
-@@ -53,6 +53,7 @@
- #include "qapi/error.h"
- #include "qemu/error-report.h"
- #include "sysemu/xen.h"
-+#include "migration/migration.h"
- #ifdef CONFIG_XEN
- #include <xen/hvm/hvm_info_table.h>
- #include "hw/xen/xen_pt.h"
-@@ -184,8 +185,8 @@ static void pc_init1(MachineState *machine,
-     if (pcmc->smbios_defaults) {
-         MachineClass *mc = MACHINE_GET_CLASS(machine);
-         /* These values are guest ABI, do not change */
-        smbios_set_defaults("QEMU", "Standard PC (i440FX + PIIX, 1996)",
-                            mc->name, pcmc->smbios_legacy_mode,
-+        smbios_set_defaults("Red Hat", "KVM",
-+                            mc->desc, pcmc->smbios_legacy_mode,
-                             pcmc->smbios_uuid_encoded,
-                             pcmc->smbios_stream_product,
-                             pcmc->smbios_stream_version,
-@@ -334,6 +335,7 @@ static void pc_init1(MachineState *machine,
-  * hw_compat_*, pc_compat_*, or * pc_*_machine_options().
-  */
- 
-+#if 0 /* Disabled for Red Hat Enterprise Linux */
- static void pc_compat_2_3_fn(MachineState *machine)
- {
-     X86MachineState *x86ms = X86_MACHINE(machine);
-@@ -896,3 +898,83 @@ static void xenfv_3_1_machine_options(MachineClass *m)
- DEFINE_PC_MACHINE(xenfv, "xenfv-3.1", pc_xen_hvm_init,
-                   xenfv_3_1_machine_options);
- #endif
-+#endif  /* Disabled for Red Hat Enterprise Linux */
-+
-+/* Red Hat Enterprise Linux machine types */
-+
-+/* Options for the latest rhel7 machine type */
-+static void pc_machine_rhel7_options(MachineClass *m)
-+{
-+    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-+    m->family = "pc_piix_Y";
-+    m->default_machine_opts = "firmware=bios-256k.bin,hpet=off";
-+    pcmc->default_nic_model = "e1000";
-+    pcmc->pci_root_uid = 0;
-+    m->default_display = "std";
-+    m->no_parallel = 1;
-+    m->numa_mem_supported = true;
-+    m->auto_enable_numa_with_memdev = false;
-+    machine_class_allow_dynamic_sysbus_dev(m, TYPE_RAMFB_DEVICE);
-+    compat_props_add(m->compat_props, pc_rhel_compat, pc_rhel_compat_len);
-+    m->alias = "pc";
-+    m->is_default = 1;
-+    m->smp_props.prefer_sockets = true;
-+}
-+
-+static void pc_init_rhel760(MachineState *machine)
-+{
-+    pc_init1(machine, TYPE_I440FX_PCI_HOST_BRIDGE, \
-+             TYPE_I440FX_PCI_DEVICE);
-+}
-+
-+static void pc_machine_rhel760_options(MachineClass *m)
-+{
-+    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-+    pc_machine_rhel7_options(m);
-+    m->desc = "RHEL 7.6.0 PC (i440FX + PIIX, 1996)";
-+    m->async_pf_vmexit_disable = true;
-+    m->smbus_no_migration_support = true;
-+
-+    /* All RHEL machines for prior major releases are deprecated */
-+    m->deprecation_reason = rhel_old_machine_deprecation;
-+
-+    pcmc->pvh_enabled = false;
-+    pcmc->default_cpu_version = CPU_VERSION_LEGACY;
-+    pcmc->kvmclock_create_always = false;
-+    /* From pc_i440fx_5_1_machine_options() */
-+    pcmc->pci_root_uid = 1;
-+    pcmc->legacy_no_rng_seed = true;
-+    compat_props_add(m->compat_props, hw_compat_rhel_9_1,
-+                     hw_compat_rhel_9_1_len);
-+    compat_props_add(m->compat_props, hw_compat_rhel_9_0,
-+                     hw_compat_rhel_9_0_len);
-+    compat_props_add(m->compat_props, pc_rhel_9_0_compat,
-+                     pc_rhel_9_0_compat_len);
-+    compat_props_add(m->compat_props, hw_compat_rhel_8_6,
-+                     hw_compat_rhel_8_6_len);
-+    compat_props_add(m->compat_props, hw_compat_rhel_8_5,
-+                     hw_compat_rhel_8_5_len);
-+    compat_props_add(m->compat_props, pc_rhel_8_5_compat,
-+                     pc_rhel_8_5_compat_len);
-+    compat_props_add(m->compat_props, hw_compat_rhel_8_4,
-+                     hw_compat_rhel_8_4_len);
-+    compat_props_add(m->compat_props, pc_rhel_8_4_compat,
-+                     pc_rhel_8_4_compat_len);
-+    compat_props_add(m->compat_props, hw_compat_rhel_8_3,
-+                     hw_compat_rhel_8_3_len);
-+    compat_props_add(m->compat_props, pc_rhel_8_3_compat,
-+                     pc_rhel_8_3_compat_len);
-+    compat_props_add(m->compat_props, hw_compat_rhel_8_2,
-+                     hw_compat_rhel_8_2_len);
-+    compat_props_add(m->compat_props, pc_rhel_8_2_compat,
-+                     pc_rhel_8_2_compat_len);
-+    compat_props_add(m->compat_props, hw_compat_rhel_8_1, hw_compat_rhel_8_1_len);
-+    compat_props_add(m->compat_props, pc_rhel_8_1_compat, pc_rhel_8_1_compat_len);
-+    compat_props_add(m->compat_props, hw_compat_rhel_8_0, hw_compat_rhel_8_0_len);
-+    compat_props_add(m->compat_props, pc_rhel_8_0_compat, pc_rhel_8_0_compat_len);
-+    compat_props_add(m->compat_props, hw_compat_rhel_7_6, hw_compat_rhel_7_6_len);
-+    compat_props_add(m->compat_props, pc_rhel_7_6_compat, pc_rhel_7_6_compat_len);
-+}
-+
-+DEFINE_PC_MACHINE(rhel760, "pc-i440fx-rhel7.6.0", pc_init_rhel760,
-+                  pc_machine_rhel760_options);
-diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
-index ea582254e3..97c3630021 100644
--- a/hw/i386/pc_q35.c
-+++ b/hw/i386/pc_q35.c
-@@ -198,8 +198,8 @@ static void pc_q35_init(MachineState *machine)
- 
-     if (pcmc->smbios_defaults) {
-         /* These values are guest ABI, do not change */
-        smbios_set_defaults("QEMU", "Standard PC (Q35 + ICH9, 2009)",
-                            mc->name, pcmc->smbios_legacy_mode,
-+        smbios_set_defaults("Red Hat", "KVM",
-+                            mc->desc, pcmc->smbios_legacy_mode,
-                             pcmc->smbios_uuid_encoded,
-                             pcmc->smbios_stream_product,
-                             pcmc->smbios_stream_version,
-@@ -352,6 +352,7 @@ static void pc_q35_init(MachineState *machine)
-     DEFINE_PC_MACHINE(suffix, name, pc_init_##suffix, optionfn)
- 
- 
-+#if 0 /* Disabled for Red Hat Enterprise Linux */
- static void pc_q35_machine_options(MachineClass *m)
- {
-     PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-@@ -666,3 +667,232 @@ static void pc_q35_2_4_machine_options(MachineClass *m)
- 
- DEFINE_Q35_MACHINE(v2_4, "pc-q35-2.4", NULL,
-                    pc_q35_2_4_machine_options);
-+#endif  /* Disabled for Red Hat Enterprise Linux */
-+
-+/* Red Hat Enterprise Linux machine types */
-+
-+/* Options for the latest rhel q35 machine type */
-+static void pc_q35_machine_rhel_options(MachineClass *m)
-+{
-+    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-+    pcmc->default_nic_model = "e1000e";
-+    pcmc->pci_root_uid = 0;
-+    m->family = "pc_q35_Z";
-+    m->units_per_default_bus = 1;
-+    m->default_machine_opts = "firmware=bios-256k.bin,hpet=off";
-+    m->default_display = "std";
-+    m->no_floppy = 1;
-+    m->no_parallel = 1;
-+    pcmc->default_cpu_version = 1;
-+    machine_class_allow_dynamic_sysbus_dev(m, TYPE_AMD_IOMMU_DEVICE);
-+    machine_class_allow_dynamic_sysbus_dev(m, TYPE_INTEL_IOMMU_DEVICE);
-+    machine_class_allow_dynamic_sysbus_dev(m, TYPE_RAMFB_DEVICE);
-+    m->alias = "q35";
-+    m->max_cpus = 710;
-+    compat_props_add(m->compat_props, pc_rhel_compat, pc_rhel_compat_len);
-+}
-+
-+static void pc_q35_init_rhel900(MachineState *machine)
-+{
-+    pc_q35_init(machine);
-+}
-+
-+static void pc_q35_machine_rhel900_options(MachineClass *m)
-+{
-+    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-+    pc_q35_machine_rhel_options(m);
-+    m->desc = "RHEL-9.0.0 PC (Q35 + ICH9, 2009)";
-+    pcmc->smbios_stream_product = "RHEL";
-+    pcmc->smbios_stream_version = "9.0.0";
-+    pcmc->legacy_no_rng_seed = true;
-+    compat_props_add(m->compat_props, hw_compat_rhel_9_1,
-+                     hw_compat_rhel_9_1_len);
-+    compat_props_add(m->compat_props, hw_compat_rhel_9_0,
-+                     hw_compat_rhel_9_0_len);
-+    compat_props_add(m->compat_props, pc_rhel_9_0_compat,
-+                     pc_rhel_9_0_compat_len);
-+}
-+
-+DEFINE_PC_MACHINE(q35_rhel900, "pc-q35-rhel9.0.0", pc_q35_init_rhel900,
-+                  pc_q35_machine_rhel900_options);
-+
-+static void pc_q35_init_rhel860(MachineState *machine)
-+{
-+    pc_q35_init(machine);
-+}
-+
-+static void pc_q35_machine_rhel860_options(MachineClass *m)
-+{
-+    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-+    pc_q35_machine_rhel900_options(m);
-+    m->desc = "RHEL-8.6.0 PC (Q35 + ICH9, 2009)";
-+    m->alias = NULL;
-+
-+    /* All RHEL machines for prior major releases are deprecated */
-+    m->deprecation_reason = rhel_old_machine_deprecation;
-+
-+    pcmc->smbios_stream_product = "RHEL-AV";
-+    pcmc->smbios_stream_version = "8.6.0";
-+    compat_props_add(m->compat_props, hw_compat_rhel_8_6,
-+                     hw_compat_rhel_8_6_len);
-+}
-+
-+DEFINE_PC_MACHINE(q35_rhel860, "pc-q35-rhel8.6.0", pc_q35_init_rhel860,
-+                  pc_q35_machine_rhel860_options);
-+
-+
-+static void pc_q35_init_rhel850(MachineState *machine)
-+{
-+    pc_q35_init(machine);
-+}
-+
-+static void pc_q35_machine_rhel850_options(MachineClass *m)
-+{
-+    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-+    pc_q35_machine_rhel860_options(m);
-+    m->desc = "RHEL-8.5.0 PC (Q35 + ICH9, 2009)";
-+    m->alias = NULL;
-+    pcmc->smbios_stream_product = "RHEL-AV";
-+    pcmc->smbios_stream_version = "8.5.0";
-+    compat_props_add(m->compat_props, hw_compat_rhel_8_5,
-+                     hw_compat_rhel_8_5_len);
-+    compat_props_add(m->compat_props, pc_rhel_8_5_compat,
-+                     pc_rhel_8_5_compat_len);
-+    m->smp_props.prefer_sockets = true;
-+}
-+
-+DEFINE_PC_MACHINE(q35_rhel850, "pc-q35-rhel8.5.0", pc_q35_init_rhel850,
-+                  pc_q35_machine_rhel850_options);
-+
-+
-+static void pc_q35_init_rhel840(MachineState *machine)
-+{
-+    pc_q35_init(machine);
-+}
-+
-+static void pc_q35_machine_rhel840_options(MachineClass *m)
-+{
-+    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-+    pc_q35_machine_rhel850_options(m);
-+    m->desc = "RHEL-8.4.0 PC (Q35 + ICH9, 2009)";
-+    m->alias = NULL;
-+    pcmc->smbios_stream_product = "RHEL-AV";
-+    pcmc->smbios_stream_version = "8.4.0";
-+    compat_props_add(m->compat_props, hw_compat_rhel_8_4,
-+                     hw_compat_rhel_8_4_len);
-+    compat_props_add(m->compat_props, pc_rhel_8_4_compat,
-+                     pc_rhel_8_4_compat_len);
-+}
-+
-+DEFINE_PC_MACHINE(q35_rhel840, "pc-q35-rhel8.4.0", pc_q35_init_rhel840,
-+                  pc_q35_machine_rhel840_options);
-+
-+
-+static void pc_q35_init_rhel830(MachineState *machine)
-+{
-+    pc_q35_init(machine);
-+}
-+
-+static void pc_q35_machine_rhel830_options(MachineClass *m)
-+{
-+    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-+    pc_q35_machine_rhel840_options(m);
-+    m->desc = "RHEL-8.3.0 PC (Q35 + ICH9, 2009)";
-+    m->alias = NULL;
-+    pcmc->smbios_stream_product = "RHEL-AV";
-+    pcmc->smbios_stream_version = "8.3.0";
-+    compat_props_add(m->compat_props, hw_compat_rhel_8_3,
-+                     hw_compat_rhel_8_3_len);
-+    compat_props_add(m->compat_props, pc_rhel_8_3_compat,
-+                     pc_rhel_8_3_compat_len);
-+    /* From pc_q35_5_1_machine_options() */
-+    pcmc->kvmclock_create_always = false;
-+    /* From pc_q35_5_1_machine_options() */
-+    pcmc->pci_root_uid = 1;
-+}
-+
-+DEFINE_PC_MACHINE(q35_rhel830, "pc-q35-rhel8.3.0", pc_q35_init_rhel830,
-+                  pc_q35_machine_rhel830_options);
-+
-+static void pc_q35_init_rhel820(MachineState *machine)
-+{
-+    pc_q35_init(machine);
-+}
-+
-+static void pc_q35_machine_rhel820_options(MachineClass *m)
-+{
-+    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-+    pc_q35_machine_rhel830_options(m);
-+    m->desc = "RHEL-8.2.0 PC (Q35 + ICH9, 2009)";
-+    m->alias = NULL;
-+    m->numa_mem_supported = true;
-+    m->auto_enable_numa_with_memdev = false;
-+    pcmc->smbios_stream_product = "RHEL-AV";
-+    pcmc->smbios_stream_version = "8.2.0";
-+    compat_props_add(m->compat_props, hw_compat_rhel_8_2,
-+                     hw_compat_rhel_8_2_len);
-+    compat_props_add(m->compat_props, pc_rhel_8_2_compat,
-+                     pc_rhel_8_2_compat_len);
-+}
-+
-+DEFINE_PC_MACHINE(q35_rhel820, "pc-q35-rhel8.2.0", pc_q35_init_rhel820,
-+                  pc_q35_machine_rhel820_options);
-+
-+static void pc_q35_init_rhel810(MachineState *machine)
-+{
-+    pc_q35_init(machine);
-+}
-+
-+static void pc_q35_machine_rhel810_options(MachineClass *m)
-+{
-+    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-+    pc_q35_machine_rhel820_options(m);
-+    m->desc = "RHEL-8.1.0 PC (Q35 + ICH9, 2009)";
-+    m->alias = NULL;
-+    pcmc->smbios_stream_product = NULL;
-+    pcmc->smbios_stream_version = NULL;
-+    compat_props_add(m->compat_props, hw_compat_rhel_8_1, hw_compat_rhel_8_1_len);
-+    compat_props_add(m->compat_props, pc_rhel_8_1_compat, pc_rhel_8_1_compat_len);
-+}
-+
-+DEFINE_PC_MACHINE(q35_rhel810, "pc-q35-rhel8.1.0", pc_q35_init_rhel810,
-+                  pc_q35_machine_rhel810_options);
-+
-+static void pc_q35_init_rhel800(MachineState *machine)
-+{
-+    pc_q35_init(machine);
-+}
-+
-+static void pc_q35_machine_rhel800_options(MachineClass *m)
-+{
-+    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-+    pc_q35_machine_rhel810_options(m);
-+    m->desc = "RHEL-8.0.0 PC (Q35 + ICH9, 2009)";
-+    m->smbus_no_migration_support = true;
-+    m->alias = NULL;
-+    pcmc->pvh_enabled = false;
-+    pcmc->default_cpu_version = CPU_VERSION_LEGACY;
-+    compat_props_add(m->compat_props, hw_compat_rhel_8_0, hw_compat_rhel_8_0_len);
-+    compat_props_add(m->compat_props, pc_rhel_8_0_compat, pc_rhel_8_0_compat_len);
-+}
-+
-+DEFINE_PC_MACHINE(q35_rhel800, "pc-q35-rhel8.0.0", pc_q35_init_rhel800,
-+                  pc_q35_machine_rhel800_options);
-+
-+static void pc_q35_init_rhel760(MachineState *machine)
-+{
-+    pc_q35_init(machine);
-+}
-+
-+static void pc_q35_machine_rhel760_options(MachineClass *m)
-+{
-+    pc_q35_machine_rhel800_options(m);
-+    m->alias = NULL;
-+    m->desc = "RHEL-7.6.0 PC (Q35 + ICH9, 2009)";
-+    m->async_pf_vmexit_disable = true;
-+    compat_props_add(m->compat_props, hw_compat_rhel_7_6, hw_compat_rhel_7_6_len);
-+    compat_props_add(m->compat_props, pc_rhel_7_6_compat, pc_rhel_7_6_compat_len);
-+}
-+
-+DEFINE_PC_MACHINE(q35_rhel760, "pc-q35-rhel7.6.0", pc_q35_init_rhel760,
-+                  pc_q35_machine_rhel760_options);
-diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
-index 8d5221fbb1..ba640e3d9e 100644
--- a/hw/s390x/s390-virtio-ccw.c
-+++ b/hw/s390x/s390-virtio-ccw.c
-@@ -1213,6 +1213,7 @@ static void ccw_machine_rhel860_instance_options(MachineState *machine)
- static void ccw_machine_rhel860_class_options(MachineClass *mc)
- {
-     ccw_machine_rhel900_class_options(mc);
-+    compat_props_add(mc->compat_props, hw_compat_rhel_8_6, hw_compat_rhel_8_6_len);
- 
-     /* All RHEL machines for prior major releases are deprecated */
-     mc->deprecation_reason = rhel_old_machine_deprecation;
-diff --git a/include/hw/boards.h b/include/hw/boards.h
-index 2209d4e416..fd75f551b1 100644
--- a/include/hw/boards.h
-+++ b/include/hw/boards.h
-@@ -266,6 +266,8 @@ struct MachineClass {
-     strList *allowed_dynamic_sysbus_devices;
-     bool auto_enable_numa_with_memhp;
-     bool auto_enable_numa_with_memdev;
-+    /* RHEL only */
-+    bool async_pf_vmexit_disable;
-     bool ignore_boot_device_suffixes;
-     bool smbus_no_migration_support;
-     bool nvdimm_supported;
-diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
-index 3754eaa97d..4266fe2fdb 100644
--- a/include/hw/i386/pc.h
-+++ b/include/hw/i386/pc.h
-@@ -293,6 +293,33 @@ extern const size_t pc_compat_1_5_len;
- extern GlobalProperty pc_compat_1_4[];
- extern const size_t pc_compat_1_4_len;
- 
-+extern GlobalProperty pc_rhel_compat[];
-+extern const size_t pc_rhel_compat_len;
-+
-+extern GlobalProperty pc_rhel_9_0_compat[];
-+extern const size_t pc_rhel_9_0_compat_len;
-+
-+extern GlobalProperty pc_rhel_8_5_compat[];
-+extern const size_t pc_rhel_8_5_compat_len;
-+
-+extern GlobalProperty pc_rhel_8_4_compat[];
-+extern const size_t pc_rhel_8_4_compat_len;
-+
-+extern GlobalProperty pc_rhel_8_3_compat[];
-+extern const size_t pc_rhel_8_3_compat_len;
-+
-+extern GlobalProperty pc_rhel_8_2_compat[];
-+extern const size_t pc_rhel_8_2_compat_len;
-+
-+extern GlobalProperty pc_rhel_8_1_compat[];
-+extern const size_t pc_rhel_8_1_compat_len;
-+
-+extern GlobalProperty pc_rhel_8_0_compat[];
-+extern const size_t pc_rhel_8_0_compat_len;
-+
-+extern GlobalProperty pc_rhel_7_6_compat[];
-+extern const size_t pc_rhel_7_6_compat_len;
-+
- #define DEFINE_PC_MACHINE(suffix, namestr, initfn, optsfn) \
-     static void pc_machine_##suffix##_class_init(ObjectClass *oc, void *data) \
-     { \
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index 22b681ca37..f7c526cbe6 100644
--- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -1832,9 +1832,13 @@ static const CPUCaches epyc_milan_cache_info = {
-  *  PT in VMX operation
-  */
- 
-+#define RHEL_CPU_DEPRECATION \
-+    "use at least 'Nehalem' / 'Opteron_G4', or 'host' / 'max'"
-+
- static const X86CPUDefinition builtin_x86_defs[] = {
-     {
-         .name = "qemu64",
-+        .deprecation_note = RHEL_CPU_DEPRECATION,
-         .level = 0xd,
-         .vendor = CPUID_VENDOR_AMD,
-         .family = 15,
-@@ -1855,6 +1859,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
-     },
-     {
-         .name = "phenom",
-+        .deprecation_note = RHEL_CPU_DEPRECATION,
-         .level = 5,
-         .vendor = CPUID_VENDOR_AMD,
-         .family = 16,
-@@ -1887,6 +1892,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
-     },
-     {
-         .name = "core2duo",
-+        .deprecation_note = RHEL_CPU_DEPRECATION,
-         .level = 10,
-         .vendor = CPUID_VENDOR_INTEL,
-         .family = 6,
-@@ -1929,6 +1935,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
-     },
-     {
-         .name = "kvm64",
-+        .deprecation_note = RHEL_CPU_DEPRECATION,
-         .level = 0xd,
-         .vendor = CPUID_VENDOR_INTEL,
-         .family = 15,
-@@ -1970,6 +1977,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
-     },
-     {
-         .name = "qemu32",
-+        .deprecation_note = RHEL_CPU_DEPRECATION,
-         .level = 4,
-         .vendor = CPUID_VENDOR_INTEL,
-         .family = 6,
-@@ -1984,6 +1992,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
-     },
-     {
-         .name = "kvm32",
-+        .deprecation_note = RHEL_CPU_DEPRECATION,
-         .level = 5,
-         .vendor = CPUID_VENDOR_INTEL,
-         .family = 15,
-@@ -2014,6 +2023,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
-     },
-     {
-         .name = "coreduo",
-+        .deprecation_note = RHEL_CPU_DEPRECATION,
-         .level = 10,
-         .vendor = CPUID_VENDOR_INTEL,
-         .family = 6,
-@@ -2047,6 +2057,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
-     },
-     {
-         .name = "486",
-+        .deprecation_note = RHEL_CPU_DEPRECATION,
-         .level = 1,
-         .vendor = CPUID_VENDOR_INTEL,
-         .family = 4,
-@@ -2059,6 +2070,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
-     },
-     {
-         .name = "pentium",
-+        .deprecation_note = RHEL_CPU_DEPRECATION,
-         .level = 1,
-         .vendor = CPUID_VENDOR_INTEL,
-         .family = 5,
-@@ -2071,6 +2083,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
-     },
-     {
-         .name = "pentium2",
-+        .deprecation_note = RHEL_CPU_DEPRECATION,
-         .level = 2,
-         .vendor = CPUID_VENDOR_INTEL,
-         .family = 6,
-@@ -2083,6 +2096,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
-     },
-     {
-         .name = "pentium3",
-+        .deprecation_note = RHEL_CPU_DEPRECATION,
-         .level = 3,
-         .vendor = CPUID_VENDOR_INTEL,
-         .family = 6,
-@@ -2095,6 +2109,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
-     },
-     {
-         .name = "athlon",
-+        .deprecation_note = RHEL_CPU_DEPRECATION,
-         .level = 2,
-         .vendor = CPUID_VENDOR_AMD,
-         .family = 6,
-@@ -2110,6 +2125,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
-     },
-     {
-         .name = "n270",
-+        .deprecation_note = RHEL_CPU_DEPRECATION,
-         .level = 10,
-         .vendor = CPUID_VENDOR_INTEL,
-         .family = 6,
-@@ -2135,6 +2151,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
-     },
-     {
-         .name = "Conroe",
-+        .deprecation_note = RHEL_CPU_DEPRECATION,
-         .level = 10,
-         .vendor = CPUID_VENDOR_INTEL,
-         .family = 6,
-@@ -2175,6 +2192,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
-     },
-     {
-         .name = "Penryn",
-+        .deprecation_note = RHEL_CPU_DEPRECATION,
-         .level = 10,
-         .vendor = CPUID_VENDOR_INTEL,
-         .family = 6,
-@@ -3762,6 +3780,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
-     },
-     {
-         .name = "Opteron_G1",
-+        .deprecation_note = RHEL_CPU_DEPRECATION,
-         .level = 5,
-         .vendor = CPUID_VENDOR_AMD,
-         .family = 15,
-@@ -3782,6 +3801,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
-     },
-     {
-         .name = "Opteron_G2",
-+        .deprecation_note = RHEL_CPU_DEPRECATION,
-         .level = 5,
-         .vendor = CPUID_VENDOR_AMD,
-         .family = 15,
-@@ -3804,6 +3824,7 @@ static const X86CPUDefinition builtin_x86_defs[] = {
-     },
-     {
-         .name = "Opteron_G3",
-+        .deprecation_note = RHEL_CPU_DEPRECATION,
-         .level = 5,
-         .vendor = CPUID_VENDOR_AMD,
-         .family = 16,
-diff --git a/target/i386/kvm/kvm-cpu.c b/target/i386/kvm/kvm-cpu.c
-index 7237378a7d..7b8a3d5af0 100644
--- a/target/i386/kvm/kvm-cpu.c
-+++ b/target/i386/kvm/kvm-cpu.c
-@@ -137,6 +137,7 @@ static PropValue kvm_default_props[] = {
-     { "acpi", "off" },
-     { "monitor", "off" },
-     { "svm", "off" },
-+    { "kvm-pv-unhalt", "on" },
-     { NULL, NULL },
- };
- 
-diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
-index a213209379..81526a1575 100644
--- a/target/i386/kvm/kvm.c
-+++ b/target/i386/kvm/kvm.c
-@@ -3707,6 +3707,7 @@ static int kvm_get_msrs(X86CPU *cpu)
-     struct kvm_msr_entry *msrs = cpu->kvm_msr_buf->entries;
-     int ret, i;
-     uint64_t mtrr_top_bits;
-+    MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
- 
-     kvm_msr_buf_reset(cpu);
- 
-@@ -4062,6 +4063,9 @@ static int kvm_get_msrs(X86CPU *cpu)
-             break;
-         case MSR_KVM_ASYNC_PF_EN:
-             env->async_pf_en_msr = msrs[i].data;
-+            if (mc->async_pf_vmexit_disable) {
-+                env->async_pf_en_msr &= ~(1ULL << 2);
-+            }
-             break;
-         case MSR_KVM_ASYNC_PF_INT:
-             env->async_pf_int_msr = msrs[i].data;
-diff --git a/tests/qtest/pvpanic-test.c b/tests/qtest/pvpanic-test.c
-index bc7b7dfc39..96e6dee3a1 100644
--- a/tests/qtest/pvpanic-test.c
-+++ b/tests/qtest/pvpanic-test.c
-@@ -17,7 +17,7 @@ static void test_panic_nopause(void)
-     QDict *response, *data;
-     QTestState *qts;
- 
-    qts = qtest_init("-device pvpanic -action panic=none");
-+    qts = qtest_init("-M q35 -device pvpanic -action panic=none");
- 
-     val = qtest_inb(qts, 0x505);
-     g_assert_cmpuint(val, ==, 3);
-@@ -40,7 +40,8 @@ static void test_panic(void)
-     QDict *response, *data;
-     QTestState *qts;
- 
-    qts = qtest_init("-device pvpanic -action panic=pause");
-+    /* RHEL: Use q35 */
-+    qts = qtest_init("-M q35 -device pvpanic -action panic=pause");
- 
-     val = qtest_inb(qts, 0x505);
-     g_assert_cmpuint(val, ==, 3);
-- 
-2.31.1
-
--- a/SOURCES/0011-Add-x86_64-machine-types.patch
+++ b/SOURCES/0011-Add-x86_64-machine-types.patch
--- a/SOURCES/0011-Enable-make-check.patch
+++ b/SOURCES/0011-Enable-make-check.patch
@ -1,261 +0,0 @@
-From badfb1290c8eea8a2e1769b2392c7899d5077698 Mon Sep 17 00:00:00 2001
-From: Miroslav Rezanina <mrezanin@redhat.com>
-Date: Wed, 2 Sep 2020 09:39:41 +0200
-Subject: Enable make check
-
-Fixing tests after device disabling and machine types changes and enabling
-make check run during build.
-
-Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
---
-Rebase changes (6.1.0):
- removed unnecessary test changes
-
-Rebase changes (6.2.0):
- new way of disabling bios-table-test
-
-Rebase changes (7.0.0):
- Disable testing virtio-iommu-pci
- Rename default_bus_bypass_iommu property to default-bus-bypass-iommu
- Disable qtest-bios-table for aarch64
- Removed redhat chunks for boot-serial-test.c, cdrom-test.c and cpu-plug-test.c qtests
- Do not disable boot-order-test, prom-env-test and boot-serial-test qtests
- Use rhel machine type for new intel hda qtest
- Remove unnecessary changes in iotest 051
- Remove changes in bios-tables-test.c and prom-env-test.c qtests
-
-Rebase changes (7.1.0 rc0):
- Disable bcm2835-dma-test (added upstream)
-
-Merged patches (6.1.0):
- 2f129df7d3 redhat: Enable the 'test-block-iothread' test again
-
-Merged patches (7.1.0 rc0):
- 64d736640e RHEL-only: tests/avocado: Switch aarch64 tests from a53 to a57
---
- .distro/qemu-kvm.spec.template      | 5 ++---
- tests/avocado/replay_kernel.py      | 2 +-
- tests/avocado/reverse_debugging.py  | 2 +-
- tests/avocado/tcg_plugins.py        | 6 +++---
- tests/qtest/fuzz-e1000e-test.c      | 2 +-
- tests/qtest/fuzz-virtio-scsi-test.c | 2 +-
- tests/qtest/intel-hda-test.c        | 2 +-
- tests/qtest/libqos/meson.build      | 2 +-
- tests/qtest/lpc-ich9-test.c         | 2 +-
- tests/qtest/meson.build             | 7 +------
- tests/qtest/usb-hcd-xhci-test.c     | 4 ++++
- tests/qtest/virtio-net-failover.c   | 1 +
- 12 files changed, 18 insertions(+), 19 deletions(-)
-
-diff --git a/tests/avocado/replay_kernel.py b/tests/avocado/replay_kernel.py
-index 00a26e4a0c..fe5ecf238a 100644
--- a/tests/avocado/replay_kernel.py
-+++ b/tests/avocado/replay_kernel.py
-@@ -147,7 +147,7 @@ def test_aarch64_virt(self):
-         """
-         :avocado: tags=arch:aarch64
-         :avocado: tags=machine:virt
-        :avocado: tags=cpu:cortex-a53
-+        :avocado: tags=cpu:cortex-a57
-         """
-         kernel_url = ('https://archives.fedoraproject.org/pub/archive/fedora'
-                       '/linux/releases/29/Everything/aarch64/os/images/pxeboot'
-diff --git a/tests/avocado/reverse_debugging.py b/tests/avocado/reverse_debugging.py
-index d2921e70c3..66d185ed42 100644
--- a/tests/avocado/reverse_debugging.py
-+++ b/tests/avocado/reverse_debugging.py
-@@ -198,7 +198,7 @@ def test_aarch64_virt(self):
-         """
-         :avocado: tags=arch:aarch64
-         :avocado: tags=machine:virt
-        :avocado: tags=cpu:cortex-a53
-+        :avocado: tags=cpu:cortex-a57
-         """
-         kernel_url = ('https://archives.fedoraproject.org/pub/archive/fedora'
-                       '/linux/releases/29/Everything/aarch64/os/images/pxeboot'
-diff --git a/tests/avocado/tcg_plugins.py b/tests/avocado/tcg_plugins.py
-index 642d2e49e3..93b3afd823 100644
--- a/tests/avocado/tcg_plugins.py
-+++ b/tests/avocado/tcg_plugins.py
-@@ -68,7 +68,7 @@ def test_aarch64_virt_insn(self):
-         :avocado: tags=accel:tcg
-         :avocado: tags=arch:aarch64
-         :avocado: tags=machine:virt
-        :avocado: tags=cpu:cortex-a53
-+        :avocado: tags=cpu:cortex-a57
-         """
-         kernel_path = self._grab_aarch64_kernel()
-         kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
-@@ -94,7 +94,7 @@ def test_aarch64_virt_insn_icount(self):
-         :avocado: tags=accel:tcg
-         :avocado: tags=arch:aarch64
-         :avocado: tags=machine:virt
-        :avocado: tags=cpu:cortex-a53
-+        :avocado: tags=cpu:cortex-a57
-         """
-         kernel_path = self._grab_aarch64_kernel()
-         kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
-@@ -120,7 +120,7 @@ def test_aarch64_virt_mem_icount(self):
-         :avocado: tags=accel:tcg
-         :avocado: tags=arch:aarch64
-         :avocado: tags=machine:virt
-        :avocado: tags=cpu:cortex-a53
-+        :avocado: tags=cpu:cortex-a57
-         """
-         kernel_path = self._grab_aarch64_kernel()
-         kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
-diff --git a/tests/qtest/fuzz-e1000e-test.c b/tests/qtest/fuzz-e1000e-test.c
-index 5052883fb6..b5286f4b12 100644
--- a/tests/qtest/fuzz-e1000e-test.c
-+++ b/tests/qtest/fuzz-e1000e-test.c
-@@ -17,7 +17,7 @@ static void test_lp1879531_eth_get_rss_ex_dst_addr(void)
- {
-     QTestState *s;
- 
-    s = qtest_init("-nographic -monitor none -serial none -M pc-q35-5.0");
-+    s = qtest_init("-nographic -monitor none -serial none -M pc-q35-rhel8.4.0");
- 
-     qtest_outl(s, 0xcf8, 0x80001010);
-     qtest_outl(s, 0xcfc, 0xe1020000);
-diff --git a/tests/qtest/fuzz-virtio-scsi-test.c b/tests/qtest/fuzz-virtio-scsi-test.c
-index e37b48b2cc..88647da054 100644
--- a/tests/qtest/fuzz-virtio-scsi-test.c
-+++ b/tests/qtest/fuzz-virtio-scsi-test.c
-@@ -19,7 +19,7 @@ static void test_mmio_oob_from_memory_region_cache(void)
- {
-     QTestState *s;
- 
-    s = qtest_init("-M pc-q35-5.2 -m 512M "
-+    s = qtest_init("-M pc-q35-rhel8.4.0 -m 512M "
-                    "-device virtio-scsi,num_queues=8,addr=03.0 ");
- 
-     qtest_outl(s, 0xcf8, 0x80001811);
-diff --git a/tests/qtest/intel-hda-test.c b/tests/qtest/intel-hda-test.c
-index d4a8db6fd6..1a796ec15a 100644
--- a/tests/qtest/intel-hda-test.c
-+++ b/tests/qtest/intel-hda-test.c
-@@ -38,7 +38,7 @@ static void test_issue542_ich6(void)
- {
-     QTestState *s;
- 
-    s = qtest_init("-nographic -nodefaults -M pc-q35-6.2 "
-+    s = qtest_init("-nographic -nodefaults -M pc-q35-rhel9.0.0 "
-                    "-device intel-hda,id=" HDA_ID CODEC_DEVICES);
- 
-     qtest_outl(s, 0xcf8, 0x80000804);
-diff --git a/tests/qtest/libqos/meson.build b/tests/qtest/libqos/meson.build
-index 32f028872c..1e78a1a055 100644
--- a/tests/qtest/libqos/meson.build
-+++ b/tests/qtest/libqos/meson.build
-@@ -43,7 +43,7 @@ libqos_srcs = files(
-         'virtio-rng.c',
-         'virtio-scsi.c',
-         'virtio-serial.c',
-        'virtio-iommu.c',
-+#        'virtio-iommu.c',
-         'virtio-gpio.c',
-         'generic-pcihost.c',
- 
-diff --git a/tests/qtest/lpc-ich9-test.c b/tests/qtest/lpc-ich9-test.c
-index 8ac95b89f7..cd2102555c 100644
--- a/tests/qtest/lpc-ich9-test.c
-+++ b/tests/qtest/lpc-ich9-test.c
-@@ -15,7 +15,7 @@ static void test_lp1878642_pci_bus_get_irq_level_assert(void)
- {
-     QTestState *s;
- 
-    s = qtest_init("-M pc-q35-5.0 "
-+    s = qtest_init("-M pc-q35-rhel8.4.0 "
-                    "-nographic -monitor none -serial none");
- 
-     qtest_outl(s, 0xcf8, 0x8000f840); /* PMBASE */
-diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
-index c07a5b1a5f..9df3f9f8b9 100644
--- a/tests/qtest/meson.build
-+++ b/tests/qtest/meson.build
-@@ -82,7 +82,6 @@ qtests_i386 = \
-    config_all_devices.has_key('CONFIG_Q35') and                                             \
-    config_all_devices.has_key('CONFIG_VIRTIO_PCI') and                                      \
-    slirp.found() ? ['virtio-net-failover'] : []) +                                          \
-  (unpack_edk2_blobs ? ['bios-tables-test'] : []) +                                         \
-   qtests_pci +                                                                              \
-   qtests_cxl +                                                                              \
-   ['fdc-test',
-@@ -96,7 +95,6 @@ qtests_i386 = \
-    'drive_del-test',
-    'tco-test',
-    'cpu-plug-test',
-   'q35-test',
-    'vmgenid-test',
-    'migration-test',
-    'test-x86-cpuid-compat',
-@@ -209,15 +207,13 @@ qtests_arm = \
- 
- # TODO: once aarch64 TCG is fixed on ARM 32 bit host, make bios-tables-test unconditional
- qtests_aarch64 = \
-  (cpu != 'arm' and unpack_edk2_blobs ? ['bios-tables-test'] : []) +                            \
-   (config_all_devices.has_key('CONFIG_TPM_TIS_SYSBUS') ? ['tpm-tis-device-test'] : []) +        \
-   (config_all_devices.has_key('CONFIG_TPM_TIS_SYSBUS') ? ['tpm-tis-device-swtpm-test'] : []) +  \
-   (config_all_devices.has_key('CONFIG_XLNX_ZYNQMP_ARM') ? ['xlnx-can-test', 'fuzz-xlnx-dp-test'] : []) + \
-   ['arm-cpu-features',
-    'numa-test',
-    'boot-serial-test',
-   'migration-test',
-   'bcm2835-dma-test']
-+   'migration-test']
- 
- qtests_s390x = \
-   (slirp.found() ? ['pxe-test', 'test-netfilter'] : []) +                 \
-@@ -225,7 +221,6 @@ qtests_s390x = \
-   (config_host.has_key('CONFIG_POSIX') ? ['test-filter-redirector'] : []) +                     \
-   ['boot-serial-test',
-    'drive_del-test',
-   'device-plug-test',
-    'virtio-ccw-test',
-    'cpu-plug-test',
-    'migration-test']
-diff --git a/tests/qtest/usb-hcd-xhci-test.c b/tests/qtest/usb-hcd-xhci-test.c
-index 10ef9d2a91..3855873050 100644
--- a/tests/qtest/usb-hcd-xhci-test.c
-+++ b/tests/qtest/usb-hcd-xhci-test.c
-@@ -21,6 +21,7 @@ static void test_xhci_hotplug(void)
-     usb_test_hotplug(global_qtest, "xhci", "1", NULL);
- }
- 
-+#if 0 /* Disabled for Red Hat Enterprise Linux */
- static void test_usb_uas_hotplug(void)
- {
-     QTestState *qts = global_qtest;
-@@ -36,6 +37,7 @@ static void test_usb_uas_hotplug(void)
-     qtest_qmp_device_del(qts, "scsihd");
-     qtest_qmp_device_del(qts, "uas");
- }
-+#endif
- 
- static void test_usb_ccid_hotplug(void)
- {
-@@ -56,7 +58,9 @@ int main(int argc, char **argv)
- 
-     qtest_add_func("/xhci/pci/init", test_xhci_init);
-     qtest_add_func("/xhci/pci/hotplug", test_xhci_hotplug);
-+#if 0 /* Disabled for Red Hat Enterprise Linux */
-     qtest_add_func("/xhci/pci/hotplug/usb-uas", test_usb_uas_hotplug);
-+#endif
-     qtest_add_func("/xhci/pci/hotplug/usb-ccid", test_usb_ccid_hotplug);
- 
-     qtest_start("-device nec-usb-xhci,id=xhci"
-diff --git a/tests/qtest/virtio-net-failover.c b/tests/qtest/virtio-net-failover.c
-index 4a809590bf..1bf3fa641c 100644
--- a/tests/qtest/virtio-net-failover.c
-+++ b/tests/qtest/virtio-net-failover.c
-@@ -25,6 +25,7 @@
- #define PCI_SEL_BASE            0x0010
- 
- #define BASE_MACHINE "-M q35 -nodefaults " \
-+    "-global ICH9-LPC.acpi-pci-hotplug-with-bridge-support=on " \
-     "-device pcie-root-port,id=root0,addr=0x1,bus=pcie.0,chassis=1 " \
-     "-device pcie-root-port,id=root1,addr=0x2,bus=pcie.0,chassis=2 "
- 
-- 
-2.31.1
-
--- a/SOURCES/0012-Enable-make-check.patch
+++ b/SOURCES/0012-Enable-make-check.patch
@ -0,0 +1,407 @@
+From 740a2dd943a2e0fcd41a9cd8eb94a136f8f49fa2 Mon Sep 17 00:00:00 2001
+From: Miroslav Rezanina <mrezanin@redhat.com>
+Date: Wed, 2 Sep 2020 09:39:41 +0200
+Subject: Enable make check
+
+Fixing tests after device disabling and machine types changes and enabling
+make check run during build.
+
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+
+Rebase changes (4.0.0):
+- Remove testing for pseries-2.7 in endianess test
+- Disable device-plug-test on s390x as it use disabled device
+- Do not run cpu-plug-tests on 7.3 and older machine types
+
+Rebase changes (4.1.0-rc0):
+- removed iotests 068
+
+Rebase changes (4.1.0-rc1):
+- remove all 205 tests (unstable)
+
+Rebase changes (4.2.0-rc0):
+- partially disable hd-geo-test (requires lsi53c895a)
+
+Rebase changes (5.1.0-rc1):
+- Disable qtest/q35-test (uses upstream machine types)
+- Do not run iotests on make checka
+- Enabled iotests 071 and 099
+
+Rebase changes (5.2.0 rc0):
+- Disable cdrom tests (unsupported devices) on x86_64
+- disable fuzz test
+
+Rebase changes (6.0.0):
+- Disabled xlnx-can-test
+- Disable pxb-pcie subtest for bios-table-test
+- Replace qtest usage of upstream q35 machine type with pc-q35-rhel8.4.0
+- Not run cdrom-test on aarch64
+
+Rebase changes (6.1.0):
+- Remove unnecessary test disabling changes
+
+Rebase changes (weekly-211006):
+- New handling for bios-table-test (disabled downstream)
+
+Merged patches (4.0.0):
+- f7ffd13 Remove 7 qcow2 and luks iotests that are taking > 25 sec to run during the fast train build proce
+
+Merged patches (4.1.0-rc0):
+- 41288ff redhat: Remove raw iotest 205
+---
+ redhat/qemu-kvm.spec.template       |  2 +-
+ tests/qemu-iotests/051              |  8 ++++----
+ tests/qtest/bios-tables-test.c      |  5 ++++-
+ tests/qtest/boot-serial-test.c      |  6 +++++-
+ tests/qtest/cdrom-test.c            |  4 ++++
+ tests/qtest/cpu-plug-test.c         |  4 ++--
+ tests/qtest/fuzz-e1000e-test.c      |  2 +-
+ tests/qtest/fuzz-virtio-scsi-test.c |  2 +-
+ tests/qtest/hd-geo-test.c           |  4 ++++
+ tests/qtest/lpc-ich9-test.c         |  2 +-
+ tests/qtest/meson.build             | 13 ++++---------
+ tests/qtest/prom-env-test.c         |  4 ++++
+ tests/qtest/test-x86-cpuid-compat.c |  2 ++
+ tests/qtest/usb-hcd-xhci-test.c     |  4 ++++
+ 14 files changed, 41 insertions(+), 21 deletions(-)
+
+diff --git a/tests/qemu-iotests/051 b/tests/qemu-iotests/051
+index 1d2fa93a11..c8a2815f54 100755
+--- a/tests/qemu-iotests/051
+++ b/tests/qemu-iotests/051
+@@ -174,9 +174,9 @@ run_qemu -drive if=virtio
+ case "$QEMU_DEFAULT_MACHINE" in
+     pc)
+         run_qemu -drive if=none,id=disk -device ide-cd,drive=disk
+-        run_qemu -drive if=none,id=disk -device lsi53c895a -device scsi-cd,drive=disk
+#        run_qemu -drive if=none,id=disk -device lsi53c895a -device scsi-cd,drive=disk
+         run_qemu -drive if=none,id=disk -device ide-hd,drive=disk
+-        run_qemu -drive if=none,id=disk -device lsi53c895a -device scsi-hd,drive=disk
+#        run_qemu -drive if=none,id=disk -device lsi53c895a -device scsi-hd,drive=disk
+         ;;
+      *)
+         ;;
+@@ -225,9 +225,9 @@ run_qemu -drive file="$TEST_IMG",if=virtio,readonly=on
+ case "$QEMU_DEFAULT_MACHINE" in
+     pc)
+         run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device ide-cd,drive=disk
+-        run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device lsi53c895a -device scsi-cd,drive=disk
+#        run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device lsi53c895a -device scsi-cd,drive=disk
+         run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device ide-hd,drive=disk
+-        run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device lsi53c895a -device scsi-hd,drive=disk
+#        run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device lsi53c895a -device scsi-hd,drive=disk
+         ;;
+      *)
+         ;;
+diff --git a/tests/qtest/bios-tables-test.c b/tests/qtest/bios-tables-test.c
+index 258874167e..16d8304cde 100644
+--- a/tests/qtest/bios-tables-test.c
+++ b/tests/qtest/bios-tables-test.c
+@@ -1372,6 +1372,7 @@ static void test_acpi_virt_tcg_numamem(void)
+ 
+ }
+ 
+#if 0 /* Disabled for Red Hat Enterprise Linux */
+ static void test_acpi_virt_tcg_pxb(void)
+ {
+     test_data data = {
+@@ -1403,6 +1404,7 @@ static void test_acpi_virt_tcg_pxb(void)
+ 
+     free_test_data(&data);
+ }
+#endif
+ 
+ static void test_acpi_tcg_acpi_hmat(const char *machine)
+ {
+@@ -1644,7 +1646,8 @@ int main(int argc, char *argv[])
+             qtest_add_func("acpi/virt", test_acpi_virt_tcg);
+             qtest_add_func("acpi/virt/numamem", test_acpi_virt_tcg_numamem);
+             qtest_add_func("acpi/virt/memhp", test_acpi_virt_tcg_memhp);
+-            qtest_add_func("acpi/virt/pxb", test_acpi_virt_tcg_pxb);
+            /* Disabled for Red Hat Enterprise Linux
+            qtest_add_func("acpi/virt/pxb", test_acpi_virt_tcg_pxb); */
+             qtest_add_func("acpi/virt/oem-fields", test_acpi_oem_fields_virt);
+         }
+     }
+diff --git a/tests/qtest/boot-serial-test.c b/tests/qtest/boot-serial-test.c
+index 83828ba270..294476b959 100644
+--- a/tests/qtest/boot-serial-test.c
+++ b/tests/qtest/boot-serial-test.c
+@@ -148,19 +148,23 @@ static testdef_t tests[] = {
+     { "ppc", "g3beige", "", "PowerPC,750" },
+     { "ppc", "mac99", "", "PowerPC,G4" },
+     { "ppc", "sam460ex", "-m 256", "DRAM:  256 MiB" },
+#if 0 /* Disabled for Red Hat Enterprise Linux */
+     { "ppc64", "ppce500", "", "U-Boot" },
+     { "ppc64", "40p", "-m 192", "Memory: 192M" },
+     { "ppc64", "mac99", "", "PowerPC,970FX" },
+#endif
+     { "ppc64", "pseries",
+       "-machine " PSERIES_DEFAULT_CAPABILITIES,
+       "Open Firmware" },
+#if 0 /* Disabled for Red Hat Enterprise Linux */
+     { "ppc64", "powernv8", "", "OPAL" },
+     { "ppc64", "powernv9", "", "OPAL" },
+     { "ppc64", "sam460ex", "-device e1000", "8086  100e" },
+#endif
+     { "i386", "isapc", "-cpu qemu32 -device sga", "SGABIOS" },
+     { "i386", "pc", "-device sga", "SGABIOS" },
+     { "i386", "q35", "-device sga", "SGABIOS" },
+-    { "x86_64", "isapc", "-cpu qemu32 -device sga", "SGABIOS" },
+    { "x86_64", "pc", "-cpu qemu32 -device sga", "SGABIOS" },
+     { "x86_64", "q35", "-device sga", "SGABIOS" },
+     { "sparc", "LX", "", "TMS390S10" },
+     { "sparc", "SS-4", "", "MB86904" },
+diff --git a/tests/qtest/cdrom-test.c b/tests/qtest/cdrom-test.c
+index 5af944a5fb..69d9bac38a 100644
+--- a/tests/qtest/cdrom-test.c
+++ b/tests/qtest/cdrom-test.c
+@@ -140,6 +140,7 @@ static void add_x86_tests(void)
+         qtest_add_data_func("cdrom/boot/isapc", "-M isapc "
+                             "-drive if=ide,media=cdrom,file=", test_cdboot);
+     }
+#if 0  /* Disabled for Red Hat Enterprise Linux */
+     qtest_add_data_func("cdrom/boot/am53c974",
+                         "-device am53c974 -device scsi-cd,drive=cd1 "
+                         "-drive if=none,id=cd1,format=raw,file=", test_cdboot);
+@@ -155,6 +156,7 @@ static void add_x86_tests(void)
+     qtest_add_data_func("cdrom/boot/megasas-gen2", "-M q35 "
+                         "-device megasas-gen2 -device scsi-cd,drive=cd1 "
+                         "-blockdev file,node-name=cd1,filename=", test_cdboot);
+#endif
+ }
+ 
+ static void add_s390x_tests(void)
+@@ -220,6 +222,7 @@ int main(int argc, char **argv)
+             "magnum", "malta", "pica61", NULL
+         };
+         add_cdrom_param_tests(mips64machines);
+#if 0 /* Disabled for Red Hat Enterprise Linux */
+     } else if (g_str_equal(arch, "arm") || g_str_equal(arch, "aarch64")) {
+         const char *armmachines[] = {
+             "realview-eb", "realview-eb-mpcore", "realview-pb-a8",
+@@ -227,6 +230,7 @@ int main(int argc, char **argv)
+             "vexpress-a9", "virt", NULL
+         };
+         add_cdrom_param_tests(armmachines);
+#endif
+     } else {
+         const char *nonemachine[] = { "none", NULL };
+         add_cdrom_param_tests(nonemachine);
+diff --git a/tests/qtest/cpu-plug-test.c b/tests/qtest/cpu-plug-test.c
+index a1c689414b..a8f076711c 100644
+--- a/tests/qtest/cpu-plug-test.c
+++ b/tests/qtest/cpu-plug-test.c
+@@ -110,8 +110,8 @@ static void add_pseries_test_case(const char *mname)
+     char *path;
+     PlugTestData *data;
+ 
+-    if (!g_str_has_prefix(mname, "pseries-") ||
+-        (g_str_has_prefix(mname, "pseries-2.") && atoi(&mname[10]) < 7)) {
+    if (!g_str_has_prefix(mname, "pseries-rhel") ||
+        (g_str_has_prefix(mname, "pseries-rhel7.") && atoi(&mname[14]) < 4)) {
+         return;
+     }
+     data = g_new(PlugTestData, 1);
+diff --git a/tests/qtest/fuzz-e1000e-test.c b/tests/qtest/fuzz-e1000e-test.c
+index 66229e6096..947fba73b7 100644
+--- a/tests/qtest/fuzz-e1000e-test.c
+++ b/tests/qtest/fuzz-e1000e-test.c
+@@ -17,7 +17,7 @@ static void test_lp1879531_eth_get_rss_ex_dst_addr(void)
+ {
+     QTestState *s;
+ 
+-    s = qtest_init("-nographic -monitor none -serial none -M pc-q35-5.0");
+    s = qtest_init("-nographic -monitor none -serial none -M pc-q35-rhel8.4.0");
+ 
+     qtest_outl(s, 0xcf8, 0x80001010);
+     qtest_outl(s, 0xcfc, 0xe1020000);
+diff --git a/tests/qtest/fuzz-virtio-scsi-test.c b/tests/qtest/fuzz-virtio-scsi-test.c
+index aaf6d10e18..43727d62ac 100644
+--- a/tests/qtest/fuzz-virtio-scsi-test.c
+++ b/tests/qtest/fuzz-virtio-scsi-test.c
+@@ -19,7 +19,7 @@ static void test_mmio_oob_from_memory_region_cache(void)
+ {
+     QTestState *s;
+ 
+-    s = qtest_init("-M pc-q35-5.2 -display none -m 512M "
+    s = qtest_init("-M pc-q35-rhel8.4.0 -display none -m 512M "
+                    "-device virtio-scsi,num_queues=8,addr=03.0 ");
+ 
+     qtest_outl(s, 0xcf8, 0x80001811);
+diff --git a/tests/qtest/hd-geo-test.c b/tests/qtest/hd-geo-test.c
+index 113126ae06..999ef2aace 100644
+--- a/tests/qtest/hd-geo-test.c
+++ b/tests/qtest/hd-geo-test.c
+@@ -737,6 +737,7 @@ static void test_override_ide(void)
+     test_override(args, expected);
+ }
+ 
+#if 0 /* Require lsi53c895a - not supported on RHEL */
+ static void test_override_scsi(void)
+ {
+     TestArgs *args = create_args();
+@@ -781,6 +782,7 @@ static void test_override_scsi_2_controllers(void)
+     add_scsi_disk(args, 3, 1, 0, 1, 2, 0, 1, 0);
+     test_override(args, expected);
+ }
+#endif
+ 
+ static void test_override_virtio_blk(void)
+ {
+@@ -960,9 +962,11 @@ int main(int argc, char **argv)
+     qtest_add_func("hd-geo/ide/device/user/chst", test_ide_device_user_chst);
+     if (have_qemu_img()) {
+         qtest_add_func("hd-geo/override/ide", test_override_ide);
+#if 0 /* Require lsi53c895a - not supported on RHEL */
+         qtest_add_func("hd-geo/override/scsi", test_override_scsi);
+         qtest_add_func("hd-geo/override/scsi_2_controllers",
+                        test_override_scsi_2_controllers);
+#endif
+         qtest_add_func("hd-geo/override/virtio_blk", test_override_virtio_blk);
+         qtest_add_func("hd-geo/override/zero_chs", test_override_zero_chs);
+         qtest_add_func("hd-geo/override/scsi_hot_unplug",
+diff --git a/tests/qtest/lpc-ich9-test.c b/tests/qtest/lpc-ich9-test.c
+index fe0bef9980..7a9d51579b 100644
+--- a/tests/qtest/lpc-ich9-test.c
+++ b/tests/qtest/lpc-ich9-test.c
+@@ -15,7 +15,7 @@ static void test_lp1878642_pci_bus_get_irq_level_assert(void)
+ {
+     QTestState *s;
+ 
+-    s = qtest_init("-M pc-q35-5.0 "
+    s = qtest_init("-M pc-q35-rhel8.4.0 "
+                    "-nographic -monitor none -serial none");
+ 
+     qtest_outl(s, 0xcf8, 0x8000f840); /* PMBASE */
+diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
+index c9d8458062..049e06c057 100644
+--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
+@@ -68,7 +68,6 @@ qtests_i386 = \
+   (config_all_devices.has_key('CONFIG_RTL8139_PCI') ? ['rtl8139-test'] : []) +              \
+   (config_all_devices.has_key('CONFIG_E1000E_PCI_EXPRESS') ? ['fuzz-e1000e-test'] : []) +   \
+   (config_all_devices.has_key('CONFIG_ESP_PCI') ? ['am53c974-test'] : []) +                 \
+-  (unpack_edk2_blobs ? ['bios-tables-test'] : []) +                                         \
+   qtests_pci +                                                                              \
+   ['fdc-test',
+    'ide-test',
+@@ -81,7 +80,6 @@ qtests_i386 = \
+    'drive_del-test',
+    'tco-test',
+    'cpu-plug-test',
+-   'q35-test',
+    'vmgenid-test',
+    'migration-test',
+    'test-x86-cpuid-compat',
+@@ -130,17 +128,15 @@ qtests_mips64el = \
+ 
+ qtests_ppc = \
+   (config_all_devices.has_key('CONFIG_ISA_TESTDEV') ? ['endianness-test'] : []) +            \
+-  (config_all_devices.has_key('CONFIG_M48T59') ? ['m48t59-test'] : []) +                     \
+-  ['boot-order-test', 'prom-env-test', 'boot-serial-test']                 \
+  (config_all_devices.has_key('CONFIG_M48T59') ? ['m48t59-test'] : [])
+ 
+ qtests_ppc64 = \
+   (config_all_devices.has_key('CONFIG_PSERIES') ? ['device-plug-test'] : []) +               \
+   (config_all_devices.has_key('CONFIG_POWERNV') ? ['pnv-xscom-test'] : []) +                 \
+   (config_all_devices.has_key('CONFIG_PSERIES') ? ['rtas-test'] : []) +                      \
+-  (slirp.found() ? ['pxe-test', 'test-netfilter'] : []) +              \
+  (slirp.found() ? ['pxe-test'] : []) +              \
+   (config_all_devices.has_key('CONFIG_USB_UHCI') ? ['usb-hcd-uhci-test'] : []) +             \
+   (config_all_devices.has_key('CONFIG_USB_XHCI_NEC') ? ['usb-hcd-xhci-test'] : []) +         \
+-  (config_host.has_key('CONFIG_POSIX') ? ['test-filter-mirror'] : []) +                      \
+   qtests_pci + ['migration-test', 'numa-test', 'cpu-plug-test', 'drive_del-test']
+ 
+ qtests_sh4 = (config_all_devices.has_key('CONFIG_ISA_TESTDEV') ? ['endianness-test'] : [])
+@@ -186,8 +182,8 @@ qtests_aarch64 = \
+   ['arm-cpu-features',
+    'numa-test',
+    'boot-serial-test',
+-   'xlnx-can-test',
+-   'fuzz-xlnx-dp-test',
+#   'xlnx-can-test',
+#   'fuzz-xlnx-dp-test',
+    'migration-test']
+ 
+ qtests_s390x = \
+@@ -196,7 +192,6 @@ qtests_s390x = \
+   (config_host.has_key('CONFIG_POSIX') ? ['test-filter-redirector'] : []) +                     \
+   ['boot-serial-test',
+    'drive_del-test',
+-   'device-plug-test',
+    'virtio-ccw-test',
+    'cpu-plug-test',
+    'migration-test']
+diff --git a/tests/qtest/prom-env-test.c b/tests/qtest/prom-env-test.c
+index f41d80154a..f8dc478ce8 100644
+--- a/tests/qtest/prom-env-test.c
+++ b/tests/qtest/prom-env-test.c
+@@ -89,10 +89,14 @@ int main(int argc, char *argv[])
+     if (!strcmp(arch, "ppc")) {
+         add_tests(ppc_machines);
+     } else if (!strcmp(arch, "ppc64")) {
+#if 0 /* Disabled for Red Hat Enterprise Linux */
+         add_tests(ppc_machines);
+         if (g_test_slow()) {
+#endif
+             qtest_add_data_func("prom-env/pseries", "pseries", test_machine);
+#if 0 /* Disabled for Red Hat Enterprise Linux */
+         }
+#endif
+     } else if (!strcmp(arch, "sparc")) {
+         add_tests(sparc_machines);
+     } else if (!strcmp(arch, "sparc64")) {
+diff --git a/tests/qtest/test-x86-cpuid-compat.c b/tests/qtest/test-x86-cpuid-compat.c
+index f28848e06e..6b2fd398a2 100644
+--- a/tests/qtest/test-x86-cpuid-compat.c
+++ b/tests/qtest/test-x86-cpuid-compat.c
+@@ -300,6 +300,7 @@ int main(int argc, char **argv)
+                    "-cpu 486,xlevel2=0xC0000002,xstore=on",
+                    "xlevel2", 0xC0000002);
+ 
+#if 0 /* Disabled in Red Hat Enterprise Linux */
+     /* Check compatibility of old machine-types that didn't
+      * auto-increase level/xlevel/xlevel2: */
+ 
+@@ -350,6 +351,7 @@ int main(int argc, char **argv)
+     add_cpuid_test("x86/cpuid/xlevel-compat/pc-i440fx-2.4/npt-on",
+                    "-machine pc-i440fx-2.4 -cpu SandyBridge,svm=on,npt=on",
+                    "xlevel", 0x80000008);
+#endif
+ 
+     /* Test feature parsing */
+     add_feature_test("x86/cpuid/features/plus",
+diff --git a/tests/qtest/usb-hcd-xhci-test.c b/tests/qtest/usb-hcd-xhci-test.c
+index 10ef9d2a91..3855873050 100644
+--- a/tests/qtest/usb-hcd-xhci-test.c
+++ b/tests/qtest/usb-hcd-xhci-test.c
+@@ -21,6 +21,7 @@ static void test_xhci_hotplug(void)
+     usb_test_hotplug(global_qtest, "xhci", "1", NULL);
+ }
+ 
+#if 0 /* Disabled for Red Hat Enterprise Linux */
+ static void test_usb_uas_hotplug(void)
+ {
+     QTestState *qts = global_qtest;
+@@ -36,6 +37,7 @@ static void test_usb_uas_hotplug(void)
+     qtest_qmp_device_del(qts, "scsihd");
+     qtest_qmp_device_del(qts, "uas");
+ }
+#endif
+ 
+ static void test_usb_ccid_hotplug(void)
+ {
+@@ -56,7 +58,9 @@ int main(int argc, char **argv)
+ 
+     qtest_add_func("/xhci/pci/init", test_xhci_init);
+     qtest_add_func("/xhci/pci/hotplug", test_xhci_hotplug);
+#if 0 /* Disabled for Red Hat Enterprise Linux */
+     qtest_add_func("/xhci/pci/hotplug/usb-uas", test_usb_uas_hotplug);
+#endif
+     qtest_add_func("/xhci/pci/hotplug/usb-ccid", test_usb_ccid_hotplug);
+ 
+     qtest_start("-device nec-usb-xhci,id=xhci"
+-- 
+2.27.0
+
--- a/SOURCES/0013-vfio-cap-number-of-devices-that-can-be-assigned.patch
+++ b/SOURCES/0013-vfio-cap-number-of-devices-that-can-be-assigned.patch
@ -1,4 +1,4 @@
-From 0804844e4755377be6d2ebad578794ad9f4f3f31 Mon Sep 17 00:00:00 2001
+From e9ebc159a9acf108e1ec6f622be3f256cf14aba7 Mon Sep 17 00:00:00 2001
 From: Bandan Das <bsd@redhat.com>
 Date: Tue, 3 Dec 2013 20:05:13 +0100
 Subject: vfio: cap number of devices that can be assigned
@ -22,30 +22,36 @@ for other uses. Stepping down a bit, the number 32 arbitrarily
 matches the number of slots on a PCI bus and is also a nice power
 of two.

