Merge ~lvoytek/ubuntu/+source/libvirt:sapphire-rapids-and-libvirt-uri-jammy into ubuntu/+source/libvirt:ubuntu/jammy-devel

[Lena Voytek]

Add support for Sapphire Rapids and keep a consistent LIBVIRT_DEFAULT_URI value.

Jammy requires substantially more patches than Lunar for Sapphire Rapids with the addition of xfd, tsx-ldtrk, serialize, bus-lock-detect, avx512-fp16, and amx

Still working on architecture-specific testing for Sapphire Rapids alongside the SRU template for both bugs.

PPA: https://launchpad.net/~lvoytek/+archive/ubuntu/libvirt-sapphirerapids-uri

[Bryce Harrington (bryce)]

This looks to be properly carrying the changes from https://code.launchpad.net/~lvoytek/ubuntu/+source/libvirt/+git/libvirt/+merge/455071 back to jammy, and the further support as mentioned. PPA builds properly, I didn't check autopkgtests but this type of change is unlikely to be adequately exercised by those tests. There is a quantity of patches here but they're principally all XML tweaks along with corresponding python and C code, all of which looks good on a quick visual inspection.

LGTM, +1

review: Approve

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: lvoytek, bryce
Uploaders: lvoytek, bryce
MP auto-approved

review: Approve

e73a707... by Lena Voytek on 2023-12-06

changelog

[Lena Voytek (lvoytek)]

Thanks for the reviews Bryce! I'll go ahead and upload the Sapphire Rapids changes for lunar, and jammy. Still need some time for the URI update and I don't want the wishlist item to block this off

[Andreas Hasenack (ahasenack)]

This is already in jammy-proposed[1], and git-ubuntu imported it. Marking the MP as merged.

1. https://launchpad.net/ubuntu/+source/libvirt/8.0.0-1ubuntu7.8

diff --git a/debian/changelog b/debian/changelog
index ce7b258..d28b52e 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+libvirt (8.0.0-1ubuntu7.8) jammy; urgency=medium
+
+  * d/p/u/lp-2028057-*, d/libvirt0.install: Add named types and definitions,
+    along with QEMU alias syncing for Intel SapphireRapids (LP: #2028057)
+
+ -- Lena Voytek <[e-mail]>  Wed, 29 Nov 2023 14:52:52 -0700
+
 libvirt (8.0.0-1ubuntu7.7) jammy; urgency=medium
 
   * When attempting to launch a VM with SGX enabled, there is an
diff --git a/debian/libvirt0.install b/debian/libvirt0.install
index b384c41..ca07f96 100644
--- a/debian/libvirt0.install
+++ b/debian/libvirt0.install
@@ -58,6 +58,8 @@ usr/share/libvirt/cpu_map/x86_Opteron_G5.xml
 usr/share/libvirt/cpu_map/x86_Penryn.xml
 usr/share/libvirt/cpu_map/x86_SandyBridge-IBRS.xml
 usr/share/libvirt/cpu_map/x86_SandyBridge.xml
+usr/share/libvirt/cpu_map/x86_SapphireRapids-noTSX.xml
+usr/share/libvirt/cpu_map/x86_SapphireRapids.xml
 usr/share/libvirt/cpu_map/x86_Skylake-Client-IBRS.xml
 usr/share/libvirt/cpu_map/x86_Skylake-Client-noTSX-IBRS.xml
 usr/share/libvirt/cpu_map/x86_Skylake-Client.xml
diff --git a/debian/patches/series b/debian/patches/series
index fa31371..8b1d998 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -29,6 +29,30 @@ ubuntu/dnsmasq-as-priv-user
 ubuntu/ovmf_paths.patch
 ubuntu/wait-for-qemu-kvm.patch
 
