From 7bcbf342c20f5756fec85de12bb1a96f7299750e Mon Sep 17 00:00:00 2001
From: MSVSphere Packaging Team <packager@msvsphere-os.ru>
Date: Wed, 13 Nov 2024 16:17:58 +0300
Subject: [PATCH] import qemu-kvm-9.0.0-10.el9_5

---
 .gitignore                                    |    2 +-
 .qemu-kvm.metadata                            |    2 +-
 SOURCES/0004-Initial-redhat-build.patch       |   19 +-
 ...0005-Enable-disable-devices-for-RHEL.patch |  266 +-
 ...Machine-type-related-general-changes.patch |  166 +-
 SOURCES/0007-Add-aarch64-machine-types.patch  |  138 +-
 SOURCES/0008-Add-ppc64-machine-types.patch    |   50 +-
 SOURCES/0009-Add-s390x-machine-types.patch    |   20 +-
 SOURCES/0010-Add-x86_64-machine-types.patch   |  100 +-
 SOURCES/0011-Enable-make-check.patch          |   20 +-
 ...mber-of-devices-that-can-be-assigned.patch |   19 +-
 ...Add-support-statement-to-help-output.patch |    8 +-
 ...documentation-instead-of-qemu-system.patch |    6 +-
 ...on-warning-when-opening-v2-images-rw.patch |    4 +-
 ...0016-Add-upstream-compatibility-bits.patch |  121 +
 ....4.0-qemu-kvm-machine-type-for-aarch.patch |   44 -
 ...6-rhel-9.4.0-machine-type-compat-fix.patch |   30 +
 ...vm-Compile-IOMMUFD-object-on-aarch64.patch |   37 -
 SOURCES/kvm-Compile-IOMMUFD-on-s390x.patch    |   37 -
 SOURCES/kvm-Compile-IOMMUFD-on-x86_64.patch   |   37 -
 ...canout-version-with-pc-q35-rhel9.4.0.patch |  128 -
 ...anism-to-opt-in-kvm-guest-memfd-via-.patch |  139 +
 .../kvm-Implement-SMBIOS-type-9-v2.6.patch    |  155 -
 ...ent-base-of-SMBIOS-type-9-descriptor.patch |  218 -
 ...ve-kvm_arch_cpu_check_are_resettable.patch |  203 +
 ...ack-whether-guest-state-is-encrypted.patch |  127 +
 ...d-support-of-KVM-private-guest-memfd.patch |  329 ++
 ...est_memfd-require-uncoordinated-disc.patch |   82 +
 ...har-socket-Fix-TLS-io-channels-sendi.patch |   60 -
 ...se-a-child-source-for-qio-input-sour.patch |  216 -
 ...t-monitor-use-aio_co_reschedule_self.patch |   67 +
 ...6-rhel-9.4.0-machine-type-compat-fix.patch |   38 +
 ...text_acquire-aio_context_release-a-n.patch |   60 -
 ...ontext_acquire-aio_context_release-A.patch |  102 -
 ...uivalence-between-AIO_WAIT_WHILE-and.patch |   81 -
 ...n-about-iohandler_ctx-special-casing.patch |   64 +
 ...iommufd-Introduce-the-iommufd-object.patch |  476 --
 ...-Remove-check-on-number-of-backend-u.patch |   47 -
 .../kvm-backends-iommufd-Remove-mutex.patch   |  112 -
 ...names-only-when-explicitly-requested.patch |  104 +-
 ...end-Allow-concurrent-context-changes.patch |  104 -
 ...wrapper-use-qemu_get_current_aio_con.patch |   69 -
 ...lock-crypto-create-ciphers-on-demand.patch |  330 ++
 ...-set-up-Linux-AIO-and-io_uring-in-th.patch |  217 -
 .../kvm-block-remove-AioContext-locking.patch | 4438 -----------------
 SOURCES/kvm-block-remove-bdrv_co_lock.patch   |   97 -
 ...outdated-AioContext-locking-comments.patch |  411 --
 ...ket-Fix-TLS-io-channels-sending-too-.patch |  105 -
 ...iority-of-the-HUP-GSource-in-socket-.patch |   78 -
 ...st-support-Add-kvm_init-and-kvm_rese.patch |   90 +
 ...utine-cap-per-thread-local-pool-size.patch |  412 --
 ...kvm-coroutine-reserve-5-000-mappings.patch |   61 -
 ...p-qcrypto_block_open-n_threads-argum.patch |  228 +
 ...-don-t-lock-AioContext-in-dma_blk_cb.patch |   75 -
 ...d-VFIO-iommufd-backend-documentation.patch |  228 -
 ...e-AioContext-lock-from-IOThread-docs.patch |   98 -
 ...graph-lock-remove-AioContext-locking.patch | 1190 -----
 ...et_min_alignment-to-express-32-GiB-a.patch |   94 -
 ...m-Activate-IOMMUFD-for-virt-machines.patch |   42 -
 ...properties-to-disable-high-memory-re.patch |   88 -
 ...d-unexpected-warning-from-Linux-gues.patch |  120 +
 SOURCES/kvm-hw-arm-virt-Fix-compats.patch     |  132 -
 ...spurious-call-to-arm_virt_compat_set.patch |   59 +
 ...ecate-virt-rhel9.-0-2-.0-machine-typ.patch |   41 -
 ...86-Activate-IOMMUFD-for-q35-machines.patch |   41 -
 ...ort-for-loading-BIOS-using-guest_mem.patch |   73 +
 ..._bios_rom_init-take-X86MachineState-.patch |  106 +
 ...-PCAT_COMPAT-bit-only-when-pic-is-no.patch |   51 +
 ...-smbios_set_defaults-to-machine_done.patch |  186 -
 ...-Alias-rather-than-copy-isa-bios-reg.patch |  164 +
 ...-Remove-unused-parameter-from-pc_isa.patch |   53 +
 ...function-to-get-SEV-metadata-from-OV.patch |  158 +
 ...support-to-encrypt-BIOS-when-SEV-SNP.patch |  165 +
 ...-sev-Use-guest_memfd-for-legacy-ROMs.patch |  123 +
 ...legacy-SEV-VM-types-for-older-machin.patch |   58 +
 ...w-i386-split-x86.c-in-multiple-parts.patch | 2301 +++++++++
 ...6-Don-t-leak-isa-bios-memory-regions.patch |  133 +
 ...x86-Don-t-leak-pc.bios-memory-region.patch |  105 +
 ...inate-two-if-statements-in-x86_bios_.patch |   69 +
 ...act-x86_isa_bios_init-from-x86_bios_.patch |   98 +
 .../kvm-hw-ppc-Kconfig-Imply-VFIO_PCI.patch   |  116 -
 ...teration-over-global-VFIODevice-list.patch |   73 -
 ...e-de-initialization-of-vhost-user-de.patch |  108 +
 ...elect-code-in-hw-i386-that-depends-o.patch |   68 +
 ...t-SEV-SNP-CPUID-bit-when-SNP-enabled.patch |   40 +
 ..._EXIT_HYPERCALL-handling-for-KVM_HC_.patch |  145 +
 ...chitectural-CPUID-leaf-generation-to.patch |  536 ++
 ...e-unnecessary-MachineClass-overrides.patch |   91 +
 ...lass-method-to-determine-KVM-VM-type.patch |  116 +
 ...386-sev-Add-a-sev_snp_enabled-helper.patch |   84 +
 ...dling-to-encrypt-finalize-guest-laun.patch |  187 +
 ...acy-vm-type-parameter-for-SEV-guest-.patch |  127 +
 ...-sev_kvm_init-override-for-SEV-class.patch |  203 +
 ...-snp_kvm_init-override-for-SNP-class.patch |   94 +
 ...Add-support-for-SNP-CPUID-validation.patch |  262 +
 ...port-for-populating-OVMF-metadata-pa.patch |  127 +
 ...sev-Add-the-SNP-launch-start-context.patch |  122 +
 ...w-measured-direct-kernel-boot-on-SNP.patch |  237 +
 ...llow-automatic-fallback-to-legacy-KV.patch |  268 +
 ...eturn-launch-measurements-for-SEV-SN.patch |   46 +
 ...KVM_HC_MAP_GPA_RANGE-hcall-for-SNP-g.patch |   54 +
 ...v-Extract-build_kernel_loader_hashes.patch |  167 +
 ...k-to-the-default-SEV-device-if-none-.patch |   65 +
 ...rror-message-in-sev_get_capabilities.patch |   48 +
 ...ce-sev-common-type-to-encapsulate-co.patch | 1118 +++++
 ...6-sev-Introduce-sev-snp-guest-object.patch |  530 ++
 ...oke-launch_updata_data-for-SEV-class.patch |   85 +
 ...oke-launch_updata_data-for-SNP-class.patch |   55 +
 ...V_COMMON-null-check-before-dereferen.patch |   47 +
 ...v_launch_finish-to-separate-class-me.patch |   88 +
 ...v_launch_update-to-separate-class-me.patch |   91 +
 ...i386-sev-Reorder-struct-declarations.patch |  134 +
 ...Replace-error_report-with-error_setg.patch |   46 +
 ...6-sev-Return-when-sev_common-is-null.patch |   40 +
 ...-state-to-protected-once-SNP-guest-p.patch |   47 +
 ...h-to-use-confidential_guest_kvm_init.patch |  268 +
 ...query-sev-QAPI-format-to-handle-SEV-.patch |  240 +
 ...-fix-unreachable-code-coverity-issue.patch |   51 +
 ....h-fix-qemu_rect_init-mis-assignment.patch |   54 -
 .../kvm-introduce-pc_rhel_9_5_compat.patch    |   81 +
 ...t-store-data-file-with-protocol-in-i.patch |   46 +-
 ...t-store-data-file-with-json-prefix-i.patch |   42 +-
 ...-for-reset-AioContext-switches-with-.patch |  133 -
 ...ts-add-filter_qmp_generated_node_ids.patch |   49 -
 ...ds-stream-Use-the-right-TimeoutError.patch |   49 -
 ...1-to-Python-for-reliable-QMP-testing.patch |  592 ---
 .../kvm-iotests-test-NBD-TLS-iothread.patch   |   14 +-
 ...outdated-AioContext-locking-comments.patch |  105 -
 ...-Activate-IOMMUFD-for-s390x-machines.patch |   42 -
 ..._SET_USER_MEMORY_REGION2-for-memslot.patch |  153 +
 ...roduce-support-for-memory_attributes.patch |  103 +
 ...-add-support-for-guest-physical-bits.patch |  116 +
 ...-kvm_irqchip_add_msi_route-in-case-o.patch |   76 -
 ...kvm-kvm-handle-KVM_EXIT_MEMORY_FAULT.patch |  194 +
 ...memory-type-private-by-default-if-it.patch |   56 +
 ...mplain-when-converting-vMMIO-region-.patch |   61 +
 ...emory-conversion-to-shared-of-unassi.patch |   62 +
 ...io-add-IO_CMD_FDSYNC-command-support.patch |   17 +-
 ...x-headers-Update-to-current-kvm-next.patch |  189 +
 ...x-headers-update-to-current-kvm-next.patch | 2471 +++++++++
 ...rly-use-of-machine_require_guest_mem.patch |   71 +
 ...e-memory_region_init_ram_guest_memfd.patch |   85 +
 ...reintroduce-memory-region-size-check.patch |  112 -
 ...all-job_pause_point-under-graph-lock.patch |   90 -
 ...-coroutine-commands-in-qemu_aio_cont.patch | 1630 ------
 ...024-7409-Avoid-use-after-free-when-c.patch |  101 +
 ...024-7409-Cap-default-max-connections.patch |   22 +-
 ...024-7409-Close-stray-clients-at-serv.patch |   12 +-
 ...024-7409-Drop-non-negotiating-client.patch |   13 +-
 ...rver-Fix-race-in-draining-the-export.patch |   95 -
 ...negotiation-functions-as-coroutine_f.patch |   15 +-
 ...-Plumb-in-new-args-to-nbd_client_add.patch |   16 +-
 ...id-per-NBDRequest-nbd_client_get-put.patch |   53 -
 ...-not-poll-within-a-coroutine-context.patch |   15 +-
 ...duce-NBDClient-lock-to-protect-field.patch |  373 --
 ...traverse-NBDExport-clients-from-main.patch |  176 -
 ...S-entry-point-type-to-auto-by-defaul.patch |  115 -
 ...manufacturer-product-version-to-matc.patch |   44 -
 ...e-PAM-initialization-above-SMRAM-ini.patch |   68 +
 ...e-ram_block_discard_guest_memfd_rang.patch |   83 +
 ...o-use-confidential_guest_kvm_init-re.patch |  140 +
 ...smm_ranges-property-for-q35-pci-host.patch |  164 +
 ...n-t-open-data_file-with-BDRV_O_NO_IO.patch |   60 +-
 ...adVirtQueueMappingList-property-type.patch |  167 -
 ...es-alias-all-object-class-properties.patch |   85 -
 ...-Update-the-logfile-path-of-qga-fsfr.patch |   40 +
 ...-increase-NOFILE-soft-limit-on-POSIX.patch |  135 -
 ...erit-follow_coroutine_ctx-across-TLS.patch |   16 +-
 ...ne-type-compat-for-virtio-gpu-migrat.patch |   28 +-
 ...itial-CPU-reset-if-reset-is-not-actu.patch |   67 +
 ...h-to-use-confidential_guest_kvm_init.patch |  109 +
 ...i-avoid-double-enable-disable-of-aif.patch |  106 -
 ...drive-ISM-reset-from-subsystem-reset.patch |  137 -
 ...-pci-refresh-fh-before-disabling-aif.patch |   71 -
 ...inux-header.sh-be-more-src-tree-frie.patch |  186 +
 ...inux-headers-Add-bits.h-to-file-impo.patch |   38 +
 ...inux-headers-Add-setup_data.h-to-imp.patch |   83 +
 ...inux-headers.sh-Fix-the-path-of-setu.patch |   47 +
 ...inux-headers.sh-Remove-temporary-dir.patch |   44 +
 SOURCES/kvm-scsi-Await-request-purging.patch  |  124 -
 ...-callbacks-run-in-the-correct-AioCon.patch |   88 -
 ...-skip-callback-for-sgio-error-status.patch |   60 +
 ...rning-comments-that-host_status-erro.patch |   79 +
 ...-report-RESERVATION_CONFLICT-to-gues.patch |  106 +
 ...sitive-return-value-for-status-in-dm.patch |  125 +
 ...n-t-lock-AioContext-in-I-O-code-path.patch |  245 -
 ...-SCSIDevice-requests-from-one-thread.patch |  307 --
 .../kvm-scsi-remove-AioContext-locking.patch  |  280 --
 ...ove-outdated-AioContext-lock-comment.patch |   41 -
 ...-add-smbios_add_usr_blob_size-helper.patch |   62 -
 ...-avoid-mangling-user-provided-tables.patch |  309 --
 ...legacy-mode-code-only-for-pc-machine.patch |  517 --
 ...mbios_get_tables-from-legacy-handlin.patch |   65 -
 ...ios_type4_count-before-building-tabl.patch |   38 -
 ...heck-type4-structures-in-legacy-mode.patch |  133 -
 ...-when-building-type-4-table-is-not-p.patch |   72 -
 ...bios-entry-point-type-with-auto-valu.patch |   48 -
 ...ios-get-rid-of-global-smbios_ep_type.patch |  281 --
 ...bios-get-rid-of-smbios_legacy-global.patch |  198 -
 ...get-rid-of-smbios_smp_sockets-global.patch |  134 -
 ...vm-smbios-handle-errors-consistently.patch |  217 -
 ...f-entry-point-is-auto-try-to-build-v.patch |  131 -
 ...pose-structures-bitmaps-used-by-both.patch |  330 --
 ...t-visitor-Fix-pseudo-struct-handling.patch |  190 -
 ...tput-visitor-show-structs-as-omitted.patch |   90 -
 ...-i386-Add-new-CPU-model-SierraForest.patch |  215 +
 ...arget-i386-Export-RFDS-bit-to-guests.patch |   50 +
 ...Implement-mc-kvm_type-to-get-VM-type.patch |  192 +
 ...oduce-Icelake-Server-v7-to-enable-TS.patch |   68 +
 ...fix-formatting-of-CPUID-mismatch-mes.patch |   49 +
 ...fix-mismatch-in-vcek-disabled-proper.patch |   42 +
 ...86-SEV-use-KVM_SEV_INIT2-if-possible.patch |  146 +
 ...386-add-guest-phys-bits-cpu-property.patch |  124 +
 ...386-introduce-x86-confidential-guest.patch |  161 +
 ...-pv-Provide-some-more-useful-informa.patch |  205 -
 ...sts-remove-aio_context_acquire-tests.patch |  125 -
 ...test-replication-timeout-to-60-secon.patch |   46 -
 ...address-space-and-slot-id-in-trace_k.patch |   59 +
 ...d-add-asserts-for-update-and-request.patch |   81 -
 ...k-type-as-not-available-when-there-i.patch |  107 -
 ...ders-fix-forwarding-to-asm-generic-h.patch |   62 +
 ...aders-import-linux-kvm_para.h-header.patch |  175 +
 ...ders-move-pvpanic.h-to-correct-direc.patch |   95 +
 SOURCES/kvm-util-char_dev-Add-open_cdev.patch |  175 -
 ...-helper-function-to-initialize-VFIOD.patch |  154 -
 ...ase-object-for-VFIOContainer-and-tar.patch |  129 -
 ...ntainerBase-poiner-parameter-const-i.patch |  276 -
 ...e-selection-of-a-given-iommu-backend.patch |   75 -
 ...o-cdev-pre-openable-by-passing-a-fil.patch |   87 -
 ...ODevice-initializations-in-vfio_ap_i.patch |   81 -
 ...he-selection-of-a-given-iommu-backen.patch |   79 -
 ...io-cdev-pre-openable-by-passing-a-fi.patch |   93 -
 ...IODevice-initializations-in-vfio_ccw.patch |   85 -
 ...oduce-vfio_container_init-destroy-he.patch |   98 -
 ...n-Move-giommu_list-in-base-container.patch |  221 -
 ...on-return-early-if-space-isn-t-empty.patch |   55 -
 ...-Convert-functions-to-base-container.patch |  257 -
 ...ainer-Implement-attach-detach_device.patch |   97 -
 ...nitialize-VFIOIOMMUOps-under-vfio_in.patch |   65 -
 ...ntoduce-a-new-VFIOIOMMUClass-setup-h.patch |   55 -
 ...-Introduce-a-VFIOIOMMU-QOM-interface.patch |  143 -
 ...ntroduce-a-VFIOIOMMU-legacy-QOM-inte.patch |  168 -
 ...ainer-Introduce-a-empty-VFIOIOMMUOps.patch |   71 -
 ...ntroduce-vfio_legacy_setup-for-furth.patch |  118 -
 ...ove-dirty_pgsizes-and-max_dirty_bitm.patch |  102 -
 ...r-Move-iova_ranges-to-base-container.patch |  168 -
 ...iner-Move-listener-to-base-container.patch |  522 --
 ...ove-per-container-device-list-in-bas.patch |  230 -
 ...ove-pgsizes-and-dma_max_mappings-to-.patch |  242 -
 ...r-Move-space-field-to-base-container.patch |  265 -
 ...ner-Move-vrdl_list-to-base-container.patch |  255 -
 ...ename-vfio_init_container-to-vfio_se.patch |   66 -
 ...eplace-basename-with-g_path_get_base.patch |   59 -
 ...witch-to-IOMMU-BE-set_dirty_page_tra.patch |  235 -
 ...ontainer-Switch-to-dma_map-unmap-API.patch |  303 --
 ...-support-for-iova_ranges-and-pgsizes.patch |  115 -
 ...ble-pci-hot-reset-through-iommufd-cd.patch |  215 -
 ...ommufd-Implement-the-iommufd-backend.patch |  561 ---
 ...roduce-a-VFIOIOMMU-iommufd-QOM-inter.patch |  155 -
 ...lax-assert-check-for-iommufd-backend.patch |   71 -
 ...-iommufd-Remove-CONFIG_IOMMUFD-usage.patch |   55 -
 ...ove-the-use-of-stat-to-check-file-ex.patch |   56 -
 ...dd-helper-function-to-set-state-or-r.patch |  115 -
 ...he-selection-of-a-given-iommu-backen.patch |   81 -
 ...fio-pci-Clear-MSI-X-IRQ-index-always.patch |   69 -
 ...-out-a-helper-vfio_pci_get_pci_hot_r.patch |  139 -
 ...oduce-a-vfio-pci-hot-reset-interface.patch |  466 --
 ...io-cdev-pre-openable-by-passing-a-fi.patch |  237 -
 ...IODevice-initializations-in-vfio_ins.patch |   70 -
 ...low-the-selection-of-a-given-iommu-b.patch |   77 -
 ...ke-vfio-cdev-pre-openable-by-passing.patch |  108 -
 ...ve-VFIODevice-initializations-in-vfi.patch |   64 -
 ...d-VFIOIOMMUOps-with-a-release-handle.patch |  129 -
 ...duce-a-sPAPR-VFIOIOMMU-QOM-interface.patch |  150 -
 ...duce-spapr-backend-and-target-interf.patch |   91 -
 ...ve-hostwin_list-into-spapr-container.patch |  188 -
 ...prereg_listener-into-spapr-container.patch |  120 -
 ...compile-sPAPR-IOMMU-support-when-nee.patch |   46 -
 ...h-to-spapr-IOMMU-BE-add-del_section_.patch |  184 -
 ...-Re-enable-notifications-after-drain.patch |  139 -
 ...otential-nullpointer-read-access-in-.patch |   47 -
 ...-ioeventfd_attach-in-start_ioeventfd.patch |   75 -
 ...lk-add-iothread-vq-mapping-parameter.patch |  464 --
 ...-virtio-blk-add-lock-to-protect-s-rq.patch |  177 -
 ...-always-set-ioeventfd-during-startup.patch |   63 -
 ...-using-ioeventfd-state-in-irqfd-cond.patch |   72 -
 ...-lock-AioContext-in-the-completion-c.patch |  167 -
 ...-lock-AioContext-in-the-submission-c.patch |   67 -
 ...ove-dataplane-code-into-virtio-blk.c.patch | 1009 ----
 ...e-dataplane-create-destroy-functions.patch |  117 -
 ...io-blk-rename-dataplane-to-ioeventfd.patch |  307 --
 ...-restart-s-rq-reqs-in-vq-AioContexts.patch |  106 -
 ...ate-failure-to-set-BlockBackend-AioC.patch |   72 -
 ...lock-migration-of-VMs-with-blob-true.patch |   87 -
 ...-gpu-fix-scanout-migration-post-load.patch |  196 -
 SOURCES/kvm-virtio-gpu-fix-v2-migration.patch |   36 +-
 ...-mem-default-enable-dynamic-memslots.patch |   70 -
 ...tio-pci-fix-use-of-a-released-vector.patch |  162 -
 .../kvm-virtio-rng-block-max-bytes-0.patch    |   49 +
 ...ttach-event-vq-notifier-with-no_poll.patch |   78 -
 ...t-lock-AioContext-around-virtio_queu.patch |   58 -
 ...ace-AioContext-lock-with-tmf_bh_lock.patch |  173 -
 ...6-rhel-9.2.0-machine-type-compat-fix.patch |   48 -
 SPECS/qemu-kvm.spec                           |  942 ++--
 304 files changed, 19481 insertions(+), 32629 deletions(-)
 create mode 100644 SOURCES/0016-Add-upstream-compatibility-bits.patch
 delete mode 100644 SOURCES/0016-Introduce-RHEL-9.4.0-qemu-kvm-machine-type-for-aarch.patch
 create mode 100644 SOURCES/0017-x86-rhel-9.4.0-machine-type-compat-fix.patch
 delete mode 100644 SOURCES/kvm-Compile-IOMMUFD-object-on-aarch64.patch
 delete mode 100644 SOURCES/kvm-Compile-IOMMUFD-on-s390x.patch
 delete mode 100644 SOURCES/kvm-Compile-IOMMUFD-on-x86_64.patch
 delete mode 100644 SOURCES/kvm-Fix-scanout-version-with-pc-q35-rhel9.4.0.patch
 create mode 100644 SOURCES/kvm-HostMem-Add-mechanism-to-opt-in-kvm-guest-memfd-via-.patch
 delete mode 100644 SOURCES/kvm-Implement-SMBIOS-type-9-v2.6.patch
 delete mode 100644 SOURCES/kvm-Implement-base-of-SMBIOS-type-9-descriptor.patch
 create mode 100644 SOURCES/kvm-KVM-remove-kvm_arch_cpu_check_are_resettable.patch
 create mode 100644 SOURCES/kvm-KVM-track-whether-guest-state-is-encrypted.patch
 create mode 100644 SOURCES/kvm-RAMBlock-Add-support-of-KVM-private-guest-memfd.patch
 create mode 100644 SOURCES/kvm-RAMBlock-make-guest_memfd-require-uncoordinated-disc.patch
 delete mode 100644 SOURCES/kvm-Revert-chardev-char-socket-Fix-TLS-io-channels-sendi.patch
 delete mode 100644 SOURCES/kvm-Revert-chardev-use-a-child-source-for-qio-input-sour.patch
 create mode 100644 SOURCES/kvm-Revert-monitor-use-aio_co_reschedule_self.patch
 create mode 100644 SOURCES/kvm-Revert-x86-rhel-9.4.0-machine-type-compat-fix.patch
 delete mode 100644 SOURCES/kvm-aio-make-aio_context_acquire-aio_context_release-a-n.patch
 delete mode 100644 SOURCES/kvm-aio-remove-aio_context_acquire-aio_context_release-A.patch
 delete mode 100644 SOURCES/kvm-aio-wait-draw-equivalence-between-AIO_WAIT_WHILE-and.patch
 create mode 100644 SOURCES/kvm-aio-warn-about-iohandler_ctx-special-casing.patch
 delete mode 100644 SOURCES/kvm-backends-iommufd-Introduce-the-iommufd-object.patch
 delete mode 100644 SOURCES/kvm-backends-iommufd-Remove-check-on-number-of-backend-u.patch
 delete mode 100644 SOURCES/kvm-backends-iommufd-Remove-mutex.patch
 delete mode 100644 SOURCES/kvm-block-backend-Allow-concurrent-context-changes.patch
 delete mode 100644 SOURCES/kvm-block-coroutine-wrapper-use-qemu_get_current_aio_con.patch
 create mode 100644 SOURCES/kvm-block-crypto-create-ciphers-on-demand.patch
 delete mode 100644 SOURCES/kvm-block-file-posix-set-up-Linux-AIO-and-io_uring-in-th.patch
 delete mode 100644 SOURCES/kvm-block-remove-AioContext-locking.patch
 delete mode 100644 SOURCES/kvm-block-remove-bdrv_co_lock.patch
 delete mode 100644 SOURCES/kvm-block-remove-outdated-AioContext-locking-comments.patch
 delete mode 100644 SOURCES/kvm-chardev-char-socket-Fix-TLS-io-channels-sending-too-.patch
 delete mode 100644 SOURCES/kvm-chardev-lower-priority-of-the-HUP-GSource-in-socket-.patch
 create mode 100644 SOURCES/kvm-confidential-guest-support-Add-kvm_init-and-kvm_rese.patch
 delete mode 100644 SOURCES/kvm-coroutine-cap-per-thread-local-pool-size.patch
 delete mode 100644 SOURCES/kvm-coroutine-reserve-5-000-mappings.patch
 create mode 100644 SOURCES/kvm-crypto-block-drop-qcrypto_block_open-n_threads-argum.patch
 delete mode 100644 SOURCES/kvm-dma-helpers-don-t-lock-AioContext-in-dma_blk_cb.patch
 delete mode 100644 SOURCES/kvm-docs-devel-Add-VFIO-iommufd-backend-documentation.patch
 delete mode 100644 SOURCES/kvm-docs-remove-AioContext-lock-from-IOThread-docs.patch
 delete mode 100644 SOURCES/kvm-graph-lock-remove-AioContext-locking.patch
 delete mode 100644 SOURCES/kvm-hv-balloon-use-get_min_alignment-to-express-32-GiB-a.patch
 delete mode 100644 SOURCES/kvm-hw-arm-Activate-IOMMUFD-for-virt-machines.patch
 delete mode 100644 SOURCES/kvm-hw-arm-virt-Add-properties-to-disable-high-memory-re.patch
 create mode 100644 SOURCES/kvm-hw-arm-virt-Avoid-unexpected-warning-from-Linux-gues.patch
 delete mode 100644 SOURCES/kvm-hw-arm-virt-Fix-compats.patch
 create mode 100644 SOURCES/kvm-hw-arm-virt-Fix-spurious-call-to-arm_virt_compat_set.patch
 delete mode 100644 SOURCES/kvm-hw-arm-virt-deprecate-virt-rhel9.-0-2-.0-machine-typ.patch
 delete mode 100644 SOURCES/kvm-hw-i386-Activate-IOMMUFD-for-q35-machines.patch
 create mode 100644 SOURCES/kvm-hw-i386-Add-support-for-loading-BIOS-using-guest_mem.patch
 create mode 100644 SOURCES/kvm-hw-i386-Have-x86_bios_rom_init-take-X86MachineState-.patch
 create mode 100644 SOURCES/kvm-hw-i386-acpi-Set-PCAT_COMPAT-bit-only-when-pic-is-no.patch
 delete mode 100644 SOURCES/kvm-hw-i386-pc-Defer-smbios_set_defaults-to-machine_done.patch
 create mode 100644 SOURCES/kvm-hw-i386-pc_sysfw-Alias-rather-than-copy-isa-bios-reg.patch
 create mode 100644 SOURCES/kvm-hw-i386-pc_sysfw-Remove-unused-parameter-from-pc_isa.patch
 create mode 100644 SOURCES/kvm-hw-i386-sev-Add-function-to-get-SEV-metadata-from-OV.patch
 create mode 100644 SOURCES/kvm-hw-i386-sev-Add-support-to-encrypt-BIOS-when-SEV-SNP.patch
 create mode 100644 SOURCES/kvm-hw-i386-sev-Use-guest_memfd-for-legacy-ROMs.patch
 create mode 100644 SOURCES/kvm-hw-i386-sev-Use-legacy-SEV-VM-types-for-older-machin.patch
 create mode 100644 SOURCES/kvm-hw-i386-split-x86.c-in-multiple-parts.patch
 create mode 100644 SOURCES/kvm-hw-i386-x86-Don-t-leak-isa-bios-memory-regions.patch
 create mode 100644 SOURCES/kvm-hw-i386-x86-Don-t-leak-pc.bios-memory-region.patch
 create mode 100644 SOURCES/kvm-hw-i386-x86-Eliminate-two-if-statements-in-x86_bios_.patch
 create mode 100644 SOURCES/kvm-hw-i386-x86-Extract-x86_isa_bios_init-from-x86_bios_.patch
 delete mode 100644 SOURCES/kvm-hw-ppc-Kconfig-Imply-VFIO_PCI.patch
 delete mode 100644 SOURCES/kvm-hw-vfio-fix-iteration-over-global-VFIODevice-list.patch
 create mode 100644 SOURCES/kvm-hw-virtio-Fix-the-de-initialization-of-vhost-user-de.patch
 create mode 100644 SOURCES/kvm-i386-correctly-select-code-in-hw-i386-that-depends-o.patch
 create mode 100644 SOURCES/kvm-i386-cpu-Set-SEV-SNP-CPUID-bit-when-SNP-enabled.patch
 create mode 100644 SOURCES/kvm-i386-kvm-Add-KVM_EXIT_HYPERCALL-handling-for-KVM_HC_.patch
 create mode 100644 SOURCES/kvm-i386-kvm-Move-architectural-CPUID-leaf-generation-to.patch
 create mode 100644 SOURCES/kvm-i386-pc-remove-unnecessary-MachineClass-overrides.patch
 create mode 100644 SOURCES/kvm-i386-sev-Add-a-class-method-to-determine-KVM-VM-type.patch
 create mode 100644 SOURCES/kvm-i386-sev-Add-a-sev_snp_enabled-helper.patch
 create mode 100644 SOURCES/kvm-i386-sev-Add-handling-to-encrypt-finalize-guest-laun.patch
 create mode 100644 SOURCES/kvm-i386-sev-Add-legacy-vm-type-parameter-for-SEV-guest-.patch
 create mode 100644 SOURCES/kvm-i386-sev-Add-sev_kvm_init-override-for-SEV-class.patch
 create mode 100644 SOURCES/kvm-i386-sev-Add-snp_kvm_init-override-for-SNP-class.patch
 create mode 100644 SOURCES/kvm-i386-sev-Add-support-for-SNP-CPUID-validation.patch
 create mode 100644 SOURCES/kvm-i386-sev-Add-support-for-populating-OVMF-metadata-pa.patch
 create mode 100644 SOURCES/kvm-i386-sev-Add-the-SNP-launch-start-context.patch
 create mode 100644 SOURCES/kvm-i386-sev-Allow-measured-direct-kernel-boot-on-SNP.patch
 create mode 100644 SOURCES/kvm-i386-sev-Don-t-allow-automatic-fallback-to-legacy-KV.patch
 create mode 100644 SOURCES/kvm-i386-sev-Don-t-return-launch-measurements-for-SEV-SN.patch
 create mode 100644 SOURCES/kvm-i386-sev-Enable-KVM_HC_MAP_GPA_RANGE-hcall-for-SNP-g.patch
 create mode 100644 SOURCES/kvm-i386-sev-Extract-build_kernel_loader_hashes.patch
 create mode 100644 SOURCES/kvm-i386-sev-Fallback-to-the-default-SEV-device-if-none-.patch
 create mode 100644 SOURCES/kvm-i386-sev-Fix-error-message-in-sev_get_capabilities.patch
 create mode 100644 SOURCES/kvm-i386-sev-Introduce-sev-common-type-to-encapsulate-co.patch
 create mode 100644 SOURCES/kvm-i386-sev-Introduce-sev-snp-guest-object.patch
 create mode 100644 SOURCES/kvm-i386-sev-Invoke-launch_updata_data-for-SEV-class.patch
 create mode 100644 SOURCES/kvm-i386-sev-Invoke-launch_updata_data-for-SNP-class.patch
 create mode 100644 SOURCES/kvm-i386-sev-Move-SEV_COMMON-null-check-before-dereferen.patch
 create mode 100644 SOURCES/kvm-i386-sev-Move-sev_launch_finish-to-separate-class-me.patch
 create mode 100644 SOURCES/kvm-i386-sev-Move-sev_launch_update-to-separate-class-me.patch
 create mode 100644 SOURCES/kvm-i386-sev-Reorder-struct-declarations.patch
 create mode 100644 SOURCES/kvm-i386-sev-Replace-error_report-with-error_setg.patch
 create mode 100644 SOURCES/kvm-i386-sev-Return-when-sev_common-is-null.patch
 create mode 100644 SOURCES/kvm-i386-sev-Set-CPU-state-to-protected-once-SNP-guest-p.patch
 create mode 100644 SOURCES/kvm-i386-sev-Switch-to-use-confidential_guest_kvm_init.patch
 create mode 100644 SOURCES/kvm-i386-sev-Update-query-sev-QAPI-format-to-handle-SEV-.patch
 create mode 100644 SOURCES/kvm-i386-sev-fix-unreachable-code-coverity-issue.patch
 delete mode 100644 SOURCES/kvm-include-ui-rect.h-fix-qemu_rect_init-mis-assignment.patch
 create mode 100644 SOURCES/kvm-introduce-pc_rhel_9_5_compat.patch
 delete mode 100644 SOURCES/kvm-iotests-Add-test-for-reset-AioContext-switches-with-.patch
 delete mode 100644 SOURCES/kvm-iotests-add-filter_qmp_generated_node_ids.patch
 delete mode 100644 SOURCES/kvm-iotests-iothreads-stream-Use-the-right-TimeoutError.patch
 delete mode 100644 SOURCES/kvm-iotests-port-141-to-Python-for-reliable-QMP-testing.patch
 delete mode 100644 SOURCES/kvm-job-remove-outdated-AioContext-locking-comments.patch
 delete mode 100644 SOURCES/kvm-kconfig-Activate-IOMMUFD-for-s390x-machines.patch
 create mode 100644 SOURCES/kvm-kvm-Enable-KVM_SET_USER_MEMORY_REGION2-for-memslot.patch
 create mode 100644 SOURCES/kvm-kvm-Introduce-support-for-memory_attributes.patch
 create mode 100644 SOURCES/kvm-kvm-add-support-for-guest-physical-bits.patch
 delete mode 100644 SOURCES/kvm-kvm-error-out-of-kvm_irqchip_add_msi_route-in-case-o.patch
 create mode 100644 SOURCES/kvm-kvm-handle-KVM_EXIT_MEMORY_FAULT.patch
 create mode 100644 SOURCES/kvm-kvm-memory-Make-memory-type-private-by-default-if-it.patch
 create mode 100644 SOURCES/kvm-kvm-tdx-Don-t-complain-when-converting-vMMIO-region-.patch
 create mode 100644 SOURCES/kvm-kvm-tdx-Ignore-memory-conversion-to-shared-of-unassi.patch
 create mode 100644 SOURCES/kvm-linux-headers-Update-to-current-kvm-next.patch
 create mode 100644 SOURCES/kvm-linux-headers-update-to-current-kvm-next.patch
 create mode 100644 SOURCES/kvm-machine-allow-early-use-of-machine_require_guest_mem.patch
 create mode 100644 SOURCES/kvm-memory-Introduce-memory_region_init_ram_guest_memfd.patch
 delete mode 100644 SOURCES/kvm-memory-device-reintroduce-memory-region-size-check.patch
 delete mode 100644 SOURCES/kvm-mirror-Don-t-call-job_pause_point-under-graph-lock.patch
 delete mode 100644 SOURCES/kvm-monitor-only-run-coroutine-commands-in-qemu_aio_cont.patch
 create mode 100644 SOURCES/kvm-nbd-server-CVE-2024-7409-Avoid-use-after-free-when-c.patch
 delete mode 100644 SOURCES/kvm-nbd-server-Fix-race-in-draining-the-export.patch
 delete mode 100644 SOURCES/kvm-nbd-server-avoid-per-NBDRequest-nbd_client_get-put.patch
 delete mode 100644 SOURCES/kvm-nbd-server-introduce-NBDClient-lock-to-protect-field.patch
 delete mode 100644 SOURCES/kvm-nbd-server-only-traverse-NBDExport-clients-from-main.patch
 delete mode 100644 SOURCES/kvm-pc-q35-set-SMBIOS-entry-point-type-to-auto-by-defaul.patch
 delete mode 100644 SOURCES/kvm-pc-smbios-fixup-manufacturer-product-version-to-matc.patch
 create mode 100644 SOURCES/kvm-pci-host-q35-Move-PAM-initialization-above-SMRAM-ini.patch
 create mode 100644 SOURCES/kvm-physmem-Introduce-ram_block_discard_guest_memfd_rang.patch
 create mode 100644 SOURCES/kvm-ppc-pef-switch-to-use-confidential_guest_kvm_init-re.patch
 create mode 100644 SOURCES/kvm-q35-Introduce-smm_ranges-property-for-q35-pci-host.patch
 delete mode 100644 SOURCES/kvm-qdev-add-IOThreadVirtQueueMappingList-property-type.patch
 delete mode 100644 SOURCES/kvm-qdev-properties-alias-all-object-class-properties.patch
 create mode 100644 SOURCES/kvm-qemu-guest-agent-Update-the-logfile-path-of-qga-fsfr.patch
 delete mode 100644 SOURCES/kvm-qemu_init-increase-NOFILE-soft-limit-on-POSIX.patch
 create mode 100644 SOURCES/kvm-runstate-skip-initial-CPU-reset-if-reset-is-not-actu.patch
 create mode 100644 SOURCES/kvm-s390-Switch-to-use-confidential_guest_kvm_init.patch
 delete mode 100644 SOURCES/kvm-s390x-pci-avoid-double-enable-disable-of-aif.patch
 delete mode 100644 SOURCES/kvm-s390x-pci-drive-ISM-reset-from-subsystem-reset.patch
 delete mode 100644 SOURCES/kvm-s390x-pci-refresh-fh-before-disabling-aif.patch
 create mode 100644 SOURCES/kvm-scripts-update-linux-header.sh-be-more-src-tree-frie.patch
 create mode 100644 SOURCES/kvm-scripts-update-linux-headers-Add-bits.h-to-file-impo.patch
 create mode 100644 SOURCES/kvm-scripts-update-linux-headers-Add-setup_data.h-to-imp.patch
 create mode 100644 SOURCES/kvm-scripts-update-linux-headers.sh-Fix-the-path-of-setu.patch
 create mode 100644 SOURCES/kvm-scripts-update-linux-headers.sh-Remove-temporary-dir.patch
 delete mode 100644 SOURCES/kvm-scsi-Await-request-purging.patch
 delete mode 100644 SOURCES/kvm-scsi-assert-that-callbacks-run-in-the-correct-AioCon.patch
 create mode 100644 SOURCES/kvm-scsi-block-Don-t-skip-callback-for-sgio-error-status.patch
 create mode 100644 SOURCES/kvm-scsi-disk-Add-warning-comments-that-host_status-erro.patch
 create mode 100644 SOURCES/kvm-scsi-disk-Always-report-RESERVATION_CONFLICT-to-gues.patch
 create mode 100644 SOURCES/kvm-scsi-disk-Use-positive-return-value-for-status-in-dm.patch
 delete mode 100644 SOURCES/kvm-scsi-don-t-lock-AioContext-in-I-O-code-path.patch
 delete mode 100644 SOURCES/kvm-scsi-only-access-SCSIDevice-requests-from-one-thread.patch
 delete mode 100644 SOURCES/kvm-scsi-remove-AioContext-locking.patch
 delete mode 100644 SOURCES/kvm-scsi-remove-outdated-AioContext-lock-comment.patch
 delete mode 100644 SOURCES/kvm-smbios-add-smbios_add_usr_blob_size-helper.patch
 delete mode 100644 SOURCES/kvm-smbios-avoid-mangling-user-provided-tables.patch
 delete mode 100644 SOURCES/kvm-smbios-build-legacy-mode-code-only-for-pc-machine.patch
 delete mode 100644 SOURCES/kvm-smbios-cleanup-smbios_get_tables-from-legacy-handlin.patch
 delete mode 100644 SOURCES/kvm-smbios-clear-smbios_type4_count-before-building-tabl.patch
 delete mode 100644 SOURCES/kvm-smbios-don-t-check-type4-structures-in-legacy-mode.patch
 delete mode 100644 SOURCES/kvm-smbios-error-out-when-building-type-4-table-is-not-p.patch
 delete mode 100644 SOURCES/kvm-smbios-extend-smbios-entry-point-type-with-auto-valu.patch
 delete mode 100644 SOURCES/kvm-smbios-get-rid-of-global-smbios_ep_type.patch
 delete mode 100644 SOURCES/kvm-smbios-get-rid-of-smbios_legacy-global.patch
 delete mode 100644 SOURCES/kvm-smbios-get-rid-of-smbios_smp_sockets-global.patch
 delete mode 100644 SOURCES/kvm-smbios-handle-errors-consistently.patch
 delete mode 100644 SOURCES/kvm-smbios-in-case-of-entry-point-is-auto-try-to-build-v.patch
 delete mode 100644 SOURCES/kvm-smbios-rename-expose-structures-bitmaps-used-by-both.patch
 delete mode 100644 SOURCES/kvm-string-output-visitor-Fix-pseudo-struct-handling.patch
 delete mode 100644 SOURCES/kvm-string-output-visitor-show-structs-as-omitted.patch
 create mode 100644 SOURCES/kvm-target-i386-Add-new-CPU-model-SierraForest.patch
 create mode 100644 SOURCES/kvm-target-i386-Export-RFDS-bit-to-guests.patch
 create mode 100644 SOURCES/kvm-target-i386-Implement-mc-kvm_type-to-get-VM-type.patch
 create mode 100644 SOURCES/kvm-target-i386-Introduce-Icelake-Server-v7-to-enable-TS.patch
 create mode 100644 SOURCES/kvm-target-i386-SEV-fix-formatting-of-CPUID-mismatch-mes.patch
 create mode 100644 SOURCES/kvm-target-i386-SEV-fix-mismatch-in-vcek-disabled-proper.patch
 create mode 100644 SOURCES/kvm-target-i386-SEV-use-KVM_SEV_INIT2-if-possible.patch
 create mode 100644 SOURCES/kvm-target-i386-add-guest-phys-bits-cpu-property.patch
 create mode 100644 SOURCES/kvm-target-i386-introduce-x86-confidential-guest.patch
 delete mode 100644 SOURCES/kvm-target-s390x-kvm-pv-Provide-some-more-useful-informa.patch
 delete mode 100644 SOURCES/kvm-tests-remove-aio_context_acquire-tests.patch
 delete mode 100644 SOURCES/kvm-tests-unit-Bump-test-replication-timeout-to-60-secon.patch
 create mode 100644 SOURCES/kvm-trace-kvm-Split-address-space-and-slot-id-in-trace_k.patch
 delete mode 100644 SOURCES/kvm-ui-clipboard-add-asserts-for-update-and-request.patch
 delete mode 100644 SOURCES/kvm-ui-clipboard-mark-type-as-not-available-when-there-i.patch
 create mode 100644 SOURCES/kvm-update-linux-headers-fix-forwarding-to-asm-generic-h.patch
 create mode 100644 SOURCES/kvm-update-linux-headers-import-linux-kvm_para.h-header.patch
 create mode 100644 SOURCES/kvm-update-linux-headers-move-pvpanic.h-to-correct-direc.patch
 delete mode 100644 SOURCES/kvm-util-char_dev-Add-open_cdev.patch
 delete mode 100644 SOURCES/kvm-vfio-Introduce-a-helper-function-to-initialize-VFIOD.patch
 delete mode 100644 SOURCES/kvm-vfio-Introduce-base-object-for-VFIOContainer-and-tar.patch
 delete mode 100644 SOURCES/kvm-vfio-Make-VFIOContainerBase-poiner-parameter-const-i.patch
 delete mode 100644 SOURCES/kvm-vfio-ap-Allow-the-selection-of-a-given-iommu-backend.patch
 delete mode 100644 SOURCES/kvm-vfio-ap-Make-vfio-cdev-pre-openable-by-passing-a-fil.patch
 delete mode 100644 SOURCES/kvm-vfio-ap-Move-VFIODevice-initializations-in-vfio_ap_i.patch
 delete mode 100644 SOURCES/kvm-vfio-ccw-Allow-the-selection-of-a-given-iommu-backen.patch
 delete mode 100644 SOURCES/kvm-vfio-ccw-Make-vfio-cdev-pre-openable-by-passing-a-fi.patch
 delete mode 100644 SOURCES/kvm-vfio-ccw-Move-VFIODevice-initializations-in-vfio_ccw.patch
 delete mode 100644 SOURCES/kvm-vfio-common-Introduce-vfio_container_init-destroy-he.patch
 delete mode 100644 SOURCES/kvm-vfio-common-Move-giommu_list-in-base-container.patch
 delete mode 100644 SOURCES/kvm-vfio-common-return-early-if-space-isn-t-empty.patch
 delete mode 100644 SOURCES/kvm-vfio-container-Convert-functions-to-base-container.patch
 delete mode 100644 SOURCES/kvm-vfio-container-Implement-attach-detach_device.patch
 delete mode 100644 SOURCES/kvm-vfio-container-Initialize-VFIOIOMMUOps-under-vfio_in.patch
 delete mode 100644 SOURCES/kvm-vfio-container-Intoduce-a-new-VFIOIOMMUClass-setup-h.patch
 delete mode 100644 SOURCES/kvm-vfio-container-Introduce-a-VFIOIOMMU-QOM-interface.patch
 delete mode 100644 SOURCES/kvm-vfio-container-Introduce-a-VFIOIOMMU-legacy-QOM-inte.patch
 delete mode 100644 SOURCES/kvm-vfio-container-Introduce-a-empty-VFIOIOMMUOps.patch
 delete mode 100644 SOURCES/kvm-vfio-container-Introduce-vfio_legacy_setup-for-furth.patch
 delete mode 100644 SOURCES/kvm-vfio-container-Move-dirty_pgsizes-and-max_dirty_bitm.patch
 delete mode 100644 SOURCES/kvm-vfio-container-Move-iova_ranges-to-base-container.patch
 delete mode 100644 SOURCES/kvm-vfio-container-Move-listener-to-base-container.patch
 delete mode 100644 SOURCES/kvm-vfio-container-Move-per-container-device-list-in-bas.patch
 delete mode 100644 SOURCES/kvm-vfio-container-Move-pgsizes-and-dma_max_mappings-to-.patch
 delete mode 100644 SOURCES/kvm-vfio-container-Move-space-field-to-base-container.patch
 delete mode 100644 SOURCES/kvm-vfio-container-Move-vrdl_list-to-base-container.patch
 delete mode 100644 SOURCES/kvm-vfio-container-Rename-vfio_init_container-to-vfio_se.patch
 delete mode 100644 SOURCES/kvm-vfio-container-Replace-basename-with-g_path_get_base.patch
 delete mode 100644 SOURCES/kvm-vfio-container-Switch-to-IOMMU-BE-set_dirty_page_tra.patch
 delete mode 100644 SOURCES/kvm-vfio-container-Switch-to-dma_map-unmap-API.patch
 delete mode 100644 SOURCES/kvm-vfio-iommufd-Add-support-for-iova_ranges-and-pgsizes.patch
 delete mode 100644 SOURCES/kvm-vfio-iommufd-Enable-pci-hot-reset-through-iommufd-cd.patch
 delete mode 100644 SOURCES/kvm-vfio-iommufd-Implement-the-iommufd-backend.patch
 delete mode 100644 SOURCES/kvm-vfio-iommufd-Introduce-a-VFIOIOMMU-iommufd-QOM-inter.patch
 delete mode 100644 SOURCES/kvm-vfio-iommufd-Relax-assert-check-for-iommufd-backend.patch
 delete mode 100644 SOURCES/kvm-vfio-iommufd-Remove-CONFIG_IOMMUFD-usage.patch
 delete mode 100644 SOURCES/kvm-vfio-iommufd-Remove-the-use-of-stat-to-check-file-ex.patch
 delete mode 100644 SOURCES/kvm-vfio-migration-Add-helper-function-to-set-state-or-r.patch
 delete mode 100644 SOURCES/kvm-vfio-pci-Allow-the-selection-of-a-given-iommu-backen.patch
 delete mode 100644 SOURCES/kvm-vfio-pci-Clear-MSI-X-IRQ-index-always.patch
 delete mode 100644 SOURCES/kvm-vfio-pci-Extract-out-a-helper-vfio_pci_get_pci_hot_r.patch
 delete mode 100644 SOURCES/kvm-vfio-pci-Introduce-a-vfio-pci-hot-reset-interface.patch
 delete mode 100644 SOURCES/kvm-vfio-pci-Make-vfio-cdev-pre-openable-by-passing-a-fi.patch
 delete mode 100644 SOURCES/kvm-vfio-pci-Move-VFIODevice-initializations-in-vfio_ins.patch
 delete mode 100644 SOURCES/kvm-vfio-platform-Allow-the-selection-of-a-given-iommu-b.patch
 delete mode 100644 SOURCES/kvm-vfio-platform-Make-vfio-cdev-pre-openable-by-passing.patch
 delete mode 100644 SOURCES/kvm-vfio-platform-Move-VFIODevice-initializations-in-vfi.patch
 delete mode 100644 SOURCES/kvm-vfio-spapr-Extend-VFIOIOMMUOps-with-a-release-handle.patch
 delete mode 100644 SOURCES/kvm-vfio-spapr-Introduce-a-sPAPR-VFIOIOMMU-QOM-interface.patch
 delete mode 100644 SOURCES/kvm-vfio-spapr-Introduce-spapr-backend-and-target-interf.patch
 delete mode 100644 SOURCES/kvm-vfio-spapr-Move-hostwin_list-into-spapr-container.patch
 delete mode 100644 SOURCES/kvm-vfio-spapr-Move-prereg_listener-into-spapr-container.patch
 delete mode 100644 SOURCES/kvm-vfio-spapr-Only-compile-sPAPR-IOMMU-support-when-nee.patch
 delete mode 100644 SOURCES/kvm-vfio-spapr-switch-to-spapr-IOMMU-BE-add-del_section_.patch
 delete mode 100644 SOURCES/kvm-virtio-Re-enable-notifications-after-drain.patch
 delete mode 100644 SOURCES/kvm-virtio-blk-Fix-potential-nullpointer-read-access-in-.patch
 delete mode 100644 SOURCES/kvm-virtio-blk-Use-ioeventfd_attach-in-start_ioeventfd.patch
 delete mode 100644 SOURCES/kvm-virtio-blk-add-iothread-vq-mapping-parameter.patch
 delete mode 100644 SOURCES/kvm-virtio-blk-add-lock-to-protect-s-rq.patch
 delete mode 100644 SOURCES/kvm-virtio-blk-always-set-ioeventfd-during-startup.patch
 delete mode 100644 SOURCES/kvm-virtio-blk-avoid-using-ioeventfd-state-in-irqfd-cond.patch
 delete mode 100644 SOURCES/kvm-virtio-blk-don-t-lock-AioContext-in-the-completion-c.patch
 delete mode 100644 SOURCES/kvm-virtio-blk-don-t-lock-AioContext-in-the-submission-c.patch
 delete mode 100644 SOURCES/kvm-virtio-blk-move-dataplane-code-into-virtio-blk.c.patch
 delete mode 100644 SOURCES/kvm-virtio-blk-rename-dataplane-create-destroy-functions.patch
 delete mode 100644 SOURCES/kvm-virtio-blk-rename-dataplane-to-ioeventfd.patch
 delete mode 100644 SOURCES/kvm-virtio-blk-restart-s-rq-reqs-in-vq-AioContexts.patch
 delete mode 100644 SOURCES/kvm-virtio-blk-tolerate-failure-to-set-BlockBackend-AioC.patch
 delete mode 100644 SOURCES/kvm-virtio-gpu-block-migration-of-VMs-with-blob-true.patch
 delete mode 100644 SOURCES/kvm-virtio-gpu-fix-scanout-migration-post-load.patch
 delete mode 100644 SOURCES/kvm-virtio-mem-default-enable-dynamic-memslots.patch
 delete mode 100644 SOURCES/kvm-virtio-pci-fix-use-of-a-released-vector.patch
 create mode 100644 SOURCES/kvm-virtio-rng-block-max-bytes-0.patch
 delete mode 100644 SOURCES/kvm-virtio-scsi-Attach-event-vq-notifier-with-no_poll.patch
 delete mode 100644 SOURCES/kvm-virtio-scsi-don-t-lock-AioContext-around-virtio_queu.patch
 delete mode 100644 SOURCES/kvm-virtio-scsi-replace-AioContext-lock-with-tmf_bh_lock.patch
 delete mode 100644 SOURCES/kvm-x86-rhel-9.2.0-machine-type-compat-fix.patch

diff --git a/.gitignore b/.gitignore
index ded41b6..49421e7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1 @@
-SOURCES/qemu-8.2.0.tar.xz
+SOURCES/qemu-9.0.0.tar.xz
diff --git a/.qemu-kvm.metadata b/.qemu-kvm.metadata
index 4a22f24..437fb86 100644
--- a/.qemu-kvm.metadata
+++ b/.qemu-kvm.metadata
@@ -1 +1 @@
-1615e59b1bd68324e0819245fe003e33c14a52f9 SOURCES/qemu-8.2.0.tar.xz
+6699bb03d6da21159b89668bca01c6c958b95d07 SOURCES/qemu-9.0.0.tar.xz
diff --git a/SOURCES/0004-Initial-redhat-build.patch b/SOURCES/0004-Initial-redhat-build.patch
index a63b5c3..49991a2 100644
--- a/SOURCES/0004-Initial-redhat-build.patch
+++ b/SOURCES/0004-Initial-redhat-build.patch
@@ -1,4 +1,4 @@
-From faae70a870156f86a5cf55ca967b15d7612941ff Mon Sep 17 00:00:00 2001
+From ea7dff3dbf979d7d8a85a16cf5187235143e1048 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 26 May 2021 10:56:02 +0200
 Subject: Initial redhat build
@@ -13,7 +13,7 @@ several issues are fixed in QEMU tree:
 
 We disable make check due to issues with some of the tests.
 
-This rebase is based on qemu-kvm-8.1.0-5.el9
+This rebase is based on qemu-kvm-8.2.0-11.el9
 
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 --
@@ -83,6 +83,12 @@ Rebase changes (8.2.0):
 - Added --disable-plugins configure option
 - Fixing frh.py strings
 
+Rebase notes (9.0.0):
+- Fixed qemu-kvm binary location change
+- Remove hppa-firmware64.img
+- Package stp files for utilities
+- Download subprojects on local build
+
 Merged patches (6.0.0):
  - 605758c902 Limit build on Power to qemu-img and qemu-ga only
 
@@ -193,14 +199,17 @@ Merged patches (8.1.0):
 Merged patches (8.2.0):
 - cd9efa221d Enable qemu-kvm-device-usb-redirec for aarch64
 
+Merged patches (9.0.0 rc0):
+- 25de053dbf spec: Enable zstd
+
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
- .distro/Makefile                        |  100 +
+ .distro/Makefile                        |  101 +
  .distro/Makefile.common                 |   42 +
  .distro/README.tests                    |   39 +
  .distro/modules-load.conf               |    4 +
  .distro/qemu-guest-agent.service        |    1 -
- .distro/qemu-kvm.spec.template          | 4909 +++++++++++++++++++++++
+ .distro/qemu-kvm.spec.template          | 5170 +++++++++++++++++++++++
  .distro/rpminspect.yaml                 |    6 +-
  .distro/scripts/extract_build_cmd.py    |   12 +
  .distro/scripts/frh.py                  |    4 +-
@@ -211,7 +220,7 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
  scripts/systemtap/conf.d/qemu_kvm.conf  |    4 +
  scripts/systemtap/script.d/qemu_kvm.stp |    1 +
  ui/vnc-auth-sasl.c                      |    2 +-
- 16 files changed, 5168 insertions(+), 6 deletions(-)
+ 16 files changed, 5430 insertions(+), 6 deletions(-)
  create mode 100644 .distro/Makefile
  create mode 100644 .distro/Makefile.common
  create mode 100644 .distro/README.tests
diff --git a/SOURCES/0005-Enable-disable-devices-for-RHEL.patch b/SOURCES/0005-Enable-disable-devices-for-RHEL.patch
index 97c53b4..61e84a1 100644
--- a/SOURCES/0005-Enable-disable-devices-for-RHEL.patch
+++ b/SOURCES/0005-Enable-disable-devices-for-RHEL.patch
@@ -1,4 +1,4 @@
-From 048067b4618ba1fa7c8c517185d4cd3a675eba72 Mon Sep 17 00:00:00 2001
+From 780c39975b059deaee106775b6e3a240155acea3 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 7 Dec 2022 03:05:48 -0500
 Subject: Enable/disable devices for RHEL
@@ -47,6 +47,12 @@ Rebase notes (8.2.0):
 - Disable new neoverse-v2
 - Removed CONFIG_OPENGL from x86_64 config file
 
+Rebase notes (9.0.0 rc0):
+- Split CONFIG_IDE_QDEV to CONFIG_IDE_DEV and CONFIG_IDE_BUS (upstream change)
+
+Rebase notes (9.0.0 rc1):
+- Do not compile armv7 cpu types
+
 Merged patches (6.1.0):
 - c51bf45304 Remove SPICE and QXL from x86_64-rh-devices.mak
 - 02fc745601 aarch64-rh-devices: add CONFIG_PVPANIC_PCI
@@ -74,36 +80,41 @@ Merged patches (8.1.0):
 
 Merged patches (8.2.0):
 - b29f66431f Enable igb on x86_64
+
+Merged patches (9.0.0 rc0):
+- 3889ede5d9 Compile IOMMUFD on x86_64
+- 0beb18451f Compile IOMMUFD on s390x
+- 2b4b13f70d Compile IOMMUFD object on aarch64
 ---
  .distro/qemu-kvm.spec.template                |  18 +--
- .../aarch64-softmmu/aarch64-rh-devices.mak    |  41 +++++++
+ .../aarch64-softmmu/aarch64-rh-devices.mak    |  42 +++++++
  .../ppc64-softmmu/ppc64-rh-devices.mak        |  37 ++++++
  configs/devices/rh-virtio.mak                 |  10 ++
- .../s390x-softmmu/s390x-rh-devices.mak        |  18 +++
- .../x86_64-softmmu/x86_64-rh-devices.mak      | 110 ++++++++++++++++++
+ .../s390x-softmmu/s390x-rh-devices.mak        |  19 +++
+ .../x86_64-softmmu/x86_64-rh-devices.mak      | 112 ++++++++++++++++++
  hw/arm/virt.c                                 |   2 +
  hw/block/fdc.c                                |  10 ++
  hw/cpu/meson.build                            |   3 +-
  hw/cxl/meson.build                            |   3 +-
  hw/display/cirrus_vga.c                       |   4 +
  hw/ide/piix.c                                 |   5 +-
- hw/ide/qdev.c                                 |   9 ++
  hw/input/pckbd.c                              |   2 +
  hw/net/e1000.c                                |   2 +
  hw/ppc/spapr_cpu_core.c                       |   2 +
  hw/usb/meson.build                            |   2 +-
- hw/virtio/meson.build                         |   5 +-
+ hw/virtio/meson.build                         |   6 +-
  target/arm/arm-qmp-cmds.c                     |   2 +
  target/arm/cpu.c                              |   4 +
  target/arm/cpu.h                              |   3 +
  target/arm/cpu64.c                            |  12 +-
  target/arm/tcg/cpu32.c                        |   2 +
  target/arm/tcg/cpu64.c                        |   8 ++
+ target/arm/tcg/meson.build                    |   4 +-
  target/ppc/cpu-models.c                       |   9 ++
  target/s390x/cpu_models_sysemu.c              |   3 +
  target/s390x/kvm/kvm.c                        |   8 ++
  tests/qtest/arm-cpu-features.c                |   4 +
- 28 files changed, 323 insertions(+), 15 deletions(-)
+ 28 files changed, 321 insertions(+), 17 deletions(-)
  create mode 100644 configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
  create mode 100644 configs/devices/ppc64-softmmu/ppc64-rh-devices.mak
  create mode 100644 configs/devices/rh-virtio.mak
@@ -112,10 +123,10 @@ Merged patches (8.2.0):
 
 diff --git a/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak b/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
 new file mode 100644
-index 0000000000..aec1831199
+index 0000000000..b0191d3c69
 --- /dev/null
 +++ b/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
-@@ -0,0 +1,41 @@
+@@ -0,0 +1,42 @@
 +include ../rh-virtio.mak
 +
 +CONFIG_ARM_GIC_KVM=y
@@ -157,6 +168,7 @@ index 0000000000..aec1831199
 +CONFIG_VHOST_VSOCK=y
 +CONFIG_VHOST_USER_VSOCK=y
 +CONFIG_VHOST_USER_FS=y
++CONFIG_IOMMUFD=y
 diff --git a/configs/devices/ppc64-softmmu/ppc64-rh-devices.mak b/configs/devices/ppc64-softmmu/ppc64-rh-devices.mak
 new file mode 100644
 index 0000000000..dbb7d30829
@@ -218,10 +230,10 @@ index 0000000000..94ede1b5f6
 +CONFIG_VIRTIO_SERIAL=y
 diff --git a/configs/devices/s390x-softmmu/s390x-rh-devices.mak b/configs/devices/s390x-softmmu/s390x-rh-devices.mak
 new file mode 100644
-index 0000000000..69a799adbd
+index 0000000000..24cf6dbd03
 --- /dev/null
 +++ b/configs/devices/s390x-softmmu/s390x-rh-devices.mak
-@@ -0,0 +1,18 @@
+@@ -0,0 +1,19 @@
 +include ../rh-virtio.mak
 +
 +CONFIG_PCI=y
@@ -240,12 +252,13 @@ index 0000000000..69a799adbd
 +CONFIG_VHOST_VSOCK=y
 +CONFIG_VHOST_USER_VSOCK=y
 +CONFIG_VHOST_USER_FS=y
++CONFIG_IOMMUFD=y
 diff --git a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
 new file mode 100644
-index 0000000000..ce5be73633
+index 0000000000..d60ff1bcfc
 --- /dev/null
 +++ b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
-@@ -0,0 +1,110 @@
+@@ -0,0 +1,112 @@
 +include ../rh-virtio.mak
 +
 +CONFIG_ACPI=y
@@ -283,7 +296,8 @@ index 0000000000..ce5be73633
 +CONFIG_IDE_CORE=y
 +CONFIG_IDE_PCI=y
 +CONFIG_IDE_PIIX=y
-+CONFIG_IDE_QDEV=y
++CONFIG_IDE_DEV=y
++CONFIG_IDE_BUS=y
 +CONFIG_IGB_PCI_EXPRESS=y
 +CONFIG_IOAPIC=y
 +CONFIG_IOH3420=y
@@ -356,28 +370,29 @@ index 0000000000..ce5be73633
 +CONFIG_VHOST_VSOCK=y
 +CONFIG_VHOST_USER_VSOCK=y
 +CONFIG_VHOST_USER_FS=y
++CONFIG_IOMMUFD=y
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index be2856c018..af9ea4dd1c 100644
+index a9a913aead..6c6d155002 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
-@@ -205,6 +205,7 @@ static const int a15irqmap[] = {
- };
- 
- static const char *valid_cpus[] = {
+@@ -2954,6 +2954,7 @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
+     MachineClass *mc = MACHINE_CLASS(oc);
+     HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(oc);
+     static const char * const valid_cpu_types[] = {
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
  #ifdef CONFIG_TCG
-     ARM_CPU_TYPE_NAME("cortex-a7"),
-     ARM_CPU_TYPE_NAME("cortex-a15"),
-@@ -219,6 +220,7 @@ static const char *valid_cpus[] = {
-     ARM_CPU_TYPE_NAME("neoverse-n2"),
- #endif
-     ARM_CPU_TYPE_NAME("cortex-a53"),
+         ARM_CPU_TYPE_NAME("cortex-a7"),
+         ARM_CPU_TYPE_NAME("cortex-a15"),
+@@ -2971,6 +2972,7 @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
+ #endif /* CONFIG_TCG */
+ #ifdef TARGET_AARCH64
+         ARM_CPU_TYPE_NAME("cortex-a53"),
 +#endif /* disabled for RHEL */
-     ARM_CPU_TYPE_NAME("cortex-a57"),
-     ARM_CPU_TYPE_NAME("host"),
-     ARM_CPU_TYPE_NAME("max"),
+         ARM_CPU_TYPE_NAME("cortex-a57"),
+ #if defined(CONFIG_KVM) || defined(CONFIG_HVF)
+         ARM_CPU_TYPE_NAME("host"),
 diff --git a/hw/block/fdc.c b/hw/block/fdc.c
-index d7cc4d3ec1..12d0a60905 100644
+index 6dd94e98bc..a05757fc9a 100644
 --- a/hw/block/fdc.c
 +++ b/hw/block/fdc.c
 @@ -49,6 +49,8 @@
@@ -405,7 +420,7 @@ index d7cc4d3ec1..12d0a60905 100644
          error_setg(errp, "Cannot choose a fallback FDrive type of 'auto'");
          return;
 diff --git a/hw/cpu/meson.build b/hw/cpu/meson.build
-index 6d319947ca..91962fd863 100644
+index 38cdcfbe57..e588ecfd42 100644
 --- a/hw/cpu/meson.build
 +++ b/hw/cpu/meson.build
 @@ -1,4 +1,5 @@
@@ -416,7 +431,7 @@ index 6d319947ca..91962fd863 100644
  system_ss.add(when: 'CONFIG_ARM11MPCORE', if_true: files('arm11mpcore.c'))
  system_ss.add(when: 'CONFIG_REALVIEW', if_true: files('realview_mpcore.c'))
 diff --git a/hw/cxl/meson.build b/hw/cxl/meson.build
-index ea0aebf6e3..6878f06974 100644
+index 3e375f61a9..613adb3ebb 100644
 --- a/hw/cxl/meson.build
 +++ b/hw/cxl/meson.build
 @@ -6,7 +6,8 @@ system_ss.add(when: 'CONFIG_CXL',
@@ -430,7 +445,7 @@ index ea0aebf6e3..6878f06974 100644
                 if_false: files(
                     'cxl-host-stubs.c',
 diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
-index b80f98b6c4..0370cf8a64 100644
+index 150883a971..497365bd80 100644
 --- a/hw/display/cirrus_vga.c
 +++ b/hw/display/cirrus_vga.c
 @@ -36,6 +36,7 @@
@@ -452,10 +467,10 @@ index b80f98b6c4..0370cf8a64 100644
       * Follow real hardware, cirrus card emulated has 4 MB video memory.
       * Also accept 8 MB/16 MB for backward compatibility.
 diff --git a/hw/ide/piix.c b/hw/ide/piix.c
-index 4e5e12935f..03ca06bb17 100644
+index 80efc633d3..9cb82b8eea 100644
 --- a/hw/ide/piix.c
 +++ b/hw/ide/piix.c
-@@ -190,7 +190,8 @@ static void piix3_ide_class_init(ObjectClass *klass, void *data)
+@@ -191,7 +191,8 @@ static void piix3_ide_class_init(ObjectClass *klass, void *data)
      k->device_id = PCI_DEVICE_ID_INTEL_82371SB_1;
      k->class_id = PCI_CLASS_STORAGE_IDE;
      set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
@@ -465,7 +480,7 @@ index 4e5e12935f..03ca06bb17 100644
  }
  
  static const TypeInfo piix3_ide_info = {
-@@ -214,6 +215,8 @@ static void piix4_ide_class_init(ObjectClass *klass, void *data)
+@@ -215,6 +216,8 @@ static void piix4_ide_class_init(ObjectClass *klass, void *data)
      k->class_id = PCI_CLASS_STORAGE_IDE;
      set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
      dc->hotpluggable = false;
@@ -474,57 +489,11 @@ index 4e5e12935f..03ca06bb17 100644
  }
  
  static const TypeInfo piix4_ide_info = {
-diff --git a/hw/ide/qdev.c b/hw/ide/qdev.c
-index 1b3b4da01d..454bfa5783 100644
---- a/hw/ide/qdev.c
-+++ b/hw/ide/qdev.c
-@@ -283,10 +283,13 @@ static void ide_cd_realize(IDEDevice *dev, Error **errp)
-     ide_dev_initfn(dev, IDE_CD, errp);
- }
- 
-+/* Disabled for Red Hat Enterprise Linux */
-+#if 0
- static void ide_cf_realize(IDEDevice *dev, Error **errp)
- {
-     ide_dev_initfn(dev, IDE_CFATA, errp);
- }
-+#endif
- 
- #define DEFINE_IDE_DEV_PROPERTIES()                     \
-     DEFINE_BLOCK_PROPERTIES(IDEDrive, dev.conf),        \
-@@ -346,6 +349,8 @@ static const TypeInfo ide_cd_info = {
-     .class_init    = ide_cd_class_init,
- };
- 
-+/* Disabled for Red Hat Enterprise Linux */
-+#if 0
- static Property ide_cf_properties[] = {
-     DEFINE_IDE_DEV_PROPERTIES(),
-     DEFINE_BLOCK_CHS_PROPERTIES(IDEDrive, dev.conf),
-@@ -371,6 +376,7 @@ static const TypeInfo ide_cf_info = {
-     .instance_size = sizeof(IDEDrive),
-     .class_init    = ide_cf_class_init,
- };
-+#endif
- 
- static void ide_device_class_init(ObjectClass *klass, void *data)
- {
-@@ -396,7 +402,10 @@ static void ide_register_types(void)
-     type_register_static(&ide_bus_info);
-     type_register_static(&ide_hd_info);
-     type_register_static(&ide_cd_info);
-+/* Disabled for Red Hat Enterprise Linux */
-+#if 0
-     type_register_static(&ide_cf_info);
-+#endif
-     type_register_static(&ide_device_type_info);
- }
- 
 diff --git a/hw/input/pckbd.c b/hw/input/pckbd.c
-index b92b63bedc..3b6235dde6 100644
+index 74f10b640f..2e85ecf476 100644
 --- a/hw/input/pckbd.c
 +++ b/hw/input/pckbd.c
-@@ -957,6 +957,8 @@ static void i8042_class_initfn(ObjectClass *klass, void *data)
+@@ -952,6 +952,8 @@ static void i8042_class_initfn(ObjectClass *klass, void *data)
      dc->vmsd = &vmstate_kbd_isa;
      adevc->build_dev_aml = i8042_build_aml;
      set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
@@ -534,7 +503,7 @@ index b92b63bedc..3b6235dde6 100644
  
  static const TypeInfo i8042_info = {
 diff --git a/hw/net/e1000.c b/hw/net/e1000.c
-index 8ffe1077f1..b3dfeeca4f 100644
+index 43f3a4a701..267f182883 100644
 --- a/hw/net/e1000.c
 +++ b/hw/net/e1000.c
 @@ -1746,6 +1746,7 @@ static const E1000Info e1000_devices[] = {
@@ -554,10 +523,10 @@ index 8ffe1077f1..b3dfeeca4f 100644
  
  static void e1000_register_types(void)
 diff --git a/hw/ppc/spapr_cpu_core.c b/hw/ppc/spapr_cpu_core.c
-index 91fae56573..33e0c8724c 100644
+index e7c9edd033..3b0a47a28c 100644
 --- a/hw/ppc/spapr_cpu_core.c
 +++ b/hw/ppc/spapr_cpu_core.c
-@@ -386,10 +386,12 @@ static const TypeInfo spapr_cpu_core_type_infos[] = {
+@@ -389,10 +389,12 @@ static const TypeInfo spapr_cpu_core_type_infos[] = {
          .instance_size = sizeof(SpaprCpuCore),
          .class_size = sizeof(SpaprCpuCoreClass),
      },
@@ -565,16 +534,16 @@ index 91fae56573..33e0c8724c 100644
      DEFINE_SPAPR_CPU_CORE_TYPE("970_v2.2"),
      DEFINE_SPAPR_CPU_CORE_TYPE("970mp_v1.0"),
      DEFINE_SPAPR_CPU_CORE_TYPE("970mp_v1.1"),
-     DEFINE_SPAPR_CPU_CORE_TYPE("power5+_v2.1"),
+     DEFINE_SPAPR_CPU_CORE_TYPE("power5p_v2.1"),
 +#endif
      DEFINE_SPAPR_CPU_CORE_TYPE("power7_v2.3"),
-     DEFINE_SPAPR_CPU_CORE_TYPE("power7+_v2.1"),
+     DEFINE_SPAPR_CPU_CORE_TYPE("power7p_v2.1"),
      DEFINE_SPAPR_CPU_CORE_TYPE("power8_v2.0"),
 diff --git a/hw/usb/meson.build b/hw/usb/meson.build
-index e94149ebde..4a8adbf3dc 100644
+index aac3bb35f2..5411ff35df 100644
 --- a/hw/usb/meson.build
 +++ b/hw/usb/meson.build
-@@ -52,7 +52,7 @@ system_ss.add(when: 'CONFIG_USB_SMARTCARD', if_true: files('dev-smartcard-reader
+@@ -55,7 +55,7 @@ system_ss.add(when: 'CONFIG_USB_SMARTCARD', if_true: files('dev-smartcard-reader
  if cacard.found()
    usbsmartcard_ss = ss.source_set()
    usbsmartcard_ss.add(when: 'CONFIG_USB_SMARTCARD',
@@ -584,26 +553,34 @@ index e94149ebde..4a8adbf3dc 100644
  endif
  
 diff --git a/hw/virtio/meson.build b/hw/virtio/meson.build
-index c0055a7832..12e1d6c67e 100644
+index d7f18c96e6..aaabbb8b0b 100644
 --- a/hw/virtio/meson.build
 +++ b/hw/virtio/meson.build
-@@ -17,8 +17,9 @@ if have_vhost
-   if have_vhost_user
-     # fixme - this really should be generic
-     specific_virtio_ss.add(files('vhost-user.c'))
+@@ -20,7 +20,8 @@ if have_vhost
+     system_virtio_ss.add(files('vhost-user-base.c'))
+ 
+     # MMIO Stubs
 -    system_virtio_ss.add(files('vhost-user-device.c'))
--    system_virtio_ss.add(when: 'CONFIG_VIRTIO_PCI', if_true: files('vhost-user-device-pci.c'))
 +# Disabled for 8.2.0 rebase for RHEL 9.4.0
 +#    system_virtio_ss.add(files('vhost-user-device.c'))
+     system_virtio_ss.add(when: 'CONFIG_VHOST_USER_GPIO', if_true: files('vhost-user-gpio.c'))
+     system_virtio_ss.add(when: 'CONFIG_VHOST_USER_I2C', if_true: files('vhost-user-i2c.c'))
+     system_virtio_ss.add(when: 'CONFIG_VHOST_USER_RNG', if_true: files('vhost-user-rng.c'))
+@@ -28,7 +29,8 @@ if have_vhost
+     system_virtio_ss.add(when: 'CONFIG_VHOST_USER_INPUT', if_true: files('vhost-user-input.c'))
+ 
+     # PCI Stubs
+-    system_virtio_ss.add(when: 'CONFIG_VIRTIO_PCI', if_true: files('vhost-user-device-pci.c'))
++# Disabled for 8.2.0 rebase for RHEL 9.4.0
 +#    system_virtio_ss.add(when: 'CONFIG_VIRTIO_PCI', if_true: files('vhost-user-device-pci.c'))
-   endif
-   if have_vhost_vdpa
-     system_virtio_ss.add(files('vhost-vdpa.c'))
+     system_virtio_ss.add(when: ['CONFIG_VIRTIO_PCI', 'CONFIG_VHOST_USER_GPIO'],
+                          if_true: files('vhost-user-gpio-pci.c'))
+     system_virtio_ss.add(when: ['CONFIG_VIRTIO_PCI', 'CONFIG_VHOST_USER_I2C'],
 diff --git a/target/arm/arm-qmp-cmds.c b/target/arm/arm-qmp-cmds.c
-index b53d5efe13..64989a02d1 100644
+index 3cc8cc738b..6f21fea1f5 100644
 --- a/target/arm/arm-qmp-cmds.c
 +++ b/target/arm/arm-qmp-cmds.c
-@@ -231,6 +231,7 @@ CpuModelExpansionInfo *qmp_query_cpu_model_expansion(CpuModelExpansionType type,
+@@ -223,6 +223,7 @@ CpuModelExpansionInfo *qmp_query_cpu_model_expansion(CpuModelExpansionType type,
  static void arm_cpu_add_definition(gpointer data, gpointer user_data)
  {
      ObjectClass *oc = data;
@@ -611,23 +588,23 @@ index b53d5efe13..64989a02d1 100644
      CpuDefinitionInfoList **cpu_list = user_data;
      CpuDefinitionInfo *info;
      const char *typename;
-@@ -240,6 +241,7 @@ static void arm_cpu_add_definition(gpointer data, gpointer user_data)
-     info->name = g_strndup(typename,
-                            strlen(typename) - strlen("-" TYPE_ARM_CPU));
+@@ -231,6 +232,7 @@ static void arm_cpu_add_definition(gpointer data, gpointer user_data)
+     info = g_malloc0(sizeof(*info));
+     info->name = cpu_model_from_type(typename);
      info->q_typename = g_strdup(typename);
 +    info->deprecated = !!cc->deprecation_note;
  
      QAPI_LIST_PREPEND(*cpu_list, info);
  }
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-index efb22a87f9..a32521ada9 100644
+index ab8d007a86..e5dce20f19 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
-@@ -2524,6 +2524,10 @@ static void cpu_register_class_init(ObjectClass *oc, void *data)
+@@ -2546,6 +2546,10 @@ static void cpu_register_class_init(ObjectClass *oc, void *data)
  
      acc->info = data;
      cc->gdb_core_xml_file = "arm-core.xml";
-+    
++
 +    if (acc->info->deprecation_note) {
 +        cc->deprecation_note = acc->info->deprecation_note;
 +    }
@@ -635,10 +612,10 @@ index efb22a87f9..a32521ada9 100644
  
  void arm_cpu_register(const ARMCPUInfo *info)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-index a0282e0d28..7e0f0dfea7 100644
+index bc0c84873f..e9472c8bb8 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
-@@ -34,6 +34,8 @@
+@@ -37,6 +37,8 @@
  #define KVM_HAVE_MCE_INJECTION 1
  #endif
  
@@ -647,7 +624,7 @@ index a0282e0d28..7e0f0dfea7 100644
  #define EXCP_UDEF            1   /* undefined instruction */
  #define EXCP_SWI             2   /* software interrupt */
  #define EXCP_PREFETCH_ABORT  3
-@@ -1120,6 +1122,7 @@ typedef struct ARMCPUInfo {
+@@ -1092,6 +1094,7 @@ typedef struct ARMCPUInfo {
      const char *name;
      void (*initfn)(Object *obj);
      void (*class_init)(ObjectClass *oc, void *data);
@@ -656,7 +633,7 @@ index a0282e0d28..7e0f0dfea7 100644
  
  /**
 diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
-index 1e9c6c85ae..10be900803 100644
+index 985b1efe16..46a4e80171 100644
 --- a/target/arm/cpu64.c
 +++ b/target/arm/cpu64.c
 @@ -648,6 +648,7 @@ static void aarch64_a57_initfn(Object *obj)
@@ -688,7 +665,7 @@ index 1e9c6c85ae..10be900803 100644
      { .name = "max",                .initfn = aarch64_max_initfn },
  #if defined(CONFIG_KVM) || defined(CONFIG_HVF)
      { .name = "host",               .initfn = aarch64_host_initfn },
-@@ -815,8 +820,13 @@ static void aarch64_cpu_instance_init(Object *obj)
+@@ -814,8 +819,13 @@ static void aarch64_cpu_instance_init(Object *obj)
  static void cpu_register_class_init(ObjectClass *oc, void *data)
  {
      ARMCPUClass *acc = ARM_CPU_CLASS(oc);
@@ -703,24 +680,24 @@ index 1e9c6c85ae..10be900803 100644
  
  void aarch64_cpu_register(const ARMCPUInfo *info)
 diff --git a/target/arm/tcg/cpu32.c b/target/arm/tcg/cpu32.c
-index d9e0e2a4dd..c5c639a6ea 100644
+index de8f2be941..8896295ae3 100644
 --- a/target/arm/tcg/cpu32.c
 +++ b/target/arm/tcg/cpu32.c
-@@ -98,6 +98,7 @@ void aa32_max_features(ARMCPU *cpu)
+@@ -92,6 +92,7 @@ void aa32_max_features(ARMCPU *cpu)
+     cpu->isar.id_dfr1 = t;
+ }
+ 
++#if 0 /* Disabled for Red Hat Enterprise Linux */
  /* CPU models. These are not needed for the AArch64 linux-user build. */
  #if !defined(CONFIG_USER_ONLY) || !defined(TARGET_AARCH64)
  
-+#if 0 /* Disabled for Red Hat Enterprise Linux */
- #if !defined(CONFIG_USER_ONLY)
- static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
- {
-@@ -1189,3 +1190,4 @@ static void arm_tcg_cpu_register_types(void)
+@@ -1037,3 +1038,4 @@ static void arm_tcg_cpu_register_types(void)
  type_init(arm_tcg_cpu_register_types)
  
  #endif /* !CONFIG_USER_ONLY || !TARGET_AARCH64 */
 +#endif /* disabled for RHEL */
 diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
-index fcda99e158..bd5a993ff8 100644
+index 9f7a9f3d2c..7ec6851c9c 100644
 --- a/target/arm/tcg/cpu64.c
 +++ b/target/arm/tcg/cpu64.c
 @@ -29,6 +29,7 @@
@@ -755,7 +732,7 @@ index fcda99e158..bd5a993ff8 100644
  
  /*
   * -cpu max: a CPU with as many features enabled as our emulation supports.
-@@ -1259,6 +1263,7 @@ void aarch64_max_tcg_initfn(Object *obj)
+@@ -1271,6 +1275,7 @@ void aarch64_max_tcg_initfn(Object *obj)
      qdev_property_add_static(DEVICE(obj), &arm_cpu_lpa2_property);
  }
  
@@ -763,7 +740,7 @@ index fcda99e158..bd5a993ff8 100644
  static const ARMCPUInfo aarch64_cpus[] = {
      { .name = "cortex-a35",         .initfn = aarch64_a35_initfn },
      { .name = "cortex-a55",         .initfn = aarch64_a55_initfn },
-@@ -1270,14 +1275,17 @@ static const ARMCPUInfo aarch64_cpus[] = {
+@@ -1282,14 +1287,17 @@ static const ARMCPUInfo aarch64_cpus[] = {
      { .name = "neoverse-v1",        .initfn = aarch64_neoverse_v1_initfn },
      { .name = "neoverse-n2",        .initfn = aarch64_neoverse_n2_initfn },
  };
@@ -781,8 +758,20 @@ index fcda99e158..bd5a993ff8 100644
  }
  
  type_init(aarch64_cpu_register_types)
+diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
+index 3b1a9f0fc5..6898b4de6f 100644
+--- a/target/arm/tcg/meson.build
++++ b/target/arm/tcg/meson.build
+@@ -56,5 +56,5 @@ arm_system_ss.add(files(
+   'psci.c',
+ ))
+ 
+-arm_system_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('cpu-v7m.c'))
+-arm_user_ss.add(when: 'TARGET_AARCH64', if_false: files('cpu-v7m.c'))
++#arm_system_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('cpu-v7m.c'))
++#arm_user_ss.add(when: 'TARGET_AARCH64', if_false: files('cpu-v7m.c'))
 diff --git a/target/ppc/cpu-models.c b/target/ppc/cpu-models.c
-index 7dbb47de64..69fddb05bc 100644
+index f2301b43f7..f77ebfcc81 100644
 --- a/target/ppc/cpu-models.c
 +++ b/target/ppc/cpu-models.c
 @@ -66,6 +66,7 @@
@@ -806,13 +795,13 @@ index 7dbb47de64..69fddb05bc 100644
      POWERPC_DEF("970fx_v1.0",    CPU_POWERPC_970FX_v10,              970,
 @@ -718,6 +721,7 @@
                  "PowerPC 970MP v1.1")
-     POWERPC_DEF("power5+_v2.1",  CPU_POWERPC_POWER5P_v21,            POWER5P,
+     POWERPC_DEF("power5p_v2.1",  CPU_POWERPC_POWER5P_v21,            POWER5P,
                  "POWER5+ v2.1")
 +#endif
      POWERPC_DEF("power7_v2.3",   CPU_POWERPC_POWER7_v23,             POWER7,
                  "POWER7 v2.3")
-     POWERPC_DEF("power7+_v2.1",  CPU_POWERPC_POWER7P_v21,            POWER7,
-@@ -898,12 +902,15 @@ PowerPCCPUAlias ppc_cpu_aliases[] = {
+     POWERPC_DEF("power7p_v2.1",  CPU_POWERPC_POWER7P_v21,            POWER7,
+@@ -894,13 +898,16 @@ PowerPCCPUAlias ppc_cpu_aliases[] = {
      { "7447a", "7447a_v1.2" },
      { "7457a", "7457a_v1.2" },
      { "apollo7pm", "7457a_v1.0" },
@@ -822,13 +811,14 @@ index 7dbb47de64..69fddb05bc 100644
      { "970", "970_v2.2" },
      { "970fx", "970fx_v3.1" },
      { "970mp", "970mp_v1.1" },
-     { "power5+", "power5+_v2.1" },
+     { "power5+", "power5p_v2.1" },
+     { "power5+_v2.1", "power5p_v2.1" },
      { "power5gs", "power5+_v2.1" },
 +#endif
      { "power7", "power7_v2.3" },
-     { "power7+", "power7+_v2.1" },
-     { "power8e", "power8e_v2.1" },
-@@ -913,12 +920,14 @@ PowerPCCPUAlias ppc_cpu_aliases[] = {
+     { "power7+", "power7p_v2.1" },
+     { "power7+_v2.1", "power7p_v2.1" },
+@@ -911,12 +918,14 @@ PowerPCCPUAlias ppc_cpu_aliases[] = {
      { "power10", "power10_v2.0" },
  #endif
  
@@ -844,10 +834,10 @@ index 7dbb47de64..69fddb05bc 100644
      { NULL, NULL }
  };
 diff --git a/target/s390x/cpu_models_sysemu.c b/target/s390x/cpu_models_sysemu.c
-index 63981bf36b..87a4480c05 100644
+index 2d99218069..0728bfcc20 100644
 --- a/target/s390x/cpu_models_sysemu.c
 +++ b/target/s390x/cpu_models_sysemu.c
-@@ -35,6 +35,9 @@ static void check_unavailable_features(const S390CPUModel *max_model,
+@@ -34,6 +34,9 @@ static void check_unavailable_features(const S390CPUModel *max_model,
          (max_model->def->gen == model->def->gen &&
           max_model->def->ec_ga < model->def->ec_ga)) {
          list_add_feat("type", unavailable);
@@ -858,10 +848,10 @@ index 63981bf36b..87a4480c05 100644
  
      /* detect missing features if any to properly report them */
 diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c
-index 33ab3551f4..912e493951 100644
+index 4ce809c5d4..55fb4855b1 100644
 --- a/target/s390x/kvm/kvm.c
 +++ b/target/s390x/kvm/kvm.c
-@@ -2567,6 +2567,14 @@ void kvm_s390_apply_cpu_model(const S390CPUModel *model, Error **errp)
+@@ -2565,6 +2565,14 @@ void kvm_s390_apply_cpu_model(const S390CPUModel *model, Error **errp)
          error_setg(errp, "KVM doesn't support CPU models");
          return;
      }
@@ -877,10 +867,10 @@ index 33ab3551f4..912e493951 100644
      prop.ibc = s390_ibc_from_cpu_model(model);
      /* configure cpu features indicated via STFL(e) */
 diff --git a/tests/qtest/arm-cpu-features.c b/tests/qtest/arm-cpu-features.c
-index a8a4c668ad..2458cc527c 100644
+index 9d6e6190d5..f822526acb 100644
 --- a/tests/qtest/arm-cpu-features.c
 +++ b/tests/qtest/arm-cpu-features.c
-@@ -451,8 +451,10 @@ static void test_query_cpu_model_expansion(const void *data)
+@@ -452,8 +452,10 @@ static void test_query_cpu_model_expansion(const void *data)
      assert_error(qts, "host", "The CPU type 'host' requires KVM", NULL);
  
      /* Test expected feature presence/absence for some cpu types */
@@ -891,7 +881,7 @@ index a8a4c668ad..2458cc527c 100644
  
      /* Enabling and disabling pmu should always work. */
      assert_has_feature_enabled(qts, "max", "pmu");
-@@ -469,6 +471,7 @@ static void test_query_cpu_model_expansion(const void *data)
+@@ -470,6 +472,7 @@ static void test_query_cpu_model_expansion(const void *data)
          assert_has_feature_enabled(qts, "cortex-a57", "pmu");
          assert_has_feature_enabled(qts, "cortex-a57", "aarch64");
  
@@ -899,7 +889,7 @@ index a8a4c668ad..2458cc527c 100644
          assert_has_feature_enabled(qts, "a64fx", "pmu");
          assert_has_feature_enabled(qts, "a64fx", "aarch64");
          /*
-@@ -481,6 +484,7 @@ static void test_query_cpu_model_expansion(const void *data)
+@@ -482,6 +485,7 @@ static void test_query_cpu_model_expansion(const void *data)
                       "{ 'sve384': true }");
          assert_error(qts, "a64fx", "cannot enable sve640",
                       "{ 'sve640': true }");
diff --git a/SOURCES/0006-Machine-type-related-general-changes.patch b/SOURCES/0006-Machine-type-related-general-changes.patch
index 4a4c6fb..e0c3795 100644
--- a/SOURCES/0006-Machine-type-related-general-changes.patch
+++ b/SOURCES/0006-Machine-type-related-general-changes.patch
@@ -1,4 +1,4 @@
-From d9ff466c980d219ebf230ea24becce294c196f1f Mon Sep 17 00:00:00 2001
+From 8e6a30073f9c1a5d6294b2d16556522453e227e7 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 11 Jan 2019 09:54:45 +0100
 Subject: Machine type related general changes
@@ -26,6 +26,12 @@ Rebase notes (7.1.0):
 Rebase notes (8.1.0):
 - Do not modify unused vga-isa.c
 
+Rebase notes (9.0.0 rc0):
+- Updated smsbios handling
+
+Rebase notes (9.0.0 rc4):
+- Moving downstream compat changes
+
 Merged patches (6.1.0):
 - f2fb42a3c6 redhat: add missing entries in hw_compat_rhel_8_4
 - 1949ec258e hw/arm/virt: Disable PL011 clock migration through hw_compat_rhel_8_3
@@ -61,24 +67,27 @@ Merged patches (8.1.0):
 
 Merged patches (8.2.0):
 - 4ee284aca9 Add machine types compat bits. (partial)
+
+Merged patches (9.0.0 rc0):
+- 4b8fe42abc virtio-mem: default-enable "dynamic-memslots"
 ---
  hw/acpi/piix4.c              |   2 +-
  hw/arm/virt.c                |   2 +-
- hw/core/machine.c            | 267 +++++++++++++++++++++++++++++++++++
- hw/i386/pc_piix.c            |   2 +
- hw/i386/pc_q35.c             |   2 +
+ hw/core/machine.c            | 269 +++++++++++++++++++++++++++++++++++
+ hw/i386/fw_cfg.c             |   3 +-
  hw/net/rtl8139.c             |   4 +-
  hw/smbios/smbios.c           |  46 +++++-
  hw/timer/i8254_common.c      |   2 +-
  hw/usb/hcd-xhci-pci.c        |  59 ++++++--
  hw/usb/hcd-xhci-pci.h        |   1 +
+ hw/virtio/virtio-mem.c       |   3 +-
  include/hw/boards.h          |  40 ++++++
- include/hw/firmware/smbios.h |   5 +-
+ include/hw/firmware/smbios.h |   4 +-
  include/hw/i386/pc.h         |   3 +
- 13 files changed, 413 insertions(+), 22 deletions(-)
+ 13 files changed, 414 insertions(+), 24 deletions(-)
 
 diff --git a/hw/acpi/piix4.c b/hw/acpi/piix4.c
-index dd523d2e4c..5050c0ba97 100644
+index debe1adb84..e8ddcd716e 100644
 --- a/hw/acpi/piix4.c
 +++ b/hw/acpi/piix4.c
 @@ -245,7 +245,7 @@ static bool vmstate_test_migrate_acpi_index(void *opaque, int version_id)
@@ -88,28 +97,28 @@ index dd523d2e4c..5050c0ba97 100644
 -    .minimum_version_id = 3,
 +    .minimum_version_id = 2,
      .post_load = vmstate_acpi_post_load,
-     .fields = (VMStateField[]) {
+     .fields = (const VMStateField[]) {
          VMSTATE_PCI_DEVICE(parent_obj, PIIX4PMState),
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index af9ea4dd1c..62f0f7d4d6 100644
+index 6c6d155002..36e9b4b4e9 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
-@@ -1638,7 +1638,7 @@ static void virt_build_smbios(VirtMachineState *vms)
+@@ -1651,7 +1651,7 @@ static void virt_build_smbios(VirtMachineState *vms)
  
      smbios_set_defaults("QEMU", product,
-                         vmc->smbios_old_sys_ver ? "1.0" : mc->name, false,
--                        true, SMBIOS_ENTRY_POINT_TYPE_64);
-+                        true, NULL, NULL, SMBIOS_ENTRY_POINT_TYPE_64);
+                         vmc->smbios_old_sys_ver ? "1.0" : mc->name,
+-                        true);
++                        true, NULL, NULL);
  
      /* build the array of physical mem area from base_memmap */
      mem_array.address = vms->memmap[VIRT_MEM].base;
 diff --git a/hw/core/machine.c b/hw/core/machine.c
-index 0c17398141..446601ee30 100644
+index 37ede0e7d4..695cb89a46 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
-@@ -57,6 +57,273 @@ GlobalProperty hw_compat_7_2[] = {
+@@ -296,6 +296,275 @@ GlobalProperty hw_compat_2_1[] = {
  };
- const size_t hw_compat_7_2_len = G_N_ELEMENTS(hw_compat_7_2);
+ const size_t hw_compat_2_1_len = G_N_ELEMENTS(hw_compat_2_1);
  
 +/*
 + * RHEL only: machine types for previous major releases are deprecated
@@ -132,6 +141,8 @@ index 0c17398141..446601ee30 100644
 +     { "vfio-pci-nohotplug", "x-ramfb-migrate", "off" },
 +  /* hw_compat_rhel_9_4 from hw_compat_8_1 */
 +     { "igb", "x-pcie-flr-init", "off" },
++  /* hw_compat_rhel_9_4 jira RHEL-24045 */
++     { "virtio-mem", "dynamic-memslots", "off" },
 +};
 +const size_t hw_compat_rhel_9_4_len = G_N_ELEMENTS(hw_compat_rhel_9_4);
 +
@@ -378,37 +389,25 @@ index 0c17398141..446601ee30 100644
 +};
 +const size_t hw_compat_rhel_7_6_len = G_N_ELEMENTS(hw_compat_rhel_7_6);
 +
- GlobalProperty hw_compat_7_1[] = {
-     { "virtio-device", "queue_reset", "false" },
-     { "virtio-rng-pci", "vectors", "0" },
-diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
-index eace854335..2a9f465619 100644
---- a/hw/i386/pc_piix.c
-+++ b/hw/i386/pc_piix.c
-@@ -238,6 +238,8 @@ static void pc_init1(MachineState *machine,
-         smbios_set_defaults("QEMU", mc->desc,
-                             mc->name, pcmc->smbios_legacy_mode,
-                             pcmc->smbios_uuid_encoded,
-+                            pcmc->smbios_stream_product,
-+                            pcmc->smbios_stream_version,
-                             pcms->smbios_entry_point_type);
-     }
+ MachineState *current_machine;
  
-diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
-index 4f3e5412f6..912cb0c0dc 100644
---- a/hw/i386/pc_q35.c
-+++ b/hw/i386/pc_q35.c
-@@ -206,6 +206,8 @@ static void pc_q35_init(MachineState *machine)
-         smbios_set_defaults("QEMU", mc->desc,
-                             mc->name, pcmc->smbios_legacy_mode,
-                             pcmc->smbios_uuid_encoded,
-+                            pcmc->smbios_stream_product,
-+                            pcmc->smbios_stream_version,
-                             pcms->smbios_entry_point_type);
+ static char *machine_get_kernel(Object *obj, Error **errp)
+diff --git a/hw/i386/fw_cfg.c b/hw/i386/fw_cfg.c
+index d802d2787f..c7aa39a13e 100644
+--- a/hw/i386/fw_cfg.c
++++ b/hw/i386/fw_cfg.c
+@@ -64,7 +64,8 @@ void fw_cfg_build_smbios(PCMachineState *pcms, FWCfgState *fw_cfg,
+     if (pcmc->smbios_defaults) {
+         /* These values are guest ABI, do not change */
+         smbios_set_defaults("QEMU", mc->desc, mc->name,
+-                            pcmc->smbios_uuid_encoded);
++                            pcmc->smbios_uuid_encoded,
++                            pcmc->smbios_stream_product, pcmc->smbios_stream_version);
      }
  
+     /* tell smbios about cpuid version and features */
 diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
-index 4af8c66266..7dc12907ab 100644
+index 897c86ec41..2d0db43f49 100644
 --- a/hw/net/rtl8139.c
 +++ b/hw/net/rtl8139.c
 @@ -3169,7 +3169,7 @@ static int rtl8139_pre_save(void *opaque)
@@ -431,20 +430,21 @@ index 4af8c66266..7dc12907ab 100644
          VMSTATE_UINT16(tally_counters.TxUndrn, RTL8139State),
  
 diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c
-index 2a90601ac5..7bde23e59d 100644
+index eed5787b15..68608a3403 100644
 --- a/hw/smbios/smbios.c
 +++ b/hw/smbios/smbios.c
-@@ -58,6 +58,9 @@ static bool smbios_legacy = true;
- static bool smbios_uuid_encoded = true;
- /* end: legacy structures & constants for <= 2.0 machines */
+@@ -39,6 +39,10 @@ size_t usr_blobs_len;
+ static unsigned usr_table_max;
+ static unsigned usr_table_cnt;
  
 +/* Set to true for modern Windows 10 HardwareID-6 compat */
 +static bool smbios_type2_required;
 +
- 
++
  uint8_t *smbios_tables;
  size_t smbios_tables_len;
-@@ -670,7 +673,7 @@ static void smbios_build_type_1_table(void)
+ unsigned smbios_table_max;
+@@ -629,7 +633,7 @@ static void smbios_build_type_1_table(void)
  
  static void smbios_build_type_2_table(void)
  {
@@ -453,21 +453,17 @@ index 2a90601ac5..7bde23e59d 100644
  
      SMBIOS_TABLE_SET_STR(2, manufacturer_str, type2.manufacturer);
      SMBIOS_TABLE_SET_STR(2, product_str, type2.product);
-@@ -985,7 +988,10 @@ void smbios_set_cpuid(uint32_t version, uint32_t features)
+@@ -1018,16 +1022,52 @@ void smbios_set_default_processor_family(uint16_t processor_family)
  
  void smbios_set_defaults(const char *manufacturer, const char *product,
-                          const char *version, bool legacy_mode,
--                         bool uuid_encoded, SmbiosEntryPointType ep_type)
+                          const char *version,
+-                         bool uuid_encoded)
 +                         bool uuid_encoded,
 +                         const char *stream_product,
-+                         const char *stream_version,
-+                         SmbiosEntryPointType ep_type)
++                         const char *stream_version)
  {
      smbios_have_defaults = true;
-     smbios_legacy = legacy_mode;
-@@ -1006,11 +1012,45 @@ void smbios_set_defaults(const char *manufacturer, const char *product,
-         g_free(smbios_entries);
-     }
+     smbios_uuid_encoded = uuid_encoded;
  
 +    /*
 +     * If @stream_product & @stream_version are non-NULL, then
@@ -494,12 +490,12 @@ index 2a90601ac5..7bde23e59d 100644
 +     *
 +     * We get 'System Manufacturer' and 'Baseboard Manufacturer'
 +     */
-     SMBIOS_SET_DEFAULT(type1.manufacturer, manufacturer);
-     SMBIOS_SET_DEFAULT(type1.product, product);
-     SMBIOS_SET_DEFAULT(type1.version, version);
-+    SMBIOS_SET_DEFAULT(type1.family, "Red Hat Enterprise Linux");
+     SMBIOS_SET_DEFAULT(smbios_type1.manufacturer, manufacturer);
+     SMBIOS_SET_DEFAULT(smbios_type1.product, product);
+     SMBIOS_SET_DEFAULT(smbios_type1.version, version);
++    SMBIOS_SET_DEFAULT(smbios_type1.family, "Red Hat Enterprise Linux");
 +    if (stream_version != NULL) {
-+        SMBIOS_SET_DEFAULT(type1.sku, stream_version);
++        SMBIOS_SET_DEFAULT(smbios_type1.sku, stream_version);
 +    }
      SMBIOS_SET_DEFAULT(type2.manufacturer, manufacturer);
 -    SMBIOS_SET_DEFAULT(type2.product, product);
@@ -513,20 +509,20 @@ index 2a90601ac5..7bde23e59d 100644
      SMBIOS_SET_DEFAULT(type3.manufacturer, manufacturer);
      SMBIOS_SET_DEFAULT(type3.version, version);
 diff --git a/hw/timer/i8254_common.c b/hw/timer/i8254_common.c
-index b25da448c8..0331e84398 100644
+index 28fdabc321..bad13ec224 100644
 --- a/hw/timer/i8254_common.c
 +++ b/hw/timer/i8254_common.c
 @@ -229,7 +229,7 @@ static const VMStateDescription vmstate_pit_common = {
      .pre_save = pit_dispatch_pre_save,
      .post_load = pit_dispatch_post_load,
-     .fields = (VMStateField[]) {
+     .fields = (const VMStateField[]) {
 -        VMSTATE_UINT32_V(channels[0].irq_disabled, PITCommonState, 3),
 +        VMSTATE_UINT32(channels[0].irq_disabled, PITCommonState), /* qemu-kvm's v2 had 'flags' here */
          VMSTATE_STRUCT_ARRAY(channels, PITCommonState, 3, 2,
                               vmstate_pit_channel, PITChannelState),
          VMSTATE_INT64(channels[0].next_transition_time,
 diff --git a/hw/usb/hcd-xhci-pci.c b/hw/usb/hcd-xhci-pci.c
-index 643d4643e4..529bad9366 100644
+index 4423983308..43b4b71fdf 100644
 --- a/hw/usb/hcd-xhci-pci.c
 +++ b/hw/usb/hcd-xhci-pci.c
 @@ -104,6 +104,33 @@ static int xhci_pci_vmstate_post_load(void *opaque, int version_id)
@@ -636,11 +632,26 @@ index 08f70ce97c..1be7527c1b 100644
  } XHCIPciState;
  
  #endif
+diff --git a/hw/virtio/virtio-mem.c b/hw/virtio/virtio-mem.c
+index ffd119ebac..0e2be2219c 100644
+--- a/hw/virtio/virtio-mem.c
++++ b/hw/virtio/virtio-mem.c
+@@ -1694,8 +1694,9 @@ static Property virtio_mem_properties[] = {
+ #endif
+     DEFINE_PROP_BOOL(VIRTIO_MEM_EARLY_MIGRATION_PROP, VirtIOMEM,
+                      early_migration, true),
++    /* RHEL: default-enable "dynamic-memslots" (jira RHEL-24045) */
+     DEFINE_PROP_BOOL(VIRTIO_MEM_DYNAMIC_MEMSLOTS_PROP, VirtIOMEM,
+-                     dynamic_memslots, false),
++                     dynamic_memslots, true),
+     DEFINE_PROP_END_OF_LIST(),
+ };
+ 
 diff --git a/include/hw/boards.h b/include/hw/boards.h
-index da85f86efb..4a21eddbf9 100644
+index 8b8f6d5c00..0466f9d0f3 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
-@@ -503,4 +503,44 @@ extern const size_t hw_compat_2_2_len;
+@@ -512,4 +512,44 @@ extern const size_t hw_compat_2_2_len;
  extern GlobalProperty hw_compat_2_1[];
  extern const size_t hw_compat_2_1_len;
  
@@ -686,26 +697,25 @@ index da85f86efb..4a21eddbf9 100644
 +extern const char *rhel_old_machine_deprecation;
  #endif
 diff --git a/include/hw/firmware/smbios.h b/include/hw/firmware/smbios.h
-index 7f3259a630..d24b3ccd32 100644
+index 8d3fb2fb3b..d9d6d7a169 100644
 --- a/include/hw/firmware/smbios.h
 +++ b/include/hw/firmware/smbios.h
-@@ -294,7 +294,10 @@ void smbios_entry_add(QemuOpts *opts, Error **errp);
+@@ -332,7 +332,9 @@ void smbios_entry_add(QemuOpts *opts, Error **errp);
  void smbios_set_cpuid(uint32_t version, uint32_t features);
  void smbios_set_defaults(const char *manufacturer, const char *product,
-                          const char *version, bool legacy_mode,
--                         bool uuid_encoded, SmbiosEntryPointType ep_type);
+                          const char *version,
+-                         bool uuid_encoded);
 +                         bool uuid_encoded,
 +                         const char *stream_product,
-+                         const char *stream_version,
-+                         SmbiosEntryPointType ep_type);
- uint8_t *smbios_get_table_legacy(MachineState *ms, size_t *length);
++                         const char *stream_version);
+ void smbios_set_default_processor_family(uint16_t processor_family);
+ uint8_t *smbios_get_table_legacy(size_t *length, Error **errp);
  void smbios_get_tables(MachineState *ms,
-                        const struct smbios_phys_mem_area *mem_array,
 diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
-index a10ceeabbf..037942d233 100644
+index 27a68071d7..ebd8f973f2 100644
 --- a/include/hw/i386/pc.h
 +++ b/include/hw/i386/pc.h
-@@ -113,6 +113,9 @@ struct PCMachineClass {
+@@ -112,6 +112,9 @@ struct PCMachineClass {
      bool smbios_legacy_mode;
      bool smbios_uuid_encoded;
      SmbiosEntryPointType default_smbios_ep_type;
diff --git a/SOURCES/0007-Add-aarch64-machine-types.patch b/SOURCES/0007-Add-aarch64-machine-types.patch
index fde7982..a556bb2 100644
--- a/SOURCES/0007-Add-aarch64-machine-types.patch
+++ b/SOURCES/0007-Add-aarch64-machine-types.patch
@@ -1,4 +1,4 @@
-From 23f614ab0b79ec1c6f65a7f0d6993bfdfc53fd23 Mon Sep 17 00:00:00 2001
+From cf398296f3fcee185a00f23de5deae57c97d648e Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 12:53:31 +0200
 Subject: Add aarch64 machine types
@@ -30,6 +30,9 @@ Rebase notes (8.0.0):
 Rebase notes (8.1.0):
 - Added setting default_nic
 
+Rebase notes (9.0.0 rc0):
+- call arm_virt_compat_set on rhel type class_init
+
 Merged patches (6.2.0):
 - 9a3d4fde0e hw/arm/virt: Remove 9.0 machine type
 - f7d04d6695 hw: arm: virt: Add hw_compat_rhel_8_5 to 8.5 machine type
@@ -64,34 +67,67 @@ Merged patches (8.1.0):
 
 Merged patches (8.2.0):
 - 4ee284aca9 Add machine types compat bits. (partial)
+
+Merged patches (9.0.0 rc0):
+- 117068376a hw/arm/virt: Fix compats
+- 8bcccfabc4 hw/arm/virt: Add properties to disable high memory regions
+- 0005a8b93a hw/arm/virt: deprecate virt-rhel9.{0,2}.0 machine types
 ---
- hw/arm/virt.c         | 250 +++++++++++++++++++++++++++++++++++++++++-
+ hw/arm/virt.c         | 299 +++++++++++++++++++++++++++++++++++++++++-
  include/hw/arm/virt.h |   8 ++
- 2 files changed, 257 insertions(+), 1 deletion(-)
+ 2 files changed, 306 insertions(+), 1 deletion(-)
 
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index 62f0f7d4d6..c541efee5e 100644
+index 36e9b4b4e9..22bc345137 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
-@@ -82,6 +82,7 @@
- #include "hw/char/pl011.h"
- #include "qemu/guest-random.h"
+@@ -101,6 +101,7 @@ static void arm_virt_compat_set(MachineClass *mc)
+                      arm_virt_compat_len);
+ }
  
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
  #define DEFINE_VIRT_MACHINE_LATEST(major, minor, latest) \
      static void virt_##major##_##minor##_class_init(ObjectClass *oc, \
                                                      void *data) \
-@@ -108,7 +109,48 @@
+@@ -128,7 +129,63 @@ static void arm_virt_compat_set(MachineClass *mc)
      DEFINE_VIRT_MACHINE_LATEST(major, minor, true)
  #define DEFINE_VIRT_MACHINE(major, minor) \
      DEFINE_VIRT_MACHINE_LATEST(major, minor, false)
 +#endif /* disabled for RHEL */
++
++/*
++ * This variable is for changes to properties that are RHEL specific,
++ * different to the current upstream and to be applied to the latest
++ * machine type. They may be overriden by older machine compats.
++ *
++ * virtio-net-pci variant romfiles are not needed because edk2 does
++ * fully support the pxe boot. Besides virtio romfiles are not shipped
++ * on rhel/aarch64.
++ */
++GlobalProperty arm_rhel_compat[] = {
++    {"virtio-net-pci", "romfile", "" },
++    {"virtio-net-pci-transitional", "romfile", "" },
++    {"virtio-net-pci-non-transitional", "romfile", "" },
++};
++const size_t arm_rhel_compat_len = G_N_ELEMENTS(arm_rhel_compat);
  
++/*
++ * This cannot be called from the rhel_virt_class_init() because
++ * TYPE_RHEL_MACHINE is abstract and mc->compat_props g_ptr_array_new()
++ * only is called on virt-rhelm.n.s non abstract class init.
++ */
++static void arm_rhel_compat_set(MachineClass *mc)
++{
++    compat_props_add(mc->compat_props, arm_rhel_compat,
++                     arm_rhel_compat_len);
++}
++
 +#define DEFINE_RHEL_MACHINE_LATEST(m, n, s, latest)                     \
 +    static void rhel##m##n##s##_virt_class_init(ObjectClass *oc,        \
 +                                                void *data)             \
 +    {                                                                   \
 +        MachineClass *mc = MACHINE_CLASS(oc);                           \
++        arm_rhel_compat_set(mc);                                        \
 +        rhel##m##n##s##_virt_options(mc);                               \
 +        mc->desc = "RHEL " # m "." # n "." # s " ARM Virtual Machine";  \
 +        if (latest) {                                                   \
@@ -114,23 +150,10 @@ index 62f0f7d4d6..c541efee5e 100644
 +    DEFINE_RHEL_MACHINE_LATEST(major, minor, subminor, true)
 +#define DEFINE_RHEL_MACHINE(major, minor, subminor)             \
 +    DEFINE_RHEL_MACHINE_LATEST(major, minor, subminor, false)
-+
-+/* This variable is for changes to properties that are RHEL specific,
-+ * different to the current upstream and to be applied to the latest
-+ * machine type.
-+ */
-+GlobalProperty arm_rhel_compat[] = {
-+    {
-+        .driver   = "virtio-net-pci",
-+        .property = "romfile",
-+        .value    = "",
-+    },
-+};
-+const size_t arm_rhel_compat_len = G_N_ELEMENTS(arm_rhel_compat);
  
  /* Number of external interrupt lines to configure the GIC with */
  #define NUM_IRQS 256
-@@ -2341,6 +2383,7 @@ static void machvirt_init(MachineState *machine)
+@@ -2355,6 +2412,7 @@ static void machvirt_init(MachineState *machine)
      qemu_add_machine_init_done_notifier(&vms->machine_done);
  }
  
@@ -138,7 +161,7 @@ index 62f0f7d4d6..c541efee5e 100644
  static bool virt_get_secure(Object *obj, Error **errp)
  {
      VirtMachineState *vms = VIRT_MACHINE(obj);
-@@ -2368,6 +2411,7 @@ static void virt_set_virt(Object *obj, bool value, Error **errp)
+@@ -2382,6 +2440,7 @@ static void virt_set_virt(Object *obj, bool value, Error **errp)
  
      vms->virt = value;
  }
@@ -146,7 +169,7 @@ index 62f0f7d4d6..c541efee5e 100644
  
  static bool virt_get_highmem(Object *obj, Error **errp)
  {
-@@ -2383,6 +2427,7 @@ static void virt_set_highmem(Object *obj, bool value, Error **errp)
+@@ -2397,6 +2456,7 @@ static void virt_set_highmem(Object *obj, bool value, Error **errp)
      vms->highmem = value;
  }
  
@@ -154,16 +177,23 @@ index 62f0f7d4d6..c541efee5e 100644
  static bool virt_get_compact_highmem(Object *obj, Error **errp)
  {
      VirtMachineState *vms = VIRT_MACHINE(obj);
-@@ -2438,7 +2483,7 @@ static void virt_set_highmem_mmio(Object *obj, bool value, Error **errp)
+@@ -2410,6 +2470,7 @@ static void virt_set_compact_highmem(Object *obj, bool value, Error **errp)
  
-     vms->highmem_mmio = value;
+     vms->highmem_compact = value;
  }
--
 +#endif /* disabled for RHEL */
  
+ static bool virt_get_highmem_redists(Object *obj, Error **errp)
+ {
+@@ -2453,7 +2514,6 @@ static void virt_set_highmem_mmio(Object *obj, bool value, Error **errp)
+     vms->highmem_mmio = value;
+ }
+ 
+-
  static bool virt_get_its(Object *obj, Error **errp)
  {
-@@ -2454,6 +2499,7 @@ static void virt_set_its(Object *obj, bool value, Error **errp)
+     VirtMachineState *vms = VIRT_MACHINE(obj);
+@@ -2468,6 +2528,7 @@ static void virt_set_its(Object *obj, bool value, Error **errp)
      vms->its = value;
  }
  
@@ -171,7 +201,7 @@ index 62f0f7d4d6..c541efee5e 100644
  static bool virt_get_dtb_randomness(Object *obj, Error **errp)
  {
      VirtMachineState *vms = VIRT_MACHINE(obj);
-@@ -2467,6 +2513,7 @@ static void virt_set_dtb_randomness(Object *obj, bool value, Error **errp)
+@@ -2481,6 +2542,7 @@ static void virt_set_dtb_randomness(Object *obj, bool value, Error **errp)
  
      vms->dtb_randomness = value;
  }
@@ -179,7 +209,7 @@ index 62f0f7d4d6..c541efee5e 100644
  
  static char *virt_get_oem_id(Object *obj, Error **errp)
  {
-@@ -2550,6 +2597,7 @@ static void virt_set_ras(Object *obj, bool value, Error **errp)
+@@ -2564,6 +2626,7 @@ static void virt_set_ras(Object *obj, bool value, Error **errp)
      vms->ras = value;
  }
  
@@ -187,7 +217,7 @@ index 62f0f7d4d6..c541efee5e 100644
  static bool virt_get_mte(Object *obj, Error **errp)
  {
      VirtMachineState *vms = VIRT_MACHINE(obj);
-@@ -2563,6 +2611,7 @@ static void virt_set_mte(Object *obj, bool value, Error **errp)
+@@ -2577,6 +2640,7 @@ static void virt_set_mte(Object *obj, bool value, Error **errp)
  
      vms->mte = value;
  }
@@ -195,7 +225,7 @@ index 62f0f7d4d6..c541efee5e 100644
  
  static char *virt_get_gic_version(Object *obj, Error **errp)
  {
-@@ -2935,6 +2984,7 @@ static int virt_kvm_type(MachineState *ms, const char *type_str)
+@@ -2949,6 +3013,7 @@ static int virt_kvm_type(MachineState *ms, const char *type_str)
      return fixed_ipa ? 0 : requested_pa_size;
  }
  
@@ -203,7 +233,7 @@ index 62f0f7d4d6..c541efee5e 100644
  static void virt_machine_class_init(ObjectClass *oc, void *data)
  {
      MachineClass *mc = MACHINE_CLASS(oc);
-@@ -3405,3 +3455,201 @@ static void virt_machine_2_6_options(MachineClass *mc)
+@@ -3463,3 +3528,235 @@ static void virt_machine_2_6_options(MachineClass *mc)
      vmc->no_pmu = true;
  }
  DEFINE_VIRT_MACHINE(2, 6)
@@ -213,6 +243,7 @@ index 62f0f7d4d6..c541efee5e 100644
 +{
 +    MachineClass *mc = MACHINE_CLASS(oc);
 +    HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(oc);
++    arm_virt_compat_set(mc);
 +
 +    mc->family = "virt-rhel-Z";
 +    mc->init = machvirt_init;
@@ -258,6 +289,28 @@ index 62f0f7d4d6..c541efee5e 100644
 +                                          "Set on/off to enable/disable using "
 +                                          "physical address space above 32 bits");
 +
++    object_class_property_add_bool(oc, "highmem-redists",
++                                   virt_get_highmem_redists,
++                                   virt_set_highmem_redists);
++    object_class_property_set_description(oc, "highmem-redists",
++                                          "Set on/off to enable/disable high "
++                                          "memory region for GICv3 or GICv4 "
++                                          "redistributor");
++
++    object_class_property_add_bool(oc, "highmem-ecam",
++                                   virt_get_highmem_ecam,
++                                   virt_set_highmem_ecam);
++    object_class_property_set_description(oc, "highmem-ecam",
++                                          "Set on/off to enable/disable high "
++                                          "memory region for PCI ECAM");
++
++    object_class_property_add_bool(oc, "highmem-mmio",
++                                   virt_get_highmem_mmio,
++                                   virt_set_highmem_mmio);
++    object_class_property_set_description(oc, "highmem-mmio",
++                                          "Set on/off to enable/disable high "
++                                          "memory region for PCI MMIO");
++
 +    object_class_property_add_str(oc, "gic-version", virt_get_gic_version,
 +                                  virt_set_gic_version);
 +    object_class_property_set_description(oc, "gic-version",
@@ -382,14 +435,24 @@ index 62f0f7d4d6..c541efee5e 100644
 +}
 +type_init(rhel_machine_init);
 +
++static void rhel940_virt_options(MachineClass *mc)
++{
++}
++DEFINE_RHEL_MACHINE_AS_LATEST(9, 4, 0)
++
 +static void rhel920_virt_options(MachineClass *mc)
 +{
-+    compat_props_add(mc->compat_props, arm_rhel_compat, arm_rhel_compat_len);
++    rhel940_virt_options(mc);
++
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_4, hw_compat_rhel_9_4_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_3, hw_compat_rhel_9_3_len);
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_2, hw_compat_rhel_9_2_len);
++
++    /* RHEL 9.4 is the first supported release */
++    mc->deprecation_reason =
++        "machine types for versions prior to 9.4 are deprecated";
 +}
-+DEFINE_RHEL_MACHINE_AS_LATEST(9, 2, 0)
++DEFINE_RHEL_MACHINE(9, 2, 0)
 +
 +static void rhel900_virt_options(MachineClass *mc)
 +{
@@ -398,6 +461,7 @@ index 62f0f7d4d6..c541efee5e 100644
 +    rhel920_virt_options(mc);
 +
 +    compat_props_add(mc->compat_props, hw_compat_rhel_9_1, hw_compat_rhel_9_1_len);
++    compat_props_add(mc->compat_props, hw_compat_rhel_9_0, hw_compat_rhel_9_0_len);
 +
 +    /* Disable FEAT_LPA2 since old kernels (<= v5.12) don't boot with that feature */
 +    vmc->no_tcg_lpa2 = true;
@@ -406,10 +470,10 @@ index 62f0f7d4d6..c541efee5e 100644
 +}
 +DEFINE_RHEL_MACHINE(9, 0, 0)
 diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
-index f69239850e..7b8abe5645 100644
+index bb486d36b1..237fc77bda 100644
 --- a/include/hw/arm/virt.h
 +++ b/include/hw/arm/virt.h
-@@ -177,9 +177,17 @@ struct VirtMachineState {
+@@ -179,9 +179,17 @@ struct VirtMachineState {
  
  #define VIRT_ECAM_ID(high) (high ? VIRT_HIGH_PCIE_ECAM : VIRT_PCIE_ECAM)
  
diff --git a/SOURCES/0008-Add-ppc64-machine-types.patch b/SOURCES/0008-Add-ppc64-machine-types.patch
index a269adb..87fcb3a 100644
--- a/SOURCES/0008-Add-ppc64-machine-types.patch
+++ b/SOURCES/0008-Add-ppc64-machine-types.patch
@@ -1,4 +1,4 @@
-From d03cff85f5f1b69b1a66011ebaa974ece81d31bc Mon Sep 17 00:00:00 2001
+From fb905dbe5b51ed899062ef99a2dd7f238d3e3384 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 13:27:13 +0200
 Subject: Add ppc64 machine types
@@ -34,20 +34,20 @@ Merged patches (7.1.0):
  8 files changed, 314 insertions(+), 1 deletion(-)
 
 diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
-index df09aa9d6a..ff459e1a46 100644
+index e9bc97fee0..a258d81846 100644
 --- a/hw/ppc/spapr.c
 +++ b/hw/ppc/spapr.c
-@@ -1689,6 +1689,9 @@ static void spapr_machine_reset(MachineState *machine, ShutdownCause reason)
- 
+@@ -1718,6 +1718,9 @@ static void spapr_machine_reset(MachineState *machine, ShutdownCause reason)
      pef_kvm_reset(machine->cgs, &error_fatal);
      spapr_caps_apply(spapr);
+     spapr_nested_reset(spapr);
 +    if (spapr->svm_allowed) {
 +        kvmppc_svm_allow(&error_fatal);
 +    }
  
      first_ppc_cpu = POWERPC_CPU(first_cpu);
      if (kvm_enabled() && kvmppc_has_cap_mmu_radix() &&
-@@ -3397,6 +3400,20 @@ static void spapr_set_host_serial(Object *obj, const char *value, Error **errp)
+@@ -3421,6 +3424,20 @@ static void spapr_set_host_serial(Object *obj, const char *value, Error **errp)
      spapr->host_serial = g_strdup(value);
  }
  
@@ -68,7 +68,7 @@ index df09aa9d6a..ff459e1a46 100644
  static void spapr_instance_init(Object *obj)
  {
      SpaprMachineState *spapr = SPAPR_MACHINE(obj);
-@@ -3475,6 +3492,12 @@ static void spapr_instance_init(Object *obj)
+@@ -3499,6 +3516,12 @@ static void spapr_instance_init(Object *obj)
          spapr_get_host_serial, spapr_set_host_serial);
      object_property_set_description(obj, "host-serial",
          "Host serial number to advertise in guest device tree");
@@ -81,7 +81,7 @@ index df09aa9d6a..ff459e1a46 100644
  }
  
  static void spapr_machine_finalizefn(Object *obj)
-@@ -4734,6 +4757,7 @@ static void spapr_machine_class_init(ObjectClass *oc, void *data)
+@@ -4754,6 +4777,7 @@ static void spapr_machine_class_init(ObjectClass *oc, void *data)
      vmc->client_architecture_support = spapr_vof_client_architecture_support;
      vmc->quiesce = spapr_vof_quiesce;
      vmc->setprop = spapr_vof_setprop;
@@ -89,15 +89,15 @@ index df09aa9d6a..ff459e1a46 100644
  }
  
  static const TypeInfo spapr_machine_info = {
-@@ -4785,6 +4809,7 @@ static void spapr_machine_latest_class_options(MachineClass *mc)
+@@ -4805,6 +4829,7 @@ static void spapr_machine_latest_class_options(MachineClass *mc)
      }                                                                \
      type_init(spapr_machine_register_##suffix)
  
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
  /*
-  * pseries-8.2
+  * pseries-9.0
   */
-@@ -4967,6 +4992,7 @@ static void spapr_machine_4_1_class_options(MachineClass *mc)
+@@ -4998,6 +5023,7 @@ static void spapr_machine_4_1_class_options(MachineClass *mc)
  }
  
  DEFINE_SPAPR_MACHINE(4_1, "4.1", false);
@@ -105,7 +105,7 @@ index df09aa9d6a..ff459e1a46 100644
  
  /*
   * pseries-4.0
-@@ -4982,6 +5008,8 @@ static bool phb_placement_4_0(SpaprMachineState *spapr, uint32_t index,
+@@ -5013,6 +5039,8 @@ static bool phb_placement_4_0(SpaprMachineState *spapr, uint32_t index,
      }
      return true;
  }
@@ -114,7 +114,7 @@ index df09aa9d6a..ff459e1a46 100644
  static void spapr_machine_4_0_class_options(MachineClass *mc)
  {
      SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
-@@ -5306,6 +5334,221 @@ static void spapr_machine_2_1_class_options(MachineClass *mc)
+@@ -5338,6 +5366,221 @@ static void spapr_machine_2_1_class_options(MachineClass *mc)
      compat_props_add(mc->compat_props, hw_compat_2_1, hw_compat_2_1_len);
  }
  DEFINE_SPAPR_MACHINE(2_1, "2.1", false);
@@ -337,7 +337,7 @@ index df09aa9d6a..ff459e1a46 100644
  static void spapr_machine_register_types(void)
  {
 diff --git a/hw/ppc/spapr_cpu_core.c b/hw/ppc/spapr_cpu_core.c
-index 33e0c8724c..9d01663f43 100644
+index 3b0a47a28c..375e0c8e45 100644
 --- a/hw/ppc/spapr_cpu_core.c
 +++ b/hw/ppc/spapr_cpu_core.c
 @@ -25,6 +25,7 @@
@@ -348,7 +348,7 @@ index 33e0c8724c..9d01663f43 100644
  
  static void spapr_reset_vcpu(PowerPCCPU *cpu)
  {
-@@ -261,6 +262,7 @@ static bool spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
+@@ -264,6 +265,7 @@ static bool spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
  {
      CPUPPCState *env = &cpu->env;
      CPUState *cs = CPU(cpu);
@@ -356,7 +356,7 @@ index 33e0c8724c..9d01663f43 100644
  
      if (!qdev_realize(DEVICE(cpu), NULL, errp)) {
          return false;
-@@ -277,6 +279,17 @@ static bool spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
+@@ -280,6 +282,17 @@ static bool spapr_realize_vcpu(PowerPCCPU *cpu, SpaprMachineState *spapr,
      /* Set time-base frequency to 512 MHz. vhyp must be set first. */
      cpu_ppc_tb_init(env, SPAPR_TIMEBASE_FREQ);
  
@@ -375,10 +375,10 @@ index 33e0c8724c..9d01663f43 100644
          qdev_unrealize(DEVICE(cpu));
          return false;
 diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
-index e91791a1a9..1951d8a2a0 100644
+index 4aaf23d28f..3233c54d11 100644
 --- a/include/hw/ppc/spapr.h
 +++ b/include/hw/ppc/spapr.h
-@@ -154,6 +154,7 @@ struct SpaprMachineClass {
+@@ -157,6 +157,7 @@ struct SpaprMachineClass {
      bool pre_5_2_numa_associativity;
      bool pre_6_2_numa_affinity;
  
@@ -386,7 +386,7 @@ index e91791a1a9..1951d8a2a0 100644
      bool (*phb_placement)(SpaprMachineState *spapr, uint32_t index,
                            uint64_t *buid, hwaddr *pio,
                            hwaddr *mmio32, hwaddr *mmio64,
-@@ -256,6 +257,9 @@ struct SpaprMachineState {
+@@ -259,6 +260,9 @@ struct SpaprMachineState {
      /* Set by -boot */
      char *boot_device;
  
@@ -422,10 +422,10 @@ index ebef2cccec..ff2c00c60e 100644
      const CompatInfo *compat = compat_by_pvr(compat_pvr);
      const CompatInfo *min = compat_by_pvr(min_compat_pvr);
 diff --git a/target/ppc/cpu-models.c b/target/ppc/cpu-models.c
-index 69fddb05bc..64a05aaef3 100644
+index f77ebfcc81..18e9422006 100644
 --- a/target/ppc/cpu-models.c
 +++ b/target/ppc/cpu-models.c
-@@ -748,6 +748,7 @@
+@@ -744,6 +744,7 @@
  /* PowerPC CPU aliases                                                     */
  
  PowerPCCPUAlias ppc_cpu_aliases[] = {
@@ -434,10 +434,10 @@ index 69fddb05bc..64a05aaef3 100644
      { "405cr", "405crc" },
      { "405gp", "405gpd" },
 diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
-index f8101ffa29..e799a2bee6 100644
+index 67e6b2effd..11187aeb93 100644
 --- a/target/ppc/cpu.h
 +++ b/target/ppc/cpu.h
-@@ -1635,6 +1635,7 @@ static inline int cpu_mmu_index(CPUPPCState *env, bool ifetch)
+@@ -1655,6 +1655,7 @@ static inline int ppc_env_mmu_index(CPUPPCState *env, bool ifetch)
  
  /* Compatibility modes */
  #if defined(TARGET_PPC64)
@@ -446,7 +446,7 @@ index f8101ffa29..e799a2bee6 100644
                        uint32_t min_compat_pvr, uint32_t max_compat_pvr);
  bool ppc_type_check_compat(const char *cputype, uint32_t compat_pvr,
 diff --git a/target/ppc/kvm.c b/target/ppc/kvm.c
-index 9b1abe2fc4..56f1c46e8e 100644
+index 8231feb2d4..59f640cf7b 100644
 --- a/target/ppc/kvm.c
 +++ b/target/ppc/kvm.c
 @@ -89,6 +89,7 @@ static int cap_large_decr;
@@ -465,7 +465,7 @@ index 9b1abe2fc4..56f1c46e8e 100644
      cap_large_decr = kvmppc_get_dec_bits();
      cap_fwnmi = kvm_vm_check_extension(s, KVM_CAP_PPC_FWNMI);
      /*
-@@ -2579,6 +2581,16 @@ bool kvmppc_supports_ail_3(void)
+@@ -2564,6 +2566,16 @@ bool kvmppc_supports_ail_3(void)
      return cap_ail_mode_3;
  }
  
@@ -482,7 +482,7 @@ index 9b1abe2fc4..56f1c46e8e 100644
  PowerPCCPUClass *kvm_ppc_get_host_cpu_class(void)
  {
      uint32_t host_pvr = mfpvr();
-@@ -2979,3 +2991,18 @@ bool kvm_arch_cpu_check_are_resettable(void)
+@@ -2964,3 +2976,18 @@ bool kvm_arch_cpu_check_are_resettable(void)
  void kvm_arch_accel_class_init(ObjectClass *oc)
  {
  }
diff --git a/SOURCES/0009-Add-s390x-machine-types.patch b/SOURCES/0009-Add-s390x-machine-types.patch
index c3b9936..b9709f1 100644
--- a/SOURCES/0009-Add-s390x-machine-types.patch
+++ b/SOURCES/0009-Add-s390x-machine-types.patch
@@ -1,4 +1,4 @@
-From 3623043d4a923bf9f541d439c76e7874cf0fa81d Mon Sep 17 00:00:00 2001
+From 04178c77cfe188b4eed9c08a0bf66842e61fe5dc Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 13:47:32 +0200
 Subject: Add s390x machine types
@@ -49,18 +49,18 @@ Merged patches (8.2.0):
  4 files changed, 174 insertions(+)
 
 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
-index 7262725d2e..984891b82a 100644
+index b1dcb3857f..ff753a29e0 100644
 --- a/hw/s390x/s390-virtio-ccw.c
 +++ b/hw/s390x/s390-virtio-ccw.c
-@@ -855,6 +855,7 @@ bool css_migration_enabled(void)
+@@ -859,6 +859,7 @@ bool css_migration_enabled(void)
      }                                                                         \
      type_init(ccw_machine_register_##suffix)
  
 +#if 0 /* Disabled for Red Hat Enterprise Linux */
- static void ccw_machine_8_2_instance_options(MachineState *machine)
+ static void ccw_machine_9_0_instance_options(MachineState *machine)
  {
  }
-@@ -1256,6 +1257,164 @@ static void ccw_machine_2_4_class_options(MachineClass *mc)
+@@ -1272,6 +1273,164 @@ static void ccw_machine_2_4_class_options(MachineClass *mc)
      compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
  }
  DEFINE_CCW_MACHINE(2_4, "2.4", false);
@@ -226,7 +226,7 @@ index 7262725d2e..984891b82a 100644
  static void ccw_machine_register_types(void)
  {
 diff --git a/target/s390x/cpu_models.c b/target/s390x/cpu_models.c
-index a63d990e4e..198b81f2c0 100644
+index 8ed3bb6a27..370b3b3065 100644
 --- a/target/s390x/cpu_models.c
 +++ b/target/s390x/cpu_models.c
 @@ -46,6 +46,9 @@
@@ -239,7 +239,7 @@ index a63d990e4e..198b81f2c0 100644
  static S390CPUDef s390_cpu_defs[] = {
      CPUDEF_INIT(0x2064, 7, 1, 38, 0x00000000U, "z900", "IBM zSeries 900 GA1"),
      CPUDEF_INIT(0x2064, 7, 2, 38, 0x00000000U, "z900.2", "IBM zSeries 900 GA2"),
-@@ -856,22 +859,30 @@ static void s390_host_cpu_model_class_init(ObjectClass *oc, void *data)
+@@ -866,22 +869,30 @@ static void s390_host_cpu_model_class_init(ObjectClass *oc, void *data)
  static void s390_base_cpu_model_class_init(ObjectClass *oc, void *data)
  {
      S390CPUClass *xcc = S390_CPU_CLASS(oc);
@@ -284,10 +284,10 @@ index d7b8912989..1a806a97c4 100644
  
  /* CPU model based on a CPU definition */
 diff --git a/target/s390x/cpu_models_sysemu.c b/target/s390x/cpu_models_sysemu.c
-index 87a4480c05..28c1b0486c 100644
+index 0728bfcc20..ca2e5d91e2 100644
 --- a/target/s390x/cpu_models_sysemu.c
 +++ b/target/s390x/cpu_models_sysemu.c
-@@ -60,6 +60,7 @@ static void create_cpu_model_list(ObjectClass *klass, void *opaque)
+@@ -59,6 +59,7 @@ static void create_cpu_model_list(ObjectClass *klass, void *opaque)
      CpuDefinitionInfo *info;
      char *name = g_strdup(object_class_get_name(klass));
      S390CPUClass *scc = S390_CPU_CLASS(klass);
@@ -295,7 +295,7 @@ index 87a4480c05..28c1b0486c 100644
  
      /* strip off the -s390x-cpu */
      g_strrstr(name, "-" TYPE_S390_CPU)[0] = 0;
-@@ -69,6 +70,7 @@ static void create_cpu_model_list(ObjectClass *klass, void *opaque)
+@@ -68,6 +69,7 @@ static void create_cpu_model_list(ObjectClass *klass, void *opaque)
      info->migration_safe = scc->is_migration_safe;
      info->q_static = scc->is_static;
      info->q_typename = g_strdup(object_class_get_name(klass));
diff --git a/SOURCES/0010-Add-x86_64-machine-types.patch b/SOURCES/0010-Add-x86_64-machine-types.patch
index d24bb57..83ee4a3 100644
--- a/SOURCES/0010-Add-x86_64-machine-types.patch
+++ b/SOURCES/0010-Add-x86_64-machine-types.patch
@@ -1,4 +1,4 @@
-From b432505cb28bc3b9b0c1849210ac6c63bca3fe37 Mon Sep 17 00:00:00 2001
+From 3c88acb005806ad2386ab6c94a8831151f624738 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Fri, 19 Oct 2018 13:10:31 +0200
 Subject: Add x86_64 machine types
@@ -57,23 +57,40 @@ Merged patches (8.1.0):
 Merged patches (8.2.0):
 - 4ee284aca9 Add machine types compat bits. (partial)
 - 719e2ac147 Fix x86 machine type compatibility for qemu-kvm 8.1.0
+
+Merged patches (9.0.0 rc0):
+- 9149e2bc8f x86: rhel 9.2.0 machine type compat fix
 ---
+ hw/i386/fw_cfg.c           |   2 +-
  hw/i386/pc.c               | 159 ++++++++++++++++++++-
- hw/i386/pc_piix.c          | 112 ++++++++++++++-
- hw/i386/pc_q35.c           | 285 ++++++++++++++++++++++++++++++++++++-
+ hw/i386/pc_piix.c          | 109 ++++++++++++++
+ hw/i386/pc_q35.c           | 285 +++++++++++++++++++++++++++++++++++++
  include/hw/boards.h        |   2 +
  include/hw/i386/pc.h       |  33 +++++
  target/i386/cpu.c          |  21 +++
  target/i386/kvm/kvm-cpu.c  |   1 +
  target/i386/kvm/kvm.c      |   4 +
  tests/qtest/pvpanic-test.c |   5 +-
- 9 files changed, 615 insertions(+), 7 deletions(-)
+ 10 files changed, 617 insertions(+), 4 deletions(-)
 
+diff --git a/hw/i386/fw_cfg.c b/hw/i386/fw_cfg.c
+index c7aa39a13e..283c3f4c16 100644
+--- a/hw/i386/fw_cfg.c
++++ b/hw/i386/fw_cfg.c
+@@ -63,7 +63,7 @@ void fw_cfg_build_smbios(PCMachineState *pcms, FWCfgState *fw_cfg,
+ 
+     if (pcmc->smbios_defaults) {
+         /* These values are guest ABI, do not change */
+-        smbios_set_defaults("QEMU", mc->desc, mc->name,
++        smbios_set_defaults("Red Hat", "KVM", mc->desc,
+                             pcmc->smbios_uuid_encoded,
+                             pcmc->smbios_stream_product, pcmc->smbios_stream_version);
+     }
 diff --git a/hw/i386/pc.c b/hw/i386/pc.c
-index 29b9964733..a1faa9e92c 100644
+index 5c21b0c4db..4a154c1a9a 100644
 --- a/hw/i386/pc.c
 +++ b/hw/i386/pc.c
-@@ -323,6 +323,161 @@ GlobalProperty pc_compat_2_0[] = {
+@@ -326,6 +326,161 @@ GlobalProperty pc_compat_2_0[] = {
  };
  const size_t pc_compat_2_0_len = G_N_ELEMENTS(pc_compat_2_0);
  
@@ -235,15 +252,15 @@ index 29b9964733..a1faa9e92c 100644
  GSIState *pc_gsi_create(qemu_irq **irqs, bool pci_enabled)
  {
      GSIState *s;
-@@ -1826,6 +1981,7 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
-     pcmc->kvmclock_create_always = true;
+@@ -1813,6 +1968,7 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
      pcmc->resizable_acpi_blob = true;
+     x86mc->apic_xrupt_override = true;
      assert(!mc->get_hotplug_handler);
 +    mc->async_pf_vmexit_disable = false;
      mc->get_hotplug_handler = pc_get_hotplug_handler;
      mc->hotplug_allowed = pc_hotplug_allowed;
      mc->cpu_index_to_instance_props = x86_cpu_index_to_props;
-@@ -1836,7 +1992,8 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
+@@ -1823,7 +1979,8 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
      mc->has_hotpluggable_cpus = true;
      mc->default_boot_order = "cad";
      mc->block_default_type = IF_IDE;
@@ -254,10 +271,10 @@ index 29b9964733..a1faa9e92c 100644
      mc->wakeup = pc_machine_wakeup;
      hc->pre_plug = pc_machine_device_pre_plug_cb;
 diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
-index 2a9f465619..44038391fb 100644
+index 18ba076609..a647262d63 100644
 --- a/hw/i386/pc_piix.c
 +++ b/hw/i386/pc_piix.c
-@@ -53,6 +53,7 @@
+@@ -52,6 +52,7 @@
  #include "qapi/error.h"
  #include "qemu/error-report.h"
  #include "sysemu/xen.h"
@@ -265,18 +282,7 @@ index 2a9f465619..44038391fb 100644
  #ifdef CONFIG_XEN
  #include <xen/hvm/hvm_info_table.h>
  #include "hw/xen/xen_pt.h"
-@@ -235,8 +236,8 @@ static void pc_init1(MachineState *machine,
-     if (pcmc->smbios_defaults) {
-         MachineClass *mc = MACHINE_GET_CLASS(machine);
-         /* These values are guest ABI, do not change */
--        smbios_set_defaults("QEMU", mc->desc,
--                            mc->name, pcmc->smbios_legacy_mode,
-+        smbios_set_defaults("Red Hat", "KVM",
-+                            mc->desc, pcmc->smbios_legacy_mode,
-                             pcmc->smbios_uuid_encoded,
-                             pcmc->smbios_stream_product,
-                             pcmc->smbios_stream_version,
-@@ -453,6 +454,7 @@ static void pc_set_south_bridge(Object *obj, int value, Error **errp)
+@@ -422,6 +423,7 @@ static void pc_set_south_bridge(Object *obj, int value, Error **errp)
   * hw_compat_*, pc_compat_*, or * pc_*_machine_options().
   */
  
@@ -284,7 +290,7 @@ index 2a9f465619..44038391fb 100644
  static void pc_compat_2_3_fn(MachineState *machine)
  {
      X86MachineState *x86ms = X86_MACHINE(machine);
-@@ -970,3 +972,109 @@ static void xenfv_3_1_machine_options(MachineClass *m)
+@@ -951,3 +953,110 @@ static void xenfv_3_1_machine_options(MachineClass *m)
  DEFINE_PC_MACHINE(xenfv, "xenfv-3.1", pc_xen_hvm_init,
                    xenfv_3_1_machine_options);
  #endif
@@ -314,8 +320,7 @@ index 2a9f465619..44038391fb 100644
 +
 +static void pc_init_rhel760(MachineState *machine)
 +{
-+    pc_init1(machine, TYPE_I440FX_PCI_HOST_BRIDGE, \
-+             TYPE_I440FX_PCI_DEVICE);
++    pc_init1(machine, TYPE_I440FX_PCI_DEVICE);
 +}
 +
 +static void pc_machine_rhel760_options(MachineClass *m)
@@ -339,6 +344,8 @@ index 2a9f465619..44038391fb 100644
 +    pcmc->enforce_amd_1tb_hole = false;
 +    /* From pc_i440fx_8_0_machine_options() */
 +    pcmc->default_smbios_ep_type = SMBIOS_ENTRY_POINT_TYPE_32;
++    /* From pc_i440fx_8_1_machine_options() */
++    pcmc->broken_32bit_mem_addr_check = true;
 +    /* Introduced in QEMU 8.2 */
 +    pcmc->default_south_bridge = TYPE_PIIX3_DEVICE;
 +
@@ -395,21 +402,10 @@ index 2a9f465619..44038391fb 100644
 +DEFINE_PC_MACHINE(rhel760, "pc-i440fx-rhel7.6.0", pc_init_rhel760,
 +                  pc_machine_rhel760_options);
 diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
-index 912cb0c0dc..6387df97c8 100644
+index c7bc8a2041..e872dc7e46 100644
 --- a/hw/i386/pc_q35.c
 +++ b/hw/i386/pc_q35.c
-@@ -203,8 +203,8 @@ static void pc_q35_init(MachineState *machine)
- 
-     if (pcmc->smbios_defaults) {
-         /* These values are guest ABI, do not change */
--        smbios_set_defaults("QEMU", mc->desc,
--                            mc->name, pcmc->smbios_legacy_mode,
-+        smbios_set_defaults("Red Hat", "KVM",
-+                            mc->desc, pcmc->smbios_legacy_mode,
-                             pcmc->smbios_uuid_encoded,
-                             pcmc->smbios_stream_product,
-                             pcmc->smbios_stream_version,
-@@ -363,6 +363,7 @@ static void pc_q35_init(MachineState *machine)
+@@ -341,6 +341,7 @@ static void pc_q35_init(MachineState *machine)
      DEFINE_PC_MACHINE(suffix, name, pc_init_##suffix, optionfn)
  
  
@@ -417,7 +413,7 @@ index 912cb0c0dc..6387df97c8 100644
  static void pc_q35_machine_options(MachineClass *m)
  {
      PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-@@ -699,3 +700,283 @@ static void pc_q35_2_4_machine_options(MachineClass *m)
+@@ -693,3 +694,287 @@ static void pc_q35_2_4_machine_options(MachineClass *m)
  
  DEFINE_Q35_MACHINE(v2_4, "pc-q35-2.4", NULL,
                     pc_q35_2_4_machine_options);
@@ -444,6 +440,8 @@ index 912cb0c0dc..6387df97c8 100644
 +    m->alias = "q35";
 +    m->max_cpus = 710;
 +    compat_props_add(m->compat_props, pc_rhel_compat, pc_rhel_compat_len);
++    compat_props_add(m->compat_props,
++                     pc_q35_compat_defaults, pc_q35_compat_defaults_len);
 +}
 +
 +static void pc_q35_init_rhel940(MachineState *machine)
@@ -480,6 +478,8 @@ index 912cb0c0dc..6387df97c8 100644
 +
 +    /* From pc_q35_8_0_machine_options() */
 +    pcmc->default_smbios_ep_type = SMBIOS_ENTRY_POINT_TYPE_32;
++    /* From pc_q35_8_1_machine_options() */
++    pcmc->broken_32bit_mem_addr_check = true;
 +
 +    compat_props_add(m->compat_props, hw_compat_rhel_9_4,
 +                     hw_compat_rhel_9_4_len);
@@ -702,10 +702,10 @@ index 912cb0c0dc..6387df97c8 100644
 +DEFINE_PC_MACHINE(q35_rhel760, "pc-q35-rhel7.6.0", pc_q35_init_rhel760,
 +                  pc_q35_machine_rhel760_options);
 diff --git a/include/hw/boards.h b/include/hw/boards.h
-index 4a21eddbf9..4edfdb0ddb 100644
+index 0466f9d0f3..46b8725c41 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
-@@ -277,6 +277,8 @@ struct MachineClass {
+@@ -283,6 +283,8 @@ struct MachineClass {
      strList *allowed_dynamic_sysbus_devices;
      bool auto_enable_numa_with_memhp;
      bool auto_enable_numa_with_memdev;
@@ -715,12 +715,12 @@ index 4a21eddbf9..4edfdb0ddb 100644
      bool smbus_no_migration_support;
      bool nvdimm_supported;
 diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
-index 037942d233..37644ede7e 100644
+index ebd8f973f2..a984c951ad 100644
 --- a/include/hw/i386/pc.h
 +++ b/include/hw/i386/pc.h
-@@ -314,6 +314,39 @@ extern const size_t pc_compat_1_4_len;
- 
- int pc_machine_kvm_type(MachineState *machine, const char *vm_type);
+@@ -291,6 +291,39 @@ extern const size_t pc_compat_2_1_len;
+ extern GlobalProperty pc_compat_2_0[];
+ extern const size_t pc_compat_2_0_len;
  
 +extern GlobalProperty pc_rhel_compat[];
 +extern const size_t pc_rhel_compat_len;
@@ -759,7 +759,7 @@ index 037942d233..37644ede7e 100644
      static void pc_machine_##suffix##_class_init(ObjectClass *oc, void *data) \
      { \
 diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index cd16cb893d..93203d9b91 100644
+index 33760a2ee1..be7b0663cd 100644
 --- a/target/i386/cpu.c
 +++ b/target/i386/cpu.c
 @@ -2190,9 +2190,13 @@ static const CPUCaches epyc_genoa_cache_info = {
@@ -925,10 +925,10 @@ index 9c791b7b05..b91af5051f 100644
  };
  
 diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
-index 4ce80555b4..9d41edf01e 100644
+index e68cbe9293..739f33db47 100644
 --- a/target/i386/kvm/kvm.c
 +++ b/target/i386/kvm/kvm.c
-@@ -3711,6 +3711,7 @@ static int kvm_get_msrs(X86CPU *cpu)
+@@ -3715,6 +3715,7 @@ static int kvm_get_msrs(X86CPU *cpu)
      struct kvm_msr_entry *msrs = cpu->kvm_msr_buf->entries;
      int ret, i;
      uint64_t mtrr_top_bits;
@@ -936,7 +936,7 @@ index 4ce80555b4..9d41edf01e 100644
  
      kvm_msr_buf_reset(cpu);
  
-@@ -4065,6 +4066,9 @@ static int kvm_get_msrs(X86CPU *cpu)
+@@ -4069,6 +4070,9 @@ static int kvm_get_msrs(X86CPU *cpu)
              break;
          case MSR_KVM_ASYNC_PF_EN:
              env->async_pf_en_msr = msrs[i].data;
diff --git a/SOURCES/0011-Enable-make-check.patch b/SOURCES/0011-Enable-make-check.patch
index 54015c0..502bc67 100644
--- a/SOURCES/0011-Enable-make-check.patch
+++ b/SOURCES/0011-Enable-make-check.patch
@@ -1,4 +1,4 @@
-From 66a0510405e5142a1f9e38e0770aa0f10aed3e03 Mon Sep 17 00:00:00 2001
+From 5768cf6811842e5c59da3b752f60659a9d6b5ba1 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 2 Sep 2020 09:39:41 +0200
 Subject: Enable make check
@@ -63,10 +63,10 @@ Merged patches (8.1.0):
  13 files changed, 33 insertions(+), 30 deletions(-)
 
 diff --git a/tests/avocado/replay_kernel.py b/tests/avocado/replay_kernel.py
-index c37afa662c..61c95a2198 100644
+index 10d99403a4..c3422ea1e4 100644
 --- a/tests/avocado/replay_kernel.py
 +++ b/tests/avocado/replay_kernel.py
-@@ -153,7 +153,7 @@ def test_aarch64_virt(self):
+@@ -166,7 +166,7 @@ def test_aarch64_virt(self):
          """
          :avocado: tags=arch:aarch64
          :avocado: tags=machine:virt
@@ -76,7 +76,7 @@ index c37afa662c..61c95a2198 100644
          kernel_url = ('https://archives.fedoraproject.org/pub/archive/fedora'
                        '/linux/releases/29/Everything/aarch64/os/images/pxeboot'
 diff --git a/tests/avocado/reverse_debugging.py b/tests/avocado/reverse_debugging.py
-index 4cce5a5598..e9248a04a2 100644
+index 92855a02a5..87822074b6 100644
 --- a/tests/avocado/reverse_debugging.py
 +++ b/tests/avocado/reverse_debugging.py
 @@ -230,7 +230,7 @@ def test_aarch64_virt(self):
@@ -120,7 +120,7 @@ index 15fd87b2c1..f0d9d89c93 100644
          kernel_path = self._grab_aarch64_kernel()
          kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
 diff --git a/tests/qemu-iotests/meson.build b/tests/qemu-iotests/meson.build
-index 53847cb98f..a2abdb650e 100644
+index fad340ad59..3c0d5241f6 100644
 --- a/tests/qemu-iotests/meson.build
 +++ b/tests/qemu-iotests/meson.build
 @@ -51,21 +51,21 @@ foreach format, speed: qemu_iotests_formats
@@ -163,7 +163,7 @@ index 53847cb98f..a2abdb650e 100644
 +#  endforeach
  endforeach
 diff --git a/tests/qemu-iotests/testenv.py b/tests/qemu-iotests/testenv.py
-index 3ff38f2661..cab9a2bd6c 100644
+index 588f30a4f1..3929a3634f 100644
 --- a/tests/qemu-iotests/testenv.py
 +++ b/tests/qemu-iotests/testenv.py
 @@ -244,6 +244,9 @@ def __init__(self, source_dir: str, build_dir: str,
@@ -216,7 +216,7 @@ index 663bb6c485..2efc43e3f7 100644
                     "-device intel-hda,id=" HDA_ID CODEC_DEVICES);
  
 diff --git a/tests/qtest/libqos/meson.build b/tests/qtest/libqos/meson.build
-index 90aae42a22..9bc4e41af0 100644
+index 3aed6efcb8..119613237e 100644
 --- a/tests/qtest/libqos/meson.build
 +++ b/tests/qtest/libqos/meson.build
 @@ -44,7 +44,7 @@ libqos_srcs = files(
@@ -242,10 +242,10 @@ index 8ac95b89f7..cd2102555c 100644
  
      qtest_outl(s, 0xcf8, 0x8000f840); /* PMBASE */
 diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
-index 47dabf91d0..0bdfa3a821 100644
+index 36c5c13a7b..a2887d6057 100644
 --- a/tests/qtest/meson.build
 +++ b/tests/qtest/meson.build
-@@ -97,7 +97,6 @@ qtests_i386 = \
+@@ -101,7 +101,6 @@ qtests_i386 = \
     'drive_del-test',
     'tco-test',
     'cpu-plug-test',
@@ -254,7 +254,7 @@ index 47dabf91d0..0bdfa3a821 100644
     'migration-test',
     'test-x86-cpuid-compat',
 diff --git a/tests/qtest/virtio-net-failover.c b/tests/qtest/virtio-net-failover.c
-index 0d40bc1f2d..4c633c1584 100644
+index 73dfabc272..a9dd304781 100644
 --- a/tests/qtest/virtio-net-failover.c
 +++ b/tests/qtest/virtio-net-failover.c
 @@ -26,6 +26,7 @@
diff --git a/SOURCES/0012-vfio-cap-number-of-devices-that-can-be-assigned.patch b/SOURCES/0012-vfio-cap-number-of-devices-that-can-be-assigned.patch
index 8222efd..e8bf13a 100644
--- a/SOURCES/0012-vfio-cap-number-of-devices-that-can-be-assigned.patch
+++ b/SOURCES/0012-vfio-cap-number-of-devices-that-can-be-assigned.patch
@@ -1,4 +1,4 @@
-From a27cfa0b407bd806ce389a7c69d0130bcfd35244 Mon Sep 17 00:00:00 2001
+From e06a905d726fc20ea6bd95dff1bd0ffe97ebb202 Mon Sep 17 00:00:00 2001
 From: Bandan Das <bsd@redhat.com>
 Date: Tue, 3 Dec 2013 20:05:13 +0100
 Subject: vfio: cap number of devices that can be assigned
@@ -27,7 +27,7 @@ to 64 as some usecases require more than 32 devices.
 
 Signed-off-by: Bandan Das <bsd@redhat.com>
 
-Rebase changes (231025):
+Rebase changes (8.2.0):
 - Update to upstream changes
 ---
  hw/vfio/pci.c | 31 ++++++++++++++++++++++++++++++-
@@ -35,10 +35,10 @@ Rebase changes (231025):
  2 files changed, 31 insertions(+), 1 deletion(-)
 
 diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
-index c62c02f7b6..ec98080f28 100644
+index 64780d1b79..57ac63c10c 100644
 --- a/hw/vfio/pci.c
 +++ b/hw/vfio/pci.c
-@@ -48,6 +48,9 @@
+@@ -50,6 +50,9 @@
  /* Protected by BQL */
  static KVMRouteChange vfio_route_change;
  
@@ -48,15 +48,14 @@ index c62c02f7b6..ec98080f28 100644
  static void vfio_disable_interrupts(VFIOPCIDevice *vdev);
  static void vfio_mmap_set_enabled(VFIOPCIDevice *vdev, bool enabled);
  static void vfio_msi_disable_common(VFIOPCIDevice *vdev);
-@@ -3076,14 +3079,37 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
- {
+@@ -2946,13 +2949,36 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
+     ERRP_GUARD();
      VFIOPCIDevice *vdev = VFIO_PCI(pdev);
      VFIODevice *vbasedev = &vdev->vbasedev;
 +    VFIODevice *vbasedev_iter;
 +    VFIOGroup *group;
      char *tmp, *subsys;
      Error *err = NULL;
-     struct stat st;
 -    int i, ret;
 +    int ret, i = 0;
      bool is_mdev;
@@ -84,10 +83,10 @@ index c62c02f7b6..ec98080f28 100644
 +        return;
 +    }
 +
-     if (!vbasedev->sysfsdev) {
+     if (vbasedev->fd < 0 && !vbasedev->sysfsdev) {
          if (!(~vdev->host.domain || ~vdev->host.bus ||
                ~vdev->host.slot || ~vdev->host.function)) {
-@@ -3501,6 +3527,9 @@ static Property vfio_pci_dev_properties[] = {
+@@ -3370,6 +3396,9 @@ static Property vfio_pci_dev_properties[] = {
      DEFINE_PROP_BOOL("x-no-kvm-msix", VFIOPCIDevice, no_kvm_msix, false),
      DEFINE_PROP_BOOL("x-no-geforce-quirks", VFIOPCIDevice,
                       no_geforce_quirks, false),
@@ -98,7 +97,7 @@ index c62c02f7b6..ec98080f28 100644
                       false),
      DEFINE_PROP_BOOL("x-no-vfio-ioeventfd", VFIOPCIDevice, no_vfio_ioeventfd,
 diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
-index fba8737ab2..eb74d9de2d 100644
+index 6e64a2654e..b7de39c010 100644
 --- a/hw/vfio/pci.h
 +++ b/hw/vfio/pci.h
 @@ -142,6 +142,7 @@ struct VFIOPCIDevice {
diff --git a/SOURCES/0013-Add-support-statement-to-help-output.patch b/SOURCES/0013-Add-support-statement-to-help-output.patch
index bc5d9b4..0644440 100644
--- a/SOURCES/0013-Add-support-statement-to-help-output.patch
+++ b/SOURCES/0013-Add-support-statement-to-help-output.patch
@@ -1,4 +1,4 @@
-From 424f14d123fe1043518758605d94ed5ba50e52ad Mon Sep 17 00:00:00 2001
+From b467dc6a24ef41fa574260429807711f6802a54d Mon Sep 17 00:00:00 2001
 From: Eduardo Habkost <ehabkost@redhat.com>
 Date: Wed, 4 Dec 2013 18:53:17 +0100
 Subject: Add support statement to -help output
@@ -21,10 +21,10 @@ Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
  1 file changed, 9 insertions(+)
 
 diff --git a/system/vl.c b/system/vl.c
-index 2bcd9efb9a..93635ffc5b 100644
+index c644222982..03c3b0aa94 100644
 --- a/system/vl.c
 +++ b/system/vl.c
-@@ -870,9 +870,17 @@ static void version(void)
+@@ -869,9 +869,17 @@ static void version(void)
             QEMU_COPYRIGHT "\n");
  }
  
@@ -42,7 +42,7 @@ index 2bcd9efb9a..93635ffc5b 100644
      printf("usage: %s [options] [disk_image]\n\n"
             "'disk_image' is a raw hard disk image for IDE hard disk 0\n\n",
              g_get_prgname());
-@@ -898,6 +906,7 @@ static void help(int exitcode)
+@@ -897,6 +905,7 @@ static void help(int exitcode)
             "\n"
             QEMU_HELP_BOTTOM "\n");
  
diff --git a/SOURCES/0014-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch b/SOURCES/0014-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
index 7fa10b5..04adb4a 100644
--- a/SOURCES/0014-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
+++ b/SOURCES/0014-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
@@ -1,4 +1,4 @@
-From c683ff4a770b77dbe707413840918a46f67fa825 Mon Sep 17 00:00:00 2001
+From 20cc3a6d9bce3e40d165f865b5e398c300cae7bf Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Wed, 8 Jul 2020 08:35:50 +0200
 Subject: Use qemu-kvm in documentation instead of qemu-system-<arch>
@@ -36,10 +36,10 @@ index 52d6454b93..d74dbdeca9 100644
  .. |I2C| replace:: I\ :sup:`2`\ C
  .. |I2S| replace:: I\ :sup:`2`\ S
 diff --git a/qemu-options.hx b/qemu-options.hx
-index 42fd09e4de..557118cb1f 100644
+index 8ce85d4559..4fc27ee2e2 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
-@@ -3469,11 +3469,11 @@ SRST
+@@ -3493,11 +3493,11 @@ SRST
  
      ::
  
diff --git a/SOURCES/0015-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch b/SOURCES/0015-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch
index 667d431..8518918 100644
--- a/SOURCES/0015-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch
+++ b/SOURCES/0015-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch
@@ -1,4 +1,4 @@
-From 776bff1be5e98982a9bbc8345ff27274ff5b8c0f Mon Sep 17 00:00:00 2001
+From 2f9fdd21ecf2810d0d83a8125ce0cc1e75dbb13a Mon Sep 17 00:00:00 2001
 From: Kevin Wolf <kwolf@redhat.com>
 Date: Fri, 20 Aug 2021 18:25:12 +0200
 Subject: qcow2: Deprecation warning when opening v2 images rw
@@ -44,7 +44,7 @@ Rebase notes (6.1.0):
  2 files changed, 7 insertions(+)
 
 diff --git a/block/qcow2.c b/block/qcow2.c
-index 13e032bd5e..7968735346 100644
+index 956128b409..0e8b2f7518 100644
 --- a/block/qcow2.c
 +++ b/block/qcow2.c
 @@ -1358,6 +1358,12 @@ qcow2_do_open(BlockDriverState *bs, QDict *options, int flags,
diff --git a/SOURCES/0016-Add-upstream-compatibility-bits.patch b/SOURCES/0016-Add-upstream-compatibility-bits.patch
new file mode 100644
index 0000000..3efa22c
--- /dev/null
+++ b/SOURCES/0016-Add-upstream-compatibility-bits.patch
@@ -0,0 +1,121 @@
+From 59470e8ab849f22b407f55292e540e16a8cad01a Mon Sep 17 00:00:00 2001
+From: Miroslav Rezanina <mrezanin@redhat.com>
+Date: Wed, 20 Mar 2024 05:34:32 -0400
+Subject: Add upstream compatibility bits
+
+Adding new compats structure for changes introduced during rebase to QEMU 9.0.0.
+
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+
+---
+
+Rebase notes (9.0.0 rc2):
+- Add aw-bits setting for aarch compat record (overwritten for 9.4 and older)
+---
+ hw/arm/virt.c              |  3 +++
+ hw/core/machine.c          | 10 ++++++++++
+ hw/i386/pc_piix.c          |  3 ++-
+ hw/i386/pc_q35.c           |  3 +++
+ hw/s390x/s390-virtio-ccw.c |  1 +
+ include/hw/boards.h        |  3 +++
+ 6 files changed, 22 insertions(+), 1 deletion(-)
+
+diff --git a/hw/arm/virt.c b/hw/arm/virt.c
+index 22bc345137..f1af9495c6 100644
+--- a/hw/arm/virt.c
++++ b/hw/arm/virt.c
+@@ -144,6 +144,8 @@ GlobalProperty arm_rhel_compat[] = {
+     {"virtio-net-pci", "romfile", "" },
+     {"virtio-net-pci-transitional", "romfile", "" },
+     {"virtio-net-pci-non-transitional", "romfile", "" },
++    /* arm_rhel_compat from arm_virt_compat, added for 9.0.0 rebase */
++    { TYPE_VIRTIO_IOMMU_PCI, "aw-bits", "48" },
+ };
+ const size_t arm_rhel_compat_len = G_N_ELEMENTS(arm_rhel_compat);
+ 
+@@ -3728,6 +3730,7 @@ type_init(rhel_machine_init);
+ 
+ static void rhel940_virt_options(MachineClass *mc)
+ {
++    compat_props_add(mc->compat_props, hw_compat_rhel_9_5, hw_compat_rhel_9_5_len);
+ }
+ DEFINE_RHEL_MACHINE_AS_LATEST(9, 4, 0)
+ 
+diff --git a/hw/core/machine.c b/hw/core/machine.c
+index 695cb89a46..0f256d9633 100644
+--- a/hw/core/machine.c
++++ b/hw/core/machine.c
+@@ -302,6 +302,16 @@ const size_t hw_compat_2_1_len = G_N_ELEMENTS(hw_compat_2_1);
+ const char *rhel_old_machine_deprecation =
+     "machine types for previous major releases are deprecated";
+ 
++GlobalProperty hw_compat_rhel_9_5[] = {
++  /* hw_compat_rhel_9_5 from hw_compat_8_2 */
++    { "migration", "zero-page-detection", "legacy"},
++  /* hw_compat_rhel_9_5 from hw_compat_8_2 */
++    { TYPE_VIRTIO_IOMMU_PCI, "granule", "4k" },
++  /* hw_compat_rhel_9_5 from hw_compat_8_2 */
++    { TYPE_VIRTIO_IOMMU_PCI, "aw-bits", "64" },
++};
++const size_t hw_compat_rhel_9_5_len = G_N_ELEMENTS(hw_compat_rhel_9_5);
++
+ GlobalProperty hw_compat_rhel_9_4[] = {
+   /* hw_compat_rhel_9_4 from hw_compat_8_0 */
+     { TYPE_VIRTIO_NET, "host_uso", "off"},
+diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
+index a647262d63..6b260682eb 100644
+--- a/hw/i386/pc_piix.c
++++ b/hw/i386/pc_piix.c
+@@ -1015,7 +1015,8 @@ static void pc_machine_rhel760_options(MachineClass *m)
+     object_class_property_set_description(oc, "x-south-bridge",
+                                      "Use a different south bridge than PIIX3");
+ 
+-
++    compat_props_add(m->compat_props, hw_compat_rhel_9_5,
++		     hw_compat_rhel_9_5_len);
+     compat_props_add(m->compat_props, hw_compat_rhel_9_4,
+                      hw_compat_rhel_9_4_len);
+     compat_props_add(m->compat_props, hw_compat_rhel_9_3,
+diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
+index e872dc7e46..2b54944c0f 100644
+--- a/hw/i386/pc_q35.c
++++ b/hw/i386/pc_q35.c
+@@ -733,6 +733,9 @@ static void pc_q35_machine_rhel940_options(MachineClass *m)
+     m->desc = "RHEL-9.4.0 PC (Q35 + ICH9, 2009)";
+     pcmc->smbios_stream_product = "RHEL";
+     pcmc->smbios_stream_version = "9.4.0";
++
++    compat_props_add(m->compat_props, hw_compat_rhel_9_5,
++		     hw_compat_rhel_9_5_len);
+ }
+ 
+ DEFINE_PC_MACHINE(q35_rhel940, "pc-q35-rhel9.4.0", pc_q35_init_rhel940,
+diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
+index ff753a29e0..9ad54682c6 100644
+--- a/hw/s390x/s390-virtio-ccw.c
++++ b/hw/s390x/s390-virtio-ccw.c
+@@ -1282,6 +1282,7 @@ static void ccw_machine_rhel940_instance_options(MachineState *machine)
+ 
+ static void ccw_machine_rhel940_class_options(MachineClass *mc)
+ {
++    compat_props_add(mc->compat_props, hw_compat_rhel_9_5, hw_compat_rhel_9_5_len);
+ }
+ DEFINE_CCW_MACHINE(rhel940, "rhel9.4.0", true);
+ 
+diff --git a/include/hw/boards.h b/include/hw/boards.h
+index 46b8725c41..cca62f906b 100644
+--- a/include/hw/boards.h
++++ b/include/hw/boards.h
+@@ -514,6 +514,9 @@ extern const size_t hw_compat_2_2_len;
+ extern GlobalProperty hw_compat_2_1[];
+ extern const size_t hw_compat_2_1_len;
+ 
++extern GlobalProperty hw_compat_rhel_9_5[];
++extern const size_t hw_compat_rhel_9_5_len;
++
+ extern GlobalProperty hw_compat_rhel_9_4[];
+ extern const size_t hw_compat_rhel_9_4_len;
+ 
+-- 
+2.39.3
+
diff --git a/SOURCES/0016-Introduce-RHEL-9.4.0-qemu-kvm-machine-type-for-aarch.patch b/SOURCES/0016-Introduce-RHEL-9.4.0-qemu-kvm-machine-type-for-aarch.patch
deleted file mode 100644
index 4e62baa..0000000
--- a/SOURCES/0016-Introduce-RHEL-9.4.0-qemu-kvm-machine-type-for-aarch.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From 3b9b38339346ebfaf3e8ddf0822eba1cc9e78408 Mon Sep 17 00:00:00 2001
-From: Miroslav Rezanina <mrezanin@redhat.com>
-Date: Thu, 14 Dec 2023 04:42:01 -0500
-Subject: Introduce RHEL 9.4.0 qemu-kvm machine type for aarch64
-
-Jira: https://issues.redhat.com/browse/RHEL-17168
-
-Adding new machine type to support enabling new features.
-
-Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
----
- hw/arm/virt.c | 9 ++++++++-
- 1 file changed, 8 insertions(+), 1 deletion(-)
-
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index c541efee5e..0b17c94ad7 100644
---- a/hw/arm/virt.c
-+++ b/hw/arm/virt.c
-@@ -3630,14 +3630,21 @@ static void rhel_machine_init(void)
- }
- type_init(rhel_machine_init);
- 
-+static void rhel940_virt_options(MachineClass *mc)
-+{
-+}
-+DEFINE_RHEL_MACHINE_AS_LATEST(9, 4, 0)
-+
- static void rhel920_virt_options(MachineClass *mc)
- {
-+    rhel940_virt_options(mc);
-+
-     compat_props_add(mc->compat_props, arm_rhel_compat, arm_rhel_compat_len);
-     compat_props_add(mc->compat_props, hw_compat_rhel_9_4, hw_compat_rhel_9_4_len);
-     compat_props_add(mc->compat_props, hw_compat_rhel_9_3, hw_compat_rhel_9_3_len);
-     compat_props_add(mc->compat_props, hw_compat_rhel_9_2, hw_compat_rhel_9_2_len);
- }
--DEFINE_RHEL_MACHINE_AS_LATEST(9, 2, 0)
-+DEFINE_RHEL_MACHINE(9, 2, 0)
- 
- static void rhel900_virt_options(MachineClass *mc)
- {
--- 
-2.39.3
-
diff --git a/SOURCES/0017-x86-rhel-9.4.0-machine-type-compat-fix.patch b/SOURCES/0017-x86-rhel-9.4.0-machine-type-compat-fix.patch
new file mode 100644
index 0000000..5befe68
--- /dev/null
+++ b/SOURCES/0017-x86-rhel-9.4.0-machine-type-compat-fix.patch
@@ -0,0 +1,30 @@
+From ba574acacf679850e337ec2d5e7836b8277cf393 Mon Sep 17 00:00:00 2001
+From: Sebastian Ott <sebott@redhat.com>
+Date: Thu, 18 Apr 2024 15:04:28 +0200
+Subject: x86: rhel 9.4.0 machine type compat fix
+
+Fix up the compatibility for 9.4.0. Ensure that pc-q35-rhel9.4.0
+still uses SMBIOS 3.X by default.
+
+Signed-off-by: Sebastian Ott <sebott@redhat.com>
+---
+ hw/i386/pc_q35.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
+index 2b54944c0f..2f11f9af7d 100644
+--- a/hw/i386/pc_q35.c
++++ b/hw/i386/pc_q35.c
+@@ -734,6 +734,9 @@ static void pc_q35_machine_rhel940_options(MachineClass *m)
+     pcmc->smbios_stream_product = "RHEL";
+     pcmc->smbios_stream_version = "9.4.0";
+ 
++    /* From pc_q35_8_2_machine_options() - use SMBIOS 3.X by default */
++    pcmc->default_smbios_ep_type = SMBIOS_ENTRY_POINT_TYPE_64;
++
+     compat_props_add(m->compat_props, hw_compat_rhel_9_5,
+ 		     hw_compat_rhel_9_5_len);
+ }
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-Compile-IOMMUFD-object-on-aarch64.patch b/SOURCES/kvm-Compile-IOMMUFD-object-on-aarch64.patch
deleted file mode 100644
index ed776c0..0000000
--- a/SOURCES/kvm-Compile-IOMMUFD-object-on-aarch64.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From 363d6aedc82314a70bdfbe9fa23b7e8fdda50138 Mon Sep 17 00:00:00 2001
-From: Eric Auger <eric.auger@redhat.com>
-Date: Thu, 11 Jan 2024 12:26:19 -0500
-Subject: [PATCH 066/101] Compile IOMMUFD object on aarch64
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [65/67] 9358030fdd499c5fe122dee3bb4f114966fac9c2 (eauger1/centos-qemu-kvm)
-
-Upstream: RHEL only
-
-Compiles the IOMMUFD object on aarch64 to be able to use
-the IOMMUFD VFIO backend.
-
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- configs/devices/aarch64-softmmu/aarch64-rh-devices.mak | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak b/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
-index aec1831199..b0191d3c69 100644
---- a/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
-+++ b/configs/devices/aarch64-softmmu/aarch64-rh-devices.mak
-@@ -39,3 +39,4 @@ CONFIG_PXB=y
- CONFIG_VHOST_VSOCK=y
- CONFIG_VHOST_USER_VSOCK=y
- CONFIG_VHOST_USER_FS=y
-+CONFIG_IOMMUFD=y
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-Compile-IOMMUFD-on-s390x.patch b/SOURCES/kvm-Compile-IOMMUFD-on-s390x.patch
deleted file mode 100644
index 9a98477..0000000
--- a/SOURCES/kvm-Compile-IOMMUFD-on-s390x.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From c1e9ddf8d0ea6d358fcaa5cacd3a91920f36e73b Mon Sep 17 00:00:00 2001
-From: Eric Auger <eric.auger@redhat.com>
-Date: Thu, 11 Jan 2024 12:33:17 -0500
-Subject: [PATCH 067/101] Compile IOMMUFD on s390x
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [66/67] d3004aafca2bb76d817ac99c3d65973b8fbd4557 (eauger1/centos-qemu-kvm)
-
-Upstream: RHEL only
-
-Compiles the IOMMUFD object on s390x to be able to use
-the IOMMUFD VFIO backend.
-
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- configs/devices/s390x-softmmu/s390x-rh-devices.mak | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/configs/devices/s390x-softmmu/s390x-rh-devices.mak b/configs/devices/s390x-softmmu/s390x-rh-devices.mak
-index 69a799adbd..24cf6dbd03 100644
---- a/configs/devices/s390x-softmmu/s390x-rh-devices.mak
-+++ b/configs/devices/s390x-softmmu/s390x-rh-devices.mak
-@@ -16,3 +16,4 @@ CONFIG_WDT_DIAG288=y
- CONFIG_VHOST_VSOCK=y
- CONFIG_VHOST_USER_VSOCK=y
- CONFIG_VHOST_USER_FS=y
-+CONFIG_IOMMUFD=y
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-Compile-IOMMUFD-on-x86_64.patch b/SOURCES/kvm-Compile-IOMMUFD-on-x86_64.patch
deleted file mode 100644
index a3eb40e..0000000
--- a/SOURCES/kvm-Compile-IOMMUFD-on-x86_64.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From be2c3d9bbee1bdec061c901f507bc999fa40a53e Mon Sep 17 00:00:00 2001
-From: Eric Auger <eric.auger@redhat.com>
-Date: Thu, 11 Jan 2024 12:34:44 -0500
-Subject: [PATCH 068/101] Compile IOMMUFD on x86_64
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [67/67] 411d48a5cc7ce1f05be793fd9a89c143ce34c91a (eauger1/centos-qemu-kvm)
-
-Upstream: RHEL only
-
-Compiles the IOMMUFD object on s390x to be able to use
-the IOMMUFD VFIO backend.
-
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- configs/devices/x86_64-softmmu/x86_64-rh-devices.mak | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
-index ce5be73633..ba41108e0c 100644
---- a/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
-+++ b/configs/devices/x86_64-softmmu/x86_64-rh-devices.mak
-@@ -108,3 +108,4 @@ CONFIG_SGX=y
- CONFIG_VHOST_VSOCK=y
- CONFIG_VHOST_USER_VSOCK=y
- CONFIG_VHOST_USER_FS=y
-+CONFIG_IOMMUFD=y
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-Fix-scanout-version-with-pc-q35-rhel9.4.0.patch b/SOURCES/kvm-Fix-scanout-version-with-pc-q35-rhel9.4.0.patch
deleted file mode 100644
index fdac70c..0000000
--- a/SOURCES/kvm-Fix-scanout-version-with-pc-q35-rhel9.4.0.patch
+++ /dev/null
@@ -1,128 +0,0 @@
-From ef212eb3026a2460f6502a76afa3baedeb74d975 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
-Date: Tue, 6 Aug 2024 14:14:27 +0400
-Subject: [PATCH 1/5] Fix scanout version with pc-q35-rhel9.4.0
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Marc-André Lureau <marcandre.lureau@redhat.com>
-RH-MergeRequest: 383: Fix scanout version with pc-q35-rhel9.4.0
-RH-Jira: RHEL-53565
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [1/1] ed2860cfb933654b0046c1b59f78d2e50146bd6c
-
-Resolves: https://issues.redhat.com/browse/RHEL-52940
-
-Introduce hw_compat_rhel_9_4_extra so that pc-q35-rhel9.4.0 has
-x-scanout-vmstate-version=1
-
-Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
----
- hw/arm/virt.c              |  1 +
- hw/core/machine.c          | 13 +++++++++++--
- hw/i386/pc_piix.c          |  2 ++
- hw/i386/pc_q35.c           |  3 +++
- hw/s390x/s390-virtio-ccw.c |  1 +
- include/hw/boards.h        |  3 +++
- 6 files changed, 21 insertions(+), 2 deletions(-)
-
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index e4a66affcb..851eff6b28 100644
---- a/hw/arm/virt.c
-+++ b/hw/arm/virt.c
-@@ -3670,6 +3670,7 @@ type_init(rhel_machine_init);
- 
- static void rhel940_virt_options(MachineClass *mc)
- {
-+    compat_props_add(mc->compat_props, hw_compat_rhel_9_4_extra, hw_compat_rhel_9_4_extra_len);
- }
- DEFINE_RHEL_MACHINE_AS_LATEST(9, 4, 0)
- 
-diff --git a/hw/core/machine.c b/hw/core/machine.c
-index c8c460c916..fe0a28ef3b 100644
---- a/hw/core/machine.c
-+++ b/hw/core/machine.c
-@@ -64,6 +64,17 @@ const size_t hw_compat_7_2_len = G_N_ELEMENTS(hw_compat_7_2);
- const char *rhel_old_machine_deprecation =
-     "machine types for previous major releases are deprecated";
- 
-+/*
-+ * rhel_9_4_extra is used for <= 9.4 machines.
-+ *
-+ * (for compatibility and historical reasons, rhel_9_4 is used for <= 9.2 too)
-+ */
-+GlobalProperty hw_compat_rhel_9_4_extra[] = {
-+    /* hw_compat_rhel_9_4_extra from hw_compat_8_2 */
-+    { "virtio-gpu-device", "x-scanout-vmstate-version", "1" },
-+};
-+const size_t hw_compat_rhel_9_4_extra_len = G_N_ELEMENTS(hw_compat_rhel_9_4_extra);
-+
- GlobalProperty hw_compat_rhel_9_4[] = {
-   /* hw_compat_rhel_9_4 from hw_compat_8_0 */
-     { TYPE_VIRTIO_NET, "host_uso", "off"},
-@@ -81,8 +92,6 @@ GlobalProperty hw_compat_rhel_9_4[] = {
-      { "igb", "x-pcie-flr-init", "off" },
-   /* hw_compat_rhel_9_4 jira RHEL-24045 */
-      { "virtio-mem", "dynamic-memslots", "off" },
--  /* hw_compat_rhel_9_4 from hw_compat_8_1 */
--    { "virtio-gpu-device", "x-scanout-vmstate-version", "1" },
- };
- const size_t hw_compat_rhel_9_4_len = G_N_ELEMENTS(hw_compat_rhel_9_4);
- 
-diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
-index 54d1c58bce..c846673d87 100644
---- a/hw/i386/pc_piix.c
-+++ b/hw/i386/pc_piix.c
-@@ -1031,6 +1031,8 @@ static void pc_machine_rhel760_options(MachineClass *m)
-                                      "Use a different south bridge than PIIX3");
- 
- 
-+    compat_props_add(m->compat_props, hw_compat_rhel_9_4_extra,
-+                     hw_compat_rhel_9_4_extra_len);
-     compat_props_add(m->compat_props, hw_compat_rhel_9_4,
-                      hw_compat_rhel_9_4_len);
-     compat_props_add(m->compat_props, hw_compat_rhel_9_3,
-diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
-index cd5fb7380e..02bc3d515f 100644
---- a/hw/i386/pc_q35.c
-+++ b/hw/i386/pc_q35.c
-@@ -731,6 +731,9 @@ static void pc_q35_machine_rhel940_options(MachineClass *m)
-     m->desc = "RHEL-9.4.0 PC (Q35 + ICH9, 2009)";
-     pcmc->smbios_stream_product = "RHEL";
-     pcmc->smbios_stream_version = "9.4.0";
-+
-+    compat_props_add(m->compat_props, hw_compat_rhel_9_4_extra,
-+                     hw_compat_rhel_9_4_extra_len);
- }
- 
- DEFINE_PC_MACHINE(q35_rhel940, "pc-q35-rhel9.4.0", pc_q35_init_rhel940,
-diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
-index 24f4773179..cc6087c37a 100644
---- a/hw/s390x/s390-virtio-ccw.c
-+++ b/hw/s390x/s390-virtio-ccw.c
-@@ -1277,6 +1277,7 @@ static void ccw_machine_rhel940_instance_options(MachineState *machine)
- 
- static void ccw_machine_rhel940_class_options(MachineClass *mc)
- {
-+    compat_props_add(mc->compat_props, hw_compat_rhel_9_4_extra, hw_compat_rhel_9_4_extra_len);
- }
- DEFINE_CCW_MACHINE(rhel940, "rhel9.4.0", true);
- 
-diff --git a/include/hw/boards.h b/include/hw/boards.h
-index 4edfdb0ddb..e6ae0e61cf 100644
---- a/include/hw/boards.h
-+++ b/include/hw/boards.h
-@@ -505,6 +505,9 @@ extern const size_t hw_compat_2_2_len;
- extern GlobalProperty hw_compat_2_1[];
- extern const size_t hw_compat_2_1_len;
- 
-+extern GlobalProperty hw_compat_rhel_9_4_extra[];
-+extern const size_t hw_compat_rhel_9_4_extra_len;
-+
- extern GlobalProperty hw_compat_rhel_9_4[];
- extern const size_t hw_compat_rhel_9_4_len;
- 
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-HostMem-Add-mechanism-to-opt-in-kvm-guest-memfd-via-.patch b/SOURCES/kvm-HostMem-Add-mechanism-to-opt-in-kvm-guest-memfd-via-.patch
new file mode 100644
index 0000000..65da2cc
--- /dev/null
+++ b/SOURCES/kvm-HostMem-Add-mechanism-to-opt-in-kvm-guest-memfd-via-.patch
@@ -0,0 +1,139 @@
+From 93ea86ac8849ad9ca365b1646313dde9a34ba59c Mon Sep 17 00:00:00 2001
+From: Xiaoyao Li <xiaoyao.li@intel.com>
+Date: Wed, 20 Mar 2024 03:39:03 -0500
+Subject: [PATCH 031/100] HostMem: Add mechanism to opt in kvm guest memfd via
+ MachineState
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [31/91] 43ce32aef954479cdb736301d1adcb919602c321 (bonzini/rhel-qemu-kvm)
+
+Add a new member "guest_memfd" to memory backends. When it's set
+to true, it enables RAM_GUEST_MEMFD in ram_flags, thus private kvm
+guest_memfd will be allocated during RAMBlock allocation.
+
+Memory backend's @guest_memfd is wired with @require_guest_memfd
+field of MachineState. It avoid looking up the machine in phymem.c.
+
+MachineState::require_guest_memfd is supposed to be set by any VMs
+that requires KVM guest memfd as private memory, e.g., TDX VM.
+
+Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
+Reviewed-by: David Hildenbrand <david@redhat.com>
+Message-ID: <20240320083945.991426-8-michael.roth@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 37662d85b0b7dded0ebdf6747bef6c3bb7ed6a0c)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ backends/hostmem-file.c  | 1 +
+ backends/hostmem-memfd.c | 1 +
+ backends/hostmem-ram.c   | 1 +
+ backends/hostmem.c       | 1 +
+ hw/core/machine.c        | 5 +++++
+ include/hw/boards.h      | 2 ++
+ include/sysemu/hostmem.h | 1 +
+ 7 files changed, 12 insertions(+)
+
+diff --git a/backends/hostmem-file.c b/backends/hostmem-file.c
+index ac3e433cbd..3c69db7946 100644
+--- a/backends/hostmem-file.c
++++ b/backends/hostmem-file.c
+@@ -85,6 +85,7 @@ file_backend_memory_alloc(HostMemoryBackend *backend, Error **errp)
+     ram_flags |= fb->readonly ? RAM_READONLY_FD : 0;
+     ram_flags |= fb->rom == ON_OFF_AUTO_ON ? RAM_READONLY : 0;
+     ram_flags |= backend->reserve ? 0 : RAM_NORESERVE;
++    ram_flags |= backend->guest_memfd ? RAM_GUEST_MEMFD : 0;
+     ram_flags |= fb->is_pmem ? RAM_PMEM : 0;
+     ram_flags |= RAM_NAMED_FILE;
+     return memory_region_init_ram_from_file(&backend->mr, OBJECT(backend), name,
+diff --git a/backends/hostmem-memfd.c b/backends/hostmem-memfd.c
+index 3923ea9364..745ead0034 100644
+--- a/backends/hostmem-memfd.c
++++ b/backends/hostmem-memfd.c
+@@ -55,6 +55,7 @@ memfd_backend_memory_alloc(HostMemoryBackend *backend, Error **errp)
+     name = host_memory_backend_get_name(backend);
+     ram_flags = backend->share ? RAM_SHARED : 0;
+     ram_flags |= backend->reserve ? 0 : RAM_NORESERVE;
++    ram_flags |= backend->guest_memfd ? RAM_GUEST_MEMFD : 0;
+     return memory_region_init_ram_from_fd(&backend->mr, OBJECT(backend), name,
+                                           backend->size, ram_flags, fd, 0, errp);
+ }
+diff --git a/backends/hostmem-ram.c b/backends/hostmem-ram.c
+index d121249f0f..f7d81af783 100644
+--- a/backends/hostmem-ram.c
++++ b/backends/hostmem-ram.c
+@@ -30,6 +30,7 @@ ram_backend_memory_alloc(HostMemoryBackend *backend, Error **errp)
+     name = host_memory_backend_get_name(backend);
+     ram_flags = backend->share ? RAM_SHARED : 0;
+     ram_flags |= backend->reserve ? 0 : RAM_NORESERVE;
++    ram_flags |= backend->guest_memfd ? RAM_GUEST_MEMFD : 0;
+     return memory_region_init_ram_flags_nomigrate(&backend->mr, OBJECT(backend),
+                                                   name, backend->size,
+                                                   ram_flags, errp);
+diff --git a/backends/hostmem.c b/backends/hostmem.c
+index 81a72ce40b..eb9682b4a8 100644
+--- a/backends/hostmem.c
++++ b/backends/hostmem.c
+@@ -277,6 +277,7 @@ static void host_memory_backend_init(Object *obj)
+     /* TODO: convert access to globals to compat properties */
+     backend->merge = machine_mem_merge(machine);
+     backend->dump = machine_dump_guest_core(machine);
++    backend->guest_memfd = machine_require_guest_memfd(machine);
+     backend->reserve = true;
+     backend->prealloc_threads = machine->smp.cpus;
+ }
+diff --git a/hw/core/machine.c b/hw/core/machine.c
+index 92609aae27..07b994e136 100644
+--- a/hw/core/machine.c
++++ b/hw/core/machine.c
+@@ -1480,6 +1480,11 @@ bool machine_mem_merge(MachineState *machine)
+     return machine->mem_merge;
+ }
+ 
++bool machine_require_guest_memfd(MachineState *machine)
++{
++    return machine->require_guest_memfd;
++}
++
+ static char *cpu_slot_to_string(const CPUArchId *cpu)
+ {
+     GString *s = g_string_new(NULL);
+diff --git a/include/hw/boards.h b/include/hw/boards.h
+index cca62f906b..815a1c4b26 100644
+--- a/include/hw/boards.h
++++ b/include/hw/boards.h
+@@ -36,6 +36,7 @@ bool machine_usb(MachineState *machine);
+ int machine_phandle_start(MachineState *machine);
+ bool machine_dump_guest_core(MachineState *machine);
+ bool machine_mem_merge(MachineState *machine);
++bool machine_require_guest_memfd(MachineState *machine);
+ HotpluggableCPUList *machine_query_hotpluggable_cpus(MachineState *machine);
+ void machine_set_cpu_numa_node(MachineState *machine,
+                                const CpuInstanceProperties *props,
+@@ -372,6 +373,7 @@ struct MachineState {
+     char *dt_compatible;
+     bool dump_guest_core;
+     bool mem_merge;
++    bool require_guest_memfd;
+     bool usb;
+     bool usb_disabled;
+     char *firmware;
+diff --git a/include/sysemu/hostmem.h b/include/sysemu/hostmem.h
+index 0e411aaa29..04b884bf42 100644
+--- a/include/sysemu/hostmem.h
++++ b/include/sysemu/hostmem.h
+@@ -74,6 +74,7 @@ struct HostMemoryBackend {
+     uint64_t size;
+     bool merge, dump, use_canonical_path;
+     bool prealloc, is_mapped, share, reserve;
++    bool guest_memfd;
+     uint32_t prealloc_threads;
+     ThreadContext *prealloc_context;
+     DECLARE_BITMAP(host_nodes, MAX_NODES + 1);
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-Implement-SMBIOS-type-9-v2.6.patch b/SOURCES/kvm-Implement-SMBIOS-type-9-v2.6.patch
deleted file mode 100644
index 31439d7..0000000
--- a/SOURCES/kvm-Implement-SMBIOS-type-9-v2.6.patch
+++ /dev/null
@@ -1,155 +0,0 @@
-From 5c639f8ce65183ce8e44ee8e0230e9d627a440d7 Mon Sep 17 00:00:00 2001
-From: Igor Mammedov <imammedo@redhat.com>
-Date: Wed, 21 Feb 2024 17:00:27 +0000
-Subject: [PATCH 05/20] Implement SMBIOS type 9 v2.6
-
-RH-Author: Igor Mammedov <imammedo@redhat.com>
-RH-MergeRequest: 230: Workaround Windows failing to find 64bit SMBIOS entry point with SeaBIOS
-RH-Jira: RHEL-21705
-RH-Acked-by: MST <mst@redhat.com>
-RH-Acked-by: Ani Sinha <None>
-RH-Commit: [3/18] ead230527d93938907a561cf5b985ee4f54d82b1
-
-JIRA: https://issues.redhat.com/browse/RHEL-21705
-Author: Felix Wu <flwu@google.com>
-
-    Signed-off-by: Felix Wu <flwu@google.com>
-    Signed-off-by: Nabih Estefan <nabihestefan@google.com>
-    Message-Id: <20240221170027.1027325-3-nabihestefan@google.com>
-    Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
-
-(cherry picked from commit 04f143d828845d0fd52dd4a52664d81a4f5431f7)
-Signed-off-by: Igor Mammedov <imammedo@redhat.com>
----
- hw/smbios/smbios.c           | 49 +++++++++++++++++++++++++++++++++---
- include/hw/firmware/smbios.h |  4 +++
- qemu-options.hx              |  2 +-
- 3 files changed, 51 insertions(+), 4 deletions(-)
-
-diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c
-index 4f5637d445..074705fa4c 100644
---- a/hw/smbios/smbios.c
-+++ b/hw/smbios/smbios.c
-@@ -124,7 +124,7 @@ static QTAILQ_HEAD(, type8_instance) type8 = QTAILQ_HEAD_INITIALIZER(type8);
- 
- /* type 9 instance for parsing */
- struct type9_instance {
--    const char *slot_designation;
-+    const char *slot_designation, *pcidev;
-     uint8_t slot_type, slot_data_bus_width, current_usage, slot_length,
-             slot_characteristics1, slot_characteristics2;
-     uint16_t slot_id;
-@@ -427,6 +427,11 @@ static const QemuOptDesc qemu_smbios_type9_opts[] = {
-         .type = QEMU_OPT_NUMBER,
-         .help = "slot characteristics2, see the spec",
-     },
-+    {
-+        .name = "pci_device",
-+        .type = QEMU_OPT_STRING,
-+        .help = "PCI device, if provided."
-+    }
- };
- 
- static const QemuOptDesc qemu_smbios_type11_opts[] = {
-@@ -851,7 +856,7 @@ static void smbios_build_type_8_table(void)
-     }
- }
- 
--static void smbios_build_type_9_table(void)
-+static void smbios_build_type_9_table(Error **errp)
- {
-     unsigned instance = 0;
-     struct type9_instance *t9;
-@@ -868,6 +873,43 @@ static void smbios_build_type_9_table(void)
-         t->slot_characteristics1 = t9->slot_characteristics1;
-         t->slot_characteristics2 = t9->slot_characteristics2;
- 
-+        if (t9->pcidev) {
-+            PCIDevice *pdev = NULL;
-+            int rc = pci_qdev_find_device(t9->pcidev, &pdev);
-+            if (rc != 0) {
-+                error_setg(errp,
-+                           "No PCI device %s for SMBIOS type 9 entry %s",
-+                           t9->pcidev, t9->slot_designation);
-+                return;
-+            }
-+            /*
-+             * We only handle the case were the device is attached to
-+             * the PCI root bus. The general case is more complex as
-+             * bridges are enumerated later and the table would need
-+             * to be updated at this moment.
-+             */
-+            if (!pci_bus_is_root(pci_get_bus(pdev))) {
-+                error_setg(errp,
-+                           "Cannot create type 9 entry for PCI device %s: "
-+                           "not attached to the root bus",
-+                           t9->pcidev);
-+                return;
-+            }
-+            t->segment_group_number = cpu_to_le16(0);
-+            t->bus_number = pci_dev_bus_num(pdev);
-+            t->device_number = pdev->devfn;
-+        } else {
-+            /*
-+             * Per SMBIOS spec, For slots that are not of the PCI, AGP, PCI-X,
-+             * or PCI-Express type that do not have bus/device/function
-+             * information, 0FFh should be populated in the fields of Segment
-+             * Group Number, Bus Number, Device/Function Number.
-+             */
-+            t->segment_group_number = 0xff;
-+            t->bus_number = 0xff;
-+            t->device_number = 0xff;
-+        }
-+
-         SMBIOS_BUILD_TABLE_POST;
-         instance++;
-     }
-@@ -1222,7 +1264,7 @@ void smbios_get_tables(MachineState *ms,
-         }
- 
-         smbios_build_type_8_table();
--        smbios_build_type_9_table();
-+        smbios_build_type_9_table(errp);
-         smbios_build_type_11_table();
- 
- #define MAX_DIMM_SZ (16 * GiB)
-@@ -1568,6 +1610,7 @@ void smbios_entry_add(QemuOpts *opts, Error **errp)
-             t->slot_id = qemu_opt_get_number(opts, "slot_id", 0);
-             t->slot_characteristics1 = qemu_opt_get_number(opts, "slot_characteristics1", 0);
-             t->slot_characteristics2 = qemu_opt_get_number(opts, "slot_characteristics2", 0);
-+            save_opt(&t->pcidev, opts, "pcidev");
-             QTAILQ_INSERT_TAIL(&type9, t, next);
-             return;
-         }
-diff --git a/include/hw/firmware/smbios.h b/include/hw/firmware/smbios.h
-index 6bbd5a4c20..f8dd07fe4c 100644
---- a/include/hw/firmware/smbios.h
-+++ b/include/hw/firmware/smbios.h
-@@ -222,6 +222,10 @@ struct smbios_type_9 {
-     uint16_t slot_id;
-     uint8_t slot_characteristics1;
-     uint8_t slot_characteristics2;
-+    /* SMBIOS spec v2.6+ */
-+    uint16_t segment_group_number;
-+    uint8_t bus_number;
-+    uint8_t device_number;
- } QEMU_PACKED;
- 
- /* SMBIOS type 11 - OEM strings */
-diff --git a/qemu-options.hx b/qemu-options.hx
-index 94cacc2c63..93364e1765 100644
---- a/qemu-options.hx
-+++ b/qemu-options.hx
-@@ -2710,7 +2710,7 @@ SRST
- ``-smbios type=4[,sock_pfx=str][,manufacturer=str][,version=str][,serial=str][,asset=str][,part=str][,processor-id=%d]``
-     Specify SMBIOS type 4 fields
- 
--``-smbios type=9[,slot_designation=str][,slot_type=%d][,slot_data_bus_width=%d][,current_usage=%d][,slot_length=%d][,slot_id=%d][,slot_characteristics1=%d][,slot_characteristics12=%d]``
-+``-smbios type=9[,slot_designation=str][,slot_type=%d][,slot_data_bus_width=%d][,current_usage=%d][,slot_length=%d][,slot_id=%d][,slot_characteristics1=%d][,slot_characteristics12=%d][,pci_device=str]``
-     Specify SMBIOS type 9 fields
- 
- ``-smbios type=11[,value=str][,path=filename]``
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-Implement-base-of-SMBIOS-type-9-descriptor.patch b/SOURCES/kvm-Implement-base-of-SMBIOS-type-9-descriptor.patch
deleted file mode 100644
index 89466c7..0000000
--- a/SOURCES/kvm-Implement-base-of-SMBIOS-type-9-descriptor.patch
+++ /dev/null
@@ -1,218 +0,0 @@
-From 84fc607d678bd72397a41d706e91fa241fd97266 Mon Sep 17 00:00:00 2001
-From: Igor Mammedov <imammedo@redhat.com>
-Date: Wed, 21 Feb 2024 17:00:26 +0000
-Subject: [PATCH 04/20] Implement base of SMBIOS type 9 descriptor.
-
-RH-Author: Igor Mammedov <imammedo@redhat.com>
-RH-MergeRequest: 230: Workaround Windows failing to find 64bit SMBIOS entry point with SeaBIOS
-RH-Jira: RHEL-21705
-RH-Acked-by: MST <mst@redhat.com>
-RH-Acked-by: Ani Sinha <None>
-RH-Commit: [2/18] 2678cc080bfbf3357fa2f94ceaf42fc61b690d32
-
-JIRA: https://issues.redhat.com/browse/RHEL-21705
-
-commit: 735eee07d1f963635d3c3bf9f5e4bf1bc000870e
-Author: Felix Wu <flwu@google.com>
-
-    Version 2.1+.
-
-    Signed-off-by: Felix Wu <flwu@google.com>
-    Signed-off-by: Nabih Estefan <nabihestefan@google.com>
-    Message-Id: <20240221170027.1027325-2-nabihestefan@google.com>
-    Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
-
-Signed-off-by: Igor Mammedov <imammedo@redhat.com>
----
- hw/smbios/smbios.c           | 99 ++++++++++++++++++++++++++++++++++++
- include/hw/firmware/smbios.h | 13 +++++
- qemu-options.hx              |  3 ++
- 3 files changed, 115 insertions(+)
-
-diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c
-index 7bde23e59d..4f5637d445 100644
---- a/hw/smbios/smbios.c
-+++ b/hw/smbios/smbios.c
-@@ -122,6 +122,16 @@ struct type8_instance {
- };
- static QTAILQ_HEAD(, type8_instance) type8 = QTAILQ_HEAD_INITIALIZER(type8);
- 
-+/* type 9 instance for parsing */
-+struct type9_instance {
-+    const char *slot_designation;
-+    uint8_t slot_type, slot_data_bus_width, current_usage, slot_length,
-+            slot_characteristics1, slot_characteristics2;
-+    uint16_t slot_id;
-+    QTAILQ_ENTRY(type9_instance) next;
-+};
-+static QTAILQ_HEAD(, type9_instance) type9 = QTAILQ_HEAD_INITIALIZER(type9);
-+
- static struct {
-     size_t nvalues;
-     char **values;
-@@ -371,6 +381,54 @@ static const QemuOptDesc qemu_smbios_type8_opts[] = {
-     },
- };
- 
-+static const QemuOptDesc qemu_smbios_type9_opts[] = {
-+    {
-+        .name = "type",
-+        .type = QEMU_OPT_NUMBER,
-+        .help = "SMBIOS element type",
-+    },
-+    {
-+        .name = "slot_designation",
-+        .type = QEMU_OPT_STRING,
-+        .help = "string number for reference designation",
-+    },
-+    {
-+        .name = "slot_type",
-+        .type = QEMU_OPT_NUMBER,
-+        .help = "connector type",
-+    },
-+    {
-+        .name = "slot_data_bus_width",
-+        .type = QEMU_OPT_NUMBER,
-+        .help = "port type",
-+    },
-+    {
-+        .name = "current_usage",
-+        .type = QEMU_OPT_NUMBER,
-+        .help = "current usage",
-+    },
-+    {
-+        .name = "slot_length",
-+        .type = QEMU_OPT_NUMBER,
-+        .help = "system slot length",
-+    },
-+    {
-+        .name = "slot_id",
-+        .type = QEMU_OPT_NUMBER,
-+        .help = "system slot id",
-+    },
-+    {
-+        .name = "slot_characteristics1",
-+        .type = QEMU_OPT_NUMBER,
-+        .help = "slot characteristics1, see the spec",
-+    },
-+    {
-+        .name = "slot_characteristics2",
-+        .type = QEMU_OPT_NUMBER,
-+        .help = "slot characteristics2, see the spec",
-+    },
-+};
-+
- static const QemuOptDesc qemu_smbios_type11_opts[] = {
-     {
-         .name = "value",
-@@ -594,6 +652,7 @@ bool smbios_skip_table(uint8_t type, bool required_table)
- #define T2_BASE 0x200
- #define T3_BASE 0x300
- #define T4_BASE 0x400
-+#define T9_BASE 0x900
- #define T11_BASE 0xe00
- 
- #define T16_BASE 0x1000
-@@ -792,6 +851,28 @@ static void smbios_build_type_8_table(void)
-     }
- }
- 
-+static void smbios_build_type_9_table(void)
-+{
-+    unsigned instance = 0;
-+    struct type9_instance *t9;
-+
-+    QTAILQ_FOREACH(t9, &type9, next) {
-+        SMBIOS_BUILD_TABLE_PRE(9, T9_BASE + instance, true);
-+
-+        SMBIOS_TABLE_SET_STR(9, slot_designation, t9->slot_designation);
-+        t->slot_type = t9->slot_type;
-+        t->slot_data_bus_width = t9->slot_data_bus_width;
-+        t->current_usage = t9->current_usage;
-+        t->slot_length = t9->slot_length;
-+        t->slot_id = t9->slot_id;
-+        t->slot_characteristics1 = t9->slot_characteristics1;
-+        t->slot_characteristics2 = t9->slot_characteristics2;
-+
-+        SMBIOS_BUILD_TABLE_POST;
-+        instance++;
-+    }
-+}
-+
- static void smbios_build_type_11_table(void)
- {
-     char count_str[128];
-@@ -1141,6 +1222,7 @@ void smbios_get_tables(MachineState *ms,
-         }
- 
-         smbios_build_type_8_table();
-+        smbios_build_type_9_table();
-         smbios_build_type_11_table();
- 
- #define MAX_DIMM_SZ (16 * GiB)
-@@ -1472,6 +1554,23 @@ void smbios_entry_add(QemuOpts *opts, Error **errp)
-             t8_i->port_type = qemu_opt_get_number(opts, "port_type", 0);
-             QTAILQ_INSERT_TAIL(&type8, t8_i, next);
-             return;
-+        case 9: {
-+            if (!qemu_opts_validate(opts, qemu_smbios_type9_opts, errp)) {
-+                return;
-+            }
-+            struct type9_instance *t;
-+            t = g_new0(struct type9_instance, 1);
-+            save_opt(&t->slot_designation, opts, "slot_designation");
-+            t->slot_type = qemu_opt_get_number(opts, "slot_type", 0);
-+            t->slot_data_bus_width = qemu_opt_get_number(opts, "slot_data_bus_width", 0);
-+            t->current_usage = qemu_opt_get_number(opts, "current_usage", 0);
-+            t->slot_length = qemu_opt_get_number(opts, "slot_length", 0);
-+            t->slot_id = qemu_opt_get_number(opts, "slot_id", 0);
-+            t->slot_characteristics1 = qemu_opt_get_number(opts, "slot_characteristics1", 0);
-+            t->slot_characteristics2 = qemu_opt_get_number(opts, "slot_characteristics2", 0);
-+            QTAILQ_INSERT_TAIL(&type9, t, next);
-+            return;
-+        }
-         case 11:
-             if (!qemu_opts_validate(opts, qemu_smbios_type11_opts, errp)) {
-                 return;
-diff --git a/include/hw/firmware/smbios.h b/include/hw/firmware/smbios.h
-index d24b3ccd32..6bbd5a4c20 100644
---- a/include/hw/firmware/smbios.h
-+++ b/include/hw/firmware/smbios.h
-@@ -211,6 +211,19 @@ struct smbios_type_8 {
-     uint8_t port_type;
- } QEMU_PACKED;
- 
-+/* SMBIOS type 9 - System Slots (v2.1+) */
-+struct smbios_type_9 {
-+    struct smbios_structure_header header;
-+    uint8_t slot_designation;
-+    uint8_t slot_type;
-+    uint8_t slot_data_bus_width;
-+    uint8_t current_usage;
-+    uint8_t slot_length;
-+    uint16_t slot_id;
-+    uint8_t slot_characteristics1;
-+    uint8_t slot_characteristics2;
-+} QEMU_PACKED;
-+
- /* SMBIOS type 11 - OEM strings */
- struct smbios_type_11 {
-     struct smbios_structure_header header;
-diff --git a/qemu-options.hx b/qemu-options.hx
-index 0814f43066..94cacc2c63 100644
---- a/qemu-options.hx
-+++ b/qemu-options.hx
-@@ -2710,6 +2710,9 @@ SRST
- ``-smbios type=4[,sock_pfx=str][,manufacturer=str][,version=str][,serial=str][,asset=str][,part=str][,processor-id=%d]``
-     Specify SMBIOS type 4 fields
- 
-+``-smbios type=9[,slot_designation=str][,slot_type=%d][,slot_data_bus_width=%d][,current_usage=%d][,slot_length=%d][,slot_id=%d][,slot_characteristics1=%d][,slot_characteristics12=%d]``
-+    Specify SMBIOS type 9 fields
-+
- ``-smbios type=11[,value=str][,path=filename]``
-     Specify SMBIOS type 11 fields
- 
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-KVM-remove-kvm_arch_cpu_check_are_resettable.patch b/SOURCES/kvm-KVM-remove-kvm_arch_cpu_check_are_resettable.patch
new file mode 100644
index 0000000..aaedcf4
--- /dev/null
+++ b/SOURCES/kvm-KVM-remove-kvm_arch_cpu_check_are_resettable.patch
@@ -0,0 +1,203 @@
+From c46ac3db0a4db60e667edeabc9ed451c6e8e0ccf Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Mon, 18 Mar 2024 14:41:33 -0400
+Subject: [PATCH 020/100] KVM: remove kvm_arch_cpu_check_are_resettable
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [20/91] d7745bd1a0ed1b215847f150f4a1bb2e912beabc (bonzini/rhel-qemu-kvm)
+
+Board reset requires writing a fresh CPU state.  As far as KVM is
+concerned, the only thing that blocks reset is that CPU state is
+encrypted; therefore, kvm_cpus_are_resettable() can simply check
+if that is the case.
+
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit a99c0c66ebe7d8db3af6f16689ade9375247e43e)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ accel/kvm/kvm-accel-ops.c  |  2 +-
+ accel/kvm/kvm-all.c        |  5 -----
+ include/sysemu/kvm.h       | 10 ----------
+ target/arm/kvm.c           |  5 -----
+ target/i386/kvm/kvm.c      |  5 -----
+ target/loongarch/kvm/kvm.c |  5 -----
+ target/mips/kvm.c          |  5 -----
+ target/ppc/kvm.c           |  5 -----
+ target/riscv/kvm/kvm-cpu.c |  5 -----
+ target/s390x/kvm/kvm.c     |  5 -----
+ 10 files changed, 1 insertion(+), 51 deletions(-)
+
+diff --git a/accel/kvm/kvm-accel-ops.c b/accel/kvm/kvm-accel-ops.c
+index b3c946dc4b..74e3c5785b 100644
+--- a/accel/kvm/kvm-accel-ops.c
++++ b/accel/kvm/kvm-accel-ops.c
+@@ -82,7 +82,7 @@ static bool kvm_vcpu_thread_is_idle(CPUState *cpu)
+ 
+ static bool kvm_cpus_are_resettable(void)
+ {
+-    return !kvm_enabled() || kvm_cpu_check_are_resettable();
++    return !kvm_enabled() || !kvm_state->guest_state_protected;
+ }
+ 
+ #ifdef KVM_CAP_SET_GUEST_DEBUG
+diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
+index ec0f6df7c5..b51e09a583 100644
+--- a/accel/kvm/kvm-all.c
++++ b/accel/kvm/kvm-all.c
+@@ -2696,11 +2696,6 @@ void kvm_flush_coalesced_mmio_buffer(void)
+     s->coalesced_flush_in_progress = false;
+ }
+ 
+-bool kvm_cpu_check_are_resettable(void)
+-{
+-    return kvm_arch_cpu_check_are_resettable();
+-}
+-
+ static void do_kvm_cpu_synchronize_state(CPUState *cpu, run_on_cpu_data arg)
+ {
+     if (!cpu->vcpu_dirty && !kvm_state->guest_state_protected) {
+diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
+index 302e8f6f1e..54f4d83a37 100644
+--- a/include/sysemu/kvm.h
++++ b/include/sysemu/kvm.h
+@@ -525,16 +525,6 @@ int kvm_get_one_reg(CPUState *cs, uint64_t id, void *target);
+ /* Notify resamplefd for EOI of specific interrupts. */
+ void kvm_resample_fd_notify(int gsi);
+ 
+-/**
+- * kvm_cpu_check_are_resettable - return whether CPUs can be reset
+- *
+- * Returns: true: CPUs are resettable
+- *          false: CPUs are not resettable
+- */
+-bool kvm_cpu_check_are_resettable(void);
+-
+-bool kvm_arch_cpu_check_are_resettable(void);
+-
+ bool kvm_dirty_ring_enabled(void);
+ 
+ uint32_t kvm_dirty_ring_size(void);
+diff --git a/target/arm/kvm.c b/target/arm/kvm.c
+index ab85d628a8..21ebbf3b8f 100644
+--- a/target/arm/kvm.c
++++ b/target/arm/kvm.c
+@@ -1598,11 +1598,6 @@ int kvm_arch_msi_data_to_gsi(uint32_t data)
+     return (data - 32) & 0xffff;
+ }
+ 
+-bool kvm_arch_cpu_check_are_resettable(void)
+-{
+-    return true;
+-}
+-
+ static void kvm_arch_get_eager_split_size(Object *obj, Visitor *v,
+                                           const char *name, void *opaque,
+                                           Error **errp)
+diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
+index e271652620..a12207a8ee 100644
+--- a/target/i386/kvm/kvm.c
++++ b/target/i386/kvm/kvm.c
+@@ -5623,11 +5623,6 @@ bool kvm_has_waitpkg(void)
+     return has_msr_umwait;
+ }
+ 
+-bool kvm_arch_cpu_check_are_resettable(void)
+-{
+-    return !sev_es_enabled();
+-}
+-
+ #define ARCH_REQ_XCOMP_GUEST_PERM       0x1025
+ 
+ void kvm_request_xsave_components(X86CPU *cpu, uint64_t mask)
+diff --git a/target/loongarch/kvm/kvm.c b/target/loongarch/kvm/kvm.c
+index d630cc39cb..8224d94333 100644
+--- a/target/loongarch/kvm/kvm.c
++++ b/target/loongarch/kvm/kvm.c
+@@ -733,11 +733,6 @@ bool kvm_arch_stop_on_emulation_error(CPUState *cs)
+     return true;
+ }
+ 
+-bool kvm_arch_cpu_check_are_resettable(void)
+-{
+-    return true;
+-}
+-
+ int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
+ {
+     int ret = 0;
+diff --git a/target/mips/kvm.c b/target/mips/kvm.c
+index 6c52e59f55..a631ab544f 100644
+--- a/target/mips/kvm.c
++++ b/target/mips/kvm.c
+@@ -1273,11 +1273,6 @@ int kvm_arch_get_default_type(MachineState *machine)
+     return -1;
+ }
+ 
+-bool kvm_arch_cpu_check_are_resettable(void)
+-{
+-    return true;
+-}
+-
+ void kvm_arch_accel_class_init(ObjectClass *oc)
+ {
+ }
+diff --git a/target/ppc/kvm.c b/target/ppc/kvm.c
+index 59f640cf7b..9d9d9f0d79 100644
+--- a/target/ppc/kvm.c
++++ b/target/ppc/kvm.c
+@@ -2968,11 +2968,6 @@ void kvmppc_set_reg_tb_offset(PowerPCCPU *cpu, int64_t tb_offset)
+     }
+ }
+ 
+-bool kvm_arch_cpu_check_are_resettable(void)
+-{
+-    return true;
+-}
+-
+ void kvm_arch_accel_class_init(ObjectClass *oc)
+ {
+ }
+diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
+index 6a6c6cae80..49d2f3ad58 100644
+--- a/target/riscv/kvm/kvm-cpu.c
++++ b/target/riscv/kvm/kvm-cpu.c
+@@ -1475,11 +1475,6 @@ void kvm_riscv_set_irq(RISCVCPU *cpu, int irq, int level)
+     }
+ }
+ 
+-bool kvm_arch_cpu_check_are_resettable(void)
+-{
+-    return true;
+-}
+-
+ static int aia_mode;
+ 
+ static const char *kvm_aia_mode_str(uint64_t mode)
+diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c
+index 55fb4855b1..4db59658e1 100644
+--- a/target/s390x/kvm/kvm.c
++++ b/target/s390x/kvm/kvm.c
+@@ -2630,11 +2630,6 @@ void kvm_s390_stop_interrupt(S390CPU *cpu)
+     kvm_s390_vcpu_interrupt(cpu, &irq);
+ }
+ 
+-bool kvm_arch_cpu_check_are_resettable(void)
+-{
+-    return true;
+-}
+-
+ int kvm_s390_get_zpci_op(void)
+ {
+     return cap_zpci_op;
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-KVM-track-whether-guest-state-is-encrypted.patch b/SOURCES/kvm-KVM-track-whether-guest-state-is-encrypted.patch
new file mode 100644
index 0000000..7cdab60
--- /dev/null
+++ b/SOURCES/kvm-KVM-track-whether-guest-state-is-encrypted.patch
@@ -0,0 +1,127 @@
+From 50399796da938c4ea7c69058fde84695bce9d794 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Mon, 18 Mar 2024 14:41:10 -0400
+Subject: [PATCH 019/100] KVM: track whether guest state is encrypted
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [19/91] 685b9c54d43d0043d15c33d13afc3a420cbe139b (bonzini/rhel-qemu-kvm)
+
+So far, KVM has allowed KVM_GET/SET_* ioctls to execute even if the
+guest state is encrypted, in which case they do nothing.  For the new
+API using VM types, instead, the ioctls will fail which is a safer and
+more robust approach.
+
+The new API will be the only one available for SEV-SNP and TDX, but it
+is also usable for SEV and SEV-ES.  In preparation for that, require
+architecture-specific KVM code to communicate the point at which guest
+state is protected (which must be after kvm_cpu_synchronize_post_init(),
+though that might change in the future in order to suppor migration).
+From that point, skip reading registers so that cpu->vcpu_dirty is
+never true: if it ever becomes true, kvm_arch_put_registers() will
+fail miserably.
+
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 5c3131c392f84c660033d511ec39872d8beb4b1e)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ accel/kvm/kvm-all.c      | 17 ++++++++++++++---
+ include/sysemu/kvm.h     |  2 ++
+ include/sysemu/kvm_int.h |  1 +
+ target/i386/sev.c        |  1 +
+ 4 files changed, 18 insertions(+), 3 deletions(-)
+
+diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
+index 931f74256e..ec0f6df7c5 100644
+--- a/accel/kvm/kvm-all.c
++++ b/accel/kvm/kvm-all.c
+@@ -2703,7 +2703,7 @@ bool kvm_cpu_check_are_resettable(void)
+ 
+ static void do_kvm_cpu_synchronize_state(CPUState *cpu, run_on_cpu_data arg)
+ {
+-    if (!cpu->vcpu_dirty) {
++    if (!cpu->vcpu_dirty && !kvm_state->guest_state_protected) {
+         int ret = kvm_arch_get_registers(cpu);
+         if (ret) {
+             error_report("Failed to get registers: %s", strerror(-ret));
+@@ -2717,7 +2717,7 @@ static void do_kvm_cpu_synchronize_state(CPUState *cpu, run_on_cpu_data arg)
+ 
+ void kvm_cpu_synchronize_state(CPUState *cpu)
+ {
+-    if (!cpu->vcpu_dirty) {
++    if (!cpu->vcpu_dirty && !kvm_state->guest_state_protected) {
+         run_on_cpu(cpu, do_kvm_cpu_synchronize_state, RUN_ON_CPU_NULL);
+     }
+ }
+@@ -2752,7 +2752,13 @@ static void do_kvm_cpu_synchronize_post_init(CPUState *cpu, run_on_cpu_data arg)
+ 
+ void kvm_cpu_synchronize_post_init(CPUState *cpu)
+ {
+-    run_on_cpu(cpu, do_kvm_cpu_synchronize_post_init, RUN_ON_CPU_NULL);
++    if (!kvm_state->guest_state_protected) {
++        /*
++         * This runs before the machine_init_done notifiers, and is the last
++         * opportunity to synchronize the state of confidential guests.
++         */
++        run_on_cpu(cpu, do_kvm_cpu_synchronize_post_init, RUN_ON_CPU_NULL);
++    }
+ }
+ 
+ static void do_kvm_cpu_synchronize_pre_loadvm(CPUState *cpu, run_on_cpu_data arg)
+@@ -4099,3 +4105,8 @@ void query_stats_schemas_cb(StatsSchemaList **result, Error **errp)
+         query_stats_schema_vcpu(first_cpu, &stats_args);
+     }
+ }
++
++void kvm_mark_guest_state_protected(void)
++{
++    kvm_state->guest_state_protected = true;
++}
+diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
+index fad9a7e8ff..302e8f6f1e 100644
+--- a/include/sysemu/kvm.h
++++ b/include/sysemu/kvm.h
+@@ -539,6 +539,8 @@ bool kvm_dirty_ring_enabled(void);
+ 
+ uint32_t kvm_dirty_ring_size(void);
+ 
++void kvm_mark_guest_state_protected(void);
++
+ /**
+  * kvm_hwpoisoned_mem - indicate if there is any hwpoisoned page
+  * reported for the VM.
+diff --git a/include/sysemu/kvm_int.h b/include/sysemu/kvm_int.h
+index 882e37e12c..3496be7997 100644
+--- a/include/sysemu/kvm_int.h
++++ b/include/sysemu/kvm_int.h
+@@ -87,6 +87,7 @@ struct KVMState
+     bool kernel_irqchip_required;
+     OnOffAuto kernel_irqchip_split;
+     bool sync_mmu;
++    bool guest_state_protected;
+     uint64_t manual_dirty_log_protect;
+     /* The man page (and posix) say ioctl numbers are signed int, but
+      * they're not.  Linux, glibc and *BSD all treat ioctl numbers as
+diff --git a/target/i386/sev.c b/target/i386/sev.c
+index b8f79d34d1..c49a8fd55e 100644
+--- a/target/i386/sev.c
++++ b/target/i386/sev.c
+@@ -755,6 +755,7 @@ sev_launch_get_measure(Notifier *notifier, void *unused)
+         if (ret) {
+             exit(1);
+         }
++        kvm_mark_guest_state_protected();
+     }
+ 
+     /* query the measurement blob length */
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-RAMBlock-Add-support-of-KVM-private-guest-memfd.patch b/SOURCES/kvm-RAMBlock-Add-support-of-KVM-private-guest-memfd.patch
new file mode 100644
index 0000000..8e47872
--- /dev/null
+++ b/SOURCES/kvm-RAMBlock-Add-support-of-KVM-private-guest-memfd.patch
@@ -0,0 +1,329 @@
+From f4b01d645926faab2cab86fadb7398c26d6b8285 Mon Sep 17 00:00:00 2001
+From: Xiaoyao Li <xiaoyao.li@intel.com>
+Date: Wed, 20 Mar 2024 03:39:02 -0500
+Subject: [PATCH 028/100] RAMBlock: Add support of KVM private guest memfd
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [28/91] 95fdf196afcb67113834c20fa354ee1397411bfd (bonzini/rhel-qemu-kvm)
+
+Add KVM guest_memfd support to RAMBlock so both normal hva based memory
+and kvm guest memfd based private memory can be associated in one RAMBlock.
+
+Introduce new flag RAM_GUEST_MEMFD. When it's set, it calls KVM ioctl to
+create private guest_memfd during RAMBlock setup.
+
+Allocating a new RAM_GUEST_MEMFD flag to instruct the setup of guest memfd
+is more flexible and extensible than simply relying on the VM type because
+in the future we may have the case that not all the memory of a VM need
+guest memfd. As a benefit, it also avoid getting MachineState in memory
+subsystem.
+
+Note, RAM_GUEST_MEMFD is supposed to be set for memory backends of
+confidential guests, such as TDX VM. How and when to set it for memory
+backends will be implemented in the following patches.
+
+Introduce memory_region_has_guest_memfd() to query if the MemoryRegion has
+KVM guest_memfd allocated.
+
+Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
+Reviewed-by: David Hildenbrand <david@redhat.com>
+Message-ID: <20240320083945.991426-7-michael.roth@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 15f7a80c49cb3637f62fa37fa4a17da913bd91ff)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ accel/kvm/kvm-all.c     | 28 ++++++++++++++++++++++++++++
+ accel/stubs/kvm-stub.c  |  5 +++++
+ include/exec/memory.h   | 20 +++++++++++++++++---
+ include/exec/ram_addr.h |  2 +-
+ include/exec/ramblock.h |  1 +
+ include/sysemu/kvm.h    |  2 ++
+ system/memory.c         |  5 +++++
+ system/physmem.c        | 34 +++++++++++++++++++++++++++++++---
+ 8 files changed, 90 insertions(+), 7 deletions(-)
+
+diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
+index 272e945f52..a7b9a127dd 100644
+--- a/accel/kvm/kvm-all.c
++++ b/accel/kvm/kvm-all.c
+@@ -92,6 +92,7 @@ static bool kvm_has_guest_debug;
+ static int kvm_sstep_flags;
+ static bool kvm_immediate_exit;
+ static uint64_t kvm_supported_memory_attributes;
++static bool kvm_guest_memfd_supported;
+ static hwaddr kvm_max_slot_size = ~0;
+ 
+ static const KVMCapabilityInfo kvm_required_capabilites[] = {
+@@ -2419,6 +2420,11 @@ static int kvm_init(MachineState *ms)
+     }
+ 
+     kvm_supported_memory_attributes = kvm_check_extension(s, KVM_CAP_MEMORY_ATTRIBUTES);
++    kvm_guest_memfd_supported =
++        kvm_check_extension(s, KVM_CAP_GUEST_MEMFD) &&
++        kvm_check_extension(s, KVM_CAP_USER_MEMORY2) &&
++        (kvm_supported_memory_attributes & KVM_MEMORY_ATTRIBUTE_PRIVATE);
++
+     kvm_immediate_exit = kvm_check_extension(s, KVM_CAP_IMMEDIATE_EXIT);
+     s->nr_slots = kvm_check_extension(s, KVM_CAP_NR_MEMSLOTS);
+ 
+@@ -4138,3 +4144,25 @@ void kvm_mark_guest_state_protected(void)
+ {
+     kvm_state->guest_state_protected = true;
+ }
++
++int kvm_create_guest_memfd(uint64_t size, uint64_t flags, Error **errp)
++{
++    int fd;
++    struct kvm_create_guest_memfd guest_memfd = {
++        .size = size,
++        .flags = flags,
++    };
++
++    if (!kvm_guest_memfd_supported) {
++        error_setg(errp, "KVM does not support guest_memfd");
++        return -1;
++    }
++
++    fd = kvm_vm_ioctl(kvm_state, KVM_CREATE_GUEST_MEMFD, &guest_memfd);
++    if (fd < 0) {
++        error_setg_errno(errp, errno, "Error creating KVM guest_memfd");
++        return -1;
++    }
++
++    return fd;
++}
+diff --git a/accel/stubs/kvm-stub.c b/accel/stubs/kvm-stub.c
+index ca38172884..8e0eb22e61 100644
+--- a/accel/stubs/kvm-stub.c
++++ b/accel/stubs/kvm-stub.c
+@@ -129,3 +129,8 @@ bool kvm_hwpoisoned_mem(void)
+ {
+     return false;
+ }
++
++int kvm_create_guest_memfd(uint64_t size, uint64_t flags, Error **errp)
++{
++    return -ENOSYS;
++}
+diff --git a/include/exec/memory.h b/include/exec/memory.h
+index 8626a355b3..679a847685 100644
+--- a/include/exec/memory.h
++++ b/include/exec/memory.h
+@@ -243,6 +243,9 @@ typedef struct IOMMUTLBEvent {
+ /* RAM FD is opened read-only */
+ #define RAM_READONLY_FD (1 << 11)
+ 
++/* RAM can be private that has kvm guest memfd backend */
++#define RAM_GUEST_MEMFD   (1 << 12)
++
+ static inline void iommu_notifier_init(IOMMUNotifier *n, IOMMUNotify fn,
+                                        IOMMUNotifierFlag flags,
+                                        hwaddr start, hwaddr end,
+@@ -1307,7 +1310,8 @@ bool memory_region_init_ram_nomigrate(MemoryRegion *mr,
+  * @name: Region name, becomes part of RAMBlock name used in migration stream
+  *        must be unique within any device
+  * @size: size of the region.
+- * @ram_flags: RamBlock flags. Supported flags: RAM_SHARED, RAM_NORESERVE.
++ * @ram_flags: RamBlock flags. Supported flags: RAM_SHARED, RAM_NORESERVE,
++ *             RAM_GUEST_MEMFD.
+  * @errp: pointer to Error*, to store an error if it happens.
+  *
+  * Note that this function does not do anything to cause the data in the
+@@ -1369,7 +1373,7 @@ bool memory_region_init_resizeable_ram(MemoryRegion *mr,
+  *         (getpagesize()) will be used.
+  * @ram_flags: RamBlock flags. Supported flags: RAM_SHARED, RAM_PMEM,
+  *             RAM_NORESERVE, RAM_PROTECTED, RAM_NAMED_FILE, RAM_READONLY,
+- *             RAM_READONLY_FD
++ *             RAM_READONLY_FD, RAM_GUEST_MEMFD
+  * @path: the path in which to allocate the RAM.
+  * @offset: offset within the file referenced by path
+  * @errp: pointer to Error*, to store an error if it happens.
+@@ -1399,7 +1403,7 @@ bool memory_region_init_ram_from_file(MemoryRegion *mr,
+  * @size: size of the region.
+  * @ram_flags: RamBlock flags. Supported flags: RAM_SHARED, RAM_PMEM,
+  *             RAM_NORESERVE, RAM_PROTECTED, RAM_NAMED_FILE, RAM_READONLY,
+- *             RAM_READONLY_FD
++ *             RAM_READONLY_FD, RAM_GUEST_MEMFD
+  * @fd: the fd to mmap.
+  * @offset: offset within the file referenced by fd
+  * @errp: pointer to Error*, to store an error if it happens.
+@@ -1722,6 +1726,16 @@ static inline bool memory_region_is_romd(MemoryRegion *mr)
+  */
+ bool memory_region_is_protected(MemoryRegion *mr);
+ 
++/**
++ * memory_region_has_guest_memfd: check whether a memory region has guest_memfd
++ *     associated
++ *
++ * Returns %true if a memory region's ram_block has valid guest_memfd assigned.
++ *
++ * @mr: the memory region being queried
++ */
++bool memory_region_has_guest_memfd(MemoryRegion *mr);
++
+ /**
+  * memory_region_get_iommu: check whether a memory region is an iommu
+  *
+diff --git a/include/exec/ram_addr.h b/include/exec/ram_addr.h
+index de45ba7bc9..07c8f86375 100644
+--- a/include/exec/ram_addr.h
++++ b/include/exec/ram_addr.h
+@@ -110,7 +110,7 @@ long qemu_maxrampagesize(void);
+  *  @mr: the memory region where the ram block is
+  *  @ram_flags: RamBlock flags. Supported flags: RAM_SHARED, RAM_PMEM,
+  *              RAM_NORESERVE, RAM_PROTECTED, RAM_NAMED_FILE, RAM_READONLY,
+- *              RAM_READONLY_FD
++ *              RAM_READONLY_FD, RAM_GUEST_MEMFD
+  *  @mem_path or @fd: specify the backing file or device
+  *  @offset: Offset into target file
+  *  @errp: pointer to Error*, to store an error if it happens
+diff --git a/include/exec/ramblock.h b/include/exec/ramblock.h
+index 848915ea5b..459c8917de 100644
+--- a/include/exec/ramblock.h
++++ b/include/exec/ramblock.h
+@@ -41,6 +41,7 @@ struct RAMBlock {
+     QLIST_HEAD(, RAMBlockNotifier) ramblock_notifiers;
+     int fd;
+     uint64_t fd_offset;
++    int guest_memfd;
+     size_t page_size;
+     /* dirty bitmap used during migration */
+     unsigned long *bmap;
+diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
+index f114ff6986..9e4ab7ae89 100644
+--- a/include/sysemu/kvm.h
++++ b/include/sysemu/kvm.h
+@@ -537,6 +537,8 @@ void kvm_mark_guest_state_protected(void);
+  */
+ bool kvm_hwpoisoned_mem(void);
+ 
++int kvm_create_guest_memfd(uint64_t size, uint64_t flags, Error **errp);
++
+ int kvm_set_memory_attributes_private(hwaddr start, uint64_t size);
+ int kvm_set_memory_attributes_shared(hwaddr start, uint64_t size);
+ 
+diff --git a/system/memory.c b/system/memory.c
+index a229a79988..c756950c0c 100644
+--- a/system/memory.c
++++ b/system/memory.c
+@@ -1850,6 +1850,11 @@ bool memory_region_is_protected(MemoryRegion *mr)
+     return mr->ram && (mr->ram_block->flags & RAM_PROTECTED);
+ }
+ 
++bool memory_region_has_guest_memfd(MemoryRegion *mr)
++{
++    return mr->ram_block && mr->ram_block->guest_memfd >= 0;
++}
++
+ uint8_t memory_region_get_dirty_log_mask(MemoryRegion *mr)
+ {
+     uint8_t mask = mr->dirty_log_mask;
+diff --git a/system/physmem.c b/system/physmem.c
+index a4fe3d2bf8..f5dfa20e57 100644
+--- a/system/physmem.c
++++ b/system/physmem.c
+@@ -1808,6 +1808,7 @@ static void ram_block_add(RAMBlock *new_block, Error **errp)
+     const bool shared = qemu_ram_is_shared(new_block);
+     RAMBlock *block;
+     RAMBlock *last_block = NULL;
++    bool free_on_error = false;
+     ram_addr_t old_ram_size, new_ram_size;
+     Error *err = NULL;
+ 
+@@ -1837,6 +1838,19 @@ static void ram_block_add(RAMBlock *new_block, Error **errp)
+                 return;
+             }
+             memory_try_enable_merging(new_block->host, new_block->max_length);
++            free_on_error = true;
++        }
++    }
++
++    if (new_block->flags & RAM_GUEST_MEMFD) {
++        assert(kvm_enabled());
++        assert(new_block->guest_memfd < 0);
++
++        new_block->guest_memfd = kvm_create_guest_memfd(new_block->max_length,
++                                                        0, errp);
++        if (new_block->guest_memfd < 0) {
++            qemu_mutex_unlock_ramlist();
++            goto out_free;
+         }
+     }
+ 
+@@ -1888,6 +1902,13 @@ static void ram_block_add(RAMBlock *new_block, Error **errp)
+         ram_block_notify_add(new_block->host, new_block->used_length,
+                              new_block->max_length);
+     }
++    return;
++
++out_free:
++    if (free_on_error) {
++        qemu_anon_ram_free(new_block->host, new_block->max_length);
++        new_block->host = NULL;
++    }
+ }
+ 
+ #ifdef CONFIG_POSIX
+@@ -1902,7 +1923,7 @@ RAMBlock *qemu_ram_alloc_from_fd(ram_addr_t size, MemoryRegion *mr,
+     /* Just support these ram flags by now. */
+     assert((ram_flags & ~(RAM_SHARED | RAM_PMEM | RAM_NORESERVE |
+                           RAM_PROTECTED | RAM_NAMED_FILE | RAM_READONLY |
+-                          RAM_READONLY_FD)) == 0);
++                          RAM_READONLY_FD | RAM_GUEST_MEMFD)) == 0);
+ 
+     if (xen_enabled()) {
+         error_setg(errp, "-mem-path not supported with Xen");
+@@ -1939,6 +1960,7 @@ RAMBlock *qemu_ram_alloc_from_fd(ram_addr_t size, MemoryRegion *mr,
+     new_block->used_length = size;
+     new_block->max_length = size;
+     new_block->flags = ram_flags;
++    new_block->guest_memfd = -1;
+     new_block->host = file_ram_alloc(new_block, size, fd, !file_size, offset,
+                                      errp);
+     if (!new_block->host) {
+@@ -2018,7 +2040,7 @@ RAMBlock *qemu_ram_alloc_internal(ram_addr_t size, ram_addr_t max_size,
+     int align;
+ 
+     assert((ram_flags & ~(RAM_SHARED | RAM_RESIZEABLE | RAM_PREALLOC |
+-                          RAM_NORESERVE)) == 0);
++                          RAM_NORESERVE | RAM_GUEST_MEMFD)) == 0);
+     assert(!host ^ (ram_flags & RAM_PREALLOC));
+ 
+     align = qemu_real_host_page_size();
+@@ -2033,6 +2055,7 @@ RAMBlock *qemu_ram_alloc_internal(ram_addr_t size, ram_addr_t max_size,
+     new_block->max_length = max_size;
+     assert(max_size >= size);
+     new_block->fd = -1;
++    new_block->guest_memfd = -1;
+     new_block->page_size = qemu_real_host_page_size();
+     new_block->host = host;
+     new_block->flags = ram_flags;
+@@ -2055,7 +2078,7 @@ RAMBlock *qemu_ram_alloc_from_ptr(ram_addr_t size, void *host,
+ RAMBlock *qemu_ram_alloc(ram_addr_t size, uint32_t ram_flags,
+                          MemoryRegion *mr, Error **errp)
+ {
+-    assert((ram_flags & ~(RAM_SHARED | RAM_NORESERVE)) == 0);
++    assert((ram_flags & ~(RAM_SHARED | RAM_NORESERVE | RAM_GUEST_MEMFD)) == 0);
+     return qemu_ram_alloc_internal(size, size, NULL, NULL, ram_flags, mr, errp);
+ }
+ 
+@@ -2083,6 +2106,11 @@ static void reclaim_ramblock(RAMBlock *block)
+     } else {
+         qemu_anon_ram_free(block->host, block->max_length);
+     }
++
++    if (block->guest_memfd >= 0) {
++        close(block->guest_memfd);
++    }
++
+     g_free(block);
+ }
+ 
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-RAMBlock-make-guest_memfd-require-uncoordinated-disc.patch b/SOURCES/kvm-RAMBlock-make-guest_memfd-require-uncoordinated-disc.patch
new file mode 100644
index 0000000..04a5fbf
--- /dev/null
+++ b/SOURCES/kvm-RAMBlock-make-guest_memfd-require-uncoordinated-disc.patch
@@ -0,0 +1,82 @@
+From bd289293604d6f33e9fb89196f0b19117ce81f89 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Wed, 20 Mar 2024 17:45:29 +0100
+Subject: [PATCH 032/100] RAMBlock: make guest_memfd require uncoordinated
+ discard
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [32/91] 0c005849026c334737b88cbd20a0ac237dfca37e (bonzini/rhel-qemu-kvm)
+
+Some subsystems like VFIO might disable ram block discard, but guest_memfd
+uses discard operations to implement conversions between private and
+shared memory.  Because of this, sequences like the following can result
+in stale IOMMU mappings:
+
+1. allocate shared page
+2. convert page shared->private
+3. discard shared page
+4. convert page private->shared
+5. allocate shared page
+6. issue DMA operations against that shared page
+
+This is not a use-after-free, because after step 3 VFIO is still pinning
+the page.  However, DMA operations in step 6 will hit the old mapping
+that was allocated in step 1.
+
+Address this by taking ram_block_discard_is_enabled() into account when
+deciding whether or not to discard pages.
+
+Since kvm_convert_memory()/guest_memfd doesn't implement a
+RamDiscardManager handler to convey and replay discard operations,
+this is a case of uncoordinated discard, which is blocked/released
+by ram_block_discard_require().  Interestingly, this function had
+no use so far.
+
+Alternative approaches would be to block discard of shared pages, but
+this would cause guests to consume twice the memory if they use VFIO;
+or to implement a RamDiscardManager and only block uncoordinated
+discard, i.e. use ram_block_coordinated_discard_require().
+
+[Commit message mostly by Michael Roth <michael.roth@amd.com>]
+
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 852f0048f3ea9f14de18eb279a99fccb6d250e8f)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ system/physmem.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/system/physmem.c b/system/physmem.c
+index f5dfa20e57..5ebcf5be11 100644
+--- a/system/physmem.c
++++ b/system/physmem.c
+@@ -1846,6 +1846,13 @@ static void ram_block_add(RAMBlock *new_block, Error **errp)
+         assert(kvm_enabled());
+         assert(new_block->guest_memfd < 0);
+ 
++        if (ram_block_discard_require(true) < 0) {
++            error_setg_errno(errp, errno,
++                             "cannot set up private guest memory: discard currently blocked");
++            error_append_hint(errp, "Are you using assigned devices?\n");
++            goto out_free;
++        }
++
+         new_block->guest_memfd = kvm_create_guest_memfd(new_block->max_length,
+                                                         0, errp);
+         if (new_block->guest_memfd < 0) {
+@@ -2109,6 +2116,7 @@ static void reclaim_ramblock(RAMBlock *block)
+ 
+     if (block->guest_memfd >= 0) {
+         close(block->guest_memfd);
++        ram_block_discard_require(false);
+     }
+ 
+     g_free(block);
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-Revert-chardev-char-socket-Fix-TLS-io-channels-sendi.patch b/SOURCES/kvm-Revert-chardev-char-socket-Fix-TLS-io-channels-sendi.patch
deleted file mode 100644
index bc0f15a..0000000
--- a/SOURCES/kvm-Revert-chardev-char-socket-Fix-TLS-io-channels-sendi.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From 2e0e4355b2d4edb66b7d8c198339e17940abd682 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Mon, 18 Mar 2024 13:03:19 +0000
-Subject: [PATCH 2/3] Revert "chardev/char-socket: Fix TLS io channels sending
- too much data to the backend"
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Daniel P. Berrangé <berrange@redhat.com>
-RH-MergeRequest: 233: Fix handling of TLS sessions in chardevs
-RH-Jira: RHEL-24614
-RH-Acked-by: Thomas Huth <thuth@redhat.com>
-RH-Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
-RH-Commit: [2/3] 1cb3d72b86ced0f70a09dfa0d325ae8a85db1b2b (berrange/centos-src-qemu)
-
-This commit results in unexpected termination of the TLS connection.
-When 'fd_can_read' returns 0, the code goes on to pass a zero length
-buffer to qio_channel_read. The TLS impl calls into gnutls_recv()
-with this zero length buffer, at which point GNUTLS returns an error
-GNUTLS_E_INVALID_REQUEST. This is treated as fatal by QEMU's TLS code
-resulting in the connection being torn down by the chardev.
-
-Simply skipping the qio_channel_read when the buffer length is zero
-is also not satisfactory, as it results in a high CPU burn busy loop
-massively slowing QEMU's functionality.
-
-The proper solution is to avoid tcp_chr_read being called at all
-unless the frontend is able to accept more data. This will be done
-in a followup commit.
-
-This reverts commit 462945cd22d2bcd233401ed3aa167d83a8e35b05
-
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-(cherry picked from commit e8ee827ffdb86ebbd5f5213a1f78123c25a90864)
----
- chardev/char-socket.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/chardev/char-socket.c b/chardev/char-socket.c
-index f48d341ebc..51d0943fce 100644
---- a/chardev/char-socket.c
-+++ b/chardev/char-socket.c
-@@ -492,9 +492,9 @@ static gboolean tcp_chr_read(QIOChannel *chan, GIOCondition cond, void *opaque)
-         s->max_size <= 0) {
-         return TRUE;
-     }
--    len = tcp_chr_read_poll(opaque);
--    if (len > sizeof(buf)) {
--        len = sizeof(buf);
-+    len = sizeof(buf);
-+    if (len > s->max_size) {
-+        len = s->max_size;
-     }
-     size = tcp_chr_recv(chr, (void *)buf, len);
-     if (size == 0 || (size == -1 && errno != EAGAIN)) {
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-Revert-chardev-use-a-child-source-for-qio-input-sour.patch b/SOURCES/kvm-Revert-chardev-use-a-child-source-for-qio-input-sour.patch
deleted file mode 100644
index 135afbe..0000000
--- a/SOURCES/kvm-Revert-chardev-use-a-child-source-for-qio-input-sour.patch
+++ /dev/null
@@ -1,216 +0,0 @@
-From ab5a33d57b48e35388928e388bb6e6479bc77651 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Mon, 18 Mar 2024 17:08:30 +0000
-Subject: [PATCH 3/3] Revert "chardev: use a child source for qio input source"
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Daniel P. Berrangé <berrange@redhat.com>
-RH-MergeRequest: 233: Fix handling of TLS sessions in chardevs
-RH-Jira: RHEL-24614
-RH-Acked-by: Thomas Huth <thuth@redhat.com>
-RH-Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
-RH-Commit: [3/3] b58e6c19c2b11d5d28db31cf1386226fb01d195e (berrange/centos-src-qemu)
-
-This reverts commit a7077b8e354d90fec26c2921aa2dea85b90dff90,
-and add comments to explain why child sources cannot be used.
-
-When a GSource is added as a child of another GSource, if its
-'prepare' function indicates readiness, then the parent's
-'prepare' function will never be run. The io_watch_poll_prepare
-absolutely *must* be run on every iteration of the main loop,
-to ensure that the chardev backend doesn't feed data to the
-frontend that it is unable to consume.
-
-At the time a7077b8e354d90fec26c2921aa2dea85b90dff90 was made,
-all the child GSource impls were relying on poll'ing an FD,
-so their 'prepare' functions would never indicate readiness
-ahead of poll() being invoked. So the buggy behaviour was
-not noticed and lay dormant.
-
-Relatively recently the QIOChannelTLS impl introduced a
-level 2 child GSource, which checks with GNUTLS whether it
-has cached any data that was decoded but not yet consumed:
-
-  commit ffda5db65aef42266a5053a4be34515106c4c7ee
-  Author: Antoine Damhet <antoine.damhet@shadow.tech>
-  Date:   Tue Nov 15 15:23:29 2022 +0100
-
-    io/channel-tls: fix handling of bigger read buffers
-
-    Since the TLS backend can read more data from the underlying QIOChannel
-    we introduce a minimal child GSource to notify if we still have more
-    data available to be read.
-
-    Signed-off-by: Antoine Damhet <antoine.damhet@shadow.tech>
-    Signed-off-by: Charles Frey <charles.frey@shadow.tech>
-    Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-
-With this, it is now quite common for the 'prepare' function
-on a QIOChannelTLS GSource to indicate immediate readiness,
-bypassing the parent GSource 'prepare' function. IOW, the
-critical 'io_watch_poll_prepare' is being skipped on some
-iterations of the main loop. As a result chardev frontend
-asserts are now being triggered as they are fed data they
-are not ready to consume.
-
-A reproducer is as follows:
-
- * In terminal 1 run a GNUTLS *echo* server
-
-   $ gnutls-serv --echo \
-                 --x509cafile ca-cert.pem \
-                 --x509keyfile server-key.pem \
-		 --x509certfile server-cert.pem \
-		 -p 9000
-
- * In terminal 2 run a QEMU guest
-
-   $ qemu-system-s390x \
-       -nodefaults \
-       -display none \
-       -object tls-creds-x509,id=tls0,dir=$PWD,endpoint=client \
-       -chardev socket,id=con0,host=localhost,port=9000,tls-creds=tls0 \
-       -device sclpconsole,chardev=con0 \
-       -hda Fedora-Cloud-Base-39-1.5.s390x.qcow2
-
-After the previous patch revert, but before this patch revert,
-this scenario will crash:
-
-  qemu-system-s390x: ../hw/char/sclpconsole.c:73: chr_read: Assertion
-  `size <= SIZE_BUFFER_VT220 - scon->iov_data_len' failed.
-
-This assert indicates that 'tcp_chr_read' was called without
-'tcp_chr_read_poll' having first been checked for ability to
-receive more data
-
-QEMU's use of a 'prepare' function to create/delete another
-GSource is rather a hack and not normally the kind of thing that
-is expected to be done by a GSource. There is no mechanism to
-force GLib to always run the 'prepare' function of a parent
-GSource. The best option is to simply not use the child source
-concept, and go back to the functional approach previously
-relied on.
-
-Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Tested-by: Thomas Huth <thuth@redhat.com>
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-(cherry picked from commit 038b4217884c6f297278bb1ec6f0463c6c8221de)
----
- chardev/char-io.c | 56 ++++++++++++++++++++++++++++++++++++++++++-----
- 1 file changed, 51 insertions(+), 5 deletions(-)
-
-diff --git a/chardev/char-io.c b/chardev/char-io.c
-index 4451128cba..dab77b112e 100644
---- a/chardev/char-io.c
-+++ b/chardev/char-io.c
-@@ -33,6 +33,7 @@ typedef struct IOWatchPoll {
-     IOCanReadHandler *fd_can_read;
-     GSourceFunc fd_read;
-     void *opaque;
-+    GMainContext *context;
- } IOWatchPoll;
- 
- static IOWatchPoll *io_watch_poll_from_source(GSource *source)
-@@ -50,28 +51,59 @@ static gboolean io_watch_poll_prepare(GSource *source,
-         return FALSE;
-     }
- 
-+    /*
-+     * We do not register the QIOChannel watch as a child GSource.
-+     * The 'prepare' function on the parent GSource will be
-+     * skipped if a child GSource's 'prepare' function indicates
-+     * readiness. We need this prepare function be guaranteed
-+     * to run on *every* iteration of the main loop, because
-+     * it is critical to ensure we remove the QIOChannel watch
-+     * if 'fd_can_read' indicates the frontend cannot receive
-+     * more data.
-+     */
-     if (now_active) {
-         iwp->src = qio_channel_create_watch(
-             iwp->ioc, G_IO_IN | G_IO_ERR | G_IO_HUP | G_IO_NVAL);
-         g_source_set_callback(iwp->src, iwp->fd_read, iwp->opaque, NULL);
--        g_source_add_child_source(source, iwp->src);
--        g_source_unref(iwp->src);
-+        g_source_attach(iwp->src, iwp->context);
-     } else {
--        g_source_remove_child_source(source, iwp->src);
-+        g_source_destroy(iwp->src);
-+        g_source_unref(iwp->src);
-         iwp->src = NULL;
-     }
-     return FALSE;
- }
- 
-+static gboolean io_watch_poll_check(GSource *source)
-+{
-+    return FALSE;
-+}
-+
- static gboolean io_watch_poll_dispatch(GSource *source, GSourceFunc callback,
-                                        gpointer user_data)
- {
--    return G_SOURCE_CONTINUE;
-+    abort();
-+}
-+
-+static void io_watch_poll_finalize(GSource *source)
-+{
-+    /*
-+     * Due to a glib bug, removing the last reference to a source
-+     * inside a finalize callback causes recursive locking (and a
-+     * deadlock).  This is not a problem inside other callbacks,
-+     * including dispatch callbacks, so we call io_remove_watch_poll
-+     * to remove this source.  At this point, iwp->src must
-+     * be NULL, or we would leak it.
-+     */
-+    IOWatchPoll *iwp = io_watch_poll_from_source(source);
-+    assert(iwp->src == NULL);
- }
- 
- static GSourceFuncs io_watch_poll_funcs = {
-     .prepare = io_watch_poll_prepare,
-+    .check = io_watch_poll_check,
-     .dispatch = io_watch_poll_dispatch,
-+    .finalize = io_watch_poll_finalize,
- };
- 
- GSource *io_add_watch_poll(Chardev *chr,
-@@ -91,6 +123,7 @@ GSource *io_add_watch_poll(Chardev *chr,
-     iwp->ioc = ioc;
-     iwp->fd_read = (GSourceFunc) fd_read;
-     iwp->src = NULL;
-+    iwp->context = context;
- 
-     name = g_strdup_printf("chardev-iowatch-%s", chr->label);
-     g_source_set_name((GSource *)iwp, name);
-@@ -101,10 +134,23 @@ GSource *io_add_watch_poll(Chardev *chr,
-     return (GSource *)iwp;
- }
- 
-+static void io_remove_watch_poll(GSource *source)
-+{
-+    IOWatchPoll *iwp;
-+
-+    iwp = io_watch_poll_from_source(source);
-+    if (iwp->src) {
-+        g_source_destroy(iwp->src);
-+        g_source_unref(iwp->src);
-+        iwp->src = NULL;
-+    }
-+    g_source_destroy(&iwp->parent);
-+}
-+
- void remove_fd_in_watch(Chardev *chr)
- {
-     if (chr->gsource) {
--        g_source_destroy(chr->gsource);
-+        io_remove_watch_poll(chr->gsource);
-         chr->gsource = NULL;
-     }
- }
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-Revert-monitor-use-aio_co_reschedule_self.patch b/SOURCES/kvm-Revert-monitor-use-aio_co_reschedule_self.patch
new file mode 100644
index 0000000..32e792e
--- /dev/null
+++ b/SOURCES/kvm-Revert-monitor-use-aio_co_reschedule_self.patch
@@ -0,0 +1,67 @@
+From d4e6f7105b00ba2536d5d733b7c03116f28ce116 Mon Sep 17 00:00:00 2001
+From: Stefan Hajnoczi <stefanha@redhat.com>
+Date: Mon, 6 May 2024 15:06:21 -0400
+Subject: [PATCH 2/5] Revert "monitor: use aio_co_reschedule_self()"
+
+RH-Author: Kevin Wolf <kwolf@redhat.com>
+RH-MergeRequest: 248: Revert "monitor: use aio_co_reschedule_self()"
+RH-Jira: RHEL-34618 RHEL-38697
+RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [1/2] b6a2ebd4a69dbcd2bd56c61e7c747f8f8f42337e (kmwolf/centos-qemu-kvm)
+
+Commit 1f25c172f837 ("monitor: use aio_co_reschedule_self()") was a code
+cleanup that uses aio_co_reschedule_self() instead of open coding
+coroutine rescheduling.
+
+Bug RHEL-34618 was reported and Kevin Wolf <kwolf@redhat.com> identified
+the root cause. I missed that aio_co_reschedule_self() ->
+qemu_get_current_aio_context() only knows about
+qemu_aio_context/IOThread AioContexts and not about iohandler_ctx. It
+does not function correctly when going back from the iohandler_ctx to
+qemu_aio_context.
+
+Go back to open coding the AioContext transitions to avoid this bug.
+
+This reverts commit 1f25c172f83704e350c0829438d832384084a74d.
+
+Cc: qemu-stable@nongnu.org
+Buglink: https://issues.redhat.com/browse/RHEL-34618
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Message-ID: <20240506190622.56095-2-stefanha@redhat.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit 719c6819ed9a9838520fa732f9861918dc693bda)
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ qapi/qmp-dispatch.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/qapi/qmp-dispatch.c b/qapi/qmp-dispatch.c
+index f3488afeef..176b549473 100644
+--- a/qapi/qmp-dispatch.c
++++ b/qapi/qmp-dispatch.c
+@@ -212,7 +212,8 @@ QDict *coroutine_mixed_fn qmp_dispatch(const QmpCommandList *cmds, QObject *requ
+              * executing the command handler so that it can make progress if it
+              * involves an AIO_WAIT_WHILE().
+              */
+-            aio_co_reschedule_self(qemu_get_aio_context());
++            aio_co_schedule(qemu_get_aio_context(), qemu_coroutine_self());
++            qemu_coroutine_yield();
+         }
+ 
+         monitor_set_cur(qemu_coroutine_self(), cur_mon);
+@@ -226,7 +227,9 @@ QDict *coroutine_mixed_fn qmp_dispatch(const QmpCommandList *cmds, QObject *requ
+              * Move back to iohandler_ctx so that nested event loops for
+              * qemu_aio_context don't start new monitor commands.
+              */
+-            aio_co_reschedule_self(iohandler_get_aio_context());
++            aio_co_schedule(iohandler_get_aio_context(),
++                            qemu_coroutine_self());
++            qemu_coroutine_yield();
+         }
+     } else {
+        /*
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-Revert-x86-rhel-9.4.0-machine-type-compat-fix.patch b/SOURCES/kvm-Revert-x86-rhel-9.4.0-machine-type-compat-fix.patch
new file mode 100644
index 0000000..96756df
--- /dev/null
+++ b/SOURCES/kvm-Revert-x86-rhel-9.4.0-machine-type-compat-fix.patch
@@ -0,0 +1,38 @@
+From bcbc897cb19b3a6523de611f48f6bac6cea16c97 Mon Sep 17 00:00:00 2001
+From: Sebastian Ott <sebott@redhat.com>
+Date: Thu, 2 May 2024 13:17:03 +0200
+Subject: [PATCH 2/2] Revert "x86: rhel 9.4.0 machine type compat fix"
+
+RH-Author: Sebastian Ott <sebott@redhat.com>
+RH-MergeRequest: 237: Revert "x86: rhel 9.4.0 machine type compat fix"
+RH-Jira: RHEL-30362
+RH-Acked-by: Ani Sinha <anisinha@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [1/1] 858ec153e65e96c39ca4db17ed93fd58c77dc2eb (seott1/cos-qemu-kvm)
+
+This reverts commit c46e44f0f4e861fe412ce679b0b0204881c1c2f5.
+
+pc-q35-rhel9.4.0 and newer should stay with SMBIOS_ENTRY_POINT_TYPE_AUTO.
+
+Signed-off-by: Sebastian Ott <sebott@redhat.com>
+---
+ hw/i386/pc_q35.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
+index 2f11f9af7d..2b54944c0f 100644
+--- a/hw/i386/pc_q35.c
++++ b/hw/i386/pc_q35.c
+@@ -734,9 +734,6 @@ static void pc_q35_machine_rhel940_options(MachineClass *m)
+     pcmc->smbios_stream_product = "RHEL";
+     pcmc->smbios_stream_version = "9.4.0";
+ 
+-    /* From pc_q35_8_2_machine_options() - use SMBIOS 3.X by default */
+-    pcmc->default_smbios_ep_type = SMBIOS_ENTRY_POINT_TYPE_64;
+-
+     compat_props_add(m->compat_props, hw_compat_rhel_9_5,
+ 		     hw_compat_rhel_9_5_len);
+ }
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-aio-make-aio_context_acquire-aio_context_release-a-n.patch b/SOURCES/kvm-aio-make-aio_context_acquire-aio_context_release-a-n.patch
deleted file mode 100644
index f30b81f..0000000
--- a/SOURCES/kvm-aio-make-aio_context_acquire-aio_context_release-a-n.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From 6b5cfed21e20b372090046a934387255ff4bda58 Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Tue, 5 Dec 2023 13:20:01 -0500
-Subject: [PATCH 084/101] aio: make aio_context_acquire()/aio_context_release()
- a no-op
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 214: Remove AioContext lock
-RH-Jira: RHEL-15965
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [15/26] 723dcada900aaf08862e8221921be22506b561a8 (kmwolf/centos-qemu-kvm)
-
-aio_context_acquire()/aio_context_release() has been replaced by
-fine-grained locking to protect state shared by multiple threads. The
-AioContext lock still plays the role of balancing locking in
-AIO_WAIT_WHILE() and many functions in QEMU either require that the
-AioContext lock is held or not held for this reason. In other words, the
-AioContext lock is purely there for consistency with itself and serves
-no real purpose anymore.
-
-Stop actually acquiring/releasing the lock in
-aio_context_acquire()/aio_context_release() so that subsequent patches
-can remove callers across the codebase incrementally.
-
-I have performed "make check" and qemu-iotests stress tests across
-x86-64, ppc64le, and aarch64 to confirm that there are no failures as a
-result of eliminating the lock.
-
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Acked-by: Kevin Wolf <kwolf@redhat.com>
-Message-ID: <20231205182011.1976568-5-stefanha@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- util/async.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/util/async.c b/util/async.c
-index 8f90ddc304..04ee83d220 100644
---- a/util/async.c
-+++ b/util/async.c
-@@ -725,12 +725,12 @@ void aio_context_unref(AioContext *ctx)
- 
- void aio_context_acquire(AioContext *ctx)
- {
--    qemu_rec_mutex_lock(&ctx->lock);
-+    /* TODO remove this function */
- }
- 
- void aio_context_release(AioContext *ctx)
- {
--    qemu_rec_mutex_unlock(&ctx->lock);
-+    /* TODO remove this function */
- }
- 
- QEMU_DEFINE_STATIC_CO_TLS(AioContext *, my_aiocontext)
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-aio-remove-aio_context_acquire-aio_context_release-A.patch b/SOURCES/kvm-aio-remove-aio_context_acquire-aio_context_release-A.patch
deleted file mode 100644
index a64e246..0000000
--- a/SOURCES/kvm-aio-remove-aio_context_acquire-aio_context_release-A.patch
+++ /dev/null
@@ -1,102 +0,0 @@
-From 14913d8970090c8914dc19dad14f3b9f91985ec3 Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Tue, 5 Dec 2023 13:20:07 -0500
-Subject: [PATCH 090/101] aio: remove
- aio_context_acquire()/aio_context_release() API
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 214: Remove AioContext lock
-RH-Jira: RHEL-15965
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [21/26] 4b6d4afcac79d3248a6722b063b5fc777dc418df (kmwolf/centos-qemu-kvm)
-
-Delete these functions because nothing calls these functions anymore.
-
-I introduced these APIs in commit 98563fc3ec44 ("aio: add
-aio_context_acquire() and aio_context_release()") in 2014. It's with a
-sigh of relief that I delete these APIs almost 10 years later.
-
-Thanks to Paolo Bonzini's vision for multi-queue QEMU, we got an
-understanding of where the code needed to go in order to remove the
-limitations that the original dataplane and the IOThread/AioContext
-approach that followed it.
-
-Emanuele Giuseppe Esposito had the splendid determination to convert
-large parts of the codebase so that they no longer needed the AioContext
-lock. This was a painstaking process, both in the actual code changes
-required and the iterations of code review that Emanuele eked out of
-Kevin and me over many months.
-
-Kevin Wolf tackled multitudes of graph locking conversions to protect
-in-flight I/O from run-time changes to the block graph as well as the
-clang Thread Safety Analysis annotations that allow the compiler to
-check whether the graph lock is being used correctly.
-
-And me, well, I'm just here to add some pizzazz to the QEMU multi-queue
-block layer :). Thank you to everyone who helped with this effort,
-including Eric Blake, code reviewer extraordinaire, and others who I've
-forgotten to mention.
-
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Message-ID: <20231205182011.1976568-11-stefanha@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- include/block/aio.h | 17 -----------------
- util/async.c        | 10 ----------
- 2 files changed, 27 deletions(-)
-
-diff --git a/include/block/aio.h b/include/block/aio.h
-index f08b358077..af05512a7d 100644
---- a/include/block/aio.h
-+++ b/include/block/aio.h
-@@ -278,23 +278,6 @@ void aio_context_ref(AioContext *ctx);
-  */
- void aio_context_unref(AioContext *ctx);
- 
--/* Take ownership of the AioContext.  If the AioContext will be shared between
-- * threads, and a thread does not want to be interrupted, it will have to
-- * take ownership around calls to aio_poll().  Otherwise, aio_poll()
-- * automatically takes care of calling aio_context_acquire and
-- * aio_context_release.
-- *
-- * Note that this is separate from bdrv_drained_begin/bdrv_drained_end.  A
-- * thread still has to call those to avoid being interrupted by the guest.
-- *
-- * Bottom halves, timers and callbacks can be created or removed without
-- * acquiring the AioContext.
-- */
--void aio_context_acquire(AioContext *ctx);
--
--/* Relinquish ownership of the AioContext. */
--void aio_context_release(AioContext *ctx);
--
- /**
-  * aio_bh_schedule_oneshot_full: Allocate a new bottom half structure that will
-  * run only once and as soon as possible.
-diff --git a/util/async.c b/util/async.c
-index dfd44ef612..460529057c 100644
---- a/util/async.c
-+++ b/util/async.c
-@@ -719,16 +719,6 @@ void aio_context_unref(AioContext *ctx)
-     g_source_unref(&ctx->source);
- }
- 
--void aio_context_acquire(AioContext *ctx)
--{
--    /* TODO remove this function */
--}
--
--void aio_context_release(AioContext *ctx)
--{
--    /* TODO remove this function */
--}
--
- QEMU_DEFINE_STATIC_CO_TLS(AioContext *, my_aiocontext)
- 
- AioContext *qemu_get_current_aio_context(void)
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-aio-wait-draw-equivalence-between-AIO_WAIT_WHILE-and.patch b/SOURCES/kvm-aio-wait-draw-equivalence-between-AIO_WAIT_WHILE-and.patch
deleted file mode 100644
index 7f95b67..0000000
--- a/SOURCES/kvm-aio-wait-draw-equivalence-between-AIO_WAIT_WHILE-and.patch
+++ /dev/null
@@ -1,81 +0,0 @@
-From e1e2f3972065c4b5d6fcf37e0e1c4fb92a0d5260 Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Tue, 5 Dec 2023 13:20:06 -0500
-Subject: [PATCH 089/101] aio-wait: draw equivalence between AIO_WAIT_WHILE()
- and AIO_WAIT_WHILE_UNLOCKED()
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 214: Remove AioContext lock
-RH-Jira: RHEL-15965
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [20/26] 20e49777869714c99769263103f1b0c2c370cfcd (kmwolf/centos-qemu-kvm)
-
-Now that the AioContext lock no longer exists, AIO_WAIT_WHILE() and
-AIO_WAIT_WHILE_UNLOCKED() are equivalent.
-
-A future patch will get rid of AIO_WAIT_WHILE_UNLOCKED().
-
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Message-ID: <20231205182011.1976568-10-stefanha@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- include/block/aio-wait.h | 16 ++++------------
- 1 file changed, 4 insertions(+), 12 deletions(-)
-
-diff --git a/include/block/aio-wait.h b/include/block/aio-wait.h
-index 5449b6d742..157f105916 100644
---- a/include/block/aio-wait.h
-+++ b/include/block/aio-wait.h
-@@ -63,9 +63,6 @@ extern AioWait global_aio_wait;
-  * @ctx: the aio context, or NULL if multiple aio contexts (for which the
-  *       caller does not hold a lock) are involved in the polling condition.
-  * @cond: wait while this conditional expression is true
-- * @unlock: whether to unlock and then lock again @ctx. This applies
-- * only when waiting for another AioContext from the main loop.
-- * Otherwise it's ignored.
-  *
-  * Wait while a condition is true.  Use this to implement synchronous
-  * operations that require event loop activity.
-@@ -78,7 +75,7 @@ extern AioWait global_aio_wait;
-  * wait on conditions between two IOThreads since that could lead to deadlock,
-  * go via the main loop instead.
-  */
--#define AIO_WAIT_WHILE_INTERNAL(ctx, cond, unlock) ({              \
-+#define AIO_WAIT_WHILE_INTERNAL(ctx, cond) ({                      \
-     bool waited_ = false;                                          \
-     AioWait *wait_ = &global_aio_wait;                             \
-     AioContext *ctx_ = (ctx);                                      \
-@@ -95,13 +92,7 @@ extern AioWait global_aio_wait;
-         assert(qemu_get_current_aio_context() ==                   \
-                qemu_get_aio_context());                            \
-         while ((cond)) {                                           \
--            if (unlock && ctx_) {                                  \
--                aio_context_release(ctx_);                         \
--            }                                                      \
-             aio_poll(qemu_get_aio_context(), true);                \
--            if (unlock && ctx_) {                                  \
--                aio_context_acquire(ctx_);                         \
--            }                                                      \
-             waited_ = true;                                        \
-         }                                                          \
-     }                                                              \
-@@ -109,10 +100,11 @@ extern AioWait global_aio_wait;
-     waited_; })
- 
- #define AIO_WAIT_WHILE(ctx, cond)                                  \
--    AIO_WAIT_WHILE_INTERNAL(ctx, cond, true)
-+    AIO_WAIT_WHILE_INTERNAL(ctx, cond)
- 
-+/* TODO replace this with AIO_WAIT_WHILE() in a future patch */
- #define AIO_WAIT_WHILE_UNLOCKED(ctx, cond)                         \
--    AIO_WAIT_WHILE_INTERNAL(ctx, cond, false)
-+    AIO_WAIT_WHILE_INTERNAL(ctx, cond)
- 
- /**
-  * aio_wait_kick:
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-aio-warn-about-iohandler_ctx-special-casing.patch b/SOURCES/kvm-aio-warn-about-iohandler_ctx-special-casing.patch
new file mode 100644
index 0000000..a0d9d31
--- /dev/null
+++ b/SOURCES/kvm-aio-warn-about-iohandler_ctx-special-casing.patch
@@ -0,0 +1,64 @@
+From 0e3934e89ad1dda21681f64ff38da69b07d1b531 Mon Sep 17 00:00:00 2001
+From: Stefan Hajnoczi <stefanha@redhat.com>
+Date: Mon, 6 May 2024 15:06:22 -0400
+Subject: [PATCH 3/5] aio: warn about iohandler_ctx special casing
+
+RH-Author: Kevin Wolf <kwolf@redhat.com>
+RH-MergeRequest: 248: Revert "monitor: use aio_co_reschedule_self()"
+RH-Jira: RHEL-34618 RHEL-38697
+RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [2/2] cc316d70b2c187ee0412d6560ca1a03e381a69c1 (kmwolf/centos-qemu-kvm)
+
+The main loop has two AioContexts: qemu_aio_context and iohandler_ctx.
+The main loop runs them both, but nested aio_poll() calls on
+qemu_aio_context exclude iohandler_ctx.
+
+Which one should qemu_get_current_aio_context() return when called from
+the main loop? Document that it's always qemu_aio_context.
+
+This has subtle effects on functions that use
+qemu_get_current_aio_context(). For example, aio_co_reschedule_self()
+does not work when moving from iohandler_ctx to qemu_aio_context because
+qemu_get_current_aio_context() does not differentiate these two
+AioContexts.
+
+Document this in order to reduce the chance of future bugs.
+
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Message-ID: <20240506190622.56095-3-stefanha@redhat.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit e669e800fc9ef8806af5c5578249ab758a4f8a5a)
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ include/block/aio.h | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/include/block/aio.h b/include/block/aio.h
+index 8378553eb9..4ee81936ed 100644
+--- a/include/block/aio.h
++++ b/include/block/aio.h
+@@ -629,6 +629,9 @@ void aio_co_schedule(AioContext *ctx, Coroutine *co);
+  *
+  * Move the currently running coroutine to new_ctx. If the coroutine is already
+  * running in new_ctx, do nothing.
++ *
++ * Note that this function cannot reschedule from iohandler_ctx to
++ * qemu_aio_context.
+  */
+ void coroutine_fn aio_co_reschedule_self(AioContext *new_ctx);
+ 
+@@ -661,6 +664,9 @@ void aio_co_enter(AioContext *ctx, Coroutine *co);
+  * If called from an IOThread this will be the IOThread's AioContext.  If
+  * called from the main thread or with the "big QEMU lock" taken it
+  * will be the main loop AioContext.
++ *
++ * Note that the return value is never the main loop's iohandler_ctx and the
++ * return value is the main loop AioContext instead.
+  */
+ AioContext *qemu_get_current_aio_context(void);
+ 
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-backends-iommufd-Introduce-the-iommufd-object.patch b/SOURCES/kvm-backends-iommufd-Introduce-the-iommufd-object.patch
deleted file mode 100644
index 898e35b..0000000
--- a/SOURCES/kvm-backends-iommufd-Introduce-the-iommufd-object.patch
+++ /dev/null
@@ -1,476 +0,0 @@
-From 0d8255c98b3ef6f603ff0279592d3e91de26de0e Mon Sep 17 00:00:00 2001
-From: Eric Auger <eric.auger@redhat.com>
-Date: Tue, 21 Nov 2023 16:44:00 +0800
-Subject: [PATCH 021/101] backends/iommufd: Introduce the iommufd object
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [20/67] 8a56344ab4a2126f248bfa492ccddd19265f39be (eauger1/centos-qemu-kvm)
-
-Introduce an iommufd object which allows the interaction
-with the host /dev/iommu device.
-
-The /dev/iommu can have been already pre-opened outside of qemu,
-in which case the fd can be passed directly along with the
-iommufd object:
-
-This allows the iommufd object to be shared accross several
-subsystems (VFIO, VDPA, ...). For example, libvirt would open
-the /dev/iommu once.
-
-If no fd is passed along with the iommufd object, the /dev/iommu
-is opened by the qemu code.
-
-Suggested-by: Alex Williamson <alex.williamson@redhat.com>
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
-Signed-off-by: Yi Liu <yi.l.liu@intel.com>
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Tested-by: Eric Auger <eric.auger@redhat.com>
-Tested-by: Nicolin Chen <nicolinc@nvidia.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 6e6d8ac62b5b38dc9d4b69ffdf073f0a0b43b7be)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- MAINTAINERS              |   8 ++
- backends/Kconfig         |   4 +
- backends/iommufd.c       | 245 +++++++++++++++++++++++++++++++++++++++
- backends/meson.build     |   1 +
- backends/trace-events    |  10 ++
- include/sysemu/iommufd.h |  38 ++++++
- qapi/qom.json            |  19 +++
- qemu-options.hx          |  12 ++
- 8 files changed, 337 insertions(+)
- create mode 100644 backends/iommufd.c
- create mode 100644 include/sysemu/iommufd.h
-
-diff --git a/MAINTAINERS b/MAINTAINERS
-index 695e0bd34f..a5a446914a 100644
---- a/MAINTAINERS
-+++ b/MAINTAINERS
-@@ -2167,6 +2167,14 @@ F: hw/vfio/ap.c
- F: docs/system/s390x/vfio-ap.rst
- L: qemu-s390x@nongnu.org
- 
-+iommufd
-+M: Yi Liu <yi.l.liu@intel.com>
-+M: Eric Auger <eric.auger@redhat.com>
-+M: Zhenzhong Duan <zhenzhong.duan@intel.com>
-+S: Supported
-+F: backends/iommufd.c
-+F: include/sysemu/iommufd.h
-+
- vhost
- M: Michael S. Tsirkin <mst@redhat.com>
- S: Supported
-diff --git a/backends/Kconfig b/backends/Kconfig
-index f35abc1609..2cb23f62fa 100644
---- a/backends/Kconfig
-+++ b/backends/Kconfig
-@@ -1 +1,5 @@
- source tpm/Kconfig
-+
-+config IOMMUFD
-+    bool
-+    depends on VFIO
-diff --git a/backends/iommufd.c b/backends/iommufd.c
-new file mode 100644
-index 0000000000..ba58a0eb0d
---- /dev/null
-+++ b/backends/iommufd.c
-@@ -0,0 +1,245 @@
-+/*
-+ * iommufd container backend
-+ *
-+ * Copyright (C) 2023 Intel Corporation.
-+ * Copyright Red Hat, Inc. 2023
-+ *
-+ * Authors: Yi Liu <yi.l.liu@intel.com>
-+ *          Eric Auger <eric.auger@redhat.com>
-+ *
-+ * SPDX-License-Identifier: GPL-2.0-or-later
-+ */
-+
-+#include "qemu/osdep.h"
-+#include "sysemu/iommufd.h"
-+#include "qapi/error.h"
-+#include "qapi/qmp/qerror.h"
-+#include "qemu/module.h"
-+#include "qom/object_interfaces.h"
-+#include "qemu/error-report.h"
-+#include "monitor/monitor.h"
-+#include "trace.h"
-+#include <sys/ioctl.h>
-+#include <linux/iommufd.h>
-+
-+static void iommufd_backend_init(Object *obj)
-+{
-+    IOMMUFDBackend *be = IOMMUFD_BACKEND(obj);
-+
-+    be->fd = -1;
-+    be->users = 0;
-+    be->owned = true;
-+    qemu_mutex_init(&be->lock);
-+}
-+
-+static void iommufd_backend_finalize(Object *obj)
-+{
-+    IOMMUFDBackend *be = IOMMUFD_BACKEND(obj);
-+
-+    if (be->owned) {
-+        close(be->fd);
-+        be->fd = -1;
-+    }
-+}
-+
-+static void iommufd_backend_set_fd(Object *obj, const char *str, Error **errp)
-+{
-+    IOMMUFDBackend *be = IOMMUFD_BACKEND(obj);
-+    int fd = -1;
-+
-+    fd = monitor_fd_param(monitor_cur(), str, errp);
-+    if (fd == -1) {
-+        error_prepend(errp, "Could not parse remote object fd %s:", str);
-+        return;
-+    }
-+    qemu_mutex_lock(&be->lock);
-+    be->fd = fd;
-+    be->owned = false;
-+    qemu_mutex_unlock(&be->lock);
-+    trace_iommu_backend_set_fd(be->fd);
-+}
-+
-+static bool iommufd_backend_can_be_deleted(UserCreatable *uc)
-+{
-+    IOMMUFDBackend *be = IOMMUFD_BACKEND(uc);
-+
-+    return !be->users;
-+}
-+
-+static void iommufd_backend_class_init(ObjectClass *oc, void *data)
-+{
-+    UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
-+
-+    ucc->can_be_deleted = iommufd_backend_can_be_deleted;
-+
-+    object_class_property_add_str(oc, "fd", NULL, iommufd_backend_set_fd);
-+}
-+
-+int iommufd_backend_connect(IOMMUFDBackend *be, Error **errp)
-+{
-+    int fd, ret = 0;
-+
-+    qemu_mutex_lock(&be->lock);
-+    if (be->users == UINT32_MAX) {
-+        error_setg(errp, "too many connections");
-+        ret = -E2BIG;
-+        goto out;
-+    }
-+    if (be->owned && !be->users) {
-+        fd = qemu_open_old("/dev/iommu", O_RDWR);
-+        if (fd < 0) {
-+            error_setg_errno(errp, errno, "/dev/iommu opening failed");
-+            ret = fd;
-+            goto out;
-+        }
-+        be->fd = fd;
-+    }
-+    be->users++;
-+out:
-+    trace_iommufd_backend_connect(be->fd, be->owned,
-+                                  be->users, ret);
-+    qemu_mutex_unlock(&be->lock);
-+    return ret;
-+}
-+
-+void iommufd_backend_disconnect(IOMMUFDBackend *be)
-+{
-+    qemu_mutex_lock(&be->lock);
-+    if (!be->users) {
-+        goto out;
-+    }
-+    be->users--;
-+    if (!be->users && be->owned) {
-+        close(be->fd);
-+        be->fd = -1;
-+    }
-+out:
-+    trace_iommufd_backend_disconnect(be->fd, be->users);
-+    qemu_mutex_unlock(&be->lock);
-+}
-+
-+int iommufd_backend_alloc_ioas(IOMMUFDBackend *be, uint32_t *ioas_id,
-+                               Error **errp)
-+{
-+    int ret, fd = be->fd;
-+    struct iommu_ioas_alloc alloc_data  = {
-+        .size = sizeof(alloc_data),
-+        .flags = 0,
-+    };
-+
-+    ret = ioctl(fd, IOMMU_IOAS_ALLOC, &alloc_data);
-+    if (ret) {
-+        error_setg_errno(errp, errno, "Failed to allocate ioas");
-+        return ret;
-+    }
-+
-+    *ioas_id = alloc_data.out_ioas_id;
-+    trace_iommufd_backend_alloc_ioas(fd, *ioas_id, ret);
-+
-+    return ret;
-+}
-+
-+void iommufd_backend_free_id(IOMMUFDBackend *be, uint32_t id)
-+{
-+    int ret, fd = be->fd;
-+    struct iommu_destroy des = {
-+        .size = sizeof(des),
-+        .id = id,
-+    };
-+
-+    ret = ioctl(fd, IOMMU_DESTROY, &des);
-+    trace_iommufd_backend_free_id(fd, id, ret);
-+    if (ret) {
-+        error_report("Failed to free id: %u %m", id);
-+    }
-+}
-+
-+int iommufd_backend_map_dma(IOMMUFDBackend *be, uint32_t ioas_id, hwaddr iova,
-+                            ram_addr_t size, void *vaddr, bool readonly)
-+{
-+    int ret, fd = be->fd;
-+    struct iommu_ioas_map map = {
-+        .size = sizeof(map),
-+        .flags = IOMMU_IOAS_MAP_READABLE |
-+                 IOMMU_IOAS_MAP_FIXED_IOVA,
-+        .ioas_id = ioas_id,
-+        .__reserved = 0,
-+        .user_va = (uintptr_t)vaddr,
-+        .iova = iova,
-+        .length = size,
-+    };
-+
-+    if (!readonly) {
-+        map.flags |= IOMMU_IOAS_MAP_WRITEABLE;
-+    }
-+
-+    ret = ioctl(fd, IOMMU_IOAS_MAP, &map);
-+    trace_iommufd_backend_map_dma(fd, ioas_id, iova, size,
-+                                  vaddr, readonly, ret);
-+    if (ret) {
-+        ret = -errno;
-+
-+        /* TODO: Not support mapping hardware PCI BAR region for now. */
-+        if (errno == EFAULT) {
-+            warn_report("IOMMU_IOAS_MAP failed: %m, PCI BAR?");
-+        } else {
-+            error_report("IOMMU_IOAS_MAP failed: %m");
-+        }
-+    }
-+    return ret;
-+}
-+
-+int iommufd_backend_unmap_dma(IOMMUFDBackend *be, uint32_t ioas_id,
-+                              hwaddr iova, ram_addr_t size)
-+{
-+    int ret, fd = be->fd;
-+    struct iommu_ioas_unmap unmap = {
-+        .size = sizeof(unmap),
-+        .ioas_id = ioas_id,
-+        .iova = iova,
-+        .length = size,
-+    };
-+
-+    ret = ioctl(fd, IOMMU_IOAS_UNMAP, &unmap);
-+    /*
-+     * IOMMUFD takes mapping as some kind of object, unmapping
-+     * nonexistent mapping is treated as deleting a nonexistent
-+     * object and return ENOENT. This is different from legacy
-+     * backend which allows it. vIOMMU may trigger a lot of
-+     * redundant unmapping, to avoid flush the log, treat them
-+     * as succeess for IOMMUFD just like legacy backend.
-+     */
-+    if (ret && errno == ENOENT) {
-+        trace_iommufd_backend_unmap_dma_non_exist(fd, ioas_id, iova, size, ret);
-+        ret = 0;
-+    } else {
-+        trace_iommufd_backend_unmap_dma(fd, ioas_id, iova, size, ret);
-+    }
-+
-+    if (ret) {
-+        ret = -errno;
-+        error_report("IOMMU_IOAS_UNMAP failed: %m");
-+    }
-+    return ret;
-+}
-+
-+static const TypeInfo iommufd_backend_info = {
-+    .name = TYPE_IOMMUFD_BACKEND,
-+    .parent = TYPE_OBJECT,
-+    .instance_size = sizeof(IOMMUFDBackend),
-+    .instance_init = iommufd_backend_init,
-+    .instance_finalize = iommufd_backend_finalize,
-+    .class_size = sizeof(IOMMUFDBackendClass),
-+    .class_init = iommufd_backend_class_init,
-+    .interfaces = (InterfaceInfo[]) {
-+        { TYPE_USER_CREATABLE },
-+        { }
-+    }
-+};
-+
-+static void register_types(void)
-+{
-+    type_register_static(&iommufd_backend_info);
-+}
-+
-+type_init(register_types);
-diff --git a/backends/meson.build b/backends/meson.build
-index 914c7c4afb..9a5cea480d 100644
---- a/backends/meson.build
-+++ b/backends/meson.build
-@@ -20,6 +20,7 @@ if have_vhost_user
-   system_ss.add(when: 'CONFIG_VIRTIO', if_true: files('vhost-user.c'))
- endif
- system_ss.add(when: 'CONFIG_VIRTIO_CRYPTO', if_true: files('cryptodev-vhost.c'))
-+system_ss.add(when: 'CONFIG_IOMMUFD', if_true: files('iommufd.c'))
- if have_vhost_user_crypto
-   system_ss.add(when: 'CONFIG_VIRTIO_CRYPTO', if_true: files('cryptodev-vhost-user.c'))
- endif
-diff --git a/backends/trace-events b/backends/trace-events
-index 652eb76a57..d45c6e31a6 100644
---- a/backends/trace-events
-+++ b/backends/trace-events
-@@ -5,3 +5,13 @@ dbus_vmstate_pre_save(void)
- dbus_vmstate_post_load(int version_id) "version_id: %d"
- dbus_vmstate_loading(const char *id) "id: %s"
- dbus_vmstate_saving(const char *id) "id: %s"
-+
-+# iommufd.c
-+iommufd_backend_connect(int fd, bool owned, uint32_t users, int ret) "fd=%d owned=%d users=%d (%d)"
-+iommufd_backend_disconnect(int fd, uint32_t users) "fd=%d users=%d"
-+iommu_backend_set_fd(int fd) "pre-opened /dev/iommu fd=%d"
-+iommufd_backend_map_dma(int iommufd, uint32_t ioas, uint64_t iova, uint64_t size, void *vaddr, bool readonly, int ret) " iommufd=%d ioas=%d iova=0x%"PRIx64" size=0x%"PRIx64" addr=%p readonly=%d (%d)"
-+iommufd_backend_unmap_dma_non_exist(int iommufd, uint32_t ioas, uint64_t iova, uint64_t size, int ret) " Unmap nonexistent mapping: iommufd=%d ioas=%d iova=0x%"PRIx64" size=0x%"PRIx64" (%d)"
-+iommufd_backend_unmap_dma(int iommufd, uint32_t ioas, uint64_t iova, uint64_t size, int ret) " iommufd=%d ioas=%d iova=0x%"PRIx64" size=0x%"PRIx64" (%d)"
-+iommufd_backend_alloc_ioas(int iommufd, uint32_t ioas, int ret) " iommufd=%d ioas=%d (%d)"
-+iommufd_backend_free_id(int iommufd, uint32_t id, int ret) " iommufd=%d id=%d (%d)"
-diff --git a/include/sysemu/iommufd.h b/include/sysemu/iommufd.h
-new file mode 100644
-index 0000000000..9c5524b0ed
---- /dev/null
-+++ b/include/sysemu/iommufd.h
-@@ -0,0 +1,38 @@
-+#ifndef SYSEMU_IOMMUFD_H
-+#define SYSEMU_IOMMUFD_H
-+
-+#include "qom/object.h"
-+#include "qemu/thread.h"
-+#include "exec/hwaddr.h"
-+#include "exec/cpu-common.h"
-+
-+#define TYPE_IOMMUFD_BACKEND "iommufd"
-+OBJECT_DECLARE_TYPE(IOMMUFDBackend, IOMMUFDBackendClass, IOMMUFD_BACKEND)
-+
-+struct IOMMUFDBackendClass {
-+    ObjectClass parent_class;
-+};
-+
-+struct IOMMUFDBackend {
-+    Object parent;
-+
-+    /*< protected >*/
-+    int fd;            /* /dev/iommu file descriptor */
-+    bool owned;        /* is the /dev/iommu opened internally */
-+    QemuMutex lock;
-+    uint32_t users;
-+
-+    /*< public >*/
-+};
-+
-+int iommufd_backend_connect(IOMMUFDBackend *be, Error **errp);
-+void iommufd_backend_disconnect(IOMMUFDBackend *be);
-+
-+int iommufd_backend_alloc_ioas(IOMMUFDBackend *be, uint32_t *ioas_id,
-+                               Error **errp);
-+void iommufd_backend_free_id(IOMMUFDBackend *be, uint32_t id);
-+int iommufd_backend_map_dma(IOMMUFDBackend *be, uint32_t ioas_id, hwaddr iova,
-+                            ram_addr_t size, void *vaddr, bool readonly);
-+int iommufd_backend_unmap_dma(IOMMUFDBackend *be, uint32_t ioas_id,
-+                              hwaddr iova, ram_addr_t size);
-+#endif
-diff --git a/qapi/qom.json b/qapi/qom.json
-index c53ef978ff..95516ba325 100644
---- a/qapi/qom.json
-+++ b/qapi/qom.json
-@@ -794,6 +794,23 @@
- { 'struct': 'VfioUserServerProperties',
-   'data': { 'socket': 'SocketAddress', 'device': 'str' } }
- 
-+##
-+# @IOMMUFDProperties:
-+#
-+# Properties for iommufd objects.
-+#
-+# @fd: file descriptor name previously passed via 'getfd' command,
-+#     which represents a pre-opened /dev/iommu.  This allows the
-+#     iommufd object to be shared accross several subsystems
-+#     (VFIO, VDPA, ...), and the file descriptor to be shared
-+#     with other process, e.g. DPDK.  (default: QEMU opens
-+#     /dev/iommu by itself)
-+#
-+# Since: 9.0
-+##
-+{ 'struct': 'IOMMUFDProperties',
-+  'data': { '*fd': 'str' } }
-+
- ##
- # @RngProperties:
- #
-@@ -934,6 +951,7 @@
-     'input-barrier',
-     { 'name': 'input-linux',
-       'if': 'CONFIG_LINUX' },
-+    'iommufd',
-     'iothread',
-     'main-loop',
-     { 'name': 'memory-backend-epc',
-@@ -1003,6 +1021,7 @@
-       'input-barrier':              'InputBarrierProperties',
-       'input-linux':                { 'type': 'InputLinuxProperties',
-                                       'if': 'CONFIG_LINUX' },
-+      'iommufd':                    'IOMMUFDProperties',
-       'iothread':                   'IothreadProperties',
-       'main-loop':                  'MainLoopProperties',
-       'memory-backend-epc':         { 'type': 'MemoryBackendEpcProperties',
-diff --git a/qemu-options.hx b/qemu-options.hx
-index 557118cb1f..0814f43066 100644
---- a/qemu-options.hx
-+++ b/qemu-options.hx
-@@ -5224,6 +5224,18 @@ SRST
- 
-         The ``share`` boolean option is on by default with memfd.
- 
-+    ``-object iommufd,id=id[,fd=fd]``
-+        Creates an iommufd backend which allows control of DMA mapping
-+        through the ``/dev/iommu`` device.
-+
-+        The ``id`` parameter is a unique ID which frontends (such as
-+        vfio-pci of vdpa) will use to connect with the iommufd backend.
-+
-+        The ``fd`` parameter is an optional pre-opened file descriptor
-+        resulting from ``/dev/iommu`` opening. Usually the iommufd is shared
-+        across all subsystems, bringing the benefit of centralized
-+        reference counting.
-+
-     ``-object rng-builtin,id=id``
-         Creates a random number generator backend which obtains entropy
-         from QEMU builtin functions. The ``id`` parameter is a unique ID
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-backends-iommufd-Remove-check-on-number-of-backend-u.patch b/SOURCES/kvm-backends-iommufd-Remove-check-on-number-of-backend-u.patch
deleted file mode 100644
index 5ee365b..0000000
--- a/SOURCES/kvm-backends-iommufd-Remove-check-on-number-of-backend-u.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From da9a24793e876f6f2727d57f939d882be26a47b8 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
-Date: Fri, 22 Dec 2023 08:55:23 +0100
-Subject: [PATCH 064/101] backends/iommufd: Remove check on number of backend
- users
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [63/67] ac4d4589d1f2de5ac3f0adfd8d1f27dbf6bbfdee (eauger1/centos-qemu-kvm)
-
-QOM already has a ref count on objects and it will assert much
-earlier, when INT_MAX is reached.
-
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit c2ab3a6f7411c895e538e8350fee8948ac07c1a0)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- backends/iommufd.c | 5 -----
- 1 file changed, 5 deletions(-)
-
-diff --git a/backends/iommufd.c b/backends/iommufd.c
-index ba58a0eb0d..393c0d9a37 100644
---- a/backends/iommufd.c
-+++ b/backends/iommufd.c
-@@ -80,11 +80,6 @@ int iommufd_backend_connect(IOMMUFDBackend *be, Error **errp)
-     int fd, ret = 0;
- 
-     qemu_mutex_lock(&be->lock);
--    if (be->users == UINT32_MAX) {
--        error_setg(errp, "too many connections");
--        ret = -E2BIG;
--        goto out;
--    }
-     if (be->owned && !be->users) {
-         fd = qemu_open_old("/dev/iommu", O_RDWR);
-         if (fd < 0) {
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-backends-iommufd-Remove-mutex.patch b/SOURCES/kvm-backends-iommufd-Remove-mutex.patch
deleted file mode 100644
index 83878d5..0000000
--- a/SOURCES/kvm-backends-iommufd-Remove-mutex.patch
+++ /dev/null
@@ -1,112 +0,0 @@
-From 92aff3cc1a412de01e9563802fa48848eae5283f Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
-Date: Thu, 21 Dec 2023 16:58:41 +0100
-Subject: [PATCH 065/101] backends/iommufd: Remove mutex
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [64/67] 65518432b18f18ceadafe1b0698cdaa962e84f61 (eauger1/centos-qemu-kvm)
-
-Coverity reports a concurrent data access violation because be->users
-is being accessed in iommufd_backend_can_be_deleted() without holding
-the mutex.
-
-However, these routines are called from the QEMU main thread when a
-device is created. In this case, the code paths should be protected by
-the BQL lock and it should be safe to drop the IOMMUFD backend mutex.
-Simply remove it.
-
-Fixes: CID 1531550
-Fixes: CID 1531549
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 19368b1905b4b917e915526fcbd5bfa3f7439451)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- backends/iommufd.c       | 7 -------
- include/sysemu/iommufd.h | 2 --
- 2 files changed, 9 deletions(-)
-
-diff --git a/backends/iommufd.c b/backends/iommufd.c
-index 393c0d9a37..1ef683c7b0 100644
---- a/backends/iommufd.c
-+++ b/backends/iommufd.c
-@@ -29,7 +29,6 @@ static void iommufd_backend_init(Object *obj)
-     be->fd = -1;
-     be->users = 0;
-     be->owned = true;
--    qemu_mutex_init(&be->lock);
- }
- 
- static void iommufd_backend_finalize(Object *obj)
-@@ -52,10 +51,8 @@ static void iommufd_backend_set_fd(Object *obj, const char *str, Error **errp)
-         error_prepend(errp, "Could not parse remote object fd %s:", str);
-         return;
-     }
--    qemu_mutex_lock(&be->lock);
-     be->fd = fd;
-     be->owned = false;
--    qemu_mutex_unlock(&be->lock);
-     trace_iommu_backend_set_fd(be->fd);
- }
- 
-@@ -79,7 +76,6 @@ int iommufd_backend_connect(IOMMUFDBackend *be, Error **errp)
- {
-     int fd, ret = 0;
- 
--    qemu_mutex_lock(&be->lock);
-     if (be->owned && !be->users) {
-         fd = qemu_open_old("/dev/iommu", O_RDWR);
-         if (fd < 0) {
-@@ -93,13 +89,11 @@ int iommufd_backend_connect(IOMMUFDBackend *be, Error **errp)
- out:
-     trace_iommufd_backend_connect(be->fd, be->owned,
-                                   be->users, ret);
--    qemu_mutex_unlock(&be->lock);
-     return ret;
- }
- 
- void iommufd_backend_disconnect(IOMMUFDBackend *be)
- {
--    qemu_mutex_lock(&be->lock);
-     if (!be->users) {
-         goto out;
-     }
-@@ -110,7 +104,6 @@ void iommufd_backend_disconnect(IOMMUFDBackend *be)
-     }
- out:
-     trace_iommufd_backend_disconnect(be->fd, be->users);
--    qemu_mutex_unlock(&be->lock);
- }
- 
- int iommufd_backend_alloc_ioas(IOMMUFDBackend *be, uint32_t *ioas_id,
-diff --git a/include/sysemu/iommufd.h b/include/sysemu/iommufd.h
-index 9c5524b0ed..9af27ebd6c 100644
---- a/include/sysemu/iommufd.h
-+++ b/include/sysemu/iommufd.h
-@@ -2,7 +2,6 @@
- #define SYSEMU_IOMMUFD_H
- 
- #include "qom/object.h"
--#include "qemu/thread.h"
- #include "exec/hwaddr.h"
- #include "exec/cpu-common.h"
- 
-@@ -19,7 +18,6 @@ struct IOMMUFDBackend {
-     /*< protected >*/
-     int fd;            /* /dev/iommu file descriptor */
-     bool owned;        /* is the /dev/iommu opened internally */
--    QemuMutex lock;
-     uint32_t users;
- 
-     /*< public >*/
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-block-Parse-filenames-only-when-explicitly-requested.patch b/SOURCES/kvm-block-Parse-filenames-only-when-explicitly-requested.patch
index 5ea7203..8db6199 100644
--- a/SOURCES/kvm-block-Parse-filenames-only-when-explicitly-requested.patch
+++ b/SOURCES/kvm-block-Parse-filenames-only-when-explicitly-requested.patch
@@ -1,60 +1,52 @@
-From 5c35b7d631e9cdf75512b9e1a0b5d48e8fd768d9 Mon Sep 17 00:00:00 2001
-From: Jon Maloy <jmaloy@redhat.com>
-Date: Wed, 5 Jun 2024 19:56:51 -0400
+From 2ee645a339e9ef9cd92620a8b784d18d512326be Mon Sep 17 00:00:00 2001
+From: Kevin Wolf <kwolf@redhat.com>
+Date: Thu, 25 Apr 2024 14:56:02 +0200
 Subject: [PATCH 4/4] block: Parse filenames only when explicitly requested
 
-RH-Author: Jon Maloy <jmaloy@redhat.com>
-RH-MergeRequest: 2: EMBARGOED CVE-2024-4467 for rhel-9.4.z (PRDSC)
-RH-Jira: https://issues.redhat.com/browse/RHEL-35610
+RH-Author: Hana Czenczek <hczenczek@redhat.com>
+RH-MergeRequest: 1: CVE 2024-4467 (PRDSC)
+RH-Jira: RHEL-35611
 RH-CVE: CVE-2024-4467
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Acked-by: Hanna Czenczek <hczenczek@redhat.com>
-RH-Commit: [4/4] 6f71e6a07bd5a9f8352db920f498f5fa5a2cdbfb
+RH-Acked-by: Eric Blake <eblake@redhat.com>
+RH-Commit: [4/4] f44c2941d4419e60f16dea3e9adca164e75aa78d
 
-commit f44c2941d4419e60f16dea3e9adca164e75aa78d (origin/cve-2024-4467-hreitz-rhel-9.5.0)
-Author: Kevin Wolf <kwolf@redhat.com>
-Date:   Thu Apr 25 14:56:02 2024 +0200
+When handling image filenames from legacy options such as -drive or from
+tools, these filenames are parsed for protocol prefixes, including for
+the json:{} pseudo-protocol.
 
-    block: Parse filenames only when explicitly requested
+This behaviour is intended for filenames that come directly from the
+command line and for backing files, which may come from the image file
+itself. Higher level management tools generally take care to verify that
+untrusted images don't contain a bad (or any) backing file reference;
+'qemu-img info' is a suitable tool for this.
 
-    When handling image filenames from legacy options such as -drive or from
-    tools, these filenames are parsed for protocol prefixes, including for
-    the json:{} pseudo-protocol.
+However, for other files that can be referenced in images, such as
+qcow2 data files or VMDK extents, the string from the image file is
+usually not verified by management tools - and 'qemu-img info' wouldn't
+be suitable because in contrast to backing files, it already opens these
+other referenced files. So here the string should be interpreted as a
+literal local filename. More complex configurations need to be specified
+explicitly on the command line or in QMP.
 
-    This behaviour is intended for filenames that come directly from the
-    command line and for backing files, which may come from the image file
-    itself. Higher level management tools generally take care to verify that
-    untrusted images don't contain a bad (or any) backing file reference;
-    'qemu-img info' is a suitable tool for this.
+This patch changes bdrv_open_inherit() so that it only parses filenames
+if a new parameter parse_filename is true. It is set for the top level
+in bdrv_open(), for the file child and for the backing file child. All
+other callers pass false and disable filename parsing this way.
 
