diff --git a/.gitignore b/.gitignore
index eb8fb8c..fa2b595 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1 @@
-SOURCES/seabios-1.15.0.tar.gz
+SOURCES/seabios-1.16.0.tar.gz
diff --git a/.seabios.metadata b/.seabios.metadata
index 7e522e1..41a6710 100644
--- a/.seabios.metadata
+++ b/.seabios.metadata
@@ -1 +1 @@
-1ab1ca5971e59d8d6b5c579b242d586e54a86873 SOURCES/seabios-1.15.0.tar.gz
+0cc6b21cfbafa1f9f158c9aca1ab9f5174ebede2 SOURCES/seabios-1.16.0.tar.gz
diff --git a/SOURCES/0001-Workaround-for-a-win8.1-32-S4-resume-bug.patch b/SOURCES/0001-Workaround-for-a-win8.1-32-S4-resume-bug.patch
new file mode 100644
index 0000000..3d26289
--- /dev/null
+++ b/SOURCES/0001-Workaround-for-a-win8.1-32-S4-resume-bug.patch
@@ -0,0 +1,67 @@
+From 11b98cdd8d3f07f3b57fa7b4f531b52a4c1018f7 Mon Sep 17 00:00:00 2001
+From: Radim Krcmar <rkrcmar@redhat.com>
+Date: Mon, 10 Mar 2014 15:14:27 +0100
+Subject: Workaround for a win8.1-32 S4 resume bug
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Radim Krcmar <rkrcmar@redhat.com>
+Message-id: <1394464467-23560-1-git-send-email-rkrcmar@redhat.com>
+Patchwork-id: 58069
+O-Subject: [RHEL7.0 seabios PATCH] Workaround for a win8.1-32 S4 resume bug
+Bugzilla: 1050775
+RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+RH-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+
+bug: https://bugzilla.redhat.com/show_bug.cgi?id=1050775
+brew: http://brewweb.devel.redhat.com/brew/taskinfo?taskID=7176174
+This patch has no upstream equivalent.
+
+When a 32 bit version of windows 8.1 resumes from suspend, it writes 1
+into 0x72 in the early boot because it didn't expect a NULL pointer.
+0x72 is lower offset byte of 0x1c interrupt entry, so we jump into a
+middle of other function if this interrupt is triggered.
+
+Because 0x1c is only triggered from our handle_08, we detect if our
+default value (function that does only iret) has its lower offset byte
+overwritten and skip it in that case.
+(Windows never sets own callback there, so we always detect this bug
+ correctly, as seabios doesn't use it either
+ Other sources shouldn't incorrectly overwrite it or use seabios code,
+ but it is quite ok even if the guest did this on purpose.)
+
+The reason Windows uses NULL pointer is still unknown, but this bug is
+blocking WHQL certification, so we have to work around it in 7.0.
+
+Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
+
+(cherry picked from commit 10883a49e78ba83e3667e4386b8f11b4aa18ddb2)
+Signed-off-by: Paweł Poławski <ppolawsk@redhat.com>
+---
+ src/clock.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/src/clock.c b/src/clock.c
+index e44e1120..298a7229 100644
+--- a/src/clock.c
++++ b/src/clock.c
+@@ -309,7 +309,13 @@ handle_08(void)
+ struct bregs br;
+ memset(&br, 0, sizeof(br));
+ br.flags = F_IF;
+- call16_int(0x1c, &br);
++ struct segoff_s isr1c = GET_IVT(0x1c);
++ // hardcoded address of entry_iret_official with lower segment byte
++ // overwritten by 1
++ if (isr1c.seg == ((SEG_BIOS & ~0xff) | 0x1) && isr1c.offset == 0xff53)
++ dprintf(1, "Worked around win8.1-32 S4 resume bug\n");
++ else
++ call16_int(0x1c, &br);
+
+ pic_eoi1();
+ }
+--
+2.31.1
+
diff --git a/SOURCES/0002-Workaround-for-a-win8.1-32-S4-resume-bug.patch b/SOURCES/0002-Workaround-for-a-win8.1-32-S4-resume-bug.patch
deleted file mode 100644
index 58bf56c..0000000
--- a/SOURCES/0002-Workaround-for-a-win8.1-32-S4-resume-bug.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-From 10883a49e78ba83e3667e4386b8f11b4aa18ddb2 Mon Sep 17 00:00:00 2001
-From: Radim Krcmar <rkrcmar@redhat.com>
-Date: Mon, 10 Mar 2014 15:14:27 +0100
-Subject: Workaround for a win8.1-32 S4 resume bug
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-RH-Author: Radim Krcmar <rkrcmar@redhat.com>
-Message-id: <1394464467-23560-1-git-send-email-rkrcmar@redhat.com>
-Patchwork-id: 58069
-O-Subject: [RHEL7.0 seabios PATCH] Workaround for a win8.1-32 S4 resume bug
-Bugzilla: 1050775
-RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
-RH-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
-RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
-
-bug: https://bugzilla.redhat.com/show_bug.cgi?id=1050775
-brew: http://brewweb.devel.redhat.com/brew/taskinfo?taskID=7176174
-This patch has no upstream equivalent.
-
-When a 32 bit version of windows 8.1 resumes from suspend, it writes 1
-into 0x72 in the early boot because it didn't expect a NULL pointer.
-0x72 is lower offset byte of 0x1c interrupt entry, so we jump into a
-middle of other function if this interrupt is triggered.
-
-Because 0x1c is only triggered from our handle_08, we detect if our
-default value (function that does only iret) has its lower offset byte
-overwritten and skip it in that case.
-(Windows never sets own callback there, so we always detect this bug
- correctly, as seabios doesn't use it either
- Other sources shouldn't incorrectly overwrite it or use seabios code,
- but it is quite ok even if the guest did this on purpose.)
-
-The reason Windows uses NULL pointer is still unknown, but this bug is
-blocking WHQL certification, so we have to work around it in 7.0.