+ubuntu/lp-2028057-01-alias-names-allow-additional-feature-node-children.patch
+ubuntu/lp-2028057-02-alias-names-ignore.patch
+ubuntu/lp-2028057-03-alias-names-make-machine-readable.patch
+ubuntu/lp-2028057-04-qemu-i386-sync-cpu-features.patch
+ubuntu/lp-2028057-05-add-missing-feature-amx.patch
+ubuntu/lp-2028057-06-qemu-i386-rename-file.patch
+ubuntu/lp-2028057-07-alias-names-add-to-features.patch
+ubuntu/lp-2028057-08-add-missing-feature-sgx.patch
+ubuntu/lp-2028057-09-add-missing-feature-sgxlc.patch
+ubuntu/lp-2028057-10-add-missing-feature-sgx-exinfo.patch
+ubuntu/lp-2028057-11-add-missing-feature-sgx1.patch
+ubuntu/lp-2028057-12-add-missing-feature-sgx2.patch
+ubuntu/lp-2028057-13-add-missing-feature-sgx-additional.patch
+ubuntu/lp-2028057-14-add-missing-feature-bus-lock-detect.patch
+ubuntu/lp-2028057-15-add-missing-feature-pks.patch
+ubuntu/lp-2028057-16-add-missing-feature-avx512-vp2intersect.patch
+ubuntu/lp-2028057-17-add-missing-feature-avx512-fp16.patch
+ubuntu/lp-2028057-18-add-missing-feature-serialize.patch
+ubuntu/lp-2028057-19-add-missing-feature-tsx-ldtrk.patch
+ubuntu/lp-2028057-20-add-missing-feature-arch-lbr.patch
+ubuntu/lp-2028057-21-add-missing-feature-xfd.patch
+ubuntu/lp-2028057-22-add-missing-feature-intel-pt-lip.patch
+ubuntu/lp-2028057-23-add-new-CPU-model-Intel-SapphireRapids.patch
+
 # Ubuntu Apparmor Changes
 ubuntu-aa/0020-virt-aa-helper-ubuntu-storage-paths.patch
 ubuntu-aa/0029-appmor-libvirt-qemu-Add-9p-support.patch
diff --git a/debian/patches/ubuntu/lp-2028057-01-alias-names-allow-additional-feature-node-children.patch b/debian/patches/ubuntu/lp-2028057-01-alias-names-allow-additional-feature-node-children.patch
new file mode 100644
index 0000000..bd4d6be
--- /dev/null
+++ b/debian/patches/ubuntu/lp-2028057-01-alias-names-allow-additional-feature-node-children.patch
@@ -0,0 +1,33 @@
+Description: Allow for more than one child in feature nodes in cpu-data.py.
+ cpu-data.py assumes that all "feature" nodes have exactly one child. This
+ assumption is no longer true when the cpumap includes alias-names for
+ features.
+Author: Tim Wiederhake <[e-mail]>
+Origin: upstream, https://gitlab.com/libvirt/libvirt/-/commit/10a41a8cbdf4bcaba0039e97704afda8220cd8e0
+Bug-Ubuntu: https://launchpad.net/bugs/2028057
+Forwarded: not-needed
+Last-Update: 2023-11-29
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+--- a/tests/cputestdata/cpu-data.py
++++ b/tests/cputestdata/cpu-data.py
+@@ -445,12 +445,15 @@
+ 
+     cpuMap = dict()
+     for f in xml.etree.ElementTree.parse(path).getroot().iter("feature"):
+-        if f[0].tag not in ("cpuid", "msr"):
++        data = f.find("cpuid")
++        if data is None:
++            data = f.find("msr")
++        if data is None:
+             continue
+ 
+-        feature = {"type": f[0].tag}
+-        for reg in _KEYS[f[0].tag] + _REGS[f[0].tag]:
+-            feature[reg] = int(f[0].attrib.get(reg, "0"), 0)
++        feature = {"type": data.tag}
++        for reg in _KEYS[data.tag] + _REGS[data.tag]:
++            feature[reg] = int(data.attrib.get(reg, "0"), 0)
+         cpuMap[f.attrib["name"]] = feature
+     return cpuMap
+ 
diff --git a/debian/patches/ubuntu/lp-2028057-02-alias-names-ignore.patch b/debian/patches/ubuntu/lp-2028057-02-alias-names-ignore.patch
new file mode 100644
index 0000000..3eb2351
--- /dev/null
+++ b/debian/patches/ubuntu/lp-2028057-02-alias-names-ignore.patch
@@ -0,0 +1,45 @@
+Description: Ignore alias names in feature maps when parsing in cpu_x86.
+ This patch makes sure cpu_x86 skips over feature map alias names which will
+ be added in this series as they are meant only for QEMU synchronization.
+Author: Tim Wiederhake <[e-mail]>
+Origin: upstream, https://gitlab.com/libvirt/libvirt/-/commit/7b0c01db75b0c11ba6f80999b822cfadff4d28da
+Bug-Ubuntu: https://launchpad.net/bugs/2028057
+Forwarded: not-needed
+Last-Update: 2023-11-29
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+--- a/src/cpu/cpu_x86.c
++++ b/src/cpu/cpu_x86.c
+@@ -1089,7 +1089,7 @@
+ x86ParseDataItemList(virCPUx86Data *cpudata,
+                      xmlNodePtr node)
+ {
+-    size_t i;
++    size_t i = 0;
+ 
+     if (xmlChildElementCount(node) <= 0) {
+         virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("no x86 CPU data found"));
+@@ -1097,9 +1097,14 @@
+     }
+ 
+     node = xmlFirstElementChild(node);
+-    for (i = 0; node; ++i) {
++    while (node) {
+         virCPUx86DataItem item;
+ 
++        if (virXMLNodeNameEqual(node, "alias")) {
++            node = xmlNextElementSibling(node);
++            continue;
++        }
++
+         if (virXMLNodeNameEqual(node, "cpuid")) {
+             if (x86ParseCPUID(node, &item) < 0) {
+                 virReportError(VIR_ERR_INTERNAL_ERROR,
+@@ -1116,6 +1121,7 @@
+ 
+         if (virCPUx86DataAddItem(cpudata, &item) < 0)
+             return -1;
++        ++i;
+ 
+         node = xmlNextElementSibling(node);
+     }
diff --git a/debian/patches/ubuntu/lp-2028057-03-alias-names-make-machine-readable.patch b/debian/patches/ubuntu/lp-2028057-03-alias-names-make-machine-readable.patch
new file mode 100644
index 0000000..9200c9e
--- /dev/null
+++ b/debian/patches/ubuntu/lp-2028057-03-alias-names-make-machine-readable.patch
@@ -0,0 +1,161 @@
+Description: Make x86 feature alias names machine readable.
+Author: Tim Wiederhake <[e-mail]>
+Origin: upstream, https://gitlab.com/libvirt/libvirt/-/commit/1d946ac79416f3731262c059c35a234c95285d46
+Bug-Ubuntu: https://launchpad.net/bugs/2028057
+Forwarded: not-needed
+Last-Update: 2023-11-29
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+--- a/src/cpu_map/x86_features.xml