-    However, for other files that can be referenced in images, such as
-    qcow2 data files or VMDK extents, the string from the image file is
-    usually not verified by management tools - and 'qemu-img info' wouldn't
-    be suitable because in contrast to backing files, it already opens these
-    other referenced files. So here the string should be interpreted as a
-    literal local filename. More complex configurations need to be specified
-    explicitly on the command line or in QMP.
-
-    This patch changes bdrv_open_inherit() so that it only parses filenames
-    if a new parameter parse_filename is true. It is set for the top level
-    in bdrv_open(), for the file child and for the backing file child. All
-    other callers pass false and disable filename parsing this way.
-
-    Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-    Reviewed-by: Eric Blake <eblake@redhat.com>
-    Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-    Reviewed-by: Hanna Czenczek <hreitz@redhat.com>
-    Upstream: N/A, embargoed
-    Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
-
-Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+Reviewed-by: Eric Blake <eblake@redhat.com>
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Reviewed-by: Hanna Czenczek <hreitz@redhat.com>
+Upstream: N/A, embargoed
+Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 ---
  block.c | 90 ++++++++++++++++++++++++++++++++++++---------------------
  1 file changed, 57 insertions(+), 33 deletions(-)
 
 diff --git a/block.c b/block.c
-index a097772238..8b6aa4a65c 100644
+index 468cf5e67d..50bdd197b7 100644
 --- a/block.c
 +++ b/block.c
 @@ -86,6 +86,7 @@ static BlockDriverState *bdrv_open_inherit(const char *filename,
@@ -65,7 +57,7 @@ index a097772238..8b6aa4a65c 100644
                                             Error **errp);
  
  static bool bdrv_recurse_has_child(BlockDriverState *bs,
-@@ -2035,7 +2036,8 @@ static void parse_json_protocol(QDict *options, const char **pfilename,
+@@ -2058,7 +2059,8 @@ static void parse_json_protocol(QDict *options, const char **pfilename,
   * block driver has been specified explicitly.
   */
  static int bdrv_fill_options(QDict **options, const char *filename,
@@ -75,7 +67,7 @@ index a097772238..8b6aa4a65c 100644
  {
      const char *drvname;
      bool protocol = *flags & BDRV_O_PROTOCOL;
-@@ -2077,7 +2079,7 @@ static int bdrv_fill_options(QDict **options, const char *filename,
+@@ -2100,7 +2102,7 @@ static int bdrv_fill_options(QDict **options, const char *filename,
      if (protocol && filename) {
          if (!qdict_haskey(*options, "filename")) {
              qdict_put_str(*options, "filename", filename);
@@ -84,7 +76,7 @@ index a097772238..8b6aa4a65c 100644
          } else {
              error_setg(errp, "Can't specify 'file' and 'filename' options at "
                               "the same time");
-@@ -3639,7 +3641,8 @@ int bdrv_open_backing_file(BlockDriverState *bs, QDict *parent_options,
+@@ -3663,7 +3665,8 @@ int bdrv_open_backing_file(BlockDriverState *bs, QDict *parent_options,
      }
  
      backing_hd = bdrv_open_inherit(backing_filename, reference, options, 0, bs,
@@ -94,7 +86,7 @@ index a097772238..8b6aa4a65c 100644
      if (!backing_hd) {
          bs->open_flags |= BDRV_O_NO_BACKING;
          error_prepend(errp, "Could not open backing file: ");
-@@ -3673,7 +3676,8 @@ free_exit:
+@@ -3697,7 +3700,8 @@ free_exit:
  static BlockDriverState *
  bdrv_open_child_bs(const char *filename, QDict *options, const char *bdref_key,
                     BlockDriverState *parent, const BdrvChildClass *child_class,
@@ -104,7 +96,7 @@ index a097772238..8b6aa4a65c 100644
  {
      BlockDriverState *bs = NULL;
      QDict *image_options;
-@@ -3704,7 +3708,8 @@ bdrv_open_child_bs(const char *filename, QDict *options, const char *bdref_key,
+@@ -3728,7 +3732,8 @@ bdrv_open_child_bs(const char *filename, QDict *options, const char *bdref_key,
      }
  
      bs = bdrv_open_inherit(filename, reference, image_options, 0,
@@ -114,7 +106,7 @@ index a097772238..8b6aa4a65c 100644
      if (!bs) {
          goto done;
      }
-@@ -3714,6 +3719,33 @@ done:
+@@ -3738,6 +3743,33 @@ done:
      return bs;
  }
  
@@ -148,7 +140,7 @@ index a097772238..8b6aa4a65c 100644
  /*
   * Opens a disk image whose options are given as BlockdevRef in another block
   * device's options.
-@@ -3737,27 +3769,15 @@ BdrvChild *bdrv_open_child(const char *filename,
+@@ -3761,27 +3793,15 @@ BdrvChild *bdrv_open_child(const char *filename,
                             BdrvChildRole child_role,
                             bool allow_none, Error **errp)
  {
@@ -182,7 +174,7 @@ index a097772238..8b6aa4a65c 100644
   *
   * @parent can move to a different AioContext in this function.
   */
-@@ -3772,8 +3792,8 @@ int bdrv_open_file_child(const char *filename,
+@@ -3796,8 +3816,8 @@ int bdrv_open_file_child(const char *filename,
      role = parent->drv->is_filter ?
          (BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY) : BDRV_CHILD_IMAGE;
  
@@ -193,7 +185,7 @@ index a097772238..8b6aa4a65c 100644
      {
          return -EINVAL;
      }
-@@ -3818,7 +3838,8 @@ BlockDriverState *bdrv_open_blockdev_ref(BlockdevRef *ref, Error **errp)
+@@ -3842,7 +3862,8 @@ BlockDriverState *bdrv_open_blockdev_ref(BlockdevRef *ref, Error **errp)
  
      }
  
@@ -203,7 +195,7 @@ index a097772238..8b6aa4a65c 100644
      obj = NULL;
      qobject_unref(obj);
      visit_free(v);
-@@ -3907,7 +3928,7 @@ static BlockDriverState * no_coroutine_fn
+@@ -3932,7 +3953,7 @@ static BlockDriverState * no_coroutine_fn
  bdrv_open_inherit(const char *filename, const char *reference, QDict *options,
                    int flags, BlockDriverState *parent,
                    const BdrvChildClass *child_class, BdrvChildRole child_role,
@@ -212,7 +204,7 @@ index a097772238..8b6aa4a65c 100644
  {
      int ret;
      BlockBackend *file = NULL;
-@@ -3955,9 +3976,11 @@ bdrv_open_inherit(const char *filename, const char *reference, QDict *options,
+@@ -3980,9 +4001,11 @@ bdrv_open_inherit(const char *filename, const char *reference, QDict *options,
      }
  
      /* json: syntax counts as explicit options, as if in the QDict */
@@ -227,7 +219,7 @@ index a097772238..8b6aa4a65c 100644
      }
  
      bs->explicit_options = qdict_clone_shallow(options);
-@@ -3982,7 +4005,8 @@ bdrv_open_inherit(const char *filename, const char *reference, QDict *options,
+@@ -4007,7 +4030,8 @@ bdrv_open_inherit(const char *filename, const char *reference, QDict *options,
                                       parent->open_flags, parent->options);
      }
  
@@ -237,7 +229,7 @@ index a097772238..8b6aa4a65c 100644
      if (ret < 0) {
          goto fail;
      }
-@@ -4051,7 +4075,7 @@ bdrv_open_inherit(const char *filename, const char *reference, QDict *options,
+@@ -4076,7 +4100,7 @@ bdrv_open_inherit(const char *filename, const char *reference, QDict *options,
  
          file_bs = bdrv_open_child_bs(filename, options, "file", bs,
                                       &child_of_bds, BDRV_CHILD_IMAGE,
@@ -246,7 +238,7 @@ index a097772238..8b6aa4a65c 100644
          if (local_err) {
              goto fail;
          }
-@@ -4200,7 +4224,7 @@ BlockDriverState *bdrv_open(const char *filename, const char *reference,
+@@ -4225,7 +4249,7 @@ BlockDriverState *bdrv_open(const char *filename, const char *reference,
      GLOBAL_STATE_CODE();
  