-
-Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
----
- src/clock.c | 8 +++++++-
- 1 file changed, 7 insertions(+), 1 deletion(-)
-
-diff --git a/src/clock.c b/src/clock.c
-index e44e1120..298a7229 100644
---- a/src/clock.c
-+++ b/src/clock.c
-@@ -309,7 +309,13 @@ handle_08(void)
- struct bregs br;
- memset(&br, 0, sizeof(br));
- br.flags = F_IF;
-- call16_int(0x1c, &br);
-+ struct segoff_s isr1c = GET_IVT(0x1c);
-+ // hardcoded address of entry_iret_official with lower segment byte
-+ // overwritten by 1
-+ if (isr1c.seg == ((SEG_BIOS & ~0xff) | 0x1) && isr1c.offset == 0xff53)
-+ dprintf(1, "Worked around win8.1-32 S4 resume bug\n");
-+ else
-+ call16_int(0x1c, &br);
-
- pic_eoi1();
- }
---
-2.27.0
-
diff --git a/SOURCES/0003-pci-let-firmware-reserve-IO-for-pcie-pci-bridge.patch b/SOURCES/0003-pci-let-firmware-reserve-IO-for-pcie-pci-bridge.patch
deleted file mode 100644
index f5862f2..0000000
--- a/SOURCES/0003-pci-let-firmware-reserve-IO-for-pcie-pci-bridge.patch
+++ /dev/null
@@ -1,90 +0,0 @@
-From 87689162d5203522a8e089bb0e46302a07c77301 Mon Sep 17 00:00:00 2001
-From: Igor Mammedov <imammedo@redhat.com>
-Date: Mon, 29 Nov 2021 06:48:12 -0500
-Subject: pci: let firmware reserve IO for pcie-pci-bridge
-
-RH-Bugzilla: 2001732
-
-With [1] patch hotplug of rtl8139 succeeds, with caveat that it
-fails to initialize IO bar, which is caused by [2] that makes
-firmware skip IO reservation for any PCIe device, which isn't
-correct in case of pcie-pci-bridge.
-Fix it by exposing hotplug type and making IO resource optional
-only if PCIe hotplug is in use.
-
-[1]
- "pci: reserve resources for pcie-pci-bridge to fix regressed hotplug on q35"
-[2]
-
-Fixes: 76327b9f32a ("fw/pci: do not automatically allocate IO region for PCIe bridges")
-Signed-off-by: Igor Mammedov imammedo@redhat.com
-CC: mapfelba@redhat.com
-CC: kraxel@redhat.com
-CC: mst@redhat.com
-CC: lvivier@redhat.com
-CC: jusual@redhat.com
-Tested-by: Laurent Vivier <lvivier@redhat.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Message-Id: <20211129114812.231849-3-imammedo@redhat.com>
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
----
- src/fw/pciinit.c | 19 ++++++++++++++-----
- 1 file changed, 14 insertions(+), 5 deletions(-)
-
-diff --git a/src/fw/pciinit.c b/src/fw/pciinit.c
-index d25931bb..3c99d514 100644
---- a/src/fw/pciinit.c
-+++ b/src/fw/pciinit.c
-@@ -793,7 +793,13 @@ pci_region_create_entry(struct pci_bus *bus, struct pci_device *dev,
- return entry;
- }
-
--static int pci_bus_hotplug_support(struct pci_bus *bus, u8 pcie_cap)
-+typedef enum hotplug_type_t {
-+ HOTPLUG_NO_SUPPORTED = 0,
-+ HOTPLUG_PCIE,
-+ HOTPLUG_SHPC
-+} hotplug_type_t;
-+
-+static hotplug_type_t pci_bus_hotplug_support(struct pci_bus *bus, u8 pcie_cap)
- {
- u8 shpc_cap;
-
-@@ -815,11 +821,12 @@ static int pci_bus_hotplug_support(struct pci_bus *bus, u8 pcie_cap)
- */
- u16 slot_implemented = pcie_flags & PCI_EXP_FLAGS_SLOT;
-
-- return downstream_port && slot_implemented;
-+ return downstream_port && slot_implemented ?
-+ HOTPLUG_PCIE : HOTPLUG_NO_SUPPORTED;
- }
-
- shpc_cap = pci_find_capability(bus->bus_dev->bdf, PCI_CAP_ID_SHPC, 0);
-- return !!shpc_cap;
-+ return !!shpc_cap ? HOTPLUG_SHPC : HOTPLUG_NO_SUPPORTED;
- }
-
- /* Test whether bridge support forwarding of transactions
-@@ -904,7 +911,7 @@ static int pci_bios_check_devices(struct pci_bus *busses)
- u8 pcie_cap = pci_find_capability(bdf, PCI_CAP_ID_EXP, 0);
- u8 qemu_cap = pci_find_resource_reserve_capability(bdf);
-
-- int hotplug_support = pci_bus_hotplug_support(s, pcie_cap);
-+ hotplug_type_t hotplug_support = pci_bus_hotplug_support(s, pcie_cap);
- for (type = 0; type < PCI_REGION_TYPE_COUNT; type++) {
- u64 align = (type == PCI_REGION_TYPE_IO) ?
