.gitignore

@@ -1 +1,5 @@
-SOURCES/qemu-7.0.0.tar.xz
+SOURCES/qemu-6.2.0.tar.xz
+SOURCES/tests_data_acpi_pc_SSDT.dimmpxm
+SOURCES/tests_data_acpi_q35_FACP.slic
+SOURCES/tests_data_acpi_q35_SSDT.dimmpxm
+SOURCES/tests_data_acpi_virt_SSDT.memhp

.qemu-kvm.metadata

@@ -1 +1,5 @@
-c3fd2403106c33d0470bc9ba4fb4b946c0402248 SOURCES/qemu-7.0.0.tar.xz
+68cd61a466170115b88817e2d52db2cd7a92f43a SOURCES/qemu-6.2.0.tar.xz
+c4b34092bc5af1ba7febfca1477320fb024e8acd SOURCES/tests_data_acpi_pc_SSDT.dimmpxm
+19349e3517143bd1af56a5444e927ba37a111f72 SOURCES/tests_data_acpi_q35_FACP.slic
+4632d10ae8cedad4d5d760ed211f83f0dc81005d SOURCES/tests_data_acpi_q35_SSDT.dimmpxm
+ef12eed43cc357fb134db6fa3c7ffc83e222a97d SOURCES/tests_data_acpi_virt_SSDT.memhp

SOURCES/0004-Initial-redhat-build.patch

@@ -1,313 +0,0 @@
-From fc113ecd7c99646a7ced0b99570b5927ae6d595f Mon Sep 17 00:00:00 2001
-From: Miroslav Rezanina <mrezanin@redhat.com>
-Date: Wed, 26 May 2021 10:56:02 +0200
-Subject: Initial redhat build
-
-This patch introduces redhat build structure in redhat subdirectory. In addition,
-several issues are fixed in QEMU tree:
-
-- Change of app name for sasl_server_init in VNC code from qemu to qemu-kvm
- - As we use qemu-kvm as name in all places, this is updated to be consistent
-- Man page renamed from qemu to qemu-kvm
- - man page is installed using make install so we have to fix it in qemu tree
-
-We disable make check due to issues with some of the tests.
-
-This rebase is based on qemu-kvm-6.2.0-13.el9
-
-Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
---
-Rebase changes (6.1.0):
-- Move build to .distro
-- Move changes for support file to related commit
-- Added dependency for python3-sphinx-rtd_theme
-- Removed --disable-sheepdog configure option
-- Added new hw-display modules
-- SASL initialization moved to ui/vnc-auth-sasl.c
-- Add accel-qtest-<arch> and accel-tcg-x86_64 libraries
-- Added hw-usb-host module
-- Disable new configure options (bpf, nvmm, slirp-smbd)
-- Use -pie for ksmctl build (annocheck complain fix)
-
-Rebase changes (6.2.0):
-- removed --disable-jemalloc and --disable-tcmalloc configure options
-- added audio-oss.so
-- added fdt requirement for x86_64
-- tests/acceptance renamed to tests/avocado
-- added multiboot_dma.bin
-- Add -Wno-string-plus-int to extra flags
-- Updated configure options
-
-Rebase changes (7.0.0):
-- Do not use -mlittle CFLAG on ppc64le
-- Used upstream handling issue with ui/clipboard.c
-- Use -mlittle-endian on ppc64le instead of deleteing it in configure
-- Drop --disable-libxml2 option for configure (upstream)
-- Remove vof roms
-- Disable AVX2 support
-- Use internal meson
-- Disable new configure options (dbus-display and qga-vss)
-- Change permissions on installing tests/Makefile.include
-- Remove ssh block driver
-
-Merged patches (6.0.0):
- - 605758c902 Limit build on Power to qemu-img and qemu-ga only
-
-Merged patches (6.1.0):
-- f04f91751f Use cached tarballs
-- 6581165c65 Remove message with running VM count
-- 03c3cac9fc spec-file: build qemu-kvm without SPICE and QXL
-- e0ae6c1f6c spec-file: Obsolete qemu-kvm-ui-spice
-- 9d2e9f9ecf spec: Do not build qemu-kvm-block-gluster
-- cf470b4234 spec: Do not link pcnet and ne2k_pci roms
-- e981284a6b redhat: Install the s390-netboot.img that we've built
-- 24ef557f33 spec: Remove usage of Group: tag
-- c40d69b4f4 spec: Drop %defattr usage
-- f8e98798ce spec: Clean up BuildRequires
-- 47246b43ee spec: Remove iasl BuildRequires
-- 170dc1cbe0 spec: Remove redundant 0 in conditionals
-- 8718f6fa11 spec: Add more have_XXX conditionals
-- a001269ce9 spec: Remove binutils versioned Requires
-- 34545ee641 spec: Remove diffutils BuildRequires
-- c2c82beac9 spec: Remove redundant Requires:
-- 9314c231f4 spec: Add XXX_version macros
-- c43db0bf0f spec: Add have_block_rbd
-- 3ecb0c0319 qga: drop StandardError=syslog
-- 018049dc80 Remove iscsi support
-- a2edf18777 redhat: Replace the kvm-setup.service with a /etc/modules-load.d config file
-- 387b5fbcfe redhat: Move qemu-kvm-docs dependency to qemu-kvm
-- 4ead693178 redhat: introducting qemu-kvm-hw-usbredir
-- 4dc6fc3035 redhat: use the standard vhost-user JSON path
-- 84757178b4 Fix local build
-- 8c394227dd spec: Restrict block drivers in tools
-- b6aa7c1fae Move tools to separate package
-- eafd82e509 Split qemu-pr-helper to separate package
-- 2c0182e2aa spec: RPM_BUILD_ROOT -> %{buildroot}
-- 91bd55ca13 spec: More use of %{name} instead of 'qemu-kvm'
-- 50ba299c61 spec: Use qemu-pr-helper.service from qemu.git (partial)
-- ee08d4e0a3 spec: Use %{_sourcedir} for referencing sources
-- 039e7f7d02 spec: Add tools_only
-- 884ba71617 spec: %build: Add run_configure helper
-- 8ebd864d65 spec: %build: Disable more bits with %{disable_everything} (partial)
-- f23fdb53f5 spec: %build: Add macros for some 'configure' parameters
-- fe951a8bd8 spec: %files: Move qemu-guest-agent and qemu-img earlier
-- 353b632e37 spec: %install: Remove redundant bits
-- 9d2015b752 spec: %install: Add %{modprobe_kvm_conf} macro
-- 6d05134e8c spec: %install: Remove qemu-guest-agent /etc/qemu-kvm usage
-- 985b226467 spec: %install: clean up qemu-ga section
-- dfaf9c600d spec: %install: Use a single %{tools_only} section
-- f6978ddb46 spec: Make tools_only not cross spec sections
-- 071c211098 spec: %install: Limit time spent in %{qemu_kvm_build}
-- 1b65c674be spec: misc syntactic merges with Fedora
-- 4da16294cf spec: Use Fedora's pattern for specifying rc version
-- d7ee259a79 spec: %files: don't use fine grained -docs file list
-- 64cad0c60f spec: %files: Add licenses to qemu-common too
-- c3de4f080a spec: %install: Drop python3 shebang fixup
-- 46fc216115 Update local build to work with spec file improvements
-- bab9531548 spec: Remove buildldflags
-- c8360ab6a9 spec: Use %make_build macro
-- f6966c66e9 spec: Drop make install sharedir and datadir usage
-- 86982421bc spec: use %make_install macro
-- 191c405d22 spec: parallelize `make check`
-- 251a1fb958 spec: Drop explicit --build-id
-- 44c7dda6c3 spec: use %{build_ldflags}
-- 0009a34354 Move virtiofsd to separate package
--  34d1b200b3 Utilize --firmware configure option
-- 2800e1dd03 spec: Switch toolchain to Clang/LLVM (except process-patches.sh)
-- e8a70f500f spec: Use safe-stack for x86_64
-- e29445d50d spec: Reenable write support for VMDK etc. in tools
-- a4fe2a3e16 redhat: Disable LTO on non-x86 architectures
-
-Merged patches (6.2.0):
-- 333452440b remove sgabios dependency
-- 7d3633f184 enable pulseaudio
-- bd898709b0 spec: disable use of gcrypt for crypto backends in favour of gnutls
-- e4f0c6dee6 spec: Remove block-curl and block-ssh dependency
-- 4dc13bfe63 spec: Build the VDI block driver
-- d2f2ff3c74 spec: Explicitly include compress filter
-- a7d047f9c2 Move ksmtuned files to separate package
-
-Merged patches (7.0.0):
-- 098d4d08d0 spec: Rename qemu-kvm-hw-usbredir to qemu-kvm-device-usb-redirect
-- c2bd0d6834 spec: Split qemu-kvm-ui-opengl
-- 2c9cda805d spec: Introduce packages for virtio-gpu-* modules (changed as rhel device tree not set)
-- d0414a3e0b spec: Introduce device-display-virtio-vga* packages
-- 3534ec46d4 spec: Move usb-host module to separate package
-- ddc14d4737 spec: Move qtest accel module to tests package
-- 6f2c4befa6 spec: Extend qemu-kvm-core description
-- 6f11866e4e (rhel/rhel-9.0.0) Update to qemu-kvm-6.2.0-6.el9
-- da0a28758f ui/clipboard: fix use-after-free regression
-- 895d4d52eb spec: Remove qemu-virtiofsd
-- c8c8c8bd84 spec: Fix obsolete for spice subpackages
-- d46d2710b2 spec: Obsolete old usb redir subpackage
-- 6f52a50b68 spec: Obsolete ssh driver
-
-Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
----
- .distro/85-kvm.preset                   |    5 -
- .distro/Makefile                        |  100 +
- .distro/Makefile.common                 |   40 +
- .distro/README.tests                    |   39 +
- .distro/ksm.service                     |   13 -
- .distro/ksm.sysconfig                   |    4 -
- .distro/ksmctl.c                        |   77 -
- .distro/ksmtuned                        |  139 -
- .distro/ksmtuned.conf                   |   21 -
- .distro/ksmtuned.service                |   12 -
- .distro/kvm-setup                       |   49 -
- .distro/kvm-setup.service               |   14 -
- .distro/modules-load.conf               |    4 +
- .distro/qemu-guest-agent.service        |    1 -
- .distro/qemu-kvm.spec.template          | 4034 +++++++++++++++++++++++
- .distro/rpminspect.yaml                 |    6 +-
- .distro/scripts/extract_build_cmd.py    |   12 +
- .gitignore                              |    1 +
- README.systemtap                        |   43 +
- meson.build                             |    4 +-
- scripts/qemu-guest-agent/fsfreeze-hook  |    2 +-
- scripts/systemtap/conf.d/qemu_kvm.conf  |    4 +
- scripts/systemtap/script.d/qemu_kvm.stp |    1 +
- tests/check-block.sh                    |    2 +
- ui/vnc-auth-sasl.c                      |    2 +-
- 25 files changed, 4290 insertions(+), 339 deletions(-)
- delete mode 100644 .distro/85-kvm.preset
- create mode 100644 .distro/Makefile
- create mode 100644 .distro/Makefile.common
- create mode 100644 .distro/README.tests
- delete mode 100644 .distro/ksm.service
- delete mode 100644 .distro/ksm.sysconfig
- delete mode 100644 .distro/ksmctl.c
- delete mode 100644 .distro/ksmtuned
- delete mode 100644 .distro/ksmtuned.conf
- delete mode 100644 .distro/ksmtuned.service
- delete mode 100644 .distro/kvm-setup
- delete mode 100644 .distro/kvm-setup.service
- create mode 100644 .distro/modules-load.conf
- create mode 100644 .distro/qemu-kvm.spec.template
- create mode 100644 README.systemtap
- create mode 100644 scripts/systemtap/conf.d/qemu_kvm.conf
- create mode 100644 scripts/systemtap/script.d/qemu_kvm.stp
-
-diff --git a/README.systemtap b/README.systemtap
-new file mode 100644
-index 0000000000..ad913fc990
---- /dev/null
-+++ b/README.systemtap
-@@ -0,0 +1,43 @@
-+QEMU tracing using systemtap-initscript
-+---------------------------------------
-+
-+You can capture QEMU trace data all the time using systemtap-initscript.  This
-+uses SystemTap's flight recorder mode to trace all running guests to a
-+fixed-size buffer on the host.  Old trace entries are overwritten by new
-+entries when the buffer size wraps.
-+
-+1. Install the systemtap-initscript package:
-+  # yum install systemtap-initscript
-+
-+2. Install the systemtap scripts and the conf file:
-+  # cp /usr/share/qemu-kvm/systemtap/script.d/qemu_kvm.stp /etc/systemtap/script.d/
-+  # cp /usr/share/qemu-kvm/systemtap/conf.d/qemu_kvm.conf /etc/systemtap/conf.d/
-+
-+The set of trace events to enable is given in qemu_kvm.stp.  This SystemTap
-+script can be customized to add or remove trace events provided in
-+/usr/share/systemtap/tapset/qemu-kvm-simpletrace.stp.
-+
-+SystemTap customizations can be made to qemu_kvm.conf to control the flight
-+recorder buffer size and whether to store traces in memory only or disk too.
-+See stap(1) for option documentation.
-+
-+3. Start the systemtap service.
-+　# service systemtap start qemu_kvm
-+
-+4. Make the service start at boot time.
-+　# chkconfig systemtap on
-+
-+5. Confirm that the service works.
-+  # service systemtap status qemu_kvm
-+  qemu_kvm is running...
-+
-+When you want to inspect the trace buffer, perform the following steps:
-+
-+1. Dump the trace buffer.
-+  # staprun -A qemu_kvm >/tmp/trace.log
-+
-+2. Start the systemtap service because the preceding step stops the service.
-+  # service systemtap start qemu_kvm
-+
-+3. Translate the trace record to readable format.
-+  # /usr/share/qemu-kvm/simpletrace.py --no-header /usr/share/qemu-kvm/trace-events /tmp/trace.log
-diff --git a/meson.build b/meson.build
-index 861de93c4f..6f7e430f0f 100644
---- a/meson.build
-+++ b/meson.build
-@@ -2394,7 +2394,9 @@ if capstone_opt == 'internal'
-     # Include all configuration defines via a header file, which will wind up
-     # as a dependency on the object file, and thus changes here will result
-     # in a rebuild.
--    '-include', 'capstone-defs.h'
-+    '-include', 'capstone-defs.h',
-+
-+    '-Wp,-D_GLIBCXX_ASSERTIONS',
-   ]
- 
-   libcapstone = static_library('capstone',
-diff --git a/scripts/qemu-guest-agent/fsfreeze-hook b/scripts/qemu-guest-agent/fsfreeze-hook
-index 13aafd4845..e9b84ec028 100755
---- a/scripts/qemu-guest-agent/fsfreeze-hook
-+++ b/scripts/qemu-guest-agent/fsfreeze-hook
-@@ -8,7 +8,7 @@
- # request, it is issued with "thaw" argument after filesystem is thawed.
- 
- LOGFILE=/var/log/qga-fsfreeze-hook.log
--FSFREEZE_D=$(dirname -- "$0")/fsfreeze-hook.d
-+FSFREEZE_D=$(dirname -- "$(realpath $0)")/fsfreeze-hook.d
- 
- # Check whether file $1 is a backup or rpm-generated file and should be ignored
- is_ignored_file() {
-diff --git a/scripts/systemtap/conf.d/qemu_kvm.conf b/scripts/systemtap/conf.d/qemu_kvm.conf
-new file mode 100644
-index 0000000000..372d8160a4
---- /dev/null
-+++ b/scripts/systemtap/conf.d/qemu_kvm.conf
-@@ -0,0 +1,4 @@
-+# Force load uprobes (see BZ#1118352)
-+stap -e 'probe process("/usr/libexec/qemu-kvm").function("main") { printf("") }' -c true
-+
-+qemu_kvm_OPT="-s4" # per-CPU buffer size, in megabytes
-diff --git a/scripts/systemtap/script.d/qemu_kvm.stp b/scripts/systemtap/script.d/qemu_kvm.stp
-new file mode 100644
-index 0000000000..c04abf9449
---- /dev/null
-+++ b/scripts/systemtap/script.d/qemu_kvm.stp
-@@ -0,0 +1 @@
-+probe qemu.kvm.simpletrace.handle_qmp_command,qemu.kvm.simpletrace.monitor_protocol_*,qemu.kvm.simpletrace.migrate_set_state {}
-diff --git a/tests/check-block.sh b/tests/check-block.sh
-index f59496396c..d900d8b35e 100755
---- a/tests/check-block.sh
-+++ b/tests/check-block.sh
-@@ -48,6 +48,8 @@ if LANG=C bash --version | grep -q 'GNU bash, version [123]' ; then
-     skip "bash version too old ==> Not running the qemu-iotests."
- fi
- 
-+exit 0
-+
- cd tests/qemu-iotests
- 
- # QEMU_CHECK_BLOCK_AUTO is used to disable some unstable sub-tests
-diff --git a/ui/vnc-auth-sasl.c b/ui/vnc-auth-sasl.c
-index 47fdae5b21..2a950caa2a 100644
---- a/ui/vnc-auth-sasl.c
-+++ b/ui/vnc-auth-sasl.c
-@@ -42,7 +42,7 @@
- 
- bool vnc_sasl_server_init(Error **errp)
- {
--    int saslErr = sasl_server_init(NULL, "qemu");
-+    int saslErr = sasl_server_init(NULL, "qemu-kvm");
- 
-     if (saslErr != SASL_OK) {
-         error_setg(errp, "Failed to initialize SASL auth: %s",
--- 
-2.31.1
-

SOURCES/0005-Initial-redhat-build.patch

@@ -0,0 +1,351 @@
+From 19ce5ff93ddd6b8a998348f2a5f59f603c5e11b7 Mon Sep 17 00:00:00 2001
+From: Miroslav Rezanina <mrezanin@redhat.com>
+Date: Fri, 12 Oct 2018 07:31:11 +0200
+Subject: Initial redhat build
+
+This patch introduces redhat build structure in redhat subdirectory. In addition,
+several issues are fixed in QEMU tree:
+
+ - Change of app name for sasl_server_init in VNC code from qemu to qemu-kvm
+  - As we use qemu-kvm as name in all places, this is updated to be consistent
+ - Man page renamed from qemu to qemu-kvm
+  - man page is installed using make install so we have to fix it in qemu tree
+
+This rebase includes changes up to qemu-kvm-6.1.0-5.el9
+
+Rebase notes (3.1.0):
+- added new configure options
+
+Rebase notes (4.0.0):
+- Added dependency to perl-Test-Harness (upstream)
+- Added dependency to python3-sphinx (upstream)
+- Change location of icons (upstream)
+- Remove .desktop file (added upstream)
+- Added qemu-trace-stap (added upstream)
+- Removed elf2dmp (added upstream)
+- Remove .buildinfo
+- Added pvh.bin rom (added upstream)
+- Added interop documentation files
+- Use python module instead of qemu.py (upstream)
+
+Rebase notes (4.1.0):
+- Remove edk2 files generated by build
+- Switch to rhel-8.1-candidate build target
+- Remove specs documentation
+- Switched from libssh2 to libssh
+- Add rc0 tarball usage hacks
+- Added BuildRequires for wget, rpm-build and python3-sphinx
+- Removed new unpacked files
+- Update configure line to use new options
+
+Rebase notes (4.2.0):
+- Disable iotest run during make check
+- README renamed to README.rst (upstream)
+- Removed ui-spice-app.so
+- Added relevant changes from "505f7f4 redhat: Adding slirp to the exploded tree"
+- Removed qemu-ga.8 install from spec file - installed by make
+- Removed spapr-rtas.bin (upstream)
+- Require newer SLOF (20191022)
+
+Rebase notes (5.1.0):
+- Use python3 for virtio_seg_max_adjust.py test
+- Removed qemu-trace-stap shebang from spec file
+- Added virtiofsd.1 (upstream)
+- Use out-of-tree build
+- New documentation structure (upstream)
+- Update local build
+- Removing installed qemu-storage-daemon (added upstream)
+- Removing opensbi-riscv32-sifive_u-fw_jump.bin (added upstream)
+- Disable iotests (moved from Enable make check commit)
+- Added missing configure options
+- Reorder configure options
+- qemu-pr-helper moved to /usr/libexec/ (upstream)
+- Added submodules for usb-redir, smartcard-reader and qxl display (upstream)
+- Added setting rc version in Makefile for build
+- removed --disable-vxhs configure option (removed upstream)
+- bumped required libusbx-devel version to 1.0.23
+- bumped libfdt version to 1.6.0
+
+Rebase notes (5.2.0 rc0):
+- Move libfdt dependency to qemu-kvm-core
+- Move manpage rename from Makefile to spec file
+- rename with-confsuffix configure option to with-suffix (upstream)
+- Bump libusbx Requires version to 1.0.234
+- Manual copy of keymaps in spec file (BZ 1875217)
+- Removed /usr/share/qemu-kvm/npcm7xx_bootrom.bin, considering it
+  unpackaged for now.
+- Removed /usr/share/qemu-kvm/qboot.rom, considering unpackaged.
+- Added build dependency for meson and ninja-build
+- hw/s390/s390-pci-vfio.c hack - set NULL for g_autofree variables
+- Removed Chanelog (upstream)
+- Fix in directory used for docs (upstream add %name so we do not pass it in configure)
+- Package various .so as part of qemu-kvm-core package.
+
+Rebase notes (5.2.0 rc2):
+- Added fix for dtrace build on RHEL 8.4.0
+
+Rebase notes (5.2.0 rc3):
+- Added man page for qemu-pr-helper
+- Added new configure options
+- Update qemu-kiwi patches to v4
+
+Rebase notes (6.0.0):
+- update tracetool usage in spec file
+- remove qemu-storage-daemon-qmp-ref man page
+- remove qemu-storage-daemon man page
+- Added devel documentation
+- do not package virtfs-proxy-helper files
+- Use --with-git-submodules instead of --(enable|disable)-git-update
+- Minor build fixes for sending upstream
+- g_autofree initialization fixed upstream
+- Updated rc information usage
+- do not package package hw-s390x-virtio-gpu-ccw.so
+- Disable new switch options
+
+Rebase notes (6.1.0):
+- Fix warning issue in block.c
+- Download tarball from dist-git cache
+- Removed sheepdog driver
+- Added new display modules:
+  - hw-display-virtio-gpu-gl.so
+  - hw-display-virtio-gpu-pci-gl.so
+  - hw-display-virtio-vga-gl.so
+- sasl fix moved from ui/vnc.c to ui/vnc-auth-sasl.c
+- Added accel-qtest-%{kvm_target} and accel-tcg-%{kvm_target}
+- Added about docs
+- Use -q option for setup
+- Added hw-usb-host.so
+- Disable new options (bpf, nvmm, slirp-smbd)
+
+Rebase notes (6.2.0):
+- Using internal meson
+- removed --disable-jemalloc and --disable-tcmalloc configure options
+- added audio-oss.so
+- added fdt requirement for x86_64
+- tests/acceptance renamed to tests/avocado
+- added multiboot_dma.bin
+- Removed conflict relics
+- Updated configure options
+
+Merged patches (3.1.0):
+- 01f0c9f RHEL8: Add disable configure options to qemu spec file
+- Spec file cleanups
+
+Merged patches (4.0.0):
+- aa4297c Add edk2 Requires to qemu-kvm
+- d124ff5779 Fixing brew build target
+- eb204b5 Introduce the qemu-kvm-tests rpm
+- 223cf0c Load kvm module during boot (partial)
+
+Merged patches (4.1.0):
+- ebb6e97 redhat: Fix LOCALVERSION creation
+- b0ab0cc redhat: enable tpmdev passthrough (not disabling tests)
+- 7cb3c4a Enable libpmem to support nvdimm
+- 8943607 qemu-kvm.spec: bump libseccomp >= 2.4.0
+- 27b7c44 rh: set CONFIG_BOCHS_DISPLAY=y for x86 (partial)
+- e1fe9fe x86_64-rh-devices: enable TPM emulation (partial)
+
+Merged patches (4.2.0):
+- 69e1fb2 enable virgla
+- d4f6115 enable virgl, for real this time ...
+
+Merged patches (5.1.0):
+- 5edf6bd Add support for rh-brew-module
+- f77d52d redhat: ship virtiofsd vhost-user device backend
+- 63f12d4 redhat: Always use module build target for rh-brew (modified)
+- 9b1e140 redhat: updating the modular target
+- 44b8bd0 spec: Fix python shenigans for tests
+
+Merged patches (5.2.0 rc0):
+- 9238ce7 Add support for simpletrace
+- 5797cff Remove explicit glusterfs-api dependency
+- fd62478 disable virgl
+- 0205018 redhat: link /etc/qemu-ga/fsfreeze-hook to /etc/qemu-kvm/
+- 3645097 redhat: Make all generated so files executable (not only block-*)
+
+Merged patches (5.2.0 rc2):
+- pjw 99657 redhat: introduces disable_everything macro into the configure call
+- pjw 99659 redhat: scripts/extract_build_cmd.py - Avoid listing empty lines
+- pjw 99658 redhat: Fixing rh-local build
+- pjw 99660 redhat: Add qemu-kiwi subpackage
+- d2e59ce redhat: add (un/pre)install systemd hooks for qemu-ga
+
+Merged patches (5.2.0 rc3):
+- pjw 99887 - redhat: allow Makefile rh-prep builddep to fail
+- pjw 99885 - redhat: adding rh-rpm target
+
+Merged patches (6.0.0):
+- 5ab9954a3b spec: find system python via meson
+- cd0f7db11f build-system: use b_staticpic=false
+- 80d2dec42c udev-kvm-check: remove the "exceeded subscription limit" message
+- 38959d51c0 redhat: Allow make to inherit params from parent make for rh-local
+- 1e0cfe458f redhat: moving all documentation files to qemu-kvm-docs
+- d7a594d02b redhat: makes qemu respect system's crypto profile
+- e2bbf1572b spec: Package qemu-storage-daemon
+- 92f10993ba spec: ui-spice sub-package
+- 8931e46069 spec: ui-opengl sub-package
+
+Merged patches (6.1.0):
+- 7bb57541b3 redhat: Install the s390-netboot.img that we've built
+- b4a8531f41 redhat: Fix "unversioned Obsoletes" warning
+- 141a1693c7 redhat: Move qemu-kvm-docs dependency to qemu-kvm
+- d75f59c6f9 redhat: introducting qemu-kvm-hw-usbredir
+- a934d8bf44 redhat: use the standard vhost-user JSON path
+
+Merged patches (6.2.0):
+- 4f3f04bbb6 spec: Remove qemu-kiwi build
+---
+ .gitignore                                 |    1 +
+ .gitlab-ci.yml                             |   24 -
+ .gitlab/issue_templates/bug.md             |   64 -
+ .gitlab/issue_templates/feature_request.md |   32 -
+ README.systemtap                           |   43 +
+ meson.build                                |    4 +-
+ redhat/Makefile                            |   90 +
+ redhat/Makefile.common                     |   48 +
+ redhat/README.tests                        |   39 +
+ redhat/qemu-kvm.spec.template              | 3896 ++++++++++++++++++++
+ redhat/scripts/extract_build_cmd.py        |    5 +-
+ redhat/scripts/process-patches.sh          |   20 +-
+ redhat/scripts/tarball_checksum.sh         |    2 +-
+ redhat/udev-kvm-check.c                    |   19 +-
+ scripts/qemu-guest-agent/fsfreeze-hook     |    2 +-
+ scripts/systemtap/conf.d/qemu_kvm.conf     |    4 +
+ scripts/systemtap/script.d/qemu_kvm.stp    |    1 +
+ tests/check-block.sh                       |    2 +
+ ui/vnc-auth-sasl.c                         |    2 +-
+ 19 files changed, 4142 insertions(+), 156 deletions(-)
+ delete mode 100644 .gitlab-ci.yml
+ delete mode 100644 .gitlab/issue_templates/bug.md
+ delete mode 100644 .gitlab/issue_templates/feature_request.md
+ create mode 100644 README.systemtap
+ create mode 100644 redhat/Makefile
+ create mode 100644 redhat/Makefile.common
+ create mode 100644 redhat/README.tests
+ create mode 100644 redhat/qemu-kvm.spec.template
+ create mode 100644 scripts/systemtap/conf.d/qemu_kvm.conf
+ create mode 100644 scripts/systemtap/script.d/qemu_kvm.stp
+
+diff --git a/README.systemtap b/README.systemtap
+new file mode 100644
+index 0000000000..ad913fc990
+--- /dev/null
++++ b/README.systemtap
+@@ -0,0 +1,43 @@
++QEMU tracing using systemtap-initscript
++---------------------------------------
++
++You can capture QEMU trace data all the time using systemtap-initscript.  This
++uses SystemTap's flight recorder mode to trace all running guests to a
++fixed-size buffer on the host.  Old trace entries are overwritten by new
++entries when the buffer size wraps.
++
++1. Install the systemtap-initscript package:
++  # yum install systemtap-initscript
++
++2. Install the systemtap scripts and the conf file:
++  # cp /usr/share/qemu-kvm/systemtap/script.d/qemu_kvm.stp /etc/systemtap/script.d/
++  # cp /usr/share/qemu-kvm/systemtap/conf.d/qemu_kvm.conf /etc/systemtap/conf.d/
++
++The set of trace events to enable is given in qemu_kvm.stp.  This SystemTap
++script can be customized to add or remove trace events provided in
++/usr/share/systemtap/tapset/qemu-kvm-simpletrace.stp.
++
++SystemTap customizations can be made to qemu_kvm.conf to control the flight
++recorder buffer size and whether to store traces in memory only or disk too.
++See stap(1) for option documentation.
++
++3. Start the systemtap service.
++　# service systemtap start qemu_kvm
++
++4. Make the service start at boot time.
++　# chkconfig systemtap on
++
++5. Confirm that the service works.
++  # service systemtap status qemu_kvm
++  qemu_kvm is running...
++
++When you want to inspect the trace buffer, perform the following steps:
++
++1. Dump the trace buffer.
++  # staprun -A qemu_kvm >/tmp/trace.log
++
++2. Start the systemtap service because the preceding step stops the service.
++  # service systemtap start qemu_kvm
++
++3. Translate the trace record to readable format.
++  # /usr/share/qemu-kvm/simpletrace.py --no-header /usr/share/qemu-kvm/trace-events /tmp/trace.log
+diff --git a/meson.build b/meson.build
+index 96de1a6ef9..5f6ba86dbb 100644
+--- a/meson.build
++++ b/meson.build
+@@ -2108,7 +2108,9 @@ if capstone_opt == 'internal'
+     # Include all configuration defines via a header file, which will wind up
+     # as a dependency on the object file, and thus changes here will result
+     # in a rebuild.
+-    '-include', 'capstone-defs.h'
++    '-include', 'capstone-defs.h',
++
++    '-Wp,-D_GLIBCXX_ASSERTIONS',
+   ]
+ 
+   libcapstone = static_library('capstone',
+diff --git a/scripts/qemu-guest-agent/fsfreeze-hook b/scripts/qemu-guest-agent/fsfreeze-hook
+index 13aafd4845..e9b84ec028 100755
+--- a/scripts/qemu-guest-agent/fsfreeze-hook
++++ b/scripts/qemu-guest-agent/fsfreeze-hook
+@@ -8,7 +8,7 @@
+ # request, it is issued with "thaw" argument after filesystem is thawed.
+ 
+ LOGFILE=/var/log/qga-fsfreeze-hook.log
+-FSFREEZE_D=$(dirname -- "$0")/fsfreeze-hook.d
++FSFREEZE_D=$(dirname -- "$(realpath $0)")/fsfreeze-hook.d
+ 
+ # Check whether file $1 is a backup or rpm-generated file and should be ignored
+ is_ignored_file() {
+diff --git a/scripts/systemtap/conf.d/qemu_kvm.conf b/scripts/systemtap/conf.d/qemu_kvm.conf
+new file mode 100644
+index 0000000000..372d8160a4
+--- /dev/null
++++ b/scripts/systemtap/conf.d/qemu_kvm.conf
+@@ -0,0 +1,4 @@
++# Force load uprobes (see BZ#1118352)
++stap -e 'probe process("/usr/libexec/qemu-kvm").function("main") { printf("") }' -c true
++
++qemu_kvm_OPT="-s4" # per-CPU buffer size, in megabytes
+diff --git a/scripts/systemtap/script.d/qemu_kvm.stp b/scripts/systemtap/script.d/qemu_kvm.stp
+new file mode 100644
+index 0000000000..c04abf9449
+--- /dev/null
++++ b/scripts/systemtap/script.d/qemu_kvm.stp
+@@ -0,0 +1 @@
++probe qemu.kvm.simpletrace.handle_qmp_command,qemu.kvm.simpletrace.monitor_protocol_*,qemu.kvm.simpletrace.migrate_set_state {}
+diff --git a/tests/check-block.sh b/tests/check-block.sh
+index f86cb863de..6d38340d49 100755
+--- a/tests/check-block.sh
++++ b/tests/check-block.sh
+@@ -69,6 +69,8 @@ else
+     fi
+ fi
+ 
++exit 0
++
+ cd tests/qemu-iotests
+ 
+ # QEMU_CHECK_BLOCK_AUTO is used to disable some unstable sub-tests
+diff --git a/ui/vnc-auth-sasl.c b/ui/vnc-auth-sasl.c
+index 47fdae5b21..2a950caa2a 100644
+--- a/ui/vnc-auth-sasl.c
++++ b/ui/vnc-auth-sasl.c
+@@ -42,7 +42,7 @@
+ 
+ bool vnc_sasl_server_init(Error **errp)
+ {
+-    int saslErr = sasl_server_init(NULL, "qemu");
++    int saslErr = sasl_server_init(NULL, "qemu-kvm");
+ 
+     if (saslErr != SASL_OK) {
+         error_setg(errp, "Failed to initialize SASL auth: %s",
+-- 
+2.27.0
+

SOURCES/0006-Enable-disable-devices-for-RHEL.patch

@@ -1,80 +1,170 @@
-From 51ec7495d69fe4b4d0b61642ca6c0e7fd7a1032d Mon Sep 17 00:00:00 2001
+From 3d5a82d172345d17e300672909835262ff9dc917 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
-Date: Thu, 15 Jul 2021 03:22:36 -0400
+Date: Wed, 2 Sep 2020 09:11:07 +0200
 Subject: Enable/disable devices for RHEL
 
 This commit adds all changes related to changes in supported devices.
 
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
---
-Rebase notes (6.1.0):
-- Added CONFIG_TPM (except s390x)
-- default-configs moved to configs
-- Use --with-device-<ARCH> configure option to use rhel configs
 
-Rebase notes (6.2.0):
-- Add CONFIG_ISA_FDC
+Rebase notes (qemu 3.1.0)
+- spapr_rng disabled in default_config
+- new hyperv.mak in default configs
+- Move changes from x86_64-softmmu.mak to i386-softmmu.mak
+- Added CONFIG_VIRTIO_MMIO to aarch64-softmmu.mak
+- Removed config_vga_isa.c changes as no longer needed
+- Removed new devices
+
+Rebase notes (4.0.0):
+- Added CONFIG_PCI_EXPRESS_GENERIC_BRIDGE for aarch64-softmmu.mak
+- Added CONFIG_ARM_VIRT for aarch64-softmmu.mak
+- Switch to KConfig (upstream)
+ - Using device whitelist + without-defualt-devices option
+
+Rebase notes (4.1.0):
+- Added CONFIG_USB_OHCI_PCI for ppc64
+- Added CONFIG_XIVE_KVM for ppc64
+- Added CONFIG_ACPI_PCI for x86_64
+- Added CONFIG_SEMIHOSTING for aarch64
+- Cleanup aarch64 devices
+- Do not build a15mpcore.c
+- Removed ide-isa.c stub file
+- Use CONFIG_USB_EHCI_PCI on x86_64 (new upstream)
+
+Rebase notes (4.2.0-rc0):
+- Use conditional build for isa-superio.c (upstream change)
+- Rename PCI_PIIX to PCI_I440FX (upstream change)
+
+Rebase notes (4.2.0-rc3):
+- Disabled ccid-card-emulated (patch 92566)
+- Disabled vfio-pci-igd-lpc-bridge (patch 92565)
+
+Rebase notes (5.1.0):
+- added CONFIG_PCI_EXPRESS on ppc64 (due to upstream dependency)
+- Added CONFIG_NVDIMM
+- updated cortex-15 disabling to upstream code
+- Add CONFIG_ACPI_APEI for aarch64
+- removed obsolete hw/bt/Makefile.objs chunk
+- removed unnecessary changes in target/i386/cpu.c
+
+Rebase notes (5.2.0 rc0):
+- Added CONFIG_USB_XHCI_PCI on aarch64 ppc64 and x86_64
+- remove vl.c hack for no hpet
+- Enable CONFIG_PTIMER for aarch64
+- Do not package hw-display-virtio-gpu.so on s390x
+
+Rebase notes (5.2.0 rc1):
+- Added CONFIG_ARM_GIC for aarch64 (required for build)
+
+Rebase notes (weekly-210113):
+- Removed XICS_KVM, XICS_SPAPR, XIVE_KVM and XIVE_SPAPR config (removed upstream)
+
+Rebase notes (weekly-210120):
+- Add CONFIG_ARM_COMPATIBLE_SEMIHOSTING option
+
+Rebase notes (weekly-210203):
+- Rename CONFIG_PVPANIC to CONFIG_PVPANIC_ISA
+
+Rebase notes (weekly-210317):
+- Add new USB_STORAGE_CORE and USB_STORAGE_CLASSIC config for ppc64 and x86_64
+- Update disabling TCG cpus for AArch64
+
+Rebase notes (weekly-210519):
+- Do not use CONFIG_SPICE and CONFIG_OPENGL in default configs
+
+Rebase notes (weekly-210623):
+- Add CONFIG_TPM for archs with used TPM functionality
+
+Rebase notes (weekly-210714):
+- default_configs moved to configs
+
+Rebase notes (6.1.0 rc2):
+- Use --with-device-ARCH configure option to use redhat config files
+
+Rebase notes (6.2.0 rc3):
 - Do not remove -no-hpet documentation
+Merged patches (qemu 3.1.0):
+- d51e082 Re-enable CONFIG_HYPERV_TESTDEV
+- 4b889f3 Declare cirrus-vga as deprecated
+- b579d32 Do not build bluetooth support
+- 3eef52a Disable CONFIG_IPMI and CONFIG_I2C for ppc64
+- 9caf292 Disable CONFIG_CAN_BUS and CONFIG_CAN_SJA1000
 
-Rebase notes (7.0.0):
-- Added CONFIG_ARM_GIC_TCG option for aarch64
-- Fixes necessary for layout change fixes
-- Renamed CONFIG_ARM_GIC_TCG to CONFIG_ARM_GICV3_TCG
-- Removed upstream devices
+Merged patches (4.1.0):
+- 20a51f6 fdc: Revert downstream disablement of device "floppy"
+- f869cc0 fdc: Restrict floppy controllers to RHEL-7 machine types
+- 5909721 aarch64: Compile out IOH3420
+- 27b7c44 rh: set CONFIG_BOCHS_DISPLAY=y for x86 (partial)
+- 495a27d x86_64-rh-devices: add missing TPM passthrough
+- e1fe9fe x86_64-rh-devices: enable TPM emulation (partial)
 
-Merged patches (6.1.0):
-- c51bf45304 Remove SPICE and QXL from x86_64-rh-devices.mak
-- 02fc745601 aarch64-rh-devices: add CONFIG_PVPANIC_PCI
-- f2fe835153 aarch64-rh-devices: add CONFIG_PXB
-- b5431733ad disable CONFIG_USB_STORAGE_BOT
-- 478ba0cdf6 Disable TPM passthrough
-- 2504d68a7c aarch64: Add USB storage devices
-- 51c2a3253c disable ac97 audio
+Merged patches (4.2.0):
+- f7587dd RHEL: disable hostmem-memfd
 
-Merged patches (6.2.0):
-- 9f2f9fa2ba disable sga device
+Merged patches (5.1.0):
+- 4543a3c i386: Remove cpu64-rhel6 CPU model
+- 96533 aarch64: Remove tcg cpu types (pjw commit)
+- 559d589 Revert "RHEL: disable hostmem-memfd"
+- 441128e enable ramfb
 
-Merged patches (7.0.0):
-- fd7c45a5a8 redhat: Enable virtio-mem as tech-preview on x86-64
-- c9e68ea451 Enable SGX -- RH Only
+Merged patches (5.2.0 rc0):
+- f70eb50 RHEL-only: Enable vTPM for POWER in downstream configs
+- 69d8ae7 redhat: fix 5.0 rebase missing ISA TPM TIS
+- 8310f89 RHEL-only: Enable vTPM for ARM in downstream configs
+- 4a8ccfd Disable TPM passthrough backend on ARM
+
+Merged patches (6.0.0):
+- ff817df9e3 config: enable VFIO_CCW
+- 70d3924521 redhat: Add some devices for exporting upstream machine types
+ - without machine type chunks
+- efac91b2b4 default-configs: Enable vhost-user-blk
+
+Merged patches (weekly-210630):
+- 59a178acff disable CONFIG_USB_STORAGE_BOT
+
+Merged patches (6.1.0 rc2):
+- 86f0025f16 aarch64: Add USB storage devices
 ---
- .distro/qemu-kvm.spec.template                |  18 +--
- .../aarch64-softmmu/aarch64-rh-devices.mak    |  34 ++++++
- .../ppc64-softmmu/ppc64-rh-devices.mak        |  35 ++++++
+ .../aarch64-softmmu/aarch64-rh-devices.mak    |  31 ++++++
+ .../ppc64-softmmu/ppc64-rh-devices.mak        |  36 ++++++
  configs/devices/rh-virtio.mak                 |  10 ++
- .../s390x-softmmu/s390x-rh-devices.mak        |  15 +++
- .../x86_64-softmmu/x86_64-rh-devices.mak      | 103 ++++++++++++++++++
+ .../s390x-softmmu/s390x-rh-devices.mak        |  16 +++
+ .../x86_64-softmmu/x86_64-rh-devices.mak      | 104 ++++++++++++++++++
+ .../x86_64-upstream-devices.mak               |   4 +
  hw/acpi/ich9.c                                |   4 +-
  hw/arm/meson.build                            |   2 +-
  hw/block/fdc.c                                |  10 ++
+ hw/char/parallel.c                            |   9 ++
  hw/cpu/meson.build                            |   5 +-
- hw/display/cirrus_vga.c                       |   5 +-
+ hw/display/cirrus_vga.c                       |   3 +
  hw/ide/piix.c                                 |   5 +-
  hw/input/pckbd.c                              |   2 +
  hw/net/e1000.c                                |   2 +
  hw/ppc/spapr_cpu_core.c                       |   2 +
+ hw/timer/hpet.c                               |   8 ++
  hw/usb/meson.build                            |   2 +-
+ redhat/qemu-kvm.spec.template                 |   9 +-
  target/arm/cpu_tcg.c                          |  10 ++
- target/ppc/cpu-models.c                       |   9 ++
+ target/ppc/cpu-models.c                       |  10 ++
  target/s390x/cpu_models_sysemu.c              |   3 +
  target/s390x/kvm/kvm.c                        |   8 ++
- 20 files changed, 269 insertions(+), 15 deletions(-)
+ 23 files changed, 286 insertions(+), 9 deletions(-)
  create mode 100644 configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
  create mode 100644 configs/devices/ppc64-softmmu/ppc64-rh-devices.mak
  create mode 100644 configs/devices/rh-virtio.mak
  create mode 100644 configs/devices/s390x-softmmu/s390x-rh-devices.mak
  create mode 100644 configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
+ create mode 100644 configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak
 
 diff --git a/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak b/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
 new file mode 100644
-index 0000000000..5f6ee1de5b
+index 0000000000..0d4f9e6e4b
 --- /dev/null
 +++ b/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
-@@ -0,0 +1,34 @@
+@@ -0,0 +1,31 @@
 +include ../rh-virtio.mak
 +
 +CONFIG_ARM_GIC_KVM=y
-+CONFIG_ARM_GICV3_TCG=y
 +CONFIG_ARM_GIC=y
 +CONFIG_ARM_SMMUV3=y
 +CONFIG_ARM_V7M=y
@@ -103,14 +193,12 @@ index 0000000000..5f6ee1de5b
 +CONFIG_TPM_TIS_SYSBUS=y
 +CONFIG_PTIMER=y
 +CONFIG_ARM_COMPATIBLE_SEMIHOSTING=y
-+CONFIG_PVPANIC_PCI=y
-+CONFIG_PXB=y
 diff --git a/configs/devices/ppc64-softmmu/ppc64-rh-devices.mak b/configs/devices/ppc64-softmmu/ppc64-rh-devices.mak
 new file mode 100644
-index 0000000000..6a3e3f0227
+index 0000000000..73e3ee0293
 --- /dev/null
 +++ b/configs/devices/ppc64-softmmu/ppc64-rh-devices.mak
-@@ -0,0 +1,35 @@
+@@ -0,0 +1,36 @@
 +include ../rh-virtio.mak
 +
 +CONFIG_DIMM=y
@@ -146,6 +234,7 @@ index 0000000000..6a3e3f0227
 +CONFIG_TPM=y
 +CONFIG_TPM_SPAPR=y
 +CONFIG_TPM_EMULATOR=y
++CONFIG_TPM_PASSTHROUGH=y
 diff --git a/configs/devices/rh-virtio.mak b/configs/devices/rh-virtio.mak
 new file mode 100644
 index 0000000000..94ede1b5f6
@@ -164,10 +253,10 @@ index 0000000000..94ede1b5f6
 +CONFIG_VIRTIO_SERIAL=y
 diff --git a/configs/devices/s390x-softmmu/s390x-rh-devices.mak b/configs/devices/s390x-softmmu/s390x-rh-devices.mak
 new file mode 100644
-index 0000000000..d3b38312e1
+index 0000000000..165c082e87
 --- /dev/null
 +++ b/configs/devices/s390x-softmmu/s390x-rh-devices.mak
-@@ -0,0 +1,15 @@
+@@ -0,0 +1,16 @@
 +include ../rh-virtio.mak
 +
 +CONFIG_PCI=y
@@ -176,6 +265,7 @@ index 0000000000..d3b38312e1
 +CONFIG_S390_FLIC_KVM=y
 +CONFIG_SCLPCONSOLE=y
 +CONFIG_SCSI=y
++CONFIG_TERMINAL3270=y
 +CONFIG_VFIO=y
 +CONFIG_VFIO_AP=y
 +CONFIG_VFIO_CCW=y
@@ -185,12 +275,14 @@ index 0000000000..d3b38312e1
 +CONFIG_WDT_DIAG288=y
 diff --git a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 new file mode 100644
-index 0000000000..d0c9e66641
+index 0000000000..ddf036f042
 --- /dev/null
 +++ b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
-@@ -0,0 +1,103 @@
+@@ -0,0 +1,104 @@
 +include ../rh-virtio.mak
++include x86_64-upstream-devices.mak
 +
++CONFIG_AC97=y
 +CONFIG_ACPI=y
 +CONFIG_ACPI_PCI=y
 +CONFIG_ACPI_CPU_HOTPLUG=y
@@ -210,7 +302,6 @@ index 0000000000..d0c9e66641
 +CONFIG_EDU=y
 +CONFIG_FDC=y
 +CONFIG_FDC_SYSBUS=y
-+CONFIG_FDC_ISA=y
 +CONFIG_FW_CFG_DMA=y
 +CONFIG_HDA=y
 +CONFIG_HYPERV=y
@@ -234,7 +325,6 @@ index 0000000000..d0c9e66641
 +CONFIG_MC146818RTC=y
 +CONFIG_MEM_DEVICE=y
 +CONFIG_NVDIMM=y
-+CONFIG_OPENGL=y
 +CONFIG_PAM=y
 +CONFIG_PC=y
 +CONFIG_PCI=y
@@ -252,12 +342,14 @@ index 0000000000..d0c9e66641
 +CONFIG_PVPANIC_ISA=y
 +CONFIG_PXB=y
 +CONFIG_Q35=y
++CONFIG_QXL=y
 +CONFIG_RTL8139_PCI=y
 +CONFIG_SCSI=y
 +CONFIG_SERIAL=y
 +CONFIG_SERIAL_ISA=y
 +CONFIG_SERIAL_PCI=y
 +CONFIG_SEV=y
++CONFIG_SGA=y
 +CONFIG_SMBIOS=y
 +CONFIG_SMBUS_EEPROM=y
 +CONFIG_TEST_DEVICES=y
@@ -278,7 +370,6 @@ index 0000000000..d0c9e66641
 +CONFIG_VGA_PCI=y
 +CONFIG_VHOST_USER=y
 +CONFIG_VHOST_USER_BLK=y
-+CONFIG_VIRTIO_MEM=y
 +CONFIG_VIRTIO_PCI=y
 +CONFIG_VIRTIO_VGA=y
 +CONFIG_VMMOUSE=y
@@ -291,12 +382,22 @@ index 0000000000..d0c9e66641
 +CONFIG_TPM_CRB=y
 +CONFIG_TPM_TIS_ISA=y
 +CONFIG_TPM_EMULATOR=y
-+CONFIG_SGX=y
++CONFIG_TPM_PASSTHROUGH=y
+diff --git a/configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak b/configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak
+new file mode 100644
+index 0000000000..2cd20f54d2
+--- /dev/null
++++ b/configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak
+@@ -0,0 +1,4 @@
++# We need "isa-parallel"
++CONFIG_PARALLEL=y
++# We need "hpet"
++CONFIG_HPET=y
 diff --git a/hw/acpi/ich9.c b/hw/acpi/ich9.c
-index bd9bbade70..de1e401cdf 100644
+index ebe08ed831..381ef2ddcf 100644
 --- a/hw/acpi/ich9.c
 +++ b/hw/acpi/ich9.c
-@@ -435,8 +435,8 @@ void ich9_pm_add_properties(Object *obj, ICH9LPCPMRegs *pm)
+@@ -438,8 +438,8 @@ void ich9_pm_add_properties(Object *obj, ICH9LPCPMRegs *pm)
      static const uint32_t gpe0_len = ICH9_PMIO_GPE0_LEN;
      pm->acpi_memory_hotplug.is_enabled = true;
      pm->cpu_hotplug_legacy = true;
@@ -321,10 +422,10 @@ index 721a8eb8be..87ed4dd914 100644
  arm_ss.add(when: 'CONFIG_PXA2XX', if_true: files('pxa2xx.c', 'pxa2xx_gpio.c', 'pxa2xx_pic.c'))
  arm_ss.add(when: 'CONFIG_DIGIC', if_true: files('digic.c'))
 diff --git a/hw/block/fdc.c b/hw/block/fdc.c
-index 347875a0cd..ca1776121f 100644
+index 21d18ac2e3..97fa6de423 100644
 --- a/hw/block/fdc.c
 +++ b/hw/block/fdc.c
-@@ -49,6 +49,8 @@
+@@ -48,6 +48,8 @@
  #include "qom/object.h"
  #include "fdc-internal.h"
  
@@ -333,7 +434,7 @@ index 347875a0cd..ca1776121f 100644
  /********************************************************/
  /* debug Floppy devices */
  
-@@ -2338,6 +2340,14 @@ void fdctrl_realize_common(DeviceState *dev, FDCtrl *fdctrl, Error **errp)
+@@ -2337,6 +2339,14 @@ void fdctrl_realize_common(DeviceState *dev, FDCtrl *fdctrl, Error **errp)
      FDrive *drive;
      static int command_tables_inited = 0;
  
@@ -348,6 +449,33 @@ index 347875a0cd..ca1776121f 100644
      if (fdctrl->fallback == FLOPPY_DRIVE_TYPE_AUTO) {
          error_setg(errp, "Cannot choose a fallback FDrive type of 'auto'");
          return;
+diff --git a/hw/char/parallel.c b/hw/char/parallel.c
+index b45e67bfbb..e5f108211b 100644
+--- a/hw/char/parallel.c
++++ b/hw/char/parallel.c
+@@ -29,6 +29,7 @@
+ #include "chardev/char-parallel.h"
+ #include "chardev/char-fe.h"
+ #include "hw/acpi/aml-build.h"
++#include "hw/boards.h"
+ #include "hw/irq.h"
+ #include "hw/isa/isa.h"
+ #include "hw/qdev-properties.h"
+@@ -534,6 +535,14 @@ static void parallel_isa_realizefn(DeviceState *dev, Error **errp)
+     int base;
+     uint8_t dummy;
+ 
++    /* Restricted for Red Hat Enterprise Linux */
++    MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
++    if (strstr(mc->name, "rhel")) {
++        error_setg(errp, "Device %s is not supported with machine type %s",
++                   object_get_typename(OBJECT(dev)), mc->name);
++        return;
++    }
++
+     if (!qemu_chr_fe_backend_connected(&s->chr)) {
+         error_setg(errp, "Can't create parallel device, empty char device");
+         return;
 diff --git a/hw/cpu/meson.build b/hw/cpu/meson.build
 index 9e52fee9e7..bb71c9f3e7 100644
 --- a/hw/cpu/meson.build
@@ -363,21 +491,19 @@ index 9e52fee9e7..bb71c9f3e7 100644
 -specific_ss.add(when: 'CONFIG_A15MPCORE', if_true: files('a15mpcore.c'))
 +#specific_ss.add(when: 'CONFIG_A15MPCORE', if_true: files('a15mpcore.c'))
 diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
-index 3bb6a58698..6447fdb02e 100644
+index fdca6ca659..fa1a7eee51 100644
 --- a/hw/display/cirrus_vga.c
 +++ b/hw/display/cirrus_vga.c
-@@ -2945,7 +2945,10 @@ static void pci_cirrus_vga_realize(PCIDevice *dev, Error **errp)
-     PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(dev);
-     int16_t device_id = pc->device_id;
+@@ -2945,6 +2945,9 @@ static void pci_cirrus_vga_realize(PCIDevice *dev, Error **errp)
+      PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(dev);
+      int16_t device_id = pc->device_id;
  
--    /*
 +     warn_report("'cirrus-vga' is deprecated, "
 +                 "please use a different VGA card instead");
 +
-+     /*
-      * Follow real hardware, cirrus card emulated has 4 MB video memory.
-      * Also accept 8 MB/16 MB for backward compatibility.
-      */
+      /* follow real hardware, cirrus card emulated has 4 MB video memory.
+        Also accept 8 MB/16 MB for backward compatibility. */
+      if (s->vga.vram_size_mb != 4 && s->vga.vram_size_mb != 8 &&
 diff --git a/hw/ide/piix.c b/hw/ide/piix.c
 index ce89fd0aa3..fbcf802b13 100644
 --- a/hw/ide/piix.c
@@ -402,10 +528,10 @@ index ce89fd0aa3..fbcf802b13 100644
  
  static const TypeInfo piix4_ide_info = {
 diff --git a/hw/input/pckbd.c b/hw/input/pckbd.c
-index 4efdf75620..5143ebaa27 100644
+index baba62f357..bc360347ea 100644
 --- a/hw/input/pckbd.c
 +++ b/hw/input/pckbd.c
-@@ -814,6 +814,8 @@ static void i8042_class_initfn(ObjectClass *klass, void *data)
+@@ -796,6 +796,8 @@ static void i8042_class_initfn(ObjectClass *klass, void *data)
      dc->vmsd = &vmstate_kbd_isa;
      isa->build_aml = i8042_build_aml;
      set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
@@ -435,10 +561,10 @@ index f5bc81296d..282d01e374 100644
  
  static void e1000_register_types(void)
 diff --git a/hw/ppc/spapr_cpu_core.c b/hw/ppc/spapr_cpu_core.c
-index 8a4861f45a..fcb5dfe792 100644
+index 58e7341cb7..8ba34f6a1d 100644
 --- a/hw/ppc/spapr_cpu_core.c
 +++ b/hw/ppc/spapr_cpu_core.c
-@@ -379,10 +379,12 @@ static const TypeInfo spapr_cpu_core_type_infos[] = {
+@@ -370,10 +370,12 @@ static const TypeInfo spapr_cpu_core_type_infos[] = {
          .instance_size = sizeof(SpaprCpuCore),
          .class_size = sizeof(SpaprCpuCoreClass),
      },
@@ -451,6 +577,25 @@ index 8a4861f45a..fcb5dfe792 100644
      DEFINE_SPAPR_CPU_CORE_TYPE("power7_v2.3"),
      DEFINE_SPAPR_CPU_CORE_TYPE("power7+_v2.1"),
      DEFINE_SPAPR_CPU_CORE_TYPE("power8_v2.0"),
+diff --git a/hw/timer/hpet.c b/hw/timer/hpet.c
+index 9520471be2..202e032524 100644
+--- a/hw/timer/hpet.c
++++ b/hw/timer/hpet.c
+@@ -733,6 +733,14 @@ static void hpet_realize(DeviceState *dev, Error **errp)
+     int i;
+     HPETTimer *timer;
+ 
++    /* Restricted for Red Hat Enterprise Linux */
++    MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
++    if (strstr(mc->name, "rhel")) {
++        error_setg(errp, "Device %s is not supported with machine type %s",
++                   object_get_typename(OBJECT(dev)), mc->name);
++        return;
++    }
++
+     if (!s->intcap) {
+         warn_report("Hpet's intcap not initialized");
+     }
 diff --git a/hw/usb/meson.build b/hw/usb/meson.build
 index de853d780d..0776ae6a20 100644
 --- a/hw/usb/meson.build
@@ -543,7 +688,7 @@ index 13d0e9b195..3826fa5122 100644
      { .name = "max",         .initfn = arm_max_initfn },
  #endif
 diff --git a/target/ppc/cpu-models.c b/target/ppc/cpu-models.c
-index 976be5e0d1..dd78883410 100644
+index 4baa111713..d779c4d1d5 100644
 --- a/target/ppc/cpu-models.c
 +++ b/target/ppc/cpu-models.c
 @@ -66,6 +66,7 @@
@@ -552,9 +697,9 @@ index 976be5e0d1..dd78883410 100644
  
 +#if 0  /* Embedded and 32-bit CPUs disabled for Red Hat Enterprise Linux */
      /* Embedded PowerPC                                                      */
-     /* PowerPC 405 family                                                    */
-     /* PowerPC 405 cores                                                     */
-@@ -698,8 +699,10 @@
+     /* PowerPC 401 family                                                    */
+     POWERPC_DEF("401",           CPU_POWERPC_401,                    401,
+@@ -740,8 +741,10 @@
                  "PowerPC 7447A v1.2 (G4)")
      POWERPC_DEF("7457a_v1.2",    CPU_POWERPC_74x7A_v12,              7455,
                  "PowerPC 7457A v1.2 (G4)")
@@ -565,7 +710,7 @@ index 976be5e0d1..dd78883410 100644
      POWERPC_DEF("970_v2.2",      CPU_POWERPC_970_v22,                970,
                  "PowerPC 970 v2.2")
      POWERPC_DEF("970fx_v1.0",    CPU_POWERPC_970FX_v10,              970,
-@@ -718,6 +721,7 @@
+@@ -760,6 +763,7 @@
                  "PowerPC 970MP v1.1")
      POWERPC_DEF("power5+_v2.1",  CPU_POWERPC_POWER5P_v21,            POWER5P,
                  "POWER5+ v2.1")
@@ -573,7 +718,15 @@ index 976be5e0d1..dd78883410 100644
      POWERPC_DEF("power7_v2.3",   CPU_POWERPC_POWER7_v23,             POWER7,
                  "POWER7 v2.3")
      POWERPC_DEF("power7+_v2.1",  CPU_POWERPC_POWER7P_v21,            POWER7,
-@@ -897,12 +901,15 @@ PowerPCCPUAlias ppc_cpu_aliases[] = {
+@@ -784,6 +788,7 @@
+ /* PowerPC CPU aliases                                                     */
+ 
+ PowerPCCPUAlias ppc_cpu_aliases[] = {
++#if 0  /* Embedded and 32-bit CPUs disabled for Red Hat Enterprise Linux */
+     { "403", "403gc" },
+     { "405", "405d4" },
+     { "405cr", "405crc" },
+@@ -942,12 +947,15 @@ PowerPCCPUAlias ppc_cpu_aliases[] = {
      { "7447a", "7447a_v1.2" },
      { "7457a", "7457a_v1.2" },
      { "apollo7pm", "7457a_v1.0" },
@@ -589,7 +742,7 @@ index 976be5e0d1..dd78883410 100644
      { "power7", "power7_v2.3" },
      { "power7+", "power7+_v2.1" },
      { "power8e", "power8e_v2.1" },
-@@ -912,6 +919,7 @@ PowerPCCPUAlias ppc_cpu_aliases[] = {
+@@ -957,6 +965,7 @@ PowerPCCPUAlias ppc_cpu_aliases[] = {
      { "power10", "power10_v2.0" },
  #endif
  
@@ -597,7 +750,7 @@ index 976be5e0d1..dd78883410 100644
      /* Generic PowerPCs */
  #if defined(TARGET_PPC64)
      { "ppc64", "970fx_v3.1" },
-@@ -919,5 +927,6 @@ PowerPCCPUAlias ppc_cpu_aliases[] = {
+@@ -964,5 +973,6 @@ PowerPCCPUAlias ppc_cpu_aliases[] = {
      { "ppc32", "604" },
      { "ppc", "604" },
      { "default", "604" },
@@ -619,10 +772,10 @@ index 05c3ccaaff..6a04ccab1b 100644
  
      /* detect missing features if any to properly report them */
 diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c
-index 6acf14d5ec..74f089d87f 100644
+index 5b1fdb55c4..c52434985b 100644
 --- a/target/s390x/kvm/kvm.c
 +++ b/target/s390x/kvm/kvm.c
-@@ -2512,6 +2512,14 @@ void kvm_s390_apply_cpu_model(const S390CPUModel *model, Error **errp)
+@@ -2508,6 +2508,14 @@ void kvm_s390_apply_cpu_model(const S390CPUModel *model, Error **errp)
          error_setg(errp, "KVM doesn't support CPU models");
          return;
      }
@@ -638,5 +791,5 @@ index 6acf14d5ec..74f089d87f 100644
      prop.ibc = s390_ibc_from_cpu_model(model);
      /* configure cpu features indicated via STFL(e) */
 -- 
-2.31.1
+2.27.0
 

SOURCES/0007-Machine-type-related-general-changes.patch

@@ -1,4 +1,4 @@
-From a525db3951dc68c469d1f51bdc69ab6e75e72c37 Mon Sep 17 00:00:00 2001
+From adca046d9db670637b9bf2b24f7a4349a9fe2628 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 11 Jan 2019 09:54:45 +0100
 Subject: Machine type related general changes
@@ -8,55 +8,124 @@ split to allow easier review. It contains changes not related to any
 architecture.
 
