diff --git a/SOURCES/kvm-block-iscsi-fix-segfault-if-writesame-fails.patch b/SOURCES/kvm-block-iscsi-fix-segfault-if-writesame-fails.patch
new file mode 100644
index 0000000..1687f01
--- /dev/null
+++ b/SOURCES/kvm-block-iscsi-fix-segfault-if-writesame-fails.patch
@@ -0,0 +1,72 @@
+From 51cb710930b200264555e47590c8a50b82588ecb Mon Sep 17 00:00:00 2001
+From: Fam Zheng <famz@redhat.com>
+Date: Fri, 4 Apr 2014 05:55:59 +0200
+Subject: [PATCH 04/12] block/iscsi: fix segfault if writesame fails
+
+RH-Author: Fam Zheng <famz@redhat.com>
+Message-id: <1396590962-25815-5-git-send-email-famz@redhat.com>
+Patchwork-id: 58341
+O-Subject: [RHEL-7 0day qemu-kvm PATCH 4/7] block/iscsi: fix segfault if writesame fails
+Bugzilla: 1090978
+RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+RH-Acked-by: Markus Armbruster <armbru@redhat.com>
+RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
+RH-Acked-by: Jeffrey Cody <jcody@redhat.com>
+
+From: Peter Lieven <pl@kamp.de>
+
+commit fa6252b0 introduced a segfault because it tries
+to read iTask.task->sense after iTask.task has been
+freed.
+
+Signed-off-by: Peter Lieven <pl@kamp.de>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit d9738fd2463f71530d8d92fbb52ebdd1d78074fc)
+Signed-off-by: Fam Zheng <famz@redhat.com>
+---
+ block/iscsi.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ block/iscsi.c | 17 +++++++++--------
+ 1 files changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/block/iscsi.c b/block/iscsi.c
+index d3c8802..4a535e3 100644
+--- a/block/iscsi.c
++++ b/block/iscsi.c
+@@ -1010,6 +1010,15 @@ retry:
+ qemu_coroutine_yield();
+ }
+
++ if (iTask.status == SCSI_STATUS_CHECK_CONDITION &&
++ iTask.task->sense.key == SCSI_SENSE_ILLEGAL_REQUEST &&
++ iTask.task->sense.ascq == SCSI_SENSE_ASCQ_INVALID_OPERATION_CODE) {
++ /* WRITE SAME is not supported by the target */
++ iscsilun->has_write_same = false;
++ scsi_free_scsi_task(iTask.task);
++ return -ENOTSUP;
++ }
++
+ if (iTask.task != NULL) {
+ scsi_free_scsi_task(iTask.task);
+ iTask.task = NULL;
+@@ -1020,14 +1029,6 @@ retry:
+ }
+
+ if (iTask.status != SCSI_STATUS_GOOD) {
+- if (iTask.status == SCSI_STATUS_CHECK_CONDITION &&
+- iTask.task->sense.key == SCSI_SENSE_ILLEGAL_REQUEST &&
+- iTask.task->sense.ascq == SCSI_SENSE_ASCQ_INVALID_OPERATION_CODE) {
+- /* WRITE SAME is not supported by the target */
+- iscsilun->has_write_same = false;
+- return -ENOTSUP;
+- }
+-
+ return -EIO;
+ }
+
+--
+1.7.1
+
diff --git a/SOURCES/kvm-block-iscsi-query-for-supported-VPD-pages.patch b/SOURCES/kvm-block-iscsi-query-for-supported-VPD-pages.patch
new file mode 100644
index 0000000..3cd8ab2
--- /dev/null
+++ b/SOURCES/kvm-block-iscsi-query-for-supported-VPD-pages.patch
@@ -0,0 +1,202 @@
+From ea065d17bd4302027839cde0b038061ccfe616a4 Mon Sep 17 00:00:00 2001
+From: Fam Zheng <famz@redhat.com>
+Date: Fri, 4 Apr 2014 05:55:58 +0200
+Subject: [PATCH 03/12] block/iscsi: query for supported VPD pages
+
+RH-Author: Fam Zheng <famz@redhat.com>
+Message-id: <1396590962-25815-4-git-send-email-famz@redhat.com>
+Patchwork-id: 58340
+O-Subject: [RHEL-7 0day qemu-kvm PATCH 3/7] block/iscsi: query for supported VPD pages
+Bugzilla: 1090978
+RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+RH-Acked-by: Markus Armbruster <armbru@redhat.com>
+RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
+RH-Acked-by: Jeffrey Cody <jcody@redhat.com>
+
+From: Peter Lieven <pl@kamp.de>
+
+this patch ensures that we only query for block provisioning and
+block limits vpd pages if they are advertised. It also cleans
+up the inquiry code and eliminates some redundant code.
+
+Signed-off-by: Peter Lieven <pl@kamp.de>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 24d3bd67aca958c8ea103646d9d326de00056e4d)
+Signed-off-by: Fam Zheng <famz@redhat.com>
+---
+ block/iscsi.c | 107 +++++++++++++++++++++++++++++-----------------------------
+ 1 file changed, 54 insertions(+), 53 deletions(-)
+
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ block/iscsi.c | 107 +++++++++++++++++++++++++++++----------------------------
+ 1 files changed, 54 insertions(+), 53 deletions(-)
+
+diff --git a/block/iscsi.c b/block/iscsi.c
+index 537d2cb..d3c8802 100644
+--- a/block/iscsi.c
++++ b/block/iscsi.c
+@@ -1240,7 +1240,7 @@ static QemuOptsList runtime_opts = {
+ };
+
+ static struct scsi_task *iscsi_do_inquiry(struct iscsi_context *iscsi, int lun,
+- int evpd, int pc, Error **errp)
++ int evpd, int pc, void **inq, Error **errp)
+ {
+ int full_size;
+ struct scsi_task *task = NULL;
+@@ -1259,14 +1259,19 @@ static struct scsi_task *iscsi_do_inquiry(struct iscsi_context *iscsi, int lun,
+ }
+ }
+
++ *inq = scsi_datain_unmarshall(task);
++ if (*inq == NULL) {
++ error_setg(errp, "iSCSI: failed to unmarshall inquiry datain blob");
++ goto fail;
++ }
++
+ return task;
+
+ fail:
+ error_setg(errp, "iSCSI: Inquiry command failed : %s",
+ iscsi_get_error(iscsi));
+- if (task) {
++ if (task != NULL) {
+ scsi_free_scsi_task(task);
+- return NULL;
+ }
+ return NULL;
+ }
+@@ -1283,11 +1288,12 @@ static int iscsi_open(BlockDriverState *bs, QDict *options, int flags,
+ struct iscsi_url *iscsi_url = NULL;
+ struct scsi_task *task = NULL;
+ struct scsi_inquiry_standard *inq = NULL;
++ struct scsi_inquiry_supported_pages *inq_vpd;
+ char *initiator_name = NULL;
+ QemuOpts *opts;
+ Error *local_err = NULL;
+ const char *filename;
+- int ret;
++ int i, ret;
+
+ if ((BDRV_SECTOR_SIZE % 512) != 0) {
+ error_setg(errp, "iSCSI: Invalid BDRV_SECTOR_SIZE. "
+@@ -1373,24 +1379,17 @@ static int iscsi_open(BlockDriverState *bs, QDict *options, int flags,
+
+ iscsilun->iscsi = iscsi;
+ iscsilun->lun = iscsi_url->lun;
++ iscsilun->has_write_same = true;
+
+- task = iscsi_inquiry_sync(iscsi, iscsilun->lun, 0, 0, 36);
+-
+- if (task == NULL || task->status != SCSI_STATUS_GOOD) {
+- error_setg(errp, "iSCSI: failed to send inquiry command.");
+- ret = -EINVAL;
+- goto out;
+- }
+-
+- inq = scsi_datain_unmarshall(task);
+- if (inq == NULL) {
+- error_setg(errp, "iSCSI: Failed to unmarshall inquiry data.");
++ task = iscsi_do_inquiry(iscsilun->iscsi, iscsilun->lun, 0, 0,
++ (void **) &inq, errp);
++ if (task == NULL) {
+ ret = -EINVAL;
+ goto out;
+ }
+-
+ iscsilun->type = inq->periperal_device_type;
+- iscsilun->has_write_same = true;
++ scsi_free_scsi_task(task);
++ task = NULL;
+
+ iscsi_readcapacity_sync(iscsilun, &local_err);
+ if (local_err != NULL) {
+@@ -1408,46 +1407,48 @@ static int iscsi_open(BlockDriverState *bs, QDict *options, int flags,
+ bs->sg = 1;
+ }
+
+- if (iscsilun->lbpme) {
+- struct scsi_inquiry_logical_block_provisioning *inq_lbp;
+- task = iscsi_do_inquiry(iscsilun->iscsi, iscsilun->lun, 1,
+- SCSI_INQUIRY_PAGECODE_LOGICAL_BLOCK_PROVISIONING,
+- errp);
+- if (task == NULL) {
+- ret = -EINVAL;
+- goto out;
+- }
+- inq_lbp = scsi_datain_unmarshall(task);
+- if (inq_lbp == NULL) {
+- error_setg(errp, "iSCSI: failed to unmarshall inquiry datain blob");
+- ret = -EINVAL;
+- goto out;
+- }
+- memcpy(&iscsilun->lbp, inq_lbp,
+- sizeof(struct scsi_inquiry_logical_block_provisioning));
+- scsi_free_scsi_task(task);
+- task = NULL;
++ task = iscsi_do_inquiry(iscsilun->iscsi, iscsilun->lun, 1,
++ SCSI_INQUIRY_PAGECODE_SUPPORTED_VPD_PAGES,
++ (void **) &inq_vpd, errp);
++ if (task == NULL) {
++ ret = -EINVAL;
++ goto out;
+ }
+-
+- if (iscsilun->lbp.lbpu || iscsilun->lbp.lbpws) {
++ for (i = 0; i < inq_vpd->num_pages; i++) {
++ struct scsi_task *inq_task;
++ struct scsi_inquiry_logical_block_provisioning *inq_lbp;
+ struct scsi_inquiry_block_limits *inq_bl;
+- task = iscsi_do_inquiry(iscsilun->iscsi, iscsilun->lun, 1,
+- SCSI_INQUIRY_PAGECODE_BLOCK_LIMITS, errp);
+- if (task == NULL) {
+- ret = -EINVAL;
+- goto out;
+- }
+- inq_bl = scsi_datain_unmarshall(task);
+- if (inq_bl == NULL) {
+- error_setg(errp, "iSCSI: failed to unmarshall inquiry datain blob");
+- ret = -EINVAL;
+- goto out;
++ switch (inq_vpd->pages[i]) {
++ case SCSI_INQUIRY_PAGECODE_LOGICAL_BLOCK_PROVISIONING:
++ inq_task = iscsi_do_inquiry(iscsilun->iscsi, iscsilun->lun, 1,
++ SCSI_INQUIRY_PAGECODE_LOGICAL_BLOCK_PROVISIONING,
++ (void **) &inq_lbp, errp);