- PCI_BRIDGE_IO_MIN : PCI_BRIDGE_MEM_MIN;
-@@ -948,7 +955,9 @@ static int pci_bios_check_devices(struct pci_bus *busses)
- if (pci_region_align(&s->r[type]) > align)
- align = pci_region_align(&s->r[type]);
- u64 sum = pci_region_sum(&s->r[type]);
-- int resource_optional = pcie_cap && (type == PCI_REGION_TYPE_IO);
-+ int resource_optional = 0;
-+ if (hotplug_support == HOTPLUG_PCIE)
-+ resource_optional = pcie_cap && (type == PCI_REGION_TYPE_IO);
- if (!sum && hotplug_support && !resource_optional)
- sum = align; /* reserve min size for hot-plug */
- if (size > sum) {
---
-2.27.0
-
diff --git a/SOURCES/0004-pci-reserve-resources-for-pcie-pci-bridge-to-fix-reg.patch b/SOURCES/0004-pci-reserve-resources-for-pcie-pci-bridge-to-fix-reg.patch
deleted file mode 100644
index 9af58d8..0000000
--- a/SOURCES/0004-pci-reserve-resources-for-pcie-pci-bridge-to-fix-reg.patch
+++ /dev/null
@@ -1,83 +0,0 @@
-From ded76fad62293d5dbe4eebf30d3b19c9eb8330de Mon Sep 17 00:00:00 2001
-From: Igor Mammedov <imammedo@redhat.com>
-Date: Mon, 29 Nov 2021 06:48:11 -0500
-Subject: pci: reserve resources for pcie-pci-bridge to fix regressed hotplug
- on q35
-
-RH-Bugzilla: 2001732
-
-If QEMU is started with unpopulated pcie-pci-bridge with ACPI PCI
-hotplug enabled (default since QEMU-6.1), hotplugging a PCI device
-into one of the bridge slots fails due to lack of resources.
-
-once linux guest is booted (test used Fedora 34), hotplug NIC from
-QEMU monitor:
- (qemu) device_add rtl8139,bus=pcie-pci-bridge-0,addr=0x2
-
-guest fails hotplug with:
- pci 0000:01:02.0: [10ec:8139] type 00 class 0x020000
- pci 0000:01:02.0: reg 0x10: [io 0x0000-0x00ff]
- pci 0000:01:02.0: reg 0x14: [mem 0x00000000-0x000000ff]
- pci 0000:01:02.0: reg 0x30: [mem 0x00000000-0x0003ffff pref]
- pci 0000:01:02.0: BAR 6: no space for [mem size 0x00040000 pref]
- pci 0000:01:02.0: BAR 6: failed to assign [mem size 0x00040000 pref]
- pci 0000:01:02.0: BAR 0: no space for [io size 0x0100]
- pci 0000:01:02.0: BAR 0: failed to assign [io size 0x0100]
- pci 0000:01:02.0: BAR 1: no space for [mem size 0x00000100]
- pci 0000:01:02.0: BAR 1: failed to assign [mem size 0x00000100]
- 8139cp: 8139cp: 10/100 PCI Ethernet driver v1.3 (Mar 22, 2004)
- PCI Interrupt Link [GSIG] enabled at IRQ 22
- 8139cp 0000:01:02.0: no MMIO resource
- 8139cp: probe of 0000:01:02.0 failed with error -5
-
-Reason for this is that commit [1] didn't take into account
-pcie-pci-bridge, marking bridge as non hotpluggable instead of
-handling it as possibly SHPC capable bridge.
-Fix issue by checking if pcie-pci-bridge is SHPC capable and
-if it is mark it as hotpluggable.
-
-Fixes regression in QEMU-6.1 and later, since it was switched
-to ACPI based PCI hotplug on Q35 by default at that time.
-
-[1]
-Fixes: 3aa31d7d637 ("hw/pci: reserve IO and mem for pci express downstream ports with no devices attached")
-Signed-off-by: Igor Mammedov imammedo@redhat.com
-CC: mapfelba@redhat.com
-CC: kraxel@redhat.com
-CC: mst@redhat.com
-CC: lvivier@redhat.com
-CC: jusual@redhat.com
-Tested-by: Laurent Vivier <lvivier@redhat.com>
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
-Message-Id: <20211129114812.231849-2-imammedo@redhat.com>
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
----
- src/fw/pciinit.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/src/fw/pciinit.c b/src/fw/pciinit.c
-index 3c99d514..badf13d3 100644
---- a/src/fw/pciinit.c
-+++ b/src/fw/pciinit.c
-@@ -808,6 +808,10 @@ static hotplug_type_t pci_bus_hotplug_support(struct pci_bus *bus, u8 pcie_cap)
- pcie_cap + PCI_EXP_FLAGS);
- u8 port_type = ((pcie_flags & PCI_EXP_FLAGS_TYPE) >>
- (__builtin_ffs(PCI_EXP_FLAGS_TYPE) - 1));
-+
-+ if (port_type == PCI_EXP_TYPE_PCI_BRIDGE)
-+ goto check_shpc;
-+
- u8 downstream_port = (port_type == PCI_EXP_TYPE_DOWNSTREAM) ||
- (port_type == PCI_EXP_TYPE_ROOT_PORT);
- /*
-@@ -825,6 +829,7 @@ static hotplug_type_t pci_bus_hotplug_support(struct pci_bus *bus, u8 pcie_cap)
- HOTPLUG_PCIE : HOTPLUG_NO_SUPPORTED;
- }
-
-+check_shpc:
- shpc_cap = pci_find_capability(bus->bus_dev->bdf, PCI_CAP_ID_SHPC, 0);
- return !!shpc_cap ? HOTPLUG_SHPC : HOTPLUG_NO_SUPPORTED;
- }
---
-2.27.0
-
diff --git a/SOURCES/seabios-malloc-use-large-ZoneHigh-when-there-is-enough-memor.patch b/SOURCES/seabios-malloc-use-large-ZoneHigh-when-there-is-enough-memor.patch
new file mode 100644
index 0000000..218e115
--- /dev/null
+++ b/SOURCES/seabios-malloc-use-large-ZoneHigh-when-there-is-enough-memor.patch
@@ -0,0 +1,70 @@
+From f8c75c66a29fae7ff1e3bf23f382cd8f04e695a1 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Mon, 25 Apr 2022 09:25:31 +0200
+Subject: [PATCH 2/2] malloc: use large ZoneHigh when there is enough memory
+
+RH-Author: Gerd Hoffmann <kraxel@redhat.com>
+RH-MergeRequest: 3: malloc: use large ZoneHigh when there is enough memory
+RH-Commit: [2/2] 93b15659b39b9772c7620ddfbf558e11008bb8f9 (kraxel/centos-seabios)
+RH-Bugzilla: 2004662
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
+
+In case there is enough memory installed use a large ZoneHigh.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit dc88f9b72df52b22c35b127b80c487e0b6fca4af)