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
---
-Rebase notes (6.2.0):
+
+Rebase changes (4.0.0):
+- Remove e1000 device duplication changes to reflect upstream solution
+- Rewrite machine compat properties to upstream solution
+
+Rebase changes (4.1.0):
+- Removed optional flag for machine compat properties (upstream)
+- Remove c3e002cb chunk from hw/net/e1000.c
+- Reorder compat structures
+- Use one format for compat scructures
+- Added compat for virtio-balloon-pci.any_layout for rhel71
+
+Rebase changes (weekly-210303):
+- Added rhel 8.4.0 compat based on 5.2 compat
+
+Rebase changes (weekly-211103):
 - Do not duplicate minimal_version_id for piix4_pm
-- Remove empty line chunks in serial.c
-- Remove migration.h include in serial.c
-- Update hw_compat_rhel_8_5 (from MR 66)
 
-Rebase notes (7.0.0):
-- Remove downstream changes leftovers in hw/rtc/mc146818rtc.c
-- Remove unnecessary change in hw/usb/hcd-uhci.c
+Merged patches (4.0.0):
+- d4c0957 compat: Generic HW_COMPAT_RHEL7_6
+- cbac773 virtio: Make disable-legacy/disable-modern compat properties optional
 
-Merged patches (6.1.0):
-- f2fb42a3c6 redhat: add missing entries in hw_compat_rhel_8_4
-- 1949ec258e hw/arm/virt: Disable PL011 clock migration through hw_compat_rhel_8_3
-- a3995e2eff Remove RHEL 7.0.0 machine type (only generic changes)
-- ad3190a79b Remove RHEL 7.1.0 machine type (only generic changes)
-- 84bbe15d4e Remove RHEL 7.2.0 machine type (only generic changes)
-- 0215eb3356 Remove RHEL 7.3.0 machine types (only generic changes)
-- af69d1ca6e Remove RHEL 7.4.0 machine types (only generic changes)
-- 8f7a74ab78 Remove RHEL 7.5.0 machine types (only generic changes)
+Merged patches (4.1.0):
+- 479ad30 redhat: fix cut'n'paste garbage in hw_compat comments
+- f19738e compat: Generic hw_compat_rhel_8_0
 
-Merged patches (6.2.0):
-- d687ac13d2 redhat: Define hw_compat_rhel_8_5
+Merged patches (4.2.0):
+- 9f2bfaa machine types: Update hw_compat_rhel_8_0 from hw_compat_4_0
+- ca4a5e8 virtio: Make disable-legacy/disable-modern compat properties optional
+- compat: Generic hw_compat_rhel_8_1 (patch 93040/92956)
 
-Merged patches (7.0.0):
-- ef5afcc86d Fix virtio-net-pci* "vectors" compat
-- 168f0d56e3 compat: Update hw_compat_rhel_8_5 with 6.2.0 RC2 changes
+Merged patches (5.1.0):
+- e6c3fbf hw/smbios: set new default SMBIOS fields for Windows driver support (partialy)
+- 8f9f4d8 compat: disable 'edid' for virtio-gpu-ccw
+
+Merged patches (5.2.0 rc0):
+- 8348642 redhat: define hw_compat_8_2
+- 45b8402 redhat: define hw_compat_8_2
+- 4effa71 redhat: Update hw_compat_8_2
+- 0e84dff virtio: skip legacy support check on machine types less than 5.1 (partialy)
+
+Merged patches (6.0.0):
+- fa0063ba67 redhat: Define hw_compat_8_3
+- d98e328c8d usb/hcd-xhci-pci: Fixup capabilities ordering (again)
+- b8a2578117 virtio: move 'use-disabled-flag' property to hw_compat_4_2
+- f7940b04c8 virtio-pci: compat page aligned ATS
+
+Merged patches (weekly-210602):
+- 26f25108c1 redhat: add missing entries in hw_compat_rhel_8_4
+
+Merged patches (weekly-211006):
+- 43c4b9bea6 redhat: Define hw_compat_rhel_8_5
 ---
+ hw/acpi/ich9.c               |  15 ++
  hw/acpi/piix4.c              |   6 +-
  hw/arm/virt.c                |   2 +-
- hw/core/machine.c            | 186 +++++++++++++++++++++++++++++++++++
+ hw/char/serial.c             |  16 +++
+ hw/core/machine.c            | 272 +++++++++++++++++++++++++++++++++++
  hw/display/vga-isa.c         |   2 +-
  hw/i386/pc_piix.c            |   2 +
  hw/i386/pc_q35.c             |   2 +
+ hw/net/e1000e.c              |  22 +++
  hw/net/rtl8139.c             |   4 +-
- hw/smbios/smbios.c           |  46 ++++++++-
+ hw/rtc/mc146818rtc.c         |   6 +
+ hw/smbios/smbios.c           |  46 +++++-
  hw/timer/i8254_common.c      |   2 +-
- hw/usb/hcd-xhci-pci.c        |  59 ++++++++---
+ hw/usb/hcd-uhci.c            |   4 +-
+ hw/usb/hcd-xhci-pci.c        |  59 ++++++--
  hw/usb/hcd-xhci-pci.h        |   1 +
- include/hw/boards.h          |  21 ++++
+ hw/usb/hcd-xhci.c            |  20 +++
+ hw/usb/hcd-xhci.h            |   2 +
+ include/hw/acpi/ich9.h       |   3 +
+ include/hw/boards.h          |  36 +++++
  include/hw/firmware/smbios.h |   5 +-
  include/hw/i386/pc.h         |   3 +
- 14 files changed, 316 insertions(+), 25 deletions(-)
+ include/hw/usb.h             |   3 +
+ migration/migration.c        |   2 +
+ migration/migration.h        |   5 +
+ 25 files changed, 514 insertions(+), 26 deletions(-)
 
+diff --git a/hw/acpi/ich9.c b/hw/acpi/ich9.c
+index 381ef2ddcf..82bd805b55 100644
+--- a/hw/acpi/ich9.c
++++ b/hw/acpi/ich9.c
+@@ -433,6 +433,18 @@ static void ich9_pm_set_keep_pci_slot_hpc(Object *obj, bool value, Error **errp)
+     s->pm.keep_pci_slot_hpc = value;
+ }
+ 
++static bool ich9_pm_get_force_rev1_fadt(Object *obj, Error **errp)
++{
++    ICH9LPCState *s = ICH9_LPC_DEVICE(obj);
++    return s->pm.force_rev1_fadt;
++}
++
++static void ich9_pm_set_force_rev1_fadt(Object *obj, bool value, Error **errp)
++{
++    ICH9LPCState *s = ICH9_LPC_DEVICE(obj);
++    s->pm.force_rev1_fadt = value;
++}
++
+ void ich9_pm_add_properties(Object *obj, ICH9LPCPMRegs *pm)
+ {
+     static const uint32_t gpe0_len = ICH9_PMIO_GPE0_LEN;
+@@ -457,6 +469,9 @@ void ich9_pm_add_properties(Object *obj, ICH9LPCPMRegs *pm)
+     object_property_add_bool(obj, "cpu-hotplug-legacy",
+                              ich9_pm_get_cpu_hotplug_legacy,
+                              ich9_pm_set_cpu_hotplug_legacy);
++    object_property_add_bool(obj, "__com.redhat_force-rev1-fadt",
++                             ich9_pm_get_force_rev1_fadt,
++                             ich9_pm_set_force_rev1_fadt);
+     object_property_add_uint8_ptr(obj, ACPI_PM_PROP_S3_DISABLED,
+                                   &pm->disable_s3, OBJ_PROP_FLAG_READWRITE);
+     object_property_add_uint8_ptr(obj, ACPI_PM_PROP_S4_DISABLED,
 diff --git a/hw/acpi/piix4.c b/hw/acpi/piix4.c
-index fe5625d07a..28544e78c3 100644
+index f0b5fac44a..8d6011c0a3 100644
 --- a/hw/acpi/piix4.c
 +++ b/hw/acpi/piix4.c
-@@ -287,7 +287,7 @@ static bool vmstate_test_migrate_acpi_index(void *opaque, int version_id)
+@@ -278,7 +278,7 @@ static bool piix4_vmstate_need_smbus(void *opaque, int version_id)
  static const VMStateDescription vmstate_acpi = {
      .name = "piix4_pm",
      .version_id = 3,
@@ -65,7 +134,7 @@ index fe5625d07a..28544e78c3 100644
      .post_load = vmstate_acpi_post_load,
      .fields = (VMStateField[]) {
          VMSTATE_PCI_DEVICE(parent_obj, PIIX4PMState),
-@@ -653,8 +653,8 @@ static void piix4_send_gpe(AcpiDeviceIf *adev, AcpiEventStatusBits ev)
+@@ -644,8 +644,8 @@ static void piix4_send_gpe(AcpiDeviceIf *adev, AcpiEventStatusBits ev)
  
  static Property piix4_pm_properties[] = {
      DEFINE_PROP_UINT32("smb_io_base", PIIX4PMState, smb_io_base, 0),
@@ -77,28 +146,83 @@ index fe5625d07a..28544e78c3 100644
      DEFINE_PROP_BOOL(ACPI_PM_PROP_ACPI_PCIHP_BRIDGE, PIIX4PMState,
                       use_acpi_hotplug_bridge, true),
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index d2e5ecd234..6a84031fd7 100644
+index 30da05dfe0..5de4d9d73b 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
-@@ -1596,7 +1596,7 @@ static void virt_build_smbios(VirtMachineState *vms)
+@@ -1590,7 +1590,7 @@ static void virt_build_smbios(VirtMachineState *vms)
  
      smbios_set_defaults("QEMU", product,
                          vmc->smbios_old_sys_ver ? "1.0" : mc->name, false,
--                        true, SMBIOS_ENTRY_POINT_TYPE_64);
-+                        true, NULL, NULL, SMBIOS_ENTRY_POINT_TYPE_64);
+-                        true, SMBIOS_ENTRY_POINT_30);
++                        true, NULL, NULL, SMBIOS_ENTRY_POINT_30);
  
      smbios_get_tables(MACHINE(vms), NULL, 0,
                        &smbios_tables, &smbios_tables_len,
+diff --git a/hw/char/serial.c b/hw/char/serial.c
+index 7061aacbce..fe8d0afbb0 100644
+--- a/hw/char/serial.c
++++ b/hw/char/serial.c
+@@ -37,6 +37,7 @@
+ #include "trace.h"
+ #include "hw/qdev-properties.h"
+ #include "hw/qdev-properties-system.h"
++#include "migration/migration.h"
+ 
+ #define UART_LCR_DLAB	0x80	/* Divisor latch access bit */
+ 
+@@ -689,6 +690,9 @@ static int serial_post_load(void *opaque, int version_id)
+ static bool serial_thr_ipending_needed(void *opaque)
+ {
+     SerialState *s = opaque;
++    if (migrate_pre_2_2) {
++        return false;
++    }
+ 
+     if (s->ier & UART_IER_THRI) {
+         bool expected_value = ((s->iir & UART_IIR_ID) == UART_IIR_THRI);
+@@ -770,6 +774,10 @@ static const VMStateDescription vmstate_serial_xmit_fifo = {
+ static bool serial_fifo_timeout_timer_needed(void *opaque)
+ {
+     SerialState *s = (SerialState *)opaque;
++    if (migrate_pre_2_2) {
++        return false;
++    }
++
+     return timer_pending(s->fifo_timeout_timer);
+ }
+ 
+@@ -787,6 +795,10 @@ static const VMStateDescription vmstate_serial_fifo_timeout_timer = {
+ static bool serial_timeout_ipending_needed(void *opaque)
+ {
+     SerialState *s = (SerialState *)opaque;
++    if (migrate_pre_2_2) {
++        return false;
++    }
++
+     return s->timeout_ipending != 0;
+ }
+ 
+@@ -804,6 +816,10 @@ static const VMStateDescription vmstate_serial_timeout_ipending = {
+ static bool serial_poll_needed(void *opaque)
+ {
+     SerialState *s = (SerialState *)opaque;
++    if (migrate_pre_2_2) {
++        return false;
++    }
++
+     return s->poll_msl >= 0;
+ }
+ 
 diff --git a/hw/core/machine.c b/hw/core/machine.c
-index 1e23fdc14b..ea430d844e 100644
+index 53a99abc56..be4f9864cd 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
-@@ -37,6 +37,192 @@
+@@ -37,6 +37,278 @@
  #include "hw/virtio/virtio.h"
  #include "hw/virtio/virtio-pci.h"
  
 +/*
-+ * Mostly the same as hw_compat_6_0 and hw_compat_6_1
++ * Mostly the same as hw_compat_6_0
 + */
 +GlobalProperty hw_compat_rhel_8_5[] = {
 +    /* hw_compat_rhel_8_5 from hw_compat_6_0 */
@@ -111,12 +235,6 @@ index 1e23fdc14b..ea430d844e 100644
 +    { "e1000", "init-vet", "off" },
 +    /* hw_compat_rhel_8_5 from hw_compat_6_0 */
 +    { "e1000e", "init-vet", "off" },
-+    /* hw_compat_rhel_8_5 from hw_compat_6_0 */
-+    { "vhost-vsock-device", "seqpacket", "off" },
-+    /* hw_compat_rhel_8_5 from hw_compat_6_1 */
-+    { "vhost-user-vsock-device", "seqpacket", "off" },
-+    /* hw_compat_rhel_8_5 from hw_compat_6_1 */
-+    { "nvme-ns", "shared", "off" },
 +};
 +const size_t hw_compat_rhel_8_5_len = G_N_ELEMENTS(hw_compat_rhel_8_5);
 +
@@ -131,11 +249,7 @@ index 1e23fdc14b..ea430d844e 100644
 +    /* hw_compat_rhel_8_4 from hw_compat_5_2 */
 +    { "virtio-blk-device", "report-discard-granularity", "off" },
 +    /* hw_compat_rhel_8_4 from hw_compat_5_2 */
-+    /*
-+     * Upstream incorrectly had "virtio-net-pci" instead of "virtio-net-pci-base",
-+     * (https://bugzilla.redhat.com/show_bug.cgi?id=1999141)
-+     */
-+    { "virtio-net-pci-base", "vectors", "3"},
++    { "virtio-net-pci", "vectors", "3"},
 +};
 +const size_t hw_compat_rhel_8_4_len = G_N_ELEMENTS(hw_compat_rhel_8_4);
 +
@@ -157,8 +271,6 @@ index 1e23fdc14b..ea430d844e 100644
 +    { "nvme", "use-intel-id", "on"},
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 +    { "pvpanic", "events", "1"}, /* PVPANIC_PANICKED */
-+    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
-+    { "pl011", "migrate-clk", "off" },
 +    /* hw_compat_rhel_8_3 bz 1912846 */
 +    { "pci-xhci", "x-rh-late-msi-cap", "off" },
 +    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
@@ -283,14 +395,112 @@ index 1e23fdc14b..ea430d844e 100644
 +};
 +const size_t hw_compat_rhel_7_6_len = G_N_ELEMENTS(hw_compat_rhel_7_6);
 +
- GlobalProperty hw_compat_6_2[] = {
-     { "PIIX4_PM", "x-not-migrate-acpi-index", "on"},
- };
++/* The same as hw_compat_2_11 + hw_compat_2_10 */
++GlobalProperty hw_compat_rhel_7_5[] = {
++    /* hw_compat_rhel_7_5 from hw_compat_2_11 */
++    { "hpet", "hpet-offset-saved", "false" },
++    /* hw_compat_rhel_7_5 from hw_compat_2_11 */
++    { "virtio-blk-pci", "vectors", "2" },
++    /* hw_compat_rhel_7_5 from hw_compat_2_11 */
++    { "vhost-user-blk-pci", "vectors", "2" },
++    /* hw_compat_rhel_7_5 from hw_compat_2_11
++       bz 1608778 modified for our naming */
++    { "e1000-82540em", "migrate_tso_props", "off" },
++    /* hw_compat_rhel_7_5 from hw_compat_2_10 */
++    { "virtio-mouse-device", "wheel-axis", "false" },
++    /* hw_compat_rhel_7_5 from hw_compat_2_10 */
++    { "virtio-tablet-device", "wheel-axis", "false" },
++    { "cirrus-vga", "vgamem_mb", "16" },
++    { "migration", "decompress-error-check", "off" },
++};
++const size_t hw_compat_rhel_7_5_len = G_N_ELEMENTS(hw_compat_rhel_7_5);
++
++/* Mostly like hw_compat_2_9 except
++ * x-mtu-bypass-backend, x-migrate-msix has already been
++ * backported to RHEL7.4. shpc was already on in 7.4.
++ */
++GlobalProperty hw_compat_rhel_7_4[] = {
++    { "intel-iommu", "pt", "off" },
++};
++
++const size_t hw_compat_rhel_7_4_len = G_N_ELEMENTS(hw_compat_rhel_7_4);
++/* Mostly like HW_COMPAT_2_6 + HW_COMPAT_2_7 + HW_COMPAT_2_8 except
++ * disable-modern, disable-legacy, page-per-vq have already been
++ * backported to RHEL7.3
++ */
++GlobalProperty hw_compat_rhel_7_3[] = {
++    { "virtio-mmio", "format_transport_address", "off" },
++    { "virtio-serial-device", "emergency-write", "off" },
++    { "ioapic", "version", "0x11" },
++    { "intel-iommu", "x-buggy-eim", "true" },
++    { "virtio-pci", "x-ignore-backend-features", "on" },
++    { "fw_cfg_mem", "x-file-slots", stringify(0x10) },
++    { "fw_cfg_io", "x-file-slots", stringify(0x10) },
++    { "pflash_cfi01", "old-multiple-chip-handling", "on" },
++    { TYPE_PCI_DEVICE, "x-pcie-extcap-init", "off" },
++    { "virtio-pci", "x-pcie-deverr-init", "off" },
++    { "virtio-pci", "x-pcie-lnkctl-init", "off" },
++    { "virtio-pci", "x-pcie-pm-init", "off" },
++    { "virtio-net-device", "x-mtu-bypass-backend", "off" },
++    { "e1000e", "__redhat_e1000e_7_3_intr_state", "on" },
++};
++const size_t hw_compat_rhel_7_3_len = G_N_ELEMENTS(hw_compat_rhel_7_3);
++
++/* Mostly like hw_compat_2_4 + 2_3 but:
++ *  we don't need "any_layout" as it has been backported to 7.2
++ */
++GlobalProperty hw_compat_rhel_7_2[] = {
++        { "virtio-blk-device", "scsi", "true" },
++        { "e1000-82540em", "extra_mac_registers", "off" },
++        { "virtio-pci", "x-disable-pcie", "on" },
++        { "virtio-pci", "migrate-extra", "off" },
++        { "fw_cfg_mem", "dma_enabled", "off" },
++        { "fw_cfg_io", "dma_enabled", "off" },
++        { "isa-fdc", "fallback", "144" },
++        /* Optional because not all virtio-pci devices support legacy mode */
++        { "virtio-pci", "disable-modern", "on", .optional = true },
++        { "virtio-pci", "disable-legacy", "off", .optional = true },
++        { TYPE_PCI_DEVICE, "x-pcie-lnksta-dllla", "off" },
++        { "virtio-pci", "page-per-vq", "on" },
++        /* hw_compat_rhel_7_2 - introduced with 2.10.0 */
++        { "migration", "send-section-footer", "off" },
++        /* hw_compat_rhel_7_2 - introduced with 2.10.0 */
++        { "migration", "store-global-state", "off",
++        },
++};
++const size_t hw_compat_rhel_7_2_len = G_N_ELEMENTS(hw_compat_rhel_7_2);
++
++/* Mostly like hw_compat_2_1 but:
++ *    we don't need virtio-scsi-pci since 7.0 already had that on
++ *
++ * RH: Note, qemu-extended-regs should have been enabled in the 7.1
++ * machine type, but was accidentally turned off in 7.2 onwards.
++ */
++GlobalProperty hw_compat_rhel_7_1[] = {
++    { "intel-hda-generic", "old_msi_addr", "on" },
++    { "VGA", "qemu-extended-regs", "off" },
++    { "secondary-vga", "qemu-extended-regs", "off" },
++    { "usb-mouse", "usb_version", stringify(1) },
++    { "usb-kbd", "usb_version", stringify(1) },
++    { "virtio-pci",  "virtio-pci-bus-master-bug-migration", "on" },
++    { "virtio-blk-pci", "any_layout", "off" },
++    { "virtio-balloon-pci", "any_layout", "off" },
++    { "virtio-serial-pci", "any_layout", "off" },
++    { "virtio-9p-pci", "any_layout", "off" },
++    { "virtio-rng-pci", "any_layout", "off" },
++    /* HW_COMPAT_RHEL7_1 - introduced with 2.10.0 */
++    { "migration", "send-configuration", "off" },
++};
++const size_t hw_compat_rhel_7_1_len = G_N_ELEMENTS(hw_compat_rhel_7_1);
++
+ GlobalProperty hw_compat_6_1[] = {
+     { "vhost-user-vsock-device", "seqpacket", "off" },
+     { "nvme-ns", "shared", "off" },
 diff --git a/hw/display/vga-isa.c b/hw/display/vga-isa.c
-index 46abbc5653..505467059b 100644
+index 90851e730b..a91c5d7467 100644
 --- a/hw/display/vga-isa.c
 +++ b/hw/display/vga-isa.c
-@@ -88,7 +88,7 @@ static void vga_isa_realizefn(DeviceState *dev, Error **errp)
+@@ -85,7 +85,7 @@ static void vga_isa_realizefn(DeviceState *dev, Error **errp)
  }
  
  static Property vga_isa_properties[] = {
@@ -300,7 +510,7 @@ index 46abbc5653..505467059b 100644
  };
  
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
-index b72c03d0a6..c797e98312 100644
+index 223dd3e05d..dda3f64f19 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
 @@ -177,6 +177,8 @@ static void pc_init1(MachineState *machine,
@@ -309,11 +519,11 @@ index b72c03d0a6..c797e98312 100644
                              pcmc->smbios_uuid_encoded,
 +                            pcmc->smbios_stream_product,
 +                            pcmc->smbios_stream_version,
-                             pcms->smbios_entry_point_type);
+                             SMBIOS_ENTRY_POINT_21);
      }
  
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
-index 1780f79bc1..b695f88c45 100644
+index e1e100316d..235054a643 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
 @@ -200,6 +200,8 @@ static void pc_q35_init(MachineState *machine)
@@ -322,11 +532,86 @@ index 1780f79bc1..b695f88c45 100644
                              pcmc->smbios_uuid_encoded,
 +                            pcmc->smbios_stream_product,
 +                            pcmc->smbios_stream_version,
-                             pcms->smbios_entry_point_type);
+                             SMBIOS_ENTRY_POINT_21);
      }
  
+diff --git a/hw/net/e1000e.c b/hw/net/e1000e.c
+index ac96f7665a..d35bc1f0b0 100644
+--- a/hw/net/e1000e.c
++++ b/hw/net/e1000e.c
+@@ -81,6 +81,12 @@ struct E1000EState {
+ 
+     E1000ECore core;
+     bool init_vet;
++
++    /* 7.3 had the intr_state field that was in the original e1000e code
++     * but that was removed prior to 2.7's release
++     */
++    bool redhat_7_3_intr_state_enable;
++    uint32_t redhat_7_3_intr_state;
+ };
+ 
+ #define E1000E_MMIO_IDX     0
+@@ -96,6 +102,10 @@ struct E1000EState {
+ #define E1000E_MSIX_TABLE   (0x0000)
+ #define E1000E_MSIX_PBA     (0x2000)
+ 
++/* Values as in RHEL 7.3 build and original upstream */
++#define RH_E1000E_USE_MSI     BIT(0)
++#define RH_E1000E_USE_MSIX    BIT(1)
++
+ static uint64_t
+ e1000e_mmio_read(void *opaque, hwaddr addr, unsigned size)
+ {
+@@ -307,6 +317,8 @@ e1000e_init_msix(E1000EState *s)
+     } else {
+         if (!e1000e_use_msix_vectors(s, E1000E_MSIX_VEC_NUM)) {
+             msix_uninit(d, &s->msix, &s->msix);
++        } else {
++            s->redhat_7_3_intr_state |= RH_E1000E_USE_MSIX;
+         }
+     }
+ }
+@@ -478,6 +490,8 @@ static void e1000e_pci_realize(PCIDevice *pci_dev, Error **errp)
+     ret = msi_init(PCI_DEVICE(s), 0xD0, 1, true, false, NULL);
+     if (ret) {
+         trace_e1000e_msi_init_fail(ret);
++    } else {
++        s->redhat_7_3_intr_state |= RH_E1000E_USE_MSI;
+     }
+ 
+     if (e1000e_add_pm_capability(pci_dev, e1000e_pmrb_offset,
+@@ -605,6 +619,11 @@ static const VMStateDescription e1000e_vmstate_intr_timer = {
+     VMSTATE_STRUCT_ARRAY(_f, _s, _num, 0,                           \
+                          e1000e_vmstate_intr_timer, E1000IntrDelayTimer)
+ 
++static bool rhel_7_3_check(void *opaque, int version_id)
++{
++    return ((E1000EState *)opaque)->redhat_7_3_intr_state_enable;
++}
++
+ static const VMStateDescription e1000e_vmstate = {
+     .name = "e1000e",
+     .version_id = 1,
+@@ -616,6 +635,7 @@ static const VMStateDescription e1000e_vmstate = {
+         VMSTATE_MSIX(parent_obj, E1000EState),
+ 
+         VMSTATE_UINT32(ioaddr, E1000EState),
++        VMSTATE_UINT32_TEST(redhat_7_3_intr_state, E1000EState, rhel_7_3_check),
+         VMSTATE_UINT32(core.rxbuf_min_shift, E1000EState),
+         VMSTATE_UINT8(core.rx_desc_len, E1000EState),
+         VMSTATE_UINT32_ARRAY(core.rxbuf_sizes, E1000EState,
+@@ -664,6 +684,8 @@ static PropertyInfo e1000e_prop_disable_vnet,
+ 
+ static Property e1000e_properties[] = {
+     DEFINE_NIC_PROPERTIES(E1000EState, conf),
++    DEFINE_PROP_BOOL("__redhat_e1000e_7_3_intr_state", E1000EState,
++                        redhat_7_3_intr_state_enable, false),
+     DEFINE_PROP_SIGNED("disable_vnet_hdr", E1000EState, disable_vnet, false,
+                         e1000e_prop_disable_vnet, bool),
+     DEFINE_PROP_SIGNED("subsys_ven", E1000EState, subsys_ven,
 diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
-index 6b65823b4b..75dacabc43 100644
+index 90b4fc63ce..3ffb9dd22c 100644
 --- a/hw/net/rtl8139.c
 +++ b/hw/net/rtl8139.c
 @@ -3179,7 +3179,7 @@ static int rtl8139_pre_save(void *opaque)
@@ -348,8 +633,32 @@ index 6b65823b4b..75dacabc43 100644
          VMSTATE_UINT16(tally_counters.TxAbt, RTL8139State),
          VMSTATE_UINT16(tally_counters.TxUndrn, RTL8139State),
  
+diff --git a/hw/rtc/mc146818rtc.c b/hw/rtc/mc146818rtc.c
+index 4fbafddb22..2f120c6e70 100644
+--- a/hw/rtc/mc146818rtc.c
++++ b/hw/rtc/mc146818rtc.c
+@@ -43,6 +43,7 @@
+ #include "qapi/qapi-events-misc-target.h"
+ #include "qapi/visitor.h"
+ #include "hw/rtc/mc146818rtc_regs.h"
++#include "migration/migration.h"
+ 
+ #ifdef TARGET_I386
+ #include "qapi/qapi-commands-misc-target.h"
+@@ -821,6 +822,11 @@ static int rtc_post_load(void *opaque, int version_id)
+ static bool rtc_irq_reinject_on_ack_count_needed(void *opaque)
+ {
+     RTCState *s = (RTCState *)opaque;
++
++    if (migrate_pre_2_2) {
++        return false;
++    }
++
+     return s->irq_reinject_on_ack_count != 0;
+ }
+ 
 diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c
-index 60349ee402..0edcc98434 100644
+index 7397e56737..3a4bb894ba 100644
 --- a/hw/smbios/smbios.c
 +++ b/hw/smbios/smbios.c
 @@ -57,6 +57,9 @@ static bool smbios_legacy = true;
@@ -362,16 +671,16 @@ index 60349ee402..0edcc98434 100644
  
  uint8_t *smbios_tables;
  size_t smbios_tables_len;
-@@ -639,7 +642,7 @@ static void smbios_build_type_1_table(void)
+@@ -619,7 +622,7 @@ static void smbios_build_type_1_table(void)
  
  static void smbios_build_type_2_table(void)
  {
--    SMBIOS_BUILD_TABLE_PRE(2, T2_BASE, false); /* optional */
-+    SMBIOS_BUILD_TABLE_PRE(2, T2_BASE, smbios_type2_required);
+-    SMBIOS_BUILD_TABLE_PRE(2, 0x200, false); /* optional */
++    SMBIOS_BUILD_TABLE_PRE(2, 0x200, smbios_type2_required);
  
      SMBIOS_TABLE_SET_STR(2, manufacturer_str, type2.manufacturer);
      SMBIOS_TABLE_SET_STR(2, product_str, type2.product);
-@@ -914,7 +917,10 @@ void smbios_set_cpuid(uint32_t version, uint32_t features)
+@@ -888,7 +891,10 @@ void smbios_set_cpuid(uint32_t version, uint32_t features)
  
  void smbios_set_defaults(const char *manufacturer, const char *product,
                           const char *version, bool legacy_mode,
@@ -383,7 +692,7 @@ index 60349ee402..0edcc98434 100644
  {
      smbios_have_defaults = true;
      smbios_legacy = legacy_mode;
-@@ -935,11 +941,45 @@ void smbios_set_defaults(const char *manufacturer, const char *product,
+@@ -909,11 +915,45 @@ void smbios_set_defaults(const char *manufacturer, const char *product,
          g_free(smbios_entries);
      }
  
@@ -443,6 +752,25 @@ index 050875b497..32935da46c 100644
          VMSTATE_STRUCT_ARRAY(channels, PITCommonState, 3, 2,
                               vmstate_pit_channel, PITChannelState),
          VMSTATE_INT64(channels[0].next_transition_time,
+diff --git a/hw/usb/hcd-uhci.c b/hw/usb/hcd-uhci.c
+index d1b5657d72..7930b868fa 100644
+--- a/hw/usb/hcd-uhci.c
++++ b/hw/usb/hcd-uhci.c
+@@ -1166,11 +1166,13 @@ void usb_uhci_common_realize(PCIDevice *dev, Error **errp)
+     UHCIState *s = UHCI(dev);
+     uint8_t *pci_conf = s->dev.config;
+     int i;
++    int irq_pin;
+ 
+     pci_conf[PCI_CLASS_PROG] = 0x00;
+     /* TODO: reset value should be 0. */
+     pci_conf[USB_SBRN] = USB_RELEASE_1; /* release number */
+-    pci_config_set_interrupt_pin(pci_conf, u->info.irq_pin + 1);
++    irq_pin = u->info.irq_pin;
++    pci_config_set_interrupt_pin(pci_conf, irq_pin + 1);
+     s->irq = pci_allocate_irq(dev);
+ 
+     if (s->masterbus) {
 diff --git a/hw/usb/hcd-xhci-pci.c b/hw/usb/hcd-xhci-pci.c
 index e934b1a5b1..e18b05e528 100644
 --- a/hw/usb/hcd-xhci-pci.c
@@ -554,11 +882,79 @@ index c193f79443..086a1feb1e 100644
  } XHCIPciState;
  
  #endif
+diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
+index e01700039b..d5ea13356c 100644
+--- a/hw/usb/hcd-xhci.c
++++ b/hw/usb/hcd-xhci.c
+@@ -3494,9 +3494,27 @@ static const VMStateDescription vmstate_xhci_slot = {
+     }
+ };
+ 
++static int xhci_event_pre_save(void *opaque)
++{
++    XHCIEvent *s = opaque;
++
++    s->cve_2014_5263_a = ((uint8_t *)&s->type)[0];
++    s->cve_2014_5263_b = ((uint8_t *)&s->type)[1];
++
++    return 0;
++}
++
++bool migrate_cve_2014_5263_xhci_fields;
++
++static bool xhci_event_cve_2014_5263(void *opaque, int version_id)
++{
++    return migrate_cve_2014_5263_xhci_fields;
++}
++
+ static const VMStateDescription vmstate_xhci_event = {
+     .name = "xhci-event",
+     .version_id = 1,
++    .pre_save = xhci_event_pre_save,
+     .fields = (VMStateField[]) {
+         VMSTATE_UINT32(type,   XHCIEvent),
+         VMSTATE_UINT32(ccode,  XHCIEvent),
+@@ -3505,6 +3523,8 @@ static const VMStateDescription vmstate_xhci_event = {
+         VMSTATE_UINT32(flags,  XHCIEvent),
+         VMSTATE_UINT8(slotid,  XHCIEvent),
+         VMSTATE_UINT8(epid,    XHCIEvent),
++        VMSTATE_UINT8_TEST(cve_2014_5263_a, XHCIEvent, xhci_event_cve_2014_5263),
++        VMSTATE_UINT8_TEST(cve_2014_5263_b, XHCIEvent, xhci_event_cve_2014_5263),
+         VMSTATE_END_OF_LIST()
+     }
+ };
+diff --git a/hw/usb/hcd-xhci.h b/hw/usb/hcd-xhci.h
+index 98f598382a..50a7b6f6c4 100644
+--- a/hw/usb/hcd-xhci.h
++++ b/hw/usb/hcd-xhci.h
+@@ -149,6 +149,8 @@ typedef struct XHCIEvent {
+     uint32_t flags;
+     uint8_t slotid;
+     uint8_t epid;
++    uint8_t cve_2014_5263_a;
++    uint8_t cve_2014_5263_b;
+ } XHCIEvent;
+ 
+ typedef struct XHCIInterrupter {
+diff --git a/include/hw/acpi/ich9.h b/include/hw/acpi/ich9.h
+index 7ca92843c6..21abfd8447 100644
+--- a/include/hw/acpi/ich9.h
++++ b/include/hw/acpi/ich9.h
+@@ -68,6 +68,9 @@ typedef struct ICH9LPCPMRegs {
+     bool smm_compat;
+     bool enable_tco;
+     TCOIORegs tco_regs;
++
++    /* RH addition, see bz 1489800 */
++    bool force_rev1_fadt;
+ } ICH9LPCPMRegs;
+ 
+ #define ACPI_PM_PROP_TCO_ENABLED "enable_tco"
 diff --git a/include/hw/boards.h b/include/hw/boards.h
-index c92ac8815c..c90a19b4d1 100644
+index 9c1c190104..8bba96ef2b 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
-@@ -449,4 +449,25 @@ extern const size_t hw_compat_2_2_len;
+@@ -441,4 +441,40 @@ extern const size_t hw_compat_2_2_len;
  extern GlobalProperty hw_compat_2_1[];
  extern const size_t hw_compat_2_1_len;
  
@@ -582,13 +978,28 @@ index c92ac8815c..c90a19b4d1 100644
 +
 +extern GlobalProperty hw_compat_rhel_7_6[];
 +extern const size_t hw_compat_rhel_7_6_len;
++
++extern GlobalProperty hw_compat_rhel_7_5[];
++extern const size_t hw_compat_rhel_7_5_len;
++
++extern GlobalProperty hw_compat_rhel_7_4[];
++extern const size_t hw_compat_rhel_7_4_len;
++
++extern GlobalProperty hw_compat_rhel_7_3[];
++extern const size_t hw_compat_rhel_7_3_len;
++
++extern GlobalProperty hw_compat_rhel_7_2[];
++extern const size_t hw_compat_rhel_7_2_len;
++
++extern GlobalProperty hw_compat_rhel_7_1[];
++extern const size_t hw_compat_rhel_7_1_len;
 +
  #endif
 diff --git a/include/hw/firmware/smbios.h b/include/hw/firmware/smbios.h
-index 4b7ad77a44..9acff96a86 100644
+index 5a0dd0c8cf..2cb1ec2bab 100644
 --- a/include/hw/firmware/smbios.h
 +++ b/include/hw/firmware/smbios.h
-@@ -272,7 +272,10 @@ void smbios_entry_add(QemuOpts *opts, Error **errp);
+@@ -278,7 +278,10 @@ void smbios_entry_add(QemuOpts *opts, Error **errp);
  void smbios_set_cpuid(uint32_t version, uint32_t features);
  void smbios_set_defaults(const char *manufacturer, const char *product,
                           const char *version, bool legacy_mode,
@@ -601,10 +1012,10 @@ index 4b7ad77a44..9acff96a86 100644
  void smbios_get_tables(MachineState *ms,
                         const struct smbios_phys_mem_area *mem_array,
 diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
-index 1a27de9c8b..91331059d9 100644
+index 9ab39e428f..7ccc9a1a07 100644
 --- a/include/hw/i386/pc.h
 +++ b/include/hw/i386/pc.h
-@@ -113,6 +113,9 @@ struct PCMachineClass {
+@@ -107,6 +107,9 @@ struct PCMachineClass {
      bool smbios_defaults;
      bool smbios_legacy_mode;
      bool smbios_uuid_encoded;
@@ -614,6 +1025,47 @@ index 1a27de9c8b..91331059d9 100644
  
      /* RAM / address space compat: */
      bool gigabyte_align;
+diff --git a/include/hw/usb.h b/include/hw/usb.h
+index 33668dd0a9..e6b2fe72da 100644
+--- a/include/hw/usb.h
++++ b/include/hw/usb.h
+@@ -582,4 +582,7 @@ void usb_pcap_init(FILE *fp);
+ void usb_pcap_ctrl(USBPacket *p, bool setup);
+ void usb_pcap_data(USBPacket *p, bool setup);
+ 
++/* hcd-xhci.c -- rhel7.0.0 machine type compatibility */
++extern bool migrate_cve_2014_5263_xhci_fields;
++
+ #endif
+diff --git a/migration/migration.c b/migration/migration.c
+index abaf6f9e3d..a87ff01b81 100644
+--- a/migration/migration.c
++++ b/migration/migration.c
+@@ -164,6 +164,8 @@ INITIALIZE_MIGRATE_CAPS_SET(check_caps_background_snapshot,
+     MIGRATION_CAPABILITY_X_COLO,
+     MIGRATION_CAPABILITY_VALIDATE_UUID);
+ 
++bool migrate_pre_2_2;
++
+ /* When we add fault tolerance, we could have several
+    migrations at once.  For now we don't need to add
+    dynamic creation of migration */
+diff --git a/migration/migration.h b/migration/migration.h
+index 8130b703eb..d016cedd9d 100644
+--- a/migration/migration.h
++++ b/migration/migration.h
+@@ -381,6 +381,11 @@ bool check_dirty_bitmap_mig_alias_map(const BitmapMigrationNodeAliasList *bbm,
+ void migrate_add_address(SocketAddress *address);
+ 
+ int foreach_not_ignored_block(RAMBlockIterFunc func, void *opaque);
++/*
++ * Disables a load of subsections that were added in 2.2/rh7.2 for backwards
++ * migration compatibility.
++ */
++extern bool migrate_pre_2_2;
+ 
+ #define qemu_ram_foreach_block \
+   #warning "Use foreach_not_ignored_block in migration code"
 -- 
-2.31.1
+2.27.0
 

SOURCES/0008-Add-aarch64-machine-types.patch

@@ -1,4 +1,4 @@
-From 697aaa43e3c0f20fc312f06be6c1093f1ba907e1 Mon Sep 17 00:00:00 2001
+From 670e90f5cbd92189155e079b8c6e2aafdf82d162 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 12:53:31 +0200
 Subject: Add aarch64 machine types
@@ -6,39 +6,87 @@ Subject: Add aarch64 machine types
 Adding changes to add RHEL machine types for aarch64 architecture.
 
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
----
-Rebase notes (6.1.0):
-- Use CONFIG_TPM check when using TPM structures
+
+Rebase notes (4.0.0):
+- Use upstream compat handling
+
+Rebase notes (4.1.0-rc0):
+- Removed a15memmap (upstream)
+- Use virt_flash_create in rhel800_virt_instance_init
+
+Rebase notes (4.2.0-rc0):
+- Set numa_mem_supported
+
+Rebase notes (4.2.0-rc3):
+- aarch64: Add virt-rhel8.2.0 machine type for ARM (patch 92246)
+- aarch64: virt: Allow more than 1TB of RAM (patch 92249)
+- aarch64: virt: Allow PCDIMM instantiation (patch 92247)
+- aarch64: virt: Enhance the comment related to gic-version (patch 92248)
+
+Rebase notes (5.0.0):
+- Set default_ram_id in rhel_machine_class_init
+- Added setting acpi properties
+
+Rebase notes (5.1.0):
+- Added ras property
+- Added to virt_machine_device_unplug_cb to machine type (upstream)
+- added mte property (upstream)
+
+Rebase notes (weekly-210210):
+- Added support for oem fields to machine type
+
+Rebase notes (weekly-210303):
+- Use rhel-8.4.0 hw compat
+
+Rebase notes (6.0.0-rc2):
+- renamed oem-id and oem-table-id to x-oem-id and x-oem-table-id
+
+Rebase notes (210623):
+- Protect TPM functions by CONFIG_TPM ifdef
+
+Rebase notes (6.1.0-rc0):
 - Add support for default_bus_bypass_iommu
-- ea4c0b32d9 arm/virt: Register highmem and gic-version as class properties
-- 895e1fa86a hw/arm/virt: Add 8.5 and 9.0 machine types and remove older ones
 
-Rebase notes (7.0.0):
-- Added dtb-kaslr-seed option
-- Set no_tcg_lpa2 to true
+Merged patches (4.0.0):
+- 7bfdb4c aarch64: Add virt-rhel8.0.0 machine type for ARM
+- 3433e69 aarch64: Set virt-rhel8.0.0 max_cpus to 512
+- 4d20863 aarch64: Use 256MB ECAM region by default
 
-Merged patches (6.2.0):
-- 9a3d4fde0e hw/arm/virt: Remove 9.0 machine type
-- f7d04d6695 hw: arm: virt: Add hw_compat_rhel_8_5 to 8.5 machine type
+Merged patches (4.1.0):
+- c3e39ef aarch64: Add virt-rhel8.1.0 machine type for ARM
+- 59a46d1 aarch64: Allow ARM VIRT iommu option in RHEL8.1 machine
 
-Merged patches (7.0.0):
-- 3b82be3dd3 redhat: virt-rhel8.5.0: Update machine type compatibility for QEMU 6.2.0 update
-- c354a86c9b hw/arm/virt: Register "iommu" as a class property
-- c1a2630dc9 hw/arm/virt: Register "its" as a class property
-- 9d8c61dc93 hw/arm/virt: Rename default_bus_bypass_iommu
-- a1d1b6eeb6 hw/arm/virt: Expose the 'RAS' option
-- 47f8fe1b82 hw/arm/virt: Add 9.0 machine type and remove 8.5 one
-- ed2346788f hw/arm/virt: Check no_tcg_its and minor style changes
+Merged patches (5.2.0 rc0):
+- 12990ad hw/arm: Changes to rhel820 machine
+- 46d5a79 hw/arm: Introduce rhel_virt_instance_init() helper
+- 098954a hw/arm: Add rhel830 machine type
+- ee8e99d arm: Set correct max_cpus value on virt-rhel* machine types
+- e5edd38 RHEL-only: arm/virt: Allow the TPM_TIS_SYSBUS device dynamic allocation in machvirt
+- 6d7ba66 machine types/numa: set numa_mem_supported on old machine types (partialy)
+- 25c5644 machine_types/numa: compatibility for auto_enable_numa_with_memdev (partialy)
+
+Merged patches (6.0):
+- 078fadb5da AArch64 machine types cleanup
+- ea7b7425fa hw/arm/virt: Add 8.4 Machine type
+
+Merged patches (weekly-210609):
+- 73b1578882 hw/arm/virt: Add 8.5 machine type
+- 5333038d11 hw/arm/virt: Disable PL011 clock migration through hw_compat_rhel_8_3
+- 63adb8ae86 arm/virt: Register highmem and gic-version as class properties
+
+Merged patches (weekly-211027):
+- 86e3057c0a hw: arm: virt: Add hw_compat_rhel_8_5 to 8.5 machine type
 ---
- hw/arm/virt.c         | 234 +++++++++++++++++++++++++++++++++++++++++-
+ hw/arm/virt.c         | 226 +++++++++++++++++++++++++++++++++++++++++-
+ hw/core/machine.c     |   2 +
  include/hw/arm/virt.h |   8 ++
- 2 files changed, 241 insertions(+), 1 deletion(-)
+ 3 files changed, 235 insertions(+), 1 deletion(-)
 
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index 6a84031fd7..e06862d22a 100644
+index 5de4d9d73b..c77d26ab13 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
-@@ -80,6 +80,7 @@
+@@ -79,6 +79,7 @@
  #include "hw/char/pl011.h"
  #include "qemu/guest-random.h"
  
@@ -46,7 +94,7 @@ index 6a84031fd7..e06862d22a 100644
  #define DEFINE_VIRT_MACHINE_LATEST(major, minor, latest) \
      static void virt_##major##_##minor##_class_init(ObjectClass *oc, \
                                                      void *data) \
-@@ -106,7 +107,48 @@
+@@ -105,7 +106,48 @@
      DEFINE_VIRT_MACHINE_LATEST(major, minor, true)
  #define DEFINE_VIRT_MACHINE(major, minor) \
      DEFINE_VIRT_MACHINE_LATEST(major, minor, false)
@@ -96,7 +144,7 @@ index 6a84031fd7..e06862d22a 100644
  
  /* Number of external interrupt lines to configure the GIC with */
  #define NUM_IRQS 256
-@@ -2250,6 +2292,7 @@ static void machvirt_init(MachineState *machine)
+@@ -2180,6 +2222,7 @@ static void machvirt_init(MachineState *machine)
      qemu_add_machine_init_done_notifier(&vms->machine_done);
  }
  
@@ -104,7 +152,7 @@ index 6a84031fd7..e06862d22a 100644
  static bool virt_get_secure(Object *obj, Error **errp)
  {
      VirtMachineState *vms = VIRT_MACHINE(obj);
-@@ -2277,6 +2320,7 @@ static void virt_set_virt(Object *obj, bool value, Error **errp)
+@@ -2207,6 +2250,7 @@ static void virt_set_virt(Object *obj, bool value, Error **errp)
  
      vms->virt = value;
  }
@@ -112,15 +160,15 @@ index 6a84031fd7..e06862d22a 100644
  
  static bool virt_get_highmem(Object *obj, Error **errp)
  {
-@@ -2402,6 +2446,7 @@ static void virt_set_ras(Object *obj, bool value, Error **errp)
-     vms->ras = value;
+@@ -2304,6 +2348,7 @@ static void virt_set_acpi(Object *obj, Visitor *v, const char *name,
+     visit_type_OnOffAuto(v, name, &vms->acpi, errp);
  }
  
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
- static bool virt_get_mte(Object *obj, Error **errp)
+ static bool virt_get_ras(Object *obj, Error **errp)
  {
      VirtMachineState *vms = VIRT_MACHINE(obj);
-@@ -2415,6 +2460,7 @@ static void virt_set_mte(Object *obj, bool value, Error **errp)
+@@ -2331,6 +2376,7 @@ static void virt_set_mte(Object *obj, bool value, Error **errp)
  
      vms->mte = value;
  }
@@ -128,7 +176,7 @@ index 6a84031fd7..e06862d22a 100644
  
  static char *virt_get_gic_version(Object *obj, Error **errp)
  {
-@@ -2818,6 +2864,7 @@ static int virt_kvm_type(MachineState *ms, const char *type_str)
+@@ -2666,6 +2712,7 @@ static int virt_kvm_type(MachineState *ms, const char *type_str)
      return fixed_ipa ? 0 : requested_pa_size;
  }
  
@@ -136,7 +184,7 @@ index 6a84031fd7..e06862d22a 100644
  static void virt_machine_class_init(ObjectClass *oc, void *data)
  {
      MachineClass *mc = MACHINE_CLASS(oc);
-@@ -3206,3 +3253,188 @@ static void virt_machine_2_6_options(MachineClass *mc)
+@@ -3031,3 +3078,180 @@ static void virt_machine_2_6_options(MachineClass *mc)
      vmc->no_pmu = true;
  }
  DEFINE_VIRT_MACHINE(2, 6)
@@ -193,30 +241,6 @@ index 6a84031fd7..e06862d22a 100644
 +                                          "Set GIC version. "
 +                                          "Valid values are 2, 3, host and max");
 +
-+    object_class_property_add_str(oc, "iommu", virt_get_iommu, virt_set_iommu);
-+    object_class_property_set_description(oc, "iommu",
-+                                          "Set the IOMMU type. "
-+                                          "Valid values are none and smmuv3");
-+
-+    object_class_property_add_bool(oc, "default-bus-bypass-iommu",
-+                                   virt_get_default_bus_bypass_iommu,
-+                                   virt_set_default_bus_bypass_iommu);
-+    object_class_property_set_description(oc, "default-bus-bypass-iommu",
-+                                          "Set on/off to enable/disable "
-+                                          "bypass_iommu for default root bus");
-+
-+    object_class_property_add_bool(oc, "ras", virt_get_ras,
-+                                   virt_set_ras);
-+    object_class_property_set_description(oc, "ras",
-+                                          "Set on/off to enable/disable reporting host memory errors "
-+                                          "to a KVM guest using ACPI and guest external abort exceptions");
-+
-+    object_class_property_add_bool(oc, "its", virt_get_its,
-+                                   virt_set_its);
-+    object_class_property_set_description(oc, "its",
-+                                          "Set on/off to enable/disable "
-+                                          "ITS instantiation");
-+
 +    object_class_property_add_str(oc, "x-oem-id",
 +                                  virt_get_oem_id,
 +                                  virt_set_oem_id);
@@ -225,7 +249,6 @@ index 6a84031fd7..e06862d22a 100644
 +                                          "in ACPI table header."
 +                                          "The string may be up to 6 bytes in size");
 +
-+
 +    object_class_property_add_str(oc, "x-oem-table-id",
 +                                  virt_get_oem_table_id,
 +                                  virt_set_oem_table_id);
@@ -233,13 +256,10 @@ index 6a84031fd7..e06862d22a 100644
 +                                          "Override the default value of field OEM Table ID "
 +                                          "in ACPI table header."
 +                                          "The string may be up to 8 bytes in size");
++    object_class_property_add_bool(oc, "default_bus_bypass_iommu",
++                                   virt_get_default_bus_bypass_iommu,
++                                   virt_set_default_bus_bypass_iommu);
 +
-+    object_class_property_add_bool(oc, "dtb-kaslr-seed",
-+                                   virt_get_dtb_kaslr_seed,
-+                                   virt_set_dtb_kaslr_seed);
-+    object_class_property_set_description(oc, "dtb-kaslr-seed",
-+                                          "Set off to disable passing of kaslr-seed "
-+                                          "dtb node to guest");
 +}
 +
 +static void rhel_virt_instance_init(Object *obj)
@@ -264,19 +284,19 @@ index 6a84031fd7..e06862d22a 100644
 +    } else {
 +        /* Default allows ITS instantiation */
 +        vms->its = true;
-+
-+        if (vmc->no_tcg_its) {
-+            vms->tcg_its = false;
-+        } else {
-+            vms->tcg_its = true;
-+        }
++        object_property_add_bool(obj, "its", virt_get_its,
++                                 virt_set_its);
++        object_property_set_description(obj, "its",
++                                        "Set on/off to enable/disable "
++                                        "ITS instantiation");
 +    }
 +
 +    /* Default disallows iommu instantiation */
 +    vms->iommu = VIRT_IOMMU_NONE;
-+
-+    /* The default root bus is attached to iommu by default */
-+    vms->default_bus_bypass_iommu = false;
++    object_property_add_str(obj, "iommu", virt_get_iommu, virt_set_iommu);
++    object_property_set_description(obj, "iommu",
++                                    "Set the IOMMU type. "
++                                    "Valid values are none and smmuv3");
 +
 +    /* Default disallows RAS instantiation and is non-configurable for RHEL */
 +    vms->ras = false;
@@ -284,15 +304,13 @@ index 6a84031fd7..e06862d22a 100644
 +    /* MTE is disabled by default and non-configurable for RHEL */
 +    vms->mte = false;
 +
-+    /* Supply a kaslr-seed by default */
-+    vms->dtb_kaslr_seed = true;
-+
++    vms->default_bus_bypass_iommu = false;
 +    vms->irqmap = a15irqmap;
 +
 +    virt_flash_create(vms);
-+
 +    vms->oem_id = g_strndup(ACPI_BUILD_APPNAME6, 6);
 +    vms->oem_table_id = g_strndup(ACPI_BUILD_APPNAME8, 8);
++
 +}
 +
 +static const TypeInfo rhel_machine_info = {
@@ -315,21 +333,56 @@ index 6a84031fd7..e06862d22a 100644
 +}
 +type_init(rhel_machine_init);
 +
-+static void rhel900_virt_options(MachineClass *mc)
++static void rhel850_virt_options(MachineClass *mc)
++{
++    compat_props_add(mc->compat_props, arm_rhel_compat, arm_rhel_compat_len);
++    compat_props_add(mc->compat_props, hw_compat_rhel_8_5, hw_compat_rhel_8_5_len);
++}
++DEFINE_RHEL_MACHINE_AS_LATEST(8, 5, 0)
++
++static void rhel840_virt_options(MachineClass *mc)
++{
++    rhel850_virt_options(mc);
++    compat_props_add(mc->compat_props, hw_compat_rhel_8_4, hw_compat_rhel_8_4_len);
++}
++DEFINE_RHEL_MACHINE(8, 4, 0)
++
++static void rhel830_virt_options(MachineClass *mc)
 +{
 +    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
 +
-+    compat_props_add(mc->compat_props, arm_rhel_compat, arm_rhel_compat_len);
-+
-+    /* Disable FEAT_LPA2 since old kernels (<= v5.12) don't boot with that feature */
-+    vmc->no_tcg_lpa2 = true;
++    rhel840_virt_options(mc);
++    compat_props_add(mc->compat_props, hw_compat_rhel_8_3, hw_compat_rhel_8_3_len);
++    vmc->no_kvm_steal_time = true;
 +}
-+DEFINE_RHEL_MACHINE_AS_LATEST(9, 0, 0)
++DEFINE_RHEL_MACHINE(8, 3, 0)
++
++static void rhel820_virt_options(MachineClass *mc)
++{
++    rhel830_virt_options(mc);
++    compat_props_add(mc->compat_props, hw_compat_rhel_8_2, hw_compat_rhel_8_2_len);
++    mc->numa_mem_supported = true;
++    mc->auto_enable_numa_with_memdev = false;
++}
++DEFINE_RHEL_MACHINE(8, 2, 0)
+diff --git a/hw/core/machine.c b/hw/core/machine.c
+index be4f9864cd..62febde5aa 100644
+--- a/hw/core/machine.c
++++ b/hw/core/machine.c
+@@ -87,6 +87,8 @@ GlobalProperty hw_compat_rhel_8_3[] = {
+     { "nvme", "use-intel-id", "on"},
+     /* hw_compat_rhel_8_3 from hw_compat_5_1 */
+     { "pvpanic", "events", "1"}, /* PVPANIC_PANICKED */
++    /* hw_compat_rhel_8_3 from hw_compat_5_1 */
++    { "pl011", "migrate-clk", "off" },
+     /* hw_compat_rhel_8_3 bz 1912846 */
+     { "pci-xhci", "x-rh-late-msi-cap", "off" },
+     /* hw_compat_rhel_8_3 from hw_compat_5_1 */
 diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
-index 7e76ee2619..9b1efe8f0e 100644
+index dc6b66ffc8..9364628847 100644
 --- a/include/hw/arm/virt.h
 +++ b/include/hw/arm/virt.h
-@@ -179,9 +179,17 @@ struct VirtMachineState {
+@@ -175,9 +175,17 @@ struct VirtMachineState {
  
  #define VIRT_ECAM_ID(high) (high ? VIRT_HIGH_PCIE_ECAM : VIRT_PCIE_ECAM)
  
@@ -348,5 +401,5 @@ index 7e76ee2619..9b1efe8f0e 100644
  bool virt_is_acpi_enabled(VirtMachineState *vms);
  
 -- 
-2.31.1
+2.27.0
 

SOURCES/0009-Add-ppc64-machine-types.patch

@@ -1,4 +1,4 @@
-From f61b3d7dc000886e23943457ee9baf1d4cae43b4 Mon Sep 17 00:00:00 2001
+From 3c65320ce5b8ad3bb8c0d8fd13a88c464d5c5845 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 13:27:13 +0200
 Subject: Add ppc64 machine types
@@ -7,33 +7,66 @@ Adding changes to add RHEL machine types for ppc64 architecture.
 
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 
-Rebase notes (6.2.0):
-- Fixed rebase conflict relicts
-- Update machine type compat for 6.2 (from MR 66)
+Rebase changes (4.0.0):
+- remove instance options and use upstream solution
+- Use upstream compat handling
+- Replace SPAPR_PCI_2_7_MMIO_WIN_SIZE with value (changed upstream)
+- re-add handling of instance_options (removed upstream)
+- Use p8 as default for rhel machine types (p9 default upstream)
+- sPAPRMachineClass renamed to SpaprMachineClass (upstream)
 
-Merged patches (6.1.0):
-- c438c25ac3 redhat: Define pseries-rhel8.5.0 machine type
-- a3995e2eff Remove RHEL 7.0.0 machine type (only ppc64 changes)
-- ad3190a79b Remove RHEL 7.1.0 machine type (only ppc64 changes)
-- 84bbe15d4e Remove RHEL 7.2.0 machine type (only ppc64 changes)
-- 0215eb3356 Remove RHEL 7.3.0 machine types (only ppc64 changes)
-- af69d1ca6e Remove RHEL 7.4.0 machine types (only ppc64 changes)
-- 8f7a74ab78 Remove RHEL 7.5.0 machine types (only ppc64 changes)
+Rebase changes (4.1.0):
+- Update format for compat structures
+
+Rebase notes (weekly-210303):
+- Use rhel-8.4.0 hw compat
+
+Merged patches (4.0.0):
+- 467d59a redhat: define pseries-rhel8.0.0 machine type
+
+Merged patches (4.1.0):
+- f21757edc target/ppc/spapr: Enable mitigations by default for pseries-4.0 machine type
+- 2511c63 redhat: sync pseries-rhel7.6.0 with rhel-av-8.0.1
+- 89f01da redhat: define pseries-rhel8.1.0 machine type
+
+Merged patches (4.2.0):
+- bcba728 redhat: update pseries-rhel8.1.0 machine type
+- redhat: update pseries-rhel-7.6.0 machine type (patch 93039)
+- redhat: define pseries-rhel8.2.0 machine type (patch 93041)
+
+Merged patches (5.1.0):
+- eb121ff spapr: Enable DD2.3 accelerated count cache flush in pseries-5.0 machine (partial)
+
+Merged patches (5.2.0 rc0):
+- 311a20f redhat: define pseries-rhel8.3.0 machine type
+- 1284167 ppc: Set correct max_cpus value on spapr-rhel* machine types
+- 1ab8783 redhat: update pseries-rhel8.2.0 machine type
+- b162af531a target/ppc: Add experimental option for enabling secure guests
+
+Merged patches (weekly-201216):
+- 943c936df3 redhat: Add spapr_machine_rhel_default_class_options()
+- 030b5e6fba redhat: Define pseries-rhel8.4.0 machine type
+
+Merged patches (weekly-210602):
+- b7128d8ef7 redhat: Define pseries-rhel8.5.0 machine type
+
+Merged patches (weekly-211006):
+- c8f68b47e9 redhat: Update pseries-rhel8.5.0
 ---
- hw/ppc/spapr.c          | 243 ++++++++++++++++++++++++++++++++++++++++
- hw/ppc/spapr_cpu_core.c |  13 +++
+ hw/ppc/spapr.c          | 382 ++++++++++++++++++++++++++++++++++++++++
+ hw/ppc/spapr_cpu_core.c |  13 ++
  include/hw/ppc/spapr.h  |   4 +
- target/ppc/compat.c     |  13 ++-
+ target/ppc/compat.c     |  13 +-
  target/ppc/cpu.h        |   1 +
- target/ppc/kvm.c        |  27 +++++
- target/ppc/kvm_ppc.h    |  13 +++
- 7 files changed, 313 insertions(+), 1 deletion(-)
+ target/ppc/kvm.c        |  27 +++
+ target/ppc/kvm_ppc.h    |  13 ++
+ 7 files changed, 452 insertions(+), 1 deletion(-)
 
 diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
-index a4372ba189..5fdf8b506d 100644
+index 3b5fd749be..cace86028d 100644
 --- a/hw/ppc/spapr.c
 +++ b/hw/ppc/spapr.c
-@@ -1622,6 +1622,9 @@ static void spapr_machine_reset(MachineState *machine)
+@@ -1593,6 +1593,9 @@ static void spapr_machine_reset(MachineState *machine)
  
      pef_kvm_reset(machine->cgs, &error_fatal);
      spapr_caps_apply(spapr);
@@ -43,7 +76,7 @@ index a4372ba189..5fdf8b506d 100644
  
      first_ppc_cpu = POWERPC_CPU(first_cpu);
      if (kvm_enabled() && kvmppc_has_cap_mmu_radix() &&
-@@ -3317,6 +3320,20 @@ static void spapr_set_host_serial(Object *obj, const char *value, Error **errp)
+@@ -3288,6 +3291,20 @@ static void spapr_set_host_serial(Object *obj, const char *value, Error **errp)
      spapr->host_serial = g_strdup(value);
  }
  
@@ -64,7 +97,7 @@ index a4372ba189..5fdf8b506d 100644
  static void spapr_instance_init(Object *obj)
  {
      SpaprMachineState *spapr = SPAPR_MACHINE(obj);
-@@ -3395,6 +3412,12 @@ static void spapr_instance_init(Object *obj)
+@@ -3366,6 +3383,12 @@ static void spapr_instance_init(Object *obj)
          spapr_get_host_serial, spapr_set_host_serial);
      object_property_set_description(obj, "host-serial",
          "Host serial number to advertise in guest device tree");
@@ -77,7 +110,7 @@ index a4372ba189..5fdf8b506d 100644
  }
  
  static void spapr_machine_finalizefn(Object *obj)
-@@ -4652,6 +4675,7 @@ static void spapr_machine_class_init(ObjectClass *oc, void *data)
+@@ -4614,6 +4637,7 @@ static void spapr_machine_class_init(ObjectClass *oc, void *data)
      vmc->client_architecture_support = spapr_vof_client_architecture_support;
      vmc->quiesce = spapr_vof_quiesce;
      vmc->setprop = spapr_vof_setprop;
@@ -85,15 +118,15 @@ index a4372ba189..5fdf8b506d 100644
  }
  
  static const TypeInfo spapr_machine_info = {
-@@ -4703,6 +4727,7 @@ static void spapr_machine_latest_class_options(MachineClass *mc)
+@@ -4665,6 +4689,7 @@ static void spapr_machine_latest_class_options(MachineClass *mc)
      }                                                                \
      type_init(spapr_machine_register_##suffix)
  
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
  /*
-  * pseries-7.0
+  * pseries-6.2
   */
-@@ -4830,6 +4855,7 @@ static void spapr_machine_4_1_class_options(MachineClass *mc)
+@@ -4781,6 +4806,7 @@ static void spapr_machine_4_1_class_options(MachineClass *mc)
  }
  
  DEFINE_SPAPR_MACHINE(4_1, "4.1", false);
@@ -101,7 +134,7 @@ index a4372ba189..5fdf8b506d 100644
  
  /*
   * pseries-4.0
-@@ -4849,6 +4875,8 @@ static bool phb_placement_4_0(SpaprMachineState *spapr, uint32_t index,
+@@ -4800,6 +4826,8 @@ static bool phb_placement_4_0(SpaprMachineState *spapr, uint32_t index,
      *nv2atsd = 0;
      return true;
  }
@@ -110,7 +143,23 @@ index a4372ba189..5fdf8b506d 100644
  static void spapr_machine_4_0_class_options(MachineClass *mc)
  {
      SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
-@@ -5176,6 +5204,221 @@ static void spapr_machine_2_1_class_options(MachineClass *mc)
+@@ -4958,6 +4986,7 @@ DEFINE_SPAPR_MACHINE(2_8, "2.8", false);
+ /*
+  * pseries-2.7
+  */
++#endif
+ 
+ static bool phb_placement_2_7(SpaprMachineState *spapr, uint32_t index,
+                               uint64_t *buid, hwaddr *pio,
+@@ -5013,6 +5042,7 @@ static bool phb_placement_2_7(SpaprMachineState *spapr, uint32_t index,
+     return true;
+ }
+ 
++#if 0 /* Disabled for Red Hat Enterprise Linux */
+ static void spapr_machine_2_7_class_options(MachineClass *mc)
+ {
+     SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
+@@ -5127,6 +5157,358 @@ static void spapr_machine_2_1_class_options(MachineClass *mc)
      compat_props_add(mc->compat_props, hw_compat_2_1, hw_compat_2_1_len);
  }
  DEFINE_SPAPR_MACHINE(2_1, "2.1", false);
@@ -134,14 +183,10 @@ index a4372ba189..5fdf8b506d 100644
 +
 +static void spapr_machine_rhel850_class_options(MachineClass *mc)
 +{
-+    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
-+
 +    /* The default machine type must apply the RHEL specific defaults */
 +    spapr_machine_rhel_default_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_5,
 +                     hw_compat_rhel_8_5_len);
-+    smc->pre_6_2_numa_affinity = true;
-+    mc->smp_props.prefer_sockets = true;
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel850, "rhel8.5.0", true);
@@ -329,14 +374,155 @@ index a4372ba189..5fdf8b506d 100644
 +}
 +
 +DEFINE_SPAPR_MACHINE(rhel760sxxm, "rhel7.6.0-sxxm", false);
++
++static void spapr_machine_rhel750_class_options(MachineClass *mc)
++{
++    spapr_machine_rhel760_class_options(mc);
++    compat_props_add(mc->compat_props, hw_compat_rhel_7_5, hw_compat_rhel_7_5_len);
++
++}
++
++DEFINE_SPAPR_MACHINE(rhel750, "rhel7.5.0", false);
++
++/*
++ * pseries-rhel7.5.0-sxxm
++ *
++ * pseries-rhel7.5.0 with speculative execution exploit mitigations enabled by default
++ */
++
++static void spapr_machine_rhel750sxxm_class_options(MachineClass *mc)
++{
++    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
++
++    spapr_machine_rhel750_class_options(mc);
++    smc->default_caps.caps[SPAPR_CAP_CFPC] = SPAPR_CAP_WORKAROUND;
++    smc->default_caps.caps[SPAPR_CAP_SBBC] = SPAPR_CAP_WORKAROUND;
++    smc->default_caps.caps[SPAPR_CAP_IBS] = SPAPR_CAP_FIXED_CCD;
++}
++
++DEFINE_SPAPR_MACHINE(rhel750sxxm, "rhel7.5.0-sxxm", false);
++
++/*
++ * pseries-rhel7.4.0
++ * like spapr_compat_2_9
++ */
++GlobalProperty spapr_compat_rhel7_4[] = {
++    { TYPE_POWERPC_CPU, "pre-2.10-migration", "on" },
++};
++const size_t spapr_compat_rhel7_4_len = G_N_ELEMENTS(spapr_compat_rhel7_4);
++
++static void spapr_machine_rhel740_class_options(MachineClass *mc)
++{
++    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
++
++    spapr_machine_rhel750_class_options(mc);
++    compat_props_add(mc->compat_props, hw_compat_rhel_7_4, hw_compat_rhel_7_4_len);
++    compat_props_add(mc->compat_props, spapr_compat_rhel7_4, spapr_compat_rhel7_4_len);
++    smc->has_power9_support = false;
++    smc->pre_2_10_has_unused_icps = true;
++    smc->resize_hpt_default = SPAPR_RESIZE_HPT_DISABLED;
++    smc->default_caps.caps[SPAPR_CAP_HTM] = SPAPR_CAP_ON;
++}
++
++DEFINE_SPAPR_MACHINE(rhel740, "rhel7.4.0", false);
++
++/*
++ * pseries-rhel7.4.0-sxxm
++ *
++ * pseries-rhel7.4.0 with speculative execution exploit mitigations enabled by default
++ */
++
++static void spapr_machine_rhel740sxxm_class_options(MachineClass *mc)
++{
++    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
++
++    spapr_machine_rhel740_class_options(mc);
++    smc->default_caps.caps[SPAPR_CAP_CFPC] = SPAPR_CAP_WORKAROUND;
++    smc->default_caps.caps[SPAPR_CAP_SBBC] = SPAPR_CAP_WORKAROUND;
++    smc->default_caps.caps[SPAPR_CAP_IBS] = SPAPR_CAP_FIXED_CCD;
++}
++
++DEFINE_SPAPR_MACHINE(rhel740sxxm, "rhel7.4.0-sxxm", false);
++
++/*
++ * pseries-rhel7.3.0
++ * like spapr_compat_2_6/_2_7/_2_8 but "ddw" has been backported to RHEL7_3
++ */
++GlobalProperty spapr_compat_rhel7_3[] = {
++    { TYPE_SPAPR_PCI_HOST_BRIDGE, "mem_win_size", "0xf80000000" },
++    { TYPE_SPAPR_PCI_HOST_BRIDGE, "mem64_win_size", "0" },
++    { TYPE_POWERPC_CPU, "pre-2.8-migration", "on" },
++    { TYPE_SPAPR_PCI_HOST_BRIDGE, "pre-2.8-migration", "on" },
++    { TYPE_SPAPR_PCI_HOST_BRIDGE, "pcie-extended-configuration-space", "off" },
++};
++const size_t spapr_compat_rhel7_3_len = G_N_ELEMENTS(spapr_compat_rhel7_3);
++
++static void spapr_machine_rhel730_class_options(MachineClass *mc)
++{
++    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
++
++    spapr_machine_rhel740_class_options(mc);
++    mc->default_cpu_type = POWERPC_CPU_TYPE_NAME("power7_v2.3");
++    mc->default_machine_opts = "modern-hotplug-events=off";
++    compat_props_add(mc->compat_props, hw_compat_rhel_7_3, hw_compat_rhel_7_3_len);
++    compat_props_add(mc->compat_props, spapr_compat_rhel7_3, spapr_compat_rhel7_3_len);
++
++    smc->phb_placement = phb_placement_2_7;
++}
++
++DEFINE_SPAPR_MACHINE(rhel730, "rhel7.3.0", false);
++
++/*
++ * pseries-rhel7.3.0-sxxm
++ *
++ * pseries-rhel7.3.0 with speculative execution exploit mitigations enabled by default
++ */
++
++static void spapr_machine_rhel730sxxm_class_options(MachineClass *mc)
++{
++    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
++
++    spapr_machine_rhel730_class_options(mc);
++    smc->default_caps.caps[SPAPR_CAP_CFPC] = SPAPR_CAP_WORKAROUND;
++    smc->default_caps.caps[SPAPR_CAP_SBBC] = SPAPR_CAP_WORKAROUND;
++    smc->default_caps.caps[SPAPR_CAP_IBS] = SPAPR_CAP_FIXED_CCD;
++}
++
++DEFINE_SPAPR_MACHINE(rhel730sxxm, "rhel7.3.0-sxxm", false);
++
++/*
++ * pseries-rhel7.2.0
++ */
++/* Should be like spapr_compat_2_5 + 2_4 + 2_3, but "dynamic-reconfiguration"
++ * has been backported to RHEL7_2 so we don't need it here.
++ */
++
++GlobalProperty spapr_compat_rhel7_2[] = {
++    { "spapr-vlan", "use-rx-buffer-pools", "off" },
++    { TYPE_SPAPR_PCI_HOST_BRIDGE, "ddw", "off" },
++};
++const size_t spapr_compat_rhel7_2_len = G_N_ELEMENTS(spapr_compat_rhel7_2);
++
++static void spapr_machine_rhel720_class_options(MachineClass *mc)
++{
++    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
++
++    spapr_machine_rhel730_class_options(mc);
++    smc->use_ohci_by_default = true;
++    mc->has_hotpluggable_cpus = NULL;
++    compat_props_add(mc->compat_props, hw_compat_rhel_7_2, hw_compat_rhel_7_2_len);
++    compat_props_add(mc->compat_props, spapr_compat_rhel7_2, spapr_compat_rhel7_2_len);
++}
++
++DEFINE_SPAPR_MACHINE(rhel720, "rhel7.2.0", false);
  
  static void spapr_machine_register_types(void)
  {
 diff --git a/hw/ppc/spapr_cpu_core.c b/hw/ppc/spapr_cpu_core.c
-index fcb5dfe792..ab8fb5bf62 100644
+index 8ba34f6a1d..78eca1c04a 100644
 --- a/hw/ppc/spapr_cpu_core.c
 +++ b/hw/ppc/spapr_cpu_core.c
-@@ -25,6 +25,7 @@
+@@ -24,6 +24,7 @@
  #include "sysemu/reset.h"
  #include "sysemu/hw_accel.h"
  #include "qemu/error-report.h"
@@ -344,7 +530,7 @@ index fcb5dfe792..ab8fb5bf62 100644
  
  static void spapr_reset_vcpu(PowerPCCPU *cpu)
  {
-@@ -259,6 +260,7 @@ static bool spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
+@@ -250,6 +251,7 @@ static bool spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
  {
      CPUPPCState *env = &cpu->env;
      CPUState *cs = CPU(cpu);
@@ -352,9 +538,9 @@ index fcb5dfe792..ab8fb5bf62 100644
  
      if (!qdev_realize(DEVICE(cpu), NULL, errp)) {
          return false;
-@@ -270,6 +272,17 @@ static bool spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
-     /* Set time-base frequency to 512 MHz. vhyp must be set first. */
-     cpu_ppc_tb_init(env, SPAPR_TIMEBASE_FREQ);
+@@ -261,6 +263,17 @@ static bool spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
+     cpu_ppc_set_vhyp(cpu, PPC_VIRTUAL_HYPERVISOR(spapr));
+     kvmppc_set_papr(cpu);
  
 +    if (!smc->has_power9_support &&
 +        (((spapr->max_compat_pvr &&
@@ -371,7 +557,7 @@ index fcb5dfe792..ab8fb5bf62 100644
          qdev_unrealize(DEVICE(cpu));
          return false;
 diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
-index f5c33dcc86..4a68e0a901 100644
+index ee7504b976..37a014d59c 100644
 --- a/include/hw/ppc/spapr.h
 +++ b/include/hw/ppc/spapr.h
 @@ -154,6 +154,7 @@ struct SpaprMachineClass {
@@ -382,16 +568,16 @@ index f5c33dcc86..4a68e0a901 100644
      bool (*phb_placement)(SpaprMachineState *spapr, uint32_t index,
                            uint64_t *buid, hwaddr *pio,
                            hwaddr *mmio32, hwaddr *mmio64,
-@@ -241,6 +242,9 @@ struct SpaprMachineState {
+@@ -237,6 +238,9 @@ struct SpaprMachineState {
+ 
      /* Set by -boot */
      char *boot_device;
- 
++ 
 +    /* Secure Guest support via x-svm-allowed */
 +    bool svm_allowed;
-+
+ 
      /*< public >*/
      char *kvm_type;
-     char *host_model;
 diff --git a/target/ppc/compat.c b/target/ppc/compat.c
 index 7949a24f5a..f207a9ba01 100644
 --- a/target/ppc/compat.c
@@ -418,10 +604,10 @@ index 7949a24f5a..f207a9ba01 100644
      const CompatInfo *compat = compat_by_pvr(compat_pvr);
      const CompatInfo *min = compat_by_pvr(min_compat_pvr);
 diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
-index 047b24ba50..79c5ac50b9 100644
+index e946da5f3a..23e8b76c85 100644
 --- a/target/ppc/cpu.h
 +++ b/target/ppc/cpu.h
-@@ -1462,6 +1462,7 @@ static inline int cpu_mmu_index(CPUPPCState *env, bool ifetch)
+@@ -1401,6 +1401,7 @@ static inline int cpu_mmu_index(CPUPPCState *env, bool ifetch)
  
  /* Compatibility modes */
  #if defined(TARGET_PPC64)
@@ -524,5 +710,5 @@ index ee9325bf9a..20dbb95989 100644
  {
      return -1;
 -- 
-2.31.1
+2.27.0
 

SOURCES/0010-Add-s390x-machine-types.patch

@@ -1,4 +1,4 @@
-From 680f343e58a50a99d17bc7dedd3ee90980912023 Mon Sep 17 00:00:00 2001
+From 4ad9a0d0582eef78946b47563eb2c5b7ddf0cbb0 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 13:47:32 +0200
 Subject: Add s390x machine types
@@ -6,43 +6,38 @@ Subject: Add s390x machine types
 Adding changes to add RHEL machine types for s390x architecture.
 