-Count of slots increased to 509 later so we could increase limit
-to 64 as some usecases require more than 32 devices.
-
 Signed-off-by: Bandan Das <bsd@redhat.com>
+
+Rebase notes (2.8.0):
+- removed return value for vfio_realize (commit 1a22aca)
+
+Merged patches (2.9.0):
+- 17eb774 vfio: Use error_setg when reporting max assigned device overshoot
+
+ Merged patches (4.1.0-rc3):
+- 2b89558 vfio: increase the cap on number of assigned devices to 64
 ---
 hw/vfio/pci.c | 29 ++++++++++++++++++++++++++++-
 hw/vfio/pci.h |  1 +
 2 files changed, 29 insertions(+), 1 deletion(-)

 diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
-index 939dcc3d4a..acbc6673ce 100644
+index 7b45353ce2..eb725a3aee 100644
 --- a/hw/vfio/pci.c
 +++ b/hw/vfio/pci.c
-@@ -48,6 +48,9 @@
- /* Protected by BQL */
- static KVMRouteChange vfio_route_change;
+@@ -45,6 +45,9 @@
+ 
+ #define TYPE_VFIO_PCI_NOHOTPLUG "vfio-pci-nohotplug"
 
 +/* RHEL only: Set once for the first assigned dev */
 +static uint16_t device_limit;
 +
 static void vfio_disable_interrupts(VFIOPCIDevice *vdev);
 static void vfio_mmap_set_enabled(VFIOPCIDevice *vdev, bool enabled);
- static void vfio_msi_disable_common(VFIOPCIDevice *vdev);
-@@ -2854,9 +2857,30 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
+ 
+@@ -2807,9 +2810,30 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
     ssize_t len;
     struct stat st;
     int groupid;
@ -74,10 +80,10 @@ index 939dcc3d4a..acbc6673ce 100644
 +        return;
 +    }
 +
-     if (!vbasedev->sysfsdev) {
+     if (!vdev->vbasedev.sysfsdev) {
         if (!(~vdev->host.domain || ~vdev->host.bus ||
               ~vdev->host.slot || ~vdev->host.function)) {
-@@ -3293,6 +3317,9 @@ static Property vfio_pci_dev_properties[] = {
+@@ -3246,6 +3270,9 @@ static Property vfio_pci_dev_properties[] = {
     DEFINE_PROP_BOOL("x-no-kvm-msix", VFIOPCIDevice, no_kvm_msix, false),
     DEFINE_PROP_BOOL("x-no-geforce-quirks", VFIOPCIDevice,
                      no_geforce_quirks, false),
@ -88,10 +94,10 @@ index 939dcc3d4a..acbc6673ce 100644
                      false),
     DEFINE_PROP_BOOL("x-no-vfio-ioeventfd", VFIOPCIDevice, no_vfio_ioeventfd,
 diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
-index 7c236a52f4..7b7d036a8f 100644
+index 64777516d1..e0fe6ca97e 100644
 --- a/hw/vfio/pci.h
 +++ b/hw/vfio/pci.h
-@@ -140,6 +140,7 @@ struct VFIOPCIDevice {
+@@ -139,6 +139,7 @@ struct VFIOPCIDevice {
     EventNotifier err_notifier;
     EventNotifier req_notifier;
     int (*resetfn)(struct VFIOPCIDevice *);
@ -100,5 +106,5 @@ index 7c236a52f4..7b7d036a8f 100644
     uint32_t device_id;
     uint32_t sub_vendor_id;
 -- 
-2.31.1
+2.27.0

--- a/SOURCES/0014-Add-support-statement-to-help-output.patch
+++ b/SOURCES/0014-Add-support-statement-to-help-output.patch
@ -1,4 +1,4 @@
-From 283a0e258dc2f3b83c58e6f948bafe430cd2c1d5 Mon Sep 17 00:00:00 2001
+From b736b0c41dd62ed6f874a7b33ca1d4f9ceab4573 Mon Sep 17 00:00:00 2001
 From: Eduardo Habkost <ehabkost@redhat.com>
 Date: Wed, 4 Dec 2013 18:53:17 +0100
 Subject: Add support statement to -help output
@ -21,10 +21,10 @@ Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
 1 file changed, 9 insertions(+)

 diff --git a/softmmu/vl.c b/softmmu/vl.c
-index 5115221efe..17188df528 100644
+index 620a1f1367..d46b8fb4ab 100644
 --- a/softmmu/vl.c
 +++ b/softmmu/vl.c
-@@ -834,9 +834,17 @@ static void version(void)
+@@ -827,9 +827,17 @@ static void version(void)
            QEMU_COPYRIGHT "\n");
 }
 
@ -41,8 +41,8 @@ index 5115221efe..17188df528 100644
 +    print_rh_warning();
     printf("usage: %s [options] [disk_image]\n\n"
            "'disk_image' is a raw hard disk image for IDE hard disk 0\n\n",
-             g_get_prgname());
-@@ -862,6 +870,7 @@ static void help(int exitcode)
+             error_get_progname());
+@@ -855,6 +863,7 @@ static void help(int exitcode)
            "\n"
            QEMU_HELP_BOTTOM "\n");
 
@ -51,5 +51,5 @@ index 5115221efe..17188df528 100644
 }
 
 -- 
-2.31.1
+2.27.0

--- a/SOURCES/0014-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
+++ b/SOURCES/0014-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
@ -1,61 +0,0 @@
-From d8ded821aa698b3b03bd9089fbd6c2b33da87b9e Mon Sep 17 00:00:00 2001
-From: Miroslav Rezanina <mrezanin@redhat.com>
-Date: Wed, 8 Jul 2020 08:35:50 +0200
-Subject: Use qemu-kvm in documentation instead of qemu-system-<arch>
-
-Patchwork-id: 62380
-O-Subject: [RHEV-7.1 qemu-kvm-rhev PATCHv4] Use qemu-kvm in documentation instead of qemu-system-i386
-Bugzilla: 1140620
-RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
-RH-Acked-by: Markus Armbruster <armbru@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-
-From: Miroslav Rezanina <mrezanin@redhat.com>
-
-We change the name and location of qemu-kvm binaries. Update documentation
-to reflect this change. Only architectures available in RHEL are updated.
-
-Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
---
- docs/defs.rst.inc |  4 ++--
- qemu-options.hx   | 10 +++++-----
- 2 files changed, 7 insertions(+), 7 deletions(-)
-
-diff --git a/docs/defs.rst.inc b/docs/defs.rst.inc
-index 52d6454b93..d74dbdeca9 100644
--- a/docs/defs.rst.inc
-+++ b/docs/defs.rst.inc
-@@ -9,7 +9,7 @@
-    but the manpages will end up misrendered with following normal text
-    incorrectly in boldface.
- 
-.. |qemu_system| replace:: qemu-system-x86_64
-.. |qemu_system_x86| replace:: qemu-system-x86_64
-+.. |qemu_system| replace:: qemu-kvm
-+.. |qemu_system_x86| replace:: qemu-kvm
- .. |I2C| replace:: I\ :sup:`2`\ C
- .. |I2S| replace:: I\ :sup:`2`\ S
-diff --git a/qemu-options.hx b/qemu-options.hx
-index 7f99d15b23..ea02ca3a45 100644
--- a/qemu-options.hx
-+++ b/qemu-options.hx
-@@ -3300,11 +3300,11 @@ SRST
- 
-     ::
- 
-        qemu -m 512 -object memory-backend-file,id=mem,size=512M,mem-path=/hugetlbfs,share=on \
-             -numa node,memdev=mem \
-             -chardev socket,id=chr0,path=/path/to/socket \
-             -netdev type=vhost-user,id=net0,chardev=chr0 \
-             -device virtio-net-pci,netdev=net0
-+        qemu-kvm -m 512 -object memory-backend-file,id=mem,size=512M,mem-path=/hugetlbfs,share=on \
-+                 -numa node,memdev=mem \
-+                 -chardev socket,id=chr0,path=/path/to/socket \
-+                 -netdev type=vhost-user,id=net0,chardev=chr0 \
-+                 -device virtio-net-pci,netdev=net0
- 
- ``-netdev vhost-vdpa[,vhostdev=/path/to/dev][,vhostfd=h]``
-     Establish a vhost-vdpa netdev.
-- 
-2.31.1
-
--- a/SOURCES/0015-globally-limit-the-maximum-number-of-CPUs.patch
+++ b/SOURCES/0015-globally-limit-the-maximum-number-of-CPUs.patch
@ -0,0 +1,65 @@
+From 9a7621819821ee88d2f99d6b629fd87aa9a07758 Mon Sep 17 00:00:00 2001
+From: Andrew Jones <drjones@redhat.com>
+Date: Tue, 21 Jan 2014 10:46:52 +0100
+Subject: globally limit the maximum number of CPUs
+
+We now globally limit the number of VCPUs.
+Especially, there is no way one can specify more than
+max_cpus VCPUs for a VM.
+
+This allows us the restore the ppc max_cpus limitation to the upstream
+default and minimize the ppc hack in kvm-all.c.
+
+Signed-off-by: David Hildenbrand <david@redhat.com>
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+Signed-off-by: Danilo Cesar Lemes de Paula <ddepaula@redhat.com>
+
+Rebase notes (2.11.0):
+- Removed CONFIG_RHV reference
+- Update commit log
+
+Merged patches (2.11.0):
+- 92fef14623 redhat: remove manual max_cpus limitations for ppc
+- bb722e9eff redhat: globally limit the maximum number of CPUs
+- fdeef3c1c7 RHEL: Set vcpus hard limit to 240 for Power
+- 0584216921 Match POWER max cpus to x86
+
+Signed-off-by: Andrew Jones <drjones@redhat.com>
+
+Merged patches (5.1.0):
+- redhat: globally limit the maximum number of CPUs
+- redhat: remove manual max_cpus limitations for ppc
+- use recommended max vcpu count
+
+Merged patches (5.2.0 rc0):
+- f8a4123 vl: Remove downstream-only MAX_RHEL_CPUS code
+---
+ accel/kvm/kvm-all.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
+index eecd8031cf..8f2a53438f 100644
+--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
+@@ -2423,6 +2423,18 @@ static int kvm_init(MachineState *ms)
+     soft_vcpus_limit = kvm_recommended_vcpus(s);
+     hard_vcpus_limit = kvm_max_vcpus(s);
+ 
+#ifdef HOST_PPC64
+    /*
+     * On POWER, the kernel advertises a soft limit based on the
+     * number of CPU threads on the host.  We want to allow exceeding
+     * this for testing purposes, so we don't want to set hard limit
+     * to soft limit as on x86.
+     */
+#else
+    /* RHEL doesn't support nr_vcpus > soft_vcpus_limit */
+    hard_vcpus_limit = soft_vcpus_limit;
+#endif
+
+     while (nc->name) {
+         if (nc->num > soft_vcpus_limit) {
+             warn_report("Number of %s cpus requested (%d) exceeds "
+-- 
+2.27.0
+
--- a/SOURCES/0016-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
+++ b/SOURCES/0016-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
@ -0,0 +1,126 @@
+From 0d3fc0b4c5773c6cabb0a58c064475f76eb6ac1e Mon Sep 17 00:00:00 2001
+From: Miroslav Rezanina <mrezanin@redhat.com>
+Date: Wed, 8 Jul 2020 08:35:50 +0200
+Subject: Use qemu-kvm in documentation instead of qemu-system-<arch>
+
+Patchwork-id: 62380
+O-Subject: [RHEV-7.1 qemu-kvm-rhev PATCHv4] Use qemu-kvm in documentation instead of qemu-system-i386
+Bugzilla: 1140620
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Acked-by: Markus Armbruster <armbru@redhat.com>
+RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+
+From: Miroslav Rezanina <mrezanin@redhat.com>
+
+We change the name and location of qemu-kvm binaries. Update documentation
+to reflect this change. Only architectures available in RHEL are updated.
+
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+
+Rebase notes (5.1.0 rc0):
+ - qemu-block-drivers.texi converted to qemu-block-drivers.rst (upstream)
+
+Rebase notes (5.2.0 rc0):
+ - rewrite patch to new docs structure
+---
+ docs/defs.rst.inc              |  4 ++--
+ docs/tools/qemu-trace-stap.rst | 14 +++++++-------
+ qemu-options.hx                | 10 +++++-----
+ 3 files changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/docs/defs.rst.inc b/docs/defs.rst.inc
+index 52d6454b93..d74dbdeca9 100644
+--- a/docs/defs.rst.inc
+++ b/docs/defs.rst.inc
+@@ -9,7 +9,7 @@
+    but the manpages will end up misrendered with following normal text
+    incorrectly in boldface.
+ 
+-.. |qemu_system| replace:: qemu-system-x86_64
+-.. |qemu_system_x86| replace:: qemu-system-x86_64
+.. |qemu_system| replace:: qemu-kvm
+.. |qemu_system_x86| replace:: qemu-kvm
+ .. |I2C| replace:: I\ :sup:`2`\ C
+ .. |I2S| replace:: I\ :sup:`2`\ S
+diff --git a/docs/tools/qemu-trace-stap.rst b/docs/tools/qemu-trace-stap.rst
+index d53073b52b..9e93df084f 100644
+--- a/docs/tools/qemu-trace-stap.rst
+++ b/docs/tools/qemu-trace-stap.rst
+@@ -46,19 +46,19 @@ The following commands are valid:
+   any of the listed names. If no *PATTERN* is given, the all possible
+   probes will be listed.
+ 
+-  For example, to list all probes available in the ``qemu-system-x86_64``
+  For example, to list all probes available in the ``qemu-kvm``
+   binary:
+ 
+   ::
+ 
+-    $ qemu-trace-stap list qemu-system-x86_64
+    $ qemu-trace-stap list qemu-kvm
+ 
+   To filter the list to only cover probes related to QEMU's cryptographic
+   subsystem, in a binary outside ``$PATH``
+ 
+   ::
+ 
+-    $ qemu-trace-stap list /opt/qemu/4.0.0/bin/qemu-system-x86_64 'qcrypto*'
+    $ qemu-trace-stap list /opt/qemu/4.0.0/bin/qemu-kvm 'qcrypto*'
+ 
+ .. option:: run OPTIONS BINARY PATTERN...
+ 
+@@ -90,18 +90,18 @@ The following commands are valid:
+     Restrict the tracing session so that it only triggers for the process
+     identified by *PID*.
+ 
+-  For example, to monitor all processes executing ``qemu-system-x86_64``
+  For example, to monitor all processes executing ``qemu-kvm``
+   as found on ``$PATH``, displaying all I/O related probes:
+ 
+   ::
+ 
+-    $ qemu-trace-stap run qemu-system-x86_64 'qio*'
+    $ qemu-trace-stap run qemu-kvm 'qio*'
+ 
+   To monitor only the QEMU process with PID 1732
+ 
+   ::
+ 
+-    $ qemu-trace-stap run --pid=1732 qemu-system-x86_64 'qio*'
+    $ qemu-trace-stap run --pid=1732 qemu-kvm 'qio*'
+ 
+   To monitor QEMU processes running an alternative binary outside of
+   ``$PATH``, displaying verbose information about setup of the
+@@ -109,7 +109,7 @@ The following commands are valid:
+ 
+   ::
+ 
+-    $ qemu-trace-stap -v run /opt/qemu/4.0.0/qemu-system-x86_64 'qio*'
+    $ qemu-trace-stap -v run /opt/qemu/4.0.0/qemu-kvm 'qio*'
+ 
+ See also
+ --------
+diff --git a/qemu-options.hx b/qemu-options.hx
+index ae2c6dbbfc..94c4a8dbaf 100644
+--- a/qemu-options.hx
+++ b/qemu-options.hx
+@@ -3150,11 +3150,11 @@ SRST
+ 
+     ::
+ 
+-        qemu -m 512 -object memory-backend-file,id=mem,size=512M,mem-path=/hugetlbfs,share=on \
+-             -numa node,memdev=mem \
+-             -chardev socket,id=chr0,path=/path/to/socket \
+-             -netdev type=vhost-user,id=net0,chardev=chr0 \
+-             -device virtio-net-pci,netdev=net0
+        qemu-kvm -m 512 -object memory-backend-file,id=mem,size=512M,mem-path=/hugetlbfs,share=on \
+                 -numa node,memdev=mem \
+                 -chardev socket,id=chr0,path=/path/to/socket \
+                 -netdev type=vhost-user,id=net0,chardev=chr0 \
+                 -device virtio-net-pci,netdev=net0
+ 
+ ``-netdev vhost-vdpa,vhostdev=/path/to/dev``
+     Establish a vhost-vdpa netdev.
+-- 
+2.27.0
+
--- a/SOURCES/0016-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch
+++ b/SOURCES/0016-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch
@ -1,77 +0,0 @@
-From 02fde2a0cbd679ebd4104fe5522572c31ec23abd Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Fri, 20 Aug 2021 18:25:12 +0200
-Subject: qcow2: Deprecation warning when opening v2 images rw
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 37: qcow2: Deprecation warning when opening v2 images rw
-RH-Commit: [1/1] f450d0ae32d35063b28c72c4f2d2ebb9e6d8db3e (kmwolf/centos-qemu-kvm)
-RH-Bugzilla: 1951814
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Acked-by: Hanna Reitz <hreitz@redhat.com>
-RH-Acked-by: Thomas Huth <thuth@redhat.com>
-RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-
-qcow2 v3 has been around for a long time (since QEMU 1.1/RHEL 7), so
-there is no real reason any more to use it. People still using it might
-do so unintentionally. Warn about it and suggest upgrading during the
-RHEL 9 timeframe so that the code can possibly be disabled in RHEL 10.
-
-The warning is restricted to read-write mode and the system emulator.
-The primary motivation for not having it in qemu-img is that 'qemu-img
-amend' for upgrades would warn otherwise. It also avoids having to make
-too many changes to the test suite.
-
-bdrv_uses_whitelist() is used as a proxy for deciding whether we are
-running in a tool or the system emulator. This is not entirely clean,
-but it's what is available and the same function qcow2_do_open() already
-uses it this way for another warning.
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-
-patch_name: kvm-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch
-present_in_specfile: true
-location_in_specfile: 116
---
-Rebase notes (6.1.0):
- Replace bs->read_only with bdrv_is_read_only
---
- block/qcow2.c                    | 6 ++++++
- tests/qemu-iotests/common.filter | 1 +
- 2 files changed, 7 insertions(+)
-
-diff --git a/block/qcow2.c b/block/qcow2.c
-index 4d6666d3ff..d2ba263e9d 100644
--- a/block/qcow2.c
-+++ b/block/qcow2.c
-@@ -1336,6 +1336,12 @@ static int coroutine_fn qcow2_do_open(BlockDriverState *bs, QDict *options,
-         ret = -ENOTSUP;
-         goto fail;
-     }
-+    if (header.version < 3 && !bdrv_is_read_only(bs) && bdrv_uses_whitelist()) {
-+        warn_report_once("qcow2 v2 images are deprecated and may not be "
-+                         "supported in future versions. Please consider "
-+                         "upgrading the image with 'qemu-img amend "
-+                         "-o compat=v3'.");
-+    }
- 
-     s->qcow_version = header.version;
- 
-diff --git a/tests/qemu-iotests/common.filter b/tests/qemu-iotests/common.filter
-index cc9f1a5891..6a13757177 100644
--- a/tests/qemu-iotests/common.filter
-+++ b/tests/qemu-iotests/common.filter
-@@ -83,6 +83,7 @@ _filter_qemu()
- {
-     gsed -e "s#\\(^\\|(qemu) \\)$(basename $QEMU_PROG):#\1QEMU_PROG:#" \
-         -e 's#^QEMU [0-9]\+\.[0-9]\+\.[0-9]\+ monitor#QEMU X.Y.Z monitor#' \
-+        -e "/qcow2 v2 images are deprecated/d" \
-         -e $'s#\r##' # QEMU monitor uses \r\n line endings
- }
- 
-- 
-2.31.1
-
--- a/SOURCES/0017-virtio-scsi-Reject-scsi-cd-if-data-plane-enabled-RHE.patch
+++ b/SOURCES/0017-virtio-scsi-Reject-scsi-cd-if-data-plane-enabled-RHE.patch
@ -0,0 +1,66 @@
+From d95768c039a2bf6b68422f83a8d55dad41bd3181 Mon Sep 17 00:00:00 2001
+From: Fam Zheng <famz@redhat.com>
+Date: Wed, 14 Jun 2017 15:37:01 +0200
+Subject: virtio-scsi: Reject scsi-cd if data plane enabled [RHEL only]
+
+RH-Author: Fam Zheng <famz@redhat.com>
+Message-id: <20170614153701.14757-1-famz@redhat.com>
+Patchwork-id: 75613
+O-Subject: [RHV-7.4 qemu-kvm-rhev PATCH v3] virtio-scsi: Reject scsi-cd if data plane enabled [RHEL only]
+Bugzilla: 1378816
+RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+RH-Acked-by: Max Reitz <mreitz@redhat.com>
+
+We need a fix for RHEL 7.4 and 7.3.z, but unfortunately upstream isn't
+ready. If it were, the changes will be too invasive. To have an idea:
+
+https://lists.gnu.org/archive/html/qemu-devel/2017-05/msg05400.html
+
+is an incomplete attempt to fix part of the issue, and the remaining
+work unfortunately involve even more complex changes.
+
+As a band-aid, this partially reverts the effect of ef8875b
+(virtio-scsi: Remove op blocker for dataplane, since v2.7). We cannot
+simply revert that commit as a whole because we already shipped it in
+qemu-kvm-rhev 7.3, since when, block jobs has been possible.  We should
+only block what has been broken.  Also, faithfully reverting the above
+commit means adding back the removed op blocker, but that is not enough,
+because it still crashes when inserting media into an initially empty
+scsi-cd.
+
+All in all, scsi-cd on virtio-scsi-dataplane has basically been unusable
+unless the scsi-cd never enters an empty state, so, disable it
+altogether.  Otherwise it would be much more difficult to avoid
+crashing.
+
+Signed-off-by: Fam Zheng <famz@redhat.com>
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
+---
+ hw/scsi/virtio-scsi.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
+index 51fd09522a..a35257c35a 100644
+--- a/hw/scsi/virtio-scsi.c
+++ b/hw/scsi/virtio-scsi.c
+@@ -896,6 +896,15 @@ static void virtio_scsi_hotplug(HotplugHandler *hotplug_dev, DeviceState *dev,
+     AioContext *old_context;
+     int ret;
+ 
+    /* XXX: Remove this check once block backend is capable of handling
+     * AioContext change upon eject/insert.
+     * s->ctx is NULL if ioeventfd is off, s->ctx is qemu_get_aio_context() if
+     * data plane is not used, both cases are safe for scsi-cd. */
+    if (s->ctx && s->ctx != qemu_get_aio_context() &&
+        object_dynamic_cast(OBJECT(dev), "scsi-cd")) {
+        error_setg(errp, "scsi-cd is not supported by data plane");
+        return;
+    }
+     if (s->ctx && !s->dataplane_fenced) {
+         if (blk_op_is_blocked(sd->conf.blk, BLOCK_OP_TYPE_DATAPLANE, errp)) {
+             return;
+-- 
+2.27.0
+
--- a/SOURCES/0018-Addd-7.2-compat-bits-for-RHEL-9.1-machine-type.patch
+++ b/SOURCES/0018-Addd-7.2-compat-bits-for-RHEL-9.1-machine-type.patch
@ -1,26 +0,0 @@
-From 21ed34787b9492c2cfe3d8fc12a32748bcf02307 Mon Sep 17 00:00:00 2001
-From: Miroslav Rezanina <mrezanin@redhat.com>
-Date: Wed, 9 Nov 2022 07:08:32 -0500
-Subject: Addd 7.2 compat bits for RHEL 9.1 machine type
-
-Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
---
- hw/core/machine.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/hw/core/machine.c b/hw/core/machine.c
-index 9edec1ca05..3d851d34da 100644
--- a/hw/core/machine.c
-+++ b/hw/core/machine.c
-@@ -54,6 +54,8 @@ GlobalProperty hw_compat_rhel_9_1[] = {
-   { "arm-gicv3-common", "force-8-bit-prio", "on" },
-   /* hw_compat_rhel_9_1 from hw_compat_7_0 */
-   { "nvme-ns", "eui64-default", "on"},
-+  /* hw_compat_rhel_9_1 from hw_compat_7_1 */
-+  { "virtio-device", "queue_reset", "false" },
- };
- const size_t hw_compat_rhel_9_1_len = G_N_ELEMENTS(hw_compat_rhel_9_1);
- 
-- 
-2.31.1
-
--- a/SOURCES/0018-BZ1653590-Require-at-least-64kiB-pages-for-downstrea.patch
+++ b/SOURCES/0018-BZ1653590-Require-at-least-64kiB-pages-for-downstrea.patch
@ -1,4 +1,4 @@
-From 9c6acadb444c9300d7c18b6939ce4f96484aeacc Mon Sep 17 00:00:00 2001
+From 92bb62c47eab021f8dabecd09b5fbc1706e6a29c Mon Sep 17 00:00:00 2001
 From: David Gibson <dgibson@redhat.com>
 Date: Wed, 6 Feb 2019 03:58:56 +0000
 Subject: BZ1653590: Require at least 64kiB pages for downstream guests & hosts
@ -32,10 +32,10 @@ Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
 1 file changed, 7 insertions(+)

 diff --git a/hw/ppc/spapr_caps.c b/hw/ppc/spapr_caps.c
-index b4283055c1..59b88aadff 100644
+index ed7c077a0d..48a8efe678 100644
 --- a/hw/ppc/spapr_caps.c
 +++ b/hw/ppc/spapr_caps.c
-@@ -329,12 +329,19 @@ bool spapr_check_pagesize(SpaprMachineState *spapr, hwaddr pagesize,
+@@ -332,12 +332,19 @@ bool spapr_check_pagesize(SpaprMachineState *spapr, hwaddr pagesize,
 static void cap_hpt_maxpagesize_apply(SpaprMachineState *spapr,
                                       uint8_t val, Error **errp)
 {
@ -56,5 +56,5 @@ index b4283055c1..59b88aadff 100644
     spapr_check_pagesize(spapr, qemu_minrampagesize(), errp);
 }
 -- 
-2.31.1
+2.27.0

--- a/SOURCES/0019-compat-Update-hw_compat_rhel_8_5.patch
+++ b/SOURCES/0019-compat-Update-hw_compat_rhel_8_5.patch
@ -0,0 +1,53 @@
+From a9b5da617c29f48199cbea08d6a1c083877dce10 Mon Sep 17 00:00:00 2001
+From: Laurent Vivier <lvivier@redhat.com>
+Date: Mon, 15 Nov 2021 14:22:29 +0100
+Subject: compat: Update hw_compat_rhel_8_5
+
+RH-Author: Laurent Vivier <lvivier@redhat.com>
+RH-MergeRequest: 66: redhat: Update pseries-rhel8.5.0 machine type
+RH-Commit: [1/2] 232f2ad2b29d250fbdb8fcea9d814704c575ba2b
+RH-Bugzilla: 2022608
+RH-Acked-by: Eric Auger <eric.auger@redhat.com>
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Greg Kurz <gkurz@redhat.com>
+
+Add properties from hw_compat_6_1 as it already includes the ones from
+hw_compat_6_0. Add a lately added property from 6.0 too.
+
+Signed-off-by: Laurent Vivier <lvivier@redhat.com>
+--
+Rebase notes (6.2.0 rc3):
+- Included compatc changes introduced in RC2
+---
+ hw/core/machine.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/hw/core/machine.c b/hw/core/machine.c
+index 62febde5aa..736c765c30 100644
+--- a/hw/core/machine.c
+++ b/hw/core/machine.c
+@@ -38,7 +38,7 @@
+ #include "hw/virtio/virtio-pci.h"
+ 
+ /*
+- * Mostly the same as hw_compat_6_0
+ * Mostly the same as hw_compat_6_0 and hw_compat_6_1
+  */
+ GlobalProperty hw_compat_rhel_8_5[] = {
+     /* hw_compat_rhel_8_5 from hw_compat_6_0 */
+@@ -51,6 +51,12 @@ GlobalProperty hw_compat_rhel_8_5[] = {
+     { "e1000", "init-vet", "off" },
+     /* hw_compat_rhel_8_5 from hw_compat_6_0 */
+     { "e1000e", "init-vet", "off" },
+    /* hw_compat_rhel_8_5 from hw_compat_6_0 */
+    { "vhost-vsock-device", "seqpacket", "off" },
+    /* hw_compat_rhel_8_5 from hw_compat_6_1 */
+    { "vhost-user-vsock-device", "seqpacket", "off" },
+    /* hw_compat_rhel_8_5 from hw_compat_6_1 */
+    { "nvme-ns", "shared", "off" },
+ };
+ const size_t hw_compat_rhel_8_5_len = G_N_ELEMENTS(hw_compat_rhel_8_5);
+ 
+-- 
+2.27.0
+
--- a/SOURCES/0019-redhat-Update-s390x-machine-type-compatibility-for-Q.patch
+++ b/SOURCES/0019-redhat-Update-s390x-machine-type-compatibility-for-Q.patch
@ -1,47 +0,0 @@
-From 27c188c6a4cbd908269cf06affd24025708ecb5c Mon Sep 17 00:00:00 2001
-From: Thomas Huth <thuth@redhat.com>
-Date: Thu, 17 Nov 2022 16:47:16 +0100
-Subject: redhat: Update s390x machine type compatibility for QEMU 7.2.0 update
-
-Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2143585
-Upstream Status: n/a (rhel-only)
-
-Add the compatibility handling for the rebase from QEMU 7.1 to 7.2,
-i.e. the settings from ccw_machine_7_1_class_options() and
-ccw_machine_7_1_instance_options() to the rhel9.1.0 machine type
-(earlier settings have been added by previous rebases already).
-
-Signed-off-by: Thomas Huth <thuth@redhat.com>
---
- hw/s390x/s390-virtio-ccw.c | 9 +++++++++
- 1 file changed, 9 insertions(+)
-
-diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
-index ba640e3d9e..97e868ada0 100644
--- a/hw/s390x/s390-virtio-ccw.c
-+++ b/hw/s390x/s390-virtio-ccw.c
-@@ -1195,12 +1195,21 @@ static void ccw_machine_rhel900_instance_options(MachineState *machine)
-     static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V6_2 };
- 
-     s390_set_qemu_cpu_model(0x3906, 14, 2, qemu_cpu_feat);
-+    s390_cpudef_featoff_greater(16, 1, S390_FEAT_PAIE);
- }
- 
- static void ccw_machine_rhel900_class_options(MachineClass *mc)
- {
-+    S390CcwMachineClass *s390mc = S390_CCW_MACHINE_CLASS(mc);
-+    static GlobalProperty compat[] = {
-+        { TYPE_S390_PCI_DEVICE, "interpret", "off", },
-+        { TYPE_S390_PCI_DEVICE, "forwarding-assist", "off", },
-+    };
-+
-+    compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
-     compat_props_add(mc->compat_props, hw_compat_rhel_9_1, hw_compat_rhel_9_1_len);
-     compat_props_add(mc->compat_props, hw_compat_rhel_9_0, hw_compat_rhel_9_0_len);
-+    s390mc->max_threads = S390_MAX_CPUS;
- }
- DEFINE_CCW_MACHINE(rhel900, "rhel9.0.0", true);
- 
-- 
-2.31.1
-
--- a/SOURCES/0020-redhat-Update-pseries-rhel8.5.0-machine-type.patch
+++ b/SOURCES/0020-redhat-Update-pseries-rhel8.5.0-machine-type.patch
@ -0,0 +1,43 @@
+From 82358c35f04f026820b3907069a6c19cd95b654d Mon Sep 17 00:00:00 2001
+From: Laurent Vivier <lvivier@redhat.com>
+Date: Mon, 15 Nov 2021 14:25:33 +0100
+Subject: redhat: Update pseries-rhel8.5.0 machine type
+
+RH-Author: Laurent Vivier <lvivier@redhat.com>
+RH-MergeRequest: 66: redhat: Update pseries-rhel8.5.0 machine type
+RH-Commit: [2/2] 36f7ad1ea56baaaecb139875ad0a90a6470196be
+RH-Bugzilla: 2022608
+RH-Acked-by: Eric Auger <eric.auger@redhat.com>
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Greg Kurz <gkurz@redhat.com>
+`
+We don't introduce a new machine type for rhel8.6.0 but we need
+to keep compatibility with rhel8.5.0 machine type.
+
+Signed-off-by: Laurent Vivier <lvivier@redhat.com>
+---
+ hw/ppc/spapr.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
+index cace86028d..2f27888d8a 100644
+--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
+@@ -5177,10 +5177,14 @@ static void spapr_machine_rhel_default_class_options(MachineClass *mc)
+ 
+ static void spapr_machine_rhel850_class_options(MachineClass *mc)
+ {
+    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
+
+     /* The default machine type must apply the RHEL specific defaults */
+     spapr_machine_rhel_default_class_options(mc);
+     compat_props_add(mc->compat_props, hw_compat_rhel_8_5,
+                      hw_compat_rhel_8_5_len);
+    smc->pre_6_2_numa_affinity = true;
+    mc->smp_props.prefer_sockets = true;
+ }
+ 
+ DEFINE_SPAPR_MACHINE(rhel850, "rhel8.5.0", true);
+-- 
+2.27.0
+
--- a/SOURCES/0020-redhat-aarch64-add-rhel9.2.0-virt-machine-type.patch
+++ b/SOURCES/0020-redhat-aarch64-add-rhel9.2.0-virt-machine-type.patch
@ -1,43 +0,0 @@
-From c1a21266d8bed27f1ef1f705818fde5f9350b73f Mon Sep 17 00:00:00 2001
-From: Cornelia Huck <cohuck@redhat.com>
-Date: Wed, 23 Nov 2022 14:15:37 +0100
-Subject: redhat: aarch64: add rhel9.2.0 virt machine type
-
-Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2131982
-Upstream: RHEL only
-
-Signed-off-by: Cornelia Huck <cohuck@redhat.com>
---
- hw/arm/virt.c | 9 ++++++++-
- 1 file changed, 8 insertions(+), 1 deletion(-)
-
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index dfcab40a73..0a94f31dd1 100644
--- a/hw/arm/virt.c
-+++ b/hw/arm/virt.c
-@@ -3518,14 +3518,21 @@ static void rhel_machine_init(void)
- }
- type_init(rhel_machine_init);
- 
-+static void rhel920_virt_options(MachineClass *mc)
-+{
-+}
-+DEFINE_RHEL_MACHINE_AS_LATEST(9, 2, 0)
-+
- static void rhel900_virt_options(MachineClass *mc)
- {
-     VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
- 
-+    rhel920_virt_options(mc);
-+
-     compat_props_add(mc->compat_props, arm_rhel_compat, arm_rhel_compat_len);
-     compat_props_add(mc->compat_props, hw_compat_rhel_9_1, hw_compat_rhel_9_1_len);
- 
-     /* Disable FEAT_LPA2 since old kernels (<= v5.12) don't boot with that feature */
-     vmc->no_tcg_lpa2 = true;
- }
-DEFINE_RHEL_MACHINE_AS_LATEST(9, 0, 0)
-+DEFINE_RHEL_MACHINE(9, 0, 0)
-- 
-2.31.1
-
--- a/SOURCES/0021-redhat-Add-new-rhel-9.2.0-s390x-machine-type.patch
+++ b/SOURCES/0021-redhat-Add-new-rhel-9.2.0-s390x-machine-type.patch
@ -1,62 +0,0 @@
-From a932b8d4296066be01613ada84241b501488f99f Mon Sep 17 00:00:00 2001
-From: Thomas Huth <thuth@redhat.com>
-Date: Thu, 17 Nov 2022 17:03:24 +0100
-Subject: redhat: Add new rhel-9.2.0 s390x machine type
-
-Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2136473
-Upstream Status: n/a (rhel-only)
-
-RHEL 9.2 will be an EUS release - we want to have a new machine
-type here to make sure that we have a spot where we can wire up
-fixes later.
-
-Signed-off-by: Thomas Huth <thuth@redhat.com>
---
- hw/s390x/s390-virtio-ccw.c | 15 ++++++++++++++-
- 1 file changed, 14 insertions(+), 1 deletion(-)
-
-diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
-index 97e868ada0..aa142a1a4e 100644
--- a/hw/s390x/s390-virtio-ccw.c
-+++ b/hw/s390x/s390-virtio-ccw.c
-@@ -1190,10 +1190,21 @@ DEFINE_CCW_MACHINE(2_4, "2.4", false);
- #endif
- 
- 
-+static void ccw_machine_rhel920_instance_options(MachineState *machine)
-+{
-+}
-+
-+static void ccw_machine_rhel920_class_options(MachineClass *mc)
-+{
-+}
-+DEFINE_CCW_MACHINE(rhel920, "rhel9.2.0", true);
-+
- static void ccw_machine_rhel900_instance_options(MachineState *machine)
- {
-     static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V6_2 };
- 
-+    ccw_machine_rhel920_instance_options(machine);
-+
-     s390_set_qemu_cpu_model(0x3906, 14, 2, qemu_cpu_feat);
-     s390_cpudef_featoff_greater(16, 1, S390_FEAT_PAIE);
- }
-@@ -1206,12 +1217,14 @@ static void ccw_machine_rhel900_class_options(MachineClass *mc)
-         { TYPE_S390_PCI_DEVICE, "forwarding-assist", "off", },
-     };
- 
-+    ccw_machine_rhel920_class_options(mc);
-+
-     compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
-     compat_props_add(mc->compat_props, hw_compat_rhel_9_1, hw_compat_rhel_9_1_len);
-     compat_props_add(mc->compat_props, hw_compat_rhel_9_0, hw_compat_rhel_9_0_len);
-     s390mc->max_threads = S390_MAX_CPUS;
- }
-DEFINE_CCW_MACHINE(rhel900, "rhel9.0.0", true);
-+DEFINE_CCW_MACHINE(rhel900, "rhel9.0.0", false);
- 
- static void ccw_machine_rhel860_instance_options(MachineState *machine)
- {
-- 
-2.31.1
-
--- a/SOURCES/0021-redhat-virt-rhel8.5.0-Update-machine-type-compatibil.patch
+++ b/SOURCES/0021-redhat-virt-rhel8.5.0-Update-machine-type-compatibil.patch
@ -0,0 +1,51 @@
+From ce73e939b993cc6be170cdb5d3f2068270593f2b Mon Sep 17 00:00:00 2001
+From: Eric Auger <eric.auger@redhat.com>
+Date: Tue, 16 Nov 2021 17:03:07 +0100
+Subject: redhat: virt-rhel8.5.0: Update machine type compatibility for QEMU
+ 6.2.0 update
+
+RH-Author: Eric Auger <eric.auger@redhat.com>
+RH-MergeRequest: 75: redhat: virt-rhel8.5.0: Update machine type compatibility for QEMU 6.2.0 update
+RH-Commit: [21/21] f027d13654944e3d34e3356affe7af952eec2bed
+RH-Bugzilla: 2022607
+RH-Acked-by: Gavin Shan <gshan@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Acked-by: Andrew Jones <drjones@redhat.com>
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
+
+To keep compatibility with 8.5-AV machine type we need to
+turn few new options on by default:
+smp_props.prefer_sockets, no_cpu_topology, no_tcg_its
+
+TESTED: migrate from rhel-av-8.5.0 to rhel-8.6.0 and vice-versa
+with upstream fix: 33a0c404fb  hw/intc/arm_gicv3_its: Revert version
+increments in vmstate_its
+
+Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ hw/arm/virt.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/hw/arm/virt.c b/hw/arm/virt.c
+index c77d26ab13..e8941afd01 100644
+--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
+@@ -3225,8 +3225,13 @@ type_init(rhel_machine_init);
+ 
+ static void rhel850_virt_options(MachineClass *mc)
+ {
+    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
+
+     compat_props_add(mc->compat_props, arm_rhel_compat, arm_rhel_compat_len);
+     compat_props_add(mc->compat_props, hw_compat_rhel_8_5, hw_compat_rhel_8_5_len);
+    mc->smp_props.prefer_sockets = true;
+    vmc->no_cpu_topology = true;
+    vmc->no_tcg_its = true;
+ }
+ DEFINE_RHEL_MACHINE_AS_LATEST(8, 5, 0)
+ 
+-- 
+2.27.0
+
--- a/SOURCES/0022-Fix-virtio-net-pci-vectors-compat.patch
+++ b/SOURCES/0022-Fix-virtio-net-pci-vectors-compat.patch
@ -0,0 +1,45 @@
+From f9643b6934657292aae0b830627b1e5f9b8cbaa1 Mon Sep 17 00:00:00 2001
+From: Eduardo Habkost <ehabkost@redhat.com>
+Date: Tue, 19 Oct 2021 13:17:06 -0400
+Subject: Fix virtio-net-pci* "vectors" compat
+
+RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
+RH-MergeRequest: 77: 8.6/6.2 mt fixes
+RH-Commit: [21/23] 8ad581932275d2698a99f31bec40b14f1dbd3d2e
+RH-Bugzilla: 2026443
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+
+hw_compat_rhel_8_4 has an issue: it affects only "virtio-net-pci"
+but not "virtio-net-pci-transitional" and
+"virtio-net-pci-non-transitional".  The solution is to use the
+"virtio-net-pci-base" type in compat_props.
+
+An equivalent fix will be submitted for hw_compat_5_2 upstream.
+
+Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
+(cherry picked from commit d45823ab0d0138b2fbaf2ed1e1896d2052f3ccb3)
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ hw/core/machine.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/hw/core/machine.c b/hw/core/machine.c
+index 736c765c30..024b025fc2 100644
+--- a/hw/core/machine.c
+++ b/hw/core/machine.c
+@@ -71,7 +71,11 @@ GlobalProperty hw_compat_rhel_8_4[] = {
+     /* hw_compat_rhel_8_4 from hw_compat_5_2 */
+     { "virtio-blk-device", "report-discard-granularity", "off" },
+     /* hw_compat_rhel_8_4 from hw_compat_5_2 */
+-    { "virtio-net-pci", "vectors", "3"},
+    /*
+     * Upstream incorrectly had "virtio-net-pci" instead of "virtio-net-pci-base",
+     * (https://bugzilla.redhat.com/show_bug.cgi?id=1999141)
+     */
+    { "virtio-net-pci-base", "vectors", "3"},
+ };
+ const size_t hw_compat_rhel_8_4_len = G_N_ELEMENTS(hw_compat_rhel_8_4);
+ 
+-- 
+2.27.0
+
--- a/SOURCES/0022-x86-rhel-9.2.0-machine-type.patch
+++ b/SOURCES/0022-x86-rhel-9.2.0-machine-type.patch
@ -1,75 +0,0 @@
-From f33ca8aed4744238230f1f2cc47df77aa4c9e0ac Mon Sep 17 00:00:00 2001
-From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
-Date: Thu, 17 Nov 2022 12:36:30 +0000
-Subject: x86: rhel 9.2.0 machine type
-
-Add a 9.2.0 x86 machine type, and fix up the compatibility
-for 9.0.0 and older.
-
-pc_compat_7_1 and pc_compat_7_0 are both empty upstream so there's
-nothing to do there.
-
-Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
---
- hw/i386/pc_piix.c |  1 +
- hw/i386/pc_q35.c  | 21 ++++++++++++++++++++-
- 2 files changed, 21 insertions(+), 1 deletion(-)
-
-diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
-index 173a1fd10b..fc06877344 100644
--- a/hw/i386/pc_piix.c
-+++ b/hw/i386/pc_piix.c
-@@ -944,6 +944,7 @@ static void pc_machine_rhel760_options(MachineClass *m)
-     /* From pc_i440fx_5_1_machine_options() */
-     pcmc->pci_root_uid = 1;
-     pcmc->legacy_no_rng_seed = true;
-+    pcmc->enforce_amd_1tb_hole = false;
-     compat_props_add(m->compat_props, hw_compat_rhel_9_1,
-                      hw_compat_rhel_9_1_len);
-     compat_props_add(m->compat_props, hw_compat_rhel_9_0,
-diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
-index 97c3630021..52cfe3bf45 100644
--- a/hw/i386/pc_q35.c
-+++ b/hw/i386/pc_q35.c
-@@ -692,6 +692,23 @@ static void pc_q35_machine_rhel_options(MachineClass *m)
-     compat_props_add(m->compat_props, pc_rhel_compat, pc_rhel_compat_len);
- }
- 
-+static void pc_q35_init_rhel920(MachineState *machine)
-+{
-+    pc_q35_init(machine);
-+}
-+
-+static void pc_q35_machine_rhel920_options(MachineClass *m)
-+{
-+    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-+    pc_q35_machine_rhel_options(m);
-+    m->desc = "RHEL-9.2.0 PC (Q35 + ICH9, 2009)";
-+    pcmc->smbios_stream_product = "RHEL";
-+    pcmc->smbios_stream_version = "9.2.0";
-+}
-+
-+DEFINE_PC_MACHINE(q35_rhel920, "pc-q35-rhel9.2.0", pc_q35_init_rhel920,
-+                  pc_q35_machine_rhel920_options);
-+
- static void pc_q35_init_rhel900(MachineState *machine)
- {
-     pc_q35_init(machine);
-@@ -700,11 +717,13 @@ static void pc_q35_init_rhel900(MachineState *machine)
- static void pc_q35_machine_rhel900_options(MachineClass *m)
- {
-     PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-    pc_q35_machine_rhel_options(m);
-+    pc_q35_machine_rhel920_options(m);
-     m->desc = "RHEL-9.0.0 PC (Q35 + ICH9, 2009)";
-+    m->alias = NULL;
-     pcmc->smbios_stream_product = "RHEL";
-     pcmc->smbios_stream_version = "9.0.0";
-     pcmc->legacy_no_rng_seed = true;
-+    pcmc->enforce_amd_1tb_hole = false;
-     compat_props_add(m->compat_props, hw_compat_rhel_9_1,
-                      hw_compat_rhel_9_1_len);
-     compat_props_add(m->compat_props, hw_compat_rhel_9_0,
-- 
-2.31.1
-
--- a/SOURCES/0023-x86-rhel-machine-types-Add-pc_rhel_8_5_compat.patch
+++ b/SOURCES/0023-x86-rhel-machine-types-Add-pc_rhel_8_5_compat.patch
@ -0,0 +1,73 @@
+From 7ad8814e583dcc7dc23e3e8398570243b8f176a1 Mon Sep 17 00:00:00 2001
+From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
+Date: Tue, 23 Nov 2021 17:57:42 +0000
+Subject: x86/rhel machine types: Add pc_rhel_8_5_compat
+
+RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
+RH-MergeRequest: 77: 8.6/6.2 mt fixes
+RH-Commit: [22/23] 8bf555c5d78f344b97ffd5c888c7a7bed592d9d0
+RH-Bugzilla: 2026443
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+
+Add pc_rhel_8_5_compat as the merge of pc_compat_6_1 and pc_compat_6_0
+(since 8.5 was based on 6.0).
+
+Note, x-keep-pci-slot-hpc flipped back and forward, leaving it out
+looks like it leaves us with the original.
+
+Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ hw/i386/pc.c         | 21 +++++++++++++++++++++
+ include/hw/i386/pc.h |  3 +++
+ 2 files changed, 24 insertions(+)
+
+diff --git a/hw/i386/pc.c b/hw/i386/pc.c
+index e8109954ca..4c08a1971c 100644
+--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
+@@ -387,6 +387,27 @@ GlobalProperty pc_rhel_compat[] = {
+ };
+ const size_t pc_rhel_compat_len = G_N_ELEMENTS(pc_rhel_compat);
+ 
+GlobalProperty pc_rhel_8_5_compat[] = {
+    /* pc_rhel_8_5_compat from pc_compat_6_0 */
+    { "qemu64" "-" TYPE_X86_CPU, "family", "6" },
+    /* pc_rhel_8_5_compat from pc_compat_6_0 */
+    { "qemu64" "-" TYPE_X86_CPU, "model", "6" },
+    /* pc_rhel_8_5_compat from pc_compat_6_0 */
+    { "qemu64" "-" TYPE_X86_CPU, "stepping", "3" },
+    /* pc_rhel_8_5_compat from pc_compat_6_0 */
+    { TYPE_X86_CPU, "x-vendor-cpuid-only", "off" },
+    /* pc_rhel_8_5_compat from pc_compat_6_0 */
+    { "ICH9-LPC", ACPI_PM_PROP_ACPI_PCIHP_BRIDGE, "off" },
+
+    /* pc_rhel_8_5_compat from pc_compat_6_1 */
+    { TYPE_X86_CPU, "hv-version-id-build", "0x1bbc" },
+    /* pc_rhel_8_5_compat from pc_compat_6_1 */
+    { TYPE_X86_CPU, "hv-version-id-major", "0x0006" },
+    /* pc_rhel_8_5_compat from pc_compat_6_1 */
+    { TYPE_X86_CPU, "hv-version-id-minor", "0x0001" },
+};
+const size_t pc_rhel_8_5_compat_len = G_N_ELEMENTS(pc_rhel_8_5_compat);
+
+ GlobalProperty pc_rhel_8_4_compat[] = {
+     /* pc_rhel_8_4_compat from pc_compat_5_2 */
+     { "ICH9-LPC", "x-smi-cpu-hotunplug", "off" },
+diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
+index d0544ee119..9e8bfb69f8 100644
+--- a/include/hw/i386/pc.h
+++ b/include/hw/i386/pc.h
+@@ -286,6 +286,9 @@ extern const size_t pc_compat_1_4_len;
+ extern GlobalProperty pc_rhel_compat[];
+ extern const size_t pc_rhel_compat_len;
+ 
+extern GlobalProperty pc_rhel_8_5_compat[];
+extern const size_t pc_rhel_8_5_compat_len;
+
+ extern GlobalProperty pc_rhel_8_4_compat[];
+ extern const size_t pc_rhel_8_4_compat_len;
+ 
+-- 
+2.27.0
+
--- a/SOURCES/0024-x86-rhel-machine-types-Wire-compat-into-q35-and-i440.patch
+++ b/SOURCES/0024-x86-rhel-machine-types-Wire-compat-into-q35-and-i440.patch
@ -0,0 +1,54 @@
+From 7bd99eebadfdbea6a76585b526e7cab1ee8b1fde Mon Sep 17 00:00:00 2001
+From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
+Date: Tue, 23 Nov 2021 18:07:49 +0000
+Subject: x86/rhel machine types: Wire compat into q35 and i440fx
+
+RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
+RH-MergeRequest: 77: 8.6/6.2 mt fixes
+RH-Commit: [23/23] fc3861aeccc943b434231193ef45ffbc0b3cf6c6
+RH-Bugzilla: 2026443
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+
+Wire the pc_rhel_8_5 compat data into both piix and q35
+to keep the existing machine types compatible.
+
+Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ hw/i386/pc_piix.c | 4 ++++
+ hw/i386/pc_q35.c  | 4 ++++
+ 2 files changed, 8 insertions(+)
+
+diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
+index 2885edffe9..37fab00733 100644
+--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
+@@ -1040,6 +1040,10 @@ static void pc_machine_rhel760_options(MachineClass *m)
+     pcmc->kvmclock_create_always = false;
+     /* From pc_i440fx_5_1_machine_options() */
+     pcmc->pci_root_uid = 1;
+    compat_props_add(m->compat_props, hw_compat_rhel_8_5,
+                     hw_compat_rhel_8_5_len);
+    compat_props_add(m->compat_props, pc_rhel_8_5_compat,
+                     pc_rhel_8_5_compat_len);
+     compat_props_add(m->compat_props, hw_compat_rhel_8_4,
+                      hw_compat_rhel_8_4_len);
+     compat_props_add(m->compat_props, pc_rhel_8_4_compat,
+diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
+index c67418b6a9..78876e1101 100644
+--- a/hw/i386/pc_q35.c
+++ b/hw/i386/pc_q35.c
+@@ -658,6 +658,10 @@ static void pc_q35_machine_rhel850_options(MachineClass *m)
+     m->desc = "RHEL-8.5.0 PC (Q35 + ICH9, 2009)";
+     pcmc->smbios_stream_product = "RHEL-AV";
+     pcmc->smbios_stream_version = "8.5.0";
+    compat_props_add(m->compat_props, hw_compat_rhel_8_5,
+                     hw_compat_rhel_8_5_len);
+    compat_props_add(m->compat_props, pc_rhel_8_5_compat,
+                     pc_rhel_8_5_compat_len);
+ }
+ 
+ DEFINE_PC_MACHINE(q35_rhel850, "pc-q35-rhel8.5.0", pc_q35_init_rhel850,
+-- 
+2.27.0
+
--- a/SOURCES/0025-redhat-Add-s390x-machine-type-compatibility-handling.patch
+++ b/SOURCES/0025-redhat-Add-s390x-machine-type-compatibility-handling.patch
@ -0,0 +1,58 @@
+From 265a57f2955b7f0b65e3f57f89aa1ff2541d3f73 Mon Sep 17 00:00:00 2001
+From: Thomas Huth <thuth@redhat.com>
+Date: Fri, 26 Nov 2021 09:37:11 +0100
+Subject: redhat: Add s390x machine type compatibility handling for the rebase
+ to v6.2
+
+RH-Author: Thomas Huth <thuth@redhat.com>
+RH-MergeRequest: 80: Add s390x machine type compatibility handling for the rebase to v6.2
+RH-Commit: [26/26] c45cf594604f6dd23954696b9c84d2025e328d11
+RH-Bugzilla: 2022602
+RH-Acked-by: David Hildenbrand <david@redhat.com>
+RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+
+Add compatibility handling for the rhel8.5.0 machine type (and
+recursively older, of course).
+
+Based on the following upstream commits:
+
+ 463e50da8b - s390x/cpumodel: Bump up QEMU model to a stripped-down IBM z14 GA2
+ 30e398f796 - s390x/cpumodel: Add more feature to gen16 default model
+ 4a0af2930a - machine: Prefer cores over sockets in smp parsing since 6.2
+ 2b52619994 - machine: Move smp_prefer_sockets to struct SMPCompatProps
+
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+---
+ hw/s390x/s390-virtio-ccw.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
+index 181856e6cf..cf13c457d6 100644
+--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
+@@ -1105,11 +1105,21 @@ DEFINE_CCW_MACHINE(2_4, "2.4", false);
+ 
+ static void ccw_machine_rhel850_instance_options(MachineState *machine)
+ {
+    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V6_0 };
+
+    s390_set_qemu_cpu_model(0x2964, 13, 2, qemu_cpu_feat);
+
+    s390_cpudef_featoff_greater(16, 1, S390_FEAT_NNPA);
+    s390_cpudef_featoff_greater(16, 1, S390_FEAT_VECTOR_PACKED_DECIMAL_ENH2);
+    s390_cpudef_featoff_greater(16, 1, S390_FEAT_BEAR_ENH);
+    s390_cpudef_featoff_greater(16, 1, S390_FEAT_RDP);
+    s390_cpudef_featoff_greater(16, 1, S390_FEAT_PAI);
+ }
+ 
+ static void ccw_machine_rhel850_class_options(MachineClass *mc)
+ {
+     compat_props_add(mc->compat_props, hw_compat_rhel_8_5, hw_compat_rhel_8_5_len);
+    mc->smp_props.prefer_sockets = true;
+ }
+ DEFINE_CCW_MACHINE(rhel850, "rhel8.5.0", true);
+ 
+-- 
+2.27.0
+
--- a/SOURCES/81-kvm-rhel.rules
+++ b/SOURCES/81-kvm-rhel.rules
@ -0,0 +1 @@
+DEVPATH=="*/kvm", ACTION=="change", RUN+="/lib/udev/udev-kvm-check $env{COUNT} $env{EVENT}"
--- a/SOURCES/85-kvm.preset
+++ b/SOURCES/85-kvm.preset
@ -0,0 +1,5 @@
+# Enable kvm-setup by default.  This can have odd side effects on
+# PowerNV systems that aren't intended as KVM hosts, but at present we
+# only support RHEL on PowerNV for the purpose of being a RHEV host.
+
+enable kvm-setup.service
--- a/SOURCES/ksm.service
+++ b/SOURCES/ksm.service
@ -0,0 +1,13 @@
+[Unit]
+Description=Kernel Samepage Merging
+ConditionPathExists=/sys/kernel/mm/ksm
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+EnvironmentFile=-/etc/sysconfig/ksm
+ExecStart=/usr/libexec/ksmctl start
+ExecStop=/usr/libexec/ksmctl stop
+
+[Install]
+WantedBy=multi-user.target
--- a/SOURCES/ksm.sysconfig
+++ b/SOURCES/ksm.sysconfig
@ -0,0 +1,4 @@
+# The maximum number of unswappable kernel pages
+# which may be allocated by ksm (0 for unlimited)
+# If unset, defaults to half of total memory
+# KSM_MAX_KERNEL_PAGES=
--- a/SOURCES/ksmctl.c
+++ b/SOURCES/ksmctl.c
@ -0,0 +1,77 @@
+/* Start/stop KSM, for systemd.
+ * Copyright (C) 2009, 2011 Red Hat, Inc.
+ * Written by Paolo Bonzini <pbonzini@redhat.com>.
+ * Based on the original sysvinit script by Dan Kenigsberg <danken@redhat.com>
+ * This file is distributed under the GNU General Public License, version 2
+ * or later.  */
+
+#include <unistd.h>
+#include <stdio.h>
+#include <limits.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+
+#define KSM_MAX_KERNEL_PAGES_FILE "/sys/kernel/mm/ksm/max_kernel_pages"
+#define KSM_RUN_FILE		  "/sys/kernel/mm/ksm/run"
+
+char *program_name;
+
+int usage(void)
+{
+	fprintf(stderr, "Usage: %s {start|stop}\n", program_name);
+	return 1;
+}
+
+int write_value(uint64_t value, char *filename)
+{
+	FILE *fp;
+	if (!(fp = fopen(filename, "w")) ||
+	    fprintf(fp, "%llu\n", (unsigned long long) value) == EOF ||
+	    fflush(fp) == EOF ||
+	    fclose(fp) == EOF)
+		return 1;
+
+	return 0;
+}
+
+uint64_t ksm_max_kernel_pages()
+{
+	char *var = getenv("KSM_MAX_KERNEL_PAGES");
+	char *endptr;
+	uint64_t value;
+	if (var && *var) {
+		value = strtoll(var, &endptr, 0);
+		if (value < LLONG_MAX && !*endptr)
+			return value;
+	}
+	/* Unless KSM_MAX_KERNEL_PAGES is set, let KSM munch up to half of
+	 * total memory.  */
+	return sysconf(_SC_PHYS_PAGES) / 2;
+}
+
+int start(void)
+{
+	if (access(KSM_MAX_KERNEL_PAGES_FILE, R_OK) >= 0)
+		write_value(ksm_max_kernel_pages(), KSM_MAX_KERNEL_PAGES_FILE);
+	return write_value(1, KSM_RUN_FILE);
+}
+
+int stop(void)
+{
+	return write_value(0, KSM_RUN_FILE);
+}
+
+int main(int argc, char **argv)
+{
+	program_name = argv[0];
+	if (argc < 2) {
+		return usage();
+	} else if (!strcmp(argv[1], "start")) {
+		return start();
+	} else if (!strcmp(argv[1], "stop")) {
+		return stop();
+	} else {
+		return usage();
+	}
+}
--- a/SOURCES/ksmtuned
+++ b/SOURCES/ksmtuned
@ -0,0 +1,139 @@
+#!/bin/bash
+#
+# Copyright 2009 Red Hat, Inc. and/or its affiliates.
+# Released under the GPL
+#
+# Author:      Dan Kenigsberg <danken@redhat.com>
+#
+# ksmtuned - a simple script that controls whether (and with what vigor) ksm
+# should search for duplicated pages.
+#
+# starts ksm when memory commited to qemu processes exceeds a threshold, and
+# make ksm work harder and harder untill memory load falls below that
+# threshold.
+#
+# send SIGUSR1 to this process right after a new qemu process is started, or
+# following its death, to retune ksm accordingly
+#
+# needs testing and ironing. contact danken@redhat.com if something breaks.
+
+if [ -f /etc/ksmtuned.conf ]; then
+    . /etc/ksmtuned.conf
+fi
+
+debug() {
+    if [ -n "$DEBUG" ]; then
+        s="`/bin/date`: $*"
+        [ -n "$LOGFILE" ] && echo "$s" >> "$LOGFILE" || echo "$s"
+    fi
+}
+
+
+KSM_MONITOR_INTERVAL=${KSM_MONITOR_INTERVAL:-60}
+KSM_NPAGES_BOOST=${KSM_NPAGES_BOOST:-300}
+KSM_NPAGES_DECAY=${KSM_NPAGES_DECAY:--50}
+
+KSM_NPAGES_MIN=${KSM_NPAGES_MIN:-64}
+KSM_NPAGES_MAX=${KSM_NPAGES_MAX:-1250}
+# millisecond sleep between ksm scans for 16Gb server. Smaller servers sleep
+# more, bigger sleep less.
+KSM_SLEEP_MSEC=${KSM_SLEEP_MSEC:-10}
+
+KSM_THRES_COEF=${KSM_THRES_COEF:-20}
+KSM_THRES_CONST=${KSM_THRES_CONST:-2048}
+
+total=`awk '/^MemTotal:/ {print $2}' /proc/meminfo`
+debug total $total
+
+npages=0
+sleep=$[KSM_SLEEP_MSEC * 16 * 1024 * 1024 / total]
+[ $sleep -le 10 ] && sleep=10
+debug sleep $sleep
+thres=$[total * KSM_THRES_COEF / 100]
+if [ $KSM_THRES_CONST -gt $thres ]; then
+    thres=$KSM_THRES_CONST
+fi
+debug thres $thres
+
+KSMCTL () {
+    case x$1 in
+        xstop)
+            echo 0 > /sys/kernel/mm/ksm/run
+            ;;
+        xstart)
+            echo $2 > /sys/kernel/mm/ksm/pages_to_scan
+            echo $3 > /sys/kernel/mm/ksm/sleep_millisecs
+            echo 1 > /sys/kernel/mm/ksm/run
+            ;;
+    esac
+}
+
+committed_memory () {
+    # calculate how much memory is committed to running qemu processes
+    local pidlist
+    pidlist=$(pgrep -d ' ' -- '^qemu(-(kvm|system-.+)|:.{1,11})$')
+    if [ -n "$pidlist" ]; then
+        ps -p "$pidlist" -o rsz=
+    fi | awk '{ sum += $1 }; END { print 0+sum }'
+}
+
+free_memory () {
+    awk '/^(MemFree|Buffers|Cached):/ {free += $2}; END {print free}' \
+                /proc/meminfo
+}
+
+increase_npages() {
+    local delta
+    delta=${1:-0}
+    npages=$[npages + delta]
+    if [ $npages -lt $KSM_NPAGES_MIN ]; then
+        npages=$KSM_NPAGES_MIN
+    elif [ $npages -gt $KSM_NPAGES_MAX ]; then
+        npages=$KSM_NPAGES_MAX
+    fi
+    echo $npages
+}
+
+
+adjust () {
+    local free committed
+    free=`free_memory`
+    committed=`committed_memory`
+    debug committed $committed free $free
+    if [ $[committed + thres] -lt $total -a $free -gt $thres ]; then
+        KSMCTL stop
+        debug "$[committed + thres] < $total and free > $thres, stop ksm"
+        return 1
+    fi
+    debug "$[committed + thres] > $total, start ksm"
+    if [ $free -lt $thres ]; then
+        npages=`increase_npages $KSM_NPAGES_BOOST`
+        debug "$free < $thres, boost"
+    else
+        npages=`increase_npages $KSM_NPAGES_DECAY`
+        debug "$free > $thres, decay"
+    fi
+    KSMCTL start $npages $sleep
+    debug "KSMCTL start $npages $sleep"
+    return 0
+}
+
+function nothing () {
+    :
+}
+
+loop () {
+    trap nothing SIGUSR1
+    while true
+    do
+        sleep $KSM_MONITOR_INTERVAL &
+        wait $!
+        adjust
+    done
+}
+
+PIDFILE=${PIDFILE-/var/run/ksmtune.pid}
+if touch "$PIDFILE"; then
+  loop &
+  echo $! > "$PIDFILE"
+fi
--- a/SOURCES/ksmtuned.conf
+++ b/SOURCES/ksmtuned.conf
@ -0,0 +1,21 @@
+# Configuration file for ksmtuned.
+
+# How long ksmtuned should sleep between tuning adjustments
+# KSM_MONITOR_INTERVAL=60
+
+# Millisecond sleep between ksm scans for 16Gb server.
+# Smaller servers sleep more, bigger sleep less.
+# KSM_SLEEP_MSEC=10
+
+# KSM_NPAGES_BOOST=300
+# KSM_NPAGES_DECAY=-50
+# KSM_NPAGES_MIN=64
+# KSM_NPAGES_MAX=1250
+
+# KSM_THRES_COEF=20
+# KSM_THRES_CONST=2048
+
+# uncomment the following if you want ksmtuned debug info
+
+# LOGFILE=/var/log/ksmtuned
+# DEBUG=1
--- a/SOURCES/ksmtuned.service
+++ b/SOURCES/ksmtuned.service
@ -0,0 +1,12 @@
+[Unit]
+Description=Kernel Samepage Merging (KSM) Tuning Daemon
+After=ksm.service
+Requires=ksm.service
+
+[Service]
+ExecStart=/usr/sbin/ksmtuned
+ExecReload=/bin/kill -USR1 $MAINPID
+Type=forking
+
+[Install]
+WantedBy=multi-user.target
--- a/SOURCES/kvm-Add-dirty-sync-missed-zero-copy-migration-stat.patch
+++ b/SOURCES/kvm-Add-dirty-sync-missed-zero-copy-migration-stat.patch
@ -0,0 +1,87 @@
+From cd49a32e9c9e33efc51652b68180a07683814b4d Mon Sep 17 00:00:00 2001
+From: Leonardo Bras <leobras@redhat.com>
+Date: Mon, 11 Jul 2022 18:11:12 -0300
+Subject: [PATCH 4/9] Add dirty-sync-missed-zero-copy migration stat
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Leonardo Brás <leobras@redhat.com>
+RH-MergeRequest: 201: Zero-copy-send fixes + improvements
+RH-Commit: [4/8] 56cce61cf95aafc8dafae7531b43c166084abfec
+RH-Bugzilla: 2110203
+RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+RH-Acked-by: Peter Xu <peterx@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+
+Signed-off-by: Leonardo Bras <leobras@redhat.com>
+Acked-by: Markus Armbruster <armbru@redhat.com>
+Acked-by: Peter Xu <peterx@redhat.com>
+Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
+Message-Id: <20220711211112.18951-3-leobras@redhat.com>
+Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+(cherry picked from commit cf20c897338067ab4b70a4596fdccaf90c7e29a1)
+Signed-off-by: Leonardo Bras <leobras@redhat.com>
+---
+ migration/migration.c | 2 ++
+ monitor/hmp-cmds.c    | 5 +++++
+ qapi/migration.json   | 7 ++++++-
+ 3 files changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/migration/migration.c b/migration/migration.c
+index e100b30f00..952a26c5c2 100644
+--- a/migration/migration.c
+++ b/migration/migration.c
+@@ -1012,6 +1012,8 @@ static void populate_ram_info(MigrationInfo *info, MigrationState *s)
+     info->ram->normal_bytes = ram_counters.normal * page_size;
+     info->ram->mbps = s->mbps;
+     info->ram->dirty_sync_count = ram_counters.dirty_sync_count;
+    info->ram->dirty_sync_missed_zero_copy =
+            ram_counters.dirty_sync_missed_zero_copy;
+     info->ram->postcopy_requests = ram_counters.postcopy_requests;
+     info->ram->page_size = page_size;
+     info->ram->multifd_bytes = ram_counters.multifd_bytes;
+diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
+index 8c384dc1b2..f7216ab5d0 100644
+--- a/monitor/hmp-cmds.c
+++ b/monitor/hmp-cmds.c
+@@ -305,6 +305,11 @@ void hmp_info_migrate(Monitor *mon, const QDict *qdict)
+             monitor_printf(mon, "postcopy ram: %" PRIu64 " kbytes\n",
+                            info->ram->postcopy_bytes >> 10);
+         }
+        if (info->ram->dirty_sync_missed_zero_copy) {
+            monitor_printf(mon,
+                           "Zero-copy-send fallbacks happened: %" PRIu64 " times\n",
+                           info->ram->dirty_sync_missed_zero_copy);
+        }
+     }
+ 
+     if (info->has_disk) {
+diff --git a/qapi/migration.json b/qapi/migration.json
+index c8ec260ab0..94bc5c69db 100644
+--- a/qapi/migration.json
+++ b/qapi/migration.json
+@@ -55,6 +55,10 @@
+ # @postcopy-bytes: The number of bytes sent during the post-copy phase
+ #                  (since 7.0).
+ #
+# @dirty-sync-missed-zero-copy: Number of times dirty RAM synchronization could
+#                               not avoid copying dirty pages. This is between
+#                               0 and @dirty-sync-count * @multifd-channels.
+#                               (since 7.1)
+ # Since: 0.14
+ ##
+ { 'struct': 'MigrationStats',
+@@ -65,7 +69,8 @@
+            'postcopy-requests' : 'int', 'page-size' : 'int',
+            'multifd-bytes' : 'uint64', 'pages-per-second' : 'uint64',
+            'precopy-bytes' : 'uint64', 'downtime-bytes' : 'uint64',
+-           'postcopy-bytes' : 'uint64' } }
+           'postcopy-bytes' : 'uint64',
+           'dirty-sync-missed-zero-copy' : 'uint64' } }
+ 
+ ##
+ # @XBZRLECacheStats:
+-- 
+2.31.1
+
--- a/SOURCES/kvm-Enable-SGX-RH-Only.patch
+++ b/SOURCES/kvm-Enable-SGX-RH-Only.patch
@ -0,0 +1,28 @@
+From db6e042fe4fdc1a1bbf562a46b15d4d8e33e2fa6 Mon Sep 17 00:00:00 2001
+From: Paul Lai <plai@redhat.com>
+Date: Tue, 25 Jan 2022 15:16:22 -0500
+Subject: [PATCH 4/7] Enable SGX  -- RH Only
+
+RH-Author: Paul Lai <None>
+RH-MergeRequest: 111: numa: Enable numa for SGX EPC sections
+RH-Commit: [4/5] cea874f29984897ef1232fb7749c13203c888034
+RH-Bugzilla: 1518984
+RH-Acked-by: Paolo Bonzini <None>
+RH-Acked-by: Bandan Das <None>
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+---
+ configs/devices/x86_64-softmmu/x86_64-rh-devices.mak | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
+index ddf036f042..fdbbdf9742 100644
+--- a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
+++ b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
+@@ -102,3 +102,4 @@ CONFIG_TPM_CRB=y
+ CONFIG_TPM_TIS_ISA=y
+ CONFIG_TPM_EMULATOR=y
+ CONFIG_TPM_PASSTHROUGH=y
+CONFIG_SGX=y
+-- 
+2.27.0
+
--- a/SOURCES/kvm-KVM-keep-track-of-running-ioctls.patch
+++ b/SOURCES/kvm-KVM-keep-track-of-running-ioctls.patch
@ -1,17 +1,17 @@
-From 6aebc271d95f9c59cb63c923b6ce35f16fce10e4 Mon Sep 17 00:00:00 2001
+From 9bacf8c4104ff3cff2e0e2c2179ec4fda633167f Mon Sep 17 00:00:00 2001
 From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
-Date: Mon, 16 Jan 2023 07:17:23 -0500
-Subject: [PATCH 30/31] KVM: keep track of running ioctls
+Date: Mon, 16 Jan 2023 07:51:08 -0500
+Subject: [PATCH 05/11] KVM: keep track of running ioctls

 RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
-RH-MergeRequest: 138: accel: introduce accelerator blocker API
-RH-Bugzilla: 1979276
-RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 247: accel: introduce accelerator blocker API
+RH-Bugzilla: 2161188
 RH-Acked-by: David Hildenbrand <david@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [2/3] f566f81dda26ae733008f32261ecd1253ec1796d (eesposit/qemu-kvm)
+RH-Commit: [2/3] 357508389e2a0fd996206b406e9e235e50b5f0b6

-Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1979276
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2161188

 commit a27dd2de68f37ba96fe164a42121daa5f0750afc
 Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
@ -36,18 +36,18 @@ Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 1 file changed, 7 insertions(+)

 diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
-index f99b0becd8..ff660fd469 100644
+index 8f2a53438f..221aadfda7 100644
 --- a/accel/kvm/kvm-all.c
 +++ b/accel/kvm/kvm-all.c
-@@ -2310,6 +2310,7 @@ static int kvm_init(MachineState *ms)
-     assert(TARGET_PAGE_SIZE <= qemu_real_host_page_size());
+@@ -2337,6 +2337,7 @@ static int kvm_init(MachineState *ms)
+     assert(TARGET_PAGE_SIZE <= qemu_real_host_page_size);
 
     s->sigmask_len = 8;
 +    accel_blocker_init();
 
 #ifdef KVM_CAP_SET_GUEST_DEBUG
     QTAILQ_INIT(&s->kvm_sw_breakpoints);
-@@ -3014,7 +3015,9 @@ int kvm_vm_ioctl(KVMState *s, int type, ...)
+@@ -3018,7 +3019,9 @@ int kvm_vm_ioctl(KVMState *s, int type, ...)
     va_end(ap);
 
     trace_kvm_vm_ioctl(type, arg);
@ -57,7 +57,7 @@ index f99b0becd8..ff660fd469 100644
     if (ret == -1) {
         ret = -errno;
     }
-@@ -3032,7 +3035,9 @@ int kvm_vcpu_ioctl(CPUState *cpu, int type, ...)
+@@ -3036,7 +3039,9 @@ int kvm_vcpu_ioctl(CPUState *cpu, int type, ...)
     va_end(ap);
 
     trace_kvm_vcpu_ioctl(cpu->cpu_index, type, arg);
@ -67,7 +67,7 @@ index f99b0becd8..ff660fd469 100644
     if (ret == -1) {
         ret = -errno;
     }
-@@ -3050,7 +3055,9 @@ int kvm_device_ioctl(int fd, int type, ...)
+@@ -3054,7 +3059,9 @@ int kvm_device_ioctl(int fd, int type, ...)
     va_end(ap);
 
     trace_kvm_device_ioctl(fd, type, arg);
@ -78,5 +78,5 @@ index f99b0becd8..ff660fd469 100644
         ret = -errno;
     }
 -- 
-2.31.1
+2.37.3