++ if (inq_task == NULL) {
++ ret = -EINVAL;
++ goto out;
++ }
++ memcpy(&iscsilun->lbp, inq_lbp,
++ sizeof(struct scsi_inquiry_logical_block_provisioning));
++ scsi_free_scsi_task(inq_task);
++ break;
++ case SCSI_INQUIRY_PAGECODE_BLOCK_LIMITS:
++ inq_task = iscsi_do_inquiry(iscsilun->iscsi, iscsilun->lun, 1,
++ SCSI_INQUIRY_PAGECODE_BLOCK_LIMITS,
++ (void **) &inq_bl, errp);
++ if (inq_task == NULL) {
++ ret = -EINVAL;
++ goto out;
++ }
++ memcpy(&iscsilun->bl, inq_bl,
++ sizeof(struct scsi_inquiry_block_limits));
++ scsi_free_scsi_task(inq_task);
++ break;
++ default:
++ break;
+ }
+- memcpy(&iscsilun->bl, inq_bl,
+- sizeof(struct scsi_inquiry_block_limits));
+- scsi_free_scsi_task(task);
+- task = NULL;
+ }
++ scsi_free_scsi_task(task);
++ task = NULL;
+
+ #if defined(LIBISCSI_FEATURE_NOP_COUNTER)
+ /* Set up a timer for sending out iSCSI NOPs */
+--
+1.7.1
+
diff --git a/SOURCES/kvm-ide-Correct-improper-smart-self-test-counter-reset-i.patch b/SOURCES/kvm-ide-Correct-improper-smart-self-test-counter-reset-i.patch
new file mode 100644
index 0000000..f68e85c
--- /dev/null
+++ b/SOURCES/kvm-ide-Correct-improper-smart-self-test-counter-reset-i.patch
@@ -0,0 +1,65 @@
+From 547c264f28ee2fb34a0f2ef60ca880745229a41d Mon Sep 17 00:00:00 2001
+From: Markus Armbruster <armbru@redhat.com>
+Date: Fri, 25 Apr 2014 17:54:05 +0200
+Subject: [PATCH 12/12] ide: Correct improper smart self test counter reset in ide core.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Markus Armbruster <armbru@redhat.com>
+Message-id: <1398448445-17245-2-git-send-email-armbru@redhat.com>
+Patchwork-id: 58568
+O-Subject: [PATCH 7.0 qemu-kvm 1/1] ide: Correct improper smart self test counter reset in ide core.
+Bugzilla: 1093612
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Acked-by: Fam Zheng <famz@redhat.com>
+RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
+
+From: Benoît Canet <benoit.canet@irqsave.net>
+
+The SMART self test counter was incorrectly being reset to zero,
+not 1. This had the effect that on every 21st SMART EXECUTE OFFLINE:
+ * We would write off the beginning of a dynamically allocated buffer
+ * We forgot the SMART history
+Fix this.
+
+Signed-off-by: Benoit Canet <benoit@irqsave.net>
+Message-id: 1397336390-24664-1-git-send-email-benoit.canet@irqsave.net
+Reviewed-by: Markus Armbruster <armbru@redhat.com>
+Cc: qemu-stable@nongnu.org
+Acked-by: Kevin Wolf <kwolf@redhat.com>
+[PMM: tweaked commit message as per suggestions from Markus]
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+(cherry picked from commit 940973ae0b45c9b6817bab8e4cf4df99a9ef83d7)
+
+Conflicts:
+ hw/ide/core.c
+
+CVE-2014-2894
+Signed-off-by: Markus Armbruster <armbru@redhat.com>
+---
+ hw/ide/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ hw/ide/core.c | 2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/hw/ide/core.c b/hw/ide/core.c
+index c172c71..0313250 100644
+--- a/hw/ide/core.c
++++ b/hw/ide/core.c
+@@ -1617,7 +1617,7 @@ void ide_exec_cmd(IDEBus *bus, uint32_t val)
+ case 2: /* extended self test */
+ s->smart_selftest_count++;
+ if(s->smart_selftest_count > 21)
+- s->smart_selftest_count = 0;
++ s->smart_selftest_count = 1;
+ n = 2 + (s->smart_selftest_count - 1) * 24;
+ s->smart_selftest_data[n] = s->sector;
+ s->smart_selftest_data[n+1] = 0x00; /* OK and finished */
+--
+1.7.1
+
diff --git a/SOURCES/kvm-iscsi-Don-t-set-error-if-already-set-in-iscsi_do_inq.patch b/SOURCES/kvm-iscsi-Don-t-set-error-if-already-set-in-iscsi_do_inq.patch
new file mode 100644
index 0000000..9d99b36
--- /dev/null
+++ b/SOURCES/kvm-iscsi-Don-t-set-error-if-already-set-in-iscsi_do_inq.patch
@@ -0,0 +1,53 @@
+From 157bc246bfb0a67c65e1cca823f8ec60d071ff97 Mon Sep 17 00:00:00 2001
+From: Fam Zheng <famz@redhat.com>
+Date: Sun, 6 Apr 2014 01:10:17 +0200
+Subject: [PATCH 08/12] iscsi: Don't set error if already set in iscsi_do_inquiry
+
+RH-Author: Fam Zheng <famz@redhat.com>
+Message-id: <1396746617-11978-1-git-send-email-famz@redhat.com>
+Patchwork-id: 58350
+O-Subject: [RHEL-7 0day qemu-kvm PATCH 8/7] iscsi: Don't set error if already set in iscsi_do_inquiry
+Bugzilla: 1090978
+RH-Acked-by: Markus Armbruster <armbru@redhat.com>
+RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
+RH-Acked-by: Jeffrey Cody <jcody@redhat.com>
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1083413
+Brew: http://brewweb.devel.redhat.com/brew/taskinfo?taskID=7308220
+
+This eliminates the possible assertion failure in error_setg().
+
+Signed-off-by: Fam Zheng <famz@redhat.com>
+Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit cbee81f6de57ddc1b21ba28f01f6a3b5d87428a5)
+Signed-off-by: Fam Zheng <famz@redhat.com>
+---
+ block/iscsi.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ block/iscsi.c | 6 ++++--
+ 1 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/block/iscsi.c b/block/iscsi.c
+index 78ab91e..ff5ca20 100644
+--- a/block/iscsi.c
++++ b/block/iscsi.c
+@@ -1280,8 +1280,10 @@ static struct scsi_task *iscsi_do_inquiry(struct iscsi_context *iscsi, int lun,
+ return task;
+
+ fail:
+- error_setg(errp, "iSCSI: Inquiry command failed : %s",
+- iscsi_get_error(iscsi));
++ if (!error_is_set(errp)) {
++ error_setg(errp, "iSCSI: Inquiry command failed : %s",
++ iscsi_get_error(iscsi));
++ }
+ if (task != NULL) {
+ scsi_free_scsi_task(task);
+ }
+--
+1.7.1
+
diff --git a/SOURCES/kvm-iscsi-Remember-to-set-ret-for-iscsi_open-in-error-ca.patch b/SOURCES/kvm-iscsi-Remember-to-set-ret-for-iscsi_open-in-error-ca.patch
new file mode 100644
index 0000000..9406012
--- /dev/null
+++ b/SOURCES/kvm-iscsi-Remember-to-set-ret-for-iscsi_open-in-error-ca.patch
@@ -0,0 +1,42 @@
+From 3fdabff07bad6541ad6da731b23362a594433694 Mon Sep 17 00:00:00 2001
+From: Fam Zheng <famz@redhat.com>
+Date: Mon, 14 Apr 2014 02:05:19 +0200
+Subject: [PATCH 09/12] iscsi: Remember to set ret for iscsi_open in error case
+
+RH-Author: Fam Zheng <famz@redhat.com>
+Message-id: <1397441119-8563-1-git-send-email-famz@redhat.com>
+Patchwork-id: 58457
+O-Subject: [RHEL-7 0day qemu-kvm PATCH 9/7] iscsi: Remember to set ret for iscsi_open in error case
+Bugzilla: 1090978
+RH-Acked-by: Markus Armbruster <armbru@redhat.com>
+RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
+RH-Acked-by: Jeffrey Cody <jcody@redhat.com>
+
+Signed-off-by: Fam Zheng <famz@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit cd82b6fb4daf87f17742f7971ba6cb90d23e6703)
+Signed-off-by: Fam Zheng <famz@redhat.com>
+---
+ block/iscsi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ block/iscsi.c | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/block/iscsi.c b/block/iscsi.c
+index ff5ca20..9fe3be8 100644
+--- a/block/iscsi.c
++++ b/block/iscsi.c
+@@ -1408,6 +1408,7 @@ static int iscsi_open(BlockDriverState *bs, QDict *options, int flags,
+ iscsi_readcapacity_sync(iscsilun, &local_err);
+ if (local_err != NULL) {
+ error_propagate(errp, local_err);
++ ret = -EINVAL;
+ goto out;
+ }
+ bs->total_sectors = sector_lun2qemu(iscsilun->num_blocks, iscsilun);
+--
+1.7.1
+
diff --git a/SOURCES/kvm-iscsi-always-query-max-WRITE-SAME-length.patch b/SOURCES/kvm-iscsi-always-query-max-WRITE-SAME-length.patch
new file mode 100644
index 0000000..55fa9b6
--- /dev/null
+++ b/SOURCES/kvm-iscsi-always-query-max-WRITE-SAME-length.patch
@@ -0,0 +1,70 @@
+From 0be3bd54babffebdc68e274a926ccecb77b2537c Mon Sep 17 00:00:00 2001
+From: Fam Zheng <famz@redhat.com>
+Date: Fri, 4 Apr 2014 05:56:02 +0200
+Subject: [PATCH 07/12] iscsi: always query max WRITE SAME length
+
+RH-Author: Fam Zheng <famz@redhat.com>
+Message-id: <1396590962-25815-8-git-send-email-famz@redhat.com>
+Patchwork-id: 58344
+O-Subject: [RHEL-7 0day qemu-kvm PATCH 7/7] iscsi: always query max WRITE SAME length
+Bugzilla: 1090978
+RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+RH-Acked-by: Markus Armbruster <armbru@redhat.com>
+RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
+RH-Acked-by: Jeffrey Cody <jcody@redhat.com>
+
+From: Paolo Bonzini <pbonzini@redhat.com>
+
+Max WRITE SAME length is also used when the UNMAP bit is zero, so it
+should be queried even if LBPWS=0. Same for the optimal transfer
+length.