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
---
-Merged patches (6.1.0):
-- 64a9a5c971 hw/s390x: Remove the RHEL7-only machine type
-- 395516d62b redhat: s390x: add rhel-8.5.0 compat machine
 
-Merged patches (6.2.0):
-- 3bf66f4520 redhat: Add s390x machine type compatibility update for 6.1 rebase
+Rebase changes (weekly-4.1.0):
+- Use upstream compat handling
 
-Merged patches (7.0.0):
-- e6ff4de4f7 redhat: Add s390x machine type compatibility handling for the rebase to v6.2
-- 4b0efa7e21 redhat: Add rhel8.6.0 and rhel9.0.0 machine types for s390x
-- dcc64971bf RHEL: mark old machine types as deprecated (partialy)
+Rebase notes (weekly-210303):
+- Use rhel-8.4.0 hw compat
+
+Merged patches (3.1.0):
+- 29df663 s390x/cpumodel: default enable bpb and ppa15 for z196 and later
+
+Merged patches (4.1.0):
+- 6c200d665b hw/s390x/s390-virtio-ccw: Add machine types for RHEL8.0.0
+
+Merged patches (4.2.0):
+- fb192e5 redhat: s390x: Rename s390-ccw-virtio-rhel8.0.0 to s390-ccw-virtio-rhel8.1.0
+- a9b22e8 redhat: s390x: Add proper compatibility options for the -rhel7.6.0 machine
+- hw/s390x: Add the s390-ccw-virtio-rhel8.2.0 machine types (patch 92954)
+
+Merged patches (weekly-201216):
+- a6ae745cce redhat: s390x: add rhel-8.4.0 compat machine
+
+Merged patches (weekly-210602):
+- 50835d3429 redhat: s390x: add rhel-8.5.0 compat machine
+
+Merged patches (weekly-211006):
+- a3bcde27fe redhat: Add s390x machine type compatibility update for 6.1 rebase
 ---
- hw/core/machine.c          |   6 +++
- hw/s390x/s390-virtio-ccw.c | 104 ++++++++++++++++++++++++++++++++++++-
- include/hw/boards.h        |   2 +
- 3 files changed, 111 insertions(+), 1 deletion(-)
+ hw/s390x/s390-virtio-ccw.c | 99 +++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 98 insertions(+), 1 deletion(-)
 
-diff --git a/hw/core/machine.c b/hw/core/machine.c
-index ea430d844e..77202a3570 100644
---- a/hw/core/machine.c
-+++ b/hw/core/machine.c
-@@ -37,6 +37,12 @@
- #include "hw/virtio/virtio.h"
- #include "hw/virtio/virtio-pci.h"
- 
-+/*
-+ * RHEL only: machine types for previous major releases are deprecated
-+ */
-+const char *rhel_old_machine_deprecation =
-+    "machine types for previous major releases are deprecated";
-+
- /*
-  * Mostly the same as hw_compat_6_0 and hw_compat_6_1
-  */
 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
-index 90480e7cf9..ec4176a1e0 100644
+index 653587ea62..181856e6cf 100644
 --- a/hw/s390x/s390-virtio-ccw.c
 +++ b/hw/s390x/s390-virtio-ccw.c
 @@ -767,7 +767,7 @@ bool css_migration_enabled(void)
@@ -59,61 +54,24 @@ index 90480e7cf9..ec4176a1e0 100644
      type_init(ccw_machine_register_##suffix)
  
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
- static void ccw_machine_7_0_instance_options(MachineState *machine)
+ static void ccw_machine_6_2_instance_options(MachineState *machine)
  {
  }
-@@ -1115,6 +1116,107 @@ static void ccw_machine_2_4_class_options(MachineClass *mc)
+@@ -1100,6 +1101,102 @@ static void ccw_machine_2_4_class_options(MachineClass *mc)
      compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
  }
  DEFINE_CCW_MACHINE(2_4, "2.4", false);
 +#endif
 +
-+static void ccw_machine_rhel900_instance_options(MachineState *machine)
-+{
-+}
-+
-+static void ccw_machine_rhel900_class_options(MachineClass *mc)
-+{
-+}
-+DEFINE_CCW_MACHINE(rhel900, "rhel9.0.0", true);
-+
-+static void ccw_machine_rhel860_instance_options(MachineState *machine)
-+{
-+    /* Note: The -rhel8.6.0 and -rhel9.0.0 machines are technically identical */
-+    ccw_machine_rhel900_instance_options(machine);
-+}
-+
-+static void ccw_machine_rhel860_class_options(MachineClass *mc)
-+{
-+    ccw_machine_rhel900_class_options(mc);
-+
-+    /* All RHEL machines for prior major releases are deprecated */
-+    mc->deprecation_reason = rhel_old_machine_deprecation;
-+}
-+DEFINE_CCW_MACHINE(rhel860, "rhel8.6.0", false);
-+
 +static void ccw_machine_rhel850_instance_options(MachineState *machine)
 +{
-+    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V6_0 };
-+
-+    ccw_machine_rhel860_instance_options(machine);
-+
-+    s390_set_qemu_cpu_model(0x2964, 13, 2, qemu_cpu_feat);
-+
-+    s390_cpudef_featoff_greater(16, 1, S390_FEAT_NNPA);
-+    s390_cpudef_featoff_greater(16, 1, S390_FEAT_VECTOR_PACKED_DECIMAL_ENH2);
-+    s390_cpudef_featoff_greater(16, 1, S390_FEAT_BEAR_ENH);
-+    s390_cpudef_featoff_greater(16, 1, S390_FEAT_RDP);
-+    s390_cpudef_featoff_greater(16, 1, S390_FEAT_PAI);
 +}
 +
 +static void ccw_machine_rhel850_class_options(MachineClass *mc)
 +{
-+    ccw_machine_rhel860_class_options(mc);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_8_5, hw_compat_rhel_8_5_len);
-+    mc->smp_props.prefer_sockets = true;
 +}
-+DEFINE_CCW_MACHINE(rhel850, "rhel8.5.0", false);
++DEFINE_CCW_MACHINE(rhel850, "rhel8.5.0", true);
 +
 +static void ccw_machine_rhel840_instance_options(MachineState *machine)
 +{
@@ -167,20 +125,41 @@ index 90480e7cf9..ec4176a1e0 100644
 +    compat_props_add(mc->compat_props, hw_compat_rhel_7_6, hw_compat_rhel_7_6_len);
 +}
 +DEFINE_CCW_MACHINE(rhel760, "rhel7.6.0", false);
++
++static void ccw_machine_rhel750_instance_options(MachineState *machine)
++{
++    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V2_11 };
++    ccw_machine_rhel760_instance_options(machine);
++
++    /* before 2.12 we emulated the very first z900, and RHEL 7.5 is
++       based on 2.10 */
++    s390_set_qemu_cpu_model(0x2064, 7, 1, qemu_cpu_feat);
++
++    /* bpb and ppa15 were only in the full model in RHEL 7.5 */
++    s390_cpudef_featoff_greater(11, 1, S390_FEAT_PPA15);
++    s390_cpudef_featoff_greater(11, 1, S390_FEAT_BPB);
++}
++
++GlobalProperty ccw_compat_rhel_7_5[] = {
++        {
++            .driver   = TYPE_SCLP_EVENT_FACILITY,
++            .property = "allow_all_mask_sizes",
++            .value    = "off",
++        },
++};
++const size_t ccw_compat_rhel_7_5_len = G_N_ELEMENTS(ccw_compat_rhel_7_5);
++
++static void ccw_machine_rhel750_class_options(MachineClass *mc)
++{
++    ccw_machine_rhel760_class_options(mc);
++    compat_props_add(mc->compat_props, hw_compat_rhel_7_5, hw_compat_rhel_7_5_len);
++    compat_props_add(mc->compat_props, ccw_compat_rhel_7_5, ccw_compat_rhel_7_5_len);
++    S390_CCW_MACHINE_CLASS(mc)->hpage_1m_allowed = false;
++}
++DEFINE_CCW_MACHINE(rhel750, "rhel7.5.0", false);
  
  static void ccw_machine_register_types(void)
  {
-diff --git a/include/hw/boards.h b/include/hw/boards.h
-index c90a19b4d1..bf59275f18 100644
---- a/include/hw/boards.h
-+++ b/include/hw/boards.h
-@@ -470,4 +470,6 @@ extern const size_t hw_compat_rhel_8_0_len;
- extern GlobalProperty hw_compat_rhel_7_6[];
- extern const size_t hw_compat_rhel_7_6_len;
- 
-+extern const char *rhel_old_machine_deprecation;
-+
- #endif
 -- 
-2.31.1
+2.27.0
 

SOURCES/0010-Add-x86_64-machine-types.patch

@@ -1,714 +0,0 @@
-From 427a575ca57966bc72e1ebf218081da530d435d7 Mon Sep 17 00:00:00 2001
-From: Miroslav Rezanina <mrezanin@redhat.com>
-Date: Fri, 19 Oct 2018 13:10:31 +0200
-Subject: Add x86_64 machine types
-
-Adding changes to add RHEL machine types for x86_64 architecture.
-
-Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
-
-Rebase notes (6.1.0):
-- Update qemu64 cpu spec
-
-Rebase notes (7.0.0):
-- Reset alias for all machine-types except latest one
-
-Merged patches (6.1.0):
-- 59c284ad3b x86: Add x86 rhel8.5 machine types
-- a8868b42fe redhat: x86: Enable 'kvm-asyncpf-int' by default
-- a3995e2eff Remove RHEL 7.0.0 machine type (only x86_64 changes)
-- ad3190a79b Remove RHEL 7.1.0 machine type (only x86_64 changes)
-- 84bbe15d4e Remove RHEL 7.2.0 machine type (only x86_64 changes)
-- 0215eb3356 Remove RHEL 7.3.0 machine types (only x86_64 changes)
-- af69d1ca6e Remove RHEL 7.4.0 machine types (only x86_64 changes)
-- 8f7a74ab78 Remove RHEL 7.5.0 machine types (only x86_64 changes)
-
-Merged patches (7.0.0):
-- eae7d8dd3c x86/rhel machine types: Add pc_rhel_8_5_compat
-- 6762f56469 x86/rhel machine types: Wire compat into q35 and i440fx
-- 5762101438 rhel machine types/x86: set prefer_sockets
-- 9ba9ddc632 x86: Add q35 RHEL 8.6.0 machine type
-- 6110d865e5 x86: Add q35 RHEL 9.0.0 machine type
-- dcc64971bf RHEL: mark old machine types as deprecated (partialy)
-- 6b396f182b RHEL: disable "seqpacket" for "vhost-vsock-device" in rhel8.6.0
----
- hw/core/machine.c          |  10 ++
- hw/i386/pc.c               | 135 +++++++++++++++++++++-
- hw/i386/pc_piix.c          |  79 ++++++++++++-
- hw/i386/pc_q35.c           | 227 ++++++++++++++++++++++++++++++++++++-
- hw/s390x/s390-virtio-ccw.c |   1 +
- include/hw/boards.h        |   5 +
- include/hw/i386/pc.h       |  24 ++++
- target/i386/kvm/kvm-cpu.c  |   1 +
- target/i386/kvm/kvm.c      |   4 +
- tests/qtest/pvpanic-test.c |   5 +-
- 10 files changed, 484 insertions(+), 7 deletions(-)
-
-diff --git a/hw/core/machine.c b/hw/core/machine.c
-index 77202a3570..28989b6e7b 100644
---- a/hw/core/machine.c
-+++ b/hw/core/machine.c
-@@ -43,6 +43,16 @@
- const char *rhel_old_machine_deprecation =
-     "machine types for previous major releases are deprecated";
- 
-+GlobalProperty hw_compat_rhel_8_6[] = {
-+    /* hw_compat_rhel_8_6 bz 2065589 */
-+    /*
-+     * vhost-vsock device in RHEL 8 kernels doesn't support seqpacket, so
-+     * we need do disable it downstream on the latest hw_compat_rhel_8.
-+     */
-+    { "vhost-vsock-device", "seqpacket", "off" },
-+};
-+const size_t hw_compat_rhel_8_6_len = G_N_ELEMENTS(hw_compat_rhel_8_6);
-+
- /*
-  * Mostly the same as hw_compat_6_0 and hw_compat_6_1
-  */
-diff --git a/hw/i386/pc.c b/hw/i386/pc.c
-index fd55fc725c..263d882af6 100644
---- a/hw/i386/pc.c
-+++ b/hw/i386/pc.c
-@@ -375,6 +375,137 @@ GlobalProperty pc_compat_1_4[] = {
- };
- const size_t pc_compat_1_4_len = G_N_ELEMENTS(pc_compat_1_4);
- 
-+/* This macro is for changes to properties that are RHEL specific,
-+ * different to the current upstream and to be applied to the latest
-+ * machine type.
-+ */
-+GlobalProperty pc_rhel_compat[] = {
-+    { TYPE_X86_CPU, "host-phys-bits", "on" },
-+    { TYPE_X86_CPU, "host-phys-bits-limit", "48" },
-+    { TYPE_X86_CPU, "vmx-entry-load-perf-global-ctrl", "off" },
-+    { TYPE_X86_CPU, "vmx-exit-load-perf-global-ctrl", "off" },
-+    /* bz 1508330 */ 
-+    { "vfio-pci", "x-no-geforce-quirks", "on" },
-+    /* bz 1941397 */
-+    { TYPE_X86_CPU, "kvm-asyncpf-int", "on" },
-+};
-+const size_t pc_rhel_compat_len = G_N_ELEMENTS(pc_rhel_compat);
-+
-+GlobalProperty pc_rhel_8_5_compat[] = {
-+    /* pc_rhel_8_5_compat from pc_compat_6_0 */
-+    { "qemu64" "-" TYPE_X86_CPU, "family", "6" },
-+    /* pc_rhel_8_5_compat from pc_compat_6_0 */
-+    { "qemu64" "-" TYPE_X86_CPU, "model", "6" },
-+    /* pc_rhel_8_5_compat from pc_compat_6_0 */
-+    { "qemu64" "-" TYPE_X86_CPU, "stepping", "3" },
-+    /* pc_rhel_8_5_compat from pc_compat_6_0 */
-+    { TYPE_X86_CPU, "x-vendor-cpuid-only", "off" },
-+    /* pc_rhel_8_5_compat from pc_compat_6_0 */
-+    { "ICH9-LPC", ACPI_PM_PROP_ACPI_PCIHP_BRIDGE, "off" },
-+
-+    /* pc_rhel_8_5_compat from pc_compat_6_1 */
-+    { TYPE_X86_CPU, "hv-version-id-build", "0x1bbc" },
-+    /* pc_rhel_8_5_compat from pc_compat_6_1 */
-+    { TYPE_X86_CPU, "hv-version-id-major", "0x0006" },
-+    /* pc_rhel_8_5_compat from pc_compat_6_1 */
-+    { TYPE_X86_CPU, "hv-version-id-minor", "0x0001" },
-+};
-+const size_t pc_rhel_8_5_compat_len = G_N_ELEMENTS(pc_rhel_8_5_compat);
-+
-+GlobalProperty pc_rhel_8_4_compat[] = {
-+    /* pc_rhel_8_4_compat from pc_compat_5_2 */
-+    { "ICH9-LPC", "x-smi-cpu-hotunplug", "off" },
-+    { TYPE_X86_CPU, "kvm-asyncpf-int", "off" },
-+};
-+const size_t pc_rhel_8_4_compat_len = G_N_ELEMENTS(pc_rhel_8_4_compat);
-+
-+GlobalProperty pc_rhel_8_3_compat[] = {
-+    /* pc_rhel_8_3_compat from pc_compat_5_1 */
-+    { "ICH9-LPC", "x-smi-cpu-hotplug", "off" },
-+};
-+const size_t pc_rhel_8_3_compat_len = G_N_ELEMENTS(pc_rhel_8_3_compat);
-+
-+GlobalProperty pc_rhel_8_2_compat[] = {
-+    /* pc_rhel_8_2_compat from pc_compat_4_2 */
-+    { "mch", "smbase-smram", "off" },
-+};
-+const size_t pc_rhel_8_2_compat_len = G_N_ELEMENTS(pc_rhel_8_2_compat);
-+
-+/* pc_rhel_8_1_compat is empty since pc_4_1_compat is */
-+GlobalProperty pc_rhel_8_1_compat[] = { };
-+const size_t pc_rhel_8_1_compat_len = G_N_ELEMENTS(pc_rhel_8_1_compat);
-+
-+GlobalProperty pc_rhel_8_0_compat[] = {
-+    /* pc_rhel_8_0_compat from pc_compat_3_1 */
-+    { "intel-iommu", "dma-drain", "off" },
-+    /* pc_rhel_8_0_compat from pc_compat_3_1 */
-+    { "Opteron_G3" "-" TYPE_X86_CPU, "rdtscp", "off" },
-+    /* pc_rhel_8_0_compat from pc_compat_3_1 */
-+    { "Opteron_G4" "-" TYPE_X86_CPU, "rdtscp", "off" },
-+    /* pc_rhel_8_0_compat from pc_compat_3_1 */
-+    { "Opteron_G4" "-" TYPE_X86_CPU, "npt", "off" },
-+    /* pc_rhel_8_0_compat from pc_compat_3_1 */
-+    { "Opteron_G4" "-" TYPE_X86_CPU, "nrip-save", "off" },
-+    /* pc_rhel_8_0_compat from pc_compat_3_1 */
-+    { "Opteron_G5" "-" TYPE_X86_CPU, "rdtscp", "off" },
-+    /* pc_rhel_8_0_compat from pc_compat_3_1 */
-+    { "Opteron_G5" "-" TYPE_X86_CPU, "npt", "off" },
-+    /* pc_rhel_8_0_compat from pc_compat_3_1 */
-+    { "Opteron_G5" "-" TYPE_X86_CPU, "nrip-save", "off" },
-+    /* pc_rhel_8_0_compat from pc_compat_3_1 */
-+    { "EPYC" "-" TYPE_X86_CPU, "npt", "off" },
-+    /* pc_rhel_8_0_compat from pc_compat_3_1 */
-+    { "EPYC" "-" TYPE_X86_CPU, "nrip-save", "off" },
-+    /* pc_rhel_8_0_compat from pc_compat_3_1 */
-+    { "EPYC-IBPB" "-" TYPE_X86_CPU, "npt", "off" },
-+    /* pc_rhel_8_0_compat from pc_compat_3_1 */
-+    { "EPYC-IBPB" "-" TYPE_X86_CPU, "nrip-save", "off" },
-+    /** The mpx=on entries from pc_compat_3_1 are in pc_rhel_7_6_compat **/
-+    /* pc_rhel_8_0_compat from pc_compat_3_1 */
-+    { "Cascadelake-Server" "-" TYPE_X86_CPU, "stepping", "5" },
-+    /* pc_rhel_8_0_compat from pc_compat_3_1 */
-+    { TYPE_X86_CPU, "x-intel-pt-auto-level", "off" },
-+};
-+const size_t pc_rhel_8_0_compat_len = G_N_ELEMENTS(pc_rhel_8_0_compat);
-+
-+/* Similar to PC_COMPAT_3_0 + PC_COMPAT_2_12, but:
-+ * all of the 2_12 stuff was already in 7.6 from bz 1481253
-+ * x-migrate-smi-count comes from PC_COMPAT_2_11 but
-+ * is really tied to kernel version so keep it off on 7.x
-+ * machine types irrespective of host.
-+ */
-+GlobalProperty pc_rhel_7_6_compat[] = {
-+    /* pc_rhel_7_6_compat from pc_compat_3_0 */ 
-+    { TYPE_X86_CPU, "x-hv-synic-kvm-only", "on" },
-+    /* pc_rhel_7_6_compat from pc_compat_3_0 */ 
-+    { "Skylake-Server" "-" TYPE_X86_CPU, "pku", "off" },
-+    /* pc_rhel_7_6_compat from pc_compat_3_0 */ 
-+    { "Skylake-Server-IBRS" "-" TYPE_X86_CPU, "pku", "off" },
-+    /* pc_rhel_7_6_compat from pc_compat_2_11 */ 
-+    { TYPE_X86_CPU, "x-migrate-smi-count", "off" },
-+    /* pc_rhel_7_6_compat from pc_compat_2_11 */ 
-+    { "Skylake-Client" "-" TYPE_X86_CPU, "mpx", "on" },
-+    /* pc_rhel_7_6_compat from pc_compat_2_11 */ 
-+    { "Skylake-Client-IBRS" "-" TYPE_X86_CPU, "mpx", "on" },
-+    /* pc_rhel_7_6_compat from pc_compat_2_11 */ 
-+    { "Skylake-Server" "-" TYPE_X86_CPU, "mpx", "on" },
-+    /* pc_rhel_7_6_compat from pc_compat_2_11 */ 
-+    { "Skylake-Server-IBRS" "-" TYPE_X86_CPU, "mpx", "on" },
-+    /* pc_rhel_7_6_compat from pc_compat_2_11 */ 
-+    { "Cascadelake-Server" "-" TYPE_X86_CPU, "mpx", "on" },
-+    /* pc_rhel_7_6_compat from pc_compat_2_11 */ 
-+    { "Icelake-Client" "-" TYPE_X86_CPU, "mpx", "on" },
-+    /* pc_rhel_7_6_compat from pc_compat_2_11 */ 
-+    { "Icelake-Server" "-" TYPE_X86_CPU, "mpx", "on" },
-+};
-+const size_t pc_rhel_7_6_compat_len = G_N_ELEMENTS(pc_rhel_7_6_compat);
-+
-+/*
-+ * The PC_RHEL_*_COMPAT serve the same purpose for RHEL-7 machine
-+ * types as the PC_COMPAT_* do for upstream types.
-+ * PC_RHEL_7_*_COMPAT apply both to i440fx and q35 types.
-+ */
-+
- GSIState *pc_gsi_create(qemu_irq **irqs, bool pci_enabled)
- {
-     GSIState *s;
-@@ -1738,6 +1869,7 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
-     pcmc->pvh_enabled = true;
-     pcmc->kvmclock_create_always = true;
-     assert(!mc->get_hotplug_handler);
-+    mc->async_pf_vmexit_disable = false;
-     mc->get_hotplug_handler = pc_get_hotplug_handler;
-     mc->hotplug_allowed = pc_hotplug_allowed;
-     mc->cpu_index_to_instance_props = x86_cpu_index_to_props;
-@@ -1748,7 +1880,8 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
-     mc->has_hotpluggable_cpus = true;
-     mc->default_boot_order = "cad";
-     mc->block_default_type = IF_IDE;
--    mc->max_cpus = 255;
-+    /* 240: max CPU count for RHEL */
-+    mc->max_cpus = 240;
-     mc->reset = pc_machine_reset;
-     mc->wakeup = pc_machine_wakeup;
-     hc->pre_plug = pc_machine_device_pre_plug_cb;
-diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
-index c797e98312..0cacc0d623 100644
---- a/hw/i386/pc_piix.c
-+++ b/hw/i386/pc_piix.c
-@@ -50,6 +50,7 @@
- #include "qapi/error.h"
- #include "qemu/error-report.h"
- #include "sysemu/xen.h"
-+#include "migration/migration.h"
- #ifdef CONFIG_XEN
- #include <xen/hvm/hvm_info_table.h>
- #include "hw/xen/xen_pt.h"
-@@ -174,8 +175,8 @@ static void pc_init1(MachineState *machine,
-     if (pcmc->smbios_defaults) {
-         MachineClass *mc = MACHINE_GET_CLASS(machine);
-         /* These values are guest ABI, do not change */
--        smbios_set_defaults("QEMU", "Standard PC (i440FX + PIIX, 1996)",
--                            mc->name, pcmc->smbios_legacy_mode,
-+        smbios_set_defaults("Red Hat", "KVM",
-+                            mc->desc, pcmc->smbios_legacy_mode,
-                             pcmc->smbios_uuid_encoded,
-                             pcmc->smbios_stream_product,
-                             pcmc->smbios_stream_version,
-@@ -314,6 +315,7 @@ static void pc_init1(MachineState *machine,
-  * hw_compat_*, pc_compat_*, or * pc_*_machine_options().
-  */
- 
-+#if 0 /* Disabled for Red Hat Enterprise Linux */
- static void pc_compat_2_3_fn(MachineState *machine)
- {
-     X86MachineState *x86ms = X86_MACHINE(machine);
-@@ -967,3 +969,76 @@ static void xenfv_3_1_machine_options(MachineClass *m)
- DEFINE_PC_MACHINE(xenfv, "xenfv-3.1", pc_xen_hvm_init,
-                   xenfv_3_1_machine_options);
- #endif
-+#endif  /* Disabled for Red Hat Enterprise Linux */
-+
-+/* Red Hat Enterprise Linux machine types */
-+
-+/* Options for the latest rhel7 machine type */
-+static void pc_machine_rhel7_options(MachineClass *m)
-+{
-+    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-+    m->family = "pc_piix_Y";
-+    m->default_machine_opts = "firmware=bios-256k.bin,hpet=off";
-+    pcmc->default_nic_model = "e1000";
-+    pcmc->pci_root_uid = 0;
-+    m->default_display = "std";
-+    m->no_parallel = 1;
-+    m->numa_mem_supported = true;
-+    m->auto_enable_numa_with_memdev = false;
-+    machine_class_allow_dynamic_sysbus_dev(m, TYPE_RAMFB_DEVICE);
-+    compat_props_add(m->compat_props, pc_rhel_compat, pc_rhel_compat_len);
-+    m->alias = "pc";
-+    m->is_default = 1;
-+    m->smp_props.prefer_sockets = true;
-+}
-+
-+static void pc_init_rhel760(MachineState *machine)
-+{
-+    pc_init1(machine, TYPE_I440FX_PCI_HOST_BRIDGE, \
-+             TYPE_I440FX_PCI_DEVICE);
-+}
-+
-+static void pc_machine_rhel760_options(MachineClass *m)
-+{
-+    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-+    pc_machine_rhel7_options(m);
-+    m->desc = "RHEL 7.6.0 PC (i440FX + PIIX, 1996)";
-+    m->async_pf_vmexit_disable = true;
-+    m->smbus_no_migration_support = true;
-+
-+    /* All RHEL machines for prior major releases are deprecated */
-+    m->deprecation_reason = rhel_old_machine_deprecation;
-+
-+    pcmc->pvh_enabled = false;
-+    pcmc->default_cpu_version = CPU_VERSION_LEGACY;
-+    pcmc->kvmclock_create_always = false;
-+    /* From pc_i440fx_5_1_machine_options() */
-+    pcmc->pci_root_uid = 1;
-+    compat_props_add(m->compat_props, hw_compat_rhel_8_6,
-+                     hw_compat_rhel_8_6_len);
-+    compat_props_add(m->compat_props, hw_compat_rhel_8_5,
-+                     hw_compat_rhel_8_5_len);
-+    compat_props_add(m->compat_props, pc_rhel_8_5_compat,
-+                     pc_rhel_8_5_compat_len);
-+    compat_props_add(m->compat_props, hw_compat_rhel_8_4,
-+                     hw_compat_rhel_8_4_len);
-+    compat_props_add(m->compat_props, pc_rhel_8_4_compat,
-+                     pc_rhel_8_4_compat_len);
-+    compat_props_add(m->compat_props, hw_compat_rhel_8_3,
-+                     hw_compat_rhel_8_3_len);
-+    compat_props_add(m->compat_props, pc_rhel_8_3_compat,
-+                     pc_rhel_8_3_compat_len);
-+    compat_props_add(m->compat_props, hw_compat_rhel_8_2,
-+                     hw_compat_rhel_8_2_len);
-+    compat_props_add(m->compat_props, pc_rhel_8_2_compat,
-+                     pc_rhel_8_2_compat_len);
-+    compat_props_add(m->compat_props, hw_compat_rhel_8_1, hw_compat_rhel_8_1_len);
-+    compat_props_add(m->compat_props, pc_rhel_8_1_compat, pc_rhel_8_1_compat_len);
-+    compat_props_add(m->compat_props, hw_compat_rhel_8_0, hw_compat_rhel_8_0_len);
-+    compat_props_add(m->compat_props, pc_rhel_8_0_compat, pc_rhel_8_0_compat_len);
-+    compat_props_add(m->compat_props, hw_compat_rhel_7_6, hw_compat_rhel_7_6_len);
-+    compat_props_add(m->compat_props, pc_rhel_7_6_compat, pc_rhel_7_6_compat_len);
-+}
-+
-+DEFINE_PC_MACHINE(rhel760, "pc-i440fx-rhel7.6.0", pc_init_rhel760,
-+                  pc_machine_rhel760_options);
-diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
-index b695f88c45..157160e069 100644
---- a/hw/i386/pc_q35.c
-+++ b/hw/i386/pc_q35.c
-@@ -197,8 +197,8 @@ static void pc_q35_init(MachineState *machine)
- 
-     if (pcmc->smbios_defaults) {
-         /* These values are guest ABI, do not change */
--        smbios_set_defaults("QEMU", "Standard PC (Q35 + ICH9, 2009)",
--                            mc->name, pcmc->smbios_legacy_mode,
-+        smbios_set_defaults("Red Hat", "KVM",
-+                            mc->desc, pcmc->smbios_legacy_mode,
-                             pcmc->smbios_uuid_encoded,
-                             pcmc->smbios_stream_product,
-                             pcmc->smbios_stream_version,
-@@ -342,6 +342,7 @@ static void pc_q35_init(MachineState *machine)
-     DEFINE_PC_MACHINE(suffix, name, pc_init_##suffix, optionfn)
- 
- 
-+#if 0 /* Disabled for Red Hat Enterprise Linux */
- static void pc_q35_machine_options(MachineClass *m)
- {
-     PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-@@ -631,3 +632,225 @@ static void pc_q35_2_4_machine_options(MachineClass *m)
- 
- DEFINE_Q35_MACHINE(v2_4, "pc-q35-2.4", NULL,
-                    pc_q35_2_4_machine_options);
-+#endif  /* Disabled for Red Hat Enterprise Linux */
-+
-+/* Red Hat Enterprise Linux machine types */
-+
-+/* Options for the latest rhel q35 machine type */
-+static void pc_q35_machine_rhel_options(MachineClass *m)
-+{
-+    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-+    pcmc->default_nic_model = "e1000e";
-+    pcmc->pci_root_uid = 0;
-+    m->family = "pc_q35_Z";
-+    m->units_per_default_bus = 1;
-+    m->default_machine_opts = "firmware=bios-256k.bin,hpet=off";
-+    m->default_display = "std";
-+    m->no_floppy = 1;
-+    m->no_parallel = 1;
-+    pcmc->default_cpu_version = 1;
-+    machine_class_allow_dynamic_sysbus_dev(m, TYPE_AMD_IOMMU_DEVICE);
-+    machine_class_allow_dynamic_sysbus_dev(m, TYPE_INTEL_IOMMU_DEVICE);
-+    machine_class_allow_dynamic_sysbus_dev(m, TYPE_RAMFB_DEVICE);
-+    m->alias = "q35";
-+    m->max_cpus = 710;
-+    compat_props_add(m->compat_props, pc_rhel_compat, pc_rhel_compat_len);
-+}
-+
-+static void pc_q35_init_rhel900(MachineState *machine)
-+{
-+    pc_q35_init(machine);
-+}
-+
-+static void pc_q35_machine_rhel900_options(MachineClass *m)
-+{
-+    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-+    pc_q35_machine_rhel_options(m);
-+    m->desc = "RHEL-9.0.0 PC (Q35 + ICH9, 2009)";
-+    pcmc->smbios_stream_product = "RHEL";
-+    pcmc->smbios_stream_version = "9.0.0";
-+}
-+
-+DEFINE_PC_MACHINE(q35_rhel900, "pc-q35-rhel9.0.0", pc_q35_init_rhel900,
-+                  pc_q35_machine_rhel900_options);
-+
-+static void pc_q35_init_rhel860(MachineState *machine)
-+{
-+    pc_q35_init(machine);
-+}
-+
-+static void pc_q35_machine_rhel860_options(MachineClass *m)
-+{
-+    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-+    pc_q35_machine_rhel900_options(m);
-+    m->desc = "RHEL-8.6.0 PC (Q35 + ICH9, 2009)";
-+    m->alias = NULL;
-+
-+    /* All RHEL machines for prior major releases are deprecated */
-+    m->deprecation_reason = rhel_old_machine_deprecation;
-+
-+    pcmc->smbios_stream_product = "RHEL-AV";
-+    pcmc->smbios_stream_version = "8.6.0";
-+    compat_props_add(m->compat_props, hw_compat_rhel_8_6,
-+                     hw_compat_rhel_8_6_len);
-+}
-+
-+DEFINE_PC_MACHINE(q35_rhel860, "pc-q35-rhel8.6.0", pc_q35_init_rhel860,
-+                  pc_q35_machine_rhel860_options);
-+
-+
-+static void pc_q35_init_rhel850(MachineState *machine)
-+{
-+    pc_q35_init(machine);
-+}
-+
-+static void pc_q35_machine_rhel850_options(MachineClass *m)
-+{
-+    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-+    pc_q35_machine_rhel860_options(m);
-+    m->desc = "RHEL-8.5.0 PC (Q35 + ICH9, 2009)";
-+    m->alias = NULL;
-+    pcmc->smbios_stream_product = "RHEL-AV";
-+    pcmc->smbios_stream_version = "8.5.0";
-+    compat_props_add(m->compat_props, hw_compat_rhel_8_5,
-+                     hw_compat_rhel_8_5_len);
-+    compat_props_add(m->compat_props, pc_rhel_8_5_compat,
-+                     pc_rhel_8_5_compat_len);
-+    m->smp_props.prefer_sockets = true;
-+}
-+
-+DEFINE_PC_MACHINE(q35_rhel850, "pc-q35-rhel8.5.0", pc_q35_init_rhel850,
-+                  pc_q35_machine_rhel850_options);
-+
-+
-+static void pc_q35_init_rhel840(MachineState *machine)
-+{
-+    pc_q35_init(machine);
-+}
-+
-+static void pc_q35_machine_rhel840_options(MachineClass *m)
-+{
-+    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-+    pc_q35_machine_rhel850_options(m);
-+    m->desc = "RHEL-8.4.0 PC (Q35 + ICH9, 2009)";
-+    m->alias = NULL;
-+    pcmc->smbios_stream_product = "RHEL-AV";
-+    pcmc->smbios_stream_version = "8.4.0";
-+    compat_props_add(m->compat_props, hw_compat_rhel_8_4,
-+                     hw_compat_rhel_8_4_len);
-+    compat_props_add(m->compat_props, pc_rhel_8_4_compat,
-+                     pc_rhel_8_4_compat_len);
-+}
-+
-+DEFINE_PC_MACHINE(q35_rhel840, "pc-q35-rhel8.4.0", pc_q35_init_rhel840,
-+                  pc_q35_machine_rhel840_options);
-+
-+
-+static void pc_q35_init_rhel830(MachineState *machine)
-+{
-+    pc_q35_init(machine);
-+}
-+
-+static void pc_q35_machine_rhel830_options(MachineClass *m)
-+{
-+    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-+    pc_q35_machine_rhel840_options(m);
-+    m->desc = "RHEL-8.3.0 PC (Q35 + ICH9, 2009)";
-+    m->alias = NULL;
-+    pcmc->smbios_stream_product = "RHEL-AV";
-+    pcmc->smbios_stream_version = "8.3.0";
-+    compat_props_add(m->compat_props, hw_compat_rhel_8_3,
-+                     hw_compat_rhel_8_3_len);
-+    compat_props_add(m->compat_props, pc_rhel_8_3_compat,
-+                     pc_rhel_8_3_compat_len);
-+    /* From pc_q35_5_1_machine_options() */
-+    pcmc->kvmclock_create_always = false;
-+    /* From pc_q35_5_1_machine_options() */
-+    pcmc->pci_root_uid = 1;
-+}
-+
-+DEFINE_PC_MACHINE(q35_rhel830, "pc-q35-rhel8.3.0", pc_q35_init_rhel830,
-+                  pc_q35_machine_rhel830_options);
-+
-+static void pc_q35_init_rhel820(MachineState *machine)
-+{
-+    pc_q35_init(machine);
-+}
-+
-+static void pc_q35_machine_rhel820_options(MachineClass *m)
-+{
-+    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-+    pc_q35_machine_rhel830_options(m);
-+    m->desc = "RHEL-8.2.0 PC (Q35 + ICH9, 2009)";
-+    m->alias = NULL;
-+    m->numa_mem_supported = true;
-+    m->auto_enable_numa_with_memdev = false;
-+    pcmc->smbios_stream_product = "RHEL-AV";
-+    pcmc->smbios_stream_version = "8.2.0";
-+    compat_props_add(m->compat_props, hw_compat_rhel_8_2,
-+                     hw_compat_rhel_8_2_len);
-+    compat_props_add(m->compat_props, pc_rhel_8_2_compat,
-+                     pc_rhel_8_2_compat_len);
-+}
-+
-+DEFINE_PC_MACHINE(q35_rhel820, "pc-q35-rhel8.2.0", pc_q35_init_rhel820,
-+                  pc_q35_machine_rhel820_options);
-+
-+static void pc_q35_init_rhel810(MachineState *machine)
-+{
-+    pc_q35_init(machine);
-+}
-+
-+static void pc_q35_machine_rhel810_options(MachineClass *m)
-+{
-+    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-+    pc_q35_machine_rhel820_options(m);
-+    m->desc = "RHEL-8.1.0 PC (Q35 + ICH9, 2009)";
-+    m->alias = NULL;
-+    pcmc->smbios_stream_product = NULL;
-+    pcmc->smbios_stream_version = NULL;
-+    compat_props_add(m->compat_props, hw_compat_rhel_8_1, hw_compat_rhel_8_1_len);
-+    compat_props_add(m->compat_props, pc_rhel_8_1_compat, pc_rhel_8_1_compat_len);
-+}
-+
-+DEFINE_PC_MACHINE(q35_rhel810, "pc-q35-rhel8.1.0", pc_q35_init_rhel810,
-+                  pc_q35_machine_rhel810_options);
-+
-+static void pc_q35_init_rhel800(MachineState *machine)
-+{
-+    pc_q35_init(machine);
-+}
-+
-+static void pc_q35_machine_rhel800_options(MachineClass *m)
-+{
-+    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-+    pc_q35_machine_rhel810_options(m);
-+    m->desc = "RHEL-8.0.0 PC (Q35 + ICH9, 2009)";
-+    m->smbus_no_migration_support = true;
-+    m->alias = NULL;
-+    pcmc->pvh_enabled = false;
-+    pcmc->default_cpu_version = CPU_VERSION_LEGACY;
-+    compat_props_add(m->compat_props, hw_compat_rhel_8_0, hw_compat_rhel_8_0_len);
-+    compat_props_add(m->compat_props, pc_rhel_8_0_compat, pc_rhel_8_0_compat_len);
-+}
-+
-+DEFINE_PC_MACHINE(q35_rhel800, "pc-q35-rhel8.0.0", pc_q35_init_rhel800,
-+                  pc_q35_machine_rhel800_options);
-+
-+static void pc_q35_init_rhel760(MachineState *machine)
-+{
-+    pc_q35_init(machine);
-+}
-+
-+static void pc_q35_machine_rhel760_options(MachineClass *m)
-+{
-+    pc_q35_machine_rhel800_options(m);
-+    m->alias = NULL;
-+    m->desc = "RHEL-7.6.0 PC (Q35 + ICH9, 2009)";
-+    m->async_pf_vmexit_disable = true;
-+    compat_props_add(m->compat_props, hw_compat_rhel_7_6, hw_compat_rhel_7_6_len);
-+    compat_props_add(m->compat_props, pc_rhel_7_6_compat, pc_rhel_7_6_compat_len);
-+}
-+
-+DEFINE_PC_MACHINE(q35_rhel760, "pc-q35-rhel7.6.0", pc_q35_init_rhel760,
-+                  pc_q35_machine_rhel760_options);
-diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
-index ec4176a1e0..465a2a09d2 100644
---- a/hw/s390x/s390-virtio-ccw.c
-+++ b/hw/s390x/s390-virtio-ccw.c
-@@ -1136,6 +1136,7 @@ static void ccw_machine_rhel860_instance_options(MachineState *machine)
- static void ccw_machine_rhel860_class_options(MachineClass *mc)
- {
-     ccw_machine_rhel900_class_options(mc);
-+    compat_props_add(mc->compat_props, hw_compat_rhel_8_6, hw_compat_rhel_8_6_len);
- 
-     /* All RHEL machines for prior major releases are deprecated */
-     mc->deprecation_reason = rhel_old_machine_deprecation;
-diff --git a/include/hw/boards.h b/include/hw/boards.h
-index bf59275f18..d1555665df 100644
---- a/include/hw/boards.h
-+++ b/include/hw/boards.h
-@@ -266,6 +266,8 @@ struct MachineClass {
-     strList *allowed_dynamic_sysbus_devices;
-     bool auto_enable_numa_with_memhp;
-     bool auto_enable_numa_with_memdev;
-+    /* RHEL only */
-+    bool async_pf_vmexit_disable;
-     bool ignore_boot_device_suffixes;
-     bool smbus_no_migration_support;
-     bool nvdimm_supported;
-@@ -449,6 +451,9 @@ extern const size_t hw_compat_2_2_len;
- extern GlobalProperty hw_compat_2_1[];
- extern const size_t hw_compat_2_1_len;
- 
-+extern GlobalProperty hw_compat_rhel_8_6[];
-+extern const size_t hw_compat_rhel_8_6_len;
-+
- extern GlobalProperty hw_compat_rhel_8_5[];
- extern const size_t hw_compat_rhel_8_5_len;
- 
-diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
-index 91331059d9..419a6ec24b 100644
---- a/include/hw/i386/pc.h
-+++ b/include/hw/i386/pc.h
-@@ -289,6 +289,30 @@ extern const size_t pc_compat_1_5_len;
- extern GlobalProperty pc_compat_1_4[];
- extern const size_t pc_compat_1_4_len;
- 
-+extern GlobalProperty pc_rhel_compat[];
-+extern const size_t pc_rhel_compat_len;
-+
-+extern GlobalProperty pc_rhel_8_5_compat[];
-+extern const size_t pc_rhel_8_5_compat_len;
-+
-+extern GlobalProperty pc_rhel_8_4_compat[];
-+extern const size_t pc_rhel_8_4_compat_len;
-+
-+extern GlobalProperty pc_rhel_8_3_compat[];
-+extern const size_t pc_rhel_8_3_compat_len;
-+
-+extern GlobalProperty pc_rhel_8_2_compat[];
-+extern const size_t pc_rhel_8_2_compat_len;
-+
-+extern GlobalProperty pc_rhel_8_1_compat[];
-+extern const size_t pc_rhel_8_1_compat_len;
-+
-+extern GlobalProperty pc_rhel_8_0_compat[];
-+extern const size_t pc_rhel_8_0_compat_len;
-+
-+extern GlobalProperty pc_rhel_7_6_compat[];
-+extern const size_t pc_rhel_7_6_compat_len;
-+
- /* Helper for setting model-id for CPU models that changed model-id
-  * depending on QEMU versions up to QEMU 2.4.
-  */
-diff --git a/target/i386/kvm/kvm-cpu.c b/target/i386/kvm/kvm-cpu.c
-index 5eb955ce9a..74c1396a93 100644
---- a/target/i386/kvm/kvm-cpu.c
-+++ b/target/i386/kvm/kvm-cpu.c
-@@ -137,6 +137,7 @@ static PropValue kvm_default_props[] = {
-     { "acpi", "off" },
-     { "monitor", "off" },
-     { "svm", "off" },
-+    { "kvm-pv-unhalt", "on" },
-     { NULL, NULL },
- };
- 
-diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
-index 9cf8e03669..6d1e009443 100644
---- a/target/i386/kvm/kvm.c
-+++ b/target/i386/kvm/kvm.c
-@@ -3488,6 +3488,7 @@ static int kvm_get_msrs(X86CPU *cpu)
-     struct kvm_msr_entry *msrs = cpu->kvm_msr_buf->entries;
-     int ret, i;
-     uint64_t mtrr_top_bits;
-+    MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
- 
-     kvm_msr_buf_reset(cpu);
- 
-@@ -3822,6 +3823,9 @@ static int kvm_get_msrs(X86CPU *cpu)
-             break;
-         case MSR_KVM_ASYNC_PF_EN:
-             env->async_pf_en_msr = msrs[i].data;
-+            if (mc->async_pf_vmexit_disable) {
-+                env->async_pf_en_msr &= ~(1ULL << 2);
-+            }
-             break;
-         case MSR_KVM_ASYNC_PF_INT:
-             env->async_pf_int_msr = msrs[i].data;
-diff --git a/tests/qtest/pvpanic-test.c b/tests/qtest/pvpanic-test.c
-index 6dcad2db49..580c2c43d2 100644
---- a/tests/qtest/pvpanic-test.c
-+++ b/tests/qtest/pvpanic-test.c
-@@ -17,7 +17,7 @@ static void test_panic_nopause(void)
-     QDict *response, *data;
-     QTestState *qts;
- 
--    qts = qtest_init("-device pvpanic -action panic=none");
-+    qts = qtest_init("-M q35 -device pvpanic -action panic=none");
- 
-     val = qtest_inb(qts, 0x505);
-     g_assert_cmpuint(val, ==, 3);
-@@ -40,7 +40,8 @@ static void test_panic(void)
-     QDict *response, *data;
-     QTestState *qts;
- 
--    qts = qtest_init("-device pvpanic -action panic=pause");
-+    /* RHEL: Use q35 */
-+    qts = qtest_init("-M q35 -device pvpanic -action panic=pause");
- 
-     val = qtest_inb(qts, 0x505);
-     g_assert_cmpuint(val, ==, 3);
--- 
-2.31.1
-

SOURCES/0011-Enable-make-check.patch

@@ -1,186 +0,0 @@
-From 5e419e5e0a721bdbbfa6d9b82c8be5c5b3d26a01 Mon Sep 17 00:00:00 2001
-From: Miroslav Rezanina <mrezanin@redhat.com>
-Date: Wed, 2 Sep 2020 09:39:41 +0200
-Subject: Enable make check
-
-Fixing tests after device disabling and machine types changes and enabling
-make check run during build.
-
-Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
----
-Rebase changes (6.1.0):
-- removed unnecessary test changes
-
-Rebase changes (6.2.0):
-- new way of disabling bios-table-test
-
-Rebase changes (7.0.0):
-- Disable testing virtio-iommu-pci
-- Rename default_bus_bypass_iommu property to default-bus-bypass-iommu
-- Disable qtest-bios-table for aarch64
-- Removed redhat chunks for boot-serial-test.c, cdrom-test.c and cpu-plug-test.c qtests
-- Do not disable boot-order-test, prom-env-test and boot-serial-test qtests
-- Use rhel machine type for new intel hda qtest
-- Remove unnecessary changes in iotest 051
-- Remove changes in bios-tables-test.c and prom-env-test.c qtests
-
-Merged patches (6.1.0):
-- 2f129df7d3 redhat: Enable the 'test-block-iothread' test again
----
- .distro/qemu-kvm.spec.template      | 5 ++---
- tests/qtest/fuzz-e1000e-test.c      | 2 +-
- tests/qtest/fuzz-virtio-scsi-test.c | 2 +-
- tests/qtest/intel-hda-test.c        | 2 +-
- tests/qtest/libqos/meson.build      | 2 +-
- tests/qtest/lpc-ich9-test.c         | 2 +-
- tests/qtest/meson.build             | 4 ----
- tests/qtest/usb-hcd-xhci-test.c     | 4 ++++
- tests/qtest/virtio-net-failover.c   | 1 +
- 9 files changed, 12 insertions(+), 12 deletions(-)
-
-diff --git a/tests/qtest/fuzz-e1000e-test.c b/tests/qtest/fuzz-e1000e-test.c
-index 66229e6096..947fba73b7 100644
---- a/tests/qtest/fuzz-e1000e-test.c
-+++ b/tests/qtest/fuzz-e1000e-test.c
-@@ -17,7 +17,7 @@ static void test_lp1879531_eth_get_rss_ex_dst_addr(void)
- {
-     QTestState *s;
- 
--    s = qtest_init("-nographic -monitor none -serial none -M pc-q35-5.0");
-+    s = qtest_init("-nographic -monitor none -serial none -M pc-q35-rhel8.4.0");
- 
-     qtest_outl(s, 0xcf8, 0x80001010);
-     qtest_outl(s, 0xcfc, 0xe1020000);
-diff --git a/tests/qtest/fuzz-virtio-scsi-test.c b/tests/qtest/fuzz-virtio-scsi-test.c
-index aaf6d10e18..43727d62ac 100644
---- a/tests/qtest/fuzz-virtio-scsi-test.c
-+++ b/tests/qtest/fuzz-virtio-scsi-test.c
-@@ -19,7 +19,7 @@ static void test_mmio_oob_from_memory_region_cache(void)
- {
-     QTestState *s;
- 
--    s = qtest_init("-M pc-q35-5.2 -display none -m 512M "
-+    s = qtest_init("-M pc-q35-rhel8.4.0 -display none -m 512M "
-                    "-device virtio-scsi,num_queues=8,addr=03.0 ");
- 
-     qtest_outl(s, 0xcf8, 0x80001811);
-diff --git a/tests/qtest/intel-hda-test.c b/tests/qtest/intel-hda-test.c
-index a58c98e4d1..c8387e39ce 100644
---- a/tests/qtest/intel-hda-test.c
-+++ b/tests/qtest/intel-hda-test.c
-@@ -38,7 +38,7 @@ static void test_issue542_ich6(void)
- {
-     QTestState *s;
- 
--    s = qtest_init("-nographic -nodefaults -M pc-q35-6.2 "
-+    s = qtest_init("-nographic -nodefaults -M pc-q35-rhel9.0.0 "
-                    "-device intel-hda,id=" HDA_ID CODEC_DEVICES);
- 
-     qtest_outl(s, 0xcf8, 0x80000804);
-diff --git a/tests/qtest/libqos/meson.build b/tests/qtest/libqos/meson.build
-index e988d15791..46f7dcb81a 100644
---- a/tests/qtest/libqos/meson.build
-+++ b/tests/qtest/libqos/meson.build
-@@ -41,7 +41,7 @@ libqos_srcs = files('../libqtest.c',
-         'virtio-rng.c',
-         'virtio-scsi.c',
-         'virtio-serial.c',
--        'virtio-iommu.c',
-+#        'virtio-iommu.c',
- 
-         # qgraph machines:
-         'aarch64-xlnx-zcu102-machine.c',
-diff --git a/tests/qtest/lpc-ich9-test.c b/tests/qtest/lpc-ich9-test.c
-index fe0bef9980..7a9d51579b 100644
---- a/tests/qtest/lpc-ich9-test.c
-+++ b/tests/qtest/lpc-ich9-test.c
-@@ -15,7 +15,7 @@ static void test_lp1878642_pci_bus_get_irq_level_assert(void)
- {
-     QTestState *s;
- 
--    s = qtest_init("-M pc-q35-5.0 "
-+    s = qtest_init("-M pc-q35-rhel8.4.0 "
-                    "-nographic -monitor none -serial none");
- 
-     qtest_outl(s, 0xcf8, 0x8000f840); /* PMBASE */
-diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
-index d25f82bb5a..67cd32def1 100644
---- a/tests/qtest/meson.build
-+++ b/tests/qtest/meson.build
-@@ -73,7 +73,6 @@ qtests_i386 = \
-    config_all_devices.has_key('CONFIG_Q35') and                                             \
-    config_all_devices.has_key('CONFIG_VIRTIO_PCI') and                                      \
-    slirp.found() ? ['virtio-net-failover'] : []) +                                          \
--  (unpack_edk2_blobs ? ['bios-tables-test'] : []) +                                         \
-   qtests_pci +                                                                              \
-   ['fdc-test',
-    'ide-test',
-@@ -86,7 +85,6 @@ qtests_i386 = \
-    'drive_del-test',
-    'tco-test',
-    'cpu-plug-test',
--   'q35-test',
-    'vmgenid-test',
-    'migration-test',
-    'test-x86-cpuid-compat',
-@@ -216,7 +214,6 @@ qtests_arm = \
- 
- # TODO: once aarch64 TCG is fixed on ARM 32 bit host, make bios-tables-test unconditional
- qtests_aarch64 = \
--  (cpu != 'arm' and unpack_edk2_blobs ? ['bios-tables-test'] : []) +                            \
-   (config_all_devices.has_key('CONFIG_TPM_TIS_SYSBUS') ? ['tpm-tis-device-test'] : []) +        \
-   (config_all_devices.has_key('CONFIG_TPM_TIS_SYSBUS') ? ['tpm-tis-device-swtpm-test'] : []) +  \
-   (config_all_devices.has_key('CONFIG_XLNX_ZYNQMP_ARM') ? ['xlnx-can-test', 'fuzz-xlnx-dp-test'] : []) + \
-@@ -231,7 +228,6 @@ qtests_s390x = \
-   (config_host.has_key('CONFIG_POSIX') ? ['test-filter-redirector'] : []) +                     \
-   ['boot-serial-test',
-    'drive_del-test',
--   'device-plug-test',
-    'virtio-ccw-test',
-    'cpu-plug-test',
-    'migration-test']
-diff --git a/tests/qtest/usb-hcd-xhci-test.c b/tests/qtest/usb-hcd-xhci-test.c
-index 10ef9d2a91..3855873050 100644
---- a/tests/qtest/usb-hcd-xhci-test.c
-+++ b/tests/qtest/usb-hcd-xhci-test.c
-@@ -21,6 +21,7 @@ static void test_xhci_hotplug(void)
-     usb_test_hotplug(global_qtest, "xhci", "1", NULL);
- }
- 
-+#if 0 /* Disabled for Red Hat Enterprise Linux */
- static void test_usb_uas_hotplug(void)
- {
-     QTestState *qts = global_qtest;
-@@ -36,6 +37,7 @@ static void test_usb_uas_hotplug(void)
-     qtest_qmp_device_del(qts, "scsihd");
-     qtest_qmp_device_del(qts, "uas");
- }
-+#endif
- 
- static void test_usb_ccid_hotplug(void)
- {
-@@ -56,7 +58,9 @@ int main(int argc, char **argv)
- 
-     qtest_add_func("/xhci/pci/init", test_xhci_init);
-     qtest_add_func("/xhci/pci/hotplug", test_xhci_hotplug);
-+#if 0 /* Disabled for Red Hat Enterprise Linux */
-     qtest_add_func("/xhci/pci/hotplug/usb-uas", test_usb_uas_hotplug);
-+#endif
-     qtest_add_func("/xhci/pci/hotplug/usb-ccid", test_usb_ccid_hotplug);
- 
-     qtest_start("-device nec-usb-xhci,id=xhci"
-diff --git a/tests/qtest/virtio-net-failover.c b/tests/qtest/virtio-net-failover.c
-index 78811f1c92..44de8af00c 100644
---- a/tests/qtest/virtio-net-failover.c
-+++ b/tests/qtest/virtio-net-failover.c
-@@ -25,6 +25,7 @@
- #define PCI_SEL_BASE            0x0010
- 
- #define BASE_MACHINE "-M q35 -nodefaults " \
-+    "-global ICH9-LPC.acpi-pci-hotplug-with-bridge-support=on " \
-     "-device pcie-root-port,id=root0,addr=0x1,bus=pcie.0,chassis=1 " \
-     "-device pcie-root-port,id=root1,addr=0x2,bus=pcie.0,chassis=2 "
- 
--- 
-2.31.1
-

SOURCES/0012-Enable-make-check.patch

@@ -0,0 +1,407 @@
+From 740a2dd943a2e0fcd41a9cd8eb94a136f8f49fa2 Mon Sep 17 00:00:00 2001
+From: Miroslav Rezanina <mrezanin@redhat.com>
+Date: Wed, 2 Sep 2020 09:39:41 +0200
+Subject: Enable make check
+
+Fixing tests after device disabling and machine types changes and enabling
+make check run during build.
+
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+
+Rebase changes (4.0.0):
+- Remove testing for pseries-2.7 in endianess test
+- Disable device-plug-test on s390x as it use disabled device
+- Do not run cpu-plug-tests on 7.3 and older machine types
+
+Rebase changes (4.1.0-rc0):
+- removed iotests 068
+
+Rebase changes (4.1.0-rc1):
+- remove all 205 tests (unstable)
+
+Rebase changes (4.2.0-rc0):
+- partially disable hd-geo-test (requires lsi53c895a)
+
+Rebase changes (5.1.0-rc1):
+- Disable qtest/q35-test (uses upstream machine types)
+- Do not run iotests on make checka
+- Enabled iotests 071 and 099
+
+Rebase changes (5.2.0 rc0):
+- Disable cdrom tests (unsupported devices) on x86_64
+- disable fuzz test
+
+Rebase changes (6.0.0):
+- Disabled xlnx-can-test
+- Disable pxb-pcie subtest for bios-table-test
+- Replace qtest usage of upstream q35 machine type with pc-q35-rhel8.4.0
+- Not run cdrom-test on aarch64
+
+Rebase changes (6.1.0):
+- Remove unnecessary test disabling changes
+
+Rebase changes (weekly-211006):
+- New handling for bios-table-test (disabled downstream)
+
+Merged patches (4.0.0):
+- f7ffd13 Remove 7 qcow2 and luks iotests that are taking > 25 sec to run during the fast train build proce
+
+Merged patches (4.1.0-rc0):
+- 41288ff redhat: Remove raw iotest 205
+---
+ redhat/qemu-kvm.spec.template       |  2 +-
+ tests/qemu-iotests/051              |  8 ++++----
+ tests/qtest/bios-tables-test.c      |  5 ++++-
+ tests/qtest/boot-serial-test.c      |  6 +++++-
+ tests/qtest/cdrom-test.c            |  4 ++++
+ tests/qtest/cpu-plug-test.c         |  4 ++--
+ tests/qtest/fuzz-e1000e-test.c      |  2 +-
+ tests/qtest/fuzz-virtio-scsi-test.c |  2 +-
+ tests/qtest/hd-geo-test.c           |  4 ++++
+ tests/qtest/lpc-ich9-test.c         |  2 +-
+ tests/qtest/meson.build             | 13 ++++---------
+ tests/qtest/prom-env-test.c         |  4 ++++
+ tests/qtest/test-x86-cpuid-compat.c |  2 ++
+ tests/qtest/usb-hcd-xhci-test.c     |  4 ++++
+ 14 files changed, 41 insertions(+), 21 deletions(-)
+
+diff --git a/tests/qemu-iotests/051 b/tests/qemu-iotests/051
+index 1d2fa93a11..c8a2815f54 100755
+--- a/tests/qemu-iotests/051
++++ b/tests/qemu-iotests/051
+@@ -174,9 +174,9 @@ run_qemu -drive if=virtio
+ case "$QEMU_DEFAULT_MACHINE" in
+     pc)
+         run_qemu -drive if=none,id=disk -device ide-cd,drive=disk
+-        run_qemu -drive if=none,id=disk -device lsi53c895a -device scsi-cd,drive=disk
++#        run_qemu -drive if=none,id=disk -device lsi53c895a -device scsi-cd,drive=disk
+         run_qemu -drive if=none,id=disk -device ide-hd,drive=disk
+-        run_qemu -drive if=none,id=disk -device lsi53c895a -device scsi-hd,drive=disk
++#        run_qemu -drive if=none,id=disk -device lsi53c895a -device scsi-hd,drive=disk
+         ;;
+      *)
+         ;;
+@@ -225,9 +225,9 @@ run_qemu -drive file="$TEST_IMG",if=virtio,readonly=on
+ case "$QEMU_DEFAULT_MACHINE" in
+     pc)
+         run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device ide-cd,drive=disk
+-        run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device lsi53c895a -device scsi-cd,drive=disk
++#        run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device lsi53c895a -device scsi-cd,drive=disk
+         run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device ide-hd,drive=disk
+-        run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device lsi53c895a -device scsi-hd,drive=disk
++#        run_qemu -drive file="$TEST_IMG",if=none,id=disk,readonly=on -device lsi53c895a -device scsi-hd,drive=disk
+         ;;
+      *)
+         ;;
+diff --git a/tests/qtest/bios-tables-test.c b/tests/qtest/bios-tables-test.c
+index 258874167e..16d8304cde 100644
+--- a/tests/qtest/bios-tables-test.c
++++ b/tests/qtest/bios-tables-test.c
+@@ -1372,6 +1372,7 @@ static void test_acpi_virt_tcg_numamem(void)
+ 
+ }
+ 
++#if 0 /* Disabled for Red Hat Enterprise Linux */
+ static void test_acpi_virt_tcg_pxb(void)
+ {
+     test_data data = {
+@@ -1403,6 +1404,7 @@ static void test_acpi_virt_tcg_pxb(void)
+ 
+     free_test_data(&data);
+ }
++#endif
+ 
+ static void test_acpi_tcg_acpi_hmat(const char *machine)
+ {
+@@ -1644,7 +1646,8 @@ int main(int argc, char *argv[])
+             qtest_add_func("acpi/virt", test_acpi_virt_tcg);
+             qtest_add_func("acpi/virt/numamem", test_acpi_virt_tcg_numamem);
+             qtest_add_func("acpi/virt/memhp", test_acpi_virt_tcg_memhp);
+-            qtest_add_func("acpi/virt/pxb", test_acpi_virt_tcg_pxb);
++            /* Disabled for Red Hat Enterprise Linux
++            qtest_add_func("acpi/virt/pxb", test_acpi_virt_tcg_pxb); */
+             qtest_add_func("acpi/virt/oem-fields", test_acpi_oem_fields_virt);
+         }
+     }
+diff --git a/tests/qtest/boot-serial-test.c b/tests/qtest/boot-serial-test.c
+index 83828ba270..294476b959 100644
+--- a/tests/qtest/boot-serial-test.c
++++ b/tests/qtest/boot-serial-test.c
+@@ -148,19 +148,23 @@ static testdef_t tests[] = {
+     { "ppc", "g3beige", "", "PowerPC,750" },
+     { "ppc", "mac99", "", "PowerPC,G4" },
+     { "ppc", "sam460ex", "-m 256", "DRAM:  256 MiB" },
++#if 0 /* Disabled for Red Hat Enterprise Linux */
+     { "ppc64", "ppce500", "", "U-Boot" },
+     { "ppc64", "40p", "-m 192", "Memory: 192M" },
+     { "ppc64", "mac99", "", "PowerPC,970FX" },
++#endif
+     { "ppc64", "pseries",
+       "-machine " PSERIES_DEFAULT_CAPABILITIES,
+       "Open Firmware" },
++#if 0 /* Disabled for Red Hat Enterprise Linux */
+     { "ppc64", "powernv8", "", "OPAL" },
+     { "ppc64", "powernv9", "", "OPAL" },
+     { "ppc64", "sam460ex", "-device e1000", "8086  100e" },
++#endif
+     { "i386", "isapc", "-cpu qemu32 -device sga", "SGABIOS" },
+     { "i386", "pc", "-device sga", "SGABIOS" },
+     { "i386", "q35", "-device sga", "SGABIOS" },
+-    { "x86_64", "isapc", "-cpu qemu32 -device sga", "SGABIOS" },
++    { "x86_64", "pc", "-cpu qemu32 -device sga", "SGABIOS" },
+     { "x86_64", "q35", "-device sga", "SGABIOS" },
+     { "sparc", "LX", "", "TMS390S10" },
+     { "sparc", "SS-4", "", "MB86904" },
+diff --git a/tests/qtest/cdrom-test.c b/tests/qtest/cdrom-test.c
+index 5af944a5fb..69d9bac38a 100644
+--- a/tests/qtest/cdrom-test.c
++++ b/tests/qtest/cdrom-test.c
+@@ -140,6 +140,7 @@ static void add_x86_tests(void)
+         qtest_add_data_func("cdrom/boot/isapc", "-M isapc "
+                             "-drive if=ide,media=cdrom,file=", test_cdboot);
+     }
++#if 0  /* Disabled for Red Hat Enterprise Linux */
+     qtest_add_data_func("cdrom/boot/am53c974",
+                         "-device am53c974 -device scsi-cd,drive=cd1 "
+                         "-drive if=none,id=cd1,format=raw,file=", test_cdboot);
+@@ -155,6 +156,7 @@ static void add_x86_tests(void)
+     qtest_add_data_func("cdrom/boot/megasas-gen2", "-M q35 "
+                         "-device megasas-gen2 -device scsi-cd,drive=cd1 "
+                         "-blockdev file,node-name=cd1,filename=", test_cdboot);
++#endif
+ }
+ 
+ static void add_s390x_tests(void)
+@@ -220,6 +222,7 @@ int main(int argc, char **argv)
+             "magnum", "malta", "pica61", NULL
+         };
+         add_cdrom_param_tests(mips64machines);
++#if 0 /* Disabled for Red Hat Enterprise Linux */
+     } else if (g_str_equal(arch, "arm") || g_str_equal(arch, "aarch64")) {
+         const char *armmachines[] = {
+             "realview-eb", "realview-eb-mpcore", "realview-pb-a8",
+@@ -227,6 +230,7 @@ int main(int argc, char **argv)
+             "vexpress-a9", "virt", NULL
+         };
+         add_cdrom_param_tests(armmachines);
++#endif
+     } else {
+         const char *nonemachine[] = { "none", NULL };
+         add_cdrom_param_tests(nonemachine);
+diff --git a/tests/qtest/cpu-plug-test.c b/tests/qtest/cpu-plug-test.c
+index a1c689414b..a8f076711c 100644
+--- a/tests/qtest/cpu-plug-test.c
++++ b/tests/qtest/cpu-plug-test.c
+@@ -110,8 +110,8 @@ static void add_pseries_test_case(const char *mname)
+     char *path;
+     PlugTestData *data;
+ 
+-    if (!g_str_has_prefix(mname, "pseries-") ||
+-        (g_str_has_prefix(mname, "pseries-2.") && atoi(&mname[10]) < 7)) {
++    if (!g_str_has_prefix(mname, "pseries-rhel") ||
++        (g_str_has_prefix(mname, "pseries-rhel7.") && atoi(&mname[14]) < 4)) {
+         return;
+     }
+     data = g_new(PlugTestData, 1);
+diff --git a/tests/qtest/fuzz-e1000e-test.c b/tests/qtest/fuzz-e1000e-test.c
+index 66229e6096..947fba73b7 100644
+--- a/tests/qtest/fuzz-e1000e-test.c
++++ b/tests/qtest/fuzz-e1000e-test.c
+@@ -17,7 +17,7 @@ static void test_lp1879531_eth_get_rss_ex_dst_addr(void)
+ {
+     QTestState *s;
+ 
+-    s = qtest_init("-nographic -monitor none -serial none -M pc-q35-5.0");
++    s = qtest_init("-nographic -monitor none -serial none -M pc-q35-rhel8.4.0");
+ 
+     qtest_outl(s, 0xcf8, 0x80001010);
+     qtest_outl(s, 0xcfc, 0xe1020000);
+diff --git a/tests/qtest/fuzz-virtio-scsi-test.c b/tests/qtest/fuzz-virtio-scsi-test.c
+index aaf6d10e18..43727d62ac 100644
+--- a/tests/qtest/fuzz-virtio-scsi-test.c
++++ b/tests/qtest/fuzz-virtio-scsi-test.c
+@@ -19,7 +19,7 @@ static void test_mmio_oob_from_memory_region_cache(void)
+ {
+     QTestState *s;
+ 
+-    s = qtest_init("-M pc-q35-5.2 -display none -m 512M "
++    s = qtest_init("-M pc-q35-rhel8.4.0 -display none -m 512M "
+                    "-device virtio-scsi,num_queues=8,addr=03.0 ");
+ 
+     qtest_outl(s, 0xcf8, 0x80001811);
+diff --git a/tests/qtest/hd-geo-test.c b/tests/qtest/hd-geo-test.c
+index 113126ae06..999ef2aace 100644
+--- a/tests/qtest/hd-geo-test.c
++++ b/tests/qtest/hd-geo-test.c
+@@ -737,6 +737,7 @@ static void test_override_ide(void)
+     test_override(args, expected);
+ }
+ 
++#if 0 /* Require lsi53c895a - not supported on RHEL */
+ static void test_override_scsi(void)
+ {
+     TestArgs *args = create_args();
+@@ -781,6 +782,7 @@ static void test_override_scsi_2_controllers(void)
+     add_scsi_disk(args, 3, 1, 0, 1, 2, 0, 1, 0);
+     test_override(args, expected);
+ }
++#endif
+ 
+ static void test_override_virtio_blk(void)
+ {
+@@ -960,9 +962,11 @@ int main(int argc, char **argv)
+     qtest_add_func("hd-geo/ide/device/user/chst", test_ide_device_user_chst);
+     if (have_qemu_img()) {
+         qtest_add_func("hd-geo/override/ide", test_override_ide);
++#if 0 /* Require lsi53c895a - not supported on RHEL */
+         qtest_add_func("hd-geo/override/scsi", test_override_scsi);
+         qtest_add_func("hd-geo/override/scsi_2_controllers",
+                        test_override_scsi_2_controllers);
++#endif
+         qtest_add_func("hd-geo/override/virtio_blk", test_override_virtio_blk);
+         qtest_add_func("hd-geo/override/zero_chs", test_override_zero_chs);
+         qtest_add_func("hd-geo/override/scsi_hot_unplug",
+diff --git a/tests/qtest/lpc-ich9-test.c b/tests/qtest/lpc-ich9-test.c
+index fe0bef9980..7a9d51579b 100644
+--- a/tests/qtest/lpc-ich9-test.c
++++ b/tests/qtest/lpc-ich9-test.c
+@@ -15,7 +15,7 @@ static void test_lp1878642_pci_bus_get_irq_level_assert(void)
+ {
+     QTestState *s;
+ 
+-    s = qtest_init("-M pc-q35-5.0 "
++    s = qtest_init("-M pc-q35-rhel8.4.0 "
+                    "-nographic -monitor none -serial none");
+ 
+     qtest_outl(s, 0xcf8, 0x8000f840); /* PMBASE */
+diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
+index c9d8458062..049e06c057 100644
+--- a/tests/qtest/meson.build
++++ b/tests/qtest/meson.build
+@@ -68,7 +68,6 @@ qtests_i386 = \
+   (config_all_devices.has_key('CONFIG_RTL8139_PCI') ? ['rtl8139-test'] : []) +              \
+   (config_all_devices.has_key('CONFIG_E1000E_PCI_EXPRESS') ? ['fuzz-e1000e-test'] : []) +   \
+   (config_all_devices.has_key('CONFIG_ESP_PCI') ? ['am53c974-test'] : []) +                 \
+-  (unpack_edk2_blobs ? ['bios-tables-test'] : []) +                                         \
+   qtests_pci +                                                                              \
+   ['fdc-test',
+    'ide-test',
+@@ -81,7 +80,6 @@ qtests_i386 = \
+    'drive_del-test',
+    'tco-test',
+    'cpu-plug-test',
+-   'q35-test',
+    'vmgenid-test',
+    'migration-test',
+    'test-x86-cpuid-compat',
+@@ -130,17 +128,15 @@ qtests_mips64el = \
+ 
+ qtests_ppc = \
+   (config_all_devices.has_key('CONFIG_ISA_TESTDEV') ? ['endianness-test'] : []) +            \
+-  (config_all_devices.has_key('CONFIG_M48T59') ? ['m48t59-test'] : []) +                     \
+-  ['boot-order-test', 'prom-env-test', 'boot-serial-test']                 \
++  (config_all_devices.has_key('CONFIG_M48T59') ? ['m48t59-test'] : [])
+ 
+ qtests_ppc64 = \
+   (config_all_devices.has_key('CONFIG_PSERIES') ? ['device-plug-test'] : []) +               \
+   (config_all_devices.has_key('CONFIG_POWERNV') ? ['pnv-xscom-test'] : []) +                 \
+   (config_all_devices.has_key('CONFIG_PSERIES') ? ['rtas-test'] : []) +                      \
+-  (slirp.found() ? ['pxe-test', 'test-netfilter'] : []) +              \
++  (slirp.found() ? ['pxe-test'] : []) +              \
+   (config_all_devices.has_key('CONFIG_USB_UHCI') ? ['usb-hcd-uhci-test'] : []) +             \
+   (config_all_devices.has_key('CONFIG_USB_XHCI_NEC') ? ['usb-hcd-xhci-test'] : []) +         \
+-  (config_host.has_key('CONFIG_POSIX') ? ['test-filter-mirror'] : []) +                      \
+   qtests_pci + ['migration-test', 'numa-test', 'cpu-plug-test', 'drive_del-test']
+ 
+ qtests_sh4 = (config_all_devices.has_key('CONFIG_ISA_TESTDEV') ? ['endianness-test'] : [])
+@@ -186,8 +182,8 @@ qtests_aarch64 = \
+   ['arm-cpu-features',
+    'numa-test',
+    'boot-serial-test',
+-   'xlnx-can-test',
+-   'fuzz-xlnx-dp-test',
++#   'xlnx-can-test',
++#   'fuzz-xlnx-dp-test',
+    'migration-test']
+ 
+ qtests_s390x = \
+@@ -196,7 +192,6 @@ qtests_s390x = \
+   (config_host.has_key('CONFIG_POSIX') ? ['test-filter-redirector'] : []) +                     \
+   ['boot-serial-test',
+    'drive_del-test',
+-   'device-plug-test',
+    'virtio-ccw-test',
+    'cpu-plug-test',
+    'migration-test']
+diff --git a/tests/qtest/prom-env-test.c b/tests/qtest/prom-env-test.c
+index f41d80154a..f8dc478ce8 100644
+--- a/tests/qtest/prom-env-test.c
++++ b/tests/qtest/prom-env-test.c
+@@ -89,10 +89,14 @@ int main(int argc, char *argv[])
+     if (!strcmp(arch, "ppc")) {
+         add_tests(ppc_machines);
+     } else if (!strcmp(arch, "ppc64")) {
++#if 0 /* Disabled for Red Hat Enterprise Linux */
+         add_tests(ppc_machines);
+         if (g_test_slow()) {
++#endif
+             qtest_add_data_func("prom-env/pseries", "pseries", test_machine);
++#if 0 /* Disabled for Red Hat Enterprise Linux */
+         }
++#endif
+     } else if (!strcmp(arch, "sparc")) {
+         add_tests(sparc_machines);
+     } else if (!strcmp(arch, "sparc64")) {
+diff --git a/tests/qtest/test-x86-cpuid-compat.c b/tests/qtest/test-x86-cpuid-compat.c
+index f28848e06e..6b2fd398a2 100644
+--- a/tests/qtest/test-x86-cpuid-compat.c
++++ b/tests/qtest/test-x86-cpuid-compat.c
+@@ -300,6 +300,7 @@ int main(int argc, char **argv)
+                    "-cpu 486,xlevel2=0xC0000002,xstore=on",
+                    "xlevel2", 0xC0000002);
+ 
++#if 0 /* Disabled in Red Hat Enterprise Linux */
+     /* Check compatibility of old machine-types that didn't
+      * auto-increase level/xlevel/xlevel2: */
+ 
+@@ -350,6 +351,7 @@ int main(int argc, char **argv)
+     add_cpuid_test("x86/cpuid/xlevel-compat/pc-i440fx-2.4/npt-on",
+                    "-machine pc-i440fx-2.4 -cpu SandyBridge,svm=on,npt=on",
+                    "xlevel", 0x80000008);
++#endif
+ 
+     /* Test feature parsing */
+     add_feature_test("x86/cpuid/features/plus",
+diff --git a/tests/qtest/usb-hcd-xhci-test.c b/tests/qtest/usb-hcd-xhci-test.c
+index 10ef9d2a91..3855873050 100644
+--- a/tests/qtest/usb-hcd-xhci-test.c
++++ b/tests/qtest/usb-hcd-xhci-test.c
+@@ -21,6 +21,7 @@ static void test_xhci_hotplug(void)
+     usb_test_hotplug(global_qtest, "xhci", "1", NULL);
+ }
+ 
++#if 0 /* Disabled for Red Hat Enterprise Linux */
+ static void test_usb_uas_hotplug(void)
+ {
+     QTestState *qts = global_qtest;
+@@ -36,6 +37,7 @@ static void test_usb_uas_hotplug(void)
+     qtest_qmp_device_del(qts, "scsihd");
+     qtest_qmp_device_del(qts, "uas");
+ }
++#endif
+ 
+ static void test_usb_ccid_hotplug(void)
+ {
+@@ -56,7 +58,9 @@ int main(int argc, char **argv)
+ 
+     qtest_add_func("/xhci/pci/init", test_xhci_init);
+     qtest_add_func("/xhci/pci/hotplug", test_xhci_hotplug);
++#if 0 /* Disabled for Red Hat Enterprise Linux */
+     qtest_add_func("/xhci/pci/hotplug/usb-uas", test_usb_uas_hotplug);
++#endif
+     qtest_add_func("/xhci/pci/hotplug/usb-ccid", test_usb_ccid_hotplug);
+ 
+     qtest_start("-device nec-usb-xhci,id=xhci"
+-- 
+2.27.0
+