++++ b/src/cpu_map/x86_features.xml
+@@ -98,10 +98,12 @@
+   </feature>
+ 
+   <!-- standard features, ECX -->
+-  <feature name='pni'> <!-- sse3 -->
++  <feature name='pni'>
++    <alias name='sse3' source='qemu'/>
+     <cpuid eax_in='0x01' ecx='0x00000001'/>
+   </feature>
+-  <feature name='pclmuldq'> <!-- pclmulqdq -->
++  <feature name='pclmuldq'>
++    <alias name='pclmulqdq' source='qemu'/>
+     <cpuid eax_in='0x01' ecx='0x00000002'/>
+   </feature>
+   <feature name='dtes64'>
+@@ -110,7 +112,8 @@
+   <feature name='monitor'>
+     <cpuid eax_in='0x01' ecx='0x00000008'/>
+   </feature>
+-  <feature name='ds_cpl'> <!-- ds-cpl -->
++  <feature name='ds_cpl'>
++    <alias name='ds-cpl' source='qemu'/>
+     <cpuid eax_in='0x01' ecx='0x00000010'/>
+   </feature>
+   <feature name='vmx'>
+@@ -149,10 +152,14 @@
+   <feature name='dca'>
+     <cpuid eax_in='0x01' ecx='0x00040000'/>
+   </feature>
+-  <feature name='sse4.1'> <!-- sse4-1, sse4_1 -->
++  <feature name='sse4.1'>
++    <alias name='sse4-1' source='qemu'/>
++    <alias name='sse4_1' source='qemu'/>
+     <cpuid eax_in='0x01' ecx='0x00080000'/>
+   </feature>
+-  <feature name='sse4.2'> <!-- sse4-2, sse4_2 -->
++  <feature name='sse4.2'>
++    <alias name='sse4-2' source='qemu'/>
++    <alias name='sse4_2' source='qemu'/>
+     <cpuid eax_in='0x01' ecx='0x00100000'/>
+   </feature>
+   <feature name='x2apic'>
+@@ -198,7 +205,8 @@
+   <feature name='fsgsbase'>
+     <cpuid eax_in='0x07' ecx_in='0x00' ebx='0x00000001'/>
+   </feature>
+-  <feature name='tsc_adjust'> <!-- tsc-adjust -->
++  <feature name='tsc_adjust'>
++    <alias name='tsc-adjust' source='qemu'/>
+     <cpuid eax_in='0x07' ecx_in='0x00' ebx='0x00000002'/>
+   </feature>
+   <feature name='bmi1'>
+@@ -225,7 +233,8 @@
+   <feature name='rtm'>
+     <cpuid eax_in='0x07' ecx_in='0x00' ebx='0x00000800'/>
+   </feature>
+-  <feature name='cmt'> <!-- cqm -->
++  <feature name='cmt'>
++    <alias name='cqm' source='linux'/>
+     <cpuid eax_in='0x07' ecx_in='0x00' ebx='0x00001000'/>
+   </feature>
+   <feature name='mpx'>
+@@ -341,7 +350,8 @@
+   <feature name='fsrm'>
+     <cpuid eax_in='0x07' ecx_in='0x00' edx='0x00000010'/>
+   </feature>
+-  <feature name='md-clear'> <!-- md_clear -->
++  <feature name='md-clear'>
++    <alias name='md_clear' source='linux'/>
+     <cpuid eax_in='0x07' ecx_in='0x00' edx='0x00000400'/>
+   </feature>
+   <feature name='pconfig'>
+@@ -362,7 +372,8 @@
+   <feature name='stibp'>
+     <cpuid eax_in='0x07' ecx_in='0x00' edx='0x08000000'/>
+   </feature>
+-  <feature name='arch-capabilities'> <!-- arch_capabilities, arch-facilities -->
++  <feature name='arch-capabilities'>
++    <alias name='arch_capabilities' source='linux'/>
+     <cpuid eax_in='0x07' ecx_in='0x00' edx='0x20000000'/>
+   </feature>
+   <feature name='core-capability'>
+@@ -405,13 +416,16 @@
+   <feature name='syscall'>
+     <cpuid eax_in='0x80000001' edx='0x00000800'/>
+   </feature>
+-  <feature name='nx'> <!-- xd -->
++  <feature name='nx'>
++    <alias name='xd' source='qemu'/>
+     <cpuid eax_in='0x80000001' edx='0x00100000'/>
+   </feature>
+   <feature name='mmxext'>
+     <cpuid eax_in='0x80000001' edx='0x00400000'/>
+   </feature>
+-  <feature name='fxsr_opt'> <!-- ffxsr, fxsr-opt -->
++  <feature name='fxsr_opt'>
++    <alias name='ffxsr' source='qemu'/>
++    <alias name='fxsr-opt' source='qemu'/>
+     <cpuid eax_in='0x80000001' edx='0x02000000'/>
+   </feature>
+   <feature name='pdpe1gb'>
+@@ -420,7 +434,8 @@
+   <feature name='rdtscp'>
+     <cpuid eax_in='0x80000001' edx='0x08000000'/>
+   </feature>
+-  <feature name='lm'> <!-- i64 -->
++  <feature name='lm'>
++    <alias name='i64' source='qemu'/>
+     <cpuid eax_in='0x80000001' edx='0x20000000'/>
+   </feature>
+   <feature name='3dnowext'>
+@@ -431,10 +446,12 @@
+   </feature>
+ 
+   <!-- extended features, ECX -->
+-  <feature name='lahf_lm'> <!-- lahf-lm -->
++  <feature name='lahf_lm'>
++    <alias name='lahf-lm' source='qemu'/>
+     <cpuid eax_in='0x80000001' ecx='0x00000001'/>
+   </feature>
+-  <feature name='cmp_legacy'> <!-- cmp-legacy -->
++  <feature name='cmp_legacy'>
++    <alias name='cmp-legacy' source='qemu'/>
+     <cpuid eax_in='0x80000001' ecx='0x00000002'/>
+   </feature>
+   <feature name='svm'>
+@@ -485,7 +502,8 @@
+   <feature name='cvt16'>
+     <cpuid eax_in='0x80000001' ecx='0x00040000'/>
+   </feature>
+-  <feature name='nodeid_msr'> <!-- nodeid-msr -->
++  <feature name='nodeid_msr'>
++    <alias name='nodeid-msr' source='qemu'/>
+     <cpuid eax_in='0x80000001' ecx='0x00080000'/>
+   </feature>
+   <feature name='tbm'>
+@@ -494,10 +512,12 @@
+   <feature name='topoext'>
+     <cpuid eax_in='0x80000001' ecx='0x00400000'/>
+   </feature>
+-  <feature name='perfctr_core'> <!-- perfctr-core -->
++  <feature name='perfctr_core'>
++    <alias name='perfctr-core' source='qemu'/>
+     <cpuid eax_in='0x80000001' ecx='0x00800000'/>
+   </feature>
+-  <feature name='perfctr_nb'> <!-- perfctr-nb -->
++  <feature name='perfctr_nb'>
++    <alias name='perfctr-nb' source='qemu'/>
+     <cpuid eax_in='0x80000001' ecx='0x01000000'/>
+   </feature>
+ 
diff --git a/debian/patches/ubuntu/lp-2028057-04-qemu-i386-sync-cpu-features.patch b/debian/patches/ubuntu/lp-2028057-04-qemu-i386-sync-cpu-features.patch
new file mode 100644
index 0000000..97b9f2a
--- /dev/null
+++ b/debian/patches/ubuntu/lp-2028057-04-qemu-i386-sync-cpu-features.patch
@@ -0,0 +1,292 @@
+Description: Add script to sync from QEMU i386 cpu features.
+ This script is intended to help in synchronizing i386 QEMU cpu feature
+ definitions with libvirt. QEMU's attribute list for the "max-x86_64-cpu"