      return bdrv_open_inherit(filename, reference, options, flags, NULL,
diff --git a/SOURCES/kvm-block-backend-Allow-concurrent-context-changes.patch b/SOURCES/kvm-block-backend-Allow-concurrent-context-changes.patch
deleted file mode 100644
index 155fa19..0000000
--- a/SOURCES/kvm-block-backend-Allow-concurrent-context-changes.patch
+++ /dev/null
@@ -1,104 +0,0 @@
-From afa842e9fdf6e1d6e5d5785679a22779632142bd Mon Sep 17 00:00:00 2001
-From: Hanna Czenczek <hreitz@redhat.com>
-Date: Fri, 2 Feb 2024 15:47:54 +0100
-Subject: [PATCH 03/22] block-backend: Allow concurrent context changes
-
-RH-Author: Hanna Czenczek <hreitz@redhat.com>
-RH-MergeRequest: 222: Allow concurrent BlockBackend context changes
-RH-Jira: RHEL-24593
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Commit: [1/2] 9e1b535f60f7afa94a0817dc3e71136e41631c71 (hreitz/qemu-kvm-c-9-s)
-
-Since AioContext locks have been removed, a BlockBackend's AioContext
-may really change at any time (only exception is that it is often
-confined to a drained section, as noted in this patch).  Therefore,
-blk_get_aio_context() cannot rely on its root node's context always
-matching that of the BlockBackend.
-
-In practice, whether they match does not matter anymore anyway: Requests
-can be sent to BDSs from any context, so anyone who requests the BB's
-context should have no reason to require the root node to have the same
-context.  Therefore, we can and should remove the assertion to that
-effect.
-
-In addition, because the context can be set and queried from different
-threads concurrently, it has to be accessed with atomic operations.
-
-Buglink: https://issues.redhat.com/browse/RHEL-19381
-Suggested-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
-Message-ID: <20240202144755.671354-2-hreitz@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit ad893672027ffe26db498947d70cde6d4f58a111)
----
- block/block-backend.c | 22 +++++++++++-----------
- 1 file changed, 11 insertions(+), 11 deletions(-)
-
-diff --git a/block/block-backend.c b/block/block-backend.c
-index 209eb07528..9c4de79e6b 100644
---- a/block/block-backend.c
-+++ b/block/block-backend.c
-@@ -44,7 +44,7 @@ struct BlockBackend {
-     char *name;
-     int refcnt;
-     BdrvChild *root;
--    AioContext *ctx;
-+    AioContext *ctx; /* access with atomic operations only */
-     DriveInfo *legacy_dinfo;    /* null unless created by drive_new() */
-     QTAILQ_ENTRY(BlockBackend) link;         /* for block_backends */
-     QTAILQ_ENTRY(BlockBackend) monitor_link; /* for monitor_block_backends */
-@@ -2414,22 +2414,22 @@ void blk_op_unblock_all(BlockBackend *blk, Error *reason)
-     }
- }
- 
-+/**
-+ * Return BB's current AioContext.  Note that this context may change
-+ * concurrently at any time, with one exception: If the BB has a root node
-+ * attached, its context will only change through bdrv_try_change_aio_context(),
-+ * which creates a drained section.  Therefore, incrementing such a BB's
-+ * in-flight counter will prevent its context from changing.
-+ */
- AioContext *blk_get_aio_context(BlockBackend *blk)
- {
--    BlockDriverState *bs;
-     IO_CODE();
- 
-     if (!blk) {
-         return qemu_get_aio_context();
-     }
- 
--    bs = blk_bs(blk);
--    if (bs) {
--        AioContext *ctx = bdrv_get_aio_context(blk_bs(blk));
--        assert(ctx == blk->ctx);
--    }
--
--    return blk->ctx;
-+    return qatomic_read(&blk->ctx);
- }
- 
- int blk_set_aio_context(BlockBackend *blk, AioContext *new_context,
-@@ -2442,7 +2442,7 @@ int blk_set_aio_context(BlockBackend *blk, AioContext *new_context,
-     GLOBAL_STATE_CODE();
- 
-     if (!bs) {
--        blk->ctx = new_context;
-+        qatomic_set(&blk->ctx, new_context);
-         return 0;
-     }
- 
-@@ -2471,7 +2471,7 @@ static void blk_root_set_aio_ctx_commit(void *opaque)
-     AioContext *new_context = s->new_ctx;
-     ThrottleGroupMember *tgm = &blk->public.throttle_group_member;
- 
--    blk->ctx = new_context;
-+    qatomic_set(&blk->ctx, new_context);
-     if (tgm->throttle_state) {
-         throttle_group_detach_aio_context(tgm);
-         throttle_group_attach_aio_context(tgm, new_context);
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-block-coroutine-wrapper-use-qemu_get_current_aio_con.patch b/SOURCES/kvm-block-coroutine-wrapper-use-qemu_get_current_aio_con.patch
deleted file mode 100644
index df764fb..0000000
--- a/SOURCES/kvm-block-coroutine-wrapper-use-qemu_get_current_aio_con.patch
+++ /dev/null
@@ -1,69 +0,0 @@
-From b1a68aebadecd7d339cf5eaffeda15099c998528 Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Tue, 12 Sep 2023 19:10:37 -0400
-Subject: [PATCH 095/101] block-coroutine-wrapper: use
- qemu_get_current_aio_context()
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 214: Remove AioContext lock
-RH-Jira: RHEL-15965
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [26/26] cde767bcdc626e90721792e3889952057a548ac5 (kmwolf/centos-qemu-kvm)
-
-Use qemu_get_current_aio_context() in mixed wrappers and coroutine
-wrappers so that code runs in the caller's AioContext instead of moving
-to the BlockDriverState's AioContext. This change is necessary for the
-multi-queue block layer where any thread can call into the block layer.
-
-Most wrappers are IO_CODE where it's safe to use the current AioContext
-nowadays. BlockDrivers and the core block layer use their own locks and
-no longer depend on the AioContext lock for thread-safety.
-
-The bdrv_create() wrapper invokes GLOBAL_STATE code. Using the current
-AioContext is safe because this code is only called with the BQL held
-from the main loop thread.
-
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20230912231037.826804-6-stefanha@redhat.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- scripts/block-coroutine-wrapper.py | 6 ++----
- 1 file changed, 2 insertions(+), 4 deletions(-)
-
-diff --git a/scripts/block-coroutine-wrapper.py b/scripts/block-coroutine-wrapper.py
-index c9c09fcacd..dbbde99e39 100644
---- a/scripts/block-coroutine-wrapper.py
-+++ b/scripts/block-coroutine-wrapper.py
-@@ -92,8 +92,6 @@ def __init__(self, wrapper_type: str, return_type: str, name: str,
-                                  f"{self.name}")
-             self.target_name = f'{subsystem}_{subname}'
- 
--        self.ctx = self.gen_ctx()
--
-         self.get_result = 's->ret = '
-         self.ret = 'return s.ret;'
-         self.co_ret = 'return '
-@@ -167,7 +165,7 @@ def create_mixed_wrapper(func: FuncDecl) -> str:
-         {func.co_ret}{name}({ func.gen_list('{name}') });
-     }} else {{
-         {struct_name} s = {{
--            .poll_state.ctx = {func.ctx},
-+            .poll_state.ctx = qemu_get_current_aio_context(),
-             .poll_state.in_progress = true,
- 
- { func.gen_block('            .{name} = {name},') }
-@@ -191,7 +189,7 @@ def create_co_wrapper(func: FuncDecl) -> str:
- {func.return_type} {func.name}({ func.gen_list('{decl}') })
- {{
-     {struct_name} s = {{
--        .poll_state.ctx = {func.ctx},
-+        .poll_state.ctx = qemu_get_current_aio_context(),
-         .poll_state.in_progress = true,
- 
- { func.gen_block('        .{name} = {name},') }
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-block-crypto-create-ciphers-on-demand.patch b/SOURCES/kvm-block-crypto-create-ciphers-on-demand.patch
new file mode 100644
index 0000000..c2b9c47
--- /dev/null
+++ b/SOURCES/kvm-block-crypto-create-ciphers-on-demand.patch
@@ -0,0 +1,330 @@
+From a67edfb4b591acdffc5b4987601a30224376996f Mon Sep 17 00:00:00 2001
+From: Stefan Hajnoczi <stefanha@redhat.com>
+Date: Mon, 27 May 2024 11:58:50 -0400
+Subject: [PATCH 4/5] block/crypto: create ciphers on demand
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
+RH-MergeRequest: 251: block/crypto: create ciphers on demand
+RH-Jira: RHEL-36159
+RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [1/2] 22a4c87fef774cad98a6f5a79f27df50a208013d (stefanha/centos-stream-qemu-kvm)
+
+Ciphers are pre-allocated by qcrypto_block_init_cipher() depending on
+the given number of threads. The -device
+virtio-blk-pci,iothread-vq-mapping= feature allows users to assign
+multiple IOThreads to a virtio-blk device, but the association between
+the virtio-blk device and the block driver happens after the block
+driver is already open.
+
+When the number of threads given to qcrypto_block_init_cipher() is
+smaller than the actual number of threads at runtime, the
+block->n_free_ciphers > 0 assertion in qcrypto_block_pop_cipher() can
+fail.
+
+Get rid of qcrypto_block_init_cipher() n_thread's argument and allocate
+ciphers on demand.
+
+Reported-by: Qing Wang <qinwang@redhat.com>
+Buglink: https://issues.redhat.com/browse/RHEL-36159
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Message-ID: <20240527155851.892885-2-stefanha@redhat.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Acked-by: Daniel P. Berrangé <berrange@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit af206c284e4c1b17cdfb0f17e898b288c0fc1751)
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ crypto/block-luks.c |   3 +-
+ crypto/block-qcow.c |   2 +-
+ crypto/block.c      | 111 ++++++++++++++++++++++++++------------------
+ crypto/blockpriv.h  |  12 +++--
+ 4 files changed, 78 insertions(+), 50 deletions(-)
+
+diff --git a/crypto/block-luks.c b/crypto/block-luks.c
+index 3ee928fb5a..3357852c0a 100644
+--- a/crypto/block-luks.c
++++ b/crypto/block-luks.c
+@@ -1262,7 +1262,6 @@ qcrypto_block_luks_open(QCryptoBlock *block,
+                                       luks->cipher_mode,
+                                       masterkey,
+                                       luks->header.master_key_len,
+-                                      n_threads,
+                                       errp) < 0) {
+             goto fail;
+         }
+@@ -1456,7 +1455,7 @@ qcrypto_block_luks_create(QCryptoBlock *block,
+     /* Setup the block device payload encryption objects */
+     if (qcrypto_block_init_cipher(block, luks_opts.cipher_alg,
+                                   luks_opts.cipher_mode, masterkey,
+-                                  luks->header.master_key_len, 1, errp) < 0) {
++                                  luks->header.master_key_len, errp) < 0) {
+         goto error;
+     }
+ 
+diff --git a/crypto/block-qcow.c b/crypto/block-qcow.c
+index 4d7cf36a8f..02305058e3 100644
+--- a/crypto/block-qcow.c
++++ b/crypto/block-qcow.c
+@@ -75,7 +75,7 @@ qcrypto_block_qcow_init(QCryptoBlock *block,
+     ret = qcrypto_block_init_cipher(block, QCRYPTO_CIPHER_ALG_AES_128,
+                                     QCRYPTO_CIPHER_MODE_CBC,
+                                     keybuf, G_N_ELEMENTS(keybuf),
+-                                    n_threads, errp);
++                                    errp);
+     if (ret < 0) {
+         ret = -ENOTSUP;
+         goto fail;
+diff --git a/crypto/block.c b/crypto/block.c
+index 506ea1d1a3..ba6d1cebc7 100644
+--- a/crypto/block.c
++++ b/crypto/block.c
+@@ -20,6 +20,7 @@
+ 
+ #include "qemu/osdep.h"
+ #include "qapi/error.h"
++#include "qemu/lockable.h"
+ #include "blockpriv.h"
+ #include "block-qcow.h"
+ #include "block-luks.h"
+@@ -57,6 +58,8 @@ QCryptoBlock *qcrypto_block_open(QCryptoBlockOpenOptions *options,
+ {
+     QCryptoBlock *block = g_new0(QCryptoBlock, 1);
+ 
++    qemu_mutex_init(&block->mutex);
++
+     block->format = options->format;
+ 
+     if (options->format >= G_N_ELEMENTS(qcrypto_block_drivers) ||
+@@ -76,8 +79,6 @@ QCryptoBlock *qcrypto_block_open(QCryptoBlockOpenOptions *options,
+         return NULL;
+     }
+ 
+-    qemu_mutex_init(&block->mutex);
+-
+     return block;
+ }
+ 
+@@ -92,6 +93,8 @@ QCryptoBlock *qcrypto_block_create(QCryptoBlockCreateOptions *options,
+ {
+     QCryptoBlock *block = g_new0(QCryptoBlock, 1);
+ 
++    qemu_mutex_init(&block->mutex);
++
+     block->format = options->format;
+ 
+     if (options->format >= G_N_ELEMENTS(qcrypto_block_drivers) ||
+@@ -111,8 +114,6 @@ QCryptoBlock *qcrypto_block_create(QCryptoBlockCreateOptions *options,
+         return NULL;
+     }
+ 
+-    qemu_mutex_init(&block->mutex);
+-
+     return block;
+ }
+ 
+@@ -227,37 +228,42 @@ QCryptoCipher *qcrypto_block_get_cipher(QCryptoBlock *block)
+      * This function is used only in test with one thread (it's safe to skip
+      * pop/push interface), so it's enough to assert it here:
+      */
+-    assert(block->n_ciphers <= 1);
+-    return block->ciphers ? block->ciphers[0] : NULL;
++    assert(block->max_free_ciphers <= 1);
++    return block->free_ciphers ? block->free_ciphers[0] : NULL;
+ }
+ 
+ 
+-static QCryptoCipher *qcrypto_block_pop_cipher(QCryptoBlock *block)
++static QCryptoCipher *qcrypto_block_pop_cipher(QCryptoBlock *block,
++                                               Error **errp)
+ {
+-    QCryptoCipher *cipher;
+-
+-    qemu_mutex_lock(&block->mutex);
+-
+-    assert(block->n_free_ciphers > 0);
+-    block->n_free_ciphers--;
+-    cipher = block->ciphers[block->n_free_ciphers];
+-
+-    qemu_mutex_unlock(&block->mutex);
++    /* Usually there is a free cipher available */
++    WITH_QEMU_LOCK_GUARD(&block->mutex) {
++        if (block->n_free_ciphers > 0) {
++            block->n_free_ciphers--;
++            return block->free_ciphers[block->n_free_ciphers];
++        }
++    }
+ 
+-    return cipher;
++    /* Otherwise allocate a new cipher */
++    return qcrypto_cipher_new(block->alg, block->mode, block->key,
++                              block->nkey, errp);
+ }
+ 
+ 
+ static void qcrypto_block_push_cipher(QCryptoBlock *block,
+                                       QCryptoCipher *cipher)
+ {
+-    qemu_mutex_lock(&block->mutex);
++    QEMU_LOCK_GUARD(&block->mutex);
+ 
+-    assert(block->n_free_ciphers < block->n_ciphers);
+-    block->ciphers[block->n_free_ciphers] = cipher;
+-    block->n_free_ciphers++;
++    if (block->n_free_ciphers == block->max_free_ciphers) {
++        block->max_free_ciphers++;
++        block->free_ciphers = g_renew(QCryptoCipher *,
++                                      block->free_ciphers,
++                                      block->max_free_ciphers);
++    }
+ 
+-    qemu_mutex_unlock(&block->mutex);
++    block->free_ciphers[block->n_free_ciphers] = cipher;
++    block->n_free_ciphers++;
+ }
+ 
+ 
+@@ -265,24 +271,31 @@ int qcrypto_block_init_cipher(QCryptoBlock *block,
+                               QCryptoCipherAlgorithm alg,
+                               QCryptoCipherMode mode,
+                               const uint8_t *key, size_t nkey,
+-                              size_t n_threads, Error **errp)
++                              Error **errp)
+ {
+-    size_t i;
++    QCryptoCipher *cipher;
+ 
+-    assert(!block->ciphers && !block->n_ciphers && !block->n_free_ciphers);
++    assert(!block->free_ciphers && !block->max_free_ciphers &&
++           !block->n_free_ciphers);
+ 
+-    block->ciphers = g_new0(QCryptoCipher *, n_threads);
++    /* Stash away cipher parameters for qcrypto_block_pop_cipher() */
++    block->alg = alg;
++    block->mode = mode;
++    block->key = g_memdup2(key, nkey);
++    block->nkey = nkey;
+ 
+-    for (i = 0; i < n_threads; i++) {
+-        block->ciphers[i] = qcrypto_cipher_new(alg, mode, key, nkey, errp);
+-        if (!block->ciphers[i]) {
+-            qcrypto_block_free_cipher(block);
+-            return -1;
+-        }
+-        block->n_ciphers++;
+-        block->n_free_ciphers++;
++    /*
++     * Create a new cipher to validate the parameters now. This reduces the
++     * chance of cipher creation failing at I/O time.
++     */
++    cipher = qcrypto_block_pop_cipher(block, errp);
++    if (!cipher) {
++        g_free(block->key);
++        block->key = NULL;
++        return -1;
+     }
+ 
++    qcrypto_block_push_cipher(block, cipher);
+     return 0;
+ }
+ 
+@@ -291,19 +304,23 @@ void qcrypto_block_free_cipher(QCryptoBlock *block)
+ {
+     size_t i;
+ 
+-    if (!block->ciphers) {
++    g_free(block->key);
++    block->key = NULL;
++
++    if (!block->free_ciphers) {
+         return;
+     }
+ 
+-    assert(block->n_ciphers == block->n_free_ciphers);
++    /* All popped ciphers were eventually pushed back */
++    assert(block->n_free_ciphers == block->max_free_ciphers);
+ 
+-    for (i = 0; i < block->n_ciphers; i++) {
+-        qcrypto_cipher_free(block->ciphers[i]);
++    for (i = 0; i < block->max_free_ciphers; i++) {
++        qcrypto_cipher_free(block->free_ciphers[i]);
+     }
+ 
+-    g_free(block->ciphers);
+-    block->ciphers = NULL;
+-    block->n_ciphers = block->n_free_ciphers = 0;
++    g_free(block->free_ciphers);
++    block->free_ciphers = NULL;
++    block->max_free_ciphers = block->n_free_ciphers = 0;
+ }
+ 
+ QCryptoIVGen *qcrypto_block_get_ivgen(QCryptoBlock *block)
+@@ -311,7 +328,7 @@ QCryptoIVGen *qcrypto_block_get_ivgen(QCryptoBlock *block)
+     /* ivgen should be accessed under mutex. However, this function is used only
+      * in test with one thread, so it's enough to assert it here:
+      */
+-    assert(block->n_ciphers <= 1);
++    assert(block->max_free_ciphers <= 1);
+     return block->ivgen;
+ }
+ 
+@@ -446,7 +463,10 @@ int qcrypto_block_decrypt_helper(QCryptoBlock *block,
+                                  Error **errp)
+ {
+     int ret;
+-    QCryptoCipher *cipher = qcrypto_block_pop_cipher(block);
++    QCryptoCipher *cipher = qcrypto_block_pop_cipher(block, errp);
++    if (!cipher) {
++        return -1;
++    }
+ 
+     ret = do_qcrypto_block_cipher_encdec(cipher, block->niv, block->ivgen,
+                                          &block->mutex, sectorsize, offset, buf,
+@@ -465,7 +485,10 @@ int qcrypto_block_encrypt_helper(QCryptoBlock *block,
+                                  Error **errp)
+ {
+     int ret;
+-    QCryptoCipher *cipher = qcrypto_block_pop_cipher(block);
++    QCryptoCipher *cipher = qcrypto_block_pop_cipher(block, errp);
++    if (!cipher) {
++        return -1;
++    }
+ 
+     ret = do_qcrypto_block_cipher_encdec(cipher, block->niv, block->ivgen,
+                                          &block->mutex, sectorsize, offset, buf,
+diff --git a/crypto/blockpriv.h b/crypto/blockpriv.h
+index 836f3b4726..4bf6043d5d 100644
+--- a/crypto/blockpriv.h
++++ b/crypto/blockpriv.h
+@@ -32,8 +32,14 @@ struct QCryptoBlock {
+     const QCryptoBlockDriver *driver;
+     void *opaque;
+ 
+-    QCryptoCipher **ciphers;
+-    size_t n_ciphers;
++    /* Cipher parameters */
++    QCryptoCipherAlgorithm alg;
++    QCryptoCipherMode mode;
++    uint8_t *key;
++    size_t nkey;
++
++    QCryptoCipher **free_ciphers;
++    size_t max_free_ciphers;
+     size_t n_free_ciphers;
+     QCryptoIVGen *ivgen;
+     QemuMutex mutex;
+@@ -130,7 +136,7 @@ int qcrypto_block_init_cipher(QCryptoBlock *block,
+                               QCryptoCipherAlgorithm alg,
+                               QCryptoCipherMode mode,
+                               const uint8_t *key, size_t nkey,
+-                              size_t n_threads, Error **errp);
++                              Error **errp);
+ 
+ void qcrypto_block_free_cipher(QCryptoBlock *block);
+ 
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-block-file-posix-set-up-Linux-AIO-and-io_uring-in-th.patch b/SOURCES/kvm-block-file-posix-set-up-Linux-AIO-and-io_uring-in-th.patch
deleted file mode 100644
index 1783a64..0000000
--- a/SOURCES/kvm-block-file-posix-set-up-Linux-AIO-and-io_uring-in-th.patch
+++ /dev/null
@@ -1,217 +0,0 @@
-From 25cce5df341861e8ba8ec57722558e2dee3ce56a Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Thu, 14 Sep 2023 10:00:58 -0400
-Subject: [PATCH 073/101] block/file-posix: set up Linux AIO and io_uring in
- the current thread
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 214: Remove AioContext lock
-RH-Jira: RHEL-15965
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [4/26] 74c7daf805daefe706378308c3afeb28d861164b (kmwolf/centos-qemu-kvm)
-
-The file-posix block driver currently only sets up Linux AIO and
-io_uring in the BDS's AioContext. In the multi-queue block layer we must
-be able to submit I/O requests in AioContexts that do not have Linux AIO
-and io_uring set up yet since any thread can call into the block driver.
-
-Set up Linux AIO and io_uring for the current AioContext during request
-submission. We lose the ability to return an error from
-.bdrv_file_open() when Linux AIO and io_uring setup fails (e.g. due to
-resource limits). Instead the user only gets warnings and we fall back
-to aio=threads. This is still better than a fatal error after startup.
-
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20230914140101.1065008-2-stefanha@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- block/file-posix.c | 103 ++++++++++++++++++++++-----------------------
- 1 file changed, 51 insertions(+), 52 deletions(-)
-
-diff --git a/block/file-posix.c b/block/file-posix.c
-index b862406c71..35684f7e21 100644
---- a/block/file-posix.c
-+++ b/block/file-posix.c
-@@ -712,17 +712,11 @@ static int raw_open_common(BlockDriverState *bs, QDict *options,
- 
- #ifdef CONFIG_LINUX_AIO
-      /* Currently Linux does AIO only for files opened with O_DIRECT */
--    if (s->use_linux_aio) {
--        if (!(s->open_flags & O_DIRECT)) {
--            error_setg(errp, "aio=native was specified, but it requires "
--                             "cache.direct=on, which was not specified.");
--            ret = -EINVAL;
--            goto fail;
--        }
--        if (!aio_setup_linux_aio(bdrv_get_aio_context(bs), errp)) {
--            error_prepend(errp, "Unable to use native AIO: ");
--            goto fail;
--        }
-+    if (s->use_linux_aio && !(s->open_flags & O_DIRECT)) {
-+        error_setg(errp, "aio=native was specified, but it requires "
-+                         "cache.direct=on, which was not specified.");
-+        ret = -EINVAL;
-+        goto fail;
-     }
- #else
-     if (s->use_linux_aio) {
-@@ -733,14 +727,7 @@ static int raw_open_common(BlockDriverState *bs, QDict *options,
-     }
- #endif /* !defined(CONFIG_LINUX_AIO) */
- 
--#ifdef CONFIG_LINUX_IO_URING
--    if (s->use_linux_io_uring) {
--        if (!aio_setup_linux_io_uring(bdrv_get_aio_context(bs), errp)) {
--            error_prepend(errp, "Unable to use io_uring: ");
--            goto fail;
--        }
--    }
--#else
-+#ifndef CONFIG_LINUX_IO_URING
-     if (s->use_linux_io_uring) {
-         error_setg(errp, "aio=io_uring was specified, but is not supported "
-                          "in this build.");
-@@ -2444,6 +2431,48 @@ static bool bdrv_qiov_is_aligned(BlockDriverState *bs, QEMUIOVector *qiov)
-     return true;
- }
- 
-+#ifdef CONFIG_LINUX_IO_URING
-+static inline bool raw_check_linux_io_uring(BDRVRawState *s)
-+{
-+    Error *local_err = NULL;
-+    AioContext *ctx;
-+
-+    if (!s->use_linux_io_uring) {
-+        return false;
-+    }
-+
-+    ctx = qemu_get_current_aio_context();
-+    if (unlikely(!aio_setup_linux_io_uring(ctx, &local_err))) {
-+        error_reportf_err(local_err, "Unable to use linux io_uring, "
-+                                     "falling back to thread pool: ");
-+        s->use_linux_io_uring = false;
-+        return false;
-+    }
-+    return true;
-+}
-+#endif
-+
-+#ifdef CONFIG_LINUX_AIO
-+static inline bool raw_check_linux_aio(BDRVRawState *s)
-+{
-+    Error *local_err = NULL;
-+    AioContext *ctx;
-+
-+    if (!s->use_linux_aio) {
-+        return false;
-+    }
-+
-+    ctx = qemu_get_current_aio_context();
-+    if (unlikely(!aio_setup_linux_aio(ctx, &local_err))) {
-+        error_reportf_err(local_err, "Unable to use Linux AIO, "
-+                                     "falling back to thread pool: ");
-+        s->use_linux_aio = false;
-+        return false;
-+    }
-+    return true;
-+}
-+#endif
-+
- static int coroutine_fn raw_co_prw(BlockDriverState *bs, int64_t *offset_ptr,
-                                    uint64_t bytes, QEMUIOVector *qiov, int type)
- {
-@@ -2474,13 +2503,13 @@ static int coroutine_fn raw_co_prw(BlockDriverState *bs, int64_t *offset_ptr,
-     if (s->needs_alignment && !bdrv_qiov_is_aligned(bs, qiov)) {
-         type |= QEMU_AIO_MISALIGNED;
- #ifdef CONFIG_LINUX_IO_URING
--    } else if (s->use_linux_io_uring) {
-+    } else if (raw_check_linux_io_uring(s)) {
-         assert(qiov->size == bytes);
-         ret = luring_co_submit(bs, s->fd, offset, qiov, type);
-         goto out;
- #endif
- #ifdef CONFIG_LINUX_AIO
--    } else if (s->use_linux_aio) {
-+    } else if (raw_check_linux_aio(s)) {
-         assert(qiov->size == bytes);
-         ret = laio_co_submit(s->fd, offset, qiov, type,
-                               s->aio_max_batch);
-@@ -2567,39 +2596,13 @@ static int coroutine_fn raw_co_flush_to_disk(BlockDriverState *bs)
-     };
- 
- #ifdef CONFIG_LINUX_IO_URING
--    if (s->use_linux_io_uring) {
-+    if (raw_check_linux_io_uring(s)) {
-         return luring_co_submit(bs, s->fd, 0, NULL, QEMU_AIO_FLUSH);
-     }
- #endif
-     return raw_thread_pool_submit(handle_aiocb_flush, &acb);
- }
- 
--static void raw_aio_attach_aio_context(BlockDriverState *bs,
--                                       AioContext *new_context)
--{
--    BDRVRawState __attribute__((unused)) *s = bs->opaque;
--#ifdef CONFIG_LINUX_AIO
--    if (s->use_linux_aio) {
--        Error *local_err = NULL;
--        if (!aio_setup_linux_aio(new_context, &local_err)) {
--            error_reportf_err(local_err, "Unable to use native AIO, "
--                                         "falling back to thread pool: ");
--            s->use_linux_aio = false;
--        }
--    }
--#endif
--#ifdef CONFIG_LINUX_IO_URING
--    if (s->use_linux_io_uring) {
--        Error *local_err = NULL;
--        if (!aio_setup_linux_io_uring(new_context, &local_err)) {
--            error_reportf_err(local_err, "Unable to use linux io_uring, "
--                                         "falling back to thread pool: ");
--            s->use_linux_io_uring = false;
--        }
--    }
--#endif
--}
--
- static void raw_close(BlockDriverState *bs)
- {
-     BDRVRawState *s = bs->opaque;
-@@ -3896,7 +3899,6 @@ BlockDriver bdrv_file = {
-     .bdrv_co_copy_range_from = raw_co_copy_range_from,
-     .bdrv_co_copy_range_to  = raw_co_copy_range_to,
-     .bdrv_refresh_limits = raw_refresh_limits,
--    .bdrv_attach_aio_context = raw_aio_attach_aio_context,
- 
-     .bdrv_co_truncate                   = raw_co_truncate,
-     .bdrv_co_getlength                  = raw_co_getlength,
-@@ -4266,7 +4268,6 @@ static BlockDriver bdrv_host_device = {
-     .bdrv_co_copy_range_from = raw_co_copy_range_from,
-     .bdrv_co_copy_range_to  = raw_co_copy_range_to,
-     .bdrv_refresh_limits = raw_refresh_limits,
--    .bdrv_attach_aio_context = raw_aio_attach_aio_context,
- 
-     .bdrv_co_truncate                   = raw_co_truncate,
-     .bdrv_co_getlength                  = raw_co_getlength,
-@@ -4402,7 +4403,6 @@ static BlockDriver bdrv_host_cdrom = {
-     .bdrv_co_pwritev        = raw_co_pwritev,
-     .bdrv_co_flush_to_disk  = raw_co_flush_to_disk,
-     .bdrv_refresh_limits    = cdrom_refresh_limits,
--    .bdrv_attach_aio_context = raw_aio_attach_aio_context,
- 
-     .bdrv_co_truncate                   = raw_co_truncate,
-     .bdrv_co_getlength                  = raw_co_getlength,
-@@ -4528,7 +4528,6 @@ static BlockDriver bdrv_host_cdrom = {
-     .bdrv_co_pwritev        = raw_co_pwritev,
-     .bdrv_co_flush_to_disk  = raw_co_flush_to_disk,
-     .bdrv_refresh_limits    = cdrom_refresh_limits,
--    .bdrv_attach_aio_context = raw_aio_attach_aio_context,
- 
-     .bdrv_co_truncate                   = raw_co_truncate,
-     .bdrv_co_getlength                  = raw_co_getlength,
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-block-remove-AioContext-locking.patch b/SOURCES/kvm-block-remove-AioContext-locking.patch
deleted file mode 100644
index 5bcd859..0000000
--- a/SOURCES/kvm-block-remove-AioContext-locking.patch
+++ /dev/null
@@ -1,4438 +0,0 @@
-From df1400991580e8a60d711079865b56ed95830b28 Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Tue, 5 Dec 2023 13:20:03 -0500
-Subject: [PATCH 086/101] block: remove AioContext locking
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 214: Remove AioContext lock
-RH-Jira: RHEL-15965
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [17/26] b29c3ac7ea91ca356335ba047c66187317c482f9 (kmwolf/centos-qemu-kvm)
-
-This is the big patch that removes
-aio_context_acquire()/aio_context_release() from the block layer and
-affected block layer users.
-
-There isn't a clean way to split this patch and the reviewers are likely
-the same group of people, so I decided to do it in one patch.
-
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Reviewed-by: Paul Durrant <paul@xen.org>
-Message-ID: <20231205182011.1976568-7-stefanha@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- block.c                            | 234 +---------------------
- block/block-backend.c              |  14 --
- block/copy-before-write.c          |  22 +--
- block/export/export.c              |  22 +--
- block/io.c                         |  45 +----
- block/mirror.c                     |  19 --
- block/monitor/bitmap-qmp-cmds.c    |  20 +-
- block/monitor/block-hmp-cmds.c     |  29 ---
- block/qapi-sysemu.c                |  27 +--
- block/qapi.c                       |  18 +-
- block/raw-format.c                 |   5 -
- block/replication.c                |  58 +-----
- block/snapshot.c                   |  22 +--
- block/write-threshold.c            |   6 -
- blockdev.c                         | 307 +++++------------------------
- blockjob.c                         |  18 --
- hw/block/dataplane/virtio-blk.c    |  10 -
- hw/block/dataplane/xen-block.c     |  17 +-
- hw/block/virtio-blk.c              |  13 --
- hw/core/qdev-properties-system.c   |   9 -
- include/block/block-global-state.h |   9 +-
- include/block/block-io.h           |   3 +-
- include/block/snapshot.h           |   2 -
- job.c                              |  16 --
- migration/block.c                  |  34 +---
- migration/migration-hmp-cmds.c     |   3 -
- migration/savevm.c                 |  22 ---
- net/colo-compare.c                 |   2 -
- qemu-img.c                         |   4 -
- qemu-io.c                          |  10 +-
- qemu-nbd.c                         |   2 -
- replay/replay-debugging.c          |   4 -
- scripts/block-coroutine-wrapper.py |   3 -
- tests/tsan/suppressions.tsan       |   1 -
- tests/unit/test-bdrv-drain.c       |  51 +----
- tests/unit/test-bdrv-graph-mod.c   |   6 -
- tests/unit/test-block-iothread.c   |  31 ---
- tests/unit/test-blockjob.c         | 137 -------------
- tests/unit/test-replication.c      |  11 --
- util/async.c                       |   4 -
- util/vhost-user-server.c           |   3 -
- 41 files changed, 104 insertions(+), 1169 deletions(-)
-
-diff --git a/block.c b/block.c
-index 25e1ebc606..91ace5d2d5 100644
---- a/block.c
-+++ b/block.c
-@@ -1625,7 +1625,6 @@ static int no_coroutine_fn GRAPH_UNLOCKED
- bdrv_open_driver(BlockDriverState *bs, BlockDriver *drv, const char *node_name,
-                  QDict *options, int open_flags, Error **errp)
- {
--    AioContext *ctx;
-     Error *local_err = NULL;
-     int i, ret;
-     GLOBAL_STATE_CODE();
-@@ -1673,21 +1672,15 @@ bdrv_open_driver(BlockDriverState *bs, BlockDriver *drv, const char *node_name,
-     bs->supported_read_flags |= BDRV_REQ_REGISTERED_BUF;
-     bs->supported_write_flags |= BDRV_REQ_REGISTERED_BUF;
- 
--    /* Get the context after .bdrv_open, it can change the context */
--    ctx = bdrv_get_aio_context(bs);
--    aio_context_acquire(ctx);
--
-     ret = bdrv_refresh_total_sectors(bs, bs->total_sectors);
-     if (ret < 0) {
-         error_setg_errno(errp, -ret, "Could not refresh total sector count");
--        aio_context_release(ctx);
-         return ret;
-     }
- 
-     bdrv_graph_rdlock_main_loop();
-     bdrv_refresh_limits(bs, NULL, &local_err);
-     bdrv_graph_rdunlock_main_loop();
--    aio_context_release(ctx);
- 
-     if (local_err) {
-         error_propagate(errp, local_err);
-@@ -3062,7 +3055,7 @@ bdrv_attach_child_common(BlockDriverState *child_bs,
-                          Transaction *tran, Error **errp)
- {
-     BdrvChild *new_child;
--    AioContext *parent_ctx, *new_child_ctx;
-+    AioContext *parent_ctx;
-     AioContext *child_ctx = bdrv_get_aio_context(child_bs);
- 
-     assert(child_class->get_parent_desc);
-@@ -3114,12 +3107,6 @@ bdrv_attach_child_common(BlockDriverState *child_bs,
-         }
-     }
- 
--    new_child_ctx = bdrv_get_aio_context(child_bs);
--    if (new_child_ctx != child_ctx) {
--        aio_context_release(child_ctx);
--        aio_context_acquire(new_child_ctx);
--    }
--
-     bdrv_ref(child_bs);
-     /*
-      * Let every new BdrvChild start with a drained parent. Inserting the child
-@@ -3149,11 +3136,6 @@ bdrv_attach_child_common(BlockDriverState *child_bs,
-     };
-     tran_add(tran, &bdrv_attach_child_common_drv, s);
- 
--    if (new_child_ctx != child_ctx) {
--        aio_context_release(new_child_ctx);
--        aio_context_acquire(child_ctx);
--    }
--
-     return new_child;
- }
- 
-@@ -3605,7 +3587,6 @@ int bdrv_open_backing_file(BlockDriverState *bs, QDict *parent_options,
-     int ret = 0;
-     bool implicit_backing = false;
-     BlockDriverState *backing_hd;
--    AioContext *backing_hd_ctx;
-     QDict *options;
-     QDict *tmp_parent_options = NULL;
-     Error *local_err = NULL;
-@@ -3691,11 +3672,8 @@ int bdrv_open_backing_file(BlockDriverState *bs, QDict *parent_options,
- 
-     /* Hook up the backing file link; drop our reference, bs owns the
-      * backing_hd reference now */
--    backing_hd_ctx = bdrv_get_aio_context(backing_hd);
--    aio_context_acquire(backing_hd_ctx);
-     ret = bdrv_set_backing_hd(bs, backing_hd, errp);
-     bdrv_unref(backing_hd);
--    aio_context_release(backing_hd_ctx);
- 
-     if (ret < 0) {
-         goto free_exit;
-@@ -3780,7 +3758,6 @@ BdrvChild *bdrv_open_child(const char *filename,
- {
-     BlockDriverState *bs;
-     BdrvChild *child;
--    AioContext *ctx;
- 
-     GLOBAL_STATE_CODE();
- 
-@@ -3791,11 +3768,8 @@ BdrvChild *bdrv_open_child(const char *filename,
-     }
- 
-     bdrv_graph_wrlock();
--    ctx = bdrv_get_aio_context(bs);
--    aio_context_acquire(ctx);
-     child = bdrv_attach_child(parent, bs, bdref_key, child_class, child_role,
-                               errp);
--    aio_context_release(ctx);
-     bdrv_graph_wrunlock();
- 
-     return child;
-@@ -3881,7 +3855,6 @@ static BlockDriverState *bdrv_append_temp_snapshot(BlockDriverState *bs,
-     int64_t total_size;
-     QemuOpts *opts = NULL;
-     BlockDriverState *bs_snapshot = NULL;
--    AioContext *ctx = bdrv_get_aio_context(bs);
-     int ret;
- 
-     GLOBAL_STATE_CODE();
-@@ -3890,9 +3863,7 @@ static BlockDriverState *bdrv_append_temp_snapshot(BlockDriverState *bs,
-        instead of opening 'filename' directly */
- 
-     /* Get the required size from the image */
--    aio_context_acquire(ctx);
-     total_size = bdrv_getlength(bs);
--    aio_context_release(ctx);
- 
-     if (total_size < 0) {
-         error_setg_errno(errp, -total_size, "Could not get image size");
-@@ -3927,10 +3898,7 @@ static BlockDriverState *bdrv_append_temp_snapshot(BlockDriverState *bs,
-         goto out;
-     }
- 
--    aio_context_acquire(ctx);
-     ret = bdrv_append(bs_snapshot, bs, errp);
--    aio_context_release(ctx);
--
-     if (ret < 0) {
-         bs_snapshot = NULL;
-         goto out;
-@@ -3974,7 +3942,6 @@ bdrv_open_inherit(const char *filename, const char *reference, QDict *options,
-     Error *local_err = NULL;
-     QDict *snapshot_options = NULL;
-     int snapshot_flags = 0;
--    AioContext *ctx = qemu_get_aio_context();
- 
-     assert(!child_class || !flags);
-     assert(!child_class == !parent);
-@@ -4115,12 +4082,10 @@ bdrv_open_inherit(const char *filename, const char *reference, QDict *options,
-             /* Not requesting BLK_PERM_CONSISTENT_READ because we're only
-              * looking at the header to guess the image format. This works even
-              * in cases where a guest would not see a consistent state. */
--            ctx = bdrv_get_aio_context(file_bs);
--            aio_context_acquire(ctx);
-+            AioContext *ctx = bdrv_get_aio_context(file_bs);
-             file = blk_new(ctx, 0, BLK_PERM_ALL);
-             blk_insert_bs(file, file_bs, &local_err);
-             bdrv_unref(file_bs);
--            aio_context_release(ctx);
- 
-             if (local_err) {
-                 goto fail;
-@@ -4167,13 +4132,8 @@ bdrv_open_inherit(const char *filename, const char *reference, QDict *options,
-         goto fail;
-     }
- 
--    /* The AioContext could have changed during bdrv_open_common() */
--    ctx = bdrv_get_aio_context(bs);
--
-     if (file) {
--        aio_context_acquire(ctx);
-         blk_unref(file);
--        aio_context_release(ctx);
-         file = NULL;
-     }
- 
-@@ -4231,16 +4191,13 @@ bdrv_open_inherit(const char *filename, const char *reference, QDict *options,
-          * (snapshot_bs); thus, we have to drop the strong reference to bs
-          * (which we obtained by calling bdrv_new()). bs will not be deleted,
-          * though, because the overlay still has a reference to it. */
--        aio_context_acquire(ctx);
-         bdrv_unref(bs);
--        aio_context_release(ctx);
-         bs = snapshot_bs;
-     }
- 
-     return bs;
- 
- fail:
--    aio_context_acquire(ctx);
-     blk_unref(file);
-     qobject_unref(snapshot_options);
-     qobject_unref(bs->explicit_options);
-@@ -4249,14 +4206,11 @@ fail:
-     bs->options = NULL;
-     bs->explicit_options = NULL;
-     bdrv_unref(bs);
--    aio_context_release(ctx);
-     error_propagate(errp, local_err);
-     return NULL;
- 
- close_and_fail:
--    aio_context_acquire(ctx);
-     bdrv_unref(bs);
--    aio_context_release(ctx);
-     qobject_unref(snapshot_options);
-     qobject_unref(options);
-     error_propagate(errp, local_err);
-@@ -4540,12 +4494,7 @@ void bdrv_reopen_queue_free(BlockReopenQueue *bs_queue)
-     if (bs_queue) {
-         BlockReopenQueueEntry *bs_entry, *next;
-         QTAILQ_FOREACH_SAFE(bs_entry, bs_queue, entry, next) {
--            AioContext *ctx = bdrv_get_aio_context(bs_entry->state.bs);
--
--            aio_context_acquire(ctx);
-             bdrv_drained_end(bs_entry->state.bs);
--            aio_context_release(ctx);
--
-             qobject_unref(bs_entry->state.explicit_options);
-             qobject_unref(bs_entry->state.options);
-             g_free(bs_entry);
-@@ -4577,7 +4526,6 @@ int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp)
- {
-     int ret = -1;
-     BlockReopenQueueEntry *bs_entry, *next;
--    AioContext *ctx;
-     Transaction *tran = tran_new();
-     g_autoptr(GSList) refresh_list = NULL;
- 
-@@ -4586,10 +4534,7 @@ int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp)
-     GLOBAL_STATE_CODE();
- 
-     QTAILQ_FOREACH(bs_entry, bs_queue, entry) {
--        ctx = bdrv_get_aio_context(bs_entry->state.bs);
--        aio_context_acquire(ctx);
-         ret = bdrv_flush(bs_entry->state.bs);
--        aio_context_release(ctx);
-         if (ret < 0) {
-             error_setg_errno(errp, -ret, "Error flushing drive");
-             goto abort;
-@@ -4598,10 +4543,7 @@ int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp)
- 
-     QTAILQ_FOREACH(bs_entry, bs_queue, entry) {
-         assert(bs_entry->state.bs->quiesce_counter > 0);
--        ctx = bdrv_get_aio_context(bs_entry->state.bs);
--        aio_context_acquire(ctx);
-         ret = bdrv_reopen_prepare(&bs_entry->state, bs_queue, tran, errp);
--        aio_context_release(ctx);
-         if (ret < 0) {
-             goto abort;
-         }
-@@ -4644,10 +4586,7 @@ int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp)
-      * to first element.
-      */
-     QTAILQ_FOREACH_REVERSE(bs_entry, bs_queue, entry) {
--        ctx = bdrv_get_aio_context(bs_entry->state.bs);
--        aio_context_acquire(ctx);
-         bdrv_reopen_commit(&bs_entry->state);
--        aio_context_release(ctx);
-     }
- 
-     bdrv_graph_wrlock();
-@@ -4658,10 +4597,7 @@ int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp)
-         BlockDriverState *bs = bs_entry->state.bs;
- 
-         if (bs->drv->bdrv_reopen_commit_post) {
--            ctx = bdrv_get_aio_context(bs);
--            aio_context_acquire(ctx);
-             bs->drv->bdrv_reopen_commit_post(&bs_entry->state);
--            aio_context_release(ctx);
-         }
-     }
- 
-@@ -4675,10 +4611,7 @@ abort:
- 
-     QTAILQ_FOREACH_SAFE(bs_entry, bs_queue, entry, next) {
-         if (bs_entry->prepared) {
--            ctx = bdrv_get_aio_context(bs_entry->state.bs);
--            aio_context_acquire(ctx);
-             bdrv_reopen_abort(&bs_entry->state);
--            aio_context_release(ctx);
-         }
-     }
- 
-@@ -4691,24 +4624,13 @@ cleanup:
- int bdrv_reopen(BlockDriverState *bs, QDict *opts, bool keep_old_opts,
-                 Error **errp)
- {
--    AioContext *ctx = bdrv_get_aio_context(bs);
-     BlockReopenQueue *queue;
--    int ret;
- 
-     GLOBAL_STATE_CODE();
- 
-     queue = bdrv_reopen_queue(NULL, bs, opts, keep_old_opts);
- 
--    if (ctx != qemu_get_aio_context()) {
--        aio_context_release(ctx);
--    }
--    ret = bdrv_reopen_multiple(queue, errp);
--
--    if (ctx != qemu_get_aio_context()) {
--        aio_context_acquire(ctx);
--    }
--
--    return ret;
-+    return bdrv_reopen_multiple(queue, errp);
- }
- 
- int bdrv_reopen_set_read_only(BlockDriverState *bs, bool read_only,
-@@ -4760,7 +4682,6 @@ bdrv_reopen_parse_file_or_backing(BDRVReopenState *reopen_state,
-     const char *child_name = is_backing ? "backing" : "file";
-     QObject *value;
-     const char *str;
--    AioContext *ctx, *old_ctx;
-     bool has_child;
-     int ret;
- 
-@@ -4844,13 +4765,6 @@ bdrv_reopen_parse_file_or_backing(BDRVReopenState *reopen_state,
-         bdrv_drained_begin(old_child_bs);
-     }
- 
--    old_ctx = bdrv_get_aio_context(bs);
--    ctx = bdrv_get_aio_context(new_child_bs);
--    if (old_ctx != ctx) {
--        aio_context_release(old_ctx);
--        aio_context_acquire(ctx);
--    }
--
-     bdrv_graph_rdunlock_main_loop();
-     bdrv_graph_wrlock();
- 
-@@ -4859,11 +4773,6 @@ bdrv_reopen_parse_file_or_backing(BDRVReopenState *reopen_state,
- 
-     bdrv_graph_wrunlock();
- 
--    if (old_ctx != ctx) {
--        aio_context_release(ctx);
--        aio_context_acquire(old_ctx);
--    }
--
-     if (old_child_bs) {
-         bdrv_drained_end(old_child_bs);
-         bdrv_unref(old_child_bs);
-@@ -5537,7 +5446,6 @@ int bdrv_append(BlockDriverState *bs_new, BlockDriverState *bs_top,
-     int ret;
-     BdrvChild *child;
-     Transaction *tran = tran_new();
--    AioContext *old_context, *new_context = NULL;
- 
-     GLOBAL_STATE_CODE();
- 
-@@ -5545,21 +5453,8 @@ int bdrv_append(BlockDriverState *bs_new, BlockDriverState *bs_top,
-     assert(!bs_new->backing);
-     bdrv_graph_rdunlock_main_loop();
- 
--    old_context = bdrv_get_aio_context(bs_top);
-     bdrv_drained_begin(bs_top);
--
--    /*
--     * bdrv_drained_begin() requires that only the AioContext of the drained
--     * node is locked, and at this point it can still differ from the AioContext
--     * of bs_top.
--     */
--    new_context = bdrv_get_aio_context(bs_new);
--    aio_context_release(old_context);
--    aio_context_acquire(new_context);
-     bdrv_drained_begin(bs_new);
--    aio_context_release(new_context);
--    aio_context_acquire(old_context);
--    new_context = NULL;
- 
-     bdrv_graph_wrlock();
- 
-@@ -5571,18 +5466,6 @@ int bdrv_append(BlockDriverState *bs_new, BlockDriverState *bs_top,
-         goto out;
-     }
- 
--    /*
--     * bdrv_attach_child_noperm could change the AioContext of bs_top and
--     * bs_new, but at least they are in the same AioContext now. This is the
--     * AioContext that we need to lock for the rest of the function.
--     */
--    new_context = bdrv_get_aio_context(bs_top);
--
--    if (old_context != new_context) {
--        aio_context_release(old_context);
--        aio_context_acquire(new_context);
--    }
--
-     ret = bdrv_replace_node_noperm(bs_top, bs_new, true, tran, errp);
-     if (ret < 0) {
-         goto out;
-@@ -5598,11 +5481,6 @@ out:
-     bdrv_drained_end(bs_top);
-     bdrv_drained_end(bs_new);
- 
--    if (new_context && old_context != new_context) {
--        aio_context_release(new_context);
--        aio_context_acquire(old_context);
--    }
--
-     return ret;
- }
- 
-@@ -5697,12 +5575,8 @@ BlockDriverState *bdrv_insert_node(BlockDriverState *bs, QDict *options,
- 
-     GLOBAL_STATE_CODE();
- 
--    aio_context_release(ctx);
--    aio_context_acquire(qemu_get_aio_context());
-     new_node_bs = bdrv_new_open_driver_opts(drv, node_name, options, flags,
-                                             errp);
--    aio_context_release(qemu_get_aio_context());
--    aio_context_acquire(ctx);
-     assert(bdrv_get_aio_context(bs) == ctx);
- 
-     options = NULL; /* bdrv_new_open_driver() eats options */
-@@ -7037,12 +6911,9 @@ void bdrv_activate_all(Error **errp)
-     GRAPH_RDLOCK_GUARD_MAINLOOP();
- 
-     for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {
--        AioContext *aio_context = bdrv_get_aio_context(bs);
-         int ret;
- 
--        aio_context_acquire(aio_context);
-         ret = bdrv_activate(bs, errp);
--        aio_context_release(aio_context);
-         if (ret < 0) {
-             bdrv_next_cleanup(&it);
-             return;
-@@ -7137,20 +7008,10 @@ int bdrv_inactivate_all(void)
-     BlockDriverState *bs = NULL;
-     BdrvNextIterator it;
-     int ret = 0;
--    GSList *aio_ctxs = NULL, *ctx;
- 
-     GLOBAL_STATE_CODE();
-     GRAPH_RDLOCK_GUARD_MAINLOOP();
- 
--    for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {
--        AioContext *aio_context = bdrv_get_aio_context(bs);
--
--        if (!g_slist_find(aio_ctxs, aio_context)) {
--            aio_ctxs = g_slist_prepend(aio_ctxs, aio_context);
--            aio_context_acquire(aio_context);
--        }
--    }
--
-     for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {
-         /* Nodes with BDS parents are covered by recursion from the last
-          * parent that gets inactivated. Don't inactivate them a second
-@@ -7161,17 +7022,10 @@ int bdrv_inactivate_all(void)
-         ret = bdrv_inactivate_recurse(bs);
-         if (ret < 0) {
-             bdrv_next_cleanup(&it);
--            goto out;
-+            break;
-         }
-     }
- 
--out:
--    for (ctx = aio_ctxs; ctx != NULL; ctx = ctx->next) {
--        AioContext *aio_context = ctx->data;
--        aio_context_release(aio_context);
--    }
--    g_slist_free(aio_ctxs);
--
-     return ret;
- }
- 
-@@ -7257,11 +7111,8 @@ void bdrv_unref(BlockDriverState *bs)
- static void bdrv_schedule_unref_bh(void *opaque)
- {
-     BlockDriverState *bs = opaque;
--    AioContext *ctx = bdrv_get_aio_context(bs);
- 
--    aio_context_acquire(ctx);
-     bdrv_unref(bs);
--    aio_context_release(ctx);
- }
- 
- /*
-@@ -7398,8 +7249,6 @@ void bdrv_img_create(const char *filename, const char *fmt,
-         return;
-     }
- 
--    aio_context_acquire(qemu_get_aio_context());
--
-     /* Create parameter list */
-     create_opts = qemu_opts_append(create_opts, drv->create_opts);
-     create_opts = qemu_opts_append(create_opts, proto_drv->create_opts);
-@@ -7549,7 +7398,6 @@ out:
-     qemu_opts_del(opts);
-     qemu_opts_free(create_opts);
-     error_propagate(errp, local_err);
--    aio_context_release(qemu_get_aio_context());
- }
- 
- AioContext *bdrv_get_aio_context(BlockDriverState *bs)
-@@ -7585,29 +7433,12 @@ void coroutine_fn bdrv_co_leave(BlockDriverState *bs, AioContext *old_ctx)
- 
- void coroutine_fn bdrv_co_lock(BlockDriverState *bs)
- {
--    AioContext *ctx = bdrv_get_aio_context(bs);
--
--    /* In the main thread, bs->aio_context won't change concurrently */
--    assert(qemu_get_current_aio_context() == qemu_get_aio_context());
--
--    /*
--     * We're in coroutine context, so we already hold the lock of the main
--     * loop AioContext. Don't lock it twice to avoid deadlocks.
--     */
--    assert(qemu_in_coroutine());
--    if (ctx != qemu_get_aio_context()) {
--        aio_context_acquire(ctx);
--    }
-+    /* TODO removed in next patch */
- }
- 
- void coroutine_fn bdrv_co_unlock(BlockDriverState *bs)
- {
--    AioContext *ctx = bdrv_get_aio_context(bs);
--
--    assert(qemu_in_coroutine());
--    if (ctx != qemu_get_aio_context()) {
--        aio_context_release(ctx);
--    }
-+    /* TODO removed in next patch */
- }
- 
- static void bdrv_do_remove_aio_context_notifier(BdrvAioNotifier *ban)
-@@ -7728,21 +7559,8 @@ static void bdrv_set_aio_context_commit(void *opaque)
-     BdrvStateSetAioContext *state = (BdrvStateSetAioContext *) opaque;
-     BlockDriverState *bs = (BlockDriverState *) state->bs;
-     AioContext *new_context = state->new_ctx;
--    AioContext *old_context = bdrv_get_aio_context(bs);
- 
--    /*
--     * Take the old AioContex when detaching it from bs.
--     * At this point, new_context lock is already acquired, and we are now
--     * also taking old_context. This is safe as long as bdrv_detach_aio_context
--     * does not call AIO_POLL_WHILE().
--     */
--    if (old_context != qemu_get_aio_context()) {
--        aio_context_acquire(old_context);
--    }
-     bdrv_detach_aio_context(bs);
--    if (old_context != qemu_get_aio_context()) {
--        aio_context_release(old_context);
--    }
-     bdrv_attach_aio_context(bs, new_context);
- }
- 
-@@ -7827,7 +7645,6 @@ int bdrv_try_change_aio_context(BlockDriverState *bs, AioContext *ctx,
-     Transaction *tran;
-     GHashTable *visited;
-     int ret;
--    AioContext *old_context = bdrv_get_aio_context(bs);
-     GLOBAL_STATE_CODE();
- 
-     /*
-@@ -7857,34 +7674,7 @@ int bdrv_try_change_aio_context(BlockDriverState *bs, AioContext *ctx,
-         return -EPERM;
-     }
- 
--    /*
--     * Release old AioContext, it won't be needed anymore, as all
--     * bdrv_drained_begin() have been called already.
--     */
--    if (qemu_get_aio_context() != old_context) {
--        aio_context_release(old_context);
--    }
--
--    /*
--     * Acquire new AioContext since bdrv_drained_end() is going to be called
--     * after we switched all nodes in the new AioContext, and the function
--     * assumes that the lock of the bs is always taken.
--     */
--    if (qemu_get_aio_context() != ctx) {
--        aio_context_acquire(ctx);
--    }
--
-     tran_commit(tran);
--
--    if (qemu_get_aio_context() != ctx) {
--        aio_context_release(ctx);
--    }
--
--    /* Re-acquire the old AioContext, since the caller takes and releases it. */
--    if (qemu_get_aio_context() != old_context) {
--        aio_context_acquire(old_context);
--    }
--
-     return 0;
- }
- 
-@@ -8006,7 +7796,6 @@ BlockDriverState *check_to_replace_node(BlockDriverState *parent_bs,
-                                         const char *node_name, Error **errp)
- {
-     BlockDriverState *to_replace_bs = bdrv_find_node(node_name);
--    AioContext *aio_context;
- 
-     GLOBAL_STATE_CODE();
- 
-@@ -8015,12 +7804,8 @@ BlockDriverState *check_to_replace_node(BlockDriverState *parent_bs,
-         return NULL;
-     }
- 
--    aio_context = bdrv_get_aio_context(to_replace_bs);
--    aio_context_acquire(aio_context);
--
-     if (bdrv_op_is_blocked(to_replace_bs, BLOCK_OP_TYPE_REPLACE, errp)) {
--        to_replace_bs = NULL;
--        goto out;
-+        return NULL;
-     }
- 
-     /* We don't want arbitrary node of the BDS chain to be replaced only the top
-@@ -8033,12 +7818,9 @@ BlockDriverState *check_to_replace_node(BlockDriverState *parent_bs,
-                    "because it cannot be guaranteed that doing so would not "
-                    "lead to an abrupt change of visible data",
-                    node_name, parent_bs->node_name);
--        to_replace_bs = NULL;
--        goto out;
-+        return NULL;
-     }
- 
--out:
--    aio_context_release(aio_context);
-     return to_replace_bs;
- }
- 
-diff --git a/block/block-backend.c b/block/block-backend.c
-index abac4e0235..f412bed274 100644
---- a/block/block-backend.c
-+++ b/block/block-backend.c
-@@ -429,7 +429,6 @@ BlockBackend *blk_new_open(const char *filename, const char *reference,
- {
-     BlockBackend *blk;
-     BlockDriverState *bs;
--    AioContext *ctx;
-     uint64_t perm = 0;
-     uint64_t shared = BLK_PERM_ALL;
- 
-@@ -459,23 +458,18 @@ BlockBackend *blk_new_open(const char *filename, const char *reference,
-         shared = BLK_PERM_CONSISTENT_READ | BLK_PERM_WRITE_UNCHANGED;
-     }
- 
--    aio_context_acquire(qemu_get_aio_context());
-     bs = bdrv_open(filename, reference, options, flags, errp);
--    aio_context_release(qemu_get_aio_context());
-     if (!bs) {
-         return NULL;
-     }
- 
-     /* bdrv_open() could have moved bs to a different AioContext */
--    ctx = bdrv_get_aio_context(bs);
-     blk = blk_new(bdrv_get_aio_context(bs), perm, shared);
-     blk->perm = perm;
-     blk->shared_perm = shared;
- 
--    aio_context_acquire(ctx);
-     blk_insert_bs(blk, bs, errp);
-     bdrv_unref(bs);
--    aio_context_release(ctx);
- 
-     if (!blk->root) {
-         blk_unref(blk);
-@@ -577,13 +571,9 @@ void blk_remove_all_bs(void)
-     GLOBAL_STATE_CODE();
- 
-     while ((blk = blk_all_next(blk)) != NULL) {
--        AioContext *ctx = blk_get_aio_context(blk);
--
--        aio_context_acquire(ctx);
-         if (blk->root) {
-             blk_remove_bs(blk);
-         }
--        aio_context_release(ctx);
-     }
- }
- 
-@@ -2736,20 +2726,16 @@ int blk_commit_all(void)
-     GRAPH_RDLOCK_GUARD_MAINLOOP();
- 
-     while ((blk = blk_all_next(blk)) != NULL) {
--        AioContext *aio_context = blk_get_aio_context(blk);
-         BlockDriverState *unfiltered_bs = bdrv_skip_filters(blk_bs(blk));
- 
--        aio_context_acquire(aio_context);
-         if (blk_is_inserted(blk) && bdrv_cow_child(unfiltered_bs)) {
-             int ret;
- 
-             ret = bdrv_commit(unfiltered_bs);
-             if (ret < 0) {
--                aio_context_release(aio_context);
-                 return ret;
-             }
-         }
--        aio_context_release(aio_context);
-     }
-     return 0;
- }
-diff --git a/block/copy-before-write.c b/block/copy-before-write.c
-index 13972879b1..0842a1a6df 100644
---- a/block/copy-before-write.c
-+++ b/block/copy-before-write.c
-@@ -412,7 +412,6 @@ static int cbw_open(BlockDriverState *bs, QDict *options, int flags,
-     int64_t cluster_size;
-     g_autoptr(BlockdevOptions) full_opts = NULL;
-     BlockdevOptionsCbw *opts;
--    AioContext *ctx;
-     int ret;
- 
-     full_opts = cbw_parse_options(options, errp);
-@@ -435,15 +434,11 @@ static int cbw_open(BlockDriverState *bs, QDict *options, int flags,
- 
-     GRAPH_RDLOCK_GUARD_MAINLOOP();
- 
--    ctx = bdrv_get_aio_context(bs);
--    aio_context_acquire(ctx);
--
-     if (opts->bitmap) {
-         bitmap = block_dirty_bitmap_lookup(opts->bitmap->node,
-                                            opts->bitmap->name, NULL, errp);
-         if (!bitmap) {
--            ret = -EINVAL;
--            goto out;
-+            return -EINVAL;
-         }
-     }
-     s->on_cbw_error = opts->has_on_cbw_error ? opts->on_cbw_error :
-@@ -461,24 +456,21 @@ static int cbw_open(BlockDriverState *bs, QDict *options, int flags,
-     s->bcs = block_copy_state_new(bs->file, s->target, bitmap, errp);
-     if (!s->bcs) {
-         error_prepend(errp, "Cannot create block-copy-state: ");
--        ret = -EINVAL;
--        goto out;
-+        return -EINVAL;
-     }
- 
-     cluster_size = block_copy_cluster_size(s->bcs);
- 
-     s->done_bitmap = bdrv_create_dirty_bitmap(bs, cluster_size, NULL, errp);
-     if (!s->done_bitmap) {
--        ret = -EINVAL;
--        goto out;
-+        return -EINVAL;
-     }
-     bdrv_disable_dirty_bitmap(s->done_bitmap);
- 
-     /* s->access_bitmap starts equal to bcs bitmap */
-     s->access_bitmap = bdrv_create_dirty_bitmap(bs, cluster_size, NULL, errp);
-     if (!s->access_bitmap) {
--        ret = -EINVAL;
--        goto out;
-+        return -EINVAL;
-     }
-     bdrv_disable_dirty_bitmap(s->access_bitmap);
-     bdrv_dirty_bitmap_merge_internal(s->access_bitmap,
-@@ -487,11 +479,7 @@ static int cbw_open(BlockDriverState *bs, QDict *options, int flags,
- 
-     qemu_co_mutex_init(&s->lock);
-     QLIST_INIT(&s->frozen_read_reqs);
--
--    ret = 0;
--out:
--    aio_context_release(ctx);
--    return ret;
-+    return 0;
- }
- 
- static void cbw_close(BlockDriverState *bs)
-diff --git a/block/export/export.c b/block/export/export.c
-index a8f274e526..6d51ae8ed7 100644
---- a/block/export/export.c
-+++ b/block/export/export.c
-@@ -114,7 +114,6 @@ BlockExport *blk_exp_add(BlockExportOptions *export, Error **errp)
-     }
- 
-     ctx = bdrv_get_aio_context(bs);
--    aio_context_acquire(ctx);
- 
-     if (export->iothread) {
-         IOThread *iothread;
-@@ -133,8 +132,6 @@ BlockExport *blk_exp_add(BlockExportOptions *export, Error **errp)
-         set_context_errp = fixed_iothread ? errp : NULL;
-         ret = bdrv_try_change_aio_context(bs, new_ctx, NULL, set_context_errp);
-         if (ret == 0) {
--            aio_context_release(ctx);
--            aio_context_acquire(new_ctx);
-             ctx = new_ctx;
-         } else if (fixed_iothread) {
-             goto fail;
-@@ -191,8 +188,6 @@ BlockExport *blk_exp_add(BlockExportOptions *export, Error **errp)
-     assert(exp->blk != NULL);
- 
-     QLIST_INSERT_HEAD(&block_exports, exp, next);
--
--    aio_context_release(ctx);
-     return exp;
- 
- fail:
-@@ -200,7 +195,6 @@ fail:
-         blk_set_dev_ops(blk, NULL, NULL);
-         blk_unref(blk);
-     }
--    aio_context_release(ctx);
-     if (exp) {
-         g_free(exp->id);
-         g_free(exp);
-@@ -218,9 +212,6 @@ void blk_exp_ref(BlockExport *exp)
- static void blk_exp_delete_bh(void *opaque)
- {
-     BlockExport *exp = opaque;
--    AioContext *aio_context = exp->ctx;
--
--    aio_context_acquire(aio_context);
- 
-     assert(exp->refcount == 0);
-     QLIST_REMOVE(exp, next);
-@@ -230,8 +221,6 @@ static void blk_exp_delete_bh(void *opaque)
-     qapi_event_send_block_export_deleted(exp->id);
-     g_free(exp->id);
-     g_free(exp);
--
--    aio_context_release(aio_context);
- }
- 
- void blk_exp_unref(BlockExport *exp)
-@@ -249,22 +238,16 @@ void blk_exp_unref(BlockExport *exp)
-  * connections and other internally held references start to shut down. When
-  * the function returns, there may still be active references while the export
-  * is in the process of shutting down.
-- *
-- * Acquires exp->ctx internally. Callers must *not* hold the lock.
-  */
- void blk_exp_request_shutdown(BlockExport *exp)
- {
--    AioContext *aio_context = exp->ctx;
--
--    aio_context_acquire(aio_context);
--
-     /*
-      * If the user doesn't own the export any more, it is already shutting
-      * down. We must not call .request_shutdown and decrease the refcount a
-      * second time.
-      */
-     if (!exp->user_owned) {
--        goto out;
-+        return;
-     }
- 
-     exp->drv->request_shutdown(exp);
-@@ -272,9 +255,6 @@ void blk_exp_request_shutdown(BlockExport *exp)
-     assert(exp->user_owned);
-     exp->user_owned = false;
-     blk_exp_unref(exp);
--
--out:
--    aio_context_release(aio_context);
- }
- 
- /*
-diff --git a/block/io.c b/block/io.c
-index 7e62fabbf5..8fa7670571 100644
---- a/block/io.c
-+++ b/block/io.c
-@@ -294,8 +294,6 @@ static void bdrv_co_drain_bh_cb(void *opaque)
-     BlockDriverState *bs = data->bs;
- 
-     if (bs) {
--        AioContext *ctx = bdrv_get_aio_context(bs);
--        aio_context_acquire(ctx);
-         bdrv_dec_in_flight(bs);
-         if (data->begin) {
-             bdrv_do_drained_begin(bs, data->parent, data->poll);
-@@ -303,7 +301,6 @@ static void bdrv_co_drain_bh_cb(void *opaque)
-             assert(!data->poll);
-             bdrv_do_drained_end(bs, data->parent);
-         }
--        aio_context_release(ctx);
-     } else {
-         assert(data->begin);
-         bdrv_drain_all_begin();
-@@ -320,8 +317,6 @@ static void coroutine_fn bdrv_co_yield_to_drain(BlockDriverState *bs,
- {
-     BdrvCoDrainData data;
-     Coroutine *self = qemu_coroutine_self();
--    AioContext *ctx = bdrv_get_aio_context(bs);
--    AioContext *co_ctx = qemu_coroutine_get_aio_context(self);
- 
-     /* Calling bdrv_drain() from a BH ensures the current coroutine yields and
-      * other coroutines run if they were queued by aio_co_enter(). */
-@@ -340,17 +335,6 @@ static void coroutine_fn bdrv_co_yield_to_drain(BlockDriverState *bs,
-         bdrv_inc_in_flight(bs);
-     }
- 
--    /*
--     * Temporarily drop the lock across yield or we would get deadlocks.
--     * bdrv_co_drain_bh_cb() reaquires the lock as needed.
--     *
--     * When we yield below, the lock for the current context will be
--     * released, so if this is actually the lock that protects bs, don't drop
--     * it a second time.
--     */
--    if (ctx != co_ctx) {
--        aio_context_release(ctx);
--    }
-     replay_bh_schedule_oneshot_event(qemu_get_aio_context(),
-                                      bdrv_co_drain_bh_cb, &data);
- 
-@@ -358,11 +342,6 @@ static void coroutine_fn bdrv_co_yield_to_drain(BlockDriverState *bs,
-     /* If we are resumed from some other event (such as an aio completion or a
-      * timer callback), it is a bug in the caller that should be fixed. */
-     assert(data.done);
--
--    /* Reacquire the AioContext of bs if we dropped it */
--    if (ctx != co_ctx) {
--        aio_context_acquire(ctx);
--    }
- }
- 
- static void bdrv_do_drained_begin(BlockDriverState *bs, BdrvChild *parent,
-@@ -478,13 +457,12 @@ static bool bdrv_drain_all_poll(void)
-     GLOBAL_STATE_CODE();
-     GRAPH_RDLOCK_GUARD_MAINLOOP();
- 
--    /* bdrv_drain_poll() can't make changes to the graph and we are holding the
--     * main AioContext lock, so iterating bdrv_next_all_states() is safe. */
-+    /*
-+     * bdrv_drain_poll() can't make changes to the graph and we hold the BQL,
-+     * so iterating bdrv_next_all_states() is safe.
-+     */
-     while ((bs = bdrv_next_all_states(bs))) {
--        AioContext *aio_context = bdrv_get_aio_context(bs);
--        aio_context_acquire(aio_context);
-         result |= bdrv_drain_poll(bs, NULL, true);
--        aio_context_release(aio_context);
-     }
- 
-     return result;
-@@ -525,11 +503,7 @@ void bdrv_drain_all_begin_nopoll(void)
-     /* Quiesce all nodes, without polling in-flight requests yet. The graph
-      * cannot change during this loop. */
-     while ((bs = bdrv_next_all_states(bs))) {
--        AioContext *aio_context = bdrv_get_aio_context(bs);
--
--        aio_context_acquire(aio_context);
-         bdrv_do_drained_begin(bs, NULL, false);
--        aio_context_release(aio_context);
-     }
- }
- 
-@@ -588,11 +562,7 @@ void bdrv_drain_all_end(void)
-     }
- 
-     while ((bs = bdrv_next_all_states(bs))) {
--        AioContext *aio_context = bdrv_get_aio_context(bs);
--
--        aio_context_acquire(aio_context);
-         bdrv_do_drained_end(bs, NULL);
--        aio_context_release(aio_context);
-     }
- 
-     assert(qemu_get_current_aio_context() == qemu_get_aio_context());
-@@ -2368,15 +2338,10 @@ int bdrv_flush_all(void)
-     }
- 
-     for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {
--        AioContext *aio_context = bdrv_get_aio_context(bs);
--        int ret;
--
--        aio_context_acquire(aio_context);
--        ret = bdrv_flush(bs);
-+        int ret = bdrv_flush(bs);
-         if (ret < 0 && !result) {
-             result = ret;
-         }
--        aio_context_release(aio_context);
-     }
- 
-     return result;
-diff --git a/block/mirror.c b/block/mirror.c
-index 51f9e2f17c..5145eb53e1 100644
---- a/block/mirror.c
-+++ b/block/mirror.c
-@@ -662,7 +662,6 @@ static int mirror_exit_common(Job *job)
-     MirrorBlockJob *s = container_of(job, MirrorBlockJob, common.job);
-     BlockJob *bjob = &s->common;
-     MirrorBDSOpaque *bs_opaque;
--    AioContext *replace_aio_context = NULL;
-     BlockDriverState *src;
-     BlockDriverState *target_bs;
-     BlockDriverState *mirror_top_bs;
-@@ -677,7 +676,6 @@ static int mirror_exit_common(Job *job)
-     }
-     s->prepared = true;
- 
--    aio_context_acquire(qemu_get_aio_context());
-     bdrv_graph_rdlock_main_loop();
- 
-     mirror_top_bs = s->mirror_top_bs;
-@@ -742,11 +740,6 @@ static int mirror_exit_common(Job *job)
-     }
-     bdrv_graph_rdunlock_main_loop();
- 
--    if (s->to_replace) {
--        replace_aio_context = bdrv_get_aio_context(s->to_replace);
--        aio_context_acquire(replace_aio_context);
--    }
--
-     if (s->should_complete && !abort) {
-         BlockDriverState *to_replace = s->to_replace ?: src;
-         bool ro = bdrv_is_read_only(to_replace);
-@@ -785,9 +778,6 @@ static int mirror_exit_common(Job *job)
-         error_free(s->replace_blocker);
-         bdrv_unref(s->to_replace);
-     }
--    if (replace_aio_context) {
--        aio_context_release(replace_aio_context);
--    }
-     g_free(s->replaces);
- 
-     /*
-@@ -811,8 +801,6 @@ static int mirror_exit_common(Job *job)
-     bdrv_unref(mirror_top_bs);
-     bdrv_unref(src);
- 
--    aio_context_release(qemu_get_aio_context());
--
-     return ret;
- }
- 
-@@ -1191,24 +1179,17 @@ static void mirror_complete(Job *job, Error **errp)
- 
-     /* block all operations on to_replace bs */
-     if (s->replaces) {
--        AioContext *replace_aio_context;
--
-         s->to_replace = bdrv_find_node(s->replaces);
-         if (!s->to_replace) {
-             error_setg(errp, "Node name '%s' not found", s->replaces);
-             return;
-         }
- 
--        replace_aio_context = bdrv_get_aio_context(s->to_replace);
--        aio_context_acquire(replace_aio_context);
--
-         /* TODO Translate this into child freeze system. */
-         error_setg(&s->replace_blocker,
-                    "block device is in use by block-job-complete");
-         bdrv_op_block_all(s->to_replace, s->replace_blocker);
-         bdrv_ref(s->to_replace);
--
--        aio_context_release(replace_aio_context);
-     }
- 
-     s->should_complete = true;
-diff --git a/block/monitor/bitmap-qmp-cmds.c b/block/monitor/bitmap-qmp-cmds.c
-index 70d01a3776..a738e7bbf7 100644
---- a/block/monitor/bitmap-qmp-cmds.c
-+++ b/block/monitor/bitmap-qmp-cmds.c
-@@ -95,7 +95,6 @@ void qmp_block_dirty_bitmap_add(const char *node, const char *name,
- {
-     BlockDriverState *bs;
-     BdrvDirtyBitmap *bitmap;
--    AioContext *aio_context;
- 
-     if (!name || name[0] == '\0') {
-         error_setg(errp, "Bitmap name cannot be empty");
-@@ -107,14 +106,11 @@ void qmp_block_dirty_bitmap_add(const char *node, const char *name,
-         return;
-     }
- 
--    aio_context = bdrv_get_aio_context(bs);
--    aio_context_acquire(aio_context);
--
-     if (has_granularity) {
-         if (granularity < 512 || !is_power_of_2(granularity)) {
-             error_setg(errp, "Granularity must be power of 2 "
-                              "and at least 512");
--            goto out;
-+            return;
-         }
-     } else {
-         /* Default to cluster size, if available: */
-@@ -132,12 +128,12 @@ void qmp_block_dirty_bitmap_add(const char *node, const char *name,
-     if (persistent &&
-         !bdrv_can_store_new_dirty_bitmap(bs, name, granularity, errp))
-     {
--        goto out;
-+        return;
-     }
- 
-     bitmap = bdrv_create_dirty_bitmap(bs, granularity, name, errp);
-     if (bitmap == NULL) {
--        goto out;
-+        return;
-     }
- 
-     if (disabled) {
-@@ -145,9 +141,6 @@ void qmp_block_dirty_bitmap_add(const char *node, const char *name,
-     }
- 
-     bdrv_dirty_bitmap_set_persistence(bitmap, persistent);
--
--out:
--    aio_context_release(aio_context);
- }
- 
- BdrvDirtyBitmap *block_dirty_bitmap_remove(const char *node, const char *name,
-@@ -157,7 +150,6 @@ BdrvDirtyBitmap *block_dirty_bitmap_remove(const char *node, const char *name,
- {
-     BlockDriverState *bs;
-     BdrvDirtyBitmap *bitmap;
--    AioContext *aio_context;
- 
-     GLOBAL_STATE_CODE();
- 
-@@ -166,19 +158,14 @@ BdrvDirtyBitmap *block_dirty_bitmap_remove(const char *node, const char *name,
-         return NULL;
-     }
- 
--    aio_context = bdrv_get_aio_context(bs);
--    aio_context_acquire(aio_context);
--
-     if (bdrv_dirty_bitmap_check(bitmap, BDRV_BITMAP_BUSY | BDRV_BITMAP_RO,
-                                 errp)) {
--        aio_context_release(aio_context);
-         return NULL;
-     }
- 
-     if (bdrv_dirty_bitmap_get_persistence(bitmap) &&
-         bdrv_remove_persistent_dirty_bitmap(bs, name, errp) < 0)
-     {
--        aio_context_release(aio_context);
-         return NULL;
-     }
- 
-@@ -190,7 +177,6 @@ BdrvDirtyBitmap *block_dirty_bitmap_remove(const char *node, const char *name,
-         *bitmap_bs = bs;
-     }
- 
--    aio_context_release(aio_context);
-     return release ? NULL : bitmap;
- }
- 
-diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
-index c729cbf1eb..bdbb5cb141 100644
---- a/block/monitor/block-hmp-cmds.c
-+++ b/block/monitor/block-hmp-cmds.c
-@@ -141,7 +141,6 @@ void hmp_drive_del(Monitor *mon, const QDict *qdict)
-     const char *id = qdict_get_str(qdict, "id");
-     BlockBackend *blk;
-     BlockDriverState *bs;
--    AioContext *aio_context;
-     Error *local_err = NULL;
- 
-     GLOBAL_STATE_CODE();
-@@ -168,14 +167,10 @@ void hmp_drive_del(Monitor *mon, const QDict *qdict)
-         return;
-     }
- 
--    aio_context = blk_get_aio_context(blk);
--    aio_context_acquire(aio_context);
--
-     bs = blk_bs(blk);
-     if (bs) {
-         if (bdrv_op_is_blocked(bs, BLOCK_OP_TYPE_DRIVE_DEL, &local_err)) {
-             error_report_err(local_err);
--            aio_context_release(aio_context);
-             return;
-         }
- 
-@@ -196,8 +191,6 @@ void hmp_drive_del(Monitor *mon, const QDict *qdict)
-     } else {
-         blk_unref(blk);
-     }
--
--    aio_context_release(aio_context);
- }
- 
- void hmp_commit(Monitor *mon, const QDict *qdict)
-@@ -213,7 +206,6 @@ void hmp_commit(Monitor *mon, const QDict *qdict)
-         ret = blk_commit_all();
-     } else {
-         BlockDriverState *bs;
--        AioContext *aio_context;
- 
-         blk = blk_by_name(device);
-         if (!blk) {
-@@ -222,18 +214,13 @@ void hmp_commit(Monitor *mon, const QDict *qdict)
-         }
- 
-         bs = bdrv_skip_implicit_filters(blk_bs(blk));
--        aio_context = bdrv_get_aio_context(bs);
--        aio_context_acquire(aio_context);
- 
-         if (!blk_is_available(blk)) {
-             error_report("Device '%s' has no medium", device);
--            aio_context_release(aio_context);
-             return;
-         }
- 
-         ret = bdrv_commit(bs);
--
--        aio_context_release(aio_context);
-     }
-     if (ret < 0) {
-         error_report("'commit' error for '%s': %s", device, strerror(-ret));
-@@ -560,7 +547,6 @@ void hmp_qemu_io(Monitor *mon, const QDict *qdict)
-     BlockBackend *blk = NULL;
-     BlockDriverState *bs = NULL;
-     BlockBackend *local_blk = NULL;
--    AioContext *ctx = NULL;
-     bool qdev = qdict_get_try_bool(qdict, "qdev", false);
-     const char *device = qdict_get_str(qdict, "device");
-     const char *command = qdict_get_str(qdict, "command");
-@@ -582,9 +568,6 @@ void hmp_qemu_io(Monitor *mon, const QDict *qdict)
-         }
-     }
- 
--    ctx = blk ? blk_get_aio_context(blk) : bdrv_get_aio_context(bs);
--    aio_context_acquire(ctx);
--
-     if (bs) {
-         blk = local_blk = blk_new(bdrv_get_aio_context(bs), 0, BLK_PERM_ALL);
-         ret = blk_insert_bs(blk, bs, &err);
-@@ -622,11 +605,6 @@ void hmp_qemu_io(Monitor *mon, const QDict *qdict)
- 
- fail:
-     blk_unref(local_blk);
--
--    if (ctx) {
--        aio_context_release(ctx);
--    }
--
-     hmp_handle_error(mon, err);
- }
- 
-@@ -882,7 +860,6 @@ void hmp_info_snapshots(Monitor *mon, const QDict *qdict)
-     int nb_sns, i;
-     int total;
-     int *global_snapshots;
--    AioContext *aio_context;
- 
-     typedef struct SnapshotEntry {
-         QEMUSnapshotInfo sn;
-@@ -909,11 +886,8 @@ void hmp_info_snapshots(Monitor *mon, const QDict *qdict)
-         error_report_err(err);
-         return;
-     }
--    aio_context = bdrv_get_aio_context(bs);
- 
--    aio_context_acquire(aio_context);
-     nb_sns = bdrv_snapshot_list(bs, &sn_tab);
--    aio_context_release(aio_context);
- 
-     if (nb_sns < 0) {
-         monitor_printf(mon, "bdrv_snapshot_list: error %d\n", nb_sns);
-@@ -924,9 +898,7 @@ void hmp_info_snapshots(Monitor *mon, const QDict *qdict)
-         int bs1_nb_sns = 0;
-         ImageEntry *ie;
-         SnapshotEntry *se;
--        AioContext *ctx = bdrv_get_aio_context(bs1);
- 
--        aio_context_acquire(ctx);
-         if (bdrv_can_snapshot(bs1)) {
-             sn = NULL;
-             bs1_nb_sns = bdrv_snapshot_list(bs1, &sn);
-@@ -944,7 +916,6 @@ void hmp_info_snapshots(Monitor *mon, const QDict *qdict)
-             }
-             g_free(sn);
-         }
--        aio_context_release(ctx);
-     }
- 
-     if (no_snapshot) {
-diff --git a/block/qapi-sysemu.c b/block/qapi-sysemu.c
-index 1618cd225a..e4282631d2 100644
---- a/block/qapi-sysemu.c
-+++ b/block/qapi-sysemu.c
-@@ -174,7 +174,6 @@ blockdev_remove_medium(const char *device, const char *id, Error **errp)
- {
-     BlockBackend *blk;
-     BlockDriverState *bs;
--    AioContext *aio_context;
-     bool has_attached_device;
- 
-     GLOBAL_STATE_CODE();
-@@ -204,13 +203,10 @@ blockdev_remove_medium(const char *device, const char *id, Error **errp)
-         return;
-     }
- 
--    aio_context = bdrv_get_aio_context(bs);
--    aio_context_acquire(aio_context);
--
-     bdrv_graph_rdlock_main_loop();
-     if (bdrv_op_is_blocked(bs, BLOCK_OP_TYPE_EJECT, errp)) {
-         bdrv_graph_rdunlock_main_loop();
--        goto out;
-+        return;
-     }
-     bdrv_graph_rdunlock_main_loop();
- 
-@@ -223,9 +219,6 @@ blockdev_remove_medium(const char *device, const char *id, Error **errp)
-          * value passed here (i.e. false). */
-         blk_dev_change_media_cb(blk, false, &error_abort);
-     }
--
--out:
--    aio_context_release(aio_context);
- }
- 
- void qmp_blockdev_remove_medium(const char *id, Error **errp)
-@@ -237,7 +230,6 @@ static void qmp_blockdev_insert_anon_medium(BlockBackend *blk,
-                                             BlockDriverState *bs, Error **errp)
- {
-     Error *local_err = NULL;
--    AioContext *ctx;
-     bool has_device;
-     int ret;
- 
-@@ -259,11 +251,7 @@ static void qmp_blockdev_insert_anon_medium(BlockBackend *blk,
-         return;
-     }
- 
--    ctx = bdrv_get_aio_context(bs);
--    aio_context_acquire(ctx);
-     ret = blk_insert_bs(blk, bs, errp);
--    aio_context_release(ctx);
--
-     if (ret < 0) {
-         return;
-     }
-@@ -374,9 +362,7 @@ void qmp_blockdev_change_medium(const char *device,
-         qdict_put_str(options, "driver", format);
-     }
- 
--    aio_context_acquire(qemu_get_aio_context());
-     medium_bs = bdrv_open(filename, NULL, options, bdrv_flags, errp);
--    aio_context_release(qemu_get_aio_context());
- 
-     if (!medium_bs) {
-         goto fail;
-@@ -437,20 +423,16 @@ void qmp_block_set_io_throttle(BlockIOThrottle *arg, Error **errp)
-     ThrottleConfig cfg;
-     BlockDriverState *bs;
-     BlockBackend *blk;
--    AioContext *aio_context;
- 
-     blk = qmp_get_blk(arg->device, arg->id, errp);
-     if (!blk) {
-         return;
-     }
- 
--    aio_context = blk_get_aio_context(blk);
--    aio_context_acquire(aio_context);
--
-     bs = blk_bs(blk);
-     if (!bs) {
-         error_setg(errp, "Device has no medium");
--        goto out;
-+        return;
-     }
- 
-     throttle_config_init(&cfg);
-@@ -505,7 +487,7 @@ void qmp_block_set_io_throttle(BlockIOThrottle *arg, Error **errp)
-     }
- 
-     if (!throttle_is_valid(&cfg, errp)) {
--        goto out;
-+        return;
-     }
- 
-     if (throttle_enabled(&cfg)) {
-@@ -522,9 +504,6 @@ void qmp_block_set_io_throttle(BlockIOThrottle *arg, Error **errp)
-         /* If all throttling settings are set to 0, disable I/O limits */
-         blk_io_limits_disable(blk);
-     }
--
--out:
--    aio_context_release(aio_context);
- }
- 
- void qmp_block_latency_histogram_set(
-diff --git a/block/qapi.c b/block/qapi.c
-index 82a30b38fe..9e806fa230 100644
---- a/block/qapi.c
-+++ b/block/qapi.c
-@@ -234,13 +234,11 @@ bdrv_do_query_node_info(BlockDriverState *bs, BlockNodeInfo *info, Error **errp)
-     int ret;
-     Error *err = NULL;
- 
--    aio_context_acquire(bdrv_get_aio_context(bs));
--
-     size = bdrv_getlength(bs);
-     if (size < 0) {
-         error_setg_errno(errp, -size, "Can't get image size '%s'",
-                          bs->exact_filename);
--        goto out;
-+        return;
-     }
- 
-     bdrv_refresh_filename(bs);
-@@ -265,7 +263,7 @@ bdrv_do_query_node_info(BlockDriverState *bs, BlockNodeInfo *info, Error **errp)
-     info->format_specific = bdrv_get_specific_info(bs, &err);
-     if (err) {
-         error_propagate(errp, err);
--        goto out;
-+        return;
-     }
-     backing_filename = bs->backing_file;
-     if (backing_filename[0] != '\0') {
-@@ -300,11 +298,8 @@ bdrv_do_query_node_info(BlockDriverState *bs, BlockNodeInfo *info, Error **errp)
-         break;
-     default:
-         error_propagate(errp, err);
--        goto out;
-+        return;
-     }
--
--out:
--    aio_context_release(bdrv_get_aio_context(bs));
- }
- 
- /**
-@@ -709,15 +704,10 @@ BlockStatsList *qmp_query_blockstats(bool has_query_nodes,
-     /* Just to be safe if query_nodes is not always initialized */
-     if (has_query_nodes && query_nodes) {
-         for (bs = bdrv_next_node(NULL); bs; bs = bdrv_next_node(bs)) {
--            AioContext *ctx = bdrv_get_aio_context(bs);
--
--            aio_context_acquire(ctx);
-             QAPI_LIST_APPEND(tail, bdrv_query_bds_stats(bs, false));
--            aio_context_release(ctx);
-         }
-     } else {
-         for (blk = blk_all_next(NULL); blk; blk = blk_all_next(blk)) {
--            AioContext *ctx = blk_get_aio_context(blk);
-             BlockStats *s;
-             char *qdev;
- 
-@@ -725,7 +715,6 @@ BlockStatsList *qmp_query_blockstats(bool has_query_nodes,
-                 continue;
-             }
- 
--            aio_context_acquire(ctx);
-             s = bdrv_query_bds_stats(blk_bs(blk), true);
-             s->device = g_strdup(blk_name(blk));
- 
-@@ -737,7 +726,6 @@ BlockStatsList *qmp_query_blockstats(bool has_query_nodes,
-             }
- 
-             bdrv_query_blk_stats(s->stats, blk);
--            aio_context_release(ctx);
- 
-             QAPI_LIST_APPEND(tail, s);
-         }
-diff --git a/block/raw-format.c b/block/raw-format.c
-index 1111dffd54..ac7e8495f6 100644
---- a/block/raw-format.c
-+++ b/block/raw-format.c
-@@ -470,7 +470,6 @@ static int raw_open(BlockDriverState *bs, QDict *options, int flags,
-                     Error **errp)
- {
-     BDRVRawState *s = bs->opaque;
--    AioContext *ctx;
-     bool has_size;
-     uint64_t offset, size;
-     BdrvChildRole file_role;
-@@ -522,11 +521,7 @@ static int raw_open(BlockDriverState *bs, QDict *options, int flags,
-                 bs->file->bs->filename);
-     }
- 
--    ctx = bdrv_get_aio_context(bs);
--    aio_context_acquire(ctx);
-     ret = raw_apply_options(bs, s, offset, has_size, size, errp);
--    aio_context_release(ctx);
--
-     if (ret < 0) {
-         return ret;
-     }
-diff --git a/block/replication.c b/block/replication.c
-index 424b537ff7..ca6bd0a720 100644
---- a/block/replication.c
-+++ b/block/replication.c
-@@ -394,14 +394,7 @@ static void reopen_backing_file(BlockDriverState *bs, bool writable,
-     }
- 
-     if (reopen_queue) {
--        AioContext *ctx = bdrv_get_aio_context(bs);
--        if (ctx != qemu_get_aio_context()) {
--            aio_context_release(ctx);
--        }
-         bdrv_reopen_multiple(reopen_queue, errp);
--        if (ctx != qemu_get_aio_context()) {
--            aio_context_acquire(ctx);
--        }
-     }
- }
- 
-@@ -462,14 +455,11 @@ static void replication_start(ReplicationState *rs, ReplicationMode mode,
-     BlockDriverState *top_bs;
-     BdrvChild *active_disk, *hidden_disk, *secondary_disk;
-     int64_t active_length, hidden_length, disk_length;
--    AioContext *aio_context;
-     Error *local_err = NULL;
-     BackupPerf perf = { .use_copy_range = true, .max_workers = 1 };
- 
-     GLOBAL_STATE_CODE();
- 
--    aio_context = bdrv_get_aio_context(bs);
--    aio_context_acquire(aio_context);
-     s = bs->opaque;
- 
-     if (s->stage == BLOCK_REPLICATION_DONE ||
-@@ -479,20 +469,17 @@ static void replication_start(ReplicationState *rs, ReplicationMode mode,
-          * Ignore the request because the secondary side of replication
-          * doesn't have to do anything anymore.
-          */
--        aio_context_release(aio_context);
-         return;
-     }
- 
-     if (s->stage != BLOCK_REPLICATION_NONE) {
-         error_setg(errp, "Block replication is running or done");
--        aio_context_release(aio_context);
-         return;
-     }
- 
-     if (s->mode != mode) {
-         error_setg(errp, "The parameter mode's value is invalid, needs %d,"
-                    " but got %d", s->mode, mode);
--        aio_context_release(aio_context);
-         return;
-     }
- 
-@@ -505,7 +492,6 @@ static void replication_start(ReplicationState *rs, ReplicationMode mode,
-         if (!active_disk || !active_disk->bs || !active_disk->bs->backing) {
-             error_setg(errp, "Active disk doesn't have backing file");
-             bdrv_graph_rdunlock_main_loop();
--            aio_context_release(aio_context);
-             return;
-         }
- 
-@@ -513,7 +499,6 @@ static void replication_start(ReplicationState *rs, ReplicationMode mode,
-         if (!hidden_disk->bs || !hidden_disk->bs->backing) {
-             error_setg(errp, "Hidden disk doesn't have backing file");
-             bdrv_graph_rdunlock_main_loop();
--            aio_context_release(aio_context);
-             return;
-         }
- 
-@@ -521,7 +506,6 @@ static void replication_start(ReplicationState *rs, ReplicationMode mode,
-         if (!secondary_disk->bs || !bdrv_has_blk(secondary_disk->bs)) {
-             error_setg(errp, "The secondary disk doesn't have block backend");
-             bdrv_graph_rdunlock_main_loop();
--            aio_context_release(aio_context);
-             return;
-         }
-         bdrv_graph_rdunlock_main_loop();
-@@ -534,7 +518,6 @@ static void replication_start(ReplicationState *rs, ReplicationMode mode,
-             active_length != hidden_length || hidden_length != disk_length) {
-             error_setg(errp, "Active disk, hidden disk, secondary disk's length"
-                        " are not the same");
--            aio_context_release(aio_context);
-             return;
-         }
- 
-@@ -546,7 +529,6 @@ static void replication_start(ReplicationState *rs, ReplicationMode mode,
-             !hidden_disk->bs->drv->bdrv_make_empty) {
-             error_setg(errp,
-                        "Active disk or hidden disk doesn't support make_empty");
--            aio_context_release(aio_context);
-             bdrv_graph_rdunlock_main_loop();
-             return;
-         }
-@@ -556,7 +538,6 @@ static void replication_start(ReplicationState *rs, ReplicationMode mode,
-         reopen_backing_file(bs, true, &local_err);
-         if (local_err) {
-             error_propagate(errp, local_err);
--            aio_context_release(aio_context);
-             return;
-         }
- 
-@@ -569,7 +550,6 @@ static void replication_start(ReplicationState *rs, ReplicationMode mode,
-         if (local_err) {
-             error_propagate(errp, local_err);
-             bdrv_graph_wrunlock();
--            aio_context_release(aio_context);
-             return;
-         }
- 
-@@ -580,7 +560,6 @@ static void replication_start(ReplicationState *rs, ReplicationMode mode,
-         if (local_err) {
-             error_propagate(errp, local_err);
-             bdrv_graph_wrunlock();
--            aio_context_release(aio_context);
-             return;
-         }
- 
-@@ -594,7 +573,6 @@ static void replication_start(ReplicationState *rs, ReplicationMode mode,
-             error_setg(errp, "No top_bs or it is invalid");
-             bdrv_graph_wrunlock();
-             reopen_backing_file(bs, false, NULL);
--            aio_context_release(aio_context);
-             return;
-         }
-         bdrv_op_block_all(top_bs, s->blocker);
-@@ -612,13 +590,11 @@ static void replication_start(ReplicationState *rs, ReplicationMode mode,
-         if (local_err) {
-             error_propagate(errp, local_err);
-             backup_job_cleanup(bs);
--            aio_context_release(aio_context);
-             return;
-         }
-         job_start(&s->backup_job->job);
-         break;
-     default:
--        aio_context_release(aio_context);
-         abort();
-     }
- 
-@@ -629,18 +605,12 @@ static void replication_start(ReplicationState *rs, ReplicationMode mode,
-     }
- 
-     s->error = 0;
--    aio_context_release(aio_context);
- }
- 
- static void replication_do_checkpoint(ReplicationState *rs, Error **errp)
- {
-     BlockDriverState *bs = rs->opaque;
--    BDRVReplicationState *s;
--    AioContext *aio_context;
--
--    aio_context = bdrv_get_aio_context(bs);
--    aio_context_acquire(aio_context);
--    s = bs->opaque;
-+    BDRVReplicationState *s = bs->opaque;
- 
-     if (s->stage == BLOCK_REPLICATION_DONE ||
-         s->stage == BLOCK_REPLICATION_FAILOVER) {
-@@ -649,38 +619,28 @@ static void replication_do_checkpoint(ReplicationState *rs, Error **errp)
-          * Ignore the request because the secondary side of replication
-          * doesn't have to do anything anymore.
-          */
--        aio_context_release(aio_context);
-         return;
-     }
- 
-     if (s->mode == REPLICATION_MODE_SECONDARY) {
-         secondary_do_checkpoint(bs, errp);
-     }
--    aio_context_release(aio_context);
- }
- 
- static void replication_get_error(ReplicationState *rs, Error **errp)
- {
-     BlockDriverState *bs = rs->opaque;
--    BDRVReplicationState *s;
--    AioContext *aio_context;
--
--    aio_context = bdrv_get_aio_context(bs);
--    aio_context_acquire(aio_context);
--    s = bs->opaque;
-+    BDRVReplicationState *s = bs->opaque;
- 
-     if (s->stage == BLOCK_REPLICATION_NONE) {
-         error_setg(errp, "Block replication is not running");
--        aio_context_release(aio_context);
-         return;
-     }
- 
-     if (s->error) {
-         error_setg(errp, "I/O error occurred");
--        aio_context_release(aio_context);
-         return;
-     }
--    aio_context_release(aio_context);
- }
- 
- static void replication_done(void *opaque, int ret)
-@@ -708,12 +668,7 @@ static void replication_done(void *opaque, int ret)
- static void replication_stop(ReplicationState *rs, bool failover, Error **errp)
- {
-     BlockDriverState *bs = rs->opaque;
--    BDRVReplicationState *s;
--    AioContext *aio_context;
--
--    aio_context = bdrv_get_aio_context(bs);
--    aio_context_acquire(aio_context);
--    s = bs->opaque;
-+    BDRVReplicationState *s = bs->opaque;
- 
-     if (s->stage == BLOCK_REPLICATION_DONE ||
-         s->stage == BLOCK_REPLICATION_FAILOVER) {
-@@ -722,13 +677,11 @@ static void replication_stop(ReplicationState *rs, bool failover, Error **errp)
-          * Ignore the request because the secondary side of replication
-          * doesn't have to do anything anymore.
-          */
--        aio_context_release(aio_context);
-         return;
-     }
- 
-     if (s->stage != BLOCK_REPLICATION_RUNNING) {
-         error_setg(errp, "Block replication is not running");
--        aio_context_release(aio_context);
-         return;
-     }
- 
-@@ -744,15 +697,12 @@ static void replication_stop(ReplicationState *rs, bool failover, Error **errp)
-          * disk, secondary disk in backup_job_completed().
-          */
-         if (s->backup_job) {
--            aio_context_release(aio_context);
-             job_cancel_sync(&s->backup_job->job, true);
--            aio_context_acquire(aio_context);
-         }
- 
-         if (!failover) {
-             secondary_do_checkpoint(bs, errp);
-             s->stage = BLOCK_REPLICATION_DONE;
--            aio_context_release(aio_context);
-             return;
-         }
- 
-@@ -765,10 +715,8 @@ static void replication_stop(ReplicationState *rs, bool failover, Error **errp)
-         bdrv_graph_rdunlock_main_loop();
-         break;
-     default:
--        aio_context_release(aio_context);
-         abort();
-     }
--    aio_context_release(aio_context);
- }
- 
- static const char *const replication_strong_runtime_opts[] = {
-diff --git a/block/snapshot.c b/block/snapshot.c
-index e486d3e205..a28f2b039f 100644
---- a/block/snapshot.c
-+++ b/block/snapshot.c
-@@ -525,9 +525,7 @@ static bool GRAPH_RDLOCK bdrv_all_snapshots_includes_bs(BlockDriverState *bs)
-     return bdrv_has_blk(bs) || QLIST_EMPTY(&bs->parents);
- }
- 
--/* Group operations. All block drivers are involved.
-- * These functions will properly handle dataplane (take aio_context_acquire
-- * when appropriate for appropriate block drivers) */
-+/* Group operations. All block drivers are involved. */
- 
- bool bdrv_all_can_snapshot(bool has_devices, strList *devices,
-                            Error **errp)
-@@ -545,14 +543,11 @@ bool bdrv_all_can_snapshot(bool has_devices, strList *devices,
-     iterbdrvs = bdrvs;
-     while (iterbdrvs) {
-         BlockDriverState *bs = iterbdrvs->data;
--        AioContext *ctx = bdrv_get_aio_context(bs);
-         bool ok = true;
- 
--        aio_context_acquire(ctx);
-         if (devices || bdrv_all_snapshots_includes_bs(bs)) {
-             ok = bdrv_can_snapshot(bs);
-         }
--        aio_context_release(ctx);
-         if (!ok) {
-             error_setg(errp, "Device '%s' is writable but does not support "
-                        "snapshots", bdrv_get_device_or_node_name(bs));
-@@ -582,18 +577,15 @@ int bdrv_all_delete_snapshot(const char *name,
-     iterbdrvs = bdrvs;
-     while (iterbdrvs) {
-         BlockDriverState *bs = iterbdrvs->data;
--        AioContext *ctx = bdrv_get_aio_context(bs);
-         QEMUSnapshotInfo sn1, *snapshot = &sn1;
-         int ret = 0;
- 
--        aio_context_acquire(ctx);
-         if ((devices || bdrv_all_snapshots_includes_bs(bs)) &&
-             bdrv_snapshot_find(bs, snapshot, name) >= 0)
-         {
-             ret = bdrv_snapshot_delete(bs, snapshot->id_str,
-                                        snapshot->name, errp);
-         }
--        aio_context_release(ctx);
-         if (ret < 0) {
-             error_prepend(errp, "Could not delete snapshot '%s' on '%s': ",
-                           name, bdrv_get_device_or_node_name(bs));
-@@ -628,17 +620,14 @@ int bdrv_all_goto_snapshot(const char *name,
-     iterbdrvs = bdrvs;
-     while (iterbdrvs) {
-         BlockDriverState *bs = iterbdrvs->data;
--        AioContext *ctx = bdrv_get_aio_context(bs);
-         bool all_snapshots_includes_bs;
- 
--        aio_context_acquire(ctx);
-         bdrv_graph_rdlock_main_loop();
-         all_snapshots_includes_bs = bdrv_all_snapshots_includes_bs(bs);
-         bdrv_graph_rdunlock_main_loop();
- 
-         ret = (devices || all_snapshots_includes_bs) ?
-               bdrv_snapshot_goto(bs, name, errp) : 0;
--        aio_context_release(ctx);
-         if (ret < 0) {
-             bdrv_graph_rdlock_main_loop();
-             error_prepend(errp, "Could not load snapshot '%s' on '%s': ",
-@@ -670,15 +659,12 @@ int bdrv_all_has_snapshot(const char *name,
-     iterbdrvs = bdrvs;
-     while (iterbdrvs) {
-         BlockDriverState *bs = iterbdrvs->data;
--        AioContext *ctx = bdrv_get_aio_context(bs);
-         QEMUSnapshotInfo sn;
-         int ret = 0;
- 
--        aio_context_acquire(ctx);
-         if (devices || bdrv_all_snapshots_includes_bs(bs)) {
-             ret = bdrv_snapshot_find(bs, &sn, name);
-         }
--        aio_context_release(ctx);
-         if (ret < 0) {
-             if (ret == -ENOENT) {
-                 return 0;
-@@ -715,10 +701,8 @@ int bdrv_all_create_snapshot(QEMUSnapshotInfo *sn,
-     iterbdrvs = bdrvs;
-     while (iterbdrvs) {
-         BlockDriverState *bs = iterbdrvs->data;
--        AioContext *ctx = bdrv_get_aio_context(bs);
-         int ret = 0;
- 
--        aio_context_acquire(ctx);
-         if (bs == vm_state_bs) {
-             sn->vm_state_size = vm_state_size;
-             ret = bdrv_snapshot_create(bs, sn);
-@@ -726,7 +710,6 @@ int bdrv_all_create_snapshot(QEMUSnapshotInfo *sn,
-             sn->vm_state_size = 0;
-             ret = bdrv_snapshot_create(bs, sn);
-         }
--        aio_context_release(ctx);
-         if (ret < 0) {
-             error_setg(errp, "Could not create snapshot '%s' on '%s'",
-                        sn->name, bdrv_get_device_or_node_name(bs));
-@@ -757,13 +740,10 @@ BlockDriverState *bdrv_all_find_vmstate_bs(const char *vmstate_bs,
-     iterbdrvs = bdrvs;
-     while (iterbdrvs) {
-         BlockDriverState *bs = iterbdrvs->data;
--        AioContext *ctx = bdrv_get_aio_context(bs);
-         bool found = false;
- 
--        aio_context_acquire(ctx);
-         found = (devices || bdrv_all_snapshots_includes_bs(bs)) &&
-             bdrv_can_snapshot(bs);
--        aio_context_release(ctx);
- 
-         if (vmstate_bs) {
-             if (g_str_equal(vmstate_bs,
-diff --git a/block/write-threshold.c b/block/write-threshold.c
-index 76d8885677..56fe88de81 100644
---- a/block/write-threshold.c
-+++ b/block/write-threshold.c
-@@ -33,7 +33,6 @@ void qmp_block_set_write_threshold(const char *node_name,
-                                    Error **errp)
- {
-     BlockDriverState *bs;
--    AioContext *aio_context;
- 
-     bs = bdrv_find_node(node_name);
-     if (!bs) {
-@@ -41,12 +40,7 @@ void qmp_block_set_write_threshold(const char *node_name,
-         return;
-     }
- 
--    aio_context = bdrv_get_aio_context(bs);
--    aio_context_acquire(aio_context);
--
-     bdrv_write_threshold_set(bs, threshold_bytes);
--
--    aio_context_release(aio_context);
- }
- 
- void bdrv_write_threshold_check_write(BlockDriverState *bs, int64_t offset,
-diff --git a/blockdev.c b/blockdev.c
-index 9e1381169d..5d8b3a23eb 100644
---- a/blockdev.c
-+++ b/blockdev.c
-@@ -662,7 +662,6 @@ err_no_opts:
- /* Takes the ownership of bs_opts */
- BlockDriverState *bds_tree_init(QDict *bs_opts, Error **errp)
- {
--    BlockDriverState *bs;
-     int bdrv_flags = 0;
- 
-     GLOBAL_STATE_CODE();
-@@ -677,11 +676,7 @@ BlockDriverState *bds_tree_init(QDict *bs_opts, Error **errp)
-         bdrv_flags |= BDRV_O_INACTIVE;
-     }
- 
--    aio_context_acquire(qemu_get_aio_context());
--    bs = bdrv_open(NULL, NULL, bs_opts, bdrv_flags, errp);
--    aio_context_release(qemu_get_aio_context());
--
--    return bs;
-+    return bdrv_open(NULL, NULL, bs_opts, bdrv_flags, errp);
- }
- 
- void blockdev_close_all_bdrv_states(void)
-@@ -690,11 +685,7 @@ void blockdev_close_all_bdrv_states(void)
- 
-     GLOBAL_STATE_CODE();
-     QTAILQ_FOREACH_SAFE(bs, &monitor_bdrv_states, monitor_list, next_bs) {
--        AioContext *ctx = bdrv_get_aio_context(bs);
--
--        aio_context_acquire(ctx);
-         bdrv_unref(bs);
--        aio_context_release(ctx);
-     }
- }
- 
-@@ -1048,7 +1039,6 @@ fail:
- static BlockDriverState *qmp_get_root_bs(const char *name, Error **errp)
- {
-     BlockDriverState *bs;
--    AioContext *aio_context;
- 
-     GRAPH_RDLOCK_GUARD_MAINLOOP();
- 
-@@ -1062,16 +1052,11 @@ static BlockDriverState *qmp_get_root_bs(const char *name, Error **errp)
-         return NULL;
-     }
- 
--    aio_context = bdrv_get_aio_context(bs);
--    aio_context_acquire(aio_context);
--
-     if (!bdrv_is_inserted(bs)) {
-         error_setg(errp, "Device has no medium");
-         bs = NULL;
-     }
- 
--    aio_context_release(aio_context);
--
-     return bs;
- }
- 
-@@ -1141,7 +1126,6 @@ SnapshotInfo *qmp_blockdev_snapshot_delete_internal_sync(const char *device,
-                                                          Error **errp)
- {
-     BlockDriverState *bs;
--    AioContext *aio_context;
-     QEMUSnapshotInfo sn;
-     Error *local_err = NULL;
-     SnapshotInfo *info = NULL;
-@@ -1154,39 +1138,35 @@ SnapshotInfo *qmp_blockdev_snapshot_delete_internal_sync(const char *device,
-     if (!bs) {
-         return NULL;
-     }
--    aio_context = bdrv_get_aio_context(bs);
--    aio_context_acquire(aio_context);
- 
-     if (!id && !name) {
-         error_setg(errp, "Name or id must be provided");
--        goto out_aio_context;
-+        return NULL;
-     }
- 
-     if (bdrv_op_is_blocked(bs, BLOCK_OP_TYPE_INTERNAL_SNAPSHOT_DELETE, errp)) {
--        goto out_aio_context;
-+        return NULL;
-     }
- 
-     ret = bdrv_snapshot_find_by_id_and_name(bs, id, name, &sn, &local_err);
-     if (local_err) {
-         error_propagate(errp, local_err);
--        goto out_aio_context;
-+        return NULL;
-     }
-     if (!ret) {
-         error_setg(errp,
-                    "Snapshot with id '%s' and name '%s' does not exist on "
-                    "device '%s'",
-                    STR_OR_NULL(id), STR_OR_NULL(name), device);
--        goto out_aio_context;
-+        return NULL;
-     }
- 
-     bdrv_snapshot_delete(bs, id, name, &local_err);
-     if (local_err) {
-         error_propagate(errp, local_err);
--        goto out_aio_context;
-+        return NULL;
-     }
- 
--    aio_context_release(aio_context);
--
-     info = g_new0(SnapshotInfo, 1);
-     info->id = g_strdup(sn.id_str);
-     info->name = g_strdup(sn.name);
-@@ -1201,10 +1181,6 @@ SnapshotInfo *qmp_blockdev_snapshot_delete_internal_sync(const char *device,
-     }
- 
-     return info;
--
--out_aio_context:
--    aio_context_release(aio_context);
--    return NULL;
- }
- 
- /* internal snapshot private data */
-@@ -1232,7 +1208,6 @@ static void internal_snapshot_action(BlockdevSnapshotInternal *internal,
-     bool ret;
-     int64_t rt;
-     InternalSnapshotState *state = g_new0(InternalSnapshotState, 1);
--    AioContext *aio_context;
-     int ret1;
- 
-     GLOBAL_STATE_CODE();
-@@ -1248,33 +1223,30 @@ static void internal_snapshot_action(BlockdevSnapshotInternal *internal,
-         return;
-     }
- 
--    aio_context = bdrv_get_aio_context(bs);
--    aio_context_acquire(aio_context);
--
-     state->bs = bs;
- 
-     /* Paired with .clean() */
-     bdrv_drained_begin(bs);
- 
-     if (bdrv_op_is_blocked(bs, BLOCK_OP_TYPE_INTERNAL_SNAPSHOT, errp)) {
--        goto out;
-+        return;
-     }
- 
-     if (bdrv_is_read_only(bs)) {
-         error_setg(errp, "Device '%s' is read only", device);
--        goto out;
-+        return;
-     }
- 
-     if (!bdrv_can_snapshot(bs)) {
-         error_setg(errp, "Block format '%s' used by device '%s' "
-                    "does not support internal snapshots",
-                    bs->drv->format_name, device);
--        goto out;
-+        return;
-     }
- 
-     if (!strlen(name)) {
-         error_setg(errp, "Name is empty");
--        goto out;
-+        return;
-     }
- 
-     /* check whether a snapshot with name exist */
-@@ -1282,12 +1254,12 @@ static void internal_snapshot_action(BlockdevSnapshotInternal *internal,
-                                             &local_err);
-     if (local_err) {
-         error_propagate(errp, local_err);
--        goto out;
-+        return;
-     } else if (ret) {
-         error_setg(errp,
-                    "Snapshot with name '%s' already exists on device '%s'",
-                    name, device);
--        goto out;
-+        return;
-     }
- 
-     /* 3. take the snapshot */
-@@ -1308,14 +1280,11 @@ static void internal_snapshot_action(BlockdevSnapshotInternal *internal,
-         error_setg_errno(errp, -ret1,
-                          "Failed to create snapshot '%s' on device '%s'",
-                          name, device);
--        goto out;
-+        return;
-     }
- 
-     /* 4. succeed, mark a snapshot is created */
-     state->created = true;
--
--out:
--    aio_context_release(aio_context);
- }
- 
- static void internal_snapshot_abort(void *opaque)
-@@ -1323,7 +1292,6 @@ static void internal_snapshot_abort(void *opaque)
-     InternalSnapshotState *state = opaque;
-     BlockDriverState *bs = state->bs;
-     QEMUSnapshotInfo *sn = &state->sn;
--    AioContext *aio_context;
-     Error *local_error = NULL;
- 
-     GLOBAL_STATE_CODE();
-@@ -1333,9 +1301,6 @@ static void internal_snapshot_abort(void *opaque)
-         return;
-     }
- 
--    aio_context = bdrv_get_aio_context(state->bs);
--    aio_context_acquire(aio_context);
--
-     if (bdrv_snapshot_delete(bs, sn->id_str, sn->name, &local_error) < 0) {
-         error_reportf_err(local_error,
-                           "Failed to delete snapshot with id '%s' and "
-@@ -1343,25 +1308,17 @@ static void internal_snapshot_abort(void *opaque)
-                           sn->id_str, sn->name,
-                           bdrv_get_device_name(bs));
-     }
--
--    aio_context_release(aio_context);
- }
- 
- static void internal_snapshot_clean(void *opaque)
- {
-     g_autofree InternalSnapshotState *state = opaque;
--    AioContext *aio_context;
- 
-     if (!state->bs) {
-         return;
-     }
- 
--    aio_context = bdrv_get_aio_context(state->bs);
--    aio_context_acquire(aio_context);
--
-     bdrv_drained_end(state->bs);
--
--    aio_context_release(aio_context);
- }
- 
- /* external snapshot private data */
-@@ -1395,7 +1352,6 @@ static void external_snapshot_action(TransactionAction *action,
-     /* File name of the new image (for 'blockdev-snapshot-sync') */
-     const char *new_image_file;
-     ExternalSnapshotState *state = g_new0(ExternalSnapshotState, 1);
--    AioContext *aio_context;
-     uint64_t perm, shared;
- 
-     /* TODO We'll eventually have to take a writer lock in this function */
-@@ -1435,26 +1391,23 @@ static void external_snapshot_action(TransactionAction *action,
-         return;
-     }
- 
--    aio_context = bdrv_get_aio_context(state->old_bs);
--    aio_context_acquire(aio_context);
--
-     /* Paired with .clean() */
-     bdrv_drained_begin(state->old_bs);
- 
-     if (!bdrv_is_inserted(state->old_bs)) {
-         error_setg(errp, QERR_DEVICE_HAS_NO_MEDIUM, device);
--        goto out;
-+        return;
-     }
- 
-     if (bdrv_op_is_blocked(state->old_bs,
-                            BLOCK_OP_TYPE_EXTERNAL_SNAPSHOT, errp)) {
--        goto out;
-+        return;
-     }
- 
-     if (!bdrv_is_read_only(state->old_bs)) {
-         if (bdrv_flush(state->old_bs)) {
-             error_setg(errp, QERR_IO_ERROR);
--            goto out;
-+            return;
-         }
-     }
- 
-@@ -1466,13 +1419,13 @@ static void external_snapshot_action(TransactionAction *action,
- 
-         if (node_name && !snapshot_node_name) {
-             error_setg(errp, "New overlay node-name missing");
--            goto out;
-+            return;
-         }
- 
-         if (snapshot_node_name &&
-             bdrv_lookup_bs(snapshot_node_name, snapshot_node_name, NULL)) {
-             error_setg(errp, "New overlay node-name already in use");
--            goto out;
-+            return;
-         }
- 
-         flags = state->old_bs->open_flags;
-@@ -1485,20 +1438,18 @@ static void external_snapshot_action(TransactionAction *action,
-             int64_t size = bdrv_getlength(state->old_bs);
-             if (size < 0) {
-                 error_setg_errno(errp, -size, "bdrv_getlength failed");
--                goto out;
-+                return;
-             }
-             bdrv_refresh_filename(state->old_bs);
- 
--            aio_context_release(aio_context);
-             bdrv_img_create(new_image_file, format,
-                             state->old_bs->filename,
-                             state->old_bs->drv->format_name,
-                             NULL, size, flags, false, &local_err);
--            aio_context_acquire(aio_context);
- 
-             if (local_err) {
-                 error_propagate(errp, local_err);
--                goto out;
-+                return;
-             }
-         }
- 
-@@ -1508,20 +1459,15 @@ static void external_snapshot_action(TransactionAction *action,
-         }
-         qdict_put_str(options, "driver", format);
-     }
--    aio_context_release(aio_context);
- 
--    aio_context_acquire(qemu_get_aio_context());
-     state->new_bs = bdrv_open(new_image_file, snapshot_ref, options, flags,
-                               errp);
--    aio_context_release(qemu_get_aio_context());
- 
-     /* We will manually add the backing_hd field to the bs later */
-     if (!state->new_bs) {
-         return;
-     }
- 
--    aio_context_acquire(aio_context);
--
-     /*
-      * Allow attaching a backing file to an overlay that's already in use only
-      * if the parents don't assume that they are already seeing a valid image.
-@@ -1530,41 +1476,34 @@ static void external_snapshot_action(TransactionAction *action,
-     bdrv_get_cumulative_perm(state->new_bs, &perm, &shared);
-     if (perm & BLK_PERM_CONSISTENT_READ) {
-         error_setg(errp, "The overlay is already in use");
--        goto out;
-+        return;
-     }
- 
-     if (state->new_bs->drv->is_filter) {
-         error_setg(errp, "Filters cannot be used as overlays");
--        goto out;
-+        return;
-     }
- 
-     if (bdrv_cow_child(state->new_bs)) {
-         error_setg(errp, "The overlay already has a backing image");
--        goto out;
-+        return;
-     }
- 
-     if (!state->new_bs->drv->supports_backing) {
-         error_setg(errp, "The overlay does not support backing images");
--        goto out;
-+        return;
-     }
- 
-     ret = bdrv_append(state->new_bs, state->old_bs, errp);
-     if (ret < 0) {
--        goto out;
-+        return;
-     }
-     state->overlay_appended = true;
--
--out:
--    aio_context_release(aio_context);
- }
- 
- static void external_snapshot_commit(void *opaque)
- {
-     ExternalSnapshotState *state = opaque;
--    AioContext *aio_context;
--
--    aio_context = bdrv_get_aio_context(state->old_bs);
--    aio_context_acquire(aio_context);
- 
-     /* We don't need (or want) to use the transactional
-      * bdrv_reopen_multiple() across all the entries at once, because we
-@@ -1572,8 +1511,6 @@ static void external_snapshot_commit(void *opaque)
-     if (!qatomic_read(&state->old_bs->copy_on_read)) {
-         bdrv_reopen_set_read_only(state->old_bs, true, NULL);
-     }
--
--    aio_context_release(aio_context);
- }
- 
- static void external_snapshot_abort(void *opaque)
-@@ -1586,7 +1523,6 @@ static void external_snapshot_abort(void *opaque)
-             int ret;
- 
-             aio_context = bdrv_get_aio_context(state->old_bs);
--            aio_context_acquire(aio_context);
- 
-             bdrv_ref(state->old_bs);   /* we can't let bdrv_set_backind_hd()
-                                           close state->old_bs; we need it */
-@@ -1599,15 +1535,9 @@ static void external_snapshot_abort(void *opaque)
-              */
-             tmp_context = bdrv_get_aio_context(state->old_bs);
-             if (aio_context != tmp_context) {
--                aio_context_release(aio_context);
--                aio_context_acquire(tmp_context);
--
-                 ret = bdrv_try_change_aio_context(state->old_bs,
-                                                   aio_context, NULL, NULL);
-                 assert(ret == 0);
--
--                aio_context_release(tmp_context);
--                aio_context_acquire(aio_context);
-             }
- 
-             bdrv_drained_begin(state->new_bs);
-@@ -1617,8 +1547,6 @@ static void external_snapshot_abort(void *opaque)
-             bdrv_drained_end(state->new_bs);
- 
-             bdrv_unref(state->old_bs); /* bdrv_replace_node() ref'ed old_bs */
--
--            aio_context_release(aio_context);
-         }
-     }
- }
-@@ -1626,19 +1554,13 @@ static void external_snapshot_abort(void *opaque)
- static void external_snapshot_clean(void *opaque)
- {
-     g_autofree ExternalSnapshotState *state = opaque;
--    AioContext *aio_context;
- 
-     if (!state->old_bs) {
-         return;
-     }
- 
--    aio_context = bdrv_get_aio_context(state->old_bs);
--    aio_context_acquire(aio_context);
--
-     bdrv_drained_end(state->old_bs);
-     bdrv_unref(state->new_bs);
--
--    aio_context_release(aio_context);
- }
- 
- typedef struct DriveBackupState {
-@@ -1670,7 +1592,6 @@ static void drive_backup_action(DriveBackup *backup,
-     BlockDriverState *target_bs;
-     BlockDriverState *source = NULL;
-     AioContext *aio_context;
--    AioContext *old_context;
-     const char *format;
-     QDict *options;
-     Error *local_err = NULL;
-@@ -1698,7 +1619,6 @@ static void drive_backup_action(DriveBackup *backup,
-     }
- 
-     aio_context = bdrv_get_aio_context(bs);
--    aio_context_acquire(aio_context);
- 
-     state->bs = bs;
-     /* Paired with .clean() */
-@@ -1713,7 +1633,7 @@ static void drive_backup_action(DriveBackup *backup,
-     bdrv_graph_rdlock_main_loop();
-     if (bdrv_op_is_blocked(bs, BLOCK_OP_TYPE_BACKUP_SOURCE, errp)) {
-         bdrv_graph_rdunlock_main_loop();
--        goto out;
-+        return;
-     }
- 
-     flags = bs->open_flags | BDRV_O_RDWR;
-@@ -1744,7 +1664,7 @@ static void drive_backup_action(DriveBackup *backup,
-     size = bdrv_getlength(bs);
-     if (size < 0) {
-         error_setg_errno(errp, -size, "bdrv_getlength failed");
--        goto out;
-+        return;
-     }
- 
-     if (backup->mode != NEW_IMAGE_MODE_EXISTING) {
-@@ -1770,7 +1690,7 @@ static void drive_backup_action(DriveBackup *backup,
- 
-     if (local_err) {
-         error_propagate(errp, local_err);
--        goto out;
-+        return;
-     }
- 
-     options = qdict_new();
-@@ -1779,30 +1699,18 @@ static void drive_backup_action(DriveBackup *backup,
-     if (format) {
-         qdict_put_str(options, "driver", format);
-     }
--    aio_context_release(aio_context);
- 
--    aio_context_acquire(qemu_get_aio_context());
-     target_bs = bdrv_open(backup->target, NULL, options, flags, errp);
--    aio_context_release(qemu_get_aio_context());
--
-     if (!target_bs) {
-         return;
-     }
- 
--    /* Honor bdrv_try_change_aio_context() context acquisition requirements. */
--    old_context = bdrv_get_aio_context(target_bs);
--    aio_context_acquire(old_context);
--
-     ret = bdrv_try_change_aio_context(target_bs, aio_context, NULL, errp);
-     if (ret < 0) {
-         bdrv_unref(target_bs);
--        aio_context_release(old_context);
-         return;
-     }
- 
--    aio_context_release(old_context);
--    aio_context_acquire(aio_context);
--
-     if (set_backing_hd) {
-         if (bdrv_set_backing_hd(target_bs, source, errp) < 0) {
-             goto unref;
-@@ -1815,22 +1723,14 @@ static void drive_backup_action(DriveBackup *backup,
- 
- unref:
-     bdrv_unref(target_bs);
--out:
--    aio_context_release(aio_context);
- }
- 
- static void drive_backup_commit(void *opaque)
- {
-     DriveBackupState *state = opaque;
--    AioContext *aio_context;
--
--    aio_context = bdrv_get_aio_context(state->bs);
--    aio_context_acquire(aio_context);
- 
-     assert(state->job);
-     job_start(&state->job->job);
--
--    aio_context_release(aio_context);
- }
- 
- static void drive_backup_abort(void *opaque)
-@@ -1845,18 +1745,12 @@ static void drive_backup_abort(void *opaque)
- static void drive_backup_clean(void *opaque)
- {
-     g_autofree DriveBackupState *state = opaque;
--    AioContext *aio_context;
- 
-     if (!state->bs) {
-         return;
-     }
- 
--    aio_context = bdrv_get_aio_context(state->bs);
--    aio_context_acquire(aio_context);
--
-     bdrv_drained_end(state->bs);
--
--    aio_context_release(aio_context);
- }
- 
- typedef struct BlockdevBackupState {
-@@ -1881,7 +1775,6 @@ static void blockdev_backup_action(BlockdevBackup *backup,
-     BlockDriverState *bs;
-     BlockDriverState *target_bs;
-     AioContext *aio_context;
--    AioContext *old_context;
-     int ret;
- 
-     tran_add(tran, &blockdev_backup_drv, state);
-@@ -1898,17 +1791,12 @@ static void blockdev_backup_action(BlockdevBackup *backup,
- 
-     /* Honor bdrv_try_change_aio_context() context acquisition requirements. */
-     aio_context = bdrv_get_aio_context(bs);
--    old_context = bdrv_get_aio_context(target_bs);
--    aio_context_acquire(old_context);
- 
-     ret = bdrv_try_change_aio_context(target_bs, aio_context, NULL, errp);
-     if (ret < 0) {
--        aio_context_release(old_context);
-         return;
-     }
- 
--    aio_context_release(old_context);
--    aio_context_acquire(aio_context);
-     state->bs = bs;
- 
-     /* Paired with .clean() */
-@@ -1917,22 +1805,14 @@ static void blockdev_backup_action(BlockdevBackup *backup,
-     state->job = do_backup_common(qapi_BlockdevBackup_base(backup),
-                                   bs, target_bs, aio_context,
-                                   block_job_txn, errp);
--
--    aio_context_release(aio_context);
- }
- 
- static void blockdev_backup_commit(void *opaque)
- {
-     BlockdevBackupState *state = opaque;
--    AioContext *aio_context;
--
--    aio_context = bdrv_get_aio_context(state->bs);
--    aio_context_acquire(aio_context);
- 
-     assert(state->job);
-     job_start(&state->job->job);
--
--    aio_context_release(aio_context);
- }
- 
- static void blockdev_backup_abort(void *opaque)
-@@ -1947,18 +1827,12 @@ static void blockdev_backup_abort(void *opaque)
- static void blockdev_backup_clean(void *opaque)
- {
-     g_autofree BlockdevBackupState *state = opaque;
--    AioContext *aio_context;
- 
-     if (!state->bs) {
-         return;
-     }
- 
--    aio_context = bdrv_get_aio_context(state->bs);
--    aio_context_acquire(aio_context);
--
-     bdrv_drained_end(state->bs);
--
--    aio_context_release(aio_context);
- }
- 
- typedef struct BlockDirtyBitmapState {
-@@ -2454,7 +2328,6 @@ void qmp_block_stream(const char *job_id, const char *device,
-     }
- 
-     aio_context = bdrv_get_aio_context(bs);
--    aio_context_acquire(aio_context);
- 
-     bdrv_graph_rdlock_main_loop();
-     if (base) {
-@@ -2521,7 +2394,7 @@ void qmp_block_stream(const char *job_id, const char *device,
-     if (!base_bs && backing_file) {
-         error_setg(errp, "backing file specified, but streaming the "
-                          "entire chain");
--        goto out;
-+        return;
-     }
- 
-     if (has_auto_finalize && !auto_finalize) {
-@@ -2536,18 +2409,14 @@ void qmp_block_stream(const char *job_id, const char *device,
-                  filter_node_name, &local_err);
-     if (local_err) {
-         error_propagate(errp, local_err);
--        goto out;
-+        return;
-     }
- 
-     trace_qmp_block_stream(bs);
--
--out:
--    aio_context_release(aio_context);
-     return;
- 
- out_rdlock:
-     bdrv_graph_rdunlock_main_loop();
--    aio_context_release(aio_context);
- }
- 
- void qmp_block_commit(const char *job_id, const char *device,
-@@ -2606,10 +2475,9 @@ void qmp_block_commit(const char *job_id, const char *device,
-     }
- 
-     aio_context = bdrv_get_aio_context(bs);
--    aio_context_acquire(aio_context);
- 
-     if (bdrv_op_is_blocked(bs, BLOCK_OP_TYPE_COMMIT_SOURCE, errp)) {
--        goto out;
-+        return;
-     }
- 
-     /* default top_bs is the active layer */
-@@ -2617,16 +2485,16 @@ void qmp_block_commit(const char *job_id, const char *device,
- 
-     if (top_node && top) {
-         error_setg(errp, "'top-node' and 'top' are mutually exclusive");
--        goto out;
-+        return;
-     } else if (top_node) {
-         top_bs = bdrv_lookup_bs(NULL, top_node, errp);
-         if (top_bs == NULL) {
--            goto out;
-+            return;
-         }
-         if (!bdrv_chain_contains(bs, top_bs)) {
-             error_setg(errp, "'%s' is not in this backing file chain",
-                        top_node);
--            goto out;
-+            return;
-         }
-     } else if (top) {
-         /* This strcmp() is just a shortcut, there is no need to
-@@ -2640,35 +2508,35 @@ void qmp_block_commit(const char *job_id, const char *device,
- 
-     if (top_bs == NULL) {
-         error_setg(errp, "Top image file %s not found", top ? top : "NULL");
--        goto out;
-+        return;
-     }
- 
-     assert(bdrv_get_aio_context(top_bs) == aio_context);
- 
-     if (base_node && base) {
-         error_setg(errp, "'base-node' and 'base' are mutually exclusive");
--        goto out;
-+        return;
-     } else if (base_node) {
-         base_bs = bdrv_lookup_bs(NULL, base_node, errp);
-         if (base_bs == NULL) {
--            goto out;
-+            return;
-         }
-         if (!bdrv_chain_contains(top_bs, base_bs)) {
-             error_setg(errp, "'%s' is not in this backing file chain",
-                        base_node);
--            goto out;
-+            return;
-         }
-     } else if (base) {
-         base_bs = bdrv_find_backing_image(top_bs, base);
-         if (base_bs == NULL) {
-             error_setg(errp, "Can't find '%s' in the backing chain", base);
--            goto out;
-+            return;
-         }
-     } else {
-         base_bs = bdrv_find_base(top_bs);
-         if (base_bs == NULL) {
-             error_setg(errp, "There is no backimg image");
--            goto out;
-+            return;
-         }
-     }
- 
-@@ -2678,14 +2546,14 @@ void qmp_block_commit(const char *job_id, const char *device,
-          iter = bdrv_filter_or_cow_bs(iter))
-     {
-         if (bdrv_op_is_blocked(iter, BLOCK_OP_TYPE_COMMIT_TARGET, errp)) {
--            goto out;
-+            return;
-         }
-     }
- 
-     /* Do not allow attempts to commit an image into itself */
-     if (top_bs == base_bs) {
-         error_setg(errp, "cannot commit an image into itself");
--        goto out;
-+        return;
-     }
- 
-     /*
-@@ -2708,7 +2576,7 @@ void qmp_block_commit(const char *job_id, const char *device,
-                 error_setg(errp, "'backing-file' specified, but 'top' has a "
-                                  "writer on it");
-             }
--            goto out;
-+            return;
-         }
-         if (!job_id) {
-             /*
-@@ -2724,7 +2592,7 @@ void qmp_block_commit(const char *job_id, const char *device,
-     } else {
-         BlockDriverState *overlay_bs = bdrv_find_overlay(bs, top_bs);
-         if (bdrv_op_is_blocked(overlay_bs, BLOCK_OP_TYPE_COMMIT_TARGET, errp)) {
--            goto out;
-+            return;
-         }
-         commit_start(job_id, bs, base_bs, top_bs, job_flags,
-                      speed, on_error, backing_file,
-@@ -2732,11 +2600,8 @@ void qmp_block_commit(const char *job_id, const char *device,
-     }
-     if (local_err != NULL) {
-         error_propagate(errp, local_err);
--        goto out;
-+        return;
-     }
--
--out:
--    aio_context_release(aio_context);
- }
- 
- /* Common QMP interface for drive-backup and blockdev-backup */
-@@ -2985,8 +2850,6 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
- 
-     if (replaces) {
-         BlockDriverState *to_replace_bs;
--        AioContext *aio_context;
--        AioContext *replace_aio_context;
-         int64_t bs_size, replace_size;
- 
-         bs_size = bdrv_getlength(bs);
-@@ -3000,19 +2863,7 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
-             return;
-         }
- 
--        aio_context = bdrv_get_aio_context(bs);
--        replace_aio_context = bdrv_get_aio_context(to_replace_bs);
--        /*
--         * bdrv_getlength() is a co-wrapper and uses AIO_WAIT_WHILE. Be sure not
--         * to acquire the same AioContext twice.
--         */
--        if (replace_aio_context != aio_context) {
--            aio_context_acquire(replace_aio_context);
--        }
-         replace_size = bdrv_getlength(to_replace_bs);
--        if (replace_aio_context != aio_context) {
--            aio_context_release(replace_aio_context);
--        }
- 
-         if (replace_size < 0) {
-             error_setg_errno(errp, -replace_size,
-@@ -3041,7 +2892,6 @@ void qmp_drive_mirror(DriveMirror *arg, Error **errp)
-     BlockDriverState *bs;
-     BlockDriverState *target_backing_bs, *target_bs;
-     AioContext *aio_context;
--    AioContext *old_context;
-     BlockMirrorBackingMode backing_mode;
-     Error *local_err = NULL;
-     QDict *options = NULL;
-@@ -3064,7 +2914,6 @@ void qmp_drive_mirror(DriveMirror *arg, Error **errp)
-     }
- 
-     aio_context = bdrv_get_aio_context(bs);
--    aio_context_acquire(aio_context);
- 
-     if (!arg->has_mode) {
-         arg->mode = NEW_IMAGE_MODE_ABSOLUTE_PATHS;
-@@ -3088,14 +2937,14 @@ void qmp_drive_mirror(DriveMirror *arg, Error **errp)
-     size = bdrv_getlength(bs);
-     if (size < 0) {
-         error_setg_errno(errp, -size, "bdrv_getlength failed");
--        goto out;
-+        return;
-     }
- 
-     if (arg->replaces) {
-         if (!arg->node_name) {
-             error_setg(errp, "a node-name must be provided when replacing a"
-                              " named node of the graph");
--            goto out;
-+            return;
-         }
-     }
- 
-@@ -3143,7 +2992,7 @@ void qmp_drive_mirror(DriveMirror *arg, Error **errp)
- 
-     if (local_err) {
-         error_propagate(errp, local_err);
--        goto out;
-+        return;
-     }
- 
-     options = qdict_new();
-@@ -3153,15 +3002,11 @@ void qmp_drive_mirror(DriveMirror *arg, Error **errp)
-     if (format) {
-         qdict_put_str(options, "driver", format);
-     }
--    aio_context_release(aio_context);
- 
-     /* Mirroring takes care of copy-on-write using the source's backing
-      * file.
-      */
--    aio_context_acquire(qemu_get_aio_context());
-     target_bs = bdrv_open(arg->target, NULL, options, flags, errp);
--    aio_context_release(qemu_get_aio_context());
--
-     if (!target_bs) {
-         return;
-     }
-@@ -3173,20 +3018,12 @@ void qmp_drive_mirror(DriveMirror *arg, Error **errp)
-     bdrv_graph_rdunlock_main_loop();
- 
- 
--    /* Honor bdrv_try_change_aio_context() context acquisition requirements. */
--    old_context = bdrv_get_aio_context(target_bs);
--    aio_context_acquire(old_context);
--
-     ret = bdrv_try_change_aio_context(target_bs, aio_context, NULL, errp);
-     if (ret < 0) {
-         bdrv_unref(target_bs);
--        aio_context_release(old_context);
-         return;
-     }
- 
--    aio_context_release(old_context);
--    aio_context_acquire(aio_context);
--
-     blockdev_mirror_common(arg->job_id, bs, target_bs,
-                            arg->replaces, arg->sync,
-                            backing_mode, zero_target,
-@@ -3202,8 +3039,6 @@ void qmp_drive_mirror(DriveMirror *arg, Error **errp)
-                            arg->has_auto_dismiss, arg->auto_dismiss,
-                            errp);
-     bdrv_unref(target_bs);
--out:
--    aio_context_release(aio_context);
- }
- 
- void qmp_blockdev_mirror(const char *job_id,
-@@ -3226,7 +3061,6 @@ void qmp_blockdev_mirror(const char *job_id,
-     BlockDriverState *bs;
-     BlockDriverState *target_bs;
-     AioContext *aio_context;
--    AioContext *old_context;
-     BlockMirrorBackingMode backing_mode = MIRROR_LEAVE_BACKING_CHAIN;
-     bool zero_target;
-     int ret;
-@@ -3243,18 +3077,11 @@ void qmp_blockdev_mirror(const char *job_id,
- 
-     zero_target = (sync == MIRROR_SYNC_MODE_FULL);
- 
--    /* Honor bdrv_try_change_aio_context() context acquisition requirements. */
--    old_context = bdrv_get_aio_context(target_bs);
-     aio_context = bdrv_get_aio_context(bs);
--    aio_context_acquire(old_context);
- 
-     ret = bdrv_try_change_aio_context(target_bs, aio_context, NULL, errp);
--
--    aio_context_release(old_context);
--    aio_context_acquire(aio_context);
--
-     if (ret < 0) {
--        goto out;
-+        return;
-     }
- 
-     blockdev_mirror_common(job_id, bs, target_bs,
-@@ -3269,8 +3096,6 @@ void qmp_blockdev_mirror(const char *job_id,
-                            has_auto_finalize, auto_finalize,
-                            has_auto_dismiss, auto_dismiss,
-                            errp);
--out:
--    aio_context_release(aio_context);
- }
- 
- /*
-@@ -3433,7 +3258,6 @@ void qmp_change_backing_file(const char *device,
-                              Error **errp)
- {
-     BlockDriverState *bs = NULL;
--    AioContext *aio_context;
-     BlockDriverState *image_bs = NULL;
-     Error *local_err = NULL;
-     bool ro;
-@@ -3444,9 +3268,6 @@ void qmp_change_backing_file(const char *device,
-         return;
-     }
- 
--    aio_context = bdrv_get_aio_context(bs);
--    aio_context_acquire(aio_context);
--
-     bdrv_graph_rdlock_main_loop();
- 
-     image_bs = bdrv_lookup_bs(NULL, image_node_name, &local_err);
-@@ -3485,7 +3306,7 @@ void qmp_change_backing_file(const char *device,
- 
-     if (ro) {
-         if (bdrv_reopen_set_read_only(image_bs, false, errp) != 0) {
--            goto out;
-+            return;
-         }
-     }
- 
-@@ -3503,14 +3324,10 @@ void qmp_change_backing_file(const char *device,
-     if (ro) {
-         bdrv_reopen_set_read_only(image_bs, true, errp);
-     }
--
--out:
--    aio_context_release(aio_context);
-     return;
- 
- out_rdlock:
-     bdrv_graph_rdunlock_main_loop();
--    aio_context_release(aio_context);
- }
- 
- void qmp_blockdev_add(BlockdevOptions *options, Error **errp)
-@@ -3550,7 +3367,6 @@ void qmp_blockdev_reopen(BlockdevOptionsList *reopen_list, Error **errp)
-     for (; reopen_list != NULL; reopen_list = reopen_list->next) {
-         BlockdevOptions *options = reopen_list->value;
-         BlockDriverState *bs;
--        AioContext *ctx;
-         QObject *obj;
-         Visitor *v;
-         QDict *qdict;
-@@ -3578,12 +3394,7 @@ void qmp_blockdev_reopen(BlockdevOptionsList *reopen_list, Error **errp)
- 
-         qdict_flatten(qdict);
- 
--        ctx = bdrv_get_aio_context(bs);
--        aio_context_acquire(ctx);
--
-         queue = bdrv_reopen_queue(queue, bs, qdict, false);
--
--        aio_context_release(ctx);
-     }
- 
-     /* Perform the reopen operation */
-@@ -3596,7 +3407,6 @@ fail:
- 
- void qmp_blockdev_del(const char *node_name, Error **errp)
- {
--    AioContext *aio_context;
-     BlockDriverState *bs;
- 
-     GLOBAL_STATE_CODE();
-@@ -3611,30 +3421,25 @@ void qmp_blockdev_del(const char *node_name, Error **errp)
-         error_setg(errp, "Node %s is in use", node_name);
-         return;
-     }
--    aio_context = bdrv_get_aio_context(bs);
--    aio_context_acquire(aio_context);
- 
-     if (bdrv_op_is_blocked(bs, BLOCK_OP_TYPE_DRIVE_DEL, errp)) {
--        goto out;
-+        return;
-     }
- 
-     if (!QTAILQ_IN_USE(bs, monitor_list)) {
-         error_setg(errp, "Node %s is not owned by the monitor",
-                    bs->node_name);
--        goto out;
-+        return;
-     }
- 
-     if (bs->refcnt > 1) {
-         error_setg(errp, "Block device %s is in use",
-                    bdrv_get_device_or_node_name(bs));
--        goto out;
-+        return;
-     }
- 
-     QTAILQ_REMOVE(&monitor_bdrv_states, bs, monitor_list);
-     bdrv_unref(bs);
--
--out:
--    aio_context_release(aio_context);
- }
- 
- static BdrvChild * GRAPH_RDLOCK
-@@ -3724,7 +3529,6 @@ BlockJobInfoList *qmp_query_block_jobs(Error **errp)
- void qmp_x_blockdev_set_iothread(const char *node_name, StrOrNull *iothread,
-                                  bool has_force, bool force, Error **errp)
- {
--    AioContext *old_context;
-     AioContext *new_context;
-     BlockDriverState *bs;
- 
-@@ -3756,12 +3560,7 @@ void qmp_x_blockdev_set_iothread(const char *node_name, StrOrNull *iothread,
-         new_context = qemu_get_aio_context();
-     }
- 
--    old_context = bdrv_get_aio_context(bs);
--    aio_context_acquire(old_context);
--
-     bdrv_try_change_aio_context(bs, new_context, NULL, errp);
--
--    aio_context_release(old_context);
- }
- 
- QemuOptsList qemu_common_drive_opts = {
-diff --git a/blockjob.c b/blockjob.c
-index 7310412313..d5f29e14af 100644
---- a/blockjob.c
-+++ b/blockjob.c
-@@ -198,9 +198,7 @@ void block_job_remove_all_bdrv(BlockJob *job)
-      * one to make sure that such a concurrent access does not attempt
-      * to process an already freed BdrvChild.
-      */
--    aio_context_release(job->job.aio_context);
-     bdrv_graph_wrlock();
--    aio_context_acquire(job->job.aio_context);
-     while (job->nodes) {
-         GSList *l = job->nodes;
-         BdrvChild *c = l->data;
-@@ -234,28 +232,12 @@ int block_job_add_bdrv(BlockJob *job, const char *name, BlockDriverState *bs,
-                        uint64_t perm, uint64_t shared_perm, Error **errp)
- {
-     BdrvChild *c;
--    AioContext *ctx = bdrv_get_aio_context(bs);
--    bool need_context_ops;
-     GLOBAL_STATE_CODE();
- 
-     bdrv_ref(bs);
- 
--    need_context_ops = ctx != job->job.aio_context;
--
--    if (need_context_ops) {
--        if (job->job.aio_context != qemu_get_aio_context()) {
--            aio_context_release(job->job.aio_context);
--        }
--        aio_context_acquire(ctx);
--    }
-     c = bdrv_root_attach_child(bs, name, &child_job, 0, perm, shared_perm, job,
-                                errp);
--    if (need_context_ops) {
--        aio_context_release(ctx);
--        if (job->job.aio_context != qemu_get_aio_context()) {
--            aio_context_acquire(job->job.aio_context);
--        }
--    }
-     if (c == NULL) {
-         return -EPERM;
-     }
-diff --git a/hw/block/dataplane/virtio-blk.c b/hw/block/dataplane/virtio-blk.c
-index f83bb0f116..7bbbd981ad 100644
---- a/hw/block/dataplane/virtio-blk.c
-+++ b/hw/block/dataplane/virtio-blk.c
-@@ -124,7 +124,6 @@ int virtio_blk_data_plane_start(VirtIODevice *vdev)
-     VirtIOBlockDataPlane *s = vblk->dataplane;
-     BusState *qbus = BUS(qdev_get_parent_bus(DEVICE(vblk)));
-     VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(qbus);
--    AioContext *old_context;
-     unsigned i;
-     unsigned nvqs = s->conf->num_queues;
-     Error *local_err = NULL;
-@@ -178,10 +177,7 @@ int virtio_blk_data_plane_start(VirtIODevice *vdev)
- 
-     trace_virtio_blk_data_plane_start(s);
- 
--    old_context = blk_get_aio_context(s->conf->conf.blk);
--    aio_context_acquire(old_context);
-     r = blk_set_aio_context(s->conf->conf.blk, s->ctx, &local_err);
--    aio_context_release(old_context);
-     if (r < 0) {
-         error_report_err(local_err);
-         goto fail_aio_context;
-@@ -208,13 +204,11 @@ int virtio_blk_data_plane_start(VirtIODevice *vdev)
- 
-     /* Get this show started by hooking up our callbacks */
-     if (!blk_in_drain(s->conf->conf.blk)) {
--        aio_context_acquire(s->ctx);
-         for (i = 0; i < nvqs; i++) {
-             VirtQueue *vq = virtio_get_queue(s->vdev, i);
- 
-             virtio_queue_aio_attach_host_notifier(vq, s->ctx);
-         }
--        aio_context_release(s->ctx);
-     }
-     return 0;
- 
-@@ -314,8 +308,6 @@ void virtio_blk_data_plane_stop(VirtIODevice *vdev)
-      */
-     vblk->dataplane_started = false;
- 
--    aio_context_acquire(s->ctx);
--
-     /* Wait for virtio_blk_dma_restart_bh() and in flight I/O to complete */
-     blk_drain(s->conf->conf.blk);
- 
-@@ -325,8 +317,6 @@ void virtio_blk_data_plane_stop(VirtIODevice *vdev)
-      */
-     blk_set_aio_context(s->conf->conf.blk, qemu_get_aio_context(), NULL);
- 
--    aio_context_release(s->ctx);
--
-     /* Clean up guest notifier (irq) */
-     k->set_guest_notifiers(qbus->parent, nvqs, false);
- 
-diff --git a/hw/block/dataplane/xen-block.c b/hw/block/dataplane/xen-block.c
-index c4bb28c66f..98501e6885 100644
---- a/hw/block/dataplane/xen-block.c
-+++ b/hw/block/dataplane/xen-block.c
-@@ -260,8 +260,6 @@ static void xen_block_complete_aio(void *opaque, int ret)
-     XenBlockRequest *request = opaque;
-     XenBlockDataPlane *dataplane = request->dataplane;
- 
--    aio_context_acquire(dataplane->ctx);
--
-     if (ret != 0) {
-         error_report("%s I/O error",
-                      request->req.operation == BLKIF_OP_READ ?
-@@ -273,10 +271,10 @@ static void xen_block_complete_aio(void *opaque, int ret)
-     if (request->presync) {
-         request->presync = 0;
-         xen_block_do_aio(request);
--        goto done;
-+        return;
-     }
-     if (request->aio_inflight > 0) {
--        goto done;
-+        return;
-     }
- 
-     switch (request->req.operation) {
-@@ -318,9 +316,6 @@ static void xen_block_complete_aio(void *opaque, int ret)
-     if (dataplane->more_work) {
-         qemu_bh_schedule(dataplane->bh);
-     }
--
--done:
--    aio_context_release(dataplane->ctx);
- }
- 
- static bool xen_block_split_discard(XenBlockRequest *request,
-@@ -601,9 +596,7 @@ static void xen_block_dataplane_bh(void *opaque)
- {
-     XenBlockDataPlane *dataplane = opaque;
- 
--    aio_context_acquire(dataplane->ctx);
-     xen_block_handle_requests(dataplane);
--    aio_context_release(dataplane->ctx);
- }
- 
- static bool xen_block_dataplane_event(void *opaque)
-@@ -703,10 +696,8 @@ void xen_block_dataplane_stop(XenBlockDataPlane *dataplane)
-         xen_block_dataplane_detach(dataplane);
-     }
- 
--    aio_context_acquire(dataplane->ctx);
-     /* Xen doesn't have multiple users for nodes, so this can't fail */
-     blk_set_aio_context(dataplane->blk, qemu_get_aio_context(), &error_abort);
--    aio_context_release(dataplane->ctx);
- 
-     /*
-      * Now that the context has been moved onto the main thread, cancel
-@@ -752,7 +743,6 @@ void xen_block_dataplane_start(XenBlockDataPlane *dataplane,
- {
-     ERRP_GUARD();
-     XenDevice *xendev = dataplane->xendev;
--    AioContext *old_context;
-     unsigned int ring_size;
-     unsigned int i;
- 
-@@ -836,11 +826,8 @@ void xen_block_dataplane_start(XenBlockDataPlane *dataplane,
-         goto stop;
-     }
- 
--    old_context = blk_get_aio_context(dataplane->blk);
--    aio_context_acquire(old_context);
-     /* If other users keep the BlockBackend in the iothread, that's ok */
-     blk_set_aio_context(dataplane->blk, dataplane->ctx, NULL);
--    aio_context_release(old_context);
- 
-     if (!blk_in_drain(dataplane->blk)) {
-         xen_block_dataplane_attach(dataplane);
-diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
-index e110f9718b..ec9ed09a6a 100644
---- a/hw/block/virtio-blk.c
-+++ b/hw/block/virtio-blk.c
-@@ -1210,17 +1210,13 @@ static void virtio_blk_dma_restart_cb(void *opaque, bool running,
- static void virtio_blk_reset(VirtIODevice *vdev)
- {
-     VirtIOBlock *s = VIRTIO_BLK(vdev);
--    AioContext *ctx;
-     VirtIOBlockReq *req;
- 
-     /* Dataplane has stopped... */
-     assert(!s->dataplane_started);
- 
-     /* ...but requests may still be in flight. */
--    ctx = blk_get_aio_context(s->blk);
--    aio_context_acquire(ctx);
-     blk_drain(s->blk);
--    aio_context_release(ctx);
- 
-     /* We drop queued requests after blk_drain() because blk_drain() itself can
-      * produce them. */
-@@ -1250,10 +1246,6 @@ static void virtio_blk_update_config(VirtIODevice *vdev, uint8_t *config)
-     uint64_t capacity;
-     int64_t length;
-     int blk_size = conf->logical_block_size;
--    AioContext *ctx;
--
--    ctx = blk_get_aio_context(s->blk);
--    aio_context_acquire(ctx);
- 
-     blk_get_geometry(s->blk, &capacity);
-     memset(&blkcfg, 0, sizeof(blkcfg));
-@@ -1277,7 +1269,6 @@ static void virtio_blk_update_config(VirtIODevice *vdev, uint8_t *config)
-      * per track (cylinder).
-      */
-     length = blk_getlength(s->blk);
--    aio_context_release(ctx);
-     if (length > 0 && length / conf->heads / conf->secs % blk_size) {
-         blkcfg.geometry.sectors = conf->secs & ~s->sector_mask;
-     } else {
-@@ -1344,9 +1335,7 @@ static void virtio_blk_set_config(VirtIODevice *vdev, const uint8_t *config)
- 
-     memcpy(&blkcfg, config, s->config_size);
- 
--    aio_context_acquire(blk_get_aio_context(s->blk));
-     blk_set_enable_write_cache(s->blk, blkcfg.wce != 0);
--    aio_context_release(blk_get_aio_context(s->blk));
- }
- 
- static uint64_t virtio_blk_get_features(VirtIODevice *vdev, uint64_t features,
-@@ -1414,11 +1403,9 @@ static void virtio_blk_set_status(VirtIODevice *vdev, uint8_t status)
-      * s->blk would erroneously be placed in writethrough mode.
-      */
-     if (!virtio_vdev_has_feature(vdev, VIRTIO_BLK_F_CONFIG_WCE)) {
--        aio_context_acquire(blk_get_aio_context(s->blk));
-         blk_set_enable_write_cache(s->blk,
-                                    virtio_vdev_has_feature(vdev,
-                                                            VIRTIO_BLK_F_WCE));
--        aio_context_release(blk_get_aio_context(s->blk));
-     }
- }
- 
-diff --git a/hw/core/qdev-properties-system.c b/hw/core/qdev-properties-system.c
-index 1473ab3d5e..73cced4626 100644
---- a/hw/core/qdev-properties-system.c
-+++ b/hw/core/qdev-properties-system.c
-@@ -120,9 +120,7 @@ static void set_drive_helper(Object *obj, Visitor *v, const char *name,
-                        "node");
-         }
- 
--        aio_context_acquire(ctx);
-         blk_replace_bs(blk, bs, errp);
--        aio_context_release(ctx);
-         return;
-     }
- 
-@@ -148,10 +146,7 @@ static void set_drive_helper(Object *obj, Visitor *v, const char *name,
-                           0, BLK_PERM_ALL);
-             blk_created = true;
- 
--            aio_context_acquire(ctx);
-             ret = blk_insert_bs(blk, bs, errp);
--            aio_context_release(ctx);
--
-             if (ret < 0) {
-                 goto fail;
-             }
-@@ -207,12 +202,8 @@ static void release_drive(Object *obj, const char *name, void *opaque)
-     BlockBackend **ptr = object_field_prop_ptr(obj, prop);
- 
-     if (*ptr) {
--        AioContext *ctx = blk_get_aio_context(*ptr);
--
--        aio_context_acquire(ctx);
-         blockdev_auto_del(*ptr);
-         blk_detach_dev(*ptr, dev);
--        aio_context_release(ctx);
-     }
- }
- 
-diff --git a/include/block/block-global-state.h b/include/block/block-global-state.h
-index 6b21fbc73f..0327f1c605 100644
---- a/include/block/block-global-state.h
-+++ b/include/block/block-global-state.h
-@@ -31,11 +31,10 @@
- /*
-  * Global state (GS) API. These functions run under the BQL.
-  *
-- * If a function modifies the graph, it also uses drain and/or
-- * aio_context_acquire/release to be sure it has unique access.
-- * aio_context locking is needed together with BQL because of
-- * the thread-safe I/O API that concurrently runs and accesses
-- * the graph without the BQL.
-+ * If a function modifies the graph, it also uses the graph lock to be sure it
-+ * has unique access. The graph lock is needed together with BQL because of the
-+ * thread-safe I/O API that concurrently runs and accesses the graph without
-+ * the BQL.
-  *
-  * It is important to note that not all of these functions are
-  * necessarily limited to running under the BQL, but they would
-diff --git a/include/block/block-io.h b/include/block/block-io.h
-index f8729ccc55..8eb39a858b 100644
---- a/include/block/block-io.h
-+++ b/include/block/block-io.h
-@@ -31,8 +31,7 @@
- 
- /*
-  * I/O API functions. These functions are thread-safe, and therefore
-- * can run in any thread as long as the thread has called
-- * aio_context_acquire/release().
-+ * can run in any thread.
-  *
-  * These functions can only call functions from I/O and Common categories,
-  * but can be invoked by GS, "I/O or GS" and I/O APIs.
-diff --git a/include/block/snapshot.h b/include/block/snapshot.h
-index d49c5599d9..304cc6ea61 100644
---- a/include/block/snapshot.h
-+++ b/include/block/snapshot.h
-@@ -86,8 +86,6 @@ int bdrv_snapshot_load_tmp_by_id_or_name(BlockDriverState *bs,
- 
- /*
-  * Group operations. All block drivers are involved.
-- * These functions will properly handle dataplane (take aio_context_acquire
-- * when appropriate for appropriate block drivers
-  */
- 
- bool bdrv_all_can_snapshot(bool has_devices, strList *devices,
-diff --git a/job.c b/job.c
-index 99a2e54b54..660ce22c56 100644
---- a/job.c
-+++ b/job.c
-@@ -464,12 +464,8 @@ void job_unref_locked(Job *job)
-         assert(!job->txn);
- 
-         if (job->driver->free) {
--            AioContext *aio_context = job->aio_context;
-             job_unlock();
--            /* FIXME: aiocontext lock is required because cb calls blk_unref */
--            aio_context_acquire(aio_context);
-             job->driver->free(job);
--            aio_context_release(aio_context);
-             job_lock();
-         }
- 
-@@ -840,12 +836,10 @@ static void job_clean(Job *job)
- 
- /*
-  * Called with job_mutex held, but releases it temporarily.
-- * Takes AioContext lock internally to invoke a job->driver callback.
-  */
- static int job_finalize_single_locked(Job *job)
- {
-     int job_ret;
--    AioContext *ctx = job->aio_context;
- 
-     assert(job_is_completed_locked(job));
- 
-@@ -854,7 +848,6 @@ static int job_finalize_single_locked(Job *job)
- 
-     job_ret = job->ret;
-     job_unlock();
--    aio_context_acquire(ctx);
- 
-     if (!job_ret) {
-         job_commit(job);
-@@ -867,7 +860,6 @@ static int job_finalize_single_locked(Job *job)
-         job->cb(job->opaque, job_ret);
-     }
- 
--    aio_context_release(ctx);
-     job_lock();
- 
-     /* Emit events only if we actually started */
-@@ -886,17 +878,13 @@ static int job_finalize_single_locked(Job *job)
- 
- /*
-  * Called with job_mutex held, but releases it temporarily.
-- * Takes AioContext lock internally to invoke a job->driver callback.
-  */
- static void job_cancel_async_locked(Job *job, bool force)
- {
--    AioContext *ctx = job->aio_context;
-     GLOBAL_STATE_CODE();
-     if (job->driver->cancel) {
-         job_unlock();
--        aio_context_acquire(ctx);
-         force = job->driver->cancel(job, force);
--        aio_context_release(ctx);
-         job_lock();
-     } else {
-         /* No .cancel() means the job will behave as if force-cancelled */
-@@ -931,7 +919,6 @@ static void job_cancel_async_locked(Job *job, bool force)
- 
- /*
-  * Called with job_mutex held, but releases it temporarily.
-- * Takes AioContext lock internally to invoke a job->driver callback.
-  */
- static void job_completed_txn_abort_locked(Job *job)
- {
-@@ -979,15 +966,12 @@ static void job_completed_txn_abort_locked(Job *job)
- static int job_prepare_locked(Job *job)
- {
-     int ret;
--    AioContext *ctx = job->aio_context;
- 
-     GLOBAL_STATE_CODE();
- 
-     if (job->ret == 0 && job->driver->prepare) {
-         job_unlock();
--        aio_context_acquire(ctx);
-         ret = job->driver->prepare(job);
--        aio_context_release(ctx);
-         job_lock();
-         job->ret = ret;
-         job_update_rc_locked(job);
-diff --git a/migration/block.c b/migration/block.c
-index a15f9bddcb..6ec6a1d6e6 100644
---- a/migration/block.c
-+++ b/migration/block.c
-@@ -66,7 +66,7 @@ typedef struct BlkMigDevState {
-     /* Protected by block migration lock.  */
-     int64_t completed_sectors;
- 
--    /* During migration this is protected by iothread lock / AioContext.
-+    /* During migration this is protected by bdrv_dirty_bitmap_lock().
-      * Allocation and free happen during setup and cleanup respectively.
-      */
-     BdrvDirtyBitmap *dirty_bitmap;
-@@ -101,7 +101,7 @@ typedef struct BlkMigState {
-     int prev_progress;
-     int bulk_completed;
- 
--    /* Lock must be taken _inside_ the iothread lock and any AioContexts.  */
-+    /* Lock must be taken _inside_ the iothread lock.  */
-     QemuMutex lock;
- } BlkMigState;
- 
-@@ -270,7 +270,6 @@ static int mig_save_device_bulk(QEMUFile *f, BlkMigDevState *bmds)
- 
-     if (bmds->shared_base) {
-         qemu_mutex_lock_iothread();
--        aio_context_acquire(blk_get_aio_context(bb));
-         /* Skip unallocated sectors; intentionally treats failure or
-          * partial sector as an allocated sector */
-         while (cur_sector < total_sectors &&
-@@ -281,7 +280,6 @@ static int mig_save_device_bulk(QEMUFile *f, BlkMigDevState *bmds)
-             }
-             cur_sector += count >> BDRV_SECTOR_BITS;
-         }
--        aio_context_release(blk_get_aio_context(bb));
-         qemu_mutex_unlock_iothread();
-     }
- 
-@@ -313,21 +311,16 @@ static int mig_save_device_bulk(QEMUFile *f, BlkMigDevState *bmds)
-     block_mig_state.submitted++;
-     blk_mig_unlock();
- 
--    /* We do not know if bs is under the main thread (and thus does
--     * not acquire the AioContext when doing AIO) or rather under
--     * dataplane.  Thus acquire both the iothread mutex and the
--     * AioContext.
--     *
--     * This is ugly and will disappear when we make bdrv_* thread-safe,
--     * without the need to acquire the AioContext.
-+    /*
-+     * The migration thread does not have an AioContext. Lock the BQL so that
-+     * I/O runs in the main loop AioContext (see
-+     * qemu_get_current_aio_context()).
-      */
-     qemu_mutex_lock_iothread();
--    aio_context_acquire(blk_get_aio_context(bmds->blk));
-     bdrv_reset_dirty_bitmap(bmds->dirty_bitmap, cur_sector * BDRV_SECTOR_SIZE,
-                             nr_sectors * BDRV_SECTOR_SIZE);
-     blk->aiocb = blk_aio_preadv(bb, cur_sector * BDRV_SECTOR_SIZE, &blk->qiov,
-                                 0, blk_mig_read_cb, blk);
--    aio_context_release(blk_get_aio_context(bmds->blk));
-     qemu_mutex_unlock_iothread();
- 
-     bmds->cur_sector = cur_sector + nr_sectors;
-@@ -512,7 +505,7 @@ static void blk_mig_reset_dirty_cursor(void)
-     }
- }
- 
--/* Called with iothread lock and AioContext taken.  */
-+/* Called with iothread lock taken.  */
- 
- static int mig_save_device_dirty(QEMUFile *f, BlkMigDevState *bmds,
-                                  int is_async)
-@@ -606,9 +599,7 @@ static int blk_mig_save_dirty_block(QEMUFile *f, int is_async)
-     int ret = 1;
- 
-     QSIMPLEQ_FOREACH(bmds, &block_mig_state.bmds_list, entry) {
--        aio_context_acquire(blk_get_aio_context(bmds->blk));
-         ret = mig_save_device_dirty(f, bmds, is_async);
--        aio_context_release(blk_get_aio_context(bmds->blk));
-         if (ret <= 0) {
-             break;
-         }
-@@ -666,9 +657,9 @@ static int64_t get_remaining_dirty(void)
-     int64_t dirty = 0;
- 
-     QSIMPLEQ_FOREACH(bmds, &block_mig_state.bmds_list, entry) {
--        aio_context_acquire(blk_get_aio_context(bmds->blk));
-+        bdrv_dirty_bitmap_lock(bmds->dirty_bitmap);
-         dirty += bdrv_get_dirty_count(bmds->dirty_bitmap);
--        aio_context_release(blk_get_aio_context(bmds->blk));
-+        bdrv_dirty_bitmap_unlock(bmds->dirty_bitmap);
-     }
- 
-     return dirty;
-@@ -681,7 +672,6 @@ static void block_migration_cleanup_bmds(void)
- {
-     BlkMigDevState *bmds;
-     BlockDriverState *bs;
--    AioContext *ctx;
- 
-     unset_dirty_tracking();
- 
-@@ -693,13 +683,7 @@ static void block_migration_cleanup_bmds(void)
-             bdrv_op_unblock_all(bs, bmds->blocker);
-         }
-         error_free(bmds->blocker);
--
--        /* Save ctx, because bmds->blk can disappear during blk_unref.  */
--        ctx = blk_get_aio_context(bmds->blk);
--        aio_context_acquire(ctx);
-         blk_unref(bmds->blk);
--        aio_context_release(ctx);
--
-         g_free(bmds->blk_name);
-         g_free(bmds->aio_bitmap);
-         g_free(bmds);
-diff --git a/migration/migration-hmp-cmds.c b/migration/migration-hmp-cmds.c
-index 86ae832176..99710c8ffb 100644
---- a/migration/migration-hmp-cmds.c
-+++ b/migration/migration-hmp-cmds.c
-@@ -852,14 +852,11 @@ static void vm_completion(ReadLineState *rs, const char *str)
- 
-     for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {
-         SnapshotInfoList *snapshots, *snapshot;
--        AioContext *ctx = bdrv_get_aio_context(bs);
-         bool ok = false;
- 
--        aio_context_acquire(ctx);
-         if (bdrv_can_snapshot(bs)) {
-             ok = bdrv_query_snapshot_info_list(bs, &snapshots, NULL) == 0;
-         }
--        aio_context_release(ctx);
-         if (!ok) {
-             continue;
-         }
-diff --git a/migration/savevm.c b/migration/savevm.c
-index eec5503a42..1b9ab7b8ee 100644
---- a/migration/savevm.c
-+++ b/migration/savevm.c
-@@ -3049,7 +3049,6 @@ bool save_snapshot(const char *name, bool overwrite, const char *vmstate,
-     int saved_vm_running;
-     uint64_t vm_state_size;
-     g_autoptr(GDateTime) now = g_date_time_new_now_local();
--    AioContext *aio_context;
- 
-     GLOBAL_STATE_CODE();
- 
-@@ -3092,7 +3091,6 @@ bool save_snapshot(const char *name, bool overwrite, const char *vmstate,
-     if (bs == NULL) {
-         return false;
-     }
--    aio_context = bdrv_get_aio_context(bs);
- 
-     saved_vm_running = runstate_is_running();
- 
-@@ -3101,8 +3099,6 @@ bool save_snapshot(const char *name, bool overwrite, const char *vmstate,
- 
-     bdrv_drain_all_begin();
- 
--    aio_context_acquire(aio_context);
--
-     memset(sn, 0, sizeof(*sn));
- 
-     /* fill auxiliary fields */
-@@ -3139,14 +3135,6 @@ bool save_snapshot(const char *name, bool overwrite, const char *vmstate,
-         goto the_end;
-     }
- 
--    /* The bdrv_all_create_snapshot() call that follows acquires the AioContext
--     * for itself.  BDRV_POLL_WHILE() does not support nested locking because
--     * it only releases the lock once.  Therefore synchronous I/O will deadlock
--     * unless we release the AioContext before bdrv_all_create_snapshot().
--     */
--    aio_context_release(aio_context);
--    aio_context = NULL;
--
-     ret = bdrv_all_create_snapshot(sn, bs, vm_state_size,
-                                    has_devices, devices, errp);
-     if (ret < 0) {
-@@ -3157,10 +3145,6 @@ bool save_snapshot(const char *name, bool overwrite, const char *vmstate,
-     ret = 0;
- 
-  the_end:
--    if (aio_context) {
--        aio_context_release(aio_context);
--    }
--
-     bdrv_drain_all_end();
- 
-     if (saved_vm_running) {
-@@ -3258,7 +3242,6 @@ bool load_snapshot(const char *name, const char *vmstate,
-     QEMUSnapshotInfo sn;
-     QEMUFile *f;
-     int ret;
--    AioContext *aio_context;
-     MigrationIncomingState *mis = migration_incoming_get_current();
- 
-     if (!bdrv_all_can_snapshot(has_devices, devices, errp)) {
-@@ -3278,12 +3261,9 @@ bool load_snapshot(const char *name, const char *vmstate,
-     if (!bs_vm_state) {
-         return false;
-     }
--    aio_context = bdrv_get_aio_context(bs_vm_state);
- 
-     /* Don't even try to load empty VM states */
--    aio_context_acquire(aio_context);
-     ret = bdrv_snapshot_find(bs_vm_state, &sn, name);
--    aio_context_release(aio_context);
-     if (ret < 0) {
-         return false;
-     } else if (sn.vm_state_size == 0) {
-@@ -3320,10 +3300,8 @@ bool load_snapshot(const char *name, const char *vmstate,
-         ret = -EINVAL;
-         goto err_drain;
-     }
--    aio_context_acquire(aio_context);
-     ret = qemu_loadvm_state(f);
-     migration_incoming_state_destroy();
--    aio_context_release(aio_context);
- 
-     bdrv_drain_all_end();
- 
-diff --git a/net/colo-compare.c b/net/colo-compare.c
-index 7f9e6f89ce..f2dfc0ebdc 100644
---- a/net/colo-compare.c
-+++ b/net/colo-compare.c
-@@ -1439,12 +1439,10 @@ static void colo_compare_finalize(Object *obj)
-     qemu_bh_delete(s->event_bh);
- 
-     AioContext *ctx = iothread_get_aio_context(s->iothread);
--    aio_context_acquire(ctx);
-     AIO_WAIT_WHILE(ctx, !s->out_sendco.done);
-     if (s->notify_dev) {
-         AIO_WAIT_WHILE(ctx, !s->notify_sendco.done);
-     }
--    aio_context_release(ctx);
- 
-     /* Release all unhandled packets after compare thead exited */
-     g_queue_foreach(&s->conn_list, colo_flush_packets, s);
-diff --git a/qemu-img.c b/qemu-img.c
-index 5a77f67719..7668f86769 100644
---- a/qemu-img.c
-+++ b/qemu-img.c
-@@ -960,7 +960,6 @@ static int img_commit(int argc, char **argv)
-     Error *local_err = NULL;
-     CommonBlockJobCBInfo cbi;
-     bool image_opts = false;
--    AioContext *aio_context;
-     int64_t rate_limit = 0;
- 
-     fmt = NULL;
-@@ -1078,12 +1077,9 @@ static int img_commit(int argc, char **argv)
-         .bs   = bs,
-     };
- 
--    aio_context = bdrv_get_aio_context(bs);
--    aio_context_acquire(aio_context);
-     commit_active_start("commit", bs, base_bs, JOB_DEFAULT, rate_limit,
-                         BLOCKDEV_ON_ERROR_REPORT, NULL, common_block_job_cb,
-                         &cbi, false, &local_err);
--    aio_context_release(aio_context);
-     if (local_err) {
-         goto done;
-     }
-diff --git a/qemu-io.c b/qemu-io.c
-index 050c70835f..6cb1e00385 100644
---- a/qemu-io.c
-+++ b/qemu-io.c
-@@ -414,15 +414,7 @@ static void prep_fetchline(void *opaque)
- 
- static int do_qemuio_command(const char *cmd)
- {
--    int ret;
--    AioContext *ctx =
--        qemuio_blk ? blk_get_aio_context(qemuio_blk) : qemu_get_aio_context();
--
--    aio_context_acquire(ctx);
--    ret = qemuio_command(qemuio_blk, cmd);
--    aio_context_release(ctx);
--
--    return ret;
-+    return qemuio_command(qemuio_blk, cmd);
- }
- 
- static int command_loop(void)
-diff --git a/qemu-nbd.c b/qemu-nbd.c
-index 186e6468b1..bac0b5e3ec 100644
---- a/qemu-nbd.c
-+++ b/qemu-nbd.c
-@@ -1123,9 +1123,7 @@ int main(int argc, char **argv)
-         qdict_put_str(raw_opts, "file", bs->node_name);
-         qdict_put_int(raw_opts, "offset", dev_offset);
- 
--        aio_context_acquire(qemu_get_aio_context());
-         bs = bdrv_open(NULL, NULL, raw_opts, flags, &error_fatal);
--        aio_context_release(qemu_get_aio_context());
- 
-         blk_remove_bs(blk);
-         blk_insert_bs(blk, bs, &error_fatal);
-diff --git a/replay/replay-debugging.c b/replay/replay-debugging.c
-index 3e60549a4a..82c66fff26 100644
---- a/replay/replay-debugging.c
-+++ b/replay/replay-debugging.c
-@@ -144,7 +144,6 @@ static char *replay_find_nearest_snapshot(int64_t icount,
-     char *ret = NULL;
-     int rv;
-     int nb_sns, i;
--    AioContext *aio_context;
- 
-     *snapshot_icount = -1;
- 
-@@ -152,11 +151,8 @@ static char *replay_find_nearest_snapshot(int64_t icount,
-     if (!bs) {
-         goto fail;
-     }
--    aio_context = bdrv_get_aio_context(bs);
- 
--    aio_context_acquire(aio_context);
-     nb_sns = bdrv_snapshot_list(bs, &sn_tab);
--    aio_context_release(aio_context);
- 
-     for (i = 0; i < nb_sns; i++) {
-         rv = bdrv_all_has_snapshot(sn_tab[i].name, false, NULL, NULL);
-diff --git a/scripts/block-coroutine-wrapper.py b/scripts/block-coroutine-wrapper.py
-index 38364fa557..c9c09fcacd 100644
---- a/scripts/block-coroutine-wrapper.py
-+++ b/scripts/block-coroutine-wrapper.py
-@@ -278,12 +278,9 @@ def gen_no_co_wrapper(func: FuncDecl) -> str:
- static void {name}_bh(void *opaque)
- {{
-     {struct_name} *s = opaque;
--    AioContext *ctx = {func.gen_ctx('s->')};
- 
- {graph_lock}
--    aio_context_acquire(ctx);
-     {func.get_result}{name}({ func.gen_list('s->{name}') });
--    aio_context_release(ctx);
- {graph_unlock}
- 
-     aio_co_wake(s->co);
-diff --git a/tests/tsan/suppressions.tsan b/tests/tsan/suppressions.tsan
-index d9a002a2ef..b3ef59c27c 100644
---- a/tests/tsan/suppressions.tsan
-+++ b/tests/tsan/suppressions.tsan
-@@ -4,7 +4,6 @@
- 
- # TSan reports a double lock on RECURSIVE mutexes.
- # Since the recursive lock is intentional, we choose to ignore it.
--mutex:aio_context_acquire
- mutex:pthread_mutex_lock
- 
- # TSan reports a race between pthread_mutex_init() and
-diff --git a/tests/unit/test-bdrv-drain.c b/tests/unit/test-bdrv-drain.c
-index d9754dfebc..17830a69c1 100644
---- a/tests/unit/test-bdrv-drain.c
-+++ b/tests/unit/test-bdrv-drain.c
-@@ -179,13 +179,7 @@ static void do_drain_end(enum drain_type drain_type, BlockDriverState *bs)
- 
- static void do_drain_begin_unlocked(enum drain_type drain_type, BlockDriverState *bs)
- {
--    if (drain_type != BDRV_DRAIN_ALL) {
--        aio_context_acquire(bdrv_get_aio_context(bs));
--    }
-     do_drain_begin(drain_type, bs);
--    if (drain_type != BDRV_DRAIN_ALL) {
--        aio_context_release(bdrv_get_aio_context(bs));
--    }
- }
- 
- static BlockBackend * no_coroutine_fn test_setup(void)
-@@ -209,13 +203,7 @@ static BlockBackend * no_coroutine_fn test_setup(void)
- 
- static void do_drain_end_unlocked(enum drain_type drain_type, BlockDriverState *bs)
- {
--    if (drain_type != BDRV_DRAIN_ALL) {
--        aio_context_acquire(bdrv_get_aio_context(bs));
--    }
-     do_drain_end(drain_type, bs);
--    if (drain_type != BDRV_DRAIN_ALL) {
--        aio_context_release(bdrv_get_aio_context(bs));
--    }
- }
- 
- /*
-@@ -520,12 +508,8 @@ static void test_iothread_main_thread_bh(void *opaque)
- {
-     struct test_iothread_data *data = opaque;
- 
--    /* Test that the AioContext is not yet locked in a random BH that is
--     * executed during drain, otherwise this would deadlock. */
--    aio_context_acquire(bdrv_get_aio_context(data->bs));
-     bdrv_flush(data->bs);
-     bdrv_dec_in_flight(data->bs); /* incremented by test_iothread_common() */
--    aio_context_release(bdrv_get_aio_context(data->bs));
- }
- 
- /*
-@@ -567,7 +551,6 @@ static void test_iothread_common(enum drain_type drain_type, int drain_thread)
-     blk_set_disable_request_queuing(blk, true);
- 
-     blk_set_aio_context(blk, ctx_a, &error_abort);
--    aio_context_acquire(ctx_a);
- 
-     s->bh_indirection_ctx = ctx_b;
- 
-@@ -582,8 +565,6 @@ static void test_iothread_common(enum drain_type drain_type, int drain_thread)
-     g_assert(acb != NULL);
-     g_assert_cmpint(aio_ret, ==, -EINPROGRESS);
- 
--    aio_context_release(ctx_a);
--
-     data = (struct test_iothread_data) {
-         .bs         = bs,
-         .drain_type = drain_type,
-@@ -592,10 +573,6 @@ static void test_iothread_common(enum drain_type drain_type, int drain_thread)
- 
-     switch (drain_thread) {
-     case 0:
--        if (drain_type != BDRV_DRAIN_ALL) {
--            aio_context_acquire(ctx_a);
--        }
--
-         /*
-          * Increment in_flight so that do_drain_begin() waits for
-          * test_iothread_main_thread_bh(). This prevents the race between
-@@ -613,20 +590,10 @@ static void test_iothread_common(enum drain_type drain_type, int drain_thread)
-         do_drain_begin(drain_type, bs);
-         g_assert_cmpint(bs->in_flight, ==, 0);
- 
--        if (drain_type != BDRV_DRAIN_ALL) {
--            aio_context_release(ctx_a);
--        }
-         qemu_event_wait(&done_event);
--        if (drain_type != BDRV_DRAIN_ALL) {
--            aio_context_acquire(ctx_a);
--        }
- 
-         g_assert_cmpint(aio_ret, ==, 0);
-         do_drain_end(drain_type, bs);
--
--        if (drain_type != BDRV_DRAIN_ALL) {
--            aio_context_release(ctx_a);
--        }
-         break;
-     case 1:
-         co = qemu_coroutine_create(test_iothread_drain_co_entry, &data);
-@@ -637,9 +604,7 @@ static void test_iothread_common(enum drain_type drain_type, int drain_thread)
-         g_assert_not_reached();
-     }
- 
--    aio_context_acquire(ctx_a);
-     blk_set_aio_context(blk, qemu_get_aio_context(), &error_abort);
--    aio_context_release(ctx_a);
- 
-     bdrv_unref(bs);
-     blk_unref(blk);
-@@ -757,7 +722,6 @@ static void test_blockjob_common_drain_node(enum drain_type drain_type,
-     BlockJob *job;
-     TestBlockJob *tjob;
-     IOThread *iothread = NULL;
--    AioContext *ctx;
-     int ret;
- 
-     src = bdrv_new_open_driver(&bdrv_test, "source", BDRV_O_RDWR,
-@@ -787,11 +751,11 @@ static void test_blockjob_common_drain_node(enum drain_type drain_type,
-     }
- 
-     if (use_iothread) {
-+        AioContext *ctx;
-+
-         iothread = iothread_new();
-         ctx = iothread_get_aio_context(iothread);
-         blk_set_aio_context(blk_src, ctx, &error_abort);
--    } else {
--        ctx = qemu_get_aio_context();
-     }
- 
-     target = bdrv_new_open_driver(&bdrv_test, "target", BDRV_O_RDWR,
-@@ -800,7 +764,6 @@ static void test_blockjob_common_drain_node(enum drain_type drain_type,
-     blk_insert_bs(blk_target, target, &error_abort);
-     blk_set_allow_aio_context_change(blk_target, true);
- 
--    aio_context_acquire(ctx);
-     tjob = block_job_create("job0", &test_job_driver, NULL, src,
-                             0, BLK_PERM_ALL,
-                             0, 0, NULL, NULL, &error_abort);
-@@ -821,7 +784,6 @@ static void test_blockjob_common_drain_node(enum drain_type drain_type,
-         tjob->prepare_ret = -EIO;
-         break;
-     }
--    aio_context_release(ctx);
- 
-     job_start(&job->job);
- 
-@@ -912,12 +874,10 @@ static void test_blockjob_common_drain_node(enum drain_type drain_type,
-     }
-     g_assert_cmpint(ret, ==, (result == TEST_JOB_SUCCESS ? 0 : -EIO));
- 
--    aio_context_acquire(ctx);
-     if (use_iothread) {
-         blk_set_aio_context(blk_src, qemu_get_aio_context(), &error_abort);
-         assert(blk_get_aio_context(blk_target) == qemu_get_aio_context());
-     }
--    aio_context_release(ctx);
- 
-     blk_unref(blk_src);
-     blk_unref(blk_target);
-@@ -1401,9 +1361,7 @@ static void test_append_to_drained(void)
-     g_assert_cmpint(base_s->drain_count, ==, 1);
-     g_assert_cmpint(base->in_flight, ==, 0);
- 
--    aio_context_acquire(qemu_get_aio_context());
-     bdrv_append(overlay, base, &error_abort);
--    aio_context_release(qemu_get_aio_context());
- 
-     g_assert_cmpint(base->in_flight, ==, 0);
-     g_assert_cmpint(overlay->in_flight, ==, 0);
-@@ -1438,16 +1396,11 @@ static void test_set_aio_context(void)
- 
-     bdrv_drained_begin(bs);
-     bdrv_try_change_aio_context(bs, ctx_a, NULL, &error_abort);
--
--    aio_context_acquire(ctx_a);
-     bdrv_drained_end(bs);
- 
-     bdrv_drained_begin(bs);
-     bdrv_try_change_aio_context(bs, ctx_b, NULL, &error_abort);
--    aio_context_release(ctx_a);
--    aio_context_acquire(ctx_b);
-     bdrv_try_change_aio_context(bs, qemu_get_aio_context(), NULL, &error_abort);
--    aio_context_release(ctx_b);
-     bdrv_drained_end(bs);
- 
-     bdrv_unref(bs);
-diff --git a/tests/unit/test-bdrv-graph-mod.c b/tests/unit/test-bdrv-graph-mod.c
-index 8ee6ef38d8..cafc023db4 100644
---- a/tests/unit/test-bdrv-graph-mod.c
-+++ b/tests/unit/test-bdrv-graph-mod.c
-@@ -142,10 +142,8 @@ static void test_update_perm_tree(void)
-                       BDRV_CHILD_DATA, &error_abort);
-     bdrv_graph_wrunlock();
- 
--    aio_context_acquire(qemu_get_aio_context());
-     ret = bdrv_append(filter, bs, NULL);
-     g_assert_cmpint(ret, <, 0);
--    aio_context_release(qemu_get_aio_context());
- 
-     bdrv_unref(filter);
-     blk_unref(root);
-@@ -211,9 +209,7 @@ static void test_should_update_child(void)
-     bdrv_attach_child(filter, target, "target", &child_of_bds,
-                       BDRV_CHILD_DATA, &error_abort);
-     bdrv_graph_wrunlock();
--    aio_context_acquire(qemu_get_aio_context());
-     bdrv_append(filter, bs, &error_abort);
--    aio_context_release(qemu_get_aio_context());
- 
-     bdrv_graph_rdlock_main_loop();
-     g_assert(target->backing->bs == bs);
-@@ -440,9 +436,7 @@ static void test_append_greedy_filter(void)
-                       &error_abort);
-     bdrv_graph_wrunlock();
- 
--    aio_context_acquire(qemu_get_aio_context());
-     bdrv_append(fl, base, &error_abort);
--    aio_context_release(qemu_get_aio_context());
-     bdrv_unref(fl);
-     bdrv_unref(top);
- }
-diff --git a/tests/unit/test-block-iothread.c b/tests/unit/test-block-iothread.c
-index 9b15d2768c..3766d5de6b 100644
---- a/tests/unit/test-block-iothread.c
-+++ b/tests/unit/test-block-iothread.c
-@@ -483,7 +483,6 @@ static void test_sync_op(const void *opaque)
-     bdrv_graph_rdunlock_main_loop();
- 
-     blk_set_aio_context(blk, ctx, &error_abort);
--    aio_context_acquire(ctx);
-     if (t->fn) {
-         t->fn(c);
-     }
-@@ -491,7 +490,6 @@ static void test_sync_op(const void *opaque)
-         t->blkfn(blk);
-     }
-     blk_set_aio_context(blk, qemu_get_aio_context(), &error_abort);
--    aio_context_release(ctx);
- 
-     bdrv_unref(bs);
-     blk_unref(blk);
-@@ -576,9 +574,7 @@ static void test_attach_blockjob(void)
-         aio_poll(qemu_get_aio_context(), false);
-     }
- 
--    aio_context_acquire(ctx);
-     blk_set_aio_context(blk, qemu_get_aio_context(), &error_abort);
--    aio_context_release(ctx);
- 
-     tjob->n = 0;
-     while (tjob->n == 0) {
-@@ -595,9 +591,7 @@ static void test_attach_blockjob(void)
-     WITH_JOB_LOCK_GUARD() {
-         job_complete_sync_locked(&tjob->common.job, &error_abort);
-     }
--    aio_context_acquire(ctx);
-     blk_set_aio_context(blk, qemu_get_aio_context(), &error_abort);
--    aio_context_release(ctx);
- 
-     bdrv_unref(bs);
-     blk_unref(blk);
-@@ -654,9 +648,7 @@ static void test_propagate_basic(void)
- 
-     /* Switch the AioContext back */
-     main_ctx = qemu_get_aio_context();
--    aio_context_acquire(ctx);
-     blk_set_aio_context(blk, main_ctx, &error_abort);
--    aio_context_release(ctx);
-     g_assert(blk_get_aio_context(blk) == main_ctx);
-     g_assert(bdrv_get_aio_context(bs_a) == main_ctx);
-     g_assert(bdrv_get_aio_context(bs_verify) == main_ctx);
-@@ -732,9 +724,7 @@ static void test_propagate_diamond(void)
- 
-     /* Switch the AioContext back */
-     main_ctx = qemu_get_aio_context();
--    aio_context_acquire(ctx);
-     blk_set_aio_context(blk, main_ctx, &error_abort);
--    aio_context_release(ctx);
-     g_assert(blk_get_aio_context(blk) == main_ctx);
-     g_assert(bdrv_get_aio_context(bs_verify) == main_ctx);
-     g_assert(bdrv_get_aio_context(bs_a) == main_ctx);
-@@ -764,13 +754,11 @@ static void test_propagate_mirror(void)
-                                   &error_abort);
- 
-     /* Start a mirror job */
--    aio_context_acquire(main_ctx);
-     mirror_start("job0", src, target, NULL, JOB_DEFAULT, 0, 0, 0,
-                  MIRROR_SYNC_MODE_NONE, MIRROR_OPEN_BACKING_CHAIN, false,
-                  BLOCKDEV_ON_ERROR_REPORT, BLOCKDEV_ON_ERROR_REPORT,
-                  false, "filter_node", MIRROR_COPY_MODE_BACKGROUND,
-                  &error_abort);
--    aio_context_release(main_ctx);
- 
-     WITH_JOB_LOCK_GUARD() {
-         job = job_get_locked("job0");
-@@ -785,9 +773,7 @@ static void test_propagate_mirror(void)
-     g_assert(job->aio_context == ctx);
- 
-     /* Change the AioContext of target */
--    aio_context_acquire(ctx);
-     bdrv_try_change_aio_context(target, main_ctx, NULL, &error_abort);
--    aio_context_release(ctx);
-     g_assert(bdrv_get_aio_context(src) == main_ctx);
-     g_assert(bdrv_get_aio_context(target) == main_ctx);
-     g_assert(bdrv_get_aio_context(filter) == main_ctx);
-@@ -805,10 +791,8 @@ static void test_propagate_mirror(void)
-     g_assert(bdrv_get_aio_context(filter) == main_ctx);
- 
-     /* ...unless we explicitly allow it */
--    aio_context_acquire(ctx);
-     blk_set_allow_aio_context_change(blk, true);
-     bdrv_try_change_aio_context(target, ctx, NULL, &error_abort);
--    aio_context_release(ctx);
- 
-     g_assert(blk_get_aio_context(blk) == ctx);
-     g_assert(bdrv_get_aio_context(src) == ctx);
-@@ -817,10 +801,8 @@ static void test_propagate_mirror(void)
- 
-     job_cancel_sync_all();
- 
--    aio_context_acquire(ctx);
-     blk_set_aio_context(blk, main_ctx, &error_abort);
-     bdrv_try_change_aio_context(target, main_ctx, NULL, &error_abort);
--    aio_context_release(ctx);
- 
-     blk_unref(blk);
-     bdrv_unref(src);
-@@ -836,7 +818,6 @@ static void test_attach_second_node(void)
-     BlockDriverState *bs, *filter;
-     QDict *options;
- 
--    aio_context_acquire(main_ctx);
-     blk = blk_new(ctx, BLK_PERM_ALL, BLK_PERM_ALL);
-     bs = bdrv_new_open_driver(&bdrv_test, "base", BDRV_O_RDWR, &error_abort);
-     blk_insert_bs(blk, bs, &error_abort);
-@@ -846,15 +827,12 @@ static void test_attach_second_node(void)
-     qdict_put_str(options, "file", "base");
- 
-     filter = bdrv_open(NULL, NULL, options, BDRV_O_RDWR, &error_abort);
--    aio_context_release(main_ctx);
- 
-     g_assert(blk_get_aio_context(blk) == ctx);
-     g_assert(bdrv_get_aio_context(bs) == ctx);
-     g_assert(bdrv_get_aio_context(filter) == ctx);
- 
--    aio_context_acquire(ctx);
-     blk_set_aio_context(blk, main_ctx, &error_abort);
--    aio_context_release(ctx);
-     g_assert(blk_get_aio_context(blk) == main_ctx);
-     g_assert(bdrv_get_aio_context(bs) == main_ctx);
-     g_assert(bdrv_get_aio_context(filter) == main_ctx);
-@@ -868,11 +846,9 @@ static void test_attach_preserve_blk_ctx(void)
- {
-     IOThread *iothread = iothread_new();
-     AioContext *ctx = iothread_get_aio_context(iothread);
--    AioContext *main_ctx = qemu_get_aio_context();
-     BlockBackend *blk;
-     BlockDriverState *bs;
- 
--    aio_context_acquire(main_ctx);
-     blk = blk_new(ctx, BLK_PERM_ALL, BLK_PERM_ALL);
-     bs = bdrv_new_open_driver(&bdrv_test, "base", BDRV_O_RDWR, &error_abort);
-     bs->total_sectors = 65536 / BDRV_SECTOR_SIZE;
-@@ -881,25 +857,18 @@ static void test_attach_preserve_blk_ctx(void)
-     blk_insert_bs(blk, bs, &error_abort);
-     g_assert(blk_get_aio_context(blk) == ctx);
-     g_assert(bdrv_get_aio_context(bs) == ctx);
--    aio_context_release(main_ctx);
- 
-     /* Remove the node again */
--    aio_context_acquire(ctx);
-     blk_remove_bs(blk);
--    aio_context_release(ctx);
-     g_assert(blk_get_aio_context(blk) == ctx);
-     g_assert(bdrv_get_aio_context(bs) == qemu_get_aio_context());
- 
-     /* Re-attach the node */
--    aio_context_acquire(main_ctx);
-     blk_insert_bs(blk, bs, &error_abort);
--    aio_context_release(main_ctx);
-     g_assert(blk_get_aio_context(blk) == ctx);
-     g_assert(bdrv_get_aio_context(bs) == ctx);
- 
--    aio_context_acquire(ctx);
-     blk_set_aio_context(blk, qemu_get_aio_context(), &error_abort);
--    aio_context_release(ctx);
-     bdrv_unref(bs);
-     blk_unref(blk);
- }
-diff --git a/tests/unit/test-blockjob.c b/tests/unit/test-blockjob.c
-index a130f6fefb..fe3e0d2d38 100644
---- a/tests/unit/test-blockjob.c
-+++ b/tests/unit/test-blockjob.c
-@@ -228,7 +228,6 @@ static void cancel_common(CancelJob *s)
-     BlockJob *job = &s->common;
-     BlockBackend *blk = s->blk;
-     JobStatus sts = job->job.status;
--    AioContext *ctx = job->job.aio_context;
- 
-     job_cancel_sync(&job->job, true);
-     WITH_JOB_LOCK_GUARD() {
-@@ -240,9 +239,7 @@ static void cancel_common(CancelJob *s)
-         job_unref_locked(&job->job);
-     }
- 
--    aio_context_acquire(ctx);
-     destroy_blk(blk);
--    aio_context_release(ctx);
- 
- }
- 
-@@ -391,132 +388,6 @@ static void test_cancel_concluded(void)
-     cancel_common(s);
- }
- 
--/* (See test_yielding_driver for the job description) */
--typedef struct YieldingJob {
--    BlockJob common;
--    bool should_complete;
--} YieldingJob;
--
--static void yielding_job_complete(Job *job, Error **errp)
--{
--    YieldingJob *s = container_of(job, YieldingJob, common.job);
--    s->should_complete = true;
--    job_enter(job);
--}
--
--static int coroutine_fn yielding_job_run(Job *job, Error **errp)
--{
--    YieldingJob *s = container_of(job, YieldingJob, common.job);
--
--    job_transition_to_ready(job);
--
--    while (!s->should_complete) {
--        job_yield(job);
--    }
--
--    return 0;
--}
--
--/*
-- * This job transitions immediately to the READY state, and then
-- * yields until it is to complete.
-- */
--static const BlockJobDriver test_yielding_driver = {
--    .job_driver = {
--        .instance_size  = sizeof(YieldingJob),
--        .free           = block_job_free,
--        .user_resume    = block_job_user_resume,
--        .run            = yielding_job_run,
--        .complete       = yielding_job_complete,
--    },
--};
--
--/*
-- * Test that job_complete_locked() works even on jobs that are in a paused
-- * state (i.e., STANDBY).
-- *
-- * To do this, run YieldingJob in an IO thread, get it into the READY
-- * state, then have a drained section.  Before ending the section,
-- * acquire the context so the job will not be entered and will thus
-- * remain on STANDBY.
-- *
-- * job_complete_locked() should still work without error.
-- *
-- * Note that on the QMP interface, it is impossible to lock an IO
-- * thread before a drained section ends.  In practice, the
-- * bdrv_drain_all_end() and the aio_context_acquire() will be
-- * reversed.  However, that makes for worse reproducibility here:
-- * Sometimes, the job would no longer be in STANDBY then but already
-- * be started.  We cannot prevent that, because the IO thread runs
-- * concurrently.  We can only prevent it by taking the lock before
-- * ending the drained section, so we do that.
-- *
-- * (You can reverse the order of operations and most of the time the
-- * test will pass, but sometimes the assert(status == STANDBY) will
-- * fail.)
-- */
--static void test_complete_in_standby(void)
--{
--    BlockBackend *blk;
--    IOThread *iothread;
--    AioContext *ctx;
--    Job *job;
--    BlockJob *bjob;
--
--    /* Create a test drive, move it to an IO thread */
--    blk = create_blk(NULL);
--    iothread = iothread_new();
--
--    ctx = iothread_get_aio_context(iothread);
--    blk_set_aio_context(blk, ctx, &error_abort);
--
--    /* Create our test job */
--    bjob = mk_job(blk, "job", &test_yielding_driver, true,
--                  JOB_MANUAL_FINALIZE | JOB_MANUAL_DISMISS);
--    job = &bjob->job;
--    assert_job_status_is(job, JOB_STATUS_CREATED);
--
--    /* Wait for the job to become READY */
--    job_start(job);
--    /*
--     * Here we are waiting for the status to change, so don't bother
--     * protecting the read every time.
--     */
--    AIO_WAIT_WHILE_UNLOCKED(ctx, job->status != JOB_STATUS_READY);
--
--    /* Begin the drained section, pausing the job */
--    bdrv_drain_all_begin();
--    assert_job_status_is(job, JOB_STATUS_STANDBY);
--
--    /* Lock the IO thread to prevent the job from being run */
--    aio_context_acquire(ctx);
--    /* This will schedule the job to resume it */
--    bdrv_drain_all_end();
--    aio_context_release(ctx);
--
--    WITH_JOB_LOCK_GUARD() {
--        /* But the job cannot run, so it will remain on standby */
--        assert(job->status == JOB_STATUS_STANDBY);
--
--        /* Even though the job is on standby, this should work */
--        job_complete_locked(job, &error_abort);
--
--        /* The test is done now, clean up. */
--        job_finish_sync_locked(job, NULL, &error_abort);
--        assert(job->status == JOB_STATUS_PENDING);
--
--        job_finalize_locked(job, &error_abort);
--        assert(job->status == JOB_STATUS_CONCLUDED);
--
--        job_dismiss_locked(&job, &error_abort);
--    }
--
--    aio_context_acquire(ctx);
--    destroy_blk(blk);
--    aio_context_release(ctx);
--    iothread_join(iothread);
--}
--
- int main(int argc, char **argv)
- {
-     qemu_init_main_loop(&error_abort);
-@@ -531,13 +402,5 @@ int main(int argc, char **argv)
-     g_test_add_func("/blockjob/cancel/standby", test_cancel_standby);
-     g_test_add_func("/blockjob/cancel/pending", test_cancel_pending);
-     g_test_add_func("/blockjob/cancel/concluded", test_cancel_concluded);
--
--    /*
--     * This test is flaky and sometimes fails in CI and otherwise:
--     * don't run unless user opts in via environment variable.
--     */
--    if (getenv("QEMU_TEST_FLAKY_TESTS")) {
--        g_test_add_func("/blockjob/complete_in_standby", test_complete_in_standby);
--    }
-     return g_test_run();
- }
-diff --git a/tests/unit/test-replication.c b/tests/unit/test-replication.c
-index afff908d77..5d2003b8ce 100644
---- a/tests/unit/test-replication.c
-+++ b/tests/unit/test-replication.c
-@@ -199,17 +199,13 @@ static BlockBackend *start_primary(void)
- static void teardown_primary(void)
- {
-     BlockBackend *blk;
--    AioContext *ctx;
- 
-     /* remove P_ID */
-     blk = blk_by_name(P_ID);
-     assert(blk);
- 
--    ctx = blk_get_aio_context(blk);
--    aio_context_acquire(ctx);
-     monitor_remove_blk(blk);
-     blk_unref(blk);
--    aio_context_release(ctx);
- }
- 
- static void test_primary_read(void)
-@@ -345,27 +341,20 @@ static void teardown_secondary(void)
- {
-     /* only need to destroy two BBs */
-     BlockBackend *blk;
--    AioContext *ctx;
- 
-     /* remove S_LOCAL_DISK_ID */
-     blk = blk_by_name(S_LOCAL_DISK_ID);
-     assert(blk);
- 
--    ctx = blk_get_aio_context(blk);
--    aio_context_acquire(ctx);
-     monitor_remove_blk(blk);
-     blk_unref(blk);
--    aio_context_release(ctx);
- 
-     /* remove S_ID */
-     blk = blk_by_name(S_ID);
-     assert(blk);
- 
--    ctx = blk_get_aio_context(blk);
--    aio_context_acquire(ctx);
-     monitor_remove_blk(blk);
-     blk_unref(blk);
--    aio_context_release(ctx);
- }
- 
- static void test_secondary_read(void)
-diff --git a/util/async.c b/util/async.c
-index 04ee83d220..dfd44ef612 100644
---- a/util/async.c
-+++ b/util/async.c
-@@ -562,12 +562,10 @@ static void co_schedule_bh_cb(void *opaque)
-         Coroutine *co = QSLIST_FIRST(&straight);
-         QSLIST_REMOVE_HEAD(&straight, co_scheduled_next);
-         trace_aio_co_schedule_bh_cb(ctx, co);
--        aio_context_acquire(ctx);
- 
-         /* Protected by write barrier in qemu_aio_coroutine_enter */
-         qatomic_set(&co->scheduled, NULL);
-         qemu_aio_coroutine_enter(ctx, co);
--        aio_context_release(ctx);
-     }
- }
- 
-@@ -707,9 +705,7 @@ void aio_co_enter(AioContext *ctx, Coroutine *co)
-         assert(self != co);
-         QSIMPLEQ_INSERT_TAIL(&self->co_queue_wakeup, co, co_queue_next);
-     } else {
--        aio_context_acquire(ctx);
-         qemu_aio_coroutine_enter(ctx, co);
--        aio_context_release(ctx);
-     }
- }
- 
-diff --git a/util/vhost-user-server.c b/util/vhost-user-server.c
-index a9a48fffb8..3bfb1ad3ec 100644
---- a/util/vhost-user-server.c
-+++ b/util/vhost-user-server.c
-@@ -360,10 +360,7 @@ static void vu_accept(QIONetListener *listener, QIOChannelSocket *sioc,
- 
-     qio_channel_set_follow_coroutine_ctx(server->ioc, true);
- 
--    /* Attaching the AioContext starts the vu_client_trip coroutine */
--    aio_context_acquire(server->ctx);
-     vhost_user_server_attach_aio_context(server, server->ctx);
--    aio_context_release(server->ctx);
- }
- 
- /* server->ctx acquired by caller */
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-block-remove-bdrv_co_lock.patch b/SOURCES/kvm-block-remove-bdrv_co_lock.patch
deleted file mode 100644
index b219c1c..0000000
--- a/SOURCES/kvm-block-remove-bdrv_co_lock.patch
+++ /dev/null
@@ -1,97 +0,0 @@
-From d0514c7d5d6cc1aa140119c95d5ea2c1591b01e9 Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Tue, 5 Dec 2023 13:20:04 -0500
-Subject: [PATCH 087/101] block: remove bdrv_co_lock()
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 214: Remove AioContext lock
-RH-Jira: RHEL-15965
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [18/26] a303f861ea5e84d8e89fd51e530fd0cb2da17b89 (kmwolf/centos-qemu-kvm)
-
-The bdrv_co_lock() and bdrv_co_unlock() functions are already no-ops.
-Remove them.
-
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20231205182011.1976568-8-stefanha@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- block.c                            | 10 ----------
- blockdev.c                         |  5 -----
- include/block/block-global-state.h | 14 --------------
- 3 files changed, 29 deletions(-)
-
-diff --git a/block.c b/block.c
-index 91ace5d2d5..434b7f4d72 100644
---- a/block.c
-+++ b/block.c
-@@ -7431,16 +7431,6 @@ void coroutine_fn bdrv_co_leave(BlockDriverState *bs, AioContext *old_ctx)
-     bdrv_dec_in_flight(bs);
- }
- 
--void coroutine_fn bdrv_co_lock(BlockDriverState *bs)
--{
--    /* TODO removed in next patch */
--}
--
--void coroutine_fn bdrv_co_unlock(BlockDriverState *bs)
--{
--    /* TODO removed in next patch */
--}
--
- static void bdrv_do_remove_aio_context_notifier(BdrvAioNotifier *ban)
- {
-     GLOBAL_STATE_CODE();
-diff --git a/blockdev.c b/blockdev.c
-index 5d8b3a23eb..3a5e7222ec 100644
---- a/blockdev.c
-+++ b/blockdev.c
-@@ -2264,18 +2264,13 @@ void coroutine_fn qmp_block_resize(const char *device, const char *node_name,
-         return;
-     }
- 
--    bdrv_co_lock(bs);
-     bdrv_drained_begin(bs);
--    bdrv_co_unlock(bs);
- 
-     old_ctx = bdrv_co_enter(bs);
-     blk_co_truncate(blk, size, false, PREALLOC_MODE_OFF, 0, errp);
-     bdrv_co_leave(bs, old_ctx);
- 
--    bdrv_co_lock(bs);
-     bdrv_drained_end(bs);
--    bdrv_co_unlock(bs);
--
-     blk_co_unref(blk);
- }
- 
-diff --git a/include/block/block-global-state.h b/include/block/block-global-state.h
-index 0327f1c605..4ec0b217f0 100644
---- a/include/block/block-global-state.h
-+++ b/include/block/block-global-state.h
-@@ -267,20 +267,6 @@ int bdrv_debug_remove_breakpoint(BlockDriverState *bs, const char *tag);
- int bdrv_debug_resume(BlockDriverState *bs, const char *tag);
- bool bdrv_debug_is_suspended(BlockDriverState *bs, const char *tag);
- 
--/**
-- * Locks the AioContext of @bs if it's not the current AioContext. This avoids
-- * double locking which could lead to deadlocks: This is a coroutine_fn, so we
-- * know we already own the lock of the current AioContext.
-- *
-- * May only be called in the main thread.
-- */
--void coroutine_fn bdrv_co_lock(BlockDriverState *bs);
--
--/**
-- * Unlocks the AioContext of @bs if it's not the current AioContext.
-- */
--void coroutine_fn bdrv_co_unlock(BlockDriverState *bs);
--
- bool bdrv_child_change_aio_context(BdrvChild *c, AioContext *ctx,
-                                    GHashTable *visited, Transaction *tran,
-                                    Error **errp);
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-block-remove-outdated-AioContext-locking-comments.patch b/SOURCES/kvm-block-remove-outdated-AioContext-locking-comments.patch
deleted file mode 100644
index d6670c1..0000000
--- a/SOURCES/kvm-block-remove-outdated-AioContext-locking-comments.patch
+++ /dev/null
@@ -1,411 +0,0 @@
-From dc4eb64185957a01948217814478abc450ce5f26 Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Tue, 5 Dec 2023 13:20:11 -0500
-Subject: [PATCH 094/101] block: remove outdated AioContext locking comments
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 214: Remove AioContext lock
-RH-Jira: RHEL-15965
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [25/26] 395e18fb40d28d4bc961acee1a00da7f60748076 (kmwolf/centos-qemu-kvm)
-
-The AioContext lock no longer exists.
-
-There is one noteworthy change:
-
-  - * More specifically, these functions use BDRV_POLL_WHILE(bs), which
-  - * requires the caller to be either in the main thread and hold
-  - * the BlockdriverState (bs) AioContext lock, or directly in the
-  - * home thread that runs the bs AioContext. Calling them from
-  - * another thread in another AioContext would cause deadlocks.
-  + * More specifically, these functions use BDRV_POLL_WHILE(bs), which requires
-  + * the caller to be either in the main thread or directly in the home thread
-  + * that runs the bs AioContext. Calling them from another thread in another
-  + * AioContext would cause deadlocks.
-
-I am not sure whether deadlocks are still possible. Maybe they have just
-moved to the fine-grained locks that have replaced the AioContext. Since
-I am not sure if the deadlocks are gone, I have kept the substance
-unchanged and just removed mention of the AioContext.
-
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Message-ID: <20231205182011.1976568-15-stefanha@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- block.c                              | 73 ++++++----------------------
- block/block-backend.c                |  8 ---
- block/export/vhost-user-blk-server.c |  4 --
- include/block/block-common.h         |  3 --
- include/block/block-io.h             |  9 ++--
- include/block/block_int-common.h     |  2 -
- tests/qemu-iotests/202               |  2 +-
- tests/qemu-iotests/203               |  3 +-
- 8 files changed, 22 insertions(+), 82 deletions(-)
-
-diff --git a/block.c b/block.c
-index 434b7f4d72..a097772238 100644
---- a/block.c
-+++ b/block.c
-@@ -1616,11 +1616,6 @@ out:
-     g_free(gen_node_name);
- }
- 
--/*
-- * The caller must always hold @bs AioContext lock, because this function calls
-- * bdrv_refresh_total_sectors() which polls when called from non-coroutine
-- * context.
-- */
- static int no_coroutine_fn GRAPH_UNLOCKED
- bdrv_open_driver(BlockDriverState *bs, BlockDriver *drv, const char *node_name,
-                  QDict *options, int open_flags, Error **errp)
-@@ -2901,7 +2896,7 @@ uint64_t bdrv_qapi_perm_to_blk_perm(BlockPermission qapi_perm)
-  * Replaces the node that a BdrvChild points to without updating permissions.
-  *
-  * If @new_bs is non-NULL, the parent of @child must already be drained through
-- * @child and the caller must hold the AioContext lock for @new_bs.
-+ * @child.
-  */
- static void GRAPH_WRLOCK
- bdrv_replace_child_noperm(BdrvChild *child, BlockDriverState *new_bs)
-@@ -3041,9 +3036,8 @@ static TransactionActionDrv bdrv_attach_child_common_drv = {
-  *
-  * Returns new created child.
-  *
-- * The caller must hold the AioContext lock for @child_bs. Both @parent_bs and
-- * @child_bs can move to a different AioContext in this function. Callers must
-- * make sure that their AioContext locking is still correct after this.
-+ * Both @parent_bs and @child_bs can move to a different AioContext in this
-+ * function.
-  */
- static BdrvChild * GRAPH_WRLOCK
- bdrv_attach_child_common(BlockDriverState *child_bs,
-@@ -3142,9 +3136,8 @@ bdrv_attach_child_common(BlockDriverState *child_bs,
- /*
-  * Function doesn't update permissions, caller is responsible for this.
-  *
-- * The caller must hold the AioContext lock for @child_bs. Both @parent_bs and
-- * @child_bs can move to a different AioContext in this function. Callers must
-- * make sure that their AioContext locking is still correct after this.
-+ * Both @parent_bs and @child_bs can move to a different AioContext in this
-+ * function.
-  *
-  * After calling this function, the transaction @tran may only be completed
-  * while holding a writer lock for the graph.
-@@ -3184,9 +3177,6 @@ bdrv_attach_child_noperm(BlockDriverState *parent_bs,
-  *
-  * On failure NULL is returned, errp is set and the reference to
-  * child_bs is also dropped.
-- *
-- * The caller must hold the AioContext lock @child_bs, but not that of @ctx
-- * (unless @child_bs is already in @ctx).
-  */
- BdrvChild *bdrv_root_attach_child(BlockDriverState *child_bs,
-                                   const char *child_name,
-@@ -3226,9 +3216,6 @@ out:
-  *
-  * On failure NULL is returned, errp is set and the reference to
-  * child_bs is also dropped.
-- *
-- * If @parent_bs and @child_bs are in different AioContexts, the caller must
-- * hold the AioContext lock for @child_bs, but not for @parent_bs.
-  */
- BdrvChild *bdrv_attach_child(BlockDriverState *parent_bs,
-                              BlockDriverState *child_bs,
-@@ -3418,9 +3405,8 @@ static BdrvChildRole bdrv_backing_role(BlockDriverState *bs)
-  *
-  * Function doesn't update permissions, caller is responsible for this.
-  *
-- * The caller must hold the AioContext lock for @child_bs. Both @parent_bs and
-- * @child_bs can move to a different AioContext in this function. Callers must
-- * make sure that their AioContext locking is still correct after this.
-+ * Both @parent_bs and @child_bs can move to a different AioContext in this
-+ * function.
-  *
-  * After calling this function, the transaction @tran may only be completed
-  * while holding a writer lock for the graph.
-@@ -3513,9 +3499,8 @@ out:
- }
- 
- /*
-- * The caller must hold the AioContext lock for @backing_hd. Both @bs and
-- * @backing_hd can move to a different AioContext in this function. Callers must
-- * make sure that their AioContext locking is still correct after this.
-+ * Both @bs and @backing_hd can move to a different AioContext in this
-+ * function.
-  *
-  * If a backing child is already present (i.e. we're detaching a node), that
-  * child node must be drained.
-@@ -3574,8 +3559,6 @@ int bdrv_set_backing_hd(BlockDriverState *bs, BlockDriverState *backing_hd,
-  * itself, all options starting with "${bdref_key}." are considered part of the
-  * BlockdevRef.
-  *
-- * The caller must hold the main AioContext lock.
-- *
-  * TODO Can this be unified with bdrv_open_image()?
-  */
- int bdrv_open_backing_file(BlockDriverState *bs, QDict *parent_options,
-@@ -3745,9 +3728,7 @@ done:
-  *
-  * The BlockdevRef will be removed from the options QDict.
-  *
-- * The caller must hold the lock of the main AioContext and no other AioContext.
-- * @parent can move to a different AioContext in this function. Callers must
-- * make sure that their AioContext locking is still correct after this.
-+ * @parent can move to a different AioContext in this function.
-  */
- BdrvChild *bdrv_open_child(const char *filename,
-                            QDict *options, const char *bdref_key,
-@@ -3778,9 +3759,7 @@ BdrvChild *bdrv_open_child(const char *filename,
- /*
-  * Wrapper on bdrv_open_child() for most popular case: open primary child of bs.
-  *
-- * The caller must hold the lock of the main AioContext and no other AioContext.
-- * @parent can move to a different AioContext in this function. Callers must
-- * make sure that their AioContext locking is still correct after this.
-+ * @parent can move to a different AioContext in this function.
-  */
- int bdrv_open_file_child(const char *filename,
-                          QDict *options, const char *bdref_key,
-@@ -3923,8 +3902,6 @@ out:
-  * The reference parameter may be used to specify an existing block device which
-  * should be opened. If specified, neither options nor a filename may be given,
-  * nor can an existing BDS be reused (that is, *pbs has to be NULL).
-- *
-- * The caller must always hold the main AioContext lock.
-  */
- static BlockDriverState * no_coroutine_fn
- bdrv_open_inherit(const char *filename, const char *reference, QDict *options,
-@@ -4217,7 +4194,6 @@ close_and_fail:
-     return NULL;
- }
- 
--/* The caller must always hold the main AioContext lock. */
- BlockDriverState *bdrv_open(const char *filename, const char *reference,
-                             QDict *options, int flags, Error **errp)
- {
-@@ -4665,10 +4641,7 @@ int bdrv_reopen_set_read_only(BlockDriverState *bs, bool read_only,
-  *
-  * Return 0 on success, otherwise return < 0 and set @errp.
-  *
-- * The caller must hold the AioContext lock of @reopen_state->bs.
-  * @reopen_state->bs can move to a different AioContext in this function.
-- * Callers must make sure that their AioContext locking is still correct after
-- * this.
-  */
- static int GRAPH_UNLOCKED
- bdrv_reopen_parse_file_or_backing(BDRVReopenState *reopen_state,
-@@ -4801,8 +4774,6 @@ out_rdlock:
-  * It is the responsibility of the caller to then call the abort() or
-  * commit() for any other BDS that have been left in a prepare() state
-  *
-- * The caller must hold the AioContext lock of @reopen_state->bs.
-- *
-  * After calling this function, the transaction @change_child_tran may only be
-  * completed while holding a writer lock for the graph.
-  */
-@@ -5437,8 +5408,6 @@ int bdrv_drop_filter(BlockDriverState *bs, Error **errp)
-  * child.
-  *
-  * This function does not create any image files.
-- *
-- * The caller must hold the AioContext lock for @bs_top.
-  */
- int bdrv_append(BlockDriverState *bs_new, BlockDriverState *bs_top,
-                 Error **errp)
-@@ -5545,9 +5514,8 @@ static void bdrv_delete(BlockDriverState *bs)
-  * after the call (even on failure), so if the caller intends to reuse the
-  * dictionary, it needs to use qobject_ref() before calling bdrv_open.
-  *
-- * The caller holds the AioContext lock for @bs. It must make sure that @bs
-- * stays in the same AioContext, i.e. @options must not refer to nodes in a
-- * different AioContext.
-+ * The caller must make sure that @bs stays in the same AioContext, i.e.
-+ * @options must not refer to nodes in a different AioContext.
-  */
- BlockDriverState *bdrv_insert_node(BlockDriverState *bs, QDict *options,
-                                    int flags, Error **errp)
-@@ -7565,10 +7533,6 @@ static TransactionActionDrv set_aio_context = {
-  *
-  * Must be called from the main AioContext.
-  *
-- * The caller must own the AioContext lock for the old AioContext of bs, but it
-- * must not own the AioContext lock for new_context (unless new_context is the
-- * same as the current context of bs).
-- *
-  * @visited will accumulate all visited BdrvChild objects. The caller is
-  * responsible for freeing the list afterwards.
-  */
-@@ -7621,13 +7585,6 @@ static bool bdrv_change_aio_context(BlockDriverState *bs, AioContext *ctx,
-  *
-  * If ignore_child is not NULL, that child (and its subgraph) will not
-  * be touched.
-- *
-- * This function still requires the caller to take the bs current
-- * AioContext lock, otherwise draining will fail since AIO_WAIT_WHILE
-- * assumes the lock is always held if bs is in another AioContext.
-- * For the same reason, it temporarily also holds the new AioContext, since
-- * bdrv_drained_end calls BDRV_POLL_WHILE that assumes the lock is taken too.
-- * Therefore the new AioContext lock must not be taken by the caller.
-  */
- int bdrv_try_change_aio_context(BlockDriverState *bs, AioContext *ctx,
-                                 BdrvChild *ignore_child, Error **errp)
-@@ -7653,8 +7610,8 @@ int bdrv_try_change_aio_context(BlockDriverState *bs, AioContext *ctx,
- 
-     /*
-      * Linear phase: go through all callbacks collected in the transaction.
--     * Run all callbacks collected in the recursion to switch all nodes
--     * AioContext lock (transaction commit), or undo all changes done in the
-+     * Run all callbacks collected in the recursion to switch every node's
-+     * AioContext (transaction commit), or undo all changes done in the
-      * recursion (transaction abort).
-      */
- 
-diff --git a/block/block-backend.c b/block/block-backend.c
-index f412bed274..209eb07528 100644
---- a/block/block-backend.c
-+++ b/block/block-backend.c
-@@ -390,8 +390,6 @@ BlockBackend *blk_new(AioContext *ctx, uint64_t perm, uint64_t shared_perm)
-  * Both sets of permissions can be changed later using blk_set_perm().
-  *
-  * Return the new BlockBackend on success, null on failure.
-- *
-- * Callers must hold the AioContext lock of @bs.
-  */
- BlockBackend *blk_new_with_bs(BlockDriverState *bs, uint64_t perm,
-                               uint64_t shared_perm, Error **errp)
-@@ -416,8 +414,6 @@ BlockBackend *blk_new_with_bs(BlockDriverState *bs, uint64_t perm,
-  * Just as with bdrv_open(), after having called this function the reference to
-  * @options belongs to the block layer (even on failure).
-  *
-- * Called without holding an AioContext lock.
-- *
-  * TODO: Remove @filename and @flags; it should be possible to specify a whole
-  * BDS tree just by specifying the @options QDict (or @reference,
-  * alternatively). At the time of adding this function, this is not possible,
-@@ -872,8 +868,6 @@ BlockBackend *blk_by_public(BlockBackendPublic *public)
- 
- /*
-  * Disassociates the currently associated BlockDriverState from @blk.
-- *
-- * The caller must hold the AioContext lock for the BlockBackend.
-  */
- void blk_remove_bs(BlockBackend *blk)
- {
-@@ -915,8 +909,6 @@ void blk_remove_bs(BlockBackend *blk)
- 
- /*
-  * Associates a new BlockDriverState with @blk.
-- *
-- * Callers must hold the AioContext lock of @bs.
-  */
- int blk_insert_bs(BlockBackend *blk, BlockDriverState *bs, Error **errp)
- {
-diff --git a/block/export/vhost-user-blk-server.c b/block/export/vhost-user-blk-server.c
-index 16f48388d3..50c358e8cd 100644
---- a/block/export/vhost-user-blk-server.c
-+++ b/block/export/vhost-user-blk-server.c
-@@ -278,7 +278,6 @@ static void vu_blk_exp_resize(void *opaque)
-     vu_config_change_msg(&vexp->vu_server.vu_dev);
- }
- 
--/* Called with vexp->export.ctx acquired */
- static void vu_blk_drained_begin(void *opaque)
- {
-     VuBlkExport *vexp = opaque;
-@@ -287,7 +286,6 @@ static void vu_blk_drained_begin(void *opaque)
-     vhost_user_server_detach_aio_context(&vexp->vu_server);
- }
- 
--/* Called with vexp->export.blk AioContext acquired */
- static void vu_blk_drained_end(void *opaque)
- {
-     VuBlkExport *vexp = opaque;
-@@ -300,8 +298,6 @@ static void vu_blk_drained_end(void *opaque)
-  * Ensures that bdrv_drained_begin() waits until in-flight requests complete
-  * and the server->co_trip coroutine has terminated. It will be restarted in
-  * vhost_user_server_attach_aio_context().
-- *
-- * Called with vexp->export.ctx acquired.
-  */
- static bool vu_blk_drained_poll(void *opaque)
- {
-diff --git a/include/block/block-common.h b/include/block/block-common.h
-index d7599564db..a846023a09 100644
---- a/include/block/block-common.h
-+++ b/include/block/block-common.h
-@@ -70,9 +70,6 @@
-  * automatically takes the graph rdlock when calling the wrapped function. In
-  * the same way, no_co_wrapper_bdrv_wrlock functions automatically take the
-  * graph wrlock.
-- *
-- * If the first parameter of the function is a BlockDriverState, BdrvChild or
-- * BlockBackend pointer, the AioContext lock for it is taken in the wrapper.
-  */
- #define no_co_wrapper
- #define no_co_wrapper_bdrv_rdlock
-diff --git a/include/block/block-io.h b/include/block/block-io.h
-index 8eb39a858b..b49e0537dd 100644
---- a/include/block/block-io.h
-+++ b/include/block/block-io.h
-@@ -332,11 +332,10 @@ bdrv_co_copy_range(BdrvChild *src, int64_t src_offset,
-  * "I/O or GS" API functions. These functions can run without
-  * the BQL, but only in one specific iothread/main loop.
-  *
-- * More specifically, these functions use BDRV_POLL_WHILE(bs), which
-- * requires the caller to be either in the main thread and hold
-- * the BlockdriverState (bs) AioContext lock, or directly in the
-- * home thread that runs the bs AioContext. Calling them from
-- * another thread in another AioContext would cause deadlocks.
-+ * More specifically, these functions use BDRV_POLL_WHILE(bs), which requires
-+ * the caller to be either in the main thread or directly in the home thread
-+ * that runs the bs AioContext. Calling them from another thread in another
-+ * AioContext would cause deadlocks.
-  *
-  * Therefore, these functions are not proper I/O, because they
-  * can't run in *any* iothreads, but only in a specific one.
-diff --git a/include/block/block_int-common.h b/include/block/block_int-common.h
-index 4e31d161c5..151279d481 100644
---- a/include/block/block_int-common.h
-+++ b/include/block/block_int-common.h
-@@ -1192,8 +1192,6 @@ struct BlockDriverState {
-     /* The error object in use for blocking operations on backing_hd */
-     Error *backing_blocker;
- 
--    /* Protected by AioContext lock */
--
-     /*
-      * If we are reading a disk image, give its size in sectors.
-      * Generally read-only; it is written to by load_snapshot and
-diff --git a/tests/qemu-iotests/202 b/tests/qemu-iotests/202
-index b784dcd791..13304242e5 100755
---- a/tests/qemu-iotests/202
-+++ b/tests/qemu-iotests/202
-@@ -21,7 +21,7 @@
- # Check that QMP 'transaction' blockdev-snapshot-sync with multiple drives on a
- # single IOThread completes successfully.  This particular command triggered a
- # hang due to recursive AioContext locking and BDRV_POLL_WHILE().  Protect
--# against regressions.
-+# against regressions even though the AioContext lock no longer exists.
- 
- import iotests
- 
-diff --git a/tests/qemu-iotests/203 b/tests/qemu-iotests/203
-index ab80fd0e44..1ba878522b 100755
---- a/tests/qemu-iotests/203
-+++ b/tests/qemu-iotests/203
-@@ -21,7 +21,8 @@
- # Check that QMP 'migrate' with multiple drives on a single IOThread completes
- # successfully.  This particular command triggered a hang in the source QEMU
- # process due to recursive AioContext locking in bdrv_invalidate_all() and
--# BDRV_POLL_WHILE().
-+# BDRV_POLL_WHILE().  Protect against regressions even though the AioContext
-+# lock no longer exists.
- 
- import iotests
- 
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-chardev-char-socket-Fix-TLS-io-channels-sending-too-.patch b/SOURCES/kvm-chardev-char-socket-Fix-TLS-io-channels-sending-too-.patch
deleted file mode 100644
index 34c4e8f..0000000
--- a/SOURCES/kvm-chardev-char-socket-Fix-TLS-io-channels-sending-too-.patch
+++ /dev/null
@@ -1,105 +0,0 @@
-From 95b2ffc5f01dc4309c2e747ed883d22cd1d26347 Mon Sep 17 00:00:00 2001
-From: Thomas Huth <thuth@redhat.com>
-Date: Sat, 2 Mar 2024 17:00:23 +0100
-Subject: [PATCH 2/2] chardev/char-socket: Fix TLS io channels sending too much
- data to the backend
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 227: Fix TLS io channels sending too much data to the backend
-RH-Jira: RHEL-24614
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Daniel P. Berrangé <berrange@redhat.com>
-RH-Commit: [1/1] fce871914e0ce52e16a6edae0e007513f9fec1ae (thuth/qemu-kvm-cs9)
-
-JIRA: https://issues.redhat.com/browse/RHEL-24614
-
-commit 462945cd22d2bcd233401ed3aa167d83a8e35b05
-Author: Thomas Huth <thuth@redhat.com>
-Date:   Thu Feb 29 11:43:37 2024 +0100
-
-    chardev/char-socket: Fix TLS io channels sending too much data to the backend
-
-    Commit ffda5db65a ("io/channel-tls: fix handling of bigger read buffers")
-    changed the behavior of the TLS io channels to schedule a second reading
-    attempt if there is still incoming data pending. This caused a regression
-    with backends like the sclpconsole that check in their read function that
-    the sender does not try to write more bytes to it than the device can
-    currently handle.
-
-    The problem can be reproduced like this:
-
-     1) In one terminal, do this:
-
-      mkdir qemu-pki
-      cd qemu-pki
-      openssl genrsa 2048 > ca-key.pem
-      openssl req -new -x509 -nodes -days 365000 -key ca-key.pem -out ca-cert.pem
-      # enter some dummy value for the cert
-      openssl genrsa 2048 > server-key.pem
-      openssl req -new -x509 -nodes -days 365000 -key server-key.pem \
-        -out server-cert.pem
-      # enter some other dummy values for the cert
-
-      gnutls-serv --echo --x509cafile ca-cert.pem --x509keyfile server-key.pem \
-                  --x509certfile server-cert.pem -p 8338
-
-     2) In another terminal, do this:
-
-      wget https://download.fedoraproject.org/pub/fedora-secondary/releases/39/Cloud/s390x/images/Fedora-Cloud-Base-39-1.5.s390x.qcow2
-
-      qemu-system-s390x -nographic -nodefaults \
-        -hda Fedora-Cloud-Base-39-1.5.s390x.qcow2 \
-        -object tls-creds-x509,id=tls0,endpoint=client,verify-peer=false,dir=$PWD/qemu-pki \
-        -chardev socket,id=tls_chardev,host=localhost,port=8338,tls-creds=tls0 \
-        -device sclpconsole,chardev=tls_chardev,id=tls_serial
-
-    QEMU then aborts after a second or two with:
-
-      qemu-system-s390x: ../hw/char/sclpconsole.c:73: chr_read: Assertion
-       `size <= SIZE_BUFFER_VT220 - scon->iov_data_len' failed.
-     Aborted (core dumped)
-
-    It looks like the second read does not trigger the chr_can_read() function
-    to be called before the second read, which should normally always be done
-    before sending bytes to a character device to see how much it can handle,
-    so the s->max_size in tcp_chr_read() still contains the old value from the
-    previous read. Let's make sure that we use the up-to-date value by calling
-    tcp_chr_read_poll() again here.
-
-    Fixes: ffda5db65a ("io/channel-tls: fix handling of bigger read buffers")
-    Buglink: https://issues.redhat.com/browse/RHEL-24614
-    Reviewed-by: "Daniel P. Berrangé" <berrange@redhat.com>
-    Message-ID: <20240229104339.42574-1-thuth@redhat.com>
-    Reviewed-by: Antoine Damhet <antoine.damhet@blade-group.com>
-    Tested-by: Antoine Damhet <antoine.damhet@blade-group.com>
-    Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
-    Signed-off-by: Thomas Huth <thuth@redhat.com>
-
-Signed-off-by: Thomas Huth <thuth@redhat.com>
----
- chardev/char-socket.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/chardev/char-socket.c b/chardev/char-socket.c
-index 73947da188..034840593d 100644
---- a/chardev/char-socket.c
-+++ b/chardev/char-socket.c
-@@ -492,9 +492,9 @@ static gboolean tcp_chr_read(QIOChannel *chan, GIOCondition cond, void *opaque)
-         s->max_size <= 0) {
-         return TRUE;
-     }
--    len = sizeof(buf);
--    if (len > s->max_size) {
--        len = s->max_size;
-+    len = tcp_chr_read_poll(opaque);
-+    if (len > sizeof(buf)) {
-+        len = sizeof(buf);
-     }
-     size = tcp_chr_recv(chr, (void *)buf, len);
-     if (size == 0 || (size == -1 && errno != EAGAIN)) {
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-chardev-lower-priority-of-the-HUP-GSource-in-socket-.patch b/SOURCES/kvm-chardev-lower-priority-of-the-HUP-GSource-in-socket-.patch
deleted file mode 100644
index 30e055f..0000000
--- a/SOURCES/kvm-chardev-lower-priority-of-the-HUP-GSource-in-socket-.patch
+++ /dev/null
@@ -1,78 +0,0 @@
-From 4d4102f6e2f9afd6182888787ae8b570347df87d Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Mon, 18 Mar 2024 18:06:59 +0000
-Subject: [PATCH 1/3] chardev: lower priority of the HUP GSource in socket
- chardev
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Daniel P. Berrangé <berrange@redhat.com>
-RH-MergeRequest: 233: Fix handling of TLS sessions in chardevs
-RH-Jira: RHEL-24614
-RH-Acked-by: Thomas Huth <thuth@redhat.com>
-RH-Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
-RH-Commit: [1/3] 842f54349191b0206e68f35a7a80155f5a584942 (berrange/centos-src-qemu)
-
-The socket chardev often has 2 GSource object registered against the
-same FD. One is registered all the time and is just intended to handle
-POLLHUP events, while the other gets registered & unregistered on the
-fly as the frontend is ready to receive more data or not.
-
-It is very common for poll() to signal a POLLHUP event at the same time
-as there is pending incoming data from the disconnected client. It is
-therefore essential to process incoming data prior to processing HUP.
-The problem with having 2 GSource on the same FD is that there is no
-guaranteed ordering of execution between them, so the chardev code may
-process HUP first and thus discard data.
-
-This failure scenario is non-deterministic but can be seen fairly
-reliably by reverting a7077b8e354d90fec26c2921aa2dea85b90dff90, and
-then running 'tests/unit/test-char', which will sometimes fail with
-missing data.
-
-Ideally QEMU would only have 1 GSource, but that's a complex code
-refactoring job. The next best solution is to try to ensure ordering
-between the 2 GSource objects. This can be achieved by lowering the
-priority of the HUP GSource, so that it is never dispatched if the
-main GSource is also ready to dispatch. Counter-intuitively, lowering
-the priority of a GSource is done by raising its priority number.
-
-Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-(cherry picked from commit 8bd8b04adc9f18904f323dff085f8b4ec77915c6)
----
- chardev/char-socket.c | 16 ++++++++++++++++
- 1 file changed, 16 insertions(+)
-
-diff --git a/chardev/char-socket.c b/chardev/char-socket.c
-index 034840593d..f48d341ebc 100644
---- a/chardev/char-socket.c
-+++ b/chardev/char-socket.c
-@@ -597,6 +597,22 @@ static void update_ioc_handlers(SocketChardev *s)
- 
-     remove_hup_source(s);
-     s->hup_source = qio_channel_create_watch(s->ioc, G_IO_HUP);
-+    /*
-+     * poll() is liable to return POLLHUP even when there is
-+     * still incoming data available to read on the FD. If
-+     * we have the hup_source at the same priority as the
-+     * main io_add_watch_poll GSource, then we might end up
-+     * processing the POLLHUP event first, closing the FD,
-+     * and as a result silently discard data we should have
-+     * read.
-+     *
-+     * By setting the hup_source to G_PRIORITY_DEFAULT + 1,
-+     * we ensure that io_add_watch_poll GSource will always
-+     * be dispatched first, thus guaranteeing we will be
-+     * able to process all incoming data before closing the
-+     * FD
-+     */
-+    g_source_set_priority(s->hup_source, G_PRIORITY_DEFAULT + 1);
-     g_source_set_callback(s->hup_source, (GSourceFunc)tcp_chr_hup,
-                           chr, NULL);
-     g_source_attach(s->hup_source, chr->gcontext);
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-confidential-guest-support-Add-kvm_init-and-kvm_rese.patch b/SOURCES/kvm-confidential-guest-support-Add-kvm_init-and-kvm_rese.patch
new file mode 100644
index 0000000..785b437
--- /dev/null
+++ b/SOURCES/kvm-confidential-guest-support-Add-kvm_init-and-kvm_rese.patch
@@ -0,0 +1,90 @@
+From 0f0a3a860a07addea21a0282556a5022b9cb8b2c Mon Sep 17 00:00:00 2001
+From: Xiaoyao Li <xiaoyao.li@intel.com>
+Date: Thu, 29 Feb 2024 01:00:35 -0500
+Subject: [PATCH 011/100] confidential guest support: Add kvm_init() and
+ kvm_reset() in class
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [11/91] 21d2178178bf181a8e4d0b051f64bd983f0d0cf1 (bonzini/rhel-qemu-kvm)
+
+Different confidential VMs in different architectures all have the same
+needs to do their specific initialization (and maybe resetting) stuffs
+with KVM. Currently each of them exposes individual *_kvm_init()
+functions and let machine code or kvm code to call it.
+
+To facilitate the introduction of confidential guest technology from
+different x86 vendors, add two virtual functions, kvm_init() and kvm_reset()
+in ConfidentialGuestSupportClass, and expose two helpers functions for
+invodking them.
+
+Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
+Message-Id: <20240229060038.606591-1-xiaoyao.li@intel.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 41a605944e3fecae43ca18ded95ec31f28e0c7fe)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ include/exec/confidential-guest-support.h | 34 ++++++++++++++++++++++-
+ 1 file changed, 33 insertions(+), 1 deletion(-)
+
+diff --git a/include/exec/confidential-guest-support.h b/include/exec/confidential-guest-support.h
+index ba2dd4b5df..e5b188cffb 100644
+--- a/include/exec/confidential-guest-support.h
++++ b/include/exec/confidential-guest-support.h
+@@ -23,7 +23,10 @@
+ #include "qom/object.h"
+ 
+ #define TYPE_CONFIDENTIAL_GUEST_SUPPORT "confidential-guest-support"
+-OBJECT_DECLARE_SIMPLE_TYPE(ConfidentialGuestSupport, CONFIDENTIAL_GUEST_SUPPORT)
++OBJECT_DECLARE_TYPE(ConfidentialGuestSupport,
++                    ConfidentialGuestSupportClass,
++                    CONFIDENTIAL_GUEST_SUPPORT)
++
+ 
+ struct ConfidentialGuestSupport {
+     Object parent;
+@@ -55,8 +58,37 @@ struct ConfidentialGuestSupport {
+ 
+ typedef struct ConfidentialGuestSupportClass {
+     ObjectClass parent;
++
++    int (*kvm_init)(ConfidentialGuestSupport *cgs, Error **errp);
++    int (*kvm_reset)(ConfidentialGuestSupport *cgs, Error **errp);
+ } ConfidentialGuestSupportClass;
+ 
++static inline int confidential_guest_kvm_init(ConfidentialGuestSupport *cgs,
++                                              Error **errp)
++{
++    ConfidentialGuestSupportClass *klass;
++
++    klass = CONFIDENTIAL_GUEST_SUPPORT_GET_CLASS(cgs);
++    if (klass->kvm_init) {
++        return klass->kvm_init(cgs, errp);
++    }
++
++    return 0;
++}
++
++static inline int confidential_guest_kvm_reset(ConfidentialGuestSupport *cgs,
++                                               Error **errp)
++{
++    ConfidentialGuestSupportClass *klass;
++
++    klass = CONFIDENTIAL_GUEST_SUPPORT_GET_CLASS(cgs);
++    if (klass->kvm_reset) {
++        return klass->kvm_reset(cgs, errp);
++    }
++
++    return 0;
++}
++
+ #endif /* !CONFIG_USER_ONLY */
+ 
+ #endif /* QEMU_CONFIDENTIAL_GUEST_SUPPORT_H */
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-coroutine-cap-per-thread-local-pool-size.patch b/SOURCES/kvm-coroutine-cap-per-thread-local-pool-size.patch
deleted file mode 100644
index 6fffc23..0000000
--- a/SOURCES/kvm-coroutine-cap-per-thread-local-pool-size.patch
+++ /dev/null
@@ -1,412 +0,0 @@
-From e99c56752a1c4021a93c92b7be78856ebefaa1b3 Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Mon, 18 Mar 2024 14:34:29 -0400
-Subject: [PATCH 1/2] coroutine: cap per-thread local pool size
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 234: coroutine: cap per-thread local pool size
-RH-Jira: RHEL-28947
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Commit: [1/2] 5971de1c1e238457925bfb9c4bfc932de857b28d (stefanha/centos-stream-qemu-kvm)
-
-The coroutine pool implementation can hit the Linux vm.max_map_count
-limit, causing QEMU to abort with "failed to allocate memory for stack"
-or "failed to set up stack guard page" during coroutine creation.
-
-This happens because per-thread pools can grow to tens of thousands of
-coroutines. Each coroutine causes 2 virtual memory areas to be created.
-Eventually vm.max_map_count is reached and memory-related syscalls fail.
-The per-thread pool sizes are non-uniform and depend on past coroutine
-usage in each thread, so it's possible for one thread to have a large
-pool while another thread's pool is empty.
-
-Switch to a new coroutine pool implementation with a global pool that
-grows to a maximum number of coroutines and per-thread local pools that
-are capped at hardcoded small number of coroutines.
-
-This approach does not leave large numbers of coroutines pooled in a
-thread that may not use them again. In order to perform well it
-amortizes the cost of global pool accesses by working in batches of
-coroutines instead of individual coroutines.
-
-The global pool is a list. Threads donate batches of coroutines to when
-they have too many and take batches from when they have too few:
-
-.-----------------------------------.
-| Batch 1 | Batch 2 | Batch 3 | ... | global_pool
-`-----------------------------------'
-
-Each thread has up to 2 batches of coroutines:
-
-.-------------------.
-| Batch 1 | Batch 2 | per-thread local_pool (maximum 2 batches)
-`-------------------'
-
-The goal of this change is to reduce the excessive number of pooled
-coroutines that cause QEMU to abort when vm.max_map_count is reached
-without losing the performance of an adequately sized coroutine pool.
-
-Here are virtio-blk disk I/O benchmark results:
-
-      RW BLKSIZE IODEPTH    OLD    NEW CHANGE
-randread      4k       1 113725 117451 +3.3%
-randread      4k       8 192968 198510 +2.9%
-randread      4k      16 207138 209429 +1.1%
-randread      4k      32 212399 215145 +1.3%
-randread      4k      64 218319 221277 +1.4%
-randread    128k       1  17587  17535 -0.3%
-randread    128k       8  17614  17616 +0.0%
-randread    128k      16  17608  17609 +0.0%
-randread    128k      32  17552  17553 +0.0%
-randread    128k      64  17484  17484 +0.0%
-
-See files/{fio.sh,test.xml.j2} for the benchmark configuration:
-https://gitlab.com/stefanha/virt-playbooks/-/tree/coroutine-pool-fix-sizing
-
-Buglink: https://issues.redhat.com/browse/RHEL-28947
-Reported-by: Sanjay Rao <srao@redhat.com>
-Reported-by: Boaz Ben Shabat <bbenshab@redhat.com>
-Reported-by: Joe Mario <jmario@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20240318183429.1039340-1-stefanha@redhat.com>
-(cherry picked from commit 86a637e48104ae74d8be53bed6441ce32be33433)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- util/qemu-coroutine.c | 282 +++++++++++++++++++++++++++++++++---------
- 1 file changed, 223 insertions(+), 59 deletions(-)
-
-diff --git a/util/qemu-coroutine.c b/util/qemu-coroutine.c
-index 5fd2dbaf8b..2790959eaf 100644
---- a/util/qemu-coroutine.c
-+++ b/util/qemu-coroutine.c
-@@ -18,39 +18,200 @@
- #include "qemu/atomic.h"
- #include "qemu/coroutine_int.h"
- #include "qemu/coroutine-tls.h"
-+#include "qemu/cutils.h"
- #include "block/aio.h"
- 
--/**
-- * The minimal batch size is always 64, coroutines from the release_pool are
-- * reused as soon as there are 64 coroutines in it. The maximum pool size starts
-- * with 64 and is increased on demand so that coroutines are not deleted even if
-- * they are not immediately reused.
-- */
- enum {
--    POOL_MIN_BATCH_SIZE = 64,
--    POOL_INITIAL_MAX_SIZE = 64,
-+    COROUTINE_POOL_BATCH_MAX_SIZE = 128,
- };
- 
--/** Free list to speed up creation */
--static QSLIST_HEAD(, Coroutine) release_pool = QSLIST_HEAD_INITIALIZER(pool);
--static unsigned int pool_max_size = POOL_INITIAL_MAX_SIZE;
--static unsigned int release_pool_size;
-+/*
-+ * Coroutine creation and deletion is expensive so a pool of unused coroutines
-+ * is kept as a cache. When the pool has coroutines available, they are
-+ * recycled instead of creating new ones from scratch. Coroutines are added to
-+ * the pool upon termination.
-+ *
-+ * The pool is global but each thread maintains a small local pool to avoid
-+ * global pool contention. Threads fetch and return batches of coroutines from
-+ * the global pool to maintain their local pool. The local pool holds up to two
-+ * batches whereas the maximum size of the global pool is controlled by the
-+ * qemu_coroutine_inc_pool_size() API.
-+ *
-+ * .-----------------------------------.
-+ * | Batch 1 | Batch 2 | Batch 3 | ... | global_pool
-+ * `-----------------------------------'
-+ *
-+ * .-------------------.
-+ * | Batch 1 | Batch 2 | per-thread local_pool (maximum 2 batches)
-+ * `-------------------'
-+ */
-+typedef struct CoroutinePoolBatch {
-+    /* Batches are kept in a list */
-+    QSLIST_ENTRY(CoroutinePoolBatch) next;
-+
-+    /* This batch holds up to @COROUTINE_POOL_BATCH_MAX_SIZE coroutines */
-+    QSLIST_HEAD(, Coroutine) list;
-+    unsigned int size;
-+} CoroutinePoolBatch;
-+
-+typedef QSLIST_HEAD(, CoroutinePoolBatch) CoroutinePool;
-+
-+/* Host operating system limit on number of pooled coroutines */
-+static unsigned int global_pool_hard_max_size;
-+
-+static QemuMutex global_pool_lock; /* protects the following variables */
-+static CoroutinePool global_pool = QSLIST_HEAD_INITIALIZER(global_pool);
-+static unsigned int global_pool_size;
-+static unsigned int global_pool_max_size = COROUTINE_POOL_BATCH_MAX_SIZE;
-+
-+QEMU_DEFINE_STATIC_CO_TLS(CoroutinePool, local_pool);
-+QEMU_DEFINE_STATIC_CO_TLS(Notifier, local_pool_cleanup_notifier);
- 
--typedef QSLIST_HEAD(, Coroutine) CoroutineQSList;
--QEMU_DEFINE_STATIC_CO_TLS(CoroutineQSList, alloc_pool);
--QEMU_DEFINE_STATIC_CO_TLS(unsigned int, alloc_pool_size);
--QEMU_DEFINE_STATIC_CO_TLS(Notifier, coroutine_pool_cleanup_notifier);
-+static CoroutinePoolBatch *coroutine_pool_batch_new(void)
-+{
-+    CoroutinePoolBatch *batch = g_new(CoroutinePoolBatch, 1);
-+
-+    QSLIST_INIT(&batch->list);
-+    batch->size = 0;
-+    return batch;
-+}
- 
--static void coroutine_pool_cleanup(Notifier *n, void *value)
-+static void coroutine_pool_batch_delete(CoroutinePoolBatch *batch)
- {
-     Coroutine *co;
-     Coroutine *tmp;
--    CoroutineQSList *alloc_pool = get_ptr_alloc_pool();
- 
--    QSLIST_FOREACH_SAFE(co, alloc_pool, pool_next, tmp) {
--        QSLIST_REMOVE_HEAD(alloc_pool, pool_next);
-+    QSLIST_FOREACH_SAFE(co, &batch->list, pool_next, tmp) {
-+        QSLIST_REMOVE_HEAD(&batch->list, pool_next);
-         qemu_coroutine_delete(co);
-     }
-+    g_free(batch);
-+}
-+
-+static void local_pool_cleanup(Notifier *n, void *value)
-+{
-+    CoroutinePool *local_pool = get_ptr_local_pool();
-+    CoroutinePoolBatch *batch;
-+    CoroutinePoolBatch *tmp;
-+
-+    QSLIST_FOREACH_SAFE(batch, local_pool, next, tmp) {
-+        QSLIST_REMOVE_HEAD(local_pool, next);
-+        coroutine_pool_batch_delete(batch);
-+    }
-+}
-+
-+/* Ensure the atexit notifier is registered */
-+static void local_pool_cleanup_init_once(void)
-+{
-+    Notifier *notifier = get_ptr_local_pool_cleanup_notifier();
-+    if (!notifier->notify) {
-+        notifier->notify = local_pool_cleanup;
-+        qemu_thread_atexit_add(notifier);
-+    }
-+}
-+
-+/* Helper to get the next unused coroutine from the local pool */
-+static Coroutine *coroutine_pool_get_local(void)
-+{
-+    CoroutinePool *local_pool = get_ptr_local_pool();
-+    CoroutinePoolBatch *batch = QSLIST_FIRST(local_pool);
-+    Coroutine *co;
-+
-+    if (unlikely(!batch)) {
-+        return NULL;
-+    }
-+
-+    co = QSLIST_FIRST(&batch->list);
-+    QSLIST_REMOVE_HEAD(&batch->list, pool_next);
-+    batch->size--;
-+
-+    if (batch->size == 0) {
-+        QSLIST_REMOVE_HEAD(local_pool, next);
-+        coroutine_pool_batch_delete(batch);
-+    }
-+    return co;
-+}
-+
-+/* Get the next batch from the global pool */
-+static void coroutine_pool_refill_local(void)
-+{
-+    CoroutinePool *local_pool = get_ptr_local_pool();
-+    CoroutinePoolBatch *batch;
-+
-+    WITH_QEMU_LOCK_GUARD(&global_pool_lock) {
-+        batch = QSLIST_FIRST(&global_pool);
-+
-+        if (batch) {
-+            QSLIST_REMOVE_HEAD(&global_pool, next);
-+            global_pool_size -= batch->size;
-+        }
-+    }
-+
-+    if (batch) {
-+        QSLIST_INSERT_HEAD(local_pool, batch, next);
-+        local_pool_cleanup_init_once();
-+    }
-+}
-+
-+/* Add a batch of coroutines to the global pool */
-+static void coroutine_pool_put_global(CoroutinePoolBatch *batch)
-+{
-+    WITH_QEMU_LOCK_GUARD(&global_pool_lock) {
-+        unsigned int max = MIN(global_pool_max_size,
-+                               global_pool_hard_max_size);
-+
-+        if (global_pool_size < max) {
-+            QSLIST_INSERT_HEAD(&global_pool, batch, next);
-+
-+            /* Overshooting the max pool size is allowed */
-+            global_pool_size += batch->size;
-+            return;
-+        }
-+    }
-+
-+    /* The global pool was full, so throw away this batch */
-+    coroutine_pool_batch_delete(batch);
-+}
-+
-+/* Get the next unused coroutine from the pool or return NULL */
-+static Coroutine *coroutine_pool_get(void)
-+{
-+    Coroutine *co;
-+
-+    co = coroutine_pool_get_local();
-+    if (!co) {
-+        coroutine_pool_refill_local();
-+        co = coroutine_pool_get_local();
-+    }
-+    return co;
-+}
-+
-+static void coroutine_pool_put(Coroutine *co)
-+{
-+    CoroutinePool *local_pool = get_ptr_local_pool();
-+    CoroutinePoolBatch *batch = QSLIST_FIRST(local_pool);
-+
-+    if (unlikely(!batch)) {
-+        batch = coroutine_pool_batch_new();
-+        QSLIST_INSERT_HEAD(local_pool, batch, next);
-+        local_pool_cleanup_init_once();
-+    }
-+
-+    if (unlikely(batch->size >= COROUTINE_POOL_BATCH_MAX_SIZE)) {
-+        CoroutinePoolBatch *next = QSLIST_NEXT(batch, next);
-+
-+        /* Is the local pool full? */
-+        if (next) {
-+            QSLIST_REMOVE_HEAD(local_pool, next);
-+            coroutine_pool_put_global(batch);
-+        }
-+
-+        batch = coroutine_pool_batch_new();
-+        QSLIST_INSERT_HEAD(local_pool, batch, next);
-+    }
-+
-+    QSLIST_INSERT_HEAD(&batch->list, co, pool_next);
-+    batch->size++;
- }
- 
- Coroutine *qemu_coroutine_create(CoroutineEntry *entry, void *opaque)
-@@ -58,31 +219,7 @@ Coroutine *qemu_coroutine_create(CoroutineEntry *entry, void *opaque)
-     Coroutine *co = NULL;
- 
-     if (IS_ENABLED(CONFIG_COROUTINE_POOL)) {
--        CoroutineQSList *alloc_pool = get_ptr_alloc_pool();
--
--        co = QSLIST_FIRST(alloc_pool);
--        if (!co) {
--            if (release_pool_size > POOL_MIN_BATCH_SIZE) {
--                /* Slow path; a good place to register the destructor, too.  */
--                Notifier *notifier = get_ptr_coroutine_pool_cleanup_notifier();
--                if (!notifier->notify) {
--                    notifier->notify = coroutine_pool_cleanup;
--                    qemu_thread_atexit_add(notifier);
--                }
--
--                /* This is not exact; there could be a little skew between
--                 * release_pool_size and the actual size of release_pool.  But
--                 * it is just a heuristic, it does not need to be perfect.
--                 */
--                set_alloc_pool_size(qatomic_xchg(&release_pool_size, 0));
--                QSLIST_MOVE_ATOMIC(alloc_pool, &release_pool);
--                co = QSLIST_FIRST(alloc_pool);
--            }
--        }
--        if (co) {
--            QSLIST_REMOVE_HEAD(alloc_pool, pool_next);
--            set_alloc_pool_size(get_alloc_pool_size() - 1);
--        }
-+        co = coroutine_pool_get();
-     }
- 
-     if (!co) {
-@@ -100,19 +237,10 @@ static void coroutine_delete(Coroutine *co)
-     co->caller = NULL;
- 
-     if (IS_ENABLED(CONFIG_COROUTINE_POOL)) {
--        if (release_pool_size < qatomic_read(&pool_max_size) * 2) {
--            QSLIST_INSERT_HEAD_ATOMIC(&release_pool, co, pool_next);
--            qatomic_inc(&release_pool_size);
--            return;
--        }
--        if (get_alloc_pool_size() < qatomic_read(&pool_max_size)) {
--            QSLIST_INSERT_HEAD(get_ptr_alloc_pool(), co, pool_next);
--            set_alloc_pool_size(get_alloc_pool_size() + 1);
--            return;
--        }
-+        coroutine_pool_put(co);
-+    } else {
-+        qemu_coroutine_delete(co);
-     }
--
--    qemu_coroutine_delete(co);
- }
- 
- void qemu_aio_coroutine_enter(AioContext *ctx, Coroutine *co)
-@@ -223,10 +351,46 @@ AioContext *qemu_coroutine_get_aio_context(Coroutine *co)
- 
- void qemu_coroutine_inc_pool_size(unsigned int additional_pool_size)
- {
--    qatomic_add(&pool_max_size, additional_pool_size);
-+    QEMU_LOCK_GUARD(&global_pool_lock);
-+    global_pool_max_size += additional_pool_size;
- }
- 
- void qemu_coroutine_dec_pool_size(unsigned int removing_pool_size)
- {
--    qatomic_sub(&pool_max_size, removing_pool_size);
-+    QEMU_LOCK_GUARD(&global_pool_lock);
-+    global_pool_max_size -= removing_pool_size;
-+}
-+
-+static unsigned int get_global_pool_hard_max_size(void)
-+{
-+#ifdef __linux__
-+    g_autofree char *contents = NULL;
-+    int max_map_count;
-+
-+    /*
-+     * Linux processes can have up to max_map_count virtual memory areas
-+     * (VMAs). mmap(2), mprotect(2), etc fail with ENOMEM beyond this limit. We
-+     * must limit the coroutine pool to a safe size to avoid running out of
-+     * VMAs.
-+     */
-+    if (g_file_get_contents("/proc/sys/vm/max_map_count", &contents, NULL,
-+                            NULL) &&
-+        qemu_strtoi(contents, NULL, 10, &max_map_count) == 0) {
-+        /*
-+         * This is a conservative upper bound that avoids exceeding
-+         * max_map_count. Leave half for non-coroutine users like library
-+         * dependencies, vhost-user, etc. Each coroutine takes up 2 VMAs so
-+         * halve the amount again.
-+         */
-+        return max_map_count / 4;
-+    }
-+#endif
-+
-+    return UINT_MAX;
-+}
-+
-+static void __attribute__((constructor)) qemu_coroutine_init(void)
-+{
-+    qemu_mutex_init(&global_pool_lock);
-+    global_pool_hard_max_size = get_global_pool_hard_max_size();
- }
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-coroutine-reserve-5-000-mappings.patch b/SOURCES/kvm-coroutine-reserve-5-000-mappings.patch
deleted file mode 100644
index cdbb666..0000000
--- a/SOURCES/kvm-coroutine-reserve-5-000-mappings.patch
+++ /dev/null
@@ -1,61 +0,0 @@
-From 0aa65dc3acba481f7064df936ab49e3bceb1d5bd Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Wed, 20 Mar 2024 14:12:32 -0400
-Subject: [PATCH 2/2] coroutine: reserve 5,000 mappings
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 234: coroutine: cap per-thread local pool size
-RH-Jira: RHEL-28947
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Commit: [2/2] 78560c2b947471111cc16c313d6f38db42860a1c (stefanha/centos-stream-qemu-kvm)
-
-Daniel P. Berrangé <berrange@redhat.com> pointed out that the coroutine
-pool size heuristic is very conservative. Instead of halving
-max_map_count, he suggested reserving 5,000 mappings for non-coroutine
-users based on observations of guests he has access to.
-
-Fixes: 86a637e48104 ("coroutine: cap per-thread local pool size")
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Message-id: 20240320181232.1464819-1-stefanha@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit 9352f80cd926fe2dde7c89b93ee33bb0356ff40e)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- util/qemu-coroutine.c | 15 ++++++++++-----
- 1 file changed, 10 insertions(+), 5 deletions(-)
-
-diff --git a/util/qemu-coroutine.c b/util/qemu-coroutine.c
-index 2790959eaf..eb4eebefdf 100644
---- a/util/qemu-coroutine.c
-+++ b/util/qemu-coroutine.c
-@@ -377,12 +377,17 @@ static unsigned int get_global_pool_hard_max_size(void)
-                             NULL) &&
-         qemu_strtoi(contents, NULL, 10, &max_map_count) == 0) {
-         /*
--         * This is a conservative upper bound that avoids exceeding
--         * max_map_count. Leave half for non-coroutine users like library
--         * dependencies, vhost-user, etc. Each coroutine takes up 2 VMAs so
--         * halve the amount again.
-+         * This is an upper bound that avoids exceeding max_map_count. Leave a
-+         * fixed amount for non-coroutine users like library dependencies,
-+         * vhost-user, etc. Each coroutine takes up 2 VMAs so halve the
-+         * remaining amount.
-          */
--        return max_map_count / 4;
-+        if (max_map_count > 5000) {
-+            return (max_map_count - 5000) / 2;
-+        } else {
-+            /* Disable the global pool but threads still have local pools */
-+            return 0;
-+        }
-     }
- #endif
- 
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-crypto-block-drop-qcrypto_block_open-n_threads-argum.patch b/SOURCES/kvm-crypto-block-drop-qcrypto_block_open-n_threads-argum.patch
new file mode 100644
index 0000000..b5fcef5
--- /dev/null
+++ b/SOURCES/kvm-crypto-block-drop-qcrypto_block_open-n_threads-argum.patch
@@ -0,0 +1,228 @@
+From 117486e0820f135f191e19f8ebb8838a98b121c6 Mon Sep 17 00:00:00 2001
+From: Stefan Hajnoczi <stefanha@redhat.com>
+Date: Mon, 27 May 2024 11:58:51 -0400
+Subject: [PATCH 5/5] crypto/block: drop qcrypto_block_open() n_threads
+ argument
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
+RH-MergeRequest: 251: block/crypto: create ciphers on demand
+RH-Jira: RHEL-36159
+RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [2/2] 68290935b174b1f2b76aa857a926da9011e54abe (stefanha/centos-stream-qemu-kvm)
+
+The n_threads argument is no longer used since the previous commit.
+Remove it.
+
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Message-ID: <20240527155851.892885-3-stefanha@redhat.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Acked-by: Daniel P. Berrangé <berrange@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit 3ab0f063e58ed9224237d69c4211ca83335164c4)
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ block/crypto.c                 | 1 -
+ block/qcow.c                   | 2 +-
+ block/qcow2.c                  | 5 ++---
+ crypto/block-luks.c            | 1 -
+ crypto/block-qcow.c            | 6 ++----
+ crypto/block.c                 | 3 +--
+ crypto/blockpriv.h             | 1 -
+ include/crypto/block.h         | 2 --
+ tests/unit/test-crypto-block.c | 4 ----
+ 9 files changed, 6 insertions(+), 19 deletions(-)
+
+diff --git a/block/crypto.c b/block/crypto.c
+index 21eed909c1..4eed3ffa6a 100644
+--- a/block/crypto.c
++++ b/block/crypto.c
+@@ -363,7 +363,6 @@ static int block_crypto_open_generic(QCryptoBlockFormat format,
+                                        block_crypto_read_func,
+                                        bs,
+                                        cflags,
+-                                       1,
+                                        errp);
+ 
+     if (!crypto->block) {
+diff --git a/block/qcow.c b/block/qcow.c
+index ca8e1d5ec8..c2f89db055 100644
+--- a/block/qcow.c
++++ b/block/qcow.c
+@@ -211,7 +211,7 @@ static int qcow_open(BlockDriverState *bs, QDict *options, int flags,
+                 cflags |= QCRYPTO_BLOCK_OPEN_NO_IO;
+             }
+             s->crypto = qcrypto_block_open(crypto_opts, "encrypt.",
+-                                           NULL, NULL, cflags, 1, errp);
++                                           NULL, NULL, cflags, errp);
+             if (!s->crypto) {
+                 ret = -EINVAL;
+                 goto fail;
+diff --git a/block/qcow2.c b/block/qcow2.c
+index 0e8b2f7518..0ebd455dc8 100644
+--- a/block/qcow2.c
++++ b/block/qcow2.c
+@@ -321,7 +321,7 @@ qcow2_read_extensions(BlockDriverState *bs, uint64_t start_offset,
+             }
+             s->crypto = qcrypto_block_open(s->crypto_opts, "encrypt.",
+                                            qcow2_crypto_hdr_read_func,
+-                                           bs, cflags, QCOW2_MAX_THREADS, errp);
++                                           bs, cflags, errp);
+             if (!s->crypto) {
+                 return -EINVAL;
+             }
+@@ -1707,8 +1707,7 @@ qcow2_do_open(BlockDriverState *bs, QDict *options, int flags,
+                 cflags |= QCRYPTO_BLOCK_OPEN_NO_IO;
+             }
+             s->crypto = qcrypto_block_open(s->crypto_opts, "encrypt.",
+-                                           NULL, NULL, cflags,
+-                                           QCOW2_MAX_THREADS, errp);
++                                           NULL, NULL, cflags, errp);
+             if (!s->crypto) {
+                 ret = -EINVAL;
+                 goto fail;
+diff --git a/crypto/block-luks.c b/crypto/block-luks.c
+index 3357852c0a..5b777c15d3 100644
+--- a/crypto/block-luks.c
++++ b/crypto/block-luks.c
+@@ -1189,7 +1189,6 @@ qcrypto_block_luks_open(QCryptoBlock *block,
+                         QCryptoBlockReadFunc readfunc,
+                         void *opaque,
+                         unsigned int flags,
+-                        size_t n_threads,
+                         Error **errp)
+ {
+     QCryptoBlockLUKS *luks = NULL;
+diff --git a/crypto/block-qcow.c b/crypto/block-qcow.c
+index 02305058e3..42e9556e42 100644
+--- a/crypto/block-qcow.c
++++ b/crypto/block-qcow.c
+@@ -44,7 +44,6 @@ qcrypto_block_qcow_has_format(const uint8_t *buf G_GNUC_UNUSED,
+ static int
+ qcrypto_block_qcow_init(QCryptoBlock *block,
+                         const char *keysecret,
+-                        size_t n_threads,
+                         Error **errp)
+ {
+     char *password;
+@@ -100,7 +99,6 @@ qcrypto_block_qcow_open(QCryptoBlock *block,
+                         QCryptoBlockReadFunc readfunc G_GNUC_UNUSED,
+                         void *opaque G_GNUC_UNUSED,
+                         unsigned int flags,
+-                        size_t n_threads,
+                         Error **errp)
+ {
+     if (flags & QCRYPTO_BLOCK_OPEN_NO_IO) {
+@@ -115,7 +113,7 @@ qcrypto_block_qcow_open(QCryptoBlock *block,
+             return -1;
+         }
+         return qcrypto_block_qcow_init(block, options->u.qcow.key_secret,
+-                                       n_threads, errp);
++                                       errp);
+     }
+ }
+ 
+@@ -135,7 +133,7 @@ qcrypto_block_qcow_create(QCryptoBlock *block,
+         return -1;
+     }
+     /* QCow2 has no special header, since everything is hardwired */
+-    return qcrypto_block_qcow_init(block, options->u.qcow.key_secret, 1, errp);
++    return qcrypto_block_qcow_init(block, options->u.qcow.key_secret, errp);
+ }
+ 
+ 
+diff --git a/crypto/block.c b/crypto/block.c
+index ba6d1cebc7..3bcc4270c3 100644
+--- a/crypto/block.c
++++ b/crypto/block.c
+@@ -53,7 +53,6 @@ QCryptoBlock *qcrypto_block_open(QCryptoBlockOpenOptions *options,
+                                  QCryptoBlockReadFunc readfunc,
+                                  void *opaque,
+                                  unsigned int flags,
+-                                 size_t n_threads,
+                                  Error **errp)
+ {
+     QCryptoBlock *block = g_new0(QCryptoBlock, 1);
+@@ -73,7 +72,7 @@ QCryptoBlock *qcrypto_block_open(QCryptoBlockOpenOptions *options,
+     block->driver = qcrypto_block_drivers[options->format];
+ 
+     if (block->driver->open(block, options, optprefix,
+-                            readfunc, opaque, flags, n_threads, errp) < 0)
++                            readfunc, opaque, flags, errp) < 0)
+     {
+         g_free(block);
+         return NULL;
+diff --git a/crypto/blockpriv.h b/crypto/blockpriv.h
+index 4bf6043d5d..b8f77cb5eb 100644
+--- a/crypto/blockpriv.h
++++ b/crypto/blockpriv.h
+@@ -59,7 +59,6 @@ struct QCryptoBlockDriver {
+                 QCryptoBlockReadFunc readfunc,
+                 void *opaque,
+                 unsigned int flags,
+-                size_t n_threads,
+                 Error **errp);
+ 
+     int (*create)(QCryptoBlock *block,
+diff --git a/include/crypto/block.h b/include/crypto/block.h
+index 92e823c9f2..5b5d039800 100644
+--- a/include/crypto/block.h
++++ b/include/crypto/block.h
+@@ -76,7 +76,6 @@ typedef enum {
+  * @readfunc: callback for reading data from the volume
+  * @opaque: data to pass to @readfunc
+  * @flags: bitmask of QCryptoBlockOpenFlags values
+- * @n_threads: allow concurrent I/O from up to @n_threads threads
+  * @errp: pointer to a NULL-initialized error object
+  *
+  * Create a new block encryption object for an existing
+@@ -113,7 +112,6 @@ QCryptoBlock *qcrypto_block_open(QCryptoBlockOpenOptions *options,
+                                  QCryptoBlockReadFunc readfunc,
+                                  void *opaque,
+                                  unsigned int flags,
+-                                 size_t n_threads,
+                                  Error **errp);
+ 
+ typedef enum {
+diff --git a/tests/unit/test-crypto-block.c b/tests/unit/test-crypto-block.c
+index 6cfc817a92..42cfab6067 100644
+--- a/tests/unit/test-crypto-block.c
++++ b/tests/unit/test-crypto-block.c
+@@ -303,7 +303,6 @@ static void test_block(gconstpointer opaque)
+                              test_block_read_func,
+                              &header,
+                              0,
+-                             1,
+                              NULL);
+     g_assert(blk == NULL);
+ 
+@@ -312,7 +311,6 @@ static void test_block(gconstpointer opaque)
+                              test_block_read_func,
+                              &header,
+                              QCRYPTO_BLOCK_OPEN_NO_IO,
+-                             1,
+                              &error_abort);
+ 
+     g_assert(qcrypto_block_get_cipher(blk) == NULL);
+@@ -327,7 +325,6 @@ static void test_block(gconstpointer opaque)
+                              test_block_read_func,
+                              &header,
+                              0,
+-                             1,
+                              &error_abort);
+     g_assert(blk);
+ 
+@@ -384,7 +381,6 @@ test_luks_bad_header(gconstpointer data)
+                              test_block_read_func,
+                              &buf,
+                              0,
+-                             1,
+                              &err);
+     g_assert(!blk);
+     g_assert(err);
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-dma-helpers-don-t-lock-AioContext-in-dma_blk_cb.patch b/SOURCES/kvm-dma-helpers-don-t-lock-AioContext-in-dma_blk_cb.patch
deleted file mode 100644
index 735f2a3..0000000
--- a/SOURCES/kvm-dma-helpers-don-t-lock-AioContext-in-dma_blk_cb.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-From ac9dc8ea241ef6d3a0447d696620d4d4053b71bf Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Mon, 4 Dec 2023 11:42:59 -0500
-Subject: [PATCH 080/101] dma-helpers: don't lock AioContext in dma_blk_cb()
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 214: Remove AioContext lock
-RH-Jira: RHEL-15965
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [11/26] a8580463ba6aee4ca248c0b947b9e72bd9e87aab (kmwolf/centos-qemu-kvm)
-
-Commit abfcd2760b3e ("dma-helpers: prevent dma_blk_cb() vs
-dma_aio_cancel() race") acquired the AioContext lock inside dma_blk_cb()
-to avoid a race with scsi_device_purge_requests() running in the main
-loop thread.
-
-The SCSI code no longer calls dma_aio_cancel() from the main loop thread
-while I/O is running in the IOThread AioContext. Therefore it is no
-longer necessary to take this lock to protect DMAAIOCB fields. The
-->cb() function also does not require the lock because blk_aio_*() and
-friends do not need the AioContext lock.
-
-Both hw/ide/core.c and hw/ide/macio.c also call dma_blk_io() but don't
-rely on it taking the AioContext lock, so this change is safe.
-
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Message-ID: <20231204164259.1515217-5-stefanha@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- system/dma-helpers.c | 7 ++-----
- 1 file changed, 2 insertions(+), 5 deletions(-)
-
-diff --git a/system/dma-helpers.c b/system/dma-helpers.c
-index 36211acc7e..528117f256 100644
---- a/system/dma-helpers.c
-+++ b/system/dma-helpers.c
-@@ -119,13 +119,12 @@ static void dma_blk_cb(void *opaque, int ret)
- 
-     trace_dma_blk_cb(dbs, ret);
- 
--    aio_context_acquire(ctx);
-     dbs->acb = NULL;
-     dbs->offset += dbs->iov.size;
- 
-     if (dbs->sg_cur_index == dbs->sg->nsg || ret < 0) {
-         dma_complete(dbs, ret);
--        goto out;
-+        return;
-     }
-     dma_blk_unmap(dbs);
- 
-@@ -168,7 +167,7 @@ static void dma_blk_cb(void *opaque, int ret)
-         trace_dma_map_wait(dbs);
-         dbs->bh = aio_bh_new(ctx, reschedule_dma, dbs);
-         cpu_register_map_client(dbs->bh);
--        goto out;
-+        return;
-     }
- 
-     if (!QEMU_IS_ALIGNED(dbs->iov.size, dbs->align)) {
-@@ -179,8 +178,6 @@ static void dma_blk_cb(void *opaque, int ret)
-     dbs->acb = dbs->io_func(dbs->offset, &dbs->iov,
-                             dma_blk_cb, dbs, dbs->io_func_opaque);
-     assert(dbs->acb);
--out:
--    aio_context_release(ctx);
- }
- 
- static void dma_aio_cancel(BlockAIOCB *acb)
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-docs-devel-Add-VFIO-iommufd-backend-documentation.patch b/SOURCES/kvm-docs-devel-Add-VFIO-iommufd-backend-documentation.patch
deleted file mode 100644
index dbe48d7..0000000
--- a/SOURCES/kvm-docs-devel-Add-VFIO-iommufd-backend-documentation.patch
+++ /dev/null
@@ -1,228 +0,0 @@
-From 71aa0219f7c84cbf175eb2a091d48d5fd5daa40b Mon Sep 17 00:00:00 2001
-From: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Date: Tue, 21 Nov 2023 16:44:26 +0800
-Subject: [PATCH 047/101] docs/devel: Add VFIO iommufd backend documentation
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [46/67] 6cf49d00e87788f894d690a985bb6798eae24505 (eauger1/centos-qemu-kvm)
-
-Suggested-by: Cédric Le Goater <clg@redhat.com>
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
-Signed-off-by: Yi Liu <yi.l.liu@intel.com>
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Tested-by: Nicolin Chen <nicolinc@nvidia.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 98dad2b01931f6064c6c4b48ca3c2a1d9f542cd8)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- MAINTAINERS                    |   1 +
- docs/devel/index-internals.rst |   1 +
- docs/devel/vfio-iommufd.rst    | 166 +++++++++++++++++++++++++++++++++
- 3 files changed, 168 insertions(+)
- create mode 100644 docs/devel/vfio-iommufd.rst
-
-diff --git a/MAINTAINERS b/MAINTAINERS
-index ca70bb4e64..0ddb20a35f 100644
---- a/MAINTAINERS
-+++ b/MAINTAINERS
-@@ -2176,6 +2176,7 @@ F: backends/iommufd.c
- F: include/sysemu/iommufd.h
- F: include/qemu/chardev_open.h
- F: util/chardev_open.c
-+F: docs/devel/vfio-iommufd.rst
- 
- vhost
- M: Michael S. Tsirkin <mst@redhat.com>
-diff --git a/docs/devel/index-internals.rst b/docs/devel/index-internals.rst
-index 6f81df92bc..3def4a138b 100644
---- a/docs/devel/index-internals.rst
-+++ b/docs/devel/index-internals.rst
-@@ -18,5 +18,6 @@ Details about QEMU's various subsystems including how to add features to them.
-    s390-dasd-ipl
-    tracing
-    vfio-migration
-+   vfio-iommufd
-    writing-monitor-commands
-    virtio-backends
-diff --git a/docs/devel/vfio-iommufd.rst b/docs/devel/vfio-iommufd.rst
-new file mode 100644
-index 0000000000..3d1c11f175
---- /dev/null
-+++ b/docs/devel/vfio-iommufd.rst
-@@ -0,0 +1,166 @@
-+===============================
-+IOMMUFD BACKEND usage with VFIO
-+===============================
-+
-+(Same meaning for backend/container/BE)
-+
-+With the introduction of iommufd, the Linux kernel provides a generic
-+interface for user space drivers to propagate their DMA mappings to kernel
-+for assigned devices. While the legacy kernel interface is group-centric,
-+the new iommufd interface is device-centric, relying on device fd and iommufd.
-+
-+To support both interfaces in the QEMU VFIO device, introduce a base container
-+to abstract the common part of VFIO legacy and iommufd container. So that the
-+generic VFIO code can use either container.
-+
-+The base container implements generic functions such as memory_listener and
-+address space management whereas the derived container implements callbacks
-+specific to either legacy or iommufd. Each container has its own way to setup
-+secure context and dma management interface. The below diagram shows how it
-+looks like with both containers.
-+
-+::
-+
-+                      VFIO                           AddressSpace/Memory
-+      +-------+  +----------+  +-----+  +-----+
-+      |  pci  |  | platform |  |  ap |  | ccw |
-+      +---+---+  +----+-----+  +--+--+  +--+--+     +----------------------+
-+          |           |           |        |        |   AddressSpace       |
-+          |           |           |        |        +------------+---------+
-+      +---V-----------V-----------V--------V----+               /
-+      |           VFIOAddressSpace              | <------------+
-+      |                  |                      |  MemoryListener
-+      |        VFIOContainerBase list           |
-+      +-------+----------------------------+----+
-+              |                            |
-+              |                            |
-+      +-------V------+            +--------V----------+
-+      |   iommufd    |            |    vfio legacy    |
-+      |  container   |            |     container     |
-+      +-------+------+            +--------+----------+
-+              |                            |
-+              | /dev/iommu                 | /dev/vfio/vfio
-+              | /dev/vfio/devices/vfioX    | /dev/vfio/$group_id
-+  Userspace   |                            |
-+  ============+============================+===========================
-+  Kernel      |  device fd                 |
-+              +---------------+            | group/container fd
-+              | (BIND_IOMMUFD |            | (SET_CONTAINER/SET_IOMMU)
-+              |  ATTACH_IOAS) |            | device fd
-+              |               |            |
-+              |       +-------V------------V-----------------+
-+      iommufd |       |                vfio                  |
-+  (map/unmap  |       +---------+--------------------+-------+
-+  ioas_copy)  |                 |                    | map/unmap
-+              |                 |                    |
-+       +------V------+    +-----V------+      +------V--------+
-+       | iommfd core |    |  device    |      |  vfio iommu   |
-+       +-------------+    +------------+      +---------------+
-+
-+* Secure Context setup
-+
-+  - iommufd BE: uses device fd and iommufd to setup secure context
-+    (bind_iommufd, attach_ioas)
-+  - vfio legacy BE: uses group fd and container fd to setup secure context
-+    (set_container, set_iommu)
-+
-+* Device access
-+
-+  - iommufd BE: device fd is opened through ``/dev/vfio/devices/vfioX``
-+  - vfio legacy BE: device fd is retrieved from group fd ioctl
-+
-+* DMA Mapping flow
-+
-+  1. VFIOAddressSpace receives MemoryRegion add/del via MemoryListener
-+  2. VFIO populates DMA map/unmap via the container BEs
-+     * iommufd BE: uses iommufd
-+     * vfio legacy BE: uses container fd
-+
-+Example configuration
-+=====================
-+
-+Step 1: configure the host device
-+---------------------------------
-+
-+It's exactly same as the VFIO device with legacy VFIO container.
-+
-+Step 2: configure QEMU
-+----------------------
-+
-+Interactions with the ``/dev/iommu`` are abstracted by a new iommufd
-+object (compiled in with the ``CONFIG_IOMMUFD`` option).
-+
-+Any QEMU device (e.g. VFIO device) wishing to use ``/dev/iommu`` must
-+be linked with an iommufd object. It gets a new optional property
-+named iommufd which allows to pass an iommufd object. Take ``vfio-pci``
-+device for example:
-+
-+.. code-block:: bash
-+
-+    -object iommufd,id=iommufd0
-+    -device vfio-pci,host=0000:02:00.0,iommufd=iommufd0
-+
-+Note the ``/dev/iommu`` and VFIO cdev can be externally opened by a
-+management layer. In such a case the fd is passed, the fd supports a
-+string naming the fd or a number, for example:
-+
-+.. code-block:: bash
-+
-+    -object iommufd,id=iommufd0,fd=22
-+    -device vfio-pci,iommufd=iommufd0,fd=23
-+
-+If the ``fd`` property is not passed, the fd is opened by QEMU.
-+
-+If no ``iommufd`` object is passed to the ``vfio-pci`` device, iommufd
-+is not used and the user gets the behavior based on the legacy VFIO
-+container:
-+
-+.. code-block:: bash
-+
-+    -device vfio-pci,host=0000:02:00.0
-+
-+Supported platform
-+==================
-+
-+Supports x86, ARM and s390x currently.
-+
-+Caveats
-+=======
-+
-+Dirty page sync
-+---------------
-+
-+Dirty page sync with iommufd backend is unsupported yet, live migration is
-+disabled by default. But it can be force enabled like below, low efficient
-+though.
-+
-+.. code-block:: bash
-+
-+    -object iommufd,id=iommufd0
-+    -device vfio-pci,host=0000:02:00.0,iommufd=iommufd0,enable-migration=on
-+
-+P2P DMA
-+-------
-+
-+PCI p2p DMA is unsupported as IOMMUFD doesn't support mapping hardware PCI
-+BAR region yet. Below warning shows for assigned PCI device, it's not a bug.
-+
-+.. code-block:: none
-+
-+    qemu-system-x86_64: warning: IOMMU_IOAS_MAP failed: Bad address, PCI BAR?
-+    qemu-system-x86_64: vfio_container_dma_map(0x560cb6cb1620, 0xe000000021000, 0x3000, 0x7f32ed55c000) = -14 (Bad address)
-+
-+FD passing with mdev
-+--------------------
-+
-+``vfio-pci`` device checks sysfsdev property to decide if backend is a mdev.
-+If FD passing is used, there is no way to know that and the mdev is treated
-+like a real PCI device. There is an error as below if user wants to enable
-+RAM discarding for mdev.
-+
-+.. code-block:: none
-+
-+    qemu-system-x86_64: -device vfio-pci,iommufd=iommufd0,x-balloon-allowed=on,fd=9: vfio VFIO_FD9: x-balloon-allowed only potentially compatible with mdev devices
-+
-+``vfio-ap`` and ``vfio-ccw`` devices don't have same issue as their backend
-+devices are always mdev and RAM discarding is force enabled.
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-docs-remove-AioContext-lock-from-IOThread-docs.patch b/SOURCES/kvm-docs-remove-AioContext-lock-from-IOThread-docs.patch
deleted file mode 100644
index 80adc69..0000000
--- a/SOURCES/kvm-docs-remove-AioContext-lock-from-IOThread-docs.patch
+++ /dev/null
@@ -1,98 +0,0 @@
-From fc69df3a70bed5722643cc16828ca20beae3a20d Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Tue, 5 Dec 2023 13:20:08 -0500
-Subject: [PATCH 091/101] docs: remove AioContext lock from IOThread docs
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 214: Remove AioContext lock
-RH-Jira: RHEL-15965
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [22/26] ab89cda483e74ded983d26e1c6e50217405e0a55 (kmwolf/centos-qemu-kvm)
-
-Encourage the use of locking primitives and stop mentioning the
-AioContext lock since it is being removed.
-
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Message-ID: <20231205182011.1976568-12-stefanha@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- docs/devel/multiple-iothreads.txt | 47 +++++++++++--------------------
- 1 file changed, 16 insertions(+), 31 deletions(-)
-
-diff --git a/docs/devel/multiple-iothreads.txt b/docs/devel/multiple-iothreads.txt
-index a3e949f6b3..4865196bde 100644
---- a/docs/devel/multiple-iothreads.txt
-+++ b/docs/devel/multiple-iothreads.txt
-@@ -88,27 +88,18 @@ loop, depending on which AioContext instance the caller passes in.
- 
- How to synchronize with an IOThread
- -----------------------------------
--AioContext is not thread-safe so some rules must be followed when using file
--descriptors, event notifiers, timers, or BHs across threads:
-+Variables that can be accessed by multiple threads require some form of
-+synchronization such as qemu_mutex_lock(), rcu_read_lock(), etc.
- 
--1. AioContext functions can always be called safely.  They handle their
--own locking internally.
--
--2. Other threads wishing to access the AioContext must use
--aio_context_acquire()/aio_context_release() for mutual exclusion.  Once the
--context is acquired no other thread can access it or run event loop iterations
--in this AioContext.
--
--Legacy code sometimes nests aio_context_acquire()/aio_context_release() calls.
--Do not use nesting anymore, it is incompatible with the BDRV_POLL_WHILE() macro
--used in the block layer and can lead to hangs.
--
--There is currently no lock ordering rule if a thread needs to acquire multiple
--AioContexts simultaneously.  Therefore, it is only safe for code holding the
--QEMU global mutex to acquire other AioContexts.
-+AioContext functions like aio_set_fd_handler(), aio_set_event_notifier(),
-+aio_bh_new(), and aio_timer_new() are thread-safe. They can be used to trigger
-+activity in an IOThread.
- 
- Side note: the best way to schedule a function call across threads is to call
--aio_bh_schedule_oneshot().  No acquire/release or locking is needed.
-+aio_bh_schedule_oneshot().
-+
-+The main loop thread can wait synchronously for a condition using
-+AIO_WAIT_WHILE().
- 
- AioContext and the block layer
- ------------------------------
-@@ -124,22 +115,16 @@ Block layer code must therefore expect to run in an IOThread and avoid using
- old APIs that implicitly use the main loop.  See the "How to program for
- IOThreads" above for information on how to do that.
- 
--If main loop code such as a QMP function wishes to access a BlockDriverState
--it must first call aio_context_acquire(bdrv_get_aio_context(bs)) to ensure
--that callbacks in the IOThread do not run in parallel.
--
- Code running in the monitor typically needs to ensure that past
- requests from the guest are completed.  When a block device is running
- in an IOThread, the IOThread can also process requests from the guest
- (via ioeventfd).  To achieve both objects, wrap the code between
- bdrv_drained_begin() and bdrv_drained_end(), thus creating a "drained
--section".  The functions must be called between aio_context_acquire()
--and aio_context_release().  You can freely release and re-acquire the
--AioContext within a drained section.
--
--Long-running jobs (usually in the form of coroutines) are best scheduled in
--the BlockDriverState's AioContext to avoid the need to acquire/release around
--each bdrv_*() call.  The functions bdrv_add/remove_aio_context_notifier,
--or alternatively blk_add/remove_aio_context_notifier if you use BlockBackends,
--can be used to get a notification whenever bdrv_try_change_aio_context() moves a
-+section".
-+
-+Long-running jobs (usually in the form of coroutines) are often scheduled in
-+the BlockDriverState's AioContext.  The functions
-+bdrv_add/remove_aio_context_notifier, or alternatively
-+blk_add/remove_aio_context_notifier if you use BlockBackends, can be used to
-+get a notification whenever bdrv_try_change_aio_context() moves a
- BlockDriverState to a different AioContext.
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-graph-lock-remove-AioContext-locking.patch b/SOURCES/kvm-graph-lock-remove-AioContext-locking.patch
deleted file mode 100644
index 2fff9ba..0000000
--- a/SOURCES/kvm-graph-lock-remove-AioContext-locking.patch
+++ /dev/null
@@ -1,1190 +0,0 @@
-From 57d96b5774fab588c6bb6812ef8ef281ffe018d7 Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Tue, 5 Dec 2023 13:20:02 -0500
-Subject: [PATCH 085/101] graph-lock: remove AioContext locking
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 214: Remove AioContext lock
-RH-Jira: RHEL-15965
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [16/26] 9575a8b834aaaa03abaf869e96f0808172e87824 (kmwolf/centos-qemu-kvm)
-
-Stop acquiring/releasing the AioContext lock in
-bdrv_graph_wrlock()/bdrv_graph_unlock() since the lock no longer has any
-effect.
-
-The distinction between bdrv_graph_wrunlock() and
-bdrv_graph_wrunlock_ctx() becomes meaningless and they can be collapsed
-into one function.
-
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Message-ID: <20231205182011.1976568-6-stefanha@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- block.c                            | 50 +++++++++++++++---------------
- block/backup.c                     |  4 +--
- block/blklogwrites.c               |  8 ++---
- block/blkverify.c                  |  4 +--
- block/block-backend.c              | 11 +++----
- block/commit.c                     | 16 +++++-----
- block/graph-lock.c                 | 44 ++------------------------
- block/mirror.c                     | 22 ++++++-------
- block/qcow2.c                      |  4 +--
- block/quorum.c                     |  8 ++---
- block/replication.c                | 14 ++++-----
- block/snapshot.c                   |  4 +--
- block/stream.c                     | 12 +++----
- block/vmdk.c                       | 20 ++++++------
- blockdev.c                         |  8 ++---
- blockjob.c                         | 12 +++----
- include/block/graph-lock.h         | 21 ++-----------
- scripts/block-coroutine-wrapper.py |  4 +--
- tests/unit/test-bdrv-drain.c       | 40 ++++++++++++------------
- tests/unit/test-bdrv-graph-mod.c   | 20 ++++++------
- 20 files changed, 133 insertions(+), 193 deletions(-)
-
-diff --git a/block.c b/block.c
-index bfb0861ec6..25e1ebc606 100644
---- a/block.c
-+++ b/block.c
-@@ -1708,12 +1708,12 @@ bdrv_open_driver(BlockDriverState *bs, BlockDriver *drv, const char *node_name,
- open_failed:
-     bs->drv = NULL;
- 
--    bdrv_graph_wrlock(NULL);
-+    bdrv_graph_wrlock();
-     if (bs->file != NULL) {
-         bdrv_unref_child(bs, bs->file);
-         assert(!bs->file);
-     }
--    bdrv_graph_wrunlock(NULL);
-+    bdrv_graph_wrunlock();
- 
-     g_free(bs->opaque);
-     bs->opaque = NULL;
-@@ -3575,9 +3575,9 @@ int bdrv_set_backing_hd(BlockDriverState *bs, BlockDriverState *backing_hd,
- 
-     bdrv_ref(drain_bs);
-     bdrv_drained_begin(drain_bs);
--    bdrv_graph_wrlock(backing_hd);
-+    bdrv_graph_wrlock();
-     ret = bdrv_set_backing_hd_drained(bs, backing_hd, errp);
--    bdrv_graph_wrunlock(backing_hd);
-+    bdrv_graph_wrunlock();
-     bdrv_drained_end(drain_bs);
-     bdrv_unref(drain_bs);
- 
-@@ -3790,13 +3790,13 @@ BdrvChild *bdrv_open_child(const char *filename,
-         return NULL;
-     }
- 
--    bdrv_graph_wrlock(NULL);
-+    bdrv_graph_wrlock();
-     ctx = bdrv_get_aio_context(bs);
-     aio_context_acquire(ctx);
-     child = bdrv_attach_child(parent, bs, bdref_key, child_class, child_role,
-                               errp);
-     aio_context_release(ctx);
--    bdrv_graph_wrunlock(NULL);
-+    bdrv_graph_wrunlock();
- 
-     return child;
- }
-@@ -4650,9 +4650,9 @@ int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp)
-         aio_context_release(ctx);
-     }
- 
--    bdrv_graph_wrlock(NULL);
-+    bdrv_graph_wrlock();
-     tran_commit(tran);
--    bdrv_graph_wrunlock(NULL);
-+    bdrv_graph_wrunlock();
- 
-     QTAILQ_FOREACH_REVERSE(bs_entry, bs_queue, entry) {
-         BlockDriverState *bs = bs_entry->state.bs;
-@@ -4669,9 +4669,9 @@ int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp)
-     goto cleanup;
- 
- abort:
--    bdrv_graph_wrlock(NULL);
-+    bdrv_graph_wrlock();
-     tran_abort(tran);
--    bdrv_graph_wrunlock(NULL);
-+    bdrv_graph_wrunlock();
- 
-     QTAILQ_FOREACH_SAFE(bs_entry, bs_queue, entry, next) {
-         if (bs_entry->prepared) {
-@@ -4852,12 +4852,12 @@ bdrv_reopen_parse_file_or_backing(BDRVReopenState *reopen_state,
-     }
- 
-     bdrv_graph_rdunlock_main_loop();
--    bdrv_graph_wrlock(new_child_bs);
-+    bdrv_graph_wrlock();
- 
-     ret = bdrv_set_file_or_backing_noperm(bs, new_child_bs, is_backing,
-                                           tran, errp);
- 
--    bdrv_graph_wrunlock_ctx(ctx);
-+    bdrv_graph_wrunlock();
- 
-     if (old_ctx != ctx) {
-         aio_context_release(ctx);
-@@ -5209,14 +5209,14 @@ static void bdrv_close(BlockDriverState *bs)
-         bs->drv = NULL;
-     }
- 
--    bdrv_graph_wrlock(bs);
-+    bdrv_graph_wrlock();
-     QLIST_FOREACH_SAFE(child, &bs->children, next, next) {
-         bdrv_unref_child(bs, child);
-     }
- 
-     assert(!bs->backing);
-     assert(!bs->file);
--    bdrv_graph_wrunlock(bs);
-+    bdrv_graph_wrunlock();
- 
-     g_free(bs->opaque);
-     bs->opaque = NULL;
-@@ -5509,9 +5509,9 @@ int bdrv_drop_filter(BlockDriverState *bs, Error **errp)
-     bdrv_graph_rdunlock_main_loop();
- 
-     bdrv_drained_begin(child_bs);
--    bdrv_graph_wrlock(bs);
-+    bdrv_graph_wrlock();
-     ret = bdrv_replace_node_common(bs, child_bs, true, true, errp);
--    bdrv_graph_wrunlock(bs);
-+    bdrv_graph_wrunlock();
-     bdrv_drained_end(child_bs);
- 
-     return ret;
-@@ -5561,7 +5561,7 @@ int bdrv_append(BlockDriverState *bs_new, BlockDriverState *bs_top,
-     aio_context_acquire(old_context);
-     new_context = NULL;
- 
--    bdrv_graph_wrlock(bs_top);
-+    bdrv_graph_wrlock();
- 
-     child = bdrv_attach_child_noperm(bs_new, bs_top, "backing",
-                                      &child_of_bds, bdrv_backing_role(bs_new),
-@@ -5593,7 +5593,7 @@ out:
-     tran_finalize(tran, ret);
- 
-     bdrv_refresh_limits(bs_top, NULL, NULL);
--    bdrv_graph_wrunlock(bs_top);
-+    bdrv_graph_wrunlock();
- 
-     bdrv_drained_end(bs_top);
-     bdrv_drained_end(bs_new);
-@@ -5620,7 +5620,7 @@ int bdrv_replace_child_bs(BdrvChild *child, BlockDriverState *new_bs,
-     bdrv_ref(old_bs);
-     bdrv_drained_begin(old_bs);
-     bdrv_drained_begin(new_bs);
--    bdrv_graph_wrlock(new_bs);
-+    bdrv_graph_wrlock();
- 
-     bdrv_replace_child_tran(child, new_bs, tran);
- 
-@@ -5631,7 +5631,7 @@ int bdrv_replace_child_bs(BdrvChild *child, BlockDriverState *new_bs,
- 
-     tran_finalize(tran, ret);
- 
--    bdrv_graph_wrunlock(new_bs);
-+    bdrv_graph_wrunlock();
-     bdrv_drained_end(old_bs);
-     bdrv_drained_end(new_bs);
-     bdrv_unref(old_bs);
-@@ -5718,9 +5718,9 @@ BlockDriverState *bdrv_insert_node(BlockDriverState *bs, QDict *options,
-     bdrv_ref(bs);
-     bdrv_drained_begin(bs);
-     bdrv_drained_begin(new_node_bs);
--    bdrv_graph_wrlock(new_node_bs);
-+    bdrv_graph_wrlock();
-     ret = bdrv_replace_node(bs, new_node_bs, errp);
--    bdrv_graph_wrunlock(new_node_bs);
-+    bdrv_graph_wrunlock();
-     bdrv_drained_end(new_node_bs);
-     bdrv_drained_end(bs);
-     bdrv_unref(bs);
-@@ -5975,7 +5975,7 @@ int bdrv_drop_intermediate(BlockDriverState *top, BlockDriverState *base,
- 
-     bdrv_ref(top);
-     bdrv_drained_begin(base);
--    bdrv_graph_wrlock(base);
-+    bdrv_graph_wrlock();
- 
-     if (!top->drv || !base->drv) {
-         goto exit_wrlock;
-@@ -6015,7 +6015,7 @@ int bdrv_drop_intermediate(BlockDriverState *top, BlockDriverState *base,
-      * That's a FIXME.
-      */
-     bdrv_replace_node_common(top, base, false, false, &local_err);
--    bdrv_graph_wrunlock(base);
-+    bdrv_graph_wrunlock();
- 
-     if (local_err) {
-         error_report_err(local_err);
-@@ -6052,7 +6052,7 @@ int bdrv_drop_intermediate(BlockDriverState *top, BlockDriverState *base,
-     goto exit;
- 
- exit_wrlock:
--    bdrv_graph_wrunlock(base);
-+    bdrv_graph_wrunlock();
- exit:
-     bdrv_drained_end(base);
-     bdrv_unref(top);
-diff --git a/block/backup.c b/block/backup.c
-index 8aae5836d7..ec29d6b810 100644
---- a/block/backup.c
-+++ b/block/backup.c
-@@ -496,10 +496,10 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
-     block_copy_set_speed(bcs, speed);
- 
-     /* Required permissions are taken by copy-before-write filter target */
--    bdrv_graph_wrlock(target);
-+    bdrv_graph_wrlock();
-     block_job_add_bdrv(&job->common, "target", target, 0, BLK_PERM_ALL,
-                        &error_abort);
--    bdrv_graph_wrunlock(target);
-+    bdrv_graph_wrunlock();
- 
-     return &job->common;
- 
-diff --git a/block/blklogwrites.c b/block/blklogwrites.c
-index 3678f6cf42..7207b2e757 100644
---- a/block/blklogwrites.c
-+++ b/block/blklogwrites.c
-@@ -251,9 +251,9 @@ static int blk_log_writes_open(BlockDriverState *bs, QDict *options, int flags,
-     ret = 0;
- fail_log:
-     if (ret < 0) {
--        bdrv_graph_wrlock(NULL);
-+        bdrv_graph_wrlock();
-         bdrv_unref_child(bs, s->log_file);
--        bdrv_graph_wrunlock(NULL);
-+        bdrv_graph_wrunlock();
-         s->log_file = NULL;
-     }
- fail:
-@@ -265,10 +265,10 @@ static void blk_log_writes_close(BlockDriverState *bs)
- {
-     BDRVBlkLogWritesState *s = bs->opaque;
- 
--    bdrv_graph_wrlock(NULL);
-+    bdrv_graph_wrlock();
-     bdrv_unref_child(bs, s->log_file);
-     s->log_file = NULL;
--    bdrv_graph_wrunlock(NULL);
-+    bdrv_graph_wrunlock();
- }
- 
- static int64_t coroutine_fn GRAPH_RDLOCK
-diff --git a/block/blkverify.c b/block/blkverify.c
-index 9b17c46644..ec45d8335e 100644
---- a/block/blkverify.c
-+++ b/block/blkverify.c
-@@ -151,10 +151,10 @@ static void blkverify_close(BlockDriverState *bs)
- {
-     BDRVBlkverifyState *s = bs->opaque;
- 
--    bdrv_graph_wrlock(NULL);
-+    bdrv_graph_wrlock();
-     bdrv_unref_child(bs, s->test_file);
-     s->test_file = NULL;
--    bdrv_graph_wrunlock(NULL);
-+    bdrv_graph_wrunlock();
- }
- 
- static int64_t coroutine_fn GRAPH_RDLOCK
-diff --git a/block/block-backend.c b/block/block-backend.c
-index ec21148806..abac4e0235 100644
---- a/block/block-backend.c
-+++ b/block/block-backend.c
-@@ -889,7 +889,6 @@ void blk_remove_bs(BlockBackend *blk)
- {
-     ThrottleGroupMember *tgm = &blk->public.throttle_group_member;
-     BdrvChild *root;
--    AioContext *ctx;
- 
-     GLOBAL_STATE_CODE();
- 
-@@ -919,10 +918,9 @@ void blk_remove_bs(BlockBackend *blk)
-     root = blk->root;
-     blk->root = NULL;
- 
--    ctx = bdrv_get_aio_context(root->bs);
--    bdrv_graph_wrlock(root->bs);
-+    bdrv_graph_wrlock();
-     bdrv_root_unref_child(root);
--    bdrv_graph_wrunlock_ctx(ctx);
-+    bdrv_graph_wrunlock();
- }
- 
- /*
-@@ -933,16 +931,15 @@ void blk_remove_bs(BlockBackend *blk)
- int blk_insert_bs(BlockBackend *blk, BlockDriverState *bs, Error **errp)
- {
-     ThrottleGroupMember *tgm = &blk->public.throttle_group_member;
--    AioContext *ctx = bdrv_get_aio_context(bs);
- 
-     GLOBAL_STATE_CODE();
-     bdrv_ref(bs);
--    bdrv_graph_wrlock(bs);
-+    bdrv_graph_wrlock();
-     blk->root = bdrv_root_attach_child(bs, "root", &child_root,
-                                        BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
-                                        blk->perm, blk->shared_perm,
-                                        blk, errp);
--    bdrv_graph_wrunlock_ctx(ctx);
-+    bdrv_graph_wrunlock();
-     if (blk->root == NULL) {
-         return -EPERM;
-     }
-diff --git a/block/commit.c b/block/commit.c
-index 69cc75be0c..1dd7a65ffb 100644
---- a/block/commit.c
-+++ b/block/commit.c
-@@ -100,9 +100,9 @@ static void commit_abort(Job *job)
-     bdrv_graph_rdunlock_main_loop();
- 
-     bdrv_drained_begin(commit_top_backing_bs);
--    bdrv_graph_wrlock(commit_top_backing_bs);
-+    bdrv_graph_wrlock();
-     bdrv_replace_node(s->commit_top_bs, commit_top_backing_bs, &error_abort);
--    bdrv_graph_wrunlock(commit_top_backing_bs);
-+    bdrv_graph_wrunlock();
-     bdrv_drained_end(commit_top_backing_bs);
- 
-     bdrv_unref(s->commit_top_bs);
-@@ -339,7 +339,7 @@ void commit_start(const char *job_id, BlockDriverState *bs,
-      * this is the responsibility of the interface (i.e. whoever calls
-      * commit_start()).
-      */
--    bdrv_graph_wrlock(top);
-+    bdrv_graph_wrlock();
-     s->base_overlay = bdrv_find_overlay(top, base);
-     assert(s->base_overlay);
- 
-@@ -370,19 +370,19 @@ void commit_start(const char *job_id, BlockDriverState *bs,
-         ret = block_job_add_bdrv(&s->common, "intermediate node", iter, 0,
-                                  iter_shared_perms, errp);
-         if (ret < 0) {
--            bdrv_graph_wrunlock(top);
-+            bdrv_graph_wrunlock();
-             goto fail;
-         }
-     }
- 
-     if (bdrv_freeze_backing_chain(commit_top_bs, base, errp) < 0) {
--        bdrv_graph_wrunlock(top);
-+        bdrv_graph_wrunlock();
-         goto fail;
-     }
-     s->chain_frozen = true;
- 
-     ret = block_job_add_bdrv(&s->common, "base", base, 0, BLK_PERM_ALL, errp);
--    bdrv_graph_wrunlock(top);
-+    bdrv_graph_wrunlock();
- 
-     if (ret < 0) {
-         goto fail;
-@@ -434,9 +434,9 @@ fail:
-      * otherwise this would fail because of lack of permissions. */
-     if (commit_top_bs) {
-         bdrv_drained_begin(top);
--        bdrv_graph_wrlock(top);
-+        bdrv_graph_wrlock();
-         bdrv_replace_node(commit_top_bs, top, &error_abort);
--        bdrv_graph_wrunlock(top);
-+        bdrv_graph_wrunlock();
-         bdrv_drained_end(top);
-     }
- }
-diff --git a/block/graph-lock.c b/block/graph-lock.c
-index 079e878d9b..c81162b147 100644
---- a/block/graph-lock.c
-+++ b/block/graph-lock.c
-@@ -106,27 +106,12 @@ static uint32_t reader_count(void)
-     return rd;
- }
- 
--void no_coroutine_fn bdrv_graph_wrlock(BlockDriverState *bs)
-+void no_coroutine_fn bdrv_graph_wrlock(void)
- {
--    AioContext *ctx = NULL;
--
-     GLOBAL_STATE_CODE();
-     assert(!qatomic_read(&has_writer));
-     assert(!qemu_in_coroutine());
- 
--    /*
--     * Release only non-mainloop AioContext. The mainloop often relies on the
--     * BQL and doesn't lock the main AioContext before doing things.
--     */
--    if (bs) {
--        ctx = bdrv_get_aio_context(bs);
--        if (ctx != qemu_get_aio_context()) {
--            aio_context_release(ctx);
--        } else {
--            ctx = NULL;
--        }
--    }
--
-     /* Make sure that constantly arriving new I/O doesn't cause starvation */
-     bdrv_drain_all_begin_nopoll();
- 
-@@ -155,27 +140,13 @@ void no_coroutine_fn bdrv_graph_wrlock(BlockDriverState *bs)
-     } while (reader_count() >= 1);
- 
-     bdrv_drain_all_end();
--
--    if (ctx) {
--        aio_context_acquire(bdrv_get_aio_context(bs));
--    }
- }
- 
--void no_coroutine_fn bdrv_graph_wrunlock_ctx(AioContext *ctx)
-+void no_coroutine_fn bdrv_graph_wrunlock(void)
- {
-     GLOBAL_STATE_CODE();
-     assert(qatomic_read(&has_writer));
- 
--    /*
--     * Release only non-mainloop AioContext. The mainloop often relies on the
--     * BQL and doesn't lock the main AioContext before doing things.
--     */
--    if (ctx && ctx != qemu_get_aio_context()) {
--        aio_context_release(ctx);
--    } else {
--        ctx = NULL;
--    }
--
-     WITH_QEMU_LOCK_GUARD(&aio_context_list_lock) {
-         /*
-          * No need for memory barriers, this works in pair with
-@@ -197,17 +168,6 @@ void no_coroutine_fn bdrv_graph_wrunlock_ctx(AioContext *ctx)
-      * progress.
-      */
-     aio_bh_poll(qemu_get_aio_context());
--
--    if (ctx) {
--        aio_context_acquire(ctx);
--    }
--}
--
--void no_coroutine_fn bdrv_graph_wrunlock(BlockDriverState *bs)
--{
--    AioContext *ctx = bs ? bdrv_get_aio_context(bs) : NULL;
--
--    bdrv_graph_wrunlock_ctx(ctx);
- }
- 
- void coroutine_fn bdrv_graph_co_rdlock(void)
-diff --git a/block/mirror.c b/block/mirror.c
-index cd9d3ad4a8..51f9e2f17c 100644
---- a/block/mirror.c
-+++ b/block/mirror.c
-@@ -764,7 +764,7 @@ static int mirror_exit_common(Job *job)
-          * check for an op blocker on @to_replace, and we have our own
-          * there.
-          */
--        bdrv_graph_wrlock(target_bs);
-+        bdrv_graph_wrlock();
-         if (bdrv_recurse_can_replace(src, to_replace)) {
-             bdrv_replace_node(to_replace, target_bs, &local_err);
-         } else {
-@@ -773,7 +773,7 @@ static int mirror_exit_common(Job *job)
-                        "would not lead to an abrupt change of visible data",
-                        to_replace->node_name, target_bs->node_name);
-         }
--        bdrv_graph_wrunlock(target_bs);
-+        bdrv_graph_wrunlock();
-         bdrv_drained_end(to_replace);
-         if (local_err) {
-             error_report_err(local_err);
-@@ -796,9 +796,9 @@ static int mirror_exit_common(Job *job)
-      * valid.
-      */
-     block_job_remove_all_bdrv(bjob);
--    bdrv_graph_wrlock(mirror_top_bs);
-+    bdrv_graph_wrlock();
-     bdrv_replace_node(mirror_top_bs, mirror_top_bs->backing->bs, &error_abort);
--    bdrv_graph_wrunlock(mirror_top_bs);
-+    bdrv_graph_wrunlock();
- 
-     bdrv_drained_end(target_bs);
-     bdrv_unref(target_bs);
-@@ -1914,13 +1914,13 @@ static BlockJob *mirror_start_job(
-      */
-     bdrv_disable_dirty_bitmap(s->dirty_bitmap);
- 
--    bdrv_graph_wrlock(bs);
-+    bdrv_graph_wrlock();
-     ret = block_job_add_bdrv(&s->common, "source", bs, 0,
-                              BLK_PERM_WRITE_UNCHANGED | BLK_PERM_WRITE |
-                              BLK_PERM_CONSISTENT_READ,
-                              errp);
-     if (ret < 0) {
--        bdrv_graph_wrunlock(bs);
-+        bdrv_graph_wrunlock();
-         goto fail;
-     }
- 
-@@ -1965,17 +1965,17 @@ static BlockJob *mirror_start_job(
-             ret = block_job_add_bdrv(&s->common, "intermediate node", iter, 0,
-                                      iter_shared_perms, errp);
-             if (ret < 0) {
--                bdrv_graph_wrunlock(bs);
-+                bdrv_graph_wrunlock();
-                 goto fail;
-             }
-         }
- 
-         if (bdrv_freeze_backing_chain(mirror_top_bs, target, errp) < 0) {
--            bdrv_graph_wrunlock(bs);
-+            bdrv_graph_wrunlock();
-             goto fail;
-         }
-     }
--    bdrv_graph_wrunlock(bs);
-+    bdrv_graph_wrunlock();
- 
-     QTAILQ_INIT(&s->ops_in_flight);
- 
-@@ -2001,12 +2001,12 @@ fail:
- 
-     bs_opaque->stop = true;
-     bdrv_drained_begin(bs);
--    bdrv_graph_wrlock(bs);
-+    bdrv_graph_wrlock();
-     assert(mirror_top_bs->backing->bs == bs);
-     bdrv_child_refresh_perms(mirror_top_bs, mirror_top_bs->backing,
-                              &error_abort);
-     bdrv_replace_node(mirror_top_bs, bs, &error_abort);
--    bdrv_graph_wrunlock(bs);
-+    bdrv_graph_wrunlock();
-     bdrv_drained_end(bs);
- 
-     bdrv_unref(mirror_top_bs);
-diff --git a/block/qcow2.c b/block/qcow2.c
-index 7968735346..d91b7b91d3 100644
---- a/block/qcow2.c
-+++ b/block/qcow2.c
-@@ -2813,9 +2813,9 @@ qcow2_do_close(BlockDriverState *bs, bool close_data_file)
-     if (close_data_file && has_data_file(bs)) {
-         GLOBAL_STATE_CODE();
-         bdrv_graph_rdunlock_main_loop();
--        bdrv_graph_wrlock(NULL);
-+        bdrv_graph_wrlock();
-         bdrv_unref_child(bs, s->data_file);
--        bdrv_graph_wrunlock(NULL);
-+        bdrv_graph_wrunlock();
-         s->data_file = NULL;
-         bdrv_graph_rdlock_main_loop();
-     }
-diff --git a/block/quorum.c b/block/quorum.c
-index 505b8b3e18..db8fe891c4 100644
---- a/block/quorum.c
-+++ b/block/quorum.c
-@@ -1037,14 +1037,14 @@ static int quorum_open(BlockDriverState *bs, QDict *options, int flags,
- 
- close_exit:
-     /* cleanup on error */
--    bdrv_graph_wrlock(NULL);
-+    bdrv_graph_wrlock();
-     for (i = 0; i < s->num_children; i++) {
-         if (!opened[i]) {
-             continue;
-         }
-         bdrv_unref_child(bs, s->children[i]);
-     }
--    bdrv_graph_wrunlock(NULL);
-+    bdrv_graph_wrunlock();
-     g_free(s->children);
-     g_free(opened);
- exit:
-@@ -1057,11 +1057,11 @@ static void quorum_close(BlockDriverState *bs)
-     BDRVQuorumState *s = bs->opaque;
-     int i;
- 
--    bdrv_graph_wrlock(NULL);
-+    bdrv_graph_wrlock();
-     for (i = 0; i < s->num_children; i++) {
-         bdrv_unref_child(bs, s->children[i]);
-     }
--    bdrv_graph_wrunlock(NULL);
-+    bdrv_graph_wrunlock();
- 
-     g_free(s->children);
- }
-diff --git a/block/replication.c b/block/replication.c
-index 5ded5f1ca9..424b537ff7 100644
---- a/block/replication.c
-+++ b/block/replication.c
-@@ -560,7 +560,7 @@ static void replication_start(ReplicationState *rs, ReplicationMode mode,
-             return;
-         }
- 
--        bdrv_graph_wrlock(bs);
-+        bdrv_graph_wrlock();
- 
-         bdrv_ref(hidden_disk->bs);
-         s->hidden_disk = bdrv_attach_child(bs, hidden_disk->bs, "hidden disk",
-@@ -568,7 +568,7 @@ static void replication_start(ReplicationState *rs, ReplicationMode mode,
-                                            &local_err);
-         if (local_err) {
-             error_propagate(errp, local_err);
--            bdrv_graph_wrunlock(bs);
-+            bdrv_graph_wrunlock();
-             aio_context_release(aio_context);
-             return;
-         }
-@@ -579,7 +579,7 @@ static void replication_start(ReplicationState *rs, ReplicationMode mode,
-                                               BDRV_CHILD_DATA, &local_err);
-         if (local_err) {
-             error_propagate(errp, local_err);
--            bdrv_graph_wrunlock(bs);
-+            bdrv_graph_wrunlock();
-             aio_context_release(aio_context);
-             return;
-         }
-@@ -592,7 +592,7 @@ static void replication_start(ReplicationState *rs, ReplicationMode mode,
-         if (!top_bs || !bdrv_is_root_node(top_bs) ||
-             !check_top_bs(top_bs, bs)) {
-             error_setg(errp, "No top_bs or it is invalid");
--            bdrv_graph_wrunlock(bs);
-+            bdrv_graph_wrunlock();
-             reopen_backing_file(bs, false, NULL);
-             aio_context_release(aio_context);
-             return;
-@@ -600,7 +600,7 @@ static void replication_start(ReplicationState *rs, ReplicationMode mode,
-         bdrv_op_block_all(top_bs, s->blocker);
-         bdrv_op_unblock(top_bs, BLOCK_OP_TYPE_DATAPLANE, s->blocker);
- 
--        bdrv_graph_wrunlock(bs);
-+        bdrv_graph_wrunlock();
- 
-         s->backup_job = backup_job_create(
-                                 NULL, s->secondary_disk->bs, s->hidden_disk->bs,
-@@ -691,12 +691,12 @@ static void replication_done(void *opaque, int ret)
-     if (ret == 0) {
-         s->stage = BLOCK_REPLICATION_DONE;
- 
--        bdrv_graph_wrlock(NULL);
-+        bdrv_graph_wrlock();
-         bdrv_unref_child(bs, s->secondary_disk);
-         s->secondary_disk = NULL;
-         bdrv_unref_child(bs, s->hidden_disk);
-         s->hidden_disk = NULL;
--        bdrv_graph_wrunlock(NULL);
-+        bdrv_graph_wrunlock();
- 
-         s->error = 0;
-     } else {
-diff --git a/block/snapshot.c b/block/snapshot.c
-index ec8cf4810b..e486d3e205 100644
---- a/block/snapshot.c
-+++ b/block/snapshot.c
-@@ -290,9 +290,9 @@ int bdrv_snapshot_goto(BlockDriverState *bs,
-         }
- 
-         /* .bdrv_open() will re-attach it */
--        bdrv_graph_wrlock(NULL);
-+        bdrv_graph_wrlock();
-         bdrv_unref_child(bs, fallback);
--        bdrv_graph_wrunlock(NULL);
-+        bdrv_graph_wrunlock();
- 
-         ret = bdrv_snapshot_goto(fallback_bs, snapshot_id, errp);
-         open_ret = drv->bdrv_open(bs, options, bs->open_flags, &local_err);
-diff --git a/block/stream.c b/block/stream.c
-index 01fe7c0f16..048c2d282f 100644
---- a/block/stream.c
-+++ b/block/stream.c
-@@ -99,9 +99,9 @@ static int stream_prepare(Job *job)
-             }
-         }
- 
--        bdrv_graph_wrlock(s->target_bs);
-+        bdrv_graph_wrlock();
-         bdrv_set_backing_hd_drained(unfiltered_bs, base, &local_err);
--        bdrv_graph_wrunlock(s->target_bs);
-+        bdrv_graph_wrunlock();
- 
-         /*
-          * This call will do I/O, so the graph can change again from here on.
-@@ -366,10 +366,10 @@ void stream_start(const char *job_id, BlockDriverState *bs,
-      * already have our own plans. Also don't allow resize as the image size is
-      * queried only at the job start and then cached.
-      */
--    bdrv_graph_wrlock(bs);
-+    bdrv_graph_wrlock();
-     if (block_job_add_bdrv(&s->common, "active node", bs, 0,
-                            basic_flags | BLK_PERM_WRITE, errp)) {
--        bdrv_graph_wrunlock(bs);
-+        bdrv_graph_wrunlock();
-         goto fail;
-     }
- 
-@@ -389,11 +389,11 @@ void stream_start(const char *job_id, BlockDriverState *bs,
-         ret = block_job_add_bdrv(&s->common, "intermediate node", iter, 0,
-                                  basic_flags, errp);
-         if (ret < 0) {
--            bdrv_graph_wrunlock(bs);
-+            bdrv_graph_wrunlock();
-             goto fail;
-         }
-     }
--    bdrv_graph_wrunlock(bs);
-+    bdrv_graph_wrunlock();
- 
-     s->base_overlay = base_overlay;
-     s->above_base = above_base;
-diff --git a/block/vmdk.c b/block/vmdk.c
-index d6971c7067..bf78e12383 100644
---- a/block/vmdk.c
-+++ b/block/vmdk.c
-@@ -272,7 +272,7 @@ static void vmdk_free_extents(BlockDriverState *bs)
-     BDRVVmdkState *s = bs->opaque;
-     VmdkExtent *e;
- 
--    bdrv_graph_wrlock(NULL);
-+    bdrv_graph_wrlock();
-     for (i = 0; i < s->num_extents; i++) {
-         e = &s->extents[i];
-         g_free(e->l1_table);
-@@ -283,7 +283,7 @@ static void vmdk_free_extents(BlockDriverState *bs)
-             bdrv_unref_child(bs, e->file);
-         }
-     }
--    bdrv_graph_wrunlock(NULL);
-+    bdrv_graph_wrunlock();
- 
-     g_free(s->extents);
- }
-@@ -1247,9 +1247,9 @@ vmdk_parse_extents(const char *desc, BlockDriverState *bs, QDict *options,
-                             0, 0, 0, 0, 0, &extent, errp);
-             if (ret < 0) {
-                 bdrv_graph_rdunlock_main_loop();
--                bdrv_graph_wrlock(NULL);
-+                bdrv_graph_wrlock();
-                 bdrv_unref_child(bs, extent_file);
--                bdrv_graph_wrunlock(NULL);
-+                bdrv_graph_wrunlock();
-                 bdrv_graph_rdlock_main_loop();
-                 goto out;
-             }
-@@ -1266,9 +1266,9 @@ vmdk_parse_extents(const char *desc, BlockDriverState *bs, QDict *options,
-             g_free(buf);
-             if (ret) {
-                 bdrv_graph_rdunlock_main_loop();
--                bdrv_graph_wrlock(NULL);
-+                bdrv_graph_wrlock();
-                 bdrv_unref_child(bs, extent_file);
--                bdrv_graph_wrunlock(NULL);
-+                bdrv_graph_wrunlock();
-                 bdrv_graph_rdlock_main_loop();
-                 goto out;
-             }
-@@ -1277,9 +1277,9 @@ vmdk_parse_extents(const char *desc, BlockDriverState *bs, QDict *options,
-             ret = vmdk_open_se_sparse(bs, extent_file, bs->open_flags, errp);
-             if (ret) {
-                 bdrv_graph_rdunlock_main_loop();
--                bdrv_graph_wrlock(NULL);
-+                bdrv_graph_wrlock();
-                 bdrv_unref_child(bs, extent_file);
--                bdrv_graph_wrunlock(NULL);
-+                bdrv_graph_wrunlock();
-                 bdrv_graph_rdlock_main_loop();
-                 goto out;
-             }
-@@ -1287,9 +1287,9 @@ vmdk_parse_extents(const char *desc, BlockDriverState *bs, QDict *options,
-         } else {
-             error_setg(errp, "Unsupported extent type '%s'", type);
-             bdrv_graph_rdunlock_main_loop();
--            bdrv_graph_wrlock(NULL);
-+            bdrv_graph_wrlock();
-             bdrv_unref_child(bs, extent_file);
--            bdrv_graph_wrunlock(NULL);
-+            bdrv_graph_wrunlock();
-             bdrv_graph_rdlock_main_loop();
-             ret = -ENOTSUP;
-             goto out;
-diff --git a/blockdev.c b/blockdev.c
-index c91f49e7b6..9e1381169d 100644
---- a/blockdev.c
-+++ b/blockdev.c
-@@ -1611,9 +1611,9 @@ static void external_snapshot_abort(void *opaque)
-             }
- 
-             bdrv_drained_begin(state->new_bs);
--            bdrv_graph_wrlock(state->old_bs);
-+            bdrv_graph_wrlock();
-             bdrv_replace_node(state->new_bs, state->old_bs, &error_abort);
--            bdrv_graph_wrunlock(state->old_bs);
-+            bdrv_graph_wrunlock();
-             bdrv_drained_end(state->new_bs);
- 
-             bdrv_unref(state->old_bs); /* bdrv_replace_node() ref'ed old_bs */
-@@ -3657,7 +3657,7 @@ void qmp_x_blockdev_change(const char *parent, const char *child,
-     BlockDriverState *parent_bs, *new_bs = NULL;
-     BdrvChild *p_child;
- 
--    bdrv_graph_wrlock(NULL);
-+    bdrv_graph_wrlock();
- 
-     parent_bs = bdrv_lookup_bs(parent, parent, errp);
-     if (!parent_bs) {
-@@ -3693,7 +3693,7 @@ void qmp_x_blockdev_change(const char *parent, const char *child,
-     }
- 
- out:
--    bdrv_graph_wrunlock(NULL);
-+    bdrv_graph_wrunlock();
- }
- 
- BlockJobInfoList *qmp_query_block_jobs(Error **errp)
-diff --git a/blockjob.c b/blockjob.c
-index b7a29052b9..7310412313 100644
---- a/blockjob.c
-+++ b/blockjob.c
-@@ -199,7 +199,7 @@ void block_job_remove_all_bdrv(BlockJob *job)
-      * to process an already freed BdrvChild.
-      */
-     aio_context_release(job->job.aio_context);
--    bdrv_graph_wrlock(NULL);
-+    bdrv_graph_wrlock();
-     aio_context_acquire(job->job.aio_context);
-     while (job->nodes) {
-         GSList *l = job->nodes;
-@@ -212,7 +212,7 @@ void block_job_remove_all_bdrv(BlockJob *job)
- 
-         g_slist_free_1(l);
-     }
--    bdrv_graph_wrunlock_ctx(job->job.aio_context);
-+    bdrv_graph_wrunlock();
- }
- 
- bool block_job_has_bdrv(BlockJob *job, BlockDriverState *bs)
-@@ -514,7 +514,7 @@ void *block_job_create(const char *job_id, const BlockJobDriver *driver,
-     int ret;
-     GLOBAL_STATE_CODE();
- 
--    bdrv_graph_wrlock(bs);
-+    bdrv_graph_wrlock();
- 
-     if (job_id == NULL && !(flags & JOB_INTERNAL)) {
-         job_id = bdrv_get_device_name(bs);
-@@ -523,7 +523,7 @@ void *block_job_create(const char *job_id, const BlockJobDriver *driver,
-     job = job_create(job_id, &driver->job_driver, txn, bdrv_get_aio_context(bs),
-                      flags, cb, opaque, errp);
-     if (job == NULL) {
--        bdrv_graph_wrunlock(bs);
-+        bdrv_graph_wrunlock();
-         return NULL;
-     }
- 
-@@ -563,11 +563,11 @@ void *block_job_create(const char *job_id, const BlockJobDriver *driver,
-         goto fail;
-     }
- 
--    bdrv_graph_wrunlock(bs);
-+    bdrv_graph_wrunlock();
-     return job;
- 
- fail:
--    bdrv_graph_wrunlock(bs);
-+    bdrv_graph_wrunlock();
-     job_early_fail(&job->job);
-     return NULL;
- }
-diff --git a/include/block/graph-lock.h b/include/block/graph-lock.h
-index 22b5db1ed9..d7545e82d0 100644
---- a/include/block/graph-lock.h
-+++ b/include/block/graph-lock.h
-@@ -110,34 +110,17 @@ void unregister_aiocontext(AioContext *ctx);
-  *
-  * The wrlock can only be taken from the main loop, with BQL held, as only the
-  * main loop is allowed to modify the graph.
-- *
-- * If @bs is non-NULL, its AioContext is temporarily released.
-- *
-- * This function polls. Callers must not hold the lock of any AioContext other
-- * than the current one and the one of @bs.
-  */
- void no_coroutine_fn TSA_ACQUIRE(graph_lock) TSA_NO_TSA
--bdrv_graph_wrlock(BlockDriverState *bs);
-+bdrv_graph_wrlock(void);
- 
- /*
-  * bdrv_graph_wrunlock:
-  * Write finished, reset global has_writer to 0 and restart
-  * all readers that are waiting.
-- *
-- * If @bs is non-NULL, its AioContext is temporarily released.
-- */
--void no_coroutine_fn TSA_RELEASE(graph_lock) TSA_NO_TSA
--bdrv_graph_wrunlock(BlockDriverState *bs);
--
--/*
-- * bdrv_graph_wrunlock_ctx:
-- * Write finished, reset global has_writer to 0 and restart
-- * all readers that are waiting.
-- *
-- * If @ctx is non-NULL, its lock is temporarily released.
-  */
- void no_coroutine_fn TSA_RELEASE(graph_lock) TSA_NO_TSA
--bdrv_graph_wrunlock_ctx(AioContext *ctx);
-+bdrv_graph_wrunlock(void);
- 
- /*
-  * bdrv_graph_co_rdlock:
-diff --git a/scripts/block-coroutine-wrapper.py b/scripts/block-coroutine-wrapper.py
-index a38e5833fb..38364fa557 100644
---- a/scripts/block-coroutine-wrapper.py
-+++ b/scripts/block-coroutine-wrapper.py
-@@ -261,8 +261,8 @@ def gen_no_co_wrapper(func: FuncDecl) -> str:
-         graph_lock='    bdrv_graph_rdlock_main_loop();'
-         graph_unlock='    bdrv_graph_rdunlock_main_loop();'
-     elif func.graph_wrlock:
--        graph_lock='    bdrv_graph_wrlock(NULL);'
--        graph_unlock='    bdrv_graph_wrunlock(NULL);'
-+        graph_lock='    bdrv_graph_wrlock();'
-+        graph_unlock='    bdrv_graph_wrunlock();'
- 
-     return f"""\
- /*
-diff --git a/tests/unit/test-bdrv-drain.c b/tests/unit/test-bdrv-drain.c
-index 704d1a3f36..d9754dfebc 100644
---- a/tests/unit/test-bdrv-drain.c
-+++ b/tests/unit/test-bdrv-drain.c
-@@ -807,9 +807,9 @@ static void test_blockjob_common_drain_node(enum drain_type drain_type,
-     tjob->bs = src;
-     job = &tjob->common;
- 
--    bdrv_graph_wrlock(target);
-+    bdrv_graph_wrlock();
-     block_job_add_bdrv(job, "target", target, 0, BLK_PERM_ALL, &error_abort);
--    bdrv_graph_wrunlock(target);
-+    bdrv_graph_wrunlock();
- 
-     switch (result) {
-     case TEST_JOB_SUCCESS:
-@@ -991,11 +991,11 @@ static void bdrv_test_top_close(BlockDriverState *bs)
- {
-     BdrvChild *c, *next_c;
- 
--    bdrv_graph_wrlock(NULL);
-+    bdrv_graph_wrlock();
-     QLIST_FOREACH_SAFE(c, &bs->children, next, next_c) {
-         bdrv_unref_child(bs, c);
-     }
--    bdrv_graph_wrunlock(NULL);
-+    bdrv_graph_wrunlock();
- }
- 
- static int coroutine_fn GRAPH_RDLOCK
-@@ -1085,10 +1085,10 @@ static void do_test_delete_by_drain(bool detach_instead_of_delete,
- 
-     null_bs = bdrv_open("null-co://", NULL, NULL, BDRV_O_RDWR | BDRV_O_PROTOCOL,
-                         &error_abort);
--    bdrv_graph_wrlock(NULL);
-+    bdrv_graph_wrlock();
-     bdrv_attach_child(bs, null_bs, "null-child", &child_of_bds,
-                       BDRV_CHILD_DATA, &error_abort);
--    bdrv_graph_wrunlock(NULL);
-+    bdrv_graph_wrunlock();
- 
-     /* This child will be the one to pass to requests through to, and
-      * it will stall until a drain occurs */
-@@ -1096,21 +1096,21 @@ static void do_test_delete_by_drain(bool detach_instead_of_delete,
-                                     &error_abort);
-     child_bs->total_sectors = 65536 >> BDRV_SECTOR_BITS;
-     /* Takes our reference to child_bs */
--    bdrv_graph_wrlock(NULL);
-+    bdrv_graph_wrlock();
-     tts->wait_child = bdrv_attach_child(bs, child_bs, "wait-child",
-                                         &child_of_bds,
-                                         BDRV_CHILD_DATA | BDRV_CHILD_PRIMARY,
-                                         &error_abort);
--    bdrv_graph_wrunlock(NULL);
-+    bdrv_graph_wrunlock();
- 
-     /* This child is just there to be deleted
-      * (for detach_instead_of_delete == true) */
-     null_bs = bdrv_open("null-co://", NULL, NULL, BDRV_O_RDWR | BDRV_O_PROTOCOL,
-                         &error_abort);
--    bdrv_graph_wrlock(NULL);
-+    bdrv_graph_wrlock();
-     bdrv_attach_child(bs, null_bs, "null-child", &child_of_bds, BDRV_CHILD_DATA,
-                       &error_abort);
--    bdrv_graph_wrunlock(NULL);
-+    bdrv_graph_wrunlock();
- 
-     blk = blk_new(qemu_get_aio_context(), BLK_PERM_ALL, BLK_PERM_ALL);
-     blk_insert_bs(blk, bs, &error_abort);
-@@ -1193,14 +1193,14 @@ static void no_coroutine_fn detach_indirect_bh(void *opaque)
- 
-     bdrv_dec_in_flight(data->child_b->bs);
- 
--    bdrv_graph_wrlock(NULL);
-+    bdrv_graph_wrlock();
-     bdrv_unref_child(data->parent_b, data->child_b);
- 
-     bdrv_ref(data->c);
-     data->child_c = bdrv_attach_child(data->parent_b, data->c, "PB-C",
-                                       &child_of_bds, BDRV_CHILD_DATA,
-                                       &error_abort);
--    bdrv_graph_wrunlock(NULL);
-+    bdrv_graph_wrunlock();
- }
- 
- static void coroutine_mixed_fn detach_by_parent_aio_cb(void *opaque, int ret)
-@@ -1298,7 +1298,7 @@ static void TSA_NO_TSA test_detach_indirect(bool by_parent_cb)
-     /* Set child relationships */
-     bdrv_ref(b);
-     bdrv_ref(a);
--    bdrv_graph_wrlock(NULL);
-+    bdrv_graph_wrlock();
-     child_b = bdrv_attach_child(parent_b, b, "PB-B", &child_of_bds,
-                                 BDRV_CHILD_DATA, &error_abort);
-     child_a = bdrv_attach_child(parent_b, a, "PB-A", &child_of_bds,
-@@ -1308,7 +1308,7 @@ static void TSA_NO_TSA test_detach_indirect(bool by_parent_cb)
-     bdrv_attach_child(parent_a, a, "PA-A",
-                       by_parent_cb ? &child_of_bds : &detach_by_driver_cb_class,
-                       BDRV_CHILD_DATA, &error_abort);
--    bdrv_graph_wrunlock(NULL);
-+    bdrv_graph_wrunlock();
- 
-     g_assert_cmpint(parent_a->refcnt, ==, 1);
-     g_assert_cmpint(parent_b->refcnt, ==, 1);
-@@ -1727,7 +1727,7 @@ static void test_drop_intermediate_poll(void)
-      * Establish the chain last, so the chain links are the first
-      * elements in the BDS.parents lists
-      */
--    bdrv_graph_wrlock(NULL);
-+    bdrv_graph_wrlock();
-     for (i = 0; i < 3; i++) {
-         if (i) {
-             /* Takes the reference to chain[i - 1] */
-@@ -1735,7 +1735,7 @@ static void test_drop_intermediate_poll(void)
-                               &chain_child_class, BDRV_CHILD_COW, &error_abort);
-         }
-     }
--    bdrv_graph_wrunlock(NULL);
-+    bdrv_graph_wrunlock();
- 
-     job = block_job_create("job", &test_simple_job_driver, NULL, job_node,
-                            0, BLK_PERM_ALL, 0, 0, NULL, NULL, &error_abort);
-@@ -1982,10 +1982,10 @@ static void do_test_replace_child_mid_drain(int old_drain_count,
-     new_child_bs->total_sectors = 1;
- 
-     bdrv_ref(old_child_bs);
--    bdrv_graph_wrlock(NULL);
-+    bdrv_graph_wrlock();
-     bdrv_attach_child(parent_bs, old_child_bs, "child", &child_of_bds,
-                       BDRV_CHILD_COW, &error_abort);
--    bdrv_graph_wrunlock(NULL);
-+    bdrv_graph_wrunlock();
-     parent_s->setup_completed = true;
- 
-     for (i = 0; i < old_drain_count; i++) {
-@@ -2016,9 +2016,9 @@ static void do_test_replace_child_mid_drain(int old_drain_count,
-     g_assert(parent_bs->quiesce_counter == old_drain_count);
-     bdrv_drained_begin(old_child_bs);
-     bdrv_drained_begin(new_child_bs);
--    bdrv_graph_wrlock(NULL);
-+    bdrv_graph_wrlock();
-     bdrv_replace_node(old_child_bs, new_child_bs, &error_abort);
--    bdrv_graph_wrunlock(NULL);
-+    bdrv_graph_wrunlock();
-     bdrv_drained_end(new_child_bs);
-     bdrv_drained_end(old_child_bs);
-     g_assert(parent_bs->quiesce_counter == new_drain_count);
-diff --git a/tests/unit/test-bdrv-graph-mod.c b/tests/unit/test-bdrv-graph-mod.c
-index 074adcbb93..8ee6ef38d8 100644
---- a/tests/unit/test-bdrv-graph-mod.c
-+++ b/tests/unit/test-bdrv-graph-mod.c
-@@ -137,10 +137,10 @@ static void test_update_perm_tree(void)
- 
-     blk_insert_bs(root, bs, &error_abort);
- 
--    bdrv_graph_wrlock(NULL);
-+    bdrv_graph_wrlock();
-     bdrv_attach_child(filter, bs, "child", &child_of_bds,
-                       BDRV_CHILD_DATA, &error_abort);
--    bdrv_graph_wrunlock(NULL);
-+    bdrv_graph_wrunlock();
- 
-     aio_context_acquire(qemu_get_aio_context());
-     ret = bdrv_append(filter, bs, NULL);
-@@ -206,11 +206,11 @@ static void test_should_update_child(void)
- 
-     bdrv_set_backing_hd(target, bs, &error_abort);
- 
--    bdrv_graph_wrlock(NULL);
-+    bdrv_graph_wrlock();
-     g_assert(target->backing->bs == bs);
-     bdrv_attach_child(filter, target, "target", &child_of_bds,
-                       BDRV_CHILD_DATA, &error_abort);
--    bdrv_graph_wrunlock(NULL);
-+    bdrv_graph_wrunlock();
-     aio_context_acquire(qemu_get_aio_context());
-     bdrv_append(filter, bs, &error_abort);
-     aio_context_release(qemu_get_aio_context());
-@@ -248,7 +248,7 @@ static void test_parallel_exclusive_write(void)
-     bdrv_ref(base);
-     bdrv_ref(fl1);
- 
--    bdrv_graph_wrlock(NULL);
-+    bdrv_graph_wrlock();
-     bdrv_attach_child(top, fl1, "backing", &child_of_bds,
-                       BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
-                       &error_abort);
-@@ -260,7 +260,7 @@ static void test_parallel_exclusive_write(void)
-                       &error_abort);
- 
-     bdrv_replace_node(fl1, fl2, &error_abort);
--    bdrv_graph_wrunlock(NULL);
-+    bdrv_graph_wrunlock();
- 
-     bdrv_drained_end(fl2);
-     bdrv_drained_end(fl1);
-@@ -367,7 +367,7 @@ static void test_parallel_perm_update(void)
-      */
-     bdrv_ref(base);
- 
--    bdrv_graph_wrlock(NULL);
-+    bdrv_graph_wrlock();
-     bdrv_attach_child(top, ws, "file", &child_of_bds, BDRV_CHILD_DATA,
-                       &error_abort);
-     c_fl1 = bdrv_attach_child(ws, fl1, "first", &child_of_bds,
-@@ -380,7 +380,7 @@ static void test_parallel_perm_update(void)
-     bdrv_attach_child(fl2, base, "backing", &child_of_bds,
-                       BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
-                       &error_abort);
--    bdrv_graph_wrunlock(NULL);
-+    bdrv_graph_wrunlock();
- 
-     /* Select fl1 as first child to be active */
-     s->selected = c_fl1;
-@@ -434,11 +434,11 @@ static void test_append_greedy_filter(void)
-     BlockDriverState *base = no_perm_node("base");
-     BlockDriverState *fl = exclusive_writer_node("fl1");
- 
--    bdrv_graph_wrlock(NULL);
-+    bdrv_graph_wrlock();
-     bdrv_attach_child(top, base, "backing", &child_of_bds,
-                       BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
-                       &error_abort);
--    bdrv_graph_wrunlock(NULL);
-+    bdrv_graph_wrunlock();
- 
-     aio_context_acquire(qemu_get_aio_context());
-     bdrv_append(fl, base, &error_abort);
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-hv-balloon-use-get_min_alignment-to-express-32-GiB-a.patch b/SOURCES/kvm-hv-balloon-use-get_min_alignment-to-express-32-GiB-a.patch
deleted file mode 100644
index 4fb4844..0000000
--- a/SOURCES/kvm-hv-balloon-use-get_min_alignment-to-express-32-GiB-a.patch
+++ /dev/null
@@ -1,94 +0,0 @@
-From a5b4eec5f456b1ca3fe753e1d76f96cf3f8914ef Mon Sep 17 00:00:00 2001
-From: David Hildenbrand <david@redhat.com>
-Date: Wed, 17 Jan 2024 14:55:53 +0100
-Subject: [PATCH 01/22] hv-balloon: use get_min_alignment() to express 32 GiB
- alignment
-
-RH-Author: David Hildenbrand <david@redhat.com>
-RH-MergeRequest: 221: memory-device: reintroduce memory region size check
-RH-Jira: RHEL-20341
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
-RH-Commit: [1/2] cbe092fe549552928270892253b31cd8fe199825
-
-https://issues.redhat.com/browse/RHEL-20341
-
-Let's implement the get_min_alignment() callback for memory devices, and
-copy for the device memory region the alignment of the host memory
-region. This mimics what virtio-mem does, and allows for re-introducing
-proper alignment checks for the memory region size (where we don't care
-about additional device requirements) in memory device core.
-
-Message-ID: <20240117135554.787344-2-david@redhat.com>
-Reviewed-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com>
-Signed-off-by: David Hildenbrand <david@redhat.com>
-(cherry picked from commit f77c5f38f49c71bc14cf1019ac92b0b95f572414)
-Signed-off-by: David Hildenbrand <david@redhat.com>
----
- hw/hyperv/hv-balloon.c | 37 +++++++++++++++++++++----------------
- 1 file changed, 21 insertions(+), 16 deletions(-)
-
-diff --git a/hw/hyperv/hv-balloon.c b/hw/hyperv/hv-balloon.c
-index 66f297c1d7..0829c495b0 100644
---- a/hw/hyperv/hv-balloon.c
-+++ b/hw/hyperv/hv-balloon.c
-@@ -1476,22 +1476,7 @@ static void hv_balloon_ensure_mr(HvBalloon *balloon)
-     balloon->mr = g_new0(MemoryRegion, 1);
-     memory_region_init(balloon->mr, OBJECT(balloon), TYPE_HV_BALLOON,
-                        memory_region_size(hostmem_mr));
--
--    /*
--     * The VM can indicate an alignment up to 32 GiB. Memory device core can
--     * usually only handle/guarantee 1 GiB alignment. The user will have to
--     * specify a larger maxmem eventually.
--     *
--     * The memory device core will warn the user in case maxmem might have to be
--     * increased and will fail plugging the device if there is not sufficient
--     * space after alignment.
--     *
--     * TODO: we could do the alignment ourselves in a slightly bigger region.
--     * But this feels better, although the warning might be annoying. Maybe
--     * we can optimize that in the future (e.g., with such a device on the
--     * cmdline place/size the device memory region differently.
--     */
--    balloon->mr->align = MAX(32 * GiB, memory_region_get_alignment(hostmem_mr));
-+    balloon->mr->align = memory_region_get_alignment(hostmem_mr);
- }
- 
- static void hv_balloon_free_mr(HvBalloon *balloon)
-@@ -1653,6 +1638,25 @@ static MemoryRegion *hv_balloon_md_get_memory_region(MemoryDeviceState *md,
-     return balloon->mr;
- }
- 
-+static uint64_t hv_balloon_md_get_min_alignment(const MemoryDeviceState *md)
-+{
-+    /*
-+     * The VM can indicate an alignment up to 32 GiB. Memory device core can
-+     * usually only handle/guarantee 1 GiB alignment. The user will have to
-+     * specify a larger maxmem eventually.
-+     *
-+     * The memory device core will warn the user in case maxmem might have to be
-+     * increased and will fail plugging the device if there is not sufficient
-+     * space after alignment.
-+     *
-+     * TODO: we could do the alignment ourselves in a slightly bigger region.
-+     * But this feels better, although the warning might be annoying. Maybe
-+     * we can optimize that in the future (e.g., with such a device on the
-+     * cmdline place/size the device memory region differently.
-+     */
-+    return 32 * GiB;
-+}
-+
- static void hv_balloon_md_fill_device_info(const MemoryDeviceState *md,
-                                            MemoryDeviceInfo *info)
- {
-@@ -1765,5 +1769,6 @@ static void hv_balloon_class_init(ObjectClass *klass, void *data)
-     mdc->get_memory_region = hv_balloon_md_get_memory_region;
-     mdc->decide_memslots = hv_balloon_decide_memslots;
-     mdc->get_memslots = hv_balloon_get_memslots;
-+    mdc->get_min_alignment = hv_balloon_md_get_min_alignment;
-     mdc->fill_device_info = hv_balloon_md_fill_device_info;
- }
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-hw-arm-Activate-IOMMUFD-for-virt-machines.patch b/SOURCES/kvm-hw-arm-Activate-IOMMUFD-for-virt-machines.patch
deleted file mode 100644
index 84f6108..0000000
--- a/SOURCES/kvm-hw-arm-Activate-IOMMUFD-for-virt-machines.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From ceaee9c4372bbdc4196cb6808515047388f7aa26 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
-Date: Tue, 21 Nov 2023 16:44:18 +0800
-Subject: [PATCH 039/101] hw/arm: Activate IOMMUFD for virt machines
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [38/67] 0a059ae661616e95eb8455e17f35774495cae8e7 (eauger1/centos-qemu-kvm)
-
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Tested-by: Eric Auger <eric.auger@redhat.com>
-Tested-by: Nicolin Chen <nicolinc@nvidia.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 0970238343af45a8b547695bfc22f18d4eb7da7e)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/arm/Kconfig | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
-index 3ada335a24..660f49db49 100644
---- a/hw/arm/Kconfig
-+++ b/hw/arm/Kconfig
-@@ -8,6 +8,7 @@ config ARM_VIRT
-     imply TPM_TIS_SYSBUS
-     imply TPM_TIS_I2C
-     imply NVDIMM
-+    imply IOMMUFD
-     select ARM_GIC
-     select ACPI
-     select ARM_SMMUV3
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-hw-arm-virt-Add-properties-to-disable-high-memory-re.patch b/SOURCES/kvm-hw-arm-virt-Add-properties-to-disable-high-memory-re.patch
deleted file mode 100644
index 76ab341..0000000
--- a/SOURCES/kvm-hw-arm-virt-Add-properties-to-disable-high-memory-re.patch
+++ /dev/null
@@ -1,88 +0,0 @@
-From e670722b9a6460d41497688d820d5a9a9b51d8e9 Mon Sep 17 00:00:00 2001
-From: Gavin Shan <gshan@redhat.com>
-Date: Tue, 9 Jan 2024 11:36:42 +1000
-Subject: [PATCH 001/101] hw/arm/virt: Add properties to disable high memory
- regions
-
-RH-Author: Gavin Shan <gshan@redhat.com>
-RH-MergeRequest: 210: hw/arm/virt: Add properties to disable high memory regions
-RH-Jira: RHEL-19738
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Eric Auger <eric.auger@redhat.com>
-RH-Commit: [1/1] 4097ba5133a67126e30b84202cb40df4e019c5f4
-
-Upstream: RHEL-only
-Brew: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=57927352
-
-There are 3 high memory regions for GICv3 or GICv4 redistributor, PCI
-ECAM and PCI MMIO. Each of them has a property introduced by upstream
-commit 6a48c64eec ("hw/arm/virt: Add properties to disable high memory
-regions") so that the corresponding high memory region can be disabled.
-
-It's notable that another property ("compact-highmem") introduced by
-upstream commit f40408a9fe ("hw/arm/virt: Add 'compact-highmem' property")
-so that the compact high memory region layout during assignment can be
-disabled, compatible to the old machine types. However, we don't have
-the compatible issue since the compact high memory region layout is
-always kept as disabled until RHEL9.2.0 machine type and onwards.
-
-Expose those 3 properties: "highmem-redists", "highmem-ecam" and
-"highmem-mmio". The property "compact-highmem" is kept as hidden.
-
-Signed-off-by: Gavin Shan <gshan@redhat.com>
----
- hw/arm/virt.c | 24 +++++++++++++++++++++++-
- 1 file changed, 23 insertions(+), 1 deletion(-)
-
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index 5cab00b4cd..60f117f0d2 100644
---- a/hw/arm/virt.c
-+++ b/hw/arm/virt.c
-@@ -2456,6 +2456,7 @@ static void virt_set_compact_highmem(Object *obj, bool value, Error **errp)
- 
-     vms->highmem_compact = value;
- }
-+#endif /* disabled for RHEL */
- 
- static bool virt_get_highmem_redists(Object *obj, Error **errp)
- {
-@@ -2498,7 +2499,6 @@ static void virt_set_highmem_mmio(Object *obj, bool value, Error **errp)
- 
-     vms->highmem_mmio = value;
- }
--#endif /* disabled for RHEL */
- 
- static bool virt_get_its(Object *obj, Error **errp)
- {
-@@ -3521,6 +3521,28 @@ static void rhel_machine_class_init(ObjectClass *oc, void *data)
-                                           "Set on/off to enable/disable using "
-                                           "physical address space above 32 bits");
- 
-+    object_class_property_add_bool(oc, "highmem-redists",
-+                                   virt_get_highmem_redists,
-+                                   virt_set_highmem_redists);
-+    object_class_property_set_description(oc, "highmem-redists",
-+                                          "Set on/off to enable/disable high "
-+                                          "memory region for GICv3 or GICv4 "
-+                                          "redistributor");
-+
-+    object_class_property_add_bool(oc, "highmem-ecam",
-+                                   virt_get_highmem_ecam,
-+                                   virt_set_highmem_ecam);
-+    object_class_property_set_description(oc, "highmem-ecam",
-+                                          "Set on/off to enable/disable high "
-+                                          "memory region for PCI ECAM");
-+
-+    object_class_property_add_bool(oc, "highmem-mmio",
-+                                   virt_get_highmem_mmio,
-+                                   virt_set_highmem_mmio);
-+    object_class_property_set_description(oc, "highmem-mmio",
-+                                          "Set on/off to enable/disable high "
-+                                          "memory region for PCI MMIO");
-+
-     object_class_property_add_str(oc, "gic-version", virt_get_gic_version,
-                                   virt_set_gic_version);
-     object_class_property_set_description(oc, "gic-version",
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-hw-arm-virt-Avoid-unexpected-warning-from-Linux-gues.patch b/SOURCES/kvm-hw-arm-virt-Avoid-unexpected-warning-from-Linux-gues.patch
new file mode 100644
index 0000000..29991d5
--- /dev/null
+++ b/SOURCES/kvm-hw-arm-virt-Avoid-unexpected-warning-from-Linux-gues.patch
@@ -0,0 +1,120 @@
+From 41c4083269ec772b406c6c57b496ca2011f928c7 Mon Sep 17 00:00:00 2001
+From: Zhenyu Zhang <zhenyzha@redhat.com>
+Date: Tue, 9 Jul 2024 23:08:59 -0400
+Subject: [PATCH 2/2] hw/arm/virt: Avoid unexpected warning from Linux guest on
+ host with Fujitsu CPUs
+
+RH-Author: zhenyzha <None>
+RH-MergeRequest: 256: hw/arm/virt: Avoid unexpected warning from Linux guest on host with Fujitsu CPUs
+RH-Jira: RHEL-39936
+RH-Acked-by: Gavin Shan <gshan@redhat.com>
+RH-Acked-by: Sebastian Ott <sebott@redhat.com>
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Commit: [1/1] fdf156fd05b219a06e2e2ca409fff0f728c1e2cf (zhenyzha/qemu-kvm)
+
+JIRA: https://issues.redhat.com/browse/RHEL-39936
+
+Multiple warning messages and corresponding backtraces are observed when Linux
+guest is booted on the host with Fujitsu CPUs. One of them is shown as below.
+
+[    0.032443] ------------[ cut here ]------------
+[    0.032446] uart-pl011 9000000.pl011: ARCH_DMA_MINALIGN smaller than
+CTR_EL0.CWG (128 < 256)
+[    0.032454] WARNING: CPU: 0 PID: 1 at arch/arm64/mm/dma-mapping.c:54
+arch_setup_dma_ops+0xbc/0xcc
+[    0.032470] Modules linked in:
+[    0.032475] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.14.0-452.el9.aarch64
+[    0.032481] Hardware name: linux,dummy-virt (DT)
+[    0.032484] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+[    0.032490] pc : arch_setup_dma_ops+0xbc/0xcc
+[    0.032496] lr : arch_setup_dma_ops+0xbc/0xcc
+[    0.032501] sp : ffff80008003b860
+[    0.032503] x29: ffff80008003b860 x28: 0000000000000000 x27: ffffaae4b949049c
+[    0.032510] x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000
+[    0.032517] x23: 0000000000000100 x22: 0000000000000000 x21: 0000000000000000
+[    0.032523] x20: 0000000100000000 x19: ffff2f06c02ea400 x18: ffffffffffffffff
+[    0.032529] x17: 00000000208a5f76 x16: 000000006589dbcb x15: ffffaae4ba071c89
+[    0.032535] x14: 0000000000000000 x13: ffffaae4ba071c84 x12: 455f525443206e61
+[    0.032541] x11: 68742072656c6c61 x10: 0000000000000029 x9 : ffffaae4b7d21da4
+[    0.032547] x8 : 0000000000000029 x7 : 4c414e494d5f414d x6 : 0000000000000029
+[    0.032553] x5 : 000000000000000f x4 : ffffaae4b9617a00 x3 : 0000000000000001
+[    0.032558] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff2f06c029be40
+[    0.032564] Call trace:
+[    0.032566]  arch_setup_dma_ops+0xbc/0xcc
+[    0.032572]  of_dma_configure_id+0x138/0x300
+[    0.032591]  amba_dma_configure+0x34/0xc0
+[    0.032600]  really_probe+0x78/0x3dc
+[    0.032614]  __driver_probe_device+0x108/0x160
+[    0.032619]  driver_probe_device+0x44/0x114
+[    0.032624]  __device_attach_driver+0xb8/0x14c
+[    0.032629]  bus_for_each_drv+0x88/0xe4
+[    0.032634]  __device_attach+0xb0/0x1e0
+[    0.032638]  device_initial_probe+0x18/0x20
+[    0.032643]  bus_probe_device+0xa8/0xb0
+[    0.032648]  device_add+0x4b4/0x6c0
+[    0.032652]  amba_device_try_add.part.0+0x48/0x360
+[    0.032657]  amba_device_add+0x104/0x144
+[    0.032662]  of_amba_device_create.isra.0+0x100/0x1c4
+[    0.032666]  of_platform_bus_create+0x294/0x35c
+[    0.032669]  of_platform_populate+0x5c/0x150
+[    0.032672]  of_platform_default_populate_init+0xd0/0xec
+[    0.032697]  do_one_initcall+0x4c/0x2e0
+[    0.032701]  do_initcalls+0x100/0x13c
+[    0.032707]  kernel_init_freeable+0x1c8/0x21c
+[    0.032712]  kernel_init+0x28/0x140
+[    0.032731]  ret_from_fork+0x10/0x20
+[    0.032735] ---[ end trace 0000000000000000 ]---
+
+In Linux, a check is applied to every device which is exposed through
+device-tree node. The warning message is raised when the device isn't
+DMA coherent and the cache line size is larger than ARCH_DMA_MINALIGN
+(128 bytes). The cache line is sorted from CTR_EL0[CWG], which corresponds
+to 256 bytes on the guest CPUs. The DMA coherent capability is claimed
+through 'dma-coherent' in their device-tree nodes or parent nodes.
+This happens even when the device doesn't implement or use DMA at all,
+for legacy reasons.
+
+Fix the issue by adding 'dma-coherent' property to the device-tree root
+node, meaning all devices are capable of DMA coherent by default.
+This both suppresses the spurious kernel warnings and also guards
+against possible future QEMU bugs where we add a DMA-capable device
+and forget to mark it as dma-coherent.
+
+Signed-off-by: Zhenyu Zhang <zhenyzha@redhat.com>
+Reviewed-by: Gavin Shan <gshan@redhat.com>
+Reviewed-by: Donald Dutile <ddutile@redhat.com
+Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Message-id: 20240612020506.307793-1-zhenyzha@redhat.com
+[PMM: tweaked commit message]
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+(cherry picked from commit dda533087ad5559674ff486e7031c88dc01e0abd)
+Signed-off-by: Zhenyu Zhang <zhenyzha@redhat.com>
+---
+ hw/arm/virt.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/hw/arm/virt.c b/hw/arm/virt.c
+index 3f0496cdb9..6ece67f11d 100644
+--- a/hw/arm/virt.c
++++ b/hw/arm/virt.c
+@@ -330,6 +330,17 @@ static void create_fdt(VirtMachineState *vms)
+     qemu_fdt_setprop_cell(fdt, "/", "#size-cells", 0x2);
+     qemu_fdt_setprop_string(fdt, "/", "model", "linux,dummy-virt");
+ 
++    /*
++     * For QEMU, all DMA is coherent. Advertising this in the root node
++     * has two benefits:
++     *
++     * - It avoids potential bugs where we forget to mark a DMA
++     *   capable device as being dma-coherent
++     * - It avoids spurious warnings from the Linux kernel about
++     *   devices which can't do DMA at all
++     */
++    qemu_fdt_setprop(fdt, "/", "dma-coherent", NULL, 0);
++
+     /* /chosen must exist for load_dtb to fill in necessary properties later */
+     qemu_fdt_add_subnode(fdt, "/chosen");
+     if (vms->dtb_randomness) {
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-hw-arm-virt-Fix-compats.patch b/SOURCES/kvm-hw-arm-virt-Fix-compats.patch
deleted file mode 100644
index 7e3af18..0000000
--- a/SOURCES/kvm-hw-arm-virt-Fix-compats.patch
+++ /dev/null
@@ -1,132 +0,0 @@
-From 3f58194f8642a71c47d91d3c00a34faf44ea2c11 Mon Sep 17 00:00:00 2001
-From: Eric Auger <eric.auger@redhat.com>
-Date: Wed, 3 Jan 2024 05:57:38 -0500
-Subject: [PATCH] hw/arm/virt: Fix compats
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 209: hw/arm/virt: Fix compats
-RH-Jira: RHEL-17168
-RH-Acked-by: Gavin Shan <gshan@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [1/1] bcdf6493bbd6d7b52b0b88ff44441d22aeddfde2 (eauger1/centos-qemu-kvm)
-
-arm_rhel_compat is not added for virt-rhel9.4.0 machine causing
-the efi-virtio.rom to be looked for when instantiating a virtio-net-pci
-device and it won't be found since not shipped on ARM. This is a
-regression compared to 9.2.
-
-Actually we do not need any rom file for any virtio-net-pci variant
-because edk2 already brings the functionality. So for 9.4 onwards, we
-want to set romfiles to "" for all of them.
-
-However at the moment we apply arm_rhel_compat from the latest
-rhel*_virt_options(). This is not aligned with the generic compat
-usage which sets compats for a given machine type to accomodate for
-changes that occured after its advent. Here we are somehow abusing
-the compat infra to set general driver options that should apply for
-all machines.  On top of that this is really error prone and we have
-forgotten to add arm_rhel_compat several times in the past.
-
-So let's introduce set_arm_rhel_compat() being called before any
-*virt_options in the non abstract machine class. That way the setting
-will apply to any machine type without any need to add it in any
-future machine types.
-
-For < 9.4 machines we don't really care keeping non void romfiles
-for transitional and non transitional devices because anyway this was
-not working. So let's keep things simple and apply the new defaults for
-all RHEL9 machine types.
-
-Finally, to follow the generic pattern we should set hw_compat_rhel_9_0
-in 9.0 machine as it is done on x86 or ccw. This has no consequence on
-aarch64 because it only contains x86 stuff but that helps understanding
-the consistency.
-
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/arm/virt.c | 43 +++++++++++++++++++++++++++++--------------
- 1 file changed, 29 insertions(+), 14 deletions(-)
-
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index 0b17c94ad7..5cab00b4cd 100644
---- a/hw/arm/virt.c
-+++ b/hw/arm/virt.c
-@@ -111,11 +111,39 @@
-     DEFINE_VIRT_MACHINE_LATEST(major, minor, false)
- #endif /* disabled for RHEL */
- 
-+/*
-+ * This variable is for changes to properties that are RHEL specific,
-+ * different to the current upstream and to be applied to the latest
-+ * machine type. They may be overriden by older machine compats.
-+ *
-+ * virtio-net-pci variant romfiles are not needed because edk2 does
-+ * fully support the pxe boot. Besides virtio romfiles are not shipped
-+ * on rhel/aarch64.
-+ */
-+GlobalProperty arm_rhel_compat[] = {
-+    {"virtio-net-pci", "romfile", "" },
-+    {"virtio-net-pci-transitional", "romfile", "" },
-+    {"virtio-net-pci-non-transitional", "romfile", "" },
-+};
-+const size_t arm_rhel_compat_len = G_N_ELEMENTS(arm_rhel_compat);
-+
-+/*
-+ * This cannot be called from the rhel_virt_class_init() because
-+ * TYPE_RHEL_MACHINE is abstract and mc->compat_props g_ptr_array_new()
-+ * only is called on virt-rhelm.n.s non abstract class init.
-+ */
-+static void arm_rhel_compat_set(MachineClass *mc)
-+{
-+    compat_props_add(mc->compat_props, arm_rhel_compat,
-+                     arm_rhel_compat_len);
-+}
-+
- #define DEFINE_RHEL_MACHINE_LATEST(m, n, s, latest)                     \
-     static void rhel##m##n##s##_virt_class_init(ObjectClass *oc,        \
-                                                 void *data)             \
-     {                                                                   \
-         MachineClass *mc = MACHINE_CLASS(oc);                           \
-+        arm_rhel_compat_set(mc);                                        \
-         rhel##m##n##s##_virt_options(mc);                               \
-         mc->desc = "RHEL " # m "." # n "." # s " ARM Virtual Machine";  \
-         if (latest) {                                                   \
-@@ -139,19 +167,6 @@
- #define DEFINE_RHEL_MACHINE(major, minor, subminor)             \
-     DEFINE_RHEL_MACHINE_LATEST(major, minor, subminor, false)
- 
--/* This variable is for changes to properties that are RHEL specific,
-- * different to the current upstream and to be applied to the latest
-- * machine type.
-- */
--GlobalProperty arm_rhel_compat[] = {
--    {
--        .driver   = "virtio-net-pci",
--        .property = "romfile",
--        .value    = "",
--    },
--};
--const size_t arm_rhel_compat_len = G_N_ELEMENTS(arm_rhel_compat);
--
- /* Number of external interrupt lines to configure the GIC with */
- #define NUM_IRQS 256
- 
-@@ -3639,7 +3654,6 @@ static void rhel920_virt_options(MachineClass *mc)
- {
-     rhel940_virt_options(mc);
- 
--    compat_props_add(mc->compat_props, arm_rhel_compat, arm_rhel_compat_len);
-     compat_props_add(mc->compat_props, hw_compat_rhel_9_4, hw_compat_rhel_9_4_len);
-     compat_props_add(mc->compat_props, hw_compat_rhel_9_3, hw_compat_rhel_9_3_len);
-     compat_props_add(mc->compat_props, hw_compat_rhel_9_2, hw_compat_rhel_9_2_len);
-@@ -3653,6 +3667,7 @@ static void rhel900_virt_options(MachineClass *mc)
-     rhel920_virt_options(mc);
- 
-     compat_props_add(mc->compat_props, hw_compat_rhel_9_1, hw_compat_rhel_9_1_len);
-+    compat_props_add(mc->compat_props, hw_compat_rhel_9_0, hw_compat_rhel_9_0_len);
- 
-     /* Disable FEAT_LPA2 since old kernels (<= v5.12) don't boot with that feature */
-     vmc->no_tcg_lpa2 = true;
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-hw-arm-virt-Fix-spurious-call-to-arm_virt_compat_set.patch b/SOURCES/kvm-hw-arm-virt-Fix-spurious-call-to-arm_virt_compat_set.patch
new file mode 100644
index 0000000..8128a4e
--- /dev/null
+++ b/SOURCES/kvm-hw-arm-virt-Fix-spurious-call-to-arm_virt_compat_set.patch
@@ -0,0 +1,59 @@
+From e3360c415f7de923d27c3167260a93cb679afabe Mon Sep 17 00:00:00 2001
+From: Eric Auger <eric.auger@redhat.com>
+Date: Mon, 6 May 2024 15:09:43 +0200
+Subject: [PATCH 1/2] hw/arm/virt: Fix spurious call to arm_virt_compat_set()
+
+RH-Author: Eric Auger <eric.auger@redhat.com>
+RH-MergeRequest: 238: hw/arm/virt: Fix spurious call to arm_virt_compat_set()
+RH-Jira: RHEL-34945
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
+RH-Acked-by: Gavin Shan <gshan@redhat.com>
+RH-Commit: [1/1] a858a3e1dff12b28e14f7e4bd2b896a9f06eacbb (eauger1/centos-qemu-kvm)
+
+JIRA: https://issues.redhat.com/browse/RHEL-34945
+Status: RHEL-only
+
+Downstream, we apply arm_rhel_compat in place of arm_virt_compat.
+This is done though arm_rhel_compat_set() transparently called in
+DEFINE_RHEL_MACHINE_LATEST(). So there is no need to call
+arm_virt_compat_set() in rhel_machine_class_init(). Besides
+this triggers a "GLib: g_ptr_array_add: assertion 'rarray' failed"
+warning.
+
+Signed-off-by: Eric Auger <eric.auger@redhat.com>
+---
+ hw/arm/virt.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/hw/arm/virt.c b/hw/arm/virt.c
+index f1af9495c6..3f0496cdb9 100644
+--- a/hw/arm/virt.c
++++ b/hw/arm/virt.c
+@@ -85,6 +85,7 @@
+ #include "hw/char/pl011.h"
+ #include "qemu/guest-random.h"
+ 
++#if 0 /* Disabled for Red Hat Enterprise Linux */
+ static GlobalProperty arm_virt_compat[] = {
+     { TYPE_VIRTIO_IOMMU_PCI, "aw-bits", "48" },
+ };
+@@ -101,7 +102,6 @@ static void arm_virt_compat_set(MachineClass *mc)
+                      arm_virt_compat_len);
+ }
+ 
+-#if 0 /* Disabled for Red Hat Enterprise Linux */
+ #define DEFINE_VIRT_MACHINE_LATEST(major, minor, latest) \
+     static void virt_##major##_##minor##_class_init(ObjectClass *oc, \
+                                                     void *data) \
+@@ -3536,7 +3536,6 @@ static void rhel_machine_class_init(ObjectClass *oc, void *data)
+ {
+     MachineClass *mc = MACHINE_CLASS(oc);
+     HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(oc);
+-    arm_virt_compat_set(mc);
+ 
+     mc->family = "virt-rhel-Z";
+     mc->init = machvirt_init;
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-hw-arm-virt-deprecate-virt-rhel9.-0-2-.0-machine-typ.patch b/SOURCES/kvm-hw-arm-virt-deprecate-virt-rhel9.-0-2-.0-machine-typ.patch
deleted file mode 100644
index 4770a58..0000000
--- a/SOURCES/kvm-hw-arm-virt-deprecate-virt-rhel9.-0-2-.0-machine-typ.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From 4c1d07995a7afb6fae68a7e7a8b6b6c94fa0a7bb Mon Sep 17 00:00:00 2001
-From: Cornelia Huck <cohuck@redhat.com>
-Date: Mon, 12 Feb 2024 10:37:54 +0100
-Subject: [PATCH 5/6] hw/arm/virt: deprecate virt-rhel9.{0,2}.0 machine types
-
-RH-Author: Cornelia Huck <cohuck@redhat.com>
-RH-MergeRequest: 225: hw/arm/virt: deprecate virt-rhel9.{0,2}.0 machine types
-RH-Jira: RHEL-24988
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Acked-by: Eric Auger <eric.auger@redhat.com>
-RH-Commit: [1/1] f15579db44808fa8a2d7bc01b3915aa59c064411 (cohuck/qemu-kvm-c9s)
-
-Jira: https://issues.redhat.com/browse/RHEL-24988
-Upstream: RHEL only
-
-We do not plan to support any machine types prior to 9.4.0; leave them
-in, but mark as deprecated.
-
-Signed-off-by: Cornelia Huck <cohuck@redhat.com>
----
- hw/arm/virt.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index 60f117f0d2..943c563391 100644
---- a/hw/arm/virt.c
-+++ b/hw/arm/virt.c
-@@ -3679,6 +3679,10 @@ static void rhel920_virt_options(MachineClass *mc)
-     compat_props_add(mc->compat_props, hw_compat_rhel_9_4, hw_compat_rhel_9_4_len);
-     compat_props_add(mc->compat_props, hw_compat_rhel_9_3, hw_compat_rhel_9_3_len);
-     compat_props_add(mc->compat_props, hw_compat_rhel_9_2, hw_compat_rhel_9_2_len);
-+
-+    /* RHEL 9.4 is the first supported release */
-+    mc->deprecation_reason =
-+        "machine types for versions prior to 9.4 are deprecated";
- }
- DEFINE_RHEL_MACHINE(9, 2, 0)
- 
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-hw-i386-Activate-IOMMUFD-for-q35-machines.patch b/SOURCES/kvm-hw-i386-Activate-IOMMUFD-for-q35-machines.patch
deleted file mode 100644
index 81c20e5..0000000
--- a/SOURCES/kvm-hw-i386-Activate-IOMMUFD-for-q35-machines.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From 7a6be312c11911bdd2ce82566be22a3e014947c2 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
-Date: Tue, 21 Nov 2023 16:44:20 +0800
-Subject: [PATCH 041/101] hw/i386: Activate IOMMUFD for q35 machines
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [40/67] b15764ab24fd57389a8d219736613484acd7d29e (eauger1/centos-qemu-kvm)
-
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Tested-by: Nicolin Chen <nicolinc@nvidia.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 64ad06f6eba66c514477f490bcba409439a480d8)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/i386/Kconfig | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/hw/i386/Kconfig b/hw/i386/Kconfig
-index 55850791df..a1846be6f7 100644
---- a/hw/i386/Kconfig
-+++ b/hw/i386/Kconfig
-@@ -95,6 +95,7 @@ config Q35
-     imply E1000E_PCI_EXPRESS
-     imply VMPORT
-     imply VMMOUSE
-+    imply IOMMUFD
-     select PC_PCI
-     select PC_ACPI
-     select PCI_EXPRESS_Q35
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-hw-i386-Add-support-for-loading-BIOS-using-guest_mem.patch b/SOURCES/kvm-hw-i386-Add-support-for-loading-BIOS-using-guest_mem.patch
new file mode 100644
index 0000000..ee2f88e
--- /dev/null
+++ b/SOURCES/kvm-hw-i386-Add-support-for-loading-BIOS-using-guest_mem.patch
@@ -0,0 +1,73 @@
+From e74980be81d641736ea9d44d0fe9af02af63a220 Mon Sep 17 00:00:00 2001
+From: Michael Roth <michael.roth@amd.com>
+Date: Thu, 30 May 2024 06:16:40 -0500
+Subject: [PATCH 083/100] hw/i386: Add support for loading BIOS using
+ guest_memfd
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [83/91] 7b77d212ef7d83b66ad9d8348179ee84e64fb911 (bonzini/rhel-qemu-kvm)
+
+When guest_memfd is enabled, the BIOS is generally part of the initial
+encrypted guest image and will be accessed as private guest memory. Add
+the necessary changes to set up the associated RAM region with a
+guest_memfd backend to allow for this.
+
+Current support centers around using -bios to load the BIOS data.
+Support for loading the BIOS via pflash requires additional enablement
+since those interfaces rely on the use of ROM memory regions which make
+use of the KVM_MEM_READONLY memslot flag, which is not supported for
+guest_memfd-backed memslots.
+
+Signed-off-by: Michael Roth <michael.roth@amd.com>
+Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com>
+Message-ID: <20240530111643.1091816-29-pankaj.gupta@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit fc7a69e177e4ba26d11fcf47b853f85115b35a11)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ hw/i386/x86-common.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+diff --git a/hw/i386/x86-common.c b/hw/i386/x86-common.c
+index 35fe6eabea..6cbb76c25c 100644
+--- a/hw/i386/x86-common.c
++++ b/hw/i386/x86-common.c
+@@ -969,8 +969,13 @@ void x86_bios_rom_init(X86MachineState *x86ms, const char *default_firmware,
+         (bios_size % 65536) != 0) {
+         goto bios_error;
+     }
+-    memory_region_init_ram(&x86ms->bios, NULL, "pc.bios", bios_size,
+-                           &error_fatal);
++    if (machine_require_guest_memfd(MACHINE(x86ms))) {
++        memory_region_init_ram_guest_memfd(&x86ms->bios, NULL, "pc.bios",
++                                           bios_size, &error_fatal);
++    } else {
++        memory_region_init_ram(&x86ms->bios, NULL, "pc.bios",
++                               bios_size, &error_fatal);
++    }
+     if (sev_enabled()) {
+         /*
+          * The concept of a "reset" simply doesn't exist for
+@@ -991,9 +996,11 @@ void x86_bios_rom_init(X86MachineState *x86ms, const char *default_firmware,
+     }
+     g_free(filename);
+ 
+-    /* map the last 128KB of the BIOS in ISA space */
+-    x86_isa_bios_init(&x86ms->isa_bios, rom_memory, &x86ms->bios,
+-                      !isapc_ram_fw);
++    if (!machine_require_guest_memfd(MACHINE(x86ms))) {
++        /* map the last 128KB of the BIOS in ISA space */
++        x86_isa_bios_init(&x86ms->isa_bios, rom_memory, &x86ms->bios,
++                          !isapc_ram_fw);
++    }
+ 
+     /* map all the bios at the top of memory */
+     memory_region_add_subregion(rom_memory,
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-hw-i386-Have-x86_bios_rom_init-take-X86MachineState-.patch b/SOURCES/kvm-hw-i386-Have-x86_bios_rom_init-take-X86MachineState-.patch
new file mode 100644
index 0000000..1fafe03
--- /dev/null
+++ b/SOURCES/kvm-hw-i386-Have-x86_bios_rom_init-take-X86MachineState-.patch
@@ -0,0 +1,106 @@
+From c1e615d6b8f609b72a94ffe6d31a9848a41744ef Mon Sep 17 00:00:00 2001
+From: Bernhard Beschow <shentey@gmail.com>
+Date: Tue, 30 Apr 2024 17:06:39 +0200
+Subject: [PATCH 038/100] hw/i386: Have x86_bios_rom_init() take
+ X86MachineState rather than MachineState
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [38/91] 59f388b1dffc5d0aa2f0fff768194d755bc3efbb (bonzini/rhel-qemu-kvm)
+
+The function creates and leaks two MemoryRegion objects regarding the BIOS which
+will be moved into X86MachineState in the next steps to avoid the leakage.
+
+Signed-off-by: Bernhard Beschow <shentey@gmail.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Message-ID: <20240430150643.111976-3-shentey@gmail.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+(cherry picked from commit 848351840148f8c3b53ddf6210194506547d3ffd)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ hw/i386/microvm.c     | 2 +-
+ hw/i386/pc_sysfw.c    | 4 ++--
+ hw/i386/x86.c         | 4 ++--
+ include/hw/i386/x86.h | 2 +-
+ 4 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/hw/i386/microvm.c b/hw/i386/microvm.c
+index 61a772dfe6..fec63cacfa 100644
+--- a/hw/i386/microvm.c
++++ b/hw/i386/microvm.c
+@@ -278,7 +278,7 @@ static void microvm_devices_init(MicrovmMachineState *mms)
+     default_firmware = x86_machine_is_acpi_enabled(x86ms)
+             ? MICROVM_BIOS_FILENAME
+             : MICROVM_QBOOT_FILENAME;
+-    x86_bios_rom_init(MACHINE(mms), default_firmware, get_system_memory(), true);
++    x86_bios_rom_init(x86ms, default_firmware, get_system_memory(), true);
+ }
+ 
+ static void microvm_memory_init(MicrovmMachineState *mms)
+diff --git a/hw/i386/pc_sysfw.c b/hw/i386/pc_sysfw.c
+index 3efabbbab2..ef7dea9798 100644
+--- a/hw/i386/pc_sysfw.c
++++ b/hw/i386/pc_sysfw.c
+@@ -206,7 +206,7 @@ void pc_system_firmware_init(PCMachineState *pcms,
+     BlockBackend *pflash_blk[ARRAY_SIZE(pcms->flash)];
+ 
+     if (!pcmc->pci_enabled) {
+-        x86_bios_rom_init(MACHINE(pcms), "bios.bin", rom_memory, true);
++        x86_bios_rom_init(X86_MACHINE(pcms), "bios.bin", rom_memory, true);
+         return;
+     }
+ 
+@@ -227,7 +227,7 @@ void pc_system_firmware_init(PCMachineState *pcms,
+ 
+     if (!pflash_blk[0]) {
+         /* Machine property pflash0 not set, use ROM mode */
+-        x86_bios_rom_init(MACHINE(pcms), "bios.bin", rom_memory, false);
++        x86_bios_rom_init(X86_MACHINE(pcms), "bios.bin", rom_memory, false);
+     } else {
+         if (kvm_enabled() && !kvm_readonly_mem_enabled()) {
+             /*
+diff --git a/hw/i386/x86.c b/hw/i386/x86.c
+index 2a4f3ee285..6d3c72f124 100644
+--- a/hw/i386/x86.c
++++ b/hw/i386/x86.c
+@@ -1128,7 +1128,7 @@ void x86_load_linux(X86MachineState *x86ms,
+     nb_option_roms++;
+ }
+ 
+-void x86_bios_rom_init(MachineState *ms, const char *default_firmware,
++void x86_bios_rom_init(X86MachineState *x86ms, const char *default_firmware,
+                        MemoryRegion *rom_memory, bool isapc_ram_fw)
+ {
+     const char *bios_name;
+@@ -1138,7 +1138,7 @@ void x86_bios_rom_init(MachineState *ms, const char *default_firmware,
+     ssize_t ret;
+ 
+     /* BIOS load */
+-    bios_name = ms->firmware ?: default_firmware;
++    bios_name = MACHINE(x86ms)->firmware ?: default_firmware;
+     filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, bios_name);
+     if (filename) {
+         bios_size = get_image_size(filename);
+diff --git a/include/hw/i386/x86.h b/include/hw/i386/x86.h
+index 4dc30dcb4d..cb07618d19 100644
+--- a/include/hw/i386/x86.h
++++ b/include/hw/i386/x86.h
+@@ -116,7 +116,7 @@ void x86_cpu_unplug_request_cb(HotplugHandler *hotplug_dev,
+ void x86_cpu_unplug_cb(HotplugHandler *hotplug_dev,
+                        DeviceState *dev, Error **errp);
+ 
+-void x86_bios_rom_init(MachineState *ms, const char *default_firmware,
++void x86_bios_rom_init(X86MachineState *x86ms, const char *default_firmware,
+                        MemoryRegion *rom_memory, bool isapc_ram_fw);
+ 
+ void x86_load_linux(X86MachineState *x86ms,
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-hw-i386-acpi-Set-PCAT_COMPAT-bit-only-when-pic-is-no.patch b/SOURCES/kvm-hw-i386-acpi-Set-PCAT_COMPAT-bit-only-when-pic-is-no.patch
new file mode 100644
index 0000000..a789fb7
--- /dev/null
+++ b/SOURCES/kvm-hw-i386-acpi-Set-PCAT_COMPAT-bit-only-when-pic-is-no.patch
@@ -0,0 +1,51 @@
+From 7bb1f124413891bc5d2187f12cd19da6e794904b Mon Sep 17 00:00:00 2001
+From: Xiaoyao Li <xiaoyao.li@intel.com>
+Date: Wed, 3 Apr 2024 10:59:53 -0400
+Subject: [PATCH 010/100] hw/i386/acpi: Set PCAT_COMPAT bit only when pic is
+ not disabled
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [10/91] 62110e4bf52cb3e106c8d2a902bbd31548beba00 (bonzini/rhel-qemu-kvm)
+
+A value 1 of PCAT_COMPAT (bit 0) of MADT.Flags indicates that the system
+also has a PC-AT-compatible dual-8259 setup, i.e., the PIC.  When PIC
+is not enabled (pic=off) for x86 machine, the PCAT_COMPAT bit needs to
+be cleared.  The PIC probe should then print:
+
+   [    0.155970] Using NULL legacy PIC
+
+However, no such log printed in guest kernel unless PCAT_COMPAT is
+cleared.
+
+Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
+Message-ID: <20240403145953.3082491-1-xiaoyao.li@intel.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 292dd287e78e0cbafde9d1522c729349d132d844)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ hw/i386/acpi-common.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/hw/i386/acpi-common.c b/hw/i386/acpi-common.c
+index 20f19269da..0cc2919bb8 100644
+--- a/hw/i386/acpi-common.c
++++ b/hw/i386/acpi-common.c
+@@ -107,7 +107,9 @@ void acpi_build_madt(GArray *table_data, BIOSLinker *linker,
+     acpi_table_begin(&table, table_data);
+     /* Local APIC Address */
+     build_append_int_noprefix(table_data, APIC_DEFAULT_ADDRESS, 4);
+-    build_append_int_noprefix(table_data, 1 /* PCAT_COMPAT */, 4); /* Flags */
++    /* Flags. bit 0: PCAT_COMPAT */
++    build_append_int_noprefix(table_data,
++                              x86ms->pic != ON_OFF_AUTO_OFF ? 1 : 0 , 4);
+ 
+     for (i = 0; i < apic_ids->len; i++) {
+         pc_madt_cpu_entry(i, apic_ids, table_data, false);
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-hw-i386-pc-Defer-smbios_set_defaults-to-machine_done.patch b/SOURCES/kvm-hw-i386-pc-Defer-smbios_set_defaults-to-machine_done.patch
deleted file mode 100644
index 5470bdf..0000000
--- a/SOURCES/kvm-hw-i386-pc-Defer-smbios_set_defaults-to-machine_done.patch
+++ /dev/null
@@ -1,186 +0,0 @@
-From ea2e2368dcf4140be47288472f2c2a094358e0c7 Mon Sep 17 00:00:00 2001
-From: Igor Mammedov <imammedo@redhat.com>
-Date: Thu, 8 Feb 2024 23:03:45 +0100
-Subject: [PATCH 03/20] hw/i386/pc: Defer smbios_set_defaults() to machine_done
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Igor Mammedov <imammedo@redhat.com>
-RH-MergeRequest: 230: Workaround Windows failing to find 64bit SMBIOS entry point with SeaBIOS
-RH-Jira: RHEL-21705
-RH-Acked-by: MST <mst@redhat.com>
-RH-Acked-by: Ani Sinha <None>
-RH-Commit: [1/18] 9d4c1d1a910fec7d310429d6fc0b10c798932db7
-
-JIRA: https://issues.redhat.com/browse/RHEL-21705
-
-commit: a0204a5ed091dfe79aced7ec8f3ce1931fd25816
-Author: Bernhard Beschow <shentey@gmail.com>
-
-    Handling most of smbios data generation in the machine_done notifier is similar
-    to how the ARM virt machine handles it which also calls smbios_set_defaults()
-    there. The result is that all pc machines are freed from explicitly worrying
-    about smbios setup.
-
-    Signed-off-by: Bernhard Beschow <shentey@gmail.com>
-    Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-    Message-ID: <20240208220349.4948-6-shentey@gmail.com>
-    Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-
-Conflicts: hw/i386/pc_q35.c, hw/i386/pc_piix.c
-  due to missing 4d3457fef9 (w/i386/pc: Merge pc_guest_info_init() into pc_machine_initfn())
-  and different signature of smbios_set_defaults() downstream
-Fixup: hw/i386/fw_cfg.c to account for downstream changes smbios_set_defaults()
-
-Signed-off-by: Igor Mammedov <imammedo@redhat.com>
----
- hw/i386/fw_cfg.c     | 14 +++++++++++++-
- hw/i386/fw_cfg.h     |  3 ++-
- hw/i386/pc.c         |  2 +-
- hw/i386/pc_piix.c    | 12 ------------
- hw/i386/pc_q35.c     | 11 -----------
- include/hw/i386/pc.h |  1 -
- 6 files changed, 16 insertions(+), 27 deletions(-)
-
-diff --git a/hw/i386/fw_cfg.c b/hw/i386/fw_cfg.c
-index 7362daa45a..6a5466faf0 100644
---- a/hw/i386/fw_cfg.c
-+++ b/hw/i386/fw_cfg.c
-@@ -48,15 +48,27 @@ const char *fw_cfg_arch_key_name(uint16_t key)
-     return NULL;
- }
- 
--void fw_cfg_build_smbios(MachineState *ms, FWCfgState *fw_cfg)
-+void fw_cfg_build_smbios(PCMachineState *pcms, FWCfgState *fw_cfg)
- {
- #ifdef CONFIG_SMBIOS
-     uint8_t *smbios_tables, *smbios_anchor;
-     size_t smbios_tables_len, smbios_anchor_len;
-     struct smbios_phys_mem_area *mem_array;
-     unsigned i, array_count;
-+    MachineState *ms = MACHINE(pcms);
-+    PCMachineClass *pcmc = PC_MACHINE_GET_CLASS(pcms);
-+    MachineClass *mc = MACHINE_GET_CLASS(pcms);
-     X86CPU *cpu = X86_CPU(ms->possible_cpus->cpus[0].cpu);
- 
-+    if (pcmc->smbios_defaults) {
-+        /* These values are guest ABI, do not change */
-+        smbios_set_defaults("QEMU", mc->desc, mc->name,
-+                            pcmc->smbios_legacy_mode, pcmc->smbios_uuid_encoded,
-+                            pcmc->smbios_stream_product,
-+                            pcmc->smbios_stream_version,
-+                            pcms->smbios_entry_point_type);
-+    }
-+
-     /* tell smbios about cpuid version and features */
-     smbios_set_cpuid(cpu->env.cpuid_version, cpu->env.features[FEAT_1_EDX]);
- 
-diff --git a/hw/i386/fw_cfg.h b/hw/i386/fw_cfg.h
-index 86ca7c1c0c..1e1de6b4a3 100644
---- a/hw/i386/fw_cfg.h
-+++ b/hw/i386/fw_cfg.h
-@@ -10,6 +10,7 @@
- #define HW_I386_FW_CFG_H
- 
- #include "hw/boards.h"
-+#include "hw/i386/pc.h"
- #include "hw/nvram/fw_cfg.h"
- 
- #define FW_CFG_IO_BASE     0x510
-@@ -22,7 +23,7 @@
- FWCfgState *fw_cfg_arch_create(MachineState *ms,
-                                uint16_t boot_cpus,
-                                uint16_t apic_id_limit);
--void fw_cfg_build_smbios(MachineState *ms, FWCfgState *fw_cfg);
-+void fw_cfg_build_smbios(PCMachineState *ms, FWCfgState *fw_cfg);
- void fw_cfg_build_feature_control(MachineState *ms, FWCfgState *fw_cfg);
- void fw_cfg_add_acpi_dsdt(Aml *scope, FWCfgState *fw_cfg);
- 
-diff --git a/hw/i386/pc.c b/hw/i386/pc.c
-index a1faa9e92c..16de2a59e8 100644
---- a/hw/i386/pc.c
-+++ b/hw/i386/pc.c
-@@ -847,7 +847,7 @@ void pc_machine_done(Notifier *notifier, void *data)
- 
-     acpi_setup();
-     if (x86ms->fw_cfg) {
--        fw_cfg_build_smbios(MACHINE(pcms), x86ms->fw_cfg);
-+        fw_cfg_build_smbios(pcms, x86ms->fw_cfg);
-         fw_cfg_build_feature_control(MACHINE(pcms), x86ms->fw_cfg);
-         /* update FW_CFG_NB_CPUS to account for -device added CPUs */
-         fw_cfg_modify_i16(x86ms->fw_cfg, FW_CFG_NB_CPUS, x86ms->boot_cpus);
-diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
-index 09d02cc91f..7344b35cf1 100644
---- a/hw/i386/pc_piix.c
-+++ b/hw/i386/pc_piix.c
-@@ -36,7 +36,6 @@
- #include "hw/rtc/mc146818rtc.h"
- #include "hw/southbridge/piix.h"
- #include "hw/display/ramfb.h"
--#include "hw/firmware/smbios.h"
- #include "hw/pci/pci.h"
- #include "hw/pci/pci_ids.h"
- #include "hw/usb.h"
-@@ -233,17 +232,6 @@ static void pc_init1(MachineState *machine,
- 
-     pc_guest_info_init(pcms);
- 
--    if (pcmc->smbios_defaults) {
--        MachineClass *mc = MACHINE_GET_CLASS(machine);
--        /* These values are guest ABI, do not change */
--        smbios_set_defaults("Red Hat", "KVM",
--                            mc->desc, pcmc->smbios_legacy_mode,
--                            pcmc->smbios_uuid_encoded,
--                            pcmc->smbios_stream_product,
--                            pcmc->smbios_stream_version,
--                            pcms->smbios_entry_point_type);
--    }
--
-     /* allocate ram and load rom/bios */
-     if (!xen_enabled()) {
-         pc_memory_init(pcms, system_memory, rom_memory, hole64_size);
-diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
-index c6967e1846..9a22ff5dd6 100644
---- a/hw/i386/pc_q35.c
-+++ b/hw/i386/pc_q35.c
-@@ -45,7 +45,6 @@
- #include "hw/i386/amd_iommu.h"
- #include "hw/i386/intel_iommu.h"
- #include "hw/display/ramfb.h"
--#include "hw/firmware/smbios.h"
- #include "hw/ide/pci.h"
- #include "hw/ide/ahci.h"
- #include "hw/intc/ioapic.h"
-@@ -201,16 +200,6 @@ static void pc_q35_init(MachineState *machine)
- 
-     pc_guest_info_init(pcms);
- 
--    if (pcmc->smbios_defaults) {
--        /* These values are guest ABI, do not change */
--        smbios_set_defaults("Red Hat", "KVM",
--                            mc->desc, pcmc->smbios_legacy_mode,
--                            pcmc->smbios_uuid_encoded,
--                            pcmc->smbios_stream_product,
--                            pcmc->smbios_stream_version,
--                            pcms->smbios_entry_point_type);
--    }
--
-     /* create pci host bus */
-     phb = OBJECT(qdev_new(TYPE_Q35_HOST_DEVICE));
- 
-diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
-index 37644ede7e..c286c10bc3 100644
---- a/include/hw/i386/pc.h
-+++ b/include/hw/i386/pc.h
-@@ -12,7 +12,6 @@
- #include "hw/hotplug.h"
- #include "qom/object.h"
- #include "hw/i386/sgx-epc.h"
--#include "hw/firmware/smbios.h"
- #include "hw/cxl/cxl.h"
- 
- #define HPET_INTCAP "hpet-intcap"
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-hw-i386-pc_sysfw-Alias-rather-than-copy-isa-bios-reg.patch b/SOURCES/kvm-hw-i386-pc_sysfw-Alias-rather-than-copy-isa-bios-reg.patch
new file mode 100644
index 0000000..021db3d
--- /dev/null
+++ b/SOURCES/kvm-hw-i386-pc_sysfw-Alias-rather-than-copy-isa-bios-reg.patch
@@ -0,0 +1,164 @@
+From fd6de3c5e97bdf13a39342fc71815a20c66867ae Mon Sep 17 00:00:00 2001
+From: Bernhard Beschow <shentey@gmail.com>
+Date: Wed, 8 May 2024 19:55:07 +0200
+Subject: [PATCH 043/100] hw/i386/pc_sysfw: Alias rather than copy isa-bios
+ region
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [43/91] f64dab2a091838a10a9b94e3d09ea11432b0809f (bonzini/rhel-qemu-kvm)
+
+In the -bios case the "isa-bios" memory region is an alias to the BIOS mapped
+to the top of the 4G memory boundary. Do the same in the -pflash case, but only
+for new machine versions for migration compatibility. This establishes common
+behavior and makes pflash commands work in the "isa-bios" region which some
+real-world legacy bioses rely on.
+
+Note that in the sev_enabled() case, the "isa-bios" memory region in the -pflash
+case will now also point to encrypted memory, just like it already does in the
+-bios case.
+
+When running `info mtree` before and after this commit with
+`qemu-system-x86_64 -S -drive \
+if=pflash,format=raw,readonly=on,file=/usr/share/qemu/bios-256k.bin` and running
+`diff -u before.mtree after.mtree` results in the following changes in the
+memory tree:
+
+|  --- before.mtree
+|  +++ after.mtree
+|  @@ -71,7 +71,7 @@
+|       0000000000000000-ffffffffffffffff (prio -1, i/o): pci
+|       00000000000a0000-00000000000bffff (prio 1, i/o): vga-lowmem
+|       00000000000c0000-00000000000dffff (prio 1, rom): pc.rom
+|  -      00000000000e0000-00000000000fffff (prio 1, rom): isa-bios
+|  +      00000000000e0000-00000000000fffff (prio 1, romd): alias isa-bios @system.flash0 0000000000020000-000000000003ffff
+|       00000000000a0000-00000000000bffff (prio 1, i/o): alias smram-region @pci 00000000000a0000-00000000000bffff
+|       00000000000c0000-00000000000c3fff (prio 1, i/o): alias pam-pci @pci 00000000000c0000-00000000000c3fff
+|       00000000000c4000-00000000000c7fff (prio 1, i/o): alias pam-pci @pci 00000000000c4000-00000000000c7fff
+|  @@ -108,7 +108,7 @@
+|       0000000000000000-ffffffffffffffff (prio -1, i/o): pci
+|       00000000000a0000-00000000000bffff (prio 1, i/o): vga-lowmem
+|       00000000000c0000-00000000000dffff (prio 1, rom): pc.rom
+|  -      00000000000e0000-00000000000fffff (prio 1, rom): isa-bios
+|  +      00000000000e0000-00000000000fffff (prio 1, romd): alias isa-bios @system.flash0 0000000000020000-000000000003ffff
+|       00000000000a0000-00000000000bffff (prio 1, i/o): alias smram-region @pci 00000000000a0000-00000000000bffff
+|       00000000000c0000-00000000000c3fff (prio 1, i/o): alias pam-pci @pci 00000000000c0000-00000000000c3fff
+|       00000000000c4000-00000000000c7fff (prio 1, i/o): alias pam-pci @pci 00000000000c4000-00000000000c7fff
+|  @@ -131,11 +131,14 @@
+|  memory-region: pc.ram
+|  0000000000000000-0000000007ffffff (prio 0, ram): pc.ram
+|
+|  +memory-region: system.flash0
+|  +  00000000fffc0000-00000000ffffffff (prio 0, romd): system.flash0
+|  +
+|  memory-region: pci
+|  0000000000000000-ffffffffffffffff (prio -1, i/o): pci
+|       00000000000a0000-00000000000bffff (prio 1, i/o): vga-lowmem
+|       00000000000c0000-00000000000dffff (prio 1, rom): pc.rom
+|  -    00000000000e0000-00000000000fffff (prio 1, rom): isa-bios
+|  +    00000000000e0000-00000000000fffff (prio 1, romd): alias isa-bios @system.flash0 0000000000020000-000000000003ffff
+|
+|  memory-region: smram
+|       00000000000a0000-00000000000bffff (prio 0, ram): alias smram-low @pc.ram 00000000000a0000-00000000000bffff
+
+Note that in both cases the "system" memory region contains the entry
+
+  00000000fffc0000-00000000ffffffff (prio 0, romd): system.flash0
+
+but the "system.flash0" memory region only appears standalone when "isa-bios" is
+an alias.
+
+Signed-off-by: Bernhard Beschow <shentey@gmail.com>
+Message-ID: <20240508175507.22270-7-shentey@gmail.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit a44ea3fa7f2aa1d809fdca1b84a52695b53d8ad0)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ hw/i386/pc.c         | 1 +
+ hw/i386/pc_piix.c    | 1 +
+ hw/i386/pc_q35.c     | 1 +
+ hw/i386/pc_sysfw.c   | 8 +++++++-
+ include/hw/i386/pc.h | 1 +
+ 5 files changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/hw/i386/pc.c b/hw/i386/pc.c
+index 1a34bc4522..660a59c63b 100644
+--- a/hw/i386/pc.c
++++ b/hw/i386/pc.c
+@@ -1967,6 +1967,7 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
+     pcmc->has_reserved_memory = true;
+     pcmc->enforce_aligned_dimm = true;
+     pcmc->enforce_amd_1tb_hole = true;
++    pcmc->isa_bios_alias = true;
+     /* BIOS ACPI tables: 128K. Other BIOS datastructures: less than 4K reported
+      * to be used at the moment, 32K should be enough for a while.  */
+     pcmc->acpi_data_size = 0x20000 + 0x8000;
+diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
+index bef3e8b73e..dbb7f2ed17 100644
+--- a/hw/i386/pc_piix.c
++++ b/hw/i386/pc_piix.c
+@@ -975,6 +975,7 @@ static void pc_machine_rhel7_options(MachineClass *m)
+     m->alias = "pc";
+     m->is_default = 1;
+     m->smp_props.prefer_sockets = true;
++    pcmc->isa_bios_alias = false;
+ }
+ 
+ static void pc_init_rhel760(MachineState *machine)
+diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
+index dedc86eec9..f9900ad798 100644
+--- a/hw/i386/pc_q35.c
++++ b/hw/i386/pc_q35.c
+@@ -735,6 +735,7 @@ static void pc_q35_machine_rhel940_options(MachineClass *m)
+     m->desc = "RHEL-9.4.0 PC (Q35 + ICH9, 2009)";
+     pcmc->smbios_stream_product = "RHEL";
+     pcmc->smbios_stream_version = "9.4.0";
++    pcmc->isa_bios_alias = false;
+ 
+     compat_props_add(m->compat_props, pc_rhel_9_5_compat,
+ 		     pc_rhel_9_5_compat_len);
+diff --git a/hw/i386/pc_sysfw.c b/hw/i386/pc_sysfw.c
+index 82d37cb376..ac88ad4eb9 100644
+--- a/hw/i386/pc_sysfw.c
++++ b/hw/i386/pc_sysfw.c
+@@ -135,6 +135,7 @@ static void pc_system_flash_map(PCMachineState *pcms,
+                                 MemoryRegion *rom_memory)
+ {
+     X86MachineState *x86ms = X86_MACHINE(pcms);
++    PCMachineClass *pcmc = PC_MACHINE_GET_CLASS(pcms);
+     hwaddr total_size = 0;
+     int i;
+     BlockBackend *blk;
+@@ -184,7 +185,12 @@ static void pc_system_flash_map(PCMachineState *pcms,
+ 
+         if (i == 0) {
+             flash_mem = pflash_cfi01_get_memory(system_flash);
+-            pc_isa_bios_init(&x86ms->isa_bios, rom_memory, flash_mem);
++            if (pcmc->isa_bios_alias) {
++                x86_isa_bios_init(&x86ms->isa_bios, rom_memory, flash_mem,
++                                  true);
++            } else {
++                pc_isa_bios_init(&x86ms->isa_bios, rom_memory, flash_mem);
++            }
+ 
+             /* Encrypt the pflash boot ROM */
+             if (sev_enabled()) {
+diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
+index 467e7fb52f..3f53ec73ac 100644
+--- a/include/hw/i386/pc.h
++++ b/include/hw/i386/pc.h
+@@ -122,6 +122,7 @@ struct PCMachineClass {
+     bool enforce_aligned_dimm;
+     bool broken_reserved_end;
+     bool enforce_amd_1tb_hole;
++    bool isa_bios_alias;
+ 
+     /* generate legacy CPU hotplug AML */
+     bool legacy_cpu_hotplug;
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-hw-i386-pc_sysfw-Remove-unused-parameter-from-pc_isa.patch b/SOURCES/kvm-hw-i386-pc_sysfw-Remove-unused-parameter-from-pc_isa.patch
new file mode 100644
index 0000000..4188fd3
--- /dev/null
+++ b/SOURCES/kvm-hw-i386-pc_sysfw-Remove-unused-parameter-from-pc_isa.patch
@@ -0,0 +1,53 @@
+From 9bf1d368c4b53139db39649833d475e097fc98d1 Mon Sep 17 00:00:00 2001
+From: Bernhard Beschow <shentey@gmail.com>
+Date: Mon, 22 Apr 2024 22:06:22 +0200
+Subject: [PATCH 039/100] hw/i386/pc_sysfw: Remove unused parameter from
+ pc_isa_bios_init()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [39/91] c0019dc2706a8e3f40486fd4a4c0dd1fbe23237b (bonzini/rhel-qemu-kvm)
+
+Signed-off-by: Bernhard Beschow <shentey@gmail.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Message-ID: <20240422200625.2768-2-shentey@gmail.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+(cherry picked from commit f4b63768b91811cdcf1fb7b270587123251dfea5)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ hw/i386/pc_sysfw.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/hw/i386/pc_sysfw.c b/hw/i386/pc_sysfw.c
+index ef7dea9798..59c7a81692 100644
+--- a/hw/i386/pc_sysfw.c
++++ b/hw/i386/pc_sysfw.c
+@@ -41,8 +41,7 @@
+ #define FLASH_SECTOR_SIZE 4096
+ 
+ static void pc_isa_bios_init(MemoryRegion *rom_memory,
+-                             MemoryRegion *flash_mem,
+-                             int ram_size)
++                             MemoryRegion *flash_mem)
+ {
+     int isa_bios_size;
+     MemoryRegion *isa_bios;
+@@ -186,7 +185,7 @@ static void pc_system_flash_map(PCMachineState *pcms,
+ 
+         if (i == 0) {
+             flash_mem = pflash_cfi01_get_memory(system_flash);
+-            pc_isa_bios_init(rom_memory, flash_mem, size);
++            pc_isa_bios_init(rom_memory, flash_mem);
+ 
+             /* Encrypt the pflash boot ROM */
+             if (sev_enabled()) {
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-hw-i386-sev-Add-function-to-get-SEV-metadata-from-OV.patch b/SOURCES/kvm-hw-i386-sev-Add-function-to-get-SEV-metadata-from-OV.patch
new file mode 100644
index 0000000..a543c79
--- /dev/null
+++ b/SOURCES/kvm-hw-i386-sev-Add-function-to-get-SEV-metadata-from-OV.patch
@@ -0,0 +1,158 @@
+From e6472ff46cbed97c2a238a8ef7d321351931333a Mon Sep 17 00:00:00 2001
+From: Brijesh Singh <brijesh.singh@amd.com>
+Date: Thu, 30 May 2024 06:16:30 -0500
+Subject: [PATCH 070/100] hw/i386/sev: Add function to get SEV metadata from
+ OVMF header
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [70/91] ba818dade96119c8a51ca1fb222f4f69e2752396 (bonzini/rhel-qemu-kvm)
+
+A recent version of OVMF expanded the reset vector GUID list to add
+SEV-specific metadata GUID. The SEV metadata describes the reserved
+memory regions such as the secrets and CPUID page used during the SEV-SNP
+guest launch.
+
+The pc_system_get_ovmf_sev_metadata_ptr() is used to retieve the SEV
+metadata pointer from the OVMF GUID list.
+
+Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
+Signed-off-by: Michael Roth <michael.roth@amd.com>
+Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com>
+Message-ID: <20240530111643.1091816-19-pankaj.gupta@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit f3c30c575d34122573b7370a7da5ca3a27dde481)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ hw/i386/pc_sysfw.c            |  4 ++++
+ include/hw/i386/pc.h          | 26 ++++++++++++++++++++++++++
+ target/i386/sev-sysemu-stub.c |  4 ++++
+ target/i386/sev.c             | 32 ++++++++++++++++++++++++++++++++
+ target/i386/sev.h             |  2 ++
+ 5 files changed, 68 insertions(+)
+
+diff --git a/hw/i386/pc_sysfw.c b/hw/i386/pc_sysfw.c
+index ac88ad4eb9..9b8671c441 100644
+--- a/hw/i386/pc_sysfw.c
++++ b/hw/i386/pc_sysfw.c
+@@ -260,6 +260,10 @@ void x86_firmware_configure(void *ptr, int size)
+     pc_system_parse_ovmf_flash(ptr, size);
+ 
+     if (sev_enabled()) {
++
++        /* Copy the SEV metadata table (if it exists) */
++        pc_system_parse_sev_metadata(ptr, size);
++
+         ret = sev_es_save_reset_vector(ptr, size);
+         if (ret) {
+             error_report("failed to locate and/or save reset vector");
+diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
+index 3f53ec73ac..94b49310f5 100644
+--- a/include/hw/i386/pc.h
++++ b/include/hw/i386/pc.h
+@@ -167,6 +167,32 @@ void pc_acpi_smi_interrupt(void *opaque, int irq, int level);
+ #define PCI_HOST_ABOVE_4G_MEM_SIZE     "above-4g-mem-size"
+ #define PCI_HOST_PROP_SMM_RANGES       "smm-ranges"
+ 
++typedef enum {
++    SEV_DESC_TYPE_UNDEF,
++    /* The section contains the region that must be validated by the VMM. */
++    SEV_DESC_TYPE_SNP_SEC_MEM,
++    /* The section contains the SNP secrets page */
++    SEV_DESC_TYPE_SNP_SECRETS,
++    /* The section contains address that can be used as a CPUID page */
++    SEV_DESC_TYPE_CPUID,
++
++} ovmf_sev_metadata_desc_type;
++
++typedef struct __attribute__((__packed__)) OvmfSevMetadataDesc {
++    uint32_t base;
++    uint32_t len;
++    ovmf_sev_metadata_desc_type type;
++} OvmfSevMetadataDesc;
++
++typedef struct __attribute__((__packed__)) OvmfSevMetadata {
++    uint8_t signature[4];
++    uint32_t len;
++    uint32_t version;
++    uint32_t num_desc;
++    OvmfSevMetadataDesc descs[];
++} OvmfSevMetadata;
++
++OvmfSevMetadata *pc_system_get_ovmf_sev_metadata_ptr(void);
+ 
+ void pc_pci_as_mapping_init(MemoryRegion *system_memory,
+                             MemoryRegion *pci_address_space);
+diff --git a/target/i386/sev-sysemu-stub.c b/target/i386/sev-sysemu-stub.c
+index 96e1c15cc3..fc1c57c411 100644
+--- a/target/i386/sev-sysemu-stub.c
++++ b/target/i386/sev-sysemu-stub.c
+@@ -67,3 +67,7 @@ void hmp_info_sev(Monitor *mon, const QDict *qdict)
+ {
+     monitor_printf(mon, "SEV is not available in this QEMU\n");
+ }
++
++void pc_system_parse_sev_metadata(uint8_t *flash_ptr, size_t flash_size)
++{
++}
+diff --git a/target/i386/sev.c b/target/i386/sev.c
+index e84e4395a5..17281bb2c7 100644
+--- a/target/i386/sev.c
++++ b/target/i386/sev.c
+@@ -597,6 +597,38 @@ SevCapability *qmp_query_sev_capabilities(Error **errp)
+     return sev_get_capabilities(errp);
+ }
+ 
++static OvmfSevMetadata *ovmf_sev_metadata_table;
++
++#define OVMF_SEV_META_DATA_GUID "dc886566-984a-4798-A75e-5585a7bf67cc"
++typedef struct __attribute__((__packed__)) OvmfSevMetadataOffset {
++    uint32_t offset;
++} OvmfSevMetadataOffset;
++
++OvmfSevMetadata *pc_system_get_ovmf_sev_metadata_ptr(void)
++{
++    return ovmf_sev_metadata_table;
++}
++
++void pc_system_parse_sev_metadata(uint8_t *flash_ptr, size_t flash_size)
++{
++    OvmfSevMetadata     *metadata;
++    OvmfSevMetadataOffset  *data;
++
++    if (!pc_system_ovmf_table_find(OVMF_SEV_META_DATA_GUID, (uint8_t **)&data,
++                                   NULL)) {
++        return;
++    }
++
++    metadata = (OvmfSevMetadata *)(flash_ptr + flash_size - data->offset);
++    if (memcmp(metadata->signature, "ASEV", 4) != 0 ||
++        metadata->len < sizeof(OvmfSevMetadata) ||
++        metadata->len > flash_size - data->offset) {
++        return;
++    }
++
++    ovmf_sev_metadata_table = g_memdup2(metadata, metadata->len);
++}
++
+ static SevAttestationReport *sev_get_attestation_report(const char *mnonce,
+                                                         Error **errp)
+ {
+diff --git a/target/i386/sev.h b/target/i386/sev.h
+index 5dc4767b1e..cc12824dd6 100644
+--- a/target/i386/sev.h
++++ b/target/i386/sev.h
+@@ -66,4 +66,6 @@ int sev_inject_launch_secret(const char *hdr, const char *secret,
+ int sev_es_save_reset_vector(void *flash_ptr, uint64_t flash_size);
+ void sev_es_set_reset_vector(CPUState *cpu);
+ 
++void pc_system_parse_sev_metadata(uint8_t *flash_ptr, size_t flash_size);
++
+ #endif
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-hw-i386-sev-Add-support-to-encrypt-BIOS-when-SEV-SNP.patch b/SOURCES/kvm-hw-i386-sev-Add-support-to-encrypt-BIOS-when-SEV-SNP.patch
new file mode 100644
index 0000000..c5a7a28
--- /dev/null
+++ b/SOURCES/kvm-hw-i386-sev-Add-support-to-encrypt-BIOS-when-SEV-SNP.patch
@@ -0,0 +1,165 @@
+From 226cf6c3d3e2fd1a35422043dbe0b73d1216df83 Mon Sep 17 00:00:00 2001
+From: Brijesh Singh <brijesh.singh@amd.com>
+Date: Thu, 30 May 2024 06:16:36 -0500
+Subject: [PATCH 073/100] hw/i386/sev: Add support to encrypt BIOS when SEV-SNP
+ is enabled
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [73/91] 844afd322c12c3e8992cf6ec692c94e70747bd0c (bonzini/rhel-qemu-kvm)
+
+As with SEV, an SNP guest requires that the BIOS be part of the initial
+encrypted/measured guest payload. Extend sev_encrypt_flash() to handle
+the SNP case and plumb through the GPA of the BIOS location since this
+is needed for SNP.
+
+Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
+Signed-off-by: Michael Roth <michael.roth@amd.com>
+Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com>
+Message-ID: <20240530111643.1091816-25-pankaj.gupta@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 77d1abd91e5352ad30ae2f83790f95fa6a3c0b6b)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ hw/i386/pc_sysfw.c            | 12 +++++++-----
+ hw/i386/x86-common.c          |  2 +-
+ include/hw/i386/x86.h         |  2 +-
+ target/i386/sev-sysemu-stub.c |  2 +-
+ target/i386/sev.c             |  5 +++--
+ target/i386/sev.h             |  2 +-
+ 6 files changed, 14 insertions(+), 11 deletions(-)
+
+diff --git a/hw/i386/pc_sysfw.c b/hw/i386/pc_sysfw.c
+index 9b8671c441..7cdbafc8d2 100644
+--- a/hw/i386/pc_sysfw.c
++++ b/hw/i386/pc_sysfw.c
+@@ -148,6 +148,8 @@ static void pc_system_flash_map(PCMachineState *pcms,
+     assert(PC_MACHINE_GET_CLASS(pcms)->pci_enabled);
+ 
+     for (i = 0; i < ARRAY_SIZE(pcms->flash); i++) {
++        hwaddr gpa;
++
+         system_flash = pcms->flash[i];
+         blk = pflash_cfi01_get_blk(system_flash);
+         if (!blk) {
+@@ -177,11 +179,11 @@ static void pc_system_flash_map(PCMachineState *pcms,
+         }
+ 
+         total_size += size;
++        gpa = 0x100000000ULL - total_size; /* where the flash is mapped */
+         qdev_prop_set_uint32(DEVICE(system_flash), "num-blocks",
+                              size / FLASH_SECTOR_SIZE);
+         sysbus_realize_and_unref(SYS_BUS_DEVICE(system_flash), &error_fatal);
+-        sysbus_mmio_map(SYS_BUS_DEVICE(system_flash), 0,
+-                        0x100000000ULL - total_size);
++        sysbus_mmio_map(SYS_BUS_DEVICE(system_flash), 0, gpa);
+ 
+         if (i == 0) {
+             flash_mem = pflash_cfi01_get_memory(system_flash);
+@@ -196,7 +198,7 @@ static void pc_system_flash_map(PCMachineState *pcms,
+             if (sev_enabled()) {
+                 flash_ptr = memory_region_get_ram_ptr(flash_mem);
+                 flash_size = memory_region_size(flash_mem);
+-                x86_firmware_configure(flash_ptr, flash_size);
++                x86_firmware_configure(gpa, flash_ptr, flash_size);
+             }
+         }
+     }
+@@ -249,7 +251,7 @@ void pc_system_firmware_init(PCMachineState *pcms,
+     pc_system_flash_cleanup_unused(pcms);
+ }
+ 
+-void x86_firmware_configure(void *ptr, int size)
++void x86_firmware_configure(hwaddr gpa, void *ptr, int size)
+ {
+     int ret;
+ 
+@@ -270,6 +272,6 @@ void x86_firmware_configure(void *ptr, int size)
+             exit(1);
+         }
+ 
+-        sev_encrypt_flash(ptr, size, &error_fatal);
++        sev_encrypt_flash(gpa, ptr, size, &error_fatal);
+     }
+ }
+diff --git a/hw/i386/x86-common.c b/hw/i386/x86-common.c
+index 67b03c913a..35fe6eabea 100644
+--- a/hw/i386/x86-common.c
++++ b/hw/i386/x86-common.c
+@@ -981,7 +981,7 @@ void x86_bios_rom_init(X86MachineState *x86ms, const char *default_firmware,
+          */
+         void *ptr = memory_region_get_ram_ptr(&x86ms->bios);
+         load_image_size(filename, ptr, bios_size);
+-        x86_firmware_configure(ptr, bios_size);
++        x86_firmware_configure(0x100000000ULL - bios_size, ptr, bios_size);
+     } else {
+         memory_region_set_readonly(&x86ms->bios, !isapc_ram_fw);
+         ret = rom_add_file_fixed(bios_name, (uint32_t)(-bios_size), -1);
+diff --git a/include/hw/i386/x86.h b/include/hw/i386/x86.h
+index b006f16b8d..d43cb3908e 100644
+--- a/include/hw/i386/x86.h
++++ b/include/hw/i386/x86.h
+@@ -154,6 +154,6 @@ void ioapic_init_gsi(GSIState *gsi_state, Object *parent);
+ DeviceState *ioapic_init_secondary(GSIState *gsi_state);
+ 
+ /* pc_sysfw.c */
+-void x86_firmware_configure(void *ptr, int size);
++void x86_firmware_configure(hwaddr gpa, void *ptr, int size);
+ 
+ #endif
+diff --git a/target/i386/sev-sysemu-stub.c b/target/i386/sev-sysemu-stub.c
+index fc1c57c411..d5bf886e79 100644
+--- a/target/i386/sev-sysemu-stub.c
++++ b/target/i386/sev-sysemu-stub.c
+@@ -42,7 +42,7 @@ void qmp_sev_inject_launch_secret(const char *packet_header, const char *secret,
+     error_setg(errp, "SEV is not available in this QEMU");
+ }
+ 
+-int sev_encrypt_flash(uint8_t *ptr, uint64_t len, Error **errp)
++int sev_encrypt_flash(hwaddr gpa, uint8_t *ptr, uint64_t len, Error **errp)
+ {
+     g_assert_not_reached();
+ }
+diff --git a/target/i386/sev.c b/target/i386/sev.c
+index 06401f0526..7b5c4b4874 100644
+--- a/target/i386/sev.c
++++ b/target/i386/sev.c
+@@ -1484,7 +1484,7 @@ static int sev_snp_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
+ }
+ 
+ int
+-sev_encrypt_flash(uint8_t *ptr, uint64_t len, Error **errp)
++sev_encrypt_flash(hwaddr gpa, uint8_t *ptr, uint64_t len, Error **errp)
+ {
+     SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs);
+ 
+@@ -1841,7 +1841,8 @@ bool sev_add_kernel_loader_hashes(SevKernelLoaderContext *ctx, Error **errp)
+     /* zero the excess data so the measurement can be reliably calculated */
+     memset(padded_ht->padding, 0, sizeof(padded_ht->padding));
+ 
+-    if (sev_encrypt_flash((uint8_t *)padded_ht, sizeof(*padded_ht), errp) < 0) {
++    if (sev_encrypt_flash(area->base, (uint8_t *)padded_ht,
++                          sizeof(*padded_ht), errp) < 0) {
+         ret = false;
+     }
+ 
+diff --git a/target/i386/sev.h b/target/i386/sev.h
+index cc12824dd6..858005a119 100644
+--- a/target/i386/sev.h
++++ b/target/i386/sev.h
+@@ -59,7 +59,7 @@ uint32_t sev_get_cbit_position(void);
+ uint32_t sev_get_reduced_phys_bits(void);
+ bool sev_add_kernel_loader_hashes(SevKernelLoaderContext *ctx, Error **errp);
+ 
+-int sev_encrypt_flash(uint8_t *ptr, uint64_t len, Error **errp);
++int sev_encrypt_flash(hwaddr gpa, uint8_t *ptr, uint64_t len, Error **errp);
+ int sev_inject_launch_secret(const char *hdr, const char *secret,
+                              uint64_t gpa, Error **errp);
+ 
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-hw-i386-sev-Use-guest_memfd-for-legacy-ROMs.patch b/SOURCES/kvm-hw-i386-sev-Use-guest_memfd-for-legacy-ROMs.patch
new file mode 100644
index 0000000..050a522
--- /dev/null
+++ b/SOURCES/kvm-hw-i386-sev-Use-guest_memfd-for-legacy-ROMs.patch
@@ -0,0 +1,123 @@
+From a20b2e3e52b9589ac1abc8b9b818d526c86368cf Mon Sep 17 00:00:00 2001
+From: Michael Roth <michael.roth@amd.com>
+Date: Thu, 30 May 2024 06:16:39 -0500
+Subject: [PATCH 082/100] hw/i386/sev: Use guest_memfd for legacy ROMs
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [82/91] a591e85e00c353009803b143c80852b8c9b1f15e (bonzini/rhel-qemu-kvm)
+
+Current SNP guest kernels will attempt to access these regions with
+with C-bit set, so guest_memfd is needed to handle that. Otherwise,
+kvm_convert_memory() will fail when the guest kernel tries to access it
+and QEMU attempts to call KVM_SET_MEMORY_ATTRIBUTES to set these ranges
+to private.
+
+Whether guests should actually try to access ROM regions in this way (or
+need to deal with legacy ROM regions at all), is a separate issue to be
+addressed on kernel side, but current SNP guest kernels will exhibit
+this behavior and so this handling is needed to allow QEMU to continue
+running existing SNP guest kernels.
+
+Signed-off-by: Michael Roth <michael.roth@amd.com>
+[pankaj: Added sev_snp_enabled() check]
+Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com>
+Message-ID: <20240530111643.1091816-28-pankaj.gupta@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 413a67450750e0459efeffc3db3ba9759c3e381c)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ hw/i386/pc.c       | 14 ++++++++++----
+ hw/i386/pc_sysfw.c | 19 +++++++++++++------
+ 2 files changed, 23 insertions(+), 10 deletions(-)
+
+diff --git a/hw/i386/pc.c b/hw/i386/pc.c
+index 0aca0cc79e..b25d075b59 100644
+--- a/hw/i386/pc.c
++++ b/hw/i386/pc.c
+@@ -62,6 +62,7 @@
+ #include "hw/mem/memory-device.h"
+ #include "e820_memory_layout.h"
+ #include "trace.h"
++#include "sev.h"
+ #include CONFIG_DEVICES
+ 
+ #ifdef CONFIG_XEN_EMU
+@@ -1173,10 +1174,15 @@ void pc_memory_init(PCMachineState *pcms,
+     pc_system_firmware_init(pcms, rom_memory);
+ 
+     option_rom_mr = g_malloc(sizeof(*option_rom_mr));
+-    memory_region_init_ram(option_rom_mr, NULL, "pc.rom", PC_ROM_SIZE,
+-                           &error_fatal);
+-    if (pcmc->pci_enabled) {
+-        memory_region_set_readonly(option_rom_mr, true);
++    if (machine_require_guest_memfd(machine)) {
++        memory_region_init_ram_guest_memfd(option_rom_mr, NULL, "pc.rom",
++                                           PC_ROM_SIZE, &error_fatal);
++    } else {
++        memory_region_init_ram(option_rom_mr, NULL, "pc.rom", PC_ROM_SIZE,
++                               &error_fatal);
++        if (pcmc->pci_enabled) {
++            memory_region_set_readonly(option_rom_mr, true);
++        }
+     }
+     memory_region_add_subregion_overlap(rom_memory,
+                                         PC_ROM_MIN_VGA,
+diff --git a/hw/i386/pc_sysfw.c b/hw/i386/pc_sysfw.c
+index 7cdbafc8d2..ef80281d28 100644
+--- a/hw/i386/pc_sysfw.c
++++ b/hw/i386/pc_sysfw.c
+@@ -40,8 +40,8 @@
+ 
+ #define FLASH_SECTOR_SIZE 4096
+ 
+-static void pc_isa_bios_init(MemoryRegion *isa_bios, MemoryRegion *rom_memory,
+-                             MemoryRegion *flash_mem)
++static void pc_isa_bios_init(PCMachineState *pcms, MemoryRegion *isa_bios,
++                             MemoryRegion *rom_memory, MemoryRegion *flash_mem)
+ {
+     int isa_bios_size;
+     uint64_t flash_size;
+@@ -51,8 +51,13 @@ static void pc_isa_bios_init(MemoryRegion *isa_bios, MemoryRegion *rom_memory,
+ 
+     /* map the last 128KB of the BIOS in ISA space */
+     isa_bios_size = MIN(flash_size, 128 * KiB);
+-    memory_region_init_ram(isa_bios, NULL, "isa-bios", isa_bios_size,
+-                           &error_fatal);
++    if (machine_require_guest_memfd(MACHINE(pcms))) {
++        memory_region_init_ram_guest_memfd(isa_bios, NULL, "isa-bios",
++                                           isa_bios_size, &error_fatal);
++    } else {
++        memory_region_init_ram(isa_bios, NULL, "isa-bios", isa_bios_size,
++                               &error_fatal);
++    }
+     memory_region_add_subregion_overlap(rom_memory,
+                                         0x100000 - isa_bios_size,
+                                         isa_bios,
+@@ -65,7 +70,9 @@ static void pc_isa_bios_init(MemoryRegion *isa_bios, MemoryRegion *rom_memory,
+            ((uint8_t*)flash_ptr) + (flash_size - isa_bios_size),
+            isa_bios_size);
+ 
+-    memory_region_set_readonly(isa_bios, true);
++    if (!machine_require_guest_memfd(current_machine)) {
++        memory_region_set_readonly(isa_bios, true);
++    }
+ }
+ 
+ static PFlashCFI01 *pc_pflash_create(PCMachineState *pcms,
+@@ -191,7 +198,7 @@ static void pc_system_flash_map(PCMachineState *pcms,
+                 x86_isa_bios_init(&x86ms->isa_bios, rom_memory, flash_mem,
+                                   true);
+             } else {
+-                pc_isa_bios_init(&x86ms->isa_bios, rom_memory, flash_mem);
++                pc_isa_bios_init(pcms, &x86ms->isa_bios, rom_memory, flash_mem);
+             }
+ 
+             /* Encrypt the pflash boot ROM */
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-hw-i386-sev-Use-legacy-SEV-VM-types-for-older-machin.patch b/SOURCES/kvm-hw-i386-sev-Use-legacy-SEV-VM-types-for-older-machin.patch
new file mode 100644
index 0000000..7b03cb4
--- /dev/null
+++ b/SOURCES/kvm-hw-i386-sev-Use-legacy-SEV-VM-types-for-older-machin.patch
@@ -0,0 +1,58 @@
+From 4331180aa09e44550ff8de781c618bae5e99bb70 Mon Sep 17 00:00:00 2001
+From: Michael Roth <michael.roth@amd.com>
+Date: Tue, 9 Apr 2024 18:07:43 -0500
+Subject: [PATCH 025/100] hw/i386/sev: Use legacy SEV VM types for older
+ machine types
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [25/91] 8c73cd312736ccb0818b4d3216fd13712f21f3c9 (bonzini/rhel-qemu-kvm)
+
+Newer 9.1 machine types will default to using the KVM_SEV_INIT2 API for
+creating SEV/SEV-ES going forward. However, this API results in guest
+measurement changes which are generally not expected for users of these
+older guest types and can cause disruption if they switch to a newer
+QEMU/kernel version. Avoid this by continuing to use the older
+KVM_SEV_INIT/KVM_SEV_ES_INIT APIs for older machine types.
+
+Signed-off-by: Michael Roth <michael.roth@amd.com>
+Message-ID: <20240409230743.962513-4-michael.roth@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit ea7fbd37537b3a598335c21ccb2ea674630fc810)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ hw/i386/pc.c      | 1 +
+ target/i386/sev.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/hw/i386/pc.c b/hw/i386/pc.c
+index b9fde3cec1..1a34bc4522 100644
+--- a/hw/i386/pc.c
++++ b/hw/i386/pc.c
+@@ -351,6 +351,7 @@ const size_t pc_rhel_compat_len = G_N_ELEMENTS(pc_rhel_compat);
+ GlobalProperty pc_rhel_9_5_compat[] = {
+     /* pc_rhel_9_5_compat from pc_compat_pc_9_0 (backported from 9.1) */
+     { TYPE_X86_CPU, "guest-phys-bits", "0" },
++    { "sev-guest", "legacy-vm-type", "true" },
+ };
+ const size_t pc_rhel_9_5_compat_len = G_N_ELEMENTS(pc_rhel_9_5_compat);
+ 
+diff --git a/target/i386/sev.c b/target/i386/sev.c
+index f4ee317cb0..d30b68c11e 100644
+--- a/target/i386/sev.c
++++ b/target/i386/sev.c
+@@ -1417,6 +1417,7 @@ sev_guest_instance_init(Object *obj)
+     object_property_add_uint32_ptr(obj, "reduced-phys-bits",
+                                    &sev->reduced_phys_bits,
+                                    OBJ_PROP_FLAG_READWRITE);
++    object_apply_compat_props(obj);
+ }
+ 
+ /* sev guest info */
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-hw-i386-split-x86.c-in-multiple-parts.patch b/SOURCES/kvm-hw-i386-split-x86.c-in-multiple-parts.patch
new file mode 100644
index 0000000..40ca52b
--- /dev/null
+++ b/SOURCES/kvm-hw-i386-split-x86.c-in-multiple-parts.patch
@@ -0,0 +1,2301 @@
+From bf2206fae2e640da9de7fc0648b4b90ad3ddfbe3 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Thu, 9 May 2024 19:00:41 +0200
+Subject: [PATCH 046/100] hw/i386: split x86.c in multiple parts
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [46/91] 3d6e8364aa9b691c25bdcf54a30b116da5d33874 (bonzini/rhel-qemu-kvm)
+
+Keep the basic X86MachineState definition in x86.c.  Move out functions that
+are only needed by other files: x86-common.c for the pc and microvm machines,
+x86-cpu.c for those used by accelerator code.
+
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
+Message-ID: <20240509170044.190795-11-pbonzini@redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit b061f0598b9231f7992aff4fcdf3f336f9747d11)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ hw/i386/meson.build   |    4 +-
+ hw/i386/x86-common.c  | 1007 +++++++++++++++++++++++++++++++++++++++
+ hw/i386/x86-cpu.c     |   97 ++++
+ hw/i386/x86.c         | 1052 +----------------------------------------
+ include/hw/i386/x86.h |    6 +-
+ 5 files changed, 1113 insertions(+), 1053 deletions(-)
+ create mode 100644 hw/i386/x86-common.c
+ create mode 100644 hw/i386/x86-cpu.c
+
+diff --git a/hw/i386/meson.build b/hw/i386/meson.build
+index d9da676038..3437da0aad 100644
+--- a/hw/i386/meson.build
++++ b/hw/i386/meson.build
+@@ -4,6 +4,7 @@ i386_ss.add(files(
+   'e820_memory_layout.c',
+   'multiboot.c',
+   'x86.c',
++  'x86-cpu.c',
+ ))
+ 
+ i386_ss.add(when: 'CONFIG_APIC', if_true: files('vapic.c'))
+@@ -12,7 +13,7 @@ i386_ss.add(when: 'CONFIG_X86_IOMMU', if_true: files('x86-iommu.c'),
+ i386_ss.add(when: 'CONFIG_AMD_IOMMU', if_true: files('amd_iommu.c'),
+                                       if_false: files('amd_iommu-stub.c'))
+ i386_ss.add(when: 'CONFIG_I440FX', if_true: files('pc_piix.c'))
+-i386_ss.add(when: 'CONFIG_MICROVM', if_true: files('microvm.c', 'acpi-microvm.c', 'microvm-dt.c'))
++i386_ss.add(when: 'CONFIG_MICROVM', if_true: files('x86-common.c', 'microvm.c', 'acpi-microvm.c', 'microvm-dt.c'))
+ i386_ss.add(when: 'CONFIG_Q35', if_true: files('pc_q35.c'))
+ i386_ss.add(when: 'CONFIG_VMMOUSE', if_true: files('vmmouse.c'))
+ i386_ss.add(when: 'CONFIG_VMPORT', if_true: files('vmport.c'))
+@@ -22,6 +23,7 @@ i386_ss.add(when: 'CONFIG_SGX', if_true: files('sgx-epc.c','sgx.c'),
+ 
+ i386_ss.add(when: 'CONFIG_ACPI', if_true: files('acpi-common.c'))
+ i386_ss.add(when: 'CONFIG_PC', if_true: files(
++  'x86-common.c',
+   'pc.c',
+   'pc_sysfw.c',
+   'acpi-build.c',
+diff --git a/hw/i386/x86-common.c b/hw/i386/x86-common.c
+new file mode 100644
+index 0000000000..67b03c913a
+--- /dev/null
++++ b/hw/i386/x86-common.c
+@@ -0,0 +1,1007 @@
++/*
++ * Copyright (c) 2003-2004 Fabrice Bellard
++ * Copyright (c) 2019, 2024 Red Hat, Inc.
++ *
++ * Permission is hereby granted, free of charge, to any person obtaining a copy
++ * of this software and associated documentation files (the "Software"), to deal
++ * in the Software without restriction, including without limitation the rights
++ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
++ * copies of the Software, and to permit persons to whom the Software is
++ * furnished to do so, subject to the following conditions:
++ *
++ * The above copyright notice and this permission notice shall be included in
++ * all copies or substantial portions of the Software.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
++ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
++ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
++ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
++ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
++ * THE SOFTWARE.
++ */
++#include "qemu/osdep.h"
++#include "qemu/error-report.h"
++#include "qemu/cutils.h"
++#include "qemu/units.h"
++#include "qemu/datadir.h"
++#include "qapi/error.h"
++#include "sysemu/numa.h"
++#include "sysemu/sysemu.h"
++#include "sysemu/xen.h"
++#include "trace.h"
++
++#include "hw/i386/x86.h"
++#include "target/i386/cpu.h"
++#include "hw/rtc/mc146818rtc.h"
++#include "target/i386/sev.h"
++
++#include "hw/acpi/cpu_hotplug.h"
++#include "hw/irq.h"
++#include "hw/loader.h"
++#include "multiboot.h"
++#include "elf.h"
++#include "standard-headers/asm-x86/bootparam.h"
++#include CONFIG_DEVICES
++#include "kvm/kvm_i386.h"
++
++#ifdef CONFIG_XEN_EMU
++#include "hw/xen/xen.h"
++#include "hw/i386/kvm/xen_evtchn.h"
++#endif
++
++/* Physical Address of PVH entry point read from kernel ELF NOTE */
++static size_t pvh_start_addr;
++
++static void x86_cpu_new(X86MachineState *x86ms, int64_t apic_id, Error **errp)
++{
++    Object *cpu = object_new(MACHINE(x86ms)->cpu_type);
++
++    if (!object_property_set_uint(cpu, "apic-id", apic_id, errp)) {
++        goto out;
++    }
++    qdev_realize(DEVICE(cpu), NULL, errp);
++
++out:
++    object_unref(cpu);
++}
++
++void x86_cpus_init(X86MachineState *x86ms, int default_cpu_version)
++{
++    int i;
++    const CPUArchIdList *possible_cpus;
++    MachineState *ms = MACHINE(x86ms);
++    MachineClass *mc = MACHINE_GET_CLASS(x86ms);
++
++    x86_cpu_set_default_version(default_cpu_version);
++
++    /*
++     * Calculates the limit to CPU APIC ID values
++     *
++     * Limit for the APIC ID value, so that all
++     * CPU APIC IDs are < x86ms->apic_id_limit.
++     *
++     * This is used for FW_CFG_MAX_CPUS. See comments on fw_cfg_arch_create().
++     */
++    x86ms->apic_id_limit = x86_cpu_apic_id_from_index(x86ms,
++                                                      ms->smp.max_cpus - 1) + 1;
++
++    /*
++     * Can we support APIC ID 255 or higher?  With KVM, that requires
++     * both in-kernel lapic and X2APIC userspace API.
++     *
++     * kvm_enabled() must go first to ensure that kvm_* references are
++     * not emitted for the linker to consume (kvm_enabled() is
++     * a literal `0` in configurations where kvm_* aren't defined)
++     */
++    if (kvm_enabled() && x86ms->apic_id_limit > 255 &&
++        kvm_irqchip_in_kernel() && !kvm_enable_x2apic()) {
++        error_report("current -smp configuration requires kernel "
++                     "irqchip and X2APIC API support.");
++        exit(EXIT_FAILURE);
++    }
++
++    if (kvm_enabled()) {
++        kvm_set_max_apic_id(x86ms->apic_id_limit);
++    }
++
++    if (!kvm_irqchip_in_kernel()) {
++        apic_set_max_apic_id(x86ms->apic_id_limit);
++    }
++
++    possible_cpus = mc->possible_cpu_arch_ids(ms);
++    for (i = 0; i < ms->smp.cpus; i++) {
++        x86_cpu_new(x86ms, possible_cpus->cpus[i].arch_id, &error_fatal);
++    }
++}
++
++void x86_rtc_set_cpus_count(ISADevice *s, uint16_t cpus_count)
++{
++    MC146818RtcState *rtc = MC146818_RTC(s);
++
++    if (cpus_count > 0xff) {
++        /*
++         * If the number of CPUs can't be represented in 8 bits, the
++         * BIOS must use "FW_CFG_NB_CPUS". Set RTC field to 0 just
++         * to make old BIOSes fail more predictably.
++         */
++        mc146818rtc_set_cmos_data(rtc, 0x5f, 0);
++    } else {
++        mc146818rtc_set_cmos_data(rtc, 0x5f, cpus_count - 1);
++    }
++}
++
++static int x86_apic_cmp(const void *a, const void *b)
++{
++   CPUArchId *apic_a = (CPUArchId *)a;
++   CPUArchId *apic_b = (CPUArchId *)b;
++
++   return apic_a->arch_id - apic_b->arch_id;
++}
++
++/*
++ * returns pointer to CPUArchId descriptor that matches CPU's apic_id
++ * in ms->possible_cpus->cpus, if ms->possible_cpus->cpus has no
++ * entry corresponding to CPU's apic_id returns NULL.
++ */
++static CPUArchId *x86_find_cpu_slot(MachineState *ms, uint32_t id, int *idx)
++{
++    CPUArchId apic_id, *found_cpu;
++
++    apic_id.arch_id = id;
++    found_cpu = bsearch(&apic_id, ms->possible_cpus->cpus,
++        ms->possible_cpus->len, sizeof(*ms->possible_cpus->cpus),
++        x86_apic_cmp);
++    if (found_cpu && idx) {
++        *idx = found_cpu - ms->possible_cpus->cpus;
++    }
++    return found_cpu;
++}
++
++void x86_cpu_plug(HotplugHandler *hotplug_dev,
++                  DeviceState *dev, Error **errp)
++{
++    CPUArchId *found_cpu;
++    Error *local_err = NULL;
++    X86CPU *cpu = X86_CPU(dev);
++    X86MachineState *x86ms = X86_MACHINE(hotplug_dev);
++
++    if (x86ms->acpi_dev) {
++        hotplug_handler_plug(x86ms->acpi_dev, dev, &local_err);
++        if (local_err) {
++            goto out;
++        }
++    }
++
++    /* increment the number of CPUs */
++    x86ms->boot_cpus++;
++    if (x86ms->rtc) {
++        x86_rtc_set_cpus_count(x86ms->rtc, x86ms->boot_cpus);
++    }
++    if (x86ms->fw_cfg) {
++        fw_cfg_modify_i16(x86ms->fw_cfg, FW_CFG_NB_CPUS, x86ms->boot_cpus);
++    }
++
++    found_cpu = x86_find_cpu_slot(MACHINE(x86ms), cpu->apic_id, NULL);
++    found_cpu->cpu = CPU(dev);
++out:
++    error_propagate(errp, local_err);
++}
++
++void x86_cpu_unplug_request_cb(HotplugHandler *hotplug_dev,
++                               DeviceState *dev, Error **errp)
++{
++    int idx = -1;
++    X86CPU *cpu = X86_CPU(dev);
++    X86MachineState *x86ms = X86_MACHINE(hotplug_dev);
++
++    if (!x86ms->acpi_dev) {
++        error_setg(errp, "CPU hot unplug not supported without ACPI");
++        return;
++    }
++
++    x86_find_cpu_slot(MACHINE(x86ms), cpu->apic_id, &idx);
++    assert(idx != -1);
++    if (idx == 0) {
++        error_setg(errp, "Boot CPU is unpluggable");
++        return;
++    }
++
++    hotplug_handler_unplug_request(x86ms->acpi_dev, dev,
++                                   errp);
++}
++
++void x86_cpu_unplug_cb(HotplugHandler *hotplug_dev,
++                       DeviceState *dev, Error **errp)
++{
++    CPUArchId *found_cpu;
++    Error *local_err = NULL;
++    X86CPU *cpu = X86_CPU(dev);
++    X86MachineState *x86ms = X86_MACHINE(hotplug_dev);
++
++    hotplug_handler_unplug(x86ms->acpi_dev, dev, &local_err);
++    if (local_err) {
++        goto out;
++    }
++
++    found_cpu = x86_find_cpu_slot(MACHINE(x86ms), cpu->apic_id, NULL);
++    found_cpu->cpu = NULL;
++    qdev_unrealize(dev);
++
++    /* decrement the number of CPUs */
++    x86ms->boot_cpus--;
++    /* Update the number of CPUs in CMOS */
++    x86_rtc_set_cpus_count(x86ms->rtc, x86ms->boot_cpus);
++    fw_cfg_modify_i16(x86ms->fw_cfg, FW_CFG_NB_CPUS, x86ms->boot_cpus);
++ out:
++    error_propagate(errp, local_err);
++}
++
++void x86_cpu_pre_plug(HotplugHandler *hotplug_dev,
++                      DeviceState *dev, Error **errp)
++{
++    int idx;
++    CPUState *cs;
++    CPUArchId *cpu_slot;
++    X86CPUTopoIDs topo_ids;
++    X86CPU *cpu = X86_CPU(dev);
++    CPUX86State *env = &cpu->env;
++    MachineState *ms = MACHINE(hotplug_dev);
++    X86MachineState *x86ms = X86_MACHINE(hotplug_dev);
++    unsigned int smp_cores = ms->smp.cores;
++    unsigned int smp_threads = ms->smp.threads;
++    X86CPUTopoInfo topo_info;
++
++    if (!object_dynamic_cast(OBJECT(cpu), ms->cpu_type)) {
++        error_setg(errp, "Invalid CPU type, expected cpu type: '%s'",
++                   ms->cpu_type);
++        return;
++    }
++
++    if (x86ms->acpi_dev) {
++        Error *local_err = NULL;
++
++        hotplug_handler_pre_plug(HOTPLUG_HANDLER(x86ms->acpi_dev), dev,
++                                 &local_err);
++        if (local_err) {
++            error_propagate(errp, local_err);
++            return;
++        }
++    }
++
++    init_topo_info(&topo_info, x86ms);
++
++    env->nr_dies = ms->smp.dies;
++
++    /*
++     * If APIC ID is not set,
++     * set it based on socket/die/core/thread properties.
++     */
++    if (cpu->apic_id == UNASSIGNED_APIC_ID) {
++        int max_socket = (ms->smp.max_cpus - 1) /
++                                smp_threads / smp_cores / ms->smp.dies;
++
++        /*
++         * die-id was optional in QEMU 4.0 and older, so keep it optional
++         * if there's only one die per socket.
++         */
++        if (cpu->die_id < 0 && ms->smp.dies == 1) {
++            cpu->die_id = 0;
++        }
++
++        if (cpu->socket_id < 0) {
++            error_setg(errp, "CPU socket-id is not set");
++            return;
++        } else if (cpu->socket_id > max_socket) {
++            error_setg(errp, "Invalid CPU socket-id: %u must be in range 0:%u",
++                       cpu->socket_id, max_socket);
++            return;
++        }
++        if (cpu->die_id < 0) {
++            error_setg(errp, "CPU die-id is not set");
++            return;
++        } else if (cpu->die_id > ms->smp.dies - 1) {
++            error_setg(errp, "Invalid CPU die-id: %u must be in range 0:%u",
++                       cpu->die_id, ms->smp.dies - 1);
++            return;
++        }
++        if (cpu->core_id < 0) {
++            error_setg(errp, "CPU core-id is not set");
++            return;
++        } else if (cpu->core_id > (smp_cores - 1)) {
++            error_setg(errp, "Invalid CPU core-id: %u must be in range 0:%u",
++                       cpu->core_id, smp_cores - 1);
++            return;
++        }
++        if (cpu->thread_id < 0) {
++            error_setg(errp, "CPU thread-id is not set");
++            return;
++        } else if (cpu->thread_id > (smp_threads - 1)) {
++            error_setg(errp, "Invalid CPU thread-id: %u must be in range 0:%u",
++                       cpu->thread_id, smp_threads - 1);
++            return;
++        }
++
++        topo_ids.pkg_id = cpu->socket_id;
++        topo_ids.die_id = cpu->die_id;
++        topo_ids.core_id = cpu->core_id;
++        topo_ids.smt_id = cpu->thread_id;
++        cpu->apic_id = x86_apicid_from_topo_ids(&topo_info, &topo_ids);
++    }
++
++    cpu_slot = x86_find_cpu_slot(MACHINE(x86ms), cpu->apic_id, &idx);
++    if (!cpu_slot) {
++        x86_topo_ids_from_apicid(cpu->apic_id, &topo_info, &topo_ids);
++        error_setg(errp,
++            "Invalid CPU [socket: %u, die: %u, core: %u, thread: %u] with"
++            " APIC ID %" PRIu32 ", valid index range 0:%d",
++            topo_ids.pkg_id, topo_ids.die_id, topo_ids.core_id, topo_ids.smt_id,
++            cpu->apic_id, ms->possible_cpus->len - 1);
++        return;
++    }
++
++    if (cpu_slot->cpu) {
++        error_setg(errp, "CPU[%d] with APIC ID %" PRIu32 " exists",
++                   idx, cpu->apic_id);
++        return;
++    }
++
++    /* if 'address' properties socket-id/core-id/thread-id are not set, set them
++     * so that machine_query_hotpluggable_cpus would show correct values
++     */
++    /* TODO: move socket_id/core_id/thread_id checks into x86_cpu_realizefn()
++     * once -smp refactoring is complete and there will be CPU private
++     * CPUState::nr_cores and CPUState::nr_threads fields instead of globals */
++    x86_topo_ids_from_apicid(cpu->apic_id, &topo_info, &topo_ids);
++    if (cpu->socket_id != -1 && cpu->socket_id != topo_ids.pkg_id) {
++        error_setg(errp, "property socket-id: %u doesn't match set apic-id:"
++            " 0x%x (socket-id: %u)", cpu->socket_id, cpu->apic_id,
++            topo_ids.pkg_id);
++        return;
++    }
++    cpu->socket_id = topo_ids.pkg_id;
++
++    if (cpu->die_id != -1 && cpu->die_id != topo_ids.die_id) {
++        error_setg(errp, "property die-id: %u doesn't match set apic-id:"
++            " 0x%x (die-id: %u)", cpu->die_id, cpu->apic_id, topo_ids.die_id);
++        return;
++    }
++    cpu->die_id = topo_ids.die_id;
++
++    if (cpu->core_id != -1 && cpu->core_id != topo_ids.core_id) {
++        error_setg(errp, "property core-id: %u doesn't match set apic-id:"
++            " 0x%x (core-id: %u)", cpu->core_id, cpu->apic_id,
++            topo_ids.core_id);
++        return;
++    }
++    cpu->core_id = topo_ids.core_id;
++
++    if (cpu->thread_id != -1 && cpu->thread_id != topo_ids.smt_id) {
++        error_setg(errp, "property thread-id: %u doesn't match set apic-id:"
++            " 0x%x (thread-id: %u)", cpu->thread_id, cpu->apic_id,
++            topo_ids.smt_id);
++        return;
++    }
++    cpu->thread_id = topo_ids.smt_id;
++
++    /*
++    * kvm_enabled() must go first to ensure that kvm_* references are
++    * not emitted for the linker to consume (kvm_enabled() is
++    * a literal `0` in configurations where kvm_* aren't defined)
++    */
++    if (kvm_enabled() && hyperv_feat_enabled(cpu, HYPERV_FEAT_VPINDEX) &&
++        !kvm_hv_vpindex_settable()) {
++        error_setg(errp, "kernel doesn't allow setting HyperV VP_INDEX");
++        return;
++    }
++
++    cs = CPU(cpu);
++    cs->cpu_index = idx;
++
++    numa_cpu_pre_plug(cpu_slot, dev, errp);
++}
++
++static long get_file_size(FILE *f)
++{
++    long where, size;
++
++    /* XXX: on Unix systems, using fstat() probably makes more sense */
++
++    where = ftell(f);
++    fseek(f, 0, SEEK_END);
++    size = ftell(f);
++    fseek(f, where, SEEK_SET);
++
++    return size;
++}
++
++void gsi_handler(void *opaque, int n, int level)
++{
++    GSIState *s = opaque;
++
++    trace_x86_gsi_interrupt(n, level);
++    switch (n) {
++    case 0 ... ISA_NUM_IRQS - 1:
++        if (s->i8259_irq[n]) {
++            /* Under KVM, Kernel will forward to both PIC and IOAPIC */
++            qemu_set_irq(s->i8259_irq[n], level);
++        }
++        /* fall through */
++    case ISA_NUM_IRQS ... IOAPIC_NUM_PINS - 1:
++#ifdef CONFIG_XEN_EMU
++        /*
++         * Xen delivers the GSI to the Legacy PIC (not that Legacy PIC
++         * routing actually works properly under Xen). And then to
++         * *either* the PIRQ handling or the I/OAPIC depending on
++         * whether the former wants it.
++         */
++        if (xen_mode == XEN_EMULATE && xen_evtchn_set_gsi(n, level)) {
++            break;
++        }
++#endif
++        qemu_set_irq(s->ioapic_irq[n], level);
++        break;
++    case IO_APIC_SECONDARY_IRQBASE
++        ... IO_APIC_SECONDARY_IRQBASE + IOAPIC_NUM_PINS - 1:
++        qemu_set_irq(s->ioapic2_irq[n - IO_APIC_SECONDARY_IRQBASE], level);
++        break;
++    }
++}
++
++void ioapic_init_gsi(GSIState *gsi_state, Object *parent)
++{
++    DeviceState *dev;
++    SysBusDevice *d;
++    unsigned int i;
++
++    assert(parent);
++    if (kvm_ioapic_in_kernel()) {
++        dev = qdev_new(TYPE_KVM_IOAPIC);
++    } else {
++        dev = qdev_new(TYPE_IOAPIC);
++    }
++    object_property_add_child(parent, "ioapic", OBJECT(dev));
++    d = SYS_BUS_DEVICE(dev);
++    sysbus_realize_and_unref(d, &error_fatal);
++    sysbus_mmio_map(d, 0, IO_APIC_DEFAULT_ADDRESS);
++
++    for (i = 0; i < IOAPIC_NUM_PINS; i++) {
++        gsi_state->ioapic_irq[i] = qdev_get_gpio_in(dev, i);
++    }
++}
++
++DeviceState *ioapic_init_secondary(GSIState *gsi_state)
++{
++    DeviceState *dev;
++    SysBusDevice *d;
++    unsigned int i;
++
++    dev = qdev_new(TYPE_IOAPIC);
++    d = SYS_BUS_DEVICE(dev);
++    sysbus_realize_and_unref(d, &error_fatal);
++    sysbus_mmio_map(d, 0, IO_APIC_SECONDARY_ADDRESS);
++
++    for (i = 0; i < IOAPIC_NUM_PINS; i++) {
++        gsi_state->ioapic2_irq[i] = qdev_get_gpio_in(dev, i);
++    }
++    return dev;
++}
++
++/*
++ * The entry point into the kernel for PVH boot is different from
++ * the native entry point.  The PVH entry is defined by the x86/HVM
++ * direct boot ABI and is available in an ELFNOTE in the kernel binary.
++ *
++ * This function is passed to load_elf() when it is called from
++ * load_elfboot() which then additionally checks for an ELF Note of
++ * type XEN_ELFNOTE_PHYS32_ENTRY and passes it to this function to
++ * parse the PVH entry address from the ELF Note.
++ *
++ * Due to trickery in elf_opts.h, load_elf() is actually available as
++ * load_elf32() or load_elf64() and this routine needs to be able
++ * to deal with being called as 32 or 64 bit.
++ *
++ * The address of the PVH entry point is saved to the 'pvh_start_addr'
++ * global variable.  (although the entry point is 32-bit, the kernel
++ * binary can be either 32-bit or 64-bit).
++ */
++static uint64_t read_pvh_start_addr(void *arg1, void *arg2, bool is64)
++{
++    size_t *elf_note_data_addr;
++
++    /* Check if ELF Note header passed in is valid */
++    if (arg1 == NULL) {
++        return 0;
++    }
++
++    if (is64) {
++        struct elf64_note *nhdr64 = (struct elf64_note *)arg1;
++        uint64_t nhdr_size64 = sizeof(struct elf64_note);
++        uint64_t phdr_align = *(uint64_t *)arg2;
++        uint64_t nhdr_namesz = nhdr64->n_namesz;
++
++        elf_note_data_addr =
++            ((void *)nhdr64) + nhdr_size64 +
++            QEMU_ALIGN_UP(nhdr_namesz, phdr_align);
++
++        pvh_start_addr = *elf_note_data_addr;
++    } else {
++        struct elf32_note *nhdr32 = (struct elf32_note *)arg1;
++        uint32_t nhdr_size32 = sizeof(struct elf32_note);
++        uint32_t phdr_align = *(uint32_t *)arg2;
++        uint32_t nhdr_namesz = nhdr32->n_namesz;
++
++        elf_note_data_addr =
++            ((void *)nhdr32) + nhdr_size32 +
++            QEMU_ALIGN_UP(nhdr_namesz, phdr_align);
++
++        pvh_start_addr = *(uint32_t *)elf_note_data_addr;
++    }
++
++    return pvh_start_addr;
++}
++
++static bool load_elfboot(const char *kernel_filename,
++                         int kernel_file_size,
++                         uint8_t *header,
++                         size_t pvh_xen_start_addr,
++                         FWCfgState *fw_cfg)
++{
++    uint32_t flags = 0;
++    uint32_t mh_load_addr = 0;
++    uint32_t elf_kernel_size = 0;
++    uint64_t elf_entry;
++    uint64_t elf_low, elf_high;
++    int kernel_size;
++
++    if (ldl_p(header) != 0x464c457f) {
++        return false; /* no elfboot */
++    }
++
++    bool elf_is64 = header[EI_CLASS] == ELFCLASS64;
++    flags = elf_is64 ?
++        ((Elf64_Ehdr *)header)->e_flags : ((Elf32_Ehdr *)header)->e_flags;
++
++    if (flags & 0x00010004) { /* LOAD_ELF_HEADER_HAS_ADDR */
++        error_report("elfboot unsupported flags = %x", flags);
++        exit(1);
++    }
++
++    uint64_t elf_note_type = XEN_ELFNOTE_PHYS32_ENTRY;
++    kernel_size = load_elf(kernel_filename, read_pvh_start_addr,
++                           NULL, &elf_note_type, &elf_entry,
++                           &elf_low, &elf_high, NULL, 0, I386_ELF_MACHINE,
++                           0, 0);
++
++    if (kernel_size < 0) {
++        error_report("Error while loading elf kernel");
++        exit(1);
++    }
++    mh_load_addr = elf_low;
++    elf_kernel_size = elf_high - elf_low;
++
++    if (pvh_start_addr == 0) {
++        error_report("Error loading uncompressed kernel without PVH ELF Note");
++        exit(1);
++    }
++    fw_cfg_add_i32(fw_cfg, FW_CFG_KERNEL_ENTRY, pvh_start_addr);
++    fw_cfg_add_i32(fw_cfg, FW_CFG_KERNEL_ADDR, mh_load_addr);
++    fw_cfg_add_i32(fw_cfg, FW_CFG_KERNEL_SIZE, elf_kernel_size);
++
++    return true;
++}
++
++void x86_load_linux(X86MachineState *x86ms,
++                    FWCfgState *fw_cfg,
++                    int acpi_data_size,
++                    bool pvh_enabled)
++{
++    bool linuxboot_dma_enabled = X86_MACHINE_GET_CLASS(x86ms)->fwcfg_dma_enabled;
++    uint16_t protocol;
++    int setup_size, kernel_size, cmdline_size;
++    int dtb_size, setup_data_offset;
++    uint32_t initrd_max;
++    uint8_t header[8192], *setup, *kernel;
++    hwaddr real_addr, prot_addr, cmdline_addr, initrd_addr = 0;
++    FILE *f;
++    char *vmode;
++    MachineState *machine = MACHINE(x86ms);
++    struct setup_data *setup_data;
++    const char *kernel_filename = machine->kernel_filename;
++    const char *initrd_filename = machine->initrd_filename;
++    const char *dtb_filename = machine->dtb;
++    const char *kernel_cmdline = machine->kernel_cmdline;
++    SevKernelLoaderContext sev_load_ctx = {};
++
++    /* Align to 16 bytes as a paranoia measure */
++    cmdline_size = (strlen(kernel_cmdline) + 16) & ~15;
++
++    /* load the kernel header */
++    f = fopen(kernel_filename, "rb");
++    if (!f) {
++        fprintf(stderr, "qemu: could not open kernel file '%s': %s\n",
++                kernel_filename, strerror(errno));
++        exit(1);
++    }
++
++    kernel_size = get_file_size(f);
++    if (!kernel_size ||
++        fread(header, 1, MIN(ARRAY_SIZE(header), kernel_size), f) !=
++        MIN(ARRAY_SIZE(header), kernel_size)) {
++        fprintf(stderr, "qemu: could not load kernel '%s': %s\n",
++                kernel_filename, strerror(errno));
++        exit(1);
++    }
++
++    /* kernel protocol version */
++    if (ldl_p(header + 0x202) == 0x53726448) {
++        protocol = lduw_p(header + 0x206);
++    } else {
++        /*
++         * This could be a multiboot kernel. If it is, let's stop treating it
++         * like a Linux kernel.
++         * Note: some multiboot images could be in the ELF format (the same of
++         * PVH), so we try multiboot first since we check the multiboot magic
++         * header before to load it.
++         */
++        if (load_multiboot(x86ms, fw_cfg, f, kernel_filename, initrd_filename,
++                           kernel_cmdline, kernel_size, header)) {
++            return;
++        }
++        /*
++         * Check if the file is an uncompressed kernel file (ELF) and load it,
++         * saving the PVH entry point used by the x86/HVM direct boot ABI.
++         * If load_elfboot() is successful, populate the fw_cfg info.
++         */
++        if (pvh_enabled &&
++            load_elfboot(kernel_filename, kernel_size,
++                         header, pvh_start_addr, fw_cfg)) {
++            fclose(f);
++
++            fw_cfg_add_i32(fw_cfg, FW_CFG_CMDLINE_SIZE,
++                strlen(kernel_cmdline) + 1);
++            fw_cfg_add_string(fw_cfg, FW_CFG_CMDLINE_DATA, kernel_cmdline);
++
++            fw_cfg_add_i32(fw_cfg, FW_CFG_SETUP_SIZE, sizeof(header));
++            fw_cfg_add_bytes(fw_cfg, FW_CFG_SETUP_DATA,
++                             header, sizeof(header));
++
++            /* load initrd */
++            if (initrd_filename) {
++                GMappedFile *mapped_file;
++                gsize initrd_size;
++                gchar *initrd_data;
++                GError *gerr = NULL;
++
++                mapped_file = g_mapped_file_new(initrd_filename, false, &gerr);
++                if (!mapped_file) {
++                    fprintf(stderr, "qemu: error reading initrd %s: %s\n",
++                            initrd_filename, gerr->message);
++                    exit(1);
++                }
++                x86ms->initrd_mapped_file = mapped_file;
++
++                initrd_data = g_mapped_file_get_contents(mapped_file);
++                initrd_size = g_mapped_file_get_length(mapped_file);
++                initrd_max = x86ms->below_4g_mem_size - acpi_data_size - 1;
++                if (initrd_size >= initrd_max) {
++                    fprintf(stderr, "qemu: initrd is too large, cannot support."
++                            "(max: %"PRIu32", need %"PRId64")\n",
++                            initrd_max, (uint64_t)initrd_size);
++                    exit(1);
++                }
++
++                initrd_addr = (initrd_max - initrd_size) & ~4095;
++
++                fw_cfg_add_i32(fw_cfg, FW_CFG_INITRD_ADDR, initrd_addr);
++                fw_cfg_add_i32(fw_cfg, FW_CFG_INITRD_SIZE, initrd_size);
++                fw_cfg_add_bytes(fw_cfg, FW_CFG_INITRD_DATA, initrd_data,
++                                 initrd_size);
++            }
++
++            option_rom[nb_option_roms].bootindex = 0;
++            option_rom[nb_option_roms].name = "pvh.bin";
++            nb_option_roms++;
++
++            return;
++        }
++        protocol = 0;
++    }
++
++    if (protocol < 0x200 || !(header[0x211] & 0x01)) {
++        /* Low kernel */
++        real_addr    = 0x90000;
++        cmdline_addr = 0x9a000 - cmdline_size;
++        prot_addr    = 0x10000;
++    } else if (protocol < 0x202) {
++        /* High but ancient kernel */
++        real_addr    = 0x90000;
++        cmdline_addr = 0x9a000 - cmdline_size;
++        prot_addr    = 0x100000;
++    } else {
++        /* High and recent kernel */
++        real_addr    = 0x10000;
++        cmdline_addr = 0x20000;
++        prot_addr    = 0x100000;
++    }
++
++    /* highest address for loading the initrd */
++    if (protocol >= 0x20c &&
++        lduw_p(header + 0x236) & XLF_CAN_BE_LOADED_ABOVE_4G) {
++        /*
++         * Linux has supported initrd up to 4 GB for a very long time (2007,
++         * long before XLF_CAN_BE_LOADED_ABOVE_4G which was added in 2013),
++         * though it only sets initrd_max to 2 GB to "work around bootloader
++         * bugs". Luckily, QEMU firmware(which does something like bootloader)
++         * has supported this.
++         *
++         * It's believed that if XLF_CAN_BE_LOADED_ABOVE_4G is set, initrd can
++         * be loaded into any address.
++         *
++         * In addition, initrd_max is uint32_t simply because QEMU doesn't
++         * support the 64-bit boot protocol (specifically the ext_ramdisk_image
++         * field).
++         *
++         * Therefore here just limit initrd_max to UINT32_MAX simply as well.
++         */
++        initrd_max = UINT32_MAX;
++    } else if (protocol >= 0x203) {
++        initrd_max = ldl_p(header + 0x22c);
++    } else {
++        initrd_max = 0x37ffffff;
++    }
++
++    if (initrd_max >= x86ms->below_4g_mem_size - acpi_data_size) {
++        initrd_max = x86ms->below_4g_mem_size - acpi_data_size - 1;
++    }
++
++    fw_cfg_add_i32(fw_cfg, FW_CFG_CMDLINE_ADDR, cmdline_addr);
++    fw_cfg_add_i32(fw_cfg, FW_CFG_CMDLINE_SIZE, strlen(kernel_cmdline) + 1);
++    fw_cfg_add_string(fw_cfg, FW_CFG_CMDLINE_DATA, kernel_cmdline);
++    sev_load_ctx.cmdline_data = (char *)kernel_cmdline;
++    sev_load_ctx.cmdline_size = strlen(kernel_cmdline) + 1;
++
++    if (protocol >= 0x202) {
++        stl_p(header + 0x228, cmdline_addr);
++    } else {
++        stw_p(header + 0x20, 0xA33F);
++        stw_p(header + 0x22, cmdline_addr - real_addr);
++    }
++
++    /* handle vga= parameter */
++    vmode = strstr(kernel_cmdline, "vga=");
++    if (vmode) {
++        unsigned int video_mode;
++        const char *end;
++        int ret;
++        /* skip "vga=" */
++        vmode += 4;
++        if (!strncmp(vmode, "normal", 6)) {
++            video_mode = 0xffff;
++        } else if (!strncmp(vmode, "ext", 3)) {
++            video_mode = 0xfffe;
++        } else if (!strncmp(vmode, "ask", 3)) {
++            video_mode = 0xfffd;
++        } else {
++            ret = qemu_strtoui(vmode, &end, 0, &video_mode);
++            if (ret != 0 || (*end && *end != ' ')) {
++                fprintf(stderr, "qemu: invalid 'vga=' kernel parameter.\n");
++                exit(1);
++            }
++        }
++        stw_p(header + 0x1fa, video_mode);
++    }
++
++    /* loader type */
++    /*
++     * High nybble = B reserved for QEMU; low nybble is revision number.
++     * If this code is substantially changed, you may want to consider
++     * incrementing the revision.
++     */
++    if (protocol >= 0x200) {
++        header[0x210] = 0xB0;
++    }
++    /* heap */
++    if (protocol >= 0x201) {
++        header[0x211] |= 0x80; /* CAN_USE_HEAP */
++        stw_p(header + 0x224, cmdline_addr - real_addr - 0x200);
++    }
++
++    /* load initrd */
++    if (initrd_filename) {
++        GMappedFile *mapped_file;
++        gsize initrd_size;
++        gchar *initrd_data;
++        GError *gerr = NULL;
++
++        if (protocol < 0x200) {
++            fprintf(stderr, "qemu: linux kernel too old to load a ram disk\n");
++            exit(1);
++        }
++
++        mapped_file = g_mapped_file_new(initrd_filename, false, &gerr);
++        if (!mapped_file) {
++            fprintf(stderr, "qemu: error reading initrd %s: %s\n",
++                    initrd_filename, gerr->message);
++            exit(1);
++        }
++        x86ms->initrd_mapped_file = mapped_file;
++
++        initrd_data = g_mapped_file_get_contents(mapped_file);
++        initrd_size = g_mapped_file_get_length(mapped_file);
++        if (initrd_size >= initrd_max) {
++            fprintf(stderr, "qemu: initrd is too large, cannot support."
++                    "(max: %"PRIu32", need %"PRId64")\n",
++                    initrd_max, (uint64_t)initrd_size);
++            exit(1);
++        }
++
++        initrd_addr = (initrd_max - initrd_size) & ~4095;
++
++        fw_cfg_add_i32(fw_cfg, FW_CFG_INITRD_ADDR, initrd_addr);
++        fw_cfg_add_i32(fw_cfg, FW_CFG_INITRD_SIZE, initrd_size);
++        fw_cfg_add_bytes(fw_cfg, FW_CFG_INITRD_DATA, initrd_data, initrd_size);
++        sev_load_ctx.initrd_data = initrd_data;
++        sev_load_ctx.initrd_size = initrd_size;
++
++        stl_p(header + 0x218, initrd_addr);
++        stl_p(header + 0x21c, initrd_size);
++    }
++
++    /* load kernel and setup */
++    setup_size = header[0x1f1];
++    if (setup_size == 0) {
++        setup_size = 4;
++    }
++    setup_size = (setup_size + 1) * 512;
++    if (setup_size > kernel_size) {
++        fprintf(stderr, "qemu: invalid kernel header\n");
++        exit(1);
++    }
++    kernel_size -= setup_size;
++
++    setup  = g_malloc(setup_size);
++    kernel = g_malloc(kernel_size);
++    fseek(f, 0, SEEK_SET);
++    if (fread(setup, 1, setup_size, f) != setup_size) {
++        fprintf(stderr, "fread() failed\n");
++        exit(1);
++    }
++    if (fread(kernel, 1, kernel_size, f) != kernel_size) {
++        fprintf(stderr, "fread() failed\n");
++        exit(1);
++    }
++    fclose(f);
++
++    /* append dtb to kernel */
++    if (dtb_filename) {
++        if (protocol < 0x209) {
++            fprintf(stderr, "qemu: Linux kernel too old to load a dtb\n");
++            exit(1);
++        }
++
++        dtb_size = get_image_size(dtb_filename);
++        if (dtb_size <= 0) {
++            fprintf(stderr, "qemu: error reading dtb %s: %s\n",
++                    dtb_filename, strerror(errno));
++            exit(1);
++        }
++
++        setup_data_offset = QEMU_ALIGN_UP(kernel_size, 16);
++        kernel_size = setup_data_offset + sizeof(struct setup_data) + dtb_size;
++        kernel = g_realloc(kernel, kernel_size);
++
++        stq_p(header + 0x250, prot_addr + setup_data_offset);
++
++        setup_data = (struct setup_data *)(kernel + setup_data_offset);
++        setup_data->next = 0;
++        setup_data->type = cpu_to_le32(SETUP_DTB);
++        setup_data->len = cpu_to_le32(dtb_size);
++
++        load_image_size(dtb_filename, setup_data->data, dtb_size);
++    }
++
++    /*
++     * If we're starting an encrypted VM, it will be OVMF based, which uses the
++     * efi stub for booting and doesn't require any values to be placed in the
++     * kernel header.  We therefore don't update the header so the hash of the
++     * kernel on the other side of the fw_cfg interface matches the hash of the
++     * file the user passed in.
++     */
++    if (!sev_enabled()) {
++        memcpy(setup, header, MIN(sizeof(header), setup_size));
++    }
++
++    fw_cfg_add_i32(fw_cfg, FW_CFG_KERNEL_ADDR, prot_addr);
++    fw_cfg_add_i32(fw_cfg, FW_CFG_KERNEL_SIZE, kernel_size);
++    fw_cfg_add_bytes(fw_cfg, FW_CFG_KERNEL_DATA, kernel, kernel_size);
++    sev_load_ctx.kernel_data = (char *)kernel;
++    sev_load_ctx.kernel_size = kernel_size;
++
++    fw_cfg_add_i32(fw_cfg, FW_CFG_SETUP_ADDR, real_addr);
++    fw_cfg_add_i32(fw_cfg, FW_CFG_SETUP_SIZE, setup_size);
++    fw_cfg_add_bytes(fw_cfg, FW_CFG_SETUP_DATA, setup, setup_size);
++    sev_load_ctx.setup_data = (char *)setup;
++    sev_load_ctx.setup_size = setup_size;
++
++    if (sev_enabled()) {
++        sev_add_kernel_loader_hashes(&sev_load_ctx, &error_fatal);
++    }
++
++    option_rom[nb_option_roms].bootindex = 0;
++    option_rom[nb_option_roms].name = "linuxboot.bin";
++    if (linuxboot_dma_enabled && fw_cfg_dma_enabled(fw_cfg)) {
++        option_rom[nb_option_roms].name = "linuxboot_dma.bin";
++    }
++    nb_option_roms++;
++}
++
++void x86_isa_bios_init(MemoryRegion *isa_bios, MemoryRegion *isa_memory,
++                       MemoryRegion *bios, bool read_only)
++{
++    uint64_t bios_size = memory_region_size(bios);
++    uint64_t isa_bios_size = MIN(bios_size, 128 * KiB);
++
++    memory_region_init_alias(isa_bios, NULL, "isa-bios", bios,
++                             bios_size - isa_bios_size, isa_bios_size);
++    memory_region_add_subregion_overlap(isa_memory, 1 * MiB - isa_bios_size,
++                                        isa_bios, 1);
++    memory_region_set_readonly(isa_bios, read_only);
++}
++
++void x86_bios_rom_init(X86MachineState *x86ms, const char *default_firmware,
++                       MemoryRegion *rom_memory, bool isapc_ram_fw)
++{
++    const char *bios_name;
++    char *filename;
++    int bios_size;
++    ssize_t ret;
++
++    /* BIOS load */
++    bios_name = MACHINE(x86ms)->firmware ?: default_firmware;
++    filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, bios_name);
++    if (filename) {
++        bios_size = get_image_size(filename);
++    } else {
++        bios_size = -1;
++    }
++    if (bios_size <= 0 ||
++        (bios_size % 65536) != 0) {
++        goto bios_error;
++    }
++    memory_region_init_ram(&x86ms->bios, NULL, "pc.bios", bios_size,
++                           &error_fatal);
++    if (sev_enabled()) {
++        /*
++         * The concept of a "reset" simply doesn't exist for
++         * confidential computing guests, we have to destroy and
++         * re-launch them instead.  So there is no need to register
++         * the firmware as rom to properly re-initialize on reset.
++         * Just go for a straight file load instead.
++         */
++        void *ptr = memory_region_get_ram_ptr(&x86ms->bios);
++        load_image_size(filename, ptr, bios_size);
++        x86_firmware_configure(ptr, bios_size);
++    } else {
++        memory_region_set_readonly(&x86ms->bios, !isapc_ram_fw);
++        ret = rom_add_file_fixed(bios_name, (uint32_t)(-bios_size), -1);
++        if (ret != 0) {
++            goto bios_error;
++        }
++    }
++    g_free(filename);
++
++    /* map the last 128KB of the BIOS in ISA space */
++    x86_isa_bios_init(&x86ms->isa_bios, rom_memory, &x86ms->bios,
++                      !isapc_ram_fw);
++
++    /* map all the bios at the top of memory */
++    memory_region_add_subregion(rom_memory,
++                                (uint32_t)(-bios_size),
++                                &x86ms->bios);
++    return;
++
++bios_error:
++    fprintf(stderr, "qemu: could not load PC BIOS '%s'\n", bios_name);
++    exit(1);
++}
+diff --git a/hw/i386/x86-cpu.c b/hw/i386/x86-cpu.c
+new file mode 100644
+index 0000000000..ab2920522d
+--- /dev/null
++++ b/hw/i386/x86-cpu.c
+@@ -0,0 +1,97 @@
++/*
++ * Copyright (c) 2003-2004 Fabrice Bellard
++ * Copyright (c) 2019, 2024 Red Hat, Inc.
++ *
++ * Permission is hereby granted, free of charge, to any person obtaining a copy
++ * of this software and associated documentation files (the "Software"), to deal
++ * in the Software without restriction, including without limitation the rights
++ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
++ * copies of the Software, and to permit persons to whom the Software is
++ * furnished to do so, subject to the following conditions:
++ *
++ * The above copyright notice and this permission notice shall be included in
++ * all copies or substantial portions of the Software.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
++ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
++ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
++ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
++ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
++ * THE SOFTWARE.
++ */
++#include "qemu/osdep.h"
++#include "sysemu/whpx.h"
++#include "sysemu/cpu-timers.h"
++#include "trace.h"
++
++#include "hw/i386/x86.h"
++#include "target/i386/cpu.h"
++#include "hw/intc/i8259.h"
++#include "hw/irq.h"
++#include "sysemu/kvm.h"
++
++/* TSC handling */
++uint64_t cpu_get_tsc(CPUX86State *env)
++{
++    return cpus_get_elapsed_ticks();
++}
++
++/* IRQ handling */
++static void pic_irq_request(void *opaque, int irq, int level)
++{
++    CPUState *cs = first_cpu;
++    X86CPU *cpu = X86_CPU(cs);
++
++    trace_x86_pic_interrupt(irq, level);
++    if (cpu_is_apic_enabled(cpu->apic_state) && !kvm_irqchip_in_kernel() &&
++        !whpx_apic_in_platform()) {
++        CPU_FOREACH(cs) {
++            cpu = X86_CPU(cs);
++            if (apic_accept_pic_intr(cpu->apic_state)) {
++                apic_deliver_pic_intr(cpu->apic_state, level);
++            }
++        }
++    } else {
++        if (level) {
++            cpu_interrupt(cs, CPU_INTERRUPT_HARD);
++        } else {
++            cpu_reset_interrupt(cs, CPU_INTERRUPT_HARD);
++        }
++    }
++}
++
++qemu_irq x86_allocate_cpu_irq(void)
++{
++    return qemu_allocate_irq(pic_irq_request, NULL, 0);
++}
++
++int cpu_get_pic_interrupt(CPUX86State *env)
++{
++    X86CPU *cpu = env_archcpu(env);
++    int intno;
++
++    if (!kvm_irqchip_in_kernel() && !whpx_apic_in_platform()) {
++        intno = apic_get_interrupt(cpu->apic_state);
++        if (intno >= 0) {
++            return intno;
++        }
++        /* read the irq from the PIC */
++        if (!apic_accept_pic_intr(cpu->apic_state)) {
++            return -1;
++        }
++    }
++
++    intno = pic_read_irq(isa_pic);
++    return intno;
++}
++
++DeviceState *cpu_get_current_apic(void)
++{
++    if (current_cpu) {
++        X86CPU *cpu = X86_CPU(current_cpu);
++        return cpu->apic_state;
++    } else {
++        return NULL;
++    }
++}
+diff --git a/hw/i386/x86.c b/hw/i386/x86.c
+index fcef652c1e..0b5cc59956 100644
+--- a/hw/i386/x86.c
++++ b/hw/i386/x86.c
+@@ -22,52 +22,25 @@
+  */
+ #include "qemu/osdep.h"
+ #include "qemu/error-report.h"
+-#include "qemu/option.h"
+-#include "qemu/cutils.h"
+ #include "qemu/units.h"
+-#include "qemu/datadir.h"
+ #include "qapi/error.h"
+ #include "qapi/qapi-visit-common.h"
+-#include "qapi/clone-visitor.h"
+ #include "qapi/qapi-visit-machine.h"
+ #include "qapi/visitor.h"
+ #include "sysemu/qtest.h"
+-#include "sysemu/whpx.h"
+ #include "sysemu/numa.h"
+-#include "sysemu/replay.h"
+-#include "sysemu/sysemu.h"
+-#include "sysemu/cpu-timers.h"
+-#include "sysemu/xen.h"
+ #include "trace.h"
+ 
++#include "hw/acpi/aml-build.h"
+ #include "hw/i386/x86.h"
+-#include "target/i386/cpu.h"
+ #include "hw/i386/topology.h"
+-#include "hw/i386/fw_cfg.h"
+-#include "hw/intc/i8259.h"
+-#include "hw/rtc/mc146818rtc.h"
+-#include "target/i386/sev.h"
+ 
+-#include "hw/acpi/cpu_hotplug.h"
+-#include "hw/irq.h"
+ #include "hw/nmi.h"
+-#include "hw/loader.h"
+-#include "multiboot.h"
+-#include "elf.h"
+-#include "standard-headers/asm-x86/bootparam.h"
+-#include CONFIG_DEVICES
+ #include "kvm/kvm_i386.h"
+ 
+-#ifdef CONFIG_XEN_EMU
+-#include "hw/xen/xen.h"
+-#include "hw/i386/kvm/xen_evtchn.h"
+-#endif
+ 
+-/* Physical Address of PVH entry point read from kernel ELF NOTE */
+-static size_t pvh_start_addr;
+-
+-static void init_topo_info(X86CPUTopoInfo *topo_info,
+-                           const X86MachineState *x86ms)
++void init_topo_info(X86CPUTopoInfo *topo_info,
++                    const X86MachineState *x86ms)
+ {
+     MachineState *ms = MACHINE(x86ms);
+ 
+@@ -94,355 +67,6 @@ uint32_t x86_cpu_apic_id_from_index(X86MachineState *x86ms,
+     return x86_apicid_from_cpu_idx(&topo_info, cpu_index);
+ }
+ 
+-
+-void x86_cpu_new(X86MachineState *x86ms, int64_t apic_id, Error **errp)
+-{
+-    Object *cpu = object_new(MACHINE(x86ms)->cpu_type);
+-
+-    if (!object_property_set_uint(cpu, "apic-id", apic_id, errp)) {
+-        goto out;
+-    }
+-    qdev_realize(DEVICE(cpu), NULL, errp);
+-
+-out:
+-    object_unref(cpu);
+-}
+-
+-void x86_cpus_init(X86MachineState *x86ms, int default_cpu_version)
+-{
+-    int i;
+-    const CPUArchIdList *possible_cpus;
+-    MachineState *ms = MACHINE(x86ms);
+-    MachineClass *mc = MACHINE_GET_CLASS(x86ms);
+-
+-    x86_cpu_set_default_version(default_cpu_version);
+-
+-    /*
+-     * Calculates the limit to CPU APIC ID values
+-     *
+-     * Limit for the APIC ID value, so that all
+-     * CPU APIC IDs are < x86ms->apic_id_limit.
+-     *
+-     * This is used for FW_CFG_MAX_CPUS. See comments on fw_cfg_arch_create().
+-     */
+-    x86ms->apic_id_limit = x86_cpu_apic_id_from_index(x86ms,
+-                                                      ms->smp.max_cpus - 1) + 1;
+-
+-    /*
+-     * Can we support APIC ID 255 or higher?  With KVM, that requires
+-     * both in-kernel lapic and X2APIC userspace API.
+-     *
+-     * kvm_enabled() must go first to ensure that kvm_* references are
+-     * not emitted for the linker to consume (kvm_enabled() is
+-     * a literal `0` in configurations where kvm_* aren't defined)
+-     */
+-    if (kvm_enabled() && x86ms->apic_id_limit > 255 &&
+-        kvm_irqchip_in_kernel() && !kvm_enable_x2apic()) {
+-        error_report("current -smp configuration requires kernel "
+-                     "irqchip and X2APIC API support.");
+-        exit(EXIT_FAILURE);
+-    }
+-
+-    if (kvm_enabled()) {
+-        kvm_set_max_apic_id(x86ms->apic_id_limit);
+-    }
+-
+-    if (!kvm_irqchip_in_kernel()) {
+-        apic_set_max_apic_id(x86ms->apic_id_limit);
+-    }
+-
+-    possible_cpus = mc->possible_cpu_arch_ids(ms);
+-    for (i = 0; i < ms->smp.cpus; i++) {
+-        x86_cpu_new(x86ms, possible_cpus->cpus[i].arch_id, &error_fatal);
+-    }
+-}
+-
+-void x86_rtc_set_cpus_count(ISADevice *s, uint16_t cpus_count)
+-{
+-    MC146818RtcState *rtc = MC146818_RTC(s);
+-
+-    if (cpus_count > 0xff) {
+-        /*
+-         * If the number of CPUs can't be represented in 8 bits, the
+-         * BIOS must use "FW_CFG_NB_CPUS". Set RTC field to 0 just
+-         * to make old BIOSes fail more predictably.
+-         */
+-        mc146818rtc_set_cmos_data(rtc, 0x5f, 0);
+-    } else {
+-        mc146818rtc_set_cmos_data(rtc, 0x5f, cpus_count - 1);
+-    }
+-}
+-
+-static int x86_apic_cmp(const void *a, const void *b)
+-{
+-   CPUArchId *apic_a = (CPUArchId *)a;
+-   CPUArchId *apic_b = (CPUArchId *)b;
+-
+-   return apic_a->arch_id - apic_b->arch_id;
+-}
+-
+-/*
+- * returns pointer to CPUArchId descriptor that matches CPU's apic_id
+- * in ms->possible_cpus->cpus, if ms->possible_cpus->cpus has no
+- * entry corresponding to CPU's apic_id returns NULL.
+- */
+-CPUArchId *x86_find_cpu_slot(MachineState *ms, uint32_t id, int *idx)
+-{
+-    CPUArchId apic_id, *found_cpu;
+-
+-    apic_id.arch_id = id;
+-    found_cpu = bsearch(&apic_id, ms->possible_cpus->cpus,
+-        ms->possible_cpus->len, sizeof(*ms->possible_cpus->cpus),
+-        x86_apic_cmp);
+-    if (found_cpu && idx) {
+-        *idx = found_cpu - ms->possible_cpus->cpus;
+-    }
+-    return found_cpu;
+-}
+-
+-void x86_cpu_plug(HotplugHandler *hotplug_dev,
+-                  DeviceState *dev, Error **errp)
+-{
+-    CPUArchId *found_cpu;
+-    Error *local_err = NULL;
+-    X86CPU *cpu = X86_CPU(dev);
+-    X86MachineState *x86ms = X86_MACHINE(hotplug_dev);
+-
+-    if (x86ms->acpi_dev) {
+-        hotplug_handler_plug(x86ms->acpi_dev, dev, &local_err);
+-        if (local_err) {
+-            goto out;
+-        }
+-    }
+-
+-    /* increment the number of CPUs */
+-    x86ms->boot_cpus++;
+-    if (x86ms->rtc) {
+-        x86_rtc_set_cpus_count(x86ms->rtc, x86ms->boot_cpus);
+-    }
+-    if (x86ms->fw_cfg) {
+-        fw_cfg_modify_i16(x86ms->fw_cfg, FW_CFG_NB_CPUS, x86ms->boot_cpus);
+-    }
+-
+-    found_cpu = x86_find_cpu_slot(MACHINE(x86ms), cpu->apic_id, NULL);
+-    found_cpu->cpu = CPU(dev);
+-out:
+-    error_propagate(errp, local_err);
+-}
+-
+-void x86_cpu_unplug_request_cb(HotplugHandler *hotplug_dev,
+-                               DeviceState *dev, Error **errp)
+-{
+-    int idx = -1;
+-    X86CPU *cpu = X86_CPU(dev);
+-    X86MachineState *x86ms = X86_MACHINE(hotplug_dev);
+-
+-    if (!x86ms->acpi_dev) {
+-        error_setg(errp, "CPU hot unplug not supported without ACPI");
+-        return;
+-    }
+-
+-    x86_find_cpu_slot(MACHINE(x86ms), cpu->apic_id, &idx);
+-    assert(idx != -1);
+-    if (idx == 0) {
+-        error_setg(errp, "Boot CPU is unpluggable");
+-        return;
+-    }
+-
+-    hotplug_handler_unplug_request(x86ms->acpi_dev, dev,
+-                                   errp);
+-}
+-
+-void x86_cpu_unplug_cb(HotplugHandler *hotplug_dev,
+-                       DeviceState *dev, Error **errp)
+-{
+-    CPUArchId *found_cpu;
+-    Error *local_err = NULL;
+-    X86CPU *cpu = X86_CPU(dev);
+-    X86MachineState *x86ms = X86_MACHINE(hotplug_dev);
+-
+-    hotplug_handler_unplug(x86ms->acpi_dev, dev, &local_err);
+-    if (local_err) {
+-        goto out;
+-    }
+-
+-    found_cpu = x86_find_cpu_slot(MACHINE(x86ms), cpu->apic_id, NULL);
+-    found_cpu->cpu = NULL;
+-    qdev_unrealize(dev);
+-
+-    /* decrement the number of CPUs */
+-    x86ms->boot_cpus--;
+-    /* Update the number of CPUs in CMOS */
+-    x86_rtc_set_cpus_count(x86ms->rtc, x86ms->boot_cpus);
+-    fw_cfg_modify_i16(x86ms->fw_cfg, FW_CFG_NB_CPUS, x86ms->boot_cpus);
+- out:
+-    error_propagate(errp, local_err);
+-}
+-
+-void x86_cpu_pre_plug(HotplugHandler *hotplug_dev,
+-                      DeviceState *dev, Error **errp)
+-{
+-    int idx;
+-    CPUState *cs;
+-    CPUArchId *cpu_slot;
+-    X86CPUTopoIDs topo_ids;
+-    X86CPU *cpu = X86_CPU(dev);
+-    CPUX86State *env = &cpu->env;
+-    MachineState *ms = MACHINE(hotplug_dev);
+-    X86MachineState *x86ms = X86_MACHINE(hotplug_dev);
+-    unsigned int smp_cores = ms->smp.cores;
+-    unsigned int smp_threads = ms->smp.threads;
+-    X86CPUTopoInfo topo_info;
+-
+-    if (!object_dynamic_cast(OBJECT(cpu), ms->cpu_type)) {
+-        error_setg(errp, "Invalid CPU type, expected cpu type: '%s'",
+-                   ms->cpu_type);
+-        return;
+-    }
+-
+-    if (x86ms->acpi_dev) {
+-        Error *local_err = NULL;
+-
+-        hotplug_handler_pre_plug(HOTPLUG_HANDLER(x86ms->acpi_dev), dev,
+-                                 &local_err);
+-        if (local_err) {
+-            error_propagate(errp, local_err);
+-            return;
+-        }
+-    }
+-
+-    init_topo_info(&topo_info, x86ms);
+-
+-    env->nr_dies = ms->smp.dies;
+-
+-    /*
+-     * If APIC ID is not set,
+-     * set it based on socket/die/core/thread properties.
+-     */
+-    if (cpu->apic_id == UNASSIGNED_APIC_ID) {
+-        int max_socket = (ms->smp.max_cpus - 1) /
+-                                smp_threads / smp_cores / ms->smp.dies;
+-
+-        /*
+-         * die-id was optional in QEMU 4.0 and older, so keep it optional
+-         * if there's only one die per socket.
+-         */
+-        if (cpu->die_id < 0 && ms->smp.dies == 1) {
+-            cpu->die_id = 0;
+-        }
+-
+-        if (cpu->socket_id < 0) {
+-            error_setg(errp, "CPU socket-id is not set");
+-            return;
+-        } else if (cpu->socket_id > max_socket) {
+-            error_setg(errp, "Invalid CPU socket-id: %u must be in range 0:%u",
+-                       cpu->socket_id, max_socket);
+-            return;
+-        }
+-        if (cpu->die_id < 0) {
+-            error_setg(errp, "CPU die-id is not set");
+-            return;
+-        } else if (cpu->die_id > ms->smp.dies - 1) {
+-            error_setg(errp, "Invalid CPU die-id: %u must be in range 0:%u",
+-                       cpu->die_id, ms->smp.dies - 1);
+-            return;
+-        }
+-        if (cpu->core_id < 0) {
+-            error_setg(errp, "CPU core-id is not set");
+-            return;
+-        } else if (cpu->core_id > (smp_cores - 1)) {
+-            error_setg(errp, "Invalid CPU core-id: %u must be in range 0:%u",
+-                       cpu->core_id, smp_cores - 1);
+-            return;
+-        }
+-        if (cpu->thread_id < 0) {
+-            error_setg(errp, "CPU thread-id is not set");
+-            return;
+-        } else if (cpu->thread_id > (smp_threads - 1)) {
+-            error_setg(errp, "Invalid CPU thread-id: %u must be in range 0:%u",
+-                       cpu->thread_id, smp_threads - 1);
+-            return;
+-        }
+-
+-        topo_ids.pkg_id = cpu->socket_id;
+-        topo_ids.die_id = cpu->die_id;
+-        topo_ids.core_id = cpu->core_id;
+-        topo_ids.smt_id = cpu->thread_id;
+-        cpu->apic_id = x86_apicid_from_topo_ids(&topo_info, &topo_ids);
+-    }
+-
+-    cpu_slot = x86_find_cpu_slot(MACHINE(x86ms), cpu->apic_id, &idx);
+-    if (!cpu_slot) {
+-        x86_topo_ids_from_apicid(cpu->apic_id, &topo_info, &topo_ids);
+-        error_setg(errp,
+-            "Invalid CPU [socket: %u, die: %u, core: %u, thread: %u] with"
+-            " APIC ID %" PRIu32 ", valid index range 0:%d",
+-            topo_ids.pkg_id, topo_ids.die_id, topo_ids.core_id, topo_ids.smt_id,
+-            cpu->apic_id, ms->possible_cpus->len - 1);
+-        return;
+-    }
+-
+-    if (cpu_slot->cpu) {
+-        error_setg(errp, "CPU[%d] with APIC ID %" PRIu32 " exists",
+-                   idx, cpu->apic_id);
+-        return;
+-    }
+-
+-    /* if 'address' properties socket-id/core-id/thread-id are not set, set them
+-     * so that machine_query_hotpluggable_cpus would show correct values
+-     */
+-    /* TODO: move socket_id/core_id/thread_id checks into x86_cpu_realizefn()
+-     * once -smp refactoring is complete and there will be CPU private
+-     * CPUState::nr_cores and CPUState::nr_threads fields instead of globals */
+-    x86_topo_ids_from_apicid(cpu->apic_id, &topo_info, &topo_ids);
+-    if (cpu->socket_id != -1 && cpu->socket_id != topo_ids.pkg_id) {
+-        error_setg(errp, "property socket-id: %u doesn't match set apic-id:"
+-            " 0x%x (socket-id: %u)", cpu->socket_id, cpu->apic_id,
+-            topo_ids.pkg_id);
+-        return;
+-    }
+-    cpu->socket_id = topo_ids.pkg_id;
+-
+-    if (cpu->die_id != -1 && cpu->die_id != topo_ids.die_id) {
+-        error_setg(errp, "property die-id: %u doesn't match set apic-id:"
+-            " 0x%x (die-id: %u)", cpu->die_id, cpu->apic_id, topo_ids.die_id);
+-        return;
+-    }
+-    cpu->die_id = topo_ids.die_id;
+-
+-    if (cpu->core_id != -1 && cpu->core_id != topo_ids.core_id) {
+-        error_setg(errp, "property core-id: %u doesn't match set apic-id:"
+-            " 0x%x (core-id: %u)", cpu->core_id, cpu->apic_id,
+-            topo_ids.core_id);
+-        return;
+-    }
+-    cpu->core_id = topo_ids.core_id;
+-
+-    if (cpu->thread_id != -1 && cpu->thread_id != topo_ids.smt_id) {
+-        error_setg(errp, "property thread-id: %u doesn't match set apic-id:"
+-            " 0x%x (thread-id: %u)", cpu->thread_id, cpu->apic_id,
+-            topo_ids.smt_id);
+-        return;
+-    }
+-    cpu->thread_id = topo_ids.smt_id;
+-
+-    /*
+-    * kvm_enabled() must go first to ensure that kvm_* references are
+-    * not emitted for the linker to consume (kvm_enabled() is
+-    * a literal `0` in configurations where kvm_* aren't defined)
+-    */
+-    if (kvm_enabled() && hyperv_feat_enabled(cpu, HYPERV_FEAT_VPINDEX) &&
+-        !kvm_hv_vpindex_settable()) {
+-        error_setg(errp, "kernel doesn't allow setting HyperV VP_INDEX");
+-        return;
+-    }
+-
+-    cs = CPU(cpu);
+-    cs->cpu_index = idx;
+-
+-    numa_cpu_pre_plug(cpu_slot, dev, errp);
+-}
+-
+ static CpuInstanceProperties
+ x86_cpu_index_to_props(MachineState *ms, unsigned cpu_index)
+ {
+@@ -528,676 +152,6 @@ static void x86_nmi(NMIState *n, int cpu_index, Error **errp)
+     }
+ }
+ 
+-static long get_file_size(FILE *f)
+-{
+-    long where, size;
+-
+-    /* XXX: on Unix systems, using fstat() probably makes more sense */
+-
+-    where = ftell(f);
+-    fseek(f, 0, SEEK_END);
+-    size = ftell(f);
+-    fseek(f, where, SEEK_SET);
+-
+-    return size;
+-}
+-
+-/* TSC handling */
+-uint64_t cpu_get_tsc(CPUX86State *env)
+-{
+-    return cpus_get_elapsed_ticks();
+-}
+-
+-/* IRQ handling */
+-static void pic_irq_request(void *opaque, int irq, int level)
+-{
+-    CPUState *cs = first_cpu;
+-    X86CPU *cpu = X86_CPU(cs);
+-
+-    trace_x86_pic_interrupt(irq, level);
+-    if (cpu_is_apic_enabled(cpu->apic_state) && !kvm_irqchip_in_kernel() &&
+-        !whpx_apic_in_platform()) {
+-        CPU_FOREACH(cs) {
+-            cpu = X86_CPU(cs);
+-            if (apic_accept_pic_intr(cpu->apic_state)) {
+-                apic_deliver_pic_intr(cpu->apic_state, level);
+-            }
+-        }
+-    } else {
+-        if (level) {
+-            cpu_interrupt(cs, CPU_INTERRUPT_HARD);
+-        } else {
+-            cpu_reset_interrupt(cs, CPU_INTERRUPT_HARD);
+-        }
+-    }
+-}
+-
+-qemu_irq x86_allocate_cpu_irq(void)
+-{
+-    return qemu_allocate_irq(pic_irq_request, NULL, 0);
+-}
+-
+-int cpu_get_pic_interrupt(CPUX86State *env)
+-{
+-    X86CPU *cpu = env_archcpu(env);
+-    int intno;
+-
+-    if (!kvm_irqchip_in_kernel() && !whpx_apic_in_platform()) {
+-        intno = apic_get_interrupt(cpu->apic_state);
+-        if (intno >= 0) {
+-            return intno;
+-        }
+-        /* read the irq from the PIC */
+-        if (!apic_accept_pic_intr(cpu->apic_state)) {
+-            return -1;
+-        }
+-    }
+-
+-    intno = pic_read_irq(isa_pic);
+-    return intno;
+-}
+-
+-DeviceState *cpu_get_current_apic(void)
+-{
+-    if (current_cpu) {
+-        X86CPU *cpu = X86_CPU(current_cpu);
+-        return cpu->apic_state;
+-    } else {
+-        return NULL;
+-    }
+-}
+-
+-void gsi_handler(void *opaque, int n, int level)
+-{
+-    GSIState *s = opaque;
+-
+-    trace_x86_gsi_interrupt(n, level);
+-    switch (n) {
+-    case 0 ... ISA_NUM_IRQS - 1:
+-        if (s->i8259_irq[n]) {
+-            /* Under KVM, Kernel will forward to both PIC and IOAPIC */
+-            qemu_set_irq(s->i8259_irq[n], level);
+-        }
+-        /* fall through */
+-    case ISA_NUM_IRQS ... IOAPIC_NUM_PINS - 1:
+-#ifdef CONFIG_XEN_EMU
+-        /*
+-         * Xen delivers the GSI to the Legacy PIC (not that Legacy PIC
+-         * routing actually works properly under Xen). And then to
+-         * *either* the PIRQ handling or the I/OAPIC depending on
+-         * whether the former wants it.
+-         */
+-        if (xen_mode == XEN_EMULATE && xen_evtchn_set_gsi(n, level)) {
+-            break;
+-        }
+-#endif
+-        qemu_set_irq(s->ioapic_irq[n], level);
+-        break;
+-    case IO_APIC_SECONDARY_IRQBASE
+-        ... IO_APIC_SECONDARY_IRQBASE + IOAPIC_NUM_PINS - 1:
+-        qemu_set_irq(s->ioapic2_irq[n - IO_APIC_SECONDARY_IRQBASE], level);
+-        break;
+-    }
+-}
+-
+-void ioapic_init_gsi(GSIState *gsi_state, Object *parent)
+-{
+-    DeviceState *dev;
+-    SysBusDevice *d;
+-    unsigned int i;
+-
+-    assert(parent);
+-    if (kvm_ioapic_in_kernel()) {
+-        dev = qdev_new(TYPE_KVM_IOAPIC);
+-    } else {
+-        dev = qdev_new(TYPE_IOAPIC);
+-    }
+-    object_property_add_child(parent, "ioapic", OBJECT(dev));
+-    d = SYS_BUS_DEVICE(dev);
+-    sysbus_realize_and_unref(d, &error_fatal);
+-    sysbus_mmio_map(d, 0, IO_APIC_DEFAULT_ADDRESS);
+-
+-    for (i = 0; i < IOAPIC_NUM_PINS; i++) {
+-        gsi_state->ioapic_irq[i] = qdev_get_gpio_in(dev, i);
+-    }
+-}
+-
+-DeviceState *ioapic_init_secondary(GSIState *gsi_state)
+-{
+-    DeviceState *dev;
+-    SysBusDevice *d;
+-    unsigned int i;
+-
+-    dev = qdev_new(TYPE_IOAPIC);
+-    d = SYS_BUS_DEVICE(dev);
+-    sysbus_realize_and_unref(d, &error_fatal);
+-    sysbus_mmio_map(d, 0, IO_APIC_SECONDARY_ADDRESS);
+-
+-    for (i = 0; i < IOAPIC_NUM_PINS; i++) {
+-        gsi_state->ioapic2_irq[i] = qdev_get_gpio_in(dev, i);
+-    }
+-    return dev;
+-}
+-
+-/*
+- * The entry point into the kernel for PVH boot is different from
+- * the native entry point.  The PVH entry is defined by the x86/HVM
+- * direct boot ABI and is available in an ELFNOTE in the kernel binary.
+- *
+- * This function is passed to load_elf() when it is called from
+- * load_elfboot() which then additionally checks for an ELF Note of
+- * type XEN_ELFNOTE_PHYS32_ENTRY and passes it to this function to
+- * parse the PVH entry address from the ELF Note.
+- *
+- * Due to trickery in elf_opts.h, load_elf() is actually available as
+- * load_elf32() or load_elf64() and this routine needs to be able
+- * to deal with being called as 32 or 64 bit.
+- *
+- * The address of the PVH entry point is saved to the 'pvh_start_addr'
+- * global variable.  (although the entry point is 32-bit, the kernel
+- * binary can be either 32-bit or 64-bit).
+- */
+-static uint64_t read_pvh_start_addr(void *arg1, void *arg2, bool is64)
+-{
+-    size_t *elf_note_data_addr;
+-
+-    /* Check if ELF Note header passed in is valid */
+-    if (arg1 == NULL) {
+-        return 0;
+-    }
+-
+-    if (is64) {
+-        struct elf64_note *nhdr64 = (struct elf64_note *)arg1;
+-        uint64_t nhdr_size64 = sizeof(struct elf64_note);
+-        uint64_t phdr_align = *(uint64_t *)arg2;
+-        uint64_t nhdr_namesz = nhdr64->n_namesz;
+-
+-        elf_note_data_addr =
+-            ((void *)nhdr64) + nhdr_size64 +
+-            QEMU_ALIGN_UP(nhdr_namesz, phdr_align);
+-
+-        pvh_start_addr = *elf_note_data_addr;
+-    } else {
+-        struct elf32_note *nhdr32 = (struct elf32_note *)arg1;
+-        uint32_t nhdr_size32 = sizeof(struct elf32_note);
+-        uint32_t phdr_align = *(uint32_t *)arg2;
+-        uint32_t nhdr_namesz = nhdr32->n_namesz;
+-
+-        elf_note_data_addr =
+-            ((void *)nhdr32) + nhdr_size32 +
+-            QEMU_ALIGN_UP(nhdr_namesz, phdr_align);
+-
+-        pvh_start_addr = *(uint32_t *)elf_note_data_addr;
+-    }
+-
+-    return pvh_start_addr;
+-}
+-
+-static bool load_elfboot(const char *kernel_filename,
+-                         int kernel_file_size,
+-                         uint8_t *header,
+-                         size_t pvh_xen_start_addr,
+-                         FWCfgState *fw_cfg)
+-{
+-    uint32_t flags = 0;
+-    uint32_t mh_load_addr = 0;
+-    uint32_t elf_kernel_size = 0;
+-    uint64_t elf_entry;
+-    uint64_t elf_low, elf_high;
+-    int kernel_size;
+-
+-    if (ldl_p(header) != 0x464c457f) {
+-        return false; /* no elfboot */
+-    }
+-
+-    bool elf_is64 = header[EI_CLASS] == ELFCLASS64;
+-    flags = elf_is64 ?
+-        ((Elf64_Ehdr *)header)->e_flags : ((Elf32_Ehdr *)header)->e_flags;
+-
+-    if (flags & 0x00010004) { /* LOAD_ELF_HEADER_HAS_ADDR */
+-        error_report("elfboot unsupported flags = %x", flags);
+-        exit(1);
+-    }
+-
+-    uint64_t elf_note_type = XEN_ELFNOTE_PHYS32_ENTRY;
+-    kernel_size = load_elf(kernel_filename, read_pvh_start_addr,
+-                           NULL, &elf_note_type, &elf_entry,
+-                           &elf_low, &elf_high, NULL, 0, I386_ELF_MACHINE,
+-                           0, 0);
+-
+-    if (kernel_size < 0) {
+-        error_report("Error while loading elf kernel");
+-        exit(1);
+-    }
+-    mh_load_addr = elf_low;
+-    elf_kernel_size = elf_high - elf_low;
+-
+-    if (pvh_start_addr == 0) {
+-        error_report("Error loading uncompressed kernel without PVH ELF Note");
+-        exit(1);
+-    }
+-    fw_cfg_add_i32(fw_cfg, FW_CFG_KERNEL_ENTRY, pvh_start_addr);
+-    fw_cfg_add_i32(fw_cfg, FW_CFG_KERNEL_ADDR, mh_load_addr);
+-    fw_cfg_add_i32(fw_cfg, FW_CFG_KERNEL_SIZE, elf_kernel_size);
+-
+-    return true;
+-}
+-
+-void x86_load_linux(X86MachineState *x86ms,
+-                    FWCfgState *fw_cfg,
+-                    int acpi_data_size,
+-                    bool pvh_enabled)
+-{
+-    bool linuxboot_dma_enabled = X86_MACHINE_GET_CLASS(x86ms)->fwcfg_dma_enabled;
+-    uint16_t protocol;
+-    int setup_size, kernel_size, cmdline_size;
+-    int dtb_size, setup_data_offset;
+-    uint32_t initrd_max;
+-    uint8_t header[8192], *setup, *kernel;
+-    hwaddr real_addr, prot_addr, cmdline_addr, initrd_addr = 0;
+-    FILE *f;
+-    char *vmode;
+-    MachineState *machine = MACHINE(x86ms);
+-    struct setup_data *setup_data;
+-    const char *kernel_filename = machine->kernel_filename;
+-    const char *initrd_filename = machine->initrd_filename;
+-    const char *dtb_filename = machine->dtb;
+-    const char *kernel_cmdline = machine->kernel_cmdline;
+-    SevKernelLoaderContext sev_load_ctx = {};
+-
+-    /* Align to 16 bytes as a paranoia measure */
+-    cmdline_size = (strlen(kernel_cmdline) + 16) & ~15;
+-
+-    /* load the kernel header */
+-    f = fopen(kernel_filename, "rb");
+-    if (!f) {
+-        fprintf(stderr, "qemu: could not open kernel file '%s': %s\n",
+-                kernel_filename, strerror(errno));
+-        exit(1);
+-    }
+-
+-    kernel_size = get_file_size(f);
+-    if (!kernel_size ||
+-        fread(header, 1, MIN(ARRAY_SIZE(header), kernel_size), f) !=
+-        MIN(ARRAY_SIZE(header), kernel_size)) {
+-        fprintf(stderr, "qemu: could not load kernel '%s': %s\n",
+-                kernel_filename, strerror(errno));
+-        exit(1);
+-    }
+-
+-    /* kernel protocol version */
+-    if (ldl_p(header + 0x202) == 0x53726448) {
+-        protocol = lduw_p(header + 0x206);
+-    } else {
+-        /*
+-         * This could be a multiboot kernel. If it is, let's stop treating it
+-         * like a Linux kernel.
+-         * Note: some multiboot images could be in the ELF format (the same of
+-         * PVH), so we try multiboot first since we check the multiboot magic
+-         * header before to load it.
+-         */
+-        if (load_multiboot(x86ms, fw_cfg, f, kernel_filename, initrd_filename,
+-                           kernel_cmdline, kernel_size, header)) {
+-            return;
+-        }
+-        /*
+-         * Check if the file is an uncompressed kernel file (ELF) and load it,
+-         * saving the PVH entry point used by the x86/HVM direct boot ABI.
+-         * If load_elfboot() is successful, populate the fw_cfg info.
+-         */
+-        if (pvh_enabled &&
+-            load_elfboot(kernel_filename, kernel_size,
+-                         header, pvh_start_addr, fw_cfg)) {
+-            fclose(f);
+-
+-            fw_cfg_add_i32(fw_cfg, FW_CFG_CMDLINE_SIZE,
+-                strlen(kernel_cmdline) + 1);
+-            fw_cfg_add_string(fw_cfg, FW_CFG_CMDLINE_DATA, kernel_cmdline);
+-
+-            fw_cfg_add_i32(fw_cfg, FW_CFG_SETUP_SIZE, sizeof(header));
+-            fw_cfg_add_bytes(fw_cfg, FW_CFG_SETUP_DATA,
+-                             header, sizeof(header));
+-
+-            /* load initrd */
+-            if (initrd_filename) {
+-                GMappedFile *mapped_file;
+-                gsize initrd_size;
+-                gchar *initrd_data;
+-                GError *gerr = NULL;
+-
+-                mapped_file = g_mapped_file_new(initrd_filename, false, &gerr);
+-                if (!mapped_file) {
+-                    fprintf(stderr, "qemu: error reading initrd %s: %s\n",
+-                            initrd_filename, gerr->message);
+-                    exit(1);
+-                }
+-                x86ms->initrd_mapped_file = mapped_file;
+-
+-                initrd_data = g_mapped_file_get_contents(mapped_file);
+-                initrd_size = g_mapped_file_get_length(mapped_file);
+-                initrd_max = x86ms->below_4g_mem_size - acpi_data_size - 1;
+-                if (initrd_size >= initrd_max) {
+-                    fprintf(stderr, "qemu: initrd is too large, cannot support."
+-                            "(max: %"PRIu32", need %"PRId64")\n",
+-                            initrd_max, (uint64_t)initrd_size);
+-                    exit(1);
+-                }
+-
+-                initrd_addr = (initrd_max - initrd_size) & ~4095;
+-
+-                fw_cfg_add_i32(fw_cfg, FW_CFG_INITRD_ADDR, initrd_addr);
+-                fw_cfg_add_i32(fw_cfg, FW_CFG_INITRD_SIZE, initrd_size);
+-                fw_cfg_add_bytes(fw_cfg, FW_CFG_INITRD_DATA, initrd_data,
+-                                 initrd_size);
+-            }
+-
+-            option_rom[nb_option_roms].bootindex = 0;
+-            option_rom[nb_option_roms].name = "pvh.bin";
+-            nb_option_roms++;
+-
+-            return;
+-        }
+-        protocol = 0;
+-    }
+-
+-    if (protocol < 0x200 || !(header[0x211] & 0x01)) {
+-        /* Low kernel */
+-        real_addr    = 0x90000;
+-        cmdline_addr = 0x9a000 - cmdline_size;
+-        prot_addr    = 0x10000;
+-    } else if (protocol < 0x202) {
+-        /* High but ancient kernel */
+-        real_addr    = 0x90000;
+-        cmdline_addr = 0x9a000 - cmdline_size;
+-        prot_addr    = 0x100000;
+-    } else {
+-        /* High and recent kernel */
+-        real_addr    = 0x10000;
+-        cmdline_addr = 0x20000;
+-        prot_addr    = 0x100000;
+-    }
+-
+-    /* highest address for loading the initrd */
+-    if (protocol >= 0x20c &&
+-        lduw_p(header + 0x236) & XLF_CAN_BE_LOADED_ABOVE_4G) {
+-        /*
+-         * Linux has supported initrd up to 4 GB for a very long time (2007,
+-         * long before XLF_CAN_BE_LOADED_ABOVE_4G which was added in 2013),
+-         * though it only sets initrd_max to 2 GB to "work around bootloader
+-         * bugs". Luckily, QEMU firmware(which does something like bootloader)
+-         * has supported this.
+-         *
+-         * It's believed that if XLF_CAN_BE_LOADED_ABOVE_4G is set, initrd can
+-         * be loaded into any address.
+-         *
+-         * In addition, initrd_max is uint32_t simply because QEMU doesn't
+-         * support the 64-bit boot protocol (specifically the ext_ramdisk_image
+-         * field).
+-         *
+-         * Therefore here just limit initrd_max to UINT32_MAX simply as well.
+-         */
+-        initrd_max = UINT32_MAX;
+-    } else if (protocol >= 0x203) {
+-        initrd_max = ldl_p(header + 0x22c);
+-    } else {
+-        initrd_max = 0x37ffffff;
+-    }
+-
+-    if (initrd_max >= x86ms->below_4g_mem_size - acpi_data_size) {
+-        initrd_max = x86ms->below_4g_mem_size - acpi_data_size - 1;
+-    }
+-
+-    fw_cfg_add_i32(fw_cfg, FW_CFG_CMDLINE_ADDR, cmdline_addr);
+-    fw_cfg_add_i32(fw_cfg, FW_CFG_CMDLINE_SIZE, strlen(kernel_cmdline) + 1);
+-    fw_cfg_add_string(fw_cfg, FW_CFG_CMDLINE_DATA, kernel_cmdline);
+-    sev_load_ctx.cmdline_data = (char *)kernel_cmdline;
+-    sev_load_ctx.cmdline_size = strlen(kernel_cmdline) + 1;
+-
+-    if (protocol >= 0x202) {
+-        stl_p(header + 0x228, cmdline_addr);
+-    } else {
+-        stw_p(header + 0x20, 0xA33F);
+-        stw_p(header + 0x22, cmdline_addr - real_addr);
+-    }
+-
+-    /* handle vga= parameter */
+-    vmode = strstr(kernel_cmdline, "vga=");
+-    if (vmode) {
+-        unsigned int video_mode;
+-        const char *end;
+-        int ret;
+-        /* skip "vga=" */
+-        vmode += 4;
+-        if (!strncmp(vmode, "normal", 6)) {
+-            video_mode = 0xffff;
+-        } else if (!strncmp(vmode, "ext", 3)) {
+-            video_mode = 0xfffe;
+-        } else if (!strncmp(vmode, "ask", 3)) {
+-            video_mode = 0xfffd;
+-        } else {
+-            ret = qemu_strtoui(vmode, &end, 0, &video_mode);
+-            if (ret != 0 || (*end && *end != ' ')) {
+-                fprintf(stderr, "qemu: invalid 'vga=' kernel parameter.\n");
+-                exit(1);
+-            }
+-        }
+-        stw_p(header + 0x1fa, video_mode);
+-    }
+-
+-    /* loader type */
+-    /*
+-     * High nybble = B reserved for QEMU; low nybble is revision number.
+-     * If this code is substantially changed, you may want to consider
+-     * incrementing the revision.
+-     */
+-    if (protocol >= 0x200) {
+-        header[0x210] = 0xB0;
+-    }
+-    /* heap */
+-    if (protocol >= 0x201) {
+-        header[0x211] |= 0x80; /* CAN_USE_HEAP */
+-        stw_p(header + 0x224, cmdline_addr - real_addr - 0x200);
+-    }
+-
+-    /* load initrd */
+-    if (initrd_filename) {
+-        GMappedFile *mapped_file;
+-        gsize initrd_size;
+-        gchar *initrd_data;
+-        GError *gerr = NULL;
+-
+-        if (protocol < 0x200) {
+-            fprintf(stderr, "qemu: linux kernel too old to load a ram disk\n");
+-            exit(1);
+-        }
+-
+-        mapped_file = g_mapped_file_new(initrd_filename, false, &gerr);
+-        if (!mapped_file) {
+-            fprintf(stderr, "qemu: error reading initrd %s: %s\n",
+-                    initrd_filename, gerr->message);
+-            exit(1);
+-        }
+-        x86ms->initrd_mapped_file = mapped_file;
+-
+-        initrd_data = g_mapped_file_get_contents(mapped_file);
+-        initrd_size = g_mapped_file_get_length(mapped_file);
+-        if (initrd_size >= initrd_max) {
+-            fprintf(stderr, "qemu: initrd is too large, cannot support."
+-                    "(max: %"PRIu32", need %"PRId64")\n",
+-                    initrd_max, (uint64_t)initrd_size);
+-            exit(1);
+-        }
+-
+-        initrd_addr = (initrd_max - initrd_size) & ~4095;
+-
+-        fw_cfg_add_i32(fw_cfg, FW_CFG_INITRD_ADDR, initrd_addr);
+-        fw_cfg_add_i32(fw_cfg, FW_CFG_INITRD_SIZE, initrd_size);
+-        fw_cfg_add_bytes(fw_cfg, FW_CFG_INITRD_DATA, initrd_data, initrd_size);
+-        sev_load_ctx.initrd_data = initrd_data;
+-        sev_load_ctx.initrd_size = initrd_size;
+-
+-        stl_p(header + 0x218, initrd_addr);
+-        stl_p(header + 0x21c, initrd_size);
+-    }
+-
+-    /* load kernel and setup */
+-    setup_size = header[0x1f1];
+-    if (setup_size == 0) {
+-        setup_size = 4;
+-    }
+-    setup_size = (setup_size + 1) * 512;
+-    if (setup_size > kernel_size) {
+-        fprintf(stderr, "qemu: invalid kernel header\n");
+-        exit(1);
+-    }
+-    kernel_size -= setup_size;
+-
+-    setup  = g_malloc(setup_size);
+-    kernel = g_malloc(kernel_size);
+-    fseek(f, 0, SEEK_SET);
+-    if (fread(setup, 1, setup_size, f) != setup_size) {
+-        fprintf(stderr, "fread() failed\n");
+-        exit(1);
+-    }
+-    if (fread(kernel, 1, kernel_size, f) != kernel_size) {
+-        fprintf(stderr, "fread() failed\n");
+-        exit(1);
+-    }
+-    fclose(f);
+-
+-    /* append dtb to kernel */
+-    if (dtb_filename) {
+-        if (protocol < 0x209) {
+-            fprintf(stderr, "qemu: Linux kernel too old to load a dtb\n");
+-            exit(1);
+-        }
+-
+-        dtb_size = get_image_size(dtb_filename);
+-        if (dtb_size <= 0) {
+-            fprintf(stderr, "qemu: error reading dtb %s: %s\n",
+-                    dtb_filename, strerror(errno));
+-            exit(1);
+-        }
+-
+-        setup_data_offset = QEMU_ALIGN_UP(kernel_size, 16);
+-        kernel_size = setup_data_offset + sizeof(struct setup_data) + dtb_size;
+-        kernel = g_realloc(kernel, kernel_size);
+-
+-        stq_p(header + 0x250, prot_addr + setup_data_offset);
+-
+-        setup_data = (struct setup_data *)(kernel + setup_data_offset);
+-        setup_data->next = 0;
+-        setup_data->type = cpu_to_le32(SETUP_DTB);
+-        setup_data->len = cpu_to_le32(dtb_size);
+-
+-        load_image_size(dtb_filename, setup_data->data, dtb_size);
+-    }
+-
+-    /*
+-     * If we're starting an encrypted VM, it will be OVMF based, which uses the
+-     * efi stub for booting and doesn't require any values to be placed in the
+-     * kernel header.  We therefore don't update the header so the hash of the
+-     * kernel on the other side of the fw_cfg interface matches the hash of the
+-     * file the user passed in.
+-     */
+-    if (!sev_enabled()) {
+-        memcpy(setup, header, MIN(sizeof(header), setup_size));
+-    }
+-
+-    fw_cfg_add_i32(fw_cfg, FW_CFG_KERNEL_ADDR, prot_addr);
+-    fw_cfg_add_i32(fw_cfg, FW_CFG_KERNEL_SIZE, kernel_size);
+-    fw_cfg_add_bytes(fw_cfg, FW_CFG_KERNEL_DATA, kernel, kernel_size);
+-    sev_load_ctx.kernel_data = (char *)kernel;
+-    sev_load_ctx.kernel_size = kernel_size;
+-
+-    fw_cfg_add_i32(fw_cfg, FW_CFG_SETUP_ADDR, real_addr);
+-    fw_cfg_add_i32(fw_cfg, FW_CFG_SETUP_SIZE, setup_size);
+-    fw_cfg_add_bytes(fw_cfg, FW_CFG_SETUP_DATA, setup, setup_size);
+-    sev_load_ctx.setup_data = (char *)setup;
+-    sev_load_ctx.setup_size = setup_size;
+-
+-    if (sev_enabled()) {
+-        sev_add_kernel_loader_hashes(&sev_load_ctx, &error_fatal);
+-    }
+-
+-    option_rom[nb_option_roms].bootindex = 0;
+-    option_rom[nb_option_roms].name = "linuxboot.bin";
+-    if (linuxboot_dma_enabled && fw_cfg_dma_enabled(fw_cfg)) {
+-        option_rom[nb_option_roms].name = "linuxboot_dma.bin";
+-    }
+-    nb_option_roms++;
+-}
+-
+-void x86_isa_bios_init(MemoryRegion *isa_bios, MemoryRegion *isa_memory,
+-                       MemoryRegion *bios, bool read_only)
+-{
+-    uint64_t bios_size = memory_region_size(bios);
+-    uint64_t isa_bios_size = MIN(bios_size, 128 * KiB);
+-
+-    memory_region_init_alias(isa_bios, NULL, "isa-bios", bios,
+-                             bios_size - isa_bios_size, isa_bios_size);
+-    memory_region_add_subregion_overlap(isa_memory, 1 * MiB - isa_bios_size,
+-                                        isa_bios, 1);
+-    memory_region_set_readonly(isa_bios, read_only);
+-}
+-
+-void x86_bios_rom_init(X86MachineState *x86ms, const char *default_firmware,
+-                       MemoryRegion *rom_memory, bool isapc_ram_fw)
+-{
+-    const char *bios_name;
+-    char *filename;
+-    int bios_size;
+-    ssize_t ret;
+-
+-    /* BIOS load */
+-    bios_name = MACHINE(x86ms)->firmware ?: default_firmware;
+-    filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, bios_name);
+-    if (filename) {
+-        bios_size = get_image_size(filename);
+-    } else {
+-        bios_size = -1;
+-    }
+-    if (bios_size <= 0 ||
+-        (bios_size % 65536) != 0) {
+-        goto bios_error;
+-    }
+-    memory_region_init_ram(&x86ms->bios, NULL, "pc.bios", bios_size,
+-                           &error_fatal);
+-    if (sev_enabled()) {
+-        /*
+-         * The concept of a "reset" simply doesn't exist for
+-         * confidential computing guests, we have to destroy and
+-         * re-launch them instead.  So there is no need to register
+-         * the firmware as rom to properly re-initialize on reset.
+-         * Just go for a straight file load instead.
+-         */
+-        void *ptr = memory_region_get_ram_ptr(&x86ms->bios);
+-        load_image_size(filename, ptr, bios_size);
+-        x86_firmware_configure(ptr, bios_size);
+-    } else {
+-        memory_region_set_readonly(&x86ms->bios, !isapc_ram_fw);
+-        ret = rom_add_file_fixed(bios_name, (uint32_t)(-bios_size), -1);
+-        if (ret != 0) {
+-            goto bios_error;
+-        }
+-    }
+-    g_free(filename);
+-
+-    /* map the last 128KB of the BIOS in ISA space */
+-    x86_isa_bios_init(&x86ms->isa_bios, rom_memory, &x86ms->bios,
+-                      !isapc_ram_fw);
+-
+-    /* map all the bios at the top of memory */
+-    memory_region_add_subregion(rom_memory,
+-                                (uint32_t)(-bios_size),
+-                                &x86ms->bios);
+-    return;
+-
+-bios_error:
+-    fprintf(stderr, "qemu: could not load PC BIOS '%s'\n", bios_name);
+-    exit(1);
+-}
+-
+ bool x86_machine_is_smm_enabled(const X86MachineState *x86ms)
+ {
+     bool smm_available = false;
+diff --git a/include/hw/i386/x86.h b/include/hw/i386/x86.h
+index c2062db13f..b006f16b8d 100644
+--- a/include/hw/i386/x86.h
++++ b/include/hw/i386/x86.h
+@@ -21,6 +21,7 @@
+ #include "exec/memory.h"
+ 
+ #include "hw/boards.h"
++#include "hw/i386/topology.h"
+ #include "hw/intc/ioapic.h"
+ #include "hw/isa/isa.h"
+ #include "qom/object.h"
+@@ -109,12 +110,11 @@ struct X86MachineState {
+ #define TYPE_X86_MACHINE   MACHINE_TYPE_NAME("x86")
+ OBJECT_DECLARE_TYPE(X86MachineState, X86MachineClass, X86_MACHINE)
+ 
+-uint32_t x86_cpu_apic_id_from_index(X86MachineState *pcms,
++void init_topo_info(X86CPUTopoInfo *topo_info, const X86MachineState *x86ms);
++uint32_t x86_cpu_apic_id_from_index(X86MachineState *x86ms,
+                                     unsigned int cpu_index);
+ 
+-void x86_cpu_new(X86MachineState *pcms, int64_t apic_id, Error **errp);
+ void x86_cpus_init(X86MachineState *pcms, int default_cpu_version);
+-CPUArchId *x86_find_cpu_slot(MachineState *ms, uint32_t id, int *idx);
+ void x86_rtc_set_cpus_count(ISADevice *rtc, uint16_t cpus_count);
+ void x86_cpu_pre_plug(HotplugHandler *hotplug_dev,
+                       DeviceState *dev, Error **errp);
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-hw-i386-x86-Don-t-leak-isa-bios-memory-regions.patch b/SOURCES/kvm-hw-i386-x86-Don-t-leak-isa-bios-memory-regions.patch
new file mode 100644
index 0000000..38fd870
--- /dev/null
+++ b/SOURCES/kvm-hw-i386-x86-Don-t-leak-isa-bios-memory-regions.patch
@@ -0,0 +1,133 @@
+From ebf08d2a822576acfa60fbd5f552d26de1e4c4be Mon Sep 17 00:00:00 2001
+From: Bernhard Beschow <shentey@gmail.com>
+Date: Wed, 8 May 2024 19:55:04 +0200
+Subject: [PATCH 040/100] hw/i386/x86: Don't leak "isa-bios" memory regions
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [40/91] bb595357c6cc2d5a80bf3873853c69553c5feee5 (bonzini/rhel-qemu-kvm)
+
+Fix the leaking in x86_bios_rom_init() and pc_isa_bios_init() by adding an
+"isa_bios" attribute to X86MachineState.
+
+Suggested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Signed-off-by: Bernhard Beschow <shentey@gmail.com>
+Message-ID: <20240508175507.22270-4-shentey@gmail.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+(cherry picked from commit 32d3ee87a17fc91e981a23dba94855bff89f5920)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ hw/i386/pc_sysfw.c    | 7 +++----
+ hw/i386/x86.c         | 9 ++++-----
+ include/hw/i386/x86.h | 7 +++++++
+ 3 files changed, 14 insertions(+), 9 deletions(-)
+
+diff --git a/hw/i386/pc_sysfw.c b/hw/i386/pc_sysfw.c
+index 59c7a81692..82d37cb376 100644
+--- a/hw/i386/pc_sysfw.c
++++ b/hw/i386/pc_sysfw.c
+@@ -40,11 +40,10 @@
+ 
+ #define FLASH_SECTOR_SIZE 4096
+ 
+-static void pc_isa_bios_init(MemoryRegion *rom_memory,
++static void pc_isa_bios_init(MemoryRegion *isa_bios, MemoryRegion *rom_memory,
+                              MemoryRegion *flash_mem)
+ {
+     int isa_bios_size;
+-    MemoryRegion *isa_bios;
+     uint64_t flash_size;
+     void *flash_ptr, *isa_bios_ptr;
+ 
+@@ -52,7 +51,6 @@ static void pc_isa_bios_init(MemoryRegion *rom_memory,
+ 
+     /* map the last 128KB of the BIOS in ISA space */
+     isa_bios_size = MIN(flash_size, 128 * KiB);
+-    isa_bios = g_malloc(sizeof(*isa_bios));
+     memory_region_init_ram(isa_bios, NULL, "isa-bios", isa_bios_size,
+                            &error_fatal);
+     memory_region_add_subregion_overlap(rom_memory,
+@@ -136,6 +134,7 @@ void pc_system_flash_cleanup_unused(PCMachineState *pcms)
+ static void pc_system_flash_map(PCMachineState *pcms,
+                                 MemoryRegion *rom_memory)
+ {
++    X86MachineState *x86ms = X86_MACHINE(pcms);
+     hwaddr total_size = 0;
+     int i;
+     BlockBackend *blk;
+@@ -185,7 +184,7 @@ static void pc_system_flash_map(PCMachineState *pcms,
+ 
+         if (i == 0) {
+             flash_mem = pflash_cfi01_get_memory(system_flash);
+-            pc_isa_bios_init(rom_memory, flash_mem);
++            pc_isa_bios_init(&x86ms->isa_bios, rom_memory, flash_mem);
+ 
+             /* Encrypt the pflash boot ROM */
+             if (sev_enabled()) {
+diff --git a/hw/i386/x86.c b/hw/i386/x86.c
+index 6d3c72f124..457e8a34a5 100644
+--- a/hw/i386/x86.c
++++ b/hw/i386/x86.c
+@@ -1133,7 +1133,7 @@ void x86_bios_rom_init(X86MachineState *x86ms, const char *default_firmware,
+ {
+     const char *bios_name;
+     char *filename;
+-    MemoryRegion *bios, *isa_bios;
++    MemoryRegion *bios;
+     int bios_size, isa_bios_size;
+     ssize_t ret;
+ 
+@@ -1173,14 +1173,13 @@ void x86_bios_rom_init(X86MachineState *x86ms, const char *default_firmware,
+ 
+     /* map the last 128KB of the BIOS in ISA space */
+     isa_bios_size = MIN(bios_size, 128 * KiB);
+-    isa_bios = g_malloc(sizeof(*isa_bios));
+-    memory_region_init_alias(isa_bios, NULL, "isa-bios", bios,
++    memory_region_init_alias(&x86ms->isa_bios, NULL, "isa-bios", bios,
+                              bios_size - isa_bios_size, isa_bios_size);
+     memory_region_add_subregion_overlap(rom_memory,
+                                         0x100000 - isa_bios_size,
+-                                        isa_bios,
++                                        &x86ms->isa_bios,
+                                         1);
+-    memory_region_set_readonly(isa_bios, !isapc_ram_fw);
++    memory_region_set_readonly(&x86ms->isa_bios, !isapc_ram_fw);
+ 
+     /* map all the bios at the top of memory */
+     memory_region_add_subregion(rom_memory,
+diff --git a/include/hw/i386/x86.h b/include/hw/i386/x86.h
+index cb07618d19..a07de79167 100644
+--- a/include/hw/i386/x86.h
++++ b/include/hw/i386/x86.h
+@@ -18,6 +18,7 @@
+ #define HW_I386_X86_H
+ 
+ #include "exec/hwaddr.h"
++#include "exec/memory.h"
+ 
+ #include "hw/boards.h"
+ #include "hw/intc/ioapic.h"
+@@ -52,6 +53,12 @@ struct X86MachineState {
+     GMappedFile *initrd_mapped_file;
+     HotplugHandler *acpi_dev;
+ 
++    /*
++     * Map the upper 128 KiB of the BIOS just underneath the 1 MiB address
++     * boundary.
++     */
++    MemoryRegion isa_bios;
++
+     /* RAM information (sizes, addresses, configuration): */
+     ram_addr_t below_4g_mem_size, above_4g_mem_size;
+ 
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-hw-i386-x86-Don-t-leak-pc.bios-memory-region.patch b/SOURCES/kvm-hw-i386-x86-Don-t-leak-pc.bios-memory-region.patch
new file mode 100644
index 0000000..7a61f95
--- /dev/null
+++ b/SOURCES/kvm-hw-i386-x86-Don-t-leak-pc.bios-memory-region.patch
@@ -0,0 +1,105 @@
+From e1f2265b5f6bf5b63bf3808bb540888f3cf8badb Mon Sep 17 00:00:00 2001
+From: Bernhard Beschow <shentey@gmail.com>
+Date: Wed, 8 May 2024 19:55:05 +0200
+Subject: [PATCH 041/100] hw/i386/x86: Don't leak "pc.bios" memory region
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [41/91] a9cd61d8d240134c09c46e244efb89217cadf60c (bonzini/rhel-qemu-kvm)
+
+Fix the leaking in x86_bios_rom_init() by adding a "bios" attribute to
+X86MachineState. Note that it is only used in the -bios case.
+
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Signed-off-by: Bernhard Beschow <shentey@gmail.com>
+Message-ID: <20240508175507.22270-5-shentey@gmail.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+(cherry picked from commit 865d95321ffc8d9941e33000b10140550f094556)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ hw/i386/x86.c         | 13 ++++++-------
+ include/hw/i386/x86.h |  6 ++++++
+ 2 files changed, 12 insertions(+), 7 deletions(-)
+
+diff --git a/hw/i386/x86.c b/hw/i386/x86.c
+index 457e8a34a5..29167de97d 100644
+--- a/hw/i386/x86.c
++++ b/hw/i386/x86.c
+@@ -1133,7 +1133,6 @@ void x86_bios_rom_init(X86MachineState *x86ms, const char *default_firmware,
+ {
+     const char *bios_name;
+     char *filename;
+-    MemoryRegion *bios;
+     int bios_size, isa_bios_size;
+     ssize_t ret;
+ 
+@@ -1149,8 +1148,8 @@ void x86_bios_rom_init(X86MachineState *x86ms, const char *default_firmware,
+         (bios_size % 65536) != 0) {
+         goto bios_error;
+     }
+-    bios = g_malloc(sizeof(*bios));
+-    memory_region_init_ram(bios, NULL, "pc.bios", bios_size, &error_fatal);
++    memory_region_init_ram(&x86ms->bios, NULL, "pc.bios", bios_size,
++                           &error_fatal);
+     if (sev_enabled()) {
+         /*
+          * The concept of a "reset" simply doesn't exist for
+@@ -1159,11 +1158,11 @@ void x86_bios_rom_init(X86MachineState *x86ms, const char *default_firmware,
+          * the firmware as rom to properly re-initialize on reset.
+          * Just go for a straight file load instead.
+          */
+-        void *ptr = memory_region_get_ram_ptr(bios);
++        void *ptr = memory_region_get_ram_ptr(&x86ms->bios);
+         load_image_size(filename, ptr, bios_size);
+         x86_firmware_configure(ptr, bios_size);
+     } else {
+-        memory_region_set_readonly(bios, !isapc_ram_fw);
++        memory_region_set_readonly(&x86ms->bios, !isapc_ram_fw);
+         ret = rom_add_file_fixed(bios_name, (uint32_t)(-bios_size), -1);
+         if (ret != 0) {
+             goto bios_error;
+@@ -1173,7 +1172,7 @@ void x86_bios_rom_init(X86MachineState *x86ms, const char *default_firmware,
+ 
+     /* map the last 128KB of the BIOS in ISA space */
+     isa_bios_size = MIN(bios_size, 128 * KiB);
+-    memory_region_init_alias(&x86ms->isa_bios, NULL, "isa-bios", bios,
++    memory_region_init_alias(&x86ms->isa_bios, NULL, "isa-bios", &x86ms->bios,
+                              bios_size - isa_bios_size, isa_bios_size);
+     memory_region_add_subregion_overlap(rom_memory,
+                                         0x100000 - isa_bios_size,
+@@ -1184,7 +1183,7 @@ void x86_bios_rom_init(X86MachineState *x86ms, const char *default_firmware,
+     /* map all the bios at the top of memory */
+     memory_region_add_subregion(rom_memory,
+                                 (uint32_t)(-bios_size),
+-                                bios);
++                                &x86ms->bios);
+     return;
+ 
+ bios_error:
+diff --git a/include/hw/i386/x86.h b/include/hw/i386/x86.h
+index a07de79167..55c6809ae0 100644
+--- a/include/hw/i386/x86.h
++++ b/include/hw/i386/x86.h
+@@ -53,6 +53,12 @@ struct X86MachineState {
+     GMappedFile *initrd_mapped_file;
+     HotplugHandler *acpi_dev;
+ 
++    /*
++     * Map the whole BIOS just underneath the 4 GiB address boundary. Only used
++     * in the ROM (-bios) case.
++     */
++    MemoryRegion bios;
++
+     /*
+      * Map the upper 128 KiB of the BIOS just underneath the 1 MiB address
+      * boundary.
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-hw-i386-x86-Eliminate-two-if-statements-in-x86_bios_.patch b/SOURCES/kvm-hw-i386-x86-Eliminate-two-if-statements-in-x86_bios_.patch
new file mode 100644
index 0000000..b9c18e7
--- /dev/null
+++ b/SOURCES/kvm-hw-i386-x86-Eliminate-two-if-statements-in-x86_bios_.patch
@@ -0,0 +1,69 @@
+From b9d0c78f04160fbc1eee6cfd94b17f1133a35d83 Mon Sep 17 00:00:00 2001
+From: Bernhard Beschow <shentey@gmail.com>
+Date: Tue, 30 Apr 2024 17:06:38 +0200
+Subject: [PATCH 037/100] hw/i386/x86: Eliminate two if statements in
+ x86_bios_rom_init()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [37/91] 1ef6a13214e85f6ef773f5c894c720f20330912b (bonzini/rhel-qemu-kvm)
+
+Given that memory_region_set_readonly() is a no-op when the readonlyness is
+already as requested it is possible to simplify the pattern
+
+  if (condition) {
+    foo(true);
+  }
+
+to
+
+  foo(condition);
+
+which is shorter and allows to see the invariant of the code more easily.
+
+Signed-off-by: Bernhard Beschow <shentey@gmail.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Message-ID: <20240430150643.111976-2-shentey@gmail.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+(cherry picked from commit 014dbdac8798799d081abc9dff3e4876ca54f49e)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ hw/i386/x86.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/hw/i386/x86.c b/hw/i386/x86.c
+index 3d5b51e92d..2a4f3ee285 100644
+--- a/hw/i386/x86.c
++++ b/hw/i386/x86.c
+@@ -1163,9 +1163,7 @@ void x86_bios_rom_init(MachineState *ms, const char *default_firmware,
+         load_image_size(filename, ptr, bios_size);
+         x86_firmware_configure(ptr, bios_size);
+     } else {
+-        if (!isapc_ram_fw) {
+-            memory_region_set_readonly(bios, true);
+-        }
++        memory_region_set_readonly(bios, !isapc_ram_fw);
+         ret = rom_add_file_fixed(bios_name, (uint32_t)(-bios_size), -1);
+         if (ret != 0) {
+             goto bios_error;
+@@ -1182,9 +1180,7 @@ void x86_bios_rom_init(MachineState *ms, const char *default_firmware,
+                                         0x100000 - isa_bios_size,
+                                         isa_bios,
+                                         1);
+-    if (!isapc_ram_fw) {
+-        memory_region_set_readonly(isa_bios, true);
+-    }
++    memory_region_set_readonly(isa_bios, !isapc_ram_fw);
+ 
+     /* map all the bios at the top of memory */
+     memory_region_add_subregion(rom_memory,
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-hw-i386-x86-Extract-x86_isa_bios_init-from-x86_bios_.patch b/SOURCES/kvm-hw-i386-x86-Extract-x86_isa_bios_init-from-x86_bios_.patch
new file mode 100644
index 0000000..6ce9c72
--- /dev/null
+++ b/SOURCES/kvm-hw-i386-x86-Extract-x86_isa_bios_init-from-x86_bios_.patch
@@ -0,0 +1,98 @@
+From 1baf67564d4227d6ba98923217a15814c438c32b Mon Sep 17 00:00:00 2001
+From: Bernhard Beschow <shentey@gmail.com>
+Date: Wed, 8 May 2024 19:55:06 +0200
+Subject: [PATCH 042/100] hw/i386/x86: Extract x86_isa_bios_init() from
+ x86_bios_rom_init()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [42/91] 1db417a5995480924f7fd0661a306f2d2bfa0a77 (bonzini/rhel-qemu-kvm)
+
+The function is inspired by pc_isa_bios_init() and should eventually replace it.
+Using x86_isa_bios_init() rather than pc_isa_bios_init() fixes pflash commands
+to work in the isa-bios region.
+
+While at it convert the magic number 0x100000 (== 1MiB) to increase readability.
+
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Signed-off-by: Bernhard Beschow <shentey@gmail.com>
+Message-ID: <20240508175507.22270-6-shentey@gmail.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+(cherry picked from commit 5c5ffec12c30d2017cbdee6798f54d8fad3f9656)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ hw/i386/x86.c         | 25 ++++++++++++++++---------
+ include/hw/i386/x86.h |  2 ++
+ 2 files changed, 18 insertions(+), 9 deletions(-)
+
+diff --git a/hw/i386/x86.c b/hw/i386/x86.c
+index 29167de97d..c61f4ebfa6 100644
+--- a/hw/i386/x86.c
++++ b/hw/i386/x86.c
+@@ -1128,12 +1128,25 @@ void x86_load_linux(X86MachineState *x86ms,
+     nb_option_roms++;
+ }
+ 
++void x86_isa_bios_init(MemoryRegion *isa_bios, MemoryRegion *isa_memory,
++                       MemoryRegion *bios, bool read_only)
++{
++    uint64_t bios_size = memory_region_size(bios);
++    uint64_t isa_bios_size = MIN(bios_size, 128 * KiB);
++
++    memory_region_init_alias(isa_bios, NULL, "isa-bios", bios,
++                             bios_size - isa_bios_size, isa_bios_size);
++    memory_region_add_subregion_overlap(isa_memory, 1 * MiB - isa_bios_size,
++                                        isa_bios, 1);
++    memory_region_set_readonly(isa_bios, read_only);
++}
++
+ void x86_bios_rom_init(X86MachineState *x86ms, const char *default_firmware,
+                        MemoryRegion *rom_memory, bool isapc_ram_fw)
+ {
+     const char *bios_name;
+     char *filename;
+-    int bios_size, isa_bios_size;
++    int bios_size;
+     ssize_t ret;
+ 
+     /* BIOS load */
+@@ -1171,14 +1184,8 @@ void x86_bios_rom_init(X86MachineState *x86ms, const char *default_firmware,
+     g_free(filename);
+ 
+     /* map the last 128KB of the BIOS in ISA space */
+-    isa_bios_size = MIN(bios_size, 128 * KiB);
+-    memory_region_init_alias(&x86ms->isa_bios, NULL, "isa-bios", &x86ms->bios,
+-                             bios_size - isa_bios_size, isa_bios_size);
+-    memory_region_add_subregion_overlap(rom_memory,
+-                                        0x100000 - isa_bios_size,
+-                                        &x86ms->isa_bios,
+-                                        1);
+-    memory_region_set_readonly(&x86ms->isa_bios, !isapc_ram_fw);
++    x86_isa_bios_init(&x86ms->isa_bios, rom_memory, &x86ms->bios,
++                      !isapc_ram_fw);
+ 
+     /* map all the bios at the top of memory */
+     memory_region_add_subregion(rom_memory,
+diff --git a/include/hw/i386/x86.h b/include/hw/i386/x86.h
+index 55c6809ae0..d7b7d3f3ce 100644
+--- a/include/hw/i386/x86.h
++++ b/include/hw/i386/x86.h
+@@ -129,6 +129,8 @@ void x86_cpu_unplug_request_cb(HotplugHandler *hotplug_dev,
+ void x86_cpu_unplug_cb(HotplugHandler *hotplug_dev,
+                        DeviceState *dev, Error **errp);
+ 
++void x86_isa_bios_init(MemoryRegion *isa_bios, MemoryRegion *isa_memory,
++                       MemoryRegion *bios, bool read_only);
+ void x86_bios_rom_init(X86MachineState *x86ms, const char *default_firmware,
+                        MemoryRegion *rom_memory, bool isapc_ram_fw);
+ 
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-hw-ppc-Kconfig-Imply-VFIO_PCI.patch b/SOURCES/kvm-hw-ppc-Kconfig-Imply-VFIO_PCI.patch
deleted file mode 100644
index f850765..0000000
--- a/SOURCES/kvm-hw-ppc-Kconfig-Imply-VFIO_PCI.patch
+++ /dev/null
@@ -1,116 +0,0 @@
-From 84f378c41832602dcf9bad6167b1f532c7c53e37 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
-Date: Tue, 21 Nov 2023 15:03:55 +0100
-Subject: [PATCH 048/101] hw/ppc/Kconfig: Imply VFIO_PCI
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [47/67] c1a40cdab9bf62b16cb428d57a20b3e0eaa6de38 (eauger1/centos-qemu-kvm)
-
-When the legacy and iommufd backends were introduced, a set of common
-vfio-pci routines were exported in pci.c for both backends to use :
-
-  vfio_pci_pre_reset
-  vfio_pci_get_pci_hot_reset_info
-  vfio_pci_host_match
-  vfio_pci_post_reset
-
-This introduced a build failure on PPC when --without-default-devices
-is use because VFIO is always selected in ppc/Kconfig but VFIO_PCI is
-not.
-
-Use an 'imply VFIO_PCI' in ppc/Kconfig and bypass compilation of the
-VFIO EEH hooks routines defined in hw/ppc/spapr_pci_vfio.c with
-CONFIG_VFIO_PCI.
-
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 4278df9d1d2383b738338c857406357660f11e42)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/ppc/Kconfig          |  2 +-
- hw/ppc/spapr_pci_vfio.c | 36 ++++++++++++++++++++++++++++++++++++
- 2 files changed, 37 insertions(+), 1 deletion(-)
-
-diff --git a/hw/ppc/Kconfig b/hw/ppc/Kconfig
-index 56f0475a8e..44263a58c4 100644
---- a/hw/ppc/Kconfig
-+++ b/hw/ppc/Kconfig
-@@ -3,11 +3,11 @@ config PSERIES
-     imply PCI_DEVICES
-     imply TEST_DEVICES
-     imply VIRTIO_VGA
-+    imply VFIO_PCI if LINUX   # needed by spapr_pci_vfio.c
-     select NVDIMM
-     select DIMM
-     select PCI
-     select SPAPR_VSCSI
--    select VFIO if LINUX   # needed by spapr_pci_vfio.c
-     select XICS
-     select XIVE
-     select MSI_NONBROKEN
-diff --git a/hw/ppc/spapr_pci_vfio.c b/hw/ppc/spapr_pci_vfio.c
-index d1d07bec46..76b2a3487b 100644
---- a/hw/ppc/spapr_pci_vfio.c
-+++ b/hw/ppc/spapr_pci_vfio.c
-@@ -26,10 +26,12 @@
- #include "hw/pci/pci_device.h"
- #include "hw/vfio/vfio-common.h"
- #include "qemu/error-report.h"
-+#include CONFIG_DEVICES /* CONFIG_VFIO_PCI */
- 
- /*
-  * Interfaces for IBM EEH (Enhanced Error Handling)
-  */
-+#ifdef CONFIG_VFIO_PCI
- static bool vfio_eeh_container_ok(VFIOContainer *container)
- {
-     /*
-@@ -314,3 +316,37 @@ int spapr_phb_vfio_eeh_configure(SpaprPhbState *sphb)
- 
-     return RTAS_OUT_SUCCESS;
- }
-+
-+#else
-+
-+bool spapr_phb_eeh_available(SpaprPhbState *sphb)
-+{
-+    return false;
-+}
-+
-+void spapr_phb_vfio_reset(DeviceState *qdev)
-+{
-+}
-+
-+int spapr_phb_vfio_eeh_set_option(SpaprPhbState *sphb,
-+                                  unsigned int addr, int option)
-+{
-+    return RTAS_OUT_NOT_SUPPORTED;
-+}
-+
-+int spapr_phb_vfio_eeh_get_state(SpaprPhbState *sphb, int *state)
-+{
-+    return RTAS_OUT_NOT_SUPPORTED;
-+}
-+
-+int spapr_phb_vfio_eeh_reset(SpaprPhbState *sphb, int option)
-+{
-+    return RTAS_OUT_NOT_SUPPORTED;
-+}
-+
-+int spapr_phb_vfio_eeh_configure(SpaprPhbState *sphb)
-+{
-+    return RTAS_OUT_NOT_SUPPORTED;
-+}
-+
-+#endif /* CONFIG_VFIO_PCI */
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-hw-vfio-fix-iteration-over-global-VFIODevice-list.patch b/SOURCES/kvm-hw-vfio-fix-iteration-over-global-VFIODevice-list.patch
deleted file mode 100644
index 2c7f6ff..0000000
--- a/SOURCES/kvm-hw-vfio-fix-iteration-over-global-VFIODevice-list.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-From 8f27893a37e55a31180bb66cd9eae7199911881b Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Volker=20R=C3=BCmelin?= <vr_qemu@t-online.de>
-Date: Fri, 29 Dec 2023 21:38:54 +0100
-Subject: [PATCH 060/101] hw/vfio: fix iteration over global VFIODevice list
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [59/67] f926e1233c8c5ad418e8794b1a103371c9dc5eb0 (eauger1/centos-qemu-kvm)
-
-Commit 3d779abafe ("vfio/common: Introduce a global VFIODevice list")
-introduced a global VFIODevice list, but forgot to update the list
-element field name when iterating over the new list. Change the code
-to use the correct list element field.
-
-Fixes: 3d779abafe ("vfio/common: Introduce a global VFIODevice list")
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2061
-Signed-off-by: Volker Rümelin <vr_qemu@t-online.de>
-Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
-(cherry picked from commit 9353b6da430f90e47f352dbf6dc31120c8914da6)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/common.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/hw/vfio/common.c b/hw/vfio/common.c
-index 0d4d8b8416..0b3352f2a9 100644
---- a/hw/vfio/common.c
-+++ b/hw/vfio/common.c
-@@ -73,7 +73,7 @@ bool vfio_mig_active(void)
-         return false;
-     }
- 
--    QLIST_FOREACH(vbasedev, &vfio_device_list, next) {
-+    QLIST_FOREACH(vbasedev, &vfio_device_list, global_next) {
-         if (vbasedev->migration_blocker) {
-             return false;
-         }
-@@ -94,7 +94,7 @@ static bool vfio_multiple_devices_migration_is_supported(void)
-     unsigned int device_num = 0;
-     bool all_support_p2p = true;
- 
--    QLIST_FOREACH(vbasedev, &vfio_device_list, next) {
-+    QLIST_FOREACH(vbasedev, &vfio_device_list, global_next) {
-         if (vbasedev->migration) {
-             device_num++;
- 
-@@ -1366,13 +1366,13 @@ void vfio_reset_handler(void *opaque)
- {
-     VFIODevice *vbasedev;
- 
--    QLIST_FOREACH(vbasedev, &vfio_device_list, next) {
-+    QLIST_FOREACH(vbasedev, &vfio_device_list, global_next) {
-         if (vbasedev->dev->realized) {
-             vbasedev->ops->vfio_compute_needs_reset(vbasedev);
-         }
-     }
- 
--    QLIST_FOREACH(vbasedev, &vfio_device_list, next) {
-+    QLIST_FOREACH(vbasedev, &vfio_device_list, global_next) {
-         if (vbasedev->dev->realized && vbasedev->needs_reset) {
-             vbasedev->ops->vfio_hot_reset_multi(vbasedev);
-         }
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-hw-virtio-Fix-the-de-initialization-of-vhost-user-de.patch b/SOURCES/kvm-hw-virtio-Fix-the-de-initialization-of-vhost-user-de.patch
new file mode 100644
index 0000000..7b2e1b6
--- /dev/null
+++ b/SOURCES/kvm-hw-virtio-Fix-the-de-initialization-of-vhost-user-de.patch
@@ -0,0 +1,108 @@
+From c554f8768a18ceba173aedbd582c1cae43a41e2c Mon Sep 17 00:00:00 2001
+From: Thomas Huth <thuth@redhat.com>
+Date: Tue, 18 Jun 2024 14:19:58 +0200
+Subject: [PATCH 1/2] hw/virtio: Fix the de-initialization of vhost-user
+ devices
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Thomas Huth <thuth@redhat.com>
+RH-MergeRequest: 255: hw/virtio: Fix the de-initialization of vhost-user devices
+RH-Jira: RHEL-40708
+RH-Acked-by: Cédric Le Goater <clg@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [1/1] c7815a249ec135993f45934cab1c1f2c038b80ea (thuth/qemu-kvm-cs9)
+
+JIRA: https://issues.redhat.com/browse/RHEL-40708
+
+The unrealize functions of the various vhost-user devices are
+calling the corresponding vhost_*_set_status() functions with a
+status of 0 to shut down the device correctly.
+
+Now these vhost_*_set_status() functions all follow this scheme:
+
+    bool should_start = virtio_device_should_start(vdev, status);
+
+    if (vhost_dev_is_started(&vvc->vhost_dev) == should_start) {
+        return;
+    }
+
+    if (should_start) {
+        /* ... do the initialization stuff ... */
+    } else {
+        /* ... do the cleanup stuff ... */
+    }
+
+The problem here is virtio_device_should_start(vdev, 0) currently
+always returns "true" since it internally only looks at vdev->started
+instead of looking at the "status" parameter. Thus once the device
+got started once, virtio_device_should_start() always returns true
+and thus the vhost_*_set_status() functions return early, without
+ever doing any clean-up when being called with status == 0. This
+causes e.g. problems when trying to hot-plug and hot-unplug a vhost
+user devices multiple times since the de-initialization step is
+completely skipped during the unplug operation.
+
+This bug has been introduced in commit 9f6bcfd99f ("hw/virtio: move
+vm_running check to virtio_device_started") which replaced
+
+ should_start = status & VIRTIO_CONFIG_S_DRIVER_OK;
+
+with
+
+ should_start = virtio_device_started(vdev, status);
+
+which later got replaced by virtio_device_should_start(). This blocked
+the possibility to set should_start to false in case the status flag
+VIRTIO_CONFIG_S_DRIVER_OK was not set.
+
+Fix it by adjusting the virtio_device_should_start() function to
+only consider the status flag instead of vdev->started. Since this
+function is only used in the various vhost_*_set_status() functions
+for exactly the same purpose, it should be fine to fix it in this
+central place there without any risk to change the behavior of other
+code.
+
+Fixes: 9f6bcfd99f ("hw/virtio: move vm_running check to virtio_device_started")
+Buglink: https://issues.redhat.com/browse/RHEL-40708
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+Message-Id: <20240618121958.88673-1-thuth@redhat.com>
+Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+(cherry picked from commit d72479b11797c28893e1e3fc565497a9cae5ca16)
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+---
+ include/hw/virtio/virtio.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/include/hw/virtio/virtio.h b/include/hw/virtio/virtio.h
+index 7d5ffdc145..2eafad17b8 100644
+--- a/include/hw/virtio/virtio.h
++++ b/include/hw/virtio/virtio.h
+@@ -470,9 +470,9 @@ static inline bool virtio_device_started(VirtIODevice *vdev, uint8_t status)
+  * @vdev - the VirtIO device
+  * @status - the devices status bits
+  *
+- * This is similar to virtio_device_started() but also encapsulates a
+- * check on the VM status which would prevent a device starting
+- * anyway.
++ * This is similar to virtio_device_started() but ignores vdev->started
++ * and also encapsulates a check on the VM status which would prevent a
++ * device from starting anyway.
+  */
+ static inline bool virtio_device_should_start(VirtIODevice *vdev, uint8_t status)
+ {
+@@ -480,7 +480,7 @@ static inline bool virtio_device_should_start(VirtIODevice *vdev, uint8_t status
+         return false;
+     }
+ 
+-    return virtio_device_started(vdev, status);
++    return status & VIRTIO_CONFIG_S_DRIVER_OK;
+ }
+ 
+ static inline void virtio_set_started(VirtIODevice *vdev, bool started)
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-i386-correctly-select-code-in-hw-i386-that-depends-o.patch b/SOURCES/kvm-i386-correctly-select-code-in-hw-i386-that-depends-o.patch
new file mode 100644
index 0000000..8f69f9e
--- /dev/null
+++ b/SOURCES/kvm-i386-correctly-select-code-in-hw-i386-that-depends-o.patch
@@ -0,0 +1,68 @@
+From f572a40924c7138072e387111d0f092185972477 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Thu, 9 May 2024 19:00:39 +0200
+Subject: [PATCH 044/100] i386: correctly select code in hw/i386 that depends
+ on other components
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [44/91] 1327a5eb2b91edacf56cc4e93255cad456abbbeb (bonzini/rhel-qemu-kvm)
+
+fw_cfg.c and vapic.c are currently included unconditionally but
+depend on other components.  vapic.c depends on the local APIC,
+while fw_cfg.c includes a piece of AML builder code that depends
+on CONFIG_ACPI.
+
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
+Message-ID: <20240509170044.190795-9-pbonzini@redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 7974e51342775c87f6e759a8c525db1045ddfa24)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ hw/i386/fw_cfg.c    | 2 ++
+ hw/i386/meson.build | 2 +-
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/hw/i386/fw_cfg.c b/hw/i386/fw_cfg.c
+index 283c3f4c16..7f97d40616 100644
+--- a/hw/i386/fw_cfg.c
++++ b/hw/i386/fw_cfg.c
+@@ -204,6 +204,7 @@ void fw_cfg_build_feature_control(MachineState *ms, FWCfgState *fw_cfg)
+     fw_cfg_add_file(fw_cfg, "etc/msr_feature_control", val, sizeof(*val));
+ }
+ 
++#ifdef CONFIG_ACPI
+ void fw_cfg_add_acpi_dsdt(Aml *scope, FWCfgState *fw_cfg)
+ {
+     /*
+@@ -230,3 +231,4 @@ void fw_cfg_add_acpi_dsdt(Aml *scope, FWCfgState *fw_cfg)
+     aml_append(dev, aml_name_decl("_CRS", crs));
+     aml_append(scope, dev);
+ }
++#endif
+diff --git a/hw/i386/meson.build b/hw/i386/meson.build
+index d8b70ef3e9..d9da676038 100644
+--- a/hw/i386/meson.build
++++ b/hw/i386/meson.build
+@@ -1,12 +1,12 @@
+ i386_ss = ss.source_set()
+ i386_ss.add(files(
+   'fw_cfg.c',
+-  'vapic.c',
+   'e820_memory_layout.c',
+   'multiboot.c',
+   'x86.c',
+ ))
+ 
++i386_ss.add(when: 'CONFIG_APIC', if_true: files('vapic.c'))
+ i386_ss.add(when: 'CONFIG_X86_IOMMU', if_true: files('x86-iommu.c'),
+                                       if_false: files('x86-iommu-stub.c'))
+ i386_ss.add(when: 'CONFIG_AMD_IOMMU', if_true: files('amd_iommu.c'),
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-i386-cpu-Set-SEV-SNP-CPUID-bit-when-SNP-enabled.patch b/SOURCES/kvm-i386-cpu-Set-SEV-SNP-CPUID-bit-when-SNP-enabled.patch
new file mode 100644
index 0000000..31a7e92
--- /dev/null
+++ b/SOURCES/kvm-i386-cpu-Set-SEV-SNP-CPUID-bit-when-SNP-enabled.patch
@@ -0,0 +1,40 @@
+From 127f3c60668e1bd08ec00856a317cb841adf0440 Mon Sep 17 00:00:00 2001
+From: Michael Roth <michael.roth@amd.com>
+Date: Thu, 30 May 2024 06:16:23 -0500
+Subject: [PATCH 063/100] i386/cpu: Set SEV-SNP CPUID bit when SNP enabled
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [63/91] 0f834a6897c5cdc0e29a5b1862e621f8ce309657 (bonzini/rhel-qemu-kvm)
+
+SNP guests will rely on this bit to determine certain feature support.
+
+Signed-off-by: Michael Roth <michael.roth@amd.com>
+Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com>
+Message-ID: <20240530111643.1091816-12-pankaj.gupta@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 7831221941cccbde922412c1550ed8b4bce7c361)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ target/i386/cpu.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/target/i386/cpu.c b/target/i386/cpu.c
+index 489c853b42..13737cd703 100644
+--- a/target/i386/cpu.c
++++ b/target/i386/cpu.c
+@@ -6822,6 +6822,7 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
+         if (sev_enabled()) {
+             *eax = 0x2;
+             *eax |= sev_es_enabled() ? 0x8 : 0;
++            *eax |= sev_snp_enabled() ? 0x10 : 0;
+             *ebx = sev_get_cbit_position() & 0x3f; /* EBX[5:0] */
+             *ebx |= (sev_get_reduced_phys_bits() & 0x3f) << 6; /* EBX[11:6] */
+         }
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-i386-kvm-Add-KVM_EXIT_HYPERCALL-handling-for-KVM_HC_.patch b/SOURCES/kvm-i386-kvm-Add-KVM_EXIT_HYPERCALL-handling-for-KVM_HC_.patch
new file mode 100644
index 0000000..fd604d2
--- /dev/null
+++ b/SOURCES/kvm-i386-kvm-Add-KVM_EXIT_HYPERCALL-handling-for-KVM_HC_.patch
@@ -0,0 +1,145 @@
+From 14aa42bbacde75b2ce9a59d1267f73d613026461 Mon Sep 17 00:00:00 2001
+From: Michael Roth <michael.roth@amd.com>
+Date: Thu, 30 May 2024 06:16:42 -0500
+Subject: [PATCH 076/100] i386/kvm: Add KVM_EXIT_HYPERCALL handling for
+ KVM_HC_MAP_GPA_RANGE
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [76/91] 3e1201c330dc826af1ec4650974d47053270eb16 (bonzini/rhel-qemu-kvm)
+
+KVM_HC_MAP_GPA_RANGE will be used to send requests to userspace for
+private/shared memory attribute updates requested by the guest.
+Implement handling for that use-case along with some basic
+infrastructure for enabling specific hypercall events.
+
+Signed-off-by: Michael Roth <michael.roth@amd.com>
+Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com>
+Message-ID: <20240530111643.1091816-31-pankaj.gupta@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 47e76d03b155e43beca550251a6eb7ea926c059f)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ target/i386/kvm/kvm.c        | 55 ++++++++++++++++++++++++++++++++++++
+ target/i386/kvm/kvm_i386.h   |  1 +
+ target/i386/kvm/trace-events |  1 +
+ 3 files changed, 57 insertions(+)
+
+diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
+index 75e75d9772..2935e3931a 100644
+--- a/target/i386/kvm/kvm.c
++++ b/target/i386/kvm/kvm.c
+@@ -21,6 +21,7 @@
+ #include <sys/syscall.h>
+ 
+ #include <linux/kvm.h>
++#include <linux/kvm_para.h>
+ #include "standard-headers/asm-x86/kvm_para.h"
+ #include "hw/xen/interface/arch-x86/cpuid.h"
+ 
+@@ -208,6 +209,13 @@ int kvm_get_vm_type(MachineState *ms)
+     return kvm_type;
+ }
+ 
++bool kvm_enable_hypercall(uint64_t enable_mask)
++{
++    KVMState *s = KVM_STATE(current_accel());
++
++    return !kvm_vm_enable_cap(s, KVM_CAP_EXIT_HYPERCALL, 0, enable_mask);
++}
++
+ bool kvm_has_smm(void)
+ {
+     return kvm_vm_check_extension(kvm_state, KVM_CAP_X86_SMM);
+@@ -5325,6 +5333,50 @@ static bool host_supports_vmx(void)
+     return ecx & CPUID_EXT_VMX;
+ }
+ 
++/*
++ * Currently the handling here only supports use of KVM_HC_MAP_GPA_RANGE
++ * to service guest-initiated memory attribute update requests so that
++ * KVM_SET_MEMORY_ATTRIBUTES can update whether or not a page should be
++ * backed by the private memory pool provided by guest_memfd, and as such
++ * is only applicable to guest_memfd-backed guests (e.g. SNP/TDX).
++ *
++ * Other other use-cases for KVM_HC_MAP_GPA_RANGE, such as for SEV live
++ * migration, are not implemented here currently.
++ *
++ * For the guest_memfd use-case, these exits will generally be synthesized
++ * by KVM based on platform-specific hypercalls, like GHCB requests in the
++ * case of SEV-SNP, and not issued directly within the guest though the
++ * KVM_HC_MAP_GPA_RANGE hypercall. So in this case, KVM_HC_MAP_GPA_RANGE is
++ * not actually advertised to guests via the KVM CPUID feature bit, as
++ * opposed to SEV live migration where it would be. Since it is unlikely the
++ * SEV live migration use-case would be useful for guest-memfd backed guests,
++ * because private/shared page tracking is already provided through other
++ * means, these 2 use-cases should be treated as being mutually-exclusive.
++ */
++static int kvm_handle_hc_map_gpa_range(struct kvm_run *run)
++{
++    uint64_t gpa, size, attributes;
++
++    if (!machine_require_guest_memfd(current_machine))
++        return -EINVAL;
++
++    gpa = run->hypercall.args[0];
++    size = run->hypercall.args[1] * TARGET_PAGE_SIZE;
++    attributes = run->hypercall.args[2];
++
++    trace_kvm_hc_map_gpa_range(gpa, size, attributes, run->hypercall.flags);
++
++    return kvm_convert_memory(gpa, size, attributes & KVM_MAP_GPA_RANGE_ENCRYPTED);
++}
++
++static int kvm_handle_hypercall(struct kvm_run *run)
++{
++    if (run->hypercall.nr == KVM_HC_MAP_GPA_RANGE)
++        return kvm_handle_hc_map_gpa_range(run);
++
++    return -EINVAL;
++}
++
+ #define VMX_INVALID_GUEST_STATE 0x80000021
+ 
+ int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
+@@ -5420,6 +5472,9 @@ int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
+         ret = kvm_xen_handle_exit(cpu, &run->xen);
+         break;
+ #endif
++    case KVM_EXIT_HYPERCALL:
++        ret = kvm_handle_hypercall(run);
++        break;
+     default:
+         fprintf(stderr, "KVM: unknown exit reason %d\n", run->exit_reason);
+         ret = -1;
+diff --git a/target/i386/kvm/kvm_i386.h b/target/i386/kvm/kvm_i386.h
+index 6b44844d95..34fc60774b 100644
+--- a/target/i386/kvm/kvm_i386.h
++++ b/target/i386/kvm/kvm_i386.h
+@@ -33,6 +33,7 @@
+ bool kvm_has_smm(void);
+ bool kvm_enable_x2apic(void);
+ bool kvm_hv_vpindex_settable(void);
++bool kvm_enable_hypercall(uint64_t enable_mask);
+ 
+ bool kvm_enable_sgx_provisioning(KVMState *s);
+ bool kvm_hyperv_expand_features(X86CPU *cpu, Error **errp);
+diff --git a/target/i386/kvm/trace-events b/target/i386/kvm/trace-events
+index b365a8e8e2..74a6234ff7 100644
+--- a/target/i386/kvm/trace-events
++++ b/target/i386/kvm/trace-events
+@@ -5,6 +5,7 @@ kvm_x86_fixup_msi_error(uint32_t gsi) "VT-d failed to remap interrupt for GSI %"
+ kvm_x86_add_msi_route(int virq) "Adding route entry for virq %d"
+ kvm_x86_remove_msi_route(int virq) "Removing route entry for virq %d"
+ kvm_x86_update_msi_routes(int num) "Updated %d MSI routes"
++kvm_hc_map_gpa_range(uint64_t gpa, uint64_t size, uint64_t attributes, uint64_t flags) "gpa 0x%" PRIx64 " size 0x%" PRIx64 " attributes 0x%" PRIx64 " flags 0x%" PRIx64
+ 
+ # xen-emu.c
+ kvm_xen_hypercall(int cpu, uint8_t cpl, uint64_t input, uint64_t a0, uint64_t a1, uint64_t a2, uint64_t ret) "xen_hypercall: cpu %d cpl %d input %" PRIu64 " a0 0x%" PRIx64 " a1 0x%" PRIx64 " a2 0x%" PRIx64" ret 0x%" PRIx64
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-i386-kvm-Move-architectural-CPUID-leaf-generation-to.patch b/SOURCES/kvm-i386-kvm-Move-architectural-CPUID-leaf-generation-to.patch
new file mode 100644
index 0000000..4b91e93
--- /dev/null
+++ b/SOURCES/kvm-i386-kvm-Move-architectural-CPUID-leaf-generation-to.patch
@@ -0,0 +1,536 @@
+From 5ead79f45e8e90b7a04586c89e70cb9d0b66b730 Mon Sep 17 00:00:00 2001
+From: Sean Christopherson <sean.j.christopherson@intel.com>
+Date: Thu, 29 Feb 2024 01:36:43 -0500
+Subject: [PATCH 004/100] i386/kvm: Move architectural CPUID leaf generation to
+ separate helper
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [4/91] 06ecdbcf05ad3d658273980b114f02477d0b0475 (bonzini/rhel-qemu-kvm)
+
+Move the architectural (for lack of a better term) CPUID leaf generation
+to a separate helper so that the generation code can be reused by TDX,
+which needs to generate a canonical VM-scoped configuration.
+
+For now this is just a cleanup, so keep the function static.
+
+Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
+Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
+Message-ID: <20240229063726.610065-23-xiaoyao.li@intel.com>
+Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit a5acf4f26c208a05d05ef1bde65553ce2ab5e5d0)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ target/i386/kvm/kvm.c | 417 +++++++++++++++++++++---------------------
+ 1 file changed, 211 insertions(+), 206 deletions(-)
+
+diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
+index 739f33db47..5f30b649a0 100644
+--- a/target/i386/kvm/kvm.c
++++ b/target/i386/kvm/kvm.c
+@@ -1706,195 +1706,22 @@ static void kvm_init_nested_state(CPUX86State *env)
+     }
+ }
+ 
+-int kvm_arch_init_vcpu(CPUState *cs)
++static uint32_t kvm_x86_build_cpuid(CPUX86State *env,
++                                    struct kvm_cpuid_entry2 *entries,
++                                    uint32_t cpuid_i)
+ {
+-    struct {
+-        struct kvm_cpuid2 cpuid;
+-        struct kvm_cpuid_entry2 entries[KVM_MAX_CPUID_ENTRIES];
+-    } cpuid_data;
+-    /*
+-     * The kernel defines these structs with padding fields so there
+-     * should be no extra padding in our cpuid_data struct.
+-     */
+-    QEMU_BUILD_BUG_ON(sizeof(cpuid_data) !=
+-                      sizeof(struct kvm_cpuid2) +
+-                      sizeof(struct kvm_cpuid_entry2) * KVM_MAX_CPUID_ENTRIES);
+-
+-    X86CPU *cpu = X86_CPU(cs);
+-    CPUX86State *env = &cpu->env;
+-    uint32_t limit, i, j, cpuid_i;
++    uint32_t limit, i, j;
+     uint32_t unused;
+     struct kvm_cpuid_entry2 *c;
+-    uint32_t signature[3];
+-    int kvm_base = KVM_CPUID_SIGNATURE;
+-    int max_nested_state_len;
+-    int r;
+-    Error *local_err = NULL;
+-
+-    memset(&cpuid_data, 0, sizeof(cpuid_data));
+-
+-    cpuid_i = 0;
+-
+-    has_xsave2 = kvm_check_extension(cs->kvm_state, KVM_CAP_XSAVE2);
+-
+-    r = kvm_arch_set_tsc_khz(cs);
+-    if (r < 0) {
+-        return r;
+-    }
+-
+-    /* vcpu's TSC frequency is either specified by user, or following
+-     * the value used by KVM if the former is not present. In the
+-     * latter case, we query it from KVM and record in env->tsc_khz,
+-     * so that vcpu's TSC frequency can be migrated later via this field.
+-     */
+-    if (!env->tsc_khz) {
+-        r = kvm_check_extension(cs->kvm_state, KVM_CAP_GET_TSC_KHZ) ?
+-            kvm_vcpu_ioctl(cs, KVM_GET_TSC_KHZ) :
+-            -ENOTSUP;
+-        if (r > 0) {
+-            env->tsc_khz = r;
+-        }
+-    }
+-
+-    env->apic_bus_freq = KVM_APIC_BUS_FREQUENCY;
+-
+-    /*
+-     * kvm_hyperv_expand_features() is called here for the second time in case
+-     * KVM_CAP_SYS_HYPERV_CPUID is not supported. While we can't possibly handle
+-     * 'query-cpu-model-expansion' in this case as we don't have a KVM vCPU to
+-     * check which Hyper-V enlightenments are supported and which are not, we
+-     * can still proceed and check/expand Hyper-V enlightenments here so legacy
+-     * behavior is preserved.
+-     */
+-    if (!kvm_hyperv_expand_features(cpu, &local_err)) {
+-        error_report_err(local_err);
+-        return -ENOSYS;
+-    }
+-
+-    if (hyperv_enabled(cpu)) {
+-        r = hyperv_init_vcpu(cpu);
+-        if (r) {
+-            return r;
+-        }
+-
+-        cpuid_i = hyperv_fill_cpuids(cs, cpuid_data.entries);
+-        kvm_base = KVM_CPUID_SIGNATURE_NEXT;
+-        has_msr_hv_hypercall = true;
+-    }
+-
+-    if (cs->kvm_state->xen_version) {
+-#ifdef CONFIG_XEN_EMU
+-        struct kvm_cpuid_entry2 *xen_max_leaf;
+-
+-        memcpy(signature, "XenVMMXenVMM", 12);
+-
+-        xen_max_leaf = c = &cpuid_data.entries[cpuid_i++];
+-        c->function = kvm_base + XEN_CPUID_SIGNATURE;
+-        c->eax = kvm_base + XEN_CPUID_TIME;
+-        c->ebx = signature[0];
+-        c->ecx = signature[1];
+-        c->edx = signature[2];
+-
+-        c = &cpuid_data.entries[cpuid_i++];
+-        c->function = kvm_base + XEN_CPUID_VENDOR;
+-        c->eax = cs->kvm_state->xen_version;
+-        c->ebx = 0;
+-        c->ecx = 0;
+-        c->edx = 0;
+-
+-        c = &cpuid_data.entries[cpuid_i++];
+-        c->function = kvm_base + XEN_CPUID_HVM_MSR;
+-        /* Number of hypercall-transfer pages */
+-        c->eax = 1;
+-        /* Hypercall MSR base address */
+-        if (hyperv_enabled(cpu)) {
+-            c->ebx = XEN_HYPERCALL_MSR_HYPERV;
+-            kvm_xen_init(cs->kvm_state, c->ebx);
+-        } else {
+-            c->ebx = XEN_HYPERCALL_MSR;
+-        }
+-        c->ecx = 0;
+-        c->edx = 0;
+-
+-        c = &cpuid_data.entries[cpuid_i++];
+-        c->function = kvm_base + XEN_CPUID_TIME;
+-        c->eax = ((!!tsc_is_stable_and_known(env) << 1) |
+-            (!!(env->features[FEAT_8000_0001_EDX] & CPUID_EXT2_RDTSCP) << 2));
+-        /* default=0 (emulate if necessary) */
+-        c->ebx = 0;
+-        /* guest tsc frequency */
+-        c->ecx = env->user_tsc_khz;
+-        /* guest tsc incarnation (migration count) */
+-        c->edx = 0;
+-
+-        c = &cpuid_data.entries[cpuid_i++];
+-        c->function = kvm_base + XEN_CPUID_HVM;
+-        xen_max_leaf->eax = kvm_base + XEN_CPUID_HVM;
+-        if (cs->kvm_state->xen_version >= XEN_VERSION(4, 5)) {
+-            c->function = kvm_base + XEN_CPUID_HVM;
+-
+-            if (cpu->xen_vapic) {
+-                c->eax |= XEN_HVM_CPUID_APIC_ACCESS_VIRT;
+-                c->eax |= XEN_HVM_CPUID_X2APIC_VIRT;
+-            }
+-
+-            c->eax |= XEN_HVM_CPUID_IOMMU_MAPPINGS;
+-
+-            if (cs->kvm_state->xen_version >= XEN_VERSION(4, 6)) {
+-                c->eax |= XEN_HVM_CPUID_VCPU_ID_PRESENT;
+-                c->ebx = cs->cpu_index;
+-            }
+-
+-            if (cs->kvm_state->xen_version >= XEN_VERSION(4, 17)) {
+-                c->eax |= XEN_HVM_CPUID_UPCALL_VECTOR;
+-            }
+-        }
+-
+-        r = kvm_xen_init_vcpu(cs);
+-        if (r) {
+-            return r;
+-        }
+-
+-        kvm_base += 0x100;
+-#else /* CONFIG_XEN_EMU */
+-        /* This should never happen as kvm_arch_init() would have died first. */
+-        fprintf(stderr, "Cannot enable Xen CPUID without Xen support\n");
+-        abort();
+-#endif
+-    } else if (cpu->expose_kvm) {
+-        memcpy(signature, "KVMKVMKVM\0\0\0", 12);
+-        c = &cpuid_data.entries[cpuid_i++];
+-        c->function = KVM_CPUID_SIGNATURE | kvm_base;
+-        c->eax = KVM_CPUID_FEATURES | kvm_base;
+-        c->ebx = signature[0];
+-        c->ecx = signature[1];
+-        c->edx = signature[2];
+-
+-        c = &cpuid_data.entries[cpuid_i++];
+-        c->function = KVM_CPUID_FEATURES | kvm_base;
+-        c->eax = env->features[FEAT_KVM];
+-        c->edx = env->features[FEAT_KVM_HINTS];
+-    }
+ 
+     cpu_x86_cpuid(env, 0, 0, &limit, &unused, &unused, &unused);
+ 
+-    if (cpu->kvm_pv_enforce_cpuid) {
+-        r = kvm_vcpu_enable_cap(cs, KVM_CAP_ENFORCE_PV_FEATURE_CPUID, 0, 1);
+-        if (r < 0) {
+-            fprintf(stderr,
+-                    "failed to enable KVM_CAP_ENFORCE_PV_FEATURE_CPUID: %s",
+-                    strerror(-r));
+-            abort();
+-        }
+-    }
+-
+     for (i = 0; i <= limit; i++) {
++        j = 0;
+         if (cpuid_i == KVM_MAX_CPUID_ENTRIES) {
+-            fprintf(stderr, "unsupported level value: 0x%x\n", limit);
+-            abort();
++            goto full;
+         }
+-        c = &cpuid_data.entries[cpuid_i++];
+-
++        c = &entries[cpuid_i++];
+         switch (i) {
+         case 2: {
+             /* Keep reading function 2 till all the input is received */
+@@ -1908,11 +1735,9 @@ int kvm_arch_init_vcpu(CPUState *cs)
+ 
+             for (j = 1; j < times; ++j) {
+                 if (cpuid_i == KVM_MAX_CPUID_ENTRIES) {
+-                    fprintf(stderr, "cpuid_data is full, no space for "
+-                            "cpuid(eax:2):eax & 0xf = 0x%x\n", times);
+-                    abort();
++                    goto full;
+                 }
+-                c = &cpuid_data.entries[cpuid_i++];
++                c = &entries[cpuid_i++];
+                 c->function = i;
+                 c->flags = KVM_CPUID_FLAG_STATEFUL_FUNC;
+                 cpu_x86_cpuid(env, i, 0, &c->eax, &c->ebx, &c->ecx, &c->edx);
+@@ -1951,11 +1776,9 @@ int kvm_arch_init_vcpu(CPUState *cs)
+                     continue;
+                 }
+                 if (cpuid_i == KVM_MAX_CPUID_ENTRIES) {
+-                    fprintf(stderr, "cpuid_data is full, no space for "
+-                            "cpuid(eax:0x%x,ecx:0x%x)\n", i, j);
+-                    abort();
++                    goto full;
+                 }
+-                c = &cpuid_data.entries[cpuid_i++];
++                c = &entries[cpuid_i++];
+             }
+             break;
+         case 0x12:
+@@ -1970,11 +1793,9 @@ int kvm_arch_init_vcpu(CPUState *cs)
+                 }
+ 
+                 if (cpuid_i == KVM_MAX_CPUID_ENTRIES) {
+-                    fprintf(stderr, "cpuid_data is full, no space for "
+-                                "cpuid(eax:0x12,ecx:0x%x)\n", j);
+-                    abort();
++                    goto full;
+                 }
+-                c = &cpuid_data.entries[cpuid_i++];
++                c = &entries[cpuid_i++];
+             }
+             break;
+         case 0x7:
+@@ -1991,11 +1812,9 @@ int kvm_arch_init_vcpu(CPUState *cs)
+ 
+             for (j = 1; j <= times; ++j) {
+                 if (cpuid_i == KVM_MAX_CPUID_ENTRIES) {
+-                    fprintf(stderr, "cpuid_data is full, no space for "
+-                                "cpuid(eax:0x%x,ecx:0x%x)\n", i, j);
+-                    abort();
++                    goto full;
+                 }
+-                c = &cpuid_data.entries[cpuid_i++];
++                c = &entries[cpuid_i++];
+                 c->function = i;
+                 c->index = j;
+                 c->flags = KVM_CPUID_FLAG_SIGNIFCANT_INDEX;
+@@ -2048,11 +1867,11 @@ int kvm_arch_init_vcpu(CPUState *cs)
+     cpu_x86_cpuid(env, 0x80000000, 0, &limit, &unused, &unused, &unused);
+ 
+     for (i = 0x80000000; i <= limit; i++) {
++        j = 0;
+         if (cpuid_i == KVM_MAX_CPUID_ENTRIES) {
+-            fprintf(stderr, "unsupported xlevel value: 0x%x\n", limit);
+-            abort();
++            goto full;
+         }
+-        c = &cpuid_data.entries[cpuid_i++];
++        c = &entries[cpuid_i++];
+ 
+         switch (i) {
+         case 0x8000001d:
+@@ -2067,11 +1886,9 @@ int kvm_arch_init_vcpu(CPUState *cs)
+                     break;
+                 }
+                 if (cpuid_i == KVM_MAX_CPUID_ENTRIES) {
+-                    fprintf(stderr, "cpuid_data is full, no space for "
+-                            "cpuid(eax:0x%x,ecx:0x%x)\n", i, j);
+-                    abort();
++                    goto full;
+                 }
+-                c = &cpuid_data.entries[cpuid_i++];
++                c = &entries[cpuid_i++];
+             }
+             break;
+         default:
+@@ -2094,11 +1911,11 @@ int kvm_arch_init_vcpu(CPUState *cs)
+         cpu_x86_cpuid(env, 0xC0000000, 0, &limit, &unused, &unused, &unused);
+ 
+         for (i = 0xC0000000; i <= limit; i++) {
++            j = 0;
+             if (cpuid_i == KVM_MAX_CPUID_ENTRIES) {
+-                fprintf(stderr, "unsupported xlevel2 value: 0x%x\n", limit);
+-                abort();
++                goto full;
+             }
+-            c = &cpuid_data.entries[cpuid_i++];
++            c = &entries[cpuid_i++];
+ 
+             c->function = i;
+             c->flags = 0;
+@@ -2106,6 +1923,194 @@ int kvm_arch_init_vcpu(CPUState *cs)
+         }
+     }
+ 
++    return cpuid_i;
++
++full:
++    fprintf(stderr, "cpuid_data is full, no space for "
++            "cpuid(eax:0x%x,ecx:0x%x)\n", i, j);
++    abort();
++}
++
++int kvm_arch_init_vcpu(CPUState *cs)
++{
++    struct {
++        struct kvm_cpuid2 cpuid;
++        struct kvm_cpuid_entry2 entries[KVM_MAX_CPUID_ENTRIES];
++    } cpuid_data;
++    /*
++     * The kernel defines these structs with padding fields so there
++     * should be no extra padding in our cpuid_data struct.
++     */
++    QEMU_BUILD_BUG_ON(sizeof(cpuid_data) !=
++                      sizeof(struct kvm_cpuid2) +
++                      sizeof(struct kvm_cpuid_entry2) * KVM_MAX_CPUID_ENTRIES);
++
++    X86CPU *cpu = X86_CPU(cs);
++    CPUX86State *env = &cpu->env;
++    uint32_t cpuid_i;
++    struct kvm_cpuid_entry2 *c;
++    uint32_t signature[3];
++    int kvm_base = KVM_CPUID_SIGNATURE;
++    int max_nested_state_len;
++    int r;
++    Error *local_err = NULL;
++
++    memset(&cpuid_data, 0, sizeof(cpuid_data));
++
++    cpuid_i = 0;
++
++    has_xsave2 = kvm_check_extension(cs->kvm_state, KVM_CAP_XSAVE2);
++
++    r = kvm_arch_set_tsc_khz(cs);
++    if (r < 0) {
++        return r;
++    }
++
++    /* vcpu's TSC frequency is either specified by user, or following
++     * the value used by KVM if the former is not present. In the
++     * latter case, we query it from KVM and record in env->tsc_khz,
++     * so that vcpu's TSC frequency can be migrated later via this field.
++     */
++    if (!env->tsc_khz) {
++        r = kvm_check_extension(cs->kvm_state, KVM_CAP_GET_TSC_KHZ) ?
++            kvm_vcpu_ioctl(cs, KVM_GET_TSC_KHZ) :
++            -ENOTSUP;
++        if (r > 0) {
++            env->tsc_khz = r;
++        }
++    }
++
++    env->apic_bus_freq = KVM_APIC_BUS_FREQUENCY;
++
++    /*
++     * kvm_hyperv_expand_features() is called here for the second time in case
++     * KVM_CAP_SYS_HYPERV_CPUID is not supported. While we can't possibly handle
++     * 'query-cpu-model-expansion' in this case as we don't have a KVM vCPU to
++     * check which Hyper-V enlightenments are supported and which are not, we
++     * can still proceed and check/expand Hyper-V enlightenments here so legacy
++     * behavior is preserved.
++     */
++    if (!kvm_hyperv_expand_features(cpu, &local_err)) {
++        error_report_err(local_err);
++        return -ENOSYS;
++    }
++
++    if (hyperv_enabled(cpu)) {
++        r = hyperv_init_vcpu(cpu);
++        if (r) {
++            return r;
++        }
++
++        cpuid_i = hyperv_fill_cpuids(cs, cpuid_data.entries);
++        kvm_base = KVM_CPUID_SIGNATURE_NEXT;
++        has_msr_hv_hypercall = true;
++    }
++
++    if (cs->kvm_state->xen_version) {
++#ifdef CONFIG_XEN_EMU
++        struct kvm_cpuid_entry2 *xen_max_leaf;
++
++        memcpy(signature, "XenVMMXenVMM", 12);
++
++        xen_max_leaf = c = &cpuid_data.entries[cpuid_i++];
++        c->function = kvm_base + XEN_CPUID_SIGNATURE;
++        c->eax = kvm_base + XEN_CPUID_TIME;
++        c->ebx = signature[0];
++        c->ecx = signature[1];
++        c->edx = signature[2];
++
++        c = &cpuid_data.entries[cpuid_i++];
++        c->function = kvm_base + XEN_CPUID_VENDOR;
++        c->eax = cs->kvm_state->xen_version;
++        c->ebx = 0;
++        c->ecx = 0;
++        c->edx = 0;
++
++        c = &cpuid_data.entries[cpuid_i++];
++        c->function = kvm_base + XEN_CPUID_HVM_MSR;
++        /* Number of hypercall-transfer pages */
++        c->eax = 1;
++        /* Hypercall MSR base address */
++        if (hyperv_enabled(cpu)) {
++            c->ebx = XEN_HYPERCALL_MSR_HYPERV;
++            kvm_xen_init(cs->kvm_state, c->ebx);
++        } else {
++            c->ebx = XEN_HYPERCALL_MSR;
++        }
++        c->ecx = 0;
++        c->edx = 0;
++
++        c = &cpuid_data.entries[cpuid_i++];
++        c->function = kvm_base + XEN_CPUID_TIME;
++        c->eax = ((!!tsc_is_stable_and_known(env) << 1) |
++            (!!(env->features[FEAT_8000_0001_EDX] & CPUID_EXT2_RDTSCP) << 2));
++        /* default=0 (emulate if necessary) */
++        c->ebx = 0;
++        /* guest tsc frequency */
++        c->ecx = env->user_tsc_khz;
++        /* guest tsc incarnation (migration count) */
++        c->edx = 0;
++
++        c = &cpuid_data.entries[cpuid_i++];
++        c->function = kvm_base + XEN_CPUID_HVM;
++        xen_max_leaf->eax = kvm_base + XEN_CPUID_HVM;
++        if (cs->kvm_state->xen_version >= XEN_VERSION(4, 5)) {
++            c->function = kvm_base + XEN_CPUID_HVM;
++
++            if (cpu->xen_vapic) {
++                c->eax |= XEN_HVM_CPUID_APIC_ACCESS_VIRT;
++                c->eax |= XEN_HVM_CPUID_X2APIC_VIRT;
++            }
++
++            c->eax |= XEN_HVM_CPUID_IOMMU_MAPPINGS;
++
++            if (cs->kvm_state->xen_version >= XEN_VERSION(4, 6)) {
++                c->eax |= XEN_HVM_CPUID_VCPU_ID_PRESENT;
++                c->ebx = cs->cpu_index;
++            }
++
++            if (cs->kvm_state->xen_version >= XEN_VERSION(4, 17)) {
++                c->eax |= XEN_HVM_CPUID_UPCALL_VECTOR;
++            }
++        }
++
++        r = kvm_xen_init_vcpu(cs);
++        if (r) {
++            return r;
++        }
++
++        kvm_base += 0x100;
++#else /* CONFIG_XEN_EMU */
++        /* This should never happen as kvm_arch_init() would have died first. */
++        fprintf(stderr, "Cannot enable Xen CPUID without Xen support\n");
++        abort();
++#endif
++    } else if (cpu->expose_kvm) {
++        memcpy(signature, "KVMKVMKVM\0\0\0", 12);
++        c = &cpuid_data.entries[cpuid_i++];
++        c->function = KVM_CPUID_SIGNATURE | kvm_base;
++        c->eax = KVM_CPUID_FEATURES | kvm_base;
++        c->ebx = signature[0];
++        c->ecx = signature[1];
++        c->edx = signature[2];
++
++        c = &cpuid_data.entries[cpuid_i++];
++        c->function = KVM_CPUID_FEATURES | kvm_base;
++        c->eax = env->features[FEAT_KVM];
++        c->edx = env->features[FEAT_KVM_HINTS];
++    }
++
++    if (cpu->kvm_pv_enforce_cpuid) {
++        r = kvm_vcpu_enable_cap(cs, KVM_CAP_ENFORCE_PV_FEATURE_CPUID, 0, 1);
++        if (r < 0) {
++            fprintf(stderr,
++                    "failed to enable KVM_CAP_ENFORCE_PV_FEATURE_CPUID: %s",
++                    strerror(-r));
++            abort();
++        }
++    }
++
++    cpuid_i = kvm_x86_build_cpuid(env, cpuid_data.entries, cpuid_i);
+     cpuid_data.cpuid.nent = cpuid_i;
+ 
+     if (((env->cpuid_version >> 8)&0xF) >= 6
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-i386-pc-remove-unnecessary-MachineClass-overrides.patch b/SOURCES/kvm-i386-pc-remove-unnecessary-MachineClass-overrides.patch
new file mode 100644
index 0000000..65d09ab
--- /dev/null
+++ b/SOURCES/kvm-i386-pc-remove-unnecessary-MachineClass-overrides.patch
@@ -0,0 +1,91 @@
+From 03e275023b482ac79b4f92ca4ceef6de3caa634f Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Thu, 9 May 2024 19:00:40 +0200
+Subject: [PATCH 045/100] i386: pc: remove unnecessary MachineClass overrides
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [45/91] c03d5b57014d0d02f6ce0cdfb19a34996d100dea (bonzini/rhel-qemu-kvm)
+
+There is no need to override these fields of MachineClass because they are
+already set to the right value in the superclass.
+
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
+Message-ID: <20240509170044.190795-10-pbonzini@redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit b348fdcdac9f9fc70be9ae56c54e41765e9aae24)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ hw/i386/pc.c          | 3 ---
+ hw/i386/x86.c         | 6 +++---
+ include/hw/i386/x86.h | 4 ----
+ 3 files changed, 3 insertions(+), 10 deletions(-)
+
+diff --git a/hw/i386/pc.c b/hw/i386/pc.c
+index 660a59c63b..0aca0cc79e 100644
+--- a/hw/i386/pc.c
++++ b/hw/i386/pc.c
+@@ -1979,9 +1979,6 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
+     mc->async_pf_vmexit_disable = false;
+     mc->get_hotplug_handler = pc_get_hotplug_handler;
+     mc->hotplug_allowed = pc_hotplug_allowed;
+-    mc->cpu_index_to_instance_props = x86_cpu_index_to_props;
+-    mc->get_default_cpu_node_id = x86_get_default_cpu_node_id;
+-    mc->possible_cpu_arch_ids = x86_possible_cpu_arch_ids;
+     mc->auto_enable_numa_with_memhp = true;
+     mc->auto_enable_numa_with_memdev = true;
+     mc->has_hotpluggable_cpus = true;
+diff --git a/hw/i386/x86.c b/hw/i386/x86.c
+index c61f4ebfa6..fcef652c1e 100644
+--- a/hw/i386/x86.c
++++ b/hw/i386/x86.c
+@@ -443,7 +443,7 @@ void x86_cpu_pre_plug(HotplugHandler *hotplug_dev,
+     numa_cpu_pre_plug(cpu_slot, dev, errp);
+ }
+ 
+-CpuInstanceProperties
++static CpuInstanceProperties
+ x86_cpu_index_to_props(MachineState *ms, unsigned cpu_index)
+ {
+     MachineClass *mc = MACHINE_GET_CLASS(ms);
+@@ -453,7 +453,7 @@ x86_cpu_index_to_props(MachineState *ms, unsigned cpu_index)
+     return possible_cpus->cpus[cpu_index].props;
+ }
+ 
+-int64_t x86_get_default_cpu_node_id(const MachineState *ms, int idx)
++static int64_t x86_get_default_cpu_node_id(const MachineState *ms, int idx)
+ {
+    X86CPUTopoIDs topo_ids;
+    X86MachineState *x86ms = X86_MACHINE(ms);
+@@ -467,7 +467,7 @@ int64_t x86_get_default_cpu_node_id(const MachineState *ms, int idx)
+    return topo_ids.pkg_id % ms->numa_state->num_nodes;
+ }
+ 
+-const CPUArchIdList *x86_possible_cpu_arch_ids(MachineState *ms)
++static const CPUArchIdList *x86_possible_cpu_arch_ids(MachineState *ms)
+ {
+     X86MachineState *x86ms = X86_MACHINE(ms);
+     unsigned int max_cpus = ms->smp.max_cpus;
+diff --git a/include/hw/i386/x86.h b/include/hw/i386/x86.h
+index d7b7d3f3ce..c2062db13f 100644
+--- a/include/hw/i386/x86.h
++++ b/include/hw/i386/x86.h
+@@ -114,10 +114,6 @@ uint32_t x86_cpu_apic_id_from_index(X86MachineState *pcms,
+ 
+ void x86_cpu_new(X86MachineState *pcms, int64_t apic_id, Error **errp);
+ void x86_cpus_init(X86MachineState *pcms, int default_cpu_version);
+-CpuInstanceProperties x86_cpu_index_to_props(MachineState *ms,
+-                                             unsigned cpu_index);
+-int64_t x86_get_default_cpu_node_id(const MachineState *ms, int idx);
+-const CPUArchIdList *x86_possible_cpu_arch_ids(MachineState *ms);
+ CPUArchId *x86_find_cpu_slot(MachineState *ms, uint32_t id, int *idx);
+ void x86_rtc_set_cpus_count(ISADevice *rtc, uint16_t cpus_count);
+ void x86_cpu_pre_plug(HotplugHandler *hotplug_dev,
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-i386-sev-Add-a-class-method-to-determine-KVM-VM-type.patch b/SOURCES/kvm-i386-sev-Add-a-class-method-to-determine-KVM-VM-type.patch
new file mode 100644
index 0000000..fce51aa
--- /dev/null
+++ b/SOURCES/kvm-i386-sev-Add-a-class-method-to-determine-KVM-VM-type.patch
@@ -0,0 +1,116 @@
+From 652793962000d6906e219ceae36348a476b78c28 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Fri, 31 May 2024 12:44:44 +0200
+Subject: [PATCH 065/100] i386/sev: Add a class method to determine KVM VM type
+ for SNP guests
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [65/91] c6cbeac0a6f691138df212b80efaa9b1143fdaa8 (bonzini/rhel-qemu-kvm)
+
+SEV guests can use either KVM_X86_DEFAULT_VM, KVM_X86_SEV_VM,
+or KVM_X86_SEV_ES_VM depending on the configuration and what
+the host kernel supports. SNP guests on the other hand can only
+ever use KVM_X86_SNP_VM, so split determination of VM type out
+into a separate class method that can be set accordingly for
+sev-guest vs. sev-snp-guest objects and add handling for SNP.
+
+Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com>
+Message-ID: <20240530111643.1091816-14-pankaj.gupta@amd.com>
+[Remove unnecessary function pointer declaration. - Paolo]
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit a808132f6d8e855bd83a400570ec91d2e00bebe3)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ target/i386/kvm/kvm.c |  1 +
+ target/i386/sev.c     | 15 ++++++++++++---
+ 2 files changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
+index 408568d053..75e75d9772 100644
+--- a/target/i386/kvm/kvm.c
++++ b/target/i386/kvm/kvm.c
+@@ -166,6 +166,7 @@ static const char *vm_type_name[] = {
+     [KVM_X86_DEFAULT_VM] = "default",
+     [KVM_X86_SEV_VM] = "SEV",
+     [KVM_X86_SEV_ES_VM] = "SEV-ES",
++    [KVM_X86_SNP_VM] = "SEV-SNP",
+ };
+ 
+ bool kvm_is_vm_type_supported(int type)
+diff --git a/target/i386/sev.c b/target/i386/sev.c
+index c3daaf1ad5..072cc4f853 100644
+--- a/target/i386/sev.c
++++ b/target/i386/sev.c
+@@ -885,6 +885,11 @@ out:
+     return sev_common->kvm_type;
+ }
+ 
++static int sev_snp_kvm_type(X86ConfidentialGuest *cg)
++{
++    return KVM_X86_SNP_VM;
++}
++
+ static int sev_common_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
+ {
+     char *devname;
+@@ -894,6 +899,8 @@ static int sev_common_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
+     struct sev_user_data_status status = {};
+     SevCommonState *sev_common = SEV_COMMON(cgs);
+     SevCommonStateClass *klass = SEV_COMMON_GET_CLASS(cgs);
++    X86ConfidentialGuestClass *x86_klass =
++                               X86_CONFIDENTIAL_GUEST_GET_CLASS(cgs);
+ 
+     sev_common->state = SEV_STATE_UNINIT;
+ 
+@@ -964,7 +971,7 @@ static int sev_common_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
+     }
+ 
+     trace_kvm_sev_init();
+-    if (sev_kvm_type(X86_CONFIDENTIAL_GUEST(sev_common)) == KVM_X86_DEFAULT_VM) {
++    if (x86_klass->kvm_type(X86_CONFIDENTIAL_GUEST(sev_common)) == KVM_X86_DEFAULT_VM) {
+         cmd = sev_es_enabled() ? KVM_SEV_ES_INIT : KVM_SEV_INIT;
+ 
+         ret = sev_ioctl(sev_common->sev_fd, cmd, NULL, &fw_error);
+@@ -1441,10 +1448,8 @@ static void
+ sev_common_class_init(ObjectClass *oc, void *data)
+ {
+     ConfidentialGuestSupportClass *klass = CONFIDENTIAL_GUEST_SUPPORT_CLASS(oc);
+-    X86ConfidentialGuestClass *x86_klass = X86_CONFIDENTIAL_GUEST_CLASS(oc);
+ 
+     klass->kvm_init = sev_common_kvm_init;
+-    x86_klass->kvm_type = sev_kvm_type;
+ 
+     object_class_property_add_str(oc, "sev-device",
+                                   sev_common_get_sev_device,
+@@ -1529,10 +1534,12 @@ static void
+ sev_guest_class_init(ObjectClass *oc, void *data)
+ {
+     SevCommonStateClass *klass = SEV_COMMON_CLASS(oc);
++    X86ConfidentialGuestClass *x86_klass = X86_CONFIDENTIAL_GUEST_CLASS(oc);
+ 
+     klass->launch_start = sev_launch_start;
+     klass->launch_finish = sev_launch_finish;
+     klass->kvm_init = sev_kvm_init;
++    x86_klass->kvm_type = sev_kvm_type;
+ 
+     object_class_property_add_str(oc, "dh-cert-file",
+                                   sev_guest_get_dh_cert_file,
+@@ -1770,8 +1777,10 @@ static void
+ sev_snp_guest_class_init(ObjectClass *oc, void *data)
+ {
+     SevCommonStateClass *klass = SEV_COMMON_CLASS(oc);
++    X86ConfidentialGuestClass *x86_klass = X86_CONFIDENTIAL_GUEST_CLASS(oc);
+ 
+     klass->kvm_init = sev_snp_kvm_init;
++    x86_klass->kvm_type = sev_snp_kvm_type;
+ 
+     object_class_property_add(oc, "policy", "uint64",
+                               sev_snp_guest_get_policy,
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-i386-sev-Add-a-sev_snp_enabled-helper.patch b/SOURCES/kvm-i386-sev-Add-a-sev_snp_enabled-helper.patch
new file mode 100644
index 0000000..d194994
--- /dev/null
+++ b/SOURCES/kvm-i386-sev-Add-a-sev_snp_enabled-helper.patch
@@ -0,0 +1,84 @@
+From 82a714b79851b5c2d1389d2fa7a01548c486a854 Mon Sep 17 00:00:00 2001
+From: Michael Roth <michael.roth@amd.com>
+Date: Thu, 30 May 2024 06:16:20 -0500
+Subject: [PATCH 060/100] i386/sev: Add a sev_snp_enabled() helper
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [60/91] c35ead095028ccfb1e1be0fe010ca4f7688530a0 (bonzini/rhel-qemu-kvm)
+
+Add a simple helper to check if the current guest type is SNP. Also have
+SNP-enabled imply that SEV-ES is enabled as well, and fix up any places
+where the sev_es_enabled() check is expecting a pure/non-SNP guest.
+
+Signed-off-by: Michael Roth <michael.roth@amd.com>
+Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com>
+Message-ID: <20240530111643.1091816-9-pankaj.gupta@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 99190f805dca9475fe244fbd8041961842657dc2)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ target/i386/sev.c | 13 ++++++++++++-
+ target/i386/sev.h |  2 ++
+ 2 files changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/target/i386/sev.c b/target/i386/sev.c
+index a81b3228d4..4edfedc139 100644
+--- a/target/i386/sev.c
++++ b/target/i386/sev.c
+@@ -325,12 +325,21 @@ sev_enabled(void)
+     return !!object_dynamic_cast(OBJECT(cgs), TYPE_SEV_COMMON);
+ }
+ 
++bool
++sev_snp_enabled(void)
++{
++    ConfidentialGuestSupport *cgs = MACHINE(qdev_get_machine())->cgs;
++
++    return !!object_dynamic_cast(OBJECT(cgs), TYPE_SEV_SNP_GUEST);
++}
++
+ bool
+ sev_es_enabled(void)
+ {
+     ConfidentialGuestSupport *cgs = MACHINE(qdev_get_machine())->cgs;
+ 
+-    return sev_enabled() && (SEV_GUEST(cgs)->policy & SEV_POLICY_ES);
++    return sev_snp_enabled() ||
++            (sev_enabled() && SEV_GUEST(cgs)->policy & SEV_POLICY_ES);
+ }
+ 
+ uint32_t
+@@ -946,7 +955,9 @@ static int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
+                        "support", __func__);
+             goto err;
+         }
++    }
+ 
++    if (sev_es_enabled() && !sev_snp_enabled()) {
+         if (!(status.flags & SEV_STATUS_FLAGS_CONFIG_ES)) {
+             error_setg(errp, "%s: guest policy requires SEV-ES, but "
+                          "host SEV-ES support unavailable",
+diff --git a/target/i386/sev.h b/target/i386/sev.h
+index bedc667eeb..94295ee74f 100644
+--- a/target/i386/sev.h
++++ b/target/i386/sev.h
+@@ -45,9 +45,11 @@ typedef struct SevKernelLoaderContext {
+ #ifdef CONFIG_SEV
+ bool sev_enabled(void);
+ bool sev_es_enabled(void);
++bool sev_snp_enabled(void);
+ #else
+ #define sev_enabled() 0
+ #define sev_es_enabled() 0
++#define sev_snp_enabled() 0
+ #endif
+ 
+ uint32_t sev_get_cbit_position(void);
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-i386-sev-Add-handling-to-encrypt-finalize-guest-laun.patch b/SOURCES/kvm-i386-sev-Add-handling-to-encrypt-finalize-guest-laun.patch
new file mode 100644
index 0000000..2bab2ac
--- /dev/null
+++ b/SOURCES/kvm-i386-sev-Add-handling-to-encrypt-finalize-guest-laun.patch
@@ -0,0 +1,187 @@
+From 0e435819540b0d39da2c828aacc0f35ecaadbdf6 Mon Sep 17 00:00:00 2001
+From: Brijesh Singh <brijesh.singh@amd.com>
+Date: Thu, 30 May 2024 06:16:28 -0500
+Subject: [PATCH 068/100] i386/sev: Add handling to encrypt/finalize guest
+ launch data
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [68/91] fe77931d279aa8df061823da88a320fb5f72ffea (bonzini/rhel-qemu-kvm)
+
+Process any queued up launch data and encrypt/measure it into the SNP
+guest instance prior to initial guest launch.
+
+This also updates the KVM_SEV_SNP_LAUNCH_UPDATE call to handle partial
+update responses.
+
+Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
+Co-developed-by: Michael Roth <michael.roth@amd.com>
+Signed-off-by: Michael Roth <michael.roth@amd.com>
+Co-developed-by: Pankaj Gupta <pankaj.gupta@amd.com>
+Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com>
+Message-ID: <20240530111643.1091816-17-pankaj.gupta@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 9f3a6999f9730a694d7db448a99f9c9cb6515992)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ target/i386/sev.c        | 112 ++++++++++++++++++++++++++++++++++++++-
+ target/i386/trace-events |   2 +
+ 2 files changed, 113 insertions(+), 1 deletion(-)
+
+diff --git a/target/i386/sev.c b/target/i386/sev.c
+index e89b87d2f5..ef2e592ca7 100644
+--- a/target/i386/sev.c
++++ b/target/i386/sev.c
+@@ -756,6 +756,76 @@ out:
+     return ret;
+ }
+ 
++static const char *
++snp_page_type_to_str(int type)
++{
++    switch (type) {
++    case KVM_SEV_SNP_PAGE_TYPE_NORMAL: return "Normal";
++    case KVM_SEV_SNP_PAGE_TYPE_ZERO: return "Zero";
++    case KVM_SEV_SNP_PAGE_TYPE_UNMEASURED: return "Unmeasured";
++    case KVM_SEV_SNP_PAGE_TYPE_SECRETS: return "Secrets";
++    case KVM_SEV_SNP_PAGE_TYPE_CPUID: return "Cpuid";
++    default: return "unknown";
++    }
++}
++
++static int
++sev_snp_launch_update(SevSnpGuestState *sev_snp_guest,
++                      SevLaunchUpdateData *data)
++{
++    int ret, fw_error;
++    struct kvm_sev_snp_launch_update update = {0};
++
++    if (!data->hva || !data->len) {
++        error_report("SNP_LAUNCH_UPDATE called with invalid address"
++                     "/ length: %p / %lx",
++                     data->hva, data->len);
++        return 1;
++    }
++
++    update.uaddr = (__u64)(unsigned long)data->hva;
++    update.gfn_start = data->gpa >> TARGET_PAGE_BITS;
++    update.len = data->len;
++    update.type = data->type;
++
++    /*
++     * KVM_SEV_SNP_LAUNCH_UPDATE requires that GPA ranges have the private
++     * memory attribute set in advance.
++     */
++    ret = kvm_set_memory_attributes_private(data->gpa, data->len);
++    if (ret) {
++        error_report("SEV-SNP: failed to configure initial"
++                     "private guest memory");
++        goto out;
++    }
++
++    while (update.len || ret == -EAGAIN) {
++        trace_kvm_sev_snp_launch_update(update.uaddr, update.gfn_start <<
++                                        TARGET_PAGE_BITS, update.len,
++                                        snp_page_type_to_str(update.type));
++
++        ret = sev_ioctl(SEV_COMMON(sev_snp_guest)->sev_fd,
++                        KVM_SEV_SNP_LAUNCH_UPDATE,
++                        &update, &fw_error);
++        if (ret && ret != -EAGAIN) {
++            error_report("SNP_LAUNCH_UPDATE ret=%d fw_error=%d '%s'",
++                         ret, fw_error, fw_error_to_str(fw_error));
++            break;
++        }
++    }
++
++out:
++    if (!ret && update.gfn_start << TARGET_PAGE_BITS != data->gpa + data->len) {
++        error_report("SEV-SNP: expected update of GPA range %lx-%lx,"
++                     "got GPA range %lx-%llx",
++                     data->gpa, data->gpa + data->len, data->gpa,
++                     update.gfn_start << TARGET_PAGE_BITS);
++        ret = -EIO;
++    }
++
++    return ret;
++}
++
+ static int
+ sev_launch_update_data(SevGuestState *sev_guest, uint8_t *addr, uint64_t len)
+ {
+@@ -901,6 +971,46 @@ sev_launch_finish(SevCommonState *sev_common)
+     migrate_add_blocker(&sev_mig_blocker, &error_fatal);
+ }
+ 
++static void
++sev_snp_launch_finish(SevCommonState *sev_common)
++{
++    int ret, error;
++    Error *local_err = NULL;
++    SevLaunchUpdateData *data;
++    SevSnpGuestState *sev_snp = SEV_SNP_GUEST(sev_common);
++    struct kvm_sev_snp_launch_finish *finish = &sev_snp->kvm_finish_conf;
++
++    QTAILQ_FOREACH(data, &launch_update, next) {
++        ret = sev_snp_launch_update(sev_snp, data);
++        if (ret) {
++            exit(1);
++        }
++    }
++
++    trace_kvm_sev_snp_launch_finish(sev_snp->id_block, sev_snp->id_auth,
++                                    sev_snp->host_data);
++    ret = sev_ioctl(sev_common->sev_fd, KVM_SEV_SNP_LAUNCH_FINISH,
++                    finish, &error);
++    if (ret) {
++        error_report("SNP_LAUNCH_FINISH ret=%d fw_error=%d '%s'",
++                     ret, error, fw_error_to_str(error));
++        exit(1);
++    }
++
++    sev_set_guest_state(sev_common, SEV_STATE_RUNNING);
++
++    /* add migration blocker */
++    error_setg(&sev_mig_blocker,
++               "SEV-SNP: Migration is not implemented");
++    ret = migrate_add_blocker(&sev_mig_blocker, &local_err);
++    if (local_err) {
++        error_report_err(local_err);
++        error_free(sev_mig_blocker);
++        exit(1);
++    }
++}
++
++
+ static void
+ sev_vm_state_change(void *opaque, bool running, RunState state)
+ {
+@@ -1832,10 +1942,10 @@ sev_snp_guest_class_init(ObjectClass *oc, void *data)
+     X86ConfidentialGuestClass *x86_klass = X86_CONFIDENTIAL_GUEST_CLASS(oc);
+ 
+     klass->launch_start = sev_snp_launch_start;
++    klass->launch_finish = sev_snp_launch_finish;
+     klass->kvm_init = sev_snp_kvm_init;
+     x86_klass->kvm_type = sev_snp_kvm_type;
+ 
+-
+     object_class_property_add(oc, "policy", "uint64",
+                               sev_snp_guest_get_policy,
+                               sev_snp_guest_set_policy, NULL, NULL);
+diff --git a/target/i386/trace-events b/target/i386/trace-events
+index cb26d8a925..06b44ead2e 100644
+--- a/target/i386/trace-events
++++ b/target/i386/trace-events
+@@ -12,3 +12,5 @@ kvm_sev_launch_finish(void) ""
+ kvm_sev_launch_secret(uint64_t hpa, uint64_t hva, uint64_t secret, int len) "hpa 0x%" PRIx64 " hva 0x%" PRIx64 " data 0x%" PRIx64 " len %d"
+ kvm_sev_attestation_report(const char *mnonce, const char *data) "mnonce %s data %s"
+ kvm_sev_snp_launch_start(uint64_t policy, char *gosvw) "policy 0x%" PRIx64 " gosvw %s"
++kvm_sev_snp_launch_update(uint64_t src, uint64_t gpa, uint64_t len, const char *type) "src 0x%" PRIx64 " gpa 0x%" PRIx64 " len 0x%" PRIx64 " (%s page)"
++kvm_sev_snp_launch_finish(char *id_block, char *id_auth, char *host_data) "id_block %s id_auth %s host_data %s"
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-i386-sev-Add-legacy-vm-type-parameter-for-SEV-guest-.patch b/SOURCES/kvm-i386-sev-Add-legacy-vm-type-parameter-for-SEV-guest-.patch
new file mode 100644
index 0000000..572dddc
--- /dev/null
+++ b/SOURCES/kvm-i386-sev-Add-legacy-vm-type-parameter-for-SEV-guest-.patch
@@ -0,0 +1,127 @@
+From 2872c423fa44dcbf50b581a5c3feac064a0473a0 Mon Sep 17 00:00:00 2001
+From: Michael Roth <michael.roth@amd.com>
+Date: Tue, 9 Apr 2024 18:07:41 -0500
+Subject: [PATCH 024/100] i386/sev: Add 'legacy-vm-type' parameter for SEV
+ guest objects
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [24/91] ce35d1b09fe8aa8772ff149543f7760455c1e6b5 (bonzini/rhel-qemu-kvm)
+
+QEMU will currently automatically make use of the KVM_SEV_INIT2 API for
+initializing SEV and SEV-ES guests verses the older
+KVM_SEV_INIT/KVM_SEV_ES_INIT interfaces.
+
+However, the older interfaces will silently avoid sync'ing FPU/XSAVE
+state to the VMSA prior to encryption, thus relying on behavior and
+measurements that assume the related fields to be allow zero.
+
+With KVM_SEV_INIT2, this state is now synced into the VMSA, resulting in
+measurements changes and, theoretically, behaviorial changes, though the
+latter are unlikely to be seen in practice.
+
+To allow a smooth transition to the newer interface, while still
+providing a mechanism to maintain backward compatibility with VMs
+created using the older interfaces, provide a new command-line
+parameter:
+
+  -object sev-guest,legacy-vm-type=true,...
+
+and have it default to false.
+
+Signed-off-by: Michael Roth <michael.roth@amd.com>
+Message-ID: <20240409230743.962513-2-michael.roth@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 023267334da375226720e62963df9545aa8fc2fd)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ qapi/qom.json     | 11 ++++++++++-
+ target/i386/sev.c | 18 +++++++++++++++++-
+ 2 files changed, 27 insertions(+), 2 deletions(-)
+
+diff --git a/qapi/qom.json b/qapi/qom.json
+index 85e6b4f84a..38dde6d785 100644
+--- a/qapi/qom.json
++++ b/qapi/qom.json
+@@ -898,6 +898,14 @@
+ #     designated guest firmware page for measured boot with -kernel
+ #     (default: false) (since 6.2)
+ #
++# @legacy-vm-type: Use legacy KVM_SEV_INIT KVM interface for creating the VM.
++#                  The newer KVM_SEV_INIT2 interface syncs additional vCPU
++#                  state when initializing the VMSA structures, which will
++#                  result in a different guest measurement. Set this to
++#                  maintain compatibility with older QEMU or kernel versions
++#                  that rely on legacy KVM_SEV_INIT behavior.
++#                  (default: false) (since 9.1)
++#
+ # Since: 2.12
+ ##
+ { 'struct': 'SevGuestProperties',
+@@ -908,7 +916,8 @@
+             '*handle': 'uint32',
+             '*cbitpos': 'uint32',
+             'reduced-phys-bits': 'uint32',
+-            '*kernel-hashes': 'bool' } }
++            '*kernel-hashes': 'bool',
++            '*legacy-vm-type': 'bool' } }
+ 
+ ##
+ # @ThreadContextProperties:
+diff --git a/target/i386/sev.c b/target/i386/sev.c
+index 9dab4060b8..f4ee317cb0 100644
+--- a/target/i386/sev.c
++++ b/target/i386/sev.c
+@@ -67,6 +67,7 @@ struct SevGuestState {
+     uint32_t cbitpos;
+     uint32_t reduced_phys_bits;
+     bool kernel_hashes;
++    bool legacy_vm_type;
+ 
+     /* runtime state */
+     uint32_t handle;
+@@ -356,6 +357,16 @@ static void sev_guest_set_kernel_hashes(Object *obj, bool value, Error **errp)
+     sev->kernel_hashes = value;
+ }
+ 
++static bool sev_guest_get_legacy_vm_type(Object *obj, Error **errp)
++{
++    return SEV_GUEST(obj)->legacy_vm_type;
++}
++
++static void sev_guest_set_legacy_vm_type(Object *obj, bool value, Error **errp)
++{
++    SEV_GUEST(obj)->legacy_vm_type = value;
++}
++
+ bool
+ sev_enabled(void)
+ {
+@@ -863,7 +874,7 @@ static int sev_kvm_type(X86ConfidentialGuest *cg)
+     }
+ 
+     kvm_type = (sev->policy & SEV_POLICY_ES) ? KVM_X86_SEV_ES_VM : KVM_X86_SEV_VM;
+-    if (kvm_is_vm_type_supported(kvm_type)) {
++    if (kvm_is_vm_type_supported(kvm_type) && !sev->legacy_vm_type) {
+         sev->kvm_type = kvm_type;
+     } else {
+         sev->kvm_type = KVM_X86_DEFAULT_VM;
+@@ -1381,6 +1392,11 @@ sev_guest_class_init(ObjectClass *oc, void *data)
+                                    sev_guest_set_kernel_hashes);
+     object_class_property_set_description(oc, "kernel-hashes",
+             "add kernel hashes to guest firmware for measured Linux boot");
++    object_class_property_add_bool(oc, "legacy-vm-type",
++                                   sev_guest_get_legacy_vm_type,
++                                   sev_guest_set_legacy_vm_type);
++    object_class_property_set_description(oc, "legacy-vm-type",
++            "use legacy VM type to maintain measurement compatibility with older QEMU or kernel versions.");
+ }
+ 
+ static void
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-i386-sev-Add-sev_kvm_init-override-for-SEV-class.patch b/SOURCES/kvm-i386-sev-Add-sev_kvm_init-override-for-SEV-class.patch
new file mode 100644
index 0000000..ca1338c
--- /dev/null
+++ b/SOURCES/kvm-i386-sev-Add-sev_kvm_init-override-for-SEV-class.patch
@@ -0,0 +1,203 @@
+From a236548a903aa8350fff9601d481b2f529c8d4a7 Mon Sep 17 00:00:00 2001
+From: Pankaj Gupta <pankaj.gupta@amd.com>
+Date: Thu, 30 May 2024 06:16:21 -0500
+Subject: [PATCH 061/100] i386/sev: Add sev_kvm_init() override for SEV class
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [61/91] b24fcbc8712e7394e029312229da023c63803969 (bonzini/rhel-qemu-kvm)
+
+Some aspects of the init routine SEV are specific to SEV and not
+applicable for SNP guests, so move the SEV-specific bits into
+separate class method and retain only the common functionality.
+
+Co-developed-by: Michael Roth <michael.roth@amd.com>
+Signed-off-by: Michael Roth <michael.roth@amd.com>
+Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com>
+Message-ID: <20240530111643.1091816-10-pankaj.gupta@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 990da8d243a8c59dafcbed78b56a0e4ffb1605d9)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ target/i386/sev.c | 72 +++++++++++++++++++++++++++++++++--------------
+ 1 file changed, 51 insertions(+), 21 deletions(-)
+
+diff --git a/target/i386/sev.c b/target/i386/sev.c
+index 4edfedc139..5519de1c6b 100644
+--- a/target/i386/sev.c
++++ b/target/i386/sev.c
+@@ -73,6 +73,7 @@ struct SevCommonStateClass {
+     /* public */
+     int (*launch_start)(SevCommonState *sev_common);
+     void (*launch_finish)(SevCommonState *sev_common);
++    int (*kvm_init)(ConfidentialGuestSupport *cgs, Error **errp);
+ };
+ 
+ /**
+@@ -882,7 +883,7 @@ out:
+     return sev_common->kvm_type;
+ }
+ 
+-static int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
++static int sev_common_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
+ {
+     SevCommonState *sev_common = SEV_COMMON(cgs);
+     char *devname;
+@@ -892,12 +893,6 @@ static int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
+     struct sev_user_data_status status = {};
+     SevCommonStateClass *klass = SEV_COMMON_GET_CLASS(cgs);
+ 
+-    ret = ram_block_discard_disable(true);
+-    if (ret) {
+-        error_report("%s: cannot disable RAM discard", __func__);
+-        return -1;
+-    }
+-
+     sev_common->state = SEV_STATE_UNINIT;
+ 
+     host_cpuid(0x8000001F, 0, NULL, &ebx, NULL, NULL);
+@@ -911,7 +906,7 @@ static int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
+     if (host_cbitpos != sev_common->cbitpos) {
+         error_setg(errp, "%s: cbitpos check failed, host '%d' requested '%d'",
+                    __func__, host_cbitpos, sev_common->cbitpos);
+-        goto err;
++        return -1;
+     }
+ 
+     /*
+@@ -924,7 +919,7 @@ static int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
+         error_setg(errp, "%s: reduced_phys_bits check failed,"
+                    " it should be in the range of 1 to 63, requested '%d'",
+                    __func__, sev_common->reduced_phys_bits);
+-        goto err;
++        return -1;
+     }
+ 
+     devname = object_property_get_str(OBJECT(sev_common), "sev-device", NULL);
+@@ -933,7 +928,7 @@ static int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
+         error_setg(errp, "%s: Failed to open %s '%s'", __func__,
+                    devname, strerror(errno));
+         g_free(devname);
+-        goto err;
++        return -1;
+     }
+     g_free(devname);
+ 
+@@ -943,7 +938,7 @@ static int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
+         error_setg(errp, "%s: failed to get platform status ret=%d "
+                    "fw_error='%d: %s'", __func__, ret, fw_error,
+                    fw_error_to_str(fw_error));
+-        goto err;
++        return -1;
+     }
+     sev_common->build_id = status.build;
+     sev_common->api_major = status.api_major;
+@@ -953,7 +948,7 @@ static int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
+         if (!kvm_kernel_irqchip_allowed()) {
+             error_setg(errp, "%s: SEV-ES guests require in-kernel irqchip"
+                        "support", __func__);
+-            goto err;
++            return -1;
+         }
+     }
+ 
+@@ -962,7 +957,7 @@ static int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
+             error_setg(errp, "%s: guest policy requires SEV-ES, but "
+                          "host SEV-ES support unavailable",
+                          __func__);
+-            goto err;
++            return -1;
+         }
+     }
+ 
+@@ -980,25 +975,59 @@ static int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
+     if (ret) {
+         error_setg(errp, "%s: failed to initialize ret=%d fw_error=%d '%s'",
+                    __func__, ret, fw_error, fw_error_to_str(fw_error));
+-        goto err;
++        return -1;
+     }
+ 
+     ret = klass->launch_start(sev_common);
+     if (ret) {
+         error_setg(errp, "%s: failed to create encryption context", __func__);
+-        goto err;
++        return -1;
++    }
++
++    if (klass->kvm_init && klass->kvm_init(cgs, errp)) {
++        return -1;
+     }
+ 
+-    ram_block_notifier_add(&sev_ram_notifier);
+-    qemu_add_machine_init_done_notifier(&sev_machine_done_notify);
+     qemu_add_vm_change_state_handler(sev_vm_state_change, sev_common);
+ 
+     cgs->ready = true;
+ 
+     return 0;
+-err:
+-    ram_block_discard_disable(false);
+-    return -1;
++}
++
++static int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
++{
++     int ret;
++
++    /*
++     * SEV/SEV-ES rely on pinned memory to back guest RAM so discarding
++     * isn't actually possible. With SNP, only guest_memfd pages are used
++     * for private guest memory, so discarding of shared memory is still
++     * possible..
++     */
++    ret = ram_block_discard_disable(true);
++    if (ret) {
++        error_setg(errp, "%s: cannot disable RAM discard", __func__);
++        return -1;
++    }
++
++    /*
++     * SEV uses these notifiers to register/pin pages prior to guest use,
++     * but SNP relies on guest_memfd for private pages, which has its
++     * own internal mechanisms for registering/pinning private memory.
++     */
++    ram_block_notifier_add(&sev_ram_notifier);
++
++    /*
++     * The machine done notify event is used for SEV guests to get the
++     * measurement of the encrypted images. When SEV-SNP is enabled, the
++     * measurement is part of the guest attestation process where it can
++     * be collected without any reliance on the VMM. So skip registering
++     * the notifier for SNP in favor of using guest attestation instead.
++     */
++    qemu_add_machine_init_done_notifier(&sev_machine_done_notify);
++
++    return 0;
+ }
+ 
+ int
+@@ -1397,7 +1426,7 @@ sev_common_class_init(ObjectClass *oc, void *data)
+     ConfidentialGuestSupportClass *klass = CONFIDENTIAL_GUEST_SUPPORT_CLASS(oc);
+     X86ConfidentialGuestClass *x86_klass = X86_CONFIDENTIAL_GUEST_CLASS(oc);
+ 
+-    klass->kvm_init = sev_kvm_init;
++    klass->kvm_init = sev_common_kvm_init;
+     x86_klass->kvm_type = sev_kvm_type;
+ 
+     object_class_property_add_str(oc, "sev-device",
+@@ -1486,6 +1515,7 @@ sev_guest_class_init(ObjectClass *oc, void *data)
+ 
+     klass->launch_start = sev_launch_start;
+     klass->launch_finish = sev_launch_finish;
++    klass->kvm_init = sev_kvm_init;
+ 
+     object_class_property_add_str(oc, "dh-cert-file",
+                                   sev_guest_get_dh_cert_file,
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-i386-sev-Add-snp_kvm_init-override-for-SNP-class.patch b/SOURCES/kvm-i386-sev-Add-snp_kvm_init-override-for-SNP-class.patch
new file mode 100644
index 0000000..0db345c
--- /dev/null
+++ b/SOURCES/kvm-i386-sev-Add-snp_kvm_init-override-for-SNP-class.patch
@@ -0,0 +1,94 @@
+From 35ceebdeccbf5dceb374c6f89a12e9981def570b Mon Sep 17 00:00:00 2001
+From: Pankaj Gupta <pankaj.gupta@amd.com>
+Date: Thu, 30 May 2024 06:16:22 -0500
+Subject: [PATCH 062/100] i386/sev: Add snp_kvm_init() override for SNP class
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [62/91] 8fa537961c9262b99a4ffb99e1c25f080d76d1de (bonzini/rhel-qemu-kvm)
+
+SNP does not support SMM and requires guest_memfd for
+private guest memory, so add SNP specific kvm_init()
+functionality in snp_kvm_init() class method.
+
+Signed-off-by: Michael Roth <michael.roth@amd.com>
+Co-developed-by: Pankaj Gupta <pankaj.gupta@amd.com>
+Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com>
+Message-ID: <20240530111643.1091816-11-pankaj.gupta@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 125b95a6d465a03ff30816eff0b1889aec01f0c3)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ target/i386/sev.c | 24 +++++++++++++++++++++++-
+ 1 file changed, 23 insertions(+), 1 deletion(-)
+
+diff --git a/target/i386/sev.c b/target/i386/sev.c
+index 5519de1c6b..6525b3c1a0 100644
+--- a/target/i386/sev.c
++++ b/target/i386/sev.c
+@@ -885,12 +885,12 @@ out:
+ 
+ static int sev_common_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
+ {
+-    SevCommonState *sev_common = SEV_COMMON(cgs);
+     char *devname;
+     int ret, fw_error, cmd;
+     uint32_t ebx;
+     uint32_t host_cbitpos;
+     struct sev_user_data_status status = {};
++    SevCommonState *sev_common = SEV_COMMON(cgs);
+     SevCommonStateClass *klass = SEV_COMMON_GET_CLASS(cgs);
+ 
+     sev_common->state = SEV_STATE_UNINIT;
+@@ -1030,6 +1030,21 @@ static int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
+     return 0;
+ }
+ 
++static int sev_snp_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
++{
++    MachineState *ms = MACHINE(qdev_get_machine());
++    X86MachineState *x86ms = X86_MACHINE(ms);
++
++    if (x86ms->smm == ON_OFF_AUTO_AUTO) {
++        x86ms->smm = ON_OFF_AUTO_OFF;
++    } else if (x86ms->smm == ON_OFF_AUTO_ON) {
++        error_setg(errp, "SEV-SNP does not support SMM.");
++        return -1;
++    }
++
++    return 0;
++}
++
+ int
+ sev_encrypt_flash(uint8_t *ptr, uint64_t len, Error **errp)
+ {
+@@ -1752,6 +1767,10 @@ sev_snp_guest_set_host_data(Object *obj, const char *value, Error **errp)
+ static void
+ sev_snp_guest_class_init(ObjectClass *oc, void *data)
+ {
++    SevCommonStateClass *klass = SEV_COMMON_CLASS(oc);
++
++    klass->kvm_init = sev_snp_kvm_init;
++
+     object_class_property_add(oc, "policy", "uint64",
+                               sev_snp_guest_get_policy,
+                               sev_snp_guest_set_policy, NULL, NULL);
+@@ -1778,8 +1797,11 @@ sev_snp_guest_class_init(ObjectClass *oc, void *data)
+ static void
+ sev_snp_guest_instance_init(Object *obj)
+ {
++    ConfidentialGuestSupport *cgs = CONFIDENTIAL_GUEST_SUPPORT(obj);
+     SevSnpGuestState *sev_snp_guest = SEV_SNP_GUEST(obj);
+ 
++    cgs->require_guest_memfd = true;
++
+     /* default init/start/finish params for kvm */
+     sev_snp_guest->kvm_start_conf.policy = DEFAULT_SEV_SNP_POLICY;
+ }
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-i386-sev-Add-support-for-SNP-CPUID-validation.patch b/SOURCES/kvm-i386-sev-Add-support-for-SNP-CPUID-validation.patch
new file mode 100644
index 0000000..c10f75f
--- /dev/null
+++ b/SOURCES/kvm-i386-sev-Add-support-for-SNP-CPUID-validation.patch
@@ -0,0 +1,262 @@
+From 4013364679757161d6b9754bfc33ae38be0a1b7f Mon Sep 17 00:00:00 2001
+From: Michael Roth <michael.roth@amd.com>
+Date: Thu, 30 May 2024 06:16:32 -0500
+Subject: [PATCH 072/100] i386/sev: Add support for SNP CPUID validation
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [72/91] 080e2942552dc7de8966e69d0d0d3b8951392030 (bonzini/rhel-qemu-kvm)
+
+SEV-SNP firmware allows a special guest page to be populated with a
+table of guest CPUID values so that they can be validated through
+firmware before being loaded into encrypted guest memory where they can
+be used in place of hypervisor-provided values[1].
+
+As part of SEV-SNP guest initialization, use this interface to validate
+the CPUID entries reported by KVM_GET_CPUID2 prior to initial guest
+start and populate the CPUID page reserved by OVMF with the resulting
+encrypted data.
+
+[1] SEV SNP Firmware ABI Specification, Rev. 0.8, 8.13.2.6
+
+Signed-off-by: Michael Roth <michael.roth@amd.com>
+Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com>
+Message-ID: <20240530111643.1091816-21-pankaj.gupta@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 70943ad8e4dfbe5f77006b880290219be9d03553)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ target/i386/sev.c | 164 +++++++++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 162 insertions(+), 2 deletions(-)
+
+diff --git a/target/i386/sev.c b/target/i386/sev.c
+index c57534fca2..06401f0526 100644
+--- a/target/i386/sev.c
++++ b/target/i386/sev.c
+@@ -200,6 +200,36 @@ static const char *const sev_fw_errlist[] = {
+ 
+ #define SEV_FW_MAX_ERROR      ARRAY_SIZE(sev_fw_errlist)
+ 
++/* <linux/kvm.h> doesn't expose this, so re-use the max from kvm.c */
++#define KVM_MAX_CPUID_ENTRIES 100
++
++typedef struct KvmCpuidInfo {
++    struct kvm_cpuid2 cpuid;
++    struct kvm_cpuid_entry2 entries[KVM_MAX_CPUID_ENTRIES];
++} KvmCpuidInfo;
++
++#define SNP_CPUID_FUNCTION_MAXCOUNT 64
++#define SNP_CPUID_FUNCTION_UNKNOWN 0xFFFFFFFF
++
++typedef struct {
++    uint32_t eax_in;
++    uint32_t ecx_in;
++    uint64_t xcr0_in;
++    uint64_t xss_in;
++    uint32_t eax;
++    uint32_t ebx;
++    uint32_t ecx;
++    uint32_t edx;
++    uint64_t reserved;
++} __attribute__((packed)) SnpCpuidFunc;
++
++typedef struct {
++    uint32_t count;
++    uint32_t reserved1;
++    uint64_t reserved2;
++    SnpCpuidFunc entries[SNP_CPUID_FUNCTION_MAXCOUNT];
++} __attribute__((packed)) SnpCpuidInfo;
++
+ static int
+ sev_ioctl(int fd, int cmd, void *data, int *error)
+ {
+@@ -788,6 +818,35 @@ out:
+     return ret;
+ }
+ 
++static void
++sev_snp_cpuid_report_mismatches(SnpCpuidInfo *old,
++                                SnpCpuidInfo *new)
++{
++    size_t i;
++
++    if (old->count != new->count) {
++        error_report("SEV-SNP: CPUID validation failed due to count mismatch,"
++                     "provided: %d, expected: %d", old->count, new->count);
++        return;
++    }
++
++    for (i = 0; i < old->count; i++) {
++        SnpCpuidFunc *old_func, *new_func;
++
++        old_func = &old->entries[i];
++        new_func = &new->entries[i];
++
++        if (memcmp(old_func, new_func, sizeof(SnpCpuidFunc))) {
++            error_report("SEV-SNP: CPUID validation failed for function 0x%x, index: 0x%x"
++                         "provided: eax:0x%08x, ebx: 0x%08x, ecx: 0x%08x, edx: 0x%08x"
++                         "expected: eax:0x%08x, ebx: 0x%08x, ecx: 0x%08x, edx: 0x%08x",
++                         old_func->eax_in, old_func->ecx_in,
++                         old_func->eax, old_func->ebx, old_func->ecx, old_func->edx,
++                         new_func->eax, new_func->ebx, new_func->ecx, new_func->edx);
++        }
++    }
++}
++
+ static const char *
+ snp_page_type_to_str(int type)
+ {
+@@ -806,6 +865,7 @@ sev_snp_launch_update(SevSnpGuestState *sev_snp_guest,
+                       SevLaunchUpdateData *data)
+ {
+     int ret, fw_error;
++    SnpCpuidInfo snp_cpuid_info;
+     struct kvm_sev_snp_launch_update update = {0};
+ 
+     if (!data->hva || !data->len) {
+@@ -815,6 +875,11 @@ sev_snp_launch_update(SevSnpGuestState *sev_snp_guest,
+         return 1;
+     }
+ 
++    if (data->type == KVM_SEV_SNP_PAGE_TYPE_CPUID) {
++        /* Save a copy for comparison in case the LAUNCH_UPDATE fails */
++        memcpy(&snp_cpuid_info, data->hva, sizeof(snp_cpuid_info));
++    }
++
+     update.uaddr = (__u64)(unsigned long)data->hva;
+     update.gfn_start = data->gpa >> TARGET_PAGE_BITS;
+     update.len = data->len;
+@@ -842,6 +907,11 @@ sev_snp_launch_update(SevSnpGuestState *sev_snp_guest,
+         if (ret && ret != -EAGAIN) {
+             error_report("SNP_LAUNCH_UPDATE ret=%d fw_error=%d '%s'",
+                          ret, fw_error, fw_error_to_str(fw_error));
++
++            if (data->type == KVM_SEV_SNP_PAGE_TYPE_CPUID) {
++                sev_snp_cpuid_report_mismatches(&snp_cpuid_info, data->hva);
++                error_report("SEV-SNP: failed update CPUID page");
++            }
+             break;
+         }
+     }
+@@ -1004,7 +1074,8 @@ sev_launch_finish(SevCommonState *sev_common)
+ }
+ 
+ static int
+-snp_launch_update_data(uint64_t gpa, void *hva, uint32_t len, int type)
++snp_launch_update_data(uint64_t gpa, void *hva,
++                       uint32_t len, int type)
+ {
+     SevLaunchUpdateData *data;
+ 
+@@ -1019,6 +1090,90 @@ snp_launch_update_data(uint64_t gpa, void *hva, uint32_t len, int type)
+     return 0;
+ }
+ 
++static int
++sev_snp_cpuid_info_fill(SnpCpuidInfo *snp_cpuid_info,
++                        const KvmCpuidInfo *kvm_cpuid_info)
++{
++    size_t i;
++
++    if (kvm_cpuid_info->cpuid.nent > SNP_CPUID_FUNCTION_MAXCOUNT) {
++        error_report("SEV-SNP: CPUID entry count (%d) exceeds max (%d)",
++                     kvm_cpuid_info->cpuid.nent, SNP_CPUID_FUNCTION_MAXCOUNT);
++        return -1;
++    }
++
++    memset(snp_cpuid_info, 0, sizeof(*snp_cpuid_info));
++
++    for (i = 0; i < kvm_cpuid_info->cpuid.nent; i++) {
++        const struct kvm_cpuid_entry2 *kvm_cpuid_entry;
++        SnpCpuidFunc *snp_cpuid_entry;
++
++        kvm_cpuid_entry = &kvm_cpuid_info->entries[i];
++        snp_cpuid_entry = &snp_cpuid_info->entries[i];
++
++        snp_cpuid_entry->eax_in = kvm_cpuid_entry->function;
++        if (kvm_cpuid_entry->flags == KVM_CPUID_FLAG_SIGNIFCANT_INDEX) {
++            snp_cpuid_entry->ecx_in = kvm_cpuid_entry->index;
++        }
++        snp_cpuid_entry->eax = kvm_cpuid_entry->eax;
++        snp_cpuid_entry->ebx = kvm_cpuid_entry->ebx;
++        snp_cpuid_entry->ecx = kvm_cpuid_entry->ecx;
++        snp_cpuid_entry->edx = kvm_cpuid_entry->edx;
++
++        /*
++         * Guest kernels will calculate EBX themselves using the 0xD
++         * subfunctions corresponding to the individual XSAVE areas, so only
++         * encode the base XSAVE size in the initial leaves, corresponding
++         * to the initial XCR0=1 state.
++         */
++        if (snp_cpuid_entry->eax_in == 0xD &&
++            (snp_cpuid_entry->ecx_in == 0x0 || snp_cpuid_entry->ecx_in == 0x1)) {
++            snp_cpuid_entry->ebx = 0x240;
++            snp_cpuid_entry->xcr0_in = 1;
++            snp_cpuid_entry->xss_in = 0;
++        }
++    }
++
++    snp_cpuid_info->count = i;
++
++    return 0;
++}
++
++static int
++snp_launch_update_cpuid(uint32_t cpuid_addr, void *hva, uint32_t cpuid_len)
++{
++    KvmCpuidInfo kvm_cpuid_info = {0};
++    SnpCpuidInfo snp_cpuid_info;
++    CPUState *cs = first_cpu;
++    int ret;
++    uint32_t i = 0;
++
++    assert(sizeof(snp_cpuid_info) <= cpuid_len);
++
++    /* get the cpuid list from KVM */
++    do {
++        kvm_cpuid_info.cpuid.nent = ++i;
++        ret = kvm_vcpu_ioctl(cs, KVM_GET_CPUID2, &kvm_cpuid_info);
++    } while (ret == -E2BIG);
++
++    if (ret) {
++        error_report("SEV-SNP: unable to query CPUID values for CPU: '%s'",
++                     strerror(-ret));
++        return 1;
++    }
++
++    ret = sev_snp_cpuid_info_fill(&snp_cpuid_info, &kvm_cpuid_info);
++    if (ret) {
++        error_report("SEV-SNP: failed to generate CPUID table information");
++        return 1;
++    }
++
++    memcpy(hva, &snp_cpuid_info, sizeof(snp_cpuid_info));
++
++    return snp_launch_update_data(cpuid_addr, hva, cpuid_len,
++                                  KVM_SEV_SNP_PAGE_TYPE_CPUID);
++}
++
+ static int
+ snp_metadata_desc_to_page_type(int desc_type)
+ {
+@@ -1053,7 +1208,12 @@ snp_populate_metadata_pages(SevSnpGuestState *sev_snp,
+             exit(1);
+         }
+ 
+-        ret = snp_launch_update_data(desc->base, hva, desc->len, type);
++        if (type == KVM_SEV_SNP_PAGE_TYPE_CPUID) {
++            ret = snp_launch_update_cpuid(desc->base, hva, desc->len);
++        } else {
++            ret = snp_launch_update_data(desc->base, hva, desc->len, type);
++        }
++
+         if (ret) {
+             error_report("%s: Failed to add metadata page gpa 0x%x+%x type %d",
+                          __func__, desc->base, desc->len, desc->type);
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-i386-sev-Add-support-for-populating-OVMF-metadata-pa.patch b/SOURCES/kvm-i386-sev-Add-support-for-populating-OVMF-metadata-pa.patch
new file mode 100644
index 0000000..4691679
--- /dev/null
+++ b/SOURCES/kvm-i386-sev-Add-support-for-populating-OVMF-metadata-pa.patch
@@ -0,0 +1,127 @@
+From b2cfd4d89026e76ba86ea7adea323f2c3a588790 Mon Sep 17 00:00:00 2001
+From: Brijesh Singh <brijesh.singh@amd.com>
+Date: Thu, 30 May 2024 06:16:31 -0500
+Subject: [PATCH 071/100] i386/sev: Add support for populating OVMF metadata
+ pages
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [71/91] b563442c0e2f6ea01937425d300b56d9e641fd57 (bonzini/rhel-qemu-kvm)
+
+OVMF reserves various pages so they can be pre-initialized/validated
+prior to launching the guest. Add support for populating these pages
+with the expected content.
+
+Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
+Signed-off-by: Michael Roth <michael.roth@amd.com>
+Co-developed-by: Pankaj Gupta <pankaj.gupta@amd.com>
+Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com>
+Message-ID: <20240530111643.1091816-20-pankaj.gupta@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 3d8c2a7f4806ff39423312e503737fd76c34dcae)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ target/i386/sev.c | 74 +++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 74 insertions(+)
+
+diff --git a/target/i386/sev.c b/target/i386/sev.c
+index 17281bb2c7..c57534fca2 100644
+--- a/target/i386/sev.c
++++ b/target/i386/sev.c
+@@ -1003,15 +1003,89 @@ sev_launch_finish(SevCommonState *sev_common)
+     migrate_add_blocker(&sev_mig_blocker, &error_fatal);
+ }
+ 
++static int
++snp_launch_update_data(uint64_t gpa, void *hva, uint32_t len, int type)
++{
++    SevLaunchUpdateData *data;
++
++    data = g_new0(SevLaunchUpdateData, 1);
++    data->gpa = gpa;
++    data->hva = hva;
++    data->len = len;
++    data->type = type;
++
++    QTAILQ_INSERT_TAIL(&launch_update, data, next);
++
++    return 0;
++}
++
++static int
++snp_metadata_desc_to_page_type(int desc_type)
++{
++    switch (desc_type) {
++    /* Add the umeasured prevalidated pages as a zero page */
++    case SEV_DESC_TYPE_SNP_SEC_MEM: return KVM_SEV_SNP_PAGE_TYPE_ZERO;
++    case SEV_DESC_TYPE_SNP_SECRETS: return KVM_SEV_SNP_PAGE_TYPE_SECRETS;
++    case SEV_DESC_TYPE_CPUID: return KVM_SEV_SNP_PAGE_TYPE_CPUID;
++    default:
++         return KVM_SEV_SNP_PAGE_TYPE_ZERO;
++    }
++}
++
++static void
++snp_populate_metadata_pages(SevSnpGuestState *sev_snp,
++                            OvmfSevMetadata *metadata)
++{
++    OvmfSevMetadataDesc *desc;
++    int type, ret, i;
++    void *hva;
++    MemoryRegion *mr = NULL;
++
++    for (i = 0; i < metadata->num_desc; i++) {
++        desc = &metadata->descs[i];
++
++        type = snp_metadata_desc_to_page_type(desc->type);
++
++        hva = gpa2hva(&mr, desc->base, desc->len, NULL);
++        if (!hva) {
++            error_report("%s: Failed to get HVA for GPA 0x%x sz 0x%x",
++                         __func__, desc->base, desc->len);
++            exit(1);
++        }
++
++        ret = snp_launch_update_data(desc->base, hva, desc->len, type);
++        if (ret) {
++            error_report("%s: Failed to add metadata page gpa 0x%x+%x type %d",
++                         __func__, desc->base, desc->len, desc->type);
++            exit(1);
++        }
++    }
++}
++
+ static void
+ sev_snp_launch_finish(SevCommonState *sev_common)
+ {
+     int ret, error;
+     Error *local_err = NULL;
++    OvmfSevMetadata *metadata;
+     SevLaunchUpdateData *data;
+     SevSnpGuestState *sev_snp = SEV_SNP_GUEST(sev_common);
+     struct kvm_sev_snp_launch_finish *finish = &sev_snp->kvm_finish_conf;
+ 
++    /*
++     * To boot the SNP guest, the hypervisor is required to populate the CPUID
++     * and Secrets page before finalizing the launch flow. The location of
++     * the secrets and CPUID page is available through the OVMF metadata GUID.
++     */
++    metadata = pc_system_get_ovmf_sev_metadata_ptr();
++    if (metadata == NULL) {
++        error_report("%s: Failed to locate SEV metadata header", __func__);
++        exit(1);
++    }
++
++    /* Populate all the metadata pages */
++    snp_populate_metadata_pages(sev_snp, metadata);
++
+     QTAILQ_FOREACH(data, &launch_update, next) {
+         ret = sev_snp_launch_update(sev_snp, data);
+         if (ret) {
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-i386-sev-Add-the-SNP-launch-start-context.patch b/SOURCES/kvm-i386-sev-Add-the-SNP-launch-start-context.patch
new file mode 100644
index 0000000..5da793f
--- /dev/null
+++ b/SOURCES/kvm-i386-sev-Add-the-SNP-launch-start-context.patch
@@ -0,0 +1,122 @@
+From 0f7432f2b968298b64fd243df793b176f67a538f Mon Sep 17 00:00:00 2001
+From: Brijesh Singh <brijesh.singh@amd.com>
+Date: Thu, 30 May 2024 06:16:27 -0500
+Subject: [PATCH 067/100] i386/sev: Add the SNP launch start context
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [67/91] 63759a25a413a7a9a7274fb4c3b8bc2528634855 (bonzini/rhel-qemu-kvm)
+
+The SNP_LAUNCH_START is called first to create a cryptographic launch
+context within the firmware.
+
+Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
+Signed-off-by: Michael Roth <michael.roth@amd.com>
+Co-developed-by: Pankaj Gupta <pankaj.gupta@amd.com>
+Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com>
+Message-ID: <20240530111643.1091816-16-pankaj.gupta@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit d3107f882ec22cfb211eab7efa0c4e95f5ce11bb)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ target/i386/sev.c        | 39 +++++++++++++++++++++++++++++++++++++++
+ target/i386/trace-events |  1 +
+ 2 files changed, 40 insertions(+)
+
+diff --git a/target/i386/sev.c b/target/i386/sev.c
+index 43d1c48bd9..e89b87d2f5 100644
+--- a/target/i386/sev.c
++++ b/target/i386/sev.c
+@@ -39,6 +39,7 @@
+ #include "confidential-guest.h"
+ #include "hw/i386/pc.h"
+ #include "exec/address-spaces.h"
++#include "qemu/queue.h"
+ 
+ OBJECT_DECLARE_TYPE(SevCommonState, SevCommonStateClass, SEV_COMMON)
+ OBJECT_DECLARE_TYPE(SevGuestState, SevCommonStateClass, SEV_GUEST)
+@@ -115,6 +116,16 @@ struct SevSnpGuestState {
+ #define DEFAULT_SEV_DEVICE      "/dev/sev"
+ #define DEFAULT_SEV_SNP_POLICY  0x30000
+ 
++typedef struct SevLaunchUpdateData {
++    QTAILQ_ENTRY(SevLaunchUpdateData) next;
++    hwaddr gpa;
++    void *hva;
++    uint64_t len;
++    int type;
++} SevLaunchUpdateData;
++
++static QTAILQ_HEAD(, SevLaunchUpdateData) launch_update;
++
+ #define SEV_INFO_BLOCK_GUID     "00f771de-1a7e-4fcb-890e-68c77e2fb44e"
+ typedef struct __attribute__((__packed__)) SevInfoBlock {
+     /* SEV-ES Reset Vector Address */
+@@ -674,6 +685,31 @@ sev_read_file_base64(const char *filename, guchar **data, gsize *len)
+     return 0;
+ }
+ 
++static int
++sev_snp_launch_start(SevCommonState *sev_common)
++{
++    int fw_error, rc;
++    SevSnpGuestState *sev_snp_guest = SEV_SNP_GUEST(sev_common);
++    struct kvm_sev_snp_launch_start *start = &sev_snp_guest->kvm_start_conf;
++
++    trace_kvm_sev_snp_launch_start(start->policy,
++                                   sev_snp_guest->guest_visible_workarounds);
++
++    rc = sev_ioctl(sev_common->sev_fd, KVM_SEV_SNP_LAUNCH_START,
++                   start, &fw_error);
++    if (rc < 0) {
++        error_report("%s: SNP_LAUNCH_START ret=%d fw_error=%d '%s'",
++                __func__, rc, fw_error, fw_error_to_str(fw_error));
++        return 1;
++    }
++
++    QTAILQ_INIT(&launch_update);
++
++    sev_set_guest_state(sev_common, SEV_STATE_LAUNCH_UPDATE);
++
++    return 0;
++}
++
+ static int
+ sev_launch_start(SevCommonState *sev_common)
+ {
+@@ -1003,6 +1039,7 @@ static int sev_common_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
+     }
+ 
+     ret = klass->launch_start(sev_common);
++
+     if (ret) {
+         error_setg(errp, "%s: failed to create encryption context", __func__);
+         return -1;
+@@ -1794,9 +1831,11 @@ sev_snp_guest_class_init(ObjectClass *oc, void *data)
+     SevCommonStateClass *klass = SEV_COMMON_CLASS(oc);
+     X86ConfidentialGuestClass *x86_klass = X86_CONFIDENTIAL_GUEST_CLASS(oc);
+ 
++    klass->launch_start = sev_snp_launch_start;
+     klass->kvm_init = sev_snp_kvm_init;
+     x86_klass->kvm_type = sev_snp_kvm_type;
+ 
++
+     object_class_property_add(oc, "policy", "uint64",
+                               sev_snp_guest_get_policy,
+                               sev_snp_guest_set_policy, NULL, NULL);
+diff --git a/target/i386/trace-events b/target/i386/trace-events
+index 2cd8726eeb..cb26d8a925 100644
+--- a/target/i386/trace-events
++++ b/target/i386/trace-events
+@@ -11,3 +11,4 @@ kvm_sev_launch_measurement(const char *value) "data %s"
+ kvm_sev_launch_finish(void) ""
+ kvm_sev_launch_secret(uint64_t hpa, uint64_t hva, uint64_t secret, int len) "hpa 0x%" PRIx64 " hva 0x%" PRIx64 " data 0x%" PRIx64 " len %d"
+ kvm_sev_attestation_report(const char *mnonce, const char *data) "mnonce %s data %s"
++kvm_sev_snp_launch_start(uint64_t policy, char *gosvw) "policy 0x%" PRIx64 " gosvw %s"
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-i386-sev-Allow-measured-direct-kernel-boot-on-SNP.patch b/SOURCES/kvm-i386-sev-Allow-measured-direct-kernel-boot-on-SNP.patch
new file mode 100644
index 0000000..f809242
--- /dev/null
+++ b/SOURCES/kvm-i386-sev-Allow-measured-direct-kernel-boot-on-SNP.patch
@@ -0,0 +1,237 @@
+From ec786a1ec0a76775e980862d77500f5196a937e3 Mon Sep 17 00:00:00 2001
+From: Dov Murik <dovmurik@linux.ibm.com>
+Date: Thu, 30 May 2024 06:16:35 -0500
+Subject: [PATCH 080/100] i386/sev: Allow measured direct kernel boot on SNP
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [80/91] 11c629862519c1a279566febf5a537c63c5fcf61 (bonzini/rhel-qemu-kvm)
+
+In SNP, the hashes page designated with a specific metadata entry
+published in AmdSev OVMF.
+
+Therefore, if the user enabled kernel hashes (for measured direct boot),
+QEMU should prepare the content of hashes table, and during the
+processing of the metadata entry it copy the content into the designated
+page and encrypt it.
+
+Note that in SNP (unlike SEV and SEV-ES) the measurements is done in
+whole 4KB pages.  Therefore QEMU zeros the whole page that includes the
+hashes table, and fills in the kernel hashes area in that page, and then
+encrypts the whole page.  The rest of the page is reserved for SEV
+launch secrets which are not usable anyway on SNP.
+
+If the user disabled kernel hashes, QEMU pre-validates the kernel hashes
+page as a zero page.
+
+Signed-off-by: Dov Murik <dovmurik@linux.ibm.com>
+Signed-off-by: Michael Roth <michael.roth@amd.com>
+Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com>
+Message-ID: <20240530111643.1091816-24-pankaj.gupta@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit c1996992cc882b00139f78067d6a64e2ec9cb0d8)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ include/hw/i386/pc.h |   2 +
+ target/i386/sev.c    | 111 ++++++++++++++++++++++++++++++++-----------
+ 2 files changed, 85 insertions(+), 28 deletions(-)
+
+diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
+index 94b49310f5..ee3bfb7be9 100644
+--- a/include/hw/i386/pc.h
++++ b/include/hw/i386/pc.h
+@@ -175,6 +175,8 @@ typedef enum {
+     SEV_DESC_TYPE_SNP_SECRETS,
+     /* The section contains address that can be used as a CPUID page */
+     SEV_DESC_TYPE_CPUID,
++    /* The section contains the region for kernel hashes for measured direct boot */
++    SEV_DESC_TYPE_SNP_KERNEL_HASHES = 0x10,
+ 
+ } ovmf_sev_metadata_desc_type;
+ 
+diff --git a/target/i386/sev.c b/target/i386/sev.c
+index 3fce4c08eb..004c667ac1 100644
+--- a/target/i386/sev.c
++++ b/target/i386/sev.c
+@@ -115,6 +115,10 @@ struct SevCommonStateClass {
+     X86ConfidentialGuestClass parent_class;
+ 
+     /* public */
++    bool (*build_kernel_loader_hashes)(SevCommonState *sev_common,
++                                       SevHashTableDescriptor *area,
++                                       SevKernelLoaderContext *ctx,
++                                       Error **errp);
+     int (*launch_start)(SevCommonState *sev_common);
+     void (*launch_finish)(SevCommonState *sev_common);
+     int (*launch_update_data)(SevCommonState *sev_common, hwaddr gpa, uint8_t *ptr, uint64_t len);
+@@ -154,6 +158,9 @@ struct SevSnpGuestState {
+ 
+     struct kvm_sev_snp_launch_start kvm_start_conf;
+     struct kvm_sev_snp_launch_finish kvm_finish_conf;
++
++    uint32_t kernel_hashes_offset;
++    PaddedSevHashTable *kernel_hashes_data;
+ };
+ 
+ #define DEFAULT_GUEST_POLICY    0x1 /* disable debug */
+@@ -1189,6 +1196,23 @@ snp_launch_update_cpuid(uint32_t cpuid_addr, void *hva, uint32_t cpuid_len)
+                                   KVM_SEV_SNP_PAGE_TYPE_CPUID);
+ }
+ 
++static int
++snp_launch_update_kernel_hashes(SevSnpGuestState *sev_snp, uint32_t addr,
++                                void *hva, uint32_t len)
++{
++    int type = KVM_SEV_SNP_PAGE_TYPE_ZERO;
++    if (sev_snp->parent_obj.kernel_hashes) {
++        assert(sev_snp->kernel_hashes_data);
++        assert((sev_snp->kernel_hashes_offset +
++                sizeof(*sev_snp->kernel_hashes_data)) <= len);
++        memset(hva, 0, len);
++        memcpy(hva + sev_snp->kernel_hashes_offset, sev_snp->kernel_hashes_data,
++               sizeof(*sev_snp->kernel_hashes_data));
++        type = KVM_SEV_SNP_PAGE_TYPE_NORMAL;
++    }
++    return snp_launch_update_data(addr, hva, len, type);
++}
++
+ static int
+ snp_metadata_desc_to_page_type(int desc_type)
+ {
+@@ -1225,6 +1249,9 @@ snp_populate_metadata_pages(SevSnpGuestState *sev_snp,
+ 
+         if (type == KVM_SEV_SNP_PAGE_TYPE_CPUID) {
+             ret = snp_launch_update_cpuid(desc->base, hva, desc->len);
++        } else if (desc->type == SEV_DESC_TYPE_SNP_KERNEL_HASHES) {
++            ret = snp_launch_update_kernel_hashes(sev_snp, desc->base, hva,
++                                                  desc->len);
+         } else {
+             ret = snp_launch_update_data(desc->base, hva, desc->len, type);
+         }
+@@ -1823,6 +1850,58 @@ static bool build_kernel_loader_hashes(PaddedSevHashTable *padded_ht,
+     return true;
+ }
+ 
++static bool sev_snp_build_kernel_loader_hashes(SevCommonState *sev_common,
++                                               SevHashTableDescriptor *area,
++                                               SevKernelLoaderContext *ctx,
++                                               Error **errp)
++{
++    /*
++     * SNP: Populate the hashes table in an area that later in
++     * snp_launch_update_kernel_hashes() will be copied to the guest memory
++     * and encrypted.
++     */
++    SevSnpGuestState *sev_snp_guest = SEV_SNP_GUEST(sev_common);
++    sev_snp_guest->kernel_hashes_offset = area->base & ~TARGET_PAGE_MASK;
++    sev_snp_guest->kernel_hashes_data = g_new0(PaddedSevHashTable, 1);
++    return build_kernel_loader_hashes(sev_snp_guest->kernel_hashes_data, ctx, errp);
++}
++
++static bool sev_build_kernel_loader_hashes(SevCommonState *sev_common,
++                                           SevHashTableDescriptor *area,
++                                           SevKernelLoaderContext *ctx,
++                                           Error **errp)
++{
++    PaddedSevHashTable *padded_ht;
++    hwaddr mapped_len = sizeof(*padded_ht);
++    MemTxAttrs attrs = { 0 };
++    bool ret = true;
++
++    /*
++     * Populate the hashes table in the guest's memory at the OVMF-designated
++     * area for the SEV hashes table
++     */
++    padded_ht = address_space_map(&address_space_memory, area->base,
++                                  &mapped_len, true, attrs);
++    if (!padded_ht || mapped_len != sizeof(*padded_ht)) {
++        error_setg(errp, "SEV: cannot map hashes table guest memory area");
++        return false;
++    }
++
++    if (build_kernel_loader_hashes(padded_ht, ctx, errp)) {
++        if (sev_encrypt_flash(area->base, (uint8_t *)padded_ht,
++                              sizeof(*padded_ht), errp) < 0) {
++            ret = false;
++        }
++    } else {
++        ret = false;
++    }
++
++    address_space_unmap(&address_space_memory, padded_ht,
++                        mapped_len, true, mapped_len);
++
++    return ret;
++}
++
+ /*
+  * Add the hashes of the linux kernel/initrd/cmdline to an encrypted guest page
+  * which is included in SEV's initial memory measurement.
+@@ -1831,11 +1910,8 @@ bool sev_add_kernel_loader_hashes(SevKernelLoaderContext *ctx, Error **errp)
+ {
+     uint8_t *data;
+     SevHashTableDescriptor *area;
+-    PaddedSevHashTable *padded_ht;
+-    hwaddr mapped_len = sizeof(*padded_ht);
+-    MemTxAttrs attrs = { 0 };
+-    bool ret = true;
+     SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs);
++    SevCommonStateClass *klass = SEV_COMMON_GET_CLASS(sev_common);
+ 
+     /*
+      * Only add the kernel hashes if the sev-guest configuration explicitly
+@@ -1858,30 +1934,7 @@ bool sev_add_kernel_loader_hashes(SevKernelLoaderContext *ctx, Error **errp)
+         return false;
+     }
+ 
+-    /*
+-     * Populate the hashes table in the guest's memory at the OVMF-designated
+-     * area for the SEV hashes table
+-     */
+-    padded_ht = address_space_map(&address_space_memory, area->base,
+-                                  &mapped_len, true, attrs);
+-    if (!padded_ht || mapped_len != sizeof(*padded_ht)) {
+-        error_setg(errp, "SEV: cannot map hashes table guest memory area");
+-        return false;
+-    }
+-
+-    if (build_kernel_loader_hashes(padded_ht, ctx, errp)) {
+-        if (sev_encrypt_flash(area->base, (uint8_t *)padded_ht,
+-                              sizeof(*padded_ht), errp) < 0) {
+-            ret = false;
+-        }
+-    } else {
+-        ret = false;
+-    }
+-
+-    address_space_unmap(&address_space_memory, padded_ht,
+-                        mapped_len, true, mapped_len);
+-
+-    return ret;
++    return klass->build_kernel_loader_hashes(sev_common, area, ctx, errp);
+ }
+ 
+ static char *
+@@ -1998,6 +2051,7 @@ sev_guest_class_init(ObjectClass *oc, void *data)
+     SevCommonStateClass *klass = SEV_COMMON_CLASS(oc);
+     X86ConfidentialGuestClass *x86_klass = X86_CONFIDENTIAL_GUEST_CLASS(oc);
+ 
++    klass->build_kernel_loader_hashes = sev_build_kernel_loader_hashes;
+     klass->launch_start = sev_launch_start;
+     klass->launch_finish = sev_launch_finish;
+     klass->launch_update_data = sev_launch_update_data;
+@@ -2242,6 +2296,7 @@ sev_snp_guest_class_init(ObjectClass *oc, void *data)
+     SevCommonStateClass *klass = SEV_COMMON_CLASS(oc);
+     X86ConfidentialGuestClass *x86_klass = X86_CONFIDENTIAL_GUEST_CLASS(oc);
+ 
++    klass->build_kernel_loader_hashes = sev_snp_build_kernel_loader_hashes;
+     klass->launch_start = sev_snp_launch_start;
+     klass->launch_finish = sev_snp_launch_finish;
+     klass->launch_update_data = sev_snp_launch_update_data;
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-i386-sev-Don-t-allow-automatic-fallback-to-legacy-KV.patch b/SOURCES/kvm-i386-sev-Don-t-allow-automatic-fallback-to-legacy-KV.patch
new file mode 100644
index 0000000..aacb0da
--- /dev/null
+++ b/SOURCES/kvm-i386-sev-Don-t-allow-automatic-fallback-to-legacy-KV.patch
@@ -0,0 +1,268 @@
+From ab6197309551bd6ddd9f8239191f68dfac23684b Mon Sep 17 00:00:00 2001
+From: Michael Roth <michael.roth@amd.com>
+Date: Tue, 9 Jul 2024 23:10:05 -0500
+Subject: [PATCH 090/100] i386/sev: Don't allow automatic fallback to legacy
+ KVM_SEV*_INIT
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [90/91] 2b1345faa56f993bb6e13d63e11656c784e20412 (bonzini/rhel-qemu-kvm)
+
+Currently if the 'legacy-vm-type' property of the sev-guest object is
+'on', QEMU will attempt to use the newer KVM_SEV_INIT2 kernel
+interface in conjunction with the newer KVM_X86_SEV_VM and
+KVM_X86_SEV_ES_VM KVM VM types.
+
+This can lead to measurement changes if, for instance, an SEV guest was
+created on a host that originally had an older kernel that didn't
+support KVM_SEV_INIT2, but is booted on the same host later on after the
+host kernel was upgraded.
+
+Instead, if legacy-vm-type is 'off', QEMU should fail if the
+KVM_SEV_INIT2 interface is not provided by the current host kernel.
+Modify the fallback handling accordingly.
+
+In the future, VMSA features and other flags might be added to QEMU
+which will require legacy-vm-type to be 'off' because they will rely
+on the newer KVM_SEV_INIT2 interface. It may be difficult to convey to
+users what values of legacy-vm-type are compatible with which
+features/options, so as part of this rework, switch legacy-vm-type to a
+tri-state OnOffAuto option. 'auto' in this case will automatically
+switch to using the newer KVM_SEV_INIT2, but only if it is required to
+make use of new VMSA features or other options only available via
+KVM_SEV_INIT2.
+
+Defining 'auto' in this way would avoid inadvertantly breaking
+compatibility with older kernels since it would only be used in cases
+where users opt into newer features that are only available via
+KVM_SEV_INIT2 and newer kernels, and provide better default behavior
+than the legacy-vm-type=off behavior that was previously in place, so
+make it the default for 9.1+ machine types.
+
+Cc: Daniel P. Berrangé <berrange@redhat.com>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+cc: kvm@vger.kernel.org
+Signed-off-by: Michael Roth <michael.roth@amd.com>
+Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
+Link: https://lore.kernel.org/r/20240710041005.83720-1-michael.roth@amd.com
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 9d38d9dca2a81aaf5752d45d221021ef96d496cd)
+
+RHEL: adjust compatiility setting, applying it to 9.4 machine type
+---
+ hw/i386/pc.c      |  2 +-
+ qapi/qom.json     | 18 ++++++----
+ target/i386/sev.c | 85 +++++++++++++++++++++++++++++++++++++++--------
+ 3 files changed, 83 insertions(+), 22 deletions(-)
+
+diff --git a/hw/i386/pc.c b/hw/i386/pc.c
+index b25d075b59..e9c5ea5d8f 100644
+--- a/hw/i386/pc.c
++++ b/hw/i386/pc.c
+@@ -352,7 +352,7 @@ const size_t pc_rhel_compat_len = G_N_ELEMENTS(pc_rhel_compat);
+ GlobalProperty pc_rhel_9_5_compat[] = {
+     /* pc_rhel_9_5_compat from pc_compat_pc_9_0 (backported from 9.1) */
+     { TYPE_X86_CPU, "guest-phys-bits", "0" },
+-    { "sev-guest", "legacy-vm-type", "true" },
++    { "sev-guest", "legacy-vm-type", "on" },
+ };
+ const size_t pc_rhel_9_5_compat_len = G_N_ELEMENTS(pc_rhel_9_5_compat);
+ 
+diff --git a/qapi/qom.json b/qapi/qom.json
+index 8bd299265e..17bd5a0cf7 100644
+--- a/qapi/qom.json
++++ b/qapi/qom.json
+@@ -912,12 +912,16 @@
+ # @handle: SEV firmware handle (default: 0)
+ #
+ # @legacy-vm-type: Use legacy KVM_SEV_INIT KVM interface for creating the VM.
+-#                  The newer KVM_SEV_INIT2 interface syncs additional vCPU
+-#                  state when initializing the VMSA structures, which will
+-#                  result in a different guest measurement. Set this to
+-#                  maintain compatibility with older QEMU or kernel versions
+-#                  that rely on legacy KVM_SEV_INIT behavior.
+-#                  (default: false) (since 9.1)
++#                  The newer KVM_SEV_INIT2 interface, from Linux >= 6.10, syncs
++#                  additional vCPU state when initializing the VMSA structures,
++#                  which will result in a different guest measurement. Set
++#                  this to 'on' to force compatibility with older QEMU or kernel
++#                  versions that rely on legacy KVM_SEV_INIT behavior. 'auto'
++#                  will behave identically to 'on', but will automatically
++#                  switch to using KVM_SEV_INIT2 if the user specifies any
++#                  additional options that require it. If set to 'off', QEMU
++#                  will require KVM_SEV_INIT2 unconditionally.
++#                  (default: off) (since 9.1)
+ #
+ # Since: 2.12
+ ##
+@@ -927,7 +931,7 @@
+             '*session-file': 'str',
+             '*policy': 'uint32',
+             '*handle': 'uint32',
+-            '*legacy-vm-type': 'bool' } }
++            '*legacy-vm-type': 'OnOffAuto' } }
+ 
+ ##
+ # @SevSnpGuestProperties:
+diff --git a/target/i386/sev.c b/target/i386/sev.c
+index 491fab74fd..b921defb63 100644
+--- a/target/i386/sev.c
++++ b/target/i386/sev.c
+@@ -144,7 +144,7 @@ struct SevGuestState {
+     uint32_t policy;
+     char *dh_cert_file;
+     char *session_file;
+-    bool legacy_vm_type;
++    OnOffAuto legacy_vm_type;
+ };
+ 
+ struct SevSnpGuestState {
+@@ -1334,6 +1334,17 @@ sev_vm_state_change(void *opaque, bool running, RunState state)
+     }
+ }
+ 
++/*
++ * This helper is to examine sev-guest properties and determine if any options
++ * have been set which rely on the newer KVM_SEV_INIT2 interface and associated
++ * KVM VM types.
++ */
++static bool sev_init2_required(SevGuestState *sev_guest)
++{
++    /* Currently no KVM_SEV_INIT2-specific options are exposed via QEMU */
++    return false;
++}
++
+ static int sev_kvm_type(X86ConfidentialGuest *cg)
+ {
+     SevCommonState *sev_common = SEV_COMMON(cg);
+@@ -1344,14 +1355,39 @@ static int sev_kvm_type(X86ConfidentialGuest *cg)
+         goto out;
+     }
+ 
++    /* These are the only cases where legacy VM types can be used. */
++    if (sev_guest->legacy_vm_type == ON_OFF_AUTO_ON ||
++        (sev_guest->legacy_vm_type == ON_OFF_AUTO_AUTO &&
++         !sev_init2_required(sev_guest))) {
++        sev_common->kvm_type = KVM_X86_DEFAULT_VM;
++        goto out;
++    }
++
++    /*
++     * Newer VM types are required, either explicitly via legacy-vm-type=on, or
++     * implicitly via legacy-vm-type=auto along with additional sev-guest
++     * properties that require the newer VM types.
++     */
+     kvm_type = (sev_guest->policy & SEV_POLICY_ES) ?
+                 KVM_X86_SEV_ES_VM : KVM_X86_SEV_VM;
+-    if (kvm_is_vm_type_supported(kvm_type) && !sev_guest->legacy_vm_type) {
+-        sev_common->kvm_type = kvm_type;
+-    } else {
+-        sev_common->kvm_type = KVM_X86_DEFAULT_VM;
++    if (!kvm_is_vm_type_supported(kvm_type)) {
++        if (sev_guest->legacy_vm_type == ON_OFF_AUTO_AUTO) {
++            error_report("SEV: host kernel does not support requested %s VM type, which is required "
++                         "for the set of options specified. To allow use of the legacy "
++                         "KVM_X86_DEFAULT_VM VM type, please disable any options that are not "
++                         "compatible with the legacy VM type, or upgrade your kernel.",
++                         kvm_type == KVM_X86_SEV_VM ? "KVM_X86_SEV_VM" : "KVM_X86_SEV_ES_VM");
++        } else {
++            error_report("SEV: host kernel does not support requested %s VM type. To allow use of "
++                         "the legacy KVM_X86_DEFAULT_VM VM type, the 'legacy-vm-type' argument "
++                         "must be set to 'on' or 'auto' for the sev-guest object.",
++                         kvm_type == KVM_X86_SEV_VM ? "KVM_X86_SEV_VM" : "KVM_X86_SEV_ES_VM");
++        }
++
++        return -1;
+     }
+ 
++    sev_common->kvm_type = kvm_type;
+ out:
+     return sev_common->kvm_type;
+ }
+@@ -1442,14 +1478,24 @@ static int sev_common_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
+     }
+ 
+     trace_kvm_sev_init();
+-    if (x86_klass->kvm_type(X86_CONFIDENTIAL_GUEST(sev_common)) == KVM_X86_DEFAULT_VM) {
++    switch (x86_klass->kvm_type(X86_CONFIDENTIAL_GUEST(sev_common))) {
++    case KVM_X86_DEFAULT_VM:
+         cmd = sev_es_enabled() ? KVM_SEV_ES_INIT : KVM_SEV_INIT;
+ 
+         ret = sev_ioctl(sev_common->sev_fd, cmd, NULL, &fw_error);
+-    } else {
++        break;
++    case KVM_X86_SEV_VM:
++    case KVM_X86_SEV_ES_VM:
++    case KVM_X86_SNP_VM: {
+         struct kvm_sev_init args = { 0 };
+ 
+         ret = sev_ioctl(sev_common->sev_fd, KVM_SEV_INIT2, &args, &fw_error);
++        break;
++    }
++    default:
++        error_setg(errp, "%s: host kernel does not support the requested SEV configuration.",
++                   __func__);
++        return -1;
+     }
+ 
+     if (ret) {
+@@ -2037,14 +2083,23 @@ sev_guest_set_session_file(Object *obj, const char *value, Error **errp)
+     SEV_GUEST(obj)->session_file = g_strdup(value);
+ }
+ 
+-static bool sev_guest_get_legacy_vm_type(Object *obj, Error **errp)
++static void sev_guest_get_legacy_vm_type(Object *obj, Visitor *v,
++                                         const char *name, void *opaque,
++                                         Error **errp)
+ {
+-    return SEV_GUEST(obj)->legacy_vm_type;
++    SevGuestState *sev_guest = SEV_GUEST(obj);
++    OnOffAuto legacy_vm_type = sev_guest->legacy_vm_type;
++
++    visit_type_OnOffAuto(v, name, &legacy_vm_type, errp);
+ }
+ 
+-static void sev_guest_set_legacy_vm_type(Object *obj, bool value, Error **errp)
++static void sev_guest_set_legacy_vm_type(Object *obj, Visitor *v,
++                                         const char *name, void *opaque,
++                                         Error **errp)
+ {
+-    SEV_GUEST(obj)->legacy_vm_type = value;
++    SevGuestState *sev_guest = SEV_GUEST(obj);
++
++    visit_type_OnOffAuto(v, name, &sev_guest->legacy_vm_type, errp);
+ }
+ 
+ static void
+@@ -2070,9 +2125,9 @@ sev_guest_class_init(ObjectClass *oc, void *data)
+                                   sev_guest_set_session_file);
+     object_class_property_set_description(oc, "session-file",
+             "guest owners session parameters (encoded with base64)");
+-    object_class_property_add_bool(oc, "legacy-vm-type",
+-                                   sev_guest_get_legacy_vm_type,
+-                                   sev_guest_set_legacy_vm_type);
++    object_class_property_add(oc, "legacy-vm-type", "OnOffAuto",
++                              sev_guest_get_legacy_vm_type,
++                              sev_guest_set_legacy_vm_type, NULL, NULL);
+     object_class_property_set_description(oc, "legacy-vm-type",
+             "use legacy VM type to maintain measurement compatibility with older QEMU or kernel versions.");
+ }
+@@ -2088,6 +2143,8 @@ sev_guest_instance_init(Object *obj)
+     object_property_add_uint32_ptr(obj, "policy", &sev_guest->policy,
+                                    OBJ_PROP_FLAG_READWRITE);
+     object_apply_compat_props(obj);
++
++    sev_guest->legacy_vm_type = ON_OFF_AUTO_AUTO;
+ }
+ 
+ /* guest info specific sev/sev-es */
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-i386-sev-Don-t-return-launch-measurements-for-SEV-SN.patch b/SOURCES/kvm-i386-sev-Don-t-return-launch-measurements-for-SEV-SN.patch
new file mode 100644
index 0000000..739a145
--- /dev/null
+++ b/SOURCES/kvm-i386-sev-Don-t-return-launch-measurements-for-SEV-SN.patch
@@ -0,0 +1,46 @@
+From ebb3c3536366c383fa09b0987a4efb68d018b7b8 Mon Sep 17 00:00:00 2001
+From: Michael Roth <michael.roth@amd.com>
+Date: Thu, 30 May 2024 06:16:24 -0500
+Subject: [PATCH 064/100] i386/sev: Don't return launch measurements for
+ SEV-SNP guests
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [64/91] 5a29bb2d8b5a07aec6fd271ec37345e665e9cce4 (bonzini/rhel-qemu-kvm)
+
+For SEV-SNP guests, launch measurement is queried from within the guest
+during attestation, so don't attempt to return it as part of
+query-sev-launch-measure.
+
+Signed-off-by: Michael Roth <michael.roth@amd.com>
+Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com>
+Message-ID: <20240530111643.1091816-13-pankaj.gupta@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 73ae63b162fc1fed520f53ad200712964d7d0264)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ target/i386/sev.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/target/i386/sev.c b/target/i386/sev.c
+index 6525b3c1a0..c3daaf1ad5 100644
+--- a/target/i386/sev.c
++++ b/target/i386/sev.c
+@@ -795,7 +795,9 @@ sev_launch_get_measure(Notifier *notifier, void *unused)
+ 
+ static char *sev_get_launch_measurement(void)
+ {
+-    SevGuestState *sev_guest = SEV_GUEST(MACHINE(qdev_get_machine())->cgs);
++    ConfidentialGuestSupport *cgs = MACHINE(qdev_get_machine())->cgs;
++    SevGuestState *sev_guest =
++        (SevGuestState *)object_dynamic_cast(OBJECT(cgs), TYPE_SEV_GUEST);
+ 
+     if (sev_guest &&
+         SEV_COMMON(sev_guest)->state >= SEV_STATE_LAUNCH_SECRET) {
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-i386-sev-Enable-KVM_HC_MAP_GPA_RANGE-hcall-for-SNP-g.patch b/SOURCES/kvm-i386-sev-Enable-KVM_HC_MAP_GPA_RANGE-hcall-for-SNP-g.patch
new file mode 100644
index 0000000..e438cd3
--- /dev/null
+++ b/SOURCES/kvm-i386-sev-Enable-KVM_HC_MAP_GPA_RANGE-hcall-for-SNP-g.patch
@@ -0,0 +1,54 @@
+From 0612c7ed587422ec7e07c27c8ca11b89c7aa8b02 Mon Sep 17 00:00:00 2001
+From: Michael Roth <michael.roth@amd.com>
+Date: Thu, 30 May 2024 06:16:43 -0500
+Subject: [PATCH 077/100] i386/sev: Enable KVM_HC_MAP_GPA_RANGE hcall for SNP
+ guests
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [77/91] 3c494eb54499c24121cc2c47045626478b8bb41e (bonzini/rhel-qemu-kvm)
+
+KVM will forward GHCB page-state change requests to userspace in the
+form of KVM_HC_MAP_GPA_RANGE, so make sure the hypercall handling is
+enabled for SNP guests.
+
+Signed-off-by: Michael Roth <michael.roth@amd.com>
+Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com>
+Message-ID: <20240530111643.1091816-32-pankaj.gupta@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit e3cddff93c1f88fea3b26841e792dc0be6b6fae8)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ target/i386/sev.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/target/i386/sev.c b/target/i386/sev.c
+index eaf5fc6c6b..abb63062ac 100644
+--- a/target/i386/sev.c
++++ b/target/i386/sev.c
+@@ -14,6 +14,7 @@
+ #include "qemu/osdep.h"
+ 
+ #include <linux/kvm.h>
++#include <linux/kvm_para.h>
+ #include <linux/psp-sev.h>
+ 
+ #include <sys/ioctl.h>
+@@ -758,6 +759,10 @@ sev_snp_launch_start(SevCommonState *sev_common)
+     trace_kvm_sev_snp_launch_start(start->policy,
+                                    sev_snp_guest->guest_visible_workarounds);
+ 
++    if (!kvm_enable_hypercall(BIT_ULL(KVM_HC_MAP_GPA_RANGE))) {
++            return 1;
++    }
++
+     rc = sev_ioctl(sev_common->sev_fd, KVM_SEV_SNP_LAUNCH_START,
+                    start, &fw_error);
+     if (rc < 0) {
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-i386-sev-Extract-build_kernel_loader_hashes.patch b/SOURCES/kvm-i386-sev-Extract-build_kernel_loader_hashes.patch
new file mode 100644
index 0000000..a06301d
--- /dev/null
+++ b/SOURCES/kvm-i386-sev-Extract-build_kernel_loader_hashes.patch
@@ -0,0 +1,167 @@
+From eed17520567c202f53ab767bfd42cfe303838772 Mon Sep 17 00:00:00 2001
+From: Dov Murik <dovmurik@linux.ibm.com>
+Date: Thu, 30 May 2024 06:16:33 -0500
+Subject: [PATCH 078/100] i386/sev: Extract build_kernel_loader_hashes
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [78/91] 291ea10e774178826d1afd38fc8292d67c5fd42d (bonzini/rhel-qemu-kvm)
+
+Extract the building of the kernel hashes table out from
+sev_add_kernel_loader_hashes() to allow building it in
+other memory areas (for SNP support).
+
+No functional change intended.
+
+Signed-off-by: Dov Murik <dovmurik@linux.ibm.com>
+Signed-off-by: Michael Roth <michael.roth@amd.com>
+Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com>
+Message-ID: <20240530111643.1091816-22-pankaj.gupta@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 06cbd66cecaa3230cccb330facac241a677b29d5)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ target/i386/sev.c | 102 ++++++++++++++++++++++++++--------------------
+ 1 file changed, 58 insertions(+), 44 deletions(-)
+
+diff --git a/target/i386/sev.c b/target/i386/sev.c
+index abb63062ac..73f9406715 100644
+--- a/target/i386/sev.c
++++ b/target/i386/sev.c
+@@ -1754,45 +1754,16 @@ static const QemuUUID sev_cmdline_entry_guid = {
+                     0x4d, 0x36, 0xab, 0x2a)
+ };
+ 
+-/*
+- * Add the hashes of the linux kernel/initrd/cmdline to an encrypted guest page
+- * which is included in SEV's initial memory measurement.
+- */
+-bool sev_add_kernel_loader_hashes(SevKernelLoaderContext *ctx, Error **errp)
++static bool build_kernel_loader_hashes(PaddedSevHashTable *padded_ht,
++                                       SevKernelLoaderContext *ctx,
++                                       Error **errp)
+ {
+-    uint8_t *data;
+-    SevHashTableDescriptor *area;
+     SevHashTable *ht;
+-    PaddedSevHashTable *padded_ht;
+     uint8_t cmdline_hash[HASH_SIZE];
+     uint8_t initrd_hash[HASH_SIZE];
+     uint8_t kernel_hash[HASH_SIZE];
+     uint8_t *hashp;
+     size_t hash_len = HASH_SIZE;
+-    hwaddr mapped_len = sizeof(*padded_ht);
+-    MemTxAttrs attrs = { 0 };
+-    bool ret = true;
+-    SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs);
+-
+-    /*
+-     * Only add the kernel hashes if the sev-guest configuration explicitly
+-     * stated kernel-hashes=on.
+-     */
+-    if (!sev_common->kernel_hashes) {
+-        return false;
+-    }
+-
+-    if (!pc_system_ovmf_table_find(SEV_HASH_TABLE_RV_GUID, &data, NULL)) {
+-        error_setg(errp, "SEV: kernel specified but guest firmware "
+-                         "has no hashes table GUID");
+-        return false;
+-    }
+-    area = (SevHashTableDescriptor *)data;
+-    if (!area->base || area->size < sizeof(PaddedSevHashTable)) {
+-        error_setg(errp, "SEV: guest firmware hashes table area is invalid "
+-                         "(base=0x%x size=0x%x)", area->base, area->size);
+-        return false;
+-    }
+ 
+     /*
+      * Calculate hash of kernel command-line with the terminating null byte. If
+@@ -1829,16 +1800,6 @@ bool sev_add_kernel_loader_hashes(SevKernelLoaderContext *ctx, Error **errp)
+     }
+     assert(hash_len == HASH_SIZE);
+ 
+-    /*
+-     * Populate the hashes table in the guest's memory at the OVMF-designated
+-     * area for the SEV hashes table
+-     */
+-    padded_ht = address_space_map(&address_space_memory, area->base,
+-                                  &mapped_len, true, attrs);
+-    if (!padded_ht || mapped_len != sizeof(*padded_ht)) {
+-        error_setg(errp, "SEV: cannot map hashes table guest memory area");
+-        return false;
+-    }
+     ht = &padded_ht->ht;
+ 
+     ht->guid = sev_hash_table_header_guid;
+@@ -1859,8 +1820,61 @@ bool sev_add_kernel_loader_hashes(SevKernelLoaderContext *ctx, Error **errp)
+     /* zero the excess data so the measurement can be reliably calculated */
+     memset(padded_ht->padding, 0, sizeof(padded_ht->padding));
+ 
+-    if (sev_encrypt_flash(area->base, (uint8_t *)padded_ht,
+-                          sizeof(*padded_ht), errp) < 0) {
++    return true;
++}
++
++/*
++ * Add the hashes of the linux kernel/initrd/cmdline to an encrypted guest page
++ * which is included in SEV's initial memory measurement.
++ */
++bool sev_add_kernel_loader_hashes(SevKernelLoaderContext *ctx, Error **errp)
++{
++    uint8_t *data;
++    SevHashTableDescriptor *area;
++    PaddedSevHashTable *padded_ht;
++    hwaddr mapped_len = sizeof(*padded_ht);
++    MemTxAttrs attrs = { 0 };
++    bool ret = true;
++    SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs);
++
++    /*
++     * Only add the kernel hashes if the sev-guest configuration explicitly
++     * stated kernel-hashes=on.
++     */
++    if (!sev_common->kernel_hashes) {
++        return false;
++    }
++
++    if (!pc_system_ovmf_table_find(SEV_HASH_TABLE_RV_GUID, &data, NULL)) {
++        error_setg(errp, "SEV: kernel specified but guest firmware "
++                         "has no hashes table GUID");
++        return false;
++    }
++
++    area = (SevHashTableDescriptor *)data;
++    if (!area->base || area->size < sizeof(PaddedSevHashTable)) {
++        error_setg(errp, "SEV: guest firmware hashes table area is invalid "
++                         "(base=0x%x size=0x%x)", area->base, area->size);
++        return false;
++    }
++
++    /*
++     * Populate the hashes table in the guest's memory at the OVMF-designated
++     * area for the SEV hashes table
++     */
++    padded_ht = address_space_map(&address_space_memory, area->base,
++                                  &mapped_len, true, attrs);
++    if (!padded_ht || mapped_len != sizeof(*padded_ht)) {
++        error_setg(errp, "SEV: cannot map hashes table guest memory area");
++        return false;
++    }
++
++    if (build_kernel_loader_hashes(padded_ht, ctx, errp)) {
++        if (sev_encrypt_flash(area->base, (uint8_t *)padded_ht,
++                              sizeof(*padded_ht), errp) < 0) {
++            ret = false;
++        }
++    } else {
+         ret = false;
+     }
+ 
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-i386-sev-Fallback-to-the-default-SEV-device-if-none-.patch b/SOURCES/kvm-i386-sev-Fallback-to-the-default-SEV-device-if-none-.patch
new file mode 100644
index 0000000..1d30674
--- /dev/null
+++ b/SOURCES/kvm-i386-sev-Fallback-to-the-default-SEV-device-if-none-.patch
@@ -0,0 +1,65 @@
+From a9530c89225fce9e381929c4cd8e372068827acf Mon Sep 17 00:00:00 2001
+From: Michal Privoznik <mprivozn@redhat.com>
+Date: Mon, 24 Jun 2024 10:52:49 +0200
+Subject: [PATCH 089/100] i386/sev: Fallback to the default SEV device if none
+ provided in sev_get_capabilities()
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [89/91] 22318c20d7102815f754cec0efaf383e05ef79c1 (bonzini/rhel-qemu-kvm)
+
+When management tools (e.g. libvirt) query QEMU capabilities,
+they start QEMU with a minimalistic configuration and issue
+various commands on monitor. One of the command issued is/might
+be "query-sev-capabilities" to learn values like cbitpos or
+reduced-phys-bits. But as of v9.0.0-1145-g16dcf200dc the monitor
+command returns an error instead.
+
+This creates a chicken-egg problem because in order to query
+those aforementioned values QEMU needs to be started with a
+'sev-guest' object. But to start QEMU with the values must be
+known.
+
+I think it's safe to assume that the default path ("/dev/sev")
+provides the same data as user provided one. So fall back to it.
+
+Fixes: 16dcf200dc951c1cde3e5b442457db5f690b8cf0
+Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
+Link: https://lore.kernel.org/r/157f93712c23818be193ce785f648f0060b33dee.1719218926.git.mprivozn@redhat.com
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 3fb24530b2bb1346a44e17becefc9865b40a2257)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ target/i386/sev.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/target/i386/sev.c b/target/i386/sev.c
+index 53b7f7315b..491fab74fd 100644
+--- a/target/i386/sev.c
++++ b/target/i386/sev.c
+@@ -585,13 +585,13 @@ static SevCapability *sev_get_capabilities(Error **errp)
+     }
+ 
+     sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs);
+-    if (!sev_common) {
+-        error_setg(errp, "SEV is not configured");
+-        return NULL;
++    if (sev_common) {
++        sev_device = object_property_get_str(OBJECT(sev_common), "sev-device",
++                                             &error_abort);
++    } else {
++        sev_device = g_strdup(DEFAULT_SEV_DEVICE);
+     }
+ 
+-    sev_device = object_property_get_str(OBJECT(sev_common), "sev-device",
+-                                         &error_abort);
+     fd = open(sev_device, O_RDWR);
+     if (fd < 0) {
+         error_setg_errno(errp, errno, "SEV: Failed to open %s",
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-i386-sev-Fix-error-message-in-sev_get_capabilities.patch b/SOURCES/kvm-i386-sev-Fix-error-message-in-sev_get_capabilities.patch
new file mode 100644
index 0000000..b23e008
--- /dev/null
+++ b/SOURCES/kvm-i386-sev-Fix-error-message-in-sev_get_capabilities.patch
@@ -0,0 +1,48 @@
+From b672cdf8c10a530b5bcf6dd4489632891eb2c731 Mon Sep 17 00:00:00 2001
+From: Michal Privoznik <mprivozn@redhat.com>
+Date: Mon, 24 Jun 2024 10:52:48 +0200
+Subject: [PATCH 088/100] i386/sev: Fix error message in sev_get_capabilities()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [88/91] ff8a8b27af02e565172ffe39d0571c234317713d (bonzini/rhel-qemu-kvm)
+
+When a custom path is provided to sev-guest object and opening
+the path fails an error message is reported. But the error
+message still mentions DEFAULT_SEV_DEVICE ("/dev/sev") instead of
+the custom path.
+
+Fixes: 16dcf200dc951c1cde3e5b442457db5f690b8cf0
+Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Link: https://lore.kernel.org/r/b4648905d399780063dc70851d3d6a3cd28719a5.1719218926.git.mprivozn@redhat.com
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit e306ae87e0ef04bc7a5dec6db693f6ea09d64d45)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ target/i386/sev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/target/i386/sev.c b/target/i386/sev.c
+index 37de80adc7..53b7f7315b 100644
+--- a/target/i386/sev.c
++++ b/target/i386/sev.c
+@@ -595,7 +595,7 @@ static SevCapability *sev_get_capabilities(Error **errp)
+     fd = open(sev_device, O_RDWR);
+     if (fd < 0) {
+         error_setg_errno(errp, errno, "SEV: Failed to open %s",
+-                         DEFAULT_SEV_DEVICE);
++                         sev_device);
+         g_free(sev_device);
+         return NULL;
+     }
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-i386-sev-Introduce-sev-common-type-to-encapsulate-co.patch b/SOURCES/kvm-i386-sev-Introduce-sev-common-type-to-encapsulate-co.patch
new file mode 100644
index 0000000..2d167af
--- /dev/null
+++ b/SOURCES/kvm-i386-sev-Introduce-sev-common-type-to-encapsulate-co.patch
@@ -0,0 +1,1118 @@
+From e6cf2115eb9db545821180b8a978cdccc6a2c2db Mon Sep 17 00:00:00 2001
+From: Michael Roth <michael.roth@amd.com>
+Date: Thu, 30 May 2024 06:16:16 -0500
+Subject: [PATCH 056/100] i386/sev: Introduce "sev-common" type to encapsulate
+ common SEV state
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [56/91] b52d5c9c5e4997d2fd791fa36dd5d4c836dfc32f (bonzini/rhel-qemu-kvm)
+
+Currently all SEV/SEV-ES functionality is managed through a single
+'sev-guest' QOM type. With upcoming support for SEV-SNP, taking this
+same approach won't work well since some of the properties/state
+managed by 'sev-guest' is not applicable to SEV-SNP, which will instead
+rely on a new QOM type with its own set of properties/state.
+
+To prepare for this, this patch moves common state into an abstract
+'sev-common' parent type to encapsulate properties/state that are
+common to both SEV/SEV-ES and SEV-SNP, leaving only SEV/SEV-ES-specific
+properties/state in the current 'sev-guest' type. This should not
+affect current behavior or command-line options.
+
+As part of this patch, some related changes are also made:
+
+  - a static 'sev_guest' variable is currently used to keep track of
+    the 'sev-guest' instance. SEV-SNP would similarly introduce an
+    'sev_snp_guest' static variable. But these instances are now
+    available via qdev_get_machine()->cgs, so switch to using that
+    instead and drop the static variable.
+
+  - 'sev_guest' is currently used as the name for the static variable
+    holding a pointer to the 'sev-guest' instance. Re-purpose the name
+    as a local variable referring the 'sev-guest' instance, and use
+    that consistently throughout the code so it can be easily
+    distinguished from sev-common/sev-snp-guest instances.
+
+  - 'sev' is generally used as the name for local variables holding a
+    pointer to the 'sev-guest' instance. In cases where that now points
+    to common state, use the name 'sev_common'; in cases where that now
+    points to state specific to 'sev-guest' instance, use the name
+    'sev_guest'
+
+In order to enable kernel-hashes for SNP, pull it from
+SevGuestProperties to its parent SevCommonProperties so
+it will be available for both SEV and SNP.
+
+Signed-off-by: Michael Roth <michael.roth@amd.com>
+Co-developed-by: Dov Murik <dovmurik@linux.ibm.com>
+Signed-off-by: Dov Murik <dovmurik@linux.ibm.com>
+Acked-by: Markus Armbruster <armbru@redhat.com> (QAPI schema)
+Co-developed-by: Pankaj Gupta <pankaj.gupta@amd.com>
+Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com>
+Message-ID: <20240530111643.1091816-5-pankaj.gupta@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 16dcf200dc951c1cde3e5b442457db5f690b8cf0)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ qapi/qom.json     |  40 ++--
+ target/i386/sev.c | 489 ++++++++++++++++++++++++++--------------------
+ target/i386/sev.h |   3 +
+ 3 files changed, 301 insertions(+), 231 deletions(-)
+
+diff --git a/qapi/qom.json b/qapi/qom.json
+index 38dde6d785..056b38f491 100644
+--- a/qapi/qom.json
++++ b/qapi/qom.json
+@@ -875,20 +875,12 @@
+   'data': { '*filename': 'str' } }
+ 
+ ##
+-# @SevGuestProperties:
++# @SevCommonProperties:
+ #
+-# Properties for sev-guest objects.
++# Properties common to objects that are derivatives of sev-common.
+ #
+ # @sev-device: SEV device to use (default: "/dev/sev")
+ #
+-# @dh-cert-file: guest owners DH certificate (encoded with base64)
+-#
+-# @session-file: guest owners session parameters (encoded with base64)
+-#
+-# @policy: SEV policy value (default: 0x1)
+-#
+-# @handle: SEV firmware handle (default: 0)
+-#
+ # @cbitpos: C-bit location in page table entry (default: 0)
+ #
+ # @reduced-phys-bits: number of bits in physical addresses that become
+@@ -898,6 +890,27 @@
+ #     designated guest firmware page for measured boot with -kernel
+ #     (default: false) (since 6.2)
+ #
++# Since: 9.1
++##
++{ 'struct': 'SevCommonProperties',
++  'data': { '*sev-device': 'str',
++            '*cbitpos': 'uint32',
++            'reduced-phys-bits': 'uint32',
++            '*kernel-hashes': 'bool' } }
++
++##
++# @SevGuestProperties:
++#
++# Properties for sev-guest objects.
++#
++# @dh-cert-file: guest owners DH certificate (encoded with base64)
++#
++# @session-file: guest owners session parameters (encoded with base64)
++#
++# @policy: SEV policy value (default: 0x1)
++#
++# @handle: SEV firmware handle (default: 0)
++#
+ # @legacy-vm-type: Use legacy KVM_SEV_INIT KVM interface for creating the VM.
+ #                  The newer KVM_SEV_INIT2 interface syncs additional vCPU
+ #                  state when initializing the VMSA structures, which will
+@@ -909,14 +922,11 @@
+ # Since: 2.12
+ ##
+ { 'struct': 'SevGuestProperties',
+-  'data': { '*sev-device': 'str',
+-            '*dh-cert-file': 'str',
++  'base': 'SevCommonProperties',
++  'data': { '*dh-cert-file': 'str',
+             '*session-file': 'str',
+             '*policy': 'uint32',
+             '*handle': 'uint32',
+-            '*cbitpos': 'uint32',
+-            'reduced-phys-bits': 'uint32',
+-            '*kernel-hashes': 'bool',
+             '*legacy-vm-type': 'bool' } }
+ 
+ ##
+diff --git a/target/i386/sev.c b/target/i386/sev.c
+index 67ed32e5ea..33e606eea0 100644
+--- a/target/i386/sev.c
++++ b/target/i386/sev.c
+@@ -40,49 +40,59 @@
+ #include "hw/i386/pc.h"
+ #include "exec/address-spaces.h"
+ 
+-#define TYPE_SEV_GUEST "sev-guest"
+-OBJECT_DECLARE_SIMPLE_TYPE(SevGuestState, SEV_GUEST)
++OBJECT_DECLARE_TYPE(SevCommonState, SevCommonStateClass, SEV_COMMON)
++OBJECT_DECLARE_TYPE(SevGuestState, SevCommonStateClass, SEV_GUEST)
+ 
+-
+-/**
+- * SevGuestState:
+- *
+- * The SevGuestState object is used for creating and managing a SEV
+- * guest.
+- *
+- * # $QEMU \
+- *         -object sev-guest,id=sev0 \
+- *         -machine ...,memory-encryption=sev0
+- */
+-struct SevGuestState {
++struct SevCommonState {
+     X86ConfidentialGuest parent_obj;
+ 
+     int kvm_type;
+ 
+     /* configuration parameters */
+     char *sev_device;
+-    uint32_t policy;
+-    char *dh_cert_file;
+-    char *session_file;
+     uint32_t cbitpos;
+     uint32_t reduced_phys_bits;
+     bool kernel_hashes;
+-    bool legacy_vm_type;
+ 
+     /* runtime state */
+-    uint32_t handle;
+     uint8_t api_major;
+     uint8_t api_minor;
+     uint8_t build_id;
+     int sev_fd;
+     SevState state;
+-    gchar *measurement;
+ 
+     uint32_t reset_cs;
+     uint32_t reset_ip;
+     bool reset_data_valid;
+ };
+ 
++struct SevCommonStateClass {
++    X86ConfidentialGuestClass parent_class;
++
++};
++
++/**
++ * SevGuestState:
++ *
++ * The SevGuestState object is used for creating and managing a SEV
++ * guest.
++ *
++ * # $QEMU \
++ *         -object sev-guest,id=sev0 \
++ *         -machine ...,memory-encryption=sev0
++ */
++struct SevGuestState {
++    SevCommonState parent_obj;
++    gchar *measurement;
++
++    /* configuration parameters */
++    uint32_t handle;
++    uint32_t policy;
++    char *dh_cert_file;
++    char *session_file;
++    bool legacy_vm_type;
++};
++
+ #define DEFAULT_GUEST_POLICY    0x1 /* disable debug */
+ #define DEFAULT_SEV_DEVICE      "/dev/sev"
+ 
+@@ -128,7 +138,6 @@ typedef struct QEMU_PACKED PaddedSevHashTable {
+ 
+ QEMU_BUILD_BUG_ON(sizeof(PaddedSevHashTable) % 16 != 0);
+ 
+-static SevGuestState *sev_guest;
+ static Error *sev_mig_blocker;
+ 
+ static const char *const sev_fw_errlist[] = {
+@@ -209,21 +218,21 @@ fw_error_to_str(int code)
+ }
+ 
+ static bool
+-sev_check_state(const SevGuestState *sev, SevState state)
++sev_check_state(const SevCommonState *sev_common, SevState state)
+ {
+-    assert(sev);
+-    return sev->state == state ? true : false;
++    assert(sev_common);
++    return sev_common->state == state ? true : false;
+ }
+ 
+ static void
+-sev_set_guest_state(SevGuestState *sev, SevState new_state)
++sev_set_guest_state(SevCommonState *sev_common, SevState new_state)
+ {
+     assert(new_state < SEV_STATE__MAX);
+-    assert(sev);
++    assert(sev_common);
+ 
+-    trace_kvm_sev_change_state(SevState_str(sev->state),
++    trace_kvm_sev_change_state(SevState_str(sev_common->state),
+                                SevState_str(new_state));
+-    sev->state = new_state;
++    sev_common->state = new_state;
+ }
+ 
+ static void
+@@ -290,121 +299,61 @@ static struct RAMBlockNotifier sev_ram_notifier = {
+     .ram_block_removed = sev_ram_block_removed,
+ };
+ 
+-static void
+-sev_guest_finalize(Object *obj)
+-{
+-}
+-
+-static char *
+-sev_guest_get_session_file(Object *obj, Error **errp)
+-{
+-    SevGuestState *s = SEV_GUEST(obj);
+-
+-    return s->session_file ? g_strdup(s->session_file) : NULL;
+-}
+-
+-static void
+-sev_guest_set_session_file(Object *obj, const char *value, Error **errp)
+-{
+-    SevGuestState *s = SEV_GUEST(obj);
+-
+-    s->session_file = g_strdup(value);
+-}
+-
+-static char *
+-sev_guest_get_dh_cert_file(Object *obj, Error **errp)
+-{
+-    SevGuestState *s = SEV_GUEST(obj);
+-
+-    return g_strdup(s->dh_cert_file);
+-}
+-
+-static void
+-sev_guest_set_dh_cert_file(Object *obj, const char *value, Error **errp)
+-{
+-    SevGuestState *s = SEV_GUEST(obj);
+-
+-    s->dh_cert_file = g_strdup(value);
+-}
+-
+-static char *
+-sev_guest_get_sev_device(Object *obj, Error **errp)
+-{
+-    SevGuestState *sev = SEV_GUEST(obj);
+-
+-    return g_strdup(sev->sev_device);
+-}
+-
+-static void
+-sev_guest_set_sev_device(Object *obj, const char *value, Error **errp)
+-{
+-    SevGuestState *sev = SEV_GUEST(obj);
+-
+-    sev->sev_device = g_strdup(value);
+-}
+-
+-static bool sev_guest_get_kernel_hashes(Object *obj, Error **errp)
+-{
+-    SevGuestState *sev = SEV_GUEST(obj);
+-
+-    return sev->kernel_hashes;
+-}
+-
+-static void sev_guest_set_kernel_hashes(Object *obj, bool value, Error **errp)
+-{
+-    SevGuestState *sev = SEV_GUEST(obj);
+-
+-    sev->kernel_hashes = value;
+-}
+-
+-static bool sev_guest_get_legacy_vm_type(Object *obj, Error **errp)
+-{
+-    return SEV_GUEST(obj)->legacy_vm_type;
+-}
+-
+-static void sev_guest_set_legacy_vm_type(Object *obj, bool value, Error **errp)
+-{
+-    SEV_GUEST(obj)->legacy_vm_type = value;
+-}
+-
+ bool
+ sev_enabled(void)
+ {
+-    return !!sev_guest;
++    ConfidentialGuestSupport *cgs = MACHINE(qdev_get_machine())->cgs;
++
++    return !!object_dynamic_cast(OBJECT(cgs), TYPE_SEV_COMMON);
+ }
+ 
+ bool
+ sev_es_enabled(void)
+ {
+-    return sev_enabled() && (sev_guest->policy & SEV_POLICY_ES);
++    ConfidentialGuestSupport *cgs = MACHINE(qdev_get_machine())->cgs;
++
++    return sev_enabled() && (SEV_GUEST(cgs)->policy & SEV_POLICY_ES);
+ }
+ 
+ uint32_t
+ sev_get_cbit_position(void)
+ {
+-    return sev_guest ? sev_guest->cbitpos : 0;
++    SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs);
++
++    return sev_common ? sev_common->cbitpos : 0;
+ }
+ 
+ uint32_t
+ sev_get_reduced_phys_bits(void)
+ {
+-    return sev_guest ? sev_guest->reduced_phys_bits : 0;
++    SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs);
++
++    return sev_common ? sev_common->reduced_phys_bits : 0;
+ }
+ 
+ static SevInfo *sev_get_info(void)
+ {
+     SevInfo *info;
++    SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs);
++    SevGuestState *sev_guest =
++        (SevGuestState *)object_dynamic_cast(OBJECT(sev_common),
++                                             TYPE_SEV_GUEST);
+ 
+     info = g_new0(SevInfo, 1);
+     info->enabled = sev_enabled();
+ 
+     if (info->enabled) {
+-        info->api_major = sev_guest->api_major;
+-        info->api_minor = sev_guest->api_minor;
+-        info->build_id = sev_guest->build_id;
+-        info->policy = sev_guest->policy;
+-        info->state = sev_guest->state;
+-        info->handle = sev_guest->handle;
++        if (sev_guest) {
++            info->handle = sev_guest->handle;
++        }
++        info->api_major = sev_common->api_major;
++        info->api_minor = sev_common->api_minor;
++        info->build_id = sev_common->build_id;
++        info->state = sev_common->state;
++        /* we only report the lower 32-bits of policy for SNP, ok for now... */
++        info->policy =
++            (uint32_t)object_property_get_uint(OBJECT(sev_common),
++                                               "policy", NULL);
+     }
+ 
+     return info;
+@@ -530,6 +479,8 @@ static SevCapability *sev_get_capabilities(Error **errp)
+     size_t pdh_len = 0, cert_chain_len = 0, cpu0_id_len = 0;
+     uint32_t ebx;
+     int fd;
++    SevCommonState *sev_common;
++    char *sev_device;
+ 
+     if (!kvm_enabled()) {
+         error_setg(errp, "KVM not enabled");
+@@ -540,12 +491,21 @@ static SevCapability *sev_get_capabilities(Error **errp)
+         return NULL;
+     }
+ 
+-    fd = open(DEFAULT_SEV_DEVICE, O_RDWR);
++    sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs);
++    if (!sev_common) {
++        error_setg(errp, "SEV is not configured");
++    }
++
++    sev_device = object_property_get_str(OBJECT(sev_common), "sev-device",
++                                         &error_abort);
++    fd = open(sev_device, O_RDWR);
+     if (fd < 0) {
+         error_setg_errno(errp, errno, "SEV: Failed to open %s",
+                          DEFAULT_SEV_DEVICE);
++        g_free(sev_device);
+         return NULL;
+     }
++    g_free(sev_device);
+ 
+     if (sev_get_pdh_info(fd, &pdh_data, &pdh_len,
+                          &cert_chain_data, &cert_chain_len, errp)) {
+@@ -588,7 +548,7 @@ static SevAttestationReport *sev_get_attestation_report(const char *mnonce,
+ {
+     struct kvm_sev_attestation_report input = {};
+     SevAttestationReport *report = NULL;
+-    SevGuestState *sev = sev_guest;
++    SevCommonState *sev_common;
+     g_autofree guchar *data = NULL;
+     g_autofree guchar *buf = NULL;
+     gsize len;
+@@ -613,8 +573,10 @@ static SevAttestationReport *sev_get_attestation_report(const char *mnonce,
+         return NULL;
+     }
+ 
++    sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs);
++
+     /* Query the report length */
+-    ret = sev_ioctl(sev->sev_fd, KVM_SEV_GET_ATTESTATION_REPORT,
++    ret = sev_ioctl(sev_common->sev_fd, KVM_SEV_GET_ATTESTATION_REPORT,
+             &input, &err);
+     if (ret < 0) {
+         if (err != SEV_RET_INVALID_LEN) {
+@@ -630,7 +592,7 @@ static SevAttestationReport *sev_get_attestation_report(const char *mnonce,
+     memcpy(input.mnonce, buf, sizeof(input.mnonce));
+ 
+     /* Query the report */
+-    ret = sev_ioctl(sev->sev_fd, KVM_SEV_GET_ATTESTATION_REPORT,
++    ret = sev_ioctl(sev_common->sev_fd, KVM_SEV_GET_ATTESTATION_REPORT,
+             &input, &err);
+     if (ret) {
+         error_setg_errno(errp, errno, "SEV: Failed to get attestation report"
+@@ -670,26 +632,27 @@ sev_read_file_base64(const char *filename, guchar **data, gsize *len)
+ }
+ 
+ static int
+-sev_launch_start(SevGuestState *sev)
++sev_launch_start(SevGuestState *sev_guest)
+ {
+     gsize sz;
+     int ret = 1;
+     int fw_error, rc;
+     struct kvm_sev_launch_start start = {
+-        .handle = sev->handle, .policy = sev->policy
++        .handle = sev_guest->handle, .policy = sev_guest->policy
+     };
+     guchar *session = NULL, *dh_cert = NULL;
++    SevCommonState *sev_common = SEV_COMMON(sev_guest);
+ 
+-    if (sev->session_file) {
+-        if (sev_read_file_base64(sev->session_file, &session, &sz) < 0) {
++    if (sev_guest->session_file) {
++        if (sev_read_file_base64(sev_guest->session_file, &session, &sz) < 0) {
+             goto out;
+         }
+         start.session_uaddr = (unsigned long)session;
+         start.session_len = sz;
+     }
+ 
+-    if (sev->dh_cert_file) {
+-        if (sev_read_file_base64(sev->dh_cert_file, &dh_cert, &sz) < 0) {
++    if (sev_guest->dh_cert_file) {
++        if (sev_read_file_base64(sev_guest->dh_cert_file, &dh_cert, &sz) < 0) {
+             goto out;
+         }
+         start.dh_uaddr = (unsigned long)dh_cert;
+@@ -697,15 +660,15 @@ sev_launch_start(SevGuestState *sev)
+     }
+ 
+     trace_kvm_sev_launch_start(start.policy, session, dh_cert);
+-    rc = sev_ioctl(sev->sev_fd, KVM_SEV_LAUNCH_START, &start, &fw_error);
++    rc = sev_ioctl(sev_common->sev_fd, KVM_SEV_LAUNCH_START, &start, &fw_error);
+     if (rc < 0) {
+         error_report("%s: LAUNCH_START ret=%d fw_error=%d '%s'",
+                 __func__, ret, fw_error, fw_error_to_str(fw_error));
+         goto out;
+     }
+ 
+-    sev_set_guest_state(sev, SEV_STATE_LAUNCH_UPDATE);
+-    sev->handle = start.handle;
++    sev_set_guest_state(sev_common, SEV_STATE_LAUNCH_UPDATE);
++    sev_guest->handle = start.handle;
+     ret = 0;
+ 
+ out:
+@@ -715,7 +678,7 @@ out:
+ }
+ 
+ static int
+-sev_launch_update_data(SevGuestState *sev, uint8_t *addr, uint64_t len)
++sev_launch_update_data(SevGuestState *sev_guest, uint8_t *addr, uint64_t len)
+ {
+     int ret, fw_error;
+     struct kvm_sev_launch_update_data update;
+@@ -727,7 +690,7 @@ sev_launch_update_data(SevGuestState *sev, uint8_t *addr, uint64_t len)
+     update.uaddr = (uintptr_t)addr;
+     update.len = len;
+     trace_kvm_sev_launch_update_data(addr, len);
+-    ret = sev_ioctl(sev->sev_fd, KVM_SEV_LAUNCH_UPDATE_DATA,
++    ret = sev_ioctl(SEV_COMMON(sev_guest)->sev_fd, KVM_SEV_LAUNCH_UPDATE_DATA,
+                     &update, &fw_error);
+     if (ret) {
+         error_report("%s: LAUNCH_UPDATE ret=%d fw_error=%d '%s'",
+@@ -738,11 +701,12 @@ sev_launch_update_data(SevGuestState *sev, uint8_t *addr, uint64_t len)
+ }
+ 
+ static int
+-sev_launch_update_vmsa(SevGuestState *sev)
++sev_launch_update_vmsa(SevGuestState *sev_guest)
+ {
+     int ret, fw_error;
+ 
+-    ret = sev_ioctl(sev->sev_fd, KVM_SEV_LAUNCH_UPDATE_VMSA, NULL, &fw_error);
++    ret = sev_ioctl(SEV_COMMON(sev_guest)->sev_fd, KVM_SEV_LAUNCH_UPDATE_VMSA,
++                    NULL, &fw_error);
+     if (ret) {
+         error_report("%s: LAUNCH_UPDATE_VMSA ret=%d fw_error=%d '%s'",
+                 __func__, ret, fw_error, fw_error_to_str(fw_error));
+@@ -754,18 +718,19 @@ sev_launch_update_vmsa(SevGuestState *sev)
+ static void
+ sev_launch_get_measure(Notifier *notifier, void *unused)
+ {
+-    SevGuestState *sev = sev_guest;
++    SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs);
++    SevGuestState *sev_guest = SEV_GUEST(sev_common);
+     int ret, error;
+     g_autofree guchar *data = NULL;
+     struct kvm_sev_launch_measure measurement = {};
+ 
+-    if (!sev_check_state(sev, SEV_STATE_LAUNCH_UPDATE)) {
++    if (!sev_check_state(sev_common, SEV_STATE_LAUNCH_UPDATE)) {
+         return;
+     }
+ 
+     if (sev_es_enabled()) {
+         /* measure all the VM save areas before getting launch_measure */
+-        ret = sev_launch_update_vmsa(sev);
++        ret = sev_launch_update_vmsa(sev_guest);
+         if (ret) {
+             exit(1);
+         }
+@@ -773,7 +738,7 @@ sev_launch_get_measure(Notifier *notifier, void *unused)
+     }
+ 
+     /* query the measurement blob length */
+-    ret = sev_ioctl(sev->sev_fd, KVM_SEV_LAUNCH_MEASURE,
++    ret = sev_ioctl(sev_common->sev_fd, KVM_SEV_LAUNCH_MEASURE,
+                     &measurement, &error);
+     if (!measurement.len) {
+         error_report("%s: LAUNCH_MEASURE ret=%d fw_error=%d '%s'",
+@@ -785,7 +750,7 @@ sev_launch_get_measure(Notifier *notifier, void *unused)
+     measurement.uaddr = (unsigned long)data;
+ 
+     /* get the measurement blob */
+-    ret = sev_ioctl(sev->sev_fd, KVM_SEV_LAUNCH_MEASURE,
++    ret = sev_ioctl(sev_common->sev_fd, KVM_SEV_LAUNCH_MEASURE,
+                     &measurement, &error);
+     if (ret) {
+         error_report("%s: LAUNCH_MEASURE ret=%d fw_error=%d '%s'",
+@@ -793,17 +758,19 @@ sev_launch_get_measure(Notifier *notifier, void *unused)
+         return;
+     }
+ 
+-    sev_set_guest_state(sev, SEV_STATE_LAUNCH_SECRET);
++    sev_set_guest_state(sev_common, SEV_STATE_LAUNCH_SECRET);
+ 
+     /* encode the measurement value and emit the event */
+-    sev->measurement = g_base64_encode(data, measurement.len);
+-    trace_kvm_sev_launch_measurement(sev->measurement);
++    sev_guest->measurement = g_base64_encode(data, measurement.len);
++    trace_kvm_sev_launch_measurement(sev_guest->measurement);
+ }
+ 
+ static char *sev_get_launch_measurement(void)
+ {
++    SevGuestState *sev_guest = SEV_GUEST(MACHINE(qdev_get_machine())->cgs);
++
+     if (sev_guest &&
+-        sev_guest->state >= SEV_STATE_LAUNCH_SECRET) {
++        SEV_COMMON(sev_guest)->state >= SEV_STATE_LAUNCH_SECRET) {
+         return g_strdup(sev_guest->measurement);
+     }
+ 
+@@ -832,19 +799,20 @@ static Notifier sev_machine_done_notify = {
+ };
+ 
+ static void
+-sev_launch_finish(SevGuestState *sev)
++sev_launch_finish(SevGuestState *sev_guest)
+ {
+     int ret, error;
+ 
+     trace_kvm_sev_launch_finish();
+-    ret = sev_ioctl(sev->sev_fd, KVM_SEV_LAUNCH_FINISH, 0, &error);
++    ret = sev_ioctl(SEV_COMMON(sev_guest)->sev_fd, KVM_SEV_LAUNCH_FINISH, 0,
++                    &error);
+     if (ret) {
+         error_report("%s: LAUNCH_FINISH ret=%d fw_error=%d '%s'",
+                      __func__, ret, error, fw_error_to_str(error));
+         exit(1);
+     }
+ 
+-    sev_set_guest_state(sev, SEV_STATE_RUNNING);
++    sev_set_guest_state(SEV_COMMON(sev_guest), SEV_STATE_RUNNING);
+ 
+     /* add migration blocker */
+     error_setg(&sev_mig_blocker,
+@@ -855,38 +823,40 @@ sev_launch_finish(SevGuestState *sev)
+ static void
+ sev_vm_state_change(void *opaque, bool running, RunState state)
+ {
+-    SevGuestState *sev = opaque;
++    SevCommonState *sev_common = opaque;
+ 
+     if (running) {
+-        if (!sev_check_state(sev, SEV_STATE_RUNNING)) {
+-            sev_launch_finish(sev);
++        if (!sev_check_state(sev_common, SEV_STATE_RUNNING)) {
++            sev_launch_finish(SEV_GUEST(sev_common));
+         }
+     }
+ }
+ 
+ static int sev_kvm_type(X86ConfidentialGuest *cg)
+ {
+-    SevGuestState *sev = SEV_GUEST(cg);
++    SevCommonState *sev_common = SEV_COMMON(cg);
++    SevGuestState *sev_guest = SEV_GUEST(sev_common);
+     int kvm_type;
+ 
+-    if (sev->kvm_type != -1) {
++    if (sev_common->kvm_type != -1) {
+         goto out;
+     }
+ 
+-    kvm_type = (sev->policy & SEV_POLICY_ES) ? KVM_X86_SEV_ES_VM : KVM_X86_SEV_VM;
+-    if (kvm_is_vm_type_supported(kvm_type) && !sev->legacy_vm_type) {
+-        sev->kvm_type = kvm_type;
++    kvm_type = (sev_guest->policy & SEV_POLICY_ES) ?
++                KVM_X86_SEV_ES_VM : KVM_X86_SEV_VM;
++    if (kvm_is_vm_type_supported(kvm_type) && !sev_guest->legacy_vm_type) {
++        sev_common->kvm_type = kvm_type;
+     } else {
+-        sev->kvm_type = KVM_X86_DEFAULT_VM;
++        sev_common->kvm_type = KVM_X86_DEFAULT_VM;
+     }
+ 
+ out:
+-    return sev->kvm_type;
++    return sev_common->kvm_type;
+ }
+ 
+ static int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
+ {
+-    SevGuestState *sev = SEV_GUEST(cgs);
++    SevCommonState *sev_common = SEV_COMMON(cgs);
+     char *devname;
+     int ret, fw_error, cmd;
+     uint32_t ebx;
+@@ -899,8 +869,7 @@ static int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
+         return -1;
+     }
+ 
+-    sev_guest = sev;
+-    sev->state = SEV_STATE_UNINIT;
++    sev_common->state = SEV_STATE_UNINIT;
+ 
+     host_cpuid(0x8000001F, 0, NULL, &ebx, NULL, NULL);
+     host_cbitpos = ebx & 0x3f;
+@@ -910,9 +879,9 @@ static int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
+      * register of CPUID 0x8000001F. No need to verify the range as the
+      * comparison against the host value accomplishes that.
+      */
+-    if (host_cbitpos != sev->cbitpos) {
++    if (host_cbitpos != sev_common->cbitpos) {
+         error_setg(errp, "%s: cbitpos check failed, host '%d' requested '%d'",
+-                   __func__, host_cbitpos, sev->cbitpos);
++                   __func__, host_cbitpos, sev_common->cbitpos);
+         goto err;
+     }
+ 
+@@ -921,16 +890,17 @@ static int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
+      * the EBX register of CPUID 0x8000001F, so verify the supplied value
+      * is in the range of 1 to 63.
+      */
+-    if (sev->reduced_phys_bits < 1 || sev->reduced_phys_bits > 63) {
++    if (sev_common->reduced_phys_bits < 1 ||
++        sev_common->reduced_phys_bits > 63) {
+         error_setg(errp, "%s: reduced_phys_bits check failed,"
+                    " it should be in the range of 1 to 63, requested '%d'",
+-                   __func__, sev->reduced_phys_bits);
++                   __func__, sev_common->reduced_phys_bits);
+         goto err;
+     }
+ 
+-    devname = object_property_get_str(OBJECT(sev), "sev-device", NULL);
+-    sev->sev_fd = open(devname, O_RDWR);
+-    if (sev->sev_fd < 0) {
++    devname = object_property_get_str(OBJECT(sev_common), "sev-device", NULL);
++    sev_common->sev_fd = open(devname, O_RDWR);
++    if (sev_common->sev_fd < 0) {
+         error_setg(errp, "%s: Failed to open %s '%s'", __func__,
+                    devname, strerror(errno));
+         g_free(devname);
+@@ -938,7 +908,7 @@ static int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
+     }
+     g_free(devname);
+ 
+-    ret = sev_platform_ioctl(sev->sev_fd, SEV_PLATFORM_STATUS, &status,
++    ret = sev_platform_ioctl(sev_common->sev_fd, SEV_PLATFORM_STATUS, &status,
+                              &fw_error);
+     if (ret) {
+         error_setg(errp, "%s: failed to get platform status ret=%d "
+@@ -946,9 +916,9 @@ static int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
+                    fw_error_to_str(fw_error));
+         goto err;
+     }
+-    sev->build_id = status.build;
+-    sev->api_major = status.api_major;
+-    sev->api_minor = status.api_minor;
++    sev_common->build_id = status.build;
++    sev_common->api_major = status.api_major;
++    sev_common->api_minor = status.api_minor;
+ 
+     if (sev_es_enabled()) {
+         if (!kvm_kernel_irqchip_allowed()) {
+@@ -966,14 +936,14 @@ static int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
+     }
+ 
+     trace_kvm_sev_init();
+-    if (sev_kvm_type(X86_CONFIDENTIAL_GUEST(sev)) == KVM_X86_DEFAULT_VM) {
++    if (sev_kvm_type(X86_CONFIDENTIAL_GUEST(sev_common)) == KVM_X86_DEFAULT_VM) {
+         cmd = sev_es_enabled() ? KVM_SEV_ES_INIT : KVM_SEV_INIT;
+ 
+-        ret = sev_ioctl(sev->sev_fd, cmd, NULL, &fw_error);
++        ret = sev_ioctl(sev_common->sev_fd, cmd, NULL, &fw_error);
+     } else {
+         struct kvm_sev_init args = { 0 };
+ 
+-        ret = sev_ioctl(sev->sev_fd, KVM_SEV_INIT2, &args, &fw_error);
++        ret = sev_ioctl(sev_common->sev_fd, KVM_SEV_INIT2, &args, &fw_error);
+     }
+ 
+     if (ret) {
+@@ -982,7 +952,7 @@ static int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
+         goto err;
+     }
+ 
+-    ret = sev_launch_start(sev);
++    sev_launch_start(SEV_GUEST(sev_common));
+     if (ret) {
+         error_setg(errp, "%s: failed to create encryption context", __func__);
+         goto err;
+@@ -990,13 +960,12 @@ static int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
+ 
+     ram_block_notifier_add(&sev_ram_notifier);
+     qemu_add_machine_init_done_notifier(&sev_machine_done_notify);
+-    qemu_add_vm_change_state_handler(sev_vm_state_change, sev);
++    qemu_add_vm_change_state_handler(sev_vm_state_change, sev_common);
+ 
+     cgs->ready = true;
+ 
+     return 0;
+ err:
+-    sev_guest = NULL;
+     ram_block_discard_disable(false);
+     return -1;
+ }
+@@ -1004,13 +973,15 @@ err:
+ int
+ sev_encrypt_flash(uint8_t *ptr, uint64_t len, Error **errp)
+ {
+-    if (!sev_guest) {
++    SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs);
++
++    if (!sev_common) {
+         return 0;
+     }
+ 
+     /* if SEV is in update state then encrypt the data else do nothing */
+-    if (sev_check_state(sev_guest, SEV_STATE_LAUNCH_UPDATE)) {
+-        int ret = sev_launch_update_data(sev_guest, ptr, len);
++    if (sev_check_state(sev_common, SEV_STATE_LAUNCH_UPDATE)) {
++        int ret = sev_launch_update_data(SEV_GUEST(sev_common), ptr, len);
+         if (ret < 0) {
+             error_setg(errp, "SEV: Failed to encrypt pflash rom");
+             return ret;
+@@ -1030,16 +1001,17 @@ int sev_inject_launch_secret(const char *packet_hdr, const char *secret,
+     void *hva;
+     gsize hdr_sz = 0, data_sz = 0;
+     MemoryRegion *mr = NULL;
++    SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs);
+ 
+-    if (!sev_guest) {
++    if (!sev_common) {
+         error_setg(errp, "SEV not enabled for guest");
+         return 1;
+     }
+ 
+     /* secret can be injected only in this state */
+-    if (!sev_check_state(sev_guest, SEV_STATE_LAUNCH_SECRET)) {
++    if (!sev_check_state(sev_common, SEV_STATE_LAUNCH_SECRET)) {
+         error_setg(errp, "SEV: Not in correct state. (LSECRET) %x",
+-                     sev_guest->state);
++                   sev_common->state);
+         return 1;
+     }
+ 
+@@ -1073,7 +1045,7 @@ int sev_inject_launch_secret(const char *packet_hdr, const char *secret,
+     trace_kvm_sev_launch_secret(gpa, input.guest_uaddr,
+                                 input.trans_uaddr, input.trans_len);
+ 
+-    ret = sev_ioctl(sev_guest->sev_fd, KVM_SEV_LAUNCH_SECRET,
++    ret = sev_ioctl(sev_common->sev_fd, KVM_SEV_LAUNCH_SECRET,
+                     &input, &error);
+     if (ret) {
+         error_setg(errp, "SEV: failed to inject secret ret=%d fw_error=%d '%s'",
+@@ -1180,9 +1152,10 @@ void sev_es_set_reset_vector(CPUState *cpu)
+ {
+     X86CPU *x86;
+     CPUX86State *env;
++    SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs);
+ 
+     /* Only update if we have valid reset information */
+-    if (!sev_guest || !sev_guest->reset_data_valid) {
++    if (!sev_common || !sev_common->reset_data_valid) {
+         return;
+     }
+ 
+@@ -1194,11 +1167,11 @@ void sev_es_set_reset_vector(CPUState *cpu)
+     x86 = X86_CPU(cpu);
+     env = &x86->env;
+ 
+-    cpu_x86_load_seg_cache(env, R_CS, 0xf000, sev_guest->reset_cs, 0xffff,
++    cpu_x86_load_seg_cache(env, R_CS, 0xf000, sev_common->reset_cs, 0xffff,
+                            DESC_P_MASK | DESC_S_MASK | DESC_CS_MASK |
+                            DESC_R_MASK | DESC_A_MASK);
+ 
+-    env->eip = sev_guest->reset_ip;
++    env->eip = sev_common->reset_ip;
+ }
+ 
+ int sev_es_save_reset_vector(void *flash_ptr, uint64_t flash_size)
+@@ -1206,6 +1179,7 @@ int sev_es_save_reset_vector(void *flash_ptr, uint64_t flash_size)
+     CPUState *cpu;
+     uint32_t addr;
+     int ret;
++    SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs);
+ 
+     if (!sev_es_enabled()) {
+         return 0;
+@@ -1219,9 +1193,9 @@ int sev_es_save_reset_vector(void *flash_ptr, uint64_t flash_size)
+     }
+ 
+     if (addr) {
+-        sev_guest->reset_cs = addr & 0xffff0000;
+-        sev_guest->reset_ip = addr & 0x0000ffff;
+-        sev_guest->reset_data_valid = true;
++        sev_common->reset_cs = addr & 0xffff0000;
++        sev_common->reset_ip = addr & 0x0000ffff;
++        sev_common->reset_data_valid = true;
+ 
+         CPU_FOREACH(cpu) {
+             sev_es_set_reset_vector(cpu);
+@@ -1267,12 +1241,13 @@ bool sev_add_kernel_loader_hashes(SevKernelLoaderContext *ctx, Error **errp)
+     hwaddr mapped_len = sizeof(*padded_ht);
+     MemTxAttrs attrs = { 0 };
+     bool ret = true;
++    SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs);
+ 
+     /*
+      * Only add the kernel hashes if the sev-guest configuration explicitly
+      * stated kernel-hashes=on.
+      */
+-    if (!sev_guest->kernel_hashes) {
++    if (!sev_common->kernel_hashes) {
+         return false;
+     }
+ 
+@@ -1363,8 +1338,30 @@ bool sev_add_kernel_loader_hashes(SevKernelLoaderContext *ctx, Error **errp)
+     return ret;
+ }
+ 
++static char *
++sev_common_get_sev_device(Object *obj, Error **errp)
++{
++    return g_strdup(SEV_COMMON(obj)->sev_device);
++}
++
+ static void
+-sev_guest_class_init(ObjectClass *oc, void *data)
++sev_common_set_sev_device(Object *obj, const char *value, Error **errp)
++{
++    SEV_COMMON(obj)->sev_device = g_strdup(value);
++}
++
++static bool sev_common_get_kernel_hashes(Object *obj, Error **errp)
++{
++    return SEV_COMMON(obj)->kernel_hashes;
++}
++
++static void sev_common_set_kernel_hashes(Object *obj, bool value, Error **errp)
++{
++    SEV_COMMON(obj)->kernel_hashes = value;
++}
++
++static void
++sev_common_class_init(ObjectClass *oc, void *data)
+ {
+     ConfidentialGuestSupportClass *klass = CONFIDENTIAL_GUEST_SUPPORT_CLASS(oc);
+     X86ConfidentialGuestClass *x86_klass = X86_CONFIDENTIAL_GUEST_CLASS(oc);
+@@ -1373,10 +1370,87 @@ sev_guest_class_init(ObjectClass *oc, void *data)
+     x86_klass->kvm_type = sev_kvm_type;
+ 
+     object_class_property_add_str(oc, "sev-device",
+-                                  sev_guest_get_sev_device,
+-                                  sev_guest_set_sev_device);
++                                  sev_common_get_sev_device,
++                                  sev_common_set_sev_device);
+     object_class_property_set_description(oc, "sev-device",
+             "SEV device to use");
++    object_class_property_add_bool(oc, "kernel-hashes",
++                                   sev_common_get_kernel_hashes,
++                                   sev_common_set_kernel_hashes);
++    object_class_property_set_description(oc, "kernel-hashes",
++            "add kernel hashes to guest firmware for measured Linux boot");
++}
++
++static void
++sev_common_instance_init(Object *obj)
++{
++    SevCommonState *sev_common = SEV_COMMON(obj);
++
++    sev_common->kvm_type = -1;
++
++    sev_common->sev_device = g_strdup(DEFAULT_SEV_DEVICE);
++
++    object_property_add_uint32_ptr(obj, "cbitpos", &sev_common->cbitpos,
++                                   OBJ_PROP_FLAG_READWRITE);
++    object_property_add_uint32_ptr(obj, "reduced-phys-bits",
++                                   &sev_common->reduced_phys_bits,
++                                   OBJ_PROP_FLAG_READWRITE);
++}
++
++/* sev guest info common to sev/sev-es/sev-snp */
++static const TypeInfo sev_common_info = {
++    .parent = TYPE_X86_CONFIDENTIAL_GUEST,
++    .name = TYPE_SEV_COMMON,
++    .instance_size = sizeof(SevCommonState),
++    .instance_init = sev_common_instance_init,
++    .class_size = sizeof(SevCommonStateClass),
++    .class_init = sev_common_class_init,
++    .abstract = true,
++    .interfaces = (InterfaceInfo[]) {
++        { TYPE_USER_CREATABLE },
++        { }
++    }
++};
++
++static char *
++sev_guest_get_dh_cert_file(Object *obj, Error **errp)
++{
++    return g_strdup(SEV_GUEST(obj)->dh_cert_file);
++}
++
++static void
++sev_guest_set_dh_cert_file(Object *obj, const char *value, Error **errp)
++{
++    SEV_GUEST(obj)->dh_cert_file = g_strdup(value);
++}
++
++static char *
++sev_guest_get_session_file(Object *obj, Error **errp)
++{
++    SevGuestState *sev_guest = SEV_GUEST(obj);
++
++    return sev_guest->session_file ? g_strdup(sev_guest->session_file) : NULL;
++}
++
++static void
++sev_guest_set_session_file(Object *obj, const char *value, Error **errp)
++{
++    SEV_GUEST(obj)->session_file = g_strdup(value);
++}
++
++static bool sev_guest_get_legacy_vm_type(Object *obj, Error **errp)
++{
++    return SEV_GUEST(obj)->legacy_vm_type;
++}
++
++static void sev_guest_set_legacy_vm_type(Object *obj, bool value, Error **errp)
++{
++    SEV_GUEST(obj)->legacy_vm_type = value;
++}
++
++static void
++sev_guest_class_init(ObjectClass *oc, void *data)
++{
+     object_class_property_add_str(oc, "dh-cert-file",
+                                   sev_guest_get_dh_cert_file,
+                                   sev_guest_set_dh_cert_file);
+@@ -1387,11 +1461,6 @@ sev_guest_class_init(ObjectClass *oc, void *data)
+                                   sev_guest_set_session_file);
+     object_class_property_set_description(oc, "session-file",
+             "guest owners session parameters (encoded with base64)");
+-    object_class_property_add_bool(oc, "kernel-hashes",
+-                                   sev_guest_get_kernel_hashes,
+-                                   sev_guest_set_kernel_hashes);
+-    object_class_property_set_description(oc, "kernel-hashes",
+-            "add kernel hashes to guest firmware for measured Linux boot");
+     object_class_property_add_bool(oc, "legacy-vm-type",
+                                    sev_guest_get_legacy_vm_type,
+                                    sev_guest_set_legacy_vm_type);
+@@ -1402,41 +1471,29 @@ sev_guest_class_init(ObjectClass *oc, void *data)
+ static void
+ sev_guest_instance_init(Object *obj)
+ {
+-    SevGuestState *sev = SEV_GUEST(obj);
+-
+-    sev->kvm_type = -1;
++    SevGuestState *sev_guest = SEV_GUEST(obj);
+ 
+-    sev->sev_device = g_strdup(DEFAULT_SEV_DEVICE);
+-    sev->policy = DEFAULT_GUEST_POLICY;
+-    object_property_add_uint32_ptr(obj, "policy", &sev->policy,
+-                                   OBJ_PROP_FLAG_READWRITE);
+-    object_property_add_uint32_ptr(obj, "handle", &sev->handle,
++    sev_guest->policy = DEFAULT_GUEST_POLICY;
++    object_property_add_uint32_ptr(obj, "handle", &sev_guest->handle,
+                                    OBJ_PROP_FLAG_READWRITE);
+-    object_property_add_uint32_ptr(obj, "cbitpos", &sev->cbitpos,
+-                                   OBJ_PROP_FLAG_READWRITE);
+-    object_property_add_uint32_ptr(obj, "reduced-phys-bits",
+-                                   &sev->reduced_phys_bits,
++    object_property_add_uint32_ptr(obj, "policy", &sev_guest->policy,
+                                    OBJ_PROP_FLAG_READWRITE);
+     object_apply_compat_props(obj);
+ }
+ 
+-/* sev guest info */
++/* guest info specific sev/sev-es */
+ static const TypeInfo sev_guest_info = {
+-    .parent = TYPE_X86_CONFIDENTIAL_GUEST,
++    .parent = TYPE_SEV_COMMON,
+     .name = TYPE_SEV_GUEST,
+     .instance_size = sizeof(SevGuestState),
+-    .instance_finalize = sev_guest_finalize,
+-    .class_init = sev_guest_class_init,
+     .instance_init = sev_guest_instance_init,
+-    .interfaces = (InterfaceInfo[]) {
+-        { TYPE_USER_CREATABLE },
+-        { }
+-    }
++    .class_init = sev_guest_class_init,
+ };
+ 
+ static void
+ sev_register_types(void)
+ {
++    type_register_static(&sev_common_info);
+     type_register_static(&sev_guest_info);
+ }
+ 
+diff --git a/target/i386/sev.h b/target/i386/sev.h
+index 9e10d09539..668374eef3 100644
+--- a/target/i386/sev.h
++++ b/target/i386/sev.h
+@@ -20,6 +20,9 @@
+ 
+ #include "exec/confidential-guest-support.h"
+ 
++#define TYPE_SEV_COMMON "sev-common"
++#define TYPE_SEV_GUEST "sev-guest"
++
+ #define SEV_POLICY_NODBG        0x1
+ #define SEV_POLICY_NOKS         0x2
+ #define SEV_POLICY_ES           0x4
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-i386-sev-Introduce-sev-snp-guest-object.patch b/SOURCES/kvm-i386-sev-Introduce-sev-snp-guest-object.patch
new file mode 100644
index 0000000..b347bf6
--- /dev/null
+++ b/SOURCES/kvm-i386-sev-Introduce-sev-snp-guest-object.patch
@@ -0,0 +1,530 @@
+From 900859fd3445b9a71f1a9a8befda17f0c33f3923 Mon Sep 17 00:00:00 2001
+From: Brijesh Singh <brijesh.singh@amd.com>
+Date: Thu, 30 May 2024 06:16:19 -0500
+Subject: [PATCH 059/100] i386/sev: Introduce 'sev-snp-guest' object
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [59/91] 3e585113d209176c2b97ad5e4fe943f19dfdcaeb (bonzini/rhel-qemu-kvm)
+
+SEV-SNP support relies on a different set of properties/state than the
+existing 'sev-guest' object. This patch introduces the 'sev-snp-guest'
+object, which can be used to configure an SEV-SNP guest. For example,
+a default-configured SEV-SNP guest with no additional information
+passed in for use with attestation:
+
+  -object sev-snp-guest,id=sev0
+
+or a fully-specified SEV-SNP guest where all spec-defined binary
+blobs are passed in as base64-encoded strings:
+
+  -object sev-snp-guest,id=sev0, \
+    policy=0x30000, \
+    init-flags=0, \
+    id-block=YWFhYWFhYWFhYWFhYWFhCg==, \
+    id-auth=CxHK/OKLkXGn/KpAC7Wl1FSiisWDbGTEKz..., \
+    author-key-enabled=on, \
+    host-data=LNkCWBRC5CcdGXirbNUV1OrsR28s..., \
+    guest-visible-workarounds=AA==, \
+
+See the QAPI schema updates included in this patch for more usage
+details.
+
+In some cases these blobs may be up to 4096 characters, but this is
+generally well below the default limit for linux hosts where
+command-line sizes are defined by the sysconf-configurable ARG_MAX
+value, which defaults to 2097152 characters for Ubuntu hosts, for
+example.
+
+Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
+Co-developed-by: Michael Roth <michael.roth@amd.com>
+Acked-by: Markus Armbruster <armbru@redhat.com> (for QAPI schema)
+Signed-off-by: Michael Roth <michael.roth@amd.com>
+Co-developed-by: Pankaj Gupta <pankaj.gupta@amd.com>
+Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com>
+Message-ID: <20240530111643.1091816-8-pankaj.gupta@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 7b34df44260b391e33bc3acf1ced30019d9aadf1)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ docs/system/i386/amd-memory-encryption.rst |  70 +++++-
+ qapi/qom.json                              |  58 +++++
+ target/i386/sev.c                          | 253 +++++++++++++++++++++
+ target/i386/sev.h                          |   1 +
+ 4 files changed, 380 insertions(+), 2 deletions(-)
+
+diff --git a/docs/system/i386/amd-memory-encryption.rst b/docs/system/i386/amd-memory-encryption.rst
+index e9bc142bc1..748f5094ba 100644
+--- a/docs/system/i386/amd-memory-encryption.rst
++++ b/docs/system/i386/amd-memory-encryption.rst
+@@ -25,8 +25,8 @@ support for notifying a guest's operating system when certain types of VMEXITs
+ are about to occur. This allows the guest to selectively share information with
+ the hypervisor to satisfy the requested function.
+ 
+-Launching
+----------
++Launching (SEV and SEV-ES)
++--------------------------
+ 
+ Boot images (such as bios) must be encrypted before a guest can be booted. The
+ ``MEMORY_ENCRYPT_OP`` ioctl provides commands to encrypt the images: ``LAUNCH_START``,
+@@ -161,6 +161,72 @@ The value of GCTX.LD is
+ If kernel hashes are not used, or SEV-ES is disabled, use empty blobs for
+ ``kernel_hashes_blob`` and ``vmsas_blob`` as needed.
+ 
++Launching (SEV-SNP)
++-------------------
++Boot images (such as bios) must be encrypted before a guest can be booted. The
++``MEMORY_ENCRYPT_OP`` ioctl provides commands to encrypt the images:
++``SNP_LAUNCH_START``, ``SNP_LAUNCH_UPDATE``, and ``SNP_LAUNCH_FINISH``. These
++three commands communicate with SEV-SNP firmware to generate a fresh memory
++encryption key for the VM, encrypt the boot images for a successful launch. For
++more details on the SEV-SNP firmware interfaces used by these commands please
++see the SEV-SNP Firmware ABI.
++
++``SNP_LAUNCH_START`` is called first to create a cryptographic launch context
++within the firmware. To create this context, the guest owner must provide a
++guest policy and other parameters as described in the SEV-SNP firmware
++specification. The launch parameters should be specified as described in the
++QAPI schema for the sev-snp-guest object.
++
++The ``SNP_LAUNCH_START`` uses the following parameters, which can be configured
++by the corresponding parameters documented in the QAPI schema for the
++'sev-snp-guest' object.
++
+++--------+-------+----------+-------------------------------------------------+
++| key                       | type  | default  | meaning                      |
+++---------------------------+-------------------------------------------------+
++| policy                    | hex   | 0x30000  | a 64-bit guest policy        |
+++---------------------------+-------------------------------------------------+
++| guest-visible-workarounds | string| 0        | 16-byte base64 encoded string|
++|                           |       |          | for guest OS visible         |
++|                           |       |          | workarounds.                 |
+++---------------------------+-------------------------------------------------+
++
++``SNP_LAUNCH_UPDATE`` encrypts the memory region using the cryptographic context
++created via the ``SNP_LAUNCH_START`` command. If required, this command can be
++called multiple times to encrypt different memory regions. The command also
++calculates the measurement of the memory contents as it encrypts.
++
++``SNP_LAUNCH_FINISH`` finalizes the guest launch flow. Optionally, while
++finalizing the launch the firmware can perform checks on the launch digest
++computing through the ``SNP_LAUNCH_UPDATE``. To perform the check the user must
++supply the id block, authentication blob and host data that should be included
++in the attestation report. See the SEV-SNP spec for further details.
++
++The ``SNP_LAUNCH_FINISH`` uses the following parameters, which can be configured
++by the corresponding parameters documented in the QAPI schema for the
++'sev-snp-guest' object.
++
+++--------------------+-------+----------+-------------------------------------+
++| key                | type  | default  | meaning                             |
+++--------------------+-------+----------+-------------------------------------+
++| id-block           | string| none     | base64 encoded ID block             |
+++--------------------+-------+----------+-------------------------------------+
++| id-auth            | string| none     | base64 encoded authentication       |
++|                    |       |          | information                         |
+++--------------------+-------+----------+-------------------------------------+
++| author-key-enabled | bool  | 0        | auth block contains author key      |
+++--------------------+-------+----------+-------------------------------------+
++| host_data          | string| none     | host provided data                  |
+++--------------------+-------+----------+-------------------------------------+
++
++To launch a SEV-SNP guest (additional parameters are documented in the QAPI
++schema for the 'sev-snp-guest' object)::
++
++  # ${QEMU} \
++    -machine ...,confidential-guest-support=sev0 \
++    -object sev-snp-guest,id=sev0,cbitpos=51,reduced-phys-bits=1
++
++
+ Debugging
+ ---------
+ 
+diff --git a/qapi/qom.json b/qapi/qom.json
+index 056b38f491..8bd299265e 100644
+--- a/qapi/qom.json
++++ b/qapi/qom.json
+@@ -929,6 +929,62 @@
+             '*handle': 'uint32',
+             '*legacy-vm-type': 'bool' } }
+ 
++##
++# @SevSnpGuestProperties:
++#
++# Properties for sev-snp-guest objects.  Most of these are direct
++# arguments for the KVM_SNP_* interfaces documented in the Linux
++# kernel source under
++# Documentation/arch/x86/amd-memory-encryption.rst, which are in turn
++# closely coupled with the SNP_INIT/SNP_LAUNCH_* firmware commands
++# documented in the SEV-SNP Firmware ABI Specification (Rev 0.9).
++#
++# More usage information is also available in the QEMU source tree
++# under docs/amd-memory-encryption.
++#
++# @policy: the 'POLICY' parameter to the SNP_LAUNCH_START command, as
++#     defined in the SEV-SNP firmware ABI (default: 0x30000)
++#
++# @guest-visible-workarounds: 16-byte, base64-encoded blob to report
++#     hypervisor-defined workarounds, corresponding to the 'GOSVW'
++#     parameter of the SNP_LAUNCH_START command defined in the SEV-SNP
++#     firmware ABI (default: all-zero)
++#
++# @id-block: 96-byte, base64-encoded blob to provide the 'ID Block'
++#     structure for the SNP_LAUNCH_FINISH command defined in the
++#     SEV-SNP firmware ABI (default: all-zero)
++#
++# @id-auth: 4096-byte, base64-encoded blob to provide the 'ID
++#     Authentication Information Structure' for the SNP_LAUNCH_FINISH
++#     command defined in the SEV-SNP firmware ABI (default: all-zero)
++#
++# @author-key-enabled: true if 'id-auth' blob contains the 'AUTHOR_KEY'
++#     field defined SEV-SNP firmware ABI (default: false)
++#
++# @host-data: 32-byte, base64-encoded, user-defined blob to provide to
++#     the guest, as documented for the 'HOST_DATA' parameter of the
++#     SNP_LAUNCH_FINISH command in the SEV-SNP firmware ABI (default:
++#     all-zero)
++#
++# @vcek-disabled: Guests are by default allowed to choose between VLEK
++#     (Versioned Loaded Endorsement Key) or VCEK (Versioned Chip
++#     Endorsement Key) when requesting attestation reports from
++#     firmware. Set this to true to disable the use of VCEK.
++#     (default: false) (since: 9.1)
++#
++# Since: 9.1
++##
++{ 'struct': 'SevSnpGuestProperties',
++  'base': 'SevCommonProperties',
++  'data': {
++            '*policy': 'uint64',
++            '*guest-visible-workarounds': 'str',
++            '*id-block': 'str',
++            '*id-auth': 'str',
++            '*author-key-enabled': 'bool',
++            '*host-data': 'str',
++            '*vcek-disabled': 'bool' } }
++
+ ##
+ # @ThreadContextProperties:
+ #
+@@ -1007,6 +1063,7 @@
+     { 'name': 'secret_keyring',
+       'if': 'CONFIG_SECRET_KEYRING' },
+     'sev-guest',
++    'sev-snp-guest',
+     'thread-context',
+     's390-pv-guest',
+     'throttle-group',
+@@ -1077,6 +1134,7 @@
+       'secret_keyring':             { 'type': 'SecretKeyringProperties',
+                                       'if': 'CONFIG_SECRET_KEYRING' },
+       'sev-guest':                  'SevGuestProperties',
++      'sev-snp-guest':              'SevSnpGuestProperties',
+       'thread-context':             'ThreadContextProperties',
+       'throttle-group':             'ThrottleGroupProperties',
+       'tls-creds-anon':             'TlsCredsAnonProperties',
+diff --git a/target/i386/sev.c b/target/i386/sev.c
+index 28a018ed83..a81b3228d4 100644
+--- a/target/i386/sev.c
++++ b/target/i386/sev.c
+@@ -42,6 +42,7 @@
+ 
+ OBJECT_DECLARE_TYPE(SevCommonState, SevCommonStateClass, SEV_COMMON)
+ OBJECT_DECLARE_TYPE(SevGuestState, SevCommonStateClass, SEV_GUEST)
++OBJECT_DECLARE_TYPE(SevSnpGuestState, SevCommonStateClass, SEV_SNP_GUEST)
+ 
+ struct SevCommonState {
+     X86ConfidentialGuest parent_obj;
+@@ -96,8 +97,22 @@ struct SevGuestState {
+     bool legacy_vm_type;
+ };
+ 
++struct SevSnpGuestState {
++    SevCommonState parent_obj;
++
++    /* configuration parameters */
++    char *guest_visible_workarounds;
++    char *id_block;
++    char *id_auth;
++    char *host_data;
++
++    struct kvm_sev_snp_launch_start kvm_start_conf;
++    struct kvm_sev_snp_launch_finish kvm_finish_conf;
++};
++
+ #define DEFAULT_GUEST_POLICY    0x1 /* disable debug */
+ #define DEFAULT_SEV_DEVICE      "/dev/sev"
++#define DEFAULT_SEV_SNP_POLICY  0x30000
+ 
+ #define SEV_INFO_BLOCK_GUID     "00f771de-1a7e-4fcb-890e-68c77e2fb44e"
+ typedef struct __attribute__((__packed__)) SevInfoBlock {
+@@ -1500,11 +1515,249 @@ static const TypeInfo sev_guest_info = {
+     .class_init = sev_guest_class_init,
+ };
+ 
++static void
++sev_snp_guest_get_policy(Object *obj, Visitor *v, const char *name,
++                         void *opaque, Error **errp)
++{
++    visit_type_uint64(v, name,
++                      (uint64_t *)&SEV_SNP_GUEST(obj)->kvm_start_conf.policy,
++                      errp);
++}
++
++static void
++sev_snp_guest_set_policy(Object *obj, Visitor *v, const char *name,
++                         void *opaque, Error **errp)
++{
++    visit_type_uint64(v, name,
++                      (uint64_t *)&SEV_SNP_GUEST(obj)->kvm_start_conf.policy,
++                      errp);
++}
++
++static char *
++sev_snp_guest_get_guest_visible_workarounds(Object *obj, Error **errp)
++{
++    return g_strdup(SEV_SNP_GUEST(obj)->guest_visible_workarounds);
++}
++
++static void
++sev_snp_guest_set_guest_visible_workarounds(Object *obj, const char *value,
++                                            Error **errp)
++{
++    SevSnpGuestState *sev_snp_guest = SEV_SNP_GUEST(obj);
++    struct kvm_sev_snp_launch_start *start = &sev_snp_guest->kvm_start_conf;
++    g_autofree guchar *blob;
++    gsize len;
++
++    g_free(sev_snp_guest->guest_visible_workarounds);
++
++    /* store the base64 str so we don't need to re-encode in getter */
++    sev_snp_guest->guest_visible_workarounds = g_strdup(value);
++
++    blob = qbase64_decode(sev_snp_guest->guest_visible_workarounds,
++                          -1, &len, errp);
++    if (!blob) {
++        return;
++    }
++
++    if (len != sizeof(start->gosvw)) {
++        error_setg(errp, "parameter length of %lu exceeds max of %lu",
++                   len, sizeof(start->gosvw));
++        return;
++    }
++
++    memcpy(start->gosvw, blob, len);
++}
++
++static char *
++sev_snp_guest_get_id_block(Object *obj, Error **errp)
++{
++    SevSnpGuestState *sev_snp_guest = SEV_SNP_GUEST(obj);
++
++    return g_strdup(sev_snp_guest->id_block);
++}
++
++static void
++sev_snp_guest_set_id_block(Object *obj, const char *value, Error **errp)
++{
++    SevSnpGuestState *sev_snp_guest = SEV_SNP_GUEST(obj);
++    struct kvm_sev_snp_launch_finish *finish = &sev_snp_guest->kvm_finish_conf;
++    gsize len;
++
++    g_free(sev_snp_guest->id_block);
++    g_free((guchar *)finish->id_block_uaddr);
++
++    /* store the base64 str so we don't need to re-encode in getter */
++    sev_snp_guest->id_block = g_strdup(value);
++
++    finish->id_block_uaddr =
++        (uint64_t)qbase64_decode(sev_snp_guest->id_block, -1, &len, errp);
++
++    if (!finish->id_block_uaddr) {
++        return;
++    }
++
++    if (len != KVM_SEV_SNP_ID_BLOCK_SIZE) {
++        error_setg(errp, "parameter length of %lu not equal to %u",
++                   len, KVM_SEV_SNP_ID_BLOCK_SIZE);
++        return;
++    }
++
++    finish->id_block_en = (len) ? 1 : 0;
++}
++
++static char *
++sev_snp_guest_get_id_auth(Object *obj, Error **errp)
++{
++    SevSnpGuestState *sev_snp_guest = SEV_SNP_GUEST(obj);
++
++    return g_strdup(sev_snp_guest->id_auth);
++}
++
++static void
++sev_snp_guest_set_id_auth(Object *obj, const char *value, Error **errp)
++{
++    SevSnpGuestState *sev_snp_guest = SEV_SNP_GUEST(obj);
++    struct kvm_sev_snp_launch_finish *finish = &sev_snp_guest->kvm_finish_conf;
++    gsize len;
++
++    g_free(sev_snp_guest->id_auth);
++    g_free((guchar *)finish->id_auth_uaddr);
++
++    /* store the base64 str so we don't need to re-encode in getter */
++    sev_snp_guest->id_auth = g_strdup(value);
++
++    finish->id_auth_uaddr =
++        (uint64_t)qbase64_decode(sev_snp_guest->id_auth, -1, &len, errp);
++
++    if (!finish->id_auth_uaddr) {
++        return;
++    }
++
++    if (len > KVM_SEV_SNP_ID_AUTH_SIZE) {
++        error_setg(errp, "parameter length:ID_AUTH %lu exceeds max of %u",
++                   len, KVM_SEV_SNP_ID_AUTH_SIZE);
++        return;
++    }
++}
++
++static bool
++sev_snp_guest_get_author_key_enabled(Object *obj, Error **errp)
++{
++    SevSnpGuestState *sev_snp_guest = SEV_SNP_GUEST(obj);
++
++    return !!sev_snp_guest->kvm_finish_conf.auth_key_en;
++}
++
++static void
++sev_snp_guest_set_author_key_enabled(Object *obj, bool value, Error **errp)
++{
++    SevSnpGuestState *sev_snp_guest = SEV_SNP_GUEST(obj);
++
++    sev_snp_guest->kvm_finish_conf.auth_key_en = value;
++}
++
++static bool
++sev_snp_guest_get_vcek_disabled(Object *obj, Error **errp)
++{
++    SevSnpGuestState *sev_snp_guest = SEV_SNP_GUEST(obj);
++
++    return !!sev_snp_guest->kvm_finish_conf.vcek_disabled;
++}
++
++static void
++sev_snp_guest_set_vcek_disabled(Object *obj, bool value, Error **errp)
++{
++    SevSnpGuestState *sev_snp_guest = SEV_SNP_GUEST(obj);
++
++    sev_snp_guest->kvm_finish_conf.vcek_disabled = value;
++}
++
++static char *
++sev_snp_guest_get_host_data(Object *obj, Error **errp)
++{
++    SevSnpGuestState *sev_snp_guest = SEV_SNP_GUEST(obj);
++
++    return g_strdup(sev_snp_guest->host_data);
++}
++
++static void
++sev_snp_guest_set_host_data(Object *obj, const char *value, Error **errp)
++{
++    SevSnpGuestState *sev_snp_guest = SEV_SNP_GUEST(obj);
++    struct kvm_sev_snp_launch_finish *finish = &sev_snp_guest->kvm_finish_conf;
++    g_autofree guchar *blob;
++    gsize len;
++
++    g_free(sev_snp_guest->host_data);
++
++    /* store the base64 str so we don't need to re-encode in getter */
++    sev_snp_guest->host_data = g_strdup(value);
++
++    blob = qbase64_decode(sev_snp_guest->host_data, -1, &len, errp);
++
++    if (!blob) {
++        return;
++    }
++
++    if (len != sizeof(finish->host_data)) {
++        error_setg(errp, "parameter length of %lu not equal to %lu",
++                   len, sizeof(finish->host_data));
++        return;
++    }
++
++    memcpy(finish->host_data, blob, len);
++}
++
++static void
++sev_snp_guest_class_init(ObjectClass *oc, void *data)
++{
++    object_class_property_add(oc, "policy", "uint64",
++                              sev_snp_guest_get_policy,
++                              sev_snp_guest_set_policy, NULL, NULL);
++    object_class_property_add_str(oc, "guest-visible-workarounds",
++                                  sev_snp_guest_get_guest_visible_workarounds,
++                                  sev_snp_guest_set_guest_visible_workarounds);
++    object_class_property_add_str(oc, "id-block",
++                                  sev_snp_guest_get_id_block,
++                                  sev_snp_guest_set_id_block);
++    object_class_property_add_str(oc, "id-auth",
++                                  sev_snp_guest_get_id_auth,
++                                  sev_snp_guest_set_id_auth);
++    object_class_property_add_bool(oc, "author-key-enabled",
++                                   sev_snp_guest_get_author_key_enabled,
++                                   sev_snp_guest_set_author_key_enabled);
++    object_class_property_add_bool(oc, "vcek-required",
++                                   sev_snp_guest_get_vcek_disabled,
++                                   sev_snp_guest_set_vcek_disabled);
++    object_class_property_add_str(oc, "host-data",
++                                  sev_snp_guest_get_host_data,
++                                  sev_snp_guest_set_host_data);
++}
++
++static void
++sev_snp_guest_instance_init(Object *obj)
++{
++    SevSnpGuestState *sev_snp_guest = SEV_SNP_GUEST(obj);
++
++    /* default init/start/finish params for kvm */
++    sev_snp_guest->kvm_start_conf.policy = DEFAULT_SEV_SNP_POLICY;
++}
++
++/* guest info specific to sev-snp */
++static const TypeInfo sev_snp_guest_info = {
++    .parent = TYPE_SEV_COMMON,
++    .name = TYPE_SEV_SNP_GUEST,
++    .instance_size = sizeof(SevSnpGuestState),
++    .class_init = sev_snp_guest_class_init,
++    .instance_init = sev_snp_guest_instance_init,
++};
++
+ static void
+ sev_register_types(void)
+ {
+     type_register_static(&sev_common_info);
+     type_register_static(&sev_guest_info);
++    type_register_static(&sev_snp_guest_info);
+ }
+ 
+ type_init(sev_register_types);
+diff --git a/target/i386/sev.h b/target/i386/sev.h
+index 668374eef3..bedc667eeb 100644
+--- a/target/i386/sev.h
++++ b/target/i386/sev.h
+@@ -22,6 +22,7 @@
+ 
+ #define TYPE_SEV_COMMON "sev-common"
+ #define TYPE_SEV_GUEST "sev-guest"
++#define TYPE_SEV_SNP_GUEST "sev-snp-guest"
+ 
+ #define SEV_POLICY_NODBG        0x1
+ #define SEV_POLICY_NOKS         0x2
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-i386-sev-Invoke-launch_updata_data-for-SEV-class.patch b/SOURCES/kvm-i386-sev-Invoke-launch_updata_data-for-SEV-class.patch
new file mode 100644
index 0000000..265da66
--- /dev/null
+++ b/SOURCES/kvm-i386-sev-Invoke-launch_updata_data-for-SEV-class.patch
@@ -0,0 +1,85 @@
+From be37914ae54c8aebc218cf41b37bc0ea1563daae Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Fri, 31 May 2024 12:51:44 +0200
+Subject: [PATCH 074/100] i386/sev: Invoke launch_updata_data() for SEV class
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [74/91] f1b588a9ffecd6944a78186d88a6be3849698710 (bonzini/rhel-qemu-kvm)
+
+Add launch_update_data() in SevCommonStateClass and
+invoke as sev_launch_update_data() for SEV object.
+
+Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com>
+Message-ID: <20240530111643.1091816-26-pankaj.gupta@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 9861405a8f845133b7984322c2df0c43a45553c3)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ target/i386/sev.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/target/i386/sev.c b/target/i386/sev.c
+index 7b5c4b4874..8834cf9441 100644
+--- a/target/i386/sev.c
++++ b/target/i386/sev.c
+@@ -74,6 +74,7 @@ struct SevCommonStateClass {
+     /* public */
+     int (*launch_start)(SevCommonState *sev_common);
+     void (*launch_finish)(SevCommonState *sev_common);
++    int (*launch_update_data)(SevCommonState *sev_common, hwaddr gpa, uint8_t *ptr, uint64_t len);
+     int (*kvm_init)(ConfidentialGuestSupport *cgs, Error **errp);
+ };
+ 
+@@ -929,7 +930,7 @@ out:
+ }
+ 
+ static int
+-sev_launch_update_data(SevGuestState *sev_guest, uint8_t *addr, uint64_t len)
++sev_launch_update_data(SevCommonState *sev_common, hwaddr gpa, uint8_t *addr, uint64_t len)
+ {
+     int ret, fw_error;
+     struct kvm_sev_launch_update_data update;
+@@ -941,7 +942,7 @@ sev_launch_update_data(SevGuestState *sev_guest, uint8_t *addr, uint64_t len)
+     update.uaddr = (uintptr_t)addr;
+     update.len = len;
+     trace_kvm_sev_launch_update_data(addr, len);
+-    ret = sev_ioctl(SEV_COMMON(sev_guest)->sev_fd, KVM_SEV_LAUNCH_UPDATE_DATA,
++    ret = sev_ioctl(sev_common->sev_fd, KVM_SEV_LAUNCH_UPDATE_DATA,
+                     &update, &fw_error);
+     if (ret) {
+         error_report("%s: LAUNCH_UPDATE ret=%d fw_error=%d '%s'",
+@@ -1487,6 +1488,7 @@ int
+ sev_encrypt_flash(hwaddr gpa, uint8_t *ptr, uint64_t len, Error **errp)
+ {
+     SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs);
++    SevCommonStateClass *klass = SEV_COMMON_GET_CLASS(sev_common);
+ 
+     if (!sev_common) {
+         return 0;
+@@ -1494,7 +1496,9 @@ sev_encrypt_flash(hwaddr gpa, uint8_t *ptr, uint64_t len, Error **errp)
+ 
+     /* if SEV is in update state then encrypt the data else do nothing */
+     if (sev_check_state(sev_common, SEV_STATE_LAUNCH_UPDATE)) {
+-        int ret = sev_launch_update_data(SEV_GUEST(sev_common), ptr, len);
++        int ret;
++
++        ret = klass->launch_update_data(sev_common, gpa, ptr, len);
+         if (ret < 0) {
+             error_setg(errp, "SEV: Failed to encrypt pflash rom");
+             return ret;
+@@ -1968,6 +1972,7 @@ sev_guest_class_init(ObjectClass *oc, void *data)
+ 
+     klass->launch_start = sev_launch_start;
+     klass->launch_finish = sev_launch_finish;
++    klass->launch_update_data = sev_launch_update_data;
+     klass->kvm_init = sev_kvm_init;
+     x86_klass->kvm_type = sev_kvm_type;
+ 
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-i386-sev-Invoke-launch_updata_data-for-SNP-class.patch b/SOURCES/kvm-i386-sev-Invoke-launch_updata_data-for-SNP-class.patch
new file mode 100644
index 0000000..f28004d
--- /dev/null
+++ b/SOURCES/kvm-i386-sev-Invoke-launch_updata_data-for-SNP-class.patch
@@ -0,0 +1,55 @@
+From 32899eb4fa5143b795b107de4857adce2cf1d434 Mon Sep 17 00:00:00 2001
+From: Pankaj Gupta <pankaj.gupta@amd.com>
+Date: Thu, 30 May 2024 06:16:38 -0500
+Subject: [PATCH 075/100] i386/sev: Invoke launch_updata_data() for SNP class
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [75/91] 3520af5847f8dddb6d7fe7ad5feb308230f387b9 (bonzini/rhel-qemu-kvm)
+
+Invoke as sev_snp_launch_update_data() for SNP object.
+
+Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com>
+Message-ID: <20240530111643.1091816-27-pankaj.gupta@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 0765d136eba400ad1cb7cae18438bb10eace64dc)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ target/i386/sev.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/target/i386/sev.c b/target/i386/sev.c
+index 8834cf9441..eaf5fc6c6b 100644
+--- a/target/i386/sev.c
++++ b/target/i386/sev.c
+@@ -1091,6 +1091,15 @@ snp_launch_update_data(uint64_t gpa, void *hva,
+     return 0;
+ }
+ 
++static int
++sev_snp_launch_update_data(SevCommonState *sev_common, hwaddr gpa,
++                           uint8_t *ptr, uint64_t len)
++{
++       int ret = snp_launch_update_data(gpa, ptr, len,
++                                         KVM_SEV_SNP_PAGE_TYPE_NORMAL);
++       return ret;
++}
++
+ static int
+ sev_snp_cpuid_info_fill(SnpCpuidInfo *snp_cpuid_info,
+                         const KvmCpuidInfo *kvm_cpuid_info)
+@@ -2216,6 +2225,7 @@ sev_snp_guest_class_init(ObjectClass *oc, void *data)
+ 
+     klass->launch_start = sev_snp_launch_start;
+     klass->launch_finish = sev_snp_launch_finish;
++    klass->launch_update_data = sev_snp_launch_update_data;
+     klass->kvm_init = sev_snp_kvm_init;
+     x86_klass->kvm_type = sev_snp_kvm_type;
+ 
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-i386-sev-Move-SEV_COMMON-null-check-before-dereferen.patch b/SOURCES/kvm-i386-sev-Move-SEV_COMMON-null-check-before-dereferen.patch
new file mode 100644
index 0000000..e38615b
--- /dev/null
+++ b/SOURCES/kvm-i386-sev-Move-SEV_COMMON-null-check-before-dereferen.patch
@@ -0,0 +1,47 @@
+From fa6076291eb45255bc2fe523399d7d0647fc5570 Mon Sep 17 00:00:00 2001
+From: Pankaj Gupta <pankaj.gupta@amd.com>
+Date: Fri, 7 Jun 2024 13:36:10 -0500
+Subject: [PATCH 085/100] i386/sev: Move SEV_COMMON null check before
+ dereferencing
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [85/91] e8d2bfd077766a5e7777b9337d0e77146f883224 (bonzini/rhel-qemu-kvm)
+
+Fixes Coverity CID 1546886.
+
+Fixes: 9861405a8f ("i386/sev: Invoke launch_updata_data() for SEV class")
+Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com>
+Message-ID: <20240607183611.1111100-3-pankaj.gupta@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 48779faef3c8e2fe70bd8285bffa731bd76dc844)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ target/i386/sev.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/target/i386/sev.c b/target/i386/sev.c
+index 7c9df621de..f18432f58e 100644
+--- a/target/i386/sev.c
++++ b/target/i386/sev.c
+@@ -1529,11 +1529,12 @@ int
+ sev_encrypt_flash(hwaddr gpa, uint8_t *ptr, uint64_t len, Error **errp)
+ {
+     SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs);
+-    SevCommonStateClass *klass = SEV_COMMON_GET_CLASS(sev_common);
++    SevCommonStateClass *klass;
+ 
+     if (!sev_common) {
+         return 0;
+     }
++    klass = SEV_COMMON_GET_CLASS(sev_common);
+ 
+     /* if SEV is in update state then encrypt the data else do nothing */
+     if (sev_check_state(sev_common, SEV_STATE_LAUNCH_UPDATE)) {
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-i386-sev-Move-sev_launch_finish-to-separate-class-me.patch b/SOURCES/kvm-i386-sev-Move-sev_launch_finish-to-separate-class-me.patch
new file mode 100644
index 0000000..250a723
--- /dev/null
+++ b/SOURCES/kvm-i386-sev-Move-sev_launch_finish-to-separate-class-me.patch
@@ -0,0 +1,88 @@
+From 4d96ca893126d4c17c9fe03c76973b1d4a414f21 Mon Sep 17 00:00:00 2001
+From: Pankaj Gupta <pankaj.gupta@amd.com>
+Date: Thu, 30 May 2024 06:16:18 -0500
+Subject: [PATCH 058/100] i386/sev: Move sev_launch_finish to separate class
+ method
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [58/91] 7865710d320a6df7038ef7016d350aa9cdcea326 (bonzini/rhel-qemu-kvm)
+
+When sev-snp-guest objects are introduced there will be a number of
+differences in how the launch finish is handled compared to the existing
+sev-guest object. Move sev_launch_finish() to a class method to make it
+easier to implement SNP-specific launch update functionality later.
+
+Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com>
+Message-ID: <20240530111643.1091816-7-pankaj.gupta@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit bce615a14aec07cab0488e5a242f6a91e641efcb)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ target/i386/sev.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/target/i386/sev.c b/target/i386/sev.c
+index b2aa0d6f99..28a018ed83 100644
+--- a/target/i386/sev.c
++++ b/target/i386/sev.c
+@@ -71,6 +71,7 @@ struct SevCommonStateClass {
+ 
+     /* public */
+     int (*launch_start)(SevCommonState *sev_common);
++    void (*launch_finish)(SevCommonState *sev_common);
+ };
+ 
+ /**
+@@ -801,12 +802,12 @@ static Notifier sev_machine_done_notify = {
+ };
+ 
+ static void
+-sev_launch_finish(SevGuestState *sev_guest)
++sev_launch_finish(SevCommonState *sev_common)
+ {
+     int ret, error;
+ 
+     trace_kvm_sev_launch_finish();
+-    ret = sev_ioctl(SEV_COMMON(sev_guest)->sev_fd, KVM_SEV_LAUNCH_FINISH, 0,
++    ret = sev_ioctl(sev_common->sev_fd, KVM_SEV_LAUNCH_FINISH, 0,
+                     &error);
+     if (ret) {
+         error_report("%s: LAUNCH_FINISH ret=%d fw_error=%d '%s'",
+@@ -814,7 +815,7 @@ sev_launch_finish(SevGuestState *sev_guest)
+         exit(1);
+     }
+ 
+-    sev_set_guest_state(SEV_COMMON(sev_guest), SEV_STATE_RUNNING);
++    sev_set_guest_state(sev_common, SEV_STATE_RUNNING);
+ 
+     /* add migration blocker */
+     error_setg(&sev_mig_blocker,
+@@ -826,10 +827,11 @@ static void
+ sev_vm_state_change(void *opaque, bool running, RunState state)
+ {
+     SevCommonState *sev_common = opaque;
++    SevCommonStateClass *klass = SEV_COMMON_GET_CLASS(opaque);
+ 
+     if (running) {
+         if (!sev_check_state(sev_common, SEV_STATE_RUNNING)) {
+-            sev_launch_finish(SEV_GUEST(sev_common));
++            klass->launch_finish(sev_common);
+         }
+     }
+ }
+@@ -1457,6 +1459,7 @@ sev_guest_class_init(ObjectClass *oc, void *data)
+     SevCommonStateClass *klass = SEV_COMMON_CLASS(oc);
+ 
+     klass->launch_start = sev_launch_start;
++    klass->launch_finish = sev_launch_finish;
+ 
+     object_class_property_add_str(oc, "dh-cert-file",
+                                   sev_guest_get_dh_cert_file,
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-i386-sev-Move-sev_launch_update-to-separate-class-me.patch b/SOURCES/kvm-i386-sev-Move-sev_launch_update-to-separate-class-me.patch
new file mode 100644
index 0000000..12824ec
--- /dev/null
+++ b/SOURCES/kvm-i386-sev-Move-sev_launch_update-to-separate-class-me.patch
@@ -0,0 +1,91 @@
+From a170ba2c7dbf2775eb9047779d3643a2a81bb372 Mon Sep 17 00:00:00 2001
+From: Pankaj Gupta <pankaj.gupta@amd.com>
+Date: Thu, 30 May 2024 06:16:17 -0500
+Subject: [PATCH 057/100] i386/sev: Move sev_launch_update to separate class
+ method
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [57/91] 4f31e7afaec6f2c2a7c06cda4d7d27d4037e53e0 (bonzini/rhel-qemu-kvm)
+
+When sev-snp-guest objects are introduced there will be a number of
+differences in how the launch data is handled compared to the existing
+sev-guest object. Move sev_launch_start() to a class method to make it
+easier to implement SNP-specific launch update functionality later.
+
+Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com>
+Message-ID: <20240530111643.1091816-6-pankaj.gupta@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 6600f1ac0c81cbe67faf048ea07f78542dea925f)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ target/i386/sev.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/target/i386/sev.c b/target/i386/sev.c
+index 33e606eea0..b2aa0d6f99 100644
+--- a/target/i386/sev.c
++++ b/target/i386/sev.c
+@@ -69,6 +69,8 @@ struct SevCommonState {
+ struct SevCommonStateClass {
+     X86ConfidentialGuestClass parent_class;
+ 
++    /* public */
++    int (*launch_start)(SevCommonState *sev_common);
+ };
+ 
+ /**
+@@ -632,16 +634,16 @@ sev_read_file_base64(const char *filename, guchar **data, gsize *len)
+ }
+ 
+ static int
+-sev_launch_start(SevGuestState *sev_guest)
++sev_launch_start(SevCommonState *sev_common)
+ {
+     gsize sz;
+     int ret = 1;
+     int fw_error, rc;
++    SevGuestState *sev_guest = SEV_GUEST(sev_common);
+     struct kvm_sev_launch_start start = {
+         .handle = sev_guest->handle, .policy = sev_guest->policy
+     };
+     guchar *session = NULL, *dh_cert = NULL;
+-    SevCommonState *sev_common = SEV_COMMON(sev_guest);
+ 
+     if (sev_guest->session_file) {
+         if (sev_read_file_base64(sev_guest->session_file, &session, &sz) < 0) {
+@@ -862,6 +864,7 @@ static int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
+     uint32_t ebx;
+     uint32_t host_cbitpos;
+     struct sev_user_data_status status = {};
++    SevCommonStateClass *klass = SEV_COMMON_GET_CLASS(cgs);
+ 
+     ret = ram_block_discard_disable(true);
+     if (ret) {
+@@ -952,7 +955,7 @@ static int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
+         goto err;
+     }
+ 
+-    sev_launch_start(SEV_GUEST(sev_common));
++    ret = klass->launch_start(sev_common);
+     if (ret) {
+         error_setg(errp, "%s: failed to create encryption context", __func__);
+         goto err;
+@@ -1451,6 +1454,10 @@ static void sev_guest_set_legacy_vm_type(Object *obj, bool value, Error **errp)
+ static void
+ sev_guest_class_init(ObjectClass *oc, void *data)
+ {
++    SevCommonStateClass *klass = SEV_COMMON_CLASS(oc);
++
++    klass->launch_start = sev_launch_start;
++
+     object_class_property_add_str(oc, "dh-cert-file",
+                                   sev_guest_get_dh_cert_file,
+                                   sev_guest_set_dh_cert_file);
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-i386-sev-Reorder-struct-declarations.patch b/SOURCES/kvm-i386-sev-Reorder-struct-declarations.patch
new file mode 100644
index 0000000..746317d
--- /dev/null
+++ b/SOURCES/kvm-i386-sev-Reorder-struct-declarations.patch
@@ -0,0 +1,134 @@
+From d009fa2cebebd1da80f4f2f5d0c4fffb87e02afc Mon Sep 17 00:00:00 2001
+From: Dov Murik <dovmurik@linux.ibm.com>
+Date: Thu, 30 May 2024 06:16:34 -0500
+Subject: [PATCH 079/100] i386/sev: Reorder struct declarations
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [79/91] 1274d4620e88dda99ec10173ca5e3cd4184c8fb6 (bonzini/rhel-qemu-kvm)
+
+Move the declaration of PaddedSevHashTable before SevSnpGuest so
+we can add a new such field to the latter.
+
+No functional change intended.
+
+Signed-off-by: Dov Murik <dovmurik@linux.ibm.com>
+Signed-off-by: Michael Roth <michael.roth@amd.com>
+Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com>
+Message-ID: <20240530111643.1091816-23-pankaj.gupta@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit cc483bf911931f405dea682c74a3d8b9b6c54369)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ target/i386/sev.c | 84 +++++++++++++++++++++++------------------------
+ 1 file changed, 42 insertions(+), 42 deletions(-)
+
+diff --git a/target/i386/sev.c b/target/i386/sev.c
+index 73f9406715..3fce4c08eb 100644
+--- a/target/i386/sev.c
++++ b/target/i386/sev.c
+@@ -46,6 +46,48 @@ OBJECT_DECLARE_TYPE(SevCommonState, SevCommonStateClass, SEV_COMMON)
+ OBJECT_DECLARE_TYPE(SevGuestState, SevCommonStateClass, SEV_GUEST)
+ OBJECT_DECLARE_TYPE(SevSnpGuestState, SevCommonStateClass, SEV_SNP_GUEST)
+ 
++/* hard code sha256 digest size */
++#define HASH_SIZE 32
++
++typedef struct QEMU_PACKED SevHashTableEntry {
++    QemuUUID guid;
++    uint16_t len;
++    uint8_t hash[HASH_SIZE];
++} SevHashTableEntry;
++
++typedef struct QEMU_PACKED SevHashTable {
++    QemuUUID guid;
++    uint16_t len;
++    SevHashTableEntry cmdline;
++    SevHashTableEntry initrd;
++    SevHashTableEntry kernel;
++} SevHashTable;
++
++/*
++ * Data encrypted by sev_encrypt_flash() must be padded to a multiple of
++ * 16 bytes.
++ */
++typedef struct QEMU_PACKED PaddedSevHashTable {
++    SevHashTable ht;
++    uint8_t padding[ROUND_UP(sizeof(SevHashTable), 16) - sizeof(SevHashTable)];
++} PaddedSevHashTable;
++
++QEMU_BUILD_BUG_ON(sizeof(PaddedSevHashTable) % 16 != 0);
++
++#define SEV_INFO_BLOCK_GUID     "00f771de-1a7e-4fcb-890e-68c77e2fb44e"
++typedef struct __attribute__((__packed__)) SevInfoBlock {
++    /* SEV-ES Reset Vector Address */
++    uint32_t reset_addr;
++} SevInfoBlock;
++
++#define SEV_HASH_TABLE_RV_GUID  "7255371f-3a3b-4b04-927b-1da6efa8d454"
++typedef struct QEMU_PACKED SevHashTableDescriptor {
++    /* SEV hash table area guest address */
++    uint32_t base;
++    /* SEV hash table area size (in bytes) */
++    uint32_t size;
++} SevHashTableDescriptor;
++
+ struct SevCommonState {
+     X86ConfidentialGuest parent_obj;
+ 
+@@ -128,48 +170,6 @@ typedef struct SevLaunchUpdateData {
+ 
+ static QTAILQ_HEAD(, SevLaunchUpdateData) launch_update;
+ 
+-#define SEV_INFO_BLOCK_GUID     "00f771de-1a7e-4fcb-890e-68c77e2fb44e"
+-typedef struct __attribute__((__packed__)) SevInfoBlock {
+-    /* SEV-ES Reset Vector Address */
+-    uint32_t reset_addr;
+-} SevInfoBlock;
+-
+-#define SEV_HASH_TABLE_RV_GUID  "7255371f-3a3b-4b04-927b-1da6efa8d454"
+-typedef struct QEMU_PACKED SevHashTableDescriptor {
+-    /* SEV hash table area guest address */
+-    uint32_t base;
+-    /* SEV hash table area size (in bytes) */
+-    uint32_t size;
+-} SevHashTableDescriptor;
+-
+-/* hard code sha256 digest size */
+-#define HASH_SIZE 32
+-
+-typedef struct QEMU_PACKED SevHashTableEntry {
+-    QemuUUID guid;
+-    uint16_t len;
+-    uint8_t hash[HASH_SIZE];
+-} SevHashTableEntry;
+-
+-typedef struct QEMU_PACKED SevHashTable {
+-    QemuUUID guid;
+-    uint16_t len;
+-    SevHashTableEntry cmdline;
+-    SevHashTableEntry initrd;
+-    SevHashTableEntry kernel;
+-} SevHashTable;
+-
+-/*
+- * Data encrypted by sev_encrypt_flash() must be padded to a multiple of
+- * 16 bytes.
+- */
+-typedef struct QEMU_PACKED PaddedSevHashTable {
+-    SevHashTable ht;
+-    uint8_t padding[ROUND_UP(sizeof(SevHashTable), 16) - sizeof(SevHashTable)];
+-} PaddedSevHashTable;
+-
+-QEMU_BUILD_BUG_ON(sizeof(PaddedSevHashTable) % 16 != 0);
+-
+ static Error *sev_mig_blocker;
+ 
+ static const char *const sev_fw_errlist[] = {
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-i386-sev-Replace-error_report-with-error_setg.patch b/SOURCES/kvm-i386-sev-Replace-error_report-with-error_setg.patch
new file mode 100644
index 0000000..ba66cde
--- /dev/null
+++ b/SOURCES/kvm-i386-sev-Replace-error_report-with-error_setg.patch
@@ -0,0 +1,46 @@
+From 80c1d78e31b2567d1c610c8939b75d159ff6ea27 Mon Sep 17 00:00:00 2001
+From: Pankaj Gupta <pankaj.gupta@amd.com>
+Date: Thu, 30 May 2024 06:16:13 -0500
+Subject: [PATCH 055/100] i386/sev: Replace error_report with error_setg
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [55/91] 1e15fc2458687e564af9fa5022c29e79ddc8edfd (bonzini/rhel-qemu-kvm)
+
+Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com>
+Message-ID: <20240530111643.1091816-2-pankaj.gupta@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 18c453409a3a84cf7b2c764c5a03fb429a73bbeb)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ target/i386/sev.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/target/i386/sev.c b/target/i386/sev.c
+index d30b68c11e..67ed32e5ea 100644
+--- a/target/i386/sev.c
++++ b/target/i386/sev.c
+@@ -952,13 +952,13 @@ static int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
+ 
+     if (sev_es_enabled()) {
+         if (!kvm_kernel_irqchip_allowed()) {
+-            error_report("%s: SEV-ES guests require in-kernel irqchip support",
+-                         __func__);
++            error_setg(errp, "%s: SEV-ES guests require in-kernel irqchip"
++                       "support", __func__);
+             goto err;
+         }
+ 
+         if (!(status.flags & SEV_STATUS_FLAGS_CONFIG_ES)) {
+-            error_report("%s: guest policy requires SEV-ES, but "
++            error_setg(errp, "%s: guest policy requires SEV-ES, but "
+                          "host SEV-ES support unavailable",
+                          __func__);
+             goto err;
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-i386-sev-Return-when-sev_common-is-null.patch b/SOURCES/kvm-i386-sev-Return-when-sev_common-is-null.patch
new file mode 100644
index 0000000..6fc68aa
--- /dev/null
+++ b/SOURCES/kvm-i386-sev-Return-when-sev_common-is-null.patch
@@ -0,0 +1,40 @@
+From 88da6d01b1de2b92adb5c47c6d482876a054705f Mon Sep 17 00:00:00 2001
+From: Pankaj Gupta <pankaj.gupta@amd.com>
+Date: Fri, 7 Jun 2024 13:36:11 -0500
+Subject: [PATCH 086/100] i386/sev: Return when sev_common is null
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [86/91] 02ce4a6a51ce9fd961f417c13db0a760673591ba (bonzini/rhel-qemu-kvm)
+
+Fixes Coverity CID 1546885.
+
+Fixes: 16dcf200dc ("i386/sev: Introduce "sev-common" type to encapsulate common SEV state")
+Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com>
+Message-ID: <20240607183611.1111100-4-pankaj.gupta@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit cd7093a7a168a823d07671348996f049d45e8f67)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ target/i386/sev.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/target/i386/sev.c b/target/i386/sev.c
+index f18432f58e..c40562dce3 100644
+--- a/target/i386/sev.c
++++ b/target/i386/sev.c
+@@ -587,6 +587,7 @@ static SevCapability *sev_get_capabilities(Error **errp)
+     sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs);
+     if (!sev_common) {
+         error_setg(errp, "SEV is not configured");
++        return NULL;
+     }
+ 
+     sev_device = object_property_get_str(OBJECT(sev_common), "sev-device",
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-i386-sev-Set-CPU-state-to-protected-once-SNP-guest-p.patch b/SOURCES/kvm-i386-sev-Set-CPU-state-to-protected-once-SNP-guest-p.patch
new file mode 100644
index 0000000..8548e22
--- /dev/null
+++ b/SOURCES/kvm-i386-sev-Set-CPU-state-to-protected-once-SNP-guest-p.patch
@@ -0,0 +1,47 @@
+From c7649ac1b958dc48de50f32b1ad80d84b17945a8 Mon Sep 17 00:00:00 2001
+From: Michael Roth <michael.roth@amd.com>
+Date: Thu, 30 May 2024 06:16:29 -0500
+Subject: [PATCH 069/100] i386/sev: Set CPU state to protected once SNP guest
+ payload is finalized
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [69/91] 09280f987a186511ec7d62c3f340b2148e8556d7 (bonzini/rhel-qemu-kvm)
+
+Once KVM_SNP_LAUNCH_FINISH is called the vCPU state is copied into the
+vCPU's VMSA page and measured/encrypted. Any attempt to read/write CPU
+state afterward will only be acting on the initial data and so are
+effectively no-ops.
+
+Set the vCPU state to protected at this point so that QEMU don't
+continue trying to re-sync vCPU data during guest runtime.
+
+Signed-off-by: Michael Roth <michael.roth@amd.com>
+Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com>
+Message-ID: <20240530111643.1091816-18-pankaj.gupta@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 3d44fdff60ea66fbd7a33f5d32b50843cd80f48a)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ target/i386/sev.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/target/i386/sev.c b/target/i386/sev.c
+index ef2e592ca7..e84e4395a5 100644
+--- a/target/i386/sev.c
++++ b/target/i386/sev.c
+@@ -997,6 +997,7 @@ sev_snp_launch_finish(SevCommonState *sev_common)
+         exit(1);
+     }
+ 
++    kvm_mark_guest_state_protected();
+     sev_set_guest_state(sev_common, SEV_STATE_RUNNING);
+ 
+     /* add migration blocker */
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-i386-sev-Switch-to-use-confidential_guest_kvm_init.patch b/SOURCES/kvm-i386-sev-Switch-to-use-confidential_guest_kvm_init.patch
new file mode 100644
index 0000000..05ccb0a
--- /dev/null
+++ b/SOURCES/kvm-i386-sev-Switch-to-use-confidential_guest_kvm_init.patch
@@ -0,0 +1,268 @@
+From 5540bb5ca052531563df1ade68995e268ae65224 Mon Sep 17 00:00:00 2001
+From: Xiaoyao Li <xiaoyao.li@intel.com>
+Date: Thu, 29 Feb 2024 01:00:36 -0500
+Subject: [PATCH 012/100] i386/sev: Switch to use confidential_guest_kvm_init()
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [12/91] 6f5f8d1b818826f7ee4b6ae527963ef23c97f531 (bonzini/rhel-qemu-kvm)
+
+Use confidential_guest_kvm_init() instead of calling SEV
+specific sev_kvm_init(). This allows the introduction of multiple
+confidential-guest-support subclasses for different x86 vendors.
+
+As a bonus, stubs are not needed anymore since there is no
+direct call from target/i386/kvm/kvm.c to SEV code.
+
+Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
+Message-Id: <20240229060038.606591-1-xiaoyao.li@intel.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 637c95b37b106c2eeba313e0abb38ec12e918a59)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ target/i386/kvm/kvm.c       |  10 +--
+ target/i386/kvm/meson.build |   2 -
+ target/i386/kvm/sev-stub.c  |  21 ------
+ target/i386/sev.c           | 127 ++++++++++++++++++------------------
+ target/i386/sev.h           |   2 -
+ 5 files changed, 69 insertions(+), 93 deletions(-)
+ delete mode 100644 target/i386/kvm/sev-stub.c
+
+diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
+index 5f30b649a0..e271652620 100644
+--- a/target/i386/kvm/kvm.c
++++ b/target/i386/kvm/kvm.c
+@@ -2543,10 +2543,12 @@ int kvm_arch_init(MachineState *ms, KVMState *s)
+      * mechanisms are supported in future (e.g. TDX), they'll need
+      * their own initialization either here or elsewhere.
+      */
+-    ret = sev_kvm_init(ms->cgs, &local_err);
+-    if (ret < 0) {
+-        error_report_err(local_err);
+-        return ret;
++    if (ms->cgs) {
++        ret = confidential_guest_kvm_init(ms->cgs, &local_err);
++        if (ret < 0) {
++            error_report_err(local_err);
++            return ret;
++        }
+     }
+ 
+     has_xcrs = kvm_check_extension(s, KVM_CAP_XCRS);
+diff --git a/target/i386/kvm/meson.build b/target/i386/kvm/meson.build
+index 84d9143e60..e7850981e6 100644
+--- a/target/i386/kvm/meson.build
++++ b/target/i386/kvm/meson.build
+@@ -7,8 +7,6 @@ i386_kvm_ss.add(files(
+ 
+ i386_kvm_ss.add(when: 'CONFIG_XEN_EMU', if_true: files('xen-emu.c'))
+ 
+-i386_kvm_ss.add(when: 'CONFIG_SEV', if_false: files('sev-stub.c'))
+-
+ i386_system_ss.add(when: 'CONFIG_HYPERV', if_true: files('hyperv.c'), if_false: files('hyperv-stub.c'))
+ 
+ i386_system_ss.add_all(when: 'CONFIG_KVM', if_true: i386_kvm_ss)
+diff --git a/target/i386/kvm/sev-stub.c b/target/i386/kvm/sev-stub.c
+deleted file mode 100644
+index 1be5341e8a..0000000000
+--- a/target/i386/kvm/sev-stub.c
++++ /dev/null
+@@ -1,21 +0,0 @@
+-/*
+- * QEMU SEV stub
+- *
+- * Copyright Advanced Micro Devices 2018
+- *
+- * Authors:
+- *      Brijesh Singh <brijesh.singh@amd.com>
+- *
+- * This work is licensed under the terms of the GNU GPL, version 2 or later.
+- * See the COPYING file in the top-level directory.
+- *
+- */
+-
+-#include "qemu/osdep.h"
+-#include "sev.h"
+-
+-int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
+-{
+-    /* If we get here, cgs must be some non-SEV thing */
+-    return 0;
+-}
+diff --git a/target/i386/sev.c b/target/i386/sev.c
+index 72930ff0dc..b8f79d34d1 100644
+--- a/target/i386/sev.c
++++ b/target/i386/sev.c
+@@ -353,63 +353,6 @@ static void sev_guest_set_kernel_hashes(Object *obj, bool value, Error **errp)
+     sev->kernel_hashes = value;
+ }
+ 
+-static void
+-sev_guest_class_init(ObjectClass *oc, void *data)
+-{
+-    object_class_property_add_str(oc, "sev-device",
+-                                  sev_guest_get_sev_device,
+-                                  sev_guest_set_sev_device);
+-    object_class_property_set_description(oc, "sev-device",
+-            "SEV device to use");
+-    object_class_property_add_str(oc, "dh-cert-file",
+-                                  sev_guest_get_dh_cert_file,
+-                                  sev_guest_set_dh_cert_file);
+-    object_class_property_set_description(oc, "dh-cert-file",
+-            "guest owners DH certificate (encoded with base64)");
+-    object_class_property_add_str(oc, "session-file",
+-                                  sev_guest_get_session_file,
+-                                  sev_guest_set_session_file);
+-    object_class_property_set_description(oc, "session-file",
+-            "guest owners session parameters (encoded with base64)");
+-    object_class_property_add_bool(oc, "kernel-hashes",
+-                                   sev_guest_get_kernel_hashes,
+-                                   sev_guest_set_kernel_hashes);
+-    object_class_property_set_description(oc, "kernel-hashes",
+-            "add kernel hashes to guest firmware for measured Linux boot");
+-}
+-
+-static void
+-sev_guest_instance_init(Object *obj)
+-{
+-    SevGuestState *sev = SEV_GUEST(obj);
+-
+-    sev->sev_device = g_strdup(DEFAULT_SEV_DEVICE);
+-    sev->policy = DEFAULT_GUEST_POLICY;
+-    object_property_add_uint32_ptr(obj, "policy", &sev->policy,
+-                                   OBJ_PROP_FLAG_READWRITE);
+-    object_property_add_uint32_ptr(obj, "handle", &sev->handle,
+-                                   OBJ_PROP_FLAG_READWRITE);
+-    object_property_add_uint32_ptr(obj, "cbitpos", &sev->cbitpos,
+-                                   OBJ_PROP_FLAG_READWRITE);
+-    object_property_add_uint32_ptr(obj, "reduced-phys-bits",
+-                                   &sev->reduced_phys_bits,
+-                                   OBJ_PROP_FLAG_READWRITE);
+-}
+-
+-/* sev guest info */
+-static const TypeInfo sev_guest_info = {
+-    .parent = TYPE_CONFIDENTIAL_GUEST_SUPPORT,
+-    .name = TYPE_SEV_GUEST,
+-    .instance_size = sizeof(SevGuestState),
+-    .instance_finalize = sev_guest_finalize,
+-    .class_init = sev_guest_class_init,
+-    .instance_init = sev_guest_instance_init,
+-    .interfaces = (InterfaceInfo[]) {
+-        { TYPE_USER_CREATABLE },
+-        { }
+-    }
+-};
+-
+ bool
+ sev_enabled(void)
+ {
+@@ -906,20 +849,15 @@ sev_vm_state_change(void *opaque, bool running, RunState state)
+     }
+ }
+ 
+-int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
++static int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
+ {
+-    SevGuestState *sev
+-        = (SevGuestState *)object_dynamic_cast(OBJECT(cgs), TYPE_SEV_GUEST);
++    SevGuestState *sev = SEV_GUEST(cgs);
+     char *devname;
+     int ret, fw_error, cmd;
+     uint32_t ebx;
+     uint32_t host_cbitpos;
+     struct sev_user_data_status status = {};
+ 
+-    if (!sev) {
+-        return 0;
+-    }
+-
+     ret = ram_block_discard_disable(true);
+     if (ret) {
+         error_report("%s: cannot disable RAM discard", __func__);
+@@ -1384,6 +1322,67 @@ bool sev_add_kernel_loader_hashes(SevKernelLoaderContext *ctx, Error **errp)
+     return ret;
+ }
+ 
++static void
++sev_guest_class_init(ObjectClass *oc, void *data)
++{
++    ConfidentialGuestSupportClass *klass = CONFIDENTIAL_GUEST_SUPPORT_CLASS(oc);
++
++    klass->kvm_init = sev_kvm_init;
++
++    object_class_property_add_str(oc, "sev-device",
++                                  sev_guest_get_sev_device,
++                                  sev_guest_set_sev_device);
++    object_class_property_set_description(oc, "sev-device",
++            "SEV device to use");
++    object_class_property_add_str(oc, "dh-cert-file",
++                                  sev_guest_get_dh_cert_file,
++                                  sev_guest_set_dh_cert_file);
++    object_class_property_set_description(oc, "dh-cert-file",
++            "guest owners DH certificate (encoded with base64)");
++    object_class_property_add_str(oc, "session-file",
++                                  sev_guest_get_session_file,
++                                  sev_guest_set_session_file);
++    object_class_property_set_description(oc, "session-file",
++            "guest owners session parameters (encoded with base64)");
++    object_class_property_add_bool(oc, "kernel-hashes",
++                                   sev_guest_get_kernel_hashes,
++                                   sev_guest_set_kernel_hashes);
++    object_class_property_set_description(oc, "kernel-hashes",
++            "add kernel hashes to guest firmware for measured Linux boot");
++}
++
++static void
++sev_guest_instance_init(Object *obj)
++{
++    SevGuestState *sev = SEV_GUEST(obj);
++
++    sev->sev_device = g_strdup(DEFAULT_SEV_DEVICE);
++    sev->policy = DEFAULT_GUEST_POLICY;
++    object_property_add_uint32_ptr(obj, "policy", &sev->policy,
++                                   OBJ_PROP_FLAG_READWRITE);
++    object_property_add_uint32_ptr(obj, "handle", &sev->handle,
++                                   OBJ_PROP_FLAG_READWRITE);
++    object_property_add_uint32_ptr(obj, "cbitpos", &sev->cbitpos,
++                                   OBJ_PROP_FLAG_READWRITE);
++    object_property_add_uint32_ptr(obj, "reduced-phys-bits",
++                                   &sev->reduced_phys_bits,
++                                   OBJ_PROP_FLAG_READWRITE);
++}
++
++/* sev guest info */
++static const TypeInfo sev_guest_info = {
++    .parent = TYPE_CONFIDENTIAL_GUEST_SUPPORT,
++    .name = TYPE_SEV_GUEST,
++    .instance_size = sizeof(SevGuestState),
++    .instance_finalize = sev_guest_finalize,
++    .class_init = sev_guest_class_init,
++    .instance_init = sev_guest_instance_init,
++    .interfaces = (InterfaceInfo[]) {
++        { TYPE_USER_CREATABLE },
++        { }
++    }
++};
++
+ static void
+ sev_register_types(void)
+ {
+diff --git a/target/i386/sev.h b/target/i386/sev.h
+index e7499c95b1..9e10d09539 100644
+--- a/target/i386/sev.h
++++ b/target/i386/sev.h
+@@ -57,6 +57,4 @@ int sev_inject_launch_secret(const char *hdr, const char *secret,
+ int sev_es_save_reset_vector(void *flash_ptr, uint64_t flash_size);
+ void sev_es_set_reset_vector(CPUState *cpu);
+ 
+-int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp);
+-
+ #endif
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-i386-sev-Update-query-sev-QAPI-format-to-handle-SEV-.patch b/SOURCES/kvm-i386-sev-Update-query-sev-QAPI-format-to-handle-SEV-.patch
new file mode 100644
index 0000000..27852d5
--- /dev/null
+++ b/SOURCES/kvm-i386-sev-Update-query-sev-QAPI-format-to-handle-SEV-.patch
@@ -0,0 +1,240 @@
+From a870e7c31d9605baea4741d82521612b6164c99b Mon Sep 17 00:00:00 2001
+From: Michael Roth <michael.roth@amd.com>
+Date: Thu, 30 May 2024 06:16:26 -0500
+Subject: [PATCH 066/100] i386/sev: Update query-sev QAPI format to handle
+ SEV-SNP
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [66/91] a19b3e226e857f3995176e7d2ef1ce2e4329a885 (bonzini/rhel-qemu-kvm)
+
+Most of the current 'query-sev' command is relevant to both legacy
+SEV/SEV-ES guests and SEV-SNP guests, with 2 exceptions:
+
+  - 'policy' is a 64-bit field for SEV-SNP, not 32-bit, and
+    the meaning of the bit positions has changed
+  - 'handle' is not relevant to SEV-SNP
+
+To address this, this patch adds a new 'sev-type' field that can be
+used as a discriminator to select between SEV and SEV-SNP-specific
+fields/formats without breaking compatibility for existing management
+tools (so long as management tools that add support for launching
+SEV-SNP guest update their handling of query-sev appropriately).
+
+The corresponding HMP command has also been fixed up similarly.
+
+Signed-off-by: Michael Roth <michael.roth@amd.com>
+Co-developed-by:Pankaj Gupta <pankaj.gupta@amd.com>
+Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com>
+Message-ID: <20240530111643.1091816-15-pankaj.gupta@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 59d3740cb4ac0f010ce35877572904f6297284b4)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ qapi/misc-target.json | 72 ++++++++++++++++++++++++++++++++++---------
+ target/i386/sev.c     | 55 +++++++++++++++++++++------------
+ target/i386/sev.h     |  3 ++
+ 3 files changed, 96 insertions(+), 34 deletions(-)
+
+diff --git a/qapi/misc-target.json b/qapi/misc-target.json
+index 4e0a6492a9..2d7d4d89bd 100644
+--- a/qapi/misc-target.json
++++ b/qapi/misc-target.json
+@@ -47,6 +47,50 @@
+            'send-update', 'receive-update' ],
+   'if': 'TARGET_I386' }
+ 
++##
++# @SevGuestType:
++#
++# An enumeration indicating the type of SEV guest being run.
++#
++# @sev: The guest is a legacy SEV or SEV-ES guest.
++#
++# @sev-snp: The guest is an SEV-SNP guest.
++#
++# Since: 6.2
++##
++{ 'enum': 'SevGuestType',
++  'data': [ 'sev', 'sev-snp' ],
++  'if': 'TARGET_I386' }
++
++##
++# @SevGuestInfo:
++#
++# Information specific to legacy SEV/SEV-ES guests.
++#
++# @policy: SEV policy value
++#
++# @handle: SEV firmware handle
++#
++# Since: 2.12
++##
++{ 'struct': 'SevGuestInfo',
++  'data': { 'policy': 'uint32',
++            'handle': 'uint32' },
++  'if': 'TARGET_I386' }
++
++##
++# @SevSnpGuestInfo:
++#
++# Information specific to SEV-SNP guests.
++#
++# @snp-policy: SEV-SNP policy value
++#
++# Since: 9.1
++##
++{ 'struct': 'SevSnpGuestInfo',
++  'data': { 'snp-policy': 'uint64' },
++  'if': 'TARGET_I386' }
++
+ ##
+ # @SevInfo:
+ #
+@@ -60,25 +104,25 @@
+ #
+ # @build-id: SEV FW build id
+ #
+-# @policy: SEV policy value
+-#
+ # @state: SEV guest state
+ #
+-# @handle: SEV firmware handle
++# @sev-type: Type of SEV guest being run
+ #
+ # Since: 2.12
+ ##
+-{ 'struct': 'SevInfo',
+-    'data': { 'enabled': 'bool',
+-              'api-major': 'uint8',
+-              'api-minor' : 'uint8',
+-              'build-id' : 'uint8',
+-              'policy' : 'uint32',
+-              'state' : 'SevState',
+-              'handle' : 'uint32'
+-            },
+-  'if': 'TARGET_I386'
+-}
++{ 'union': 'SevInfo',
++  'base': { 'enabled': 'bool',
++            'api-major': 'uint8',
++            'api-minor' : 'uint8',
++            'build-id' : 'uint8',
++            'state' : 'SevState',
++            'sev-type' : 'SevGuestType' },
++  'discriminator': 'sev-type',
++  'data': {
++      'sev': 'SevGuestInfo',
++      'sev-snp': 'SevSnpGuestInfo' },
++  'if': 'TARGET_I386' }
++
+ 
+ ##
+ # @query-sev:
+diff --git a/target/i386/sev.c b/target/i386/sev.c
+index 072cc4f853..43d1c48bd9 100644
+--- a/target/i386/sev.c
++++ b/target/i386/sev.c
+@@ -363,25 +363,27 @@ static SevInfo *sev_get_info(void)
+ {
+     SevInfo *info;
+     SevCommonState *sev_common = SEV_COMMON(MACHINE(qdev_get_machine())->cgs);
+-    SevGuestState *sev_guest =
+-        (SevGuestState *)object_dynamic_cast(OBJECT(sev_common),
+-                                             TYPE_SEV_GUEST);
+ 
+     info = g_new0(SevInfo, 1);
+     info->enabled = sev_enabled();
+ 
+     if (info->enabled) {
+-        if (sev_guest) {
+-            info->handle = sev_guest->handle;
+-        }
+         info->api_major = sev_common->api_major;
+         info->api_minor = sev_common->api_minor;
+         info->build_id = sev_common->build_id;
+         info->state = sev_common->state;
+-        /* we only report the lower 32-bits of policy for SNP, ok for now... */
+-        info->policy =
+-            (uint32_t)object_property_get_uint(OBJECT(sev_common),
+-                                               "policy", NULL);
++
++        if (sev_snp_enabled()) {
++            info->sev_type = SEV_GUEST_TYPE_SEV_SNP;
++            info->u.sev_snp.snp_policy =
++                object_property_get_uint(OBJECT(sev_common), "policy", NULL);
++        } else {
++            info->sev_type = SEV_GUEST_TYPE_SEV;
++            info->u.sev.handle = SEV_GUEST(sev_common)->handle;
++            info->u.sev.policy =
++                (uint32_t)object_property_get_uint(OBJECT(sev_common),
++                                                   "policy", NULL);
++        }
+     }
+ 
+     return info;
+@@ -404,20 +406,33 @@ void hmp_info_sev(Monitor *mon, const QDict *qdict)
+ {
+     SevInfo *info = sev_get_info();
+ 
+-    if (info && info->enabled) {
+-        monitor_printf(mon, "handle: %d\n", info->handle);
+-        monitor_printf(mon, "state: %s\n", SevState_str(info->state));
+-        monitor_printf(mon, "build: %d\n", info->build_id);
+-        monitor_printf(mon, "api version: %d.%d\n",
+-                       info->api_major, info->api_minor);
++    if (!info || !info->enabled) {
++        monitor_printf(mon, "SEV is not enabled\n");
++        goto out;
++    }
++
++    monitor_printf(mon, "SEV type: %s\n", SevGuestType_str(info->sev_type));
++    monitor_printf(mon, "state: %s\n", SevState_str(info->state));
++    monitor_printf(mon, "build: %d\n", info->build_id);
++    monitor_printf(mon, "api version: %d.%d\n", info->api_major,
++                   info->api_minor);
++
++    if (sev_snp_enabled()) {
+         monitor_printf(mon, "debug: %s\n",
+-                       info->policy & SEV_POLICY_NODBG ? "off" : "on");
+-        monitor_printf(mon, "key-sharing: %s\n",
+-                       info->policy & SEV_POLICY_NOKS ? "off" : "on");
++                       info->u.sev_snp.snp_policy & SEV_SNP_POLICY_DBG ? "on"
++                                                                       : "off");
++        monitor_printf(mon, "SMT allowed: %s\n",
++                       info->u.sev_snp.snp_policy & SEV_SNP_POLICY_SMT ? "on"
++                                                                       : "off");
+     } else {
+-        monitor_printf(mon, "SEV is not enabled\n");
++        monitor_printf(mon, "handle: %d\n", info->u.sev.handle);
++        monitor_printf(mon, "debug: %s\n",
++                       info->u.sev.policy & SEV_POLICY_NODBG ? "off" : "on");
++        monitor_printf(mon, "key-sharing: %s\n",
++                       info->u.sev.policy & SEV_POLICY_NOKS ? "off" : "on");
+     }
+ 
++out:
+     qapi_free_SevInfo(info);
+ }
+ 
+diff --git a/target/i386/sev.h b/target/i386/sev.h
+index 94295ee74f..5dc4767b1e 100644
+--- a/target/i386/sev.h
++++ b/target/i386/sev.h
+@@ -31,6 +31,9 @@
+ #define SEV_POLICY_DOMAIN       0x10
+ #define SEV_POLICY_SEV          0x20
+ 
++#define SEV_SNP_POLICY_SMT      0x10000
++#define SEV_SNP_POLICY_DBG      0x80000
++
+ typedef struct SevKernelLoaderContext {
+     char *setup_data;
+     size_t setup_size;
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-i386-sev-fix-unreachable-code-coverity-issue.patch b/SOURCES/kvm-i386-sev-fix-unreachable-code-coverity-issue.patch
new file mode 100644
index 0000000..56f9f6f
--- /dev/null
+++ b/SOURCES/kvm-i386-sev-fix-unreachable-code-coverity-issue.patch
@@ -0,0 +1,51 @@
+From 98057e3adafa052b21a4fe5ef22835d30df3e644 Mon Sep 17 00:00:00 2001
+From: Pankaj Gupta <pankaj.gupta@amd.com>
+Date: Fri, 7 Jun 2024 13:36:09 -0500
+Subject: [PATCH 084/100] i386/sev: fix unreachable code coverity issue
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [84/91] dc7bf28f491bf675b22a98ea593fba72d8bc415a (bonzini/rhel-qemu-kvm)
+
+Set 'finish->id_block_en' early, so that it is properly reset.
+
+Fixes coverity CID 1546887.
+
+Fixes: 7b34df4426 ("i386/sev: Introduce 'sev-snp-guest' object")
+Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com>
+Message-ID: <20240607183611.1111100-2-pankaj.gupta@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit c94eb5db8e409c932da9eb187e68d4cdc14acc5b)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ target/i386/sev.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/target/i386/sev.c b/target/i386/sev.c
+index 004c667ac1..7c9df621de 100644
+--- a/target/i386/sev.c
++++ b/target/i386/sev.c
+@@ -2165,6 +2165,7 @@ sev_snp_guest_set_id_block(Object *obj, const char *value, Error **errp)
+     struct kvm_sev_snp_launch_finish *finish = &sev_snp_guest->kvm_finish_conf;
+     gsize len;
+ 
++    finish->id_block_en = 0;
+     g_free(sev_snp_guest->id_block);
+     g_free((guchar *)finish->id_block_uaddr);
+ 
+@@ -2184,7 +2185,7 @@ sev_snp_guest_set_id_block(Object *obj, const char *value, Error **errp)
+         return;
+     }
+ 
+-    finish->id_block_en = (len) ? 1 : 0;
++    finish->id_block_en = 1;
+ }
+ 
+ static char *
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-include-ui-rect.h-fix-qemu_rect_init-mis-assignment.patch b/SOURCES/kvm-include-ui-rect.h-fix-qemu_rect_init-mis-assignment.patch
deleted file mode 100644
index 0cf782e..0000000
--- a/SOURCES/kvm-include-ui-rect.h-fix-qemu_rect_init-mis-assignment.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-From 51b8f29cddb73eb02f91af5f52a205fdd3af6583 Mon Sep 17 00:00:00 2001
-From: Thomas Huth <thuth@redhat.com>
-Date: Wed, 17 Jan 2024 21:08:59 +0100
-Subject: [PATCH 099/101] include/ui/rect.h: fix qemu_rect_init()
- mis-assignment
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 216: Fix regression in QEMU's virtio-gpu VNC sessions
-RH-Jira: RHEL-21570
-RH-Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Commit: [1/1] a9d487be04e2c1847b80c479b5cc790af81e3428 (thuth/qemu-kvm-cs9)
-
-JIRA: https://issues.redhat.com/browse/RHEL-21570
-
-commit 9d5b42beb6978dc6219d5dc029c9d453c6b8d503
-Author: Elen Avan <elen.avan@bk.ru>
-Date:   Fri Dec 22 22:17:21 2023 +0300
-
-    include/ui/rect.h: fix qemu_rect_init() mis-assignment
-
-    Signed-off-by: Elen Avan <elen.avan@bk.ru>
-    Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2051
-    Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2050
-    Fixes: a200d53b1fde "virtio-gpu: replace PIXMAN for region/rect test"
-    Cc: qemu-stable@nongnu.org
-    Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
-    Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
-    Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
-
-Signed-off-by: Thomas Huth <thuth@redhat.com>
----
- include/ui/rect.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/include/ui/rect.h b/include/ui/rect.h
-index 94898f92d0..68f05d78a8 100644
---- a/include/ui/rect.h
-+++ b/include/ui/rect.h
-@@ -19,7 +19,7 @@ static inline void qemu_rect_init(QemuRect *rect,
-                                   uint16_t width, uint16_t height)
- {
-     rect->x = x;
--    rect->y = x;
-+    rect->y = y;
-     rect->width = width;
-     rect->height = height;
- }
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-introduce-pc_rhel_9_5_compat.patch b/SOURCES/kvm-introduce-pc_rhel_9_5_compat.patch
new file mode 100644
index 0000000..9a17dda
--- /dev/null
+++ b/SOURCES/kvm-introduce-pc_rhel_9_5_compat.patch
@@ -0,0 +1,81 @@
+From deae6c3b57c3919946a5ce1613e667a3240cf158 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Mon, 15 Apr 2024 12:45:09 +0200
+Subject: [PATCH 001/100] introduce pc_rhel_9_5_compat
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [1/91] cfd402fa5080eddba7c954e81ed79f9a1dd654cf (bonzini/rhel-qemu-kvm)
+
+Allow undoing backported changes that impact guest ABI.
+
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ hw/i386/pc.c         | 4 ++++
+ hw/i386/pc_piix.c    | 2 ++
+ hw/i386/pc_q35.c     | 2 ++
+ include/hw/i386/pc.h | 3 +++
+ 4 files changed, 11 insertions(+)
+
+diff --git a/hw/i386/pc.c b/hw/i386/pc.c
+index 4a154c1a9a..648762d908 100644
+--- a/hw/i386/pc.c
++++ b/hw/i386/pc.c
+@@ -348,6 +348,10 @@ GlobalProperty pc_rhel_compat[] = {
+ };
+ const size_t pc_rhel_compat_len = G_N_ELEMENTS(pc_rhel_compat);
+ 
++GlobalProperty pc_rhel_9_5_compat[] = {
++};
++const size_t pc_rhel_9_5_compat_len = G_N_ELEMENTS(pc_rhel_9_5_compat);
++
+ GlobalProperty pc_rhel_9_3_compat[] = {
+     /* pc_rhel_9_3_compat from pc_compat_8_0 */
+     { "virtio-mem", "unplugged-inaccessible", "auto" },
+diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
+index 6b260682eb..bef3e8b73e 100644
+--- a/hw/i386/pc_piix.c
++++ b/hw/i386/pc_piix.c
+@@ -1015,6 +1015,8 @@ static void pc_machine_rhel760_options(MachineClass *m)
+     object_class_property_set_description(oc, "x-south-bridge",
+                                      "Use a different south bridge than PIIX3");
+ 
++    compat_props_add(m->compat_props, pc_rhel_9_5_compat,
++		     pc_rhel_9_5_compat_len);
+     compat_props_add(m->compat_props, hw_compat_rhel_9_5,
+ 		     hw_compat_rhel_9_5_len);
+     compat_props_add(m->compat_props, hw_compat_rhel_9_4,
+diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
+index 2b54944c0f..9adcdadce8 100644
+--- a/hw/i386/pc_q35.c
++++ b/hw/i386/pc_q35.c
+@@ -734,6 +734,8 @@ static void pc_q35_machine_rhel940_options(MachineClass *m)
+     pcmc->smbios_stream_product = "RHEL";
+     pcmc->smbios_stream_version = "9.4.0";
+ 
++    compat_props_add(m->compat_props, pc_rhel_9_5_compat,
++		     pc_rhel_9_5_compat_len);
+     compat_props_add(m->compat_props, hw_compat_rhel_9_5,
+ 		     hw_compat_rhel_9_5_len);
+ }
+diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
+index a984c951ad..87420783ab 100644
+--- a/include/hw/i386/pc.h
++++ b/include/hw/i386/pc.h
+@@ -294,6 +294,9 @@ extern const size_t pc_compat_2_0_len;
+ extern GlobalProperty pc_rhel_compat[];
+ extern const size_t pc_rhel_compat_len;
+ 
++extern GlobalProperty pc_rhel_9_5_compat[];
++extern const size_t pc_rhel_9_5_compat_len;
++
+ extern GlobalProperty pc_rhel_9_3_compat[];
+ extern const size_t pc_rhel_9_3_compat_len;
+ 
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-iotests-244-Don-t-store-data-file-with-protocol-in-i.patch b/SOURCES/kvm-iotests-244-Don-t-store-data-file-with-protocol-in-i.patch
index 0e2fa11..137cb53 100644
--- a/SOURCES/kvm-iotests-244-Don-t-store-data-file-with-protocol-in-i.patch
+++ b/SOURCES/kvm-iotests-244-Don-t-store-data-file-with-protocol-in-i.patch
@@ -1,35 +1,27 @@
-From c2eafeb32a256cbafb0e65c0380acb478181326e Mon Sep 17 00:00:00 2001
-From: Jon Maloy <jmaloy@redhat.com>
-Date: Wed, 5 Jun 2024 19:56:51 -0400
+From 16c2e9e339a4c83055fd39e032fa16a0e732ed17 Mon Sep 17 00:00:00 2001
+From: Kevin Wolf <kwolf@redhat.com>
+Date: Thu, 25 Apr 2024 14:49:40 +0200
 Subject: [PATCH 2/4] iotests/244: Don't store data-file with protocol in image
 