+
+However, the write_zeroes_alignment only matters for UNMAP=1 so we
+still restrict it to LBPWS=1.
+
+Reviewed-by: Peter Lieven <pl@kamp.de>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit c97ca29db0a68deb281a901f535cec5ea4862244)
+Signed-off-by: Fam Zheng <famz@redhat.com>
+---
+ block/iscsi.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ block/iscsi.c | 12 +++++++-----
+ 1 files changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/block/iscsi.c b/block/iscsi.c
+index b80ebd3..78ab91e 100644
+--- a/block/iscsi.c
++++ b/block/iscsi.c
+@@ -1510,18 +1510,20 @@ static int iscsi_refresh_limits(BlockDriverState *bs)
+
+ /* We don't actually refresh here, but just return data queried in
+ * iscsi_open(): iscsi targets don't change their limits. */
+- if (iscsilun->lbp.lbpu || iscsilun->lbp.lbpws) {
++ if (iscsilun->lbp.lbpu) {
+ if (iscsilun->bl.max_unmap < 0xffffffff) {
+ bs->bl.max_discard = sector_lun2qemu(iscsilun->bl.max_unmap,
+ iscsilun);
+ }
+ bs->bl.discard_alignment = sector_lun2qemu(iscsilun->bl.opt_unmap_gran,
+ iscsilun);
++ }
+
+- if (iscsilun->bl.max_ws_len < 0xffffffff) {
+- bs->bl.max_write_zeroes = sector_lun2qemu(iscsilun->bl.max_ws_len,
+- iscsilun);
+- }
++ if (iscsilun->bl.max_ws_len < 0xffffffff) {
++ bs->bl.max_write_zeroes = sector_lun2qemu(iscsilun->bl.max_ws_len,
++ iscsilun);
++ }
++ if (iscsilun->lbp.lbpws) {
+ bs->bl.write_zeroes_alignment = sector_lun2qemu(iscsilun->bl.opt_unmap_gran,
+ iscsilun);
+
+--
+1.7.1
+
diff --git a/SOURCES/kvm-iscsi-correctly-propagate-errors-in-iscsi_open.patch b/SOURCES/kvm-iscsi-correctly-propagate-errors-in-iscsi_open.patch
new file mode 100644
index 0000000..334615a
--- /dev/null
+++ b/SOURCES/kvm-iscsi-correctly-propagate-errors-in-iscsi_open.patch
@@ -0,0 +1,377 @@
+From 3e977cc45393793cfaa17ed471e85953a9bab35a Mon Sep 17 00:00:00 2001
+From: Fam Zheng <famz@redhat.com>
+Date: Fri, 4 Apr 2014 05:55:57 +0200
+Subject: [PATCH 02/12] iscsi: correctly propagate errors in iscsi_open
+
+RH-Author: Fam Zheng <famz@redhat.com>
+Message-id: <1396590962-25815-3-git-send-email-famz@redhat.com>
+Patchwork-id: 58339
+O-Subject: [RHEL-7 0day qemu-kvm PATCH 2/7] iscsi: correctly propagate errors in iscsi_open
+Bugzilla: 1090978
+RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+RH-Acked-by: Markus Armbruster <armbru@redhat.com>
+RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
+RH-Acked-by: Jeffrey Cody <jcody@redhat.com>
+
+From: Paolo Bonzini <pbonzini@redhat.com>
+
+Before:
+ $ ./qemu-io-old
+ qemu-io-old> open -r -o file.driver=iscsi,file.filename=foo
+ Failed to parse URL : foo
+ qemu-io-old: can't open device (null): Could not open 'foo': Invalid argument
+
+After:
+ $ ./qemu-io
+ qemu-io> open -r -o file.driver=iscsi,file.filename=foo
+ qemu-io: can't open device (null): Failed to parse URL : foo
+
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Reviewed-by: Fam Zheng <famz@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit f2917853f715b0ef55df29eb2ffea29dc69ce814)
+Signed-off-by: Fam Zheng <famz@redhat.com>
+
+Conflicts:
+ block/iscsi.c
+ Because 84d18f065fb041a1c0d78d20320d740ae0673c8a (Use
+ error_is_set() only when necessary) is not backpored, which
+ converted "if (error_is_set(&local_err))" to "if (local_err)".
+
+Signed-off-by: Fam Zheng <famz@redhat.com>
+---
+ block/iscsi.c | 105 ++++++++++++++++++++++++++++++----------------------------
+ 1 file changed, 54 insertions(+), 51 deletions(-)
+
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ block/iscsi.c | 105 +++++++++++++++++++++++++++++---------------------------
+ 1 files changed, 54 insertions(+), 51 deletions(-)
+
+diff --git a/block/iscsi.c b/block/iscsi.c
+index 082956c..537d2cb 100644
+--- a/block/iscsi.c
++++ b/block/iscsi.c
+@@ -1036,7 +1036,8 @@ retry:
+
+ #endif /* SCSI_SENSE_ASCQ_CAPACITY_DATA_HAS_CHANGED */
+
+-static int parse_chap(struct iscsi_context *iscsi, const char *target)
++static void parse_chap(struct iscsi_context *iscsi, const char *target,
++ Error **errp)
+ {
+ QemuOptsList *list;
+ QemuOpts *opts;
+@@ -1045,37 +1046,35 @@ static int parse_chap(struct iscsi_context *iscsi, const char *target)
+
+ list = qemu_find_opts("iscsi");
+ if (!list) {
+- return 0;
++ return;
+ }
+
+ opts = qemu_opts_find(list, target);
+ if (opts == NULL) {
+ opts = QTAILQ_FIRST(&list->head);
+ if (!opts) {
+- return 0;
++ return;
+ }
+ }
+
+ user = qemu_opt_get(opts, "user");
+ if (!user) {
+- return 0;
++ return;
+ }
+
+ password = qemu_opt_get(opts, "password");
+ if (!password) {
+- error_report("CHAP username specified but no password was given");
+- return -1;
++ error_setg(errp, "CHAP username specified but no password was given");
++ return;
+ }
+
+ if (iscsi_set_initiator_username_pwd(iscsi, user, password)) {
+- error_report("Failed to set initiator username and password");
+- return -1;
++ error_setg(errp, "Failed to set initiator username and password");
+ }
+-
+- return 0;
+ }
+
+-static void parse_header_digest(struct iscsi_context *iscsi, const char *target)
++static void parse_header_digest(struct iscsi_context *iscsi, const char *target,
++ Error **errp)
+ {
+ QemuOptsList *list;
+ QemuOpts *opts;
+@@ -1108,7 +1107,7 @@ static void parse_header_digest(struct iscsi_context *iscsi, const char *target)
+ } else if (!strcmp(digest, "NONE-CRC32C")) {
+ iscsi_set_header_digest(iscsi, ISCSI_HEADER_DIGEST_NONE_CRC32C);
+ } else {
+- error_report("Invalid header-digest setting : %s", digest);
++ error_setg(errp, "Invalid header-digest setting : %s", digest);
+ }
+ }
+
+@@ -1166,12 +1165,11 @@ static void iscsi_nop_timed_event(void *opaque)
+ }
+ #endif
+
+-static int iscsi_readcapacity_sync(IscsiLun *iscsilun)
++static void iscsi_readcapacity_sync(IscsiLun *iscsilun, Error **errp)
+ {
+ struct scsi_task *task = NULL;
+ struct scsi_readcapacity10 *rc10 = NULL;
+ struct scsi_readcapacity16 *rc16 = NULL;
+- int ret = 0;
+ int retries = ISCSI_CMD_RETRIES;
+
+ do {
+@@ -1186,8 +1184,7 @@ static int iscsi_readcapacity_sync(IscsiLun *iscsilun)
+ if (task != NULL && task->status == SCSI_STATUS_GOOD) {
+ rc16 = scsi_datain_unmarshall(task);
+ if (rc16 == NULL) {
+- error_report("iSCSI: Failed to unmarshall readcapacity16 data.");
+- ret = -EINVAL;
++ error_setg(errp, "iSCSI: Failed to unmarshall readcapacity16 data.");
+ } else {
+ iscsilun->block_size = rc16->block_length;
+ iscsilun->num_blocks = rc16->returned_lba + 1;
+@@ -1201,8 +1198,7 @@ static int iscsi_readcapacity_sync(IscsiLun *iscsilun)
+ if (task != NULL && task->status == SCSI_STATUS_GOOD) {
+ rc10 = scsi_datain_unmarshall(task);
+ if (rc10 == NULL) {
+- error_report("iSCSI: Failed to unmarshall readcapacity10 data.");
+- ret = -EINVAL;
++ error_setg(errp, "iSCSI: Failed to unmarshall readcapacity10 data.");
+ } else {
+ iscsilun->block_size = rc10->block_size;
+ if (rc10->lba == 0) {
+@@ -1215,20 +1211,18 @@ static int iscsi_readcapacity_sync(IscsiLun *iscsilun)
+ }