--- a/SOURCES/kvm-KVM-x86-workaround-invalid-CPUID-0xD-9-info-on-some-.patch
+++ b/SOURCES/kvm-KVM-x86-workaround-invalid-CPUID-0xD-9-info-on-some-.patch
@ -0,0 +1,109 @@
+From ea5299b5dde7d0b6b2f93cb646e6a24c9f105466 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Wed, 23 Mar 2022 12:33:25 +0100
+Subject: [PATCH 13/24] KVM: x86: workaround invalid CPUID[0xD,9] info on some
+ AMD processors
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Paul Lai <plai@redhat.com>
+RH-MergeRequest: 176: Enable KVM AMX support
+RH-Commit: [13/13] 38f147c911258e84e01336271ebd23a1c24371fc
+RH-Bugzilla: 1916415
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
+RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+
+Some AMD processors expose the PKRU extended save state even if they do not have
+the related PKU feature in CPUID.  Worse, when they do they report a size of
+64, whereas the expected size of the PKRU extended save state is 8, therefore
+the esa->size == eax assertion does not hold.
+
+The state is already ignored by KVM_GET_SUPPORTED_CPUID because it
+was not enabled in the host XCR0.  However, QEMU kvm_cpu_xsave_init()
+runs before QEMU invokes arch_prctl() to enable dynamically-enabled
+save states such as XTILEDATA, and KVM_GET_SUPPORTED_CPUID hides save
+states that have yet to be enabled.  Therefore, kvm_cpu_xsave_init()
+needs to consult the host CPUID instead of KVM_GET_SUPPORTED_CPUID,
+and dies with an assertion failure.
+
+When setting up the ExtSaveArea array to match the host, ignore features that
+KVM does not report as supported.  This will cause QEMU to skip the incorrect
+CPUID leaf instead of tripping the assertion.
+
+Closes: https://gitlab.com/qemu-project/qemu/-/issues/916
+Reported-by: Daniel P. Berrangé <berrange@redhat.com>
+Analyzed-by: Yang Zhong <yang.zhong@intel.com>
+Reported-by: Peter Krempa <pkrempa@redhat.com>
+Tested-by: Daniel P. Berrangé <berrange@redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 58f7db26f21c690cf9a669c314cfd7371506084a)
+Signed-off-by: Paul Lai <plai@redhat.com>
+---
+ target/i386/cpu.c         |  4 ++--
+ target/i386/cpu.h         |  2 ++
+ target/i386/kvm/kvm-cpu.c | 19 ++++++++++++-------
+ 3 files changed, 16 insertions(+), 9 deletions(-)
+
+diff --git a/target/i386/cpu.c b/target/i386/cpu.c
+index 09e08f7f38..0543b846ff 100644
+--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
+@@ -4980,8 +4980,8 @@ CpuDefinitionInfoList *qmp_query_cpu_definitions(Error **errp)
+     return cpu_list;
+ }
+ 
+-static uint64_t x86_cpu_get_supported_feature_word(FeatureWord w,
+-                                                   bool migratable_only)
+uint64_t x86_cpu_get_supported_feature_word(FeatureWord w,
+                                            bool migratable_only)
+ {
+     FeatureWordInfo *wi = &feature_word_info[w];
+     uint64_t r = 0;
+diff --git a/target/i386/cpu.h b/target/i386/cpu.h
+index 8ab2a4042a..006b735fe4 100644
+--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
+@@ -604,6 +604,8 @@ typedef enum FeatureWord {
+ } FeatureWord;
+ 
+ typedef uint64_t FeatureWordArray[FEATURE_WORDS];
+uint64_t x86_cpu_get_supported_feature_word(FeatureWord w,
+                                            bool migratable_only);
+ 
+ /* cpuid_features bits */
+ #define CPUID_FP87 (1U << 0)
+diff --git a/target/i386/kvm/kvm-cpu.c b/target/i386/kvm/kvm-cpu.c
+index bdc967c484..74c1396a93 100644
+--- a/target/i386/kvm/kvm-cpu.c
+++ b/target/i386/kvm/kvm-cpu.c
+@@ -99,13 +99,18 @@ static void kvm_cpu_xsave_init(void)
+     for (i = XSTATE_SSE_BIT + 1; i < XSAVE_STATE_AREA_COUNT; i++) {
+         ExtSaveArea *esa = &x86_ext_save_areas[i];
+ 
+-        if (esa->size) {
+-            host_cpuid(0xd, i, &eax, &ebx, &ecx, &edx);
+-            if (eax != 0) {
+-                assert(esa->size == eax);
+-                esa->offset = ebx;
+-                esa->ecx = ecx;
+-            }
+        if (!esa->size) {
+            continue;
+        }
+        if ((x86_cpu_get_supported_feature_word(esa->feature, false) & esa->bits)
+            != esa->bits) {
+            continue;
+        }
+        host_cpuid(0xd, i, &eax, &ebx, &ecx, &edx);
+        if (eax != 0) {
+            assert(esa->size == eax);
+            esa->offset = ebx;
+            esa->ecx = ecx;
+         }
+     }
+ }
+-- 
+2.35.3
+
--- a/SOURCES/kvm-QIOChannel-Add-flags-on-io_writev-and-introduce-io_f.patch
+++ b/SOURCES/kvm-QIOChannel-Add-flags-on-io_writev-and-introduce-io_f.patch
@ -0,0 +1,420 @@
+From 7eeec7c008e947bc3e1fed682791092b408852c6 Mon Sep 17 00:00:00 2001
+From: Leonardo Bras <leobras@redhat.com>
+Date: Wed, 18 May 2022 02:52:24 -0300
+Subject: [PATCH 17/37] QIOChannel: Add flags on io_writev and introduce
+ io_flush callback
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Leonardo Brás <leobras@redhat.com>
+RH-MergeRequest: 191: MSG_ZEROCOPY + Multifd @ rhel8.7
+RH-Commit: [17/26] 7bde4e79fd3f76a6cc84d9cacf50420584ddd35c
+RH-Bugzilla: 2072049
+RH-Acked-by: Peter Xu <peterx@redhat.com>
+RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
+RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+
+Add flags to io_writev and introduce io_flush as optional callback to
+QIOChannelClass, allowing the implementation of zero copy writes by
+subclasses.
+
+How to use them:
+- Write data using qio_channel_writev*(...,QIO_CHANNEL_WRITE_FLAG_ZERO_COPY),
+- Wait write completion with qio_channel_flush().
+
+Notes:
+As some zero copy write implementations work asynchronously, it's
+recommended to keep the write buffer untouched until the return of
+qio_channel_flush(), to avoid the risk of sending an updated buffer
+instead of the buffer state during write.
+
+As io_flush callback is optional, if a subclass does not implement it, then:
+- io_flush will return 0 without changing anything.
+
+Also, some functions like qio_channel_writev_full_all() were adapted to
+receive a flag parameter. That allows shared code between zero copy and
+non-zero copy writev, and also an easier implementation on new flags.
+
+Signed-off-by: Leonardo Bras <leobras@redhat.com>
+Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
+Reviewed-by: Peter Xu <peterx@redhat.com>
+Reviewed-by: Juan Quintela <quintela@redhat.com>
+Message-Id: <20220513062836.965425-3-leobras@redhat.com>
+Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+(cherry picked from commit b88651cb4d4fa416fdbb6afaf5b26ec8c035eaad)
+Signed-off-by: Leonardo Bras <leobras@redhat.com>
+---
+ chardev/char-io.c                   |  2 +-
+ hw/remote/mpqemu-link.c             |  2 +-
+ include/io/channel.h                | 38 +++++++++++++++++++++-
+ io/channel-buffer.c                 |  1 +
+ io/channel-command.c                |  1 +
+ io/channel-file.c                   |  1 +
+ io/channel-socket.c                 |  2 ++
+ io/channel-tls.c                    |  1 +
+ io/channel-websock.c                |  1 +
+ io/channel.c                        | 49 +++++++++++++++++++++++------
+ migration/rdma.c                    |  1 +
+ scsi/pr-manager-helper.c            |  2 +-
+ tests/unit/test-io-channel-socket.c |  1 +
+ 13 files changed, 88 insertions(+), 14 deletions(-)
+
+diff --git a/chardev/char-io.c b/chardev/char-io.c
+index 8ced184160..4451128cba 100644
+--- a/chardev/char-io.c
+++ b/chardev/char-io.c
+@@ -122,7 +122,7 @@ int io_channel_send_full(QIOChannel *ioc,
+ 
+         ret = qio_channel_writev_full(
+             ioc, &iov, 1,
+-            fds, nfds, NULL);
+            fds, nfds, 0, NULL);
+         if (ret == QIO_CHANNEL_ERR_BLOCK) {
+             if (offset) {
+                 return offset;
+diff --git a/hw/remote/mpqemu-link.c b/hw/remote/mpqemu-link.c
+index 7e841820e5..e8f556bd27 100644
+--- a/hw/remote/mpqemu-link.c
+++ b/hw/remote/mpqemu-link.c
+@@ -69,7 +69,7 @@ bool mpqemu_msg_send(MPQemuMsg *msg, QIOChannel *ioc, Error **errp)
+     }
+ 
+     if (!qio_channel_writev_full_all(ioc, send, G_N_ELEMENTS(send),
+-                                    fds, nfds, errp)) {
+                                    fds, nfds, 0, errp)) {
+         ret = true;
+     } else {
+         trace_mpqemu_send_io_error(msg->cmd, msg->size, nfds);
+diff --git a/include/io/channel.h b/include/io/channel.h
+index 88988979f8..c680ee7480 100644
+--- a/include/io/channel.h
+++ b/include/io/channel.h
+@@ -32,12 +32,15 @@ OBJECT_DECLARE_TYPE(QIOChannel, QIOChannelClass,
+ 
+ #define QIO_CHANNEL_ERR_BLOCK -2
+ 
+#define QIO_CHANNEL_WRITE_FLAG_ZERO_COPY 0x1
+
+ typedef enum QIOChannelFeature QIOChannelFeature;
+ 
+ enum QIOChannelFeature {
+     QIO_CHANNEL_FEATURE_FD_PASS,
+     QIO_CHANNEL_FEATURE_SHUTDOWN,
+     QIO_CHANNEL_FEATURE_LISTEN,
+    QIO_CHANNEL_FEATURE_WRITE_ZERO_COPY,
+ };
+ 
+ 
+@@ -104,6 +107,7 @@ struct QIOChannelClass {
+                          size_t niov,
+                          int *fds,
+                          size_t nfds,
+                         int flags,
+                          Error **errp);
+     ssize_t (*io_readv)(QIOChannel *ioc,
+                         const struct iovec *iov,
+@@ -136,6 +140,8 @@ struct QIOChannelClass {
+                                   IOHandler *io_read,
+                                   IOHandler *io_write,
+                                   void *opaque);
+    int (*io_flush)(QIOChannel *ioc,
+                    Error **errp);
+ };
+ 
+ /* General I/O handling functions */
+@@ -228,6 +234,7 @@ ssize_t qio_channel_readv_full(QIOChannel *ioc,
+  * @niov: the length of the @iov array
+  * @fds: an array of file handles to send
+  * @nfds: number of file handles in @fds
+ * @flags: write flags (QIO_CHANNEL_WRITE_FLAG_*)
+  * @errp: pointer to a NULL-initialized error object
+  *
+  * Write data to the IO channel, reading it from the
+@@ -260,6 +267,7 @@ ssize_t qio_channel_writev_full(QIOChannel *ioc,
+                                 size_t niov,
+                                 int *fds,
+                                 size_t nfds,
+                                int flags,
+                                 Error **errp);
+ 
+ /**
+@@ -837,6 +845,7 @@ int qio_channel_readv_full_all(QIOChannel *ioc,
+  * @niov: the length of the @iov array
+  * @fds: an array of file handles to send
+  * @nfds: number of file handles in @fds
+ * @flags: write flags (QIO_CHANNEL_WRITE_FLAG_*)
+  * @errp: pointer to a NULL-initialized error object
+  *
+  *
+@@ -846,6 +855,14 @@ int qio_channel_readv_full_all(QIOChannel *ioc,
+  * to be written, yielding from the current coroutine
+  * if required.
+  *
+ * If QIO_CHANNEL_WRITE_FLAG_ZERO_COPY is passed in flags,
+ * instead of waiting for all requested data to be written,
+ * this function will wait until it's all queued for writing.
+ * In this case, if the buffer gets changed between queueing and
+ * sending, the updated buffer will be sent. If this is not a
+ * desired behavior, it's suggested to call qio_channel_flush()
+ * before reusing the buffer.
+ *
+  * Returns: 0 if all bytes were written, or -1 on error
+  */
+ 
+@@ -853,6 +870,25 @@ int qio_channel_writev_full_all(QIOChannel *ioc,
+                                 const struct iovec *iov,
+                                 size_t niov,
+                                 int *fds, size_t nfds,
+-                                Error **errp);
+                                int flags, Error **errp);
+
+/**
+ * qio_channel_flush:
+ * @ioc: the channel object
+ * @errp: pointer to a NULL-initialized error object
+ *
+ * Will block until every packet queued with
+ * qio_channel_writev_full() + QIO_CHANNEL_WRITE_FLAG_ZERO_COPY
+ * is sent, or return in case of any error.
+ *
+ * If not implemented, acts as a no-op, and returns 0.
+ *
+ * Returns -1 if any error is found,
+ *          1 if every send failed to use zero copy.
+ *          0 otherwise.
+ */
+
+int qio_channel_flush(QIOChannel *ioc,
+                      Error **errp);
+ 
+ #endif /* QIO_CHANNEL_H */
+diff --git a/io/channel-buffer.c b/io/channel-buffer.c
+index baa4e2b089..bf52011be2 100644
+--- a/io/channel-buffer.c
+++ b/io/channel-buffer.c
+@@ -81,6 +81,7 @@ static ssize_t qio_channel_buffer_writev(QIOChannel *ioc,
+                                          size_t niov,
+                                          int *fds,
+                                          size_t nfds,
+                                         int flags,
+                                          Error **errp)
+ {
+     QIOChannelBuffer *bioc = QIO_CHANNEL_BUFFER(ioc);
+diff --git a/io/channel-command.c b/io/channel-command.c
+index b2a9e27138..5ff1691bad 100644
+--- a/io/channel-command.c
+++ b/io/channel-command.c
+@@ -258,6 +258,7 @@ static ssize_t qio_channel_command_writev(QIOChannel *ioc,
+                                           size_t niov,
+                                           int *fds,
+                                           size_t nfds,
+                                          int flags,
+                                           Error **errp)
+ {
+     QIOChannelCommand *cioc = QIO_CHANNEL_COMMAND(ioc);
+diff --git a/io/channel-file.c b/io/channel-file.c
+index c4bf799a80..348a48545e 100644
+--- a/io/channel-file.c
+++ b/io/channel-file.c
+@@ -114,6 +114,7 @@ static ssize_t qio_channel_file_writev(QIOChannel *ioc,
+                                        size_t niov,
+                                        int *fds,
+                                        size_t nfds,
+                                       int flags,
+                                        Error **errp)
+ {
+     QIOChannelFile *fioc = QIO_CHANNEL_FILE(ioc);
+diff --git a/io/channel-socket.c b/io/channel-socket.c
+index 606ec97cf7..bfbd64787e 100644
+--- a/io/channel-socket.c
+++ b/io/channel-socket.c
+@@ -525,6 +525,7 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
+                                          size_t niov,
+                                          int *fds,
+                                          size_t nfds,
+                                         int flags,
+                                          Error **errp)
+ {
+     QIOChannelSocket *sioc = QIO_CHANNEL_SOCKET(ioc);
+@@ -620,6 +621,7 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
+                                          size_t niov,
+                                          int *fds,
+                                          size_t nfds,
+                                         int flags,
+                                          Error **errp)
+ {
+     QIOChannelSocket *sioc = QIO_CHANNEL_SOCKET(ioc);
+diff --git a/io/channel-tls.c b/io/channel-tls.c
+index 2ae1b92fc0..4ce890a538 100644
+--- a/io/channel-tls.c
+++ b/io/channel-tls.c
+@@ -301,6 +301,7 @@ static ssize_t qio_channel_tls_writev(QIOChannel *ioc,
+                                       size_t niov,
+                                       int *fds,
+                                       size_t nfds,
+                                      int flags,
+                                       Error **errp)
+ {
+     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
+diff --git a/io/channel-websock.c b/io/channel-websock.c
+index 70889bb54d..035dd6075b 100644
+--- a/io/channel-websock.c
+++ b/io/channel-websock.c
+@@ -1127,6 +1127,7 @@ static ssize_t qio_channel_websock_writev(QIOChannel *ioc,
+                                           size_t niov,
+                                           int *fds,
+                                           size_t nfds,
+                                          int flags,
+                                           Error **errp)
+ {
+     QIOChannelWebsock *wioc = QIO_CHANNEL_WEBSOCK(ioc);
+diff --git a/io/channel.c b/io/channel.c
+index e8b019dc36..0640941ac5 100644
+--- a/io/channel.c
+++ b/io/channel.c
+@@ -72,18 +72,32 @@ ssize_t qio_channel_writev_full(QIOChannel *ioc,
+                                 size_t niov,
+                                 int *fds,
+                                 size_t nfds,
+                                int flags,
+                                 Error **errp)
+ {
+     QIOChannelClass *klass = QIO_CHANNEL_GET_CLASS(ioc);
+ 
+-    if ((fds || nfds) &&
+-        !qio_channel_has_feature(ioc, QIO_CHANNEL_FEATURE_FD_PASS)) {
+    if (fds || nfds) {
+        if (!qio_channel_has_feature(ioc, QIO_CHANNEL_FEATURE_FD_PASS)) {
+            error_setg_errno(errp, EINVAL,
+                             "Channel does not support file descriptor passing");
+            return -1;
+        }
+        if (flags & QIO_CHANNEL_WRITE_FLAG_ZERO_COPY) {
+            error_setg_errno(errp, EINVAL,
+                             "Zero Copy does not support file descriptor passing");
+            return -1;
+        }
+    }
+
+    if ((flags & QIO_CHANNEL_WRITE_FLAG_ZERO_COPY) &&
+        !qio_channel_has_feature(ioc, QIO_CHANNEL_FEATURE_WRITE_ZERO_COPY)) {
+         error_setg_errno(errp, EINVAL,
+-                         "Channel does not support file descriptor passing");
+                         "Requested Zero Copy feature is not available");
+         return -1;
+     }
+ 
+-    return klass->io_writev(ioc, iov, niov, fds, nfds, errp);
+    return klass->io_writev(ioc, iov, niov, fds, nfds, flags, errp);
+ }
+ 
+ 
+@@ -217,14 +231,14 @@ int qio_channel_writev_all(QIOChannel *ioc,
+                            size_t niov,
+                            Error **errp)
+ {
+-    return qio_channel_writev_full_all(ioc, iov, niov, NULL, 0, errp);
+    return qio_channel_writev_full_all(ioc, iov, niov, NULL, 0, 0, errp);
+ }
+ 
+ int qio_channel_writev_full_all(QIOChannel *ioc,
+                                 const struct iovec *iov,
+                                 size_t niov,
+                                 int *fds, size_t nfds,
+-                                Error **errp)
+                                int flags, Error **errp)
+ {
+     int ret = -1;
+     struct iovec *local_iov = g_new(struct iovec, niov);
+@@ -237,8 +251,10 @@ int qio_channel_writev_full_all(QIOChannel *ioc,
+ 
+     while (nlocal_iov > 0) {
+         ssize_t len;
+-        len = qio_channel_writev_full(ioc, local_iov, nlocal_iov, fds, nfds,
+-                                      errp);
+
+        len = qio_channel_writev_full(ioc, local_iov, nlocal_iov, fds,
+                                            nfds, flags, errp);
+
+         if (len == QIO_CHANNEL_ERR_BLOCK) {
+             if (qemu_in_coroutine()) {
+                 qio_channel_yield(ioc, G_IO_OUT);
+@@ -277,7 +293,7 @@ ssize_t qio_channel_writev(QIOChannel *ioc,
+                            size_t niov,
+                            Error **errp)
+ {
+-    return qio_channel_writev_full(ioc, iov, niov, NULL, 0, errp);
+    return qio_channel_writev_full(ioc, iov, niov, NULL, 0, 0, errp);
+ }
+ 
+ 
+@@ -297,7 +313,7 @@ ssize_t qio_channel_write(QIOChannel *ioc,
+                           Error **errp)
+ {
+     struct iovec iov = { .iov_base = (char *)buf, .iov_len = buflen };
+-    return qio_channel_writev_full(ioc, &iov, 1, NULL, 0, errp);
+    return qio_channel_writev_full(ioc, &iov, 1, NULL, 0, 0, errp);
+ }
+ 
+ 
+@@ -473,6 +489,19 @@ off_t qio_channel_io_seek(QIOChannel *ioc,
+     return klass->io_seek(ioc, offset, whence, errp);
+ }
+ 
+int qio_channel_flush(QIOChannel *ioc,
+                                Error **errp)
+{
+    QIOChannelClass *klass = QIO_CHANNEL_GET_CLASS(ioc);
+
+    if (!klass->io_flush ||
+        !qio_channel_has_feature(ioc, QIO_CHANNEL_FEATURE_WRITE_ZERO_COPY)) {
+        return 0;
+    }
+
+    return klass->io_flush(ioc, errp);
+}
+
+ 
+ static void qio_channel_restart_read(void *opaque)
+ {
+diff --git a/migration/rdma.c b/migration/rdma.c
+index f5d3bbe7e9..54acd2000e 100644
+--- a/migration/rdma.c
+++ b/migration/rdma.c
+@@ -2833,6 +2833,7 @@ static ssize_t qio_channel_rdma_writev(QIOChannel *ioc,
+                                        size_t niov,
+                                        int *fds,
+                                        size_t nfds,
+                                       int flags,
+                                        Error **errp)
+ {
+     QIOChannelRDMA *rioc = QIO_CHANNEL_RDMA(ioc);
+diff --git a/scsi/pr-manager-helper.c b/scsi/pr-manager-helper.c
+index 451c7631b7..3be52a98d5 100644
+--- a/scsi/pr-manager-helper.c
+++ b/scsi/pr-manager-helper.c
+@@ -77,7 +77,7 @@ static int pr_manager_helper_write(PRManagerHelper *pr_mgr,
+         iov.iov_base = (void *)buf;
+         iov.iov_len = sz;
+         n_written = qio_channel_writev_full(QIO_CHANNEL(pr_mgr->ioc), &iov, 1,
+-                                            nfds ? &fd : NULL, nfds, errp);
+                                            nfds ? &fd : NULL, nfds, 0, errp);
+ 
+         if (n_written <= 0) {
+             assert(n_written != QIO_CHANNEL_ERR_BLOCK);
+diff --git a/tests/unit/test-io-channel-socket.c b/tests/unit/test-io-channel-socket.c
+index c49eec1f03..6713886d02 100644
+--- a/tests/unit/test-io-channel-socket.c
+++ b/tests/unit/test-io-channel-socket.c
+@@ -444,6 +444,7 @@ static void test_io_channel_unix_fd_pass(void)
+                             G_N_ELEMENTS(iosend),
+                             fdsend,
+                             G_N_ELEMENTS(fdsend),
+                            0,
+                             &error_abort);
+ 
+     qio_channel_readv_full(dst,
+-- 
+2.35.3
+
--- a/SOURCES/kvm-QIOChannelSocket-Add-support-for-MSG_ZEROCOPY-IPV6.patch
+++ b/SOURCES/kvm-QIOChannelSocket-Add-support-for-MSG_ZEROCOPY-IPV6.patch
@ -0,0 +1,56 @@
+From a6c4aed18a027ce8e107fdf9184e9ea43a86f843 Mon Sep 17 00:00:00 2001
+From: Leonardo Bras <leobras@redhat.com>
+Date: Thu, 4 Aug 2022 04:10:43 -0300
+Subject: [PATCH 8/9] QIOChannelSocket: Add support for MSG_ZEROCOPY + IPV6
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Leonardo Brás <leobras@redhat.com>
+RH-MergeRequest: 201: Zero-copy-send fixes + improvements
+RH-Commit: [8/8] 6e26ee7c9ebaedb07623313cb0678816867751dd
+RH-Bugzilla: 2110203
+RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+RH-Acked-by: Peter Xu <peterx@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+
+For using MSG_ZEROCOPY, there are two steps:
+1 - io_writev() the packet, which enqueues the packet for sending, and
+2 - io_flush(), which gets confirmation that all packets got correctly sent
+
+Currently, if MSG_ZEROCOPY is used to send packets over IPV6, no error will
+be reported in (1), but it will fail in the first time (2) happens.
+
+This happens because (2) currently checks for cmsg_level & cmsg_type
+associated with IPV4 only, before reporting any error.
+
+Add checks for cmsg_level & cmsg_type associated with IPV6, and thus enable
+support for MSG_ZEROCOPY + IPV6
+
+Fixes: 2bc58ffc29 ("QIOChannelSocket: Implement io_writev zero copy flag & io_flush for CONFIG_LINUX")
+Signed-off-by: Leonardo Bras <leobras@redhat.com>
+Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
+(cherry picked from commit 5258a7e2c0677d16e9e1d06845f60171adf0b290)
+Signed-off-by: Leonardo Bras <leobras@redhat.com>
+---
+ io/channel-socket.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/io/channel-socket.c b/io/channel-socket.c
+index cf0d67c51b..6010ad7017 100644
+--- a/io/channel-socket.c
+++ b/io/channel-socket.c
+@@ -747,8 +747,8 @@ static int qio_channel_socket_flush(QIOChannel *ioc,
+         }
+ 
+         cm = CMSG_FIRSTHDR(&msg);
+-        if (cm->cmsg_level != SOL_IP &&
+-            cm->cmsg_type != IP_RECVERR) {
+        if (cm->cmsg_level != SOL_IP   && cm->cmsg_type != IP_RECVERR &&
+            cm->cmsg_level != SOL_IPV6 && cm->cmsg_type != IPV6_RECVERR) {
+             error_setg_errno(errp, EPROTOTYPE,
+                              "Wrong cmsg in errqueue");
+             return -1;
+-- 
+2.31.1
+
--- a/SOURCES/kvm-QIOChannelSocket-Fix-zero-copy-flush-returning-code-.patch
+++ b/SOURCES/kvm-QIOChannelSocket-Fix-zero-copy-flush-returning-code-.patch
@ -0,0 +1,65 @@
+From 905cc8032fc63619efb3f0a8c9754b7190bcc43a Mon Sep 17 00:00:00 2001
+From: Leonardo Bras <leobras@redhat.com>
+Date: Mon, 11 Jul 2022 18:11:11 -0300
+Subject: [PATCH 3/9] QIOChannelSocket: Fix zero-copy flush returning code 1
+ when nothing sent
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Leonardo Brás <leobras@redhat.com>
+RH-MergeRequest: 201: Zero-copy-send fixes + improvements
+RH-Commit: [3/8] 1ad707702fa26cd4d0fa1870c21f5f26ae93ff97
+RH-Bugzilla: 2110203
+RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+RH-Acked-by: Peter Xu <peterx@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+
+If flush is called when no buffer was sent with MSG_ZEROCOPY, it currently
+returns 1. This return code should be used only when Linux fails to use
+MSG_ZEROCOPY on a lot of sendmsg().
+
+Fix this by returning early from flush if no sendmsg(...,MSG_ZEROCOPY)
+was attempted.
+
+Fixes: 2bc58ffc2926 ("QIOChannelSocket: Implement io_writev zero copy flag & io_flush for CONFIG_LINUX")
+Signed-off-by: Leonardo Bras <leobras@redhat.com>
+Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
+Acked-by: Daniel P. Berrangé <berrange@redhat.com>
+Reviewed-by: Juan Quintela <quintela@redhat.com>
+Reviewed-by: Peter Xu <peterx@redhat.com>
+Message-Id: <20220711211112.18951-2-leobras@redhat.com>
+Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+(cherry picked from commit 927f93e099c4f9184e60a1bc61624ac2d04d0223)
+Signed-off-by: Leonardo Bras <leobras@redhat.com>
+---
+ io/channel-socket.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/io/channel-socket.c b/io/channel-socket.c
+index df858da924..cf0d67c51b 100644
+--- a/io/channel-socket.c
+++ b/io/channel-socket.c
+@@ -717,12 +717,18 @@ static int qio_channel_socket_flush(QIOChannel *ioc,
+     struct cmsghdr *cm;
+     char control[CMSG_SPACE(sizeof(*serr))];
+     int received;
+-    int ret = 1;
+    int ret;
+
+    if (sioc->zero_copy_queued == sioc->zero_copy_sent) {
+        return 0;
+    }
+ 
+     msg.msg_control = control;
+     msg.msg_controllen = sizeof(control);
+     memset(control, 0, sizeof(control));
+ 
+    ret = 1;
+
+     while (sioc->zero_copy_sent < sioc->zero_copy_queued) {
+         received = recvmsg(sioc->fd, &msg, MSG_ERRQUEUE);
+         if (received < 0) {
+-- 
+2.31.1
+
--- a/SOURCES/kvm-QIOChannelSocket-Fix-zero-copy-send-so-socket-flush-.patch
+++ b/SOURCES/kvm-QIOChannelSocket-Fix-zero-copy-send-so-socket-flush-.patch
@ -0,0 +1,58 @@
+From c1fd32d93ae42fcf3c1a25f4d56e669f251087d8 Mon Sep 17 00:00:00 2001
+From: Leonardo Bras <leobras@redhat.com>
+Date: Mon, 20 Jun 2022 02:39:43 -0300
+Subject: [PATCH 25/37] QIOChannelSocket: Fix zero-copy send so socket flush
+ works
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Leonardo Brás <leobras@redhat.com>
+RH-MergeRequest: 191: MSG_ZEROCOPY + Multifd @ rhel8.7
+RH-Commit: [25/26] 3ede94f3269e21c3ace073ed1a6f24696315bcbb
+RH-Bugzilla: 2072049
+RH-Acked-by: Peter Xu <peterx@redhat.com>
+RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
+RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+
+Somewhere between v6 and v7 the of the zero-copy-send patchset a crucial
+part of the flushing mechanism got missing: incrementing zero_copy_queued.
+
+Without that, the flushing interface becomes a no-op, and there is no
+guarantee the buffer is really sent.
+
+This can go as bad as causing a corruption in RAM during migration.
+
+Fixes: 2bc58ffc2926 ("QIOChannelSocket: Implement io_writev zero copy flag & io_flush for CONFIG_LINUX")
+Reported-by: 徐闯 <xuchuangxclwt@bytedance.com>
+Signed-off-by: Leonardo Bras <leobras@redhat.com>
+Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
+Reviewed-by: Peter Xu <peterx@redhat.com>
+Reviewed-by: Juan Quintela <quintela@redhat.com>
+Signed-off-by: Juan Quintela <quintela@redhat.com>
+Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+(cherry picked from commit 4f5a09714c983a3471fd12e3c7f3196e95c650c1)
+Signed-off-by: Leonardo Bras <leobras@redhat.com>
+---
+ io/channel-socket.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/io/channel-socket.c b/io/channel-socket.c
+index 7d37b39de7..df858da924 100644
+--- a/io/channel-socket.c
+++ b/io/channel-socket.c
+@@ -612,6 +612,11 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
+                          "Unable to write to socket");
+         return -1;
+     }
+
+    if (flags & QIO_CHANNEL_WRITE_FLAG_ZERO_COPY) {
+        sioc->zero_copy_queued++;
+    }
+
+     return ret;
+ }
+ #else /* WIN32 */
+-- 
+2.35.3
+
--- a/SOURCES/kvm-QIOChannelSocket-Implement-io_writev-zero-copy-flag-.patch
+++ b/SOURCES/kvm-QIOChannelSocket-Implement-io_writev-zero-copy-flag-.patch
@ -0,0 +1,249 @@
+From 5fd7af93a06adaddbae719aabbaf912159f4fb28 Mon Sep 17 00:00:00 2001
+From: Leonardo Bras <leobras@redhat.com>
+Date: Wed, 18 May 2022 02:52:25 -0300
+Subject: [PATCH 18/37] QIOChannelSocket: Implement io_writev zero copy flag &
+ io_flush for CONFIG_LINUX
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Leonardo Brás <leobras@redhat.com>
+RH-MergeRequest: 191: MSG_ZEROCOPY + Multifd @ rhel8.7
+RH-Commit: [18/26] 6f65c8c879a5df57213b541d58285b65178f8547
+RH-Bugzilla: 2072049
+RH-Acked-by: Peter Xu <peterx@redhat.com>
+RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
+RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+
+For CONFIG_LINUX, implement the new zero copy flag and the optional callback
+io_flush on QIOChannelSocket, but enables it only when MSG_ZEROCOPY
+feature is available in the host kernel, which is checked on
+qio_channel_socket_connect_sync()
+
+qio_channel_socket_flush() was implemented by counting how many times
+sendmsg(...,MSG_ZEROCOPY) was successfully called, and then reading the
+socket's error queue, in order to find how many of them finished sending.
+Flush will loop until those counters are the same, or until some error occurs.
+
+Notes on using writev() with QIO_CHANNEL_WRITE_FLAG_ZERO_COPY:
+1: Buffer
+- As MSG_ZEROCOPY tells the kernel to use the same user buffer to avoid copying,
+some caution is necessary to avoid overwriting any buffer before it's sent.
+If something like this happen, a newer version of the buffer may be sent instead.
+- If this is a problem, it's recommended to call qio_channel_flush() before freeing
+or re-using the buffer.
+
+2: Locked memory
+- When using MSG_ZERCOCOPY, the buffer memory will be locked after queued, and
+unlocked after it's sent.
+- Depending on the size of each buffer, and how often it's sent, it may require
+a larger amount of locked memory than usually available to non-root user.
+- If the required amount of locked memory is not available, writev_zero_copy
+will return an error, which can abort an operation like migration,
+- Because of this, when an user code wants to add zero copy as a feature, it
+requires a mechanism to disable it, so it can still be accessible to less
+privileged users.
+
+Signed-off-by: Leonardo Bras <leobras@redhat.com>
+Reviewed-by: Peter Xu <peterx@redhat.com>
+Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
+Reviewed-by: Juan Quintela <quintela@redhat.com>
+Message-Id: <20220513062836.965425-4-leobras@redhat.com>
+Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+(cherry picked from commit 2bc58ffc2926a4efdd03edfb5909861fefc68c3d)
+Signed-off-by: Leonardo Bras <leobras@redhat.com>
+---
+ include/io/channel-socket.h |   2 +
+ io/channel-socket.c         | 116 ++++++++++++++++++++++++++++++++++--
+ 2 files changed, 114 insertions(+), 4 deletions(-)
+
+diff --git a/include/io/channel-socket.h b/include/io/channel-socket.h
+index e747e63514..513c428fe4 100644
+--- a/include/io/channel-socket.h
+++ b/include/io/channel-socket.h
+@@ -47,6 +47,8 @@ struct QIOChannelSocket {
+     socklen_t localAddrLen;
+     struct sockaddr_storage remoteAddr;
+     socklen_t remoteAddrLen;
+    ssize_t zero_copy_queued;
+    ssize_t zero_copy_sent;
+ };
+ 
+ 
+diff --git a/io/channel-socket.c b/io/channel-socket.c
+index bfbd64787e..38a46ba213 100644
+--- a/io/channel-socket.c
+++ b/io/channel-socket.c
+@@ -26,6 +26,14 @@
+ #include "io/channel-watch.h"
+ #include "trace.h"
+ #include "qapi/clone-visitor.h"
+#ifdef CONFIG_LINUX
+#include <linux/errqueue.h>
+#include <sys/socket.h>
+
+#if (defined(MSG_ZEROCOPY) && defined(SO_ZEROCOPY))
+#define QEMU_MSG_ZEROCOPY
+#endif
+#endif
+ 
+ #define SOCKET_MAX_FDS 16
+ 
+@@ -55,6 +63,8 @@ qio_channel_socket_new(void)
+ 
+     sioc = QIO_CHANNEL_SOCKET(object_new(TYPE_QIO_CHANNEL_SOCKET));
+     sioc->fd = -1;
+    sioc->zero_copy_queued = 0;
+    sioc->zero_copy_sent = 0;
+ 
+     ioc = QIO_CHANNEL(sioc);
+     qio_channel_set_feature(ioc, QIO_CHANNEL_FEATURE_SHUTDOWN);
+@@ -154,6 +164,16 @@ int qio_channel_socket_connect_sync(QIOChannelSocket *ioc,
+         return -1;
+     }
+ 
+#ifdef QEMU_MSG_ZEROCOPY
+    int ret, v = 1;
+    ret = setsockopt(fd, SOL_SOCKET, SO_ZEROCOPY, &v, sizeof(v));
+    if (ret == 0) {
+        /* Zero copy available on host */
+        qio_channel_set_feature(QIO_CHANNEL(ioc),
+                                QIO_CHANNEL_FEATURE_WRITE_ZERO_COPY);
+    }
+#endif
+
+     return 0;
+ }
+ 
+@@ -534,6 +554,7 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
+     char control[CMSG_SPACE(sizeof(int) * SOCKET_MAX_FDS)];
+     size_t fdsize = sizeof(int) * nfds;
+     struct cmsghdr *cmsg;
+    int sflags = 0;
+ 
+     memset(control, 0, CMSG_SPACE(sizeof(int) * SOCKET_MAX_FDS));
+ 
+@@ -558,15 +579,31 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
+         memcpy(CMSG_DATA(cmsg), fds, fdsize);
+     }
+ 
+#ifdef QEMU_MSG_ZEROCOPY
+    if (flags & QIO_CHANNEL_WRITE_FLAG_ZERO_COPY) {
+        sflags = MSG_ZEROCOPY;
+    }
+#endif
+
+  retry:
+-    ret = sendmsg(sioc->fd, &msg, 0);
+    ret = sendmsg(sioc->fd, &msg, sflags);
+     if (ret <= 0) {
+-        if (errno == EAGAIN) {
+        switch (errno) {
+        case EAGAIN:
+             return QIO_CHANNEL_ERR_BLOCK;
+-        }
+-        if (errno == EINTR) {
+        case EINTR:
+             goto retry;
+#ifdef QEMU_MSG_ZEROCOPY
+        case ENOBUFS:
+            if (sflags & MSG_ZEROCOPY) {
+                error_setg_errno(errp, errno,
+                                 "Process can't lock enough memory for using MSG_ZEROCOPY");
+                return -1;
+            }
+            break;
+#endif
+         }
+
+         error_setg_errno(errp, errno,
+                          "Unable to write to socket");
+         return -1;
+@@ -660,6 +697,74 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
+ }
+ #endif /* WIN32 */
+ 
+
+#ifdef QEMU_MSG_ZEROCOPY
+static int qio_channel_socket_flush(QIOChannel *ioc,
+                                    Error **errp)
+{
+    QIOChannelSocket *sioc = QIO_CHANNEL_SOCKET(ioc);
+    struct msghdr msg = {};
+    struct sock_extended_err *serr;
+    struct cmsghdr *cm;
+    char control[CMSG_SPACE(sizeof(*serr))];
+    int received;
+    int ret = 1;
+
+    msg.msg_control = control;
+    msg.msg_controllen = sizeof(control);
+    memset(control, 0, sizeof(control));
+
+    while (sioc->zero_copy_sent < sioc->zero_copy_queued) {
+        received = recvmsg(sioc->fd, &msg, MSG_ERRQUEUE);
+        if (received < 0) {
+            switch (errno) {
+            case EAGAIN:
+                /* Nothing on errqueue, wait until something is available */
+                qio_channel_wait(ioc, G_IO_ERR);
+                continue;
+            case EINTR:
+                continue;
+            default:
+                error_setg_errno(errp, errno,
+                                 "Unable to read errqueue");
+                return -1;
+            }
+        }
+
+        cm = CMSG_FIRSTHDR(&msg);
+        if (cm->cmsg_level != SOL_IP &&
+            cm->cmsg_type != IP_RECVERR) {
+            error_setg_errno(errp, EPROTOTYPE,
+                             "Wrong cmsg in errqueue");
+            return -1;
+        }
+
+        serr = (void *) CMSG_DATA(cm);
+        if (serr->ee_errno != SO_EE_ORIGIN_NONE) {
+            error_setg_errno(errp, serr->ee_errno,
+                             "Error on socket");
+            return -1;
+        }
+        if (serr->ee_origin != SO_EE_ORIGIN_ZEROCOPY) {
+            error_setg_errno(errp, serr->ee_origin,
+                             "Error not from zero copy");
+            return -1;
+        }
+
+        /* No errors, count successfully finished sendmsg()*/
+        sioc->zero_copy_sent += serr->ee_data - serr->ee_info + 1;
+
+        /* If any sendmsg() succeeded using zero copy, return 0 at the end */
+        if (serr->ee_code != SO_EE_CODE_ZEROCOPY_COPIED) {
+            ret = 0;
+        }
+    }
+
+    return ret;
+}
+
+#endif /* QEMU_MSG_ZEROCOPY */
+
+ static int
+ qio_channel_socket_set_blocking(QIOChannel *ioc,
+                                 bool enabled,
+@@ -789,6 +894,9 @@ static void qio_channel_socket_class_init(ObjectClass *klass,
+     ioc_klass->io_set_delay = qio_channel_socket_set_delay;
+     ioc_klass->io_create_watch = qio_channel_socket_create_watch;
+     ioc_klass->io_set_aio_fd_handler = qio_channel_socket_set_aio_fd_handler;
+#ifdef QEMU_MSG_ZEROCOPY
+    ioc_klass->io_flush = qio_channel_socket_flush;
+#endif
+ }
+ 
+ static const TypeInfo qio_channel_socket_info = {
+-- 
+2.35.3
+
--- a/SOURCES/kvm-QIOChannelSocket-Introduce-assert-and-reduce-ifdefs-.patch
+++ b/SOURCES/kvm-QIOChannelSocket-Introduce-assert-and-reduce-ifdefs-.patch
@ -0,0 +1,82 @@
+From cbfaf86331c2b2e01a2083303b7554672bf991b7 Mon Sep 17 00:00:00 2001
+From: Leonardo Bras <leobras@redhat.com>
+Date: Mon, 20 Jun 2022 02:39:42 -0300
+Subject: [PATCH 24/37] QIOChannelSocket: Introduce assert and reduce ifdefs to
+ improve readability
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Leonardo Brás <leobras@redhat.com>
+RH-MergeRequest: 191: MSG_ZEROCOPY + Multifd @ rhel8.7
+RH-Commit: [24/26] b50e2e65307149f247155a7f7a032dc99e57718d
+RH-Bugzilla: 2072049
+RH-Acked-by: Peter Xu <peterx@redhat.com>
+RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
+RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+
+During implementation of MSG_ZEROCOPY feature, a lot of #ifdefs were
+introduced, particularly at qio_channel_socket_writev().
+
+Rewrite some of those changes so it's easier to read.
+
+Also, introduce an assert to help detect incorrect zero-copy usage is when
+it's disabled on build.
+
+Signed-off-by: Leonardo Bras <leobras@redhat.com>
+Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
+Reviewed-by: Juan Quintela <quintela@redhat.com>
+Reviewed-by: Peter Xu <peterx@redhat.com>
+Signed-off-by: Juan Quintela <quintela@redhat.com>
+Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+  dgilbert: Fixed up thinko'd g_assert_unreachable->g_assert_not_reached
+(cherry picked from commit 803ca43e4c7fcf32f9f68c118301ccd0c83ece3f)
+Signed-off-by: Leonardo Bras <leobras@redhat.com>
+---
+ io/channel-socket.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/io/channel-socket.c b/io/channel-socket.c
+index 38a46ba213..7d37b39de7 100644
+--- a/io/channel-socket.c
+++ b/io/channel-socket.c
+@@ -579,11 +579,17 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
+         memcpy(CMSG_DATA(cmsg), fds, fdsize);
+     }
+ 
+-#ifdef QEMU_MSG_ZEROCOPY
+     if (flags & QIO_CHANNEL_WRITE_FLAG_ZERO_COPY) {
+#ifdef QEMU_MSG_ZEROCOPY
+         sflags = MSG_ZEROCOPY;
+-    }
+#else
+        /*
+         * We expect QIOChannel class entry point to have
+         * blocked this code path already
+         */
+        g_assert_not_reached();
+ #endif
+    }
+ 
+  retry:
+     ret = sendmsg(sioc->fd, &msg, sflags);
+@@ -593,15 +599,13 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
+             return QIO_CHANNEL_ERR_BLOCK;
+         case EINTR:
+             goto retry;
+-#ifdef QEMU_MSG_ZEROCOPY
+         case ENOBUFS:
+-            if (sflags & MSG_ZEROCOPY) {
+            if (flags & QIO_CHANNEL_WRITE_FLAG_ZERO_COPY) {
+                 error_setg_errno(errp, errno,
+                                  "Process can't lock enough memory for using MSG_ZEROCOPY");
+                 return -1;
+             }
+             break;
+-#endif
+         }
+ 
+         error_setg_errno(errp, errno,
+-- 
+2.35.3
+
--- a/SOURCES/kvm-RHEL-Enable-x-not-migrate-acpi-index-for-all-pre-RHE.patch
+++ b/SOURCES/kvm-RHEL-Enable-x-not-migrate-acpi-index-for-all-pre-RHE.patch
@ -0,0 +1,42 @@
+From adbbc64db535d84fc24b576888f834841f54e8d3 Mon Sep 17 00:00:00 2001
+From: Peter Xu <peterx@redhat.com>
+Date: Wed, 6 Sep 2023 16:29:23 -0400
+Subject: [PATCH 2/2] RHEL: Enable "x-not-migrate-acpi-index" for all pre-RHEL8
+ guests
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Peter Xu <peterx@redhat.com>
+RH-MergeRequest: 317: acpi: fix acpi_index migration
+RH-Jira: RHEL-2186
+RH-Acked-by: Ani Sinha <None>
+RH-Acked-by: Leonardo Brás <leobras@redhat.com>
+RH-Commit: [2/2] 961eee71e6f563aadf4a93082cd384d765d3e73b
+
+The acpi index migration is simply broken before for all pre-RHEL8
+branches.  Don't migrate it for all of them.
+
+Signed-off-by: Peter Xu <peterx@redhat.com>
+---
+ hw/core/machine.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/hw/core/machine.c b/hw/core/machine.c
+index 2724f6848a..6650a3d7b7 100644
+--- a/hw/core/machine.c
+++ b/hw/core/machine.c
+@@ -44,6 +44,10 @@ GlobalProperty hw_compat_rhel_8_6[] = {
+      * we need do disable it downstream on the latest hw_compat_rhel_8.
+      */
+     { "vhost-vsock-device", "seqpacket", "off" },
+    /*
+     * RHEL-2186: all rhel8 machines should not migrate acpi index.
+     */
+    { "PIIX4_PM", "x-not-migrate-acpi-index", "on"},
+ };
+ const size_t hw_compat_rhel_8_6_len = G_N_ELEMENTS(hw_compat_rhel_8_6);
+ 
+-- 
+2.37.3
+
--- a/SOURCES/kvm-RHEL-disable-seqpacket-for-vhost-vsock-device-in-rhe.patch
+++ b/SOURCES/kvm-RHEL-disable-seqpacket-for-vhost-vsock-device-in-rhe.patch
@ -0,0 +1,107 @@
+From e0e4f01c6f4fb5881960f72ae4e80951b711131e Mon Sep 17 00:00:00 2001
+From: Stefano Garzarella <sgarzare@redhat.com>
+Date: Thu, 24 Mar 2022 16:04:57 +0100
+Subject: [PATCH 1/5] RHEL: disable "seqpacket" for "vhost-vsock-device" in
+ rhel8.6.0
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Stefano Garzarella <sgarzare@redhat.com>
+RH-MergeRequest: 136: RHEL: disable "seqpacket" for "vhost-vsock-device" in rhel8.6.0 [rhel-8.7.0]
+RH-Commit: [1/1] d82ea09e123679521503689f7d9af1c03dc71bfc
+RH-Bugzilla: 2068202
+RH-Acked-by: Jason Wang <None>
+RH-Acked-by: Eugenio Pérez <None>
+RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+
+vhost-vsock device in RHEL 8 kernels doesn't support seqpacket.
+To avoid problems when migrating a VM from RHEL 9 host, we need to
+disable it in rhel8-* machine types.
+
+Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
+---
+ hw/core/machine.c          | 10 ++++++++++
+ hw/i386/pc_piix.c          |  2 ++
+ hw/i386/pc_q35.c           |  2 ++
+ hw/s390x/s390-virtio-ccw.c |  1 +
+ include/hw/boards.h        |  3 +++
+ 5 files changed, 18 insertions(+)
+
+diff --git a/hw/core/machine.c b/hw/core/machine.c
+index 024b025fc2..76fcabec7a 100644
+--- a/hw/core/machine.c
+++ b/hw/core/machine.c
+@@ -37,6 +37,16 @@
+ #include "hw/virtio/virtio.h"
+ #include "hw/virtio/virtio-pci.h"
+ 
+GlobalProperty hw_compat_rhel_8_6[] = {
+    /* hw_compat_rhel_8_6 bz 2068202 */
+    /*
+     * vhost-vsock device in RHEL 8 kernels doesn't support seqpacket, so
+     * we need do disable it downstream on the latest hw_compat_rhel_8.
+     */
+    { "vhost-vsock-device", "seqpacket", "off" },
+};
+const size_t hw_compat_rhel_8_6_len = G_N_ELEMENTS(hw_compat_rhel_8_6);
+
+ /*
+  * Mostly the same as hw_compat_6_0 and hw_compat_6_1
+  */
+diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
+index f03a8f0db8..ab6d03e07a 100644
+--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
+@@ -998,6 +998,8 @@ static void pc_machine_rhel760_options(MachineClass *m)
+     pcmc->kvmclock_create_always = false;
+     /* From pc_i440fx_5_1_machine_options() */
+     pcmc->pci_root_uid = 1;
+    compat_props_add(m->compat_props, hw_compat_rhel_8_6,
+                     hw_compat_rhel_8_6_len);
+     compat_props_add(m->compat_props, hw_compat_rhel_8_5,
+                      hw_compat_rhel_8_5_len);
+     compat_props_add(m->compat_props, pc_rhel_8_5_compat,
+diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
+index 5559261d9e..882fe7a68d 100644
+--- a/hw/i386/pc_q35.c
+++ b/hw/i386/pc_q35.c
+@@ -658,6 +658,8 @@ static void pc_q35_machine_rhel860_options(MachineClass *m)
+     m->desc = "RHEL-8.6.0 PC (Q35 + ICH9, 2009)";
+     pcmc->smbios_stream_product = "RHEL-AV";
+     pcmc->smbios_stream_version = "8.6.0";
+    compat_props_add(m->compat_props, hw_compat_rhel_8_6,
+                     hw_compat_rhel_8_6_len);
+ }
+ 
+ DEFINE_PC_MACHINE(q35_rhel860, "pc-q35-rhel8.6.0", pc_q35_init_rhel860,
+diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
+index 9795eb9406..bec270598b 100644
+--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
+@@ -1109,6 +1109,7 @@ static void ccw_machine_rhel860_instance_options(MachineState *machine)
+ 
+ static void ccw_machine_rhel860_class_options(MachineClass *mc)
+ {
+    compat_props_add(mc->compat_props, hw_compat_rhel_8_6, hw_compat_rhel_8_6_len);
+ }
+ DEFINE_CCW_MACHINE(rhel860, "rhel8.6.0", true);
+ 
+diff --git a/include/hw/boards.h b/include/hw/boards.h
+index 04e8759815..4ddb798144 100644
+--- a/include/hw/boards.h
+++ b/include/hw/boards.h
+@@ -443,6 +443,9 @@ extern const size_t hw_compat_2_2_len;
+ extern GlobalProperty hw_compat_2_1[];
+ extern const size_t hw_compat_2_1_len;
+ 
+extern GlobalProperty hw_compat_rhel_8_6[];
+extern const size_t hw_compat_rhel_8_6_len;
+
+ extern GlobalProperty hw_compat_rhel_8_5[];
+ extern const size_t hw_compat_rhel_8_5_len;
+ 
+-- 
+2.27.0
+
--- a/SOURCES/kvm-Revert-redhat-Add-hw_compat_4_2_extra-and-apply-to-u.patch
+++ b/SOURCES/kvm-Revert-redhat-Add-hw_compat_4_2_extra-and-apply-to-u.patch
@ -0,0 +1,93 @@
+From e626dc16d130c724c400b99a93daad0a9abeae59 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 22 Mar 2022 19:23:36 -0400
+Subject: [PATCH 01/18] Revert "redhat: Add hw_compat_4_2_extra and apply to
+ upstream machines"
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 131: Revert "redhat: Add hw_compat_4_2_extra and apply to upstream machines"
+RH-Commit: [1/3] 47b7d9e5062f5e215d5ed1a3ecdc1a87ac3fa630 (jmaloy/qemu-kvm)
+RH-Bugzilla: 2062613
+RH-Acked-by: Peter Xu <peterx@redhat.com>
+RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+
+BZ: https://bugzilla.redhat.com/2062613
+UPSTREAM: no
+BREW: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=44038000
+
+commit dc2e9ec1e014950c7918e23a3e9b0096b34a4a92
+Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
+Date:   Wed Mar 9 10:31:53 2022 +0000
+
+    Revert "redhat: Add hw_compat_4_2_extra and apply to upstream machines"
+
+    This reverts commit 66882f9a3230246409f3918424aca26add5c034a.
+    We no longer need these compat machines it was added for.
+
+    Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+
+(cherry picked from commit dc2e9ec1e014950c7918e23a3e9b0096b34a4a92)
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ hw/i386/pc.c         | 12 ------------
+ hw/i386/pc_piix.c    |  6 ------
+ include/hw/i386/pc.h |  3 ---
+ 3 files changed, 21 deletions(-)
+
+diff --git a/hw/i386/pc.c b/hw/i386/pc.c
+index 4c08a1971c..357257349b 100644
+--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
+@@ -670,18 +670,6 @@ GlobalProperty pc_rhel_7_0_compat[] = {
+ };
+ const size_t pc_rhel_7_0_compat_len = G_N_ELEMENTS(pc_rhel_7_0_compat);
+ 
+-/*
+- * RHEL: These properties only apply to the RHEL exported machine types
+- * pc-4.2/2.11 for the purpose to have a limited upstream machines support
+- * which can be migrated to RHEL.  Let's avoid touching hw_compat_4_2 directly
+- * so that we can have some isolation against the upstream code.
+- */
+-GlobalProperty hw_compat_4_2_extra[] = {
+-    /* By default enlarge the default virtio-net-pci ROM to 512KB. */
+-    { "virtio-net-pci", "romsize", "0x80000" },
+-};
+-const size_t hw_compat_4_2_extra_len = G_N_ELEMENTS(hw_compat_4_2_extra);
+-
+ GSIState *pc_gsi_create(qemu_irq **irqs, bool pci_enabled)
+ {
+     GSIState *s;
+diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
+index c30057c443..7b7076cbc7 100644
+--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
+@@ -531,12 +531,6 @@ static void pc_i440fx_4_2_machine_options(MachineClass *m)
+      * supported by RHEL, even if exported.
+      */
+     m->deprecation_reason = "Not supported by RHEL";
+-    /*
+-     * RHEL: Specific compat properties to have limited support for upstream
+-     * machines exported.
+-     */
+-    compat_props_add(m->compat_props, hw_compat_4_2_extra,
+-                     hw_compat_4_2_extra_len);
+ }
+ 
+ /* RHEL: Export pc-4.2 */
+diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
+index 9e8bfb69f8..4a593acb50 100644
+--- a/include/hw/i386/pc.h
+++ b/include/hw/i386/pc.h
+@@ -325,9 +325,6 @@ extern const size_t pc_rhel_7_1_compat_len;
+ extern GlobalProperty pc_rhel_7_0_compat[];
+ extern const size_t pc_rhel_7_0_compat_len;
+ 
+-extern GlobalProperty hw_compat_4_2_extra[];
+-extern const size_t hw_compat_4_2_extra_len;
+-
+ /* Helper for setting model-id for CPU models that changed model-id
+  * depending on QEMU versions up to QEMU 2.4.
+  */
+-- 
+2.27.0
+
--- a/SOURCES/kvm-Revert-redhat-Add-some-devices-for-exporting-upstrea.patch
+++ b/SOURCES/kvm-Revert-redhat-Add-some-devices-for-exporting-upstrea.patch
@ -0,0 +1,128 @@
+From 96edd15df257f1d1496397a6fac24b4316570d7e Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Thu, 14 Apr 2022 16:45:30 -0400
+Subject: [PATCH 1/3] Revert redhat: Add some devices for exporting upstream
+ machine types
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 156: Revert redhat: Add some devices for exporting upstream machine types
+RH-Commit: [1/1] f25d0da3a181136917ead82f5a5c59efe3fa445a (jmaloy/qemu-kvm)
+RH-Bugzilla: 2065043
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Peter Xu <peterx@redhat.com>
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2065043
+Upstream: no
+
+Manual revert of commit 70d3924521c9bfd912bcf1a1fc76f49eb377de46, since
+the directory structure looks different from rhel-av-8.4.0.z where
+this commit is taken from. Besides, x86_64-softmmu.mak looks totally
+different and should not be affected by this reversal.
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ configs/devices/x86_64-softmmu/x86_64-rh-devices.mak     | 1 -
+ .../devices/x86_64-softmmu/x86_64-upstream-devices.mak   | 4 ----
+ hw/char/parallel.c                                       | 9 ---------
+ hw/i386/pc_piix.c                                        | 2 +-
+ hw/i386/pc_q35.c                                         | 2 +-
+ hw/timer/hpet.c                                          | 8 --------
+ 6 files changed, 2 insertions(+), 24 deletions(-)
+ delete mode 100644 configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak
+
+diff --git a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
+index fdbbdf9742..31ce08edab 100644
+--- a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
+++ b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
+@@ -1,5 +1,4 @@
+ include ../rh-virtio.mak
+-include x86_64-upstream-devices.mak
+ 
+ CONFIG_AC97=y
+ CONFIG_ACPI=y
+diff --git a/configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak b/configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak
+deleted file mode 100644
+index 2cd20f54d2..0000000000
+--- a/configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak
+++ /dev/null
+@@ -1,4 +0,0 @@
+-# We need "isa-parallel"
+-CONFIG_PARALLEL=y
+-# We need "hpet"
+-CONFIG_HPET=y
+diff --git a/hw/char/parallel.c b/hw/char/parallel.c
+index e5f108211b..b45e67bfbb 100644
+--- a/hw/char/parallel.c
+++ b/hw/char/parallel.c
+@@ -29,7 +29,6 @@
+ #include "chardev/char-parallel.h"
+ #include "chardev/char-fe.h"
+ #include "hw/acpi/aml-build.h"
+-#include "hw/boards.h"
+ #include "hw/irq.h"
+ #include "hw/isa/isa.h"
+ #include "hw/qdev-properties.h"
+@@ -535,14 +534,6 @@ static void parallel_isa_realizefn(DeviceState *dev, Error **errp)
+     int base;
+     uint8_t dummy;
+ 
+-    /* Restricted for Red Hat Enterprise Linux */
+-    MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
+-    if (strstr(mc->name, "rhel")) {
+-        error_setg(errp, "Device %s is not supported with machine type %s",
+-                   object_get_typename(OBJECT(dev)), mc->name);
+-        return;
+-    }
+-
+     if (!qemu_chr_fe_backend_connected(&s->chr)) {
+         error_setg(errp, "Can't create parallel device, empty char device");
+         return;
+diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
+index ab6d03e07a..5f101c8748 100644
+--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
+@@ -966,7 +966,7 @@ static void pc_machine_rhel7_options(MachineClass *m)
+ {
+     PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
+     m->family = "pc_piix_Y";
+-    m->default_machine_opts = "firmware=bios-256k.bin,hpet=off";
+    m->default_machine_opts = "firmware=bios-256k.bin";
+     pcmc->default_nic_model = "e1000";
+     pcmc->pci_root_uid = 0;
+     m->default_display = "std";
+diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
+index 882fe7a68d..73b0d0d317 100644
+--- a/hw/i386/pc_q35.c
+++ b/hw/i386/pc_q35.c
+@@ -633,7 +633,7 @@ static void pc_q35_machine_rhel_options(MachineClass *m)
+     pcmc->pci_root_uid = 0;
+     m->family = "pc_q35_Z";
+     m->units_per_default_bus = 1;
+-    m->default_machine_opts = "firmware=bios-256k.bin,hpet=off";
+    m->default_machine_opts = "firmware=bios-256k.bin";
+     m->default_display = "std";
+     m->no_floppy = 1;
+     m->no_parallel = 1;
+diff --git a/hw/timer/hpet.c b/hw/timer/hpet.c
+index 202e032524..9520471be2 100644
+--- a/hw/timer/hpet.c
+++ b/hw/timer/hpet.c
+@@ -733,14 +733,6 @@ static void hpet_realize(DeviceState *dev, Error **errp)
+     int i;
+     HPETTimer *timer;
+ 
+-    /* Restricted for Red Hat Enterprise Linux */
+-    MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
+-    if (strstr(mc->name, "rhel")) {
+-        error_setg(errp, "Device %s is not supported with machine type %s",
+-                   object_get_typename(OBJECT(dev)), mc->name);
+-        return;
+-    }
+-
+     if (!s->intcap) {
+         warn_report("Hpet's intcap not initialized");
+     }
+-- 
+2.35.1
+
--- a/SOURCES/kvm-Revert-redhat-Enable-FDC-device-for-upstream-machine.patch
+++ b/SOURCES/kvm-Revert-redhat-Enable-FDC-device-for-upstream-machine.patch
@ -0,0 +1,53 @@
+From 5bf8f1d69fea1225e927fbb3efe549a2a9d47d92 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 22 Mar 2022 19:23:36 -0400
+Subject: [PATCH 02/18] Revert "redhat: Enable FDC device for upstream machines
+ too"
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 131: Revert "redhat: Add hw_compat_4_2_extra and apply to upstream machines"
+RH-Commit: [2/3] 4e3c945e3de9bb9d9a6d24115f0719168c9669fe (jmaloy/qemu-kvm)
+RH-Bugzilla: 2062613
+RH-Acked-by: Peter Xu <peterx@redhat.com>
+RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+
+BZ: https://bugzilla.redhat.com/2062613
+UPSTREAM: no
+BREW: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=44038000
+
+commit 597cb6ca1da4a3eea77c1e4928f55203a1d5c70c
+Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
+Date:   Wed Mar 9 10:32:39 2022 +0000
+
+    Revert "redhat: Enable FDC device for upstream machines too"
+
+    This reverts commit c4d1aa8bf21fe98da94a9cff30b7c25bed12c17f.
+    We no longer need these compat machines it was added for.
+
+  Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+
+(cherry picked from commit 597cb6ca1da4a3eea77c1e4928f55203a1d5c70c)
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ hw/block/fdc.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/hw/block/fdc.c b/hw/block/fdc.c
+index 63042ef030..97fa6de423 100644
+--- a/hw/block/fdc.c
+++ b/hw/block/fdc.c
+@@ -2341,10 +2341,7 @@ void fdctrl_realize_common(DeviceState *dev, FDCtrl *fdctrl, Error **errp)
+ 
+     /* Restricted for Red Hat Enterprise Linux: */
+     MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
+-    if (!strstr(mc->name, "-rhel7.") &&
+-        /* Exported two upstream machine types allows FDC too */
+-        strcmp(mc->name, "pc-i440fx-4.2") &&
+-        strcmp(mc->name, "pc-i440fx-2.11")) {
+    if (!strstr(mc->name, "-rhel7.")) {
+         error_setg(errp, "Device %s is not supported with machine type %s",
+                    object_get_typename(OBJECT(dev)), mc->name);
+         return;
+-- 
+2.27.0
+
--- a/SOURCES/kvm-Revert-redhat-Expose-upstream-machines-pc-4.2-and-pc.patch
+++ b/SOURCES/kvm-Revert-redhat-Expose-upstream-machines-pc-4.2-and-pc.patch
@ -0,0 +1,191 @@
+From ee3cae3bb349469edcf725a1c5161521e95dcb9f Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 22 Mar 2022 19:23:36 -0400
+Subject: [PATCH 03/18] Revert "redhat: Expose upstream machines pc-4.2 and
+ pc-2.11"
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 131: Revert "redhat: Add hw_compat_4_2_extra and apply to upstream machines"
+RH-Commit: [3/3] 35cee68034580f81b3aa916921eecd2fdfa7dd15 (jmaloy/qemu-kvm)
+RH-Bugzilla: 2062613
+RH-Acked-by: Peter Xu <peterx@redhat.com>
+RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+
+BZ: https://bugzilla.redhat.com/2062613
+UPSTREAM: no
+BREW: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=44038000
+
+commit f3b50d6d4ae0be9e64aafe6a15f5423bab4899e9
+Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
+Date:   Wed Mar 9 10:34:58 2022 +0000
+
+    Revert "redhat: Expose upstream machines pc-4.2 and pc-2.11"
+    This reverts commit 618e2424edba499d52cd26cf8363bc2dd85ef149.
+    We no longer need these compat machines.
+
+    Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+
+(cherry picked from commit f3b50d6d4ae0be9e64aafe6a15f5423bab4899e9)
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ hw/i386/pc_piix.c | 37 -------------------------------------
+ 1 file changed, 37 deletions(-)
+
+diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
+index 7b7076cbc7..f03a8f0db8 100644
+--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
+@@ -315,14 +315,6 @@ static void pc_init1(MachineState *machine,
+  * hw_compat_*, pc_compat_*, or * pc_*_machine_options().
+  */
+ 
+-/*
+- * NOTE!  Not all the upstream machine types are disabled for RHEL.  For
+- * providing a very limited support for upstream machine types, pc machines
+- * 2.11 and 4.2 are exposed explicitly.  This will make the below "#if" macros
+- * a bit messed up, but please read this comment first so that we can have a
+- * rough understanding of what we're going to do.
+- */
+-
+ #if 0 /* Disabled for Red Hat Enterprise Linux */
+ static void pc_compat_2_3_fn(MachineState *machine)
+ {
+@@ -399,8 +391,6 @@ static void pc_xen_hvm_init(MachineState *machine)
+ }
+ #endif
+ 
+-#endif /* Disabled for Red Hat Enterprise Linux */
+-
+ #define DEFINE_I440FX_MACHINE(suffix, name, compatfn, optionfn) \
+     static void pc_init_##suffix(MachineState *machine) \
+     { \
+@@ -465,10 +455,8 @@ static void pc_i440fx_6_0_machine_options(MachineClass *m)
+     compat_props_add(m->compat_props, pc_compat_6_0, pc_compat_6_0_len);
+ }
+ 
+-#if 0 /* Disabled for Red Hat Enterprise Linux */
+ DEFINE_I440FX_MACHINE(v6_0, "pc-i440fx-6.0", NULL,
+                       pc_i440fx_6_0_machine_options);
+-#endif /* Disabled for Red Hat Enterprise Linux */
+ 
+ static void pc_i440fx_5_2_machine_options(MachineClass *m)
+ {
+@@ -479,10 +467,8 @@ static void pc_i440fx_5_2_machine_options(MachineClass *m)
+     compat_props_add(m->compat_props, pc_compat_5_2, pc_compat_5_2_len);
+ }
+ 
+-#if 0 /* Disabled for Red Hat Enterprise Linux */
+ DEFINE_I440FX_MACHINE(v5_2, "pc-i440fx-5.2", NULL,
+                       pc_i440fx_5_2_machine_options);
+-#endif /* Disabled for Red Hat Enterprise Linux */
+ 
+ static void pc_i440fx_5_1_machine_options(MachineClass *m)
+ {
+@@ -497,10 +483,8 @@ static void pc_i440fx_5_1_machine_options(MachineClass *m)
+     pcmc->pci_root_uid = 1;
+ }
+ 
+-#if 0 /* Disabled for Red Hat Enterprise Linux */
+ DEFINE_I440FX_MACHINE(v5_1, "pc-i440fx-5.1", NULL,
+                       pc_i440fx_5_1_machine_options);
+-#endif /* Disabled for Red Hat Enterprise Linux */
+ 
+ static void pc_i440fx_5_0_machine_options(MachineClass *m)
+ {
+@@ -513,10 +497,8 @@ static void pc_i440fx_5_0_machine_options(MachineClass *m)
+     m->auto_enable_numa_with_memdev = false;
+ }
+ 
+-#if 0 /* Disabled for Red Hat Enterprise Linux */
+ DEFINE_I440FX_MACHINE(v5_0, "pc-i440fx-5.0", NULL,
+                       pc_i440fx_5_0_machine_options);
+-#endif /* Disabled for Red Hat Enterprise Linux */
+ 
+ static void pc_i440fx_4_2_machine_options(MachineClass *m)
+ {
+@@ -525,15 +507,8 @@ static void pc_i440fx_4_2_machine_options(MachineClass *m)
+     m->is_default = false;
+     compat_props_add(m->compat_props, hw_compat_4_2, hw_compat_4_2_len);
+     compat_props_add(m->compat_props, pc_compat_4_2, pc_compat_4_2_len);
+-
+-    /*
+-     * RHEL: Mark all upstream machines as deprecated because they're not
+-     * supported by RHEL, even if exported.
+-     */
+-    m->deprecation_reason = "Not supported by RHEL";
+ }
+ 
+-/* RHEL: Export pc-4.2 */
+ DEFINE_I440FX_MACHINE(v4_2, "pc-i440fx-4.2", NULL,
+                       pc_i440fx_4_2_machine_options);
+ 
+@@ -546,10 +521,8 @@ static void pc_i440fx_4_1_machine_options(MachineClass *m)
+     compat_props_add(m->compat_props, pc_compat_4_1, pc_compat_4_1_len);
+ }
+ 
+-#if 0 /* Disabled for Red Hat Enterprise Linux */
+ DEFINE_I440FX_MACHINE(v4_1, "pc-i440fx-4.1", NULL,
+                       pc_i440fx_4_1_machine_options);
+-#endif /* Disabled for Red Hat Enterprise Linux */
+ 
+ static void pc_i440fx_4_0_machine_options(MachineClass *m)
+ {
+@@ -562,10 +535,8 @@ static void pc_i440fx_4_0_machine_options(MachineClass *m)
+     compat_props_add(m->compat_props, pc_compat_4_0, pc_compat_4_0_len);
+ }
+ 
+-#if 0 /* Disabled for Red Hat Enterprise Linux */
+ DEFINE_I440FX_MACHINE(v4_0, "pc-i440fx-4.0", NULL,
+                       pc_i440fx_4_0_machine_options);
+-#endif /* Disabled for Red Hat Enterprise Linux */
+ 
+ static void pc_i440fx_3_1_machine_options(MachineClass *m)
+ {
+@@ -581,10 +552,8 @@ static void pc_i440fx_3_1_machine_options(MachineClass *m)
+     compat_props_add(m->compat_props, pc_compat_3_1, pc_compat_3_1_len);
+ }
+ 
+-#if 0 /* Disabled for Red Hat Enterprise Linux */
+ DEFINE_I440FX_MACHINE(v3_1, "pc-i440fx-3.1", NULL,
+                       pc_i440fx_3_1_machine_options);
+-#endif /* Disabled for Red Hat Enterprise Linux */
+ 
+ static void pc_i440fx_3_0_machine_options(MachineClass *m)
+ {
+@@ -593,10 +562,8 @@ static void pc_i440fx_3_0_machine_options(MachineClass *m)
+     compat_props_add(m->compat_props, pc_compat_3_0, pc_compat_3_0_len);
+ }
+ 
+-#if 0 /* Disabled for Red Hat Enterprise Linux */
+ DEFINE_I440FX_MACHINE(v3_0, "pc-i440fx-3.0", NULL,
+                       pc_i440fx_3_0_machine_options);
+-#endif /* Disabled for Red Hat Enterprise Linux */
+ 
+ static void pc_i440fx_2_12_machine_options(MachineClass *m)
+ {
+@@ -605,10 +572,8 @@ static void pc_i440fx_2_12_machine_options(MachineClass *m)
+     compat_props_add(m->compat_props, pc_compat_2_12, pc_compat_2_12_len);
+ }
+ 
+-#if 0 /* Disabled for Red Hat Enterprise Linux */
+ DEFINE_I440FX_MACHINE(v2_12, "pc-i440fx-2.12", NULL,
+                       pc_i440fx_2_12_machine_options);
+-#endif /* Disabled for Red Hat Enterprise Linux */
+ 
+ static void pc_i440fx_2_11_machine_options(MachineClass *m)
+ {
+@@ -617,11 +582,9 @@ static void pc_i440fx_2_11_machine_options(MachineClass *m)
+     compat_props_add(m->compat_props, pc_compat_2_11, pc_compat_2_11_len);
+ }
+ 
+-/* RHEL: Export pc-2.11 */
+ DEFINE_I440FX_MACHINE(v2_11, "pc-i440fx-2.11", NULL,
+                       pc_i440fx_2_11_machine_options);
+ 
+-#if 0 /* Disabled for Red Hat Enterprise Linux */
+ static void pc_i440fx_2_10_machine_options(MachineClass *m)
+ {
+     pc_i440fx_2_11_machine_options(m);
+-- 
+2.27.0
+
--- a/SOURCES/kvm-Revert-vhost-user-Introduce-nested-event-loop-in-vho.patch
+++ b/SOURCES/kvm-Revert-vhost-user-Introduce-nested-event-loop-in-vho.patch
@ -1,140 +0,0 @@
-From 0c19fb7c4a22a30830152b224b2e66963f829a7a Mon Sep 17 00:00:00 2001
-From: Greg Kurz <groug@kaod.org>
-Date: Thu, 19 Jan 2023 18:24:24 +0100
-Subject: [PATCH 19/20] Revert "vhost-user: Introduce nested event loop in
- vhost_user_read()"
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Laurent Vivier <lvivier@redhat.com>
-RH-MergeRequest: 146: Fix vhost-user with dpdk
-RH-Bugzilla: 2155173
-RH-Acked-by: Cindy Lu <lulu@redhat.com>
-RH-Acked-by: Greg Kurz (RH) <gkurz@redhat.com>
-RH-Acked-by: Eugenio Pérez <eperezma@redhat.com>
-RH-Commit: [2/2] 9b67041f92f29f70b7ccb41d8087801e4e4e38af (lvivier/qemu-kvm-centos)
-
-This reverts commit a7f523c7d114d445c5d83aecdba3efc038e5a692.
-
-The nested event loop is broken by design. It's only user was removed.
-Drop the code as well so that nobody ever tries to use it again.
-
-I had to fix a couple of trivial conflicts around return values because
-of 025faa872bcf ("vhost-user: stick to -errno error return convention").
-
-Signed-off-by: Greg Kurz <groug@kaod.org>
-Message-Id: <20230119172424.478268-3-groug@kaod.org>
-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
-Acked-by: Maxime Coquelin <maxime.coquelin@redhat.com>
-(cherry picked from commit 4382138f642f69fdbc79ebf4e93d84be8061191f)
-Signed-off-by: Laurent Vivier <lvivier@redhat.com>
---
- hw/virtio/vhost-user.c | 65 ++++--------------------------------------
- 1 file changed, 5 insertions(+), 60 deletions(-)
-
-diff --git a/hw/virtio/vhost-user.c b/hw/virtio/vhost-user.c
-index 0ac00eb901..7cb49c50f9 100644
--- a/hw/virtio/vhost-user.c
-+++ b/hw/virtio/vhost-user.c
-@@ -305,19 +305,8 @@ static int vhost_user_read_header(struct vhost_dev *dev, VhostUserMsg *msg)
-     return 0;
- }
- 
-struct vhost_user_read_cb_data {
-    struct vhost_dev *dev;
-    VhostUserMsg *msg;
-    GMainLoop *loop;
-    int ret;
-};
-
-static gboolean vhost_user_read_cb(void *do_not_use, GIOCondition condition,
-                                   gpointer opaque)
-+static int vhost_user_read(struct vhost_dev *dev, VhostUserMsg *msg)
- {
-    struct vhost_user_read_cb_data *data = opaque;
-    struct vhost_dev *dev = data->dev;
-    VhostUserMsg *msg = data->msg;
-     struct vhost_user *u = dev->opaque;
-     CharBackend *chr = u->user->chr;
-     uint8_t *p = (uint8_t *) msg;
-@@ -325,8 +314,7 @@ static gboolean vhost_user_read_cb(void *do_not_use, GIOCondition condition,
- 
-     r = vhost_user_read_header(dev, msg);
-     if (r < 0) {
-        data->ret = r;
-        goto end;
-+        return r;
-     }
- 
-     /* validate message size is sane */
-@@ -334,8 +322,7 @@ static gboolean vhost_user_read_cb(void *do_not_use, GIOCondition condition,
-         error_report("Failed to read msg header."
-                 " Size %d exceeds the maximum %zu.", msg->hdr.size,
-                 VHOST_USER_PAYLOAD_SIZE);
-        data->ret = -EPROTO;
-        goto end;
-+        return -EPROTO;
-     }
- 
-     if (msg->hdr.size) {
-@@ -346,53 +333,11 @@ static gboolean vhost_user_read_cb(void *do_not_use, GIOCondition condition,
-             int saved_errno = errno;
-             error_report("Failed to read msg payload."
-                          " Read %d instead of %d.", r, msg->hdr.size);
-            data->ret = r < 0 ? -saved_errno : -EIO;
-            goto end;
-+            return r < 0 ? -saved_errno : -EIO;
-         }
-     }
- 
-end:
-    g_main_loop_quit(data->loop);
-    return G_SOURCE_REMOVE;
-}
-
-static int vhost_user_read(struct vhost_dev *dev, VhostUserMsg *msg)
-{
-    struct vhost_user *u = dev->opaque;
-    CharBackend *chr = u->user->chr;
-    GMainContext *prev_ctxt = chr->chr->gcontext;
-    GMainContext *ctxt = g_main_context_new();
-    GMainLoop *loop = g_main_loop_new(ctxt, FALSE);
-    struct vhost_user_read_cb_data data = {
-        .dev = dev,
-        .loop = loop,
-        .msg = msg,
-        .ret = 0
-    };
-
-    /*
-     * We want to be able to monitor the slave channel fd while waiting
-     * for chr I/O. This requires an event loop, but we can't nest the
-     * one to which chr is currently attached : its fd handlers might not
-     * be prepared for re-entrancy. So we create a new one and switch chr
-     * to use it.
-     */
-    qemu_chr_be_update_read_handlers(chr->chr, ctxt);
-    qemu_chr_fe_add_watch(chr, G_IO_IN | G_IO_HUP, vhost_user_read_cb, &data);
-
-    g_main_loop_run(loop);
-
-    /*
-     * Restore the previous event loop context. This also destroys/recreates
-     * event sources : this guarantees that all pending events in the original
-     * context that have been processed by the nested loop are purged.
-     */
-    qemu_chr_be_update_read_handlers(chr->chr, prev_ctxt);
-
-    g_main_loop_unref(loop);
-    g_main_context_unref(ctxt);
-
-    return data.ret;
-+    return 0;
- }
- 
- static int process_message_reply(struct vhost_dev *dev,
-- 
-2.31.1
-
--- a/SOURCES/kvm-Revert-vhost-user-Monitor-slave-channel-in-vhost_use.patch
+++ b/SOURCES/kvm-Revert-vhost-user-Monitor-slave-channel-in-vhost_use.patch
@ -1,143 +0,0 @@
-From 9fb47ad317ad8cdda9960190d499ad6c3a9817f0 Mon Sep 17 00:00:00 2001
-From: Greg Kurz <groug@kaod.org>
-Date: Thu, 19 Jan 2023 18:24:23 +0100
-Subject: [PATCH 18/20] Revert "vhost-user: Monitor slave channel in
- vhost_user_read()"
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Laurent Vivier <lvivier@redhat.com>
-RH-MergeRequest: 146: Fix vhost-user with dpdk
-RH-Bugzilla: 2155173
-RH-Acked-by: Cindy Lu <lulu@redhat.com>
-RH-Acked-by: Greg Kurz (RH) <gkurz@redhat.com>
-RH-Acked-by: Eugenio Pérez <eperezma@redhat.com>
-RH-Commit: [1/2] c583a7f121ca9c93c9a2ad17bf0ccf5c1241dc99 (lvivier/qemu-kvm-centos)
-
-This reverts commit db8a3772e300c1a656331a92da0785d81667dc81.
-
-Motivation : this is breaking vhost-user with DPDK as reported in [0].
-
-Received unexpected msg type. Expected 22 received 40
-Fail to update device iotlb
-Received unexpected msg type. Expected 40 received 22
-Received unexpected msg type. Expected 22 received 11
-Fail to update device iotlb
-Received unexpected msg type. Expected 11 received 22
-vhost VQ 1 ring restore failed: -71: Protocol error (71)
-Received unexpected msg type. Expected 22 received 11
-Fail to update device iotlb
-Received unexpected msg type. Expected 11 received 22
-vhost VQ 0 ring restore failed: -71: Protocol error (71)
-unable to start vhost net: 71: falling back on userspace virtio
-
-The failing sequence that leads to the first error is :
- QEMU sends a VHOST_USER_GET_STATUS (40) request to DPDK on the master
-  socket
- QEMU starts a nested event loop in order to wait for the
-  VHOST_USER_GET_STATUS response and to be able to process messages from
-  the slave channel
- DPDK sends a couple of legitimate IOTLB miss messages on the slave
-  channel
- QEMU processes each IOTLB request and sends VHOST_USER_IOTLB_MSG (22)
-  updates on the master socket
- QEMU assumes to receive a response for the latest VHOST_USER_IOTLB_MSG
-  but it gets the response for the VHOST_USER_GET_STATUS instead
-
-The subsequent errors have the same root cause : the nested event loop
-breaks the order by design. It lures QEMU to expect responses to the
-latest message sent on the master socket to arrive first.
-
-Since this was only needed for DAX enablement which is still not merged
-upstream, just drop the code for now. A working solution will have to
-be merged later on. Likely protect the master socket with a mutex
-and service the slave channel with a separate thread, as discussed with
-Maxime in the mail thread below.
-
-[0] https://lore.kernel.org/qemu-devel/43145ede-89dc-280e-b953-6a2b436de395@redhat.com/
-
-Reported-by: Yanghang Liu <yanghliu@redhat.com>
-Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2155173
-Signed-off-by: Greg Kurz <groug@kaod.org>
-Message-Id: <20230119172424.478268-2-groug@kaod.org>
-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-Acked-by: Maxime Coquelin <maxime.coquelin@redhat.com>
-(cherry picked from commit f340a59d5a852d75ae34555723694c7e8eafbd0c)
-Signed-off-by: Laurent Vivier <lvivier@redhat.com>
---
- hw/virtio/vhost-user.c | 35 +++--------------------------------
- 1 file changed, 3 insertions(+), 32 deletions(-)
-
-diff --git a/hw/virtio/vhost-user.c b/hw/virtio/vhost-user.c
-index 8f635844af..0ac00eb901 100644
--- a/hw/virtio/vhost-user.c
-+++ b/hw/virtio/vhost-user.c
-@@ -356,35 +356,6 @@ end:
-     return G_SOURCE_REMOVE;
- }
- 
-static gboolean slave_read(QIOChannel *ioc, GIOCondition condition,
-                           gpointer opaque);
-
-/*
- * This updates the read handler to use a new event loop context.
- * Event sources are removed from the previous context : this ensures
- * that events detected in the previous context are purged. They will
- * be re-detected and processed in the new context.
- */
-static void slave_update_read_handler(struct vhost_dev *dev,
-                                      GMainContext *ctxt)
-{
-    struct vhost_user *u = dev->opaque;
-
-    if (!u->slave_ioc) {
-        return;
-    }
-
-    if (u->slave_src) {
-        g_source_destroy(u->slave_src);
-        g_source_unref(u->slave_src);
-    }
-
-    u->slave_src = qio_channel_add_watch_source(u->slave_ioc,
-                                                G_IO_IN | G_IO_HUP,
-                                                slave_read, dev, NULL,
-                                                ctxt);
-}
-
- static int vhost_user_read(struct vhost_dev *dev, VhostUserMsg *msg)
- {
-     struct vhost_user *u = dev->opaque;
-@@ -406,7 +377,6 @@ static int vhost_user_read(struct vhost_dev *dev, VhostUserMsg *msg)
-      * be prepared for re-entrancy. So we create a new one and switch chr
-      * to use it.
-      */
-    slave_update_read_handler(dev, ctxt);
-     qemu_chr_be_update_read_handlers(chr->chr, ctxt);
-     qemu_chr_fe_add_watch(chr, G_IO_IN | G_IO_HUP, vhost_user_read_cb, &data);
- 
-@@ -418,7 +388,6 @@ static int vhost_user_read(struct vhost_dev *dev, VhostUserMsg *msg)
-      * context that have been processed by the nested loop are purged.
-      */
-     qemu_chr_be_update_read_handlers(chr->chr, prev_ctxt);
-    slave_update_read_handler(dev, NULL);
- 
-     g_main_loop_unref(loop);
-     g_main_context_unref(ctxt);
-@@ -1802,7 +1771,9 @@ static int vhost_setup_slave_channel(struct vhost_dev *dev)
-         return -ECONNREFUSED;
-     }
-     u->slave_ioc = ioc;
-    slave_update_read_handler(dev, NULL);
-+    u->slave_src = qio_channel_add_watch_source(u->slave_ioc,
-+                                                G_IO_IN | G_IO_HUP,
-+                                                slave_read, dev, NULL, NULL);
- 
-     if (reply_supported) {
-         msg.hdr.flags |= VHOST_USER_NEED_REPLY_MASK;
-- 
-2.31.1
-
--- a/SOURCES/kvm-Update-linux-headers-to-v6.0-rc4.patch
+++ b/SOURCES/kvm-Update-linux-headers-to-v6.0-rc4.patch
@ -0,0 +1,171 @@
+From 10fc28b61a6fba1e6dc44fd544cf31c7f313c622 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
+Date: Fri, 28 Oct 2022 17:48:00 +0100
+Subject: [PATCH 05/42] Update linux headers to v6.0-rc4
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Cédric Le Goater <clg@redhat.com>
+RH-MergeRequest: 226: s390: Enhanced Interpretation for PCI Functions and Secure Execution guest dump
+RH-Bugzilla: 1664378 2043909
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
+RH-Commit: [5/41] ca55f497d1bf1e72179330f8f613781bf999d898
+
+Based on upstream commit d525f73f9186a5bc641b8caf0b2c9bb94e5aa963
+("Update linux headers to v6.0-rc4"), but this is focusing only on the
+ZPCI and protected dump changes.
+
+Signed-off-by: Cédric Le Goater <clg@redhat.com>
+---
+ linux-headers/linux/kvm.h       | 87 +++++++++++++++++++++++++++++++++
+ linux-headers/linux/vfio_zdev.h |  7 +++
+ 2 files changed, 94 insertions(+)
+
+diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h
+index 0d05d02ee4..c65930288c 100644
+--- a/linux-headers/linux/kvm.h
+++ b/linux-headers/linux/kvm.h
+@@ -1150,6 +1150,9 @@ struct kvm_ppc_resize_hpt {
+ #define KVM_CAP_DISABLE_QUIRKS2 213
+ /* #define KVM_CAP_VM_TSC_CONTROL 214 */
+ #define KVM_CAP_SYSTEM_EVENT_DATA 215
+#define KVM_CAP_S390_PROTECTED_DUMP 217
+#define KVM_CAP_S390_ZPCI_OP 221
+#define KVM_CAP_S390_CPU_TOPOLOGY 222
+ 
+ #ifdef KVM_CAP_IRQ_ROUTING
+ 
+@@ -1651,6 +1654,55 @@ struct kvm_s390_pv_unp {
+ 	__u64 tweak;
+ };
+ 
+enum pv_cmd_dmp_id {
+	KVM_PV_DUMP_INIT,
+	KVM_PV_DUMP_CONFIG_STOR_STATE,
+	KVM_PV_DUMP_COMPLETE,
+	KVM_PV_DUMP_CPU,
+};
+
+struct kvm_s390_pv_dmp {
+	__u64 subcmd;
+	__u64 buff_addr;
+	__u64 buff_len;
+	__u64 gaddr;		/* For dump storage state */
+	__u64 reserved[4];
+};
+
+enum pv_cmd_info_id {
+	KVM_PV_INFO_VM,
+	KVM_PV_INFO_DUMP,
+};
+
+struct kvm_s390_pv_info_dump {
+	__u64 dump_cpu_buffer_len;
+	__u64 dump_config_mem_buffer_per_1m;
+	__u64 dump_config_finalize_len;
+};
+
+struct kvm_s390_pv_info_vm {
+	__u64 inst_calls_list[4];
+	__u64 max_cpus;
+	__u64 max_guests;
+	__u64 max_guest_addr;
+	__u64 feature_indication;
+};
+
+struct kvm_s390_pv_info_header {
+	__u32 id;
+	__u32 len_max;
+	__u32 len_written;
+	__u32 reserved;
+};
+
+struct kvm_s390_pv_info {
+	struct kvm_s390_pv_info_header header;
+	union {
+		struct kvm_s390_pv_info_dump dump;
+		struct kvm_s390_pv_info_vm vm;
+	};
+};
+
+ enum pv_cmd_id {
+ 	KVM_PV_ENABLE,
+ 	KVM_PV_DISABLE,
+@@ -1659,6 +1711,8 @@ enum pv_cmd_id {
+ 	KVM_PV_VERIFY,
+ 	KVM_PV_PREP_RESET,
+ 	KVM_PV_UNSHARE_ALL,
+	KVM_PV_INFO,
+	KVM_PV_DUMP,
+ };
+ 
+ struct kvm_pv_cmd {
+@@ -2066,4 +2120,37 @@ struct kvm_stats_desc {
+ /* Available with KVM_CAP_XSAVE2 */
+ #define KVM_GET_XSAVE2		  _IOR(KVMIO,  0xcf, struct kvm_xsave)
+ 
+/* Available with KVM_CAP_S390_PROTECTED_DUMP */
+#define KVM_S390_PV_CPU_COMMAND	_IOWR(KVMIO, 0xd0, struct kvm_pv_cmd)
+
+/* Available with KVM_CAP_S390_ZPCI_OP */
+#define KVM_S390_ZPCI_OP         _IOW(KVMIO,  0xd1, struct kvm_s390_zpci_op)
+
+struct kvm_s390_zpci_op {
+	/* in */
+	__u32 fh;               /* target device */
+	__u8  op;               /* operation to perform */
+	__u8  pad[3];
+	union {
+		/* for KVM_S390_ZPCIOP_REG_AEN */
+		struct {
+			__u64 ibv;      /* Guest addr of interrupt bit vector */
+			__u64 sb;       /* Guest addr of summary bit */
+			__u32 flags;
+			__u32 noi;      /* Number of interrupts */
+			__u8 isc;       /* Guest interrupt subclass */
+			__u8 sbo;       /* Offset of guest summary bit vector */
+			__u16 pad;
+		} reg_aen;
+		__u64 reserved[8];
+	} u;
+};
+
+/* types for kvm_s390_zpci_op->op */
+#define KVM_S390_ZPCIOP_REG_AEN                0
+#define KVM_S390_ZPCIOP_DEREG_AEN      1
+
+/* flags for kvm_s390_zpci_op->u.reg_aen.flags */
+#define KVM_S390_ZPCIOP_REGAEN_HOST    (1 << 0)
+
+ #endif /* __LINUX_KVM_H */
+diff --git a/linux-headers/linux/vfio_zdev.h b/linux-headers/linux/vfio_zdev.h
+index b4309397b6..77f2aff1f2 100644
+--- a/linux-headers/linux/vfio_zdev.h
+++ b/linux-headers/linux/vfio_zdev.h
+@@ -29,6 +29,9 @@ struct vfio_device_info_cap_zpci_base {
+ 	__u16 fmb_length;	/* Measurement Block Length (in bytes) */
+ 	__u8 pft;		/* PCI Function Type */
+ 	__u8 gid;		/* PCI function group ID */
+	/* End of version 1 */
+	__u32 fh;		/* PCI function handle */
+	/* End of version 2 */
+ };
+ 
+ /**
+@@ -47,6 +50,10 @@ struct vfio_device_info_cap_zpci_group {
+ 	__u16 noi;		/* Maximum number of MSIs */
+ 	__u16 maxstbl;		/* Maximum Store Block Length */
+ 	__u8 version;		/* Supported PCI Version */
+	/* End of version 1 */
+	__u8 reserved;
+	__u16 imaxstbl;		/* Maximum Interpreted Store Block Length */
+	/* End of version 2 */
+ };
+ 
+ /**
+-- 
+2.37.3
+
--- a/SOURCES/kvm-accel-introduce-accelerator-blocker-API.patch
+++ b/SOURCES/kvm-accel-introduce-accelerator-blocker-API.patch
@ -1,20 +1,20 @@
-From ae2077fd5d351a68c313c64f07fb225dff694a8f Mon Sep 17 00:00:00 2001
+From a5e7bb1f7a88efb5574266a76e80fd7604d19921 Mon Sep 17 00:00:00 2001
 From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
-Date: Mon, 16 Jan 2023 07:16:41 -0500
-Subject: [PATCH 29/31] accel: introduce accelerator blocker API
+Date: Mon, 16 Jan 2023 07:49:59 -0500
+Subject: [PATCH 04/11] accel: introduce accelerator blocker API
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit

 RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
-RH-MergeRequest: 138: accel: introduce accelerator blocker API
-RH-Bugzilla: 1979276
-RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 247: accel: introduce accelerator blocker API
+RH-Bugzilla: 2161188
 RH-Acked-by: David Hildenbrand <david@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [1/3] 56b07cd7db516c5066e6d66b4695064fdf73abbf (eesposit/qemu-kvm)
+RH-Commit: [1/3] 9d3d7f9554974a79042c915763288cce07aef135

-Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1979276
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2161188

 commit bd688fc93120fb3e28aa70e3dfdf567ccc1e0bc1
 Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
@ -43,7 +43,8 @@ Date:   Fri Nov 11 10:47:56 2022 -0500
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

 Conflicts:
-	util/meson.build: "interval-tree.c" does not exist
+	util/meson.build: files are missing in rhel 8.8.0
+	namely int128.c, memalign.c and interval-tree.c

 Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 ---
@ -218,7 +219,7 @@ index 0000000000..1e7f423462
 +}
 +
 diff --git a/accel/meson.build b/accel/meson.build
-index 259c35c4c8..061332610f 100644
+index dfd808d2c8..801b4d44e8 100644
 --- a/accel/meson.build
 +++ b/accel/meson.build
@@ -1,4 +1,4 @@
@ -228,10 +229,10 @@ index 259c35c4c8..061332610f 100644
 user_ss.add(files('accel-user.c'))
 
 diff --git a/hw/core/cpu-common.c b/hw/core/cpu-common.c
-index f9fdd46b9d..8d6a4b1b65 100644
+index 9e3241b430..b6e83acf0a 100644
 --- a/hw/core/cpu-common.c
 +++ b/hw/core/cpu-common.c
-@@ -237,6 +237,7 @@ static void cpu_common_initfn(Object *obj)
+@@ -238,6 +238,7 @@ static void cpu_common_initfn(Object *obj)
     cpu->nr_threads = 1;
 
     qemu_mutex_init(&cpu->work_mutex);
@ -239,7 +240,7 @@ index f9fdd46b9d..8d6a4b1b65 100644
     QSIMPLEQ_INIT(&cpu->work_list);
     QTAILQ_INIT(&cpu->breakpoints);
     QTAILQ_INIT(&cpu->watchpoints);
-@@ -248,6 +249,7 @@ static void cpu_common_finalize(Object *obj)
+@@ -249,6 +250,7 @@ static void cpu_common_finalize(Object *obj)
 {
     CPUState *cpu = CPU(obj);
 
@ -248,10 +249,10 @@ index f9fdd46b9d..8d6a4b1b65 100644
 }
 
 diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
-index 8830546121..2417597236 100644
+index e948e81f1a..49d9c73f97 100644
 --- a/include/hw/core/cpu.h
 +++ b/include/hw/core/cpu.h
-@@ -398,6 +398,9 @@ struct CPUState {
+@@ -383,6 +383,9 @@ struct CPUState {
     uint32_t kvm_fetch_index;
     uint64_t dirty_pages;
 
@ -324,25 +325,25 @@ index 0000000000..72020529ef
 +
 +#endif /* ACCEL_BLOCKER_H */
 diff --git a/util/meson.build b/util/meson.build
-index 25b9b61f98..85a5504c4d 100644
+index 05b593055a..b5f153b0e8 100644
 --- a/util/meson.build
 +++ b/util/meson.build
-@@ -57,6 +57,7 @@ util_ss.add(files('guest-random.c'))
+@@ -48,6 +48,7 @@ util_ss.add(files('transactions.c'))
+ util_ss.add(when: 'CONFIG_POSIX', if_true: files('drm.c'))
+ util_ss.add(files('guest-random.c'))
 util_ss.add(files('yank.c'))
- util_ss.add(files('int128.c'))
- util_ss.add(files('memalign.c'))
 +util_ss.add(files('lockcnt.c'))
 
 if have_user
   util_ss.add(files('selfmap.c'))
-@@ -71,7 +72,6 @@ endif
- if have_block or have_ga
-   util_ss.add(files('aiocb.c', 'async.c'))
-   util_ss.add(files('base64.c'))
+@@ -69,7 +70,6 @@ if have_block
+   util_ss.add(files('hexdump.c'))
+   util_ss.add(files('iova-tree.c'))
+   util_ss.add(files('iov.c', 'qemu-sockets.c', 'uri.c'))
 -  util_ss.add(files('lockcnt.c'))
   util_ss.add(files('main-loop.c'))
+   util_ss.add(files('nvdimm-utils.c'))
   util_ss.add(files('qemu-coroutine.c', 'qemu-coroutine-lock.c', 'qemu-coroutine-io.c'))
-   util_ss.add(files('coroutine-@0@.c'.format(config_host['CONFIG_COROUTINE_BACKEND'])))
 -- 
-2.31.1
+2.37.3