SOURCES/0013-vfio-cap-number-of-devices-that-can-be-assigned.patch

@@ -1,4 +1,4 @@
-From c358fd4c224a9c3f64b4a8fff34cc6b1dc201fa0 Mon Sep 17 00:00:00 2001
+From e9ebc159a9acf108e1ec6f622be3f256cf14aba7 Mon Sep 17 00:00:00 2001
 From: Bandan Das <bsd@redhat.com>
 Date: Tue, 3 Dec 2013 20:05:13 +0100
 Subject: vfio: cap number of devices that can be assigned
@@ -22,17 +22,23 @@ for other uses. Stepping down a bit, the number 32 arbitrarily
 matches the number of slots on a PCI bus and is also a nice power
 of two.
 
-Count of slots increased to 509 later so we could increase limit
-to 64 as some usecases require more than 32 devices.
-
 Signed-off-by: Bandan Das <bsd@redhat.com>
+
+Rebase notes (2.8.0):
+- removed return value for vfio_realize (commit 1a22aca)
+
+Merged patches (2.9.0):
+- 17eb774 vfio: Use error_setg when reporting max assigned device overshoot
+
+ Merged patches (4.1.0-rc3):
+- 2b89558 vfio: increase the cap on number of assigned devices to 64
 ---
  hw/vfio/pci.c | 29 ++++++++++++++++++++++++++++-
  hw/vfio/pci.h |  1 +
  2 files changed, 29 insertions(+), 1 deletion(-)
 
 diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
-index 67a183f17b..1e20f9fd59 100644
+index 7b45353ce2..eb725a3aee 100644
 --- a/hw/vfio/pci.c
 +++ b/hw/vfio/pci.c
 @@ -45,6 +45,9 @@
@@ -45,7 +51,7 @@ index 67a183f17b..1e20f9fd59 100644
  static void vfio_disable_interrupts(VFIOPCIDevice *vdev);
  static void vfio_mmap_set_enabled(VFIOPCIDevice *vdev, bool enabled);
  
-@@ -2810,9 +2813,30 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
+@@ -2807,9 +2810,30 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
      ssize_t len;
      struct stat st;
      int groupid;
@@ -77,7 +83,7 @@ index 67a183f17b..1e20f9fd59 100644
      if (!vdev->vbasedev.sysfsdev) {
          if (!(~vdev->host.domain || ~vdev->host.bus ||
                ~vdev->host.slot || ~vdev->host.function)) {
-@@ -3249,6 +3273,9 @@ static Property vfio_pci_dev_properties[] = {
+@@ -3246,6 +3270,9 @@ static Property vfio_pci_dev_properties[] = {
      DEFINE_PROP_BOOL("x-no-kvm-msix", VFIOPCIDevice, no_kvm_msix, false),
      DEFINE_PROP_BOOL("x-no-geforce-quirks", VFIOPCIDevice,
                       no_geforce_quirks, false),
@@ -100,5 +106,5 @@ index 64777516d1..e0fe6ca97e 100644
      uint32_t device_id;
      uint32_t sub_vendor_id;
 -- 
-2.31.1
+2.27.0
 

SOURCES/0014-Add-support-statement-to-help-output.patch

@@ -1,4 +1,4 @@
-From ba0c7a5f6b9a1f75666db6b3b795ddf03695dc26 Mon Sep 17 00:00:00 2001
+From b736b0c41dd62ed6f874a7b33ca1d4f9ceab4573 Mon Sep 17 00:00:00 2001
 From: Eduardo Habkost <ehabkost@redhat.com>
 Date: Wed, 4 Dec 2013 18:53:17 +0100
 Subject: Add support statement to -help output
@@ -21,10 +21,10 @@ Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
  1 file changed, 9 insertions(+)
 
 diff --git a/softmmu/vl.c b/softmmu/vl.c
-index 6f646531a0..9d5dab43d2 100644
+index 620a1f1367..d46b8fb4ab 100644
 --- a/softmmu/vl.c
 +++ b/softmmu/vl.c
-@@ -831,9 +831,17 @@ static void version(void)
+@@ -827,9 +827,17 @@ static void version(void)
             QEMU_COPYRIGHT "\n");
  }
  
@@ -41,8 +41,8 @@ index 6f646531a0..9d5dab43d2 100644
 +    print_rh_warning();
      printf("usage: %s [options] [disk_image]\n\n"
             "'disk_image' is a raw hard disk image for IDE hard disk 0\n\n",
-             g_get_prgname());
-@@ -859,6 +867,7 @@ static void help(int exitcode)
+             error_get_progname());
+@@ -855,6 +863,7 @@ static void help(int exitcode)
             "\n"
             QEMU_HELP_BOTTOM "\n");
  
@@ -51,5 +51,5 @@ index 6f646531a0..9d5dab43d2 100644
  }
  
 -- 
-2.31.1
+2.27.0
 

SOURCES/0015-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch

@@ -1,61 +0,0 @@
-From 4b6c8cdc52fdf94d4098d278defb3833dce1d189 Mon Sep 17 00:00:00 2001
-From: Miroslav Rezanina <mrezanin@redhat.com>
-Date: Wed, 8 Jul 2020 08:35:50 +0200
-Subject: Use qemu-kvm in documentation instead of qemu-system-<arch>
-
-Patchwork-id: 62380
-O-Subject: [RHEV-7.1 qemu-kvm-rhev PATCHv4] Use qemu-kvm in documentation instead of qemu-system-i386
-Bugzilla: 1140620
-RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
-RH-Acked-by: Markus Armbruster <armbru@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-
-From: Miroslav Rezanina <mrezanin@redhat.com>
-
-We change the name and location of qemu-kvm binaries. Update documentation
-to reflect this change. Only architectures available in RHEL are updated.
-
-Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
----
- docs/defs.rst.inc |  4 ++--
- qemu-options.hx   | 10 +++++-----
- 2 files changed, 7 insertions(+), 7 deletions(-)
-
-diff --git a/docs/defs.rst.inc b/docs/defs.rst.inc
-index 52d6454b93..d74dbdeca9 100644
---- a/docs/defs.rst.inc
-+++ b/docs/defs.rst.inc
-@@ -9,7 +9,7 @@
-    but the manpages will end up misrendered with following normal text
-    incorrectly in boldface.
- 
--.. |qemu_system| replace:: qemu-system-x86_64
--.. |qemu_system_x86| replace:: qemu-system-x86_64
-+.. |qemu_system| replace:: qemu-kvm
-+.. |qemu_system_x86| replace:: qemu-kvm
- .. |I2C| replace:: I\ :sup:`2`\ C
- .. |I2S| replace:: I\ :sup:`2`\ S
-diff --git a/qemu-options.hx b/qemu-options.hx
-index 34e9b32a5c..924f61ab6d 100644
---- a/qemu-options.hx
-+++ b/qemu-options.hx
-@@ -3233,11 +3233,11 @@ SRST
- 
-     ::
- 
--        qemu -m 512 -object memory-backend-file,id=mem,size=512M,mem-path=/hugetlbfs,share=on \
--             -numa node,memdev=mem \
--             -chardev socket,id=chr0,path=/path/to/socket \
--             -netdev type=vhost-user,id=net0,chardev=chr0 \
--             -device virtio-net-pci,netdev=net0
-+        qemu-kvm -m 512 -object memory-backend-file,id=mem,size=512M,mem-path=/hugetlbfs,share=on \
-+                 -numa node,memdev=mem \
-+                 -chardev socket,id=chr0,path=/path/to/socket \
-+                 -netdev type=vhost-user,id=net0,chardev=chr0 \
-+                 -device virtio-net-pci,netdev=net0
- 
- ``-netdev vhost-vdpa,vhostdev=/path/to/dev``
-     Establish a vhost-vdpa netdev.
--- 
-2.31.1
-

SOURCES/0015-globally-limit-the-maximum-number-of-CPUs.patch

@@ -1,4 +1,4 @@
-From 9ebfd2f6cfa8e79c92e58fd169f90cc768fb865a Mon Sep 17 00:00:00 2001
+From 9a7621819821ee88d2f99d6b629fd87aa9a07758 Mon Sep 17 00:00:00 2001
 From: Andrew Jones <drjones@redhat.com>
 Date: Tue, 21 Jan 2014 10:46:52 +0100
 Subject: globally limit the maximum number of CPUs
@@ -13,15 +13,35 @@ default and minimize the ppc hack in kvm-all.c.
 Signed-off-by: David Hildenbrand <david@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 Signed-off-by: Danilo Cesar Lemes de Paula <ddepaula@redhat.com>
+
+Rebase notes (2.11.0):
+- Removed CONFIG_RHV reference
+- Update commit log
+
+Merged patches (2.11.0):
+- 92fef14623 redhat: remove manual max_cpus limitations for ppc
+- bb722e9eff redhat: globally limit the maximum number of CPUs
+- fdeef3c1c7 RHEL: Set vcpus hard limit to 240 for Power
+- 0584216921 Match POWER max cpus to x86
+
+Signed-off-by: Andrew Jones <drjones@redhat.com>
+
+Merged patches (5.1.0):
+- redhat: globally limit the maximum number of CPUs
+- redhat: remove manual max_cpus limitations for ppc
+- use recommended max vcpu count
+
+Merged patches (5.2.0 rc0):
+- f8a4123 vl: Remove downstream-only MAX_RHEL_CPUS code
 ---
  accel/kvm/kvm-all.c | 12 ++++++++++++
  1 file changed, 12 insertions(+)
 
 diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
-index 5f1377ca04..fdf0e4d429 100644
+index eecd8031cf..8f2a53438f 100644
 --- a/accel/kvm/kvm-all.c
 +++ b/accel/kvm/kvm-all.c
-@@ -2430,6 +2430,18 @@ static int kvm_init(MachineState *ms)
+@@ -2423,6 +2423,18 @@ static int kvm_init(MachineState *ms)
      soft_vcpus_limit = kvm_recommended_vcpus(s);
      hard_vcpus_limit = kvm_max_vcpus(s);
  
@@ -41,5 +61,5 @@ index 5f1377ca04..fdf0e4d429 100644
          if (nc->num > soft_vcpus_limit) {
              warn_report("Number of %s cpus requested (%d) exceeds "
 -- 
-2.31.1
+2.27.0
 

SOURCES/0016-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch

@@ -0,0 +1,126 @@
+From 0d3fc0b4c5773c6cabb0a58c064475f76eb6ac1e Mon Sep 17 00:00:00 2001
+From: Miroslav Rezanina <mrezanin@redhat.com>
+Date: Wed, 8 Jul 2020 08:35:50 +0200
+Subject: Use qemu-kvm in documentation instead of qemu-system-<arch>
+
+Patchwork-id: 62380
+O-Subject: [RHEV-7.1 qemu-kvm-rhev PATCHv4] Use qemu-kvm in documentation instead of qemu-system-i386
+Bugzilla: 1140620
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Acked-by: Markus Armbruster <armbru@redhat.com>
+RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+
+From: Miroslav Rezanina <mrezanin@redhat.com>
+
+We change the name and location of qemu-kvm binaries. Update documentation
+to reflect this change. Only architectures available in RHEL are updated.
+
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+
+Rebase notes (5.1.0 rc0):
+ - qemu-block-drivers.texi converted to qemu-block-drivers.rst (upstream)
+
+Rebase notes (5.2.0 rc0):
+ - rewrite patch to new docs structure
+---
+ docs/defs.rst.inc              |  4 ++--
+ docs/tools/qemu-trace-stap.rst | 14 +++++++-------
+ qemu-options.hx                | 10 +++++-----
+ 3 files changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/docs/defs.rst.inc b/docs/defs.rst.inc
+index 52d6454b93..d74dbdeca9 100644
+--- a/docs/defs.rst.inc
++++ b/docs/defs.rst.inc
+@@ -9,7 +9,7 @@
+    but the manpages will end up misrendered with following normal text
+    incorrectly in boldface.
+ 
+-.. |qemu_system| replace:: qemu-system-x86_64
+-.. |qemu_system_x86| replace:: qemu-system-x86_64
++.. |qemu_system| replace:: qemu-kvm
++.. |qemu_system_x86| replace:: qemu-kvm
+ .. |I2C| replace:: I\ :sup:`2`\ C
+ .. |I2S| replace:: I\ :sup:`2`\ S
+diff --git a/docs/tools/qemu-trace-stap.rst b/docs/tools/qemu-trace-stap.rst
+index d53073b52b..9e93df084f 100644
+--- a/docs/tools/qemu-trace-stap.rst
++++ b/docs/tools/qemu-trace-stap.rst
+@@ -46,19 +46,19 @@ The following commands are valid:
+   any of the listed names. If no *PATTERN* is given, the all possible
+   probes will be listed.
+ 
+-  For example, to list all probes available in the ``qemu-system-x86_64``
++  For example, to list all probes available in the ``qemu-kvm``
+   binary:
+ 
+   ::
+ 
+-    $ qemu-trace-stap list qemu-system-x86_64
++    $ qemu-trace-stap list qemu-kvm
+ 
+   To filter the list to only cover probes related to QEMU's cryptographic
+   subsystem, in a binary outside ``$PATH``
+ 
+   ::
+ 
+-    $ qemu-trace-stap list /opt/qemu/4.0.0/bin/qemu-system-x86_64 'qcrypto*'
++    $ qemu-trace-stap list /opt/qemu/4.0.0/bin/qemu-kvm 'qcrypto*'
+ 
+ .. option:: run OPTIONS BINARY PATTERN...
+ 
+@@ -90,18 +90,18 @@ The following commands are valid:
+     Restrict the tracing session so that it only triggers for the process
+     identified by *PID*.
+ 
+-  For example, to monitor all processes executing ``qemu-system-x86_64``
++  For example, to monitor all processes executing ``qemu-kvm``
+   as found on ``$PATH``, displaying all I/O related probes:
+ 
+   ::
+ 
+-    $ qemu-trace-stap run qemu-system-x86_64 'qio*'
++    $ qemu-trace-stap run qemu-kvm 'qio*'
+ 
+   To monitor only the QEMU process with PID 1732
+ 
+   ::
+ 
+-    $ qemu-trace-stap run --pid=1732 qemu-system-x86_64 'qio*'
++    $ qemu-trace-stap run --pid=1732 qemu-kvm 'qio*'
+ 
+   To monitor QEMU processes running an alternative binary outside of
+   ``$PATH``, displaying verbose information about setup of the
+@@ -109,7 +109,7 @@ The following commands are valid:
+ 
+   ::
+ 
+-    $ qemu-trace-stap -v run /opt/qemu/4.0.0/qemu-system-x86_64 'qio*'
++    $ qemu-trace-stap -v run /opt/qemu/4.0.0/qemu-kvm 'qio*'
+ 
+ See also
+ --------
+diff --git a/qemu-options.hx b/qemu-options.hx
+index ae2c6dbbfc..94c4a8dbaf 100644
+--- a/qemu-options.hx
++++ b/qemu-options.hx
+@@ -3150,11 +3150,11 @@ SRST
+ 
+     ::
+ 
+-        qemu -m 512 -object memory-backend-file,id=mem,size=512M,mem-path=/hugetlbfs,share=on \
+-             -numa node,memdev=mem \
+-             -chardev socket,id=chr0,path=/path/to/socket \
+-             -netdev type=vhost-user,id=net0,chardev=chr0 \
+-             -device virtio-net-pci,netdev=net0
++        qemu-kvm -m 512 -object memory-backend-file,id=mem,size=512M,mem-path=/hugetlbfs,share=on \
++                 -numa node,memdev=mem \
++                 -chardev socket,id=chr0,path=/path/to/socket \
++                 -netdev type=vhost-user,id=net0,chardev=chr0 \
++                 -device virtio-net-pci,netdev=net0
+ 
+ ``-netdev vhost-vdpa,vhostdev=/path/to/dev``
+     Establish a vhost-vdpa netdev.
+-- 
+2.27.0
+

SOURCES/0017-virtio-scsi-Reject-scsi-cd-if-data-plane-enabled-RHE.patch

@@ -1,4 +1,4 @@
-From b72e04cb7e417d9e1c973223747ab3a27abda8b4 Mon Sep 17 00:00:00 2001
+From d95768c039a2bf6b68422f83a8d55dad41bd3181 Mon Sep 17 00:00:00 2001
 From: Fam Zheng <famz@redhat.com>
 Date: Wed, 14 Jun 2017 15:37:01 +0200
 Subject: virtio-scsi: Reject scsi-cd if data plane enabled [RHEL only]
@@ -42,7 +42,7 @@ Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
  1 file changed, 9 insertions(+)
 
 diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
-index 34a968ecfb..7f6da33a8a 100644
+index 51fd09522a..a35257c35a 100644
 --- a/hw/scsi/virtio-scsi.c
 +++ b/hw/scsi/virtio-scsi.c
 @@ -896,6 +896,15 @@ static void virtio_scsi_hotplug(HotplugHandler *hotplug_dev, DeviceState *dev,
@@ -62,5 +62,5 @@ index 34a968ecfb..7f6da33a8a 100644
          if (blk_op_is_blocked(sd->conf.blk, BLOCK_OP_TYPE_DATAPLANE, errp)) {
              return;
 -- 
-2.31.1
+2.27.0
 

SOURCES/0018-BZ1653590-Require-at-least-64kiB-pages-for-downstrea.patch

@@ -1,4 +1,4 @@
-From 64a06662cdea0ff62efb122be4eab506b2a842d9 Mon Sep 17 00:00:00 2001
+From 92bb62c47eab021f8dabecd09b5fbc1706e6a29c Mon Sep 17 00:00:00 2001
 From: David Gibson <dgibson@redhat.com>
 Date: Wed, 6 Feb 2019 03:58:56 +0000
 Subject: BZ1653590: Require at least 64kiB pages for downstream guests & hosts
@@ -32,10 +32,10 @@ Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
  1 file changed, 7 insertions(+)
 
 diff --git a/hw/ppc/spapr_caps.c b/hw/ppc/spapr_caps.c
-index 655ab856a0..6aa7f93df9 100644
+index ed7c077a0d..48a8efe678 100644
 --- a/hw/ppc/spapr_caps.c
 +++ b/hw/ppc/spapr_caps.c
-@@ -329,12 +329,19 @@ bool spapr_check_pagesize(SpaprMachineState *spapr, hwaddr pagesize,
+@@ -332,12 +332,19 @@ bool spapr_check_pagesize(SpaprMachineState *spapr, hwaddr pagesize,
  static void cap_hpt_maxpagesize_apply(SpaprMachineState *spapr,
                                        uint8_t val, Error **errp)
  {
@@ -56,5 +56,5 @@ index 655ab856a0..6aa7f93df9 100644
      spapr_check_pagesize(spapr, qemu_minrampagesize(), errp);
  }
 -- 
-2.31.1
+2.27.0
 

SOURCES/0018-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch

@@ -1,77 +0,0 @@
-From 54f9157a918e1404f2f17ce89a9c8b9088c1bc06 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Fri, 20 Aug 2021 18:25:12 +0200
-Subject: qcow2: Deprecation warning when opening v2 images rw
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 37: qcow2: Deprecation warning when opening v2 images rw
-RH-Commit: [1/1] f450d0ae32d35063b28c72c4f2d2ebb9e6d8db3e (kmwolf/centos-qemu-kvm)
-RH-Bugzilla: 1951814
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Acked-by: Hanna Reitz <hreitz@redhat.com>
-RH-Acked-by: Thomas Huth <thuth@redhat.com>
-RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-
-qcow2 v3 has been around for a long time (since QEMU 1.1/RHEL 7), so
-there is no real reason any more to use it. People still using it might
-do so unintentionally. Warn about it and suggest upgrading during the
-RHEL 9 timeframe so that the code can possibly be disabled in RHEL 10.
-
-The warning is restricted to read-write mode and the system emulator.
-The primary motivation for not having it in qemu-img is that 'qemu-img
-amend' for upgrades would warn otherwise. It also avoids having to make
-too many changes to the test suite.
-
-bdrv_uses_whitelist() is used as a proxy for deciding whether we are
-running in a tool or the system emulator. This is not entirely clean,
-but it's what is available and the same function qcow2_do_open() already
-uses it this way for another warning.
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-
-patch_name: kvm-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch
-present_in_specfile: true
-location_in_specfile: 116
----
-Rebase notes (6.1.0):
-- Replace bs->read_only with bdrv_is_read_only
----
- block/qcow2.c                    | 6 ++++++
- tests/qemu-iotests/common.filter | 1 +
- 2 files changed, 7 insertions(+)
-
-diff --git a/block/qcow2.c b/block/qcow2.c
-index b5c47931ef..a795e457ac 100644
---- a/block/qcow2.c
-+++ b/block/qcow2.c
-@@ -1337,6 +1337,12 @@ static int coroutine_fn qcow2_do_open(BlockDriverState *bs, QDict *options,
-         ret = -ENOTSUP;
-         goto fail;
-     }
-+    if (header.version < 3 && !bdrv_is_read_only(bs) && bdrv_uses_whitelist()) {
-+        warn_report_once("qcow2 v2 images are deprecated and may not be "
-+                         "supported in future versions. Please consider "
-+                         "upgrading the image with 'qemu-img amend "
-+                         "-o compat=v3'.");
-+    }
- 
-     s->qcow_version = header.version;
- 
-diff --git a/tests/qemu-iotests/common.filter b/tests/qemu-iotests/common.filter
-index cc9f1a5891..6a13757177 100644
---- a/tests/qemu-iotests/common.filter
-+++ b/tests/qemu-iotests/common.filter
-@@ -83,6 +83,7 @@ _filter_qemu()
- {
-     gsed -e "s#\\(^\\|(qemu) \\)$(basename $QEMU_PROG):#\1QEMU_PROG:#" \
-         -e 's#^QEMU [0-9]\+\.[0-9]\+\.[0-9]\+ monitor#QEMU X.Y.Z monitor#' \
-+        -e "/qcow2 v2 images are deprecated/d" \
-         -e $'s#\r##' # QEMU monitor uses \r\n line endings
- }
- 
--- 
-2.31.1
-

SOURCES/0019-WRB-Introduce-RHEL-9.0.0-hw-compat-structure.patch

@@ -1,135 +0,0 @@
-From 1d6439527aa6ccabb58208c94417778ccc19de39 Mon Sep 17 00:00:00 2001
-From: Miroslav Rezanina <mrezanin@redhat.com>
-Date: Wed, 9 Feb 2022 04:16:25 -0500
-Subject: WRB: Introduce RHEL 9.0.0 hw compat structure
-
-General compatibility structure for post RHEL 9.0.0 rebase.
-
-Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
----
- hw/core/machine.c          | 9 +++++++++
- hw/i386/pc.c               | 6 ++++++
- hw/i386/pc_piix.c          | 4 ++++
- hw/i386/pc_q35.c           | 4 ++++
- hw/s390x/s390-virtio-ccw.c | 2 ++
- include/hw/boards.h        | 3 +++
- include/hw/i386/pc.h       | 3 +++
- 7 files changed, 31 insertions(+)
-
-diff --git a/hw/core/machine.c b/hw/core/machine.c
-index 28989b6e7b..dffc3ef4ab 100644
---- a/hw/core/machine.c
-+++ b/hw/core/machine.c
-@@ -53,6 +53,15 @@ GlobalProperty hw_compat_rhel_8_6[] = {
- };
- const size_t hw_compat_rhel_8_6_len = G_N_ELEMENTS(hw_compat_rhel_8_6);
- 
-+/*
-+ * Mostly the same as hw_compat_6_2
-+ */
-+GlobalProperty hw_compat_rhel_9_0[] = {
-+    /* hw_compat_rhel_9_0 from hw_compat_6_2 */
-+    { "PIIX4_PM", "x-not-migrate-acpi-index", "on"},
-+};
-+const size_t hw_compat_rhel_9_0_len = G_N_ELEMENTS(hw_compat_rhel_9_0);
-+
- /*
-  * Mostly the same as hw_compat_6_0 and hw_compat_6_1
-  */
-diff --git a/hw/i386/pc.c b/hw/i386/pc.c
-index 263d882af6..0886cfe3fe 100644
---- a/hw/i386/pc.c
-+++ b/hw/i386/pc.c
-@@ -391,6 +391,12 @@ GlobalProperty pc_rhel_compat[] = {
- };
- const size_t pc_rhel_compat_len = G_N_ELEMENTS(pc_rhel_compat);
- 
-+GlobalProperty pc_rhel_9_0_compat[] = {
-+    /* pc_rhel_9_0_compat from pc_compat_6_2 */
-+    { "virtio-mem", "unplugged-inaccessible", "off" },
-+};
-+const size_t pc_rhel_9_0_compat_len = G_N_ELEMENTS(pc_rhel_9_0_compat);
-+
- GlobalProperty pc_rhel_8_5_compat[] = {
-     /* pc_rhel_8_5_compat from pc_compat_6_0 */
-     { "qemu64" "-" TYPE_X86_CPU, "family", "6" },
-diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
-index 0cacc0d623..dc987fe93b 100644
---- a/hw/i386/pc_piix.c
-+++ b/hw/i386/pc_piix.c
-@@ -1014,6 +1014,10 @@ static void pc_machine_rhel760_options(MachineClass *m)
-     pcmc->kvmclock_create_always = false;
-     /* From pc_i440fx_5_1_machine_options() */
-     pcmc->pci_root_uid = 1;
-+    compat_props_add(m->compat_props, hw_compat_rhel_9_0,
-+                     hw_compat_rhel_9_0_len);
-+    compat_props_add(m->compat_props, pc_rhel_9_0_compat,
-+                     pc_rhel_9_0_compat_len);
-     compat_props_add(m->compat_props, hw_compat_rhel_8_6,
-                      hw_compat_rhel_8_6_len);
-     compat_props_add(m->compat_props, hw_compat_rhel_8_5,
-diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
-index 157160e069..52c253c570 100644
---- a/hw/i386/pc_q35.c
-+++ b/hw/i386/pc_q35.c
-@@ -669,6 +669,10 @@ static void pc_q35_machine_rhel900_options(MachineClass *m)
-     m->desc = "RHEL-9.0.0 PC (Q35 + ICH9, 2009)";
-     pcmc->smbios_stream_product = "RHEL";
-     pcmc->smbios_stream_version = "9.0.0";
-+    compat_props_add(m->compat_props, hw_compat_rhel_9_0,
-+                     hw_compat_rhel_9_0_len);
-+    compat_props_add(m->compat_props, pc_rhel_9_0_compat,
-+                     pc_rhel_9_0_compat_len);
- }
- 
- DEFINE_PC_MACHINE(q35_rhel900, "pc-q35-rhel9.0.0", pc_q35_init_rhel900,
-diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
-index 465a2a09d2..08e0f6a79b 100644
---- a/hw/s390x/s390-virtio-ccw.c
-+++ b/hw/s390x/s390-virtio-ccw.c
-@@ -1118,12 +1118,14 @@ static void ccw_machine_2_4_class_options(MachineClass *mc)
- DEFINE_CCW_MACHINE(2_4, "2.4", false);
- #endif
- 
-+
- static void ccw_machine_rhel900_instance_options(MachineState *machine)
- {
- }
- 
- static void ccw_machine_rhel900_class_options(MachineClass *mc)
- {
-+    compat_props_add(mc->compat_props, hw_compat_rhel_9_0, hw_compat_rhel_9_0_len);
- }
- DEFINE_CCW_MACHINE(rhel900, "rhel9.0.0", true);
- 
-diff --git a/include/hw/boards.h b/include/hw/boards.h
-index d1555665df..635e45dd71 100644
---- a/include/hw/boards.h
-+++ b/include/hw/boards.h
-@@ -451,6 +451,9 @@ extern const size_t hw_compat_2_2_len;
- extern GlobalProperty hw_compat_2_1[];
- extern const size_t hw_compat_2_1_len;
- 
-+extern GlobalProperty hw_compat_rhel_9_0[];
-+extern const size_t hw_compat_rhel_9_0_len;
-+
- extern GlobalProperty hw_compat_rhel_8_6[];
- extern const size_t hw_compat_rhel_8_6_len;
- 
-diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
-index 419a6ec24b..a492c420b5 100644
---- a/include/hw/i386/pc.h
-+++ b/include/hw/i386/pc.h
-@@ -292,6 +292,9 @@ extern const size_t pc_compat_1_4_len;
- extern GlobalProperty pc_rhel_compat[];
- extern const size_t pc_rhel_compat_len;
- 
-+extern GlobalProperty pc_rhel_9_0_compat[];
-+extern const size_t pc_rhel_9_0_compat_len;
-+
- extern GlobalProperty pc_rhel_8_5_compat[];
- extern const size_t pc_rhel_8_5_compat_len;
- 
--- 
-2.31.1
-

SOURCES/0019-compat-Update-hw_compat_rhel_8_5.patch

@@ -0,0 +1,53 @@
+From a9b5da617c29f48199cbea08d6a1c083877dce10 Mon Sep 17 00:00:00 2001
+From: Laurent Vivier <lvivier@redhat.com>
+Date: Mon, 15 Nov 2021 14:22:29 +0100
+Subject: compat: Update hw_compat_rhel_8_5
+
+RH-Author: Laurent Vivier <lvivier@redhat.com>
+RH-MergeRequest: 66: redhat: Update pseries-rhel8.5.0 machine type
+RH-Commit: [1/2] 232f2ad2b29d250fbdb8fcea9d814704c575ba2b
+RH-Bugzilla: 2022608
+RH-Acked-by: Eric Auger <eric.auger@redhat.com>
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Greg Kurz <gkurz@redhat.com>
+
+Add properties from hw_compat_6_1 as it already includes the ones from
+hw_compat_6_0. Add a lately added property from 6.0 too.
+
+Signed-off-by: Laurent Vivier <lvivier@redhat.com>
+--
+Rebase notes (6.2.0 rc3):
+- Included compatc changes introduced in RC2
+---
+ hw/core/machine.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/hw/core/machine.c b/hw/core/machine.c
+index 62febde5aa..736c765c30 100644
+--- a/hw/core/machine.c
++++ b/hw/core/machine.c
+@@ -38,7 +38,7 @@
+ #include "hw/virtio/virtio-pci.h"
+ 
+ /*
+- * Mostly the same as hw_compat_6_0
++ * Mostly the same as hw_compat_6_0 and hw_compat_6_1
+  */
+ GlobalProperty hw_compat_rhel_8_5[] = {
+     /* hw_compat_rhel_8_5 from hw_compat_6_0 */
+@@ -51,6 +51,12 @@ GlobalProperty hw_compat_rhel_8_5[] = {
+     { "e1000", "init-vet", "off" },
+     /* hw_compat_rhel_8_5 from hw_compat_6_0 */
+     { "e1000e", "init-vet", "off" },
++    /* hw_compat_rhel_8_5 from hw_compat_6_0 */
++    { "vhost-vsock-device", "seqpacket", "off" },
++    /* hw_compat_rhel_8_5 from hw_compat_6_1 */
++    { "vhost-user-vsock-device", "seqpacket", "off" },
++    /* hw_compat_rhel_8_5 from hw_compat_6_1 */
++    { "nvme-ns", "shared", "off" },
+ };
+ const size_t hw_compat_rhel_8_5_len = G_N_ELEMENTS(hw_compat_rhel_8_5);
+ 
+-- 
+2.27.0
+

SOURCES/0020-redhat-Update-pseries-rhel8.5.0-machine-type.patch

@@ -0,0 +1,43 @@
+From 82358c35f04f026820b3907069a6c19cd95b654d Mon Sep 17 00:00:00 2001
+From: Laurent Vivier <lvivier@redhat.com>
+Date: Mon, 15 Nov 2021 14:25:33 +0100
+Subject: redhat: Update pseries-rhel8.5.0 machine type
+
+RH-Author: Laurent Vivier <lvivier@redhat.com>
+RH-MergeRequest: 66: redhat: Update pseries-rhel8.5.0 machine type
+RH-Commit: [2/2] 36f7ad1ea56baaaecb139875ad0a90a6470196be
+RH-Bugzilla: 2022608
+RH-Acked-by: Eric Auger <eric.auger@redhat.com>
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Greg Kurz <gkurz@redhat.com>
+`
+We don't introduce a new machine type for rhel8.6.0 but we need
+to keep compatibility with rhel8.5.0 machine type.
+
+Signed-off-by: Laurent Vivier <lvivier@redhat.com>
+---
+ hw/ppc/spapr.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
+index cace86028d..2f27888d8a 100644
+--- a/hw/ppc/spapr.c
++++ b/hw/ppc/spapr.c
+@@ -5177,10 +5177,14 @@ static void spapr_machine_rhel_default_class_options(MachineClass *mc)
+ 
+ static void spapr_machine_rhel850_class_options(MachineClass *mc)
+ {
++    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
++
+     /* The default machine type must apply the RHEL specific defaults */
+     spapr_machine_rhel_default_class_options(mc);
+     compat_props_add(mc->compat_props, hw_compat_rhel_8_5,
+                      hw_compat_rhel_8_5_len);
++    smc->pre_6_2_numa_affinity = true;
++    mc->smp_props.prefer_sockets = true;
+ }
+ 
+ DEFINE_SPAPR_MACHINE(rhel850, "rhel8.5.0", true);
+-- 
+2.27.0
+

SOURCES/0020-redhat-Update-s390x-machine-type-compatibility-for-r.patch

@@ -1,38 +0,0 @@
-From c8ad21ca31892f8798cf82508c2b2c61bf3b9895 Mon Sep 17 00:00:00 2001
-From: Thomas Huth <thuth@redhat.com>
-Date: Mon, 4 Apr 2022 12:15:50 +0200
-Subject: redhat: Update s390x machine type compatibility for rebase to QEMU
- 7.0.0
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 143: Update machine type compatibility for QEMU 7.0.0 update [s390x]
-RH-Commit: [23/23] 0ecf97d7bdddc50565b5779c64744b353f715cbd
-RH-Bugzilla: 2064782
-RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-
-No s390x-specific machine class property updates required this time,
-only an update to the default qemu cpu model.
-
-Signed-off-by: Thomas Huth <thuth@redhat.com>
----
- hw/s390x/s390-virtio-ccw.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
-index 08e0f6a79b..4a491d4988 100644
---- a/hw/s390x/s390-virtio-ccw.c
-+++ b/hw/s390x/s390-virtio-ccw.c
-@@ -1121,6 +1121,9 @@ DEFINE_CCW_MACHINE(2_4, "2.4", false);
- 
- static void ccw_machine_rhel900_instance_options(MachineState *machine)
- {
-+    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V6_2 };
-+
-+    s390_set_qemu_cpu_model(0x3906, 14, 2, qemu_cpu_feat);
- }
- 
- static void ccw_machine_rhel900_class_options(MachineClass *mc)
--- 
-2.31.1
-

SOURCES/0021-pc-Move-s3-s4-suspend-disabling-to-compat.patch

@@ -1,70 +0,0 @@
-From 38b89dc24551258b630f09d1c654b6c72b265c79 Mon Sep 17 00:00:00 2001
-From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
-Date: Thu, 14 Apr 2022 14:58:43 +0100
-Subject: pc: Move s3/s4 suspend disabling to compat
-
-RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
-RH-MergeRequest: 155: 7.0 machine type fixes (x86)
-RH-Commit: [26/26] 7d666032d5f5dab1444ebba085f92f2de4e86699
-RH-Bugzilla: 2064771
-
-Our downstream patches currently have tweaks in the C code to disable
-s3/s4; Thomas pointed out we can just set the property.
-
-Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
----
- hw/acpi/ich9.c  | 4 ++--
- hw/acpi/piix4.c | 4 ++--
- hw/i386/pc.c    | 6 ++++++
- 3 files changed, 10 insertions(+), 4 deletions(-)
-
-diff --git a/hw/acpi/ich9.c b/hw/acpi/ich9.c
-index de1e401cdf..bd9bbade70 100644
---- a/hw/acpi/ich9.c
-+++ b/hw/acpi/ich9.c
-@@ -435,8 +435,8 @@ void ich9_pm_add_properties(Object *obj, ICH9LPCPMRegs *pm)
-     static const uint32_t gpe0_len = ICH9_PMIO_GPE0_LEN;
-     pm->acpi_memory_hotplug.is_enabled = true;
-     pm->cpu_hotplug_legacy = true;
--    pm->disable_s3 = 1;
--    pm->disable_s4 = 1;
-+    pm->disable_s3 = 0;
-+    pm->disable_s4 = 0;
-     pm->s4_val = 2;
-     pm->use_acpi_hotplug_bridge = true;
-     pm->keep_pci_slot_hpc = true;
-diff --git a/hw/acpi/piix4.c b/hw/acpi/piix4.c
-index 28544e78c3..2fb2b43248 100644
---- a/hw/acpi/piix4.c
-+++ b/hw/acpi/piix4.c
-@@ -653,8 +653,8 @@ static void piix4_send_gpe(AcpiDeviceIf *adev, AcpiEventStatusBits ev)
- 
- static Property piix4_pm_properties[] = {
-     DEFINE_PROP_UINT32("smb_io_base", PIIX4PMState, smb_io_base, 0),
--    DEFINE_PROP_UINT8(ACPI_PM_PROP_S3_DISABLED, PIIX4PMState, disable_s3, 1),
--    DEFINE_PROP_UINT8(ACPI_PM_PROP_S4_DISABLED, PIIX4PMState, disable_s4, 1),
-+    DEFINE_PROP_UINT8(ACPI_PM_PROP_S3_DISABLED, PIIX4PMState, disable_s3, 0),
-+    DEFINE_PROP_UINT8(ACPI_PM_PROP_S4_DISABLED, PIIX4PMState, disable_s4, 0),
-     DEFINE_PROP_UINT8(ACPI_PM_PROP_S4_VAL, PIIX4PMState, s4_val, 2),
-     DEFINE_PROP_BOOL(ACPI_PM_PROP_ACPI_PCIHP_BRIDGE, PIIX4PMState,
-                      use_acpi_hotplug_bridge, true),
-diff --git a/hw/i386/pc.c b/hw/i386/pc.c
-index 0886cfe3fe..f98f842f80 100644
---- a/hw/i386/pc.c
-+++ b/hw/i386/pc.c
-@@ -380,6 +380,12 @@ const size_t pc_compat_1_4_len = G_N_ELEMENTS(pc_compat_1_4);
-  * machine type.
-  */
- GlobalProperty pc_rhel_compat[] = {
-+    /* we don't support s3/s4 suspend */
-+    { "PIIX4_PM", "disable_s3", "1" },
-+    { "PIIX4_PM", "disable_s4", "1" },
-+    { "ICH9-LPC", "disable_s3", "1" },
-+    { "ICH9-LPC", "disable_s4", "1" },
-+
-     { TYPE_X86_CPU, "host-phys-bits", "on" },
-     { TYPE_X86_CPU, "host-phys-bits-limit", "48" },
-     { TYPE_X86_CPU, "vmx-entry-load-perf-global-ctrl", "off" },
--- 
-2.31.1
-

SOURCES/0021-redhat-virt-rhel8.5.0-Update-machine-type-compatibil.patch

@@ -0,0 +1,51 @@
+From ce73e939b993cc6be170cdb5d3f2068270593f2b Mon Sep 17 00:00:00 2001
+From: Eric Auger <eric.auger@redhat.com>
+Date: Tue, 16 Nov 2021 17:03:07 +0100
+Subject: redhat: virt-rhel8.5.0: Update machine type compatibility for QEMU
+ 6.2.0 update
+
+RH-Author: Eric Auger <eric.auger@redhat.com>
+RH-MergeRequest: 75: redhat: virt-rhel8.5.0: Update machine type compatibility for QEMU 6.2.0 update
+RH-Commit: [21/21] f027d13654944e3d34e3356affe7af952eec2bed
+RH-Bugzilla: 2022607
+RH-Acked-by: Gavin Shan <gshan@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Acked-by: Andrew Jones <drjones@redhat.com>
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
+
+To keep compatibility with 8.5-AV machine type we need to
+turn few new options on by default:
+smp_props.prefer_sockets, no_cpu_topology, no_tcg_its
+
+TESTED: migrate from rhel-av-8.5.0 to rhel-8.6.0 and vice-versa
+with upstream fix: 33a0c404fb  hw/intc/arm_gicv3_its: Revert version
+increments in vmstate_its
+
+Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ hw/arm/virt.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/hw/arm/virt.c b/hw/arm/virt.c
+index c77d26ab13..e8941afd01 100644
+--- a/hw/arm/virt.c
++++ b/hw/arm/virt.c
+@@ -3225,8 +3225,13 @@ type_init(rhel_machine_init);
+ 
+ static void rhel850_virt_options(MachineClass *mc)
+ {
++    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
++
+     compat_props_add(mc->compat_props, arm_rhel_compat, arm_rhel_compat_len);
+     compat_props_add(mc->compat_props, hw_compat_rhel_8_5, hw_compat_rhel_8_5_len);
++    mc->smp_props.prefer_sockets = true;
++    vmc->no_cpu_topology = true;
++    vmc->no_tcg_its = true;
+ }
+ DEFINE_RHEL_MACHINE_AS_LATEST(8, 5, 0)
+ 
+-- 
+2.27.0
+

SOURCES/0022-Fix-virtio-net-pci-vectors-compat.patch

@@ -0,0 +1,45 @@
+From f9643b6934657292aae0b830627b1e5f9b8cbaa1 Mon Sep 17 00:00:00 2001
+From: Eduardo Habkost <ehabkost@redhat.com>
+Date: Tue, 19 Oct 2021 13:17:06 -0400
+Subject: Fix virtio-net-pci* "vectors" compat
+
+RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
+RH-MergeRequest: 77: 8.6/6.2 mt fixes
+RH-Commit: [21/23] 8ad581932275d2698a99f31bec40b14f1dbd3d2e
+RH-Bugzilla: 2026443
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+
+hw_compat_rhel_8_4 has an issue: it affects only "virtio-net-pci"
+but not "virtio-net-pci-transitional" and
+"virtio-net-pci-non-transitional".  The solution is to use the
+"virtio-net-pci-base" type in compat_props.
+
+An equivalent fix will be submitted for hw_compat_5_2 upstream.
+
+Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
+(cherry picked from commit d45823ab0d0138b2fbaf2ed1e1896d2052f3ccb3)
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ hw/core/machine.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/hw/core/machine.c b/hw/core/machine.c
+index 736c765c30..024b025fc2 100644
+--- a/hw/core/machine.c
++++ b/hw/core/machine.c
+@@ -71,7 +71,11 @@ GlobalProperty hw_compat_rhel_8_4[] = {
+     /* hw_compat_rhel_8_4 from hw_compat_5_2 */
+     { "virtio-blk-device", "report-discard-granularity", "off" },
+     /* hw_compat_rhel_8_4 from hw_compat_5_2 */
+-    { "virtio-net-pci", "vectors", "3"},
++    /*
++     * Upstream incorrectly had "virtio-net-pci" instead of "virtio-net-pci-base",
++     * (https://bugzilla.redhat.com/show_bug.cgi?id=1999141)
++     */
++    { "virtio-net-pci-base", "vectors", "3"},
+ };
+ const size_t hw_compat_rhel_8_4_len = G_N_ELEMENTS(hw_compat_rhel_8_4);
+ 
+-- 
+2.27.0
+

SOURCES/0023-x86-rhel-machine-types-Add-pc_rhel_8_5_compat.patch

@@ -0,0 +1,73 @@
+From 7ad8814e583dcc7dc23e3e8398570243b8f176a1 Mon Sep 17 00:00:00 2001
+From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
+Date: Tue, 23 Nov 2021 17:57:42 +0000
+Subject: x86/rhel machine types: Add pc_rhel_8_5_compat
+
+RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
+RH-MergeRequest: 77: 8.6/6.2 mt fixes
+RH-Commit: [22/23] 8bf555c5d78f344b97ffd5c888c7a7bed592d9d0
+RH-Bugzilla: 2026443
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+
+Add pc_rhel_8_5_compat as the merge of pc_compat_6_1 and pc_compat_6_0
+(since 8.5 was based on 6.0).
+
+Note, x-keep-pci-slot-hpc flipped back and forward, leaving it out
+looks like it leaves us with the original.
+
+Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ hw/i386/pc.c         | 21 +++++++++++++++++++++
+ include/hw/i386/pc.h |  3 +++
+ 2 files changed, 24 insertions(+)
+
+diff --git a/hw/i386/pc.c b/hw/i386/pc.c
+index e8109954ca..4c08a1971c 100644
+--- a/hw/i386/pc.c
++++ b/hw/i386/pc.c
+@@ -387,6 +387,27 @@ GlobalProperty pc_rhel_compat[] = {
+ };
+ const size_t pc_rhel_compat_len = G_N_ELEMENTS(pc_rhel_compat);
+ 
++GlobalProperty pc_rhel_8_5_compat[] = {
++    /* pc_rhel_8_5_compat from pc_compat_6_0 */
++    { "qemu64" "-" TYPE_X86_CPU, "family", "6" },
++    /* pc_rhel_8_5_compat from pc_compat_6_0 */
++    { "qemu64" "-" TYPE_X86_CPU, "model", "6" },
++    /* pc_rhel_8_5_compat from pc_compat_6_0 */
++    { "qemu64" "-" TYPE_X86_CPU, "stepping", "3" },
++    /* pc_rhel_8_5_compat from pc_compat_6_0 */
++    { TYPE_X86_CPU, "x-vendor-cpuid-only", "off" },
++    /* pc_rhel_8_5_compat from pc_compat_6_0 */
++    { "ICH9-LPC", ACPI_PM_PROP_ACPI_PCIHP_BRIDGE, "off" },
++
++    /* pc_rhel_8_5_compat from pc_compat_6_1 */
++    { TYPE_X86_CPU, "hv-version-id-build", "0x1bbc" },
++    /* pc_rhel_8_5_compat from pc_compat_6_1 */
++    { TYPE_X86_CPU, "hv-version-id-major", "0x0006" },
++    /* pc_rhel_8_5_compat from pc_compat_6_1 */
++    { TYPE_X86_CPU, "hv-version-id-minor", "0x0001" },
++};
++const size_t pc_rhel_8_5_compat_len = G_N_ELEMENTS(pc_rhel_8_5_compat);
++
+ GlobalProperty pc_rhel_8_4_compat[] = {
+     /* pc_rhel_8_4_compat from pc_compat_5_2 */
+     { "ICH9-LPC", "x-smi-cpu-hotunplug", "off" },
+diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
+index d0544ee119..9e8bfb69f8 100644
+--- a/include/hw/i386/pc.h
++++ b/include/hw/i386/pc.h
+@@ -286,6 +286,9 @@ extern const size_t pc_compat_1_4_len;
+ extern GlobalProperty pc_rhel_compat[];
+ extern const size_t pc_rhel_compat_len;
+ 
++extern GlobalProperty pc_rhel_8_5_compat[];
++extern const size_t pc_rhel_8_5_compat_len;
++
+ extern GlobalProperty pc_rhel_8_4_compat[];
+ extern const size_t pc_rhel_8_4_compat_len;
+ 
+-- 
+2.27.0
+

SOURCES/0024-x86-rhel-machine-types-Wire-compat-into-q35-and-i440.patch

@@ -0,0 +1,54 @@
+From 7bd99eebadfdbea6a76585b526e7cab1ee8b1fde Mon Sep 17 00:00:00 2001
+From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
+Date: Tue, 23 Nov 2021 18:07:49 +0000
+Subject: x86/rhel machine types: Wire compat into q35 and i440fx
+
+RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
+RH-MergeRequest: 77: 8.6/6.2 mt fixes
+RH-Commit: [23/23] fc3861aeccc943b434231193ef45ffbc0b3cf6c6
+RH-Bugzilla: 2026443
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+
+Wire the pc_rhel_8_5 compat data into both piix and q35
+to keep the existing machine types compatible.
+
+Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ hw/i386/pc_piix.c | 4 ++++
+ hw/i386/pc_q35.c  | 4 ++++
+ 2 files changed, 8 insertions(+)
+
+diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
+index 2885edffe9..37fab00733 100644
+--- a/hw/i386/pc_piix.c
++++ b/hw/i386/pc_piix.c
+@@ -1040,6 +1040,10 @@ static void pc_machine_rhel760_options(MachineClass *m)
+     pcmc->kvmclock_create_always = false;
+     /* From pc_i440fx_5_1_machine_options() */
+     pcmc->pci_root_uid = 1;
++    compat_props_add(m->compat_props, hw_compat_rhel_8_5,
++                     hw_compat_rhel_8_5_len);
++    compat_props_add(m->compat_props, pc_rhel_8_5_compat,
++                     pc_rhel_8_5_compat_len);
+     compat_props_add(m->compat_props, hw_compat_rhel_8_4,
+                      hw_compat_rhel_8_4_len);
+     compat_props_add(m->compat_props, pc_rhel_8_4_compat,
+diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
+index c67418b6a9..78876e1101 100644
+--- a/hw/i386/pc_q35.c
++++ b/hw/i386/pc_q35.c
+@@ -658,6 +658,10 @@ static void pc_q35_machine_rhel850_options(MachineClass *m)
+     m->desc = "RHEL-8.5.0 PC (Q35 + ICH9, 2009)";
+     pcmc->smbios_stream_product = "RHEL-AV";
+     pcmc->smbios_stream_version = "8.5.0";
++    compat_props_add(m->compat_props, hw_compat_rhel_8_5,
++                     hw_compat_rhel_8_5_len);
++    compat_props_add(m->compat_props, pc_rhel_8_5_compat,
++                     pc_rhel_8_5_compat_len);
+ }
+ 
+ DEFINE_PC_MACHINE(q35_rhel850, "pc-q35-rhel8.5.0", pc_q35_init_rhel850,
+-- 
+2.27.0
+

SOURCES/0025-redhat-Add-s390x-machine-type-compatibility-handling.patch

@@ -0,0 +1,58 @@
+From 265a57f2955b7f0b65e3f57f89aa1ff2541d3f73 Mon Sep 17 00:00:00 2001
+From: Thomas Huth <thuth@redhat.com>
+Date: Fri, 26 Nov 2021 09:37:11 +0100
+Subject: redhat: Add s390x machine type compatibility handling for the rebase
+ to v6.2
+
+RH-Author: Thomas Huth <thuth@redhat.com>
+RH-MergeRequest: 80: Add s390x machine type compatibility handling for the rebase to v6.2
+RH-Commit: [26/26] c45cf594604f6dd23954696b9c84d2025e328d11
+RH-Bugzilla: 2022602
+RH-Acked-by: David Hildenbrand <david@redhat.com>
+RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+
+Add compatibility handling for the rhel8.5.0 machine type (and
+recursively older, of course).
+
+Based on the following upstream commits:
+
+ 463e50da8b - s390x/cpumodel: Bump up QEMU model to a stripped-down IBM z14 GA2
+ 30e398f796 - s390x/cpumodel: Add more feature to gen16 default model
+ 4a0af2930a - machine: Prefer cores over sockets in smp parsing since 6.2
+ 2b52619994 - machine: Move smp_prefer_sockets to struct SMPCompatProps
+
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+---
+ hw/s390x/s390-virtio-ccw.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
+index 181856e6cf..cf13c457d6 100644
+--- a/hw/s390x/s390-virtio-ccw.c
++++ b/hw/s390x/s390-virtio-ccw.c
+@@ -1105,11 +1105,21 @@ DEFINE_CCW_MACHINE(2_4, "2.4", false);
+ 
+ static void ccw_machine_rhel850_instance_options(MachineState *machine)
+ {
++    static const S390FeatInit qemu_cpu_feat = { S390_FEAT_LIST_QEMU_V6_0 };
++
++    s390_set_qemu_cpu_model(0x2964, 13, 2, qemu_cpu_feat);
++
++    s390_cpudef_featoff_greater(16, 1, S390_FEAT_NNPA);
++    s390_cpudef_featoff_greater(16, 1, S390_FEAT_VECTOR_PACKED_DECIMAL_ENH2);
++    s390_cpudef_featoff_greater(16, 1, S390_FEAT_BEAR_ENH);
++    s390_cpudef_featoff_greater(16, 1, S390_FEAT_RDP);
++    s390_cpudef_featoff_greater(16, 1, S390_FEAT_PAI);
+ }
+ 
+ static void ccw_machine_rhel850_class_options(MachineClass *mc)
+ {
+     compat_props_add(mc->compat_props, hw_compat_rhel_8_5, hw_compat_rhel_8_5_len);
++    mc->smp_props.prefer_sockets = true;
+ }
+ DEFINE_CCW_MACHINE(rhel850, "rhel8.5.0", true);
+ 
+-- 
+2.27.0
+

SOURCES/81-kvm-rhel.rules

@@ -0,0 +1 @@
+DEVPATH=="*/kvm", ACTION=="change", RUN+="/lib/udev/udev-kvm-check $env{COUNT} $env{EVENT}"

SOURCES/85-kvm.preset

@@ -0,0 +1,5 @@
+# Enable kvm-setup by default.  This can have odd side effects on
+# PowerNV systems that aren't intended as KVM hosts, but at present we
+# only support RHEL on PowerNV for the purpose of being a RHEV host.
+
+enable kvm-setup.service

SOURCES/ksm.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=Kernel Samepage Merging
+ConditionPathExists=/sys/kernel/mm/ksm
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+EnvironmentFile=-/etc/sysconfig/ksm
+ExecStart=/usr/libexec/ksmctl start
+ExecStop=/usr/libexec/ksmctl stop
+
+[Install]
+WantedBy=multi-user.target

SOURCES/ksm.sysconfig

@@ -0,0 +1,4 @@
+# The maximum number of unswappable kernel pages
+# which may be allocated by ksm (0 for unlimited)
+# If unset, defaults to half of total memory
+# KSM_MAX_KERNEL_PAGES=

SOURCES/ksmctl.c

@@ -0,0 +1,77 @@
+/* Start/stop KSM, for systemd.
+ * Copyright (C) 2009, 2011 Red Hat, Inc.
+ * Written by Paolo Bonzini <pbonzini@redhat.com>.
+ * Based on the original sysvinit script by Dan Kenigsberg <danken@redhat.com>
+ * This file is distributed under the GNU General Public License, version 2
+ * or later.  */
+
+#include <unistd.h>
+#include <stdio.h>
+#include <limits.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+
+#define KSM_MAX_KERNEL_PAGES_FILE "/sys/kernel/mm/ksm/max_kernel_pages"
+#define KSM_RUN_FILE		  "/sys/kernel/mm/ksm/run"
+
+char *program_name;
+
+int usage(void)
+{
+	fprintf(stderr, "Usage: %s {start|stop}\n", program_name);
+	return 1;
+}
+
+int write_value(uint64_t value, char *filename)
+{
+	FILE *fp;
+	if (!(fp = fopen(filename, "w")) ||
+	    fprintf(fp, "%llu\n", (unsigned long long) value) == EOF ||
+	    fflush(fp) == EOF ||
+	    fclose(fp) == EOF)
+		return 1;
+
+	return 0;
+}
+
+uint64_t ksm_max_kernel_pages()
+{
+	char *var = getenv("KSM_MAX_KERNEL_PAGES");
+	char *endptr;
+	uint64_t value;
+	if (var && *var) {
+		value = strtoll(var, &endptr, 0);
+		if (value < LLONG_MAX && !*endptr)
+			return value;
+	}
+	/* Unless KSM_MAX_KERNEL_PAGES is set, let KSM munch up to half of
+	 * total memory.  */
+	return sysconf(_SC_PHYS_PAGES) / 2;
+}
+
+int start(void)
+{
+	if (access(KSM_MAX_KERNEL_PAGES_FILE, R_OK) >= 0)
+		write_value(ksm_max_kernel_pages(), KSM_MAX_KERNEL_PAGES_FILE);
+	return write_value(1, KSM_RUN_FILE);
+}
+
+int stop(void)
+{
+	return write_value(0, KSM_RUN_FILE);
+}
+
+int main(int argc, char **argv)
+{
+	program_name = argv[0];
+	if (argc < 2) {
+		return usage();
+	} else if (!strcmp(argv[1], "start")) {
+		return start();
+	} else if (!strcmp(argv[1], "stop")) {
+		return stop();
+	} else {
+		return usage();
+	}
+}

SOURCES/ksmtuned

@@ -0,0 +1,139 @@
+#!/bin/bash
+#
+# Copyright 2009 Red Hat, Inc. and/or its affiliates.
+# Released under the GPL
+#
+# Author:      Dan Kenigsberg <danken@redhat.com>
+#
+# ksmtuned - a simple script that controls whether (and with what vigor) ksm
+# should search for duplicated pages.
+#
+# starts ksm when memory commited to qemu processes exceeds a threshold, and
+# make ksm work harder and harder untill memory load falls below that
+# threshold.
+#
+# send SIGUSR1 to this process right after a new qemu process is started, or
+# following its death, to retune ksm accordingly
+#
+# needs testing and ironing. contact danken@redhat.com if something breaks.
+
+if [ -f /etc/ksmtuned.conf ]; then
+    . /etc/ksmtuned.conf
+fi
+
+debug() {
+    if [ -n "$DEBUG" ]; then
+        s="`/bin/date`: $*"
+        [ -n "$LOGFILE" ] && echo "$s" >> "$LOGFILE" || echo "$s"
+    fi
+}
+
+
+KSM_MONITOR_INTERVAL=${KSM_MONITOR_INTERVAL:-60}
+KSM_NPAGES_BOOST=${KSM_NPAGES_BOOST:-300}
+KSM_NPAGES_DECAY=${KSM_NPAGES_DECAY:--50}
+
+KSM_NPAGES_MIN=${KSM_NPAGES_MIN:-64}
+KSM_NPAGES_MAX=${KSM_NPAGES_MAX:-1250}
+# millisecond sleep between ksm scans for 16Gb server. Smaller servers sleep
+# more, bigger sleep less.
+KSM_SLEEP_MSEC=${KSM_SLEEP_MSEC:-10}
+
+KSM_THRES_COEF=${KSM_THRES_COEF:-20}
+KSM_THRES_CONST=${KSM_THRES_CONST:-2048}
+
+total=`awk '/^MemTotal:/ {print $2}' /proc/meminfo`
+debug total $total
+
+npages=0
+sleep=$[KSM_SLEEP_MSEC * 16 * 1024 * 1024 / total]
+[ $sleep -le 10 ] && sleep=10
+debug sleep $sleep
+thres=$[total * KSM_THRES_COEF / 100]
+if [ $KSM_THRES_CONST -gt $thres ]; then
+    thres=$KSM_THRES_CONST
+fi
+debug thres $thres
+
+KSMCTL () {
+    case x$1 in
+        xstop)
+            echo 0 > /sys/kernel/mm/ksm/run
+            ;;
+        xstart)
+            echo $2 > /sys/kernel/mm/ksm/pages_to_scan
+            echo $3 > /sys/kernel/mm/ksm/sleep_millisecs
+            echo 1 > /sys/kernel/mm/ksm/run
+            ;;
+    esac
+}
+
+committed_memory () {
+    # calculate how much memory is committed to running qemu processes
+    local pidlist
+    pidlist=$(pgrep -d ' ' -- '^qemu(-(kvm|system-.+)|:.{1,11})$')
+    if [ -n "$pidlist" ]; then
+        ps -p "$pidlist" -o rsz=
+    fi | awk '{ sum += $1 }; END { print 0+sum }'
+}
+
+free_memory () {
+    awk '/^(MemFree|Buffers|Cached):/ {free += $2}; END {print free}' \
+                /proc/meminfo
+}
+
+increase_npages() {
+    local delta
+    delta=${1:-0}
+    npages=$[npages + delta]
+    if [ $npages -lt $KSM_NPAGES_MIN ]; then
+        npages=$KSM_NPAGES_MIN
+    elif [ $npages -gt $KSM_NPAGES_MAX ]; then
+        npages=$KSM_NPAGES_MAX
+    fi
+    echo $npages
+}
+
+
+adjust () {
+    local free committed
+    free=`free_memory`
+    committed=`committed_memory`
+    debug committed $committed free $free
+    if [ $[committed + thres] -lt $total -a $free -gt $thres ]; then
+        KSMCTL stop
+        debug "$[committed + thres] < $total and free > $thres, stop ksm"
+        return 1
+    fi
+    debug "$[committed + thres] > $total, start ksm"
+    if [ $free -lt $thres ]; then
+        npages=`increase_npages $KSM_NPAGES_BOOST`
+        debug "$free < $thres, boost"
+    else
+        npages=`increase_npages $KSM_NPAGES_DECAY`
+        debug "$free > $thres, decay"
+    fi
+    KSMCTL start $npages $sleep
+    debug "KSMCTL start $npages $sleep"
+    return 0
+}
+
+function nothing () {
+    :
+}
+
+loop () {
+    trap nothing SIGUSR1
+    while true
+    do
+        sleep $KSM_MONITOR_INTERVAL &
+        wait $!
+        adjust
+    done
+}
+
+PIDFILE=${PIDFILE-/var/run/ksmtune.pid}
+if touch "$PIDFILE"; then
+  loop &
+  echo $! > "$PIDFILE"
+fi