+---
+ src/config.h | 3 ++-
+ src/malloc.c | 14 +++++++++-----
+ 2 files changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/src/config.h b/src/config.h
+index 93c8dbc2..9abe355b 100644
+--- a/src/config.h
++++ b/src/config.h
+@@ -17,7 +17,8 @@
+ // Maximum number of map entries in the e820 map
+ #define BUILD_MAX_E820 32
+ // Space to reserve in high-memory for tables
+-#define BUILD_MAX_HIGHTABLE (256*1024)
++#define BUILD_MIN_HIGHTABLE (256*1024)
++#define BUILD_MAX_HIGHTABLE (16*1024*1024)
+ // Largest supported externaly facing drive id
+ #define BUILD_MAX_EXTDRIVE 16
+ // Number of bytes the smbios may be and still live in the f-segment
+diff --git a/src/malloc.c b/src/malloc.c
+index ecd8c9ac..da840980 100644
+--- a/src/malloc.c
++++ b/src/malloc.c
+@@ -423,7 +423,7 @@ malloc_preinit(void)
+
+ // Populate temp high ram
+ u32 highram_start = 0;
+- u32 highram_size = BUILD_MAX_HIGHTABLE;
++ u32 highram_size = 0;
+ int i;
+ for (i=e820_count-1; i>=0; i--) {
+ struct e820entry *en = &e820_list[i];
+@@ -434,10 +434,14 @@ malloc_preinit(void)
+ continue;
+ u32 s = en->start, e = end;
+ if (!highram_start) {
+- u32 newe = ALIGN_DOWN(e - highram_size, MALLOC_MIN_ALIGN);
+- if (newe <= e && newe >= s) {
+- highram_start = newe;
+- e = newe;
++ u32 new_max = ALIGN_DOWN(e - BUILD_MAX_HIGHTABLE, MALLOC_MIN_ALIGN);
++ u32 new_min = ALIGN_DOWN(e - BUILD_MIN_HIGHTABLE, MALLOC_MIN_ALIGN);
++ if (new_max <= e && new_max >= s + BUILD_MAX_HIGHTABLE) {
++ highram_start = e = new_max;
++ highram_size = BUILD_MAX_HIGHTABLE;
++ } else if (new_min <= e && new_min >= s) {
++ highram_start = e = new_min;
++ highram_size = BUILD_MIN_HIGHTABLE;
+ }
+ }
+ alloc_add(&ZoneTmpHigh, s, e);
+--
+2.31.1
+
diff --git a/SOURCES/seabios-malloc-use-variable-for-ZoneHigh-size.patch b/SOURCES/seabios-malloc-use-variable-for-ZoneHigh-size.patch
new file mode 100644
index 0000000..8fd4485
--- /dev/null
+++ b/SOURCES/seabios-malloc-use-variable-for-ZoneHigh-size.patch
@@ -0,0 +1,69 @@
+From 1c38dda9009b11aa935b9cd32043338c250f4de2 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Mon, 25 Apr 2022 09:20:02 +0200
+Subject: [PATCH 1/2] malloc: use variable for ZoneHigh size
+
+RH-Author: Gerd Hoffmann <kraxel@redhat.com>
+RH-MergeRequest: 3: malloc: use large ZoneHigh when there is enough memory
+RH-Commit: [1/2] 4265a009c535ebb7a592cc610266ba02546ec77d (kraxel/centos-seabios)
+RH-Bugzilla: 2004662
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
+
+Use the variable highram_size instead of the BUILD_MAX_HIGHTABLE #define
+for the ZoneHigh size. Initialize the new variable with the old #define,
+so behavior does not change.
+
+This allows to easily adjust the ZoneHigh size at runtime in a followup
+patch.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 3b91e8e9fe93d5ff7edf17f984c401f9e6ba55fe)
+---
+ src/malloc.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/src/malloc.c b/src/malloc.c
+index 3733855c..ecd8c9ac 100644
+--- a/src/malloc.c
++++ b/src/malloc.c
+@@ -422,7 +422,8 @@ malloc_preinit(void)
+ e820_add(BUILD_BIOS_ADDR, BUILD_BIOS_SIZE, E820_RESERVED);
+
+ // Populate temp high ram
+- u32 highram = 0;
++ u32 highram_start = 0;
++ u32 highram_size = BUILD_MAX_HIGHTABLE;
+ int i;
+ for (i=e820_count-1; i>=0; i--) {
+ struct e820entry *en = &e820_list[i];
+@@ -432,10 +433,10 @@ malloc_preinit(void)
+ if (en->type != E820_RAM || end > 0xffffffff)
+ continue;
+ u32 s = en->start, e = end;
+- if (!highram) {
+- u32 newe = ALIGN_DOWN(e - BUILD_MAX_HIGHTABLE, MALLOC_MIN_ALIGN);
++ if (!highram_start) {
++ u32 newe = ALIGN_DOWN(e - highram_size, MALLOC_MIN_ALIGN);
+ if (newe <= e && newe >= s) {
+- highram = newe;
++ highram_start = newe;
+ e = newe;
+ }
+ }
+@@ -444,9 +445,9 @@ malloc_preinit(void)
+
+ // Populate regions
+ alloc_add(&ZoneTmpLow, BUILD_STACK_ADDR, BUILD_EBDA_MINIMUM);
+- if (highram) {
+- alloc_add(&ZoneHigh, highram, highram + BUILD_MAX_HIGHTABLE);
+- e820_add(highram, BUILD_MAX_HIGHTABLE, E820_RESERVED);
++ if (highram_start) {
++ alloc_add(&ZoneHigh, highram_start, highram_start + highram_size);
++ e820_add(highram_start, highram_size, E820_RESERVED);
+ }
+ }
+
+--
+2.31.1
+
diff --git a/SOURCES/seabios-pci-refactor-the-pci_config_-functions.patch b/SOURCES/seabios-pci-refactor-the-pci_config_-functions.patch
new file mode 100644
index 0000000..a43cb5c
--- /dev/null
+++ b/SOURCES/seabios-pci-refactor-the-pci_config_-functions.patch
@@ -0,0 +1,172 @@
+From d1e13b6d631a45882471efcbe367c690e1698b42 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Volker=20R=C3=BCmelin?= <vr_qemu@t-online.de>
+Date: Sat, 2 Apr 2022 20:28:38 +0200
+Subject: [PATCH 1/2] pci: refactor the pci_config_*() functions
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Gerd Hoffmann <kraxel@redhat.com>
+RH-MergeRequest: 4: reset: force standard PCI configuration access
+RH-Commit: [1/2] 49093312e6cdddd301766fcfb91cf80260be3f05 (kraxel/centos-seabios)
+RH-Bugzilla: 2086407
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
+
+Split out the Standard PCI Configuration Access Mechanism
+pci_ioconfig_*() functions from the pci_config_*() functions.