--- a/SOURCES/kvm-accel-tcg-Test-CPUJumpCache-in-tb_jmp_cache_clear_pa.patch
+++ b/SOURCES/kvm-accel-tcg-Test-CPUJumpCache-in-tb_jmp_cache_clear_pa.patch
@ -1,58 +0,0 @@
-From ab68e13b7628f2348d41a4518a92508542af712f Mon Sep 17 00:00:00 2001
-From: Eric Auger <eric.auger@redhat.com>
-Date: Fri, 3 Feb 2023 18:15:10 +0100
-Subject: [PATCH 05/20] accel/tcg: Test CPUJumpCache in tb_jmp_cache_clear_page
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 144: accel/tcg: Test CPUJumpCache in tb_jmp_cache_clear_page
-RH-Bugzilla: 2165280
-RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
-RH-Acked-by: Gavin Shan <gshan@redhat.com>
-RH-Acked-by: Shaoqin Huang <None>
-RH-Commit: [1/1] 5b0863c34ba06c01c4e343d1ecd72402779c7de3 (eauger1/centos-qemu-kvm)
-
-Bugzilla: https://bugzilla.redhat.com/2165280
-Upstream: yes
-Brew: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=50530041
-Test: 'kvm unit test ./run_tests.sh -g debug' does not SIGSEV anymore
-
-After commit 4e4fa6c12d ("accel/tcg: Complete cpu initialization
-before registration"), it looks the CPUJumpCache pointer can be NULL.
-This causes a SIGSEV when running debug-wp-migration kvm unit test.
-
-At the first place it should be clarified why this TCG code is called
-with KVM acceleration. This may hide another bug.
-
-Fixes: 4e4fa6c12d ("accel/tcg: Complete cpu initialization before registration")
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
-Message-Id: <20230203171510.2867451-1-eric.auger@redhat.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-(cherry picked from commit 99ab4d500af638ba3ebb20e8aa89d72201b70860)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
---
- accel/tcg/cputlb.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
-index 6f1c00682b..4244b0e4e3 100644
--- a/accel/tcg/cputlb.c
-+++ b/accel/tcg/cputlb.c
-@@ -100,9 +100,14 @@ static void tlb_window_reset(CPUTLBDesc *desc, int64_t ns,
- 
- static void tb_jmp_cache_clear_page(CPUState *cpu, target_ulong page_addr)
- {
-    int i, i0 = tb_jmp_cache_hash_page(page_addr);
-     CPUJumpCache *jc = cpu->tb_jmp_cache;
-+    int i, i0;
- 
-+    if (unlikely(!jc)) {
-+        return;
-+    }
-+
-+    i0 = tb_jmp_cache_hash_page(page_addr);
-     for (i = 0; i < TB_JMP_PAGE_SIZE; i++) {
-         qatomic_set(&jc->array[i0 + i].tb, NULL);
-     }
-- 
-2.31.1
-
--- a/SOURCES/kvm-acpi-fix-OEM-ID-OEM-Table-ID-padding.patch
+++ b/SOURCES/kvm-acpi-fix-OEM-ID-OEM-Table-ID-padding.patch
@ -0,0 +1,78 @@
+From af082f3499de265d123157d097b5c84981e0aa63 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Wed, 30 Mar 2022 14:52:34 -0400
+Subject: [PATCH 15/18] acpi: fix OEM ID/OEM Table ID padding
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 141: acpi: fix QEMU crash when started with SLIC table
+RH-Commit: [7/10] 51ea859cbe12b5a902d529ab589d18757d98f71d (jmaloy/qemu-kvm)
+RH-Bugzilla: 2062611
+RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2062611
+Upstream: Merged
+
+commit 748c030f360a940fe0c9382c8ca1649096c3a80d
+Author: Igor Mammedov <imammedo@redhat.com>
+Date:   Wed Jan 12 08:03:31 2022 -0500
+
+    acpi: fix OEM ID/OEM Table ID padding
+
+    Commit [2] broke original '\0' padding of OEM ID and OEM Table ID
+    fields in headers of ACPI tables. While it doesn't have impact on
+    default values since QEMU uses 6 and 8 characters long values
+    respectively, it broke usecase where IDs are provided on QEMU CLI.
+    It shouldn't affect guest (but may cause licensing verification
+    issues in guest OS).
+    One of the broken usecases is user supplied SLIC table with IDs
+    shorter than max possible length, where [2] mangles IDs with extra
+    spaces in RSDT and FADT tables whereas guest OS expects those to
+    mirror the respective values of the used SLIC table.
+
+    Fix it by replacing whitespace padding with '\0' padding in
+    accordance with [1] and expectations of guest OS
+
+    1) ACPI spec, v2.0b
+           17.2 AML Grammar Definition
+           ...
+           //OEM ID of up to 6 characters. If the OEM ID is
+           //shorter than 6 characters, it can be terminated
+           //with a NULL character.
+
+    2)
+    Fixes: 602b458201 ("acpi: Permit OEM ID and OEM table ID fields to be changed")
+    Resolves: https://gitlab.com/qemu-project/qemu/-/issues/707
+    Reported-by: Dmitry V. Orekhov <dima.orekhov@gmail.com>
+    Signed-off-by: Igor Mammedov <imammedo@redhat.com>
+    Cc: qemu-stable@nongnu.org
+    Message-Id: <20220112130332.1648664-4-imammedo@redhat.com>
+    Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+    Reviewed-by: Ani Sinha <ani@anisinha.ca>
+    Tested-by: Dmitry V. Orekhov dima.orekhov@gmail.com
+
+(cherry picked from commit 748c030f360a940fe0c9382c8ca1649096c3a80d)
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ hw/acpi/aml-build.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/hw/acpi/aml-build.c b/hw/acpi/aml-build.c
+index b3b3310df3..65148d5b9d 100644
+--- a/hw/acpi/aml-build.c
+++ b/hw/acpi/aml-build.c
+@@ -1724,9 +1724,9 @@ void acpi_table_begin(AcpiTable *desc, GArray *array)
+     build_append_int_noprefix(array, 0, 4); /* Length */
+     build_append_int_noprefix(array, desc->rev, 1); /* Revision */
+     build_append_int_noprefix(array, 0, 1); /* Checksum */
+-    build_append_padded_str(array, desc->oem_id, 6, ' '); /* OEMID */
+    build_append_padded_str(array, desc->oem_id, 6, '\0'); /* OEMID */
+     /* OEM Table ID */
+-    build_append_padded_str(array, desc->oem_table_id, 8, ' ');
+    build_append_padded_str(array, desc->oem_table_id, 8, '\0');
+     build_append_int_noprefix(array, 1, 4); /* OEM Revision */
+     g_array_append_vals(array, ACPI_BUILD_APPNAME8, 4); /* Creator ID */
+     build_append_int_noprefix(array, 1, 4); /* Creator Revision */
+-- 
+2.27.0
+
--- a/SOURCES/kvm-acpi-fix-QEMU-crash-when-started-with-SLIC-table.patch
+++ b/SOURCES/kvm-acpi-fix-QEMU-crash-when-started-with-SLIC-table.patch
@ -0,0 +1,108 @@
+From 4e8fb957a349558648d5cddb80a89460bc97439e Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Wed, 30 Mar 2022 14:52:34 -0400
+Subject: [PATCH 09/18] acpi: fix QEMU crash when started with SLIC table
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 141: acpi: fix QEMU crash when started with SLIC table
+RH-Commit: [1/10] 0c34e80346c33da4f220d9c486b120c35005144e (jmaloy/qemu-kvm)
+RH-Bugzilla: 2062611
+RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2062611
+Upstream: Merged
+
+commit 8cdb99af45365727ac17f45239a9b8c1d5155c6d)
+Author: Igor Mammedov <imammedo@redhat.com>
+Date:   Mon Dec 27 14:31:17 2021 -0500
+
+    acpi: fix QEMU crash when started with SLIC table
+
+    if QEMU is started with used provided SLIC table blob,
+
+      -acpitable sig=SLIC,oem_id='CRASH ',oem_table_id="ME",oem_rev=00002210,asl_compiler_id="",asl_compiler_rev=00000000,data=/dev/null
+    it will assert with:
+
+      hw/acpi/aml-build.c:61:build_append_padded_str: assertion failed: (len <= maxlen)
+
+    and following backtrace:
+
+      ...
+      build_append_padded_str (array=0x555556afe320, str=0x555556afdb2e "CRASH ME", maxlen=0x6, pad=0x20) at hw/acpi/aml-build.c:61
+      acpi_table_begin (desc=0x7fffffffd1b0, array=0x555556afe320) at hw/acpi/aml-build.c:1727
+      build_fadt (tbl=0x555556afe320, linker=0x555557ca3830, f=0x7fffffffd318, oem_id=0x555556afdb2e "CRASH ME", oem_table_id=0x555556afdb34 "ME") at hw/acpi/aml-build.c:2064
+      ...
+
+    which happens due to acpi_table_begin() expecting NULL terminated
+    oem_id and oem_table_id strings, which is normally the case, but
+    in case of user provided SLIC table, oem_id points to table's blob
+    directly and as result oem_id became longer than expected.
+
+    Fix issue by handling oem_id consistently and make acpi_get_slic_oem()
+    return NULL terminated strings.
+
+    PS:
+    After [1] refactoring, oem_id semantics became inconsistent, where
+    NULL terminated string was coming from machine and old way pointer
+    into byte array coming from -acpitable option. That used to work
+    since build_header() wasn't expecting NULL terminated string and
+    blindly copied the 1st 6 bytes only.
+
+    However commit [2] broke that by replacing build_header() with
+    acpi_table_begin(), which was expecting NULL terminated string
+    and was checking oem_id size.
+
+    1) 602b45820 ("acpi: Permit OEM ID and OEM table ID fields to be changed")
+    2)
+    Fixes: 4b56e1e4eb08 ("acpi: build_fadt: use acpi_table_begin()/acpi_table_end() instead of build_header()")
+    Resolves: https://gitlab.com/qemu-project/qemu/-/issues/786
+    Signed-off-by: Igor Mammedov <imammedo@redhat.com>
+    Message-Id: <20211227193120.1084176-2-imammedo@redhat.com>
+    Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+    Tested-by: Denis Lisov <dennis.lissov@gmail.com>
+    Tested-by: Alexander Tsoy <alexander@tsoy.me>
+    Cc: qemu-stable@nongnu.org
+    Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+
+(cherry picked from commit 8cdb99af45365727ac17f45239a9b8c1d5155c6d)
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ hw/acpi/core.c       | 4 ++--
+ hw/i386/acpi-build.c | 2 ++
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/hw/acpi/core.c b/hw/acpi/core.c
+index 1e004d0078..3e811bf03c 100644
+--- a/hw/acpi/core.c
+++ b/hw/acpi/core.c
+@@ -345,8 +345,8 @@ int acpi_get_slic_oem(AcpiSlicOem *oem)
+         struct acpi_table_header *hdr = (void *)(u - sizeof(hdr->_length));
+ 
+         if (memcmp(hdr->sig, "SLIC", 4) == 0) {
+-            oem->id = hdr->oem_id;
+-            oem->table_id = hdr->oem_table_id;
+            oem->id = g_strndup(hdr->oem_id, 6);
+            oem->table_id = g_strndup(hdr->oem_table_id, 8);
+             return 0;
+         }
+     }
+diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
+index a4478e77b7..acc4869db0 100644
+--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
+@@ -2726,6 +2726,8 @@ void acpi_build(AcpiBuildTables *tables, MachineState *machine)
+ 
+     /* Cleanup memory that's no longer used. */
+     g_array_free(table_offsets, true);
+    g_free(slic_oem.id);
+    g_free(slic_oem.table_id);
+ }
+ 
+ static void acpi_ram_update(MemoryRegion *mr, GArray *data)
+-- 
+2.27.0
+
--- a/SOURCES/kvm-acpi-fix-acpi_index-migration.patch
+++ b/SOURCES/kvm-acpi-fix-acpi_index-migration.patch
@ -0,0 +1,164 @@
+From 997516a14cb8811558f4db1710e728007a3b53fb Mon Sep 17 00:00:00 2001
+From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
+Date: Wed, 6 Apr 2022 14:58:12 -0400
+Subject: [PATCH 1/2] acpi: fix acpi_index migration
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Peter Xu <peterx@redhat.com>
+RH-MergeRequest: 317: acpi: fix acpi_index migration
+RH-Jira: RHEL-2186
+RH-Acked-by: Ani Sinha <None>
+RH-Acked-by: Leonardo Brás <leobras@redhat.com>
+RH-Commit: [1/2] e49dace989531e940dca1c6e9df5f75ebee411a2
+
+vmstate_acpi_pcihp_use_acpi_index() was expecting AcpiPciHpState
+as state but it actually received PIIX4PMState, because
+VMSTATE_PCI_HOTPLUG is a macro and not another struct.
+So it ended up accessing random pointer, which resulted
+in 'false' return value and acpi_index field wasn't ever
+sent.
+
+However in 7.0 that pointer de-references to value > 0, and
+destination QEMU starts to expect the field which isn't
+sent in migratioon stream from older QEMU (6.2 and older).
+As result migration fails with:
+  qemu-system-x86_64: Missing section footer for 0000:00:01.3/piix4_pm
+  qemu-system-x86_64: load of migration failed: Invalid argument
+
+In addition with QEMU-6.2, destination due to not expected
+state, also never expects the acpi_index field in migration
+stream.
+
+Q35 is not affected as it always sends/expects the field as
+long as acpi based PCI hotplug is enabled.
+
+Fix issue by introducing compat knob to never send/expect
+acpi_index in migration stream for 6.2 and older PC machine
+types and always send it for 7.0 and newer PC machine types.
+
+Diagnosed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+Fixes: b32bd76 ("pci: introduce acpi-index property for PCI device")
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/932
+Signed-off-by: Igor Mammedov <imammedo@redhat.com>
+Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+(cherry picked from commit a83c2844903c45aa7d32cdd17305f23ce2c56ab9)
+Signed-off-by: Peter Xu <peterx@redhat.com>
+---
+ hw/acpi/acpi-pci-hotplug-stub.c |  4 ----
+ hw/acpi/pcihp.c                 |  6 ------
+ hw/acpi/piix4.c                 | 15 ++++++++++++++-
+ hw/core/machine.c               |  5 +++++
+ include/hw/acpi/pcihp.h         |  2 --
+ 5 files changed, 19 insertions(+), 13 deletions(-)
+
+diff --git a/hw/acpi/acpi-pci-hotplug-stub.c b/hw/acpi/acpi-pci-hotplug-stub.c
+index 734e4c5986..a43f6dafc9 100644
+--- a/hw/acpi/acpi-pci-hotplug-stub.c
+++ b/hw/acpi/acpi-pci-hotplug-stub.c
+@@ -41,7 +41,3 @@ void acpi_pcihp_reset(AcpiPciHpState *s, bool acpihp_root_off)
+     return;
+ }
+ 
+-bool vmstate_acpi_pcihp_use_acpi_index(void *opaque, int version_id)
+-{
+-    return false;
+-}
+diff --git a/hw/acpi/pcihp.c b/hw/acpi/pcihp.c
+index be0e846b34..ec861661c3 100644
+--- a/hw/acpi/pcihp.c
+++ b/hw/acpi/pcihp.c
+@@ -559,12 +559,6 @@ void acpi_pcihp_init(Object *owner, AcpiPciHpState *s, PCIBus *root_bus,
+                                    OBJ_PROP_FLAG_READ);
+ }
+ 
+-bool vmstate_acpi_pcihp_use_acpi_index(void *opaque, int version_id)
+-{
+-     AcpiPciHpState *s = opaque;
+-     return s->acpi_index;
+-}
+-
+ const VMStateDescription vmstate_acpi_pcihp_pci_status = {
+     .name = "acpi_pcihp_pci_status",
+     .version_id = 1,
+diff --git a/hw/acpi/piix4.c b/hw/acpi/piix4.c
+index 8d6011c0a3..033e75ce5b 100644
+--- a/hw/acpi/piix4.c
+++ b/hw/acpi/piix4.c
+@@ -82,6 +82,7 @@ struct PIIX4PMState {
+     AcpiPciHpState acpi_pci_hotplug;
+     bool use_acpi_hotplug_bridge;
+     bool use_acpi_root_pci_hotplug;
+    bool not_migrate_acpi_index;
+ 
+     uint8_t disable_s3;
+     uint8_t disable_s4;
+@@ -269,6 +270,16 @@ static bool piix4_vmstate_need_smbus(void *opaque, int version_id)
+     return pm_smbus_vmstate_needed();
+ }
+ 
+/*
+ * This is a fudge to turn off the acpi_index field,
+ * whose test was always broken on piix4 with 6.2 and older machine types.
+ */
+static bool vmstate_test_migrate_acpi_index(void *opaque, int version_id)
+{
+    PIIX4PMState *s = PIIX4_PM(opaque);
+    return s->use_acpi_hotplug_bridge && !s->not_migrate_acpi_index;
+}
+
+ /* qemu-kvm 1.2 uses version 3 but advertised as 2
+  * To support incoming qemu-kvm 1.2 migration, change version_id
+  * and minimum_version_id to 2 below (which breaks migration from
+@@ -299,7 +310,7 @@ static const VMStateDescription vmstate_acpi = {
+             struct AcpiPciHpPciStatus),
+         VMSTATE_PCI_HOTPLUG(acpi_pci_hotplug, PIIX4PMState,
+                             vmstate_test_use_acpi_hotplug_bridge,
+-                            vmstate_acpi_pcihp_use_acpi_index),
+                            vmstate_test_migrate_acpi_index),
+         VMSTATE_END_OF_LIST()
+     },
+     .subsections = (const VMStateDescription*[]) {
+@@ -654,6 +665,8 @@ static Property piix4_pm_properties[] = {
+     DEFINE_PROP_BOOL("memory-hotplug-support", PIIX4PMState,
+                      acpi_memory_hotplug.is_enabled, true),
+     DEFINE_PROP_BOOL("smm-compat", PIIX4PMState, smm_compat, false),
+    DEFINE_PROP_BOOL("x-not-migrate-acpi-index", PIIX4PMState,
+                      not_migrate_acpi_index, false),
+     DEFINE_PROP_END_OF_LIST(),
+ };
+ 
+diff --git a/hw/core/machine.c b/hw/core/machine.c
+index 76fcabec7a..2724f6848a 100644
+--- a/hw/core/machine.c
+++ b/hw/core/machine.c
+@@ -331,6 +331,11 @@ GlobalProperty hw_compat_rhel_7_1[] = {
+ };
+ const size_t hw_compat_rhel_7_1_len = G_N_ELEMENTS(hw_compat_rhel_7_1);
+ 
+GlobalProperty hw_compat_6_2[] = {
+    { "PIIX4_PM", "x-not-migrate-acpi-index", "on"},
+};
+const size_t hw_compat_6_2_len = G_N_ELEMENTS(hw_compat_6_2);
+
+ GlobalProperty hw_compat_6_1[] = {
+     { "vhost-user-vsock-device", "seqpacket", "off" },
+     { "nvme-ns", "shared", "off" },
+diff --git a/include/hw/acpi/pcihp.h b/include/hw/acpi/pcihp.h
+index af1a169fc3..7e268c2c9c 100644
+--- a/include/hw/acpi/pcihp.h
+++ b/include/hw/acpi/pcihp.h
+@@ -73,8 +73,6 @@ void acpi_pcihp_reset(AcpiPciHpState *s, bool acpihp_root_off);
+ 
+ extern const VMStateDescription vmstate_acpi_pcihp_pci_status;
+ 
+-bool vmstate_acpi_pcihp_use_acpi_index(void *opaque, int version_id);
+-
+ #define VMSTATE_PCI_HOTPLUG(pcihp, state, test_pcihp, test_acpi_index) \
+         VMSTATE_UINT32_TEST(pcihp.hotplug_select, state, \
+                             test_pcihp), \
+-- 
+2.37.3
+
--- a/SOURCES/kvm-acpi-pcihp-pcie-set-power-on-cap-on-parent-slot.patch
+++ b/SOURCES/kvm-acpi-pcihp-pcie-set-power-on-cap-on-parent-slot.patch
@ -0,0 +1,140 @@
+From c9ceb175667cdeead59384a97a812367ae19c570 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Wed, 23 Mar 2022 13:21:40 -0400
+Subject: [PATCH 06/18] acpi: pcihp: pcie: set power on cap on parent slot
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 134: pci: expose TYPE_XIO3130_DOWNSTREAM name
+RH-Commit: [2/2] d883872647a6e90ec573140b2c171f3f53b600ab (jmaloy/qemu-kvm)
+RH-Bugzilla: 2062610
+RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
+RH-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
+
+BZ: https://bugzilla.redhat.com/2062610
+UPSTREAM: merged
+BREW: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=44038138
+
+commit 6b0969f1ec825984cd74619f0730be421b0c46fb
+Author: Igor Mammedov <imammedo@redhat.com>
+Date:   Tue Mar 1 10:11:59 2022 -0500
+
+    acpi: pcihp: pcie: set power on cap on parent slot
+
+    on creation a PCIDevice has power turned on at the end of pci_qdev_realize()
+    however later on if PCIe slot isn't populated with any children
+    it's power is turned off. It's fine if native hotplug is used
+    as plug callback will power slot on among other things.
+    However when ACPI hotplug is enabled it replaces native PCIe plug
+    callbacks with ACPI specific ones (acpi_pcihp_device_*plug_cb) and
+    as result slot stays powered off. It works fine as ACPI hotplug
+    on guest side takes care of enumerating/initializing hotplugged
+    device. But when later guest is migrated, call chain introduced by]
+    commit d5daff7d312 (pcie: implement slot power control for pcie root ports)
+
+       pcie_cap_slot_post_load()
+           -> pcie_cap_update_power()
+               -> pcie_set_power_device()
+                   -> pci_set_power()
+                       -> pci_update_mappings()
+
+    will disable earlier initialized BARs for the hotplugged device
+    in powered off slot due to commit 23786d13441 (pci: implement power state)
+    which disables BARs if power is off.
+
+    Fix it by setting PCI_EXP_SLTCTL_PCC to PCI_EXP_SLTCTL_PWR_ON
+    on slot (root port/downstream port) at the time a device
+    hotplugged into it. As result PCI_EXP_SLTCTL_PWR_ON is migrated
+    to target and above call chain keeps device plugged into it
+    powered on.
+
+    Fixes: d5daff7d312 ("pcie: implement slot power control for pcie root ports")
+    Fixes: 23786d13441 ("pci: implement power state")
+    Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2053584
+    Suggested-by: "Michael S. Tsirkin" <mst@redhat.com>
+    Signed-off-by: Igor Mammedov <imammedo@redhat.com>
+    Message-Id: <20220301151200.3507298-3-imammedo@redhat.com>
+    Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+
+(cherry picked from commit 6b0969f1ec825984cd74619f0730be421b0c46fb)
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ hw/acpi/pcihp.c       | 12 +++++++++++-
+ hw/pci/pcie.c         | 11 +++++++++++
+ include/hw/pci/pcie.h |  1 +
+ 3 files changed, 23 insertions(+), 1 deletion(-)
+
+diff --git a/hw/acpi/pcihp.c b/hw/acpi/pcihp.c
+index a5e182dd3a..be0e846b34 100644
+--- a/hw/acpi/pcihp.c
+++ b/hw/acpi/pcihp.c
+@@ -32,6 +32,7 @@
+ #include "hw/pci/pci_bridge.h"
+ #include "hw/pci/pci_host.h"
+ #include "hw/pci/pcie_port.h"
+#include "hw/pci-bridge/xio3130_downstream.h"
+ #include "hw/i386/acpi-build.h"
+ #include "hw/acpi/acpi.h"
+ #include "hw/pci/pci_bus.h"
+@@ -341,6 +342,8 @@ void acpi_pcihp_device_plug_cb(HotplugHandler *hotplug_dev, AcpiPciHpState *s,
+ {
+     PCIDevice *pdev = PCI_DEVICE(dev);
+     int slot = PCI_SLOT(pdev->devfn);
+    PCIDevice *bridge;
+    PCIBus *bus;
+     int bsel;
+ 
+     /* Don't send event when device is enabled during qemu machine creation:
+@@ -370,7 +373,14 @@ void acpi_pcihp_device_plug_cb(HotplugHandler *hotplug_dev, AcpiPciHpState *s,
+         return;
+     }
+ 
+-    bsel = acpi_pcihp_get_bsel(pci_get_bus(pdev));
+    bus = pci_get_bus(pdev);
+    bridge = pci_bridge_get_device(bus);
+    if (object_dynamic_cast(OBJECT(bridge), TYPE_PCIE_ROOT_PORT) ||
+        object_dynamic_cast(OBJECT(bridge), TYPE_XIO3130_DOWNSTREAM)) {
+        pcie_cap_slot_enable_power(bridge);
+    }
+
+    bsel = acpi_pcihp_get_bsel(bus);
+     g_assert(bsel >= 0);
+     s->acpi_pcihp_pci_status[bsel].up |= (1U << slot);
+     acpi_send_event(DEVICE(hotplug_dev), ACPI_PCI_HOTPLUG_STATUS);
+diff --git a/hw/pci/pcie.c b/hw/pci/pcie.c
+index d7d73a31e4..996f0e24fe 100644
+--- a/hw/pci/pcie.c
+++ b/hw/pci/pcie.c
+@@ -366,6 +366,17 @@ static void hotplug_event_clear(PCIDevice *dev)
+     }
+ }
+ 
+void pcie_cap_slot_enable_power(PCIDevice *dev)
+{
+    uint8_t *exp_cap = dev->config + dev->exp.exp_cap;
+    uint32_t sltcap = pci_get_long(exp_cap + PCI_EXP_SLTCAP);
+
+    if (sltcap & PCI_EXP_SLTCAP_PCP) {
+        pci_set_word_by_mask(exp_cap + PCI_EXP_SLTCTL,
+                             PCI_EXP_SLTCTL_PCC, PCI_EXP_SLTCTL_PWR_ON);
+    }
+}
+
+ static void pcie_set_power_device(PCIBus *bus, PCIDevice *dev, void *opaque)
+ {
+     bool *power = opaque;
+diff --git a/include/hw/pci/pcie.h b/include/hw/pci/pcie.h
+index 6063bee0ec..c27368d077 100644
+--- a/include/hw/pci/pcie.h
+++ b/include/hw/pci/pcie.h
+@@ -112,6 +112,7 @@ void pcie_cap_slot_write_config(PCIDevice *dev,
+                                 uint32_t addr, uint32_t val, int len);
+ int pcie_cap_slot_post_load(void *opaque, int version_id);
+ void pcie_cap_slot_push_attention_button(PCIDevice *dev);
+void pcie_cap_slot_enable_power(PCIDevice *dev);
+ 
+ void pcie_cap_root_init(PCIDevice *dev);
+ void pcie_cap_root_reset(PCIDevice *dev);
+-- 
+2.27.0
+
--- a/SOURCES/kvm-acpi-validate-hotplug-selector-on-access.patch
+++ b/SOURCES/kvm-acpi-validate-hotplug-selector-on-access.patch
@ -0,0 +1,51 @@
+From 529a5d908f5d16714b8ae0a51eaaaa84994dfae8 Mon Sep 17 00:00:00 2001
+From: "Michael S. Tsirkin" <mst@redhat.com>
+Date: Tue, 21 Dec 2021 09:45:44 -0500
+Subject: [PATCH 1/2] acpi: validate hotplug selector on access
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 97: acpi: validate hotplug selector on access
+RH-Commit: [1/1] 79bcfb0df0091e2b716d2e1c545f047b3409c26c (jmaloy/qemu-kvm)
+RH-Bugzilla: 2036580
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
+RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
+
+When bus is looked up on a pci write, we didn't
+validate that the lookup succeeded.
+Fuzzers thus can trigger QEMU crash by dereferencing the NULL
+bus pointer.
+
+Fixes: b32bd763a1 ("pci: introduce acpi-index property for PCI device")
+Fixes: CVE-2021-4158
+Cc: "Igor Mammedov" <imammedo@redhat.com>
+Fixes: https://gitlab.com/qemu-project/qemu/-/issues/770
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Ani Sinha <ani@anisinha.ca>
+(cherry picked from commit 9bd6565ccee68f72d5012e24646e12a1c662827e)
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ hw/acpi/pcihp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/hw/acpi/pcihp.c b/hw/acpi/pcihp.c
+index 30405b5113..a5e182dd3a 100644
+--- a/hw/acpi/pcihp.c
+++ b/hw/acpi/pcihp.c
+@@ -491,6 +491,9 @@ static void pci_write(void *opaque, hwaddr addr, uint64_t data,
+         }
+ 
+         bus = acpi_pcihp_find_hotplug_bus(s, s->hotplug_select);
+        if (!bus) {
+            break;
+        }
+         QTAILQ_FOREACH_SAFE(kid, &bus->qbus.children, sibling, next) {
+             Object *o = OBJECT(kid->child);
+             PCIDevice *dev = PCI_DEVICE(o);
+-- 
+2.27.0
+
--- a/SOURCES/kvm-aio-wait-switch-to-smp_mb__after_rmw.patch
+++ b/SOURCES/kvm-aio-wait-switch-to-smp_mb__after_rmw.patch
@ -0,0 +1,50 @@
+From 953c5c0982b61b0a3f8f03452844b5487eb22fc7 Mon Sep 17 00:00:00 2001
+From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+Date: Thu, 9 Mar 2023 08:13:17 -0500
+Subject: [PATCH 06/13] aio-wait: switch to smp_mb__after_rmw()
+
+RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+RH-MergeRequest: 263: qatomic: add smp_mb__before/after_rmw()
+RH-Bugzilla: 2168472
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Eric Auger <eric.auger@redhat.com>
+RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+RH-Acked-by: David Hildenbrand <david@redhat.com>
+RH-Commit: [6/10] 9f30f97754139ffd18d36b2350f9ed4e59ac496e
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2168472
+
+commit b532526a07ef3b903ead2e055fe6cc87b41057a3
+Author: Paolo Bonzini <pbonzini@redhat.com>
+Date:   Fri Mar 3 11:03:52 2023 +0100
+
+    aio-wait: switch to smp_mb__after_rmw()
+
+    The barrier comes after an atomic increment, so it is enough to use
+    smp_mb__after_rmw(); this avoids a double barrier on x86 systems.
+
+    Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+    Reviewed-by: David Hildenbrand <david@redhat.com>
+    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+
+Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+---
+ include/block/aio-wait.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/block/aio-wait.h b/include/block/aio-wait.h
+index 54840f8622..03b6394c78 100644
+--- a/include/block/aio-wait.h
+++ b/include/block/aio-wait.h
+@@ -82,7 +82,7 @@ extern AioWait global_aio_wait;
+     /* Increment wait_->num_waiters before evaluating cond. */     \
+     qatomic_inc(&wait_->num_waiters);                              \
+     /* Paired with smp_mb in aio_wait_kick(). */                   \
+-    smp_mb();                                                      \
+    smp_mb__after_rmw();                                           \
+     if (ctx_ && in_aio_context_home_thread(ctx_)) {                \
+         while ((cond)) {                                           \
+             aio_poll(ctx_, true);                                  \
+-- 
+2.37.3
+
--- a/SOURCES/kvm-aio_wait_kick-add-missing-memory-barrier.patch
+++ b/SOURCES/kvm-aio_wait_kick-add-missing-memory-barrier.patch
@ -0,0 +1,86 @@
+From d7eae0ff4c7f7f7bf10f10272adf7c6971c0db9b Mon Sep 17 00:00:00 2001
+From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+Date: Thu, 9 Mar 2023 09:26:35 -0500
+Subject: [PATCH 01/13] aio_wait_kick: add missing memory barrier
+
+RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+RH-MergeRequest: 263: qatomic: add smp_mb__before/after_rmw()
+RH-Bugzilla: 2168472
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Eric Auger <eric.auger@redhat.com>
+RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+RH-Acked-by: David Hildenbrand <david@redhat.com>
+RH-Commit: [1/10] eb774aee79864052e14e706d931e52e7bd1162c8
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2168472
+
+commit 7455ff1aa01564cc175db5b2373e610503ad4411
+Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+Date:   Tue May 24 13:30:54 2022 -0400
+
+    aio_wait_kick: add missing memory barrier
+
+    It seems that aio_wait_kick always required a memory barrier
+    or atomic operation in the caller, but nobody actually
+    took care of doing it.
+
+    Let's put the barrier in the function instead, and pair it
+    with another one in AIO_WAIT_WHILE. Read aio_wait_kick()
+    comment for further explanation.
+
+    Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
+    Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+    Message-Id: <20220524173054.12651-1-eesposit@redhat.com>
+    Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
+    Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+    Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+
+Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+---
+ include/block/aio-wait.h |  2 ++
+ util/aio-wait.c          | 16 +++++++++++++++-
+ 2 files changed, 17 insertions(+), 1 deletion(-)
+
+diff --git a/include/block/aio-wait.h b/include/block/aio-wait.h
+index b39eefb38d..54840f8622 100644
+--- a/include/block/aio-wait.h
+++ b/include/block/aio-wait.h
+@@ -81,6 +81,8 @@ extern AioWait global_aio_wait;
+     AioContext *ctx_ = (ctx);                                      \
+     /* Increment wait_->num_waiters before evaluating cond. */     \
+     qatomic_inc(&wait_->num_waiters);                              \
+    /* Paired with smp_mb in aio_wait_kick(). */                   \
+    smp_mb();                                                      \
+     if (ctx_ && in_aio_context_home_thread(ctx_)) {                \
+         while ((cond)) {                                           \
+             aio_poll(ctx_, true);                                  \
+diff --git a/util/aio-wait.c b/util/aio-wait.c
+index bdb3d3af22..98c5accd29 100644
+--- a/util/aio-wait.c
+++ b/util/aio-wait.c
+@@ -35,7 +35,21 @@ static void dummy_bh_cb(void *opaque)
+ 
+ void aio_wait_kick(void)
+ {
+-    /* The barrier (or an atomic op) is in the caller.  */
+    /*
+     * Paired with smp_mb in AIO_WAIT_WHILE. Here we have:
+     * write(condition);
+     * aio_wait_kick() {
+     *      smp_mb();
+     *      read(num_waiters);
+     * }
+     *
+     * And in AIO_WAIT_WHILE:
+     * write(num_waiters);
+     * smp_mb();
+     * read(condition);
+     */
+    smp_mb();
+
+     if (qatomic_read(&global_aio_wait.num_waiters)) {
+         aio_bh_schedule_oneshot(qemu_get_aio_context(), dummy_bh_cb, NULL);
+     }
+-- 
+2.37.3
+
--- a/SOURCES/kvm-apic-disable-reentrancy-detection-for-apic-msi.patch
+++ b/SOURCES/kvm-apic-disable-reentrancy-detection-for-apic-msi.patch
@ -0,0 +1,56 @@
+From 47d027147694fde94dd73305ee53b6a136cbeced Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 9 May 2023 10:29:03 -0400
+Subject: [PATCH 08/15] apic: disable reentrancy detection for apic-msi
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 277: memory: prevent dma-reentracy issues
+RH-Bugzilla: 1999236
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [8/12] 25c3cf99b00cd9adc10d6e7afa9c3e3b7da08de2 (redhat/rhel/src/qemu-kvm/jons-qemu-kvm-2)
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1999236
+Upstream: Merged
+CVE: CVE-2021-3750
+
+commit 50795ee051a342c681a9b45671c552fbd6274db8
+Author: Alexander Bulekov <alxndr@bu.edu>
+Date:   Thu Apr 27 17:10:13 2023 -0400
+
+    apic: disable reentrancy detection for apic-msi
+
+    As the code is designed for re-entrant calls to apic-msi, mark apic-msi
+    as reentrancy-safe.
+
+    Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
+    Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
+    Message-Id: <20230427211013.2994127-9-alxndr@bu.edu>
+    Signed-off-by: Thomas Huth <thuth@redhat.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ hw/intc/apic.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/hw/intc/apic.c b/hw/intc/apic.c
+index 3df11c34d6..a7c2b301a8 100644
+--- a/hw/intc/apic.c
+++ b/hw/intc/apic.c
+@@ -883,6 +883,13 @@ static void apic_realize(DeviceState *dev, Error **errp)
+     memory_region_init_io(&s->io_memory, OBJECT(s), &apic_io_ops, s, "apic-msi",
+                           APIC_SPACE_SIZE);
+ 
+    /*
+     * apic-msi's apic_mem_write can call into ioapic_eoi_broadcast, which can
+     * write back to apic-msi. As such mark the apic-msi region re-entrancy
+     * safe.
+     */
+    s->io_memory.disable_reentrancy_guard = true;
+
+     s->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, apic_timer, s);
+     local_apics[s->id] = s;
+ 
+-- 
+2.37.3
+
--- a/SOURCES/kvm-async-Add-an-optional-reentrancy-guard-to-the-BH-API.patch
+++ b/SOURCES/kvm-async-Add-an-optional-reentrancy-guard-to-the-BH-API.patch
@ -0,0 +1,235 @@
+From 8996ac4369de7e0cb6f911db6f47c3e4ae88c8aa Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 9 May 2023 10:29:03 -0400
+Subject: [PATCH 02/15] async: Add an optional reentrancy guard to the BH API
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 277: memory: prevent dma-reentracy issues
+RH-Bugzilla: 1999236
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [2/12] b03f247e242a6cdb3eebec36477234ac77dcd20c (redhat/rhel/src/qemu-kvm/jons-qemu-kvm-2)
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1999236
+Upstream: Merged
+CVE: CVE-2021-3750
+Conflict: The file block/graph-lock.h, inluded from include/block/aio.h,
+          doesn't exist in this code version. The code compiles without
+          issues if this include is just omitted, so we do that.
+
+commit 9c86c97f12c060bf7484dd931f38634e166a81f0
+Author: Alexander Bulekov <alxndr@bu.edu>
+Date:   Thu Apr 27 17:10:07 2023 -0400
+
+    async: Add an optional reentrancy guard to the BH API
+
+    Devices can pass their MemoryReentrancyGuard (from their DeviceState),
+    when creating new BHes. Then, the async API will toggle the guard
+    before/after calling the BH call-back. This prevents bh->mmio reentrancy
+    issues.
+
+    Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
+    Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
+    Message-Id: <20230427211013.2994127-3-alxndr@bu.edu>
+    [thuth: Fix "line over 90 characters" checkpatch.pl error]
+    Signed-off-by: Thomas Huth <thuth@redhat.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ docs/devel/multiple-iothreads.txt |  7 +++++++
+ include/block/aio.h               | 18 ++++++++++++++++--
+ include/qemu/main-loop.h          |  7 +++++--
+ tests/unit/ptimer-test-stubs.c    |  3 ++-
+ util/async.c                      | 18 +++++++++++++++++-
+ util/main-loop.c                  |  6 ++++--
+ util/trace-events                 |  1 +
+ 7 files changed, 52 insertions(+), 8 deletions(-)
+
+diff --git a/docs/devel/multiple-iothreads.txt b/docs/devel/multiple-iothreads.txt
+index aeb997bed5..a11576bc74 100644
+--- a/docs/devel/multiple-iothreads.txt
+++ b/docs/devel/multiple-iothreads.txt
+@@ -61,6 +61,7 @@ There are several old APIs that use the main loop AioContext:
+  * LEGACY qemu_aio_set_event_notifier() - monitor an event notifier
+  * LEGACY timer_new_ms() - create a timer
+  * LEGACY qemu_bh_new() - create a BH
+ * LEGACY qemu_bh_new_guarded() - create a BH with a device re-entrancy guard
+  * LEGACY qemu_aio_wait() - run an event loop iteration
+ 
+ Since they implicitly work on the main loop they cannot be used in code that
+@@ -72,8 +73,14 @@ Instead, use the AioContext functions directly (see include/block/aio.h):
+  * aio_set_event_notifier() - monitor an event notifier
+  * aio_timer_new() - create a timer
+  * aio_bh_new() - create a BH
+ * aio_bh_new_guarded() - create a BH with a device re-entrancy guard
+  * aio_poll() - run an event loop iteration
+ 
+The qemu_bh_new_guarded/aio_bh_new_guarded APIs accept a "MemReentrancyGuard"
+argument, which is used to check for and prevent re-entrancy problems. For
+BHs associated with devices, the reentrancy-guard is contained in the
+corresponding DeviceState and named "mem_reentrancy_guard".
+
+ The AioContext can be obtained from the IOThread using
+ iothread_get_aio_context() or for the main loop using qemu_get_aio_context().
+ Code that takes an AioContext argument works both in IOThreads or the main
+diff --git a/include/block/aio.h b/include/block/aio.h
+index 47fbe9d81f..c7da152985 100644
+--- a/include/block/aio.h
+++ b/include/block/aio.h
+@@ -22,6 +22,8 @@
+ #include "qemu/event_notifier.h"
+ #include "qemu/thread.h"
+ #include "qemu/timer.h"
+#include "hw/qdev-core.h"
+
+ 
+ typedef struct BlockAIOCB BlockAIOCB;
+ typedef void BlockCompletionFunc(void *opaque, int ret);
+@@ -321,9 +323,11 @@ void aio_bh_schedule_oneshot_full(AioContext *ctx, QEMUBHFunc *cb, void *opaque,
+  * is opaque and must be allocated prior to its use.
+  *
+  * @name: A human-readable identifier for debugging purposes.
+ * @reentrancy_guard: A guard set when entering a cb to prevent
+ * device-reentrancy issues
+  */
+ QEMUBH *aio_bh_new_full(AioContext *ctx, QEMUBHFunc *cb, void *opaque,
+-                        const char *name);
+                        const char *name, MemReentrancyGuard *reentrancy_guard);
+ 
+ /**
+  * aio_bh_new: Allocate a new bottom half structure
+@@ -332,7 +336,17 @@ QEMUBH *aio_bh_new_full(AioContext *ctx, QEMUBHFunc *cb, void *opaque,
+  * string.
+  */
+ #define aio_bh_new(ctx, cb, opaque) \
+-    aio_bh_new_full((ctx), (cb), (opaque), (stringify(cb)))
+    aio_bh_new_full((ctx), (cb), (opaque), (stringify(cb)), NULL)
+
+/**
+ * aio_bh_new_guarded: Allocate a new bottom half structure with a
+ * reentrancy_guard
+ *
+ * A convenience wrapper for aio_bh_new_full() that uses the cb as the name
+ * string.
+ */
+#define aio_bh_new_guarded(ctx, cb, opaque, guard) \
+    aio_bh_new_full((ctx), (cb), (opaque), (stringify(cb)), guard)
+ 
+ /**
+  * aio_notify: Force processing of pending events.
+diff --git a/include/qemu/main-loop.h b/include/qemu/main-loop.h
+index 8dbc6fcb89..85dd5ada9e 100644
+--- a/include/qemu/main-loop.h
+++ b/include/qemu/main-loop.h
+@@ -294,9 +294,12 @@ void qemu_cond_timedwait_iothread(QemuCond *cond, int ms);
+ 
+ void qemu_fd_register(int fd);
+ 
+#define qemu_bh_new_guarded(cb, opaque, guard) \
+    qemu_bh_new_full((cb), (opaque), (stringify(cb)), guard)
+ #define qemu_bh_new(cb, opaque) \
+-    qemu_bh_new_full((cb), (opaque), (stringify(cb)))
+-QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name);
+    qemu_bh_new_full((cb), (opaque), (stringify(cb)), NULL)
+QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name,
+                         MemReentrancyGuard *reentrancy_guard);
+ void qemu_bh_schedule_idle(QEMUBH *bh);
+ 
+ enum {
+diff --git a/tests/unit/ptimer-test-stubs.c b/tests/unit/ptimer-test-stubs.c
+index 2a3ef58799..a7a2d08e7e 100644
+--- a/tests/unit/ptimer-test-stubs.c
+++ b/tests/unit/ptimer-test-stubs.c
+@@ -108,7 +108,8 @@ int64_t qemu_clock_deadline_ns_all(QEMUClockType type, int attr_mask)
+     return deadline;
+ }
+ 
+-QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name)
+QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name,
+                         MemReentrancyGuard *reentrancy_guard)
+ {
+     QEMUBH *bh = g_new(QEMUBH, 1);
+ 
+diff --git a/util/async.c b/util/async.c
+index 2a63bf90f2..1fff02e7fc 100644
+--- a/util/async.c
+++ b/util/async.c
+@@ -62,6 +62,7 @@ struct QEMUBH {
+     void *opaque;
+     QSLIST_ENTRY(QEMUBH) next;
+     unsigned flags;
+    MemReentrancyGuard *reentrancy_guard;
+ };
+ 
+ /* Called concurrently from any thread */
+@@ -127,7 +128,7 @@ void aio_bh_schedule_oneshot_full(AioContext *ctx, QEMUBHFunc *cb,
+ }
+ 
+ QEMUBH *aio_bh_new_full(AioContext *ctx, QEMUBHFunc *cb, void *opaque,
+-                        const char *name)
+                        const char *name, MemReentrancyGuard *reentrancy_guard)
+ {
+     QEMUBH *bh;
+     bh = g_new(QEMUBH, 1);
+@@ -136,13 +137,28 @@ QEMUBH *aio_bh_new_full(AioContext *ctx, QEMUBHFunc *cb, void *opaque,
+         .cb = cb,
+         .opaque = opaque,
+         .name = name,
+        .reentrancy_guard = reentrancy_guard,
+     };
+     return bh;
+ }
+ 
+ void aio_bh_call(QEMUBH *bh)
+ {
+    bool last_engaged_in_io = false;
+
+    if (bh->reentrancy_guard) {
+        last_engaged_in_io = bh->reentrancy_guard->engaged_in_io;
+        if (bh->reentrancy_guard->engaged_in_io) {
+            trace_reentrant_aio(bh->ctx, bh->name);
+        }
+        bh->reentrancy_guard->engaged_in_io = true;
+    }
+
+     bh->cb(bh->opaque);
+
+    if (bh->reentrancy_guard) {
+        bh->reentrancy_guard->engaged_in_io = last_engaged_in_io;
+    }
+ }
+ 
+ /* Multiple occurrences of aio_bh_poll cannot be called concurrently. */
+diff --git a/util/main-loop.c b/util/main-loop.c
+index 06b18b195c..1eacf04691 100644
+--- a/util/main-loop.c
+++ b/util/main-loop.c
+@@ -544,9 +544,11 @@ void main_loop_wait(int nonblocking)
+ 
+ /* Functions to operate on the main QEMU AioContext.  */
+ 
+-QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name)
+QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name,
+                         MemReentrancyGuard *reentrancy_guard)
+ {
+-    return aio_bh_new_full(qemu_aio_context, cb, opaque, name);
+    return aio_bh_new_full(qemu_aio_context, cb, opaque, name,
+                           reentrancy_guard);
+ }
+ 
+ /*
+diff --git a/util/trace-events b/util/trace-events
+index c8f53d7d9f..dc3b1eb3bf 100644
+--- a/util/trace-events
+++ b/util/trace-events
+@@ -11,6 +11,7 @@ poll_remove(void *ctx, void *node, int fd) "ctx %p node %p fd %d"
+ # async.c
+ aio_co_schedule(void *ctx, void *co) "ctx %p co %p"
+ aio_co_schedule_bh_cb(void *ctx, void *co) "ctx %p co %p"
+reentrant_aio(void *ctx, const char *name) "ctx %p name %s"
+ 
+ # thread-pool.c
+ thread_pool_submit(void *pool, void *req, void *opaque) "pool %p req %p opaque %p"
+-- 
+2.37.3
+
--- a/SOURCES/kvm-async-avoid-use-after-free-on-re-entrancy-guard.patch
+++ b/SOURCES/kvm-async-avoid-use-after-free-on-re-entrancy-guard.patch
@ -0,0 +1,71 @@
+From d754050d260e2ad890cecd975df6e163c531b40e Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 9 May 2023 10:29:03 -0400
+Subject: [PATCH 09/15] async: avoid use-after-free on re-entrancy guard
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 277: memory: prevent dma-reentracy issues
+RH-Bugzilla: 1999236
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [9/12] d357650e581c3921bbfe3e2fde5e3f55853b5fab (redhat/rhel/src/qemu-kvm/jons-qemu-kvm-2)
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1999236
+Upstream: Merged
+CVE: CVE-2021-3750
+
+commit 7915bd06f25e1803778081161bf6fa10c42dc7cd
+Author: Alexander Bulekov <alxndr@bu.edu>
+Date:   Mon May 1 10:19:56 2023 -0400
+
+    async: avoid use-after-free on re-entrancy guard
+
+    A BH callback can free the BH, causing a use-after-free in aio_bh_call.
+    Fix that by keeping a local copy of the re-entrancy guard pointer.
+
+    Buglink: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58513
+    Fixes: 9c86c97f12 ("async: Add an optional reentrancy guard to the BH API")
+    Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
+    Message-Id: <20230501141956.3444868-1-alxndr@bu.edu>
+    Reviewed-by: Thomas Huth <thuth@redhat.com>
+    Signed-off-by: Thomas Huth <thuth@redhat.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ util/async.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/util/async.c b/util/async.c
+index 1fff02e7fc..ffe0541c3b 100644
+--- a/util/async.c
+++ b/util/async.c
+@@ -146,18 +146,20 @@ void aio_bh_call(QEMUBH *bh)
+ {
+     bool last_engaged_in_io = false;
+ 
+-    if (bh->reentrancy_guard) {
+-        last_engaged_in_io = bh->reentrancy_guard->engaged_in_io;
+-        if (bh->reentrancy_guard->engaged_in_io) {
+    /* Make a copy of the guard-pointer as cb may free the bh */
+    MemReentrancyGuard *reentrancy_guard = bh->reentrancy_guard;
+    if (reentrancy_guard) {
+        last_engaged_in_io = reentrancy_guard->engaged_in_io;
+        if (reentrancy_guard->engaged_in_io) {
+             trace_reentrant_aio(bh->ctx, bh->name);
+         }
+-        bh->reentrancy_guard->engaged_in_io = true;
+        reentrancy_guard->engaged_in_io = true;
+     }
+ 
+     bh->cb(bh->opaque);
+ 
+-    if (bh->reentrancy_guard) {
+-        bh->reentrancy_guard->engaged_in_io = last_engaged_in_io;
+    if (reentrancy_guard) {
+        reentrancy_guard->engaged_in_io = last_engaged_in_io;
+     }
+ }
+ 
+-- 
+2.37.3
+
--- a/SOURCES/kvm-async-clarify-usage-of-barriers-in-the-polling-case.patch
+++ b/SOURCES/kvm-async-clarify-usage-of-barriers-in-the-polling-case.patch
@ -0,0 +1,66 @@
+From 187eb7a418af93375e42298d06e231e2bec3cf00 Mon Sep 17 00:00:00 2001
+From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+Date: Thu, 9 Mar 2023 08:15:42 -0500
+Subject: [PATCH 10/13] async: clarify usage of barriers in the polling case
+
+RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+RH-MergeRequest: 263: qatomic: add smp_mb__before/after_rmw()
+RH-Bugzilla: 2168472
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Eric Auger <eric.auger@redhat.com>
+RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+RH-Acked-by: David Hildenbrand <david@redhat.com>
+RH-Commit: [10/10] 3be07ccc6137a0336becfe63a818d9cbadb38e9c
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2168472
+
+commit 6229438cca037d42f44a96d38feb15cb102a444f
+Author: Paolo Bonzini <pbonzini@redhat.com>
+Date:   Mon Mar 6 10:43:52 2023 +0100
+
+    async: clarify usage of barriers in the polling case
+
+    Explain that aio_context_notifier_poll() relies on
+    aio_notify_accept() to catch all the memory writes that were
+    done before ctx->notified was set to true.
+
+    Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+    Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+
+Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+---
+ util/async.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/util/async.c b/util/async.c
+index 795fe699b6..2a63bf90f2 100644
+--- a/util/async.c
+++ b/util/async.c
+@@ -463,8 +463,9 @@ void aio_notify_accept(AioContext *ctx)
+     qatomic_set(&ctx->notified, false);
+ 
+     /*
+-     * Write ctx->notified before reading e.g. bh->flags.  Pairs with smp_wmb
+-     * in aio_notify.
+     * Order reads of ctx->notified (in aio_context_notifier_poll()) and the
+     * above clearing of ctx->notified before reads of e.g. bh->flags.  Pairs
+     * with smp_wmb() in aio_notify.
+      */
+     smp_mb();
+ }
+@@ -487,6 +488,11 @@ static bool aio_context_notifier_poll(void *opaque)
+     EventNotifier *e = opaque;
+     AioContext *ctx = container_of(e, AioContext, notifier);
+ 
+    /*
+     * No need for load-acquire because we just want to kick the
+     * event loop.  aio_notify_accept() takes care of synchronizing
+     * the event loop with the producers.
+     */
+     return qatomic_read(&ctx->notified);
+ }
+ 
+-- 
+2.37.3
+
--- a/SOURCES/kvm-async-update-documentation-of-the-memory-barriers.patch
+++ b/SOURCES/kvm-async-update-documentation-of-the-memory-barriers.patch
@ -0,0 +1,111 @@
+From ea3856bb545d19499602830cdc3076d83a981e7a Mon Sep 17 00:00:00 2001
+From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+Date: Thu, 9 Mar 2023 08:15:36 -0500
+Subject: [PATCH 09/13] async: update documentation of the memory barriers
+
+RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+RH-MergeRequest: 263: qatomic: add smp_mb__before/after_rmw()
+RH-Bugzilla: 2168472
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Eric Auger <eric.auger@redhat.com>
+RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+RH-Acked-by: David Hildenbrand <david@redhat.com>
+RH-Commit: [9/10] d471da2acf7a107cf75f3327c5e8d7456307160e
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2168472
+
+commit 8dd48650b43dfde4ebea34191ac267e474bcc29e
+Author: Paolo Bonzini <pbonzini@redhat.com>
+Date:   Mon Mar 6 10:15:06 2023 +0100
+
+    async: update documentation of the memory barriers
+
+    Ever since commit 8c6b0356b539 ("util/async: make bh_aio_poll() O(1)",
+    2020-02-22), synchronization between qemu_bh_schedule() and aio_bh_poll()
+    is happening when the bottom half is enqueued in the bh_list; not
+    when the flags are set.  Update the documentation to match.
+
+    Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+
+Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+---
+ util/async.c | 33 +++++++++++++++++++--------------
+ 1 file changed, 19 insertions(+), 14 deletions(-)
+
+diff --git a/util/async.c b/util/async.c
+index 6f6717a34b..795fe699b6 100644
+--- a/util/async.c
+++ b/util/async.c
+@@ -71,14 +71,21 @@ static void aio_bh_enqueue(QEMUBH *bh, unsigned new_flags)
+     unsigned old_flags;
+ 
+     /*
+-     * The memory barrier implicit in qatomic_fetch_or makes sure that:
+-     * 1. idle & any writes needed by the callback are done before the
+-     *    locations are read in the aio_bh_poll.
+-     * 2. ctx is loaded before the callback has a chance to execute and bh
+-     *    could be freed.
+     * Synchronizes with atomic_fetch_and() in aio_bh_dequeue(), ensuring that
+     * insertion starts after BH_PENDING is set.
+      */
+     old_flags = qatomic_fetch_or(&bh->flags, BH_PENDING | new_flags);
+
+     if (!(old_flags & BH_PENDING)) {
+        /*
+         * At this point the bottom half becomes visible to aio_bh_poll().
+         * This insertion thus synchronizes with QSLIST_MOVE_ATOMIC in
+         * aio_bh_poll(), ensuring that:
+         * 1. any writes needed by the callback are visible from the callback
+         *    after aio_bh_dequeue() returns bh.
+         * 2. ctx is loaded before the callback has a chance to execute and bh
+         *    could be freed.
+         */
+         QSLIST_INSERT_HEAD_ATOMIC(&ctx->bh_list, bh, next);
+     }
+ 
+@@ -97,11 +104,8 @@ static QEMUBH *aio_bh_dequeue(BHList *head, unsigned *flags)
+     QSLIST_REMOVE_HEAD(head, next);
+ 
+     /*
+-     * The qatomic_and is paired with aio_bh_enqueue().  The implicit memory
+-     * barrier ensures that the callback sees all writes done by the scheduling
+-     * thread.  It also ensures that the scheduling thread sees the cleared
+-     * flag before bh->cb has run, and thus will call aio_notify again if
+-     * necessary.
+     * Synchronizes with qatomic_fetch_or() in aio_bh_enqueue(), ensuring that
+     * the removal finishes before BH_PENDING is reset.
+      */
+     *flags = qatomic_fetch_and(&bh->flags,
+                               ~(BH_PENDING | BH_SCHEDULED | BH_IDLE));
+@@ -148,6 +152,7 @@ int aio_bh_poll(AioContext *ctx)
+     BHListSlice *s;
+     int ret = 0;
+ 
+    /* Synchronizes with QSLIST_INSERT_HEAD_ATOMIC in aio_bh_enqueue().  */
+     QSLIST_MOVE_ATOMIC(&slice.bh_list, &ctx->bh_list);
+     QSIMPLEQ_INSERT_TAIL(&ctx->bh_slice_list, &slice, next);
+ 
+@@ -437,15 +442,15 @@ LuringState *aio_get_linux_io_uring(AioContext *ctx)
+ void aio_notify(AioContext *ctx)
+ {
+     /*
+-     * Write e.g. bh->flags before writing ctx->notified.  Pairs with smp_mb in
+-     * aio_notify_accept.
+     * Write e.g. ctx->bh_list before writing ctx->notified.  Pairs with
+     * smp_mb() in aio_notify_accept().
+      */
+     smp_wmb();
+     qatomic_set(&ctx->notified, true);
+ 
+     /*
+-     * Write ctx->notified before reading ctx->notify_me.  Pairs
+-     * with smp_mb in aio_ctx_prepare or aio_poll.
+     * Write ctx->notified (and also ctx->bh_list) before reading ctx->notify_me.
+     * Pairs with smp_mb() in aio_ctx_prepare or aio_poll.
+      */
+     smp_mb();
+     if (qatomic_read(&ctx->notify_me)) {
+-- 
+2.37.3
+
--- a/SOURCES/kvm-backends-hostmem-Fix-support-of-memory-backend-memfd.patch
+++ b/SOURCES/kvm-backends-hostmem-Fix-support-of-memory-backend-memfd.patch
@ -0,0 +1,71 @@
+From 60da56e3685969493ae483c3cc2c66af13d00baf Mon Sep 17 00:00:00 2001
+From: Thomas Huth <thuth@redhat.com>
+Date: Wed, 10 Aug 2022 14:57:18 +0200
+Subject: [PATCH 1/3] backends/hostmem: Fix support of memory-backend-memfd in
+ qemu_maxrampagesize()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Cédric Le Goater <None>
+RH-MergeRequest: 221: backends/hostmem: Fix support of memory-backend-memfd in qemu_maxrampagesize()
+RH-Bugzilla: 2117149
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: David Hildenbrand <david@redhat.com>
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Commit: [1/1] b5a1047750af32c0a261b8385ea0e819eb16681a
+
+It is currently not possible yet to use "memory-backend-memfd" on s390x
+with hugepages enabled. This problem is caused by qemu_maxrampagesize()
+not taking memory-backend-memfd objects into account yet, so the code
+in s390_memory_init() fails to enable the huge page support there via
+s390_set_max_pagesize(). Fix it by generalizing the code, so that it
+looks at qemu_ram_pagesize(memdev->mr.ram_block) instead of re-trying
+to get the information from the filesystem.
+
+Suggested-by: David Hildenbrand <david@redhat.com>
+Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2116496
+Message-Id: <20220810125720.3849835-2-thuth@redhat.com>
+Reviewed-by: David Hildenbrand <david@redhat.com>
+Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+(cherry picked from commit 8be934b70e923104da883b990dee18f02552d40e)
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2117149
+[clg: Resolved conflict on qemu_real_host_page_size() ]
+Signed-off-by: Cédric Le Goater <clg@redhat.com>
+---
+ backends/hostmem.c | 14 ++------------
+ 1 file changed, 2 insertions(+), 12 deletions(-)
+
+diff --git a/backends/hostmem.c b/backends/hostmem.c
+index 4c05862ed5..0c4654ea85 100644
+--- a/backends/hostmem.c
+++ b/backends/hostmem.c
+@@ -305,22 +305,12 @@ bool host_memory_backend_is_mapped(HostMemoryBackend *backend)
+     return backend->is_mapped;
+ }
+ 
+-#ifdef __linux__
+ size_t host_memory_backend_pagesize(HostMemoryBackend *memdev)
+ {
+-    Object *obj = OBJECT(memdev);
+-    char *path = object_property_get_str(obj, "mem-path", NULL);
+-    size_t pagesize = qemu_mempath_getpagesize(path);
+-
+-    g_free(path);
+    size_t pagesize = qemu_ram_pagesize(memdev->mr.ram_block);
+    g_assert(pagesize >= qemu_real_host_page_size);
+     return pagesize;
+ }
+-#else
+-size_t host_memory_backend_pagesize(HostMemoryBackend *memdev)
+-{
+-    return qemu_real_host_page_size;
+-}
+-#endif
+ 
+ static void
+ host_memory_backend_memory_complete(UserCreatable *uc, Error **errp)
+-- 
+2.35.3
+
--- a/SOURCES/kvm-bcm2835_property-disable-reentrancy-detection-for-io.patch
+++ b/SOURCES/kvm-bcm2835_property-disable-reentrancy-detection-for-io.patch
@ -0,0 +1,58 @@
+From 7715635d018351e0a5c4c25aec2c71a2fe3b9e69 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 9 May 2023 10:29:03 -0400