+ break;
+ default:
+- return 0;
++ return;
+ }
+ } while (task != NULL && task->status == SCSI_STATUS_CHECK_CONDITION
+ && task->sense.key == SCSI_SENSE_UNIT_ATTENTION
+ && retries-- > 0);
+
+ if (task == NULL || task->status != SCSI_STATUS_GOOD) {
+- error_report("iSCSI: failed to send readcapacity10 command.");
+- ret = -EINVAL;
++ error_setg(errp, "iSCSI: failed to send readcapacity10 command.");
+ }
+ if (task) {
+ scsi_free_scsi_task(task);
+ }
+- return ret;
+ }
+
+ /* TODO Convert to fine grained options */
+@@ -1246,7 +1240,7 @@ static QemuOptsList runtime_opts = {
+ };
+
+ static struct scsi_task *iscsi_do_inquiry(struct iscsi_context *iscsi, int lun,
+- int evpd, int pc)
++ int evpd, int pc, Error **errp)
+ {
+ int full_size;
+ struct scsi_task *task = NULL;
+@@ -1268,8 +1262,8 @@ static struct scsi_task *iscsi_do_inquiry(struct iscsi_context *iscsi, int lun,
+ return task;
+
+ fail:
+- error_report("iSCSI: Inquiry command failed : %s",
+- iscsi_get_error(iscsi));
++ error_setg(errp, "iSCSI: Inquiry command failed : %s",
++ iscsi_get_error(iscsi));
+ if (task) {
+ scsi_free_scsi_task(task);
+ return NULL;
+@@ -1296,27 +1290,25 @@ static int iscsi_open(BlockDriverState *bs, QDict *options, int flags,
+ int ret;
+
+ if ((BDRV_SECTOR_SIZE % 512) != 0) {
+- error_report("iSCSI: Invalid BDRV_SECTOR_SIZE. "
+- "BDRV_SECTOR_SIZE(%lld) is not a multiple "
+- "of 512", BDRV_SECTOR_SIZE);
++ error_setg(errp, "iSCSI: Invalid BDRV_SECTOR_SIZE. "
++ "BDRV_SECTOR_SIZE(%lld) is not a multiple "
++ "of 512", BDRV_SECTOR_SIZE);
+ return -EINVAL;
+ }
+
+ opts = qemu_opts_create_nofail(&runtime_opts);
+ qemu_opts_absorb_qdict(opts, options, &local_err);
+- if (error_is_set(&local_err)) {
+- qerror_report_err(local_err);
+- error_free(local_err);
++ if (local_err) {
++ error_propagate(errp, local_err);
+ ret = -EINVAL;
+ goto out;
+ }
+
+ filename = qemu_opt_get(opts, "filename");
+
+-
+ iscsi_url = iscsi_parse_full_url(iscsi, filename);
+ if (iscsi_url == NULL) {
+- error_report("Failed to parse URL : %s", filename);
++ error_setg(errp, "Failed to parse URL : %s", filename);
+ ret = -EINVAL;
+ goto out;
+ }
+@@ -1327,13 +1319,13 @@ static int iscsi_open(BlockDriverState *bs, QDict *options, int flags,
+
+ iscsi = iscsi_create_context(initiator_name);
+ if (iscsi == NULL) {
+- error_report("iSCSI: Failed to create iSCSI context.");
++ error_setg(errp, "iSCSI: Failed to create iSCSI context.");
+ ret = -ENOMEM;
+ goto out;
+ }
+
+ if (iscsi_set_targetname(iscsi, iscsi_url->target)) {
+- error_report("iSCSI: Failed to set target name.");
++ error_setg(errp, "iSCSI: Failed to set target name.");
+ ret = -EINVAL;
+ goto out;
+ }
+@@ -1342,21 +1334,22 @@ static int iscsi_open(BlockDriverState *bs, QDict *options, int flags,
+ ret = iscsi_set_initiator_username_pwd(iscsi, iscsi_url->user,
+ iscsi_url->passwd);
+ if (ret != 0) {
+- error_report("Failed to set initiator username and password");
++ error_setg(errp, "Failed to set initiator username and password");
+ ret = -EINVAL;
+ goto out;
+ }
+ }
+
+ /* check if we got CHAP username/password via the options */
+- if (parse_chap(iscsi, iscsi_url->target) != 0) {
+- error_report("iSCSI: Failed to set CHAP user/password");
++ parse_chap(iscsi, iscsi_url->target, &local_err);
++ if (local_err != NULL) {
++ error_propagate(errp, local_err);
+ ret = -EINVAL;
+ goto out;
+ }
+
+ if (iscsi_set_session_type(iscsi, ISCSI_SESSION_NORMAL) != 0) {
+- error_report("iSCSI: Failed to set session type to normal.");
++ error_setg(errp, "iSCSI: Failed to set session type to normal.");
+ ret = -EINVAL;
+ goto out;
+ }
+@@ -1364,10 +1357,15 @@ static int iscsi_open(BlockDriverState *bs, QDict *options, int flags,
+ iscsi_set_header_digest(iscsi, ISCSI_HEADER_DIGEST_NONE_CRC32C);
+
+ /* check if we got HEADER_DIGEST via the options */
+- parse_header_digest(iscsi, iscsi_url->target);
++ parse_header_digest(iscsi, iscsi_url->target, &local_err);
++ if (local_err != NULL) {
++ error_propagate(errp, local_err);
++ ret = -EINVAL;
++ goto out;
++ }
+
+ if (iscsi_full_connect_sync(iscsi, iscsi_url->portal, iscsi_url->lun) != 0) {
+- error_report("iSCSI: Failed to connect to LUN : %s",
++ error_setg(errp, "iSCSI: Failed to connect to LUN : %s",
+ iscsi_get_error(iscsi));
+ ret = -EINVAL;
+ goto out;
+@@ -1379,14 +1377,14 @@ static int iscsi_open(BlockDriverState *bs, QDict *options, int flags,
+ task = iscsi_inquiry_sync(iscsi, iscsilun->lun, 0, 0, 36);
+
+ if (task == NULL || task->status != SCSI_STATUS_GOOD) {
+- error_report("iSCSI: failed to send inquiry command.");
++ error_setg(errp, "iSCSI: failed to send inquiry command.");
+ ret = -EINVAL;
+ goto out;
+ }
+
+ inq = scsi_datain_unmarshall(task);
+ if (inq == NULL) {
+- error_report("iSCSI: Failed to unmarshall inquiry data.");
++ error_setg(errp, "iSCSI: Failed to unmarshall inquiry data.");
+ ret = -EINVAL;
+ goto out;
+ }
+@@ -1394,7 +1392,9 @@ static int iscsi_open(BlockDriverState *bs, QDict *options, int flags,
+ iscsilun->type = inq->periperal_device_type;
+ iscsilun->has_write_same = true;
+
+- if ((ret = iscsi_readcapacity_sync(iscsilun)) != 0) {
++ iscsi_readcapacity_sync(iscsilun, &local_err);
++ if (local_err != NULL) {
++ error_propagate(errp, local_err);
+ goto out;
+ }
+ bs->total_sectors = sector_lun2qemu(iscsilun->num_blocks, iscsilun);
+@@ -1411,14 +1411,15 @@ static int iscsi_open(BlockDriverState *bs, QDict *options, int flags,
+ if (iscsilun->lbpme) {
+ struct scsi_inquiry_logical_block_provisioning *inq_lbp;
+ task = iscsi_do_inquiry(iscsilun->iscsi, iscsilun->lun, 1,
+- SCSI_INQUIRY_PAGECODE_LOGICAL_BLOCK_PROVISIONING);
++ SCSI_INQUIRY_PAGECODE_LOGICAL_BLOCK_PROVISIONING,
++ errp);
+ if (task == NULL) {
+ ret = -EINVAL;
+ goto out;
+ }
+ inq_lbp = scsi_datain_unmarshall(task);
+ if (inq_lbp == NULL) {
+- error_report("iSCSI: failed to unmarshall inquiry datain blob");
++ error_setg(errp, "iSCSI: failed to unmarshall inquiry datain blob");
+ ret = -EINVAL;
+ goto out;
+ }
+@@ -1431,14 +1432,14 @@ static int iscsi_open(BlockDriverState *bs, QDict *options, int flags,
+ if (iscsilun->lbp.lbpu || iscsilun->lbp.lbpws) {
+ struct scsi_inquiry_block_limits *inq_bl;
+ task = iscsi_do_inquiry(iscsilun->iscsi, iscsilun->lun, 1,
+- SCSI_INQUIRY_PAGECODE_BLOCK_LIMITS);
++ SCSI_INQUIRY_PAGECODE_BLOCK_LIMITS, errp);
+ if (task == NULL) {
+ ret = -EINVAL;
+ goto out;
+ }
+ inq_bl = scsi_datain_unmarshall(task);
+ if (inq_bl == NULL) {
+- error_report("iSCSI: failed to unmarshall inquiry datain blob");
++ error_setg(errp, "iSCSI: failed to unmarshall inquiry datain blob");
+ ret = -EINVAL;
+ goto out;
+ }
+@@ -1529,14 +1530,16 @@ static int iscsi_reopen_prepare(BDRVReopenState *state,
+ static int iscsi_truncate(BlockDriverState *bs, int64_t offset)
+ {
+ IscsiLun *iscsilun = bs->opaque;
+- int ret = 0;
++ Error *local_err = NULL;
+
+ if (iscsilun->type != TYPE_DISK) {
+ return -ENOTSUP;
+ }
+
+- if ((ret = iscsi_readcapacity_sync(iscsilun)) != 0) {