+The standard PCI CAM functions will be used in the next patch.
+
+Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
+Signed-off-by: Volker Rümelin <vr_qemu@t-online.de>
+(cherry picked from commit d24f42b0d819ea473ae05b2f955b822d0126d901)
+---
+ src/hw/pci.c | 54 ++++++++++++++++++++++++++++++++++++++++------------
+ src/hw/pci.h | 12 +++++++++++-
+ 2 files changed, 53 insertions(+), 13 deletions(-)
+
+diff --git a/src/hw/pci.c b/src/hw/pci.c
+index 3df1dae4..f13cbdea 100644
+--- a/src/hw/pci.c
++++ b/src/hw/pci.c
+@@ -26,63 +26,93 @@ static u32 ioconfig_cmd(u16 bdf, u32 addr)
+ return 0x80000000 | (bdf << 8) | (addr & 0xfc);
+ }
+
++void pci_ioconfig_writel(u16 bdf, u32 addr, u32 val)
++{
++ outl(ioconfig_cmd(bdf, addr), PORT_PCI_CMD);
++ outl(val, PORT_PCI_DATA);
++}
++
+ void pci_config_writel(u16 bdf, u32 addr, u32 val)
+ {
+ if (!MODESEGMENT && mmconfig) {
+ writel(mmconfig_addr(bdf, addr), val);
+ } else {
+- outl(ioconfig_cmd(bdf, addr), PORT_PCI_CMD);
+- outl(val, PORT_PCI_DATA);
++ pci_ioconfig_writel(bdf, addr, val);
+ }
+ }
+
++void pci_ioconfig_writew(u16 bdf, u32 addr, u16 val)
++{
++ outl(ioconfig_cmd(bdf, addr), PORT_PCI_CMD);
++ outw(val, PORT_PCI_DATA + (addr & 2));
++}
++
+ void pci_config_writew(u16 bdf, u32 addr, u16 val)
+ {
+ if (!MODESEGMENT && mmconfig) {
+ writew(mmconfig_addr(bdf, addr), val);
+ } else {
+- outl(ioconfig_cmd(bdf, addr), PORT_PCI_CMD);
+- outw(val, PORT_PCI_DATA + (addr & 2));
++ pci_ioconfig_writew(bdf, addr, val);
+ }
+ }
+
++void pci_ioconfig_writeb(u16 bdf, u32 addr, u8 val)
++{
++ outl(ioconfig_cmd(bdf, addr), PORT_PCI_CMD);
++ outb(val, PORT_PCI_DATA + (addr & 3));
++}
++
+ void pci_config_writeb(u16 bdf, u32 addr, u8 val)
+ {
+ if (!MODESEGMENT && mmconfig) {
+ writeb(mmconfig_addr(bdf, addr), val);
+ } else {
+- outl(ioconfig_cmd(bdf, addr), PORT_PCI_CMD);
+- outb(val, PORT_PCI_DATA + (addr & 3));
++ pci_ioconfig_writeb(bdf, addr, val);
+ }
+ }
+
++u32 pci_ioconfig_readl(u16 bdf, u32 addr)
++{
++ outl(ioconfig_cmd(bdf, addr), PORT_PCI_CMD);
++ return inl(PORT_PCI_DATA);
++}
++
+ u32 pci_config_readl(u16 bdf, u32 addr)
+ {
+ if (!MODESEGMENT && mmconfig) {
+ return readl(mmconfig_addr(bdf, addr));
+ } else {
+- outl(ioconfig_cmd(bdf, addr), PORT_PCI_CMD);
+- return inl(PORT_PCI_DATA);
++ return pci_ioconfig_readl(bdf, addr);
+ }
+ }
+
++u16 pci_ioconfig_readw(u16 bdf, u32 addr)
++{
++ outl(ioconfig_cmd(bdf, addr), PORT_PCI_CMD);
++ return inw(PORT_PCI_DATA + (addr & 2));
++}
++
+ u16 pci_config_readw(u16 bdf, u32 addr)
+ {
+ if (!MODESEGMENT && mmconfig) {
+ return readw(mmconfig_addr(bdf, addr));
+ } else {
+- outl(ioconfig_cmd(bdf, addr), PORT_PCI_CMD);
+- return inw(PORT_PCI_DATA + (addr & 2));
++ return pci_ioconfig_readw(bdf, addr);
+ }
+ }
+
++u8 pci_ioconfig_readb(u16 bdf, u32 addr)
++{
++ outl(ioconfig_cmd(bdf, addr), PORT_PCI_CMD);
++ return inb(PORT_PCI_DATA + (addr & 3));
++}
++
+ u8 pci_config_readb(u16 bdf, u32 addr)
+ {
+ if (!MODESEGMENT && mmconfig) {
+ return readb(mmconfig_addr(bdf, addr));
+ } else {
+- outl(ioconfig_cmd(bdf, addr), PORT_PCI_CMD);
+- return inb(PORT_PCI_DATA + (addr & 3));
++ return pci_ioconfig_readb(bdf, addr);
+ }
+ }
+
+diff --git a/src/hw/pci.h b/src/hw/pci.h
+index 01c51f70..ee6acafc 100644
+--- a/src/hw/pci.h
++++ b/src/hw/pci.h
+@@ -32,6 +32,15 @@ static inline u16 pci_bus_devfn_to_bdf(int bus, u16 devfn) {
+ ; BDF >= 0 \
+ ; BDF=pci_next(BDF, (BUS)))
+
++// standard PCI configration access mechanism
++void pci_ioconfig_writel(u16 bdf, u32 addr, u32 val);
++void pci_ioconfig_writew(u16 bdf, u32 addr, u16 val);
++void pci_ioconfig_writeb(u16 bdf, u32 addr, u8 val);
++u32 pci_ioconfig_readl(u16 bdf, u32 addr);
++u16 pci_ioconfig_readw(u16 bdf, u32 addr);
++u8 pci_ioconfig_readb(u16 bdf, u32 addr);