-RH-Author: Jon Maloy <jmaloy@redhat.com>
-RH-MergeRequest: 2: EMBARGOED CVE-2024-4467 for rhel-9.4.z (PRDSC)
-RH-Jira: https://issues.redhat.com/browse/RHEL-35610
+RH-Author: Hana Czenczek <hczenczek@redhat.com>
+RH-MergeRequest: 1: CVE 2024-4467 (PRDSC)
+RH-Jira: RHEL-35611
 RH-CVE: CVE-2024-4467
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Acked-by: Hanna Czenczek <hczenczek@redhat.com>
-RH-Commit: [2/4] ddef095945aa55bb0aacc2a2cb58f9e12ad20d5e
-
-commit 92e00dab8be1570b13172353d77d2af44cb4e22b
-Author: Kevin Wolf <kwolf@redhat.com>
-Date:   Thu Apr 25 14:49:40 2024 +0200
-
-    iotests/244: Don't store data-file with protocol in image
-
-    We want to disable filename parsing for data files because it's too easy
-    to abuse in malicious image files. Make the test ready for the change by
-    passing the data file explicitly in command line options.
-
-    Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-    Reviewed-by: Eric Blake <eblake@redhat.com>
-    Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-    Reviewed-by: Hanna Czenczek <hreitz@redhat.com>
-    Upstream: N/A, embargoed
-    Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
-
-Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+RH-Acked-by: Eric Blake <eblake@redhat.com>
+RH-Commit: [2/4] 92e00dab8be1570b13172353d77d2af44cb4e22b
+
+We want to disable filename parsing for data files because it's too easy
+to abuse in malicious image files. Make the test ready for the change by
+passing the data file explicitly in command line options.
+
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+Reviewed-by: Eric Blake <eblake@redhat.com>
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Reviewed-by: Hanna Czenczek <hreitz@redhat.com>
+Upstream: N/A, embargoed
+Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 ---
  tests/qemu-iotests/244 | 19 ++++++++++++++++---
  1 file changed, 16 insertions(+), 3 deletions(-)
diff --git a/SOURCES/kvm-iotests-270-Don-t-store-data-file-with-json-prefix-i.patch b/SOURCES/kvm-iotests-270-Don-t-store-data-file-with-json-prefix-i.patch
index caeac22..2c1d6ae 100644
--- a/SOURCES/kvm-iotests-270-Don-t-store-data-file-with-json-prefix-i.patch
+++ b/SOURCES/kvm-iotests-270-Don-t-store-data-file-with-json-prefix-i.patch
@@ -1,36 +1,28 @@
-From 931ab59f39b5e3551b328fe5b0f872df7a19ba05 Mon Sep 17 00:00:00 2001
-From: Jon Maloy <jmaloy@redhat.com>
-Date: Wed, 5 Jun 2024 19:56:51 -0400
+From d70daa2eb5b670513ccd36c0baa5b36ec8cef666 Mon Sep 17 00:00:00 2001
+From: Kevin Wolf <kwolf@redhat.com>
+Date: Thu, 25 Apr 2024 14:49:40 +0200
 Subject: [PATCH 3/4] iotests/270: Don't store data-file with json: prefix in
  image
 
-RH-Author: Jon Maloy <jmaloy@redhat.com>
-RH-MergeRequest: 2: EMBARGOED CVE-2024-4467 for rhel-9.4.z (PRDSC)
-RH-Jira: https://issues.redhat.com/browse/RHEL-35610
+RH-Author: Hana Czenczek <hczenczek@redhat.com>
+RH-MergeRequest: 1: CVE 2024-4467 (PRDSC)
+RH-Jira: RHEL-35611
 RH-CVE: CVE-2024-4467
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Acked-by: Hanna Czenczek <hczenczek@redhat.com>
-RH-Commit: [3/4] 7a9844fd48e3f3c4d1711ea4fb671c795ca4a1c1
+RH-Acked-by: Eric Blake <eblake@redhat.com>
+RH-Commit: [3/4] 705bcc2819ce8e0f8b9d660a93bc48de26413aec
 
-commit 705bcc2819ce8e0f8b9d660a93bc48de26413aec
-Author: Kevin Wolf <kwolf@redhat.com>
-Date:   Thu Apr 25 14:49:40 2024 +0200
+We want to disable filename parsing for data files because it's too easy
+to abuse in malicious image files. Make the test ready for the change by
+passing the data file explicitly in command line options.
 
-    iotests/270: Don't store data-file with json: prefix in image
-
-    We want to disable filename parsing for data files because it's too easy
-    to abuse in malicious image files. Make the test ready for the change by
-    passing the data file explicitly in command line options.
-
-    Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-    Reviewed-by: Eric Blake <eblake@redhat.com>
-    Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-    Reviewed-by: Hanna Czenczek <hreitz@redhat.com>
-    Upstream: N/A, embargoed
-    Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
-
-Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+Reviewed-by: Eric Blake <eblake@redhat.com>
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Reviewed-by: Hanna Czenczek <hreitz@redhat.com>
+Upstream: N/A, embargoed
+Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 ---
  tests/qemu-iotests/270 | 14 +++++++++++---
  1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/SOURCES/kvm-iotests-Add-test-for-reset-AioContext-switches-with-.patch b/SOURCES/kvm-iotests-Add-test-for-reset-AioContext-switches-with-.patch
deleted file mode 100644
index 3b2841f..0000000
--- a/SOURCES/kvm-iotests-Add-test-for-reset-AioContext-switches-with-.patch
+++ /dev/null
@@ -1,133 +0,0 @@
-From 65d58819ff7b012e43b5f1da1356b559d3f5a962 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Thu, 14 Mar 2024 17:58:25 +0100
-Subject: [PATCH 3/4] iotests: Add test for reset/AioContext switches with NBD
- exports
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 231: Fix deadlock and crash during storage migration
-RH-Jira: RHEL-28125
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Acked-by: Eric Blake <eblake@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [3/3] 7266acdf85271d157497bfe452aa6eeb58fbe7c6 (kmwolf/centos-qemu-kvm)
-
-This replicates the scenario in which the bug was reported.
-Unfortunately this relies on actually executing a guest (so that the
-firmware initialises the virtio-blk device and moves it to its
-configured iothread), so this can't make use of the qtest accelerator
-like most other test cases. I tried to find a different easy way to
-trigger the bug, but couldn't find one.
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Message-ID: <20240314165825.40261-3-kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit e8fce34eccf68a32f4ecf2c6f121ff2ac383d6bf)
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- tests/qemu-iotests/tests/iothreads-nbd-export | 66 +++++++++++++++++++
- .../tests/iothreads-nbd-export.out            | 19 ++++++
- 2 files changed, 85 insertions(+)
- create mode 100755 tests/qemu-iotests/tests/iothreads-nbd-export
- create mode 100644 tests/qemu-iotests/tests/iothreads-nbd-export.out
-
-diff --git a/tests/qemu-iotests/tests/iothreads-nbd-export b/tests/qemu-iotests/tests/iothreads-nbd-export
-new file mode 100755
-index 0000000000..037260729c
---- /dev/null
-+++ b/tests/qemu-iotests/tests/iothreads-nbd-export
-@@ -0,0 +1,66 @@
-+#!/usr/bin/env python3
-+# group: rw quick
-+#
-+# Copyright (C) 2024 Red Hat, Inc.
-+#
-+# This program is free software; you can redistribute it and/or modify
-+# it under the terms of the GNU General Public License as published by
-+# the Free Software Foundation; either version 2 of the License, or
-+# (at your option) any later version.
-+#
-+# This program is distributed in the hope that it will be useful,
-+# but WITHOUT ANY WARRANTY; without even the implied warranty of
-+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+# GNU General Public License for more details.
-+#
-+# You should have received a copy of the GNU General Public License
-+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-+#
-+# Creator/Owner: Kevin Wolf <kwolf@redhat.com>
-+
-+import time
-+import qemu
-+import iotests
-+
-+iotests.script_initialize(supported_fmts=['qcow2'],
-+                          supported_platforms=['linux'])
-+
-+with iotests.FilePath('disk1.img') as path, \
-+     iotests.FilePath('nbd.sock', base_dir=iotests.sock_dir) as nbd_sock, \
-+     qemu.machine.QEMUMachine(iotests.qemu_prog) as vm:
-+
-+    img_size = '10M'
-+
-+    iotests.log('Preparing disk...')
-+    iotests.qemu_img_create('-f', iotests.imgfmt, path, img_size)
-+    vm.add_args('-blockdev', f'file,node-name=disk-file,filename={path}')
-+    vm.add_args('-blockdev', 'qcow2,node-name=disk,file=disk-file')
-+    vm.add_args('-object', 'iothread,id=iothread0')
-+    vm.add_args('-device',
-+                'virtio-blk,drive=disk,iothread=iothread0,share-rw=on')
-+
-+    iotests.log('Launching VM...')
-+    vm.add_args('-accel', 'kvm', '-accel', 'tcg')
-+    #vm.add_args('-accel', 'qtest')
-+    vm.launch()
-+
-+    iotests.log('Exporting to NBD...')
-+    iotests.log(vm.qmp('nbd-server-start',
-+                       addr={'type': 'unix', 'data': {'path': nbd_sock}}))
-+    iotests.log(vm.qmp('block-export-add', type='nbd', id='exp0',
-+                       node_name='disk', writable=True))
-+
-+    iotests.log('Connecting qemu-img...')
-+    qemu_io = iotests.QemuIoInteractive('-f', 'raw',
-+                                        f'nbd+unix:///disk?socket={nbd_sock}')
-+
-+    iotests.log('Moving the NBD export to a different iothread...')
-+    for i in range(0, 10):
-+        iotests.log(vm.qmp('system_reset'))
-+        time.sleep(0.1)
-+
-+    iotests.log('Checking that it is still alive...')
-+    iotests.log(vm.qmp('query-status'))
-+
-+    qemu_io.close()
-+    vm.shutdown()
-diff --git a/tests/qemu-iotests/tests/iothreads-nbd-export.out b/tests/qemu-iotests/tests/iothreads-nbd-export.out
-new file mode 100644
-index 0000000000..bc514e35e5
---- /dev/null
-+++ b/tests/qemu-iotests/tests/iothreads-nbd-export.out
-@@ -0,0 +1,19 @@
-+Preparing disk...
-+Launching VM...
-+Exporting to NBD...
-+{"return": {}}
-+{"return": {}}
-+Connecting qemu-img...
-+Moving the NBD export to a different iothread...
-+{"return": {}}
-+{"return": {}}
-+{"return": {}}
-+{"return": {}}
-+{"return": {}}
-+{"return": {}}
-+{"return": {}}
-+{"return": {}}
-+{"return": {}}
-+{"return": {}}
-+Checking that it is still alive...
-+{"return": {"running": true, "status": "running"}}
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-iotests-add-filter_qmp_generated_node_ids.patch b/SOURCES/kvm-iotests-add-filter_qmp_generated_node_ids.patch
deleted file mode 100644
index d9072f5..0000000
--- a/SOURCES/kvm-iotests-add-filter_qmp_generated_node_ids.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From a9be663beaace1c31d75ca353e5d3bb0657a4f6c Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Thu, 18 Jan 2024 09:48:21 -0500
-Subject: [PATCH 11/22] iotests: add filter_qmp_generated_node_ids()
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 219: virtio-blk: add iothread-vq-mapping parameter
-RH-Jira: RHEL-17369 RHEL-20764 RHEL-7356
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Commit: [7/17] 8dd20acc5b1e992294ed422e80897a9c221940dd (stefanha/centos-stream-qemu-kvm)
-
-Add a filter function for QMP responses that contain QEMU's
-automatically generated node ids. The ids change between runs and must
-be masked in the reference output.
-
-The next commit will use this new function.
-
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20240118144823.1497953-2-stefanha@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit da62b507a20510d819bcfbe8f5e573409b954006)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- tests/qemu-iotests/iotests.py | 7 +++++++
- 1 file changed, 7 insertions(+)
-
-diff --git a/tests/qemu-iotests/iotests.py b/tests/qemu-iotests/iotests.py
-index e5c5798c71..ea48af4a7b 100644
---- a/tests/qemu-iotests/iotests.py
-+++ b/tests/qemu-iotests/iotests.py
-@@ -651,6 +651,13 @@ def _filter(_key, value):
- def filter_generated_node_ids(msg):
-     return re.sub("#block[0-9]+", "NODE_NAME", msg)
- 
-+def filter_qmp_generated_node_ids(qmsg):
-+    def _filter(_key, value):
-+        if is_str(value):
-+            return filter_generated_node_ids(value)
-+        return value
-+    return filter_qmp(qmsg, _filter)
-+
- def filter_img_info(output: str, filename: str,
-                     drop_child_info: bool = True) -> str:
-     lines = []
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-iotests-iothreads-stream-Use-the-right-TimeoutError.patch b/SOURCES/kvm-iotests-iothreads-stream-Use-the-right-TimeoutError.patch
deleted file mode 100644
index ab63004..0000000
--- a/SOURCES/kvm-iotests-iothreads-stream-Use-the-right-TimeoutError.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From 453da839a7d81896d03b827a95c1991a60740dc5 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Thu, 25 Jan 2024 16:21:50 +0100
-Subject: [PATCH 21/22] iotests/iothreads-stream: Use the right TimeoutError
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 219: virtio-blk: add iothread-vq-mapping parameter
-RH-Jira: RHEL-17369 RHEL-20764 RHEL-7356
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Commit: [17/17] ca5a512ccccb668089b726d7499562d1e294c828 (stefanha/centos-stream-qemu-kvm)
-
-Since Python 3.11 asyncio.TimeoutError is an alias for TimeoutError, but
-in older versions it's not. We really have to catch asyncio.TimeoutError
-here, otherwise a slow test run will fail (as has happened multiple
-times on CI recently).
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Message-ID: <20240125152150.42389-1-kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit c9c0b37ff4c11b712b21efabe8e5381d223d0295)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- tests/qemu-iotests/tests/iothreads-stream | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/tests/qemu-iotests/tests/iothreads-stream b/tests/qemu-iotests/tests/iothreads-stream
-index 503f221f16..231195b5e8 100755
---- a/tests/qemu-iotests/tests/iothreads-stream
-+++ b/tests/qemu-iotests/tests/iothreads-stream
-@@ -18,6 +18,7 @@
- #
- # Creator/Owner: Kevin Wolf <kwolf@redhat.com>
- 
-+import asyncio
- import iotests
- 
- iotests.script_initialize(supported_fmts=['qcow2'],
-@@ -69,6 +70,6 @@ with iotests.FilePath('disk1.img') as base1_path, \
-                 # The test is done once both jobs are gone
-                 if finished == 2:
-                     break
--        except TimeoutError:
-+        except asyncio.TimeoutError:
-             pass
-         vm.cmd('query-jobs')
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-iotests-port-141-to-Python-for-reliable-QMP-testing.patch b/SOURCES/kvm-iotests-port-141-to-Python-for-reliable-QMP-testing.patch
deleted file mode 100644
index 209bd1e..0000000
--- a/SOURCES/kvm-iotests-port-141-to-Python-for-reliable-QMP-testing.patch
+++ /dev/null
@@ -1,592 +0,0 @@
-From 70efc3bbf1f7d7b1b0c2475d9ce3bb70cc9d1cc7 Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Thu, 18 Jan 2024 09:48:22 -0500
-Subject: [PATCH 12/22] iotests: port 141 to Python for reliable QMP testing
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 219: virtio-blk: add iothread-vq-mapping parameter
-RH-Jira: RHEL-17369 RHEL-20764 RHEL-7356
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Commit: [8/17] 0783f536508916feac4b4c39e41c22c24a2e52e7 (stefanha/centos-stream-qemu-kvm)
-
-The common.qemu bash functions allow tests to interact with the QMP
-monitor of a QEMU process. I spent two days trying to update 141 when
-the order of the test output changed, but found it would still fail
-occassionally because printf() and QMP events race with synchronous QMP
-communication.
-
-I gave up and ported 141 to the existing Python API for QMP tests. The
-Python API is less affected by the order in which QEMU prints output
-because it does not print all QMP traffic by default.
-
-The next commit changes the order in which QMP messages are received.
-Make 141 reliable first.
-
-Cc: Hanna Czenczek <hreitz@redhat.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20240118144823.1497953-3-stefanha@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 9ee2dd4c22a3639c5462b3fc20df60c005c3de64)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- tests/qemu-iotests/141     | 307 ++++++++++++++++---------------------
- tests/qemu-iotests/141.out | 200 ++++++------------------
- 2 files changed, 176 insertions(+), 331 deletions(-)
-
-diff --git a/tests/qemu-iotests/141 b/tests/qemu-iotests/141
-index a37030ee17..a7d3985a02 100755
---- a/tests/qemu-iotests/141
-+++ b/tests/qemu-iotests/141
-@@ -1,9 +1,12 @@
--#!/usr/bin/env bash
-+#!/usr/bin/env python3
- # group: rw auto quick
- #
- # Test case for ejecting BDSs with block jobs still running on them
- #
--# Copyright (C) 2016 Red Hat, Inc.
-+# Originally written in bash by Hanna Czenczek, ported to Python by Stefan
-+# Hajnoczi.
-+#
-+# Copyright Red Hat
- #
- # This program is free software; you can redistribute it and/or modify
- # it under the terms of the GNU General Public License as published by
-@@ -19,177 +22,129 @@
- # along with this program.  If not, see <http://www.gnu.org/licenses/>.
- #
- 
--# creator
--owner=hreitz@redhat.com
--
--seq="$(basename $0)"
--echo "QA output created by $seq"
--
--status=1	# failure is the default!
--
--_cleanup()
--{
--    _cleanup_qemu
--    _cleanup_test_img
--    for img in "$TEST_DIR"/{b,m,o}.$IMGFMT; do
--        _rm_test_img "$img"
--    done
--}
--trap "_cleanup; exit \$status" 0 1 2 3 15
--
--# get standard environment, filters and checks
--. ./common.rc
--. ./common.filter
--. ./common.qemu
--
--# Needs backing file and backing format support
--_supported_fmt qcow2 qed
--_supported_proto file
--_supported_os Linux
--
--
--test_blockjob()
--{
--    _send_qemu_cmd $QEMU_HANDLE \
--        "{'execute': 'blockdev-add',
--          'arguments': {
--              'node-name': 'drv0',
--              'driver': '$IMGFMT',
--              'file': {
--                  'driver': 'file',
--                  'filename': '$TEST_IMG'
--              }}}" \
--        'return'
--
--    # If "$2" is an event, we may or may not see it before the
--    # {"return": {}}.  Therefore, filter the {"return": {}} out both
--    # here and in the next command.  (Naturally, if we do not see it
--    # here, we will see it before the next command can be executed,
--    # so it will appear in the next _send_qemu_cmd's output.)
--    _send_qemu_cmd $QEMU_HANDLE \
--        "$1" \
--        "$2" \
--        | _filter_img_create | _filter_qmp_empty_return
--
--    # We want this to return an error because the block job is still running
--    _send_qemu_cmd $QEMU_HANDLE \
--        "{'execute': 'blockdev-del',
--          'arguments': {'node-name': 'drv0'}}" \
--        'error' | _filter_generated_node_ids | _filter_qmp_empty_return
--
--    _send_qemu_cmd $QEMU_HANDLE \
--        "{'execute': 'block-job-cancel',
--          'arguments': {'device': 'job0'}}" \
--        "$3"
--
--    _send_qemu_cmd $QEMU_HANDLE \
--        "{'execute': 'blockdev-del',
--          'arguments': {'node-name': 'drv0'}}" \
--        'return'
--}
--
--
--TEST_IMG="$TEST_DIR/b.$IMGFMT" _make_test_img 1M
--TEST_IMG="$TEST_DIR/m.$IMGFMT" _make_test_img -b "$TEST_DIR/b.$IMGFMT" -F $IMGFMT 1M
--_make_test_img -b "$TEST_DIR/m.$IMGFMT" 1M -F $IMGFMT
--
--_launch_qemu -nodefaults
--
--_send_qemu_cmd $QEMU_HANDLE \
--    "{'execute': 'qmp_capabilities'}" \
--    'return'
--
--echo
--echo '=== Testing drive-backup ==='
--echo
--
--# drive-backup will not send BLOCK_JOB_READY by itself, and cancelling the job
--# will consequently result in BLOCK_JOB_CANCELLED being emitted.
--
--test_blockjob \
--    "{'execute': 'drive-backup',
--      'arguments': {'job-id': 'job0',
--                    'device': 'drv0',
--                    'target': '$TEST_DIR/o.$IMGFMT',
--                    'format': '$IMGFMT',
--                    'sync': 'none'}}" \
--    'return' \
--    '"status": "null"'
--
--echo
--echo '=== Testing drive-mirror ==='
--echo
--
--# drive-mirror will send BLOCK_JOB_READY basically immediately, and cancelling
--# the job will consequently result in BLOCK_JOB_COMPLETED being emitted.
--
--test_blockjob \
--    "{'execute': 'drive-mirror',
--      'arguments': {'job-id': 'job0',
--                    'device': 'drv0',
--                    'target': '$TEST_DIR/o.$IMGFMT',
--                    'format': '$IMGFMT',
--                    'sync': 'none'}}" \
--    'BLOCK_JOB_READY' \
--    '"status": "null"'
--
--echo
--echo '=== Testing active block-commit ==='
--echo
--
--# An active block-commit will send BLOCK_JOB_READY basically immediately, and
--# cancelling the job will consequently result in BLOCK_JOB_COMPLETED being
--# emitted.
--
--test_blockjob \
--    "{'execute': 'block-commit',
--      'arguments': {'job-id': 'job0', 'device': 'drv0'}}" \
--    'BLOCK_JOB_READY' \
--    '"status": "null"'
--
--echo
--echo '=== Testing non-active block-commit ==='
--echo
--
--# Give block-commit something to work on, otherwise it would be done
--# immediately, send a BLOCK_JOB_COMPLETED and ejecting the BDS would work just
--# fine without the block job still running.
--
--$QEMU_IO -c 'write 0 1M' "$TEST_DIR/m.$IMGFMT" | _filter_qemu_io
--
--test_blockjob \
--    "{'execute': 'block-commit',
--      'arguments': {'job-id': 'job0',
--                    'device': 'drv0',
--                    'top':    '$TEST_DIR/m.$IMGFMT',
--                    'speed':  1}}" \
--    'return' \
--    '"status": "null"'
--
--echo
--echo '=== Testing block-stream ==='
--echo
--
--# Give block-stream something to work on, otherwise it would be done
--# immediately, send a BLOCK_JOB_COMPLETED and ejecting the BDS would work just
--# fine without the block job still running.
--
--$QEMU_IO -c 'write 0 1M' "$TEST_DIR/b.$IMGFMT" | _filter_qemu_io
--
--# With some data to stream (and @speed set to 1), block-stream will not complete
--# until we send the block-job-cancel command.
--
--test_blockjob \
--    "{'execute': 'block-stream',
--      'arguments': {'job-id': 'job0',
--                    'device': 'drv0',
--                    'speed': 1}}" \
--    'return' \
--    '"status": "null"'
--
--_cleanup_qemu
--
--# success, all done
--echo "*** done"
--rm -f $seq.full
--status=0
-+import iotests
-+
-+# Common filters to mask values that vary in the test output
-+QMP_FILTERS = [iotests.filter_qmp_testfiles, \
-+               iotests.filter_qmp_imgfmt]
-+
-+
-+class TestCase:
-+    def __init__(self, name, vm, image_path, cancel_event):
-+        self.name = name
-+        self.vm = vm
-+        self.image_path = image_path
-+        self.cancel_event = cancel_event
-+
-+    def __enter__(self):
-+        iotests.log(f'=== Testing {self.name} ===')
-+        self.vm.qmp_log('blockdev-add', \
-+                        node_name='drv0', \
-+                        driver=iotests.imgfmt, \
-+                        file={'driver': 'file', 'filename': self.image_path}, \
-+                        filters=QMP_FILTERS)
-+
-+    def __exit__(self, *exc_details):
-+        # This is expected to fail because the job still exists
-+        self.vm.qmp_log('blockdev-del', node_name='drv0', \
-+                        filters=[iotests.filter_qmp_generated_node_ids])
-+
-+        self.vm.qmp_log('block-job-cancel', device='job0')
-+        event = self.vm.event_wait(self.cancel_event)
-+        iotests.log(event, filters=[iotests.filter_qmp_event])
-+
-+        # This time it succeeds
-+        self.vm.qmp_log('blockdev-del', node_name='drv0')
-+
-+        # Separate test cases in output
-+        iotests.log('')
-+
-+
-+def main() -> None:
-+    with iotests.FilePath('bottom', 'middle', 'top', 'target') as \
-+            (bottom_path, middle_path, top_path, target_path), \
-+         iotests.VM() as vm:
-+
-+        iotests.log('Creating bottom <- middle <- top backing file chain...')
-+        IMAGE_SIZE='1M'
-+        iotests.qemu_img_create('-f', iotests.imgfmt, bottom_path, IMAGE_SIZE)
-+        iotests.qemu_img_create('-f', iotests.imgfmt, \
-+                                '-F', iotests.imgfmt, \
-+                                '-b', bottom_path, \
-+                                middle_path, \
-+                                IMAGE_SIZE)
-+        iotests.qemu_img_create('-f', iotests.imgfmt, \
-+                                '-F', iotests.imgfmt, \
-+                                '-b', middle_path, \
-+                                top_path, \
-+                                IMAGE_SIZE)
-+
-+        iotests.log('Starting VM...')
-+        vm.add_args('-nodefaults')
-+        vm.launch()
-+
-+        # drive-backup will not send BLOCK_JOB_READY by itself, and cancelling
-+        # the job will consequently result in BLOCK_JOB_CANCELLED being
-+        # emitted.
-+        with TestCase('drive-backup', vm, top_path, 'BLOCK_JOB_CANCELLED'):
-+            vm.qmp_log('drive-backup', \
-+                       job_id='job0', \
-+                       device='drv0', \
-+                       target=target_path, \
-+                       format=iotests.imgfmt, \
-+                       sync='none', \
-+                       filters=QMP_FILTERS)
-+
-+        # drive-mirror will send BLOCK_JOB_READY basically immediately, and
-+        # cancelling the job will consequently result in BLOCK_JOB_COMPLETED
-+        # being emitted.
-+        with TestCase('drive-mirror', vm, top_path, 'BLOCK_JOB_COMPLETED'):
-+            vm.qmp_log('drive-mirror', \
-+                       job_id='job0', \
-+                       device='drv0', \
-+                       target=target_path, \
-+                       format=iotests.imgfmt, \
-+                       sync='none', \
-+                       filters=QMP_FILTERS)
-+            event = vm.event_wait('BLOCK_JOB_READY')
-+            assert event is not None # silence mypy
-+            iotests.log(event, filters=[iotests.filter_qmp_event])
-+
-+        # An active block-commit will send BLOCK_JOB_READY basically
-+        # immediately, and cancelling the job will consequently result in
-+        # BLOCK_JOB_COMPLETED being emitted.
-+        with TestCase('active block-commit', vm, top_path, \
-+                      'BLOCK_JOB_COMPLETED'):
-+            vm.qmp_log('block-commit', \
-+                       job_id='job0', \
-+                       device='drv0')
-+            event = vm.event_wait('BLOCK_JOB_READY')
-+            assert event is not None # silence mypy
-+            iotests.log(event, filters=[iotests.filter_qmp_event])
-+
-+        # Give block-commit something to work on, otherwise it would be done
-+        # immediately, send a BLOCK_JOB_COMPLETED and ejecting the BDS would
-+        # work just fine without the block job still running.
-+        iotests.qemu_io(middle_path, '-c', f'write 0 {IMAGE_SIZE}')
-+        with TestCase('non-active block-commit', vm, top_path, \
-+                      'BLOCK_JOB_CANCELLED'):
-+            vm.qmp_log('block-commit', \
-+                       job_id='job0', \
-+                       device='drv0', \
-+                       top=middle_path, \
-+                       speed=1, \
-+                       filters=[iotests.filter_qmp_testfiles])
-+
-+        # Give block-stream something to work on, otherwise it would be done
-+        # immediately, send a BLOCK_JOB_COMPLETED and ejecting the BDS would
-+        # work just fine without the block job still running.
-+        iotests.qemu_io(bottom_path, '-c', f'write 0 {IMAGE_SIZE}')
-+        with TestCase('block-stream', vm, top_path, 'BLOCK_JOB_CANCELLED'):
-+            vm.qmp_log('block-stream', \
-+                       job_id='job0', \
-+                       device='drv0', \
-+                       speed=1)
-+
-+if __name__ == '__main__':
-+    iotests.script_main(main, supported_fmts=['qcow2', 'qed'],
-+                        supported_protocols=['file'])
-diff --git a/tests/qemu-iotests/141.out b/tests/qemu-iotests/141.out
-index 63203d9944..91b7ba50af 100644
---- a/tests/qemu-iotests/141.out
-+++ b/tests/qemu-iotests/141.out
-@@ -1,179 +1,69 @@
--QA output created by 141
--Formatting 'TEST_DIR/b.IMGFMT', fmt=IMGFMT size=1048576
--Formatting 'TEST_DIR/m.IMGFMT', fmt=IMGFMT size=1048576 backing_file=TEST_DIR/b.IMGFMT backing_fmt=IMGFMT
--Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1048576 backing_file=TEST_DIR/m.IMGFMT backing_fmt=IMGFMT
--{'execute': 'qmp_capabilities'}
--{"return": {}}
--
-+Creating bottom <- middle <- top backing file chain...
-+Starting VM...
- === Testing drive-backup ===
--
--{'execute': 'blockdev-add',
--          'arguments': {
--              'node-name': 'drv0',
--              'driver': 'IMGFMT',
--              'file': {
--                  'driver': 'file',
--                  'filename': 'TEST_DIR/t.IMGFMT'
--              }}}
--{"return": {}}
--{'execute': 'drive-backup',
--'arguments': {'job-id': 'job0',
--'device': 'drv0',
--'target': 'TEST_DIR/o.IMGFMT',
--'format': 'IMGFMT',
--'sync': 'none'}}
--Formatting 'TEST_DIR/o.IMGFMT', fmt=IMGFMT size=1048576 backing_file=TEST_DIR/t.IMGFMT backing_fmt=IMGFMT
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "job0"}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "job0"}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "paused", "id": "job0"}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "job0"}}
--{'execute': 'blockdev-del',
--          'arguments': {'node-name': 'drv0'}}
-+{"execute": "blockdev-add", "arguments": {"driver": "IMGFMT", "file": {"driver": "file", "filename": "TEST_DIR/PID-top"}, "node-name": "drv0"}}
-+{"return": {}}
-+{"execute": "drive-backup", "arguments": {"device": "drv0", "format": "IMGFMT", "job-id": "job0", "sync": "none", "target": "TEST_DIR/PID-target"}}
-+{"return": {}}
-+{"execute": "blockdev-del", "arguments": {"node-name": "drv0"}}
- {"error": {"class": "GenericError", "desc": "Node 'drv0' is busy: node is used as backing hd of 'NODE_NAME'"}}
--{'execute': 'block-job-cancel',
--          'arguments': {'device': 'job0'}}
-+{"execute": "block-job-cancel", "arguments": {"device": "job0"}}
- {"return": {}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "aborting", "id": "job0"}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_CANCELLED", "data": {"device": "job0", "len": 1048576, "offset": 0, "speed": 0, "type": "backup"}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "job0"}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "job0"}}
--{'execute': 'blockdev-del',
--          'arguments': {'node-name': 'drv0'}}
-+{"data": {"device": "job0", "len": 1048576, "offset": 0, "speed": 0, "type": "backup"}, "event": "BLOCK_JOB_CANCELLED", "timestamp": {"microseconds": "USECS", "seconds": "SECS"}}
-+{"execute": "blockdev-del", "arguments": {"node-name": "drv0"}}
- {"return": {}}
- 
- === Testing drive-mirror ===
--
--{'execute': 'blockdev-add',
--          'arguments': {
--              'node-name': 'drv0',
--              'driver': 'IMGFMT',
--              'file': {
--                  'driver': 'file',
--                  'filename': 'TEST_DIR/t.IMGFMT'
--              }}}
--{"return": {}}
--{'execute': 'drive-mirror',
--'arguments': {'job-id': 'job0',
--'device': 'drv0',
--'target': 'TEST_DIR/o.IMGFMT',
--'format': 'IMGFMT',
--'sync': 'none'}}
--Formatting 'TEST_DIR/o.IMGFMT', fmt=IMGFMT size=1048576 backing_file=TEST_DIR/t.IMGFMT backing_fmt=IMGFMT
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "job0"}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "job0"}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "job0"}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_READY", "data": {"device": "job0", "len": 0, "offset": 0, "speed": 0, "type": "mirror"}}
--{'execute': 'blockdev-del',
--          'arguments': {'node-name': 'drv0'}}
-+{"execute": "blockdev-add", "arguments": {"driver": "IMGFMT", "file": {"driver": "file", "filename": "TEST_DIR/PID-top"}, "node-name": "drv0"}}
-+{"return": {}}
-+{"execute": "drive-mirror", "arguments": {"device": "drv0", "format": "IMGFMT", "job-id": "job0", "sync": "none", "target": "TEST_DIR/PID-target"}}
-+{"return": {}}
-+{"data": {"device": "job0", "len": 0, "offset": 0, "speed": 0, "type": "mirror"}, "event": "BLOCK_JOB_READY", "timestamp": {"microseconds": "USECS", "seconds": "SECS"}}
-+{"execute": "blockdev-del", "arguments": {"node-name": "drv0"}}
- {"error": {"class": "GenericError", "desc": "Node 'drv0' is busy: block device is in use by block job: mirror"}}
--{'execute': 'block-job-cancel',
--          'arguments': {'device': 'job0'}}
-+{"execute": "block-job-cancel", "arguments": {"device": "job0"}}
- {"return": {}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "waiting", "id": "job0"}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "pending", "id": "job0"}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_COMPLETED", "data": {"device": "job0", "len": 0, "offset": 0, "speed": 0, "type": "mirror"}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "job0"}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "job0"}}
--{'execute': 'blockdev-del',
--          'arguments': {'node-name': 'drv0'}}
-+{"data": {"device": "job0", "len": 0, "offset": 0, "speed": 0, "type": "mirror"}, "event": "BLOCK_JOB_COMPLETED", "timestamp": {"microseconds": "USECS", "seconds": "SECS"}}
-+{"execute": "blockdev-del", "arguments": {"node-name": "drv0"}}
- {"return": {}}
- 
- === Testing active block-commit ===
--
--{'execute': 'blockdev-add',
--          'arguments': {
--              'node-name': 'drv0',
--              'driver': 'IMGFMT',
--              'file': {
--                  'driver': 'file',
--                  'filename': 'TEST_DIR/t.IMGFMT'
--              }}}
--{"return": {}}
--{'execute': 'block-commit',
--'arguments': {'job-id': 'job0', 'device': 'drv0'}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "job0"}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "job0"}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "job0"}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_READY", "data": {"device": "job0", "len": 0, "offset": 0, "speed": 0, "type": "commit"}}
--{'execute': 'blockdev-del',
--          'arguments': {'node-name': 'drv0'}}
-+{"execute": "blockdev-add", "arguments": {"driver": "IMGFMT", "file": {"driver": "file", "filename": "TEST_DIR/PID-top"}, "node-name": "drv0"}}
-+{"return": {}}
-+{"execute": "block-commit", "arguments": {"device": "drv0", "job-id": "job0"}}
-+{"return": {}}
-+{"data": {"device": "job0", "len": 0, "offset": 0, "speed": 0, "type": "commit"}, "event": "BLOCK_JOB_READY", "timestamp": {"microseconds": "USECS", "seconds": "SECS"}}
-+{"execute": "blockdev-del", "arguments": {"node-name": "drv0"}}
- {"error": {"class": "GenericError", "desc": "Node 'drv0' is busy: block device is in use by block job: commit"}}
--{'execute': 'block-job-cancel',
--          'arguments': {'device': 'job0'}}
-+{"execute": "block-job-cancel", "arguments": {"device": "job0"}}
- {"return": {}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "waiting", "id": "job0"}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "pending", "id": "job0"}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_COMPLETED", "data": {"device": "job0", "len": 0, "offset": 0, "speed": 0, "type": "commit"}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "job0"}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "job0"}}
--{'execute': 'blockdev-del',
--          'arguments': {'node-name': 'drv0'}}
-+{"data": {"device": "job0", "len": 0, "offset": 0, "speed": 0, "type": "commit"}, "event": "BLOCK_JOB_COMPLETED", "timestamp": {"microseconds": "USECS", "seconds": "SECS"}}
-+{"execute": "blockdev-del", "arguments": {"node-name": "drv0"}}
- {"return": {}}
- 
- === Testing non-active block-commit ===
--
--wrote 1048576/1048576 bytes at offset 0
--1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
--{'execute': 'blockdev-add',
--          'arguments': {
--              'node-name': 'drv0',
--              'driver': 'IMGFMT',
--              'file': {
--                  'driver': 'file',
--                  'filename': 'TEST_DIR/t.IMGFMT'
--              }}}
--{"return": {}}
--{'execute': 'block-commit',
--'arguments': {'job-id': 'job0',
--'device': 'drv0',
--'top':    'TEST_DIR/m.IMGFMT',
--'speed':  1}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "job0"}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "job0"}}
--{'execute': 'blockdev-del',
--          'arguments': {'node-name': 'drv0'}}
-+{"execute": "blockdev-add", "arguments": {"driver": "IMGFMT", "file": {"driver": "file", "filename": "TEST_DIR/PID-top"}, "node-name": "drv0"}}
-+{"return": {}}
-+{"execute": "block-commit", "arguments": {"device": "drv0", "job-id": "job0", "speed": 1, "top": "TEST_DIR/PID-middle"}}
-+{"return": {}}
-+{"execute": "blockdev-del", "arguments": {"node-name": "drv0"}}
- {"error": {"class": "GenericError", "desc": "Node 'drv0' is busy: block device is in use by block job: commit"}}
--{'execute': 'block-job-cancel',
--          'arguments': {'device': 'job0'}}
-+{"execute": "block-job-cancel", "arguments": {"device": "job0"}}
- {"return": {}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "aborting", "id": "job0"}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_CANCELLED", "data": {"device": "job0", "len": 1048576, "offset": 524288, "speed": 1, "type": "commit"}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "job0"}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "job0"}}
--{'execute': 'blockdev-del',
--          'arguments': {'node-name': 'drv0'}}
-+{"data": {"device": "job0", "len": 1048576, "offset": 524288, "speed": 1, "type": "commit"}, "event": "BLOCK_JOB_CANCELLED", "timestamp": {"microseconds": "USECS", "seconds": "SECS"}}
-+{"execute": "blockdev-del", "arguments": {"node-name": "drv0"}}
- {"return": {}}
- 
- === Testing block-stream ===
--
--wrote 1048576/1048576 bytes at offset 0
--1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
--{'execute': 'blockdev-add',
--          'arguments': {
--              'node-name': 'drv0',
--              'driver': 'IMGFMT',
--              'file': {
--                  'driver': 'file',
--                  'filename': 'TEST_DIR/t.IMGFMT'
--              }}}
--{"return": {}}
--{'execute': 'block-stream',
--'arguments': {'job-id': 'job0',
--'device': 'drv0',
--'speed': 1}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "job0"}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "job0"}}
--{'execute': 'blockdev-del',
--          'arguments': {'node-name': 'drv0'}}
-+{"execute": "blockdev-add", "arguments": {"driver": "IMGFMT", "file": {"driver": "file", "filename": "TEST_DIR/PID-top"}, "node-name": "drv0"}}
-+{"return": {}}
-+{"execute": "block-stream", "arguments": {"device": "drv0", "job-id": "job0", "speed": 1}}
-+{"return": {}}
-+{"execute": "blockdev-del", "arguments": {"node-name": "drv0"}}
- {"error": {"class": "GenericError", "desc": "Node 'drv0' is busy: block device is in use by block job: stream"}}
--{'execute': 'block-job-cancel',
--          'arguments': {'device': 'job0'}}
-+{"execute": "block-job-cancel", "arguments": {"device": "job0"}}
- {"return": {}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "aborting", "id": "job0"}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_CANCELLED", "data": {"device": "job0", "len": 1048576, "offset": 524288, "speed": 1, "type": "stream"}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "job0"}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "job0"}}
--{'execute': 'blockdev-del',
--          'arguments': {'node-name': 'drv0'}}
-+{"data": {"device": "job0", "len": 1048576, "offset": 524288, "speed": 1, "type": "stream"}, "event": "BLOCK_JOB_CANCELLED", "timestamp": {"microseconds": "USECS", "seconds": "SECS"}}
-+{"execute": "blockdev-del", "arguments": {"node-name": "drv0"}}
- {"return": {}}
--*** done
-+
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-iotests-test-NBD-TLS-iothread.patch b/SOURCES/kvm-iotests-test-NBD-TLS-iothread.patch
index 9d47aab..5640a7e 100644
--- a/SOURCES/kvm-iotests-test-NBD-TLS-iothread.patch
+++ b/SOURCES/kvm-iotests-test-NBD-TLS-iothread.patch
@@ -1,17 +1,17 @@
-From 4296c41178438f9dffa16c538b0c1a2e28944f4c Mon Sep 17 00:00:00 2001
+From 88adaeaecb1d7753aa8ac3da40f617d93eaf8bdc Mon Sep 17 00:00:00 2001
 From: Eric Blake <eblake@redhat.com>
 Date: Fri, 17 May 2024 21:50:15 -0500
-Subject: [PATCH 4/4] iotests: test NBD+TLS+iothread
+Subject: [PATCH 2/4] iotests: test NBD+TLS+iothread
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 
 RH-Author: Eric Blake <eblake@redhat.com>
-RH-MergeRequest: 375: Fix regression on nbd+tls
-RH-Jira: RHEL-33754
+RH-MergeRequest: 244: qio: Inherit follow_coroutine_ctx across TLS
+RH-Jira: RHEL-33440
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [4/4] 5905c09466f4e65f3ff9973b41f42cbe1d75363c (ebblake/qemu-kvm)
+RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+RH-Commit: [2/2] 29c3128a158b7c49fa79c141a9adcc12693f7de4 (ebblake/centos-qemu-kvm)
 
 Prevent regressions when using NBD with TLS in the presence of
 iothreads, adding coverage the fix to qio channels made in the
@@ -27,7 +27,7 @@ Signed-off-by: Eric Blake <eblake@redhat.com>
 Message-ID: <20240531180639.1392905-6-eblake@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 (cherry picked from commit a73c99378022ebb785481e84cfe1e81097546268)
-Jira: https://issues.redhat.com/browse/RHEL-33754
+Jira: https://issues.redhat.com/browse/RHEL-33440
 Signed-off-by: Eric Blake <eblake@redhat.com>
 ---
  tests/qemu-iotests/tests/nbd-tls-iothread     | 168 ++++++++++++++++++
diff --git a/SOURCES/kvm-job-remove-outdated-AioContext-locking-comments.patch b/SOURCES/kvm-job-remove-outdated-AioContext-locking-comments.patch
deleted file mode 100644
index fc1c62f..0000000
--- a/SOURCES/kvm-job-remove-outdated-AioContext-locking-comments.patch
+++ /dev/null
@@ -1,105 +0,0 @@
-From 4ab25b33831fa207500179bd30f29388d81e4cce Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Tue, 5 Dec 2023 13:20:10 -0500
-Subject: [PATCH 093/101] job: remove outdated AioContext locking comments
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 214: Remove AioContext lock
-RH-Jira: RHEL-15965
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [24/26] 15ff2928be82d6905c22619458487fbb72d6044a (kmwolf/centos-qemu-kvm)
-
-The AioContext lock no longer exists.
-
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Message-ID: <20231205182011.1976568-14-stefanha@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- include/qemu/job.h | 20 --------------------
- 1 file changed, 20 deletions(-)
-
-diff --git a/include/qemu/job.h b/include/qemu/job.h
-index e502787dd8..9ea98b5927 100644
---- a/include/qemu/job.h
-+++ b/include/qemu/job.h
-@@ -67,8 +67,6 @@ typedef struct Job {
- 
-     /**
-      * The completion function that will be called when the job completes.
--     * Called with AioContext lock held, since many callback implementations
--     * use bdrv_* functions that require to hold the lock.
-      */
-     BlockCompletionFunc *cb;
- 
-@@ -264,9 +262,6 @@ struct JobDriver {
-      *
-      * This callback will not be invoked if the job has already failed.
-      * If it fails, abort and then clean will be called.
--     *
--     * Called with AioContext lock held, since many callbacs implementations
--     * use bdrv_* functions that require to hold the lock.
-      */
-     int (*prepare)(Job *job);
- 
-@@ -277,9 +272,6 @@ struct JobDriver {
-      *
-      * All jobs will complete with a call to either .commit() or .abort() but
-      * never both.
--     *
--     * Called with AioContext lock held, since many callback implementations
--     * use bdrv_* functions that require to hold the lock.
-      */
-     void (*commit)(Job *job);
- 
-@@ -290,9 +282,6 @@ struct JobDriver {
-      *
-      * All jobs will complete with a call to either .commit() or .abort() but
-      * never both.
--     *
--     * Called with AioContext lock held, since many callback implementations
--     * use bdrv_* functions that require to hold the lock.
-      */
-     void (*abort)(Job *job);
- 
-@@ -301,9 +290,6 @@ struct JobDriver {
-      * .commit() or .abort(). Regardless of which callback is invoked after
-      * completion, .clean() will always be called, even if the job does not
-      * belong to a transaction group.
--     *
--     * Called with AioContext lock held, since many callbacs implementations
--     * use bdrv_* functions that require to hold the lock.
-      */
-     void (*clean)(Job *job);
- 
-@@ -318,17 +304,12 @@ struct JobDriver {
-      * READY).
-      * (If the callback is NULL, the job is assumed to terminate
-      * without I/O.)
--     *
--     * Called with AioContext lock held, since many callback implementations
--     * use bdrv_* functions that require to hold the lock.
-      */
-     bool (*cancel)(Job *job, bool force);
- 
- 
-     /**
-      * Called when the job is freed.
--     * Called with AioContext lock held, since many callback implementations
--     * use bdrv_* functions that require to hold the lock.
-      */
-     void (*free)(Job *job);
- };
-@@ -424,7 +405,6 @@ void job_ref_locked(Job *job);
-  * Release a reference that was previously acquired with job_ref_locked() or
-  * job_create(). If it's the last reference to the object, it will be freed.
-  *
-- * Takes AioContext lock internally to invoke a job->driver callback.
-  * Called with job lock held.
-  */
- void job_unref_locked(Job *job);
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-kconfig-Activate-IOMMUFD-for-s390x-machines.patch b/SOURCES/kvm-kconfig-Activate-IOMMUFD-for-s390x-machines.patch
deleted file mode 100644
index 3e562b8..0000000
--- a/SOURCES/kvm-kconfig-Activate-IOMMUFD-for-s390x-machines.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From 9c2eb4ab03903bc084c53ac29b60b8d2121c9fed Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
-Date: Tue, 21 Nov 2023 16:44:19 +0800
-Subject: [PATCH 040/101] kconfig: Activate IOMMUFD for s390x machines
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [39/67] cf0ebe770b8db5916dd35247618c0a325dc1eaab (eauger1/centos-qemu-kvm)
-
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
-Reviewed-by: Eric Farman <farman@linux.ibm.com>
-Tested-by: Nicolin Chen <nicolinc@nvidia.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 73e2df669335047b542b67d37ade060a6ae40dd8)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/s390x/Kconfig | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/hw/s390x/Kconfig b/hw/s390x/Kconfig
-index 4c068d7960..26ad104485 100644
---- a/hw/s390x/Kconfig
-+++ b/hw/s390x/Kconfig
-@@ -6,6 +6,7 @@ config S390_CCW_VIRTIO
-     imply VFIO_CCW
-     imply WDT_DIAG288
-     imply PCIE_DEVICES
-+    imply IOMMUFD
-     select PCI_EXPRESS
-     select S390_FLIC
-     select S390_FLIC_KVM if KVM
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-kvm-Enable-KVM_SET_USER_MEMORY_REGION2-for-memslot.patch b/SOURCES/kvm-kvm-Enable-KVM_SET_USER_MEMORY_REGION2-for-memslot.patch
new file mode 100644
index 0000000..10e98a7
--- /dev/null
+++ b/SOURCES/kvm-kvm-Enable-KVM_SET_USER_MEMORY_REGION2-for-memslot.patch
@@ -0,0 +1,153 @@
+From 120157257ac239050779fdddc9abb56bd39958b3 Mon Sep 17 00:00:00 2001
+From: Chao Peng <chao.p.peng@linux.intel.com>
+Date: Wed, 20 Mar 2024 03:39:05 -0500
+Subject: [PATCH 029/100] kvm: Enable KVM_SET_USER_MEMORY_REGION2 for memslot
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [29/91] 9a08c8699f632cd046a6307e33bd053a7cc7db46 (bonzini/rhel-qemu-kvm)
+
+Switch to KVM_SET_USER_MEMORY_REGION2 when supported by KVM.
+
+With KVM_SET_USER_MEMORY_REGION2, QEMU can set up memory region that
+backend'ed both by hva-based shared memory and guest memfd based private
+memory.
+
+Signed-off-by: Chao Peng <chao.p.peng@linux.intel.com>
+Co-developed-by: Xiaoyao Li <xiaoyao.li@intel.com>
+Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
+Message-ID: <20240320083945.991426-10-michael.roth@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit ce5a983233b4ca94ced88c9581014346509b5c71)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ accel/kvm/kvm-all.c      | 46 +++++++++++++++++++++++++++++++++-------
+ accel/kvm/trace-events   |  2 +-
+ include/sysemu/kvm_int.h |  2 ++
+ 3 files changed, 41 insertions(+), 9 deletions(-)
+
+diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
+index a7b9a127dd..5ef55e4dd7 100644
+--- a/accel/kvm/kvm-all.c
++++ b/accel/kvm/kvm-all.c
+@@ -284,35 +284,58 @@ int kvm_physical_memory_addr_from_host(KVMState *s, void *ram,
+ static int kvm_set_user_memory_region(KVMMemoryListener *kml, KVMSlot *slot, bool new)
+ {
+     KVMState *s = kvm_state;
+-    struct kvm_userspace_memory_region mem;
++    struct kvm_userspace_memory_region2 mem;
+     int ret;
+ 
+     mem.slot = slot->slot | (kml->as_id << 16);
+     mem.guest_phys_addr = slot->start_addr;
+     mem.userspace_addr = (unsigned long)slot->ram;
+     mem.flags = slot->flags;
++    mem.guest_memfd = slot->guest_memfd;
++    mem.guest_memfd_offset = slot->guest_memfd_offset;
+ 
+     if (slot->memory_size && !new && (mem.flags ^ slot->old_flags) & KVM_MEM_READONLY) {
+         /* Set the slot size to 0 before setting the slot to the desired
+          * value. This is needed based on KVM commit 75d61fbc. */
+         mem.memory_size = 0;
+-        ret = kvm_vm_ioctl(s, KVM_SET_USER_MEMORY_REGION, &mem);
++
++        if (kvm_guest_memfd_supported) {
++            ret = kvm_vm_ioctl(s, KVM_SET_USER_MEMORY_REGION2, &mem);
++        } else {
++            ret = kvm_vm_ioctl(s, KVM_SET_USER_MEMORY_REGION, &mem);
++        }
+         if (ret < 0) {
+             goto err;
+         }
+     }
+     mem.memory_size = slot->memory_size;
+-    ret = kvm_vm_ioctl(s, KVM_SET_USER_MEMORY_REGION, &mem);
++    if (kvm_guest_memfd_supported) {
++        ret = kvm_vm_ioctl(s, KVM_SET_USER_MEMORY_REGION2, &mem);
++    } else {
++        ret = kvm_vm_ioctl(s, KVM_SET_USER_MEMORY_REGION, &mem);
++    }
+     slot->old_flags = mem.flags;
+ err:
+     trace_kvm_set_user_memory(mem.slot >> 16, (uint16_t)mem.slot, mem.flags,
+                               mem.guest_phys_addr, mem.memory_size,
+-                              mem.userspace_addr, ret);
++                              mem.userspace_addr, mem.guest_memfd,
++                              mem.guest_memfd_offset, ret);
+     if (ret < 0) {
+-        error_report("%s: KVM_SET_USER_MEMORY_REGION failed, slot=%d,"
+-                     " start=0x%" PRIx64 ", size=0x%" PRIx64 ": %s",
+-                     __func__, mem.slot, slot->start_addr,
+-                     (uint64_t)mem.memory_size, strerror(errno));
++        if (kvm_guest_memfd_supported) {
++                error_report("%s: KVM_SET_USER_MEMORY_REGION2 failed, slot=%d,"
++                        " start=0x%" PRIx64 ", size=0x%" PRIx64 ","
++                        " flags=0x%" PRIx32 ", guest_memfd=%" PRId32 ","
++                        " guest_memfd_offset=0x%" PRIx64 ": %s",
++                        __func__, mem.slot, slot->start_addr,
++                        (uint64_t)mem.memory_size, mem.flags,
++                        mem.guest_memfd, (uint64_t)mem.guest_memfd_offset,
++                        strerror(errno));
++        } else {
++                error_report("%s: KVM_SET_USER_MEMORY_REGION failed, slot=%d,"
++                            " start=0x%" PRIx64 ", size=0x%" PRIx64 ": %s",
++                            __func__, mem.slot, slot->start_addr,
++                            (uint64_t)mem.memory_size, strerror(errno));
++        }
+     }
+     return ret;
+ }
+@@ -467,6 +490,10 @@ static int kvm_mem_flags(MemoryRegion *mr)
+     if (readonly && kvm_readonly_mem_allowed) {
+         flags |= KVM_MEM_READONLY;
+     }
++    if (memory_region_has_guest_memfd(mr)) {
++        assert(kvm_guest_memfd_supported);
++        flags |= KVM_MEM_GUEST_MEMFD;
++    }
+     return flags;
+ }
+ 
+@@ -1394,6 +1421,9 @@ static void kvm_set_phys_mem(KVMMemoryListener *kml,
+         mem->ram_start_offset = ram_start_offset;
+         mem->ram = ram;
+         mem->flags = kvm_mem_flags(mr);
++        mem->guest_memfd = mr->ram_block->guest_memfd;
++        mem->guest_memfd_offset = (uint8_t*)ram - mr->ram_block->host;
++
+         kvm_slot_init_dirty_bitmap(mem);
+         err = kvm_set_user_memory_region(kml, mem, true);
+         if (err) {
+diff --git a/accel/kvm/trace-events b/accel/kvm/trace-events
+index 9f599abc17..e8c52cb9e7 100644
+--- a/accel/kvm/trace-events
++++ b/accel/kvm/trace-events
+@@ -15,7 +15,7 @@ kvm_irqchip_update_msi_route(int virq) "Updating MSI route virq=%d"
+ kvm_irqchip_release_virq(int virq) "virq %d"
+ kvm_set_ioeventfd_mmio(int fd, uint64_t addr, uint32_t val, bool assign, uint32_t size, bool datamatch) "fd: %d @0x%" PRIx64 " val=0x%x assign: %d size: %d match: %d"
+ kvm_set_ioeventfd_pio(int fd, uint16_t addr, uint32_t val, bool assign, uint32_t size, bool datamatch) "fd: %d @0x%x val=0x%x assign: %d size: %d match: %d"
+-kvm_set_user_memory(uint16_t as, uint16_t slot, uint32_t flags, uint64_t guest_phys_addr, uint64_t memory_size, uint64_t userspace_addr, int ret) "AddrSpace#%d Slot#%d flags=0x%x gpa=0x%"PRIx64 " size=0x%"PRIx64 " ua=0x%"PRIx64 " ret=%d"
++kvm_set_user_memory(uint16_t as, uint16_t slot, uint32_t flags, uint64_t guest_phys_addr, uint64_t memory_size, uint64_t userspace_addr, uint32_t fd, uint64_t fd_offset, int ret) "AddrSpace#%d Slot#%d flags=0x%x gpa=0x%"PRIx64 " size=0x%"PRIx64 " ua=0x%"PRIx64 " guest_memfd=%d" " guest_memfd_offset=0x%" PRIx64 " ret=%d"
+ kvm_clear_dirty_log(uint32_t slot, uint64_t start, uint32_t size) "slot#%"PRId32" start 0x%"PRIx64" size 0x%"PRIx32
+ kvm_resample_fd_notify(int gsi) "gsi %d"
+ kvm_dirty_ring_full(int id) "vcpu %d"
+diff --git a/include/sysemu/kvm_int.h b/include/sysemu/kvm_int.h
+index 3496be7997..a5a3fee411 100644
+--- a/include/sysemu/kvm_int.h
++++ b/include/sysemu/kvm_int.h
+@@ -30,6 +30,8 @@ typedef struct KVMSlot
+     int as_id;
+     /* Cache of the offset in ram address space */
+     ram_addr_t ram_start_offset;
++    int guest_memfd;
++    hwaddr guest_memfd_offset;
+ } KVMSlot;
+ 
+ typedef struct KVMMemoryUpdate {
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-kvm-Introduce-support-for-memory_attributes.patch b/SOURCES/kvm-kvm-Introduce-support-for-memory_attributes.patch
new file mode 100644
index 0000000..1f043a9
--- /dev/null
+++ b/SOURCES/kvm-kvm-Introduce-support-for-memory_attributes.patch
@@ -0,0 +1,103 @@
+From 37e6c98987bb2d4be7ce1fdda4475cd0266271c3 Mon Sep 17 00:00:00 2001
+From: Xiaoyao Li <xiaoyao.li@intel.com>
+Date: Wed, 20 Mar 2024 03:39:06 -0500
+Subject: [PATCH 027/100] kvm: Introduce support for memory_attributes
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [27/91] 1b4428289949478f7390196ae4b098c5e6f36bb0 (bonzini/rhel-qemu-kvm)
+
+Introduce the helper functions to set the attributes of a range of
+memory to private or shared.
+
+This is necessary to notify KVM the private/shared attribute of each gpa
+range. KVM needs the information to decide the GPA needs to be mapped at
+hva-based shared memory or guest_memfd based private memory.
+
+Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
+Message-ID: <20240320083945.991426-11-michael.roth@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 0811baed49010a9b651b8029ab6b9828b09a884f)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ accel/kvm/kvm-all.c  | 32 ++++++++++++++++++++++++++++++++
+ include/sysemu/kvm.h |  4 ++++
+ 2 files changed, 36 insertions(+)
+
+diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
+index 9bd235c969..272e945f52 100644
+--- a/accel/kvm/kvm-all.c
++++ b/accel/kvm/kvm-all.c
+@@ -91,6 +91,7 @@ bool kvm_msi_use_devid;
+ static bool kvm_has_guest_debug;
+ static int kvm_sstep_flags;
+ static bool kvm_immediate_exit;
++static uint64_t kvm_supported_memory_attributes;
+ static hwaddr kvm_max_slot_size = ~0;
+ 
+ static const KVMCapabilityInfo kvm_required_capabilites[] = {
+@@ -1266,6 +1267,36 @@ void kvm_set_max_memslot_size(hwaddr max_slot_size)
+     kvm_max_slot_size = max_slot_size;
+ }
+ 
++static int kvm_set_memory_attributes(hwaddr start, uint64_t size, uint64_t attr)
++{
++    struct kvm_memory_attributes attrs;
++    int r;
++
++    assert((attr & kvm_supported_memory_attributes) == attr);
++    attrs.attributes = attr;
++    attrs.address = start;
++    attrs.size = size;
++    attrs.flags = 0;
++
++    r = kvm_vm_ioctl(kvm_state, KVM_SET_MEMORY_ATTRIBUTES, &attrs);
++    if (r) {
++        error_report("failed to set memory (0x%" HWADDR_PRIx "+0x%" PRIx64 ") "
++                     "with attr 0x%" PRIx64 " error '%s'",
++                     start, size, attr, strerror(errno));
++    }
++    return r;
++}
++
++int kvm_set_memory_attributes_private(hwaddr start, uint64_t size)
++{
++    return kvm_set_memory_attributes(start, size, KVM_MEMORY_ATTRIBUTE_PRIVATE);
++}
++
++int kvm_set_memory_attributes_shared(hwaddr start, uint64_t size)
++{
++    return kvm_set_memory_attributes(start, size, 0);
++}
++
+ /* Called with KVMMemoryListener.slots_lock held */
+ static void kvm_set_phys_mem(KVMMemoryListener *kml,
+                              MemoryRegionSection *section, bool add)
+@@ -2387,6 +2418,7 @@ static int kvm_init(MachineState *ms)
+         goto err;
+     }
+ 
++    kvm_supported_memory_attributes = kvm_check_extension(s, KVM_CAP_MEMORY_ATTRIBUTES);
+     kvm_immediate_exit = kvm_check_extension(s, KVM_CAP_IMMEDIATE_EXIT);
+     s->nr_slots = kvm_check_extension(s, KVM_CAP_NR_MEMSLOTS);
+ 
+diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
+index 54f4d83a37..f114ff6986 100644
+--- a/include/sysemu/kvm.h
++++ b/include/sysemu/kvm.h
+@@ -536,4 +536,8 @@ void kvm_mark_guest_state_protected(void);
+  * reported for the VM.
+  */
+ bool kvm_hwpoisoned_mem(void);
++
++int kvm_set_memory_attributes_private(hwaddr start, uint64_t size);
++int kvm_set_memory_attributes_shared(hwaddr start, uint64_t size);
++
+ #endif
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-kvm-add-support-for-guest-physical-bits.patch b/SOURCES/kvm-kvm-add-support-for-guest-physical-bits.patch
new file mode 100644
index 0000000..97b94eb
--- /dev/null
+++ b/SOURCES/kvm-kvm-add-support-for-guest-physical-bits.patch
@@ -0,0 +1,116 @@
+From 31cc494d69449811f4d995326479372da7c1241e Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Mon, 18 Mar 2024 16:53:35 +0100
+Subject: [PATCH 003/100] kvm: add support for guest physical bits
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [3/91] abb1ba3a584152d8efabd8255b86afe609f8ffbd (bonzini/rhel-qemu-kvm)
+
+Query kvm for supported guest physical address bits, in cpuid
+function 80000008, eax[23:16].  Usually this is identical to host
+physical address bits.  With NPT or EPT being used this might be
+restricted to 48 (max 4-level paging address space size) even if
+the host cpu supports more physical address bits.
+
+When set pass this to the guest, using cpuid too.  Guest firmware
+can use this to figure how big the usable guest physical address
+space is, so PCI bar mapping are actually reachable.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
+Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
+Message-ID: <20240318155336.156197-2-kraxel@redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 0d08c423688edcca857f88dab20f1fc56de2b281)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ target/i386/kvm/kvm-cpu.c | 50 ++++++++++++++++++++++++++++++++-------
+ 1 file changed, 42 insertions(+), 8 deletions(-)
+
+diff --git a/target/i386/kvm/kvm-cpu.c b/target/i386/kvm/kvm-cpu.c
+index b91af5051f..7ef94c681f 100644
+--- a/target/i386/kvm/kvm-cpu.c
++++ b/target/i386/kvm/kvm-cpu.c
+@@ -18,10 +18,32 @@
+ #include "kvm_i386.h"
+ #include "hw/core/accel-cpu.h"
+ 
++static void kvm_set_guest_phys_bits(CPUState *cs)
++{
++    X86CPU *cpu = X86_CPU(cs);
++    uint32_t eax, guest_phys_bits;
++
++    eax = kvm_arch_get_supported_cpuid(cs->kvm_state, 0x80000008, 0, R_EAX);
++    guest_phys_bits = (eax >> 16) & 0xff;
++    if (!guest_phys_bits) {
++        return;
++    }
++    cpu->guest_phys_bits = guest_phys_bits;
++    if (cpu->guest_phys_bits > cpu->phys_bits) {
++        cpu->guest_phys_bits = cpu->phys_bits;
++    }
++
++    if (cpu->host_phys_bits && cpu->host_phys_bits_limit &&
++        cpu->guest_phys_bits > cpu->host_phys_bits_limit) {
++        cpu->guest_phys_bits = cpu->host_phys_bits_limit;
++    }
++}
++
+ static bool kvm_cpu_realizefn(CPUState *cs, Error **errp)
+ {
+     X86CPU *cpu = X86_CPU(cs);
+     CPUX86State *env = &cpu->env;
++    bool ret;
+ 
+     /*
+      * The realize order is important, since x86_cpu_realize() checks if
+@@ -32,13 +54,15 @@ static bool kvm_cpu_realizefn(CPUState *cs, Error **errp)
+      *
+      * realize order:
+      *
+-     * x86_cpu_realize():
+-     *  -> x86_cpu_expand_features()
+-     *  -> cpu_exec_realizefn():
+-     *            -> accel_cpu_common_realize()
+-     *               kvm_cpu_realizefn() -> host_cpu_realizefn()
+-     *  -> cpu_common_realizefn()
+-     *  -> check/update ucode_rev, phys_bits, mwait
++     * x86_cpu_realizefn():
++     *   x86_cpu_expand_features()
++     *   cpu_exec_realizefn():
++     *      accel_cpu_common_realize()
++     *        kvm_cpu_realizefn()
++     *          host_cpu_realizefn()
++     *          kvm_set_guest_phys_bits()
++     *   check/update ucode_rev, phys_bits, guest_phys_bits, mwait
++     *   cpu_common_realizefn() (via xcc->parent_realize)
+      */
+     if (cpu->max_features) {
+         if (enable_cpu_pm && kvm_has_waitpkg()) {
+@@ -50,7 +74,17 @@ static bool kvm_cpu_realizefn(CPUState *cs, Error **errp)
+                                                    MSR_IA32_UCODE_REV);
+         }
+     }
+-    return host_cpu_realizefn(cs, errp);
++    ret = host_cpu_realizefn(cs, errp);
++    if (!ret) {
++        return ret;
++    }
++
++    if ((env->features[FEAT_8000_0001_EDX] & CPUID_EXT2_LM) &&
++        cpu->guest_phys_bits == -1) {
++        kvm_set_guest_phys_bits(cs);
++    }
++
++    return true;
+ }
+ 
+ static bool lmce_supported(void)
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-kvm-error-out-of-kvm_irqchip_add_msi_route-in-case-o.patch b/SOURCES/kvm-kvm-error-out-of-kvm_irqchip_add_msi_route-in-case-o.patch
deleted file mode 100644
index 5116b96..0000000
--- a/SOURCES/kvm-kvm-error-out-of-kvm_irqchip_add_msi_route-in-case-o.patch
+++ /dev/null
@@ -1,76 +0,0 @@
-From 8a8fa4ab4dc05502550ca207926cd0c93a3341ea Mon Sep 17 00:00:00 2001
-From: Igor Mammedov <imammedo@redhat.com>
-Date: Mon, 8 Apr 2024 12:43:49 +0200
-Subject: [PATCH] kvm: error out of kvm_irqchip_add_msi_route() in case of full
- route table
-
-RH-Author: Igor Mammedov <imammedo@redhat.com>
-RH-MergeRequest: 374: kvm: error out of kvm_irqchip_add_msi_route() in case of full route table
-RH-Jira: RHEL-32990
-RH-Acked-by: Ani Sinha <anisinha@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [1/1] df31f2d0cafe10a1ac22a2bebb85dc17c1e891e0
-
-RH-Jira: RHEL-32990
-
-subj is calling kvm_add_routing_entry() which simply extends
-  KVMState::irq_routes::entries[]
-but doesn't check if number of routes goes beyond limit the kernel
-is willing to accept. Which later leads toi the assert
-
-  qemu-kvm: ../accel/kvm/kvm-all.c:1833: kvm_irqchip_commit_routes: Assertion `ret == 0' failed
-
-typically it happens during guest boot for large enough guest
-
-Reproduced with:
-  ./qemu --enable-kvm -m 8G -smp 64 -machine pc \
-     `for b in {1..2}; do echo -n "-device pci-bridge,id=pci$b,chassis_nr=$b ";
-        for i in {0..31}; do touch /tmp/vblk$b$i;
-           echo -n "-drive file=/tmp/vblk$b$i,if=none,id=drive$b$i,format=raw
-                    -device virtio-blk-pci,drive=drive$b$i,bus=pci$b ";
-      done; done`
-
-While crash at boot time is bad, the same might happen at hotplug time
-which is unacceptable.
-So instead calling kvm_add_routing_entry() unconditionally, check first
-that number of routes won't exceed KVM_CAP_IRQ_ROUTING. This way virtio
-device insteads killin qemu, will gracefully fail to initialize device
-as expected with following warnings on console:
-    virtio-blk failed to set guest notifier (-28), ensure -accel kvm is set.
-    virtio_bus_start_ioeventfd: failed. Fallback to userspace (slower).
-
-Signed-off-by: Igor Mammedov <imammedo@redhat.com>
----
- accel/kvm/kvm-all.c | 15 ++++++++++-----
- 1 file changed, 10 insertions(+), 5 deletions(-)
-
-diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
-index e39a810a4e..f1a4564cbd 100644
---- a/accel/kvm/kvm-all.c
-+++ b/accel/kvm/kvm-all.c
-@@ -2000,12 +2000,17 @@ int kvm_irqchip_add_msi_route(KVMRouteChange *c, int vector, PCIDevice *dev)
-         return -EINVAL;
-     }
- 
--    trace_kvm_irqchip_add_msi_route(dev ? dev->name : (char *)"N/A",
--                                    vector, virq);
-+    if (s->irq_routes->nr < s->gsi_count) {
-+        trace_kvm_irqchip_add_msi_route(dev ? dev->name : (char *)"N/A",
-+                                        vector, virq);
- 
--    kvm_add_routing_entry(s, &kroute);
--    kvm_arch_add_msi_route_post(&kroute, vector, dev);
--    c->changes++;
-+        kvm_add_routing_entry(s, &kroute);
-+        kvm_arch_add_msi_route_post(&kroute, vector, dev);
-+        c->changes++;
-+    } else {
-+        kvm_irqchip_release_virq(s, virq);
-+        return -ENOSPC;
-+    }
- 
-     return virq;
- }
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-kvm-handle-KVM_EXIT_MEMORY_FAULT.patch b/SOURCES/kvm-kvm-handle-KVM_EXIT_MEMORY_FAULT.patch
new file mode 100644
index 0000000..9baa06f
--- /dev/null
+++ b/SOURCES/kvm-kvm-handle-KVM_EXIT_MEMORY_FAULT.patch
@@ -0,0 +1,194 @@
+From 33cc1b469689ee2bb7c4f745189472c74a0a98ab Mon Sep 17 00:00:00 2001
+From: Chao Peng <chao.p.peng@linux.intel.com>
+Date: Wed, 20 Mar 2024 03:39:08 -0500
+Subject: [PATCH 034/100] kvm: handle KVM_EXIT_MEMORY_FAULT
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [34/91] 59c672f6b19a3afcb61878775eb6425c6fdea6d5 (bonzini/rhel-qemu-kvm)
+
+Upon an KVM_EXIT_MEMORY_FAULT exit, userspace needs to do the memory
+conversion on the RAMBlock to turn the memory into desired attribute,
+switching between private and shared.
+
+Currently only KVM_MEMORY_EXIT_FLAG_PRIVATE in flags is valid when
+KVM_EXIT_MEMORY_FAULT happens.
+
+Note, KVM_EXIT_MEMORY_FAULT makes sense only when the RAMBlock has
+guest_memfd memory backend.
+
+Note, KVM_EXIT_MEMORY_FAULT returns with -EFAULT, so special handling is
+added.
+
+When page is converted from shared to private, the original shared
+memory can be discarded via ram_block_discard_range(). Note, shared
+memory can be discarded only when it's not back'ed by hugetlb because
+hugetlb is supposed to be pre-allocated and no need for discarding.
+
+Signed-off-by: Chao Peng <chao.p.peng@linux.intel.com>
+Co-developed-by: Xiaoyao Li <xiaoyao.li@intel.com>
+Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
+
+Message-ID: <20240320083945.991426-13-michael.roth@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit c15e5684071d93174e446be318f49d8d59b15d6d)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ accel/kvm/kvm-all.c    | 98 +++++++++++++++++++++++++++++++++++++-----
+ accel/kvm/trace-events |  2 +
+ include/sysemu/kvm.h   |  2 +
+ 3 files changed, 92 insertions(+), 10 deletions(-)
+
+diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
+index 3f99efc8cc..09164e346c 100644
+--- a/accel/kvm/kvm-all.c
++++ b/accel/kvm/kvm-all.c
+@@ -2900,6 +2900,69 @@ static void kvm_eat_signals(CPUState *cpu)
+     } while (sigismember(&chkset, SIG_IPI));
+ }
+ 
++int kvm_convert_memory(hwaddr start, hwaddr size, bool to_private)
++{
++    MemoryRegionSection section;
++    ram_addr_t offset;
++    MemoryRegion *mr;
++    RAMBlock *rb;
++    void *addr;
++    int ret = -1;
++
++    trace_kvm_convert_memory(start, size, to_private ? "shared_to_private" : "private_to_shared");
++
++    if (!QEMU_PTR_IS_ALIGNED(start, qemu_real_host_page_size()) ||
++        !QEMU_PTR_IS_ALIGNED(size, qemu_real_host_page_size())) {
++        return -1;
++    }
++
++    if (!size) {
++        return -1;
++    }
++
++    section = memory_region_find(get_system_memory(), start, size);
++    mr = section.mr;
++    if (!mr) {
++        return -1;
++    }
++
++    if (!memory_region_has_guest_memfd(mr)) {
++        error_report("Converting non guest_memfd backed memory region "
++                     "(0x%"HWADDR_PRIx" ,+ 0x%"HWADDR_PRIx") to %s",
++                     start, size, to_private ? "private" : "shared");
++        goto out_unref;
++    }
++
++    if (to_private) {
++        ret = kvm_set_memory_attributes_private(start, size);
++    } else {
++        ret = kvm_set_memory_attributes_shared(start, size);
++    }
++    if (ret) {
++        goto out_unref;
++    }
++
++    addr = memory_region_get_ram_ptr(mr) + section.offset_within_region;
++    rb = qemu_ram_block_from_host(addr, false, &offset);
++
++    if (to_private) {
++        if (rb->page_size != qemu_real_host_page_size()) {
++            /*
++             * shared memory is backed by hugetlb, which is supposed to be
++             * pre-allocated and doesn't need to be discarded
++             */
++            goto out_unref;
++        }
++        ret = ram_block_discard_range(rb, offset, size);
++    } else {
++        ret = ram_block_discard_guest_memfd_range(rb, offset, size);
++    }
++
++out_unref:
++    memory_region_unref(mr);
++    return ret;
++}
++
+ int kvm_cpu_exec(CPUState *cpu)
+ {
+     struct kvm_run *run = cpu->kvm_run;
+@@ -2967,18 +3030,20 @@ int kvm_cpu_exec(CPUState *cpu)
+                 ret = EXCP_INTERRUPT;
+                 break;
+             }
+-            fprintf(stderr, "error: kvm run failed %s\n",
+-                    strerror(-run_ret));
++            if (!(run_ret == -EFAULT && run->exit_reason == KVM_EXIT_MEMORY_FAULT)) {
++                fprintf(stderr, "error: kvm run failed %s\n",
++                        strerror(-run_ret));
+ #ifdef TARGET_PPC
+-            if (run_ret == -EBUSY) {
+-                fprintf(stderr,
+-                        "This is probably because your SMT is enabled.\n"
+-                        "VCPU can only run on primary threads with all "
+-                        "secondary threads offline.\n");
+-            }
++                if (run_ret == -EBUSY) {
++                    fprintf(stderr,
++                            "This is probably because your SMT is enabled.\n"
++                            "VCPU can only run on primary threads with all "
++                            "secondary threads offline.\n");
++                }
+ #endif
+-            ret = -1;
+-            break;
++                ret = -1;
++                break;
++            }
+         }
+ 
+         trace_kvm_run_exit(cpu->cpu_index, run->exit_reason);
+@@ -3061,6 +3126,19 @@ int kvm_cpu_exec(CPUState *cpu)
+                 break;
+             }
+             break;
++        case KVM_EXIT_MEMORY_FAULT:
++            trace_kvm_memory_fault(run->memory_fault.gpa,
++                                   run->memory_fault.size,
++                                   run->memory_fault.flags);
++            if (run->memory_fault.flags & ~KVM_MEMORY_EXIT_FLAG_PRIVATE) {
++                error_report("KVM_EXIT_MEMORY_FAULT: Unknown flag 0x%" PRIx64,
++                             (uint64_t)run->memory_fault.flags);
++                ret = -1;
++                break;
++            }
++            ret = kvm_convert_memory(run->memory_fault.gpa, run->memory_fault.size,
++                                     run->memory_fault.flags & KVM_MEMORY_EXIT_FLAG_PRIVATE);
++            break;
+         default:
+             ret = kvm_arch_handle_exit(cpu, run);
+             break;
+diff --git a/accel/kvm/trace-events b/accel/kvm/trace-events
+index e8c52cb9e7..681ccb667d 100644
+--- a/accel/kvm/trace-events
++++ b/accel/kvm/trace-events
+@@ -31,3 +31,5 @@ kvm_cpu_exec(void) ""
+ kvm_interrupt_exit_request(void) ""
+ kvm_io_window_exit(void) ""
+ kvm_run_exit_system_event(int cpu_index, uint32_t event_type) "cpu_index %d, system_even_type %"PRIu32
++kvm_convert_memory(uint64_t start, uint64_t size, const char *msg) "start 0x%" PRIx64 " size 0x%" PRIx64 " %s"
++kvm_memory_fault(uint64_t start, uint64_t size, uint64_t flags) "start 0x%" PRIx64 " size 0x%" PRIx64 " flags 0x%" PRIx64
+diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
+index 9e4ab7ae89..74f23dff9c 100644
+--- a/include/sysemu/kvm.h
++++ b/include/sysemu/kvm.h
+@@ -542,4 +542,6 @@ int kvm_create_guest_memfd(uint64_t size, uint64_t flags, Error **errp);
+ int kvm_set_memory_attributes_private(hwaddr start, uint64_t size);
+ int kvm_set_memory_attributes_shared(hwaddr start, uint64_t size);
+ 
++int kvm_convert_memory(hwaddr start, hwaddr size, bool to_private);
++
+ #endif
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-kvm-memory-Make-memory-type-private-by-default-if-it.patch b/SOURCES/kvm-kvm-memory-Make-memory-type-private-by-default-if-it.patch
new file mode 100644
index 0000000..8f9756b
--- /dev/null
+++ b/SOURCES/kvm-kvm-memory-Make-memory-type-private-by-default-if-it.patch
@@ -0,0 +1,56 @@
+From f9dc55dd179bb534d589af371c5c2a7886bd461e Mon Sep 17 00:00:00 2001
+From: Xiaoyao Li <xiaoyao.li@intel.com>
+Date: Wed, 20 Mar 2024 03:39:11 -0500
+Subject: [PATCH 030/100] kvm/memory: Make memory type private by default if it
+ has guest memfd backend
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [30/91] 5e21edf844b5629ee32c4075843b028561b97ae2 (bonzini/rhel-qemu-kvm)
+
+KVM side leaves the memory to shared by default, which may incur the
+overhead of paging conversion on the first visit of each page. Because
+the expectation is that page is likely to private for the VMs that
+require private memory (has guest memfd).
+
+Explicitly set the memory to private when memory region has valid
+guest memfd backend.
+
+Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
+Signed-off-by: Michael Roth <michael.roth@amd.com>
+Message-ID: <20240320083945.991426-16-michael.roth@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit bd3bcf6962b664ca3bf9c60fdcc4534e8e3d0641)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ accel/kvm/kvm-all.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
+index 5ef55e4dd7..3f99efc8cc 100644
+--- a/accel/kvm/kvm-all.c
++++ b/accel/kvm/kvm-all.c
+@@ -1431,6 +1431,16 @@ static void kvm_set_phys_mem(KVMMemoryListener *kml,
+                     strerror(-err));
+             abort();
+         }
++
++        if (memory_region_has_guest_memfd(mr)) {
++            err = kvm_set_memory_attributes_private(start_addr, slot_size);
++            if (err) {
++                error_report("%s: failed to set memory attribute private: %s",
++                             __func__, strerror(-err));
++                exit(1);
++            }
++        }
++
+         start_addr += slot_size;
+         ram_start_offset += slot_size;
+         ram += slot_size;
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-kvm-tdx-Don-t-complain-when-converting-vMMIO-region-.patch b/SOURCES/kvm-kvm-tdx-Don-t-complain-when-converting-vMMIO-region-.patch
new file mode 100644
index 0000000..7b578b5
--- /dev/null
+++ b/SOURCES/kvm-kvm-tdx-Don-t-complain-when-converting-vMMIO-region-.patch
@@ -0,0 +1,61 @@
+From aeaa7061139202448d466b7e18682081f9cd2097 Mon Sep 17 00:00:00 2001
+From: Isaku Yamahata <isaku.yamahata@intel.com>
+Date: Thu, 29 Feb 2024 01:36:54 -0500
+Subject: [PATCH 035/100] kvm/tdx: Don't complain when converting vMMIO region
+ to shared
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [35/91] c42870771d7af5badc2e10d42be9b5620d72f95d (bonzini/rhel-qemu-kvm)
+
+Because vMMIO region needs to be shared region, guest TD may explicitly
+convert such region from private to shared.  Don't complain such
+conversion.
+
+Signed-off-by: Isaku Yamahata <isaku.yamahata@intel.com>
+Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
+Message-ID: <20240229063726.610065-34-xiaoyao.li@intel.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit c5d9425ef4da9f43fc0903905ad415456d1ab843)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ accel/kvm/kvm-all.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
+index 09164e346c..6efaff90a7 100644
+--- a/accel/kvm/kvm-all.c
++++ b/accel/kvm/kvm-all.c
+@@ -2927,9 +2927,22 @@ int kvm_convert_memory(hwaddr start, hwaddr size, bool to_private)
+     }
+ 
+     if (!memory_region_has_guest_memfd(mr)) {
+-        error_report("Converting non guest_memfd backed memory region "
+-                     "(0x%"HWADDR_PRIx" ,+ 0x%"HWADDR_PRIx") to %s",
+-                     start, size, to_private ? "private" : "shared");
++        /*
++         * Because vMMIO region must be shared, guest TD may convert vMMIO
++         * region to shared explicitly.  Don't complain such case.  See
++         * memory_region_type() for checking if the region is MMIO region.
++         */
++        if (!to_private &&
++            !memory_region_is_ram(mr) &&
++            !memory_region_is_ram_device(mr) &&
++            !memory_region_is_rom(mr) &&
++            !memory_region_is_romd(mr)) {
++		    ret = 0;
++        } else {
++            error_report("Convert non guest_memfd backed memory region "
++                        "(0x%"HWADDR_PRIx" ,+ 0x%"HWADDR_PRIx") to %s",
++                        start, size, to_private ? "private" : "shared");
++        }
+         goto out_unref;
+     }
+ 
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-kvm-tdx-Ignore-memory-conversion-to-shared-of-unassi.patch b/SOURCES/kvm-kvm-tdx-Ignore-memory-conversion-to-shared-of-unassi.patch
new file mode 100644
index 0000000..c0f2bc6
--- /dev/null
+++ b/SOURCES/kvm-kvm-tdx-Ignore-memory-conversion-to-shared-of-unassi.patch
@@ -0,0 +1,62 @@
+From 2b2dfff3e383c99d0f759a8c12659d1a0ce50e8e Mon Sep 17 00:00:00 2001
+From: Isaku Yamahata <isaku.yamahata@intel.com>
+Date: Thu, 29 Feb 2024 01:36:55 -0500
+Subject: [PATCH 036/100] kvm/tdx: Ignore memory conversion to shared of
+ unassigned region
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [36/91] 84515b9dcfc2e07b272bb2477acf6430e9d33f28 (bonzini/rhel-qemu-kvm)
+
+TDX requires vMMIO region to be shared.  For KVM, MMIO region is the region
+which kvm memslot isn't assigned to (except in-kernel emulation).
+qemu has the memory region for vMMIO at each device level.
+
+While OVMF issues MapGPA(to-shared) conservatively on 32bit PCI MMIO
+region, qemu doesn't find corresponding vMMIO region because it's before
+PCI device allocation and memory_region_find() finds the device region, not
+PCI bus region.  It's safe to ignore MapGPA(to-shared) because when guest
+accesses those region they use GPA with shared bit set for vMMIO.  Ignore
+memory conversion request of non-assigned region to shared and return
+success.  Otherwise OVMF is confused and panics there.
+
+Signed-off-by: Isaku Yamahata <isaku.yamahata@intel.com>
+Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
+Message-ID: <20240229063726.610065-35-xiaoyao.li@intel.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 565f4768bb9cf840b2f8cca41483bb91aa3196a3)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ accel/kvm/kvm-all.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
+index 6efaff90a7..f6268855b4 100644
+--- a/accel/kvm/kvm-all.c
++++ b/accel/kvm/kvm-all.c
+@@ -2923,6 +2923,18 @@ int kvm_convert_memory(hwaddr start, hwaddr size, bool to_private)
+     section = memory_region_find(get_system_memory(), start, size);
+     mr = section.mr;
+     if (!mr) {
++        /*
++         * Ignore converting non-assigned region to shared.
++         *
++         * TDX requires vMMIO region to be shared to inject #VE to guest.
++         * OVMF issues conservatively MapGPA(shared) on 32bit PCI MMIO region,
++         * and vIO-APIC 0xFEC00000 4K page.
++         * OVMF assigns 32bit PCI MMIO region to
++         * [top of low memory: typically 2GB=0xC000000,  0xFC00000)
++         */
++        if (!to_private) {
++            return 0;
++        }
+         return -1;
+     }
+ 
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-linux-aio-add-IO_CMD_FDSYNC-command-support.patch b/SOURCES/kvm-linux-aio-add-IO_CMD_FDSYNC-command-support.patch
index 391e618..1aba040 100644
--- a/SOURCES/kvm-linux-aio-add-IO_CMD_FDSYNC-command-support.patch
+++ b/SOURCES/kvm-linux-aio-add-IO_CMD_FDSYNC-command-support.patch
@@ -1,13 +1,14 @@
-From 9d00965910d5a7818ffe55b18d3e9dd4c7210e1b Mon Sep 17 00:00:00 2001
+From 287ebf9f0b8a62dc49fd7802472c1ae57f653e44 Mon Sep 17 00:00:00 2001
 From: Prasad Pandit <pjp@fedoraproject.org>
 Date: Thu, 25 Apr 2024 12:34:12 +0530
-Subject: [PATCH 4/4] linux-aio: add IO_CMD_FDSYNC command support
+Subject: [PATCH 1/5] linux-aio: add IO_CMD_FDSYNC command support
 
 RH-Author: Prasad Pandit <None>
-RH-MergeRequest: 378: linux-aio: add IO_CMD_FDSYNC command support
-RH-Jira: RHEL-43261
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [1/1] 3b80d4a162aad1a87322078a7d7b060a9496035b
+RH-MergeRequest: 249: linux-aio: add IO_CMD_FDSYNC command support
+RH-Jira: RHEL-42411
+RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
+RH-Commit: [1/1] 9beff6506d2eca7741b1c11b5acdc19b635c7c75 (pjp/cs-qemu-kvm)
 
 Libaio defines IO_CMD_FDSYNC command to sync all outstanding
 asynchronous I/O operations, by flushing out file data to the
@@ -18,7 +19,7 @@ pthreads, and destroying these pthreads results in TLB flushes.
 In a real-time guest environment, TLB flushes cause a latency
 spike. This patch helps to avoid such spikes.
 