+- return ret;
++ iscsi_readcapacity_sync(iscsilun, &local_err);
++ if (local_err != NULL) {
++ error_free(local_err);
++ return -EIO;
+ }
+
+ if (offset > iscsi_getlength(bs)) {
+--
+1.7.1
+
diff --git a/SOURCES/kvm-iscsi-fix-indentation.patch b/SOURCES/kvm-iscsi-fix-indentation.patch
new file mode 100644
index 0000000..ac91a1d
--- /dev/null
+++ b/SOURCES/kvm-iscsi-fix-indentation.patch
@@ -0,0 +1,97 @@
+From aa310a9247019b3858150e48f41900105e6541cd Mon Sep 17 00:00:00 2001
+From: Fam Zheng <famz@redhat.com>
+Date: Fri, 4 Apr 2014 05:55:56 +0200
+Subject: [PATCH 01/12] iscsi: fix indentation
+
+RH-Author: Fam Zheng <famz@redhat.com>
+Message-id: <1396590962-25815-2-git-send-email-famz@redhat.com>
+Patchwork-id: 58338
+O-Subject: [RHEL-7 0day qemu-kvm PATCH 1/7] iscsi: fix indentation
+Bugzilla: 1090978
+RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+RH-Acked-by: Markus Armbruster <armbru@redhat.com>
+RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
+RH-Acked-by: Jeffrey Cody <jcody@redhat.com>
+
+From: Paolo Bonzini <pbonzini@redhat.com>
+
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Reviewed-by: Fam Zheng <famz@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit 35cb1748d54c8e56881a5e10138b3eb090f3a6bc)
+Signed-off-by: Fam Zheng <famz@redhat.com>
+---
+ block/iscsi.c | 45 +++++++++++++++++++++++----------------------
+ 1 file changed, 23 insertions(+), 22 deletions(-)
+
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ block/iscsi.c | 45 +++++++++++++++++++++++----------------------
+ 1 files changed, 23 insertions(+), 22 deletions(-)
+
+diff --git a/block/iscsi.c b/block/iscsi.c
+index 64a8295..082956c 100644
+--- a/block/iscsi.c
++++ b/block/iscsi.c
+@@ -1245,35 +1245,36 @@ static QemuOptsList runtime_opts = {
+ },
+ };
+
+-static struct scsi_task *iscsi_do_inquiry(struct iscsi_context *iscsi,
+- int lun, int evpd, int pc) {
+- int full_size;
+- struct scsi_task *task = NULL;
+- task = iscsi_inquiry_sync(iscsi, lun, evpd, pc, 64);
++static struct scsi_task *iscsi_do_inquiry(struct iscsi_context *iscsi, int lun,
++ int evpd, int pc)
++{
++ int full_size;
++ struct scsi_task *task = NULL;
++ task = iscsi_inquiry_sync(iscsi, lun, evpd, pc, 64);
++ if (task == NULL || task->status != SCSI_STATUS_GOOD) {
++ goto fail;
++ }
++ full_size = scsi_datain_getfullsize(task);
++ if (full_size > task->datain.size) {
++ scsi_free_scsi_task(task);
++
++ /* we need more data for the full list */
++ task = iscsi_inquiry_sync(iscsi, lun, evpd, pc, full_size);
+ if (task == NULL || task->status != SCSI_STATUS_GOOD) {
+ goto fail;
+ }
+- full_size = scsi_datain_getfullsize(task);
+- if (full_size > task->datain.size) {
+- scsi_free_scsi_task(task);
+-
+- /* we need more data for the full list */
+- task = iscsi_inquiry_sync(iscsi, lun, evpd, pc, full_size);
+- if (task == NULL || task->status != SCSI_STATUS_GOOD) {
+- goto fail;
+- }
+- }
++ }
+
+- return task;
++ return task;
+
+ fail:
+- error_report("iSCSI: Inquiry command failed : %s",
+- iscsi_get_error(iscsi));
+- if (task) {
+- scsi_free_scsi_task(task);
+- return NULL;
+- }
++ error_report("iSCSI: Inquiry command failed : %s",
++ iscsi_get_error(iscsi));
++ if (task) {
++ scsi_free_scsi_task(task);
+ return NULL;
++ }
++ return NULL;
+ }
+
+ /*
+--
+1.7.1
+
diff --git a/SOURCES/kvm-iscsi-ignore-flushes-on-scsi-generic-devices.patch b/SOURCES/kvm-iscsi-ignore-flushes-on-scsi-generic-devices.patch
new file mode 100644
index 0000000..31815ac
--- /dev/null
+++ b/SOURCES/kvm-iscsi-ignore-flushes-on-scsi-generic-devices.patch
@@ -0,0 +1,70 @@
+From 90f24ff57d4861c6143176cba17e51f3a9bd7d50 Mon Sep 17 00:00:00 2001
+From: Fam Zheng <famz@redhat.com>
+Date: Mon, 14 Apr 2014 09:59:22 +0200
+Subject: [PATCH 06/12] iscsi: ignore flushes on scsi-generic devices
+
+RH-Author: Fam Zheng <famz@redhat.com>
+Message-id: <1397469562-5050-1-git-send-email-famz@redhat.com>
+Patchwork-id: 58458
+O-Subject: [RHEL-7 0day qemu-kvm PATCH v2 6/7] iscsi: ignore flushes on scsi-generic devices
+Bugzilla: 1090978
+RH-Acked-by: Markus Armbruster <armbru@redhat.com>
+RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
+RH-Acked-by: Jeffrey Cody <jcody@redhat.com>
+
+From: Paolo Bonzini <pbonzini@redhat.com>
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1083413
+Brew: http://brewweb.devel.redhat.com/brew/taskinfo?taskID=7342452
+
+Non-block SCSI devices do not support flushing, but we may still send
+them requests via bdrv_flush_all. Just ignore them.
+
+Reviewed-by: Peter Lieven <pl@kamp.de>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit b2f9c08a4f11f16ec101e95feab8e71d7cfcfee9)
+Signed-off-by: Fam Zheng <famz@redhat.com>
+
+Conflicts:
+ block/iscsi.c
+ Because upstream iscsi driver is converted to coroutine while
+ downstream is aio. So the bdrv_flush code is different.
+
+---
+v2: Schedule BH instead of returning NULL (which is interpreted as error
+for AIO). (Thanks Kevin)
+
+Signed-off-by: Fam Zheng <famz@redhat.com>
+---
+ block/iscsi.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ block/iscsi.c | 10 ++++++++++
+ 1 files changed, 10 insertions(+), 0 deletions(-)
+
+diff --git a/block/iscsi.c b/block/iscsi.c
+index 268da2f..b80ebd3 100644
+--- a/block/iscsi.c
++++ b/block/iscsi.c
+@@ -617,6 +617,16 @@ iscsi_aio_flush(BlockDriverState *bs,
+ acb->iscsilun = iscsilun;
+ acb->retries = ISCSI_CMD_RETRIES;
+
++ if (bs->sg) {
++ acb->canceled = 0;
++ acb->status = 0;
++ acb->bh = NULL;
++ acb->buf = NULL;
++ acb->task = NULL;
++ iscsi_schedule_bh(acb);
++ return &acb->common;
++ }
++
+ if (iscsi_aio_flush_acb(acb) != 0) {
+ qemu_aio_release(acb);
+ return NULL;
+--
+1.7.1
+
diff --git a/SOURCES/kvm-iscsi-recognize-invalid-field-ASCQ-from-WRITE-SAME-c.patch b/SOURCES/kvm-iscsi-recognize-invalid-field-ASCQ-from-WRITE-SAME-c.patch
new file mode 100644
index 0000000..d399e11
--- /dev/null
+++ b/SOURCES/kvm-iscsi-recognize-invalid-field-ASCQ-from-WRITE-SAME-c.patch
@@ -0,0 +1,51 @@
+From 70ccfb3676918e20a2c83774d0242ad98b1f2f93 Mon Sep 17 00:00:00 2001
+From: Fam Zheng <famz@redhat.com>
+Date: Fri, 4 Apr 2014 05:56:00 +0200
+Subject: [PATCH 05/12] iscsi: recognize "invalid field" ASCQ from WRITE SAME command
+
+RH-Author: Fam Zheng <famz@redhat.com>
+Message-id: <1396590962-25815-6-git-send-email-famz@redhat.com>
+Patchwork-id: 58342
+O-Subject: [RHEL-7 0day qemu-kvm PATCH 5/7] iscsi: recognize "invalid field" ASCQ from WRITE SAME command
+Bugzilla: 1090978
+RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+RH-Acked-by: Markus Armbruster <armbru@redhat.com>
+RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
+RH-Acked-by: Jeffrey Cody <jcody@redhat.com>
+
+From: Paolo Bonzini <pbonzini@redhat.com>
+
+Some targets may return "invalid field" as the ASCQ from WRITE SAME
+if they support the command only without the UNMAP field. Recognize
+that, and return ENOTSUP just like for "invalid operation code".