+Subject: [PATCH 06/15] bcm2835_property: disable reentrancy detection for
+ iomem
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 277: memory: prevent dma-reentracy issues
+RH-Bugzilla: 1999236
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [6/12] 4d6187430ca1c4309a36824c0c6815d2a763db1a (redhat/rhel/src/qemu-kvm/jons-qemu-kvm-2)
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1999236
+Upstream: Merged
+CVE: CVE-2021-3750
+
+commit 985c4a4e547afb9573b6bd6843d20eb2c3d1d1cd
+Author: Alexander Bulekov <alxndr@bu.edu>
+Date:   Thu Apr 27 17:10:11 2023 -0400
+
+    bcm2835_property: disable reentrancy detection for iomem
+
+    As the code is designed for re-entrant calls from bcm2835_property to
+    bcm2835_mbox and back into bcm2835_property, mark iomem as
+    reentrancy-safe.
+
+    Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
+    Reviewed-by: Thomas Huth <thuth@redhat.com>
+    Message-Id: <20230427211013.2994127-7-alxndr@bu.edu>
+    Signed-off-by: Thomas Huth <thuth@redhat.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ hw/misc/bcm2835_property.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/hw/misc/bcm2835_property.c b/hw/misc/bcm2835_property.c
+index 73941bdae9..022b5a849c 100644
+--- a/hw/misc/bcm2835_property.c
+++ b/hw/misc/bcm2835_property.c
+@@ -377,6 +377,13 @@ static void bcm2835_property_init(Object *obj)
+ 
+     memory_region_init_io(&s->iomem, OBJECT(s), &bcm2835_property_ops, s,
+                           TYPE_BCM2835_PROPERTY, 0x10);
+
+    /*
+     * bcm2835_property_ops call into bcm2835_mbox, which in-turn reads from
+     * iomem. As such, mark iomem as re-entracy safe.
+     */
+    s->iomem.disable_reentrancy_guard = true;
+
+     sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
+     sysbus_init_irq(SYS_BUS_DEVICE(s), &s->mbox_irq);
+ }
+-- 
+2.37.3
+
--- a/SOURCES/kvm-block-Call-drain-callbacks-only-once.patch
+++ b/SOURCES/kvm-block-Call-drain-callbacks-only-once.patch
@ -1,250 +0,0 @@
-From 9bb9cafd736057fd2a8ebfa6f5769668f125fbe6 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Fri, 18 Nov 2022 18:41:06 +0100
-Subject: [PATCH 24/31] block: Call drain callbacks only once
-
-RH-Author: Stefano Garzarella <sgarzare@redhat.com>
-RH-MergeRequest: 135: block: Simplify drain to prevent QEMU from crashing during snapshot
-RH-Bugzilla: 2155112
-RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Commit: [12/16] ea9a433dc01d1b8539a2d4ea12887f2a3ce830ea (sgarzarella/qemu-kvm-c-9-s)
-
-We only need to call both the BlockDriver's callback and the parent
-callbacks when going from undrained to drained or vice versa. A second
-drain section doesn't make a difference for the driver or the parent,
-they weren't supposed to send new requests before and after the second
-drain.
-
-One thing that gets in the way is the 'ignore_bds_parents' parameter in
-bdrv_do_drained_begin_quiesce() and bdrv_do_drained_end(): It means that
-bdrv_drain_all_begin() increases bs->quiesce_counter, but does not
-quiesce the parent through BdrvChildClass callbacks. If an additional
-drain section is started now, bs->quiesce_counter will be non-zero, but
-we would still need to quiesce the parent through BdrvChildClass in
-order to keep things consistent (and unquiesce it on the matching
-bdrv_drained_end(), even though the counter would not reach 0 yet as
-long as the bdrv_drain_all() section is still active).
-
-Instead of keeping track of this, let's just get rid of the parameter.
-It was introduced in commit 6cd5c9d7b2d as an optimisation so that
-during bdrv_drain_all(), we wouldn't recursively drain all parents up to
-the root for each node, resulting in quadratic complexity. As it happens,
-calling the callbacks only once solves the same problem, so as of this
-patch, we'll still have O(n) complexity and ignore_bds_parents is not
-needed any more.
-
-This patch only ignores the 'ignore_bds_parents' parameter. It will be
-removed in a separate patch.
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Reviewed-by: Hanna Reitz <hreitz@redhat.com>
-Message-Id: <20221118174110.55183-12-kwolf@redhat.com>
-Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 57e05be343f33f4e5899a8d8946a8596d68424a1)
-Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
---
- block.c                          | 25 +++++++------------------
- block/io.c                       | 30 ++++++++++++++++++------------
- include/block/block_int-common.h |  8 ++++----
- tests/unit/test-bdrv-drain.c     | 16 ++++++++++------
- 4 files changed, 39 insertions(+), 40 deletions(-)
-
-diff --git a/block.c b/block.c
-index e0e3b21790..5a583e260d 100644
--- a/block.c
-+++ b/block.c
-@@ -2824,7 +2824,6 @@ static void bdrv_replace_child_noperm(BdrvChild *child,
- {
-     BlockDriverState *old_bs = child->bs;
-     int new_bs_quiesce_counter;
-    int drain_saldo;
- 
-     assert(!child->frozen);
-     assert(old_bs != new_bs);
-@@ -2834,16 +2833,13 @@ static void bdrv_replace_child_noperm(BdrvChild *child,
-         assert(bdrv_get_aio_context(old_bs) == bdrv_get_aio_context(new_bs));
-     }
- 
-    new_bs_quiesce_counter = (new_bs ? new_bs->quiesce_counter : 0);
-    drain_saldo = new_bs_quiesce_counter - child->parent_quiesce_counter;
-
-     /*
-      * If the new child node is drained but the old one was not, flush
-      * all outstanding requests to the old child node.
-      */
-    while (drain_saldo > 0 && child->klass->drained_begin) {
-+    new_bs_quiesce_counter = (new_bs ? new_bs->quiesce_counter : 0);
-+    if (new_bs_quiesce_counter && !child->quiesced_parent) {
-         bdrv_parent_drained_begin_single(child, true);
-        drain_saldo--;
-     }
- 
-     if (old_bs) {
-@@ -2859,16 +2855,6 @@ static void bdrv_replace_child_noperm(BdrvChild *child,
-     if (new_bs) {
-         assert_bdrv_graph_writable(new_bs);
-         QLIST_INSERT_HEAD(&new_bs->parents, child, next_parent);
-
-        /*
-         * Polling in bdrv_parent_drained_begin_single() may have led to the new
-         * node's quiesce_counter having been decreased.  Not a problem, we just
-         * need to recognize this here and then invoke drained_end appropriately
-         * more often.
-         */
-        assert(new_bs->quiesce_counter <= new_bs_quiesce_counter);
-        drain_saldo += new_bs->quiesce_counter - new_bs_quiesce_counter;
-
-         if (child->klass->attach) {
-             child->klass->attach(child);
-         }
-@@ -2877,10 +2863,13 @@ static void bdrv_replace_child_noperm(BdrvChild *child,
-     /*
-      * If the old child node was drained but the new one is not, allow
-      * requests to come in only after the new node has been attached.
-+     *
-+     * Update new_bs_quiesce_counter because bdrv_parent_drained_begin_single()
-+     * polls, which could have changed the value.
-      */
-    while (drain_saldo < 0 && child->klass->drained_end) {
-+    new_bs_quiesce_counter = (new_bs ? new_bs->quiesce_counter : 0);
-+    if (!new_bs_quiesce_counter && child->quiesced_parent) {
-         bdrv_parent_drained_end_single(child);
-        drain_saldo++;
-     }
- }
- 
-diff --git a/block/io.c b/block/io.c
-index 75224480d0..87d6f22ec4 100644
--- a/block/io.c
-+++ b/block/io.c
-@@ -62,8 +62,9 @@ void bdrv_parent_drained_end_single(BdrvChild *c)
- {
-     IO_OR_GS_CODE();
- 
-    assert(c->parent_quiesce_counter > 0);
-    c->parent_quiesce_counter--;
-+    assert(c->quiesced_parent);
-+    c->quiesced_parent = false;
-+
-     if (c->klass->drained_end) {
-         c->klass->drained_end(c);
-     }
-@@ -110,7 +111,10 @@ void bdrv_parent_drained_begin_single(BdrvChild *c, bool poll)
- {
-     AioContext *ctx = bdrv_child_get_parent_aio_context(c);
-     IO_OR_GS_CODE();
-    c->parent_quiesce_counter++;
-+
-+    assert(!c->quiesced_parent);
-+    c->quiesced_parent = true;
-+
-     if (c->klass->drained_begin) {
-         c->klass->drained_begin(c);
-     }
-@@ -358,11 +362,12 @@ void bdrv_do_drained_begin_quiesce(BlockDriverState *bs,
-     /* Stop things in parent-to-child order */
-     if (qatomic_fetch_inc(&bs->quiesce_counter) == 0) {
-         aio_disable_external(bdrv_get_aio_context(bs));
-    }
- 
-    bdrv_parent_drained_begin(bs, parent, ignore_bds_parents);
-    if (bs->drv && bs->drv->bdrv_drain_begin) {
-        bs->drv->bdrv_drain_begin(bs);
-+        /* TODO Remove ignore_bds_parents, we don't consider it any more */
-+        bdrv_parent_drained_begin(bs, parent, false);
-+        if (bs->drv && bs->drv->bdrv_drain_begin) {
-+            bs->drv->bdrv_drain_begin(bs);
-+        }
-     }
- }
- 
-@@ -413,13 +418,14 @@ static void bdrv_do_drained_end(BlockDriverState *bs, BdrvChild *parent,
-     assert(bs->quiesce_counter > 0);
- 
-     /* Re-enable things in child-to-parent order */
-    if (bs->drv && bs->drv->bdrv_drain_end) {
-        bs->drv->bdrv_drain_end(bs);
-    }
-    bdrv_parent_drained_end(bs, parent, ignore_bds_parents);
-
-     old_quiesce_counter = qatomic_fetch_dec(&bs->quiesce_counter);
-     if (old_quiesce_counter == 1) {
-+        if (bs->drv && bs->drv->bdrv_drain_end) {
-+            bs->drv->bdrv_drain_end(bs);
-+        }
-+        /* TODO Remove ignore_bds_parents, we don't consider it any more */
-+        bdrv_parent_drained_end(bs, parent, false);
-+
-         aio_enable_external(bdrv_get_aio_context(bs));
-     }
- }
-diff --git a/include/block/block_int-common.h b/include/block/block_int-common.h
-index 791dddfd7d..a6bc6b7fe9 100644
--- a/include/block/block_int-common.h
-+++ b/include/block/block_int-common.h
-@@ -980,13 +980,13 @@ struct BdrvChild {
-     bool frozen;
- 
-     /*
-     * How many times the parent of this child has been drained
-+     * True if the parent of this child has been drained by this BdrvChild
-      * (through klass->drained_*).
-     * Usually, this is equal to bs->quiesce_counter (potentially
-     * reduced by bdrv_drain_all_count).  It may differ while the
-+     *
-+     * It is generally true if bs->quiesce_counter > 0. It may differ while the
-      * child is entering or leaving a drained section.
-      */
-    int parent_quiesce_counter;
-+    bool quiesced_parent;
- 
-     QLIST_ENTRY(BdrvChild) next;
-     QLIST_ENTRY(BdrvChild) next_parent;
-diff --git a/tests/unit/test-bdrv-drain.c b/tests/unit/test-bdrv-drain.c
-index dda08de8db..172bc6debc 100644
--- a/tests/unit/test-bdrv-drain.c
-+++ b/tests/unit/test-bdrv-drain.c
-@@ -296,7 +296,11 @@ static void test_quiesce_common(enum drain_type drain_type, bool recursive)
- 
-     do_drain_begin(drain_type, bs);
- 
-    g_assert_cmpint(bs->quiesce_counter, ==, 1);
-+    if (drain_type == BDRV_DRAIN_ALL) {
-+        g_assert_cmpint(bs->quiesce_counter, ==, 2);
-+    } else {
-+        g_assert_cmpint(bs->quiesce_counter, ==, 1);
-+    }
-     g_assert_cmpint(backing->quiesce_counter, ==, !!recursive);
- 
-     do_drain_end(drain_type, bs);
-@@ -348,8 +352,8 @@ static void test_nested(void)
- 
-     for (outer = 0; outer < DRAIN_TYPE_MAX; outer++) {
-         for (inner = 0; inner < DRAIN_TYPE_MAX; inner++) {
-            int backing_quiesce = (outer != BDRV_DRAIN) +
-                                  (inner != BDRV_DRAIN);
-+            int backing_quiesce = (outer == BDRV_DRAIN_ALL) +
-+                                  (inner == BDRV_DRAIN_ALL);
- 
-             g_assert_cmpint(bs->quiesce_counter, ==, 0);
-             g_assert_cmpint(backing->quiesce_counter, ==, 0);
-@@ -359,10 +363,10 @@ static void test_nested(void)
-             do_drain_begin(outer, bs);
-             do_drain_begin(inner, bs);
- 
-            g_assert_cmpint(bs->quiesce_counter, ==, 2);
-+            g_assert_cmpint(bs->quiesce_counter, ==, 2 + !!backing_quiesce);
-             g_assert_cmpint(backing->quiesce_counter, ==, backing_quiesce);
-            g_assert_cmpint(s->drain_count, ==, 2);
-            g_assert_cmpint(backing_s->drain_count, ==, backing_quiesce);
-+            g_assert_cmpint(s->drain_count, ==, 1);
-+            g_assert_cmpint(backing_s->drain_count, ==, !!backing_quiesce);
- 
-             do_drain_end(inner, bs);
-             do_drain_end(outer, bs);
-- 
-2.31.1
-
--- a/SOURCES/kvm-block-Collapse-padded-I-O-vecs-exceeding-IOV_MAX.patch
+++ b/SOURCES/kvm-block-Collapse-padded-I-O-vecs-exceeding-IOV_MAX.patch
@ -0,0 +1,359 @@
+From 1f7520baa6f0bf02ccba2ebfe7d1d5bf6520f95a Mon Sep 17 00:00:00 2001
+From: Hanna Czenczek <hreitz@redhat.com>
+Date: Tue, 11 Apr 2023 19:34:16 +0200
+Subject: [PATCH 2/5] block: Collapse padded I/O vecs exceeding IOV_MAX
+
+RH-Author: Hanna Czenczek <hreitz@redhat.com>
+RH-MergeRequest: 291: block: Split padded I/O vectors exceeding IOV_MAX
+RH-Bugzilla: 2141964
+RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+RH-Commit: [2/5] 1d86ce8398e4ab66e308a686f9855c963e52b0a9
+
+When processing vectored guest requests that are not aligned to the
+storage request alignment, we pad them by adding head and/or tail
+buffers for a read-modify-write cycle.
+
+The guest can submit I/O vectors up to IOV_MAX (1024) in length, but
+with this padding, the vector can exceed that limit.  As of
+4c002cef0e9abe7135d7916c51abce47f7fc1ee2 ("util/iov: make
+qemu_iovec_init_extended() honest"), we refuse to pad vectors beyond the
+limit, instead returning an error to the guest.
+
+To the guest, this appears as a random I/O error.  We should not return
+an I/O error to the guest when it issued a perfectly valid request.
+
+Before 4c002cef0e9abe7135d7916c51abce47f7fc1ee2, we just made the vector
+longer than IOV_MAX, which generally seems to work (because the guest
+assumes a smaller alignment than we really have, file-posix's
+raw_co_prw() will generally see bdrv_qiov_is_aligned() return false, and
+so emulate the request, so that the IOV_MAX does not matter).  However,
+that does not seem exactly great.
+
+I see two ways to fix this problem:
+1. We split such long requests into two requests.
+2. We join some elements of the vector into new buffers to make it
+   shorter.
+
+I am wary of (1), because it seems like it may have unintended side
+effects.
+
+(2) on the other hand seems relatively simple to implement, with
+hopefully few side effects, so this patch does that.
+
+To do this, the use of qemu_iovec_init_extended() in bdrv_pad_request()
+is effectively replaced by the new function bdrv_create_padded_qiov(),
+which not only wraps the request IOV with padding head/tail, but also
+ensures that the resulting vector will not have more than IOV_MAX
+elements.  Putting that functionality into qemu_iovec_init_extended() is
+infeasible because it requires allocating a bounce buffer; doing so
+would require many more parameters (buffer alignment, how to initialize
+the buffer, and out parameters like the buffer, its length, and the
+original elements), which is not reasonable.
+
+Conversely, it is not difficult to move qemu_iovec_init_extended()'s
+functionality into bdrv_create_padded_qiov() by using public
+qemu_iovec_* functions, so that is what this patch does.
+
+Because bdrv_pad_request() was the only "serious" user of
+qemu_iovec_init_extended(), the next patch will remove the latter
+function, so the functionality is not implemented twice.
+
+Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2141964
+Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
+Message-Id: <20230411173418.19549-3-hreitz@redhat.com>
+Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
+(cherry picked from commit 18743311b829cafc1737a5f20bc3248d5f91ee2a)
+
+Conflicts:
+	block/io.c: Downstream bdrv_pad_request() has no @flags
+        parameter.
+
+Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
+---
+ block/io.c | 166 ++++++++++++++++++++++++++++++++++++++++++++++++-----
+ 1 file changed, 151 insertions(+), 15 deletions(-)
+
+diff --git a/block/io.c b/block/io.c
+index c3e7301613..0fe8f0dd40 100644
+--- a/block/io.c
+++ b/block/io.c
+@@ -1624,6 +1624,14 @@ out:
+  * @merge_reads is true for small requests,
+  * if @buf_len == @head + bytes + @tail. In this case it is possible that both
+  * head and tail exist but @buf_len == align and @tail_buf == @buf.
+ *
+ * @write is true for write requests, false for read requests.
+ *
+ * If padding makes the vector too long (exceeding IOV_MAX), then we need to
+ * merge existing vector elements into a single one.  @collapse_bounce_buf acts
+ * as the bounce buffer in such cases.  @pre_collapse_qiov has the pre-collapse
+ * I/O vector elements so for read requests, the data can be copied back after
+ * the read is done.
+  */
+ typedef struct BdrvRequestPadding {
+     uint8_t *buf;
+@@ -1632,11 +1640,17 @@ typedef struct BdrvRequestPadding {
+     size_t head;
+     size_t tail;
+     bool merge_reads;
+    bool write;
+     QEMUIOVector local_qiov;
+
+    uint8_t *collapse_bounce_buf;
+    size_t collapse_len;
+    QEMUIOVector pre_collapse_qiov;
+ } BdrvRequestPadding;
+ 
+ static bool bdrv_init_padding(BlockDriverState *bs,
+                               int64_t offset, int64_t bytes,
+                              bool write,
+                               BdrvRequestPadding *pad)
+ {
+     int64_t align = bs->bl.request_alignment;
+@@ -1668,6 +1682,8 @@ static bool bdrv_init_padding(BlockDriverState *bs,
+         pad->tail_buf = pad->buf + pad->buf_len - align;
+     }
+ 
+    pad->write = write;
+
+     return true;
+ }
+ 
+@@ -1733,8 +1749,23 @@ zero_mem:
+     return 0;
+ }
+ 
+-static void bdrv_padding_destroy(BdrvRequestPadding *pad)
+/**
+ * Free *pad's associated buffers, and perform any necessary finalization steps.
+ */
+static void bdrv_padding_finalize(BdrvRequestPadding *pad)
+ {
+    if (pad->collapse_bounce_buf) {
+        if (!pad->write) {
+            /*
+             * If padding required elements in the vector to be collapsed into a
+             * bounce buffer, copy the bounce buffer content back
+             */
+            qemu_iovec_from_buf(&pad->pre_collapse_qiov, 0,
+                                pad->collapse_bounce_buf, pad->collapse_len);
+        }
+        qemu_vfree(pad->collapse_bounce_buf);
+        qemu_iovec_destroy(&pad->pre_collapse_qiov);
+    }
+     if (pad->buf) {
+         qemu_vfree(pad->buf);
+         qemu_iovec_destroy(&pad->local_qiov);
+@@ -1742,6 +1773,101 @@ static void bdrv_padding_destroy(BdrvRequestPadding *pad)
+     memset(pad, 0, sizeof(*pad));
+ }
+ 
+/*
+ * Create pad->local_qiov by wrapping @iov in the padding head and tail, while
+ * ensuring that the resulting vector will not exceed IOV_MAX elements.
+ *
+ * To ensure this, when necessary, the first two or three elements of @iov are
+ * merged into pad->collapse_bounce_buf and replaced by a reference to that
+ * bounce buffer in pad->local_qiov.
+ *
+ * After performing a read request, the data from the bounce buffer must be
+ * copied back into pad->pre_collapse_qiov (e.g. by bdrv_padding_finalize()).
+ */
+static int bdrv_create_padded_qiov(BlockDriverState *bs,
+                                   BdrvRequestPadding *pad,
+                                   struct iovec *iov, int niov,
+                                   size_t iov_offset, size_t bytes)
+{
+    int padded_niov, surplus_count, collapse_count;
+
+    /* Assert this invariant */
+    assert(niov <= IOV_MAX);
+
+    /*
+     * Cannot pad if resulting length would exceed SIZE_MAX.  Returning an error
+     * to the guest is not ideal, but there is little else we can do.  At least
+     * this will practically never happen on 64-bit systems.
+     */
+    if (SIZE_MAX - pad->head < bytes ||
+        SIZE_MAX - pad->head - bytes < pad->tail)
+    {
+        return -EINVAL;
+    }
+
+    /* Length of the resulting IOV if we just concatenated everything */
+    padded_niov = !!pad->head + niov + !!pad->tail;
+
+    qemu_iovec_init(&pad->local_qiov, MIN(padded_niov, IOV_MAX));
+
+    if (pad->head) {
+        qemu_iovec_add(&pad->local_qiov, pad->buf, pad->head);
+    }
+
+    /*
+     * If padded_niov > IOV_MAX, we cannot just concatenate everything.
+     * Instead, merge the first two or three elements of @iov to reduce the
+     * number of vector elements as necessary.
+     */
+    if (padded_niov > IOV_MAX) {
+        /*
+         * Only head and tail can have lead to the number of entries exceeding
+         * IOV_MAX, so we can exceed it by the head and tail at most.  We need
+         * to reduce the number of elements by `surplus_count`, so we merge that
+         * many elements plus one into one element.
+         */
+        surplus_count = padded_niov - IOV_MAX;
+        assert(surplus_count <= !!pad->head + !!pad->tail);
+        collapse_count = surplus_count + 1;
+
+        /*
+         * Move the elements to collapse into `pad->pre_collapse_qiov`, then
+         * advance `iov` (and associated variables) by those elements.
+         */
+        qemu_iovec_init(&pad->pre_collapse_qiov, collapse_count);
+        qemu_iovec_concat_iov(&pad->pre_collapse_qiov, iov,
+                              collapse_count, iov_offset, SIZE_MAX);
+        iov += collapse_count;
+        iov_offset = 0;
+        niov -= collapse_count;
+        bytes -= pad->pre_collapse_qiov.size;
+
+        /*
+         * Construct the bounce buffer to match the length of the to-collapse
+         * vector elements, and for write requests, initialize it with the data
+         * from those elements.  Then add it to `pad->local_qiov`.
+         */
+        pad->collapse_len = pad->pre_collapse_qiov.size;
+        pad->collapse_bounce_buf = qemu_blockalign(bs, pad->collapse_len);
+        if (pad->write) {
+            qemu_iovec_to_buf(&pad->pre_collapse_qiov, 0,
+                              pad->collapse_bounce_buf, pad->collapse_len);
+        }
+        qemu_iovec_add(&pad->local_qiov,
+                       pad->collapse_bounce_buf, pad->collapse_len);
+    }
+
+    qemu_iovec_concat_iov(&pad->local_qiov, iov, niov, iov_offset, bytes);
+
+    if (pad->tail) {
+        qemu_iovec_add(&pad->local_qiov,
+                       pad->buf + pad->buf_len - pad->tail, pad->tail);
+    }
+
+    assert(pad->local_qiov.niov == MIN(padded_niov, IOV_MAX));
+    return 0;
+}
+
+ /*
+  * bdrv_pad_request
+  *
+@@ -1749,6 +1875,8 @@ static void bdrv_padding_destroy(BdrvRequestPadding *pad)
+  * read of padding, bdrv_padding_rmw_read() should be called separately if
+  * needed.
+  *
+ * @write is true for write requests, false for read requests.
+ *
+  * Request parameters (@qiov, &qiov_offset, &offset, &bytes) are in-out:
+  *  - on function start they represent original request
+  *  - on failure or when padding is not needed they are unchanged
+@@ -1757,25 +1885,33 @@ static void bdrv_padding_destroy(BdrvRequestPadding *pad)
+ static int bdrv_pad_request(BlockDriverState *bs,
+                             QEMUIOVector **qiov, size_t *qiov_offset,
+                             int64_t *offset, int64_t *bytes,
+                            bool write,
+                             BdrvRequestPadding *pad, bool *padded)
+ {
+     int ret;
+    struct iovec *sliced_iov;
+    int sliced_niov;
+    size_t sliced_head, sliced_tail;
+ 
+     bdrv_check_qiov_request(*offset, *bytes, *qiov, *qiov_offset, &error_abort);
+ 
+-    if (!bdrv_init_padding(bs, *offset, *bytes, pad)) {
+    if (!bdrv_init_padding(bs, *offset, *bytes, write, pad)) {
+         if (padded) {
+             *padded = false;
+         }
+         return 0;
+     }
+ 
+-    ret = qemu_iovec_init_extended(&pad->local_qiov, pad->buf, pad->head,
+-                                   *qiov, *qiov_offset, *bytes,
+-                                   pad->buf + pad->buf_len - pad->tail,
+-                                   pad->tail);
+    sliced_iov = qemu_iovec_slice(*qiov, *qiov_offset, *bytes,
+                                  &sliced_head, &sliced_tail,
+                                  &sliced_niov);
+
+    /* Guaranteed by bdrv_check_qiov_request() */
+    assert(*bytes <= SIZE_MAX);
+    ret = bdrv_create_padded_qiov(bs, pad, sliced_iov, sliced_niov,
+                                  sliced_head, *bytes);
+     if (ret < 0) {
+-        bdrv_padding_destroy(pad);
+        bdrv_padding_finalize(pad);
+         return ret;
+     }
+     *bytes += pad->head + pad->tail;
+@@ -1836,8 +1972,8 @@ int coroutine_fn bdrv_co_preadv_part(BdrvChild *child,
+         flags |= BDRV_REQ_COPY_ON_READ;
+     }
+ 
+-    ret = bdrv_pad_request(bs, &qiov, &qiov_offset, &offset, &bytes, &pad,
+-                           NULL);
+    ret = bdrv_pad_request(bs, &qiov, &qiov_offset, &offset, &bytes, false,
+                           &pad, NULL);
+     if (ret < 0) {
+         goto fail;
+     }
+@@ -1847,7 +1983,7 @@ int coroutine_fn bdrv_co_preadv_part(BdrvChild *child,
+                               bs->bl.request_alignment,
+                               qiov, qiov_offset, flags);
+     tracked_request_end(&req);
+-    bdrv_padding_destroy(&pad);
+    bdrv_padding_finalize(&pad);
+ 
+ fail:
+     bdrv_dec_in_flight(bs);
+@@ -2167,7 +2303,7 @@ static int coroutine_fn bdrv_co_do_zero_pwritev(BdrvChild *child,
+     bool padding;
+     BdrvRequestPadding pad;
+ 
+-    padding = bdrv_init_padding(bs, offset, bytes, &pad);
+    padding = bdrv_init_padding(bs, offset, bytes, true, &pad);
+     if (padding) {
+         bdrv_make_request_serialising(req, align);
+ 
+@@ -2214,7 +2350,7 @@ static int coroutine_fn bdrv_co_do_zero_pwritev(BdrvChild *child,
+     }
+ 
+ out:
+-    bdrv_padding_destroy(&pad);
+    bdrv_padding_finalize(&pad);
+ 
+     return ret;
+ }
+@@ -2280,8 +2416,8 @@ int coroutine_fn bdrv_co_pwritev_part(BdrvChild *child,
+          * bdrv_co_do_zero_pwritev() does aligning by itself, so, we do
+          * alignment only if there is no ZERO flag.
+          */
+-        ret = bdrv_pad_request(bs, &qiov, &qiov_offset, &offset, &bytes, &pad,
+-                               &padded);
+        ret = bdrv_pad_request(bs, &qiov, &qiov_offset, &offset, &bytes, true,
+                               &pad, &padded);
+         if (ret < 0) {
+             return ret;
+         }
+@@ -2310,7 +2446,7 @@ int coroutine_fn bdrv_co_pwritev_part(BdrvChild *child,
+     ret = bdrv_aligned_pwritev(child, &req, offset, bytes, align,
+                                qiov, qiov_offset, flags);
+ 
+-    bdrv_padding_destroy(&pad);
+    bdrv_padding_finalize(&pad);
+ 
+ out:
+     tracked_request_end(&req);
+-- 
+2.39.3
+
--- a/SOURCES/kvm-block-Don-t-poll-in-bdrv_replace_child_noperm.patch
+++ b/SOURCES/kvm-block-Don-t-poll-in-bdrv_replace_child_noperm.patch
@ -1,298 +0,0 @@
-From 150ef3356cc6732fede7ca059168fc0565ed0b76 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Fri, 18 Nov 2022 18:41:09 +0100
-Subject: [PATCH 27/31] block: Don't poll in bdrv_replace_child_noperm()
-
-RH-Author: Stefano Garzarella <sgarzare@redhat.com>
-RH-MergeRequest: 135: block: Simplify drain to prevent QEMU from crashing during snapshot
-RH-Bugzilla: 2155112
-RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Commit: [15/16] 5fc7d6b703a2d6c1118d875056f0afbd6ba5cca9 (sgarzarella/qemu-kvm-c-9-s)
-
-In order to make sure that bdrv_replace_child_noperm() doesn't have to
-poll any more, get rid of the bdrv_parent_drained_begin_single() call.
-
-This is possible now because we can require that the parent is already
-drained through the child in question when the function is called and we
-don't call the parent drain callbacks more than once.
-
-The additional drain calls needed in callers cause the test case to run
-its code in the drain handler too early (bdrv_attach_child() drains
-now), so modify it to only enable the code after the test setup has
-completed.
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Message-Id: <20221118174110.55183-15-kwolf@redhat.com>
-Reviewed-by: Hanna Reitz <hreitz@redhat.com>
-Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 23987471285a26397e3152a9244b652445fd36c4)
-Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
---
- block.c                      | 103 ++++++++++++++++++++++++++++++-----
- block/io.c                   |   2 +-
- include/block/block-io.h     |   8 +++
- tests/unit/test-bdrv-drain.c |  10 ++++
- 4 files changed, 108 insertions(+), 15 deletions(-)
-
-diff --git a/block.c b/block.c
-index af31a94863..65588d313a 100644
--- a/block.c
-+++ b/block.c
-@@ -2407,6 +2407,20 @@ static void bdrv_replace_child_abort(void *opaque)
- 
-     GLOBAL_STATE_CODE();
-     /* old_bs reference is transparently moved from @s to @s->child */
-+    if (!s->child->bs) {
-+        /*
-+         * The parents were undrained when removing old_bs from the child. New
-+         * requests can't have been made, though, because the child was empty.
-+         *
-+         * TODO Make bdrv_replace_child_noperm() transactionable to avoid
-+         * undraining the parent in the first place. Once this is done, having
-+         * new_bs drained when calling bdrv_replace_child_tran() is not a
-+         * requirement any more.
-+         */
-+        bdrv_parent_drained_begin_single(s->child, false);
-+        assert(!bdrv_parent_drained_poll_single(s->child));
-+    }
-+    assert(s->child->quiesced_parent);
-     bdrv_replace_child_noperm(s->child, s->old_bs);
-     bdrv_unref(new_bs);
- }
-@@ -2422,12 +2436,19 @@ static TransactionActionDrv bdrv_replace_child_drv = {
-  *
-  * Note: real unref of old_bs is done only on commit.
-  *
-+ * Both @child->bs and @new_bs (if non-NULL) must be drained. @new_bs must be
-+ * kept drained until the transaction is completed.
-+ *
-  * The function doesn't update permissions, caller is responsible for this.
-  */
- static void bdrv_replace_child_tran(BdrvChild *child, BlockDriverState *new_bs,
-                                     Transaction *tran)
- {
-     BdrvReplaceChildState *s = g_new(BdrvReplaceChildState, 1);
-+
-+    assert(child->quiesced_parent);
-+    assert(!new_bs || new_bs->quiesce_counter);
-+
-     *s = (BdrvReplaceChildState) {
-         .child = child,
-         .old_bs = child->bs,
-@@ -2819,6 +2840,14 @@ uint64_t bdrv_qapi_perm_to_blk_perm(BlockPermission qapi_perm)
-     return permissions[qapi_perm];
- }
- 
-+/*
-+ * Replaces the node that a BdrvChild points to without updating permissions.
-+ *
-+ * If @new_bs is non-NULL, the parent of @child must already be drained through
-+ * @child.
-+ *
-+ * This function does not poll.
-+ */
- static void bdrv_replace_child_noperm(BdrvChild *child,
-                                       BlockDriverState *new_bs)
- {
-@@ -2826,6 +2855,28 @@ static void bdrv_replace_child_noperm(BdrvChild *child,
-     int new_bs_quiesce_counter;
- 
-     assert(!child->frozen);
-+
-+    /*
-+     * If we want to change the BdrvChild to point to a drained node as its new
-+     * child->bs, we need to make sure that its new parent is drained, too. In
-+     * other words, either child->quiesce_parent must already be true or we must
-+     * be able to set it and keep the parent's quiesce_counter consistent with
-+     * that, but without polling or starting new requests (this function
-+     * guarantees that it doesn't poll, and starting new requests would be
-+     * against the invariants of drain sections).
-+     *
-+     * To keep things simple, we pick the first option (child->quiesce_parent
-+     * must already be true). We also generalise the rule a bit to make it
-+     * easier to verify in callers and more likely to be covered in test cases:
-+     * The parent must be quiesced through this child even if new_bs isn't
-+     * currently drained.
-+     *
-+     * The only exception is for callers that always pass new_bs == NULL. In
-+     * this case, we obviously never need to consider the case of a drained
-+     * new_bs, so we can keep the callers simpler by allowing them not to drain
-+     * the parent.
-+     */
-+    assert(!new_bs || child->quiesced_parent);
-     assert(old_bs != new_bs);
-     GLOBAL_STATE_CODE();
- 
-@@ -2833,15 +2884,6 @@ static void bdrv_replace_child_noperm(BdrvChild *child,
-         assert(bdrv_get_aio_context(old_bs) == bdrv_get_aio_context(new_bs));
-     }
- 
-    /*
-     * If the new child node is drained but the old one was not, flush
-     * all outstanding requests to the old child node.
-     */
-    new_bs_quiesce_counter = (new_bs ? new_bs->quiesce_counter : 0);
-    if (new_bs_quiesce_counter && !child->quiesced_parent) {
-        bdrv_parent_drained_begin_single(child, true);
-    }
-
-     if (old_bs) {
-         if (child->klass->detach) {
-             child->klass->detach(child);
-@@ -2861,11 +2903,9 @@ static void bdrv_replace_child_noperm(BdrvChild *child,
-     }
- 
-     /*
-     * If the old child node was drained but the new one is not, allow
-     * requests to come in only after the new node has been attached.
-     *
-     * Update new_bs_quiesce_counter because bdrv_parent_drained_begin_single()
-     * polls, which could have changed the value.
-+     * If the parent was drained through this BdrvChild previously, but new_bs
-+     * is not drained, allow requests to come in only after the new node has
-+     * been attached.
-      */
-     new_bs_quiesce_counter = (new_bs ? new_bs->quiesce_counter : 0);
-     if (!new_bs_quiesce_counter && child->quiesced_parent) {
-@@ -3002,6 +3042,24 @@ static BdrvChild *bdrv_attach_child_common(BlockDriverState *child_bs,
-     }
- 
-     bdrv_ref(child_bs);
-+    /*
-+     * Let every new BdrvChild start with a drained parent. Inserting the child
-+     * in the graph with bdrv_replace_child_noperm() will undrain it if
-+     * @child_bs is not drained.
-+     *
-+     * The child was only just created and is not yet visible in global state
-+     * until bdrv_replace_child_noperm() inserts it into the graph, so nobody
-+     * could have sent requests and polling is not necessary.
-+     *
-+     * Note that this means that the parent isn't fully drained yet, we only
-+     * stop new requests from coming in. This is fine, we don't care about the
-+     * old requests here, they are not for this child. If another place enters a
-+     * drain section for the same parent, but wants it to be fully quiesced, it
-+     * will not run most of the the code in .drained_begin() again (which is not
-+     * a problem, we already did this), but it will still poll until the parent
-+     * is fully quiesced, so it will not be negatively affected either.
-+     */
-+    bdrv_parent_drained_begin_single(new_child, false);
-     bdrv_replace_child_noperm(new_child, child_bs);
- 
-     BdrvAttachChildCommonState *s = g_new(BdrvAttachChildCommonState, 1);
-@@ -5059,12 +5117,24 @@ static void bdrv_remove_child(BdrvChild *child, Transaction *tran)
-     }
- 
-     if (child->bs) {
-+        BlockDriverState *bs = child->bs;
-+        bdrv_drained_begin(bs);
-         bdrv_replace_child_tran(child, NULL, tran);
-+        bdrv_drained_end(bs);
-     }
- 
-     tran_add(tran, &bdrv_remove_child_drv, child);
- }
- 
-+static void undrain_on_clean_cb(void *opaque)
-+{
-+    bdrv_drained_end(opaque);
-+}
-+
-+static TransactionActionDrv undrain_on_clean = {
-+    .clean = undrain_on_clean_cb,
-+};
-+
- static int bdrv_replace_node_noperm(BlockDriverState *from,
-                                     BlockDriverState *to,
-                                     bool auto_skip, Transaction *tran,
-@@ -5074,6 +5144,11 @@ static int bdrv_replace_node_noperm(BlockDriverState *from,
- 
-     GLOBAL_STATE_CODE();
- 
-+    bdrv_drained_begin(from);
-+    bdrv_drained_begin(to);
-+    tran_add(tran, &undrain_on_clean, from);
-+    tran_add(tran, &undrain_on_clean, to);
-+
-     QLIST_FOREACH_SAFE(c, &from->parents, next_parent, next) {
-         assert(c->bs == from);
-         if (!should_update_child(c, to)) {
-diff --git a/block/io.c b/block/io.c
-index 5e9150d92c..ae64830eac 100644
--- a/block/io.c
-+++ b/block/io.c
-@@ -81,7 +81,7 @@ static void bdrv_parent_drained_end(BlockDriverState *bs, BdrvChild *ignore)
-     }
- }
- 
-static bool bdrv_parent_drained_poll_single(BdrvChild *c)
-+bool bdrv_parent_drained_poll_single(BdrvChild *c)
- {
-     if (c->klass->drained_poll) {
-         return c->klass->drained_poll(c);
-diff --git a/include/block/block-io.h b/include/block/block-io.h
-index 8f5e75756a..65e6d2569b 100644
--- a/include/block/block-io.h
-+++ b/include/block/block-io.h
-@@ -292,6 +292,14 @@ bdrv_writev_vmstate(BlockDriverState *bs, QEMUIOVector *qiov, int64_t pos);
-  */
- void bdrv_parent_drained_begin_single(BdrvChild *c, bool poll);
- 
-+/**
-+ * bdrv_parent_drained_poll_single:
-+ *
-+ * Returns true if there is any pending activity to cease before @c can be
-+ * called quiesced, false otherwise.
-+ */
-+bool bdrv_parent_drained_poll_single(BdrvChild *c);
-+
- /**
-  * bdrv_parent_drained_end_single:
-  *
-diff --git a/tests/unit/test-bdrv-drain.c b/tests/unit/test-bdrv-drain.c
-index 172bc6debc..2686a8acee 100644
--- a/tests/unit/test-bdrv-drain.c
-+++ b/tests/unit/test-bdrv-drain.c
-@@ -1654,6 +1654,7 @@ static void test_drop_intermediate_poll(void)
- 
- 
- typedef struct BDRVReplaceTestState {
-+    bool setup_completed;
-     bool was_drained;
-     bool was_undrained;
-     bool has_read;
-@@ -1738,6 +1739,10 @@ static void bdrv_replace_test_drain_begin(BlockDriverState *bs)
- {
-     BDRVReplaceTestState *s = bs->opaque;
- 
-+    if (!s->setup_completed) {
-+        return;
-+    }
-+
-     if (!s->drain_count) {
-         s->drain_co = qemu_coroutine_create(bdrv_replace_test_drain_co, bs);
-         bdrv_inc_in_flight(bs);
-@@ -1769,6 +1774,10 @@ static void bdrv_replace_test_drain_end(BlockDriverState *bs)
- {
-     BDRVReplaceTestState *s = bs->opaque;
- 
-+    if (!s->setup_completed) {
-+        return;
-+    }
-+
-     g_assert(s->drain_count > 0);
-     if (!--s->drain_count) {
-         s->was_undrained = true;
-@@ -1867,6 +1876,7 @@ static void do_test_replace_child_mid_drain(int old_drain_count,
-     bdrv_ref(old_child_bs);
-     bdrv_attach_child(parent_bs, old_child_bs, "child", &child_of_bds,
-                       BDRV_CHILD_COW, &error_abort);
-+    parent_s->setup_completed = true;
- 
-     for (i = 0; i < old_drain_count; i++) {
-         bdrv_drained_begin(old_child_bs);
-- 
-2.31.1
-
--- a/SOURCES/kvm-block-Don-t-use-subtree-drains-in-bdrv_drop_intermed.patch
+++ b/SOURCES/kvm-block-Don-t-use-subtree-drains-in-bdrv_drop_intermed.patch
@ -1,54 +0,0 @@
-From 6af6de77dace29aa8548b3649dc9c6163740ac86 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Fri, 18 Nov 2022 18:41:03 +0100
-Subject: [PATCH 21/31] block: Don't use subtree drains in
- bdrv_drop_intermediate()
-
-RH-Author: Stefano Garzarella <sgarzare@redhat.com>
-RH-MergeRequest: 135: block: Simplify drain to prevent QEMU from crashing during snapshot
-RH-Bugzilla: 2155112
-RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Commit: [9/16] 3c06fa826f262558f57d38b0155500c2e8e23a53 (sgarzarella/qemu-kvm-c-9-s)
-
-Instead of using a subtree drain from the top node (which also drains
-child nodes of base that we're not even interested in), use a normal
-drain for base, which automatically drains all of the parents, too.
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
-Reviewed-by: Hanna Reitz <hreitz@redhat.com>
-Message-Id: <20221118174110.55183-9-kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 631086deefc32690ee56efed1c5b891dec31ae37)
-Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
---
- block.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/block.c b/block.c
-index cb5e96b1cf..b3449a312e 100644
--- a/block.c
-+++ b/block.c
-@@ -5586,7 +5586,7 @@ int bdrv_drop_intermediate(BlockDriverState *top, BlockDriverState *base,
-     GLOBAL_STATE_CODE();
- 
-     bdrv_ref(top);
-    bdrv_subtree_drained_begin(top);
-+    bdrv_drained_begin(base);
- 
-     if (!top->drv || !base->drv) {
-         goto exit;
-@@ -5659,7 +5659,7 @@ int bdrv_drop_intermediate(BlockDriverState *top, BlockDriverState *base,
- 
-     ret = 0;
- exit:
-    bdrv_subtree_drained_end(top);
-+    bdrv_drained_end(base);
-     bdrv_unref(top);
-     return ret;
- }
-- 
-2.31.1
-
--- a/SOURCES/kvm-block-Drain-individual-nodes-during-reopen.patch
+++ b/SOURCES/kvm-block-Drain-individual-nodes-during-reopen.patch
@ -1,157 +0,0 @@
-From ad52cb621daad45d3c2a0e2e670d6ca2e16690bd Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Fri, 18 Nov 2022 18:41:02 +0100
-Subject: [PATCH 20/31] block: Drain individual nodes during reopen
-
-RH-Author: Stefano Garzarella <sgarzare@redhat.com>
-RH-MergeRequest: 135: block: Simplify drain to prevent QEMU from crashing during snapshot
-RH-Bugzilla: 2155112
-RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Commit: [8/16] 5441b6f0ae9102ef40d1093e1db3084eea81e3b0 (sgarzarella/qemu-kvm-c-9-s)
-
-bdrv_reopen() and friends use subtree drains as a lazy way of covering
-all the nodes they touch. Turns out that this lazy way is a lot more
-complicated than just draining the nodes individually, even not
-accounting for the additional complexity in the drain mechanism itself.
-
-Simplify the code by switching to draining the individual nodes that are
-already managed in the BlockReopenQueue anyway.
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Message-Id: <20221118174110.55183-8-kwolf@redhat.com>
-Reviewed-by: Hanna Reitz <hreitz@redhat.com>
-Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit d22933acd2f470eeef779e4d444e848f76dcfaf8)
-Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
---
- block.c             | 16 +++++++++-------
- block/replication.c |  6 ------
- blockdev.c          | 13 -------------
- 3 files changed, 9 insertions(+), 26 deletions(-)
-
-diff --git a/block.c b/block.c
-index 46df410b07..cb5e96b1cf 100644
--- a/block.c
-+++ b/block.c
-@@ -4150,7 +4150,7 @@ static bool bdrv_recurse_has_child(BlockDriverState *bs,
-  * returns a pointer to bs_queue, which is either the newly allocated
-  * bs_queue, or the existing bs_queue being used.
-  *
- * bs must be drained between bdrv_reopen_queue() and bdrv_reopen_multiple().
-+ * bs is drained here and undrained by bdrv_reopen_queue_free().
-  *
-  * To be called with bs->aio_context locked.
-  */
-@@ -4172,12 +4172,10 @@ static BlockReopenQueue *bdrv_reopen_queue_child(BlockReopenQueue *bs_queue,
-     int flags;
-     QemuOpts *opts;
- 
-    /* Make sure that the caller remembered to use a drained section. This is
-     * important to avoid graph changes between the recursive queuing here and
-     * bdrv_reopen_multiple(). */
-    assert(bs->quiesce_counter > 0);
-     GLOBAL_STATE_CODE();
- 
-+    bdrv_drained_begin(bs);
-+
-     if (bs_queue == NULL) {
-         bs_queue = g_new0(BlockReopenQueue, 1);
-         QTAILQ_INIT(bs_queue);
-@@ -4328,6 +4326,12 @@ void bdrv_reopen_queue_free(BlockReopenQueue *bs_queue)
-     if (bs_queue) {
-         BlockReopenQueueEntry *bs_entry, *next;
-         QTAILQ_FOREACH_SAFE(bs_entry, bs_queue, entry, next) {
-+            AioContext *ctx = bdrv_get_aio_context(bs_entry->state.bs);
-+
-+            aio_context_acquire(ctx);
-+            bdrv_drained_end(bs_entry->state.bs);
-+            aio_context_release(ctx);
-+
-             qobject_unref(bs_entry->state.explicit_options);
-             qobject_unref(bs_entry->state.options);
-             g_free(bs_entry);
-@@ -4475,7 +4479,6 @@ int bdrv_reopen(BlockDriverState *bs, QDict *opts, bool keep_old_opts,
- 
-     GLOBAL_STATE_CODE();
- 
-    bdrv_subtree_drained_begin(bs);
-     queue = bdrv_reopen_queue(NULL, bs, opts, keep_old_opts);
- 
-     if (ctx != qemu_get_aio_context()) {
-@@ -4486,7 +4489,6 @@ int bdrv_reopen(BlockDriverState *bs, QDict *opts, bool keep_old_opts,
-     if (ctx != qemu_get_aio_context()) {
-         aio_context_acquire(ctx);
-     }
-    bdrv_subtree_drained_end(bs);
- 
-     return ret;
- }
-diff --git a/block/replication.c b/block/replication.c
-index f1eed25e43..c62f48a874 100644
--- a/block/replication.c
-+++ b/block/replication.c
-@@ -374,9 +374,6 @@ static void reopen_backing_file(BlockDriverState *bs, bool writable,
-         s->orig_secondary_read_only = bdrv_is_read_only(secondary_disk->bs);
-     }
- 
-    bdrv_subtree_drained_begin(hidden_disk->bs);
-    bdrv_subtree_drained_begin(secondary_disk->bs);
-
-     if (s->orig_hidden_read_only) {
-         QDict *opts = qdict_new();
-         qdict_put_bool(opts, BDRV_OPT_READ_ONLY, !writable);
-@@ -401,9 +398,6 @@ static void reopen_backing_file(BlockDriverState *bs, bool writable,
-             aio_context_acquire(ctx);
-         }
-     }
-
-    bdrv_subtree_drained_end(hidden_disk->bs);
-    bdrv_subtree_drained_end(secondary_disk->bs);
- }
- 
- static void backup_job_cleanup(BlockDriverState *bs)
-diff --git a/blockdev.c b/blockdev.c
-index 3f1dec6242..8ffb3d9537 100644
--- a/blockdev.c
-+++ b/blockdev.c
-@@ -3547,8 +3547,6 @@ fail:
- void qmp_blockdev_reopen(BlockdevOptionsList *reopen_list, Error **errp)
- {
-     BlockReopenQueue *queue = NULL;
-    GSList *drained = NULL;
-    GSList *p;
- 
-     /* Add each one of the BDS that we want to reopen to the queue */
-     for (; reopen_list != NULL; reopen_list = reopen_list->next) {
-@@ -3585,9 +3583,7 @@ void qmp_blockdev_reopen(BlockdevOptionsList *reopen_list, Error **errp)
-         ctx = bdrv_get_aio_context(bs);
-         aio_context_acquire(ctx);
- 
-        bdrv_subtree_drained_begin(bs);
-         queue = bdrv_reopen_queue(queue, bs, qdict, false);
-        drained = g_slist_prepend(drained, bs);
- 
-         aio_context_release(ctx);
-     }
-@@ -3598,15 +3594,6 @@ void qmp_blockdev_reopen(BlockdevOptionsList *reopen_list, Error **errp)
- 
- fail:
-     bdrv_reopen_queue_free(queue);
-    for (p = drained; p; p = p->next) {
-        BlockDriverState *bs = p->data;
-        AioContext *ctx = bdrv_get_aio_context(bs);
-
-        aio_context_acquire(ctx);
-        bdrv_subtree_drained_end(bs);
-        aio_context_release(ctx);
-    }
-    g_slist_free(drained);
- }
- 
- void qmp_blockdev_del(const char *node_name, Error **errp)
-- 
-2.31.1
-
--- a/SOURCES/kvm-block-Drop-out-of-coroutine-in-bdrv_do_drained_begin.patch
+++ b/SOURCES/kvm-block-Drop-out-of-coroutine-in-bdrv_do_drained_begin.patch
@ -1,96 +0,0 @@
-From 9a789d104a4a69031ad95d7fad6380ab21e82503 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Fri, 18 Nov 2022 18:41:08 +0100
-Subject: [PATCH 26/31] block: Drop out of coroutine in
- bdrv_do_drained_begin_quiesce()
-
-RH-Author: Stefano Garzarella <sgarzare@redhat.com>
-RH-MergeRequest: 135: block: Simplify drain to prevent QEMU from crashing during snapshot
-RH-Bugzilla: 2155112
-RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Commit: [14/16] c9266663b822f703e55b6a07de98ceb56e69e924 (sgarzarella/qemu-kvm-c-9-s)
-
-The next patch adds a parent drain to bdrv_attach_child_common(), which
-shouldn't be, but is currently called from coroutines in some cases (e.g.
-.bdrv_co_create implementations generally open new nodes). Therefore,
-the assertion that we're not in a coroutine doesn't hold true any more.
-
-We could just remove the assertion because there is nothing in the
-function that should be in conflict with running in a coroutine, but
-just to be on the safe side, we can reverse the caller relationship
-between bdrv_do_drained_begin() and bdrv_do_drained_begin_quiesce() so
-that the latter also just drops out of coroutine context and we can
-still be certain in the future that any drain code doesn't run in
-coroutines.
-
-As a nice side effect, the structure of bdrv_do_drained_begin() is now
-symmetrical with bdrv_do_drained_end().
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Message-Id: <20221118174110.55183-14-kwolf@redhat.com>
-Reviewed-by: Hanna Reitz <hreitz@redhat.com>
-Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 05c272ff0cf1b16cc3606f746182dd99b774f553)
-Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
---
- block/io.c | 25 ++++++++++++-------------
- 1 file changed, 12 insertions(+), 13 deletions(-)
-
-diff --git a/block/io.c b/block/io.c
-index 2e9503df6a..5e9150d92c 100644
--- a/block/io.c
-+++ b/block/io.c
-@@ -346,10 +346,15 @@ static void coroutine_fn bdrv_co_yield_to_drain(BlockDriverState *bs,
-     }
- }
- 
-void bdrv_do_drained_begin_quiesce(BlockDriverState *bs, BdrvChild *parent)
-+static void bdrv_do_drained_begin(BlockDriverState *bs, BdrvChild *parent,
-+                                  bool poll)
- {
-     IO_OR_GS_CODE();
-    assert(!qemu_in_coroutine());
-+
-+    if (qemu_in_coroutine()) {
-+        bdrv_co_yield_to_drain(bs, true, parent, poll);
-+        return;
-+    }
- 
-     /* Stop things in parent-to-child order */
-     if (qatomic_fetch_inc(&bs->quiesce_counter) == 0) {
-@@ -359,17 +364,6 @@ void bdrv_do_drained_begin_quiesce(BlockDriverState *bs, BdrvChild *parent)
-             bs->drv->bdrv_drain_begin(bs);
-         }
-     }
-}
-
-static void bdrv_do_drained_begin(BlockDriverState *bs, BdrvChild *parent,
-                                  bool poll)
-{
-    if (qemu_in_coroutine()) {
-        bdrv_co_yield_to_drain(bs, true, parent, poll);
-        return;
-    }
-
-    bdrv_do_drained_begin_quiesce(bs, parent);
- 
-     /*
-      * Wait for drained requests to finish.
-@@ -385,6 +379,11 @@ static void bdrv_do_drained_begin(BlockDriverState *bs, BdrvChild *parent,
-     }
- }
- 
-+void bdrv_do_drained_begin_quiesce(BlockDriverState *bs, BdrvChild *parent)
-+{
-+    bdrv_do_drained_begin(bs, parent, false);
-+}
-+
- void bdrv_drained_begin(BlockDriverState *bs)
- {
-     IO_OR_GS_CODE();
-- 
-2.31.1
-
--- a/SOURCES/kvm-block-Fix-locking-for-bdrv_reopen_queue_child.patch
+++ b/SOURCES/kvm-block-Fix-locking-for-bdrv_reopen_queue_child.patch
@ -1,67 +0,0 @@
-From e790b4c20a5124239fe93e91fbc87745e5f2cea6 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Fri, 18 Nov 2022 18:41:01 +0100
-Subject: [PATCH 19/31] block: Fix locking for bdrv_reopen_queue_child()
-
-RH-Author: Stefano Garzarella <sgarzare@redhat.com>
-RH-MergeRequest: 135: block: Simplify drain to prevent QEMU from crashing during snapshot
-RH-Bugzilla: 2155112
-RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Commit: [7/16] 46bb54506c4400b9a1bf66b6bd7987ff67260003 (sgarzarella/qemu-kvm-c-9-s)
-
-Callers don't agree whether bdrv_reopen_queue_child() should be called
-with the AioContext lock held or not. Standardise on holding the lock
-(as done by QMP blockdev-reopen and the replication block driver) and
-fix bdrv_reopen() to do the same.
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Message-Id: <20221118174110.55183-7-kwolf@redhat.com>
-Reviewed-by: Hanna Reitz <hreitz@redhat.com>
-Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 2e117866d7c96cc17e84cd2946fee1bf3292d814)
-Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
---
- block.c | 7 +++++--
- 1 file changed, 5 insertions(+), 2 deletions(-)
-
-diff --git a/block.c b/block.c
-index 7999fd08c5..46df410b07 100644
--- a/block.c
-+++ b/block.c
-@@ -4151,6 +4151,8 @@ static bool bdrv_recurse_has_child(BlockDriverState *bs,
-  * bs_queue, or the existing bs_queue being used.
-  *
-  * bs must be drained between bdrv_reopen_queue() and bdrv_reopen_multiple().
-+ *
-+ * To be called with bs->aio_context locked.
-  */
- static BlockReopenQueue *bdrv_reopen_queue_child(BlockReopenQueue *bs_queue,
-                                                  BlockDriverState *bs,
-@@ -4309,6 +4311,7 @@ static BlockReopenQueue *bdrv_reopen_queue_child(BlockReopenQueue *bs_queue,
-     return bs_queue;
- }
- 
-+/* To be called with bs->aio_context locked */
- BlockReopenQueue *bdrv_reopen_queue(BlockReopenQueue *bs_queue,
-                                     BlockDriverState *bs,
-                                     QDict *options, bool keep_old_opts)
-@@ -4473,11 +4476,11 @@ int bdrv_reopen(BlockDriverState *bs, QDict *opts, bool keep_old_opts,
-     GLOBAL_STATE_CODE();
- 
-     bdrv_subtree_drained_begin(bs);
-+    queue = bdrv_reopen_queue(NULL, bs, opts, keep_old_opts);
-+
-     if (ctx != qemu_get_aio_context()) {
-         aio_context_release(ctx);
-     }
-
-    queue = bdrv_reopen_queue(NULL, bs, opts, keep_old_opts);
-     ret = bdrv_reopen_multiple(queue, errp);
- 
-     if (ctx != qemu_get_aio_context()) {
-- 
-2.31.1
-
--- a/SOURCES/kvm-block-Fix-pad_request-s-request-restriction.patch
+++ b/SOURCES/kvm-block-Fix-pad_request-s-request-restriction.patch
@ -0,0 +1,75 @@
+From b9866279996ee065cb524bf30bc70e22efbab303 Mon Sep 17 00:00:00 2001
+From: Hanna Czenczek <hreitz@redhat.com>
+Date: Fri, 14 Jul 2023 10:59:38 +0200
+Subject: [PATCH 5/5] block: Fix pad_request's request restriction
+
+RH-Author: Hanna Czenczek <hreitz@redhat.com>
+RH-MergeRequest: 291: block: Split padded I/O vectors exceeding IOV_MAX
+RH-Bugzilla: 2141964
+RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+RH-Commit: [5/5] f9188bd089d6c67185ea1accde20d491a2ed3193
+
+bdrv_pad_request() relies on requests' lengths not to exceed SIZE_MAX,
+which bdrv_check_qiov_request() does not guarantee.
+
+bdrv_check_request32() however will guarantee this, and both of
+bdrv_pad_request()'s callers (bdrv_co_preadv_part() and
+bdrv_co_pwritev_part()) already run it before calling
+bdrv_pad_request().  Therefore, bdrv_pad_request() can safely call
+bdrv_check_request32() without expecting error, too.
+
+In effect, this patch will not change guest-visible behavior.  It is a
+clean-up to tighten a condition to match what is guaranteed by our
+callers, and which exists purely to show clearly why the subsequent
+assertion (`assert(*bytes <= SIZE_MAX)`) is always true.
+
+Note there is a difference between the interfaces of
+bdrv_check_qiov_request() and bdrv_check_request32(): The former takes
+an errp, the latter does not, so we can no longer just pass
+&error_abort.  Instead, we need to check the returned value.  While we
+do expect success (because the callers have already run this function),
+an assert(ret == 0) is not much simpler than just to return an error if
+it occurs, so let us handle errors by returning them up the stack now.
+