-Jira: https://issues.redhat.com/browse/RHEL-43261
+Jira: https://issues.redhat.com/browse/RHEL-42411
 Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
 Signed-off-by: Prasad Pandit <pjp@fedoraproject.org>
 Message-ID: <20240425070412.37248-1-ppandit@redhat.com>
@@ -110,7 +111,7 @@ index ec05d946f3..e3b5ec9aba 100644
 +    return (ret == -EINVAL) ? false : true;
 +}
 diff --git a/include/block/raw-aio.h b/include/block/raw-aio.h
-index 0f63c2800c..3166903a56 100644
+index 20e000b8ef..626706827f 100644
 --- a/include/block/raw-aio.h
 +++ b/include/block/raw-aio.h
 @@ -60,6 +60,7 @@ void laio_cleanup(LinuxAioState *s);
diff --git a/SOURCES/kvm-linux-headers-Update-to-current-kvm-next.patch b/SOURCES/kvm-linux-headers-Update-to-current-kvm-next.patch
new file mode 100644
index 0000000..2fd35fd
--- /dev/null
+++ b/SOURCES/kvm-linux-headers-Update-to-current-kvm-next.patch
@@ -0,0 +1,189 @@
+From c3e2bc3319882c16fa36eafc7a613073746cfc8b Mon Sep 17 00:00:00 2001
+From: Pankaj Gupta <pankaj.gupta@amd.com>
+Date: Thu, 30 May 2024 06:16:14 -0500
+Subject: [PATCH 052/100] linux-headers: Update to current kvm/next
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [52/91] df77e867072f60110b8387a54ba2db6226b35007 (bonzini/rhel-qemu-kvm)
+
+This updates kernel headers to commit 6f627b425378 ("KVM: SVM: Add module
+parameter to enable SEV-SNP", 2024-05-12).  The SNP host patches will
+be included in Linux 6.11, to be released next July.
+
+Also brings in an linux-headers/linux/vhost.h fix from v6.9-rc4.
+
+Co-developed-by: Michael Roth <michael.roth@amd.com>
+Signed-off-by: Michael Roth <michael.roth@amd.com>
+Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com>
+Message-ID: <20240530111643.1091816-3-pankaj.gupta@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 5f69e42da5b40a2213f4db70ca461f554abca686)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ linux-headers/asm-loongarch/kvm.h |  4 +++
+ linux-headers/asm-riscv/kvm.h     |  1 +
+ linux-headers/asm-x86/kvm.h       | 52 ++++++++++++++++++++++++++++++-
+ linux-headers/linux/vhost.h       | 15 ++++-----
+ 4 files changed, 64 insertions(+), 8 deletions(-)
+
+diff --git a/linux-headers/asm-loongarch/kvm.h b/linux-headers/asm-loongarch/kvm.h
+index 109785922c..f9abef3823 100644
+--- a/linux-headers/asm-loongarch/kvm.h
++++ b/linux-headers/asm-loongarch/kvm.h
+@@ -17,6 +17,8 @@
+ #define KVM_COALESCED_MMIO_PAGE_OFFSET	1
+ #define KVM_DIRTY_LOG_PAGE_OFFSET	64
+ 
++#define KVM_GUESTDBG_USE_SW_BP		0x00010000
++
+ /*
+  * for KVM_GET_REGS and KVM_SET_REGS
+  */
+@@ -72,6 +74,8 @@ struct kvm_fpu {
+ 
+ #define KVM_REG_LOONGARCH_COUNTER	(KVM_REG_LOONGARCH_KVM | KVM_REG_SIZE_U64 | 1)
+ #define KVM_REG_LOONGARCH_VCPU_RESET	(KVM_REG_LOONGARCH_KVM | KVM_REG_SIZE_U64 | 2)
++/* Debugging: Special instruction for software breakpoint */
++#define KVM_REG_LOONGARCH_DEBUG_INST	(KVM_REG_LOONGARCH_KVM | KVM_REG_SIZE_U64 | 3)
+ 
+ #define LOONGARCH_REG_SHIFT		3
+ #define LOONGARCH_REG_64(TYPE, REG)	(TYPE | KVM_REG_SIZE_U64 | (REG << LOONGARCH_REG_SHIFT))
+diff --git a/linux-headers/asm-riscv/kvm.h b/linux-headers/asm-riscv/kvm.h
+index b1c503c295..e878e7cc39 100644
+--- a/linux-headers/asm-riscv/kvm.h
++++ b/linux-headers/asm-riscv/kvm.h
+@@ -167,6 +167,7 @@ enum KVM_RISCV_ISA_EXT_ID {
+ 	KVM_RISCV_ISA_EXT_ZFA,
+ 	KVM_RISCV_ISA_EXT_ZTSO,
+ 	KVM_RISCV_ISA_EXT_ZACAS,
++	KVM_RISCV_ISA_EXT_SSCOFPMF,
+ 	KVM_RISCV_ISA_EXT_MAX,
+ };
+ 
+diff --git a/linux-headers/asm-x86/kvm.h b/linux-headers/asm-x86/kvm.h
+index 31c95c2dfe..1c8f918234 100644
+--- a/linux-headers/asm-x86/kvm.h
++++ b/linux-headers/asm-x86/kvm.h
+@@ -695,6 +695,11 @@ enum sev_cmd_id {
+ 	/* Second time is the charm; improved versions of the above ioctls.  */
+ 	KVM_SEV_INIT2,
+ 
++	/* SNP-specific commands */
++	KVM_SEV_SNP_LAUNCH_START = 100,
++	KVM_SEV_SNP_LAUNCH_UPDATE,
++	KVM_SEV_SNP_LAUNCH_FINISH,
++
+ 	KVM_SEV_NR_MAX,
+ };
+ 
+@@ -709,7 +714,9 @@ struct kvm_sev_cmd {
+ struct kvm_sev_init {
+ 	__u64 vmsa_features;
+ 	__u32 flags;
+-	__u32 pad[9];
++	__u16 ghcb_version;
++	__u16 pad1;
++	__u32 pad2[8];
+ };
+ 
+ struct kvm_sev_launch_start {
+@@ -820,6 +827,48 @@ struct kvm_sev_receive_update_data {
+ 	__u32 pad2;
+ };
+ 
++struct kvm_sev_snp_launch_start {
++	__u64 policy;
++	__u8 gosvw[16];
++	__u16 flags;
++	__u8 pad0[6];
++	__u64 pad1[4];
++};
++
++/* Kept in sync with firmware values for simplicity. */
++#define KVM_SEV_SNP_PAGE_TYPE_NORMAL		0x1
++#define KVM_SEV_SNP_PAGE_TYPE_ZERO		0x3
++#define KVM_SEV_SNP_PAGE_TYPE_UNMEASURED	0x4
++#define KVM_SEV_SNP_PAGE_TYPE_SECRETS		0x5
++#define KVM_SEV_SNP_PAGE_TYPE_CPUID		0x6
++
++struct kvm_sev_snp_launch_update {
++	__u64 gfn_start;
++	__u64 uaddr;
++	__u64 len;
++	__u8 type;
++	__u8 pad0;
++	__u16 flags;
++	__u32 pad1;
++	__u64 pad2[4];
++};
++
++#define KVM_SEV_SNP_ID_BLOCK_SIZE	96
++#define KVM_SEV_SNP_ID_AUTH_SIZE	4096
++#define KVM_SEV_SNP_FINISH_DATA_SIZE	32
++
++struct kvm_sev_snp_launch_finish {
++	__u64 id_block_uaddr;
++	__u64 id_auth_uaddr;
++	__u8 id_block_en;
++	__u8 auth_key_en;
++	__u8 vcek_disabled;
++	__u8 host_data[KVM_SEV_SNP_FINISH_DATA_SIZE];
++	__u8 pad0[3];
++	__u16 flags;
++	__u64 pad1[4];
++};
++
+ #define KVM_X2APIC_API_USE_32BIT_IDS            (1ULL << 0)
+ #define KVM_X2APIC_API_DISABLE_BROADCAST_QUIRK  (1ULL << 1)
+ 
+@@ -870,5 +919,6 @@ struct kvm_hyperv_eventfd {
+ #define KVM_X86_SW_PROTECTED_VM	1
+ #define KVM_X86_SEV_VM		2
+ #define KVM_X86_SEV_ES_VM	3
++#define KVM_X86_SNP_VM		4
+ 
+ #endif /* _ASM_X86_KVM_H */
+diff --git a/linux-headers/linux/vhost.h b/linux-headers/linux/vhost.h
+index bea6973906..b95dd84eef 100644
+--- a/linux-headers/linux/vhost.h
++++ b/linux-headers/linux/vhost.h
+@@ -179,12 +179,6 @@
+ /* Get the config size */
+ #define VHOST_VDPA_GET_CONFIG_SIZE	_IOR(VHOST_VIRTIO, 0x79, __u32)
+ 
+-/* Get the count of all virtqueues */
+-#define VHOST_VDPA_GET_VQS_COUNT	_IOR(VHOST_VIRTIO, 0x80, __u32)
+-
+-/* Get the number of virtqueue groups. */
+-#define VHOST_VDPA_GET_GROUP_NUM	_IOR(VHOST_VIRTIO, 0x81, __u32)
+-
+ /* Get the number of address spaces. */
+ #define VHOST_VDPA_GET_AS_NUM		_IOR(VHOST_VIRTIO, 0x7A, unsigned int)
+ 
+@@ -228,10 +222,17 @@
+ #define VHOST_VDPA_GET_VRING_DESC_GROUP	_IOWR(VHOST_VIRTIO, 0x7F,	\
+ 					      struct vhost_vring_state)
+ 
++
++/* Get the count of all virtqueues */
++#define VHOST_VDPA_GET_VQS_COUNT	_IOR(VHOST_VIRTIO, 0x80, __u32)
++
++/* Get the number of virtqueue groups. */
++#define VHOST_VDPA_GET_GROUP_NUM	_IOR(VHOST_VIRTIO, 0x81, __u32)
++
+ /* Get the queue size of a specific virtqueue.
+  * userspace set the vring index in vhost_vring_state.index
+  * kernel set the queue size in vhost_vring_state.num
+  */
+-#define VHOST_VDPA_GET_VRING_SIZE	_IOWR(VHOST_VIRTIO, 0x80,	\
++#define VHOST_VDPA_GET_VRING_SIZE	_IOWR(VHOST_VIRTIO, 0x82,	\
+ 					      struct vhost_vring_state)
+ #endif
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-linux-headers-update-to-current-kvm-next.patch b/SOURCES/kvm-linux-headers-update-to-current-kvm-next.patch
new file mode 100644
index 0000000..4c3dd73
--- /dev/null
+++ b/SOURCES/kvm-linux-headers-update-to-current-kvm-next.patch
@@ -0,0 +1,2471 @@
+From 530296e1669c9730f261a269d5b911ea56dfcce7 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Tue, 23 Apr 2024 11:46:47 +0200
+Subject: [PATCH 017/100] linux-headers: update to current kvm/next
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [17/91] 5660d4967f10a84802de16c24540e95095eaffd5 (bonzini/rhel-qemu-kvm)
+
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit ab0c7fb22b56523f24d6e127cd4d10ecff67bf85)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ hw/i386/x86.c                                 |   8 -
+ include/standard-headers/asm-x86/bootparam.h  |  17 +-
+ include/standard-headers/asm-x86/kvm_para.h   |   3 +-
+ include/standard-headers/asm-x86/setup_data.h |  83 +++
+ include/standard-headers/linux/ethtool.h      |  48 ++
+ include/standard-headers/linux/fuse.h         |  39 +-
+ .../linux/input-event-codes.h                 |   1 +
+ include/standard-headers/linux/virtio_gpu.h   |   2 +
+ include/standard-headers/linux/virtio_pci.h   |  10 +-
+ include/standard-headers/linux/virtio_snd.h   | 154 ++++
+ linux-headers/asm-arm64/kvm.h                 |  15 +-
+ linux-headers/asm-arm64/sve_context.h         |  11 +
+ linux-headers/asm-generic/bitsperlong.h       |   4 +
+ linux-headers/asm-loongarch/kvm.h             |   2 -
+ linux-headers/asm-mips/kvm.h                  |   2 -
+ linux-headers/asm-powerpc/kvm.h               |  45 +-
+ linux-headers/asm-riscv/kvm.h                 |   3 +-
+ linux-headers/asm-s390/kvm.h                  | 315 +++++++-
+ linux-headers/asm-x86/kvm.h                   | 328 ++++++++-
+ linux-headers/linux/bits.h                    |  15 +
+ linux-headers/linux/kvm.h                     | 689 +-----------------
+ linux-headers/linux/psp-sev.h                 |  59 ++
+ linux-headers/linux/vhost.h                   |   7 +
+ 23 files changed, 1120 insertions(+), 740 deletions(-)
+ create mode 100644 include/standard-headers/asm-x86/setup_data.h
+ create mode 100644 linux-headers/linux/bits.h
+
+diff --git a/hw/i386/x86.c b/hw/i386/x86.c
+index ffbda48917..84a4801977 100644
+--- a/hw/i386/x86.c
++++ b/hw/i386/x86.c
+@@ -679,14 +679,6 @@ DeviceState *ioapic_init_secondary(GSIState *gsi_state)
+     return dev;
+ }
+ 
+-struct setup_data {
+-    uint64_t next;
+-    uint32_t type;
+-    uint32_t len;
+-    uint8_t data[];
+-} __attribute__((packed));
+-
+-
+ /*
+  * The entry point into the kernel for PVH boot is different from
+  * the native entry point.  The PVH entry is defined by the x86/HVM
+diff --git a/include/standard-headers/asm-x86/bootparam.h b/include/standard-headers/asm-x86/bootparam.h
+index 0b06d2bff1..b582a105c0 100644
+--- a/include/standard-headers/asm-x86/bootparam.h
++++ b/include/standard-headers/asm-x86/bootparam.h
+@@ -2,21 +2,7 @@
+ #ifndef _ASM_X86_BOOTPARAM_H
+ #define _ASM_X86_BOOTPARAM_H
+ 
+-/* setup_data/setup_indirect types */
+-#define SETUP_NONE			0
+-#define SETUP_E820_EXT			1
+-#define SETUP_DTB			2
+-#define SETUP_PCI			3
+-#define SETUP_EFI			4
+-#define SETUP_APPLE_PROPERTIES		5
+-#define SETUP_JAILHOUSE			6
+-#define SETUP_CC_BLOB			7
+-#define SETUP_IMA			8
+-#define SETUP_RNG_SEED			9
+-#define SETUP_ENUM_MAX			SETUP_RNG_SEED
+-
+-#define SETUP_INDIRECT			(1<<31)
+-#define SETUP_TYPE_MAX			(SETUP_ENUM_MAX | SETUP_INDIRECT)
++#include "standard-headers/asm-x86/setup_data.h"
+ 
+ /* ram_size flags */
+ #define RAMDISK_IMAGE_START_MASK	0x07FF
+@@ -38,6 +24,7 @@
+ #define XLF_EFI_KEXEC			(1<<4)
+ #define XLF_5LEVEL			(1<<5)
+ #define XLF_5LEVEL_ENABLED		(1<<6)
++#define XLF_MEM_ENCRYPTION		(1<<7)
+ 
+ 
+ #endif /* _ASM_X86_BOOTPARAM_H */
+diff --git a/include/standard-headers/asm-x86/kvm_para.h b/include/standard-headers/asm-x86/kvm_para.h
+index f0235e58a1..9a011d20f0 100644
+--- a/include/standard-headers/asm-x86/kvm_para.h
++++ b/include/standard-headers/asm-x86/kvm_para.h
+@@ -92,7 +92,7 @@ struct kvm_clock_pairing {
+ #define KVM_ASYNC_PF_DELIVERY_AS_INT		(1 << 3)
+ 
+ /* MSR_KVM_ASYNC_PF_INT */
+-#define KVM_ASYNC_PF_VEC_MASK			GENMASK(7, 0)
++#define KVM_ASYNC_PF_VEC_MASK			__GENMASK(7, 0)
+ 
+ /* MSR_KVM_MIGRATION_CONTROL */
+ #define KVM_MIGRATION_READY		(1 << 0)
+@@ -142,7 +142,6 @@ struct kvm_vcpu_pv_apf_data {
+ 	uint32_t token;
+ 
+ 	uint8_t pad[56];
+-	uint32_t enabled;
+ };
+ 
+ #define KVM_PV_EOI_BIT 0
+diff --git a/include/standard-headers/asm-x86/setup_data.h b/include/standard-headers/asm-x86/setup_data.h
+new file mode 100644
+index 0000000000..09355f54c5
+--- /dev/null
++++ b/include/standard-headers/asm-x86/setup_data.h
+@@ -0,0 +1,83 @@
++/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
++#ifndef _ASM_X86_SETUP_DATA_H
++#define _ASM_X86_SETUP_DATA_H
++
++/* setup_data/setup_indirect types */
++#define SETUP_NONE			0
++#define SETUP_E820_EXT			1
++#define SETUP_DTB			2
++#define SETUP_PCI			3
++#define SETUP_EFI			4
++#define SETUP_APPLE_PROPERTIES		5
++#define SETUP_JAILHOUSE			6
++#define SETUP_CC_BLOB			7
++#define SETUP_IMA			8
++#define SETUP_RNG_SEED			9
++#define SETUP_ENUM_MAX			SETUP_RNG_SEED
++
++#define SETUP_INDIRECT			(1<<31)
++#define SETUP_TYPE_MAX			(SETUP_ENUM_MAX | SETUP_INDIRECT)
++
++#ifndef __ASSEMBLY__
++
++#include "standard-headers/linux/types.h"
++
++/* extensible setup data list node */
++struct setup_data {
++	uint64_t next;
++	uint32_t type;
++	uint32_t len;
++	uint8_t data[];
++};
++
++/* extensible setup indirect data node */
++struct setup_indirect {
++	uint32_t type;
++	uint32_t reserved;  /* Reserved, must be set to zero. */
++	uint64_t len;
++	uint64_t addr;
++};
++
++/*
++ * The E820 memory region entry of the boot protocol ABI:
++ */
++struct boot_e820_entry {
++	uint64_t addr;
++	uint64_t size;
++	uint32_t type;
++} QEMU_PACKED;
++
++/*
++ * The boot loader is passing platform information via this Jailhouse-specific
++ * setup data structure.
++ */
++struct jailhouse_setup_data {
++	struct {
++		uint16_t	version;
++		uint16_t	compatible_version;
++	} QEMU_PACKED hdr;
++	struct {
++		uint16_t	pm_timer_address;
++		uint16_t	num_cpus;
++		uint64_t	pci_mmconfig_base;
++		uint32_t	tsc_khz;
++		uint32_t	apic_khz;
++		uint8_t	standard_ioapic;
++		uint8_t	cpu_ids[255];
++	} QEMU_PACKED v1;
++	struct {
++		uint32_t	flags;
++	} QEMU_PACKED v2;
++} QEMU_PACKED;
++
++/*
++ * IMA buffer setup data information from the previous kernel during kexec
++ */
++struct ima_setup_data {
++	uint64_t addr;
++	uint64_t size;
++} QEMU_PACKED;
++
++#endif /* __ASSEMBLY__ */
++
++#endif /* _ASM_X86_SETUP_DATA_H */
+diff --git a/include/standard-headers/linux/ethtool.h b/include/standard-headers/linux/ethtool.h
+index dfb54eff6f..01503784d2 100644
+--- a/include/standard-headers/linux/ethtool.h
++++ b/include/standard-headers/linux/ethtool.h
+@@ -2023,6 +2023,53 @@ static inline int ethtool_validate_duplex(uint8_t duplex)
+ #define	IPV4_FLOW	0x10	/* hash only */
+ #define	IPV6_FLOW	0x11	/* hash only */
+ #define	ETHER_FLOW	0x12	/* spec only (ether_spec) */
++
++/* Used for GTP-U IPv4 and IPv6.
++ * The format of GTP packets only includes
++ * elements such as TEID and GTP version.
++ * It is primarily intended for data communication of the UE.
++ */
++#define GTPU_V4_FLOW 0x13	/* hash only */
++#define GTPU_V6_FLOW 0x14	/* hash only */
++
++/* Use for GTP-C IPv4 and v6.
++ * The format of these GTP packets does not include TEID.
++ * Primarily expected to be used for communication
++ * to create sessions for UE data communication,
++ * commonly referred to as CSR (Create Session Request).
++ */
++#define GTPC_V4_FLOW 0x15	/* hash only */
++#define GTPC_V6_FLOW 0x16	/* hash only */
++
++/* Use for GTP-C IPv4 and v6.
++ * Unlike GTPC_V4_FLOW, the format of these GTP packets includes TEID.
++ * After session creation, it becomes this packet.
++ * This is mainly used for requests to realize UE handover.
++ */
++#define GTPC_TEID_V4_FLOW 0x17	/* hash only */
++#define GTPC_TEID_V6_FLOW 0x18	/* hash only */
++
++/* Use for GTP-U and extended headers for the PSC (PDU Session Container).
++ * The format of these GTP packets includes TEID and QFI.
++ * In 5G communication using UPF (User Plane Function),
++ * data communication with this extended header is performed.
++ */
++#define GTPU_EH_V4_FLOW 0x19	/* hash only */
++#define GTPU_EH_V6_FLOW 0x1a	/* hash only */
++
++/* Use for GTP-U IPv4 and v6 PSC (PDU Session Container) extended headers.
++ * This differs from GTPU_EH_V(4|6)_FLOW in that it is distinguished by
++ * UL/DL included in the PSC.
++ * There are differences in the data included based on Downlink/Uplink,
++ * and can be used to distinguish packets.
++ * The functions described so far are useful when you want to
++ * handle communication from the mobile network in UPF, PGW, etc.
++ */
++#define GTPU_UL_V4_FLOW 0x1b	/* hash only */
++#define GTPU_UL_V6_FLOW 0x1c	/* hash only */
++#define GTPU_DL_V4_FLOW 0x1d	/* hash only */
++#define GTPU_DL_V6_FLOW 0x1e	/* hash only */
++
+ /* Flag to enable additional fields in struct ethtool_rx_flow_spec */
+ #define	FLOW_EXT	0x80000000
+ #define	FLOW_MAC_EXT	0x40000000
+@@ -2037,6 +2084,7 @@ static inline int ethtool_validate_duplex(uint8_t duplex)
+ #define	RXH_IP_DST	(1 << 5)
+ #define	RXH_L4_B_0_1	(1 << 6) /* src port in case of TCP/UDP/SCTP */
+ #define	RXH_L4_B_2_3	(1 << 7) /* dst port in case of TCP/UDP/SCTP */
++#define	RXH_GTP_TEID	(1 << 8) /* teid in case of GTP */
+ #define	RXH_DISCARD	(1 << 31)
+ 
+ #define	RX_CLS_FLOW_DISC	0xffffffffffffffffULL
+diff --git a/include/standard-headers/linux/fuse.h b/include/standard-headers/linux/fuse.h
+index fc0dcd10ae..bac9dbc49f 100644
+--- a/include/standard-headers/linux/fuse.h
++++ b/include/standard-headers/linux/fuse.h
+@@ -211,6 +211,12 @@
+  *  7.39
+  *  - add FUSE_DIRECT_IO_ALLOW_MMAP
+  *  - add FUSE_STATX and related structures
++ *
++ *  7.40
++ *  - add max_stack_depth to fuse_init_out, add FUSE_PASSTHROUGH init flag
++ *  - add backing_id to fuse_open_out, add FOPEN_PASSTHROUGH open flag
++ *  - add FUSE_NO_EXPORT_SUPPORT init flag
++ *  - add FUSE_NOTIFY_RESEND, add FUSE_HAS_RESEND init flag
+  */
+ 
+ #ifndef _LINUX_FUSE_H
+@@ -242,7 +248,7 @@
+ #define FUSE_KERNEL_VERSION 7
+ 
+ /** Minor version number of this interface */
+-#define FUSE_KERNEL_MINOR_VERSION 39
++#define FUSE_KERNEL_MINOR_VERSION 40
+ 
+ /** The node ID of the root inode */
+ #define FUSE_ROOT_ID 1
+@@ -349,6 +355,7 @@ struct fuse_file_lock {
+  * FOPEN_STREAM: the file is stream-like (no file position at all)
+  * FOPEN_NOFLUSH: don't flush data cache on close (unless FUSE_WRITEBACK_CACHE)
+  * FOPEN_PARALLEL_DIRECT_WRITES: Allow concurrent direct writes on the same inode
++ * FOPEN_PASSTHROUGH: passthrough read/write io for this open file
+  */
+ #define FOPEN_DIRECT_IO		(1 << 0)
+ #define FOPEN_KEEP_CACHE	(1 << 1)
+@@ -357,6 +364,7 @@ struct fuse_file_lock {
+ #define FOPEN_STREAM		(1 << 4)
+ #define FOPEN_NOFLUSH		(1 << 5)
+ #define FOPEN_PARALLEL_DIRECT_WRITES	(1 << 6)
++#define FOPEN_PASSTHROUGH	(1 << 7)
+ 
+ /**
+  * INIT request/reply flags
+@@ -406,6 +414,9 @@ struct fuse_file_lock {
+  *			symlink and mknod (single group that matches parent)
+  * FUSE_HAS_EXPIRE_ONLY: kernel supports expiry-only entry invalidation
+  * FUSE_DIRECT_IO_ALLOW_MMAP: allow shared mmap in FOPEN_DIRECT_IO mode.
++ * FUSE_NO_EXPORT_SUPPORT: explicitly disable export support
++ * FUSE_HAS_RESEND: kernel supports resending pending requests, and the high bit
++ *		    of the request ID indicates resend requests
+  */
+ #define FUSE_ASYNC_READ		(1 << 0)
+ #define FUSE_POSIX_LOCKS	(1 << 1)
+@@ -445,6 +456,9 @@ struct fuse_file_lock {
+ #define FUSE_CREATE_SUPP_GROUP	(1ULL << 34)
+ #define FUSE_HAS_EXPIRE_ONLY	(1ULL << 35)
+ #define FUSE_DIRECT_IO_ALLOW_MMAP (1ULL << 36)
++#define FUSE_PASSTHROUGH	(1ULL << 37)
++#define FUSE_NO_EXPORT_SUPPORT	(1ULL << 38)
++#define FUSE_HAS_RESEND		(1ULL << 39)
+ 
+ /* Obsolete alias for FUSE_DIRECT_IO_ALLOW_MMAP */
+ #define FUSE_DIRECT_IO_RELAX	FUSE_DIRECT_IO_ALLOW_MMAP
+@@ -631,6 +645,7 @@ enum fuse_notify_code {
+ 	FUSE_NOTIFY_STORE = 4,
+ 	FUSE_NOTIFY_RETRIEVE = 5,
+ 	FUSE_NOTIFY_DELETE = 6,
++	FUSE_NOTIFY_RESEND = 7,
+ 	FUSE_NOTIFY_CODE_MAX,
+ };
+ 
+@@ -757,7 +772,7 @@ struct fuse_create_in {
+ struct fuse_open_out {
+ 	uint64_t	fh;
+ 	uint32_t	open_flags;
+-	uint32_t	padding;
++	int32_t		backing_id;
+ };
+ 
+ struct fuse_release_in {
+@@ -873,7 +888,8 @@ struct fuse_init_out {
+ 	uint16_t	max_pages;
+ 	uint16_t	map_alignment;
+ 	uint32_t	flags2;
+-	uint32_t	unused[7];
++	uint32_t	max_stack_depth;
++	uint32_t	unused[6];
+ };
+ 
+ #define CUSE_INIT_INFO_MAX 4096
+@@ -956,6 +972,14 @@ struct fuse_fallocate_in {
+ 	uint32_t	padding;
+ };
+ 
++/**
++ * FUSE request unique ID flag
++ *
++ * Indicates whether this is a resend request. The receiver should handle this
++ * request accordingly.
++ */
++#define FUSE_UNIQUE_RESEND (1ULL << 63)
++
+ struct fuse_in_header {
+ 	uint32_t	len;
+ 	uint32_t	opcode;
+@@ -1045,9 +1069,18 @@ struct fuse_notify_retrieve_in {
+ 	uint64_t	dummy4;
+ };
+ 
++struct fuse_backing_map {
++	int32_t		fd;
++	uint32_t	flags;
++	uint64_t	padding;
++};
++
+ /* Device ioctls: */
+ #define FUSE_DEV_IOC_MAGIC		229
+ #define FUSE_DEV_IOC_CLONE		_IOR(FUSE_DEV_IOC_MAGIC, 0, uint32_t)
++#define FUSE_DEV_IOC_BACKING_OPEN	_IOW(FUSE_DEV_IOC_MAGIC, 1, \
++					     struct fuse_backing_map)
++#define FUSE_DEV_IOC_BACKING_CLOSE	_IOW(FUSE_DEV_IOC_MAGIC, 2, uint32_t)
+ 
+ struct fuse_lseek_in {
+ 	uint64_t	fh;
+diff --git a/include/standard-headers/linux/input-event-codes.h b/include/standard-headers/linux/input-event-codes.h
+index f6bab08540..2221b0c383 100644
+--- a/include/standard-headers/linux/input-event-codes.h
++++ b/include/standard-headers/linux/input-event-codes.h
+@@ -602,6 +602,7 @@
+ 
+ #define KEY_ALS_TOGGLE		0x230	/* Ambient light sensor */
+ #define KEY_ROTATE_LOCK_TOGGLE	0x231	/* Display rotation lock */
++#define KEY_REFRESH_RATE_TOGGLE	0x232	/* Display refresh rate toggle */
+ 
+ #define KEY_BUTTONCONFIG		0x240	/* AL Button Configuration */
+ #define KEY_TASKMANAGER		0x241	/* AL Task/Project Manager */
+diff --git a/include/standard-headers/linux/virtio_gpu.h b/include/standard-headers/linux/virtio_gpu.h
+index 2da48d3d4c..2db643ed8f 100644
+--- a/include/standard-headers/linux/virtio_gpu.h
++++ b/include/standard-headers/linux/virtio_gpu.h
+@@ -309,6 +309,8 @@ struct virtio_gpu_cmd_submit {
+ 
+ #define VIRTIO_GPU_CAPSET_VIRGL 1
+ #define VIRTIO_GPU_CAPSET_VIRGL2 2
++/* 3 is reserved for gfxstream */
++#define VIRTIO_GPU_CAPSET_VENUS 4
+ 
+ /* VIRTIO_GPU_CMD_GET_CAPSET_INFO */
+ struct virtio_gpu_get_capset_info {
+diff --git a/include/standard-headers/linux/virtio_pci.h b/include/standard-headers/linux/virtio_pci.h
+index 3e2bc2c97e..4010216103 100644
+--- a/include/standard-headers/linux/virtio_pci.h
++++ b/include/standard-headers/linux/virtio_pci.h
+@@ -240,7 +240,7 @@ struct virtio_pci_cfg_cap {
+ #define VIRTIO_ADMIN_CMD_LEGACY_DEV_CFG_READ		0x5
+ #define VIRTIO_ADMIN_CMD_LEGACY_NOTIFY_INFO		0x6
+ 
+-struct QEMU_PACKED virtio_admin_cmd_hdr {
++struct virtio_admin_cmd_hdr {
+ 	uint16_t opcode;
+ 	/*
+ 	 * 1 - SR-IOV
+@@ -252,20 +252,20 @@ struct QEMU_PACKED virtio_admin_cmd_hdr {
+ 	uint64_t group_member_id;
+ };
+ 
+-struct QEMU_PACKED virtio_admin_cmd_status {
++struct virtio_admin_cmd_status {
+ 	uint16_t status;
+ 	uint16_t status_qualifier;
+ 	/* Unused, reserved for future extensions. */
+ 	uint8_t reserved2[4];
+ };
+ 
+-struct QEMU_PACKED virtio_admin_cmd_legacy_wr_data {
++struct virtio_admin_cmd_legacy_wr_data {
+ 	uint8_t offset; /* Starting offset of the register(s) to write. */
+ 	uint8_t reserved[7];
+ 	uint8_t registers[];
+ };
+ 
+-struct QEMU_PACKED virtio_admin_cmd_legacy_rd_data {
++struct virtio_admin_cmd_legacy_rd_data {
+ 	uint8_t offset; /* Starting offset of the register(s) to read. */
+ };
+ 
+@@ -275,7 +275,7 @@ struct QEMU_PACKED virtio_admin_cmd_legacy_rd_data {
+ 
+ #define VIRTIO_ADMIN_CMD_MAX_NOTIFY_INFO 4
+ 
+-struct QEMU_PACKED virtio_admin_cmd_notify_info_data {
++struct virtio_admin_cmd_notify_info_data {
+ 	uint8_t flags; /* 0 = end of list, 1 = owner device, 2 = member device */
+ 	uint8_t bar; /* BAR of the member or the owner device */
+ 	uint8_t padding[6];
+diff --git a/include/standard-headers/linux/virtio_snd.h b/include/standard-headers/linux/virtio_snd.h
+index 1af96b9fc6..860f12e0a4 100644
+--- a/include/standard-headers/linux/virtio_snd.h
++++ b/include/standard-headers/linux/virtio_snd.h
+@@ -7,6 +7,14 @@
+ 
+ #include "standard-headers/linux/virtio_types.h"
+ 
++/*******************************************************************************
++ * FEATURE BITS
++ */
++enum {
++	/* device supports control elements */
++	VIRTIO_SND_F_CTLS = 0
++};
++
+ /*******************************************************************************
+  * CONFIGURATION SPACE
+  */
+@@ -17,6 +25,8 @@ struct virtio_snd_config {
+ 	uint32_t streams;
+ 	/* # of available channel maps */
+ 	uint32_t chmaps;
++	/* # of available control elements */
++	uint32_t controls;
+ };
+ 
+ enum {
+@@ -55,6 +65,15 @@ enum {
+ 	/* channel map control request types */
+ 	VIRTIO_SND_R_CHMAP_INFO = 0x0200,
+ 
++	/* control element request types */
++	VIRTIO_SND_R_CTL_INFO = 0x0300,
++	VIRTIO_SND_R_CTL_ENUM_ITEMS,
++	VIRTIO_SND_R_CTL_READ,
++	VIRTIO_SND_R_CTL_WRITE,
++	VIRTIO_SND_R_CTL_TLV_READ,
++	VIRTIO_SND_R_CTL_TLV_WRITE,
++	VIRTIO_SND_R_CTL_TLV_COMMAND,
++
+ 	/* jack event types */
+ 	VIRTIO_SND_EVT_JACK_CONNECTED = 0x1000,
+ 	VIRTIO_SND_EVT_JACK_DISCONNECTED,
+@@ -63,6 +82,9 @@ enum {
+ 	VIRTIO_SND_EVT_PCM_PERIOD_ELAPSED = 0x1100,
+ 	VIRTIO_SND_EVT_PCM_XRUN,
+ 
++	/* control element event types */
++	VIRTIO_SND_EVT_CTL_NOTIFY = 0x1200,
++
+ 	/* common status codes */
+ 	VIRTIO_SND_S_OK = 0x8000,
+ 	VIRTIO_SND_S_BAD_MSG,
+@@ -331,4 +353,136 @@ struct virtio_snd_chmap_info {
+ 	uint8_t positions[VIRTIO_SND_CHMAP_MAX_SIZE];
+ };
+ 
++/*******************************************************************************
++ * CONTROL ELEMENTS MESSAGES
++ */
++struct virtio_snd_ctl_hdr {
++	/* VIRTIO_SND_R_CTL_XXX */
++	struct virtio_snd_hdr hdr;
++	/* 0 ... virtio_snd_config::controls - 1 */
++	uint32_t control_id;
++};
++
++/* supported roles for control elements */
++enum {
++	VIRTIO_SND_CTL_ROLE_UNDEFINED = 0,
++	VIRTIO_SND_CTL_ROLE_VOLUME,
++	VIRTIO_SND_CTL_ROLE_MUTE,
++	VIRTIO_SND_CTL_ROLE_GAIN
++};
++
++/* supported value types for control elements */
++enum {
++	VIRTIO_SND_CTL_TYPE_BOOLEAN = 0,
++	VIRTIO_SND_CTL_TYPE_INTEGER,
++	VIRTIO_SND_CTL_TYPE_INTEGER64,
++	VIRTIO_SND_CTL_TYPE_ENUMERATED,
++	VIRTIO_SND_CTL_TYPE_BYTES,
++	VIRTIO_SND_CTL_TYPE_IEC958
++};
++
++/* supported access rights for control elements */
++enum {
++	VIRTIO_SND_CTL_ACCESS_READ = 0,
++	VIRTIO_SND_CTL_ACCESS_WRITE,
++	VIRTIO_SND_CTL_ACCESS_VOLATILE,
++	VIRTIO_SND_CTL_ACCESS_INACTIVE,
++	VIRTIO_SND_CTL_ACCESS_TLV_READ,
++	VIRTIO_SND_CTL_ACCESS_TLV_WRITE,
++	VIRTIO_SND_CTL_ACCESS_TLV_COMMAND
++};
++
++struct virtio_snd_ctl_info {
++	/* common header */
++	struct virtio_snd_info hdr;
++	/* element role (VIRTIO_SND_CTL_ROLE_XXX) */
++	uint32_t role;
++	/* element value type (VIRTIO_SND_CTL_TYPE_XXX) */
++	uint32_t type;
++	/* element access right bit map (1 << VIRTIO_SND_CTL_ACCESS_XXX) */
++	uint32_t access;
++	/* # of members in the element value */
++	uint32_t count;
++	/* index for an element with a non-unique name */
++	uint32_t index;
++	/* name identifier string for the element */
++	uint8_t name[44];
++	/* additional information about the element's value */
++	union {
++		/* VIRTIO_SND_CTL_TYPE_INTEGER */
++		struct {
++			/* minimum supported value */
++			uint32_t min;
++			/* maximum supported value */
++			uint32_t max;
++			/* fixed step size for value (0 = variable size) */
++			uint32_t step;
++		} integer;
++		/* VIRTIO_SND_CTL_TYPE_INTEGER64 */
++		struct {
++			/* minimum supported value */
++			uint64_t min;
++			/* maximum supported value */
++			uint64_t max;
++			/* fixed step size for value (0 = variable size) */
++			uint64_t step;
++		} integer64;
++		/* VIRTIO_SND_CTL_TYPE_ENUMERATED */
++		struct {
++			/* # of options supported for value */
++			uint32_t items;
++		} enumerated;
++	} value;
++};
++
++struct virtio_snd_ctl_enum_item {
++	/* option name */
++	uint8_t item[64];
++};
++
++struct virtio_snd_ctl_iec958 {
++	/* AES/IEC958 channel status bits */
++	uint8_t status[24];
++	/* AES/IEC958 subcode bits */
++	uint8_t subcode[147];
++	/* nothing */
++	uint8_t pad;
++	/* AES/IEC958 subframe bits */
++	uint8_t dig_subframe[4];
++};
++
++struct virtio_snd_ctl_value {
++	union {
++		/* VIRTIO_SND_CTL_TYPE_BOOLEAN|INTEGER value */
++		uint32_t integer[128];
++		/* VIRTIO_SND_CTL_TYPE_INTEGER64 value */
++		uint64_t integer64[64];
++		/* VIRTIO_SND_CTL_TYPE_ENUMERATED value (option indexes) */
++		uint32_t enumerated[128];
++		/* VIRTIO_SND_CTL_TYPE_BYTES value */
++		uint8_t bytes[512];
++		/* VIRTIO_SND_CTL_TYPE_IEC958 value */
++		struct virtio_snd_ctl_iec958 iec958;
++	} value;
++};
++
++/* supported event reason types */
++enum {
++	/* element's value has changed */
++	VIRTIO_SND_CTL_EVT_MASK_VALUE = 0,
++	/* element's information has changed */
++	VIRTIO_SND_CTL_EVT_MASK_INFO,
++	/* element's metadata has changed */
++	VIRTIO_SND_CTL_EVT_MASK_TLV
++};
++
++struct virtio_snd_ctl_event {
++	/* VIRTIO_SND_EVT_CTL_NOTIFY */
++	struct virtio_snd_hdr hdr;
++	/* 0 ... virtio_snd_config::controls - 1 */
++	uint16_t control_id;
++	/* event reason bit map (1 << VIRTIO_SND_CTL_EVT_MASK_XXX) */
++	uint16_t mask;
++};
++
+ #endif /* VIRTIO_SND_IF_H */
+diff --git a/linux-headers/asm-arm64/kvm.h b/linux-headers/asm-arm64/kvm.h
+index c59ea55cd8..2af9931ae9 100644
+--- a/linux-headers/asm-arm64/kvm.h
++++ b/linux-headers/asm-arm64/kvm.h
+@@ -37,9 +37,7 @@
+ #include <asm/ptrace.h>
+ #include <asm/sve_context.h>
+ 
+-#define __KVM_HAVE_GUEST_DEBUG
+ #define __KVM_HAVE_IRQ_LINE
+-#define __KVM_HAVE_READONLY_MEM
+ #define __KVM_HAVE_VCPU_EVENTS
+ 
+ #define KVM_COALESCED_MMIO_PAGE_OFFSET 1
+@@ -76,11 +74,11 @@ struct kvm_regs {
+ 
+ /* KVM_ARM_SET_DEVICE_ADDR ioctl id encoding */
+ #define KVM_ARM_DEVICE_TYPE_SHIFT	0
+-#define KVM_ARM_DEVICE_TYPE_MASK	GENMASK(KVM_ARM_DEVICE_TYPE_SHIFT + 15, \
+-						KVM_ARM_DEVICE_TYPE_SHIFT)
++#define KVM_ARM_DEVICE_TYPE_MASK	__GENMASK(KVM_ARM_DEVICE_TYPE_SHIFT + 15, \
++						  KVM_ARM_DEVICE_TYPE_SHIFT)
+ #define KVM_ARM_DEVICE_ID_SHIFT		16
+-#define KVM_ARM_DEVICE_ID_MASK		GENMASK(KVM_ARM_DEVICE_ID_SHIFT + 15, \
+-						KVM_ARM_DEVICE_ID_SHIFT)
++#define KVM_ARM_DEVICE_ID_MASK		__GENMASK(KVM_ARM_DEVICE_ID_SHIFT + 15, \
++						  KVM_ARM_DEVICE_ID_SHIFT)
+ 
+ /* Supported device IDs */
+ #define KVM_ARM_DEVICE_VGIC_V2		0
+@@ -162,6 +160,11 @@ struct kvm_sync_regs {
+ 	__u64 device_irq_level;
+ };
+ 
++/* Bits for run->s.regs.device_irq_level */
++#define KVM_ARM_DEV_EL1_VTIMER		(1 << 0)
++#define KVM_ARM_DEV_EL1_PTIMER		(1 << 1)
++#define KVM_ARM_DEV_PMU			(1 << 2)
++
+ /*
+  * PMU filter structure. Describe a range of events with a particular
+  * action. To be used with KVM_ARM_VCPU_PMU_V3_FILTER.
+diff --git a/linux-headers/asm-arm64/sve_context.h b/linux-headers/asm-arm64/sve_context.h
+index 1d0e3e1d09..d1b1ec8cb1 100644
+--- a/linux-headers/asm-arm64/sve_context.h
++++ b/linux-headers/asm-arm64/sve_context.h
+@@ -13,6 +13,17 @@
+ 
+ #define __SVE_VQ_BYTES		16	/* number of bytes per quadword */
+ 
++/*
++ * Yes, __SVE_VQ_MAX is 512 QUADWORDS.
++ *
++ * To help ensure forward portability, this is much larger than the
++ * current maximum value defined by the SVE architecture.  While arrays
++ * or static allocations can be sized based on this value, watch out!
++ * It will waste a surprisingly large amount of memory.
++ *
++ * Dynamic sizing based on the actual runtime vector length is likely to
++ * be preferable for most purposes.
++ */
+ #define __SVE_VQ_MIN		1
+ #define __SVE_VQ_MAX		512
+ 
+diff --git a/linux-headers/asm-generic/bitsperlong.h b/linux-headers/asm-generic/bitsperlong.h
+index 75f320fa91..1fb4f0c9f2 100644
+--- a/linux-headers/asm-generic/bitsperlong.h
++++ b/linux-headers/asm-generic/bitsperlong.h
+@@ -24,4 +24,8 @@
+ #endif
+ #endif
+ 
++#ifndef __BITS_PER_LONG_LONG
++#define __BITS_PER_LONG_LONG 64
++#endif
++
+ #endif /* __ASM_GENERIC_BITS_PER_LONG */
+diff --git a/linux-headers/asm-loongarch/kvm.h b/linux-headers/asm-loongarch/kvm.h
+index 923d0bd382..109785922c 100644
+--- a/linux-headers/asm-loongarch/kvm.h
++++ b/linux-headers/asm-loongarch/kvm.h
+@@ -14,8 +14,6 @@
+  * Some parts derived from the x86 version of this file.
+  */
+ 
+-#define __KVM_HAVE_READONLY_MEM
+-
+ #define KVM_COALESCED_MMIO_PAGE_OFFSET	1
+ #define KVM_DIRTY_LOG_PAGE_OFFSET	64
+ 
+diff --git a/linux-headers/asm-mips/kvm.h b/linux-headers/asm-mips/kvm.h
+index edcf717c43..9673dc9cb3 100644
+--- a/linux-headers/asm-mips/kvm.h
++++ b/linux-headers/asm-mips/kvm.h
+@@ -20,8 +20,6 @@
+  * Some parts derived from the x86 version of this file.
+  */
+ 
+-#define __KVM_HAVE_READONLY_MEM
+-
+ #define KVM_COALESCED_MMIO_PAGE_OFFSET 1
+ 
+ /*
+diff --git a/linux-headers/asm-powerpc/kvm.h b/linux-headers/asm-powerpc/kvm.h
+index 9f18fa090f..1691297a76 100644
+--- a/linux-headers/asm-powerpc/kvm.h
++++ b/linux-headers/asm-powerpc/kvm.h
+@@ -28,7 +28,6 @@
+ #define __KVM_HAVE_PPC_SMT
+ #define __KVM_HAVE_IRQCHIP
+ #define __KVM_HAVE_IRQ_LINE
+-#define __KVM_HAVE_GUEST_DEBUG
+ 
+ /* Not always available, but if it is, this is the correct offset.  */
+ #define KVM_COALESCED_MMIO_PAGE_OFFSET 1
+@@ -733,4 +732,48 @@ struct kvm_ppc_xive_eq {
+ #define KVM_XIVE_TIMA_PAGE_OFFSET	0
+ #define KVM_XIVE_ESB_PAGE_OFFSET	4
+ 
++/* for KVM_PPC_GET_PVINFO */
++
++#define KVM_PPC_PVINFO_FLAGS_EV_IDLE   (1<<0)
++
++struct kvm_ppc_pvinfo {
++	/* out */
++	__u32 flags;
++	__u32 hcall[4];
++	__u8  pad[108];
++};
++
++/* for KVM_PPC_GET_SMMU_INFO */
++#define KVM_PPC_PAGE_SIZES_MAX_SZ	8
++
++struct kvm_ppc_one_page_size {
++	__u32 page_shift;	/* Page shift (or 0) */
++	__u32 pte_enc;		/* Encoding in the HPTE (>>12) */
++};
++
++struct kvm_ppc_one_seg_page_size {
++	__u32 page_shift;	/* Base page shift of segment (or 0) */
++	__u32 slb_enc;		/* SLB encoding for BookS */
++	struct kvm_ppc_one_page_size enc[KVM_PPC_PAGE_SIZES_MAX_SZ];
++};
++
++#define KVM_PPC_PAGE_SIZES_REAL		0x00000001
++#define KVM_PPC_1T_SEGMENTS		0x00000002
++#define KVM_PPC_NO_HASH			0x00000004
++
++struct kvm_ppc_smmu_info {
++	__u64 flags;
++	__u32 slb_size;
++	__u16 data_keys;	/* # storage keys supported for data */
++	__u16 instr_keys;	/* # storage keys supported for instructions */
++	struct kvm_ppc_one_seg_page_size sps[KVM_PPC_PAGE_SIZES_MAX_SZ];
++};
++
++/* for KVM_PPC_RESIZE_HPT_{PREPARE,COMMIT} */
++struct kvm_ppc_resize_hpt {
++	__u64 flags;
++	__u32 shift;
++	__u32 pad;
++};
++
+ #endif /* __LINUX_KVM_POWERPC_H */
+diff --git a/linux-headers/asm-riscv/kvm.h b/linux-headers/asm-riscv/kvm.h
+index 7499e88a94..b1c503c295 100644
+--- a/linux-headers/asm-riscv/kvm.h
++++ b/linux-headers/asm-riscv/kvm.h
+@@ -16,7 +16,6 @@
+ #include <asm/ptrace.h>
+ 
+ #define __KVM_HAVE_IRQ_LINE
+-#define __KVM_HAVE_READONLY_MEM
+ 
+ #define KVM_COALESCED_MMIO_PAGE_OFFSET 1
+ 
+@@ -166,6 +165,8 @@ enum KVM_RISCV_ISA_EXT_ID {
+ 	KVM_RISCV_ISA_EXT_ZVFH,
+ 	KVM_RISCV_ISA_EXT_ZVFHMIN,
+ 	KVM_RISCV_ISA_EXT_ZFA,
++	KVM_RISCV_ISA_EXT_ZTSO,
++	KVM_RISCV_ISA_EXT_ZACAS,
+ 	KVM_RISCV_ISA_EXT_MAX,
+ };
+ 
+diff --git a/linux-headers/asm-s390/kvm.h b/linux-headers/asm-s390/kvm.h
+index 023a2763a9..684c4e1205 100644
+--- a/linux-headers/asm-s390/kvm.h
++++ b/linux-headers/asm-s390/kvm.h
+@@ -12,7 +12,320 @@
+ #include <linux/types.h>
+ 
+ #define __KVM_S390
+-#define __KVM_HAVE_GUEST_DEBUG
++
++struct kvm_s390_skeys {
++	__u64 start_gfn;
++	__u64 count;
++	__u64 skeydata_addr;
++	__u32 flags;
++	__u32 reserved[9];
++};
++
++#define KVM_S390_CMMA_PEEK (1 << 0)
++
++/**
++ * kvm_s390_cmma_log - Used for CMMA migration.
++ *
++ * Used both for input and output.
++ *
++ * @start_gfn: Guest page number to start from.
++ * @count: Size of the result buffer.
++ * @flags: Control operation mode via KVM_S390_CMMA_* flags
++ * @remaining: Used with KVM_S390_GET_CMMA_BITS. Indicates how many dirty
++ *             pages are still remaining.
++ * @mask: Used with KVM_S390_SET_CMMA_BITS. Bitmap of bits to actually set
++ *        in the PGSTE.
++ * @values: Pointer to the values buffer.
++ *
++ * Used in KVM_S390_{G,S}ET_CMMA_BITS ioctls.
++ */
++struct kvm_s390_cmma_log {
++	__u64 start_gfn;
++	__u32 count;
++	__u32 flags;
++	union {
++		__u64 remaining;
++		__u64 mask;
++	};
++	__u64 values;
++};
++
++#define KVM_S390_RESET_POR       1
++#define KVM_S390_RESET_CLEAR     2
++#define KVM_S390_RESET_SUBSYSTEM 4
++#define KVM_S390_RESET_CPU_INIT  8
++#define KVM_S390_RESET_IPL       16
++
++/* for KVM_S390_MEM_OP */
++struct kvm_s390_mem_op {
++	/* in */
++	__u64 gaddr;		/* the guest address */
++	__u64 flags;		/* flags */
++	__u32 size;		/* amount of bytes */
++	__u32 op;		/* type of operation */
++	__u64 buf;		/* buffer in userspace */
++	union {
++		struct {
++			__u8 ar;	/* the access register number */
++			__u8 key;	/* access key, ignored if flag unset */
++			__u8 pad1[6];	/* ignored */
++			__u64 old_addr;	/* ignored if cmpxchg flag unset */
++		};
++		__u32 sida_offset; /* offset into the sida */
++		__u8 reserved[32]; /* ignored */
++	};
++};
++/* types for kvm_s390_mem_op->op */
++#define KVM_S390_MEMOP_LOGICAL_READ	0
++#define KVM_S390_MEMOP_LOGICAL_WRITE	1
++#define KVM_S390_MEMOP_SIDA_READ	2
++#define KVM_S390_MEMOP_SIDA_WRITE	3
++#define KVM_S390_MEMOP_ABSOLUTE_READ	4
++#define KVM_S390_MEMOP_ABSOLUTE_WRITE	5
++#define KVM_S390_MEMOP_ABSOLUTE_CMPXCHG	6
++
++/* flags for kvm_s390_mem_op->flags */
++#define KVM_S390_MEMOP_F_CHECK_ONLY		(1ULL << 0)
++#define KVM_S390_MEMOP_F_INJECT_EXCEPTION	(1ULL << 1)
++#define KVM_S390_MEMOP_F_SKEY_PROTECTION	(1ULL << 2)
++
++/* flags specifying extension support via KVM_CAP_S390_MEM_OP_EXTENSION */
++#define KVM_S390_MEMOP_EXTENSION_CAP_BASE	(1 << 0)
++#define KVM_S390_MEMOP_EXTENSION_CAP_CMPXCHG	(1 << 1)
++
++struct kvm_s390_psw {
++	__u64 mask;
++	__u64 addr;
++};
++
++/* valid values for type in kvm_s390_interrupt */
++#define KVM_S390_SIGP_STOP		0xfffe0000u
++#define KVM_S390_PROGRAM_INT		0xfffe0001u
++#define KVM_S390_SIGP_SET_PREFIX	0xfffe0002u
++#define KVM_S390_RESTART		0xfffe0003u
++#define KVM_S390_INT_PFAULT_INIT	0xfffe0004u
++#define KVM_S390_INT_PFAULT_DONE	0xfffe0005u
++#define KVM_S390_MCHK			0xfffe1000u
++#define KVM_S390_INT_CLOCK_COMP		0xffff1004u
++#define KVM_S390_INT_CPU_TIMER		0xffff1005u
++#define KVM_S390_INT_VIRTIO		0xffff2603u
++#define KVM_S390_INT_SERVICE		0xffff2401u
++#define KVM_S390_INT_EMERGENCY		0xffff1201u
++#define KVM_S390_INT_EXTERNAL_CALL	0xffff1202u
++/* Anything below 0xfffe0000u is taken by INT_IO */
++#define KVM_S390_INT_IO(ai,cssid,ssid,schid)   \
++	(((schid)) |			       \
++	 ((ssid) << 16) |		       \
++	 ((cssid) << 18) |		       \
++	 ((ai) << 26))
++#define KVM_S390_INT_IO_MIN		0x00000000u
++#define KVM_S390_INT_IO_MAX		0xfffdffffu
++#define KVM_S390_INT_IO_AI_MASK		0x04000000u
++
++
++struct kvm_s390_interrupt {
++	__u32 type;
++	__u32 parm;
++	__u64 parm64;
++};
++
++struct kvm_s390_io_info {
++	__u16 subchannel_id;
++	__u16 subchannel_nr;
++	__u32 io_int_parm;
++	__u32 io_int_word;
++};
++
++struct kvm_s390_ext_info {
++	__u32 ext_params;
++	__u32 pad;
++	__u64 ext_params2;
++};
++
++struct kvm_s390_pgm_info {
++	__u64 trans_exc_code;
++	__u64 mon_code;
++	__u64 per_address;
++	__u32 data_exc_code;
++	__u16 code;
++	__u16 mon_class_nr;
++	__u8 per_code;
++	__u8 per_atmid;
++	__u8 exc_access_id;
++	__u8 per_access_id;
++	__u8 op_access_id;
++#define KVM_S390_PGM_FLAGS_ILC_VALID	0x01
++#define KVM_S390_PGM_FLAGS_ILC_0	0x02
++#define KVM_S390_PGM_FLAGS_ILC_1	0x04
++#define KVM_S390_PGM_FLAGS_ILC_MASK	0x06
++#define KVM_S390_PGM_FLAGS_NO_REWIND	0x08
++	__u8 flags;
++	__u8 pad[2];
++};
++
++struct kvm_s390_prefix_info {
++	__u32 address;
++};
++
++struct kvm_s390_extcall_info {
++	__u16 code;
++};
++
++struct kvm_s390_emerg_info {
++	__u16 code;
++};
++
++#define KVM_S390_STOP_FLAG_STORE_STATUS	0x01
++struct kvm_s390_stop_info {
++	__u32 flags;
++};
++
++struct kvm_s390_mchk_info {
++	__u64 cr14;
++	__u64 mcic;
++	__u64 failing_storage_address;
++	__u32 ext_damage_code;
++	__u32 pad;
++	__u8 fixed_logout[16];
++};
++
++struct kvm_s390_irq {
++	__u64 type;
++	union {
++		struct kvm_s390_io_info io;
++		struct kvm_s390_ext_info ext;
++		struct kvm_s390_pgm_info pgm;
++		struct kvm_s390_emerg_info emerg;
++		struct kvm_s390_extcall_info extcall;
++		struct kvm_s390_prefix_info prefix;
++		struct kvm_s390_stop_info stop;
++		struct kvm_s390_mchk_info mchk;
++		char reserved[64];
++	} u;
++};
++
++struct kvm_s390_irq_state {
++	__u64 buf;
++	__u32 flags;        /* will stay unused for compatibility reasons */
++	__u32 len;
++	__u32 reserved[4];  /* will stay unused for compatibility reasons */
++};
++
++struct kvm_s390_ucas_mapping {
++	__u64 user_addr;
++	__u64 vcpu_addr;
++	__u64 length;
++};
++
++struct kvm_s390_pv_sec_parm {
++	__u64 origin;
++	__u64 length;
++};
++
++struct kvm_s390_pv_unp {
++	__u64 addr;
++	__u64 size;
++	__u64 tweak;
++};
++
++enum pv_cmd_dmp_id {
++	KVM_PV_DUMP_INIT,
++	KVM_PV_DUMP_CONFIG_STOR_STATE,
++	KVM_PV_DUMP_COMPLETE,
++	KVM_PV_DUMP_CPU,
++};
++
++struct kvm_s390_pv_dmp {
++	__u64 subcmd;
++	__u64 buff_addr;
++	__u64 buff_len;
++	__u64 gaddr;		/* For dump storage state */
++	__u64 reserved[4];
++};
++
++enum pv_cmd_info_id {
++	KVM_PV_INFO_VM,
++	KVM_PV_INFO_DUMP,
++};
++
++struct kvm_s390_pv_info_dump {
++	__u64 dump_cpu_buffer_len;
++	__u64 dump_config_mem_buffer_per_1m;
++	__u64 dump_config_finalize_len;
++};
++
++struct kvm_s390_pv_info_vm {
++	__u64 inst_calls_list[4];
++	__u64 max_cpus;
++	__u64 max_guests;
++	__u64 max_guest_addr;
++	__u64 feature_indication;
++};
++
++struct kvm_s390_pv_info_header {
++	__u32 id;
++	__u32 len_max;
++	__u32 len_written;
++	__u32 reserved;
++};
++
++struct kvm_s390_pv_info {
++	struct kvm_s390_pv_info_header header;
++	union {
++		struct kvm_s390_pv_info_dump dump;
++		struct kvm_s390_pv_info_vm vm;
++	};
++};
++
++enum pv_cmd_id {
++	KVM_PV_ENABLE,
++	KVM_PV_DISABLE,
++	KVM_PV_SET_SEC_PARMS,
++	KVM_PV_UNPACK,
++	KVM_PV_VERIFY,
++	KVM_PV_PREP_RESET,
++	KVM_PV_UNSHARE_ALL,
++	KVM_PV_INFO,
++	KVM_PV_DUMP,
++	KVM_PV_ASYNC_CLEANUP_PREPARE,
++	KVM_PV_ASYNC_CLEANUP_PERFORM,
++};
++
++struct kvm_pv_cmd {
++	__u32 cmd;	/* Command to be executed */
++	__u16 rc;	/* Ultravisor return code */
++	__u16 rrc;	/* Ultravisor return reason code */
++	__u64 data;	/* Data or address */
++	__u32 flags;    /* flags for future extensions. Must be 0 for now */
++	__u32 reserved[3];
++};
++
++struct kvm_s390_zpci_op {
++	/* in */
++	__u32 fh;               /* target device */
++	__u8  op;               /* operation to perform */
++	__u8  pad[3];
++	union {
++		/* for KVM_S390_ZPCIOP_REG_AEN */
++		struct {
++			__u64 ibv;      /* Guest addr of interrupt bit vector */
++			__u64 sb;       /* Guest addr of summary bit */
++			__u32 flags;
++			__u32 noi;      /* Number of interrupts */
++			__u8 isc;       /* Guest interrupt subclass */
++			__u8 sbo;       /* Offset of guest summary bit vector */
++			__u16 pad;
++		} reg_aen;
++		__u64 reserved[8];
++	} u;
++};
++
++/* types for kvm_s390_zpci_op->op */
++#define KVM_S390_ZPCIOP_REG_AEN                0
++#define KVM_S390_ZPCIOP_DEREG_AEN      1
++
++/* flags for kvm_s390_zpci_op->u.reg_aen.flags */
++#define KVM_S390_ZPCIOP_REGAEN_HOST    (1 << 0)
+ 
+ /* Device control API: s390-specific devices */
+ #define KVM_DEV_FLIC_GET_ALL_IRQS	1
+diff --git a/linux-headers/asm-x86/kvm.h b/linux-headers/asm-x86/kvm.h
+index 003fb74534..31c95c2dfe 100644
+--- a/linux-headers/asm-x86/kvm.h
++++ b/linux-headers/asm-x86/kvm.h
+@@ -7,6 +7,8 @@
+  *
+  */
+ 
++#include <linux/const.h>
++#include <linux/bits.h>
+ #include <linux/types.h>
+ #include <linux/ioctl.h>
+ #include <linux/stddef.h>
+@@ -40,7 +42,6 @@
+ #define __KVM_HAVE_IRQ_LINE
+ #define __KVM_HAVE_MSI
+ #define __KVM_HAVE_USER_NMI
+-#define __KVM_HAVE_GUEST_DEBUG
+ #define __KVM_HAVE_MSIX
+ #define __KVM_HAVE_MCE
+ #define __KVM_HAVE_PIT_STATE2
+@@ -49,7 +50,6 @@
+ #define __KVM_HAVE_DEBUGREGS
+ #define __KVM_HAVE_XSAVE
+ #define __KVM_HAVE_XCRS
+-#define __KVM_HAVE_READONLY_MEM
+ 
+ /* Architectural interrupt line count. */
+ #define KVM_NR_INTERRUPTS 256
+@@ -455,8 +455,13 @@ struct kvm_sync_regs {
+ 
+ #define KVM_STATE_VMX_PREEMPTION_TIMER_DEADLINE	0x00000001
+ 
+-/* attributes for system fd (group 0) */
+-#define KVM_X86_XCOMP_GUEST_SUPP	0
++/* vendor-independent attributes for system fd (group 0) */
++#define KVM_X86_GRP_SYSTEM		0
++#  define KVM_X86_XCOMP_GUEST_SUPP	0
++
++/* vendor-specific groups and attributes for system fd */
++#define KVM_X86_GRP_SEV			1
++#  define KVM_X86_SEV_VMSA_FEATURES	0
+ 
+ struct kvm_vmx_nested_state_data {
+ 	__u8 vmcs12[KVM_STATE_NESTED_VMX_VMCS_SIZE];
+@@ -524,9 +529,310 @@ struct kvm_pmu_event_filter {
+ #define KVM_PMU_EVENT_ALLOW 0
+ #define KVM_PMU_EVENT_DENY 1
+ 
+-#define KVM_PMU_EVENT_FLAG_MASKED_EVENTS BIT(0)
++#define KVM_PMU_EVENT_FLAG_MASKED_EVENTS _BITUL(0)
+ #define KVM_PMU_EVENT_FLAGS_VALID_MASK (KVM_PMU_EVENT_FLAG_MASKED_EVENTS)
+ 
++/* for KVM_CAP_MCE */
++struct kvm_x86_mce {
++	__u64 status;
++	__u64 addr;
++	__u64 misc;
++	__u64 mcg_status;
++	__u8 bank;
++	__u8 pad1[7];
++	__u64 pad2[3];
++};
++
++/* for KVM_CAP_XEN_HVM */
++#define KVM_XEN_HVM_CONFIG_HYPERCALL_MSR	(1 << 0)
++#define KVM_XEN_HVM_CONFIG_INTERCEPT_HCALL	(1 << 1)
++#define KVM_XEN_HVM_CONFIG_SHARED_INFO		(1 << 2)
++#define KVM_XEN_HVM_CONFIG_RUNSTATE		(1 << 3)
++#define KVM_XEN_HVM_CONFIG_EVTCHN_2LEVEL	(1 << 4)
++#define KVM_XEN_HVM_CONFIG_EVTCHN_SEND		(1 << 5)
++#define KVM_XEN_HVM_CONFIG_RUNSTATE_UPDATE_FLAG	(1 << 6)
++#define KVM_XEN_HVM_CONFIG_PVCLOCK_TSC_UNSTABLE	(1 << 7)
++#define KVM_XEN_HVM_CONFIG_SHARED_INFO_HVA	(1 << 8)
++
++struct kvm_xen_hvm_config {
++	__u32 flags;
++	__u32 msr;
++	__u64 blob_addr_32;
++	__u64 blob_addr_64;
++	__u8 blob_size_32;
++	__u8 blob_size_64;
++	__u8 pad2[30];
++};
++
++struct kvm_xen_hvm_attr {
++	__u16 type;
++	__u16 pad[3];
++	union {
++		__u8 long_mode;
++		__u8 vector;
++		__u8 runstate_update_flag;
++		union {
++			__u64 gfn;
++#define KVM_XEN_INVALID_GFN ((__u64)-1)
++			__u64 hva;
++		} shared_info;
++		struct {
++			__u32 send_port;
++			__u32 type; /* EVTCHNSTAT_ipi / EVTCHNSTAT_interdomain */
++			__u32 flags;
++#define KVM_XEN_EVTCHN_DEASSIGN		(1 << 0)
++#define KVM_XEN_EVTCHN_UPDATE		(1 << 1)
++#define KVM_XEN_EVTCHN_RESET		(1 << 2)
++			/*
++			 * Events sent by the guest are either looped back to
++			 * the guest itself (potentially on a different port#)
++			 * or signalled via an eventfd.
++			 */
++			union {
++				struct {
++					__u32 port;
++					__u32 vcpu;
++					__u32 priority;
++				} port;
++				struct {
++					__u32 port; /* Zero for eventfd */
++					__s32 fd;
++				} eventfd;
++				__u32 padding[4];
++			} deliver;
++		} evtchn;
++		__u32 xen_version;
++		__u64 pad[8];
++	} u;
++};
++
++
++/* Available with KVM_CAP_XEN_HVM / KVM_XEN_HVM_CONFIG_SHARED_INFO */
++#define KVM_XEN_ATTR_TYPE_LONG_MODE		0x0
++#define KVM_XEN_ATTR_TYPE_SHARED_INFO		0x1
++#define KVM_XEN_ATTR_TYPE_UPCALL_VECTOR		0x2
++/* Available with KVM_CAP_XEN_HVM / KVM_XEN_HVM_CONFIG_EVTCHN_SEND */
++#define KVM_XEN_ATTR_TYPE_EVTCHN		0x3
++#define KVM_XEN_ATTR_TYPE_XEN_VERSION		0x4
++/* Available with KVM_CAP_XEN_HVM / KVM_XEN_HVM_CONFIG_RUNSTATE_UPDATE_FLAG */
++#define KVM_XEN_ATTR_TYPE_RUNSTATE_UPDATE_FLAG	0x5
++/* Available with KVM_CAP_XEN_HVM / KVM_XEN_HVM_CONFIG_SHARED_INFO_HVA */
++#define KVM_XEN_ATTR_TYPE_SHARED_INFO_HVA	0x6
++
++struct kvm_xen_vcpu_attr {
++	__u16 type;
++	__u16 pad[3];
++	union {
++		__u64 gpa;
++#define KVM_XEN_INVALID_GPA ((__u64)-1)
++		__u64 hva;
++		__u64 pad[8];
++		struct {
++			__u64 state;
++			__u64 state_entry_time;
++			__u64 time_running;
++			__u64 time_runnable;
++			__u64 time_blocked;
++			__u64 time_offline;
++		} runstate;
++		__u32 vcpu_id;
++		struct {
++			__u32 port;
++			__u32 priority;
++			__u64 expires_ns;
++		} timer;
++		__u8 vector;
++	} u;
++};
++
++/* Available with KVM_CAP_XEN_HVM / KVM_XEN_HVM_CONFIG_SHARED_INFO */
++#define KVM_XEN_VCPU_ATTR_TYPE_VCPU_INFO	0x0
++#define KVM_XEN_VCPU_ATTR_TYPE_VCPU_TIME_INFO	0x1
++#define KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_ADDR	0x2
++#define KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_CURRENT	0x3
++#define KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_DATA	0x4
++#define KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_ADJUST	0x5
++/* Available with KVM_CAP_XEN_HVM / KVM_XEN_HVM_CONFIG_EVTCHN_SEND */
++#define KVM_XEN_VCPU_ATTR_TYPE_VCPU_ID		0x6
++#define KVM_XEN_VCPU_ATTR_TYPE_TIMER		0x7
++#define KVM_XEN_VCPU_ATTR_TYPE_UPCALL_VECTOR	0x8
++/* Available with KVM_CAP_XEN_HVM / KVM_XEN_HVM_CONFIG_SHARED_INFO_HVA */
++#define KVM_XEN_VCPU_ATTR_TYPE_VCPU_INFO_HVA	0x9
++
++/* Secure Encrypted Virtualization command */
++enum sev_cmd_id {
++	/* Guest initialization commands */
++	KVM_SEV_INIT = 0,
++	KVM_SEV_ES_INIT,
++	/* Guest launch commands */
++	KVM_SEV_LAUNCH_START,
++	KVM_SEV_LAUNCH_UPDATE_DATA,
++	KVM_SEV_LAUNCH_UPDATE_VMSA,
++	KVM_SEV_LAUNCH_SECRET,
++	KVM_SEV_LAUNCH_MEASURE,
++	KVM_SEV_LAUNCH_FINISH,
++	/* Guest migration commands (outgoing) */
++	KVM_SEV_SEND_START,
++	KVM_SEV_SEND_UPDATE_DATA,
++	KVM_SEV_SEND_UPDATE_VMSA,
++	KVM_SEV_SEND_FINISH,
++	/* Guest migration commands (incoming) */
++	KVM_SEV_RECEIVE_START,
++	KVM_SEV_RECEIVE_UPDATE_DATA,
++	KVM_SEV_RECEIVE_UPDATE_VMSA,
++	KVM_SEV_RECEIVE_FINISH,
++	/* Guest status and debug commands */
++	KVM_SEV_GUEST_STATUS,
++	KVM_SEV_DBG_DECRYPT,
++	KVM_SEV_DBG_ENCRYPT,
++	/* Guest certificates commands */
++	KVM_SEV_CERT_EXPORT,
++	/* Attestation report */
++	KVM_SEV_GET_ATTESTATION_REPORT,
++	/* Guest Migration Extension */
++	KVM_SEV_SEND_CANCEL,
++
++	/* Second time is the charm; improved versions of the above ioctls.  */
++	KVM_SEV_INIT2,
++
++	KVM_SEV_NR_MAX,
++};
++
++struct kvm_sev_cmd {
++	__u32 id;
++	__u32 pad0;
++	__u64 data;
++	__u32 error;
++	__u32 sev_fd;
++};
++
++struct kvm_sev_init {
++	__u64 vmsa_features;
++	__u32 flags;
++	__u32 pad[9];
++};
++
++struct kvm_sev_launch_start {
++	__u32 handle;
++	__u32 policy;
++	__u64 dh_uaddr;
++	__u32 dh_len;
++	__u32 pad0;
++	__u64 session_uaddr;
++	__u32 session_len;
++	__u32 pad1;
++};
++
++struct kvm_sev_launch_update_data {
++	__u64 uaddr;
++	__u32 len;
++	__u32 pad0;
++};
++
++
++struct kvm_sev_launch_secret {
++	__u64 hdr_uaddr;
++	__u32 hdr_len;
++	__u32 pad0;
++	__u64 guest_uaddr;
++	__u32 guest_len;
++	__u32 pad1;
++	__u64 trans_uaddr;
++	__u32 trans_len;
++	__u32 pad2;
++};
++
++struct kvm_sev_launch_measure {
++	__u64 uaddr;
++	__u32 len;
++	__u32 pad0;
++};
++
++struct kvm_sev_guest_status {
++	__u32 handle;
++	__u32 policy;
++	__u32 state;
++};
++
++struct kvm_sev_dbg {
++	__u64 src_uaddr;
++	__u64 dst_uaddr;
++	__u32 len;
++	__u32 pad0;
++};
++
++struct kvm_sev_attestation_report {
++	__u8 mnonce[16];
++	__u64 uaddr;
++	__u32 len;
++	__u32 pad0;
++};
++
++struct kvm_sev_send_start {
++	__u32 policy;
++	__u32 pad0;
++	__u64 pdh_cert_uaddr;
++	__u32 pdh_cert_len;
++	__u32 pad1;
++	__u64 plat_certs_uaddr;
++	__u32 plat_certs_len;
++	__u32 pad2;
++	__u64 amd_certs_uaddr;
++	__u32 amd_certs_len;
++	__u32 pad3;
++	__u64 session_uaddr;
++	__u32 session_len;
++	__u32 pad4;
++};
++
++struct kvm_sev_send_update_data {
++	__u64 hdr_uaddr;
++	__u32 hdr_len;
++	__u32 pad0;
++	__u64 guest_uaddr;
++	__u32 guest_len;
++	__u32 pad1;
++	__u64 trans_uaddr;
++	__u32 trans_len;
++	__u32 pad2;
++};
++
++struct kvm_sev_receive_start {
++	__u32 handle;
++	__u32 policy;
++	__u64 pdh_uaddr;
++	__u32 pdh_len;
++	__u32 pad0;
++	__u64 session_uaddr;
++	__u32 session_len;
++	__u32 pad1;
++};
++
++struct kvm_sev_receive_update_data {
++	__u64 hdr_uaddr;
++	__u32 hdr_len;
++	__u32 pad0;
++	__u64 guest_uaddr;
++	__u32 guest_len;
++	__u32 pad1;
++	__u64 trans_uaddr;
++	__u32 trans_len;
++	__u32 pad2;
++};
++
++#define KVM_X2APIC_API_USE_32BIT_IDS            (1ULL << 0)
++#define KVM_X2APIC_API_DISABLE_BROADCAST_QUIRK  (1ULL << 1)
++
++struct kvm_hyperv_eventfd {
++	__u32 conn_id;
++	__s32 fd;
++	__u32 flags;
++	__u32 padding[3];
++};
++
++#define KVM_HYPERV_CONN_ID_MASK		0x00ffffff
++#define KVM_HYPERV_EVENTFD_DEASSIGN	(1 << 0)
++
+ /*
+  * Masked event layout.
+  * Bits   Description
+@@ -547,10 +853,10 @@ struct kvm_pmu_event_filter {
+ 	((__u64)(!!(exclude)) << 55))
+ 
+ #define KVM_PMU_MASKED_ENTRY_EVENT_SELECT \
+-	(GENMASK_ULL(7, 0) | GENMASK_ULL(35, 32))
+-#define KVM_PMU_MASKED_ENTRY_UMASK_MASK		(GENMASK_ULL(63, 56))
+-#define KVM_PMU_MASKED_ENTRY_UMASK_MATCH	(GENMASK_ULL(15, 8))
+-#define KVM_PMU_MASKED_ENTRY_EXCLUDE		(BIT_ULL(55))
++	(__GENMASK_ULL(7, 0) | __GENMASK_ULL(35, 32))
++#define KVM_PMU_MASKED_ENTRY_UMASK_MASK		(__GENMASK_ULL(63, 56))
++#define KVM_PMU_MASKED_ENTRY_UMASK_MATCH	(__GENMASK_ULL(15, 8))
++#define KVM_PMU_MASKED_ENTRY_EXCLUDE		(_BITULL(55))
+ #define KVM_PMU_MASKED_ENTRY_UMASK_MASK_SHIFT	(56)
+ 
+ /* for KVM_{GET,SET,HAS}_DEVICE_ATTR */
+@@ -558,9 +864,11 @@ struct kvm_pmu_event_filter {
+ #define   KVM_VCPU_TSC_OFFSET 0 /* attribute for the TSC offset */
+ 
+ /* x86-specific KVM_EXIT_HYPERCALL flags. */
+-#define KVM_EXIT_HYPERCALL_LONG_MODE	BIT(0)
++#define KVM_EXIT_HYPERCALL_LONG_MODE	_BITULL(0)
+ 
+ #define KVM_X86_DEFAULT_VM	0
+ #define KVM_X86_SW_PROTECTED_VM	1
++#define KVM_X86_SEV_VM		2
++#define KVM_X86_SEV_ES_VM	3
+ 
+ #endif /* _ASM_X86_KVM_H */
+diff --git a/linux-headers/linux/bits.h b/linux-headers/linux/bits.h
+new file mode 100644
+index 0000000000..d9897771be
+--- /dev/null
++++ b/linux-headers/linux/bits.h
+@@ -0,0 +1,15 @@
++/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
++/* bits.h: Macros for dealing with bitmasks.  */
++
++#ifndef _LINUX_BITS_H
++#define _LINUX_BITS_H
++
++#define __GENMASK(h, l) \
++        (((~_UL(0)) - (_UL(1) << (l)) + 1) & \
++         (~_UL(0) >> (__BITS_PER_LONG - 1 - (h))))
++
++#define __GENMASK_ULL(h, l) \
++        (((~_ULL(0)) - (_ULL(1) << (l)) + 1) & \
++         (~_ULL(0) >> (__BITS_PER_LONG_LONG - 1 - (h))))
++
++#endif /* _LINUX_BITS_H */
+diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h
+index 17839229b2..038731cdef 100644
+--- a/linux-headers/linux/kvm.h
++++ b/linux-headers/linux/kvm.h
+@@ -16,6 +16,11 @@
+ 
+ #define KVM_API_VERSION 12
+ 
++/*
++ * Backwards-compatible definitions.
++ */
++#define __KVM_HAVE_GUEST_DEBUG
++
+ /* for KVM_SET_USER_MEMORY_REGION */
+ struct kvm_userspace_memory_region {
+ 	__u32 slot;
+@@ -85,43 +90,6 @@ struct kvm_pit_config {
+ 
+ #define KVM_PIT_SPEAKER_DUMMY     1
+ 
+-struct kvm_s390_skeys {
+-	__u64 start_gfn;
+-	__u64 count;
+-	__u64 skeydata_addr;
+-	__u32 flags;
+-	__u32 reserved[9];
+-};
+-
+-#define KVM_S390_CMMA_PEEK (1 << 0)
+-
+-/**
+- * kvm_s390_cmma_log - Used for CMMA migration.
+- *
+- * Used both for input and output.
+- *
+- * @start_gfn: Guest page number to start from.
+- * @count: Size of the result buffer.
+- * @flags: Control operation mode via KVM_S390_CMMA_* flags
+- * @remaining: Used with KVM_S390_GET_CMMA_BITS. Indicates how many dirty
+- *             pages are still remaining.
+- * @mask: Used with KVM_S390_SET_CMMA_BITS. Bitmap of bits to actually set
+- *        in the PGSTE.
+- * @values: Pointer to the values buffer.
+- *
+- * Used in KVM_S390_{G,S}ET_CMMA_BITS ioctls.
+- */
+-struct kvm_s390_cmma_log {
+-	__u64 start_gfn;
+-	__u32 count;
+-	__u32 flags;
+-	union {
+-		__u64 remaining;
+-		__u64 mask;
+-	};
+-	__u64 values;
+-};
+-
+ struct kvm_hyperv_exit {
+ #define KVM_EXIT_HYPERV_SYNIC          1
+ #define KVM_EXIT_HYPERV_HCALL          2
+@@ -313,11 +281,6 @@ struct kvm_run {
+ 			__u32 ipb;
+ 		} s390_sieic;
+ 		/* KVM_EXIT_S390_RESET */
+-#define KVM_S390_RESET_POR       1
+-#define KVM_S390_RESET_CLEAR     2
+-#define KVM_S390_RESET_SUBSYSTEM 4
+-#define KVM_S390_RESET_CPU_INIT  8
+-#define KVM_S390_RESET_IPL       16
+ 		__u64 s390_reset_flags;
+ 		/* KVM_EXIT_S390_UCONTROL */
+ 		struct {
+@@ -532,43 +495,6 @@ struct kvm_translation {
+ 	__u8  pad[5];
+ };
+ 
+-/* for KVM_S390_MEM_OP */
+-struct kvm_s390_mem_op {
+-	/* in */
+-	__u64 gaddr;		/* the guest address */
+-	__u64 flags;		/* flags */
+-	__u32 size;		/* amount of bytes */
+-	__u32 op;		/* type of operation */
+-	__u64 buf;		/* buffer in userspace */
+-	union {
+-		struct {
+-			__u8 ar;	/* the access register number */
+-			__u8 key;	/* access key, ignored if flag unset */
+-			__u8 pad1[6];	/* ignored */
+-			__u64 old_addr;	/* ignored if cmpxchg flag unset */
+-		};
+-		__u32 sida_offset; /* offset into the sida */
+-		__u8 reserved[32]; /* ignored */
+-	};
+-};
+-/* types for kvm_s390_mem_op->op */
+-#define KVM_S390_MEMOP_LOGICAL_READ	0
+-#define KVM_S390_MEMOP_LOGICAL_WRITE	1
+-#define KVM_S390_MEMOP_SIDA_READ	2
+-#define KVM_S390_MEMOP_SIDA_WRITE	3
+-#define KVM_S390_MEMOP_ABSOLUTE_READ	4
+-#define KVM_S390_MEMOP_ABSOLUTE_WRITE	5
+-#define KVM_S390_MEMOP_ABSOLUTE_CMPXCHG	6
+-
+-/* flags for kvm_s390_mem_op->flags */
+-#define KVM_S390_MEMOP_F_CHECK_ONLY		(1ULL << 0)
+-#define KVM_S390_MEMOP_F_INJECT_EXCEPTION	(1ULL << 1)
+-#define KVM_S390_MEMOP_F_SKEY_PROTECTION	(1ULL << 2)
+-
+-/* flags specifying extension support via KVM_CAP_S390_MEM_OP_EXTENSION */
+-#define KVM_S390_MEMOP_EXTENSION_CAP_BASE	(1 << 0)
+-#define KVM_S390_MEMOP_EXTENSION_CAP_CMPXCHG	(1 << 1)
+-
+ /* for KVM_INTERRUPT */
+ struct kvm_interrupt {
+ 	/* in */
+@@ -633,124 +559,6 @@ struct kvm_mp_state {
+ 	__u32 mp_state;
+ };
+ 
+-struct kvm_s390_psw {
+-	__u64 mask;
+-	__u64 addr;
+-};
+-
+-/* valid values for type in kvm_s390_interrupt */
+-#define KVM_S390_SIGP_STOP		0xfffe0000u
+-#define KVM_S390_PROGRAM_INT		0xfffe0001u
+-#define KVM_S390_SIGP_SET_PREFIX	0xfffe0002u
+-#define KVM_S390_RESTART		0xfffe0003u
+-#define KVM_S390_INT_PFAULT_INIT	0xfffe0004u
+-#define KVM_S390_INT_PFAULT_DONE	0xfffe0005u
+-#define KVM_S390_MCHK			0xfffe1000u
+-#define KVM_S390_INT_CLOCK_COMP		0xffff1004u
+-#define KVM_S390_INT_CPU_TIMER		0xffff1005u
+-#define KVM_S390_INT_VIRTIO		0xffff2603u
+-#define KVM_S390_INT_SERVICE		0xffff2401u
+-#define KVM_S390_INT_EMERGENCY		0xffff1201u
+-#define KVM_S390_INT_EXTERNAL_CALL	0xffff1202u
+-/* Anything below 0xfffe0000u is taken by INT_IO */
+-#define KVM_S390_INT_IO(ai,cssid,ssid,schid)   \
+-	(((schid)) |			       \
+-	 ((ssid) << 16) |		       \
+-	 ((cssid) << 18) |		       \
+-	 ((ai) << 26))
+-#define KVM_S390_INT_IO_MIN		0x00000000u
+-#define KVM_S390_INT_IO_MAX		0xfffdffffu
+-#define KVM_S390_INT_IO_AI_MASK		0x04000000u
+-
+-
+-struct kvm_s390_interrupt {
+-	__u32 type;
+-	__u32 parm;
+-	__u64 parm64;
+-};
+-
+-struct kvm_s390_io_info {
+-	__u16 subchannel_id;
+-	__u16 subchannel_nr;
+-	__u32 io_int_parm;
+-	__u32 io_int_word;
+-};
+-
+-struct kvm_s390_ext_info {
+-	__u32 ext_params;
+-	__u32 pad;
+-	__u64 ext_params2;
+-};
+-
+-struct kvm_s390_pgm_info {
+-	__u64 trans_exc_code;
+-	__u64 mon_code;
+-	__u64 per_address;
+-	__u32 data_exc_code;
+-	__u16 code;
+-	__u16 mon_class_nr;
+-	__u8 per_code;
+-	__u8 per_atmid;
+-	__u8 exc_access_id;
+-	__u8 per_access_id;
+-	__u8 op_access_id;
+-#define KVM_S390_PGM_FLAGS_ILC_VALID	0x01
+-#define KVM_S390_PGM_FLAGS_ILC_0	0x02
+-#define KVM_S390_PGM_FLAGS_ILC_1	0x04
+-#define KVM_S390_PGM_FLAGS_ILC_MASK	0x06
+-#define KVM_S390_PGM_FLAGS_NO_REWIND	0x08
+-	__u8 flags;
+-	__u8 pad[2];
+-};
+-
+-struct kvm_s390_prefix_info {
+-	__u32 address;
+-};
+-
+-struct kvm_s390_extcall_info {
+-	__u16 code;
+-};
+-
+-struct kvm_s390_emerg_info {
+-	__u16 code;
+-};
+-
+-#define KVM_S390_STOP_FLAG_STORE_STATUS	0x01
+-struct kvm_s390_stop_info {
+-	__u32 flags;
+-};
+-
+-struct kvm_s390_mchk_info {
+-	__u64 cr14;
+-	__u64 mcic;
+-	__u64 failing_storage_address;
+-	__u32 ext_damage_code;
+-	__u32 pad;
+-	__u8 fixed_logout[16];
+-};
+-
+-struct kvm_s390_irq {
+-	__u64 type;
+-	union {
+-		struct kvm_s390_io_info io;
+-		struct kvm_s390_ext_info ext;
+-		struct kvm_s390_pgm_info pgm;
+-		struct kvm_s390_emerg_info emerg;
+-		struct kvm_s390_extcall_info extcall;
+-		struct kvm_s390_prefix_info prefix;
+-		struct kvm_s390_stop_info stop;
+-		struct kvm_s390_mchk_info mchk;
+-		char reserved[64];
+-	} u;
+-};
+-
+-struct kvm_s390_irq_state {
+-	__u64 buf;
+-	__u32 flags;        /* will stay unused for compatibility reasons */
+-	__u32 len;
+-	__u32 reserved[4];  /* will stay unused for compatibility reasons */
+-};
+-
+ /* for KVM_SET_GUEST_DEBUG */
+ 
+ #define KVM_GUESTDBG_ENABLE		0x00000001
+@@ -806,50 +614,6 @@ struct kvm_enable_cap {
+ 	__u8  pad[64];
+ };
+ 
+-/* for KVM_PPC_GET_PVINFO */
+-
+-#define KVM_PPC_PVINFO_FLAGS_EV_IDLE   (1<<0)
+-
+-struct kvm_ppc_pvinfo {
+-	/* out */
+-	__u32 flags;
+-	__u32 hcall[4];
+-	__u8  pad[108];
+-};
+-
+-/* for KVM_PPC_GET_SMMU_INFO */
+-#define KVM_PPC_PAGE_SIZES_MAX_SZ	8
+-
+-struct kvm_ppc_one_page_size {
+-	__u32 page_shift;	/* Page shift (or 0) */
+-	__u32 pte_enc;		/* Encoding in the HPTE (>>12) */
+-};
+-
+-struct kvm_ppc_one_seg_page_size {
+-	__u32 page_shift;	/* Base page shift of segment (or 0) */
+-	__u32 slb_enc;		/* SLB encoding for BookS */
+-	struct kvm_ppc_one_page_size enc[KVM_PPC_PAGE_SIZES_MAX_SZ];
+-};
+-
+-#define KVM_PPC_PAGE_SIZES_REAL		0x00000001
+-#define KVM_PPC_1T_SEGMENTS		0x00000002
+-#define KVM_PPC_NO_HASH			0x00000004
+-
+-struct kvm_ppc_smmu_info {
+-	__u64 flags;
+-	__u32 slb_size;
+-	__u16 data_keys;	/* # storage keys supported for data */
+-	__u16 instr_keys;	/* # storage keys supported for instructions */
+-	struct kvm_ppc_one_seg_page_size sps[KVM_PPC_PAGE_SIZES_MAX_SZ];
+-};
+-
+-/* for KVM_PPC_RESIZE_HPT_{PREPARE,COMMIT} */
+-struct kvm_ppc_resize_hpt {
+-	__u64 flags;
+-	__u32 shift;
+-	__u32 pad;
+-};
+-
+ #define KVMIO 0xAE
+ 
+ /* machine type bits, to be used as argument to KVM_CREATE_VM */
+@@ -919,9 +683,7 @@ struct kvm_ppc_resize_hpt {
+ /* Bug in KVM_SET_USER_MEMORY_REGION fixed: */
+ #define KVM_CAP_DESTROY_MEMORY_REGION_WORKS 21
+ #define KVM_CAP_USER_NMI 22
+-#ifdef __KVM_HAVE_GUEST_DEBUG
+ #define KVM_CAP_SET_GUEST_DEBUG 23
+-#endif
+ #ifdef __KVM_HAVE_PIT
+ #define KVM_CAP_REINJECT_CONTROL 24
+ #endif
+@@ -1152,8 +914,6 @@ struct kvm_ppc_resize_hpt {
+ #define KVM_CAP_GUEST_MEMFD 234
+ #define KVM_CAP_VM_TYPES 235
+ 
+-#ifdef KVM_CAP_IRQ_ROUTING
+-
+ struct kvm_irq_routing_irqchip {
+ 	__u32 irqchip;
+ 	__u32 pin;
+@@ -1218,42 +978,6 @@ struct kvm_irq_routing {
+ 	struct kvm_irq_routing_entry entries[];
+ };
+ 
+-#endif
+-
+-#ifdef KVM_CAP_MCE
+-/* x86 MCE */
+-struct kvm_x86_mce {
+-	__u64 status;
+-	__u64 addr;
+-	__u64 misc;
+-	__u64 mcg_status;
+-	__u8 bank;
+-	__u8 pad1[7];
+-	__u64 pad2[3];
+-};
+-#endif
+-
+-#ifdef KVM_CAP_XEN_HVM
+-#define KVM_XEN_HVM_CONFIG_HYPERCALL_MSR	(1 << 0)
+-#define KVM_XEN_HVM_CONFIG_INTERCEPT_HCALL	(1 << 1)
+-#define KVM_XEN_HVM_CONFIG_SHARED_INFO		(1 << 2)
+-#define KVM_XEN_HVM_CONFIG_RUNSTATE		(1 << 3)
+-#define KVM_XEN_HVM_CONFIG_EVTCHN_2LEVEL	(1 << 4)
+-#define KVM_XEN_HVM_CONFIG_EVTCHN_SEND		(1 << 5)
+-#define KVM_XEN_HVM_CONFIG_RUNSTATE_UPDATE_FLAG	(1 << 6)
+-#define KVM_XEN_HVM_CONFIG_PVCLOCK_TSC_UNSTABLE	(1 << 7)
+-
+-struct kvm_xen_hvm_config {
+-	__u32 flags;
+-	__u32 msr;
+-	__u64 blob_addr_32;
+-	__u64 blob_addr_64;
+-	__u8 blob_size_32;
+-	__u8 blob_size_64;
+-	__u8 pad2[30];
+-};
+-#endif
+-
+ #define KVM_IRQFD_FLAG_DEASSIGN (1 << 0)
+ /*
+  * Available with KVM_CAP_IRQFD_RESAMPLE
+@@ -1438,11 +1162,6 @@ struct kvm_vfio_spapr_tce {
+ 					 struct kvm_userspace_memory_region2)
+ 
+ /* enable ucontrol for s390 */
+-struct kvm_s390_ucas_mapping {
+-	__u64 user_addr;
+-	__u64 vcpu_addr;
+-	__u64 length;
+-};
+ #define KVM_S390_UCAS_MAP        _IOW(KVMIO, 0x50, struct kvm_s390_ucas_mapping)
+ #define KVM_S390_UCAS_UNMAP      _IOW(KVMIO, 0x51, struct kvm_s390_ucas_mapping)
+ #define KVM_S390_VCPU_FAULT	 _IOW(KVMIO, 0x52, unsigned long)
+@@ -1637,89 +1356,6 @@ struct kvm_enc_region {
+ #define KVM_S390_NORMAL_RESET	_IO(KVMIO,   0xc3)
+ #define KVM_S390_CLEAR_RESET	_IO(KVMIO,   0xc4)
+ 
+-struct kvm_s390_pv_sec_parm {
+-	__u64 origin;
+-	__u64 length;
+-};
+-
+-struct kvm_s390_pv_unp {
+-	__u64 addr;
+-	__u64 size;
+-	__u64 tweak;
+-};
+-
+-enum pv_cmd_dmp_id {
+-	KVM_PV_DUMP_INIT,
+-	KVM_PV_DUMP_CONFIG_STOR_STATE,
+-	KVM_PV_DUMP_COMPLETE,
+-	KVM_PV_DUMP_CPU,
+-};
+-
+-struct kvm_s390_pv_dmp {
+-	__u64 subcmd;
+-	__u64 buff_addr;
+-	__u64 buff_len;
+-	__u64 gaddr;		/* For dump storage state */
+-	__u64 reserved[4];
+-};
+-
+-enum pv_cmd_info_id {
+-	KVM_PV_INFO_VM,
+-	KVM_PV_INFO_DUMP,
+-};
+-
+-struct kvm_s390_pv_info_dump {
+-	__u64 dump_cpu_buffer_len;
+-	__u64 dump_config_mem_buffer_per_1m;
+-	__u64 dump_config_finalize_len;
+-};
+-
+-struct kvm_s390_pv_info_vm {
+-	__u64 inst_calls_list[4];
+-	__u64 max_cpus;
+-	__u64 max_guests;
+-	__u64 max_guest_addr;
+-	__u64 feature_indication;
+-};
+-
+-struct kvm_s390_pv_info_header {
+-	__u32 id;
+-	__u32 len_max;
+-	__u32 len_written;
+-	__u32 reserved;
+-};
+-
+-struct kvm_s390_pv_info {
+-	struct kvm_s390_pv_info_header header;
+-	union {
+-		struct kvm_s390_pv_info_dump dump;
+-		struct kvm_s390_pv_info_vm vm;
+-	};
+-};
+-
+-enum pv_cmd_id {
+-	KVM_PV_ENABLE,
+-	KVM_PV_DISABLE,
+-	KVM_PV_SET_SEC_PARMS,
+-	KVM_PV_UNPACK,
+-	KVM_PV_VERIFY,
+-	KVM_PV_PREP_RESET,
+-	KVM_PV_UNSHARE_ALL,
+-	KVM_PV_INFO,
+-	KVM_PV_DUMP,
+-	KVM_PV_ASYNC_CLEANUP_PREPARE,
+-	KVM_PV_ASYNC_CLEANUP_PERFORM,
+-};
+-
+-struct kvm_pv_cmd {
+-	__u32 cmd;	/* Command to be executed */
+-	__u16 rc;	/* Ultravisor return code */
+-	__u16 rrc;	/* Ultravisor return reason code */
+-	__u64 data;	/* Data or address */
+-	__u32 flags;    /* flags for future extensions. Must be 0 for now */
+-	__u32 reserved[3];
+-};
+-
+ /* Available with KVM_CAP_S390_PROTECTED */
+ #define KVM_S390_PV_COMMAND		_IOWR(KVMIO, 0xc5, struct kvm_pv_cmd)
+ 
+@@ -1733,58 +1369,6 @@ struct kvm_pv_cmd {
+ #define KVM_XEN_HVM_GET_ATTR	_IOWR(KVMIO, 0xc8, struct kvm_xen_hvm_attr)
+ #define KVM_XEN_HVM_SET_ATTR	_IOW(KVMIO,  0xc9, struct kvm_xen_hvm_attr)
+ 
+-struct kvm_xen_hvm_attr {
+-	__u16 type;
+-	__u16 pad[3];
+-	union {
+-		__u8 long_mode;
+-		__u8 vector;
+-		__u8 runstate_update_flag;
+-		struct {
+-			__u64 gfn;
+-#define KVM_XEN_INVALID_GFN ((__u64)-1)
+-		} shared_info;
+-		struct {
+-			__u32 send_port;
+-			__u32 type; /* EVTCHNSTAT_ipi / EVTCHNSTAT_interdomain */
+-			__u32 flags;
+-#define KVM_XEN_EVTCHN_DEASSIGN		(1 << 0)
+-#define KVM_XEN_EVTCHN_UPDATE		(1 << 1)
+-#define KVM_XEN_EVTCHN_RESET		(1 << 2)
+-			/*
+-			 * Events sent by the guest are either looped back to
+-			 * the guest itself (potentially on a different port#)
+-			 * or signalled via an eventfd.
+-			 */
+-			union {
+-				struct {
+-					__u32 port;
+-					__u32 vcpu;
+-					__u32 priority;
+-				} port;
+-				struct {
+-					__u32 port; /* Zero for eventfd */
+-					__s32 fd;
+-				} eventfd;
+-				__u32 padding[4];
+-			} deliver;
+-		} evtchn;
+-		__u32 xen_version;
+-		__u64 pad[8];
+-	} u;
+-};
+-
+-
+-/* Available with KVM_CAP_XEN_HVM / KVM_XEN_HVM_CONFIG_SHARED_INFO */
+-#define KVM_XEN_ATTR_TYPE_LONG_MODE		0x0
+-#define KVM_XEN_ATTR_TYPE_SHARED_INFO		0x1
+-#define KVM_XEN_ATTR_TYPE_UPCALL_VECTOR		0x2
+-/* Available with KVM_CAP_XEN_HVM / KVM_XEN_HVM_CONFIG_EVTCHN_SEND */
+-#define KVM_XEN_ATTR_TYPE_EVTCHN		0x3
+-#define KVM_XEN_ATTR_TYPE_XEN_VERSION		0x4
+-/* Available with KVM_CAP_XEN_HVM / KVM_XEN_HVM_CONFIG_RUNSTATE_UPDATE_FLAG */
+-#define KVM_XEN_ATTR_TYPE_RUNSTATE_UPDATE_FLAG	0x5
+-
+ /* Per-vCPU Xen attributes */
+ #define KVM_XEN_VCPU_GET_ATTR	_IOWR(KVMIO, 0xca, struct kvm_xen_vcpu_attr)
+ #define KVM_XEN_VCPU_SET_ATTR	_IOW(KVMIO,  0xcb, struct kvm_xen_vcpu_attr)
+@@ -1795,242 +1379,6 @@ struct kvm_xen_hvm_attr {
+ #define KVM_GET_SREGS2             _IOR(KVMIO,  0xcc, struct kvm_sregs2)
+ #define KVM_SET_SREGS2             _IOW(KVMIO,  0xcd, struct kvm_sregs2)
+ 
+-struct kvm_xen_vcpu_attr {
+-	__u16 type;
+-	__u16 pad[3];
+-	union {
+-		__u64 gpa;
+-#define KVM_XEN_INVALID_GPA ((__u64)-1)
+-		__u64 pad[8];
+-		struct {
+-			__u64 state;
+-			__u64 state_entry_time;
+-			__u64 time_running;
+-			__u64 time_runnable;
+-			__u64 time_blocked;
+-			__u64 time_offline;
+-		} runstate;
+-		__u32 vcpu_id;
+-		struct {
+-			__u32 port;
+-			__u32 priority;
+-			__u64 expires_ns;
+-		} timer;
+-		__u8 vector;
+-	} u;
+-};
+-
+-/* Available with KVM_CAP_XEN_HVM / KVM_XEN_HVM_CONFIG_SHARED_INFO */
+-#define KVM_XEN_VCPU_ATTR_TYPE_VCPU_INFO	0x0
+-#define KVM_XEN_VCPU_ATTR_TYPE_VCPU_TIME_INFO	0x1
+-#define KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_ADDR	0x2
+-#define KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_CURRENT	0x3
+-#define KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_DATA	0x4
+-#define KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_ADJUST	0x5
+-/* Available with KVM_CAP_XEN_HVM / KVM_XEN_HVM_CONFIG_EVTCHN_SEND */
+-#define KVM_XEN_VCPU_ATTR_TYPE_VCPU_ID		0x6
+-#define KVM_XEN_VCPU_ATTR_TYPE_TIMER		0x7
+-#define KVM_XEN_VCPU_ATTR_TYPE_UPCALL_VECTOR	0x8
+-
+-/* Secure Encrypted Virtualization command */
+-enum sev_cmd_id {
+-	/* Guest initialization commands */
+-	KVM_SEV_INIT = 0,
+-	KVM_SEV_ES_INIT,
+-	/* Guest launch commands */
+-	KVM_SEV_LAUNCH_START,
+-	KVM_SEV_LAUNCH_UPDATE_DATA,
+-	KVM_SEV_LAUNCH_UPDATE_VMSA,
+-	KVM_SEV_LAUNCH_SECRET,
+-	KVM_SEV_LAUNCH_MEASURE,
+-	KVM_SEV_LAUNCH_FINISH,
+-	/* Guest migration commands (outgoing) */
+-	KVM_SEV_SEND_START,
+-	KVM_SEV_SEND_UPDATE_DATA,
+-	KVM_SEV_SEND_UPDATE_VMSA,
+-	KVM_SEV_SEND_FINISH,
+-	/* Guest migration commands (incoming) */
+-	KVM_SEV_RECEIVE_START,
+-	KVM_SEV_RECEIVE_UPDATE_DATA,
+-	KVM_SEV_RECEIVE_UPDATE_VMSA,
+-	KVM_SEV_RECEIVE_FINISH,
+-	/* Guest status and debug commands */
+-	KVM_SEV_GUEST_STATUS,
+-	KVM_SEV_DBG_DECRYPT,
+-	KVM_SEV_DBG_ENCRYPT,
+-	/* Guest certificates commands */
+-	KVM_SEV_CERT_EXPORT,
+-	/* Attestation report */
+-	KVM_SEV_GET_ATTESTATION_REPORT,
+-	/* Guest Migration Extension */
+-	KVM_SEV_SEND_CANCEL,
+-
+-	KVM_SEV_NR_MAX,
+-};
+-
+-struct kvm_sev_cmd {
+-	__u32 id;
+-	__u64 data;
+-	__u32 error;
+-	__u32 sev_fd;
+-};
+-
+-struct kvm_sev_launch_start {
+-	__u32 handle;
+-	__u32 policy;
+-	__u64 dh_uaddr;
+-	__u32 dh_len;
+-	__u64 session_uaddr;
+-	__u32 session_len;
+-};
+-
+-struct kvm_sev_launch_update_data {
+-	__u64 uaddr;
+-	__u32 len;
+-};
+-
+-
+-struct kvm_sev_launch_secret {
+-	__u64 hdr_uaddr;
+-	__u32 hdr_len;
+-	__u64 guest_uaddr;
+-	__u32 guest_len;
+-	__u64 trans_uaddr;
+-	__u32 trans_len;
+-};
+-
+-struct kvm_sev_launch_measure {
+-	__u64 uaddr;
+-	__u32 len;
+-};
+-
+-struct kvm_sev_guest_status {
+-	__u32 handle;
+-	__u32 policy;
+-	__u32 state;
+-};
+-
+-struct kvm_sev_dbg {
+-	__u64 src_uaddr;
+-	__u64 dst_uaddr;
+-	__u32 len;
+-};
+-
+-struct kvm_sev_attestation_report {
+-	__u8 mnonce[16];
+-	__u64 uaddr;
+-	__u32 len;
+-};
+-
+-struct kvm_sev_send_start {
+-	__u32 policy;
+-	__u64 pdh_cert_uaddr;
+-	__u32 pdh_cert_len;
+-	__u64 plat_certs_uaddr;
+-	__u32 plat_certs_len;
+-	__u64 amd_certs_uaddr;
+-	__u32 amd_certs_len;
+-	__u64 session_uaddr;
+-	__u32 session_len;
+-};
+-
+-struct kvm_sev_send_update_data {
+-	__u64 hdr_uaddr;
+-	__u32 hdr_len;
+-	__u64 guest_uaddr;
+-	__u32 guest_len;
+-	__u64 trans_uaddr;
+-	__u32 trans_len;
+-};
+-
+-struct kvm_sev_receive_start {
+-	__u32 handle;
+-	__u32 policy;
+-	__u64 pdh_uaddr;
+-	__u32 pdh_len;
+-	__u64 session_uaddr;
+-	__u32 session_len;
+-};
+-
+-struct kvm_sev_receive_update_data {
+-	__u64 hdr_uaddr;
+-	__u32 hdr_len;
+-	__u64 guest_uaddr;
+-	__u32 guest_len;
+-	__u64 trans_uaddr;
+-	__u32 trans_len;
+-};
+-
+-#define KVM_DEV_ASSIGN_ENABLE_IOMMU	(1 << 0)
+-#define KVM_DEV_ASSIGN_PCI_2_3		(1 << 1)
+-#define KVM_DEV_ASSIGN_MASK_INTX	(1 << 2)
+-
+-struct kvm_assigned_pci_dev {
+-	__u32 assigned_dev_id;
+-	__u32 busnr;
+-	__u32 devfn;
+-	__u32 flags;
+-	__u32 segnr;
+-	union {
+-		__u32 reserved[11];
+-	};
+-};
+-
+-#define KVM_DEV_IRQ_HOST_INTX    (1 << 0)
+-#define KVM_DEV_IRQ_HOST_MSI     (1 << 1)
+-#define KVM_DEV_IRQ_HOST_MSIX    (1 << 2)
+-
+-#define KVM_DEV_IRQ_GUEST_INTX   (1 << 8)
+-#define KVM_DEV_IRQ_GUEST_MSI    (1 << 9)
+-#define KVM_DEV_IRQ_GUEST_MSIX   (1 << 10)
+-
+-#define KVM_DEV_IRQ_HOST_MASK	 0x00ff
+-#define KVM_DEV_IRQ_GUEST_MASK   0xff00
+-
+-struct kvm_assigned_irq {
+-	__u32 assigned_dev_id;
+-	__u32 host_irq; /* ignored (legacy field) */
+-	__u32 guest_irq;
+-	__u32 flags;
+-	union {
+-		__u32 reserved[12];
+-	};
+-};
+-
+-struct kvm_assigned_msix_nr {
+-	__u32 assigned_dev_id;
+-	__u16 entry_nr;
+-	__u16 padding;
+-};
+-
+-#define KVM_MAX_MSIX_PER_DEV		256
+-struct kvm_assigned_msix_entry {
+-	__u32 assigned_dev_id;
+-	__u32 gsi;
+-	__u16 entry; /* The index of entry in the MSI-X table */
+-	__u16 padding[3];
+-};
+-
+-#define KVM_X2APIC_API_USE_32BIT_IDS            (1ULL << 0)
+-#define KVM_X2APIC_API_DISABLE_BROADCAST_QUIRK  (1ULL << 1)
+-
+-/* Available with KVM_CAP_ARM_USER_IRQ */
+-
+-/* Bits for run->s.regs.device_irq_level */
+-#define KVM_ARM_DEV_EL1_VTIMER		(1 << 0)
+-#define KVM_ARM_DEV_EL1_PTIMER		(1 << 1)
+-#define KVM_ARM_DEV_PMU			(1 << 2)
+-
+-struct kvm_hyperv_eventfd {
+-	__u32 conn_id;
+-	__s32 fd;
+-	__u32 flags;
+-	__u32 padding[3];
+-};
+-
+-#define KVM_HYPERV_CONN_ID_MASK		0x00ffffff
+-#define KVM_HYPERV_EVENTFD_DEASSIGN	(1 << 0)
+-
+ #define KVM_DIRTY_LOG_MANUAL_PROTECT_ENABLE    (1 << 0)
+ #define KVM_DIRTY_LOG_INITIALLY_SET            (1 << 1)
+ 
+@@ -2176,33 +1524,6 @@ struct kvm_stats_desc {
+ /* Available with KVM_CAP_S390_ZPCI_OP */
+ #define KVM_S390_ZPCI_OP         _IOW(KVMIO,  0xd1, struct kvm_s390_zpci_op)
+ 
+-struct kvm_s390_zpci_op {
+-	/* in */
+-	__u32 fh;               /* target device */
+-	__u8  op;               /* operation to perform */
+-	__u8  pad[3];
+-	union {
+-		/* for KVM_S390_ZPCIOP_REG_AEN */
+-		struct {
+-			__u64 ibv;      /* Guest addr of interrupt bit vector */
+-			__u64 sb;       /* Guest addr of summary bit */
+-			__u32 flags;
+-			__u32 noi;      /* Number of interrupts */
+-			__u8 isc;       /* Guest interrupt subclass */
+-			__u8 sbo;       /* Offset of guest summary bit vector */
+-			__u16 pad;
+-		} reg_aen;
+-		__u64 reserved[8];
+-	} u;
+-};
+-
+-/* types for kvm_s390_zpci_op->op */
+-#define KVM_S390_ZPCIOP_REG_AEN                0
+-#define KVM_S390_ZPCIOP_DEREG_AEN      1
+-
+-/* flags for kvm_s390_zpci_op->u.reg_aen.flags */
+-#define KVM_S390_ZPCIOP_REGAEN_HOST    (1 << 0)
+-
+ /* Available with KVM_CAP_MEMORY_ATTRIBUTES */
+ #define KVM_SET_MEMORY_ATTRIBUTES              _IOW(KVMIO,  0xd2, struct kvm_memory_attributes)
+ 
+diff --git a/linux-headers/linux/psp-sev.h b/linux-headers/linux/psp-sev.h
+index bcb21339ee..c3046c6bff 100644
+--- a/linux-headers/linux/psp-sev.h
++++ b/linux-headers/linux/psp-sev.h
+@@ -28,6 +28,9 @@ enum {
+ 	SEV_PEK_CERT_IMPORT,
+ 	SEV_GET_ID,	/* This command is deprecated, use SEV_GET_ID2 */
+ 	SEV_GET_ID2,
++	SNP_PLATFORM_STATUS,
++	SNP_COMMIT,
++	SNP_SET_CONFIG,
+ 
+ 	SEV_MAX,
+ };
+@@ -69,6 +72,12 @@ typedef enum {
+ 	SEV_RET_RESOURCE_LIMIT,
+ 	SEV_RET_SECURE_DATA_INVALID,
+ 	SEV_RET_INVALID_KEY = 0x27,
++	SEV_RET_INVALID_PAGE_SIZE,
++	SEV_RET_INVALID_PAGE_STATE,
++	SEV_RET_INVALID_MDATA_ENTRY,
++	SEV_RET_INVALID_PAGE_OWNER,
++	SEV_RET_INVALID_PAGE_AEAD_OFLOW,
++	SEV_RET_RMP_INIT_REQUIRED,
+ 	SEV_RET_MAX,
+ } sev_ret_code;
+ 
+@@ -155,6 +164,56 @@ struct sev_user_data_get_id2 {
+ 	__u32 length;				/* In/Out */
+ } __attribute__((packed));
+ 
++/**
++ * struct sev_user_data_snp_status - SNP status
++ *
++ * @api_major: API major version
++ * @api_minor: API minor version
++ * @state: current platform state
++ * @is_rmp_initialized: whether RMP is initialized or not
++ * @rsvd: reserved
++ * @build_id: firmware build id for the API version
++ * @mask_chip_id: whether chip id is present in attestation reports or not
++ * @mask_chip_key: whether attestation reports are signed or not
++ * @vlek_en: VLEK (Version Loaded Endorsement Key) hashstick is loaded
++ * @rsvd1: reserved
++ * @guest_count: the number of guest currently managed by the firmware
++ * @current_tcb_version: current TCB version
++ * @reported_tcb_version: reported TCB version
++ */
++struct sev_user_data_snp_status {
++	__u8 api_major;			/* Out */
++	__u8 api_minor;			/* Out */
++	__u8 state;			/* Out */
++	__u8 is_rmp_initialized:1;	/* Out */
++	__u8 rsvd:7;
++	__u32 build_id;			/* Out */
++	__u32 mask_chip_id:1;		/* Out */
++	__u32 mask_chip_key:1;		/* Out */
++	__u32 vlek_en:1;		/* Out */
++	__u32 rsvd1:29;
++	__u32 guest_count;		/* Out */
++	__u64 current_tcb_version;	/* Out */
++	__u64 reported_tcb_version;	/* Out */
++} __attribute__((packed));
++
++/**
++ * struct sev_user_data_snp_config - system wide configuration value for SNP.
++ *
++ * @reported_tcb: the TCB version to report in the guest attestation report.
++ * @mask_chip_id: whether chip id is present in attestation reports or not
++ * @mask_chip_key: whether attestation reports are signed or not
++ * @rsvd: reserved
++ * @rsvd1: reserved
++ */
++struct sev_user_data_snp_config {
++	__u64 reported_tcb  ;   /* In */
++	__u32 mask_chip_id:1;   /* In */
++	__u32 mask_chip_key:1;  /* In */
++	__u32 rsvd:30;          /* In */
++	__u8 rsvd1[52];
++} __attribute__((packed));
++
+ /**
+  * struct sev_issue_cmd - SEV ioctl parameters
+  *
+diff --git a/linux-headers/linux/vhost.h b/linux-headers/linux/vhost.h
+index 649560c685..bea6973906 100644
+--- a/linux-headers/linux/vhost.h
++++ b/linux-headers/linux/vhost.h
+@@ -227,4 +227,11 @@
+  */
+ #define VHOST_VDPA_GET_VRING_DESC_GROUP	_IOWR(VHOST_VIRTIO, 0x7F,	\
+ 					      struct vhost_vring_state)
++
++/* Get the queue size of a specific virtqueue.
++ * userspace set the vring index in vhost_vring_state.index
++ * kernel set the queue size in vhost_vring_state.num
++ */
++#define VHOST_VDPA_GET_VRING_SIZE	_IOWR(VHOST_VIRTIO, 0x80,	\
++					      struct vhost_vring_state)
+ #endif
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-machine-allow-early-use-of-machine_require_guest_mem.patch b/SOURCES/kvm-machine-allow-early-use-of-machine_require_guest_mem.patch
new file mode 100644
index 0000000..6524d6a
--- /dev/null
+++ b/SOURCES/kvm-machine-allow-early-use-of-machine_require_guest_mem.patch
@@ -0,0 +1,71 @@
+From 9f485c8df885bcd1ff6c5692463c6168bfec07fb Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Fri, 31 May 2024 13:29:53 +0200
+Subject: [PATCH 054/100] machine: allow early use of
+ machine_require_guest_memfd
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [54/91] fd8c1a6624d5f27268215c8aa70dfc9d37bdb981 (bonzini/rhel-qemu-kvm)
+
+Ask the ConfidentialGuestSupport object whether to use guest_memfd
+for KVM-backend private memory.  This bool can be set in instance_init
+(or user_complete) so that it is available when the machine is created.
+
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit dc0d28ca46c0e7ee3c055ad4da24022995bd3765)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ hw/core/machine.c                         | 2 +-
+ include/exec/confidential-guest-support.h | 5 +++++
+ include/hw/boards.h                       | 1 -
+ 3 files changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/hw/core/machine.c b/hw/core/machine.c
+index 07b994e136..2055e0d312 100644
+--- a/hw/core/machine.c
++++ b/hw/core/machine.c
+@@ -1482,7 +1482,7 @@ bool machine_mem_merge(MachineState *machine)
+ 
+ bool machine_require_guest_memfd(MachineState *machine)
+ {
+-    return machine->require_guest_memfd;
++    return machine->cgs && machine->cgs->require_guest_memfd;
+ }
+ 
+ static char *cpu_slot_to_string(const CPUArchId *cpu)
+diff --git a/include/exec/confidential-guest-support.h b/include/exec/confidential-guest-support.h
+index e5b188cffb..02dc4e518f 100644
+--- a/include/exec/confidential-guest-support.h
++++ b/include/exec/confidential-guest-support.h
+@@ -31,6 +31,11 @@ OBJECT_DECLARE_TYPE(ConfidentialGuestSupport,
+ struct ConfidentialGuestSupport {
+     Object parent;
+ 
++    /*
++     * True if the machine should use guest_memfd for RAM.
++     */
++    bool require_guest_memfd;
++
+     /*
+      * ready: flag set by CGS initialization code once it's ready to
+      *        start executing instructions in a potentially-secure
+diff --git a/include/hw/boards.h b/include/hw/boards.h
+index 815a1c4b26..0d1f9533ef 100644
+--- a/include/hw/boards.h
++++ b/include/hw/boards.h
+@@ -373,7 +373,6 @@ struct MachineState {
+     char *dt_compatible;
+     bool dump_guest_core;
+     bool mem_merge;
+-    bool require_guest_memfd;
+     bool usb;
+     bool usb_disabled;
+     char *firmware;
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-memory-Introduce-memory_region_init_ram_guest_memfd.patch b/SOURCES/kvm-memory-Introduce-memory_region_init_ram_guest_memfd.patch
new file mode 100644
index 0000000..538e82d
--- /dev/null
+++ b/SOURCES/kvm-memory-Introduce-memory_region_init_ram_guest_memfd.patch
@@ -0,0 +1,85 @@
+From 331c58d87dde8b4757e1d1e09d9b16bac2952d22 Mon Sep 17 00:00:00 2001
+From: Xiaoyao Li <xiaoyao.li@intel.com>
+Date: Thu, 30 May 2024 06:16:15 -0500
+Subject: [PATCH 081/100] memory: Introduce
+ memory_region_init_ram_guest_memfd()
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [81/91] d5b0898d791f3f90d1acda0230f96ca9bf5be5e4 (bonzini/rhel-qemu-kvm)
+
+Introduce memory_region_init_ram_guest_memfd() to allocate private
+guset memfd on the MemoryRegion initialization. It's for the use case of
+TDVF, which must be private on TDX case.
+
+Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
+Signed-off-by: Michael Roth <michael.roth@amd.com>
+Signed-off-by: Pankaj Gupta <pankaj.gupta@amd.com>
+Message-ID: <20240530111643.1091816-4-pankaj.gupta@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit a0aa6db7ce72a08703774107185e639e73e7754c)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ include/exec/memory.h |  6 ++++++
+ system/memory.c       | 24 ++++++++++++++++++++++++
+ 2 files changed, 30 insertions(+)
+
+diff --git a/include/exec/memory.h b/include/exec/memory.h
+index 679a847685..1e351f6fc8 100644
+--- a/include/exec/memory.h
++++ b/include/exec/memory.h
+@@ -1603,6 +1603,12 @@ bool memory_region_init_ram(MemoryRegion *mr,
+                             uint64_t size,
+                             Error **errp);
+ 
++bool memory_region_init_ram_guest_memfd(MemoryRegion *mr,
++                                        Object *owner,
++                                        const char *name,
++                                        uint64_t size,
++                                        Error **errp);
++
+ /**
+  * memory_region_init_rom: Initialize a ROM memory region.
+  *
+diff --git a/system/memory.c b/system/memory.c
+index c756950c0c..b09065eef3 100644
+--- a/system/memory.c
++++ b/system/memory.c
+@@ -3606,6 +3606,30 @@ bool memory_region_init_ram(MemoryRegion *mr,
+     return true;
+ }
+ 
++bool memory_region_init_ram_guest_memfd(MemoryRegion *mr,
++                                        Object *owner,
++                                        const char *name,
++                                        uint64_t size,
++                                        Error **errp)
++{
++    DeviceState *owner_dev;
++
++    if (!memory_region_init_ram_flags_nomigrate(mr, owner, name, size,
++                                                RAM_GUEST_MEMFD, errp)) {
++        return false;
++    }
++    /* This will assert if owner is neither NULL nor a DeviceState.
++     * We only want the owner here for the purposes of defining a
++     * unique name for migration. TODO: Ideally we should implement
++     * a naming scheme for Objects which are not DeviceStates, in
++     * which case we can relax this restriction.
++     */
++    owner_dev = DEVICE(owner);
++    vmstate_register_ram(mr, owner_dev);
++
++    return true;
++}
++
+ bool memory_region_init_rom(MemoryRegion *mr,
+                             Object *owner,
+                             const char *name,
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-memory-device-reintroduce-memory-region-size-check.patch b/SOURCES/kvm-memory-device-reintroduce-memory-region-size-check.patch
deleted file mode 100644
index 5b531f5..0000000
--- a/SOURCES/kvm-memory-device-reintroduce-memory-region-size-check.patch
+++ /dev/null
@@ -1,112 +0,0 @@
-From 633c6a52ac88526534466ae311522fe5447bcf91 Mon Sep 17 00:00:00 2001
-From: David Hildenbrand <david@redhat.com>
-Date: Wed, 17 Jan 2024 14:55:54 +0100
-Subject: [PATCH 02/22] memory-device: reintroduce memory region size check
-
-RH-Author: David Hildenbrand <david@redhat.com>
-RH-MergeRequest: 221: memory-device: reintroduce memory region size check
-RH-Jira: RHEL-20341
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
-RH-Commit: [2/2] e9ff2339b0c07c3f48f5834c9c80cd6d4cbc8f71
-
-JIRA: https://issues.redhat.com/browse/RHEL-20341
-
-We used to check that the memory region size is multiples of the overall
-requested address alignment for the device memory address.
-
-We removed that check, because there are cases (i.e., hv-balloon) where
-devices unconditionally request an address alignment that has a very large
-alignment (i.e., 32 GiB), but the actual memory device size might not be
-multiples of that alignment.
-
-However, this change:
-
-(a) allows for some practically impossible DIMM sizes, like "1GB+1 byte".
-(b) allows for DIMMs that partially cover hugetlb pages, previously
-    reported in [1].
-
-Both scenarios don't make any sense: we might even waste memory.
-
-So let's reintroduce that check, but only check that the
-memory region size is multiples of the memory region alignment (i.e.,
-page size, huge page size), but not any additional memory device
-requirements communicated using md->get_min_alignment().
-
-The following examples now fail again as expected:
-
-(a) 1M with 2M THP
- qemu-system-x86_64 -m 4g,maxmem=16g,slots=1 -S -nodefaults -nographic \
-                     -object memory-backend-ram,id=mem1,size=1M \
-                     -device pc-dimm,id=dimm1,memdev=mem1
- -> backend memory size must be multiple of 0x200000
-
-(b) 1G+1byte
-
- qemu-system-x86_64 -m 4g,maxmem=16g,slots=1 -S -nodefaults -nographic \
-                   -object memory-backend-ram,id=mem1,size=1073741825B \
-                   -device pc-dimm,id=dimm1,memdev=mem1
- -> backend memory size must be multiple of 0x200000
-
-(c) Unliagned hugetlb size (2M)
-
- qemu-system-x86_64 -m 4g,maxmem=16g,slots=1 -S -nodefaults -nographic \
-                   -object memory-backend-file,id=mem1,mem-path=/dev/hugepages/tmp,size=511M \
-                   -device pc-dimm,id=dimm1,memdev=mem1
- backend memory size must be multiple of 0x200000
-
-(d) Unliagned hugetlb size (1G)
-
- qemu-system-x86_64 -m 4g,maxmem=16g,slots=1 -S -nodefaults -nographic \
-                    -object memory-backend-file,id=mem1,mem-path=/dev/hugepages1G/tmp,size=2047M \
-                    -device pc-dimm,id=dimm1,memdev=mem1
- -> backend memory size must be multiple of 0x40000000
-
-Note that this fix depends on a hv-balloon change to communicate its
-additional alignment requirements using get_min_alignment() instead of
-through the memory region.
-
-[1] https://lkml.kernel.org/r/f77d641d500324525ac036fe1827b3070de75fc1.1701088320.git.mprivozn@redhat.com
-
-Message-ID: <20240117135554.787344-3-david@redhat.com>
-Reported-by: Zhenyu Zhang <zhenyzha@redhat.com>
-Reported-by: Michal Privoznik <mprivozn@redhat.com>
-Fixes: eb1b7c4bd413 ("memory-device: Drop size alignment check")
-Tested-by: Zhenyu Zhang <zhenyzha@redhat.com>
-Tested-by: Mario Casquero <mcasquer@redhat.com>
-Reviewed-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com>
-Signed-off-by: David Hildenbrand <david@redhat.com>
-(cherry picked from commit 540a1abbf0b243e4cfb4333c5d30a041f7080ba4)
-Signed-off-by: David Hildenbrand <david@redhat.com>
----
- hw/mem/memory-device.c | 14 ++++++++++++++
- 1 file changed, 14 insertions(+)
-
-diff --git a/hw/mem/memory-device.c b/hw/mem/memory-device.c
-index a1b1af26bc..e098585cda 100644
---- a/hw/mem/memory-device.c
-+++ b/hw/mem/memory-device.c
-@@ -374,6 +374,20 @@ void memory_device_pre_plug(MemoryDeviceState *md, MachineState *ms,
-         goto out;
-     }
- 
-+    /*
-+     * We always want the memory region size to be multiples of the memory
-+     * region alignment: for example, DIMMs with 1G+1byte size don't make
-+     * any sense. Note that we don't check that the size is multiples
-+     * of any additional alignment requirements the memory device might
-+     * have when it comes to the address in physical address space.
-+     */
-+    if (!QEMU_IS_ALIGNED(memory_region_size(mr),
-+                         memory_region_get_alignment(mr))) {
-+        error_setg(errp, "backend memory size must be multiple of 0x%"
-+                   PRIx64, memory_region_get_alignment(mr));
-+        return;
-+    }
-+
-     if (legacy_align) {
-         align = *legacy_align;
-     } else {
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-mirror-Don-t-call-job_pause_point-under-graph-lock.patch b/SOURCES/kvm-mirror-Don-t-call-job_pause_point-under-graph-lock.patch
deleted file mode 100644
index 871a80e..0000000
--- a/SOURCES/kvm-mirror-Don-t-call-job_pause_point-under-graph-lock.patch
+++ /dev/null
@@ -1,90 +0,0 @@
-From 21cadc8ed200ad9af13b217b441b9f12cd2163ee Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Wed, 13 Mar 2024 16:30:00 +0100
-Subject: [PATCH 1/4] mirror: Don't call job_pause_point() under graph lock
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 231: Fix deadlock and crash during storage migration
-RH-Jira: RHEL-28125
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Acked-by: Eric Blake <eblake@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [1/3] 093910fcd5ea1516d0ed48a9cd73dad6170590f3 (kmwolf/centos-qemu-kvm)
-
-Calling job_pause_point() while holding the graph reader lock
-potentially results in a deadlock: bdrv_graph_wrlock() first drains
-everything, including the mirror job, which pauses it. The job is only
-unpaused at the end of the drain section, which is when the graph writer
-lock has been successfully taken. However, if the job happens to be
-paused at a pause point where it still holds the reader lock, the writer
-lock can't be taken as long as the job is still paused.
-
-Mark job_pause_point() as GRAPH_UNLOCKED and fix mirror accordingly.
-
-Cc: qemu-stable@nongnu.org
-Buglink: https://issues.redhat.com/browse/RHEL-28125
-Fixes: 004915a96a7a ("block: Protect bs->backing with graph_lock")
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Message-ID: <20240313153000.33121-1-kwolf@redhat.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit ae5a40e8581185654a667fbbf7e4adbc2a2a3e45)
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- block/mirror.c     | 10 ++++++----
- include/qemu/job.h |  2 +-
- 2 files changed, 7 insertions(+), 5 deletions(-)
-
-diff --git a/block/mirror.c b/block/mirror.c
-index 5145eb53e1..1bdce3b657 100644
---- a/block/mirror.c
-+++ b/block/mirror.c
-@@ -479,9 +479,9 @@ static unsigned mirror_perform(MirrorBlockJob *s, int64_t offset,
-     return bytes_handled;
- }
- 
--static void coroutine_fn GRAPH_RDLOCK mirror_iteration(MirrorBlockJob *s)
-+static void coroutine_fn GRAPH_UNLOCKED mirror_iteration(MirrorBlockJob *s)
- {
--    BlockDriverState *source = s->mirror_top_bs->backing->bs;
-+    BlockDriverState *source;
-     MirrorOp *pseudo_op;
-     int64_t offset;
-     /* At least the first dirty chunk is mirrored in one iteration. */
-@@ -489,6 +489,10 @@ static void coroutine_fn GRAPH_RDLOCK mirror_iteration(MirrorBlockJob *s)
-     bool write_zeroes_ok = bdrv_can_write_zeroes_with_unmap(blk_bs(s->target));
-     int max_io_bytes = MAX(s->buf_size / MAX_IN_FLIGHT, MAX_IO_BYTES);
- 
-+    bdrv_graph_co_rdlock();
-+    source = s->mirror_top_bs->backing->bs;
-+    bdrv_graph_co_rdunlock();
-+
-     bdrv_dirty_bitmap_lock(s->dirty_bitmap);
-     offset = bdrv_dirty_iter_next(s->dbi);
-     if (offset < 0) {
-@@ -1066,9 +1070,7 @@ static int coroutine_fn mirror_run(Job *job, Error **errp)
-                 mirror_wait_for_free_in_flight_slot(s);
-                 continue;
-             } else if (cnt != 0) {
--                bdrv_graph_co_rdlock();
-                 mirror_iteration(s);
--                bdrv_graph_co_rdunlock();
-             }
-         }
- 
-diff --git a/include/qemu/job.h b/include/qemu/job.h
-index 9ea98b5927..2b873f2576 100644
---- a/include/qemu/job.h
-+++ b/include/qemu/job.h
-@@ -483,7 +483,7 @@ void job_enter(Job *job);
-  *
-  * Called with job_mutex *not* held.
-  */
--void coroutine_fn job_pause_point(Job *job);
-+void coroutine_fn GRAPH_UNLOCKED job_pause_point(Job *job);
- 
- /**
-  * @job: The job that calls the function.
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-monitor-only-run-coroutine-commands-in-qemu_aio_cont.patch b/SOURCES/kvm-monitor-only-run-coroutine-commands-in-qemu_aio_cont.patch
deleted file mode 100644
index 345a2b4..0000000
--- a/SOURCES/kvm-monitor-only-run-coroutine-commands-in-qemu_aio_cont.patch
+++ /dev/null
@@ -1,1630 +0,0 @@
-From 972e553e605e8916fc47c2d51cdbde940fd7d855 Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Thu, 18 Jan 2024 09:48:23 -0500
-Subject: [PATCH 13/22] monitor: only run coroutine commands in
- qemu_aio_context
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 219: virtio-blk: add iothread-vq-mapping parameter
-RH-Jira: RHEL-17369 RHEL-20764 RHEL-7356
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Commit: [9/17] ec5690fcade04a88bd1815bf2ae0377e80fe3d51 (stefanha/centos-stream-qemu-kvm)
-
-monitor_qmp_dispatcher_co() runs in the iohandler AioContext that is not
-polled during nested event loops. The coroutine currently reschedules
-itself in the main loop's qemu_aio_context AioContext, which is polled
-during nested event loops. One known problem is that QMP device-add
-calls drain_call_rcu(), which temporarily drops the BQL, leading to all
-sorts of havoc like other vCPU threads re-entering device emulation code
-while another vCPU thread is waiting in device emulation code with
-aio_poll().
-
-Paolo Bonzini suggested running non-coroutine QMP handlers in the
-iohandler AioContext. This avoids trouble with nested event loops. His
-original idea was to move coroutine rescheduling to
-monitor_qmp_dispatch(), but I resorted to moving it to qmp_dispatch()
-because we don't know if the QMP handler needs to run in coroutine
-context in monitor_qmp_dispatch(). monitor_qmp_dispatch() would have
-been nicer since it's associated with the monitor implementation and not
-as general as qmp_dispatch(), which is also used by qemu-ga.
-
-A number of qemu-iotests need updated .out files because the order of
-QMP events vs QMP responses has changed.
-
-Solves Issue #1933.
-
-Cc: qemu-stable@nongnu.org
-Fixes: 7bed89958bfbf40df9ca681cefbdca63abdde39d ("device_core: use drain_call_rcu in in qmp_device_add")
-Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2215192
-Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2214985
-Buglink: https://issues.redhat.com/browse/RHEL-17369
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20240118144823.1497953-4-stefanha@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Tested-by: Fiona Ebner <f.ebner@proxmox.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit effd60c878176bcaf97fa7ce2b12d04bb8ead6f7)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- monitor/qmp.c                                 | 17 ----
- qapi/qmp-dispatch.c                           | 24 +++++-
- tests/qemu-iotests/060.out                    |  4 +-
- tests/qemu-iotests/071.out                    |  4 +-
- tests/qemu-iotests/081.out                    | 16 ++--
- tests/qemu-iotests/087.out                    | 12 +--
- tests/qemu-iotests/108.out                    |  2 +-
- tests/qemu-iotests/109                        |  4 +-
- tests/qemu-iotests/109.out                    | 78 ++++++++-----------
- tests/qemu-iotests/117.out                    |  2 +-
- tests/qemu-iotests/120.out                    |  2 +-
- tests/qemu-iotests/127.out                    |  2 +-
- tests/qemu-iotests/140.out                    |  2 +-
- tests/qemu-iotests/143.out                    |  2 +-
- tests/qemu-iotests/156.out                    |  2 +-
- tests/qemu-iotests/176.out                    | 16 ++--
- tests/qemu-iotests/182.out                    |  2 +-
- tests/qemu-iotests/183.out                    |  4 +-
- tests/qemu-iotests/184.out                    | 32 ++++----
- tests/qemu-iotests/185                        |  6 +-
- tests/qemu-iotests/185.out                    | 45 +++++++++--
- tests/qemu-iotests/191.out                    | 16 ++--
- tests/qemu-iotests/195.out                    | 16 ++--
- tests/qemu-iotests/223.out                    | 12 +--
- tests/qemu-iotests/227.out                    | 32 ++++----
- tests/qemu-iotests/247.out                    |  2 +-
- tests/qemu-iotests/273.out                    |  8 +-
- tests/qemu-iotests/308                        |  4 +-
- tests/qemu-iotests/308.out                    |  4 +-
- tests/qemu-iotests/tests/file-io-error        |  5 +-
- tests/qemu-iotests/tests/iothreads-resize.out |  2 +-
- tests/qemu-iotests/tests/qsd-jobs.out         |  4 +-
- 32 files changed, 205 insertions(+), 178 deletions(-)
-
-diff --git a/monitor/qmp.c b/monitor/qmp.c
-index 6eee450fe4..a239945e8d 100644
---- a/monitor/qmp.c
-+++ b/monitor/qmp.c
-@@ -321,14 +321,6 @@ void coroutine_fn monitor_qmp_dispatcher_co(void *data)
-             qemu_coroutine_yield();
-         }
- 
--        /*
--         * Move the coroutine from iohandler_ctx to qemu_aio_context for
--         * executing the command handler so that it can make progress if it
--         * involves an AIO_WAIT_WHILE().
--         */
--        aio_co_schedule(qemu_get_aio_context(), qmp_dispatcher_co);
--        qemu_coroutine_yield();
--
-         /* Process request */
-         if (req_obj->req) {
-             if (trace_event_get_state(TRACE_MONITOR_QMP_CMD_IN_BAND)) {
-@@ -355,15 +347,6 @@ void coroutine_fn monitor_qmp_dispatcher_co(void *data)
-         }
- 
-         qmp_request_free(req_obj);
--
--        /*
--         * Yield and reschedule so the main loop stays responsive.
--         *
--         * Move back to iohandler_ctx so that nested event loops for
--         * qemu_aio_context don't start new monitor commands.
--         */
--        aio_co_schedule(iohandler_get_aio_context(), qmp_dispatcher_co);
--        qemu_coroutine_yield();
-     }
-     qatomic_set(&qmp_dispatcher_co, NULL);
- }
-diff --git a/qapi/qmp-dispatch.c b/qapi/qmp-dispatch.c
-index 555528b6bb..176b549473 100644
---- a/qapi/qmp-dispatch.c
-+++ b/qapi/qmp-dispatch.c
-@@ -206,9 +206,31 @@ QDict *coroutine_mixed_fn qmp_dispatch(const QmpCommandList *cmds, QObject *requ
-     assert(!(oob && qemu_in_coroutine()));
-     assert(monitor_cur() == NULL);
-     if (!!(cmd->options & QCO_COROUTINE) == qemu_in_coroutine()) {
-+        if (qemu_in_coroutine()) {
-+            /*
-+             * Move the coroutine from iohandler_ctx to qemu_aio_context for
-+             * executing the command handler so that it can make progress if it
-+             * involves an AIO_WAIT_WHILE().
-+             */
-+            aio_co_schedule(qemu_get_aio_context(), qemu_coroutine_self());
-+            qemu_coroutine_yield();
-+        }
-+
-         monitor_set_cur(qemu_coroutine_self(), cur_mon);
-         cmd->fn(args, &ret, &err);
-         monitor_set_cur(qemu_coroutine_self(), NULL);
-+
-+        if (qemu_in_coroutine()) {
-+            /*
-+             * Yield and reschedule so the main loop stays responsive.
-+             *
-+             * Move back to iohandler_ctx so that nested event loops for
-+             * qemu_aio_context don't start new monitor commands.
-+             */
-+            aio_co_schedule(iohandler_get_aio_context(),
-+                            qemu_coroutine_self());
-+            qemu_coroutine_yield();
-+        }
-     } else {
-        /*
-         * Actual context doesn't match the one the command needs.
-@@ -232,7 +254,7 @@ QDict *coroutine_mixed_fn qmp_dispatch(const QmpCommandList *cmds, QObject *requ
-             .errp       = &err,
-             .co         = qemu_coroutine_self(),
-         };
--        aio_bh_schedule_oneshot(qemu_get_aio_context(), do_qmp_dispatch_bh,
-+        aio_bh_schedule_oneshot(iohandler_get_aio_context(), do_qmp_dispatch_bh,
-                                 &data);
-         qemu_coroutine_yield();
-     }
-diff --git a/tests/qemu-iotests/060.out b/tests/qemu-iotests/060.out
-index 329977d9b9..a37bf446e9 100644
---- a/tests/qemu-iotests/060.out
-+++ b/tests/qemu-iotests/060.out
-@@ -421,8 +421,8 @@ QMP_VERSION
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_IMAGE_CORRUPTED", "data": {"device": "none0", "msg": "Preventing invalid write on metadata (overlaps with refcount table)", "offset": 65536, "node-name": "drive", "fatal": true, "size": 65536}}
- write failed: Input/output error
- {"return": ""}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- 
- === Testing incoming inactive corrupted image ===
- 
-@@ -432,8 +432,8 @@ QMP_VERSION
- qcow2: Image is corrupt: L2 table offset 0x2a2a2a00 unaligned (L1 index: 0); further non-fatal corruption events will be suppressed
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_IMAGE_CORRUPTED", "data": {"device": "", "msg": "L2 table offset 0x2a2a2a00 unaligned (L1 index: 0)", "node-name": "drive", "fatal": false}}
- {"return": ""}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- 
-     corrupt: false
- *** done
-diff --git a/tests/qemu-iotests/071.out b/tests/qemu-iotests/071.out
-index bca0c02f5c..a2923b05c2 100644
---- a/tests/qemu-iotests/071.out
-+++ b/tests/qemu-iotests/071.out
-@@ -45,8 +45,8 @@ QMP_VERSION
- {"return": {}}
- read failed: Input/output error
- {"return": ""}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- 
- 
- === Testing blkverify on existing block device ===
-@@ -84,9 +84,9 @@ wrote 512/512 bytes at offset 0
- {"return": ""}
- read failed: Input/output error
- {"return": ""}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
- QEMU_PROG: Failed to flush the L2 table cache: Input/output error
- QEMU_PROG: Failed to flush the refcount block cache: Input/output error
-+{"return": {}}
- 
- *** done
-diff --git a/tests/qemu-iotests/081.out b/tests/qemu-iotests/081.out
-index 615c083549..aba85ea564 100644
---- a/tests/qemu-iotests/081.out
-+++ b/tests/qemu-iotests/081.out
-@@ -35,8 +35,8 @@ QMP_VERSION
- read 10485760/10485760 bytes at offset 0
- 10 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
- {"return": ""}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- 
- 
- == using quorum rewrite corrupted mode ==
-@@ -67,8 +67,8 @@ QMP_VERSION
- read 10485760/10485760 bytes at offset 0
- 10 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
- {"return": ""}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- 
- -- checking that the image has been corrected --
- read 10485760/10485760 bytes at offset 0
-@@ -106,8 +106,8 @@ QMP_VERSION
- {"return": {}}
- {"return": {}}
- {"return": {}}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- 
- Testing:
- QMP_VERSION
-@@ -115,8 +115,8 @@ QMP_VERSION
- {"return": {}}
- {"return": {}}
- {"error": {"class": "GenericError", "desc": "Cannot add a child to a quorum in blkverify mode"}}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- 
- 
- == dynamically removing a child from a quorum ==
-@@ -125,31 +125,31 @@ QMP_VERSION
- {"return": {}}
- {"return": {}}
- {"return": {}}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- 
- Testing:
- QMP_VERSION
- {"return": {}}
- {"return": {}}
- {"error": {"class": "GenericError", "desc": "The number of children cannot be lower than the vote threshold 2"}}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- 
- Testing:
- QMP_VERSION
- {"return": {}}
- {"error": {"class": "GenericError", "desc": "blkverify=on can only be set if there are exactly two files and vote-threshold is 2"}}
- {"error": {"class": "GenericError", "desc": "Cannot find device='drive0-quorum' nor node-name='drive0-quorum'"}}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- 
- Testing:
- QMP_VERSION
- {"return": {}}
- {"return": {}}
- {"error": {"class": "GenericError", "desc": "The number of children cannot be lower than the vote threshold 2"}}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- 
- *** done
-diff --git a/tests/qemu-iotests/087.out b/tests/qemu-iotests/087.out
-index e1c23a6983..97b6d8036d 100644
---- a/tests/qemu-iotests/087.out
-+++ b/tests/qemu-iotests/087.out
-@@ -7,8 +7,8 @@ Testing:
- QMP_VERSION
- {"return": {}}
- {"error": {"class": "GenericError", "desc": "'node-name' must be specified for the root node"}}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- 
- 
- === Duplicate ID ===
-@@ -18,8 +18,8 @@ QMP_VERSION
- {"return": {}}
- {"error": {"class": "GenericError", "desc": "node-name=disk is conflicting with a device id"}}
- {"error": {"class": "GenericError", "desc": "Duplicate nodes with node-name='test-node'"}}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- 
- 
- === aio=native without O_DIRECT ===
-@@ -28,8 +28,8 @@ Testing:
- QMP_VERSION
- {"return": {}}
- {"error": {"class": "GenericError", "desc": "aio=native was specified, but it requires cache.direct=on, which was not specified."}}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- 
- 
- === Encrypted image QCow ===
-@@ -40,8 +40,8 @@ QMP_VERSION
- {"return": {}}
- {"return": {}}
- {"error": {"class": "GenericError", "desc": "Use of AES-CBC encrypted IMGFMT images is no longer supported in system emulators"}}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- 
- 
- === Encrypted image LUKS ===
-@@ -52,8 +52,8 @@ QMP_VERSION
- {"return": {}}
- {"return": {}}
- {"return": {}}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- 
- 
- === Missing driver ===
-@@ -63,7 +63,7 @@ Testing: -S
- QMP_VERSION
- {"return": {}}
- {"error": {"class": "GenericError", "desc": "Parameter 'driver' is missing"}}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- 
- *** done
-diff --git a/tests/qemu-iotests/108.out b/tests/qemu-iotests/108.out
-index b5401d788d..b9c876b394 100644
---- a/tests/qemu-iotests/108.out
-+++ b/tests/qemu-iotests/108.out
-@@ -173,8 +173,8 @@ OK: Reftable is where we expect it
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "create"}}
- {"return": {}}
- { "execute": "quit" }
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- 
- wrote 65536/65536 bytes at offset 0
- 64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-diff --git a/tests/qemu-iotests/109 b/tests/qemu-iotests/109
-index e207a555f3..0fb580f9a5 100755
---- a/tests/qemu-iotests/109
-+++ b/tests/qemu-iotests/109
-@@ -57,13 +57,13 @@ run_qemu()
-     _launch_qemu -drive file="${source_img}",format=raw,cache=${CACHEMODE},aio=${AIOMODE},id=src
-     _send_qemu_cmd $QEMU_HANDLE "{ 'execute': 'qmp_capabilities' }" "return"
- 
--    _send_qemu_cmd $QEMU_HANDLE \
-+    capture_events="$qmp_event" _send_qemu_cmd $QEMU_HANDLE \
-         "{'execute':'drive-mirror', 'arguments':{
-             'device': 'src', 'target': '$raw_img', $qmp_format
-             'mode': 'existing', 'sync': 'full'}}" \
-         "return"
- 
--    _send_qemu_cmd $QEMU_HANDLE '' "$qmp_event"
-+    capture_events="$qmp_event JOB_STATUS_CHANGE" _wait_event $QEMU_HANDLE "$qmp_event"
-     if test "$qmp_event" = BLOCK_JOB_ERROR; then
-         _send_qemu_cmd $QEMU_HANDLE '' '"status": "null"'
-     fi
-diff --git a/tests/qemu-iotests/109.out b/tests/qemu-iotests/109.out
-index 965c9a6a0a..3ae8552ff7 100644
---- a/tests/qemu-iotests/109.out
-+++ b/tests/qemu-iotests/109.out
-@@ -7,7 +7,7 @@ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=SIZE
- { 'execute': 'qmp_capabilities' }
- {"return": {}}
- {'execute':'drive-mirror', 'arguments':{
--            'device': 'src', 'target': 'TEST_DIR/t.IMGFMT',
-+            'device': 'src', 'target': 'TEST_DIR/t.IMGFMT', 
-             'mode': 'existing', 'sync': 'full'}}
- WARNING: Image format was not specified for 'TEST_DIR/t.raw' and probing guessed raw.
-          Automatically detecting the format is dangerous for raw images, write operations on block 0 will be restricted.
-@@ -23,8 +23,8 @@ WARNING: Image format was not specified for 'TEST_DIR/t.raw' and probing guessed
- {"execute":"query-block-jobs"}
- {"return": []}
- {"execute":"quit"}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- read 512/512 bytes at offset 0
- 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
- { 'execute': 'qmp_capabilities' }
-@@ -35,12 +35,10 @@ read 512/512 bytes at offset 0
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "src"}}
- {"return": {}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_READY", "data": {"device": "src", "len": 1024, "offset": 1024, "speed": 0, "type": "mirror"}}
- {"execute":"query-block-jobs"}
- {"return": [{"auto-finalize": true, "io-status": "ok", "device": "src", "auto-dismiss": true, "busy": false, "len": 1024, "offset": 1024, "status": "ready", "paused": false, "speed": 0, "ready": true, "type": "mirror", "actively-synced": false}]}
- {"execute":"quit"}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "standby", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "src"}}
-@@ -50,6 +48,7 @@ read 512/512 bytes at offset 0
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_CANCELLED", "data": {"device": "src", "len": 1024, "offset": 1024, "speed": 0, "type": "mirror"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "src"}}
-+{"return": {}}
- Images are identical.
- 
- === Writing a qcow2 header into raw ===
-@@ -59,7 +58,7 @@ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=SIZE
- { 'execute': 'qmp_capabilities' }
- {"return": {}}
- {'execute':'drive-mirror', 'arguments':{
--            'device': 'src', 'target': 'TEST_DIR/t.IMGFMT',
-+            'device': 'src', 'target': 'TEST_DIR/t.IMGFMT', 
-             'mode': 'existing', 'sync': 'full'}}
- WARNING: Image format was not specified for 'TEST_DIR/t.raw' and probing guessed raw.
-          Automatically detecting the format is dangerous for raw images, write operations on block 0 will be restricted.
-@@ -75,8 +74,8 @@ WARNING: Image format was not specified for 'TEST_DIR/t.raw' and probing guessed
- {"execute":"query-block-jobs"}
- {"return": []}
- {"execute":"quit"}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- read 512/512 bytes at offset 0
- 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
- { 'execute': 'qmp_capabilities' }
-@@ -87,12 +86,10 @@ read 512/512 bytes at offset 0
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "src"}}
- {"return": {}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_READY", "data": {"device": "src", "len": 197120, "offset": 197120, "speed": 0, "type": "mirror"}}
- {"execute":"query-block-jobs"}
- {"return": [{"auto-finalize": true, "io-status": "ok", "device": "src", "auto-dismiss": true, "busy": false, "len": 197120, "offset": 197120, "status": "ready", "paused": false, "speed": 0, "ready": true, "type": "mirror", "actively-synced": false}]}
- {"execute":"quit"}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "standby", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "src"}}
-@@ -102,6 +99,7 @@ read 512/512 bytes at offset 0
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_CANCELLED", "data": {"device": "src", "len": 197120, "offset": 197120, "speed": 0, "type": "mirror"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "src"}}
-+{"return": {}}
- Images are identical.
- 
- === Writing a qed header into raw ===
-@@ -111,7 +109,7 @@ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=SIZE
- { 'execute': 'qmp_capabilities' }
- {"return": {}}
- {'execute':'drive-mirror', 'arguments':{
--            'device': 'src', 'target': 'TEST_DIR/t.IMGFMT',
-+            'device': 'src', 'target': 'TEST_DIR/t.IMGFMT', 
-             'mode': 'existing', 'sync': 'full'}}
- WARNING: Image format was not specified for 'TEST_DIR/t.raw' and probing guessed raw.
-          Automatically detecting the format is dangerous for raw images, write operations on block 0 will be restricted.
-@@ -127,8 +125,8 @@ WARNING: Image format was not specified for 'TEST_DIR/t.raw' and probing guessed
- {"execute":"query-block-jobs"}
- {"return": []}
- {"execute":"quit"}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- read 512/512 bytes at offset 0
- 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
- { 'execute': 'qmp_capabilities' }
-@@ -139,12 +137,10 @@ read 512/512 bytes at offset 0
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "src"}}
- {"return": {}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_READY", "data": {"device": "src", "len": 327680, "offset": 327680, "speed": 0, "type": "mirror"}}
- {"execute":"query-block-jobs"}
- {"return": [{"auto-finalize": true, "io-status": "ok", "device": "src", "auto-dismiss": true, "busy": false, "len": 327680, "offset": 327680, "status": "ready", "paused": false, "speed": 0, "ready": true, "type": "mirror", "actively-synced": false}]}
- {"execute":"quit"}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "standby", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "src"}}
-@@ -154,6 +150,7 @@ read 512/512 bytes at offset 0
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_CANCELLED", "data": {"device": "src", "len": 327680, "offset": 327680, "speed": 0, "type": "mirror"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "src"}}
-+{"return": {}}
- Images are identical.
- 
- === Writing a vdi header into raw ===
-@@ -163,7 +160,7 @@ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=SIZE
- { 'execute': 'qmp_capabilities' }
- {"return": {}}
- {'execute':'drive-mirror', 'arguments':{
--            'device': 'src', 'target': 'TEST_DIR/t.IMGFMT',
-+            'device': 'src', 'target': 'TEST_DIR/t.IMGFMT', 
-             'mode': 'existing', 'sync': 'full'}}
- WARNING: Image format was not specified for 'TEST_DIR/t.raw' and probing guessed raw.
-          Automatically detecting the format is dangerous for raw images, write operations on block 0 will be restricted.
-@@ -179,8 +176,8 @@ WARNING: Image format was not specified for 'TEST_DIR/t.raw' and probing guessed
- {"execute":"query-block-jobs"}
- {"return": []}
- {"execute":"quit"}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- read 512/512 bytes at offset 0
- 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
- { 'execute': 'qmp_capabilities' }
-@@ -191,12 +188,10 @@ read 512/512 bytes at offset 0
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "src"}}
- {"return": {}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_READY", "data": {"device": "src", "len": 1024, "offset": 1024, "speed": 0, "type": "mirror"}}
- {"execute":"query-block-jobs"}
- {"return": [{"auto-finalize": true, "io-status": "ok", "device": "src", "auto-dismiss": true, "busy": false, "len": 1024, "offset": 1024, "status": "ready", "paused": false, "speed": 0, "ready": true, "type": "mirror", "actively-synced": false}]}
- {"execute":"quit"}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "standby", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "src"}}
-@@ -206,6 +201,7 @@ read 512/512 bytes at offset 0
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_CANCELLED", "data": {"device": "src", "len": 1024, "offset": 1024, "speed": 0, "type": "mirror"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "src"}}
-+{"return": {}}
- Images are identical.
- 
- === Writing a vmdk header into raw ===
-@@ -215,7 +211,7 @@ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=SIZE
- { 'execute': 'qmp_capabilities' }
- {"return": {}}
- {'execute':'drive-mirror', 'arguments':{
--            'device': 'src', 'target': 'TEST_DIR/t.IMGFMT',
-+            'device': 'src', 'target': 'TEST_DIR/t.IMGFMT', 
-             'mode': 'existing', 'sync': 'full'}}
- WARNING: Image format was not specified for 'TEST_DIR/t.raw' and probing guessed raw.
-          Automatically detecting the format is dangerous for raw images, write operations on block 0 will be restricted.
-@@ -231,8 +227,8 @@ WARNING: Image format was not specified for 'TEST_DIR/t.raw' and probing guessed
- {"execute":"query-block-jobs"}
- {"return": []}
- {"execute":"quit"}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- read 512/512 bytes at offset 0
- 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
- { 'execute': 'qmp_capabilities' }
-@@ -243,12 +239,10 @@ read 512/512 bytes at offset 0
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "src"}}
- {"return": {}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_READY", "data": {"device": "src", "len": 65536, "offset": 65536, "speed": 0, "type": "mirror"}}
- {"execute":"query-block-jobs"}
- {"return": [{"auto-finalize": true, "io-status": "ok", "device": "src", "auto-dismiss": true, "busy": false, "len": 65536, "offset": 65536, "status": "ready", "paused": false, "speed": 0, "ready": true, "type": "mirror", "actively-synced": false}]}
- {"execute":"quit"}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "standby", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "src"}}
-@@ -258,6 +252,7 @@ read 512/512 bytes at offset 0
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_CANCELLED", "data": {"device": "src", "len": 65536, "offset": 65536, "speed": 0, "type": "mirror"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "src"}}
-+{"return": {}}
- Images are identical.
- 
- === Writing a vpc header into raw ===
-@@ -267,7 +262,7 @@ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=SIZE
- { 'execute': 'qmp_capabilities' }
- {"return": {}}
- {'execute':'drive-mirror', 'arguments':{
--            'device': 'src', 'target': 'TEST_DIR/t.IMGFMT',
-+            'device': 'src', 'target': 'TEST_DIR/t.IMGFMT', 
-             'mode': 'existing', 'sync': 'full'}}
- WARNING: Image format was not specified for 'TEST_DIR/t.raw' and probing guessed raw.
-          Automatically detecting the format is dangerous for raw images, write operations on block 0 will be restricted.
-@@ -283,8 +278,8 @@ WARNING: Image format was not specified for 'TEST_DIR/t.raw' and probing guessed
- {"execute":"query-block-jobs"}
- {"return": []}
- {"execute":"quit"}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- read 512/512 bytes at offset 0
- 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
- { 'execute': 'qmp_capabilities' }
-@@ -295,12 +290,10 @@ read 512/512 bytes at offset 0
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "src"}}
- {"return": {}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_READY", "data": {"device": "src", "len": 2560, "offset": 2560, "speed": 0, "type": "mirror"}}
- {"execute":"query-block-jobs"}
- {"return": [{"auto-finalize": true, "io-status": "ok", "device": "src", "auto-dismiss": true, "busy": false, "len": 2560, "offset": 2560, "status": "ready", "paused": false, "speed": 0, "ready": true, "type": "mirror", "actively-synced": false}]}
- {"execute":"quit"}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "standby", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "src"}}
-@@ -310,6 +303,7 @@ read 512/512 bytes at offset 0
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_CANCELLED", "data": {"device": "src", "len": 2560, "offset": 2560, "speed": 0, "type": "mirror"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "src"}}
-+{"return": {}}
- Images are identical.
- 
- === Copying sample image empty.bochs into raw ===
-@@ -318,7 +312,7 @@ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=SIZE
- { 'execute': 'qmp_capabilities' }
- {"return": {}}
- {'execute':'drive-mirror', 'arguments':{
--            'device': 'src', 'target': 'TEST_DIR/t.IMGFMT',
-+            'device': 'src', 'target': 'TEST_DIR/t.IMGFMT', 
-             'mode': 'existing', 'sync': 'full'}}
- WARNING: Image format was not specified for 'TEST_DIR/t.raw' and probing guessed raw.
-          Automatically detecting the format is dangerous for raw images, write operations on block 0 will be restricted.
-@@ -334,8 +328,8 @@ WARNING: Image format was not specified for 'TEST_DIR/t.raw' and probing guessed
- {"execute":"query-block-jobs"}
- {"return": []}
- {"execute":"quit"}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- read 512/512 bytes at offset 0
- 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
- { 'execute': 'qmp_capabilities' }
-@@ -346,12 +340,10 @@ read 512/512 bytes at offset 0
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "src"}}
- {"return": {}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_READY", "data": {"device": "src", "len": 2560, "offset": 2560, "speed": 0, "type": "mirror"}}
- {"execute":"query-block-jobs"}
- {"return": [{"auto-finalize": true, "io-status": "ok", "device": "src", "auto-dismiss": true, "busy": false, "len": 2560, "offset": 2560, "status": "ready", "paused": false, "speed": 0, "ready": true, "type": "mirror", "actively-synced": false}]}
- {"execute":"quit"}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "standby", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "src"}}
-@@ -361,6 +353,7 @@ read 512/512 bytes at offset 0
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_CANCELLED", "data": {"device": "src", "len": 2560, "offset": 2560, "speed": 0, "type": "mirror"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "src"}}
-+{"return": {}}
- Images are identical.
- 
- === Copying sample image iotest-dirtylog-10G-4M.vhdx into raw ===
-@@ -369,7 +362,7 @@ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=SIZE
- { 'execute': 'qmp_capabilities' }
- {"return": {}}
- {'execute':'drive-mirror', 'arguments':{
--            'device': 'src', 'target': 'TEST_DIR/t.IMGFMT',
-+            'device': 'src', 'target': 'TEST_DIR/t.IMGFMT', 
-             'mode': 'existing', 'sync': 'full'}}
- WARNING: Image format was not specified for 'TEST_DIR/t.raw' and probing guessed raw.
-          Automatically detecting the format is dangerous for raw images, write operations on block 0 will be restricted.
-@@ -385,8 +378,8 @@ WARNING: Image format was not specified for 'TEST_DIR/t.raw' and probing guessed
- {"execute":"query-block-jobs"}
- {"return": []}
- {"execute":"quit"}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- read 512/512 bytes at offset 0
- 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
- { 'execute': 'qmp_capabilities' }
-@@ -397,12 +390,10 @@ read 512/512 bytes at offset 0
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "src"}}
- {"return": {}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_READY", "data": {"device": "src", "len": 31457280, "offset": 31457280, "speed": 0, "type": "mirror"}}
- {"execute":"query-block-jobs"}
- {"return": [{"auto-finalize": true, "io-status": "ok", "device": "src", "auto-dismiss": true, "busy": false, "len": 31457280, "offset": 31457280, "status": "ready", "paused": false, "speed": 0, "ready": true, "type": "mirror", "actively-synced": false}]}
- {"execute":"quit"}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "standby", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "src"}}
-@@ -412,6 +403,7 @@ read 512/512 bytes at offset 0
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_CANCELLED", "data": {"device": "src", "len": 31457280, "offset": 31457280, "speed": 0, "type": "mirror"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "src"}}
-+{"return": {}}
- Images are identical.
- 
- === Copying sample image parallels-v1 into raw ===
-@@ -420,7 +412,7 @@ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=SIZE
- { 'execute': 'qmp_capabilities' }
- {"return": {}}
- {'execute':'drive-mirror', 'arguments':{
--            'device': 'src', 'target': 'TEST_DIR/t.IMGFMT',
-+            'device': 'src', 'target': 'TEST_DIR/t.IMGFMT', 
-             'mode': 'existing', 'sync': 'full'}}
- WARNING: Image format was not specified for 'TEST_DIR/t.raw' and probing guessed raw.
-          Automatically detecting the format is dangerous for raw images, write operations on block 0 will be restricted.
-@@ -436,8 +428,8 @@ WARNING: Image format was not specified for 'TEST_DIR/t.raw' and probing guessed
- {"execute":"query-block-jobs"}
- {"return": []}
- {"execute":"quit"}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- read 512/512 bytes at offset 0
- 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
- { 'execute': 'qmp_capabilities' }
-@@ -448,12 +440,10 @@ read 512/512 bytes at offset 0
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "src"}}
- {"return": {}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_READY", "data": {"device": "src", "len": 327680, "offset": 327680, "speed": 0, "type": "mirror"}}
- {"execute":"query-block-jobs"}
- {"return": [{"auto-finalize": true, "io-status": "ok", "device": "src", "auto-dismiss": true, "busy": false, "len": 327680, "offset": 327680, "status": "ready", "paused": false, "speed": 0, "ready": true, "type": "mirror", "actively-synced": false}]}
- {"execute":"quit"}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "standby", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "src"}}
-@@ -463,6 +453,7 @@ read 512/512 bytes at offset 0
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_CANCELLED", "data": {"device": "src", "len": 327680, "offset": 327680, "speed": 0, "type": "mirror"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "src"}}
-+{"return": {}}
- Images are identical.
- 
- === Copying sample image simple-pattern.cloop into raw ===
-@@ -471,7 +462,7 @@ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=SIZE
- { 'execute': 'qmp_capabilities' }
- {"return": {}}
- {'execute':'drive-mirror', 'arguments':{
--            'device': 'src', 'target': 'TEST_DIR/t.IMGFMT',
-+            'device': 'src', 'target': 'TEST_DIR/t.IMGFMT', 
-             'mode': 'existing', 'sync': 'full'}}
- WARNING: Image format was not specified for 'TEST_DIR/t.raw' and probing guessed raw.
-          Automatically detecting the format is dangerous for raw images, write operations on block 0 will be restricted.
-@@ -487,8 +478,8 @@ WARNING: Image format was not specified for 'TEST_DIR/t.raw' and probing guessed
- {"execute":"query-block-jobs"}
- {"return": []}
- {"execute":"quit"}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- read 512/512 bytes at offset 0
- 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
- { 'execute': 'qmp_capabilities' }
-@@ -499,12 +490,10 @@ read 512/512 bytes at offset 0
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "src"}}
- {"return": {}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_READY", "data": {"device": "src", "len": 2048, "offset": 2048, "speed": 0, "type": "mirror"}}
- {"execute":"query-block-jobs"}
- {"return": [{"auto-finalize": true, "io-status": "ok", "device": "src", "auto-dismiss": true, "busy": false, "len": 2048, "offset": 2048, "status": "ready", "paused": false, "speed": 0, "ready": true, "type": "mirror", "actively-synced": false}]}
- {"execute":"quit"}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "standby", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "src"}}
-@@ -514,6 +503,7 @@ read 512/512 bytes at offset 0
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_CANCELLED", "data": {"device": "src", "len": 2048, "offset": 2048, "speed": 0, "type": "mirror"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "src"}}
-+{"return": {}}
- Images are identical.
- 
- === Write legitimate MBR into raw ===
-@@ -522,7 +512,7 @@ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=SIZE
- { 'execute': 'qmp_capabilities' }
- {"return": {}}
- {'execute':'drive-mirror', 'arguments':{
--            'device': 'src', 'target': 'TEST_DIR/t.IMGFMT',
-+            'device': 'src', 'target': 'TEST_DIR/t.IMGFMT', 
-             'mode': 'existing', 'sync': 'full'}}
- WARNING: Image format was not specified for 'TEST_DIR/t.raw' and probing guessed raw.
-          Automatically detecting the format is dangerous for raw images, write operations on block 0 will be restricted.
-@@ -530,12 +520,10 @@ WARNING: Image format was not specified for 'TEST_DIR/t.raw' and probing guessed
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "src"}}
- {"return": {}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_READY", "data": {"device": "src", "len": 512, "offset": 512, "speed": 0, "type": "mirror"}}
- {"execute":"query-block-jobs"}
- {"return": [{"auto-finalize": true, "io-status": "ok", "device": "src", "auto-dismiss": true, "busy": false, "len": 512, "offset": 512, "status": "ready", "paused": false, "speed": 0, "ready": true, "type": "mirror", "actively-synced": false}]}
- {"execute":"quit"}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "standby", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "src"}}
-@@ -545,6 +533,7 @@ WARNING: Image format was not specified for 'TEST_DIR/t.raw' and probing guessed
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_CANCELLED", "data": {"device": "src", "len": 512, "offset": 512, "speed": 0, "type": "mirror"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "src"}}
-+{"return": {}}
- Images are identical.
- { 'execute': 'qmp_capabilities' }
- {"return": {}}
-@@ -554,12 +543,10 @@ Images are identical.
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "src"}}
- {"return": {}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_READY", "data": {"device": "src", "len": 512, "offset": 512, "speed": 0, "type": "mirror"}}
- {"execute":"query-block-jobs"}
- {"return": [{"auto-finalize": true, "io-status": "ok", "device": "src", "auto-dismiss": true, "busy": false, "len": 512, "offset": 512, "status": "ready", "paused": false, "speed": 0, "ready": true, "type": "mirror", "actively-synced": false}]}
- {"execute":"quit"}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "standby", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "ready", "id": "src"}}
-@@ -569,5 +556,6 @@ Images are identical.
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_CANCELLED", "data": {"device": "src", "len": 512, "offset": 512, "speed": 0, "type": "mirror"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "src"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "src"}}
-+{"return": {}}
- Images are identical.
- *** done
-diff --git a/tests/qemu-iotests/117.out b/tests/qemu-iotests/117.out
-index 735ffd25c6..1cea9e0217 100644
---- a/tests/qemu-iotests/117.out
-+++ b/tests/qemu-iotests/117.out
-@@ -18,8 +18,8 @@ wrote 65536/65536 bytes at offset 0
- 64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
- {"return": ""}
- { 'execute': 'quit' }
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- No errors were found on the image.
- read 65536/65536 bytes at offset 0
- 64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-diff --git a/tests/qemu-iotests/120.out b/tests/qemu-iotests/120.out
-index 0744c1f136..35d84a5bc5 100644
---- a/tests/qemu-iotests/120.out
-+++ b/tests/qemu-iotests/120.out
-@@ -5,8 +5,8 @@ QMP_VERSION
- wrote 65536/65536 bytes at offset 0
- 64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
- {"return": ""}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- read 65536/65536 bytes at offset 0
- 64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
- read 65536/65536 bytes at offset 0
-diff --git a/tests/qemu-iotests/127.out b/tests/qemu-iotests/127.out
-index 1685c4850a..dd8c4a8aa9 100644
---- a/tests/qemu-iotests/127.out
-+++ b/tests/qemu-iotests/127.out
-@@ -28,6 +28,6 @@ wrote 42/42 bytes at offset 0
- { 'execute': 'quit' }
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "mirror"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "mirror"}}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- *** done
-diff --git a/tests/qemu-iotests/140.out b/tests/qemu-iotests/140.out
-index 312f76d5da..32866440ae 100644
---- a/tests/qemu-iotests/140.out
-+++ b/tests/qemu-iotests/140.out
-@@ -19,6 +19,6 @@ read 65536/65536 bytes at offset 0
- qemu-io: can't open device nbd+unix:///drv?socket=SOCK_DIR/nbd: Requested export not available
- server reported: export 'drv' not present
- { 'execute': 'quit' }
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- *** done
-diff --git a/tests/qemu-iotests/143.out b/tests/qemu-iotests/143.out
-index 9ec5888e0e..d6afa32abc 100644
---- a/tests/qemu-iotests/143.out
-+++ b/tests/qemu-iotests/143.out
-@@ -10,6 +10,6 @@ server reported: export 'no_such_export' not present
- qemu-io: can't open device nbd+unix:///aa--aa1?socket=SOCK_DIR/nbd: Requested export not available
- server reported: export 'aa--aa...' not present
- { 'execute': 'quit' }
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- *** done
-diff --git a/tests/qemu-iotests/156.out b/tests/qemu-iotests/156.out
-index 4a22f0c41a..07e5e83f5d 100644
---- a/tests/qemu-iotests/156.out
-+++ b/tests/qemu-iotests/156.out
-@@ -72,8 +72,8 @@ read 65536/65536 bytes at offset 196608
- {"return": ""}
- 
- { 'execute': 'quit' }
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- 
- read 65536/65536 bytes at offset 0
- 64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-diff --git a/tests/qemu-iotests/176.out b/tests/qemu-iotests/176.out
-index 9d09b60452..45e9153ef3 100644
---- a/tests/qemu-iotests/176.out
-+++ b/tests/qemu-iotests/176.out
-@@ -169,8 +169,8 @@ QMP_VERSION
- {"return": {}}
- {"return": {}}
- {"return": {}}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- wrote 196608/196608 bytes at offset 2147287040
- 192 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
- wrote 131072/131072 bytes at offset 2147352576
-@@ -206,8 +206,8 @@ QMP_VERSION
- {"return": {}}
- {"return": {}}
- {"return": {"sha256": HASH}}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- 
- === Test pass bitmap.1 ===
- 
-@@ -218,8 +218,8 @@ QMP_VERSION
- {"return": {}}
- {"return": {}}
- {"return": {}}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- wrote 196608/196608 bytes at offset 2147287040
- 192 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
- wrote 131072/131072 bytes at offset 2147352576
-@@ -256,8 +256,8 @@ QMP_VERSION
- {"return": {}}
- {"return": {}}
- {"return": {"sha256": HASH}}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- 
- === Test pass bitmap.2 ===
- 
-@@ -268,8 +268,8 @@ QMP_VERSION
- {"return": {}}
- {"return": {}}
- {"return": {}}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- wrote 196608/196608 bytes at offset 2147287040
- 192 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
- wrote 131072/131072 bytes at offset 2147352576
-@@ -306,8 +306,8 @@ QMP_VERSION
- {"return": {}}
- {"return": {}}
- {"return": {"sha256": HASH}}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- 
- === Test pass bitmap.3 ===
- 
-@@ -318,8 +318,8 @@ QMP_VERSION
- {"return": {}}
- {"return": {}}
- {"return": {}}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- wrote 196608/196608 bytes at offset 2147287040
- 192 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
- wrote 131072/131072 bytes at offset 2147352576
-@@ -353,6 +353,6 @@ QMP_VERSION
- {"return": {}}
- {"return": {}}
- {"return": {"sha256": HASH}}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- *** done
-diff --git a/tests/qemu-iotests/182.out b/tests/qemu-iotests/182.out
-index 57f7265458..83fc1a4797 100644
---- a/tests/qemu-iotests/182.out
-+++ b/tests/qemu-iotests/182.out
-@@ -53,6 +53,6 @@ Formatting 'TEST_DIR/t.qcow2.overlay', fmt=qcow2 cluster_size=65536 extended_l2=
- {'execute': 'qmp_capabilities'}
- {"return": {}}
- {'execute': 'quit'}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- *** done
-diff --git a/tests/qemu-iotests/183.out b/tests/qemu-iotests/183.out
-index fd9c2e52a5..51aa41c888 100644
---- a/tests/qemu-iotests/183.out
-+++ b/tests/qemu-iotests/183.out
-@@ -53,11 +53,11 @@ wrote 65536/65536 bytes at offset 1048576
- === Shut down and check image ===
- 
- {"execute":"quit"}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
- {"return": {}}
- {"execute":"quit"}
--{"return": {}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- No errors were found on the image.
- No errors were found on the image.
- wrote 65536/65536 bytes at offset 1048576
-diff --git a/tests/qemu-iotests/184.out b/tests/qemu-iotests/184.out
-index 77e5489d65..e8f631f853 100644
---- a/tests/qemu-iotests/184.out
-+++ b/tests/qemu-iotests/184.out
-@@ -89,10 +89,6 @@ Testing:
-     "return": [
-     ]
- }
--{
--    "return": {
--    }
--}
- {
-     "timestamp": {
-         "seconds":  TIMESTAMP,
-@@ -104,6 +100,10 @@ Testing:
-         "reason": "host-qmp-quit"
-     }
- }
-+{
-+    "return": {
-+    }
-+}
- 
- 
- == property changes in ThrottleGroup ==
-@@ -169,10 +169,6 @@ Testing:
-         "iops-total-max": 0
-     }
- }
--{
--    "return": {
--    }
--}
- {
-     "timestamp": {
-         "seconds":  TIMESTAMP,
-@@ -184,6 +180,10 @@ Testing:
-         "reason": "host-qmp-quit"
-     }
- }
-+{
-+    "return": {
-+    }
-+}
- 
- 
- == object creation/set errors  ==
-@@ -211,10 +211,6 @@ Testing:
-         "desc": "bps/iops/max total values and read/write values cannot be used at the same time"
-     }
- }
--{
--    "return": {
--    }
--}
- {
-     "timestamp": {
-         "seconds":  TIMESTAMP,
-@@ -226,6 +222,10 @@ Testing:
-         "reason": "host-qmp-quit"
-     }
- }
-+{
-+    "return": {
-+    }
-+}
- 
- 
- == don't specify group ==
-@@ -247,10 +247,6 @@ Testing:
-         "desc": "Parameter 'throttle-group' is missing"
-     }
- }
--{
--    "return": {
--    }
--}
- {
-     "timestamp": {
-         "seconds":  TIMESTAMP,
-@@ -262,6 +258,10 @@ Testing:
-         "reason": "host-qmp-quit"
-     }
- }
-+{
-+    "return": {
-+    }
-+}
- 
- 
- *** done
-diff --git a/tests/qemu-iotests/185 b/tests/qemu-iotests/185
-index 2ae0a85bbf..17489fb91c 100755
---- a/tests/qemu-iotests/185
-+++ b/tests/qemu-iotests/185
-@@ -344,14 +344,14 @@ wait_for_job_and_quit() {
- 
-     sleep 1
- 
-+    # List of expected events
-+    capture_events='BLOCK_JOB_CANCELLED JOB_STATUS_CHANGE SHUTDOWN'
-+
-     _send_qemu_cmd $h \
-         '{"execute": "quit"}' \
-         'return'
- 
--    # List of expected events
--    capture_events='BLOCK_JOB_CANCELLED JOB_STATUS_CHANGE SHUTDOWN'
-     _wait_event $h 'SHUTDOWN'
--    QEMU_EVENTS= # Ignore all JOB_STATUS_CHANGE events that came before SHUTDOWN
-     _wait_event $h 'JOB_STATUS_CHANGE' # standby
-     _wait_event $h 'JOB_STATUS_CHANGE' # ready
-     _wait_event $h 'JOB_STATUS_CHANGE' # standby
-diff --git a/tests/qemu-iotests/185.out b/tests/qemu-iotests/185.out
-index 7292c26bae..6af0953c4d 100644
---- a/tests/qemu-iotests/185.out
-+++ b/tests/qemu-iotests/185.out
-@@ -40,9 +40,16 @@ Formatting 'TEST_DIR/t.qcow2', fmt=qcow2 cluster_size=65536 extended_l2=off comp
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "disk"}}
- {"return": {}}
- { 'execute': 'quit' }
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "paused", "id": "disk"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "disk"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "paused", "id": "disk"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "disk"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "aborting", "id": "disk"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_CANCELLED", "data": {"device": "disk", "len": 67108864, "offset": 524288, "speed": 65536, "type": "commit"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "disk"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "disk"}}
-+{"return": {}}
- 
- === Start active commit job and exit qemu ===
- 
-@@ -56,9 +63,16 @@ Formatting 'TEST_DIR/t.qcow2', fmt=qcow2 cluster_size=65536 extended_l2=off comp
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "disk"}}
- {"return": {}}
- { 'execute': 'quit' }
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "paused", "id": "disk"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "disk"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "paused", "id": "disk"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "disk"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "aborting", "id": "disk"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_CANCELLED", "data": {"device": "disk", "len": 4194304, "offset": 4194304, "speed": 65536, "type": "commit"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "disk"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "disk"}}
-+{"return": {}}
- 
- === Start mirror job and exit qemu ===
- 
-@@ -75,9 +89,16 @@ Formatting 'TEST_DIR/t.qcow2.copy', fmt=qcow2 cluster_size=65536 extended_l2=off
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "disk"}}
- {"return": {}}
- { 'execute': 'quit' }
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "paused", "id": "disk"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "disk"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "paused", "id": "disk"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "disk"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "aborting", "id": "disk"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_CANCELLED", "data": {"device": "disk", "len": 4194304, "offset": 4194304, "speed": 65536, "type": "mirror"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "disk"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "disk"}}
-+{"return": {}}
- 
- === Start backup job and exit qemu ===
- 
-@@ -97,9 +118,16 @@ Formatting 'TEST_DIR/t.qcow2.copy', fmt=qcow2 cluster_size=65536 extended_l2=off
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "disk"}}
- {"return": {}}
- { 'execute': 'quit' }
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "paused", "id": "disk"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "disk"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "paused", "id": "disk"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "disk"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "aborting", "id": "disk"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_CANCELLED", "data": {"device": "disk", "len": 67108864, "offset": 65536, "speed": 65536, "type": "backup"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "disk"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "disk"}}
-+{"return": {}}
- 
- === Start streaming job and exit qemu ===
- 
-@@ -112,9 +140,16 @@ Formatting 'TEST_DIR/t.qcow2.copy', fmt=qcow2 cluster_size=65536 extended_l2=off
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "disk"}}
- {"return": {}}
- { 'execute': 'quit' }
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "paused", "id": "disk"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "disk"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "paused", "id": "disk"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "disk"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "aborting", "id": "disk"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_CANCELLED", "data": {"device": "disk", "len": 67108864, "offset": 524288, "speed": 65536, "type": "stream"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "disk"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "disk"}}
-+{"return": {}}
- No errors were found on the image.
- 
- === Start mirror to throttled QSD and exit qemu ===
-diff --git a/tests/qemu-iotests/191.out b/tests/qemu-iotests/191.out
-index ea88777374..c3309e4bc6 100644
---- a/tests/qemu-iotests/191.out
-+++ b/tests/qemu-iotests/191.out
-@@ -378,10 +378,6 @@ wrote 65536/65536 bytes at offset 1048576
-     ]
- }
- { 'execute': 'quit' }
--{
--    "return": {
--    }
--}
- {
-     "timestamp": {
-         "seconds":  TIMESTAMP,
-@@ -393,6 +389,10 @@ wrote 65536/65536 bytes at offset 1048576
-         "reason": "host-qmp-quit"
-     }
- }
-+{
-+    "return": {
-+    }
-+}
- image: TEST_DIR/t.IMGFMT
- file format: IMGFMT
- virtual size: 64 MiB (67108864 bytes)
-@@ -796,10 +796,6 @@ wrote 65536/65536 bytes at offset 1048576
-     ]
- }
- { 'execute': 'quit' }
--{
--    "return": {
--    }
--}
- {
-     "timestamp": {
-         "seconds":  TIMESTAMP,
-@@ -811,6 +807,10 @@ wrote 65536/65536 bytes at offset 1048576
-         "reason": "host-qmp-quit"
-     }
- }
-+{
-+    "return": {
-+    }
-+}
- image: TEST_DIR/t.IMGFMT
- file format: IMGFMT
- virtual size: 64 MiB (67108864 bytes)
-diff --git a/tests/qemu-iotests/195.out b/tests/qemu-iotests/195.out
-index ec84df5012..91717d302e 100644
---- a/tests/qemu-iotests/195.out
-+++ b/tests/qemu-iotests/195.out
-@@ -17,10 +17,6 @@ Testing: -drive if=none,file=TEST_DIR/t.IMGFMT,backing.node-name=mid
-     "return": {
-     }
- }
--{
--    "return": {
--    }
--}
- {
-     "timestamp": {
-         "seconds":  TIMESTAMP,
-@@ -32,6 +28,10 @@ Testing: -drive if=none,file=TEST_DIR/t.IMGFMT,backing.node-name=mid
-         "reason": "host-qmp-quit"
-     }
- }
-+{
-+    "return": {
-+    }
-+}
- 
- image: TEST_DIR/t.IMGFMT.mid
- file format: IMGFMT
-@@ -55,10 +55,6 @@ Testing: -drive if=none,file=TEST_DIR/t.IMGFMT,node-name=top
-     "return": {
-     }
- }
--{
--    "return": {
--    }
--}
- {
-     "timestamp": {
-         "seconds":  TIMESTAMP,
-@@ -70,6 +66,10 @@ Testing: -drive if=none,file=TEST_DIR/t.IMGFMT,node-name=top
-         "reason": "host-qmp-quit"
-     }
- }
-+{
-+    "return": {
-+    }
-+}
- 
- image: TEST_DIR/t.IMGFMT
- file format: IMGFMT
-diff --git a/tests/qemu-iotests/223.out b/tests/qemu-iotests/223.out
-index e5e7f42caa..5f5b42e2dc 100644
---- a/tests/qemu-iotests/223.out
-+++ b/tests/qemu-iotests/223.out
-@@ -11,8 +11,8 @@ QMP_VERSION
- {"return": {}}
- {"return": {}}
- {"return": {}}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- 
- 
- === Write part of the file under active bitmap ===
-@@ -145,14 +145,14 @@ read 2097152/2097152 bytes at offset 2097152
- 
- {"execute":"nbd-server-remove",
-   "arguments":{"name":"n"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_EXPORT_DELETED", "data": {"id": "n"}}
- {"return": {}}
- {"execute":"nbd-server-remove",
-   "arguments":{"name":"n2"}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_EXPORT_DELETED", "data": {"id": "n"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_EXPORT_DELETED", "data": {"id": "n2"}}
- {"return": {}}
- {"execute":"nbd-server-remove",
-   "arguments":{"name":"n2"}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_EXPORT_DELETED", "data": {"id": "n2"}}
- {"error": {"class": "GenericError", "desc": "Export 'n2' is not found"}}
- {"execute":"nbd-server-stop"}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_EXPORT_DELETED", "data": {"id": "n3"}}
-@@ -267,14 +267,14 @@ read 2097152/2097152 bytes at offset 2097152
- 
- {"execute":"nbd-server-remove",
-   "arguments":{"name":"n"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_EXPORT_DELETED", "data": {"id": "n"}}
- {"return": {}}
- {"execute":"nbd-server-remove",
-   "arguments":{"name":"n2"}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_EXPORT_DELETED", "data": {"id": "n"}}
-+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_EXPORT_DELETED", "data": {"id": "n2"}}
- {"return": {}}
- {"execute":"nbd-server-remove",
-   "arguments":{"name":"n2"}}
--{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_EXPORT_DELETED", "data": {"id": "n2"}}
- {"error": {"class": "GenericError", "desc": "Export 'n2' is not found"}}
- {"execute":"nbd-server-stop"}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_EXPORT_DELETED", "data": {"id": "n3"}}
-@@ -282,8 +282,8 @@ read 2097152/2097152 bytes at offset 2097152
- {"execute":"nbd-server-stop"}
- {"error": {"class": "GenericError", "desc": "NBD server not running"}}
- {"execute":"quit"}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- 
- === Use qemu-nbd as server ===
- 
-diff --git a/tests/qemu-iotests/227.out b/tests/qemu-iotests/227.out
-index a947b1a87d..d6a1d4ecb6 100644
---- a/tests/qemu-iotests/227.out
-+++ b/tests/qemu-iotests/227.out
-@@ -54,10 +54,6 @@ Testing: -drive driver=null-co,read-zeroes=on,if=virtio
-         }
-     ]
- }
--{
--    "return": {
--    }
--}
- {
-     "timestamp": {
-         "seconds":  TIMESTAMP,
-@@ -69,6 +65,10 @@ Testing: -drive driver=null-co,read-zeroes=on,if=virtio
-         "reason": "host-qmp-quit"
-     }
- }
-+{
-+    "return": {
-+    }
-+}
- 
- 
- === blockstats with -drive if=none ===
-@@ -124,10 +124,6 @@ Testing: -drive driver=null-co,if=none
-         }
-     ]
- }
--{
--    "return": {
--    }
--}
- {
-     "timestamp": {
-         "seconds":  TIMESTAMP,
-@@ -139,6 +135,10 @@ Testing: -drive driver=null-co,if=none
-         "reason": "host-qmp-quit"
-     }
- }
-+{
-+    "return": {
-+    }
-+}
- 
- 
- === blockstats with -blockdev ===
-@@ -155,10 +155,6 @@ Testing: -blockdev driver=null-co,node-name=null
-     "return": [
-     ]
- }
--{
--    "return": {
--    }
--}
- {
-     "timestamp": {
-         "seconds":  TIMESTAMP,
-@@ -170,6 +166,10 @@ Testing: -blockdev driver=null-co,node-name=null
-         "reason": "host-qmp-quit"
-     }
- }
-+{
-+    "return": {
-+    }
-+}
- 
- 
- === blockstats with -blockdev and -device ===
-@@ -226,10 +226,6 @@ Testing: -blockdev driver=null-co,read-zeroes=on,node-name=null -device virtio-b
-         }
-     ]
- }
--{
--    "return": {
--    }
--}
- {
-     "timestamp": {
-         "seconds":  TIMESTAMP,
-@@ -241,5 +237,9 @@ Testing: -blockdev driver=null-co,read-zeroes=on,node-name=null -device virtio-b
-         "reason": "host-qmp-quit"
-     }
- }
-+{
-+    "return": {
-+    }
-+}
- 
- *** done
-diff --git a/tests/qemu-iotests/247.out b/tests/qemu-iotests/247.out
-index e909e83994..7d252e7fe4 100644
---- a/tests/qemu-iotests/247.out
-+++ b/tests/qemu-iotests/247.out
-@@ -17,6 +17,6 @@ QMP_VERSION
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_COMPLETED", "data": {"device": "job0", "len": 134217728, "offset": 134217728, "speed": 0, "type": "commit"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "job0"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "job0"}}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- *** done
-diff --git a/tests/qemu-iotests/273.out b/tests/qemu-iotests/273.out
-index 6a74a8138b..71843f02de 100644
---- a/tests/qemu-iotests/273.out
-+++ b/tests/qemu-iotests/273.out
-@@ -282,10 +282,6 @@ Testing: -blockdev file,node-name=base,filename=TEST_DIR/t.IMGFMT.base -blockdev
-         ]
-     }
- }
--{
--    "return": {
--    }
--}
- {
-     "timestamp": {
-         "seconds":  TIMESTAMP,
-@@ -297,5 +293,9 @@ Testing: -blockdev file,node-name=base,filename=TEST_DIR/t.IMGFMT.base -blockdev
-         "reason": "host-qmp-quit"
-     }
- }
-+{
-+    "return": {
-+    }
-+}
- 
- *** done
-diff --git a/tests/qemu-iotests/308 b/tests/qemu-iotests/308
-index de12b2b1b9..ea81dc496a 100755
---- a/tests/qemu-iotests/308
-+++ b/tests/qemu-iotests/308
-@@ -77,6 +77,7 @@ fuse_export_add()
- # $1: Export ID
- fuse_export_del()
- {
-+    capture_events="BLOCK_EXPORT_DELETED" \
-     _send_qemu_cmd $QEMU_HANDLE \
-         "{'execute': 'block-export-del',
-           'arguments': {
-@@ -84,8 +85,7 @@ fuse_export_del()
-           } }" \
-         'return'
- 
--    _send_qemu_cmd $QEMU_HANDLE \
--        '' \
-+    _wait_event $QEMU_HANDLE \
-         'BLOCK_EXPORT_DELETED'
- }
- 
-diff --git a/tests/qemu-iotests/308.out b/tests/qemu-iotests/308.out
-index d5767133b1..e5e233691d 100644
---- a/tests/qemu-iotests/308.out
-+++ b/tests/qemu-iotests/308.out
-@@ -165,9 +165,9 @@ OK: Post-truncate image size is as expected
- 
- === Tear down ===
- {'execute': 'quit'}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_EXPORT_DELETED", "data": {"id": "export-mp"}}
-+{"return": {}}
- 
- === Compare copy with original ===
- Images are identical.
-@@ -201,9 +201,9 @@ wrote 67108864/67108864 bytes at offset 0
- read 67108864/67108864 bytes at offset 0
- 64 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
- {'execute': 'quit'}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_EXPORT_DELETED", "data": {"id": "export"}}
-+{"return": {}}
- read 67108864/67108864 bytes at offset 0
- 64 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
- *** done
-diff --git a/tests/qemu-iotests/tests/file-io-error b/tests/qemu-iotests/tests/file-io-error
-index 88ee5f670c..fb8db73b31 100755
---- a/tests/qemu-iotests/tests/file-io-error
-+++ b/tests/qemu-iotests/tests/file-io-error
-@@ -99,13 +99,12 @@ echo
- $QEMU_IO -f file -c 'write 0 64M' "$TEST_DIR/fuse-export" | _filter_qemu_io
- echo
- 
--_send_qemu_cmd $QEMU_HANDLE \
-+capture_events=BLOCK_EXPORT_DELETED _send_qemu_cmd $QEMU_HANDLE \
-     "{'execute': 'block-export-del',
-       'arguments': {'id': 'exp0'}}" \
-     'return'
- 
--_send_qemu_cmd $QEMU_HANDLE \
--    '' \
-+_wait_event $QEMU_HANDLE \
-     'BLOCK_EXPORT_DELETED'
- 
- _send_qemu_cmd $QEMU_HANDLE \
-diff --git a/tests/qemu-iotests/tests/iothreads-resize.out b/tests/qemu-iotests/tests/iothreads-resize.out
-index 2ca5a9d964..2967ac8f0d 100644
---- a/tests/qemu-iotests/tests/iothreads-resize.out
-+++ b/tests/qemu-iotests/tests/iothreads-resize.out
-@@ -3,8 +3,8 @@ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
- QMP_VERSION
- {"return": {}}
- {"return": {}}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
-+{"return": {}}
- image: TEST_DIR/t.IMGFMT
- file format: IMGFMT
- virtual size: 128 MiB (134217728 bytes)
-diff --git a/tests/qemu-iotests/tests/qsd-jobs.out b/tests/qemu-iotests/tests/qsd-jobs.out
-index c1bc9b8356..aa6b6d1aef 100644
---- a/tests/qemu-iotests/tests/qsd-jobs.out
-+++ b/tests/qemu-iotests/tests/qsd-jobs.out
-@@ -7,8 +7,8 @@ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/
- QMP_VERSION
- {"return": {}}
- {"return": {}}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_JOB_CANCELLED", "data": {"device": "job0", "len": 0, "offset": 0, "speed": 0, "type": "commit"}}
-+{"return": {}}
- 
- === Streaming can't get permission on base node ===
- 
-@@ -17,6 +17,6 @@ QMP_VERSION
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "job0"}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "job0"}}
- {"error": {"class": "GenericError", "desc": "Permission conflict on node 'fmt_base': permissions 'write' are both required by an unnamed block device (uses node 'fmt_base' as 'root' child) and unshared by stream job 'job0' (uses node 'fmt_base' as 'intermediate node' child)."}}
--{"return": {}}
- {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_EXPORT_DELETED", "data": {"id": "export1"}}
-+{"return": {}}
- *** done
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-nbd-server-CVE-2024-7409-Avoid-use-after-free-when-c.patch b/SOURCES/kvm-nbd-server-CVE-2024-7409-Avoid-use-after-free-when-c.patch
new file mode 100644
index 0000000..f65d293
--- /dev/null
+++ b/SOURCES/kvm-nbd-server-CVE-2024-7409-Avoid-use-after-free-when-c.patch
@@ -0,0 +1,101 @@
+From 6f60c86c5dd747ba68cb4a11084e7b021769e70b Mon Sep 17 00:00:00 2001
+From: Eric Blake <eblake@redhat.com>
+Date: Thu, 22 Aug 2024 09:35:29 -0500
+Subject: [PATCH] nbd/server: CVE-2024-7409: Avoid use-after-free when closing
+ server
+
+RH-Author: Eric Blake <eblake@redhat.com>
+RH-MergeRequest: 266: nbd/server: CVE-2024-7409: Avoid use-after-free when closing server
+RH-Jira: RHEL-52617
+RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
+RH-Commit: [1/1] e6e12c985cd13dd14336d98ab0719c789b5e914d (ebblake/centos-qemu-kvm)
+
+Commit 3e7ef738 plugged the use-after-free of the global nbd_server
+object, but overlooked a use-after-free of nbd_server->listener.
+Although this race is harder to hit, notice that our shutdown path
+first drops the reference count of nbd_server->listener, then triggers
+actions that can result in a pending client reaching the
+nbd_blockdev_client_closed() callback, which in turn calls
+qio_net_listener_set_client_func on a potentially stale object.
+
+If we know we don't want any more clients to connect, and have already
+told the listener socket to shut down, then we should not be trying to
+update the listener socket's associated function.
+
+Reproducer:
+
+> #!/usr/bin/python3
+>
+> import os
+> from threading import Thread
+>
+> def start_stop():
+>     while 1:
+>         os.system('virsh qemu-monitor-command VM \'{"execute": "nbd-server-start",
++"arguments":{"addr":{"type":"unix","data":{"path":"/tmp/nbd-sock"}}}}\'')
+>         os.system('virsh qemu-monitor-command VM \'{"execute": "nbd-server-stop"}\'')
+>
+> def nbd_list():
+>     while 1:
+>         os.system('/path/to/build/qemu-nbd -L -k /tmp/nbd-sock')
+>
+> def test():
+>     sst = Thread(target=start_stop)
+>     sst.start()
+>     nlt = Thread(target=nbd_list)
+>     nlt.start()
+>
+>     sst.join()
+>     nlt.join()
+>
+> test()
+
+Fixes: CVE-2024-7409
+Fixes: 3e7ef738c8 ("nbd/server: CVE-2024-7409: Close stray clients at server-stop")
+CC: qemu-stable@nongnu.org
+Reported-by: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>
+Signed-off-by: Eric Blake <eblake@redhat.com>
+Message-ID: <20240822143617.800419-2-eblake@redhat.com>
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+
+(cherry picked from commit 3874f5f73c441c52f1c699c848d463b0eda01e4c)
+Jira: https://issues.redhat.com/browse/RHEL-52617
+Signed-off-by: Eric Blake <eblake@redhat.com>
+---
+ blockdev-nbd.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/blockdev-nbd.c b/blockdev-nbd.c
+index f73409ae49..b36f41b7c5 100644
+--- a/blockdev-nbd.c
++++ b/blockdev-nbd.c
+@@ -92,10 +92,13 @@ static void nbd_accept(QIONetListener *listener, QIOChannelSocket *cioc,
+ 
+ static void nbd_update_server_watch(NBDServerData *s)
+ {
+-    if (!s->max_connections || s->connections < s->max_connections) {
+-        qio_net_listener_set_client_func(s->listener, nbd_accept, NULL, NULL);
+-    } else {
+-        qio_net_listener_set_client_func(s->listener, NULL, NULL, NULL);
++    if (s->listener) {
++        if (!s->max_connections || s->connections < s->max_connections) {
++            qio_net_listener_set_client_func(s->listener, nbd_accept, NULL,
++                                             NULL);
++        } else {
++            qio_net_listener_set_client_func(s->listener, NULL, NULL, NULL);
++        }
+     }
+ }
+ 
+@@ -113,6 +116,7 @@ static void nbd_server_free(NBDServerData *server)
+      */
+     qio_net_listener_disconnect(server->listener);
+     object_unref(OBJECT(server->listener));
++    server->listener = NULL;
+     QLIST_FOREACH_SAFE(conn, &server->conns, next, tmp) {
+         qio_channel_shutdown(QIO_CHANNEL(conn->cioc), QIO_CHANNEL_SHUTDOWN_BOTH,
+                              NULL);
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-nbd-server-CVE-2024-7409-Cap-default-max-connections.patch b/SOURCES/kvm-nbd-server-CVE-2024-7409-Cap-default-max-connections.patch
index 7098ffc..5459a51 100644
--- a/SOURCES/kvm-nbd-server-CVE-2024-7409-Cap-default-max-connections.patch
+++ b/SOURCES/kvm-nbd-server-CVE-2024-7409-Cap-default-max-connections.patch
@@ -1,17 +1,17 @@
-From 3311ddaffa78ad8d2c40c86cd69461ebeabe1052 Mon Sep 17 00:00:00 2001
+From f76d73f62555ad73081558c1f56bcb832fbb8c35 Mon Sep 17 00:00:00 2001
 From: Eric Blake <eblake@redhat.com>
 Date: Tue, 6 Aug 2024 13:53:00 -0500
-Subject: [PATCH 3/5] nbd/server: CVE-2024-7409: Cap default max-connections to
- 100
+Subject: [PATCH 098/100] nbd/server: CVE-2024-7409: Cap default
+ max-connections to 100
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 
 RH-Author: Eric Blake <eblake@redhat.com>
-RH-MergeRequest: 386: nbd/server: fix CVE-2024-7409 (qemu crash on nbd-server-stop) [rhel-9.4.z]
-RH-Jira: RHEL-52616
+RH-MergeRequest: 262: nbd/server: fix CVE-2024-7409 (qemu crash on nbd-server-stop)
+RH-Jira: RHEL-52617
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [2/4] 17c9c81282e180485e2f2d584a3e0c73a6fbd66a (ebblake/qemu-kvm)
+RH-Commit: [2/4] 1fb3b8cd9781a66bba2f4a6bee2b320e96de86aa (redhat/centos-stream/src/qemu-kvm)
 
 Allowing an unlimited number of clients to any web service is a recipe
 for a rudimentary denial of service attack: the client merely needs to
@@ -90,7 +90,7 @@ break corner-case back-compat behavior without a deprecation period]
 Signed-off-by: Eric Blake <eblake@redhat.com>
 
 (cherry picked from commit c8a76dbd90c2f48df89b75bef74917f90a59b623)
-Jira: https://issues.redhat.com/browse/RHEL-52616
+Jira: https://issues.redhat.com/browse/RHEL-52617
 Signed-off-by: Eric Blake <eblake@redhat.com>
 ---
  block/monitor/block-hmp-cmds.c | 3 ++-
@@ -100,7 +100,7 @@ Signed-off-by: Eric Blake <eblake@redhat.com>
  4 files changed, 19 insertions(+), 3 deletions(-)
 
 diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
-index bdbb5cb141..2d7b4d80c8 100644
+index d954bec6f1..bdf2eb50b6 100644
 --- a/block/monitor/block-hmp-cmds.c
 +++ b/block/monitor/block-hmp-cmds.c
 @@ -402,7 +402,8 @@ void hmp_nbd_server_start(Monitor *mon, const QDict *qdict)
@@ -158,7 +158,7 @@ index 1d4d65922d..d4f8b21aec 100644
  
  typedef struct NBDOption {
 diff --git a/qapi/block-export.json b/qapi/block-export.json
-index 7874a49ba7..1d255d77e3 100644
+index 3919a2d5b9..f45e4fd481 100644
 --- a/qapi/block-export.json
 +++ b/qapi/block-export.json
 @@ -28,7 +28,7 @@
@@ -177,8 +177,8 @@ index 7874a49ba7..1d255d77e3 100644
 -#     default: 0).
 +#     default: 100).
  #
- # Returns: error if the server is already running.
- #
+ # Errors:
+ #     - if the server is already running
 -- 
 2.39.3
 
diff --git a/SOURCES/kvm-nbd-server-CVE-2024-7409-Close-stray-clients-at-serv.patch b/SOURCES/kvm-nbd-server-CVE-2024-7409-Close-stray-clients-at-serv.patch
index 834eae3..2ba16e5 100644
--- a/SOURCES/kvm-nbd-server-CVE-2024-7409-Close-stray-clients-at-serv.patch
+++ b/SOURCES/kvm-nbd-server-CVE-2024-7409-Close-stray-clients-at-serv.patch
@@ -1,17 +1,17 @@
-From 1c2fe81349a99cf0c28549426c7ad0c06d942ae3 Mon Sep 17 00:00:00 2001
+From 6522c68268f00c9c5665f8f98cf6ed1984124cf3 Mon Sep 17 00:00:00 2001
 From: Eric Blake <eblake@redhat.com>
 Date: Wed, 7 Aug 2024 12:23:13 -0500
-Subject: [PATCH 5/5] nbd/server: CVE-2024-7409: Close stray clients at
+Subject: [PATCH 100/100] nbd/server: CVE-2024-7409: Close stray clients at
  server-stop
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 
 RH-Author: Eric Blake <eblake@redhat.com>
-RH-MergeRequest: 386: nbd/server: fix CVE-2024-7409 (qemu crash on nbd-server-stop) [rhel-9.4.z]
-RH-Jira: RHEL-52616
+RH-MergeRequest: 262: nbd/server: fix CVE-2024-7409 (qemu crash on nbd-server-stop)
+RH-Jira: RHEL-52617
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [4/4] 54d56c0d92d92b2b6a0f81a01853881286beae0e (ebblake/qemu-kvm)
+RH-Commit: [4/4] c00bb5a7e73446e9f071ef83e4f1576f73a17059 (redhat/centos-stream/src/qemu-kvm)
 
 A malicious client can attempt to connect to an NBD server, and then
 intentionally delay progress in the handshake, including if it does
@@ -76,7 +76,7 @@ Message-ID: <20240807174943.771624-14-eblake@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 
 (cherry picked from commit 3e7ef738c8462c45043a1d39f702a0990406a3b3)
-Jira: https://issues.redhat.com/browse/RHEL-52616
+Jira: https://issues.redhat.com/browse/RHEL-52617
 Signed-off-by: Eric Blake <eblake@redhat.com>
 ---
  blockdev-nbd.c | 35 ++++++++++++++++++++++++++++++++++-
diff --git a/SOURCES/kvm-nbd-server-CVE-2024-7409-Drop-non-negotiating-client.patch b/SOURCES/kvm-nbd-server-CVE-2024-7409-Drop-non-negotiating-client.patch
index 0b2261e..e1755c2 100644
--- a/SOURCES/kvm-nbd-server-CVE-2024-7409-Drop-non-negotiating-client.patch
+++ b/SOURCES/kvm-nbd-server-CVE-2024-7409-Drop-non-negotiating-client.patch
@@ -1,16 +1,17 @@
-From 71c525e45f3f2a421ad651bc50eff94be925b36c Mon Sep 17 00:00:00 2001
+From ca30846351f1136d15f55717a5534ad927f7cf52 Mon Sep 17 00:00:00 2001
 From: Eric Blake <eblake@redhat.com>
 Date: Thu, 8 Aug 2024 16:05:08 -0500
-Subject: [PATCH 4/5] nbd/server: CVE-2024-7409: Drop non-negotiating clients
+Subject: [PATCH 099/100] nbd/server: CVE-2024-7409: Drop non-negotiating
+ clients
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 
 RH-Author: Eric Blake <eblake@redhat.com>
-RH-MergeRequest: 386: nbd/server: fix CVE-2024-7409 (qemu crash on nbd-server-stop) [rhel-9.4.z]
-RH-Jira: RHEL-52616
+RH-MergeRequest: 262: nbd/server: fix CVE-2024-7409 (qemu crash on nbd-server-stop)
+RH-Jira: RHEL-52617
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [3/4] 4394e60a8733cd57ee6c8cb140171c7f61cc13a3 (ebblake/qemu-kvm)
+RH-Commit: [3/4] 8008a1067766951d9752bcc41c2127a07fce934d (redhat/centos-stream/src/qemu-kvm)
 
 A client that opens a socket but does not negotiate is merely hogging
 qemu's resources (an open fd and a small amount of memory); and a
@@ -56,7 +57,7 @@ Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 Signed-off-by: Eric Blake <eblake@redhat.com>
 
 (cherry picked from commit b9b72cb3ce15b693148bd09cef7e50110566d8a0)
-Jira: https://issues.redhat.com/browse/RHEL-52616
+Jira: https://issues.redhat.com/browse/RHEL-52617
 Signed-off-by: Eric Blake <eblake@redhat.com>
 ---
  nbd/server.c     | 28 +++++++++++++++++++++++++++-
diff --git a/SOURCES/kvm-nbd-server-Fix-race-in-draining-the-export.patch b/SOURCES/kvm-nbd-server-Fix-race-in-draining-the-export.patch
deleted file mode 100644
index 7298992..0000000
--- a/SOURCES/kvm-nbd-server-Fix-race-in-draining-the-export.patch
+++ /dev/null
@@ -1,95 +0,0 @@
-From dc4dd11233522d8195782a2196aaae44bd924575 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Thu, 14 Mar 2024 17:58:24 +0100
-Subject: [PATCH 2/4] nbd/server: Fix race in draining the export
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 231: Fix deadlock and crash during storage migration
-RH-Jira: RHEL-28125
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Acked-by: Eric Blake <eblake@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [2/3] 036e1b171986099904dee468c59d77437e3d3d61 (kmwolf/centos-qemu-kvm)
-
-When draining an NBD export, nbd_drained_begin() first sets
-client->quiescing so that nbd_client_receive_next_request() won't start
-any new request coroutines. Then nbd_drained_poll() tries to makes sure
-that we wait for any existing request coroutines by checking that
-client->nb_requests has become 0.
-
-However, there is a small window between creating a new request
-coroutine and increasing client->nb_requests. If a coroutine is in this
-state, it won't be waited for and drain returns too early.
-
-In the context of switching to a different AioContext, this means that
-blk_aio_attached() will see client->recv_coroutine != NULL and fail its
-assertion.
-
-Fix this by increasing client->nb_requests immediately when starting the
-coroutine. Doing this after the checks if we should create a new
-coroutine is okay because client->lock is held.
-
-Cc: qemu-stable@nongnu.org
-Fixes: fd6afc501a01 ("nbd/server: Use drained block ops to quiesce the server")
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Message-ID: <20240314165825.40261-2-kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 9c707525cbb1dd1e56876e45c70c0c08f2876d41)
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- nbd/server.c | 15 +++++++--------
- 1 file changed, 7 insertions(+), 8 deletions(-)
-
-diff --git a/nbd/server.c b/nbd/server.c
-index 941832f178..c3484cc1eb 100644
---- a/nbd/server.c
-+++ b/nbd/server.c
-@@ -3007,8 +3007,8 @@ static coroutine_fn int nbd_handle_request(NBDClient *client,
- /* Owns a reference to the NBDClient passed as opaque.  */
- static coroutine_fn void nbd_trip(void *opaque)
- {
--    NBDClient *client = opaque;
--    NBDRequestData *req = NULL;
-+    NBDRequestData *req = opaque;
-+    NBDClient *client = req->client;
-     NBDRequest request = { 0 };    /* GCC thinks it can be used uninitialized */
-     int ret;
-     Error *local_err = NULL;
-@@ -3037,8 +3037,6 @@ static coroutine_fn void nbd_trip(void *opaque)
-         goto done;
-     }
- 
--    req = nbd_request_get(client);
--
-     /*
-      * nbd_co_receive_request() returns -EAGAIN when nbd_drained_begin() has
-      * set client->quiescing but by the time we get back nbd_drained_end() may
-@@ -3112,9 +3110,7 @@ static coroutine_fn void nbd_trip(void *opaque)
-     }
- 
- done:
--    if (req) {
--        nbd_request_put(req);
--    }
-+    nbd_request_put(req);
- 
-     qemu_mutex_unlock(&client->lock);
- 
-@@ -3143,10 +3139,13 @@ disconnect:
-  */
- static void nbd_client_receive_next_request(NBDClient *client)
- {
-+    NBDRequestData *req;
-+
-     if (!client->recv_coroutine && client->nb_requests < MAX_NBD_REQUESTS &&
-         !client->quiescing) {
-         nbd_client_get(client);
--        client->recv_coroutine = qemu_coroutine_create(nbd_trip, client);
-+        req = nbd_request_get(client);
-+        client->recv_coroutine = qemu_coroutine_create(nbd_trip, req);
-         aio_co_schedule(client->exp->common.ctx, client->recv_coroutine);
-     }
- }
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-nbd-server-Mark-negotiation-functions-as-coroutine_f.patch b/SOURCES/kvm-nbd-server-Mark-negotiation-functions-as-coroutine_f.patch
index 28b0064..7614df8 100644
--- a/SOURCES/kvm-nbd-server-Mark-negotiation-functions-as-coroutine_f.patch
+++ b/SOURCES/kvm-nbd-server-Mark-negotiation-functions-as-coroutine_f.patch
@@ -1,14 +1,14 @@
-From d1dd79b558fb9b23ae14165ec8edf0085e927091 Mon Sep 17 00:00:00 2001
+From af6f51ad3482513e3ac047eb203f9dc623d47088 Mon Sep 17 00:00:00 2001
 From: Eric Blake <eblake@redhat.com>
 Date: Mon, 8 Apr 2024 11:00:44 -0500
-Subject: [PATCH 2/4] nbd/server: Mark negotiation functions as coroutine_fn
+Subject: [PATCH 2/2] nbd/server: Mark negotiation functions as coroutine_fn
 
 RH-Author: Eric Blake <eblake@redhat.com>
-RH-MergeRequest: 375: Fix regression on nbd+tls
-RH-Jira: RHEL-33754
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
+RH-MergeRequest: 239: avoid destination hang on NBD+TLS storage migration
+RH-Jira: RHEL-33440
+RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [2/4] 6dc8ecca16df5ae5cc6dc36e7b96f991396fcf24 (ebblake/qemu-kvm)
+RH-Commit: [2/2] acf61b854f80365993d24bcd1d110ed3518b22fa (ebblake/centos-qemu-kvm)
 
 nbd_negotiate() is already marked coroutine_fn.  And given the fix in
 the previous patch to have nbd_negotiate_handle_starttls not create
@@ -23,8 +23,9 @@ Message-ID: <20240408160214.1200629-6-eblake@redhat.com>
 Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
 [eblake: drop one spurious coroutine_fn marking]
 Signed-off-by: Eric Blake <eblake@redhat.com>
+
+Jira: https://issues.redhat.com/browse/RHEL-33440
 (cherry picked from commit 4fa333e08dd96395a99ea8dd9e4c73a29dd23344)
-Jira: https://issues.redhat.com/browse/RHEL-33754
 Signed-off-by: Eric Blake <eblake@redhat.com>
 ---
  nbd/server.c | 102 +++++++++++++++++++++++++++++----------------------
diff --git a/SOURCES/kvm-nbd-server-Plumb-in-new-args-to-nbd_client_add.patch b/SOURCES/kvm-nbd-server-Plumb-in-new-args-to-nbd_client_add.patch
index 85a9986..6b4c670 100644
--- a/SOURCES/kvm-nbd-server-Plumb-in-new-args-to-nbd_client_add.patch
+++ b/SOURCES/kvm-nbd-server-Plumb-in-new-args-to-nbd_client_add.patch
@@ -1,16 +1,16 @@
-From c8c7dc7a445892a820223be2e7617a790e0400f5 Mon Sep 17 00:00:00 2001
+From 70acef52a99e5114699f5fa58de5f0b5c031b880 Mon Sep 17 00:00:00 2001
 From: Eric Blake <eblake@redhat.com>
 Date: Wed, 7 Aug 2024 08:50:01 -0500
-Subject: [PATCH 2/5] nbd/server: Plumb in new args to nbd_client_add()
+Subject: [PATCH 097/100] nbd/server: Plumb in new args to nbd_client_add()
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 
 RH-Author: Eric Blake <eblake@redhat.com>
-RH-MergeRequest: 386: nbd/server: fix CVE-2024-7409 (qemu crash on nbd-server-stop) [rhel-9.4.z]
-RH-Jira: RHEL-52616
+RH-MergeRequest: 262: nbd/server: fix CVE-2024-7409 (qemu crash on nbd-server-stop)
+RH-Jira: RHEL-52617
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [1/4] 658d80c80a1163fcad456a34ec20d7828273a36c (ebblake/qemu-kvm)
+RH-Commit: [1/4] 7614e294e1f5b7861386950ae994bea166d19950 (redhat/centos-stream/src/qemu-kvm)
 
 Upcoming patches to fix a CVE need to track an opaque pointer passed
 in by the owner of a client object, as well as request for a time
@@ -28,7 +28,7 @@ Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 Signed-off-by: Eric Blake <eblake@redhat.com>
 
 (cherry picked from commit fb1c2aaa981e0a2fa6362c9985f1296b74f055ac)
-Jira: https://issues.redhat.com/browse/RHEL-52616
+Jira: https://issues.redhat.com/browse/RHEL-52617
 Signed-off-by: Eric Blake <eblake@redhat.com>
 ---
  blockdev-nbd.c      |  6 ++++--
@@ -156,10 +156,10 @@ index 892797bb11..e50012499f 100644
 +    return client->owner;
 +}
 diff --git a/qemu-nbd.c b/qemu-nbd.c
-index bac0b5e3ec..01b4a63c31 100644
+index d7b3ccab21..48e2fa5858 100644
 --- a/qemu-nbd.c
 +++ b/qemu-nbd.c
-@@ -389,7 +389,9 @@ static void nbd_accept(QIONetListener *listener, QIOChannelSocket *cioc,
+@@ -390,7 +390,9 @@ static void nbd_accept(QIONetListener *listener, QIOChannelSocket *cioc,
  
      nb_fds++;
      nbd_update_server_watch();
diff --git a/SOURCES/kvm-nbd-server-avoid-per-NBDRequest-nbd_client_get-put.patch b/SOURCES/kvm-nbd-server-avoid-per-NBDRequest-nbd_client_get-put.patch
deleted file mode 100644
index 339e234..0000000
--- a/SOURCES/kvm-nbd-server-avoid-per-NBDRequest-nbd_client_get-put.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From cd7788a857a6099206c4063e3ef69cb9e4aebcbc Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Thu, 21 Dec 2023 14:24:50 -0500
-Subject: [PATCH 070/101] nbd/server: avoid per-NBDRequest nbd_client_get/put()
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 214: Remove AioContext lock
-RH-Jira: RHEL-15965
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [1/26] 5acb090ac4adf4260cd9e9c5605a27012b2a33aa (kmwolf/centos-qemu-kvm)
-
-nbd_trip() processes a single NBD request from start to finish and holds
-an NBDClient reference throughout. NBDRequest does not outlive the scope
-of nbd_trip(). Therefore it is unnecessary to ref/unref NBDClient for
-each NBDRequest.
-
-Removing these nbd_client_get()/nbd_client_put() calls will make
-thread-safety easier in the commits that follow.
-
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
-Message-ID: <20231221192452.1785567-5-stefanha@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- nbd/server.c | 3 ---
- 1 file changed, 3 deletions(-)
-
-diff --git a/nbd/server.c b/nbd/server.c
-index 895cf0a752..0b09ccc8dc 100644
---- a/nbd/server.c
-+++ b/nbd/server.c
-@@ -1557,7 +1557,6 @@ static NBDRequestData *nbd_request_get(NBDClient *client)
-     client->nb_requests++;
- 
-     req = g_new0(NBDRequestData, 1);
--    nbd_client_get(client);
-     req->client = client;
-     return req;
- }
-@@ -1578,8 +1577,6 @@ static void nbd_request_put(NBDRequestData *req)
-     }
- 
-     nbd_client_receive_next_request(client);
--
--    nbd_client_put(client);
- }
- 
- static void blk_aio_attached(AioContext *ctx, void *opaque)
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-nbd-server-do-not-poll-within-a-coroutine-context.patch b/SOURCES/kvm-nbd-server-do-not-poll-within-a-coroutine-context.patch
index 8693400..9f65e99 100644
--- a/SOURCES/kvm-nbd-server-do-not-poll-within-a-coroutine-context.patch
+++ b/SOURCES/kvm-nbd-server-do-not-poll-within-a-coroutine-context.patch
@@ -1,14 +1,14 @@
-From ef01aeba9f6c4c886719261333a04bc32484f0d0 Mon Sep 17 00:00:00 2001
+From ae9ebfc4ebd6f146951f04cf9e12eeaaf4c2387e Mon Sep 17 00:00:00 2001
 From: Zhu Yangyang <zhuyangyang14@huawei.com>
 Date: Mon, 8 Apr 2024 11:00:43 -0500
-Subject: [PATCH 1/4] nbd/server: do not poll within a coroutine context
+Subject: [PATCH 1/2] nbd/server: do not poll within a coroutine context
 
 RH-Author: Eric Blake <eblake@redhat.com>
-RH-MergeRequest: 375: Fix regression on nbd+tls
-RH-Jira: RHEL-33754
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
+RH-MergeRequest: 239: avoid destination hang on NBD+TLS storage migration
+RH-Jira: RHEL-33440
+RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [1/4] 88ca2c90e0c412ba8c1cfd7ea91e01ec58220e9b (ebblake/qemu-kvm)
+RH-Commit: [1/2] 27963e92aacca8ed43994113b645f472fba8f8bc (ebblake/centos-qemu-kvm)
 
 Coroutines are not supposed to block. Instead, they should yield.
 
@@ -28,8 +28,9 @@ Signed-off-by: Zhu Yangyang <zhuyangyang14@huawei.com>
 Signed-off-by: Eric Blake <eblake@redhat.com>
 Message-ID: <20240408160214.1200629-5-eblake@redhat.com>
 Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
+
+Jira: https://issues.redhat.com/browse/RHEL-33440
 (cherry picked from commit ae6d91a7e9b77abb029ed3fa9fad461422286942)
-Jira: https://issues.redhat.com/browse/RHEL-33754
 Signed-off-by: Eric Blake <eblake@redhat.com>
 ---
  nbd/client.c       | 28 ++++++++++++++++++++++++----
diff --git a/SOURCES/kvm-nbd-server-introduce-NBDClient-lock-to-protect-field.patch b/SOURCES/kvm-nbd-server-introduce-NBDClient-lock-to-protect-field.patch
deleted file mode 100644
index e0d763d..0000000
--- a/SOURCES/kvm-nbd-server-introduce-NBDClient-lock-to-protect-field.patch
+++ /dev/null
@@ -1,373 +0,0 @@
-From bb0a6afff7f23a3ddb460dc1b2e70c06565f8a3f Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Thu, 21 Dec 2023 14:24:52 -0500
-Subject: [PATCH 072/101] nbd/server: introduce NBDClient->lock to protect
- fields
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 214: Remove AioContext lock
-RH-Jira: RHEL-15965
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [3/26] 49b64adaaf8b1c30f339d1ecc8ea89fb9db63f1c (kmwolf/centos-qemu-kvm)
-
-NBDClient has a number of fields that are accessed by both the export
-AioContext and the main loop thread. When the AioContext lock is removed
-these fields will need another form of protection.
-
-Add NBDClient->lock and protect fields that are accessed by both
-threads. Also add assertions where possible and otherwise add doc
-comments stating assumptions about which thread and lock holding.
-
-Note this patch moves the client->recv_coroutine assertion from
-nbd_co_receive_request() to nbd_trip() where client->lock is held.
-
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20231221192452.1785567-7-stefanha@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- nbd/server.c | 144 +++++++++++++++++++++++++++++++++++++++------------
- 1 file changed, 111 insertions(+), 33 deletions(-)
-
-diff --git a/nbd/server.c b/nbd/server.c
-index e91e2e0903..941832f178 100644
---- a/nbd/server.c
-+++ b/nbd/server.c
-@@ -125,23 +125,25 @@ struct NBDClient {
-     int refcount; /* atomic */
-     void (*close_fn)(NBDClient *client, bool negotiated);
- 
-+    QemuMutex lock;
-+
-     NBDExport *exp;
-     QCryptoTLSCreds *tlscreds;
-     char *tlsauthz;
-     QIOChannelSocket *sioc; /* The underlying data channel */
-     QIOChannel *ioc; /* The current I/O channel which may differ (eg TLS) */
- 
--    Coroutine *recv_coroutine;
-+    Coroutine *recv_coroutine; /* protected by lock */
- 
-     CoMutex send_lock;
-     Coroutine *send_coroutine;
- 
--    bool read_yielding;
--    bool quiescing;
-+    bool read_yielding; /* protected by lock */
-+    bool quiescing; /* protected by lock */
- 
-     QTAILQ_ENTRY(NBDClient) next;
--    int nb_requests;
--    bool closing;
-+    int nb_requests; /* protected by lock */
-+    bool closing; /* protected by lock */
- 
-     uint32_t check_align; /* If non-zero, check for aligned client requests */
- 
-@@ -1415,11 +1417,18 @@ nbd_read_eof(NBDClient *client, void *buffer, size_t size, Error **errp)
- 
-         len = qio_channel_readv(client->ioc, &iov, 1, errp);
-         if (len == QIO_CHANNEL_ERR_BLOCK) {
--            client->read_yielding = true;
-+            WITH_QEMU_LOCK_GUARD(&client->lock) {
-+                client->read_yielding = true;
-+
-+                /* Prompt main loop thread to re-run nbd_drained_poll() */
-+                aio_wait_kick();
-+            }
-             qio_channel_yield(client->ioc, G_IO_IN);
--            client->read_yielding = false;
--            if (client->quiescing) {
--                return -EAGAIN;
-+            WITH_QEMU_LOCK_GUARD(&client->lock) {
-+                client->read_yielding = false;
-+                if (client->quiescing) {
-+                    return -EAGAIN;
-+                }
-             }
-             continue;
-         } else if (len < 0) {
-@@ -1528,6 +1537,7 @@ void nbd_client_put(NBDClient *client)
-             blk_exp_unref(&client->exp->common);
-         }
-         g_free(client->contexts.bitmaps);
-+        qemu_mutex_destroy(&client->lock);
-         g_free(client);
-     }
- }
-@@ -1561,11 +1571,13 @@ static void client_close(NBDClient *client, bool negotiated)
- {
-     assert(qemu_in_main_thread());
- 
--    if (client->closing) {
--        return;
--    }
-+    WITH_QEMU_LOCK_GUARD(&client->lock) {
-+        if (client->closing) {
-+            return;
-+        }
- 
--    client->closing = true;
-+        client->closing = true;
-+    }
- 
-     /* Force requests to finish.  They will drop their own references,
-      * then we'll close the socket and free the NBDClient.
-@@ -1579,6 +1591,7 @@ static void client_close(NBDClient *client, bool negotiated)
-     }
- }
- 
-+/* Runs in export AioContext with client->lock held */
- static NBDRequestData *nbd_request_get(NBDClient *client)
- {
-     NBDRequestData *req;
-@@ -1591,6 +1604,7 @@ static NBDRequestData *nbd_request_get(NBDClient *client)
-     return req;
- }
- 
-+/* Runs in export AioContext with client->lock held */
- static void nbd_request_put(NBDRequestData *req)
- {
-     NBDClient *client = req->client;
-@@ -1614,14 +1628,18 @@ static void blk_aio_attached(AioContext *ctx, void *opaque)
-     NBDExport *exp = opaque;
-     NBDClient *client;
- 
-+    assert(qemu_in_main_thread());
-+
-     trace_nbd_blk_aio_attached(exp->name, ctx);
- 
-     exp->common.ctx = ctx;
- 
-     QTAILQ_FOREACH(client, &exp->clients, next) {
--        assert(client->nb_requests == 0);
--        assert(client->recv_coroutine == NULL);
--        assert(client->send_coroutine == NULL);
-+        WITH_QEMU_LOCK_GUARD(&client->lock) {
-+            assert(client->nb_requests == 0);
-+            assert(client->recv_coroutine == NULL);
-+            assert(client->send_coroutine == NULL);
-+        }
-     }
- }
- 
-@@ -1629,6 +1647,8 @@ static void blk_aio_detach(void *opaque)
- {
-     NBDExport *exp = opaque;
- 
-+    assert(qemu_in_main_thread());
-+
-     trace_nbd_blk_aio_detach(exp->name, exp->common.ctx);
- 
-     exp->common.ctx = NULL;
-@@ -1639,8 +1659,12 @@ static void nbd_drained_begin(void *opaque)
-     NBDExport *exp = opaque;
-     NBDClient *client;
- 
-+    assert(qemu_in_main_thread());
-+
-     QTAILQ_FOREACH(client, &exp->clients, next) {
--        client->quiescing = true;
-+        WITH_QEMU_LOCK_GUARD(&client->lock) {
-+            client->quiescing = true;
-+        }
-     }
- }
- 
-@@ -1649,28 +1673,48 @@ static void nbd_drained_end(void *opaque)
-     NBDExport *exp = opaque;
-     NBDClient *client;
- 
-+    assert(qemu_in_main_thread());
-+
-     QTAILQ_FOREACH(client, &exp->clients, next) {
--        client->quiescing = false;
--        nbd_client_receive_next_request(client);
-+        WITH_QEMU_LOCK_GUARD(&client->lock) {
-+            client->quiescing = false;
-+            nbd_client_receive_next_request(client);
-+        }
-     }
- }
- 
-+/* Runs in export AioContext */
-+static void nbd_wake_read_bh(void *opaque)
-+{
-+    NBDClient *client = opaque;
-+    qio_channel_wake_read(client->ioc);
-+}
-+
- static bool nbd_drained_poll(void *opaque)
- {
-     NBDExport *exp = opaque;
-     NBDClient *client;
- 
-+    assert(qemu_in_main_thread());
-+
-     QTAILQ_FOREACH(client, &exp->clients, next) {
--        if (client->nb_requests != 0) {
--            /*
--             * If there's a coroutine waiting for a request on nbd_read_eof()
--             * enter it here so we don't depend on the client to wake it up.
--             */
--            if (client->recv_coroutine != NULL && client->read_yielding) {
--                qio_channel_wake_read(client->ioc);
--            }
-+        WITH_QEMU_LOCK_GUARD(&client->lock) {
-+            if (client->nb_requests != 0) {
-+                /*
-+                 * If there's a coroutine waiting for a request on nbd_read_eof()
-+                 * enter it here so we don't depend on the client to wake it up.
-+                 *
-+                 * Schedule a BH in the export AioContext to avoid missing the
-+                 * wake up due to the race between qio_channel_wake_read() and
-+                 * qio_channel_yield().
-+                 */
-+                if (client->recv_coroutine != NULL && client->read_yielding) {
-+                    aio_bh_schedule_oneshot(nbd_export_aio_context(client->exp),
-+                                            nbd_wake_read_bh, client);
-+                }
- 
--            return true;
-+                return true;
-+            }
-         }
-     }
- 
-@@ -1681,6 +1725,8 @@ static void nbd_eject_notifier(Notifier *n, void *data)
- {
-     NBDExport *exp = container_of(n, NBDExport, eject_notifier);
- 
-+    assert(qemu_in_main_thread());
-+
-     blk_exp_request_shutdown(&exp->common);
- }
- 
-@@ -2566,7 +2612,6 @@ static int coroutine_fn nbd_co_receive_request(NBDRequestData *req,
-     int ret;
- 
-     g_assert(qemu_in_coroutine());
--    assert(client->recv_coroutine == qemu_coroutine_self());
-     ret = nbd_receive_request(client, request, errp);
-     if (ret < 0) {
-         return ret;
-@@ -2975,6 +3020,9 @@ static coroutine_fn void nbd_trip(void *opaque)
-      */
- 
-     trace_nbd_trip();
-+
-+    qemu_mutex_lock(&client->lock);
-+
-     if (client->closing) {
-         goto done;
-     }
-@@ -2990,7 +3038,21 @@ static coroutine_fn void nbd_trip(void *opaque)
-     }
- 
-     req = nbd_request_get(client);
--    ret = nbd_co_receive_request(req, &request, &local_err);
-+
-+    /*
-+     * nbd_co_receive_request() returns -EAGAIN when nbd_drained_begin() has
-+     * set client->quiescing but by the time we get back nbd_drained_end() may
-+     * have already cleared client->quiescing. In that case we try again
-+     * because nothing else will spawn an nbd_trip() coroutine until we set
-+     * client->recv_coroutine = NULL further down.
-+     */
-+    do {
-+        assert(client->recv_coroutine == qemu_coroutine_self());
-+        qemu_mutex_unlock(&client->lock);
-+        ret = nbd_co_receive_request(req, &request, &local_err);
-+        qemu_mutex_lock(&client->lock);
-+    } while (ret == -EAGAIN && !client->quiescing);
-+
-     client->recv_coroutine = NULL;
- 
-     if (client->closing) {
-@@ -3002,15 +3064,16 @@ static coroutine_fn void nbd_trip(void *opaque)
-     }
- 
-     if (ret == -EAGAIN) {
--        assert(client->quiescing);
-         goto done;
-     }
- 
-     nbd_client_receive_next_request(client);
-+
-     if (ret == -EIO) {
-         goto disconnect;
-     }
- 
-+    qemu_mutex_unlock(&client->lock);
-     qio_channel_set_cork(client->ioc, true);
- 
-     if (ret < 0) {
-@@ -3030,6 +3093,10 @@ static coroutine_fn void nbd_trip(void *opaque)
-         g_free(request.contexts->bitmaps);
-         g_free(request.contexts);
-     }
-+
-+    qio_channel_set_cork(client->ioc, false);
-+    qemu_mutex_lock(&client->lock);
-+
-     if (ret < 0) {
-         error_prepend(&local_err, "Failed to send reply: ");
-         goto disconnect;
-@@ -3044,11 +3111,13 @@ static coroutine_fn void nbd_trip(void *opaque)
-         goto disconnect;
-     }
- 
--    qio_channel_set_cork(client->ioc, false);
- done:
-     if (req) {
-         nbd_request_put(req);
-     }
-+
-+    qemu_mutex_unlock(&client->lock);
-+
-     if (!nbd_client_put_nonzero(client)) {
-         aio_co_reschedule_self(qemu_get_aio_context());
-         nbd_client_put(client);
-@@ -3059,13 +3128,19 @@ disconnect:
-     if (local_err) {
-         error_reportf_err(local_err, "Disconnect client, due to: ");
-     }
-+
-     nbd_request_put(req);
-+    qemu_mutex_unlock(&client->lock);
- 
-     aio_co_reschedule_self(qemu_get_aio_context());
-     client_close(client, true);
-     nbd_client_put(client);
- }
- 
-+/*
-+ * Runs in export AioContext and main loop thread. Caller must hold
-+ * client->lock.
-+ */
- static void nbd_client_receive_next_request(NBDClient *client)
- {
-     if (!client->recv_coroutine && client->nb_requests < MAX_NBD_REQUESTS &&
-@@ -3091,7 +3166,9 @@ static coroutine_fn void nbd_co_client_start(void *opaque)
-         return;
-     }
- 
--    nbd_client_receive_next_request(client);
-+    WITH_QEMU_LOCK_GUARD(&client->lock) {
-+        nbd_client_receive_next_request(client);
-+    }
- }
- 
- /*
-@@ -3108,6 +3185,7 @@ void nbd_client_new(QIOChannelSocket *sioc,
-     Coroutine *co;
- 
-     client = g_new0(NBDClient, 1);
-+    qemu_mutex_init(&client->lock);
-     client->refcount = 1;
-     client->tlscreds = tlscreds;
-     if (tlscreds) {
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-nbd-server-only-traverse-NBDExport-clients-from-main.patch b/SOURCES/kvm-nbd-server-only-traverse-NBDExport-clients-from-main.patch
deleted file mode 100644
index 3ca11a9..0000000
--- a/SOURCES/kvm-nbd-server-only-traverse-NBDExport-clients-from-main.patch
+++ /dev/null
@@ -1,176 +0,0 @@
-From 8b60d72532b6511b41d82d591fb4f509314ef15f Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Thu, 21 Dec 2023 14:24:51 -0500
-Subject: [PATCH 071/101] nbd/server: only traverse NBDExport->clients from
- main loop thread
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 214: Remove AioContext lock
-RH-Jira: RHEL-15965
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [2/26] e7794a3a5c363c7508ee505c4ba03d9ef8862ca9 (kmwolf/centos-qemu-kvm)
-
-The NBD clients list is currently accessed from both the export
-AioContext and the main loop thread. When the AioContext lock is removed
-there will be nothing protecting the clients list.
-
-Adding a lock around the clients list is tricky because NBDClient
-structs are refcounted and may be freed from the export AioContext or
-the main loop thread. nbd_export_request_shutdown() -> client_close() ->
-nbd_client_put() is also tricky because the list lock would be held
-while indirectly dropping references to NDBClients.
-
-A simpler approach is to only allow nbd_client_put() and client_close()
-calls from the main loop thread. Then the NBD clients list is only
-accessed from the main loop thread and no fancy locking is needed.
-
-nbd_trip() just needs to reschedule itself in the main loop AioContext
-before calling nbd_client_put() and client_close(). This costs more CPU
-cycles per NBD request so add nbd_client_put_nonzero() to optimize the
-common case where more references to NBDClient remain.
-
-Note that nbd_client_get() can still be called from either thread, so
-make NBDClient->refcount atomic.
-
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20231221192452.1785567-6-stefanha@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- nbd/server.c | 61 +++++++++++++++++++++++++++++++++++++++++++---------
- 1 file changed, 51 insertions(+), 10 deletions(-)
-
-diff --git a/nbd/server.c b/nbd/server.c
-index 0b09ccc8dc..e91e2e0903 100644
---- a/nbd/server.c
-+++ b/nbd/server.c
-@@ -122,7 +122,7 @@ struct NBDMetaContexts {
- };
- 
- struct NBDClient {
--    int refcount;
-+    int refcount; /* atomic */
-     void (*close_fn)(NBDClient *client, bool negotiated);
- 
-     NBDExport *exp;
-@@ -1501,14 +1501,17 @@ static int coroutine_fn nbd_receive_request(NBDClient *client, NBDRequest *reque
- 
- #define MAX_NBD_REQUESTS 16
- 
-+/* Runs in export AioContext and main loop thread */
- void nbd_client_get(NBDClient *client)
- {
--    client->refcount++;
-+    qatomic_inc(&client->refcount);
- }
- 
- void nbd_client_put(NBDClient *client)
- {
--    if (--client->refcount == 0) {
-+    assert(qemu_in_main_thread());
-+
-+    if (qatomic_fetch_dec(&client->refcount) == 1) {
-         /* The last reference should be dropped by client->close,
-          * which is called by client_close.
-          */
-@@ -1529,8 +1532,35 @@ void nbd_client_put(NBDClient *client)
-     }
- }
- 
-+/*
-+ * Tries to release the reference to @client, but only if other references
-+ * remain. This is an optimization for the common case where we want to avoid
-+ * the expense of scheduling nbd_client_put() in the main loop thread.
-+ *
-+ * Returns true upon success or false if the reference was not released because
-+ * it is the last reference.
-+ */
-+static bool nbd_client_put_nonzero(NBDClient *client)
-+{
-+    int old = qatomic_read(&client->refcount);
-+    int expected;
-+
-+    do {
-+        if (old == 1) {
-+            return false;
-+        }
-+
-+        expected = old;
-+        old = qatomic_cmpxchg(&client->refcount, expected, expected - 1);
-+    } while (old != expected);
-+
-+    return true;
-+}
-+
- static void client_close(NBDClient *client, bool negotiated)
- {
-+    assert(qemu_in_main_thread());
-+
-     if (client->closing) {
-         return;
-     }
-@@ -2933,15 +2963,20 @@ static coroutine_fn int nbd_handle_request(NBDClient *client,
- static coroutine_fn void nbd_trip(void *opaque)
- {
-     NBDClient *client = opaque;
--    NBDRequestData *req;
-+    NBDRequestData *req = NULL;
-     NBDRequest request = { 0 };    /* GCC thinks it can be used uninitialized */
-     int ret;
-     Error *local_err = NULL;
- 
-+    /*
-+     * Note that nbd_client_put() and client_close() must be called from the
-+     * main loop thread. Use aio_co_reschedule_self() to switch AioContext
-+     * before calling these functions.
-+     */
-+
-     trace_nbd_trip();
-     if (client->closing) {
--        nbd_client_put(client);
--        return;
-+        goto done;
-     }
- 
-     if (client->quiescing) {
-@@ -2949,10 +2984,9 @@ static coroutine_fn void nbd_trip(void *opaque)
-          * We're switching between AIO contexts. Don't attempt to receive a new
-          * request and kick the main context which may be waiting for us.
-          */
--        nbd_client_put(client);
-         client->recv_coroutine = NULL;
-         aio_wait_kick();
--        return;
-+        goto done;
-     }
- 
-     req = nbd_request_get(client);
-@@ -3012,8 +3046,13 @@ static coroutine_fn void nbd_trip(void *opaque)
- 
-     qio_channel_set_cork(client->ioc, false);
- done:
--    nbd_request_put(req);
--    nbd_client_put(client);
-+    if (req) {
-+        nbd_request_put(req);
-+    }
-+    if (!nbd_client_put_nonzero(client)) {
-+        aio_co_reschedule_self(qemu_get_aio_context());
-+        nbd_client_put(client);
-+    }
-     return;
- 
- disconnect:
-@@ -3021,6 +3060,8 @@ disconnect:
-         error_reportf_err(local_err, "Disconnect client, due to: ");
-     }
-     nbd_request_put(req);
-+
-+    aio_co_reschedule_self(qemu_get_aio_context());
-     client_close(client, true);
-     nbd_client_put(client);
- }
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-pc-q35-set-SMBIOS-entry-point-type-to-auto-by-defaul.patch b/SOURCES/kvm-pc-q35-set-SMBIOS-entry-point-type-to-auto-by-defaul.patch
deleted file mode 100644
index f37f65f..0000000
--- a/SOURCES/kvm-pc-q35-set-SMBIOS-entry-point-type-to-auto-by-defaul.patch
+++ /dev/null
@@ -1,115 +0,0 @@
-From 9ca64f73238d9f1b9f13d8e941ba42771a992afb Mon Sep 17 00:00:00 2001
-From: Igor Mammedov <imammedo@redhat.com>
-Date: Fri, 29 Dec 2023 14:06:05 +0100
-Subject: [PATCH 20/20] pc/q35: set SMBIOS entry point type to 'auto' by
- default
-
-RH-Author: Igor Mammedov <imammedo@redhat.com>
-RH-MergeRequest: 230: Workaround Windows failing to find 64bit SMBIOS entry point with SeaBIOS
-RH-Jira: RHEL-21705
-RH-Acked-by: MST <mst@redhat.com>
-RH-Acked-by: Ani Sinha <None>
-RH-Commit: [18/18] c7fc6ac7350bca3ff99e58620710a86218385781
-
-JIRA: https://issues.redhat.com/browse/RHEL-21705
-
-    Use smbios-entry-point-type='auto' for newer machine types as a workaround
-    for Windows not detecting SMBIOS tables. Which makes QEMU pick SMBIOS tables
-    based on configuration (with 2.x preferred and fallback to 3.x if the former
-    isn't compatible with configuration)
-
-    Default compat setting of smbios-entry-point-type after series
-    for pc/q35 machines:
-      * 9.0-newer: 'auto'
-      * 8.1-8.2: '64'
-      * 8.0-older: '32'
-    Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2008
-    Signed-off-by: Igor Mammedov <imammedo@redhat.com>
-    Reviewed-by: Ani Sinha <anisinha@redhat.com>
-    Tested-by: Fiona Ebner <f.ebner@proxmox.com>
-
-Conflicts: hw/i386/pc_piix.c hw/i386/pc_q35.c
-  due to RHEL machine types
-
-REHL only parts:
-  Fix RHEL 'pc' machine types at SMBIOS 2.X
-  for the latest RHEL 'q35' machine type use version autoselect
-  which propagates to RHEL 9.4 q35 macine type while RHEL 9.2 q35 and older
-  are kept at SMBIOS_ENTRY_POINT_TYPE_32 (see: pc_q35_machine_rhel920_options)
-
-Signed-off-by: Igor Mammedov <imammedo@redhat.com>
----
- hw/i386/pc.c      | 2 +-
- hw/i386/pc_piix.c | 7 +++++++
- hw/i386/pc_q35.c  | 5 +++++
- 3 files changed, 13 insertions(+), 1 deletion(-)
-
-diff --git a/hw/i386/pc.c b/hw/i386/pc.c
-index ae6777fc1a..d6f267b220 100644
---- a/hw/i386/pc.c
-+++ b/hw/i386/pc.c
-@@ -2004,7 +2004,7 @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
-     mc->nvdimm_supported = true;
-     mc->smp_props.dies_supported = true;
-     mc->default_ram_id = "pc.ram";
--    pcmc->default_smbios_ep_type = SMBIOS_ENTRY_POINT_TYPE_64;
-+    pcmc->default_smbios_ep_type = SMBIOS_ENTRY_POINT_TYPE_AUTO;
- 
-     object_class_property_add(oc, PC_MACHINE_MAX_RAM_BELOW_4G, "size",
-         pc_machine_get_max_ram_below_4g, pc_machine_set_max_ram_below_4g,
-diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
-index 7344b35cf1..54d1c58bce 100644
---- a/hw/i386/pc_piix.c
-+++ b/hw/i386/pc_piix.c
-@@ -539,9 +539,14 @@ static void pc_i440fx_machine_options(MachineClass *m)
- 
- static void pc_i440fx_8_2_machine_options(MachineClass *m)
- {
-+    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-+
-     pc_i440fx_machine_options(m);
-     m->alias = "pc";
-     m->is_default = true;
-+
-+    /* For pc-i44fx-8.2 and 8.1, use SMBIOS 3.X by default */
-+    pcmc->default_smbios_ep_type = SMBIOS_ENTRY_POINT_TYPE_64;
- }
- 
- DEFINE_I440FX_MACHINE(v8_2, "pc-i440fx-8.2", NULL,
-@@ -982,6 +987,8 @@ static void pc_machine_rhel7_options(MachineClass *m)
-     m->alias = "pc";
-     m->is_default = 1;
-     m->smp_props.prefer_sockets = true;
-+    /* there aren't ne PC macine types in RHEL9, keep it at SMBIOS 2.X */
-+    pcmc->default_smbios_ep_type = SMBIOS_ENTRY_POINT_TYPE_32;
- }
- 
- static void pc_init_rhel760(MachineState *machine)
-diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
-index 9a22ff5dd6..cd5fb7380e 100644
---- a/hw/i386/pc_q35.c
-+++ b/hw/i386/pc_q35.c
-@@ -377,8 +377,11 @@ static void pc_q35_machine_options(MachineClass *m)
- 
- static void pc_q35_8_2_machine_options(MachineClass *m)
- {
-+    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-     pc_q35_machine_options(m);
-     m->alias = "q35";
-+    /* For pc-q35-8.2 and 8.1, use SMBIOS 3.X by default */
-+    pcmc->default_smbios_ep_type = SMBIOS_ENTRY_POINT_TYPE_64;
- }
- 
- DEFINE_Q35_MACHINE(v8_2, "pc-q35-8.2", NULL,
-@@ -712,6 +715,8 @@ static void pc_q35_machine_rhel_options(MachineClass *m)
-     m->alias = "q35";
-     m->max_cpus = 710;
-     compat_props_add(m->compat_props, pc_rhel_compat, pc_rhel_compat_len);
-+    /* use SMBIOS version autoselect by default for the latest RHEL machine */
-+    pcmc->default_smbios_ep_type = SMBIOS_ENTRY_POINT_TYPE_AUTO;
- }
- 
- static void pc_q35_init_rhel940(MachineState *machine)
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-pc-smbios-fixup-manufacturer-product-version-to-matc.patch b/SOURCES/kvm-pc-smbios-fixup-manufacturer-product-version-to-matc.patch
deleted file mode 100644
index 9d3fd29..0000000
--- a/SOURCES/kvm-pc-smbios-fixup-manufacturer-product-version-to-matc.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From 03cad16743d9a4d377af66611d030eca9eda326d Mon Sep 17 00:00:00 2001
-From: Igor Mammedov <imammedo@redhat.com>
-Date: Tue, 19 Mar 2024 11:42:04 +0100
-Subject: [PATCH 4/4] pc: smbios: fixup manufacturer/product/version to match
- downstream
-
-RH-Author: Igor Mammedov <imammedo@redhat.com>
-RH-MergeRequest: 232: pc: smbios: fixup manufacturer/product/version to match downstream
-RH-Jira: RHEL-21705
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Ani Sinha <anisinha@redhat.com>
-RH-Commit: [1/1] 9235f64acb5ff46360282e889d0aedcb13374ac1
-
-JIRA: https://issues.redhat.com/browse/RHEL-21705
-
-commit [1] discarded RHEL only change that customizes
-SMBIOS values for manufacturer/product/version for pc/q35
-machine types.
-Fix it up by reverting back to ("Red Hat", "KVM", mc->desc)
-tuple.
-
-1)
-Fixes: 208239eb2 (hw/i386/pc: Defer smbios_set_defaults() to machine_done)
-Signed-off-by: Igor Mammedov <imammedo@redhat.com>
----
- hw/i386/fw_cfg.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/hw/i386/fw_cfg.c b/hw/i386/fw_cfg.c
-index 58429bb78d..d6a24177e2 100644
---- a/hw/i386/fw_cfg.c
-+++ b/hw/i386/fw_cfg.c
-@@ -63,7 +63,7 @@ void fw_cfg_build_smbios(PCMachineState *pcms, FWCfgState *fw_cfg,
- 
-     if (pcmc->smbios_defaults) {
-         /* These values are guest ABI, do not change */
--        smbios_set_defaults("QEMU", mc->desc, mc->name,
-+        smbios_set_defaults("Red Hat", "KVM", mc->desc,
-                             pcmc->smbios_uuid_encoded,
-                             pcmc->smbios_stream_product,
-                             pcmc->smbios_stream_version);
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-pci-host-q35-Move-PAM-initialization-above-SMRAM-ini.patch b/SOURCES/kvm-pci-host-q35-Move-PAM-initialization-above-SMRAM-ini.patch
new file mode 100644
index 0000000..2c21dde
--- /dev/null
+++ b/SOURCES/kvm-pci-host-q35-Move-PAM-initialization-above-SMRAM-ini.patch
@@ -0,0 +1,68 @@
+From c0a65c752cd83dea27cbeb34074d65fb2c5a6b59 Mon Sep 17 00:00:00 2001
+From: Isaku Yamahata <isaku.yamahata@intel.com>
+Date: Wed, 20 Mar 2024 03:39:13 -0500
+Subject: [PATCH 008/100] pci-host/q35: Move PAM initialization above SMRAM
+ initialization
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [8/91] 22a9221d4726e872aa0f0dc25ae9d823c0611547 (bonzini/rhel-qemu-kvm)
+
+In mch_realize(), process PAM initialization before SMRAM initialization so
+that later patch can skill all the SMRAM related with a single check.
+
+Signed-off-by: Isaku Yamahata <isaku.yamahata@intel.com>
+Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
+Signed-off-by: Michael Roth <michael.roth@amd.com>
+Message-ID: <20240320083945.991426-18-michael.roth@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 42c11ae2416dcbcd694ec3ee574fe2f3e70099ae)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ hw/pci-host/q35.c | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
+index 0d7d4e3f08..98d4a7c253 100644
+--- a/hw/pci-host/q35.c
++++ b/hw/pci-host/q35.c
+@@ -568,6 +568,16 @@ static void mch_realize(PCIDevice *d, Error **errp)
+     /* setup pci memory mapping */
+     pc_pci_as_mapping_init(mch->system_memory, mch->pci_address_space);
+ 
++    /* PAM */
++    init_pam(&mch->pam_regions[0], OBJECT(mch), mch->ram_memory,
++             mch->system_memory, mch->pci_address_space,
++             PAM_BIOS_BASE, PAM_BIOS_SIZE);
++    for (i = 0; i < ARRAY_SIZE(mch->pam_regions) - 1; ++i) {
++        init_pam(&mch->pam_regions[i + 1], OBJECT(mch), mch->ram_memory,
++                 mch->system_memory, mch->pci_address_space,
++                 PAM_EXPAN_BASE + i * PAM_EXPAN_SIZE, PAM_EXPAN_SIZE);
++    }
++
+     /* if *disabled* show SMRAM to all CPUs */
+     memory_region_init_alias(&mch->smram_region, OBJECT(mch), "smram-region",
+                              mch->pci_address_space, MCH_HOST_BRIDGE_SMRAM_C_BASE,
+@@ -634,15 +644,6 @@ static void mch_realize(PCIDevice *d, Error **errp)
+ 
+     object_property_add_const_link(qdev_get_machine(), "smram",
+                                    OBJECT(&mch->smram));
+-
+-    init_pam(&mch->pam_regions[0], OBJECT(mch), mch->ram_memory,
+-             mch->system_memory, mch->pci_address_space,
+-             PAM_BIOS_BASE, PAM_BIOS_SIZE);
+-    for (i = 0; i < ARRAY_SIZE(mch->pam_regions) - 1; ++i) {
+-        init_pam(&mch->pam_regions[i + 1], OBJECT(mch), mch->ram_memory,
+-                 mch->system_memory, mch->pci_address_space,
+-                 PAM_EXPAN_BASE + i * PAM_EXPAN_SIZE, PAM_EXPAN_SIZE);
+-    }
+ }
+ 
+ uint64_t mch_mcfg_base(void)
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-physmem-Introduce-ram_block_discard_guest_memfd_rang.patch b/SOURCES/kvm-physmem-Introduce-ram_block_discard_guest_memfd_rang.patch
new file mode 100644
index 0000000..66e0423
--- /dev/null
+++ b/SOURCES/kvm-physmem-Introduce-ram_block_discard_guest_memfd_rang.patch
@@ -0,0 +1,83 @@
+From c70f6e7e3461e6562c0591079cc71068bf0f2ed8 Mon Sep 17 00:00:00 2001
+From: Xiaoyao Li <xiaoyao.li@intel.com>
+Date: Wed, 20 Mar 2024 03:39:07 -0500
+Subject: [PATCH 033/100] physmem: Introduce
+ ram_block_discard_guest_memfd_range()
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [33/91] b6169fa8d752d83977b18897be24f6ab9f3d3472 (bonzini/rhel-qemu-kvm)
+
+When memory page is converted from private to shared, the original
+private memory is back'ed by guest_memfd. Introduce
+ram_block_discard_guest_memfd_range() for discarding memory in
+guest_memfd.
+
+Based on a patch by Isaku Yamahata <isaku.yamahata@intel.com>.
+
+Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
+Reviewed-by: David Hildenbrand <david@redhat.com>
+Signed-off-by: Michael Roth <michael.roth@amd.com>
+Message-ID: <20240320083945.991426-12-michael.roth@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit b2e9426c04fdd32d93a3a37db6b0c2e67c88c335)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ include/exec/cpu-common.h |  2 ++
+ system/physmem.c          | 23 +++++++++++++++++++++++
+ 2 files changed, 25 insertions(+)
+
+diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
+index 6346df17ce..6d5318895a 100644
+--- a/include/exec/cpu-common.h
++++ b/include/exec/cpu-common.h
+@@ -159,6 +159,8 @@ typedef int (RAMBlockIterFunc)(RAMBlock *rb, void *opaque);
+ 
+ int qemu_ram_foreach_block(RAMBlockIterFunc func, void *opaque);
+ int ram_block_discard_range(RAMBlock *rb, uint64_t start, size_t length);
++int ram_block_discard_guest_memfd_range(RAMBlock *rb, uint64_t start,
++                                        size_t length);
+ 
+ #endif
+ 
+diff --git a/system/physmem.c b/system/physmem.c
+index 5ebcf5be11..c3d04ca921 100644
+--- a/system/physmem.c
++++ b/system/physmem.c
+@@ -3721,6 +3721,29 @@ err:
+     return ret;
+ }
+ 
++int ram_block_discard_guest_memfd_range(RAMBlock *rb, uint64_t start,
++                                        size_t length)
++{
++    int ret = -1;
++
++#ifdef CONFIG_FALLOCATE_PUNCH_HOLE
++    ret = fallocate(rb->guest_memfd, FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE,
++                    start, length);
++
++    if (ret) {
++        ret = -errno;
++        error_report("%s: Failed to fallocate %s:%" PRIx64 " +%zx (%d)",
++                     __func__, rb->idstr, start, length, ret);
++    }
++#else
++    ret = -ENOSYS;
++    error_report("%s: fallocate not available %s:%" PRIx64 " +%zx (%d)",
++                 __func__, rb->idstr, start, length, ret);
++#endif
++
++    return ret;
++}
++
+ bool ramblock_is_pmem(RAMBlock *rb)
+ {
+     return rb->flags & RAM_PMEM;
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-ppc-pef-switch-to-use-confidential_guest_kvm_init-re.patch b/SOURCES/kvm-ppc-pef-switch-to-use-confidential_guest_kvm_init-re.patch
new file mode 100644
index 0000000..037442c
--- /dev/null
+++ b/SOURCES/kvm-ppc-pef-switch-to-use-confidential_guest_kvm_init-re.patch
@@ -0,0 +1,140 @@
+From cfb109b393e019398a52f66a5ff0e9581c841335 Mon Sep 17 00:00:00 2001
+From: Xiaoyao Li <xiaoyao.li@intel.com>
+Date: Thu, 29 Feb 2024 01:00:37 -0500
+Subject: [PATCH 013/100] ppc/pef: switch to use
+ confidential_guest_kvm_init/reset()
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [13/91] e25c498fc79a4c8e22ca41d9cbd06e40b4cf1f11 (bonzini/rhel-qemu-kvm)
+
+Use the unified interface to call confidential guest related kvm_init()
+and kvm_reset(), to avoid exposing pef specific functions.
+
+As a bonus, pef.h goes away since there is no direct call from sPAPR
+board code to PEF code anymore.
+
+Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 00a238b1a845fd5f0acd771664c5e184a63ed9b6)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ hw/ppc/pef.c         |  9 ++++++---
+ hw/ppc/spapr.c       | 10 +++++++---
+ include/hw/ppc/pef.h | 17 -----------------
+ 3 files changed, 13 insertions(+), 23 deletions(-)
+ delete mode 100644 include/hw/ppc/pef.h
+
+diff --git a/hw/ppc/pef.c b/hw/ppc/pef.c
+index d28ed3ba73..47553348b1 100644
+--- a/hw/ppc/pef.c
++++ b/hw/ppc/pef.c
+@@ -15,7 +15,6 @@
+ #include "sysemu/kvm.h"
+ #include "migration/blocker.h"
+ #include "exec/confidential-guest-support.h"
+-#include "hw/ppc/pef.h"
+ 
+ #define TYPE_PEF_GUEST "pef-guest"
+ OBJECT_DECLARE_SIMPLE_TYPE(PefGuest, PEF_GUEST)
+@@ -93,7 +92,7 @@ static int kvmppc_svm_off(Error **errp)
+ #endif
+ }
+ 
+-int pef_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
++static int pef_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
+ {
+     if (!object_dynamic_cast(OBJECT(cgs), TYPE_PEF_GUEST)) {
+         return 0;
+@@ -107,7 +106,7 @@ int pef_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
+     return kvmppc_svm_init(cgs, errp);
+ }
+ 
+-int pef_kvm_reset(ConfidentialGuestSupport *cgs, Error **errp)
++static int pef_kvm_reset(ConfidentialGuestSupport *cgs, Error **errp)
+ {
+     if (!object_dynamic_cast(OBJECT(cgs), TYPE_PEF_GUEST)) {
+         return 0;
+@@ -131,6 +130,10 @@ OBJECT_DEFINE_TYPE_WITH_INTERFACES(PefGuest,
+ 
+ static void pef_guest_class_init(ObjectClass *oc, void *data)
+ {
++    ConfidentialGuestSupportClass *klass = CONFIDENTIAL_GUEST_SUPPORT_CLASS(oc);
++
++    klass->kvm_init = pef_kvm_init;
++    klass->kvm_reset = pef_kvm_reset;
+ }
+ 
+ static void pef_guest_init(Object *obj)
+diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
+index a258d81846..6f6f0fd790 100644
+--- a/hw/ppc/spapr.c
++++ b/hw/ppc/spapr.c
+@@ -75,6 +75,7 @@
+ #include "hw/virtio/vhost-scsi-common.h"
+ 
+ #include "exec/ram_addr.h"
++#include "exec/confidential-guest-support.h"
+ #include "hw/usb.h"
+ #include "qemu/config-file.h"
+ #include "qemu/error-report.h"
+@@ -87,7 +88,6 @@
+ #include "hw/ppc/spapr_tpm_proxy.h"
+ #include "hw/ppc/spapr_nvdimm.h"
+ #include "hw/ppc/spapr_numa.h"
+-#include "hw/ppc/pef.h"
+ 
+ #include "monitor/monitor.h"
+ 
+@@ -1715,7 +1715,9 @@ static void spapr_machine_reset(MachineState *machine, ShutdownCause reason)
+         qemu_guest_getrandom_nofail(spapr->fdt_rng_seed, 32);
+     }
+ 
+-    pef_kvm_reset(machine->cgs, &error_fatal);
++    if (machine->cgs) {
++        confidential_guest_kvm_reset(machine->cgs, &error_fatal);
++    }
+     spapr_caps_apply(spapr);
+     spapr_nested_reset(spapr);
+     if (spapr->svm_allowed) {
+@@ -2844,7 +2846,9 @@ static void spapr_machine_init(MachineState *machine)
+     /*
+      * if Secure VM (PEF) support is configured, then initialize it
+      */
+-    pef_kvm_init(machine->cgs, &error_fatal);
++    if (machine->cgs) {
++        confidential_guest_kvm_init(machine->cgs, &error_fatal);
++    }
+ 
+     msi_nonbroken = true;
+ 
+diff --git a/include/hw/ppc/pef.h b/include/hw/ppc/pef.h
+deleted file mode 100644
+index 707dbe524c..0000000000
+--- a/include/hw/ppc/pef.h
++++ /dev/null
+@@ -1,17 +0,0 @@
+-/*
+- * PEF (Protected Execution Facility) for POWER support
+- *
+- * Copyright Red Hat.
+- *
+- * This work is licensed under the terms of the GNU GPL, version 2 or later.
+- * See the COPYING file in the top-level directory.
+- *
+- */
+-
+-#ifndef HW_PPC_PEF_H
+-#define HW_PPC_PEF_H
+-
+-int pef_kvm_init(ConfidentialGuestSupport *cgs, Error **errp);
+-int pef_kvm_reset(ConfidentialGuestSupport *cgs, Error **errp);
+-
+-#endif /* HW_PPC_PEF_H */
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-q35-Introduce-smm_ranges-property-for-q35-pci-host.patch b/SOURCES/kvm-q35-Introduce-smm_ranges-property-for-q35-pci-host.patch
new file mode 100644
index 0000000..c7f121b
--- /dev/null
+++ b/SOURCES/kvm-q35-Introduce-smm_ranges-property-for-q35-pci-host.patch
@@ -0,0 +1,164 @@
+From 83bb32c25472b500738a54ac8f2ad0f5c496acf1 Mon Sep 17 00:00:00 2001
+From: Isaku Yamahata <isaku.yamahata@linux.intel.com>
+Date: Wed, 20 Mar 2024 03:39:14 -0500
+Subject: [PATCH 009/100] q35: Introduce smm_ranges property for q35-pci-host
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [9/91] 931156772bfc2085e7241eecc56cf6eca3dac1fd (bonzini/rhel-qemu-kvm)
+
+Add a q35 property to check whether or not SMM ranges, e.g. SMRAM, TSEG,
+etc... exist for the target platform.  TDX doesn't support SMM and doesn't
+play nice with QEMU modifying related guest memory ranges.
+
+Signed-off-by: Isaku Yamahata <isaku.yamahata@linux.intel.com>
+Co-developed-by: Sean Christopherson <sean.j.christopherson@intel.com>
+Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
+Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
+Signed-off-by: Michael Roth <michael.roth@amd.com>
+Message-ID: <20240320083945.991426-19-michael.roth@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit b07bf7b73fd02d24a7baa64a580f4974b86bbc86)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ hw/i386/pc_q35.c          |  2 ++
+ hw/pci-host/q35.c         | 42 +++++++++++++++++++++++++++------------
+ include/hw/i386/pc.h      |  1 +
+ include/hw/pci-host/q35.h |  1 +
+ 4 files changed, 33 insertions(+), 13 deletions(-)
+
+diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
+index 9adcdadce8..dedc86eec9 100644
+--- a/hw/i386/pc_q35.c
++++ b/hw/i386/pc_q35.c
+@@ -219,6 +219,8 @@ static void pc_q35_init(MachineState *machine)
+                             x86ms->above_4g_mem_size, NULL);
+     object_property_set_bool(phb, PCI_HOST_BYPASS_IOMMU,
+                              pcms->default_bus_bypass_iommu, NULL);
++    object_property_set_bool(phb, PCI_HOST_PROP_SMM_RANGES,
++                             x86_machine_is_smm_enabled(x86ms), NULL);
+     sysbus_realize_and_unref(SYS_BUS_DEVICE(phb), &error_fatal);
+ 
+     /* pci */
+diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
+index 98d4a7c253..0b6cbaed7e 100644
+--- a/hw/pci-host/q35.c
++++ b/hw/pci-host/q35.c
+@@ -179,6 +179,8 @@ static Property q35_host_props[] = {
+                      mch.below_4g_mem_size, 0),
+     DEFINE_PROP_SIZE(PCI_HOST_ABOVE_4G_MEM_SIZE, Q35PCIHost,
+                      mch.above_4g_mem_size, 0),
++    DEFINE_PROP_BOOL(PCI_HOST_PROP_SMM_RANGES, Q35PCIHost,
++                     mch.has_smm_ranges, true),
+     DEFINE_PROP_BOOL("x-pci-hole64-fix", Q35PCIHost, pci_hole64_fix, true),
+     DEFINE_PROP_END_OF_LIST(),
+ };
+@@ -214,6 +216,7 @@ static void q35_host_initfn(Object *obj)
+     /* mch's object_initialize resets the default value, set it again */
+     qdev_prop_set_uint64(DEVICE(s), PCI_HOST_PROP_PCI_HOLE64_SIZE,
+                          Q35_PCI_HOST_HOLE64_SIZE_DEFAULT);
++
+     object_property_add(obj, PCI_HOST_PROP_PCI_HOLE_START, "uint32",
+                         q35_host_get_pci_hole_start,
+                         NULL, NULL, NULL);
+@@ -476,6 +479,10 @@ static void mch_write_config(PCIDevice *d,
+         mch_update_pciexbar(mch);
+     }
+ 
++    if (!mch->has_smm_ranges) {
++        return;
++    }
++
+     if (ranges_overlap(address, len, MCH_HOST_BRIDGE_SMRAM,
+                        MCH_HOST_BRIDGE_SMRAM_SIZE)) {
+         mch_update_smram(mch);
+@@ -494,10 +501,13 @@ static void mch_write_config(PCIDevice *d,
+ static void mch_update(MCHPCIState *mch)
+ {
+     mch_update_pciexbar(mch);
++
+     mch_update_pam(mch);
+-    mch_update_smram(mch);
+-    mch_update_ext_tseg_mbytes(mch);
+-    mch_update_smbase_smram(mch);
++    if (mch->has_smm_ranges) {
++        mch_update_smram(mch);
++        mch_update_ext_tseg_mbytes(mch);
++        mch_update_smbase_smram(mch);
++    }
+ 
+     /*
+      * pci hole goes from end-of-low-ram to io-apic.
+@@ -538,18 +548,20 @@ static void mch_reset(DeviceState *qdev)
+     pci_set_quad(d->config + MCH_HOST_BRIDGE_PCIEXBAR,
+                  MCH_HOST_BRIDGE_PCIEXBAR_DEFAULT);
+ 
+-    d->config[MCH_HOST_BRIDGE_SMRAM] = MCH_HOST_BRIDGE_SMRAM_DEFAULT;
+-    d->config[MCH_HOST_BRIDGE_ESMRAMC] = MCH_HOST_BRIDGE_ESMRAMC_DEFAULT;
+-    d->wmask[MCH_HOST_BRIDGE_SMRAM] = MCH_HOST_BRIDGE_SMRAM_WMASK;
+-    d->wmask[MCH_HOST_BRIDGE_ESMRAMC] = MCH_HOST_BRIDGE_ESMRAMC_WMASK;
++    if (mch->has_smm_ranges) {
++        d->config[MCH_HOST_BRIDGE_SMRAM] = MCH_HOST_BRIDGE_SMRAM_DEFAULT;
++        d->config[MCH_HOST_BRIDGE_ESMRAMC] = MCH_HOST_BRIDGE_ESMRAMC_DEFAULT;
++        d->wmask[MCH_HOST_BRIDGE_SMRAM] = MCH_HOST_BRIDGE_SMRAM_WMASK;
++        d->wmask[MCH_HOST_BRIDGE_ESMRAMC] = MCH_HOST_BRIDGE_ESMRAMC_WMASK;
+ 
+-    if (mch->ext_tseg_mbytes > 0) {
+-        pci_set_word(d->config + MCH_HOST_BRIDGE_EXT_TSEG_MBYTES,
+-                     MCH_HOST_BRIDGE_EXT_TSEG_MBYTES_QUERY);
+-    }
++        if (mch->ext_tseg_mbytes > 0) {
++            pci_set_word(d->config + MCH_HOST_BRIDGE_EXT_TSEG_MBYTES,
++                        MCH_HOST_BRIDGE_EXT_TSEG_MBYTES_QUERY);
++        }
+ 
+-    d->config[MCH_HOST_BRIDGE_F_SMBASE] = 0;
+-    d->wmask[MCH_HOST_BRIDGE_F_SMBASE] = 0xff;
++        d->config[MCH_HOST_BRIDGE_F_SMBASE] = 0;
++        d->wmask[MCH_HOST_BRIDGE_F_SMBASE] = 0xff;
++    }
+ 
+     mch_update(mch);
+ }
+@@ -578,6 +590,10 @@ static void mch_realize(PCIDevice *d, Error **errp)
+                  PAM_EXPAN_BASE + i * PAM_EXPAN_SIZE, PAM_EXPAN_SIZE);
+     }
+ 
++    if (!mch->has_smm_ranges) {
++        return;
++    }
++
+     /* if *disabled* show SMRAM to all CPUs */
+     memory_region_init_alias(&mch->smram_region, OBJECT(mch), "smram-region",
+                              mch->pci_address_space, MCH_HOST_BRIDGE_SMRAM_C_BASE,
+diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
+index 87420783ab..467e7fb52f 100644
+--- a/include/hw/i386/pc.h
++++ b/include/hw/i386/pc.h
+@@ -164,6 +164,7 @@ void pc_acpi_smi_interrupt(void *opaque, int irq, int level);
+ #define PCI_HOST_PROP_PCI_HOLE64_SIZE  "pci-hole64-size"
+ #define PCI_HOST_BELOW_4G_MEM_SIZE     "below-4g-mem-size"
+ #define PCI_HOST_ABOVE_4G_MEM_SIZE     "above-4g-mem-size"
++#define PCI_HOST_PROP_SMM_RANGES       "smm-ranges"
+ 
+ 
+ void pc_pci_as_mapping_init(MemoryRegion *system_memory,
+diff --git a/include/hw/pci-host/q35.h b/include/hw/pci-host/q35.h
+index bafcbe6752..22fadfa3ed 100644
+--- a/include/hw/pci-host/q35.h
++++ b/include/hw/pci-host/q35.h
+@@ -50,6 +50,7 @@ struct MCHPCIState {
+     MemoryRegion tseg_blackhole, tseg_window;
+     MemoryRegion smbase_blackhole, smbase_window;
+     bool has_smram_at_smbase;
++    bool has_smm_ranges;
+     Range pci_hole;
+     uint64_t below_4g_mem_size;
+     uint64_t above_4g_mem_size;
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-qcow2-Don-t-open-data_file-with-BDRV_O_NO_IO.patch b/SOURCES/kvm-qcow2-Don-t-open-data_file-with-BDRV_O_NO_IO.patch
index a92c7f5..00cdae0 100644
--- a/SOURCES/kvm-qcow2-Don-t-open-data_file-with-BDRV_O_NO_IO.patch
+++ b/SOURCES/kvm-qcow2-Don-t-open-data_file-with-BDRV_O_NO_IO.patch
@@ -1,44 +1,36 @@
-From 6e39b4c13c0eacb35e81874b09e6b6411266c631 Mon Sep 17 00:00:00 2001
-From: Jon Maloy <jmaloy@redhat.com>
-Date: Wed, 5 Jun 2024 19:56:51 -0400
+From 97739ee2ed20856fe395248d399dfc7f9ab4f33d Mon Sep 17 00:00:00 2001
+From: Kevin Wolf <kwolf@redhat.com>
+Date: Thu, 11 Apr 2024 15:06:01 +0200
 Subject: [PATCH 1/4] qcow2: Don't open data_file with BDRV_O_NO_IO
 
-RH-Author: Jon Maloy <jmaloy@redhat.com>
-RH-MergeRequest: 2: EMBARGOED CVE-2024-4467 for rhel-9.4.z (PRDSC)
-RH-Jira: https://issues.redhat.com/browse/RHEL-35610
+RH-Author: Hana Czenczek <hczenczek@redhat.com>
+RH-MergeRequest: 1: CVE 2024-4467 (PRDSC)
+RH-Jira: RHEL-35611
 RH-CVE: CVE-2024-4467
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
 RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Acked-by: Hanna Czenczek <hczenczek@redhat.com>
-RH-Commit: [1/4] 1000359b05c706f3c5155a9481692352be333129
+RH-Acked-by: Eric Blake <eblake@redhat.com>
+RH-Commit: [1/4] f9843ce5c519901654a7d8ba43ee95ce25ca13c2
 
-commit f9843ce5c519901654a7d8ba43ee95ce25ca13c2
-Author: Kevin Wolf <kwolf@redhat.com>
-Date:   Thu Apr 11 15:06:01 2024 +0200
+One use case for 'qemu-img info' is verifying that untrusted images
+don't reference an unwanted external file, be it as a backing file or an
+external data file. To make sure that calling 'qemu-img info' can't
+already have undesired side effects with a malicious image, just don't
+open the data file at all with BDRV_O_NO_IO. If nothing ever tries to do
+I/O, we don't need to have it open.
 
-    qcow2: Don't open data_file with BDRV_O_NO_IO
+This changes the output of iotests case 061, which used 'qemu-img info'
+to show that opening an image with an invalid data file fails. After
+this patch, it succeeds. Replace this part of the test with a qemu-io
+call, but keep the final 'qemu-img info' to show that the invalid data
+file is correctly displayed in the output.
 
-    One use case for 'qemu-img info' is verifying that untrusted images
-    don't reference an unwanted external file, be it as a backing file or an
-    external data file. To make sure that calling 'qemu-img info' can't
-    already have undesired side effects with a malicious image, just don't
-    open the data file at all with BDRV_O_NO_IO. If nothing ever tries to do
-    I/O, we don't need to have it open.
-
-    This changes the output of iotests case 061, which used 'qemu-img info'
-    to show that opening an image with an invalid data file fails. After
-    this patch, it succeeds. Replace this part of the test with a qemu-io
-    call, but keep the final 'qemu-img info' to show that the invalid data
-    file is correctly displayed in the output.
-
-    Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-    Reviewed-by: Eric Blake <eblake@redhat.com>
-    Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-    Reviewed-by: Hanna Czenczek <hreitz@redhat.com>
-    Upstream: N/A, embargoed
-    Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
-
-Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+Reviewed-by: Eric Blake <eblake@redhat.com>
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Reviewed-by: Hanna Czenczek <hreitz@redhat.com>
+Upstream: N/A, embargoed
+Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
 ---
  block/qcow2.c              | 17 ++++++++++++++++-
  tests/qemu-iotests/061     |  6 ++++--
@@ -46,7 +38,7 @@ Signed-off-by: Jon Maloy <jmaloy@redhat.com>
  3 files changed, 26 insertions(+), 5 deletions(-)
 
 diff --git a/block/qcow2.c b/block/qcow2.c
-index d91b7b91d3..b269cfc78f 100644
+index 0ebd455dc8..a4cffb628c 100644
 --- a/block/qcow2.c
 +++ b/block/qcow2.c
 @@ -1642,7 +1642,22 @@ qcow2_do_open(BlockDriverState *bs, QDict *options, int flags,
diff --git a/SOURCES/kvm-qdev-add-IOThreadVirtQueueMappingList-property-type.patch b/SOURCES/kvm-qdev-add-IOThreadVirtQueueMappingList-property-type.patch
deleted file mode 100644
index b31142e..0000000
--- a/SOURCES/kvm-qdev-add-IOThreadVirtQueueMappingList-property-type.patch
+++ /dev/null
@@ -1,167 +0,0 @@
-From f1e82fe5076b4030d385dfa49b8284899386114d Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Wed, 20 Dec 2023 08:47:54 -0500
-Subject: [PATCH 08/22] qdev: add IOThreadVirtQueueMappingList property type
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 219: virtio-blk: add iothread-vq-mapping parameter
-RH-Jira: RHEL-17369 RHEL-20764 RHEL-7356
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Commit: [4/17] 817aa1339da8ed3814730473342ba045e66d5b51 (stefanha/centos-stream-qemu-kvm)
-
-virtio-blk and virtio-scsi devices will need a way to specify the
-mapping between IOThreads and virtqueues. At the moment all virtqueues
-are assigned to a single IOThread or the main loop. This single thread
-can be a CPU bottleneck, so it is necessary to allow finer-grained
-assignment to spread the load.
-
-Introduce DEFINE_PROP_IOTHREAD_VQ_MAPPING_LIST() so devices can take a
-parameter that maps virtqueues to IOThreads. The command-line syntax for
-this new property is as follows:
-
-  --device '{"driver":"foo","iothread-vq-mapping":[{"iothread":"iothread0","vqs":[0,1,2]},...]}'
-
-IOThreads are specified by name and virtqueues are specified by 0-based
-index.
-
-It will be common to simply assign virtqueues round-robin across a set
-of IOThreads. A convenient syntax that does not require specifying
-individual virtqueue indices is available:
-
-  --device '{"driver":"foo","iothread-vq-mapping":[{"iothread":"iothread0"},{"iothread":"iothread1"},...]}'
-
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20231220134755.814917-4-stefanha@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit cf03a152c5d749fd0083bfe540df9524f1d2ff1d)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- hw/core/qdev-properties-system.c    | 46 +++++++++++++++++++++++++++++
- include/hw/qdev-properties-system.h |  5 ++++
- qapi/virtio.json                    | 29 ++++++++++++++++++
- 3 files changed, 80 insertions(+)
-
-diff --git a/hw/core/qdev-properties-system.c b/hw/core/qdev-properties-system.c
-index 73cced4626..1a396521d5 100644
---- a/hw/core/qdev-properties-system.c
-+++ b/hw/core/qdev-properties-system.c
-@@ -18,6 +18,7 @@
- #include "qapi/qapi-types-block.h"
- #include "qapi/qapi-types-machine.h"
- #include "qapi/qapi-types-migration.h"
-+#include "qapi/qapi-visit-virtio.h"
- #include "qapi/qmp/qerror.h"
- #include "qemu/ctype.h"
- #include "qemu/cutils.h"
-@@ -1160,3 +1161,48 @@ const PropertyInfo qdev_prop_cpus390entitlement = {
-     .set   = qdev_propinfo_set_enum,
-     .set_default_value = qdev_propinfo_set_default_value_enum,
- };
-+
-+/* --- IOThreadVirtQueueMappingList --- */
-+
-+static void get_iothread_vq_mapping_list(Object *obj, Visitor *v,
-+        const char *name, void *opaque, Error **errp)
-+{
-+    IOThreadVirtQueueMappingList **prop_ptr =
-+        object_field_prop_ptr(obj, opaque);
-+
-+    visit_type_IOThreadVirtQueueMappingList(v, name, prop_ptr, errp);
-+}
-+
-+static void set_iothread_vq_mapping_list(Object *obj, Visitor *v,
-+        const char *name, void *opaque, Error **errp)
-+{
-+    IOThreadVirtQueueMappingList **prop_ptr =
-+        object_field_prop_ptr(obj, opaque);
-+    IOThreadVirtQueueMappingList *list;
-+
-+    if (!visit_type_IOThreadVirtQueueMappingList(v, name, &list, errp)) {
-+        return;
-+    }
-+
-+    qapi_free_IOThreadVirtQueueMappingList(*prop_ptr);
-+    *prop_ptr = list;
-+}
-+
-+static void release_iothread_vq_mapping_list(Object *obj,
-+        const char *name, void *opaque)
-+{
-+    IOThreadVirtQueueMappingList **prop_ptr =
-+        object_field_prop_ptr(obj, opaque);
-+
-+    qapi_free_IOThreadVirtQueueMappingList(*prop_ptr);
-+    *prop_ptr = NULL;
-+}
-+
-+const PropertyInfo qdev_prop_iothread_vq_mapping_list = {
-+    .name = "IOThreadVirtQueueMappingList",
-+    .description = "IOThread virtqueue mapping list [{\"iothread\":\"<id>\", "
-+                   "\"vqs\":[1,2,3,...]},...]",
-+    .get = get_iothread_vq_mapping_list,
-+    .set = set_iothread_vq_mapping_list,
-+    .release = release_iothread_vq_mapping_list,
-+};
-diff --git a/include/hw/qdev-properties-system.h b/include/hw/qdev-properties-system.h
-index 91f7a2452d..06c359c190 100644
---- a/include/hw/qdev-properties-system.h
-+++ b/include/hw/qdev-properties-system.h
-@@ -24,6 +24,7 @@ extern const PropertyInfo qdev_prop_off_auto_pcibar;
- extern const PropertyInfo qdev_prop_pcie_link_speed;
- extern const PropertyInfo qdev_prop_pcie_link_width;
- extern const PropertyInfo qdev_prop_cpus390entitlement;
-+extern const PropertyInfo qdev_prop_iothread_vq_mapping_list;
- 
- #define DEFINE_PROP_PCI_DEVFN(_n, _s, _f, _d)                   \
-     DEFINE_PROP_SIGNED(_n, _s, _f, _d, qdev_prop_pci_devfn, int32_t)
-@@ -82,4 +83,8 @@ extern const PropertyInfo qdev_prop_cpus390entitlement;
-     DEFINE_PROP_SIGNED(_n, _s, _f, _d, qdev_prop_cpus390entitlement, \
-                        CpuS390Entitlement)
- 
-+#define DEFINE_PROP_IOTHREAD_VQ_MAPPING_LIST(_name, _state, _field) \
-+    DEFINE_PROP(_name, _state, _field, qdev_prop_iothread_vq_mapping_list, \
-+                IOThreadVirtQueueMappingList *)
-+
- #endif
-diff --git a/qapi/virtio.json b/qapi/virtio.json
-index e6dcee7b83..19c7c36e36 100644
---- a/qapi/virtio.json
-+++ b/qapi/virtio.json
-@@ -928,3 +928,32 @@
-   'data': { 'path': 'str', 'queue': 'uint16', '*index': 'uint16' },
-   'returns': 'VirtioQueueElement',
-   'features': [ 'unstable' ] }
-+
-+##
-+# @IOThreadVirtQueueMapping:
-+#
-+# Describes the subset of virtqueues assigned to an IOThread.
-+#
-+# @iothread: the id of IOThread object
-+#
-+# @vqs: an optional array of virtqueue indices that will be handled by this
-+#     IOThread.  When absent, virtqueues are assigned round-robin across all
-+#     IOThreadVirtQueueMappings provided.  Either all IOThreadVirtQueueMappings
-+#     must have @vqs or none of them must have it.
-+#
-+# Since: 9.0
-+##
-+
-+{ 'struct': 'IOThreadVirtQueueMapping',
-+  'data': { 'iothread': 'str', '*vqs': ['uint16'] } }
-+
-+##
-+# @DummyVirtioForceArrays:
-+#
-+# Not used by QMP; hack to let us use IOThreadVirtQueueMappingList internally
-+#
-+# Since: 9.0
-+##
-+
-+{ 'struct': 'DummyVirtioForceArrays',
-+  'data': { 'unused-iothread-vq-mapping': ['IOThreadVirtQueueMapping'] } }
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-qdev-properties-alias-all-object-class-properties.patch b/SOURCES/kvm-qdev-properties-alias-all-object-class-properties.patch
deleted file mode 100644
index 94bb716..0000000
--- a/SOURCES/kvm-qdev-properties-alias-all-object-class-properties.patch
+++ /dev/null
@@ -1,85 +0,0 @@
-From 4251aab5b2beb68d1800cd4a329361ff6f57c430 Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Wed, 20 Dec 2023 08:47:52 -0500
-Subject: [PATCH 07/22] qdev-properties: alias all object class properties
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 219: virtio-blk: add iothread-vq-mapping parameter
-RH-Jira: RHEL-17369 RHEL-20764 RHEL-7356
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Commit: [3/17] bc5d0aafe4645dacf9277904a2b20760d6e676e1 (stefanha/centos-stream-qemu-kvm)
-
-qdev_alias_all_properties() aliases a DeviceState's qdev properties onto
-an Object. This is used for VirtioPCIProxy types so that --device
-virtio-blk-pci has properties of its embedded --device virtio-blk-device
-object.
-
-Currently this function is implemented using qdev properties. Change the
-function to use QOM object class properties instead. This works because
-qdev properties create QOM object class properties, but it also catches
-any QOM object class-only properties that have no qdev properties.
-
-This change ensures that properties of devices are shown with --device
-foo,\? even if they are QOM object class properties.
-
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20231220134755.814917-2-stefanha@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 350147a871a545ab56b4a1062c8485635d9ffc24)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- hw/core/qdev-properties.c    | 18 ++++++++++--------
- include/hw/qdev-properties.h |  4 ++--
- 2 files changed, 12 insertions(+), 10 deletions(-)
-
-diff --git a/hw/core/qdev-properties.c b/hw/core/qdev-properties.c
-index 840006e953..7d6fa726fd 100644
---- a/hw/core/qdev-properties.c
-+++ b/hw/core/qdev-properties.c
-@@ -1076,16 +1076,18 @@ void device_class_set_props(DeviceClass *dc, Property *props)
- void qdev_alias_all_properties(DeviceState *target, Object *source)
- {
-     ObjectClass *class;
--    Property *prop;
-+    ObjectPropertyIterator iter;
-+    ObjectProperty *prop;
- 
-     class = object_get_class(OBJECT(target));
--    do {
--        DeviceClass *dc = DEVICE_CLASS(class);
- 
--        for (prop = dc->props_; prop && prop->name; prop++) {
--            object_property_add_alias(source, prop->name,
--                                      OBJECT(target), prop->name);
-+    object_class_property_iter_init(&iter, class);
-+    while ((prop = object_property_iter_next(&iter))) {
-+        if (object_property_find(source, prop->name)) {
-+            continue; /* skip duplicate properties */
-         }
--        class = object_class_get_parent(class);
--    } while (class != object_class_by_name(TYPE_DEVICE));
-+
-+        object_property_add_alias(source, prop->name,
-+                                  OBJECT(target), prop->name);
-+    }
- }
-diff --git a/include/hw/qdev-properties.h b/include/hw/qdev-properties.h
-index 25743a29a0..09aa04ca1e 100644
---- a/include/hw/qdev-properties.h
-+++ b/include/hw/qdev-properties.h
-@@ -230,8 +230,8 @@ void qdev_property_add_static(DeviceState *dev, Property *prop);
-  * @target: Device which has properties to be aliased
-  * @source: Object to add alias properties to
-  *
-- * Add alias properties to the @source object for all qdev properties on
-- * the @target DeviceState.
-+ * Add alias properties to the @source object for all properties on the @target
-+ * DeviceState.
-  *
-  * This is useful when @target is an internal implementation object
-  * owned by @source, and you want to expose all the properties of that
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-qemu-guest-agent-Update-the-logfile-path-of-qga-fsfr.patch b/SOURCES/kvm-qemu-guest-agent-Update-the-logfile-path-of-qga-fsfr.patch
new file mode 100644
index 0000000..967adc1
--- /dev/null
+++ b/SOURCES/kvm-qemu-guest-agent-Update-the-logfile-path-of-qga-fsfr.patch
@@ -0,0 +1,40 @@
+From 97e10c2ccc8dc29019d6d22de1d23c55fea0f6c4 Mon Sep 17 00:00:00 2001
+From: Dehan Meng <demeng@redhat.com>
+Date: Wed, 21 Aug 2024 14:55:01 +0800
+Subject: [PATCH] qemu-guest-agent: Update the logfile path of
+ qga-fsfreeze-hook.log
+
+RH-Author: 6-dehan <None>
+RH-MergeRequest: 265: qemu-guest-agent: Update the logfile path of qga-fsfreeze-hook.log
+RH-Jira: RHEL-52250
+RH-Acked-by: Konstantin Kostiuk <None>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [1/1] 7c5cfb882dbc277becb7daa2c5d6b8eff3d601b2 (6-dehan/src_centosupstream_qemu-kvm)
+
+selinux context 'system_u:object_r:virt_qemu_ga_log_t:s0', it
+should be changed to '/var/log/qemu-ga/qga-fsfreeze-hook.log'. And
+it's worth to mention that this is RHEL-only change for matching
+existing SELinux boolean and policy.
+
+Jira: https://issues.redhat.com/browse/RHEL-52250
+Signed-off-by: Dehan Meng <demeng@redhat.com>
+---
+ scripts/qemu-guest-agent/fsfreeze-hook | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/qemu-guest-agent/fsfreeze-hook b/scripts/qemu-guest-agent/fsfreeze-hook
+index e9b84ec028..70536ba3e3 100755
+--- a/scripts/qemu-guest-agent/fsfreeze-hook
++++ b/scripts/qemu-guest-agent/fsfreeze-hook
+@@ -7,7 +7,7 @@
+ # "freeze" argument before the filesystem is frozen. And for fsfreeze-thaw
+ # request, it is issued with "thaw" argument after filesystem is thawed.
+ 
+-LOGFILE=/var/log/qga-fsfreeze-hook.log
++LOGFILE=/var/log/qemu-ga/qga-fsfreeze-hook.log
+ FSFREEZE_D=$(dirname -- "$(realpath $0)")/fsfreeze-hook.d
+ 
+ # Check whether file $1 is a backup or rpm-generated file and should be ignored
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-qemu_init-increase-NOFILE-soft-limit-on-POSIX.patch b/SOURCES/kvm-qemu_init-increase-NOFILE-soft-limit-on-POSIX.patch
deleted file mode 100644
index 7dc550c..0000000
--- a/SOURCES/kvm-qemu_init-increase-NOFILE-soft-limit-on-POSIX.patch
+++ /dev/null
@@ -1,135 +0,0 @@
-From f2fe6c7a2def488633cbb67e28ac00279d6e8de4 Mon Sep 17 00:00:00 2001
-From: Cornelia Huck <cohuck@redhat.com>
-Date: Tue, 27 Feb 2024 11:17:39 +0100
-Subject: [PATCH 1/2] qemu_init: increase NOFILE soft limit on POSIX
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Cornelia Huck <cohuck@redhat.com>
-RH-MergeRequest: 226: qemu_init: increase NOFILE soft limit on POSIX
-RH-Jira: RHEL-26049
-RH-Acked-by: Gavin Shan <gshan@redhat.com>
-RH-Acked-by: Ani Sinha <None>
-RH-Acked-by: Shaoqin Huang <None>
-RH-Commit: [1/1] cee5404aef3f6437d45a1c43bdee73a57a528bee (cohuck/qemu-kvm-c9s)
-
-Jira: https://issues.redhat.com/browse/RHEL-26049
-
-In many configurations, e.g. multiple vNICs with multiple queues or
-with many Ceph OSDs, the default soft limit of 1024 is not enough.
-QEMU is supposed to work fine with file descriptors >= 1024 and does
-not use select() on POSIX. Bump the soft limit to the allowed hard
-limit to avoid issues with the aforementioned configurations.
-
-Of course the limit could be raised from the outside, but the man page
-of systemd.exec states about 'LimitNOFILE=':
-
-> Don't use.
-> [...]
-> Typically applications should increase their soft limit to the hard
-> limit on their own, if they are OK with working with file
-> descriptors above 1023,
-
-If the soft limit is already the same as the hard limit, avoid the
-superfluous setrlimit call. This can avoid a warning with a strict
-seccomp filter blocking setrlimit if NOFILE was already raised before
-executing QEMU.
-
-Buglink: https://bugzilla.proxmox.com/show_bug.cgi?id=4507
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-(cherry picked from commit 03e471c41d8b1b6eb16c9714f387449f52fe5c1d)
-Signed-off-by: Cornelia Huck <cohuck@redhat.com>
----
- include/sysemu/os-posix.h |  1 +
- include/sysemu/os-win32.h |  5 +++++
- os-posix.c                | 22 ++++++++++++++++++++++
- system/vl.c               |  2 ++
- 4 files changed, 30 insertions(+)
-
-diff --git a/include/sysemu/os-posix.h b/include/sysemu/os-posix.h
-index dff32ae185..b881ac6c6f 100644
---- a/include/sysemu/os-posix.h
-+++ b/include/sysemu/os-posix.h
-@@ -51,6 +51,7 @@ bool is_daemonized(void);
- void os_daemonize(void);
- bool os_set_runas(const char *user_id);
- void os_set_chroot(const char *path);
-+void os_setup_limits(void);
- void os_setup_post(void);
- int os_mlock(void);
- 
-diff --git a/include/sysemu/os-win32.h b/include/sysemu/os-win32.h
-index 1047d260cb..b82a5d3ad9 100644
---- a/include/sysemu/os-win32.h
-+++ b/include/sysemu/os-win32.h
-@@ -128,6 +128,11 @@ static inline int os_mlock(void)
-     return -ENOSYS;
- }
- 
-+static inline void os_setup_limits(void)
-+{
-+    return;
-+}
-+
- #define fsync _commit
- 
- #if !defined(lseek)
-diff --git a/os-posix.c b/os-posix.c
-index 52ef6990ff..a4284e2c07 100644
---- a/os-posix.c
-+++ b/os-posix.c
-@@ -24,6 +24,7 @@
-  */
- 
- #include "qemu/osdep.h"
-+#include <sys/resource.h>
- #include <sys/wait.h>
- #include <pwd.h>
- #include <grp.h>
-@@ -256,6 +257,27 @@ void os_daemonize(void)
-     }
- }
- 
-+void os_setup_limits(void)
-+{
-+    struct rlimit nofile;
-+
-+    if (getrlimit(RLIMIT_NOFILE, &nofile) < 0) {
-+        warn_report("unable to query NOFILE limit: %s", strerror(errno));
-+        return;
-+    }
-+
-+    if (nofile.rlim_cur == nofile.rlim_max) {
-+        return;
-+    }
-+
-+    nofile.rlim_cur = nofile.rlim_max;
-+
-+    if (setrlimit(RLIMIT_NOFILE, &nofile) < 0) {
-+        warn_report("unable to set NOFILE limit: %s", strerror(errno));
-+        return;
-+    }
-+}
-+
- void os_setup_post(void)
- {
-     int fd = 0;
-diff --git a/system/vl.c b/system/vl.c
-index 93635ffc5b..6443b6e469 100644
---- a/system/vl.c
-+++ b/system/vl.c
-@@ -2783,6 +2783,8 @@ void qemu_init(int argc, char **argv)
-     error_init(argv[0]);
-     qemu_init_exec_dir(argv[0]);
- 
-+    os_setup_limits();
-+
-     qemu_init_arch_modules();
- 
-     qemu_init_subsystems();
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-qio-Inherit-follow_coroutine_ctx-across-TLS.patch b/SOURCES/kvm-qio-Inherit-follow_coroutine_ctx-across-TLS.patch
index f033486..c60570e 100644
--- a/SOURCES/kvm-qio-Inherit-follow_coroutine_ctx-across-TLS.patch
+++ b/SOURCES/kvm-qio-Inherit-follow_coroutine_ctx-across-TLS.patch
@@ -1,17 +1,17 @@
-From 69d6b5f98d665fbcb86e42df40bcc5e9c79b397f Mon Sep 17 00:00:00 2001
+From fef17d3466deba9b4d581604de1c64c210d1a454 Mon Sep 17 00:00:00 2001
 From: Eric Blake <eblake@redhat.com>
 Date: Fri, 17 May 2024 21:50:14 -0500
-Subject: [PATCH 3/4] qio: Inherit follow_coroutine_ctx across TLS
+Subject: [PATCH 1/4] qio: Inherit follow_coroutine_ctx across TLS
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 
 RH-Author: Eric Blake <eblake@redhat.com>
-RH-MergeRequest: 375: Fix regression on nbd+tls
-RH-Jira: RHEL-33754
+RH-MergeRequest: 244: qio: Inherit follow_coroutine_ctx across TLS
+RH-Jira: RHEL-33440
 RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [3/4] 14ddea7e3c81898bb3fe4be51a40749d67a5c0c0 (ebblake/qemu-kvm)
+RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+RH-Commit: [1/2] 447b144638a1f032fa036838f5f1839628389fe5 (ebblake/centos-qemu-kvm)
 
 Since qemu 8.2, the combination of NBD + TLS + iothread crashes on an
 assertion failure:
@@ -41,7 +41,7 @@ Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 Message-ID: <20240518025246.791593-5-eblake@redhat.com>
 (cherry picked from commit 199e84de1c903ba5aa1f7256310bbc4a20dd930b)
-Jira: https://issues.redhat.com/browse/RHEL-33754
+Jira: https://issues.redhat.com/browse/RHEL-33440
 Signed-off-by: Eric Blake <eblake@redhat.com>
 ---
  io/channel-tls.c     | 26 +++++++++++++++-----------
@@ -49,7 +49,7 @@ Signed-off-by: Eric Blake <eblake@redhat.com>
  2 files changed, 16 insertions(+), 11 deletions(-)
 
 diff --git a/io/channel-tls.c b/io/channel-tls.c
-index 58fe1aceee..a8ad89c3d1 100644
+index 1d9c9c72bf..67b9700006 100644
 --- a/io/channel-tls.c
 +++ b/io/channel-tls.c
 @@ -69,37 +69,40 @@ qio_channel_tls_new_server(QIOChannel *master,
diff --git a/SOURCES/kvm-rhel-9.4.0-machine-type-compat-for-virtio-gpu-migrat.patch b/SOURCES/kvm-rhel-9.4.0-machine-type-compat-for-virtio-gpu-migrat.patch
index 667e80b..c6948ae 100644
--- a/SOURCES/kvm-rhel-9.4.0-machine-type-compat-for-virtio-gpu-migrat.patch
+++ b/SOURCES/kvm-rhel-9.4.0-machine-type-compat-for-virtio-gpu-migrat.patch
@@ -1,19 +1,17 @@
-From aa0ad36a56cbc0528306e47112081b0db124e512 Mon Sep 17 00:00:00 2001
+From 97334815c4a7cf0911b30c1366bbe67e883c57dd Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
 Date: Wed, 5 Jun 2024 10:28:20 +0400
-Subject: [PATCH 3/4] rhel 9.4.0 machine type compat for virtio-gpu migration
+Subject: [PATCH 4/4] rhel 9.4.0 machine type compat for virtio-gpu migration
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 
 RH-Author: Marc-André Lureau <marcandre.lureau@redhat.com>
-RH-MergeRequest: 377: virtio-gpu: fix scanout migration post-load
-RH-Jira: RHEL-36181
+RH-MergeRequest: 246: virtio-gpu: fix v2 migration
+RH-Jira: RHEL-34621
 RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [3/3] 270e932e04eb2d730550f3a56b53cbb17f5e66f8
-
-Jira: https://issues.redhat.com/browse/RHEL-36181
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Commit: [2/2] 2a895d510453e83bb45dfb39b7751bcc2f309cc5 (marcandre.lureau-rh/qemu-kvm-centos)
 
 Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
 ---
@@ -21,17 +19,17 @@ Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
  1 file changed, 2 insertions(+)
 
 diff --git a/hw/core/machine.c b/hw/core/machine.c
-index a0843ab93e..c8c460c916 100644
+index cf1d7faaaf..92609aae27 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
-@@ -81,6 +81,8 @@ GlobalProperty hw_compat_rhel_9_4[] = {
-      { "igb", "x-pcie-flr-init", "off" },
-   /* hw_compat_rhel_9_4 jira RHEL-24045 */
-      { "virtio-mem", "dynamic-memslots", "off" },
-+  /* hw_compat_rhel_9_4 from hw_compat_8_1 */
+@@ -310,6 +310,8 @@ GlobalProperty hw_compat_rhel_9_5[] = {
+     { TYPE_VIRTIO_IOMMU_PCI, "granule", "4k" },
+   /* hw_compat_rhel_9_5 from hw_compat_8_2 */
+     { TYPE_VIRTIO_IOMMU_PCI, "aw-bits", "64" },
++  /* hw_compat_rhel_9_5 from hw_compat_8_2 */
 +    { "virtio-gpu-device", "x-scanout-vmstate-version", "1" },
  };
- const size_t hw_compat_rhel_9_4_len = G_N_ELEMENTS(hw_compat_rhel_9_4);
+ const size_t hw_compat_rhel_9_5_len = G_N_ELEMENTS(hw_compat_rhel_9_5);
  