+
+Reviewed-by: Peter Lieven <pl@kamp.de>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 27898a5daa4c6d28adb32b401a011d7198494482)
+Signed-off-by: Fam Zheng <famz@redhat.com>
+---
+ block/iscsi.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ block/iscsi.c | 3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/block/iscsi.c b/block/iscsi.c
+index 4a535e3..268da2f 100644
+--- a/block/iscsi.c
++++ b/block/iscsi.c
+@@ -1012,7 +1012,8 @@ retry:
+
+ if (iTask.status == SCSI_STATUS_CHECK_CONDITION &&
+ iTask.task->sense.key == SCSI_SENSE_ILLEGAL_REQUEST &&
+- iTask.task->sense.ascq == SCSI_SENSE_ASCQ_INVALID_OPERATION_CODE) {
++ (iTask.task->sense.ascq == SCSI_SENSE_ASCQ_INVALID_OPERATION_CODE ||
++ iTask.task->sense.ascq == SCSI_SENSE_ASCQ_INVALID_FIELD_IN_CDB)) {
+ /* WRITE SAME is not supported by the target */
+ iscsilun->has_write_same = false;
+ scsi_free_scsi_task(iTask.task);
+--
+1.7.1
+
diff --git a/SOURCES/kvm-pc-add-hot_add_cpu-callback-to-all-machine-types.patch b/SOURCES/kvm-pc-add-hot_add_cpu-callback-to-all-machine-types.patch
new file mode 100644
index 0000000..8c811f4
--- /dev/null
+++ b/SOURCES/kvm-pc-add-hot_add_cpu-callback-to-all-machine-types.patch
@@ -0,0 +1,92 @@
+From baa1f0d306b387ce7b05d1eea51034d86b1a203d Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Mon, 5 May 2014 20:27:12 +0200
+Subject: [PATCH] pc: add hot_add_cpu callback to all machine types
+
+RH-Author: Paolo Bonzini <pbonzini@redhat.com>
+Message-id: <1399321632-26203-1-git-send-email-pbonzini@redhat.com>
+Patchwork-id: 58691
+O-Subject: [RHEL 7.0.z qemu-kvm PATCH] pc: add hot_add_cpu callback to all machine types
+Bugzilla: 1094820
+RH-Acked-by: Markus Armbruster <armbru@redhat.com>
+RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+
+Upstream status: N/A
+
+Brew build: 7416220
+
+Due to the lack of the callback, RHEL6-compatible machine types
+failed CPU hotplug with a "not supported" error message.
+
+However CPU hotplug is supported in RHEL6, albeit with a different
+monitor command that we had inherited from qemu-kvm, and for all machine
+types. So, add it to all machine types in RHEL7 too.
+
+Tested locally with a RHEL6.5 guest and -Mrhel6.5.0.
+
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ hw/i386/pc_piix.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ hw/i386/pc_piix.c | 6 ++++++
+ 1 files changed, 6 insertions(+), 0 deletions(-)
+
+diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
+index 67d51da..aeec6f2 100644
+--- a/hw/i386/pc_piix.c
++++ b/hw/i386/pc_piix.c
+@@ -968,6 +968,7 @@ static QEMUMachine pc_machine_rhel650 = {
+ .name = "rhel6.5.0",
+ .desc = "RHEL 6.5.0 PC",
+ .init = pc_init_rhel650,
++ .hot_add_cpu = pc_hot_add_cpu,
+ .max_cpus = 255,
+ .compat_props = (GlobalProperty[]) {
+ PC_RHEL6_5_COMPAT,
+@@ -1016,6 +1017,7 @@ static QEMUMachine pc_machine_rhel640 = {
+ .name = "rhel6.4.0",
+ .desc = "RHEL 6.4.0 PC",
+ .init = pc_init_rhel640,
++ .hot_add_cpu = pc_hot_add_cpu,
+ .max_cpus = 255,
+ .compat_props = (GlobalProperty[]) {
+ PC_RHEL6_4_COMPAT,
+@@ -1091,6 +1093,7 @@ static QEMUMachine pc_machine_rhel630 = {
+ .name = "rhel6.3.0",
+ .desc = "RHEL 6.3.0 PC",
+ .init = pc_init_rhel630,
++ .hot_add_cpu = pc_hot_add_cpu,
+ .max_cpus = 255,
+ .compat_props = (GlobalProperty[]) {
+ PC_RHEL6_3_COMPAT,
+@@ -1122,6 +1125,7 @@ static QEMUMachine pc_machine_rhel620 = {
+ .name = "rhel6.2.0",
+ .desc = "RHEL 6.2.0 PC",
+ .init = pc_init_rhel620,
++ .hot_add_cpu = pc_hot_add_cpu,
+ .max_cpus = 255,
+ .compat_props = (GlobalProperty[]) {
+ PC_RHEL6_2_COMPAT,
+@@ -1194,6 +1198,7 @@ static QEMUMachine pc_machine_rhel610 = {
+ .name = "rhel6.1.0",
+ .desc = "RHEL 6.1.0 PC",
+ .init = pc_init_rhel610,
++ .hot_add_cpu = pc_hot_add_cpu,
+ .max_cpus = 255,
+ .compat_props = (GlobalProperty[]) {
+ PC_RHEL6_1_COMPAT,
+@@ -1233,6 +1238,7 @@ static QEMUMachine pc_machine_rhel600 = {
+ .name = "rhel6.0.0",
+ .desc = "RHEL 6.0.0 PC",
+ .init = pc_init_rhel600,
++ .hot_add_cpu = pc_hot_add_cpu,
+ .max_cpus = 255,
+ .compat_props = (GlobalProperty[]) {
+ PC_RHEL6_0_COMPAT,
+--
+1.7.1
+
diff --git a/SOURCES/kvm-qemu_loadvm_state-shadow-SeaBIOS-for-VM-incoming-fro.patch b/SOURCES/kvm-qemu_loadvm_state-shadow-SeaBIOS-for-VM-incoming-fro.patch
new file mode 100644
index 0000000..03e5027
--- /dev/null
+++ b/SOURCES/kvm-qemu_loadvm_state-shadow-SeaBIOS-for-VM-incoming-fro.patch
@@ -0,0 +1,167 @@
+From df9e9e9c56c7fbf0ea54a342591c5427b508a7bf Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Thu, 17 Apr 2014 11:13:59 +0200
+Subject: [PATCH 10/12] qemu_loadvm_state(): shadow SeaBIOS for VM incoming from RHEL-6 host
+
+RH-Author: Laszlo Ersek <lersek@redhat.com>
+Message-id: <1397733239-8835-1-git-send-email-lersek@redhat.com>
+Patchwork-id: 58498
+O-Subject: [RHEL-7.0 0day qemu-kvm PATCH v2] qemu_loadvm_state(): shadow SeaBIOS for VM incoming from RHEL-6 host
+Bugzilla: 1090978
+RH-Acked-by: Dr. David Alan Gilbert (git) <dgilbert@redhat.com>
+RH-Acked-by: Marcel Apfelbaum <marcel.a@redhat.com>
+RH-Acked-by: Eduardo Habkost <ehabkost@redhat.com>
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1027565
+Brew: https://brewweb.devel.redhat.com/taskinfo?taskID=7352678
+
+RHEL-only patch.
+
+SeaBIOS's shadowing logic has no effect on "pc.ram" (only on "pc.bios" and
+"pc.rom") when it runs on the RHEL-6 emulator. When such a guest is
+migrated to the RHEL-7 emulator, where the PAM registers actually work,
+these two UMBs under 1MB simply disappear from the guest's view, breaking
+reboot and S3 resume.
+
+Tested extensively by QE.
+
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+---
+
+Notes:
+ Changes in v2:
+ - print message to stderr when we shadow the UMBs manually [Dave]
+ - also copy C and D segments from pc.rom to pc.ram
+ - move to qemu_loadvm_state() from ram_load() -- we must shadow only
+ when all RAMBlocks have been loaded [Dave]
+
+ include/sysemu/sysemu.h | 1 +
+ hw/i386/pc_piix.c | 1 +
+ savevm.c | 66 +++++++++++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 68 insertions(+)
+
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ hw/i386/pc_piix.c | 1 +
+ include/sysemu/sysemu.h | 1 +
+ savevm.c | 66 +++++++++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 68 insertions(+), 0 deletions(-)
+
+diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
+index 940816f..fea98b6 100644
+--- a/hw/i386/pc_piix.c
++++ b/hw/i386/pc_piix.c
+@@ -954,6 +954,7 @@ static void pc_compat_rhel650(QEMUMachineInitArgs *args)
+ rom_file_has_mr = false;
+ has_acpi_build = false;
+ gigabyte_align = false;
++ shadow_bios_after_incoming = true;
+ }
+
+ static void pc_init_rhel650(QEMUMachineInitArgs *args)
+diff --git a/include/sysemu/sysemu.h b/include/sysemu/sysemu.h
+index 8dc0a4c..07181ac 100644
+--- a/include/sysemu/sysemu.h
++++ b/include/sysemu/sysemu.h
+@@ -84,6 +84,7 @@ void qemu_savevm_state_complete(QEMUFile *f);
+ void qemu_savevm_state_cancel(void);
+ uint64_t qemu_savevm_state_pending(QEMUFile *f, uint64_t max_size);
+ int qemu_loadvm_state(QEMUFile *f);
++extern bool shadow_bios_after_incoming;
+
+ /* SLIRP */
+ void do_info_slirp(Monitor *mon);
+diff --git a/savevm.c b/savevm.c
+index 4d92a7b..6efbb75 100644
+--- a/savevm.c
++++ b/savevm.c
+@@ -52,6 +52,8 @@
+ #define ARP_PTYPE_IP 0x0800
+ #define ARP_OP_REQUEST_REV 0x3
+
++bool shadow_bios_after_incoming;
++
+ static int announce_self_create(uint8_t *buf,
+ uint8_t *mac_addr)
+ {
+@@ -2195,6 +2197,63 @@ typedef struct LoadStateEntry {
+ int version_id;
+ } LoadStateEntry;
+
++static void shadow_bios(void)
++{
++ RAMBlock *block, *ram, *oprom, *bios;
++ size_t one_meg, oprom_size, bios_size;
++ uint8_t *cd_seg_host, *ef_seg_host;
++
++ ram = NULL;
++ oprom = NULL;
++ bios = NULL;
++ QTAILQ_FOREACH(block, &ram_list.blocks, next) {
++ if (strcmp("pc.ram", block->idstr) == 0) {
++ assert(ram == NULL);
++ ram = block;
++ } else if (strcmp("pc.rom", block->idstr) == 0) {
++ assert(oprom == NULL);
++ oprom = block;
++ } else if (strcmp("pc.bios", block->idstr) == 0) {
++ assert(bios == NULL);
++ bios = block;
++ }
++ }
++ assert(ram != NULL);
++ assert(oprom != NULL);
++ assert(bios != NULL);
++ assert(memory_region_is_ram(ram->mr));
++ assert(memory_region_is_ram(oprom->mr));
++ assert(memory_region_is_ram(bios->mr));
++ assert(int128_eq(ram->mr->size, int128_make64(ram->length)));
++ assert(int128_eq(oprom->mr->size, int128_make64(oprom->length)));
++ assert(int128_eq(bios->mr->size, int128_make64(bios->length)));
++
++ one_meg = 1024 * 1024;
++ oprom_size = 128 * 1024;
++ bios_size = 128 * 1024;
++ assert(ram->length >= one_meg);
++ assert(oprom->length == oprom_size);
++ assert(bios->length == bios_size);
++
++ ef_seg_host = memory_region_get_ram_ptr(ram->mr) + (one_meg - bios_size);
++ cd_seg_host = ef_seg_host - oprom_size;
++
++ /* This is a crude hack, but we must distinguish a rhel6.x.0 machtype guest
++ * coming in from a RHEL-6 emulator (where shadowing has had no effect on
++ * "pc.ram") from a similar guest coming in from a RHEL-7 emulator (where
++ * shadowing has worked). In the latter case we must not trample the live
++ * SeaBIOS variables in "pc.ram".