+Reported-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
+Message-id: 20230714085938.202730-1-hreitz@redhat.com
+Fixes: 18743311b829cafc1737a5f20bc3248d5f91ee2a
+       ("block: Collapse padded I/O vecs exceeding IOV_MAX")
+Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
+---
+ block/io.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/block/io.c b/block/io.c
+index 0fe8f0dd40..8ae57728a6 100644
+--- a/block/io.c
+++ b/block/io.c
+@@ -1893,7 +1893,11 @@ static int bdrv_pad_request(BlockDriverState *bs,
+     int sliced_niov;
+     size_t sliced_head, sliced_tail;
+ 
+-    bdrv_check_qiov_request(*offset, *bytes, *qiov, *qiov_offset, &error_abort);
+    /* Should have been checked by the caller already */
+    ret = bdrv_check_request32(*offset, *bytes, *qiov, *qiov_offset);
+    if (ret < 0) {
+        return ret;
+    }
+ 
+     if (!bdrv_init_padding(bs, *offset, *bytes, write, pad)) {
+         if (padded) {
+@@ -1906,7 +1910,7 @@ static int bdrv_pad_request(BlockDriverState *bs,
+                                   &sliced_head, &sliced_tail,
+                                   &sliced_niov);
+ 
+-    /* Guaranteed by bdrv_check_qiov_request() */
+    /* Guaranteed by bdrv_check_request32() */
+     assert(*bytes <= SIZE_MAX);
+     ret = bdrv_create_padded_qiov(bs, pad, sliced_iov, sliced_niov,
+                                   sliced_head, *bytes);
+-- 
+2.39.3
+
--- a/SOURCES/kvm-block-Improve-empty-format-specific-info-dump.patch
+++ b/SOURCES/kvm-block-Improve-empty-format-specific-info-dump.patch
@ -1,132 +0,0 @@
-From 074c89b05dae971c7118cb769fd34e22135c8f4c Mon Sep 17 00:00:00 2001
-From: Hanna Reitz <hreitz@redhat.com>
-Date: Mon, 20 Jun 2022 18:26:53 +0200
-Subject: [PATCH 06/20] block: Improve empty format-specific info dump
-
-RH-Author: Hanna Czenczek <hreitz@redhat.com>
-RH-MergeRequest: 145: Show protocol-level information in qemu-img info
-RH-Bugzilla: 1860292
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
-RH-Commit: [1/12] be551e83f426e620e673302198b51368bfd324ce (hreitz/qemu-kvm-c-9-s)
-
-When a block driver supports obtaining format-specific information, but
-that object only contains optional fields, it is possible that none of
-them are present, so that dump_qobject() (called by
-bdrv_image_info_specific_dump()) will not print anything.
-
-The callers of bdrv_image_info_specific_dump() put a header above this
-information ("Format specific information:\n"), which will look strange
-when there is nothing below.  Modify bdrv_image_info_specific_dump() to
-print this header instead of its callers, and only if there is indeed
-something to be printed.
-
-Signed-off-by: Hanna Reitz <hreitz@redhat.com>
-Message-Id: <20220620162704.80987-2-hreitz@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 3716470b24f0f63090d59bcf28ad8fe6fb7835bd)
-Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
---
- block/qapi.c         | 41 +++++++++++++++++++++++++++++++++++++----
- include/block/qapi.h |  3 ++-
- qemu-io-cmds.c       |  4 ++--
- 3 files changed, 41 insertions(+), 7 deletions(-)
-
-diff --git a/block/qapi.c b/block/qapi.c
-index cf557e3aea..51202b470a 100644
--- a/block/qapi.c
-+++ b/block/qapi.c
-@@ -777,7 +777,35 @@ static void dump_qdict(int indentation, QDict *dict)
-     }
- }
- 
-void bdrv_image_info_specific_dump(ImageInfoSpecific *info_spec)
-+/*
-+ * Return whether dumping the given QObject with dump_qobject() would
-+ * yield an empty dump, i.e. not print anything.
-+ */
-+static bool qobject_is_empty_dump(const QObject *obj)
-+{
-+    switch (qobject_type(obj)) {
-+    case QTYPE_QNUM:
-+    case QTYPE_QSTRING:
-+    case QTYPE_QBOOL:
-+        return false;
-+
-+    case QTYPE_QDICT:
-+        return qdict_size(qobject_to(QDict, obj)) == 0;
-+
-+    case QTYPE_QLIST:
-+        return qlist_empty(qobject_to(QList, obj));
-+
-+    default:
-+        abort();
-+    }
-+}
-+
-+/**
-+ * Dumps the given ImageInfoSpecific object in a human-readable form,
-+ * prepending an optional prefix if the dump is not empty.
-+ */
-+void bdrv_image_info_specific_dump(ImageInfoSpecific *info_spec,
-+                                   const char *prefix)
- {
-     QObject *obj, *data;
-     Visitor *v = qobject_output_visitor_new(&obj);
-@@ -785,7 +813,12 @@ void bdrv_image_info_specific_dump(ImageInfoSpecific *info_spec)
-     visit_type_ImageInfoSpecific(v, NULL, &info_spec, &error_abort);
-     visit_complete(v, &obj);
-     data = qdict_get(qobject_to(QDict, obj), "data");
-    dump_qobject(1, data);
-+    if (!qobject_is_empty_dump(data)) {
-+        if (prefix) {
-+            qemu_printf("%s", prefix);
-+        }
-+        dump_qobject(1, data);
-+    }
-     qobject_unref(obj);
-     visit_free(v);
- }
-@@ -866,7 +899,7 @@ void bdrv_image_info_dump(ImageInfo *info)
-     }
- 
-     if (info->has_format_specific) {
-        qemu_printf("Format specific information:\n");
-        bdrv_image_info_specific_dump(info->format_specific);
-+        bdrv_image_info_specific_dump(info->format_specific,
-+                                      "Format specific information:\n");
-     }
- }
-diff --git a/include/block/qapi.h b/include/block/qapi.h
-index 22c7807c89..c09859ea78 100644
--- a/include/block/qapi.h
-+++ b/include/block/qapi.h
-@@ -40,6 +40,7 @@ void bdrv_query_image_info(BlockDriverState *bs,
-                            Error **errp);
- 
- void bdrv_snapshot_dump(QEMUSnapshotInfo *sn);
-void bdrv_image_info_specific_dump(ImageInfoSpecific *info_spec);
-+void bdrv_image_info_specific_dump(ImageInfoSpecific *info_spec,
-+                                   const char *prefix);
- void bdrv_image_info_dump(ImageInfo *info);
- #endif
-diff --git a/qemu-io-cmds.c b/qemu-io-cmds.c
-index 952dc940f1..f4a374528e 100644
--- a/qemu-io-cmds.c
-+++ b/qemu-io-cmds.c
-@@ -1825,8 +1825,8 @@ static int info_f(BlockBackend *blk, int argc, char **argv)
-         return -EIO;
-     }
-     if (spec_info) {
-        printf("Format specific information:\n");
-        bdrv_image_info_specific_dump(spec_info);
-+        bdrv_image_info_specific_dump(spec_info,
-+                                      "Format specific information:\n");
-         qapi_free_ImageInfoSpecific(spec_info);
-     }
- 
-- 
-2.31.1
-
--- a/SOURCES/kvm-block-Inline-bdrv_drain_invoke.patch
+++ b/SOURCES/kvm-block-Inline-bdrv_drain_invoke.patch
@ -1,81 +0,0 @@
-From 1808e560396872173f787f8e338e9837a4c3d626 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Fri, 18 Nov 2022 18:41:00 +0100
-Subject: [PATCH 18/31] block: Inline bdrv_drain_invoke()
-
-RH-Author: Stefano Garzarella <sgarzare@redhat.com>
-RH-MergeRequest: 135: block: Simplify drain to prevent QEMU from crashing during snapshot
-RH-Bugzilla: 2155112
-RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Commit: [6/16] 2c7473a36360eb43d94b967deb12308cb5ea0d3b (sgarzarella/qemu-kvm-c-9-s)
-
-bdrv_drain_invoke() has now two entirely separate cases that share no
-code any more and are selected depending on a bool parameter. Each case
-has only one caller. Just inline the function.
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
-Reviewed-by: Hanna Reitz <hreitz@redhat.com>
-Message-Id: <20221118174110.55183-6-kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit c7bc05f78ab31fb02fc9635f60b9bd22efc8d121)
-Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
---
- block/io.c | 23 ++++++-----------------
- 1 file changed, 6 insertions(+), 17 deletions(-)
-
-diff --git a/block/io.c b/block/io.c
-index f4ca62b034..a25103be6f 100644
--- a/block/io.c
-+++ b/block/io.c
-@@ -242,21 +242,6 @@ typedef struct {
-     bool ignore_bds_parents;
- } BdrvCoDrainData;
- 
-/* Recursively call BlockDriver.bdrv_drain_begin/end callbacks */
-static void bdrv_drain_invoke(BlockDriverState *bs, bool begin)
-{
-    if (!bs->drv || (begin && !bs->drv->bdrv_drain_begin) ||
-            (!begin && !bs->drv->bdrv_drain_end)) {
-        return;
-    }
-
-    if (begin) {
-        bs->drv->bdrv_drain_begin(bs);
-    } else {
-        bs->drv->bdrv_drain_end(bs);
-    }
-}
-
- /* Returns true if BDRV_POLL_WHILE() should go into a blocking aio_poll() */
- bool bdrv_drain_poll(BlockDriverState *bs, bool recursive,
-                      BdrvChild *ignore_parent, bool ignore_bds_parents)
-@@ -390,7 +375,9 @@ void bdrv_do_drained_begin_quiesce(BlockDriverState *bs,
-     }
- 
-     bdrv_parent_drained_begin(bs, parent, ignore_bds_parents);
-    bdrv_drain_invoke(bs, true);
-+    if (bs->drv && bs->drv->bdrv_drain_begin) {
-+        bs->drv->bdrv_drain_begin(bs);
-+    }
- }
- 
- static void bdrv_do_drained_begin(BlockDriverState *bs, bool recursive,
-@@ -461,7 +448,9 @@ static void bdrv_do_drained_end(BlockDriverState *bs, bool recursive,
-     assert(bs->quiesce_counter > 0);
- 
-     /* Re-enable things in child-to-parent order */
-    bdrv_drain_invoke(bs, false);
-+    if (bs->drv && bs->drv->bdrv_drain_end) {
-+        bs->drv->bdrv_drain_end(bs);
-+    }
-     bdrv_parent_drained_end(bs, parent, ignore_bds_parents);
- 
-     old_quiesce_counter = qatomic_fetch_dec(&bs->quiesce_counter);
-- 
-2.31.1
-
--- a/SOURCES/kvm-block-Lock-AioContext-for-drain_end-in-blockdev-reop.patch
+++ b/SOURCES/kvm-block-Lock-AioContext-for-drain_end-in-blockdev-reop.patch
@ -0,0 +1,63 @@
+From b21fa5ecd9acf2b91839a2915fb4bb39dac4c803 Mon Sep 17 00:00:00 2001
+From: Kevin Wolf <kwolf@redhat.com>
+Date: Thu, 3 Feb 2022 15:05:33 +0100
+Subject: [PATCH 2/5] block: Lock AioContext for drain_end in blockdev-reopen
+
+RH-Author: Kevin Wolf <kwolf@redhat.com>
+RH-MergeRequest: 142: block: Lock AioContext for drain_end in blockdev-reopen
+RH-Commit: [1/2] 98de3b5987f88ea6b4b503f623d6c4475574e037
+RH-Bugzilla: 2067118
+RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+RH-Acked-by: Hanna Reitz <hreitz@redhat.com>
+
+bdrv_subtree_drained_end() requires the caller to hold the AioContext
+lock for the drained node. Not doing this for nodes outside of the main
+AioContext leads to crashes when AIO_WAIT_WHILE() needs to wait and
+tries to temporarily release the lock.
+
+Fixes: 3908b7a8994fa5ef7a89aa58cd5a02fc58141592
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2046659
+Reported-by: Qing Wang <qinwang@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+Message-Id: <20220203140534.36522-2-kwolf@redhat.com>
+Reviewed-by: Hanna Reitz <hreitz@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit aba8205be0707b9d108e32254e186ba88107a869)
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ blockdev.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/blockdev.c b/blockdev.c
+index b35072644e..565f6a81fd 100644
+--- a/blockdev.c
+++ b/blockdev.c
+@@ -3562,6 +3562,7 @@ void qmp_blockdev_reopen(BlockdevOptionsList *reopen_list, Error **errp)
+ {
+     BlockReopenQueue *queue = NULL;
+     GSList *drained = NULL;
+    GSList *p;
+ 
+     /* Add each one of the BDS that we want to reopen to the queue */
+     for (; reopen_list != NULL; reopen_list = reopen_list->next) {
+@@ -3611,7 +3612,15 @@ void qmp_blockdev_reopen(BlockdevOptionsList *reopen_list, Error **errp)
+ 
+ fail:
+     bdrv_reopen_queue_free(queue);
+-    g_slist_free_full(drained, (GDestroyNotify) bdrv_subtree_drained_end);
+    for (p = drained; p; p = p->next) {
+        BlockDriverState *bs = p->data;
+        AioContext *ctx = bdrv_get_aio_context(bs);
+
+        aio_context_acquire(ctx);
+        bdrv_subtree_drained_end(bs);
+        aio_context_release(ctx);
+    }
+    g_slist_free(drained);
+ }
+ 
+ void qmp_blockdev_del(const char *node_name, Error **errp)
+-- 
+2.27.0
+
--- a/SOURCES/kvm-block-Make-bdrv_refresh_limits-non-recursive.patch
+++ b/SOURCES/kvm-block-Make-bdrv_refresh_limits-non-recursive.patch
@ -0,0 +1,78 @@
+From 6348063b91b2370cc27153fd58fd11a6681631f6 Mon Sep 17 00:00:00 2001
+From: Hanna Reitz <hreitz@redhat.com>
+Date: Wed, 16 Feb 2022 11:53:53 +0100
+Subject: [PATCH 22/24] block: Make bdrv_refresh_limits() non-recursive
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Hanna Reitz <hreitz@redhat.com>
+RH-MergeRequest: 189: block: Make bdrv_refresh_limits() non-recursive
+RH-Commit: [1/3] 1a1fe37f8d8f0344dd8639d6cc9d884d1aff9096
+RH-Bugzilla: 2072932
+RH-Acked-by: Eric Blake <eblake@redhat.com>
+RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
+
+bdrv_refresh_limits() recurses down to the node's children.  That does
+not seem necessary: When we refresh limits on some node, and then
+recurse down and were to change one of its children's BlockLimits, then
+that would mean we noticed the changed limits by pure chance.  The fact
+that we refresh the parent's limits has nothing to do with it, so the
+reason for the change probably happened before this point in time, and
+we should have refreshed the limits then.
+
+Consequently, we should actually propagate block limits changes upwards,
+not downwards.  That is a separate and pre-existing issue, though, and
+so will not be addressed in this patch.
+
+The problem with recursing is that bdrv_refresh_limits() is not atomic.
+It begins with zeroing BDS.bl, and only then sets proper, valid limits.
+If we do not drain all nodes whose limits are refreshed, then concurrent
+I/O requests can encounter invalid request_alignment values and crash
+qemu.  Therefore, a recursing bdrv_refresh_limits() requires the whole
+subtree to be drained, which is currently not ensured by most callers.
+
+A non-recursive bdrv_refresh_limits() only requires the node in question
+to not receive I/O requests, and this is done by most callers in some
+way or another:
+- bdrv_open_driver() deals with a new node with no parents yet
+- bdrv_set_file_or_backing_noperm() acts on a drained node
+- bdrv_reopen_commit() acts only on drained nodes
+- bdrv_append() should in theory require the node to be drained; in
+  practice most callers just lock the AioContext, which should at least
+  be enough to prevent concurrent I/O requests from accessing invalid
+  limits
+
+So we can resolve the bug by making bdrv_refresh_limits() non-recursive.
+
+Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1879437
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+Reviewed-by: Eric Blake <eblake@redhat.com>
+Message-Id: <20220216105355.30729-2-hreitz@redhat.com>
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit 4d378bbd831bdd2f6e6adcd4ea5b77b6effaa627)
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+---
+ block/io.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/block/io.c b/block/io.c
+index 4e4cb556c5..c3e7301613 100644
+--- a/block/io.c
+++ b/block/io.c
+@@ -189,10 +189,6 @@ void bdrv_refresh_limits(BlockDriverState *bs, Transaction *tran, Error **errp)
+     QLIST_FOREACH(c, &bs->children, next) {
+         if (c->role & (BDRV_CHILD_DATA | BDRV_CHILD_FILTERED | BDRV_CHILD_COW))
+         {
+-            bdrv_refresh_limits(c->bs, tran, errp);
+-            if (*errp) {
+-                return;
+-            }
+             bdrv_merge_limits(&bs->bl, &c->bs->bl);
+             have_limits = true;
+         }
+-- 
+2.35.3
+
--- a/SOURCES/kvm-block-Remove-drained_end_counter.patch
+++ b/SOURCES/kvm-block-Remove-drained_end_counter.patch
@ -1,433 +0,0 @@
-From 3009e49f242ab371ffad35bb29c2c26ddfac75d4 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Fri, 18 Nov 2022 18:40:59 +0100
-Subject: [PATCH 17/31] block: Remove drained_end_counter
-
-RH-Author: Stefano Garzarella <sgarzare@redhat.com>
-RH-MergeRequest: 135: block: Simplify drain to prevent QEMU from crashing during snapshot
-RH-Bugzilla: 2155112
-RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Commit: [5/16] 5589e3f05dece5394a05641f7f42096e8dc62bdb (sgarzarella/qemu-kvm-c-9-s)
-
-drained_end_counter is unused now, nobody changes its value any more. It
-can be removed.
-
-In cases where we had two almost identical functions that only differed
-in whether the caller passes drained_end_counter, or whether they would
-poll for a local drained_end_counter to reach 0, these become a single
-function.
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
-Reviewed-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
-Message-Id: <20221118174110.55183-5-kwolf@redhat.com>
-Reviewed-by: Hanna Reitz <hreitz@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 2f65df6e16dea2d6e7212fa675f4779d9281e26f)
-Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
---
- block.c                          |  5 +-
- block/block-backend.c            |  4 +-
- block/io.c                       | 98 ++++++++------------------------
- blockjob.c                       |  2 +-
- include/block/block-io.h         | 24 --------
- include/block/block_int-common.h |  6 +-
- 6 files changed, 30 insertions(+), 109 deletions(-)
-
-diff --git a/block.c b/block.c
-index 16a62a329c..7999fd08c5 100644
--- a/block.c
-+++ b/block.c
-@@ -1235,11 +1235,10 @@ static bool bdrv_child_cb_drained_poll(BdrvChild *child)
-     return bdrv_drain_poll(bs, false, NULL, false);
- }
- 
-static void bdrv_child_cb_drained_end(BdrvChild *child,
-                                      int *drained_end_counter)
-+static void bdrv_child_cb_drained_end(BdrvChild *child)
- {
-     BlockDriverState *bs = child->opaque;
-    bdrv_drained_end_no_poll(bs, drained_end_counter);
-+    bdrv_drained_end(bs);
- }
- 
- static int bdrv_child_cb_inactivate(BdrvChild *child)
-diff --git a/block/block-backend.c b/block/block-backend.c
-index d98a96ff37..feaf2181fa 100644
--- a/block/block-backend.c
-+++ b/block/block-backend.c
-@@ -129,7 +129,7 @@ static void blk_root_inherit_options(BdrvChildRole role, bool parent_is_format,
- }
- static void blk_root_drained_begin(BdrvChild *child);
- static bool blk_root_drained_poll(BdrvChild *child);
-static void blk_root_drained_end(BdrvChild *child, int *drained_end_counter);
-+static void blk_root_drained_end(BdrvChild *child);
- 
- static void blk_root_change_media(BdrvChild *child, bool load);
- static void blk_root_resize(BdrvChild *child);
-@@ -2556,7 +2556,7 @@ static bool blk_root_drained_poll(BdrvChild *child)
-     return busy || !!blk->in_flight;
- }
- 
-static void blk_root_drained_end(BdrvChild *child, int *drained_end_counter)
-+static void blk_root_drained_end(BdrvChild *child)
- {
-     BlockBackend *blk = child->opaque;
-     assert(blk->quiesce_counter);
-diff --git a/block/io.c b/block/io.c
-index c2ed4b2af9..f4ca62b034 100644
--- a/block/io.c
-+++ b/block/io.c
-@@ -58,28 +58,19 @@ static void bdrv_parent_drained_begin(BlockDriverState *bs, BdrvChild *ignore,
-     }
- }
- 
-static void bdrv_parent_drained_end_single_no_poll(BdrvChild *c,
-                                                   int *drained_end_counter)
-+void bdrv_parent_drained_end_single(BdrvChild *c)
- {
-+    IO_OR_GS_CODE();
-+
-     assert(c->parent_quiesce_counter > 0);
-     c->parent_quiesce_counter--;
-     if (c->klass->drained_end) {
-        c->klass->drained_end(c, drained_end_counter);
-+        c->klass->drained_end(c);
-     }
- }
- 
-void bdrv_parent_drained_end_single(BdrvChild *c)
-{
-    int drained_end_counter = 0;
-    AioContext *ctx = bdrv_child_get_parent_aio_context(c);
-    IO_OR_GS_CODE();
-    bdrv_parent_drained_end_single_no_poll(c, &drained_end_counter);
-    AIO_WAIT_WHILE(ctx, qatomic_read(&drained_end_counter) > 0);
-}
-
- static void bdrv_parent_drained_end(BlockDriverState *bs, BdrvChild *ignore,
-                                    bool ignore_bds_parents,
-                                    int *drained_end_counter)
-+                                    bool ignore_bds_parents)
- {
-     BdrvChild *c;
- 
-@@ -87,7 +78,7 @@ static void bdrv_parent_drained_end(BlockDriverState *bs, BdrvChild *ignore,
-         if (c == ignore || (ignore_bds_parents && c->klass->parent_is_bds)) {
-             continue;
-         }
-        bdrv_parent_drained_end_single_no_poll(c, drained_end_counter);
-+        bdrv_parent_drained_end_single(c);
-     }
- }
- 
-@@ -249,12 +240,10 @@ typedef struct {
-     bool poll;
-     BdrvChild *parent;
-     bool ignore_bds_parents;
-    int *drained_end_counter;
- } BdrvCoDrainData;
- 
- /* Recursively call BlockDriver.bdrv_drain_begin/end callbacks */
-static void bdrv_drain_invoke(BlockDriverState *bs, bool begin,
-                              int *drained_end_counter)
-+static void bdrv_drain_invoke(BlockDriverState *bs, bool begin)
- {
-     if (!bs->drv || (begin && !bs->drv->bdrv_drain_begin) ||
-             (!begin && !bs->drv->bdrv_drain_end)) {
-@@ -305,8 +294,7 @@ static void bdrv_do_drained_begin(BlockDriverState *bs, bool recursive,
-                                   BdrvChild *parent, bool ignore_bds_parents,
-                                   bool poll);
- static void bdrv_do_drained_end(BlockDriverState *bs, bool recursive,
-                                BdrvChild *parent, bool ignore_bds_parents,
-                                int *drained_end_counter);
-+                                BdrvChild *parent, bool ignore_bds_parents);
- 
- static void bdrv_co_drain_bh_cb(void *opaque)
- {
-@@ -319,14 +307,12 @@ static void bdrv_co_drain_bh_cb(void *opaque)
-         aio_context_acquire(ctx);
-         bdrv_dec_in_flight(bs);
-         if (data->begin) {
-            assert(!data->drained_end_counter);
-             bdrv_do_drained_begin(bs, data->recursive, data->parent,
-                                   data->ignore_bds_parents, data->poll);
-         } else {
-             assert(!data->poll);
-             bdrv_do_drained_end(bs, data->recursive, data->parent,
-                                data->ignore_bds_parents,
-                                data->drained_end_counter);
-+                                data->ignore_bds_parents);
-         }
-         aio_context_release(ctx);
-     } else {
-@@ -342,8 +328,7 @@ static void coroutine_fn bdrv_co_yield_to_drain(BlockDriverState *bs,
-                                                 bool begin, bool recursive,
-                                                 BdrvChild *parent,
-                                                 bool ignore_bds_parents,
-                                                bool poll,
-                                                int *drained_end_counter)
-+                                                bool poll)
- {
-     BdrvCoDrainData data;
-     Coroutine *self = qemu_coroutine_self();
-@@ -363,7 +348,6 @@ static void coroutine_fn bdrv_co_yield_to_drain(BlockDriverState *bs,
-         .parent = parent,
-         .ignore_bds_parents = ignore_bds_parents,
-         .poll = poll,
-        .drained_end_counter = drained_end_counter,
-     };
- 
-     if (bs) {
-@@ -406,7 +390,7 @@ void bdrv_do_drained_begin_quiesce(BlockDriverState *bs,
-     }
- 
-     bdrv_parent_drained_begin(bs, parent, ignore_bds_parents);
-    bdrv_drain_invoke(bs, true, NULL);
-+    bdrv_drain_invoke(bs, true);
- }
- 
- static void bdrv_do_drained_begin(BlockDriverState *bs, bool recursive,
-@@ -417,7 +401,7 @@ static void bdrv_do_drained_begin(BlockDriverState *bs, bool recursive,
- 
-     if (qemu_in_coroutine()) {
-         bdrv_co_yield_to_drain(bs, true, recursive, parent, ignore_bds_parents,
-                               poll, NULL);
-+                               poll);
-         return;
-     }
- 
-@@ -461,38 +445,24 @@ void bdrv_subtree_drained_begin(BlockDriverState *bs)
- 
- /**
-  * This function does not poll, nor must any of its recursively called
- * functions.  The *drained_end_counter pointee will be incremented
- * once for every background operation scheduled, and decremented once
- * the operation settles.  Therefore, the pointer must remain valid
- * until the pointee reaches 0.  That implies that whoever sets up the
- * pointee has to poll until it is 0.
- *
- * We use atomic operations to access *drained_end_counter, because
- * (1) when called from bdrv_set_aio_context_ignore(), the subgraph of
- *     @bs may contain nodes in different AioContexts,
- * (2) bdrv_drain_all_end() uses the same counter for all nodes,
- *     regardless of which AioContext they are in.
-+ * functions.
-  */
- static void bdrv_do_drained_end(BlockDriverState *bs, bool recursive,
-                                BdrvChild *parent, bool ignore_bds_parents,
-                                int *drained_end_counter)
-+                                BdrvChild *parent, bool ignore_bds_parents)
- {
-     BdrvChild *child;
-     int old_quiesce_counter;
- 
-    assert(drained_end_counter != NULL);
-
-     if (qemu_in_coroutine()) {
-         bdrv_co_yield_to_drain(bs, false, recursive, parent, ignore_bds_parents,
-                               false, drained_end_counter);
-+                               false);
-         return;
-     }
-     assert(bs->quiesce_counter > 0);
- 
-     /* Re-enable things in child-to-parent order */
-    bdrv_drain_invoke(bs, false, drained_end_counter);
-    bdrv_parent_drained_end(bs, parent, ignore_bds_parents,
-                            drained_end_counter);
-+    bdrv_drain_invoke(bs, false);
-+    bdrv_parent_drained_end(bs, parent, ignore_bds_parents);
- 
-     old_quiesce_counter = qatomic_fetch_dec(&bs->quiesce_counter);
-     if (old_quiesce_counter == 1) {
-@@ -503,32 +473,21 @@ static void bdrv_do_drained_end(BlockDriverState *bs, bool recursive,
-         assert(!ignore_bds_parents);
-         bs->recursive_quiesce_counter--;
-         QLIST_FOREACH(child, &bs->children, next) {
-            bdrv_do_drained_end(child->bs, true, child, ignore_bds_parents,
-                                drained_end_counter);
-+            bdrv_do_drained_end(child->bs, true, child, ignore_bds_parents);
-         }
-     }
- }
- 
- void bdrv_drained_end(BlockDriverState *bs)
- {
-    int drained_end_counter = 0;
-     IO_OR_GS_CODE();
-    bdrv_do_drained_end(bs, false, NULL, false, &drained_end_counter);
-    BDRV_POLL_WHILE(bs, qatomic_read(&drained_end_counter) > 0);
-}
-
-void bdrv_drained_end_no_poll(BlockDriverState *bs, int *drained_end_counter)
-{
-    IO_CODE();
-    bdrv_do_drained_end(bs, false, NULL, false, drained_end_counter);
-+    bdrv_do_drained_end(bs, false, NULL, false);
- }
- 
- void bdrv_subtree_drained_end(BlockDriverState *bs)
- {
-    int drained_end_counter = 0;
-     IO_OR_GS_CODE();
-    bdrv_do_drained_end(bs, true, NULL, false, &drained_end_counter);
-    BDRV_POLL_WHILE(bs, qatomic_read(&drained_end_counter) > 0);
-+    bdrv_do_drained_end(bs, true, NULL, false);
- }
- 
- void bdrv_apply_subtree_drain(BdrvChild *child, BlockDriverState *new_parent)
-@@ -543,16 +502,12 @@ void bdrv_apply_subtree_drain(BdrvChild *child, BlockDriverState *new_parent)
- 
- void bdrv_unapply_subtree_drain(BdrvChild *child, BlockDriverState *old_parent)
- {
-    int drained_end_counter = 0;
-     int i;
-     IO_OR_GS_CODE();
- 
-     for (i = 0; i < old_parent->recursive_quiesce_counter; i++) {
-        bdrv_do_drained_end(child->bs, true, child, false,
-                            &drained_end_counter);
-+        bdrv_do_drained_end(child->bs, true, child, false);
-     }
-
-    BDRV_POLL_WHILE(child->bs, qatomic_read(&drained_end_counter) > 0);
- }
- 
- void bdrv_drain(BlockDriverState *bs)
-@@ -610,7 +565,7 @@ void bdrv_drain_all_begin(void)
-     GLOBAL_STATE_CODE();
- 
-     if (qemu_in_coroutine()) {
-        bdrv_co_yield_to_drain(NULL, true, false, NULL, true, true, NULL);
-+        bdrv_co_yield_to_drain(NULL, true, false, NULL, true, true);
-         return;
-     }
- 
-@@ -649,22 +604,19 @@ void bdrv_drain_all_begin(void)
- 
- void bdrv_drain_all_end_quiesce(BlockDriverState *bs)
- {
-    int drained_end_counter = 0;
-     GLOBAL_STATE_CODE();
- 
-     g_assert(bs->quiesce_counter > 0);
-     g_assert(!bs->refcnt);
- 
-     while (bs->quiesce_counter) {
-        bdrv_do_drained_end(bs, false, NULL, true, &drained_end_counter);
-+        bdrv_do_drained_end(bs, false, NULL, true);
-     }
-    BDRV_POLL_WHILE(bs, qatomic_read(&drained_end_counter) > 0);
- }
- 
- void bdrv_drain_all_end(void)
- {
-     BlockDriverState *bs = NULL;
-    int drained_end_counter = 0;
-     GLOBAL_STATE_CODE();
- 
-     /*
-@@ -680,13 +632,11 @@ void bdrv_drain_all_end(void)
-         AioContext *aio_context = bdrv_get_aio_context(bs);
- 
-         aio_context_acquire(aio_context);
-        bdrv_do_drained_end(bs, false, NULL, true, &drained_end_counter);
-+        bdrv_do_drained_end(bs, false, NULL, true);
-         aio_context_release(aio_context);
-     }
- 
-     assert(qemu_get_current_aio_context() == qemu_get_aio_context());
-    AIO_WAIT_WHILE(NULL, qatomic_read(&drained_end_counter) > 0);
-
-     assert(bdrv_drain_all_count > 0);
-     bdrv_drain_all_count--;
- }
-diff --git a/blockjob.c b/blockjob.c
-index f51d4e18f3..0ab721e139 100644
--- a/blockjob.c
-+++ b/blockjob.c
-@@ -120,7 +120,7 @@ static bool child_job_drained_poll(BdrvChild *c)
-     }
- }
- 
-static void child_job_drained_end(BdrvChild *c, int *drained_end_counter)
-+static void child_job_drained_end(BdrvChild *c)
- {
-     BlockJob *job = c->opaque;
-     job_resume(&job->job);
-diff --git a/include/block/block-io.h b/include/block/block-io.h
-index b099d7db45..054e964c9b 100644
--- a/include/block/block-io.h
-+++ b/include/block/block-io.h
-@@ -237,21 +237,6 @@ int coroutine_fn bdrv_co_copy_range(BdrvChild *src, int64_t src_offset,
-                                     int64_t bytes, BdrvRequestFlags read_flags,
-                                     BdrvRequestFlags write_flags);
- 
-/**
- * bdrv_drained_end_no_poll:
- *
- * Same as bdrv_drained_end(), but do not poll for the subgraph to
- * actually become unquiesced.  Therefore, no graph changes will occur
- * with this function.
- *
- * *drained_end_counter is incremented for every background operation
- * that is scheduled, and will be decremented for every operation once
- * it settles.  The caller must poll until it reaches 0.  The counter
- * should be accessed using atomic operations only.
- */
-void bdrv_drained_end_no_poll(BlockDriverState *bs, int *drained_end_counter);
-
-
- /*
-  * "I/O or GS" API functions. These functions can run without
-  * the BQL, but only in one specific iothread/main loop.
-@@ -311,9 +296,6 @@ void bdrv_parent_drained_begin_single(BdrvChild *c, bool poll);
-  * bdrv_parent_drained_end_single:
-  *
-  * End a quiesced section for the parent of @c.
- *
- * This polls @bs's AioContext until all scheduled sub-drained_ends
- * have settled, which may result in graph changes.
-  */
- void bdrv_parent_drained_end_single(BdrvChild *c);
- 
-@@ -361,12 +343,6 @@ void bdrv_subtree_drained_begin(BlockDriverState *bs);
-  * bdrv_drained_end:
-  *
-  * End a quiescent section started by bdrv_drained_begin().
- *
- * This polls @bs's AioContext until all scheduled sub-drained_ends
- * have settled.  On one hand, that may result in graph changes.  On
- * the other, this requires that the caller either runs in the main
- * loop; or that all involved nodes (@bs and all of its parents) are
- * in the caller's AioContext.
-  */
- void bdrv_drained_end(BlockDriverState *bs);
- 
-diff --git a/include/block/block_int-common.h b/include/block/block_int-common.h
-index 40d646d1ed..2b97576f6d 100644
--- a/include/block/block_int-common.h
-+++ b/include/block/block_int-common.h
-@@ -939,15 +939,11 @@ struct BdrvChildClass {
-      * These functions must not change the graph (and therefore also must not
-      * call aio_poll(), which could change the graph indirectly).
-      *
-     * If drained_end() schedules background operations, it must atomically
-     * increment *drained_end_counter for each such operation and atomically
-     * decrement it once the operation has settled.
-     *
-      * Note that this can be nested. If drained_begin() was called twice, new
-      * I/O is allowed only after drained_end() was called twice, too.
-      */
-     void (*drained_begin)(BdrvChild *child);
-    void (*drained_end)(BdrvChild *child, int *drained_end_counter);
-+    void (*drained_end)(BdrvChild *child);
- 
-     /*
-      * Returns whether the parent has pending requests for the child. This
-- 
-2.31.1
-
--- a/SOURCES/kvm-block-Remove-ignore_bds_parents-parameter-from-drain.patch
+++ b/SOURCES/kvm-block-Remove-ignore_bds_parents-parameter-from-drain.patch
@ -1,274 +0,0 @@
-From 0dc7990533cef41e58579ee96315aca1fdc44ea1 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Fri, 18 Nov 2022 18:41:07 +0100
-Subject: [PATCH 25/31] block: Remove ignore_bds_parents parameter from
- drain_begin/end.
-
-RH-Author: Stefano Garzarella <sgarzare@redhat.com>
-RH-MergeRequest: 135: block: Simplify drain to prevent QEMU from crashing during snapshot
-RH-Bugzilla: 2155112
-RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Commit: [13/16] 1ed88d975a9569bffeb33ad847874417780ce408 (sgarzarella/qemu-kvm-c-9-s)
-
-ignore_bds_parents is now ignored during drain_begin and drain_end, so
-we can just remove it there. It is still a valid optimisation for
-drain_all in bdrv_drained_poll(), so leave it around there.
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Message-Id: <20221118174110.55183-13-kwolf@redhat.com>
-Reviewed-by: Hanna Reitz <hreitz@redhat.com>
-Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit a82a3bd135078d14f1bb4b5e50f51e77d3748270)
-Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
---
- block.c                  |  2 +-
- block/io.c               | 58 +++++++++++++++-------------------------
- include/block/block-io.h |  3 +--
- 3 files changed, 24 insertions(+), 39 deletions(-)
-
-diff --git a/block.c b/block.c
-index 5a583e260d..af31a94863 100644
--- a/block.c
-+++ b/block.c
-@@ -1226,7 +1226,7 @@ static char *bdrv_child_get_parent_desc(BdrvChild *c)
- static void bdrv_child_cb_drained_begin(BdrvChild *child)
- {
-     BlockDriverState *bs = child->opaque;
-    bdrv_do_drained_begin_quiesce(bs, NULL, false);
-+    bdrv_do_drained_begin_quiesce(bs, NULL);
- }
- 
- static bool bdrv_child_cb_drained_poll(BdrvChild *child)
-diff --git a/block/io.c b/block/io.c
-index 87d6f22ec4..2e9503df6a 100644
--- a/block/io.c
-+++ b/block/io.c
-@@ -45,13 +45,12 @@ static void bdrv_parent_cb_resize(BlockDriverState *bs);
- static int coroutine_fn bdrv_co_do_pwrite_zeroes(BlockDriverState *bs,
-     int64_t offset, int64_t bytes, BdrvRequestFlags flags);
- 
-static void bdrv_parent_drained_begin(BlockDriverState *bs, BdrvChild *ignore,
-                                      bool ignore_bds_parents)
-+static void bdrv_parent_drained_begin(BlockDriverState *bs, BdrvChild *ignore)
- {
-     BdrvChild *c, *next;
- 
-     QLIST_FOREACH_SAFE(c, &bs->parents, next_parent, next) {
-        if (c == ignore || (ignore_bds_parents && c->klass->parent_is_bds)) {
-+        if (c == ignore) {
-             continue;
-         }
-         bdrv_parent_drained_begin_single(c, false);
-@@ -70,13 +69,12 @@ void bdrv_parent_drained_end_single(BdrvChild *c)
-     }
- }
- 
-static void bdrv_parent_drained_end(BlockDriverState *bs, BdrvChild *ignore,
-                                    bool ignore_bds_parents)
-+static void bdrv_parent_drained_end(BlockDriverState *bs, BdrvChild *ignore)
- {
-     BdrvChild *c;
- 
-     QLIST_FOREACH(c, &bs->parents, next_parent) {
-        if (c == ignore || (ignore_bds_parents && c->klass->parent_is_bds)) {
-+        if (c == ignore) {
-             continue;
-         }
-         bdrv_parent_drained_end_single(c);
-@@ -242,7 +240,6 @@ typedef struct {
-     bool begin;
-     bool poll;
-     BdrvChild *parent;
-    bool ignore_bds_parents;
- } BdrvCoDrainData;
- 
- /* Returns true if BDRV_POLL_WHILE() should go into a blocking aio_poll() */
-@@ -269,9 +266,8 @@ static bool bdrv_drain_poll_top_level(BlockDriverState *bs,
- }
- 
- static void bdrv_do_drained_begin(BlockDriverState *bs, BdrvChild *parent,
-                                  bool ignore_bds_parents, bool poll);
-static void bdrv_do_drained_end(BlockDriverState *bs, BdrvChild *parent,
-                                bool ignore_bds_parents);
-+                                  bool poll);
-+static void bdrv_do_drained_end(BlockDriverState *bs, BdrvChild *parent);
- 
- static void bdrv_co_drain_bh_cb(void *opaque)
- {
-@@ -284,11 +280,10 @@ static void bdrv_co_drain_bh_cb(void *opaque)
-         aio_context_acquire(ctx);
-         bdrv_dec_in_flight(bs);
-         if (data->begin) {
-            bdrv_do_drained_begin(bs, data->parent, data->ignore_bds_parents,
-                                  data->poll);
-+            bdrv_do_drained_begin(bs, data->parent, data->poll);
-         } else {
-             assert(!data->poll);
-            bdrv_do_drained_end(bs, data->parent, data->ignore_bds_parents);
-+            bdrv_do_drained_end(bs, data->parent);
-         }
-         aio_context_release(ctx);
-     } else {
-@@ -303,7 +298,6 @@ static void bdrv_co_drain_bh_cb(void *opaque)
- static void coroutine_fn bdrv_co_yield_to_drain(BlockDriverState *bs,
-                                                 bool begin,
-                                                 BdrvChild *parent,
-                                                bool ignore_bds_parents,
-                                                 bool poll)
- {
-     BdrvCoDrainData data;
-@@ -321,7 +315,6 @@ static void coroutine_fn bdrv_co_yield_to_drain(BlockDriverState *bs,
-         .done = false,
-         .begin = begin,
-         .parent = parent,
-        .ignore_bds_parents = ignore_bds_parents,
-         .poll = poll,
-     };
- 
-@@ -353,8 +346,7 @@ static void coroutine_fn bdrv_co_yield_to_drain(BlockDriverState *bs,
-     }
- }
- 
-void bdrv_do_drained_begin_quiesce(BlockDriverState *bs,
-                                   BdrvChild *parent, bool ignore_bds_parents)
-+void bdrv_do_drained_begin_quiesce(BlockDriverState *bs, BdrvChild *parent)
- {
-     IO_OR_GS_CODE();
-     assert(!qemu_in_coroutine());
-@@ -362,9 +354,7 @@ void bdrv_do_drained_begin_quiesce(BlockDriverState *bs,
-     /* Stop things in parent-to-child order */
-     if (qatomic_fetch_inc(&bs->quiesce_counter) == 0) {
-         aio_disable_external(bdrv_get_aio_context(bs));
-
-        /* TODO Remove ignore_bds_parents, we don't consider it any more */
-        bdrv_parent_drained_begin(bs, parent, false);
-+        bdrv_parent_drained_begin(bs, parent);
-         if (bs->drv && bs->drv->bdrv_drain_begin) {
-             bs->drv->bdrv_drain_begin(bs);
-         }
-@@ -372,14 +362,14 @@ void bdrv_do_drained_begin_quiesce(BlockDriverState *bs,
- }
- 
- static void bdrv_do_drained_begin(BlockDriverState *bs, BdrvChild *parent,
-                                  bool ignore_bds_parents, bool poll)
-+                                  bool poll)
- {
-     if (qemu_in_coroutine()) {
-        bdrv_co_yield_to_drain(bs, true, parent, ignore_bds_parents, poll);
-+        bdrv_co_yield_to_drain(bs, true, parent, poll);
-         return;
-     }
- 
-    bdrv_do_drained_begin_quiesce(bs, parent, ignore_bds_parents);
-+    bdrv_do_drained_begin_quiesce(bs, parent);
- 
-     /*
-      * Wait for drained requests to finish.
-@@ -391,7 +381,6 @@ static void bdrv_do_drained_begin(BlockDriverState *bs, BdrvChild *parent,
-      * nodes.
-      */
-     if (poll) {
-        assert(!ignore_bds_parents);
-         BDRV_POLL_WHILE(bs, bdrv_drain_poll_top_level(bs, parent));
-     }
- }
-@@ -399,20 +388,19 @@ static void bdrv_do_drained_begin(BlockDriverState *bs, BdrvChild *parent,
- void bdrv_drained_begin(BlockDriverState *bs)
- {
-     IO_OR_GS_CODE();
-    bdrv_do_drained_begin(bs, NULL, false, true);
-+    bdrv_do_drained_begin(bs, NULL, true);
- }
- 
- /**
-  * This function does not poll, nor must any of its recursively called
-  * functions.
-  */
-static void bdrv_do_drained_end(BlockDriverState *bs, BdrvChild *parent,
-                                bool ignore_bds_parents)
-+static void bdrv_do_drained_end(BlockDriverState *bs, BdrvChild *parent)
- {
-     int old_quiesce_counter;
- 
-     if (qemu_in_coroutine()) {
-        bdrv_co_yield_to_drain(bs, false, parent, ignore_bds_parents, false);
-+        bdrv_co_yield_to_drain(bs, false, parent, false);
-         return;
-     }
-     assert(bs->quiesce_counter > 0);
-@@ -423,9 +411,7 @@ static void bdrv_do_drained_end(BlockDriverState *bs, BdrvChild *parent,
-         if (bs->drv && bs->drv->bdrv_drain_end) {
-             bs->drv->bdrv_drain_end(bs);
-         }
-        /* TODO Remove ignore_bds_parents, we don't consider it any more */
-        bdrv_parent_drained_end(bs, parent, false);
-
-+        bdrv_parent_drained_end(bs, parent);
-         aio_enable_external(bdrv_get_aio_context(bs));
-     }
- }
-@@ -433,7 +419,7 @@ static void bdrv_do_drained_end(BlockDriverState *bs, BdrvChild *parent,
- void bdrv_drained_end(BlockDriverState *bs)
- {
-     IO_OR_GS_CODE();
-    bdrv_do_drained_end(bs, NULL, false);
-+    bdrv_do_drained_end(bs, NULL);
- }
- 
- void bdrv_drain(BlockDriverState *bs)
-@@ -491,7 +477,7 @@ void bdrv_drain_all_begin(void)
-     GLOBAL_STATE_CODE();
- 
-     if (qemu_in_coroutine()) {
-        bdrv_co_yield_to_drain(NULL, true, NULL, true, true);
-+        bdrv_co_yield_to_drain(NULL, true, NULL, true);
-         return;
-     }
- 
-@@ -516,7 +502,7 @@ void bdrv_drain_all_begin(void)
-         AioContext *aio_context = bdrv_get_aio_context(bs);
- 
-         aio_context_acquire(aio_context);
-        bdrv_do_drained_begin(bs, NULL, true, false);
-+        bdrv_do_drained_begin(bs, NULL, false);
-         aio_context_release(aio_context);
-     }
- 
-@@ -536,7 +522,7 @@ void bdrv_drain_all_end_quiesce(BlockDriverState *bs)
-     g_assert(!bs->refcnt);
- 
-     while (bs->quiesce_counter) {
-        bdrv_do_drained_end(bs, NULL, true);
-+        bdrv_do_drained_end(bs, NULL);
-     }
- }
- 
-@@ -558,7 +544,7 @@ void bdrv_drain_all_end(void)
-         AioContext *aio_context = bdrv_get_aio_context(bs);
- 
-         aio_context_acquire(aio_context);
-        bdrv_do_drained_end(bs, NULL, true);
-+        bdrv_do_drained_end(bs, NULL);
-         aio_context_release(aio_context);
-     }
- 
-diff --git a/include/block/block-io.h b/include/block/block-io.h
-index 9c36a16a1f..8f5e75756a 100644
--- a/include/block/block-io.h
-+++ b/include/block/block-io.h
-@@ -329,8 +329,7 @@ void bdrv_drained_begin(BlockDriverState *bs);
-  * Quiesces a BDS like bdrv_drained_begin(), but does not wait for already
-  * running requests to complete.
-  */
-void bdrv_do_drained_begin_quiesce(BlockDriverState *bs,
-                                   BdrvChild *parent, bool ignore_bds_parents);
-+void bdrv_do_drained_begin_quiesce(BlockDriverState *bs, BdrvChild *parent);
- 
- /**
-  * bdrv_drained_end:
-- 
-2.31.1
-
--- a/SOURCES/kvm-block-Remove-poll-parameter-from-bdrv_parent_drained.patch
+++ b/SOURCES/kvm-block-Remove-poll-parameter-from-bdrv_parent_drained.patch
@ -1,106 +0,0 @@
-From 60b66881fb972e1cdff1cd7b4c865e5e21c141b0 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Fri, 18 Nov 2022 18:41:10 +0100
-Subject: [PATCH 28/31] block: Remove poll parameter from
- bdrv_parent_drained_begin_single()
-
-RH-Author: Stefano Garzarella <sgarzare@redhat.com>
-RH-MergeRequest: 135: block: Simplify drain to prevent QEMU from crashing during snapshot
-RH-Bugzilla: 2155112
-RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Commit: [16/16] fd526cc9e5bebeb256cfa56d23ec596f26caa37a (sgarzarella/qemu-kvm-c-9-s)
-
-All callers of bdrv_parent_drained_begin_single() pass poll=false now,
-so we don't need the parameter any more.
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Message-Id: <20221118174110.55183-16-kwolf@redhat.com>
-Reviewed-by: Hanna Reitz <hreitz@redhat.com>
-Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 606ed756c1d69cba4822be8923248d2fd714f069)
-Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
---
- block.c                  | 4 ++--
- block/io.c               | 8 ++------
- include/block/block-io.h | 5 ++---
- 3 files changed, 6 insertions(+), 11 deletions(-)
-
-diff --git a/block.c b/block.c
-index 65588d313a..0d78711416 100644
--- a/block.c
-+++ b/block.c
-@@ -2417,7 +2417,7 @@ static void bdrv_replace_child_abort(void *opaque)
-          * new_bs drained when calling bdrv_replace_child_tran() is not a
-          * requirement any more.
-          */
-        bdrv_parent_drained_begin_single(s->child, false);
-+        bdrv_parent_drained_begin_single(s->child);
-         assert(!bdrv_parent_drained_poll_single(s->child));
-     }
-     assert(s->child->quiesced_parent);
-@@ -3059,7 +3059,7 @@ static BdrvChild *bdrv_attach_child_common(BlockDriverState *child_bs,
-      * a problem, we already did this), but it will still poll until the parent
-      * is fully quiesced, so it will not be negatively affected either.
-      */
-    bdrv_parent_drained_begin_single(new_child, false);
-+    bdrv_parent_drained_begin_single(new_child);
-     bdrv_replace_child_noperm(new_child, child_bs);
- 
-     BdrvAttachChildCommonState *s = g_new(BdrvAttachChildCommonState, 1);
-diff --git a/block/io.c b/block/io.c
-index ae64830eac..38e57d1f67 100644
--- a/block/io.c
-+++ b/block/io.c
-@@ -53,7 +53,7 @@ static void bdrv_parent_drained_begin(BlockDriverState *bs, BdrvChild *ignore)
-         if (c == ignore) {
-             continue;
-         }
-        bdrv_parent_drained_begin_single(c, false);
-+        bdrv_parent_drained_begin_single(c);
-     }
- }
- 
-@@ -105,9 +105,8 @@ static bool bdrv_parent_drained_poll(BlockDriverState *bs, BdrvChild *ignore,
-     return busy;
- }
- 
-void bdrv_parent_drained_begin_single(BdrvChild *c, bool poll)
-+void bdrv_parent_drained_begin_single(BdrvChild *c)
- {
-    AioContext *ctx = bdrv_child_get_parent_aio_context(c);
-     IO_OR_GS_CODE();
- 
-     assert(!c->quiesced_parent);
-@@ -116,9 +115,6 @@ void bdrv_parent_drained_begin_single(BdrvChild *c, bool poll)
-     if (c->klass->drained_begin) {
-         c->klass->drained_begin(c);
-     }
-    if (poll) {
-        AIO_WAIT_WHILE(ctx, bdrv_parent_drained_poll_single(c));
-    }
- }
- 
- static void bdrv_merge_limits(BlockLimits *dst, const BlockLimits *src)
-diff --git a/include/block/block-io.h b/include/block/block-io.h
-index 65e6d2569b..92aaa7c1e9 100644
--- a/include/block/block-io.h
-+++ b/include/block/block-io.h
-@@ -287,10 +287,9 @@ bdrv_writev_vmstate(BlockDriverState *bs, QEMUIOVector *qiov, int64_t pos);
- /**
-  * bdrv_parent_drained_begin_single:
-  *
- * Begin a quiesced section for the parent of @c. If @poll is true, wait for
- * any pending activity to cease.
-+ * Begin a quiesced section for the parent of @c.
-  */
-void bdrv_parent_drained_begin_single(BdrvChild *c, bool poll);
-+void bdrv_parent_drained_begin_single(BdrvChild *c);
- 
- /**
-  * bdrv_parent_drained_poll_single:
-- 
-2.31.1
-
--- a/SOURCES/kvm-block-Remove-subtree-drains.patch
+++ b/SOURCES/kvm-block-Remove-subtree-drains.patch
@ -1,896 +0,0 @@
-From 79063522861cb2baf921b204bcdf4c3bfb5697f4 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Fri, 18 Nov 2022 18:41:05 +0100
-Subject: [PATCH 23/31] block: Remove subtree drains
-
-RH-Author: Stefano Garzarella <sgarzare@redhat.com>
-RH-MergeRequest: 135: block: Simplify drain to prevent QEMU from crashing during snapshot
-RH-Bugzilla: 2155112
-RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Commit: [11/16] d92f5041cceeeec49a65441b22d20f692c0f1c77 (sgarzarella/qemu-kvm-c-9-s)
-
-Subtree drains are not used any more. Remove them.
-
-After this, BdrvChildClass.attach/detach() don't poll any more.
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
-Reviewed-by: Hanna Reitz <hreitz@redhat.com>
-Message-Id: <20221118174110.55183-11-kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 299403aedaeb7f08d8e98aa8614b29d4e5546066)
-Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
---
- block.c                          |  20 +--
- block/io.c                       | 121 +++-----------
- include/block/block-io.h         |  18 +--
- include/block/block_int-common.h |   1 -
- include/block/block_int-io.h     |  12 --
- tests/unit/test-bdrv-drain.c     | 261 ++-----------------------------
- 6 files changed, 44 insertions(+), 389 deletions(-)
-
-diff --git a/block.c b/block.c
-index 5330e89903..e0e3b21790 100644
--- a/block.c
-+++ b/block.c
-@@ -1232,7 +1232,7 @@ static void bdrv_child_cb_drained_begin(BdrvChild *child)
- static bool bdrv_child_cb_drained_poll(BdrvChild *child)
- {
-     BlockDriverState *bs = child->opaque;
-    return bdrv_drain_poll(bs, false, NULL, false);
-+    return bdrv_drain_poll(bs, NULL, false);
- }
- 
- static void bdrv_child_cb_drained_end(BdrvChild *child)
-@@ -1482,8 +1482,6 @@ static void bdrv_child_cb_attach(BdrvChild *child)
-         assert(!bs->file);
-         bs->file = child;
-     }
-
-    bdrv_apply_subtree_drain(child, bs);
- }
- 
- static void bdrv_child_cb_detach(BdrvChild *child)
-@@ -1494,8 +1492,6 @@ static void bdrv_child_cb_detach(BdrvChild *child)
-         bdrv_backing_detach(child);
-     }
- 
-    bdrv_unapply_subtree_drain(child, bs);
-
-     assert_bdrv_graph_writable(bs);
-     QLIST_REMOVE(child, next);
-     if (child == bs->backing) {
-@@ -2851,9 +2847,6 @@ static void bdrv_replace_child_noperm(BdrvChild *child,
-     }
- 
-     if (old_bs) {
-        /* Detach first so that the recursive drain sections coming from @child
-         * are already gone and we only end the drain sections that came from
-         * elsewhere. */
-         if (child->klass->detach) {
-             child->klass->detach(child);
-         }
-@@ -2868,17 +2861,14 @@ static void bdrv_replace_child_noperm(BdrvChild *child,
-         QLIST_INSERT_HEAD(&new_bs->parents, child, next_parent);
- 
-         /*
-         * Detaching the old node may have led to the new node's
-         * quiesce_counter having been decreased.  Not a problem, we
-         * just need to recognize this here and then invoke
-         * drained_end appropriately more often.
-+         * Polling in bdrv_parent_drained_begin_single() may have led to the new
-+         * node's quiesce_counter having been decreased.  Not a problem, we just
-+         * need to recognize this here and then invoke drained_end appropriately
-+         * more often.
-          */
-         assert(new_bs->quiesce_counter <= new_bs_quiesce_counter);
-         drain_saldo += new_bs->quiesce_counter - new_bs_quiesce_counter;
- 
-        /* Attach only after starting new drained sections, so that recursive
-         * drain sections coming from @child don't get an extra .drained_begin
-         * callback. */
-         if (child->klass->attach) {
-             child->klass->attach(child);
-         }
-diff --git a/block/io.c b/block/io.c
-index a25103be6f..75224480d0 100644
--- a/block/io.c
-+++ b/block/io.c
-@@ -236,17 +236,15 @@ typedef struct {
-     BlockDriverState *bs;
-     bool done;
-     bool begin;
-    bool recursive;
-     bool poll;
-     BdrvChild *parent;
-     bool ignore_bds_parents;
- } BdrvCoDrainData;
- 
- /* Returns true if BDRV_POLL_WHILE() should go into a blocking aio_poll() */
-bool bdrv_drain_poll(BlockDriverState *bs, bool recursive,
-                     BdrvChild *ignore_parent, bool ignore_bds_parents)
-+bool bdrv_drain_poll(BlockDriverState *bs, BdrvChild *ignore_parent,
-+                     bool ignore_bds_parents)
- {
-    BdrvChild *child, *next;
-     IO_OR_GS_CODE();
- 
-     if (bdrv_parent_drained_poll(bs, ignore_parent, ignore_bds_parents)) {
-@@ -257,29 +255,19 @@ bool bdrv_drain_poll(BlockDriverState *bs, bool recursive,
-         return true;
-     }
- 
-    if (recursive) {
-        assert(!ignore_bds_parents);
-        QLIST_FOREACH_SAFE(child, &bs->children, next, next) {
-            if (bdrv_drain_poll(child->bs, recursive, child, false)) {
-                return true;
-            }
-        }
-    }
-
-     return false;
- }
- 
-static bool bdrv_drain_poll_top_level(BlockDriverState *bs, bool recursive,
-+static bool bdrv_drain_poll_top_level(BlockDriverState *bs,
-                                       BdrvChild *ignore_parent)
- {
-    return bdrv_drain_poll(bs, recursive, ignore_parent, false);
-+    return bdrv_drain_poll(bs, ignore_parent, false);
- }
- 
-static void bdrv_do_drained_begin(BlockDriverState *bs, bool recursive,
-                                  BdrvChild *parent, bool ignore_bds_parents,
-                                  bool poll);
-static void bdrv_do_drained_end(BlockDriverState *bs, bool recursive,
-                                BdrvChild *parent, bool ignore_bds_parents);
-+static void bdrv_do_drained_begin(BlockDriverState *bs, BdrvChild *parent,
-+                                  bool ignore_bds_parents, bool poll);
-+static void bdrv_do_drained_end(BlockDriverState *bs, BdrvChild *parent,
-+                                bool ignore_bds_parents);
- 
- static void bdrv_co_drain_bh_cb(void *opaque)
- {
-@@ -292,12 +280,11 @@ static void bdrv_co_drain_bh_cb(void *opaque)
-         aio_context_acquire(ctx);
-         bdrv_dec_in_flight(bs);
-         if (data->begin) {
-            bdrv_do_drained_begin(bs, data->recursive, data->parent,
-                                  data->ignore_bds_parents, data->poll);
-+            bdrv_do_drained_begin(bs, data->parent, data->ignore_bds_parents,
-+                                  data->poll);
-         } else {
-             assert(!data->poll);
-            bdrv_do_drained_end(bs, data->recursive, data->parent,
-                                data->ignore_bds_parents);
-+            bdrv_do_drained_end(bs, data->parent, data->ignore_bds_parents);
-         }
-         aio_context_release(ctx);
-     } else {
-@@ -310,7 +297,7 @@ static void bdrv_co_drain_bh_cb(void *opaque)
- }
- 
- static void coroutine_fn bdrv_co_yield_to_drain(BlockDriverState *bs,
-                                                bool begin, bool recursive,
-+                                                bool begin,
-                                                 BdrvChild *parent,
-                                                 bool ignore_bds_parents,
-                                                 bool poll)