+ contains non-cpu-feature items and needs to be filtered before being useful.
+Author: Tim Wiederhake <[e-mail]>
+Origin: upstream, https://gitlab.com/libvirt/libvirt/-/commit/fe69966cbbdd51e409506bd485e75b317fde8fbb
+Bug-Ubuntu: https://launchpad.net/bugs/2028057
+Forwarded: not-needed
+Last-Update: 2023-11-29
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+--- /dev/null
++++ b/src/cpu_map/sync_qemu_features_i386.py
+@@ -0,0 +1,278 @@
++#!/usr/bin/env python3
++
++import argparse
++import json
++import subprocess
++import xml.etree.ElementTree
++
++
++def ignore_feature(feature):
++    ignored_features = [
++        # VIA/Cyrix/Centaur-defined CPU features
++        # CPUID level 0xC0000001, word 5
++        "ace2",
++        "ace2-en",
++        "phe",
++        "phe-en",
++        "pmm",
++        "pmm-en",
++        "xcrypt",
++        "xcrypt-en",
++        "xstore",
++        "xstore-en",
++
++        # non-features
++        "check",
++        "cpuid-0xb",
++        "enforce",
++        "fill-mtrr-mask",
++        "full-cpuid-auto-level",
++        "full-width-write",
++        "host-cache-info",
++        "host-phys-bits",
++        "hotpluggable",
++        "hotplugged",
++        "hv-apicv",
++        "hv-avic",
++        "hv-crash",
++        "hv-emsr-bitmap",
++        "hv-enforce-cpuid",
++        "hv-evmcs",
++        "hv-frequencies",
++        "hv-ipi",
++        "hv-passthrough",
++        "hv-reenlightenment",
++        "hv-relaxed",
++        "hv-reset",
++        "hv-runtime",
++        "hv-stimer",
++        "hv-stimer-direct",
++        "hv-syndbg",
++        "hv-synic",
++        "hv-time",
++        "hv-tlbflush",
++        "hv-tlbflush-direct",
++        "hv-tlbflush-ext",
++        "hv-vapic",
++        "hv-vpindex",
++        "hv-xmm-input",
++        "kvm",
++        "kvm-asyncpf",
++        "kvm-asyncpf-int",
++        "kvm-hint-dedicated",
++        "kvm-mmu",
++        "kvm-msi-ext-dest-id",
++        "kvm-no-smi-migration",
++        "kvm-nopiodelay",
++        "kvm-poll-control",
++        "kvm-pv-enforce-cpuid",
++        "kvm-pv-eoi",
++        "kvm-pv-ipi",
++        "kvm-pv-sched-yield",
++        "kvm-pv-tlb-flush",
++        "kvm-pv-unhalt",
++        "kvm-steal-time",
++        "kvm_asyncpf",
++        "kvm_asyncpf_int",
++        "kvm_mmu",
++        "kvm_nopiodelay",
++        "kvm_poll_control",
++        "kvm_pv_eoi",
++        "kvm_pv_unhalt",
++        "kvm_steal_time",
++        "kvmclock",
++        "kvmclock-stable-bit",
++        "l3-cache",
++        "legacy-cache",
++        "lmce",
++        "migratable",
++        "pmu",
++        "realized",
++        "start-powered-off",
++        "tcg-cpuid",
++        "vmware-cpuid-freq",
++        "vmx-activity-hlt",
++        "vmx-activity-shutdown",
++        "vmx-activity-wait-sipi",
++        "vmx-apicv-register",
++        "vmx-apicv-vid",
++        "vmx-apicv-x2apic",
++        "vmx-apicv-xapic",
++        "vmx-cr3-load-noexit",
++        "vmx-cr3-store-noexit",
++        "vmx-cr8-load-exit",
++        "vmx-cr8-store-exit",
++        "vmx-desc-exit",
++        "vmx-encls-exit",
++        "vmx-entry-ia32e-mode",
++        "vmx-entry-load-bndcfgs",
++        "vmx-entry-load-efer",
++        "vmx-entry-load-pat",
++        "vmx-entry-load-perf-global-ctrl",
++        "vmx-entry-load-pkrs",
++        "vmx-entry-load-rtit-ctl",
++        "vmx-entry-noload-debugctl",
++        "vmx-ept",
++        "vmx-ept-1gb",
++        "vmx-ept-2mb",
++        "vmx-ept-advanced-exitinfo",
++        "vmx-ept-execonly",
++        "vmx-eptad",
++        "vmx-eptp-switching",
++        "vmx-exit-ack-intr",
++        "vmx-exit-clear-bndcfgs",
++        "vmx-exit-clear-rtit-ctl",
++        "vmx-exit-load-efer",
++        "vmx-exit-load-pat",
++        "vmx-exit-load-perf-global-ctrl",
++        "vmx-exit-load-pkrs",
++        "vmx-exit-nosave-debugctl",
++        "vmx-exit-save-efer",
++        "vmx-exit-save-pat",
++        "vmx-exit-save-preemption-timer",
++        "vmx-flexpriority",
++        "vmx-hlt-exit",
++        "vmx-ins-outs",
++        "vmx-intr-exit",
++        "vmx-invept",
++        "vmx-invept-all-context",
++        "vmx-invept-single-context",
++        "vmx-invept-single-context-noglobals",
++        "vmx-invlpg-exit",
++        "vmx-invpcid-exit",
++        "vmx-invvpid",
++        "vmx-invvpid-all-context",
++        "vmx-invvpid-single-addr",
++        "vmx-io-bitmap",
++        "vmx-io-exit",
++        "vmx-monitor-exit",
++        "vmx-movdr-exit",
++        "vmx-msr-bitmap",
++        "vmx-mtf",
++        "vmx-mwait-exit",
++        "vmx-nmi-exit",
++        "vmx-page-walk-4",
++        "vmx-page-walk-5",
++        "vmx-pause-exit",
++        "vmx-ple",
++        "vmx-pml",
++        "vmx-posted-intr",
++        "vmx-preemption-timer",
++        "vmx-rdpmc-exit",
++        "vmx-rdrand-exit",
++        "vmx-rdseed-exit",
++        "vmx-rdtsc-exit",
++        "vmx-rdtscp-exit",
++        "vmx-secondary-ctls",
++        "vmx-shadow-vmcs",
++        "vmx-store-lma",
++        "vmx-true-ctls",
++        "vmx-tsc-offset",
++        "vmx-tsc-scaling",
++        "vmx-unrestricted-guest",
++        "vmx-vintr-pending",
++        "vmx-vmfunc",
++        "vmx-vmwrite-vmexit-fields",
++        "vmx-vnmi",
++        "vmx-vnmi-pending",
++        "vmx-vpid",
++        "vmx-wbinvd-exit",
++        "vmx-xsaves",
++        "vmx-zero-len-inject",
++    ]
++
++    if feature["type"] != "bool":
++        return True
++
++    name = feature["name"]
++
++    if name.startswith("x-"):
++        return True
++
++    if name in ignored_features:
++        return True