 -- 
 2.39.3
diff --git a/SOURCES/kvm-runstate-skip-initial-CPU-reset-if-reset-is-not-actu.patch b/SOURCES/kvm-runstate-skip-initial-CPU-reset-if-reset-is-not-actu.patch
new file mode 100644
index 0000000..4f757bf
--- /dev/null
+++ b/SOURCES/kvm-runstate-skip-initial-CPU-reset-if-reset-is-not-actu.patch
@@ -0,0 +1,67 @@
+From 4c93bec108f7e3918a2ef91b51cec477ade38cc3 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Mon, 18 Mar 2024 17:45:56 -0400
+Subject: [PATCH 018/100] runstate: skip initial CPU reset if reset is not
+ actually possible
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [18/91] ced267fdaadbf2072c1897223522457a006e6c81 (bonzini/rhel-qemu-kvm)
+
+Right now, the system reset is concluded by a call to
+cpu_synchronize_all_post_reset() in order to sync any changes
+that the machine reset callback applied to the CPU state.
+
+However, for VMs with encrypted state such as SEV-ES guests (currently
+the only case of guests with non-resettable CPUs) this cannot be done,
+because guest state has already been finalized by machine-init-done notifiers.
+cpu_synchronize_all_post_reset() does nothing on these guests, and actually
+we would like to make it fail if called once guest has been encrypted.
+So, assume that boards that support non-resettable CPUs do not touch
+CPU state and that all such setup is done before, at the time of
+cpu_synchronize_all_post_init().
+
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 08b2d15cdd0d3fbbe37ce23bf192b770db3a7539)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ system/runstate.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/system/runstate.c b/system/runstate.c
+index d6ab860eca..cb4905a40f 100644
+--- a/system/runstate.c
++++ b/system/runstate.c
+@@ -501,7 +501,20 @@ void qemu_system_reset(ShutdownCause reason)
+     default:
+         qapi_event_send_reset(shutdown_caused_by_guest(reason), reason);
+     }
+-    cpu_synchronize_all_post_reset();
++
++    /*
++     * Some boards use the machine reset callback to point CPUs to the firmware
++     * entry point.  Assume that this is not the case for boards that support
++     * non-resettable CPUs (currently used only for confidential guests), in
++     * which case cpu_synchronize_all_post_init() is enough because
++     * it does _more_  than cpu_synchronize_all_post_reset().
++     */
++    if (cpus_are_resettable()) {
++        cpu_synchronize_all_post_reset();
++    } else {
++        assert(runstate_check(RUN_STATE_PRELAUNCH));
++    }
++
+     vm_set_suspended(false);
+ }
+ 
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-s390-Switch-to-use-confidential_guest_kvm_init.patch b/SOURCES/kvm-s390-Switch-to-use-confidential_guest_kvm_init.patch
new file mode 100644
index 0000000..bc6e4e3
--- /dev/null
+++ b/SOURCES/kvm-s390-Switch-to-use-confidential_guest_kvm_init.patch
@@ -0,0 +1,109 @@
+From 4ebc58d4a7a3d4a20f20f1cd3f21082b80097fe2 Mon Sep 17 00:00:00 2001
+From: Xiaoyao Li <xiaoyao.li@intel.com>
+Date: Thu, 29 Feb 2024 01:00:38 -0500
+Subject: [PATCH 014/100] s390: Switch to use confidential_guest_kvm_init()
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [14/91] 8c9e09ec9976c00b41c02868fff034286a341468 (bonzini/rhel-qemu-kvm)
+
+Use unified confidential_guest_kvm_init() for consistency with
+other architectures.
+
+Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
+Message-Id: <20240229060038.606591-1-xiaoyao.li@intel.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit a14a2b0148e657cc526b7a75f2a1937628764e7a)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ hw/s390x/s390-virtio-ccw.c |  5 ++++-
+ target/s390x/kvm/pv.c      | 10 +++++++++-
+ target/s390x/kvm/pv.h      | 14 --------------
+ 3 files changed, 13 insertions(+), 16 deletions(-)
+
+diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
+index 9ad54682c6..828ce6e87e 100644
+--- a/hw/s390x/s390-virtio-ccw.c
++++ b/hw/s390x/s390-virtio-ccw.c
+@@ -14,6 +14,7 @@
+ #include "qemu/osdep.h"
+ #include "qapi/error.h"
+ #include "exec/ram_addr.h"
++#include "exec/confidential-guest-support.h"
+ #include "hw/s390x/s390-virtio-hcall.h"
+ #include "hw/s390x/sclp.h"
+ #include "hw/s390x/s390_flic.h"
+@@ -260,7 +261,9 @@ static void ccw_init(MachineState *machine)
+     s390_init_cpus(machine);
+ 
+     /* Need CPU model to be determined before we can set up PV */
+-    s390_pv_init(machine->cgs, &error_fatal);
++    if (machine->cgs) {
++        confidential_guest_kvm_init(machine->cgs, &error_fatal);
++    }
+ 
+     s390_flic_init();
+ 
+diff --git a/target/s390x/kvm/pv.c b/target/s390x/kvm/pv.c
+index 7ca7faec73..dde836d21a 100644
+--- a/target/s390x/kvm/pv.c
++++ b/target/s390x/kvm/pv.c
+@@ -334,12 +334,17 @@ static bool s390_pv_guest_check(ConfidentialGuestSupport *cgs, Error **errp)
+     return s390_pv_check_cpus(errp);
+ }
+ 
+-int s390_pv_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
++static int s390_pv_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
+ {
+     if (!object_dynamic_cast(OBJECT(cgs), TYPE_S390_PV_GUEST)) {
+         return 0;
+     }
+ 
++    if (!kvm_enabled()) {
++        error_setg(errp, "Protected Virtualization requires KVM");
++        return -1;
++    }
++
+     if (!s390_has_feat(S390_FEAT_UNPACK)) {
+         error_setg(errp,
+                    "CPU model does not support Protected Virtualization");
+@@ -364,6 +369,9 @@ OBJECT_DEFINE_TYPE_WITH_INTERFACES(S390PVGuest,
+ 
+ static void s390_pv_guest_class_init(ObjectClass *oc, void *data)
+ {
++    ConfidentialGuestSupportClass *klass = CONFIDENTIAL_GUEST_SUPPORT_CLASS(oc);
++
++    klass->kvm_init = s390_pv_kvm_init;
+ }
+ 
+ static void s390_pv_guest_init(Object *obj)
+diff --git a/target/s390x/kvm/pv.h b/target/s390x/kvm/pv.h
+index 5877d28ff1..4b40817439 100644
+--- a/target/s390x/kvm/pv.h
++++ b/target/s390x/kvm/pv.h
+@@ -80,18 +80,4 @@ static inline int kvm_s390_dump_mem_state(uint64_t addr, size_t len,
+ static inline int kvm_s390_dump_completion_data(void *buff) { return 0; }
+ #endif /* CONFIG_KVM */
+ 
+-int s390_pv_kvm_init(ConfidentialGuestSupport *cgs, Error **errp);
+-static inline int s390_pv_init(ConfidentialGuestSupport *cgs, Error **errp)
+-{
+-    if (!cgs) {
+-        return 0;
+-    }
+-    if (kvm_enabled()) {
+-        return s390_pv_kvm_init(cgs, errp);
+-    }
+-
+-    error_setg(errp, "Protected Virtualization requires KVM");
+-    return -1;
+-}
+-
+ #endif /* HW_S390_PV_H */
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-s390x-pci-avoid-double-enable-disable-of-aif.patch b/SOURCES/kvm-s390x-pci-avoid-double-enable-disable-of-aif.patch
deleted file mode 100644
index 1b4a4ab..0000000
--- a/SOURCES/kvm-s390x-pci-avoid-double-enable-disable-of-aif.patch
+++ /dev/null
@@ -1,106 +0,0 @@
-From 64b0180f5a52668f8ac4c444ba369231dbc4d5b9 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
-Date: Mon, 22 Jan 2024 09:25:53 +0100
-Subject: [PATCH 096/101] s390x/pci: avoid double enable/disable of aif
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Cédric Le Goater <clg@redhat.com>
-RH-MergeRequest: 215: s390x: Fix reset ordering of passthrough ISM devices
-RH-Jira: RHEL-21169
-RH-Acked-by: Thomas Huth <thuth@redhat.com>
-RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
-RH-Commit: [1/3] ebdf8a474ea21486f5ec051683f17bae6d20f675 (clegoate/qemu-kvm-c9s)
-
-JIRA: https://issues.redhat.com/browse/RHEL-21169
-
-commit 07b2c8e034d80ff92e202405c494d2ff80fcf848
-Author: Matthew Rosato <mjrosato@linux.ibm.com>
-Date:   Thu Jan 18 13:51:49 2024 -0500
-
-    s390x/pci: avoid double enable/disable of aif
-
-    Use a flag to keep track of whether AIF is currently enabled.  This can be
-    used to avoid enabling/disabling AIF multiple times as well as to determine
-    whether or not it should be disabled during reset processing.
-
-    Fixes: d0bc7091c2 ("s390x/pci: enable adapter event notification for interpreted devices")
-    Reported-by: Cédric Le Goater <clg@redhat.com>
-    Reviewed-by: Eric Farman <farman@linux.ibm.com>
-    Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
-    Message-ID: <20240118185151.265329-2-mjrosato@linux.ibm.com>
-    Reviewed-by: Cédric Le Goater <clg@redhat.com>
-    Signed-off-by: Thomas Huth <thuth@redhat.com>
-
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
----
- hw/s390x/s390-pci-kvm.c         | 25 +++++++++++++++++++++++--
- include/hw/s390x/s390-pci-bus.h |  1 +
- 2 files changed, 24 insertions(+), 2 deletions(-)
-
-diff --git a/hw/s390x/s390-pci-kvm.c b/hw/s390x/s390-pci-kvm.c
-index ff41e4106d..1ee510436c 100644
---- a/hw/s390x/s390-pci-kvm.c
-+++ b/hw/s390x/s390-pci-kvm.c
-@@ -27,6 +27,7 @@ bool s390_pci_kvm_interp_allowed(void)
- 
- int s390_pci_kvm_aif_enable(S390PCIBusDevice *pbdev, ZpciFib *fib, bool assist)
- {
-+    int rc;
-     struct kvm_s390_zpci_op args = {
-         .fh = pbdev->fh,
-         .op = KVM_S390_ZPCIOP_REG_AEN,
-@@ -38,15 +39,35 @@ int s390_pci_kvm_aif_enable(S390PCIBusDevice *pbdev, ZpciFib *fib, bool assist)
-         .u.reg_aen.flags = (assist) ? 0 : KVM_S390_ZPCIOP_REGAEN_HOST
-     };
- 
--    return kvm_vm_ioctl(kvm_state, KVM_S390_ZPCI_OP, &args);
-+    if (pbdev->aif) {
-+        return -EINVAL;
-+    }
-+
-+    rc = kvm_vm_ioctl(kvm_state, KVM_S390_ZPCI_OP, &args);
-+    if (rc == 0) {
-+        pbdev->aif = true;
-+    }
-+
-+    return rc;
- }
- 
- int s390_pci_kvm_aif_disable(S390PCIBusDevice *pbdev)
- {
-+    int rc;
-+
-     struct kvm_s390_zpci_op args = {
-         .fh = pbdev->fh,
-         .op = KVM_S390_ZPCIOP_DEREG_AEN
-     };
- 
--    return kvm_vm_ioctl(kvm_state, KVM_S390_ZPCI_OP, &args);
-+    if (!pbdev->aif) {
-+        return -EINVAL;
-+    }
-+
-+    rc = kvm_vm_ioctl(kvm_state, KVM_S390_ZPCI_OP, &args);
-+    if (rc == 0) {
-+        pbdev->aif = false;
-+    }
-+
-+    return rc;
- }
-diff --git a/include/hw/s390x/s390-pci-bus.h b/include/hw/s390x/s390-pci-bus.h
-index b1bdbeaeb5..435e788867 100644
---- a/include/hw/s390x/s390-pci-bus.h
-+++ b/include/hw/s390x/s390-pci-bus.h
-@@ -361,6 +361,7 @@ struct S390PCIBusDevice {
-     bool unplug_requested;
-     bool interp;
-     bool forwarding_assist;
-+    bool aif;
-     QTAILQ_ENTRY(S390PCIBusDevice) link;
- };
- 
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-s390x-pci-drive-ISM-reset-from-subsystem-reset.patch b/SOURCES/kvm-s390x-pci-drive-ISM-reset-from-subsystem-reset.patch
deleted file mode 100644
index f3a4129..0000000
--- a/SOURCES/kvm-s390x-pci-drive-ISM-reset-from-subsystem-reset.patch
+++ /dev/null
@@ -1,137 +0,0 @@
-From c885b17e09ab19a3e8d3b2e1765963811af6f764 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
-Date: Mon, 22 Jan 2024 09:25:53 +0100
-Subject: [PATCH 098/101] s390x/pci: drive ISM reset from subsystem reset
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Cédric Le Goater <clg@redhat.com>
-RH-MergeRequest: 215: s390x: Fix reset ordering of passthrough ISM devices
-RH-Jira: RHEL-21169
-RH-Acked-by: Thomas Huth <thuth@redhat.com>
-RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
-RH-Commit: [3/3] 426cf156a2c67e6dcd7483a769fa3741e2700504 (clegoate/qemu-kvm-c9s)
-
-JIRA: https://issues.redhat.com/browse/RHEL-21169
-
-commit 68c691ca99a2538d6a53a70ce8a9ce06ee307ff1
-Author: Matthew Rosato <mjrosato@linux.ibm.com>
-Date:   Thu Jan 18 13:51:51 2024 -0500
-
-    s390x/pci: drive ISM reset from subsystem reset
-
-    ISM devices are sensitive to manipulation of the IOMMU, so the ISM device
-    needs to be reset before the vfio-pci device is reset (triggering a full
-    UNMAP).  In order to ensure this occurs, trigger ISM device resets from
-    subsystem_reset before triggering the PCI bus reset (which will also
-    trigger vfio-pci reset).  This only needs to be done for ISM devices
-    which were enabled for use by the guest.
-    Further, ensure that AIF is disabled as part of the reset event.
-
-    Fixes: ef1535901a ("s390x: do a subsystem reset before the unprotect on reboot")
-    Fixes: 03451953c7 ("s390x/pci: reset ISM passthrough devices on shutdown and system reset")
-    Reported-by: Cédric Le Goater <clg@redhat.com>
-    Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
-    Message-ID: <20240118185151.265329-4-mjrosato@linux.ibm.com>
-    Reviewed-by: Eric Farman <farman@linux.ibm.com>
-    Reviewed-by: Cédric Le Goater <clg@redhat.com>
-    Signed-off-by: Thomas Huth <thuth@redhat.com>
-
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
----
- hw/s390x/s390-pci-bus.c         | 26 +++++++++++++++++---------
- hw/s390x/s390-virtio-ccw.c      |  8 ++++++++
- include/hw/s390x/s390-pci-bus.h |  1 +
- 3 files changed, 26 insertions(+), 9 deletions(-)
-
-diff --git a/hw/s390x/s390-pci-bus.c b/hw/s390x/s390-pci-bus.c
-index 347580ebac..3e57d5faca 100644
---- a/hw/s390x/s390-pci-bus.c
-+++ b/hw/s390x/s390-pci-bus.c
-@@ -151,20 +151,12 @@ static void s390_pci_shutdown_notifier(Notifier *n, void *opaque)
-     pci_device_reset(pbdev->pdev);
- }
- 
--static void s390_pci_reset_cb(void *opaque)
--{
--    S390PCIBusDevice *pbdev = opaque;
--
--    pci_device_reset(pbdev->pdev);
--}
--
- static void s390_pci_perform_unplug(S390PCIBusDevice *pbdev)
- {
-     HotplugHandler *hotplug_ctrl;
- 
-     if (pbdev->pft == ZPCI_PFT_ISM) {
-         notifier_remove(&pbdev->shutdown_notifier);
--        qemu_unregister_reset(s390_pci_reset_cb, pbdev);
-     }
- 
-     /* Unplug the PCI device */
-@@ -1132,7 +1124,6 @@ static void s390_pcihost_plug(HotplugHandler *hotplug_dev, DeviceState *dev,
-             if (pbdev->pft == ZPCI_PFT_ISM) {
-                 pbdev->shutdown_notifier.notify = s390_pci_shutdown_notifier;
-                 qemu_register_shutdown_notifier(&pbdev->shutdown_notifier);
--                qemu_register_reset(s390_pci_reset_cb, pbdev);
-             }
-         } else {
-             pbdev->fh |= FH_SHM_EMUL;
-@@ -1279,6 +1270,23 @@ static void s390_pci_enumerate_bridge(PCIBus *bus, PCIDevice *pdev,
-     pci_default_write_config(pdev, PCI_SUBORDINATE_BUS, s->bus_no, 1);
- }
- 
-+void s390_pci_ism_reset(void)
-+{
-+    S390pciState *s = s390_get_phb();
-+
-+    S390PCIBusDevice *pbdev, *next;
-+
-+    /* Trigger reset event for each passthrough ISM device currently in-use */
-+    QTAILQ_FOREACH_SAFE(pbdev, &s->zpci_devs, link, next) {
-+        if (pbdev->interp && pbdev->pft == ZPCI_PFT_ISM &&
-+            pbdev->fh & FH_MASK_ENABLE) {
-+            s390_pci_kvm_aif_disable(pbdev);
-+
-+            pci_device_reset(pbdev->pdev);
-+        }
-+    }
-+}
-+
- static void s390_pcihost_reset(DeviceState *dev)
- {
-     S390pciState *s = S390_PCI_HOST_BRIDGE(dev);
-diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
-index e26ce26f5a..24f4773179 100644
---- a/hw/s390x/s390-virtio-ccw.c
-+++ b/hw/s390x/s390-virtio-ccw.c
-@@ -118,6 +118,14 @@ static void subsystem_reset(void)
-     DeviceState *dev;
-     int i;
- 
-+    /*
-+     * ISM firmware is sensitive to unexpected changes to the IOMMU, which can
-+     * occur during reset of the vfio-pci device (unmap of entire aperture).
-+     * Ensure any passthrough ISM devices are reset now, while CPUs are paused
-+     * but before vfio-pci cleanup occurs.
-+     */
-+    s390_pci_ism_reset();
-+
-     for (i = 0; i < ARRAY_SIZE(reset_dev_types); i++) {
-         dev = DEVICE(object_resolve_path_type("", reset_dev_types[i], NULL));
-         if (dev) {
-diff --git a/include/hw/s390x/s390-pci-bus.h b/include/hw/s390x/s390-pci-bus.h
-index 435e788867..2c43ea123f 100644
---- a/include/hw/s390x/s390-pci-bus.h
-+++ b/include/hw/s390x/s390-pci-bus.h
-@@ -401,5 +401,6 @@ S390PCIBusDevice *s390_pci_find_dev_by_target(S390pciState *s,
-                                               const char *target);
- S390PCIBusDevice *s390_pci_find_next_avail_dev(S390pciState *s,
-                                                S390PCIBusDevice *pbdev);
-+void s390_pci_ism_reset(void);
- 
- #endif
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-s390x-pci-refresh-fh-before-disabling-aif.patch b/SOURCES/kvm-s390x-pci-refresh-fh-before-disabling-aif.patch
deleted file mode 100644
index 845a467..0000000
--- a/SOURCES/kvm-s390x-pci-refresh-fh-before-disabling-aif.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-From 49078bdfd4c116da3e920632ec6f7041f1b38015 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
-Date: Mon, 22 Jan 2024 09:25:53 +0100
-Subject: [PATCH 097/101] s390x/pci: refresh fh before disabling aif
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Cédric Le Goater <clg@redhat.com>
-RH-MergeRequest: 215: s390x: Fix reset ordering of passthrough ISM devices
-RH-Jira: RHEL-21169
-RH-Acked-by: Thomas Huth <thuth@redhat.com>
-RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
-RH-Commit: [2/3] 3523067909c41818dfc769abdb93930833416c11 (clegoate/qemu-kvm-c9s)
-
-JIRA: https://issues.redhat.com/browse/RHEL-21169
-
-commit 30e35258e25c75c9d799c34fd89afcafffb37084
-Author: Matthew Rosato <mjrosato@linux.ibm.com>
-Date:   Thu Jan 18 13:51:50 2024 -0500
-
-    s390x/pci: refresh fh before disabling aif
-
-    Typically we refresh the host fh during CLP enable, however it's possible
-    that the device goes through multiple reset events before the guest
-    performs another CLP enable.  Let's handle this for now by refreshing the
-    host handle from vfio before disabling aif.
-
-    Fixes: 03451953c7 ("s390x/pci: reset ISM passthrough devices on shutdown and system reset")
-    Reported-by: Cédric Le Goater <clg@redhat.com>
-    Reviewed-by: Eric Farman <farman@linux.ibm.com>
-    Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
-    Message-ID: <20240118185151.265329-3-mjrosato@linux.ibm.com>
-    Reviewed-by: Cédric Le Goater <clg@redhat.com>
-    Signed-off-by: Thomas Huth <thuth@redhat.com>
-
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
----
- hw/s390x/s390-pci-kvm.c | 9 +++++++++
- 1 file changed, 9 insertions(+)
-
-diff --git a/hw/s390x/s390-pci-kvm.c b/hw/s390x/s390-pci-kvm.c
-index 1ee510436c..9eef4fc3ec 100644
---- a/hw/s390x/s390-pci-kvm.c
-+++ b/hw/s390x/s390-pci-kvm.c
-@@ -18,6 +18,7 @@
- #include "hw/s390x/s390-pci-bus.h"
- #include "hw/s390x/s390-pci-kvm.h"
- #include "hw/s390x/s390-pci-inst.h"
-+#include "hw/s390x/s390-pci-vfio.h"
- #include "cpu_models.h"
- 
- bool s390_pci_kvm_interp_allowed(void)
-@@ -64,6 +65,14 @@ int s390_pci_kvm_aif_disable(S390PCIBusDevice *pbdev)
-         return -EINVAL;
-     }
- 
-+    /*
-+     * The device may have already been reset but we still want to relinquish
-+     * the guest ISC, so always be sure to use an up-to-date host fh.
-+     */
-+    if (!s390_pci_get_host_fh(pbdev, &args.fh)) {
-+        return -EPERM;
-+    }
-+
-     rc = kvm_vm_ioctl(kvm_state, KVM_S390_ZPCI_OP, &args);
-     if (rc == 0) {
-         pbdev->aif = false;
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-scripts-update-linux-header.sh-be-more-src-tree-frie.patch b/SOURCES/kvm-scripts-update-linux-header.sh-be-more-src-tree-frie.patch
new file mode 100644
index 0000000..2c0fb91
--- /dev/null
+++ b/SOURCES/kvm-scripts-update-linux-header.sh-be-more-src-tree-frie.patch
@@ -0,0 +1,186 @@
+From 3d197f42afea6d0b176c2b26b772965692ffeab3 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
+Date: Tue, 14 May 2024 18:42:44 +0100
+Subject: [PATCH 047/100] scripts/update-linux-header.sh: be more src tree
+ friendly
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [47/91] c4165cc8bf79c3f96912e8210b3bb3565add288f (bonzini/rhel-qemu-kvm)
+
+Running "install_headers" in the Linux source tree is fairly
+unfriendly as out-of-tree builds will start complaining about the
+kernel source being non-pristine. As we have a temporary directory for
+the install we should also do the build step here. So now we have:
+
+  $tmpdir/
+    $blddir/
+    $hdrdir/
+
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Message-Id: <20240514174253.694591-3-alex.bennee@linaro.org>
+(cherry picked from commit b51ddd937f11f76614d4b36d14d8778df242661c)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ scripts/update-linux-headers.sh | 80 +++++++++++++++++----------------
+ 1 file changed, 41 insertions(+), 39 deletions(-)
+
+diff --git a/scripts/update-linux-headers.sh b/scripts/update-linux-headers.sh
+index 5f20434d5c..4431ba4d54 100755
+--- a/scripts/update-linux-headers.sh
++++ b/scripts/update-linux-headers.sh
+@@ -27,6 +27,8 @@
+ #   types like "__u64".  This work is done in the cp_portable function.
+ 
+ tmpdir=$(mktemp -d)
++hdrdir="$tmpdir/headers"
++blddir="$tmpdir/build"
+ linux="$1"
+ output="$2"
+ 
+@@ -111,56 +113,56 @@ for arch in $ARCHLIST; do
+         arch_var=ARCH
+     fi
+ 
+-    make -C "$linux" INSTALL_HDR_PATH="$tmpdir" $arch_var=$arch headers_install
++    make -C "$linux" O="$blddir" INSTALL_HDR_PATH="$hdrdir" $arch_var=$arch headers_install
+ 
+     rm -rf "$output/linux-headers/asm-$arch"
+     mkdir -p "$output/linux-headers/asm-$arch"
+     for header in kvm.h unistd.h bitsperlong.h mman.h; do
+-        cp "$tmpdir/include/asm/$header" "$output/linux-headers/asm-$arch"
++        cp "$hdrdir/include/asm/$header" "$output/linux-headers/asm-$arch"
+     done
+ 
+     if [ $arch = mips ]; then
+-        cp "$tmpdir/include/asm/sgidefs.h" "$output/linux-headers/asm-mips/"
+-        cp "$tmpdir/include/asm/unistd_o32.h" "$output/linux-headers/asm-mips/"
+-        cp "$tmpdir/include/asm/unistd_n32.h" "$output/linux-headers/asm-mips/"
+-        cp "$tmpdir/include/asm/unistd_n64.h" "$output/linux-headers/asm-mips/"
++        cp "$hdrdir/include/asm/sgidefs.h" "$output/linux-headers/asm-mips/"
++        cp "$hdrdir/include/asm/unistd_o32.h" "$output/linux-headers/asm-mips/"
++        cp "$hdrdir/include/asm/unistd_n32.h" "$output/linux-headers/asm-mips/"
++        cp "$hdrdir/include/asm/unistd_n64.h" "$output/linux-headers/asm-mips/"
+     fi
+     if [ $arch = powerpc ]; then
+-        cp "$tmpdir/include/asm/unistd_32.h" "$output/linux-headers/asm-powerpc/"
+-        cp "$tmpdir/include/asm/unistd_64.h" "$output/linux-headers/asm-powerpc/"
++        cp "$hdrdir/include/asm/unistd_32.h" "$output/linux-headers/asm-powerpc/"
++        cp "$hdrdir/include/asm/unistd_64.h" "$output/linux-headers/asm-powerpc/"
+     fi
+ 
+     rm -rf "$output/include/standard-headers/asm-$arch"
+     mkdir -p "$output/include/standard-headers/asm-$arch"
+     if [ $arch = s390 ]; then
+-        cp_portable "$tmpdir/include/asm/virtio-ccw.h" "$output/include/standard-headers/asm-s390/"
+-        cp "$tmpdir/include/asm/unistd_32.h" "$output/linux-headers/asm-s390/"
+-        cp "$tmpdir/include/asm/unistd_64.h" "$output/linux-headers/asm-s390/"
++        cp_portable "$hdrdir/include/asm/virtio-ccw.h" "$output/include/standard-headers/asm-s390/"
++        cp "$hdrdir/include/asm/unistd_32.h" "$output/linux-headers/asm-s390/"
++        cp "$hdrdir/include/asm/unistd_64.h" "$output/linux-headers/asm-s390/"
+     fi
+     if [ $arch = arm ]; then
+-        cp "$tmpdir/include/asm/unistd-eabi.h" "$output/linux-headers/asm-arm/"
+-        cp "$tmpdir/include/asm/unistd-oabi.h" "$output/linux-headers/asm-arm/"
+-        cp "$tmpdir/include/asm/unistd-common.h" "$output/linux-headers/asm-arm/"
++        cp "$hdrdir/include/asm/unistd-eabi.h" "$output/linux-headers/asm-arm/"
++        cp "$hdrdir/include/asm/unistd-oabi.h" "$output/linux-headers/asm-arm/"
++        cp "$hdrdir/include/asm/unistd-common.h" "$output/linux-headers/asm-arm/"
+     fi
+     if [ $arch = arm64 ]; then
+-        cp "$tmpdir/include/asm/sve_context.h" "$output/linux-headers/asm-arm64/"
++        cp "$hdrdir/include/asm/sve_context.h" "$output/linux-headers/asm-arm64/"
+     fi
+     if [ $arch = x86 ]; then
+-        cp "$tmpdir/include/asm/unistd_32.h" "$output/linux-headers/asm-x86/"
+-        cp "$tmpdir/include/asm/unistd_x32.h" "$output/linux-headers/asm-x86/"
+-        cp "$tmpdir/include/asm/unistd_64.h" "$output/linux-headers/asm-x86/"
+-        cp_portable "$tmpdir/include/asm/kvm_para.h" "$output/include/standard-headers/asm-$arch"
++        cp "$hdrdir/include/asm/unistd_32.h" "$output/linux-headers/asm-x86/"
++        cp "$hdrdir/include/asm/unistd_x32.h" "$output/linux-headers/asm-x86/"
++        cp "$hdrdir/include/asm/unistd_64.h" "$output/linux-headers/asm-x86/"
++        cp_portable "$hdrdir/include/asm/kvm_para.h" "$output/include/standard-headers/asm-$arch"
+         # Remove everything except the macros from bootparam.h avoiding the
+         # unnecessary import of several video/ist/etc headers
+         sed -e '/__ASSEMBLY__/,/__ASSEMBLY__/d' \
+-               "$tmpdir/include/asm/bootparam.h" > "$tmpdir/bootparam.h"
+-        cp_portable "$tmpdir/bootparam.h" \
++               "$hdrdir/include/asm/bootparam.h" > "$hdrdir/bootparam.h"
++        cp_portable "$hdrdir/bootparam.h" \
+                     "$output/include/standard-headers/asm-$arch"
+-        cp_portable "$tmpdir/include/asm/setup_data.h" \
++        cp_portable "$hdrdir/include/asm/setup_data.h" \
+                     "$output/standard-headers/asm-x86"
+     fi
+     if [ $arch = riscv ]; then
+-        cp "$tmpdir/include/asm/ptrace.h" "$output/linux-headers/asm-riscv/"
++        cp "$hdrdir/include/asm/ptrace.h" "$output/linux-headers/asm-riscv/"
+     fi
+ done
+ arch=
+@@ -170,13 +172,13 @@ mkdir -p "$output/linux-headers/linux"
+ for header in const.h stddef.h kvm.h vfio.h vfio_ccw.h vfio_zdev.h vhost.h \
+               psci.h psp-sev.h userfaultfd.h memfd.h mman.h nvme_ioctl.h \
+               vduse.h iommufd.h bits.h; do
+-    cp "$tmpdir/include/linux/$header" "$output/linux-headers/linux"
++    cp "$hdrdir/include/linux/$header" "$output/linux-headers/linux"
+ done
+ 
+ rm -rf "$output/linux-headers/asm-generic"
+ mkdir -p "$output/linux-headers/asm-generic"
+ for header in unistd.h bitsperlong.h mman-common.h mman.h hugetlb_encode.h; do
+-    cp "$tmpdir/include/asm-generic/$header" "$output/linux-headers/asm-generic"
++    cp "$hdrdir/include/asm-generic/$header" "$output/linux-headers/asm-generic"
+ done
+ 
+ if [ -L "$linux/source" ]; then
+@@ -211,23 +213,23 @@ EOF
+ 
+ rm -rf "$output/include/standard-headers/linux"
+ mkdir -p "$output/include/standard-headers/linux"
+-for i in "$tmpdir"/include/linux/*virtio*.h \
+-         "$tmpdir/include/linux/qemu_fw_cfg.h" \
+-         "$tmpdir/include/linux/fuse.h" \
+-         "$tmpdir/include/linux/input.h" \
+-         "$tmpdir/include/linux/input-event-codes.h" \
+-         "$tmpdir/include/linux/udmabuf.h" \
+-         "$tmpdir/include/linux/pci_regs.h" \
+-         "$tmpdir/include/linux/ethtool.h" \
+-         "$tmpdir/include/linux/const.h" \
+-         "$tmpdir/include/linux/kernel.h" \
+-         "$tmpdir/include/linux/vhost_types.h" \
+-         "$tmpdir/include/linux/sysinfo.h" \
+-         "$tmpdir/include/misc/pvpanic.h"; do
++for i in "$hdrdir"/include/linux/*virtio*.h \
++         "$hdrdir/include/linux/qemu_fw_cfg.h" \
++         "$hdrdir/include/linux/fuse.h" \
++         "$hdrdir/include/linux/input.h" \
++         "$hdrdir/include/linux/input-event-codes.h" \
++         "$hdrdir/include/linux/udmabuf.h" \
++         "$hdrdir/include/linux/pci_regs.h" \
++         "$hdrdir/include/linux/ethtool.h" \
++         "$hdrdir/include/linux/const.h" \
++         "$hdrdir/include/linux/kernel.h" \
++         "$hdrdir/include/linux/vhost_types.h" \
++         "$hdrdir/include/linux/sysinfo.h" \
++         "$hdrdir/include/misc/pvpanic.h"; do
+     cp_portable "$i" "$output/include/standard-headers/linux"
+ done
+ mkdir -p "$output/include/standard-headers/drm"
+-cp_portable "$tmpdir/include/drm/drm_fourcc.h" \
++cp_portable "$hdrdir/include/drm/drm_fourcc.h" \
+             "$output/include/standard-headers/drm"
+ 
+ rm -rf "$output/include/standard-headers/drivers/infiniband/hw/vmw_pvrdma"
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-scripts-update-linux-headers-Add-bits.h-to-file-impo.patch b/SOURCES/kvm-scripts-update-linux-headers-Add-bits.h-to-file-impo.patch
new file mode 100644
index 0000000..eea324e
--- /dev/null
+++ b/SOURCES/kvm-scripts-update-linux-headers-Add-bits.h-to-file-impo.patch
@@ -0,0 +1,38 @@
+From 5db9faee4d6efc9dbe010d2b745aba59d943d2ac Mon Sep 17 00:00:00 2001
+From: Michael Roth <michael.roth@amd.com>
+Date: Wed, 21 Feb 2024 10:51:38 -0600
+Subject: [PATCH 016/100] scripts/update-linux-headers: Add bits.h to file
+ imports
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [16/91] 150ee6376982bd5f471cb561f6760bf80d1211db (bonzini/rhel-qemu-kvm)
+
+Signed-off-by: Michael Roth <michael.roth@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit b40b8eb609d3549ac14aab43849b20f5cba951c9)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ scripts/update-linux-headers.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/update-linux-headers.sh b/scripts/update-linux-headers.sh
+index d48856f9e2..5f20434d5c 100755
+--- a/scripts/update-linux-headers.sh
++++ b/scripts/update-linux-headers.sh
+@@ -169,7 +169,7 @@ rm -rf "$output/linux-headers/linux"
+ mkdir -p "$output/linux-headers/linux"
+ for header in const.h stddef.h kvm.h vfio.h vfio_ccw.h vfio_zdev.h vhost.h \
+               psci.h psp-sev.h userfaultfd.h memfd.h mman.h nvme_ioctl.h \
+-              vduse.h iommufd.h; do
++              vduse.h iommufd.h bits.h; do
+     cp "$tmpdir/include/linux/$header" "$output/linux-headers/linux"
+ done
+ 
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-scripts-update-linux-headers-Add-setup_data.h-to-imp.patch b/SOURCES/kvm-scripts-update-linux-headers-Add-setup_data.h-to-imp.patch
new file mode 100644
index 0000000..86c1f9c
--- /dev/null
+++ b/SOURCES/kvm-scripts-update-linux-headers-Add-setup_data.h-to-imp.patch
@@ -0,0 +1,83 @@
+From 2d0989fe09703ef46ba9c5d14770dbf8a6fd2f80 Mon Sep 17 00:00:00 2001
+From: Michael Roth <michael.roth@amd.com>
+Date: Sun, 18 Feb 2024 23:35:02 -0600
+Subject: [PATCH 015/100] scripts/update-linux-headers: Add setup_data.h to
+ import list
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [15/91] 9d46c8787259317710a84e7a6aa36731e9f55a17 (bonzini/rhel-qemu-kvm)
+
+Data structures like struct setup_data have been moved to a separate
+setup_data.h header which bootparam.h relies on. Add setup_data.h to
+the cp_portable() list and sync it along with the other header files.
+
+Note that currently struct setup_data is stripped away as part of
+generating bootparam.h, but that handling is no currently needed for
+setup_data.h since it doesn't pull in many external
+headers/dependencies. However, QEMU currently redefines struct
+setup_data in hw/i386/x86.c, so that will need to be removed as part of
+any header update that pulls in the new setup_data.h to avoid build
+bisect breakage.
+
+Because <asm/setup_data.h> is the first architecture specific #include
+in include/standard-headers/, add a new sed substitution to rewrite
+asm/ include to the standard-headers/asm-* subdirectory for the current
+architecture.
+
+And while at it, remove asm-generic/kvm_para.h from the list of
+allowed includes: it does not have a matching substitution, and therefore
+it would not be possible to use it on non-Linux systems where there is
+no /usr/include/asm-generic/ directory.
+
+Signed-off-by: Michael Roth <michael.roth@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 66210a1a30f2384bb59f9dad8d769dba56dd30f1)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ scripts/update-linux-headers.sh | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/scripts/update-linux-headers.sh b/scripts/update-linux-headers.sh
+index a0006eec6f..d48856f9e2 100755
+--- a/scripts/update-linux-headers.sh
++++ b/scripts/update-linux-headers.sh
+@@ -61,7 +61,7 @@ cp_portable() {
+                                      -e 'linux/const' \
+                                      -e 'linux/kernel' \
+                                      -e 'linux/sysinfo' \
+-                                     -e 'asm-generic/kvm_para' \
++                                     -e 'asm/setup_data.h' \
+                                      > /dev/null
+     then
+         echo "Unexpected #include in input file $f".
+@@ -77,6 +77,7 @@ cp_portable() {
+         -e 's/__be\([0-9][0-9]*\)/uint\1_t/g' \
+         -e 's/"\(input-event-codes\.h\)"/"standard-headers\/linux\/\1"/' \
+         -e 's/<linux\/\([^>]*\)>/"standard-headers\/linux\/\1"/' \
++        -e 's/<asm\/\([^>]*\)>/"standard-headers\/asm-'$arch'\/\1"/' \
+         -e 's/__bitwise//' \
+         -e 's/__attribute__((packed))/QEMU_PACKED/' \
+         -e 's/__inline__/inline/' \
+@@ -155,11 +156,14 @@ for arch in $ARCHLIST; do
+                "$tmpdir/include/asm/bootparam.h" > "$tmpdir/bootparam.h"
+         cp_portable "$tmpdir/bootparam.h" \
+                     "$output/include/standard-headers/asm-$arch"
++        cp_portable "$tmpdir/include/asm/setup_data.h" \
++                    "$output/standard-headers/asm-x86"
+     fi
+     if [ $arch = riscv ]; then
+         cp "$tmpdir/include/asm/ptrace.h" "$output/linux-headers/asm-riscv/"
+     fi
+ done
++arch=
+ 
+ rm -rf "$output/linux-headers/linux"
+ mkdir -p "$output/linux-headers/linux"
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-scripts-update-linux-headers.sh-Fix-the-path-of-setu.patch b/SOURCES/kvm-scripts-update-linux-headers.sh-Fix-the-path-of-setu.patch
new file mode 100644
index 0000000..ecd631a
--- /dev/null
+++ b/SOURCES/kvm-scripts-update-linux-headers.sh-Fix-the-path-of-setu.patch
@@ -0,0 +1,47 @@
+From 09acdbc49a4dd85d82ad30ec2859edfcdba8431e Mon Sep 17 00:00:00 2001
+From: Thomas Huth <thuth@redhat.com>
+Date: Mon, 27 May 2024 08:01:26 +0200
+Subject: [PATCH 049/100] scripts/update-linux-headers.sh: Fix the path of
+ setup_data.h
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [49/91] f3008bc07796687c9440f5720fbc72a12d0a1278 (bonzini/rhel-qemu-kvm)
+
+When running the update-linx-headers.sh script, it currently fails with:
+
+scripts/update-linux-headers.sh: line 73: .../qemu/standard-headers/asm-x86/setup_data.h: No such file or directory
+
+The "include" folder is obviously missing here - no clue how this could
+have worked before?
+
+Fixes: 66210a1a30 ("scripts/update-linux-headers: Add setup_data.h to import list")
+Message-ID: <20240527060126.12578-1-thuth@redhat.com>
+Reviewed-by: Cornelia Huck <cohuck@redhat.com>
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+(cherry picked from commit bde26d90ae9f7551cac90e117fc7216c807a3bfe)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ scripts/update-linux-headers.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/update-linux-headers.sh b/scripts/update-linux-headers.sh
+index 0f404d5317..f084bee72e 100755
+--- a/scripts/update-linux-headers.sh
++++ b/scripts/update-linux-headers.sh
+@@ -160,7 +160,7 @@ for arch in $ARCHLIST; do
+         cp_portable "$hdrdir/bootparam.h" \
+                     "$output/include/standard-headers/asm-$arch"
+         cp_portable "$hdrdir/include/asm/setup_data.h" \
+-                    "$output/standard-headers/asm-x86"
++                    "$output/include/standard-headers/asm-x86"
+     fi
+     if [ $arch = riscv ]; then
+         cp "$hdrdir/include/asm/ptrace.h" "$output/linux-headers/asm-riscv/"
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-scripts-update-linux-headers.sh-Remove-temporary-dir.patch b/SOURCES/kvm-scripts-update-linux-headers.sh-Remove-temporary-dir.patch
new file mode 100644
index 0000000..c7dbd3a
--- /dev/null
+++ b/SOURCES/kvm-scripts-update-linux-headers.sh-Remove-temporary-dir.patch
@@ -0,0 +1,44 @@
+From 8e63d742015bf69a00fd44e88eb1198f594b2de2 Mon Sep 17 00:00:00 2001
+From: Thomas Huth <thuth@redhat.com>
+Date: Mon, 27 May 2024 08:02:43 +0200
+Subject: [PATCH 048/100] scripts/update-linux-headers.sh: Remove temporary
+ directory inbetween
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [48/91] 879554dc7e722c4e20b302a00ca745ddeefdc0fb (bonzini/rhel-qemu-kvm)
+
+We are reusing the same temporary directory for installing the headers
+of all targets, so there could be stale files here when switching from
+one target to another. Make sure to delete the folder before installing
+a new set of target headers into it.
+
+Message-ID: <20240527060243.12647-1-thuth@redhat.com>
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Cornelia Huck <cohuck@redhat.com>
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+(cherry picked from commit 3efc75ad9d9317e5709861bbebb2c29390f8e7a2)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ scripts/update-linux-headers.sh | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/scripts/update-linux-headers.sh b/scripts/update-linux-headers.sh
+index 4431ba4d54..0f404d5317 100755
+--- a/scripts/update-linux-headers.sh
++++ b/scripts/update-linux-headers.sh
+@@ -113,6 +113,7 @@ for arch in $ARCHLIST; do
+         arch_var=ARCH
+     fi
+ 
++    rm -rf "$hdrdir"
+     make -C "$linux" O="$blddir" INSTALL_HDR_PATH="$hdrdir" $arch_var=$arch headers_install
+ 
+     rm -rf "$output/linux-headers/asm-$arch"
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-scsi-Await-request-purging.patch b/SOURCES/kvm-scsi-Await-request-purging.patch
deleted file mode 100644
index 9bd4399..0000000
--- a/SOURCES/kvm-scsi-Await-request-purging.patch
+++ /dev/null
@@ -1,124 +0,0 @@
-From 94d6458a58239b52394d58b6880509041186d5a8 Mon Sep 17 00:00:00 2001
-From: Hanna Czenczek <hreitz@redhat.com>
-Date: Fri, 2 Feb 2024 15:47:55 +0100
-Subject: [PATCH 04/22] scsi: Await request purging
-
-RH-Author: Hanna Czenczek <hreitz@redhat.com>
-RH-MergeRequest: 222: Allow concurrent BlockBackend context changes
-RH-Jira: RHEL-24593
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Commit: [2/2] 35a89273cab0af8f999881e67d359fe1328363a0 (hreitz/qemu-kvm-c-9-s)
-
-scsi_device_for_each_req_async() currently does not provide any way to
-be awaited.  One of its callers is scsi_device_purge_requests(), which
-therefore currently does not guarantee that all requests are fully
-settled when it returns.
-
-We want all requests to be settled, because scsi_device_purge_requests()
-is called through the unrealize path, including the one invoked by
-virtio_scsi_hotunplug() through qdev_simple_device_unplug_cb(), which
-most likely assumes that all SCSI requests are done then.
-
-In fact, scsi_device_purge_requests() already contains a blk_drain(),
-but this will not fully await scsi_device_for_each_req_async(), only the
-I/O requests it potentially cancels (not the non-I/O requests).
-However, we can have scsi_device_for_each_req_async() increment the BB
-in-flight counter, and have scsi_device_for_each_req_async_bh()
-decrement it when it is done.  This way, the blk_drain() will fully
-await all SCSI requests to be purged.
-
-This also removes the need for scsi_device_for_each_req_async_bh() to
-double-check the current context and potentially re-schedule itself,
-should it now differ from the BB's context: Changing a BB's AioContext
-with a root node is done through bdrv_try_change_aio_context(), which
-creates a drained section.  With this patch, we keep the BB in-flight
-counter elevated throughout, so we know the BB's context cannot change.
-
-Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
-Message-ID: <20240202144755.671354-3-hreitz@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 1604c0493193273e4eac547f86fbd2845e7f9af4)
----
- hw/scsi/scsi-bus.c | 30 +++++++++++++++++++++---------
- 1 file changed, 21 insertions(+), 9 deletions(-)
-
-diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c
-index 5b08cbf60a..b1bf8e6433 100644
---- a/hw/scsi/scsi-bus.c
-+++ b/hw/scsi/scsi-bus.c
-@@ -120,17 +120,13 @@ static void scsi_device_for_each_req_async_bh(void *opaque)
-     SCSIRequest *next;
- 
-     /*
--     * If the AioContext changed before this BH was called then reschedule into
--     * the new AioContext before accessing ->requests. This can happen when
--     * scsi_device_for_each_req_async() is called and then the AioContext is
--     * changed before BHs are run.
-+     * The BB cannot have changed contexts between this BH being scheduled and
-+     * now: BBs' AioContexts, when they have a node attached, can only be
-+     * changed via bdrv_try_change_aio_context(), in a drained section.  While
-+     * we have the in-flight counter incremented, that drain must block.
-      */
-     ctx = blk_get_aio_context(s->conf.blk);
--    if (ctx != qemu_get_current_aio_context()) {
--        aio_bh_schedule_oneshot(ctx, scsi_device_for_each_req_async_bh,
--                                g_steal_pointer(&data));
--        return;
--    }
-+    assert(ctx == qemu_get_current_aio_context());
- 
-     QTAILQ_FOREACH_SAFE(req, &s->requests, next, next) {
-         data->fn(req, data->fn_opaque);
-@@ -138,11 +134,16 @@ static void scsi_device_for_each_req_async_bh(void *opaque)
- 
-     /* Drop the reference taken by scsi_device_for_each_req_async() */
-     object_unref(OBJECT(s));
-+
-+    /* Paired with blk_inc_in_flight() in scsi_device_for_each_req_async() */
-+    blk_dec_in_flight(s->conf.blk);
- }
- 
- /*
-  * Schedule @fn() to be invoked for each enqueued request in device @s. @fn()
-  * runs in the AioContext that is executing the request.
-+ * Keeps the BlockBackend's in-flight counter incremented until everything is
-+ * done, so draining it will settle all scheduled @fn() calls.
-  */
- static void scsi_device_for_each_req_async(SCSIDevice *s,
-                                            void (*fn)(SCSIRequest *, void *),
-@@ -163,6 +164,8 @@ static void scsi_device_for_each_req_async(SCSIDevice *s,
-      */
-     object_ref(OBJECT(s));
- 
-+    /* Paired with blk_dec_in_flight() in scsi_device_for_each_req_async_bh() */
-+    blk_inc_in_flight(s->conf.blk);
-     aio_bh_schedule_oneshot(blk_get_aio_context(s->conf.blk),
-                             scsi_device_for_each_req_async_bh,
-                             data);
-@@ -1728,11 +1731,20 @@ static void scsi_device_purge_one_req(SCSIRequest *req, void *opaque)
-     scsi_req_cancel_async(req, NULL);
- }
- 
-+/**
-+ * Cancel all requests, and block until they are deleted.
-+ */
- void scsi_device_purge_requests(SCSIDevice *sdev, SCSISense sense)
- {
-     scsi_device_for_each_req_async(sdev, scsi_device_purge_one_req, NULL);
- 
-+    /*
-+     * Await all the scsi_device_purge_one_req() calls scheduled by
-+     * scsi_device_for_each_req_async(), and all I/O requests that were
-+     * cancelled this way, but may still take a bit of time to settle.
-+     */
-     blk_drain(sdev->conf.blk);
-+
-     scsi_device_set_ua(sdev, sense);
- }
- 
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-scsi-assert-that-callbacks-run-in-the-correct-AioCon.patch b/SOURCES/kvm-scsi-assert-that-callbacks-run-in-the-correct-AioCon.patch
deleted file mode 100644
index 6d43810..0000000
--- a/SOURCES/kvm-scsi-assert-that-callbacks-run-in-the-correct-AioCon.patch
+++ /dev/null
@@ -1,88 +0,0 @@
-From cd08d22a0da022d99fe6cfddb7de680abf66c8be Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Tue, 5 Dec 2023 13:19:59 -0500
-Subject: [PATCH 082/101] scsi: assert that callbacks run in the correct
- AioContext
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 214: Remove AioContext lock
-RH-Jira: RHEL-15965
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [13/26] d2fd5065c3b72d9d2f4e37efee39fe12eba0f0a9 (kmwolf/centos-qemu-kvm)
-
-Since the removal of AioContext locking, the correctness of the code
-relies on running requests from a single AioContext at any given time.
-
-Add assertions that verify that callbacks are invoked in the correct
-AioContext.
-
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20231205182011.1976568-3-stefanha@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- hw/scsi/scsi-disk.c  | 14 ++++++++++++++
- system/dma-helpers.c |  3 +++
- 2 files changed, 17 insertions(+)
-
-diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
-index 2c1bbb3530..a5048e0aaf 100644
---- a/hw/scsi/scsi-disk.c
-+++ b/hw/scsi/scsi-disk.c
-@@ -273,6 +273,10 @@ static void scsi_aio_complete(void *opaque, int ret)
-     SCSIDiskReq *r = (SCSIDiskReq *)opaque;
-     SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
- 
-+    /* The request must only run in the BlockBackend's AioContext */
-+    assert(blk_get_aio_context(s->qdev.conf.blk) ==
-+           qemu_get_current_aio_context());
-+
-     assert(r->req.aiocb != NULL);
-     r->req.aiocb = NULL;
- 
-@@ -370,8 +374,13 @@ static void scsi_dma_complete(void *opaque, int ret)
- 
- static void scsi_read_complete_noio(SCSIDiskReq *r, int ret)
- {
-+    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
-     uint32_t n;
- 
-+    /* The request must only run in the BlockBackend's AioContext */
-+    assert(blk_get_aio_context(s->qdev.conf.blk) ==
-+           qemu_get_current_aio_context());
-+
-     assert(r->req.aiocb == NULL);
-     if (scsi_disk_req_check_error(r, ret, false)) {
-         goto done;
-@@ -496,8 +505,13 @@ static void scsi_read_data(SCSIRequest *req)
- 
- static void scsi_write_complete_noio(SCSIDiskReq *r, int ret)
- {
-+    SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
-     uint32_t n;
- 
-+    /* The request must only run in the BlockBackend's AioContext */
-+    assert(blk_get_aio_context(s->qdev.conf.blk) ==
-+           qemu_get_current_aio_context());
-+
-     assert (r->req.aiocb == NULL);
-     if (scsi_disk_req_check_error(r, ret, false)) {
-         goto done;
-diff --git a/system/dma-helpers.c b/system/dma-helpers.c
-index 528117f256..9b221cf94e 100644
---- a/system/dma-helpers.c
-+++ b/system/dma-helpers.c
-@@ -119,6 +119,9 @@ static void dma_blk_cb(void *opaque, int ret)
- 
-     trace_dma_blk_cb(dbs, ret);
- 
-+    /* DMAAIOCB is not thread-safe and must be accessed only from dbs->ctx */
-+    assert(ctx == qemu_get_current_aio_context());
-+
-     dbs->acb = NULL;
-     dbs->offset += dbs->iov.size;
- 
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-scsi-block-Don-t-skip-callback-for-sgio-error-status.patch b/SOURCES/kvm-scsi-block-Don-t-skip-callback-for-sgio-error-status.patch
new file mode 100644
index 0000000..a7eebbc
--- /dev/null
+++ b/SOURCES/kvm-scsi-block-Don-t-skip-callback-for-sgio-error-status.patch
@@ -0,0 +1,60 @@
+From d580b83d9eda7802ffa3890ea8641793fe78937c Mon Sep 17 00:00:00 2001
+From: Kevin Wolf <kwolf@redhat.com>
+Date: Wed, 31 Jul 2024 14:32:05 +0200
+Subject: [PATCH 094/100] scsi-block: Don't skip callback for sgio error
+ status/driver_status
+
+RH-Author: Kevin Wolf <kwolf@redhat.com>
+RH-MergeRequest: 261: scsi-block: Fix error handling with r/werror=stop
+RH-Jira: RHEL-50000
+RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
+RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+RH-Commit: [2/4] 1fee1b21dae314f4f34c88f2d2fabd7af011404a (kmwolf/centos-qemu-kvm)
+
+Instead of calling into scsi_handle_rw_error() directly from
+scsi_block_sgio_complete() and skipping the normal callback, go through
+the normal cleanup path by calling the callback with a positive error
+value.
+
+The important difference here is not only that the code path is cleaner,
+but that the callbacks set r->req.aiocb = NULL. If we skip setting this
+and the error action is BLOCK_ERROR_ACTION_STOP, resuming the VM runs
+into an assertion failure in scsi_read_data() or scsi_write_data()
+because the dangling aiocb pointer is unexpected.
+
+Fixes: a108557bbf ("scsi: inline sg_io_sense_from_errno() into the callers.")
+Buglink: https://issues.redhat.com/browse/RHEL-50000
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+Message-ID: <20240731123207.27636-3-kwolf@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit 622a70161ac258e4a166a7dca4b5be267e0652d9)
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ hw/scsi/scsi-disk.c | 10 ----------
+ 1 file changed, 10 deletions(-)
+
+diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
+index bed2c8746c..e7f57f3230 100644
+--- a/hw/scsi/scsi-disk.c
++++ b/hw/scsi/scsi-disk.c
+@@ -2804,16 +2804,6 @@ static void scsi_block_sgio_complete(void *opaque, int ret)
+         } else {
+             ret = io_hdr->status;
+         }
+-
+-        if (ret > 0) {
+-            if (scsi_handle_rw_error(r, ret, true)) {
+-                scsi_req_unref(&r->req);
+-                return;
+-            }
+-
+-            /* Ignore error.  */
+-            ret = 0;
+-        }
+     }
+ 
+     req->cb(req->cb_opaque, ret);
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-scsi-disk-Add-warning-comments-that-host_status-erro.patch b/SOURCES/kvm-scsi-disk-Add-warning-comments-that-host_status-erro.patch
new file mode 100644
index 0000000..20aa88a
--- /dev/null
+++ b/SOURCES/kvm-scsi-disk-Add-warning-comments-that-host_status-erro.patch
@@ -0,0 +1,79 @@
+From eebe5fe8cbc854a6365e7c1adbb701079b137bcb Mon Sep 17 00:00:00 2001
+From: Kevin Wolf <kwolf@redhat.com>
+Date: Wed, 31 Jul 2024 14:32:06 +0200
+Subject: [PATCH 095/100] scsi-disk: Add warning comments that host_status
+ errors take a shortcut
+
+RH-Author: Kevin Wolf <kwolf@redhat.com>
+RH-MergeRequest: 261: scsi-block: Fix error handling with r/werror=stop
+RH-Jira: RHEL-50000
+RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
+RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+RH-Commit: [3/4] 6fcd603fc78fda65a425a1acd9a8710d81c6ed7f (kmwolf/centos-qemu-kvm)
+
+scsi_block_sgio_complete() has surprising behaviour in that there are
+error cases in which it directly completes the request and never calls
+the passed callback. In the current state of the code, this doesn't seem
+to result in bugs, but with future code changes, we must be careful to
+never rely on the callback doing some cleanup until this code smell is
+fixed. For now, just add warnings to make people aware of the trap.
+
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+Message-ID: <20240731123207.27636-4-kwolf@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit 8a0495624f23f8f01dfb1484f367174f3b3572e8)
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ hw/scsi/scsi-disk.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
+index e7f57f3230..b4062ac2ff 100644
+--- a/hw/scsi/scsi-disk.c
++++ b/hw/scsi/scsi-disk.c
+@@ -65,6 +65,9 @@ struct SCSIDiskClass {
+     /*
+      * Callbacks receive ret == 0 for success. Errors are represented either as
+      * negative errno values, or as positive SAM status codes.
++     *
++     * Beware: For errors returned in host_status, the function may directly
++     * complete the request and never call the callback.
+      */
+     DMAIOFunc       *dma_readv;
+     DMAIOFunc       *dma_writev;
+@@ -359,6 +362,7 @@ done:
+     scsi_req_unref(&r->req);
+ }
+ 
++/* May not be called in all error cases, don't rely on cleanup here */
+ static void scsi_dma_complete(void *opaque, int ret)
+ {
+     SCSIDiskReq *r = (SCSIDiskReq *)opaque;
+@@ -399,6 +403,7 @@ done:
+     scsi_req_unref(&r->req);
+ }
+ 
++/* May not be called in all error cases, don't rely on cleanup here */
+ static void scsi_read_complete(void *opaque, int ret)
+ {
+     SCSIDiskReq *r = (SCSIDiskReq *)opaque;
+@@ -538,6 +543,7 @@ done:
+     scsi_req_unref(&r->req);
+ }
+ 
++/* May not be called in all error cases, don't rely on cleanup here */
+ static void scsi_write_complete(void * opaque, int ret)
+ {
+     SCSIDiskReq *r = (SCSIDiskReq *)opaque;
+@@ -2793,6 +2799,7 @@ static void scsi_block_sgio_complete(void *opaque, int ret)
+     sg_io_hdr_t *io_hdr = &req->io_header;
+ 
+     if (ret == 0) {
++        /* FIXME This skips calling req->cb() and any cleanup in it */
+         if (io_hdr->host_status != SCSI_HOST_OK) {
+             scsi_req_complete_failed(&r->req, io_hdr->host_status);
+             scsi_req_unref(&r->req);
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-scsi-disk-Always-report-RESERVATION_CONFLICT-to-gues.patch b/SOURCES/kvm-scsi-disk-Always-report-RESERVATION_CONFLICT-to-gues.patch
new file mode 100644
index 0000000..0e2aeaf
--- /dev/null
+++ b/SOURCES/kvm-scsi-disk-Always-report-RESERVATION_CONFLICT-to-gues.patch
@@ -0,0 +1,106 @@
+From bd5cace452183053e356a27317c759ecfe0391aa Mon Sep 17 00:00:00 2001
+From: Kevin Wolf <kwolf@redhat.com>
+Date: Wed, 31 Jul 2024 14:32:07 +0200
+Subject: [PATCH 096/100] scsi-disk: Always report RESERVATION_CONFLICT to
+ guest
+
+RH-Author: Kevin Wolf <kwolf@redhat.com>
+RH-MergeRequest: 261: scsi-block: Fix error handling with r/werror=stop
+RH-Jira: RHEL-50000
+RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
+RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+RH-Commit: [4/4] eb4142071e5cbe385a949a6c48b0c8f8c6086918 (kmwolf/centos-qemu-kvm)
+
+In the case of scsi-block, RESERVATION_CONFLICT is not a backend error,
+but indicates that the guest tried to make a request that it isn't
+allowed to execute. Pass the error to the guest so that it can decide
+what to do with it.
+
+Without this, if we stop the VM in response to a RESERVATION_CONFLICT
+(as is the default policy in management software such as oVirt or
+KubeVirt), it can happen that the VM cannot be resumed any more because
+every attempt to resume it immediately runs into the same error and
+stops the VM again.
+
+One case that expects RESERVATION_CONFLICT errors to be visible in the
+guest is running the validation tests in Windows 2019's Failover Cluster
+Manager, which intentionally tries to execute invalid requests to see if
+they are properly rejected.
+
+Buglink: https://issues.redhat.com/browse/RHEL-50000
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+Message-ID: <20240731123207.27636-5-kwolf@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit 9da6bd39f92434f55573acd017841b195c60188f)
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ hw/scsi/scsi-disk.c | 35 ++++++++++++++++++++++++++++++-----
+ 1 file changed, 30 insertions(+), 5 deletions(-)
+
+diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
+index b4062ac2ff..91ccf37fef 100644
+--- a/hw/scsi/scsi-disk.c
++++ b/hw/scsi/scsi-disk.c
+@@ -202,7 +202,7 @@ static bool scsi_handle_rw_error(SCSIDiskReq *r, int ret, bool acct_failed)
+     SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
+     SCSIDiskClass *sdc = (SCSIDiskClass *) object_get_class(OBJECT(s));
+     SCSISense sense = SENSE_CODE(NO_SENSE);
+-    int error = 0;
++    int error;
+     bool req_has_sense = false;
+     BlockErrorAction action;
+     int status;
+@@ -213,11 +213,35 @@ static bool scsi_handle_rw_error(SCSIDiskReq *r, int ret, bool acct_failed)
+     } else {
+         /* A passthrough command has completed with nonzero status.  */
+         status = ret;
+-        if (status == CHECK_CONDITION) {
++        switch (status) {
++        case CHECK_CONDITION:
+             req_has_sense = true;
+             error = scsi_sense_buf_to_errno(r->req.sense, sizeof(r->req.sense));
+-        } else {
++            break;
++        case RESERVATION_CONFLICT:
++            /*
++             * Don't apply the error policy, always report to the guest.
++             *
++             * This is a passthrough code path, so it's not a backend error, but
++             * a response to an invalid guest request.
++             *
++             * Windows Failover Cluster validation intentionally sends invalid
++             * requests to verify that reservations work as intended. It is
++             * crucial that it sees the resulting errors.
++             *
++             * Treating a reservation conflict as a guest-side error is obvious
++             * when a pr-manager is in use. Without one, the situation is less
++             * clear, but there might be nothing that can be fixed on the host
++             * (like in the above example), and we don't want to be stuck in a
++             * loop where resuming the VM and retrying the request immediately
++             * stops it again. So always reporting is still the safer option in
++             * this case, too.
++             */
++            error = 0;
++            break;
++        default:
+             error = EINVAL;
++            break;
+         }
+     }
+ 
+@@ -227,8 +251,9 @@ static bool scsi_handle_rw_error(SCSIDiskReq *r, int ret, bool acct_failed)
+      * are usually retried immediately, so do not post them to QMP and
+      * do not account them as failed I/O.
+      */
+-    if (req_has_sense &&
+-        scsi_sense_buf_is_guest_recoverable(r->req.sense, sizeof(r->req.sense))) {
++    if (!error || (req_has_sense &&
++                   scsi_sense_buf_is_guest_recoverable(r->req.sense,
++                                                       sizeof(r->req.sense)))) {
+         action = BLOCK_ERROR_ACTION_REPORT;
+         acct_failed = false;
+     } else {
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-scsi-disk-Use-positive-return-value-for-status-in-dm.patch b/SOURCES/kvm-scsi-disk-Use-positive-return-value-for-status-in-dm.patch
new file mode 100644
index 0000000..409028a
--- /dev/null
+++ b/SOURCES/kvm-scsi-disk-Use-positive-return-value-for-status-in-dm.patch
@@ -0,0 +1,125 @@
+From 1a0aa9bbdad63d72628002740410b8a28282a96e Mon Sep 17 00:00:00 2001
+From: Kevin Wolf <kwolf@redhat.com>
+Date: Wed, 31 Jul 2024 14:32:04 +0200
+Subject: [PATCH 093/100] scsi-disk: Use positive return value for status in
+ dma_readv/writev
+
+RH-Author: Kevin Wolf <kwolf@redhat.com>
+RH-MergeRequest: 261: scsi-block: Fix error handling with r/werror=stop
+RH-Jira: RHEL-50000
+RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
+RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+RH-Commit: [1/4] a0b3e7bfd7b7059c0ec3706f2eb1698c1d430b08 (kmwolf/centos-qemu-kvm)
+
+In some error cases, scsi_block_sgio_complete() never calls the passed
+callback, but directly completes the request. This leads to bugs because
+its error paths are not exact copies of what the callback would normally
+do.
+
+In preparation to fix this, allow passing positive return values to the
+callbacks that represent the status code that should be used to complete
+the request.
+
+scsi_handle_rw_error() already handles positive values for its ret
+parameter because scsi_block_sgio_complete() calls directly into it.
+
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+Message-ID: <20240731123207.27636-2-kwolf@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit cfe0880835cd364b590ffd27ef8dbd2ad8838bc5)
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ hw/scsi/scsi-disk.c | 21 ++++++++++++++-------
+ 1 file changed, 14 insertions(+), 7 deletions(-)
+
+diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
+index 4bd7af9d0c..bed2c8746c 100644
+--- a/hw/scsi/scsi-disk.c
++++ b/hw/scsi/scsi-disk.c
+@@ -62,6 +62,10 @@ OBJECT_DECLARE_TYPE(SCSIDiskState, SCSIDiskClass, SCSI_DISK_BASE)
+ 
+ struct SCSIDiskClass {
+     SCSIDeviceClass parent_class;
++    /*
++     * Callbacks receive ret == 0 for success. Errors are represented either as
++     * negative errno values, or as positive SAM status codes.
++     */
+     DMAIOFunc       *dma_readv;
+     DMAIOFunc       *dma_writev;
+     bool            (*need_fua_emulation)(SCSICommand *cmd);
+@@ -261,7 +265,7 @@ static bool scsi_disk_req_check_error(SCSIDiskReq *r, int ret, bool acct_failed)
+         return true;
+     }
+ 
+-    if (ret < 0) {
++    if (ret != 0) {
+         return scsi_handle_rw_error(r, ret, acct_failed);
+     }
+ 
+@@ -338,7 +342,7 @@ static void scsi_write_do_fua(SCSIDiskReq *r)
+ static void scsi_dma_complete_noio(SCSIDiskReq *r, int ret)
+ {
+     assert(r->req.aiocb == NULL);
+-    if (scsi_disk_req_check_error(r, ret, false)) {
++    if (scsi_disk_req_check_error(r, ret, ret > 0)) {
+         goto done;
+     }
+ 
+@@ -363,9 +367,10 @@ static void scsi_dma_complete(void *opaque, int ret)
+     assert(r->req.aiocb != NULL);
+     r->req.aiocb = NULL;
+ 
++    /* ret > 0 is accounted for in scsi_disk_req_check_error() */
+     if (ret < 0) {
+         block_acct_failed(blk_get_stats(s->qdev.conf.blk), &r->acct);
+-    } else {
++    } else if (ret == 0) {
+         block_acct_done(blk_get_stats(s->qdev.conf.blk), &r->acct);
+     }
+     scsi_dma_complete_noio(r, ret);
+@@ -381,7 +386,7 @@ static void scsi_read_complete_noio(SCSIDiskReq *r, int ret)
+            qemu_get_current_aio_context());
+ 
+     assert(r->req.aiocb == NULL);
+-    if (scsi_disk_req_check_error(r, ret, false)) {
++    if (scsi_disk_req_check_error(r, ret, ret > 0)) {
+         goto done;
+     }
+ 
+@@ -402,9 +407,10 @@ static void scsi_read_complete(void *opaque, int ret)
+     assert(r->req.aiocb != NULL);
+     r->req.aiocb = NULL;
+ 
++    /* ret > 0 is accounted for in scsi_disk_req_check_error() */
+     if (ret < 0) {
+         block_acct_failed(blk_get_stats(s->qdev.conf.blk), &r->acct);
+-    } else {
++    } else if (ret == 0) {
+         block_acct_done(blk_get_stats(s->qdev.conf.blk), &r->acct);
+         trace_scsi_disk_read_complete(r->req.tag, r->qiov.size);
+     }
+@@ -512,7 +518,7 @@ static void scsi_write_complete_noio(SCSIDiskReq *r, int ret)
+            qemu_get_current_aio_context());
+ 
+     assert (r->req.aiocb == NULL);
+-    if (scsi_disk_req_check_error(r, ret, false)) {
++    if (scsi_disk_req_check_error(r, ret, ret > 0)) {
+         goto done;
+     }
+ 
+@@ -540,9 +546,10 @@ static void scsi_write_complete(void * opaque, int ret)
+     assert (r->req.aiocb != NULL);
+     r->req.aiocb = NULL;
+ 
++    /* ret > 0 is accounted for in scsi_disk_req_check_error() */
+     if (ret < 0) {
+         block_acct_failed(blk_get_stats(s->qdev.conf.blk), &r->acct);
+-    } else {
++    } else if (ret == 0) {
+         block_acct_done(blk_get_stats(s->qdev.conf.blk), &r->acct);
+     }
+     scsi_write_complete_noio(r, ret);
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-scsi-don-t-lock-AioContext-in-I-O-code-path.patch b/SOURCES/kvm-scsi-don-t-lock-AioContext-in-I-O-code-path.patch
deleted file mode 100644
index 65b08ce..0000000
--- a/SOURCES/kvm-scsi-don-t-lock-AioContext-in-I-O-code-path.patch
+++ /dev/null
@@ -1,245 +0,0 @@
-From d1d384bd24a7aeb527f4abd8a0958146544ef9bb Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Mon, 4 Dec 2023 11:42:58 -0500
-Subject: [PATCH 079/101] scsi: don't lock AioContext in I/O code path
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 214: Remove AioContext lock
-RH-Jira: RHEL-15965
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [10/26] b5814cec94af5c254e300646d8783672b085bac3 (kmwolf/centos-qemu-kvm)
-
-blk_aio_*() doesn't require the AioContext lock and the SCSI subsystem's
-internal state also does not anymore.
-
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Acked-by: Kevin Wolf <kwolf@redhat.com>
-Message-ID: <20231204164259.1515217-4-stefanha@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- hw/scsi/scsi-disk.c    | 23 -----------------------
- hw/scsi/scsi-generic.c | 20 +++-----------------
- 2 files changed, 3 insertions(+), 40 deletions(-)
-
-diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
-index 6691f5edb8..2c1bbb3530 100644
---- a/hw/scsi/scsi-disk.c
-+++ b/hw/scsi/scsi-disk.c
-@@ -273,8 +273,6 @@ static void scsi_aio_complete(void *opaque, int ret)
-     SCSIDiskReq *r = (SCSIDiskReq *)opaque;
-     SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
- 
--    aio_context_acquire(blk_get_aio_context(s->qdev.conf.blk));
--
-     assert(r->req.aiocb != NULL);
-     r->req.aiocb = NULL;
- 
-@@ -286,7 +284,6 @@ static void scsi_aio_complete(void *opaque, int ret)
-     scsi_req_complete(&r->req, GOOD);
- 
- done:
--    aio_context_release(blk_get_aio_context(s->qdev.conf.blk));
-     scsi_req_unref(&r->req);
- }
- 
-@@ -394,8 +391,6 @@ static void scsi_read_complete(void *opaque, int ret)
-     SCSIDiskReq *r = (SCSIDiskReq *)opaque;
-     SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
- 
--    aio_context_acquire(blk_get_aio_context(s->qdev.conf.blk));
--
-     assert(r->req.aiocb != NULL);
-     r->req.aiocb = NULL;
- 
-@@ -406,7 +401,6 @@ static void scsi_read_complete(void *opaque, int ret)
-         trace_scsi_disk_read_complete(r->req.tag, r->qiov.size);
-     }
-     scsi_read_complete_noio(r, ret);
--    aio_context_release(blk_get_aio_context(s->qdev.conf.blk));
- }
- 
- /* Actually issue a read to the block device.  */
-@@ -448,8 +442,6 @@ static void scsi_do_read_cb(void *opaque, int ret)
-     SCSIDiskReq *r = (SCSIDiskReq *)opaque;
-     SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
- 
--    aio_context_acquire(blk_get_aio_context(s->qdev.conf.blk));
--
-     assert (r->req.aiocb != NULL);
-     r->req.aiocb = NULL;
- 
-@@ -459,7 +451,6 @@ static void scsi_do_read_cb(void *opaque, int ret)
-         block_acct_done(blk_get_stats(s->qdev.conf.blk), &r->acct);
-     }
-     scsi_do_read(opaque, ret);
--    aio_context_release(blk_get_aio_context(s->qdev.conf.blk));
- }
- 
- /* Read more data from scsi device into buffer.  */
-@@ -533,8 +524,6 @@ static void scsi_write_complete(void * opaque, int ret)
-     SCSIDiskReq *r = (SCSIDiskReq *)opaque;
-     SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
- 
--    aio_context_acquire(blk_get_aio_context(s->qdev.conf.blk));
--
-     assert (r->req.aiocb != NULL);
-     r->req.aiocb = NULL;
- 
-@@ -544,7 +533,6 @@ static void scsi_write_complete(void * opaque, int ret)
-         block_acct_done(blk_get_stats(s->qdev.conf.blk), &r->acct);
-     }
-     scsi_write_complete_noio(r, ret);
--    aio_context_release(blk_get_aio_context(s->qdev.conf.blk));
- }
- 
- static void scsi_write_data(SCSIRequest *req)
-@@ -1742,8 +1730,6 @@ static void scsi_unmap_complete(void *opaque, int ret)
-     SCSIDiskReq *r = data->r;
-     SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
- 
--    aio_context_acquire(blk_get_aio_context(s->qdev.conf.blk));
--
-     assert(r->req.aiocb != NULL);
-     r->req.aiocb = NULL;
- 
-@@ -1754,7 +1740,6 @@ static void scsi_unmap_complete(void *opaque, int ret)
-         block_acct_done(blk_get_stats(s->qdev.conf.blk), &r->acct);
-         scsi_unmap_complete_noio(data, ret);
-     }
--    aio_context_release(blk_get_aio_context(s->qdev.conf.blk));
- }
- 
- static void scsi_disk_emulate_unmap(SCSIDiskReq *r, uint8_t *inbuf)
-@@ -1822,8 +1807,6 @@ static void scsi_write_same_complete(void *opaque, int ret)
-     SCSIDiskReq *r = data->r;
-     SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev);
- 
--    aio_context_acquire(blk_get_aio_context(s->qdev.conf.blk));
--
-     assert(r->req.aiocb != NULL);
-     r->req.aiocb = NULL;
- 
-@@ -1847,7 +1830,6 @@ static void scsi_write_same_complete(void *opaque, int ret)
-                                        data->sector << BDRV_SECTOR_BITS,
-                                        &data->qiov, 0,
-                                        scsi_write_same_complete, data);
--        aio_context_release(blk_get_aio_context(s->qdev.conf.blk));
-         return;
-     }
- 
-@@ -1857,7 +1839,6 @@ done:
-     scsi_req_unref(&r->req);
-     qemu_vfree(data->iov.iov_base);
-     g_free(data);
--    aio_context_release(blk_get_aio_context(s->qdev.conf.blk));
- }
- 
- static void scsi_disk_emulate_write_same(SCSIDiskReq *r, uint8_t *inbuf)
-@@ -2810,7 +2791,6 @@ static void scsi_block_sgio_complete(void *opaque, int ret)
- {
-     SCSIBlockReq *req = (SCSIBlockReq *)opaque;
-     SCSIDiskReq *r = &req->req;
--    SCSIDevice *s = r->req.dev;
-     sg_io_hdr_t *io_hdr = &req->io_header;
- 
-     if (ret == 0) {
-@@ -2827,13 +2807,10 @@ static void scsi_block_sgio_complete(void *opaque, int ret)
-         }
- 
-         if (ret > 0) {
--            aio_context_acquire(blk_get_aio_context(s->conf.blk));
-             if (scsi_handle_rw_error(r, ret, true)) {
--                aio_context_release(blk_get_aio_context(s->conf.blk));
-                 scsi_req_unref(&r->req);
-                 return;
-             }
--            aio_context_release(blk_get_aio_context(s->conf.blk));
- 
-             /* Ignore error.  */
-             ret = 0;
-diff --git a/hw/scsi/scsi-generic.c b/hw/scsi/scsi-generic.c
-index 2417f0ad84..b7b04e1d63 100644
---- a/hw/scsi/scsi-generic.c
-+++ b/hw/scsi/scsi-generic.c
-@@ -109,15 +109,11 @@ done:
- static void scsi_command_complete(void *opaque, int ret)
- {
-     SCSIGenericReq *r = (SCSIGenericReq *)opaque;
--    SCSIDevice *s = r->req.dev;
--
--    aio_context_acquire(blk_get_aio_context(s->conf.blk));
- 
-     assert(r->req.aiocb != NULL);
-     r->req.aiocb = NULL;
- 
-     scsi_command_complete_noio(r, ret);
--    aio_context_release(blk_get_aio_context(s->conf.blk));
- }
- 
- static int execute_command(BlockBackend *blk,
-@@ -274,14 +270,12 @@ static void scsi_read_complete(void * opaque, int ret)
-     SCSIDevice *s = r->req.dev;
-     int len;
- 
--    aio_context_acquire(blk_get_aio_context(s->conf.blk));
--
-     assert(r->req.aiocb != NULL);
-     r->req.aiocb = NULL;
- 
-     if (ret || r->req.io_canceled) {
-         scsi_command_complete_noio(r, ret);
--        goto done;
-+        return;
-     }
- 
-     len = r->io_header.dxfer_len - r->io_header.resid;
-@@ -320,7 +314,7 @@ static void scsi_read_complete(void * opaque, int ret)
-         r->io_header.status != GOOD ||
-         len == 0) {
-         scsi_command_complete_noio(r, 0);
--        goto done;
-+        return;
-     }
- 
-     /* Snoop READ CAPACITY output to set the blocksize.  */
-@@ -356,9 +350,6 @@ static void scsi_read_complete(void * opaque, int ret)
- req_complete:
-     scsi_req_data(&r->req, len);
-     scsi_req_unref(&r->req);
--
--done:
--    aio_context_release(blk_get_aio_context(s->conf.blk));
- }
- 
- /* Read more data from scsi device into buffer.  */
-@@ -391,14 +382,12 @@ static void scsi_write_complete(void * opaque, int ret)
- 
-     trace_scsi_generic_write_complete(ret);
- 
--    aio_context_acquire(blk_get_aio_context(s->conf.blk));
--
-     assert(r->req.aiocb != NULL);
-     r->req.aiocb = NULL;
- 
-     if (ret || r->req.io_canceled) {
-         scsi_command_complete_noio(r, ret);
--        goto done;
-+        return;
-     }
- 
-     if (r->req.cmd.buf[0] == MODE_SELECT && r->req.cmd.buf[4] == 12 &&
-@@ -408,9 +397,6 @@ static void scsi_write_complete(void * opaque, int ret)
-     }
- 
-     scsi_command_complete_noio(r, ret);
--
--done:
--    aio_context_release(blk_get_aio_context(s->conf.blk));
- }
- 
- /* Write data to a scsi device.  Returns nonzero on failure.
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-scsi-only-access-SCSIDevice-requests-from-one-thread.patch b/SOURCES/kvm-scsi-only-access-SCSIDevice-requests-from-one-thread.patch
deleted file mode 100644
index 30f1c00..0000000
--- a/SOURCES/kvm-scsi-only-access-SCSIDevice-requests-from-one-thread.patch
+++ /dev/null
@@ -1,307 +0,0 @@
-From 42dd1357310bd1a68d6cacaa53cd5b1d1b02880d Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Mon, 4 Dec 2023 11:42:56 -0500
-Subject: [PATCH 077/101] scsi: only access SCSIDevice->requests from one
- thread
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 214: Remove AioContext lock
-RH-Jira: RHEL-15965
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [8/26] 9df662e82a63e93d184b5763bebbe7e43bc9dabe (kmwolf/centos-qemu-kvm)
-
-Stop depending on the AioContext lock and instead access
-SCSIDevice->requests from only one thread at a time:
-- When the VM is running only the BlockBackend's AioContext may access
-  the requests list.
-- When the VM is stopped only the main loop may access the requests
-  list.
-
-These constraints protect the requests list without the need for locking
-in the I/O code path.
-
-Note that multiple IOThreads are not supported yet because the code
-assumes all SCSIRequests are executed from a single AioContext. Leave
-that as future work.
-
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Message-ID: <20231204164259.1515217-2-stefanha@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- hw/scsi/scsi-bus.c     | 181 ++++++++++++++++++++++++++++-------------
- include/hw/scsi/scsi.h |   7 +-
- 2 files changed, 131 insertions(+), 57 deletions(-)
-
-diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c
-index fc4b77fdb0..b649cdf555 100644
---- a/hw/scsi/scsi-bus.c
-+++ b/hw/scsi/scsi-bus.c
-@@ -85,6 +85,89 @@ SCSIDevice *scsi_device_get(SCSIBus *bus, int channel, int id, int lun)
-     return d;
- }
- 
-+/*
-+ * Invoke @fn() for each enqueued request in device @s. Must be called from the
-+ * main loop thread while the guest is stopped. This is only suitable for
-+ * vmstate ->put(), use scsi_device_for_each_req_async() for other cases.
-+ */
-+static void scsi_device_for_each_req_sync(SCSIDevice *s,
-+                                          void (*fn)(SCSIRequest *, void *),
-+                                          void *opaque)
-+{
-+    SCSIRequest *req;
-+    SCSIRequest *next_req;
-+
-+    assert(!runstate_is_running());
-+    assert(qemu_in_main_thread());
-+
-+    QTAILQ_FOREACH_SAFE(req, &s->requests, next, next_req) {
-+        fn(req, opaque);
-+    }
-+}
-+
-+typedef struct {
-+    SCSIDevice *s;
-+    void (*fn)(SCSIRequest *, void *);
-+    void *fn_opaque;
-+} SCSIDeviceForEachReqAsyncData;
-+
-+static void scsi_device_for_each_req_async_bh(void *opaque)
-+{
-+    g_autofree SCSIDeviceForEachReqAsyncData *data = opaque;
-+    SCSIDevice *s = data->s;
-+    AioContext *ctx;
-+    SCSIRequest *req;
-+    SCSIRequest *next;
-+
-+    /*
-+     * If the AioContext changed before this BH was called then reschedule into
-+     * the new AioContext before accessing ->requests. This can happen when
-+     * scsi_device_for_each_req_async() is called and then the AioContext is
-+     * changed before BHs are run.
-+     */
-+    ctx = blk_get_aio_context(s->conf.blk);
-+    if (ctx != qemu_get_current_aio_context()) {
-+        aio_bh_schedule_oneshot(ctx, scsi_device_for_each_req_async_bh,
-+                                g_steal_pointer(&data));
-+        return;
-+    }
-+
-+    QTAILQ_FOREACH_SAFE(req, &s->requests, next, next) {
-+        data->fn(req, data->fn_opaque);
-+    }
-+
-+    /* Drop the reference taken by scsi_device_for_each_req_async() */
-+    object_unref(OBJECT(s));
-+}
-+
-+/*
-+ * Schedule @fn() to be invoked for each enqueued request in device @s. @fn()
-+ * runs in the AioContext that is executing the request.
-+ */
-+static void scsi_device_for_each_req_async(SCSIDevice *s,
-+                                           void (*fn)(SCSIRequest *, void *),
-+                                           void *opaque)
-+{
-+    assert(qemu_in_main_thread());
-+
-+    SCSIDeviceForEachReqAsyncData *data =
-+        g_new(SCSIDeviceForEachReqAsyncData, 1);
-+
-+    data->s = s;
-+    data->fn = fn;
-+    data->fn_opaque = opaque;
-+
-+    /*
-+     * Hold a reference to the SCSIDevice until
-+     * scsi_device_for_each_req_async_bh() finishes.
-+     */
-+    object_ref(OBJECT(s));
-+
-+    aio_bh_schedule_oneshot(blk_get_aio_context(s->conf.blk),
-+                            scsi_device_for_each_req_async_bh,
-+                            data);
-+}
-+
- static void scsi_device_realize(SCSIDevice *s, Error **errp)
- {
-     SCSIDeviceClass *sc = SCSI_DEVICE_GET_CLASS(s);
-@@ -144,20 +227,18 @@ void scsi_bus_init_named(SCSIBus *bus, size_t bus_size, DeviceState *host,
-     qbus_set_bus_hotplug_handler(BUS(bus));
- }
- 
--static void scsi_dma_restart_bh(void *opaque)
-+void scsi_req_retry(SCSIRequest *req)
- {
--    SCSIDevice *s = opaque;
--    SCSIRequest *req, *next;
--
--    qemu_bh_delete(s->bh);
--    s->bh = NULL;
-+    req->retry = true;
-+}
- 
--    aio_context_acquire(blk_get_aio_context(s->conf.blk));
--    QTAILQ_FOREACH_SAFE(req, &s->requests, next, next) {
--        scsi_req_ref(req);
--        if (req->retry) {
--            req->retry = false;
--            switch (req->cmd.mode) {
-+/* Called in the AioContext that is executing the request */
-+static void scsi_dma_restart_req(SCSIRequest *req, void *opaque)
-+{
-+    scsi_req_ref(req);
-+    if (req->retry) {
-+        req->retry = false;
-+        switch (req->cmd.mode) {
-             case SCSI_XFER_FROM_DEV:
-             case SCSI_XFER_TO_DEV:
-                 scsi_req_continue(req);
-@@ -166,37 +247,22 @@ static void scsi_dma_restart_bh(void *opaque)
-                 scsi_req_dequeue(req);
-                 scsi_req_enqueue(req);
-                 break;
--            }
-         }
--        scsi_req_unref(req);
-     }
--    aio_context_release(blk_get_aio_context(s->conf.blk));
--    /* Drop the reference that was acquired in scsi_dma_restart_cb */
--    object_unref(OBJECT(s));
--}
--
--void scsi_req_retry(SCSIRequest *req)
--{
--    /* No need to save a reference, because scsi_dma_restart_bh just
--     * looks at the request list.  */
--    req->retry = true;
-+    scsi_req_unref(req);
- }
- 
- static void scsi_dma_restart_cb(void *opaque, bool running, RunState state)
- {
-     SCSIDevice *s = opaque;
- 
-+    assert(qemu_in_main_thread());
-+
-     if (!running) {
-         return;
-     }
--    if (!s->bh) {
--        AioContext *ctx = blk_get_aio_context(s->conf.blk);
--        /* The reference is dropped in scsi_dma_restart_bh.*/
--        object_ref(OBJECT(s));
--        s->bh = aio_bh_new_guarded(ctx, scsi_dma_restart_bh, s,
--                                   &DEVICE(s)->mem_reentrancy_guard);
--        qemu_bh_schedule(s->bh);
--    }
-+
-+    scsi_device_for_each_req_async(s, scsi_dma_restart_req, NULL);
- }
- 
- static bool scsi_bus_is_address_free(SCSIBus *bus,
-@@ -1657,15 +1723,16 @@ void scsi_device_set_ua(SCSIDevice *sdev, SCSISense sense)
-     }
- }
- 
-+static void scsi_device_purge_one_req(SCSIRequest *req, void *opaque)
-+{
-+    scsi_req_cancel_async(req, NULL);
-+}
-+
- void scsi_device_purge_requests(SCSIDevice *sdev, SCSISense sense)
- {
--    SCSIRequest *req;
-+    scsi_device_for_each_req_async(sdev, scsi_device_purge_one_req, NULL);
- 
-     aio_context_acquire(blk_get_aio_context(sdev->conf.blk));
--    while (!QTAILQ_EMPTY(&sdev->requests)) {
--        req = QTAILQ_FIRST(&sdev->requests);
--        scsi_req_cancel_async(req, NULL);
--    }
-     blk_drain(sdev->conf.blk);
-     aio_context_release(blk_get_aio_context(sdev->conf.blk));
-     scsi_device_set_ua(sdev, sense);
-@@ -1737,31 +1804,33 @@ static char *scsibus_get_fw_dev_path(DeviceState *dev)
- 
- /* SCSI request list.  For simplicity, pv points to the whole device */
- 
-+static void put_scsi_req(SCSIRequest *req, void *opaque)
-+{
-+    QEMUFile *f = opaque;
-+
-+    assert(!req->io_canceled);
-+    assert(req->status == -1 && req->host_status == -1);
-+    assert(req->enqueued);
-+
-+    qemu_put_sbyte(f, req->retry ? 1 : 2);
-+    qemu_put_buffer(f, req->cmd.buf, sizeof(req->cmd.buf));
-+    qemu_put_be32s(f, &req->tag);
-+    qemu_put_be32s(f, &req->lun);
-+    if (req->bus->info->save_request) {
-+        req->bus->info->save_request(f, req);
-+    }
-+    if (req->ops->save_request) {
-+        req->ops->save_request(f, req);
-+    }
-+}
-+
- static int put_scsi_requests(QEMUFile *f, void *pv, size_t size,
-                              const VMStateField *field, JSONWriter *vmdesc)
- {
-     SCSIDevice *s = pv;
--    SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, s->qdev.parent_bus);
--    SCSIRequest *req;
- 
--    QTAILQ_FOREACH(req, &s->requests, next) {
--        assert(!req->io_canceled);
--        assert(req->status == -1 && req->host_status == -1);
--        assert(req->enqueued);
--
--        qemu_put_sbyte(f, req->retry ? 1 : 2);
--        qemu_put_buffer(f, req->cmd.buf, sizeof(req->cmd.buf));
--        qemu_put_be32s(f, &req->tag);
--        qemu_put_be32s(f, &req->lun);
--        if (bus->info->save_request) {
--            bus->info->save_request(f, req);
--        }
--        if (req->ops->save_request) {
--            req->ops->save_request(f, req);
--        }
--    }
-+    scsi_device_for_each_req_sync(s, put_scsi_req, f);
-     qemu_put_sbyte(f, 0);
--
-     return 0;
- }
- 
-diff --git a/include/hw/scsi/scsi.h b/include/hw/scsi/scsi.h
-index 3692ca82f3..10c4e8288d 100644
---- a/include/hw/scsi/scsi.h
-+++ b/include/hw/scsi/scsi.h
-@@ -69,14 +69,19 @@ struct SCSIDevice
- {
-     DeviceState qdev;
-     VMChangeStateEntry *vmsentry;
--    QEMUBH *bh;
-     uint32_t id;
-     BlockConf conf;
-     SCSISense unit_attention;
-     bool sense_is_ua;
-     uint8_t sense[SCSI_SENSE_BUF_SIZE];
-     uint32_t sense_len;
-+
-+    /*
-+     * The requests list is only accessed from the AioContext that executes
-+     * requests or from the main loop when IOThread processing is stopped.
-+     */
-     QTAILQ_HEAD(, SCSIRequest) requests;
-+
-     uint32_t channel;
-     uint32_t lun;
-     int blocksize;
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-scsi-remove-AioContext-locking.patch b/SOURCES/kvm-scsi-remove-AioContext-locking.patch
deleted file mode 100644
index 34a5e46..0000000
--- a/SOURCES/kvm-scsi-remove-AioContext-locking.patch
+++ /dev/null
@@ -1,280 +0,0 @@
-From 61d605433a5edfcc7fe836fd399106ed1e1907bb Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Tue, 5 Dec 2023 13:20:05 -0500
-Subject: [PATCH 088/101] scsi: remove AioContext locking
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 214: Remove AioContext lock
-RH-Jira: RHEL-15965
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [19/26] 12a8e26670074a17dd2b0cfac06e0aea03b3068f (kmwolf/centos-qemu-kvm)
-
-The AioContext lock no longer has any effect. Remove it.
-
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Message-ID: <20231205182011.1976568-9-stefanha@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- hw/scsi/scsi-bus.c              |  2 --
- hw/scsi/scsi-disk.c             | 31 +++++--------------------------
- hw/scsi/virtio-scsi.c           | 18 ------------------
- include/hw/virtio/virtio-scsi.h | 14 --------------
- 4 files changed, 5 insertions(+), 60 deletions(-)
-
-diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c
-index b649cdf555..5b08cbf60a 100644
---- a/hw/scsi/scsi-bus.c
-+++ b/hw/scsi/scsi-bus.c
-@@ -1732,9 +1732,7 @@ void scsi_device_purge_requests(SCSIDevice *sdev, SCSISense sense)
- {
-     scsi_device_for_each_req_async(sdev, scsi_device_purge_one_req, NULL);
- 
--    aio_context_acquire(blk_get_aio_context(sdev->conf.blk));
-     blk_drain(sdev->conf.blk);
--    aio_context_release(blk_get_aio_context(sdev->conf.blk));
-     scsi_device_set_ua(sdev, sense);
- }
- 
-diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
-index a5048e0aaf..61be3d395a 100644
---- a/hw/scsi/scsi-disk.c
-+++ b/hw/scsi/scsi-disk.c
-@@ -2339,14 +2339,10 @@ static void scsi_disk_reset(DeviceState *dev)
- {
-     SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev.qdev, dev);
-     uint64_t nb_sectors;
--    AioContext *ctx;
- 
-     scsi_device_purge_requests(&s->qdev, SENSE_CODE(RESET));
- 
--    ctx = blk_get_aio_context(s->qdev.conf.blk);
--    aio_context_acquire(ctx);
-     blk_get_geometry(s->qdev.conf.blk, &nb_sectors);
--    aio_context_release(ctx);
- 
-     nb_sectors /= s->qdev.blocksize / BDRV_SECTOR_SIZE;
-     if (nb_sectors) {
-@@ -2545,15 +2541,13 @@ static void scsi_unrealize(SCSIDevice *dev)
- static void scsi_hd_realize(SCSIDevice *dev, Error **errp)
- {
-     SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
--    AioContext *ctx = NULL;
-+
-     /* can happen for devices without drive. The error message for missing
-      * backend will be issued in scsi_realize
-      */
-     if (s->qdev.conf.blk) {
--        ctx = blk_get_aio_context(s->qdev.conf.blk);
--        aio_context_acquire(ctx);
-         if (!blkconf_blocksizes(&s->qdev.conf, errp)) {
--            goto out;
-+            return;
-         }
-     }
-     s->qdev.blocksize = s->qdev.conf.logical_block_size;
-@@ -2562,16 +2556,11 @@ static void scsi_hd_realize(SCSIDevice *dev, Error **errp)
-         s->product = g_strdup("QEMU HARDDISK");
-     }
-     scsi_realize(&s->qdev, errp);
--out:
--    if (ctx) {
--        aio_context_release(ctx);
--    }
- }
- 
- static void scsi_cd_realize(SCSIDevice *dev, Error **errp)
- {
-     SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
--    AioContext *ctx;
-     int ret;
-     uint32_t blocksize = 2048;
- 
-@@ -2587,8 +2576,6 @@ static void scsi_cd_realize(SCSIDevice *dev, Error **errp)
-         blocksize = dev->conf.physical_block_size;
-     }
- 
--    ctx = blk_get_aio_context(dev->conf.blk);
--    aio_context_acquire(ctx);
-     s->qdev.blocksize = blocksize;
-     s->qdev.type = TYPE_ROM;
-     s->features |= 1 << SCSI_DISK_F_REMOVABLE;
-@@ -2596,7 +2583,6 @@ static void scsi_cd_realize(SCSIDevice *dev, Error **errp)
-         s->product = g_strdup("QEMU CD-ROM");
-     }
-     scsi_realize(&s->qdev, errp);
--    aio_context_release(ctx);
- }
- 
- 
-@@ -2727,7 +2713,6 @@ static int get_device_type(SCSIDiskState *s)
- static void scsi_block_realize(SCSIDevice *dev, Error **errp)
- {
-     SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
--    AioContext *ctx;
-     int sg_version;
-     int rc;
- 
-@@ -2742,9 +2727,6 @@ static void scsi_block_realize(SCSIDevice *dev, Error **errp)
-                           "be removed in a future version");
-     }
- 
--    ctx = blk_get_aio_context(s->qdev.conf.blk);
--    aio_context_acquire(ctx);
--
-     /* check we are using a driver managing SG_IO (version 3 and after) */
-     rc = blk_ioctl(s->qdev.conf.blk, SG_GET_VERSION_NUM, &sg_version);
-     if (rc < 0) {
-@@ -2752,18 +2734,18 @@ static void scsi_block_realize(SCSIDevice *dev, Error **errp)
-         if (rc != -EPERM) {
-             error_append_hint(errp, "Is this a SCSI device?\n");
-         }
--        goto out;
-+        return;
-     }
-     if (sg_version < 30000) {
-         error_setg(errp, "scsi generic interface too old");
--        goto out;
-+        return;
-     }
- 
-     /* get device type from INQUIRY data */
-     rc = get_device_type(s);
-     if (rc < 0) {
-         error_setg(errp, "INQUIRY failed");
--        goto out;
-+        return;
-     }
- 
-     /* Make a guess for the block size, we'll fix it when the guest sends.
-@@ -2783,9 +2765,6 @@ static void scsi_block_realize(SCSIDevice *dev, Error **errp)
- 
-     scsi_realize(&s->qdev, errp);
-     scsi_generic_read_device_inquiry(&s->qdev);
--
--out:
--    aio_context_release(ctx);
- }
- 
- typedef struct SCSIBlockReq {
-diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
-index 4f8d35facc..ca365a70e9 100644
---- a/hw/scsi/virtio-scsi.c
-+++ b/hw/scsi/virtio-scsi.c
-@@ -642,9 +642,7 @@ static void virtio_scsi_handle_ctrl(VirtIODevice *vdev, VirtQueue *vq)
-         return;
-     }
- 
--    virtio_scsi_acquire(s);
-     virtio_scsi_handle_ctrl_vq(s, vq);
--    virtio_scsi_release(s);
- }
- 
- static void virtio_scsi_complete_cmd_req(VirtIOSCSIReq *req)
-@@ -882,9 +880,7 @@ static void virtio_scsi_handle_cmd(VirtIODevice *vdev, VirtQueue *vq)
-         return;
-     }
- 
--    virtio_scsi_acquire(s);
-     virtio_scsi_handle_cmd_vq(s, vq);
--    virtio_scsi_release(s);
- }
- 
- static void virtio_scsi_get_config(VirtIODevice *vdev,
-@@ -1031,9 +1027,7 @@ static void virtio_scsi_handle_event(VirtIODevice *vdev, VirtQueue *vq)
-         return;
-     }
- 
--    virtio_scsi_acquire(s);
-     virtio_scsi_handle_event_vq(s, vq);
--    virtio_scsi_release(s);
- }
- 
- static void virtio_scsi_change(SCSIBus *bus, SCSIDevice *dev, SCSISense sense)
-@@ -1052,9 +1046,7 @@ static void virtio_scsi_change(SCSIBus *bus, SCSIDevice *dev, SCSISense sense)
-             },
-         };
- 
--        virtio_scsi_acquire(s);
-         virtio_scsi_push_event(s, &info);
--        virtio_scsi_release(s);
-     }
- }
- 
-@@ -1071,17 +1063,13 @@ static void virtio_scsi_hotplug(HotplugHandler *hotplug_dev, DeviceState *dev,
-     VirtIODevice *vdev = VIRTIO_DEVICE(hotplug_dev);
-     VirtIOSCSI *s = VIRTIO_SCSI(vdev);
-     SCSIDevice *sd = SCSI_DEVICE(dev);
--    AioContext *old_context;
-     int ret;
- 
-     if (s->ctx && !s->dataplane_fenced) {
-         if (blk_op_is_blocked(sd->conf.blk, BLOCK_OP_TYPE_DATAPLANE, errp)) {
-             return;
-         }
--        old_context = blk_get_aio_context(sd->conf.blk);
--        aio_context_acquire(old_context);
-         ret = blk_set_aio_context(sd->conf.blk, s->ctx, errp);
--        aio_context_release(old_context);
-         if (ret < 0) {
-             return;
-         }
-@@ -1097,10 +1085,8 @@ static void virtio_scsi_hotplug(HotplugHandler *hotplug_dev, DeviceState *dev,
-             },
-         };
- 
--        virtio_scsi_acquire(s);
-         virtio_scsi_push_event(s, &info);
-         scsi_bus_set_ua(&s->bus, SENSE_CODE(REPORTED_LUNS_CHANGED));
--        virtio_scsi_release(s);
-     }
- }
- 
-@@ -1122,17 +1108,13 @@ static void virtio_scsi_hotunplug(HotplugHandler *hotplug_dev, DeviceState *dev,
-     qdev_simple_device_unplug_cb(hotplug_dev, dev, errp);
- 
-     if (s->ctx) {
--        virtio_scsi_acquire(s);
-         /* If other users keep the BlockBackend in the iothread, that's ok */
-         blk_set_aio_context(sd->conf.blk, qemu_get_aio_context(), NULL);
--        virtio_scsi_release(s);
-     }
- 
-     if (virtio_vdev_has_feature(vdev, VIRTIO_SCSI_F_HOTPLUG)) {
--        virtio_scsi_acquire(s);
-         virtio_scsi_push_event(s, &info);
-         scsi_bus_set_ua(&s->bus, SENSE_CODE(REPORTED_LUNS_CHANGED));
--        virtio_scsi_release(s);
-     }
- }
- 
-diff --git a/include/hw/virtio/virtio-scsi.h b/include/hw/virtio/virtio-scsi.h
-index da8cb928d9..7f0573b1bf 100644
---- a/include/hw/virtio/virtio-scsi.h
-+++ b/include/hw/virtio/virtio-scsi.h
-@@ -101,20 +101,6 @@ struct VirtIOSCSI {
-     uint32_t host_features;
- };
- 
--static inline void virtio_scsi_acquire(VirtIOSCSI *s)
--{
--    if (s->ctx) {
--        aio_context_acquire(s->ctx);
--    }
--}
--
--static inline void virtio_scsi_release(VirtIOSCSI *s)
--{
--    if (s->ctx) {
--        aio_context_release(s->ctx);
--    }
--}
--
- void virtio_scsi_common_realize(DeviceState *dev,
-                                 VirtIOHandleOutput ctrl,
-                                 VirtIOHandleOutput evt,
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-scsi-remove-outdated-AioContext-lock-comment.patch b/SOURCES/kvm-scsi-remove-outdated-AioContext-lock-comment.patch
deleted file mode 100644
index c9baf60..0000000
--- a/SOURCES/kvm-scsi-remove-outdated-AioContext-lock-comment.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From 9f5c6dbe907fe6227006ab51179eaa50a63559cb Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Tue, 5 Dec 2023 13:20:09 -0500
-Subject: [PATCH 092/101] scsi: remove outdated AioContext lock comment
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 214: Remove AioContext lock
-RH-Jira: RHEL-15965
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [23/26] 96e2e7d2e6a160ce4d695060f902d21030b3b1d8 (kmwolf/centos-qemu-kvm)
-
-The SCSI subsystem no longer uses the AioContext lock. Request
-processing runs exclusively in the BlockBackend's AioContext since
-"scsi: only access SCSIDevice->requests from one thread" and hence the
-lock is unnecessary.
-
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Message-ID: <20231205182011.1976568-13-stefanha@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- hw/scsi/scsi-disk.c | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
-index 61be3d395a..2e7e1e9a1c 100644
---- a/hw/scsi/scsi-disk.c
-+++ b/hw/scsi/scsi-disk.c
-@@ -355,7 +355,6 @@ done:
-     scsi_req_unref(&r->req);
- }
- 
--/* Called with AioContext lock held */
- static void scsi_dma_complete(void *opaque, int ret)
- {
-     SCSIDiskReq *r = (SCSIDiskReq *)opaque;
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-smbios-add-smbios_add_usr_blob_size-helper.patch b/SOURCES/kvm-smbios-add-smbios_add_usr_blob_size-helper.patch
deleted file mode 100644
index a9d24a0..0000000
--- a/SOURCES/kvm-smbios-add-smbios_add_usr_blob_size-helper.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From 93cf5b82771f1d1e8182be168dae7a45d42069e9 Mon Sep 17 00:00:00 2001
-From: Igor Mammedov <imammedo@redhat.com>
-Date: Mon, 4 Mar 2024 15:39:57 +0100
-Subject: [PATCH 11/20] smbios: add smbios_add_usr_blob_size() helper
-
-RH-Author: Igor Mammedov <imammedo@redhat.com>
-RH-MergeRequest: 230: Workaround Windows failing to find 64bit SMBIOS entry point with SeaBIOS
-RH-Jira: RHEL-21705
-RH-Acked-by: MST <mst@redhat.com>
-RH-Acked-by: Ani Sinha <None>
-RH-Commit: [9/18] 8c698fb9e186d2b1d2b7f75a74305f356450ad68
-
-JIRA: https://issues.redhat.com/browse/RHEL-21705
-
-it will be used by follow up patch when legacy handling
-is moved out into a separate file.
-
-Signed-off-by: Igor Mammedov <imammedo@redhat.com>
-Reviewed-by: Ani Sinha <anisinha@redhat.com>
----
- hw/smbios/smbios.c | 18 ++++++++++++++----
- 1 file changed, 14 insertions(+), 4 deletions(-)
-
-diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c
-index 441517cf24..c48a290478 100644
---- a/hw/smbios/smbios.c
-+++ b/hw/smbios/smbios.c
-@@ -1426,6 +1426,14 @@ static bool save_opt_list(size_t *ndest, char ***dest, QemuOpts *opts,
-     return true;
- }
- 
-+static void smbios_add_usr_blob_size(size_t size)
-+{
-+    if (!usr_blobs_sizes) {
-+        usr_blobs_sizes = g_array_new(false, false, sizeof(size_t));
-+    }
-+    g_array_append_val(usr_blobs_sizes, size);
-+}
-+
- void smbios_entry_add(QemuOpts *opts, Error **errp)
- {
-     const char *val;
-@@ -1473,10 +1481,12 @@ void smbios_entry_add(QemuOpts *opts, Error **errp)
-             smbios_type4_count++;
-         }
- 
--        if (!usr_blobs_sizes) {
--            usr_blobs_sizes = g_array_new(false, false, sizeof(size_t));
--        }
--        g_array_append_val(usr_blobs_sizes, size);
-+        /*
-+         * preserve blob size for legacy mode so it could build its
-+         * blobs flavor from 'usr_blobs'
-+         */
-+        smbios_add_usr_blob_size(size);
-+
-         usr_blobs_len += size;
-         if (size > usr_table_max) {
-             usr_table_max = size;
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-smbios-avoid-mangling-user-provided-tables.patch b/SOURCES/kvm-smbios-avoid-mangling-user-provided-tables.patch
deleted file mode 100644
index b8e4d92..0000000
--- a/SOURCES/kvm-smbios-avoid-mangling-user-provided-tables.patch
+++ /dev/null
@@ -1,309 +0,0 @@
-From 15d293b706ca6c9e6ad569becda8da5f70461c30 Mon Sep 17 00:00:00 2001
-From: Igor Mammedov <imammedo@redhat.com>
-Date: Tue, 13 Feb 2024 09:25:11 +0100
-Subject: [PATCH 09/20] smbios: avoid mangling user provided tables
-
-RH-Author: Igor Mammedov <imammedo@redhat.com>
-RH-MergeRequest: 230: Workaround Windows failing to find 64bit SMBIOS entry point with SeaBIOS
-RH-Jira: RHEL-21705
-RH-Acked-by: MST <mst@redhat.com>
-RH-Acked-by: Ani Sinha <None>
-RH-Commit: [7/18] fa2c7372f55f29e5834eee94ba98f19ea02e7a82
-
-JIRA: https://issues.redhat.com/browse/RHEL-21705
-
-    currently smbios_entry_add() preserves internally '-smbios type='
-    options but tables provided with '-smbios file=' are stored directly
-    into blob that eventually will be exposed to VM. And then later
-    QEMU adds default/'-smbios type' entries on top into the same blob.
-
-    It makes impossible to generate tables more than once, hence
-    'immutable' guard was used.
-    Make it possible to regenerate final blob by storing user provided
-    blobs into a dedicated area (usr_blobs) and then copy it when
-    composing final blob. Which also makes handling of -smbios
-    options consistent.
-
-    As side effect of this and previous commits there is no need to
-    generate legacy smbios_entries at the time options are parsed.
-    Instead compose smbios_entries on demand from  usr_blobs like
-    it is done for non-legacy SMBIOS tables.
-
-    Signed-off-by: Igor Mammedov <imammedo@redhat.com>
-    Tested-by: Fiona Ebner <f.ebner@proxmox.com>
-    Reviewed-by: Ani Sinha <anisinha@redhat.com>
-
-Conflicts: hw/smbios/smbios.c
-              caused by downstream smbios_type2_required
-
-Signed-off-by: Igor Mammedov <imammedo@redhat.com>
----
- hw/smbios/smbios.c | 181 +++++++++++++++++++++++----------------------
- 1 file changed, 93 insertions(+), 88 deletions(-)
-
-diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c
-index 0c8c439859..d8d68716d4 100644
---- a/hw/smbios/smbios.c
-+++ b/hw/smbios/smbios.c
-@@ -60,6 +60,14 @@ static bool smbios_uuid_encoded = true;
- /* Set to true for modern Windows 10 HardwareID-6 compat */
- static bool smbios_type2_required;
- 
-+/*
-+ * SMBIOS tables provided by user with '-smbios file=<foo>' option
-+ */
-+uint8_t *usr_blobs;
-+size_t usr_blobs_len;
-+static GArray *usr_blobs_sizes;
-+static unsigned usr_table_max;
-+static unsigned usr_table_cnt;
- 
- uint8_t *smbios_tables;
- size_t smbios_tables_len;
-@@ -70,7 +78,6 @@ static SmbiosEntryPointType smbios_ep_type = SMBIOS_ENTRY_POINT_TYPE_32;
- static SmbiosEntryPoint ep;
- 
- static int smbios_type4_count = 0;
--static bool smbios_immutable;
- static bool smbios_have_defaults;
- static uint32_t smbios_cpuid_version, smbios_cpuid_features;
- 
-@@ -617,9 +624,8 @@ static void smbios_build_type_1_fields(void)
- 
- uint8_t *smbios_get_table_legacy(uint32_t expected_t4_count, size_t *length)
- {
--    /* drop unwanted version of command-line file blob(s) */
--    g_free(smbios_tables);
--    smbios_tables = NULL;
-+    int i;
-+    size_t usr_offset;
- 
-     /* also complain if fields were given for types > 1 */
-     if (find_next_bit(have_fields_bitmap,
-@@ -629,12 +635,33 @@ uint8_t *smbios_get_table_legacy(uint32_t expected_t4_count, size_t *length)
-         exit(1);
-     }
- 
--    if (!smbios_immutable) {
--        smbios_build_type_0_fields();
--        smbios_build_type_1_fields();
--        smbios_validate_table(expected_t4_count);
--        smbios_immutable = true;
-+    g_free(smbios_entries);
-+    smbios_entries_len = sizeof(uint16_t);
-+    smbios_entries = g_malloc0(smbios_entries_len);
-+
-+    for (i = 0, usr_offset = 0; usr_blobs_sizes && i < usr_blobs_sizes->len;
-+         i++)
-+    {
-+        struct smbios_table *table;
-+        struct smbios_structure_header *header;
-+        size_t size = g_array_index(usr_blobs_sizes, size_t, i);
-+
-+        header = (struct smbios_structure_header *)(usr_blobs + usr_offset);
-+        smbios_entries = g_realloc(smbios_entries, smbios_entries_len +
-+                                                   size + sizeof(*table));
-+        table = (struct smbios_table *)(smbios_entries + smbios_entries_len);
-+        table->header.type = SMBIOS_TABLE_ENTRY;
-+        table->header.length = cpu_to_le16(sizeof(*table) + size);
-+        memcpy(table->data, header, size);
-+        smbios_entries_len += sizeof(*table) + size;
-+        (*(uint16_t *)smbios_entries) =
-+            cpu_to_le16(le16_to_cpu(*(uint16_t *)smbios_entries) + 1);
-+        usr_offset += size;
-     }
-+
-+    smbios_build_type_0_fields();
-+    smbios_build_type_1_fields();
-+    smbios_validate_table(expected_t4_count);
-     *length = smbios_entries_len;
-     return smbios_entries;
- }
-@@ -1232,68 +1259,68 @@ void smbios_get_tables(MachineState *ms,
- {
-     unsigned i, dimm_cnt, offset;
- 
--    /* drop unwanted (legacy) version of command-line file blob(s) */
--    g_free(smbios_entries);
--    smbios_entries = NULL;
-+    g_free(smbios_tables);
-+    smbios_tables = g_memdup2(usr_blobs, usr_blobs_len);
-+    smbios_tables_len = usr_blobs_len;
-+    smbios_table_max = usr_table_max;
-+    smbios_table_cnt = usr_table_cnt;
- 
--    if (!smbios_immutable) {
--        smbios_build_type_0_table();
--        smbios_build_type_1_table();
--        smbios_build_type_2_table();
--        smbios_build_type_3_table();
-+    smbios_build_type_0_table();
-+    smbios_build_type_1_table();
-+    smbios_build_type_2_table();
-+    smbios_build_type_3_table();
- 
--        assert(ms->smp.sockets >= 1);
-+    assert(ms->smp.sockets >= 1);
- 
--        for (i = 0; i < ms->smp.sockets; i++) {
--            smbios_build_type_4_table(ms, i);
--        }
-+    for (i = 0; i < ms->smp.sockets; i++) {
-+        smbios_build_type_4_table(ms, i);
-+    }
- 
--        smbios_build_type_8_table();
--        smbios_build_type_9_table(errp);
--        smbios_build_type_11_table();
-+    smbios_build_type_8_table();
-+    smbios_build_type_9_table(errp);
-+    smbios_build_type_11_table();
- 
- #define MAX_DIMM_SZ (16 * GiB)
- #define GET_DIMM_SZ ((i < dimm_cnt - 1) ? MAX_DIMM_SZ \
-                                         : ((current_machine->ram_size - 1) % MAX_DIMM_SZ) + 1)
- 
--        dimm_cnt = QEMU_ALIGN_UP(current_machine->ram_size, MAX_DIMM_SZ) / MAX_DIMM_SZ;
-+    dimm_cnt = QEMU_ALIGN_UP(current_machine->ram_size, MAX_DIMM_SZ) /
-+               MAX_DIMM_SZ;
- 
--        /*
--         * The offset determines if we need to keep additional space between
--         * table 17 and table 19 header handle numbers so that they do
--         * not overlap. For example, for a VM with larger than 8 TB guest
--         * memory and DIMM like chunks of 16 GiB, the default space between
--         * the two tables (T19_BASE - T17_BASE = 512) is not enough.
--         */
--        offset = (dimm_cnt > (T19_BASE - T17_BASE)) ? \
--                 dimm_cnt - (T19_BASE - T17_BASE) : 0;
-+    /*
-+     * The offset determines if we need to keep additional space between
-+     * table 17 and table 19 header handle numbers so that they do
-+     * not overlap. For example, for a VM with larger than 8 TB guest
-+     * memory and DIMM like chunks of 16 GiB, the default space between
-+     * the two tables (T19_BASE - T17_BASE = 512) is not enough.
-+     */
-+    offset = (dimm_cnt > (T19_BASE - T17_BASE)) ? \
-+             dimm_cnt - (T19_BASE - T17_BASE) : 0;
- 
--        smbios_build_type_16_table(dimm_cnt);
-+    smbios_build_type_16_table(dimm_cnt);
- 
--        for (i = 0; i < dimm_cnt; i++) {
--            smbios_build_type_17_table(i, GET_DIMM_SZ);
--        }
-+    for (i = 0; i < dimm_cnt; i++) {
-+        smbios_build_type_17_table(i, GET_DIMM_SZ);
-+    }
- 
--        for (i = 0; i < mem_array_size; i++) {
--            smbios_build_type_19_table(i, offset, mem_array[i].address,
--                                       mem_array[i].length);
--        }
-+    for (i = 0; i < mem_array_size; i++) {
-+        smbios_build_type_19_table(i, offset, mem_array[i].address,
-+                                   mem_array[i].length);
-+    }
- 
--        /*
--         * make sure 16 bit handle numbers in the headers of tables 19
--         * and 32 do not overlap.
--         */
--        assert((mem_array_size + offset) < (T32_BASE - T19_BASE));
-+    /*
-+     * make sure 16 bit handle numbers in the headers of tables 19
-+     * and 32 do not overlap.
-+     */
-+    assert((mem_array_size + offset) < (T32_BASE - T19_BASE));
- 
--        smbios_build_type_32_table();
--        smbios_build_type_38_table();
--        smbios_build_type_41_table(errp);
--        smbios_build_type_127_table();
-+    smbios_build_type_32_table();
-+    smbios_build_type_38_table();
-+    smbios_build_type_41_table(errp);
-+    smbios_build_type_127_table();
- 
--        smbios_validate_table(ms->smp.sockets);
--        smbios_entry_point_setup();
--        smbios_immutable = true;
--    }
-+    smbios_validate_table(ms->smp.sockets);
-+    smbios_entry_point_setup();
- 
-     /* return tables blob and entry point (anchor), and their sizes */
-     *tables = smbios_tables;
-@@ -1393,13 +1420,10 @@ void smbios_entry_add(QemuOpts *opts, Error **errp)
- {
-     const char *val;
- 
--    assert(!smbios_immutable);
--
-     val = qemu_opt_get(opts, "file");
-     if (val) {
-         struct smbios_structure_header *header;
--        int size;
--        struct smbios_table *table; /* legacy mode only */
-+        size_t size;
- 
-         if (!qemu_opts_validate(opts, qemu_smbios_file_opts, errp)) {
-             return;
-@@ -1416,9 +1440,9 @@ void smbios_entry_add(QemuOpts *opts, Error **errp)
-          * (except in legacy mode, where the second '\0' is implicit and
-          *  will be inserted by the BIOS).
-          */
--        smbios_tables = g_realloc(smbios_tables, smbios_tables_len + size);
--        header = (struct smbios_structure_header *)(smbios_tables +
--                                                    smbios_tables_len);
-+        usr_blobs = g_realloc(usr_blobs, usr_blobs_len + size);
-+        header = (struct smbios_structure_header *)(usr_blobs +
-+                                                    usr_blobs_len);
- 
-         if (load_image_size(val, (uint8_t *)header, size) != size) {
-             error_setg(errp, "Failed to load SMBIOS file %s", val);
-@@ -1439,34 +1463,15 @@ void smbios_entry_add(QemuOpts *opts, Error **errp)
-             smbios_type4_count++;
-         }
- 
--        smbios_tables_len += size;
--        if (size > smbios_table_max) {
--            smbios_table_max = size;
-+        if (!usr_blobs_sizes) {
-+            usr_blobs_sizes = g_array_new(false, false, sizeof(size_t));
-         }
--        smbios_table_cnt++;
--
--        /* add a copy of the newly loaded blob to legacy smbios_entries */
--        /* NOTE: This code runs before smbios_set_defaults(), so we don't
--         *       yet know which mode (legacy vs. aggregate-table) will be
--         *       required. We therefore add the binary blob to both legacy
--         *       (smbios_entries) and aggregate (smbios_tables) tables, and
--         *       delete the one we don't need from smbios_set_defaults(),
--         *       once we know which machine version has been requested.
--         */
--        if (!smbios_entries) {
--            smbios_entries_len = sizeof(uint16_t);
--            smbios_entries = g_malloc0(smbios_entries_len);
-+        g_array_append_val(usr_blobs_sizes, size);
-+        usr_blobs_len += size;
-+        if (size > usr_table_max) {
-+            usr_table_max = size;
-         }
--        smbios_entries = g_realloc(smbios_entries, smbios_entries_len +
--                                                   size + sizeof(*table));
--        table = (struct smbios_table *)(smbios_entries + smbios_entries_len);
--        table->header.type = SMBIOS_TABLE_ENTRY;
--        table->header.length = cpu_to_le16(sizeof(*table) + size);
--        memcpy(table->data, header, size);
--        smbios_entries_len += sizeof(*table) + size;
--        (*(uint16_t *)smbios_entries) =
--                cpu_to_le16(le16_to_cpu(*(uint16_t *)smbios_entries) + 1);
--        /* end: add a copy of the newly loaded blob to legacy smbios_entries */
-+        usr_table_cnt++;
- 
-         return;
-     }
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-smbios-build-legacy-mode-code-only-for-pc-machine.patch b/SOURCES/kvm-smbios-build-legacy-mode-code-only-for-pc-machine.patch
deleted file mode 100644
index 1dc4d22..0000000
--- a/SOURCES/kvm-smbios-build-legacy-mode-code-only-for-pc-machine.patch
+++ /dev/null
@@ -1,517 +0,0 @@
-From 7ebb314a4f81d6d1a7dd4980b757fb5e556f5837 Mon Sep 17 00:00:00 2001
-From: Igor Mammedov <imammedo@redhat.com>
-Date: Tue, 13 Feb 2024 16:45:18 +0100
-Subject: [PATCH 13/20] smbios: build legacy mode code only for 'pc' machine
-
-RH-Author: Igor Mammedov <imammedo@redhat.com>
-RH-MergeRequest: 230: Workaround Windows failing to find 64bit SMBIOS entry point with SeaBIOS
-RH-Jira: RHEL-21705
-RH-Acked-by: MST <mst@redhat.com>
-RH-Acked-by: Ani Sinha <None>
-RH-Commit: [11/18] 06e639be03e0d151fb9bcf5f728388edcb84219a
-
-JIRA: https://issues.redhat.com/browse/RHEL-21705
-
-    basically moving code around without functional change.
-    And exposing some symbols so that they could be shared
-    between smbbios.c and new smbios_legacy.c
-
-    plus some meson magic to build smbios_legacy.c only
-    for 'pc' machine and otherwise replace it with stub
-    if not selected.
-
-    Signed-off-by: Igor Mammedov <imammedo@redhat.com>
-    Reviewed-by: Ani Sinha <anisinha@redhat.com>
-
-Conflicts: hw/smbios/smbios.c
-  context change due to downstream smbios_type2_required
-
-Signed-off-by: Igor Mammedov <imammedo@redhat.com>
----
- hw/i386/Kconfig                |   1 +
- hw/smbios/Kconfig              |   2 +
- hw/smbios/meson.build          |   5 +
- hw/smbios/smbios.c             | 163 +-----------------------------
- hw/smbios/smbios_legacy.c      | 179 +++++++++++++++++++++++++++++++++
- hw/smbios/smbios_legacy_stub.c |  15 +++
- include/hw/firmware/smbios.h   |   5 +
- 7 files changed, 208 insertions(+), 162 deletions(-)
- create mode 100644 hw/smbios/smbios_legacy.c
- create mode 100644 hw/smbios/smbios_legacy_stub.c
-
-diff --git a/hw/i386/Kconfig b/hw/i386/Kconfig
-index a1846be6f7..a6ee052f9a 100644
---- a/hw/i386/Kconfig
-+++ b/hw/i386/Kconfig
-@@ -76,6 +76,7 @@ config I440FX
-     select PIIX
-     select DIMM
-     select SMBIOS
-+    select SMBIOS_LEGACY
-     select FW_CFG_DMA
- 
- config ISAPC
-diff --git a/hw/smbios/Kconfig b/hw/smbios/Kconfig
-index 553adf4bfc..8d989a2f1b 100644
---- a/hw/smbios/Kconfig
-+++ b/hw/smbios/Kconfig
-@@ -1,2 +1,4 @@
- config SMBIOS
-     bool
-+config SMBIOS_LEGACY
-+    bool
-diff --git a/hw/smbios/meson.build b/hw/smbios/meson.build
-index 6eeae4b35c..fcac1d7490 100644
---- a/hw/smbios/meson.build
-+++ b/hw/smbios/meson.build
-@@ -4,10 +4,15 @@ smbios_ss.add(when: 'CONFIG_IPMI',
-               if_true: files('smbios_type_38.c'),
-               if_false: files('smbios_type_38-stub.c'))
- 
-+smbios_ss.add(when: 'CONFIG_SMBIOS_LEGACY',
-+              if_true: files('smbios_legacy.c'),
-+              if_false: files('smbios_legacy_stub.c'))
-+
- system_ss.add_all(when: 'CONFIG_SMBIOS', if_true: smbios_ss)
- system_ss.add(when: 'CONFIG_SMBIOS', if_false: files('smbios-stub.c'))
- 
- system_ss.add(when: 'CONFIG_ALL', if_true: files(
-   'smbios-stub.c',
-   'smbios_type_38-stub.c',
-+  'smbios_legacy_stub.c',
- ))
-diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c
-index eb9927335d..e40204550e 100644
---- a/hw/smbios/smbios.c
-+++ b/hw/smbios/smbios.c
-@@ -31,31 +31,7 @@
- #include "hw/pci/pci_device.h"
- #include "smbios_build.h"
- 
--/* legacy structures and constants for <= 2.0 machines */
--struct smbios_header {
--    uint16_t length;
--    uint8_t type;
--} QEMU_PACKED;
--
--struct smbios_field {
--    struct smbios_header header;
--    uint8_t type;
--    uint16_t offset;
--    uint8_t data[];
--} QEMU_PACKED;
--
--struct smbios_table {
--    struct smbios_header header;
--    uint8_t data[];
--} QEMU_PACKED;
--
--#define SMBIOS_FIELD_ENTRY 0
--#define SMBIOS_TABLE_ENTRY 1
--
--static uint8_t *smbios_entries;
--static size_t smbios_entries_len;
- static bool smbios_uuid_encoded = true;
--/* end: legacy structures & constants for <= 2.0 machines */
- 
- /* Set to true for modern Windows 10 HardwareID-6 compat */
- static bool smbios_type2_required;
-@@ -65,7 +41,6 @@ static bool smbios_type2_required;
-  */
- uint8_t *usr_blobs;
- size_t usr_blobs_len;
--static GArray *usr_blobs_sizes;
- static unsigned usr_table_max;
- static unsigned usr_table_cnt;
- 
-@@ -531,7 +506,7 @@ static void smbios_check_type4_count(uint32_t expected_t4_count)
-     }
- }
- 
--static void smbios_validate_table(void)
-+void smbios_validate_table(void)
- {
-     if (smbios_ep_type == SMBIOS_ENTRY_POINT_TYPE_32 &&
-         smbios_tables_len > SMBIOS_21_MAX_TABLES_LEN) {
-@@ -541,134 +516,6 @@ static void smbios_validate_table(void)
-     }
- }
- 
--
--/* legacy setup functions for <= 2.0 machines */
--static void smbios_add_field(int type, int offset, const void *data, size_t len)
--{
--    struct smbios_field *field;
--
--    if (!smbios_entries) {
--        smbios_entries_len = sizeof(uint16_t);
--        smbios_entries = g_malloc0(smbios_entries_len);
--    }
--    smbios_entries = g_realloc(smbios_entries, smbios_entries_len +
--                                                  sizeof(*field) + len);
--    field = (struct smbios_field *)(smbios_entries + smbios_entries_len);
--    field->header.type = SMBIOS_FIELD_ENTRY;
--    field->header.length = cpu_to_le16(sizeof(*field) + len);
--
--    field->type = type;
--    field->offset = cpu_to_le16(offset);
--    memcpy(field->data, data, len);
--
--    smbios_entries_len += sizeof(*field) + len;
--    (*(uint16_t *)smbios_entries) =
--            cpu_to_le16(le16_to_cpu(*(uint16_t *)smbios_entries) + 1);
--}
--
--static void smbios_maybe_add_str(int type, int offset, const char *data)
--{
--    if (data) {
--        smbios_add_field(type, offset, data, strlen(data) + 1);
--    }
--}
--
--static void smbios_build_type_0_fields(void)
--{
--    smbios_maybe_add_str(0, offsetof(struct smbios_type_0, vendor_str),
--                         smbios_type0.vendor);
--    smbios_maybe_add_str(0, offsetof(struct smbios_type_0, bios_version_str),
--                         smbios_type0.version);
--    smbios_maybe_add_str(0, offsetof(struct smbios_type_0,
--                                     bios_release_date_str),
--                         smbios_type0.date);
--    if (smbios_type0.have_major_minor) {
--        smbios_add_field(0, offsetof(struct smbios_type_0,
--                                     system_bios_major_release),
--                         &smbios_type0.major, 1);
--        smbios_add_field(0, offsetof(struct smbios_type_0,
--                                     system_bios_minor_release),
--                         &smbios_type0.minor, 1);
--    }
--}
--
--static void smbios_build_type_1_fields(void)
--{
--    smbios_maybe_add_str(1, offsetof(struct smbios_type_1, manufacturer_str),
--                         smbios_type1.manufacturer);
--    smbios_maybe_add_str(1, offsetof(struct smbios_type_1, product_name_str),
--                         smbios_type1.product);
--    smbios_maybe_add_str(1, offsetof(struct smbios_type_1, version_str),
--                         smbios_type1.version);
--    smbios_maybe_add_str(1, offsetof(struct smbios_type_1, serial_number_str),
--                         smbios_type1.serial);
--    smbios_maybe_add_str(1, offsetof(struct smbios_type_1, sku_number_str),
--                         smbios_type1.sku);
--    smbios_maybe_add_str(1, offsetof(struct smbios_type_1, family_str),
--                         smbios_type1.family);
--    if (qemu_uuid_set) {
--        /* We don't encode the UUID in the "wire format" here because this
--         * function is for legacy mode and needs to keep the guest ABI, and
--         * because we don't know what's the SMBIOS version advertised by the
--         * BIOS.
--         */
--        smbios_add_field(1, offsetof(struct smbios_type_1, uuid),
--                         &qemu_uuid, 16);
--    }
--}
--
--uint8_t *smbios_get_table_legacy(size_t *length)
--{
--    int i;
--    size_t usr_offset;
--
--    /* also complain if fields were given for types > 1 */
--    if (find_next_bit(smbios_have_fields_bitmap,
--                      SMBIOS_MAX_TYPE + 1, 2) < SMBIOS_MAX_TYPE + 1) {
--        error_report("can't process fields for smbios "
--                     "types > 1 on machine versions < 2.1!");
--        exit(1);
--    }
--
--    if (test_bit(4, smbios_have_binfile_bitmap)) {
--        error_report("can't process table for smbios "
--                     "type 4 on machine versions < 2.1!");
--        exit(1);
--    }
--
--    g_free(smbios_entries);
--    smbios_entries_len = sizeof(uint16_t);
--    smbios_entries = g_malloc0(smbios_entries_len);
--
--    for (i = 0, usr_offset = 0; usr_blobs_sizes && i < usr_blobs_sizes->len;
--         i++)
--    {
--        struct smbios_table *table;
--        struct smbios_structure_header *header;
--        size_t size = g_array_index(usr_blobs_sizes, size_t, i);
--
--        header = (struct smbios_structure_header *)(usr_blobs + usr_offset);
--        smbios_entries = g_realloc(smbios_entries, smbios_entries_len +
--                                                   size + sizeof(*table));
--        table = (struct smbios_table *)(smbios_entries + smbios_entries_len);
--        table->header.type = SMBIOS_TABLE_ENTRY;
--        table->header.length = cpu_to_le16(sizeof(*table) + size);
--        memcpy(table->data, header, size);
--        smbios_entries_len += sizeof(*table) + size;
--        (*(uint16_t *)smbios_entries) =
--            cpu_to_le16(le16_to_cpu(*(uint16_t *)smbios_entries) + 1);
--        usr_offset += size;
--    }
--
--    smbios_build_type_0_fields();
--    smbios_build_type_1_fields();
--    smbios_validate_table();
--    *length = smbios_entries_len;
--    return smbios_entries;
--}
--/* end: legacy setup functions for <= 2.0 machines */
--
--
- bool smbios_skip_table(uint8_t type, bool required_table)
- {
-     if (test_bit(type, smbios_have_binfile_bitmap)) {
-@@ -1418,14 +1265,6 @@ static bool save_opt_list(size_t *ndest, char ***dest, QemuOpts *opts,
-     return true;
- }
- 
--static void smbios_add_usr_blob_size(size_t size)
--{
--    if (!usr_blobs_sizes) {
--        usr_blobs_sizes = g_array_new(false, false, sizeof(size_t));
--    }
--    g_array_append_val(usr_blobs_sizes, size);
--}
--
- void smbios_entry_add(QemuOpts *opts, Error **errp)
- {
-     const char *val;
-diff --git a/hw/smbios/smbios_legacy.c b/hw/smbios/smbios_legacy.c
-new file mode 100644
-index 0000000000..21f143e738
---- /dev/null
-+++ b/hw/smbios/smbios_legacy.c
-@@ -0,0 +1,179 @@
-+/*
-+ * SMBIOS legacy support
-+ *
-+ * Copyright (C) 2009 Hewlett-Packard Development Company, L.P.
-+ * Copyright (C) 2013 Red Hat, Inc.
-+ *
-+ * Authors:
-+ *  Alex Williamson <alex.williamson@hp.com>
-+ *  Markus Armbruster <armbru@redhat.com>
-+ *
-+ * This work is licensed under the terms of the GNU GPL, version 2.  See
-+ * the COPYING file in the top-level directory.
-+ *
-+ * Contributions after 2012-01-13 are licensed under the terms of the
-+ * GNU GPL, version 2 or (at your option) any later version.
-+ */
-+
-+#include "qemu/osdep.h"
-+#include "qemu/bswap.h"
-+#include "hw/firmware/smbios.h"
-+#include "sysemu/sysemu.h"
-+#include "qemu/error-report.h"
-+
-+struct smbios_header {
-+    uint16_t length;
-+    uint8_t type;
-+} QEMU_PACKED;
-+
-+struct smbios_field {
-+    struct smbios_header header;
-+    uint8_t type;
-+    uint16_t offset;
-+    uint8_t data[];
-+} QEMU_PACKED;
-+
-+struct smbios_table {
-+    struct smbios_header header;
-+    uint8_t data[];
-+} QEMU_PACKED;
-+
-+#define SMBIOS_FIELD_ENTRY 0
-+#define SMBIOS_TABLE_ENTRY 1
-+
-+static uint8_t *smbios_entries;
-+static size_t smbios_entries_len;
-+GArray *usr_blobs_sizes;
-+
-+void smbios_add_usr_blob_size(size_t size)
-+{
-+    if (!usr_blobs_sizes) {
-+        usr_blobs_sizes = g_array_new(false, false, sizeof(size_t));
-+    }
-+    g_array_append_val(usr_blobs_sizes, size);
-+}
-+
-+static void smbios_add_field(int type, int offset, const void *data, size_t len)
-+{
-+    struct smbios_field *field;
-+
-+    if (!smbios_entries) {
-+        smbios_entries_len = sizeof(uint16_t);
-+        smbios_entries = g_malloc0(smbios_entries_len);
-+    }
-+    smbios_entries = g_realloc(smbios_entries, smbios_entries_len +
-+                                                  sizeof(*field) + len);
-+    field = (struct smbios_field *)(smbios_entries + smbios_entries_len);
-+    field->header.type = SMBIOS_FIELD_ENTRY;
-+    field->header.length = cpu_to_le16(sizeof(*field) + len);
-+
-+    field->type = type;
-+    field->offset = cpu_to_le16(offset);
-+    memcpy(field->data, data, len);
-+
-+    smbios_entries_len += sizeof(*field) + len;
-+    (*(uint16_t *)smbios_entries) =
-+            cpu_to_le16(le16_to_cpu(*(uint16_t *)smbios_entries) + 1);
-+}
-+
-+static void smbios_maybe_add_str(int type, int offset, const char *data)
-+{
-+    if (data) {
-+        smbios_add_field(type, offset, data, strlen(data) + 1);
-+    }
-+}
-+
-+static void smbios_build_type_0_fields(void)
-+{
-+    smbios_maybe_add_str(0, offsetof(struct smbios_type_0, vendor_str),
-+                         smbios_type0.vendor);
-+    smbios_maybe_add_str(0, offsetof(struct smbios_type_0, bios_version_str),
-+                         smbios_type0.version);
-+    smbios_maybe_add_str(0, offsetof(struct smbios_type_0,
-+                                     bios_release_date_str),
-+                         smbios_type0.date);
-+    if (smbios_type0.have_major_minor) {
-+        smbios_add_field(0, offsetof(struct smbios_type_0,
-+                                     system_bios_major_release),
-+                         &smbios_type0.major, 1);
-+        smbios_add_field(0, offsetof(struct smbios_type_0,
-+                                     system_bios_minor_release),
-+                         &smbios_type0.minor, 1);
-+    }
-+}
-+
-+static void smbios_build_type_1_fields(void)
-+{
-+    smbios_maybe_add_str(1, offsetof(struct smbios_type_1, manufacturer_str),
-+                         smbios_type1.manufacturer);
-+    smbios_maybe_add_str(1, offsetof(struct smbios_type_1, product_name_str),
-+                         smbios_type1.product);
-+    smbios_maybe_add_str(1, offsetof(struct smbios_type_1, version_str),
-+                         smbios_type1.version);
-+    smbios_maybe_add_str(1, offsetof(struct smbios_type_1, serial_number_str),
-+                         smbios_type1.serial);
-+    smbios_maybe_add_str(1, offsetof(struct smbios_type_1, sku_number_str),
-+                         smbios_type1.sku);
-+    smbios_maybe_add_str(1, offsetof(struct smbios_type_1, family_str),
-+                         smbios_type1.family);
-+    if (qemu_uuid_set) {
-+        /*
-+         * We don't encode the UUID in the "wire format" here because this
-+         * function is for legacy mode and needs to keep the guest ABI, and
-+         * because we don't know what's the SMBIOS version advertised by the
-+         * BIOS.
-+         */
-+        smbios_add_field(1, offsetof(struct smbios_type_1, uuid),
-+                         &qemu_uuid, 16);
-+    }
-+}
-+
-+uint8_t *smbios_get_table_legacy(size_t *length)
-+{
-+    int i;
-+    size_t usr_offset;
-+
-+    /* complain if fields were given for types > 1 */
-+    if (find_next_bit(smbios_have_fields_bitmap,
-+                      SMBIOS_MAX_TYPE + 1, 2) < SMBIOS_MAX_TYPE + 1) {
-+        error_report("can't process fields for smbios "
-+                     "types > 1 on machine versions < 2.1!");
-+        exit(1);
-+    }
-+
-+    if (test_bit(4, smbios_have_binfile_bitmap)) {
-+        error_report("can't process table for smbios "
-+                     "type 4 on machine versions < 2.1!");
-+        exit(1);
-+    }
-+
-+    g_free(smbios_entries);
-+    smbios_entries_len = sizeof(uint16_t);
-+    smbios_entries = g_malloc0(smbios_entries_len);
-+
-+    for (i = 0, usr_offset = 0; usr_blobs_sizes && i < usr_blobs_sizes->len;
-+         i++)
-+    {
-+        struct smbios_table *table;
-+        struct smbios_structure_header *header;
-+        size_t size = g_array_index(usr_blobs_sizes, size_t, i);
-+
-+        header = (struct smbios_structure_header *)(usr_blobs + usr_offset);
-+        smbios_entries = g_realloc(smbios_entries, smbios_entries_len +
-+                                                   size + sizeof(*table));
-+        table = (struct smbios_table *)(smbios_entries + smbios_entries_len);
-+        table->header.type = SMBIOS_TABLE_ENTRY;
-+        table->header.length = cpu_to_le16(sizeof(*table) + size);
-+        memcpy(table->data, header, size);
-+        smbios_entries_len += sizeof(*table) + size;
-+        (*(uint16_t *)smbios_entries) =
-+            cpu_to_le16(le16_to_cpu(*(uint16_t *)smbios_entries) + 1);
-+        usr_offset += size;
-+    }
-+
-+    smbios_build_type_0_fields();
-+    smbios_build_type_1_fields();
-+    smbios_validate_table();
-+    *length = smbios_entries_len;
-+    return smbios_entries;
-+}
-diff --git a/hw/smbios/smbios_legacy_stub.c b/hw/smbios/smbios_legacy_stub.c
-new file mode 100644
-index 0000000000..f29b15316c
---- /dev/null
-+++ b/hw/smbios/smbios_legacy_stub.c
-@@ -0,0 +1,15 @@
-+/*
-+ * IPMI SMBIOS firmware handling
-+ *
-+ * Copyright (c) 2024 Igor Mammedov, Red Hat, Inc.
-+ *
-+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
-+ * See the COPYING file in the top-level directory.
-+ */
-+
-+#include "qemu/osdep.h"
-+#include "hw/firmware/smbios.h"
-+
-+void smbios_add_usr_blob_size(size_t size)
-+{
-+}
-diff --git a/include/hw/firmware/smbios.h b/include/hw/firmware/smbios.h
-index 333de0d5fc..92e9aba415 100644
---- a/include/hw/firmware/smbios.h
-+++ b/include/hw/firmware/smbios.h
-@@ -17,6 +17,9 @@
-  *
-  */
- 
-+extern uint8_t *usr_blobs;
-+extern GArray *usr_blobs_sizes;
-+
- typedef struct {
-     const char *vendor, *version, *date;
-     bool have_major_minor, uefi;
-@@ -323,6 +326,8 @@ struct smbios_type_127 {
-     struct smbios_structure_header header;
- } QEMU_PACKED;
- 
-+void smbios_validate_table(void);
-+void smbios_add_usr_blob_size(size_t size);
- void smbios_entry_add(QemuOpts *opts, Error **errp);
- void smbios_set_cpuid(uint32_t version, uint32_t features);
- void smbios_set_defaults(const char *manufacturer, const char *product,
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-smbios-cleanup-smbios_get_tables-from-legacy-handlin.patch b/SOURCES/kvm-smbios-cleanup-smbios_get_tables-from-legacy-handlin.patch
deleted file mode 100644
index 48a9e16..0000000
--- a/SOURCES/kvm-smbios-cleanup-smbios_get_tables-from-legacy-handlin.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-From 07f6ef2d032cda3e746ac2477c0a9bc1ac636f45 Mon Sep 17 00:00:00 2001
-From: Igor Mammedov <imammedo@redhat.com>
-Date: Fri, 29 Dec 2023 14:08:13 +0100
-Subject: [PATCH 06/20] smbios: cleanup smbios_get_tables() from legacy
- handling
-
-RH-Author: Igor Mammedov <imammedo@redhat.com>
-RH-MergeRequest: 230: Workaround Windows failing to find 64bit SMBIOS entry point with SeaBIOS
-RH-Jira: RHEL-21705
-RH-Acked-by: MST <mst@redhat.com>
-RH-Acked-by: Ani Sinha <None>
-RH-Commit: [4/18] a5e09ce1df72293fecad863edd146a8c4b1a734f
-
-JIRA: https://issues.redhat.com/browse/RHEL-21705
-
-smbios_get_tables() bails out right away if leagacy mode is enabled
-and won't generate any SMBIOS tables. At the same time x86 specific
-fw_cfg_build_smbios() will genarate legacy tables and then proceed
-to preparing temporary mem_array for useless call to
-smbios_get_tables() and then discard it.
-
-Drop legacy related check in smbios_get_tables() and return from
-fw_cfg_build_smbios() early if legacy tables where built without
-proceeding to non legacy part of the function.
-
-Signed-off-by: Igor Mammedov <imammedo@redhat.com>
-Reviewed-by: Ani Sinha <anisinha@redhat.com>
-Tested-by: Fiona Ebner <f.ebner@proxmox.com>
----
- hw/i386/fw_cfg.c   | 1 +
- hw/smbios/smbios.c | 6 ------
- 2 files changed, 1 insertion(+), 6 deletions(-)
-
-diff --git a/hw/i386/fw_cfg.c b/hw/i386/fw_cfg.c
-index 6a5466faf0..ed72b1442d 100644
---- a/hw/i386/fw_cfg.c
-+++ b/hw/i386/fw_cfg.c
-@@ -76,6 +76,7 @@ void fw_cfg_build_smbios(PCMachineState *pcms, FWCfgState *fw_cfg)
-     if (smbios_tables) {
-         fw_cfg_add_bytes(fw_cfg, FW_CFG_SMBIOS_ENTRIES,
-                          smbios_tables, smbios_tables_len);
-+        return;
-     }
- 
-     /* build the array of physical mem area from e820 table */
-diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c
-index 074705fa4c..b13e40bae2 100644
---- a/hw/smbios/smbios.c
-+++ b/hw/smbios/smbios.c
-@@ -1244,12 +1244,6 @@ void smbios_get_tables(MachineState *ms,
- {
-     unsigned i, dimm_cnt, offset;
- 
--    if (smbios_legacy) {
--        *tables = *anchor = NULL;
--        *tables_len = *anchor_len = 0;
--        return;
--    }
--
-     if (!smbios_immutable) {
-         smbios_build_type_0_table();
-         smbios_build_type_1_table();
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-smbios-clear-smbios_type4_count-before-building-tabl.patch b/SOURCES/kvm-smbios-clear-smbios_type4_count-before-building-tabl.patch
deleted file mode 100644
index 38a7f95..0000000
--- a/SOURCES/kvm-smbios-clear-smbios_type4_count-before-building-tabl.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From c0282a842a912aacac28a6ae229de5854c3fb5df Mon Sep 17 00:00:00 2001
-From: Igor Mammedov <imammedo@redhat.com>
-Date: Mon, 26 Feb 2024 13:20:22 +0100
-Subject: [PATCH 16/20] smbios: clear smbios_type4_count before building tables
-
-RH-Author: Igor Mammedov <imammedo@redhat.com>
-RH-MergeRequest: 230: Workaround Windows failing to find 64bit SMBIOS entry point with SeaBIOS
-RH-Jira: RHEL-21705
-RH-Acked-by: MST <mst@redhat.com>
-RH-Acked-by: Ani Sinha <None>
-RH-Commit: [14/18] f809595d2934ae975c0b7d17a4a79645e062ba42
-
-JIRA: https://issues.redhat.com/browse/RHEL-21705
-
-it will help to keep type 4 tables accounting correct in case
-SMBIOS tables are built multiple times.
-
-Signed-off-by: Igor Mammedov <imammedo@redhat.com>
-Tested-by: Fiona Ebner <f.ebner@proxmox.com>
----
- hw/smbios/smbios.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c
-index 7e32430b85..4521ea386c 100644
---- a/hw/smbios/smbios.c
-+++ b/hw/smbios/smbios.c
-@@ -1111,6 +1111,7 @@ void smbios_get_tables(MachineState *ms,
-            ep_type == SMBIOS_ENTRY_POINT_TYPE_64);
- 
-     g_free(smbios_tables);
-+    smbios_type4_count = 0;
-     smbios_tables = g_memdup2(usr_blobs, usr_blobs_len);
-     smbios_tables_len = usr_blobs_len;
-     smbios_table_max = usr_table_max;
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-smbios-don-t-check-type4-structures-in-legacy-mode.patch b/SOURCES/kvm-smbios-don-t-check-type4-structures-in-legacy-mode.patch
deleted file mode 100644
index a2c9532..0000000
--- a/SOURCES/kvm-smbios-don-t-check-type4-structures-in-legacy-mode.patch
+++ /dev/null
@@ -1,133 +0,0 @@
-From 2b76d95ec07aba6d96070ee90c5015c1676be091 Mon Sep 17 00:00:00 2001
-From: Igor Mammedov <imammedo@redhat.com>
-Date: Tue, 13 Feb 2024 16:25:54 +0100
-Subject: [PATCH 10/20] smbios: don't check type4 structures in legacy mode
-
-RH-Author: Igor Mammedov <imammedo@redhat.com>
-RH-MergeRequest: 230: Workaround Windows failing to find 64bit SMBIOS entry point with SeaBIOS
-RH-Jira: RHEL-21705
-RH-Acked-by: MST <mst@redhat.com>
-RH-Acked-by: Ani Sinha <None>
-RH-Commit: [8/18] c1f8409ea0d916f333c9373535bf21b521c62855
-
-JIRA: https://issues.redhat.com/browse/RHEL-21705
-
-    legacy mode doesn't support structures of type 2 and more,
-    and CLI has a check for '-smbios type' option, however it's
-    still possible to sneak in type4 as a blob with '-smbios file'
-    option. However doing the later makes SMBIOS tables broken
-    since SeaBIOS doesn't expect that.
-
-    Rather than trying to add support for type4 to legacy code
-    (both QEMU and SeaBIOS), simplify smbios_get_table_legacy()
-    by dropping not relevant check in legacy code and error out
-    on type4 blob.
-
-    Signed-off-by: Igor Mammedov <imammedo@redhat.com>
-    Reviewed-by: Ani Sinha <anisinha@redhat.com>
-    Tested-by: Fiona Ebner <f.ebner@proxmox.com>
-
-Conflicts: include/hw/firmware/smbios.h
-Signed-off-by: Igor Mammedov <imammedo@redhat.com>
-
- Please enter the commit message for your changes. Lines starting
----
- hw/i386/fw_cfg.c             |  3 +--
- hw/smbios/smbios.c           | 18 ++++++++++++++----
- include/hw/firmware/smbios.h |  2 +-
- 3 files changed, 16 insertions(+), 7 deletions(-)
-
-diff --git a/hw/i386/fw_cfg.c b/hw/i386/fw_cfg.c
-index bb7149c4c3..a25793a68f 100644
---- a/hw/i386/fw_cfg.c
-+++ b/hw/i386/fw_cfg.c
-@@ -73,8 +73,7 @@ void fw_cfg_build_smbios(PCMachineState *pcms, FWCfgState *fw_cfg)
-     smbios_set_cpuid(cpu->env.cpuid_version, cpu->env.features[FEAT_1_EDX]);
- 
-     if (pcmc->smbios_legacy_mode) {
--        smbios_tables = smbios_get_table_legacy(ms->smp.cpus,
--                                                &smbios_tables_len);
-+        smbios_tables = smbios_get_table_legacy(&smbios_tables_len);
-         fw_cfg_add_bytes(fw_cfg, FW_CFG_SMBIOS_ENTRIES,
-                          smbios_tables, smbios_tables_len);
-         return;
-diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c
-index d8d68716d4..441517cf24 100644
---- a/hw/smbios/smbios.c
-+++ b/hw/smbios/smbios.c
-@@ -530,14 +530,17 @@ opts_init(smbios_register_config);
-  */
- #define SMBIOS_21_MAX_TABLES_LEN 0xffff
- 
--static void smbios_validate_table(uint32_t expected_t4_count)
-+static void smbios_check_type4_count(uint32_t expected_t4_count)
- {
-     if (smbios_type4_count && smbios_type4_count != expected_t4_count) {
-         error_report("Expected %d SMBIOS Type 4 tables, got %d instead",
-                      expected_t4_count, smbios_type4_count);
-         exit(1);
-     }
-+}
- 
-+static void smbios_validate_table(void)
-+{
-     if (smbios_ep_type == SMBIOS_ENTRY_POINT_TYPE_32 &&
-         smbios_tables_len > SMBIOS_21_MAX_TABLES_LEN) {
-         error_report("SMBIOS 2.1 table length %zu exceeds %d",
-@@ -622,7 +625,7 @@ static void smbios_build_type_1_fields(void)
-     }
- }
- 
--uint8_t *smbios_get_table_legacy(uint32_t expected_t4_count, size_t *length)
-+uint8_t *smbios_get_table_legacy(size_t *length)
- {
-     int i;
-     size_t usr_offset;
-@@ -635,6 +638,12 @@ uint8_t *smbios_get_table_legacy(uint32_t expected_t4_count, size_t *length)
-         exit(1);
-     }
- 
-+    if (test_bit(4, have_binfile_bitmap)) {
-+        error_report("can't process table for smbios "
-+                     "type 4 on machine versions < 2.1!");
-+        exit(1);
-+    }
-+
-     g_free(smbios_entries);
-     smbios_entries_len = sizeof(uint16_t);
-     smbios_entries = g_malloc0(smbios_entries_len);
-@@ -661,7 +670,7 @@ uint8_t *smbios_get_table_legacy(uint32_t expected_t4_count, size_t *length)
- 
-     smbios_build_type_0_fields();
-     smbios_build_type_1_fields();
--    smbios_validate_table(expected_t4_count);
-+    smbios_validate_table();
-     *length = smbios_entries_len;
-     return smbios_entries;
- }
-@@ -1319,7 +1328,8 @@ void smbios_get_tables(MachineState *ms,
-     smbios_build_type_41_table(errp);
-     smbios_build_type_127_table();
- 
--    smbios_validate_table(ms->smp.sockets);
-+    smbios_check_type4_count(ms->smp.sockets);
-+    smbios_validate_table();
-     smbios_entry_point_setup();
- 
-     /* return tables blob and entry point (anchor), and their sizes */
-diff --git a/include/hw/firmware/smbios.h b/include/hw/firmware/smbios.h
-index b9fc9a0f42..d55018e5e3 100644
---- a/include/hw/firmware/smbios.h
-+++ b/include/hw/firmware/smbios.h
-@@ -315,7 +315,7 @@ void smbios_set_defaults(const char *manufacturer, const char *product,
-                          SmbiosEntryPointType ep_type,
-                          const char *stream_product,
-                          const char *stream_version);
--uint8_t *smbios_get_table_legacy(uint32_t expected_t4_count, size_t *length);
-+uint8_t *smbios_get_table_legacy(size_t *length);
- void smbios_get_tables(MachineState *ms,
-                        const struct smbios_phys_mem_area *mem_array,
-                        const unsigned int mem_array_size,
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-smbios-error-out-when-building-type-4-table-is-not-p.patch b/SOURCES/kvm-smbios-error-out-when-building-type-4-table-is-not-p.patch
deleted file mode 100644
index 2afbe66..0000000
--- a/SOURCES/kvm-smbios-error-out-when-building-type-4-table-is-not-p.patch
+++ /dev/null
@@ -1,72 +0,0 @@
-From bbb2d260e6f33380b9df28c74421055bd8dccda5 Mon Sep 17 00:00:00 2001
-From: Igor Mammedov <imammedo@redhat.com>
-Date: Mon, 26 Feb 2024 12:59:33 +0100
-Subject: [PATCH 19/20] smbios: error out when building type 4 table is not
- possible
-
-RH-Author: Igor Mammedov <imammedo@redhat.com>
-RH-MergeRequest: 230: Workaround Windows failing to find 64bit SMBIOS entry point with SeaBIOS
-RH-Jira: RHEL-21705
-RH-Acked-by: MST <mst@redhat.com>
-RH-Acked-by: Ani Sinha <None>
-RH-Commit: [17/18] 86b1c67bfbe9c0c14a190cd1204b6ccd1de1630f
-
-JIRA: https://issues.redhat.com/browse/RHEL-21705
-
-If SMBIOS v2 version is requested but number of cores/threads
-are more than it's possible to describe with v2, error out
-instead of silently ignoring the fact and filling core/thread
-count with bogus values.
-
-This will help caller to decide if it should fallback to
-SMBIOSv3 when smbios-entry-point-type='auto'
-
-Signed-off-by: Igor Mammedov <imammedo@redhat.com>
-Reviewed-by: Ani Sinha <anisinha@redhat.com>
-Tested-by: Fiona Ebner <f.ebner@proxmox.com>
----
- hw/smbios/smbios.c | 14 ++++++++++++--
- 1 file changed, 12 insertions(+), 2 deletions(-)
-
-diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c
-index 3d9dcb0d31..637aa952f5 100644
---- a/hw/smbios/smbios.c
-+++ b/hw/smbios/smbios.c
-@@ -655,7 +655,8 @@ static void smbios_build_type_3_table(void)
- }
- 
- static void smbios_build_type_4_table(MachineState *ms, unsigned instance,
--                                      SmbiosEntryPointType ep_type)
-+                                      SmbiosEntryPointType ep_type,
-+                                      Error **errp)
- {
-     char sock_str[128];
-     size_t tbl_len = SMBIOS_TYPE_4_LEN_V28;
-@@ -709,6 +710,12 @@ static void smbios_build_type_4_table(MachineState *ms, unsigned instance,
-     if (tbl_len == SMBIOS_TYPE_4_LEN_V30) {
-         t->core_count2 = t->core_enabled2 = cpu_to_le16(cores_per_socket);
-         t->thread_count2 = cpu_to_le16(threads_per_socket);
-+    } else if (t->core_count == 0xFF || t->thread_count == 0xFF) {
-+        error_setg(errp, "SMBIOS 2.0 doesn't support number of processor "
-+                         "cores/threads more than 255, use "
-+                         "-machine smbios-entry-point-type=64 option to enable "
-+                         "SMBIOS 3.0 support");
-+        return;
-     }
- 
-     SMBIOS_BUILD_TABLE_POST;
-@@ -1126,7 +1133,10 @@ static bool smbios_get_tables_ep(MachineState *ms,
-     assert(ms->smp.sockets >= 1);
- 
-     for (i = 0; i < ms->smp.sockets; i++) {
--        smbios_build_type_4_table(ms, i, ep_type);
-+        smbios_build_type_4_table(ms, i, ep_type, errp);
-+        if (*errp) {
-+            goto err_exit;
-+        }
-     }
- 
-     smbios_build_type_8_table();
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-smbios-extend-smbios-entry-point-type-with-auto-valu.patch b/SOURCES/kvm-smbios-extend-smbios-entry-point-type-with-auto-valu.patch
deleted file mode 100644
index db012bd..0000000
--- a/SOURCES/kvm-smbios-extend-smbios-entry-point-type-with-auto-valu.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From c083959c963fde33f4769fd4c6e122dd16ce6d3c Mon Sep 17 00:00:00 2001
-From: Igor Mammedov <imammedo@redhat.com>
-Date: Wed, 21 Feb 2024 16:04:36 +0100
-Subject: [PATCH 17/20] smbios: extend smbios-entry-point-type with 'auto'
- value
-
-RH-Author: Igor Mammedov <imammedo@redhat.com>
-RH-MergeRequest: 230: Workaround Windows failing to find 64bit SMBIOS entry point with SeaBIOS
-RH-Jira: RHEL-21705
-RH-Acked-by: MST <mst@redhat.com>
-RH-Acked-by: Ani Sinha <None>
-RH-Commit: [15/18] 202563dcf77e062a238aa2a10ec14c25d3f5a7d0
-
-JIRA: https://issues.redhat.com/browse/RHEL-21705
-
-later patches will use it to pick SMBIOS version at runtime
-depending on configuration.
-
-Signed-off-by: Igor Mammedov <imammedo@redhat.com>
-Acked-by: Markus Armbruster <armbru@redhat.com>
-Reviewed-by: Ani Sinha <anisinha@redhat.com>
-Tested-by: Fiona Ebner <f.ebner@proxmox.com>
----
- qapi/machine.json | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/qapi/machine.json b/qapi/machine.json
-index b6d634b30d..99f6368fa6 100644
---- a/qapi/machine.json
-+++ b/qapi/machine.json
-@@ -1788,10 +1788,13 @@
- #
- # @64: SMBIOS version 3.0 (64-bit) Entry Point
- #
-+# @auto: Either 2.x or 3.x SMBIOS version, 2.x if configuration can be
-+#     described by it and 3.x otherwise (since: 9.0)
-+#
- # Since: 7.0
- ##
- { 'enum': 'SmbiosEntryPointType',
--  'data': [ '32', '64' ] }
-+  'data': [ '32', '64', 'auto' ] }
- 
- ##
- # @MemorySizeConfiguration:
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-smbios-get-rid-of-global-smbios_ep_type.patch b/SOURCES/kvm-smbios-get-rid-of-global-smbios_ep_type.patch
deleted file mode 100644
index 1896f2b..0000000
--- a/SOURCES/kvm-smbios-get-rid-of-global-smbios_ep_type.patch
+++ /dev/null
@@ -1,281 +0,0 @@
-From be0abbf3f7845847b46486704c46c5de5a2b2323 Mon Sep 17 00:00:00 2001
-From: Igor Mammedov <imammedo@redhat.com>
-Date: Mon, 26 Feb 2024 13:49:14 +0100
-Subject: [PATCH 15/20] smbios: get rid of global smbios_ep_type
-
-RH-Author: Igor Mammedov <imammedo@redhat.com>
-RH-MergeRequest: 230: Workaround Windows failing to find 64bit SMBIOS entry point with SeaBIOS
-RH-Jira: RHEL-21705
-RH-Acked-by: MST <mst@redhat.com>
-RH-Acked-by: Ani Sinha <None>
-RH-Commit: [13/18] 2e838ed0d03989e2e4ee08041b5ba64d5d7f5820
-
-JIRA: https://issues.redhat.com/browse/RHEL-21705
-
-Conflicts: hw/arm/virt.c, hw/i386/fw_cfg.c, hw/riscv/virt.c, hw/smbios/smbios.c,
-           include/hw/firmware/smbios.h
-   due to downstream specific smbios_set_defaults()
-
-Signed-off-by: Igor Mammedov <imammedo@redhat.com>
-Acked-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-Reviewed-by: Ani Sinha <anisinha@redhat.com>
-Tested-by: Fiona Ebner <f.ebner@proxmox.com>
-Signed-off-by: Igor Mammedov <imammedo@redhat.com>
----
- hw/arm/virt.c                |  4 ++--
- hw/i386/fw_cfg.c             |  6 +++---
- hw/i386/fw_cfg.h             |  3 ++-
- hw/i386/pc.c                 |  2 +-
- hw/loongarch/virt.c          |  7 ++++---
- hw/smbios/smbios.c           | 26 ++++++++++++++------------
- hw/smbios/smbios_legacy.c    |  2 +-
- include/hw/firmware/smbios.h |  4 ++--
- 8 files changed, 29 insertions(+), 25 deletions(-)
-
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index e5cfc19c08..e4a66affcb 100644
---- a/hw/arm/virt.c
-+++ b/hw/arm/virt.c
-@@ -1695,14 +1695,14 @@ static void virt_build_smbios(VirtMachineState *vms)
- 
-     smbios_set_defaults("QEMU", product,
-                         vmc->smbios_old_sys_ver ? "1.0" : mc->name,
--                        true, SMBIOS_ENTRY_POINT_TYPE_64,
-+                        true,
-                         NULL, NULL);
- 
-     /* build the array of physical mem area from base_memmap */
-     mem_array.address = vms->memmap[VIRT_MEM].base;
-     mem_array.length = ms->ram_size;
- 
--    smbios_get_tables(ms, &mem_array, 1,
-+    smbios_get_tables(ms, SMBIOS_ENTRY_POINT_TYPE_64, &mem_array, 1,
-                       &smbios_tables, &smbios_tables_len,
-                       &smbios_anchor, &smbios_anchor_len,
-                       &error_fatal);
-diff --git a/hw/i386/fw_cfg.c b/hw/i386/fw_cfg.c
-index bdc3cc4556..58429bb78d 100644
---- a/hw/i386/fw_cfg.c
-+++ b/hw/i386/fw_cfg.c
-@@ -48,7 +48,8 @@ const char *fw_cfg_arch_key_name(uint16_t key)
-     return NULL;
- }
- 
--void fw_cfg_build_smbios(PCMachineState *pcms, FWCfgState *fw_cfg)
-+void fw_cfg_build_smbios(PCMachineState *pcms, FWCfgState *fw_cfg,
-+                         SmbiosEntryPointType ep_type)
- {
- #ifdef CONFIG_SMBIOS
-     uint8_t *smbios_tables, *smbios_anchor;
-@@ -64,7 +65,6 @@ void fw_cfg_build_smbios(PCMachineState *pcms, FWCfgState *fw_cfg)
-         /* These values are guest ABI, do not change */
-         smbios_set_defaults("QEMU", mc->desc, mc->name,
-                             pcmc->smbios_uuid_encoded,
--                            pcms->smbios_entry_point_type,
-                             pcmc->smbios_stream_product,
-                             pcmc->smbios_stream_version);
-     }
-@@ -91,7 +91,7 @@ void fw_cfg_build_smbios(PCMachineState *pcms, FWCfgState *fw_cfg)
-             array_count++;
-         }
-     }
--    smbios_get_tables(ms, mem_array, array_count,
-+    smbios_get_tables(ms, ep_type, mem_array, array_count,
-                       &smbios_tables, &smbios_tables_len,
-                       &smbios_anchor, &smbios_anchor_len,
-                       &error_fatal);
-diff --git a/hw/i386/fw_cfg.h b/hw/i386/fw_cfg.h
-index 1e1de6b4a3..92e310f5fd 100644
---- a/hw/i386/fw_cfg.h
-+++ b/hw/i386/fw_cfg.h
-@@ -23,7 +23,8 @@
- FWCfgState *fw_cfg_arch_create(MachineState *ms,
-                                uint16_t boot_cpus,
-                                uint16_t apic_id_limit);
--void fw_cfg_build_smbios(PCMachineState *ms, FWCfgState *fw_cfg);
-+void fw_cfg_build_smbios(PCMachineState *pcms, FWCfgState *fw_cfg,
-+                         SmbiosEntryPointType ep_type);
- void fw_cfg_build_feature_control(MachineState *ms, FWCfgState *fw_cfg);
- void fw_cfg_add_acpi_dsdt(Aml *scope, FWCfgState *fw_cfg);
- 
-diff --git a/hw/i386/pc.c b/hw/i386/pc.c
-index 16de2a59e8..ae6777fc1a 100644
---- a/hw/i386/pc.c
-+++ b/hw/i386/pc.c
-@@ -847,7 +847,7 @@ void pc_machine_done(Notifier *notifier, void *data)
- 
-     acpi_setup();
-     if (x86ms->fw_cfg) {
--        fw_cfg_build_smbios(pcms, x86ms->fw_cfg);
-+        fw_cfg_build_smbios(pcms, x86ms->fw_cfg, pcms->smbios_entry_point_type);
-         fw_cfg_build_feature_control(MACHINE(pcms), x86ms->fw_cfg);
-         /* update FW_CFG_NB_CPUS to account for -device added CPUs */
-         fw_cfg_modify_i16(x86ms->fw_cfg, FW_CFG_NB_CPUS, x86ms->boot_cpus);
-diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
-index 7358a023d3..77956b5ada 100644
---- a/hw/loongarch/virt.c
-+++ b/hw/loongarch/virt.c
-@@ -320,10 +320,11 @@ static void virt_build_smbios(LoongArchMachineState *lams)
-         return;
-     }
- 
--    smbios_set_defaults("QEMU", product, mc->name,
--                        true, SMBIOS_ENTRY_POINT_TYPE_64);
-+    smbios_set_defaults("QEMU", product, mc->name, true);
- 
--    smbios_get_tables(ms, NULL, 0, &smbios_tables, &smbios_tables_len,
-+    smbios_get_tables(ms, SMBIOS_ENTRY_POINT_TYPE_64,
-+                      NULL, 0,
-+                      &smbios_tables, &smbios_tables_len,
-                       &smbios_anchor, &smbios_anchor_len, &error_fatal);
- 
-     if (smbios_anchor) {
-diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c
-index b5745c6c2d..7e32430b85 100644
---- a/hw/smbios/smbios.c
-+++ b/hw/smbios/smbios.c
-@@ -47,7 +47,6 @@ uint8_t *smbios_tables;
- size_t smbios_tables_len;
- unsigned smbios_table_max;
- unsigned smbios_table_cnt;
--static SmbiosEntryPointType smbios_ep_type = SMBIOS_ENTRY_POINT_TYPE_32;
- 
- static SmbiosEntryPoint ep;
- 
-@@ -506,9 +505,9 @@ static bool smbios_check_type4_count(uint32_t expected_t4_count, Error **errp)
-     return true;
- }
- 
--bool smbios_validate_table(Error **errp)
-+bool smbios_validate_table(SmbiosEntryPointType ep_type, Error **errp)
- {
--    if (smbios_ep_type == SMBIOS_ENTRY_POINT_TYPE_32 &&
-+    if (ep_type == SMBIOS_ENTRY_POINT_TYPE_32 &&
-         smbios_tables_len > SMBIOS_21_MAX_TABLES_LEN) {
-         error_setg(errp, "SMBIOS 2.1 table length %zu exceeds %d",
-                    smbios_tables_len, SMBIOS_21_MAX_TABLES_LEN);
-@@ -655,14 +654,15 @@ static void smbios_build_type_3_table(void)
-     SMBIOS_BUILD_TABLE_POST;
- }
- 
--static void smbios_build_type_4_table(MachineState *ms, unsigned instance)
-+static void smbios_build_type_4_table(MachineState *ms, unsigned instance,
-+                                      SmbiosEntryPointType ep_type)
- {
-     char sock_str[128];
-     size_t tbl_len = SMBIOS_TYPE_4_LEN_V28;
-     unsigned threads_per_socket;
-     unsigned cores_per_socket;
- 
--    if (smbios_ep_type == SMBIOS_ENTRY_POINT_TYPE_64) {
-+    if (ep_type == SMBIOS_ENTRY_POINT_TYPE_64) {
-         tbl_len = SMBIOS_TYPE_4_LEN_V30;
-     }
- 
-@@ -991,13 +991,11 @@ void smbios_set_cpuid(uint32_t version, uint32_t features)
- void smbios_set_defaults(const char *manufacturer, const char *product,
-                          const char *version,
-                          bool uuid_encoded,
--                         SmbiosEntryPointType ep_type,
-                          const char *stream_product,
-                          const char *stream_version)
- {
-     smbios_have_defaults = true;
-     smbios_uuid_encoded = uuid_encoded;
--    smbios_ep_type = ep_type;
- 
-     /*
-      * If @stream_product & @stream_version are non-NULL, then
-@@ -1048,9 +1046,9 @@ void smbios_set_defaults(const char *manufacturer, const char *product,
-     SMBIOS_SET_DEFAULT(type17.manufacturer, manufacturer);
- }
- 
--static void smbios_entry_point_setup(void)
-+static void smbios_entry_point_setup(SmbiosEntryPointType ep_type)
- {
--    switch (smbios_ep_type) {
-+    switch (ep_type) {
-     case SMBIOS_ENTRY_POINT_TYPE_32:
-         memcpy(ep.ep21.anchor_string, "_SM_", 4);
-         memcpy(ep.ep21.intermediate_anchor_string, "_DMI_", 5);
-@@ -1100,6 +1098,7 @@ static void smbios_entry_point_setup(void)
- }
- 
- void smbios_get_tables(MachineState *ms,
-+                       SmbiosEntryPointType ep_type,
-                        const struct smbios_phys_mem_area *mem_array,
-                        const unsigned int mem_array_size,
-                        uint8_t **tables, size_t *tables_len,
-@@ -1108,6 +1107,9 @@ void smbios_get_tables(MachineState *ms,
- {
-     unsigned i, dimm_cnt, offset;
- 
-+    assert(ep_type == SMBIOS_ENTRY_POINT_TYPE_32 ||
-+           ep_type == SMBIOS_ENTRY_POINT_TYPE_64);
-+
-     g_free(smbios_tables);
-     smbios_tables = g_memdup2(usr_blobs, usr_blobs_len);
-     smbios_tables_len = usr_blobs_len;
-@@ -1122,7 +1124,7 @@ void smbios_get_tables(MachineState *ms,
-     assert(ms->smp.sockets >= 1);
- 
-     for (i = 0; i < ms->smp.sockets; i++) {
--        smbios_build_type_4_table(ms, i);
-+        smbios_build_type_4_table(ms, i, ep_type);
-     }
- 
-     smbios_build_type_8_table();
-@@ -1171,10 +1173,10 @@ void smbios_get_tables(MachineState *ms,
-     if (!smbios_check_type4_count(ms->smp.sockets, errp)) {
-         goto err_exit;
-     }
--    if (!smbios_validate_table(errp)) {
-+    if (!smbios_validate_table(ep_type, errp)) {
-         goto err_exit;
-     }
--    smbios_entry_point_setup();
-+    smbios_entry_point_setup(ep_type);
- 
-     /* return tables blob and entry point (anchor), and their sizes */
-     *tables = smbios_tables;
-diff --git a/hw/smbios/smbios_legacy.c b/hw/smbios/smbios_legacy.c
-index a6544bf55a..06907cd16c 100644
---- a/hw/smbios/smbios_legacy.c
-+++ b/hw/smbios/smbios_legacy.c
-@@ -173,7 +173,7 @@ uint8_t *smbios_get_table_legacy(size_t *length, Error **errp)
- 
-     smbios_build_type_0_fields();
-     smbios_build_type_1_fields();
--    if (!smbios_validate_table(errp)) {
-+    if (!smbios_validate_table(SMBIOS_ENTRY_POINT_TYPE_32, errp)) {
-         goto err_exit;
-     }
- 
-diff --git a/include/hw/firmware/smbios.h b/include/hw/firmware/smbios.h
-index 44af3a0d82..781298f594 100644
---- a/include/hw/firmware/smbios.h
-+++ b/include/hw/firmware/smbios.h
-@@ -326,18 +326,18 @@ struct smbios_type_127 {
-     struct smbios_structure_header header;
- } QEMU_PACKED;
- 
--bool smbios_validate_table(Error **errp);
-+bool smbios_validate_table(SmbiosEntryPointType ep_type, Error **errp);
- void smbios_add_usr_blob_size(size_t size);
- void smbios_entry_add(QemuOpts *opts, Error **errp);
- void smbios_set_cpuid(uint32_t version, uint32_t features);
- void smbios_set_defaults(const char *manufacturer, const char *product,
-                          const char *version,
-                          bool uuid_encoded,
--                         SmbiosEntryPointType ep_type,
-                          const char *stream_product,
-                          const char *stream_version);
- uint8_t *smbios_get_table_legacy(size_t *length, Error **errp);
- void smbios_get_tables(MachineState *ms,
-+                       SmbiosEntryPointType ep_type,
-                        const struct smbios_phys_mem_area *mem_array,
-                        const unsigned int mem_array_size,
-                        uint8_t **tables, size_t *tables_len,
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-smbios-get-rid-of-smbios_legacy-global.patch b/SOURCES/kvm-smbios-get-rid-of-smbios_legacy-global.patch
deleted file mode 100644
index ecb730e..0000000
--- a/SOURCES/kvm-smbios-get-rid-of-smbios_legacy-global.patch
+++ /dev/null
@@ -1,198 +0,0 @@
-From 0802fa7199c8085d018fc38dd4beaa5062d383d1 Mon Sep 17 00:00:00 2001
-From: Igor Mammedov <imammedo@redhat.com>
-Date: Fri, 29 Dec 2023 15:37:29 +0100
-Subject: [PATCH 08/20] smbios: get rid of smbios_legacy global
-
-RH-Author: Igor Mammedov <imammedo@redhat.com>
-RH-MergeRequest: 230: Workaround Windows failing to find 64bit SMBIOS entry point with SeaBIOS
-RH-Jira: RHEL-21705
-RH-Acked-by: MST <mst@redhat.com>
-RH-Acked-by: Ani Sinha <None>
-RH-Commit: [6/18] 684dd1dca8d611c6de97b26ef8c1cda6ca509d54
-
-JIRA: https://issues.redhat.com/browse/RHEL-21705
-
-    clean up smbios_set_defaults() which is reused by legacy
-    and non legacy machines from being aware of 'legacy' notion
-    and need to turn it off. And push legacy handling up to
-    PC machine code where it's relevant.
-
-    Signed-off-by: Igor Mammedov <imammedo@redhat.com>
-    Reviewed-by: Ani Sinha <anisinha@redhat.com>
-    Acked-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
-    Tested-by: Fiona Ebner <f.ebner@proxmox.com>
-
-Conflicts: hw/arm/virt.c, hw/i386/fw_cfg.c, hw/loongarch/virt.c,
-           hw/smbios/smbios.c, include/hw/firmware/smbios.h
-    due to downstream specifc signature of smbios_set_defaults()
-PS:
-  while fixing conflicts move RHEL specific
-       smbios_stream_product/smbios_stream_version
-  at the end of arguments list
-
-Signed-off-by: Igor Mammedov <imammedo@redhat.com>
----
- hw/arm/virt.c                |  5 +++--
- hw/i386/fw_cfg.c             | 11 +++++-----
- hw/loongarch/virt.c          |  2 +-
- hw/smbios/smbios.c           | 39 ++++++++++++++++--------------------
- include/hw/firmware/smbios.h |  6 +++---
- 5 files changed, 30 insertions(+), 33 deletions(-)
-
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index 943c563391..e5cfc19c08 100644
---- a/hw/arm/virt.c
-+++ b/hw/arm/virt.c
-@@ -1694,8 +1694,9 @@ static void virt_build_smbios(VirtMachineState *vms)
-     }
- 
-     smbios_set_defaults("QEMU", product,
--                        vmc->smbios_old_sys_ver ? "1.0" : mc->name, false,
--                        true, NULL, NULL, SMBIOS_ENTRY_POINT_TYPE_64);
-+                        vmc->smbios_old_sys_ver ? "1.0" : mc->name,
-+                        true, SMBIOS_ENTRY_POINT_TYPE_64,
-+                        NULL, NULL);
- 
-     /* build the array of physical mem area from base_memmap */
-     mem_array.address = vms->memmap[VIRT_MEM].base;
-diff --git a/hw/i386/fw_cfg.c b/hw/i386/fw_cfg.c
-index 79ff7f7225..bb7149c4c3 100644
---- a/hw/i386/fw_cfg.c
-+++ b/hw/i386/fw_cfg.c
-@@ -63,17 +63,18 @@ void fw_cfg_build_smbios(PCMachineState *pcms, FWCfgState *fw_cfg)
-     if (pcmc->smbios_defaults) {
-         /* These values are guest ABI, do not change */
-         smbios_set_defaults("QEMU", mc->desc, mc->name,
--                            pcmc->smbios_legacy_mode, pcmc->smbios_uuid_encoded,
-+                            pcmc->smbios_uuid_encoded,
-+                            pcms->smbios_entry_point_type,
-                             pcmc->smbios_stream_product,
--                            pcmc->smbios_stream_version,
--                            pcms->smbios_entry_point_type);
-+                            pcmc->smbios_stream_version);
-     }
- 
-     /* tell smbios about cpuid version and features */
-     smbios_set_cpuid(cpu->env.cpuid_version, cpu->env.features[FEAT_1_EDX]);
- 
--    smbios_tables = smbios_get_table_legacy(ms->smp.cpus, &smbios_tables_len);
--    if (smbios_tables) {
-+    if (pcmc->smbios_legacy_mode) {
-+        smbios_tables = smbios_get_table_legacy(ms->smp.cpus,
-+                                                &smbios_tables_len);
-         fw_cfg_add_bytes(fw_cfg, FW_CFG_SMBIOS_ENTRIES,
-                          smbios_tables, smbios_tables_len);
-         return;
-diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
-index 4b7dc67a2d..7358a023d3 100644
---- a/hw/loongarch/virt.c
-+++ b/hw/loongarch/virt.c
-@@ -320,7 +320,7 @@ static void virt_build_smbios(LoongArchMachineState *lams)
-         return;
-     }
- 
--    smbios_set_defaults("QEMU", product, mc->name, false,
-+    smbios_set_defaults("QEMU", product, mc->name,
-                         true, SMBIOS_ENTRY_POINT_TYPE_64);
- 
-     smbios_get_tables(ms, NULL, 0, &smbios_tables, &smbios_tables_len,
-diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c
-index 8129d396d1..0c8c439859 100644
---- a/hw/smbios/smbios.c
-+++ b/hw/smbios/smbios.c
-@@ -54,7 +54,6 @@ struct smbios_table {
- 
- static uint8_t *smbios_entries;
- static size_t smbios_entries_len;
--static bool smbios_legacy = true;
- static bool smbios_uuid_encoded = true;
- /* end: legacy structures & constants for <= 2.0 machines */
- 
-@@ -618,9 +617,16 @@ static void smbios_build_type_1_fields(void)
- 
- uint8_t *smbios_get_table_legacy(uint32_t expected_t4_count, size_t *length)
- {
--    if (!smbios_legacy) {
--        *length = 0;
--        return NULL;
-+    /* drop unwanted version of command-line file blob(s) */
-+    g_free(smbios_tables);
-+    smbios_tables = NULL;
-+
-+    /* also complain if fields were given for types > 1 */
-+    if (find_next_bit(have_fields_bitmap,
-+                      SMBIOS_MAX_TYPE + 1, 2) < SMBIOS_MAX_TYPE + 1) {
-+        error_report("can't process fields for smbios "
-+                     "types > 1 on machine versions < 2.1!");
-+        exit(1);
-     }
- 
-     if (!smbios_immutable) {
-@@ -1107,31 +1113,16 @@ void smbios_set_cpuid(uint32_t version, uint32_t features)
-     }
- 
- void smbios_set_defaults(const char *manufacturer, const char *product,
--                         const char *version, bool legacy_mode,
-+                         const char *version,
-                          bool uuid_encoded,
-+                         SmbiosEntryPointType ep_type,
-                          const char *stream_product,
--                         const char *stream_version,
--                         SmbiosEntryPointType ep_type)
-+                         const char *stream_version)
- {
-     smbios_have_defaults = true;
--    smbios_legacy = legacy_mode;
-     smbios_uuid_encoded = uuid_encoded;
-     smbios_ep_type = ep_type;
- 
--    /* drop unwanted version of command-line file blob(s) */
--    if (smbios_legacy) {
--        g_free(smbios_tables);
--        /* in legacy mode, also complain if fields were given for types > 1 */
--        if (find_next_bit(have_fields_bitmap,
--                          SMBIOS_MAX_TYPE+1, 2) < SMBIOS_MAX_TYPE+1) {
--            error_report("can't process fields for smbios "
--                         "types > 1 on machine versions < 2.1!");
--            exit(1);
--        }
--    } else {
--        g_free(smbios_entries);
--    }
--
-     /*
-      * If @stream_product & @stream_version are non-NULL, then
-      * we're following rules for new Windows driver support.
-@@ -1241,6 +1232,10 @@ void smbios_get_tables(MachineState *ms,
- {
-     unsigned i, dimm_cnt, offset;
- 
-+    /* drop unwanted (legacy) version of command-line file blob(s) */
-+    g_free(smbios_entries);
-+    smbios_entries = NULL;
-+
-     if (!smbios_immutable) {
-         smbios_build_type_0_table();
-         smbios_build_type_1_table();
-diff --git a/include/hw/firmware/smbios.h b/include/hw/firmware/smbios.h
-index 95ec64ce2c..b9fc9a0f42 100644
---- a/include/hw/firmware/smbios.h
-+++ b/include/hw/firmware/smbios.h
-@@ -310,11 +310,11 @@ struct smbios_type_127 {
- void smbios_entry_add(QemuOpts *opts, Error **errp);
- void smbios_set_cpuid(uint32_t version, uint32_t features);
- void smbios_set_defaults(const char *manufacturer, const char *product,
--                         const char *version, bool legacy_mode,
-+                         const char *version,
-                          bool uuid_encoded,
-+                         SmbiosEntryPointType ep_type,
-                          const char *stream_product,
--                         const char *stream_version,
--                         SmbiosEntryPointType ep_type);
-+                         const char *stream_version);
- uint8_t *smbios_get_table_legacy(uint32_t expected_t4_count, size_t *length);
- void smbios_get_tables(MachineState *ms,
-                        const struct smbios_phys_mem_area *mem_array,
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-smbios-get-rid-of-smbios_smp_sockets-global.patch b/SOURCES/kvm-smbios-get-rid-of-smbios_smp_sockets-global.patch
deleted file mode 100644
index fde17ac..0000000
--- a/SOURCES/kvm-smbios-get-rid-of-smbios_smp_sockets-global.patch
+++ /dev/null
@@ -1,134 +0,0 @@
-From 1536f1ec00ddc1729854b381cc0d54814bb6c19f Mon Sep 17 00:00:00 2001
-From: Igor Mammedov <imammedo@redhat.com>
-Date: Fri, 29 Dec 2023 15:04:55 +0100
-Subject: [PATCH 07/20] smbios: get rid of smbios_smp_sockets global
-
-RH-Author: Igor Mammedov <imammedo@redhat.com>
-RH-MergeRequest: 230: Workaround Windows failing to find 64bit SMBIOS entry point with SeaBIOS
-RH-Jira: RHEL-21705
-RH-Acked-by: MST <mst@redhat.com>
-RH-Acked-by: Ani Sinha <None>
-RH-Commit: [5/18] f59bfeb547b7febcf1de2b6179af006e7fa0bccd
-
-JIRA: https://issues.redhat.com/browse/RHEL-21705
-
-    it makes smbios_validate_table() independent from
-    smbios_smp_sockets global, which in turn lets
-    smbios_get_tables() avoid using not related legacy code.
-
-    Signed-off-by: Igor Mammedov <imammedo@redhat.com>
-    Reviewed-by: Ani Sinha <anisinha@redhat.com>
-    Tested-by: Fiona Ebner <f.ebner@proxmox.com>
-
-Conflicts:
-   include/hw/firmware/smbios.h due to down-stream
-   (d9ff466c980d Machine type related general changes)
-    adding custom stream_product/stream_version
-
-Signed-off-by: Igor Mammedov <imammedo@redhat.com>
----
- hw/i386/fw_cfg.c             |  2 +-
- hw/smbios/smbios.c           | 22 +++++++++-------------
- include/hw/firmware/smbios.h |  2 +-
- 3 files changed, 11 insertions(+), 15 deletions(-)
-
-diff --git a/hw/i386/fw_cfg.c b/hw/i386/fw_cfg.c
-index ed72b1442d..79ff7f7225 100644
---- a/hw/i386/fw_cfg.c
-+++ b/hw/i386/fw_cfg.c
-@@ -72,7 +72,7 @@ void fw_cfg_build_smbios(PCMachineState *pcms, FWCfgState *fw_cfg)
-     /* tell smbios about cpuid version and features */
-     smbios_set_cpuid(cpu->env.cpuid_version, cpu->env.features[FEAT_1_EDX]);
- 
--    smbios_tables = smbios_get_table_legacy(ms, &smbios_tables_len);
-+    smbios_tables = smbios_get_table_legacy(ms->smp.cpus, &smbios_tables_len);
-     if (smbios_tables) {
-         fw_cfg_add_bytes(fw_cfg, FW_CFG_SMBIOS_ENTRIES,
-                          smbios_tables, smbios_tables_len);
-diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c
-index b13e40bae2..8129d396d1 100644
---- a/hw/smbios/smbios.c
-+++ b/hw/smbios/smbios.c
-@@ -73,7 +73,7 @@ static SmbiosEntryPoint ep;
- static int smbios_type4_count = 0;
- static bool smbios_immutable;
- static bool smbios_have_defaults;
--static uint32_t smbios_cpuid_version, smbios_cpuid_features, smbios_smp_sockets;
-+static uint32_t smbios_cpuid_version, smbios_cpuid_features;
- 
- static DECLARE_BITMAP(have_binfile_bitmap, SMBIOS_MAX_TYPE+1);
- static DECLARE_BITMAP(have_fields_bitmap, SMBIOS_MAX_TYPE+1);
-@@ -524,14 +524,11 @@ opts_init(smbios_register_config);
-  */
- #define SMBIOS_21_MAX_TABLES_LEN 0xffff
- 
--static void smbios_validate_table(MachineState *ms)
-+static void smbios_validate_table(uint32_t expected_t4_count)
- {
--    uint32_t expect_t4_count = smbios_legacy ?
--                                        ms->smp.cpus : smbios_smp_sockets;
--
--    if (smbios_type4_count && smbios_type4_count != expect_t4_count) {
-+    if (smbios_type4_count && smbios_type4_count != expected_t4_count) {
-         error_report("Expected %d SMBIOS Type 4 tables, got %d instead",
--                     expect_t4_count, smbios_type4_count);
-+                     expected_t4_count, smbios_type4_count);
-         exit(1);
-     }
- 
-@@ -619,7 +616,7 @@ static void smbios_build_type_1_fields(void)
-     }
- }
- 
--uint8_t *smbios_get_table_legacy(MachineState *ms, size_t *length)
-+uint8_t *smbios_get_table_legacy(uint32_t expected_t4_count, size_t *length)
- {
-     if (!smbios_legacy) {
-         *length = 0;
-@@ -629,7 +626,7 @@ uint8_t *smbios_get_table_legacy(MachineState *ms, size_t *length)
-     if (!smbios_immutable) {
-         smbios_build_type_0_fields();
-         smbios_build_type_1_fields();
--        smbios_validate_table(ms);
-+        smbios_validate_table(expected_t4_count);
-         smbios_immutable = true;
-     }
-     *length = smbios_entries_len;
-@@ -1250,10 +1247,9 @@ void smbios_get_tables(MachineState *ms,
-         smbios_build_type_2_table();
-         smbios_build_type_3_table();
- 
--        smbios_smp_sockets = ms->smp.sockets;
--        assert(smbios_smp_sockets >= 1);
-+        assert(ms->smp.sockets >= 1);
- 
--        for (i = 0; i < smbios_smp_sockets; i++) {
-+        for (i = 0; i < ms->smp.sockets; i++) {
-             smbios_build_type_4_table(ms, i);
-         }
- 
-@@ -1299,7 +1295,7 @@ void smbios_get_tables(MachineState *ms,
-         smbios_build_type_41_table(errp);
-         smbios_build_type_127_table();
- 
--        smbios_validate_table(ms);
-+        smbios_validate_table(ms->smp.sockets);
-         smbios_entry_point_setup();
-         smbios_immutable = true;
-     }
-diff --git a/include/hw/firmware/smbios.h b/include/hw/firmware/smbios.h
-index f8dd07fe4c..95ec64ce2c 100644
---- a/include/hw/firmware/smbios.h
-+++ b/include/hw/firmware/smbios.h
-@@ -315,7 +315,7 @@ void smbios_set_defaults(const char *manufacturer, const char *product,
-                          const char *stream_product,
-                          const char *stream_version,
-                          SmbiosEntryPointType ep_type);
--uint8_t *smbios_get_table_legacy(MachineState *ms, size_t *length);
-+uint8_t *smbios_get_table_legacy(uint32_t expected_t4_count, size_t *length);
- void smbios_get_tables(MachineState *ms,
-                        const struct smbios_phys_mem_area *mem_array,
-                        const unsigned int mem_array_size,
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-smbios-handle-errors-consistently.patch b/SOURCES/kvm-smbios-handle-errors-consistently.patch
deleted file mode 100644
index ac75c76..0000000
--- a/SOURCES/kvm-smbios-handle-errors-consistently.patch
+++ /dev/null
@@ -1,217 +0,0 @@
-From 7271c4424c6d90f0bb34f8090eb4e192eb2b2537 Mon Sep 17 00:00:00 2001
-From: Igor Mammedov <imammedo@redhat.com>
-Date: Tue, 20 Feb 2024 10:30:28 +0100
-Subject: [PATCH 14/20] smbios: handle errors consistently
-
-RH-Author: Igor Mammedov <imammedo@redhat.com>
-RH-MergeRequest: 230: Workaround Windows failing to find 64bit SMBIOS entry point with SeaBIOS
-RH-Jira: RHEL-21705
-RH-Acked-by: MST <mst@redhat.com>
-RH-Acked-by: Ani Sinha <None>
-RH-Commit: [12/18] d8a5a70602ae0665ce35e5bf87b2d8420f9189bc
-
-JIRA: https://issues.redhat.com/browse/RHEL-21705
-
-    Current code uses mix of error_report()+exit(1)
-    and error_setg() to handle errors.
-    Use newer error_setg() everywhere, beside consistency
-    it will allow to detect error condition without killing
-    QEMU and attempt switch-over to SMBIOS3.x tables/entrypoint
-    in follow up patch.
-
-    while at it, clear smbios_tables pointer after freeing.
-    that will avoid double free if smbios_get_tables() is called
-    multiple times.
-
-    Signed-off-by: Igor Mammedov <imammedo@redhat.com>
-    Reviewed-by: Ani Sinha <anisinha@redhat.com>
-
-Conflicts: include/hw/firmware/smbios.h
-            due to downstream specific smbios_set_defaults()
-
-Signed-off-by: Igor Mammedov <imammedo@redhat.com>
----
- hw/i386/fw_cfg.c             |  3 ++-
- hw/smbios/smbios.c           | 34 ++++++++++++++++++++++------------
- hw/smbios/smbios_legacy.c    | 22 ++++++++++++++--------
- include/hw/firmware/smbios.h |  4 ++--
- 4 files changed, 40 insertions(+), 23 deletions(-)
-
-diff --git a/hw/i386/fw_cfg.c b/hw/i386/fw_cfg.c
-index a25793a68f..bdc3cc4556 100644
---- a/hw/i386/fw_cfg.c
-+++ b/hw/i386/fw_cfg.c
-@@ -73,7 +73,8 @@ void fw_cfg_build_smbios(PCMachineState *pcms, FWCfgState *fw_cfg)
-     smbios_set_cpuid(cpu->env.cpuid_version, cpu->env.features[FEAT_1_EDX]);
- 
-     if (pcmc->smbios_legacy_mode) {
--        smbios_tables = smbios_get_table_legacy(&smbios_tables_len);
-+        smbios_tables = smbios_get_table_legacy(&smbios_tables_len,
-+                                                &error_fatal);
-         fw_cfg_add_bytes(fw_cfg, FW_CFG_SMBIOS_ENTRIES,
-                          smbios_tables, smbios_tables_len);
-         return;
-diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c
-index e40204550e..b5745c6c2d 100644
---- a/hw/smbios/smbios.c
-+++ b/hw/smbios/smbios.c
-@@ -19,7 +19,6 @@
- #include "qemu/units.h"
- #include "qapi/error.h"
- #include "qemu/config-file.h"
--#include "qemu/error-report.h"
- #include "qemu/module.h"
- #include "qemu/option.h"
- #include "sysemu/sysemu.h"
-@@ -497,23 +496,25 @@ opts_init(smbios_register_config);
-  */
- #define SMBIOS_21_MAX_TABLES_LEN 0xffff
- 
--static void smbios_check_type4_count(uint32_t expected_t4_count)
-+static bool smbios_check_type4_count(uint32_t expected_t4_count, Error **errp)
- {
-     if (smbios_type4_count && smbios_type4_count != expected_t4_count) {
--        error_report("Expected %d SMBIOS Type 4 tables, got %d instead",
--                     expected_t4_count, smbios_type4_count);
--        exit(1);
-+        error_setg(errp, "Expected %d SMBIOS Type 4 tables, got %d instead",
-+                   expected_t4_count, smbios_type4_count);
-+        return false;
-     }
-+    return true;
- }
- 
--void smbios_validate_table(void)
-+bool smbios_validate_table(Error **errp)
- {
-     if (smbios_ep_type == SMBIOS_ENTRY_POINT_TYPE_32 &&
-         smbios_tables_len > SMBIOS_21_MAX_TABLES_LEN) {
--        error_report("SMBIOS 2.1 table length %zu exceeds %d",
--                     smbios_tables_len, SMBIOS_21_MAX_TABLES_LEN);
--        exit(1);
-+        error_setg(errp, "SMBIOS 2.1 table length %zu exceeds %d",
-+                   smbios_tables_len, SMBIOS_21_MAX_TABLES_LEN);
-+        return false;
-     }
-+    return true;
- }
- 
- bool smbios_skip_table(uint8_t type, bool required_table)
-@@ -1167,15 +1168,18 @@ void smbios_get_tables(MachineState *ms,
-     smbios_build_type_41_table(errp);
-     smbios_build_type_127_table();
- 
--    smbios_check_type4_count(ms->smp.sockets);
--    smbios_validate_table();
-+    if (!smbios_check_type4_count(ms->smp.sockets, errp)) {
-+        goto err_exit;
-+    }
-+    if (!smbios_validate_table(errp)) {
-+        goto err_exit;
-+    }
-     smbios_entry_point_setup();
- 
-     /* return tables blob and entry point (anchor), and their sizes */
-     *tables = smbios_tables;
-     *tables_len = smbios_tables_len;
-     *anchor = (uint8_t *)&ep;
--
-     /* calculate length based on anchor string */
-     if (!strncmp((char *)&ep, "_SM_", 4)) {
-         *anchor_len = sizeof(struct smbios_21_entry_point);
-@@ -1184,6 +1188,12 @@ void smbios_get_tables(MachineState *ms,
-     } else {
-         abort();
-     }
-+
-+    return;
-+err_exit:
-+    g_free(smbios_tables);
-+    smbios_tables = NULL;
-+    return;
- }
- 
- static void save_opt(const char **dest, QemuOpts *opts, const char *name)
-diff --git a/hw/smbios/smbios_legacy.c b/hw/smbios/smbios_legacy.c
-index 21f143e738..a6544bf55a 100644
---- a/hw/smbios/smbios_legacy.c
-+++ b/hw/smbios/smbios_legacy.c
-@@ -19,7 +19,7 @@
- #include "qemu/bswap.h"
- #include "hw/firmware/smbios.h"
- #include "sysemu/sysemu.h"
--#include "qemu/error-report.h"
-+#include "qapi/error.h"
- 
- struct smbios_header {
-     uint16_t length;
-@@ -128,7 +128,7 @@ static void smbios_build_type_1_fields(void)
-     }
- }
- 
--uint8_t *smbios_get_table_legacy(size_t *length)
-+uint8_t *smbios_get_table_legacy(size_t *length, Error **errp)
- {
-     int i;
-     size_t usr_offset;
-@@ -136,15 +136,15 @@ uint8_t *smbios_get_table_legacy(size_t *length)
-     /* complain if fields were given for types > 1 */
-     if (find_next_bit(smbios_have_fields_bitmap,
-                       SMBIOS_MAX_TYPE + 1, 2) < SMBIOS_MAX_TYPE + 1) {
--        error_report("can't process fields for smbios "
-+        error_setg(errp, "can't process fields for smbios "
-                      "types > 1 on machine versions < 2.1!");
--        exit(1);
-+        goto err_exit;
-     }
- 
-     if (test_bit(4, smbios_have_binfile_bitmap)) {
--        error_report("can't process table for smbios "
--                     "type 4 on machine versions < 2.1!");
--        exit(1);
-+        error_setg(errp, "can't process table for smbios "
-+                   "type 4 on machine versions < 2.1!");
-+        goto err_exit;
-     }
- 
-     g_free(smbios_entries);
-@@ -173,7 +173,13 @@ uint8_t *smbios_get_table_legacy(size_t *length)
- 
-     smbios_build_type_0_fields();
-     smbios_build_type_1_fields();
--    smbios_validate_table();
-+    if (!smbios_validate_table(errp)) {
-+        goto err_exit;
-+    }
-+
-     *length = smbios_entries_len;
-     return smbios_entries;
-+err_exit:
-+    g_free(smbios_entries);
-+    return NULL;
- }
-diff --git a/include/hw/firmware/smbios.h b/include/hw/firmware/smbios.h
-index 92e9aba415..44af3a0d82 100644
---- a/include/hw/firmware/smbios.h
-+++ b/include/hw/firmware/smbios.h
-@@ -326,7 +326,7 @@ struct smbios_type_127 {
-     struct smbios_structure_header header;
- } QEMU_PACKED;
- 
--void smbios_validate_table(void);
-+bool smbios_validate_table(Error **errp);
- void smbios_add_usr_blob_size(size_t size);
- void smbios_entry_add(QemuOpts *opts, Error **errp);
- void smbios_set_cpuid(uint32_t version, uint32_t features);
-@@ -336,7 +336,7 @@ void smbios_set_defaults(const char *manufacturer, const char *product,
-                          SmbiosEntryPointType ep_type,
-                          const char *stream_product,
-                          const char *stream_version);
--uint8_t *smbios_get_table_legacy(size_t *length);
-+uint8_t *smbios_get_table_legacy(size_t *length, Error **errp);
- void smbios_get_tables(MachineState *ms,
-                        const struct smbios_phys_mem_area *mem_array,
-                        const unsigned int mem_array_size,
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-smbios-in-case-of-entry-point-is-auto-try-to-build-v.patch b/SOURCES/kvm-smbios-in-case-of-entry-point-is-auto-try-to-build-v.patch
deleted file mode 100644
index fd1bc19..0000000
--- a/SOURCES/kvm-smbios-in-case-of-entry-point-is-auto-try-to-build-v.patch
+++ /dev/null
@@ -1,131 +0,0 @@
-From 38220bc61bdb1614f34a53481f7604720c9e9e5a Mon Sep 17 00:00:00 2001
-From: Igor Mammedov <imammedo@redhat.com>
-Date: Tue, 20 Feb 2024 10:41:06 +0100
-Subject: [PATCH 18/20] smbios: in case of entry point is 'auto' try to build
- v2 tables 1st
-
-RH-Author: Igor Mammedov <imammedo@redhat.com>
-RH-MergeRequest: 230: Workaround Windows failing to find 64bit SMBIOS entry point with SeaBIOS
-RH-Jira: RHEL-21705
-RH-Acked-by: MST <mst@redhat.com>
-RH-Acked-by: Ani Sinha <None>
-RH-Commit: [16/18] becbcb3d8dad4842e5939bb75e21f4e737a4a325
-
-JIRA: https://issues.redhat.com/browse/RHEL-21705
-
-QEMU for some time now uses SMBIOS 3.0 for PC/Q35 machines by
-default, however Windows has a bug in locating SMBIOS 3.0
-entrypoint and fails to find tables when booted on SeaBIOS
-(on UEFI SMBIOS 3.0 tables work fine since firmware hands
-over tables in another way)
-
-Missing SMBIOS tables may lead to some issues for guest
-though (worst are: possible reactiveation, inability to
-get virtio drivers from 'Windows Update')
-
-It's unclear  at this point if MS will fix the issue on their
-side. So instead of it (or rather in addition) this patch
-will try to workaround the issue.
-
-aka, use smbios-entry-point-type=auto to make QEMU try
-generating conservative SMBIOS 2.0 tables and if that
-fails (due to limits/requested configuration) fallback
-to SMBIOS 3.0 tables.
-
-With this in place majority of users will use SMBIOS 2.0
-tables which work fine with (Windows + legacy BIOS).
-The configurations that is not to possible to describe
-with SMBIOS 2.0 will switch automatically to SMBIOS 3.0
-(which will trigger Windows bug but there is nothing
-QEMU can do here, so go and aks Microsoft to real fix).
-
-Signed-off-by: Igor Mammedov <imammedo@redhat.com>
-Reviewed-by: Ani Sinha <anisinha@redhat.com>
-Tested-by: Fiona Ebner <f.ebner@proxmox.com>
----
- hw/smbios/smbios.c | 52 +++++++++++++++++++++++++++++++++++++++++++---
- 1 file changed, 49 insertions(+), 3 deletions(-)
-
-diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c
-index 4521ea386c..3d9dcb0d31 100644
---- a/hw/smbios/smbios.c
-+++ b/hw/smbios/smbios.c
-@@ -1097,7 +1097,7 @@ static void smbios_entry_point_setup(SmbiosEntryPointType ep_type)
-     }
- }
- 
--void smbios_get_tables(MachineState *ms,
-+static bool smbios_get_tables_ep(MachineState *ms,
-                        SmbiosEntryPointType ep_type,
-                        const struct smbios_phys_mem_area *mem_array,
-                        const unsigned int mem_array_size,
-@@ -1106,6 +1106,7 @@ void smbios_get_tables(MachineState *ms,
-                        Error **errp)
- {
-     unsigned i, dimm_cnt, offset;
-+    ERRP_GUARD();
- 
-     assert(ep_type == SMBIOS_ENTRY_POINT_TYPE_32 ||
-            ep_type == SMBIOS_ENTRY_POINT_TYPE_64);
-@@ -1192,11 +1193,56 @@ void smbios_get_tables(MachineState *ms,
-         abort();
-     }
- 
--    return;
-+    return true;
- err_exit:
-     g_free(smbios_tables);
-     smbios_tables = NULL;
--    return;
-+    return false;
-+}
-+
-+void smbios_get_tables(MachineState *ms,
-+                       SmbiosEntryPointType ep_type,
-+                       const struct smbios_phys_mem_area *mem_array,
-+                       const unsigned int mem_array_size,
-+                       uint8_t **tables, size_t *tables_len,
-+                       uint8_t **anchor, size_t *anchor_len,
-+                       Error **errp)
-+{
-+    Error *local_err = NULL;
-+    bool is_valid;
-+    ERRP_GUARD();
-+
-+    switch (ep_type) {
-+    case SMBIOS_ENTRY_POINT_TYPE_AUTO:
-+    case SMBIOS_ENTRY_POINT_TYPE_32:
-+        is_valid = smbios_get_tables_ep(ms, SMBIOS_ENTRY_POINT_TYPE_32,
-+                                        mem_array, mem_array_size,
-+                                        tables, tables_len,
-+                                        anchor, anchor_len,
-+                                        &local_err);
-+        if (is_valid || ep_type != SMBIOS_ENTRY_POINT_TYPE_AUTO) {
-+            break;
-+        }
-+        /*
-+         * fall through in case AUTO endpoint is selected and
-+         * SMBIOS 2.x tables can't be generated, to try if SMBIOS 3.x
-+         * tables would work
-+         */
-+    case SMBIOS_ENTRY_POINT_TYPE_64:
-+        error_free(local_err);
-+        local_err = NULL;
-+        is_valid = smbios_get_tables_ep(ms, SMBIOS_ENTRY_POINT_TYPE_64,
-+                                        mem_array, mem_array_size,
-+                                        tables, tables_len,
-+                                        anchor, anchor_len,
-+                                        &local_err);
-+        break;
-+    default:
-+        abort();
-+    }
-+    if (!is_valid) {
-+        error_propagate(errp, local_err);
-+    }
- }
- 
- static void save_opt(const char **dest, QemuOpts *opts, const char *name)
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-smbios-rename-expose-structures-bitmaps-used-by-both.patch b/SOURCES/kvm-smbios-rename-expose-structures-bitmaps-used-by-both.patch
deleted file mode 100644
index cba6134..0000000
--- a/SOURCES/kvm-smbios-rename-expose-structures-bitmaps-used-by-both.patch
+++ /dev/null
@@ -1,330 +0,0 @@
-From 36b0256e27f9d5268c5413891b4a7322819ae9db Mon Sep 17 00:00:00 2001
-From: Igor Mammedov <imammedo@redhat.com>
-Date: Mon, 4 Mar 2024 15:56:19 +0100
-Subject: [PATCH 12/20] smbios: rename/expose structures/bitmaps used by both
- legacy and modern code
-
-RH-Author: Igor Mammedov <imammedo@redhat.com>
-RH-MergeRequest: 230: Workaround Windows failing to find 64bit SMBIOS entry point with SeaBIOS
-RH-Jira: RHEL-21705
-RH-Acked-by: MST <mst@redhat.com>
-RH-Acked-by: Ani Sinha <None>
-RH-Commit: [10/18] 59fe438d5b7f6e584a6bb02597e4d4724fe2cece
-
-JIRA: https://issues.redhat.com/browse/RHEL-21705
-
-    As a preparation to move legacy handling into a separate file,
-    add prefix 'smbios_' to type0/type1/have_binfile_bitmap/have_fields_bitmap
-    and expose them in smbios.h so that they can be reused in
-    legacy and modern code.
-
-    Doing it as a separate patch to avoid rename cluttering follow-up
-    patch which will move legacy code into a separate file.
-
-    Signed-off-by: Igor Mammedov <imammedo@redhat.com>
-    Reviewed-by: Ani Sinha <anisinha@redhat.com>
-
-Conflicts: hw/smbios/smbios.c
-    due to setting downstream type1.family/type1.sku defaults
-
-Signed-off-by: Igor Mammedov <imammedo@redhat.com>
----
- hw/smbios/smbios.c           | 117 ++++++++++++++++-------------------
- include/hw/firmware/smbios.h |  16 +++++
- 2 files changed, 71 insertions(+), 62 deletions(-)
-
-diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c
-index c48a290478..eb9927335d 100644
---- a/hw/smbios/smbios.c
-+++ b/hw/smbios/smbios.c
-@@ -81,19 +81,11 @@ static int smbios_type4_count = 0;
- static bool smbios_have_defaults;
- static uint32_t smbios_cpuid_version, smbios_cpuid_features;
- 
--static DECLARE_BITMAP(have_binfile_bitmap, SMBIOS_MAX_TYPE+1);
--static DECLARE_BITMAP(have_fields_bitmap, SMBIOS_MAX_TYPE+1);
-+DECLARE_BITMAP(smbios_have_binfile_bitmap, SMBIOS_MAX_TYPE + 1);
-+DECLARE_BITMAP(smbios_have_fields_bitmap, SMBIOS_MAX_TYPE + 1);
- 
--static struct {
--    const char *vendor, *version, *date;
--    bool have_major_minor, uefi;
--    uint8_t major, minor;
--} type0;
--
--static struct {
--    const char *manufacturer, *product, *version, *serial, *sku, *family;
--    /* uuid is in qemu_uuid */
--} type1;
-+smbios_type0_t smbios_type0;
-+smbios_type1_t smbios_type1;
- 
- static struct {
-     const char *manufacturer, *product, *version, *serial, *asset, *location;
-@@ -584,36 +576,36 @@ static void smbios_maybe_add_str(int type, int offset, const char *data)
- static void smbios_build_type_0_fields(void)
- {
-     smbios_maybe_add_str(0, offsetof(struct smbios_type_0, vendor_str),
--                         type0.vendor);
-+                         smbios_type0.vendor);
-     smbios_maybe_add_str(0, offsetof(struct smbios_type_0, bios_version_str),
--                         type0.version);
-+                         smbios_type0.version);
-     smbios_maybe_add_str(0, offsetof(struct smbios_type_0,
-                                      bios_release_date_str),
--                         type0.date);
--    if (type0.have_major_minor) {
-+                         smbios_type0.date);
-+    if (smbios_type0.have_major_minor) {
-         smbios_add_field(0, offsetof(struct smbios_type_0,
-                                      system_bios_major_release),
--                         &type0.major, 1);
-+                         &smbios_type0.major, 1);
-         smbios_add_field(0, offsetof(struct smbios_type_0,
-                                      system_bios_minor_release),
--                         &type0.minor, 1);
-+                         &smbios_type0.minor, 1);
-     }
- }
- 
- static void smbios_build_type_1_fields(void)
- {
-     smbios_maybe_add_str(1, offsetof(struct smbios_type_1, manufacturer_str),
--                         type1.manufacturer);
-+                         smbios_type1.manufacturer);
-     smbios_maybe_add_str(1, offsetof(struct smbios_type_1, product_name_str),
--                         type1.product);
-+                         smbios_type1.product);
-     smbios_maybe_add_str(1, offsetof(struct smbios_type_1, version_str),
--                         type1.version);
-+                         smbios_type1.version);
-     smbios_maybe_add_str(1, offsetof(struct smbios_type_1, serial_number_str),
--                         type1.serial);
-+                         smbios_type1.serial);
-     smbios_maybe_add_str(1, offsetof(struct smbios_type_1, sku_number_str),
--                         type1.sku);
-+                         smbios_type1.sku);
-     smbios_maybe_add_str(1, offsetof(struct smbios_type_1, family_str),
--                         type1.family);
-+                         smbios_type1.family);
-     if (qemu_uuid_set) {
-         /* We don't encode the UUID in the "wire format" here because this
-          * function is for legacy mode and needs to keep the guest ABI, and
-@@ -631,14 +623,14 @@ uint8_t *smbios_get_table_legacy(size_t *length)
-     size_t usr_offset;
- 
-     /* also complain if fields were given for types > 1 */
--    if (find_next_bit(have_fields_bitmap,
-+    if (find_next_bit(smbios_have_fields_bitmap,
-                       SMBIOS_MAX_TYPE + 1, 2) < SMBIOS_MAX_TYPE + 1) {
-         error_report("can't process fields for smbios "
-                      "types > 1 on machine versions < 2.1!");
-         exit(1);
-     }
- 
--    if (test_bit(4, have_binfile_bitmap)) {
-+    if (test_bit(4, smbios_have_binfile_bitmap)) {
-         error_report("can't process table for smbios "
-                      "type 4 on machine versions < 2.1!");
-         exit(1);
-@@ -679,10 +671,10 @@ uint8_t *smbios_get_table_legacy(size_t *length)
- 
- bool smbios_skip_table(uint8_t type, bool required_table)
- {
--    if (test_bit(type, have_binfile_bitmap)) {
-+    if (test_bit(type, smbios_have_binfile_bitmap)) {
-         return true; /* user provided their own binary blob(s) */
-     }
--    if (test_bit(type, have_fields_bitmap)) {
-+    if (test_bit(type, smbios_have_fields_bitmap)) {
-         return false; /* user provided fields via command line */
-     }
-     if (smbios_have_defaults && required_table) {
-@@ -710,25 +702,25 @@ static void smbios_build_type_0_table(void)
- {
-     SMBIOS_BUILD_TABLE_PRE(0, T0_BASE, false); /* optional, leave up to BIOS */
- 
--    SMBIOS_TABLE_SET_STR(0, vendor_str, type0.vendor);
--    SMBIOS_TABLE_SET_STR(0, bios_version_str, type0.version);
-+    SMBIOS_TABLE_SET_STR(0, vendor_str, smbios_type0.vendor);
-+    SMBIOS_TABLE_SET_STR(0, bios_version_str, smbios_type0.version);
- 
-     t->bios_starting_address_segment = cpu_to_le16(0xE800); /* from SeaBIOS */
- 
--    SMBIOS_TABLE_SET_STR(0, bios_release_date_str, type0.date);
-+    SMBIOS_TABLE_SET_STR(0, bios_release_date_str, smbios_type0.date);
- 
-     t->bios_rom_size = 0; /* hardcoded in SeaBIOS with FIXME comment */
- 
-     t->bios_characteristics = cpu_to_le64(0x08); /* Not supported */
-     t->bios_characteristics_extension_bytes[0] = 0;
-     t->bios_characteristics_extension_bytes[1] = 0x14; /* TCD/SVVP | VM */
--    if (type0.uefi) {
-+    if (smbios_type0.uefi) {
-         t->bios_characteristics_extension_bytes[1] |= 0x08; /* |= UEFI */
-     }
- 
--    if (type0.have_major_minor) {
--        t->system_bios_major_release = type0.major;
--        t->system_bios_minor_release = type0.minor;
-+    if (smbios_type0.have_major_minor) {
-+        t->system_bios_major_release = smbios_type0.major;
-+        t->system_bios_minor_release = smbios_type0.minor;
-     } else {
-         t->system_bios_major_release = 0;
-         t->system_bios_minor_release = 0;
-@@ -758,18 +750,18 @@ static void smbios_build_type_1_table(void)
- {
-     SMBIOS_BUILD_TABLE_PRE(1, T1_BASE, true); /* required */
- 
--    SMBIOS_TABLE_SET_STR(1, manufacturer_str, type1.manufacturer);
--    SMBIOS_TABLE_SET_STR(1, product_name_str, type1.product);
--    SMBIOS_TABLE_SET_STR(1, version_str, type1.version);
--    SMBIOS_TABLE_SET_STR(1, serial_number_str, type1.serial);
-+    SMBIOS_TABLE_SET_STR(1, manufacturer_str, smbios_type1.manufacturer);
-+    SMBIOS_TABLE_SET_STR(1, product_name_str, smbios_type1.product);
-+    SMBIOS_TABLE_SET_STR(1, version_str, smbios_type1.version);
-+    SMBIOS_TABLE_SET_STR(1, serial_number_str, smbios_type1.serial);
-     if (qemu_uuid_set) {
-         smbios_encode_uuid(&t->uuid, &qemu_uuid);
-     } else {
-         memset(&t->uuid, 0, 16);
-     }
-     t->wake_up_type = 0x06; /* power switch */
--    SMBIOS_TABLE_SET_STR(1, sku_number_str, type1.sku);
--    SMBIOS_TABLE_SET_STR(1, family_str, type1.family);
-+    SMBIOS_TABLE_SET_STR(1, sku_number_str, smbios_type1.sku);
-+    SMBIOS_TABLE_SET_STR(1, family_str, smbios_type1.family);
- 
-     SMBIOS_BUILD_TABLE_POST;
- }
-@@ -1184,12 +1176,12 @@ void smbios_set_defaults(const char *manufacturer, const char *product,
-      *
-      * We get 'System Manufacturer' and 'Baseboard Manufacturer'
-      */
--    SMBIOS_SET_DEFAULT(type1.manufacturer, manufacturer);
--    SMBIOS_SET_DEFAULT(type1.product, product);
--    SMBIOS_SET_DEFAULT(type1.version, version);
--    SMBIOS_SET_DEFAULT(type1.family, "Red Hat Enterprise Linux");
-+    SMBIOS_SET_DEFAULT(smbios_type1.manufacturer, manufacturer);
-+    SMBIOS_SET_DEFAULT(smbios_type1.product, product);
-+    SMBIOS_SET_DEFAULT(smbios_type1.version, version);
-+    SMBIOS_SET_DEFAULT(smbios_type1.family, "Red Hat Enterprise Linux");
-     if (stream_version != NULL) {
--        SMBIOS_SET_DEFAULT(type1.sku, stream_version);
-+        SMBIOS_SET_DEFAULT(smbios_type1.sku, stream_version);
-     }
-     SMBIOS_SET_DEFAULT(type2.manufacturer, manufacturer);
-     if (stream_product != NULL) {
-@@ -1468,13 +1460,13 @@ void smbios_entry_add(QemuOpts *opts, Error **errp)
-         }
- 
-         if (header->type <= SMBIOS_MAX_TYPE) {
--            if (test_bit(header->type, have_fields_bitmap)) {
-+            if (test_bit(header->type, smbios_have_fields_bitmap)) {
-                 error_setg(errp,
-                            "can't load type %d struct, fields already specified!",
-                            header->type);
-                 return;
-             }
--            set_bit(header->type, have_binfile_bitmap);
-+            set_bit(header->type, smbios_have_binfile_bitmap);
-         }
- 
-         if (header->type == 4) {
-@@ -1505,41 +1497,42 @@ void smbios_entry_add(QemuOpts *opts, Error **errp)
-             return;
-         }
- 
--        if (test_bit(type, have_binfile_bitmap)) {
-+        if (test_bit(type, smbios_have_binfile_bitmap)) {
-             error_setg(errp, "can't add fields, binary file already loaded!");
-             return;
-         }
--        set_bit(type, have_fields_bitmap);
-+        set_bit(type, smbios_have_fields_bitmap);
- 
-         switch (type) {
-         case 0:
-             if (!qemu_opts_validate(opts, qemu_smbios_type0_opts, errp)) {
-                 return;
-             }
--            save_opt(&type0.vendor, opts, "vendor");
--            save_opt(&type0.version, opts, "version");
--            save_opt(&type0.date, opts, "date");
--            type0.uefi = qemu_opt_get_bool(opts, "uefi", false);
-+            save_opt(&smbios_type0.vendor, opts, "vendor");
-+            save_opt(&smbios_type0.version, opts, "version");
-+            save_opt(&smbios_type0.date, opts, "date");
-+            smbios_type0.uefi = qemu_opt_get_bool(opts, "uefi", false);
- 
-             val = qemu_opt_get(opts, "release");
-             if (val) {
--                if (sscanf(val, "%hhu.%hhu", &type0.major, &type0.minor) != 2) {
-+                if (sscanf(val, "%hhu.%hhu", &smbios_type0.major,
-+                           &smbios_type0.minor) != 2) {
-                     error_setg(errp, "Invalid release");
-                     return;
-                 }
--                type0.have_major_minor = true;
-+                smbios_type0.have_major_minor = true;
-             }
-             return;
-         case 1:
-             if (!qemu_opts_validate(opts, qemu_smbios_type1_opts, errp)) {
-                 return;
-             }
--            save_opt(&type1.manufacturer, opts, "manufacturer");
--            save_opt(&type1.product, opts, "product");
--            save_opt(&type1.version, opts, "version");
--            save_opt(&type1.serial, opts, "serial");
--            save_opt(&type1.sku, opts, "sku");
--            save_opt(&type1.family, opts, "family");
-+            save_opt(&smbios_type1.manufacturer, opts, "manufacturer");
-+            save_opt(&smbios_type1.product, opts, "product");
-+            save_opt(&smbios_type1.version, opts, "version");
-+            save_opt(&smbios_type1.serial, opts, "serial");
-+            save_opt(&smbios_type1.sku, opts, "sku");
-+            save_opt(&smbios_type1.family, opts, "family");
- 
-             val = qemu_opt_get(opts, "uuid");
-             if (val) {
-diff --git a/include/hw/firmware/smbios.h b/include/hw/firmware/smbios.h
-index d55018e5e3..333de0d5fc 100644
---- a/include/hw/firmware/smbios.h
-+++ b/include/hw/firmware/smbios.h
-@@ -2,6 +2,7 @@
- #define QEMU_SMBIOS_H
- 
- #include "qapi/qapi-types-machine.h"
-+#include "qemu/bitmap.h"
- 
- /*
-  * SMBIOS Support
-@@ -16,8 +17,23 @@
-  *
-  */
- 
-+typedef struct {
-+    const char *vendor, *version, *date;
-+    bool have_major_minor, uefi;
-+    uint8_t major, minor;
-+} smbios_type0_t;
-+extern smbios_type0_t smbios_type0;
-+
-+typedef struct {
-+    const char *manufacturer, *product, *version, *serial, *sku, *family;
-+    /* uuid is in qemu_uuid */
-+} smbios_type1_t;
-+extern smbios_type1_t smbios_type1;
- 
- #define SMBIOS_MAX_TYPE 127
-+extern DECLARE_BITMAP(smbios_have_binfile_bitmap, SMBIOS_MAX_TYPE + 1);
-+extern DECLARE_BITMAP(smbios_have_fields_bitmap, SMBIOS_MAX_TYPE + 1);
-+
- #define offsetofend(TYPE, MEMBER) \
-        (offsetof(TYPE, MEMBER) + sizeof_field(TYPE, MEMBER))
- 
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-string-output-visitor-Fix-pseudo-struct-handling.patch b/SOURCES/kvm-string-output-visitor-Fix-pseudo-struct-handling.patch
deleted file mode 100644
index 81ae2f1..0000000
--- a/SOURCES/kvm-string-output-visitor-Fix-pseudo-struct-handling.patch
+++ /dev/null
@@ -1,190 +0,0 @@
-From c5f9e92cd49a2171a5b0223cafd7fab3f45edb82 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Tue, 9 Jan 2024 19:17:17 +0100
-Subject: [PATCH 06/22] string-output-visitor: Fix (pseudo) struct handling
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 219: virtio-blk: add iothread-vq-mapping parameter
-RH-Jira: RHEL-17369 RHEL-20764 RHEL-7356
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Commit: [2/17] 84e226f161680dd61b6635e213203d062c1aa556 (stefanha/centos-stream-qemu-kvm)
-
-Commit ff32bb53 tried to get minimal struct support into the string
-output visitor by just making it return "<omitted>". Unfortunately, it
-forgot that the caller will still make more visitor calls for the
-content of the struct.
-
-If the struct is contained in a list, such as IOThreadVirtQueueMapping,
-in the better case its fields show up as separate list entries. In the
-worse case, it contains another list, and the string output visitor
-doesn't support nested lists and asserts that this doesn't happen. So as
-soon as the optional "vqs" field in IOThreadVirtQueueMapping is
-specified, we get a crash.
-
-This can be reproduced with the following command line:
-
-  echo "info qtree" | ./qemu-system-x86_64 \
-    -object iothread,id=t0 \
-    -blockdev null-co,node-name=disk \
-    -device '{"driver": "virtio-blk-pci", "drive": "disk",
-              "iothread-vq-mapping": [{"iothread": "t0", "vqs": [0]}]}' \
-    -monitor stdio
-
-Fix the problem by counting the nesting level of structs and ignoring
-any visitor calls for values (apart from start/end_struct) while we're
-not on the top level.
-
-Lists nested directly within lists remain unimplemented, as we don't
-currently have a use case for them.
-
-Fixes: ff32bb53476539d352653f4ed56372dced73a388
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2069
-Reported-by: Aihua Liang <aliang@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Message-ID: <20240109181717.42493-1-kwolf@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 014b99a8e41c8cd1e895137654b44dec5430122c)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- qapi/string-output-visitor.c | 46 ++++++++++++++++++++++++++++++++++++
- 1 file changed, 46 insertions(+)
-
-diff --git a/qapi/string-output-visitor.c b/qapi/string-output-visitor.c
-index f0c1dea89e..5115536b15 100644
---- a/qapi/string-output-visitor.c
-+++ b/qapi/string-output-visitor.c
-@@ -65,6 +65,7 @@ struct StringOutputVisitor
-     } range_start, range_end;
-     GList *ranges;
-     void *list; /* Only needed for sanity checking the caller */
-+    unsigned int struct_nesting;
- };
- 
- static StringOutputVisitor *to_sov(Visitor *v)
-@@ -144,6 +145,10 @@ static bool print_type_int64(Visitor *v, const char *name, int64_t *obj,
-     StringOutputVisitor *sov = to_sov(v);
-     GList *l;
- 
-+    if (sov->struct_nesting) {
-+        return true;
-+    }
-+
-     switch (sov->list_mode) {
-     case LM_NONE:
-         string_output_append(sov, *obj);
-@@ -231,6 +236,10 @@ static bool print_type_size(Visitor *v, const char *name, uint64_t *obj,
-     uint64_t val;
-     char *out, *psize;
- 
-+    if (sov->struct_nesting) {
-+        return true;
-+    }
-+
-     if (!sov->human) {
-         out = g_strdup_printf("%"PRIu64, *obj);
-         string_output_set(sov, out);
-@@ -250,6 +259,11 @@ static bool print_type_bool(Visitor *v, const char *name, bool *obj,
-                             Error **errp)
- {
-     StringOutputVisitor *sov = to_sov(v);
-+
-+    if (sov->struct_nesting) {
-+        return true;
-+    }
-+
-     string_output_set(sov, g_strdup(*obj ? "true" : "false"));
-     return true;
- }
-@@ -260,6 +274,10 @@ static bool print_type_str(Visitor *v, const char *name, char **obj,
-     StringOutputVisitor *sov = to_sov(v);
-     char *out;
- 
-+    if (sov->struct_nesting) {
-+        return true;
-+    }
-+
-     if (sov->human) {
-         out = *obj ? g_strdup_printf("\"%s\"", *obj) : g_strdup("<null>");
-     } else {
-@@ -273,6 +291,11 @@ static bool print_type_number(Visitor *v, const char *name, double *obj,
-                               Error **errp)
- {
-     StringOutputVisitor *sov = to_sov(v);
-+
-+    if (sov->struct_nesting) {
-+        return true;
-+    }
-+
-     string_output_set(sov, g_strdup_printf("%.17g", *obj));
-     return true;
- }
-@@ -283,6 +306,10 @@ static bool print_type_null(Visitor *v, const char *name, QNull **obj,
-     StringOutputVisitor *sov = to_sov(v);
-     char *out;
- 
-+    if (sov->struct_nesting) {
-+        return true;
-+    }
-+
-     if (sov->human) {
-         out = g_strdup("<null>");
-     } else {
-@@ -295,6 +322,9 @@ static bool print_type_null(Visitor *v, const char *name, QNull **obj,
- static bool start_struct(Visitor *v, const char *name, void **obj,
-                          size_t size, Error **errp)
- {
-+    StringOutputVisitor *sov = to_sov(v);
-+
-+    sov->struct_nesting++;
-     return true;
- }
- 
-@@ -302,6 +332,10 @@ static void end_struct(Visitor *v, void **obj)
- {
-     StringOutputVisitor *sov = to_sov(v);
- 
-+    if (--sov->struct_nesting) {
-+        return;
-+    }
-+
-     /* TODO actually print struct fields */
-     string_output_set(sov, g_strdup("<omitted>"));
- }
-@@ -312,6 +346,10 @@ start_list(Visitor *v, const char *name, GenericList **list, size_t size,
- {
-     StringOutputVisitor *sov = to_sov(v);
- 
-+    if (sov->struct_nesting) {
-+        return true;
-+    }
-+
-     /* we can't traverse a list in a list */
-     assert(sov->list_mode == LM_NONE);
-     /* We don't support visits without a list */
-@@ -329,6 +367,10 @@ static GenericList *next_list(Visitor *v, GenericList *tail, size_t size)
-     StringOutputVisitor *sov = to_sov(v);
-     GenericList *ret = tail->next;
- 
-+    if (sov->struct_nesting) {
-+        return ret;
-+    }
-+
-     if (ret && !ret->next) {
-         sov->list_mode = LM_END;
-     }
-@@ -339,6 +381,10 @@ static void end_list(Visitor *v, void **obj)
- {
-     StringOutputVisitor *sov = to_sov(v);
- 
-+    if (sov->struct_nesting) {
-+        return;
-+    }
-+
-     assert(sov->list == obj);
-     assert(sov->list_mode == LM_STARTED ||
-            sov->list_mode == LM_END ||
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-string-output-visitor-show-structs-as-omitted.patch b/SOURCES/kvm-string-output-visitor-show-structs-as-omitted.patch
deleted file mode 100644
index f83635d..0000000
--- a/SOURCES/kvm-string-output-visitor-show-structs-as-omitted.patch
+++ /dev/null
@@ -1,90 +0,0 @@
-From fb2069be402ec1322834c555714f0e993778cc9d Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Tue, 12 Dec 2023 08:49:34 -0500
-Subject: [PATCH 05/22] string-output-visitor: show structs as "<omitted>"
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 219: virtio-blk: add iothread-vq-mapping parameter
-RH-Jira: RHEL-17369 RHEL-20764 RHEL-7356
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Commit: [1/17] 0c08e8237d28fbdbdbc7576d4c17d2eeeb413c2a (stefanha/centos-stream-qemu-kvm)
-
-StringOutputVisitor crashes when it visits a struct because
-->start_struct() is NULL.
-
-Show "<omitted>" instead of crashing. This is necessary because the
-virtio-blk-pci iothread-vq-mapping parameter that I'd like to introduce
-soon is a list of IOThreadMapping structs.
-
-This patch is a quick fix to solve the crash, but the long-term solution
-is replacing StringOutputVisitor with something that can handle the full
-gamut of values in QEMU.
-
-Cc: Markus Armbruster <armbru@redhat.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20231212134934.500289-1-stefanha@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Reviewed-by: Markus Armbruster <armbru@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit ff32bb53476539d352653f4ed56372dced73a388)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- include/qapi/string-output-visitor.h |  6 +++---
- qapi/string-output-visitor.c         | 16 ++++++++++++++++
- 2 files changed, 19 insertions(+), 3 deletions(-)
-
-diff --git a/include/qapi/string-output-visitor.h b/include/qapi/string-output-visitor.h
-index 268dfe9986..b1ee473b30 100644
---- a/include/qapi/string-output-visitor.h
-+++ b/include/qapi/string-output-visitor.h
-@@ -26,9 +26,9 @@ typedef struct StringOutputVisitor StringOutputVisitor;
-  * If everything else succeeds, pass @result to visit_complete() to
-  * collect the result of the visit.
-  *
-- * The string output visitor does not implement support for visiting
-- * QAPI structs, alternates, null, or arbitrary QTypes.  It also
-- * requires a non-null list argument to visit_start_list().
-+ * The string output visitor does not implement support for alternates, null,
-+ * or arbitrary QTypes.  Struct fields are not shown.  It also requires a
-+ * non-null list argument to visit_start_list().
-  */
- Visitor *string_output_visitor_new(bool human, char **result);
- 
-diff --git a/qapi/string-output-visitor.c b/qapi/string-output-visitor.c
-index c0cb72dbe4..f0c1dea89e 100644
---- a/qapi/string-output-visitor.c
-+++ b/qapi/string-output-visitor.c
-@@ -292,6 +292,20 @@ static bool print_type_null(Visitor *v, const char *name, QNull **obj,
-     return true;
- }
- 
-+static bool start_struct(Visitor *v, const char *name, void **obj,
-+                         size_t size, Error **errp)
-+{
-+    return true;
-+}
-+
-+static void end_struct(Visitor *v, void **obj)
-+{
-+    StringOutputVisitor *sov = to_sov(v);
-+
-+    /* TODO actually print struct fields */
-+    string_output_set(sov, g_strdup("<omitted>"));
-+}
-+
- static bool
- start_list(Visitor *v, const char *name, GenericList **list, size_t size,
-            Error **errp)
-@@ -379,6 +393,8 @@ Visitor *string_output_visitor_new(bool human, char **result)
-     v->visitor.type_str = print_type_str;
-     v->visitor.type_number = print_type_number;
-     v->visitor.type_null = print_type_null;
-+    v->visitor.start_struct = start_struct;
-+    v->visitor.end_struct = end_struct;
-     v->visitor.start_list = start_list;
-     v->visitor.next_list = next_list;
-     v->visitor.end_list = end_list;
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-target-i386-Add-new-CPU-model-SierraForest.patch b/SOURCES/kvm-target-i386-Add-new-CPU-model-SierraForest.patch
new file mode 100644
index 0000000..c72f290
--- /dev/null
+++ b/SOURCES/kvm-target-i386-Add-new-CPU-model-SierraForest.patch
@@ -0,0 +1,215 @@
+From d9595fecd03c9a69ac562e3f240d50b2fa8d14a4 Mon Sep 17 00:00:00 2001
+From: Tao Su <tao1.su@linux.intel.com>
+Date: Wed, 20 Mar 2024 10:10:44 +0800
+Subject: [PATCH 006/100] target/i386: Add new CPU model SierraForest
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [6/91] 4bc71f82c258db46569a7e08965d1d358b19416c (bonzini/rhel-qemu-kvm)
+
+According to table 1-2 in Intel Architecture Instruction Set Extensions and
+Future Features (rev 051) [1], SierraForest has the following new features
+which have already been virtualized:
+
+- CMPCCXADD CPUID.(EAX=7,ECX=1):EAX[bit 7]
+- AVX-IFMA CPUID.(EAX=7,ECX=1):EAX[bit 23]
+- AVX-VNNI-INT8 CPUID.(EAX=7,ECX=1):EDX[bit 4]
+- AVX-NE-CONVERT CPUID.(EAX=7,ECX=1):EDX[bit 5]
+
+Add above features to new CPU model SierraForest. Comparing with GraniteRapids
+CPU model, SierraForest bare-metal removes the following features:
+
+- HLE CPUID.(EAX=7,ECX=0):EBX[bit 4]
+- RTM CPUID.(EAX=7,ECX=0):EBX[bit 11]
+- AVX512F CPUID.(EAX=7,ECX=0):EBX[bit 16]
+- AVX512DQ CPUID.(EAX=7,ECX=0):EBX[bit 17]
+- AVX512_IFMA CPUID.(EAX=7,ECX=0):EBX[bit 21]
+- AVX512CD CPUID.(EAX=7,ECX=0):EBX[bit 28]
+- AVX512BW CPUID.(EAX=7,ECX=0):EBX[bit 30]
+- AVX512VL CPUID.(EAX=7,ECX=0):EBX[bit 31]
+- AVX512_VBMI CPUID.(EAX=7,ECX=0):ECX[bit 1]
+- AVX512_VBMI2 CPUID.(EAX=7,ECX=0):ECX[bit 6]
+- AVX512_VNNI CPUID.(EAX=7,ECX=0):ECX[bit 11]
+- AVX512_BITALG CPUID.(EAX=7,ECX=0):ECX[bit 12]
+- AVX512_VPOPCNTDQ CPUID.(EAX=7,ECX=0):ECX[bit 14]
+- LA57 CPUID.(EAX=7,ECX=0):ECX[bit 16]
+- TSXLDTRK CPUID.(EAX=7,ECX=0):EDX[bit 16]
+- AMX-BF16 CPUID.(EAX=7,ECX=0):EDX[bit 22]
+- AVX512_FP16 CPUID.(EAX=7,ECX=0):EDX[bit 23]
+- AMX-TILE CPUID.(EAX=7,ECX=0):EDX[bit 24]
+- AMX-INT8 CPUID.(EAX=7,ECX=0):EDX[bit 25]
+- AVX512_BF16 CPUID.(EAX=7,ECX=1):EAX[bit 5]
+- fast zero-length MOVSB CPUID.(EAX=7,ECX=1):EAX[bit 10]
+- fast short CMPSB, SCASB CPUID.(EAX=7,ECX=1):EAX[bit 12]
+- AMX-FP16 CPUID.(EAX=7,ECX=1):EAX[bit 21]
+- PREFETCHI CPUID.(EAX=7,ECX=1):EDX[bit 14]
+- XFD CPUID.(EAX=0xD,ECX=1):EAX[bit 4]
+- EPT_PAGE_WALK_LENGTH_5 VMX_EPT_VPID_CAP(0x48c)[bit 7]
+
+Add all features of GraniteRapids CPU model except above features to
+SierraForest CPU model.
+
+SierraForest doesn’t support TSX and RTM but supports TAA_NO. When RTM is
+not enabled in host, KVM will not report TAA_NO. So, just don't include
+TAA_NO in SierraForest CPU model.
+
+[1] https://cdrdv2.intel.com/v1/dl/getContent/671368
+
+Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
+Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
+Signed-off-by: Tao Su <tao1.su@linux.intel.com>
+Message-ID: <20240320021044.508263-1-tao1.su@linux.intel.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 6e82d3b6220777667968a04c87e1667f164ebe88)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ target/i386/cpu.c | 126 ++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 126 insertions(+)
+
+diff --git a/target/i386/cpu.c b/target/i386/cpu.c
+index 0aa88d9b48..efbadc3ed7 100644
+--- a/target/i386/cpu.c
++++ b/target/i386/cpu.c
+@@ -4127,6 +4127,132 @@ static const X86CPUDefinition builtin_x86_defs[] = {
+             { /* end of list */ },
+         },
+     },
++    {
++        .name = "SierraForest",
++        .level = 0x23,
++        .vendor = CPUID_VENDOR_INTEL,
++        .family = 6,
++        .model = 175,
++        .stepping = 0,
++        /*
++         * please keep the ascending order so that we can have a clear view of
++         * bit position of each feature.
++         */
++        .features[FEAT_1_EDX] =
++            CPUID_FP87 | CPUID_VME | CPUID_DE | CPUID_PSE | CPUID_TSC |
++            CPUID_MSR | CPUID_PAE | CPUID_MCE | CPUID_CX8 | CPUID_APIC |
++            CPUID_SEP | CPUID_MTRR | CPUID_PGE | CPUID_MCA | CPUID_CMOV |
++            CPUID_PAT | CPUID_PSE36 | CPUID_CLFLUSH | CPUID_MMX | CPUID_FXSR |
++            CPUID_SSE | CPUID_SSE2,
++        .features[FEAT_1_ECX] =
++            CPUID_EXT_SSE3 | CPUID_EXT_PCLMULQDQ | CPUID_EXT_SSSE3 |
++            CPUID_EXT_FMA | CPUID_EXT_CX16 | CPUID_EXT_PCID | CPUID_EXT_SSE41 |
++            CPUID_EXT_SSE42 | CPUID_EXT_X2APIC | CPUID_EXT_MOVBE |
++            CPUID_EXT_POPCNT | CPUID_EXT_TSC_DEADLINE_TIMER | CPUID_EXT_AES |
++            CPUID_EXT_XSAVE | CPUID_EXT_AVX | CPUID_EXT_F16C | CPUID_EXT_RDRAND,
++        .features[FEAT_8000_0001_EDX] =
++            CPUID_EXT2_SYSCALL | CPUID_EXT2_NX | CPUID_EXT2_PDPE1GB |
++            CPUID_EXT2_RDTSCP | CPUID_EXT2_LM,
++        .features[FEAT_8000_0001_ECX] =
++            CPUID_EXT3_LAHF_LM | CPUID_EXT3_ABM | CPUID_EXT3_3DNOWPREFETCH,
++        .features[FEAT_8000_0008_EBX] =
++            CPUID_8000_0008_EBX_WBNOINVD,
++        .features[FEAT_7_0_EBX] =
++            CPUID_7_0_EBX_FSGSBASE | CPUID_7_0_EBX_BMI1 | CPUID_7_0_EBX_AVX2 |
++            CPUID_7_0_EBX_SMEP | CPUID_7_0_EBX_BMI2 | CPUID_7_0_EBX_ERMS |
++            CPUID_7_0_EBX_INVPCID | CPUID_7_0_EBX_RDSEED | CPUID_7_0_EBX_ADX |
++            CPUID_7_0_EBX_SMAP | CPUID_7_0_EBX_CLFLUSHOPT | CPUID_7_0_EBX_CLWB |
++            CPUID_7_0_EBX_SHA_NI,
++        .features[FEAT_7_0_ECX] =
++            CPUID_7_0_ECX_UMIP | CPUID_7_0_ECX_PKU | CPUID_7_0_ECX_GFNI |
++            CPUID_7_0_ECX_VAES | CPUID_7_0_ECX_VPCLMULQDQ |
++            CPUID_7_0_ECX_RDPID | CPUID_7_0_ECX_BUS_LOCK_DETECT,
++        .features[FEAT_7_0_EDX] =
++            CPUID_7_0_EDX_FSRM | CPUID_7_0_EDX_SERIALIZE |
++            CPUID_7_0_EDX_SPEC_CTRL | CPUID_7_0_EDX_ARCH_CAPABILITIES |
++            CPUID_7_0_EDX_SPEC_CTRL_SSBD,
++        .features[FEAT_ARCH_CAPABILITIES] =
++            MSR_ARCH_CAP_RDCL_NO | MSR_ARCH_CAP_IBRS_ALL |
++            MSR_ARCH_CAP_SKIP_L1DFL_VMENTRY | MSR_ARCH_CAP_MDS_NO |
++            MSR_ARCH_CAP_PSCHANGE_MC_NO | MSR_ARCH_CAP_SBDR_SSDP_NO |
++            MSR_ARCH_CAP_FBSDP_NO | MSR_ARCH_CAP_PSDP_NO |
++            MSR_ARCH_CAP_PBRSB_NO,
++        .features[FEAT_XSAVE] =
++            CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XSAVEC |
++            CPUID_XSAVE_XGETBV1 | CPUID_XSAVE_XSAVES,
++        .features[FEAT_6_EAX] =
++            CPUID_6_EAX_ARAT,
++        .features[FEAT_7_1_EAX] =
++            CPUID_7_1_EAX_AVX_VNNI | CPUID_7_1_EAX_CMPCCXADD |
++            CPUID_7_1_EAX_FSRS | CPUID_7_1_EAX_AVX_IFMA,
++        .features[FEAT_7_1_EDX] =
++            CPUID_7_1_EDX_AVX_VNNI_INT8 | CPUID_7_1_EDX_AVX_NE_CONVERT,
++        .features[FEAT_7_2_EDX] =
++            CPUID_7_2_EDX_MCDT_NO,
++        .features[FEAT_VMX_BASIC] =
++            MSR_VMX_BASIC_INS_OUTS | MSR_VMX_BASIC_TRUE_CTLS,
++        .features[FEAT_VMX_ENTRY_CTLS] =
++            VMX_VM_ENTRY_LOAD_DEBUG_CONTROLS | VMX_VM_ENTRY_IA32E_MODE |
++            VMX_VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL |
++            VMX_VM_ENTRY_LOAD_IA32_PAT | VMX_VM_ENTRY_LOAD_IA32_EFER,
++        .features[FEAT_VMX_EPT_VPID_CAPS] =
++            MSR_VMX_EPT_EXECONLY | MSR_VMX_EPT_PAGE_WALK_LENGTH_4 |
++            MSR_VMX_EPT_WB | MSR_VMX_EPT_2MB | MSR_VMX_EPT_1GB |
++            MSR_VMX_EPT_INVEPT | MSR_VMX_EPT_AD_BITS |
++            MSR_VMX_EPT_INVEPT_SINGLE_CONTEXT | MSR_VMX_EPT_INVEPT_ALL_CONTEXT |
++            MSR_VMX_EPT_INVVPID | MSR_VMX_EPT_INVVPID_SINGLE_ADDR |
++            MSR_VMX_EPT_INVVPID_SINGLE_CONTEXT |
++            MSR_VMX_EPT_INVVPID_ALL_CONTEXT |
++            MSR_VMX_EPT_INVVPID_SINGLE_CONTEXT_NOGLOBALS,
++        .features[FEAT_VMX_EXIT_CTLS] =
++            VMX_VM_EXIT_SAVE_DEBUG_CONTROLS |
++            VMX_VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL |
++            VMX_VM_EXIT_ACK_INTR_ON_EXIT | VMX_VM_EXIT_SAVE_IA32_PAT |
++            VMX_VM_EXIT_LOAD_IA32_PAT | VMX_VM_EXIT_SAVE_IA32_EFER |
++            VMX_VM_EXIT_LOAD_IA32_EFER | VMX_VM_EXIT_SAVE_VMX_PREEMPTION_TIMER,
++        .features[FEAT_VMX_MISC] =
++            MSR_VMX_MISC_STORE_LMA | MSR_VMX_MISC_ACTIVITY_HLT |
++            MSR_VMX_MISC_VMWRITE_VMEXIT,
++        .features[FEAT_VMX_PINBASED_CTLS] =
++            VMX_PIN_BASED_EXT_INTR_MASK | VMX_PIN_BASED_NMI_EXITING |
++            VMX_PIN_BASED_VIRTUAL_NMIS | VMX_PIN_BASED_VMX_PREEMPTION_TIMER |
++            VMX_PIN_BASED_POSTED_INTR,
++        .features[FEAT_VMX_PROCBASED_CTLS] =
++            VMX_CPU_BASED_VIRTUAL_INTR_PENDING |
++            VMX_CPU_BASED_USE_TSC_OFFSETING | VMX_CPU_BASED_HLT_EXITING |
++            VMX_CPU_BASED_INVLPG_EXITING | VMX_CPU_BASED_MWAIT_EXITING |
++            VMX_CPU_BASED_RDPMC_EXITING | VMX_CPU_BASED_RDTSC_EXITING |
++            VMX_CPU_BASED_CR3_LOAD_EXITING | VMX_CPU_BASED_CR3_STORE_EXITING |
++            VMX_CPU_BASED_CR8_LOAD_EXITING | VMX_CPU_BASED_CR8_STORE_EXITING |
++            VMX_CPU_BASED_TPR_SHADOW | VMX_CPU_BASED_VIRTUAL_NMI_PENDING |
++            VMX_CPU_BASED_MOV_DR_EXITING | VMX_CPU_BASED_UNCOND_IO_EXITING |
++            VMX_CPU_BASED_USE_IO_BITMAPS | VMX_CPU_BASED_MONITOR_TRAP_FLAG |
++            VMX_CPU_BASED_USE_MSR_BITMAPS | VMX_CPU_BASED_MONITOR_EXITING |
++            VMX_CPU_BASED_PAUSE_EXITING |
++            VMX_CPU_BASED_ACTIVATE_SECONDARY_CONTROLS,
++        .features[FEAT_VMX_SECONDARY_CTLS] =
++            VMX_SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES |
++            VMX_SECONDARY_EXEC_ENABLE_EPT | VMX_SECONDARY_EXEC_DESC |
++            VMX_SECONDARY_EXEC_RDTSCP |
++            VMX_SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE |
++            VMX_SECONDARY_EXEC_ENABLE_VPID | VMX_SECONDARY_EXEC_WBINVD_EXITING |
++            VMX_SECONDARY_EXEC_UNRESTRICTED_GUEST |
++            VMX_SECONDARY_EXEC_APIC_REGISTER_VIRT |
++            VMX_SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY |
++            VMX_SECONDARY_EXEC_RDRAND_EXITING |
++            VMX_SECONDARY_EXEC_ENABLE_INVPCID |
++            VMX_SECONDARY_EXEC_ENABLE_VMFUNC | VMX_SECONDARY_EXEC_SHADOW_VMCS |
++            VMX_SECONDARY_EXEC_RDSEED_EXITING | VMX_SECONDARY_EXEC_ENABLE_PML |
++            VMX_SECONDARY_EXEC_XSAVES,
++        .features[FEAT_VMX_VMFUNC] =
++            MSR_VMX_VMFUNC_EPT_SWITCHING,
++        .xlevel = 0x80000008,
++        .model_id = "Intel Xeon Processor (SierraForest)",
++        .versions = (X86CPUVersionDefinition[]) {
++            { .version = 1 },
++            { /* end of list */ },
++        },
++    },
+     {
+         .name = "Denverton",
+         .level = 21,
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-target-i386-Export-RFDS-bit-to-guests.patch b/SOURCES/kvm-target-i386-Export-RFDS-bit-to-guests.patch
new file mode 100644
index 0000000..74de391
--- /dev/null
+++ b/SOURCES/kvm-target-i386-Export-RFDS-bit-to-guests.patch
@@ -0,0 +1,50 @@
+From ae6229a3e45318b1101291b99a0e894399dcb1db Mon Sep 17 00:00:00 2001
+From: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
+Date: Wed, 13 Mar 2024 07:53:23 -0700
+Subject: [PATCH 007/100] target/i386: Export RFDS bit to guests
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [7/91] 7eb6cae8821a2e953d3ff2033fa2e973011ad771 (bonzini/rhel-qemu-kvm)
+
+Register File Data Sampling (RFDS) is a CPU side-channel vulnerability
+that may expose stale register value. CPUs that set RFDS_NO bit in MSR
+IA32_ARCH_CAPABILITIES indicate that they are not vulnerable to RFDS.
+Similarly, RFDS_CLEAR indicates that CPU is affected by RFDS, and has
+the microcode to help mitigate RFDS.
+
+Make RFDS_CLEAR and RFDS_NO bits available to guests.
+
+Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
+Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
+Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
+Message-ID: <9a38877857392b5c2deae7e7db1b170d15510314.1710341348.git.pawan.kumar.gupta@linux.intel.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 41bdd9812863c150284a9339a048ed88c40f4df7)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ target/i386/cpu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/target/i386/cpu.c b/target/i386/cpu.c
+index efbadc3ed7..489c853b42 100644
+--- a/target/i386/cpu.c
++++ b/target/i386/cpu.c
+@@ -1158,8 +1158,8 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
+             NULL, "sbdr-ssdp-no", "fbsdp-no", "psdp-no",
+             NULL, "fb-clear", NULL, NULL,
+             NULL, NULL, NULL, NULL,
+-            "pbrsb-no", NULL, "gds-no", NULL,
+-            NULL, NULL, NULL, NULL,
++            "pbrsb-no", NULL, "gds-no", "rfds-no",
++            "rfds-clear", NULL, NULL, NULL,
+         },
+         .msr = {
+             .index = MSR_IA32_ARCH_CAPABILITIES,
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-target-i386-Implement-mc-kvm_type-to-get-VM-type.patch b/SOURCES/kvm-target-i386-Implement-mc-kvm_type-to-get-VM-type.patch
new file mode 100644
index 0000000..f37dbc2
--- /dev/null
+++ b/SOURCES/kvm-target-i386-Implement-mc-kvm_type-to-get-VM-type.patch
@@ -0,0 +1,192 @@
+From 4a811f54cdb3c9329f193ea43c76ed4eb1b14c19 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Tue, 19 Mar 2024 15:29:33 +0100
+Subject: [PATCH 022/100] target/i386: Implement mc->kvm_type() to get VM type
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [22/91] d58cf6ead2de37852adc15c7642166904403453f (bonzini/rhel-qemu-kvm)
+
+KVM is introducing a new API to create confidential guests, which
+will be used by TDX and SEV-SNP but is also available for SEV and
+SEV-ES.  The API uses the VM type argument to KVM_CREATE_VM to
+identify which confidential computing technology to use.
+
+Since there are no other expected uses of VM types, delegate
+mc->kvm_type() for x86 boards to the confidential-guest-support
+object pointed to by ms->cgs.
+
+For example, if a sev-guest object is specified to confidential-guest-support,
+like,
+
+  qemu -machine ...,confidential-guest-support=sev0 \
+       -object sev-guest,id=sev0,...
+
+it will check if a VM type KVM_X86_SEV_VM or KVM_X86_SEV_ES_VM
+is supported, and if so use them together with the KVM_SEV_INIT2
+function of the KVM_MEMORY_ENCRYPT_OP ioctl. If not, it will fall back to
+KVM_SEV_INIT and KVM_SEV_ES_INIT.
+
+This is a preparatory work towards TDX and SEV-SNP support, but it
+will also enable support for VMSA features such as DebugSwap, which
+are only available via KVM_SEV_INIT2.
+
+Co-developed-by: Xiaoyao Li <xiaoyao.li@intel.com>
+Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit ee88612df1e8d6c2bfec75bff3f9482ea44acec1)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ hw/i386/x86.c                    | 11 ++++++++
+ target/i386/confidential-guest.h | 19 ++++++++++++++
+ target/i386/kvm/kvm.c            | 44 ++++++++++++++++++++++++++++++++
+ target/i386/kvm/kvm_i386.h       |  2 ++
+ 4 files changed, 76 insertions(+)
+
+diff --git a/hw/i386/x86.c b/hw/i386/x86.c
+index 84a4801977..3d5b51e92d 100644
+--- a/hw/i386/x86.c
++++ b/hw/i386/x86.c
+@@ -1381,6 +1381,16 @@ static void machine_set_sgx_epc(Object *obj, Visitor *v, const char *name,
+     qapi_free_SgxEPCList(list);
+ }
+ 
++static int x86_kvm_type(MachineState *ms, const char *vm_type)
++{
++    /*
++     * No x86 machine has a kvm-type property.  If one is added that has
++     * it, it should call kvm_get_vm_type() directly or not use it at all.
++     */
++    assert(vm_type == NULL);
++    return kvm_enabled() ? kvm_get_vm_type(ms) : 0;
++}
++
+ static void x86_machine_initfn(Object *obj)
+ {
+     X86MachineState *x86ms = X86_MACHINE(obj);
+@@ -1405,6 +1415,7 @@ static void x86_machine_class_init(ObjectClass *oc, void *data)
+     mc->cpu_index_to_instance_props = x86_cpu_index_to_props;
+     mc->get_default_cpu_node_id = x86_get_default_cpu_node_id;
+     mc->possible_cpu_arch_ids = x86_possible_cpu_arch_ids;
++    mc->kvm_type = x86_kvm_type;
+     x86mc->save_tsc_khz = true;
+     x86mc->fwcfg_dma_enabled = true;
+     nc->nmi_monitor_handler = x86_nmi;
+diff --git a/target/i386/confidential-guest.h b/target/i386/confidential-guest.h
+index ca12d5a8fb..532e172a60 100644
+--- a/target/i386/confidential-guest.h
++++ b/target/i386/confidential-guest.h
+@@ -36,5 +36,24 @@ struct X86ConfidentialGuest {
+ struct X86ConfidentialGuestClass {
+     /* <private> */
+     ConfidentialGuestSupportClass parent;
++
++    /* <public> */
++    int (*kvm_type)(X86ConfidentialGuest *cg);
+ };
++
++/**
++ * x86_confidential_guest_kvm_type:
++ *
++ * Calls #X86ConfidentialGuestClass.unplug callback of @plug_handler.
++ */
++static inline int x86_confidential_guest_kvm_type(X86ConfidentialGuest *cg)
++{
++    X86ConfidentialGuestClass *klass = X86_CONFIDENTIAL_GUEST_GET_CLASS(cg);
++
++    if (klass->kvm_type) {
++        return klass->kvm_type(cg);
++    } else {
++        return 0;
++    }
++}
+ #endif
+diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
+index a12207a8ee..1f0ab12c2e 100644
+--- a/target/i386/kvm/kvm.c
++++ b/target/i386/kvm/kvm.c
+@@ -31,6 +31,7 @@
+ #include "sysemu/kvm_int.h"
+ #include "sysemu/runstate.h"
+ #include "kvm_i386.h"
++#include "../confidential-guest.h"
+ #include "sev.h"
+ #include "xen-emu.h"
+ #include "hyperv.h"
+@@ -161,6 +162,49 @@ static KVMMSRHandlers msr_handlers[KVM_MSR_FILTER_MAX_RANGES];
+ static RateLimit bus_lock_ratelimit_ctrl;
+ static int kvm_get_one_msr(X86CPU *cpu, int index, uint64_t *value);
+ 
++static const char *vm_type_name[] = {
++    [KVM_X86_DEFAULT_VM] = "default",
++};
++
++bool kvm_is_vm_type_supported(int type)
++{
++    uint32_t machine_types;
++
++    /*
++     * old KVM doesn't support KVM_CAP_VM_TYPES but KVM_X86_DEFAULT_VM
++     * is always supported
++     */
++    if (type == KVM_X86_DEFAULT_VM) {
++        return true;
++    }
++
++    machine_types = kvm_check_extension(KVM_STATE(current_machine->accelerator),
++                                        KVM_CAP_VM_TYPES);
++    return !!(machine_types & BIT(type));
++}
++
++int kvm_get_vm_type(MachineState *ms)
++{
++    int kvm_type = KVM_X86_DEFAULT_VM;
++
++    if (ms->cgs) {
++        if (!object_dynamic_cast(OBJECT(ms->cgs), TYPE_X86_CONFIDENTIAL_GUEST)) {
++            error_report("configuration type %s not supported for x86 guests",
++                         object_get_typename(OBJECT(ms->cgs)));
++            exit(1);
++        }
++        kvm_type = x86_confidential_guest_kvm_type(
++            X86_CONFIDENTIAL_GUEST(ms->cgs));
++    }
++
++    if (!kvm_is_vm_type_supported(kvm_type)) {
++        error_report("vm-type %s not supported by KVM", vm_type_name[kvm_type]);
++        exit(1);
++    }
++
++    return kvm_type;
++}
++
+ bool kvm_has_smm(void)
+ {
+     return kvm_vm_check_extension(kvm_state, KVM_CAP_X86_SMM);
+diff --git a/target/i386/kvm/kvm_i386.h b/target/i386/kvm/kvm_i386.h
+index 30fedcffea..6b44844d95 100644
+--- a/target/i386/kvm/kvm_i386.h
++++ b/target/i386/kvm/kvm_i386.h
+@@ -37,6 +37,7 @@ bool kvm_hv_vpindex_settable(void);
+ bool kvm_enable_sgx_provisioning(KVMState *s);
+ bool kvm_hyperv_expand_features(X86CPU *cpu, Error **errp);
+ 
++int kvm_get_vm_type(MachineState *ms);
+ void kvm_arch_reset_vcpu(X86CPU *cs);
+ void kvm_arch_after_reset_vcpu(X86CPU *cpu);
+ void kvm_arch_do_init_vcpu(X86CPU *cs);
+@@ -49,6 +50,7 @@ void kvm_request_xsave_components(X86CPU *cpu, uint64_t mask);
+ 
+ #ifdef CONFIG_KVM
+ 
++bool kvm_is_vm_type_supported(int type);
+ bool kvm_has_adjust_clock_stable(void);
+ bool kvm_has_exception_payload(void);
+ void kvm_synchronize_all_tsc(void);
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-target-i386-Introduce-Icelake-Server-v7-to-enable-TS.patch b/SOURCES/kvm-target-i386-Introduce-Icelake-Server-v7-to-enable-TS.patch
new file mode 100644
index 0000000..9844da7
--- /dev/null
+++ b/SOURCES/kvm-target-i386-Introduce-Icelake-Server-v7-to-enable-TS.patch
@@ -0,0 +1,68 @@
+From fe60f8d47b6e14f17dd6c06b03bd00e6bcdbeefb Mon Sep 17 00:00:00 2001
+From: Zhenzhong Duan <zhenzhong.duan@intel.com>
+Date: Wed, 20 Mar 2024 17:31:38 +0800
+Subject: [PATCH 005/100] target/i386: Introduce Icelake-Server-v7 to enable
+ TSX
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [5/91] 66d865899e0d510b6c86763422d6b28b904b208a (bonzini/rhel-qemu-kvm)
+
+When start L2 guest with both L1/L2 using Icelake-Server-v3 or above,
+QEMU reports below warning:
+
+"warning: host doesn't support requested feature: MSR(10AH).taa-no [bit 8]"
+
+Reason is QEMU Icelake-Server-v3 has TSX feature disabled but enables taa-no
+bit. It's meaningless that TSX isn't supported but still claim TSX is secure.
+So L1 KVM doesn't expose taa-no to L2 if TSX is unsupported, then starting L2
+triggers the warning.
+
+Fix it by introducing a new version Icelake-Server-v7 which has both TSX
+and taa-no features. Then guest can use TSX securely when it see taa-no.
+
+This matches the production Icelake which supports TSX and isn't susceptible
+to TSX Async Abort (TAA) vulnerabilities, a.k.a, taa-no.
+
+Ideally, TSX should have being enabled together with taa-no since v3, but for
+compatibility, we'd better to add v7 to enable it.
+
+Fixes: d965dc35592d ("target/i386: Add ARCH_CAPABILITIES related bits into Icelake-Server CPU model")
+Tested-by: Xiangfei Ma <xiangfeix.ma@intel.com>
+Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
+Message-ID: <20240320093138.80267-2-zhenzhong.duan@intel.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit c895fa54e3060c5ac6f3888dce96c9b78626072b)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ target/i386/cpu.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/target/i386/cpu.c b/target/i386/cpu.c
+index a7f71422ea..0aa88d9b48 100644
+--- a/target/i386/cpu.c
++++ b/target/i386/cpu.c
+@@ -3840,6 +3840,16 @@ static const X86CPUDefinition builtin_x86_defs[] = {
+                     { /* end of list */ }
+                 },
+             },
++            {
++                .version = 7,
++                .note = "TSX, taa-no",
++                .props = (PropValue[]) {
++                    /* Restore TSX features removed by -v2 above */
++                    { "hle", "on" },
++                    { "rtm", "on" },
++                    { /* end of list */ }
++                },
++            },
+             { /* end of list */ }
+         }
+     },
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-target-i386-SEV-fix-formatting-of-CPUID-mismatch-mes.patch b/SOURCES/kvm-target-i386-SEV-fix-formatting-of-CPUID-mismatch-mes.patch
new file mode 100644
index 0000000..ace0367
--- /dev/null
+++ b/SOURCES/kvm-target-i386-SEV-fix-formatting-of-CPUID-mismatch-mes.patch
@@ -0,0 +1,49 @@
+From 070dda07559a7488c62fc80a8c79e8baaee125eb Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Wed, 3 Jul 2024 10:37:23 +0200
+Subject: [PATCH 087/100] target/i386: SEV: fix formatting of CPUID mismatch
+ message
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [87/91] 36bc2cc80d5ffc1ceeb1836540660ff45885a818 (bonzini/rhel-qemu-kvm)
+
+Fixes: 70943ad8e4d ("i386/sev: Add support for SNP CPUID validation", 2024-06-05)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit f45ef010e19fe86314bffd5d5c9d5d77f4ce8103)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ target/i386/sev.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/target/i386/sev.c b/target/i386/sev.c
+index c40562dce3..37de80adc7 100644
+--- a/target/i386/sev.c
++++ b/target/i386/sev.c
+@@ -839,7 +839,7 @@ sev_snp_cpuid_report_mismatches(SnpCpuidInfo *old,
+     size_t i;
+ 
+     if (old->count != new->count) {
+-        error_report("SEV-SNP: CPUID validation failed due to count mismatch,"
++        error_report("SEV-SNP: CPUID validation failed due to count mismatch, "
+                      "provided: %d, expected: %d", old->count, new->count);
+         return;
+     }
+@@ -851,8 +851,8 @@ sev_snp_cpuid_report_mismatches(SnpCpuidInfo *old,
+         new_func = &new->entries[i];
+ 
+         if (memcmp(old_func, new_func, sizeof(SnpCpuidFunc))) {
+-            error_report("SEV-SNP: CPUID validation failed for function 0x%x, index: 0x%x"
+-                         "provided: eax:0x%08x, ebx: 0x%08x, ecx: 0x%08x, edx: 0x%08x"
++            error_report("SEV-SNP: CPUID validation failed for function 0x%x, index: 0x%x, "
++                         "provided: eax:0x%08x, ebx: 0x%08x, ecx: 0x%08x, edx: 0x%08x, "
+                          "expected: eax:0x%08x, ebx: 0x%08x, ecx: 0x%08x, edx: 0x%08x",
+                          old_func->eax_in, old_func->ecx_in,
+                          old_func->eax, old_func->ebx, old_func->ecx, old_func->edx,
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-target-i386-SEV-fix-mismatch-in-vcek-disabled-proper.patch b/SOURCES/kvm-target-i386-SEV-fix-mismatch-in-vcek-disabled-proper.patch
new file mode 100644
index 0000000..3030d59
--- /dev/null
+++ b/SOURCES/kvm-target-i386-SEV-fix-mismatch-in-vcek-disabled-proper.patch
@@ -0,0 +1,42 @@
+From 37b7e2185f1d23dd5f5a95b545b8d760492915ed Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Fri, 2 Aug 2024 01:43:37 +0200
+Subject: [PATCH 091/100] target/i386: SEV: fix mismatch in vcek-disabled
+ property name
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [91/91] 3a8abc4a0547b985cb79cef29bd3e8350d3d4b48 (bonzini/rhel-qemu-kvm)
+
+The vcek-disabled property of the sev-snp-guest object is misspelled
+vcek-required (which I suppose would use the opposite polarity) in
+the call to object_class_property_add_bool().  Fix it.
+
+Reported-by: Zixi Chen <zixchen@redhat.com>
+Reviewed-by: Pankaj Gupta <pankaj.gupta@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit d4392415c328f83b2e30517a3561be523874f441)
+---
+ target/i386/sev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/target/i386/sev.c b/target/i386/sev.c
+index b921defb63..aed565dbe8 100644
+--- a/target/i386/sev.c
++++ b/target/i386/sev.c
+@@ -2378,7 +2378,7 @@ sev_snp_guest_class_init(ObjectClass *oc, void *data)
+     object_class_property_add_bool(oc, "author-key-enabled",
+                                    sev_snp_guest_get_author_key_enabled,
+                                    sev_snp_guest_set_author_key_enabled);
+-    object_class_property_add_bool(oc, "vcek-required",
++    object_class_property_add_bool(oc, "vcek-disabled",
+                                    sev_snp_guest_get_vcek_disabled,
+                                    sev_snp_guest_set_vcek_disabled);
+     object_class_property_add_str(oc, "host-data",
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-target-i386-SEV-use-KVM_SEV_INIT2-if-possible.patch b/SOURCES/kvm-target-i386-SEV-use-KVM_SEV_INIT2-if-possible.patch
new file mode 100644
index 0000000..7c17e53
--- /dev/null
+++ b/SOURCES/kvm-target-i386-SEV-use-KVM_SEV_INIT2-if-possible.patch
@@ -0,0 +1,146 @@
+From 6bb738fb90a3a1221ae35596b3d03a17e0b1c34d Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Tue, 19 Mar 2024 15:30:25 +0100
+Subject: [PATCH 023/100] target/i386: SEV: use KVM_SEV_INIT2 if possible
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [23/91] 9579d772ae5124a94c6b1e3a4566bf3470d2bc8f (bonzini/rhel-qemu-kvm)
+
+Implement support for the KVM_X86_SEV_VM and KVM_X86_SEV_ES_VM virtual
+machine types, and the KVM_SEV_INIT2 function of KVM_MEMORY_ENCRYPT_OP.
+
+These replace the KVM_SEV_INIT and KVM_SEV_ES_INIT functions, and have
+several advantages:
+
+- sharing the initialization sequence with SEV-SNP and TDX
+
+- allowing arguments including the set of desired VMSA features
+
+- protection against invalid use of KVM_GET/SET_* ioctls for guests
+  with encrypted state
+
+If the KVM_X86_SEV_VM and KVM_X86_SEV_ES_VM types are not supported,
+fall back to KVM_SEV_INIT and KVM_SEV_ES_INIT (which use the
+default x86 VM type).
+
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 663e2f443e5722370708ce2f4c27d94a2087d2d3)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ target/i386/kvm/kvm.c |  2 ++
+ target/i386/sev.c     | 41 +++++++++++++++++++++++++++++++++++++----
+ 2 files changed, 39 insertions(+), 4 deletions(-)
+
+diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
+index 1f0ab12c2e..408568d053 100644
+--- a/target/i386/kvm/kvm.c
++++ b/target/i386/kvm/kvm.c
+@@ -164,6 +164,8 @@ static int kvm_get_one_msr(X86CPU *cpu, int index, uint64_t *value);
+ 
+ static const char *vm_type_name[] = {
+     [KVM_X86_DEFAULT_VM] = "default",
++    [KVM_X86_SEV_VM] = "SEV",
++    [KVM_X86_SEV_ES_VM] = "SEV-ES",
+ };
+ 
+ bool kvm_is_vm_type_supported(int type)
+diff --git a/target/i386/sev.c b/target/i386/sev.c
+index ebe36d4c10..9dab4060b8 100644
+--- a/target/i386/sev.c
++++ b/target/i386/sev.c
+@@ -26,6 +26,7 @@
+ #include "qemu/error-report.h"
+ #include "crypto/hash.h"
+ #include "sysemu/kvm.h"
++#include "kvm/kvm_i386.h"
+ #include "sev.h"
+ #include "sysemu/sysemu.h"
+ #include "sysemu/runstate.h"
+@@ -56,6 +57,8 @@ OBJECT_DECLARE_SIMPLE_TYPE(SevGuestState, SEV_GUEST)
+ struct SevGuestState {
+     X86ConfidentialGuest parent_obj;
+ 
++    int kvm_type;
++
+     /* configuration parameters */
+     char *sev_device;
+     uint32_t policy;
+@@ -850,6 +853,26 @@ sev_vm_state_change(void *opaque, bool running, RunState state)
+     }
+ }
+ 
++static int sev_kvm_type(X86ConfidentialGuest *cg)
++{
++    SevGuestState *sev = SEV_GUEST(cg);
++    int kvm_type;
++
++    if (sev->kvm_type != -1) {
++        goto out;
++    }
++
++    kvm_type = (sev->policy & SEV_POLICY_ES) ? KVM_X86_SEV_ES_VM : KVM_X86_SEV_VM;
++    if (kvm_is_vm_type_supported(kvm_type)) {
++        sev->kvm_type = kvm_type;
++    } else {
++        sev->kvm_type = KVM_X86_DEFAULT_VM;
++    }
++
++out:
++    return sev->kvm_type;
++}
++
+ static int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
+ {
+     SevGuestState *sev = SEV_GUEST(cgs);
+@@ -929,13 +952,19 @@ static int sev_kvm_init(ConfidentialGuestSupport *cgs, Error **errp)
+                          __func__);
+             goto err;
+         }
+-        cmd = KVM_SEV_ES_INIT;
+-    } else {
+-        cmd = KVM_SEV_INIT;
+     }
+ 
+     trace_kvm_sev_init();
+-    ret = sev_ioctl(sev->sev_fd, cmd, NULL, &fw_error);
++    if (sev_kvm_type(X86_CONFIDENTIAL_GUEST(sev)) == KVM_X86_DEFAULT_VM) {
++        cmd = sev_es_enabled() ? KVM_SEV_ES_INIT : KVM_SEV_INIT;
++
++        ret = sev_ioctl(sev->sev_fd, cmd, NULL, &fw_error);
++    } else {
++        struct kvm_sev_init args = { 0 };
++
++        ret = sev_ioctl(sev->sev_fd, KVM_SEV_INIT2, &args, &fw_error);
++    }
++
+     if (ret) {
+         error_setg(errp, "%s: failed to initialize ret=%d fw_error=%d '%s'",
+                    __func__, ret, fw_error, fw_error_to_str(fw_error));
+@@ -1327,8 +1356,10 @@ static void
+ sev_guest_class_init(ObjectClass *oc, void *data)
+ {
+     ConfidentialGuestSupportClass *klass = CONFIDENTIAL_GUEST_SUPPORT_CLASS(oc);
++    X86ConfidentialGuestClass *x86_klass = X86_CONFIDENTIAL_GUEST_CLASS(oc);
+ 
+     klass->kvm_init = sev_kvm_init;
++    x86_klass->kvm_type = sev_kvm_type;
+ 
+     object_class_property_add_str(oc, "sev-device",
+                                   sev_guest_get_sev_device,
+@@ -1357,6 +1388,8 @@ sev_guest_instance_init(Object *obj)
+ {
+     SevGuestState *sev = SEV_GUEST(obj);
+ 
++    sev->kvm_type = -1;
++
+     sev->sev_device = g_strdup(DEFAULT_SEV_DEVICE);
+     sev->policy = DEFAULT_GUEST_POLICY;
+     object_property_add_uint32_ptr(obj, "policy", &sev->policy,
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-target-i386-add-guest-phys-bits-cpu-property.patch b/SOURCES/kvm-target-i386-add-guest-phys-bits-cpu-property.patch
new file mode 100644
index 0000000..cd41279
--- /dev/null
+++ b/SOURCES/kvm-target-i386-add-guest-phys-bits-cpu-property.patch
@@ -0,0 +1,124 @@
+From 090c64ea622534ff2ae6c9b66cdf0b1ddb58bf26 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Mon, 18 Mar 2024 16:53:36 +0100
+Subject: [PATCH 002/100] target/i386: add guest-phys-bits cpu property
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [2/91] 6603e842012dc484e1f571ea0a77b59095f37003 (bonzini/rhel-qemu-kvm)
+
+Allows to set guest-phys-bits (cpuid leaf 80000008, eax[23:16])
+via -cpu $model,guest-phys-bits=$nr.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Message-ID: <20240318155336.156197-3-kraxel@redhat.com>
+Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 513ba32dccc659c80722b3a43233b26eaa50309a)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ hw/i386/pc.c      |  2 ++
+ target/i386/cpu.c | 22 ++++++++++++++++++++++
+ target/i386/cpu.h |  8 ++++++++
+ 3 files changed, 32 insertions(+)
+
+diff --git a/hw/i386/pc.c b/hw/i386/pc.c
+index 648762d908..b9fde3cec1 100644
+--- a/hw/i386/pc.c
++++ b/hw/i386/pc.c
+@@ -349,6 +349,8 @@ GlobalProperty pc_rhel_compat[] = {
+ const size_t pc_rhel_compat_len = G_N_ELEMENTS(pc_rhel_compat);
+ 
+ GlobalProperty pc_rhel_9_5_compat[] = {
++    /* pc_rhel_9_5_compat from pc_compat_pc_9_0 (backported from 9.1) */
++    { TYPE_X86_CPU, "guest-phys-bits", "0" },
+ };
+ const size_t pc_rhel_9_5_compat_len = G_N_ELEMENTS(pc_rhel_9_5_compat);
+ 
+diff --git a/target/i386/cpu.c b/target/i386/cpu.c
+index be7b0663cd..a7f71422ea 100644
+--- a/target/i386/cpu.c
++++ b/target/i386/cpu.c
+@@ -6591,6 +6591,7 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
+         if (env->features[FEAT_8000_0001_EDX] & CPUID_EXT2_LM) {
+             /* 64 bit processor */
+              *eax |= (cpu_x86_virtual_addr_width(env) << 8);
++             *eax |= (cpu->guest_phys_bits << 16);
+         }
+         *ebx = env->features[FEAT_8000_0008_EBX];
+         if (cs->nr_cores * cs->nr_threads > 1) {
+@@ -7350,6 +7351,14 @@ static void x86_cpu_realizefn(DeviceState *dev, Error **errp)
+         goto out;
+     }
+ 
++    if (cpu->guest_phys_bits == -1) {
++        /*
++         * If it was not set by the user, or by the accelerator via
++         * cpu_exec_realizefn, clear.
++         */
++        cpu->guest_phys_bits = 0;
++    }
++
+     if (cpu->ucode_rev == 0) {
+         /*
+          * The default is the same as KVM's. Note that this check
+@@ -7400,6 +7409,14 @@ static void x86_cpu_realizefn(DeviceState *dev, Error **errp)
+         if (cpu->phys_bits == 0) {
+             cpu->phys_bits = TCG_PHYS_ADDR_BITS;
+         }
++        if (cpu->guest_phys_bits &&
++            (cpu->guest_phys_bits > cpu->phys_bits ||
++            cpu->guest_phys_bits < 32)) {
++            error_setg(errp, "guest-phys-bits should be between 32 and %u "
++                             " (but is %u)",
++                             cpu->phys_bits, cpu->guest_phys_bits);
++            return;
++        }
+     } else {
+         /* For 32 bit systems don't use the user set value, but keep
+          * phys_bits consistent with what we tell the guest.
+@@ -7408,6 +7425,10 @@ static void x86_cpu_realizefn(DeviceState *dev, Error **errp)
+             error_setg(errp, "phys-bits is not user-configurable in 32 bit");
+             return;
+         }
++        if (cpu->guest_phys_bits != 0) {
++            error_setg(errp, "guest-phys-bits is not user-configurable in 32 bit");
++            return;
++        }
+ 
+         if (env->features[FEAT_1_EDX] & (CPUID_PSE36 | CPUID_PAE)) {
+             cpu->phys_bits = 36;
+@@ -7908,6 +7929,7 @@ static Property x86_cpu_properties[] = {
+     DEFINE_PROP_BOOL("x-force-features", X86CPU, force_features, false),
+     DEFINE_PROP_BOOL("kvm", X86CPU, expose_kvm, true),
+     DEFINE_PROP_UINT32("phys-bits", X86CPU, phys_bits, 0),
++    DEFINE_PROP_UINT32("guest-phys-bits", X86CPU, guest_phys_bits, -1),
+     DEFINE_PROP_BOOL("host-phys-bits", X86CPU, host_phys_bits, false),
+     DEFINE_PROP_UINT8("host-phys-bits-limit", X86CPU, host_phys_bits_limit, 0),
+     DEFINE_PROP_BOOL("fill-mtrr-mask", X86CPU, fill_mtrr_mask, true),
+diff --git a/target/i386/cpu.h b/target/i386/cpu.h
+index 6b05738079..6112e27bfd 100644
+--- a/target/i386/cpu.h
++++ b/target/i386/cpu.h
+@@ -2027,6 +2027,14 @@ struct ArchCPU {
+     /* Number of physical address bits supported */
+     uint32_t phys_bits;
+ 
++    /*
++     * Number of guest physical address bits available. Usually this is
++     * identical to host physical address bits. With NPT or EPT 4-level
++     * paging, guest physical address space might be restricted to 48 bits
++     * even if the host cpu supports more physical address bits.
++     */
++    uint32_t guest_phys_bits;
++
+     /* in order to simplify APIC support, we leave this pointer to the
+        user */
+     struct DeviceState *apic_state;
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-target-i386-introduce-x86-confidential-guest.patch b/SOURCES/kvm-target-i386-introduce-x86-confidential-guest.patch
new file mode 100644
index 0000000..dec3220
--- /dev/null
+++ b/SOURCES/kvm-target-i386-introduce-x86-confidential-guest.patch
@@ -0,0 +1,161 @@
+From 0573fcd1775b6613127b1906d59d02e65f7519f3 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Mon, 18 Mar 2024 11:07:43 -0400
+Subject: [PATCH 021/100] target/i386: introduce x86-confidential-guest
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [21/91] e86d3bcde7e1c2fa1ba8c9bc83e02033644f1ac0 (bonzini/rhel-qemu-kvm)
+
+Introduce a common superclass for x86 confidential guest implementations.
+It will extend ConfidentialGuestSupportClass with a method that provides
+the VM type to be passed to KVM_CREATE_VM.
+
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit d82e9c843d662f13821026618aba936eda31a6c0)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ target/i386/confidential-guest.c | 33 ++++++++++++++++++++++++++
+ target/i386/confidential-guest.h | 40 ++++++++++++++++++++++++++++++++
+ target/i386/meson.build          |  2 +-
+ target/i386/sev.c                |  6 ++---
+ 4 files changed, 77 insertions(+), 4 deletions(-)
+ create mode 100644 target/i386/confidential-guest.c
+ create mode 100644 target/i386/confidential-guest.h
+
+diff --git a/target/i386/confidential-guest.c b/target/i386/confidential-guest.c
+new file mode 100644
+index 0000000000..b3727845ad
+--- /dev/null
++++ b/target/i386/confidential-guest.c
+@@ -0,0 +1,33 @@
++/*
++ * QEMU Confidential Guest support
++ *
++ * Copyright (C) 2024 Red Hat, Inc.
++ *
++ * Authors:
++ *  Paolo Bonzini <pbonzini@redhat.com>
++ *
++ * This work is licensed under the terms of the GNU GPL, version 2 or
++ * later.  See the COPYING file in the top-level directory.
++ *
++ */
++
++#include "qemu/osdep.h"
++
++#include "confidential-guest.h"
++
++OBJECT_DEFINE_ABSTRACT_TYPE(X86ConfidentialGuest,
++                            x86_confidential_guest,
++                            X86_CONFIDENTIAL_GUEST,
++                            CONFIDENTIAL_GUEST_SUPPORT)
++
++static void x86_confidential_guest_class_init(ObjectClass *oc, void *data)
++{
++}
++
++static void x86_confidential_guest_init(Object *obj)
++{
++}
++
++static void x86_confidential_guest_finalize(Object *obj)
++{
++}
+diff --git a/target/i386/confidential-guest.h b/target/i386/confidential-guest.h
+new file mode 100644
+index 0000000000..ca12d5a8fb
+--- /dev/null
++++ b/target/i386/confidential-guest.h
+@@ -0,0 +1,40 @@
++/*
++ * x86-specific confidential guest methods.
++ *
++ * Copyright (c) 2024 Red Hat Inc.
++ *
++ * Authors:
++ *  Paolo Bonzini <pbonzini@redhat.com>
++ *
++ * This work is licensed under the terms of the GNU GPL, version 2 or later.
++ * See the COPYING file in the top-level directory.
++ */
++#ifndef TARGET_I386_CG_H
++#define TARGET_I386_CG_H
++
++#include "qom/object.h"
++
++#include "exec/confidential-guest-support.h"
++
++#define TYPE_X86_CONFIDENTIAL_GUEST "x86-confidential-guest"
++
++OBJECT_DECLARE_TYPE(X86ConfidentialGuest,
++                    X86ConfidentialGuestClass,
++                    X86_CONFIDENTIAL_GUEST)
++
++struct X86ConfidentialGuest {
++    /* <private> */
++    ConfidentialGuestSupport parent_obj;
++};
++
++/**
++ * X86ConfidentialGuestClass:
++ *
++ * Class to be implemented by confidential-guest-support concrete objects
++ * for the x86 target.
++ */
++struct X86ConfidentialGuestClass {
++    /* <private> */
++    ConfidentialGuestSupportClass parent;
++};
++#endif
+diff --git a/target/i386/meson.build b/target/i386/meson.build
+index 7c74bfa859..8abce725f8 100644
+--- a/target/i386/meson.build
++++ b/target/i386/meson.build
+@@ -6,7 +6,7 @@ i386_ss.add(files(
+   'xsave_helper.c',
+   'cpu-dump.c',
+ ))
+-i386_ss.add(when: 'CONFIG_SEV', if_true: files('host-cpu.c'))
++i386_ss.add(when: 'CONFIG_SEV', if_true: files('host-cpu.c', 'confidential-guest.c'))
+ 
+ # x86 cpu type
+ i386_ss.add(when: 'CONFIG_KVM', if_true: files('host-cpu.c'))
+diff --git a/target/i386/sev.c b/target/i386/sev.c
+index c49a8fd55e..ebe36d4c10 100644
+--- a/target/i386/sev.c
++++ b/target/i386/sev.c
+@@ -35,7 +35,7 @@
+ #include "monitor/monitor.h"
+ #include "monitor/hmp-target.h"
+ #include "qapi/qapi-commands-misc-target.h"
+-#include "exec/confidential-guest-support.h"
++#include "confidential-guest.h"
+ #include "hw/i386/pc.h"
+ #include "exec/address-spaces.h"
+ 
+@@ -54,7 +54,7 @@ OBJECT_DECLARE_SIMPLE_TYPE(SevGuestState, SEV_GUEST)
+  *         -machine ...,memory-encryption=sev0
+  */
+ struct SevGuestState {
+-    ConfidentialGuestSupport parent_obj;
++    X86ConfidentialGuest parent_obj;
+ 
+     /* configuration parameters */
+     char *sev_device;
+@@ -1372,7 +1372,7 @@ sev_guest_instance_init(Object *obj)
+ 
+ /* sev guest info */
+ static const TypeInfo sev_guest_info = {
+-    .parent = TYPE_CONFIDENTIAL_GUEST_SUPPORT,
++    .parent = TYPE_X86_CONFIDENTIAL_GUEST,
+     .name = TYPE_SEV_GUEST,
+     .instance_size = sizeof(SevGuestState),
+     .instance_finalize = sev_guest_finalize,
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-target-s390x-kvm-pv-Provide-some-more-useful-informa.patch b/SOURCES/kvm-target-s390x-kvm-pv-Provide-some-more-useful-informa.patch
deleted file mode 100644
index a2d712f..0000000
--- a/SOURCES/kvm-target-s390x-kvm-pv-Provide-some-more-useful-informa.patch
+++ /dev/null
@@ -1,205 +0,0 @@
-From cc8d794932e26df7c7f3c8cc0c1f42da8d52f12b Mon Sep 17 00:00:00 2001
-From: Thomas Huth <thuth@redhat.com>
-Date: Mon, 15 Jan 2024 10:26:52 +0100
-Subject: [PATCH 069/101] target/s390x/kvm/pv: Provide some more useful
- information if decryption fails
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Thomas Huth <thuth@redhat.com>
-RH-MergeRequest: 213: s390x: Provide some more useful information if decryption of a PV image fails
-RH-Jira: RHEL-18212
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
-RH-Commit: [1/1] 4ffb61869f7df33e23d3e0ebf8c29e386e3f6cbc (thuth/qemu-kvm-cs9)
-
-JIRA: https://issues.redhat.com/browse/RHEL-18212
-
-commit 7af51621b16ae86646cc2dc9dee30de8176ff761
-Author: Thomas Huth <thuth@redhat.com>
-Date:   Wed Jan 10 15:29:16 2024 +0100
-
-    target/s390x/kvm/pv: Provide some more useful information if decryption fails
-
-    It's a common scenario to copy guest images from one host to another
-    to run the guest on the other machine. This (of course) does not work
-    with "secure execution" guests since they are encrypted with one certain
-    host key. However, if you still (accidentally) do it, you only get a
-    very user-unfriendly error message that looks like this:
-
-     qemu-system-s390x: KVM PV command 2 (KVM_PV_SET_SEC_PARMS) failed:
-      header rc 108 rrc 5 IOCTL rc: -22
-
-    Let's provide at least a somewhat nicer hint to the users so that they
-    are able to figure out what might have gone wrong.
-
-    Buglink: https://issues.redhat.com/browse/RHEL-18212
-    Message-ID: <20240110142916.850605-1-thuth@redhat.com>
-    Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-    Reviewed-by: Cédric Le Goater <clg@redhat.com>
-    Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
-    Signed-off-by: Thomas Huth <thuth@redhat.com>
-
-Signed-off-by: Thomas Huth <thuth@redhat.com>
----
- hw/s390x/ipl.c             |  5 ++---
- hw/s390x/ipl.h             |  2 +-
- hw/s390x/s390-virtio-ccw.c |  5 ++++-
- target/s390x/kvm/pv.c      | 25 ++++++++++++++++++++-----
- target/s390x/kvm/pv.h      |  5 +++--
- 5 files changed, 30 insertions(+), 12 deletions(-)
-
-diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
-index 515dcf51b5..b23a6a0ef3 100644
---- a/hw/s390x/ipl.c
-+++ b/hw/s390x/ipl.c
-@@ -703,7 +703,7 @@ static void s390_ipl_prepare_qipl(S390CPU *cpu)
-     cpu_physical_memory_unmap(addr, len, 1, len);
- }
- 
--int s390_ipl_prepare_pv_header(void)
-+int s390_ipl_prepare_pv_header(Error **errp)
- {
-     IplParameterBlock *ipib = s390_ipl_get_iplb_pv();
-     IPLBlockPV *ipib_pv = &ipib->pv;
-@@ -712,8 +712,7 @@ int s390_ipl_prepare_pv_header(void)
- 
-     cpu_physical_memory_read(ipib_pv->pv_header_addr, hdr,
-                              ipib_pv->pv_header_len);
--    rc = s390_pv_set_sec_parms((uintptr_t)hdr,
--                               ipib_pv->pv_header_len);
-+    rc = s390_pv_set_sec_parms((uintptr_t)hdr, ipib_pv->pv_header_len, errp);
-     g_free(hdr);
-     return rc;
- }
-diff --git a/hw/s390x/ipl.h b/hw/s390x/ipl.h
-index 7fc86e7905..57cd125769 100644
---- a/hw/s390x/ipl.h
-+++ b/hw/s390x/ipl.h
-@@ -107,7 +107,7 @@ typedef union IplParameterBlock IplParameterBlock;
- 
- int s390_ipl_set_loadparm(uint8_t *loadparm);
- void s390_ipl_update_diag308(IplParameterBlock *iplb);
--int s390_ipl_prepare_pv_header(void);
-+int s390_ipl_prepare_pv_header(Error **errp);
- int s390_ipl_pv_unpack(void);
- void s390_ipl_prepare_cpu(S390CPU *cpu);
- IplParameterBlock *s390_ipl_get_iplb(void);
-diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
-index 984891b82a..e26ce26f5a 100644
---- a/hw/s390x/s390-virtio-ccw.c
-+++ b/hw/s390x/s390-virtio-ccw.c
-@@ -391,7 +391,7 @@ static int s390_machine_protect(S390CcwMachineState *ms)
-     }
- 
-     /* Set SE header and unpack */
--    rc = s390_ipl_prepare_pv_header();
-+    rc = s390_ipl_prepare_pv_header(&local_err);
-     if (rc) {
-         goto out_err;
-     }
-@@ -410,6 +410,9 @@ static int s390_machine_protect(S390CcwMachineState *ms)
-     return rc;
- 
- out_err:
-+    if (local_err) {
-+        error_report_err(local_err);
-+    }
-     s390_machine_unprotect(ms);
-     return rc;
- }
-diff --git a/target/s390x/kvm/pv.c b/target/s390x/kvm/pv.c
-index 6a69be7e5c..7ca7faec73 100644
---- a/target/s390x/kvm/pv.c
-+++ b/target/s390x/kvm/pv.c
-@@ -29,7 +29,8 @@ static bool info_valid;
- static struct kvm_s390_pv_info_vm info_vm;
- static struct kvm_s390_pv_info_dump info_dump;
- 
--static int __s390_pv_cmd(uint32_t cmd, const char *cmdname, void *data)
-+static int __s390_pv_cmd(uint32_t cmd, const char *cmdname, void *data,
-+                         int *pvrc)
- {
-     struct kvm_pv_cmd pv_cmd = {
-         .cmd = cmd,
-@@ -46,6 +47,9 @@ static int __s390_pv_cmd(uint32_t cmd, const char *cmdname, void *data)
-                      "IOCTL rc: %d", cmd, cmdname, pv_cmd.rc, pv_cmd.rrc,
-                      rc);
-     }
-+    if (pvrc) {
-+        *pvrc = pv_cmd.rc;
-+    }
-     return rc;
- }
- 
-@@ -53,12 +57,13 @@ static int __s390_pv_cmd(uint32_t cmd, const char *cmdname, void *data)
-  * This macro lets us pass the command as a string to the function so
-  * we can print it on an error.
-  */
--#define s390_pv_cmd(cmd, data) __s390_pv_cmd(cmd, #cmd, data)
-+#define s390_pv_cmd(cmd, data) __s390_pv_cmd(cmd, #cmd, data, NULL)
-+#define s390_pv_cmd_pvrc(cmd, data, pvrc) __s390_pv_cmd(cmd, #cmd, data, pvrc)
- #define s390_pv_cmd_exit(cmd, data)    \
- {                                      \
-     int rc;                            \
-                                        \
--    rc = __s390_pv_cmd(cmd, #cmd, data);\
-+    rc = __s390_pv_cmd(cmd, #cmd, data, NULL); \
-     if (rc) {                          \
-         exit(1);                       \
-     }                                  \
-@@ -142,14 +147,24 @@ bool s390_pv_vm_try_disable_async(S390CcwMachineState *ms)
-     return true;
- }
- 
--int s390_pv_set_sec_parms(uint64_t origin, uint64_t length)
-+int s390_pv_set_sec_parms(uint64_t origin, uint64_t length, Error **errp)
- {
-+    int ret, pvrc;
-     struct kvm_s390_pv_sec_parm args = {
-         .origin = origin,
-         .length = length,
-     };
- 
--    return s390_pv_cmd(KVM_PV_SET_SEC_PARMS, &args);
-+    ret = s390_pv_cmd_pvrc(KVM_PV_SET_SEC_PARMS, &args, &pvrc);
-+    if (ret) {
-+        error_setg(errp, "Failed to set secure execution parameters");
-+        if (pvrc == 0x108) {
-+            error_append_hint(errp, "Please check whether the image is "
-+                                    "correctly encrypted for this host\n");
-+        }
-+    }
-+
-+    return ret;
- }
- 
- /*
-diff --git a/target/s390x/kvm/pv.h b/target/s390x/kvm/pv.h
-index 7b935e2246..5877d28ff1 100644
---- a/target/s390x/kvm/pv.h
-+++ b/target/s390x/kvm/pv.h
-@@ -42,7 +42,7 @@ int s390_pv_query_info(void);
- int s390_pv_vm_enable(void);
- void s390_pv_vm_disable(void);
- bool s390_pv_vm_try_disable_async(S390CcwMachineState *ms);
--int s390_pv_set_sec_parms(uint64_t origin, uint64_t length);
-+int s390_pv_set_sec_parms(uint64_t origin, uint64_t length, Error **errp);
- int s390_pv_unpack(uint64_t addr, uint64_t size, uint64_t tweak);
- void s390_pv_prep_reset(void);
- int s390_pv_verify(void);
-@@ -62,7 +62,8 @@ static inline int s390_pv_query_info(void) { return 0; }
- static inline int s390_pv_vm_enable(void) { return 0; }
- static inline void s390_pv_vm_disable(void) {}
- static inline bool s390_pv_vm_try_disable_async(S390CcwMachineState *ms) { return false; }
--static inline int s390_pv_set_sec_parms(uint64_t origin, uint64_t length) { return 0; }
-+static inline int s390_pv_set_sec_parms(uint64_t origin, uint64_t length,
-+                                        Error **errp) { return 0; }
- static inline int s390_pv_unpack(uint64_t addr, uint64_t size, uint64_t tweak) { return 0; }
- static inline void s390_pv_prep_reset(void) {}
- static inline int s390_pv_verify(void) { return 0; }
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-tests-remove-aio_context_acquire-tests.patch b/SOURCES/kvm-tests-remove-aio_context_acquire-tests.patch
deleted file mode 100644
index 9b3eefb..0000000
--- a/SOURCES/kvm-tests-remove-aio_context_acquire-tests.patch
+++ /dev/null
@@ -1,125 +0,0 @@
-From 420bf75353286324822c3bbca3b52a7a56ed668c Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Tue, 5 Dec 2023 13:20:00 -0500
-Subject: [PATCH 083/101] tests: remove aio_context_acquire() tests
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 214: Remove AioContext lock
-RH-Jira: RHEL-15965
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [14/26] f6421037c1523bc957f3be0f4ad05571ae012dba (kmwolf/centos-qemu-kvm)
-
-The aio_context_acquire() API is being removed. Drop the test case that
-calls the API.
-
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Message-ID: <20231205182011.1976568-4-stefanha@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- tests/unit/test-aio.c | 67 +------------------------------------------
- 1 file changed, 1 insertion(+), 66 deletions(-)
-
-diff --git a/tests/unit/test-aio.c b/tests/unit/test-aio.c
-index 337b6e4ea7..e77d86be87 100644
---- a/tests/unit/test-aio.c
-+++ b/tests/unit/test-aio.c
-@@ -100,76 +100,12 @@ static void event_ready_cb(EventNotifier *e)
- 
- /* Tests using aio_*.  */
- 
--typedef struct {
--    QemuMutex start_lock;
--    EventNotifier notifier;
--    bool thread_acquired;
--} AcquireTestData;
--
--static void *test_acquire_thread(void *opaque)
--{
--    AcquireTestData *data = opaque;
--
--    /* Wait for other thread to let us start */
--    qemu_mutex_lock(&data->start_lock);
--    qemu_mutex_unlock(&data->start_lock);
--
--    /* event_notifier_set might be called either before or after
--     * the main thread's call to poll().  The test case's outcome
--     * should be the same in either case.
--     */
--    event_notifier_set(&data->notifier);
--    aio_context_acquire(ctx);
--    aio_context_release(ctx);
--
--    data->thread_acquired = true; /* success, we got here */
--
--    return NULL;
--}
--
- static void set_event_notifier(AioContext *nctx, EventNotifier *notifier,
-                                EventNotifierHandler *handler)
- {
-     aio_set_event_notifier(nctx, notifier, handler, NULL, NULL);
- }
- 
--static void dummy_notifier_read(EventNotifier *n)
--{
--    event_notifier_test_and_clear(n);
--}
--
--static void test_acquire(void)
--{
--    QemuThread thread;
--    AcquireTestData data;
--
--    /* Dummy event notifier ensures aio_poll() will block */
--    event_notifier_init(&data.notifier, false);
--    set_event_notifier(ctx, &data.notifier, dummy_notifier_read);
--    g_assert(!aio_poll(ctx, false)); /* consume aio_notify() */
--
--    qemu_mutex_init(&data.start_lock);
--    qemu_mutex_lock(&data.start_lock);
--    data.thread_acquired = false;
--
--    qemu_thread_create(&thread, "test_acquire_thread",
--                       test_acquire_thread,
--                       &data, QEMU_THREAD_JOINABLE);
--
--    /* Block in aio_poll(), let other thread kick us and acquire context */
--    aio_context_acquire(ctx);
--    qemu_mutex_unlock(&data.start_lock); /* let the thread run */
--    g_assert(aio_poll(ctx, true));
--    g_assert(!data.thread_acquired);
--    aio_context_release(ctx);
--
--    qemu_thread_join(&thread);
--    set_event_notifier(ctx, &data.notifier, NULL);
--    event_notifier_cleanup(&data.notifier);
--
--    g_assert(data.thread_acquired);
--}
--
- static void test_bh_schedule(void)
- {
-     BHTestData data = { .n = 0 };
-@@ -879,7 +815,7 @@ static void test_worker_thread_co_enter(void)
-     qemu_thread_get_self(&this_thread);
-     co = qemu_coroutine_create(co_check_current_thread, &this_thread);
- 
--    qemu_thread_create(&worker_thread, "test_acquire_thread",
-+    qemu_thread_create(&worker_thread, "test_aio_co_enter",
-                        test_aio_co_enter,
-                        co, QEMU_THREAD_JOINABLE);
- 
-@@ -899,7 +835,6 @@ int main(int argc, char **argv)
-     while (g_main_context_iteration(NULL, false));
- 
-     g_test_init(&argc, &argv, NULL);
--    g_test_add_func("/aio/acquire",                 test_acquire);
-     g_test_add_func("/aio/bh/schedule",             test_bh_schedule);
-     g_test_add_func("/aio/bh/schedule10",           test_bh_schedule10);
-     g_test_add_func("/aio/bh/cancel",               test_bh_cancel);
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-tests-unit-Bump-test-replication-timeout-to-60-secon.patch b/SOURCES/kvm-tests-unit-Bump-test-replication-timeout-to-60-secon.patch
deleted file mode 100644
index 0afdea2..0000000
--- a/SOURCES/kvm-tests-unit-Bump-test-replication-timeout-to-60-secon.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From bbe64d706b3cb8b10ecd22bd71cf76b21eea257f Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Thu, 25 Jan 2024 17:58:03 +0100
-Subject: [PATCH 20/22] tests/unit: Bump test-replication timeout to 60 seconds
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 219: virtio-blk: add iothread-vq-mapping parameter
-RH-Jira: RHEL-17369 RHEL-20764 RHEL-7356
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Commit: [16/17] 200768aedee44d10aa8d199b92a9c17a9002fc3f (stefanha/centos-stream-qemu-kvm)
-
-We're seeing timeouts for this test on CI runs (specifically for
-ubuntu-20.04-s390x-all). It doesn't fail consistently, but even the
-successful runs take about 27 or 28 seconds, which is not very far from
-the 30 seconds timeout.
-
-Bump the timeout a bit to make failure less likely even on this CI host.
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Message-ID: <20240125165803.48373-1-kwolf@redhat.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 63b18312d14ac984acaf13c7c55d9baa2d61496e)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- tests/unit/meson.build | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/tests/unit/meson.build b/tests/unit/meson.build
-index a05d471090..28db6adea8 100644
---- a/tests/unit/meson.build
-+++ b/tests/unit/meson.build
-@@ -173,7 +173,8 @@ test_env.set('G_TEST_BUILDDIR', meson.current_build_dir())
- 
- slow_tests = {
-   'test-crypto-tlscredsx509': 45,
--  'test-crypto-tlssession': 45
-+  'test-crypto-tlssession': 45,
-+  'test-replication': 60,
- }
- 
- foreach test_name, extra: tests
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-trace-kvm-Split-address-space-and-slot-id-in-trace_k.patch b/SOURCES/kvm-trace-kvm-Split-address-space-and-slot-id-in-trace_k.patch
new file mode 100644
index 0000000..d21d298
--- /dev/null
+++ b/SOURCES/kvm-trace-kvm-Split-address-space-and-slot-id-in-trace_k.patch
@@ -0,0 +1,59 @@
+From b02dc1e5c0f01228053e784f9ec7ac3a47e91d7c Mon Sep 17 00:00:00 2001
+From: Xiaoyao Li <xiaoyao.li@intel.com>
+Date: Thu, 29 Feb 2024 01:36:25 -0500
+Subject: [PATCH 026/100] trace/kvm: Split address space and slot id in
+ trace_kvm_set_user_memory()
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [26/91] 640511c4ab0ba76bb4483f6c3fb73e060d914f0a (bonzini/rhel-qemu-kvm)
+
+The upper 16 bits of kvm_userspace_memory_region::slot are
+address space id. Parse it separately in trace_kvm_set_user_memory().
+
+Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
+Message-ID: <20240229063726.610065-5-xiaoyao.li@intel.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 72853afc638b3e28779c86dd05da2f3bb149fe2c)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ accel/kvm/kvm-all.c    | 5 +++--
+ accel/kvm/trace-events | 2 +-
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
+index b51e09a583..9bd235c969 100644
+--- a/accel/kvm/kvm-all.c
++++ b/accel/kvm/kvm-all.c
+@@ -303,8 +303,9 @@ static int kvm_set_user_memory_region(KVMMemoryListener *kml, KVMSlot *slot, boo
+     ret = kvm_vm_ioctl(s, KVM_SET_USER_MEMORY_REGION, &mem);
+     slot->old_flags = mem.flags;
+ err:
+-    trace_kvm_set_user_memory(mem.slot, mem.flags, mem.guest_phys_addr,
+-                              mem.memory_size, mem.userspace_addr, ret);
++    trace_kvm_set_user_memory(mem.slot >> 16, (uint16_t)mem.slot, mem.flags,
++                              mem.guest_phys_addr, mem.memory_size,
++                              mem.userspace_addr, ret);
+     if (ret < 0) {
+         error_report("%s: KVM_SET_USER_MEMORY_REGION failed, slot=%d,"
+                      " start=0x%" PRIx64 ", size=0x%" PRIx64 ": %s",
+diff --git a/accel/kvm/trace-events b/accel/kvm/trace-events
+index a25902597b..9f599abc17 100644
+--- a/accel/kvm/trace-events
++++ b/accel/kvm/trace-events
+@@ -15,7 +15,7 @@ kvm_irqchip_update_msi_route(int virq) "Updating MSI route virq=%d"
+ kvm_irqchip_release_virq(int virq) "virq %d"
+ kvm_set_ioeventfd_mmio(int fd, uint64_t addr, uint32_t val, bool assign, uint32_t size, bool datamatch) "fd: %d @0x%" PRIx64 " val=0x%x assign: %d size: %d match: %d"
+ kvm_set_ioeventfd_pio(int fd, uint16_t addr, uint32_t val, bool assign, uint32_t size, bool datamatch) "fd: %d @0x%x val=0x%x assign: %d size: %d match: %d"
+-kvm_set_user_memory(uint32_t slot, uint32_t flags, uint64_t guest_phys_addr, uint64_t memory_size, uint64_t userspace_addr, int ret) "Slot#%d flags=0x%x gpa=0x%"PRIx64 " size=0x%"PRIx64 " ua=0x%"PRIx64 " ret=%d"
++kvm_set_user_memory(uint16_t as, uint16_t slot, uint32_t flags, uint64_t guest_phys_addr, uint64_t memory_size, uint64_t userspace_addr, int ret) "AddrSpace#%d Slot#%d flags=0x%x gpa=0x%"PRIx64 " size=0x%"PRIx64 " ua=0x%"PRIx64 " ret=%d"
+ kvm_clear_dirty_log(uint32_t slot, uint64_t start, uint32_t size) "slot#%"PRId32" start 0x%"PRIx64" size 0x%"PRIx32
+ kvm_resample_fd_notify(int gsi) "gsi %d"
+ kvm_dirty_ring_full(int id) "vcpu %d"
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-ui-clipboard-add-asserts-for-update-and-request.patch b/SOURCES/kvm-ui-clipboard-add-asserts-for-update-and-request.patch
deleted file mode 100644
index b51961c..0000000
--- a/SOURCES/kvm-ui-clipboard-add-asserts-for-update-and-request.patch
+++ /dev/null
@@ -1,81 +0,0 @@
-From 6e4f68e9ba3fe75ca6f200f189f96bb402f0ee8e Mon Sep 17 00:00:00 2001
-From: Fiona Ebner <f.ebner@proxmox.com>
-Date: Wed, 24 Jan 2024 11:57:49 +0100
-Subject: [PATCH 02/20] ui/clipboard: add asserts for update and request
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Jon Maloy <jmaloy@redhat.com>
-RH-MergeRequest: 228: ui/clipboard: mark type as not available when there is no data
-RH-Jira: RHEL-19629
-RH-Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
-RH-Acked-by: Gerd Hoffmann <None>
-RH-Commit: [2/2] 176b4b835fd8aa226f2fa93fd334b9384080cf21 (jmaloy/jmaloy-qemu-kvm-2)
-
-JIRA: https://issues.redhat.com/browse/RHEL-19629
-CVE: CVE-2023-6683
-Upstream: Merged
-
-ui/clipboard: add asserts for update and request
-
-commit 9c416582611b7495bdddb4c5456c7acb64b78938
-Author: Fiona Ebner <f.ebner@proxmox.com>
-Date:   Wed Jan 24 11:57:49 2024 +0100
-
-    ui/clipboard: add asserts for update and request
-
-    Should an issue like CVE-2023-6683 ever appear again in the future,
-    it will be more obvious which assumption was violated.
-
-    Suggested-by: Marc-André Lureau <marcandre.lureau@redhat.com>
-    Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
-    Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
-    Message-ID: <20240124105749.204610-2-f.ebner@proxmox.com>
-
-Signed-off-by: Jon Maloy <jmaloy@redhat.com>
----
- ui/clipboard.c | 14 ++++++++++++++
- 1 file changed, 14 insertions(+)
-
-diff --git a/ui/clipboard.c b/ui/clipboard.c
-index b3f6fa3c9e..4264884a6c 100644
---- a/ui/clipboard.c
-+++ b/ui/clipboard.c
-@@ -65,12 +65,24 @@ bool qemu_clipboard_check_serial(QemuClipboardInfo *info, bool client)
- 
- void qemu_clipboard_update(QemuClipboardInfo *info)
- {
-+    uint32_t type;
-     QemuClipboardNotify notify = {
-         .type = QEMU_CLIPBOARD_UPDATE_INFO,
-         .info = info,
-     };
-     assert(info->selection < QEMU_CLIPBOARD_SELECTION__COUNT);
- 
-+    for (type = 0; type < QEMU_CLIPBOARD_TYPE__COUNT; type++) {
-+        /*
-+         * If data is missing, the clipboard owner's 'request' callback needs to
-+         * be set. Otherwise, there is no way to get the clipboard data and
-+         * qemu_clipboard_request() cannot be called.
-+         */
-+        if (info->types[type].available && !info->types[type].data) {
-+            assert(info->owner && info->owner->request);
-+        }
-+    }
-+
-     notifier_list_notify(&clipboard_notifiers, &notify);
- 
-     if (cbinfo[info->selection] != info) {
-@@ -132,6 +144,8 @@ void qemu_clipboard_request(QemuClipboardInfo *info,
-         !info->owner)
-         return;
- 
-+    assert(info->owner->request);
-+
-     info->types[type].requested = true;
-     info->owner->request(info, type);
- }
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-ui-clipboard-mark-type-as-not-available-when-there-i.patch b/SOURCES/kvm-ui-clipboard-mark-type-as-not-available-when-there-i.patch
deleted file mode 100644
index 00c9369..0000000
--- a/SOURCES/kvm-ui-clipboard-mark-type-as-not-available-when-there-i.patch
+++ /dev/null
@@ -1,107 +0,0 @@
-From 097516bef2993d917e76d92066ca2eb067e45394 Mon Sep 17 00:00:00 2001
-From: Fiona Ebner <f.ebner@proxmox.com>
-Date: Wed, 24 Jan 2024 11:57:48 +0100
-Subject: [PATCH 01/20] ui/clipboard: mark type as not available when there is
- no data
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Jon Maloy <jmaloy@redhat.com>
-RH-MergeRequest: 228: ui/clipboard: mark type as not available when there is no data
-RH-Jira: RHEL-19629
-RH-Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
-RH-Acked-by: Gerd Hoffmann <None>
-RH-Commit: [1/2] 74ded03d6376f9693733d673502219f76eab7099 (jmaloy/jmaloy-qemu-kvm-2)
-
-JIRA: https://issues.redhat.com/browse/RHEL-19629
-CVE: CVE-2023-6683
-Upstream: Merged
-
-commit 405484b29f6548c7b86549b0f961b906337aa68a
-Author: Fiona Ebner <f.ebner@proxmox.com>
-Date:   Wed Jan 24 11:57:48 2024 +0100
-
-    ui/clipboard: mark type as not available when there is no data
-
-    With VNC, a client can send a non-extended VNC_MSG_CLIENT_CUT_TEXT
-    message with len=0. In qemu_clipboard_set_data(), the clipboard info
-    will be updated setting data to NULL (because g_memdup(data, size)
-    returns NULL when size is 0). If the client does not set the
-    VNC_ENCODING_CLIPBOARD_EXT feature when setting up the encodings, then
-    the 'request' callback for the clipboard peer is not initialized.
-    Later, because data is NULL, qemu_clipboard_request() can be reached
-    via vdagent_chr_write() and vdagent_clipboard_recv_request() and
-    there, the clipboard owner's 'request' callback will be attempted to
-    be called, but that is a NULL pointer.
-
-    In particular, this can happen when using the KRDC (22.12.3) VNC
-    client.
-
-    Another scenario leading to the same issue is with two clients (say
-    noVNC and KRDC):
-
-    The noVNC client sets the extension VNC_FEATURE_CLIPBOARD_EXT and
-    initializes its cbpeer.
-
-    The KRDC client does not, but triggers a vnc_client_cut_text() (note
-    it's not the _ext variant)). There, a new clipboard info with it as
-    the 'owner' is created and via qemu_clipboard_set_data() is called,
-    which in turn calls qemu_clipboard_update() with that info.
-
-    In qemu_clipboard_update(), the notifier for the noVNC client will be
-    called, i.e. vnc_clipboard_notify() and also set vs->cbinfo for the
-    noVNC client. The 'owner' in that clipboard info is the clipboard peer
-    for the KRDC client, which did not initialize the 'request' function.
-    That sounds correct to me, it is the owner of that clipboard info.
-
-    Then when noVNC sends a VNC_MSG_CLIENT_CUT_TEXT message (it did set
-    the VNC_FEATURE_CLIPBOARD_EXT feature correctly, so a check for it
-    passes), that clipboard info is passed to qemu_clipboard_request() and
-    the original segfault still happens.
-
-    Fix the issue by handling updates with size 0 differently. In
-    particular, mark in the clipboard info that the type is not available.
-
-    While at it, switch to g_memdup2(), because g_memdup() is deprecated.
-
-    Cc: qemu-stable@nongnu.org
-    Fixes: CVE-2023-6683
-    Reported-by: Markus Frank <m.frank@proxmox.com>
-    Suggested-by: Marc-André Lureau <marcandre.lureau@redhat.com>
-    Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
-    Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
-    Tested-by: Markus Frank <m.frank@proxmox.com>
-    Message-ID: <20240124105749.204610-1-f.ebner@proxmox.com>
-
-Signed-off-by: Jon Maloy <jmaloy@redhat.com>
----
- ui/clipboard.c | 12 +++++++++---
- 1 file changed, 9 insertions(+), 3 deletions(-)
-
-diff --git a/ui/clipboard.c b/ui/clipboard.c
-index 3d14bffaf8..b3f6fa3c9e 100644
---- a/ui/clipboard.c
-+++ b/ui/clipboard.c
-@@ -163,9 +163,15 @@ void qemu_clipboard_set_data(QemuClipboardPeer *peer,
-     }
- 
-     g_free(info->types[type].data);
--    info->types[type].data = g_memdup(data, size);
--    info->types[type].size = size;
--    info->types[type].available = true;
-+    if (size) {
-+        info->types[type].data = g_memdup2(data, size);
-+        info->types[type].size = size;
-+        info->types[type].available = true;
-+    } else {
-+        info->types[type].data = NULL;
-+        info->types[type].size = 0;
-+        info->types[type].available = false;
-+    }
- 
-     if (update) {
-         qemu_clipboard_update(info);
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-update-linux-headers-fix-forwarding-to-asm-generic-h.patch b/SOURCES/kvm-update-linux-headers-fix-forwarding-to-asm-generic-h.patch
new file mode 100644
index 0000000..f141bf1
--- /dev/null
+++ b/SOURCES/kvm-update-linux-headers-fix-forwarding-to-asm-generic-h.patch
@@ -0,0 +1,62 @@
+From e185104a10a37174d13d981fa1febafbb7e651aa Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Mon, 3 Jun 2024 13:49:49 +0200
+Subject: [PATCH 050/100] update-linux-headers: fix forwarding to asm-generic
+ headers
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [50/91] 3c98a7fe790d943bb5ff8dca1da83f5944ec3e2e (bonzini/rhel-qemu-kvm)
+
+Afer commit 3efc75ad9d9 ("scripts/update-linux-headers.sh: Remove
+temporary directory inbetween", 2024-05-29), updating linux-headers/
+results in errors such as
+
+   cp: cannot stat '/tmp/tmp.1A1Eejh1UE/headers/include/asm/bitsperlong.h': No such file or directory
+
+because Loongarch does not have an asm/bitsperlong.h file and uses the
+generic version.  Before commit 3efc75ad9d9, the missing file would
+incorrectly cause stale files to be included in linux-headers/.  The files
+were never committed to qemu.git, but were wrong nevertheless. The build
+would just use the system version of the files, which is opposite to
+the idea of importing Linux header files into QEMU's tree.
+
+Create forwarding headers, resembling the ones that are generated during a
+kernel build by scripts/Makefile.asm-generic, if a file is only installed
+under include/asm-generic/.
+
+Reviewed-by: Thomas Huth <thuth@redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit ef7c70f020ca1fe9e7c98ea2cd9d6ba3c5714716)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ scripts/update-linux-headers.sh | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/scripts/update-linux-headers.sh b/scripts/update-linux-headers.sh
+index f084bee72e..78c0f2c43e 100755
+--- a/scripts/update-linux-headers.sh
++++ b/scripts/update-linux-headers.sh
+@@ -119,7 +119,14 @@ for arch in $ARCHLIST; do
+     rm -rf "$output/linux-headers/asm-$arch"
+     mkdir -p "$output/linux-headers/asm-$arch"
+     for header in kvm.h unistd.h bitsperlong.h mman.h; do
+-        cp "$hdrdir/include/asm/$header" "$output/linux-headers/asm-$arch"
++        if test -f "$hdrdir/include/asm/$header"; then
++            cp "$hdrdir/include/asm/$header" "$output/linux-headers/asm-$arch"
++        elif test -f "$hdrdir/include/asm-generic/$header"; then
++            # not installed as <asm/$header>, but used as such in kernel sources
++            cat <<EOF >$output/linux-headers/asm-$arch/$header
++#include <asm-generic/$header>
++EOF
++        fi
+     done
+ 
+     if [ $arch = mips ]; then
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-update-linux-headers-import-linux-kvm_para.h-header.patch b/SOURCES/kvm-update-linux-headers-import-linux-kvm_para.h-header.patch
new file mode 100644
index 0000000..a75a2aa
--- /dev/null
+++ b/SOURCES/kvm-update-linux-headers-import-linux-kvm_para.h-header.patch
@@ -0,0 +1,175 @@
+From 8d6c37ddc253f63202cc9519670c258e9d81b98e Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Mon, 3 Jun 2024 14:25:06 +0200
+Subject: [PATCH 053/100] update-linux-headers: import linux/kvm_para.h header
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [53/91] 27d4db0ecec7d0b8adeba1ec85fca32eacee1009 (bonzini/rhel-qemu-kvm)
+
+Right now QEMU is importing arch/x86/include/uapi/asm/kvm_para.h
+because it includes definitions for kvmclock and for KVM CPUID
+bits.  However, other definitions for KVM hypercall values and return
+codes are included in include/uapi/linux/kvm_para.h and they will be
+used by SEV-SNP.
+
+To ensure that it is possible to include both <linux/kvm_para.h> and
+"standard-headers/asm-x86/kvm_para.h" without conflicts, provide
+linux/kvm_para.h as a portable header too, and forward linux-headers/
+files to those in include/standard-headers.  Note that <linux/kvm_para.h>
+will include architecture-specific definitions as well, but
+"standard-headers/linux/kvm_para.h" will not because it can be used in
+architecture-independent files.
+
+This could easily be extended to other architectures, but right now
+they do not need any symbol in their specific kvm_para.h files.
+
+Reviewed-by: Thomas Huth <thuth@redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit aa274c33c39e7de981dc195abe60e1a246c9d248)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ include/standard-headers/linux/kvm_para.h | 38 +++++++++++++++++++++++
+ linux-headers/asm-x86/kvm_para.h          |  1 +
+ linux-headers/linux/kvm_para.h            |  2 ++
+ scripts/update-linux-headers.sh           | 22 ++++++++++++-
+ 4 files changed, 62 insertions(+), 1 deletion(-)
+ create mode 100644 include/standard-headers/linux/kvm_para.h
+ create mode 100644 linux-headers/asm-x86/kvm_para.h
+ create mode 100644 linux-headers/linux/kvm_para.h
+
+diff --git a/include/standard-headers/linux/kvm_para.h b/include/standard-headers/linux/kvm_para.h
+new file mode 100644
+index 0000000000..015c166302
+--- /dev/null
++++ b/include/standard-headers/linux/kvm_para.h
+@@ -0,0 +1,38 @@
++/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
++#ifndef __LINUX_KVM_PARA_H
++#define __LINUX_KVM_PARA_H
++
++/*
++ * This header file provides a method for making a hypercall to the host
++ * Architectures should define:
++ * - kvm_hypercall0, kvm_hypercall1...
++ * - kvm_arch_para_features
++ * - kvm_para_available
++ */
++
++/* Return values for hypercalls */
++#define KVM_ENOSYS		1000
++#define KVM_EFAULT		EFAULT
++#define KVM_EINVAL		EINVAL
++#define KVM_E2BIG		E2BIG
++#define KVM_EPERM		EPERM
++#define KVM_EOPNOTSUPP		95
++
++#define KVM_HC_VAPIC_POLL_IRQ		1
++#define KVM_HC_MMU_OP			2
++#define KVM_HC_FEATURES			3
++#define KVM_HC_PPC_MAP_MAGIC_PAGE	4
++#define KVM_HC_KICK_CPU			5
++#define KVM_HC_MIPS_GET_CLOCK_FREQ	6
++#define KVM_HC_MIPS_EXIT_VM		7
++#define KVM_HC_MIPS_CONSOLE_OUTPUT	8
++#define KVM_HC_CLOCK_PAIRING		9
++#define KVM_HC_SEND_IPI		10
++#define KVM_HC_SCHED_YIELD		11
++#define KVM_HC_MAP_GPA_RANGE		12
++
++/*
++ * hypercalls use architecture specific
++ */
++
++#endif /* __LINUX_KVM_PARA_H */
+diff --git a/linux-headers/asm-x86/kvm_para.h b/linux-headers/asm-x86/kvm_para.h
+new file mode 100644
+index 0000000000..1d3e0e0b07
+--- /dev/null
++++ b/linux-headers/asm-x86/kvm_para.h
+@@ -0,0 +1 @@
++#include "standard-headers/asm-x86/kvm_para.h"
+diff --git a/linux-headers/linux/kvm_para.h b/linux-headers/linux/kvm_para.h
+new file mode 100644
+index 0000000000..6a1e672259
+--- /dev/null
++++ b/linux-headers/linux/kvm_para.h
+@@ -0,0 +1,2 @@
++#include "standard-headers/linux/kvm_para.h"
++#include <asm/kvm_para.h>
+diff --git a/scripts/update-linux-headers.sh b/scripts/update-linux-headers.sh
+index 90759dcfe0..64d1989961 100755
+--- a/scripts/update-linux-headers.sh
++++ b/scripts/update-linux-headers.sh
+@@ -64,6 +64,7 @@ cp_portable() {
+                                      -e 'linux/kernel' \
+                                      -e 'linux/sysinfo' \
+                                      -e 'asm/setup_data.h' \
++                                     -e 'asm/kvm_para.h' \
+                                      > /dev/null
+     then
+         echo "Unexpected #include in input file $f".
+@@ -71,6 +72,15 @@ cp_portable() {
+     fi
+ 
+     header=$(basename "$f");
++
++    if test -z "$arch"; then
++        # Let users of include/standard-headers/linux/ headers pick the
++        # asm-* header that they care about
++        arch_cmd='/<asm\/\([^>]*\)>/d'
++    else
++        arch_cmd='s/<asm\/\([^>]*\)>/"standard-headers\/asm-'$arch'\/\1"/'
++    fi
++
+     sed -e 's/__aligned_u64/__u64 __attribute__((aligned(8)))/g' \
+         -e 's/__u\([0-9][0-9]*\)/uint\1_t/g' \
+         -e 's/u\([0-9][0-9]*\)/uint\1_t/g' \
+@@ -79,7 +89,7 @@ cp_portable() {
+         -e 's/__be\([0-9][0-9]*\)/uint\1_t/g' \
+         -e 's/"\(input-event-codes\.h\)"/"standard-headers\/linux\/\1"/' \
+         -e 's/<linux\/\([^>]*\)>/"standard-headers\/linux\/\1"/' \
+-        -e 's/<asm\/\([^>]*\)>/"standard-headers\/asm-'$arch'\/\1"/' \
++        -e "$arch_cmd" \
+         -e 's/__bitwise//' \
+         -e 's/__attribute__((packed))/QEMU_PACKED/' \
+         -e 's/__inline__/inline/' \
+@@ -159,7 +169,12 @@ EOF
+         cp "$hdrdir/include/asm/unistd_32.h" "$output/linux-headers/asm-x86/"
+         cp "$hdrdir/include/asm/unistd_x32.h" "$output/linux-headers/asm-x86/"
+         cp "$hdrdir/include/asm/unistd_64.h" "$output/linux-headers/asm-x86/"
++
+         cp_portable "$hdrdir/include/asm/kvm_para.h" "$output/include/standard-headers/asm-$arch"
++        cat <<EOF >$output/linux-headers/asm-$arch/kvm_para.h
++#include "standard-headers/asm-$arch/kvm_para.h"
++EOF
++
+         # Remove everything except the macros from bootparam.h avoiding the
+         # unnecessary import of several video/ist/etc headers
+         sed -e '/__ASSEMBLY__/,/__ASSEMBLY__/d' \
+@@ -209,6 +224,10 @@ if [ -d "$linux/LICENSES" ]; then
+     done
+ fi
+ 
++cat <<EOF >$output/linux-headers/linux/kvm_para.h
++#include "standard-headers/linux/kvm_para.h"
++#include <asm/kvm_para.h>
++EOF
+ cat <<EOF >$output/linux-headers/linux/virtio_config.h
+ #include "standard-headers/linux/virtio_config.h"
+ EOF
+@@ -231,6 +250,7 @@ for i in "$hdrdir"/include/linux/*virtio*.h \
+          "$hdrdir/include/linux/ethtool.h" \
+          "$hdrdir/include/linux/const.h" \
+          "$hdrdir/include/linux/kernel.h" \
++         "$hdrdir/include/linux/kvm_para.h" \
+          "$hdrdir/include/linux/vhost_types.h" \
+          "$hdrdir/include/linux/sysinfo.h"; do
+     cp_portable "$i" "$output/include/standard-headers/linux"
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-update-linux-headers-move-pvpanic.h-to-correct-direc.patch b/SOURCES/kvm-update-linux-headers-move-pvpanic.h-to-correct-direc.patch
new file mode 100644
index 0000000..cb0a4d4
--- /dev/null
+++ b/SOURCES/kvm-update-linux-headers-move-pvpanic.h-to-correct-direc.patch
@@ -0,0 +1,95 @@
+From 00e250d9df1949d363758a34e3f46d8c71be054f Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Mon, 3 Jun 2024 14:16:55 +0200
+Subject: [PATCH 051/100] update-linux-headers: move pvpanic.h to correct
+ directory
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+RH-MergeRequest: 245: SEV-SNP support
+RH-Jira: RHEL-39544
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Bandan Das <bdas@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Commit: [51/91] 10efff5bbcb867ba34f3f9ff8045381ea96f94c7 (bonzini/rhel-qemu-kvm)
+
+Linux has <misc/pvpanic.h>, not <linux/pvpanic.h>.  Use the same
+directory for QEMU's include/standard-headers/ copy.
+
+Reviewed-by: Thomas Huth <thuth@redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit b8116f4cbaa0f64bb07564f20b3b5219e23c8bff)
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ hw/misc/pvpanic-isa.c                              | 2 +-
+ hw/misc/pvpanic-pci.c                              | 2 +-
+ hw/misc/pvpanic.c                                  | 2 +-
+ include/standard-headers/{linux => misc}/pvpanic.h | 0
+ scripts/update-linux-headers.sh                    | 6 ++++--
+ 5 files changed, 7 insertions(+), 5 deletions(-)
+ rename include/standard-headers/{linux => misc}/pvpanic.h (100%)
+
+diff --git a/hw/misc/pvpanic-isa.c b/hw/misc/pvpanic-isa.c
+index ccec50f61b..b4f84c4110 100644
+--- a/hw/misc/pvpanic-isa.c
++++ b/hw/misc/pvpanic-isa.c
+@@ -21,7 +21,7 @@
+ #include "hw/misc/pvpanic.h"
+ #include "qom/object.h"
+ #include "hw/isa/isa.h"
+-#include "standard-headers/linux/pvpanic.h"
++#include "standard-headers/misc/pvpanic.h"
+ #include "hw/acpi/acpi_aml_interface.h"
+ 
+ OBJECT_DECLARE_SIMPLE_TYPE(PVPanicISAState, PVPANIC_ISA_DEVICE)
+diff --git a/hw/misc/pvpanic-pci.c b/hw/misc/pvpanic-pci.c
+index 83be95d0d2..4d44a881da 100644
+--- a/hw/misc/pvpanic-pci.c
++++ b/hw/misc/pvpanic-pci.c
+@@ -21,7 +21,7 @@
+ #include "hw/misc/pvpanic.h"
+ #include "qom/object.h"
+ #include "hw/pci/pci_device.h"
+-#include "standard-headers/linux/pvpanic.h"
++#include "standard-headers/misc/pvpanic.h"
+ 
+ OBJECT_DECLARE_SIMPLE_TYPE(PVPanicPCIState, PVPANIC_PCI_DEVICE)
+ 
+diff --git a/hw/misc/pvpanic.c b/hw/misc/pvpanic.c
+index 1540e9091a..80289ecf5f 100644
+--- a/hw/misc/pvpanic.c
++++ b/hw/misc/pvpanic.c
+@@ -21,7 +21,7 @@
+ #include "hw/qdev-properties.h"
+ #include "hw/misc/pvpanic.h"
+ #include "qom/object.h"
+-#include "standard-headers/linux/pvpanic.h"
++#include "standard-headers/misc/pvpanic.h"
+ 
+ static void handle_event(int event)
+ {
+diff --git a/include/standard-headers/linux/pvpanic.h b/include/standard-headers/misc/pvpanic.h
+similarity index 100%
+rename from include/standard-headers/linux/pvpanic.h
+rename to include/standard-headers/misc/pvpanic.h
+diff --git a/scripts/update-linux-headers.sh b/scripts/update-linux-headers.sh
+index 78c0f2c43e..90759dcfe0 100755
+--- a/scripts/update-linux-headers.sh
++++ b/scripts/update-linux-headers.sh
+@@ -232,10 +232,12 @@ for i in "$hdrdir"/include/linux/*virtio*.h \
+          "$hdrdir/include/linux/const.h" \
+          "$hdrdir/include/linux/kernel.h" \
+          "$hdrdir/include/linux/vhost_types.h" \
+-         "$hdrdir/include/linux/sysinfo.h" \
+-         "$hdrdir/include/misc/pvpanic.h"; do
++         "$hdrdir/include/linux/sysinfo.h"; do
+     cp_portable "$i" "$output/include/standard-headers/linux"
+ done
++mkdir -p "$output/include/standard-headers/misc"
++cp_portable "$hdrdir/include/misc/pvpanic.h" \
++            "$output/include/standard-headers/misc"
+ mkdir -p "$output/include/standard-headers/drm"
+ cp_portable "$hdrdir/include/drm/drm_fourcc.h" \
+             "$output/include/standard-headers/drm"
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-util-char_dev-Add-open_cdev.patch b/SOURCES/kvm-util-char_dev-Add-open_cdev.patch
deleted file mode 100644
index 1f1e870..0000000
--- a/SOURCES/kvm-util-char_dev-Add-open_cdev.patch
+++ /dev/null
@@ -1,175 +0,0 @@
-From de167878ec4ca159cc6def5134c91c5fe9b5ab96 Mon Sep 17 00:00:00 2001
-From: Yi Liu <yi.l.liu@intel.com>
-Date: Tue, 21 Nov 2023 16:44:01 +0800
-Subject: [PATCH 022/101] util/char_dev: Add open_cdev()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [21/67] 72bf9ec3ccc9959626235bd270ec84caa4cee435 (eauger1/centos-qemu-kvm)
-
-/dev/vfio/devices/vfioX may not exist. In that case it is still possible
-to open /dev/char/$major:$minor instead. Add helper function to abstract
-the cdev open.
-
-Suggested-by: Jason Gunthorpe <jgg@nvidia.com>
-Signed-off-by: Yi Liu <yi.l.liu@intel.com>
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Tested-by: Eric Auger <eric.auger@redhat.com>
-Tested-by: Nicolin Chen <nicolinc@nvidia.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit d6b5c4c1b516a8176b74ec35a0af8cf89b04b6c1)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- MAINTAINERS                 |  2 +
- include/qemu/chardev_open.h | 16 ++++++++
- util/chardev_open.c         | 81 +++++++++++++++++++++++++++++++++++++
- util/meson.build            |  1 +
- 4 files changed, 100 insertions(+)
- create mode 100644 include/qemu/chardev_open.h
- create mode 100644 util/chardev_open.c
-
-diff --git a/MAINTAINERS b/MAINTAINERS
-index a5a446914a..ca70bb4e64 100644
---- a/MAINTAINERS
-+++ b/MAINTAINERS
-@@ -2174,6 +2174,8 @@ M: Zhenzhong Duan <zhenzhong.duan@intel.com>
- S: Supported
- F: backends/iommufd.c
- F: include/sysemu/iommufd.h
-+F: include/qemu/chardev_open.h
-+F: util/chardev_open.c
- 
- vhost
- M: Michael S. Tsirkin <mst@redhat.com>
-diff --git a/include/qemu/chardev_open.h b/include/qemu/chardev_open.h
-new file mode 100644
-index 0000000000..64e8fcfdcb
---- /dev/null
-+++ b/include/qemu/chardev_open.h
-@@ -0,0 +1,16 @@
-+/*
-+ * QEMU Chardev Helper
-+ *
-+ * Copyright (C) 2023 Intel Corporation.
-+ *
-+ * Authors: Yi Liu <yi.l.liu@intel.com>
-+ *
-+ * This work is licensed under the terms of the GNU GPL, version 2.  See
-+ * the COPYING file in the top-level directory.
-+ */
-+
-+#ifndef QEMU_CHARDEV_OPEN_H
-+#define QEMU_CHARDEV_OPEN_H
-+
-+int open_cdev(const char *devpath, dev_t cdev);
-+#endif
-diff --git a/util/chardev_open.c b/util/chardev_open.c
-new file mode 100644
-index 0000000000..f776429788
---- /dev/null
-+++ b/util/chardev_open.c
-@@ -0,0 +1,81 @@
-+/*
-+ * Copyright (c) 2019, Mellanox Technologies. All rights reserved.
-+ * Copyright (C) 2023 Intel Corporation.
-+ *
-+ * This software is available to you under a choice of one of two
-+ * licenses.  You may choose to be licensed under the terms of the GNU
-+ * General Public License (GPL) Version 2, available from the file
-+ * COPYING in the main directory of this source tree, or the
-+ * OpenIB.org BSD license below:
-+ *
-+ *      Redistribution and use in source and binary forms, with or
-+ *      without modification, are permitted provided that the following
-+ *      conditions are met:
-+ *
-+ *      - Redistributions of source code must retain the above
-+ *        copyright notice, this list of conditions and the following
-+ *        disclaimer.
-+ *
-+ *      - Redistributions in binary form must reproduce the above
-+ *        copyright notice, this list of conditions and the following
-+ *        disclaimer in the documentation and/or other materials
-+ *        provided with the distribution.
-+ *
-+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
-+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
-+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
-+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
-+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-+ * SOFTWARE.
-+ *
-+ * Authors: Yi Liu <yi.l.liu@intel.com>
-+ *
-+ * Copied from
-+ * https://github.com/linux-rdma/rdma-core/blob/master/util/open_cdev.c
-+ *
-+ */
-+
-+#include "qemu/osdep.h"
-+#include "qemu/chardev_open.h"
-+
-+static int open_cdev_internal(const char *path, dev_t cdev)
-+{
-+    struct stat st;
-+    int fd;
-+
-+    fd = qemu_open_old(path, O_RDWR);
-+    if (fd == -1) {
-+        return -1;
-+    }
-+    if (fstat(fd, &st) || !S_ISCHR(st.st_mode) ||
-+        (cdev != 0 && st.st_rdev != cdev)) {
-+        close(fd);
-+        return -1;
-+    }
-+    return fd;
-+}
-+
-+static int open_cdev_robust(dev_t cdev)
-+{
-+    g_autofree char *devpath = NULL;
-+
-+    /*
-+     * This assumes that udev is being used and is creating the /dev/char/
-+     * symlinks.
-+     */
-+    devpath = g_strdup_printf("/dev/char/%u:%u", major(cdev), minor(cdev));
-+    return open_cdev_internal(devpath, cdev);
-+}
-+
-+int open_cdev(const char *devpath, dev_t cdev)
-+{
-+    int fd;
-+
-+    fd = open_cdev_internal(devpath, cdev);
-+    if (fd == -1 && cdev != 0) {
-+        return open_cdev_robust(cdev);
-+    }
-+    return fd;
-+}
-diff --git a/util/meson.build b/util/meson.build
-index c2322ef6e7..174c133368 100644
---- a/util/meson.build
-+++ b/util/meson.build
-@@ -108,6 +108,7 @@ if have_block
-     util_ss.add(files('filemonitor-stub.c'))
-   endif
-   util_ss.add(when: 'CONFIG_LINUX', if_true: files('vfio-helpers.c'))
-+  util_ss.add(when: 'CONFIG_LINUX', if_true: files('chardev_open.c'))
- endif
- 
- if cpu == 'aarch64'
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-Introduce-a-helper-function-to-initialize-VFIOD.patch b/SOURCES/kvm-vfio-Introduce-a-helper-function-to-initialize-VFIOD.patch
deleted file mode 100644
index 040288f..0000000
--- a/SOURCES/kvm-vfio-Introduce-a-helper-function-to-initialize-VFIOD.patch
+++ /dev/null
@@ -1,154 +0,0 @@
-From f554328f6f4702743af71befcb83c25c36e4fa4d Mon Sep 17 00:00:00 2001
-From: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Date: Tue, 21 Nov 2023 16:44:25 +0800
-Subject: [PATCH 046/101] vfio: Introduce a helper function to initialize
- VFIODevice
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [45/67] 73225f394540bf5aeb70c0bdb89771f19a6d286d (eauger1/centos-qemu-kvm)
-
-Introduce a helper function to replace the common code to initialize
-VFIODevice in pci, platform, ap and ccw VFIO device.
-
-No functional change intended.
-
-Suggested-by: Cédric Le Goater <clg@redhat.com>
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Tested-by: Nicolin Chen <nicolinc@nvidia.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 6106a329141af7d47bdc3346ce9820d4714e0e5d)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/ap.c                  |  8 ++------
- hw/vfio/ccw.c                 |  8 ++------
- hw/vfio/helpers.c             | 11 +++++++++++
- hw/vfio/pci.c                 |  6 ++----
- hw/vfio/platform.c            |  6 ++----
- include/hw/vfio/vfio-common.h |  2 ++
- 6 files changed, 21 insertions(+), 20 deletions(-)
-
-diff --git a/hw/vfio/ap.c b/hw/vfio/ap.c
-index 95fe7cd98b..e157aa1ff7 100644
---- a/hw/vfio/ap.c
-+++ b/hw/vfio/ap.c
-@@ -226,18 +226,14 @@ static void vfio_ap_instance_init(Object *obj)
-     VFIOAPDevice *vapdev = VFIO_AP_DEVICE(obj);
-     VFIODevice *vbasedev = &vapdev->vdev;
- 
--    vbasedev->type = VFIO_DEVICE_TYPE_AP;
--    vbasedev->ops = &vfio_ap_ops;
--    vbasedev->dev = DEVICE(vapdev);
--    vbasedev->fd = -1;
--
-     /*
-      * vfio-ap devices operate in a way compatible with discarding of
-      * memory in RAM blocks, as no pages are pinned in the host.
-      * This needs to be set before vfio_get_device() for vfio common to
-      * handle ram_block_discard_disable().
-      */
--    vbasedev->ram_block_discard_allowed = true;
-+    vfio_device_init(vbasedev, VFIO_DEVICE_TYPE_AP, &vfio_ap_ops,
-+                     DEVICE(vapdev), true);
- }
- 
- #ifdef CONFIG_IOMMUFD
-diff --git a/hw/vfio/ccw.c b/hw/vfio/ccw.c
-index 6305a4c1b8..90e4a53437 100644
---- a/hw/vfio/ccw.c
-+++ b/hw/vfio/ccw.c
-@@ -683,11 +683,6 @@ static void vfio_ccw_instance_init(Object *obj)
-     VFIOCCWDevice *vcdev = VFIO_CCW(obj);
-     VFIODevice *vbasedev = &vcdev->vdev;
- 
--    vbasedev->type = VFIO_DEVICE_TYPE_CCW;
--    vbasedev->ops = &vfio_ccw_ops;
--    vbasedev->dev = DEVICE(vcdev);
--    vbasedev->fd = -1;
--
-     /*
-      * All vfio-ccw devices are believed to operate in a way compatible with
-      * discarding of memory in RAM blocks, ie. pages pinned in the host are
-@@ -696,7 +691,8 @@ static void vfio_ccw_instance_init(Object *obj)
-      * needs to be set before vfio_get_device() for vfio common to handle
-      * ram_block_discard_disable().
-      */
--    vbasedev->ram_block_discard_allowed = true;
-+    vfio_device_init(vbasedev, VFIO_DEVICE_TYPE_CCW, &vfio_ccw_ops,
-+                     DEVICE(vcdev), true);
- }
- 
- #ifdef CONFIG_IOMMUFD
-diff --git a/hw/vfio/helpers.c b/hw/vfio/helpers.c
-index 3592c3d54e..6789870802 100644
---- a/hw/vfio/helpers.c
-+++ b/hw/vfio/helpers.c
-@@ -652,3 +652,14 @@ void vfio_device_set_fd(VFIODevice *vbasedev, const char *str, Error **errp)
-     }
-     vbasedev->fd = fd;
- }
-+
-+void vfio_device_init(VFIODevice *vbasedev, int type, VFIODeviceOps *ops,
-+                      DeviceState *dev, bool ram_discard)
-+{
-+    vbasedev->type = type;
-+    vbasedev->ops = ops;
-+    vbasedev->dev = dev;
-+    vbasedev->fd = -1;
-+
-+    vbasedev->ram_block_discard_allowed = ram_discard;
-+}
-diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
-index 3f5900cc46..83c3238608 100644
---- a/hw/vfio/pci.c
-+++ b/hw/vfio/pci.c
-@@ -3353,10 +3353,8 @@ static void vfio_instance_init(Object *obj)
-     vdev->host.slot = ~0U;
-     vdev->host.function = ~0U;
- 
--    vbasedev->type = VFIO_DEVICE_TYPE_PCI;
--    vbasedev->ops = &vfio_pci_ops;
--    vbasedev->dev = DEVICE(vdev);
--    vbasedev->fd = -1;
-+    vfio_device_init(vbasedev, VFIO_DEVICE_TYPE_PCI, &vfio_pci_ops,
-+                     DEVICE(vdev), false);
- 
-     vdev->nv_gpudirect_clique = 0xFF;
- 
-diff --git a/hw/vfio/platform.c b/hw/vfio/platform.c
-index 506eb8193f..a8d9b7da63 100644
---- a/hw/vfio/platform.c
-+++ b/hw/vfio/platform.c
-@@ -657,10 +657,8 @@ static void vfio_platform_instance_init(Object *obj)
-     VFIOPlatformDevice *vdev = VFIO_PLATFORM_DEVICE(obj);
-     VFIODevice *vbasedev = &vdev->vbasedev;
- 
--    vbasedev->type = VFIO_DEVICE_TYPE_PLATFORM;
--    vbasedev->ops = &vfio_platform_ops;
--    vbasedev->dev = DEVICE(vdev);
--    vbasedev->fd = -1;
-+    vfio_device_init(vbasedev, VFIO_DEVICE_TYPE_PLATFORM, &vfio_platform_ops,
-+                     DEVICE(vdev), false);
- }
- 
- #ifdef CONFIG_IOMMUFD
-diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
-index efcba19f66..b8aa8a5495 100644
---- a/include/hw/vfio/vfio-common.h
-+++ b/include/hw/vfio/vfio-common.h
-@@ -257,4 +257,6 @@ int vfio_get_dirty_bitmap(const VFIOContainerBase *bcontainer, uint64_t iova,
- /* Returns 0 on success, or a negative errno. */
- int vfio_device_get_name(VFIODevice *vbasedev, Error **errp);
- void vfio_device_set_fd(VFIODevice *vbasedev, const char *str, Error **errp);
-+void vfio_device_init(VFIODevice *vbasedev, int type, VFIODeviceOps *ops,
-+                      DeviceState *dev, bool ram_discard);
- #endif /* HW_VFIO_VFIO_COMMON_H */
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-Introduce-base-object-for-VFIOContainer-and-tar.patch b/SOURCES/kvm-vfio-Introduce-base-object-for-VFIOContainer-and-tar.patch
deleted file mode 100644
index d41e8fb..0000000
--- a/SOURCES/kvm-vfio-Introduce-base-object-for-VFIOContainer-and-tar.patch
+++ /dev/null
@@ -1,129 +0,0 @@
-From 7f392385d1b865904eae4b6681e3e7a87eb3af3d Mon Sep 17 00:00:00 2001
-From: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Date: Thu, 2 Nov 2023 15:12:27 +0800
-Subject: [PATCH 002/101] vfio: Introduce base object for VFIOContainer and
- targeted interface
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [1/67] e63af50c2cb94f286b2d91f58c2d19dd862e019d (eauger1/centos-qemu-kvm)
-
-Introduce a dumb VFIOContainerBase object and its targeted interface.
-This is willingly not a QOM object because we don't want it to be
-visible from the user interface. The VFIOContainerBase will be
-smoothly populated in subsequent patches as well as interfaces.
-
-No functional change intended.
-
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
-Signed-off-by: Yi Liu <yi.l.liu@intel.com>
-Signed-off-by: Yi Sun <yi.y.sun@linux.intel.com>
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit f61dddd73232e3d82d560d1e1bca120446021f2f)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- include/hw/vfio/vfio-common.h         |  8 ++---
- include/hw/vfio/vfio-container-base.h | 50 +++++++++++++++++++++++++++
- 2 files changed, 52 insertions(+), 6 deletions(-)
- create mode 100644 include/hw/vfio/vfio-container-base.h
-
-diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
-index a4a22accb9..586d153c12 100644
---- a/include/hw/vfio/vfio-common.h
-+++ b/include/hw/vfio/vfio-common.h
-@@ -30,6 +30,7 @@
- #include <linux/vfio.h>
- #endif
- #include "sysemu/sysemu.h"
-+#include "hw/vfio/vfio-container-base.h"
- 
- #define VFIO_MSG_PREFIX "vfio %s: "
- 
-@@ -81,6 +82,7 @@ typedef struct VFIOAddressSpace {
- struct VFIOGroup;
- 
- typedef struct VFIOContainer {
-+    VFIOContainerBase bcontainer;
-     VFIOAddressSpace *space;
-     int fd; /* /dev/vfio/vfio, empowered by the attached groups */
-     MemoryListener listener;
-@@ -201,12 +203,6 @@ typedef struct VFIODisplay {
-     } dmabuf;
- } VFIODisplay;
- 
--typedef struct {
--    unsigned long *bitmap;
--    hwaddr size;
--    hwaddr pages;
--} VFIOBitmap;
--
- VFIOAddressSpace *vfio_get_address_space(AddressSpace *as);
- void vfio_put_address_space(VFIOAddressSpace *space);
- bool vfio_devices_all_running_and_saving(VFIOContainer *container);
-diff --git a/include/hw/vfio/vfio-container-base.h b/include/hw/vfio/vfio-container-base.h
-new file mode 100644
-index 0000000000..1d6daaea5d
---- /dev/null
-+++ b/include/hw/vfio/vfio-container-base.h
-@@ -0,0 +1,50 @@
-+/*
-+ * VFIO BASE CONTAINER
-+ *
-+ * Copyright (C) 2023 Intel Corporation.
-+ * Copyright Red Hat, Inc. 2023
-+ *
-+ * Authors: Yi Liu <yi.l.liu@intel.com>
-+ *          Eric Auger <eric.auger@redhat.com>
-+ *
-+ * SPDX-License-Identifier: GPL-2.0-or-later
-+ */
-+
-+#ifndef HW_VFIO_VFIO_CONTAINER_BASE_H
-+#define HW_VFIO_VFIO_CONTAINER_BASE_H
-+
-+#include "exec/memory.h"
-+
-+typedef struct VFIODevice VFIODevice;
-+typedef struct VFIOIOMMUOps VFIOIOMMUOps;
-+
-+typedef struct {
-+    unsigned long *bitmap;
-+    hwaddr size;
-+    hwaddr pages;
-+} VFIOBitmap;
-+
-+/*
-+ * This is the base object for vfio container backends
-+ */
-+typedef struct VFIOContainerBase {
-+    const VFIOIOMMUOps *ops;
-+} VFIOContainerBase;
-+
-+struct VFIOIOMMUOps {
-+    /* basic feature */
-+    int (*dma_map)(VFIOContainerBase *bcontainer,
-+                   hwaddr iova, ram_addr_t size,
-+                   void *vaddr, bool readonly);
-+    int (*dma_unmap)(VFIOContainerBase *bcontainer,
-+                     hwaddr iova, ram_addr_t size,
-+                     IOMMUTLBEntry *iotlb);
-+    int (*attach_device)(const char *name, VFIODevice *vbasedev,
-+                         AddressSpace *as, Error **errp);
-+    void (*detach_device)(VFIODevice *vbasedev);
-+    /* migration feature */
-+    int (*set_dirty_page_tracking)(VFIOContainerBase *bcontainer, bool start);
-+    int (*query_dirty_bitmap)(VFIOContainerBase *bcontainer, VFIOBitmap *vbmap,
-+                              hwaddr iova, hwaddr size);
-+};
-+#endif /* HW_VFIO_VFIO_CONTAINER_BASE_H */
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-Make-VFIOContainerBase-poiner-parameter-const-i.patch b/SOURCES/kvm-vfio-Make-VFIOContainerBase-poiner-parameter-const-i.patch
deleted file mode 100644
index 03fb220..0000000
--- a/SOURCES/kvm-vfio-Make-VFIOContainerBase-poiner-parameter-const-i.patch
+++ /dev/null
@@ -1,276 +0,0 @@
-From 84b15fad1af781d06d0206d362de0801d7a18d0b Mon Sep 17 00:00:00 2001
-From: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Date: Tue, 21 Nov 2023 16:44:17 +0800
-Subject: [PATCH 038/101] vfio: Make VFIOContainerBase poiner parameter const
- in VFIOIOMMUOps callbacks
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [37/67] 95eb9edc7fcfefbd4b075f6f04941ed4a19ff87d (eauger1/centos-qemu-kvm)
-
-Some of the callbacks in VFIOIOMMUOps pass VFIOContainerBase poiner,
-those callbacks only need read access to the sub object of VFIOContainerBase.
-So make VFIOContainerBase, VFIOContainer and VFIOIOMMUFDContainer as const
-in these callbacks.
-
-Local functions called by those callbacks also need same changes to avoid
-build error.
-
-Suggested-by: Cédric Le Goater <clg@redhat.com>
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Tested-by: Eric Auger <eric.auger@redhat.com>
-Tested-by: Nicolin Chen <nicolinc@nvidia.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 4517c33c31d392f08fa96a9db911da1e3507be94)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/common.c                      |  9 +++----
- hw/vfio/container-base.c              |  2 +-
- hw/vfio/container.c                   | 34 ++++++++++++++-------------
- hw/vfio/iommufd.c                     |  8 +++----
- include/hw/vfio/vfio-common.h         | 12 ++++++----
- include/hw/vfio/vfio-container-base.h | 12 ++++++----
- 6 files changed, 42 insertions(+), 35 deletions(-)
-
-diff --git a/hw/vfio/common.c b/hw/vfio/common.c
-index 6569732b7a..08a3e57672 100644
---- a/hw/vfio/common.c
-+++ b/hw/vfio/common.c
-@@ -204,7 +204,7 @@ static bool vfio_devices_all_dirty_tracking(VFIOContainerBase *bcontainer)
-     return true;
- }
- 
--bool vfio_devices_all_device_dirty_tracking(VFIOContainerBase *bcontainer)
-+bool vfio_devices_all_device_dirty_tracking(const VFIOContainerBase *bcontainer)
- {
-     VFIODevice *vbasedev;
- 
-@@ -221,7 +221,8 @@ bool vfio_devices_all_device_dirty_tracking(VFIOContainerBase *bcontainer)
-  * Check if all VFIO devices are running and migration is active, which is
-  * essentially equivalent to the migration being in pre-copy phase.
-  */
--bool vfio_devices_all_running_and_mig_active(VFIOContainerBase *bcontainer)
-+bool
-+vfio_devices_all_running_and_mig_active(const VFIOContainerBase *bcontainer)
- {
-     VFIODevice *vbasedev;
- 
-@@ -1139,7 +1140,7 @@ static int vfio_device_dma_logging_report(VFIODevice *vbasedev, hwaddr iova,
-     return 0;
- }
- 
--int vfio_devices_query_dirty_bitmap(VFIOContainerBase *bcontainer,
-+int vfio_devices_query_dirty_bitmap(const VFIOContainerBase *bcontainer,
-                                     VFIOBitmap *vbmap, hwaddr iova,
-                                     hwaddr size)
- {
-@@ -1162,7 +1163,7 @@ int vfio_devices_query_dirty_bitmap(VFIOContainerBase *bcontainer,
-     return 0;
- }
- 
--int vfio_get_dirty_bitmap(VFIOContainerBase *bcontainer, uint64_t iova,
-+int vfio_get_dirty_bitmap(const VFIOContainerBase *bcontainer, uint64_t iova,
-                           uint64_t size, ram_addr_t ram_addr)
- {
-     bool all_device_dirty_tracking =
-diff --git a/hw/vfio/container-base.c b/hw/vfio/container-base.c
-index eee2dcfe76..1ffd25bbfa 100644
---- a/hw/vfio/container-base.c
-+++ b/hw/vfio/container-base.c
-@@ -63,7 +63,7 @@ int vfio_container_set_dirty_page_tracking(VFIOContainerBase *bcontainer,
-     return bcontainer->ops->set_dirty_page_tracking(bcontainer, start);
- }
- 
--int vfio_container_query_dirty_bitmap(VFIOContainerBase *bcontainer,
-+int vfio_container_query_dirty_bitmap(const VFIOContainerBase *bcontainer,
-                                       VFIOBitmap *vbmap,
-                                       hwaddr iova, hwaddr size)
- {
-diff --git a/hw/vfio/container.c b/hw/vfio/container.c
-index 1dbf9b9a17..b22feb8ded 100644
---- a/hw/vfio/container.c
-+++ b/hw/vfio/container.c
-@@ -61,11 +61,11 @@ static int vfio_ram_block_discard_disable(VFIOContainer *container, bool state)
-     }
- }
- 
--static int vfio_dma_unmap_bitmap(VFIOContainer *container,
-+static int vfio_dma_unmap_bitmap(const VFIOContainer *container,
-                                  hwaddr iova, ram_addr_t size,
-                                  IOMMUTLBEntry *iotlb)
- {
--    VFIOContainerBase *bcontainer = &container->bcontainer;
-+    const VFIOContainerBase *bcontainer = &container->bcontainer;
-     struct vfio_iommu_type1_dma_unmap *unmap;
-     struct vfio_bitmap *bitmap;
-     VFIOBitmap vbmap;
-@@ -117,11 +117,12 @@ unmap_exit:
- /*
-  * DMA - Mapping and unmapping for the "type1" IOMMU interface used on x86
-  */
--static int vfio_legacy_dma_unmap(VFIOContainerBase *bcontainer, hwaddr iova,
--                                 ram_addr_t size, IOMMUTLBEntry *iotlb)
-+static int vfio_legacy_dma_unmap(const VFIOContainerBase *bcontainer,
-+                                 hwaddr iova, ram_addr_t size,
-+                                 IOMMUTLBEntry *iotlb)
- {
--    VFIOContainer *container = container_of(bcontainer, VFIOContainer,
--                                            bcontainer);
-+    const VFIOContainer *container = container_of(bcontainer, VFIOContainer,
-+                                                  bcontainer);
-     struct vfio_iommu_type1_dma_unmap unmap = {
-         .argsz = sizeof(unmap),
-         .flags = 0,
-@@ -174,11 +175,11 @@ static int vfio_legacy_dma_unmap(VFIOContainerBase *bcontainer, hwaddr iova,
-     return 0;
- }
- 
--static int vfio_legacy_dma_map(VFIOContainerBase *bcontainer, hwaddr iova,
-+static int vfio_legacy_dma_map(const VFIOContainerBase *bcontainer, hwaddr iova,
-                                ram_addr_t size, void *vaddr, bool readonly)
- {
--    VFIOContainer *container = container_of(bcontainer, VFIOContainer,
--                                            bcontainer);
-+    const VFIOContainer *container = container_of(bcontainer, VFIOContainer,
-+                                                  bcontainer);
-     struct vfio_iommu_type1_dma_map map = {
-         .argsz = sizeof(map),
-         .flags = VFIO_DMA_MAP_FLAG_READ,
-@@ -207,11 +208,12 @@ static int vfio_legacy_dma_map(VFIOContainerBase *bcontainer, hwaddr iova,
-     return -errno;
- }
- 
--static int vfio_legacy_set_dirty_page_tracking(VFIOContainerBase *bcontainer,
--                                               bool start)
-+static int
-+vfio_legacy_set_dirty_page_tracking(const VFIOContainerBase *bcontainer,
-+                                    bool start)
- {
--    VFIOContainer *container = container_of(bcontainer, VFIOContainer,
--                                            bcontainer);
-+    const VFIOContainer *container = container_of(bcontainer, VFIOContainer,
-+                                                  bcontainer);
-     int ret;
-     struct vfio_iommu_type1_dirty_bitmap dirty = {
-         .argsz = sizeof(dirty),
-@@ -233,12 +235,12 @@ static int vfio_legacy_set_dirty_page_tracking(VFIOContainerBase *bcontainer,
-     return ret;
- }
- 
--static int vfio_legacy_query_dirty_bitmap(VFIOContainerBase *bcontainer,
-+static int vfio_legacy_query_dirty_bitmap(const VFIOContainerBase *bcontainer,
-                                           VFIOBitmap *vbmap,
-                                           hwaddr iova, hwaddr size)
- {
--    VFIOContainer *container = container_of(bcontainer, VFIOContainer,
--                                            bcontainer);
-+    const VFIOContainer *container = container_of(bcontainer, VFIOContainer,
-+                                                  bcontainer);
-     struct vfio_iommu_type1_dirty_bitmap *dbitmap;
-     struct vfio_iommu_type1_dirty_bitmap_get *range;
-     int ret;
-diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
-index 5accd26484..87a561c545 100644
---- a/hw/vfio/iommufd.c
-+++ b/hw/vfio/iommufd.c
-@@ -26,10 +26,10 @@
- #include "qemu/chardev_open.h"
- #include "pci.h"
- 
--static int iommufd_cdev_map(VFIOContainerBase *bcontainer, hwaddr iova,
-+static int iommufd_cdev_map(const VFIOContainerBase *bcontainer, hwaddr iova,
-                             ram_addr_t size, void *vaddr, bool readonly)
- {
--    VFIOIOMMUFDContainer *container =
-+    const VFIOIOMMUFDContainer *container =
-         container_of(bcontainer, VFIOIOMMUFDContainer, bcontainer);
- 
-     return iommufd_backend_map_dma(container->be,
-@@ -37,11 +37,11 @@ static int iommufd_cdev_map(VFIOContainerBase *bcontainer, hwaddr iova,
-                                    iova, size, vaddr, readonly);
- }
- 
--static int iommufd_cdev_unmap(VFIOContainerBase *bcontainer,
-+static int iommufd_cdev_unmap(const VFIOContainerBase *bcontainer,
-                               hwaddr iova, ram_addr_t size,
-                               IOMMUTLBEntry *iotlb)
- {
--    VFIOIOMMUFDContainer *container =
-+    const VFIOIOMMUFDContainer *container =
-         container_of(bcontainer, VFIOIOMMUFDContainer, bcontainer);
- 
-     /* TODO: Handle dma_unmap_bitmap with iotlb args (migration) */
-diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
-index 697bf24a35..efcba19f66 100644
---- a/include/hw/vfio/vfio-common.h
-+++ b/include/hw/vfio/vfio-common.h
-@@ -244,13 +244,15 @@ bool vfio_migration_realize(VFIODevice *vbasedev, Error **errp);
- void vfio_migration_exit(VFIODevice *vbasedev);
- 
- int vfio_bitmap_alloc(VFIOBitmap *vbmap, hwaddr size);
--bool vfio_devices_all_running_and_mig_active(VFIOContainerBase *bcontainer);
--bool vfio_devices_all_device_dirty_tracking(VFIOContainerBase *bcontainer);
--int vfio_devices_query_dirty_bitmap(VFIOContainerBase *bcontainer,
-+bool
-+vfio_devices_all_running_and_mig_active(const VFIOContainerBase *bcontainer);
-+bool
-+vfio_devices_all_device_dirty_tracking(const VFIOContainerBase *bcontainer);
-+int vfio_devices_query_dirty_bitmap(const VFIOContainerBase *bcontainer,
-                                     VFIOBitmap *vbmap, hwaddr iova,
-                                     hwaddr size);
--int vfio_get_dirty_bitmap(VFIOContainerBase *bcontainer, uint64_t iova,
--                                 uint64_t size, ram_addr_t ram_addr);
-+int vfio_get_dirty_bitmap(const VFIOContainerBase *bcontainer, uint64_t iova,
-+                          uint64_t size, ram_addr_t ram_addr);
- 
- /* Returns 0 on success, or a negative errno. */
- int vfio_device_get_name(VFIODevice *vbasedev, Error **errp);
-diff --git a/include/hw/vfio/vfio-container-base.h b/include/hw/vfio/vfio-container-base.h
-index 45bb19c767..2ae297ccda 100644
---- a/include/hw/vfio/vfio-container-base.h
-+++ b/include/hw/vfio/vfio-container-base.h
-@@ -82,7 +82,7 @@ void vfio_container_del_section_window(VFIOContainerBase *bcontainer,
-                                        MemoryRegionSection *section);
- int vfio_container_set_dirty_page_tracking(VFIOContainerBase *bcontainer,
-                                            bool start);
--int vfio_container_query_dirty_bitmap(VFIOContainerBase *bcontainer,
-+int vfio_container_query_dirty_bitmap(const VFIOContainerBase *bcontainer,
-                                       VFIOBitmap *vbmap,
-                                       hwaddr iova, hwaddr size);
- 
-@@ -93,18 +93,20 @@ void vfio_container_destroy(VFIOContainerBase *bcontainer);
- 
- struct VFIOIOMMUOps {
-     /* basic feature */
--    int (*dma_map)(VFIOContainerBase *bcontainer,
-+    int (*dma_map)(const VFIOContainerBase *bcontainer,
-                    hwaddr iova, ram_addr_t size,
-                    void *vaddr, bool readonly);
--    int (*dma_unmap)(VFIOContainerBase *bcontainer,
-+    int (*dma_unmap)(const VFIOContainerBase *bcontainer,
-                      hwaddr iova, ram_addr_t size,
-                      IOMMUTLBEntry *iotlb);
-     int (*attach_device)(const char *name, VFIODevice *vbasedev,
-                          AddressSpace *as, Error **errp);
-     void (*detach_device)(VFIODevice *vbasedev);
-     /* migration feature */
--    int (*set_dirty_page_tracking)(VFIOContainerBase *bcontainer, bool start);
--    int (*query_dirty_bitmap)(VFIOContainerBase *bcontainer, VFIOBitmap *vbmap,
-+    int (*set_dirty_page_tracking)(const VFIOContainerBase *bcontainer,
-+                                   bool start);
-+    int (*query_dirty_bitmap)(const VFIOContainerBase *bcontainer,
-+                              VFIOBitmap *vbmap,
-                               hwaddr iova, hwaddr size);
-     /* PCI specific */
-     int (*pci_hot_reset)(VFIODevice *vbasedev, bool single);
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-ap-Allow-the-selection-of-a-given-iommu-backend.patch b/SOURCES/kvm-vfio-ap-Allow-the-selection-of-a-given-iommu-backend.patch
deleted file mode 100644
index ffd8b9f..0000000
--- a/SOURCES/kvm-vfio-ap-Allow-the-selection-of-a-given-iommu-backend.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-From 57bdfc821d6f4b4f9c6b1ff05bf0114e5cabc77e Mon Sep 17 00:00:00 2001
-From: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Date: Tue, 21 Nov 2023 16:44:13 +0800
-Subject: [PATCH 034/101] vfio/ap: Allow the selection of a given iommu backend
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [33/67] a12bb86e5b627ccf246fb9ce60820595589ff8e5 (eauger1/centos-qemu-kvm)
-
-Now we support two types of iommu backends, let's add the capability
-to select one of them. This depends on whether an iommufd object has
-been linked with the vfio-ap device:
-
-if the user wants to use the legacy backend, it shall not
-link the vfio-ap device with any iommufd object:
-
- -device vfio-ap,sysfsdev=/sys/bus/mdev/devices/XXX
-
-This is called the legacy mode/backend.
-
-If the user wants to use the iommufd backend (/dev/iommu) it
-shall pass an iommufd object id in the vfio-ap device options:
-
- -object iommufd,id=iommufd0
- -device vfio-ap,sysfsdev=/sys/bus/mdev/devices/XXX,iommufd=iommufd0
-
-Suggested-by: Alex Williamson <alex.williamson@redhat.com>
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Tested-by: Nicolin Chen <nicolinc@nvidia.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 336f308958d598f3db351bb7d94cc57b4b2d448d)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/ap.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/hw/vfio/ap.c b/hw/vfio/ap.c
-index bbf69ff55a..80629609ae 100644
---- a/hw/vfio/ap.c
-+++ b/hw/vfio/ap.c
-@@ -11,10 +11,12 @@
-  */
- 
- #include "qemu/osdep.h"
-+#include CONFIG_DEVICES /* CONFIG_IOMMUFD */
- #include <linux/vfio.h>
- #include <sys/ioctl.h>
- #include "qapi/error.h"
- #include "hw/vfio/vfio-common.h"
-+#include "sysemu/iommufd.h"
- #include "hw/s390x/ap-device.h"
- #include "qemu/error-report.h"
- #include "qemu/event_notifier.h"
-@@ -204,6 +206,10 @@ static void vfio_ap_unrealize(DeviceState *dev)
- 
- static Property vfio_ap_properties[] = {
-     DEFINE_PROP_STRING("sysfsdev", VFIOAPDevice, vdev.sysfsdev),
-+#ifdef CONFIG_IOMMUFD
-+    DEFINE_PROP_LINK("iommufd", VFIOAPDevice, vdev.iommufd,
-+                     TYPE_IOMMUFD_BACKEND, IOMMUFDBackend *),
-+#endif
-     DEFINE_PROP_END_OF_LIST(),
- };
- 
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-ap-Make-vfio-cdev-pre-openable-by-passing-a-fil.patch b/SOURCES/kvm-vfio-ap-Make-vfio-cdev-pre-openable-by-passing-a-fil.patch
deleted file mode 100644
index 1055329..0000000
--- a/SOURCES/kvm-vfio-ap-Make-vfio-cdev-pre-openable-by-passing-a-fil.patch
+++ /dev/null
@@ -1,87 +0,0 @@
-From db09b7c60c01ee75d602261ee959a96fa0d89d68 Mon Sep 17 00:00:00 2001
-From: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Date: Tue, 21 Nov 2023 16:44:14 +0800
-Subject: [PATCH 035/101] vfio/ap: Make vfio cdev pre-openable by passing a
- file handle
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [34/67] aaafa6088a9b0302d53aa539f67792d02ea0f663 (eauger1/centos-qemu-kvm)
-
-This gives management tools like libvirt a chance to open the vfio
-cdev with privilege and pass FD to qemu. This way qemu never needs
-to have privilege to open a VFIO or iommu cdev node.
-
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Tested-by: Nicolin Chen <nicolinc@nvidia.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 5e7ba401b71d18544a3e44b2a58b9e63fd5148d5)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/ap.c | 23 ++++++++++++++++++++++-
- 1 file changed, 22 insertions(+), 1 deletion(-)
-
-diff --git a/hw/vfio/ap.c b/hw/vfio/ap.c
-index 80629609ae..f180e4a32a 100644
---- a/hw/vfio/ap.c
-+++ b/hw/vfio/ap.c
-@@ -160,7 +160,10 @@ static void vfio_ap_realize(DeviceState *dev, Error **errp)
-     VFIOAPDevice *vapdev = VFIO_AP_DEVICE(dev);
-     VFIODevice *vbasedev = &vapdev->vdev;
- 
--    vbasedev->name = g_path_get_basename(vbasedev->sysfsdev);
-+    if (vfio_device_get_name(vbasedev, errp) < 0) {
-+        return;
-+    }
-+
-     vbasedev->ops = &vfio_ap_ops;
-     vbasedev->type = VFIO_DEVICE_TYPE_AP;
-     vbasedev->dev = dev;
-@@ -230,11 +233,28 @@ static const VMStateDescription vfio_ap_vmstate = {
-     .unmigratable = 1,
- };
- 
-+static void vfio_ap_instance_init(Object *obj)
-+{
-+    VFIOAPDevice *vapdev = VFIO_AP_DEVICE(obj);
-+
-+    vapdev->vdev.fd = -1;
-+}
-+
-+#ifdef CONFIG_IOMMUFD
-+static void vfio_ap_set_fd(Object *obj, const char *str, Error **errp)
-+{
-+    vfio_device_set_fd(&VFIO_AP_DEVICE(obj)->vdev, str, errp);
-+}
-+#endif
-+
- static void vfio_ap_class_init(ObjectClass *klass, void *data)
- {
-     DeviceClass *dc = DEVICE_CLASS(klass);
- 
-     device_class_set_props(dc, vfio_ap_properties);
-+#ifdef CONFIG_IOMMUFD
-+    object_class_property_add_str(klass, "fd", NULL, vfio_ap_set_fd);
-+#endif
-     dc->vmsd = &vfio_ap_vmstate;
-     dc->desc = "VFIO-based AP device assignment";
-     set_bit(DEVICE_CATEGORY_MISC, dc->categories);
-@@ -249,6 +269,7 @@ static const TypeInfo vfio_ap_info = {
-     .name = TYPE_VFIO_AP_DEVICE,
-     .parent = TYPE_AP_DEVICE,
-     .instance_size = sizeof(VFIOAPDevice),
-+    .instance_init = vfio_ap_instance_init,
-     .class_init = vfio_ap_class_init,
- };
- 
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-ap-Move-VFIODevice-initializations-in-vfio_ap_i.patch b/SOURCES/kvm-vfio-ap-Move-VFIODevice-initializations-in-vfio_ap_i.patch
deleted file mode 100644
index ed60920..0000000
--- a/SOURCES/kvm-vfio-ap-Move-VFIODevice-initializations-in-vfio_ap_i.patch
+++ /dev/null
@@ -1,81 +0,0 @@
-From b8630ecb698e31311089ba4e224d5e2c08c8e665 Mon Sep 17 00:00:00 2001
-From: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Date: Tue, 21 Nov 2023 16:44:23 +0800
-Subject: [PATCH 044/101] vfio/ap: Move VFIODevice initializations in
- vfio_ap_instance_init
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [43/67] 95a527f649b28c5c78903e99735107667e8468b1 (eauger1/centos-qemu-kvm)
-
-Some of the VFIODevice initializations is in vfio_ap_realize,
-move all of them in vfio_ap_instance_init.
-
-No functional change intended.
-
-Suggested-by: Cédric Le Goater <clg@redhat.com>
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Reviewed-by: Eric Farman <farman@linux.ibm.com>
-Tested-by: Nicolin Chen <nicolinc@nvidia.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit cbbcc2f1706aa1a08637142744d2f5f6515ac93f)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/ap.c | 26 +++++++++++++-------------
- 1 file changed, 13 insertions(+), 13 deletions(-)
-
-diff --git a/hw/vfio/ap.c b/hw/vfio/ap.c
-index f180e4a32a..95fe7cd98b 100644
---- a/hw/vfio/ap.c
-+++ b/hw/vfio/ap.c
-@@ -164,18 +164,6 @@ static void vfio_ap_realize(DeviceState *dev, Error **errp)
-         return;
-     }
- 
--    vbasedev->ops = &vfio_ap_ops;
--    vbasedev->type = VFIO_DEVICE_TYPE_AP;
--    vbasedev->dev = dev;
--
--    /*
--     * vfio-ap devices operate in a way compatible with discarding of
--     * memory in RAM blocks, as no pages are pinned in the host.
--     * This needs to be set before vfio_get_device() for vfio common to
--     * handle ram_block_discard_disable().
--     */
--    vapdev->vdev.ram_block_discard_allowed = true;
--
-     ret = vfio_attach_device(vbasedev->name, vbasedev,
-                              &address_space_memory, errp);
-     if (ret) {
-@@ -236,8 +224,20 @@ static const VMStateDescription vfio_ap_vmstate = {
- static void vfio_ap_instance_init(Object *obj)
- {
-     VFIOAPDevice *vapdev = VFIO_AP_DEVICE(obj);
-+    VFIODevice *vbasedev = &vapdev->vdev;
- 
--    vapdev->vdev.fd = -1;
-+    vbasedev->type = VFIO_DEVICE_TYPE_AP;
-+    vbasedev->ops = &vfio_ap_ops;
-+    vbasedev->dev = DEVICE(vapdev);
-+    vbasedev->fd = -1;
-+
-+    /*
-+     * vfio-ap devices operate in a way compatible with discarding of
-+     * memory in RAM blocks, as no pages are pinned in the host.
-+     * This needs to be set before vfio_get_device() for vfio common to
-+     * handle ram_block_discard_disable().
-+     */
-+    vbasedev->ram_block_discard_allowed = true;
- }
- 
- #ifdef CONFIG_IOMMUFD
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-ccw-Allow-the-selection-of-a-given-iommu-backen.patch b/SOURCES/kvm-vfio-ccw-Allow-the-selection-of-a-given-iommu-backen.patch
deleted file mode 100644
index ff64a91..0000000
--- a/SOURCES/kvm-vfio-ccw-Allow-the-selection-of-a-given-iommu-backen.patch
+++ /dev/null
@@ -1,79 +0,0 @@
-From 732115c80eb0dd672925a0737e09643d8a889abd Mon Sep 17 00:00:00 2001
-From: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Date: Tue, 21 Nov 2023 16:44:15 +0800
-Subject: [PATCH 036/101] vfio/ccw: Allow the selection of a given iommu
- backend
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [35/67] 1701de023a9f3b3f0420689bf851e11aee88800d (eauger1/centos-qemu-kvm)
-
-Now we support two types of iommu backends, let's add the capability
-to select one of them. This depends on whether an iommufd object has
-been linked with the vfio-ccw device:
-
-If the user wants to use the legacy backend, it shall not
-link the vfio-ccw device with any iommufd object:
-
- -device vfio-ccw,sysfsdev=/sys/bus/mdev/devices/XXX
-
-This is called the legacy mode/backend.
-
-If the user wants to use the iommufd backend (/dev/iommu) it
-shall pass an iommufd object id in the vfio-ccw device options:
-
- -object iommufd,id=iommufd0
- -device vfio-ccw,sysfsdev=/sys/bus/mdev/devices/XXX,iommufd=iommufd0
-
-Suggested-by: Alex Williamson <alex.williamson@redhat.com>
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Reviewed-by: Eric Farman <farman@linux.ibm.com>
-Tested-by: Nicolin Chen <nicolinc@nvidia.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit e70f971a6c1230138843d7ab82267e4a5aaf6bda)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/ccw.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/hw/vfio/ccw.c b/hw/vfio/ccw.c
-index d857bb8d0f..d2d58bb677 100644
---- a/hw/vfio/ccw.c
-+++ b/hw/vfio/ccw.c
-@@ -15,12 +15,14 @@
-  */
- 
- #include "qemu/osdep.h"
-+#include CONFIG_DEVICES /* CONFIG_IOMMUFD */
- #include <linux/vfio.h>
- #include <linux/vfio_ccw.h>
- #include <sys/ioctl.h>
- 
- #include "qapi/error.h"
- #include "hw/vfio/vfio-common.h"
-+#include "sysemu/iommufd.h"
- #include "hw/s390x/s390-ccw.h"
- #include "hw/s390x/vfio-ccw.h"
- #include "hw/qdev-properties.h"
-@@ -677,6 +679,10 @@ static void vfio_ccw_unrealize(DeviceState *dev)
- static Property vfio_ccw_properties[] = {
-     DEFINE_PROP_STRING("sysfsdev", VFIOCCWDevice, vdev.sysfsdev),
-     DEFINE_PROP_BOOL("force-orb-pfch", VFIOCCWDevice, force_orb_pfch, false),
-+#ifdef CONFIG_IOMMUFD
-+    DEFINE_PROP_LINK("iommufd", VFIOCCWDevice, vdev.iommufd,
-+                     TYPE_IOMMUFD_BACKEND, IOMMUFDBackend *),
-+#endif
-     DEFINE_PROP_END_OF_LIST(),
- };
- 
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-ccw-Make-vfio-cdev-pre-openable-by-passing-a-fi.patch b/SOURCES/kvm-vfio-ccw-Make-vfio-cdev-pre-openable-by-passing-a-fi.patch
deleted file mode 100644
index 6c91d85..0000000
--- a/SOURCES/kvm-vfio-ccw-Make-vfio-cdev-pre-openable-by-passing-a-fi.patch
+++ /dev/null
@@ -1,93 +0,0 @@
-From 0ff08afdec19f4decaf750fa7d158e0ea498ff28 Mon Sep 17 00:00:00 2001
-From: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Date: Tue, 21 Nov 2023 16:44:16 +0800
-Subject: [PATCH 037/101] vfio/ccw: Make vfio cdev pre-openable by passing a
- file handle
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [36/67] cc0d8f51cffa5d5a7aebc2334b908b9877179ae7 (eauger1/centos-qemu-kvm)
-
-This gives management tools like libvirt a chance to open the vfio
-cdev with privilege and pass FD to qemu. This way qemu never needs
-to have privilege to open a VFIO or iommu cdev node.
-
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Reviewed-by: Eric Farman <farman@linux.ibm.com>
-Tested-by: Nicolin Chen <nicolinc@nvidia.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 909a6254edaa8d0b0e3f1c0a623862e73d1842e9)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/ccw.c | 25 ++++++++++++++++++++++---
- 1 file changed, 22 insertions(+), 3 deletions(-)
-
-diff --git a/hw/vfio/ccw.c b/hw/vfio/ccw.c
-index d2d58bb677..2afdf17dbe 100644
---- a/hw/vfio/ccw.c
-+++ b/hw/vfio/ccw.c
-@@ -590,11 +590,12 @@ static void vfio_ccw_realize(DeviceState *dev, Error **errp)
-         }
-     }
- 
-+    if (vfio_device_get_name(vbasedev, errp) < 0) {
-+        return;
-+    }
-+
-     vbasedev->ops = &vfio_ccw_ops;
-     vbasedev->type = VFIO_DEVICE_TYPE_CCW;
--    vbasedev->name = g_strdup_printf("%x.%x.%04x", vcdev->cdev.hostid.cssid,
--                           vcdev->cdev.hostid.ssid,
--                           vcdev->cdev.hostid.devid);
-     vbasedev->dev = dev;
- 
-     /*
-@@ -691,12 +692,29 @@ static const VMStateDescription vfio_ccw_vmstate = {
-     .unmigratable = 1,
- };
- 
-+static void vfio_ccw_instance_init(Object *obj)
-+{
-+    VFIOCCWDevice *vcdev = VFIO_CCW(obj);
-+
-+    vcdev->vdev.fd = -1;
-+}
-+
-+#ifdef CONFIG_IOMMUFD
-+static void vfio_ccw_set_fd(Object *obj, const char *str, Error **errp)
-+{
-+    vfio_device_set_fd(&VFIO_CCW(obj)->vdev, str, errp);
-+}
-+#endif
-+
- static void vfio_ccw_class_init(ObjectClass *klass, void *data)
- {
-     DeviceClass *dc = DEVICE_CLASS(klass);
-     S390CCWDeviceClass *cdc = S390_CCW_DEVICE_CLASS(klass);
- 
-     device_class_set_props(dc, vfio_ccw_properties);
-+#ifdef CONFIG_IOMMUFD
-+    object_class_property_add_str(klass, "fd", NULL, vfio_ccw_set_fd);
-+#endif
-     dc->vmsd = &vfio_ccw_vmstate;
-     dc->desc = "VFIO-based subchannel assignment";
-     set_bit(DEVICE_CATEGORY_MISC, dc->categories);
-@@ -714,6 +732,7 @@ static const TypeInfo vfio_ccw_info = {
-     .name = TYPE_VFIO_CCW,
-     .parent = TYPE_S390_CCW,
-     .instance_size = sizeof(VFIOCCWDevice),
-+    .instance_init = vfio_ccw_instance_init,
-     .class_init = vfio_ccw_class_init,
- };
- 
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-ccw-Move-VFIODevice-initializations-in-vfio_ccw.patch b/SOURCES/kvm-vfio-ccw-Move-VFIODevice-initializations-in-vfio_ccw.patch
deleted file mode 100644
index 95b85f9..0000000
--- a/SOURCES/kvm-vfio-ccw-Move-VFIODevice-initializations-in-vfio_ccw.patch
+++ /dev/null
@@ -1,85 +0,0 @@
-From 2ef1c050722115247962e3cd4d8fcf73727e597e Mon Sep 17 00:00:00 2001
-From: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Date: Tue, 21 Nov 2023 16:44:24 +0800
-Subject: [PATCH 045/101] vfio/ccw: Move VFIODevice initializations in
- vfio_ccw_instance_init
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [44/67] 3345ed58f491aba8fd51bcc172af267ae53e6c8c (eauger1/centos-qemu-kvm)
-
-Some of the VFIODevice initializations is in vfio_ccw_realize,
-move all of them in vfio_ccw_instance_init.
-
-No functional change intended.
-
-Suggested-by: Cédric Le Goater <clg@redhat.com>
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Reviewed-by: Eric Farman <farman@linux.ibm.com>
-Tested-by: Nicolin Chen <nicolinc@nvidia.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit c12b55ad6f9d3b4792b590e9211bd7319e4a2d70)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/ccw.c | 30 +++++++++++++++---------------
- 1 file changed, 15 insertions(+), 15 deletions(-)
-
-diff --git a/hw/vfio/ccw.c b/hw/vfio/ccw.c
-index 2afdf17dbe..6305a4c1b8 100644
---- a/hw/vfio/ccw.c
-+++ b/hw/vfio/ccw.c
-@@ -594,20 +594,6 @@ static void vfio_ccw_realize(DeviceState *dev, Error **errp)
-         return;
-     }
- 
--    vbasedev->ops = &vfio_ccw_ops;
--    vbasedev->type = VFIO_DEVICE_TYPE_CCW;
--    vbasedev->dev = dev;
--
--    /*
--     * All vfio-ccw devices are believed to operate in a way compatible with
--     * discarding of memory in RAM blocks, ie. pages pinned in the host are
--     * in the current working set of the guest driver and therefore never
--     * overlap e.g., with pages available to the guest balloon driver.  This
--     * needs to be set before vfio_get_device() for vfio common to handle
--     * ram_block_discard_disable().
--     */
--    vbasedev->ram_block_discard_allowed = true;
--
-     ret = vfio_attach_device(cdev->mdevid, vbasedev,
-                              &address_space_memory, errp);
-     if (ret) {
-@@ -695,8 +681,22 @@ static const VMStateDescription vfio_ccw_vmstate = {
- static void vfio_ccw_instance_init(Object *obj)
- {
-     VFIOCCWDevice *vcdev = VFIO_CCW(obj);
-+    VFIODevice *vbasedev = &vcdev->vdev;
-+
-+    vbasedev->type = VFIO_DEVICE_TYPE_CCW;
-+    vbasedev->ops = &vfio_ccw_ops;
-+    vbasedev->dev = DEVICE(vcdev);
-+    vbasedev->fd = -1;
- 
--    vcdev->vdev.fd = -1;
-+    /*
-+     * All vfio-ccw devices are believed to operate in a way compatible with
-+     * discarding of memory in RAM blocks, ie. pages pinned in the host are
-+     * in the current working set of the guest driver and therefore never
-+     * overlap e.g., with pages available to the guest balloon driver.  This
-+     * needs to be set before vfio_get_device() for vfio common to handle
-+     * ram_block_discard_disable().
-+     */
-+    vbasedev->ram_block_discard_allowed = true;
- }
- 
- #ifdef CONFIG_IOMMUFD
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-common-Introduce-vfio_container_init-destroy-he.patch b/SOURCES/kvm-vfio-common-Introduce-vfio_container_init-destroy-he.patch
deleted file mode 100644
index 8615b6d..0000000
--- a/SOURCES/kvm-vfio-common-Introduce-vfio_container_init-destroy-he.patch
+++ /dev/null
@@ -1,98 +0,0 @@
-From 7de36998dd6177380e46b8c5f3a91c3fad75483c Mon Sep 17 00:00:00 2001
-From: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Date: Thu, 2 Nov 2023 15:12:30 +0800
-Subject: [PATCH 005/101] vfio/common: Introduce vfio_container_init/destroy
- helper
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [4/67] 8287f687ef19cd84afede1e8f3b16ac3caf29a1d (eauger1/centos-qemu-kvm)
-
-This adds two helper functions vfio_container_init/destroy which will be
-used by both legacy and iommufd containers to do base container specific
-initialization and release.
-
-No functional change intended.
-
-Suggested-by: Cédric Le Goater <clg@redhat.com>
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit ed2f7f80170251e7cdd2965a13ee97527d1fbec8)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/container-base.c              | 9 +++++++++
- hw/vfio/container.c                   | 4 +++-
- include/hw/vfio/vfio-container-base.h | 4 ++++
- 3 files changed, 16 insertions(+), 1 deletion(-)
-
-diff --git a/hw/vfio/container-base.c b/hw/vfio/container-base.c
-index 55d3a35fa4..e929435751 100644
---- a/hw/vfio/container-base.c
-+++ b/hw/vfio/container-base.c
-@@ -30,3 +30,12 @@ int vfio_container_dma_unmap(VFIOContainerBase *bcontainer,
-     g_assert(bcontainer->ops->dma_unmap);
-     return bcontainer->ops->dma_unmap(bcontainer, iova, size, iotlb);
- }
-+
-+void vfio_container_init(VFIOContainerBase *bcontainer, const VFIOIOMMUOps *ops)
-+{
-+    bcontainer->ops = ops;
-+}
-+
-+void vfio_container_destroy(VFIOContainerBase *bcontainer)
-+{
-+}
-diff --git a/hw/vfio/container.c b/hw/vfio/container.c
-index c04df26323..32a0251dd1 100644
---- a/hw/vfio/container.c
-+++ b/hw/vfio/container.c
-@@ -559,7 +559,7 @@ static int vfio_connect_container(VFIOGroup *group, AddressSpace *as,
-     QLIST_INIT(&container->giommu_list);
-     QLIST_INIT(&container->vrdl_list);
-     bcontainer = &container->bcontainer;
--    bcontainer->ops = &vfio_legacy_ops;
-+    vfio_container_init(bcontainer, &vfio_legacy_ops);
- 
-     ret = vfio_init_container(container, group->fd, errp);
-     if (ret) {
-@@ -661,6 +661,7 @@ put_space_exit:
- static void vfio_disconnect_container(VFIOGroup *group)
- {
-     VFIOContainer *container = group->container;
-+    VFIOContainerBase *bcontainer = &container->bcontainer;
- 
-     QLIST_REMOVE(group, container_next);
-     group->container = NULL;
-@@ -695,6 +696,7 @@ static void vfio_disconnect_container(VFIOGroup *group)
-             QLIST_REMOVE(giommu, giommu_next);
-             g_free(giommu);
-         }
-+        vfio_container_destroy(bcontainer);
- 
-         trace_vfio_disconnect_container(container->fd);
-         close(container->fd);
-diff --git a/include/hw/vfio/vfio-container-base.h b/include/hw/vfio/vfio-container-base.h
-index 56b033f59f..577f52ccbc 100644
---- a/include/hw/vfio/vfio-container-base.h
-+++ b/include/hw/vfio/vfio-container-base.h
-@@ -38,6 +38,10 @@ int vfio_container_dma_unmap(VFIOContainerBase *bcontainer,
-                              hwaddr iova, ram_addr_t size,
-                              IOMMUTLBEntry *iotlb);
- 
-+void vfio_container_init(VFIOContainerBase *bcontainer,
-+                         const VFIOIOMMUOps *ops);
-+void vfio_container_destroy(VFIOContainerBase *bcontainer);
-+
- struct VFIOIOMMUOps {
-     /* basic feature */
-     int (*dma_map)(VFIOContainerBase *bcontainer,
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-common-Move-giommu_list-in-base-container.patch b/SOURCES/kvm-vfio-common-Move-giommu_list-in-base-container.patch
deleted file mode 100644
index eec555b..0000000
--- a/SOURCES/kvm-vfio-common-Move-giommu_list-in-base-container.patch
+++ /dev/null
@@ -1,221 +0,0 @@
-From 36f4005c3dbb4c8b63a975494c75281de51c25f9 Mon Sep 17 00:00:00 2001
-From: Eric Auger <eric.auger@redhat.com>
-Date: Thu, 2 Nov 2023 15:12:31 +0800
-Subject: [PATCH 006/101] vfio/common: Move giommu_list in base container
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [5/67] ba5898e96c16c7f6e8108ae461b454d3c8c35404 (eauger1/centos-qemu-kvm)
-
-Move the giommu_list field in the base container and store
-the base container in the VFIOGuestIOMMU.
-
-No functional change intended.
-
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
-Signed-off-by: Yi Liu <yi.l.liu@intel.com>
-Signed-off-by: Yi Sun <yi.y.sun@linux.intel.com>
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit dddf83ab99eb832c449249397a1c302c6ed746bf)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/common.c                      | 17 +++++++++++------
- hw/vfio/container-base.c              |  9 +++++++++
- hw/vfio/container.c                   |  8 --------
- include/hw/vfio/vfio-common.h         |  9 ---------
- include/hw/vfio/vfio-container-base.h |  9 +++++++++
- 5 files changed, 29 insertions(+), 23 deletions(-)
-
-diff --git a/hw/vfio/common.c b/hw/vfio/common.c
-index e610771888..43580bcc43 100644
---- a/hw/vfio/common.c
-+++ b/hw/vfio/common.c
-@@ -292,7 +292,7 @@ static bool vfio_get_xlat_addr(IOMMUTLBEntry *iotlb, void **vaddr,
- static void vfio_iommu_map_notify(IOMMUNotifier *n, IOMMUTLBEntry *iotlb)
- {
-     VFIOGuestIOMMU *giommu = container_of(n, VFIOGuestIOMMU, n);
--    VFIOContainerBase *bcontainer = &giommu->container->bcontainer;
-+    VFIOContainerBase *bcontainer = giommu->bcontainer;
-     hwaddr iova = iotlb->iova + giommu->iommu_offset;
-     void *vaddr;
-     int ret;
-@@ -569,6 +569,7 @@ static void vfio_listener_region_add(MemoryListener *listener,
-                                      MemoryRegionSection *section)
- {
-     VFIOContainer *container = container_of(listener, VFIOContainer, listener);
-+    VFIOContainerBase *bcontainer = &container->bcontainer;
-     hwaddr iova, end;
-     Int128 llend, llsize;
-     void *vaddr;
-@@ -612,7 +613,7 @@ static void vfio_listener_region_add(MemoryListener *listener,
-         giommu->iommu_mr = iommu_mr;
-         giommu->iommu_offset = section->offset_within_address_space -
-                                section->offset_within_region;
--        giommu->container = container;
-+        giommu->bcontainer = bcontainer;
-         llend = int128_add(int128_make64(section->offset_within_region),
-                            section->size);
-         llend = int128_sub(llend, int128_one());
-@@ -647,7 +648,7 @@ static void vfio_listener_region_add(MemoryListener *listener,
-             g_free(giommu);
-             goto fail;
-         }
--        QLIST_INSERT_HEAD(&container->giommu_list, giommu, giommu_next);
-+        QLIST_INSERT_HEAD(&bcontainer->giommu_list, giommu, giommu_next);
-         memory_region_iommu_replay(giommu->iommu_mr, &giommu->n);
- 
-         return;
-@@ -732,6 +733,7 @@ static void vfio_listener_region_del(MemoryListener *listener,
-                                      MemoryRegionSection *section)
- {
-     VFIOContainer *container = container_of(listener, VFIOContainer, listener);
-+    VFIOContainerBase *bcontainer = &container->bcontainer;
-     hwaddr iova, end;
-     Int128 llend, llsize;
-     int ret;
-@@ -744,7 +746,7 @@ static void vfio_listener_region_del(MemoryListener *listener,
-     if (memory_region_is_iommu(section->mr)) {
-         VFIOGuestIOMMU *giommu;
- 
--        QLIST_FOREACH(giommu, &container->giommu_list, giommu_next) {
-+        QLIST_FOREACH(giommu, &bcontainer->giommu_list, giommu_next) {
-             if (MEMORY_REGION(giommu->iommu_mr) == section->mr &&
-                 giommu->n.start == section->offset_within_region) {
-                 memory_region_unregister_iommu_notifier(section->mr,
-@@ -1206,7 +1208,9 @@ static void vfio_iommu_map_dirty_notify(IOMMUNotifier *n, IOMMUTLBEntry *iotlb)
-     vfio_giommu_dirty_notifier *gdn = container_of(n,
-                                                 vfio_giommu_dirty_notifier, n);
-     VFIOGuestIOMMU *giommu = gdn->giommu;
--    VFIOContainer *container = giommu->container;
-+    VFIOContainerBase *bcontainer = giommu->bcontainer;
-+    VFIOContainer *container = container_of(bcontainer, VFIOContainer,
-+                                            bcontainer);
-     hwaddr iova = iotlb->iova + giommu->iommu_offset;
-     ram_addr_t translated_addr;
-     int ret = -EINVAL;
-@@ -1284,12 +1288,13 @@ static int vfio_sync_ram_discard_listener_dirty_bitmap(VFIOContainer *container,
- static int vfio_sync_dirty_bitmap(VFIOContainer *container,
-                                   MemoryRegionSection *section)
- {
-+    VFIOContainerBase *bcontainer = &container->bcontainer;
-     ram_addr_t ram_addr;
- 
-     if (memory_region_is_iommu(section->mr)) {
-         VFIOGuestIOMMU *giommu;
- 
--        QLIST_FOREACH(giommu, &container->giommu_list, giommu_next) {
-+        QLIST_FOREACH(giommu, &bcontainer->giommu_list, giommu_next) {
-             if (MEMORY_REGION(giommu->iommu_mr) == section->mr &&
-                 giommu->n.start == section->offset_within_region) {
-                 Int128 llend;
-diff --git a/hw/vfio/container-base.c b/hw/vfio/container-base.c
-index e929435751..20bcb9669a 100644
---- a/hw/vfio/container-base.c
-+++ b/hw/vfio/container-base.c
-@@ -34,8 +34,17 @@ int vfio_container_dma_unmap(VFIOContainerBase *bcontainer,
- void vfio_container_init(VFIOContainerBase *bcontainer, const VFIOIOMMUOps *ops)
- {
-     bcontainer->ops = ops;
-+    QLIST_INIT(&bcontainer->giommu_list);
- }
- 
- void vfio_container_destroy(VFIOContainerBase *bcontainer)
- {
-+    VFIOGuestIOMMU *giommu, *tmp;
-+
-+    QLIST_FOREACH_SAFE(giommu, &bcontainer->giommu_list, giommu_next, tmp) {
-+        memory_region_unregister_iommu_notifier(
-+                MEMORY_REGION(giommu->iommu_mr), &giommu->n);
-+        QLIST_REMOVE(giommu, giommu_next);
-+        g_free(giommu);
-+    }
- }
-diff --git a/hw/vfio/container.c b/hw/vfio/container.c
-index 32a0251dd1..133d3c8f5c 100644
---- a/hw/vfio/container.c
-+++ b/hw/vfio/container.c
-@@ -556,7 +556,6 @@ static int vfio_connect_container(VFIOGroup *group, AddressSpace *as,
-     container->dirty_pages_supported = false;
-     container->dma_max_mappings = 0;
-     container->iova_ranges = NULL;
--    QLIST_INIT(&container->giommu_list);
-     QLIST_INIT(&container->vrdl_list);
-     bcontainer = &container->bcontainer;
-     vfio_container_init(bcontainer, &vfio_legacy_ops);
-@@ -686,16 +685,9 @@ static void vfio_disconnect_container(VFIOGroup *group)
- 
-     if (QLIST_EMPTY(&container->group_list)) {
-         VFIOAddressSpace *space = container->space;
--        VFIOGuestIOMMU *giommu, *tmp;
- 
-         QLIST_REMOVE(container, next);
- 
--        QLIST_FOREACH_SAFE(giommu, &container->giommu_list, giommu_next, tmp) {
--            memory_region_unregister_iommu_notifier(
--                    MEMORY_REGION(giommu->iommu_mr), &giommu->n);
--            QLIST_REMOVE(giommu, giommu_next);
--            g_free(giommu);
--        }
-         vfio_container_destroy(bcontainer);
- 
-         trace_vfio_disconnect_container(container->fd);
-diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
-index 24a26345e5..6be082b8f2 100644
---- a/include/hw/vfio/vfio-common.h
-+++ b/include/hw/vfio/vfio-common.h
-@@ -95,7 +95,6 @@ typedef struct VFIOContainer {
-     uint64_t max_dirty_bitmap_size;
-     unsigned long pgsizes;
-     unsigned int dma_max_mappings;
--    QLIST_HEAD(, VFIOGuestIOMMU) giommu_list;
-     QLIST_HEAD(, VFIOHostDMAWindow) hostwin_list;
-     QLIST_HEAD(, VFIOGroup) group_list;
-     QLIST_HEAD(, VFIORamDiscardListener) vrdl_list;
-@@ -104,14 +103,6 @@ typedef struct VFIOContainer {
-     GList *iova_ranges;
- } VFIOContainer;
- 
--typedef struct VFIOGuestIOMMU {
--    VFIOContainer *container;
--    IOMMUMemoryRegion *iommu_mr;
--    hwaddr iommu_offset;
--    IOMMUNotifier n;
--    QLIST_ENTRY(VFIOGuestIOMMU) giommu_next;
--} VFIOGuestIOMMU;
--
- typedef struct VFIORamDiscardListener {
-     VFIOContainer *container;
-     MemoryRegion *mr;
-diff --git a/include/hw/vfio/vfio-container-base.h b/include/hw/vfio/vfio-container-base.h
-index 577f52ccbc..a11aec5755 100644
---- a/include/hw/vfio/vfio-container-base.h
-+++ b/include/hw/vfio/vfio-container-base.h
-@@ -29,8 +29,17 @@ typedef struct {
-  */
- typedef struct VFIOContainerBase {
-     const VFIOIOMMUOps *ops;
-+    QLIST_HEAD(, VFIOGuestIOMMU) giommu_list;
- } VFIOContainerBase;
- 
-+typedef struct VFIOGuestIOMMU {
-+    VFIOContainerBase *bcontainer;
-+    IOMMUMemoryRegion *iommu_mr;
-+    hwaddr iommu_offset;
-+    IOMMUNotifier n;
-+    QLIST_ENTRY(VFIOGuestIOMMU) giommu_next;
-+} VFIOGuestIOMMU;
-+
- int vfio_container_dma_map(VFIOContainerBase *bcontainer,
-                            hwaddr iova, ram_addr_t size,
-                            void *vaddr, bool readonly);
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-common-return-early-if-space-isn-t-empty.patch b/SOURCES/kvm-vfio-common-return-early-if-space-isn-t-empty.patch
deleted file mode 100644
index 261807a..0000000
--- a/SOURCES/kvm-vfio-common-return-early-if-space-isn-t-empty.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From e9476ee64edd81fafd409fb3ceaad80668446bff Mon Sep 17 00:00:00 2001
-From: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Date: Tue, 21 Nov 2023 16:44:02 +0800
-Subject: [PATCH 023/101] vfio/common: return early if space isn't empty
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [22/67] 239c21ae7cddc8efabc041b9c7774f15b4964631 (eauger1/centos-qemu-kvm)
-
-This is a trivial optimization. If there is active container in space,
-vfio_reset_handler will never be unregistered. So revert the check of
-space->containers and return early.
-
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Tested-by: Eric Auger <eric.auger@redhat.com>
-Tested-by: Nicolin Chen <nicolinc@nvidia.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 1eae5b7bd3ddd03b5591e9122b011c6520064a5a)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/common.c | 9 ++++++---
- 1 file changed, 6 insertions(+), 3 deletions(-)
-
-diff --git a/hw/vfio/common.c b/hw/vfio/common.c
-index 572ae7c934..934f4f5446 100644
---- a/hw/vfio/common.c
-+++ b/hw/vfio/common.c
-@@ -1462,10 +1462,13 @@ VFIOAddressSpace *vfio_get_address_space(AddressSpace *as)
- 
- void vfio_put_address_space(VFIOAddressSpace *space)
- {
--    if (QLIST_EMPTY(&space->containers)) {
--        QLIST_REMOVE(space, list);
--        g_free(space);
-+    if (!QLIST_EMPTY(&space->containers)) {
-+        return;
-     }
-+
-+    QLIST_REMOVE(space, list);
-+    g_free(space);
-+
-     if (QLIST_EMPTY(&vfio_address_spaces)) {
-         qemu_unregister_reset(vfio_reset_handler, NULL);
-     }
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-container-Convert-functions-to-base-container.patch b/SOURCES/kvm-vfio-container-Convert-functions-to-base-container.patch
deleted file mode 100644
index 62caf8a..0000000
--- a/SOURCES/kvm-vfio-container-Convert-functions-to-base-container.patch
+++ /dev/null
@@ -1,257 +0,0 @@
-From facad966c42b1ec38b12e45f2b84bd059542b60c Mon Sep 17 00:00:00 2001
-From: Eric Auger <eric.auger@redhat.com>
-Date: Thu, 2 Nov 2023 15:12:35 +0800
-Subject: [PATCH 010/101] vfio/container: Convert functions to base container
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [9/67] a0002d6e9cb0ca76e3e2f25208ecba22dd9f9a88 (eauger1/centos-qemu-kvm)
-
-In the prospect to get rid of VFIOContainer refs
-in common.c lets convert misc functions to use the base
-container object instead:
-
-vfio_devices_all_dirty_tracking
-vfio_devices_all_device_dirty_tracking
-vfio_devices_all_running_and_mig_active
-vfio_devices_query_dirty_bitmap
-vfio_get_dirty_bitmap
-
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit e1cac6b203f45b5322e831e8d50edfdf18609b09)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/common.c              | 42 +++++++++++++++--------------------
- hw/vfio/container.c           |  6 ++---
- hw/vfio/trace-events          |  2 +-
- include/hw/vfio/vfio-common.h |  9 ++++----
- 4 files changed, 26 insertions(+), 33 deletions(-)
-
-diff --git a/hw/vfio/common.c b/hw/vfio/common.c
-index 9415395ed9..cf6618f6ed 100644
---- a/hw/vfio/common.c
-+++ b/hw/vfio/common.c
-@@ -177,9 +177,8 @@ bool vfio_device_state_is_precopy(VFIODevice *vbasedev)
-            migration->device_state == VFIO_DEVICE_STATE_PRE_COPY_P2P;
- }
- 
--static bool vfio_devices_all_dirty_tracking(VFIOContainer *container)
-+static bool vfio_devices_all_dirty_tracking(VFIOContainerBase *bcontainer)
- {
--    VFIOContainerBase *bcontainer = &container->bcontainer;
-     VFIODevice *vbasedev;
-     MigrationState *ms = migrate_get_current();
- 
-@@ -204,9 +203,8 @@ static bool vfio_devices_all_dirty_tracking(VFIOContainer *container)
-     return true;
- }
- 
--bool vfio_devices_all_device_dirty_tracking(VFIOContainer *container)
-+bool vfio_devices_all_device_dirty_tracking(VFIOContainerBase *bcontainer)
- {
--    VFIOContainerBase *bcontainer = &container->bcontainer;
-     VFIODevice *vbasedev;
- 
-     QLIST_FOREACH(vbasedev, &bcontainer->device_list, container_next) {
-@@ -222,9 +220,8 @@ bool vfio_devices_all_device_dirty_tracking(VFIOContainer *container)
-  * Check if all VFIO devices are running and migration is active, which is
-  * essentially equivalent to the migration being in pre-copy phase.
-  */
--bool vfio_devices_all_running_and_mig_active(VFIOContainer *container)
-+bool vfio_devices_all_running_and_mig_active(VFIOContainerBase *bcontainer)
- {
--    VFIOContainerBase *bcontainer = &container->bcontainer;
-     VFIODevice *vbasedev;
- 
-     if (!migration_is_active(migrate_get_current())) {
-@@ -1082,7 +1079,7 @@ static void vfio_listener_log_global_start(MemoryListener *listener)
-     VFIOContainer *container = container_of(listener, VFIOContainer, listener);
-     int ret;
- 
--    if (vfio_devices_all_device_dirty_tracking(container)) {
-+    if (vfio_devices_all_device_dirty_tracking(&container->bcontainer)) {
-         ret = vfio_devices_dma_logging_start(container);
-     } else {
-         ret = vfio_container_set_dirty_page_tracking(&container->bcontainer,
-@@ -1101,7 +1098,7 @@ static void vfio_listener_log_global_stop(MemoryListener *listener)
-     VFIOContainer *container = container_of(listener, VFIOContainer, listener);
-     int ret = 0;
- 
--    if (vfio_devices_all_device_dirty_tracking(container)) {
-+    if (vfio_devices_all_device_dirty_tracking(&container->bcontainer)) {
-         vfio_devices_dma_logging_stop(container);
-     } else {
-         ret = vfio_container_set_dirty_page_tracking(&container->bcontainer,
-@@ -1141,11 +1138,10 @@ static int vfio_device_dma_logging_report(VFIODevice *vbasedev, hwaddr iova,
-     return 0;
- }
- 
--int vfio_devices_query_dirty_bitmap(VFIOContainer *container,
-+int vfio_devices_query_dirty_bitmap(VFIOContainerBase *bcontainer,
-                                     VFIOBitmap *vbmap, hwaddr iova,
-                                     hwaddr size)
- {
--    VFIOContainerBase *bcontainer = &container->bcontainer;
-     VFIODevice *vbasedev;
-     int ret;
- 
-@@ -1165,17 +1161,16 @@ int vfio_devices_query_dirty_bitmap(VFIOContainer *container,
-     return 0;
- }
- 
--int vfio_get_dirty_bitmap(VFIOContainer *container, uint64_t iova,
-+int vfio_get_dirty_bitmap(VFIOContainerBase *bcontainer, uint64_t iova,
-                           uint64_t size, ram_addr_t ram_addr)
- {
-     bool all_device_dirty_tracking =
--        vfio_devices_all_device_dirty_tracking(container);
-+        vfio_devices_all_device_dirty_tracking(bcontainer);
-     uint64_t dirty_pages;
-     VFIOBitmap vbmap;
-     int ret;
- 
--    if (!container->bcontainer.dirty_pages_supported &&
--        !all_device_dirty_tracking) {
-+    if (!bcontainer->dirty_pages_supported && !all_device_dirty_tracking) {
-         cpu_physical_memory_set_dirty_range(ram_addr, size,
-                                             tcg_enabled() ? DIRTY_CLIENTS_ALL :
-                                             DIRTY_CLIENTS_NOCODE);
-@@ -1188,10 +1183,9 @@ int vfio_get_dirty_bitmap(VFIOContainer *container, uint64_t iova,
-     }
- 
-     if (all_device_dirty_tracking) {
--        ret = vfio_devices_query_dirty_bitmap(container, &vbmap, iova, size);
-+        ret = vfio_devices_query_dirty_bitmap(bcontainer, &vbmap, iova, size);
-     } else {
--        ret = vfio_container_query_dirty_bitmap(&container->bcontainer, &vbmap,
--                                                iova, size);
-+        ret = vfio_container_query_dirty_bitmap(bcontainer, &vbmap, iova, size);
-     }
- 
-     if (ret) {
-@@ -1201,8 +1195,7 @@ int vfio_get_dirty_bitmap(VFIOContainer *container, uint64_t iova,
-     dirty_pages = cpu_physical_memory_set_dirty_lebitmap(vbmap.bitmap, ram_addr,
-                                                          vbmap.pages);
- 
--    trace_vfio_get_dirty_bitmap(container->fd, iova, size, vbmap.size,
--                                ram_addr, dirty_pages);
-+    trace_vfio_get_dirty_bitmap(iova, size, vbmap.size, ram_addr, dirty_pages);
- out:
-     g_free(vbmap.bitmap);
- 
-@@ -1236,8 +1229,8 @@ static void vfio_iommu_map_dirty_notify(IOMMUNotifier *n, IOMMUTLBEntry *iotlb)
- 
-     rcu_read_lock();
-     if (vfio_get_xlat_addr(iotlb, NULL, &translated_addr, NULL)) {
--        ret = vfio_get_dirty_bitmap(container, iova, iotlb->addr_mask + 1,
--                                    translated_addr);
-+        ret = vfio_get_dirty_bitmap(&container->bcontainer, iova,
-+                                    iotlb->addr_mask + 1, translated_addr);
-         if (ret) {
-             error_report("vfio_iommu_map_dirty_notify(%p, 0x%"HWADDR_PRIx", "
-                          "0x%"HWADDR_PRIx") = %d (%s)",
-@@ -1266,7 +1259,8 @@ static int vfio_ram_discard_get_dirty_bitmap(MemoryRegionSection *section,
-      * Sync the whole mapped region (spanning multiple individual mappings)
-      * in one go.
-      */
--    return vfio_get_dirty_bitmap(vrdl->container, iova, size, ram_addr);
-+    return vfio_get_dirty_bitmap(&vrdl->container->bcontainer, iova, size,
-+                                 ram_addr);
- }
- 
- static int vfio_sync_ram_discard_listener_dirty_bitmap(VFIOContainer *container,
-@@ -1335,7 +1329,7 @@ static int vfio_sync_dirty_bitmap(VFIOContainer *container,
-     ram_addr = memory_region_get_ram_addr(section->mr) +
-                section->offset_within_region;
- 
--    return vfio_get_dirty_bitmap(container,
-+    return vfio_get_dirty_bitmap(&container->bcontainer,
-                    REAL_HOST_PAGE_ALIGN(section->offset_within_address_space),
-                    int128_get64(section->size), ram_addr);
- }
-@@ -1350,7 +1344,7 @@ static void vfio_listener_log_sync(MemoryListener *listener,
-         return;
-     }
- 
--    if (vfio_devices_all_dirty_tracking(container)) {
-+    if (vfio_devices_all_dirty_tracking(&container->bcontainer)) {
-         ret = vfio_sync_dirty_bitmap(container, section);
-         if (ret) {
-             error_report("vfio: Failed to sync dirty bitmap, err: %d (%s)", ret,
-diff --git a/hw/vfio/container.c b/hw/vfio/container.c
-index 63a906de93..7bd81eab09 100644
---- a/hw/vfio/container.c
-+++ b/hw/vfio/container.c
-@@ -129,8 +129,8 @@ static int vfio_legacy_dma_unmap(VFIOContainerBase *bcontainer, hwaddr iova,
-     bool need_dirty_sync = false;
-     int ret;
- 
--    if (iotlb && vfio_devices_all_running_and_mig_active(container)) {
--        if (!vfio_devices_all_device_dirty_tracking(container) &&
-+    if (iotlb && vfio_devices_all_running_and_mig_active(bcontainer)) {
-+        if (!vfio_devices_all_device_dirty_tracking(bcontainer) &&
-             container->bcontainer.dirty_pages_supported) {
-             return vfio_dma_unmap_bitmap(container, iova, size, iotlb);
-         }
-@@ -162,7 +162,7 @@ static int vfio_legacy_dma_unmap(VFIOContainerBase *bcontainer, hwaddr iova,
-     }
- 
-     if (need_dirty_sync) {
--        ret = vfio_get_dirty_bitmap(container, iova, size,
-+        ret = vfio_get_dirty_bitmap(bcontainer, iova, size,
-                                     iotlb->translated_addr);
-         if (ret) {
-             return ret;
-diff --git a/hw/vfio/trace-events b/hw/vfio/trace-events
-index 9f7fedee98..08a1f9dfa4 100644
---- a/hw/vfio/trace-events
-+++ b/hw/vfio/trace-events
-@@ -117,7 +117,7 @@ vfio_region_sparse_mmap_header(const char *name, int index, int nr_areas) "Devic
- vfio_region_sparse_mmap_entry(int i, unsigned long start, unsigned long end) "sparse entry %d [0x%lx - 0x%lx]"
- vfio_get_dev_region(const char *name, int index, uint32_t type, uint32_t subtype) "%s index %d, %08x/%08x"
- vfio_legacy_dma_unmap_overflow_workaround(void) ""
--vfio_get_dirty_bitmap(int fd, uint64_t iova, uint64_t size, uint64_t bitmap_size, uint64_t start, uint64_t dirty_pages) "container fd=%d, iova=0x%"PRIx64" size= 0x%"PRIx64" bitmap_size=0x%"PRIx64" start=0x%"PRIx64" dirty_pages=%"PRIu64
-+vfio_get_dirty_bitmap(uint64_t iova, uint64_t size, uint64_t bitmap_size, uint64_t start, uint64_t dirty_pages) "iova=0x%"PRIx64" size= 0x%"PRIx64" bitmap_size=0x%"PRIx64" start=0x%"PRIx64" dirty_pages=%"PRIu64
- vfio_iommu_map_dirty_notify(uint64_t iova_start, uint64_t iova_end) "iommu dirty @ 0x%"PRIx64" - 0x%"PRIx64
- 
- # platform.c
-diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
-index 9740cf9fbc..bc67e1316c 100644
---- a/include/hw/vfio/vfio-common.h
-+++ b/include/hw/vfio/vfio-common.h
-@@ -186,7 +186,6 @@ typedef struct VFIODisplay {
- 
- VFIOAddressSpace *vfio_get_address_space(AddressSpace *as);
- void vfio_put_address_space(VFIOAddressSpace *space);
--bool vfio_devices_all_running_and_saving(VFIOContainer *container);
- 
- /* SPAPR specific */
- int vfio_container_add_section_window(VFIOContainer *container,
-@@ -260,11 +259,11 @@ bool vfio_migration_realize(VFIODevice *vbasedev, Error **errp);
- void vfio_migration_exit(VFIODevice *vbasedev);
- 
- int vfio_bitmap_alloc(VFIOBitmap *vbmap, hwaddr size);
--bool vfio_devices_all_running_and_mig_active(VFIOContainer *container);
--bool vfio_devices_all_device_dirty_tracking(VFIOContainer *container);
--int vfio_devices_query_dirty_bitmap(VFIOContainer *container,
-+bool vfio_devices_all_running_and_mig_active(VFIOContainerBase *bcontainer);
-+bool vfio_devices_all_device_dirty_tracking(VFIOContainerBase *bcontainer);
-+int vfio_devices_query_dirty_bitmap(VFIOContainerBase *bcontainer,
-                                     VFIOBitmap *vbmap, hwaddr iova,
-                                     hwaddr size);
--int vfio_get_dirty_bitmap(VFIOContainer *container, uint64_t iova,
-+int vfio_get_dirty_bitmap(VFIOContainerBase *bcontainer, uint64_t iova,
-                                  uint64_t size, ram_addr_t ram_addr);
- #endif /* HW_VFIO_VFIO_COMMON_H */
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-container-Implement-attach-detach_device.patch b/SOURCES/kvm-vfio-container-Implement-attach-detach_device.patch
deleted file mode 100644
index 92e9a38..0000000
--- a/SOURCES/kvm-vfio-container-Implement-attach-detach_device.patch
+++ /dev/null
@@ -1,97 +0,0 @@
-From a5d19bfbfddb36fa6d68ca6282a5acd9b245d48a Mon Sep 17 00:00:00 2001
-From: Eric Auger <eric.auger@redhat.com>
-Date: Thu, 2 Nov 2023 15:12:41 +0800
-Subject: [PATCH 016/101] vfio/container: Implement attach/detach_device
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [15/67] e233c90e4af2061dc0612bc1b1d17be1a47daeae (eauger1/centos-qemu-kvm)
-
-No functional change intended.
-
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
-Signed-off-by: Yi Liu <yi.l.liu@intel.com>
-Signed-off-by: Yi Sun <yi.y.sun@linux.intel.com>
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 1eb31f13b24c49884d8256f96a6664df2dd0824d)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/common.c    | 16 ++++++++++++++++
- hw/vfio/container.c | 12 +++++-------
- 2 files changed, 21 insertions(+), 7 deletions(-)
-
-diff --git a/hw/vfio/common.c b/hw/vfio/common.c
-index 8ef2e7967d..483ba82089 100644
---- a/hw/vfio/common.c
-+++ b/hw/vfio/common.c
-@@ -1498,3 +1498,19 @@ retry:
- 
-     return info;
- }
-+
-+int vfio_attach_device(char *name, VFIODevice *vbasedev,
-+                       AddressSpace *as, Error **errp)
-+{
-+    const VFIOIOMMUOps *ops = &vfio_legacy_ops;
-+
-+    return ops->attach_device(name, vbasedev, as, errp);
-+}
-+
-+void vfio_detach_device(VFIODevice *vbasedev)
-+{
-+    if (!vbasedev->bcontainer) {
-+        return;
-+    }
-+    vbasedev->bcontainer->ops->detach_device(vbasedev);
-+}
-diff --git a/hw/vfio/container.c b/hw/vfio/container.c
-index 721c0d7375..6bacf38222 100644
---- a/hw/vfio/container.c
-+++ b/hw/vfio/container.c
-@@ -873,8 +873,8 @@ static int vfio_device_groupid(VFIODevice *vbasedev, Error **errp)
-  * @name and @vbasedev->name are likely to be different depending
-  * on the type of the device, hence the need for passing @name
-  */
--int vfio_attach_device(char *name, VFIODevice *vbasedev,
--                       AddressSpace *as, Error **errp)
-+static int vfio_legacy_attach_device(const char *name, VFIODevice *vbasedev,
-+                                     AddressSpace *as, Error **errp)
- {
-     int groupid = vfio_device_groupid(vbasedev, errp);
-     VFIODevice *vbasedev_iter;
-@@ -914,14 +914,10 @@ int vfio_attach_device(char *name, VFIODevice *vbasedev,
-     return ret;
- }
- 
--void vfio_detach_device(VFIODevice *vbasedev)
-+static void vfio_legacy_detach_device(VFIODevice *vbasedev)
- {
-     VFIOGroup *group = vbasedev->group;
- 
--    if (!vbasedev->bcontainer) {
--        return;
--    }
--
-     QLIST_REMOVE(vbasedev, global_next);
-     QLIST_REMOVE(vbasedev, container_next);
-     vbasedev->bcontainer = NULL;
-@@ -933,6 +929,8 @@ void vfio_detach_device(VFIODevice *vbasedev)
- const VFIOIOMMUOps vfio_legacy_ops = {
-     .dma_map = vfio_legacy_dma_map,
-     .dma_unmap = vfio_legacy_dma_unmap,
-+    .attach_device = vfio_legacy_attach_device,
-+    .detach_device = vfio_legacy_detach_device,
-     .set_dirty_page_tracking = vfio_legacy_set_dirty_page_tracking,
-     .query_dirty_bitmap = vfio_legacy_query_dirty_bitmap,
- };
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-container-Initialize-VFIOIOMMUOps-under-vfio_in.patch b/SOURCES/kvm-vfio-container-Initialize-VFIOIOMMUOps-under-vfio_in.patch
deleted file mode 100644
index 42b406b..0000000
--- a/SOURCES/kvm-vfio-container-Initialize-VFIOIOMMUOps-under-vfio_in.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-From c3c9f366c356032fa57ff7cc664732ba87ceb3fb Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
-Date: Tue, 19 Dec 2023 07:58:18 +0100
-Subject: [PATCH 051/101] vfio/container: Initialize VFIOIOMMUOps under
- vfio_init_container()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [50/67] f325136391b22babadb1be3394c527deecdcd3ca (eauger1/centos-qemu-kvm)
-
-vfio_init_container() already defines the IOMMU type of the container.
-Do the same for the VFIOIOMMUOps struct. This prepares ground for the
-following patches that will deduce the associated VFIOIOMMUOps struct
-from the IOMMU type.
-
-Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Tested-by: Eric Farman <farman@linux.ibm.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit bffe92af0e7571868d47a1d1cd2205e13054d492)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/container.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/hw/vfio/container.c b/hw/vfio/container.c
-index afcfe80488..f4a0434a52 100644
---- a/hw/vfio/container.c
-+++ b/hw/vfio/container.c
-@@ -370,7 +370,7 @@ static int vfio_get_iommu_type(VFIOContainer *container,
- }
- 
- static int vfio_init_container(VFIOContainer *container, int group_fd,
--                               Error **errp)
-+                               VFIOAddressSpace *space, Error **errp)
- {
-     int iommu_type, ret;
- 
-@@ -401,6 +401,7 @@ static int vfio_init_container(VFIOContainer *container, int group_fd,
-     }
- 
-     container->iommu_type = iommu_type;
-+    vfio_container_init(&container->bcontainer, space, &vfio_legacy_ops);
-     return 0;
- }
- 
-@@ -583,9 +584,8 @@ static int vfio_connect_container(VFIOGroup *group, AddressSpace *as,
-     container = g_malloc0(sizeof(*container));
-     container->fd = fd;
-     bcontainer = &container->bcontainer;
--    vfio_container_init(bcontainer, space, &vfio_legacy_ops);
- 
--    ret = vfio_init_container(container, group->fd, errp);
-+    ret = vfio_init_container(container, group->fd, space, errp);
-     if (ret) {
-         goto free_container_exit;
-     }
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-container-Intoduce-a-new-VFIOIOMMUClass-setup-h.patch b/SOURCES/kvm-vfio-container-Intoduce-a-new-VFIOIOMMUClass-setup-h.patch
deleted file mode 100644
index 3411ecb..0000000
--- a/SOURCES/kvm-vfio-container-Intoduce-a-new-VFIOIOMMUClass-setup-h.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From 29f13011e62f5370ef7fb3248dc85c90ae5bb042 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
-Date: Tue, 19 Dec 2023 07:58:21 +0100
-Subject: [PATCH 054/101] vfio/container: Intoduce a new VFIOIOMMUClass::setup
- handler
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [53/67] 8641161afc33d68795bcf51a47e89061b34d50a8 (eauger1/centos-qemu-kvm)
-
-This will help in converting the sPAPR IOMMU backend to a QOM interface.
-
-Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Tested-by: Eric Farman <farman@linux.ibm.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 61d893f2cdb34a2b0255f9b5fbba6b49b94ff730)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/container.c                   | 1 +
- include/hw/vfio/vfio-container-base.h | 1 +
- 2 files changed, 2 insertions(+)
-
-diff --git a/hw/vfio/container.c b/hw/vfio/container.c
-index 220e838a91..c22bdd3216 100644
---- a/hw/vfio/container.c
-+++ b/hw/vfio/container.c
-@@ -1129,6 +1129,7 @@ static void vfio_iommu_legacy_class_init(ObjectClass *klass, void *data)
- {
-     VFIOIOMMUClass *vioc = VFIO_IOMMU_CLASS(klass);
- 
-+    vioc->setup = vfio_legacy_setup;
-     vioc->dma_map = vfio_legacy_dma_map;
-     vioc->dma_unmap = vfio_legacy_dma_unmap;
-     vioc->attach_device = vfio_legacy_attach_device;
-diff --git a/include/hw/vfio/vfio-container-base.h b/include/hw/vfio/vfio-container-base.h
-index c60370fc5e..ce8b1fba88 100644
---- a/include/hw/vfio/vfio-container-base.h
-+++ b/include/hw/vfio/vfio-container-base.h
-@@ -109,6 +109,7 @@ struct VFIOIOMMUClass {
-     InterfaceClass parent_class;
- 
-     /* basic feature */
-+    int (*setup)(VFIOContainerBase *bcontainer, Error **errp);
-     int (*dma_map)(const VFIOContainerBase *bcontainer,
-                    hwaddr iova, ram_addr_t size,
-                    void *vaddr, bool readonly);
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-container-Introduce-a-VFIOIOMMU-QOM-interface.patch b/SOURCES/kvm-vfio-container-Introduce-a-VFIOIOMMU-QOM-interface.patch
deleted file mode 100644
index 7139e64..0000000
--- a/SOURCES/kvm-vfio-container-Introduce-a-VFIOIOMMU-QOM-interface.patch
+++ /dev/null
@@ -1,143 +0,0 @@
-From 5b63e4595e106196ef922b7f762c8f4150d73979 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
-Date: Tue, 19 Dec 2023 07:58:19 +0100
-Subject: [PATCH 052/101] vfio/container: Introduce a VFIOIOMMU QOM interface
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [51/67] 7c06e2165efe94dcd203d44e422a7aa9fac9816c (eauger1/centos-qemu-kvm)
-
-VFIOContainerBase was not introduced as an abstract QOM object because
-it felt unnecessary to expose all the IOMMU backends to the QEMU
-machine and human interface. However, we can still abstract the IOMMU
-backend handlers using a QOM interface class. This provides more
-flexibility when referencing the various implementations.
-
-Simply transform the VFIOIOMMUOps struct in an InterfaceClass and do
-some initial name replacements. Next changes will start converting
-VFIOIOMMUOps.
-
-Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Tested-by: Eric Farman <farman@linux.ibm.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit fdaa774e67435a328c0e28006c4d749f2198294a)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/common.c                      |  2 +-
- hw/vfio/container-base.c              | 12 +++++++++++-
- hw/vfio/pci.c                         |  2 +-
- include/hw/vfio/vfio-container-base.h | 23 +++++++++++++++++++----
- 4 files changed, 32 insertions(+), 7 deletions(-)
-
-diff --git a/hw/vfio/common.c b/hw/vfio/common.c
-index 08a3e57672..49dab41566 100644
---- a/hw/vfio/common.c
-+++ b/hw/vfio/common.c
-@@ -1503,7 +1503,7 @@ retry:
- int vfio_attach_device(char *name, VFIODevice *vbasedev,
-                        AddressSpace *as, Error **errp)
- {
--    const VFIOIOMMUOps *ops = &vfio_legacy_ops;
-+    const VFIOIOMMUClass *ops = &vfio_legacy_ops;
- 
- #ifdef CONFIG_IOMMUFD
-     if (vbasedev->iommufd) {
-diff --git a/hw/vfio/container-base.c b/hw/vfio/container-base.c
-index 1ffd25bbfa..913ae49077 100644
---- a/hw/vfio/container-base.c
-+++ b/hw/vfio/container-base.c
-@@ -72,7 +72,7 @@ int vfio_container_query_dirty_bitmap(const VFIOContainerBase *bcontainer,
- }
- 
- void vfio_container_init(VFIOContainerBase *bcontainer, VFIOAddressSpace *space,
--                         const VFIOIOMMUOps *ops)
-+                         const VFIOIOMMUClass *ops)
- {
-     bcontainer->ops = ops;
-     bcontainer->space = space;
-@@ -99,3 +99,13 @@ void vfio_container_destroy(VFIOContainerBase *bcontainer)
- 
-     g_list_free_full(bcontainer->iova_ranges, g_free);
- }
-+
-+static const TypeInfo types[] = {
-+    {
-+        .name = TYPE_VFIO_IOMMU,
-+        .parent = TYPE_INTERFACE,