++
++// PCI configuration access using either PCI CAM or PCIe ECAM
+ void pci_config_writel(u16 bdf, u32 addr, u32 val);
+ void pci_config_writew(u16 bdf, u32 addr, u16 val);
+ void pci_config_writeb(u16 bdf, u32 addr, u8 val);
+@@ -39,9 +48,10 @@ u32 pci_config_readl(u16 bdf, u32 addr);
+ u16 pci_config_readw(u16 bdf, u32 addr);
+ u8 pci_config_readb(u16 bdf, u32 addr);
+ void pci_config_maskw(u16 bdf, u32 addr, u16 off, u16 on);
+-void pci_enable_mmconfig(u64 addr, const char *name);
+ u8 pci_find_capability(u16 bdf, u8 cap_id, u8 cap);
+ int pci_next(int bdf, int bus);
++
++void pci_enable_mmconfig(u64 addr, const char *name);
+ int pci_probe_host(void);
+ void pci_reboot(void);
+
+--
+2.31.1
+
diff --git a/SOURCES/seabios-reset-force-standard-PCI-configuration-access.patch b/SOURCES/seabios-reset-force-standard-PCI-configuration-access.patch
new file mode 100644
index 0000000..7502ca3
--- /dev/null
+++ b/SOURCES/seabios-reset-force-standard-PCI-configuration-access.patch
@@ -0,0 +1,157 @@
+From dbca6bf0626072c3b90ffe4f4c6e5db92814bd5d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Volker=20R=C3=BCmelin?= <vr_qemu@t-online.de>
+Date: Sat, 2 Apr 2022 20:28:39 +0200
+Subject: [PATCH 2/2] reset: force standard PCI configuration access
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Gerd Hoffmann <kraxel@redhat.com>
+RH-MergeRequest: 4: reset: force standard PCI configuration access
+RH-Commit: [2/2] 70fa6dd1d546a03a3b44e438f84682325f5ee029 (kraxel/centos-seabios)
+RH-Bugzilla: 2086407
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
+
+After a reset of a QEMU -machine q35 guest, the PCI Express
+Enhanced Configuration Mechanism is disabled and the variable
+mmconfig no longer matches the configuration register PCIEXBAR
+of the Q35 chipset. Until the variable mmconfig is reset to 0,
+all pci_config_*() functions no longer work.
+
+The variable mmconfig is located in one of the read-only C-F
+segments. To reset it the pci_config_*() functions are needed,
+but they do not work.
+
+Replace all pci_config_*() calls with Standard PCI Configuration
+Mechanism pci_ioconfig_*() calls until mmconfig is overwritten
+with 0 by a fresh copy of the BIOS.
+
+This fixes
+
+In resume (status=0)
+In 32bit resume
+Attempting a hard reboot
+Unable to unlock ram - bridge not found
+
+and a reset loop with QEMU -accel tcg.
+
+Signed-off-by: Volker Rümelin <vr_qemu@t-online.de>
+(cherry picked from commit 01774004c7f7fdc9c1e8f1715f70d3b913f8d491)
+---
+ src/fw/shadow.c | 14 +++++++-------
+ src/hw/pci.c | 27 +++++++++++++++++++++++++++
+ src/hw/pci.h | 6 ++++++
+ 3 files changed, 40 insertions(+), 7 deletions(-)
+
+diff --git a/src/fw/shadow.c b/src/fw/shadow.c
+index 4c627a8f..8930616e 100644
+--- a/src/fw/shadow.c
++++ b/src/fw/shadow.c
+@@ -32,8 +32,8 @@ __make_bios_writable_intel(u16 bdf, u32 pam0)
+ {
+ // Read in current PAM settings from pci config space
+ union pamdata_u pamdata;
+- pamdata.data32[0] = pci_config_readl(bdf, ALIGN_DOWN(pam0, 4));
+- pamdata.data32[1] = pci_config_readl(bdf, ALIGN_DOWN(pam0, 4) + 4);
++ pamdata.data32[0] = pci_ioconfig_readl(bdf, ALIGN_DOWN(pam0, 4));
++ pamdata.data32[1] = pci_ioconfig_readl(bdf, ALIGN_DOWN(pam0, 4) + 4);
+ u8 *pam = &pamdata.data8[pam0 & 0x03];
+
+ // Make ram from 0xc0000-0xf0000 writable
+@@ -46,8 +46,8 @@ __make_bios_writable_intel(u16 bdf, u32 pam0)
+ pam[0] = 0x30;
+
+ // Write PAM settings back to pci config space
+- pci_config_writel(bdf, ALIGN_DOWN(pam0, 4), pamdata.data32[0]);
+- pci_config_writel(bdf, ALIGN_DOWN(pam0, 4) + 4, pamdata.data32[1]);
++ pci_ioconfig_writel(bdf, ALIGN_DOWN(pam0, 4), pamdata.data32[0]);
++ pci_ioconfig_writel(bdf, ALIGN_DOWN(pam0, 4) + 4, pamdata.data32[1]);
+
+ if (!ram_present)
+ // Copy bios.