++
++    return False
++
++
++def get_qemu_feature_list(path_to_qemu):
++    cmd = [
++        path_to_qemu,
++        "-machine", "accel=kvm",
++        "-cpu", "host",
++        "-nodefaults",
++        "-nographic",
++        "-qmp",
++        "stdio"
++    ]
++
++    request = """
++    {
++        "execute": "qmp_capabilities"
++    }
++    {
++        "execute": "qom-list-properties",
++        "arguments": {
++            "typename": "max-x86_64-cpu"
++        },
++        "id": "qom-list-properties"
++    }
++    {
++        "execute": "quit"
++    }
++    """
++
++    decoder = json.JSONDecoder()
++    output = subprocess.check_output(cmd, input=request, text=True)
++    while output:
++        obj, idx = decoder.raw_decode(output)
++        output = output[idx:].strip()
++        if obj.get("id") != "qom-list-properties":
++            continue
++        for feature in obj["return"]:
++            if ignore_feature(feature):
++                continue
++            yield feature["name"]
++
++
++def get_libvirt_feature_list(path_to_featuresfile):
++    dom = xml.etree.ElementTree.parse(path_to_featuresfile)
++    for feature in dom.getroot().iter("feature"):
++        yield feature.get("name")
++        for alias in feature:
++            if alias.tag == "alias" and alias.get("source") == "qemu":
++                yield alias.get("name")
++
++
++def main():
++    parser = argparse.ArgumentParser(
++        description="Synchronize x86 cpu features from QEMU i386 target.")
++    parser.add_argument(
++        "--qemu",
++        help="Path to qemu executable",
++        default="qemu-system-x86_64",
++        type=str)
++    parser.add_argument(
++        "--features",
++        help="Path to 'src/cpu_map/x86_features.xml' file in "
++             "the libvirt repository",
++        default="x86_features.xml",
++        type=str)
++
++    args = parser.parse_args()
++
++    qfeatures = get_qemu_feature_list(args.qemu)
++    lfeatures = list(get_libvirt_feature_list(args.features))
++    missing = [f for f in sorted(qfeatures) if f not in lfeatures]
++
++    if missing:
++        print("The following features were reported by qemu but are "
++              "unknown to libvirt:")
++        for feature in missing:
++            print(" *", feature)
++
++    return len(missing) != 0
++
++
++if __name__ == "__main__":
++    exit(main())
diff --git a/debian/patches/ubuntu/lp-2028057-05-add-missing-feature-amx.patch b/debian/patches/ubuntu/lp-2028057-05-add-missing-feature-amx.patch
new file mode 100644
index 0000000..a44564b
--- /dev/null
+++ b/debian/patches/ubuntu/lp-2028057-05-add-missing-feature-amx.patch
@@ -0,0 +1,41 @@
+Description: Add cpu feature amx.
+ AMX is one of the features used in Sapphire Rapids CPUs. This patch adds
+ feature definitions for amx-bf16, amx-tile, and amx-int8, and syncs them
+ with QEMU using the script added in the previous patch.
+Author: Lin Yang <[e-mail]>
+Origin: upstream, https://gitlab.com/libvirt/libvirt/-/commit/e528717d9039e1f571c6546f2ea9c6ba55e2507a
+Bug-Ubuntu: https://launchpad.net/bugs/2028057
+Forwarded: not-needed
+Last-Update: 2023-11-29
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+--- a/src/cpu_map/sync_qemu_i386.py
++++ b/src/cpu_map/sync_qemu_i386.py
+@@ -72,6 +72,9 @@
+         "CPUID_7_0_EDX_SPEC_CTRL": "spec-ctrl",
+         "CPUID_7_0_EDX_SPEC_CTRL_SSBD": "ssbd",
+         "CPUID_7_0_EDX_STIBP": "stibp",
++        "CPUID_7_0_EDX_AMX_BF16": "amx-bf16",
++        "CPUID_7_0_EDX_AMX_TILE": "amx-tile",
++        "CPUID_7_0_EDX_AMX_INT8": "amx-int8",
+         "CPUID_7_1_EAX_AVX512_BF16": "avx512-bf16",
+         "CPUID_7_1_EAX_AVX_VNNI": "avx-vnni",
+         "CPUID_8000_0008_EBX_AMD_SSBD": "amd-ssbd",
+--- a/src/cpu_map/x86_features.xml
++++ b/src/cpu_map/x86_features.xml
+@@ -347,6 +347,15 @@
+   <feature name='pconfig'>
+     <cpuid eax_in='0x07' ecx_in='0x00' edx='0x00040000'/>
+   </feature>
++  <feature name='amx-bf16'>
++    <cpuid eax_in='0x07' ecx_in='0x00' edx='0x00400000'/>
++  </feature>
++  <feature name='amx-tile'>
++    <cpuid eax_in='0x07' ecx_in='0x00' edx='0x01000000'/>
++  </feature>
++  <feature name='amx-int8'>
++    <cpuid eax_in='0x07' ecx_in='0x00' edx='0x02000000'/>
++  </feature>
+   <feature name='spec-ctrl'>
+     <cpuid eax_in='0x07' ecx_in='0x00' edx='0x04000000'/>
+   </feature>
diff --git a/debian/patches/ubuntu/lp-2028057-06-qemu-i386-rename-file.patch b/debian/patches/ubuntu/lp-2028057-06-qemu-i386-rename-file.patch
new file mode 100644
index 0000000..9607a9b
--- /dev/null
+++ b/debian/patches/ubuntu/lp-2028057-06-qemu-i386-rename-file.patch
@@ -0,0 +1,15 @@
+Description: Rename sync_qemu_i386.py to sync_qemu_models_i386.py.
+ The QEMU sync script was renamed upstream to make naming more consistent. This
+ patch is included to make the script work alongside the other patches for
+ Sapphire Rapids.
+Author: Tim Wiederhake <[e-mail]>
+Origin: upstream, https://gitlab.com/libvirt/libvirt/-/commit/84080aabc0f9959b16e60cffeb634f420f86df0f
+Bug-Ubuntu: https://launchpad.net/bugs/2028057
+Forwarded: not-needed
+Last-Update: 2023-11-29
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+diff --git a/src/cpu_map/sync_qemu_i386.py b/src/cpu_map/sync_qemu_models_i386.py
+similarity index 100%
+rename from src/cpu_map/sync_qemu_i386.py
+rename to src/cpu_map/sync_qemu_models_i386.py
diff --git a/debian/patches/ubuntu/lp-2028057-07-alias-names-add-to-features.patch b/debian/patches/ubuntu/lp-2028057-07-alias-names-add-to-features.patch
new file mode 100644
index 0000000..8a82467
--- /dev/null
+++ b/debian/patches/ubuntu/lp-2028057-07-alias-names-add-to-features.patch