++ */
++ if (buffer_is_zero(ef_seg_host, bios_size)) {
++ fprintf(stderr, "copying E and F segments from pc.bios to pc.ram\n");
++ memcpy(ef_seg_host, memory_region_get_ram_ptr(bios->mr), bios_size);
++ }
++ if (buffer_is_zero(cd_seg_host, oprom_size)) {
++ fprintf(stderr, "copying C and D segments from pc.rom to pc.ram\n");
++ memcpy(cd_seg_host, memory_region_get_ram_ptr(oprom->mr), oprom_size);
++ }
++}
++
+ int qemu_loadvm_state(QEMUFile *f)
+ {
+ QLIST_HEAD(, LoadStateEntry) loadvm_handlers =
+@@ -2297,6 +2356,13 @@ int qemu_loadvm_state(QEMUFile *f)
+ }
+ }
+
++ /* Supplement SeaBIOS's shadowing now, because it was useless when the
++ * incoming VM started on the RHEL-6 emulator.
++ */
++ if (shadow_bios_after_incoming) {
++ shadow_bios();
++ }
++
+ cpu_synchronize_all_post_init();
+
+ ret = 0;
+--
+1.7.1
+
diff --git a/SOURCES/kvm-uhci-UNfix-irq-routing-for-RHEL-6-machtypes-RHEL-onl.patch b/SOURCES/kvm-uhci-UNfix-irq-routing-for-RHEL-6-machtypes-RHEL-onl.patch
new file mode 100644
index 0000000..ccbd383
--- /dev/null
+++ b/SOURCES/kvm-uhci-UNfix-irq-routing-for-RHEL-6-machtypes-RHEL-onl.patch
@@ -0,0 +1,177 @@
+From 48addb5b5b3b4712744e2ba9c3205b981f898118 Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Thu, 24 Apr 2014 10:57:23 +0200
+Subject: [PATCH 11/12] uhci: UNfix irq routing for RHEL-6 machtypes (RHEL only)
+
+RH-Author: Laszlo Ersek <lersek@redhat.com>
+Message-id: <1398337043-4967-1-git-send-email-lersek@redhat.com>
+Patchwork-id: 58540
+O-Subject: [RHEL-7.0 0day qemu-kvm PATCH] uhci: UNfix irq routing for RHEL-6 machtypes (RHEL only)
+Bugzilla: 1085701
+RH-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
+RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
+RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1085701
+Brew: https://brewweb.devel.redhat.com/taskinfo?taskID=7368968
+
+Tested by myself and QE.
+
+(Note that the bulk of the work related to this issue happened in bug
+1027565 comments 64 to 74, because QE was experiencing it with the other
+(original) issue reported in bug 1027565. Only later did I realize that
+bug 1085701 already existed for this specific problem.)
+
+Refer to the following upstream commit, present in v1.2.0 and RHEL-7:
+
+ commit 973002c11460efd3c17fe61a76711a103e30e1f9
+ Author: Gerd Hoffmann <kraxel@redhat.com>
+ Date: Fri May 25 12:53:47 2012 +0200
+
+ uhci: fix irq routing
+
+ The multifunction ich9 ehci controller with uhci companions uses a
+ different interrupt pin for each function. The three uhci devices
+ get pins A, B and C, whereas ehci uses pin D. This way the guest
+ can assign different IRQ lines to each controller.
+
+ Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+
+This is a performance optimization so that IRQ sharing can be avoided in
+the guest.
+
+Contrarily, the RHEL-6 emulator exclusively assigns pin D to each of the
+three devices (see "hw/usb-uhci.c" there):
+- usb_uhci_ich9_1_initfn()
+- usb_uhci_ich9_2_initfn()
+- usb_uhci_ich9_3_initfn()
+
+These init functions call usb_uhci_common_initfn(), which in turn assigns:
+
+ pci_conf[0x3d] = 4; // interrupt pin 3
+
+This mismatch breaks migration for rhel6.x.0 machine types from the
+RHEL-6.5 emulator to the RHEL-7.0 one.
+
+For example, considering the uhci1 controller, the guest kernel, started
+on the RHEL-6.5 source host, will see pin D advertised, and (according to
+the PCI interrupt routing table provided by SeaBIOS) will route it to IRQ
+11:
+
+ dmesg:
+
+ uhci_hcd 0000:00:11.0: PCI INT D -> Link[LNKD] -> GSI 11 (level, high)
+ -> IRQ 11
+
+ /proc/interrupts:
+
+ 10: ... IO-APIC-fasteoi virtio0
+ 11: ... IO-APIC-fasteoi uhci_hcd:usb1
+
+When the same guest kernel, using the same rhel6.5.0 machine type, is
+started fresh on the RHEL-7.0 target host, pin A is advertised instead
+(and routed to a different IRQ, based on the same table from SeaBIOS):
+
+ dmesg:
+
+ uhci_hcd 0000:00:11.0: PCI INT A -> Link[LNKA] -> GSI 10 (level, high)
+ -> IRQ 10
+
+ /proc/interrupts:
+
+ 10: ... IO-APIC-fasteoi uhci_hcd:usb1, virtio0
+
+This is no problem as long as we don't migrate.
+
+When we migrate the rhel6.x.0 machtype guest from the RHEL-6.5 host to the
+RHEL-7.0 host, the guest kernel (having booted on the source host) will
+expect the interrupts for the UHCI device on pin D / IRQ 11. However, the
+target host will inject the interrupts on pin A / IRQ 10. No handler in
+the guest kernel will claim such IRQ 10 instances (examples are: HDA or
+virtio-balloon), hence IRQ 10 will be disabled.
+
+We can fix this in at least two ways:
+(1) Drop the persistent "UHCIState.irq_pin" field, and simply use the pin
+ identifier that is stored in (already migrated) PCI config space (at
+ offset 0x3d).
+(2) Introduce yet another RHEL-6 compatibility knob that selects pin D for
+ all three ICH9-UHCI controllers.
+
+Since PCI config space could be write-accessible to the guest, plus it
+could originate from an untrusted migration source as well, and we'd use
+the setting as a subscript into the s->dev.irq[] array in
+uhci_update_irq(), it seems safer to go with (2).