SOURCES/ksmtuned.conf

@@ -0,0 +1,21 @@
+# Configuration file for ksmtuned.
+
+# How long ksmtuned should sleep between tuning adjustments
+# KSM_MONITOR_INTERVAL=60
+
+# Millisecond sleep between ksm scans for 16Gb server.
+# Smaller servers sleep more, bigger sleep less.
+# KSM_SLEEP_MSEC=10
+
+# KSM_NPAGES_BOOST=300
+# KSM_NPAGES_DECAY=-50
+# KSM_NPAGES_MIN=64
+# KSM_NPAGES_MAX=1250
+
+# KSM_THRES_COEF=20
+# KSM_THRES_CONST=2048
+
+# uncomment the following if you want ksmtuned debug info
+
+# LOGFILE=/var/log/ksmtuned
+# DEBUG=1

SOURCES/ksmtuned.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=Kernel Samepage Merging (KSM) Tuning Daemon
+After=ksm.service
+Requires=ksm.service
+
+[Service]
+ExecStart=/usr/sbin/ksmtuned
+ExecReload=/bin/kill -USR1 $MAINPID
+Type=forking
+
+[Install]
+WantedBy=multi-user.target

SOURCES/kvm-Add-dirty-sync-missed-zero-copy-migration-stat.patch

@@ -1,18 +1,18 @@
-From ac346634c5731407baa9de709dbd4d5cc6f45301 Mon Sep 17 00:00:00 2001
+From cd49a32e9c9e33efc51652b68180a07683814b4d Mon Sep 17 00:00:00 2001
 From: Leonardo Bras <leobras@redhat.com>
 Date: Mon, 11 Jul 2022 18:11:12 -0300
-Subject: [PATCH 02/11] Add dirty-sync-missed-zero-copy migration stat
+Subject: [PATCH 4/9] Add dirty-sync-missed-zero-copy migration stat
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 
 RH-Author: Leonardo Brás <leobras@redhat.com>
-RH-MergeRequest: 111: zero-copy-send fixes & improvements
-RH-Commit: [2/6] 115035fd0a4e4b9439c91fb0f5d1a2f9244ba369 (LeoBras/centos-qemu-kvm)
-RH-Bugzilla: 2107466
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-MergeRequest: 201: Zero-copy-send fixes + improvements
+RH-Commit: [4/8] 56cce61cf95aafc8dafae7531b43c166084abfec
+RH-Bugzilla: 2110203
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+RH-Acked-by: Peter Xu <peterx@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 
 Signed-off-by: Leonardo Bras <leobras@redhat.com>
 Acked-by: Markus Armbruster <armbru@redhat.com>
@@ -29,10 +29,10 @@ Signed-off-by: Leonardo Bras <leobras@redhat.com>
  3 files changed, 13 insertions(+), 1 deletion(-)
 
 diff --git a/migration/migration.c b/migration/migration.c
-index 8fb3eae910..3a3a7a4a50 100644
+index e100b30f00..952a26c5c2 100644
 --- a/migration/migration.c
 +++ b/migration/migration.c
-@@ -1017,6 +1017,8 @@ static void populate_ram_info(MigrationInfo *info, MigrationState *s)
+@@ -1012,6 +1012,8 @@ static void populate_ram_info(MigrationInfo *info, MigrationState *s)
      info->ram->normal_bytes = ram_counters.normal * page_size;
      info->ram->mbps = s->mbps;
      info->ram->dirty_sync_count = ram_counters.dirty_sync_count;
@@ -42,7 +42,7 @@ index 8fb3eae910..3a3a7a4a50 100644
      info->ram->page_size = page_size;
      info->ram->multifd_bytes = ram_counters.multifd_bytes;
 diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
-index 634968498b..9cec01de38 100644
+index 8c384dc1b2..f7216ab5d0 100644
 --- a/monitor/hmp-cmds.c
 +++ b/monitor/hmp-cmds.c
 @@ -305,6 +305,11 @@ void hmp_info_migrate(Monitor *mon, const QDict *qdict)
@@ -58,7 +58,7 @@ index 634968498b..9cec01de38 100644
  
      if (info->has_disk) {
 diff --git a/qapi/migration.json b/qapi/migration.json
-index 5105790cd0..9b38b3c21c 100644
+index c8ec260ab0..94bc5c69db 100644
 --- a/qapi/migration.json
 +++ b/qapi/migration.json
 @@ -55,6 +55,10 @@

SOURCES/kvm-Enable-SGX-RH-Only.patch

@@ -0,0 +1,28 @@
+From db6e042fe4fdc1a1bbf562a46b15d4d8e33e2fa6 Mon Sep 17 00:00:00 2001
+From: Paul Lai <plai@redhat.com>
+Date: Tue, 25 Jan 2022 15:16:22 -0500
+Subject: [PATCH 4/7] Enable SGX  -- RH Only
+
+RH-Author: Paul Lai <None>
+RH-MergeRequest: 111: numa: Enable numa for SGX EPC sections
+RH-Commit: [4/5] cea874f29984897ef1232fb7749c13203c888034
+RH-Bugzilla: 1518984
+RH-Acked-by: Paolo Bonzini <None>
+RH-Acked-by: Bandan Das <None>
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+---
+ configs/devices/x86_64-softmmu/x86_64-rh-devices.mak | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
+index ddf036f042..fdbbdf9742 100644
+--- a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
++++ b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
+@@ -102,3 +102,4 @@ CONFIG_TPM_CRB=y
+ CONFIG_TPM_TIS_ISA=y
+ CONFIG_TPM_EMULATOR=y
+ CONFIG_TPM_PASSTHROUGH=y
++CONFIG_SGX=y
+-- 
+2.27.0
+

SOURCES/kvm-Enable-virtio-iommu-pci-on-aarch64.patch

@@ -1,41 +0,0 @@
-From 85781b8745fa1581a66f64011d61a4f0c4e103dc Mon Sep 17 00:00:00 2001
-From: Eric Auger <eric.auger@redhat.com>
-Date: Fri, 6 May 2022 17:03:11 +0200
-Subject: [PATCH 3/5] Enable virtio-iommu-pci on aarch64
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 83: Enable virtio-iommu-pci on aarch64
-RH-Commit: [1/1] 23e5c0832e52c66adf5fd6daccdc3edddc7ecb8b (eauger1/centos-qemu-kvm)
-RH-Bugzilla: 1477099
-RH-Acked-by: Gavin Shan <gshan@redhat.com>
-RH-Acked-by: Andrew Jones <drjones@redhat.com>
-RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
-
-Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1477099
-Brew: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=45128798
-Upstream Status: RHEL-only
-Tested: With virtio-net-pci and virtio-block-pci
-
-let's enable the virtio-iommu-pci device on aarch64 by
-turning CONFIG_VIRTIO_IOMMU on.
-
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- configs/devices/aarch64-softmmu/aarch64-rh-devices.mak | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak b/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
-index 187938573f..1618d31b89 100644
---- a/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
-+++ b/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
-@@ -23,6 +23,7 @@ CONFIG_VFIO_PCI=y
- CONFIG_VIRTIO_MMIO=y
- CONFIG_VIRTIO_PCI=y
- CONFIG_VIRTIO_MEM=y
-+CONFIG_VIRTIO_IOMMU=y
- CONFIG_XIO3130=y
- CONFIG_NVDIMM=y
- CONFIG_ACPI_APEI=y
--- 
-2.31.1
-

SOURCES/kvm-Enable-virtio-iommu-pci-on-x86_64.patch

@@ -1,41 +0,0 @@
-From c531a39171201f8a1d063e6af752e5d629c1b4bf Mon Sep 17 00:00:00 2001
-From: Eric Auger <eric.auger@redhat.com>
-Date: Thu, 9 Jun 2022 11:35:18 +0200
-Subject: [PATCH 4/6] Enable virtio-iommu-pci on x86_64
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 100: Enable virtio-iommu-pci on x86_64
-RH-Commit: [1/1] a164af477efc7cb9d3d76a0e644f198f7c9fb2b5 (eauger1/centos-qemu-kvm)
-RH-Bugzilla: 2094252
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: MST <mst@redhat.com>
-RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
-
-Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2094252
-Brew: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=45871185
-Upstream Status: RHEL-only
-Tested: With virtio-net-pci and virtio-block-pci
-
-let's enable the virtio-iommu-pci device on x86_64 by
-turning CONFIG_VIRTIO_IOMMU on.
-
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- configs/devices/x86_64-softmmu/x86_64-rh-devices.mak | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
-index d0c9e66641..3850b9de72 100644
---- a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
-+++ b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
-@@ -90,6 +90,7 @@ CONFIG_VHOST_USER_BLK=y
- CONFIG_VIRTIO_MEM=y
- CONFIG_VIRTIO_PCI=y
- CONFIG_VIRTIO_VGA=y
-+CONFIG_VIRTIO_IOMMU=y
- CONFIG_VMMOUSE=y
- CONFIG_VMPORT=y
- CONFIG_VTD=y
--- 
-2.31.1
-

SOURCES/kvm-Introduce-event-loop-base-abstract-class.patch

@@ -1,503 +0,0 @@
-From 1163da281c178359dd7e1cf1ced5c98caa600f8e Mon Sep 17 00:00:00 2001
-From: Nicolas Saenz Julienne <nsaenzju@redhat.com>
-Date: Mon, 25 Apr 2022 09:57:21 +0200
-Subject: [PATCH 01/16] Introduce event-loop-base abstract class
-
-RH-Author: Nicolas Saenz Julienne <nsaenzju@redhat.com>
-RH-MergeRequest: 93: util/thread-pool: Expose minimum and maximum size
-RH-Commit: [1/3] 5817205d8f56cc4aa98bd5963ecac54a59bad990
-RH-Bugzilla: 2031024
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-
-Introduce the 'event-loop-base' abstract class, it'll hold the
-properties common to all event loops and provide the necessary hooks for
-their creation and maintenance. Then have iothread inherit from it.
-
-EventLoopBaseClass is defined as user creatable and provides a hook for
-its children to attach themselves to the user creatable class 'complete'
-function. It also provides an update_params() callback to propagate
-property changes onto its children.
-
-The new 'event-loop-base' class will live in the root directory. It is
-built on its own using the 'link_whole' option (there are no direct
-function dependencies between the class and its children, it all happens
-trough 'constructor' magic). And also imposes new compilation
-dependencies:
-
-    qom <- event-loop-base <- blockdev (iothread.c)
-
-And in subsequent patches:
-
-    qom <- event-loop-base <- qemuutil (util/main-loop.c)
-
-All this forced some amount of reordering in meson.build:
-
- - Moved qom build definition before qemuutil. Doing it the other way
-   around (i.e. moving qemuutil after qom) isn't possible as a lot of
-   core libraries that live in between the two depend on it.
-
- - Process the 'hw' subdir earlier, as it introduces files into the
-   'qom' source set.
-
-No functional changes intended.
-
-Signed-off-by: Nicolas Saenz Julienne <nsaenzju@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Acked-by: Markus Armbruster <armbru@redhat.com>
-Message-id: 20220425075723.20019-2-nsaenzju@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit 7d5983e3c8c40b1d0668faba31d79905c4fadd7d)
----
- event-loop-base.c                | 104 +++++++++++++++++++++++++++++++
- include/sysemu/event-loop-base.h |  36 +++++++++++
- include/sysemu/iothread.h        |   6 +-
- iothread.c                       |  65 ++++++-------------
- meson.build                      |  23 ++++---
- qapi/qom.json                    |  22 +++++--
- 6 files changed, 192 insertions(+), 64 deletions(-)
- create mode 100644 event-loop-base.c
- create mode 100644 include/sysemu/event-loop-base.h
-
-diff --git a/event-loop-base.c b/event-loop-base.c
-new file mode 100644
-index 0000000000..a924c73a7c
---- /dev/null
-+++ b/event-loop-base.c
-@@ -0,0 +1,104 @@
-+/*
-+ * QEMU event-loop base
-+ *
-+ * Copyright (C) 2022 Red Hat Inc
-+ *
-+ * Authors:
-+ *  Stefan Hajnoczi <stefanha@redhat.com>
-+ *  Nicolas Saenz Julienne <nsaenzju@redhat.com>
-+ *
-+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
-+ * See the COPYING file in the top-level directory.
-+ */
-+
-+#include "qemu/osdep.h"
-+#include "qom/object_interfaces.h"
-+#include "qapi/error.h"
-+#include "sysemu/event-loop-base.h"
-+
-+typedef struct {
-+    const char *name;
-+    ptrdiff_t offset; /* field's byte offset in EventLoopBase struct */
-+} EventLoopBaseParamInfo;
-+
-+static EventLoopBaseParamInfo aio_max_batch_info = {
-+    "aio-max-batch", offsetof(EventLoopBase, aio_max_batch),
-+};
-+
-+static void event_loop_base_get_param(Object *obj, Visitor *v,
-+        const char *name, void *opaque, Error **errp)
-+{
-+    EventLoopBase *event_loop_base = EVENT_LOOP_BASE(obj);
-+    EventLoopBaseParamInfo *info = opaque;
-+    int64_t *field = (void *)event_loop_base + info->offset;
-+
-+    visit_type_int64(v, name, field, errp);
-+}
-+
-+static void event_loop_base_set_param(Object *obj, Visitor *v,
-+        const char *name, void *opaque, Error **errp)
-+{
-+    EventLoopBaseClass *bc = EVENT_LOOP_BASE_GET_CLASS(obj);
-+    EventLoopBase *base = EVENT_LOOP_BASE(obj);
-+    EventLoopBaseParamInfo *info = opaque;
-+    int64_t *field = (void *)base + info->offset;
-+    int64_t value;
-+
-+    if (!visit_type_int64(v, name, &value, errp)) {
-+        return;
-+    }
-+
-+    if (value < 0) {
-+        error_setg(errp, "%s value must be in range [0, %" PRId64 "]",
-+                   info->name, INT64_MAX);
-+        return;
-+    }
-+
-+    *field = value;
-+
-+    if (bc->update_params) {
-+        bc->update_params(base, errp);
-+    }
-+
-+    return;
-+}
-+
-+static void event_loop_base_complete(UserCreatable *uc, Error **errp)
-+{
-+    EventLoopBaseClass *bc = EVENT_LOOP_BASE_GET_CLASS(uc);
-+    EventLoopBase *base = EVENT_LOOP_BASE(uc);
-+
-+    if (bc->init) {
-+        bc->init(base, errp);
-+    }
-+}
-+
-+static void event_loop_base_class_init(ObjectClass *klass, void *class_data)
-+{
-+    UserCreatableClass *ucc = USER_CREATABLE_CLASS(klass);
-+    ucc->complete = event_loop_base_complete;
-+
-+    object_class_property_add(klass, "aio-max-batch", "int",
-+                              event_loop_base_get_param,
-+                              event_loop_base_set_param,
-+                              NULL, &aio_max_batch_info);
-+}
-+
-+static const TypeInfo event_loop_base_info = {
-+    .name = TYPE_EVENT_LOOP_BASE,
-+    .parent = TYPE_OBJECT,
-+    .instance_size = sizeof(EventLoopBase),
-+    .class_size = sizeof(EventLoopBaseClass),
-+    .class_init = event_loop_base_class_init,
-+    .abstract = true,
-+    .interfaces = (InterfaceInfo[]) {
-+        { TYPE_USER_CREATABLE },
-+        { }
-+    }
-+};
-+
-+static void register_types(void)
-+{
-+    type_register_static(&event_loop_base_info);
-+}
-+type_init(register_types);
-diff --git a/include/sysemu/event-loop-base.h b/include/sysemu/event-loop-base.h
-new file mode 100644
-index 0000000000..8e77d8b69f
---- /dev/null
-+++ b/include/sysemu/event-loop-base.h
-@@ -0,0 +1,36 @@
-+/*
-+ * QEMU event-loop backend
-+ *
-+ * Copyright (C) 2022 Red Hat Inc
-+ *
-+ * Authors:
-+ *  Nicolas Saenz Julienne <nsaenzju@redhat.com>
-+ *
-+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
-+ * See the COPYING file in the top-level directory.
-+ */
-+#ifndef QEMU_EVENT_LOOP_BASE_H
-+#define QEMU_EVENT_LOOP_BASE_H
-+
-+#include "qom/object.h"
-+#include "block/aio.h"
-+#include "qemu/typedefs.h"
-+
-+#define TYPE_EVENT_LOOP_BASE         "event-loop-base"
-+OBJECT_DECLARE_TYPE(EventLoopBase, EventLoopBaseClass,
-+                    EVENT_LOOP_BASE)
-+
-+struct EventLoopBaseClass {
-+    ObjectClass parent_class;
-+
-+    void (*init)(EventLoopBase *base, Error **errp);
-+    void (*update_params)(EventLoopBase *base, Error **errp);
-+};
-+
-+struct EventLoopBase {
-+    Object parent;
-+
-+    /* AioContext AIO engine parameters */
-+    int64_t aio_max_batch;
-+};
-+#endif
-diff --git a/include/sysemu/iothread.h b/include/sysemu/iothread.h
-index 7f714bd136..8f8601d6ab 100644
---- a/include/sysemu/iothread.h
-+++ b/include/sysemu/iothread.h
-@@ -17,11 +17,12 @@
- #include "block/aio.h"
- #include "qemu/thread.h"
- #include "qom/object.h"
-+#include "sysemu/event-loop-base.h"
- 
- #define TYPE_IOTHREAD "iothread"
- 
- struct IOThread {
--    Object parent_obj;
-+    EventLoopBase parent_obj;
- 
-     QemuThread thread;
-     AioContext *ctx;
-@@ -37,9 +38,6 @@ struct IOThread {
-     int64_t poll_max_ns;
-     int64_t poll_grow;
-     int64_t poll_shrink;
--
--    /* AioContext AIO engine parameters */
--    int64_t aio_max_batch;
- };
- typedef struct IOThread IOThread;
- 
-diff --git a/iothread.c b/iothread.c
-index 0f98af0f2a..8fa2f3bfb8 100644
---- a/iothread.c
-+++ b/iothread.c
-@@ -17,6 +17,7 @@
- #include "qemu/module.h"
- #include "block/aio.h"
- #include "block/block.h"
-+#include "sysemu/event-loop-base.h"
- #include "sysemu/iothread.h"
- #include "qapi/error.h"
- #include "qapi/qapi-commands-misc.h"
-@@ -152,10 +153,15 @@ static void iothread_init_gcontext(IOThread *iothread)
-     iothread->main_loop = g_main_loop_new(iothread->worker_context, TRUE);
- }
- 
--static void iothread_set_aio_context_params(IOThread *iothread, Error **errp)
-+static void iothread_set_aio_context_params(EventLoopBase *base, Error **errp)
- {
-+    IOThread *iothread = IOTHREAD(base);
-     ERRP_GUARD();
- 
-+    if (!iothread->ctx) {
-+        return;
-+    }
-+
-     aio_context_set_poll_params(iothread->ctx,
-                                 iothread->poll_max_ns,
-                                 iothread->poll_grow,
-@@ -166,14 +172,15 @@ static void iothread_set_aio_context_params(IOThread *iothread, Error **errp)
-     }
- 
-     aio_context_set_aio_params(iothread->ctx,
--                               iothread->aio_max_batch,
-+                               iothread->parent_obj.aio_max_batch,
-                                errp);
- }
- 
--static void iothread_complete(UserCreatable *obj, Error **errp)
-+
-+static void iothread_init(EventLoopBase *base, Error **errp)
- {
-     Error *local_error = NULL;
--    IOThread *iothread = IOTHREAD(obj);
-+    IOThread *iothread = IOTHREAD(base);
-     char *thread_name;
- 
-     iothread->stopping = false;
-@@ -189,7 +196,7 @@ static void iothread_complete(UserCreatable *obj, Error **errp)
-      */
-     iothread_init_gcontext(iothread);
- 
--    iothread_set_aio_context_params(iothread, &local_error);
-+    iothread_set_aio_context_params(base, &local_error);
-     if (local_error) {
-         error_propagate(errp, local_error);
-         aio_context_unref(iothread->ctx);
-@@ -201,7 +208,7 @@ static void iothread_complete(UserCreatable *obj, Error **errp)
-      * to inherit.
-      */
-     thread_name = g_strdup_printf("IO %s",
--                        object_get_canonical_path_component(OBJECT(obj)));
-+                        object_get_canonical_path_component(OBJECT(base)));
-     qemu_thread_create(&iothread->thread, thread_name, iothread_run,
-                        iothread, QEMU_THREAD_JOINABLE);
-     g_free(thread_name);
-@@ -226,9 +233,6 @@ static IOThreadParamInfo poll_grow_info = {
- static IOThreadParamInfo poll_shrink_info = {
-     "poll-shrink", offsetof(IOThread, poll_shrink),
- };
--static IOThreadParamInfo aio_max_batch_info = {
--    "aio-max-batch", offsetof(IOThread, aio_max_batch),
--};
- 
- static void iothread_get_param(Object *obj, Visitor *v,
-         const char *name, IOThreadParamInfo *info, Error **errp)
-@@ -288,35 +292,12 @@ static void iothread_set_poll_param(Object *obj, Visitor *v,
-     }
- }
- 
--static void iothread_get_aio_param(Object *obj, Visitor *v,
--        const char *name, void *opaque, Error **errp)
--{
--    IOThreadParamInfo *info = opaque;
--
--    iothread_get_param(obj, v, name, info, errp);
--}
--
--static void iothread_set_aio_param(Object *obj, Visitor *v,
--        const char *name, void *opaque, Error **errp)
--{
--    IOThread *iothread = IOTHREAD(obj);
--    IOThreadParamInfo *info = opaque;
--
--    if (!iothread_set_param(obj, v, name, info, errp)) {
--        return;
--    }
--
--    if (iothread->ctx) {
--        aio_context_set_aio_params(iothread->ctx,
--                                   iothread->aio_max_batch,
--                                   errp);
--    }
--}
--
- static void iothread_class_init(ObjectClass *klass, void *class_data)
- {
--    UserCreatableClass *ucc = USER_CREATABLE_CLASS(klass);
--    ucc->complete = iothread_complete;
-+    EventLoopBaseClass *bc = EVENT_LOOP_BASE_CLASS(klass);
-+
-+    bc->init = iothread_init;
-+    bc->update_params = iothread_set_aio_context_params;
- 
-     object_class_property_add(klass, "poll-max-ns", "int",
-                               iothread_get_poll_param,
-@@ -330,23 +311,15 @@ static void iothread_class_init(ObjectClass *klass, void *class_data)
-                               iothread_get_poll_param,
-                               iothread_set_poll_param,
-                               NULL, &poll_shrink_info);
--    object_class_property_add(klass, "aio-max-batch", "int",
--                              iothread_get_aio_param,
--                              iothread_set_aio_param,
--                              NULL, &aio_max_batch_info);
- }
- 
- static const TypeInfo iothread_info = {
-     .name = TYPE_IOTHREAD,
--    .parent = TYPE_OBJECT,
-+    .parent = TYPE_EVENT_LOOP_BASE,
-     .class_init = iothread_class_init,
-     .instance_size = sizeof(IOThread),
-     .instance_init = iothread_instance_init,
-     .instance_finalize = iothread_instance_finalize,
--    .interfaces = (InterfaceInfo[]) {
--        {TYPE_USER_CREATABLE},
--        {}
--    },
- };
- 
- static void iothread_register_types(void)
-@@ -383,7 +356,7 @@ static int query_one_iothread(Object *object, void *opaque)
-     info->poll_max_ns = iothread->poll_max_ns;
-     info->poll_grow = iothread->poll_grow;
-     info->poll_shrink = iothread->poll_shrink;
--    info->aio_max_batch = iothread->aio_max_batch;
-+    info->aio_max_batch = iothread->parent_obj.aio_max_batch;
- 
-     QAPI_LIST_APPEND(*tail, info);
-     return 0;
-diff --git a/meson.build b/meson.build
-index 6f7e430f0f..b9c919a55e 100644
---- a/meson.build
-+++ b/meson.build
-@@ -2804,6 +2804,7 @@ subdir('qom')
- subdir('authz')
- subdir('crypto')
- subdir('ui')
-+subdir('hw')
- 
- 
- if enable_modules
-@@ -2811,6 +2812,18 @@ if enable_modules
-   modulecommon = declare_dependency(link_whole: libmodulecommon, compile_args: '-DBUILD_DSO')
- endif
- 
-+qom_ss = qom_ss.apply(config_host, strict: false)
-+libqom = static_library('qom', qom_ss.sources() + genh,
-+                        dependencies: [qom_ss.dependencies()],
-+                        name_suffix: 'fa')
-+qom = declare_dependency(link_whole: libqom)
-+
-+event_loop_base = files('event-loop-base.c')
-+event_loop_base = static_library('event-loop-base', sources: event_loop_base + genh,
-+                                 build_by_default: true)
-+event_loop_base = declare_dependency(link_whole: event_loop_base,
-+                                     dependencies: [qom])
-+
- stub_ss = stub_ss.apply(config_all, strict: false)
- 
- util_ss.add_all(trace_ss)
-@@ -2897,7 +2910,6 @@ subdir('monitor')
- subdir('net')
- subdir('replay')
- subdir('semihosting')
--subdir('hw')
- subdir('tcg')
- subdir('fpu')
- subdir('accel')
-@@ -3022,13 +3034,6 @@ qemu_syms = custom_target('qemu.syms', output: 'qemu.syms',
-                              capture: true,
-                              command: [undefsym, nm, '@INPUT@'])
- 
--qom_ss = qom_ss.apply(config_host, strict: false)
--libqom = static_library('qom', qom_ss.sources() + genh,
--                        dependencies: [qom_ss.dependencies()],
--                        name_suffix: 'fa')
--
--qom = declare_dependency(link_whole: libqom)
--
- authz_ss = authz_ss.apply(config_host, strict: false)
- libauthz = static_library('authz', authz_ss.sources() + genh,
-                           dependencies: [authz_ss.dependencies()],
-@@ -3081,7 +3086,7 @@ libblockdev = static_library('blockdev', blockdev_ss.sources() + genh,
-                              build_by_default: false)
- 
- blockdev = declare_dependency(link_whole: [libblockdev],
--                              dependencies: [block])
-+                              dependencies: [block, event_loop_base])
- 
- qmp_ss = qmp_ss.apply(config_host, strict: false)
- libqmp = static_library('qmp', qmp_ss.sources() + genh,
-diff --git a/qapi/qom.json b/qapi/qom.json
-index eeb5395ff3..a2439533c5 100644
---- a/qapi/qom.json
-+++ b/qapi/qom.json
-@@ -499,6 +499,20 @@
-             '*repeat': 'bool',
-             '*grab-toggle': 'GrabToggleKeys' } }
- 
-+##
-+# @EventLoopBaseProperties:
-+#
-+# Common properties for event loops
-+#
-+# @aio-max-batch: maximum number of requests in a batch for the AIO engine,
-+#                 0 means that the engine will use its default.
-+#                 (default: 0)
-+#
-+# Since: 7.1
-+##
-+{ 'struct': 'EventLoopBaseProperties',
-+  'data': { '*aio-max-batch': 'int' } }
-+
- ##
- # @IothreadProperties:
- #
-@@ -516,17 +530,15 @@
- #               algorithm detects it is spending too long polling without
- #               encountering events. 0 selects a default behaviour (default: 0)
- #
--# @aio-max-batch: maximum number of requests in a batch for the AIO engine,
--#                 0 means that the engine will use its default
--#                 (default:0, since 6.1)
-+# The @aio-max-batch option is available since 6.1.
- #
- # Since: 2.0
- ##
- { 'struct': 'IothreadProperties',
-+  'base': 'EventLoopBaseProperties',
-   'data': { '*poll-max-ns': 'int',
-             '*poll-grow': 'int',
--            '*poll-shrink': 'int',
--            '*aio-max-batch': 'int' } }
-+            '*poll-shrink': 'int' } }
- 
- ##
- # @MemoryBackendProperties:
--- 
-2.31.1
-

SOURCES/kvm-KVM-keep-track-of-running-ioctls.patch

@@ -0,0 +1,82 @@
+From 9bacf8c4104ff3cff2e0e2c2179ec4fda633167f Mon Sep 17 00:00:00 2001
+From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+Date: Mon, 16 Jan 2023 07:51:08 -0500
+Subject: [PATCH 05/11] KVM: keep track of running ioctls
+
+RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+RH-MergeRequest: 247: accel: introduce accelerator blocker API
+RH-Bugzilla: 2161188
+RH-Acked-by: David Hildenbrand <david@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [2/3] 357508389e2a0fd996206b406e9e235e50b5f0b6
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2161188
+
+commit a27dd2de68f37ba96fe164a42121daa5f0750afc
+Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+Date:   Fri Nov 11 10:47:57 2022 -0500
+
+    KVM: keep track of running ioctls
+
+    Using the new accel-blocker API, mark where ioctls are being called
+    in KVM. Next, we will implement the critical section that will take
+    care of performing memslots modifications atomically, therefore
+    preventing any new ioctl from running and allowing the running ones
+    to finish.
+
+    Signed-off-by: David Hildenbrand <david@redhat.com>
+    Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+    Message-Id: <20221111154758.1372674-3-eesposit@redhat.com>
+    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+
+Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+---
+ accel/kvm/kvm-all.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
+index 8f2a53438f..221aadfda7 100644
+--- a/accel/kvm/kvm-all.c
++++ b/accel/kvm/kvm-all.c
+@@ -2337,6 +2337,7 @@ static int kvm_init(MachineState *ms)
+     assert(TARGET_PAGE_SIZE <= qemu_real_host_page_size);
+ 
+     s->sigmask_len = 8;
++    accel_blocker_init();
+ 
+ #ifdef KVM_CAP_SET_GUEST_DEBUG
+     QTAILQ_INIT(&s->kvm_sw_breakpoints);
+@@ -3018,7 +3019,9 @@ int kvm_vm_ioctl(KVMState *s, int type, ...)
+     va_end(ap);
+ 
+     trace_kvm_vm_ioctl(type, arg);
++    accel_ioctl_begin();
+     ret = ioctl(s->vmfd, type, arg);
++    accel_ioctl_end();
+     if (ret == -1) {
+         ret = -errno;
+     }
+@@ -3036,7 +3039,9 @@ int kvm_vcpu_ioctl(CPUState *cpu, int type, ...)
+     va_end(ap);
+ 
+     trace_kvm_vcpu_ioctl(cpu->cpu_index, type, arg);
++    accel_cpu_ioctl_begin(cpu);
+     ret = ioctl(cpu->kvm_fd, type, arg);
++    accel_cpu_ioctl_end(cpu);
+     if (ret == -1) {
+         ret = -errno;
+     }
+@@ -3054,7 +3059,9 @@ int kvm_device_ioctl(int fd, int type, ...)
+     va_end(ap);
+ 
+     trace_kvm_device_ioctl(fd, type, arg);
++    accel_ioctl_begin();
+     ret = ioctl(fd, type, arg);
++    accel_ioctl_end();
+     if (ret == -1) {
+         ret = -errno;
+     }
+-- 
+2.37.3
+

SOURCES/kvm-KVM-x86-workaround-invalid-CPUID-0xD-9-info-on-some-.patch

@@ -0,0 +1,109 @@
+From ea5299b5dde7d0b6b2f93cb646e6a24c9f105466 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Wed, 23 Mar 2022 12:33:25 +0100
+Subject: [PATCH 13/24] KVM: x86: workaround invalid CPUID[0xD,9] info on some
+ AMD processors
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Paul Lai <plai@redhat.com>
+RH-MergeRequest: 176: Enable KVM AMX support
+RH-Commit: [13/13] 38f147c911258e84e01336271ebd23a1c24371fc
+RH-Bugzilla: 1916415
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
+RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+
+Some AMD processors expose the PKRU extended save state even if they do not have
+the related PKU feature in CPUID.  Worse, when they do they report a size of
+64, whereas the expected size of the PKRU extended save state is 8, therefore
+the esa->size == eax assertion does not hold.
+
+The state is already ignored by KVM_GET_SUPPORTED_CPUID because it
+was not enabled in the host XCR0.  However, QEMU kvm_cpu_xsave_init()
+runs before QEMU invokes arch_prctl() to enable dynamically-enabled
+save states such as XTILEDATA, and KVM_GET_SUPPORTED_CPUID hides save
+states that have yet to be enabled.  Therefore, kvm_cpu_xsave_init()
+needs to consult the host CPUID instead of KVM_GET_SUPPORTED_CPUID,
+and dies with an assertion failure.
+
+When setting up the ExtSaveArea array to match the host, ignore features that
+KVM does not report as supported.  This will cause QEMU to skip the incorrect
+CPUID leaf instead of tripping the assertion.
+
+Closes: https://gitlab.com/qemu-project/qemu/-/issues/916
+Reported-by: Daniel P. Berrangé <berrange@redhat.com>
+Analyzed-by: Yang Zhong <yang.zhong@intel.com>
+Reported-by: Peter Krempa <pkrempa@redhat.com>
+Tested-by: Daniel P. Berrangé <berrange@redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 58f7db26f21c690cf9a669c314cfd7371506084a)
+Signed-off-by: Paul Lai <plai@redhat.com>
+---
+ target/i386/cpu.c         |  4 ++--
+ target/i386/cpu.h         |  2 ++
+ target/i386/kvm/kvm-cpu.c | 19 ++++++++++++-------
+ 3 files changed, 16 insertions(+), 9 deletions(-)
+
+diff --git a/target/i386/cpu.c b/target/i386/cpu.c
+index 09e08f7f38..0543b846ff 100644
+--- a/target/i386/cpu.c
++++ b/target/i386/cpu.c
+@@ -4980,8 +4980,8 @@ CpuDefinitionInfoList *qmp_query_cpu_definitions(Error **errp)
+     return cpu_list;
+ }
+ 
+-static uint64_t x86_cpu_get_supported_feature_word(FeatureWord w,
+-                                                   bool migratable_only)
++uint64_t x86_cpu_get_supported_feature_word(FeatureWord w,
++                                            bool migratable_only)
+ {
+     FeatureWordInfo *wi = &feature_word_info[w];
+     uint64_t r = 0;
+diff --git a/target/i386/cpu.h b/target/i386/cpu.h
+index 8ab2a4042a..006b735fe4 100644
+--- a/target/i386/cpu.h
++++ b/target/i386/cpu.h
+@@ -604,6 +604,8 @@ typedef enum FeatureWord {
+ } FeatureWord;
+ 
+ typedef uint64_t FeatureWordArray[FEATURE_WORDS];
++uint64_t x86_cpu_get_supported_feature_word(FeatureWord w,
++                                            bool migratable_only);
+ 
+ /* cpuid_features bits */
+ #define CPUID_FP87 (1U << 0)
+diff --git a/target/i386/kvm/kvm-cpu.c b/target/i386/kvm/kvm-cpu.c
+index bdc967c484..74c1396a93 100644
+--- a/target/i386/kvm/kvm-cpu.c
++++ b/target/i386/kvm/kvm-cpu.c
+@@ -99,13 +99,18 @@ static void kvm_cpu_xsave_init(void)
+     for (i = XSTATE_SSE_BIT + 1; i < XSAVE_STATE_AREA_COUNT; i++) {
+         ExtSaveArea *esa = &x86_ext_save_areas[i];
+ 
+-        if (esa->size) {
+-            host_cpuid(0xd, i, &eax, &ebx, &ecx, &edx);
+-            if (eax != 0) {
+-                assert(esa->size == eax);
+-                esa->offset = ebx;
+-                esa->ecx = ecx;
+-            }
++        if (!esa->size) {
++            continue;
++        }
++        if ((x86_cpu_get_supported_feature_word(esa->feature, false) & esa->bits)
++            != esa->bits) {
++            continue;
++        }
++        host_cpuid(0xd, i, &eax, &ebx, &ecx, &edx);
++        if (eax != 0) {
++            assert(esa->size == eax);
++            esa->offset = ebx;
++            esa->ecx = ecx;
+         }
+     }
+ }
+-- 
+2.35.3
+

SOURCES/kvm-QIOChannel-Add-flags-on-io_writev-and-introduce-io_f.patch

@@ -1,19 +1,19 @@
-From cda3fcf14f2883fea633e25256f6c14a71271adf Mon Sep 17 00:00:00 2001
+From 7eeec7c008e947bc3e1fed682791092b408852c6 Mon Sep 17 00:00:00 2001
 From: Leonardo Bras <leobras@redhat.com>
-Date: Fri, 13 May 2022 03:28:31 -0300
-Subject: [PATCH 08/18] QIOChannel: Add flags on io_writev and introduce
+Date: Wed, 18 May 2022 02:52:24 -0300
+Subject: [PATCH 17/37] QIOChannel: Add flags on io_writev and introduce
  io_flush callback
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 
 RH-Author: Leonardo Brás <leobras@redhat.com>
-RH-MergeRequest: 95: MSG_ZEROCOPY + Multifd
-RH-Commit: [2/11] 06acfb6b0cb2c25733c2eb198011f7623b5a7024 (LeoBras/centos-qemu-kvm)
-RH-Bugzilla: 1968509
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+RH-MergeRequest: 191: MSG_ZEROCOPY + Multifd @ rhel8.7
+RH-Commit: [17/26] 7bde4e79fd3f76a6cc84d9cacf50420584ddd35c
+RH-Bugzilla: 2072049
 RH-Acked-by: Peter Xu <peterx@redhat.com>
+RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
+RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 
 Add flags to io_writev and introduce io_flush as optional callback to
 QIOChannelClass, allowing the implementation of zero copy writes by
@@ -202,7 +202,7 @@ index baa4e2b089..bf52011be2 100644
  {
      QIOChannelBuffer *bioc = QIO_CHANNEL_BUFFER(ioc);
 diff --git a/io/channel-command.c b/io/channel-command.c
-index 338da73ade..54560464ae 100644
+index b2a9e27138..5ff1691bad 100644
 --- a/io/channel-command.c
 +++ b/io/channel-command.c
 @@ -258,6 +258,7 @@ static ssize_t qio_channel_command_writev(QIOChannel *ioc,
@@ -214,7 +214,7 @@ index 338da73ade..54560464ae 100644
  {
      QIOChannelCommand *cioc = QIO_CHANNEL_COMMAND(ioc);
 diff --git a/io/channel-file.c b/io/channel-file.c
-index d7cf6d278f..ef6807a6be 100644
+index c4bf799a80..348a48545e 100644
 --- a/io/channel-file.c
 +++ b/io/channel-file.c
 @@ -114,6 +114,7 @@ static ssize_t qio_channel_file_writev(QIOChannel *ioc,
@@ -226,7 +226,7 @@ index d7cf6d278f..ef6807a6be 100644
  {
      QIOChannelFile *fioc = QIO_CHANNEL_FILE(ioc);
 diff --git a/io/channel-socket.c b/io/channel-socket.c
-index 7a8d9f69c9..a1be2197ca 100644
+index 606ec97cf7..bfbd64787e 100644
 --- a/io/channel-socket.c
 +++ b/io/channel-socket.c
 @@ -525,6 +525,7 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
@@ -258,7 +258,7 @@ index 2ae1b92fc0..4ce890a538 100644
  {
      QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
 diff --git a/io/channel-websock.c b/io/channel-websock.c
-index 55145a6a8c..9619906ac3 100644
+index 70889bb54d..035dd6075b 100644
 --- a/io/channel-websock.c
 +++ b/io/channel-websock.c
 @@ -1127,6 +1127,7 @@ static ssize_t qio_channel_websock_writev(QIOChannel *ioc,
@@ -379,10 +379,10 @@ index e8b019dc36..0640941ac5 100644
  static void qio_channel_restart_read(void *opaque)
  {
 diff --git a/migration/rdma.c b/migration/rdma.c
-index ef1e65ec36..672d1958a9 100644
+index f5d3bbe7e9..54acd2000e 100644
 --- a/migration/rdma.c
 +++ b/migration/rdma.c
-@@ -2840,6 +2840,7 @@ static ssize_t qio_channel_rdma_writev(QIOChannel *ioc,
+@@ -2833,6 +2833,7 @@ static ssize_t qio_channel_rdma_writev(QIOChannel *ioc,
                                         size_t niov,
                                         int *fds,
                                         size_t nfds,

SOURCES/kvm-QIOChannelSocket-Add-support-for-MSG_ZEROCOPY-IPV6.patch

@@ -1,18 +1,18 @@
-From cb6dc39a5e5d2d981b4b1e983042b3fbb529d5d1 Mon Sep 17 00:00:00 2001
+From a6c4aed18a027ce8e107fdf9184e9ea43a86f843 Mon Sep 17 00:00:00 2001
 From: Leonardo Bras <leobras@redhat.com>
 Date: Thu, 4 Aug 2022 04:10:43 -0300
-Subject: [PATCH 06/11] QIOChannelSocket: Add support for MSG_ZEROCOPY + IPV6
+Subject: [PATCH 8/9] QIOChannelSocket: Add support for MSG_ZEROCOPY + IPV6
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 
 RH-Author: Leonardo Brás <leobras@redhat.com>
-RH-MergeRequest: 111: zero-copy-send fixes & improvements
-RH-Commit: [6/6] 2eb1aba8ebf267a6f67cfba2e489dc88619c7fd4 (LeoBras/centos-qemu-kvm)
-RH-Bugzilla: 2107466
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-MergeRequest: 201: Zero-copy-send fixes + improvements
+RH-Commit: [8/8] 6e26ee7c9ebaedb07623313cb0678816867751dd
+RH-Bugzilla: 2110203
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+RH-Acked-by: Peter Xu <peterx@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 
 For using MSG_ZEROCOPY, there are two steps:
 1 - io_writev() the packet, which enqueues the packet for sending, and
@@ -37,7 +37,7 @@ Signed-off-by: Leonardo Bras <leobras@redhat.com>
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/io/channel-socket.c b/io/channel-socket.c
-index eb7baa2184..efd5f60808 100644
+index cf0d67c51b..6010ad7017 100644
 --- a/io/channel-socket.c
 +++ b/io/channel-socket.c
 @@ -747,8 +747,8 @@ static int qio_channel_socket_flush(QIOChannel *ioc,

SOURCES/kvm-QIOChannelSocket-Fix-zero-copy-flush-returning-code-.patch

@@ -1,19 +1,19 @@
-From 678981c6bb7c964e1591f6f8aba49e9602f64852 Mon Sep 17 00:00:00 2001
+From 905cc8032fc63619efb3f0a8c9754b7190bcc43a Mon Sep 17 00:00:00 2001
 From: Leonardo Bras <leobras@redhat.com>
 Date: Mon, 11 Jul 2022 18:11:11 -0300
-Subject: [PATCH 01/11] QIOChannelSocket: Fix zero-copy flush returning code 1
+Subject: [PATCH 3/9] QIOChannelSocket: Fix zero-copy flush returning code 1
  when nothing sent
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 
 RH-Author: Leonardo Brás <leobras@redhat.com>
-RH-MergeRequest: 111: zero-copy-send fixes & improvements
-RH-Commit: [1/6] cebc887cb61de1572d8ae3232cde45e80c339404 (LeoBras/centos-qemu-kvm)
-RH-Bugzilla: 2107466
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-MergeRequest: 201: Zero-copy-send fixes + improvements
+RH-Commit: [3/8] 1ad707702fa26cd4d0fa1870c21f5f26ae93ff97
+RH-Bugzilla: 2110203
 RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+RH-Acked-by: Peter Xu <peterx@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 
 If flush is called when no buffer was sent with MSG_ZEROCOPY, it currently
 returns 1. This return code should be used only when Linux fails to use
@@ -37,7 +37,7 @@ Signed-off-by: Leonardo Bras <leobras@redhat.com>
  1 file changed, 7 insertions(+), 1 deletion(-)
 
 diff --git a/io/channel-socket.c b/io/channel-socket.c
-index 8ae8b212cf..eb7baa2184 100644
+index df858da924..cf0d67c51b 100644
 --- a/io/channel-socket.c
 +++ b/io/channel-socket.c
 @@ -717,12 +717,18 @@ static int qio_channel_socket_flush(QIOChannel *ioc,

SOURCES/kvm-QIOChannelSocket-Fix-zero-copy-send-so-socket-flush-.patch

@@ -1,19 +1,19 @@
-From e70f01749addd7d0b7aa7fa4fdedb664f98e6b9b Mon Sep 17 00:00:00 2001
+From c1fd32d93ae42fcf3c1a25f4d56e669f251087d8 Mon Sep 17 00:00:00 2001
 From: Leonardo Bras <leobras@redhat.com>
 Date: Mon, 20 Jun 2022 02:39:43 -0300
-Subject: [PATCH 16/18] QIOChannelSocket: Fix zero-copy send so socket flush
+Subject: [PATCH 25/37] QIOChannelSocket: Fix zero-copy send so socket flush
  works
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 
 RH-Author: Leonardo Brás <leobras@redhat.com>
-RH-MergeRequest: 95: MSG_ZEROCOPY + Multifd
-RH-Commit: [10/11] a2dfac987e24026b1a78e90b86234ca206b6401f (LeoBras/centos-qemu-kvm)
-RH-Bugzilla: 1968509
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+RH-MergeRequest: 191: MSG_ZEROCOPY + Multifd @ rhel8.7
+RH-Commit: [25/26] 3ede94f3269e21c3ace073ed1a6f24696315bcbb
+RH-Bugzilla: 2072049
 RH-Acked-by: Peter Xu <peterx@redhat.com>
+RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
+RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 
 Somewhere between v6 and v7 the of the zero-copy-send patchset a crucial
 part of the flushing mechanism got missing: incrementing zero_copy_queued.
@@ -38,7 +38,7 @@ Signed-off-by: Leonardo Bras <leobras@redhat.com>
  1 file changed, 5 insertions(+)
 
 diff --git a/io/channel-socket.c b/io/channel-socket.c
-index 7490e5943d..8ae8b212cf 100644
+index 7d37b39de7..df858da924 100644
 --- a/io/channel-socket.c
 +++ b/io/channel-socket.c
 @@ -612,6 +612,11 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,

SOURCES/kvm-QIOChannelSocket-Implement-io_writev-zero-copy-flag-.patch

@@ -1,19 +1,19 @@
-From 4aeba0365d30dabe2e70dc172683f0878a4a9621 Mon Sep 17 00:00:00 2001
+From 5fd7af93a06adaddbae719aabbaf912159f4fb28 Mon Sep 17 00:00:00 2001
 From: Leonardo Bras <leobras@redhat.com>
-Date: Fri, 13 May 2022 03:28:32 -0300
-Subject: [PATCH 09/18] QIOChannelSocket: Implement io_writev zero copy flag &
+Date: Wed, 18 May 2022 02:52:25 -0300
+Subject: [PATCH 18/37] QIOChannelSocket: Implement io_writev zero copy flag &
  io_flush for CONFIG_LINUX
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 
 RH-Author: Leonardo Brás <leobras@redhat.com>
-RH-MergeRequest: 95: MSG_ZEROCOPY + Multifd
-RH-Commit: [3/11] 9afeac1f5ac7675624660a0281726c09c8321180 (LeoBras/centos-qemu-kvm)
-RH-Bugzilla: 1968509
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+RH-MergeRequest: 191: MSG_ZEROCOPY + Multifd @ rhel8.7
+RH-Commit: [18/26] 6f65c8c879a5df57213b541d58285b65178f8547
+RH-Bugzilla: 2072049
 RH-Acked-by: Peter Xu <peterx@redhat.com>
+RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
+RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 
 For CONFIG_LINUX, implement the new zero copy flag and the optional callback
 io_flush on QIOChannelSocket, but enables it only when MSG_ZEROCOPY
@@ -71,7 +71,7 @@ index e747e63514..513c428fe4 100644
  
  
 diff --git a/io/channel-socket.c b/io/channel-socket.c
-index a1be2197ca..fbd2214d20 100644
+index bfbd64787e..38a46ba213 100644
 --- a/io/channel-socket.c
 +++ b/io/channel-socket.c
 @@ -26,6 +26,14 @@
@@ -234,7 +234,7 @@ index a1be2197ca..fbd2214d20 100644
  static int
  qio_channel_socket_set_blocking(QIOChannel *ioc,
                                  bool enabled,
-@@ -790,6 +895,9 @@ static void qio_channel_socket_class_init(ObjectClass *klass,
+@@ -789,6 +894,9 @@ static void qio_channel_socket_class_init(ObjectClass *klass,
      ioc_klass->io_set_delay = qio_channel_socket_set_delay;
      ioc_klass->io_create_watch = qio_channel_socket_create_watch;
      ioc_klass->io_set_aio_fd_handler = qio_channel_socket_set_aio_fd_handler;

SOURCES/kvm-QIOChannelSocket-Introduce-assert-and-reduce-ifdefs-.patch

@@ -1,19 +1,19 @@
-From 60bf942a58db12c821f2a6a49e2e0b04b99bec30 Mon Sep 17 00:00:00 2001
+From cbfaf86331c2b2e01a2083303b7554672bf991b7 Mon Sep 17 00:00:00 2001
 From: Leonardo Bras <leobras@redhat.com>
 Date: Mon, 20 Jun 2022 02:39:42 -0300
-Subject: [PATCH 15/18] QIOChannelSocket: Introduce assert and reduce ifdefs to
+Subject: [PATCH 24/37] QIOChannelSocket: Introduce assert and reduce ifdefs to
  improve readability
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 
 RH-Author: Leonardo Brás <leobras@redhat.com>
-RH-MergeRequest: 95: MSG_ZEROCOPY + Multifd
-RH-Commit: [9/11] eaa02d68301852ccc98bdacc7387d8d03be1cb05 (LeoBras/centos-qemu-kvm)
-RH-Bugzilla: 1968509
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+RH-MergeRequest: 191: MSG_ZEROCOPY + Multifd @ rhel8.7
+RH-Commit: [24/26] b50e2e65307149f247155a7f7a032dc99e57718d
+RH-Bugzilla: 2072049
 RH-Acked-by: Peter Xu <peterx@redhat.com>
+RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
+RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 
 During implementation of MSG_ZEROCOPY feature, a lot of #ifdefs were
 introduced, particularly at qio_channel_socket_writev().
@@ -37,7 +37,7 @@ Signed-off-by: Leonardo Bras <leobras@redhat.com>
  1 file changed, 9 insertions(+), 5 deletions(-)
 
 diff --git a/io/channel-socket.c b/io/channel-socket.c
-index fbd2214d20..7490e5943d 100644
+index 38a46ba213..7d37b39de7 100644
 --- a/io/channel-socket.c
 +++ b/io/channel-socket.c
 @@ -579,11 +579,17 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,

SOURCES/kvm-RHEL-Enable-x-not-migrate-acpi-index-for-all-pre-RHE.patch

@@ -0,0 +1,42 @@
+From adbbc64db535d84fc24b576888f834841f54e8d3 Mon Sep 17 00:00:00 2001
+From: Peter Xu <peterx@redhat.com>
+Date: Wed, 6 Sep 2023 16:29:23 -0400
+Subject: [PATCH 2/2] RHEL: Enable "x-not-migrate-acpi-index" for all pre-RHEL8
+ guests
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Peter Xu <peterx@redhat.com>
+RH-MergeRequest: 317: acpi: fix acpi_index migration
+RH-Jira: RHEL-2186
+RH-Acked-by: Ani Sinha <None>
+RH-Acked-by: Leonardo Brás <leobras@redhat.com>
+RH-Commit: [2/2] 961eee71e6f563aadf4a93082cd384d765d3e73b
+
+The acpi index migration is simply broken before for all pre-RHEL8
+branches.  Don't migrate it for all of them.
+
+Signed-off-by: Peter Xu <peterx@redhat.com>
+---
+ hw/core/machine.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/hw/core/machine.c b/hw/core/machine.c
+index 2724f6848a..6650a3d7b7 100644
+--- a/hw/core/machine.c
++++ b/hw/core/machine.c
+@@ -44,6 +44,10 @@ GlobalProperty hw_compat_rhel_8_6[] = {
+      * we need do disable it downstream on the latest hw_compat_rhel_8.
+      */
+     { "vhost-vsock-device", "seqpacket", "off" },
++    /*
++     * RHEL-2186: all rhel8 machines should not migrate acpi index.
++     */
++    { "PIIX4_PM", "x-not-migrate-acpi-index", "on"},
+ };
+ const size_t hw_compat_rhel_8_6_len = G_N_ELEMENTS(hw_compat_rhel_8_6);
+ 
+-- 
+2.37.3
+

SOURCES/kvm-RHEL-disable-seqpacket-for-vhost-vsock-device-in-rhe.patch

@@ -0,0 +1,107 @@
+From e0e4f01c6f4fb5881960f72ae4e80951b711131e Mon Sep 17 00:00:00 2001
+From: Stefano Garzarella <sgarzare@redhat.com>
+Date: Thu, 24 Mar 2022 16:04:57 +0100
+Subject: [PATCH 1/5] RHEL: disable "seqpacket" for "vhost-vsock-device" in
+ rhel8.6.0
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Stefano Garzarella <sgarzare@redhat.com>
+RH-MergeRequest: 136: RHEL: disable "seqpacket" for "vhost-vsock-device" in rhel8.6.0 [rhel-8.7.0]
+RH-Commit: [1/1] d82ea09e123679521503689f7d9af1c03dc71bfc
+RH-Bugzilla: 2068202
+RH-Acked-by: Jason Wang <None>
+RH-Acked-by: Eugenio Pérez <None>
+RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+
+vhost-vsock device in RHEL 8 kernels doesn't support seqpacket.
+To avoid problems when migrating a VM from RHEL 9 host, we need to
+disable it in rhel8-* machine types.
+
+Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
+---
+ hw/core/machine.c          | 10 ++++++++++
+ hw/i386/pc_piix.c          |  2 ++
+ hw/i386/pc_q35.c           |  2 ++
+ hw/s390x/s390-virtio-ccw.c |  1 +
+ include/hw/boards.h        |  3 +++
+ 5 files changed, 18 insertions(+)
+
+diff --git a/hw/core/machine.c b/hw/core/machine.c
+index 024b025fc2..76fcabec7a 100644
+--- a/hw/core/machine.c
++++ b/hw/core/machine.c
+@@ -37,6 +37,16 @@
+ #include "hw/virtio/virtio.h"
+ #include "hw/virtio/virtio-pci.h"
+ 
++GlobalProperty hw_compat_rhel_8_6[] = {
++    /* hw_compat_rhel_8_6 bz 2068202 */
++    /*
++     * vhost-vsock device in RHEL 8 kernels doesn't support seqpacket, so
++     * we need do disable it downstream on the latest hw_compat_rhel_8.
++     */
++    { "vhost-vsock-device", "seqpacket", "off" },
++};
++const size_t hw_compat_rhel_8_6_len = G_N_ELEMENTS(hw_compat_rhel_8_6);
++
+ /*
+  * Mostly the same as hw_compat_6_0 and hw_compat_6_1
+  */
+diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
+index f03a8f0db8..ab6d03e07a 100644
+--- a/hw/i386/pc_piix.c
++++ b/hw/i386/pc_piix.c
+@@ -998,6 +998,8 @@ static void pc_machine_rhel760_options(MachineClass *m)
+     pcmc->kvmclock_create_always = false;
+     /* From pc_i440fx_5_1_machine_options() */
+     pcmc->pci_root_uid = 1;
++    compat_props_add(m->compat_props, hw_compat_rhel_8_6,
++                     hw_compat_rhel_8_6_len);
+     compat_props_add(m->compat_props, hw_compat_rhel_8_5,
+                      hw_compat_rhel_8_5_len);
+     compat_props_add(m->compat_props, pc_rhel_8_5_compat,
+diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
+index 5559261d9e..882fe7a68d 100644
+--- a/hw/i386/pc_q35.c
++++ b/hw/i386/pc_q35.c
+@@ -658,6 +658,8 @@ static void pc_q35_machine_rhel860_options(MachineClass *m)
+     m->desc = "RHEL-8.6.0 PC (Q35 + ICH9, 2009)";
+     pcmc->smbios_stream_product = "RHEL-AV";
+     pcmc->smbios_stream_version = "8.6.0";
++    compat_props_add(m->compat_props, hw_compat_rhel_8_6,
++                     hw_compat_rhel_8_6_len);
+ }
+ 
+ DEFINE_PC_MACHINE(q35_rhel860, "pc-q35-rhel8.6.0", pc_q35_init_rhel860,
+diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
+index 9795eb9406..bec270598b 100644
+--- a/hw/s390x/s390-virtio-ccw.c
++++ b/hw/s390x/s390-virtio-ccw.c
+@@ -1109,6 +1109,7 @@ static void ccw_machine_rhel860_instance_options(MachineState *machine)
+ 
+ static void ccw_machine_rhel860_class_options(MachineClass *mc)
+ {
++    compat_props_add(mc->compat_props, hw_compat_rhel_8_6, hw_compat_rhel_8_6_len);
+ }
+ DEFINE_CCW_MACHINE(rhel860, "rhel8.6.0", true);
+ 
+diff --git a/include/hw/boards.h b/include/hw/boards.h
+index 04e8759815..4ddb798144 100644
+--- a/include/hw/boards.h
++++ b/include/hw/boards.h
+@@ -443,6 +443,9 @@ extern const size_t hw_compat_2_2_len;
+ extern GlobalProperty hw_compat_2_1[];
+ extern const size_t hw_compat_2_1_len;
+ 
++extern GlobalProperty hw_compat_rhel_8_6[];
++extern const size_t hw_compat_rhel_8_6_len;
++
+ extern GlobalProperty hw_compat_rhel_8_5[];
+ extern const size_t hw_compat_rhel_8_5_len;
+ 
+-- 
+2.27.0
+

SOURCES/kvm-RHEL-only-AArch64-Drop-unsupported-CPU-types.patch

@@ -1,237 +0,0 @@
-From 055edf068196622a3e1868c9e4c991d410272a6d Mon Sep 17 00:00:00 2001
-From: Andrew Jones <drjones@redhat.com>
-Date: Wed, 15 Jun 2022 15:28:27 +0200
-Subject: [PATCH 03/18] RHEL-only: AArch64: Drop unsupported CPU types
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Daniel P. Berrangé <berrange@redhat.com>
-RH-MergeRequest: 94: i386, aarch64, s390x: deprecate many named CPU models
-RH-Commit: [3/6] 21f54c86dc87e5e75a64459b5a385686bc09640c (berrange/centos-src-qemu)
-RH-Bugzilla: 2060839
-RH-Acked-by: Thomas Huth <thuth@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
-
-Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2066824
-Upstream Status: RHEL only
-
-We only need to support AArch64 cpu types and we only need three
-types:
-   1) A base type to use with TCG, i.e. a cpu type with only base
-      features. 'cortex-a57' serves this role and is currently used
-      by libguestfs.
-   2) The 'max' type, which is for both KVM and TCG and is good for
-      tests that just specify 'max' but run under both. 'max' with
-      TCG also provides the VM with all the CPU features TCG
-      supports, which is good for VMs that need features not
-      provided by the basic cortex-a57.
-   3) The host type which is used with KVM.
-
-Signed-off-by: Andrew Jones <drjones@redhat.com>
----
- hw/arm/virt.c                  |  4 ++++
- target/arm/cpu64.c             |  6 ++++++
- target/arm/cpu_tcg.c           | 12 ++----------
- tests/qtest/arm-cpu-features.c |  6 ++++++
- 4 files changed, 18 insertions(+), 10 deletions(-)
-
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index 95d012d6eb..74119976d3 100644
---- a/hw/arm/virt.c
-+++ b/hw/arm/virt.c
-@@ -239,12 +239,16 @@ static const int a15irqmap[] = {
- };
- 
- static const char *valid_cpus[] = {
-+#if 0 /* Disabled for Red Hat Enterprise Linux */
-     ARM_CPU_TYPE_NAME("cortex-a7"),
-     ARM_CPU_TYPE_NAME("cortex-a15"),
-     ARM_CPU_TYPE_NAME("cortex-a53"),
-+#endif /* disabled for RHEL */
-     ARM_CPU_TYPE_NAME("cortex-a57"),
-+#if 0 /* Disabled for Red Hat Enterprise Linux */
-     ARM_CPU_TYPE_NAME("cortex-a72"),
-     ARM_CPU_TYPE_NAME("a64fx"),
-+#endif /* disabled for RHEL */
-     ARM_CPU_TYPE_NAME("host"),
-     ARM_CPU_TYPE_NAME("max"),
- };
-diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
-index eb44c05822..e80b831073 100644
---- a/target/arm/cpu64.c
-+++ b/target/arm/cpu64.c
-@@ -146,6 +146,7 @@ static void aarch64_a57_initfn(Object *obj)
-     define_arm_cp_regs(cpu, cortex_a72_a57_a53_cp_reginfo);
- }
- 
-+#if 0 /* Disabled for Red Hat Enterprise Linux */
- static void aarch64_a53_initfn(Object *obj)
- {
-     ARMCPU *cpu = ARM_CPU(obj);
-@@ -249,6 +250,7 @@ static void aarch64_a72_initfn(Object *obj)
-     cpu->gic_vprebits = 5;
-     define_arm_cp_regs(cpu, cortex_a72_a57_a53_cp_reginfo);
- }
-+#endif /* disabled for RHEL */
- 
- void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
- {
-@@ -923,6 +925,7 @@ static void aarch64_max_initfn(Object *obj)
-     qdev_property_add_static(DEVICE(obj), &arm_cpu_lpa2_property);
- }
- 
-+#if 0 /* Disabled for Red Hat Enterprise Linux */
- static void aarch64_a64fx_initfn(Object *obj)
- {
-     ARMCPU *cpu = ARM_CPU(obj);
-@@ -969,12 +972,15 @@ static void aarch64_a64fx_initfn(Object *obj)
- 
-     /* TODO:  Add A64FX specific HPC extension registers */
- }
-+#endif /* disabled for RHEL */
- 
- static const ARMCPUInfo aarch64_cpus[] = {
-     { .name = "cortex-a57",         .initfn = aarch64_a57_initfn },
-+#if 0 /* Disabled for Red Hat Enterprise Linux */
-     { .name = "cortex-a53",         .initfn = aarch64_a53_initfn },
-     { .name = "cortex-a72",         .initfn = aarch64_a72_initfn },
-     { .name = "a64fx",              .initfn = aarch64_a64fx_initfn },
-+#endif /* disabled for RHEL */
-     { .name = "max",                .initfn = aarch64_max_initfn },
- #if defined(CONFIG_KVM) || defined(CONFIG_HVF)
-     { .name = "host",               .initfn = aarch64_host_initfn },
-diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
-index 3826fa5122..74727fc92c 100644
---- a/target/arm/cpu_tcg.c
-+++ b/target/arm/cpu_tcg.c
-@@ -19,10 +19,10 @@
- #include "hw/boards.h"
- #endif
- 
-+#if 0 /* Disabled for Red Hat Enterprise Linux */
- /* CPU models. These are not needed for the AArch64 linux-user build. */
- #if !defined(CONFIG_USER_ONLY) || !defined(TARGET_AARCH64)
- 
--#if 0 /* Disabled for Red Hat Enterprise Linux */
- #if !defined(CONFIG_USER_ONLY) && defined(CONFIG_TCG)
- static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
- {
-@@ -376,7 +376,6 @@ static void cortex_a9_initfn(Object *obj)
-     cpu->ccsidr[1] = 0x200fe019; /* 16k L1 icache. */
-     define_arm_cp_regs(cpu, cortexa9_cp_reginfo);
- }
--#endif /* disabled for RHEL */
- 
- #ifndef CONFIG_USER_ONLY
- static uint64_t a15_l2ctlr_read(CPUARMState *env, const ARMCPRegInfo *ri)
-@@ -402,7 +401,6 @@ static const ARMCPRegInfo cortexa15_cp_reginfo[] = {
-     REGINFO_SENTINEL
- };
- 
--#if 0 /* Disabled for Red Hat Enterprise Linux */
- static void cortex_a7_initfn(Object *obj)
- {
-     ARMCPU *cpu = ARM_CPU(obj);
-@@ -448,7 +446,6 @@ static void cortex_a7_initfn(Object *obj)
-     cpu->ccsidr[2] = 0x711fe07a; /* 4096K L2 unified cache */
-     define_arm_cp_regs(cpu, cortexa15_cp_reginfo); /* Same as A15 */
- }
--#endif /* disabled for RHEL */
- 
- static void cortex_a15_initfn(Object *obj)
- {
-@@ -492,7 +489,6 @@ static void cortex_a15_initfn(Object *obj)
-     define_arm_cp_regs(cpu, cortexa15_cp_reginfo);
- }
- 
--#if 0 /* Disabled for Red Hat Enterprise Linux */
- static void cortex_m0_initfn(Object *obj)
- {
-     ARMCPU *cpu = ARM_CPU(obj);
-@@ -933,7 +929,6 @@ static void arm_v7m_class_init(ObjectClass *oc, void *data)
- 
-     cc->gdb_core_xml_file = "arm-m-profile.xml";
- }
--#endif /* disabled for RHEL */
- 
- #ifndef TARGET_AARCH64
- /*
-@@ -1013,7 +1008,6 @@ static void arm_max_initfn(Object *obj)
- #endif /* !TARGET_AARCH64 */
- 
- static const ARMCPUInfo arm_tcg_cpus[] = {
--#if 0 /* Disabled for Red Hat Enterprise Linux */
-     { .name = "arm926",      .initfn = arm926_initfn },
-     { .name = "arm946",      .initfn = arm946_initfn },
-     { .name = "arm1026",     .initfn = arm1026_initfn },
-@@ -1029,9 +1023,7 @@ static const ARMCPUInfo arm_tcg_cpus[] = {
-     { .name = "cortex-a7",   .initfn = cortex_a7_initfn },
-     { .name = "cortex-a8",   .initfn = cortex_a8_initfn },
-     { .name = "cortex-a9",   .initfn = cortex_a9_initfn },
--#endif /* disabled for RHEL */
-     { .name = "cortex-a15",  .initfn = cortex_a15_initfn },
--#if 0 /* Disabled for Red Hat Enterprise Linux */
-     { .name = "cortex-m0",   .initfn = cortex_m0_initfn,
-                              .class_init = arm_v7m_class_init },
-     { .name = "cortex-m3",   .initfn = cortex_m3_initfn,
-@@ -1062,7 +1054,6 @@ static const ARMCPUInfo arm_tcg_cpus[] = {
-     { .name = "pxa270-b1",   .initfn = pxa270b1_initfn },
-     { .name = "pxa270-c0",   .initfn = pxa270c0_initfn },
-     { .name = "pxa270-c5",   .initfn = pxa270c5_initfn },
--#endif /* disabled for RHEL */
- #ifndef TARGET_AARCH64
-     { .name = "max",         .initfn = arm_max_initfn },
- #endif
-@@ -1090,3 +1081,4 @@ static void arm_tcg_cpu_register_types(void)
- type_init(arm_tcg_cpu_register_types)
- 
- #endif /* !CONFIG_USER_ONLY || !TARGET_AARCH64 */
-+#endif /* disabled for RHEL */
-diff --git a/tests/qtest/arm-cpu-features.c b/tests/qtest/arm-cpu-features.c
-index f76652143a..fe2a0a070d 100644
---- a/tests/qtest/arm-cpu-features.c
-+++ b/tests/qtest/arm-cpu-features.c
-@@ -440,8 +440,10 @@ static void test_query_cpu_model_expansion(const void *data)
-     assert_error(qts, "host", "The CPU type 'host' requires KVM", NULL);
- 
-     /* Test expected feature presence/absence for some cpu types */
-+#if 0 /* Disabled for Red Hat Enterprise Linux */
-     assert_has_feature_enabled(qts, "cortex-a15", "pmu");
-     assert_has_not_feature(qts, "cortex-a15", "aarch64");
-+#endif /* disabled for RHEL */
- 
-     /* Enabling and disabling pmu should always work. */
-     assert_has_feature_enabled(qts, "max", "pmu");
-@@ -458,6 +460,7 @@ static void test_query_cpu_model_expansion(const void *data)
-         assert_has_feature_enabled(qts, "cortex-a57", "pmu");
-         assert_has_feature_enabled(qts, "cortex-a57", "aarch64");
- 
-+#if 0 /* Disabled for Red Hat Enterprise Linux */
-         assert_has_feature_enabled(qts, "a64fx", "pmu");
-         assert_has_feature_enabled(qts, "a64fx", "aarch64");
-         /*
-@@ -470,6 +473,7 @@ static void test_query_cpu_model_expansion(const void *data)
-                      "{ 'sve384': true }");
-         assert_error(qts, "a64fx", "cannot enable sve640",
-                      "{ 'sve640': true }");
-+#endif /* disabled for RHEL */
- 
-         sve_tests_default(qts, "max");
-         pauth_tests_default(qts, "max");
-@@ -505,9 +509,11 @@ static void test_query_cpu_model_expansion_kvm(const void *data)
-         QDict *resp;
-         char *error;
- 
-+#if 0 /* Disabled for Red Hat Enterprise Linux */
-         assert_error(qts, "cortex-a15",
-             "We cannot guarantee the CPU type 'cortex-a15' works "
-             "with KVM on this host", NULL);
-+#endif /* disabled for RHEL */
- 
-         assert_has_feature_enabled(qts, "host", "aarch64");
- 
--- 
-2.35.3
-