@@ -0,0 +1,39 @@
+Description: Add alias names for some features.
+ Add alias names for features with names that have '_' instead of '-' in QEMU.
+Author: Tim Wiederhake <[e-mail]>
+Origin: upstream, https://gitlab.com/libvirt/libvirt/-/commit/eb9912b4877b526f254af05f20c15a63fc633320
+Bug-Ubuntu: https://launchpad.net/bugs/2028057
+Forwarded: not-needed
+Last-Update: 2023-11-29
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+--- a/src/cpu_map/x86_features.xml
++++ b/src/cpu_map/x86_features.xml
+@@ -563,15 +563,19 @@
+     <cpuid eax_in='0x8000000a' edx='0x00000002'/>
+   </feature>
+   <feature name='svm-lock'>
++    <alias name='svm_lock' source='qemu'/>
+     <cpuid eax_in='0x8000000a' edx='0x00000004'/>
+   </feature>
+   <feature name='nrip-save'>
++    <alias name='nrip_save' source='qemu'/>
+     <cpuid eax_in='0x8000000a' edx='0x00000008'/>
+   </feature>
+   <feature name='tsc-scale'>
++    <alias name='tsc_scale' source='qemu'/>
+     <cpuid eax_in='0x8000000a' edx='0x00000010'/>
+   </feature>
+   <feature name='vmcb-clean'>
++    <alias name='vmcb_clean' source='qemu'/>
+     <cpuid eax_in='0x8000000a' edx='0x00000020'/>
+   </feature>
+   <feature name='flushbyasid'>
+@@ -581,6 +585,7 @@
+     <cpuid eax_in='0x8000000a' edx='0x00000080'/>
+   </feature>
+   <feature name='pause-filter'>
++    <alias name='pause_filter' source='qemu'/>
+     <cpuid eax_in='0x8000000a' edx='0x00000400'/>
+   </feature>
+   <feature name='pfthreshold'>
diff --git a/debian/patches/ubuntu/lp-2028057-08-add-missing-feature-sgx.patch b/debian/patches/ubuntu/lp-2028057-08-add-missing-feature-sgx.patch
new file mode 100644
index 0000000..b2a21bb
--- /dev/null
+++ b/debian/patches/ubuntu/lp-2028057-08-add-missing-feature-sgx.patch
@@ -0,0 +1,236 @@
+Description: Add cpu feature sgx.
+ This patch adds the feature definition for SGX, and adds the feature to the
+ relevant existing processors - i7-7700, i7-8550U, i7-8700, IceLake Server,
+ Xeon E3-1225-v5, and Xeon E3-1245-v5.
+Author: Tim Wiederhake <[e-mail]>
+Origin: upstream, https://gitlab.com/libvirt/libvirt/-/commit/24b95e07d27d73576eca5d2852a10103b4e4d3d1
+Bug-Ubuntu: https://launchpad.net/bugs/2028057
+Forwarded: not-needed
+Last-Update: 2023-11-29
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+--- a/src/cpu_map/x86_features.xml
++++ b/src/cpu_map/x86_features.xml
+@@ -209,6 +209,9 @@
+     <alias name='tsc-adjust' source='qemu'/>
+     <cpuid eax_in='0x07' ecx_in='0x00' ebx='0x00000002'/>
+   </feature>
++  <feature name='sgx'>
++    <cpuid eax_in='0x07' ecx_in='0x00' ebx='0x00000004'/>
++  </feature>
+   <feature name='bmi1'>
+     <cpuid eax_in='0x07' ecx_in='0x00' ebx='0x00000008'/>
+   </feature>
+--- a/tests/cputestdata/x86_64-cpuid-Core-i7-7600U-disabled.xml
++++ b/tests/cputestdata/x86_64-cpuid-Core-i7-7600U-disabled.xml
+@@ -1,6 +1,6 @@
+ <!-- Features disabled by QEMU -->
+ <cpudata arch='x86'>
+   <cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x0800c1dc' edx='0xb0600000'/>
+-  <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02000000' ecx='0x00000000' edx='0x08000000'/>
++  <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02000004' ecx='0x00000000' edx='0x08000000'/>
+   <cpuid eax_in='0x80000007' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000100'/>
+ </cpudata>
+--- a/tests/cputestdata/x86_64-cpuid-Core-i7-7600U-guest.xml
++++ b/tests/cputestdata/x86_64-cpuid-Core-i7-7600U-guest.xml
+@@ -18,6 +18,7 @@
+   <feature policy='require' name='pdcm'/>
+   <feature policy='require' name='osxsave'/>
+   <feature policy='require' name='tsc_adjust'/>
++  <feature policy='require' name='sgx'/>
+   <feature policy='require' name='clflushopt'/>
+   <feature policy='require' name='intel-pt'/>
+   <feature policy='require' name='stibp'/>
+--- a/tests/cputestdata/x86_64-cpuid-Core-i7-7600U-host.xml
++++ b/tests/cputestdata/x86_64-cpuid-Core-i7-7600U-host.xml
+@@ -20,6 +20,7 @@
+   <feature name='pdcm'/>
+   <feature name='osxsave'/>
+   <feature name='tsc_adjust'/>
++  <feature name='sgx'/>
+   <feature name='clflushopt'/>
+   <feature name='intel-pt'/>
+   <feature name='stibp'/>
+--- a/tests/cputestdata/x86_64-cpuid-Core-i7-7700-disabled.xml
++++ b/tests/cputestdata/x86_64-cpuid-Core-i7-7700-disabled.xml
+@@ -1,7 +1,7 @@
+ <!-- Features disabled by QEMU -->
+ <cpudata arch='x86'>
+   <cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x0800c1fc' edx='0xb0600000'/>
+-  <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02000000' ecx='0x00000000' edx='0x00000000'/>
++  <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02000004' ecx='0x00000000' edx='0x00000000'/>
+   <cpuid eax_in='0x0000000d' ecx_in='0x01' eax='0x00000008' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
+   <cpuid eax_in='0x80000007' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000100'/>
+ </cpudata>
+--- a/tests/cputestdata/x86_64-cpuid-Core-i7-7700-guest.xml
++++ b/tests/cputestdata/x86_64-cpuid-Core-i7-7700-guest.xml
+@@ -18,6 +18,7 @@
+   <feature policy='require' name='pdcm'/>
+   <feature policy='require' name='osxsave'/>
+   <feature policy='require' name='tsc_adjust'/>
++  <feature policy='require' name='sgx'/>
+   <feature policy='require' name='clflushopt'/>
+   <feature policy='require' name='intel-pt'/>
+   <feature policy='require' name='xsaves'/>
+--- a/tests/cputestdata/x86_64-cpuid-Core-i7-7700-host.xml
++++ b/tests/cputestdata/x86_64-cpuid-Core-i7-7700-host.xml
+@@ -20,6 +20,7 @@
+   <feature name='pdcm'/>
+   <feature name='osxsave'/>
+   <feature name='tsc_adjust'/>
++  <feature name='sgx'/>
+   <feature name='clflushopt'/>
+   <feature name='intel-pt'/>