-+        .class_size = sizeof(VFIOIOMMUClass),
-+    },
-+};
-+
-+DEFINE_TYPES(types)
-diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
-index 83c3238608..adb7c09367 100644
---- a/hw/vfio/pci.c
-+++ b/hw/vfio/pci.c
-@@ -2491,7 +2491,7 @@ int vfio_pci_get_pci_hot_reset_info(VFIOPCIDevice *vdev,
- static int vfio_pci_hot_reset(VFIOPCIDevice *vdev, bool single)
- {
-     VFIODevice *vbasedev = &vdev->vbasedev;
--    const VFIOIOMMUOps *ops = vbasedev->bcontainer->ops;
-+    const VFIOIOMMUClass *ops = vbasedev->bcontainer->ops;
- 
-     return ops->pci_hot_reset(vbasedev, single);
- }
-diff --git a/include/hw/vfio/vfio-container-base.h b/include/hw/vfio/vfio-container-base.h
-index 5c9594b6c7..d6147b4aee 100644
---- a/include/hw/vfio/vfio-container-base.h
-+++ b/include/hw/vfio/vfio-container-base.h
-@@ -16,7 +16,8 @@
- #include "exec/memory.h"
- 
- typedef struct VFIODevice VFIODevice;
--typedef struct VFIOIOMMUOps VFIOIOMMUOps;
-+typedef struct VFIOIOMMUClass VFIOIOMMUClass;
-+#define VFIOIOMMUOps VFIOIOMMUClass /* To remove */
- 
- typedef struct {
-     unsigned long *bitmap;
-@@ -34,7 +35,7 @@ typedef struct VFIOAddressSpace {
-  * This is the base object for vfio container backends
-  */
- typedef struct VFIOContainerBase {
--    const VFIOIOMMUOps *ops;
-+    const VFIOIOMMUClass *ops;
-     VFIOAddressSpace *space;
-     MemoryListener listener;
-     Error *error;
-@@ -88,10 +89,24 @@ int vfio_container_query_dirty_bitmap(const VFIOContainerBase *bcontainer,
- 
- void vfio_container_init(VFIOContainerBase *bcontainer,
-                          VFIOAddressSpace *space,
--                         const VFIOIOMMUOps *ops);
-+                         const VFIOIOMMUClass *ops);
- void vfio_container_destroy(VFIOContainerBase *bcontainer);
- 
--struct VFIOIOMMUOps {
-+
-+#define TYPE_VFIO_IOMMU "vfio-iommu"
-+
-+/*
-+ * VFIOContainerBase is not an abstract QOM object because it felt
-+ * unnecessary to expose all the IOMMU backends to the QEMU machine
-+ * and human interface. However, we can still abstract the IOMMU
-+ * backend handlers using a QOM interface class. This provides more
-+ * flexibility when referencing the various implementations.
-+ */
-+DECLARE_CLASS_CHECKERS(VFIOIOMMUClass, VFIO_IOMMU, TYPE_VFIO_IOMMU)
-+
-+struct VFIOIOMMUClass {
-+    InterfaceClass parent_class;
-+
-     /* basic feature */
-     int (*dma_map)(const VFIOContainerBase *bcontainer,
-                    hwaddr iova, ram_addr_t size,
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-container-Introduce-a-VFIOIOMMU-legacy-QOM-inte.patch b/SOURCES/kvm-vfio-container-Introduce-a-VFIOIOMMU-legacy-QOM-inte.patch
deleted file mode 100644
index 60439ff..0000000
--- a/SOURCES/kvm-vfio-container-Introduce-a-VFIOIOMMU-legacy-QOM-inte.patch
+++ /dev/null
@@ -1,168 +0,0 @@
-From 58927bf236541b9423f855eca1970f7a3cf864a9 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
-Date: Tue, 19 Dec 2023 07:58:20 +0100
-Subject: [PATCH 053/101] vfio/container: Introduce a VFIOIOMMU legacy QOM
- interface
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [52/67] a81f39d13305e84699313e17ae64d10ff4b09067 (eauger1/centos-qemu-kvm)
-
-Convert the legacy VFIOIOMMUOps struct to the new VFIOIOMMU QOM
-interface. The set of of operations for this backend can be referenced
-with a literal typename instead of a C struct. This will simplify
-support of multiple backends.
-
-Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Tested-by: Eric Farman <farman@linux.ibm.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 9812feefab3a4ff95a6cfd73aecb120b406bc98c)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/common.c                      |  6 ++-
- hw/vfio/container.c                   | 58 ++++++++++++++++++++++-----
- include/hw/vfio/vfio-common.h         |  1 -
- include/hw/vfio/vfio-container-base.h |  1 +
- 4 files changed, 55 insertions(+), 11 deletions(-)
-
-diff --git a/hw/vfio/common.c b/hw/vfio/common.c
-index 49dab41566..2329d0efc8 100644
---- a/hw/vfio/common.c
-+++ b/hw/vfio/common.c
-@@ -1503,13 +1503,17 @@ retry:
- int vfio_attach_device(char *name, VFIODevice *vbasedev,
-                        AddressSpace *as, Error **errp)
- {
--    const VFIOIOMMUClass *ops = &vfio_legacy_ops;
-+    const VFIOIOMMUClass *ops =
-+        VFIO_IOMMU_CLASS(object_class_by_name(TYPE_VFIO_IOMMU_LEGACY));
- 
- #ifdef CONFIG_IOMMUFD
-     if (vbasedev->iommufd) {
-         ops = &vfio_iommufd_ops;
-     }
- #endif
-+
-+    assert(ops);
-+
-     return ops->attach_device(name, vbasedev, as, errp);
- }
- 
-diff --git a/hw/vfio/container.c b/hw/vfio/container.c
-index f4a0434a52..220e838a91 100644
---- a/hw/vfio/container.c
-+++ b/hw/vfio/container.c
-@@ -369,10 +369,30 @@ static int vfio_get_iommu_type(VFIOContainer *container,
-     return -EINVAL;
- }
- 
-+/*
-+ * vfio_get_iommu_ops - get a VFIOIOMMUClass associated with a type
-+ */
-+static const VFIOIOMMUClass *vfio_get_iommu_class(int iommu_type, Error **errp)
-+{
-+    ObjectClass *klass = NULL;
-+
-+    switch (iommu_type) {
-+    case VFIO_TYPE1v2_IOMMU:
-+    case VFIO_TYPE1_IOMMU:
-+        klass = object_class_by_name(TYPE_VFIO_IOMMU_LEGACY);
-+        break;
-+    default:
-+        g_assert_not_reached();
-+    };
-+
-+    return VFIO_IOMMU_CLASS(klass);
-+}
-+
- static int vfio_init_container(VFIOContainer *container, int group_fd,
-                                VFIOAddressSpace *space, Error **errp)
- {
-     int iommu_type, ret;
-+    const VFIOIOMMUClass *vioc;
- 
-     iommu_type = vfio_get_iommu_type(container, errp);
-     if (iommu_type < 0) {
-@@ -401,7 +421,14 @@ static int vfio_init_container(VFIOContainer *container, int group_fd,
-     }
- 
-     container->iommu_type = iommu_type;
--    vfio_container_init(&container->bcontainer, space, &vfio_legacy_ops);
-+
-+    vioc = vfio_get_iommu_class(iommu_type, errp);
-+    if (!vioc) {
-+        error_setg(errp, "No available IOMMU models");
-+        return -EINVAL;
-+    }
-+
-+    vfio_container_init(&container->bcontainer, space, vioc);
-     return 0;
- }
- 
-@@ -1098,12 +1125,25 @@ out_single:
-     return ret;
- }
- 
--const VFIOIOMMUOps vfio_legacy_ops = {
--    .dma_map = vfio_legacy_dma_map,
--    .dma_unmap = vfio_legacy_dma_unmap,
--    .attach_device = vfio_legacy_attach_device,
--    .detach_device = vfio_legacy_detach_device,
--    .set_dirty_page_tracking = vfio_legacy_set_dirty_page_tracking,
--    .query_dirty_bitmap = vfio_legacy_query_dirty_bitmap,
--    .pci_hot_reset = vfio_legacy_pci_hot_reset,
-+static void vfio_iommu_legacy_class_init(ObjectClass *klass, void *data)
-+{
-+    VFIOIOMMUClass *vioc = VFIO_IOMMU_CLASS(klass);
-+
-+    vioc->dma_map = vfio_legacy_dma_map;
-+    vioc->dma_unmap = vfio_legacy_dma_unmap;
-+    vioc->attach_device = vfio_legacy_attach_device;
-+    vioc->detach_device = vfio_legacy_detach_device;
-+    vioc->set_dirty_page_tracking = vfio_legacy_set_dirty_page_tracking;
-+    vioc->query_dirty_bitmap = vfio_legacy_query_dirty_bitmap;
-+    vioc->pci_hot_reset = vfio_legacy_pci_hot_reset;
- };
-+
-+static const TypeInfo types[] = {
-+    {
-+        .name = TYPE_VFIO_IOMMU_LEGACY,
-+        .parent = TYPE_VFIO_IOMMU,
-+        .class_init = vfio_iommu_legacy_class_init,
-+    },
-+};
-+
-+DEFINE_TYPES(types)
-diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
-index b8aa8a5495..14c497b6b0 100644
---- a/include/hw/vfio/vfio-common.h
-+++ b/include/hw/vfio/vfio-common.h
-@@ -210,7 +210,6 @@ typedef QLIST_HEAD(VFIOGroupList, VFIOGroup) VFIOGroupList;
- typedef QLIST_HEAD(VFIODeviceList, VFIODevice) VFIODeviceList;
- extern VFIOGroupList vfio_group_list;
- extern VFIODeviceList vfio_device_list;
--extern const VFIOIOMMUOps vfio_legacy_ops;
- extern const VFIOIOMMUOps vfio_iommufd_ops;
- extern const MemoryListener vfio_memory_listener;
- extern int vfio_kvm_device_fd;
-diff --git a/include/hw/vfio/vfio-container-base.h b/include/hw/vfio/vfio-container-base.h
-index d6147b4aee..c60370fc5e 100644
---- a/include/hw/vfio/vfio-container-base.h
-+++ b/include/hw/vfio/vfio-container-base.h
-@@ -94,6 +94,7 @@ void vfio_container_destroy(VFIOContainerBase *bcontainer);
- 
- 
- #define TYPE_VFIO_IOMMU "vfio-iommu"
-+#define TYPE_VFIO_IOMMU_LEGACY TYPE_VFIO_IOMMU "-legacy"
- 
- /*
-  * VFIOContainerBase is not an abstract QOM object because it felt
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-container-Introduce-a-empty-VFIOIOMMUOps.patch b/SOURCES/kvm-vfio-container-Introduce-a-empty-VFIOIOMMUOps.patch
deleted file mode 100644
index 2840e2c..0000000
--- a/SOURCES/kvm-vfio-container-Introduce-a-empty-VFIOIOMMUOps.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-From e56f961fbe95a53a52c5eca00b4fca17d825e860 Mon Sep 17 00:00:00 2001
-From: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Date: Thu, 2 Nov 2023 15:12:28 +0800
-Subject: [PATCH 003/101] vfio/container: Introduce a empty VFIOIOMMUOps
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [2/67] 0de0afffce42fa4a17f6d33a10b6162cdfbe8150 (eauger1/centos-qemu-kvm)
-
-This empty VFIOIOMMUOps named vfio_legacy_ops will hold all general
-IOMMU ops of legacy container.
-
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit d24668579184f4098779983724ec74cd3db62e10)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/container.c           | 5 +++++
- include/hw/vfio/vfio-common.h | 2 +-
- 2 files changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/hw/vfio/container.c b/hw/vfio/container.c
-index 242010036a..4bc43ddfa4 100644
---- a/hw/vfio/container.c
-+++ b/hw/vfio/container.c
-@@ -472,6 +472,7 @@ static int vfio_connect_container(VFIOGroup *group, AddressSpace *as,
-                                   Error **errp)
- {
-     VFIOContainer *container;
-+    VFIOContainerBase *bcontainer;
-     int ret, fd;
-     VFIOAddressSpace *space;
- 
-@@ -552,6 +553,8 @@ static int vfio_connect_container(VFIOGroup *group, AddressSpace *as,
-     container->iova_ranges = NULL;
-     QLIST_INIT(&container->giommu_list);
-     QLIST_INIT(&container->vrdl_list);
-+    bcontainer = &container->bcontainer;
-+    bcontainer->ops = &vfio_legacy_ops;
- 
-     ret = vfio_init_container(container, group->fd, errp);
-     if (ret) {
-@@ -933,3 +936,5 @@ void vfio_detach_device(VFIODevice *vbasedev)
-     vfio_put_base_device(vbasedev);
-     vfio_put_group(group);
- }
-+
-+const VFIOIOMMUOps vfio_legacy_ops;
-diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
-index 586d153c12..678161f207 100644
---- a/include/hw/vfio/vfio-common.h
-+++ b/include/hw/vfio/vfio-common.h
-@@ -255,7 +255,7 @@ typedef QLIST_HEAD(VFIOGroupList, VFIOGroup) VFIOGroupList;
- typedef QLIST_HEAD(VFIODeviceList, VFIODevice) VFIODeviceList;
- extern VFIOGroupList vfio_group_list;
- extern VFIODeviceList vfio_device_list;
--
-+extern const VFIOIOMMUOps vfio_legacy_ops;
- extern const MemoryListener vfio_memory_listener;
- extern int vfio_kvm_device_fd;
- 
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-container-Introduce-vfio_legacy_setup-for-furth.patch b/SOURCES/kvm-vfio-container-Introduce-vfio_legacy_setup-for-furth.patch
deleted file mode 100644
index ae9ccd8..0000000
--- a/SOURCES/kvm-vfio-container-Introduce-vfio_legacy_setup-for-furth.patch
+++ /dev/null
@@ -1,118 +0,0 @@
-From 6c7546756e979e4f5ba29ae51a21c63fa90492cf Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
-Date: Tue, 19 Dec 2023 07:58:17 +0100
-Subject: [PATCH 050/101] vfio/container: Introduce vfio_legacy_setup() for
- further cleanups
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [49/67] 3a621ba2605c98b7fbf7fd9f93a207f728f1202e (eauger1/centos-qemu-kvm)
-
-This will help subsequent patches to unify the initialization of type1
-and sPAPR IOMMU backends.
-
-Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Tested-by: Eric Farman <farman@linux.ibm.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit d3764db87531cd53849ccee9b2f72aede90ccf5b)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/container.c | 63 +++++++++++++++++++++++++--------------------
- 1 file changed, 35 insertions(+), 28 deletions(-)
-
-diff --git a/hw/vfio/container.c b/hw/vfio/container.c
-index 1e77a2929e..afcfe80488 100644
---- a/hw/vfio/container.c
-+++ b/hw/vfio/container.c
-@@ -474,6 +474,35 @@ static void vfio_get_iommu_info_migration(VFIOContainer *container,
-     }
- }
- 
-+static int vfio_legacy_setup(VFIOContainerBase *bcontainer, Error **errp)
-+{
-+    VFIOContainer *container = container_of(bcontainer, VFIOContainer,
-+                                            bcontainer);
-+    g_autofree struct vfio_iommu_type1_info *info = NULL;
-+    int ret;
-+
-+    ret = vfio_get_iommu_info(container, &info);
-+    if (ret) {
-+        error_setg_errno(errp, -ret, "Failed to get VFIO IOMMU info");
-+        return ret;
-+    }
-+
-+    if (info->flags & VFIO_IOMMU_INFO_PGSIZES) {
-+        bcontainer->pgsizes = info->iova_pgsizes;
-+    } else {
-+        bcontainer->pgsizes = qemu_real_host_page_size();
-+    }
-+
-+    if (!vfio_get_info_dma_avail(info, &bcontainer->dma_max_mappings)) {
-+        bcontainer->dma_max_mappings = 65535;
-+    }
-+
-+    vfio_get_info_iova_range(info, bcontainer);
-+
-+    vfio_get_iommu_info_migration(container, info);
-+    return 0;
-+}
-+
- static int vfio_connect_container(VFIOGroup *group, AddressSpace *as,
-                                   Error **errp)
- {
-@@ -570,40 +599,18 @@ static int vfio_connect_container(VFIOGroup *group, AddressSpace *as,
-     switch (container->iommu_type) {
-     case VFIO_TYPE1v2_IOMMU:
-     case VFIO_TYPE1_IOMMU:
--    {
--        struct vfio_iommu_type1_info *info;
--
--        ret = vfio_get_iommu_info(container, &info);
--        if (ret) {
--            error_setg_errno(errp, -ret, "Failed to get VFIO IOMMU info");
--            goto enable_discards_exit;
--        }
--
--        if (info->flags & VFIO_IOMMU_INFO_PGSIZES) {
--            bcontainer->pgsizes = info->iova_pgsizes;
--        } else {
--            bcontainer->pgsizes = qemu_real_host_page_size();
--        }
--
--        if (!vfio_get_info_dma_avail(info, &bcontainer->dma_max_mappings)) {
--            bcontainer->dma_max_mappings = 65535;
--        }
--
--        vfio_get_info_iova_range(info, bcontainer);
--
--        vfio_get_iommu_info_migration(container, info);
--        g_free(info);
-+        ret = vfio_legacy_setup(bcontainer, errp);
-         break;
--    }
-     case VFIO_SPAPR_TCE_v2_IOMMU:
-     case VFIO_SPAPR_TCE_IOMMU:
--    {
-         ret = vfio_spapr_container_init(container, errp);
--        if (ret) {
--            goto enable_discards_exit;
--        }
-         break;
-+    default:
-+        g_assert_not_reached();
-     }
-+
-+    if (ret) {
-+        goto enable_discards_exit;
-     }
- 
-     vfio_kvm_device_add_group(group);
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-container-Move-dirty_pgsizes-and-max_dirty_bitm.patch b/SOURCES/kvm-vfio-container-Move-dirty_pgsizes-and-max_dirty_bitm.patch
deleted file mode 100644
index 3d46a06..0000000
--- a/SOURCES/kvm-vfio-container-Move-dirty_pgsizes-and-max_dirty_bitm.patch
+++ /dev/null
@@ -1,102 +0,0 @@
-From 6a597d7c82a4538fa1f928db7e600ec2e5a44361 Mon Sep 17 00:00:00 2001
-From: Eric Auger <eric.auger@redhat.com>
-Date: Thu, 2 Nov 2023 15:12:39 +0800
-Subject: [PATCH 014/101] vfio/container: Move dirty_pgsizes and
- max_dirty_bitmap_size to base container
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [13/67] b9fe57174368e36788b017cc2ad13b748592cfc2 (eauger1/centos-qemu-kvm)
-
-No functional change intended.
-
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
-Signed-off-by: Yi Liu <yi.l.liu@intel.com>
-Signed-off-by: Yi Sun <yi.y.sun@linux.intel.com>
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 4d6b95010c59127ac4f7230d6ee88b5d0e99738c)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/container.c                   | 9 +++++----
- include/hw/vfio/vfio-common.h         | 2 --
- include/hw/vfio/vfio-container-base.h | 2 ++
- 3 files changed, 7 insertions(+), 6 deletions(-)
-
-diff --git a/hw/vfio/container.c b/hw/vfio/container.c
-index 5c1dee8c9f..c8088a8174 100644
---- a/hw/vfio/container.c
-+++ b/hw/vfio/container.c
-@@ -64,6 +64,7 @@ static int vfio_dma_unmap_bitmap(VFIOContainer *container,
-                                  hwaddr iova, ram_addr_t size,
-                                  IOMMUTLBEntry *iotlb)
- {
-+    VFIOContainerBase *bcontainer = &container->bcontainer;
-     struct vfio_iommu_type1_dma_unmap *unmap;
-     struct vfio_bitmap *bitmap;
-     VFIOBitmap vbmap;
-@@ -91,7 +92,7 @@ static int vfio_dma_unmap_bitmap(VFIOContainer *container,
-     bitmap->size = vbmap.size;
-     bitmap->data = (__u64 *)vbmap.bitmap;
- 
--    if (vbmap.size > container->max_dirty_bitmap_size) {
-+    if (vbmap.size > bcontainer->max_dirty_bitmap_size) {
-         error_report("UNMAP: Size of bitmap too big 0x%"PRIx64, vbmap.size);
-         ret = -E2BIG;
-         goto unmap_exit;
-@@ -131,7 +132,7 @@ static int vfio_legacy_dma_unmap(VFIOContainerBase *bcontainer, hwaddr iova,
- 
-     if (iotlb && vfio_devices_all_running_and_mig_active(bcontainer)) {
-         if (!vfio_devices_all_device_dirty_tracking(bcontainer) &&
--            container->bcontainer.dirty_pages_supported) {
-+            bcontainer->dirty_pages_supported) {
-             return vfio_dma_unmap_bitmap(container, iova, size, iotlb);
-         }
- 
-@@ -469,8 +470,8 @@ static void vfio_get_iommu_info_migration(VFIOContainer *container,
-      */
-     if (cap_mig->pgsize_bitmap & qemu_real_host_page_size()) {
-         bcontainer->dirty_pages_supported = true;
--        container->max_dirty_bitmap_size = cap_mig->max_dirty_bitmap_size;
--        container->dirty_pgsizes = cap_mig->pgsize_bitmap;
-+        bcontainer->max_dirty_bitmap_size = cap_mig->max_dirty_bitmap_size;
-+        bcontainer->dirty_pgsizes = cap_mig->pgsize_bitmap;
-     }
- }
- 
-diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
-index 922022cbc6..b1c9fe711b 100644
---- a/include/hw/vfio/vfio-common.h
-+++ b/include/hw/vfio/vfio-common.h
-@@ -80,8 +80,6 @@ typedef struct VFIOContainer {
-     int fd; /* /dev/vfio/vfio, empowered by the attached groups */
-     MemoryListener prereg_listener;
-     unsigned iommu_type;
--    uint64_t dirty_pgsizes;
--    uint64_t max_dirty_bitmap_size;
-     QLIST_HEAD(, VFIOHostDMAWindow) hostwin_list;
-     QLIST_HEAD(, VFIOGroup) group_list;
-     GList *iova_ranges;
-diff --git a/include/hw/vfio/vfio-container-base.h b/include/hw/vfio/vfio-container-base.h
-index 95f8d319e0..80e4a993c5 100644
---- a/include/hw/vfio/vfio-container-base.h
-+++ b/include/hw/vfio/vfio-container-base.h
-@@ -39,6 +39,8 @@ typedef struct VFIOContainerBase {
-     MemoryListener listener;
-     Error *error;
-     bool initialized;
-+    uint64_t dirty_pgsizes;
-+    uint64_t max_dirty_bitmap_size;
-     unsigned long pgsizes;
-     unsigned int dma_max_mappings;
-     bool dirty_pages_supported;
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-container-Move-iova_ranges-to-base-container.patch b/SOURCES/kvm-vfio-container-Move-iova_ranges-to-base-container.patch
deleted file mode 100644
index c9c79b6..0000000
--- a/SOURCES/kvm-vfio-container-Move-iova_ranges-to-base-container.patch
+++ /dev/null
@@ -1,168 +0,0 @@
-From 882143ef30da4182f049eb8192e0fac317c372b3 Mon Sep 17 00:00:00 2001
-From: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Date: Thu, 2 Nov 2023 15:12:40 +0800
-Subject: [PATCH 015/101] vfio/container: Move iova_ranges to base container
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [14/67] 49f2e3c484b4c0c63be9aa4eb1bf08804dcb1ec3 (eauger1/centos-qemu-kvm)
-
-Meanwhile remove the helper function vfio_free_container as it
-only calls g_free now.
-
-No functional change intended.
-
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit f79baf8c9575ac3193ca86ec508791c86d96b13e)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/common.c                      |  5 +++--
- hw/vfio/container-base.c              |  3 +++
- hw/vfio/container.c                   | 19 ++++++-------------
- include/hw/vfio/vfio-common.h         |  1 -
- include/hw/vfio/vfio-container-base.h |  1 +
- 5 files changed, 13 insertions(+), 16 deletions(-)
-
-diff --git a/hw/vfio/common.c b/hw/vfio/common.c
-index be623e544b..8ef2e7967d 100644
---- a/hw/vfio/common.c
-+++ b/hw/vfio/common.c
-@@ -637,9 +637,10 @@ static void vfio_listener_region_add(MemoryListener *listener,
-             goto fail;
-         }
- 
--        if (container->iova_ranges) {
-+        if (bcontainer->iova_ranges) {
-             ret = memory_region_iommu_set_iova_ranges(giommu->iommu_mr,
--                    container->iova_ranges, &err);
-+                                                      bcontainer->iova_ranges,
-+                                                      &err);
-             if (ret) {
-                 g_free(giommu);
-                 goto fail;
-diff --git a/hw/vfio/container-base.c b/hw/vfio/container-base.c
-index 7f508669f5..0177f43741 100644
---- a/hw/vfio/container-base.c
-+++ b/hw/vfio/container-base.c
-@@ -54,6 +54,7 @@ void vfio_container_init(VFIOContainerBase *bcontainer, VFIOAddressSpace *space,
-     bcontainer->error = NULL;
-     bcontainer->dirty_pages_supported = false;
-     bcontainer->dma_max_mappings = 0;
-+    bcontainer->iova_ranges = NULL;
-     QLIST_INIT(&bcontainer->giommu_list);
-     QLIST_INIT(&bcontainer->vrdl_list);
- }
-@@ -70,4 +71,6 @@ void vfio_container_destroy(VFIOContainerBase *bcontainer)
-         QLIST_REMOVE(giommu, giommu_next);
-         g_free(giommu);
-     }
-+
-+    g_list_free_full(bcontainer->iova_ranges, g_free);
- }
-diff --git a/hw/vfio/container.c b/hw/vfio/container.c
-index c8088a8174..721c0d7375 100644
---- a/hw/vfio/container.c
-+++ b/hw/vfio/container.c
-@@ -308,7 +308,7 @@ bool vfio_get_info_dma_avail(struct vfio_iommu_type1_info *info,
- }
- 
- static bool vfio_get_info_iova_range(struct vfio_iommu_type1_info *info,
--                                     VFIOContainer *container)
-+                                     VFIOContainerBase *bcontainer)
- {
-     struct vfio_info_cap_header *hdr;
-     struct vfio_iommu_type1_info_cap_iova_range *cap;
-@@ -326,8 +326,8 @@ static bool vfio_get_info_iova_range(struct vfio_iommu_type1_info *info,
- 
-         range_set_bounds(range, cap->iova_ranges[i].start,
-                          cap->iova_ranges[i].end);
--        container->iova_ranges =
--            range_list_insert(container->iova_ranges, range);
-+        bcontainer->iova_ranges =
-+            range_list_insert(bcontainer->iova_ranges, range);
-     }
- 
-     return true;
-@@ -475,12 +475,6 @@ static void vfio_get_iommu_info_migration(VFIOContainer *container,
-     }
- }
- 
--static void vfio_free_container(VFIOContainer *container)
--{
--    g_list_free_full(container->iova_ranges, g_free);
--    g_free(container);
--}
--
- static int vfio_connect_container(VFIOGroup *group, AddressSpace *as,
-                                   Error **errp)
- {
-@@ -560,7 +554,6 @@ static int vfio_connect_container(VFIOGroup *group, AddressSpace *as,
- 
-     container = g_malloc0(sizeof(*container));
-     container->fd = fd;
--    container->iova_ranges = NULL;
-     bcontainer = &container->bcontainer;
-     vfio_container_init(bcontainer, space, &vfio_legacy_ops);
- 
-@@ -597,7 +590,7 @@ static int vfio_connect_container(VFIOGroup *group, AddressSpace *as,
-             bcontainer->dma_max_mappings = 65535;
-         }
- 
--        vfio_get_info_iova_range(info, container);
-+        vfio_get_info_iova_range(info, bcontainer);
- 
-         vfio_get_iommu_info_migration(container, info);
-         g_free(info);
-@@ -649,7 +642,7 @@ enable_discards_exit:
-     vfio_ram_block_discard_disable(container, false);
- 
- free_container_exit:
--    vfio_free_container(container);
-+    g_free(container);
- 
- close_fd_exit:
-     close(fd);
-@@ -693,7 +686,7 @@ static void vfio_disconnect_container(VFIOGroup *group)
- 
-         trace_vfio_disconnect_container(container->fd);
-         close(container->fd);
--        vfio_free_container(container);
-+        g_free(container);
- 
-         vfio_put_address_space(space);
-     }
-diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
-index b1c9fe711b..b9e5a0e64b 100644
---- a/include/hw/vfio/vfio-common.h
-+++ b/include/hw/vfio/vfio-common.h
-@@ -82,7 +82,6 @@ typedef struct VFIOContainer {
-     unsigned iommu_type;
-     QLIST_HEAD(, VFIOHostDMAWindow) hostwin_list;
-     QLIST_HEAD(, VFIOGroup) group_list;
--    GList *iova_ranges;
- } VFIOContainer;
- 
- typedef struct VFIOHostDMAWindow {
-diff --git a/include/hw/vfio/vfio-container-base.h b/include/hw/vfio/vfio-container-base.h
-index 80e4a993c5..9658ffb526 100644
---- a/include/hw/vfio/vfio-container-base.h
-+++ b/include/hw/vfio/vfio-container-base.h
-@@ -48,6 +48,7 @@ typedef struct VFIOContainerBase {
-     QLIST_HEAD(, VFIORamDiscardListener) vrdl_list;
-     QLIST_ENTRY(VFIOContainerBase) next;
-     QLIST_HEAD(, VFIODevice) device_list;
-+    GList *iova_ranges;
- } VFIOContainerBase;
- 
- typedef struct VFIOGuestIOMMU {
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-container-Move-listener-to-base-container.patch b/SOURCES/kvm-vfio-container-Move-listener-to-base-container.patch
deleted file mode 100644
index 3198bfd..0000000
--- a/SOURCES/kvm-vfio-container-Move-listener-to-base-container.patch
+++ /dev/null
@@ -1,522 +0,0 @@
-From 36bc7782bb02f81368e3e43a3947d16ad362e137 Mon Sep 17 00:00:00 2001
-From: Eric Auger <eric.auger@redhat.com>
-Date: Thu, 2 Nov 2023 15:12:38 +0800
-Subject: [PATCH 013/101] vfio/container: Move listener to base container
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [12/67] f469ab126c6366170aa2520f9b4d9969d3ae0a04 (eauger1/centos-qemu-kvm)
-
-Move listener to base container. Also error and initialized fields
-are moved at the same time.
-
-No functional change intended.
-
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
-Signed-off-by: Yi Liu <yi.l.liu@intel.com>
-Signed-off-by: Yi Sun <yi.y.sun@linux.intel.com>
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit c7b313d300f161c650d011a5c9da469bcd5d34e4)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/common.c                      | 110 +++++++++++++-------------
- hw/vfio/container-base.c              |   1 +
- hw/vfio/container.c                   |  19 +++--
- hw/vfio/spapr.c                       |  11 +--
- include/hw/vfio/vfio-common.h         |   3 -
- include/hw/vfio/vfio-container-base.h |   3 +
- 6 files changed, 74 insertions(+), 73 deletions(-)
-
-diff --git a/hw/vfio/common.c b/hw/vfio/common.c
-index f15665789f..be623e544b 100644
---- a/hw/vfio/common.c
-+++ b/hw/vfio/common.c
-@@ -541,7 +541,7 @@ static bool vfio_listener_valid_section(MemoryRegionSection *section,
-     return true;
- }
- 
--static bool vfio_get_section_iova_range(VFIOContainer *container,
-+static bool vfio_get_section_iova_range(VFIOContainerBase *bcontainer,
-                                         MemoryRegionSection *section,
-                                         hwaddr *out_iova, hwaddr *out_end,
-                                         Int128 *out_llend)
-@@ -569,8 +569,10 @@ static bool vfio_get_section_iova_range(VFIOContainer *container,
- static void vfio_listener_region_add(MemoryListener *listener,
-                                      MemoryRegionSection *section)
- {
--    VFIOContainer *container = container_of(listener, VFIOContainer, listener);
--    VFIOContainerBase *bcontainer = &container->bcontainer;
-+    VFIOContainerBase *bcontainer = container_of(listener, VFIOContainerBase,
-+                                                 listener);
-+    VFIOContainer *container = container_of(bcontainer, VFIOContainer,
-+                                            bcontainer);
-     hwaddr iova, end;
-     Int128 llend, llsize;
-     void *vaddr;
-@@ -581,7 +583,8 @@ static void vfio_listener_region_add(MemoryListener *listener,
-         return;
-     }
- 
--    if (!vfio_get_section_iova_range(container, section, &iova, &end, &llend)) {
-+    if (!vfio_get_section_iova_range(bcontainer, section, &iova, &end,
-+                                     &llend)) {
-         if (memory_region_is_ram_device(section->mr)) {
-             trace_vfio_listener_region_add_no_dma_map(
-                 memory_region_name(section->mr),
-@@ -688,13 +691,12 @@ static void vfio_listener_region_add(MemoryListener *listener,
-         }
-     }
- 
--    ret = vfio_container_dma_map(&container->bcontainer,
--                                 iova, int128_get64(llsize), vaddr,
--                                 section->readonly);
-+    ret = vfio_container_dma_map(bcontainer, iova, int128_get64(llsize),
-+                                 vaddr, section->readonly);
-     if (ret) {
-         error_setg(&err, "vfio_container_dma_map(%p, 0x%"HWADDR_PRIx", "
-                    "0x%"HWADDR_PRIx", %p) = %d (%s)",
--                   container, iova, int128_get64(llsize), vaddr, ret,
-+                   bcontainer, iova, int128_get64(llsize), vaddr, ret,
-                    strerror(-ret));
-         if (memory_region_is_ram_device(section->mr)) {
-             /* Allow unexpected mappings not to be fatal for RAM devices */
-@@ -716,9 +718,9 @@ fail:
-      * can gracefully fail.  Runtime, there's not much we can do other
-      * than throw a hardware error.
-      */
--    if (!container->initialized) {
--        if (!container->error) {
--            error_propagate_prepend(&container->error, err,
-+    if (!bcontainer->initialized) {
-+        if (!bcontainer->error) {
-+            error_propagate_prepend(&bcontainer->error, err,
-                                     "Region %s: ",
-                                     memory_region_name(section->mr));
-         } else {
-@@ -733,8 +735,10 @@ fail:
- static void vfio_listener_region_del(MemoryListener *listener,
-                                      MemoryRegionSection *section)
- {
--    VFIOContainer *container = container_of(listener, VFIOContainer, listener);
--    VFIOContainerBase *bcontainer = &container->bcontainer;
-+    VFIOContainerBase *bcontainer = container_of(listener, VFIOContainerBase,
-+                                                 listener);
-+    VFIOContainer *container = container_of(bcontainer, VFIOContainer,
-+                                            bcontainer);
-     hwaddr iova, end;
-     Int128 llend, llsize;
-     int ret;
-@@ -767,7 +771,8 @@ static void vfio_listener_region_del(MemoryListener *listener,
-          */
-     }
- 
--    if (!vfio_get_section_iova_range(container, section, &iova, &end, &llend)) {
-+    if (!vfio_get_section_iova_range(bcontainer, section, &iova, &end,
-+                                     &llend)) {
-         return;
-     }
- 
-@@ -790,22 +795,22 @@ static void vfio_listener_region_del(MemoryListener *listener,
-         if (int128_eq(llsize, int128_2_64())) {
-             /* The unmap ioctl doesn't accept a full 64-bit span. */
-             llsize = int128_rshift(llsize, 1);
--            ret = vfio_container_dma_unmap(&container->bcontainer, iova,
-+            ret = vfio_container_dma_unmap(bcontainer, iova,
-                                            int128_get64(llsize), NULL);
-             if (ret) {
-                 error_report("vfio_container_dma_unmap(%p, 0x%"HWADDR_PRIx", "
-                              "0x%"HWADDR_PRIx") = %d (%s)",
--                             container, iova, int128_get64(llsize), ret,
-+                             bcontainer, iova, int128_get64(llsize), ret,
-                              strerror(-ret));
-             }
-             iova += int128_get64(llsize);
-         }
--        ret = vfio_container_dma_unmap(&container->bcontainer, iova,
-+        ret = vfio_container_dma_unmap(bcontainer, iova,
-                                        int128_get64(llsize), NULL);
-         if (ret) {
-             error_report("vfio_container_dma_unmap(%p, 0x%"HWADDR_PRIx", "
-                          "0x%"HWADDR_PRIx") = %d (%s)",
--                         container, iova, int128_get64(llsize), ret,
-+                         bcontainer, iova, int128_get64(llsize), ret,
-                          strerror(-ret));
-         }
-     }
-@@ -825,16 +830,15 @@ typedef struct VFIODirtyRanges {
- } VFIODirtyRanges;
- 
- typedef struct VFIODirtyRangesListener {
--    VFIOContainer *container;
-+    VFIOContainerBase *bcontainer;
-     VFIODirtyRanges ranges;
-     MemoryListener listener;
- } VFIODirtyRangesListener;
- 
- static bool vfio_section_is_vfio_pci(MemoryRegionSection *section,
--                                     VFIOContainer *container)
-+                                     VFIOContainerBase *bcontainer)
- {
-     VFIOPCIDevice *pcidev;
--    VFIOContainerBase *bcontainer = &container->bcontainer;
-     VFIODevice *vbasedev;
-     Object *owner;
- 
-@@ -863,7 +867,7 @@ static void vfio_dirty_tracking_update(MemoryListener *listener,
-     hwaddr iova, end, *min, *max;
- 
-     if (!vfio_listener_valid_section(section, "tracking_update") ||
--        !vfio_get_section_iova_range(dirty->container, section,
-+        !vfio_get_section_iova_range(dirty->bcontainer, section,
-                                      &iova, &end, NULL)) {
-         return;
-     }
-@@ -887,7 +891,7 @@ static void vfio_dirty_tracking_update(MemoryListener *listener,
-      * The alternative would be an IOVATree but that has a much bigger runtime
-      * overhead and unnecessary complexity.
-      */
--    if (vfio_section_is_vfio_pci(section, dirty->container) &&
-+    if (vfio_section_is_vfio_pci(section, dirty->bcontainer) &&
-         iova >= UINT32_MAX) {
-         min = &range->minpci64;
-         max = &range->maxpci64;
-@@ -911,7 +915,7 @@ static const MemoryListener vfio_dirty_tracking_listener = {
-     .region_add = vfio_dirty_tracking_update,
- };
- 
--static void vfio_dirty_tracking_init(VFIOContainer *container,
-+static void vfio_dirty_tracking_init(VFIOContainerBase *bcontainer,
-                                      VFIODirtyRanges *ranges)
- {
-     VFIODirtyRangesListener dirty;
-@@ -921,10 +925,10 @@ static void vfio_dirty_tracking_init(VFIOContainer *container,
-     dirty.ranges.min64 = UINT64_MAX;
-     dirty.ranges.minpci64 = UINT64_MAX;
-     dirty.listener = vfio_dirty_tracking_listener;
--    dirty.container = container;
-+    dirty.bcontainer = bcontainer;
- 
-     memory_listener_register(&dirty.listener,
--                             container->bcontainer.space->as);
-+                             bcontainer->space->as);
- 
-     *ranges = dirty.ranges;
- 
-@@ -936,12 +940,11 @@ static void vfio_dirty_tracking_init(VFIOContainer *container,
-     memory_listener_unregister(&dirty.listener);
- }
- 
--static void vfio_devices_dma_logging_stop(VFIOContainer *container)
-+static void vfio_devices_dma_logging_stop(VFIOContainerBase *bcontainer)
- {
-     uint64_t buf[DIV_ROUND_UP(sizeof(struct vfio_device_feature),
-                               sizeof(uint64_t))] = {};
-     struct vfio_device_feature *feature = (struct vfio_device_feature *)buf;
--    VFIOContainerBase *bcontainer = &container->bcontainer;
-     VFIODevice *vbasedev;
- 
-     feature->argsz = sizeof(buf);
-@@ -962,7 +965,7 @@ static void vfio_devices_dma_logging_stop(VFIOContainer *container)
- }
- 
- static struct vfio_device_feature *
--vfio_device_feature_dma_logging_start_create(VFIOContainer *container,
-+vfio_device_feature_dma_logging_start_create(VFIOContainerBase *bcontainer,
-                                              VFIODirtyRanges *tracking)
- {
-     struct vfio_device_feature *feature;
-@@ -1035,16 +1038,15 @@ static void vfio_device_feature_dma_logging_start_destroy(
-     g_free(feature);
- }
- 
--static int vfio_devices_dma_logging_start(VFIOContainer *container)
-+static int vfio_devices_dma_logging_start(VFIOContainerBase *bcontainer)
- {
-     struct vfio_device_feature *feature;
-     VFIODirtyRanges ranges;
--    VFIOContainerBase *bcontainer = &container->bcontainer;
-     VFIODevice *vbasedev;
-     int ret = 0;
- 
--    vfio_dirty_tracking_init(container, &ranges);
--    feature = vfio_device_feature_dma_logging_start_create(container,
-+    vfio_dirty_tracking_init(bcontainer, &ranges);
-+    feature = vfio_device_feature_dma_logging_start_create(bcontainer,
-                                                            &ranges);
-     if (!feature) {
-         return -errno;
-@@ -1067,7 +1069,7 @@ static int vfio_devices_dma_logging_start(VFIOContainer *container)
- 
- out:
-     if (ret) {
--        vfio_devices_dma_logging_stop(container);
-+        vfio_devices_dma_logging_stop(bcontainer);
-     }
- 
-     vfio_device_feature_dma_logging_start_destroy(feature);
-@@ -1077,14 +1079,14 @@ out:
- 
- static void vfio_listener_log_global_start(MemoryListener *listener)
- {
--    VFIOContainer *container = container_of(listener, VFIOContainer, listener);
-+    VFIOContainerBase *bcontainer = container_of(listener, VFIOContainerBase,
-+                                                 listener);
-     int ret;
- 
--    if (vfio_devices_all_device_dirty_tracking(&container->bcontainer)) {
--        ret = vfio_devices_dma_logging_start(container);
-+    if (vfio_devices_all_device_dirty_tracking(bcontainer)) {
-+        ret = vfio_devices_dma_logging_start(bcontainer);
-     } else {
--        ret = vfio_container_set_dirty_page_tracking(&container->bcontainer,
--                                                     true);
-+        ret = vfio_container_set_dirty_page_tracking(bcontainer, true);
-     }
- 
-     if (ret) {
-@@ -1096,14 +1098,14 @@ static void vfio_listener_log_global_start(MemoryListener *listener)
- 
- static void vfio_listener_log_global_stop(MemoryListener *listener)
- {
--    VFIOContainer *container = container_of(listener, VFIOContainer, listener);
-+    VFIOContainerBase *bcontainer = container_of(listener, VFIOContainerBase,
-+                                                 listener);
-     int ret = 0;
- 
--    if (vfio_devices_all_device_dirty_tracking(&container->bcontainer)) {
--        vfio_devices_dma_logging_stop(container);
-+    if (vfio_devices_all_device_dirty_tracking(bcontainer)) {
-+        vfio_devices_dma_logging_stop(bcontainer);
-     } else {
--        ret = vfio_container_set_dirty_page_tracking(&container->bcontainer,
--                                                     false);
-+        ret = vfio_container_set_dirty_page_tracking(bcontainer, false);
-     }
- 
-     if (ret) {
-@@ -1214,8 +1216,6 @@ static void vfio_iommu_map_dirty_notify(IOMMUNotifier *n, IOMMUTLBEntry *iotlb)
-                                                 vfio_giommu_dirty_notifier, n);
-     VFIOGuestIOMMU *giommu = gdn->giommu;
-     VFIOContainerBase *bcontainer = giommu->bcontainer;
--    VFIOContainer *container = container_of(bcontainer, VFIOContainer,
--                                            bcontainer);
-     hwaddr iova = iotlb->iova + giommu->iommu_offset;
-     ram_addr_t translated_addr;
-     int ret = -EINVAL;
-@@ -1230,12 +1230,12 @@ static void vfio_iommu_map_dirty_notify(IOMMUNotifier *n, IOMMUTLBEntry *iotlb)
- 
-     rcu_read_lock();
-     if (vfio_get_xlat_addr(iotlb, NULL, &translated_addr, NULL)) {
--        ret = vfio_get_dirty_bitmap(&container->bcontainer, iova,
--                                    iotlb->addr_mask + 1, translated_addr);
-+        ret = vfio_get_dirty_bitmap(bcontainer, iova, iotlb->addr_mask + 1,
-+                                    translated_addr);
-         if (ret) {
-             error_report("vfio_iommu_map_dirty_notify(%p, 0x%"HWADDR_PRIx", "
-                          "0x%"HWADDR_PRIx") = %d (%s)",
--                         container, iova, iotlb->addr_mask + 1, ret,
-+                         bcontainer, iova, iotlb->addr_mask + 1, ret,
-                          strerror(-ret));
-         }
-     }
-@@ -1291,10 +1291,9 @@ vfio_sync_ram_discard_listener_dirty_bitmap(VFIOContainerBase *bcontainer,
-                                                 &vrdl);
- }
- 
--static int vfio_sync_dirty_bitmap(VFIOContainer *container,
-+static int vfio_sync_dirty_bitmap(VFIOContainerBase *bcontainer,
-                                   MemoryRegionSection *section)
- {
--    VFIOContainerBase *bcontainer = &container->bcontainer;
-     ram_addr_t ram_addr;
- 
-     if (memory_region_is_iommu(section->mr)) {
-@@ -1330,7 +1329,7 @@ static int vfio_sync_dirty_bitmap(VFIOContainer *container,
-     ram_addr = memory_region_get_ram_addr(section->mr) +
-                section->offset_within_region;
- 
--    return vfio_get_dirty_bitmap(&container->bcontainer,
-+    return vfio_get_dirty_bitmap(bcontainer,
-                    REAL_HOST_PAGE_ALIGN(section->offset_within_address_space),
-                    int128_get64(section->size), ram_addr);
- }
-@@ -1338,15 +1337,16 @@ static int vfio_sync_dirty_bitmap(VFIOContainer *container,
- static void vfio_listener_log_sync(MemoryListener *listener,
-         MemoryRegionSection *section)
- {
--    VFIOContainer *container = container_of(listener, VFIOContainer, listener);
-+    VFIOContainerBase *bcontainer = container_of(listener, VFIOContainerBase,
-+                                                 listener);
-     int ret;
- 
-     if (vfio_listener_skipped_section(section)) {
-         return;
-     }
- 
--    if (vfio_devices_all_dirty_tracking(&container->bcontainer)) {
--        ret = vfio_sync_dirty_bitmap(container, section);
-+    if (vfio_devices_all_dirty_tracking(bcontainer)) {
-+        ret = vfio_sync_dirty_bitmap(bcontainer, section);
-         if (ret) {
-             error_report("vfio: Failed to sync dirty bitmap, err: %d (%s)", ret,
-                          strerror(-ret));
-diff --git a/hw/vfio/container-base.c b/hw/vfio/container-base.c
-index 584eee4ba1..7f508669f5 100644
---- a/hw/vfio/container-base.c
-+++ b/hw/vfio/container-base.c
-@@ -51,6 +51,7 @@ void vfio_container_init(VFIOContainerBase *bcontainer, VFIOAddressSpace *space,
- {
-     bcontainer->ops = ops;
-     bcontainer->space = space;
-+    bcontainer->error = NULL;
-     bcontainer->dirty_pages_supported = false;
-     bcontainer->dma_max_mappings = 0;
-     QLIST_INIT(&bcontainer->giommu_list);
-diff --git a/hw/vfio/container.c b/hw/vfio/container.c
-index 6ba2e2f8c4..5c1dee8c9f 100644
---- a/hw/vfio/container.c
-+++ b/hw/vfio/container.c
-@@ -453,6 +453,7 @@ static void vfio_get_iommu_info_migration(VFIOContainer *container,
- {
-     struct vfio_info_cap_header *hdr;
-     struct vfio_iommu_type1_info_cap_migration *cap_mig;
-+    VFIOContainerBase *bcontainer = &container->bcontainer;
- 
-     hdr = vfio_get_iommu_info_cap(info, VFIO_IOMMU_TYPE1_INFO_CAP_MIGRATION);
-     if (!hdr) {
-@@ -467,7 +468,7 @@ static void vfio_get_iommu_info_migration(VFIOContainer *container,
-      * qemu_real_host_page_size to mark those dirty.
-      */
-     if (cap_mig->pgsize_bitmap & qemu_real_host_page_size()) {
--        container->bcontainer.dirty_pages_supported = true;
-+        bcontainer->dirty_pages_supported = true;
-         container->max_dirty_bitmap_size = cap_mig->max_dirty_bitmap_size;
-         container->dirty_pgsizes = cap_mig->pgsize_bitmap;
-     }
-@@ -558,7 +559,6 @@ static int vfio_connect_container(VFIOGroup *group, AddressSpace *as,
- 
-     container = g_malloc0(sizeof(*container));
-     container->fd = fd;
--    container->error = NULL;
-     container->iova_ranges = NULL;
-     bcontainer = &container->bcontainer;
-     vfio_container_init(bcontainer, space, &vfio_legacy_ops);
-@@ -621,25 +621,24 @@ static int vfio_connect_container(VFIOGroup *group, AddressSpace *as,
-     group->container = container;
-     QLIST_INSERT_HEAD(&container->group_list, group, container_next);
- 
--    container->listener = vfio_memory_listener;
--
--    memory_listener_register(&container->listener, bcontainer->space->as);
-+    bcontainer->listener = vfio_memory_listener;
-+    memory_listener_register(&bcontainer->listener, bcontainer->space->as);
- 
--    if (container->error) {
-+    if (bcontainer->error) {
-         ret = -1;
--        error_propagate_prepend(errp, container->error,
-+        error_propagate_prepend(errp, bcontainer->error,
-             "memory listener initialization failed: ");
-         goto listener_release_exit;
-     }
- 
--    container->initialized = true;
-+    bcontainer->initialized = true;
- 
-     return 0;
- listener_release_exit:
-     QLIST_REMOVE(group, container_next);
-     QLIST_REMOVE(bcontainer, next);
-     vfio_kvm_device_del_group(group);
--    memory_listener_unregister(&container->listener);
-+    memory_listener_unregister(&bcontainer->listener);
-     if (container->iommu_type == VFIO_SPAPR_TCE_v2_IOMMU ||
-         container->iommu_type == VFIO_SPAPR_TCE_IOMMU) {
-         vfio_spapr_container_deinit(container);
-@@ -674,7 +673,7 @@ static void vfio_disconnect_container(VFIOGroup *group)
-      * group.
-      */
-     if (QLIST_EMPTY(&container->group_list)) {
--        memory_listener_unregister(&container->listener);
-+        memory_listener_unregister(&bcontainer->listener);
-         if (container->iommu_type == VFIO_SPAPR_TCE_v2_IOMMU ||
-             container->iommu_type == VFIO_SPAPR_TCE_IOMMU) {
-             vfio_spapr_container_deinit(container);
-diff --git a/hw/vfio/spapr.c b/hw/vfio/spapr.c
-index 4f76bdd3ca..7a50975f25 100644
---- a/hw/vfio/spapr.c
-+++ b/hw/vfio/spapr.c
-@@ -46,6 +46,7 @@ static void vfio_prereg_listener_region_add(MemoryListener *listener,
- {
-     VFIOContainer *container = container_of(listener, VFIOContainer,
-                                             prereg_listener);
-+    VFIOContainerBase *bcontainer = &container->bcontainer;
-     const hwaddr gpa = section->offset_within_address_space;
-     hwaddr end;
-     int ret;
-@@ -88,9 +89,9 @@ static void vfio_prereg_listener_region_add(MemoryListener *listener,
-          * can gracefully fail.  Runtime, there's not much we can do other
-          * than throw a hardware error.
-          */
--        if (!container->initialized) {
--            if (!container->error) {
--                error_setg_errno(&container->error, -ret,
-+        if (!bcontainer->initialized) {
-+            if (!bcontainer->error) {
-+                error_setg_errno(&bcontainer->error, -ret,
-                                  "Memory registering failed");
-             }
-         } else {
-@@ -445,9 +446,9 @@ int vfio_spapr_container_init(VFIOContainer *container, Error **errp)
- 
-         memory_listener_register(&container->prereg_listener,
-                                  &address_space_memory);
--        if (container->error) {
-+        if (bcontainer->error) {
-             ret = -1;
--            error_propagate_prepend(errp, container->error,
-+            error_propagate_prepend(errp, bcontainer->error,
-                     "RAM memory listener initialization failed: ");
-             goto listener_unregister_exit;
-         }
-diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
-index 8a607a4c17..922022cbc6 100644
---- a/include/hw/vfio/vfio-common.h
-+++ b/include/hw/vfio/vfio-common.h
-@@ -78,11 +78,8 @@ struct VFIOGroup;
- typedef struct VFIOContainer {
-     VFIOContainerBase bcontainer;
-     int fd; /* /dev/vfio/vfio, empowered by the attached groups */
--    MemoryListener listener;
-     MemoryListener prereg_listener;
-     unsigned iommu_type;
--    Error *error;
--    bool initialized;
-     uint64_t dirty_pgsizes;
-     uint64_t max_dirty_bitmap_size;
-     QLIST_HEAD(, VFIOHostDMAWindow) hostwin_list;
-diff --git a/include/hw/vfio/vfio-container-base.h b/include/hw/vfio/vfio-container-base.h
-index 8e05b5ac5a..95f8d319e0 100644
---- a/include/hw/vfio/vfio-container-base.h
-+++ b/include/hw/vfio/vfio-container-base.h
-@@ -36,6 +36,9 @@ typedef struct VFIOAddressSpace {
- typedef struct VFIOContainerBase {
-     const VFIOIOMMUOps *ops;
-     VFIOAddressSpace *space;
-+    MemoryListener listener;
-+    Error *error;
-+    bool initialized;
-     unsigned long pgsizes;
-     unsigned int dma_max_mappings;
-     bool dirty_pages_supported;
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-container-Move-per-container-device-list-in-bas.patch b/SOURCES/kvm-vfio-container-Move-per-container-device-list-in-bas.patch
deleted file mode 100644
index df483e3..0000000
--- a/SOURCES/kvm-vfio-container-Move-per-container-device-list-in-bas.patch
+++ /dev/null
@@ -1,230 +0,0 @@
-From 0b3fbb6bf5c5bccec184829ff9454fd637c512b9 Mon Sep 17 00:00:00 2001
-From: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Date: Thu, 2 Nov 2023 15:12:34 +0800
-Subject: [PATCH 009/101] vfio/container: Move per container device list in
- base container
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [8/67] d546cc25f4424b2d42356765c860fdaf4a3ba652 (eauger1/centos-qemu-kvm)
-
-VFIO Device is also changed to point to base container instead of
-legacy container.
-
-No functional change intended.
-
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 3e6015d1117579324b456aa169dfca06da9922cf)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/common.c                      | 23 +++++++++++++++--------
- hw/vfio/container.c                   | 12 ++++++------
- include/hw/vfio/vfio-common.h         |  3 +--
- include/hw/vfio/vfio-container-base.h |  1 +
- 4 files changed, 23 insertions(+), 16 deletions(-)
-
-diff --git a/hw/vfio/common.c b/hw/vfio/common.c
-index b1a875ca93..9415395ed9 100644
---- a/hw/vfio/common.c
-+++ b/hw/vfio/common.c
-@@ -145,7 +145,7 @@ void vfio_unblock_multiple_devices_migration(void)
- 
- bool vfio_viommu_preset(VFIODevice *vbasedev)
- {
--    return vbasedev->container->bcontainer.space->as != &address_space_memory;
-+    return vbasedev->bcontainer->space->as != &address_space_memory;
- }
- 
- static void vfio_set_migration_error(int err)
-@@ -179,6 +179,7 @@ bool vfio_device_state_is_precopy(VFIODevice *vbasedev)
- 
- static bool vfio_devices_all_dirty_tracking(VFIOContainer *container)
- {
-+    VFIOContainerBase *bcontainer = &container->bcontainer;
-     VFIODevice *vbasedev;
-     MigrationState *ms = migrate_get_current();
- 
-@@ -187,7 +188,7 @@ static bool vfio_devices_all_dirty_tracking(VFIOContainer *container)
-         return false;
-     }
- 
--    QLIST_FOREACH(vbasedev, &container->device_list, container_next) {
-+    QLIST_FOREACH(vbasedev, &bcontainer->device_list, container_next) {
-         VFIOMigration *migration = vbasedev->migration;
- 
-         if (!migration) {
-@@ -205,9 +206,10 @@ static bool vfio_devices_all_dirty_tracking(VFIOContainer *container)
- 
- bool vfio_devices_all_device_dirty_tracking(VFIOContainer *container)
- {
-+    VFIOContainerBase *bcontainer = &container->bcontainer;
-     VFIODevice *vbasedev;
- 
--    QLIST_FOREACH(vbasedev, &container->device_list, container_next) {
-+    QLIST_FOREACH(vbasedev, &bcontainer->device_list, container_next) {
-         if (!vbasedev->dirty_pages_supported) {
-             return false;
-         }
-@@ -222,13 +224,14 @@ bool vfio_devices_all_device_dirty_tracking(VFIOContainer *container)
-  */
- bool vfio_devices_all_running_and_mig_active(VFIOContainer *container)
- {
-+    VFIOContainerBase *bcontainer = &container->bcontainer;
-     VFIODevice *vbasedev;
- 
-     if (!migration_is_active(migrate_get_current())) {
-         return false;
-     }
- 
--    QLIST_FOREACH(vbasedev, &container->device_list, container_next) {
-+    QLIST_FOREACH(vbasedev, &bcontainer->device_list, container_next) {
-         VFIOMigration *migration = vbasedev->migration;
- 
-         if (!migration) {
-@@ -833,12 +836,13 @@ static bool vfio_section_is_vfio_pci(MemoryRegionSection *section,
-                                      VFIOContainer *container)
- {
-     VFIOPCIDevice *pcidev;
-+    VFIOContainerBase *bcontainer = &container->bcontainer;
-     VFIODevice *vbasedev;
-     Object *owner;
- 
-     owner = memory_region_owner(section->mr);
- 
--    QLIST_FOREACH(vbasedev, &container->device_list, container_next) {
-+    QLIST_FOREACH(vbasedev, &bcontainer->device_list, container_next) {
-         if (vbasedev->type != VFIO_DEVICE_TYPE_PCI) {
-             continue;
-         }
-@@ -939,13 +943,14 @@ static void vfio_devices_dma_logging_stop(VFIOContainer *container)
-     uint64_t buf[DIV_ROUND_UP(sizeof(struct vfio_device_feature),
-                               sizeof(uint64_t))] = {};
-     struct vfio_device_feature *feature = (struct vfio_device_feature *)buf;
-+    VFIOContainerBase *bcontainer = &container->bcontainer;
-     VFIODevice *vbasedev;
- 
-     feature->argsz = sizeof(buf);
-     feature->flags = VFIO_DEVICE_FEATURE_SET |
-                      VFIO_DEVICE_FEATURE_DMA_LOGGING_STOP;
- 
--    QLIST_FOREACH(vbasedev, &container->device_list, container_next) {
-+    QLIST_FOREACH(vbasedev, &bcontainer->device_list, container_next) {
-         if (!vbasedev->dirty_tracking) {
-             continue;
-         }
-@@ -1036,6 +1041,7 @@ static int vfio_devices_dma_logging_start(VFIOContainer *container)
- {
-     struct vfio_device_feature *feature;
-     VFIODirtyRanges ranges;
-+    VFIOContainerBase *bcontainer = &container->bcontainer;
-     VFIODevice *vbasedev;
-     int ret = 0;
- 
-@@ -1046,7 +1052,7 @@ static int vfio_devices_dma_logging_start(VFIOContainer *container)
-         return -errno;
-     }
- 
--    QLIST_FOREACH(vbasedev, &container->device_list, container_next) {
-+    QLIST_FOREACH(vbasedev, &bcontainer->device_list, container_next) {
-         if (vbasedev->dirty_tracking) {
-             continue;
-         }
-@@ -1139,10 +1145,11 @@ int vfio_devices_query_dirty_bitmap(VFIOContainer *container,
-                                     VFIOBitmap *vbmap, hwaddr iova,
-                                     hwaddr size)
- {
-+    VFIOContainerBase *bcontainer = &container->bcontainer;
-     VFIODevice *vbasedev;
-     int ret;
- 
--    QLIST_FOREACH(vbasedev, &container->device_list, container_next) {
-+    QLIST_FOREACH(vbasedev, &bcontainer->device_list, container_next) {
-         ret = vfio_device_dma_logging_report(vbasedev, iova, size,
-                                              vbmap->bitmap);
-         if (ret) {
-diff --git a/hw/vfio/container.c b/hw/vfio/container.c
-index 3ab74e2615..63a906de93 100644
---- a/hw/vfio/container.c
-+++ b/hw/vfio/container.c
-@@ -888,7 +888,7 @@ int vfio_attach_device(char *name, VFIODevice *vbasedev,
-     int groupid = vfio_device_groupid(vbasedev, errp);
-     VFIODevice *vbasedev_iter;
-     VFIOGroup *group;
--    VFIOContainer *container;
-+    VFIOContainerBase *bcontainer;
-     int ret;
- 
-     if (groupid < 0) {
-@@ -915,9 +915,9 @@ int vfio_attach_device(char *name, VFIODevice *vbasedev,
-         return ret;
-     }
- 
--    container = group->container;
--    vbasedev->container = container;
--    QLIST_INSERT_HEAD(&container->device_list, vbasedev, container_next);
-+    bcontainer = &group->container->bcontainer;
-+    vbasedev->bcontainer = bcontainer;
-+    QLIST_INSERT_HEAD(&bcontainer->device_list, vbasedev, container_next);
-     QLIST_INSERT_HEAD(&vfio_device_list, vbasedev, global_next);
- 
-     return ret;
-@@ -927,13 +927,13 @@ void vfio_detach_device(VFIODevice *vbasedev)
- {
-     VFIOGroup *group = vbasedev->group;
- 
--    if (!vbasedev->container) {
-+    if (!vbasedev->bcontainer) {
-         return;
-     }
- 
-     QLIST_REMOVE(vbasedev, global_next);
-     QLIST_REMOVE(vbasedev, container_next);
--    vbasedev->container = NULL;
-+    vbasedev->bcontainer = NULL;
-     trace_vfio_detach_device(vbasedev->name, group->groupid);
-     vfio_put_base_device(vbasedev);
-     vfio_put_group(group);
-diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
-index 60f2785fe0..9740cf9fbc 100644
---- a/include/hw/vfio/vfio-common.h
-+++ b/include/hw/vfio/vfio-common.h
-@@ -90,7 +90,6 @@ typedef struct VFIOContainer {
-     QLIST_HEAD(, VFIOHostDMAWindow) hostwin_list;
-     QLIST_HEAD(, VFIOGroup) group_list;
-     QLIST_HEAD(, VFIORamDiscardListener) vrdl_list;
--    QLIST_HEAD(, VFIODevice) device_list;
-     GList *iova_ranges;
- } VFIOContainer;
- 
-@@ -118,7 +117,7 @@ typedef struct VFIODevice {
-     QLIST_ENTRY(VFIODevice) container_next;
-     QLIST_ENTRY(VFIODevice) global_next;
-     struct VFIOGroup *group;
--    VFIOContainer *container;
-+    VFIOContainerBase *bcontainer;
-     char *sysfsdev;
-     char *name;
-     DeviceState *dev;
-diff --git a/include/hw/vfio/vfio-container-base.h b/include/hw/vfio/vfio-container-base.h
-index f244f003d0..7090962496 100644
---- a/include/hw/vfio/vfio-container-base.h
-+++ b/include/hw/vfio/vfio-container-base.h
-@@ -39,6 +39,7 @@ typedef struct VFIOContainerBase {
-     bool dirty_pages_supported;
-     QLIST_HEAD(, VFIOGuestIOMMU) giommu_list;
-     QLIST_ENTRY(VFIOContainerBase) next;
-+    QLIST_HEAD(, VFIODevice) device_list;
- } VFIOContainerBase;
- 
- typedef struct VFIOGuestIOMMU {
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-container-Move-pgsizes-and-dma_max_mappings-to-.patch b/SOURCES/kvm-vfio-container-Move-pgsizes-and-dma_max_mappings-to-.patch
deleted file mode 100644
index 0db20c2..0000000
--- a/SOURCES/kvm-vfio-container-Move-pgsizes-and-dma_max_mappings-to-.patch
+++ /dev/null
@@ -1,242 +0,0 @@
-From d798939fbbe6c27200c165edd6f3771413821b34 Mon Sep 17 00:00:00 2001
-From: Eric Auger <eric.auger@redhat.com>
-Date: Thu, 2 Nov 2023 15:12:36 +0800
-Subject: [PATCH 011/101] vfio/container: Move pgsizes and dma_max_mappings to
- base container
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [10/67] e80696175aba159a17ce9a869535db66682deb08 (eauger1/centos-qemu-kvm)
-
-No functional change intended.
-
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
-Signed-off-by: Yi Liu <yi.l.liu@intel.com>
-Signed-off-by: Yi Sun <yi.y.sun@linux.intel.com>
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 7ab1cb74ffdbf92ef237243b41bde5c7067d5298)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/common.c                      | 17 +++++++++--------
- hw/vfio/container-base.c              |  1 +
- hw/vfio/container.c                   | 11 +++++------
- hw/vfio/spapr.c                       | 10 ++++++----
- include/hw/vfio/vfio-common.h         |  2 --
- include/hw/vfio/vfio-container-base.h |  2 ++
- 6 files changed, 23 insertions(+), 20 deletions(-)
-
-diff --git a/hw/vfio/common.c b/hw/vfio/common.c
-index cf6618f6ed..1cb53d369e 100644
---- a/hw/vfio/common.c
-+++ b/hw/vfio/common.c
-@@ -401,6 +401,7 @@ static int vfio_ram_discard_notify_populate(RamDiscardListener *rdl,
- static void vfio_register_ram_discard_listener(VFIOContainer *container,
-                                                MemoryRegionSection *section)
- {
-+    VFIOContainerBase *bcontainer = &container->bcontainer;
-     RamDiscardManager *rdm = memory_region_get_ram_discard_manager(section->mr);
-     VFIORamDiscardListener *vrdl;
- 
-@@ -419,8 +420,8 @@ static void vfio_register_ram_discard_listener(VFIOContainer *container,
-                                                                 section->mr);
- 
-     g_assert(vrdl->granularity && is_power_of_2(vrdl->granularity));
--    g_assert(container->pgsizes &&
--             vrdl->granularity >= 1ULL << ctz64(container->pgsizes));
-+    g_assert(bcontainer->pgsizes &&
-+             vrdl->granularity >= 1ULL << ctz64(bcontainer->pgsizes));
- 
-     ram_discard_listener_init(&vrdl->listener,
-                               vfio_ram_discard_notify_populate,
-@@ -441,7 +442,7 @@ static void vfio_register_ram_discard_listener(VFIOContainer *container,
-      * number of sections in the address space we could have over time,
-      * also consuming DMA mappings.
-      */
--    if (container->dma_max_mappings) {
-+    if (bcontainer->dma_max_mappings) {
-         unsigned int vrdl_count = 0, vrdl_mappings = 0, max_memslots = 512;
- 
- #ifdef CONFIG_KVM
-@@ -462,11 +463,11 @@ static void vfio_register_ram_discard_listener(VFIOContainer *container,
-         }
- 
-         if (vrdl_mappings + max_memslots - vrdl_count >
--            container->dma_max_mappings) {
-+            bcontainer->dma_max_mappings) {
-             warn_report("%s: possibly running out of DMA mappings. E.g., try"
-                         " increasing the 'block-size' of virtio-mem devies."
-                         " Maximum possible DMA mappings: %d, Maximum possible"
--                        " memslots: %d", __func__, container->dma_max_mappings,
-+                        " memslots: %d", __func__, bcontainer->dma_max_mappings,
-                         max_memslots);
-         }
-     }
-@@ -626,7 +627,7 @@ static void vfio_listener_region_add(MemoryListener *listener,
-                             iommu_idx);
- 
-         ret = memory_region_iommu_set_page_size_mask(giommu->iommu_mr,
--                                                     container->pgsizes,
-+                                                     bcontainer->pgsizes,
-                                                      &err);
-         if (ret) {
-             g_free(giommu);
-@@ -675,7 +676,7 @@ static void vfio_listener_region_add(MemoryListener *listener,
-     llsize = int128_sub(llend, int128_make64(iova));
- 
-     if (memory_region_is_ram_device(section->mr)) {
--        hwaddr pgmask = (1ULL << ctz64(container->pgsizes)) - 1;
-+        hwaddr pgmask = (1ULL << ctz64(bcontainer->pgsizes)) - 1;
- 
-         if ((iova & pgmask) || (int128_get64(llsize) & pgmask)) {
-             trace_vfio_listener_region_add_no_dma_map(
-@@ -777,7 +778,7 @@ static void vfio_listener_region_del(MemoryListener *listener,
-     if (memory_region_is_ram_device(section->mr)) {
-         hwaddr pgmask;
- 
--        pgmask = (1ULL << ctz64(container->pgsizes)) - 1;
-+        pgmask = (1ULL << ctz64(bcontainer->pgsizes)) - 1;
-         try_unmap = !((iova & pgmask) || (int128_get64(llsize) & pgmask));
-     } else if (memory_region_has_ram_discard_manager(section->mr)) {
-         vfio_unregister_ram_discard_listener(container, section);
-diff --git a/hw/vfio/container-base.c b/hw/vfio/container-base.c
-index 5d654ae172..dcce111349 100644
---- a/hw/vfio/container-base.c
-+++ b/hw/vfio/container-base.c
-@@ -52,6 +52,7 @@ void vfio_container_init(VFIOContainerBase *bcontainer, VFIOAddressSpace *space,
-     bcontainer->ops = ops;
-     bcontainer->space = space;
-     bcontainer->dirty_pages_supported = false;
-+    bcontainer->dma_max_mappings = 0;
-     QLIST_INIT(&bcontainer->giommu_list);
- }
- 
-diff --git a/hw/vfio/container.c b/hw/vfio/container.c
-index 7bd81eab09..c5a6262882 100644
---- a/hw/vfio/container.c
-+++ b/hw/vfio/container.c
-@@ -154,7 +154,7 @@ static int vfio_legacy_dma_unmap(VFIOContainerBase *bcontainer, hwaddr iova,
-         if (errno == EINVAL && unmap.size && !(unmap.iova + unmap.size) &&
-             container->iommu_type == VFIO_TYPE1v2_IOMMU) {
-             trace_vfio_legacy_dma_unmap_overflow_workaround();
--            unmap.size -= 1ULL << ctz64(container->pgsizes);
-+            unmap.size -= 1ULL << ctz64(bcontainer->pgsizes);
-             continue;
-         }
-         error_report("VFIO_UNMAP_DMA failed: %s", strerror(errno));
-@@ -559,7 +559,6 @@ static int vfio_connect_container(VFIOGroup *group, AddressSpace *as,
-     container = g_malloc0(sizeof(*container));
-     container->fd = fd;
-     container->error = NULL;
--    container->dma_max_mappings = 0;
-     container->iova_ranges = NULL;
-     QLIST_INIT(&container->vrdl_list);
-     bcontainer = &container->bcontainer;
-@@ -589,13 +588,13 @@ static int vfio_connect_container(VFIOGroup *group, AddressSpace *as,
-         }
- 
-         if (info->flags & VFIO_IOMMU_INFO_PGSIZES) {
--            container->pgsizes = info->iova_pgsizes;
-+            bcontainer->pgsizes = info->iova_pgsizes;
-         } else {
--            container->pgsizes = qemu_real_host_page_size();
-+            bcontainer->pgsizes = qemu_real_host_page_size();
-         }
- 
--        if (!vfio_get_info_dma_avail(info, &container->dma_max_mappings)) {
--            container->dma_max_mappings = 65535;
-+        if (!vfio_get_info_dma_avail(info, &bcontainer->dma_max_mappings)) {
-+            bcontainer->dma_max_mappings = 65535;
-         }
- 
-         vfio_get_info_iova_range(info, container);
-diff --git a/hw/vfio/spapr.c b/hw/vfio/spapr.c
-index 83da2f7ec2..4f76bdd3ca 100644
---- a/hw/vfio/spapr.c
-+++ b/hw/vfio/spapr.c
-@@ -226,6 +226,7 @@ static int vfio_spapr_create_window(VFIOContainer *container,
-                                     hwaddr *pgsize)
- {
-     int ret = 0;
-+    VFIOContainerBase *bcontainer = &container->bcontainer;
-     IOMMUMemoryRegion *iommu_mr = IOMMU_MEMORY_REGION(section->mr);
-     uint64_t pagesize = memory_region_iommu_get_min_page_size(iommu_mr), pgmask;
-     unsigned entries, bits_total, bits_per_level, max_levels;
-@@ -239,13 +240,13 @@ static int vfio_spapr_create_window(VFIOContainer *container,
-     if (pagesize > rampagesize) {
-         pagesize = rampagesize;
-     }
--    pgmask = container->pgsizes & (pagesize | (pagesize - 1));
-+    pgmask = bcontainer->pgsizes & (pagesize | (pagesize - 1));
-     pagesize = pgmask ? (1ULL << (63 - clz64(pgmask))) : 0;
-     if (!pagesize) {
-         error_report("Host doesn't support page size 0x%"PRIx64
-                      ", the supported mask is 0x%lx",
-                      memory_region_iommu_get_min_page_size(iommu_mr),
--                     container->pgsizes);
-+                     bcontainer->pgsizes);
-         return -EINVAL;
-     }
- 
-@@ -421,6 +422,7 @@ void vfio_container_del_section_window(VFIOContainer *container,
- 
- int vfio_spapr_container_init(VFIOContainer *container, Error **errp)
- {
-+    VFIOContainerBase *bcontainer = &container->bcontainer;
-     struct vfio_iommu_spapr_tce_info info;
-     bool v2 = container->iommu_type == VFIO_SPAPR_TCE_v2_IOMMU;
-     int ret, fd = container->fd;
-@@ -461,7 +463,7 @@ int vfio_spapr_container_init(VFIOContainer *container, Error **errp)
-     }
- 
-     if (v2) {
--        container->pgsizes = info.ddw.pgsizes;
-+        bcontainer->pgsizes = info.ddw.pgsizes;
-         /*
-          * There is a default window in just created container.
-          * To make region_add/del simpler, we better remove this
-@@ -476,7 +478,7 @@ int vfio_spapr_container_init(VFIOContainer *container, Error **errp)
-         }
-     } else {
-         /* The default table uses 4K pages */
--        container->pgsizes = 0x1000;
-+        bcontainer->pgsizes = 0x1000;
-         vfio_host_win_add(container, info.dma32_window_start,
-                           info.dma32_window_start +
-                           info.dma32_window_size - 1,
-diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
-index bc67e1316c..d3dc2f9dcb 100644
---- a/include/hw/vfio/vfio-common.h
-+++ b/include/hw/vfio/vfio-common.h
-@@ -85,8 +85,6 @@ typedef struct VFIOContainer {
-     bool initialized;
-     uint64_t dirty_pgsizes;
-     uint64_t max_dirty_bitmap_size;
--    unsigned long pgsizes;
--    unsigned int dma_max_mappings;
-     QLIST_HEAD(, VFIOHostDMAWindow) hostwin_list;
-     QLIST_HEAD(, VFIOGroup) group_list;
-     QLIST_HEAD(, VFIORamDiscardListener) vrdl_list;
-diff --git a/include/hw/vfio/vfio-container-base.h b/include/hw/vfio/vfio-container-base.h
-index 7090962496..85ec7e1a56 100644
---- a/include/hw/vfio/vfio-container-base.h
-+++ b/include/hw/vfio/vfio-container-base.h
-@@ -36,6 +36,8 @@ typedef struct VFIOAddressSpace {
- typedef struct VFIOContainerBase {
-     const VFIOIOMMUOps *ops;
-     VFIOAddressSpace *space;
-+    unsigned long pgsizes;
-+    unsigned int dma_max_mappings;
-     bool dirty_pages_supported;
-     QLIST_HEAD(, VFIOGuestIOMMU) giommu_list;
-     QLIST_ENTRY(VFIOContainerBase) next;
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-container-Move-space-field-to-base-container.patch b/SOURCES/kvm-vfio-container-Move-space-field-to-base-container.patch
deleted file mode 100644
index edd4538..0000000
--- a/SOURCES/kvm-vfio-container-Move-space-field-to-base-container.patch
+++ /dev/null
@@ -1,265 +0,0 @@
-From 3ba43cbc5b096feed6272e070cf152d5fc74df01 Mon Sep 17 00:00:00 2001
-From: Eric Auger <eric.auger@redhat.com>
-Date: Thu, 2 Nov 2023 15:12:32 +0800
-Subject: [PATCH 007/101] vfio/container: Move space field to base container
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [6/67] b0aa17d9ec4588bd64373452a30306e826234d0b (eauger1/centos-qemu-kvm)
-
-Move the space field to the base object. Also the VFIOAddressSpace
-now contains a list of base containers.
-
-No functional change intended.
-
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
-Signed-off-by: Yi Liu <yi.l.liu@intel.com>
-Signed-off-by: Yi Sun <yi.y.sun@linux.intel.com>
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit e5597063386a0c76308ad16da31726d23f489945)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/ppc/spapr_pci_vfio.c               | 10 +++++-----
- hw/vfio/common.c                      |  4 ++--
- hw/vfio/container-base.c              |  6 +++++-
- hw/vfio/container.c                   | 18 ++++++++----------
- include/hw/vfio/vfio-common.h         |  8 --------
- include/hw/vfio/vfio-container-base.h |  9 +++++++++
- 6 files changed, 29 insertions(+), 26 deletions(-)
-
-diff --git a/hw/ppc/spapr_pci_vfio.c b/hw/ppc/spapr_pci_vfio.c
-index f283f7e38d..d1d07bec46 100644
---- a/hw/ppc/spapr_pci_vfio.c
-+++ b/hw/ppc/spapr_pci_vfio.c
-@@ -84,27 +84,27 @@ static int vfio_eeh_container_op(VFIOContainer *container, uint32_t op)
- static VFIOContainer *vfio_eeh_as_container(AddressSpace *as)
- {
-     VFIOAddressSpace *space = vfio_get_address_space(as);
--    VFIOContainer *container = NULL;
-+    VFIOContainerBase *bcontainer = NULL;
- 
-     if (QLIST_EMPTY(&space->containers)) {
-         /* No containers to act on */
-         goto out;
-     }
- 
--    container = QLIST_FIRST(&space->containers);
-+    bcontainer = QLIST_FIRST(&space->containers);
- 
--    if (QLIST_NEXT(container, next)) {
-+    if (QLIST_NEXT(bcontainer, next)) {
-         /*
-          * We don't yet have logic to synchronize EEH state across
-          * multiple containers
-          */
--        container = NULL;
-+        bcontainer = NULL;
-         goto out;
-     }
- 
- out:
-     vfio_put_address_space(space);
--    return container;
-+    return container_of(bcontainer, VFIOContainer, bcontainer);
- }
- 
- static bool vfio_eeh_as_ok(AddressSpace *as)
-diff --git a/hw/vfio/common.c b/hw/vfio/common.c
-index 43580bcc43..1d8202537e 100644
---- a/hw/vfio/common.c
-+++ b/hw/vfio/common.c
-@@ -145,7 +145,7 @@ void vfio_unblock_multiple_devices_migration(void)
- 
- bool vfio_viommu_preset(VFIODevice *vbasedev)
- {
--    return vbasedev->container->space->as != &address_space_memory;
-+    return vbasedev->container->bcontainer.space->as != &address_space_memory;
- }
- 
- static void vfio_set_migration_error(int err)
-@@ -922,7 +922,7 @@ static void vfio_dirty_tracking_init(VFIOContainer *container,
-     dirty.container = container;
- 
-     memory_listener_register(&dirty.listener,
--                             container->space->as);
-+                             container->bcontainer.space->as);
- 
-     *ranges = dirty.ranges;
- 
-diff --git a/hw/vfio/container-base.c b/hw/vfio/container-base.c
-index 20bcb9669a..3933391e0d 100644
---- a/hw/vfio/container-base.c
-+++ b/hw/vfio/container-base.c
-@@ -31,9 +31,11 @@ int vfio_container_dma_unmap(VFIOContainerBase *bcontainer,
-     return bcontainer->ops->dma_unmap(bcontainer, iova, size, iotlb);
- }
- 
--void vfio_container_init(VFIOContainerBase *bcontainer, const VFIOIOMMUOps *ops)
-+void vfio_container_init(VFIOContainerBase *bcontainer, VFIOAddressSpace *space,
-+                         const VFIOIOMMUOps *ops)
- {
-     bcontainer->ops = ops;
-+    bcontainer->space = space;
-     QLIST_INIT(&bcontainer->giommu_list);
- }
- 
-@@ -41,6 +43,8 @@ void vfio_container_destroy(VFIOContainerBase *bcontainer)
- {
-     VFIOGuestIOMMU *giommu, *tmp;
- 
-+    QLIST_REMOVE(bcontainer, next);
-+
-     QLIST_FOREACH_SAFE(giommu, &bcontainer->giommu_list, giommu_next, tmp) {
-         memory_region_unregister_iommu_notifier(
-                 MEMORY_REGION(giommu->iommu_mr), &giommu->n);
-diff --git a/hw/vfio/container.c b/hw/vfio/container.c
-index 133d3c8f5c..f12fcb6fe1 100644
---- a/hw/vfio/container.c
-+++ b/hw/vfio/container.c
-@@ -514,7 +514,8 @@ static int vfio_connect_container(VFIOGroup *group, AddressSpace *as,
-      * details once we know which type of IOMMU we are using.
-      */
- 
--    QLIST_FOREACH(container, &space->containers, next) {
-+    QLIST_FOREACH(bcontainer, &space->containers, next) {
-+        container = container_of(bcontainer, VFIOContainer, bcontainer);
-         if (!ioctl(group->fd, VFIO_GROUP_SET_CONTAINER, &container->fd)) {
-             ret = vfio_ram_block_discard_disable(container, true);
-             if (ret) {
-@@ -550,7 +551,6 @@ static int vfio_connect_container(VFIOGroup *group, AddressSpace *as,
-     }
- 
-     container = g_malloc0(sizeof(*container));
--    container->space = space;
-     container->fd = fd;
-     container->error = NULL;
-     container->dirty_pages_supported = false;
-@@ -558,7 +558,7 @@ static int vfio_connect_container(VFIOGroup *group, AddressSpace *as,
-     container->iova_ranges = NULL;
-     QLIST_INIT(&container->vrdl_list);
-     bcontainer = &container->bcontainer;
--    vfio_container_init(bcontainer, &vfio_legacy_ops);
-+    vfio_container_init(bcontainer, space, &vfio_legacy_ops);
- 
-     ret = vfio_init_container(container, group->fd, errp);
-     if (ret) {
-@@ -613,14 +613,14 @@ static int vfio_connect_container(VFIOGroup *group, AddressSpace *as,
-     vfio_kvm_device_add_group(group);
- 
-     QLIST_INIT(&container->group_list);
--    QLIST_INSERT_HEAD(&space->containers, container, next);
-+    QLIST_INSERT_HEAD(&space->containers, bcontainer, next);
- 
-     group->container = container;
-     QLIST_INSERT_HEAD(&container->group_list, group, container_next);
- 
-     container->listener = vfio_memory_listener;
- 
--    memory_listener_register(&container->listener, container->space->as);
-+    memory_listener_register(&container->listener, bcontainer->space->as);
- 
-     if (container->error) {
-         ret = -1;
-@@ -634,7 +634,7 @@ static int vfio_connect_container(VFIOGroup *group, AddressSpace *as,
-     return 0;
- listener_release_exit:
-     QLIST_REMOVE(group, container_next);
--    QLIST_REMOVE(container, next);
-+    QLIST_REMOVE(bcontainer, next);
-     vfio_kvm_device_del_group(group);
-     memory_listener_unregister(&container->listener);
-     if (container->iommu_type == VFIO_SPAPR_TCE_v2_IOMMU ||
-@@ -684,9 +684,7 @@ static void vfio_disconnect_container(VFIOGroup *group)
-     }
- 
-     if (QLIST_EMPTY(&container->group_list)) {
--        VFIOAddressSpace *space = container->space;
--
--        QLIST_REMOVE(container, next);
-+        VFIOAddressSpace *space = bcontainer->space;
- 
-         vfio_container_destroy(bcontainer);
- 
-@@ -707,7 +705,7 @@ static VFIOGroup *vfio_get_group(int groupid, AddressSpace *as, Error **errp)
-     QLIST_FOREACH(group, &vfio_group_list, next) {
-         if (group->groupid == groupid) {
-             /* Found it.  Now is it already in the right context? */
--            if (group->container->space->as == as) {
-+            if (group->container->bcontainer.space->as == as) {
-                 return group;
-             } else {
-                 error_setg(errp, "group %d used in multiple address spaces",
-diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
-index 6be082b8f2..bd4de6cb3a 100644
---- a/include/hw/vfio/vfio-common.h
-+++ b/include/hw/vfio/vfio-common.h
-@@ -73,17 +73,10 @@ typedef struct VFIOMigration {
-     bool initial_data_sent;
- } VFIOMigration;
- 
--typedef struct VFIOAddressSpace {
--    AddressSpace *as;
--    QLIST_HEAD(, VFIOContainer) containers;
--    QLIST_ENTRY(VFIOAddressSpace) list;
--} VFIOAddressSpace;
--
- struct VFIOGroup;
- 
- typedef struct VFIOContainer {
-     VFIOContainerBase bcontainer;
--    VFIOAddressSpace *space;
-     int fd; /* /dev/vfio/vfio, empowered by the attached groups */
-     MemoryListener listener;
-     MemoryListener prereg_listener;
-@@ -98,7 +91,6 @@ typedef struct VFIOContainer {
-     QLIST_HEAD(, VFIOHostDMAWindow) hostwin_list;
-     QLIST_HEAD(, VFIOGroup) group_list;
-     QLIST_HEAD(, VFIORamDiscardListener) vrdl_list;
--    QLIST_ENTRY(VFIOContainer) next;
-     QLIST_HEAD(, VFIODevice) device_list;
-     GList *iova_ranges;
- } VFIOContainer;
-diff --git a/include/hw/vfio/vfio-container-base.h b/include/hw/vfio/vfio-container-base.h
-index a11aec5755..c7cc6ec9c5 100644
---- a/include/hw/vfio/vfio-container-base.h
-+++ b/include/hw/vfio/vfio-container-base.h
-@@ -24,12 +24,20 @@ typedef struct {
-     hwaddr pages;
- } VFIOBitmap;
- 
-+typedef struct VFIOAddressSpace {
-+    AddressSpace *as;
-+    QLIST_HEAD(, VFIOContainerBase) containers;
-+    QLIST_ENTRY(VFIOAddressSpace) list;
-+} VFIOAddressSpace;
-+
- /*
-  * This is the base object for vfio container backends
-  */
- typedef struct VFIOContainerBase {
-     const VFIOIOMMUOps *ops;
-+    VFIOAddressSpace *space;
-     QLIST_HEAD(, VFIOGuestIOMMU) giommu_list;
-+    QLIST_ENTRY(VFIOContainerBase) next;
- } VFIOContainerBase;
- 
- typedef struct VFIOGuestIOMMU {
-@@ -48,6 +56,7 @@ int vfio_container_dma_unmap(VFIOContainerBase *bcontainer,
-                              IOMMUTLBEntry *iotlb);
- 
- void vfio_container_init(VFIOContainerBase *bcontainer,
-+                         VFIOAddressSpace *space,
-                          const VFIOIOMMUOps *ops);
- void vfio_container_destroy(VFIOContainerBase *bcontainer);
- 
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-container-Move-vrdl_list-to-base-container.patch b/SOURCES/kvm-vfio-container-Move-vrdl_list-to-base-container.patch
deleted file mode 100644
index 5e31d07..0000000
--- a/SOURCES/kvm-vfio-container-Move-vrdl_list-to-base-container.patch
+++ /dev/null
@@ -1,255 +0,0 @@
-From aadd055dcc06cb964ebfd2868b7e9b207d62ae0e Mon Sep 17 00:00:00 2001
-From: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Date: Thu, 2 Nov 2023 15:12:37 +0800
-Subject: [PATCH 012/101] vfio/container: Move vrdl_list to base container
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [11/67] 42da5389e39291839259f0e4c020c7461b7225cc (eauger1/centos-qemu-kvm)
-
-No functional change intended.
-
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit dc74a4b0056c0c803d46612a2319294921097974)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/common.c                      | 38 +++++++++++++--------------
- hw/vfio/container-base.c              |  1 +
- hw/vfio/container.c                   |  1 -
- include/hw/vfio/vfio-common.h         | 11 --------
- include/hw/vfio/vfio-container-base.h | 11 ++++++++
- 5 files changed, 31 insertions(+), 31 deletions(-)
-
-diff --git a/hw/vfio/common.c b/hw/vfio/common.c
-index 1cb53d369e..f15665789f 100644
---- a/hw/vfio/common.c
-+++ b/hw/vfio/common.c
-@@ -351,13 +351,13 @@ static void vfio_ram_discard_notify_discard(RamDiscardListener *rdl,
- {
-     VFIORamDiscardListener *vrdl = container_of(rdl, VFIORamDiscardListener,
-                                                 listener);
-+    VFIOContainerBase *bcontainer = vrdl->bcontainer;
-     const hwaddr size = int128_get64(section->size);
-     const hwaddr iova = section->offset_within_address_space;
-     int ret;
- 
-     /* Unmap with a single call. */
--    ret = vfio_container_dma_unmap(&vrdl->container->bcontainer,
--                                   iova, size , NULL);
-+    ret = vfio_container_dma_unmap(bcontainer, iova, size , NULL);
-     if (ret) {
-         error_report("%s: vfio_container_dma_unmap() failed: %s", __func__,
-                      strerror(-ret));
-@@ -369,6 +369,7 @@ static int vfio_ram_discard_notify_populate(RamDiscardListener *rdl,
- {
-     VFIORamDiscardListener *vrdl = container_of(rdl, VFIORamDiscardListener,
-                                                 listener);
-+    VFIOContainerBase *bcontainer = vrdl->bcontainer;
-     const hwaddr end = section->offset_within_region +
-                        int128_get64(section->size);
-     hwaddr start, next, iova;
-@@ -387,8 +388,8 @@ static int vfio_ram_discard_notify_populate(RamDiscardListener *rdl,
-                section->offset_within_address_space;
-         vaddr = memory_region_get_ram_ptr(section->mr) + start;
- 
--        ret = vfio_container_dma_map(&vrdl->container->bcontainer, iova,
--                                     next - start, vaddr, section->readonly);
-+        ret = vfio_container_dma_map(bcontainer, iova, next - start,
-+                                     vaddr, section->readonly);
-         if (ret) {
-             /* Rollback */
-             vfio_ram_discard_notify_discard(rdl, section);
-@@ -398,10 +399,9 @@ static int vfio_ram_discard_notify_populate(RamDiscardListener *rdl,
-     return 0;
- }
- 
--static void vfio_register_ram_discard_listener(VFIOContainer *container,
-+static void vfio_register_ram_discard_listener(VFIOContainerBase *bcontainer,
-                                                MemoryRegionSection *section)
- {
--    VFIOContainerBase *bcontainer = &container->bcontainer;
-     RamDiscardManager *rdm = memory_region_get_ram_discard_manager(section->mr);
-     VFIORamDiscardListener *vrdl;
- 
-@@ -412,7 +412,7 @@ static void vfio_register_ram_discard_listener(VFIOContainer *container,
-     g_assert(QEMU_IS_ALIGNED(int128_get64(section->size), TARGET_PAGE_SIZE));
- 
-     vrdl = g_new0(VFIORamDiscardListener, 1);
--    vrdl->container = container;
-+    vrdl->bcontainer = bcontainer;
-     vrdl->mr = section->mr;
-     vrdl->offset_within_address_space = section->offset_within_address_space;
-     vrdl->size = int128_get64(section->size);
-@@ -427,7 +427,7 @@ static void vfio_register_ram_discard_listener(VFIOContainer *container,
-                               vfio_ram_discard_notify_populate,
-                               vfio_ram_discard_notify_discard, true);
-     ram_discard_manager_register_listener(rdm, &vrdl->listener, section);
--    QLIST_INSERT_HEAD(&container->vrdl_list, vrdl, next);
-+    QLIST_INSERT_HEAD(&bcontainer->vrdl_list, vrdl, next);
- 
-     /*
-      * Sanity-check if we have a theoretically problematic setup where we could
-@@ -451,7 +451,7 @@ static void vfio_register_ram_discard_listener(VFIOContainer *container,
-         }
- #endif
- 
--        QLIST_FOREACH(vrdl, &container->vrdl_list, next) {
-+        QLIST_FOREACH(vrdl, &bcontainer->vrdl_list, next) {
-             hwaddr start, end;
- 
-             start = QEMU_ALIGN_DOWN(vrdl->offset_within_address_space,
-@@ -473,13 +473,13 @@ static void vfio_register_ram_discard_listener(VFIOContainer *container,
-     }
- }
- 
--static void vfio_unregister_ram_discard_listener(VFIOContainer *container,
-+static void vfio_unregister_ram_discard_listener(VFIOContainerBase *bcontainer,
-                                                  MemoryRegionSection *section)
- {
-     RamDiscardManager *rdm = memory_region_get_ram_discard_manager(section->mr);
-     VFIORamDiscardListener *vrdl = NULL;
- 
--    QLIST_FOREACH(vrdl, &container->vrdl_list, next) {
-+    QLIST_FOREACH(vrdl, &bcontainer->vrdl_list, next) {
-         if (vrdl->mr == section->mr &&
-             vrdl->offset_within_address_space ==
-             section->offset_within_address_space) {
-@@ -663,7 +663,7 @@ static void vfio_listener_region_add(MemoryListener *listener,
-      * about changes.
-      */
-     if (memory_region_has_ram_discard_manager(section->mr)) {
--        vfio_register_ram_discard_listener(container, section);
-+        vfio_register_ram_discard_listener(bcontainer, section);
-         return;
-     }
- 
-@@ -781,7 +781,7 @@ static void vfio_listener_region_del(MemoryListener *listener,
-         pgmask = (1ULL << ctz64(bcontainer->pgsizes)) - 1;
-         try_unmap = !((iova & pgmask) || (int128_get64(llsize) & pgmask));
-     } else if (memory_region_has_ram_discard_manager(section->mr)) {
--        vfio_unregister_ram_discard_listener(container, section);
-+        vfio_unregister_ram_discard_listener(bcontainer, section);
-         /* Unregistering will trigger an unmap. */
-         try_unmap = false;
-     }
-@@ -1260,17 +1260,17 @@ static int vfio_ram_discard_get_dirty_bitmap(MemoryRegionSection *section,
-      * Sync the whole mapped region (spanning multiple individual mappings)
-      * in one go.
-      */
--    return vfio_get_dirty_bitmap(&vrdl->container->bcontainer, iova, size,
--                                 ram_addr);
-+    return vfio_get_dirty_bitmap(vrdl->bcontainer, iova, size, ram_addr);
- }
- 
--static int vfio_sync_ram_discard_listener_dirty_bitmap(VFIOContainer *container,
--                                                   MemoryRegionSection *section)
-+static int
-+vfio_sync_ram_discard_listener_dirty_bitmap(VFIOContainerBase *bcontainer,
-+                                            MemoryRegionSection *section)
- {
-     RamDiscardManager *rdm = memory_region_get_ram_discard_manager(section->mr);
-     VFIORamDiscardListener *vrdl = NULL;
- 
--    QLIST_FOREACH(vrdl, &container->vrdl_list, next) {
-+    QLIST_FOREACH(vrdl, &bcontainer->vrdl_list, next) {
-         if (vrdl->mr == section->mr &&
-             vrdl->offset_within_address_space ==
-             section->offset_within_address_space) {
-@@ -1324,7 +1324,7 @@ static int vfio_sync_dirty_bitmap(VFIOContainer *container,
-         }
-         return 0;
-     } else if (memory_region_has_ram_discard_manager(section->mr)) {
--        return vfio_sync_ram_discard_listener_dirty_bitmap(container, section);
-+        return vfio_sync_ram_discard_listener_dirty_bitmap(bcontainer, section);
-     }
- 
-     ram_addr = memory_region_get_ram_addr(section->mr) +
-diff --git a/hw/vfio/container-base.c b/hw/vfio/container-base.c
-index dcce111349..584eee4ba1 100644
---- a/hw/vfio/container-base.c
-+++ b/hw/vfio/container-base.c
-@@ -54,6 +54,7 @@ void vfio_container_init(VFIOContainerBase *bcontainer, VFIOAddressSpace *space,
-     bcontainer->dirty_pages_supported = false;
-     bcontainer->dma_max_mappings = 0;
-     QLIST_INIT(&bcontainer->giommu_list);
-+    QLIST_INIT(&bcontainer->vrdl_list);
- }
- 
- void vfio_container_destroy(VFIOContainerBase *bcontainer)
-diff --git a/hw/vfio/container.c b/hw/vfio/container.c
-index c5a6262882..6ba2e2f8c4 100644
---- a/hw/vfio/container.c
-+++ b/hw/vfio/container.c
-@@ -560,7 +560,6 @@ static int vfio_connect_container(VFIOGroup *group, AddressSpace *as,
-     container->fd = fd;
-     container->error = NULL;
-     container->iova_ranges = NULL;
--    QLIST_INIT(&container->vrdl_list);
-     bcontainer = &container->bcontainer;
-     vfio_container_init(bcontainer, space, &vfio_legacy_ops);
- 
-diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
-index d3dc2f9dcb..8a607a4c17 100644
---- a/include/hw/vfio/vfio-common.h
-+++ b/include/hw/vfio/vfio-common.h
-@@ -87,20 +87,9 @@ typedef struct VFIOContainer {
-     uint64_t max_dirty_bitmap_size;
-     QLIST_HEAD(, VFIOHostDMAWindow) hostwin_list;
-     QLIST_HEAD(, VFIOGroup) group_list;
--    QLIST_HEAD(, VFIORamDiscardListener) vrdl_list;
-     GList *iova_ranges;
- } VFIOContainer;
- 
--typedef struct VFIORamDiscardListener {
--    VFIOContainer *container;
--    MemoryRegion *mr;
--    hwaddr offset_within_address_space;
--    hwaddr size;
--    uint64_t granularity;
--    RamDiscardListener listener;
--    QLIST_ENTRY(VFIORamDiscardListener) next;
--} VFIORamDiscardListener;
--
- typedef struct VFIOHostDMAWindow {
-     hwaddr min_iova;
-     hwaddr max_iova;
-diff --git a/include/hw/vfio/vfio-container-base.h b/include/hw/vfio/vfio-container-base.h
-index 85ec7e1a56..8e05b5ac5a 100644
---- a/include/hw/vfio/vfio-container-base.h
-+++ b/include/hw/vfio/vfio-container-base.h
-@@ -40,6 +40,7 @@ typedef struct VFIOContainerBase {
-     unsigned int dma_max_mappings;
-     bool dirty_pages_supported;
-     QLIST_HEAD(, VFIOGuestIOMMU) giommu_list;
-+    QLIST_HEAD(, VFIORamDiscardListener) vrdl_list;
-     QLIST_ENTRY(VFIOContainerBase) next;
-     QLIST_HEAD(, VFIODevice) device_list;
- } VFIOContainerBase;
-@@ -52,6 +53,16 @@ typedef struct VFIOGuestIOMMU {
-     QLIST_ENTRY(VFIOGuestIOMMU) giommu_next;
- } VFIOGuestIOMMU;
- 
-+typedef struct VFIORamDiscardListener {
-+    VFIOContainerBase *bcontainer;
-+    MemoryRegion *mr;
-+    hwaddr offset_within_address_space;
-+    hwaddr size;
-+    uint64_t granularity;
-+    RamDiscardListener listener;
-+    QLIST_ENTRY(VFIORamDiscardListener) next;
-+} VFIORamDiscardListener;
-+
- int vfio_container_dma_map(VFIOContainerBase *bcontainer,
-                            hwaddr iova, ram_addr_t size,
-                            void *vaddr, bool readonly);
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-container-Rename-vfio_init_container-to-vfio_se.patch b/SOURCES/kvm-vfio-container-Rename-vfio_init_container-to-vfio_se.patch
deleted file mode 100644
index f68be0b..0000000
--- a/SOURCES/kvm-vfio-container-Rename-vfio_init_container-to-vfio_se.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From edfc1ee2a1854d180ffad92e70212535a2ca668c Mon Sep 17 00:00:00 2001
-From: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Date: Thu, 21 Dec 2023 10:45:17 +0800
-Subject: [PATCH 062/101] vfio/container: Rename vfio_init_container to
- vfio_set_iommu
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [61/67] 5e7f956379b54fe6fa7e078ec17e71325aa109af (eauger1/centos-qemu-kvm)
-
-vfio_container_init() and vfio_init_container() names are confusing
-especially when we see vfio_init_container() calls vfio_container_init().
-
-vfio_container_init() operates on base container which is consistent
-with all routines handling 'VFIOContainerBase *' ops.
-
-vfio_init_container() operates on legacy container and setup IOMMU
-context with ioctl(VFIO_SET_IOMMU).
-
-So choose to rename vfio_init_container to vfio_set_iommu to avoid
-the confusion.
-
-No functional change intended.
-
-Suggested-by: Cédric Le Goater <clg@redhat.com>
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 9f734a117cbf63b03577b46c8cad8ad88ec6dced)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/container.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/hw/vfio/container.c b/hw/vfio/container.c
-index 8d334f52f2..bd25b9fbad 100644
---- a/hw/vfio/container.c
-+++ b/hw/vfio/container.c
-@@ -392,8 +392,8 @@ static const VFIOIOMMUClass *vfio_get_iommu_class(int iommu_type, Error **errp)
-     return VFIO_IOMMU_CLASS(klass);
- }
- 
--static int vfio_init_container(VFIOContainer *container, int group_fd,
--                               VFIOAddressSpace *space, Error **errp)
-+static int vfio_set_iommu(VFIOContainer *container, int group_fd,
-+                          VFIOAddressSpace *space, Error **errp)
- {
-     int iommu_type, ret;
-     const VFIOIOMMUClass *vioc;
-@@ -616,7 +616,7 @@ static int vfio_connect_container(VFIOGroup *group, AddressSpace *as,
-     container->fd = fd;
-     bcontainer = &container->bcontainer;
- 
--    ret = vfio_init_container(container, group->fd, space, errp);
-+    ret = vfio_set_iommu(container, group->fd, space, errp);
-     if (ret) {
-         goto free_container_exit;
-     }
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-container-Replace-basename-with-g_path_get_base.patch b/SOURCES/kvm-vfio-container-Replace-basename-with-g_path_get_base.patch
deleted file mode 100644
index 77df179..0000000
--- a/SOURCES/kvm-vfio-container-Replace-basename-with-g_path_get_base.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-From 8d3857c7877da58ed0c6b62cf2714c4127350522 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
-Date: Wed, 20 Dec 2023 14:53:02 +0100
-Subject: [PATCH 059/101] vfio/container: Replace basename with
- g_path_get_basename
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [58/67] 56a90f23dadc89271b1fff014fc64ade87c1a4cb (eauger1/centos-qemu-kvm)
-
-g_path_get_basename() is a portable utility function that has the
-advantage of not modifing the string argument. It also fixes a compile
-breakage with the Musl C library reported in [1].
-
-[1] https://lore.kernel.org/all/20231212010228.2701544-1-raj.khem@gmail.com/
-
-Reported-by: Khem Raj <raj.khem@gmail.com>
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
-Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 213ae3ffda463c0503e39e0cf827511b5298c314)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/container.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/hw/vfio/container.c b/hw/vfio/container.c
-index 688cf23bab..8d334f52f2 100644
---- a/hw/vfio/container.c
-+++ b/hw/vfio/container.c
-@@ -869,7 +869,8 @@ static void vfio_put_base_device(VFIODevice *vbasedev)
- 
- static int vfio_device_groupid(VFIODevice *vbasedev, Error **errp)
- {
--    char *tmp, group_path[PATH_MAX], *group_name;
-+    char *tmp, group_path[PATH_MAX];
-+    g_autofree char *group_name = NULL;
-     int ret, groupid;
-     ssize_t len;
- 
-@@ -885,7 +886,7 @@ static int vfio_device_groupid(VFIODevice *vbasedev, Error **errp)
- 
-     group_path[len] = 0;
- 
--    group_name = basename(group_path);
-+    group_name = g_path_get_basename(group_path);
-     if (sscanf(group_name, "%d", &groupid) != 1) {
-         error_setg_errno(errp, errno, "failed to read %s", group_path);
-         return -errno;
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-container-Switch-to-IOMMU-BE-set_dirty_page_tra.patch b/SOURCES/kvm-vfio-container-Switch-to-IOMMU-BE-set_dirty_page_tra.patch
deleted file mode 100644
index 5442688..0000000
--- a/SOURCES/kvm-vfio-container-Switch-to-IOMMU-BE-set_dirty_page_tra.patch
+++ /dev/null
@@ -1,235 +0,0 @@
-From a2c8aa64b1b21a3e1d4cf2a4fe7d84dc32f69284 Mon Sep 17 00:00:00 2001
-From: Eric Auger <eric.auger@redhat.com>
-Date: Thu, 2 Nov 2023 15:12:33 +0800
-Subject: [PATCH 008/101] vfio/container: Switch to IOMMU BE
- set_dirty_page_tracking/query_dirty_bitmap API
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [7/67] 88368809c7990e1d9b01406e48694fe3e3fb1397 (eauger1/centos-qemu-kvm)
-
-dirty_pages_supported field is also moved to the base container
-
-No functional change intended.
-
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
-Signed-off-by: Yi Liu <yi.l.liu@intel.com>
-Signed-off-by: Yi Sun <yi.y.sun@linux.intel.com>
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit bb424490edcef73d07f200d53f69415b203d81df)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/common.c                      | 12 ++++++++----
- hw/vfio/container-base.c              | 16 ++++++++++++++++
- hw/vfio/container.c                   | 21 ++++++++++++++-------
- include/hw/vfio/vfio-common.h         |  6 ------
- include/hw/vfio/vfio-container-base.h |  6 ++++++
- 5 files changed, 44 insertions(+), 17 deletions(-)
-
-diff --git a/hw/vfio/common.c b/hw/vfio/common.c
-index 1d8202537e..b1a875ca93 100644
---- a/hw/vfio/common.c
-+++ b/hw/vfio/common.c
-@@ -1079,7 +1079,8 @@ static void vfio_listener_log_global_start(MemoryListener *listener)
-     if (vfio_devices_all_device_dirty_tracking(container)) {
-         ret = vfio_devices_dma_logging_start(container);
-     } else {
--        ret = vfio_set_dirty_page_tracking(container, true);
-+        ret = vfio_container_set_dirty_page_tracking(&container->bcontainer,
-+                                                     true);
-     }
- 
-     if (ret) {
-@@ -1097,7 +1098,8 @@ static void vfio_listener_log_global_stop(MemoryListener *listener)
-     if (vfio_devices_all_device_dirty_tracking(container)) {
-         vfio_devices_dma_logging_stop(container);
-     } else {
--        ret = vfio_set_dirty_page_tracking(container, false);
-+        ret = vfio_container_set_dirty_page_tracking(&container->bcontainer,
-+                                                     false);
-     }
- 
-     if (ret) {
-@@ -1165,7 +1167,8 @@ int vfio_get_dirty_bitmap(VFIOContainer *container, uint64_t iova,
-     VFIOBitmap vbmap;
-     int ret;
- 
--    if (!container->dirty_pages_supported && !all_device_dirty_tracking) {
-+    if (!container->bcontainer.dirty_pages_supported &&
-+        !all_device_dirty_tracking) {
-         cpu_physical_memory_set_dirty_range(ram_addr, size,
-                                             tcg_enabled() ? DIRTY_CLIENTS_ALL :
-                                             DIRTY_CLIENTS_NOCODE);
-@@ -1180,7 +1183,8 @@ int vfio_get_dirty_bitmap(VFIOContainer *container, uint64_t iova,
-     if (all_device_dirty_tracking) {
-         ret = vfio_devices_query_dirty_bitmap(container, &vbmap, iova, size);
-     } else {
--        ret = vfio_query_dirty_bitmap(container, &vbmap, iova, size);
-+        ret = vfio_container_query_dirty_bitmap(&container->bcontainer, &vbmap,
-+                                                iova, size);
-     }
- 
-     if (ret) {
-diff --git a/hw/vfio/container-base.c b/hw/vfio/container-base.c
-index 3933391e0d..5d654ae172 100644
---- a/hw/vfio/container-base.c
-+++ b/hw/vfio/container-base.c
-@@ -31,11 +31,27 @@ int vfio_container_dma_unmap(VFIOContainerBase *bcontainer,
-     return bcontainer->ops->dma_unmap(bcontainer, iova, size, iotlb);
- }
- 
-+int vfio_container_set_dirty_page_tracking(VFIOContainerBase *bcontainer,
-+                                           bool start)
-+{
-+    g_assert(bcontainer->ops->set_dirty_page_tracking);
-+    return bcontainer->ops->set_dirty_page_tracking(bcontainer, start);
-+}
-+
-+int vfio_container_query_dirty_bitmap(VFIOContainerBase *bcontainer,
-+                                      VFIOBitmap *vbmap,
-+                                      hwaddr iova, hwaddr size)
-+{
-+    g_assert(bcontainer->ops->query_dirty_bitmap);
-+    return bcontainer->ops->query_dirty_bitmap(bcontainer, vbmap, iova, size);
-+}
-+
- void vfio_container_init(VFIOContainerBase *bcontainer, VFIOAddressSpace *space,
-                          const VFIOIOMMUOps *ops)
- {
-     bcontainer->ops = ops;
-     bcontainer->space = space;
-+    bcontainer->dirty_pages_supported = false;
-     QLIST_INIT(&bcontainer->giommu_list);
- }
- 
-diff --git a/hw/vfio/container.c b/hw/vfio/container.c
-index f12fcb6fe1..3ab74e2615 100644
---- a/hw/vfio/container.c
-+++ b/hw/vfio/container.c
-@@ -131,7 +131,7 @@ static int vfio_legacy_dma_unmap(VFIOContainerBase *bcontainer, hwaddr iova,
- 
-     if (iotlb && vfio_devices_all_running_and_mig_active(container)) {
-         if (!vfio_devices_all_device_dirty_tracking(container) &&
--            container->dirty_pages_supported) {
-+            container->bcontainer.dirty_pages_supported) {
-             return vfio_dma_unmap_bitmap(container, iova, size, iotlb);
-         }
- 
-@@ -205,14 +205,17 @@ static int vfio_legacy_dma_map(VFIOContainerBase *bcontainer, hwaddr iova,
-     return -errno;
- }
- 
--int vfio_set_dirty_page_tracking(VFIOContainer *container, bool start)
-+static int vfio_legacy_set_dirty_page_tracking(VFIOContainerBase *bcontainer,
-+                                               bool start)
- {
-+    VFIOContainer *container = container_of(bcontainer, VFIOContainer,
-+                                            bcontainer);
-     int ret;
-     struct vfio_iommu_type1_dirty_bitmap dirty = {
-         .argsz = sizeof(dirty),
-     };
- 
--    if (!container->dirty_pages_supported) {
-+    if (!bcontainer->dirty_pages_supported) {
-         return 0;
-     }
- 
-@@ -232,9 +235,12 @@ int vfio_set_dirty_page_tracking(VFIOContainer *container, bool start)
-     return ret;
- }
- 
--int vfio_query_dirty_bitmap(VFIOContainer *container, VFIOBitmap *vbmap,
--                            hwaddr iova, hwaddr size)
-+static int vfio_legacy_query_dirty_bitmap(VFIOContainerBase *bcontainer,
-+                                          VFIOBitmap *vbmap,
-+                                          hwaddr iova, hwaddr size)
- {
-+    VFIOContainer *container = container_of(bcontainer, VFIOContainer,
-+                                            bcontainer);
-     struct vfio_iommu_type1_dirty_bitmap *dbitmap;
-     struct vfio_iommu_type1_dirty_bitmap_get *range;
-     int ret;
-@@ -461,7 +467,7 @@ static void vfio_get_iommu_info_migration(VFIOContainer *container,
-      * qemu_real_host_page_size to mark those dirty.
-      */
-     if (cap_mig->pgsize_bitmap & qemu_real_host_page_size()) {
--        container->dirty_pages_supported = true;
-+        container->bcontainer.dirty_pages_supported = true;
-         container->max_dirty_bitmap_size = cap_mig->max_dirty_bitmap_size;
-         container->dirty_pgsizes = cap_mig->pgsize_bitmap;
-     }
-@@ -553,7 +559,6 @@ static int vfio_connect_container(VFIOGroup *group, AddressSpace *as,
-     container = g_malloc0(sizeof(*container));
-     container->fd = fd;
-     container->error = NULL;
--    container->dirty_pages_supported = false;
-     container->dma_max_mappings = 0;
-     container->iova_ranges = NULL;
-     QLIST_INIT(&container->vrdl_list);
-@@ -937,4 +942,6 @@ void vfio_detach_device(VFIODevice *vbasedev)
- const VFIOIOMMUOps vfio_legacy_ops = {
-     .dma_map = vfio_legacy_dma_map,
-     .dma_unmap = vfio_legacy_dma_unmap,
-+    .set_dirty_page_tracking = vfio_legacy_set_dirty_page_tracking,
-+    .query_dirty_bitmap = vfio_legacy_query_dirty_bitmap,
- };
-diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
-index bd4de6cb3a..60f2785fe0 100644
---- a/include/hw/vfio/vfio-common.h
-+++ b/include/hw/vfio/vfio-common.h
-@@ -83,7 +83,6 @@ typedef struct VFIOContainer {
-     unsigned iommu_type;
-     Error *error;
-     bool initialized;
--    bool dirty_pages_supported;
-     uint64_t dirty_pgsizes;
-     uint64_t max_dirty_bitmap_size;
-     unsigned long pgsizes;
-@@ -190,11 +189,6 @@ VFIOAddressSpace *vfio_get_address_space(AddressSpace *as);
- void vfio_put_address_space(VFIOAddressSpace *space);
- bool vfio_devices_all_running_and_saving(VFIOContainer *container);
- 
--/* container->fd */
--int vfio_set_dirty_page_tracking(VFIOContainer *container, bool start);
--int vfio_query_dirty_bitmap(VFIOContainer *container, VFIOBitmap *vbmap,
--                            hwaddr iova, hwaddr size);
--
- /* SPAPR specific */
- int vfio_container_add_section_window(VFIOContainer *container,
-                                       MemoryRegionSection *section,
-diff --git a/include/hw/vfio/vfio-container-base.h b/include/hw/vfio/vfio-container-base.h
-index c7cc6ec9c5..f244f003d0 100644
---- a/include/hw/vfio/vfio-container-base.h
-+++ b/include/hw/vfio/vfio-container-base.h
-@@ -36,6 +36,7 @@ typedef struct VFIOAddressSpace {
- typedef struct VFIOContainerBase {
-     const VFIOIOMMUOps *ops;
-     VFIOAddressSpace *space;
-+    bool dirty_pages_supported;
-     QLIST_HEAD(, VFIOGuestIOMMU) giommu_list;
-     QLIST_ENTRY(VFIOContainerBase) next;
- } VFIOContainerBase;
-@@ -54,6 +55,11 @@ int vfio_container_dma_map(VFIOContainerBase *bcontainer,
- int vfio_container_dma_unmap(VFIOContainerBase *bcontainer,
-                              hwaddr iova, ram_addr_t size,
-                              IOMMUTLBEntry *iotlb);
-+int vfio_container_set_dirty_page_tracking(VFIOContainerBase *bcontainer,
-+                                           bool start);
-+int vfio_container_query_dirty_bitmap(VFIOContainerBase *bcontainer,
-+                                      VFIOBitmap *vbmap,
-+                                      hwaddr iova, hwaddr size);
- 
- void vfio_container_init(VFIOContainerBase *bcontainer,
-                          VFIOAddressSpace *space,
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-container-Switch-to-dma_map-unmap-API.patch b/SOURCES/kvm-vfio-container-Switch-to-dma_map-unmap-API.patch
deleted file mode 100644
index cfb5eb1..0000000
--- a/SOURCES/kvm-vfio-container-Switch-to-dma_map-unmap-API.patch
+++ /dev/null
@@ -1,303 +0,0 @@
-From 00daef8e3f4f64b1401b2e8945c256d27fbfa960 Mon Sep 17 00:00:00 2001
-From: Eric Auger <eric.auger@redhat.com>
-Date: Thu, 2 Nov 2023 15:12:29 +0800
-Subject: [PATCH 004/101] vfio/container: Switch to dma_map|unmap API
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [3/67] 9a20e2f2b277be65463f145df3309271493be6ac (eauger1/centos-qemu-kvm)
-
-No functional change intended.
-
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
-Signed-off-by: Yi Liu <yi.l.liu@intel.com>
-Signed-off-by: Yi Sun <yi.y.sun@linux.intel.com>
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit b08501a999e2448f500a46d68da503be55186b04)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/common.c                      | 45 +++++++++++++++------------
- hw/vfio/container-base.c              | 32 +++++++++++++++++++
- hw/vfio/container.c                   | 22 ++++++++-----
- hw/vfio/meson.build                   |  1 +
- hw/vfio/trace-events                  |  2 +-
- include/hw/vfio/vfio-common.h         |  4 ---
- include/hw/vfio/vfio-container-base.h |  7 +++++
- 7 files changed, 81 insertions(+), 32 deletions(-)
- create mode 100644 hw/vfio/container-base.c
-
-diff --git a/hw/vfio/common.c b/hw/vfio/common.c
-index e70fdf5e0c..e610771888 100644
---- a/hw/vfio/common.c
-+++ b/hw/vfio/common.c
-@@ -292,7 +292,7 @@ static bool vfio_get_xlat_addr(IOMMUTLBEntry *iotlb, void **vaddr,
- static void vfio_iommu_map_notify(IOMMUNotifier *n, IOMMUTLBEntry *iotlb)
- {
-     VFIOGuestIOMMU *giommu = container_of(n, VFIOGuestIOMMU, n);
--    VFIOContainer *container = giommu->container;
-+    VFIOContainerBase *bcontainer = &giommu->container->bcontainer;
-     hwaddr iova = iotlb->iova + giommu->iommu_offset;
-     void *vaddr;
-     int ret;
-@@ -322,21 +322,22 @@ static void vfio_iommu_map_notify(IOMMUNotifier *n, IOMMUTLBEntry *iotlb)
-          * of vaddr will always be there, even if the memory object is
-          * destroyed and its backing memory munmap-ed.
-          */
--        ret = vfio_dma_map(container, iova,
--                           iotlb->addr_mask + 1, vaddr,
--                           read_only);
-+        ret = vfio_container_dma_map(bcontainer, iova,
-+                                     iotlb->addr_mask + 1, vaddr,
-+                                     read_only);
-         if (ret) {
--            error_report("vfio_dma_map(%p, 0x%"HWADDR_PRIx", "
-+            error_report("vfio_container_dma_map(%p, 0x%"HWADDR_PRIx", "
-                          "0x%"HWADDR_PRIx", %p) = %d (%s)",
--                         container, iova,
-+                         bcontainer, iova,
-                          iotlb->addr_mask + 1, vaddr, ret, strerror(-ret));
-         }
-     } else {
--        ret = vfio_dma_unmap(container, iova, iotlb->addr_mask + 1, iotlb);
-+        ret = vfio_container_dma_unmap(bcontainer, iova,
-+                                       iotlb->addr_mask + 1, iotlb);
-         if (ret) {
--            error_report("vfio_dma_unmap(%p, 0x%"HWADDR_PRIx", "
-+            error_report("vfio_container_dma_unmap(%p, 0x%"HWADDR_PRIx", "
-                          "0x%"HWADDR_PRIx") = %d (%s)",
--                         container, iova,
-+                         bcontainer, iova,
-                          iotlb->addr_mask + 1, ret, strerror(-ret));
-             vfio_set_migration_error(ret);
-         }
-@@ -355,9 +356,10 @@ static void vfio_ram_discard_notify_discard(RamDiscardListener *rdl,
-     int ret;
- 
-     /* Unmap with a single call. */
--    ret = vfio_dma_unmap(vrdl->container, iova, size , NULL);
-+    ret = vfio_container_dma_unmap(&vrdl->container->bcontainer,
-+                                   iova, size , NULL);
-     if (ret) {
--        error_report("%s: vfio_dma_unmap() failed: %s", __func__,
-+        error_report("%s: vfio_container_dma_unmap() failed: %s", __func__,
-                      strerror(-ret));
-     }
- }
-@@ -385,8 +387,8 @@ static int vfio_ram_discard_notify_populate(RamDiscardListener *rdl,
-                section->offset_within_address_space;
-         vaddr = memory_region_get_ram_ptr(section->mr) + start;
- 
--        ret = vfio_dma_map(vrdl->container, iova, next - start,
--                           vaddr, section->readonly);
-+        ret = vfio_container_dma_map(&vrdl->container->bcontainer, iova,
-+                                     next - start, vaddr, section->readonly);
-         if (ret) {
-             /* Rollback */
-             vfio_ram_discard_notify_discard(rdl, section);
-@@ -684,10 +686,11 @@ static void vfio_listener_region_add(MemoryListener *listener,
-         }
-     }
- 
--    ret = vfio_dma_map(container, iova, int128_get64(llsize),
--                       vaddr, section->readonly);
-+    ret = vfio_container_dma_map(&container->bcontainer,
-+                                 iova, int128_get64(llsize), vaddr,
-+                                 section->readonly);
-     if (ret) {
--        error_setg(&err, "vfio_dma_map(%p, 0x%"HWADDR_PRIx", "
-+        error_setg(&err, "vfio_container_dma_map(%p, 0x%"HWADDR_PRIx", "
-                    "0x%"HWADDR_PRIx", %p) = %d (%s)",
-                    container, iova, int128_get64(llsize), vaddr, ret,
-                    strerror(-ret));
-@@ -784,18 +787,20 @@ static void vfio_listener_region_del(MemoryListener *listener,
-         if (int128_eq(llsize, int128_2_64())) {
-             /* The unmap ioctl doesn't accept a full 64-bit span. */
-             llsize = int128_rshift(llsize, 1);
--            ret = vfio_dma_unmap(container, iova, int128_get64(llsize), NULL);
-+            ret = vfio_container_dma_unmap(&container->bcontainer, iova,
-+                                           int128_get64(llsize), NULL);
-             if (ret) {
--                error_report("vfio_dma_unmap(%p, 0x%"HWADDR_PRIx", "
-+                error_report("vfio_container_dma_unmap(%p, 0x%"HWADDR_PRIx", "
-                              "0x%"HWADDR_PRIx") = %d (%s)",
-                              container, iova, int128_get64(llsize), ret,
-                              strerror(-ret));
-             }
-             iova += int128_get64(llsize);
-         }
--        ret = vfio_dma_unmap(container, iova, int128_get64(llsize), NULL);
-+        ret = vfio_container_dma_unmap(&container->bcontainer, iova,
-+                                       int128_get64(llsize), NULL);
-         if (ret) {
--            error_report("vfio_dma_unmap(%p, 0x%"HWADDR_PRIx", "
-+            error_report("vfio_container_dma_unmap(%p, 0x%"HWADDR_PRIx", "
-                          "0x%"HWADDR_PRIx") = %d (%s)",
-                          container, iova, int128_get64(llsize), ret,
-                          strerror(-ret));
-diff --git a/hw/vfio/container-base.c b/hw/vfio/container-base.c
-new file mode 100644
-index 0000000000..55d3a35fa4
---- /dev/null
-+++ b/hw/vfio/container-base.c
-@@ -0,0 +1,32 @@
-+/*
-+ * VFIO BASE CONTAINER
-+ *
-+ * Copyright (C) 2023 Intel Corporation.
-+ * Copyright Red Hat, Inc. 2023
-+ *
-+ * Authors: Yi Liu <yi.l.liu@intel.com>
-+ *          Eric Auger <eric.auger@redhat.com>
-+ *
-+ * SPDX-License-Identifier: GPL-2.0-or-later
-+ */
-+
-+#include "qemu/osdep.h"
-+#include "qapi/error.h"
-+#include "qemu/error-report.h"
-+#include "hw/vfio/vfio-container-base.h"
-+
-+int vfio_container_dma_map(VFIOContainerBase *bcontainer,
-+                           hwaddr iova, ram_addr_t size,
-+                           void *vaddr, bool readonly)
-+{
-+    g_assert(bcontainer->ops->dma_map);
-+    return bcontainer->ops->dma_map(bcontainer, iova, size, vaddr, readonly);
-+}
-+
-+int vfio_container_dma_unmap(VFIOContainerBase *bcontainer,
-+                             hwaddr iova, ram_addr_t size,
-+                             IOMMUTLBEntry *iotlb)
-+{
-+    g_assert(bcontainer->ops->dma_unmap);
-+    return bcontainer->ops->dma_unmap(bcontainer, iova, size, iotlb);
-+}
-diff --git a/hw/vfio/container.c b/hw/vfio/container.c
-index 4bc43ddfa4..c04df26323 100644
---- a/hw/vfio/container.c
-+++ b/hw/vfio/container.c
-@@ -115,9 +115,11 @@ unmap_exit:
- /*
-  * DMA - Mapping and unmapping for the "type1" IOMMU interface used on x86
-  */
--int vfio_dma_unmap(VFIOContainer *container, hwaddr iova,
--                   ram_addr_t size, IOMMUTLBEntry *iotlb)
-+static int vfio_legacy_dma_unmap(VFIOContainerBase *bcontainer, hwaddr iova,
-+                                 ram_addr_t size, IOMMUTLBEntry *iotlb)
- {
-+    VFIOContainer *container = container_of(bcontainer, VFIOContainer,
-+                                            bcontainer);
-     struct vfio_iommu_type1_dma_unmap unmap = {
-         .argsz = sizeof(unmap),
-         .flags = 0,
-@@ -151,7 +153,7 @@ int vfio_dma_unmap(VFIOContainer *container, hwaddr iova,
-          */
-         if (errno == EINVAL && unmap.size && !(unmap.iova + unmap.size) &&
-             container->iommu_type == VFIO_TYPE1v2_IOMMU) {
--            trace_vfio_dma_unmap_overflow_workaround();
-+            trace_vfio_legacy_dma_unmap_overflow_workaround();
-             unmap.size -= 1ULL << ctz64(container->pgsizes);
-             continue;
-         }
-@@ -170,9 +172,11 @@ int vfio_dma_unmap(VFIOContainer *container, hwaddr iova,
-     return 0;
- }
- 
--int vfio_dma_map(VFIOContainer *container, hwaddr iova,
--                 ram_addr_t size, void *vaddr, bool readonly)
-+static int vfio_legacy_dma_map(VFIOContainerBase *bcontainer, hwaddr iova,
-+                               ram_addr_t size, void *vaddr, bool readonly)
- {
-+    VFIOContainer *container = container_of(bcontainer, VFIOContainer,
-+                                            bcontainer);
-     struct vfio_iommu_type1_dma_map map = {
-         .argsz = sizeof(map),
-         .flags = VFIO_DMA_MAP_FLAG_READ,
-@@ -191,7 +195,8 @@ int vfio_dma_map(VFIOContainer *container, hwaddr iova,
-      * the VGA ROM space.
-      */
-     if (ioctl(container->fd, VFIO_IOMMU_MAP_DMA, &map) == 0 ||
--        (errno == EBUSY && vfio_dma_unmap(container, iova, size, NULL) == 0 &&
-+        (errno == EBUSY &&
-+         vfio_legacy_dma_unmap(bcontainer, iova, size, NULL) == 0 &&
-          ioctl(container->fd, VFIO_IOMMU_MAP_DMA, &map) == 0)) {
-         return 0;
-     }
-@@ -937,4 +942,7 @@ void vfio_detach_device(VFIODevice *vbasedev)
-     vfio_put_group(group);
- }
- 
--const VFIOIOMMUOps vfio_legacy_ops;
-+const VFIOIOMMUOps vfio_legacy_ops = {
-+    .dma_map = vfio_legacy_dma_map,
-+    .dma_unmap = vfio_legacy_dma_unmap,
-+};
-diff --git a/hw/vfio/meson.build b/hw/vfio/meson.build
-index 2a6912c940..eb6ce6229d 100644
---- a/hw/vfio/meson.build
-+++ b/hw/vfio/meson.build
-@@ -2,6 +2,7 @@ vfio_ss = ss.source_set()
- vfio_ss.add(files(
-   'helpers.c',
-   'common.c',
-+  'container-base.c',
-   'container.c',
-   'spapr.c',
-   'migration.c',
-diff --git a/hw/vfio/trace-events b/hw/vfio/trace-events
-index 0eb2387cf2..9f7fedee98 100644
---- a/hw/vfio/trace-events
-+++ b/hw/vfio/trace-events
-@@ -116,7 +116,7 @@ vfio_region_unmap(const char *name, unsigned long offset, unsigned long end) "Re
- vfio_region_sparse_mmap_header(const char *name, int index, int nr_areas) "Device %s region %d: %d sparse mmap entries"
- vfio_region_sparse_mmap_entry(int i, unsigned long start, unsigned long end) "sparse entry %d [0x%lx - 0x%lx]"
- vfio_get_dev_region(const char *name, int index, uint32_t type, uint32_t subtype) "%s index %d, %08x/%08x"
--vfio_dma_unmap_overflow_workaround(void) ""
-+vfio_legacy_dma_unmap_overflow_workaround(void) ""
- vfio_get_dirty_bitmap(int fd, uint64_t iova, uint64_t size, uint64_t bitmap_size, uint64_t start, uint64_t dirty_pages) "container fd=%d, iova=0x%"PRIx64" size= 0x%"PRIx64" bitmap_size=0x%"PRIx64" start=0x%"PRIx64" dirty_pages=%"PRIu64
- vfio_iommu_map_dirty_notify(uint64_t iova_start, uint64_t iova_end) "iommu dirty @ 0x%"PRIx64" - 0x%"PRIx64
- 
-diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
-index 678161f207..24a26345e5 100644
---- a/include/hw/vfio/vfio-common.h
-+++ b/include/hw/vfio/vfio-common.h
-@@ -208,10 +208,6 @@ void vfio_put_address_space(VFIOAddressSpace *space);
- bool vfio_devices_all_running_and_saving(VFIOContainer *container);
- 
- /* container->fd */
--int vfio_dma_unmap(VFIOContainer *container, hwaddr iova,
--                   ram_addr_t size, IOMMUTLBEntry *iotlb);
--int vfio_dma_map(VFIOContainer *container, hwaddr iova,
--                 ram_addr_t size, void *vaddr, bool readonly);
- int vfio_set_dirty_page_tracking(VFIOContainer *container, bool start);
- int vfio_query_dirty_bitmap(VFIOContainer *container, VFIOBitmap *vbmap,
-                             hwaddr iova, hwaddr size);
-diff --git a/include/hw/vfio/vfio-container-base.h b/include/hw/vfio/vfio-container-base.h
-index 1d6daaea5d..56b033f59f 100644
---- a/include/hw/vfio/vfio-container-base.h
-+++ b/include/hw/vfio/vfio-container-base.h
-@@ -31,6 +31,13 @@ typedef struct VFIOContainerBase {
-     const VFIOIOMMUOps *ops;
- } VFIOContainerBase;
- 
-+int vfio_container_dma_map(VFIOContainerBase *bcontainer,
-+                           hwaddr iova, ram_addr_t size,
-+                           void *vaddr, bool readonly);
-+int vfio_container_dma_unmap(VFIOContainerBase *bcontainer,
-+                             hwaddr iova, ram_addr_t size,
-+                             IOMMUTLBEntry *iotlb);
-+
- struct VFIOIOMMUOps {
-     /* basic feature */
-     int (*dma_map)(VFIOContainerBase *bcontainer,
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-iommufd-Add-support-for-iova_ranges-and-pgsizes.patch b/SOURCES/kvm-vfio-iommufd-Add-support-for-iova_ranges-and-pgsizes.patch
deleted file mode 100644
index 52e3d87..0000000
--- a/SOURCES/kvm-vfio-iommufd-Add-support-for-iova_ranges-and-pgsizes.patch
+++ /dev/null
@@ -1,115 +0,0 @@
-From 49435d4d592bc890f56b69c2290f890c87b5a103 Mon Sep 17 00:00:00 2001
-From: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Date: Tue, 21 Nov 2023 16:44:05 +0800
-Subject: [PATCH 026/101] vfio/iommufd: Add support for iova_ranges and pgsizes
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [25/67] 578af0547d97276ccd4936b574c12118fc70d468 (eauger1/centos-qemu-kvm)
-
-Some vIOMMU such as virtio-iommu use IOVA ranges from host side to
-setup reserved ranges for passthrough device, so that guest will not
-use an IOVA range beyond host support.
-
-Use an uAPI of IOMMUFD to get IOVA ranges of host side and pass to
-vIOMMU just like the legacy backend, if this fails, fallback to
-64bit IOVA range.
-
-Also use out_iova_alignment returned from uAPI as pgsizes instead of
-qemu_real_host_page_size() as a fallback.
-
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Tested-by: Eric Auger <eric.auger@redhat.com>
-Tested-by: Nicolin Chen <nicolinc@nvidia.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 714e9affa8ae1d84007c8afde7bb10fef9cb883d)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/iommufd.c | 56 ++++++++++++++++++++++++++++++++++++++++++++++-
- 1 file changed, 55 insertions(+), 1 deletion(-)
-
-diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
-index 6d31aeac7b..01b448e840 100644
---- a/hw/vfio/iommufd.c
-+++ b/hw/vfio/iommufd.c
-@@ -261,6 +261,53 @@ static int iommufd_cdev_ram_block_discard_disable(bool state)
-     return ram_block_uncoordinated_discard_disable(state);
- }
- 
-+static int iommufd_cdev_get_info_iova_range(VFIOIOMMUFDContainer *container,
-+                                            uint32_t ioas_id, Error **errp)
-+{
-+    VFIOContainerBase *bcontainer = &container->bcontainer;
-+    struct iommu_ioas_iova_ranges *info;
-+    struct iommu_iova_range *iova_ranges;
-+    int ret, sz, fd = container->be->fd;
-+
-+    info = g_malloc0(sizeof(*info));
-+    info->size = sizeof(*info);
-+    info->ioas_id = ioas_id;
-+
-+    ret = ioctl(fd, IOMMU_IOAS_IOVA_RANGES, info);
-+    if (ret && errno != EMSGSIZE) {
-+        goto error;
-+    }
-+
-+    sz = info->num_iovas * sizeof(struct iommu_iova_range);
-+    info = g_realloc(info, sizeof(*info) + sz);
-+    info->allowed_iovas = (uintptr_t)(info + 1);
-+
-+    ret = ioctl(fd, IOMMU_IOAS_IOVA_RANGES, info);
-+    if (ret) {
-+        goto error;
-+    }
-+
-+    iova_ranges = (struct iommu_iova_range *)(uintptr_t)info->allowed_iovas;
-+
-+    for (int i = 0; i < info->num_iovas; i++) {
-+        Range *range = g_new(Range, 1);
-+
-+        range_set_bounds(range, iova_ranges[i].start, iova_ranges[i].last);
-+        bcontainer->iova_ranges =
-+            range_list_insert(bcontainer->iova_ranges, range);
-+    }
-+    bcontainer->pgsizes = info->out_iova_alignment;
-+
-+    g_free(info);
-+    return 0;
-+
-+error:
-+    ret = -errno;
-+    g_free(info);
-+    error_setg_errno(errp, errno, "Cannot get IOVA ranges");
-+    return ret;
-+}
-+
- static int iommufd_cdev_attach(const char *name, VFIODevice *vbasedev,
-                                AddressSpace *as, Error **errp)
- {
-@@ -335,7 +382,14 @@ static int iommufd_cdev_attach(const char *name, VFIODevice *vbasedev,
-         goto err_discard_disable;
-     }
- 
--    bcontainer->pgsizes = qemu_real_host_page_size();
-+    ret = iommufd_cdev_get_info_iova_range(container, ioas_id, &err);
-+    if (ret) {
-+        error_append_hint(&err,
-+                   "Fallback to default 64bit IOVA range and 4K page size\n");
-+        warn_report_err(err);
-+        err = NULL;
-+        bcontainer->pgsizes = qemu_real_host_page_size();
-+    }
- 
-     bcontainer->listener = vfio_memory_listener;
-     memory_listener_register(&bcontainer->listener, bcontainer->space->as);
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-iommufd-Enable-pci-hot-reset-through-iommufd-cd.patch b/SOURCES/kvm-vfio-iommufd-Enable-pci-hot-reset-through-iommufd-cd.patch
deleted file mode 100644
index 48db196..0000000
--- a/SOURCES/kvm-vfio-iommufd-Enable-pci-hot-reset-through-iommufd-cd.patch
+++ /dev/null
@@ -1,215 +0,0 @@
-From e94700896dd8fcea149d9719eccde6f485440be2 Mon Sep 17 00:00:00 2001
-From: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Date: Tue, 21 Nov 2023 16:44:08 +0800
-Subject: [PATCH 029/101] vfio/iommufd: Enable pci hot reset through iommufd
- cdev interface
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [28/67] ca1ae970138ee4a6f4b3b49817e775f3159f4c97 (eauger1/centos-qemu-kvm)
-
-Implement the newly introduced pci_hot_reset callback named
-iommufd_cdev_pci_hot_reset to do iommufd specific check and
-reset operation.
-
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Tested-by: Eric Auger <eric.auger@redhat.com>
-Tested-by: Nicolin Chen <nicolinc@nvidia.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 96d6f85ff012abd7aaa35b1a2bc48b8640c898d9)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/iommufd.c    | 150 +++++++++++++++++++++++++++++++++++++++++++
- hw/vfio/trace-events |   1 +
- 2 files changed, 151 insertions(+)
-
-diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
-index 01b448e840..6e53e013ef 100644
---- a/hw/vfio/iommufd.c
-+++ b/hw/vfio/iommufd.c
-@@ -24,6 +24,7 @@
- #include "sysemu/reset.h"
- #include "qemu/cutils.h"
- #include "qemu/chardev_open.h"
-+#include "pci.h"
- 
- static int iommufd_cdev_map(VFIOContainerBase *bcontainer, hwaddr iova,
-                             ram_addr_t size, void *vaddr, bool readonly)
-@@ -468,9 +469,158 @@ static void iommufd_cdev_detach(VFIODevice *vbasedev)
-     close(vbasedev->fd);
- }
- 
-+static VFIODevice *iommufd_cdev_pci_find_by_devid(__u32 devid)
-+{
-+    VFIODevice *vbasedev_iter;
-+
-+    QLIST_FOREACH(vbasedev_iter, &vfio_device_list, global_next) {
-+        if (vbasedev_iter->bcontainer->ops != &vfio_iommufd_ops) {
-+            continue;
-+        }
-+        if (devid == vbasedev_iter->devid) {
-+            return vbasedev_iter;
-+        }
-+    }
-+    return NULL;
-+}
-+
-+static VFIOPCIDevice *
-+iommufd_cdev_dep_get_realized_vpdev(struct vfio_pci_dependent_device *dep_dev,
-+                                    VFIODevice *reset_dev)
-+{
-+    VFIODevice *vbasedev_tmp;
-+
-+    if (dep_dev->devid == reset_dev->devid ||
-+        dep_dev->devid == VFIO_PCI_DEVID_OWNED) {
-+        return NULL;
-+    }
-+
-+    vbasedev_tmp = iommufd_cdev_pci_find_by_devid(dep_dev->devid);
-+    if (!vbasedev_tmp || !vbasedev_tmp->dev->realized ||
-+        vbasedev_tmp->type != VFIO_DEVICE_TYPE_PCI) {
-+        return NULL;
-+    }
-+
-+    return container_of(vbasedev_tmp, VFIOPCIDevice, vbasedev);
-+}
-+
-+static int iommufd_cdev_pci_hot_reset(VFIODevice *vbasedev, bool single)
-+{
-+    VFIOPCIDevice *vdev = container_of(vbasedev, VFIOPCIDevice, vbasedev);
-+    struct vfio_pci_hot_reset_info *info = NULL;
-+    struct vfio_pci_dependent_device *devices;
-+    struct vfio_pci_hot_reset *reset;
-+    int ret, i;
-+    bool multi = false;
-+
-+    trace_vfio_pci_hot_reset(vdev->vbasedev.name, single ? "one" : "multi");
-+
-+    if (!single) {
-+        vfio_pci_pre_reset(vdev);
-+    }
-+    vdev->vbasedev.needs_reset = false;
-+
-+    ret = vfio_pci_get_pci_hot_reset_info(vdev, &info);
-+
-+    if (ret) {
-+        goto out_single;
-+    }
-+
-+    assert(info->flags & VFIO_PCI_HOT_RESET_FLAG_DEV_ID);
-+
-+    devices = &info->devices[0];
-+
-+    if (!(info->flags & VFIO_PCI_HOT_RESET_FLAG_DEV_ID_OWNED)) {
-+        if (!vdev->has_pm_reset) {
-+            for (i = 0; i < info->count; i++) {
-+                if (devices[i].devid == VFIO_PCI_DEVID_NOT_OWNED) {
-+                    error_report("vfio: Cannot reset device %s, "
-+                                 "depends on device %04x:%02x:%02x.%x "
-+                                 "which is not owned.",
-+                                 vdev->vbasedev.name, devices[i].segment,
-+                                 devices[i].bus, PCI_SLOT(devices[i].devfn),
-+                                 PCI_FUNC(devices[i].devfn));
-+                }
-+            }
-+        }
-+        ret = -EPERM;
-+        goto out_single;
-+    }
-+
-+    trace_vfio_pci_hot_reset_has_dep_devices(vdev->vbasedev.name);
-+
-+    for (i = 0; i < info->count; i++) {
-+        VFIOPCIDevice *tmp;
-+
-+        trace_iommufd_cdev_pci_hot_reset_dep_devices(devices[i].segment,
-+                                                     devices[i].bus,
-+                                                     PCI_SLOT(devices[i].devfn),
-+                                                     PCI_FUNC(devices[i].devfn),
-+                                                     devices[i].devid);
-+
-+        /*
-+         * If a VFIO cdev device is resettable, all the dependent devices
-+         * are either bound to same iommufd or within same iommu_groups as
-+         * one of the iommufd bound devices.
-+         */
-+        assert(devices[i].devid != VFIO_PCI_DEVID_NOT_OWNED);
-+
-+        tmp = iommufd_cdev_dep_get_realized_vpdev(&devices[i], &vdev->vbasedev);
-+        if (!tmp) {
-+            continue;
-+        }
-+
-+        if (single) {
-+            ret = -EINVAL;
-+            goto out_single;
-+        }
-+        vfio_pci_pre_reset(tmp);
-+        tmp->vbasedev.needs_reset = false;
-+        multi = true;
-+    }
-+
-+    if (!single && !multi) {
-+        ret = -EINVAL;
-+        goto out_single;
-+    }
-+
-+    /* Use zero length array for hot reset with iommufd backend */
-+    reset = g_malloc0(sizeof(*reset));
-+    reset->argsz = sizeof(*reset);
-+
-+     /* Bus reset! */
-+    ret = ioctl(vdev->vbasedev.fd, VFIO_DEVICE_PCI_HOT_RESET, reset);
-+    g_free(reset);
-+    if (ret) {
-+        ret = -errno;
-+    }
-+
-+    trace_vfio_pci_hot_reset_result(vdev->vbasedev.name,
-+                                    ret ? strerror(errno) : "Success");
-+
-+    /* Re-enable INTx on affected devices */
-+    for (i = 0; i < info->count; i++) {
-+        VFIOPCIDevice *tmp;
-+
-+        tmp = iommufd_cdev_dep_get_realized_vpdev(&devices[i], &vdev->vbasedev);
-+        if (!tmp) {
-+            continue;
-+        }
-+        vfio_pci_post_reset(tmp);
-+    }
-+out_single:
-+    if (!single) {
-+        vfio_pci_post_reset(vdev);
-+    }
-+    g_free(info);
-+
-+    return ret;
-+}
-+
- const VFIOIOMMUOps vfio_iommufd_ops = {
-     .dma_map = iommufd_cdev_map,
-     .dma_unmap = iommufd_cdev_unmap,
-     .attach_device = iommufd_cdev_attach,
-     .detach_device = iommufd_cdev_detach,
-+    .pci_hot_reset = iommufd_cdev_pci_hot_reset,
- };
-diff --git a/hw/vfio/trace-events b/hw/vfio/trace-events
-index 3340c93af0..8fdde54456 100644
---- a/hw/vfio/trace-events
-+++ b/hw/vfio/trace-events
-@@ -174,3 +174,4 @@ iommufd_cdev_detach_ioas_hwpt(int iommufd, const char *name) " [iommufd=%d] Succ
- iommufd_cdev_fail_attach_existing_container(const char *msg) " %s"
- iommufd_cdev_alloc_ioas(int iommufd, int ioas_id) " [iommufd=%d] new IOMMUFD container with ioasid=%d"
- iommufd_cdev_device_info(char *name, int devfd, int num_irqs, int num_regions, int flags) " %s (%d) num_irqs=%d num_regions=%d flags=%d"
-+iommufd_cdev_pci_hot_reset_dep_devices(int domain, int bus, int slot, int function, int dev_id) "\t%04x:%02x:%02x.%x devid %d"
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-iommufd-Implement-the-iommufd-backend.patch b/SOURCES/kvm-vfio-iommufd-Implement-the-iommufd-backend.patch
deleted file mode 100644
index f00cbcd..0000000
--- a/SOURCES/kvm-vfio-iommufd-Implement-the-iommufd-backend.patch
+++ /dev/null
@@ -1,561 +0,0 @@
-From f018d0b686406256c2b5e823e4227316ee1394e9 Mon Sep 17 00:00:00 2001
-From: Yi Liu <yi.l.liu@intel.com>
-Date: Tue, 21 Nov 2023 16:44:03 +0800
-Subject: [PATCH 024/101] vfio/iommufd: Implement the iommufd backend
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [23/67] d11046654117a690542a1e2b48b9d1994f778b2d (eauger1/centos-qemu-kvm)
-
-The iommufd backend is implemented based on the new /dev/iommu user API.
-This backend obviously depends on CONFIG_IOMMUFD.
-
-So far, the iommufd backend doesn't support dirty page sync yet.
-
-Co-authored-by: Eric Auger <eric.auger@redhat.com>
-Signed-off-by: Yi Liu <yi.l.liu@intel.com>
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Tested-by: Eric Auger <eric.auger@redhat.com>
-Tested-by: Nicolin Chen <nicolinc@nvidia.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 5ee3dc7af7859e7b8aa34c10c21778101c15e812)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/common.c              |   6 +
- hw/vfio/iommufd.c             | 422 ++++++++++++++++++++++++++++++++++
- hw/vfio/meson.build           |   3 +
- hw/vfio/trace-events          |  10 +
- include/hw/vfio/vfio-common.h |  11 +
- 5 files changed, 452 insertions(+)
- create mode 100644 hw/vfio/iommufd.c
-
-diff --git a/hw/vfio/common.c b/hw/vfio/common.c
-index 934f4f5446..6569732b7a 100644
---- a/hw/vfio/common.c
-+++ b/hw/vfio/common.c
-@@ -19,6 +19,7 @@
-  */
- 
- #include "qemu/osdep.h"
-+#include CONFIG_DEVICES /* CONFIG_IOMMUFD */
- #include <sys/ioctl.h>
- #ifdef CONFIG_KVM
- #include <linux/kvm.h>
-@@ -1503,6 +1504,11 @@ int vfio_attach_device(char *name, VFIODevice *vbasedev,
- {
-     const VFIOIOMMUOps *ops = &vfio_legacy_ops;
- 
-+#ifdef CONFIG_IOMMUFD
-+    if (vbasedev->iommufd) {
-+        ops = &vfio_iommufd_ops;
-+    }
-+#endif
-     return ops->attach_device(name, vbasedev, as, errp);
- }
- 
-diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
-new file mode 100644
-index 0000000000..6d31aeac7b
---- /dev/null
-+++ b/hw/vfio/iommufd.c
-@@ -0,0 +1,422 @@
-+/*
-+ * iommufd container backend
-+ *
-+ * Copyright (C) 2023 Intel Corporation.
-+ * Copyright Red Hat, Inc. 2023
-+ *
-+ * Authors: Yi Liu <yi.l.liu@intel.com>
-+ *          Eric Auger <eric.auger@redhat.com>
-+ *
-+ * SPDX-License-Identifier: GPL-2.0-or-later
-+ */
-+
-+#include "qemu/osdep.h"
-+#include <sys/ioctl.h>
-+#include <linux/vfio.h>
-+#include <linux/iommufd.h>
-+
-+#include "hw/vfio/vfio-common.h"
-+#include "qemu/error-report.h"
-+#include "trace.h"
-+#include "qapi/error.h"
-+#include "sysemu/iommufd.h"
-+#include "hw/qdev-core.h"
-+#include "sysemu/reset.h"
-+#include "qemu/cutils.h"
-+#include "qemu/chardev_open.h"
-+
-+static int iommufd_cdev_map(VFIOContainerBase *bcontainer, hwaddr iova,
-+                            ram_addr_t size, void *vaddr, bool readonly)
-+{
-+    VFIOIOMMUFDContainer *container =
-+        container_of(bcontainer, VFIOIOMMUFDContainer, bcontainer);
-+
-+    return iommufd_backend_map_dma(container->be,
-+                                   container->ioas_id,
-+                                   iova, size, vaddr, readonly);
-+}
-+
-+static int iommufd_cdev_unmap(VFIOContainerBase *bcontainer,
-+                              hwaddr iova, ram_addr_t size,
-+                              IOMMUTLBEntry *iotlb)
-+{
-+    VFIOIOMMUFDContainer *container =
-+        container_of(bcontainer, VFIOIOMMUFDContainer, bcontainer);
-+
-+    /* TODO: Handle dma_unmap_bitmap with iotlb args (migration) */
-+    return iommufd_backend_unmap_dma(container->be,
-+                                     container->ioas_id, iova, size);
-+}
-+
-+static int iommufd_cdev_kvm_device_add(VFIODevice *vbasedev, Error **errp)
-+{
-+    return vfio_kvm_device_add_fd(vbasedev->fd, errp);
-+}
-+
-+static void iommufd_cdev_kvm_device_del(VFIODevice *vbasedev)
-+{
-+    Error *err = NULL;
-+
-+    if (vfio_kvm_device_del_fd(vbasedev->fd, &err)) {
-+        error_report_err(err);
-+    }
-+}
-+
-+static int iommufd_cdev_connect_and_bind(VFIODevice *vbasedev, Error **errp)
-+{
-+    IOMMUFDBackend *iommufd = vbasedev->iommufd;
-+    struct vfio_device_bind_iommufd bind = {
-+        .argsz = sizeof(bind),
-+        .flags = 0,
-+    };
-+    int ret;
-+
-+    ret = iommufd_backend_connect(iommufd, errp);
-+    if (ret) {
-+        return ret;
-+    }
-+
-+    /*
-+     * Add device to kvm-vfio to be prepared for the tracking
-+     * in KVM. Especially for some emulated devices, it requires
-+     * to have kvm information in the device open.
-+     */
-+    ret = iommufd_cdev_kvm_device_add(vbasedev, errp);
-+    if (ret) {
-+        goto err_kvm_device_add;
-+    }
-+
-+    /* Bind device to iommufd */
-+    bind.iommufd = iommufd->fd;
-+    ret = ioctl(vbasedev->fd, VFIO_DEVICE_BIND_IOMMUFD, &bind);
-+    if (ret) {
-+        error_setg_errno(errp, errno, "error bind device fd=%d to iommufd=%d",
-+                         vbasedev->fd, bind.iommufd);
-+        goto err_bind;
-+    }
-+
-+    vbasedev->devid = bind.out_devid;
-+    trace_iommufd_cdev_connect_and_bind(bind.iommufd, vbasedev->name,
-+                                        vbasedev->fd, vbasedev->devid);
-+    return ret;
-+err_bind:
-+    iommufd_cdev_kvm_device_del(vbasedev);
-+err_kvm_device_add:
-+    iommufd_backend_disconnect(iommufd);
-+    return ret;
-+}
-+
-+static void iommufd_cdev_unbind_and_disconnect(VFIODevice *vbasedev)
-+{
-+    /* Unbind is automatically conducted when device fd is closed */
-+    iommufd_cdev_kvm_device_del(vbasedev);
-+    iommufd_backend_disconnect(vbasedev->iommufd);
-+}
-+
-+static int iommufd_cdev_getfd(const char *sysfs_path, Error **errp)
-+{
-+    long int ret = -ENOTTY;
-+    char *path, *vfio_dev_path = NULL, *vfio_path = NULL;
-+    DIR *dir = NULL;
-+    struct dirent *dent;
-+    gchar *contents;
-+    struct stat st;
-+    gsize length;
-+    int major, minor;
-+    dev_t vfio_devt;
-+
-+    path = g_strdup_printf("%s/vfio-dev", sysfs_path);
-+    if (stat(path, &st) < 0) {
-+        error_setg_errno(errp, errno, "no such host device");
-+        goto out_free_path;
-+    }
-+
-+    dir = opendir(path);
-+    if (!dir) {
-+        error_setg_errno(errp, errno, "couldn't open directory %s", path);
-+        goto out_free_path;
-+    }
-+
-+    while ((dent = readdir(dir))) {
-+        if (!strncmp(dent->d_name, "vfio", 4)) {
-+            vfio_dev_path = g_strdup_printf("%s/%s/dev", path, dent->d_name);
-+            break;
-+        }
-+    }
-+
-+    if (!vfio_dev_path) {
-+        error_setg(errp, "failed to find vfio-dev/vfioX/dev");
-+        goto out_close_dir;
-+    }
-+
-+    if (!g_file_get_contents(vfio_dev_path, &contents, &length, NULL)) {
-+        error_setg(errp, "failed to load \"%s\"", vfio_dev_path);
-+        goto out_free_dev_path;
-+    }
-+
-+    if (sscanf(contents, "%d:%d", &major, &minor) != 2) {
-+        error_setg(errp, "failed to get major:minor for \"%s\"", vfio_dev_path);
-+        goto out_free_dev_path;
-+    }
-+    g_free(contents);
-+    vfio_devt = makedev(major, minor);
-+
-+    vfio_path = g_strdup_printf("/dev/vfio/devices/%s", dent->d_name);
-+    ret = open_cdev(vfio_path, vfio_devt);
-+    if (ret < 0) {
-+        error_setg(errp, "Failed to open %s", vfio_path);
-+    }
-+
-+    trace_iommufd_cdev_getfd(vfio_path, ret);
-+    g_free(vfio_path);
-+
-+out_free_dev_path:
-+    g_free(vfio_dev_path);
-+out_close_dir:
-+    closedir(dir);
-+out_free_path:
-+    if (*errp) {
-+        error_prepend(errp, VFIO_MSG_PREFIX, path);
-+    }
-+    g_free(path);
-+
-+    return ret;
-+}
-+
-+static int iommufd_cdev_attach_ioas_hwpt(VFIODevice *vbasedev, uint32_t id,
-+                                         Error **errp)
-+{
-+    int ret, iommufd = vbasedev->iommufd->fd;
-+    struct vfio_device_attach_iommufd_pt attach_data = {
-+        .argsz = sizeof(attach_data),
-+        .flags = 0,
-+        .pt_id = id,
-+    };
-+
-+    /* Attach device to an IOAS or hwpt within iommufd */
-+    ret = ioctl(vbasedev->fd, VFIO_DEVICE_ATTACH_IOMMUFD_PT, &attach_data);
-+    if (ret) {
-+        error_setg_errno(errp, errno,
-+                         "[iommufd=%d] error attach %s (%d) to id=%d",
-+                         iommufd, vbasedev->name, vbasedev->fd, id);
-+    } else {
-+        trace_iommufd_cdev_attach_ioas_hwpt(iommufd, vbasedev->name,
-+                                            vbasedev->fd, id);
-+    }
-+    return ret;
-+}
-+
-+static int iommufd_cdev_detach_ioas_hwpt(VFIODevice *vbasedev, Error **errp)
-+{
-+    int ret, iommufd = vbasedev->iommufd->fd;
-+    struct vfio_device_detach_iommufd_pt detach_data = {
-+        .argsz = sizeof(detach_data),
-+        .flags = 0,
-+    };
-+
-+    ret = ioctl(vbasedev->fd, VFIO_DEVICE_DETACH_IOMMUFD_PT, &detach_data);
-+    if (ret) {
-+        error_setg_errno(errp, errno, "detach %s failed", vbasedev->name);
-+    } else {
-+        trace_iommufd_cdev_detach_ioas_hwpt(iommufd, vbasedev->name);
-+    }
-+    return ret;
-+}
-+
-+static int iommufd_cdev_attach_container(VFIODevice *vbasedev,
-+                                         VFIOIOMMUFDContainer *container,
-+                                         Error **errp)
-+{
-+    return iommufd_cdev_attach_ioas_hwpt(vbasedev, container->ioas_id, errp);
-+}
-+
-+static void iommufd_cdev_detach_container(VFIODevice *vbasedev,
-+                                          VFIOIOMMUFDContainer *container)
-+{
-+    Error *err = NULL;
-+
-+    if (iommufd_cdev_detach_ioas_hwpt(vbasedev, &err)) {
-+        error_report_err(err);
-+    }
-+}
-+
-+static void iommufd_cdev_container_destroy(VFIOIOMMUFDContainer *container)
-+{
-+    VFIOContainerBase *bcontainer = &container->bcontainer;
-+
-+    if (!QLIST_EMPTY(&bcontainer->device_list)) {
-+        return;
-+    }
-+    memory_listener_unregister(&bcontainer->listener);
-+    vfio_container_destroy(bcontainer);
-+    iommufd_backend_free_id(container->be, container->ioas_id);
-+    g_free(container);
-+}
-+
-+static int iommufd_cdev_ram_block_discard_disable(bool state)
-+{
-+    /*
-+     * We support coordinated discarding of RAM via the RamDiscardManager.
-+     */
-+    return ram_block_uncoordinated_discard_disable(state);
-+}
-+
-+static int iommufd_cdev_attach(const char *name, VFIODevice *vbasedev,
-+                               AddressSpace *as, Error **errp)
-+{
-+    VFIOContainerBase *bcontainer;
-+    VFIOIOMMUFDContainer *container;
-+    VFIOAddressSpace *space;
-+    struct vfio_device_info dev_info = { .argsz = sizeof(dev_info) };
-+    int ret, devfd;
-+    uint32_t ioas_id;
-+    Error *err = NULL;
-+
-+    devfd = iommufd_cdev_getfd(vbasedev->sysfsdev, errp);
-+    if (devfd < 0) {
-+        return devfd;
-+    }
-+    vbasedev->fd = devfd;
-+
-+    ret = iommufd_cdev_connect_and_bind(vbasedev, errp);
-+    if (ret) {
-+        goto err_connect_bind;
-+    }
-+
-+    space = vfio_get_address_space(as);
-+
-+    /* try to attach to an existing container in this space */
-+    QLIST_FOREACH(bcontainer, &space->containers, next) {
-+        container = container_of(bcontainer, VFIOIOMMUFDContainer, bcontainer);
-+        if (bcontainer->ops != &vfio_iommufd_ops ||
-+            vbasedev->iommufd != container->be) {
-+            continue;
-+        }
-+        if (iommufd_cdev_attach_container(vbasedev, container, &err)) {
-+            const char *msg = error_get_pretty(err);
-+
-+            trace_iommufd_cdev_fail_attach_existing_container(msg);
-+            error_free(err);
-+            err = NULL;
-+        } else {
-+            ret = iommufd_cdev_ram_block_discard_disable(true);
-+            if (ret) {
-+                error_setg(errp,
-+                              "Cannot set discarding of RAM broken (%d)", ret);
-+                goto err_discard_disable;
-+            }
-+            goto found_container;
-+        }
-+    }
-+
-+    /* Need to allocate a new dedicated container */
-+    ret = iommufd_backend_alloc_ioas(vbasedev->iommufd, &ioas_id, errp);
-+    if (ret < 0) {
-+        goto err_alloc_ioas;
-+    }
-+
-+    trace_iommufd_cdev_alloc_ioas(vbasedev->iommufd->fd, ioas_id);
-+
-+    container = g_malloc0(sizeof(*container));
-+    container->be = vbasedev->iommufd;
-+    container->ioas_id = ioas_id;
-+
-+    bcontainer = &container->bcontainer;
-+    vfio_container_init(bcontainer, space, &vfio_iommufd_ops);
-+    QLIST_INSERT_HEAD(&space->containers, bcontainer, next);
-+
-+    ret = iommufd_cdev_attach_container(vbasedev, container, errp);
-+    if (ret) {
-+        goto err_attach_container;
-+    }
-+
-+    ret = iommufd_cdev_ram_block_discard_disable(true);
-+    if (ret) {
-+        goto err_discard_disable;
-+    }
-+
-+    bcontainer->pgsizes = qemu_real_host_page_size();
-+
-+    bcontainer->listener = vfio_memory_listener;
-+    memory_listener_register(&bcontainer->listener, bcontainer->space->as);
-+
-+    if (bcontainer->error) {
-+        ret = -1;
-+        error_propagate_prepend(errp, bcontainer->error,
-+                                "memory listener initialization failed: ");
-+        goto err_listener_register;
-+    }
-+
-+    bcontainer->initialized = true;
-+
-+found_container:
-+    ret = ioctl(devfd, VFIO_DEVICE_GET_INFO, &dev_info);
-+    if (ret) {
-+        error_setg_errno(errp, errno, "error getting device info");
-+        goto err_listener_register;
-+    }
-+
-+    /*
-+     * TODO: examine RAM_BLOCK_DISCARD stuff, should we do group level
-+     * for discarding incompatibility check as well?
-+     */
-+    if (vbasedev->ram_block_discard_allowed) {
-+        iommufd_cdev_ram_block_discard_disable(false);
-+    }
-+
-+    vbasedev->group = 0;
-+    vbasedev->num_irqs = dev_info.num_irqs;
-+    vbasedev->num_regions = dev_info.num_regions;
-+    vbasedev->flags = dev_info.flags;
-+    vbasedev->reset_works = !!(dev_info.flags & VFIO_DEVICE_FLAGS_RESET);
-+    vbasedev->bcontainer = bcontainer;
-+    QLIST_INSERT_HEAD(&bcontainer->device_list, vbasedev, container_next);
-+    QLIST_INSERT_HEAD(&vfio_device_list, vbasedev, global_next);
-+
-+    trace_iommufd_cdev_device_info(vbasedev->name, devfd, vbasedev->num_irqs,
-+                                   vbasedev->num_regions, vbasedev->flags);
-+    return 0;
-+
-+err_listener_register:
-+    iommufd_cdev_ram_block_discard_disable(false);
-+err_discard_disable:
-+    iommufd_cdev_detach_container(vbasedev, container);
-+err_attach_container:
-+    iommufd_cdev_container_destroy(container);
-+err_alloc_ioas:
-+    vfio_put_address_space(space);
-+    iommufd_cdev_unbind_and_disconnect(vbasedev);
-+err_connect_bind:
-+    close(vbasedev->fd);
-+    return ret;
-+}
-+
-+static void iommufd_cdev_detach(VFIODevice *vbasedev)
-+{
-+    VFIOContainerBase *bcontainer = vbasedev->bcontainer;
-+    VFIOAddressSpace *space = bcontainer->space;
-+    VFIOIOMMUFDContainer *container = container_of(bcontainer,
-+                                                   VFIOIOMMUFDContainer,
-+                                                   bcontainer);
-+    QLIST_REMOVE(vbasedev, global_next);
-+    QLIST_REMOVE(vbasedev, container_next);
-+    vbasedev->bcontainer = NULL;
-+
-+    if (!vbasedev->ram_block_discard_allowed) {
-+        iommufd_cdev_ram_block_discard_disable(false);
-+    }
-+
-+    iommufd_cdev_detach_container(vbasedev, container);
-+    iommufd_cdev_container_destroy(container);
-+    vfio_put_address_space(space);
-+
-+    iommufd_cdev_unbind_and_disconnect(vbasedev);
-+    close(vbasedev->fd);
-+}
-+
-+const VFIOIOMMUOps vfio_iommufd_ops = {
-+    .dma_map = iommufd_cdev_map,
-+    .dma_unmap = iommufd_cdev_unmap,
-+    .attach_device = iommufd_cdev_attach,
-+    .detach_device = iommufd_cdev_detach,
-+};
-diff --git a/hw/vfio/meson.build b/hw/vfio/meson.build
-index eb6ce6229d..e5d98b6adc 100644
---- a/hw/vfio/meson.build
-+++ b/hw/vfio/meson.build
-@@ -7,6 +7,9 @@ vfio_ss.add(files(
-   'spapr.c',
-   'migration.c',
- ))
-+vfio_ss.add(when: 'CONFIG_IOMMUFD', if_true: files(
-+  'iommufd.c',
-+))
- vfio_ss.add(when: 'CONFIG_VFIO_PCI', if_true: files(
-   'display.c',
-   'pci-quirks.c',
-diff --git a/hw/vfio/trace-events b/hw/vfio/trace-events
-index 08a1f9dfa4..3340c93af0 100644
---- a/hw/vfio/trace-events
-+++ b/hw/vfio/trace-events
-@@ -164,3 +164,13 @@ vfio_state_pending_estimate(const char *name, uint64_t precopy, uint64_t postcop
- vfio_state_pending_exact(const char *name, uint64_t precopy, uint64_t postcopy, uint64_t stopcopy_size, uint64_t precopy_init_size, uint64_t precopy_dirty_size) " (%s) precopy 0x%"PRIx64" postcopy 0x%"PRIx64" stopcopy size 0x%"PRIx64" precopy initial size 0x%"PRIx64" precopy dirty size 0x%"PRIx64
- vfio_vmstate_change(const char *name, int running, const char *reason, const char *dev_state) " (%s) running %d reason %s device state %s"
- vfio_vmstate_change_prepare(const char *name, int running, const char *reason, const char *dev_state) " (%s) running %d reason %s device state %s"
-+
-+#iommufd.c
-+
-+iommufd_cdev_connect_and_bind(int iommufd, const char *name, int devfd, int devid) " [iommufd=%d] Successfully bound device %s (fd=%d): output devid=%d"
-+iommufd_cdev_getfd(const char *dev, int devfd) " %s (fd=%d)"
-+iommufd_cdev_attach_ioas_hwpt(int iommufd, const char *name, int devfd, int id) " [iommufd=%d] Successfully attached device %s (%d) to id=%d"
-+iommufd_cdev_detach_ioas_hwpt(int iommufd, const char *name) " [iommufd=%d] Successfully detached %s"
-+iommufd_cdev_fail_attach_existing_container(const char *msg) " %s"
-+iommufd_cdev_alloc_ioas(int iommufd, int ioas_id) " [iommufd=%d] new IOMMUFD container with ioasid=%d"
-+iommufd_cdev_device_info(char *name, int devfd, int num_irqs, int num_regions, int flags) " %s (%d) num_irqs=%d num_regions=%d flags=%d"
-diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
-index 24ecc0e7ee..3dac5c167e 100644
---- a/include/hw/vfio/vfio-common.h
-+++ b/include/hw/vfio/vfio-common.h
-@@ -89,6 +89,14 @@ typedef struct VFIOHostDMAWindow {
-     QLIST_ENTRY(VFIOHostDMAWindow) hostwin_next;
- } VFIOHostDMAWindow;
- 
-+typedef struct IOMMUFDBackend IOMMUFDBackend;
-+
-+typedef struct VFIOIOMMUFDContainer {
-+    VFIOContainerBase bcontainer;
-+    IOMMUFDBackend *be;
-+    uint32_t ioas_id;
-+} VFIOIOMMUFDContainer;
-+
- typedef struct VFIODeviceOps VFIODeviceOps;
- 
- typedef struct VFIODevice {
-@@ -116,6 +124,8 @@ typedef struct VFIODevice {
-     OnOffAuto pre_copy_dirty_page_tracking;
-     bool dirty_pages_supported;
-     bool dirty_tracking;
-+    int devid;
-+    IOMMUFDBackend *iommufd;
- } VFIODevice;
- 
- struct VFIODeviceOps {
-@@ -201,6 +211,7 @@ typedef QLIST_HEAD(VFIODeviceList, VFIODevice) VFIODeviceList;
- extern VFIOGroupList vfio_group_list;
- extern VFIODeviceList vfio_device_list;
- extern const VFIOIOMMUOps vfio_legacy_ops;
-+extern const VFIOIOMMUOps vfio_iommufd_ops;
- extern const MemoryListener vfio_memory_listener;
- extern int vfio_kvm_device_fd;
- 
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-iommufd-Introduce-a-VFIOIOMMU-iommufd-QOM-inter.patch b/SOURCES/kvm-vfio-iommufd-Introduce-a-VFIOIOMMU-iommufd-QOM-inter.patch
deleted file mode 100644
index 866a437..0000000
--- a/SOURCES/kvm-vfio-iommufd-Introduce-a-VFIOIOMMU-iommufd-QOM-inter.patch
+++ /dev/null
@@ -1,155 +0,0 @@
-From f98defd6fe081bc44f5bd823d187d7d3b12832ac Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
-Date: Tue, 19 Dec 2023 07:58:23 +0100
-Subject: [PATCH 056/101] vfio/iommufd: Introduce a VFIOIOMMU iommufd QOM
- interface
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [55/67] 789ecf74ace326b0df5d494fd558d7d0b6294a85 (eauger1/centos-qemu-kvm)
-
-As previously done for the sPAPR and legacy IOMMU backends, convert
-the VFIOIOMMUOps struct to a QOM interface. The set of of operations
-for this backend can be referenced with a literal typename instead of
-a C struct.
-
-Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Tested-by: Eric Farman <farman@linux.ibm.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit ce5f6d49f5845c3b9955cc377a5223c3f8d7ba1e)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/common.c                      |  2 +-
- hw/vfio/iommufd.c                     | 35 ++++++++++++++++++++-------
- include/hw/vfio/vfio-common.h         |  1 -
- include/hw/vfio/vfio-container-base.h |  2 +-
- 4 files changed, 28 insertions(+), 12 deletions(-)
-
-diff --git a/hw/vfio/common.c b/hw/vfio/common.c
-index 2329d0efc8..89ff1c7aed 100644
---- a/hw/vfio/common.c
-+++ b/hw/vfio/common.c
-@@ -1508,7 +1508,7 @@ int vfio_attach_device(char *name, VFIODevice *vbasedev,
- 
- #ifdef CONFIG_IOMMUFD
-     if (vbasedev->iommufd) {
--        ops = &vfio_iommufd_ops;
-+        ops = VFIO_IOMMU_CLASS(object_class_by_name(TYPE_VFIO_IOMMU_IOMMUFD));
-     }
- #endif
- 
-diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
-index 87a561c545..d4c586e842 100644
---- a/hw/vfio/iommufd.c
-+++ b/hw/vfio/iommufd.c
-@@ -319,6 +319,8 @@ static int iommufd_cdev_attach(const char *name, VFIODevice *vbasedev,
-     int ret, devfd;
-     uint32_t ioas_id;
-     Error *err = NULL;
-+    const VFIOIOMMUClass *iommufd_vioc =
-+        VFIO_IOMMU_CLASS(object_class_by_name(TYPE_VFIO_IOMMU_IOMMUFD));
- 
-     if (vbasedev->fd < 0) {
-         devfd = iommufd_cdev_getfd(vbasedev->sysfsdev, errp);
-@@ -340,7 +342,7 @@ static int iommufd_cdev_attach(const char *name, VFIODevice *vbasedev,
-     /* try to attach to an existing container in this space */
-     QLIST_FOREACH(bcontainer, &space->containers, next) {
-         container = container_of(bcontainer, VFIOIOMMUFDContainer, bcontainer);
--        if (bcontainer->ops != &vfio_iommufd_ops ||
-+        if (bcontainer->ops != iommufd_vioc ||
-             vbasedev->iommufd != container->be) {
-             continue;
-         }
-@@ -374,7 +376,7 @@ static int iommufd_cdev_attach(const char *name, VFIODevice *vbasedev,
-     container->ioas_id = ioas_id;
- 
-     bcontainer = &container->bcontainer;
--    vfio_container_init(bcontainer, space, &vfio_iommufd_ops);
-+    vfio_container_init(bcontainer, space, iommufd_vioc);
-     QLIST_INSERT_HEAD(&space->containers, bcontainer, next);
- 
-     ret = iommufd_cdev_attach_container(vbasedev, container, errp);
-@@ -476,9 +478,11 @@ static void iommufd_cdev_detach(VFIODevice *vbasedev)
- static VFIODevice *iommufd_cdev_pci_find_by_devid(__u32 devid)
- {
-     VFIODevice *vbasedev_iter;
-+    const VFIOIOMMUClass *iommufd_vioc =
-+        VFIO_IOMMU_CLASS(object_class_by_name(TYPE_VFIO_IOMMU_IOMMUFD));
- 
-     QLIST_FOREACH(vbasedev_iter, &vfio_device_list, global_next) {
--        if (vbasedev_iter->bcontainer->ops != &vfio_iommufd_ops) {
-+        if (vbasedev_iter->bcontainer->ops != iommufd_vioc) {
-             continue;
-         }
-         if (devid == vbasedev_iter->devid) {
-@@ -621,10 +625,23 @@ out_single:
-     return ret;
- }
- 
--const VFIOIOMMUOps vfio_iommufd_ops = {
--    .dma_map = iommufd_cdev_map,
--    .dma_unmap = iommufd_cdev_unmap,
--    .attach_device = iommufd_cdev_attach,
--    .detach_device = iommufd_cdev_detach,
--    .pci_hot_reset = iommufd_cdev_pci_hot_reset,
-+static void vfio_iommu_iommufd_class_init(ObjectClass *klass, void *data)
-+{
-+    VFIOIOMMUClass *vioc = VFIO_IOMMU_CLASS(klass);
-+
-+    vioc->dma_map = iommufd_cdev_map;
-+    vioc->dma_unmap = iommufd_cdev_unmap;
-+    vioc->attach_device = iommufd_cdev_attach;
-+    vioc->detach_device = iommufd_cdev_detach;
-+    vioc->pci_hot_reset = iommufd_cdev_pci_hot_reset;
- };
-+
-+static const TypeInfo types[] = {
-+    {
-+        .name = TYPE_VFIO_IOMMU_IOMMUFD,
-+        .parent = TYPE_VFIO_IOMMU,
-+        .class_init = vfio_iommu_iommufd_class_init,
-+    },
-+};
-+
-+DEFINE_TYPES(types)
-diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
-index 14c497b6b0..9b7ef7d02b 100644
---- a/include/hw/vfio/vfio-common.h
-+++ b/include/hw/vfio/vfio-common.h
-@@ -210,7 +210,6 @@ typedef QLIST_HEAD(VFIOGroupList, VFIOGroup) VFIOGroupList;
- typedef QLIST_HEAD(VFIODeviceList, VFIODevice) VFIODeviceList;
- extern VFIOGroupList vfio_group_list;
- extern VFIODeviceList vfio_device_list;
--extern const VFIOIOMMUOps vfio_iommufd_ops;
- extern const MemoryListener vfio_memory_listener;
- extern int vfio_kvm_device_fd;
- 
-diff --git a/include/hw/vfio/vfio-container-base.h b/include/hw/vfio/vfio-container-base.h
-index 9e21d7811f..b2813b0c11 100644
---- a/include/hw/vfio/vfio-container-base.h
-+++ b/include/hw/vfio/vfio-container-base.h
-@@ -17,7 +17,6 @@
- 
- typedef struct VFIODevice VFIODevice;
- typedef struct VFIOIOMMUClass VFIOIOMMUClass;
--#define VFIOIOMMUOps VFIOIOMMUClass /* To remove */
- 
- typedef struct {
-     unsigned long *bitmap;
-@@ -96,6 +95,7 @@ void vfio_container_destroy(VFIOContainerBase *bcontainer);
- #define TYPE_VFIO_IOMMU "vfio-iommu"
- #define TYPE_VFIO_IOMMU_LEGACY TYPE_VFIO_IOMMU "-legacy"
- #define TYPE_VFIO_IOMMU_SPAPR TYPE_VFIO_IOMMU "-spapr"
-+#define TYPE_VFIO_IOMMU_IOMMUFD TYPE_VFIO_IOMMU "-iommufd"
- 
- /*
-  * VFIOContainerBase is not an abstract QOM object because it felt
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-iommufd-Relax-assert-check-for-iommufd-backend.patch b/SOURCES/kvm-vfio-iommufd-Relax-assert-check-for-iommufd-backend.patch
deleted file mode 100644
index f77032b..0000000
--- a/SOURCES/kvm-vfio-iommufd-Relax-assert-check-for-iommufd-backend.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-From 5a49c5bb690d55fc88b6fb12f059ae932de0a716 Mon Sep 17 00:00:00 2001
-From: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Date: Tue, 21 Nov 2023 16:44:04 +0800
-Subject: [PATCH 025/101] vfio/iommufd: Relax assert check for iommufd backend
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [24/67] 2c9e41e9ca0b67ebf807d1643a98866a0cb75768 (eauger1/centos-qemu-kvm)
-
-Currently iommufd doesn't support dirty page sync yet,
-but it will not block us doing live migration if VFIO
-migration is force enabled.
-
-So in this case we allow set_dirty_page_tracking to be NULL.
-Note we don't need same change for query_dirty_bitmap because
-when dirty page sync isn't supported, query_dirty_bitmap will
-never be called.
-
-Suggested-by: Cédric Le Goater <clg@redhat.com>
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Tested-by: Eric Auger <eric.auger@redhat.com>
-Tested-by: Nicolin Chen <nicolinc@nvidia.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 36e84d0c17102fa1c887d8c650a13ec08fca0ec0)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/container-base.c | 4 ++++
- hw/vfio/container.c      | 4 ----
- 2 files changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/hw/vfio/container-base.c b/hw/vfio/container-base.c
-index 71f7274973..eee2dcfe76 100644
---- a/hw/vfio/container-base.c
-+++ b/hw/vfio/container-base.c
-@@ -55,6 +55,10 @@ void vfio_container_del_section_window(VFIOContainerBase *bcontainer,
- int vfio_container_set_dirty_page_tracking(VFIOContainerBase *bcontainer,
-                                            bool start)
- {
-+    if (!bcontainer->dirty_pages_supported) {
-+        return 0;
-+    }
-+
-     g_assert(bcontainer->ops->set_dirty_page_tracking);
-     return bcontainer->ops->set_dirty_page_tracking(bcontainer, start);
- }
-diff --git a/hw/vfio/container.c b/hw/vfio/container.c
-index 6bacf38222..ed2d721b2b 100644
---- a/hw/vfio/container.c
-+++ b/hw/vfio/container.c
-@@ -216,10 +216,6 @@ static int vfio_legacy_set_dirty_page_tracking(VFIOContainerBase *bcontainer,
-         .argsz = sizeof(dirty),
-     };
- 
--    if (!bcontainer->dirty_pages_supported) {
--        return 0;
--    }
--
-     if (start) {
-         dirty.flags = VFIO_IOMMU_DIRTY_PAGES_FLAG_START;
-     } else {
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-iommufd-Remove-CONFIG_IOMMUFD-usage.patch b/SOURCES/kvm-vfio-iommufd-Remove-CONFIG_IOMMUFD-usage.patch
deleted file mode 100644
index 97d30c9..0000000
--- a/SOURCES/kvm-vfio-iommufd-Remove-CONFIG_IOMMUFD-usage.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From 5549bf1b2e07213c23e280a43ab2ab67d5b7304a Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
-Date: Tue, 19 Dec 2023 07:58:25 +0100
-Subject: [PATCH 058/101] vfio/iommufd: Remove CONFIG_IOMMUFD usage
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [57/67] 3a6a45d379241d9412e0b8bcfeb9be0b4add59a5 (eauger1/centos-qemu-kvm)
-
-Availability of the IOMMUFD backend can now be fully determined at
-runtime and the ifdef check was a build time protection (for PPC not
-supporting it mostly).
-
-Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Tested-by: Eric Farman <farman@linux.ibm.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit c1139fa4feba8c320e4bd0a4e34af55caa5ffbb9)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/common.c | 3 ---
- 1 file changed, 3 deletions(-)
-
-diff --git a/hw/vfio/common.c b/hw/vfio/common.c
-index 89ff1c7aed..0d4d8b8416 100644
---- a/hw/vfio/common.c
-+++ b/hw/vfio/common.c
-@@ -19,7 +19,6 @@
-  */
- 
- #include "qemu/osdep.h"
--#include CONFIG_DEVICES /* CONFIG_IOMMUFD */
- #include <sys/ioctl.h>
- #ifdef CONFIG_KVM
- #include <linux/kvm.h>
-@@ -1506,11 +1505,9 @@ int vfio_attach_device(char *name, VFIODevice *vbasedev,
-     const VFIOIOMMUClass *ops =
-         VFIO_IOMMU_CLASS(object_class_by_name(TYPE_VFIO_IOMMU_LEGACY));
- 
--#ifdef CONFIG_IOMMUFD
-     if (vbasedev->iommufd) {
-         ops = VFIO_IOMMU_CLASS(object_class_by_name(TYPE_VFIO_IOMMU_IOMMUFD));
-     }
--#endif
- 
-     assert(ops);
- 
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-iommufd-Remove-the-use-of-stat-to-check-file-ex.patch b/SOURCES/kvm-vfio-iommufd-Remove-the-use-of-stat-to-check-file-ex.patch
deleted file mode 100644
index 7401d52..0000000
--- a/SOURCES/kvm-vfio-iommufd-Remove-the-use-of-stat-to-check-file-ex.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From 6b36dc2a305af856af03aad2e315eea96a349153 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
-Date: Thu, 21 Dec 2023 09:09:57 +0100
-Subject: [PATCH 061/101] vfio/iommufd: Remove the use of stat() to check file
- existence
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [60/67] 485770e45c1a6399780939bfb8b01b615d9213c6 (eauger1/centos-qemu-kvm)
-
-Using stat() before opening a file or a directory can lead to a
-time-of-check to time-of-use (TOCTOU) filesystem race, which is
-reported by coverity as a Security best practices violations. The
-sequence could be replaced by open and fdopendir but it doesn't add
-much in this case. Simply use opendir to avoid the race.
-
-Fixes: CID 1531551
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-Reviewed-by: Zhenzhong Duan <Zhenzhong.duan@intel.com>
-(cherry picked from commit 6ba254801f6bc7f3ef68a6414f1b107237c7eb26)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/iommufd.c | 6 ------
- 1 file changed, 6 deletions(-)
-
-diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
-index d4c586e842..9bfddc1360 100644
---- a/hw/vfio/iommufd.c
-+++ b/hw/vfio/iommufd.c
-@@ -121,17 +121,11 @@ static int iommufd_cdev_getfd(const char *sysfs_path, Error **errp)
-     DIR *dir = NULL;
-     struct dirent *dent;
-     gchar *contents;
--    struct stat st;
-     gsize length;
-     int major, minor;
-     dev_t vfio_devt;
- 
-     path = g_strdup_printf("%s/vfio-dev", sysfs_path);
--    if (stat(path, &st) < 0) {
--        error_setg_errno(errp, errno, "no such host device");
--        goto out_free_path;
--    }
--
-     dir = opendir(path);
-     if (!dir) {
-         error_setg_errno(errp, errno, "couldn't open directory %s", path);
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-migration-Add-helper-function-to-set-state-or-r.patch b/SOURCES/kvm-vfio-migration-Add-helper-function-to-set-state-or-r.patch
deleted file mode 100644
index 6556a19..0000000
--- a/SOURCES/kvm-vfio-migration-Add-helper-function-to-set-state-or-r.patch
+++ /dev/null
@@ -1,115 +0,0 @@
-From 0c0435e7210b99a6bf7b8f8205f7af8277b7525b Mon Sep 17 00:00:00 2001
-From: Avihai Horon <avihaih@nvidia.com>
-Date: Sun, 31 Dec 2023 12:48:18 +0200
-Subject: [PATCH 063/101] vfio/migration: Add helper function to set state or
- reset device
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [62/67] 1a63eea289561a05a6a8527c2a9da0289a7836d9 (eauger1/centos-qemu-kvm)
-
-There are several places where failure in setting the device state leads
-to a device reset, which is done by setting ERROR as the recover state.
-
-Add a helper function that sets the device state and resets the device
-in case of failure. This will make the code cleaner and remove duplicate
-comments.
-
-Signed-off-by: Avihai Horon <avihaih@nvidia.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-(cherry picked from commit c817e5a377a334241eed149e35760aca58bdeb34)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/migration.c | 41 +++++++++++++++++------------------------
- 1 file changed, 17 insertions(+), 24 deletions(-)
-
-diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
-index 28d422b39f..70e6b1a709 100644
---- a/hw/vfio/migration.c
-+++ b/hw/vfio/migration.c
-@@ -163,6 +163,19 @@ reset_device:
-     return ret;
- }
- 
-+/*
-+ * Some device state transitions require resetting the device if they fail.
-+ * This function sets the device in new_state and resets the device if that
-+ * fails. Reset is done by using ERROR as the recover state.
-+ */
-+static int
-+vfio_migration_set_state_or_reset(VFIODevice *vbasedev,
-+                                  enum vfio_device_mig_state new_state)
-+{
-+    return vfio_migration_set_state(vbasedev, new_state,
-+                                    VFIO_DEVICE_STATE_ERROR);
-+}
-+
- static int vfio_load_buffer(QEMUFile *f, VFIODevice *vbasedev,
-                             uint64_t data_size)
- {
-@@ -422,12 +435,7 @@ static void vfio_save_cleanup(void *opaque)
-      * after migration has completed, so it won't increase downtime.
-      */
-     if (migration->device_state == VFIO_DEVICE_STATE_STOP_COPY) {
--        /*
--         * If setting the device in STOP state fails, the device should be
--         * reset. To do so, use ERROR state as a recover state.
--         */
--        vfio_migration_set_state(vbasedev, VFIO_DEVICE_STATE_STOP,
--                                 VFIO_DEVICE_STATE_ERROR);
-+        vfio_migration_set_state_or_reset(vbasedev, VFIO_DEVICE_STATE_STOP);
-     }
- 
-     g_free(migration->data_buffer);
-@@ -699,12 +707,7 @@ static void vfio_vmstate_change_prepare(void *opaque, bool running,
-                     VFIO_DEVICE_STATE_PRE_COPY_P2P :
-                     VFIO_DEVICE_STATE_RUNNING_P2P;
- 
--    /*
--     * If setting the device in new_state fails, the device should be reset.
--     * To do so, use ERROR state as a recover state.
--     */
--    ret = vfio_migration_set_state(vbasedev, new_state,
--                                   VFIO_DEVICE_STATE_ERROR);
-+    ret = vfio_migration_set_state_or_reset(vbasedev, new_state);
-     if (ret) {
-         /*
-          * Migration should be aborted in this case, but vm_state_notify()
-@@ -736,12 +739,7 @@ static void vfio_vmstate_change(void *opaque, bool running, RunState state)
-                 VFIO_DEVICE_STATE_STOP;
-     }
- 
--    /*
--     * If setting the device in new_state fails, the device should be reset.
--     * To do so, use ERROR state as a recover state.
--     */
--    ret = vfio_migration_set_state(vbasedev, new_state,
--                                   VFIO_DEVICE_STATE_ERROR);
-+    ret = vfio_migration_set_state_or_reset(vbasedev, new_state);
-     if (ret) {
-         /*
-          * Migration should be aborted in this case, but vm_state_notify()
-@@ -770,12 +768,7 @@ static void vfio_migration_state_notifier(Notifier *notifier, void *data)
-     case MIGRATION_STATUS_CANCELLING:
-     case MIGRATION_STATUS_CANCELLED:
-     case MIGRATION_STATUS_FAILED:
--        /*
--         * If setting the device in RUNNING state fails, the device should
--         * be reset. To do so, use ERROR state as a recover state.
--         */
--        vfio_migration_set_state(vbasedev, VFIO_DEVICE_STATE_RUNNING,
--                                 VFIO_DEVICE_STATE_ERROR);
-+        vfio_migration_set_state_or_reset(vbasedev, VFIO_DEVICE_STATE_RUNNING);
-     }
- }
- 
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-pci-Allow-the-selection-of-a-given-iommu-backen.patch b/SOURCES/kvm-vfio-pci-Allow-the-selection-of-a-given-iommu-backen.patch
deleted file mode 100644
index f79de18..0000000
--- a/SOURCES/kvm-vfio-pci-Allow-the-selection-of-a-given-iommu-backen.patch
+++ /dev/null
@@ -1,81 +0,0 @@
-From 7788fdc2375e01ead0c8a705c3b3d7467dd93d67 Mon Sep 17 00:00:00 2001
-From: Eric Auger <eric.auger@redhat.com>
-Date: Tue, 21 Nov 2023 16:44:09 +0800
-Subject: [PATCH 030/101] vfio/pci: Allow the selection of a given iommu
- backend
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [29/67] 363c62607a11093ea0062489e11a708117d8ffb9 (eauger1/centos-qemu-kvm)
-
-Now we support two types of iommu backends, let's add the capability
-to select one of them. This depends on whether an iommufd object has
-been linked with the vfio-pci device:
-
-If the user wants to use the legacy backend, it shall not
-link the vfio-pci device with any iommufd object:
-
- -device vfio-pci,host=0000:02:00.0
-
-This is called the legacy mode/backend.
-
-If the user wants to use the iommufd backend (/dev/iommu) it
-shall pass an iommufd object id in the vfio-pci device options:
-
- -object iommufd,id=iommufd0
- -device vfio-pci,host=0000:02:00.0,iommufd=iommufd0
-
-Suggested-by: Alex Williamson <alex.williamson@redhat.com>
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
-Signed-off-by: Yi Liu <yi.l.liu@intel.com>
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Tested-by: Eric Auger <eric.auger@redhat.com>
-Tested-by: Nicolin Chen <nicolinc@nvidia.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit ee42b261b0a2e465ae003ddcaf1caf117c201f74)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/pci.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
-index 83b2561908..39e6a6678e 100644
---- a/hw/vfio/pci.c
-+++ b/hw/vfio/pci.c
-@@ -19,6 +19,7 @@
-  */
- 
- #include "qemu/osdep.h"
-+#include CONFIG_DEVICES /* CONFIG_IOMMUFD */
- #include <linux/vfio.h>
- #include <sys/ioctl.h>
- 
-@@ -42,6 +43,7 @@
- #include "qapi/error.h"
- #include "migration/blocker.h"
- #include "migration/qemu-file.h"
-+#include "sysemu/iommufd.h"
- 
- #define TYPE_VFIO_PCI_NOHOTPLUG "vfio-pci-nohotplug"
- 
-@@ -3415,6 +3417,10 @@ static Property vfio_pci_dev_properties[] = {
-      * DEFINE_PROP_STRING("vfiofd", VFIOPCIDevice, vfiofd_name),
-      * DEFINE_PROP_STRING("vfiogroupfd, VFIOPCIDevice, vfiogroupfd_name),
-      */
-+#ifdef CONFIG_IOMMUFD
-+    DEFINE_PROP_LINK("iommufd", VFIOPCIDevice, vbasedev.iommufd,
-+                     TYPE_IOMMUFD_BACKEND, IOMMUFDBackend *),
-+#endif
-     DEFINE_PROP_END_OF_LIST(),
- };
- 
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-pci-Clear-MSI-X-IRQ-index-always.patch b/SOURCES/kvm-vfio-pci-Clear-MSI-X-IRQ-index-always.patch
deleted file mode 100644
index 837e490..0000000
--- a/SOURCES/kvm-vfio-pci-Clear-MSI-X-IRQ-index-always.patch
+++ /dev/null
@@ -1,69 +0,0 @@
-From 43236995e8ad336d366b625fb8362046be53fc34 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
-Date: Mon, 29 Jan 2024 09:46:34 +0100
-Subject: [PATCH] vfio/pci: Clear MSI-X IRQ index always
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Cédric Le Goater <clg@redhat.com>
-RH-MergeRequest: 218: vfio/pci: Clear MSI-X IRQ index always
-RH-Jira: RHEL-21293
-RH-Acked-by: Eric Auger <eric.auger@redhat.com>
-RH-Acked-by: Alex Williamson <None>
-RH-Commit: [1/1] b4b587b13c11e350d3e5fcc11ba66a006b25a763 (clegoate/qemu-kvm-c9s)
-
-JIRA: https://issues.redhat.com/browse/RHEL-21293
-
-commit d2b668fca5652760b435ce812a743bba03d2f316
-Author: Cédric Le Goater <clg@redhat.com>
-Date:   Thu Jan 25 14:27:36 2024 +0100
-
-    vfio/pci: Clear MSI-X IRQ index always
-
-    When doing device assignment of a physical device, MSI-X can be
-    enabled with no vectors enabled and this sets the IRQ index to
-    VFIO_PCI_MSIX_IRQ_INDEX. However, when MSI-X is disabled, the IRQ
-    index is left untouched if no vectors are in use. Then, when INTx
-    is enabled, the IRQ index value is considered incompatible (set to
-    MSI-X) and VFIO_DEVICE_SET_IRQS fails. QEMU complains with :
-
-    qemu-system-x86_64: vfio 0000:08:00.0: Failed to set up TRIGGER eventfd signaling for interrupt INTX-0: VFIO_DEVICE_SET_IRQS failure: Invalid argument
-
-    To avoid that, unconditionaly clear the IRQ index when MSI-X is
-    disabled.
-
-    Buglink: https://issues.redhat.com/browse/RHEL-21293
-    Fixes: 5ebffa4e87e7 ("vfio/pci: use an invalid fd to enable MSI-X")
-    Cc: Jing Liu <jing2.liu@intel.com>
-    Cc: Alex Williamson <alex.williamson@redhat.com>
-    Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
-    Signed-off-by: Cédric Le Goater <clg@redhat.com>
-
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
----
- hw/vfio/pci.c | 8 +++++---
- 1 file changed, 5 insertions(+), 3 deletions(-)
-
-diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
-index adb7c09367..29bb8067eb 100644
---- a/hw/vfio/pci.c
-+++ b/hw/vfio/pci.c
-@@ -829,9 +829,11 @@ static void vfio_msix_disable(VFIOPCIDevice *vdev)
-         }
-     }
- 
--    if (vdev->nr_vectors) {
--        vfio_disable_irqindex(&vdev->vbasedev, VFIO_PCI_MSIX_IRQ_INDEX);
--    }
-+    /*
-+     * Always clear MSI-X IRQ index. A PF device could have enabled
-+     * MSI-X with no vectors. See vfio_msix_enable().
-+     */
-+    vfio_disable_irqindex(&vdev->vbasedev, VFIO_PCI_MSIX_IRQ_INDEX);
- 
-     vfio_msi_disable_common(vdev);
-     vfio_intx_enable(vdev, &err);
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-pci-Extract-out-a-helper-vfio_pci_get_pci_hot_r.patch b/SOURCES/kvm-vfio-pci-Extract-out-a-helper-vfio_pci_get_pci_hot_r.patch
deleted file mode 100644
index af6593c..0000000
--- a/SOURCES/kvm-vfio-pci-Extract-out-a-helper-vfio_pci_get_pci_hot_r.patch
+++ /dev/null
@@ -1,139 +0,0 @@
-From fe5ecedd452754eeb238b23eb0544ed3c5086157 Mon Sep 17 00:00:00 2001
-From: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Date: Tue, 21 Nov 2023 16:44:06 +0800
-Subject: [PATCH 027/101] vfio/pci: Extract out a helper
- vfio_pci_get_pci_hot_reset_info
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [26/67] 730b7f1496f4f21310fa13c79cb87f8d5e2ad2a8 (eauger1/centos-qemu-kvm)
-
-This helper will be used by both legacy and iommufd backends.
-
-No functional changes intended.
-
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Tested-by: Eric Auger <eric.auger@redhat.com>
-Tested-by: Nicolin Chen <nicolinc@nvidia.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 4d36ec23a75eb387492f4d68ff1b8eeee5d68142)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/pci.c | 54 +++++++++++++++++++++++++++++++++++----------------
- hw/vfio/pci.h |  3 +++
- 2 files changed, 40 insertions(+), 17 deletions(-)
-
-diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
-index ec98080f28..b482e5479f 100644
---- a/hw/vfio/pci.c
-+++ b/hw/vfio/pci.c
-@@ -2448,22 +2448,13 @@ static bool vfio_pci_host_match(PCIHostDeviceAddress *addr, const char *name)
-     return (strcmp(tmp, name) == 0);
- }
- 
--static int vfio_pci_hot_reset(VFIOPCIDevice *vdev, bool single)
-+int vfio_pci_get_pci_hot_reset_info(VFIOPCIDevice *vdev,
-+                                    struct vfio_pci_hot_reset_info **info_p)
- {
--    VFIOGroup *group;
-     struct vfio_pci_hot_reset_info *info;
--    struct vfio_pci_dependent_device *devices;
--    struct vfio_pci_hot_reset *reset;
--    int32_t *fds;
--    int ret, i, count;
--    bool multi = false;
-+    int ret, count;
- 
--    trace_vfio_pci_hot_reset(vdev->vbasedev.name, single ? "one" : "multi");
--
--    if (!single) {
--        vfio_pci_pre_reset(vdev);
--    }
--    vdev->vbasedev.needs_reset = false;
-+    assert(info_p && !*info_p);
- 
-     info = g_malloc0(sizeof(*info));
-     info->argsz = sizeof(*info);
-@@ -2471,24 +2462,53 @@ static int vfio_pci_hot_reset(VFIOPCIDevice *vdev, bool single)
-     ret = ioctl(vdev->vbasedev.fd, VFIO_DEVICE_GET_PCI_HOT_RESET_INFO, info);
-     if (ret && errno != ENOSPC) {
-         ret = -errno;
-+        g_free(info);
-         if (!vdev->has_pm_reset) {
-             error_report("vfio: Cannot reset device %s, "
-                          "no available reset mechanism.", vdev->vbasedev.name);
-         }
--        goto out_single;
-+        return ret;
-     }
- 
-     count = info->count;
--    info = g_realloc(info, sizeof(*info) + (count * sizeof(*devices)));
--    info->argsz = sizeof(*info) + (count * sizeof(*devices));
--    devices = &info->devices[0];
-+    info = g_realloc(info, sizeof(*info) + (count * sizeof(info->devices[0])));
-+    info->argsz = sizeof(*info) + (count * sizeof(info->devices[0]));
- 
-     ret = ioctl(vdev->vbasedev.fd, VFIO_DEVICE_GET_PCI_HOT_RESET_INFO, info);
-     if (ret) {
-         ret = -errno;
-+        g_free(info);
-         error_report("vfio: hot reset info failed: %m");
-+        return ret;
-+    }
-+
-+    *info_p = info;
-+    return 0;
-+}
-+
-+static int vfio_pci_hot_reset(VFIOPCIDevice *vdev, bool single)
-+{
-+    VFIOGroup *group;
-+    struct vfio_pci_hot_reset_info *info = NULL;
-+    struct vfio_pci_dependent_device *devices;
-+    struct vfio_pci_hot_reset *reset;
-+    int32_t *fds;
-+    int ret, i, count;
-+    bool multi = false;
-+
-+    trace_vfio_pci_hot_reset(vdev->vbasedev.name, single ? "one" : "multi");
-+
-+    if (!single) {
-+        vfio_pci_pre_reset(vdev);
-+    }
-+    vdev->vbasedev.needs_reset = false;
-+
-+    ret = vfio_pci_get_pci_hot_reset_info(vdev, &info);
-+
-+    if (ret) {
-         goto out_single;
-     }
-+    devices = &info->devices[0];
- 
-     trace_vfio_pci_hot_reset_has_dep_devices(vdev->vbasedev.name);
- 
-diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
-index eb74d9de2d..3568a6135d 100644
---- a/hw/vfio/pci.h
-+++ b/hw/vfio/pci.h
-@@ -219,6 +219,9 @@ void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr);
- 
- extern const PropertyInfo qdev_prop_nv_gpudirect_clique;
- 
-+int vfio_pci_get_pci_hot_reset_info(VFIOPCIDevice *vdev,
-+                                    struct vfio_pci_hot_reset_info **info_p);
-+
- int vfio_populate_vga(VFIOPCIDevice *vdev, Error **errp);
- 
- int vfio_pci_igd_opregion_init(VFIOPCIDevice *vdev,
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-pci-Introduce-a-vfio-pci-hot-reset-interface.patch b/SOURCES/kvm-vfio-pci-Introduce-a-vfio-pci-hot-reset-interface.patch
deleted file mode 100644
index 2a2db5f..0000000
--- a/SOURCES/kvm-vfio-pci-Introduce-a-vfio-pci-hot-reset-interface.patch
+++ /dev/null
@@ -1,466 +0,0 @@
-From acc3e5306e184567006bc45e7f36f2473e75d08a Mon Sep 17 00:00:00 2001
-From: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Date: Tue, 21 Nov 2023 16:44:07 +0800
-Subject: [PATCH 028/101] vfio/pci: Introduce a vfio pci hot reset interface
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [27/67] 192088dbf2cf88663acd2416f69b7eeb175b2525 (eauger1/centos-qemu-kvm)
-
-Legacy vfio pci and iommufd cdev have different process to hot reset
-vfio device, expand current code to abstract out pci_hot_reset callback
-for legacy vfio, this same interface will also be used by iommufd
-cdev vfio device.
-
-Rename vfio_pci_hot_reset to vfio_legacy_pci_hot_reset and move it
-into container.c.
-
-vfio_pci_[pre/post]_reset and vfio_pci_host_match are exported so
-they could be called in legacy and iommufd pci_hot_reset callback.
-
-Suggested-by: Cédric Le Goater <clg@redhat.com>
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Tested-by: Eric Auger <eric.auger@redhat.com>
-Tested-by: Nicolin Chen <nicolinc@nvidia.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit c328e7e8ad1c969dbcbe90ee76afcd3cfec5e945)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/container.c                   | 170 ++++++++++++++++++++++++++
- hw/vfio/pci.c                         | 168 +------------------------
- hw/vfio/pci.h                         |   3 +
- include/hw/vfio/vfio-container-base.h |   3 +
- 4 files changed, 182 insertions(+), 162 deletions(-)
-
-diff --git a/hw/vfio/container.c b/hw/vfio/container.c
-index ed2d721b2b..1dbf9b9a17 100644
---- a/hw/vfio/container.c
-+++ b/hw/vfio/container.c
-@@ -33,6 +33,7 @@
- #include "trace.h"
- #include "qapi/error.h"
- #include "migration/migration.h"
-+#include "pci.h"
- 
- VFIOGroupList vfio_group_list =
-     QLIST_HEAD_INITIALIZER(vfio_group_list);
-@@ -922,6 +923,174 @@ static void vfio_legacy_detach_device(VFIODevice *vbasedev)
-     vfio_put_group(group);
- }
- 
-+static int vfio_legacy_pci_hot_reset(VFIODevice *vbasedev, bool single)
-+{
-+    VFIOPCIDevice *vdev = container_of(vbasedev, VFIOPCIDevice, vbasedev);
-+    VFIOGroup *group;
-+    struct vfio_pci_hot_reset_info *info = NULL;
-+    struct vfio_pci_dependent_device *devices;
-+    struct vfio_pci_hot_reset *reset;
-+    int32_t *fds;
-+    int ret, i, count;
-+    bool multi = false;
-+
-+    trace_vfio_pci_hot_reset(vdev->vbasedev.name, single ? "one" : "multi");
-+
-+    if (!single) {
-+        vfio_pci_pre_reset(vdev);
-+    }
-+    vdev->vbasedev.needs_reset = false;
-+
-+    ret = vfio_pci_get_pci_hot_reset_info(vdev, &info);
-+
-+    if (ret) {
-+        goto out_single;
-+    }
-+    devices = &info->devices[0];
-+
-+    trace_vfio_pci_hot_reset_has_dep_devices(vdev->vbasedev.name);
-+
-+    /* Verify that we have all the groups required */
-+    for (i = 0; i < info->count; i++) {
-+        PCIHostDeviceAddress host;
-+        VFIOPCIDevice *tmp;
-+        VFIODevice *vbasedev_iter;
-+
-+        host.domain = devices[i].segment;
-+        host.bus = devices[i].bus;
-+        host.slot = PCI_SLOT(devices[i].devfn);
-+        host.function = PCI_FUNC(devices[i].devfn);
-+
-+        trace_vfio_pci_hot_reset_dep_devices(host.domain,
-+                host.bus, host.slot, host.function, devices[i].group_id);
-+
-+        if (vfio_pci_host_match(&host, vdev->vbasedev.name)) {
-+            continue;
-+        }
-+
-+        QLIST_FOREACH(group, &vfio_group_list, next) {
-+            if (group->groupid == devices[i].group_id) {
-+                break;
-+            }
-+        }
-+
-+        if (!group) {
-+            if (!vdev->has_pm_reset) {
-+                error_report("vfio: Cannot reset device %s, "
-+                             "depends on group %d which is not owned.",
-+                             vdev->vbasedev.name, devices[i].group_id);
-+            }
-+            ret = -EPERM;
-+            goto out;
-+        }
-+
-+        /* Prep dependent devices for reset and clear our marker. */
-+        QLIST_FOREACH(vbasedev_iter, &group->device_list, next) {
-+            if (!vbasedev_iter->dev->realized ||
-+                vbasedev_iter->type != VFIO_DEVICE_TYPE_PCI) {
-+                continue;
-+            }
-+            tmp = container_of(vbasedev_iter, VFIOPCIDevice, vbasedev);
-+            if (vfio_pci_host_match(&host, tmp->vbasedev.name)) {
-+                if (single) {
-+                    ret = -EINVAL;
-+                    goto out_single;
-+                }
-+                vfio_pci_pre_reset(tmp);
-+                tmp->vbasedev.needs_reset = false;
-+                multi = true;
-+                break;
-+            }
-+        }
-+    }
-+
-+    if (!single && !multi) {
-+        ret = -EINVAL;
-+        goto out_single;
-+    }
-+
-+    /* Determine how many group fds need to be passed */
-+    count = 0;
-+    QLIST_FOREACH(group, &vfio_group_list, next) {
-+        for (i = 0; i < info->count; i++) {
-+            if (group->groupid == devices[i].group_id) {
-+                count++;
-+                break;
-+            }
-+        }
-+    }
-+
-+    reset = g_malloc0(sizeof(*reset) + (count * sizeof(*fds)));
-+    reset->argsz = sizeof(*reset) + (count * sizeof(*fds));
-+    fds = &reset->group_fds[0];
-+
-+    /* Fill in group fds */
-+    QLIST_FOREACH(group, &vfio_group_list, next) {
-+        for (i = 0; i < info->count; i++) {
-+            if (group->groupid == devices[i].group_id) {
-+                fds[reset->count++] = group->fd;
-+                break;
-+            }
-+        }
-+    }
-+
-+    /* Bus reset! */
-+    ret = ioctl(vdev->vbasedev.fd, VFIO_DEVICE_PCI_HOT_RESET, reset);
-+    g_free(reset);
-+    if (ret) {
-+        ret = -errno;
-+    }
-+
-+    trace_vfio_pci_hot_reset_result(vdev->vbasedev.name,
-+                                    ret ? strerror(errno) : "Success");
-+
-+out:
-+    /* Re-enable INTx on affected devices */
-+    for (i = 0; i < info->count; i++) {
-+        PCIHostDeviceAddress host;
-+        VFIOPCIDevice *tmp;
-+        VFIODevice *vbasedev_iter;
-+
-+        host.domain = devices[i].segment;
-+        host.bus = devices[i].bus;
-+        host.slot = PCI_SLOT(devices[i].devfn);
-+        host.function = PCI_FUNC(devices[i].devfn);
-+
-+        if (vfio_pci_host_match(&host, vdev->vbasedev.name)) {
-+            continue;
-+        }
-+
-+        QLIST_FOREACH(group, &vfio_group_list, next) {
-+            if (group->groupid == devices[i].group_id) {
-+                break;
-+            }
-+        }
-+
-+        if (!group) {
-+            break;
-+        }
-+
-+        QLIST_FOREACH(vbasedev_iter, &group->device_list, next) {
-+            if (!vbasedev_iter->dev->realized ||
-+                vbasedev_iter->type != VFIO_DEVICE_TYPE_PCI) {
-+                continue;
-+            }
-+            tmp = container_of(vbasedev_iter, VFIOPCIDevice, vbasedev);
-+            if (vfio_pci_host_match(&host, tmp->vbasedev.name)) {
-+                vfio_pci_post_reset(tmp);
-+                break;
-+            }
-+        }
-+    }
-+out_single:
-+    if (!single) {
-+        vfio_pci_post_reset(vdev);
-+    }
-+    g_free(info);
-+
-+    return ret;
-+}
-+
- const VFIOIOMMUOps vfio_legacy_ops = {
-     .dma_map = vfio_legacy_dma_map,
-     .dma_unmap = vfio_legacy_dma_unmap,
-@@ -929,4 +1098,5 @@ const VFIOIOMMUOps vfio_legacy_ops = {
-     .detach_device = vfio_legacy_detach_device,
-     .set_dirty_page_tracking = vfio_legacy_set_dirty_page_tracking,
-     .query_dirty_bitmap = vfio_legacy_query_dirty_bitmap,
-+    .pci_hot_reset = vfio_legacy_pci_hot_reset,
- };
-diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
-index b482e5479f..83b2561908 100644
---- a/hw/vfio/pci.c
-+++ b/hw/vfio/pci.c
-@@ -2377,7 +2377,7 @@ static int vfio_add_capabilities(VFIOPCIDevice *vdev, Error **errp)
-     return 0;
- }
- 
--static void vfio_pci_pre_reset(VFIOPCIDevice *vdev)
-+void vfio_pci_pre_reset(VFIOPCIDevice *vdev)
- {
-     PCIDevice *pdev = &vdev->pdev;
-     uint16_t cmd;
-@@ -2414,7 +2414,7 @@ static void vfio_pci_pre_reset(VFIOPCIDevice *vdev)
-     vfio_pci_write_config(pdev, PCI_COMMAND, cmd, 2);
- }
- 
--static void vfio_pci_post_reset(VFIOPCIDevice *vdev)
-+void vfio_pci_post_reset(VFIOPCIDevice *vdev)
- {
-     Error *err = NULL;
-     int nr;
-@@ -2438,7 +2438,7 @@ static void vfio_pci_post_reset(VFIOPCIDevice *vdev)
-     vfio_quirk_reset(vdev);
- }
- 
--static bool vfio_pci_host_match(PCIHostDeviceAddress *addr, const char *name)
-+bool vfio_pci_host_match(PCIHostDeviceAddress *addr, const char *name)
- {
-     char tmp[13];
- 
-@@ -2488,166 +2488,10 @@ int vfio_pci_get_pci_hot_reset_info(VFIOPCIDevice *vdev,
- 
- static int vfio_pci_hot_reset(VFIOPCIDevice *vdev, bool single)
- {
--    VFIOGroup *group;
--    struct vfio_pci_hot_reset_info *info = NULL;
--    struct vfio_pci_dependent_device *devices;
--    struct vfio_pci_hot_reset *reset;
--    int32_t *fds;
--    int ret, i, count;
--    bool multi = false;
--
--    trace_vfio_pci_hot_reset(vdev->vbasedev.name, single ? "one" : "multi");
--
--    if (!single) {
--        vfio_pci_pre_reset(vdev);
--    }
--    vdev->vbasedev.needs_reset = false;
--
--    ret = vfio_pci_get_pci_hot_reset_info(vdev, &info);
--
--    if (ret) {
--        goto out_single;
--    }
--    devices = &info->devices[0];
--
--    trace_vfio_pci_hot_reset_has_dep_devices(vdev->vbasedev.name);
--
--    /* Verify that we have all the groups required */
--    for (i = 0; i < info->count; i++) {
--        PCIHostDeviceAddress host;
--        VFIOPCIDevice *tmp;
--        VFIODevice *vbasedev_iter;
--
--        host.domain = devices[i].segment;
--        host.bus = devices[i].bus;
--        host.slot = PCI_SLOT(devices[i].devfn);
--        host.function = PCI_FUNC(devices[i].devfn);
--
--        trace_vfio_pci_hot_reset_dep_devices(host.domain,
--                host.bus, host.slot, host.function, devices[i].group_id);
--
--        if (vfio_pci_host_match(&host, vdev->vbasedev.name)) {
--            continue;
--        }
--
--        QLIST_FOREACH(group, &vfio_group_list, next) {
--            if (group->groupid == devices[i].group_id) {
--                break;
--            }
--        }
--
--        if (!group) {
--            if (!vdev->has_pm_reset) {
--                error_report("vfio: Cannot reset device %s, "
--                             "depends on group %d which is not owned.",
--                             vdev->vbasedev.name, devices[i].group_id);
--            }
--            ret = -EPERM;
--            goto out;
--        }
--
--        /* Prep dependent devices for reset and clear our marker. */
--        QLIST_FOREACH(vbasedev_iter, &group->device_list, next) {
--            if (!vbasedev_iter->dev->realized ||
--                vbasedev_iter->type != VFIO_DEVICE_TYPE_PCI) {
--                continue;
--            }
--            tmp = container_of(vbasedev_iter, VFIOPCIDevice, vbasedev);
--            if (vfio_pci_host_match(&host, tmp->vbasedev.name)) {
--                if (single) {
--                    ret = -EINVAL;
--                    goto out_single;
--                }
--                vfio_pci_pre_reset(tmp);
--                tmp->vbasedev.needs_reset = false;
--                multi = true;
--                break;
--            }
--        }
--    }
--
--    if (!single && !multi) {
--        ret = -EINVAL;
--        goto out_single;
--    }
--
--    /* Determine how many group fds need to be passed */
--    count = 0;
--    QLIST_FOREACH(group, &vfio_group_list, next) {
--        for (i = 0; i < info->count; i++) {
--            if (group->groupid == devices[i].group_id) {
--                count++;
--                break;
--            }
--        }
--    }
--
--    reset = g_malloc0(sizeof(*reset) + (count * sizeof(*fds)));
--    reset->argsz = sizeof(*reset) + (count * sizeof(*fds));
--    fds = &reset->group_fds[0];
--
--    /* Fill in group fds */
--    QLIST_FOREACH(group, &vfio_group_list, next) {
--        for (i = 0; i < info->count; i++) {
--            if (group->groupid == devices[i].group_id) {
--                fds[reset->count++] = group->fd;
--                break;
--            }
--        }
--    }
--
--    /* Bus reset! */
--    ret = ioctl(vdev->vbasedev.fd, VFIO_DEVICE_PCI_HOT_RESET, reset);
--    g_free(reset);
--
--    trace_vfio_pci_hot_reset_result(vdev->vbasedev.name,
--                                    ret ? strerror(errno) : "Success");
--
--out:
--    /* Re-enable INTx on affected devices */
--    for (i = 0; i < info->count; i++) {
--        PCIHostDeviceAddress host;
--        VFIOPCIDevice *tmp;
--        VFIODevice *vbasedev_iter;
--
--        host.domain = devices[i].segment;
--        host.bus = devices[i].bus;
--        host.slot = PCI_SLOT(devices[i].devfn);
--        host.function = PCI_FUNC(devices[i].devfn);
--
--        if (vfio_pci_host_match(&host, vdev->vbasedev.name)) {
--            continue;
--        }
--
--        QLIST_FOREACH(group, &vfio_group_list, next) {
--            if (group->groupid == devices[i].group_id) {
--                break;
--            }
--        }
--
--        if (!group) {
--            break;
--        }
--
--        QLIST_FOREACH(vbasedev_iter, &group->device_list, next) {
--            if (!vbasedev_iter->dev->realized ||
--                vbasedev_iter->type != VFIO_DEVICE_TYPE_PCI) {
--                continue;
--            }
--            tmp = container_of(vbasedev_iter, VFIOPCIDevice, vbasedev);
--            if (vfio_pci_host_match(&host, tmp->vbasedev.name)) {
--                vfio_pci_post_reset(tmp);
--                break;
--            }
--        }
--    }
--out_single:
--    if (!single) {
--        vfio_pci_post_reset(vdev);
--    }
--    g_free(info);
-+    VFIODevice *vbasedev = &vdev->vbasedev;
-+    const VFIOIOMMUOps *ops = vbasedev->bcontainer->ops;
- 
--    return ret;
-+    return ops->pci_hot_reset(vbasedev, single);
- }
- 
- /*
-diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
-index 3568a6135d..b7de39c010 100644
---- a/hw/vfio/pci.h
-+++ b/hw/vfio/pci.h
-@@ -219,6 +219,9 @@ void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr);
- 
- extern const PropertyInfo qdev_prop_nv_gpudirect_clique;
- 
-+void vfio_pci_pre_reset(VFIOPCIDevice *vdev);
-+void vfio_pci_post_reset(VFIOPCIDevice *vdev);
-+bool vfio_pci_host_match(PCIHostDeviceAddress *addr, const char *name);
- int vfio_pci_get_pci_hot_reset_info(VFIOPCIDevice *vdev,
-                                     struct vfio_pci_hot_reset_info **info_p);
- 
-diff --git a/include/hw/vfio/vfio-container-base.h b/include/hw/vfio/vfio-container-base.h
-index 4b6f017c6f..45bb19c767 100644
---- a/include/hw/vfio/vfio-container-base.h
-+++ b/include/hw/vfio/vfio-container-base.h
-@@ -106,6 +106,9 @@ struct VFIOIOMMUOps {
-     int (*set_dirty_page_tracking)(VFIOContainerBase *bcontainer, bool start);
-     int (*query_dirty_bitmap)(VFIOContainerBase *bcontainer, VFIOBitmap *vbmap,
-                               hwaddr iova, hwaddr size);
-+    /* PCI specific */
-+    int (*pci_hot_reset)(VFIODevice *vbasedev, bool single);
-+
-     /* SPAPR specific */
-     int (*add_window)(VFIOContainerBase *bcontainer,
-                       MemoryRegionSection *section,
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-pci-Make-vfio-cdev-pre-openable-by-passing-a-fi.patch b/SOURCES/kvm-vfio-pci-Make-vfio-cdev-pre-openable-by-passing-a-fi.patch
deleted file mode 100644
index 4a973b5..0000000
--- a/SOURCES/kvm-vfio-pci-Make-vfio-cdev-pre-openable-by-passing-a-fi.patch
+++ /dev/null
@@ -1,237 +0,0 @@
-From 965a44793806fef2094906947bd3b428638bf89a Mon Sep 17 00:00:00 2001
-From: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Date: Tue, 21 Nov 2023 16:44:10 +0800
-Subject: [PATCH 031/101] vfio/pci: Make vfio cdev pre-openable by passing a
- file handle
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [30/67] a14b824b700e8fb36633cd159bcc422d992a316f (eauger1/centos-qemu-kvm)
-
-Conflicts: contextual conflict in hw/vfio/pci.c due to
-RHEL-only f73562144e492 vfio: cap number of devices that can be assigned
-
-This gives management tools like libvirt a chance to open the vfio
-cdev with privilege and pass FD to qemu. This way qemu never needs
-to have privilege to open a VFIO or iommu cdev node.
-
-Together with the earlier support of pre-opening /dev/iommu device,
-now we have full support of passing a vfio device to unprivileged
-qemu by management tool. This mode is no more considered for the
-legacy backend. So let's remove the "TODO" comment.
-
-Add helper functions vfio_device_set_fd() and vfio_device_get_name()
-to set fd and get device name, they will also be used by other vfio
-devices.
-
-There is no easy way to check if a device is mdev with FD passing,
-so fail the x-balloon-allowed check unconditionally in this case.
-
-There is also no easy way to get BDF as name with FD passing, so
-we fake a name by VFIO_FD[fd].
-
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Tested-by: Eric Auger <eric.auger@redhat.com>
-Tested-by: Nicolin Chen <nicolinc@nvidia.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit da3e04b26fd8d15b344944504d5ffa9c5f20b54b)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/helpers.c             | 43 +++++++++++++++++++++++++++++++++++
- hw/vfio/iommufd.c             | 12 ++++++----
- hw/vfio/pci.c                 | 28 +++++++++++++----------
- include/hw/vfio/vfio-common.h |  4 ++++
- 4 files changed, 71 insertions(+), 16 deletions(-)
-
-diff --git a/hw/vfio/helpers.c b/hw/vfio/helpers.c
-index 168847e7c5..3592c3d54e 100644
---- a/hw/vfio/helpers.c
-+++ b/hw/vfio/helpers.c
-@@ -27,6 +27,7 @@
- #include "trace.h"
- #include "qapi/error.h"
- #include "qemu/error-report.h"
-+#include "monitor/monitor.h"
- 
- /*
-  * Common VFIO interrupt disable
-@@ -609,3 +610,45 @@ bool vfio_has_region_cap(VFIODevice *vbasedev, int region, uint16_t cap_type)
- 
-     return ret;
- }
-+
-+int vfio_device_get_name(VFIODevice *vbasedev, Error **errp)
-+{
-+    struct stat st;
-+
-+    if (vbasedev->fd < 0) {
-+        if (stat(vbasedev->sysfsdev, &st) < 0) {
-+            error_setg_errno(errp, errno, "no such host device");
-+            error_prepend(errp, VFIO_MSG_PREFIX, vbasedev->sysfsdev);
-+            return -errno;
-+        }
-+        /* User may specify a name, e.g: VFIO platform device */
-+        if (!vbasedev->name) {
-+            vbasedev->name = g_path_get_basename(vbasedev->sysfsdev);
-+        }
-+    } else {
-+        if (!vbasedev->iommufd) {
-+            error_setg(errp, "Use FD passing only with iommufd backend");
-+            return -EINVAL;
-+        }
-+        /*
-+         * Give a name with fd so any function printing out vbasedev->name
-+         * will not break.
-+         */
-+        if (!vbasedev->name) {
-+            vbasedev->name = g_strdup_printf("VFIO_FD%d", vbasedev->fd);
-+        }
-+    }
-+
-+    return 0;
-+}
-+
-+void vfio_device_set_fd(VFIODevice *vbasedev, const char *str, Error **errp)
-+{
-+    int fd = monitor_fd_param(monitor_cur(), str, errp);
-+
-+    if (fd < 0) {
-+        error_prepend(errp, "Could not parse remote object fd %s:", str);
-+        return;
-+    }
-+    vbasedev->fd = fd;
-+}
-diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
-index 6e53e013ef..5accd26484 100644
---- a/hw/vfio/iommufd.c
-+++ b/hw/vfio/iommufd.c
-@@ -320,11 +320,15 @@ static int iommufd_cdev_attach(const char *name, VFIODevice *vbasedev,
-     uint32_t ioas_id;
-     Error *err = NULL;
- 
--    devfd = iommufd_cdev_getfd(vbasedev->sysfsdev, errp);
--    if (devfd < 0) {
--        return devfd;
-+    if (vbasedev->fd < 0) {
-+        devfd = iommufd_cdev_getfd(vbasedev->sysfsdev, errp);
-+        if (devfd < 0) {
-+            return devfd;
-+        }
-+        vbasedev->fd = devfd;
-+    } else {
-+        devfd = vbasedev->fd;
-     }
--    vbasedev->fd = devfd;
- 
-     ret = iommufd_cdev_connect_and_bind(vbasedev, errp);
-     if (ret) {
-diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
-index 39e6a6678e..3412a63bb1 100644
---- a/hw/vfio/pci.c
-+++ b/hw/vfio/pci.c
-@@ -2949,7 +2949,6 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
-     VFIOGroup *group;
-     char *tmp, *subsys;
-     Error *err = NULL;
--    struct stat st;
-     int ret, i = 0;
-     bool is_mdev;
-     char uuid[UUID_STR_LEN];
-@@ -2976,11 +2975,14 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
-         return;
-     }
- 
--    if (!vbasedev->sysfsdev) {
-+    if (vbasedev->fd < 0 && !vbasedev->sysfsdev) {
-         if (!(~vdev->host.domain || ~vdev->host.bus ||
-               ~vdev->host.slot || ~vdev->host.function)) {
-             error_setg(errp, "No provided host device");
-             error_append_hint(errp, "Use -device vfio-pci,host=DDDD:BB:DD.F "
-+#ifdef CONFIG_IOMMUFD
-+                              "or -device vfio-pci,fd=DEVICE_FD "
-+#endif
-                               "or -device vfio-pci,sysfsdev=PATH_TO_DEVICE\n");
-             return;
-         }
-@@ -2990,13 +2992,9 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
-                             vdev->host.slot, vdev->host.function);
-     }
- 
--    if (stat(vbasedev->sysfsdev, &st) < 0) {
--        error_setg_errno(errp, errno, "no such host device");
--        error_prepend(errp, VFIO_MSG_PREFIX, vbasedev->sysfsdev);
-+    if (vfio_device_get_name(vbasedev, errp) < 0) {
-         return;
-     }
--
--    vbasedev->name = g_path_get_basename(vbasedev->sysfsdev);
-     vbasedev->ops = &vfio_pci_ops;
-     vbasedev->type = VFIO_DEVICE_TYPE_PCI;
-     vbasedev->dev = DEVICE(vdev);
-@@ -3356,6 +3354,7 @@ static void vfio_instance_init(Object *obj)
-     vdev->host.bus = ~0U;
-     vdev->host.slot = ~0U;
-     vdev->host.function = ~0U;
-+    vdev->vbasedev.fd = -1;
- 
-     vdev->nv_gpudirect_clique = 0xFF;
- 
-@@ -3412,11 +3411,6 @@ static Property vfio_pci_dev_properties[] = {
-                                    qdev_prop_nv_gpudirect_clique, uint8_t),
-     DEFINE_PROP_OFF_AUTO_PCIBAR("x-msix-relocation", VFIOPCIDevice, msix_relo,
-                                 OFF_AUTOPCIBAR_OFF),
--    /*
--     * TODO - support passed fds... is this necessary?
--     * DEFINE_PROP_STRING("vfiofd", VFIOPCIDevice, vfiofd_name),
--     * DEFINE_PROP_STRING("vfiogroupfd, VFIOPCIDevice, vfiogroupfd_name),
--     */
- #ifdef CONFIG_IOMMUFD
-     DEFINE_PROP_LINK("iommufd", VFIOPCIDevice, vbasedev.iommufd,
-                      TYPE_IOMMUFD_BACKEND, IOMMUFDBackend *),
-@@ -3424,6 +3418,13 @@ static Property vfio_pci_dev_properties[] = {
-     DEFINE_PROP_END_OF_LIST(),
- };
- 
-+#ifdef CONFIG_IOMMUFD
-+static void vfio_pci_set_fd(Object *obj, const char *str, Error **errp)
-+{
-+    vfio_device_set_fd(&VFIO_PCI(obj)->vbasedev, str, errp);
-+}
-+#endif
-+
- static void vfio_pci_dev_class_init(ObjectClass *klass, void *data)
- {
-     DeviceClass *dc = DEVICE_CLASS(klass);
-@@ -3431,6 +3432,9 @@ static void vfio_pci_dev_class_init(ObjectClass *klass, void *data)
- 
-     dc->reset = vfio_pci_reset;
-     device_class_set_props(dc, vfio_pci_dev_properties);
-+#ifdef CONFIG_IOMMUFD
-+    object_class_property_add_str(klass, "fd", NULL, vfio_pci_set_fd);
-+#endif
-     dc->desc = "VFIO-based PCI device assignment";
-     set_bit(DEVICE_CATEGORY_MISC, dc->categories);
-     pdc->realize = vfio_realize;
-diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
-index 3dac5c167e..697bf24a35 100644
---- a/include/hw/vfio/vfio-common.h
-+++ b/include/hw/vfio/vfio-common.h
-@@ -251,4 +251,8 @@ int vfio_devices_query_dirty_bitmap(VFIOContainerBase *bcontainer,
-                                     hwaddr size);
- int vfio_get_dirty_bitmap(VFIOContainerBase *bcontainer, uint64_t iova,
-                                  uint64_t size, ram_addr_t ram_addr);
-+
-+/* Returns 0 on success, or a negative errno. */
-+int vfio_device_get_name(VFIODevice *vbasedev, Error **errp);
-+void vfio_device_set_fd(VFIODevice *vbasedev, const char *str, Error **errp);
- #endif /* HW_VFIO_VFIO_COMMON_H */
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-pci-Move-VFIODevice-initializations-in-vfio_ins.patch b/SOURCES/kvm-vfio-pci-Move-VFIODevice-initializations-in-vfio_ins.patch
deleted file mode 100644
index d426ede..0000000
--- a/SOURCES/kvm-vfio-pci-Move-VFIODevice-initializations-in-vfio_ins.patch
+++ /dev/null
@@ -1,70 +0,0 @@
-From 942bd7251d166f558e0e6acf7ba853e940e2fb52 Mon Sep 17 00:00:00 2001
-From: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Date: Tue, 21 Nov 2023 16:44:21 +0800
-Subject: [PATCH 042/101] vfio/pci: Move VFIODevice initializations in
- vfio_instance_init
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [41/67] 67392d7a92a6ec2155697a355c88d295338a0785 (eauger1/centos-qemu-kvm)
-
-Some of the VFIODevice initializations is in vfio_realize,
-move all of them in vfio_instance_init.
-
-No functional change intended.
-
-Suggested-by: Cédric Le Goater <clg@redhat.com>
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Tested-by: Nicolin Chen <nicolinc@nvidia.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit dd2fcb1716be9b89c726b3446f38446bb99d6b3a)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/pci.c | 10 ++++++----
- 1 file changed, 6 insertions(+), 4 deletions(-)
-
-diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
-index 3412a63bb1..3f5900cc46 100644
---- a/hw/vfio/pci.c
-+++ b/hw/vfio/pci.c
-@@ -2995,9 +2995,6 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
-     if (vfio_device_get_name(vbasedev, errp) < 0) {
-         return;
-     }
--    vbasedev->ops = &vfio_pci_ops;
--    vbasedev->type = VFIO_DEVICE_TYPE_PCI;
--    vbasedev->dev = DEVICE(vdev);
- 
-     /*
-      * Mediated devices *might* operate compatibly with discarding of RAM, but
-@@ -3346,6 +3343,7 @@ static void vfio_instance_init(Object *obj)
- {
-     PCIDevice *pci_dev = PCI_DEVICE(obj);
-     VFIOPCIDevice *vdev = VFIO_PCI(obj);
-+    VFIODevice *vbasedev = &vdev->vbasedev;
- 
-     device_add_bootindex_property(obj, &vdev->bootindex,
-                                   "bootindex", NULL,
-@@ -3354,7 +3352,11 @@ static void vfio_instance_init(Object *obj)
-     vdev->host.bus = ~0U;
-     vdev->host.slot = ~0U;
-     vdev->host.function = ~0U;
--    vdev->vbasedev.fd = -1;
-+
-+    vbasedev->type = VFIO_DEVICE_TYPE_PCI;
-+    vbasedev->ops = &vfio_pci_ops;
-+    vbasedev->dev = DEVICE(vdev);
-+    vbasedev->fd = -1;
- 
-     vdev->nv_gpudirect_clique = 0xFF;
- 
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-platform-Allow-the-selection-of-a-given-iommu-b.patch b/SOURCES/kvm-vfio-platform-Allow-the-selection-of-a-given-iommu-b.patch
deleted file mode 100644
index 06c2f0f..0000000
--- a/SOURCES/kvm-vfio-platform-Allow-the-selection-of-a-given-iommu-b.patch
+++ /dev/null
@@ -1,77 +0,0 @@
-From ede579d6d5fe5be9235d6a218efdb237192aee0e Mon Sep 17 00:00:00 2001
-From: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Date: Tue, 21 Nov 2023 16:44:11 +0800
-Subject: [PATCH 032/101] vfio/platform: Allow the selection of a given iommu
- backend
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [31/67] aba1dc16cada602edd7be1a28b0f57991131e6f7 (eauger1/centos-qemu-kvm)
-
-Now we support two types of iommu backends, let's add the capability
-to select one of them. This depends on whether an iommufd object has
-been linked with the vfio-platform device:
-
-If the user wants to use the legacy backend, it shall not
-link the vfio-platform device with any iommufd object:
-
- -device vfio-platform,host=XXX
-
-This is called the legacy mode/backend.
-
-If the user wants to use the iommufd backend (/dev/iommu) it
-shall pass an iommufd object id in the vfio-platform device options:
-
- -object iommufd,id=iommufd0
- -device vfio-platform,host=XXX,iommufd=iommufd0
-
-Suggested-by: Alex Williamson <alex.williamson@redhat.com>
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Tested-by: Nicolin Chen <nicolinc@nvidia.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit a6c50e1c3f8d0eb77edaea392e61508bb3c516f8)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/platform.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/hw/vfio/platform.c b/hw/vfio/platform.c
-index 8e3d4ac458..98ae4bc655 100644
---- a/hw/vfio/platform.c
-+++ b/hw/vfio/platform.c
-@@ -15,11 +15,13 @@
-  */
- 
- #include "qemu/osdep.h"
-+#include CONFIG_DEVICES /* CONFIG_IOMMUFD */
- #include "qapi/error.h"
- #include <sys/ioctl.h>
- #include <linux/vfio.h>
- 
- #include "hw/vfio/vfio-platform.h"
-+#include "sysemu/iommufd.h"
- #include "migration/vmstate.h"
- #include "qemu/error-report.h"
- #include "qemu/lockable.h"
-@@ -649,6 +651,10 @@ static Property vfio_platform_dev_properties[] = {
-     DEFINE_PROP_UINT32("mmap-timeout-ms", VFIOPlatformDevice,
-                        mmap_timeout, 1100),
-     DEFINE_PROP_BOOL("x-irqfd", VFIOPlatformDevice, irqfd_allowed, true),
-+#ifdef CONFIG_IOMMUFD
-+    DEFINE_PROP_LINK("iommufd", VFIOPlatformDevice, vbasedev.iommufd,
-+                     TYPE_IOMMUFD_BACKEND, IOMMUFDBackend *),
-+#endif
-     DEFINE_PROP_END_OF_LIST(),
- };
- 
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-platform-Make-vfio-cdev-pre-openable-by-passing.patch b/SOURCES/kvm-vfio-platform-Make-vfio-cdev-pre-openable-by-passing.patch
deleted file mode 100644
index f931524..0000000
--- a/SOURCES/kvm-vfio-platform-Make-vfio-cdev-pre-openable-by-passing.patch
+++ /dev/null
@@ -1,108 +0,0 @@
-From 22664f4115d9b297ef4276e48f8ba0bc195ec99e Mon Sep 17 00:00:00 2001
-From: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Date: Tue, 21 Nov 2023 16:44:12 +0800
-Subject: [PATCH 033/101] vfio/platform: Make vfio cdev pre-openable by passing
- a file handle
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [32/67] 069867dce64b826e92dc2051405a4ded5261981f (eauger1/centos-qemu-kvm)
-
-This gives management tools like libvirt a chance to open the vfio
-cdev with privilege and pass FD to qemu. This way qemu never needs
-to have privilege to open a VFIO or iommu cdev node.
-
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Tested-by: Nicolin Chen <nicolinc@nvidia.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 3016e60f8f715d2058a48e4956be994482c5e218)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/platform.c | 32 ++++++++++++++++++++++++--------
- 1 file changed, 24 insertions(+), 8 deletions(-)
-
-diff --git a/hw/vfio/platform.c b/hw/vfio/platform.c
-index 98ae4bc655..a97d9c6234 100644
---- a/hw/vfio/platform.c
-+++ b/hw/vfio/platform.c
-@@ -531,14 +531,13 @@ static VFIODeviceOps vfio_platform_ops = {
-  */
- static int vfio_base_device_init(VFIODevice *vbasedev, Error **errp)
- {
--    struct stat st;
-     int ret;
- 
--    /* @sysfsdev takes precedence over @host */
--    if (vbasedev->sysfsdev) {
-+    /* @fd takes precedence over @sysfsdev which takes precedence over @host */
-+    if (vbasedev->fd < 0 && vbasedev->sysfsdev) {
-         g_free(vbasedev->name);
-         vbasedev->name = g_path_get_basename(vbasedev->sysfsdev);
--    } else {
-+    } else if (vbasedev->fd < 0) {
-         if (!vbasedev->name || strchr(vbasedev->name, '/')) {
-             error_setg(errp, "wrong host device name");
-             return -EINVAL;
-@@ -548,10 +547,9 @@ static int vfio_base_device_init(VFIODevice *vbasedev, Error **errp)
-                                              vbasedev->name);
-     }
- 
--    if (stat(vbasedev->sysfsdev, &st) < 0) {
--        error_setg_errno(errp, errno,
--                         "failed to get the sysfs host device file status");
--        return -errno;
-+    ret = vfio_device_get_name(vbasedev, errp);
-+    if (ret) {
-+        return ret;
-     }
- 
-     ret = vfio_attach_device(vbasedev->name, vbasedev,
-@@ -658,6 +656,20 @@ static Property vfio_platform_dev_properties[] = {
-     DEFINE_PROP_END_OF_LIST(),
- };
- 
-+static void vfio_platform_instance_init(Object *obj)
-+{
-+    VFIOPlatformDevice *vdev = VFIO_PLATFORM_DEVICE(obj);
-+
-+    vdev->vbasedev.fd = -1;
-+}
-+
-+#ifdef CONFIG_IOMMUFD
-+static void vfio_platform_set_fd(Object *obj, const char *str, Error **errp)
-+{
-+    vfio_device_set_fd(&VFIO_PLATFORM_DEVICE(obj)->vbasedev, str, errp);
-+}
-+#endif
-+
- static void vfio_platform_class_init(ObjectClass *klass, void *data)
- {
-     DeviceClass *dc = DEVICE_CLASS(klass);
-@@ -665,6 +677,9 @@ static void vfio_platform_class_init(ObjectClass *klass, void *data)
- 
-     dc->realize = vfio_platform_realize;
-     device_class_set_props(dc, vfio_platform_dev_properties);
-+#ifdef CONFIG_IOMMUFD
-+    object_class_property_add_str(klass, "fd", NULL, vfio_platform_set_fd);
-+#endif
-     dc->vmsd = &vfio_platform_vmstate;
-     dc->desc = "VFIO-based platform device assignment";
-     sbc->connect_irq_notifier = vfio_start_irqfd_injection;
-@@ -677,6 +692,7 @@ static const TypeInfo vfio_platform_dev_info = {
-     .name = TYPE_VFIO_PLATFORM,
-     .parent = TYPE_SYS_BUS_DEVICE,
-     .instance_size = sizeof(VFIOPlatformDevice),
-+    .instance_init = vfio_platform_instance_init,
-     .class_init = vfio_platform_class_init,
-     .class_size = sizeof(VFIOPlatformDeviceClass),
- };
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-platform-Move-VFIODevice-initializations-in-vfi.patch b/SOURCES/kvm-vfio-platform-Move-VFIODevice-initializations-in-vfi.patch
deleted file mode 100644
index 56283a6..0000000
--- a/SOURCES/kvm-vfio-platform-Move-VFIODevice-initializations-in-vfi.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-From 2417020283532030f424fe07dfeb7477e6489640 Mon Sep 17 00:00:00 2001
-From: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Date: Tue, 21 Nov 2023 16:44:22 +0800
-Subject: [PATCH 043/101] vfio/platform: Move VFIODevice initializations in
- vfio_platform_instance_init
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [42/67] 53a459b6246d7d7bdc7a62ac92f02f1e775a54a6 (eauger1/centos-qemu-kvm)
-
-Some of the VFIODevice initializations is in vfio_platform_realize,
-move all of them in vfio_platform_instance_init.
-
-No functional change intended.
-
-Suggested-by: Cédric Le Goater <clg@redhat.com>
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Tested-by: Nicolin Chen <nicolinc@nvidia.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit a0cf44c8d618578843a65ea7f6d3db8ce52185bc)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/platform.c | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/hw/vfio/platform.c b/hw/vfio/platform.c
-index a97d9c6234..506eb8193f 100644
---- a/hw/vfio/platform.c
-+++ b/hw/vfio/platform.c
-@@ -581,10 +581,6 @@ static void vfio_platform_realize(DeviceState *dev, Error **errp)
-     VFIODevice *vbasedev = &vdev->vbasedev;
-     int i, ret;
- 
--    vbasedev->type = VFIO_DEVICE_TYPE_PLATFORM;
--    vbasedev->dev = dev;
--    vbasedev->ops = &vfio_platform_ops;
--
-     qemu_mutex_init(&vdev->intp_mutex);
- 
-     trace_vfio_platform_realize(vbasedev->sysfsdev ?
-@@ -659,8 +655,12 @@ static Property vfio_platform_dev_properties[] = {
- static void vfio_platform_instance_init(Object *obj)
- {
-     VFIOPlatformDevice *vdev = VFIO_PLATFORM_DEVICE(obj);
-+    VFIODevice *vbasedev = &vdev->vbasedev;
- 
--    vdev->vbasedev.fd = -1;
-+    vbasedev->type = VFIO_DEVICE_TYPE_PLATFORM;
-+    vbasedev->ops = &vfio_platform_ops;
-+    vbasedev->dev = DEVICE(vdev);
-+    vbasedev->fd = -1;
- }
- 
- #ifdef CONFIG_IOMMUFD
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-spapr-Extend-VFIOIOMMUOps-with-a-release-handle.patch b/SOURCES/kvm-vfio-spapr-Extend-VFIOIOMMUOps-with-a-release-handle.patch
deleted file mode 100644
index fb7e707..0000000
--- a/SOURCES/kvm-vfio-spapr-Extend-VFIOIOMMUOps-with-a-release-handle.patch
+++ /dev/null
@@ -1,129 +0,0 @@
-From e75ec2aca351daabe597ca6322c1589885f30d7a Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
-Date: Tue, 19 Dec 2023 07:58:16 +0100
-Subject: [PATCH 049/101] vfio/spapr: Extend VFIOIOMMUOps with a release
- handler
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [48/67] 1c4d22a6f69324805d050767fcf178d8566f2030 (eauger1/centos-qemu-kvm)
-
-This allows to abstract a bit more the sPAPR IOMMU support in the
-legacy IOMMU backend.
-
-Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Tested-by: Eric Farman <farman@linux.ibm.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 001a013ea3f125d2ec0e709b5765754149d8d968)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/container.c                   | 10 +++-----
- hw/vfio/spapr.c                       | 35 +++++++++++++++------------
- include/hw/vfio/vfio-container-base.h |  1 +
- 3 files changed, 24 insertions(+), 22 deletions(-)
-
-diff --git a/hw/vfio/container.c b/hw/vfio/container.c
-index b22feb8ded..1e77a2929e 100644
---- a/hw/vfio/container.c
-+++ b/hw/vfio/container.c
-@@ -632,9 +632,8 @@ listener_release_exit:
-     QLIST_REMOVE(bcontainer, next);
-     vfio_kvm_device_del_group(group);
-     memory_listener_unregister(&bcontainer->listener);
--    if (container->iommu_type == VFIO_SPAPR_TCE_v2_IOMMU ||
--        container->iommu_type == VFIO_SPAPR_TCE_IOMMU) {
--        vfio_spapr_container_deinit(container);
-+    if (bcontainer->ops->release) {
-+        bcontainer->ops->release(bcontainer);
-     }
- 
- enable_discards_exit:
-@@ -667,9 +666,8 @@ static void vfio_disconnect_container(VFIOGroup *group)
-      */
-     if (QLIST_EMPTY(&container->group_list)) {
-         memory_listener_unregister(&bcontainer->listener);
--        if (container->iommu_type == VFIO_SPAPR_TCE_v2_IOMMU ||
--            container->iommu_type == VFIO_SPAPR_TCE_IOMMU) {
--            vfio_spapr_container_deinit(container);
-+        if (bcontainer->ops->release) {
-+            bcontainer->ops->release(bcontainer);
-         }
-     }
- 
-diff --git a/hw/vfio/spapr.c b/hw/vfio/spapr.c
-index 5c6426e697..44617dfc6b 100644
---- a/hw/vfio/spapr.c
-+++ b/hw/vfio/spapr.c
-@@ -440,6 +440,24 @@ vfio_spapr_container_del_section_window(VFIOContainerBase *bcontainer,
-     }
- }
- 
-+static void vfio_spapr_container_release(VFIOContainerBase *bcontainer)
-+{
-+    VFIOContainer *container = container_of(bcontainer, VFIOContainer,
-+                                            bcontainer);
-+    VFIOSpaprContainer *scontainer = container_of(container, VFIOSpaprContainer,
-+                                                  container);
-+    VFIOHostDMAWindow *hostwin, *next;
-+
-+    if (container->iommu_type == VFIO_SPAPR_TCE_v2_IOMMU) {
-+        memory_listener_unregister(&scontainer->prereg_listener);
-+    }
-+    QLIST_FOREACH_SAFE(hostwin, &scontainer->hostwin_list, hostwin_next,
-+                       next) {
-+        QLIST_REMOVE(hostwin, hostwin_next);
-+        g_free(hostwin);
-+    }
-+}
-+
- static VFIOIOMMUOps vfio_iommu_spapr_ops;
- 
- static void setup_spapr_ops(VFIOContainerBase *bcontainer)
-@@ -447,6 +465,7 @@ static void setup_spapr_ops(VFIOContainerBase *bcontainer)
-     vfio_iommu_spapr_ops = *bcontainer->ops;
-     vfio_iommu_spapr_ops.add_window = vfio_spapr_container_add_section_window;
-     vfio_iommu_spapr_ops.del_window = vfio_spapr_container_del_section_window;
-+    vfio_iommu_spapr_ops.release = vfio_spapr_container_release;
-     bcontainer->ops = &vfio_iommu_spapr_ops;
- }
- 
-@@ -527,19 +546,3 @@ listener_unregister_exit:
-     }
-     return ret;
- }
--
--void vfio_spapr_container_deinit(VFIOContainer *container)
--{
--    VFIOSpaprContainer *scontainer = container_of(container, VFIOSpaprContainer,
--                                                  container);
--    VFIOHostDMAWindow *hostwin, *next;
--
--    if (container->iommu_type == VFIO_SPAPR_TCE_v2_IOMMU) {
--        memory_listener_unregister(&scontainer->prereg_listener);
--    }
--    QLIST_FOREACH_SAFE(hostwin, &scontainer->hostwin_list, hostwin_next,
--                       next) {
--        QLIST_REMOVE(hostwin, hostwin_next);
--        g_free(hostwin);
--    }
--}
-diff --git a/include/hw/vfio/vfio-container-base.h b/include/hw/vfio/vfio-container-base.h
-index 2ae297ccda..5c9594b6c7 100644
---- a/include/hw/vfio/vfio-container-base.h
-+++ b/include/hw/vfio/vfio-container-base.h
-@@ -117,5 +117,6 @@ struct VFIOIOMMUOps {
-                       Error **errp);
-     void (*del_window)(VFIOContainerBase *bcontainer,
-                        MemoryRegionSection *section);
-+    void (*release)(VFIOContainerBase *bcontainer);
- };
- #endif /* HW_VFIO_VFIO_CONTAINER_BASE_H */
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-spapr-Introduce-a-sPAPR-VFIOIOMMU-QOM-interface.patch b/SOURCES/kvm-vfio-spapr-Introduce-a-sPAPR-VFIOIOMMU-QOM-interface.patch
deleted file mode 100644
index f835acb..0000000
--- a/SOURCES/kvm-vfio-spapr-Introduce-a-sPAPR-VFIOIOMMU-QOM-interface.patch
+++ /dev/null
@@ -1,150 +0,0 @@
-From 645ed97633935712edcc2c56f252738b38f15e3a Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
-Date: Tue, 19 Dec 2023 07:58:22 +0100
-Subject: [PATCH 055/101] vfio/spapr: Introduce a sPAPR VFIOIOMMU QOM interface
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [54/67] 2ceac3c07d71790dc3852fbbbd4084a7affb9373 (eauger1/centos-qemu-kvm)
-
-Move vfio_spapr_container_setup() to a VFIOIOMMUClass::setup handler
-and convert the sPAPR VFIOIOMMUOps struct to a QOM interface. The
-sPAPR QOM interface inherits from the legacy QOM interface because
-because both have the same basic needs. The sPAPR interface is then
-extended with the handlers specific to the sPAPR IOMMU.
-
-This allows reuse and provides better abstraction of the backends. It
-will be useful to avoid compiling the sPAPR IOMMU backend on targets
-not supporting it.
-
-Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Tested-by: Eric Farman <farman@linux.ibm.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit f221f641a2fe69c2ca3857759551470664b0bec8)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/container.c                   | 18 +++++--------
- hw/vfio/spapr.c                       | 39 ++++++++++++++++-----------
- include/hw/vfio/vfio-container-base.h |  1 +
- 3 files changed, 31 insertions(+), 27 deletions(-)
-
-diff --git a/hw/vfio/container.c b/hw/vfio/container.c
-index c22bdd3216..688cf23bab 100644
---- a/hw/vfio/container.c
-+++ b/hw/vfio/container.c
-@@ -381,6 +381,10 @@ static const VFIOIOMMUClass *vfio_get_iommu_class(int iommu_type, Error **errp)
-     case VFIO_TYPE1_IOMMU:
-         klass = object_class_by_name(TYPE_VFIO_IOMMU_LEGACY);
-         break;
-+    case VFIO_SPAPR_TCE_v2_IOMMU:
-+    case VFIO_SPAPR_TCE_IOMMU:
-+        klass = object_class_by_name(TYPE_VFIO_IOMMU_SPAPR);
-+        break;
-     default:
-         g_assert_not_reached();
-     };
-@@ -623,19 +627,9 @@ static int vfio_connect_container(VFIOGroup *group, AddressSpace *as,
-         goto free_container_exit;
-     }
- 
--    switch (container->iommu_type) {
--    case VFIO_TYPE1v2_IOMMU:
--    case VFIO_TYPE1_IOMMU:
--        ret = vfio_legacy_setup(bcontainer, errp);
--        break;
--    case VFIO_SPAPR_TCE_v2_IOMMU:
--    case VFIO_SPAPR_TCE_IOMMU:
--        ret = vfio_spapr_container_init(container, errp);
--        break;
--    default:
--        g_assert_not_reached();
--    }
-+    assert(bcontainer->ops->setup);
- 
-+    ret = bcontainer->ops->setup(bcontainer, errp);
-     if (ret) {
-         goto enable_discards_exit;
-     }
-diff --git a/hw/vfio/spapr.c b/hw/vfio/spapr.c
-index 44617dfc6b..0d949bb728 100644
---- a/hw/vfio/spapr.c
-+++ b/hw/vfio/spapr.c
-@@ -458,20 +458,11 @@ static void vfio_spapr_container_release(VFIOContainerBase *bcontainer)
-     }
- }
- 
--static VFIOIOMMUOps vfio_iommu_spapr_ops;
--
--static void setup_spapr_ops(VFIOContainerBase *bcontainer)
--{
--    vfio_iommu_spapr_ops = *bcontainer->ops;
--    vfio_iommu_spapr_ops.add_window = vfio_spapr_container_add_section_window;
--    vfio_iommu_spapr_ops.del_window = vfio_spapr_container_del_section_window;
--    vfio_iommu_spapr_ops.release = vfio_spapr_container_release;
--    bcontainer->ops = &vfio_iommu_spapr_ops;
--}
--
--int vfio_spapr_container_init(VFIOContainer *container, Error **errp)
-+static int vfio_spapr_container_setup(VFIOContainerBase *bcontainer,
-+                                      Error **errp)
- {
--    VFIOContainerBase *bcontainer = &container->bcontainer;
-+    VFIOContainer *container = container_of(bcontainer, VFIOContainer,
-+                                            bcontainer);
-     VFIOSpaprContainer *scontainer = container_of(container, VFIOSpaprContainer,
-                                                   container);
-     struct vfio_iommu_spapr_tce_info info;
-@@ -536,8 +527,6 @@ int vfio_spapr_container_init(VFIOContainer *container, Error **errp)
-                           0x1000);
-     }
- 
--    setup_spapr_ops(bcontainer);
--
-     return 0;
- 
- listener_unregister_exit:
-@@ -546,3 +535,23 @@ listener_unregister_exit:
-     }
-     return ret;
- }
-+
-+static void vfio_iommu_spapr_class_init(ObjectClass *klass, void *data)
-+{
-+    VFIOIOMMUClass *vioc = VFIO_IOMMU_CLASS(klass);
-+
-+    vioc->add_window = vfio_spapr_container_add_section_window;
-+    vioc->del_window = vfio_spapr_container_del_section_window;
-+    vioc->release = vfio_spapr_container_release;
-+    vioc->setup = vfio_spapr_container_setup;
-+};
-+
-+static const TypeInfo types[] = {
-+    {
-+        .name = TYPE_VFIO_IOMMU_SPAPR,
-+        .parent = TYPE_VFIO_IOMMU_LEGACY,
-+        .class_init = vfio_iommu_spapr_class_init,
-+    },
-+};
-+
-+DEFINE_TYPES(types)
-diff --git a/include/hw/vfio/vfio-container-base.h b/include/hw/vfio/vfio-container-base.h
-index ce8b1fba88..9e21d7811f 100644
---- a/include/hw/vfio/vfio-container-base.h
-+++ b/include/hw/vfio/vfio-container-base.h
-@@ -95,6 +95,7 @@ void vfio_container_destroy(VFIOContainerBase *bcontainer);
- 
- #define TYPE_VFIO_IOMMU "vfio-iommu"
- #define TYPE_VFIO_IOMMU_LEGACY TYPE_VFIO_IOMMU "-legacy"
-+#define TYPE_VFIO_IOMMU_SPAPR TYPE_VFIO_IOMMU "-spapr"
- 
- /*
-  * VFIOContainerBase is not an abstract QOM object because it felt
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-spapr-Introduce-spapr-backend-and-target-interf.patch b/SOURCES/kvm-vfio-spapr-Introduce-spapr-backend-and-target-interf.patch
deleted file mode 100644
index f1ca4a2..0000000
--- a/SOURCES/kvm-vfio-spapr-Introduce-spapr-backend-and-target-interf.patch
+++ /dev/null
@@ -1,91 +0,0 @@
-From ff0c13c22878eed0f3879c0805bef5b9f9d83e04 Mon Sep 17 00:00:00 2001
-From: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Date: Thu, 2 Nov 2023 15:12:42 +0800
-Subject: [PATCH 017/101] vfio/spapr: Introduce spapr backend and target
- interface
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [16/67] e35cda157a2a1afeded3305622c861abd07edb51 (eauger1/centos-qemu-kvm)
-
-Introduce an empty spapr backend which will hold spapr specific
-content, currently only prereg_listener and hostwin_list.
-
-Also introduce two spapr specific callbacks add/del_window into
-VFIOIOMMUOps. Instantiate a spapr ops with a helper setup_spapr_ops
-and assign it to bcontainer->ops.
-
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 9b7d38bf5a2c1054bfe6de08806954cdc45d8d98)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/spapr.c                       | 14 ++++++++++++++
- include/hw/vfio/vfio-container-base.h |  6 ++++++
- 2 files changed, 20 insertions(+)
-
-diff --git a/hw/vfio/spapr.c b/hw/vfio/spapr.c
-index 7a50975f25..e1a6b35563 100644
---- a/hw/vfio/spapr.c
-+++ b/hw/vfio/spapr.c
-@@ -24,6 +24,10 @@
- #include "qapi/error.h"
- #include "trace.h"
- 
-+typedef struct VFIOSpaprContainer {
-+    VFIOContainer container;
-+} VFIOSpaprContainer;
-+
- static bool vfio_prereg_listener_skipped_section(MemoryRegionSection *section)
- {
-     if (memory_region_is_iommu(section->mr)) {
-@@ -421,6 +425,14 @@ void vfio_container_del_section_window(VFIOContainer *container,
-     }
- }
- 
-+static VFIOIOMMUOps vfio_iommu_spapr_ops;
-+
-+static void setup_spapr_ops(VFIOContainerBase *bcontainer)
-+{
-+    vfio_iommu_spapr_ops = *bcontainer->ops;
-+    bcontainer->ops = &vfio_iommu_spapr_ops;
-+}
-+
- int vfio_spapr_container_init(VFIOContainer *container, Error **errp)
- {
-     VFIOContainerBase *bcontainer = &container->bcontainer;
-@@ -486,6 +498,8 @@ int vfio_spapr_container_init(VFIOContainer *container, Error **errp)
-                           0x1000);
-     }
- 
-+    setup_spapr_ops(bcontainer);
-+
-     return 0;
- 
- listener_unregister_exit:
-diff --git a/include/hw/vfio/vfio-container-base.h b/include/hw/vfio/vfio-container-base.h
-index 9658ffb526..f62a14ac73 100644
---- a/include/hw/vfio/vfio-container-base.h
-+++ b/include/hw/vfio/vfio-container-base.h
-@@ -101,5 +101,11 @@ struct VFIOIOMMUOps {
-     int (*set_dirty_page_tracking)(VFIOContainerBase *bcontainer, bool start);
-     int (*query_dirty_bitmap)(VFIOContainerBase *bcontainer, VFIOBitmap *vbmap,
-                               hwaddr iova, hwaddr size);
-+    /* SPAPR specific */
-+    int (*add_window)(VFIOContainerBase *bcontainer,
-+                      MemoryRegionSection *section,
-+                      Error **errp);
-+    void (*del_window)(VFIOContainerBase *bcontainer,
-+                       MemoryRegionSection *section);
- };
- #endif /* HW_VFIO_VFIO_CONTAINER_BASE_H */
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-spapr-Move-hostwin_list-into-spapr-container.patch b/SOURCES/kvm-vfio-spapr-Move-hostwin_list-into-spapr-container.patch
deleted file mode 100644
index 93cb6b8..0000000
--- a/SOURCES/kvm-vfio-spapr-Move-hostwin_list-into-spapr-container.patch
+++ /dev/null
@@ -1,188 +0,0 @@
-From 3e9e7b57b15ac328f5d663b4e04df546d49f5fa6 Mon Sep 17 00:00:00 2001
-From: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Date: Thu, 2 Nov 2023 15:12:45 +0800
-Subject: [PATCH 020/101] vfio/spapr: Move hostwin_list into spapr container
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [19/67] 87cfeaa32ad32a260a89b2bb1866d59e20c0fe30 (eauger1/centos-qemu-kvm)
-
-No functional changes intended.
-
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit dbb9d0c9691d145338686d3e0920da047f2ab3da)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/spapr.c               | 36 +++++++++++++++++++----------------
- include/hw/vfio/vfio-common.h |  1 -
- 2 files changed, 20 insertions(+), 17 deletions(-)
-
-diff --git a/hw/vfio/spapr.c b/hw/vfio/spapr.c
-index 68c3dd6c75..5c6426e697 100644
---- a/hw/vfio/spapr.c
-+++ b/hw/vfio/spapr.c
-@@ -27,6 +27,7 @@
- typedef struct VFIOSpaprContainer {
-     VFIOContainer container;
-     MemoryListener prereg_listener;
-+    QLIST_HEAD(, VFIOHostDMAWindow) hostwin_list;
- } VFIOSpaprContainer;
- 
- static bool vfio_prereg_listener_skipped_section(MemoryRegionSection *section)
-@@ -154,12 +155,12 @@ static const MemoryListener vfio_prereg_listener = {
-     .region_del = vfio_prereg_listener_region_del,
- };
- 
--static void vfio_host_win_add(VFIOContainer *container, hwaddr min_iova,
-+static void vfio_host_win_add(VFIOSpaprContainer *scontainer, hwaddr min_iova,
-                               hwaddr max_iova, uint64_t iova_pgsizes)
- {
-     VFIOHostDMAWindow *hostwin;
- 
--    QLIST_FOREACH(hostwin, &container->hostwin_list, hostwin_next) {
-+    QLIST_FOREACH(hostwin, &scontainer->hostwin_list, hostwin_next) {
-         if (ranges_overlap(hostwin->min_iova,
-                            hostwin->max_iova - hostwin->min_iova + 1,
-                            min_iova,
-@@ -173,15 +174,15 @@ static void vfio_host_win_add(VFIOContainer *container, hwaddr min_iova,
-     hostwin->min_iova = min_iova;
-     hostwin->max_iova = max_iova;
-     hostwin->iova_pgsizes = iova_pgsizes;
--    QLIST_INSERT_HEAD(&container->hostwin_list, hostwin, hostwin_next);
-+    QLIST_INSERT_HEAD(&scontainer->hostwin_list, hostwin, hostwin_next);
- }
- 
--static int vfio_host_win_del(VFIOContainer *container,
-+static int vfio_host_win_del(VFIOSpaprContainer *scontainer,
-                              hwaddr min_iova, hwaddr max_iova)
- {
-     VFIOHostDMAWindow *hostwin;
- 
--    QLIST_FOREACH(hostwin, &container->hostwin_list, hostwin_next) {
-+    QLIST_FOREACH(hostwin, &scontainer->hostwin_list, hostwin_next) {
-         if (hostwin->min_iova == min_iova && hostwin->max_iova == max_iova) {
-             QLIST_REMOVE(hostwin, hostwin_next);
-             g_free(hostwin);
-@@ -192,7 +193,7 @@ static int vfio_host_win_del(VFIOContainer *container,
-     return -1;
- }
- 
--static VFIOHostDMAWindow *vfio_find_hostwin(VFIOContainer *container,
-+static VFIOHostDMAWindow *vfio_find_hostwin(VFIOSpaprContainer *container,
-                                             hwaddr iova, hwaddr end)
- {
-     VFIOHostDMAWindow *hostwin;
-@@ -329,6 +330,8 @@ vfio_spapr_container_add_section_window(VFIOContainerBase *bcontainer,
- {
-     VFIOContainer *container = container_of(bcontainer, VFIOContainer,
-                                             bcontainer);
-+    VFIOSpaprContainer *scontainer = container_of(container, VFIOSpaprContainer,
-+                                                  container);
-     VFIOHostDMAWindow *hostwin;
-     hwaddr pgsize = 0;
-     int ret;
-@@ -344,7 +347,7 @@ vfio_spapr_container_add_section_window(VFIOContainerBase *bcontainer,
-         iova = section->offset_within_address_space;
-         end = iova + int128_get64(section->size) - 1;
- 
--        if (!vfio_find_hostwin(container, iova, end)) {
-+        if (!vfio_find_hostwin(scontainer, iova, end)) {
-             error_setg(errp, "Container %p can't map guest IOVA region"
-                        " 0x%"HWADDR_PRIx"..0x%"HWADDR_PRIx, container,
-                        iova, end);
-@@ -358,7 +361,7 @@ vfio_spapr_container_add_section_window(VFIOContainerBase *bcontainer,
-     }
- 
-     /* For now intersections are not allowed, we may relax this later */
--    QLIST_FOREACH(hostwin, &container->hostwin_list, hostwin_next) {
-+    QLIST_FOREACH(hostwin, &scontainer->hostwin_list, hostwin_next) {
-         if (ranges_overlap(hostwin->min_iova,
-                            hostwin->max_iova - hostwin->min_iova + 1,
-                            section->offset_within_address_space,
-@@ -380,7 +383,7 @@ vfio_spapr_container_add_section_window(VFIOContainerBase *bcontainer,
-         return ret;
-     }
- 
--    vfio_host_win_add(container, section->offset_within_address_space,
-+    vfio_host_win_add(scontainer, section->offset_within_address_space,
-                       section->offset_within_address_space +
-                       int128_get64(section->size) - 1, pgsize);
- #ifdef CONFIG_KVM
-@@ -419,6 +422,8 @@ vfio_spapr_container_del_section_window(VFIOContainerBase *bcontainer,
- {
-     VFIOContainer *container = container_of(bcontainer, VFIOContainer,
-                                             bcontainer);
-+    VFIOSpaprContainer *scontainer = container_of(container, VFIOSpaprContainer,
-+                                                  container);
- 
-     if (container->iommu_type != VFIO_SPAPR_TCE_v2_IOMMU) {
-         return;
-@@ -426,7 +431,7 @@ vfio_spapr_container_del_section_window(VFIOContainerBase *bcontainer,
- 
-     vfio_spapr_remove_window(container,
-                              section->offset_within_address_space);
--    if (vfio_host_win_del(container,
-+    if (vfio_host_win_del(scontainer,
-                           section->offset_within_address_space,
-                           section->offset_within_address_space +
-                           int128_get64(section->size) - 1) < 0) {
-@@ -454,7 +459,7 @@ int vfio_spapr_container_init(VFIOContainer *container, Error **errp)
-     bool v2 = container->iommu_type == VFIO_SPAPR_TCE_v2_IOMMU;
-     int ret, fd = container->fd;
- 
--    QLIST_INIT(&container->hostwin_list);
-+    QLIST_INIT(&scontainer->hostwin_list);
- 
-     /*
-      * The host kernel code implementing VFIO_IOMMU_DISABLE is called
-@@ -506,7 +511,7 @@ int vfio_spapr_container_init(VFIOContainer *container, Error **errp)
-     } else {
-         /* The default table uses 4K pages */
-         bcontainer->pgsizes = 0x1000;
--        vfio_host_win_add(container, info.dma32_window_start,
-+        vfio_host_win_add(scontainer, info.dma32_window_start,
-                           info.dma32_window_start +
-                           info.dma32_window_size - 1,
-                           0x1000);
-@@ -525,15 +530,14 @@ listener_unregister_exit:
- 
- void vfio_spapr_container_deinit(VFIOContainer *container)
- {
-+    VFIOSpaprContainer *scontainer = container_of(container, VFIOSpaprContainer,
-+                                                  container);
-     VFIOHostDMAWindow *hostwin, *next;
- 
-     if (container->iommu_type == VFIO_SPAPR_TCE_v2_IOMMU) {
--        VFIOSpaprContainer *scontainer = container_of(container,
--                                                      VFIOSpaprContainer,
--                                                      container);
-         memory_listener_unregister(&scontainer->prereg_listener);
-     }
--    QLIST_FOREACH_SAFE(hostwin, &container->hostwin_list, hostwin_next,
-+    QLIST_FOREACH_SAFE(hostwin, &scontainer->hostwin_list, hostwin_next,
-                        next) {
-         QLIST_REMOVE(hostwin, hostwin_next);
-         g_free(hostwin);
-diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
-index ed6148c058..24ecc0e7ee 100644
---- a/include/hw/vfio/vfio-common.h
-+++ b/include/hw/vfio/vfio-common.h
-@@ -79,7 +79,6 @@ typedef struct VFIOContainer {
-     VFIOContainerBase bcontainer;
-     int fd; /* /dev/vfio/vfio, empowered by the attached groups */
-     unsigned iommu_type;
--    QLIST_HEAD(, VFIOHostDMAWindow) hostwin_list;
-     QLIST_HEAD(, VFIOGroup) group_list;
- } VFIOContainer;
- 
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-spapr-Move-prereg_listener-into-spapr-container.patch b/SOURCES/kvm-vfio-spapr-Move-prereg_listener-into-spapr-container.patch
deleted file mode 100644
index 1db4b55..0000000
--- a/SOURCES/kvm-vfio-spapr-Move-prereg_listener-into-spapr-container.patch
+++ /dev/null
@@ -1,120 +0,0 @@
-From 17e6dad3e43e173147c0ca33f6f1f4f317a77d0b Mon Sep 17 00:00:00 2001
-From: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Date: Thu, 2 Nov 2023 15:12:44 +0800
-Subject: [PATCH 019/101] vfio/spapr: Move prereg_listener into spapr container
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [18/67] dbea1b0b759e91b953271da92bba4ca6853bec82 (eauger1/centos-qemu-kvm)
-
-No functional changes intended.
-
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 6ad359ec29af7f21dcb206c8edb26905a4925f80)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/spapr.c               | 24 ++++++++++++++++--------
- include/hw/vfio/vfio-common.h |  1 -
- 2 files changed, 16 insertions(+), 9 deletions(-)
-
-diff --git a/hw/vfio/spapr.c b/hw/vfio/spapr.c
-index 5be1911aad..68c3dd6c75 100644
---- a/hw/vfio/spapr.c
-+++ b/hw/vfio/spapr.c
-@@ -26,6 +26,7 @@
- 
- typedef struct VFIOSpaprContainer {
-     VFIOContainer container;
-+    MemoryListener prereg_listener;
- } VFIOSpaprContainer;
- 
- static bool vfio_prereg_listener_skipped_section(MemoryRegionSection *section)
-@@ -48,8 +49,9 @@ static void *vfio_prereg_gpa_to_vaddr(MemoryRegionSection *section, hwaddr gpa)
- static void vfio_prereg_listener_region_add(MemoryListener *listener,
-                                             MemoryRegionSection *section)
- {
--    VFIOContainer *container = container_of(listener, VFIOContainer,
--                                            prereg_listener);
-+    VFIOSpaprContainer *scontainer = container_of(listener, VFIOSpaprContainer,
-+                                                  prereg_listener);
-+    VFIOContainer *container = &scontainer->container;
-     VFIOContainerBase *bcontainer = &container->bcontainer;
-     const hwaddr gpa = section->offset_within_address_space;
-     hwaddr end;
-@@ -107,8 +109,9 @@ static void vfio_prereg_listener_region_add(MemoryListener *listener,
- static void vfio_prereg_listener_region_del(MemoryListener *listener,
-                                             MemoryRegionSection *section)
- {
--    VFIOContainer *container = container_of(listener, VFIOContainer,
--                                            prereg_listener);
-+    VFIOSpaprContainer *scontainer = container_of(listener, VFIOSpaprContainer,
-+                                                  prereg_listener);
-+    VFIOContainer *container = &scontainer->container;
-     const hwaddr gpa = section->offset_within_address_space;
-     hwaddr end;
-     int ret;
-@@ -445,6 +448,8 @@ static void setup_spapr_ops(VFIOContainerBase *bcontainer)
- int vfio_spapr_container_init(VFIOContainer *container, Error **errp)
- {
-     VFIOContainerBase *bcontainer = &container->bcontainer;
-+    VFIOSpaprContainer *scontainer = container_of(container, VFIOSpaprContainer,
-+                                                  container);
-     struct vfio_iommu_spapr_tce_info info;
-     bool v2 = container->iommu_type == VFIO_SPAPR_TCE_v2_IOMMU;
-     int ret, fd = container->fd;
-@@ -463,9 +468,9 @@ int vfio_spapr_container_init(VFIOContainer *container, Error **errp)
-             return -errno;
-         }
-     } else {
--        container->prereg_listener = vfio_prereg_listener;
-+        scontainer->prereg_listener = vfio_prereg_listener;
- 
--        memory_listener_register(&container->prereg_listener,
-+        memory_listener_register(&scontainer->prereg_listener,
-                                  &address_space_memory);
-         if (bcontainer->error) {
-             ret = -1;
-@@ -513,7 +518,7 @@ int vfio_spapr_container_init(VFIOContainer *container, Error **errp)
- 
- listener_unregister_exit:
-     if (v2) {
--        memory_listener_unregister(&container->prereg_listener);
-+        memory_listener_unregister(&scontainer->prereg_listener);
-     }
-     return ret;
- }
-@@ -523,7 +528,10 @@ void vfio_spapr_container_deinit(VFIOContainer *container)
-     VFIOHostDMAWindow *hostwin, *next;
- 
-     if (container->iommu_type == VFIO_SPAPR_TCE_v2_IOMMU) {
--        memory_listener_unregister(&container->prereg_listener);
-+        VFIOSpaprContainer *scontainer = container_of(container,
-+                                                      VFIOSpaprContainer,
-+                                                      container);
-+        memory_listener_unregister(&scontainer->prereg_listener);
-     }
-     QLIST_FOREACH_SAFE(hostwin, &container->hostwin_list, hostwin_next,
-                        next) {
-diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
-index 055f679363..ed6148c058 100644
---- a/include/hw/vfio/vfio-common.h
-+++ b/include/hw/vfio/vfio-common.h
-@@ -78,7 +78,6 @@ struct VFIOGroup;
- typedef struct VFIOContainer {
-     VFIOContainerBase bcontainer;
-     int fd; /* /dev/vfio/vfio, empowered by the attached groups */
--    MemoryListener prereg_listener;
-     unsigned iommu_type;
-     QLIST_HEAD(, VFIOHostDMAWindow) hostwin_list;
-     QLIST_HEAD(, VFIOGroup) group_list;
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-spapr-Only-compile-sPAPR-IOMMU-support-when-nee.patch b/SOURCES/kvm-vfio-spapr-Only-compile-sPAPR-IOMMU-support-when-nee.patch
deleted file mode 100644
index 7762804..0000000
--- a/SOURCES/kvm-vfio-spapr-Only-compile-sPAPR-IOMMU-support-when-nee.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From 5d485eb1442a81b51688124ce30024e96490acbf Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
-Date: Tue, 19 Dec 2023 07:58:24 +0100
-Subject: [PATCH 057/101] vfio/spapr: Only compile sPAPR IOMMU support when
- needed
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [56/67] 4dc0cbde470f877a8aac2bf6fab6923f2f919285 (eauger1/centos-qemu-kvm)
-
-sPAPR IOMMU support is only needed for pseries machines. Compile out
-support when CONFIG_PSERIES is not set. This saves ~7K of text.
-
-Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Tested-by: Eric Farman <farman@linux.ibm.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 10164df6ed3d41cbf67105dcd954a663ef4cc3e9)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/meson.build | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/hw/vfio/meson.build b/hw/vfio/meson.build
-index e5d98b6adc..bb98493b53 100644
---- a/hw/vfio/meson.build
-+++ b/hw/vfio/meson.build
-@@ -4,9 +4,9 @@ vfio_ss.add(files(
-   'common.c',
-   'container-base.c',
-   'container.c',
--  'spapr.c',
-   'migration.c',
- ))
-+vfio_ss.add(when: 'CONFIG_PSERIES', if_true: files('spapr.c'))
- vfio_ss.add(when: 'CONFIG_IOMMUFD', if_true: files(
-   'iommufd.c',
- ))
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-vfio-spapr-switch-to-spapr-IOMMU-BE-add-del_section_.patch b/SOURCES/kvm-vfio-spapr-switch-to-spapr-IOMMU-BE-add-del_section_.patch
deleted file mode 100644
index 4d8db61..0000000
--- a/SOURCES/kvm-vfio-spapr-switch-to-spapr-IOMMU-BE-add-del_section_.patch
+++ /dev/null
@@ -1,184 +0,0 @@
-From 3b7f044f15b4a9daf4ad7eda58777aba6dbe3fc0 Mon Sep 17 00:00:00 2001
-From: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Date: Thu, 2 Nov 2023 15:12:43 +0800
-Subject: [PATCH 018/101] vfio/spapr: switch to spapr IOMMU BE
- add/del_section_window
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Eric Auger <eric.auger@redhat.com>
-RH-MergeRequest: 211: IOMMUFD backend backport
-RH-Jira: RHEL-19302 RHEL-21057
-RH-Acked-by: Cédric Le Goater <clg@redhat.com>
-RH-Acked-by: Sebastian Ott <sebott@redhat.com>
-RH-Commit: [17/67] a0d9f1f2d4d2592f3d9fc2ee5b2c38236a986e38 (eauger1/centos-qemu-kvm)
-
-No functional change intended.
-
-Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 233309e8e4c158af6c6b126d5ad021bae40a918a)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
----
- hw/vfio/common.c                      |  8 ++------
- hw/vfio/container-base.c              | 21 +++++++++++++++++++++
- hw/vfio/spapr.c                       | 19 ++++++++++++++-----
- include/hw/vfio/vfio-common.h         |  5 -----
- include/hw/vfio/vfio-container-base.h |  5 +++++
- 5 files changed, 42 insertions(+), 16 deletions(-)
-
-diff --git a/hw/vfio/common.c b/hw/vfio/common.c
-index 483ba82089..572ae7c934 100644
---- a/hw/vfio/common.c
-+++ b/hw/vfio/common.c
-@@ -571,8 +571,6 @@ static void vfio_listener_region_add(MemoryListener *listener,
- {
-     VFIOContainerBase *bcontainer = container_of(listener, VFIOContainerBase,
-                                                  listener);
--    VFIOContainer *container = container_of(bcontainer, VFIOContainer,
--                                            bcontainer);
-     hwaddr iova, end;
-     Int128 llend, llsize;
-     void *vaddr;
-@@ -595,7 +593,7 @@ static void vfio_listener_region_add(MemoryListener *listener,
-         return;
-     }
- 
--    if (vfio_container_add_section_window(container, section, &err)) {
-+    if (vfio_container_add_section_window(bcontainer, section, &err)) {
-         goto fail;
-     }
- 
-@@ -738,8 +736,6 @@ static void vfio_listener_region_del(MemoryListener *listener,
- {
-     VFIOContainerBase *bcontainer = container_of(listener, VFIOContainerBase,
-                                                  listener);
--    VFIOContainer *container = container_of(bcontainer, VFIOContainer,
--                                            bcontainer);
-     hwaddr iova, end;
-     Int128 llend, llsize;
-     int ret;
-@@ -818,7 +814,7 @@ static void vfio_listener_region_del(MemoryListener *listener,
- 
-     memory_region_unref(section->mr);
- 
--    vfio_container_del_section_window(container, section);
-+    vfio_container_del_section_window(bcontainer, section);
- }
- 
- typedef struct VFIODirtyRanges {
-diff --git a/hw/vfio/container-base.c b/hw/vfio/container-base.c
-index 0177f43741..71f7274973 100644
---- a/hw/vfio/container-base.c
-+++ b/hw/vfio/container-base.c
-@@ -31,6 +31,27 @@ int vfio_container_dma_unmap(VFIOContainerBase *bcontainer,
-     return bcontainer->ops->dma_unmap(bcontainer, iova, size, iotlb);
- }
- 
-+int vfio_container_add_section_window(VFIOContainerBase *bcontainer,
-+                                      MemoryRegionSection *section,
-+                                      Error **errp)
-+{
-+    if (!bcontainer->ops->add_window) {
-+        return 0;
-+    }
-+
-+    return bcontainer->ops->add_window(bcontainer, section, errp);
-+}
-+
-+void vfio_container_del_section_window(VFIOContainerBase *bcontainer,
-+                                       MemoryRegionSection *section)
-+{
-+    if (!bcontainer->ops->del_window) {
-+        return;
-+    }
-+
-+    return bcontainer->ops->del_window(bcontainer, section);
-+}
-+
- int vfio_container_set_dirty_page_tracking(VFIOContainerBase *bcontainer,
-                                            bool start)
- {
-diff --git a/hw/vfio/spapr.c b/hw/vfio/spapr.c
-index e1a6b35563..5be1911aad 100644
---- a/hw/vfio/spapr.c
-+++ b/hw/vfio/spapr.c
-@@ -319,10 +319,13 @@ static int vfio_spapr_create_window(VFIOContainer *container,
-     return 0;
- }
- 
--int vfio_container_add_section_window(VFIOContainer *container,
--                                      MemoryRegionSection *section,
--                                      Error **errp)
-+static int
-+vfio_spapr_container_add_section_window(VFIOContainerBase *bcontainer,
-+                                        MemoryRegionSection *section,
-+                                        Error **errp)
- {
-+    VFIOContainer *container = container_of(bcontainer, VFIOContainer,
-+                                            bcontainer);
-     VFIOHostDMAWindow *hostwin;
-     hwaddr pgsize = 0;
-     int ret;
-@@ -407,9 +410,13 @@ int vfio_container_add_section_window(VFIOContainer *container,
-     return 0;
- }
- 
--void vfio_container_del_section_window(VFIOContainer *container,
--                                       MemoryRegionSection *section)
-+static void
-+vfio_spapr_container_del_section_window(VFIOContainerBase *bcontainer,
-+                                        MemoryRegionSection *section)
- {
-+    VFIOContainer *container = container_of(bcontainer, VFIOContainer,
-+                                            bcontainer);
-+
-     if (container->iommu_type != VFIO_SPAPR_TCE_v2_IOMMU) {
-         return;
-     }
-@@ -430,6 +437,8 @@ static VFIOIOMMUOps vfio_iommu_spapr_ops;
- static void setup_spapr_ops(VFIOContainerBase *bcontainer)
- {
-     vfio_iommu_spapr_ops = *bcontainer->ops;
-+    vfio_iommu_spapr_ops.add_window = vfio_spapr_container_add_section_window;
-+    vfio_iommu_spapr_ops.del_window = vfio_spapr_container_del_section_window;
-     bcontainer->ops = &vfio_iommu_spapr_ops;
- }
- 
-diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
-index b9e5a0e64b..055f679363 100644
---- a/include/hw/vfio/vfio-common.h
-+++ b/include/hw/vfio/vfio-common.h
-@@ -169,11 +169,6 @@ VFIOAddressSpace *vfio_get_address_space(AddressSpace *as);
- void vfio_put_address_space(VFIOAddressSpace *space);
- 
- /* SPAPR specific */
--int vfio_container_add_section_window(VFIOContainer *container,
--                                      MemoryRegionSection *section,
--                                      Error **errp);
--void vfio_container_del_section_window(VFIOContainer *container,
--                                       MemoryRegionSection *section);
- int vfio_spapr_container_init(VFIOContainer *container, Error **errp);
- void vfio_spapr_container_deinit(VFIOContainer *container);
- 
-diff --git a/include/hw/vfio/vfio-container-base.h b/include/hw/vfio/vfio-container-base.h
-index f62a14ac73..4b6f017c6f 100644
---- a/include/hw/vfio/vfio-container-base.h
-+++ b/include/hw/vfio/vfio-container-base.h
-@@ -75,6 +75,11 @@ int vfio_container_dma_map(VFIOContainerBase *bcontainer,
- int vfio_container_dma_unmap(VFIOContainerBase *bcontainer,
-                              hwaddr iova, ram_addr_t size,
-                              IOMMUTLBEntry *iotlb);
-+int vfio_container_add_section_window(VFIOContainerBase *bcontainer,
-+                                      MemoryRegionSection *section,
-+                                      Error **errp);
-+void vfio_container_del_section_window(VFIOContainerBase *bcontainer,
-+                                       MemoryRegionSection *section);
- int vfio_container_set_dirty_page_tracking(VFIOContainerBase *bcontainer,
-                                            bool start);
- int vfio_container_query_dirty_bitmap(VFIOContainerBase *bcontainer,
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-virtio-Re-enable-notifications-after-drain.patch b/SOURCES/kvm-virtio-Re-enable-notifications-after-drain.patch
deleted file mode 100644
index ef770fd..0000000
--- a/SOURCES/kvm-virtio-Re-enable-notifications-after-drain.patch
+++ /dev/null
@@ -1,139 +0,0 @@
-From 2a758da4e1433564998def68447008908c96e113 Mon Sep 17 00:00:00 2001
-From: Hanna Czenczek <hreitz@redhat.com>
-Date: Fri, 2 Feb 2024 16:31:57 +0100
-Subject: [PATCH 2/6] virtio: Re-enable notifications after drain
-
-RH-Author: Hanna Czenczek <hreitz@redhat.com>
-RH-MergeRequest: 223: virtio: Re-enable notifications after drain
-RH-Jira: RHEL-3934
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [2/3] e3be798e6259a378fc03f4364ecaeb875b01f64c (hreitz/qemu-kvm-c-9-s)
-
-During drain, we do not care about virtqueue notifications, which is why
-we remove the handlers on it.  When removing those handlers, whether vq
-notifications are enabled or not depends on whether we were in polling
-mode or not; if not, they are enabled (by default); if so, they have
-been disabled by the io_poll_start callback.
-
-Because we do not care about those notifications after removing the
-handlers, this is fine.  However, we have to explicitly ensure they are
-enabled when re-attaching the handlers, so we will resume receiving
-notifications.  We do this in virtio_queue_aio_attach_host_notifier*().
-If such a function is called while we are in a polling section,
-attaching the notifiers will then invoke the io_poll_start callback,
-re-disabling notifications.
-
-Because we will always miss virtqueue updates in the drained section, we
-also need to poll the virtqueue once after attaching the notifiers.
-
-Buglink: https://issues.redhat.com/browse/RHEL-3934
-Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
-Message-ID: <20240202153158.788922-3-hreitz@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 5bdbaebcce18fe6a627cafad2043ec08f3de5744)
----
- hw/virtio/virtio.c  | 42 ++++++++++++++++++++++++++++++++++++++++++
- include/block/aio.h |  7 ++++++-
- 2 files changed, 48 insertions(+), 1 deletion(-)
-
-diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
-index 3a160f86ed..356d690cc9 100644
---- a/hw/virtio/virtio.c
-+++ b/hw/virtio/virtio.c
-@@ -3556,6 +3556,17 @@ static void virtio_queue_host_notifier_aio_poll_end(EventNotifier *n)
- 
- void virtio_queue_aio_attach_host_notifier(VirtQueue *vq, AioContext *ctx)
- {
-+    /*
-+     * virtio_queue_aio_detach_host_notifier() can leave notifications disabled.
-+     * Re-enable them.  (And if detach has not been used before, notifications
-+     * being enabled is still the default state while a notifier is attached;
-+     * see virtio_queue_host_notifier_aio_poll_end(), which will always leave
-+     * notifications enabled once the polling section is left.)
-+     */
-+    if (!virtio_queue_get_notification(vq)) {
-+        virtio_queue_set_notification(vq, 1);
-+    }
-+
-     aio_set_event_notifier(ctx, &vq->host_notifier,
-                            virtio_queue_host_notifier_read,
-                            virtio_queue_host_notifier_aio_poll,
-@@ -3563,6 +3574,13 @@ void virtio_queue_aio_attach_host_notifier(VirtQueue *vq, AioContext *ctx)
-     aio_set_event_notifier_poll(ctx, &vq->host_notifier,
-                                 virtio_queue_host_notifier_aio_poll_begin,
-                                 virtio_queue_host_notifier_aio_poll_end);
-+
-+    /*
-+     * We will have ignored notifications about new requests from the guest
-+     * while no notifiers were attached, so "kick" the virt queue to process
-+     * those requests now.
-+     */
-+    event_notifier_set(&vq->host_notifier);
- }
- 
- /*
-@@ -3573,14 +3591,38 @@ void virtio_queue_aio_attach_host_notifier(VirtQueue *vq, AioContext *ctx)
-  */
- void virtio_queue_aio_attach_host_notifier_no_poll(VirtQueue *vq, AioContext *ctx)
- {
-+    /* See virtio_queue_aio_attach_host_notifier() */
-+    if (!virtio_queue_get_notification(vq)) {
-+        virtio_queue_set_notification(vq, 1);
-+    }
-+
-     aio_set_event_notifier(ctx, &vq->host_notifier,
-                            virtio_queue_host_notifier_read,
-                            NULL, NULL);
-+
-+    /*
-+     * See virtio_queue_aio_attach_host_notifier().
-+     * Note that this may be unnecessary for the type of virtqueues this
-+     * function is used for.  Still, it will not hurt to have a quick look into
-+     * whether we can/should process any of the virtqueue elements.
-+     */
-+    event_notifier_set(&vq->host_notifier);
- }
- 
- void virtio_queue_aio_detach_host_notifier(VirtQueue *vq, AioContext *ctx)
- {
-     aio_set_event_notifier(ctx, &vq->host_notifier, NULL, NULL, NULL);
-+
-+    /*
-+     * aio_set_event_notifier_poll() does not guarantee whether io_poll_end()
-+     * will run after io_poll_begin(), so by removing the notifier, we do not
-+     * know whether virtio_queue_host_notifier_aio_poll_end() has run after a
-+     * previous virtio_queue_host_notifier_aio_poll_begin(), i.e. whether
-+     * notifications are enabled or disabled.  It does not really matter anyway;
-+     * we just removed the notifier, so we do not care about notifications until
-+     * we potentially re-attach it.  The attach_host_notifier functions will
-+     * ensure that notifications are enabled again when they are needed.
-+     */
- }
- 
- void virtio_queue_host_notifier_read(EventNotifier *n)
-diff --git a/include/block/aio.h b/include/block/aio.h
-index af05512a7d..261c77fd9a 100644
---- a/include/block/aio.h
-+++ b/include/block/aio.h
-@@ -480,9 +480,14 @@ void aio_set_event_notifier(AioContext *ctx,
-                             AioPollFn *io_poll,
-                             EventNotifierHandler *io_poll_ready);
- 
--/* Set polling begin/end callbacks for an event notifier that has already been
-+/*
-+ * Set polling begin/end callbacks for an event notifier that has already been
-  * registered with aio_set_event_notifier.  Do nothing if the event notifier is
-  * not registered.
-+ *
-+ * Note that if the io_poll_end() callback (or the entire notifier) is removed
-+ * during polling, it will not be called, so an io_poll_begin() is not
-+ * necessarily always followed by an io_poll_end().
-  */
- void aio_set_event_notifier_poll(AioContext *ctx,
-                                  EventNotifier *notifier,
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-virtio-blk-Fix-potential-nullpointer-read-access-in-.patch b/SOURCES/kvm-virtio-blk-Fix-potential-nullpointer-read-access-in-.patch
deleted file mode 100644
index 0565357..0000000
--- a/SOURCES/kvm-virtio-blk-Fix-potential-nullpointer-read-access-in-.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From 376df80fbba5a9bb0ec43cad083cde9de59128d7 Mon Sep 17 00:00:00 2001
-From: Stefan Weil via <qemu-trivial@nongnu.org>
-Date: Sun, 24 Dec 2023 12:43:14 +0100
-Subject: [PATCH 10/22] virtio-blk: Fix potential nullpointer read access in
- virtio_blk_data_plane_destroy
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 219: virtio-blk: add iothread-vq-mapping parameter
-RH-Jira: RHEL-17369 RHEL-20764 RHEL-7356
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Commit: [6/17] 460005fc7719b2e1dd577dfe75d18537ab2b8d06 (stefanha/centos-stream-qemu-kvm)
-
-Fixes: CID 1532828
-Fixes: b6948ab01d ("virtio-blk: add iothread-vq-mapping parameter")
-Signed-off-by: Stefan Weil <sw@weilnetz.de>
-Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
-(cherry picked from commit d819fc9516a4ec71e37a6c9edfcd285b7f98c2dc)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- hw/block/dataplane/virtio-blk.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/hw/block/dataplane/virtio-blk.c b/hw/block/dataplane/virtio-blk.c
-index 6debd4401e..97a302cf49 100644
---- a/hw/block/dataplane/virtio-blk.c
-+++ b/hw/block/dataplane/virtio-blk.c
-@@ -152,7 +152,7 @@ bool virtio_blk_data_plane_create(VirtIODevice *vdev, VirtIOBlkConf *conf,
- void virtio_blk_data_plane_destroy(VirtIOBlockDataPlane *s)
- {
-     VirtIOBlock *vblk;
--    VirtIOBlkConf *conf = s->conf;
-+    VirtIOBlkConf *conf;
- 
-     if (!s) {
-         return;
-@@ -160,6 +160,7 @@ void virtio_blk_data_plane_destroy(VirtIOBlockDataPlane *s)
- 
-     vblk = VIRTIO_BLK(s->vdev);
-     assert(!vblk->dataplane_started);
-+    conf = s->conf;
- 
-     if (conf->iothread_vq_mapping_list) {
-         IOThreadVirtQueueMappingList *node;
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-virtio-blk-Use-ioeventfd_attach-in-start_ioeventfd.patch b/SOURCES/kvm-virtio-blk-Use-ioeventfd_attach-in-start_ioeventfd.patch
deleted file mode 100644
index 1a3771e..0000000
--- a/SOURCES/kvm-virtio-blk-Use-ioeventfd_attach-in-start_ioeventfd.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-From 094941b2c3e66e078d93718933eb07e800a7dd60 Mon Sep 17 00:00:00 2001
-From: Hanna Czenczek <hreitz@redhat.com>
-Date: Fri, 2 Feb 2024 16:31:58 +0100
-Subject: [PATCH 3/6] virtio-blk: Use ioeventfd_attach in start_ioeventfd
-
-RH-Author: Hanna Czenczek <hreitz@redhat.com>
-RH-MergeRequest: 223: virtio: Re-enable notifications after drain
-RH-Jira: RHEL-3934
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [3/3] 96d6760d1b7b12df695b6825b15a2a3b8a79a74c (hreitz/qemu-kvm-c-9-s)
-
-Commit d3f6f294aeadd5f88caf0155e4360808c95b3146 ("virtio-blk: always set
-ioeventfd during startup") has made virtio_blk_start_ioeventfd() always
-kick the virtqueue (set the ioeventfd), regardless of whether the BB is
-drained.  That is no longer necessary, because attaching the host
-notifier will now set the ioeventfd, too; this happens either
-immediately right here in virtio_blk_start_ioeventfd(), or later when
-the drain ends, in virtio_blk_ioeventfd_attach().
-
-With event_notifier_set() removed, the code becomes the same as the one
-in virtio_blk_ioeventfd_attach(), so we can reuse that function.
-
-Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
-Message-ID: <20240202153158.788922-4-hreitz@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 52bff01f64eec017ffb0d5903a0ee1d67ca7a548)
----
- hw/block/virtio-blk.c | 21 ++++++++++-----------
- 1 file changed, 10 insertions(+), 11 deletions(-)
-
-diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
-index 0b9100b746..7fdeaf2d12 100644
---- a/hw/block/virtio-blk.c
-+++ b/hw/block/virtio-blk.c
-@@ -37,6 +37,8 @@
- #include "hw/virtio/virtio-blk-common.h"
- #include "qemu/coroutine.h"
- 
-+static void virtio_blk_ioeventfd_attach(VirtIOBlock *s);
-+
- static void virtio_blk_init_request(VirtIOBlock *s, VirtQueue *vq,
-                                     VirtIOBlockReq *req)
- {
-@@ -1808,17 +1810,14 @@ static int virtio_blk_start_ioeventfd(VirtIODevice *vdev)
-     s->ioeventfd_started = true;
-     smp_wmb(); /* paired with aio_notify_accept() on the read side */
- 
--    /* Get this show started by hooking up our callbacks */
--    for (i = 0; i < nvqs; i++) {
--        VirtQueue *vq = virtio_get_queue(vdev, i);
--        AioContext *ctx = s->vq_aio_context[i];
--
--        /* Kick right away to begin processing requests already in vring */
--        event_notifier_set(virtio_queue_get_host_notifier(vq));
--
--        if (!blk_in_drain(s->conf.conf.blk)) {
--            virtio_queue_aio_attach_host_notifier(vq, ctx);
--        }
-+    /*
-+     * Get this show started by hooking up our callbacks.  If drained now,
-+     * virtio_blk_drained_end() will do this later.
-+     * Attaching the notifier also kicks the virtqueues, processing any requests
-+     * they may already have.
-+     */
-+    if (!blk_in_drain(s->conf.conf.blk)) {
-+        virtio_blk_ioeventfd_attach(s);
-     }
-     return 0;
- 
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-virtio-blk-add-iothread-vq-mapping-parameter.patch b/SOURCES/kvm-virtio-blk-add-iothread-vq-mapping-parameter.patch
deleted file mode 100644
index 65a96a0..0000000
--- a/SOURCES/kvm-virtio-blk-add-iothread-vq-mapping-parameter.patch
+++ /dev/null
@@ -1,464 +0,0 @@
-From 733fc13f65286c849ad6618be89df450f8bc5f7e Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Wed, 20 Dec 2023 08:47:55 -0500
-Subject: [PATCH 09/22] virtio-blk: add iothread-vq-mapping parameter
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 219: virtio-blk: add iothread-vq-mapping parameter
-RH-Jira: RHEL-17369 RHEL-20764 RHEL-7356
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Commit: [5/17] c371fe62376c4eb54da88272a5966cec28404224 (stefanha/centos-stream-qemu-kvm)
-
-Add the iothread-vq-mapping parameter to assign virtqueues to IOThreads.
-Store the vq:AioContext mapping in the new struct
-VirtIOBlockDataPlane->vq_aio_context[] field and refactor the code to
-use the per-vq AioContext instead of the BlockDriverState's AioContext.
-
-Reimplement --device virtio-blk-pci,iothread= and non-IOThread mode by
-assigning all virtqueues to the IOThread and main loop's AioContext in
-vq_aio_context[], respectively.
-
-The comment in struct VirtIOBlockDataPlane about EventNotifiers is
-stale. Remove it.
-
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20231220134755.814917-5-stefanha@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit b6948ab01df068bef591868c22d1f873d2d05cde)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- hw/block/dataplane/virtio-blk.c | 155 ++++++++++++++++++++++++--------
- hw/block/dataplane/virtio-blk.h |   3 +
- hw/block/virtio-blk.c           |  92 ++++++++++++++++---
- include/hw/virtio/virtio-blk.h  |   2 +
- 4 files changed, 202 insertions(+), 50 deletions(-)
-
-diff --git a/hw/block/dataplane/virtio-blk.c b/hw/block/dataplane/virtio-blk.c
-index 7bbbd981ad..6debd4401e 100644
---- a/hw/block/dataplane/virtio-blk.c
-+++ b/hw/block/dataplane/virtio-blk.c
-@@ -32,13 +32,11 @@ struct VirtIOBlockDataPlane {
-     VirtIOBlkConf *conf;
-     VirtIODevice *vdev;
- 
--    /* Note that these EventNotifiers are assigned by value.  This is
--     * fine as long as you do not call event_notifier_cleanup on them
--     * (because you don't own the file descriptor or handle; you just
--     * use it).
-+    /*
-+     * The AioContext for each virtqueue. The BlockDriverState will use the
-+     * first element as its AioContext.
-      */
--    IOThread *iothread;
--    AioContext *ctx;
-+    AioContext **vq_aio_context;
- };
- 
- /* Raise an interrupt to signal guest, if necessary */
-@@ -47,6 +45,45 @@ void virtio_blk_data_plane_notify(VirtIOBlockDataPlane *s, VirtQueue *vq)
-     virtio_notify_irqfd(s->vdev, vq);
- }
- 
-+/* Generate vq:AioContext mappings from a validated iothread-vq-mapping list */
-+static void
-+apply_vq_mapping(IOThreadVirtQueueMappingList *iothread_vq_mapping_list,
-+                 AioContext **vq_aio_context, uint16_t num_queues)
-+{
-+    IOThreadVirtQueueMappingList *node;
-+    size_t num_iothreads = 0;
-+    size_t cur_iothread = 0;
-+
-+    for (node = iothread_vq_mapping_list; node; node = node->next) {
-+        num_iothreads++;
-+    }
-+
-+    for (node = iothread_vq_mapping_list; node; node = node->next) {
-+        IOThread *iothread = iothread_by_id(node->value->iothread);
-+        AioContext *ctx = iothread_get_aio_context(iothread);
-+
-+        /* Released in virtio_blk_data_plane_destroy() */
-+        object_ref(OBJECT(iothread));
-+
-+        if (node->value->vqs) {
-+            uint16List *vq;
-+
-+            /* Explicit vq:IOThread assignment */
-+            for (vq = node->value->vqs; vq; vq = vq->next) {
-+                vq_aio_context[vq->value] = ctx;
-+            }
-+        } else {
-+            /* Round-robin vq:IOThread assignment */
-+            for (unsigned i = cur_iothread; i < num_queues;
-+                 i += num_iothreads) {
-+                vq_aio_context[i] = ctx;
-+            }
-+        }
-+
-+        cur_iothread++;
-+    }
-+}
-+
- /* Context: QEMU global mutex held */
- bool virtio_blk_data_plane_create(VirtIODevice *vdev, VirtIOBlkConf *conf,
-                                   VirtIOBlockDataPlane **dataplane,
-@@ -58,7 +95,7 @@ bool virtio_blk_data_plane_create(VirtIODevice *vdev, VirtIOBlkConf *conf,
- 
-     *dataplane = NULL;
- 
--    if (conf->iothread) {
-+    if (conf->iothread || conf->iothread_vq_mapping_list) {
-         if (!k->set_guest_notifiers || !k->ioeventfd_assign) {
-             error_setg(errp,
-                        "device is incompatible with iothread "
-@@ -86,13 +123,24 @@ bool virtio_blk_data_plane_create(VirtIODevice *vdev, VirtIOBlkConf *conf,
-     s = g_new0(VirtIOBlockDataPlane, 1);
-     s->vdev = vdev;
-     s->conf = conf;
-+    s->vq_aio_context = g_new(AioContext *, conf->num_queues);
-+
-+    if (conf->iothread_vq_mapping_list) {
-+        apply_vq_mapping(conf->iothread_vq_mapping_list, s->vq_aio_context,
-+                         conf->num_queues);
-+    } else if (conf->iothread) {
-+        AioContext *ctx = iothread_get_aio_context(conf->iothread);
-+        for (unsigned i = 0; i < conf->num_queues; i++) {
-+            s->vq_aio_context[i] = ctx;
-+        }
- 
--    if (conf->iothread) {
--        s->iothread = conf->iothread;
--        object_ref(OBJECT(s->iothread));
--        s->ctx = iothread_get_aio_context(s->iothread);
-+        /* Released in virtio_blk_data_plane_destroy() */
-+        object_ref(OBJECT(conf->iothread));
-     } else {
--        s->ctx = qemu_get_aio_context();
-+        AioContext *ctx = qemu_get_aio_context();
-+        for (unsigned i = 0; i < conf->num_queues; i++) {
-+            s->vq_aio_context[i] = ctx;
-+        }
-     }
- 
-     *dataplane = s;
-@@ -104,6 +152,7 @@ bool virtio_blk_data_plane_create(VirtIODevice *vdev, VirtIOBlkConf *conf,
- void virtio_blk_data_plane_destroy(VirtIOBlockDataPlane *s)
- {
-     VirtIOBlock *vblk;
-+    VirtIOBlkConf *conf = s->conf;
- 
-     if (!s) {
-         return;
-@@ -111,9 +160,21 @@ void virtio_blk_data_plane_destroy(VirtIOBlockDataPlane *s)
- 
-     vblk = VIRTIO_BLK(s->vdev);
-     assert(!vblk->dataplane_started);
--    if (s->iothread) {
--        object_unref(OBJECT(s->iothread));
-+
-+    if (conf->iothread_vq_mapping_list) {
-+        IOThreadVirtQueueMappingList *node;
-+
-+        for (node = conf->iothread_vq_mapping_list; node; node = node->next) {
-+            IOThread *iothread = iothread_by_id(node->value->iothread);
-+            object_unref(OBJECT(iothread));
-+        }
-+    }
-+
-+    if (conf->iothread) {
-+        object_unref(OBJECT(conf->iothread));
-     }
-+
-+    g_free(s->vq_aio_context);
-     g_free(s);
- }
- 
-@@ -177,19 +238,13 @@ int virtio_blk_data_plane_start(VirtIODevice *vdev)
- 
-     trace_virtio_blk_data_plane_start(s);
- 
--    r = blk_set_aio_context(s->conf->conf.blk, s->ctx, &local_err);
-+    r = blk_set_aio_context(s->conf->conf.blk, s->vq_aio_context[0],
-+                            &local_err);
-     if (r < 0) {
-         error_report_err(local_err);
-         goto fail_aio_context;
-     }
- 
--    /* Kick right away to begin processing requests already in vring */
--    for (i = 0; i < nvqs; i++) {
--        VirtQueue *vq = virtio_get_queue(s->vdev, i);
--
--        event_notifier_set(virtio_queue_get_host_notifier(vq));
--    }
--
-     /*
-      * These fields must be visible to the IOThread when it processes the
-      * virtqueue, otherwise it will think dataplane has not started yet.
-@@ -206,8 +261,12 @@ int virtio_blk_data_plane_start(VirtIODevice *vdev)
-     if (!blk_in_drain(s->conf->conf.blk)) {
-         for (i = 0; i < nvqs; i++) {
-             VirtQueue *vq = virtio_get_queue(s->vdev, i);
-+            AioContext *ctx = s->vq_aio_context[i];
- 
--            virtio_queue_aio_attach_host_notifier(vq, s->ctx);
-+            /* Kick right away to begin processing requests already in vring */
-+            event_notifier_set(virtio_queue_get_host_notifier(vq));
-+
-+            virtio_queue_aio_attach_host_notifier(vq, ctx);
-         }
-     }
-     return 0;
-@@ -236,23 +295,18 @@ int virtio_blk_data_plane_start(VirtIODevice *vdev)
-  *
-  * Context: BH in IOThread
-  */
--static void virtio_blk_data_plane_stop_bh(void *opaque)
-+static void virtio_blk_data_plane_stop_vq_bh(void *opaque)
- {
--    VirtIOBlockDataPlane *s = opaque;
--    unsigned i;
--
--    for (i = 0; i < s->conf->num_queues; i++) {
--        VirtQueue *vq = virtio_get_queue(s->vdev, i);
--        EventNotifier *host_notifier = virtio_queue_get_host_notifier(vq);
-+    VirtQueue *vq = opaque;
-+    EventNotifier *host_notifier = virtio_queue_get_host_notifier(vq);
- 
--        virtio_queue_aio_detach_host_notifier(vq, s->ctx);
-+    virtio_queue_aio_detach_host_notifier(vq, qemu_get_current_aio_context());
- 
--        /*
--         * Test and clear notifier after disabling event, in case poll callback
--         * didn't have time to run.
--         */
--        virtio_queue_host_notifier_read(host_notifier);
--    }
-+    /*
-+     * Test and clear notifier after disabling event, in case poll callback
-+     * didn't have time to run.
-+     */
-+    virtio_queue_host_notifier_read(host_notifier);
- }
- 
- /* Context: QEMU global mutex held */
-@@ -279,7 +333,12 @@ void virtio_blk_data_plane_stop(VirtIODevice *vdev)
-     trace_virtio_blk_data_plane_stop(s);
- 
-     if (!blk_in_drain(s->conf->conf.blk)) {
--        aio_wait_bh_oneshot(s->ctx, virtio_blk_data_plane_stop_bh, s);
-+        for (i = 0; i < nvqs; i++) {
-+            VirtQueue *vq = virtio_get_queue(s->vdev, i);
-+            AioContext *ctx = s->vq_aio_context[i];
-+
-+            aio_wait_bh_oneshot(ctx, virtio_blk_data_plane_stop_vq_bh, vq);
-+        }
-     }
- 
-     /*
-@@ -322,3 +381,23 @@ void virtio_blk_data_plane_stop(VirtIODevice *vdev)
- 
-     s->stopping = false;
- }
-+
-+void virtio_blk_data_plane_detach(VirtIOBlockDataPlane *s)
-+{
-+    VirtIODevice *vdev = VIRTIO_DEVICE(s->vdev);
-+
-+    for (uint16_t i = 0; i < s->conf->num_queues; i++) {
-+        VirtQueue *vq = virtio_get_queue(vdev, i);
-+        virtio_queue_aio_detach_host_notifier(vq, s->vq_aio_context[i]);
-+    }
-+}
-+
-+void virtio_blk_data_plane_attach(VirtIOBlockDataPlane *s)
-+{
-+    VirtIODevice *vdev = VIRTIO_DEVICE(s->vdev);
-+
-+    for (uint16_t i = 0; i < s->conf->num_queues; i++) {
-+        VirtQueue *vq = virtio_get_queue(vdev, i);
-+        virtio_queue_aio_attach_host_notifier(vq, s->vq_aio_context[i]);
-+    }
-+}
-diff --git a/hw/block/dataplane/virtio-blk.h b/hw/block/dataplane/virtio-blk.h
-index 5e18bb99ae..1a806fe447 100644
---- a/hw/block/dataplane/virtio-blk.h
-+++ b/hw/block/dataplane/virtio-blk.h
-@@ -28,4 +28,7 @@ void virtio_blk_data_plane_notify(VirtIOBlockDataPlane *s, VirtQueue *vq);
- int virtio_blk_data_plane_start(VirtIODevice *vdev);
- void virtio_blk_data_plane_stop(VirtIODevice *vdev);
- 
-+void virtio_blk_data_plane_detach(VirtIOBlockDataPlane *s);
-+void virtio_blk_data_plane_attach(VirtIOBlockDataPlane *s);
-+
- #endif /* HW_DATAPLANE_VIRTIO_BLK_H */
-diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
-index ec9ed09a6a..46e73b2c96 100644
---- a/hw/block/virtio-blk.c
-+++ b/hw/block/virtio-blk.c
-@@ -1151,6 +1151,7 @@ static void virtio_blk_handle_output(VirtIODevice *vdev, VirtQueue *vq)
-             return;
-         }
-     }
-+
-     virtio_blk_handle_vq(s, vq);
- }
- 
-@@ -1463,6 +1464,68 @@ static int virtio_blk_load_device(VirtIODevice *vdev, QEMUFile *f,
-     return 0;
- }
- 
-+static bool
-+validate_iothread_vq_mapping_list(IOThreadVirtQueueMappingList *list,
-+        uint16_t num_queues, Error **errp)
-+{
-+    g_autofree unsigned long *vqs = bitmap_new(num_queues);
-+    g_autoptr(GHashTable) iothreads =
-+        g_hash_table_new(g_str_hash, g_str_equal);
-+
-+    for (IOThreadVirtQueueMappingList *node = list; node; node = node->next) {
-+        const char *name = node->value->iothread;
-+        uint16List *vq;
-+
-+        if (!iothread_by_id(name)) {
-+            error_setg(errp, "IOThread \"%s\" object does not exist", name);
-+            return false;
-+        }
-+
-+        if (!g_hash_table_add(iothreads, (gpointer)name)) {
-+            error_setg(errp,
-+                    "duplicate IOThread name \"%s\" in iothread-vq-mapping",
-+                    name);
-+            return false;
-+        }
-+
-+        if (node != list) {
-+            if (!!node->value->vqs != !!list->value->vqs) {
-+                error_setg(errp, "either all items in iothread-vq-mapping "
-+                                 "must have vqs or none of them must have it");
-+                return false;
-+            }
-+        }
-+
-+        for (vq = node->value->vqs; vq; vq = vq->next) {
-+            if (vq->value >= num_queues) {
-+                error_setg(errp, "vq index %u for IOThread \"%s\" must be "
-+                        "less than num_queues %u in iothread-vq-mapping",
-+                        vq->value, name, num_queues);
-+                return false;
-+            }
-+
-+            if (test_and_set_bit(vq->value, vqs)) {
-+                error_setg(errp, "cannot assign vq %u to IOThread \"%s\" "
-+                        "because it is already assigned", vq->value, name);
-+                return false;
-+            }
-+        }
-+    }
-+
-+    if (list->value->vqs) {
-+        for (uint16_t i = 0; i < num_queues; i++) {
-+            if (!test_bit(i, vqs)) {
-+                error_setg(errp,
-+                        "missing vq %u IOThread assignment in iothread-vq-mapping",
-+                        i);
-+                return false;
-+            }
-+        }
-+    }
-+
-+    return true;
-+}
-+
- static void virtio_resize_cb(void *opaque)
- {
-     VirtIODevice *vdev = opaque;
-@@ -1487,34 +1550,24 @@ static void virtio_blk_resize(void *opaque)
- static void virtio_blk_drained_begin(void *opaque)
- {
-     VirtIOBlock *s = opaque;
--    VirtIODevice *vdev = VIRTIO_DEVICE(opaque);
--    AioContext *ctx = blk_get_aio_context(s->conf.conf.blk);
- 
-     if (!s->dataplane || !s->dataplane_started) {
-         return;
-     }
- 
--    for (uint16_t i = 0; i < s->conf.num_queues; i++) {
--        VirtQueue *vq = virtio_get_queue(vdev, i);
--        virtio_queue_aio_detach_host_notifier(vq, ctx);
--    }
-+    virtio_blk_data_plane_detach(s->dataplane);
- }
- 
- /* Resume virtqueue ioeventfd processing after drain */
- static void virtio_blk_drained_end(void *opaque)
- {
-     VirtIOBlock *s = opaque;
--    VirtIODevice *vdev = VIRTIO_DEVICE(opaque);
--    AioContext *ctx = blk_get_aio_context(s->conf.conf.blk);
- 
-     if (!s->dataplane || !s->dataplane_started) {
-         return;
-     }
- 
--    for (uint16_t i = 0; i < s->conf.num_queues; i++) {
--        VirtQueue *vq = virtio_get_queue(vdev, i);
--        virtio_queue_aio_attach_host_notifier(vq, ctx);
--    }
-+    virtio_blk_data_plane_attach(s->dataplane);
- }
- 
- static const BlockDevOps virtio_block_ops = {
-@@ -1600,6 +1653,19 @@ static void virtio_blk_device_realize(DeviceState *dev, Error **errp)
-         return;
-     }
- 
-+    if (conf->iothread_vq_mapping_list) {
-+        if (conf->iothread) {
-+            error_setg(errp, "iothread and iothread-vq-mapping properties "
-+                             "cannot be set at the same time");
-+            return;
-+        }
-+
-+        if (!validate_iothread_vq_mapping_list(conf->iothread_vq_mapping_list,
-+                                               conf->num_queues, errp)) {
-+            return;
-+        }
-+    }
-+
-     s->config_size = virtio_get_config_size(&virtio_blk_cfg_size_params,
-                                             s->host_features);
-     virtio_init(vdev, VIRTIO_ID_BLOCK, s->config_size);
-@@ -1702,6 +1768,8 @@ static Property virtio_blk_properties[] = {
-     DEFINE_PROP_BOOL("seg-max-adjust", VirtIOBlock, conf.seg_max_adjust, true),
-     DEFINE_PROP_LINK("iothread", VirtIOBlock, conf.iothread, TYPE_IOTHREAD,
-                      IOThread *),
-+    DEFINE_PROP_IOTHREAD_VQ_MAPPING_LIST("iothread-vq-mapping", VirtIOBlock,
-+                                         conf.iothread_vq_mapping_list),
-     DEFINE_PROP_BIT64("discard", VirtIOBlock, host_features,
-                       VIRTIO_BLK_F_DISCARD, true),
-     DEFINE_PROP_BOOL("report-discard-granularity", VirtIOBlock,
-diff --git a/include/hw/virtio/virtio-blk.h b/include/hw/virtio/virtio-blk.h
-index 9881009c22..5e4091e4da 100644
---- a/include/hw/virtio/virtio-blk.h
-+++ b/include/hw/virtio/virtio-blk.h
-@@ -21,6 +21,7 @@
- #include "sysemu/block-backend.h"
- #include "sysemu/block-ram-registrar.h"
- #include "qom/object.h"
-+#include "qapi/qapi-types-virtio.h"
- 
- #define TYPE_VIRTIO_BLK "virtio-blk-device"
- OBJECT_DECLARE_SIMPLE_TYPE(VirtIOBlock, VIRTIO_BLK)
-@@ -37,6 +38,7 @@ struct VirtIOBlkConf
- {
-     BlockConf conf;
-     IOThread *iothread;
-+    IOThreadVirtQueueMappingList *iothread_vq_mapping_list;
-     char *serial;
-     uint32_t request_merging;
-     uint16_t num_queues;
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-virtio-blk-add-lock-to-protect-s-rq.patch b/SOURCES/kvm-virtio-blk-add-lock-to-protect-s-rq.patch
deleted file mode 100644
index 31e83a2..0000000
--- a/SOURCES/kvm-virtio-blk-add-lock-to-protect-s-rq.patch
+++ /dev/null
@@ -1,177 +0,0 @@
-From d54e88103aa76f3bf755b3f4308d8ab60367c6ef Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Thu, 14 Sep 2023 10:00:59 -0400
-Subject: [PATCH 074/101] virtio-blk: add lock to protect s->rq
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 214: Remove AioContext lock
-RH-Jira: RHEL-15965
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [5/26] 17dcd5ba18c03e5633a014d8d62d34d8dd7b43bf (kmwolf/centos-qemu-kvm)
-
-s->rq is accessed from IO_CODE and GLOBAL_STATE_CODE. Introduce a lock
-to protect s->rq and eliminate reliance on the AioContext lock.
-
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20230914140101.1065008-3-stefanha@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- hw/block/virtio-blk.c          | 67 +++++++++++++++++++++++-----------
- include/hw/virtio/virtio-blk.h |  3 +-
- 2 files changed, 47 insertions(+), 23 deletions(-)
-
-diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
-index a1f8e15522..ee38e089bc 100644
---- a/hw/block/virtio-blk.c
-+++ b/hw/block/virtio-blk.c
-@@ -82,8 +82,11 @@ static int virtio_blk_handle_rw_error(VirtIOBlockReq *req, int error,
-         /* Break the link as the next request is going to be parsed from the
-          * ring again. Otherwise we may end up doing a double completion! */
-         req->mr_next = NULL;
--        req->next = s->rq;
--        s->rq = req;
-+
-+        WITH_QEMU_LOCK_GUARD(&s->rq_lock) {
-+            req->next = s->rq;
-+            s->rq = req;
-+        }
-     } else if (action == BLOCK_ERROR_ACTION_REPORT) {
-         virtio_blk_req_complete(req, VIRTIO_BLK_S_IOERR);
-         if (acct_failed) {
-@@ -1183,10 +1186,13 @@ static void virtio_blk_dma_restart_bh(void *opaque)
- {
-     VirtIOBlock *s = opaque;
- 
--    VirtIOBlockReq *req = s->rq;
-+    VirtIOBlockReq *req;
-     MultiReqBuffer mrb = {};
- 
--    s->rq = NULL;
-+    WITH_QEMU_LOCK_GUARD(&s->rq_lock) {
-+        req = s->rq;
-+        s->rq = NULL;
-+    }
- 
-     aio_context_acquire(blk_get_aio_context(s->conf.conf.blk));
-     while (req) {
-@@ -1238,22 +1244,29 @@ static void virtio_blk_reset(VirtIODevice *vdev)
-     AioContext *ctx;
-     VirtIOBlockReq *req;
- 
-+    /* Dataplane has stopped... */
-+    assert(!s->dataplane_started);
-+
-+    /* ...but requests may still be in flight. */
-     ctx = blk_get_aio_context(s->blk);
-     aio_context_acquire(ctx);
-     blk_drain(s->blk);
-+    aio_context_release(ctx);
- 
-     /* We drop queued requests after blk_drain() because blk_drain() itself can
-      * produce them. */
--    while (s->rq) {
--        req = s->rq;
--        s->rq = req->next;
--        virtqueue_detach_element(req->vq, &req->elem, 0);
--        virtio_blk_free_request(req);
--    }
-+    WITH_QEMU_LOCK_GUARD(&s->rq_lock) {
-+        while (s->rq) {
-+            req = s->rq;
-+            s->rq = req->next;
- 
--    aio_context_release(ctx);
-+            /* No other threads can access req->vq here */
-+            virtqueue_detach_element(req->vq, &req->elem, 0);
-+
-+            virtio_blk_free_request(req);
-+        }
-+    }
- 
--    assert(!s->dataplane_started);
-     blk_set_enable_write_cache(s->blk, s->original_wce);
- }
- 
-@@ -1443,18 +1456,22 @@ static void virtio_blk_set_status(VirtIODevice *vdev, uint8_t status)
- static void virtio_blk_save_device(VirtIODevice *vdev, QEMUFile *f)
- {
-     VirtIOBlock *s = VIRTIO_BLK(vdev);
--    VirtIOBlockReq *req = s->rq;
- 
--    while (req) {
--        qemu_put_sbyte(f, 1);
-+    WITH_QEMU_LOCK_GUARD(&s->rq_lock) {
-+        VirtIOBlockReq *req = s->rq;
- 
--        if (s->conf.num_queues > 1) {
--            qemu_put_be32(f, virtio_get_queue_index(req->vq));
--        }
-+        while (req) {
-+            qemu_put_sbyte(f, 1);
- 
--        qemu_put_virtqueue_element(vdev, f, &req->elem);
--        req = req->next;
-+            if (s->conf.num_queues > 1) {
-+                qemu_put_be32(f, virtio_get_queue_index(req->vq));
-+            }
-+
-+            qemu_put_virtqueue_element(vdev, f, &req->elem);
-+            req = req->next;
-+        }
-     }
-+
-     qemu_put_sbyte(f, 0);
- }
- 
-@@ -1480,8 +1497,11 @@ static int virtio_blk_load_device(VirtIODevice *vdev, QEMUFile *f,
- 
-         req = qemu_get_virtqueue_element(vdev, f, sizeof(VirtIOBlockReq));
-         virtio_blk_init_request(s, virtio_get_queue(vdev, vq_idx), req);
--        req->next = s->rq;
--        s->rq = req;
-+
-+        WITH_QEMU_LOCK_GUARD(&s->rq_lock) {
-+            req->next = s->rq;
-+            s->rq = req;
-+        }
-     }
- 
-     return 0;
-@@ -1628,6 +1648,8 @@ static void virtio_blk_device_realize(DeviceState *dev, Error **errp)
-                                             s->host_features);
-     virtio_init(vdev, VIRTIO_ID_BLOCK, s->config_size);
- 
-+    qemu_mutex_init(&s->rq_lock);
-+
-     s->blk = conf->conf.blk;
-     s->rq = NULL;
-     s->sector_mask = (s->conf.conf.logical_block_size / BDRV_SECTOR_SIZE) - 1;
-@@ -1679,6 +1701,7 @@ static void virtio_blk_device_unrealize(DeviceState *dev)
-         virtio_del_queue(vdev, i);
-     }
-     qemu_coroutine_dec_pool_size(conf->num_queues * conf->queue_size / 2);
-+    qemu_mutex_destroy(&s->rq_lock);
-     blk_ram_registrar_destroy(&s->blk_ram_registrar);
-     qemu_del_vm_change_state_handler(s->change);
-     blockdev_mark_auto_del(s->blk);
-diff --git a/include/hw/virtio/virtio-blk.h b/include/hw/virtio/virtio-blk.h
-index dafec432ce..9881009c22 100644
---- a/include/hw/virtio/virtio-blk.h
-+++ b/include/hw/virtio/virtio-blk.h
-@@ -54,7 +54,8 @@ struct VirtIOBlockReq;
- struct VirtIOBlock {
-     VirtIODevice parent_obj;
-     BlockBackend *blk;
--    void *rq;
-+    QemuMutex rq_lock;
-+    void *rq; /* protected by rq_lock */
-     VirtIOBlkConf conf;
-     unsigned short sector_mask;
-     bool original_wce;
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-virtio-blk-always-set-ioeventfd-during-startup.patch b/SOURCES/kvm-virtio-blk-always-set-ioeventfd-during-startup.patch
deleted file mode 100644
index a7b518d..0000000
--- a/SOURCES/kvm-virtio-blk-always-set-ioeventfd-during-startup.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-From 22730552442003e81c8c508c3e7ebacf647e4e75 Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Fri, 19 Jan 2024 08:57:48 -0500
-Subject: [PATCH 19/22] virtio-blk: always set ioeventfd during startup
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 219: virtio-blk: add iothread-vq-mapping parameter
-RH-Jira: RHEL-17369 RHEL-20764 RHEL-7356
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Commit: [15/17] 5f7142aeaa54fda41bd5c4fd3222fd8e3e18f370 (stefanha/centos-stream-qemu-kvm)
-
-When starting ioeventfd it is common practice to set the event notifier
-so that the ioeventfd handler is triggered to run immediately. There may
-be no requests waiting to be processed, but the idea is that if a
-request snuck in then we guarantee that it will be detected.
-
-One scenario where self-triggering the ioeventfd is necessary is when
-virtio_blk_handle_output() is called from a vCPU thread before the
-VIRTIO Device Status transitions to DRIVER_OK. In that case we need to
-self-trigger the ioeventfd so that the kick handled by the vCPU thread
-causes the vq AioContext thread to take over handling the request(s).
-
-Fixes: b6948ab01df0 ("virtio-blk: add iothread-vq-mapping parameter")
-Reported-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20240119135748.270944-7-stefanha@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit d3f6f294aeadd5f88caf0155e4360808c95b3146)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- hw/block/virtio-blk.c | 12 ++++++------
- 1 file changed, 6 insertions(+), 6 deletions(-)
-
-diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
-index 81de06c9f6..0b9100b746 100644
---- a/hw/block/virtio-blk.c
-+++ b/hw/block/virtio-blk.c
-@@ -1809,14 +1809,14 @@ static int virtio_blk_start_ioeventfd(VirtIODevice *vdev)
-     smp_wmb(); /* paired with aio_notify_accept() on the read side */
- 
-     /* Get this show started by hooking up our callbacks */
--    if (!blk_in_drain(s->conf.conf.blk)) {
--        for (i = 0; i < nvqs; i++) {
--            VirtQueue *vq = virtio_get_queue(vdev, i);
--            AioContext *ctx = s->vq_aio_context[i];
-+    for (i = 0; i < nvqs; i++) {
-+        VirtQueue *vq = virtio_get_queue(vdev, i);
-+        AioContext *ctx = s->vq_aio_context[i];
- 
--            /* Kick right away to begin processing requests already in vring */
--            event_notifier_set(virtio_queue_get_host_notifier(vq));
-+        /* Kick right away to begin processing requests already in vring */
-+        event_notifier_set(virtio_queue_get_host_notifier(vq));
- 
-+        if (!blk_in_drain(s->conf.conf.blk)) {
-             virtio_queue_aio_attach_host_notifier(vq, ctx);
-         }
-     }
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-virtio-blk-avoid-using-ioeventfd-state-in-irqfd-cond.patch b/SOURCES/kvm-virtio-blk-avoid-using-ioeventfd-state-in-irqfd-cond.patch
deleted file mode 100644
index 8d93bf6..0000000
--- a/SOURCES/kvm-virtio-blk-avoid-using-ioeventfd-state-in-irqfd-cond.patch
+++ /dev/null
@@ -1,72 +0,0 @@
-From f62b56c68d50a149a07e15797bf3605e63b2c501 Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Mon, 22 Jan 2024 12:26:25 -0500
-Subject: [PATCH 4/6] virtio-blk: avoid using ioeventfd state in irqfd
- conditional
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 224: virtio-blk: avoid using ioeventfd state in irqfd conditional
-RH-Jira: RHEL-15394
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Commit: [1/1] 8f24084669db52457e55e2523b9f56f5560dd6ce (stefanha/centos-stream-qemu-kvm)
-
-Requests that complete in an IOThread use irqfd to notify the guest
-while requests that complete in the main loop thread use the traditional
-qdev irq code path. The reason for this conditional is that the irq code
-path requires the BQL:
-
-  if (s->ioeventfd_started && !s->ioeventfd_disabled) {
-      virtio_notify_irqfd(vdev, req->vq);
-  } else {
-      virtio_notify(vdev, req->vq);
-  }
-
-There is a corner case where the conditional invokes the irq code path
-instead of the irqfd code path:
-
-  static void virtio_blk_stop_ioeventfd(VirtIODevice *vdev)
-  {
-      ...
-      /*
-       * Set ->ioeventfd_started to false before draining so that host notifiers
-       * are not detached/attached anymore.
-       */
-      s->ioeventfd_started = false;
-
-      /* Wait for virtio_blk_dma_restart_bh() and in flight I/O to complete */
-      blk_drain(s->conf.conf.blk);
-
-During blk_drain() the conditional produces the wrong result because
-ioeventfd_started is false.
-
-Use qemu_in_iothread() instead of checking the ioeventfd state.
-
-Cc: qemu-stable@nongnu.org
-Buglink: https://issues.redhat.com/browse/RHEL-15394
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20240122172625.415386-1-stefanha@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit bfa36802d1704fc413c590ebdcc4e5ae0eacf439)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- hw/block/virtio-blk.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
-index 7fdeaf2d12..2ae2f6a823 100644
---- a/hw/block/virtio-blk.c
-+++ b/hw/block/virtio-blk.c
-@@ -66,7 +66,7 @@ static void virtio_blk_req_complete(VirtIOBlockReq *req, unsigned char status)
-     iov_discard_undo(&req->inhdr_undo);
-     iov_discard_undo(&req->outhdr_undo);
-     virtqueue_push(req->vq, &req->elem, req->in_len);
--    if (s->ioeventfd_started && !s->ioeventfd_disabled) {
-+    if (qemu_in_iothread()) {
-         virtio_notify_irqfd(vdev, req->vq);
-     } else {
-         virtio_notify(vdev, req->vq);
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-virtio-blk-don-t-lock-AioContext-in-the-completion-c.patch b/SOURCES/kvm-virtio-blk-don-t-lock-AioContext-in-the-completion-c.patch
deleted file mode 100644
index be3c7db..0000000
--- a/SOURCES/kvm-virtio-blk-don-t-lock-AioContext-in-the-completion-c.patch
+++ /dev/null
@@ -1,167 +0,0 @@
-From a2069ff76637365cacf5b96f9427b98a6ca2c9ba Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Thu, 14 Sep 2023 10:01:00 -0400
-Subject: [PATCH 075/101] virtio-blk: don't lock AioContext in the completion
- code path
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 214: Remove AioContext lock
-RH-Jira: RHEL-15965
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [6/26] 3426f62c2156f6967bb4ffbce75a4ff46d3312a3 (kmwolf/centos-qemu-kvm)
-
-Nothing in the completion code path relies on the AioContext lock
-anymore. Virtqueues are only accessed from one thread at any moment and
-the s->rq global state is protected by its own lock now.
-
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20230914140101.1065008-4-stefanha@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- hw/block/virtio-blk.c | 34 ++++------------------------------
- 1 file changed, 4 insertions(+), 30 deletions(-)
-
-diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
-index ee38e089bc..f5315df042 100644
---- a/hw/block/virtio-blk.c
-+++ b/hw/block/virtio-blk.c
-@@ -105,7 +105,6 @@ static void virtio_blk_rw_complete(void *opaque, int ret)
-     VirtIOBlock *s = next->dev;
-     VirtIODevice *vdev = VIRTIO_DEVICE(s);
- 
--    aio_context_acquire(blk_get_aio_context(s->conf.conf.blk));
-     while (next) {
-         VirtIOBlockReq *req = next;
-         next = req->mr_next;
-@@ -138,7 +137,6 @@ static void virtio_blk_rw_complete(void *opaque, int ret)
-         block_acct_done(blk_get_stats(s->blk), &req->acct);
-         virtio_blk_free_request(req);
-     }
--    aio_context_release(blk_get_aio_context(s->conf.conf.blk));
- }
- 
- static void virtio_blk_flush_complete(void *opaque, int ret)
-@@ -146,19 +144,13 @@ static void virtio_blk_flush_complete(void *opaque, int ret)
-     VirtIOBlockReq *req = opaque;
-     VirtIOBlock *s = req->dev;
- 
--    aio_context_acquire(blk_get_aio_context(s->conf.conf.blk));
--    if (ret) {
--        if (virtio_blk_handle_rw_error(req, -ret, 0, true)) {
--            goto out;
--        }
-+    if (ret && virtio_blk_handle_rw_error(req, -ret, 0, true)) {
-+        return;
-     }
- 
-     virtio_blk_req_complete(req, VIRTIO_BLK_S_OK);
-     block_acct_done(blk_get_stats(s->blk), &req->acct);
-     virtio_blk_free_request(req);
--
--out:
--    aio_context_release(blk_get_aio_context(s->conf.conf.blk));
- }
- 
- static void virtio_blk_discard_write_zeroes_complete(void *opaque, int ret)
-@@ -168,11 +160,8 @@ static void virtio_blk_discard_write_zeroes_complete(void *opaque, int ret)
-     bool is_write_zeroes = (virtio_ldl_p(VIRTIO_DEVICE(s), &req->out.type) &
-                             ~VIRTIO_BLK_T_BARRIER) == VIRTIO_BLK_T_WRITE_ZEROES;
- 
--    aio_context_acquire(blk_get_aio_context(s->conf.conf.blk));
--    if (ret) {
--        if (virtio_blk_handle_rw_error(req, -ret, false, is_write_zeroes)) {
--            goto out;
--        }
-+    if (ret && virtio_blk_handle_rw_error(req, -ret, false, is_write_zeroes)) {
-+        return;
-     }
- 
-     virtio_blk_req_complete(req, VIRTIO_BLK_S_OK);
-@@ -180,9 +169,6 @@ static void virtio_blk_discard_write_zeroes_complete(void *opaque, int ret)
-         block_acct_done(blk_get_stats(s->blk), &req->acct);
-     }
-     virtio_blk_free_request(req);
--
--out:
--    aio_context_release(blk_get_aio_context(s->conf.conf.blk));
- }
- 
- #ifdef __linux__
-@@ -229,10 +215,8 @@ static void virtio_blk_ioctl_complete(void *opaque, int status)
-     virtio_stl_p(vdev, &scsi->data_len, hdr->dxfer_len);
- 
- out:
--    aio_context_acquire(blk_get_aio_context(s->conf.conf.blk));
-     virtio_blk_req_complete(req, status);
-     virtio_blk_free_request(req);
--    aio_context_release(blk_get_aio_context(s->conf.conf.blk));
-     g_free(ioctl_req);
- }
- 
-@@ -672,7 +656,6 @@ static void virtio_blk_zone_report_complete(void *opaque, int ret)
- {
-     ZoneCmdData *data = opaque;
-     VirtIOBlockReq *req = data->req;
--    VirtIOBlock *s = req->dev;
-     VirtIODevice *vdev = VIRTIO_DEVICE(req->dev);
-     struct iovec *in_iov = data->in_iov;
-     unsigned in_num = data->in_num;
-@@ -763,10 +746,8 @@ static void virtio_blk_zone_report_complete(void *opaque, int ret)
-     }
- 
- out:
--    aio_context_acquire(blk_get_aio_context(s->conf.conf.blk));
-     virtio_blk_req_complete(req, err_status);
-     virtio_blk_free_request(req);
--    aio_context_release(blk_get_aio_context(s->conf.conf.blk));
-     g_free(data->zone_report_data.zones);
-     g_free(data);
- }
-@@ -829,10 +810,8 @@ static void virtio_blk_zone_mgmt_complete(void *opaque, int ret)
-         err_status = VIRTIO_BLK_S_ZONE_INVALID_CMD;
-     }
- 
--    aio_context_acquire(blk_get_aio_context(s->conf.conf.blk));
-     virtio_blk_req_complete(req, err_status);
-     virtio_blk_free_request(req);
--    aio_context_release(blk_get_aio_context(s->conf.conf.blk));
- }
- 
- static int virtio_blk_handle_zone_mgmt(VirtIOBlockReq *req, BlockZoneOp op)
-@@ -882,7 +861,6 @@ static void virtio_blk_zone_append_complete(void *opaque, int ret)
- {
-     ZoneCmdData *data = opaque;
-     VirtIOBlockReq *req = data->req;
--    VirtIOBlock *s = req->dev;
-     VirtIODevice *vdev = VIRTIO_DEVICE(req->dev);
-     int64_t append_sector, n;
-     uint8_t err_status = VIRTIO_BLK_S_OK;
-@@ -905,10 +883,8 @@ static void virtio_blk_zone_append_complete(void *opaque, int ret)
-     trace_virtio_blk_zone_append_complete(vdev, req, append_sector, ret);
- 
- out:
--    aio_context_acquire(blk_get_aio_context(s->conf.conf.blk));
-     virtio_blk_req_complete(req, err_status);
-     virtio_blk_free_request(req);
--    aio_context_release(blk_get_aio_context(s->conf.conf.blk));
-     g_free(data);
- }
- 
-@@ -944,10 +920,8 @@ static int virtio_blk_handle_zone_append(VirtIOBlockReq *req,
-     return 0;
- 
- out:
--    aio_context_acquire(blk_get_aio_context(s->conf.conf.blk));
-     virtio_blk_req_complete(req, err_status);
-     virtio_blk_free_request(req);
--    aio_context_release(blk_get_aio_context(s->conf.conf.blk));
-     return err_status;
- }
- 
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-virtio-blk-don-t-lock-AioContext-in-the-submission-c.patch b/SOURCES/kvm-virtio-blk-don-t-lock-AioContext-in-the-submission-c.patch
deleted file mode 100644
index c31fcca..0000000
--- a/SOURCES/kvm-virtio-blk-don-t-lock-AioContext-in-the-submission-c.patch
+++ /dev/null
@@ -1,67 +0,0 @@
-From 2816f6ce20c496e21947f215112be34a5cb93606 Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Thu, 14 Sep 2023 10:01:01 -0400
-Subject: [PATCH 076/101] virtio-blk: don't lock AioContext in the submission
- code path
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 214: Remove AioContext lock
-RH-Jira: RHEL-15965
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [7/26] e0de2744cb319569ea008334e45ee5fc2ba9b6d7 (kmwolf/centos-qemu-kvm)
-
-There is no need to acquire the AioContext lock around blk_aio_*() or
-blk_get_geometry() anymore. I/O plugging (defer_call()) also does not
-require the AioContext lock anymore.
-
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20230914140101.1065008-5-stefanha@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- hw/block/virtio-blk.c | 5 -----
- 1 file changed, 5 deletions(-)
-
-diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
-index f5315df042..e110f9718b 100644
---- a/hw/block/virtio-blk.c
-+++ b/hw/block/virtio-blk.c
-@@ -1111,7 +1111,6 @@ void virtio_blk_handle_vq(VirtIOBlock *s, VirtQueue *vq)
-     MultiReqBuffer mrb = {};
-     bool suppress_notifications = virtio_queue_get_notification(vq);
- 
--    aio_context_acquire(blk_get_aio_context(s->blk));
-     defer_call_begin();
- 
-     do {
-@@ -1137,7 +1136,6 @@ void virtio_blk_handle_vq(VirtIOBlock *s, VirtQueue *vq)
-     }
- 
-     defer_call_end();
--    aio_context_release(blk_get_aio_context(s->blk));
- }
- 
- static void virtio_blk_handle_output(VirtIODevice *vdev, VirtQueue *vq)
-@@ -1168,7 +1166,6 @@ static void virtio_blk_dma_restart_bh(void *opaque)
-         s->rq = NULL;
-     }
- 
--    aio_context_acquire(blk_get_aio_context(s->conf.conf.blk));
-     while (req) {
-         VirtIOBlockReq *next = req->next;
-         if (virtio_blk_handle_request(req, &mrb)) {
-@@ -1192,8 +1189,6 @@ static void virtio_blk_dma_restart_bh(void *opaque)
- 
-     /* Paired with inc in virtio_blk_dma_restart_cb() */
-     blk_dec_in_flight(s->conf.conf.blk);
--
--    aio_context_release(blk_get_aio_context(s->conf.conf.blk));
- }
- 
- static void virtio_blk_dma_restart_cb(void *opaque, bool running,
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-virtio-blk-move-dataplane-code-into-virtio-blk.c.patch b/SOURCES/kvm-virtio-blk-move-dataplane-code-into-virtio-blk.c.patch
deleted file mode 100644
index 3fb8211..0000000
--- a/SOURCES/kvm-virtio-blk-move-dataplane-code-into-virtio-blk.c.patch
+++ /dev/null
@@ -1,1009 +0,0 @@
-From d9be1e1f199ee3171455636f32f3ba59b57e9351 Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Fri, 19 Jan 2024 08:57:43 -0500
-Subject: [PATCH 14/22] virtio-blk: move dataplane code into virtio-blk.c
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 219: virtio-blk: add iothread-vq-mapping parameter
-RH-Jira: RHEL-17369 RHEL-20764 RHEL-7356
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Commit: [10/17] ad854c6c7e808da272bd07229e8c915c1ee6f296 (stefanha/centos-stream-qemu-kvm)
-
-The dataplane code used to be significantly different from the
-non-dataplane code and therefore had a separate source file.
-
-Over time the difference has gotten smaller because the I/O code paths
-were unified. Nowadays the distinction between the VirtIOBlock and
-VirtIOBlockDataPlane structs is more of an inconvenience that hinders
-code simplification.
-
-Move hw/block/dataplane/virtio-blk.c into hw/block/virtio-blk.c, merging
-VirtIOBlockDataPlane's fields into VirtIOBlock.
-
-hw/block/virtio-blk.c used VirtIOBlock->dataplane to check if
-virtio_blk_data_plane_create() was successful. This is not necessary
-because ->dataplane_started and ->dataplane_disabled can be used
-instead. This patch makes those changes in order to drop
-VirtIOBlock->dataplane.
-
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20240119135748.270944-2-stefanha@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 3bcc17f06526754fd675dcf601414442044fa0b6)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-
-Conflicts:
-  hw/block/dataplane/virtio-blk.c
-  Downstream is missing commit 0b2675c473f6 ("Rename "QEMU global mutex"
-  to "BQL" in comments and docs") so the source file still contains old
-  "QEMU global mutex held" comments instead of the new "BQL held"
-  phrasing. The code moved into hw/block/virtio-blk.c by this patch uses
-  the new "BQL held" phrasing so to minimize conflicts in future
-  backports. Either way, this is not a code change and therefore no risk
-  in introducing bugs.
----
- hw/block/dataplane/meson.build  |   1 -
- hw/block/dataplane/trace-events |   5 -
- hw/block/dataplane/trace.h      |   1 -
- hw/block/dataplane/virtio-blk.c | 404 --------------------------------
- hw/block/dataplane/virtio-blk.h |  34 ---
- hw/block/virtio-blk.c           | 362 ++++++++++++++++++++++++++--
- include/hw/virtio/virtio-blk.h  |  12 +-
- meson.build                     |   1 -
- 8 files changed, 357 insertions(+), 463 deletions(-)
- delete mode 100644 hw/block/dataplane/trace-events
- delete mode 100644 hw/block/dataplane/trace.h
- delete mode 100644 hw/block/dataplane/virtio-blk.c
- delete mode 100644 hw/block/dataplane/virtio-blk.h
-
-diff --git a/hw/block/dataplane/meson.build b/hw/block/dataplane/meson.build
-index 025b3b061b..11a5eba2f4 100644
---- a/hw/block/dataplane/meson.build
-+++ b/hw/block/dataplane/meson.build
-@@ -1,2 +1 @@
--system_ss.add(when: 'CONFIG_VIRTIO_BLK', if_true: files('virtio-blk.c'))
- specific_ss.add(when: 'CONFIG_XEN_BUS', if_true: files('xen-block.c'))
-diff --git a/hw/block/dataplane/trace-events b/hw/block/dataplane/trace-events
-deleted file mode 100644
-index 38fc3e7507..0000000000
---- a/hw/block/dataplane/trace-events
-+++ /dev/null
-@@ -1,5 +0,0 @@
--# See docs/devel/tracing.rst for syntax documentation.
--
--# virtio-blk.c
--virtio_blk_data_plane_start(void *s) "dataplane %p"
--virtio_blk_data_plane_stop(void *s) "dataplane %p"
-diff --git a/hw/block/dataplane/trace.h b/hw/block/dataplane/trace.h
-deleted file mode 100644
-index 240cc59834..0000000000
---- a/hw/block/dataplane/trace.h
-+++ /dev/null
-@@ -1 +0,0 @@
--#include "trace/trace-hw_block_dataplane.h"
-diff --git a/hw/block/dataplane/virtio-blk.c b/hw/block/dataplane/virtio-blk.c
-deleted file mode 100644
-index 97a302cf49..0000000000
---- a/hw/block/dataplane/virtio-blk.c
-+++ /dev/null
-@@ -1,404 +0,0 @@
--/*
-- * Dedicated thread for virtio-blk I/O processing
-- *
-- * Copyright 2012 IBM, Corp.
-- * Copyright 2012 Red Hat, Inc. and/or its affiliates
-- *
-- * Authors:
-- *   Stefan Hajnoczi <stefanha@redhat.com>
-- *
-- * This work is licensed under the terms of the GNU GPL, version 2 or later.
-- * See the COPYING file in the top-level directory.
-- *
-- */
--
--#include "qemu/osdep.h"
--#include "qapi/error.h"
--#include "trace.h"
--#include "qemu/iov.h"
--#include "qemu/main-loop.h"
--#include "qemu/thread.h"
--#include "qemu/error-report.h"
--#include "hw/virtio/virtio-blk.h"
--#include "virtio-blk.h"
--#include "block/aio.h"
--#include "hw/virtio/virtio-bus.h"
--#include "qom/object_interfaces.h"
--
--struct VirtIOBlockDataPlane {
--    bool starting;
--    bool stopping;
--
--    VirtIOBlkConf *conf;
--    VirtIODevice *vdev;
--
--    /*
--     * The AioContext for each virtqueue. The BlockDriverState will use the
--     * first element as its AioContext.
--     */
--    AioContext **vq_aio_context;
--};
--
--/* Raise an interrupt to signal guest, if necessary */
--void virtio_blk_data_plane_notify(VirtIOBlockDataPlane *s, VirtQueue *vq)
--{
--    virtio_notify_irqfd(s->vdev, vq);
--}
--
--/* Generate vq:AioContext mappings from a validated iothread-vq-mapping list */
--static void
--apply_vq_mapping(IOThreadVirtQueueMappingList *iothread_vq_mapping_list,
--                 AioContext **vq_aio_context, uint16_t num_queues)
--{
--    IOThreadVirtQueueMappingList *node;
--    size_t num_iothreads = 0;
--    size_t cur_iothread = 0;
--
--    for (node = iothread_vq_mapping_list; node; node = node->next) {
--        num_iothreads++;
--    }
--
--    for (node = iothread_vq_mapping_list; node; node = node->next) {
--        IOThread *iothread = iothread_by_id(node->value->iothread);
--        AioContext *ctx = iothread_get_aio_context(iothread);
--
--        /* Released in virtio_blk_data_plane_destroy() */
--        object_ref(OBJECT(iothread));
--
--        if (node->value->vqs) {
--            uint16List *vq;
--
--            /* Explicit vq:IOThread assignment */
--            for (vq = node->value->vqs; vq; vq = vq->next) {
--                vq_aio_context[vq->value] = ctx;
--            }
--        } else {
--            /* Round-robin vq:IOThread assignment */
--            for (unsigned i = cur_iothread; i < num_queues;
--                 i += num_iothreads) {
--                vq_aio_context[i] = ctx;
--            }
--        }
--
--        cur_iothread++;
--    }
--}
--
--/* Context: QEMU global mutex held */
--bool virtio_blk_data_plane_create(VirtIODevice *vdev, VirtIOBlkConf *conf,
--                                  VirtIOBlockDataPlane **dataplane,
--                                  Error **errp)
--{
--    VirtIOBlockDataPlane *s;
--    BusState *qbus = BUS(qdev_get_parent_bus(DEVICE(vdev)));
--    VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(qbus);
--
--    *dataplane = NULL;
--
--    if (conf->iothread || conf->iothread_vq_mapping_list) {
--        if (!k->set_guest_notifiers || !k->ioeventfd_assign) {
--            error_setg(errp,
--                       "device is incompatible with iothread "
--                       "(transport does not support notifiers)");
--            return false;
--        }
--        if (!virtio_device_ioeventfd_enabled(vdev)) {
--            error_setg(errp, "ioeventfd is required for iothread");
--            return false;
--        }
--
--        /* If dataplane is (re-)enabled while the guest is running there could
--         * be block jobs that can conflict.
--         */
--        if (blk_op_is_blocked(conf->conf.blk, BLOCK_OP_TYPE_DATAPLANE, errp)) {
--            error_prepend(errp, "cannot start virtio-blk dataplane: ");
--            return false;
--        }
--    }
--    /* Don't try if transport does not support notifiers. */
--    if (!virtio_device_ioeventfd_enabled(vdev)) {
--        return false;
--    }
--
--    s = g_new0(VirtIOBlockDataPlane, 1);
--    s->vdev = vdev;
--    s->conf = conf;
--    s->vq_aio_context = g_new(AioContext *, conf->num_queues);
--
--    if (conf->iothread_vq_mapping_list) {
--        apply_vq_mapping(conf->iothread_vq_mapping_list, s->vq_aio_context,
--                         conf->num_queues);
--    } else if (conf->iothread) {
--        AioContext *ctx = iothread_get_aio_context(conf->iothread);
--        for (unsigned i = 0; i < conf->num_queues; i++) {
--            s->vq_aio_context[i] = ctx;
--        }
--
--        /* Released in virtio_blk_data_plane_destroy() */
--        object_ref(OBJECT(conf->iothread));
--    } else {
--        AioContext *ctx = qemu_get_aio_context();
--        for (unsigned i = 0; i < conf->num_queues; i++) {
--            s->vq_aio_context[i] = ctx;
--        }
--    }
--
--    *dataplane = s;
--
--    return true;
--}
--
--/* Context: QEMU global mutex held */
--void virtio_blk_data_plane_destroy(VirtIOBlockDataPlane *s)
--{
--    VirtIOBlock *vblk;
--    VirtIOBlkConf *conf;
--
--    if (!s) {
--        return;
--    }
--
--    vblk = VIRTIO_BLK(s->vdev);
--    assert(!vblk->dataplane_started);
--    conf = s->conf;
--
--    if (conf->iothread_vq_mapping_list) {
--        IOThreadVirtQueueMappingList *node;
--
--        for (node = conf->iothread_vq_mapping_list; node; node = node->next) {
--            IOThread *iothread = iothread_by_id(node->value->iothread);
--            object_unref(OBJECT(iothread));
--        }
--    }
--
--    if (conf->iothread) {
--        object_unref(OBJECT(conf->iothread));
--    }
--
--    g_free(s->vq_aio_context);
--    g_free(s);
--}
--
--/* Context: QEMU global mutex held */
--int virtio_blk_data_plane_start(VirtIODevice *vdev)
--{
--    VirtIOBlock *vblk = VIRTIO_BLK(vdev);
--    VirtIOBlockDataPlane *s = vblk->dataplane;
--    BusState *qbus = BUS(qdev_get_parent_bus(DEVICE(vblk)));
--    VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(qbus);
--    unsigned i;
--    unsigned nvqs = s->conf->num_queues;
--    Error *local_err = NULL;
--    int r;
--
--    if (vblk->dataplane_started || s->starting) {
--        return 0;
--    }
--
--    s->starting = true;
--
--    /* Set up guest notifier (irq) */
--    r = k->set_guest_notifiers(qbus->parent, nvqs, true);
--    if (r != 0) {
--        error_report("virtio-blk failed to set guest notifier (%d), "
--                     "ensure -accel kvm is set.", r);
--        goto fail_guest_notifiers;
--    }
--
--    /*
--     * Batch all the host notifiers in a single transaction to avoid
--     * quadratic time complexity in address_space_update_ioeventfds().
--     */
--    memory_region_transaction_begin();
--
--    /* Set up virtqueue notify */
--    for (i = 0; i < nvqs; i++) {
--        r = virtio_bus_set_host_notifier(VIRTIO_BUS(qbus), i, true);
--        if (r != 0) {
--            int j = i;
--
--            fprintf(stderr, "virtio-blk failed to set host notifier (%d)\n", r);
--            while (i--) {
--                virtio_bus_set_host_notifier(VIRTIO_BUS(qbus), i, false);
--            }
--
--            /*
--             * The transaction expects the ioeventfds to be open when it
--             * commits. Do it now, before the cleanup loop.
--             */
--            memory_region_transaction_commit();
--
--            while (j--) {
--                virtio_bus_cleanup_host_notifier(VIRTIO_BUS(qbus), j);
--            }
--            goto fail_host_notifiers;
--        }
--    }
--
--    memory_region_transaction_commit();
--
--    trace_virtio_blk_data_plane_start(s);
--
--    r = blk_set_aio_context(s->conf->conf.blk, s->vq_aio_context[0],
--                            &local_err);
--    if (r < 0) {
--        error_report_err(local_err);
--        goto fail_aio_context;
--    }
--
--    /*
--     * These fields must be visible to the IOThread when it processes the
--     * virtqueue, otherwise it will think dataplane has not started yet.
--     *
--     * Make sure ->dataplane_started is false when blk_set_aio_context() is
--     * called above so that draining does not cause the host notifier to be
--     * detached/attached prematurely.
--     */
--    s->starting = false;
--    vblk->dataplane_started = true;
--    smp_wmb(); /* paired with aio_notify_accept() on the read side */
--
--    /* Get this show started by hooking up our callbacks */
--    if (!blk_in_drain(s->conf->conf.blk)) {
--        for (i = 0; i < nvqs; i++) {
--            VirtQueue *vq = virtio_get_queue(s->vdev, i);
--            AioContext *ctx = s->vq_aio_context[i];
--
--            /* Kick right away to begin processing requests already in vring */
--            event_notifier_set(virtio_queue_get_host_notifier(vq));
--
--            virtio_queue_aio_attach_host_notifier(vq, ctx);
--        }
--    }
--    return 0;
--
--  fail_aio_context:
--    memory_region_transaction_begin();
--
--    for (i = 0; i < nvqs; i++) {
--        virtio_bus_set_host_notifier(VIRTIO_BUS(qbus), i, false);
--    }
--
--    memory_region_transaction_commit();
--
--    for (i = 0; i < nvqs; i++) {
--        virtio_bus_cleanup_host_notifier(VIRTIO_BUS(qbus), i);
--    }
--  fail_host_notifiers:
--    k->set_guest_notifiers(qbus->parent, nvqs, false);
--  fail_guest_notifiers:
--    vblk->dataplane_disabled = true;
--    s->starting = false;
--    return -ENOSYS;
--}
--
--/* Stop notifications for new requests from guest.
-- *
-- * Context: BH in IOThread
-- */
--static void virtio_blk_data_plane_stop_vq_bh(void *opaque)
--{
--    VirtQueue *vq = opaque;
--    EventNotifier *host_notifier = virtio_queue_get_host_notifier(vq);
--
--    virtio_queue_aio_detach_host_notifier(vq, qemu_get_current_aio_context());
--
--    /*
--     * Test and clear notifier after disabling event, in case poll callback
--     * didn't have time to run.
--     */
--    virtio_queue_host_notifier_read(host_notifier);
--}
--
--/* Context: QEMU global mutex held */
--void virtio_blk_data_plane_stop(VirtIODevice *vdev)
--{
--    VirtIOBlock *vblk = VIRTIO_BLK(vdev);
--    VirtIOBlockDataPlane *s = vblk->dataplane;
--    BusState *qbus = qdev_get_parent_bus(DEVICE(vblk));
--    VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(qbus);
--    unsigned i;
--    unsigned nvqs = s->conf->num_queues;
--
--    if (!vblk->dataplane_started || s->stopping) {
--        return;
--    }
--
--    /* Better luck next time. */
--    if (vblk->dataplane_disabled) {
--        vblk->dataplane_disabled = false;
--        vblk->dataplane_started = false;
--        return;
--    }
--    s->stopping = true;
--    trace_virtio_blk_data_plane_stop(s);
--
--    if (!blk_in_drain(s->conf->conf.blk)) {
--        for (i = 0; i < nvqs; i++) {
--            VirtQueue *vq = virtio_get_queue(s->vdev, i);
--            AioContext *ctx = s->vq_aio_context[i];
--
--            aio_wait_bh_oneshot(ctx, virtio_blk_data_plane_stop_vq_bh, vq);
--        }
--    }
--
--    /*
--     * Batch all the host notifiers in a single transaction to avoid
--     * quadratic time complexity in address_space_update_ioeventfds().
--     */
--    memory_region_transaction_begin();
--
--    for (i = 0; i < nvqs; i++) {
--        virtio_bus_set_host_notifier(VIRTIO_BUS(qbus), i, false);
--    }
--
--    /*
--     * The transaction expects the ioeventfds to be open when it
--     * commits. Do it now, before the cleanup loop.
--     */
--    memory_region_transaction_commit();
--
--    for (i = 0; i < nvqs; i++) {
--        virtio_bus_cleanup_host_notifier(VIRTIO_BUS(qbus), i);
--    }
--
--    /*
--     * Set ->dataplane_started to false before draining so that host notifiers
--     * are not detached/attached anymore.
--     */
--    vblk->dataplane_started = false;
--
--    /* Wait for virtio_blk_dma_restart_bh() and in flight I/O to complete */
--    blk_drain(s->conf->conf.blk);
--
--    /*
--     * Try to switch bs back to the QEMU main loop. If other users keep the
--     * BlockBackend in the iothread, that's ok
--     */
--    blk_set_aio_context(s->conf->conf.blk, qemu_get_aio_context(), NULL);
--
--    /* Clean up guest notifier (irq) */
--    k->set_guest_notifiers(qbus->parent, nvqs, false);
--
--    s->stopping = false;
--}
--
--void virtio_blk_data_plane_detach(VirtIOBlockDataPlane *s)
--{
--    VirtIODevice *vdev = VIRTIO_DEVICE(s->vdev);
--
--    for (uint16_t i = 0; i < s->conf->num_queues; i++) {
--        VirtQueue *vq = virtio_get_queue(vdev, i);
--        virtio_queue_aio_detach_host_notifier(vq, s->vq_aio_context[i]);
--    }
--}
--
--void virtio_blk_data_plane_attach(VirtIOBlockDataPlane *s)
--{
--    VirtIODevice *vdev = VIRTIO_DEVICE(s->vdev);
--
--    for (uint16_t i = 0; i < s->conf->num_queues; i++) {
--        VirtQueue *vq = virtio_get_queue(vdev, i);
--        virtio_queue_aio_attach_host_notifier(vq, s->vq_aio_context[i]);
--    }
--}
-diff --git a/hw/block/dataplane/virtio-blk.h b/hw/block/dataplane/virtio-blk.h
-deleted file mode 100644
-index 1a806fe447..0000000000
---- a/hw/block/dataplane/virtio-blk.h
-+++ /dev/null
-@@ -1,34 +0,0 @@
--/*
-- * Dedicated thread for virtio-blk I/O processing
-- *
-- * Copyright 2012 IBM, Corp.
-- * Copyright 2012 Red Hat, Inc. and/or its affiliates
-- *
-- * Authors:
-- *   Stefan Hajnoczi <stefanha@redhat.com>
-- *
-- * This work is licensed under the terms of the GNU GPL, version 2 or later.
-- * See the COPYING file in the top-level directory.
-- *
-- */
--
--#ifndef HW_DATAPLANE_VIRTIO_BLK_H
--#define HW_DATAPLANE_VIRTIO_BLK_H
--
--#include "hw/virtio/virtio.h"
--
--typedef struct VirtIOBlockDataPlane VirtIOBlockDataPlane;
--
--bool virtio_blk_data_plane_create(VirtIODevice *vdev, VirtIOBlkConf *conf,
--                                  VirtIOBlockDataPlane **dataplane,
--                                  Error **errp);
--void virtio_blk_data_plane_destroy(VirtIOBlockDataPlane *s);
--void virtio_blk_data_plane_notify(VirtIOBlockDataPlane *s, VirtQueue *vq);
--
--int virtio_blk_data_plane_start(VirtIODevice *vdev);
--void virtio_blk_data_plane_stop(VirtIODevice *vdev);
--
--void virtio_blk_data_plane_detach(VirtIOBlockDataPlane *s);
--void virtio_blk_data_plane_attach(VirtIOBlockDataPlane *s);
--
--#endif /* HW_DATAPLANE_VIRTIO_BLK_H */
-diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
-index 46e73b2c96..cb623069f8 100644
---- a/hw/block/virtio-blk.c
-+++ b/hw/block/virtio-blk.c
-@@ -27,7 +27,6 @@
- #include "sysemu/sysemu.h"
- #include "sysemu/runstate.h"
- #include "hw/virtio/virtio-blk.h"
--#include "dataplane/virtio-blk.h"
- #include "scsi/constants.h"
- #ifdef __linux__
- # include <scsi/sg.h>
-@@ -66,7 +65,7 @@ static void virtio_blk_req_complete(VirtIOBlockReq *req, unsigned char status)
-     iov_discard_undo(&req->outhdr_undo);
-     virtqueue_push(req->vq, &req->elem, req->in_len);
-     if (s->dataplane_started && !s->dataplane_disabled) {
--        virtio_blk_data_plane_notify(s->dataplane, req->vq);
-+        virtio_notify_irqfd(vdev, req->vq);
-     } else {
-         virtio_notify(vdev, req->vq);
-     }
-@@ -1142,7 +1141,7 @@ static void virtio_blk_handle_output(VirtIODevice *vdev, VirtQueue *vq)
- {
-     VirtIOBlock *s = (VirtIOBlock *)vdev;
- 
--    if (s->dataplane && !s->dataplane_started) {
-+    if (!s->dataplane_disabled && !s->dataplane_started) {
-         /* Some guests kick before setting VIRTIO_CONFIG_S_DRIVER_OK so start
-          * dataplane here instead of waiting for .set_status().
-          */
-@@ -1546,16 +1545,34 @@ static void virtio_blk_resize(void *opaque)
-     aio_bh_schedule_oneshot(qemu_get_aio_context(), virtio_resize_cb, vdev);
- }
- 
-+static void virtio_blk_data_plane_detach(VirtIOBlock *s)
-+{
-+    VirtIODevice *vdev = VIRTIO_DEVICE(s);
-+
-+    for (uint16_t i = 0; i < s->conf.num_queues; i++) {
-+        VirtQueue *vq = virtio_get_queue(vdev, i);
-+        virtio_queue_aio_detach_host_notifier(vq, s->vq_aio_context[i]);
-+    }
-+}
-+
-+static void virtio_blk_data_plane_attach(VirtIOBlock *s)
-+{
-+    VirtIODevice *vdev = VIRTIO_DEVICE(s);
-+
-+    for (uint16_t i = 0; i < s->conf.num_queues; i++) {
-+        VirtQueue *vq = virtio_get_queue(vdev, i);
-+        virtio_queue_aio_attach_host_notifier(vq, s->vq_aio_context[i]);
-+    }
-+}
-+
- /* Suspend virtqueue ioeventfd processing during drain */
- static void virtio_blk_drained_begin(void *opaque)
- {
-     VirtIOBlock *s = opaque;
- 
--    if (!s->dataplane || !s->dataplane_started) {
--        return;
-+    if (s->dataplane_started) {
-+        virtio_blk_data_plane_detach(s);
-     }
--
--    virtio_blk_data_plane_detach(s->dataplane);
- }
- 
- /* Resume virtqueue ioeventfd processing after drain */
-@@ -1563,11 +1580,9 @@ static void virtio_blk_drained_end(void *opaque)
- {
-     VirtIOBlock *s = opaque;
- 
--    if (!s->dataplane || !s->dataplane_started) {
--        return;
-+    if (s->dataplane_started) {
-+        virtio_blk_data_plane_attach(s);
-     }
--
--    virtio_blk_data_plane_attach(s->dataplane);
- }
- 
- static const BlockDevOps virtio_block_ops = {
-@@ -1576,6 +1591,326 @@ static const BlockDevOps virtio_block_ops = {
-     .drained_end   = virtio_blk_drained_end,
- };
- 
-+/* Generate vq:AioContext mappings from a validated iothread-vq-mapping list */
-+static void
-+apply_vq_mapping(IOThreadVirtQueueMappingList *iothread_vq_mapping_list,
-+                 AioContext **vq_aio_context, uint16_t num_queues)
-+{
-+    IOThreadVirtQueueMappingList *node;
-+    size_t num_iothreads = 0;
-+    size_t cur_iothread = 0;
-+
-+    for (node = iothread_vq_mapping_list; node; node = node->next) {
-+        num_iothreads++;
-+    }
-+
-+    for (node = iothread_vq_mapping_list; node; node = node->next) {
-+        IOThread *iothread = iothread_by_id(node->value->iothread);
-+        AioContext *ctx = iothread_get_aio_context(iothread);
-+
-+        /* Released in virtio_blk_data_plane_destroy() */
-+        object_ref(OBJECT(iothread));
-+
-+        if (node->value->vqs) {
-+            uint16List *vq;
-+
-+            /* Explicit vq:IOThread assignment */
-+            for (vq = node->value->vqs; vq; vq = vq->next) {
-+                vq_aio_context[vq->value] = ctx;
-+            }
-+        } else {
-+            /* Round-robin vq:IOThread assignment */
-+            for (unsigned i = cur_iothread; i < num_queues;
-+                 i += num_iothreads) {
-+                vq_aio_context[i] = ctx;
-+            }
-+        }
-+
-+        cur_iothread++;
-+    }
-+}
-+
-+/* Context: BQL held */
-+static bool virtio_blk_data_plane_create(VirtIOBlock *s, Error **errp)
-+{
-+    VirtIODevice *vdev = VIRTIO_DEVICE(s);
-+    VirtIOBlkConf *conf = &s->conf;
-+    BusState *qbus = BUS(qdev_get_parent_bus(DEVICE(vdev)));
-+    VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(qbus);
-+
-+    if (conf->iothread || conf->iothread_vq_mapping_list) {
-+        if (!k->set_guest_notifiers || !k->ioeventfd_assign) {
-+            error_setg(errp,
-+                       "device is incompatible with iothread "
-+                       "(transport does not support notifiers)");
-+            return false;
-+        }
-+        if (!virtio_device_ioeventfd_enabled(vdev)) {
-+            error_setg(errp, "ioeventfd is required for iothread");
-+            return false;
-+        }
-+
-+        /*
-+         * If dataplane is (re-)enabled while the guest is running there could
-+         * be block jobs that can conflict.
-+         */
-+        if (blk_op_is_blocked(conf->conf.blk, BLOCK_OP_TYPE_DATAPLANE, errp)) {
-+            error_prepend(errp, "cannot start virtio-blk dataplane: ");
-+            return false;
-+        }
-+    }
-+    /* Don't try if transport does not support notifiers. */
-+    if (!virtio_device_ioeventfd_enabled(vdev)) {
-+        s->dataplane_disabled = true;
-+        return false;
-+    }
-+
-+    s->vq_aio_context = g_new(AioContext *, conf->num_queues);
-+
-+    if (conf->iothread_vq_mapping_list) {
-+        apply_vq_mapping(conf->iothread_vq_mapping_list, s->vq_aio_context,
-+                         conf->num_queues);
-+    } else if (conf->iothread) {
-+        AioContext *ctx = iothread_get_aio_context(conf->iothread);
-+        for (unsigned i = 0; i < conf->num_queues; i++) {
-+            s->vq_aio_context[i] = ctx;
-+        }
-+
-+        /* Released in virtio_blk_data_plane_destroy() */
-+        object_ref(OBJECT(conf->iothread));
-+    } else {
-+        AioContext *ctx = qemu_get_aio_context();
-+        for (unsigned i = 0; i < conf->num_queues; i++) {
-+            s->vq_aio_context[i] = ctx;
-+        }
-+    }
-+
-+    return true;
-+}
-+
-+/* Context: BQL held */
-+static void virtio_blk_data_plane_destroy(VirtIOBlock *s)
-+{
-+    VirtIOBlkConf *conf = &s->conf;
-+
-+    assert(!s->dataplane_started);
-+
-+    if (conf->iothread_vq_mapping_list) {
-+        IOThreadVirtQueueMappingList *node;
-+
-+        for (node = conf->iothread_vq_mapping_list; node; node = node->next) {
-+            IOThread *iothread = iothread_by_id(node->value->iothread);
-+            object_unref(OBJECT(iothread));
-+        }
-+    }
-+
-+    if (conf->iothread) {
-+        object_unref(OBJECT(conf->iothread));
-+    }
-+
-+    g_free(s->vq_aio_context);
-+    s->vq_aio_context = NULL;
-+}
-+
-+/* Context: BQL held */
-+static int virtio_blk_data_plane_start(VirtIODevice *vdev)
-+{
-+    VirtIOBlock *s = VIRTIO_BLK(vdev);
-+    BusState *qbus = BUS(qdev_get_parent_bus(DEVICE(s)));
-+    VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(qbus);
-+    unsigned i;
-+    unsigned nvqs = s->conf.num_queues;
-+    Error *local_err = NULL;
-+    int r;
-+
-+    if (s->dataplane_started || s->dataplane_starting) {
-+        return 0;
-+    }
-+
-+    s->dataplane_starting = true;
-+
-+    /* Set up guest notifier (irq) */
-+    r = k->set_guest_notifiers(qbus->parent, nvqs, true);
-+    if (r != 0) {
-+        error_report("virtio-blk failed to set guest notifier (%d), "
-+                     "ensure -accel kvm is set.", r);
-+        goto fail_guest_notifiers;
-+    }
-+
-+    /*
-+     * Batch all the host notifiers in a single transaction to avoid
-+     * quadratic time complexity in address_space_update_ioeventfds().
-+     */
-+    memory_region_transaction_begin();
-+
-+    /* Set up virtqueue notify */
-+    for (i = 0; i < nvqs; i++) {
-+        r = virtio_bus_set_host_notifier(VIRTIO_BUS(qbus), i, true);
-+        if (r != 0) {
-+            int j = i;
-+
-+            fprintf(stderr, "virtio-blk failed to set host notifier (%d)\n", r);
-+            while (i--) {
-+                virtio_bus_set_host_notifier(VIRTIO_BUS(qbus), i, false);
-+            }
-+
-+            /*
-+             * The transaction expects the ioeventfds to be open when it
-+             * commits. Do it now, before the cleanup loop.
-+             */
-+            memory_region_transaction_commit();
-+
-+            while (j--) {
-+                virtio_bus_cleanup_host_notifier(VIRTIO_BUS(qbus), j);
-+            }
-+            goto fail_host_notifiers;
-+        }
-+    }
-+
-+    memory_region_transaction_commit();
-+
-+    r = blk_set_aio_context(s->conf.conf.blk, s->vq_aio_context[0],
-+                            &local_err);
-+    if (r < 0) {
-+        error_report_err(local_err);
-+        goto fail_aio_context;
-+    }
-+
-+    /*
-+     * These fields must be visible to the IOThread when it processes the
-+     * virtqueue, otherwise it will think dataplane has not started yet.
-+     *
-+     * Make sure ->dataplane_started is false when blk_set_aio_context() is
-+     * called above so that draining does not cause the host notifier to be
-+     * detached/attached prematurely.
-+     */
-+    s->dataplane_starting = false;
-+    s->dataplane_started = true;
-+    smp_wmb(); /* paired with aio_notify_accept() on the read side */
-+
-+    /* Get this show started by hooking up our callbacks */
-+    if (!blk_in_drain(s->conf.conf.blk)) {
-+        for (i = 0; i < nvqs; i++) {
-+            VirtQueue *vq = virtio_get_queue(vdev, i);
-+            AioContext *ctx = s->vq_aio_context[i];
-+
-+            /* Kick right away to begin processing requests already in vring */
-+            event_notifier_set(virtio_queue_get_host_notifier(vq));
-+
-+            virtio_queue_aio_attach_host_notifier(vq, ctx);
-+        }
-+    }
-+    return 0;
-+
-+  fail_aio_context:
-+    memory_region_transaction_begin();
-+
-+    for (i = 0; i < nvqs; i++) {
-+        virtio_bus_set_host_notifier(VIRTIO_BUS(qbus), i, false);
-+    }
-+
-+    memory_region_transaction_commit();
-+
-+    for (i = 0; i < nvqs; i++) {
-+        virtio_bus_cleanup_host_notifier(VIRTIO_BUS(qbus), i);
-+    }
-+  fail_host_notifiers:
-+    k->set_guest_notifiers(qbus->parent, nvqs, false);
-+  fail_guest_notifiers:
-+    s->dataplane_disabled = true;
-+    s->dataplane_starting = false;
-+    return -ENOSYS;
-+}
-+
-+/* Stop notifications for new requests from guest.
-+ *
-+ * Context: BH in IOThread
-+ */
-+static void virtio_blk_data_plane_stop_vq_bh(void *opaque)
-+{
-+    VirtQueue *vq = opaque;
-+    EventNotifier *host_notifier = virtio_queue_get_host_notifier(vq);
-+
-+    virtio_queue_aio_detach_host_notifier(vq, qemu_get_current_aio_context());
-+
-+    /*
-+     * Test and clear notifier after disabling event, in case poll callback
-+     * didn't have time to run.
-+     */
-+    virtio_queue_host_notifier_read(host_notifier);
-+}
-+
-+/* Context: BQL held */
-+static void virtio_blk_data_plane_stop(VirtIODevice *vdev)
-+{
-+    VirtIOBlock *s = VIRTIO_BLK(vdev);
-+    BusState *qbus = qdev_get_parent_bus(DEVICE(s));
-+    VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(qbus);
-+    unsigned i;
-+    unsigned nvqs = s->conf.num_queues;
-+
-+    if (!s->dataplane_started || s->dataplane_stopping) {
-+        return;
-+    }
-+
-+    /* Better luck next time. */
-+    if (s->dataplane_disabled) {
-+        s->dataplane_disabled = false;
-+        s->dataplane_started = false;
-+        return;
-+    }
-+    s->dataplane_stopping = true;
-+
-+    if (!blk_in_drain(s->conf.conf.blk)) {
-+        for (i = 0; i < nvqs; i++) {
-+            VirtQueue *vq = virtio_get_queue(vdev, i);
-+            AioContext *ctx = s->vq_aio_context[i];
-+
-+            aio_wait_bh_oneshot(ctx, virtio_blk_data_plane_stop_vq_bh, vq);
-+        }
-+    }
-+
-+    /*
-+     * Batch all the host notifiers in a single transaction to avoid
-+     * quadratic time complexity in address_space_update_ioeventfds().
-+     */
-+    memory_region_transaction_begin();
-+
-+    for (i = 0; i < nvqs; i++) {
-+        virtio_bus_set_host_notifier(VIRTIO_BUS(qbus), i, false);
-+    }
-+
-+    /*
-+     * The transaction expects the ioeventfds to be open when it
-+     * commits. Do it now, before the cleanup loop.
-+     */
-+    memory_region_transaction_commit();
-+
-+    for (i = 0; i < nvqs; i++) {
-+        virtio_bus_cleanup_host_notifier(VIRTIO_BUS(qbus), i);
-+    }
-+
-+    /*
-+     * Set ->dataplane_started to false before draining so that host notifiers
-+     * are not detached/attached anymore.
-+     */
-+    s->dataplane_started = false;
-+
-+    /* Wait for virtio_blk_dma_restart_bh() and in flight I/O to complete */
-+    blk_drain(s->conf.conf.blk);
-+
-+    /*
-+     * Try to switch bs back to the QEMU main loop. If other users keep the
-+     * BlockBackend in the iothread, that's ok
-+     */
-+    blk_set_aio_context(s->conf.conf.blk, qemu_get_aio_context(), NULL);
-+
-+    /* Clean up guest notifier (irq) */
-+    k->set_guest_notifiers(qbus->parent, nvqs, false);
-+
-+    s->dataplane_stopping = false;
-+}
-+
- static void virtio_blk_device_realize(DeviceState *dev, Error **errp)
- {
-     VirtIODevice *vdev = VIRTIO_DEVICE(dev);
-@@ -1680,7 +2015,7 @@ static void virtio_blk_device_realize(DeviceState *dev, Error **errp)
-         virtio_add_queue(vdev, conf->queue_size, virtio_blk_handle_output);
-     }
-     qemu_coroutine_inc_pool_size(conf->num_queues * conf->queue_size / 2);
--    virtio_blk_data_plane_create(vdev, conf, &s->dataplane, &err);
-+    virtio_blk_data_plane_create(s, &err);
-     if (err != NULL) {
-         error_propagate(errp, err);
-         for (i = 0; i < conf->num_queues; i++) {
-@@ -1717,8 +2052,7 @@ static void virtio_blk_device_unrealize(DeviceState *dev)
- 
-     blk_drain(s->blk);
-     del_boot_device_lchs(dev, "/disk@0,0");
--    virtio_blk_data_plane_destroy(s->dataplane);
--    s->dataplane = NULL;
-+    virtio_blk_data_plane_destroy(s);
-     for (i = 0; i < conf->num_queues; i++) {
-         virtio_del_queue(vdev, i);
-     }
-diff --git a/include/hw/virtio/virtio-blk.h b/include/hw/virtio/virtio-blk.h
-index 5e4091e4da..fecffdc303 100644
---- a/include/hw/virtio/virtio-blk.h
-+++ b/include/hw/virtio/virtio-blk.h
-@@ -50,8 +50,6 @@ struct VirtIOBlkConf
-     bool x_enable_wce_if_config_wce;
- };
- 
--struct VirtIOBlockDataPlane;
--
- struct VirtIOBlockReq;
- struct VirtIOBlock {
-     VirtIODevice parent_obj;
-@@ -64,7 +62,15 @@ struct VirtIOBlock {
-     VMChangeStateEntry *change;
-     bool dataplane_disabled;
-     bool dataplane_started;
--    struct VirtIOBlockDataPlane *dataplane;
-+    bool dataplane_starting;
-+    bool dataplane_stopping;
-+
-+    /*
-+     * The AioContext for each virtqueue. The BlockDriverState will use the
-+     * first element as its AioContext.
-+     */
-+    AioContext **vq_aio_context;
-+
-     uint64_t host_features;
-     size_t config_size;
-     BlockRAMRegistrar blk_ram_registrar;
-diff --git a/meson.build b/meson.build
-index 6c77d9687d..47c65d0f53 100644
---- a/meson.build
-+++ b/meson.build
-@@ -3298,7 +3298,6 @@ if have_system
-     'hw/arm',
-     'hw/audio',
-     'hw/block',
--    'hw/block/dataplane',
-     'hw/char',
-     'hw/display',
-     'hw/dma',
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-virtio-blk-rename-dataplane-create-destroy-functions.patch b/SOURCES/kvm-virtio-blk-rename-dataplane-create-destroy-functions.patch
deleted file mode 100644
index 5f45b9d..0000000
--- a/SOURCES/kvm-virtio-blk-rename-dataplane-create-destroy-functions.patch
+++ /dev/null
@@ -1,117 +0,0 @@
-From 71257c2f320f1511de1e275779cf4b90effc1f02 Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Fri, 19 Jan 2024 08:57:44 -0500
-Subject: [PATCH 15/22] virtio-blk: rename dataplane create/destroy functions
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 219: virtio-blk: add iothread-vq-mapping parameter
-RH-Jira: RHEL-17369 RHEL-20764 RHEL-7356
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Commit: [11/17] 60e7016d5f3e4e9e89945578279b12f812f85ddf (stefanha/centos-stream-qemu-kvm)
-
-virtio_blk_data_plane_create() and virtio_blk_data_plane_destroy() are
-actually about s->vq_aio_context[] rather than managing
-dataplane-specific state.
-
-As a prerequisite to using s->vq_aio_context[] in all code paths (even
-when dataplane is not used), rename these functions to reflect that they
-just manage s->vq_aio_context and call them regardless of whether or not
-dataplane is in use.
-
-Note that virtio-blk supports running with -device
-virtio-blk-pci,ioevent=off where the vCPU thread enters the device
-emulation code. In this mode ioeventfd is not used for virtqueue
-processing. However, we still want to initialize s->vq_aio_context[] to
-qemu_aio_context in that case since I/O completion callbacks will be
-invoked in the main loop thread.
-
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20240119135748.270944-3-stefanha@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 57bc2658935778d1ae0edbcd4402763da8c7bae2)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- hw/block/virtio-blk.c | 23 ++++++++++++-----------
- 1 file changed, 12 insertions(+), 11 deletions(-)
-
-diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
-index cb623069f8..4d6f9377c6 100644
---- a/hw/block/virtio-blk.c
-+++ b/hw/block/virtio-blk.c
-@@ -1608,7 +1608,7 @@ apply_vq_mapping(IOThreadVirtQueueMappingList *iothread_vq_mapping_list,
-         IOThread *iothread = iothread_by_id(node->value->iothread);
-         AioContext *ctx = iothread_get_aio_context(iothread);
- 
--        /* Released in virtio_blk_data_plane_destroy() */
-+        /* Released in virtio_blk_vq_aio_context_cleanup() */
-         object_ref(OBJECT(iothread));
- 
-         if (node->value->vqs) {
-@@ -1631,7 +1631,7 @@ apply_vq_mapping(IOThreadVirtQueueMappingList *iothread_vq_mapping_list,
- }
- 
- /* Context: BQL held */
--static bool virtio_blk_data_plane_create(VirtIOBlock *s, Error **errp)
-+static bool virtio_blk_vq_aio_context_init(VirtIOBlock *s, Error **errp)
- {
-     VirtIODevice *vdev = VIRTIO_DEVICE(s);
-     VirtIOBlkConf *conf = &s->conf;
-@@ -1659,11 +1659,6 @@ static bool virtio_blk_data_plane_create(VirtIOBlock *s, Error **errp)
-             return false;
-         }
-     }
--    /* Don't try if transport does not support notifiers. */
--    if (!virtio_device_ioeventfd_enabled(vdev)) {
--        s->dataplane_disabled = true;
--        return false;
--    }
- 
-     s->vq_aio_context = g_new(AioContext *, conf->num_queues);
- 
-@@ -1676,7 +1671,7 @@ static bool virtio_blk_data_plane_create(VirtIOBlock *s, Error **errp)
-             s->vq_aio_context[i] = ctx;
-         }
- 
--        /* Released in virtio_blk_data_plane_destroy() */
-+        /* Released in virtio_blk_vq_aio_context_cleanup() */
-         object_ref(OBJECT(conf->iothread));
-     } else {
-         AioContext *ctx = qemu_get_aio_context();
-@@ -1689,7 +1684,7 @@ static bool virtio_blk_data_plane_create(VirtIOBlock *s, Error **errp)
- }
- 
- /* Context: BQL held */
--static void virtio_blk_data_plane_destroy(VirtIOBlock *s)
-+static void virtio_blk_vq_aio_context_cleanup(VirtIOBlock *s)
- {
-     VirtIOBlkConf *conf = &s->conf;
- 
-@@ -2015,7 +2010,13 @@ static void virtio_blk_device_realize(DeviceState *dev, Error **errp)
-         virtio_add_queue(vdev, conf->queue_size, virtio_blk_handle_output);
-     }
-     qemu_coroutine_inc_pool_size(conf->num_queues * conf->queue_size / 2);
--    virtio_blk_data_plane_create(s, &err);
-+
-+    /* Don't start dataplane if transport does not support notifiers. */
-+    if (!virtio_device_ioeventfd_enabled(vdev)) {
-+        s->dataplane_disabled = true;
-+    }
-+
-+    virtio_blk_vq_aio_context_init(s, &err);
-     if (err != NULL) {
-         error_propagate(errp, err);
-         for (i = 0; i < conf->num_queues; i++) {
-@@ -2052,7 +2053,7 @@ static void virtio_blk_device_unrealize(DeviceState *dev)
- 
-     blk_drain(s->blk);
-     del_boot_device_lchs(dev, "/disk@0,0");
--    virtio_blk_data_plane_destroy(s);
-+    virtio_blk_vq_aio_context_cleanup(s);
-     for (i = 0; i < conf->num_queues; i++) {
-         virtio_del_queue(vdev, i);
-     }
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-virtio-blk-rename-dataplane-to-ioeventfd.patch b/SOURCES/kvm-virtio-blk-rename-dataplane-to-ioeventfd.patch
deleted file mode 100644
index a0c0b67..0000000
--- a/SOURCES/kvm-virtio-blk-rename-dataplane-to-ioeventfd.patch
+++ /dev/null
@@ -1,307 +0,0 @@
-From ba80cdcd5604b9b9efc4682ade9828ab74ebf5e6 Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Fri, 19 Jan 2024 08:57:45 -0500
-Subject: [PATCH 16/22] virtio-blk: rename dataplane to ioeventfd
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 219: virtio-blk: add iothread-vq-mapping parameter
-RH-Jira: RHEL-17369 RHEL-20764 RHEL-7356
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Commit: [12/17] 4230005e0d1b4629fe4540f1f63cd705e58618da (stefanha/centos-stream-qemu-kvm)
-
-The dataplane code is really about using ioeventfd. It's used both for
-IOThreads (what we think of as dataplane) and for the core virtio-pci
-code's ioeventfd feature (which is enabled by default and used when no
-IOThread has been specified). Rename the code to reflect this.
-
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20240119135748.270944-4-stefanha@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 3cdaf3dd4a4ca94ebabe7eab23b432f1a6c547cc)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- hw/block/virtio-blk.c          | 78 +++++++++++++++++-----------------
- include/hw/virtio/virtio-blk.h |  8 ++--
- 2 files changed, 43 insertions(+), 43 deletions(-)
-
-diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
-index 4d6f9377c6..08c566946a 100644
---- a/hw/block/virtio-blk.c
-+++ b/hw/block/virtio-blk.c
-@@ -64,7 +64,7 @@ static void virtio_blk_req_complete(VirtIOBlockReq *req, unsigned char status)
-     iov_discard_undo(&req->inhdr_undo);
-     iov_discard_undo(&req->outhdr_undo);
-     virtqueue_push(req->vq, &req->elem, req->in_len);
--    if (s->dataplane_started && !s->dataplane_disabled) {
-+    if (s->ioeventfd_started && !s->ioeventfd_disabled) {
-         virtio_notify_irqfd(vdev, req->vq);
-     } else {
-         virtio_notify(vdev, req->vq);
-@@ -1141,12 +1141,12 @@ static void virtio_blk_handle_output(VirtIODevice *vdev, VirtQueue *vq)
- {
-     VirtIOBlock *s = (VirtIOBlock *)vdev;
- 
--    if (!s->dataplane_disabled && !s->dataplane_started) {
-+    if (!s->ioeventfd_disabled && !s->ioeventfd_started) {
-         /* Some guests kick before setting VIRTIO_CONFIG_S_DRIVER_OK so start
--         * dataplane here instead of waiting for .set_status().
-+         * ioeventfd here instead of waiting for .set_status().
-          */
-         virtio_device_start_ioeventfd(vdev);
--        if (!s->dataplane_disabled) {
-+        if (!s->ioeventfd_disabled) {
-             return;
-         }
-     }
-@@ -1213,7 +1213,7 @@ static void virtio_blk_reset(VirtIODevice *vdev)
-     VirtIOBlockReq *req;
- 
-     /* Dataplane has stopped... */
--    assert(!s->dataplane_started);
-+    assert(!s->ioeventfd_started);
- 
-     /* ...but requests may still be in flight. */
-     blk_drain(s->blk);
-@@ -1380,7 +1380,7 @@ static void virtio_blk_set_status(VirtIODevice *vdev, uint8_t status)
-     VirtIOBlock *s = VIRTIO_BLK(vdev);
- 
-     if (!(status & (VIRTIO_CONFIG_S_DRIVER | VIRTIO_CONFIG_S_DRIVER_OK))) {
--        assert(!s->dataplane_started);
-+        assert(!s->ioeventfd_started);
-     }
- 
-     if (!(status & VIRTIO_CONFIG_S_DRIVER_OK)) {
-@@ -1545,7 +1545,7 @@ static void virtio_blk_resize(void *opaque)
-     aio_bh_schedule_oneshot(qemu_get_aio_context(), virtio_resize_cb, vdev);
- }
- 
--static void virtio_blk_data_plane_detach(VirtIOBlock *s)
-+static void virtio_blk_ioeventfd_detach(VirtIOBlock *s)
- {
-     VirtIODevice *vdev = VIRTIO_DEVICE(s);
- 
-@@ -1555,7 +1555,7 @@ static void virtio_blk_data_plane_detach(VirtIOBlock *s)
-     }
- }
- 
--static void virtio_blk_data_plane_attach(VirtIOBlock *s)
-+static void virtio_blk_ioeventfd_attach(VirtIOBlock *s)
- {
-     VirtIODevice *vdev = VIRTIO_DEVICE(s);
- 
-@@ -1570,8 +1570,8 @@ static void virtio_blk_drained_begin(void *opaque)
- {
-     VirtIOBlock *s = opaque;
- 
--    if (s->dataplane_started) {
--        virtio_blk_data_plane_detach(s);
-+    if (s->ioeventfd_started) {
-+        virtio_blk_ioeventfd_detach(s);
-     }
- }
- 
-@@ -1580,8 +1580,8 @@ static void virtio_blk_drained_end(void *opaque)
- {
-     VirtIOBlock *s = opaque;
- 
--    if (s->dataplane_started) {
--        virtio_blk_data_plane_attach(s);
-+    if (s->ioeventfd_started) {
-+        virtio_blk_ioeventfd_attach(s);
-     }
- }
- 
-@@ -1651,11 +1651,11 @@ static bool virtio_blk_vq_aio_context_init(VirtIOBlock *s, Error **errp)
-         }
- 
-         /*
--         * If dataplane is (re-)enabled while the guest is running there could
-+         * If ioeventfd is (re-)enabled while the guest is running there could
-          * be block jobs that can conflict.
-          */
-         if (blk_op_is_blocked(conf->conf.blk, BLOCK_OP_TYPE_DATAPLANE, errp)) {
--            error_prepend(errp, "cannot start virtio-blk dataplane: ");
-+            error_prepend(errp, "cannot start virtio-blk ioeventfd: ");
-             return false;
-         }
-     }
-@@ -1688,7 +1688,7 @@ static void virtio_blk_vq_aio_context_cleanup(VirtIOBlock *s)
- {
-     VirtIOBlkConf *conf = &s->conf;
- 
--    assert(!s->dataplane_started);
-+    assert(!s->ioeventfd_started);
- 
-     if (conf->iothread_vq_mapping_list) {
-         IOThreadVirtQueueMappingList *node;
-@@ -1708,7 +1708,7 @@ static void virtio_blk_vq_aio_context_cleanup(VirtIOBlock *s)
- }
- 
- /* Context: BQL held */
--static int virtio_blk_data_plane_start(VirtIODevice *vdev)
-+static int virtio_blk_start_ioeventfd(VirtIODevice *vdev)
- {
-     VirtIOBlock *s = VIRTIO_BLK(vdev);
-     BusState *qbus = BUS(qdev_get_parent_bus(DEVICE(s)));
-@@ -1718,11 +1718,11 @@ static int virtio_blk_data_plane_start(VirtIODevice *vdev)
-     Error *local_err = NULL;
-     int r;
- 
--    if (s->dataplane_started || s->dataplane_starting) {
-+    if (s->ioeventfd_started || s->ioeventfd_starting) {
-         return 0;
-     }
- 
--    s->dataplane_starting = true;
-+    s->ioeventfd_starting = true;
- 
-     /* Set up guest notifier (irq) */
-     r = k->set_guest_notifiers(qbus->parent, nvqs, true);
-@@ -1773,14 +1773,14 @@ static int virtio_blk_data_plane_start(VirtIODevice *vdev)
- 
-     /*
-      * These fields must be visible to the IOThread when it processes the
--     * virtqueue, otherwise it will think dataplane has not started yet.
-+     * virtqueue, otherwise it will think ioeventfd has not started yet.
-      *
--     * Make sure ->dataplane_started is false when blk_set_aio_context() is
-+     * Make sure ->ioeventfd_started is false when blk_set_aio_context() is
-      * called above so that draining does not cause the host notifier to be
-      * detached/attached prematurely.
-      */
--    s->dataplane_starting = false;
--    s->dataplane_started = true;
-+    s->ioeventfd_starting = false;
-+    s->ioeventfd_started = true;
-     smp_wmb(); /* paired with aio_notify_accept() on the read side */
- 
-     /* Get this show started by hooking up our callbacks */
-@@ -1812,8 +1812,8 @@ static int virtio_blk_data_plane_start(VirtIODevice *vdev)
-   fail_host_notifiers:
-     k->set_guest_notifiers(qbus->parent, nvqs, false);
-   fail_guest_notifiers:
--    s->dataplane_disabled = true;
--    s->dataplane_starting = false;
-+    s->ioeventfd_disabled = true;
-+    s->ioeventfd_starting = false;
-     return -ENOSYS;
- }
- 
-@@ -1821,7 +1821,7 @@ static int virtio_blk_data_plane_start(VirtIODevice *vdev)
-  *
-  * Context: BH in IOThread
-  */
--static void virtio_blk_data_plane_stop_vq_bh(void *opaque)
-+static void virtio_blk_ioeventfd_stop_vq_bh(void *opaque)
- {
-     VirtQueue *vq = opaque;
-     EventNotifier *host_notifier = virtio_queue_get_host_notifier(vq);
-@@ -1836,7 +1836,7 @@ static void virtio_blk_data_plane_stop_vq_bh(void *opaque)
- }
- 
- /* Context: BQL held */
--static void virtio_blk_data_plane_stop(VirtIODevice *vdev)
-+static void virtio_blk_stop_ioeventfd(VirtIODevice *vdev)
- {
-     VirtIOBlock *s = VIRTIO_BLK(vdev);
-     BusState *qbus = qdev_get_parent_bus(DEVICE(s));
-@@ -1844,24 +1844,24 @@ static void virtio_blk_data_plane_stop(VirtIODevice *vdev)
-     unsigned i;
-     unsigned nvqs = s->conf.num_queues;
- 
--    if (!s->dataplane_started || s->dataplane_stopping) {
-+    if (!s->ioeventfd_started || s->ioeventfd_stopping) {
-         return;
-     }
- 
-     /* Better luck next time. */
--    if (s->dataplane_disabled) {
--        s->dataplane_disabled = false;
--        s->dataplane_started = false;
-+    if (s->ioeventfd_disabled) {
-+        s->ioeventfd_disabled = false;
-+        s->ioeventfd_started = false;
-         return;
-     }
--    s->dataplane_stopping = true;
-+    s->ioeventfd_stopping = true;
- 
-     if (!blk_in_drain(s->conf.conf.blk)) {
-         for (i = 0; i < nvqs; i++) {
-             VirtQueue *vq = virtio_get_queue(vdev, i);
-             AioContext *ctx = s->vq_aio_context[i];
- 
--            aio_wait_bh_oneshot(ctx, virtio_blk_data_plane_stop_vq_bh, vq);
-+            aio_wait_bh_oneshot(ctx, virtio_blk_ioeventfd_stop_vq_bh, vq);
-         }
-     }
- 
-@@ -1886,10 +1886,10 @@ static void virtio_blk_data_plane_stop(VirtIODevice *vdev)
-     }
- 
-     /*
--     * Set ->dataplane_started to false before draining so that host notifiers
-+     * Set ->ioeventfd_started to false before draining so that host notifiers
-      * are not detached/attached anymore.
-      */
--    s->dataplane_started = false;
-+    s->ioeventfd_started = false;
- 
-     /* Wait for virtio_blk_dma_restart_bh() and in flight I/O to complete */
-     blk_drain(s->conf.conf.blk);
-@@ -1903,7 +1903,7 @@ static void virtio_blk_data_plane_stop(VirtIODevice *vdev)
-     /* Clean up guest notifier (irq) */
-     k->set_guest_notifiers(qbus->parent, nvqs, false);
- 
--    s->dataplane_stopping = false;
-+    s->ioeventfd_stopping = false;
- }
- 
- static void virtio_blk_device_realize(DeviceState *dev, Error **errp)
-@@ -2011,9 +2011,9 @@ static void virtio_blk_device_realize(DeviceState *dev, Error **errp)
-     }
-     qemu_coroutine_inc_pool_size(conf->num_queues * conf->queue_size / 2);
- 
--    /* Don't start dataplane if transport does not support notifiers. */
-+    /* Don't start ioeventfd if transport does not support notifiers. */
-     if (!virtio_device_ioeventfd_enabled(vdev)) {
--        s->dataplane_disabled = true;
-+        s->ioeventfd_disabled = true;
-     }
- 
-     virtio_blk_vq_aio_context_init(s, &err);
-@@ -2137,8 +2137,8 @@ static void virtio_blk_class_init(ObjectClass *klass, void *data)
-     vdc->reset = virtio_blk_reset;
-     vdc->save = virtio_blk_save_device;
-     vdc->load = virtio_blk_load_device;
--    vdc->start_ioeventfd = virtio_blk_data_plane_start;
--    vdc->stop_ioeventfd = virtio_blk_data_plane_stop;
-+    vdc->start_ioeventfd = virtio_blk_start_ioeventfd;
-+    vdc->stop_ioeventfd = virtio_blk_stop_ioeventfd;
- }
- 
- static const TypeInfo virtio_blk_info = {
-diff --git a/include/hw/virtio/virtio-blk.h b/include/hw/virtio/virtio-blk.h
-index fecffdc303..833a9a344f 100644
---- a/include/hw/virtio/virtio-blk.h
-+++ b/include/hw/virtio/virtio-blk.h
-@@ -60,10 +60,10 @@ struct VirtIOBlock {
-     unsigned short sector_mask;
-     bool original_wce;
-     VMChangeStateEntry *change;
--    bool dataplane_disabled;
--    bool dataplane_started;
--    bool dataplane_starting;
--    bool dataplane_stopping;
-+    bool ioeventfd_disabled;
-+    bool ioeventfd_started;
-+    bool ioeventfd_starting;
-+    bool ioeventfd_stopping;
- 
-     /*
-      * The AioContext for each virtqueue. The BlockDriverState will use the
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-virtio-blk-restart-s-rq-reqs-in-vq-AioContexts.patch b/SOURCES/kvm-virtio-blk-restart-s-rq-reqs-in-vq-AioContexts.patch
deleted file mode 100644
index 611b881..0000000
--- a/SOURCES/kvm-virtio-blk-restart-s-rq-reqs-in-vq-AioContexts.patch
+++ /dev/null
@@ -1,106 +0,0 @@
-From 9311035821b3fea3f78c7f06ddb8a3861584f907 Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Fri, 19 Jan 2024 08:57:46 -0500
-Subject: [PATCH 17/22] virtio-blk: restart s->rq reqs in vq AioContexts
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 219: virtio-blk: add iothread-vq-mapping parameter
-RH-Jira: RHEL-17369 RHEL-20764 RHEL-7356
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Commit: [13/17] cf5ad0352a78458ffc7588f967963f62b267fd64 (stefanha/centos-stream-qemu-kvm)
-
-A virtio-blk device with the iothread-vq-mapping parameter has
-per-virtqueue AioContexts. It is not thread-safe to process s->rq
-requests in the BlockBackend AioContext since that may be different from
-the virtqueue's AioContext to which this request belongs. The code
-currently races and could crash.
-
-Adapt virtio_blk_dma_restart_cb() to first split s->rq into per-vq lists
-and then schedule a BH each vq's AioContext as necessary. This way
-requests are safely processed in their vq's AioContext.
-
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20240119135748.270944-5-stefanha@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit 71ee0cdd14cc01a8b51aa4e9577dd0a1bb2f8e19)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- hw/block/virtio-blk.c | 44 ++++++++++++++++++++++++++++++++-----------
- 1 file changed, 33 insertions(+), 11 deletions(-)
-
-diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
-index 08c566946a..f48ce5cbb8 100644
---- a/hw/block/virtio-blk.c
-+++ b/hw/block/virtio-blk.c
-@@ -1156,16 +1156,11 @@ static void virtio_blk_handle_output(VirtIODevice *vdev, VirtQueue *vq)
- 
- static void virtio_blk_dma_restart_bh(void *opaque)
- {
--    VirtIOBlock *s = opaque;
-+    VirtIOBlockReq *req = opaque;
-+    VirtIOBlock *s = req->dev; /* we're called with at least one request */
- 
--    VirtIOBlockReq *req;
-     MultiReqBuffer mrb = {};
- 
--    WITH_QEMU_LOCK_GUARD(&s->rq_lock) {
--        req = s->rq;
--        s->rq = NULL;
--    }
--
-     while (req) {
-         VirtIOBlockReq *next = req->next;
-         if (virtio_blk_handle_request(req, &mrb)) {
-@@ -1195,16 +1190,43 @@ static void virtio_blk_dma_restart_cb(void *opaque, bool running,
-                                       RunState state)
- {
-     VirtIOBlock *s = opaque;
-+    uint16_t num_queues = s->conf.num_queues;
- 
-     if (!running) {
-         return;
-     }
- 
--    /* Paired with dec in virtio_blk_dma_restart_bh() */
--    blk_inc_in_flight(s->conf.conf.blk);
-+    /* Split the device-wide s->rq request list into per-vq request lists */
-+    g_autofree VirtIOBlockReq **vq_rq = g_new0(VirtIOBlockReq *, num_queues);
-+    VirtIOBlockReq *rq;
-+
-+    WITH_QEMU_LOCK_GUARD(&s->rq_lock) {
-+        rq = s->rq;
-+        s->rq = NULL;
-+    }
-+
-+    while (rq) {
-+        VirtIOBlockReq *next = rq->next;
-+        uint16_t idx = virtio_get_queue_index(rq->vq);
-+
-+        rq->next = vq_rq[idx];
-+        vq_rq[idx] = rq;
-+        rq = next;
-+    }
- 
--    aio_bh_schedule_oneshot(blk_get_aio_context(s->conf.conf.blk),
--            virtio_blk_dma_restart_bh, s);
-+    /* Schedule a BH to submit the requests in each vq's AioContext */
-+    for (uint16_t i = 0; i < num_queues; i++) {
-+        if (!vq_rq[i]) {
-+            continue;
-+        }
-+
-+        /* Paired with dec in virtio_blk_dma_restart_bh() */
-+        blk_inc_in_flight(s->conf.conf.blk);
-+
-+        aio_bh_schedule_oneshot(s->vq_aio_context[i],
-+                                virtio_blk_dma_restart_bh,
-+                                vq_rq[i]);
-+    }
- }
- 
- static void virtio_blk_reset(VirtIODevice *vdev)
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-virtio-blk-tolerate-failure-to-set-BlockBackend-AioC.patch b/SOURCES/kvm-virtio-blk-tolerate-failure-to-set-BlockBackend-AioC.patch
deleted file mode 100644
index 303c007..0000000
--- a/SOURCES/kvm-virtio-blk-tolerate-failure-to-set-BlockBackend-AioC.patch
+++ /dev/null
@@ -1,72 +0,0 @@
-From 282cebc22987958d11efc76e4f6ddb9601e709d9 Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Fri, 19 Jan 2024 08:57:47 -0500
-Subject: [PATCH 18/22] virtio-blk: tolerate failure to set BlockBackend
- AioContext
-
-RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
-RH-MergeRequest: 219: virtio-blk: add iothread-vq-mapping parameter
-RH-Jira: RHEL-17369 RHEL-20764 RHEL-7356
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Acked-by: Hanna Czenczek <hreitz@redhat.com>
-RH-Commit: [14/17] edb113ce9fea0c1a88ae7b5d61c35c1981e6993f (stefanha/centos-stream-qemu-kvm)
-
-We no longer rely on setting the AioContext since the block layer
-IO_CODE APIs can be called from any thread. Now it's just a hint to help
-block jobs and other operations co-locate themselves in a thread with
-the guest I/O requests. Keep going if setting the AioContext fails.
-
-Suggested-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-ID: <20240119135748.270944-6-stefanha@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit ea0736d7f84ead109a6b701427991828f97724c3)
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- hw/block/virtio-blk.c | 19 +++++--------------
- 1 file changed, 5 insertions(+), 14 deletions(-)
-
-diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
-index f48ce5cbb8..81de06c9f6 100644
---- a/hw/block/virtio-blk.c
-+++ b/hw/block/virtio-blk.c
-@@ -1786,11 +1786,14 @@ static int virtio_blk_start_ioeventfd(VirtIODevice *vdev)
- 
-     memory_region_transaction_commit();
- 
-+    /*
-+     * Try to change the AioContext so that block jobs and other operations can
-+     * co-locate their activity in the same AioContext. If it fails, nevermind.
-+     */
-     r = blk_set_aio_context(s->conf.conf.blk, s->vq_aio_context[0],
-                             &local_err);
-     if (r < 0) {
--        error_report_err(local_err);
--        goto fail_aio_context;
-+        warn_report_err(local_err);
-     }
- 
-     /*
-@@ -1819,18 +1822,6 @@ static int virtio_blk_start_ioeventfd(VirtIODevice *vdev)
-     }
-     return 0;
- 
--  fail_aio_context:
--    memory_region_transaction_begin();
--
--    for (i = 0; i < nvqs; i++) {
--        virtio_bus_set_host_notifier(VIRTIO_BUS(qbus), i, false);
--    }
--
--    memory_region_transaction_commit();
--
--    for (i = 0; i < nvqs; i++) {
--        virtio_bus_cleanup_host_notifier(VIRTIO_BUS(qbus), i);
--    }
-   fail_host_notifiers:
-     k->set_guest_notifiers(qbus->parent, nvqs, false);
-   fail_guest_notifiers:
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-virtio-gpu-block-migration-of-VMs-with-blob-true.patch b/SOURCES/kvm-virtio-gpu-block-migration-of-VMs-with-blob-true.patch
deleted file mode 100644
index 1f70049..0000000
--- a/SOURCES/kvm-virtio-gpu-block-migration-of-VMs-with-blob-true.patch
+++ /dev/null
@@ -1,87 +0,0 @@
-From 5db0b4131c56d96760b3300298f4bedab99d35cb Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
-Date: Wed, 6 Sep 2023 17:00:22 +0400
-Subject: [PATCH 100/101] virtio-gpu: block migration of VMs with blob=true
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Marc-André Lureau <marcandre.lureau@redhat.com>
-RH-MergeRequest: 217: virtio-gpu: block migration of VMs with blob=true
-RH-Jira: RHEL-7565
-RH-Commit: [1/1] f978ca697d574b1419eb027a1007c060dfb83298
-
-JIRA: https://issues.redhat.com/browse/RHEL-7565
-
-commit 9c549ab6895a43ad0cb33e684e11cdb0b5400897
-Author: Marc-André Lureau <marcandre.lureau@redhat.com>
-Date:   Wed Sep 6 17:00:22 2023 +0400
-
-virtio-gpu: block migration of VMs with blob=true
-
-"blob" resources don't have an associated pixman image:
-
-#0  pixman_image_get_stride (image=0x0) at ../pixman/pixman-image.c:921
-#1  0x0000562327c25236 in virtio_gpu_save (f=0x56232bb13b00, opaque=0x56232b555a60, size=0, field=0x5623289ab6c8 <__compound_literal.3+104>, vmdesc=0x56232ab59fe0) at ../hw/display/virtio-gpu.c:1225
-
-Related to:
-https://bugzilla.redhat.com/show_bug.cgi?id=2236353
-
-Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
-Acked-by: Peter Xu <peterx@redhat.com>
-
-[ rhel backport - fix Error* vs Error** argument ]
-Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
----
- hw/display/virtio-gpu.c | 14 ++++++++++++++
- 1 file changed, 14 insertions(+)
-
-diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
-index b016d3bac8..1702190ead 100644
---- a/hw/display/virtio-gpu.c
-+++ b/hw/display/virtio-gpu.c
-@@ -27,6 +27,7 @@
- #include "hw/virtio/virtio-gpu-pixman.h"
- #include "hw/virtio/virtio-bus.h"
- #include "hw/qdev-properties.h"
-+#include "migration/blocker.h"
- #include "qemu/log.h"
- #include "qemu/module.h"
- #include "qapi/error.h"
-@@ -41,6 +42,8 @@ virtio_gpu_find_check_resource(VirtIOGPU *g, uint32_t resource_id,
- 
- static void virtio_gpu_reset_bh(void *opaque);
- 
-+static Error *blob_mig_blocker;
-+
- void virtio_gpu_update_cursor_data(VirtIOGPU *g,
-                                    struct virtio_gpu_scanout *s,
-                                    uint32_t resource_id)
-@@ -1452,6 +1455,14 @@ void virtio_gpu_device_realize(DeviceState *qdev, Error **errp)
-             error_setg(errp, "blobs and virgl are not compatible (yet)");
-             return;
-         }
-+
-+        if (!blob_mig_blocker) {
-+            error_setg(&blob_mig_blocker,
-+                       "virtio-gpu blob VMs are currently not migratable.");
-+        }
-+        if (migrate_add_blocker(&blob_mig_blocker, errp)) {
-+            return;
-+        }
-     }
- 
-     if (!virtio_gpu_base_device_realize(qdev,
-@@ -1478,6 +1489,9 @@ static void virtio_gpu_device_unrealize(DeviceState *qdev)
- {
-     VirtIOGPU *g = VIRTIO_GPU(qdev);
- 
-+    if (virtio_gpu_blob_enabled(g->parent_obj.conf)) {
-+        migrate_del_blocker(&blob_mig_blocker);
-+    }
-     g_clear_pointer(&g->ctrl_bh, qemu_bh_delete);
-     g_clear_pointer(&g->cursor_bh, qemu_bh_delete);
-     g_clear_pointer(&g->reset_bh, qemu_bh_delete);
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-virtio-gpu-fix-scanout-migration-post-load.patch b/SOURCES/kvm-virtio-gpu-fix-scanout-migration-post-load.patch
deleted file mode 100644
index b1581bf..0000000
--- a/SOURCES/kvm-virtio-gpu-fix-scanout-migration-post-load.patch
+++ /dev/null
@@ -1,196 +0,0 @@
-From 523423436e83b01a83c60bc44bd08471992aaff4 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
-Date: Mon, 15 Jan 2024 16:34:33 +0400
-Subject: [PATCH 1/4] virtio-gpu: fix scanout migration post-load
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Marc-André Lureau <marcandre.lureau@redhat.com>
-RH-MergeRequest: 377: virtio-gpu: fix scanout migration post-load
-RH-Jira: RHEL-36181
-RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [1/3] 05e9dbf7f602d62ec2f336a855daf57e6ee8f3f3
-
-The current post-loading code for scanout has a FIXME: it doesn't take
-the resource region/rect into account. But there is more, when adding
-blob migration support in commit f66767f75c9, I didn't realize that blob
-resources could be used for scanouts. This situationn leads to a crash
-during post-load, as they don't have an associated res->image.
-
-virtio_gpu_do_set_scanout() handle all cases, but requires the
-associated virtio_gpu_framebuffer, which is currently not saved during
-migration.
-
-Add a v2 of "virtio-gpu-one-scanout" with the framebuffer fields, so we
-can restore blob scanouts, as well as fixing the existing FIXME.
-
-Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
-Reviewed-by: Sebastian Ott <sebott@redhat.com>
-(cherry picked from commit dfcf74fa68c88233209aafc5f82728d0b9a1af5c)
----
- hw/display/virtio-gpu.c        | 55 +++++++++++++++++++++++++++-------
- include/hw/virtio/virtio-gpu.h |  1 +
- 2 files changed, 46 insertions(+), 10 deletions(-)
-
-diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
-index 1702190ead..bc485d60ea 100644
---- a/hw/display/virtio-gpu.c
-+++ b/hw/display/virtio-gpu.c
-@@ -598,6 +598,7 @@ static void virtio_unref_resource(pixman_image_t *image, void *data)
- static void virtio_gpu_update_scanout(VirtIOGPU *g,
-                                       uint32_t scanout_id,
-                                       struct virtio_gpu_simple_resource *res,
-+                                      struct virtio_gpu_framebuffer *fb,
-                                       struct virtio_gpu_rect *r)
- {
-     struct virtio_gpu_simple_resource *ores;
-@@ -615,9 +616,10 @@ static void virtio_gpu_update_scanout(VirtIOGPU *g,
-     scanout->y = r->y;
-     scanout->width = r->width;
-     scanout->height = r->height;
-+    scanout->fb = *fb;
- }
- 
--static void virtio_gpu_do_set_scanout(VirtIOGPU *g,
-+static bool virtio_gpu_do_set_scanout(VirtIOGPU *g,
-                                       uint32_t scanout_id,
-                                       struct virtio_gpu_framebuffer *fb,
-                                       struct virtio_gpu_simple_resource *res,
-@@ -643,7 +645,7 @@ static void virtio_gpu_do_set_scanout(VirtIOGPU *g,
-                       r->x, r->y, r->width, r->height,
-                       fb->width, fb->height);
-         *error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;
--        return;
-+        return false;
-     }
- 
-     g->parent_obj.enable = 1;
-@@ -651,11 +653,12 @@ static void virtio_gpu_do_set_scanout(VirtIOGPU *g,
-     if (res->blob) {
-         if (console_has_gl(scanout->con)) {
-             if (!virtio_gpu_update_dmabuf(g, scanout_id, res, fb, r)) {
--                virtio_gpu_update_scanout(g, scanout_id, res, r);
-+                virtio_gpu_update_scanout(g, scanout_id, res, fb, r);
-             } else {
-                 *error = VIRTIO_GPU_RESP_ERR_OUT_OF_MEMORY;
-+                return false;
-             }
--            return;
-+            return true;
-         }
- 
-         data = res->blob;
-@@ -684,7 +687,7 @@ static void virtio_gpu_do_set_scanout(VirtIOGPU *g,
-         scanout->ds = qemu_create_displaysurface_pixman(rect);
-         if (!scanout->ds) {
-             *error = VIRTIO_GPU_RESP_ERR_UNSPEC;
--            return;
-+            return false;
-         }
- #ifdef WIN32
-         qemu_displaysurface_win32_set_handle(scanout->ds, res->handle, fb->offset);
-@@ -695,7 +698,8 @@ static void virtio_gpu_do_set_scanout(VirtIOGPU *g,
-                                 scanout->ds);
-     }
- 
--    virtio_gpu_update_scanout(g, scanout_id, res, r);
-+    virtio_gpu_update_scanout(g, scanout_id, res, fb, r);
-+    return true;
- }
- 
- static void virtio_gpu_set_scanout(VirtIOGPU *g,
-@@ -1166,8 +1170,9 @@ static void virtio_gpu_cursor_bh(void *opaque)
- 
- static const VMStateDescription vmstate_virtio_gpu_scanout = {
-     .name = "virtio-gpu-one-scanout",
--    .version_id = 1,
--    .fields = (VMStateField[]) {
-+    .version_id = 2,
-+    .minimum_version_id = 1,
-+    .fields = (const VMStateField[]) {
-         VMSTATE_UINT32(resource_id, struct virtio_gpu_scanout),
-         VMSTATE_UINT32(width, struct virtio_gpu_scanout),
-         VMSTATE_UINT32(height, struct virtio_gpu_scanout),
-@@ -1178,6 +1183,12 @@ static const VMStateDescription vmstate_virtio_gpu_scanout = {
-         VMSTATE_UINT32(cursor.hot_y, struct virtio_gpu_scanout),
-         VMSTATE_UINT32(cursor.pos.x, struct virtio_gpu_scanout),
-         VMSTATE_UINT32(cursor.pos.y, struct virtio_gpu_scanout),
-+        VMSTATE_UINT32_V(fb.format, struct virtio_gpu_scanout, 2),
-+        VMSTATE_UINT32_V(fb.bytes_pp, struct virtio_gpu_scanout, 2),
-+        VMSTATE_UINT32_V(fb.width, struct virtio_gpu_scanout, 2),
-+        VMSTATE_UINT32_V(fb.height, struct virtio_gpu_scanout, 2),
-+        VMSTATE_UINT32_V(fb.stride, struct virtio_gpu_scanout, 2),
-+        VMSTATE_UINT32_V(fb.offset, struct virtio_gpu_scanout, 2),
-         VMSTATE_END_OF_LIST()
-     },
- };
-@@ -1349,6 +1360,7 @@ static int virtio_gpu_blob_save(QEMUFile *f, void *opaque, size_t size,
-         if (!res->blob_size) {
-             continue;
-         }
-+        assert(!res->image);
-         qemu_put_be32(f, res->resource_id);
-         qemu_put_be32(f, res->blob_size);
-         qemu_put_be32(f, res->iov_cnt);
-@@ -1411,11 +1423,11 @@ static int virtio_gpu_post_load(void *opaque, int version_id)
-     int i;
- 
-     for (i = 0; i < g->parent_obj.conf.max_outputs; i++) {
--        /* FIXME: should take scanout.r.{x,y} into account */
-         scanout = &g->parent_obj.scanout[i];
-         if (!scanout->resource_id) {
-             continue;
-         }
-+
-         res = virtio_gpu_find_resource(g, scanout->resource_id);
-         if (!res) {
-             return -EINVAL;
-@@ -1428,7 +1440,30 @@ static int virtio_gpu_post_load(void *opaque, int version_id)
-         qemu_displaysurface_win32_set_handle(scanout->ds, res->handle, 0);
- #endif
- 
--        dpy_gfx_replace_surface(scanout->con, scanout->ds);
-+        if (scanout->fb.format != 0) {
-+            uint32_t error = 0;
-+            struct virtio_gpu_rect r = {
-+                .x = scanout->x,
-+                .y = scanout->y,
-+                .width = scanout->width,
-+                .height = scanout->height
-+            };
-+
-+            if (!virtio_gpu_do_set_scanout(g, i, &scanout->fb, res, &r, &error)) {
-+                return -EINVAL;
-+            }
-+        } else {
-+            /* legacy v1 migration support */
-+            if (!res->image) {
-+                return -EINVAL;
-+            }
-+            scanout->ds = qemu_create_displaysurface_pixman(res->image);
-+#ifdef WIN32
-+            qemu_displaysurface_win32_set_handle(scanout->ds, res->handle, 0);
-+#endif
-+            dpy_gfx_replace_surface(scanout->con, scanout->ds);
-+        }
-+
-         dpy_gfx_update_full(scanout->con);
-         if (scanout->cursor.resource_id) {
-             update_cursor(g, &scanout->cursor);
-diff --git a/include/hw/virtio/virtio-gpu.h b/include/hw/virtio/virtio-gpu.h
-index 584ba2ed73..9a13afb34e 100644
---- a/include/hw/virtio/virtio-gpu.h
-+++ b/include/hw/virtio/virtio-gpu.h
-@@ -81,6 +81,7 @@ struct virtio_gpu_scanout {
-     uint32_t resource_id;
-     struct virtio_gpu_update_cursor cursor;
-     QEMUCursor *current_cursor;
-+    struct virtio_gpu_framebuffer fb;
- };
- 
- struct virtio_gpu_requested_state {
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-virtio-gpu-fix-v2-migration.patch b/SOURCES/kvm-virtio-gpu-fix-v2-migration.patch
index 028b23b..7183a65 100644
--- a/SOURCES/kvm-virtio-gpu-fix-v2-migration.patch
+++ b/SOURCES/kvm-virtio-gpu-fix-v2-migration.patch
@@ -1,17 +1,17 @@
-From 7741a7d1c1d719ff681f73a023f27d5951b98882 Mon Sep 17 00:00:00 2001
+From 97d039841728570b54d11ee7e5322743f519d861 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
 Date: Thu, 16 May 2024 12:40:22 +0400
-Subject: [PATCH 2/4] virtio-gpu: fix v2 migration
+Subject: [PATCH 3/4] virtio-gpu: fix v2 migration
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 
 RH-Author: Marc-André Lureau <marcandre.lureau@redhat.com>
-RH-MergeRequest: 377: virtio-gpu: fix scanout migration post-load
-RH-Jira: RHEL-36181
+RH-MergeRequest: 246: virtio-gpu: fix v2 migration
+RH-Jira: RHEL-34621
 RH-Acked-by: Peter Xu <peterx@redhat.com>
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [2/3] 482c37c10ac7e5e8a6c36ac2eb806ac02beeefdc
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Commit: [1/2] 187370bc6198a4ed0e4763314f8113ffcd21eb36 (marcandre.lureau-rh/qemu-kvm-centos)
 