+@@ -59,7 +59,7 @@ __make_bios_writable_intel(u16 bdf, u32 pam0)
+ static void
+ make_bios_writable_intel(u16 bdf, u32 pam0)
+ {
+- int reg = pci_config_readb(bdf, pam0);
++ int reg = pci_ioconfig_readb(bdf, pam0);
+ if (!(reg & 0x10)) {
+ // QEMU doesn't fully implement the piix shadow capabilities -
+ // if ram isn't backing the bios segment when shadowing is
+@@ -125,8 +125,8 @@ make_bios_writable(void)
+ // At this point, statically allocated variables can't be written,
+ // so do this search manually.
+ int bdf;
+- foreachbdf(bdf, 0) {
+- u32 vendev = pci_config_readl(bdf, PCI_VENDOR_ID);
++ pci_ioconfig_foreachbdf(bdf, 0) {
++ u32 vendev = pci_ioconfig_readl(bdf, PCI_VENDOR_ID);
+ u16 vendor = vendev & 0xffff, device = vendev >> 16;
+ if (vendor == PCI_VENDOR_ID_INTEL
+ && device == PCI_DEVICE_ID_INTEL_82441) {
+diff --git a/src/hw/pci.c b/src/hw/pci.c
+index f13cbdea..8eda84b2 100644
+--- a/src/hw/pci.c
++++ b/src/hw/pci.c
+@@ -157,6 +157,33 @@ u8 pci_find_capability(u16 bdf, u8 cap_id, u8 cap)
+ return 0;
+ }
+
++// Helper function for pci_ioconfig_foreachbdf() macro - return next device
++int pci_ioconfig_next(int bdf, int bus)
++{
++ if (pci_bdf_to_fn(bdf) == 0
++ && (pci_ioconfig_readb(bdf, PCI_HEADER_TYPE) & 0x80) == 0)
++ // Last found device wasn't a multi-function device - skip to
++ // the next device.
++ bdf += 8;
++ else
++ bdf += 1;
++
++ for (;;) {
++ if (pci_bdf_to_bus(bdf) != bus)
++ return -1;
++
++ u16 v = pci_ioconfig_readw(bdf, PCI_VENDOR_ID);
++ if (v != 0x0000 && v != 0xffff)
++ // Device is present.
++ return bdf;
++
++ if (pci_bdf_to_fn(bdf) == 0)
++ bdf += 8;
++ else
++ bdf += 1;
++ }
++}
++
+ // Helper function for foreachbdf() macro - return next device
+ int
+ pci_next(int bdf, int bus)
+diff --git a/src/hw/pci.h b/src/hw/pci.h
+index ee6acafc..b2f5baf4 100644
+--- a/src/hw/pci.h
++++ b/src/hw/pci.h
+@@ -27,6 +27,11 @@ static inline u16 pci_bus_devfn_to_bdf(int bus, u16 devfn) {
+ return (bus << 8) | devfn;
+ }
+
++#define pci_ioconfig_foreachbdf(BDF, BUS) \
++ for (BDF=pci_ioconfig_next(pci_bus_devfn_to_bdf((BUS), 0)-1, (BUS)) \
++ ; BDF >= 0 \
++ ; BDF=pci_ioconfig_next(BDF, (BUS)))
++
+ #define foreachbdf(BDF, BUS) \
+ for (BDF=pci_next(pci_bus_devfn_to_bdf((BUS), 0)-1, (BUS)) \
+ ; BDF >= 0 \
+@@ -39,6 +44,7 @@ void pci_ioconfig_writeb(u16 bdf, u32 addr, u8 val);
+ u32 pci_ioconfig_readl(u16 bdf, u32 addr);
+ u16 pci_ioconfig_readw(u16 bdf, u32 addr);
+ u8 pci_ioconfig_readb(u16 bdf, u32 addr);
++int pci_ioconfig_next(int bdf, int bus);
+
+ // PCI configuration access using either PCI CAM or PCIe ECAM
+ void pci_config_writel(u16 bdf, u32 addr, u32 val);
+--
+2.31.1
+
diff --git a/SOURCES/seabios-virtio-blk-use-larger-default-request-size.patch b/SOURCES/seabios-virtio-blk-use-larger-default-request-size.patch
new file mode 100644
index 0000000..34f0860
--- /dev/null
+++ b/SOURCES/seabios-virtio-blk-use-larger-default-request-size.patch
@@ -0,0 +1,42 @@
+From 7ef00c50cafaf356b9aef5f7c7865b405de6b2f5 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Thu, 30 Jun 2022 17:28:40 +0200
+Subject: [PATCH] virtio-blk: use larger default request size
+
+RH-Author: Gerd Hoffmann <kraxel@redhat.com>
+RH-MergeRequest: 5: virtio-blk: use larger default request size
+RH-Commit: [1/1] 5b2833de23fdab9fc3c170e448e9ed07d9fb82dd (kraxel/centos-seabios)
+RH-Bugzilla: 2108555
+RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
+RH-Acked-by: Pawel Polawski <ppolawsk@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+
+Bump default from 8 to 64 blocks. Using 8 by default leads
+to requests being splitted on qemu, which slows down boot.