SOURCES/kvm-RHEL-only-tests-avocado-Switch-aarch64-tests-from-a5.patch

@@ -1,95 +0,0 @@
-From d710394f68eb0b6116dd8ac76f619c192e0d5972 Mon Sep 17 00:00:00 2001
-From: Andrew Jones <drjones@redhat.com>
-Date: Wed, 15 Jun 2022 15:28:27 +0200
-Subject: [PATCH 02/18] RHEL-only: tests/avocado: Switch aarch64 tests from a53
- to a57
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Daniel P. Berrangé <berrange@redhat.com>
-RH-MergeRequest: 94: i386, aarch64, s390x: deprecate many named CPU models
-RH-Commit: [2/6] e85ef69b42c411a6997e4da10ba05176368769b3 (berrange/centos-src-qemu)
-RH-Bugzilla: 2060839
-RH-Acked-by: Thomas Huth <thuth@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
-
-Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2066824
-Upstream Status: RHEL only
-
-We plan to remove the cortex-a53 from the supported cpu types. Switch
-all avocado tests that use it to the cortex-a57, which will work the
-same and we intend to keep. We don't want to try and upstream this
-change since the better upstream change would be to switch from the
-a53 to 'max', but the upstream tests also need to use later guest
-kernels to use 'max' (see qemu upstream commit 0942820408dc
-("hw/arm/virt: Disable LPA2 for -machine virt-6.2")
-
-Signed-off-by: Andrew Jones <drjones@redhat.com>
----
- tests/avocado/replay_kernel.py     | 2 +-
- tests/avocado/reverse_debugging.py | 2 +-
- tests/avocado/tcg_plugins.py       | 6 +++---
- 3 files changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/tests/avocado/replay_kernel.py b/tests/avocado/replay_kernel.py
-index 0b2b0dc692..3a7b5f0748 100644
---- a/tests/avocado/replay_kernel.py
-+++ b/tests/avocado/replay_kernel.py
-@@ -147,7 +147,7 @@ def test_aarch64_virt(self):
-         """
-         :avocado: tags=arch:aarch64
-         :avocado: tags=machine:virt
--        :avocado: tags=cpu:cortex-a53
-+        :avocado: tags=cpu:cortex-a57
-         """
-         kernel_url = ('https://archives.fedoraproject.org/pub/archive/fedora'
-                       '/linux/releases/29/Everything/aarch64/os/images/pxeboot'
-diff --git a/tests/avocado/reverse_debugging.py b/tests/avocado/reverse_debugging.py
-index d2921e70c3..66d185ed42 100644
---- a/tests/avocado/reverse_debugging.py
-+++ b/tests/avocado/reverse_debugging.py
-@@ -198,7 +198,7 @@ def test_aarch64_virt(self):
-         """
-         :avocado: tags=arch:aarch64
-         :avocado: tags=machine:virt
--        :avocado: tags=cpu:cortex-a53
-+        :avocado: tags=cpu:cortex-a57
-         """
-         kernel_url = ('https://archives.fedoraproject.org/pub/archive/fedora'
-                       '/linux/releases/29/Everything/aarch64/os/images/pxeboot'
-diff --git a/tests/avocado/tcg_plugins.py b/tests/avocado/tcg_plugins.py
-index 642d2e49e3..93b3afd823 100644
---- a/tests/avocado/tcg_plugins.py
-+++ b/tests/avocado/tcg_plugins.py
-@@ -68,7 +68,7 @@ def test_aarch64_virt_insn(self):
-         :avocado: tags=accel:tcg
-         :avocado: tags=arch:aarch64
-         :avocado: tags=machine:virt
--        :avocado: tags=cpu:cortex-a53
-+        :avocado: tags=cpu:cortex-a57
-         """
-         kernel_path = self._grab_aarch64_kernel()
-         kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
-@@ -94,7 +94,7 @@ def test_aarch64_virt_insn_icount(self):
-         :avocado: tags=accel:tcg
-         :avocado: tags=arch:aarch64
-         :avocado: tags=machine:virt
--        :avocado: tags=cpu:cortex-a53
-+        :avocado: tags=cpu:cortex-a57
-         """
-         kernel_path = self._grab_aarch64_kernel()
-         kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
-@@ -120,7 +120,7 @@ def test_aarch64_virt_mem_icount(self):
-         :avocado: tags=accel:tcg
-         :avocado: tags=arch:aarch64
-         :avocado: tags=machine:virt
--        :avocado: tags=cpu:cortex-a53
-+        :avocado: tags=cpu:cortex-a57
-         """
-         kernel_path = self._grab_aarch64_kernel()
-         kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
--- 
-2.35.3
-

SOURCES/kvm-Revert-globally-limit-the-maximum-number-of-CPUs.patch

@@ -1,58 +0,0 @@
-From 5ab8613582fd56b847fe75750acb5b7255900b35 Mon Sep 17 00:00:00 2001
-From: Vitaly Kuznetsov <vkuznets@redhat.com>
-Date: Thu, 9 Jun 2022 11:55:15 +0200
-Subject: [PATCH 15/16] Revert "globally limit the maximum number of CPUs"
-
-RH-Author: Vitaly Kuznetsov <vkuznets@redhat.com>
-RH-MergeRequest: 99: Revert "globally limit the maximum number of CPUs"
-RH-Commit: [1/1] 13100d4a2209b2190a3654c1f9cf4ebade1e8d24 (vkuznets/qemu-kvm-c9s)
-RH-Bugzilla: 2094270
-RH-Acked-by: Andrew Jones <drjones@redhat.com>
-RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
-RH-Acked-by: Thomas Huth <thuth@redhat.com>
-
-Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2094270
-Brew: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=45871149
-Upstream Status: RHEL-only
-Tested: with upstream kernel
-
-Downstream QEMU carries a patch that sets the hard limit of possible vCPUs
-to the value that the KVM code of the kernel recommends as soft limit.
-Upstream KVM code has been changed recently to not use an arbitrary soft
-limit anymore, but to cap the value on the amount of available physical
-CPUs of the host. This defeats the purpose of the downstream change in
-QEMU completely. Drop the downstream-only patch to allow CPU overcommit.
-
-This reverts commit 6669f6fa677d43144f39d6ad59725b7ba622f1c2.
-
-Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
----
- accel/kvm/kvm-all.c | 12 ------------
- 1 file changed, 12 deletions(-)
-
-diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
-index fdf0e4d429..5f1377ca04 100644
---- a/accel/kvm/kvm-all.c
-+++ b/accel/kvm/kvm-all.c
-@@ -2430,18 +2430,6 @@ static int kvm_init(MachineState *ms)
-     soft_vcpus_limit = kvm_recommended_vcpus(s);
-     hard_vcpus_limit = kvm_max_vcpus(s);
- 
--#ifdef HOST_PPC64
--    /*
--     * On POWER, the kernel advertises a soft limit based on the
--     * number of CPU threads on the host.  We want to allow exceeding
--     * this for testing purposes, so we don't want to set hard limit
--     * to soft limit as on x86.
--     */
--#else
--    /* RHEL doesn't support nr_vcpus > soft_vcpus_limit */
--    hard_vcpus_limit = soft_vcpus_limit;
--#endif
--
-     while (nc->name) {
-         if (nc->num > soft_vcpus_limit) {
-             warn_report("Number of %s cpus requested (%d) exceeds "
--- 
-2.31.1
-

SOURCES/kvm-Revert-migration-Simplify-unqueue_page.patch

@@ -1,134 +0,0 @@
-From 5ea59b17866add54e5ae8c76d3cb472c67e1fa91 Mon Sep 17 00:00:00 2001
-From: Thomas Huth <thuth@redhat.com>
-Date: Tue, 2 Aug 2022 08:19:49 +0200
-Subject: [PATCH 32/32] Revert "migration: Simplify unqueue_page()"
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 112: Fix postcopy migration on s390x
-RH-Commit: [2/2] 3913c9ed3f27f4b66245913da29d0c46db0c6567 (thuth/qemu-kvm-cs9)
-RH-Bugzilla: 2099934
-RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
-RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-
-This reverts commit cfd66f30fb0f735df06ff4220e5000290a43dad3.
-
-The simplification of unqueue_page() introduced a bug that sometimes
-breaks migration on s390x hosts.
-
-The problem is not fully understood yet, but since we are already in
-the freeze for QEMU 7.1 and we need something working there, let's
-revert this patch for the upcoming release. The optimization can be
-redone later again in a proper way if necessary.
-
-Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2099934
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-Message-Id: <20220802061949.331576-1-thuth@redhat.com>
-Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
-Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
-(cherry picked from commit 777f53c75983dd10756f5dbfc8af50fe11da81c1)
-Conflicts:
-	migration/trace-events
-	(trivial contextual conflict)
-Signed-off-by: Thomas Huth <thuth@redhat.com>
----
- migration/ram.c        | 37 ++++++++++++++++++++++++++-----------
- migration/trace-events |  3 ++-
- 2 files changed, 28 insertions(+), 12 deletions(-)
-
-diff --git a/migration/ram.c b/migration/ram.c
-index fb6db54642..ee40e4a718 100644
---- a/migration/ram.c
-+++ b/migration/ram.c
-@@ -1548,7 +1548,6 @@ static RAMBlock *unqueue_page(RAMState *rs, ram_addr_t *offset)
- {
-     struct RAMSrcPageRequest *entry;
-     RAMBlock *block = NULL;
--    size_t page_size;
- 
-     if (!postcopy_has_request(rs)) {
-         return NULL;
-@@ -1565,13 +1564,10 @@ static RAMBlock *unqueue_page(RAMState *rs, ram_addr_t *offset)
-     entry = QSIMPLEQ_FIRST(&rs->src_page_requests);
-     block = entry->rb;
-     *offset = entry->offset;
--    page_size = qemu_ram_pagesize(block);
--    /* Each page request should only be multiple page size of the ramblock */
--    assert((entry->len % page_size) == 0);
- 
--    if (entry->len > page_size) {
--        entry->len -= page_size;
--        entry->offset += page_size;
-+    if (entry->len > TARGET_PAGE_SIZE) {
-+        entry->len -= TARGET_PAGE_SIZE;
-+        entry->offset += TARGET_PAGE_SIZE;
-     } else {
-         memory_region_unref(block->mr);
-         QSIMPLEQ_REMOVE_HEAD(&rs->src_page_requests, next_req);
-@@ -1579,9 +1575,6 @@ static RAMBlock *unqueue_page(RAMState *rs, ram_addr_t *offset)
-         migration_consume_urgent_request();
-     }
- 
--    trace_unqueue_page(block->idstr, *offset,
--                       test_bit((*offset >> TARGET_PAGE_BITS), block->bmap));
--
-     return block;
- }
- 
-@@ -1956,8 +1949,30 @@ static bool get_queued_page(RAMState *rs, PageSearchStatus *pss)
- {
-     RAMBlock  *block;
-     ram_addr_t offset;
-+    bool dirty;
-+
-+    do {
-+        block = unqueue_page(rs, &offset);
-+        /*
-+         * We're sending this page, and since it's postcopy nothing else
-+         * will dirty it, and we must make sure it doesn't get sent again
-+         * even if this queue request was received after the background
-+         * search already sent it.
-+         */
-+        if (block) {
-+            unsigned long page;
-+
-+            page = offset >> TARGET_PAGE_BITS;
-+            dirty = test_bit(page, block->bmap);
-+            if (!dirty) {
-+                trace_get_queued_page_not_dirty(block->idstr, (uint64_t)offset,
-+                                                page);
-+            } else {
-+                trace_get_queued_page(block->idstr, (uint64_t)offset, page);
-+            }
-+        }
- 
--    block = unqueue_page(rs, &offset);
-+    } while (block && !dirty);
- 
-     if (!block) {
-         /*
-diff --git a/migration/trace-events b/migration/trace-events
-index 1aec580e92..09d61ed1f4 100644
---- a/migration/trace-events
-+++ b/migration/trace-events
-@@ -85,6 +85,8 @@ put_qlist_end(const char *field_name, const char *vmsd_name) "%s(%s)"
- qemu_file_fclose(void) ""
- 
- # ram.c
-+get_queued_page(const char *block_name, uint64_t tmp_offset, unsigned long page_abs) "%s/0x%" PRIx64 " page_abs=0x%lx"
-+get_queued_page_not_dirty(const char *block_name, uint64_t tmp_offset, unsigned long page_abs) "%s/0x%" PRIx64 " page_abs=0x%lx"
- migration_bitmap_sync_start(void) ""
- migration_bitmap_sync_end(uint64_t dirty_pages) "dirty_pages %" PRIu64
- migration_bitmap_clear_dirty(char *str, uint64_t start, uint64_t size, unsigned long page) "rb %s start 0x%"PRIx64" size 0x%"PRIx64" page 0x%lx"
-@@ -110,7 +112,6 @@ ram_save_iterate_big_wait(uint64_t milliconds, int iterations) "big wait: %" PRI
- ram_load_complete(int ret, uint64_t seq_iter) "exit_code %d seq iteration %" PRIu64
- ram_write_tracking_ramblock_start(const char *block_id, size_t page_size, void *addr, size_t length) "%s: page_size: %zu addr: %p length: %zu"
- ram_write_tracking_ramblock_stop(const char *block_id, size_t page_size, void *addr, size_t length) "%s: page_size: %zu addr: %p length: %zu"
--unqueue_page(char *block, uint64_t offset, bool dirty) "ramblock '%s' offset 0x%"PRIx64" dirty %d"
- 
- # multifd.c
- multifd_new_send_channel_async(uint8_t id) "channel %u"
--- 
-2.31.1
-

SOURCES/kvm-Revert-redhat-Add-hw_compat_4_2_extra-and-apply-to-u.patch

@@ -0,0 +1,93 @@
+From e626dc16d130c724c400b99a93daad0a9abeae59 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 22 Mar 2022 19:23:36 -0400
+Subject: [PATCH 01/18] Revert "redhat: Add hw_compat_4_2_extra and apply to
+ upstream machines"
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 131: Revert "redhat: Add hw_compat_4_2_extra and apply to upstream machines"
+RH-Commit: [1/3] 47b7d9e5062f5e215d5ed1a3ecdc1a87ac3fa630 (jmaloy/qemu-kvm)
+RH-Bugzilla: 2062613
+RH-Acked-by: Peter Xu <peterx@redhat.com>
+RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+
+BZ: https://bugzilla.redhat.com/2062613
+UPSTREAM: no
+BREW: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=44038000
+
+commit dc2e9ec1e014950c7918e23a3e9b0096b34a4a92
+Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
+Date:   Wed Mar 9 10:31:53 2022 +0000
+
+    Revert "redhat: Add hw_compat_4_2_extra and apply to upstream machines"
+
+    This reverts commit 66882f9a3230246409f3918424aca26add5c034a.
+    We no longer need these compat machines it was added for.
+
+    Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+
+(cherry picked from commit dc2e9ec1e014950c7918e23a3e9b0096b34a4a92)
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ hw/i386/pc.c         | 12 ------------
+ hw/i386/pc_piix.c    |  6 ------
+ include/hw/i386/pc.h |  3 ---
+ 3 files changed, 21 deletions(-)
+
+diff --git a/hw/i386/pc.c b/hw/i386/pc.c
+index 4c08a1971c..357257349b 100644
+--- a/hw/i386/pc.c
++++ b/hw/i386/pc.c
+@@ -670,18 +670,6 @@ GlobalProperty pc_rhel_7_0_compat[] = {
+ };
+ const size_t pc_rhel_7_0_compat_len = G_N_ELEMENTS(pc_rhel_7_0_compat);
+ 
+-/*
+- * RHEL: These properties only apply to the RHEL exported machine types
+- * pc-4.2/2.11 for the purpose to have a limited upstream machines support
+- * which can be migrated to RHEL.  Let's avoid touching hw_compat_4_2 directly
+- * so that we can have some isolation against the upstream code.
+- */
+-GlobalProperty hw_compat_4_2_extra[] = {
+-    /* By default enlarge the default virtio-net-pci ROM to 512KB. */
+-    { "virtio-net-pci", "romsize", "0x80000" },
+-};
+-const size_t hw_compat_4_2_extra_len = G_N_ELEMENTS(hw_compat_4_2_extra);
+-
+ GSIState *pc_gsi_create(qemu_irq **irqs, bool pci_enabled)
+ {
+     GSIState *s;
+diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
+index c30057c443..7b7076cbc7 100644
+--- a/hw/i386/pc_piix.c
++++ b/hw/i386/pc_piix.c
+@@ -531,12 +531,6 @@ static void pc_i440fx_4_2_machine_options(MachineClass *m)
+      * supported by RHEL, even if exported.
+      */
+     m->deprecation_reason = "Not supported by RHEL";
+-    /*
+-     * RHEL: Specific compat properties to have limited support for upstream
+-     * machines exported.
+-     */
+-    compat_props_add(m->compat_props, hw_compat_4_2_extra,
+-                     hw_compat_4_2_extra_len);
+ }
+ 
+ /* RHEL: Export pc-4.2 */
+diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
+index 9e8bfb69f8..4a593acb50 100644
+--- a/include/hw/i386/pc.h
++++ b/include/hw/i386/pc.h
+@@ -325,9 +325,6 @@ extern const size_t pc_rhel_7_1_compat_len;
+ extern GlobalProperty pc_rhel_7_0_compat[];
+ extern const size_t pc_rhel_7_0_compat_len;
+ 
+-extern GlobalProperty hw_compat_4_2_extra[];
+-extern const size_t hw_compat_4_2_extra_len;
+-
+ /* Helper for setting model-id for CPU models that changed model-id
+  * depending on QEMU versions up to QEMU 2.4.
+  */
+-- 
+2.27.0
+

SOURCES/kvm-Revert-redhat-Add-some-devices-for-exporting-upstrea.patch

@@ -0,0 +1,128 @@
+From 96edd15df257f1d1496397a6fac24b4316570d7e Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Thu, 14 Apr 2022 16:45:30 -0400
+Subject: [PATCH 1/3] Revert redhat: Add some devices for exporting upstream
+ machine types
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 156: Revert redhat: Add some devices for exporting upstream machine types
+RH-Commit: [1/1] f25d0da3a181136917ead82f5a5c59efe3fa445a (jmaloy/qemu-kvm)
+RH-Bugzilla: 2065043
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Peter Xu <peterx@redhat.com>
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2065043
+Upstream: no
+
+Manual revert of commit 70d3924521c9bfd912bcf1a1fc76f49eb377de46, since
+the directory structure looks different from rhel-av-8.4.0.z where
+this commit is taken from. Besides, x86_64-softmmu.mak looks totally
+different and should not be affected by this reversal.
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ configs/devices/x86_64-softmmu/x86_64-rh-devices.mak     | 1 -
+ .../devices/x86_64-softmmu/x86_64-upstream-devices.mak   | 4 ----
+ hw/char/parallel.c                                       | 9 ---------
+ hw/i386/pc_piix.c                                        | 2 +-
+ hw/i386/pc_q35.c                                         | 2 +-
+ hw/timer/hpet.c                                          | 8 --------
+ 6 files changed, 2 insertions(+), 24 deletions(-)
+ delete mode 100644 configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak
+
+diff --git a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
+index fdbbdf9742..31ce08edab 100644
+--- a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
++++ b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
+@@ -1,5 +1,4 @@
+ include ../rh-virtio.mak
+-include x86_64-upstream-devices.mak
+ 
+ CONFIG_AC97=y
+ CONFIG_ACPI=y
+diff --git a/configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak b/configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak
+deleted file mode 100644
+index 2cd20f54d2..0000000000
+--- a/configs/devices/x86_64-softmmu/x86_64-upstream-devices.mak
++++ /dev/null
+@@ -1,4 +0,0 @@
+-# We need "isa-parallel"
+-CONFIG_PARALLEL=y
+-# We need "hpet"
+-CONFIG_HPET=y
+diff --git a/hw/char/parallel.c b/hw/char/parallel.c
+index e5f108211b..b45e67bfbb 100644
+--- a/hw/char/parallel.c
++++ b/hw/char/parallel.c
+@@ -29,7 +29,6 @@
+ #include "chardev/char-parallel.h"
+ #include "chardev/char-fe.h"
+ #include "hw/acpi/aml-build.h"
+-#include "hw/boards.h"
+ #include "hw/irq.h"
+ #include "hw/isa/isa.h"
+ #include "hw/qdev-properties.h"
+@@ -535,14 +534,6 @@ static void parallel_isa_realizefn(DeviceState *dev, Error **errp)
+     int base;
+     uint8_t dummy;
+ 
+-    /* Restricted for Red Hat Enterprise Linux */
+-    MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
+-    if (strstr(mc->name, "rhel")) {
+-        error_setg(errp, "Device %s is not supported with machine type %s",
+-                   object_get_typename(OBJECT(dev)), mc->name);
+-        return;
+-    }
+-
+     if (!qemu_chr_fe_backend_connected(&s->chr)) {
+         error_setg(errp, "Can't create parallel device, empty char device");
+         return;
+diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
+index ab6d03e07a..5f101c8748 100644
+--- a/hw/i386/pc_piix.c
++++ b/hw/i386/pc_piix.c
+@@ -966,7 +966,7 @@ static void pc_machine_rhel7_options(MachineClass *m)
+ {
+     PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
+     m->family = "pc_piix_Y";
+-    m->default_machine_opts = "firmware=bios-256k.bin,hpet=off";
++    m->default_machine_opts = "firmware=bios-256k.bin";
+     pcmc->default_nic_model = "e1000";
+     pcmc->pci_root_uid = 0;
+     m->default_display = "std";
+diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
+index 882fe7a68d..73b0d0d317 100644
+--- a/hw/i386/pc_q35.c
++++ b/hw/i386/pc_q35.c
+@@ -633,7 +633,7 @@ static void pc_q35_machine_rhel_options(MachineClass *m)
+     pcmc->pci_root_uid = 0;
+     m->family = "pc_q35_Z";
+     m->units_per_default_bus = 1;
+-    m->default_machine_opts = "firmware=bios-256k.bin,hpet=off";
++    m->default_machine_opts = "firmware=bios-256k.bin";
+     m->default_display = "std";
+     m->no_floppy = 1;
+     m->no_parallel = 1;
+diff --git a/hw/timer/hpet.c b/hw/timer/hpet.c
+index 202e032524..9520471be2 100644
+--- a/hw/timer/hpet.c
++++ b/hw/timer/hpet.c
+@@ -733,14 +733,6 @@ static void hpet_realize(DeviceState *dev, Error **errp)
+     int i;
+     HPETTimer *timer;
+ 
+-    /* Restricted for Red Hat Enterprise Linux */
+-    MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
+-    if (strstr(mc->name, "rhel")) {
+-        error_setg(errp, "Device %s is not supported with machine type %s",
+-                   object_get_typename(OBJECT(dev)), mc->name);
+-        return;
+-    }
+-
+     if (!s->intcap) {
+         warn_report("Hpet's intcap not initialized");
+     }
+-- 
+2.35.1
+

SOURCES/kvm-Revert-redhat-Enable-FDC-device-for-upstream-machine.patch

@@ -0,0 +1,53 @@
+From 5bf8f1d69fea1225e927fbb3efe549a2a9d47d92 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 22 Mar 2022 19:23:36 -0400
+Subject: [PATCH 02/18] Revert "redhat: Enable FDC device for upstream machines
+ too"
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 131: Revert "redhat: Add hw_compat_4_2_extra and apply to upstream machines"
+RH-Commit: [2/3] 4e3c945e3de9bb9d9a6d24115f0719168c9669fe (jmaloy/qemu-kvm)
+RH-Bugzilla: 2062613
+RH-Acked-by: Peter Xu <peterx@redhat.com>
+RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+
+BZ: https://bugzilla.redhat.com/2062613
+UPSTREAM: no
+BREW: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=44038000
+
+commit 597cb6ca1da4a3eea77c1e4928f55203a1d5c70c
+Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
+Date:   Wed Mar 9 10:32:39 2022 +0000
+
+    Revert "redhat: Enable FDC device for upstream machines too"
+
+    This reverts commit c4d1aa8bf21fe98da94a9cff30b7c25bed12c17f.
+    We no longer need these compat machines it was added for.
+
+  Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+
+(cherry picked from commit 597cb6ca1da4a3eea77c1e4928f55203a1d5c70c)
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ hw/block/fdc.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/hw/block/fdc.c b/hw/block/fdc.c
+index 63042ef030..97fa6de423 100644
+--- a/hw/block/fdc.c
++++ b/hw/block/fdc.c
+@@ -2341,10 +2341,7 @@ void fdctrl_realize_common(DeviceState *dev, FDCtrl *fdctrl, Error **errp)
+ 
+     /* Restricted for Red Hat Enterprise Linux: */
+     MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
+-    if (!strstr(mc->name, "-rhel7.") &&
+-        /* Exported two upstream machine types allows FDC too */
+-        strcmp(mc->name, "pc-i440fx-4.2") &&
+-        strcmp(mc->name, "pc-i440fx-2.11")) {
++    if (!strstr(mc->name, "-rhel7.")) {
+         error_setg(errp, "Device %s is not supported with machine type %s",
+                    object_get_typename(OBJECT(dev)), mc->name);
+         return;
+-- 
+2.27.0
+

SOURCES/kvm-Revert-redhat-Expose-upstream-machines-pc-4.2-and-pc.patch

@@ -0,0 +1,191 @@
+From ee3cae3bb349469edcf725a1c5161521e95dcb9f Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 22 Mar 2022 19:23:36 -0400
+Subject: [PATCH 03/18] Revert "redhat: Expose upstream machines pc-4.2 and
+ pc-2.11"
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 131: Revert "redhat: Add hw_compat_4_2_extra and apply to upstream machines"
+RH-Commit: [3/3] 35cee68034580f81b3aa916921eecd2fdfa7dd15 (jmaloy/qemu-kvm)
+RH-Bugzilla: 2062613
+RH-Acked-by: Peter Xu <peterx@redhat.com>
+RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+
+BZ: https://bugzilla.redhat.com/2062613
+UPSTREAM: no
+BREW: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=44038000
+
+commit f3b50d6d4ae0be9e64aafe6a15f5423bab4899e9
+Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
+Date:   Wed Mar 9 10:34:58 2022 +0000
+
+    Revert "redhat: Expose upstream machines pc-4.2 and pc-2.11"
+    This reverts commit 618e2424edba499d52cd26cf8363bc2dd85ef149.
+    We no longer need these compat machines.
+
+    Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+
+(cherry picked from commit f3b50d6d4ae0be9e64aafe6a15f5423bab4899e9)
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ hw/i386/pc_piix.c | 37 -------------------------------------
+ 1 file changed, 37 deletions(-)
+
+diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
+index 7b7076cbc7..f03a8f0db8 100644
+--- a/hw/i386/pc_piix.c
++++ b/hw/i386/pc_piix.c
+@@ -315,14 +315,6 @@ static void pc_init1(MachineState *machine,
+  * hw_compat_*, pc_compat_*, or * pc_*_machine_options().
+  */
+ 
+-/*
+- * NOTE!  Not all the upstream machine types are disabled for RHEL.  For
+- * providing a very limited support for upstream machine types, pc machines
+- * 2.11 and 4.2 are exposed explicitly.  This will make the below "#if" macros
+- * a bit messed up, but please read this comment first so that we can have a
+- * rough understanding of what we're going to do.
+- */
+-
+ #if 0 /* Disabled for Red Hat Enterprise Linux */
+ static void pc_compat_2_3_fn(MachineState *machine)
+ {
+@@ -399,8 +391,6 @@ static void pc_xen_hvm_init(MachineState *machine)
+ }
+ #endif
+ 
+-#endif /* Disabled for Red Hat Enterprise Linux */
+-
+ #define DEFINE_I440FX_MACHINE(suffix, name, compatfn, optionfn) \
+     static void pc_init_##suffix(MachineState *machine) \
+     { \
+@@ -465,10 +455,8 @@ static void pc_i440fx_6_0_machine_options(MachineClass *m)
+     compat_props_add(m->compat_props, pc_compat_6_0, pc_compat_6_0_len);
+ }
+ 
+-#if 0 /* Disabled for Red Hat Enterprise Linux */
+ DEFINE_I440FX_MACHINE(v6_0, "pc-i440fx-6.0", NULL,
+                       pc_i440fx_6_0_machine_options);
+-#endif /* Disabled for Red Hat Enterprise Linux */
+ 
+ static void pc_i440fx_5_2_machine_options(MachineClass *m)
+ {
+@@ -479,10 +467,8 @@ static void pc_i440fx_5_2_machine_options(MachineClass *m)
+     compat_props_add(m->compat_props, pc_compat_5_2, pc_compat_5_2_len);
+ }
+ 
+-#if 0 /* Disabled for Red Hat Enterprise Linux */
+ DEFINE_I440FX_MACHINE(v5_2, "pc-i440fx-5.2", NULL,
+                       pc_i440fx_5_2_machine_options);
+-#endif /* Disabled for Red Hat Enterprise Linux */
+ 
+ static void pc_i440fx_5_1_machine_options(MachineClass *m)
+ {
+@@ -497,10 +483,8 @@ static void pc_i440fx_5_1_machine_options(MachineClass *m)
+     pcmc->pci_root_uid = 1;
+ }
+ 
+-#if 0 /* Disabled for Red Hat Enterprise Linux */
+ DEFINE_I440FX_MACHINE(v5_1, "pc-i440fx-5.1", NULL,
+                       pc_i440fx_5_1_machine_options);
+-#endif /* Disabled for Red Hat Enterprise Linux */
+ 
+ static void pc_i440fx_5_0_machine_options(MachineClass *m)
+ {
+@@ -513,10 +497,8 @@ static void pc_i440fx_5_0_machine_options(MachineClass *m)
+     m->auto_enable_numa_with_memdev = false;
+ }
+ 
+-#if 0 /* Disabled for Red Hat Enterprise Linux */
+ DEFINE_I440FX_MACHINE(v5_0, "pc-i440fx-5.0", NULL,
+                       pc_i440fx_5_0_machine_options);
+-#endif /* Disabled for Red Hat Enterprise Linux */
+ 
+ static void pc_i440fx_4_2_machine_options(MachineClass *m)
+ {
+@@ -525,15 +507,8 @@ static void pc_i440fx_4_2_machine_options(MachineClass *m)
+     m->is_default = false;
+     compat_props_add(m->compat_props, hw_compat_4_2, hw_compat_4_2_len);
+     compat_props_add(m->compat_props, pc_compat_4_2, pc_compat_4_2_len);
+-
+-    /*
+-     * RHEL: Mark all upstream machines as deprecated because they're not
+-     * supported by RHEL, even if exported.
+-     */
+-    m->deprecation_reason = "Not supported by RHEL";
+ }
+ 
+-/* RHEL: Export pc-4.2 */
+ DEFINE_I440FX_MACHINE(v4_2, "pc-i440fx-4.2", NULL,
+                       pc_i440fx_4_2_machine_options);
+ 
+@@ -546,10 +521,8 @@ static void pc_i440fx_4_1_machine_options(MachineClass *m)
+     compat_props_add(m->compat_props, pc_compat_4_1, pc_compat_4_1_len);
+ }
+ 
+-#if 0 /* Disabled for Red Hat Enterprise Linux */
+ DEFINE_I440FX_MACHINE(v4_1, "pc-i440fx-4.1", NULL,
+                       pc_i440fx_4_1_machine_options);
+-#endif /* Disabled for Red Hat Enterprise Linux */
+ 
+ static void pc_i440fx_4_0_machine_options(MachineClass *m)
+ {
+@@ -562,10 +535,8 @@ static void pc_i440fx_4_0_machine_options(MachineClass *m)
+     compat_props_add(m->compat_props, pc_compat_4_0, pc_compat_4_0_len);
+ }
+ 
+-#if 0 /* Disabled for Red Hat Enterprise Linux */
+ DEFINE_I440FX_MACHINE(v4_0, "pc-i440fx-4.0", NULL,
+                       pc_i440fx_4_0_machine_options);
+-#endif /* Disabled for Red Hat Enterprise Linux */
+ 
+ static void pc_i440fx_3_1_machine_options(MachineClass *m)
+ {
+@@ -581,10 +552,8 @@ static void pc_i440fx_3_1_machine_options(MachineClass *m)
+     compat_props_add(m->compat_props, pc_compat_3_1, pc_compat_3_1_len);
+ }
+ 
+-#if 0 /* Disabled for Red Hat Enterprise Linux */
+ DEFINE_I440FX_MACHINE(v3_1, "pc-i440fx-3.1", NULL,
+                       pc_i440fx_3_1_machine_options);
+-#endif /* Disabled for Red Hat Enterprise Linux */
+ 
+ static void pc_i440fx_3_0_machine_options(MachineClass *m)
+ {
+@@ -593,10 +562,8 @@ static void pc_i440fx_3_0_machine_options(MachineClass *m)
+     compat_props_add(m->compat_props, pc_compat_3_0, pc_compat_3_0_len);
+ }
+ 
+-#if 0 /* Disabled for Red Hat Enterprise Linux */
+ DEFINE_I440FX_MACHINE(v3_0, "pc-i440fx-3.0", NULL,
+                       pc_i440fx_3_0_machine_options);
+-#endif /* Disabled for Red Hat Enterprise Linux */
+ 
+ static void pc_i440fx_2_12_machine_options(MachineClass *m)
+ {
+@@ -605,10 +572,8 @@ static void pc_i440fx_2_12_machine_options(MachineClass *m)
+     compat_props_add(m->compat_props, pc_compat_2_12, pc_compat_2_12_len);
+ }
+ 
+-#if 0 /* Disabled for Red Hat Enterprise Linux */
+ DEFINE_I440FX_MACHINE(v2_12, "pc-i440fx-2.12", NULL,
+                       pc_i440fx_2_12_machine_options);
+-#endif /* Disabled for Red Hat Enterprise Linux */
+ 
+ static void pc_i440fx_2_11_machine_options(MachineClass *m)
+ {
+@@ -617,11 +582,9 @@ static void pc_i440fx_2_11_machine_options(MachineClass *m)
+     compat_props_add(m->compat_props, pc_compat_2_11, pc_compat_2_11_len);
+ }
+ 
+-/* RHEL: Export pc-2.11 */
+ DEFINE_I440FX_MACHINE(v2_11, "pc-i440fx-2.11", NULL,
+                       pc_i440fx_2_11_machine_options);
+ 
+-#if 0 /* Disabled for Red Hat Enterprise Linux */
+ static void pc_i440fx_2_10_machine_options(MachineClass *m)
+ {
+     pc_i440fx_2_11_machine_options(m);
+-- 
+2.27.0
+

SOURCES/kvm-Revert-virtio-scsi-Reject-scsi-cd-if-data-plane-enab.patch

@@ -1,51 +0,0 @@
-From 733acef2caea0758edd74fb634b095ce09bf5914 Mon Sep 17 00:00:00 2001
-From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
-Date: Mon, 9 May 2022 03:46:23 -0400
-Subject: [PATCH 15/16] Revert "virtio-scsi: Reject scsi-cd if data plane
- enabled [RHEL only]"
-
-RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
-RH-MergeRequest: 91: Revert "virtio-scsi: Reject scsi-cd if data plane enabled [RHEL only]"
-RH-Commit: [1/1] 1af55d792bc9166e5c86272afe8093c76ab41bb4 (eesposit/qemu-kvm)
-RH-Bugzilla: 1995710
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-
-This reverts commit 4e17b1126e.
-
-Over time AioContext usage and coverage has increased, and now block
-backend is capable of handling AioContext change upon eject and insert.
-Therefore the above downstream-only commit is not necessary anymore,
-and can be safely reverted.
-
-X-downstream-only: true
-
-Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
----
- hw/scsi/virtio-scsi.c | 9 ---------
- 1 file changed, 9 deletions(-)
-
-diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
-index 2450c9438c..db54d104be 100644
---- a/hw/scsi/virtio-scsi.c
-+++ b/hw/scsi/virtio-scsi.c
-@@ -937,15 +937,6 @@ static void virtio_scsi_hotplug(HotplugHandler *hotplug_dev, DeviceState *dev,
-     AioContext *old_context;
-     int ret;
- 
--    /* XXX: Remove this check once block backend is capable of handling
--     * AioContext change upon eject/insert.
--     * s->ctx is NULL if ioeventfd is off, s->ctx is qemu_get_aio_context() if
--     * data plane is not used, both cases are safe for scsi-cd. */
--    if (s->ctx && s->ctx != qemu_get_aio_context() &&
--        object_dynamic_cast(OBJECT(dev), "scsi-cd")) {
--        error_setg(errp, "scsi-cd is not supported by data plane");
--        return;
--    }
-     if (s->ctx && !s->dataplane_fenced) {
-         if (blk_op_is_blocked(sd->conf.blk, BLOCK_OP_TYPE_DATAPLANE, errp)) {
-             return;
--- 
-2.31.1
-

SOURCES/kvm-Update-linux-headers-to-v6.0-rc4.patch

@@ -0,0 +1,171 @@
+From 10fc28b61a6fba1e6dc44fd544cf31c7f313c622 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
+Date: Fri, 28 Oct 2022 17:48:00 +0100
+Subject: [PATCH 05/42] Update linux headers to v6.0-rc4
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Cédric Le Goater <clg@redhat.com>
+RH-MergeRequest: 226: s390: Enhanced Interpretation for PCI Functions and Secure Execution guest dump
+RH-Bugzilla: 1664378 2043909
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
+RH-Commit: [5/41] ca55f497d1bf1e72179330f8f613781bf999d898
+
+Based on upstream commit d525f73f9186a5bc641b8caf0b2c9bb94e5aa963
+("Update linux headers to v6.0-rc4"), but this is focusing only on the
+ZPCI and protected dump changes.
+
+Signed-off-by: Cédric Le Goater <clg@redhat.com>
+---
+ linux-headers/linux/kvm.h       | 87 +++++++++++++++++++++++++++++++++
+ linux-headers/linux/vfio_zdev.h |  7 +++
+ 2 files changed, 94 insertions(+)
+
+diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h
+index 0d05d02ee4..c65930288c 100644
+--- a/linux-headers/linux/kvm.h
++++ b/linux-headers/linux/kvm.h
+@@ -1150,6 +1150,9 @@ struct kvm_ppc_resize_hpt {
+ #define KVM_CAP_DISABLE_QUIRKS2 213
+ /* #define KVM_CAP_VM_TSC_CONTROL 214 */
+ #define KVM_CAP_SYSTEM_EVENT_DATA 215
++#define KVM_CAP_S390_PROTECTED_DUMP 217
++#define KVM_CAP_S390_ZPCI_OP 221
++#define KVM_CAP_S390_CPU_TOPOLOGY 222
+ 
+ #ifdef KVM_CAP_IRQ_ROUTING
+ 
+@@ -1651,6 +1654,55 @@ struct kvm_s390_pv_unp {
+ 	__u64 tweak;
+ };
+ 
++enum pv_cmd_dmp_id {
++	KVM_PV_DUMP_INIT,
++	KVM_PV_DUMP_CONFIG_STOR_STATE,
++	KVM_PV_DUMP_COMPLETE,
++	KVM_PV_DUMP_CPU,
++};
++
++struct kvm_s390_pv_dmp {
++	__u64 subcmd;
++	__u64 buff_addr;
++	__u64 buff_len;
++	__u64 gaddr;		/* For dump storage state */
++	__u64 reserved[4];
++};
++
++enum pv_cmd_info_id {
++	KVM_PV_INFO_VM,
++	KVM_PV_INFO_DUMP,
++};
++
++struct kvm_s390_pv_info_dump {
++	__u64 dump_cpu_buffer_len;
++	__u64 dump_config_mem_buffer_per_1m;
++	__u64 dump_config_finalize_len;
++};
++
++struct kvm_s390_pv_info_vm {
++	__u64 inst_calls_list[4];
++	__u64 max_cpus;
++	__u64 max_guests;
++	__u64 max_guest_addr;
++	__u64 feature_indication;
++};
++
++struct kvm_s390_pv_info_header {
++	__u32 id;
++	__u32 len_max;
++	__u32 len_written;
++	__u32 reserved;
++};
++
++struct kvm_s390_pv_info {
++	struct kvm_s390_pv_info_header header;
++	union {
++		struct kvm_s390_pv_info_dump dump;
++		struct kvm_s390_pv_info_vm vm;
++	};
++};
++
+ enum pv_cmd_id {
+ 	KVM_PV_ENABLE,
+ 	KVM_PV_DISABLE,
+@@ -1659,6 +1711,8 @@ enum pv_cmd_id {
+ 	KVM_PV_VERIFY,
+ 	KVM_PV_PREP_RESET,
+ 	KVM_PV_UNSHARE_ALL,
++	KVM_PV_INFO,
++	KVM_PV_DUMP,
+ };
+ 
+ struct kvm_pv_cmd {
+@@ -2066,4 +2120,37 @@ struct kvm_stats_desc {
+ /* Available with KVM_CAP_XSAVE2 */
+ #define KVM_GET_XSAVE2		  _IOR(KVMIO,  0xcf, struct kvm_xsave)
+ 
++/* Available with KVM_CAP_S390_PROTECTED_DUMP */
++#define KVM_S390_PV_CPU_COMMAND	_IOWR(KVMIO, 0xd0, struct kvm_pv_cmd)
++
++/* Available with KVM_CAP_S390_ZPCI_OP */
++#define KVM_S390_ZPCI_OP         _IOW(KVMIO,  0xd1, struct kvm_s390_zpci_op)
++
++struct kvm_s390_zpci_op {
++	/* in */
++	__u32 fh;               /* target device */
++	__u8  op;               /* operation to perform */
++	__u8  pad[3];
++	union {
++		/* for KVM_S390_ZPCIOP_REG_AEN */
++		struct {
++			__u64 ibv;      /* Guest addr of interrupt bit vector */
++			__u64 sb;       /* Guest addr of summary bit */
++			__u32 flags;
++			__u32 noi;      /* Number of interrupts */
++			__u8 isc;       /* Guest interrupt subclass */
++			__u8 sbo;       /* Offset of guest summary bit vector */
++			__u16 pad;
++		} reg_aen;
++		__u64 reserved[8];
++	} u;
++};
++
++/* types for kvm_s390_zpci_op->op */
++#define KVM_S390_ZPCIOP_REG_AEN                0
++#define KVM_S390_ZPCIOP_DEREG_AEN      1
++
++/* flags for kvm_s390_zpci_op->u.reg_aen.flags */
++#define KVM_S390_ZPCIOP_REGAEN_HOST    (1 << 0)
++
+ #endif /* __LINUX_KVM_H */
+diff --git a/linux-headers/linux/vfio_zdev.h b/linux-headers/linux/vfio_zdev.h
+index b4309397b6..77f2aff1f2 100644
+--- a/linux-headers/linux/vfio_zdev.h
++++ b/linux-headers/linux/vfio_zdev.h
+@@ -29,6 +29,9 @@ struct vfio_device_info_cap_zpci_base {
+ 	__u16 fmb_length;	/* Measurement Block Length (in bytes) */
+ 	__u8 pft;		/* PCI Function Type */
+ 	__u8 gid;		/* PCI function group ID */
++	/* End of version 1 */
++	__u32 fh;		/* PCI function handle */
++	/* End of version 2 */
+ };
+ 
+ /**
+@@ -47,6 +50,10 @@ struct vfio_device_info_cap_zpci_group {
+ 	__u16 noi;		/* Maximum number of MSIs */
+ 	__u16 maxstbl;		/* Maximum Store Block Length */
+ 	__u8 version;		/* Supported PCI Version */
++	/* End of version 1 */
++	__u8 reserved;
++	__u16 imaxstbl;		/* Maximum Interpreted Store Block Length */
++	/* End of version 2 */
+ };
+ 
+ /**
+-- 
+2.37.3
+

SOURCES/kvm-accel-introduce-accelerator-blocker-API.patch

@@ -0,0 +1,349 @@
+From a5e7bb1f7a88efb5574266a76e80fd7604d19921 Mon Sep 17 00:00:00 2001
+From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+Date: Mon, 16 Jan 2023 07:49:59 -0500
+Subject: [PATCH 04/11] accel: introduce accelerator blocker API
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+RH-MergeRequest: 247: accel: introduce accelerator blocker API
+RH-Bugzilla: 2161188
+RH-Acked-by: David Hildenbrand <david@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [1/3] 9d3d7f9554974a79042c915763288cce07aef135
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2161188
+
+commit bd688fc93120fb3e28aa70e3dfdf567ccc1e0bc1
+Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+Date:   Fri Nov 11 10:47:56 2022 -0500
+
+    accel: introduce accelerator blocker API
+
+    This API allows the accelerators to prevent vcpus from issuing
+    new ioctls while execting a critical section marked with the
+    accel_ioctl_inhibit_begin/end functions.
+
+    Note that all functions submitting ioctls must mark where the
+    ioctl is being called with accel_{cpu_}ioctl_begin/end().
+
+    This API requires the caller to always hold the BQL.
+    API documentation is in sysemu/accel-blocker.h
+
+    Internally, it uses a QemuLockCnt together with a per-CPU QemuLockCnt
+    (to minimize cache line bouncing) to keep avoid that new ioctls
+    run when the critical section starts, and a QemuEvent to wait
+    that all running ioctls finish.
+
+    Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+    Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+    Message-Id: <20221111154758.1372674-2-eesposit@redhat.com>
+    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+
+Conflicts:
+	util/meson.build: files are missing in rhel 8.8.0
+	namely int128.c, memalign.c and interval-tree.c
+
+Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+---
+ accel/accel-blocker.c          | 154 +++++++++++++++++++++++++++++++++
+ accel/meson.build              |   2 +-
+ hw/core/cpu-common.c           |   2 +
+ include/hw/core/cpu.h          |   3 +
+ include/sysemu/accel-blocker.h |  56 ++++++++++++
+ util/meson.build               |   2 +-
+ 6 files changed, 217 insertions(+), 2 deletions(-)
+ create mode 100644 accel/accel-blocker.c
+ create mode 100644 include/sysemu/accel-blocker.h
+
+diff --git a/accel/accel-blocker.c b/accel/accel-blocker.c
+new file mode 100644
+index 0000000000..1e7f423462
+--- /dev/null
++++ b/accel/accel-blocker.c
+@@ -0,0 +1,154 @@
++/*
++ * Lock to inhibit accelerator ioctls
++ *
++ * Copyright (c) 2022 Red Hat Inc.
++ *
++ * Author: Emanuele Giuseppe Esposito       <eesposit@redhat.com>
++ *
++ * Permission is hereby granted, free of charge, to any person obtaining a copy
++ * of this software and associated documentation files (the "Software"), to deal
++ * in the Software without restriction, including without limitation the rights
++ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
++ * copies of the Software, and to permit persons to whom the Software is
++ * furnished to do so, subject to the following conditions:
++ *
++ * The above copyright notice and this permission notice shall be included in
++ * all copies or substantial portions of the Software.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
++ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
++ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
++ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
++ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
++ * THE SOFTWARE.
++ */
++
++#include "qemu/osdep.h"
++#include "qemu/thread.h"
++#include "qemu/main-loop.h"
++#include "hw/core/cpu.h"
++#include "sysemu/accel-blocker.h"
++
++static QemuLockCnt accel_in_ioctl_lock;
++static QemuEvent accel_in_ioctl_event;
++
++void accel_blocker_init(void)
++{
++    qemu_lockcnt_init(&accel_in_ioctl_lock);
++    qemu_event_init(&accel_in_ioctl_event, false);
++}
++
++void accel_ioctl_begin(void)
++{
++    if (likely(qemu_mutex_iothread_locked())) {
++        return;
++    }
++
++    /* block if lock is taken in kvm_ioctl_inhibit_begin() */
++    qemu_lockcnt_inc(&accel_in_ioctl_lock);
++}
++
++void accel_ioctl_end(void)
++{
++    if (likely(qemu_mutex_iothread_locked())) {
++        return;
++    }
++
++    qemu_lockcnt_dec(&accel_in_ioctl_lock);
++    /* change event to SET. If event was BUSY, wake up all waiters */
++    qemu_event_set(&accel_in_ioctl_event);
++}
++
++void accel_cpu_ioctl_begin(CPUState *cpu)
++{
++    if (unlikely(qemu_mutex_iothread_locked())) {
++        return;
++    }
++
++    /* block if lock is taken in kvm_ioctl_inhibit_begin() */
++    qemu_lockcnt_inc(&cpu->in_ioctl_lock);
++}
++
++void accel_cpu_ioctl_end(CPUState *cpu)
++{
++    if (unlikely(qemu_mutex_iothread_locked())) {
++        return;
++    }
++
++    qemu_lockcnt_dec(&cpu->in_ioctl_lock);
++    /* change event to SET. If event was BUSY, wake up all waiters */
++    qemu_event_set(&accel_in_ioctl_event);
++}
++
++static bool accel_has_to_wait(void)
++{
++    CPUState *cpu;
++    bool needs_to_wait = false;
++
++    CPU_FOREACH(cpu) {
++        if (qemu_lockcnt_count(&cpu->in_ioctl_lock)) {
++            /* exit the ioctl, if vcpu is running it */
++            qemu_cpu_kick(cpu);
++            needs_to_wait = true;
++        }
++    }
++
++    return needs_to_wait || qemu_lockcnt_count(&accel_in_ioctl_lock);
++}
++
++void accel_ioctl_inhibit_begin(void)
++{
++    CPUState *cpu;
++
++    /*
++     * We allow to inhibit only when holding the BQL, so we can identify
++     * when an inhibitor wants to issue an ioctl easily.
++     */
++    g_assert(qemu_mutex_iothread_locked());
++
++    /* Block further invocations of the ioctls outside the BQL.  */
++    CPU_FOREACH(cpu) {
++        qemu_lockcnt_lock(&cpu->in_ioctl_lock);
++    }
++    qemu_lockcnt_lock(&accel_in_ioctl_lock);
++
++    /* Keep waiting until there are running ioctls */
++    while (true) {
++
++        /* Reset event to FREE. */
++        qemu_event_reset(&accel_in_ioctl_event);
++
++        if (accel_has_to_wait()) {
++            /*
++             * If event is still FREE, and there are ioctls still in progress,
++             * wait.
++             *
++             *  If an ioctl finishes before qemu_event_wait(), it will change
++             * the event state to SET. This will prevent qemu_event_wait() from
++             * blocking, but it's not a problem because if other ioctls are
++             * still running the loop will iterate once more and reset the event
++             * status to FREE so that it can wait properly.
++             *
++             * If an ioctls finishes while qemu_event_wait() is blocking, then
++             * it will be waken up, but also here the while loop makes sure
++             * to re-enter the wait if there are other running ioctls.
++             */
++            qemu_event_wait(&accel_in_ioctl_event);
++        } else {
++            /* No ioctl is running */
++            return;
++        }
++    }
++}
++
++void accel_ioctl_inhibit_end(void)
++{
++    CPUState *cpu;
++
++    qemu_lockcnt_unlock(&accel_in_ioctl_lock);
++    CPU_FOREACH(cpu) {
++        qemu_lockcnt_unlock(&cpu->in_ioctl_lock);
++    }
++}
++
+diff --git a/accel/meson.build b/accel/meson.build
+index dfd808d2c8..801b4d44e8 100644
+--- a/accel/meson.build
++++ b/accel/meson.build
+@@ -1,4 +1,4 @@
+-specific_ss.add(files('accel-common.c'))
++specific_ss.add(files('accel-common.c', 'accel-blocker.c'))
+ softmmu_ss.add(files('accel-softmmu.c'))
+ user_ss.add(files('accel-user.c'))
+ 
+diff --git a/hw/core/cpu-common.c b/hw/core/cpu-common.c
+index 9e3241b430..b6e83acf0a 100644
+--- a/hw/core/cpu-common.c
++++ b/hw/core/cpu-common.c
+@@ -238,6 +238,7 @@ static void cpu_common_initfn(Object *obj)
+     cpu->nr_threads = 1;
+ 
+     qemu_mutex_init(&cpu->work_mutex);
++    qemu_lockcnt_init(&cpu->in_ioctl_lock);
+     QSIMPLEQ_INIT(&cpu->work_list);
+     QTAILQ_INIT(&cpu->breakpoints);
+     QTAILQ_INIT(&cpu->watchpoints);
+@@ -249,6 +250,7 @@ static void cpu_common_finalize(Object *obj)
+ {
+     CPUState *cpu = CPU(obj);
+ 
++    qemu_lockcnt_destroy(&cpu->in_ioctl_lock);
+     qemu_mutex_destroy(&cpu->work_mutex);
+ }
+ 
+diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
+index e948e81f1a..49d9c73f97 100644
+--- a/include/hw/core/cpu.h
++++ b/include/hw/core/cpu.h
+@@ -383,6 +383,9 @@ struct CPUState {
+     uint32_t kvm_fetch_index;
+     uint64_t dirty_pages;
+ 
++    /* Use by accel-block: CPU is executing an ioctl() */
++    QemuLockCnt in_ioctl_lock;
++
+     /* Used for events with 'vcpu' and *without* the 'disabled' properties */
+     DECLARE_BITMAP(trace_dstate_delayed, CPU_TRACE_DSTATE_MAX_EVENTS);
+     DECLARE_BITMAP(trace_dstate, CPU_TRACE_DSTATE_MAX_EVENTS);
+diff --git a/include/sysemu/accel-blocker.h b/include/sysemu/accel-blocker.h
+new file mode 100644
+index 0000000000..72020529ef
+--- /dev/null
++++ b/include/sysemu/accel-blocker.h
+@@ -0,0 +1,56 @@
++/*
++ * Accelerator blocking API, to prevent new ioctls from starting and wait the
++ * running ones finish.
++ * This mechanism differs from pause/resume_all_vcpus() in that it does not
++ * release the BQL.
++ *
++ *  Copyright (c) 2022 Red Hat Inc.
++ *
++ * Author: Emanuele Giuseppe Esposito       <eesposit@redhat.com>
++ *
++ * This work is licensed under the terms of the GNU GPL, version 2 or later.
++ * See the COPYING file in the top-level directory.
++ */
++#ifndef ACCEL_BLOCKER_H
++#define ACCEL_BLOCKER_H
++
++#include "qemu/osdep.h"
++#include "sysemu/cpus.h"
++
++extern void accel_blocker_init(void);
++
++/*
++ * accel_{cpu_}ioctl_begin/end:
++ * Mark when ioctl is about to run or just finished.
++ *
++ * accel_{cpu_}ioctl_begin will block after accel_ioctl_inhibit_begin() is
++ * called, preventing new ioctls to run. They will continue only after
++ * accel_ioctl_inibith_end().
++ */
++extern void accel_ioctl_begin(void);
++extern void accel_ioctl_end(void);
++extern void accel_cpu_ioctl_begin(CPUState *cpu);
++extern void accel_cpu_ioctl_end(CPUState *cpu);
++
++/*
++ * accel_ioctl_inhibit_begin: start critical section
++ *
++ * This function makes sure that:
++ * 1) incoming accel_{cpu_}ioctl_begin() calls block
++ * 2) wait that all ioctls that were already running reach
++ *    accel_{cpu_}ioctl_end(), kicking vcpus if necessary.
++ *
++ * This allows the caller to access shared data or perform operations without
++ * worrying of concurrent vcpus accesses.
++ */
++extern void accel_ioctl_inhibit_begin(void);
++
++/*
++ * accel_ioctl_inhibit_end: end critical section started by
++ * accel_ioctl_inhibit_begin()
++ *
++ * This function allows blocked accel_{cpu_}ioctl_begin() to continue.
++ */
++extern void accel_ioctl_inhibit_end(void);
++
++#endif /* ACCEL_BLOCKER_H */
+diff --git a/util/meson.build b/util/meson.build
+index 05b593055a..b5f153b0e8 100644
+--- a/util/meson.build
++++ b/util/meson.build
+@@ -48,6 +48,7 @@ util_ss.add(files('transactions.c'))
+ util_ss.add(when: 'CONFIG_POSIX', if_true: files('drm.c'))
+ util_ss.add(files('guest-random.c'))
+ util_ss.add(files('yank.c'))
++util_ss.add(files('lockcnt.c'))
+ 
+ if have_user
+   util_ss.add(files('selfmap.c'))
+@@ -69,7 +70,6 @@ if have_block
+   util_ss.add(files('hexdump.c'))
+   util_ss.add(files('iova-tree.c'))
+   util_ss.add(files('iov.c', 'qemu-sockets.c', 'uri.c'))
+-  util_ss.add(files('lockcnt.c'))
+   util_ss.add(files('main-loop.c'))
+   util_ss.add(files('nvdimm-utils.c'))
+   util_ss.add(files('qemu-coroutine.c', 'qemu-coroutine-lock.c', 'qemu-coroutine-io.c'))
+-- 
+2.37.3
+

SOURCES/kvm-acpi-fix-OEM-ID-OEM-Table-ID-padding.patch

@@ -0,0 +1,78 @@
+From af082f3499de265d123157d097b5c84981e0aa63 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Wed, 30 Mar 2022 14:52:34 -0400
+Subject: [PATCH 15/18] acpi: fix OEM ID/OEM Table ID padding
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 141: acpi: fix QEMU crash when started with SLIC table
+RH-Commit: [7/10] 51ea859cbe12b5a902d529ab589d18757d98f71d (jmaloy/qemu-kvm)
+RH-Bugzilla: 2062611
+RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2062611
+Upstream: Merged
+
+commit 748c030f360a940fe0c9382c8ca1649096c3a80d
+Author: Igor Mammedov <imammedo@redhat.com>
+Date:   Wed Jan 12 08:03:31 2022 -0500
+
+    acpi: fix OEM ID/OEM Table ID padding
+
+    Commit [2] broke original '\0' padding of OEM ID and OEM Table ID
+    fields in headers of ACPI tables. While it doesn't have impact on
+    default values since QEMU uses 6 and 8 characters long values
+    respectively, it broke usecase where IDs are provided on QEMU CLI.
+    It shouldn't affect guest (but may cause licensing verification
+    issues in guest OS).
+    One of the broken usecases is user supplied SLIC table with IDs
+    shorter than max possible length, where [2] mangles IDs with extra
+    spaces in RSDT and FADT tables whereas guest OS expects those to
+    mirror the respective values of the used SLIC table.
+
+    Fix it by replacing whitespace padding with '\0' padding in
+    accordance with [1] and expectations of guest OS
+
+    1) ACPI spec, v2.0b
+           17.2 AML Grammar Definition
+           ...
+           //OEM ID of up to 6 characters. If the OEM ID is
+           //shorter than 6 characters, it can be terminated
+           //with a NULL character.
+
+    2)
+    Fixes: 602b458201 ("acpi: Permit OEM ID and OEM table ID fields to be changed")
+    Resolves: https://gitlab.com/qemu-project/qemu/-/issues/707
+    Reported-by: Dmitry V. Orekhov <dima.orekhov@gmail.com>
+    Signed-off-by: Igor Mammedov <imammedo@redhat.com>
+    Cc: qemu-stable@nongnu.org
+    Message-Id: <20220112130332.1648664-4-imammedo@redhat.com>
+    Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+    Reviewed-by: Ani Sinha <ani@anisinha.ca>
+    Tested-by: Dmitry V. Orekhov dima.orekhov@gmail.com
+
+(cherry picked from commit 748c030f360a940fe0c9382c8ca1649096c3a80d)
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ hw/acpi/aml-build.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/hw/acpi/aml-build.c b/hw/acpi/aml-build.c
+index b3b3310df3..65148d5b9d 100644
+--- a/hw/acpi/aml-build.c
++++ b/hw/acpi/aml-build.c
+@@ -1724,9 +1724,9 @@ void acpi_table_begin(AcpiTable *desc, GArray *array)
+     build_append_int_noprefix(array, 0, 4); /* Length */
+     build_append_int_noprefix(array, desc->rev, 1); /* Revision */
+     build_append_int_noprefix(array, 0, 1); /* Checksum */
+-    build_append_padded_str(array, desc->oem_id, 6, ' '); /* OEMID */
++    build_append_padded_str(array, desc->oem_id, 6, '\0'); /* OEMID */
+     /* OEM Table ID */
+-    build_append_padded_str(array, desc->oem_table_id, 8, ' ');
++    build_append_padded_str(array, desc->oem_table_id, 8, '\0');
+     build_append_int_noprefix(array, 1, 4); /* OEM Revision */
+     g_array_append_vals(array, ACPI_BUILD_APPNAME8, 4); /* Creator ID */
+     build_append_int_noprefix(array, 1, 4); /* Creator Revision */
+-- 
+2.27.0
+

SOURCES/kvm-acpi-fix-QEMU-crash-when-started-with-SLIC-table.patch

@@ -0,0 +1,108 @@
+From 4e8fb957a349558648d5cddb80a89460bc97439e Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Wed, 30 Mar 2022 14:52:34 -0400
+Subject: [PATCH 09/18] acpi: fix QEMU crash when started with SLIC table
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 141: acpi: fix QEMU crash when started with SLIC table
+RH-Commit: [1/10] 0c34e80346c33da4f220d9c486b120c35005144e (jmaloy/qemu-kvm)
+RH-Bugzilla: 2062611
+RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2062611
+Upstream: Merged
+
+commit 8cdb99af45365727ac17f45239a9b8c1d5155c6d)
+Author: Igor Mammedov <imammedo@redhat.com>
+Date:   Mon Dec 27 14:31:17 2021 -0500
+
+    acpi: fix QEMU crash when started with SLIC table
+
+    if QEMU is started with used provided SLIC table blob,
+
+      -acpitable sig=SLIC,oem_id='CRASH ',oem_table_id="ME",oem_rev=00002210,asl_compiler_id="",asl_compiler_rev=00000000,data=/dev/null
+    it will assert with:
+
+      hw/acpi/aml-build.c:61:build_append_padded_str: assertion failed: (len <= maxlen)
+
+    and following backtrace:
+
+      ...
+      build_append_padded_str (array=0x555556afe320, str=0x555556afdb2e "CRASH ME", maxlen=0x6, pad=0x20) at hw/acpi/aml-build.c:61
+      acpi_table_begin (desc=0x7fffffffd1b0, array=0x555556afe320) at hw/acpi/aml-build.c:1727
+      build_fadt (tbl=0x555556afe320, linker=0x555557ca3830, f=0x7fffffffd318, oem_id=0x555556afdb2e "CRASH ME", oem_table_id=0x555556afdb34 "ME") at hw/acpi/aml-build.c:2064
+      ...
+
+    which happens due to acpi_table_begin() expecting NULL terminated
+    oem_id and oem_table_id strings, which is normally the case, but
+    in case of user provided SLIC table, oem_id points to table's blob
+    directly and as result oem_id became longer than expected.
+
+    Fix issue by handling oem_id consistently and make acpi_get_slic_oem()
+    return NULL terminated strings.
+
+    PS:
+    After [1] refactoring, oem_id semantics became inconsistent, where
+    NULL terminated string was coming from machine and old way pointer
+    into byte array coming from -acpitable option. That used to work
+    since build_header() wasn't expecting NULL terminated string and
+    blindly copied the 1st 6 bytes only.
+
+    However commit [2] broke that by replacing build_header() with
+    acpi_table_begin(), which was expecting NULL terminated string
+    and was checking oem_id size.
+
+    1) 602b45820 ("acpi: Permit OEM ID and OEM table ID fields to be changed")
+    2)
+    Fixes: 4b56e1e4eb08 ("acpi: build_fadt: use acpi_table_begin()/acpi_table_end() instead of build_header()")
+    Resolves: https://gitlab.com/qemu-project/qemu/-/issues/786
+    Signed-off-by: Igor Mammedov <imammedo@redhat.com>
+    Message-Id: <20211227193120.1084176-2-imammedo@redhat.com>
+    Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+    Tested-by: Denis Lisov <dennis.lissov@gmail.com>
+    Tested-by: Alexander Tsoy <alexander@tsoy.me>
+    Cc: qemu-stable@nongnu.org
+    Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+
+(cherry picked from commit 8cdb99af45365727ac17f45239a9b8c1d5155c6d)
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ hw/acpi/core.c       | 4 ++--
+ hw/i386/acpi-build.c | 2 ++
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/hw/acpi/core.c b/hw/acpi/core.c
+index 1e004d0078..3e811bf03c 100644
+--- a/hw/acpi/core.c
++++ b/hw/acpi/core.c
+@@ -345,8 +345,8 @@ int acpi_get_slic_oem(AcpiSlicOem *oem)
+         struct acpi_table_header *hdr = (void *)(u - sizeof(hdr->_length));
+ 
+         if (memcmp(hdr->sig, "SLIC", 4) == 0) {
+-            oem->id = hdr->oem_id;
+-            oem->table_id = hdr->oem_table_id;
++            oem->id = g_strndup(hdr->oem_id, 6);
++            oem->table_id = g_strndup(hdr->oem_table_id, 8);
+             return 0;
+         }
+     }
+diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
+index a4478e77b7..acc4869db0 100644
+--- a/hw/i386/acpi-build.c
++++ b/hw/i386/acpi-build.c
+@@ -2726,6 +2726,8 @@ void acpi_build(AcpiBuildTables *tables, MachineState *machine)
+ 
+     /* Cleanup memory that's no longer used. */
+     g_array_free(table_offsets, true);
++    g_free(slic_oem.id);
++    g_free(slic_oem.table_id);
+ }
+ 
+ static void acpi_ram_update(MemoryRegion *mr, GArray *data)
+-- 
+2.27.0
+