 Commit dfcf74fa ("virtio-gpu: fix scanout migration post-load") broke
 forward/backward version migration. Versioning of nested VMSD structures
@@ -27,7 +27,7 @@ Tested-by: Fiona Ebner <f.ebner@proxmox.com>
 [fixed long lines]
 Signed-off-by: Fabiano Rosas <farosas@suse.de>
 
-[ Move the hw-compat from 8.2 to 8.1 ]
+Jira: https://issues.redhat.com/browse/RHEL-34621
 Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
 (cherry picked from commit 40a23ef643664b5c1021a9789f9d680b6294fb50)
 ---
@@ -37,22 +37,22 @@ Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
  3 files changed, 24 insertions(+), 8 deletions(-)
 
 diff --git a/hw/core/machine.c b/hw/core/machine.c
-index 309f6ba685..a0843ab93e 100644
+index 0f256d9633..cf1d7faaaf 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
-@@ -37,6 +37,7 @@ GlobalProperty hw_compat_8_1[] = {
-     { "ramfb", "x-migrate", "off" },
-     { "vfio-pci-nohotplug", "x-ramfb-migrate", "off" },
-     { "igb", "x-pcie-flr-init", "off" },
+@@ -37,6 +37,7 @@ GlobalProperty hw_compat_8_2[] = {
+     { "migration", "zero-page-detection", "legacy"},
+     { TYPE_VIRTIO_IOMMU_PCI, "granule", "4k" },
+     { TYPE_VIRTIO_IOMMU_PCI, "aw-bits", "64" },
 +    { "virtio-gpu-device", "x-scanout-vmstate-version", "1" },
  };
- const size_t hw_compat_8_1_len = G_N_ELEMENTS(hw_compat_8_1);
+ const size_t hw_compat_8_2_len = G_N_ELEMENTS(hw_compat_8_2);
  
 diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
-index bc485d60ea..9d35a016ae 100644
+index ae831b6b3e..d60b1b2973 100644
 --- a/hw/display/virtio-gpu.c
 +++ b/hw/display/virtio-gpu.c
-@@ -1168,10 +1168,17 @@ static void virtio_gpu_cursor_bh(void *opaque)
+@@ -1166,10 +1166,17 @@ static void virtio_gpu_cursor_bh(void *opaque)
      virtio_gpu_handle_cursor(&g->parent_obj.parent_obj, g->cursor_vq);
  }
  
@@ -72,7 +72,7 @@ index bc485d60ea..9d35a016ae 100644
      .fields = (const VMStateField[]) {
          VMSTATE_UINT32(resource_id, struct virtio_gpu_scanout),
          VMSTATE_UINT32(width, struct virtio_gpu_scanout),
-@@ -1183,12 +1190,18 @@ static const VMStateDescription vmstate_virtio_gpu_scanout = {
+@@ -1181,12 +1188,18 @@ static const VMStateDescription vmstate_virtio_gpu_scanout = {
          VMSTATE_UINT32(cursor.hot_y, struct virtio_gpu_scanout),
          VMSTATE_UINT32(cursor.pos.x, struct virtio_gpu_scanout),
          VMSTATE_UINT32(cursor.pos.y, struct virtio_gpu_scanout),
@@ -97,7 +97,7 @@ index bc485d60ea..9d35a016ae 100644
          VMSTATE_END_OF_LIST()
      },
  };
-@@ -1668,6 +1681,7 @@ static Property virtio_gpu_properties[] = {
+@@ -1659,6 +1672,7 @@ static Property virtio_gpu_properties[] = {
      DEFINE_PROP_BIT("blob", VirtIOGPU, parent_obj.conf.flags,
                      VIRTIO_GPU_FLAG_BLOB_ENABLED, false),
      DEFINE_PROP_SIZE("hostmem", VirtIOGPU, parent_obj.conf.hostmem, 0),
@@ -106,7 +106,7 @@ index bc485d60ea..9d35a016ae 100644
  };
  
 diff --git a/include/hw/virtio/virtio-gpu.h b/include/hw/virtio/virtio-gpu.h
-index 9a13afb34e..18500432c6 100644
+index ed44cdad6b..842315d51d 100644
 --- a/include/hw/virtio/virtio-gpu.h
 +++ b/include/hw/virtio/virtio-gpu.h
 @@ -177,6 +177,7 @@ typedef struct VGPUDMABuf {
diff --git a/SOURCES/kvm-virtio-mem-default-enable-dynamic-memslots.patch b/SOURCES/kvm-virtio-mem-default-enable-dynamic-memslots.patch
deleted file mode 100644
index 6ad1c98..0000000
--- a/SOURCES/kvm-virtio-mem-default-enable-dynamic-memslots.patch
+++ /dev/null
@@ -1,70 +0,0 @@
-From 94bccae527f1ab8328cc7692532046d700e2ca71 Mon Sep 17 00:00:00 2001
-From: David Hildenbrand <david@redhat.com>
-Date: Mon, 5 Feb 2024 19:27:07 +0100
-Subject: [PATCH 22/22] virtio-mem: default-enable "dynamic-memslots"
-
-RH-Author: David Hildenbrand <david@redhat.com>
-RH-MergeRequest: 220: virtio-mem: default-enable "dynamic-memslots"
-RH-Jira: RHEL-24045
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Commit: [1/1] d9a60acd7de1d8703ea3ca938e388e19f31f5347
-
-JIRA: https://issues.redhat.com/browse/RHEL-24045
-Upstream: RHEL only
-
-We only support selected vhost-user devices in combination with
-virtio-mem in RHEL. One devices that works well is virtiofsd, devices that
-are currently incompatible include DPDK and SPDK.
-
-The vhost devices we support must be compatible with the dynamic-memslot
-feature (i.e., support at least 509 memslots, support dynamically adding/
-removing memslots), such that setting "dynamic-memslots=on" will work a
-expected and not make certain QEMU commandlines or hotplug of vhost-user
-devices bail out.
-
-Let's set "dynamic-memslots=on" starting with RHEL 9.4, so we
-get the benefits (i.e., reduced metadata consumption in KVM, majority of
-unplugged memory being inaccessible) as default.
-
-When wanting to run virtio-mem with incompatible vhost-user devices, it
-might just work (if the vhost-user device is created before the
-virtio-mem device), or the feature can be manually disabled by
-specifying "dynamic-memslots=off".
-
-Signed-off-by: David Hildenbrand <david@redhat.com>
----
- hw/core/machine.c      | 2 ++
- hw/virtio/virtio-mem.c | 3 ++-
- 2 files changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/hw/core/machine.c b/hw/core/machine.c
-index 446601ee30..309f6ba685 100644
---- a/hw/core/machine.c
-+++ b/hw/core/machine.c
-@@ -78,6 +78,8 @@ GlobalProperty hw_compat_rhel_9_4[] = {
-      { "vfio-pci-nohotplug", "x-ramfb-migrate", "off" },
-   /* hw_compat_rhel_9_4 from hw_compat_8_1 */
-      { "igb", "x-pcie-flr-init", "off" },
-+  /* hw_compat_rhel_9_4 jira RHEL-24045 */
-+     { "virtio-mem", "dynamic-memslots", "off" },
- };
- const size_t hw_compat_rhel_9_4_len = G_N_ELEMENTS(hw_compat_rhel_9_4);
- 
-diff --git a/hw/virtio/virtio-mem.c b/hw/virtio/virtio-mem.c
-index 75ee38aa46..00ca91e8fe 100644
---- a/hw/virtio/virtio-mem.c
-+++ b/hw/virtio/virtio-mem.c
-@@ -1696,8 +1696,9 @@ static Property virtio_mem_properties[] = {
- #endif
-     DEFINE_PROP_BOOL(VIRTIO_MEM_EARLY_MIGRATION_PROP, VirtIOMEM,
-                      early_migration, true),
-+    /* RHEL: default-enable "dynamic-memslots" (jira RHEL-24045) */
-     DEFINE_PROP_BOOL(VIRTIO_MEM_DYNAMIC_MEMSLOTS_PROP, VirtIOMEM,
--                     dynamic_memslots, false),
-+                     dynamic_memslots, true),
-     DEFINE_PROP_END_OF_LIST(),
- };
- 
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-virtio-pci-fix-use-of-a-released-vector.patch b/SOURCES/kvm-virtio-pci-fix-use-of-a-released-vector.patch
deleted file mode 100644
index 4128907..0000000
--- a/SOURCES/kvm-virtio-pci-fix-use-of-a-released-vector.patch
+++ /dev/null
@@ -1,162 +0,0 @@
-From ccd8ffa5cd7f9bcfddeda7a9fa1ad86d4bad870e Mon Sep 17 00:00:00 2001
-From: Cindy Lu <lulu@redhat.com>
-Date: Fri, 12 Apr 2024 14:26:55 +0800
-Subject: [PATCH] virtio-pci: fix use of a released vector
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Cindy Lu <lulu@redhat.com>
-RH-MergeRequest: 366: virtio-pci: fix use of a released vector
-RH-Jira: RHEL-32837
-RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
-RH-Acked-by: Jason Wang <jasowang@redhat.com>
-RH-Commit: [1/1] edd26ffb8727635310aed42e42925afe87df2287
-
-During the booting process of the non-standard image, the behavior of the
-called function in qemu is as follows:
-
-1. vhost_net_stop() was triggered by guest image. This will call the function
-virtio_pci_set_guest_notifiers() with assgin= false,
-virtio_pci_set_guest_notifiers(） will release the irqfd for vector 0
-
-2. virtio_reset() was triggered, this will set configure vector to VIRTIO_NO_VECTOR
-
-3.vhost_net_start() was called (at this time, the configure vector is
-still VIRTIO_NO_VECTOR) and then call virtio_pci_set_guest_notifiers() with
-assgin=true, so the irqfd for vector 0 is still not "init" during this process
-
-4. The system continues to boot and sets the vector back to 0. After that
-msix_fire_vector_notifier() was triggered to unmask the vector 0 and  meet the crash
-
-To fix the issue, we need to support changing the vector after VIRTIO_CONFIG_S_DRIVER_OK is set.
-
-(gdb) bt
-0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0)
-    at pthread_kill.c:44
-1  0x00007fc87148ec53 in __pthread_kill_internal (signo=6, threadid=<optimized out>) at pthread_kill.c:78
-2  0x00007fc87143e956 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
-3  0x00007fc8714287f4 in __GI_abort () at abort.c:79
-4  0x00007fc87142871b in __assert_fail_base
-    (fmt=0x7fc8715bbde0 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x5606413efd53 "ret == 0", file=0x5606413ef87d "../accel/kvm/kvm-all.c", line=1837, function=<optimized out>) at assert.c:92
-5  0x00007fc871437536 in __GI___assert_fail
-    (assertion=0x5606413efd53 "ret == 0", file=0x5606413ef87d "../accel/kvm/kvm-all.c", line=1837, function=0x5606413f06f0 <__PRETTY_FUNCTION__.19> "kvm_irqchip_commit_routes") at assert.c:101
-6  0x0000560640f884b5 in kvm_irqchip_commit_routes (s=0x560642cae1f0) at ../accel/kvm/kvm-all.c:1837
-7  0x0000560640c98f8e in virtio_pci_one_vector_unmask
-    (proxy=0x560643c65f00, queue_no=4294967295, vector=0, msg=..., n=0x560643c6e4c8)
-    at ../hw/virtio/virtio-pci.c:1005
-8  0x0000560640c99201 in virtio_pci_vector_unmask (dev=0x560643c65f00, vector=0, msg=...)
-    at ../hw/virtio/virtio-pci.c:1070
-9  0x0000560640bc402e in msix_fire_vector_notifier (dev=0x560643c65f00, vector=0, is_masked=false)
-    at ../hw/pci/msix.c:120
-10 0x0000560640bc40f1 in msix_handle_mask_update (dev=0x560643c65f00, vector=0, was_masked=true)
-    at ../hw/pci/msix.c:140
-11 0x0000560640bc4503 in msix_table_mmio_write (opaque=0x560643c65f00, addr=12, val=0, size=4)
-    at ../hw/pci/msix.c:231
-12 0x0000560640f26d83 in memory_region_write_accessor
-    (mr=0x560643c66540, addr=12, value=0x7fc86b7bc628, size=4, shift=0, mask=4294967295, attrs=...)
-    at ../system/memory.c:497
-13 0x0000560640f270a6 in access_with_adjusted_size
-
-     (addr=12, value=0x7fc86b7bc628, size=4, access_size_min=1, access_size_max=4, access_fn=0x560640f26c8d <memory_region_write_accessor>, mr=0x560643c66540, attrs=...) at ../system/memory.c:573
-14 0x0000560640f2a2b5 in memory_region_dispatch_write (mr=0x560643c66540, addr=12, data=0, op=MO_32, attrs=...)
-    at ../system/memory.c:1521
-15 0x0000560640f37bac in flatview_write_continue
-    (fv=0x7fc65805e0b0, addr=4273803276, attrs=..., ptr=0x7fc871e9c028, len=4, addr1=12, l=4, mr=0x560643c66540)
-    at ../system/physmem.c:2714
-16 0x0000560640f37d0f in flatview_write
-    (fv=0x7fc65805e0b0, addr=4273803276, attrs=..., buf=0x7fc871e9c028, len=4) at ../system/physmem.c:2756
-17 0x0000560640f380bf in address_space_write
-    (as=0x560642161ae0 <address_space_memory>, addr=4273803276, attrs=..., buf=0x7fc871e9c028, len=4)
-    at ../system/physmem.c:2863
-18 0x0000560640f3812c in address_space_rw
-    (as=0x560642161ae0 <address_space_memory>, addr=4273803276, attrs=..., buf=0x7fc871e9c028, len=4, is_write=true) at ../system/physmem.c:2873
---Type <RET> for more, q to quit, c to continue without paging--
-19 0x0000560640f8aa55 in kvm_cpu_exec (cpu=0x560642f205e0) at ../accel/kvm/kvm-all.c:2915
-20 0x0000560640f8d731 in kvm_vcpu_thread_fn (arg=0x560642f205e0) at ../accel/kvm/kvm-accel-ops.c:51
-21 0x00005606411949f4 in qemu_thread_start (args=0x560642f292b0) at ../util/qemu-thread-posix.c:541
-22 0x00007fc87148cdcd in start_thread (arg=<optimized out>) at pthread_create.c:442
-23 0x00007fc871512630 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
-(gdb)
-
-MST: coding style and typo fixups
-
-Fixes: f9a09ca3ea ("vhost: add support for configure interrupt")
-Cc: qemu-stable@nongnu.org
-Signed-off-by: Cindy Lu <lulu@redhat.com>
-Message-ID: <2321ade5f601367efe7380c04e3f61379c59b48f.1713173550.git.mst@redhat.com>
-Cc: Lei Yang <leiyang@redhat.com>
-Cc: Jason Wang <jasowang@redhat.com>
-Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
-Tested-by: Cindy Lu <lulu@redhat.com>
-(cherry picked from commit 2ce6cff94df2650c460f809e5ad263f1d22507c0)
-Signed-off-by: Cindy Lu <lulu@redhat.com>
----
- hw/virtio/virtio-pci.c | 37 +++++++++++++++++++++++++++++++++++--
- 1 file changed, 35 insertions(+), 2 deletions(-)
-
-diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
-index e433879542..08faefe29a 100644
---- a/hw/virtio/virtio-pci.c
-+++ b/hw/virtio/virtio-pci.c
-@@ -1424,6 +1424,38 @@ static int virtio_pci_add_mem_cap(VirtIOPCIProxy *proxy,
-     return offset;
- }
- 
-+static void virtio_pci_set_vector(VirtIODevice *vdev,
-+                                  VirtIOPCIProxy *proxy,
-+                                  int queue_no, uint16_t old_vector,
-+                                  uint16_t new_vector)
-+{
-+    bool kvm_irqfd = (vdev->status & VIRTIO_CONFIG_S_DRIVER_OK) &&
-+        msix_enabled(&proxy->pci_dev) && kvm_msi_via_irqfd_enabled();
-+
-+    if (new_vector == old_vector) {
-+        return;
-+    }
-+
-+    /*
-+     * If the device uses irqfd and the vector changes after DRIVER_OK is
-+     * set, we need to release the old vector and set up the new one.
-+     * Otherwise just need to set the new vector on the device.
-+     */
-+    if (kvm_irqfd && old_vector != VIRTIO_NO_VECTOR) {
-+        kvm_virtio_pci_vector_release_one(proxy, queue_no);
-+    }
-+    /* Set the new vector on the device. */
-+    if (queue_no == VIRTIO_CONFIG_IRQ_IDX) {
-+        vdev->config_vector = new_vector;
-+    } else {
-+        virtio_queue_set_vector(vdev, queue_no, new_vector);
-+    }
-+    /* If the new vector changed need to set it up. */
-+    if (kvm_irqfd && new_vector != VIRTIO_NO_VECTOR) {
-+        kvm_virtio_pci_vector_use_one(proxy, queue_no);
-+    }
-+}
-+
- int virtio_pci_add_shm_cap(VirtIOPCIProxy *proxy,
-                            uint8_t bar, uint64_t offset, uint64_t length,
-                            uint8_t id)
-@@ -1570,7 +1602,8 @@ static void virtio_pci_common_write(void *opaque, hwaddr addr,
-         } else {
-             val = VIRTIO_NO_VECTOR;
-         }
--        vdev->config_vector = val;
-+        virtio_pci_set_vector(vdev, proxy, VIRTIO_CONFIG_IRQ_IDX,
-+                              vdev->config_vector, val);
-         break;
-     case VIRTIO_PCI_COMMON_STATUS:
-         if (!(val & VIRTIO_CONFIG_S_DRIVER_OK)) {
-@@ -1610,7 +1643,7 @@ static void virtio_pci_common_write(void *opaque, hwaddr addr,
-         } else {
-             val = VIRTIO_NO_VECTOR;
-         }
--        virtio_queue_set_vector(vdev, vdev->queue_sel, val);
-+        virtio_pci_set_vector(vdev, proxy, vdev->queue_sel, vector, val);
-         break;
-     case VIRTIO_PCI_COMMON_Q_ENABLE:
-         if (val == 1) {
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-virtio-rng-block-max-bytes-0.patch b/SOURCES/kvm-virtio-rng-block-max-bytes-0.patch
new file mode 100644
index 0000000..2fba53d
--- /dev/null
+++ b/SOURCES/kvm-virtio-rng-block-max-bytes-0.patch
@@ -0,0 +1,49 @@
+From 3dd1412176a8ee6c06b5d41aa00ca49b535d99b7 Mon Sep 17 00:00:00 2001
+From: "Michael S. Tsirkin" <mst@redhat.com>
+Date: Wed, 24 Jul 2024 06:48:59 -0400
+Subject: [PATCH 092/100] virtio-rng: block max-bytes=0
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Laurent Vivier <lvivier@redhat.com>
+RH-MergeRequest: 259: virtio-rng: block max-bytes=0
+RH-Jira: RHEL-50336
+RH-Acked-by: Eugenio Pérez <eperezma@redhat.com>
+RH-Acked-by: Thomas Huth <thuth@redhat.com>
+RH-Acked-by: Eric Auger <eric.auger@redhat.com>
+RH-Commit: [1/1] 6d9852cc7cf7fdf49521b6301ceda26e11b1291f (lvivier/qemu-kvm-centos)
+
+JIRA: https://issues.redhat.com/browse/RHEL-50336
+
+with max-bytes set to 0, quota is 0 and so device does not work.
+block this to avoid user confusion
+
+Message-Id: <73a89a42d82ec8b47358f25119b87063e4a6ea57.1721818306.git.mst@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+(cherry picked from commit 024d046bf41b5256adec671085bcee767a6da125)
+Signed-off-by: Laurent Vivier <lvivier@redhat.com>
+---
+ hw/virtio/virtio-rng.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/hw/virtio/virtio-rng.c b/hw/virtio/virtio-rng.c
+index f74efffef7..7cf31da071 100644
+--- a/hw/virtio/virtio-rng.c
++++ b/hw/virtio/virtio-rng.c
+@@ -184,8 +184,9 @@ static void virtio_rng_device_realize(DeviceState *dev, Error **errp)
+ 
+     /* Workaround: Property parsing does not enforce unsigned integers,
+      * So this is a hack to reject such numbers. */
+-    if (vrng->conf.max_bytes > INT64_MAX) {
+-        error_setg(errp, "'max-bytes' parameter must be non-negative, "
++    if (vrng->conf.max_bytes == 0 ||
++        vrng->conf.max_bytes > INT64_MAX) {
++        error_setg(errp, "'max-bytes' parameter must be positive, "
+                    "and less than 2^63");
+         return;
+     }
+-- 
+2.39.3
+
diff --git a/SOURCES/kvm-virtio-scsi-Attach-event-vq-notifier-with-no_poll.patch b/SOURCES/kvm-virtio-scsi-Attach-event-vq-notifier-with-no_poll.patch
deleted file mode 100644
index b8066b2..0000000
--- a/SOURCES/kvm-virtio-scsi-Attach-event-vq-notifier-with-no_poll.patch
+++ /dev/null
@@ -1,78 +0,0 @@
-From da3a5afa41790ae913d41cfcdc3c6a8731ae3fe8 Mon Sep 17 00:00:00 2001
-From: Hanna Czenczek <hreitz@redhat.com>
-Date: Fri, 2 Feb 2024 16:31:56 +0100
-Subject: [PATCH 1/6] virtio-scsi: Attach event vq notifier with no_poll
-
-RH-Author: Hanna Czenczek <hreitz@redhat.com>
-RH-MergeRequest: 223: virtio: Re-enable notifications after drain
-RH-Jira: RHEL-3934
-RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [1/3] d29b461a0a4b584af0ee80fb3f9e45c92ea88eb0 (hreitz/qemu-kvm-c-9-s)
-
-As of commit 38738f7dbbda90fbc161757b7f4be35b52205552 ("virtio-scsi:
-don't waste CPU polling the event virtqueue"), we only attach an io_read
-notifier for the virtio-scsi event virtqueue instead, and no polling
-notifiers.  During operation, the event virtqueue is typically
-non-empty, but none of the buffers are intended to be used immediately.
-Instead, they only get used when certain events occur.  Therefore, it
-makes no sense to continuously poll it when non-empty, because it is
-supposed to be and stay non-empty.
-
-We do this by using virtio_queue_aio_attach_host_notifier_no_poll()
-instead of virtio_queue_aio_attach_host_notifier() for the event
-virtqueue.
-
-Commit 766aa2de0f29b657148e04599320d771c36fd126 ("virtio-scsi: implement
-BlockDevOps->drained_begin()") however has virtio_scsi_drained_end() use
-virtio_queue_aio_attach_host_notifier() for all virtqueues, including
-the event virtqueue.  This can lead to it being polled again, undoing
-the benefit of commit 38738f7dbbda90fbc161757b7f4be35b52205552.
-
-Fix it by using virtio_queue_aio_attach_host_notifier_no_poll() for the
-event virtqueue.
-
-Reported-by: Fiona Ebner <f.ebner@proxmox.com>
-Fixes: 766aa2de0f29b657148e04599320d771c36fd126
-       ("virtio-scsi: implement BlockDevOps->drained_begin()")
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Tested-by: Fiona Ebner <f.ebner@proxmox.com>
-Reviewed-by: Fiona Ebner <f.ebner@proxmox.com>
-Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
-Message-ID: <20240202153158.788922-2-hreitz@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit c42c3833e0cfdf2b80fb3ca410acfd392b6874ab)
----
- hw/scsi/virtio-scsi.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
-index ca365a70e9..9943186917 100644
---- a/hw/scsi/virtio-scsi.c
-+++ b/hw/scsi/virtio-scsi.c
-@@ -1149,6 +1149,7 @@ static void virtio_scsi_drained_begin(SCSIBus *bus)
- static void virtio_scsi_drained_end(SCSIBus *bus)
- {
-     VirtIOSCSI *s = container_of(bus, VirtIOSCSI, bus);
-+    VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(s);
-     VirtIODevice *vdev = VIRTIO_DEVICE(s);
-     uint32_t total_queues = VIRTIO_SCSI_VQ_NUM_FIXED +
-                             s->parent_obj.conf.num_queues;
-@@ -1166,7 +1167,11 @@ static void virtio_scsi_drained_end(SCSIBus *bus)
- 
-     for (uint32_t i = 0; i < total_queues; i++) {
-         VirtQueue *vq = virtio_get_queue(vdev, i);
--        virtio_queue_aio_attach_host_notifier(vq, s->ctx);
-+        if (vq == vs->event_vq) {
-+            virtio_queue_aio_attach_host_notifier_no_poll(vq, s->ctx);
-+        } else {
-+            virtio_queue_aio_attach_host_notifier(vq, s->ctx);
-+        }
-     }
- }
- 
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-virtio-scsi-don-t-lock-AioContext-around-virtio_queu.patch b/SOURCES/kvm-virtio-scsi-don-t-lock-AioContext-around-virtio_queu.patch
deleted file mode 100644
index 9ad8fdf..0000000
--- a/SOURCES/kvm-virtio-scsi-don-t-lock-AioContext-around-virtio_queu.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From 1ee3f919a51135a0798a14c734ca80d74d30025d Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Mon, 4 Dec 2023 11:42:57 -0500
-Subject: [PATCH 078/101] virtio-scsi: don't lock AioContext around
- virtio_queue_aio_attach_host_notifier()
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 214: Remove AioContext lock
-RH-Jira: RHEL-15965
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [9/26] 5e1179e617d05bf765b285ba42393ec1ddbeba28 (kmwolf/centos-qemu-kvm)
-
-virtio_queue_aio_attach_host_notifier() does not require the AioContext
-lock. Stop taking the lock and add an explicit smp_wmb() because we were
-relying on the implicit barrier in the AioContext lock before.
-
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Message-ID: <20231204164259.1515217-3-stefanha@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- hw/scsi/virtio-scsi-dataplane.c | 8 +-------
- 1 file changed, 1 insertion(+), 7 deletions(-)
-
-diff --git a/hw/scsi/virtio-scsi-dataplane.c b/hw/scsi/virtio-scsi-dataplane.c
-index 1e684beebe..135e23fe54 100644
---- a/hw/scsi/virtio-scsi-dataplane.c
-+++ b/hw/scsi/virtio-scsi-dataplane.c
-@@ -149,23 +149,17 @@ int virtio_scsi_dataplane_start(VirtIODevice *vdev)
- 
-     memory_region_transaction_commit();
- 
--    /*
--     * These fields are visible to the IOThread so we rely on implicit barriers
--     * in aio_context_acquire() on the write side and aio_notify_accept() on
--     * the read side.
--     */
-     s->dataplane_starting = false;
-     s->dataplane_started = true;
-+    smp_wmb(); /* paired with aio_notify_accept() */
- 
-     if (s->bus.drain_count == 0) {
--        aio_context_acquire(s->ctx);
-         virtio_queue_aio_attach_host_notifier(vs->ctrl_vq, s->ctx);
-         virtio_queue_aio_attach_host_notifier_no_poll(vs->event_vq, s->ctx);
- 
-         for (i = 0; i < vs->conf.num_queues; i++) {
-             virtio_queue_aio_attach_host_notifier(vs->cmd_vqs[i], s->ctx);
-         }
--        aio_context_release(s->ctx);
-     }
-     return 0;
- 
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-virtio-scsi-replace-AioContext-lock-with-tmf_bh_lock.patch b/SOURCES/kvm-virtio-scsi-replace-AioContext-lock-with-tmf_bh_lock.patch
deleted file mode 100644
index 2654cb7..0000000
--- a/SOURCES/kvm-virtio-scsi-replace-AioContext-lock-with-tmf_bh_lock.patch
+++ /dev/null
@@ -1,173 +0,0 @@
-From c2d7633ead6e19d4b6af5552ca907ae071b8734b Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Tue, 5 Dec 2023 13:19:58 -0500
-Subject: [PATCH 081/101] virtio-scsi: replace AioContext lock with tmf_bh_lock
-
-RH-Author: Kevin Wolf <kwolf@redhat.com>
-RH-MergeRequest: 214: Remove AioContext lock
-RH-Jira: RHEL-15965
-RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
-RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
-RH-Commit: [12/26] 8fb375bfd72a491d47321c78078577071a4e90fb (kmwolf/centos-qemu-kvm)
-
-Protect the Task Management Function BH state with a lock. The TMF BH
-runs in the main loop thread. An IOThread might process a TMF at the
-same time as the TMF BH is running. Therefore tmf_bh_list and tmf_bh
-must be protected by a lock.
-
-Run TMF request completion in the IOThread using aio_wait_bh_oneshot().
-This avoids more locking to protect the virtqueue and SCSI layer state.
-
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Message-ID: <20231205182011.1976568-2-stefanha@redhat.com>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
----
- hw/scsi/virtio-scsi.c           | 62 ++++++++++++++++++++++-----------
- include/hw/virtio/virtio-scsi.h |  3 +-
- 2 files changed, 43 insertions(+), 22 deletions(-)
-
-diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
-index 9c751bf296..4f8d35facc 100644
---- a/hw/scsi/virtio-scsi.c
-+++ b/hw/scsi/virtio-scsi.c
-@@ -123,6 +123,30 @@ static void virtio_scsi_complete_req(VirtIOSCSIReq *req)
-     virtio_scsi_free_req(req);
- }
- 
-+static void virtio_scsi_complete_req_bh(void *opaque)
-+{
-+    VirtIOSCSIReq *req = opaque;
-+
-+    virtio_scsi_complete_req(req);
-+}
-+
-+/*
-+ * Called from virtio_scsi_do_one_tmf_bh() in main loop thread. The main loop
-+ * thread cannot touch the virtqueue since that could race with an IOThread.
-+ */
-+static void virtio_scsi_complete_req_from_main_loop(VirtIOSCSIReq *req)
-+{
-+    VirtIOSCSI *s = req->dev;
-+
-+    if (!s->ctx || s->ctx == qemu_get_aio_context()) {
-+        /* No need to schedule a BH when there is no IOThread */
-+        virtio_scsi_complete_req(req);
-+    } else {
-+        /* Run request completion in the IOThread */
-+        aio_wait_bh_oneshot(s->ctx, virtio_scsi_complete_req_bh, req);
-+    }
-+}
-+
- static void virtio_scsi_bad_req(VirtIOSCSIReq *req)
- {
-     virtio_error(VIRTIO_DEVICE(req->dev), "wrong size for virtio-scsi headers");
-@@ -338,10 +362,7 @@ static void virtio_scsi_do_one_tmf_bh(VirtIOSCSIReq *req)
- 
- out:
-     object_unref(OBJECT(d));
--
--    virtio_scsi_acquire(s);
--    virtio_scsi_complete_req(req);
--    virtio_scsi_release(s);
-+    virtio_scsi_complete_req_from_main_loop(req);
- }
- 
- /* Some TMFs must be processed from the main loop thread */
-@@ -354,18 +375,16 @@ static void virtio_scsi_do_tmf_bh(void *opaque)
- 
-     GLOBAL_STATE_CODE();
- 
--    virtio_scsi_acquire(s);
-+    WITH_QEMU_LOCK_GUARD(&s->tmf_bh_lock) {
-+        QTAILQ_FOREACH_SAFE(req, &s->tmf_bh_list, next, tmp) {
-+            QTAILQ_REMOVE(&s->tmf_bh_list, req, next);
-+            QTAILQ_INSERT_TAIL(&reqs, req, next);
-+        }
- 
--    QTAILQ_FOREACH_SAFE(req, &s->tmf_bh_list, next, tmp) {
--        QTAILQ_REMOVE(&s->tmf_bh_list, req, next);
--        QTAILQ_INSERT_TAIL(&reqs, req, next);
-+        qemu_bh_delete(s->tmf_bh);
-+        s->tmf_bh = NULL;
-     }
- 
--    qemu_bh_delete(s->tmf_bh);
--    s->tmf_bh = NULL;
--
--    virtio_scsi_release(s);
--
-     QTAILQ_FOREACH_SAFE(req, &reqs, next, tmp) {
-         QTAILQ_REMOVE(&reqs, req, next);
-         virtio_scsi_do_one_tmf_bh(req);
-@@ -379,8 +398,7 @@ static void virtio_scsi_reset_tmf_bh(VirtIOSCSI *s)
- 
-     GLOBAL_STATE_CODE();
- 
--    virtio_scsi_acquire(s);
--
-+    /* Called after ioeventfd has been stopped, so tmf_bh_lock is not needed */
-     if (s->tmf_bh) {
-         qemu_bh_delete(s->tmf_bh);
-         s->tmf_bh = NULL;
-@@ -393,19 +411,19 @@ static void virtio_scsi_reset_tmf_bh(VirtIOSCSI *s)
-         req->resp.tmf.response = VIRTIO_SCSI_S_TARGET_FAILURE;
-         virtio_scsi_complete_req(req);
-     }
--
--    virtio_scsi_release(s);
- }
- 
- static void virtio_scsi_defer_tmf_to_bh(VirtIOSCSIReq *req)
- {
-     VirtIOSCSI *s = req->dev;
- 
--    QTAILQ_INSERT_TAIL(&s->tmf_bh_list, req, next);
-+    WITH_QEMU_LOCK_GUARD(&s->tmf_bh_lock) {
-+        QTAILQ_INSERT_TAIL(&s->tmf_bh_list, req, next);
- 
--    if (!s->tmf_bh) {
--        s->tmf_bh = qemu_bh_new(virtio_scsi_do_tmf_bh, s);
--        qemu_bh_schedule(s->tmf_bh);
-+        if (!s->tmf_bh) {
-+            s->tmf_bh = qemu_bh_new(virtio_scsi_do_tmf_bh, s);
-+            qemu_bh_schedule(s->tmf_bh);
-+        }
-     }
- }
- 
-@@ -1235,6 +1253,7 @@ static void virtio_scsi_device_realize(DeviceState *dev, Error **errp)
-     Error *err = NULL;
- 
-     QTAILQ_INIT(&s->tmf_bh_list);
-+    qemu_mutex_init(&s->tmf_bh_lock);
- 
-     virtio_scsi_common_realize(dev,
-                                virtio_scsi_handle_ctrl,
-@@ -1277,6 +1296,7 @@ static void virtio_scsi_device_unrealize(DeviceState *dev)
- 
-     qbus_set_hotplug_handler(BUS(&s->bus), NULL);
-     virtio_scsi_common_unrealize(dev);
-+    qemu_mutex_destroy(&s->tmf_bh_lock);
- }
- 
- static Property virtio_scsi_properties[] = {
-diff --git a/include/hw/virtio/virtio-scsi.h b/include/hw/virtio/virtio-scsi.h
-index 779568ab5d..da8cb928d9 100644
---- a/include/hw/virtio/virtio-scsi.h
-+++ b/include/hw/virtio/virtio-scsi.h
-@@ -85,8 +85,9 @@ struct VirtIOSCSI {
- 
-     /*
-      * TMFs deferred to main loop BH. These fields are protected by
--     * virtio_scsi_acquire().
-+     * tmf_bh_lock.
-      */
-+    QemuMutex tmf_bh_lock;
-     QEMUBH *tmf_bh;
-     QTAILQ_HEAD(, VirtIOSCSIReq) tmf_bh_list;
- 
--- 
-2.39.3
-
diff --git a/SOURCES/kvm-x86-rhel-9.2.0-machine-type-compat-fix.patch b/SOURCES/kvm-x86-rhel-9.2.0-machine-type-compat-fix.patch
deleted file mode 100644
index a8bf6ac..0000000
--- a/SOURCES/kvm-x86-rhel-9.2.0-machine-type-compat-fix.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From 2932c8de175fadeed4bb7c1024724cbabc53f6d5 Mon Sep 17 00:00:00 2001
-From: Sebastian Ott <sebott@redhat.com>
-Date: Mon, 19 Feb 2024 02:37:27 -0500
-Subject: [PATCH 6/6] x86: rhel 9.2.0 machine type compat fix
-
-RH-Author: Sebastian Ott <sebott@redhat.com>
-RH-MergeRequest: 342: Draft: x86: rhel 9.2.0 machine type compat fix (RHEL)
-RH-Jira: RHEL-17068
-RH-Acked-by: Thomas Huth <thuth@redhat.com>
-RH-Commit: [23/23] 658dda965f34119de300eef26155f47b1b3fa7f1
-
-Fix up the compatibility for 9.2.0 and older.
-
-Signed-off-by: Sebastian Ott's avatarSebastian Ott <sebott@redhat.com>
----
- hw/i386/pc_piix.c | 2 ++
- hw/i386/pc_q35.c  | 2 ++
- 2 files changed, 4 insertions(+)
-
-diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
-index 44038391fb..09d02cc91f 100644
---- a/hw/i386/pc_piix.c
-+++ b/hw/i386/pc_piix.c
-@@ -1023,6 +1023,8 @@ static void pc_machine_rhel760_options(MachineClass *m)
-     pcmc->enforce_amd_1tb_hole = false;
-     /* From pc_i440fx_8_0_machine_options() */
-     pcmc->default_smbios_ep_type = SMBIOS_ENTRY_POINT_TYPE_32;
-+    /* From pc_i440fx_8_1_machine_options() */
-+    pcmc->broken_32bit_mem_addr_check = true;
-     /* Introduced in QEMU 8.2 */
-     pcmc->default_south_bridge = TYPE_PIIX3_DEVICE;
- 
-diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
-index 6387df97c8..c6967e1846 100644
---- a/hw/i386/pc_q35.c
-+++ b/hw/i386/pc_q35.c
-@@ -759,6 +759,8 @@ static void pc_q35_machine_rhel920_options(MachineClass *m)
- 
-     /* From pc_q35_8_0_machine_options() */
-     pcmc->default_smbios_ep_type = SMBIOS_ENTRY_POINT_TYPE_32;
-+    /* From pc_q35_8_1_machine_options() */
-+    pcmc->broken_32bit_mem_addr_check = true;
- 
-     compat_props_add(m->compat_props, hw_compat_rhel_9_4,
-                      hw_compat_rhel_9_4_len);
--- 
-2.39.3
-
diff --git a/SPECS/qemu-kvm.spec b/SPECS/qemu-kvm.spec
index eeff4c6..cc7b200 100644
--- a/SPECS/qemu-kvm.spec
+++ b/SPECS/qemu-kvm.spec
@@ -148,8 +148,8 @@ Obsoletes: %{name}-block-ssh <= %{epoch}:%{version}                    \
 
 Summary: QEMU is a machine emulator and virtualizer
 Name: qemu-kvm
-Version: 8.2.0
-Release: 11%{?rcrel}%{?dist}%{?cc_suffix}.6
+Version: 9.0.0
+Release: 10%{?rcrel}%{?dist}%{?cc_suffix}
 # Epoch because we pushed a qemu-1.0 package. AIUI this can't ever be dropped
 # Epoch 15 used for RHEL 8
 # Epoch 17 used for RHEL 9 (due to release versioning offset in RHEL 8.5)
@@ -186,468 +186,252 @@ Patch0012: 0012-vfio-cap-number-of-devices-that-can-be-assigned.patch
 Patch0013: 0013-Add-support-statement-to-help-output.patch
 Patch0014: 0014-Use-qemu-kvm-in-documentation-instead-of-qemu-system.patch
 Patch0015: 0015-qcow2-Deprecation-warning-when-opening-v2-images-rw.patch
-Patch0016: 0016-Introduce-RHEL-9.4.0-qemu-kvm-machine-type-for-aarch.patch
-# For RHEL-17168 - Introduce virt-rhel9.4.0 arm-virt machine type [aarch64]
-Patch17: kvm-hw-arm-virt-Fix-compats.patch
-# For RHEL-19738 - Enable properties allowing to disable high memory regions
-Patch18: kvm-hw-arm-virt-Add-properties-to-disable-high-memory-re.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch19: kvm-vfio-Introduce-base-object-for-VFIOContainer-and-tar.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch20: kvm-vfio-container-Introduce-a-empty-VFIOIOMMUOps.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch21: kvm-vfio-container-Switch-to-dma_map-unmap-API.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch22: kvm-vfio-common-Introduce-vfio_container_init-destroy-he.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch23: kvm-vfio-common-Move-giommu_list-in-base-container.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch24: kvm-vfio-container-Move-space-field-to-base-container.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch25: kvm-vfio-container-Switch-to-IOMMU-BE-set_dirty_page_tra.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch26: kvm-vfio-container-Move-per-container-device-list-in-bas.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch27: kvm-vfio-container-Convert-functions-to-base-container.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch28: kvm-vfio-container-Move-pgsizes-and-dma_max_mappings-to-.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch29: kvm-vfio-container-Move-vrdl_list-to-base-container.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch30: kvm-vfio-container-Move-listener-to-base-container.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch31: kvm-vfio-container-Move-dirty_pgsizes-and-max_dirty_bitm.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch32: kvm-vfio-container-Move-iova_ranges-to-base-container.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch33: kvm-vfio-container-Implement-attach-detach_device.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch34: kvm-vfio-spapr-Introduce-spapr-backend-and-target-interf.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch35: kvm-vfio-spapr-switch-to-spapr-IOMMU-BE-add-del_section_.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch36: kvm-vfio-spapr-Move-prereg_listener-into-spapr-container.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch37: kvm-vfio-spapr-Move-hostwin_list-into-spapr-container.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch38: kvm-backends-iommufd-Introduce-the-iommufd-object.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch39: kvm-util-char_dev-Add-open_cdev.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch40: kvm-vfio-common-return-early-if-space-isn-t-empty.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch41: kvm-vfio-iommufd-Implement-the-iommufd-backend.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch42: kvm-vfio-iommufd-Relax-assert-check-for-iommufd-backend.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch43: kvm-vfio-iommufd-Add-support-for-iova_ranges-and-pgsizes.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch44: kvm-vfio-pci-Extract-out-a-helper-vfio_pci_get_pci_hot_r.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch45: kvm-vfio-pci-Introduce-a-vfio-pci-hot-reset-interface.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch46: kvm-vfio-iommufd-Enable-pci-hot-reset-through-iommufd-cd.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch47: kvm-vfio-pci-Allow-the-selection-of-a-given-iommu-backen.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch48: kvm-vfio-pci-Make-vfio-cdev-pre-openable-by-passing-a-fi.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch49: kvm-vfio-platform-Allow-the-selection-of-a-given-iommu-b.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch50: kvm-vfio-platform-Make-vfio-cdev-pre-openable-by-passing.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch51: kvm-vfio-ap-Allow-the-selection-of-a-given-iommu-backend.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch52: kvm-vfio-ap-Make-vfio-cdev-pre-openable-by-passing-a-fil.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch53: kvm-vfio-ccw-Allow-the-selection-of-a-given-iommu-backen.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch54: kvm-vfio-ccw-Make-vfio-cdev-pre-openable-by-passing-a-fi.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch55: kvm-vfio-Make-VFIOContainerBase-poiner-parameter-const-i.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch56: kvm-hw-arm-Activate-IOMMUFD-for-virt-machines.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch57: kvm-kconfig-Activate-IOMMUFD-for-s390x-machines.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch58: kvm-hw-i386-Activate-IOMMUFD-for-q35-machines.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch59: kvm-vfio-pci-Move-VFIODevice-initializations-in-vfio_ins.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch60: kvm-vfio-platform-Move-VFIODevice-initializations-in-vfi.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch61: kvm-vfio-ap-Move-VFIODevice-initializations-in-vfio_ap_i.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch62: kvm-vfio-ccw-Move-VFIODevice-initializations-in-vfio_ccw.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch63: kvm-vfio-Introduce-a-helper-function-to-initialize-VFIOD.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch64: kvm-docs-devel-Add-VFIO-iommufd-backend-documentation.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch65: kvm-hw-ppc-Kconfig-Imply-VFIO_PCI.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch66: kvm-vfio-spapr-Extend-VFIOIOMMUOps-with-a-release-handle.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch67: kvm-vfio-container-Introduce-vfio_legacy_setup-for-furth.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch68: kvm-vfio-container-Initialize-VFIOIOMMUOps-under-vfio_in.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch69: kvm-vfio-container-Introduce-a-VFIOIOMMU-QOM-interface.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch70: kvm-vfio-container-Introduce-a-VFIOIOMMU-legacy-QOM-inte.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch71: kvm-vfio-container-Intoduce-a-new-VFIOIOMMUClass-setup-h.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch72: kvm-vfio-spapr-Introduce-a-sPAPR-VFIOIOMMU-QOM-interface.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch73: kvm-vfio-iommufd-Introduce-a-VFIOIOMMU-iommufd-QOM-inter.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch74: kvm-vfio-spapr-Only-compile-sPAPR-IOMMU-support-when-nee.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch75: kvm-vfio-iommufd-Remove-CONFIG_IOMMUFD-usage.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch76: kvm-vfio-container-Replace-basename-with-g_path_get_base.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch77: kvm-hw-vfio-fix-iteration-over-global-VFIODevice-list.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch78: kvm-vfio-iommufd-Remove-the-use-of-stat-to-check-file-ex.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch79: kvm-vfio-container-Rename-vfio_init_container-to-vfio_se.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch80: kvm-vfio-migration-Add-helper-function-to-set-state-or-r.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch81: kvm-backends-iommufd-Remove-check-on-number-of-backend-u.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch82: kvm-backends-iommufd-Remove-mutex.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch83: kvm-Compile-IOMMUFD-object-on-aarch64.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch84: kvm-Compile-IOMMUFD-on-s390x.patch
-# For RHEL-19302 - NVIDIA:Grace-Hopper Backport QEMU IOMMUFD Backend
-# For RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
-Patch85: kvm-Compile-IOMMUFD-on-x86_64.patch
-# For RHEL-18212 - [RHEL9][Secure-execution][s390x] The error message is not clear when boot up a SE guest with wrong encryption
-Patch86: kvm-target-s390x-kvm-pv-Provide-some-more-useful-informa.patch
-# For RHEL-15965 -  [qemu-kvm] Remove AioContext lock (no response with QMP command block_resize)
-Patch87: kvm-nbd-server-avoid-per-NBDRequest-nbd_client_get-put.patch
-# For RHEL-15965 -  [qemu-kvm] Remove AioContext lock (no response with QMP command block_resize)
-Patch88: kvm-nbd-server-only-traverse-NBDExport-clients-from-main.patch
-# For RHEL-15965 -  [qemu-kvm] Remove AioContext lock (no response with QMP command block_resize)
-Patch89: kvm-nbd-server-introduce-NBDClient-lock-to-protect-field.patch
-# For RHEL-15965 -  [qemu-kvm] Remove AioContext lock (no response with QMP command block_resize)
-Patch90: kvm-block-file-posix-set-up-Linux-AIO-and-io_uring-in-th.patch
-# For RHEL-15965 -  [qemu-kvm] Remove AioContext lock (no response with QMP command block_resize)
-Patch91: kvm-virtio-blk-add-lock-to-protect-s-rq.patch
-# For RHEL-15965 -  [qemu-kvm] Remove AioContext lock (no response with QMP command block_resize)
-Patch92: kvm-virtio-blk-don-t-lock-AioContext-in-the-completion-c.patch
-# For RHEL-15965 -  [qemu-kvm] Remove AioContext lock (no response with QMP command block_resize)
-Patch93: kvm-virtio-blk-don-t-lock-AioContext-in-the-submission-c.patch
-# For RHEL-15965 -  [qemu-kvm] Remove AioContext lock (no response with QMP command block_resize)
-Patch94: kvm-scsi-only-access-SCSIDevice-requests-from-one-thread.patch
-# For RHEL-15965 -  [qemu-kvm] Remove AioContext lock (no response with QMP command block_resize)
-Patch95: kvm-virtio-scsi-don-t-lock-AioContext-around-virtio_queu.patch
-# For RHEL-15965 -  [qemu-kvm] Remove AioContext lock (no response with QMP command block_resize)
-Patch96: kvm-scsi-don-t-lock-AioContext-in-I-O-code-path.patch
-# For RHEL-15965 -  [qemu-kvm] Remove AioContext lock (no response with QMP command block_resize)
-Patch97: kvm-dma-helpers-don-t-lock-AioContext-in-dma_blk_cb.patch
-# For RHEL-15965 -  [qemu-kvm] Remove AioContext lock (no response with QMP command block_resize)
-Patch98: kvm-virtio-scsi-replace-AioContext-lock-with-tmf_bh_lock.patch
-# For RHEL-15965 -  [qemu-kvm] Remove AioContext lock (no response with QMP command block_resize)
-Patch99: kvm-scsi-assert-that-callbacks-run-in-the-correct-AioCon.patch
-# For RHEL-15965 -  [qemu-kvm] Remove AioContext lock (no response with QMP command block_resize)
-Patch100: kvm-tests-remove-aio_context_acquire-tests.patch
-# For RHEL-15965 -  [qemu-kvm] Remove AioContext lock (no response with QMP command block_resize)
-Patch101: kvm-aio-make-aio_context_acquire-aio_context_release-a-n.patch
-# For RHEL-15965 -  [qemu-kvm] Remove AioContext lock (no response with QMP command block_resize)
-Patch102: kvm-graph-lock-remove-AioContext-locking.patch
-# For RHEL-15965 -  [qemu-kvm] Remove AioContext lock (no response with QMP command block_resize)
-Patch103: kvm-block-remove-AioContext-locking.patch
-# For RHEL-15965 -  [qemu-kvm] Remove AioContext lock (no response with QMP command block_resize)
-Patch104: kvm-block-remove-bdrv_co_lock.patch
-# For RHEL-15965 -  [qemu-kvm] Remove AioContext lock (no response with QMP command block_resize)
-Patch105: kvm-scsi-remove-AioContext-locking.patch
-# For RHEL-15965 -  [qemu-kvm] Remove AioContext lock (no response with QMP command block_resize)
-Patch106: kvm-aio-wait-draw-equivalence-between-AIO_WAIT_WHILE-and.patch
-# For RHEL-15965 -  [qemu-kvm] Remove AioContext lock (no response with QMP command block_resize)
-Patch107: kvm-aio-remove-aio_context_acquire-aio_context_release-A.patch
-# For RHEL-15965 -  [qemu-kvm] Remove AioContext lock (no response with QMP command block_resize)
-Patch108: kvm-docs-remove-AioContext-lock-from-IOThread-docs.patch
-# For RHEL-15965 -  [qemu-kvm] Remove AioContext lock (no response with QMP command block_resize)
-Patch109: kvm-scsi-remove-outdated-AioContext-lock-comment.patch
-# For RHEL-15965 -  [qemu-kvm] Remove AioContext lock (no response with QMP command block_resize)
-Patch110: kvm-job-remove-outdated-AioContext-locking-comments.patch
-# For RHEL-15965 -  [qemu-kvm] Remove AioContext lock (no response with QMP command block_resize)
-Patch111: kvm-block-remove-outdated-AioContext-locking-comments.patch
-# For RHEL-15965 -  [qemu-kvm] Remove AioContext lock (no response with QMP command block_resize)
-Patch112: kvm-block-coroutine-wrapper-use-qemu_get_current_aio_con.patch
-# For RHEL-21169 - [s390x] VM fails to start with ISM passed through QEMU 8.2
-Patch113: kvm-s390x-pci-avoid-double-enable-disable-of-aif.patch
-# For RHEL-21169 - [s390x] VM fails to start with ISM passed through QEMU 8.2
-Patch114: kvm-s390x-pci-refresh-fh-before-disabling-aif.patch
-# For RHEL-21169 - [s390x] VM fails to start with ISM passed through QEMU 8.2
-Patch115: kvm-s390x-pci-drive-ISM-reset-from-subsystem-reset.patch
-# For RHEL-21570 - Critical performance degradation for input devices in virtio vnc session
-Patch116: kvm-include-ui-rect.h-fix-qemu_rect_init-mis-assignment.patch
-# For RHEL-7565 - qemu crashed when migrate guest with blob resources enabled
-Patch117: kvm-virtio-gpu-block-migration-of-VMs-with-blob-true.patch
-# For RHEL-21293 - [emulated igb] Failed to set up TRIGGER eventfd signaling for interrupt INTX-0: VFIO_DEVICE_SET_IRQS failure: Invalid argument
-Patch118: kvm-vfio-pci-Clear-MSI-X-IRQ-index-always.patch
-# For RHEL-20341 - memory-device size alignment check invalid in QEMU 8.2
-Patch119: kvm-hv-balloon-use-get_min_alignment-to-express-32-GiB-a.patch
-# For RHEL-20341 - memory-device size alignment check invalid in QEMU 8.2
-Patch120: kvm-memory-device-reintroduce-memory-region-size-check.patch
-# For RHEL-24593 - qemu crash blk_get_aio_context(BlockBackend *): Assertion `ctx == blk->ctx' when repeatedly hotplug/unplug disk
-Patch121: kvm-block-backend-Allow-concurrent-context-changes.patch
-# For RHEL-24593 - qemu crash blk_get_aio_context(BlockBackend *): Assertion `ctx == blk->ctx' when repeatedly hotplug/unplug disk
-Patch122: kvm-scsi-Await-request-purging.patch
-# For RHEL-17369 - [nfv virt][rt][post-copy migration] qemu-kvm: ../block/qcow2.c:5263: ImageInfoSpecific *qcow2_get_specific_info(BlockDriverState *, Error **): Assertion `false' failed.
-# For RHEL-20764 - [qemu-kvm] Enable qemu multiqueue block layer support
-# For RHEL-7356 - [qemu-kvm] no response with QMP command device_add when repeatedly hotplug/unplug virtio disks [RHEL-9]
-Patch123: kvm-string-output-visitor-show-structs-as-omitted.patch
-# For RHEL-17369 - [nfv virt][rt][post-copy migration] qemu-kvm: ../block/qcow2.c:5263: ImageInfoSpecific *qcow2_get_specific_info(BlockDriverState *, Error **): Assertion `false' failed.
-# For RHEL-20764 - [qemu-kvm] Enable qemu multiqueue block layer support
-# For RHEL-7356 - [qemu-kvm] no response with QMP command device_add when repeatedly hotplug/unplug virtio disks [RHEL-9]
-Patch124: kvm-string-output-visitor-Fix-pseudo-struct-handling.patch
-# For RHEL-17369 - [nfv virt][rt][post-copy migration] qemu-kvm: ../block/qcow2.c:5263: ImageInfoSpecific *qcow2_get_specific_info(BlockDriverState *, Error **): Assertion `false' failed.
-# For RHEL-20764 - [qemu-kvm] Enable qemu multiqueue block layer support
-# For RHEL-7356 - [qemu-kvm] no response with QMP command device_add when repeatedly hotplug/unplug virtio disks [RHEL-9]
-Patch125: kvm-qdev-properties-alias-all-object-class-properties.patch
-# For RHEL-17369 - [nfv virt][rt][post-copy migration] qemu-kvm: ../block/qcow2.c:5263: ImageInfoSpecific *qcow2_get_specific_info(BlockDriverState *, Error **): Assertion `false' failed.
-# For RHEL-20764 - [qemu-kvm] Enable qemu multiqueue block layer support
-# For RHEL-7356 - [qemu-kvm] no response with QMP command device_add when repeatedly hotplug/unplug virtio disks [RHEL-9]
-Patch126: kvm-qdev-add-IOThreadVirtQueueMappingList-property-type.patch
-# For RHEL-17369 - [nfv virt][rt][post-copy migration] qemu-kvm: ../block/qcow2.c:5263: ImageInfoSpecific *qcow2_get_specific_info(BlockDriverState *, Error **): Assertion `false' failed.
-# For RHEL-20764 - [qemu-kvm] Enable qemu multiqueue block layer support
-# For RHEL-7356 - [qemu-kvm] no response with QMP command device_add when repeatedly hotplug/unplug virtio disks [RHEL-9]
-Patch127: kvm-virtio-blk-add-iothread-vq-mapping-parameter.patch
-# For RHEL-17369 - [nfv virt][rt][post-copy migration] qemu-kvm: ../block/qcow2.c:5263: ImageInfoSpecific *qcow2_get_specific_info(BlockDriverState *, Error **): Assertion `false' failed.
-# For RHEL-20764 - [qemu-kvm] Enable qemu multiqueue block layer support
-# For RHEL-7356 - [qemu-kvm] no response with QMP command device_add when repeatedly hotplug/unplug virtio disks [RHEL-9]
-Patch128: kvm-virtio-blk-Fix-potential-nullpointer-read-access-in-.patch
-# For RHEL-17369 - [nfv virt][rt][post-copy migration] qemu-kvm: ../block/qcow2.c:5263: ImageInfoSpecific *qcow2_get_specific_info(BlockDriverState *, Error **): Assertion `false' failed.
-# For RHEL-20764 - [qemu-kvm] Enable qemu multiqueue block layer support
-# For RHEL-7356 - [qemu-kvm] no response with QMP command device_add when repeatedly hotplug/unplug virtio disks [RHEL-9]
-Patch129: kvm-iotests-add-filter_qmp_generated_node_ids.patch
-# For RHEL-17369 - [nfv virt][rt][post-copy migration] qemu-kvm: ../block/qcow2.c:5263: ImageInfoSpecific *qcow2_get_specific_info(BlockDriverState *, Error **): Assertion `false' failed.
-# For RHEL-20764 - [qemu-kvm] Enable qemu multiqueue block layer support
-# For RHEL-7356 - [qemu-kvm] no response with QMP command device_add when repeatedly hotplug/unplug virtio disks [RHEL-9]
-Patch130: kvm-iotests-port-141-to-Python-for-reliable-QMP-testing.patch
-# For RHEL-17369 - [nfv virt][rt][post-copy migration] qemu-kvm: ../block/qcow2.c:5263: ImageInfoSpecific *qcow2_get_specific_info(BlockDriverState *, Error **): Assertion `false' failed.
-# For RHEL-20764 - [qemu-kvm] Enable qemu multiqueue block layer support
-# For RHEL-7356 - [qemu-kvm] no response with QMP command device_add when repeatedly hotplug/unplug virtio disks [RHEL-9]
-Patch131: kvm-monitor-only-run-coroutine-commands-in-qemu_aio_cont.patch
-# For RHEL-17369 - [nfv virt][rt][post-copy migration] qemu-kvm: ../block/qcow2.c:5263: ImageInfoSpecific *qcow2_get_specific_info(BlockDriverState *, Error **): Assertion `false' failed.
-# For RHEL-20764 - [qemu-kvm] Enable qemu multiqueue block layer support
-# For RHEL-7356 - [qemu-kvm] no response with QMP command device_add when repeatedly hotplug/unplug virtio disks [RHEL-9]
-Patch132: kvm-virtio-blk-move-dataplane-code-into-virtio-blk.c.patch
-# For RHEL-17369 - [nfv virt][rt][post-copy migration] qemu-kvm: ../block/qcow2.c:5263: ImageInfoSpecific *qcow2_get_specific_info(BlockDriverState *, Error **): Assertion `false' failed.
-# For RHEL-20764 - [qemu-kvm] Enable qemu multiqueue block layer support
-# For RHEL-7356 - [qemu-kvm] no response with QMP command device_add when repeatedly hotplug/unplug virtio disks [RHEL-9]
-Patch133: kvm-virtio-blk-rename-dataplane-create-destroy-functions.patch
-# For RHEL-17369 - [nfv virt][rt][post-copy migration] qemu-kvm: ../block/qcow2.c:5263: ImageInfoSpecific *qcow2_get_specific_info(BlockDriverState *, Error **): Assertion `false' failed.
-# For RHEL-20764 - [qemu-kvm] Enable qemu multiqueue block layer support
-# For RHEL-7356 - [qemu-kvm] no response with QMP command device_add when repeatedly hotplug/unplug virtio disks [RHEL-9]
-Patch134: kvm-virtio-blk-rename-dataplane-to-ioeventfd.patch
-# For RHEL-17369 - [nfv virt][rt][post-copy migration] qemu-kvm: ../block/qcow2.c:5263: ImageInfoSpecific *qcow2_get_specific_info(BlockDriverState *, Error **): Assertion `false' failed.
-# For RHEL-20764 - [qemu-kvm] Enable qemu multiqueue block layer support
-# For RHEL-7356 - [qemu-kvm] no response with QMP command device_add when repeatedly hotplug/unplug virtio disks [RHEL-9]
-Patch135: kvm-virtio-blk-restart-s-rq-reqs-in-vq-AioContexts.patch
-# For RHEL-17369 - [nfv virt][rt][post-copy migration] qemu-kvm: ../block/qcow2.c:5263: ImageInfoSpecific *qcow2_get_specific_info(BlockDriverState *, Error **): Assertion `false' failed.
-# For RHEL-20764 - [qemu-kvm] Enable qemu multiqueue block layer support
-# For RHEL-7356 - [qemu-kvm] no response with QMP command device_add when repeatedly hotplug/unplug virtio disks [RHEL-9]
-Patch136: kvm-virtio-blk-tolerate-failure-to-set-BlockBackend-AioC.patch
-# For RHEL-17369 - [nfv virt][rt][post-copy migration] qemu-kvm: ../block/qcow2.c:5263: ImageInfoSpecific *qcow2_get_specific_info(BlockDriverState *, Error **): Assertion `false' failed.
-# For RHEL-20764 - [qemu-kvm] Enable qemu multiqueue block layer support
-# For RHEL-7356 - [qemu-kvm] no response with QMP command device_add when repeatedly hotplug/unplug virtio disks [RHEL-9]
-Patch137: kvm-virtio-blk-always-set-ioeventfd-during-startup.patch
-# For RHEL-17369 - [nfv virt][rt][post-copy migration] qemu-kvm: ../block/qcow2.c:5263: ImageInfoSpecific *qcow2_get_specific_info(BlockDriverState *, Error **): Assertion `false' failed.
-# For RHEL-20764 - [qemu-kvm] Enable qemu multiqueue block layer support
-# For RHEL-7356 - [qemu-kvm] no response with QMP command device_add when repeatedly hotplug/unplug virtio disks [RHEL-9]
-Patch138: kvm-tests-unit-Bump-test-replication-timeout-to-60-secon.patch
-# For RHEL-17369 - [nfv virt][rt][post-copy migration] qemu-kvm: ../block/qcow2.c:5263: ImageInfoSpecific *qcow2_get_specific_info(BlockDriverState *, Error **): Assertion `false' failed.
-# For RHEL-20764 - [qemu-kvm] Enable qemu multiqueue block layer support
-# For RHEL-7356 - [qemu-kvm] no response with QMP command device_add when repeatedly hotplug/unplug virtio disks [RHEL-9]
-Patch139: kvm-iotests-iothreads-stream-Use-the-right-TimeoutError.patch
-# For RHEL-24045 - QEMU: default-enable dynamically using multiple memslots for virtio-mem
-Patch140: kvm-virtio-mem-default-enable-dynamic-memslots.patch
-# For RHEL-3934 - [qemu-kvm] Failed on repeatedly hotplug/unplug  disk iothread enabled  
-Patch141: kvm-virtio-scsi-Attach-event-vq-notifier-with-no_poll.patch
-# For RHEL-3934 - [qemu-kvm] Failed on repeatedly hotplug/unplug  disk iothread enabled  
-Patch142: kvm-virtio-Re-enable-notifications-after-drain.patch
-# For RHEL-3934 - [qemu-kvm] Failed on repeatedly hotplug/unplug  disk iothread enabled  
-Patch143: kvm-virtio-blk-Use-ioeventfd_attach-in-start_ioeventfd.patch
-# For RHEL-15394 - virtio-blk: qemu hang on "no response on QMP query-status" when write data to disk without enough space
-Patch144: kvm-virtio-blk-avoid-using-ioeventfd-state-in-irqfd-cond.patch
-# For RHEL-24988 - Mark virt-rhel9.{0,2}.0 machine types as deprecated
-Patch145: kvm-hw-arm-virt-deprecate-virt-rhel9.-0-2-.0-machine-typ.patch
-# For RHEL-17068 - Check/fix machine type compatibility for qemu-kvm 8.2.0 [x86_64]
-Patch146: kvm-x86-rhel-9.2.0-machine-type-compat-fix.patch
-# For RHEL-26049 - When max vcpu is greater than or equal to 246, qemu unable to init event notifier
-Patch147: kvm-qemu_init-increase-NOFILE-soft-limit-on-POSIX.patch
-# For RHEL-24614 - [RHEL9][chardev][s390x] qemu hit core dump while using TLS server from host to guest
-Patch148: kvm-chardev-char-socket-Fix-TLS-io-channels-sending-too-.patch
-# For RHEL-19629 - CVE-2023-6683 qemu-kvm: QEMU: VNC: NULL pointer dereference in qemu_clipboard_request() [rhel-9]
-Patch149: kvm-ui-clipboard-mark-type-as-not-available-when-there-i.patch
-# For RHEL-19629 - CVE-2023-6683 qemu-kvm: QEMU: VNC: NULL pointer dereference in qemu_clipboard_request() [rhel-9]
-Patch150: kvm-ui-clipboard-add-asserts-for-update-and-request.patch
-# For RHEL-21705 - pc-q35-rhel9.4.0 does not provide proper computer information
-Patch151: kvm-hw-i386-pc-Defer-smbios_set_defaults-to-machine_done.patch
-# For RHEL-21705 - pc-q35-rhel9.4.0 does not provide proper computer information
-Patch152: kvm-Implement-base-of-SMBIOS-type-9-descriptor.patch
-# For RHEL-21705 - pc-q35-rhel9.4.0 does not provide proper computer information
-Patch153: kvm-Implement-SMBIOS-type-9-v2.6.patch
-# For RHEL-21705 - pc-q35-rhel9.4.0 does not provide proper computer information
-Patch154: kvm-smbios-cleanup-smbios_get_tables-from-legacy-handlin.patch
-# For RHEL-21705 - pc-q35-rhel9.4.0 does not provide proper computer information
-Patch155: kvm-smbios-get-rid-of-smbios_smp_sockets-global.patch
-# For RHEL-21705 - pc-q35-rhel9.4.0 does not provide proper computer information
-Patch156: kvm-smbios-get-rid-of-smbios_legacy-global.patch
-# For RHEL-21705 - pc-q35-rhel9.4.0 does not provide proper computer information
-Patch157: kvm-smbios-avoid-mangling-user-provided-tables.patch
-# For RHEL-21705 - pc-q35-rhel9.4.0 does not provide proper computer information
-Patch158: kvm-smbios-don-t-check-type4-structures-in-legacy-mode.patch
-# For RHEL-21705 - pc-q35-rhel9.4.0 does not provide proper computer information
-Patch159: kvm-smbios-add-smbios_add_usr_blob_size-helper.patch
-# For RHEL-21705 - pc-q35-rhel9.4.0 does not provide proper computer information
-Patch160: kvm-smbios-rename-expose-structures-bitmaps-used-by-both.patch
-# For RHEL-21705 - pc-q35-rhel9.4.0 does not provide proper computer information
-Patch161: kvm-smbios-build-legacy-mode-code-only-for-pc-machine.patch
-# For RHEL-21705 - pc-q35-rhel9.4.0 does not provide proper computer information
-Patch162: kvm-smbios-handle-errors-consistently.patch
-# For RHEL-21705 - pc-q35-rhel9.4.0 does not provide proper computer information
-Patch163: kvm-smbios-get-rid-of-global-smbios_ep_type.patch
-# For RHEL-21705 - pc-q35-rhel9.4.0 does not provide proper computer information
-Patch164: kvm-smbios-clear-smbios_type4_count-before-building-tabl.patch
-# For RHEL-21705 - pc-q35-rhel9.4.0 does not provide proper computer information
-Patch165: kvm-smbios-extend-smbios-entry-point-type-with-auto-valu.patch
-# For RHEL-21705 - pc-q35-rhel9.4.0 does not provide proper computer information
-Patch166: kvm-smbios-in-case-of-entry-point-is-auto-try-to-build-v.patch
-# For RHEL-21705 - pc-q35-rhel9.4.0 does not provide proper computer information
-Patch167: kvm-smbios-error-out-when-building-type-4-table-is-not-p.patch
-# For RHEL-21705 - pc-q35-rhel9.4.0 does not provide proper computer information
-Patch168: kvm-pc-q35-set-SMBIOS-entry-point-type-to-auto-by-defaul.patch
-# For RHEL-28125 - RHEL9.4 - KVM : Live migration of guest with multiple qcow devices remains incomplete.
-Patch169: kvm-mirror-Don-t-call-job_pause_point-under-graph-lock.patch
-# For RHEL-28125 - RHEL9.4 - KVM : Live migration of guest with multiple qcow devices remains incomplete.
-Patch170: kvm-nbd-server-Fix-race-in-draining-the-export.patch
-# For RHEL-28125 - RHEL9.4 - KVM : Live migration of guest with multiple qcow devices remains incomplete.
-Patch171: kvm-iotests-Add-test-for-reset-AioContext-switches-with-.patch
-# For RHEL-21705 - pc-q35-rhel9.4.0 does not provide proper computer information
-Patch172: kvm-pc-smbios-fixup-manufacturer-product-version-to-matc.patch
-# For RHEL-24614 - [RHEL9][chardev] qemu hit core dump while using TLS server from host to guest
-Patch173: kvm-chardev-lower-priority-of-the-HUP-GSource-in-socket-.patch
-# For RHEL-24614 - [RHEL9][chardev] qemu hit core dump while using TLS server from host to guest
-Patch174: kvm-Revert-chardev-char-socket-Fix-TLS-io-channels-sendi.patch
-# For RHEL-24614 - [RHEL9][chardev] qemu hit core dump while using TLS server from host to guest
-Patch175: kvm-Revert-chardev-use-a-child-source-for-qio-input-sour.patch
-# For RHEL-28947 - Qemu crashing with "failed to set up stack guard page: Cannot allocate memory"
-Patch176: kvm-coroutine-cap-per-thread-local-pool-size.patch
-# For RHEL-28947 - Qemu crashing with "failed to set up stack guard page: Cannot allocate memory"
-Patch177: kvm-coroutine-reserve-5-000-mappings.patch
-# For RHEL-32837 - qemu-kvm running Vyatta hits assert when doing KVM_SET_GSI_ROUTING [rhel-9.4.z]
-Patch178: kvm-virtio-pci-fix-use-of-a-released-vector.patch
-# For RHEL-32990 - qemu crash with kvm_irqchip_commit_routes: Assertion `ret == 0' failed if booting with many virtio disks and vcpus [rhel-9.4.z]
-Patch179: kvm-kvm-error-out-of-kvm_irqchip_add_msi_route-in-case-o.patch
-# For RHEL-33754 - Qemu hang when quit dst vm after storage migration(nbd+tls) [rhel-9.4.z]
-Patch180: kvm-nbd-server-do-not-poll-within-a-coroutine-context.patch
-# For RHEL-33754 - Qemu hang when quit dst vm after storage migration(nbd+tls) [rhel-9.4.z]
-Patch181: kvm-nbd-server-Mark-negotiation-functions-as-coroutine_f.patch
-# For RHEL-33754 - Qemu hang when quit dst vm after storage migration(nbd+tls) [rhel-9.4.z]
-Patch182: kvm-qio-Inherit-follow_coroutine_ctx-across-TLS.patch
-# For RHEL-33754 - Qemu hang when quit dst vm after storage migration(nbd+tls) [rhel-9.4.z]
-Patch183: kvm-iotests-test-NBD-TLS-iothread.patch
-# For RHEL-35610
-Patch184: kvm-qcow2-Don-t-open-data_file-with-BDRV_O_NO_IO.patch
-# For RHEL-35610
-Patch185: kvm-iotests-244-Don-t-store-data-file-with-protocol-in-i.patch
-# For RHEL-35610
-Patch186: kvm-iotests-270-Don-t-store-data-file-with-json-prefix-i.patch
-# For RHEL-35610
-Patch187: kvm-block-Parse-filenames-only-when-explicitly-requested.patch
-# For RHEL-36181 - [RHEL9.5.0][stable_guest_abi]Failed to migrate VM with (qemu) qemu-kvm: Missing section footer for 0000:00:01.0/virtio-gpu qemu-kvm: load of migration failed: Invalid argument [rhel-9.4.0.z]
-Patch188: kvm-virtio-gpu-fix-scanout-migration-post-load.patch
-# For RHEL-36181 - [RHEL9.5.0][stable_guest_abi]Failed to migrate VM with (qemu) qemu-kvm: Missing section footer for 0000:00:01.0/virtio-gpu qemu-kvm: load of migration failed: Invalid argument [rhel-9.4.0.z]
-Patch189: kvm-virtio-gpu-fix-v2-migration.patch
-# For RHEL-36181 - [RHEL9.5.0][stable_guest_abi]Failed to migrate VM with (qemu) qemu-kvm: Missing section footer for 0000:00:01.0/virtio-gpu qemu-kvm: load of migration failed: Invalid argument [rhel-9.4.0.z]
-Patch190: kvm-rhel-9.4.0-machine-type-compat-for-virtio-gpu-migrat.patch
-# For RHEL-43261 - qemu-kvm: linux-aio: add support for IO_CMD_FDSYNC command [rhel-9.4.z]
-Patch191: kvm-linux-aio-add-IO_CMD_FDSYNC-command-support.patch
-# For RHEL-53565 - [RHEL9.4_to_RHEL9.5]When the VM is with only 9.4.0 (q35) machine type, still hit error of virtio-gpu issue [rhel-9.4.z]
-Patch192: kvm-Fix-scanout-version-with-pc-q35-rhel9.4.0.patch
-# For RHEL-52616 - CVE-2024-7409 qemu-kvm: Denial of Service via Improper Synchronization in QEMU NBD Server During Socket Closure [rhel-9.4.z]
-Patch193: kvm-nbd-server-Plumb-in-new-args-to-nbd_client_add.patch
-# For RHEL-52616 - CVE-2024-7409 qemu-kvm: Denial of Service via Improper Synchronization in QEMU NBD Server During Socket Closure [rhel-9.4.z]
-Patch194: kvm-nbd-server-CVE-2024-7409-Cap-default-max-connections.patch
-# For RHEL-52616 - CVE-2024-7409 qemu-kvm: Denial of Service via Improper Synchronization in QEMU NBD Server During Socket Closure [rhel-9.4.z]
-Patch195: kvm-nbd-server-CVE-2024-7409-Drop-non-negotiating-client.patch
-# For RHEL-52616 - CVE-2024-7409 qemu-kvm: Denial of Service via Improper Synchronization in QEMU NBD Server During Socket Closure [rhel-9.4.z]
-Patch196: kvm-nbd-server-CVE-2024-7409-Close-stray-clients-at-serv.patch
+Patch0016: 0016-Add-upstream-compatibility-bits.patch
+Patch0017: 0017-x86-rhel-9.4.0-machine-type-compat-fix.patch
+# For RHEL-34945 - [aarch64, kvm-unit-tests] all tests tagged as FAIL [qemu-kvm: GLib: g_ptr_array_add: assertion 'rarray' failed]
+Patch18: kvm-hw-arm-virt-Fix-spurious-call-to-arm_virt_compat_set.patch
+# For RHEL-30362 - Check/fix machine type compatibility for QEMU 9.0.0 [x86_64][rhel-9.5.0]
+Patch19: kvm-Revert-x86-rhel-9.4.0-machine-type-compat-fix.patch
+# For RHEL-33440 - Qemu hang when quit dst vm after storage migration(nbd+tls)
+Patch20: kvm-nbd-server-do-not-poll-within-a-coroutine-context.patch
+# For RHEL-33440 - Qemu hang when quit dst vm after storage migration(nbd+tls)
+Patch21: kvm-nbd-server-Mark-negotiation-functions-as-coroutine_f.patch
+# For RHEL-33440 - Qemu hang when quit dst vm after storage migration(nbd+tls)
+Patch22: kvm-qio-Inherit-follow_coroutine_ctx-across-TLS.patch
+# For RHEL-33440 - Qemu hang when quit dst vm after storage migration(nbd+tls)
+Patch23: kvm-iotests-test-NBD-TLS-iothread.patch
+# For RHEL-34621 - [RHEL9.5.0][stable_guest_abi]Failed to migrate VM with (qemu) qemu-kvm: Missing section footer for 0000:00:01.0/virtio-gpu qemu-kvm: load of migration failed: Invalid argument
+Patch24: kvm-virtio-gpu-fix-v2-migration.patch
+# For RHEL-34621 - [RHEL9.5.0][stable_guest_abi]Failed to migrate VM with (qemu) qemu-kvm: Missing section footer for 0000:00:01.0/virtio-gpu qemu-kvm: load of migration failed: Invalid argument
+Patch25: kvm-rhel-9.4.0-machine-type-compat-for-virtio-gpu-migrat.patch
+# For RHEL-42411 - qemu-kvm: linux-aio: add support for IO_CMD_FDSYNC command
+Patch26: kvm-linux-aio-add-IO_CMD_FDSYNC-command-support.patch
+# For RHEL-34618 - aio=io_uring: Assertion failure `luringcb->co->ctx == s->aio_context' with block_resize
+# For RHEL-38697 - aio=native: Assertion failure `laiocb->co->ctx == laiocb->ctx->aio_context' with block_resize
+Patch27: kvm-Revert-monitor-use-aio_co_reschedule_self.patch
+# For RHEL-34618 - aio=io_uring: Assertion failure `luringcb->co->ctx == s->aio_context' with block_resize
+# For RHEL-38697 - aio=native: Assertion failure `laiocb->co->ctx == laiocb->ctx->aio_context' with block_resize
+Patch28: kvm-aio-warn-about-iohandler_ctx-special-casing.patch
+# For RHEL-36159 - qemu crash on Assertion `block->n_free_ciphers > 0' failed in guest installation with luks and iothread-vq-mapping
+Patch29: kvm-block-crypto-create-ciphers-on-demand.patch
+# For RHEL-36159 - qemu crash on Assertion `block->n_free_ciphers > 0' failed in guest installation with luks and iothread-vq-mapping
+Patch30: kvm-crypto-block-drop-qcrypto_block_open-n_threads-argum.patch
+# For RHEL-35611 - CVE-2024-4467 qemu-kvm: QEMU: 'qemu-img info' leads to host file read/write [rhel-9.5]
+Patch31: kvm-qcow2-Don-t-open-data_file-with-BDRV_O_NO_IO.patch
+# For RHEL-35611 - CVE-2024-4467 qemu-kvm: QEMU: 'qemu-img info' leads to host file read/write [rhel-9.5]
+Patch32: kvm-iotests-244-Don-t-store-data-file-with-protocol-in-i.patch
+# For RHEL-35611 - CVE-2024-4467 qemu-kvm: QEMU: 'qemu-img info' leads to host file read/write [rhel-9.5]
+Patch33: kvm-iotests-270-Don-t-store-data-file-with-json-prefix-i.patch
+# For RHEL-35611 - CVE-2024-4467 qemu-kvm: QEMU: 'qemu-img info' leads to host file read/write [rhel-9.5]
+Patch34: kvm-block-Parse-filenames-only-when-explicitly-requested.patch
+# For RHEL-40708 - [RHEL9.5.0][virtio_fs][s390x] after hot-unplug the vhost-user-fs-ccw device, the device is failed to hot-plug again 
+Patch35: kvm-hw-virtio-Fix-the-de-initialization-of-vhost-user-de.patch
+# For RHEL-39936 - ARCH_DMA_MINALIGN smaller than CTR_EL0.CWG (128 < 256) on FUJITSU
+Patch36: kvm-hw-arm-virt-Avoid-unexpected-warning-from-Linux-gues.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch37: kvm-introduce-pc_rhel_9_5_compat.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch38: kvm-target-i386-add-guest-phys-bits-cpu-property.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch39: kvm-kvm-add-support-for-guest-physical-bits.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch40: kvm-i386-kvm-Move-architectural-CPUID-leaf-generation-to.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch41: kvm-target-i386-Introduce-Icelake-Server-v7-to-enable-TS.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch42: kvm-target-i386-Add-new-CPU-model-SierraForest.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch43: kvm-target-i386-Export-RFDS-bit-to-guests.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch44: kvm-pci-host-q35-Move-PAM-initialization-above-SMRAM-ini.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch45: kvm-q35-Introduce-smm_ranges-property-for-q35-pci-host.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch46: kvm-hw-i386-acpi-Set-PCAT_COMPAT-bit-only-when-pic-is-no.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch47: kvm-confidential-guest-support-Add-kvm_init-and-kvm_rese.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch48: kvm-i386-sev-Switch-to-use-confidential_guest_kvm_init.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch49: kvm-ppc-pef-switch-to-use-confidential_guest_kvm_init-re.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch50: kvm-s390-Switch-to-use-confidential_guest_kvm_init.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch51: kvm-scripts-update-linux-headers-Add-setup_data.h-to-imp.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch52: kvm-scripts-update-linux-headers-Add-bits.h-to-file-impo.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch53: kvm-linux-headers-update-to-current-kvm-next.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch54: kvm-runstate-skip-initial-CPU-reset-if-reset-is-not-actu.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch55: kvm-KVM-track-whether-guest-state-is-encrypted.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch56: kvm-KVM-remove-kvm_arch_cpu_check_are_resettable.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch57: kvm-target-i386-introduce-x86-confidential-guest.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch58: kvm-target-i386-Implement-mc-kvm_type-to-get-VM-type.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch59: kvm-target-i386-SEV-use-KVM_SEV_INIT2-if-possible.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch60: kvm-i386-sev-Add-legacy-vm-type-parameter-for-SEV-guest-.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch61: kvm-hw-i386-sev-Use-legacy-SEV-VM-types-for-older-machin.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch62: kvm-trace-kvm-Split-address-space-and-slot-id-in-trace_k.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch63: kvm-kvm-Introduce-support-for-memory_attributes.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch64: kvm-RAMBlock-Add-support-of-KVM-private-guest-memfd.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch65: kvm-kvm-Enable-KVM_SET_USER_MEMORY_REGION2-for-memslot.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch66: kvm-kvm-memory-Make-memory-type-private-by-default-if-it.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch67: kvm-HostMem-Add-mechanism-to-opt-in-kvm-guest-memfd-via-.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch68: kvm-RAMBlock-make-guest_memfd-require-uncoordinated-disc.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch69: kvm-physmem-Introduce-ram_block_discard_guest_memfd_rang.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch70: kvm-kvm-handle-KVM_EXIT_MEMORY_FAULT.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch71: kvm-kvm-tdx-Don-t-complain-when-converting-vMMIO-region-.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch72: kvm-kvm-tdx-Ignore-memory-conversion-to-shared-of-unassi.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch73: kvm-hw-i386-x86-Eliminate-two-if-statements-in-x86_bios_.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch74: kvm-hw-i386-Have-x86_bios_rom_init-take-X86MachineState-.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch75: kvm-hw-i386-pc_sysfw-Remove-unused-parameter-from-pc_isa.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch76: kvm-hw-i386-x86-Don-t-leak-isa-bios-memory-regions.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch77: kvm-hw-i386-x86-Don-t-leak-pc.bios-memory-region.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch78: kvm-hw-i386-x86-Extract-x86_isa_bios_init-from-x86_bios_.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch79: kvm-hw-i386-pc_sysfw-Alias-rather-than-copy-isa-bios-reg.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch80: kvm-i386-correctly-select-code-in-hw-i386-that-depends-o.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch81: kvm-i386-pc-remove-unnecessary-MachineClass-overrides.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch82: kvm-hw-i386-split-x86.c-in-multiple-parts.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch83: kvm-scripts-update-linux-header.sh-be-more-src-tree-frie.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch84: kvm-scripts-update-linux-headers.sh-Remove-temporary-dir.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch85: kvm-scripts-update-linux-headers.sh-Fix-the-path-of-setu.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch86: kvm-update-linux-headers-fix-forwarding-to-asm-generic-h.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch87: kvm-update-linux-headers-move-pvpanic.h-to-correct-direc.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch88: kvm-linux-headers-Update-to-current-kvm-next.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch89: kvm-update-linux-headers-import-linux-kvm_para.h-header.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch90: kvm-machine-allow-early-use-of-machine_require_guest_mem.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch91: kvm-i386-sev-Replace-error_report-with-error_setg.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch92: kvm-i386-sev-Introduce-sev-common-type-to-encapsulate-co.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch93: kvm-i386-sev-Move-sev_launch_update-to-separate-class-me.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch94: kvm-i386-sev-Move-sev_launch_finish-to-separate-class-me.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch95: kvm-i386-sev-Introduce-sev-snp-guest-object.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch96: kvm-i386-sev-Add-a-sev_snp_enabled-helper.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch97: kvm-i386-sev-Add-sev_kvm_init-override-for-SEV-class.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch98: kvm-i386-sev-Add-snp_kvm_init-override-for-SNP-class.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch99: kvm-i386-cpu-Set-SEV-SNP-CPUID-bit-when-SNP-enabled.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch100: kvm-i386-sev-Don-t-return-launch-measurements-for-SEV-SN.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch101: kvm-i386-sev-Add-a-class-method-to-determine-KVM-VM-type.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch102: kvm-i386-sev-Update-query-sev-QAPI-format-to-handle-SEV-.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch103: kvm-i386-sev-Add-the-SNP-launch-start-context.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch104: kvm-i386-sev-Add-handling-to-encrypt-finalize-guest-laun.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch105: kvm-i386-sev-Set-CPU-state-to-protected-once-SNP-guest-p.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch106: kvm-hw-i386-sev-Add-function-to-get-SEV-metadata-from-OV.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch107: kvm-i386-sev-Add-support-for-populating-OVMF-metadata-pa.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch108: kvm-i386-sev-Add-support-for-SNP-CPUID-validation.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch109: kvm-hw-i386-sev-Add-support-to-encrypt-BIOS-when-SEV-SNP.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch110: kvm-i386-sev-Invoke-launch_updata_data-for-SEV-class.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch111: kvm-i386-sev-Invoke-launch_updata_data-for-SNP-class.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch112: kvm-i386-kvm-Add-KVM_EXIT_HYPERCALL-handling-for-KVM_HC_.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch113: kvm-i386-sev-Enable-KVM_HC_MAP_GPA_RANGE-hcall-for-SNP-g.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch114: kvm-i386-sev-Extract-build_kernel_loader_hashes.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch115: kvm-i386-sev-Reorder-struct-declarations.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch116: kvm-i386-sev-Allow-measured-direct-kernel-boot-on-SNP.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch117: kvm-memory-Introduce-memory_region_init_ram_guest_memfd.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch118: kvm-hw-i386-sev-Use-guest_memfd-for-legacy-ROMs.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch119: kvm-hw-i386-Add-support-for-loading-BIOS-using-guest_mem.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch120: kvm-i386-sev-fix-unreachable-code-coverity-issue.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch121: kvm-i386-sev-Move-SEV_COMMON-null-check-before-dereferen.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch122: kvm-i386-sev-Return-when-sev_common-is-null.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch123: kvm-target-i386-SEV-fix-formatting-of-CPUID-mismatch-mes.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch124: kvm-i386-sev-Fix-error-message-in-sev_get_capabilities.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch125: kvm-i386-sev-Fallback-to-the-default-SEV-device-if-none-.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch126: kvm-i386-sev-Don-t-allow-automatic-fallback-to-legacy-KV.patch
+# For RHEL-39544 - [QEMU] Add support for AMD SEV-SNP to Qemu
+Patch127: kvm-target-i386-SEV-fix-mismatch-in-vcek-disabled-proper.patch
+# For RHEL-50336 - Fail to boot up the guest including vtpm and virtio-rng (max-bytes=0) devices
+Patch128: kvm-virtio-rng-block-max-bytes-0.patch
+# For RHEL-50000 - scsi-block: Cannot setup Windows Failover Cluster, qemu crashes on assert
+Patch129: kvm-scsi-disk-Use-positive-return-value-for-status-in-dm.patch
+# For RHEL-50000 - scsi-block: Cannot setup Windows Failover Cluster, qemu crashes on assert
+Patch130: kvm-scsi-block-Don-t-skip-callback-for-sgio-error-status.patch
+# For RHEL-50000 - scsi-block: Cannot setup Windows Failover Cluster, qemu crashes on assert
+Patch131: kvm-scsi-disk-Add-warning-comments-that-host_status-erro.patch
+# For RHEL-50000 - scsi-block: Cannot setup Windows Failover Cluster, qemu crashes on assert
+Patch132: kvm-scsi-disk-Always-report-RESERVATION_CONFLICT-to-gues.patch
+# For RHEL-52617 - CVE-2024-7409 qemu-kvm: Denial of Service via Improper Synchronization in QEMU NBD Server During Socket Closure [rhel-9.5]
+Patch133: kvm-nbd-server-Plumb-in-new-args-to-nbd_client_add.patch
+# For RHEL-52617 - CVE-2024-7409 qemu-kvm: Denial of Service via Improper Synchronization in QEMU NBD Server During Socket Closure [rhel-9.5]
+Patch134: kvm-nbd-server-CVE-2024-7409-Cap-default-max-connections.patch
+# For RHEL-52617 - CVE-2024-7409 qemu-kvm: Denial of Service via Improper Synchronization in QEMU NBD Server During Socket Closure [rhel-9.5]
+Patch135: kvm-nbd-server-CVE-2024-7409-Drop-non-negotiating-client.patch
+# For RHEL-52617 - CVE-2024-7409 qemu-kvm: Denial of Service via Improper Synchronization in QEMU NBD Server During Socket Closure [rhel-9.5]
+Patch136: kvm-nbd-server-CVE-2024-7409-Close-stray-clients-at-serv.patch
+# For RHEL-52250 - fsfreeze hooks break on the systems first restorecon
+Patch137: kvm-qemu-guest-agent-Update-the-logfile-path-of-qga-fsfr.patch
+# For RHEL-52617 - CVE-2024-7409 qemu-kvm: Denial of Service via Improper Synchronization in QEMU NBD Server During Socket Closure [rhel-9.5]
+Patch138: kvm-nbd-server-CVE-2024-7409-Avoid-use-after-free-when-c.patch
 
 %if %{have_clang}
 BuildRequires: clang
@@ -1272,7 +1056,7 @@ run_configure \
   --group=all --binary %{_libexecdir}/qemu-kvm --probe-prefix qemu.kvm \
   trace/trace-events-all qemu-kvm-simpletrace.stp
 
-cp -a %{kvm_target}-softmmu/qemu-system-%{kvm_target} qemu-kvm
+cp -a qemu-system-%{kvm_target} qemu-kvm
 
 %ifarch s390x
     # Copy the built new images into place for "make check":
@@ -1358,7 +1142,7 @@ popd
 
 mkdir -p %{buildroot}%{_datadir}/systemtap/tapset
 
-install -m 0755 %{qemu_kvm_build}/%{kvm_target}-softmmu/qemu-system-%{kvm_target} %{buildroot}%{_libexecdir}/qemu-kvm
+install -m 0755 %{qemu_kvm_build}/qemu-system-%{kvm_target} %{buildroot}%{_libexecdir}/qemu-kvm
 install -m 0644 %{qemu_kvm_build}/qemu-kvm.stp %{buildroot}%{_datadir}/systemtap/tapset/
 install -m 0644 %{qemu_kvm_build}/qemu-kvm-log.stp %{buildroot}%{_datadir}/systemtap/tapset/
 install -m 0644 %{qemu_kvm_build}/qemu-kvm-simpletrace.stp %{buildroot}%{_datadir}/systemtap/tapset/
@@ -1417,6 +1201,7 @@ rm -rf %{buildroot}%{_datadir}/%{name}/qboot.rom
 rm -rf %{buildroot}%{_datadir}/%{name}/s390-ccw.img
 rm -rf %{buildroot}%{_datadir}/%{name}/s390-netboot.img
 rm -rf %{buildroot}%{_datadir}/%{name}/hppa-firmware.img
+rm -rf %{buildroot}%{_datadir}/%{name}/hppa-firmware64.img
 rm -rf %{buildroot}%{_datadir}/%{name}/canyonlands.dtb
 rm -rf %{buildroot}%{_datadir}/%{name}/u-boot-sam460-20100605.bin
 
@@ -1647,6 +1432,10 @@ useradd -r -u 107 -g qemu -G kvm -d / -s /sbin/nologin \
 %{_datadir}/systemtap/tapset/qemu-kvm-simpletrace.stp
 %{_datadir}/%{name}/systemtap/script.d/qemu_kvm.stp
 %{_datadir}/%{name}/systemtap/conf.d/qemu_kvm.conf
+%{_datadir}/systemtap/tapset/qemu-img*.stp
+%{_datadir}/systemtap/tapset/qemu-io*.stp
+%{_datadir}/systemtap/tapset/qemu-nbd*.stp
+%{_datadir}/systemtap/tapset/qemu-storage-daemon*.stp
 
 %ifarch x86_64
     %{_libdir}/%{name}/accel-tcg-%{kvm_target}.so
@@ -1709,48 +1498,185 @@ useradd -r -u 107 -g qemu -G kvm -d / -s /sbin/nologin \
 %endif
 
 %changelog
-* Thu Aug 15 2024 Miroslav Rezanina <mrezanin@redhat.com> - 8.2.0-11.el9_4.6
-- kvm-Fix-scanout-version-with-pc-q35-rhel9.4.0.patch [RHEL-53565]
-- kvm-nbd-server-Plumb-in-new-args-to-nbd_client_add.patch [RHEL-52616]
-- kvm-nbd-server-CVE-2024-7409-Cap-default-max-connections.patch [RHEL-52616]
-- kvm-nbd-server-CVE-2024-7409-Drop-non-negotiating-client.patch [RHEL-52616]
-- kvm-nbd-server-CVE-2024-7409-Close-stray-clients-at-serv.patch [RHEL-52616]
-- Resolves: RHEL-53565
-  ([RHEL9.4_to_RHEL9.5]When the VM is with only 9.4.0 (q35) machine type, still hit error of virtio-gpu issue [rhel-9.4.z])
-- Resolves: RHEL-52616
-  (CVE-2024-7409 qemu-kvm: Denial of Service via Improper Synchronization in QEMU NBD Server During Socket Closure [rhel-9.4.z])
-
-* Mon Jul 15 2024 Miroslav Rezanina <mrezanin@redhat.com> - 8.2.0-11.el9_4.5
-- kvm-virtio-gpu-fix-scanout-migration-post-load.patch [RHEL-36181]
-- kvm-virtio-gpu-fix-v2-migration.patch [RHEL-36181]
-- kvm-rhel-9.4.0-machine-type-compat-for-virtio-gpu-migrat.patch [RHEL-36181]
-- kvm-linux-aio-add-IO_CMD_FDSYNC-command-support.patch [RHEL-43261]
-- Resolves: RHEL-36181
-  ([RHEL9.5.0][stable_guest_abi]Failed to migrate VM with (qemu) qemu-kvm: Missing section footer for 0000:00:01.0/virtio-gpu qemu-kvm: load of migration failed: Invalid argument [rhel-9.4.0.z])
-- Resolves: RHEL-43261
-  (qemu-kvm: linux-aio: add support for IO_CMD_FDSYNC command [rhel-9.4.z])
-
-* Wed Jun 19 2024 Miroslav Rezanina <mrezanin@redhat.com> - 8.2.0-11.el9_4.4
-- Fixing CVE-2024-4467
-- Resolves: RHEL-35610
-
-* Fri Jun 07 2024 Miroslav Rezanina <mrezanin@redhat.com> - 8.2.0-11.el9_4.3
-- kvm-nbd-server-do-not-poll-within-a-coroutine-context.patch [RHEL-33754]
-- kvm-nbd-server-Mark-negotiation-functions-as-coroutine_f.patch [RHEL-33754]
-- kvm-qio-Inherit-follow_coroutine_ctx-across-TLS.patch [RHEL-33754]
-- kvm-iotests-test-NBD-TLS-iothread.patch [RHEL-33754]
-- Resolves: RHEL-33754
-  (Qemu hang when quit dst vm after storage migration(nbd+tls) [rhel-9.4.z])
-
-* Mon May 20 2024 Miroslav Rezanina <mrezanin@redhat.com> - 8.2.0-11.el9_4.2
-- kvm-kvm-error-out-of-kvm_irqchip_add_msi_route-in-case-o.patch [RHEL-32990]
-- Resolves: RHEL-32990
-  (qemu crash with kvm_irqchip_commit_routes: Assertion `ret == 0' failed if booting with many virtio disks and vcpus [rhel-9.4.z])
-
-* Thu Apr 18 2024 Miroslav Rezanina <mrezanin@redhat.com> - 8.2.0-11.el9_4.1
-- kvm-virtio-pci-fix-use-of-a-released-vector.patch [RHEL-32837]
-- Resolves: RHEL-32837
-  (qemu-kvm running Vyatta hits assert when doing KVM_SET_GSI_ROUTING [rhel-9.4.z])
+* Mon Sep 02 2024 Miroslav Rezanina <mrezanin@redhat.com> - 9.0.0-10
+- kvm-nbd-server-CVE-2024-7409-Avoid-use-after-free-when-c.patch [RHEL-52617]
+- Resolves: RHEL-52617
+  (CVE-2024-7409 qemu-kvm: Denial of Service via Improper Synchronization in QEMU NBD Server During Socket Closure [rhel-9.5])
+
+* Mon Aug 26 2024 Miroslav Rezanina <mrezanin@redhat.com> - 9.0.0-9
+- kvm-qemu-guest-agent-Update-the-logfile-path-of-qga-fsfr.patch [RHEL-52250]
+- Resolves: RHEL-52250
+  (fsfreeze hooks break on the systems first restorecon)
+
+* Wed Aug 14 2024 Miroslav Rezanina <mrezanin@redhat.com> - 9.0.0-8
+- kvm-introduce-pc_rhel_9_5_compat.patch [RHEL-39544]
+- kvm-target-i386-add-guest-phys-bits-cpu-property.patch [RHEL-39544]
+- kvm-kvm-add-support-for-guest-physical-bits.patch [RHEL-39544]
+- kvm-i386-kvm-Move-architectural-CPUID-leaf-generation-to.patch [RHEL-39544]
+- kvm-target-i386-Introduce-Icelake-Server-v7-to-enable-TS.patch [RHEL-39544]
+- kvm-target-i386-Add-new-CPU-model-SierraForest.patch [RHEL-39544]
+- kvm-target-i386-Export-RFDS-bit-to-guests.patch [RHEL-39544]
+- kvm-pci-host-q35-Move-PAM-initialization-above-SMRAM-ini.patch [RHEL-39544]
+- kvm-q35-Introduce-smm_ranges-property-for-q35-pci-host.patch [RHEL-39544]
+- kvm-hw-i386-acpi-Set-PCAT_COMPAT-bit-only-when-pic-is-no.patch [RHEL-39544]
+- kvm-confidential-guest-support-Add-kvm_init-and-kvm_rese.patch [RHEL-39544]
+- kvm-i386-sev-Switch-to-use-confidential_guest_kvm_init.patch [RHEL-39544]
+- kvm-ppc-pef-switch-to-use-confidential_guest_kvm_init-re.patch [RHEL-39544]
+- kvm-s390-Switch-to-use-confidential_guest_kvm_init.patch [RHEL-39544]
+- kvm-scripts-update-linux-headers-Add-setup_data.h-to-imp.patch [RHEL-39544]
+- kvm-scripts-update-linux-headers-Add-bits.h-to-file-impo.patch [RHEL-39544]
+- kvm-linux-headers-update-to-current-kvm-next.patch [RHEL-39544]
+- kvm-runstate-skip-initial-CPU-reset-if-reset-is-not-actu.patch [RHEL-39544]
+- kvm-KVM-track-whether-guest-state-is-encrypted.patch [RHEL-39544]
+- kvm-KVM-remove-kvm_arch_cpu_check_are_resettable.patch [RHEL-39544]
+- kvm-target-i386-introduce-x86-confidential-guest.patch [RHEL-39544]
+- kvm-target-i386-Implement-mc-kvm_type-to-get-VM-type.patch [RHEL-39544]
+- kvm-target-i386-SEV-use-KVM_SEV_INIT2-if-possible.patch [RHEL-39544]
+- kvm-i386-sev-Add-legacy-vm-type-parameter-for-SEV-guest-.patch [RHEL-39544]
+- kvm-hw-i386-sev-Use-legacy-SEV-VM-types-for-older-machin.patch [RHEL-39544]
+- kvm-trace-kvm-Split-address-space-and-slot-id-in-trace_k.patch [RHEL-39544]
+- kvm-kvm-Introduce-support-for-memory_attributes.patch [RHEL-39544]
+- kvm-RAMBlock-Add-support-of-KVM-private-guest-memfd.patch [RHEL-39544]
+- kvm-kvm-Enable-KVM_SET_USER_MEMORY_REGION2-for-memslot.patch [RHEL-39544]
+- kvm-kvm-memory-Make-memory-type-private-by-default-if-it.patch [RHEL-39544]
+- kvm-HostMem-Add-mechanism-to-opt-in-kvm-guest-memfd-via-.patch [RHEL-39544]
+- kvm-RAMBlock-make-guest_memfd-require-uncoordinated-disc.patch [RHEL-39544]
+- kvm-physmem-Introduce-ram_block_discard_guest_memfd_rang.patch [RHEL-39544]
+- kvm-kvm-handle-KVM_EXIT_MEMORY_FAULT.patch [RHEL-39544]
+- kvm-kvm-tdx-Don-t-complain-when-converting-vMMIO-region-.patch [RHEL-39544]
+- kvm-kvm-tdx-Ignore-memory-conversion-to-shared-of-unassi.patch [RHEL-39544]
+- kvm-hw-i386-x86-Eliminate-two-if-statements-in-x86_bios_.patch [RHEL-39544]
+- kvm-hw-i386-Have-x86_bios_rom_init-take-X86MachineState-.patch [RHEL-39544]
+- kvm-hw-i386-pc_sysfw-Remove-unused-parameter-from-pc_isa.patch [RHEL-39544]
+- kvm-hw-i386-x86-Don-t-leak-isa-bios-memory-regions.patch [RHEL-39544]
+- kvm-hw-i386-x86-Don-t-leak-pc.bios-memory-region.patch [RHEL-39544]
+- kvm-hw-i386-x86-Extract-x86_isa_bios_init-from-x86_bios_.patch [RHEL-39544]
+- kvm-hw-i386-pc_sysfw-Alias-rather-than-copy-isa-bios-reg.patch [RHEL-39544]
+- kvm-i386-correctly-select-code-in-hw-i386-that-depends-o.patch [RHEL-39544]
+- kvm-i386-pc-remove-unnecessary-MachineClass-overrides.patch [RHEL-39544]
+- kvm-hw-i386-split-x86.c-in-multiple-parts.patch [RHEL-39544]
+- kvm-scripts-update-linux-header.sh-be-more-src-tree-frie.patch [RHEL-39544]
+- kvm-scripts-update-linux-headers.sh-Remove-temporary-dir.patch [RHEL-39544]
+- kvm-scripts-update-linux-headers.sh-Fix-the-path-of-setu.patch [RHEL-39544]
+- kvm-update-linux-headers-fix-forwarding-to-asm-generic-h.patch [RHEL-39544]
+- kvm-update-linux-headers-move-pvpanic.h-to-correct-direc.patch [RHEL-39544]
+- kvm-linux-headers-Update-to-current-kvm-next.patch [RHEL-39544]
+- kvm-update-linux-headers-import-linux-kvm_para.h-header.patch [RHEL-39544]
+- kvm-machine-allow-early-use-of-machine_require_guest_mem.patch [RHEL-39544]
+- kvm-i386-sev-Replace-error_report-with-error_setg.patch [RHEL-39544]
+- kvm-i386-sev-Introduce-sev-common-type-to-encapsulate-co.patch [RHEL-39544]
+- kvm-i386-sev-Move-sev_launch_update-to-separate-class-me.patch [RHEL-39544]
+- kvm-i386-sev-Move-sev_launch_finish-to-separate-class-me.patch [RHEL-39544]
+- kvm-i386-sev-Introduce-sev-snp-guest-object.patch [RHEL-39544]
+- kvm-i386-sev-Add-a-sev_snp_enabled-helper.patch [RHEL-39544]
+- kvm-i386-sev-Add-sev_kvm_init-override-for-SEV-class.patch [RHEL-39544]
+- kvm-i386-sev-Add-snp_kvm_init-override-for-SNP-class.patch [RHEL-39544]
+- kvm-i386-cpu-Set-SEV-SNP-CPUID-bit-when-SNP-enabled.patch [RHEL-39544]
+- kvm-i386-sev-Don-t-return-launch-measurements-for-SEV-SN.patch [RHEL-39544]
+- kvm-i386-sev-Add-a-class-method-to-determine-KVM-VM-type.patch [RHEL-39544]
+- kvm-i386-sev-Update-query-sev-QAPI-format-to-handle-SEV-.patch [RHEL-39544]
+- kvm-i386-sev-Add-the-SNP-launch-start-context.patch [RHEL-39544]
+- kvm-i386-sev-Add-handling-to-encrypt-finalize-guest-laun.patch [RHEL-39544]
+- kvm-i386-sev-Set-CPU-state-to-protected-once-SNP-guest-p.patch [RHEL-39544]
+- kvm-hw-i386-sev-Add-function-to-get-SEV-metadata-from-OV.patch [RHEL-39544]
+- kvm-i386-sev-Add-support-for-populating-OVMF-metadata-pa.patch [RHEL-39544]
+- kvm-i386-sev-Add-support-for-SNP-CPUID-validation.patch [RHEL-39544]
+- kvm-hw-i386-sev-Add-support-to-encrypt-BIOS-when-SEV-SNP.patch [RHEL-39544]
+- kvm-i386-sev-Invoke-launch_updata_data-for-SEV-class.patch [RHEL-39544]
+- kvm-i386-sev-Invoke-launch_updata_data-for-SNP-class.patch [RHEL-39544]
+- kvm-i386-kvm-Add-KVM_EXIT_HYPERCALL-handling-for-KVM_HC_.patch [RHEL-39544]
+- kvm-i386-sev-Enable-KVM_HC_MAP_GPA_RANGE-hcall-for-SNP-g.patch [RHEL-39544]
+- kvm-i386-sev-Extract-build_kernel_loader_hashes.patch [RHEL-39544]
+- kvm-i386-sev-Reorder-struct-declarations.patch [RHEL-39544]
+- kvm-i386-sev-Allow-measured-direct-kernel-boot-on-SNP.patch [RHEL-39544]
+- kvm-memory-Introduce-memory_region_init_ram_guest_memfd.patch [RHEL-39544]
+- kvm-hw-i386-sev-Use-guest_memfd-for-legacy-ROMs.patch [RHEL-39544]
+- kvm-hw-i386-Add-support-for-loading-BIOS-using-guest_mem.patch [RHEL-39544]
+- kvm-i386-sev-fix-unreachable-code-coverity-issue.patch [RHEL-39544]
+- kvm-i386-sev-Move-SEV_COMMON-null-check-before-dereferen.patch [RHEL-39544]
+- kvm-i386-sev-Return-when-sev_common-is-null.patch [RHEL-39544]
+- kvm-target-i386-SEV-fix-formatting-of-CPUID-mismatch-mes.patch [RHEL-39544]
+- kvm-i386-sev-Fix-error-message-in-sev_get_capabilities.patch [RHEL-39544]
+- kvm-i386-sev-Fallback-to-the-default-SEV-device-if-none-.patch [RHEL-39544]
+- kvm-i386-sev-Don-t-allow-automatic-fallback-to-legacy-KV.patch [RHEL-39544]
+- kvm-target-i386-SEV-fix-mismatch-in-vcek-disabled-proper.patch [RHEL-39544]
+- kvm-virtio-rng-block-max-bytes-0.patch [RHEL-50336]
+- kvm-scsi-disk-Use-positive-return-value-for-status-in-dm.patch [RHEL-50000]
+- kvm-scsi-block-Don-t-skip-callback-for-sgio-error-status.patch [RHEL-50000]
+- kvm-scsi-disk-Add-warning-comments-that-host_status-erro.patch [RHEL-50000]
+- kvm-scsi-disk-Always-report-RESERVATION_CONFLICT-to-gues.patch [RHEL-50000]
+- kvm-nbd-server-Plumb-in-new-args-to-nbd_client_add.patch [RHEL-52617]
+- kvm-nbd-server-CVE-2024-7409-Cap-default-max-connections.patch [RHEL-52617]
+- kvm-nbd-server-CVE-2024-7409-Drop-non-negotiating-client.patch [RHEL-52617]
+- kvm-nbd-server-CVE-2024-7409-Close-stray-clients-at-serv.patch [RHEL-52617]
+- Resolves: RHEL-39544
+  ([QEMU] Add support for AMD SEV-SNP to Qemu)
+- Resolves: RHEL-50336
+  (Fail to boot up the guest including vtpm and virtio-rng (max-bytes=0) devices)
+- Resolves: RHEL-50000
+  (scsi-block: Cannot setup Windows Failover Cluster, qemu crashes on assert)
+- Resolves: RHEL-52617
+  (CVE-2024-7409 qemu-kvm: Denial of Service via Improper Synchronization in QEMU NBD Server During Socket Closure [rhel-9.5])
+
+* Mon Jul 15 2024 Miroslav Rezanina <mrezanin@redhat.com> - 9.0.0-7
+- kvm-hw-virtio-Fix-the-de-initialization-of-vhost-user-de.patch [RHEL-40708]
+- kvm-hw-arm-virt-Avoid-unexpected-warning-from-Linux-gues.patch [RHEL-39936]
+- Resolves: RHEL-40708
+  ([RHEL9.5.0][virtio_fs][s390x] after hot-unplug the vhost-user-fs-ccw device, the device is failed to hot-plug again )
+- Resolves: RHEL-39936
+  (ARCH_DMA_MINALIGN smaller than CTR_EL0.CWG (128 < 256) on FUJITSU)
+
+* Thu Jul 04 2024 Miroslav Rezanina <mrezanin@redhat.com> - 9.0.0-6
+- kvm-qcow2-Don-t-open-data_file-with-BDRV_O_NO_IO.patch [RHEL-35611]
+- kvm-iotests-244-Don-t-store-data-file-with-protocol-in-i.patch [RHEL-35611]
+- kvm-iotests-270-Don-t-store-data-file-with-json-prefix-i.patch [RHEL-35611]
+- kvm-block-Parse-filenames-only-when-explicitly-requested.patch [RHEL-35611]
+- Resolves: RHEL-35611
+  (CVE-2024-4467 qemu-kvm: QEMU: 'qemu-img info' leads to host file read/write [rhel-9.5])
+
+* Tue Jun 25 2024 Miroslav Rezanina <mrezanin@redhat.com> - 9.0.0-5
+- kvm-linux-aio-add-IO_CMD_FDSYNC-command-support.patch [RHEL-42411]
+- kvm-Revert-monitor-use-aio_co_reschedule_self.patch [RHEL-34618 RHEL-38697]
+- kvm-aio-warn-about-iohandler_ctx-special-casing.patch [RHEL-34618 RHEL-38697]
+- kvm-block-crypto-create-ciphers-on-demand.patch [RHEL-36159]
+- kvm-crypto-block-drop-qcrypto_block_open-n_threads-argum.patch [RHEL-36159]
+- Resolves: RHEL-42411
+  (qemu-kvm: linux-aio: add support for IO_CMD_FDSYNC command)
+- Resolves: RHEL-34618
+  (aio=io_uring: Assertion failure `luringcb->co->ctx == s->aio_context' with block_resize)
+- Resolves: RHEL-38697
+  (aio=native: Assertion failure `laiocb->co->ctx == laiocb->ctx->aio_context' with block_resize)
+- Resolves: RHEL-36159
+  (qemu crash on Assertion `block->n_free_ciphers > 0' failed in guest installation with luks and iothread-vq-mapping)
+
+* Mon Jun 17 2024 Miroslav Rezanina <mrezanin@redhat.com> - 9.0.0-4
+- kvm-qio-Inherit-follow_coroutine_ctx-across-TLS.patch [RHEL-33440]
+- kvm-iotests-test-NBD-TLS-iothread.patch [RHEL-33440]
+- kvm-virtio-gpu-fix-v2-migration.patch [RHEL-34621]
+- kvm-rhel-9.4.0-machine-type-compat-for-virtio-gpu-migrat.patch [RHEL-34621]
+- Resolves: RHEL-33440
+  (Qemu hang when quit dst vm after storage migration(nbd+tls))
+- Resolves: RHEL-34621
+  ([RHEL9.5.0][stable_guest_abi]Failed to migrate VM with (qemu) qemu-kvm: Missing section footer for 0000:00:01.0/virtio-gpu qemu-kvm: load of migration failed: Invalid argument)
+
+* Tue May 21 2024 Miroslav Rezanina <mrezanin@redhat.com> - 9.0.0-3
+- kvm-nbd-server-do-not-poll-within-a-coroutine-context.patch [RHEL-33440]
+- kvm-nbd-server-Mark-negotiation-functions-as-coroutine_f.patch [RHEL-33440]
+- Resolves: RHEL-33440
+  (Qemu hang when quit dst vm after storage migration(nbd+tls))
+
+* Tue May 07 2024 Miroslav Rezanina <mrezanin@redhat.com> - 9.0.0-2
+- kvm-hw-arm-virt-Fix-spurious-call-to-arm_virt_compat_set.patch [RHEL-34945]
+- kvm-Revert-x86-rhel-9.4.0-machine-type-compat-fix.patch [RHEL-30362]
+- Resolves: RHEL-34945
+  ([aarch64, kvm-unit-tests] all tests tagged as FAIL [qemu-kvm: GLib: g_ptr_array_add: assertion 'rarray' failed] )
+- Resolves: RHEL-30362
+  (Check/fix machine type compatibility for QEMU 9.0.0 [x86_64][rhel-9.5.0])
+
+* Wed Apr 24 2024 Miroslav Rezanina <mrezanin@redhat.com> - 9.0.0-1
+- Rebase to QEMU 9.0.0 [RHEL-28073]
+- Resolves: RHEL-28073
+  (Rebase qemu-kvm to QEMU 9.0.0 for RHEL 9.5)
 
 * Tue Mar 26 2024 Miroslav Rezanina <mrezanin@redhat.com> - 8.2.0-11
 - kvm-coroutine-cap-per-thread-local-pool-size.patch [RHEL-28947]