+
+Some (temporary) debug logging added showed that almost all
+requests on a standard fedora install are less than 64 blocks,
+so that should bring us back to 1.15 performance levels.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 46de2eec93bffa0706e6229c0da2919763c8eb04)
+---
+ src/hw/virtio-blk.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/hw/virtio-blk.c b/src/hw/virtio-blk.c
+index 929ba887..9b4a05a4 100644
+--- a/src/hw/virtio-blk.c
++++ b/src/hw/virtio-blk.c
+@@ -95,7 +95,7 @@ virtio_blk_op(struct disk_op_s *op, int write)
+ blk_num_max = (u16)max_io_size / vdrive->drive.blksize;
+ else
+ /* default blk_num_max if hardware doesnot advise a proper value */
+- blk_num_max = 8;
++ blk_num_max = 64;
+
+ if (op->count <= blk_num_max) {
+ virtio_blk_op_one_segment(vdrive, write, sg);
+--
+2.31.1
+
diff --git a/SPECS/seabios.spec b/SPECS/seabios.spec
index 2f05476..e86d56e 100644
--- a/SPECS/seabios.spec
+++ b/SPECS/seabios.spec
@@ -1,16 +1,12 @@
Name: seabios
-Version: 1.15.0
-Release: 1%{?dist}
+Version: 1.16.0
+Release: 4%{?dist}
Summary: Open-source legacy BIOS implementation
License: LGPLv3
URL: https://www.coreboot.org/SeaBIOS
-Source0: https://code.coreboot.org/p/seabios/downloads/get/seabios-1.15.0.tar.gz
-
-Patch0002: 0002-Workaround-for-a-win8.1-32-S4-resume-bug.patch
-Patch0003: 0003-pci-let-firmware-reserve-IO-for-pcie-pci-bridge.patch
-Patch0004: 0004-pci-reserve-resources-for-pcie-pci-bridge-to-fix-reg.patch
+Source0: https://code.coreboot.org/p/seabios/downloads/get/seabios-1.16.0.tar.gz
Source10: config.vga-cirrus
Source12: config.vga-qxl
@@ -20,6 +16,20 @@ Source19: config.vga-virtio
Source20: config.vga-ramfb
Source21: config.vga-bochs-display
+Patch0002: 0001-Workaround-for-a-win8.1-32-S4-resume-bug.patch
+# For bz#2004662 - RFE: "Unable to allocate resource at romfile_loader_allocate:87" when running very large VMs
+Patch3: seabios-malloc-use-variable-for-ZoneHigh-size.patch
+# For bz#2004662 - RFE: "Unable to allocate resource at romfile_loader_allocate:87" when running very large VMs
+Patch4: seabios-malloc-use-large-ZoneHigh-when-there-is-enough-memor.patch
+# For bz#2086407 - qemu reboot problem with seabios 1.16.0
+Patch5: seabios-pci-refactor-the-pci_config_-functions.patch
+# For bz#2086407 - qemu reboot problem with seabios 1.16.0
+Patch6: seabios-reset-force-standard-PCI-configuration-access.patch
+# For bz#2108555 - [rhel.9.1] Loading a kernel/initrd is sometimes very slow
+Patch7: seabios-virtio-blk-use-larger-default-request-size.patch
+
+# Source-git patches
+
BuildRequires: make
BuildRequires: gcc
BuildRequires: python3 iasl
@@ -135,16 +145,37 @@ install -m 0644 binaries/vgabios*.bin $RPM_BUILD_ROOT%{_datadir}/seavgabios
%{_datadir}/seavgabios/vgabios*.bin
%changelog
+* Mon Jul 25 2022 Miroslav Rezanina <mrezanin@redhat.com> - 1.16.0-4
+- seabios-virtio-blk-use-larger-default-request-size.patch [bz#2108555]
+- Resolves: bz#2108555
+ ([rhel.9.1] Loading a kernel/initrd is sometimes very slow)
+
+* Thu May 26 2022 Miroslav Rezanina <mrezanin@redhat.com> - 1.16.0-3
+- seabios-pci-refactor-the-pci_config_-functions.patch [bz#2086407]
+- seabios-reset-force-standard-PCI-configuration-access.patch [bz#2086407]
+- Resolves: bz#2086407
+ (qemu reboot problem with seabios 1.16.0)
+
+* Tue May 10 2022 Miroslav Rezanina <mrezanin@redhat.com> - 1.16.0-2
+- seabios-malloc-use-variable-for-ZoneHigh-size.patch [bz#2004662]
+- seabios-malloc-use-large-ZoneHigh-when-there-is-enough-memor.patch [bz#2004662]
+- Resolves: bz#2004662
+ (RFE: "Unable to allocate resource at romfile_loader_allocate:87" when running very large VMs)
+
+* Thu Apr 21 2022 Paweł Poławski <ppolawsk@redhat.com> - 1.16.0-1
+- Rebase to upstream 1.16.0 release [bz#2066826]
+- Resolves: bz#2066826
+ (rebase seabios to 1.16 release)
+
* Fri Dec 17 2021 Miroslav Rezanina <mrezanin@redhat.com> - 1.15.0-1
- Rebase to seabios to 1.15.0 [bz#2018393]
- 0003-pci-let-firmware-reserve-IO-for-pcie-pci-bridge.patch [bz#2001732]
-- 0004-pci-reserve-resources-for-pcie-pci-bridge-to-fix-reg.patch [bz#2001732]
+- 0004-pci-reserve-resources-for-pcie-pci-bridge-to-fix-reg.patch [bz#2001732]
- Resolves: bz#2018393
([rebase] update seabios to nov '21 release)
- Resolves: bz#2001732
([virtual network][qemu-6.1.0-1] Fail to hotplug nic with rtl8139 driver)
-
* Wed Sep 15 2021 Miroslav Rezanina <mrezanin@redhat.com> - 1.14.0-7
- seabios-Drop-fedora-bits-they-are-not-tested-and-currently-f.patch [bz#2004169]
- seabios-Disable-TPM-support.patch [bz#2004169]