SOURCES/kvm-acpi-fix-acpi_index-migration.patch

@@ -0,0 +1,164 @@
+From 997516a14cb8811558f4db1710e728007a3b53fb Mon Sep 17 00:00:00 2001
+From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
+Date: Wed, 6 Apr 2022 14:58:12 -0400
+Subject: [PATCH 1/2] acpi: fix acpi_index migration
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Peter Xu <peterx@redhat.com>
+RH-MergeRequest: 317: acpi: fix acpi_index migration
+RH-Jira: RHEL-2186
+RH-Acked-by: Ani Sinha <None>
+RH-Acked-by: Leonardo Brás <leobras@redhat.com>
+RH-Commit: [1/2] e49dace989531e940dca1c6e9df5f75ebee411a2
+
+vmstate_acpi_pcihp_use_acpi_index() was expecting AcpiPciHpState
+as state but it actually received PIIX4PMState, because
+VMSTATE_PCI_HOTPLUG is a macro and not another struct.
+So it ended up accessing random pointer, which resulted
+in 'false' return value and acpi_index field wasn't ever
+sent.
+
+However in 7.0 that pointer de-references to value > 0, and
+destination QEMU starts to expect the field which isn't
+sent in migratioon stream from older QEMU (6.2 and older).
+As result migration fails with:
+  qemu-system-x86_64: Missing section footer for 0000:00:01.3/piix4_pm
+  qemu-system-x86_64: load of migration failed: Invalid argument
+
+In addition with QEMU-6.2, destination due to not expected
+state, also never expects the acpi_index field in migration
+stream.
+
+Q35 is not affected as it always sends/expects the field as
+long as acpi based PCI hotplug is enabled.
+
+Fix issue by introducing compat knob to never send/expect
+acpi_index in migration stream for 6.2 and older PC machine
+types and always send it for 7.0 and newer PC machine types.
+
+Diagnosed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+Fixes: b32bd76 ("pci: introduce acpi-index property for PCI device")
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/932
+Signed-off-by: Igor Mammedov <imammedo@redhat.com>
+Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+(cherry picked from commit a83c2844903c45aa7d32cdd17305f23ce2c56ab9)
+Signed-off-by: Peter Xu <peterx@redhat.com>
+---
+ hw/acpi/acpi-pci-hotplug-stub.c |  4 ----
+ hw/acpi/pcihp.c                 |  6 ------
+ hw/acpi/piix4.c                 | 15 ++++++++++++++-
+ hw/core/machine.c               |  5 +++++
+ include/hw/acpi/pcihp.h         |  2 --
+ 5 files changed, 19 insertions(+), 13 deletions(-)
+
+diff --git a/hw/acpi/acpi-pci-hotplug-stub.c b/hw/acpi/acpi-pci-hotplug-stub.c
+index 734e4c5986..a43f6dafc9 100644
+--- a/hw/acpi/acpi-pci-hotplug-stub.c
++++ b/hw/acpi/acpi-pci-hotplug-stub.c
+@@ -41,7 +41,3 @@ void acpi_pcihp_reset(AcpiPciHpState *s, bool acpihp_root_off)
+     return;
+ }
+ 
+-bool vmstate_acpi_pcihp_use_acpi_index(void *opaque, int version_id)
+-{
+-    return false;
+-}
+diff --git a/hw/acpi/pcihp.c b/hw/acpi/pcihp.c
+index be0e846b34..ec861661c3 100644
+--- a/hw/acpi/pcihp.c
++++ b/hw/acpi/pcihp.c
+@@ -559,12 +559,6 @@ void acpi_pcihp_init(Object *owner, AcpiPciHpState *s, PCIBus *root_bus,
+                                    OBJ_PROP_FLAG_READ);
+ }
+ 
+-bool vmstate_acpi_pcihp_use_acpi_index(void *opaque, int version_id)
+-{
+-     AcpiPciHpState *s = opaque;
+-     return s->acpi_index;
+-}
+-
+ const VMStateDescription vmstate_acpi_pcihp_pci_status = {
+     .name = "acpi_pcihp_pci_status",
+     .version_id = 1,
+diff --git a/hw/acpi/piix4.c b/hw/acpi/piix4.c
+index 8d6011c0a3..033e75ce5b 100644
+--- a/hw/acpi/piix4.c
++++ b/hw/acpi/piix4.c
+@@ -82,6 +82,7 @@ struct PIIX4PMState {
+     AcpiPciHpState acpi_pci_hotplug;
+     bool use_acpi_hotplug_bridge;
+     bool use_acpi_root_pci_hotplug;
++    bool not_migrate_acpi_index;
+ 
+     uint8_t disable_s3;
+     uint8_t disable_s4;
+@@ -269,6 +270,16 @@ static bool piix4_vmstate_need_smbus(void *opaque, int version_id)
+     return pm_smbus_vmstate_needed();
+ }
+ 
++/*
++ * This is a fudge to turn off the acpi_index field,
++ * whose test was always broken on piix4 with 6.2 and older machine types.
++ */
++static bool vmstate_test_migrate_acpi_index(void *opaque, int version_id)
++{
++    PIIX4PMState *s = PIIX4_PM(opaque);
++    return s->use_acpi_hotplug_bridge && !s->not_migrate_acpi_index;
++}
++
+ /* qemu-kvm 1.2 uses version 3 but advertised as 2
+  * To support incoming qemu-kvm 1.2 migration, change version_id
+  * and minimum_version_id to 2 below (which breaks migration from
+@@ -299,7 +310,7 @@ static const VMStateDescription vmstate_acpi = {
+             struct AcpiPciHpPciStatus),
+         VMSTATE_PCI_HOTPLUG(acpi_pci_hotplug, PIIX4PMState,
+                             vmstate_test_use_acpi_hotplug_bridge,
+-                            vmstate_acpi_pcihp_use_acpi_index),
++                            vmstate_test_migrate_acpi_index),
+         VMSTATE_END_OF_LIST()
+     },
+     .subsections = (const VMStateDescription*[]) {
+@@ -654,6 +665,8 @@ static Property piix4_pm_properties[] = {
+     DEFINE_PROP_BOOL("memory-hotplug-support", PIIX4PMState,
+                      acpi_memory_hotplug.is_enabled, true),
+     DEFINE_PROP_BOOL("smm-compat", PIIX4PMState, smm_compat, false),
++    DEFINE_PROP_BOOL("x-not-migrate-acpi-index", PIIX4PMState,
++                      not_migrate_acpi_index, false),
+     DEFINE_PROP_END_OF_LIST(),
+ };
+ 
+diff --git a/hw/core/machine.c b/hw/core/machine.c
+index 76fcabec7a..2724f6848a 100644
+--- a/hw/core/machine.c
++++ b/hw/core/machine.c
+@@ -331,6 +331,11 @@ GlobalProperty hw_compat_rhel_7_1[] = {
+ };
+ const size_t hw_compat_rhel_7_1_len = G_N_ELEMENTS(hw_compat_rhel_7_1);
+ 
++GlobalProperty hw_compat_6_2[] = {
++    { "PIIX4_PM", "x-not-migrate-acpi-index", "on"},
++};
++const size_t hw_compat_6_2_len = G_N_ELEMENTS(hw_compat_6_2);
++
+ GlobalProperty hw_compat_6_1[] = {
+     { "vhost-user-vsock-device", "seqpacket", "off" },
+     { "nvme-ns", "shared", "off" },
+diff --git a/include/hw/acpi/pcihp.h b/include/hw/acpi/pcihp.h
+index af1a169fc3..7e268c2c9c 100644
+--- a/include/hw/acpi/pcihp.h
++++ b/include/hw/acpi/pcihp.h
+@@ -73,8 +73,6 @@ void acpi_pcihp_reset(AcpiPciHpState *s, bool acpihp_root_off);
+ 
+ extern const VMStateDescription vmstate_acpi_pcihp_pci_status;
+ 
+-bool vmstate_acpi_pcihp_use_acpi_index(void *opaque, int version_id);
+-
+ #define VMSTATE_PCI_HOTPLUG(pcihp, state, test_pcihp, test_acpi_index) \
+         VMSTATE_UINT32_TEST(pcihp.hotplug_select, state, \
+                             test_pcihp), \
+-- 
+2.37.3
+

SOURCES/kvm-acpi-pcihp-pcie-set-power-on-cap-on-parent-slot.patch

@@ -0,0 +1,140 @@
+From c9ceb175667cdeead59384a97a812367ae19c570 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Wed, 23 Mar 2022 13:21:40 -0400
+Subject: [PATCH 06/18] acpi: pcihp: pcie: set power on cap on parent slot
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 134: pci: expose TYPE_XIO3130_DOWNSTREAM name
+RH-Commit: [2/2] d883872647a6e90ec573140b2c171f3f53b600ab (jmaloy/qemu-kvm)
+RH-Bugzilla: 2062610
+RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
+RH-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
+
+BZ: https://bugzilla.redhat.com/2062610
+UPSTREAM: merged
+BREW: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=44038138
+
+commit 6b0969f1ec825984cd74619f0730be421b0c46fb
+Author: Igor Mammedov <imammedo@redhat.com>
+Date:   Tue Mar 1 10:11:59 2022 -0500
+
+    acpi: pcihp: pcie: set power on cap on parent slot
+
+    on creation a PCIDevice has power turned on at the end of pci_qdev_realize()
+    however later on if PCIe slot isn't populated with any children
+    it's power is turned off. It's fine if native hotplug is used
+    as plug callback will power slot on among other things.
+    However when ACPI hotplug is enabled it replaces native PCIe plug
+    callbacks with ACPI specific ones (acpi_pcihp_device_*plug_cb) and
+    as result slot stays powered off. It works fine as ACPI hotplug
+    on guest side takes care of enumerating/initializing hotplugged
+    device. But when later guest is migrated, call chain introduced by]
+    commit d5daff7d312 (pcie: implement slot power control for pcie root ports)
+
+       pcie_cap_slot_post_load()
+           -> pcie_cap_update_power()
+               -> pcie_set_power_device()
+                   -> pci_set_power()
+                       -> pci_update_mappings()
+
+    will disable earlier initialized BARs for the hotplugged device
+    in powered off slot due to commit 23786d13441 (pci: implement power state)
+    which disables BARs if power is off.
+
+    Fix it by setting PCI_EXP_SLTCTL_PCC to PCI_EXP_SLTCTL_PWR_ON
+    on slot (root port/downstream port) at the time a device
+    hotplugged into it. As result PCI_EXP_SLTCTL_PWR_ON is migrated
+    to target and above call chain keeps device plugged into it
+    powered on.
+
+    Fixes: d5daff7d312 ("pcie: implement slot power control for pcie root ports")
+    Fixes: 23786d13441 ("pci: implement power state")
+    Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2053584
+    Suggested-by: "Michael S. Tsirkin" <mst@redhat.com>
+    Signed-off-by: Igor Mammedov <imammedo@redhat.com>
+    Message-Id: <20220301151200.3507298-3-imammedo@redhat.com>
+    Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+
+(cherry picked from commit 6b0969f1ec825984cd74619f0730be421b0c46fb)
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ hw/acpi/pcihp.c       | 12 +++++++++++-
+ hw/pci/pcie.c         | 11 +++++++++++
+ include/hw/pci/pcie.h |  1 +
+ 3 files changed, 23 insertions(+), 1 deletion(-)
+
+diff --git a/hw/acpi/pcihp.c b/hw/acpi/pcihp.c
+index a5e182dd3a..be0e846b34 100644
+--- a/hw/acpi/pcihp.c
++++ b/hw/acpi/pcihp.c
+@@ -32,6 +32,7 @@
+ #include "hw/pci/pci_bridge.h"
+ #include "hw/pci/pci_host.h"
+ #include "hw/pci/pcie_port.h"
++#include "hw/pci-bridge/xio3130_downstream.h"
+ #include "hw/i386/acpi-build.h"
+ #include "hw/acpi/acpi.h"
+ #include "hw/pci/pci_bus.h"
+@@ -341,6 +342,8 @@ void acpi_pcihp_device_plug_cb(HotplugHandler *hotplug_dev, AcpiPciHpState *s,
+ {
+     PCIDevice *pdev = PCI_DEVICE(dev);
+     int slot = PCI_SLOT(pdev->devfn);
++    PCIDevice *bridge;
++    PCIBus *bus;
+     int bsel;
+ 
+     /* Don't send event when device is enabled during qemu machine creation:
+@@ -370,7 +373,14 @@ void acpi_pcihp_device_plug_cb(HotplugHandler *hotplug_dev, AcpiPciHpState *s,
+         return;
+     }
+ 
+-    bsel = acpi_pcihp_get_bsel(pci_get_bus(pdev));
++    bus = pci_get_bus(pdev);
++    bridge = pci_bridge_get_device(bus);
++    if (object_dynamic_cast(OBJECT(bridge), TYPE_PCIE_ROOT_PORT) ||
++        object_dynamic_cast(OBJECT(bridge), TYPE_XIO3130_DOWNSTREAM)) {
++        pcie_cap_slot_enable_power(bridge);
++    }
++
++    bsel = acpi_pcihp_get_bsel(bus);
+     g_assert(bsel >= 0);
+     s->acpi_pcihp_pci_status[bsel].up |= (1U << slot);
+     acpi_send_event(DEVICE(hotplug_dev), ACPI_PCI_HOTPLUG_STATUS);
+diff --git a/hw/pci/pcie.c b/hw/pci/pcie.c
+index d7d73a31e4..996f0e24fe 100644
+--- a/hw/pci/pcie.c
++++ b/hw/pci/pcie.c
+@@ -366,6 +366,17 @@ static void hotplug_event_clear(PCIDevice *dev)
+     }
+ }
+ 
++void pcie_cap_slot_enable_power(PCIDevice *dev)
++{
++    uint8_t *exp_cap = dev->config + dev->exp.exp_cap;
++    uint32_t sltcap = pci_get_long(exp_cap + PCI_EXP_SLTCAP);
++
++    if (sltcap & PCI_EXP_SLTCAP_PCP) {
++        pci_set_word_by_mask(exp_cap + PCI_EXP_SLTCTL,
++                             PCI_EXP_SLTCTL_PCC, PCI_EXP_SLTCTL_PWR_ON);
++    }
++}
++
+ static void pcie_set_power_device(PCIBus *bus, PCIDevice *dev, void *opaque)
+ {
+     bool *power = opaque;
+diff --git a/include/hw/pci/pcie.h b/include/hw/pci/pcie.h
+index 6063bee0ec..c27368d077 100644
+--- a/include/hw/pci/pcie.h
++++ b/include/hw/pci/pcie.h
+@@ -112,6 +112,7 @@ void pcie_cap_slot_write_config(PCIDevice *dev,
+                                 uint32_t addr, uint32_t val, int len);
+ int pcie_cap_slot_post_load(void *opaque, int version_id);
+ void pcie_cap_slot_push_attention_button(PCIDevice *dev);
++void pcie_cap_slot_enable_power(PCIDevice *dev);
+ 
+ void pcie_cap_root_init(PCIDevice *dev);
+ void pcie_cap_root_reset(PCIDevice *dev);
+-- 
+2.27.0
+

SOURCES/kvm-acpi-validate-hotplug-selector-on-access.patch

@@ -0,0 +1,51 @@
+From 529a5d908f5d16714b8ae0a51eaaaa84994dfae8 Mon Sep 17 00:00:00 2001
+From: "Michael S. Tsirkin" <mst@redhat.com>
+Date: Tue, 21 Dec 2021 09:45:44 -0500
+Subject: [PATCH 1/2] acpi: validate hotplug selector on access
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 97: acpi: validate hotplug selector on access
+RH-Commit: [1/1] 79bcfb0df0091e2b716d2e1c545f047b3409c26c (jmaloy/qemu-kvm)
+RH-Bugzilla: 2036580
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
+RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
+
+When bus is looked up on a pci write, we didn't
+validate that the lookup succeeded.
+Fuzzers thus can trigger QEMU crash by dereferencing the NULL
+bus pointer.
+
+Fixes: b32bd763a1 ("pci: introduce acpi-index property for PCI device")
+Fixes: CVE-2021-4158
+Cc: "Igor Mammedov" <imammedo@redhat.com>
+Fixes: https://gitlab.com/qemu-project/qemu/-/issues/770
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Ani Sinha <ani@anisinha.ca>
+(cherry picked from commit 9bd6565ccee68f72d5012e24646e12a1c662827e)
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ hw/acpi/pcihp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/hw/acpi/pcihp.c b/hw/acpi/pcihp.c
+index 30405b5113..a5e182dd3a 100644
+--- a/hw/acpi/pcihp.c
++++ b/hw/acpi/pcihp.c
+@@ -491,6 +491,9 @@ static void pci_write(void *opaque, hwaddr addr, uint64_t data,
+         }
+ 
+         bus = acpi_pcihp_find_hotplug_bus(s, s->hotplug_select);
++        if (!bus) {
++            break;
++        }
+         QTAILQ_FOREACH_SAFE(kid, &bus->qbus.children, sibling, next) {
+             Object *o = OBJECT(kid->child);
+             PCIDevice *dev = PCI_DEVICE(o);
+-- 
+2.27.0
+

SOURCES/kvm-aio-wait-switch-to-smp_mb__after_rmw.patch

@@ -0,0 +1,50 @@
+From 953c5c0982b61b0a3f8f03452844b5487eb22fc7 Mon Sep 17 00:00:00 2001
+From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+Date: Thu, 9 Mar 2023 08:13:17 -0500
+Subject: [PATCH 06/13] aio-wait: switch to smp_mb__after_rmw()
+
+RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+RH-MergeRequest: 263: qatomic: add smp_mb__before/after_rmw()
+RH-Bugzilla: 2168472
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Eric Auger <eric.auger@redhat.com>
+RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+RH-Acked-by: David Hildenbrand <david@redhat.com>
+RH-Commit: [6/10] 9f30f97754139ffd18d36b2350f9ed4e59ac496e
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2168472
+
+commit b532526a07ef3b903ead2e055fe6cc87b41057a3
+Author: Paolo Bonzini <pbonzini@redhat.com>
+Date:   Fri Mar 3 11:03:52 2023 +0100
+
+    aio-wait: switch to smp_mb__after_rmw()
+
+    The barrier comes after an atomic increment, so it is enough to use
+    smp_mb__after_rmw(); this avoids a double barrier on x86 systems.
+
+    Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+    Reviewed-by: David Hildenbrand <david@redhat.com>
+    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+
+Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+---
+ include/block/aio-wait.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/block/aio-wait.h b/include/block/aio-wait.h
+index 54840f8622..03b6394c78 100644
+--- a/include/block/aio-wait.h
++++ b/include/block/aio-wait.h
+@@ -82,7 +82,7 @@ extern AioWait global_aio_wait;
+     /* Increment wait_->num_waiters before evaluating cond. */     \
+     qatomic_inc(&wait_->num_waiters);                              \
+     /* Paired with smp_mb in aio_wait_kick(). */                   \
+-    smp_mb();                                                      \
++    smp_mb__after_rmw();                                           \
+     if (ctx_ && in_aio_context_home_thread(ctx_)) {                \
+         while ((cond)) {                                           \
+             aio_poll(ctx_, true);                                  \
+-- 
+2.37.3
+

SOURCES/kvm-aio_wait_kick-add-missing-memory-barrier.patch

@@ -0,0 +1,86 @@
+From d7eae0ff4c7f7f7bf10f10272adf7c6971c0db9b Mon Sep 17 00:00:00 2001
+From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+Date: Thu, 9 Mar 2023 09:26:35 -0500
+Subject: [PATCH 01/13] aio_wait_kick: add missing memory barrier
+
+RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+RH-MergeRequest: 263: qatomic: add smp_mb__before/after_rmw()
+RH-Bugzilla: 2168472
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Eric Auger <eric.auger@redhat.com>
+RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+RH-Acked-by: David Hildenbrand <david@redhat.com>
+RH-Commit: [1/10] eb774aee79864052e14e706d931e52e7bd1162c8
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2168472
+
+commit 7455ff1aa01564cc175db5b2373e610503ad4411
+Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+Date:   Tue May 24 13:30:54 2022 -0400
+
+    aio_wait_kick: add missing memory barrier
+
+    It seems that aio_wait_kick always required a memory barrier
+    or atomic operation in the caller, but nobody actually
+    took care of doing it.
+
+    Let's put the barrier in the function instead, and pair it
+    with another one in AIO_WAIT_WHILE. Read aio_wait_kick()
+    comment for further explanation.
+
+    Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
+    Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+    Message-Id: <20220524173054.12651-1-eesposit@redhat.com>
+    Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
+    Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+    Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+
+Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+---
+ include/block/aio-wait.h |  2 ++
+ util/aio-wait.c          | 16 +++++++++++++++-
+ 2 files changed, 17 insertions(+), 1 deletion(-)
+
+diff --git a/include/block/aio-wait.h b/include/block/aio-wait.h
+index b39eefb38d..54840f8622 100644
+--- a/include/block/aio-wait.h
++++ b/include/block/aio-wait.h
+@@ -81,6 +81,8 @@ extern AioWait global_aio_wait;
+     AioContext *ctx_ = (ctx);                                      \
+     /* Increment wait_->num_waiters before evaluating cond. */     \
+     qatomic_inc(&wait_->num_waiters);                              \
++    /* Paired with smp_mb in aio_wait_kick(). */                   \
++    smp_mb();                                                      \
+     if (ctx_ && in_aio_context_home_thread(ctx_)) {                \
+         while ((cond)) {                                           \
+             aio_poll(ctx_, true);                                  \
+diff --git a/util/aio-wait.c b/util/aio-wait.c
+index bdb3d3af22..98c5accd29 100644
+--- a/util/aio-wait.c
++++ b/util/aio-wait.c
+@@ -35,7 +35,21 @@ static void dummy_bh_cb(void *opaque)
+ 
+ void aio_wait_kick(void)
+ {
+-    /* The barrier (or an atomic op) is in the caller.  */
++    /*
++     * Paired with smp_mb in AIO_WAIT_WHILE. Here we have:
++     * write(condition);
++     * aio_wait_kick() {
++     *      smp_mb();
++     *      read(num_waiters);
++     * }
++     *
++     * And in AIO_WAIT_WHILE:
++     * write(num_waiters);
++     * smp_mb();
++     * read(condition);
++     */
++    smp_mb();
++
+     if (qatomic_read(&global_aio_wait.num_waiters)) {
+         aio_bh_schedule_oneshot(qemu_get_aio_context(), dummy_bh_cb, NULL);
+     }
+-- 
+2.37.3
+

SOURCES/kvm-apic-disable-reentrancy-detection-for-apic-msi.patch

@@ -0,0 +1,56 @@
+From 47d027147694fde94dd73305ee53b6a136cbeced Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 9 May 2023 10:29:03 -0400
+Subject: [PATCH 08/15] apic: disable reentrancy detection for apic-msi
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 277: memory: prevent dma-reentracy issues
+RH-Bugzilla: 1999236
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [8/12] 25c3cf99b00cd9adc10d6e7afa9c3e3b7da08de2 (redhat/rhel/src/qemu-kvm/jons-qemu-kvm-2)
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1999236
+Upstream: Merged
+CVE: CVE-2021-3750
+
+commit 50795ee051a342c681a9b45671c552fbd6274db8
+Author: Alexander Bulekov <alxndr@bu.edu>
+Date:   Thu Apr 27 17:10:13 2023 -0400
+
+    apic: disable reentrancy detection for apic-msi
+
+    As the code is designed for re-entrant calls to apic-msi, mark apic-msi
+    as reentrancy-safe.
+
+    Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
+    Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
+    Message-Id: <20230427211013.2994127-9-alxndr@bu.edu>
+    Signed-off-by: Thomas Huth <thuth@redhat.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ hw/intc/apic.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/hw/intc/apic.c b/hw/intc/apic.c
+index 3df11c34d6..a7c2b301a8 100644
+--- a/hw/intc/apic.c
++++ b/hw/intc/apic.c
+@@ -883,6 +883,13 @@ static void apic_realize(DeviceState *dev, Error **errp)
+     memory_region_init_io(&s->io_memory, OBJECT(s), &apic_io_ops, s, "apic-msi",
+                           APIC_SPACE_SIZE);
+ 
++    /*
++     * apic-msi's apic_mem_write can call into ioapic_eoi_broadcast, which can
++     * write back to apic-msi. As such mark the apic-msi region re-entrancy
++     * safe.
++     */
++    s->io_memory.disable_reentrancy_guard = true;
++
+     s->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, apic_timer, s);
+     local_apics[s->id] = s;
+ 
+-- 
+2.37.3
+

SOURCES/kvm-async-Add-an-optional-reentrancy-guard-to-the-BH-API.patch

@@ -0,0 +1,235 @@
+From 8996ac4369de7e0cb6f911db6f47c3e4ae88c8aa Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 9 May 2023 10:29:03 -0400
+Subject: [PATCH 02/15] async: Add an optional reentrancy guard to the BH API
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 277: memory: prevent dma-reentracy issues
+RH-Bugzilla: 1999236
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [2/12] b03f247e242a6cdb3eebec36477234ac77dcd20c (redhat/rhel/src/qemu-kvm/jons-qemu-kvm-2)
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1999236
+Upstream: Merged
+CVE: CVE-2021-3750
+Conflict: The file block/graph-lock.h, inluded from include/block/aio.h,
+          doesn't exist in this code version. The code compiles without
+          issues if this include is just omitted, so we do that.
+
+commit 9c86c97f12c060bf7484dd931f38634e166a81f0
+Author: Alexander Bulekov <alxndr@bu.edu>
+Date:   Thu Apr 27 17:10:07 2023 -0400
+
+    async: Add an optional reentrancy guard to the BH API
+
+    Devices can pass their MemoryReentrancyGuard (from their DeviceState),
+    when creating new BHes. Then, the async API will toggle the guard
+    before/after calling the BH call-back. This prevents bh->mmio reentrancy
+    issues.
+
+    Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
+    Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
+    Message-Id: <20230427211013.2994127-3-alxndr@bu.edu>
+    [thuth: Fix "line over 90 characters" checkpatch.pl error]
+    Signed-off-by: Thomas Huth <thuth@redhat.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ docs/devel/multiple-iothreads.txt |  7 +++++++
+ include/block/aio.h               | 18 ++++++++++++++++--
+ include/qemu/main-loop.h          |  7 +++++--
+ tests/unit/ptimer-test-stubs.c    |  3 ++-
+ util/async.c                      | 18 +++++++++++++++++-
+ util/main-loop.c                  |  6 ++++--
+ util/trace-events                 |  1 +
+ 7 files changed, 52 insertions(+), 8 deletions(-)
+
+diff --git a/docs/devel/multiple-iothreads.txt b/docs/devel/multiple-iothreads.txt
+index aeb997bed5..a11576bc74 100644
+--- a/docs/devel/multiple-iothreads.txt
++++ b/docs/devel/multiple-iothreads.txt
+@@ -61,6 +61,7 @@ There are several old APIs that use the main loop AioContext:
+  * LEGACY qemu_aio_set_event_notifier() - monitor an event notifier
+  * LEGACY timer_new_ms() - create a timer
+  * LEGACY qemu_bh_new() - create a BH
++ * LEGACY qemu_bh_new_guarded() - create a BH with a device re-entrancy guard
+  * LEGACY qemu_aio_wait() - run an event loop iteration
+ 
+ Since they implicitly work on the main loop they cannot be used in code that
+@@ -72,8 +73,14 @@ Instead, use the AioContext functions directly (see include/block/aio.h):
+  * aio_set_event_notifier() - monitor an event notifier
+  * aio_timer_new() - create a timer
+  * aio_bh_new() - create a BH
++ * aio_bh_new_guarded() - create a BH with a device re-entrancy guard
+  * aio_poll() - run an event loop iteration
+ 
++The qemu_bh_new_guarded/aio_bh_new_guarded APIs accept a "MemReentrancyGuard"
++argument, which is used to check for and prevent re-entrancy problems. For
++BHs associated with devices, the reentrancy-guard is contained in the
++corresponding DeviceState and named "mem_reentrancy_guard".
++
+ The AioContext can be obtained from the IOThread using
+ iothread_get_aio_context() or for the main loop using qemu_get_aio_context().
+ Code that takes an AioContext argument works both in IOThreads or the main
+diff --git a/include/block/aio.h b/include/block/aio.h
+index 47fbe9d81f..c7da152985 100644
+--- a/include/block/aio.h
++++ b/include/block/aio.h
+@@ -22,6 +22,8 @@
+ #include "qemu/event_notifier.h"
+ #include "qemu/thread.h"
+ #include "qemu/timer.h"
++#include "hw/qdev-core.h"
++
+ 
+ typedef struct BlockAIOCB BlockAIOCB;
+ typedef void BlockCompletionFunc(void *opaque, int ret);
+@@ -321,9 +323,11 @@ void aio_bh_schedule_oneshot_full(AioContext *ctx, QEMUBHFunc *cb, void *opaque,
+  * is opaque and must be allocated prior to its use.
+  *
+  * @name: A human-readable identifier for debugging purposes.
++ * @reentrancy_guard: A guard set when entering a cb to prevent
++ * device-reentrancy issues
+  */
+ QEMUBH *aio_bh_new_full(AioContext *ctx, QEMUBHFunc *cb, void *opaque,
+-                        const char *name);
++                        const char *name, MemReentrancyGuard *reentrancy_guard);
+ 
+ /**
+  * aio_bh_new: Allocate a new bottom half structure
+@@ -332,7 +336,17 @@ QEMUBH *aio_bh_new_full(AioContext *ctx, QEMUBHFunc *cb, void *opaque,
+  * string.
+  */
+ #define aio_bh_new(ctx, cb, opaque) \
+-    aio_bh_new_full((ctx), (cb), (opaque), (stringify(cb)))
++    aio_bh_new_full((ctx), (cb), (opaque), (stringify(cb)), NULL)
++
++/**
++ * aio_bh_new_guarded: Allocate a new bottom half structure with a
++ * reentrancy_guard
++ *
++ * A convenience wrapper for aio_bh_new_full() that uses the cb as the name
++ * string.
++ */
++#define aio_bh_new_guarded(ctx, cb, opaque, guard) \
++    aio_bh_new_full((ctx), (cb), (opaque), (stringify(cb)), guard)
+ 
+ /**
+  * aio_notify: Force processing of pending events.
+diff --git a/include/qemu/main-loop.h b/include/qemu/main-loop.h
+index 8dbc6fcb89..85dd5ada9e 100644
+--- a/include/qemu/main-loop.h
++++ b/include/qemu/main-loop.h
+@@ -294,9 +294,12 @@ void qemu_cond_timedwait_iothread(QemuCond *cond, int ms);
+ 
+ void qemu_fd_register(int fd);
+ 
++#define qemu_bh_new_guarded(cb, opaque, guard) \
++    qemu_bh_new_full((cb), (opaque), (stringify(cb)), guard)
+ #define qemu_bh_new(cb, opaque) \
+-    qemu_bh_new_full((cb), (opaque), (stringify(cb)))
+-QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name);
++    qemu_bh_new_full((cb), (opaque), (stringify(cb)), NULL)
++QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name,
++                         MemReentrancyGuard *reentrancy_guard);
+ void qemu_bh_schedule_idle(QEMUBH *bh);
+ 
+ enum {
+diff --git a/tests/unit/ptimer-test-stubs.c b/tests/unit/ptimer-test-stubs.c
+index 2a3ef58799..a7a2d08e7e 100644
+--- a/tests/unit/ptimer-test-stubs.c
++++ b/tests/unit/ptimer-test-stubs.c
+@@ -108,7 +108,8 @@ int64_t qemu_clock_deadline_ns_all(QEMUClockType type, int attr_mask)
+     return deadline;
+ }
+ 
+-QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name)
++QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name,
++                         MemReentrancyGuard *reentrancy_guard)
+ {
+     QEMUBH *bh = g_new(QEMUBH, 1);
+ 
+diff --git a/util/async.c b/util/async.c
+index 2a63bf90f2..1fff02e7fc 100644
+--- a/util/async.c
++++ b/util/async.c
+@@ -62,6 +62,7 @@ struct QEMUBH {
+     void *opaque;
+     QSLIST_ENTRY(QEMUBH) next;
+     unsigned flags;
++    MemReentrancyGuard *reentrancy_guard;
+ };
+ 
+ /* Called concurrently from any thread */
+@@ -127,7 +128,7 @@ void aio_bh_schedule_oneshot_full(AioContext *ctx, QEMUBHFunc *cb,
+ }
+ 
+ QEMUBH *aio_bh_new_full(AioContext *ctx, QEMUBHFunc *cb, void *opaque,
+-                        const char *name)
++                        const char *name, MemReentrancyGuard *reentrancy_guard)
+ {
+     QEMUBH *bh;
+     bh = g_new(QEMUBH, 1);
+@@ -136,13 +137,28 @@ QEMUBH *aio_bh_new_full(AioContext *ctx, QEMUBHFunc *cb, void *opaque,
+         .cb = cb,
+         .opaque = opaque,
+         .name = name,
++        .reentrancy_guard = reentrancy_guard,
+     };
+     return bh;
+ }
+ 
+ void aio_bh_call(QEMUBH *bh)
+ {
++    bool last_engaged_in_io = false;
++
++    if (bh->reentrancy_guard) {
++        last_engaged_in_io = bh->reentrancy_guard->engaged_in_io;
++        if (bh->reentrancy_guard->engaged_in_io) {
++            trace_reentrant_aio(bh->ctx, bh->name);
++        }
++        bh->reentrancy_guard->engaged_in_io = true;
++    }
++
+     bh->cb(bh->opaque);
++
++    if (bh->reentrancy_guard) {
++        bh->reentrancy_guard->engaged_in_io = last_engaged_in_io;
++    }
+ }
+ 
+ /* Multiple occurrences of aio_bh_poll cannot be called concurrently. */
+diff --git a/util/main-loop.c b/util/main-loop.c
+index 06b18b195c..1eacf04691 100644
+--- a/util/main-loop.c
++++ b/util/main-loop.c
+@@ -544,9 +544,11 @@ void main_loop_wait(int nonblocking)
+ 
+ /* Functions to operate on the main QEMU AioContext.  */
+ 
+-QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name)
++QEMUBH *qemu_bh_new_full(QEMUBHFunc *cb, void *opaque, const char *name,
++                         MemReentrancyGuard *reentrancy_guard)
+ {
+-    return aio_bh_new_full(qemu_aio_context, cb, opaque, name);
++    return aio_bh_new_full(qemu_aio_context, cb, opaque, name,
++                           reentrancy_guard);
+ }
+ 
+ /*
+diff --git a/util/trace-events b/util/trace-events
+index c8f53d7d9f..dc3b1eb3bf 100644
+--- a/util/trace-events
++++ b/util/trace-events
+@@ -11,6 +11,7 @@ poll_remove(void *ctx, void *node, int fd) "ctx %p node %p fd %d"
+ # async.c
+ aio_co_schedule(void *ctx, void *co) "ctx %p co %p"
+ aio_co_schedule_bh_cb(void *ctx, void *co) "ctx %p co %p"
++reentrant_aio(void *ctx, const char *name) "ctx %p name %s"
+ 
+ # thread-pool.c
+ thread_pool_submit(void *pool, void *req, void *opaque) "pool %p req %p opaque %p"
+-- 
+2.37.3
+

SOURCES/kvm-async-avoid-use-after-free-on-re-entrancy-guard.patch

@@ -0,0 +1,71 @@
+From d754050d260e2ad890cecd975df6e163c531b40e Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 9 May 2023 10:29:03 -0400
+Subject: [PATCH 09/15] async: avoid use-after-free on re-entrancy guard
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 277: memory: prevent dma-reentracy issues
+RH-Bugzilla: 1999236
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [9/12] d357650e581c3921bbfe3e2fde5e3f55853b5fab (redhat/rhel/src/qemu-kvm/jons-qemu-kvm-2)
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1999236
+Upstream: Merged
+CVE: CVE-2021-3750
+
+commit 7915bd06f25e1803778081161bf6fa10c42dc7cd
+Author: Alexander Bulekov <alxndr@bu.edu>
+Date:   Mon May 1 10:19:56 2023 -0400
+
+    async: avoid use-after-free on re-entrancy guard
+
+    A BH callback can free the BH, causing a use-after-free in aio_bh_call.
+    Fix that by keeping a local copy of the re-entrancy guard pointer.
+
+    Buglink: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58513
+    Fixes: 9c86c97f12 ("async: Add an optional reentrancy guard to the BH API")
+    Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
+    Message-Id: <20230501141956.3444868-1-alxndr@bu.edu>
+    Reviewed-by: Thomas Huth <thuth@redhat.com>
+    Signed-off-by: Thomas Huth <thuth@redhat.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ util/async.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/util/async.c b/util/async.c
+index 1fff02e7fc..ffe0541c3b 100644
+--- a/util/async.c
++++ b/util/async.c
+@@ -146,18 +146,20 @@ void aio_bh_call(QEMUBH *bh)
+ {
+     bool last_engaged_in_io = false;
+ 
+-    if (bh->reentrancy_guard) {
+-        last_engaged_in_io = bh->reentrancy_guard->engaged_in_io;
+-        if (bh->reentrancy_guard->engaged_in_io) {
++    /* Make a copy of the guard-pointer as cb may free the bh */
++    MemReentrancyGuard *reentrancy_guard = bh->reentrancy_guard;
++    if (reentrancy_guard) {
++        last_engaged_in_io = reentrancy_guard->engaged_in_io;
++        if (reentrancy_guard->engaged_in_io) {
+             trace_reentrant_aio(bh->ctx, bh->name);
+         }
+-        bh->reentrancy_guard->engaged_in_io = true;
++        reentrancy_guard->engaged_in_io = true;
+     }
+ 
+     bh->cb(bh->opaque);
+ 
+-    if (bh->reentrancy_guard) {
+-        bh->reentrancy_guard->engaged_in_io = last_engaged_in_io;
++    if (reentrancy_guard) {
++        reentrancy_guard->engaged_in_io = last_engaged_in_io;
+     }
+ }
+ 
+-- 
+2.37.3
+

SOURCES/kvm-async-clarify-usage-of-barriers-in-the-polling-case.patch

@@ -0,0 +1,66 @@
+From 187eb7a418af93375e42298d06e231e2bec3cf00 Mon Sep 17 00:00:00 2001
+From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+Date: Thu, 9 Mar 2023 08:15:42 -0500
+Subject: [PATCH 10/13] async: clarify usage of barriers in the polling case
+
+RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+RH-MergeRequest: 263: qatomic: add smp_mb__before/after_rmw()
+RH-Bugzilla: 2168472
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Eric Auger <eric.auger@redhat.com>
+RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+RH-Acked-by: David Hildenbrand <david@redhat.com>
+RH-Commit: [10/10] 3be07ccc6137a0336becfe63a818d9cbadb38e9c
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2168472
+
+commit 6229438cca037d42f44a96d38feb15cb102a444f
+Author: Paolo Bonzini <pbonzini@redhat.com>
+Date:   Mon Mar 6 10:43:52 2023 +0100
+
+    async: clarify usage of barriers in the polling case
+
+    Explain that aio_context_notifier_poll() relies on
+    aio_notify_accept() to catch all the memory writes that were
+    done before ctx->notified was set to true.
+
+    Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+    Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+
+Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+---
+ util/async.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/util/async.c b/util/async.c
+index 795fe699b6..2a63bf90f2 100644
+--- a/util/async.c
++++ b/util/async.c
+@@ -463,8 +463,9 @@ void aio_notify_accept(AioContext *ctx)
+     qatomic_set(&ctx->notified, false);
+ 
+     /*
+-     * Write ctx->notified before reading e.g. bh->flags.  Pairs with smp_wmb
+-     * in aio_notify.
++     * Order reads of ctx->notified (in aio_context_notifier_poll()) and the
++     * above clearing of ctx->notified before reads of e.g. bh->flags.  Pairs
++     * with smp_wmb() in aio_notify.
+      */
+     smp_mb();
+ }
+@@ -487,6 +488,11 @@ static bool aio_context_notifier_poll(void *opaque)
+     EventNotifier *e = opaque;
+     AioContext *ctx = container_of(e, AioContext, notifier);
+ 
++    /*
++     * No need for load-acquire because we just want to kick the
++     * event loop.  aio_notify_accept() takes care of synchronizing
++     * the event loop with the producers.
++     */
+     return qatomic_read(&ctx->notified);
+ }
+ 
+-- 
+2.37.3
+

SOURCES/kvm-async-update-documentation-of-the-memory-barriers.patch

@@ -0,0 +1,111 @@
+From ea3856bb545d19499602830cdc3076d83a981e7a Mon Sep 17 00:00:00 2001
+From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+Date: Thu, 9 Mar 2023 08:15:36 -0500
+Subject: [PATCH 09/13] async: update documentation of the memory barriers
+
+RH-Author: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+RH-MergeRequest: 263: qatomic: add smp_mb__before/after_rmw()
+RH-Bugzilla: 2168472
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Eric Auger <eric.auger@redhat.com>
+RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+RH-Acked-by: David Hildenbrand <david@redhat.com>
+RH-Commit: [9/10] d471da2acf7a107cf75f3327c5e8d7456307160e
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2168472
+
+commit 8dd48650b43dfde4ebea34191ac267e474bcc29e
+Author: Paolo Bonzini <pbonzini@redhat.com>
+Date:   Mon Mar 6 10:15:06 2023 +0100
+
+    async: update documentation of the memory barriers
+
+    Ever since commit 8c6b0356b539 ("util/async: make bh_aio_poll() O(1)",
+    2020-02-22), synchronization between qemu_bh_schedule() and aio_bh_poll()
+    is happening when the bottom half is enqueued in the bh_list; not
+    when the flags are set.  Update the documentation to match.
+
+    Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+
+Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+---
+ util/async.c | 33 +++++++++++++++++++--------------
+ 1 file changed, 19 insertions(+), 14 deletions(-)
+
+diff --git a/util/async.c b/util/async.c
+index 6f6717a34b..795fe699b6 100644
+--- a/util/async.c
++++ b/util/async.c
+@@ -71,14 +71,21 @@ static void aio_bh_enqueue(QEMUBH *bh, unsigned new_flags)
+     unsigned old_flags;
+ 
+     /*
+-     * The memory barrier implicit in qatomic_fetch_or makes sure that:
+-     * 1. idle & any writes needed by the callback are done before the
+-     *    locations are read in the aio_bh_poll.
+-     * 2. ctx is loaded before the callback has a chance to execute and bh
+-     *    could be freed.
++     * Synchronizes with atomic_fetch_and() in aio_bh_dequeue(), ensuring that
++     * insertion starts after BH_PENDING is set.
+      */
+     old_flags = qatomic_fetch_or(&bh->flags, BH_PENDING | new_flags);
++
+     if (!(old_flags & BH_PENDING)) {
++        /*
++         * At this point the bottom half becomes visible to aio_bh_poll().
++         * This insertion thus synchronizes with QSLIST_MOVE_ATOMIC in
++         * aio_bh_poll(), ensuring that:
++         * 1. any writes needed by the callback are visible from the callback
++         *    after aio_bh_dequeue() returns bh.
++         * 2. ctx is loaded before the callback has a chance to execute and bh
++         *    could be freed.
++         */
+         QSLIST_INSERT_HEAD_ATOMIC(&ctx->bh_list, bh, next);
+     }
+ 
+@@ -97,11 +104,8 @@ static QEMUBH *aio_bh_dequeue(BHList *head, unsigned *flags)
+     QSLIST_REMOVE_HEAD(head, next);
+ 
+     /*
+-     * The qatomic_and is paired with aio_bh_enqueue().  The implicit memory
+-     * barrier ensures that the callback sees all writes done by the scheduling
+-     * thread.  It also ensures that the scheduling thread sees the cleared
+-     * flag before bh->cb has run, and thus will call aio_notify again if
+-     * necessary.
++     * Synchronizes with qatomic_fetch_or() in aio_bh_enqueue(), ensuring that
++     * the removal finishes before BH_PENDING is reset.
+      */
+     *flags = qatomic_fetch_and(&bh->flags,
+                               ~(BH_PENDING | BH_SCHEDULED | BH_IDLE));
+@@ -148,6 +152,7 @@ int aio_bh_poll(AioContext *ctx)
+     BHListSlice *s;
+     int ret = 0;
+ 
++    /* Synchronizes with QSLIST_INSERT_HEAD_ATOMIC in aio_bh_enqueue().  */
+     QSLIST_MOVE_ATOMIC(&slice.bh_list, &ctx->bh_list);
+     QSIMPLEQ_INSERT_TAIL(&ctx->bh_slice_list, &slice, next);
+ 
+@@ -437,15 +442,15 @@ LuringState *aio_get_linux_io_uring(AioContext *ctx)
+ void aio_notify(AioContext *ctx)
+ {
+     /*
+-     * Write e.g. bh->flags before writing ctx->notified.  Pairs with smp_mb in
+-     * aio_notify_accept.
++     * Write e.g. ctx->bh_list before writing ctx->notified.  Pairs with
++     * smp_mb() in aio_notify_accept().
+      */
+     smp_wmb();
+     qatomic_set(&ctx->notified, true);
+ 
+     /*
+-     * Write ctx->notified before reading ctx->notify_me.  Pairs
+-     * with smp_mb in aio_ctx_prepare or aio_poll.
++     * Write ctx->notified (and also ctx->bh_list) before reading ctx->notify_me.
++     * Pairs with smp_mb() in aio_ctx_prepare or aio_poll.
+      */
+     smp_mb();
+     if (qatomic_read(&ctx->notify_me)) {
+-- 
+2.37.3
+

SOURCES/kvm-backends-hostmem-Fix-support-of-memory-backend-memfd.patch

@@ -0,0 +1,71 @@
+From 60da56e3685969493ae483c3cc2c66af13d00baf Mon Sep 17 00:00:00 2001
+From: Thomas Huth <thuth@redhat.com>
+Date: Wed, 10 Aug 2022 14:57:18 +0200
+Subject: [PATCH 1/3] backends/hostmem: Fix support of memory-backend-memfd in
+ qemu_maxrampagesize()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Cédric Le Goater <None>
+RH-MergeRequest: 221: backends/hostmem: Fix support of memory-backend-memfd in qemu_maxrampagesize()
+RH-Bugzilla: 2117149
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: David Hildenbrand <david@redhat.com>
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Commit: [1/1] b5a1047750af32c0a261b8385ea0e819eb16681a
+
+It is currently not possible yet to use "memory-backend-memfd" on s390x
+with hugepages enabled. This problem is caused by qemu_maxrampagesize()
+not taking memory-backend-memfd objects into account yet, so the code
+in s390_memory_init() fails to enable the huge page support there via
+s390_set_max_pagesize(). Fix it by generalizing the code, so that it
+looks at qemu_ram_pagesize(memdev->mr.ram_block) instead of re-trying
+to get the information from the filesystem.
+
+Suggested-by: David Hildenbrand <david@redhat.com>
+Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2116496
+Message-Id: <20220810125720.3849835-2-thuth@redhat.com>
+Reviewed-by: David Hildenbrand <david@redhat.com>
+Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+(cherry picked from commit 8be934b70e923104da883b990dee18f02552d40e)
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2117149
+[clg: Resolved conflict on qemu_real_host_page_size() ]
+Signed-off-by: Cédric Le Goater <clg@redhat.com>
+---
+ backends/hostmem.c | 14 ++------------
+ 1 file changed, 2 insertions(+), 12 deletions(-)
+
+diff --git a/backends/hostmem.c b/backends/hostmem.c
+index 4c05862ed5..0c4654ea85 100644
+--- a/backends/hostmem.c
++++ b/backends/hostmem.c
+@@ -305,22 +305,12 @@ bool host_memory_backend_is_mapped(HostMemoryBackend *backend)
+     return backend->is_mapped;
+ }
+ 
+-#ifdef __linux__
+ size_t host_memory_backend_pagesize(HostMemoryBackend *memdev)
+ {
+-    Object *obj = OBJECT(memdev);
+-    char *path = object_property_get_str(obj, "mem-path", NULL);
+-    size_t pagesize = qemu_mempath_getpagesize(path);
+-
+-    g_free(path);
++    size_t pagesize = qemu_ram_pagesize(memdev->mr.ram_block);
++    g_assert(pagesize >= qemu_real_host_page_size);
+     return pagesize;
+ }
+-#else
+-size_t host_memory_backend_pagesize(HostMemoryBackend *memdev)
+-{
+-    return qemu_real_host_page_size;
+-}
+-#endif
+ 
+ static void
+ host_memory_backend_memory_complete(UserCreatable *uc, Error **errp)
+-- 
+2.35.3
+

SOURCES/kvm-bcm2835_property-disable-reentrancy-detection-for-io.patch

@@ -0,0 +1,58 @@
+From 7715635d018351e0a5c4c25aec2c71a2fe3b9e69 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 9 May 2023 10:29:03 -0400
+Subject: [PATCH 06/15] bcm2835_property: disable reentrancy detection for
+ iomem
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 277: memory: prevent dma-reentracy issues
+RH-Bugzilla: 1999236
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [6/12] 4d6187430ca1c4309a36824c0c6815d2a763db1a (redhat/rhel/src/qemu-kvm/jons-qemu-kvm-2)
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1999236
+Upstream: Merged
+CVE: CVE-2021-3750
+
+commit 985c4a4e547afb9573b6bd6843d20eb2c3d1d1cd
+Author: Alexander Bulekov <alxndr@bu.edu>
+Date:   Thu Apr 27 17:10:11 2023 -0400
+
+    bcm2835_property: disable reentrancy detection for iomem
+
+    As the code is designed for re-entrant calls from bcm2835_property to
+    bcm2835_mbox and back into bcm2835_property, mark iomem as
+    reentrancy-safe.
+
+    Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
+    Reviewed-by: Thomas Huth <thuth@redhat.com>
+    Message-Id: <20230427211013.2994127-7-alxndr@bu.edu>
+    Signed-off-by: Thomas Huth <thuth@redhat.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ hw/misc/bcm2835_property.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/hw/misc/bcm2835_property.c b/hw/misc/bcm2835_property.c
+index 73941bdae9..022b5a849c 100644
+--- a/hw/misc/bcm2835_property.c
++++ b/hw/misc/bcm2835_property.c
+@@ -377,6 +377,13 @@ static void bcm2835_property_init(Object *obj)
+ 
+     memory_region_init_io(&s->iomem, OBJECT(s), &bcm2835_property_ops, s,
+                           TYPE_BCM2835_PROPERTY, 0x10);
++
++    /*
++     * bcm2835_property_ops call into bcm2835_mbox, which in-turn reads from
++     * iomem. As such, mark iomem as re-entracy safe.
++     */
++    s->iomem.disable_reentrancy_guard = true;
++
+     sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
+     sysbus_init_irq(SYS_BUS_DEVICE(s), &s->mbox_irq);
+ }
+-- 
+2.37.3
+

SOURCES/kvm-block-Collapse-padded-I-O-vecs-exceeding-IOV_MAX.patch

@@ -0,0 +1,359 @@
+From 1f7520baa6f0bf02ccba2ebfe7d1d5bf6520f95a Mon Sep 17 00:00:00 2001
+From: Hanna Czenczek <hreitz@redhat.com>
+Date: Tue, 11 Apr 2023 19:34:16 +0200
+Subject: [PATCH 2/5] block: Collapse padded I/O vecs exceeding IOV_MAX
+
+RH-Author: Hanna Czenczek <hreitz@redhat.com>
+RH-MergeRequest: 291: block: Split padded I/O vectors exceeding IOV_MAX
+RH-Bugzilla: 2141964
+RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+RH-Commit: [2/5] 1d86ce8398e4ab66e308a686f9855c963e52b0a9
+
+When processing vectored guest requests that are not aligned to the
+storage request alignment, we pad them by adding head and/or tail
+buffers for a read-modify-write cycle.
+
+The guest can submit I/O vectors up to IOV_MAX (1024) in length, but
+with this padding, the vector can exceed that limit.  As of
+4c002cef0e9abe7135d7916c51abce47f7fc1ee2 ("util/iov: make
+qemu_iovec_init_extended() honest"), we refuse to pad vectors beyond the
+limit, instead returning an error to the guest.
+
+To the guest, this appears as a random I/O error.  We should not return
+an I/O error to the guest when it issued a perfectly valid request.
+
+Before 4c002cef0e9abe7135d7916c51abce47f7fc1ee2, we just made the vector
+longer than IOV_MAX, which generally seems to work (because the guest
+assumes a smaller alignment than we really have, file-posix's
+raw_co_prw() will generally see bdrv_qiov_is_aligned() return false, and
+so emulate the request, so that the IOV_MAX does not matter).  However,
+that does not seem exactly great.
+
+I see two ways to fix this problem:
+1. We split such long requests into two requests.
+2. We join some elements of the vector into new buffers to make it
+   shorter.
+
+I am wary of (1), because it seems like it may have unintended side
+effects.
+
+(2) on the other hand seems relatively simple to implement, with
+hopefully few side effects, so this patch does that.
+
+To do this, the use of qemu_iovec_init_extended() in bdrv_pad_request()
+is effectively replaced by the new function bdrv_create_padded_qiov(),
+which not only wraps the request IOV with padding head/tail, but also
+ensures that the resulting vector will not have more than IOV_MAX
+elements.  Putting that functionality into qemu_iovec_init_extended() is
+infeasible because it requires allocating a bounce buffer; doing so
+would require many more parameters (buffer alignment, how to initialize
+the buffer, and out parameters like the buffer, its length, and the
+original elements), which is not reasonable.
+
+Conversely, it is not difficult to move qemu_iovec_init_extended()'s
+functionality into bdrv_create_padded_qiov() by using public
+qemu_iovec_* functions, so that is what this patch does.
+
+Because bdrv_pad_request() was the only "serious" user of
+qemu_iovec_init_extended(), the next patch will remove the latter
+function, so the functionality is not implemented twice.
+
+Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2141964
+Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
+Message-Id: <20230411173418.19549-3-hreitz@redhat.com>
+Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
+(cherry picked from commit 18743311b829cafc1737a5f20bc3248d5f91ee2a)
+
+Conflicts:
+	block/io.c: Downstream bdrv_pad_request() has no @flags
+        parameter.
+
+Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
+---
+ block/io.c | 166 ++++++++++++++++++++++++++++++++++++++++++++++++-----
+ 1 file changed, 151 insertions(+), 15 deletions(-)
+
+diff --git a/block/io.c b/block/io.c
+index c3e7301613..0fe8f0dd40 100644
+--- a/block/io.c
++++ b/block/io.c
+@@ -1624,6 +1624,14 @@ out:
+  * @merge_reads is true for small requests,
+  * if @buf_len == @head + bytes + @tail. In this case it is possible that both
+  * head and tail exist but @buf_len == align and @tail_buf == @buf.
++ *
++ * @write is true for write requests, false for read requests.
++ *
++ * If padding makes the vector too long (exceeding IOV_MAX), then we need to
++ * merge existing vector elements into a single one.  @collapse_bounce_buf acts
++ * as the bounce buffer in such cases.  @pre_collapse_qiov has the pre-collapse
++ * I/O vector elements so for read requests, the data can be copied back after
++ * the read is done.
+  */
+ typedef struct BdrvRequestPadding {
+     uint8_t *buf;
+@@ -1632,11 +1640,17 @@ typedef struct BdrvRequestPadding {
+     size_t head;
+     size_t tail;
+     bool merge_reads;
++    bool write;
+     QEMUIOVector local_qiov;
++
++    uint8_t *collapse_bounce_buf;
++    size_t collapse_len;
++    QEMUIOVector pre_collapse_qiov;
+ } BdrvRequestPadding;
+ 
+ static bool bdrv_init_padding(BlockDriverState *bs,
+                               int64_t offset, int64_t bytes,
++                              bool write,
+                               BdrvRequestPadding *pad)
+ {
+     int64_t align = bs->bl.request_alignment;
+@@ -1668,6 +1682,8 @@ static bool bdrv_init_padding(BlockDriverState *bs,
+         pad->tail_buf = pad->buf + pad->buf_len - align;
+     }
+ 
++    pad->write = write;
++
+     return true;
+ }
+ 
+@@ -1733,8 +1749,23 @@ zero_mem:
+     return 0;
+ }
+ 
+-static void bdrv_padding_destroy(BdrvRequestPadding *pad)
++/**
++ * Free *pad's associated buffers, and perform any necessary finalization steps.
++ */
++static void bdrv_padding_finalize(BdrvRequestPadding *pad)
+ {
++    if (pad->collapse_bounce_buf) {
++        if (!pad->write) {
++            /*
++             * If padding required elements in the vector to be collapsed into a
++             * bounce buffer, copy the bounce buffer content back
++             */
++            qemu_iovec_from_buf(&pad->pre_collapse_qiov, 0,
++                                pad->collapse_bounce_buf, pad->collapse_len);
++        }
++        qemu_vfree(pad->collapse_bounce_buf);
++        qemu_iovec_destroy(&pad->pre_collapse_qiov);
++    }
+     if (pad->buf) {
+         qemu_vfree(pad->buf);
+         qemu_iovec_destroy(&pad->local_qiov);
+@@ -1742,6 +1773,101 @@ static void bdrv_padding_destroy(BdrvRequestPadding *pad)
+     memset(pad, 0, sizeof(*pad));
+ }
+ 
++/*
++ * Create pad->local_qiov by wrapping @iov in the padding head and tail, while
++ * ensuring that the resulting vector will not exceed IOV_MAX elements.
++ *
++ * To ensure this, when necessary, the first two or three elements of @iov are
++ * merged into pad->collapse_bounce_buf and replaced by a reference to that
++ * bounce buffer in pad->local_qiov.
++ *
++ * After performing a read request, the data from the bounce buffer must be
++ * copied back into pad->pre_collapse_qiov (e.g. by bdrv_padding_finalize()).
++ */
++static int bdrv_create_padded_qiov(BlockDriverState *bs,
++                                   BdrvRequestPadding *pad,
++                                   struct iovec *iov, int niov,
++                                   size_t iov_offset, size_t bytes)
++{
++    int padded_niov, surplus_count, collapse_count;
++
++    /* Assert this invariant */
++    assert(niov <= IOV_MAX);
++
++    /*
++     * Cannot pad if resulting length would exceed SIZE_MAX.  Returning an error
++     * to the guest is not ideal, but there is little else we can do.  At least
++     * this will practically never happen on 64-bit systems.
++     */
++    if (SIZE_MAX - pad->head < bytes ||
++        SIZE_MAX - pad->head - bytes < pad->tail)
++    {
++        return -EINVAL;
++    }
++
++    /* Length of the resulting IOV if we just concatenated everything */
++    padded_niov = !!pad->head + niov + !!pad->tail;
++
++    qemu_iovec_init(&pad->local_qiov, MIN(padded_niov, IOV_MAX));
++
++    if (pad->head) {
++        qemu_iovec_add(&pad->local_qiov, pad->buf, pad->head);
++    }
++
++    /*
++     * If padded_niov > IOV_MAX, we cannot just concatenate everything.
++     * Instead, merge the first two or three elements of @iov to reduce the
++     * number of vector elements as necessary.
++     */
++    if (padded_niov > IOV_MAX) {
++        /*
++         * Only head and tail can have lead to the number of entries exceeding
++         * IOV_MAX, so we can exceed it by the head and tail at most.  We need
++         * to reduce the number of elements by `surplus_count`, so we merge that
++         * many elements plus one into one element.
++         */
++        surplus_count = padded_niov - IOV_MAX;
++        assert(surplus_count <= !!pad->head + !!pad->tail);
++        collapse_count = surplus_count + 1;
++
++        /*
++         * Move the elements to collapse into `pad->pre_collapse_qiov`, then
++         * advance `iov` (and associated variables) by those elements.
++         */
++        qemu_iovec_init(&pad->pre_collapse_qiov, collapse_count);
++        qemu_iovec_concat_iov(&pad->pre_collapse_qiov, iov,
++                              collapse_count, iov_offset, SIZE_MAX);
++        iov += collapse_count;
++        iov_offset = 0;
++        niov -= collapse_count;
++        bytes -= pad->pre_collapse_qiov.size;
++
++        /*
++         * Construct the bounce buffer to match the length of the to-collapse
++         * vector elements, and for write requests, initialize it with the data
++         * from those elements.  Then add it to `pad->local_qiov`.
++         */
++        pad->collapse_len = pad->pre_collapse_qiov.size;
++        pad->collapse_bounce_buf = qemu_blockalign(bs, pad->collapse_len);
++        if (pad->write) {
++            qemu_iovec_to_buf(&pad->pre_collapse_qiov, 0,
++                              pad->collapse_bounce_buf, pad->collapse_len);
++        }
++        qemu_iovec_add(&pad->local_qiov,
++                       pad->collapse_bounce_buf, pad->collapse_len);
++    }
++
++    qemu_iovec_concat_iov(&pad->local_qiov, iov, niov, iov_offset, bytes);
++
++    if (pad->tail) {
++        qemu_iovec_add(&pad->local_qiov,
++                       pad->buf + pad->buf_len - pad->tail, pad->tail);
++    }
++
++    assert(pad->local_qiov.niov == MIN(padded_niov, IOV_MAX));
++    return 0;
++}
++
+ /*
+  * bdrv_pad_request
+  *
+@@ -1749,6 +1875,8 @@ static void bdrv_padding_destroy(BdrvRequestPadding *pad)
+  * read of padding, bdrv_padding_rmw_read() should be called separately if
+  * needed.
+  *
++ * @write is true for write requests, false for read requests.
++ *
+  * Request parameters (@qiov, &qiov_offset, &offset, &bytes) are in-out:
+  *  - on function start they represent original request
+  *  - on failure or when padding is not needed they are unchanged
+@@ -1757,25 +1885,33 @@ static void bdrv_padding_destroy(BdrvRequestPadding *pad)
+ static int bdrv_pad_request(BlockDriverState *bs,
+                             QEMUIOVector **qiov, size_t *qiov_offset,
+                             int64_t *offset, int64_t *bytes,
++                            bool write,
+                             BdrvRequestPadding *pad, bool *padded)
+ {
+     int ret;
++    struct iovec *sliced_iov;
++    int sliced_niov;
++    size_t sliced_head, sliced_tail;
+ 
+     bdrv_check_qiov_request(*offset, *bytes, *qiov, *qiov_offset, &error_abort);
+ 
+-    if (!bdrv_init_padding(bs, *offset, *bytes, pad)) {
++    if (!bdrv_init_padding(bs, *offset, *bytes, write, pad)) {
+         if (padded) {
+             *padded = false;
+         }
+         return 0;
+     }
+ 
+-    ret = qemu_iovec_init_extended(&pad->local_qiov, pad->buf, pad->head,
+-                                   *qiov, *qiov_offset, *bytes,
+-                                   pad->buf + pad->buf_len - pad->tail,
+-                                   pad->tail);
++    sliced_iov = qemu_iovec_slice(*qiov, *qiov_offset, *bytes,
++                                  &sliced_head, &sliced_tail,
++                                  &sliced_niov);
++
++    /* Guaranteed by bdrv_check_qiov_request() */
++    assert(*bytes <= SIZE_MAX);
++    ret = bdrv_create_padded_qiov(bs, pad, sliced_iov, sliced_niov,
++                                  sliced_head, *bytes);
+     if (ret < 0) {
+-        bdrv_padding_destroy(pad);
++        bdrv_padding_finalize(pad);
+         return ret;
+     }
+     *bytes += pad->head + pad->tail;
+@@ -1836,8 +1972,8 @@ int coroutine_fn bdrv_co_preadv_part(BdrvChild *child,
+         flags |= BDRV_REQ_COPY_ON_READ;
+     }
+ 
+-    ret = bdrv_pad_request(bs, &qiov, &qiov_offset, &offset, &bytes, &pad,
+-                           NULL);
++    ret = bdrv_pad_request(bs, &qiov, &qiov_offset, &offset, &bytes, false,
++                           &pad, NULL);
+     if (ret < 0) {
+         goto fail;
+     }
+@@ -1847,7 +1983,7 @@ int coroutine_fn bdrv_co_preadv_part(BdrvChild *child,
+                               bs->bl.request_alignment,
+                               qiov, qiov_offset, flags);
+     tracked_request_end(&req);
+-    bdrv_padding_destroy(&pad);
++    bdrv_padding_finalize(&pad);
+ 
+ fail:
+     bdrv_dec_in_flight(bs);
+@@ -2167,7 +2303,7 @@ static int coroutine_fn bdrv_co_do_zero_pwritev(BdrvChild *child,
+     bool padding;
+     BdrvRequestPadding pad;
+ 
+-    padding = bdrv_init_padding(bs, offset, bytes, &pad);
++    padding = bdrv_init_padding(bs, offset, bytes, true, &pad);
+     if (padding) {
+         bdrv_make_request_serialising(req, align);
+ 
+@@ -2214,7 +2350,7 @@ static int coroutine_fn bdrv_co_do_zero_pwritev(BdrvChild *child,
+     }
+ 
+ out:
+-    bdrv_padding_destroy(&pad);
++    bdrv_padding_finalize(&pad);
+ 
+     return ret;
+ }
+@@ -2280,8 +2416,8 @@ int coroutine_fn bdrv_co_pwritev_part(BdrvChild *child,
+          * bdrv_co_do_zero_pwritev() does aligning by itself, so, we do
+          * alignment only if there is no ZERO flag.
+          */
+-        ret = bdrv_pad_request(bs, &qiov, &qiov_offset, &offset, &bytes, &pad,
+-                               &padded);
++        ret = bdrv_pad_request(bs, &qiov, &qiov_offset, &offset, &bytes, true,
++                               &pad, &padded);
+         if (ret < 0) {
+             return ret;
+         }
+@@ -2310,7 +2446,7 @@ int coroutine_fn bdrv_co_pwritev_part(BdrvChild *child,
+     ret = bdrv_aligned_pwritev(child, &req, offset, bytes, align,
+                                qiov, qiov_offset, flags);
+ 
+-    bdrv_padding_destroy(&pad);
++    bdrv_padding_finalize(&pad);
+ 
+ out:
+     tracked_request_end(&req);
+-- 
+2.39.3
+

SOURCES/kvm-block-Fix-pad_request-s-request-restriction.patch

@@ -0,0 +1,75 @@
+From b9866279996ee065cb524bf30bc70e22efbab303 Mon Sep 17 00:00:00 2001
+From: Hanna Czenczek <hreitz@redhat.com>
+Date: Fri, 14 Jul 2023 10:59:38 +0200
+Subject: [PATCH 5/5] block: Fix pad_request's request restriction
+
+RH-Author: Hanna Czenczek <hreitz@redhat.com>
+RH-MergeRequest: 291: block: Split padded I/O vectors exceeding IOV_MAX
+RH-Bugzilla: 2141964
+RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+RH-Commit: [5/5] f9188bd089d6c67185ea1accde20d491a2ed3193
+
+bdrv_pad_request() relies on requests' lengths not to exceed SIZE_MAX,
+which bdrv_check_qiov_request() does not guarantee.
+
+bdrv_check_request32() however will guarantee this, and both of
+bdrv_pad_request()'s callers (bdrv_co_preadv_part() and
+bdrv_co_pwritev_part()) already run it before calling
+bdrv_pad_request().  Therefore, bdrv_pad_request() can safely call
+bdrv_check_request32() without expecting error, too.
+
+In effect, this patch will not change guest-visible behavior.  It is a
+clean-up to tighten a condition to match what is guaranteed by our
+callers, and which exists purely to show clearly why the subsequent
+assertion (`assert(*bytes <= SIZE_MAX)`) is always true.
+
+Note there is a difference between the interfaces of
+bdrv_check_qiov_request() and bdrv_check_request32(): The former takes
+an errp, the latter does not, so we can no longer just pass
+&error_abort.  Instead, we need to check the returned value.  While we
+do expect success (because the callers have already run this function),
+an assert(ret == 0) is not much simpler than just to return an error if
+it occurs, so let us handle errors by returning them up the stack now.
+
+Reported-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
+Message-id: 20230714085938.202730-1-hreitz@redhat.com
+Fixes: 18743311b829cafc1737a5f20bc3248d5f91ee2a
+       ("block: Collapse padded I/O vecs exceeding IOV_MAX")
+Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
+---
+ block/io.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/block/io.c b/block/io.c
+index 0fe8f0dd40..8ae57728a6 100644
+--- a/block/io.c
++++ b/block/io.c
+@@ -1893,7 +1893,11 @@ static int bdrv_pad_request(BlockDriverState *bs,
+     int sliced_niov;
+     size_t sliced_head, sliced_tail;
+ 
+-    bdrv_check_qiov_request(*offset, *bytes, *qiov, *qiov_offset, &error_abort);
++    /* Should have been checked by the caller already */
++    ret = bdrv_check_request32(*offset, *bytes, *qiov, *qiov_offset);
++    if (ret < 0) {
++        return ret;
++    }
+ 
+     if (!bdrv_init_padding(bs, *offset, *bytes, write, pad)) {
+         if (padded) {
+@@ -1906,7 +1910,7 @@ static int bdrv_pad_request(BlockDriverState *bs,
+                                   &sliced_head, &sliced_tail,
+                                   &sliced_niov);
+ 
+-    /* Guaranteed by bdrv_check_qiov_request() */
++    /* Guaranteed by bdrv_check_request32() */
+     assert(*bytes <= SIZE_MAX);
+     ret = bdrv_create_padded_qiov(bs, pad, sliced_iov, sliced_niov,
+                                   sliced_head, *bytes);
+-- 
+2.39.3
+