+
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+---
+ include/hw/usb.h | 4 ++++
+ hw/i386/pc_piix.c | 1 +
+ hw/usb/hcd-uhci.c | 13 ++++++++++++-
+ 3 files changed, 17 insertions(+), 1 deletion(-)
+
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ hw/i386/pc_piix.c | 1 +
+ hw/usb/hcd-uhci.c | 13 ++++++++++++-
+ include/hw/usb.h | 4 ++++
+ 3 files changed, 17 insertions(+), 1 deletions(-)
+
+diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
+index fea98b6..67d51da 100644
+--- a/hw/i386/pc_piix.c
++++ b/hw/i386/pc_piix.c
+@@ -955,6 +955,7 @@ static void pc_compat_rhel650(QEMUMachineInitArgs *args)
+ has_acpi_build = false;
+ gigabyte_align = false;
+ shadow_bios_after_incoming = true;
++ ich9_uhci123_irqpin_override = true;
+ }
+
+ static void pc_init_rhel650(QEMUMachineInitArgs *args)
+diff --git a/hw/usb/hcd-uhci.c b/hw/usb/hcd-uhci.c
+index 4fc3410..3380107 100644
+--- a/hw/usb/hcd-uhci.c
++++ b/hw/usb/hcd-uhci.c
+@@ -187,6 +187,8 @@ typedef struct UHCI_QH {
+ uint32_t el_link;
+ } UHCI_QH;
+
++bool ich9_uhci123_irqpin_override;
++
+ static void uhci_async_cancel(UHCIAsync *async);
+ static void uhci_queue_fill(UHCIQueue *q, UHCI_TD *td);
+
+@@ -1232,7 +1234,16 @@ static int usb_uhci_common_initfn(PCIDevice *dev)
+ /* TODO: reset value should be 0. */
+ pci_conf[USB_SBRN] = USB_RELEASE_1; // release number
+
+- s->irq_pin = u->info.irq_pin;
++ if (ich9_uhci123_irqpin_override &&
++ u->info.vendor_id == PCI_VENDOR_ID_INTEL &&
++ (u->info.device_id == PCI_DEVICE_ID_INTEL_82801I_UHCI1 ||
++ u->info.device_id == PCI_DEVICE_ID_INTEL_82801I_UHCI2 ||
++ u->info.device_id == PCI_DEVICE_ID_INTEL_82801I_UHCI3)) {
++ fprintf(stderr, "RHEL-6 compat: %s: irq_pin = 3\n", u->info.name);
++ s->irq_pin = 3;
++ } else {
++ s->irq_pin = u->info.irq_pin;
++ }
+ pci_config_set_interrupt_pin(pci_conf, s->irq_pin + 1);
+
+ if (s->masterbus) {
+diff --git a/include/hw/usb.h b/include/hw/usb.h
+index b111be0..5668701 100644
+--- a/include/hw/usb.h
++++ b/include/hw/usb.h
+@@ -578,4 +578,8 @@ int usb_get_quirks(uint16_t vendor_id, uint16_t product_id,
+ uint8_t interface_class, uint8_t interface_subclass,
+ uint8_t interface_protocol);
+
++
++/* hcd-uhci.c -- RHEL-6 machine type compatibility */
++extern bool ich9_uhci123_irqpin_override;
++
+ #endif
+--
+1.7.1
+
diff --git a/SPECS/qemu-kvm.spec b/SPECS/qemu-kvm.spec
index 1b063d7..310a600 100644
--- a/SPECS/qemu-kvm.spec
+++ b/SPECS/qemu-kvm.spec
@@ -24,7 +24,6 @@
%ifnarch x86_64
%global build_only_sub 1
- %global debug_package %{nil}
%endif
%ifarch %{ix86}
@@ -74,7 +73,7 @@ Obsoletes: %1 < %{obsoletes_version} \
Summary: QEMU is a FAST! processor emulator
Name: %{pkgname}%{?pkgsuffix}
Version: 1.5.3
-Release: 60%{?dist}
+Release: 60%{?dist}_0.2
# Epoch because we pushed a qemu-1.0 package. AIUI this can't ever be dropped
Epoch: 10
License: GPLv2+ and LGPLv2+ and BSD
@@ -2203,6 +2202,32 @@ Patch1076: kvm-fix-machine-check-propagation.patch
Patch1077: kvm-qcow2-fix-dangling-refcount-table-entry.patch
# For bz#1081393 - qemu-img will prompt that 'leaked clusters were found' while creating images with '-o preallocation=metadata,cluster_size<=1024'
Patch1078: kvm-qcow2-link-all-L2-meta-updates-in-preallocate.patch
+# For bz#1090978 - qemu-kvm: iSCSI: Failure. SENSE KEY:ILLEGAL_REQUEST(5) ASCQ:INVALID_FIELD_IN_CDB(0x2400)
+Patch1079: kvm-iscsi-fix-indentation.patch
+# For bz#1090978 - qemu-kvm: iSCSI: Failure. SENSE KEY:ILLEGAL_REQUEST(5) ASCQ:INVALID_FIELD_IN_CDB(0x2400)
+Patch1080: kvm-iscsi-correctly-propagate-errors-in-iscsi_open.patch
+# For bz#1090978 - qemu-kvm: iSCSI: Failure. SENSE KEY:ILLEGAL_REQUEST(5) ASCQ:INVALID_FIELD_IN_CDB(0x2400)
+Patch1081: kvm-block-iscsi-query-for-supported-VPD-pages.patch
+# For bz#1090978 - qemu-kvm: iSCSI: Failure. SENSE KEY:ILLEGAL_REQUEST(5) ASCQ:INVALID_FIELD_IN_CDB(0x2400)
+Patch1082: kvm-block-iscsi-fix-segfault-if-writesame-fails.patch
+# For bz#1090978 - qemu-kvm: iSCSI: Failure. SENSE KEY:ILLEGAL_REQUEST(5) ASCQ:INVALID_FIELD_IN_CDB(0x2400)
+Patch1083: kvm-iscsi-recognize-invalid-field-ASCQ-from-WRITE-SAME-c.patch
+# For bz#1090978 - qemu-kvm: iSCSI: Failure. SENSE KEY:ILLEGAL_REQUEST(5) ASCQ:INVALID_FIELD_IN_CDB(0x2400)
+Patch1084: kvm-iscsi-ignore-flushes-on-scsi-generic-devices.patch
+# For bz#1090978 - qemu-kvm: iSCSI: Failure. SENSE KEY:ILLEGAL_REQUEST(5) ASCQ:INVALID_FIELD_IN_CDB(0x2400)
+Patch1085: kvm-iscsi-always-query-max-WRITE-SAME-length.patch
+# For bz#1090978 - qemu-kvm: iSCSI: Failure. SENSE KEY:ILLEGAL_REQUEST(5) ASCQ:INVALID_FIELD_IN_CDB(0x2400)
+Patch1086: kvm-iscsi-Don-t-set-error-if-already-set-in-iscsi_do_inq.patch
+# For bz#1090978 - qemu-kvm: iSCSI: Failure. SENSE KEY:ILLEGAL_REQUEST(5) ASCQ:INVALID_FIELD_IN_CDB(0x2400)
+Patch1087: kvm-iscsi-Remember-to-set-ret-for-iscsi_open-in-error-ca.patch
+# For bz#1091322 - fail to reboot guest after migration from RHEL6.5 host to RHEL7.0 host
+Patch1088: kvm-qemu_loadvm_state-shadow-SeaBIOS-for-VM-incoming-fro.patch
+# For bz#1090981 - Guest hits call trace migrate from RHEL6.5 to RHEL7.0 host with -M 6.1 & balloon & uhci device
+Patch1089: kvm-uhci-UNfix-irq-routing-for-RHEL-6-machtypes-RHEL-onl.patch
+# For bz#1093612 - CVE-2014-2894 qemu-kvm: QEMU: out of bounds buffer accesses, guest triggerable via IDE SMART [rhel-7.0.z]
+Patch1090: kvm-ide-Correct-improper-smart-self-test-counter-reset-i.patch
+# For bz#1094820 - Hot plug CPU not working with RHEL6 machine types running on RHEL7 host.
+Patch1091: kvm-pc-add-hot_add_cpu-callback-to-all-machine-types.patch
BuildRequires: zlib-devel
@@ -3483,6 +3508,19 @@ cp %{SOURCE18} pc-bios # keep "make check" happy
%patch1076 -p1
%patch1077 -p1
%patch1078 -p1
+%patch1079 -p1
+%patch1080 -p1
+%patch1081 -p1
+%patch1082 -p1
+%patch1083 -p1
+%patch1084 -p1
+%patch1085 -p1
+%patch1086 -p1
+%patch1087 -p1
+%patch1088 -p1
+%patch1089 -p1
+%patch1090 -p1
+%patch1091 -p1
%build
buildarch="%{kvm_target}-softmmu"
@@ -3899,6 +3937,33 @@ sh %{_sysconfdir}/sysconfig/modules/kvm.modules &> /dev/null || :
%{_libdir}/pkgconfig/libcacard.pc
%changelog
+* Wed May 07 2014 Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-60.el7_0.2
+- kvm-pc-add-hot_add_cpu-callback-to-all-machine-types.patch [bz#1094820]
+- Resolves: bz#1094820
+ (Hot plug CPU not working with RHEL6 machine types running on RHEL7 host.)
+
+* Fri May 02 2014 Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-60.el7_0.1
+- kvm-iscsi-fix-indentation.patch [bz#1090978]
+- kvm-iscsi-correctly-propagate-errors-in-iscsi_open.patch [bz#1090978]
+- kvm-block-iscsi-query-for-supported-VPD-pages.patch [bz#1090978]
+- kvm-block-iscsi-fix-segfault-if-writesame-fails.patch [bz#1090978]
+- kvm-iscsi-recognize-invalid-field-ASCQ-from-WRITE-SAME-c.patch [bz#1090978]
+- kvm-iscsi-ignore-flushes-on-scsi-generic-devices.patch [bz#1090978]
+- kvm-iscsi-always-query-max-WRITE-SAME-length.patch [bz#1090978]
+- kvm-iscsi-Don-t-set-error-if-already-set-in-iscsi_do_inq.patch [bz#1090978]
+- kvm-iscsi-Remember-to-set-ret-for-iscsi_open-in-error-ca.patch [bz#1090978]
+- kvm-qemu_loadvm_state-shadow-SeaBIOS-for-VM-incoming-fro.patch [1091322]
+- kvm-uhci-UNfix-irq-routing-for-RHEL-6-machtypes-RHEL-onl.patch [bz#1090981]
+- kvm-ide-Correct-improper-smart-self-test-counter-reset-i.patch [bz#1093612]
+- Resolves: bz#1091322
+ (fail to reboot guest after migration from RHEL6.5 host to RHEL7.0 host)
+- Resolves: bz#1090981
+ (Guest hits call trace migrate from RHEL6.5 to RHEL7.0 host with -M 6.1 & balloon & uhci device)
+- Resolves: bz#1090978
+ (qemu-kvm: iSCSI: Failure. SENSE KEY:ILLEGAL_REQUEST(5) ASCQ:INVALID_FIELD_IN_CDB(0x2400))
+- Resolves: bz#1093612
+ (CVE-2014-2894 qemu-kvm: QEMU: out of bounds buffer accesses, guest triggerable via IDE SMART [rhel-7.0.z])
+
* Wed Apr 02 2014 Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-60.el7
- kvm-qcow2-fix-dangling-refcount-table-entry.patch [bz#1081793]
- kvm-qcow2-link-all-L2-meta-updates-in-preallocate.patch [bz#1081393]