-@@ -329,7 +316,6 @@ static void coroutine_fn bdrv_co_yield_to_drain(BlockDriverState *bs,
-         .bs = bs,
-         .done = false,
-         .begin = begin,
-        .recursive = recursive,
-         .parent = parent,
-         .ignore_bds_parents = ignore_bds_parents,
-         .poll = poll,
-@@ -380,29 +366,16 @@ void bdrv_do_drained_begin_quiesce(BlockDriverState *bs,
-     }
- }
- 
-static void bdrv_do_drained_begin(BlockDriverState *bs, bool recursive,
-                                  BdrvChild *parent, bool ignore_bds_parents,
-                                  bool poll)
-+static void bdrv_do_drained_begin(BlockDriverState *bs, BdrvChild *parent,
-+                                  bool ignore_bds_parents, bool poll)
- {
-    BdrvChild *child, *next;
-
-     if (qemu_in_coroutine()) {
-        bdrv_co_yield_to_drain(bs, true, recursive, parent, ignore_bds_parents,
-                               poll);
-+        bdrv_co_yield_to_drain(bs, true, parent, ignore_bds_parents, poll);
-         return;
-     }
- 
-     bdrv_do_drained_begin_quiesce(bs, parent, ignore_bds_parents);
- 
-    if (recursive) {
-        assert(!ignore_bds_parents);
-        bs->recursive_quiesce_counter++;
-        QLIST_FOREACH_SAFE(child, &bs->children, next, next) {
-            bdrv_do_drained_begin(child->bs, true, child, ignore_bds_parents,
-                                  false);
-        }
-    }
-
-     /*
-      * Wait for drained requests to finish.
-      *
-@@ -414,35 +387,27 @@ static void bdrv_do_drained_begin(BlockDriverState *bs, bool recursive,
-      */
-     if (poll) {
-         assert(!ignore_bds_parents);
-        BDRV_POLL_WHILE(bs, bdrv_drain_poll_top_level(bs, recursive, parent));
-+        BDRV_POLL_WHILE(bs, bdrv_drain_poll_top_level(bs, parent));
-     }
- }
- 
- void bdrv_drained_begin(BlockDriverState *bs)
- {
-     IO_OR_GS_CODE();
-    bdrv_do_drained_begin(bs, false, NULL, false, true);
-}
-
-void bdrv_subtree_drained_begin(BlockDriverState *bs)
-{
-    IO_OR_GS_CODE();
-    bdrv_do_drained_begin(bs, true, NULL, false, true);
-+    bdrv_do_drained_begin(bs, NULL, false, true);
- }
- 
- /**
-  * This function does not poll, nor must any of its recursively called
-  * functions.
-  */
-static void bdrv_do_drained_end(BlockDriverState *bs, bool recursive,
-                                BdrvChild *parent, bool ignore_bds_parents)
-+static void bdrv_do_drained_end(BlockDriverState *bs, BdrvChild *parent,
-+                                bool ignore_bds_parents)
- {
-    BdrvChild *child;
-     int old_quiesce_counter;
- 
-     if (qemu_in_coroutine()) {
-        bdrv_co_yield_to_drain(bs, false, recursive, parent, ignore_bds_parents,
-                               false);
-+        bdrv_co_yield_to_drain(bs, false, parent, ignore_bds_parents, false);
-         return;
-     }
-     assert(bs->quiesce_counter > 0);
-@@ -457,46 +422,12 @@ static void bdrv_do_drained_end(BlockDriverState *bs, bool recursive,
-     if (old_quiesce_counter == 1) {
-         aio_enable_external(bdrv_get_aio_context(bs));
-     }
-
-    if (recursive) {
-        assert(!ignore_bds_parents);
-        bs->recursive_quiesce_counter--;
-        QLIST_FOREACH(child, &bs->children, next) {
-            bdrv_do_drained_end(child->bs, true, child, ignore_bds_parents);
-        }
-    }
- }
- 
- void bdrv_drained_end(BlockDriverState *bs)
- {
-     IO_OR_GS_CODE();
-    bdrv_do_drained_end(bs, false, NULL, false);
-}
-
-void bdrv_subtree_drained_end(BlockDriverState *bs)
-{
-    IO_OR_GS_CODE();
-    bdrv_do_drained_end(bs, true, NULL, false);
-}
-
-void bdrv_apply_subtree_drain(BdrvChild *child, BlockDriverState *new_parent)
-{
-    int i;
-    IO_OR_GS_CODE();
-
-    for (i = 0; i < new_parent->recursive_quiesce_counter; i++) {
-        bdrv_do_drained_begin(child->bs, true, child, false, true);
-    }
-}
-
-void bdrv_unapply_subtree_drain(BdrvChild *child, BlockDriverState *old_parent)
-{
-    int i;
-    IO_OR_GS_CODE();
-
-    for (i = 0; i < old_parent->recursive_quiesce_counter; i++) {
-        bdrv_do_drained_end(child->bs, true, child, false);
-    }
-+    bdrv_do_drained_end(bs, NULL, false);
- }
- 
- void bdrv_drain(BlockDriverState *bs)
-@@ -529,7 +460,7 @@ static bool bdrv_drain_all_poll(void)
-     while ((bs = bdrv_next_all_states(bs))) {
-         AioContext *aio_context = bdrv_get_aio_context(bs);
-         aio_context_acquire(aio_context);
-        result |= bdrv_drain_poll(bs, false, NULL, true);
-+        result |= bdrv_drain_poll(bs, NULL, true);
-         aio_context_release(aio_context);
-     }
- 
-@@ -554,7 +485,7 @@ void bdrv_drain_all_begin(void)
-     GLOBAL_STATE_CODE();
- 
-     if (qemu_in_coroutine()) {
-        bdrv_co_yield_to_drain(NULL, true, false, NULL, true, true);
-+        bdrv_co_yield_to_drain(NULL, true, NULL, true, true);
-         return;
-     }
- 
-@@ -579,7 +510,7 @@ void bdrv_drain_all_begin(void)
-         AioContext *aio_context = bdrv_get_aio_context(bs);
- 
-         aio_context_acquire(aio_context);
-        bdrv_do_drained_begin(bs, false, NULL, true, false);
-+        bdrv_do_drained_begin(bs, NULL, true, false);
-         aio_context_release(aio_context);
-     }
- 
-@@ -599,7 +530,7 @@ void bdrv_drain_all_end_quiesce(BlockDriverState *bs)
-     g_assert(!bs->refcnt);
- 
-     while (bs->quiesce_counter) {
-        bdrv_do_drained_end(bs, false, NULL, true);
-+        bdrv_do_drained_end(bs, NULL, true);
-     }
- }
- 
-@@ -621,7 +552,7 @@ void bdrv_drain_all_end(void)
-         AioContext *aio_context = bdrv_get_aio_context(bs);
- 
-         aio_context_acquire(aio_context);
-        bdrv_do_drained_end(bs, false, NULL, true);
-+        bdrv_do_drained_end(bs, NULL, true);
-         aio_context_release(aio_context);
-     }
- 
-diff --git a/include/block/block-io.h b/include/block/block-io.h
-index 054e964c9b..9c36a16a1f 100644
--- a/include/block/block-io.h
-+++ b/include/block/block-io.h
-@@ -302,8 +302,7 @@ void bdrv_parent_drained_end_single(BdrvChild *c);
- /**
-  * bdrv_drain_poll:
-  *
- * Poll for pending requests in @bs, its parents (except for @ignore_parent),
- * and if @recursive is true its children as well (used for subtree drain).
-+ * Poll for pending requests in @bs and its parents (except for @ignore_parent).
-  *
-  * If @ignore_bds_parents is true, parents that are BlockDriverStates must
-  * ignore the drain request because they will be drained separately (used for
-@@ -311,8 +310,8 @@ void bdrv_parent_drained_end_single(BdrvChild *c);
-  *
-  * This is part of bdrv_drained_begin.
-  */
-bool bdrv_drain_poll(BlockDriverState *bs, bool recursive,
-                     BdrvChild *ignore_parent, bool ignore_bds_parents);
-+bool bdrv_drain_poll(BlockDriverState *bs, BdrvChild *ignore_parent,
-+                     bool ignore_bds_parents);
- 
- /**
-  * bdrv_drained_begin:
-@@ -333,12 +332,6 @@ void bdrv_drained_begin(BlockDriverState *bs);
- void bdrv_do_drained_begin_quiesce(BlockDriverState *bs,
-                                    BdrvChild *parent, bool ignore_bds_parents);
- 
-/**
- * Like bdrv_drained_begin, but recursively begins a quiesced section for
- * exclusive access to all child nodes as well.
- */
-void bdrv_subtree_drained_begin(BlockDriverState *bs);
-
- /**
-  * bdrv_drained_end:
-  *
-@@ -346,9 +339,4 @@ void bdrv_subtree_drained_begin(BlockDriverState *bs);
-  */
- void bdrv_drained_end(BlockDriverState *bs);
- 
-/**
- * End a quiescent section started by bdrv_subtree_drained_begin().
- */
-void bdrv_subtree_drained_end(BlockDriverState *bs);
-
- #endif /* BLOCK_IO_H */
-diff --git a/include/block/block_int-common.h b/include/block/block_int-common.h
-index 2b97576f6d..791dddfd7d 100644
--- a/include/block/block_int-common.h
-+++ b/include/block/block_int-common.h
-@@ -1184,7 +1184,6 @@ struct BlockDriverState {
- 
-     /* Accessed with atomic ops.  */
-     int quiesce_counter;
-    int recursive_quiesce_counter;
- 
-     unsigned int write_gen;               /* Current data generation */
- 
-diff --git a/include/block/block_int-io.h b/include/block/block_int-io.h
-index 4b0b3e17ef..8bc061ebb8 100644
--- a/include/block/block_int-io.h
-+++ b/include/block/block_int-io.h
-@@ -179,16 +179,4 @@ void bdrv_bsc_invalidate_range(BlockDriverState *bs,
-  */
- void bdrv_bsc_fill(BlockDriverState *bs, int64_t offset, int64_t bytes);
- 
-
-/*
- * "I/O or GS" API functions. These functions can run without
- * the BQL, but only in one specific iothread/main loop.
- *
- * See include/block/block-io.h for more information about
- * the "I/O or GS" API.
- */
-
-void bdrv_apply_subtree_drain(BdrvChild *child, BlockDriverState *new_parent);
-void bdrv_unapply_subtree_drain(BdrvChild *child, BlockDriverState *old_parent);
-
- #endif /* BLOCK_INT_IO_H */
-diff --git a/tests/unit/test-bdrv-drain.c b/tests/unit/test-bdrv-drain.c
-index 695519ee02..dda08de8db 100644
--- a/tests/unit/test-bdrv-drain.c
-+++ b/tests/unit/test-bdrv-drain.c
-@@ -156,7 +156,6 @@ static void call_in_coroutine(void (*entry)(void))
- enum drain_type {
-     BDRV_DRAIN_ALL,
-     BDRV_DRAIN,
-    BDRV_SUBTREE_DRAIN,
-     DRAIN_TYPE_MAX,
- };
- 
-@@ -165,7 +164,6 @@ static void do_drain_begin(enum drain_type drain_type, BlockDriverState *bs)
-     switch (drain_type) {
-     case BDRV_DRAIN_ALL:        bdrv_drain_all_begin(); break;
-     case BDRV_DRAIN:            bdrv_drained_begin(bs); break;
-    case BDRV_SUBTREE_DRAIN:    bdrv_subtree_drained_begin(bs); break;
-     default:                    g_assert_not_reached();
-     }
- }
-@@ -175,7 +173,6 @@ static void do_drain_end(enum drain_type drain_type, BlockDriverState *bs)
-     switch (drain_type) {
-     case BDRV_DRAIN_ALL:        bdrv_drain_all_end(); break;
-     case BDRV_DRAIN:            bdrv_drained_end(bs); break;
-    case BDRV_SUBTREE_DRAIN:    bdrv_subtree_drained_end(bs); break;
-     default:                    g_assert_not_reached();
-     }
- }
-@@ -271,11 +268,6 @@ static void test_drv_cb_drain(void)
-     test_drv_cb_common(BDRV_DRAIN, false);
- }
- 
-static void test_drv_cb_drain_subtree(void)
-{
-    test_drv_cb_common(BDRV_SUBTREE_DRAIN, true);
-}
-
- static void test_drv_cb_co_drain_all(void)
- {
-     call_in_coroutine(test_drv_cb_drain_all);
-@@ -286,11 +278,6 @@ static void test_drv_cb_co_drain(void)
-     call_in_coroutine(test_drv_cb_drain);
- }
- 
-static void test_drv_cb_co_drain_subtree(void)
-{
-    call_in_coroutine(test_drv_cb_drain_subtree);
-}
-
- static void test_quiesce_common(enum drain_type drain_type, bool recursive)
- {
-     BlockBackend *blk;
-@@ -332,11 +319,6 @@ static void test_quiesce_drain(void)
-     test_quiesce_common(BDRV_DRAIN, false);
- }
- 
-static void test_quiesce_drain_subtree(void)
-{
-    test_quiesce_common(BDRV_SUBTREE_DRAIN, true);
-}
-
- static void test_quiesce_co_drain_all(void)
- {
-     call_in_coroutine(test_quiesce_drain_all);
-@@ -347,11 +329,6 @@ static void test_quiesce_co_drain(void)
-     call_in_coroutine(test_quiesce_drain);
- }
- 
-static void test_quiesce_co_drain_subtree(void)
-{
-    call_in_coroutine(test_quiesce_drain_subtree);
-}
-
- static void test_nested(void)
- {
-     BlockBackend *blk;
-@@ -402,158 +379,6 @@ static void test_nested(void)
-     blk_unref(blk);
- }
- 
-static void test_multiparent(void)
-{
-    BlockBackend *blk_a, *blk_b;
-    BlockDriverState *bs_a, *bs_b, *backing;
-    BDRVTestState *a_s, *b_s, *backing_s;
-
-    blk_a = blk_new(qemu_get_aio_context(), BLK_PERM_ALL, BLK_PERM_ALL);
-    bs_a = bdrv_new_open_driver(&bdrv_test, "test-node-a", BDRV_O_RDWR,
-                                &error_abort);
-    a_s = bs_a->opaque;
-    blk_insert_bs(blk_a, bs_a, &error_abort);
-
-    blk_b = blk_new(qemu_get_aio_context(), BLK_PERM_ALL, BLK_PERM_ALL);
-    bs_b = bdrv_new_open_driver(&bdrv_test, "test-node-b", BDRV_O_RDWR,
-                                &error_abort);
-    b_s = bs_b->opaque;
-    blk_insert_bs(blk_b, bs_b, &error_abort);
-
-    backing = bdrv_new_open_driver(&bdrv_test, "backing", 0, &error_abort);
-    backing_s = backing->opaque;
-    bdrv_set_backing_hd(bs_a, backing, &error_abort);
-    bdrv_set_backing_hd(bs_b, backing, &error_abort);
-
-    g_assert_cmpint(bs_a->quiesce_counter, ==, 0);
-    g_assert_cmpint(bs_b->quiesce_counter, ==, 0);
-    g_assert_cmpint(backing->quiesce_counter, ==, 0);
-    g_assert_cmpint(a_s->drain_count, ==, 0);
-    g_assert_cmpint(b_s->drain_count, ==, 0);
-    g_assert_cmpint(backing_s->drain_count, ==, 0);
-
-    do_drain_begin(BDRV_SUBTREE_DRAIN, bs_a);
-
-    g_assert_cmpint(bs_a->quiesce_counter, ==, 1);
-    g_assert_cmpint(bs_b->quiesce_counter, ==, 1);
-    g_assert_cmpint(backing->quiesce_counter, ==, 1);
-    g_assert_cmpint(a_s->drain_count, ==, 1);
-    g_assert_cmpint(b_s->drain_count, ==, 1);
-    g_assert_cmpint(backing_s->drain_count, ==, 1);
-
-    do_drain_begin(BDRV_SUBTREE_DRAIN, bs_b);
-
-    g_assert_cmpint(bs_a->quiesce_counter, ==, 2);
-    g_assert_cmpint(bs_b->quiesce_counter, ==, 2);
-    g_assert_cmpint(backing->quiesce_counter, ==, 2);
-    g_assert_cmpint(a_s->drain_count, ==, 2);
-    g_assert_cmpint(b_s->drain_count, ==, 2);
-    g_assert_cmpint(backing_s->drain_count, ==, 2);
-
-    do_drain_end(BDRV_SUBTREE_DRAIN, bs_b);
-
-    g_assert_cmpint(bs_a->quiesce_counter, ==, 1);
-    g_assert_cmpint(bs_b->quiesce_counter, ==, 1);
-    g_assert_cmpint(backing->quiesce_counter, ==, 1);
-    g_assert_cmpint(a_s->drain_count, ==, 1);
-    g_assert_cmpint(b_s->drain_count, ==, 1);
-    g_assert_cmpint(backing_s->drain_count, ==, 1);
-
-    do_drain_end(BDRV_SUBTREE_DRAIN, bs_a);
-
-    g_assert_cmpint(bs_a->quiesce_counter, ==, 0);
-    g_assert_cmpint(bs_b->quiesce_counter, ==, 0);
-    g_assert_cmpint(backing->quiesce_counter, ==, 0);
-    g_assert_cmpint(a_s->drain_count, ==, 0);
-    g_assert_cmpint(b_s->drain_count, ==, 0);
-    g_assert_cmpint(backing_s->drain_count, ==, 0);
-
-    bdrv_unref(backing);
-    bdrv_unref(bs_a);
-    bdrv_unref(bs_b);
-    blk_unref(blk_a);
-    blk_unref(blk_b);
-}
-
-static void test_graph_change_drain_subtree(void)
-{
-    BlockBackend *blk_a, *blk_b;
-    BlockDriverState *bs_a, *bs_b, *backing;
-    BDRVTestState *a_s, *b_s, *backing_s;
-
-    blk_a = blk_new(qemu_get_aio_context(), BLK_PERM_ALL, BLK_PERM_ALL);
-    bs_a = bdrv_new_open_driver(&bdrv_test, "test-node-a", BDRV_O_RDWR,
-                                &error_abort);
-    a_s = bs_a->opaque;
-    blk_insert_bs(blk_a, bs_a, &error_abort);
-
-    blk_b = blk_new(qemu_get_aio_context(), BLK_PERM_ALL, BLK_PERM_ALL);
-    bs_b = bdrv_new_open_driver(&bdrv_test, "test-node-b", BDRV_O_RDWR,
-                                &error_abort);
-    b_s = bs_b->opaque;
-    blk_insert_bs(blk_b, bs_b, &error_abort);
-
-    backing = bdrv_new_open_driver(&bdrv_test, "backing", 0, &error_abort);
-    backing_s = backing->opaque;
-    bdrv_set_backing_hd(bs_a, backing, &error_abort);
-
-    g_assert_cmpint(bs_a->quiesce_counter, ==, 0);
-    g_assert_cmpint(bs_b->quiesce_counter, ==, 0);
-    g_assert_cmpint(backing->quiesce_counter, ==, 0);
-    g_assert_cmpint(a_s->drain_count, ==, 0);
-    g_assert_cmpint(b_s->drain_count, ==, 0);
-    g_assert_cmpint(backing_s->drain_count, ==, 0);
-
-    do_drain_begin(BDRV_SUBTREE_DRAIN, bs_a);
-    do_drain_begin(BDRV_SUBTREE_DRAIN, bs_a);
-    do_drain_begin(BDRV_SUBTREE_DRAIN, bs_a);
-    do_drain_begin(BDRV_SUBTREE_DRAIN, bs_b);
-    do_drain_begin(BDRV_SUBTREE_DRAIN, bs_b);
-
-    bdrv_set_backing_hd(bs_b, backing, &error_abort);
-    g_assert_cmpint(bs_a->quiesce_counter, ==, 5);
-    g_assert_cmpint(bs_b->quiesce_counter, ==, 5);
-    g_assert_cmpint(backing->quiesce_counter, ==, 5);
-    g_assert_cmpint(a_s->drain_count, ==, 5);
-    g_assert_cmpint(b_s->drain_count, ==, 5);
-    g_assert_cmpint(backing_s->drain_count, ==, 5);
-
-    bdrv_set_backing_hd(bs_b, NULL, &error_abort);
-    g_assert_cmpint(bs_a->quiesce_counter, ==, 3);
-    g_assert_cmpint(bs_b->quiesce_counter, ==, 2);
-    g_assert_cmpint(backing->quiesce_counter, ==, 3);
-    g_assert_cmpint(a_s->drain_count, ==, 3);
-    g_assert_cmpint(b_s->drain_count, ==, 2);
-    g_assert_cmpint(backing_s->drain_count, ==, 3);
-
-    bdrv_set_backing_hd(bs_b, backing, &error_abort);
-    g_assert_cmpint(bs_a->quiesce_counter, ==, 5);
-    g_assert_cmpint(bs_b->quiesce_counter, ==, 5);
-    g_assert_cmpint(backing->quiesce_counter, ==, 5);
-    g_assert_cmpint(a_s->drain_count, ==, 5);
-    g_assert_cmpint(b_s->drain_count, ==, 5);
-    g_assert_cmpint(backing_s->drain_count, ==, 5);
-
-    do_drain_end(BDRV_SUBTREE_DRAIN, bs_b);
-    do_drain_end(BDRV_SUBTREE_DRAIN, bs_b);
-    do_drain_end(BDRV_SUBTREE_DRAIN, bs_a);
-    do_drain_end(BDRV_SUBTREE_DRAIN, bs_a);
-    do_drain_end(BDRV_SUBTREE_DRAIN, bs_a);
-
-    g_assert_cmpint(bs_a->quiesce_counter, ==, 0);
-    g_assert_cmpint(bs_b->quiesce_counter, ==, 0);
-    g_assert_cmpint(backing->quiesce_counter, ==, 0);
-    g_assert_cmpint(a_s->drain_count, ==, 0);
-    g_assert_cmpint(b_s->drain_count, ==, 0);
-    g_assert_cmpint(backing_s->drain_count, ==, 0);
-
-    bdrv_unref(backing);
-    bdrv_unref(bs_a);
-    bdrv_unref(bs_b);
-    blk_unref(blk_a);
-    blk_unref(blk_b);
-}
-
- static void test_graph_change_drain_all(void)
- {
-     BlockBackend *blk_a, *blk_b;
-@@ -773,12 +598,6 @@ static void test_iothread_drain(void)
-     test_iothread_common(BDRV_DRAIN, 1);
- }
- 
-static void test_iothread_drain_subtree(void)
-{
-    test_iothread_common(BDRV_SUBTREE_DRAIN, 0);
-    test_iothread_common(BDRV_SUBTREE_DRAIN, 1);
-}
-
- 
- typedef struct TestBlockJob {
-     BlockJob common;
-@@ -863,7 +682,6 @@ enum test_job_result {
- enum test_job_drain_node {
-     TEST_JOB_DRAIN_SRC,
-     TEST_JOB_DRAIN_SRC_CHILD,
-    TEST_JOB_DRAIN_SRC_PARENT,
- };
- 
- static void test_blockjob_common_drain_node(enum drain_type drain_type,
-@@ -901,9 +719,6 @@ static void test_blockjob_common_drain_node(enum drain_type drain_type,
-     case TEST_JOB_DRAIN_SRC_CHILD:
-         drain_bs = src_backing;
-         break;
-    case TEST_JOB_DRAIN_SRC_PARENT:
-        drain_bs = src_overlay;
-        break;
-     default:
-         g_assert_not_reached();
-     }
-@@ -1055,10 +870,6 @@ static void test_blockjob_common(enum drain_type drain_type, bool use_iothread,
-                                     TEST_JOB_DRAIN_SRC);
-     test_blockjob_common_drain_node(drain_type, use_iothread, result,
-                                     TEST_JOB_DRAIN_SRC_CHILD);
-    if (drain_type == BDRV_SUBTREE_DRAIN) {
-        test_blockjob_common_drain_node(drain_type, use_iothread, result,
-                                        TEST_JOB_DRAIN_SRC_PARENT);
-    }
- }
- 
- static void test_blockjob_drain_all(void)
-@@ -1071,11 +882,6 @@ static void test_blockjob_drain(void)
-     test_blockjob_common(BDRV_DRAIN, false, TEST_JOB_SUCCESS);
- }
- 
-static void test_blockjob_drain_subtree(void)
-{
-    test_blockjob_common(BDRV_SUBTREE_DRAIN, false, TEST_JOB_SUCCESS);
-}
-
- static void test_blockjob_error_drain_all(void)
- {
-     test_blockjob_common(BDRV_DRAIN_ALL, false, TEST_JOB_FAIL_RUN);
-@@ -1088,12 +894,6 @@ static void test_blockjob_error_drain(void)
-     test_blockjob_common(BDRV_DRAIN, false, TEST_JOB_FAIL_PREPARE);
- }
- 
-static void test_blockjob_error_drain_subtree(void)
-{
-    test_blockjob_common(BDRV_SUBTREE_DRAIN, false, TEST_JOB_FAIL_RUN);
-    test_blockjob_common(BDRV_SUBTREE_DRAIN, false, TEST_JOB_FAIL_PREPARE);
-}
-
- static void test_blockjob_iothread_drain_all(void)
- {
-     test_blockjob_common(BDRV_DRAIN_ALL, true, TEST_JOB_SUCCESS);
-@@ -1104,11 +904,6 @@ static void test_blockjob_iothread_drain(void)
-     test_blockjob_common(BDRV_DRAIN, true, TEST_JOB_SUCCESS);
- }
- 
-static void test_blockjob_iothread_drain_subtree(void)
-{
-    test_blockjob_common(BDRV_SUBTREE_DRAIN, true, TEST_JOB_SUCCESS);
-}
-
- static void test_blockjob_iothread_error_drain_all(void)
- {
-     test_blockjob_common(BDRV_DRAIN_ALL, true, TEST_JOB_FAIL_RUN);
-@@ -1121,12 +916,6 @@ static void test_blockjob_iothread_error_drain(void)
-     test_blockjob_common(BDRV_DRAIN, true, TEST_JOB_FAIL_PREPARE);
- }
- 
-static void test_blockjob_iothread_error_drain_subtree(void)
-{
-    test_blockjob_common(BDRV_SUBTREE_DRAIN, true, TEST_JOB_FAIL_RUN);
-    test_blockjob_common(BDRV_SUBTREE_DRAIN, true, TEST_JOB_FAIL_PREPARE);
-}
-
- 
- typedef struct BDRVTestTopState {
-     BdrvChild *wait_child;
-@@ -1273,14 +1062,6 @@ static void do_test_delete_by_drain(bool detach_instead_of_delete,
-         bdrv_drain(child_bs);
-         bdrv_unref(child_bs);
-         break;
-    case BDRV_SUBTREE_DRAIN:
-        /* Would have to ref/unref bs here for !detach_instead_of_delete, but
-         * then the whole test becomes pointless because the graph changes
-         * don't occur during the drain any more. */
-        assert(detach_instead_of_delete);
-        bdrv_subtree_drained_begin(bs);
-        bdrv_subtree_drained_end(bs);
-        break;
-     case BDRV_DRAIN_ALL:
-         bdrv_drain_all_begin();
-         bdrv_drain_all_end();
-@@ -1315,11 +1096,6 @@ static void test_detach_by_drain(void)
-     do_test_delete_by_drain(true, BDRV_DRAIN);
- }
- 
-static void test_detach_by_drain_subtree(void)
-{
-    do_test_delete_by_drain(true, BDRV_SUBTREE_DRAIN);
-}
-
- 
- struct detach_by_parent_data {
-     BlockDriverState *parent_b;
-@@ -1452,7 +1228,10 @@ static void test_detach_indirect(bool by_parent_cb)
-     g_assert(acb != NULL);
- 
-     /* Drain and check the expected result */
-    bdrv_subtree_drained_begin(parent_b);
-+    bdrv_drained_begin(parent_b);
-+    bdrv_drained_begin(a);
-+    bdrv_drained_begin(b);
-+    bdrv_drained_begin(c);
- 
-     g_assert(detach_by_parent_data.child_c != NULL);
- 
-@@ -1467,12 +1246,15 @@ static void test_detach_indirect(bool by_parent_cb)
-     g_assert(QLIST_NEXT(child_a, next) == NULL);
- 
-     g_assert_cmpint(parent_a->quiesce_counter, ==, 1);
-    g_assert_cmpint(parent_b->quiesce_counter, ==, 1);
-+    g_assert_cmpint(parent_b->quiesce_counter, ==, 3);
-     g_assert_cmpint(a->quiesce_counter, ==, 1);
-    g_assert_cmpint(b->quiesce_counter, ==, 0);
-+    g_assert_cmpint(b->quiesce_counter, ==, 1);
-     g_assert_cmpint(c->quiesce_counter, ==, 1);
- 
-    bdrv_subtree_drained_end(parent_b);
-+    bdrv_drained_end(parent_b);
-+    bdrv_drained_end(a);
-+    bdrv_drained_end(b);
-+    bdrv_drained_end(c);
- 
-     bdrv_unref(parent_b);
-     blk_unref(blk);
-@@ -2202,70 +1984,47 @@ int main(int argc, char **argv)
- 
-     g_test_add_func("/bdrv-drain/driver-cb/drain_all", test_drv_cb_drain_all);
-     g_test_add_func("/bdrv-drain/driver-cb/drain", test_drv_cb_drain);
-    g_test_add_func("/bdrv-drain/driver-cb/drain_subtree",
-                    test_drv_cb_drain_subtree);
- 
-     g_test_add_func("/bdrv-drain/driver-cb/co/drain_all",
-                     test_drv_cb_co_drain_all);
-     g_test_add_func("/bdrv-drain/driver-cb/co/drain", test_drv_cb_co_drain);
-    g_test_add_func("/bdrv-drain/driver-cb/co/drain_subtree",
-                    test_drv_cb_co_drain_subtree);
-
- 
-     g_test_add_func("/bdrv-drain/quiesce/drain_all", test_quiesce_drain_all);
-     g_test_add_func("/bdrv-drain/quiesce/drain", test_quiesce_drain);
-    g_test_add_func("/bdrv-drain/quiesce/drain_subtree",
-                    test_quiesce_drain_subtree);
- 
-     g_test_add_func("/bdrv-drain/quiesce/co/drain_all",
-                     test_quiesce_co_drain_all);
-     g_test_add_func("/bdrv-drain/quiesce/co/drain", test_quiesce_co_drain);
-    g_test_add_func("/bdrv-drain/quiesce/co/drain_subtree",
-                    test_quiesce_co_drain_subtree);
- 
-     g_test_add_func("/bdrv-drain/nested", test_nested);
-    g_test_add_func("/bdrv-drain/multiparent", test_multiparent);
- 
-    g_test_add_func("/bdrv-drain/graph-change/drain_subtree",
-                    test_graph_change_drain_subtree);
-     g_test_add_func("/bdrv-drain/graph-change/drain_all",
-                     test_graph_change_drain_all);
- 
-     g_test_add_func("/bdrv-drain/iothread/drain_all", test_iothread_drain_all);
-     g_test_add_func("/bdrv-drain/iothread/drain", test_iothread_drain);
-    g_test_add_func("/bdrv-drain/iothread/drain_subtree",
-                    test_iothread_drain_subtree);
- 
-     g_test_add_func("/bdrv-drain/blockjob/drain_all", test_blockjob_drain_all);
-     g_test_add_func("/bdrv-drain/blockjob/drain", test_blockjob_drain);
-    g_test_add_func("/bdrv-drain/blockjob/drain_subtree",
-                    test_blockjob_drain_subtree);
- 
-     g_test_add_func("/bdrv-drain/blockjob/error/drain_all",
-                     test_blockjob_error_drain_all);
-     g_test_add_func("/bdrv-drain/blockjob/error/drain",
-                     test_blockjob_error_drain);
-    g_test_add_func("/bdrv-drain/blockjob/error/drain_subtree",
-                    test_blockjob_error_drain_subtree);
- 
-     g_test_add_func("/bdrv-drain/blockjob/iothread/drain_all",
-                     test_blockjob_iothread_drain_all);
-     g_test_add_func("/bdrv-drain/blockjob/iothread/drain",
-                     test_blockjob_iothread_drain);
-    g_test_add_func("/bdrv-drain/blockjob/iothread/drain_subtree",
-                    test_blockjob_iothread_drain_subtree);
- 
-     g_test_add_func("/bdrv-drain/blockjob/iothread/error/drain_all",
-                     test_blockjob_iothread_error_drain_all);
-     g_test_add_func("/bdrv-drain/blockjob/iothread/error/drain",
-                     test_blockjob_iothread_error_drain);
-    g_test_add_func("/bdrv-drain/blockjob/iothread/error/drain_subtree",
-                    test_blockjob_iothread_error_drain_subtree);
- 
-     g_test_add_func("/bdrv-drain/deletion/drain", test_delete_by_drain);
-     g_test_add_func("/bdrv-drain/detach/drain_all", test_detach_by_drain_all);
-     g_test_add_func("/bdrv-drain/detach/drain", test_detach_by_drain);
-    g_test_add_func("/bdrv-drain/detach/drain_subtree", test_detach_by_drain_subtree);
-     g_test_add_func("/bdrv-drain/detach/parent_cb", test_detach_by_parent_cb);
-     g_test_add_func("/bdrv-drain/detach/driver_cb", test_detach_by_driver_cb);
- 
-- 
-2.31.1
-
--- a/SOURCES/kvm-block-Revert-.bdrv_drained_begin-end-to-non-coroutin.patch
+++ b/SOURCES/kvm-block-Revert-.bdrv_drained_begin-end-to-non-coroutin.patch
@ -1,302 +0,0 @@
-From 0e894c93cae97bb792dc483be8e295d097ebd7a1 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Fri, 18 Nov 2022 18:40:58 +0100
-Subject: [PATCH 16/31] block: Revert .bdrv_drained_begin/end to
- non-coroutine_fn
-
-RH-Author: Stefano Garzarella <sgarzare@redhat.com>
-RH-MergeRequest: 135: block: Simplify drain to prevent QEMU from crashing during snapshot
-RH-Bugzilla: 2155112
-RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Commit: [4/16] 86d6049e40a99604e414c2572b67f74b85868832 (sgarzarella/qemu-kvm-c-9-s)
-
-Polling during bdrv_drained_end() can be problematic (and in the future,
-we may get cases for bdrv_drained_begin() where polling is forbidden,
-and we don't care about already in-flight requests, but just want to
-prevent new requests from arriving).
-
-The .bdrv_drained_begin/end callbacks running in a coroutine is the only
-reason why we have to do this polling, so make them non-coroutine
-callbacks again. None of the callers actually yield any more.
-
-This means that bdrv_drained_end() effectively doesn't poll any more,
-even if AIO_WAIT_WHILE() loops are still there (their condition is false
-from the beginning). This is generally not a problem, but in
-test-bdrv-drain, some additional explicit aio_poll() calls need to be
-added because the test case wants to verify the final state after BHs
-have executed.
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
-Reviewed-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
-Reviewed-by: Hanna Reitz <hreitz@redhat.com>
-Message-Id: <20221118174110.55183-4-kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 5e8ac21717373cbe96ef7a91e216bf5788815d63)
-Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
---
- block.c                          |  4 +--
- block/io.c                       | 49 +++++---------------------------
- block/qed.c                      |  6 ++--
- block/throttle.c                 |  8 +++---
- include/block/block_int-common.h | 10 ++++---
- tests/unit/test-bdrv-drain.c     | 18 ++++++------
- 6 files changed, 32 insertions(+), 63 deletions(-)
-
-diff --git a/block.c b/block.c
-index ec184150a2..16a62a329c 100644
--- a/block.c
-+++ b/block.c
-@@ -1713,8 +1713,8 @@ static int bdrv_open_driver(BlockDriverState *bs, BlockDriver *drv,
-     assert(is_power_of_2(bs->bl.request_alignment));
- 
-     for (i = 0; i < bs->quiesce_counter; i++) {
-        if (drv->bdrv_co_drain_begin) {
-            drv->bdrv_co_drain_begin(bs);
-+        if (drv->bdrv_drain_begin) {
-+            drv->bdrv_drain_begin(bs);
-         }
-     }
- 
-diff --git a/block/io.c b/block/io.c
-index b9424024f9..c2ed4b2af9 100644
--- a/block/io.c
-+++ b/block/io.c
-@@ -252,55 +252,20 @@ typedef struct {
-     int *drained_end_counter;
- } BdrvCoDrainData;
- 
-static void coroutine_fn bdrv_drain_invoke_entry(void *opaque)
-{
-    BdrvCoDrainData *data = opaque;
-    BlockDriverState *bs = data->bs;
-
-    if (data->begin) {
-        bs->drv->bdrv_co_drain_begin(bs);
-    } else {
-        bs->drv->bdrv_co_drain_end(bs);
-    }
-
-    /* Set data->done and decrement drained_end_counter before bdrv_wakeup() */
-    qatomic_mb_set(&data->done, true);
-    if (!data->begin) {
-        qatomic_dec(data->drained_end_counter);
-    }
-    bdrv_dec_in_flight(bs);
-
-    g_free(data);
-}
-
-/* Recursively call BlockDriver.bdrv_co_drain_begin/end callbacks */
-+/* Recursively call BlockDriver.bdrv_drain_begin/end callbacks */
- static void bdrv_drain_invoke(BlockDriverState *bs, bool begin,
-                               int *drained_end_counter)
- {
-    BdrvCoDrainData *data;
-
-    if (!bs->drv || (begin && !bs->drv->bdrv_co_drain_begin) ||
-            (!begin && !bs->drv->bdrv_co_drain_end)) {
-+    if (!bs->drv || (begin && !bs->drv->bdrv_drain_begin) ||
-+            (!begin && !bs->drv->bdrv_drain_end)) {
-         return;
-     }
- 
-    data = g_new(BdrvCoDrainData, 1);
-    *data = (BdrvCoDrainData) {
-        .bs = bs,
-        .done = false,
-        .begin = begin,
-        .drained_end_counter = drained_end_counter,
-    };
-
-    if (!begin) {
-        qatomic_inc(drained_end_counter);
-+    if (begin) {
-+        bs->drv->bdrv_drain_begin(bs);
-+    } else {
-+        bs->drv->bdrv_drain_end(bs);
-     }
-
-    /* Make sure the driver callback completes during the polling phase for
-     * drain_begin. */
-    bdrv_inc_in_flight(bs);
-    data->co = qemu_coroutine_create(bdrv_drain_invoke_entry, data);
-    aio_co_schedule(bdrv_get_aio_context(bs), data->co);
- }
- 
- /* Returns true if BDRV_POLL_WHILE() should go into a blocking aio_poll() */
-diff --git a/block/qed.c b/block/qed.c
-index 013f826c44..c2691a85b1 100644
--- a/block/qed.c
-+++ b/block/qed.c
-@@ -262,7 +262,7 @@ static bool coroutine_fn qed_plug_allocating_write_reqs(BDRVQEDState *s)
-     assert(!s->allocating_write_reqs_plugged);
-     if (s->allocating_acb != NULL) {
-         /* Another allocating write came concurrently.  This cannot happen
-         * from bdrv_qed_co_drain_begin, but it can happen when the timer runs.
-+         * from bdrv_qed_drain_begin, but it can happen when the timer runs.
-          */
-         qemu_co_mutex_unlock(&s->table_lock);
-         return false;
-@@ -365,7 +365,7 @@ static void bdrv_qed_attach_aio_context(BlockDriverState *bs,
-     }
- }
- 
-static void coroutine_fn bdrv_qed_co_drain_begin(BlockDriverState *bs)
-+static void bdrv_qed_drain_begin(BlockDriverState *bs)
- {
-     BDRVQEDState *s = bs->opaque;
- 
-@@ -1661,7 +1661,7 @@ static BlockDriver bdrv_qed = {
-     .bdrv_co_check            = bdrv_qed_co_check,
-     .bdrv_detach_aio_context  = bdrv_qed_detach_aio_context,
-     .bdrv_attach_aio_context  = bdrv_qed_attach_aio_context,
-    .bdrv_co_drain_begin      = bdrv_qed_co_drain_begin,
-+    .bdrv_drain_begin         = bdrv_qed_drain_begin,
- };
- 
- static void bdrv_qed_init(void)
-diff --git a/block/throttle.c b/block/throttle.c
-index 131eba3ab4..88851c84f4 100644
--- a/block/throttle.c
-+++ b/block/throttle.c
-@@ -214,7 +214,7 @@ static void throttle_reopen_abort(BDRVReopenState *reopen_state)
-     reopen_state->opaque = NULL;
- }
- 
-static void coroutine_fn throttle_co_drain_begin(BlockDriverState *bs)
-+static void throttle_drain_begin(BlockDriverState *bs)
- {
-     ThrottleGroupMember *tgm = bs->opaque;
-     if (qatomic_fetch_inc(&tgm->io_limits_disabled) == 0) {
-@@ -222,7 +222,7 @@ static void coroutine_fn throttle_co_drain_begin(BlockDriverState *bs)
-     }
- }
- 
-static void coroutine_fn throttle_co_drain_end(BlockDriverState *bs)
-+static void throttle_drain_end(BlockDriverState *bs)
- {
-     ThrottleGroupMember *tgm = bs->opaque;
-     assert(tgm->io_limits_disabled);
-@@ -261,8 +261,8 @@ static BlockDriver bdrv_throttle = {
-     .bdrv_reopen_commit                 =   throttle_reopen_commit,
-     .bdrv_reopen_abort                  =   throttle_reopen_abort,
- 
-    .bdrv_co_drain_begin                =   throttle_co_drain_begin,
-    .bdrv_co_drain_end                  =   throttle_co_drain_end,
-+    .bdrv_drain_begin                   =   throttle_drain_begin,
-+    .bdrv_drain_end                     =   throttle_drain_end,
- 
-     .is_filter                          =   true,
-     .strong_runtime_opts                =   throttle_strong_runtime_opts,
-diff --git a/include/block/block_int-common.h b/include/block/block_int-common.h
-index 31ae91e56e..40d646d1ed 100644
--- a/include/block/block_int-common.h
-+++ b/include/block/block_int-common.h
-@@ -735,17 +735,19 @@ struct BlockDriver {
-     void (*bdrv_io_unplug)(BlockDriverState *bs);
- 
-     /**
-     * bdrv_co_drain_begin is called if implemented in the beginning of a
-+     * bdrv_drain_begin is called if implemented in the beginning of a
-      * drain operation to drain and stop any internal sources of requests in
-      * the driver.
-     * bdrv_co_drain_end is called if implemented at the end of the drain.
-+     * bdrv_drain_end is called if implemented at the end of the drain.
-      *
-      * They should be used by the driver to e.g. manage scheduled I/O
-      * requests, or toggle an internal state. After the end of the drain new
-      * requests will continue normally.
-+     *
-+     * Implementations of both functions must not call aio_poll().
-      */
-    void coroutine_fn (*bdrv_co_drain_begin)(BlockDriverState *bs);
-    void coroutine_fn (*bdrv_co_drain_end)(BlockDriverState *bs);
-+    void (*bdrv_drain_begin)(BlockDriverState *bs);
-+    void (*bdrv_drain_end)(BlockDriverState *bs);
- 
-     bool (*bdrv_supports_persistent_dirty_bitmap)(BlockDriverState *bs);
-     bool coroutine_fn (*bdrv_co_can_store_new_dirty_bitmap)(
-diff --git a/tests/unit/test-bdrv-drain.c b/tests/unit/test-bdrv-drain.c
-index 24f34e24ad..695519ee02 100644
--- a/tests/unit/test-bdrv-drain.c
-+++ b/tests/unit/test-bdrv-drain.c
-@@ -46,7 +46,7 @@ static void coroutine_fn sleep_in_drain_begin(void *opaque)
-     bdrv_dec_in_flight(bs);
- }
- 
-static void coroutine_fn bdrv_test_co_drain_begin(BlockDriverState *bs)
-+static void bdrv_test_drain_begin(BlockDriverState *bs)
- {
-     BDRVTestState *s = bs->opaque;
-     s->drain_count++;
-@@ -57,7 +57,7 @@ static void coroutine_fn bdrv_test_co_drain_begin(BlockDriverState *bs)
-     }
- }
- 
-static void coroutine_fn bdrv_test_co_drain_end(BlockDriverState *bs)
-+static void bdrv_test_drain_end(BlockDriverState *bs)
- {
-     BDRVTestState *s = bs->opaque;
-     s->drain_count--;
-@@ -111,8 +111,8 @@ static BlockDriver bdrv_test = {
-     .bdrv_close             = bdrv_test_close,
-     .bdrv_co_preadv         = bdrv_test_co_preadv,
- 
-    .bdrv_co_drain_begin    = bdrv_test_co_drain_begin,
-    .bdrv_co_drain_end      = bdrv_test_co_drain_end,
-+    .bdrv_drain_begin       = bdrv_test_drain_begin,
-+    .bdrv_drain_end         = bdrv_test_drain_end,
- 
-     .bdrv_child_perm        = bdrv_default_perms,
- 
-@@ -1703,6 +1703,7 @@ static void test_blockjob_commit_by_drained_end(void)
-     bdrv_drained_begin(bs_child);
-     g_assert(!job_has_completed);
-     bdrv_drained_end(bs_child);
-+    aio_poll(qemu_get_aio_context(), false);
-     g_assert(job_has_completed);
- 
-     bdrv_unref(bs_parents[0]);
-@@ -1858,6 +1859,7 @@ static void test_drop_intermediate_poll(void)
- 
-     g_assert(!job_has_completed);
-     ret = bdrv_drop_intermediate(chain[1], chain[0], NULL);
-+    aio_poll(qemu_get_aio_context(), false);
-     g_assert(ret == 0);
-     g_assert(job_has_completed);
- 
-@@ -1946,7 +1948,7 @@ static void coroutine_fn bdrv_replace_test_drain_co(void *opaque)
-  * .was_drained.
-  * Increment .drain_count.
-  */
-static void coroutine_fn bdrv_replace_test_co_drain_begin(BlockDriverState *bs)
-+static void bdrv_replace_test_drain_begin(BlockDriverState *bs)
- {
-     BDRVReplaceTestState *s = bs->opaque;
- 
-@@ -1977,7 +1979,7 @@ static void coroutine_fn bdrv_replace_test_read_entry(void *opaque)
-  * If .drain_count reaches 0 and the node has a backing file, issue a
-  * read request.
-  */
-static void coroutine_fn bdrv_replace_test_co_drain_end(BlockDriverState *bs)
-+static void bdrv_replace_test_drain_end(BlockDriverState *bs)
- {
-     BDRVReplaceTestState *s = bs->opaque;
- 
-@@ -2002,8 +2004,8 @@ static BlockDriver bdrv_replace_test = {
-     .bdrv_close             = bdrv_replace_test_close,
-     .bdrv_co_preadv         = bdrv_replace_test_co_preadv,
- 
-    .bdrv_co_drain_begin    = bdrv_replace_test_co_drain_begin,
-    .bdrv_co_drain_end      = bdrv_replace_test_co_drain_end,
-+    .bdrv_drain_begin       = bdrv_replace_test_drain_begin,
-+    .bdrv_drain_end         = bdrv_replace_test_drain_end,
- 
-     .bdrv_child_perm        = bdrv_default_perms,
- };
-- 
-2.31.1
-
--- a/SOURCES/kvm-block-Split-BlockNodeInfo-off-of-ImageInfo.patch
+++ b/SOURCES/kvm-block-Split-BlockNodeInfo-off-of-ImageInfo.patch
@ -1,246 +0,0 @@
-From 54e290df4bc1c9e83be7357caed6a2b1ba4f21f0 Mon Sep 17 00:00:00 2001
-From: Hanna Reitz <hreitz@redhat.com>
-Date: Mon, 20 Jun 2022 18:26:56 +0200
-Subject: [PATCH 09/20] block: Split BlockNodeInfo off of ImageInfo
-
-RH-Author: Hanna Czenczek <hreitz@redhat.com>
-RH-MergeRequest: 145: Show protocol-level information in qemu-img info
-RH-Bugzilla: 1860292
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
-RH-Commit: [4/12] fc8d69d549bb9a929db218b91697ee3ae95c1ff6 (hreitz/qemu-kvm-c-9-s)
-
-ImageInfo sometimes contains flat information, and sometimes it does
-not.  Split off a BlockNodeInfo struct, which only contains information
-about a single node and has no link to the backing image.
-
-We do this so we can extend BlockNodeInfo to a BlockGraphInfo struct,
-which has links to all child nodes, not just the backing node.  It would
-be strange to base BlockGraphInfo on ImageInfo, because then this
-extended struct would have two links to the backing node (one in
-BlockGraphInfo as one of all the child links, and one in ImageInfo).
-
-Furthermore, it is quite common to ignore the backing-image field
-altogether: bdrv_query_image_info() does not set it, and
-bdrv_image_info_dump() does not evaluate it.  That signals that we
-should have different structs for describing a single node and one that
-has a link to the backing image.
-
-Still, bdrv_query_image_info() and bdrv_image_info_dump() are not
-changed too much in this patch.  Follow-up patches will handle them.
-
-Signed-off-by: Hanna Reitz <hreitz@redhat.com>
-Message-Id: <20220620162704.80987-5-hreitz@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit a2085f8909377b6df738f6c3f7ee6db4d16da8f7)
-Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
---
- block/qapi.c         | 86 ++++++++++++++++++++++++++++++++------------
- include/block/qapi.h |  3 ++
- qapi/block-core.json | 24 +++++++++----
- 3 files changed, 85 insertions(+), 28 deletions(-)
-
-diff --git a/block/qapi.c b/block/qapi.c
-index 51202b470a..e5022b4481 100644
--- a/block/qapi.c
-+++ b/block/qapi.c
-@@ -241,30 +241,18 @@ int bdrv_query_snapshot_info_list(BlockDriverState *bs,
- }
- 
- /**
- * bdrv_query_image_info:
- * @bs: block device to examine
- * @p_info: location to store image information
- * @errp: location to store error information
- *
- * Store "flat" image information in @p_info.
- *
- * "Flat" means it does *not* query backing image information,
- * i.e. (*pinfo)->has_backing_image will be set to false and
- * (*pinfo)->backing_image to NULL even when the image does in fact have
- * a backing image.
- *
- * @p_info will be set only on success. On error, store error in @errp.
-+ * Helper function for other query info functions.  Store information about @bs
-+ * in @info, setting @errp on error.
-  */
-void bdrv_query_image_info(BlockDriverState *bs,
-                           ImageInfo **p_info,
-                           Error **errp)
-+static void bdrv_do_query_node_info(BlockDriverState *bs,
-+                                    BlockNodeInfo *info,
-+                                    Error **errp)
- {
-     int64_t size;
-     const char *backing_filename;
-     BlockDriverInfo bdi;
-     int ret;
-     Error *err = NULL;
-    ImageInfo *info;
- 
-     aio_context_acquire(bdrv_get_aio_context(bs));
- 
-@@ -277,7 +265,6 @@ void bdrv_query_image_info(BlockDriverState *bs,
- 
-     bdrv_refresh_filename(bs);
- 
-    info = g_new0(ImageInfo, 1);
-     info->filename        = g_strdup(bs->filename);
-     info->format          = g_strdup(bdrv_get_format_name(bs));
-     info->virtual_size    = size;
-@@ -298,7 +285,6 @@ void bdrv_query_image_info(BlockDriverState *bs,
-     info->format_specific = bdrv_get_specific_info(bs, &err);
-     if (err) {
-         error_propagate(errp, err);
-        qapi_free_ImageInfo(info);
-         goto out;
-     }
-     info->has_format_specific = info->format_specific != NULL;
-@@ -339,16 +325,72 @@ void bdrv_query_image_info(BlockDriverState *bs,
-         break;
-     default:
-         error_propagate(errp, err);
-        qapi_free_ImageInfo(info);
-         goto out;
-     }
- 
-    *p_info = info;
-
- out:
-     aio_context_release(bdrv_get_aio_context(bs));
- }
- 
-+/**
-+ * bdrv_query_block_node_info:
-+ * @bs: block node to examine
-+ * @p_info: location to store node information
-+ * @errp: location to store error information
-+ *
-+ * Store image information about @bs in @p_info.
-+ *
-+ * @p_info will be set only on success. On error, store error in @errp.
-+ */
-+void bdrv_query_block_node_info(BlockDriverState *bs,
-+                                BlockNodeInfo **p_info,
-+                                Error **errp)
-+{
-+    BlockNodeInfo *info;
-+    ERRP_GUARD();
-+
-+    info = g_new0(BlockNodeInfo, 1);
-+    bdrv_do_query_node_info(bs, info, errp);
-+    if (*errp) {
-+        qapi_free_BlockNodeInfo(info);
-+        return;
-+    }
-+
-+    *p_info = info;
-+}
-+
-+/**
-+ * bdrv_query_image_info:
-+ * @bs: block node to examine
-+ * @p_info: location to store image information
-+ * @errp: location to store error information
-+ *
-+ * Store "flat" image information in @p_info.
-+ *
-+ * "Flat" means it does *not* query backing image information,
-+ * i.e. (*pinfo)->has_backing_image will be set to false and
-+ * (*pinfo)->backing_image to NULL even when the image does in fact have
-+ * a backing image.
-+ *
-+ * @p_info will be set only on success. On error, store error in @errp.
-+ */
-+void bdrv_query_image_info(BlockDriverState *bs,
-+                           ImageInfo **p_info,
-+                           Error **errp)
-+{
-+    ImageInfo *info;
-+    ERRP_GUARD();
-+
-+    info = g_new0(ImageInfo, 1);
-+    bdrv_do_query_node_info(bs, qapi_ImageInfo_base(info), errp);
-+    if (*errp) {
-+        qapi_free_ImageInfo(info);
-+        return;
-+    }
-+
-+    *p_info = info;
-+}
-+
- /* @p_info will be set only on success. */
- static void bdrv_query_info(BlockBackend *blk, BlockInfo **p_info,
-                             Error **errp)
-diff --git a/include/block/qapi.h b/include/block/qapi.h
-index c09859ea78..c7de4e3fa9 100644
--- a/include/block/qapi.h
-+++ b/include/block/qapi.h
-@@ -35,6 +35,9 @@ BlockDeviceInfo *bdrv_block_device_info(BlockBackend *blk,
- int bdrv_query_snapshot_info_list(BlockDriverState *bs,
-                                   SnapshotInfoList **p_list,
-                                   Error **errp);
-+void bdrv_query_block_node_info(BlockDriverState *bs,
-+                                BlockNodeInfo **p_info,
-+                                Error **errp);
- void bdrv_query_image_info(BlockDriverState *bs,
-                            ImageInfo **p_info,
-                            Error **errp);
-diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 4b9365167f..7720da0498 100644
--- a/qapi/block-core.json
-+++ b/qapi/block-core.json
-@@ -251,7 +251,7 @@
-   } }
- 
- ##
-# @ImageInfo:
-+# @BlockNodeInfo:
- #
- # Information about a QEMU image file
- #
-@@ -279,22 +279,34 @@
- #
- # @snapshots: list of VM snapshots
- #
-# @backing-image: info of the backing image (since 1.6)
-#
- # @format-specific: structure supplying additional format-specific
- #                   information (since 1.7)
- #
-# Since: 1.3
-+# Since: 8.0
- ##
-{ 'struct': 'ImageInfo',
-+{ 'struct': 'BlockNodeInfo',
-   'data': {'filename': 'str', 'format': 'str', '*dirty-flag': 'bool',
-            '*actual-size': 'int', 'virtual-size': 'int',
-            '*cluster-size': 'int', '*encrypted': 'bool', '*compressed': 'bool',
-            '*backing-filename': 'str', '*full-backing-filename': 'str',
-            '*backing-filename-format': 'str', '*snapshots': ['SnapshotInfo'],
-           '*backing-image': 'ImageInfo',
-            '*format-specific': 'ImageInfoSpecific' } }
- 
-+##
-+# @ImageInfo:
-+#
-+# Information about a QEMU image file, and potentially its backing image
-+#
-+# @backing-image: info of the backing image
-+#
-+# Since: 1.3
-+##
-+{ 'struct': 'ImageInfo',
-+  'base': 'BlockNodeInfo',
-+  'data': {
-+      '*backing-image': 'ImageInfo'
-+  } }
-+
- ##
- # @ImageCheck:
- #
-- 
-2.31.1
-
--- a/SOURCES/kvm-block-backend-prevent-dangling-BDS-pointers-across-a.patch
+++ b/SOURCES/kvm-block-backend-prevent-dangling-BDS-pointers-across-a.patch
@ -0,0 +1,129 @@
+From bf4c15a3debbe68b6eb25c52174843470a9c014f Mon Sep 17 00:00:00 2001
+From: Stefan Hajnoczi <stefanha@redhat.com>
+Date: Tue, 11 Jan 2022 15:36:12 +0000
+Subject: [PATCH 3/6] block-backend: prevent dangling BDS pointers across
+ aio_poll()
+
+RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
+RH-MergeRequest: 109: block-backend: prevent dangling BDS pointers across aio_poll()
+RH-Commit: [1/2] da5a59eddff0dc10be7de8e291fa675143d11d73
+RH-Bugzilla: 2021778 2036178
+RH-Acked-by: Hanna Reitz <hreitz@redhat.com>
+RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
+
+The BlockBackend root child can change when aio_poll() is invoked. This
+happens when a temporary filter node is removed upon blockjob
+completion, for example.
+
+Functions in block/block-backend.c must be aware of this when using a
+blk_bs() pointer across aio_poll() because the BlockDriverState refcnt
+may reach 0, resulting in a stale pointer.
+
+One example is scsi_device_purge_requests(), which calls blk_drain() to
+wait for in-flight requests to cancel. If the backup blockjob is active,
+then the BlockBackend root child is a temporary filter BDS owned by the
+blockjob. The blockjob can complete during bdrv_drained_begin() and the
+last reference to the BDS is released when the temporary filter node is
+removed. This results in a use-after-free when blk_drain() calls
+bdrv_drained_end(bs) on the dangling pointer.
+
+Explicitly hold a reference to bs across block APIs that invoke
+aio_poll().
+
+Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2021778
+Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2036178
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Message-Id: <20220111153613.25453-2-stefanha@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit 1e3552dbd28359d35967b7c28dc86cde1bc29205)
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ block/block-backend.c | 19 +++++++++++++++++--
+ 1 file changed, 17 insertions(+), 2 deletions(-)
+
+diff --git a/block/block-backend.c b/block/block-backend.c
+index 12ef80ea17..23e727199b 100644
+--- a/block/block-backend.c
+++ b/block/block-backend.c
+@@ -822,16 +822,22 @@ BlockBackend *blk_by_public(BlockBackendPublic *public)
+ void blk_remove_bs(BlockBackend *blk)
+ {
+     ThrottleGroupMember *tgm = &blk->public.throttle_group_member;
+-    BlockDriverState *bs;
+     BdrvChild *root;
+ 
+     notifier_list_notify(&blk->remove_bs_notifiers, blk);
+     if (tgm->throttle_state) {
+-        bs = blk_bs(blk);
+        BlockDriverState *bs = blk_bs(blk);
+
+        /*
+         * Take a ref in case blk_bs() changes across bdrv_drained_begin(), for
+         * example, if a temporary filter node is removed by a blockjob.
+         */
+        bdrv_ref(bs);
+         bdrv_drained_begin(bs);
+         throttle_group_detach_aio_context(tgm);
+         throttle_group_attach_aio_context(tgm, qemu_get_aio_context());
+         bdrv_drained_end(bs);
+        bdrv_unref(bs);
+     }
+ 
+     blk_update_root_state(blk);
+@@ -1705,6 +1711,7 @@ void blk_drain(BlockBackend *blk)
+     BlockDriverState *bs = blk_bs(blk);
+ 
+     if (bs) {
+        bdrv_ref(bs);
+         bdrv_drained_begin(bs);
+     }
+ 
+@@ -1714,6 +1721,7 @@ void blk_drain(BlockBackend *blk)
+ 
+     if (bs) {
+         bdrv_drained_end(bs);
+        bdrv_unref(bs);
+     }
+ }
+ 
+@@ -2044,10 +2052,13 @@ static int blk_do_set_aio_context(BlockBackend *blk, AioContext *new_context,
+     int ret;
+ 
+     if (bs) {
+        bdrv_ref(bs);
+
+         if (update_root_node) {
+             ret = bdrv_child_try_set_aio_context(bs, new_context, blk->root,
+                                                  errp);
+             if (ret < 0) {
+                bdrv_unref(bs);
+                 return ret;
+             }
+         }
+@@ -2057,6 +2068,8 @@ static int blk_do_set_aio_context(BlockBackend *blk, AioContext *new_context,
+             throttle_group_attach_aio_context(tgm, new_context);
+             bdrv_drained_end(bs);
+         }
+
+        bdrv_unref(bs);
+     }
+ 
+     blk->ctx = new_context;
+@@ -2326,11 +2339,13 @@ void blk_io_limits_disable(BlockBackend *blk)
+     ThrottleGroupMember *tgm = &blk->public.throttle_group_member;
+     assert(tgm->throttle_state);
+     if (bs) {
+        bdrv_ref(bs);
+         bdrv_drained_begin(bs);
+     }
+     throttle_group_unregister_tgm(tgm);
+     if (bs) {
+         bdrv_drained_end(bs);
+        bdrv_unref(bs);
+     }
+ }
+ 
+-- 
+2.27.0
+
--- a/SOURCES/kvm-block-drop-bdrv_remove_filter_or_cow_child.patch
+++ b/SOURCES/kvm-block-drop-bdrv_remove_filter_or_cow_child.patch
@ -1,70 +0,0 @@
-From defd6b325264d94ffb1355a8b19f9a77bd694a2f Mon Sep 17 00:00:00 2001
-From: Vladimir Sementsov-Ogievskiy <vladimir.sementsov-ogievskiy@openvz.org>
-Date: Mon, 7 Nov 2022 19:35:56 +0300
-Subject: [PATCH 13/31] block: drop bdrv_remove_filter_or_cow_child
-
-RH-Author: Stefano Garzarella <sgarzare@redhat.com>
-RH-MergeRequest: 135: block: Simplify drain to prevent QEMU from crashing during snapshot
-RH-Bugzilla: 2155112
-RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Commit: [1/16] 6339edd738c3b79f8ecb6c1e012e52b6afb1a622 (sgarzarella/qemu-kvm-c-9-s)
-
-Drop this simple wrapper used only in one place. We have too many graph
-modifying functions even without it.
-
-Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@openvz.org>
-Reviewed-by: Hanna Reitz <hreitz@redhat.com>
-Message-Id: <20221107163558.618889-3-vsementsov@yandex-team.ru>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit f38eaec4c3618dfc4a23e20435cefb5bf8325264)
-Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
---
- block.c | 15 +--------------
- 1 file changed, 1 insertion(+), 14 deletions(-)
-
-diff --git a/block.c b/block.c
-index a18f052374..ec184150a2 100644
--- a/block.c
-+++ b/block.c
-@@ -93,8 +93,6 @@ static bool bdrv_recurse_has_child(BlockDriverState *bs,
- static void bdrv_replace_child_noperm(BdrvChild *child,
-                                       BlockDriverState *new_bs);
- static void bdrv_remove_child(BdrvChild *child, Transaction *tran);
-static void bdrv_remove_filter_or_cow_child(BlockDriverState *bs,
-                                            Transaction *tran);
- 
- static int bdrv_reopen_prepare(BDRVReopenState *reopen_state,
-                                BlockReopenQueue *queue,
-@@ -5073,17 +5071,6 @@ static void bdrv_remove_child(BdrvChild *child, Transaction *tran)
-     tran_add(tran, &bdrv_remove_child_drv, child);
- }
- 
-/*
- * A function to remove backing-chain child of @bs if exists: cow child for
- * format nodes (always .backing) and filter child for filters (may be .file or
- * .backing)
- */
-static void bdrv_remove_filter_or_cow_child(BlockDriverState *bs,
-                                            Transaction *tran)
-{
-    bdrv_remove_child(bdrv_filter_or_cow_child(bs), tran);
-}
-
- static int bdrv_replace_node_noperm(BlockDriverState *from,
-                                     BlockDriverState *to,
-                                     bool auto_skip, Transaction *tran,
-@@ -5168,7 +5155,7 @@ static int bdrv_replace_node_common(BlockDriverState *from,
-     }
- 
-     if (detach_subchain) {
-        bdrv_remove_filter_or_cow_child(to_cow_parent, tran);
-+        bdrv_remove_child(bdrv_filter_or_cow_child(to_cow_parent), tran);
-     }
- 
-     found = g_hash_table_new(NULL, NULL);
-- 
-2.31.1
-
--- a/Show More
+++ b/Show More
				`@ -0,0 +1 @@`
				`DEVPATH=="*/kvm", ACTION=="change", RUN+="/lib/udev/udev-kvm-check $env{COUNT} $env{EVENT}"`