+   <feature name='xsaves'/>
+--- a/tests/cputestdata/x86_64-cpuid-Core-i7-8550U-disabled.xml
++++ b/tests/cputestdata/x86_64-cpuid-Core-i7-8550U-disabled.xml
+@@ -1,6 +1,6 @@
+ <!-- Features disabled by QEMU -->
+ <cpudata arch='x86'>
+   <cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x0800c19c' edx='0xb0600000'/>
+-  <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02000000' ecx='0x00000000' edx='0x00000000'/>
++  <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02000004' ecx='0x00000000' edx='0x00000000'/>
+   <cpuid eax_in='0x80000007' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000100'/>
+ </cpudata>
+--- a/tests/cputestdata/x86_64-cpuid-Core-i7-8550U-guest.xml
++++ b/tests/cputestdata/x86_64-cpuid-Core-i7-8550U-guest.xml
+@@ -17,6 +17,7 @@
+   <feature policy='require' name='pdcm'/>
+   <feature policy='require' name='osxsave'/>
+   <feature policy='require' name='tsc_adjust'/>
++  <feature policy='require' name='sgx'/>
+   <feature policy='require' name='clflushopt'/>
+   <feature policy='require' name='intel-pt'/>
+   <feature policy='require' name='md-clear'/>
+--- a/tests/cputestdata/x86_64-cpuid-Core-i7-8550U-host.xml
++++ b/tests/cputestdata/x86_64-cpuid-Core-i7-8550U-host.xml
+@@ -19,6 +19,7 @@
+   <feature name='pdcm'/>
+   <feature name='osxsave'/>
+   <feature name='tsc_adjust'/>
++  <feature name='sgx'/>
+   <feature name='clflushopt'/>
+   <feature name='intel-pt'/>
+   <feature name='md-clear'/>
+--- a/tests/cputestdata/x86_64-cpuid-Core-i7-8700-disabled.xml
++++ b/tests/cputestdata/x86_64-cpuid-Core-i7-8700-disabled.xml
+@@ -1,6 +1,6 @@
+ <!-- Features disabled by QEMU -->
+ <cpudata arch='x86'>
+   <cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x0800c1fc' edx='0xb0600000'/>
+-  <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02000000' ecx='0x00000000' edx='0x08000000'/>
++  <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02000004' ecx='0x00000000' edx='0x08000000'/>
+   <cpuid eax_in='0x80000007' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000100'/>
+ </cpudata>
+--- a/tests/cputestdata/x86_64-cpuid-Core-i7-8700-guest.xml
++++ b/tests/cputestdata/x86_64-cpuid-Core-i7-8700-guest.xml
+@@ -18,6 +18,7 @@
+   <feature policy='require' name='pdcm'/>
+   <feature policy='require' name='osxsave'/>
+   <feature policy='require' name='tsc_adjust'/>
++  <feature policy='require' name='sgx'/>
+   <feature policy='require' name='clflushopt'/>
+   <feature policy='require' name='intel-pt'/>
+   <feature policy='require' name='stibp'/>
+--- a/tests/cputestdata/x86_64-cpuid-Core-i7-8700-host.xml
++++ b/tests/cputestdata/x86_64-cpuid-Core-i7-8700-host.xml
+@@ -20,6 +20,7 @@
+   <feature name='pdcm'/>
+   <feature name='osxsave'/>
+   <feature name='tsc_adjust'/>
++  <feature name='sgx'/>
+   <feature name='clflushopt'/>
+   <feature name='intel-pt'/>
+   <feature name='stibp'/>
+--- a/tests/cputestdata/x86_64-cpuid-Ice-Lake-Server-disabled.xml
++++ b/tests/cputestdata/x86_64-cpuid-Ice-Lake-Server-disabled.xml
+@@ -1,7 +1,7 @@
+ <!-- Features disabled by QEMU -->
+ <cpudata arch='x86'>
+   <cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x0804c1fc' edx='0xb0600000'/>
+-  <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02001000' ecx='0x00400010' edx='0x00000010'/>
++  <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02001004' ecx='0x00400010' edx='0x00000010'/>
+   <cpuid eax_in='0x0000000f' ecx_in='0x01' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000006'/>
+   <cpuid eax_in='0x80000007' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000100'/>
+ </cpudata>
+--- a/tests/cputestdata/x86_64-cpuid-Ice-Lake-Server-guest.xml
++++ b/tests/cputestdata/x86_64-cpuid-Ice-Lake-Server-guest.xml
+@@ -19,6 +19,7 @@
+   <feature policy='require' name='dca'/>
+   <feature policy='require' name='osxsave'/>
+   <feature policy='require' name='tsc_adjust'/>
++  <feature policy='require' name='sgx'/>
+   <feature policy='require' name='cmt'/>
+   <feature policy='require' name='avx512ifma'/>
+   <feature policy='require' name='intel-pt'/>
+--- a/tests/cputestdata/x86_64-cpuid-Ice-Lake-Server-host.xml
++++ b/tests/cputestdata/x86_64-cpuid-Ice-Lake-Server-host.xml
+@@ -21,6 +21,7 @@
+   <feature name='dca'/>
+   <feature name='osxsave'/>
+   <feature name='tsc_adjust'/>
++  <feature name='sgx'/>
+   <feature name='cmt'/>
+   <feature name='avx512ifma'/>
+   <feature name='intel-pt'/>
+--- a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-disabled.xml
++++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-disabled.xml
+@@ -1,7 +1,7 @@
+ <!-- Features disabled by QEMU -->
+ <cpudata arch='x86'>
+   <cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x0800c1fc' edx='0xb0600000'/>
+-  <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02000000' ecx='0x00000000' edx='0x00000000'/>
++  <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02000004' ecx='0x00000000' edx='0x00000000'/>
+   <cpuid eax_in='0x0000000d' ecx_in='0x01' eax='0x00000008' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
+   <cpuid eax_in='0x80000007' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000100'/>
+ </cpudata>
+--- a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml
++++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml
+@@ -18,6 +18,7 @@
+   <feature policy='require' name='pdcm'/>
+   <feature policy='require' name='osxsave'/>
+   <feature policy='require' name='tsc_adjust'/>
++  <feature policy='require' name='sgx'/>
+   <feature policy='require' name='clflushopt'/>
+   <feature policy='require' name='intel-pt'/>
+   <feature policy='require' name='md-clear'/>