SOURCES/kvm-block-Lock-AioContext-for-drain_end-in-blockdev-reop.patch

@@ -0,0 +1,63 @@
+From b21fa5ecd9acf2b91839a2915fb4bb39dac4c803 Mon Sep 17 00:00:00 2001
+From: Kevin Wolf <kwolf@redhat.com>
+Date: Thu, 3 Feb 2022 15:05:33 +0100
+Subject: [PATCH 2/5] block: Lock AioContext for drain_end in blockdev-reopen
+
+RH-Author: Kevin Wolf <kwolf@redhat.com>
+RH-MergeRequest: 142: block: Lock AioContext for drain_end in blockdev-reopen
+RH-Commit: [1/2] 98de3b5987f88ea6b4b503f623d6c4475574e037
+RH-Bugzilla: 2067118
+RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+RH-Acked-by: Hanna Reitz <hreitz@redhat.com>
+
+bdrv_subtree_drained_end() requires the caller to hold the AioContext
+lock for the drained node. Not doing this for nodes outside of the main
+AioContext leads to crashes when AIO_WAIT_WHILE() needs to wait and
+tries to temporarily release the lock.
+
+Fixes: 3908b7a8994fa5ef7a89aa58cd5a02fc58141592
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2046659
+Reported-by: Qing Wang <qinwang@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+Message-Id: <20220203140534.36522-2-kwolf@redhat.com>
+Reviewed-by: Hanna Reitz <hreitz@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit aba8205be0707b9d108e32254e186ba88107a869)
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ blockdev.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/blockdev.c b/blockdev.c
+index b35072644e..565f6a81fd 100644
+--- a/blockdev.c
++++ b/blockdev.c
+@@ -3562,6 +3562,7 @@ void qmp_blockdev_reopen(BlockdevOptionsList *reopen_list, Error **errp)
+ {
+     BlockReopenQueue *queue = NULL;
+     GSList *drained = NULL;
++    GSList *p;
+ 
+     /* Add each one of the BDS that we want to reopen to the queue */
+     for (; reopen_list != NULL; reopen_list = reopen_list->next) {
+@@ -3611,7 +3612,15 @@ void qmp_blockdev_reopen(BlockdevOptionsList *reopen_list, Error **errp)
+ 
+ fail:
+     bdrv_reopen_queue_free(queue);
+-    g_slist_free_full(drained, (GDestroyNotify) bdrv_subtree_drained_end);
++    for (p = drained; p; p = p->next) {
++        BlockDriverState *bs = p->data;
++        AioContext *ctx = bdrv_get_aio_context(bs);
++
++        aio_context_acquire(ctx);
++        bdrv_subtree_drained_end(bs);
++        aio_context_release(ctx);
++    }
++    g_slist_free(drained);
+ }
+ 
+ void qmp_blockdev_del(const char *node_name, Error **errp)
+-- 
+2.27.0
+

SOURCES/kvm-block-Make-bdrv_refresh_limits-non-recursive.patch

@@ -0,0 +1,78 @@
+From 6348063b91b2370cc27153fd58fd11a6681631f6 Mon Sep 17 00:00:00 2001
+From: Hanna Reitz <hreitz@redhat.com>
+Date: Wed, 16 Feb 2022 11:53:53 +0100
+Subject: [PATCH 22/24] block: Make bdrv_refresh_limits() non-recursive
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Hanna Reitz <hreitz@redhat.com>
+RH-MergeRequest: 189: block: Make bdrv_refresh_limits() non-recursive
+RH-Commit: [1/3] 1a1fe37f8d8f0344dd8639d6cc9d884d1aff9096
+RH-Bugzilla: 2072932
+RH-Acked-by: Eric Blake <eblake@redhat.com>
+RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
+
+bdrv_refresh_limits() recurses down to the node's children.  That does
+not seem necessary: When we refresh limits on some node, and then
+recurse down and were to change one of its children's BlockLimits, then
+that would mean we noticed the changed limits by pure chance.  The fact
+that we refresh the parent's limits has nothing to do with it, so the
+reason for the change probably happened before this point in time, and
+we should have refreshed the limits then.
+
+Consequently, we should actually propagate block limits changes upwards,
+not downwards.  That is a separate and pre-existing issue, though, and
+so will not be addressed in this patch.
+
+The problem with recursing is that bdrv_refresh_limits() is not atomic.
+It begins with zeroing BDS.bl, and only then sets proper, valid limits.
+If we do not drain all nodes whose limits are refreshed, then concurrent
+I/O requests can encounter invalid request_alignment values and crash
+qemu.  Therefore, a recursing bdrv_refresh_limits() requires the whole
+subtree to be drained, which is currently not ensured by most callers.
+
+A non-recursive bdrv_refresh_limits() only requires the node in question
+to not receive I/O requests, and this is done by most callers in some
+way or another:
+- bdrv_open_driver() deals with a new node with no parents yet
+- bdrv_set_file_or_backing_noperm() acts on a drained node
+- bdrv_reopen_commit() acts only on drained nodes
+- bdrv_append() should in theory require the node to be drained; in
+  practice most callers just lock the AioContext, which should at least
+  be enough to prevent concurrent I/O requests from accessing invalid
+  limits
+
+So we can resolve the bug by making bdrv_refresh_limits() non-recursive.
+
+Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1879437
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+Reviewed-by: Eric Blake <eblake@redhat.com>
+Message-Id: <20220216105355.30729-2-hreitz@redhat.com>
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit 4d378bbd831bdd2f6e6adcd4ea5b77b6effaa627)
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+---
+ block/io.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/block/io.c b/block/io.c
+index 4e4cb556c5..c3e7301613 100644
+--- a/block/io.c
++++ b/block/io.c
+@@ -189,10 +189,6 @@ void bdrv_refresh_limits(BlockDriverState *bs, Transaction *tran, Error **errp)
+     QLIST_FOREACH(c, &bs->children, next) {
+         if (c->role & (BDRV_CHILD_DATA | BDRV_CHILD_FILTERED | BDRV_CHILD_COW))
+         {
+-            bdrv_refresh_limits(c->bs, tran, errp);
+-            if (*errp) {
+-                return;
+-            }
+             bdrv_merge_limits(&bs->bl, &c->bs->bl);
+             have_limits = true;
+         }
+-- 
+2.35.3
+

SOURCES/kvm-block-backend-prevent-dangling-BDS-pointers-across-a.patch

@@ -0,0 +1,129 @@
+From bf4c15a3debbe68b6eb25c52174843470a9c014f Mon Sep 17 00:00:00 2001
+From: Stefan Hajnoczi <stefanha@redhat.com>
+Date: Tue, 11 Jan 2022 15:36:12 +0000
+Subject: [PATCH 3/6] block-backend: prevent dangling BDS pointers across
+ aio_poll()
+
+RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
+RH-MergeRequest: 109: block-backend: prevent dangling BDS pointers across aio_poll()
+RH-Commit: [1/2] da5a59eddff0dc10be7de8e291fa675143d11d73
+RH-Bugzilla: 2021778 2036178
+RH-Acked-by: Hanna Reitz <hreitz@redhat.com>
+RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
+
+The BlockBackend root child can change when aio_poll() is invoked. This
+happens when a temporary filter node is removed upon blockjob
+completion, for example.
+
+Functions in block/block-backend.c must be aware of this when using a
+blk_bs() pointer across aio_poll() because the BlockDriverState refcnt
+may reach 0, resulting in a stale pointer.
+
+One example is scsi_device_purge_requests(), which calls blk_drain() to
+wait for in-flight requests to cancel. If the backup blockjob is active,
+then the BlockBackend root child is a temporary filter BDS owned by the
+blockjob. The blockjob can complete during bdrv_drained_begin() and the
+last reference to the BDS is released when the temporary filter node is
+removed. This results in a use-after-free when blk_drain() calls
+bdrv_drained_end(bs) on the dangling pointer.
+
+Explicitly hold a reference to bs across block APIs that invoke
+aio_poll().
+
+Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2021778
+Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2036178
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Message-Id: <20220111153613.25453-2-stefanha@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit 1e3552dbd28359d35967b7c28dc86cde1bc29205)
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ block/block-backend.c | 19 +++++++++++++++++--
+ 1 file changed, 17 insertions(+), 2 deletions(-)
+
+diff --git a/block/block-backend.c b/block/block-backend.c
+index 12ef80ea17..23e727199b 100644
+--- a/block/block-backend.c
++++ b/block/block-backend.c
+@@ -822,16 +822,22 @@ BlockBackend *blk_by_public(BlockBackendPublic *public)
+ void blk_remove_bs(BlockBackend *blk)
+ {
+     ThrottleGroupMember *tgm = &blk->public.throttle_group_member;
+-    BlockDriverState *bs;
+     BdrvChild *root;
+ 
+     notifier_list_notify(&blk->remove_bs_notifiers, blk);
+     if (tgm->throttle_state) {
+-        bs = blk_bs(blk);
++        BlockDriverState *bs = blk_bs(blk);
++
++        /*
++         * Take a ref in case blk_bs() changes across bdrv_drained_begin(), for
++         * example, if a temporary filter node is removed by a blockjob.
++         */
++        bdrv_ref(bs);
+         bdrv_drained_begin(bs);
+         throttle_group_detach_aio_context(tgm);
+         throttle_group_attach_aio_context(tgm, qemu_get_aio_context());
+         bdrv_drained_end(bs);
++        bdrv_unref(bs);
+     }
+ 
+     blk_update_root_state(blk);
+@@ -1705,6 +1711,7 @@ void blk_drain(BlockBackend *blk)
+     BlockDriverState *bs = blk_bs(blk);
+ 
+     if (bs) {
++        bdrv_ref(bs);
+         bdrv_drained_begin(bs);
+     }
+ 
+@@ -1714,6 +1721,7 @@ void blk_drain(BlockBackend *blk)
+ 
+     if (bs) {
+         bdrv_drained_end(bs);
++        bdrv_unref(bs);
+     }
+ }
+ 
+@@ -2044,10 +2052,13 @@ static int blk_do_set_aio_context(BlockBackend *blk, AioContext *new_context,
+     int ret;
+ 
+     if (bs) {
++        bdrv_ref(bs);
++
+         if (update_root_node) {
+             ret = bdrv_child_try_set_aio_context(bs, new_context, blk->root,
+                                                  errp);
+             if (ret < 0) {
++                bdrv_unref(bs);
+                 return ret;
+             }
+         }
+@@ -2057,6 +2068,8 @@ static int blk_do_set_aio_context(BlockBackend *blk, AioContext *new_context,
+             throttle_group_attach_aio_context(tgm, new_context);
+             bdrv_drained_end(bs);
+         }
++
++        bdrv_unref(bs);
+     }
+ 
+     blk->ctx = new_context;
+@@ -2326,11 +2339,13 @@ void blk_io_limits_disable(BlockBackend *blk)
+     ThrottleGroupMember *tgm = &blk->public.throttle_group_member;
+     assert(tgm->throttle_state);
+     if (bs) {
++        bdrv_ref(bs);
+         bdrv_drained_begin(bs);
+     }
+     throttle_group_unregister_tgm(tgm);
+     if (bs) {
+         bdrv_drained_end(bs);
++        bdrv_unref(bs);
+     }
+ }
+ 
+-- 
+2.27.0
+

SOURCES/kvm-block-io-Update-BSC-only-if-want_zero-is-true.patch

@@ -0,0 +1,56 @@
+From 4c6eff78f4b31ec4bd7b42440396760d19fde63e Mon Sep 17 00:00:00 2001
+From: Hanna Reitz <hreitz@redhat.com>
+Date: Tue, 18 Jan 2022 17:59:59 +0100
+Subject: [PATCH 6/7] block/io: Update BSC only if want_zero is true
+
+RH-Author: Hanna Reitz <hreitz@redhat.com>
+RH-MergeRequest: 112: block/io: Update BSC only if want_zero is true
+RH-Commit: [1/2] a202de1f52110d1e871c3b5b58f2d9e9b5d17570
+RH-Bugzilla: 2041480
+RH-Acked-by: Eric Blake <eblake@redhat.com>
+RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
+
+We update the block-status cache whenever we get new information from a
+bdrv_co_block_status() call to the block driver.  However, if we have
+passed want_zero=false to that call, it may flag areas containing zeroes
+as data, and so we would update the block-status cache with wrong
+information.
+
+Therefore, we should not update the cache with want_zero=false.
+
+Reported-by: Nir Soffer <nsoffer@redhat.com>
+Fixes: 0bc329fbb00 ("block: block-status cache for data regions")
+Reviewed-by: Nir Soffer <nsoffer@redhat.com>
+Cc: qemu-stable@nongnu.org
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+Message-Id: <20220118170000.49423-2-hreitz@redhat.com>
+Reviewed-by: Eric Blake <eblake@redhat.com>
+Signed-off-by: Eric Blake <eblake@redhat.com>
+(cherry picked from commit 113b727ce788335cf76f65355d670c9bc130fd75)
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+---
+ block/io.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/block/io.c b/block/io.c
+index bb0a254def..4e4cb556c5 100644
+--- a/block/io.c
++++ b/block/io.c
+@@ -2497,8 +2497,12 @@ static int coroutine_fn bdrv_co_block_status(BlockDriverState *bs,
+              * non-protocol nodes, and then it is never used.  However, filling
+              * the cache requires an RCU update, so double check here to avoid
+              * such an update if possible.
++             *
++             * Check want_zero, because we only want to update the cache when we
++             * have accurate information about what is zero and what is data.
+              */
+-            if (ret == (BDRV_BLOCK_DATA | BDRV_BLOCK_OFFSET_VALID) &&
++            if (want_zero &&
++                ret == (BDRV_BLOCK_DATA | BDRV_BLOCK_OFFSET_VALID) &&
+                 QLIST_EMPTY(&bs->children))
+             {
+                 /*
+-- 
+2.27.0
+

SOURCES/kvm-block-mirror-Do-not-wait-for-active-writes.patch

@@ -0,0 +1,153 @@
+From 192f956f2b0761f270070555f8feb1f0544e5558 Mon Sep 17 00:00:00 2001
+From: Hanna Reitz <hreitz@redhat.com>
+Date: Wed, 9 Nov 2022 17:54:48 +0100
+Subject: [PATCH 01/11] block/mirror: Do not wait for active writes
+
+RH-Author: Hanna Czenczek <hreitz@redhat.com>
+RH-MergeRequest: 246: block/mirror: Make active mirror progress even under full load
+RH-Bugzilla: 2125119
+RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
+RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
+RH-Commit: [1/3] 652d1e55b954f13eaec2c86f58735d4942837e16
+
+Waiting for all active writes to settle before daring to create a
+background copying operation means that we will never do background
+operations while the guest does anything (in write-blocking mode), and
+therefore cannot converge.  Yes, we also will not diverge, but actually
+converging would be even nicer.
+
+It is unclear why we did decide to wait for all active writes to settle
+before creating a background operation, but it just does not seem
+necessary.  Active writes will put themselves into the in_flight bitmap
+and thus properly block actually conflicting background requests.
+
+It is important for active requests to wait on overlapping background
+requests, which we do in active_write_prepare().  However, so far it was
+not documented why it is important.  Add such documentation now, and
+also to the other call of mirror_wait_on_conflicts(), so that it becomes
+more clear why and when requests need to actively wait for other
+requests to settle.
+
+Another thing to note is that of course we need to ensure that there are
+no active requests when the job completes, but that is done by virtue of
+the BDS being drained anyway, so there cannot be any active requests at
+that point.
+
+With this change, we will need to explicitly keep track of how many
+bytes are in flight in active requests so that
+job_progress_set_remaining() in mirror_run() can set the correct number
+of remaining bytes.
+
+Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2123297
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+Message-Id: <20221109165452.67927-2-hreitz@redhat.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit d69a879bdf1aed586478eaa161ee064fe1b92f1a)
+Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
+---
+ block/mirror.c | 37 ++++++++++++++++++++++++++++++-------
+ 1 file changed, 30 insertions(+), 7 deletions(-)
+
+diff --git a/block/mirror.c b/block/mirror.c
+index efec2c7674..282f428cb7 100644
+--- a/block/mirror.c
++++ b/block/mirror.c
+@@ -81,6 +81,7 @@ typedef struct MirrorBlockJob {
+     int max_iov;
+     bool initial_zeroing_ongoing;
+     int in_active_write_counter;
++    int64_t active_write_bytes_in_flight;
+     bool prepared;
+     bool in_drain;
+ } MirrorBlockJob;
+@@ -493,6 +494,13 @@ static uint64_t coroutine_fn mirror_iteration(MirrorBlockJob *s)
+     }
+     bdrv_dirty_bitmap_unlock(s->dirty_bitmap);
+ 
++    /*
++     * Wait for concurrent requests to @offset.  The next loop will limit the
++     * copied area based on in_flight_bitmap so we only copy an area that does
++     * not overlap with concurrent in-flight requests.  Still, we would like to
++     * copy something, so wait until there are at least no more requests to the
++     * very beginning of the area.
++     */
+     mirror_wait_on_conflicts(NULL, s, offset, 1);
+ 
+     job_pause_point(&s->common.job);
+@@ -993,12 +1001,6 @@ static int coroutine_fn mirror_run(Job *job, Error **errp)
+         int64_t cnt, delta;
+         bool should_complete;
+ 
+-        /* Do not start passive operations while there are active
+-         * writes in progress */
+-        while (s->in_active_write_counter) {
+-            mirror_wait_for_any_operation(s, true);
+-        }
+-
+         if (s->ret < 0) {
+             ret = s->ret;
+             goto immediate_exit;
+@@ -1015,7 +1017,9 @@ static int coroutine_fn mirror_run(Job *job, Error **errp)
+         /* cnt is the number of dirty bytes remaining and s->bytes_in_flight is
+          * the number of bytes currently being processed; together those are
+          * the current remaining operation length */
+-        job_progress_set_remaining(&s->common.job, s->bytes_in_flight + cnt);
++        job_progress_set_remaining(&s->common.job,
++                                   s->bytes_in_flight + cnt +
++                                   s->active_write_bytes_in_flight);
+ 
+         /* Note that even when no rate limit is applied we need to yield
+          * periodically with no pending I/O so that bdrv_drain_all() returns.
+@@ -1073,6 +1077,10 @@ static int coroutine_fn mirror_run(Job *job, Error **errp)
+ 
+             s->in_drain = true;
+             bdrv_drained_begin(bs);
++
++            /* Must be zero because we are drained */
++            assert(s->in_active_write_counter == 0);
++
+             cnt = bdrv_get_dirty_count(s->dirty_bitmap);
+             if (cnt > 0 || mirror_flush(s) < 0) {
+                 bdrv_drained_end(bs);
+@@ -1306,6 +1314,7 @@ do_sync_target_write(MirrorBlockJob *job, MirrorMethod method,
+     }
+ 
+     job_progress_increase_remaining(&job->common.job, bytes);
++    job->active_write_bytes_in_flight += bytes;
+ 
+     switch (method) {
+     case MIRROR_METHOD_COPY:
+@@ -1327,6 +1336,7 @@ do_sync_target_write(MirrorBlockJob *job, MirrorMethod method,
+         abort();
+     }
+ 
++    job->active_write_bytes_in_flight -= bytes;
+     if (ret >= 0) {
+         job_progress_update(&job->common.job, bytes);
+     } else {
+@@ -1375,6 +1385,19 @@ static MirrorOp *coroutine_fn active_write_prepare(MirrorBlockJob *s,
+ 
+     s->in_active_write_counter++;
+ 
++    /*
++     * Wait for concurrent requests affecting the area.  If there are already
++     * running requests that are copying off now-to-be stale data in the area,
++     * we must wait for them to finish before we begin writing fresh data to the
++     * target so that the write operations appear in the correct order.
++     * Note that background requests (see mirror_iteration()) in contrast only
++     * wait for conflicting requests at the start of the dirty area, and then
++     * (based on the in_flight_bitmap) truncate the area to copy so it will not
++     * conflict with any requests beyond that.  For active writes, however, we
++     * cannot truncate that area.  The request from our parent must be blocked
++     * until the area is copied in full.  Therefore, we must wait for the whole
++     * area to become free of concurrent requests.
++     */
+     mirror_wait_on_conflicts(op, s, offset, bytes);
+ 
+     bitmap_set(s->in_flight_bitmap, start_chunk, end_chunk - start_chunk);
+-- 
+2.37.3
+

SOURCES/kvm-block-mirror-Drop-mirror_wait_for_any_operation.patch

@@ -0,0 +1,76 @@
+From 57c79ed20cb73aa9aa4dd7487379b85ea3f936f6 Mon Sep 17 00:00:00 2001
+From: Hanna Reitz <hreitz@redhat.com>
+Date: Wed, 9 Nov 2022 17:54:49 +0100
+Subject: [PATCH 02/11] block/mirror: Drop mirror_wait_for_any_operation()
+
+RH-Author: Hanna Czenczek <hreitz@redhat.com>
+RH-MergeRequest: 246: block/mirror: Make active mirror progress even under full load
+RH-Bugzilla: 2125119
+RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
+RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
+RH-Commit: [2/3] dec37883bcc491441ae08d9592d1ec26a47765c0
+
+mirror_wait_for_free_in_flight_slot() is the only remaining user of
+mirror_wait_for_any_operation(), so inline the latter into the former.
+
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+Message-Id: <20221109165452.67927-3-hreitz@redhat.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit eb994912993077f178ccb43b20e422ecf9ae4ac7)
+Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
+---
+ block/mirror.c | 21 ++++++++-------------
+ 1 file changed, 8 insertions(+), 13 deletions(-)
+
+diff --git a/block/mirror.c b/block/mirror.c
+index 282f428cb7..6b02555ad7 100644
+--- a/block/mirror.c
++++ b/block/mirror.c
+@@ -304,19 +304,21 @@ static int mirror_cow_align(MirrorBlockJob *s, int64_t *offset,
+ }
+ 
+ static inline void coroutine_fn
+-mirror_wait_for_any_operation(MirrorBlockJob *s, bool active)
++mirror_wait_for_free_in_flight_slot(MirrorBlockJob *s)
+ {
+     MirrorOp *op;
+ 
+     QTAILQ_FOREACH(op, &s->ops_in_flight, next) {
+-        /* Do not wait on pseudo ops, because it may in turn wait on
++        /*
++         * Do not wait on pseudo ops, because it may in turn wait on
+          * some other operation to start, which may in fact be the
+          * caller of this function.  Since there is only one pseudo op
+          * at any given time, we will always find some real operation
+-         * to wait on. */
+-        if (!op->is_pseudo_op && op->is_in_flight &&
+-            op->is_active_write == active)
+-        {
++         * to wait on.
++         * Also, do not wait on active operations, because they do not
++         * use up in-flight slots.
++         */
++        if (!op->is_pseudo_op && op->is_in_flight && !op->is_active_write) {
+             qemu_co_queue_wait(&op->waiting_requests, NULL);
+             return;
+         }
+@@ -324,13 +326,6 @@ mirror_wait_for_any_operation(MirrorBlockJob *s, bool active)
+     abort();
+ }
+ 
+-static inline void coroutine_fn
+-mirror_wait_for_free_in_flight_slot(MirrorBlockJob *s)
+-{
+-    /* Only non-active operations use up in-flight slots */
+-    mirror_wait_for_any_operation(s, false);
+-}
+-
+ /* Perform a mirror copy operation.
+  *
+  * *op->bytes_handled is set to the number of bytes copied after and
+-- 
+2.37.3
+

SOURCES/kvm-block-mirror-Fix-NULL-s-job-in-active-writes.patch

@@ -0,0 +1,75 @@
+From b1f5aa5a342a25dc558ee9d435fed0643fe5155f Mon Sep 17 00:00:00 2001
+From: Hanna Reitz <hreitz@redhat.com>
+Date: Wed, 9 Nov 2022 17:54:50 +0100
+Subject: [PATCH 03/11] block/mirror: Fix NULL s->job in active writes
+
+RH-Author: Hanna Czenczek <hreitz@redhat.com>
+RH-MergeRequest: 246: block/mirror: Make active mirror progress even under full load
+RH-Bugzilla: 2125119
+RH-Acked-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
+RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
+RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
+RH-Commit: [3/3] 49d7ebd15667151a6e14228a8260cfdd0aa27a78
+
+There is a small gap in mirror_start_job() before putting the mirror
+filter node into the block graph (bdrv_append() call) and the actual job
+being created.  Before the job is created, MirrorBDSOpaque.job is NULL.
+
+It is possible that requests come in when bdrv_drained_end() is called,
+and those requests would see MirrorBDSOpaque.job == NULL.  Have our
+filter node handle that case gracefully.
+
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+Message-Id: <20221109165452.67927-4-hreitz@redhat.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit da93d5c84e56e6b4e84aa8e98b6b984c9b6bb528)
+Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
+---
+ block/mirror.c | 20 ++++++++++++--------
+ 1 file changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/block/mirror.c b/block/mirror.c
+index 6b02555ad7..50289fca49 100644
+--- a/block/mirror.c
++++ b/block/mirror.c
+@@ -1438,11 +1438,13 @@ static int coroutine_fn bdrv_mirror_top_do_write(BlockDriverState *bs,
+     MirrorOp *op = NULL;
+     MirrorBDSOpaque *s = bs->opaque;
+     int ret = 0;
+-    bool copy_to_target;
++    bool copy_to_target = false;
+ 
+-    copy_to_target = s->job->ret >= 0 &&
+-                     !job_is_cancelled(&s->job->common.job) &&
+-                     s->job->copy_mode == MIRROR_COPY_MODE_WRITE_BLOCKING;
++    if (s->job) {
++        copy_to_target = s->job->ret >= 0 &&
++                         !job_is_cancelled(&s->job->common.job) &&
++                         s->job->copy_mode == MIRROR_COPY_MODE_WRITE_BLOCKING;
++    }
+ 
+     if (copy_to_target) {
+         op = active_write_prepare(s->job, offset, bytes);
+@@ -1487,11 +1489,13 @@ static int coroutine_fn bdrv_mirror_top_pwritev(BlockDriverState *bs,
+     QEMUIOVector bounce_qiov;
+     void *bounce_buf;
+     int ret = 0;
+-    bool copy_to_target;
++    bool copy_to_target = false;
+ 
+-    copy_to_target = s->job->ret >= 0 &&
+-                     !job_is_cancelled(&s->job->common.job) &&
+-                     s->job->copy_mode == MIRROR_COPY_MODE_WRITE_BLOCKING;
++    if (s->job) {
++        copy_to_target = s->job->ret >= 0 &&
++                         !job_is_cancelled(&s->job->common.job) &&
++                         s->job->copy_mode == MIRROR_COPY_MODE_WRITE_BLOCKING;
++    }
+ 
+     if (copy_to_target) {
+         /* The guest might concurrently modify the data to write; but
+-- 
+2.37.3
+

SOURCES/kvm-block-nbd-Assert-there-are-no-timers-when-closed.patch

@@ -0,0 +1,52 @@
+From d5a85fcf996948d1154e88e9ee3b4e8c64ec2694 Mon Sep 17 00:00:00 2001
+From: Hanna Reitz <hreitz@redhat.com>
+Date: Fri, 4 Feb 2022 12:10:08 +0100
+Subject: [PATCH 2/6] block/nbd: Assert there are no timers when closed
+
+RH-Author: Hanna Reitz <hreitz@redhat.com>
+RH-MergeRequest: 117: block/nbd: Handle AioContext changes
+RH-Commit: [2/6] 995795ae9844a7d2b28cb1e57fd7fe81482d0205
+RH-Bugzilla: 2035185
+RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
+RH-Acked-by: Eric Blake <eblake@redhat.com>
+RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+
+Our two timers must not remain armed beyond nbd_clear_bdrvstate(), or
+they will access freed data when they fire.
+
+This patch is separate from the patches that actually fix the issue
+(HEAD^^ and HEAD^) so that you can run the associated regression iotest
+(281) on a configuration that reproducibly exposes the bug.
+
+Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+(cherry picked from commit 8a39c381e5e407d2fe5500324323f90a8540fa90)
+
+Conflict:
+- block/nbd.c: open_timer was introduced after the 6.2 release (for
+  nbd's @open-timeout parameter), and has not been backported, so drop
+  the assertion that it is NULL
+
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+---
+ block/nbd.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/block/nbd.c b/block/nbd.c
+index b8e5a9b4cc..aab20125d8 100644
+--- a/block/nbd.c
++++ b/block/nbd.c
+@@ -108,6 +108,9 @@ static void nbd_clear_bdrvstate(BlockDriverState *bs)
+ 
+     yank_unregister_instance(BLOCKDEV_YANK_INSTANCE(bs->node_name));
+ 
++    /* Must not leave timers behind that would access freed data */
++    assert(!s->reconnect_delay_timer);
++
+     object_unref(OBJECT(s->tlscreds));
+     qapi_free_SocketAddress(s->saddr);
+     s->saddr = NULL;
+-- 
+2.27.0
+

SOURCES/kvm-block-nbd-Delete-reconnect-delay-timer-when-done.patch

@@ -0,0 +1,54 @@
+From 8e23c0f208c6bd5bb64c4f6e4863b93fa6f4e9de Mon Sep 17 00:00:00 2001
+From: Hanna Reitz <hreitz@redhat.com>
+Date: Fri, 4 Feb 2022 12:10:06 +0100
+Subject: [PATCH 1/6] block/nbd: Delete reconnect delay timer when done
+
+RH-Author: Hanna Reitz <hreitz@redhat.com>
+RH-MergeRequest: 117: block/nbd: Handle AioContext changes
+RH-Commit: [1/6] 70814602a8a43a7c14857d76266d82b1aa5174a9
+RH-Bugzilla: 2035185
+RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
+RH-Acked-by: Eric Blake <eblake@redhat.com>
+RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+
+We start the reconnect delay timer to cancel the reconnection attempt
+after a while.  Once nbd_co_do_establish_connection() has returned, this
+attempt is over, and we no longer need the timer.
+
+Delete it before returning from nbd_reconnect_attempt(), so that it does
+not persist beyond the I/O request that was paused for reconnecting; we
+do not want it to fire in a drained section, because all sort of things
+can happen in such a section (e.g. the AioContext might be changed, and
+we do not want the timer to fire in the wrong context; or the BDS might
+even be deleted, and so the timer CB would access already-freed data).
+
+Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+(cherry picked from commit 3ce1fc16bad9c3f8b7b10b451a224d6d76e5c551)
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+---
+ block/nbd.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/block/nbd.c b/block/nbd.c
+index 5ef462db1b..b8e5a9b4cc 100644
+--- a/block/nbd.c
++++ b/block/nbd.c
+@@ -353,6 +353,13 @@ static coroutine_fn void nbd_reconnect_attempt(BDRVNBDState *s)
+     }
+ 
+     nbd_co_do_establish_connection(s->bs, NULL);
++
++    /*
++     * The reconnect attempt is done (maybe successfully, maybe not), so
++     * we no longer need this timer.  Delete it so it will not outlive
++     * this I/O request (so draining removes all timers).
++     */
++    reconnect_delay_timer_del(s);
+ }
+ 
+ static coroutine_fn int nbd_receive_replies(BDRVNBDState *s, uint64_t handle)
+-- 
+2.27.0
+

SOURCES/kvm-block-nbd-Move-s-ioc-on-AioContext-change.patch

@@ -0,0 +1,107 @@
+From c7f63e7bbc5119d92775e20d1ebbf8280c78b732 Mon Sep 17 00:00:00 2001
+From: Hanna Reitz <hreitz@redhat.com>
+Date: Fri, 4 Feb 2022 12:10:11 +0100
+Subject: [PATCH 5/6] block/nbd: Move s->ioc on AioContext change
+
+RH-Author: Hanna Reitz <hreitz@redhat.com>
+RH-MergeRequest: 117: block/nbd: Handle AioContext changes
+RH-Commit: [5/6] 107757b9fbadfb832c75521317108525daa4174e
+RH-Bugzilla: 2035185
+RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
+RH-Acked-by: Eric Blake <eblake@redhat.com>
+RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+
+s->ioc must always be attached to the NBD node's AioContext.  If that
+context changes, s->ioc must be attached to the new context.
+
+Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2033626
+Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+(cherry picked from commit e15f3a66c830e3fce99c9d56c493c2f7078a1225)
+
+Conflict:
+- block/nbd.c: open_timer was added after the 6.2 release, so we need
+  not (and cannot) assert it is NULL here.
+
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+---
+ block/nbd.c | 41 +++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 41 insertions(+)
+
+diff --git a/block/nbd.c b/block/nbd.c
+index aab20125d8..a3896c7f5f 100644
+--- a/block/nbd.c
++++ b/block/nbd.c
+@@ -2003,6 +2003,38 @@ static void nbd_cancel_in_flight(BlockDriverState *bs)
+     nbd_co_establish_connection_cancel(s->conn);
+ }
+ 
++static void nbd_attach_aio_context(BlockDriverState *bs,
++                                   AioContext *new_context)
++{
++    BDRVNBDState *s = bs->opaque;
++
++    /*
++     * The reconnect_delay_timer is scheduled in I/O paths when the
++     * connection is lost, to cancel the reconnection attempt after a
++     * given time.  Once this attempt is done (successfully or not),
++     * nbd_reconnect_attempt() ensures the timer is deleted before the
++     * respective I/O request is resumed.
++     * Since the AioContext can only be changed when a node is drained,
++     * the reconnect_delay_timer cannot be active here.
++     */
++    assert(!s->reconnect_delay_timer);
++
++    if (s->ioc) {
++        qio_channel_attach_aio_context(s->ioc, new_context);
++    }
++}
++
++static void nbd_detach_aio_context(BlockDriverState *bs)
++{
++    BDRVNBDState *s = bs->opaque;
++
++    assert(!s->reconnect_delay_timer);
++
++    if (s->ioc) {
++        qio_channel_detach_aio_context(s->ioc);
++    }
++}
++
+ static BlockDriver bdrv_nbd = {
+     .format_name                = "nbd",
+     .protocol_name              = "nbd",
+@@ -2026,6 +2058,9 @@ static BlockDriver bdrv_nbd = {
+     .bdrv_dirname               = nbd_dirname,
+     .strong_runtime_opts        = nbd_strong_runtime_opts,
+     .bdrv_cancel_in_flight      = nbd_cancel_in_flight,
++
++    .bdrv_attach_aio_context    = nbd_attach_aio_context,
++    .bdrv_detach_aio_context    = nbd_detach_aio_context,
+ };
+ 
+ static BlockDriver bdrv_nbd_tcp = {
+@@ -2051,6 +2086,9 @@ static BlockDriver bdrv_nbd_tcp = {
+     .bdrv_dirname               = nbd_dirname,
+     .strong_runtime_opts        = nbd_strong_runtime_opts,
+     .bdrv_cancel_in_flight      = nbd_cancel_in_flight,
++
++    .bdrv_attach_aio_context    = nbd_attach_aio_context,
++    .bdrv_detach_aio_context    = nbd_detach_aio_context,
+ };
+ 
+ static BlockDriver bdrv_nbd_unix = {
+@@ -2076,6 +2114,9 @@ static BlockDriver bdrv_nbd_unix = {
+     .bdrv_dirname               = nbd_dirname,
+     .strong_runtime_opts        = nbd_strong_runtime_opts,
+     .bdrv_cancel_in_flight      = nbd_cancel_in_flight,
++
++    .bdrv_attach_aio_context    = nbd_attach_aio_context,
++    .bdrv_detach_aio_context    = nbd_detach_aio_context,
+ };
+ 
+ static void bdrv_nbd_init(void)
+-- 
+2.27.0
+

SOURCES/kvm-block-rbd-fix-handling-of-holes-in-.bdrv_co_block_st.patch

@@ -0,0 +1,59 @@
+From f4b7133d7aeb1d0b9115d01b5cff4df7f6b24e78 Mon Sep 17 00:00:00 2001
+From: Peter Lieven <pl@kamp.de>
+Date: Thu, 13 Jan 2022 15:44:25 +0100
+Subject: [PATCH 5/6] block/rbd: fix handling of holes in .bdrv_co_block_status
+
+RH-Author: Stefano Garzarella <sgarzare@redhat.com>
+RH-MergeRequest: 110: block/rbd: fix handling of holes in .bdrv_co_block_status
+RH-Commit: [1/2] 352656a5c77cc7855b476c3559a10c6aa64a4f58
+RH-Bugzilla: 2037135
+RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
+RH-Acked-by: Hanna Reitz <hreitz@redhat.com>
+
+the assumption that we can't hit a hole if we do not diff against a snapshot was wrong.
+
+We can see a hole in an image if we diff against base if there exists an older snapshot
+of the image and we have discarded blocks in the image where the snapshot has data.
+
+Fix this by simply handling a hole like an unallocated area. There are no callbacks
+for unallocated areas so just bail out if we hit a hole.
+
+Fixes: 0347a8fd4c3faaedf119be04c197804be40a384b
+Suggested-by: Ilya Dryomov <idryomov@gmail.com>
+Cc: qemu-stable@nongnu.org
+Signed-off-by: Peter Lieven <pl@kamp.de>
+Message-Id: <20220113144426.4036493-2-pl@kamp.de>
+Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit 9e302f64bb407a9bb097b626da97228c2654cfee)
+Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
+---
+ block/rbd.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/block/rbd.c b/block/rbd.c
+index def96292e0..20bb896c4a 100644
+--- a/block/rbd.c
++++ b/block/rbd.c
+@@ -1279,11 +1279,11 @@ static int qemu_rbd_diff_iterate_cb(uint64_t offs, size_t len,
+     RBDDiffIterateReq *req = opaque;
+ 
+     assert(req->offs + req->bytes <= offs);
+-    /*
+-     * we do not diff against a snapshot so we should never receive a callback
+-     * for a hole.
+-     */
+-    assert(exists);
++
++    /* treat a hole like an unallocated area and bail out */
++    if (!exists) {
++        return 0;
++    }
+ 
+     if (!req->exists && offs > req->offs) {
+         /*
+-- 
+2.27.0
+

SOURCES/kvm-block-rbd-workaround-for-ceph-issue-53784.patch

@@ -0,0 +1,103 @@
+From 8c50eedf03d8e62acd387b9aa9369dadcea9324c Mon Sep 17 00:00:00 2001
+From: Peter Lieven <pl@kamp.de>
+Date: Thu, 13 Jan 2022 15:44:26 +0100
+Subject: [PATCH 6/6] block/rbd: workaround for ceph issue #53784
+
+RH-Author: Stefano Garzarella <sgarzare@redhat.com>
+RH-MergeRequest: 110: block/rbd: fix handling of holes in .bdrv_co_block_status
+RH-Commit: [2/2] 1384557462e89bb539d0d25a1a471ad738fb9e89
+RH-Bugzilla: 2037135
+RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
+RH-Acked-by: Hanna Reitz <hreitz@redhat.com>
+
+librbd had a bug until early 2022 that affected all versions of ceph that
+supported fast-diff. This bug results in reporting of incorrect offsets
+if the offset parameter to rbd_diff_iterate2 is not object aligned.
+
+This patch works around this bug for pre Quincy versions of librbd.
+
+Fixes: 0347a8fd4c3faaedf119be04c197804be40a384b
+Cc: qemu-stable@nongnu.org
+Signed-off-by: Peter Lieven <pl@kamp.de>
+Message-Id: <20220113144426.4036493-3-pl@kamp.de>
+Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Tested-by: Stefano Garzarella <sgarzare@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit fc176116cdea816ceb8dd969080b2b95f58edbc0)
+Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
+---
+ block/rbd.c | 42 ++++++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 40 insertions(+), 2 deletions(-)
+
+diff --git a/block/rbd.c b/block/rbd.c
+index 20bb896c4a..8f183eba2a 100644
+--- a/block/rbd.c
++++ b/block/rbd.c
+@@ -1320,6 +1320,7 @@ static int coroutine_fn qemu_rbd_co_block_status(BlockDriverState *bs,
+     int status, r;
+     RBDDiffIterateReq req = { .offs = offset };
+     uint64_t features, flags;
++    uint64_t head = 0;
+ 
+     assert(offset + bytes <= s->image_size);
+ 
+@@ -1347,7 +1348,43 @@ static int coroutine_fn qemu_rbd_co_block_status(BlockDriverState *bs,
+         return status;
+     }
+ 
+-    r = rbd_diff_iterate2(s->image, NULL, offset, bytes, true, true,
++#if LIBRBD_VERSION_CODE < LIBRBD_VERSION(1, 17, 0)
++    /*
++     * librbd had a bug until early 2022 that affected all versions of ceph that
++     * supported fast-diff. This bug results in reporting of incorrect offsets
++     * if the offset parameter to rbd_diff_iterate2 is not object aligned.
++     * Work around this bug by rounding down the offset to object boundaries.
++     * This is OK because we call rbd_diff_iterate2 with whole_object = true.
++     * However, this workaround only works for non cloned images with default
++     * striping.
++     *
++     * See: https://tracker.ceph.com/issues/53784
++     */
++
++    /* check if RBD image has non-default striping enabled */
++    if (features & RBD_FEATURE_STRIPINGV2) {
++        return status;
++    }
++
++#pragma GCC diagnostic push
++#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
++    /*
++     * check if RBD image is a clone (= has a parent).
++     *
++     * rbd_get_parent_info is deprecated from Nautilus onwards, but the
++     * replacement rbd_get_parent is not present in Luminous and Mimic.
++     */
++    if (rbd_get_parent_info(s->image, NULL, 0, NULL, 0, NULL, 0) != -ENOENT) {
++        return status;
++    }
++#pragma GCC diagnostic pop
++
++    head = req.offs & (s->object_size - 1);
++    req.offs -= head;
++    bytes += head;
++#endif
++
++    r = rbd_diff_iterate2(s->image, NULL, req.offs, bytes, true, true,
+                           qemu_rbd_diff_iterate_cb, &req);
+     if (r < 0 && r != QEMU_RBD_EXIT_DIFF_ITERATE2) {
+         return status;
+@@ -1366,7 +1403,8 @@ static int coroutine_fn qemu_rbd_co_block_status(BlockDriverState *bs,
+         status = BDRV_BLOCK_ZERO | BDRV_BLOCK_OFFSET_VALID;
+     }
+ 
+-    *pnum = req.bytes;
++    assert(req.bytes > head);
++    *pnum = req.bytes - head;
+     return status;
+ }
+ 
+-- 
+2.27.0
+

SOURCES/kvm-checkpatch-add-qemu_bh_new-aio_bh_new-checks.patch

@@ -0,0 +1,56 @@
+From 866a3b56f6a2d43f3cf7b3313fb41808bc5e6e1f Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 9 May 2023 10:29:03 -0400
+Subject: [PATCH 03/15] checkpatch: add qemu_bh_new/aio_bh_new checks
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 277: memory: prevent dma-reentracy issues
+RH-Bugzilla: 1999236
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [3/12] 620b480b0878c18223f3cc103450bc16aa6d7e21 (redhat/rhel/src/qemu-kvm/jons-qemu-kvm-2)
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1999236
+Upstream: Merged
+CVE: CVE-2021-3750
+
+commit ef56ffbdd6b0605dc1e305611287b948c970e236
+Author: Alexander Bulekov <alxndr@bu.edu>
+Date:   Thu Apr 27 17:10:08 2023 -0400
+
+    checkpatch: add qemu_bh_new/aio_bh_new checks
+
+    Advise authors to use the _guarded versions of the APIs, instead.
+
+    Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
+    Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
+    Message-Id: <20230427211013.2994127-4-alxndr@bu.edu>
+    Signed-off-by: Thomas Huth <thuth@redhat.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ scripts/checkpatch.pl | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
+index cb8eff233e..b2428e80cc 100755
+--- a/scripts/checkpatch.pl
++++ b/scripts/checkpatch.pl
+@@ -2858,6 +2858,14 @@ sub process {
+ 		if ($line =~ /\bsignal\s*\(/ && !($line =~ /SIG_(?:IGN|DFL)/)) {
+ 			ERROR("use sigaction to establish signal handlers; signal is not portable\n" . $herecurr);
+ 		}
++# recommend qemu_bh_new_guarded instead of qemu_bh_new
++        if ($realfile =~ /.*\/hw\/.*/ && $line =~ /\bqemu_bh_new\s*\(/) {
++			ERROR("use qemu_bh_new_guarded() instead of qemu_bh_new() to avoid reentrancy problems\n" . $herecurr);
++		}
++# recommend aio_bh_new_guarded instead of aio_bh_new
++        if ($realfile =~ /.*\/hw\/.*/ && $line =~ /\baio_bh_new\s*\(/) {
++			ERROR("use aio_bh_new_guarded() instead of aio_bh_new() to avoid reentrancy problems\n" . $herecurr);
++		}
+ # check for module_init(), use category-specific init macros explicitly please
+ 		if ($line =~ /^module_init\s*\(/) {
+ 			ERROR("please use block_init(), type_init() etc. instead of module_init()\n" . $herecurr);
+-- 
+2.37.3
+

SOURCES/kvm-configs-devices-aarch64-softmmu-Enable-CONFIG_VIRTIO.patch

@@ -1,41 +0,0 @@
-From 3a0e9bb88e82cc76ca5efc0595ce94b5dc34749e Mon Sep 17 00:00:00 2001
-From: Gavin Shan <gshan@redhat.com>
-Date: Mon, 25 Apr 2022 13:42:46 +0800
-Subject: [PATCH 1/2] configs/devices/aarch64-softmmu: Enable CONFIG_VIRTIO_MEM
-
-RH-Author: Gavin Shan <gshan@redhat.com>
-RH-MergeRequest: 80: Enable virtio-mem for aarch64
-RH-Commit: [1/1] 1afbd08da6d7c860da8d617a0a932d3660514878 (gwshan/qemu-rhel-9)
-RH-Bugzilla: 2044162
-RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
-RH-Acked-by: Eric Auger <eric.auger@redhat.com>
-RH-Acked-by: David Hildenbrand <david@redhat.com>
-
-Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2044162
-
-This enables virtio-mem device on aarch64 since all needed commits
-are ready.
-
-    b1b87327a9 hw/arm/virt: Support for virtio-mem-pci
-    1263615efe virtio-mem: Correct default THP size for ARM64
-
-Signed-off-by: Gavin Shan <gshan@redhat.com>
----
- configs/devices/aarch64-softmmu/aarch64-rh-devices.mak | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak b/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
-index 5f6ee1de5b..187938573f 100644
---- a/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
-+++ b/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
-@@ -22,6 +22,7 @@ CONFIG_VFIO=y
- CONFIG_VFIO_PCI=y
- CONFIG_VIRTIO_MMIO=y
- CONFIG_VIRTIO_PCI=y
-+CONFIG_VIRTIO_MEM=y
- CONFIG_XIO3130=y
- CONFIG_NVDIMM=y
- CONFIG_ACPI_APEI=y
--- 
-2.35.1
-

SOURCES/kvm-coroutine-Rename-qemu_coroutine_inc-dec_pool_size.patch

@@ -1,101 +0,0 @@
-From e3cb8849862a9f0dd20f2913d540336a037d43c7 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Tue, 10 May 2022 17:10:19 +0200
-Subject: [PATCH 07/16] coroutine: Rename qemu_coroutine_inc/dec_pool_size()
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 87: coroutine: Fix crashes due to too large pool batch size
-RH-Commit: [1/2] 6389b11f70225f221784c270d9b90c1ea43ca8fb (kmwolf/centos-qemu-kvm)
-RH-Bugzilla: 2079938
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
-
-It's true that these functions currently affect the batch size in which
-coroutines are reused (i.e. moved from the global release pool to the
-allocation pool of a specific thread), but this is a bug and will be
-fixed in a separate patch.
-
-In fact, the comment in the header file already just promises that it
-influences the pool size, so reflect this in the name of the functions.
-As a nice side effect, the shorter function name makes some line
-wrapping unnecessary.
-
-Cc: qemu-stable@nongnu.org
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Message-Id: <20220510151020.105528-2-kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 98e3ab35054b946f7c2aba5408822532b0920b53)
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- hw/block/virtio-blk.c    | 6 ++----
- include/qemu/coroutine.h | 6 +++---
- util/qemu-coroutine.c    | 4 ++--
- 3 files changed, 7 insertions(+), 9 deletions(-)
-
-diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
-index 540c38f829..6a1cc41877 100644
---- a/hw/block/virtio-blk.c
-+++ b/hw/block/virtio-blk.c
-@@ -1215,8 +1215,7 @@ static void virtio_blk_device_realize(DeviceState *dev, Error **errp)
-     for (i = 0; i < conf->num_queues; i++) {
-         virtio_add_queue(vdev, conf->queue_size, virtio_blk_handle_output);
-     }
--    qemu_coroutine_increase_pool_batch_size(conf->num_queues * conf->queue_size
--                                            / 2);
-+    qemu_coroutine_inc_pool_size(conf->num_queues * conf->queue_size / 2);
-     virtio_blk_data_plane_create(vdev, conf, &s->dataplane, &err);
-     if (err != NULL) {
-         error_propagate(errp, err);
-@@ -1253,8 +1252,7 @@ static void virtio_blk_device_unrealize(DeviceState *dev)
-     for (i = 0; i < conf->num_queues; i++) {
-         virtio_del_queue(vdev, i);
-     }
--    qemu_coroutine_decrease_pool_batch_size(conf->num_queues * conf->queue_size
--                                            / 2);
-+    qemu_coroutine_dec_pool_size(conf->num_queues * conf->queue_size / 2);
-     qemu_del_vm_change_state_handler(s->change);
-     blockdev_mark_auto_del(s->blk);
-     virtio_cleanup(vdev);
-diff --git a/include/qemu/coroutine.h b/include/qemu/coroutine.h
-index c828a95ee0..5b621d1295 100644
---- a/include/qemu/coroutine.h
-+++ b/include/qemu/coroutine.h
-@@ -334,12 +334,12 @@ void coroutine_fn yield_until_fd_readable(int fd);
- /**
-  * Increase coroutine pool size
-  */
--void qemu_coroutine_increase_pool_batch_size(unsigned int additional_pool_size);
-+void qemu_coroutine_inc_pool_size(unsigned int additional_pool_size);
- 
- /**
-- * Devcrease coroutine pool size
-+ * Decrease coroutine pool size
-  */
--void qemu_coroutine_decrease_pool_batch_size(unsigned int additional_pool_size);
-+void qemu_coroutine_dec_pool_size(unsigned int additional_pool_size);
- 
- #include "qemu/lockable.h"
- 
-diff --git a/util/qemu-coroutine.c b/util/qemu-coroutine.c
-index c03b2422ff..faca0ca97c 100644
---- a/util/qemu-coroutine.c
-+++ b/util/qemu-coroutine.c
-@@ -205,12 +205,12 @@ AioContext *coroutine_fn qemu_coroutine_get_aio_context(Coroutine *co)
-     return co->ctx;
- }
- 
--void qemu_coroutine_increase_pool_batch_size(unsigned int additional_pool_size)
-+void qemu_coroutine_inc_pool_size(unsigned int additional_pool_size)
- {
-     qatomic_add(&pool_batch_size, additional_pool_size);
- }
- 
--void qemu_coroutine_decrease_pool_batch_size(unsigned int removing_pool_size)
-+void qemu_coroutine_dec_pool_size(unsigned int removing_pool_size)
- {
-     qatomic_sub(&pool_batch_size, removing_pool_size);
- }
--- 
-2.31.1
-

SOURCES/kvm-coroutine-Revert-to-constant-batch-size.patch

@@ -1,138 +0,0 @@
-From 345107bfd5537b51f34aaeb97d6161858bb6feee Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Tue, 10 May 2022 17:10:20 +0200
-Subject: [PATCH 08/16] coroutine: Revert to constant batch size
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 87: coroutine: Fix crashes due to too large pool batch size
-RH-Commit: [2/2] 8a8a39af873854cdc8333d1a70f3479a97c3ec7a (kmwolf/centos-qemu-kvm)
-RH-Bugzilla: 2079938
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Acked-by: Stefano Garzarella <sgarzare@redhat.com>
-
-Commit 4c41c69e changed the way the coroutine pool is sized because for
-virtio-blk devices with a large queue size and heavy I/O, it was just
-too small and caused coroutines to be deleted and reallocated soon
-afterwards. The change made the size dynamic based on the number of
-queues and the queue size of virtio-blk devices.
-
-There are two important numbers here: Slightly simplified, when a
-coroutine terminates, it is generally stored in the global release pool
-up to a certain pool size, and if the pool is full, it is freed.
-Conversely, when allocating a new coroutine, the coroutines in the
-release pool are reused if the pool already has reached a certain
-minimum size (the batch size), otherwise we allocate new coroutines.
-
-The problem after commit 4c41c69e is that it not only increases the
-maximum pool size (which is the intended effect), but also the batch
-size for reusing coroutines (which is a bug). It means that in cases
-with many devices and/or a large queue size (which defaults to the
-number of vcpus for virtio-blk-pci), many thousand coroutines could be
-sitting in the release pool without being reused.
-
-This is not only a waste of memory and allocations, but it actually
-makes the QEMU process likely to hit the vm.max_map_count limit on Linux
-because each coroutine requires two mappings (its stack and the guard
-page for the stack), causing it to abort() in qemu_alloc_stack() because
-when the limit is hit, mprotect() starts to fail with ENOMEM.
-
-In order to fix the problem, change the batch size back to 64 to avoid
-uselessly accumulating coroutines in the release pool, but keep the
-dynamic maximum pool size so that coroutines aren't freed too early
-in heavy I/O scenarios.
-
-Note that this fix doesn't strictly make it impossible to hit the limit,
-but this would only happen if most of the coroutines are actually in use
-at the same time, not just sitting in a pool. This is the same behaviour
-as we already had before commit 4c41c69e. Fully preventing this would
-require allowing qemu_coroutine_create() to return an error, but it
-doesn't seem to be a scenario that people hit in practice.
-
-Cc: qemu-stable@nongnu.org
-Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2079938
-Fixes: 4c41c69e05fe28c0f95f8abd2ebf407e95a4f04b
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Message-Id: <20220510151020.105528-3-kwolf@redhat.com>
-Tested-by: Hiroki Narukawa <hnarukaw@yahoo-corp.jp>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 9ec7a59b5aad4b736871c378d30f5ef5ec51cb52)
-
-Conflicts:
-	util/qemu-coroutine.c
-
-Trivial merge conflict because we don't have commit ac387a08 downstream.
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- util/qemu-coroutine.c | 22 ++++++++++++++--------
- 1 file changed, 14 insertions(+), 8 deletions(-)
-
-diff --git a/util/qemu-coroutine.c b/util/qemu-coroutine.c
-index faca0ca97c..804f672e0a 100644
---- a/util/qemu-coroutine.c
-+++ b/util/qemu-coroutine.c
-@@ -20,14 +20,20 @@
- #include "qemu/coroutine_int.h"
- #include "block/aio.h"
- 
--/** Initial batch size is 64, and is increased on demand */
-+/**
-+ * The minimal batch size is always 64, coroutines from the release_pool are
-+ * reused as soon as there are 64 coroutines in it. The maximum pool size starts
-+ * with 64 and is increased on demand so that coroutines are not deleted even if
-+ * they are not immediately reused.
-+ */
- enum {
--    POOL_INITIAL_BATCH_SIZE = 64,
-+    POOL_MIN_BATCH_SIZE = 64,
-+    POOL_INITIAL_MAX_SIZE = 64,
- };
- 
- /** Free list to speed up creation */
- static QSLIST_HEAD(, Coroutine) release_pool = QSLIST_HEAD_INITIALIZER(pool);
--static unsigned int pool_batch_size = POOL_INITIAL_BATCH_SIZE;
-+static unsigned int pool_max_size = POOL_INITIAL_MAX_SIZE;
- static unsigned int release_pool_size;
- static __thread QSLIST_HEAD(, Coroutine) alloc_pool = QSLIST_HEAD_INITIALIZER(pool);
- static __thread unsigned int alloc_pool_size;
-@@ -51,7 +57,7 @@ Coroutine *qemu_coroutine_create(CoroutineEntry *entry, void *opaque)
-     if (CONFIG_COROUTINE_POOL) {
-         co = QSLIST_FIRST(&alloc_pool);
-         if (!co) {
--            if (release_pool_size > qatomic_read(&pool_batch_size)) {
-+            if (release_pool_size > POOL_MIN_BATCH_SIZE) {
-                 /* Slow path; a good place to register the destructor, too.  */
-                 if (!coroutine_pool_cleanup_notifier.notify) {
-                     coroutine_pool_cleanup_notifier.notify = coroutine_pool_cleanup;
-@@ -88,12 +94,12 @@ static void coroutine_delete(Coroutine *co)
-     co->caller = NULL;
- 
-     if (CONFIG_COROUTINE_POOL) {
--        if (release_pool_size < qatomic_read(&pool_batch_size) * 2) {
-+        if (release_pool_size < qatomic_read(&pool_max_size) * 2) {
-             QSLIST_INSERT_HEAD_ATOMIC(&release_pool, co, pool_next);
-             qatomic_inc(&release_pool_size);
-             return;
-         }
--        if (alloc_pool_size < qatomic_read(&pool_batch_size)) {
-+        if (alloc_pool_size < qatomic_read(&pool_max_size)) {
-             QSLIST_INSERT_HEAD(&alloc_pool, co, pool_next);
-             alloc_pool_size++;
-             return;
-@@ -207,10 +213,10 @@ AioContext *coroutine_fn qemu_coroutine_get_aio_context(Coroutine *co)
- 
- void qemu_coroutine_inc_pool_size(unsigned int additional_pool_size)
- {
--    qatomic_add(&pool_batch_size, additional_pool_size);
-+    qatomic_add(&pool_max_size, additional_pool_size);
- }
- 
- void qemu_coroutine_dec_pool_size(unsigned int removing_pool_size)
- {
--    qatomic_sub(&pool_batch_size, removing_pool_size);
-+    qatomic_sub(&pool_max_size, removing_pool_size);
- }
--- 
-2.31.1
-

SOURCES/kvm-coroutine-ucontext-use-QEMU_DEFINE_STATIC_CO_TLS.patch

@@ -1,132 +0,0 @@
-From ffbd90e5f4eba620c7cd631b04f0ed31beb22ffa Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Tue, 17 May 2022 12:07:56 +0100
-Subject: [PATCH 1/6] coroutine-ucontext: use QEMU_DEFINE_STATIC_CO_TLS()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 89: coroutine: use coroutine TLS macros to protect thread-local variables
-RH-Commit: [1/3] a9782fe8e919c4bd317b7e8744c7ff57d898add3 (stefanha/centos-stream-qemu-kvm)
-RH-Bugzilla: 1952483
-RH-Acked-by: Hanna Reitz <hreitz@redhat.com>
-RH-Acked-by: Eric Blake <eblake@redhat.com>
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-
-Thread-Local Storage variables cannot be used directly from coroutine
-code because the compiler may optimize TLS variable accesses across
-qemu_coroutine_yield() calls. When the coroutine is re-entered from
-another thread the TLS variables from the old thread must no longer be
-used.
-
-Use QEMU_DEFINE_STATIC_CO_TLS() for the current and leader variables.
-
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-Id: <20220307153853.602859-2-stefanha@redhat.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 34145a307d849d0b6734d0222a7aa0bb9eef7407)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- util/coroutine-ucontext.c | 38 ++++++++++++++++++++++++--------------
- 1 file changed, 24 insertions(+), 14 deletions(-)
-
-diff --git a/util/coroutine-ucontext.c b/util/coroutine-ucontext.c
-index 904b375192..127d5a13c8 100644
---- a/util/coroutine-ucontext.c
-+++ b/util/coroutine-ucontext.c
-@@ -25,6 +25,7 @@
- #include "qemu/osdep.h"
- #include <ucontext.h>
- #include "qemu/coroutine_int.h"
-+#include "qemu/coroutine-tls.h"
- 
- #ifdef CONFIG_VALGRIND_H
- #include <valgrind/valgrind.h>
-@@ -66,8 +67,8 @@ typedef struct {
- /**
-  * Per-thread coroutine bookkeeping
-  */
--static __thread CoroutineUContext leader;
--static __thread Coroutine *current;
-+QEMU_DEFINE_STATIC_CO_TLS(Coroutine *, current);
-+QEMU_DEFINE_STATIC_CO_TLS(CoroutineUContext, leader);
- 
- /*
-  * va_args to makecontext() must be type 'int', so passing
-@@ -97,14 +98,15 @@ static inline __attribute__((always_inline))
- void finish_switch_fiber(void *fake_stack_save)
- {
- #ifdef CONFIG_ASAN
-+    CoroutineUContext *leaderp = get_ptr_leader();
-     const void *bottom_old;
-     size_t size_old;
- 
-     __sanitizer_finish_switch_fiber(fake_stack_save, &bottom_old, &size_old);
- 
--    if (!leader.stack) {
--        leader.stack = (void *)bottom_old;
--        leader.stack_size = size_old;
-+    if (!leaderp->stack) {
-+        leaderp->stack = (void *)bottom_old;
-+        leaderp->stack_size = size_old;
-     }
- #endif
- #ifdef CONFIG_TSAN
-@@ -161,8 +163,10 @@ static void coroutine_trampoline(int i0, int i1)
- 
-     /* Initialize longjmp environment and switch back the caller */
-     if (!sigsetjmp(self->env, 0)) {
--        start_switch_fiber_asan(COROUTINE_YIELD, &fake_stack_save, leader.stack,
--                                leader.stack_size);
-+        CoroutineUContext *leaderp = get_ptr_leader();
-+
-+        start_switch_fiber_asan(COROUTINE_YIELD, &fake_stack_save,
-+                                leaderp->stack, leaderp->stack_size);
-         start_switch_fiber_tsan(&fake_stack_save, self, true); /* true=caller */
-         siglongjmp(*(sigjmp_buf *)co->entry_arg, 1);
-     }
-@@ -297,7 +301,7 @@ qemu_coroutine_switch(Coroutine *from_, Coroutine *to_,
-     int ret;
-     void *fake_stack_save = NULL;
- 
--    current = to_;
-+    set_current(to_);
- 
-     ret = sigsetjmp(from->env, 0);
-     if (ret == 0) {
-@@ -315,18 +319,24 @@ qemu_coroutine_switch(Coroutine *from_, Coroutine *to_,
- 
- Coroutine *qemu_coroutine_self(void)
- {
--    if (!current) {
--        current = &leader.base;
-+    Coroutine *self = get_current();
-+    CoroutineUContext *leaderp = get_ptr_leader();
-+
-+    if (!self) {
-+        self = &leaderp->base;
-+        set_current(self);
-     }
- #ifdef CONFIG_TSAN
--    if (!leader.tsan_co_fiber) {
--        leader.tsan_co_fiber = __tsan_get_current_fiber();
-+    if (!leaderp->tsan_co_fiber) {
-+        leaderp->tsan_co_fiber = __tsan_get_current_fiber();
-     }
- #endif
--    return current;
-+    return self;
- }
- 
- bool qemu_in_coroutine(void)
- {
--    return current && current->caller;
-+    Coroutine *self = get_current();
-+
-+    return self && self->caller;
- }
--- 
-2.31.1
-

SOURCES/kvm-coroutine-use-QEMU_DEFINE_STATIC_CO_TLS.patch

@@ -1,139 +0,0 @@
-From 9c2e55d25fec6ffb21e344513b7dbeed7e21f641 Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Tue, 17 May 2022 12:08:04 +0100
-Subject: [PATCH 2/6] coroutine: use QEMU_DEFINE_STATIC_CO_TLS()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 89: coroutine: use coroutine TLS macros to protect thread-local variables
-RH-Commit: [2/3] 68a8847e406e2eace6ddc31b0c5676a60600d606 (stefanha/centos-stream-qemu-kvm)
-RH-Bugzilla: 1952483
-RH-Acked-by: Hanna Reitz <hreitz@redhat.com>
-RH-Acked-by: Eric Blake <eblake@redhat.com>
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-
-Thread-Local Storage variables cannot be used directly from coroutine
-code because the compiler may optimize TLS variable accesses across
-qemu_coroutine_yield() calls. When the coroutine is re-entered from
-another thread the TLS variables from the old thread must no longer be
-used.
-
-Use QEMU_DEFINE_STATIC_CO_TLS() for the current and leader variables.
-The alloc_pool QSLIST needs a typedef so the return value of
-get_ptr_alloc_pool() can be stored in a local variable.
-
-One example of why this code is necessary: a coroutine that yields
-before calling qemu_coroutine_create() to create another coroutine is
-affected by the TLS issue.
-
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-Id: <20220307153853.602859-3-stefanha@redhat.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit ac387a08a9c9f6b36757da912f0339c25f421f90)
-
-Conflicts:
-- Context conflicts due to commit 5411171c3ef4 ("coroutine: Revert to
-  constant batch size").
-
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- util/qemu-coroutine.c | 41 ++++++++++++++++++++++++-----------------
- 1 file changed, 24 insertions(+), 17 deletions(-)
-
-diff --git a/util/qemu-coroutine.c b/util/qemu-coroutine.c
-index 804f672e0a..4a8bd63ef0 100644
---- a/util/qemu-coroutine.c
-+++ b/util/qemu-coroutine.c
-@@ -18,6 +18,7 @@
- #include "qemu/atomic.h"
- #include "qemu/coroutine.h"
- #include "qemu/coroutine_int.h"
-+#include "qemu/coroutine-tls.h"
- #include "block/aio.h"
- 
- /**
-@@ -35,17 +36,20 @@ enum {
- static QSLIST_HEAD(, Coroutine) release_pool = QSLIST_HEAD_INITIALIZER(pool);
- static unsigned int pool_max_size = POOL_INITIAL_MAX_SIZE;
- static unsigned int release_pool_size;
--static __thread QSLIST_HEAD(, Coroutine) alloc_pool = QSLIST_HEAD_INITIALIZER(pool);
--static __thread unsigned int alloc_pool_size;
--static __thread Notifier coroutine_pool_cleanup_notifier;
-+
-+typedef QSLIST_HEAD(, Coroutine) CoroutineQSList;
-+QEMU_DEFINE_STATIC_CO_TLS(CoroutineQSList, alloc_pool);
-+QEMU_DEFINE_STATIC_CO_TLS(unsigned int, alloc_pool_size);
-+QEMU_DEFINE_STATIC_CO_TLS(Notifier, coroutine_pool_cleanup_notifier);
- 
- static void coroutine_pool_cleanup(Notifier *n, void *value)
- {
-     Coroutine *co;
-     Coroutine *tmp;
-+    CoroutineQSList *alloc_pool = get_ptr_alloc_pool();
- 
--    QSLIST_FOREACH_SAFE(co, &alloc_pool, pool_next, tmp) {
--        QSLIST_REMOVE_HEAD(&alloc_pool, pool_next);
-+    QSLIST_FOREACH_SAFE(co, alloc_pool, pool_next, tmp) {
-+        QSLIST_REMOVE_HEAD(alloc_pool, pool_next);
-         qemu_coroutine_delete(co);
-     }
- }
-@@ -55,27 +59,30 @@ Coroutine *qemu_coroutine_create(CoroutineEntry *entry, void *opaque)
-     Coroutine *co = NULL;
- 
-     if (CONFIG_COROUTINE_POOL) {
--        co = QSLIST_FIRST(&alloc_pool);
-+        CoroutineQSList *alloc_pool = get_ptr_alloc_pool();
-+
-+        co = QSLIST_FIRST(alloc_pool);
-         if (!co) {
-             if (release_pool_size > POOL_MIN_BATCH_SIZE) {
-                 /* Slow path; a good place to register the destructor, too.  */
--                if (!coroutine_pool_cleanup_notifier.notify) {
--                    coroutine_pool_cleanup_notifier.notify = coroutine_pool_cleanup;
--                    qemu_thread_atexit_add(&coroutine_pool_cleanup_notifier);
-+                Notifier *notifier = get_ptr_coroutine_pool_cleanup_notifier();
-+                if (!notifier->notify) {
-+                    notifier->notify = coroutine_pool_cleanup;
-+                    qemu_thread_atexit_add(notifier);
-                 }
- 
-                 /* This is not exact; there could be a little skew between
-                  * release_pool_size and the actual size of release_pool.  But
-                  * it is just a heuristic, it does not need to be perfect.
-                  */
--                alloc_pool_size = qatomic_xchg(&release_pool_size, 0);
--                QSLIST_MOVE_ATOMIC(&alloc_pool, &release_pool);
--                co = QSLIST_FIRST(&alloc_pool);
-+                set_alloc_pool_size(qatomic_xchg(&release_pool_size, 0));
-+                QSLIST_MOVE_ATOMIC(alloc_pool, &release_pool);
-+                co = QSLIST_FIRST(alloc_pool);
-             }
-         }
-         if (co) {
--            QSLIST_REMOVE_HEAD(&alloc_pool, pool_next);
--            alloc_pool_size--;
-+            QSLIST_REMOVE_HEAD(alloc_pool, pool_next);
-+            set_alloc_pool_size(get_alloc_pool_size() - 1);
-         }
-     }
- 
-@@ -99,9 +106,9 @@ static void coroutine_delete(Coroutine *co)
-             qatomic_inc(&release_pool_size);
-             return;
-         }
--        if (alloc_pool_size < qatomic_read(&pool_max_size)) {
--            QSLIST_INSERT_HEAD(&alloc_pool, co, pool_next);
--            alloc_pool_size++;
-+        if (get_alloc_pool_size() < qatomic_read(&pool_max_size)) {
-+            QSLIST_INSERT_HEAD(get_ptr_alloc_pool(), co, pool_next);
-+            set_alloc_pool_size(get_alloc_pool_size() + 1);
-             return;
-         }
-     }
--- 
-2.31.1
-