+--- a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml
++++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml
+@@ -20,6 +20,7 @@
+   <feature name='pdcm'/>
+   <feature name='osxsave'/>
+   <feature name='tsc_adjust'/>
++  <feature name='sgx'/>
+   <feature name='clflushopt'/>
+   <feature name='intel-pt'/>
+   <feature name='md-clear'/>
+--- a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1245-v5-disabled.xml
++++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1245-v5-disabled.xml
+@@ -1,6 +1,6 @@
+ <!-- Features disabled by QEMU -->
+ <cpudata arch='x86'>
+   <cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x0800c1dc' edx='0xb0600000'/>
+-  <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02000000' ecx='0x00000000' edx='0x00000000'/>
++  <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02000004' ecx='0x00000000' edx='0x00000000'/>
+   <cpuid eax_in='0x80000007' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000100'/>
+ </cpudata>
+--- a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1245-v5-guest.xml
++++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1245-v5-guest.xml
+@@ -18,6 +18,7 @@
+   <feature policy='require' name='pdcm'/>
+   <feature policy='require' name='osxsave'/>
+   <feature policy='require' name='tsc_adjust'/>
++  <feature policy='require' name='sgx'/>
+   <feature policy='require' name='clflushopt'/>
+   <feature policy='require' name='intel-pt'/>
+   <feature policy='require' name='xsaves'/>
+--- a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1245-v5-host.xml
++++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1245-v5-host.xml
+@@ -20,6 +20,7 @@
+   <feature name='pdcm'/>
+   <feature name='osxsave'/>
+   <feature name='tsc_adjust'/>
++  <feature name='sgx'/>
+   <feature name='clflushopt'/>
+   <feature name='intel-pt'/>
+   <feature name='xsaves'/>
diff --git a/debian/patches/ubuntu/lp-2028057-09-add-missing-feature-sgxlc.patch b/debian/patches/ubuntu/lp-2028057-09-add-missing-feature-sgxlc.patch
new file mode 100644
index 0000000..497db74
--- /dev/null
+++ b/debian/patches/ubuntu/lp-2028057-09-add-missing-feature-sgxlc.patch
@@ -0,0 +1,83 @@
+Description: Add cpu feature sgxlc.
+ This patch adds the feature definition for SGX LC, and adds the feature to the
+ relevant existing processors - i7-8700 and IceLake Server.
+Author: Tim Wiederhake <[e-mail]>
+Origin: upstream, https://gitlab.com/libvirt/libvirt/-/commit/6e84509cde99bfa2e9854e0d2c38bfe2b13340c0
+Bug-Ubuntu: https://launchpad.net/bugs/2028057
+Forwarded: not-needed
+Last-Update: 2023-11-29
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+--- a/src/cpu_map/x86_features.xml
++++ b/src/cpu_map/x86_features.xml
+@@ -343,6 +343,9 @@
+   <feature name='movdir64b'>
+     <cpuid eax_in='0x07' ecx_in='0x00' ecx='0x10000000'/>
+   </feature>
++  <feature name='sgxlc'>
++    <cpuid eax_in='0x07' ecx_in='0x00' ecx='0x40000000'/>
++  </feature>
+ 
+   <feature name='avx512-4vnniw'>
+     <cpuid eax_in='0x07' ecx_in='0x00' edx='0x00000004'/>
+--- a/tests/cputestdata/x86_64-cpuid-Core-i7-8700-disabled.xml
++++ b/tests/cputestdata/x86_64-cpuid-Core-i7-8700-disabled.xml
+@@ -1,6 +1,6 @@
+ <!-- Features disabled by QEMU -->
+ <cpudata arch='x86'>
+   <cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x0800c1fc' edx='0xb0600000'/>
+-  <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02000004' ecx='0x00000000' edx='0x08000000'/>
++  <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02000004' ecx='0x40000000' edx='0x08000000'/>
+   <cpuid eax_in='0x80000007' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000100'/>
+ </cpudata>
+--- a/tests/cputestdata/x86_64-cpuid-Core-i7-8700-guest.xml
++++ b/tests/cputestdata/x86_64-cpuid-Core-i7-8700-guest.xml
+@@ -21,6 +21,7 @@
+   <feature policy='require' name='sgx'/>
+   <feature policy='require' name='clflushopt'/>
+   <feature policy='require' name='intel-pt'/>
++  <feature policy='require' name='sgxlc'/>
+   <feature policy='require' name='stibp'/>
+   <feature policy='require' name='ssbd'/>
+   <feature policy='require' name='xsaves'/>
+--- a/tests/cputestdata/x86_64-cpuid-Core-i7-8700-host.xml
++++ b/tests/cputestdata/x86_64-cpuid-Core-i7-8700-host.xml
+@@ -23,6 +23,7 @@
+   <feature name='sgx'/>
+   <feature name='clflushopt'/>
+   <feature name='intel-pt'/>
++  <feature name='sgxlc'/>
+   <feature name='stibp'/>
+   <feature name='ssbd'/>
+   <feature name='xsaves'/>
+--- a/tests/cputestdata/x86_64-cpuid-Ice-Lake-Server-disabled.xml
++++ b/tests/cputestdata/x86_64-cpuid-Ice-Lake-Server-disabled.xml
+@@ -1,7 +1,7 @@
+ <!-- Features disabled by QEMU -->
+ <cpudata arch='x86'>
+   <cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x0804c1fc' edx='0xb0600000'/>
+-  <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02001004' ecx='0x00400010' edx='0x00000010'/>
++  <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02001004' ecx='0x40400010' edx='0x00000010'/>
+   <cpuid eax_in='0x0000000f' ecx_in='0x01' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000006'/>
+   <cpuid eax_in='0x80000007' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000100'/>
+ </cpudata>
+--- a/tests/cputestdata/x86_64-cpuid-Ice-Lake-Server-guest.xml
++++ b/tests/cputestdata/x86_64-cpuid-Ice-Lake-Server-guest.xml
+@@ -26,6 +26,7 @@
+   <feature policy='require' name='sha-ni'/>
+   <feature policy='require' name='ospke'/>
+   <feature policy='require' name='rdpid'/>
++  <feature policy='require' name='sgxlc'/>
+   <feature policy='require' name='fsrm'/>
+   <feature policy='require' name='stibp'/>
+   <feature policy='require' name='arch-capabilities'/>
+--- a/tests/cputestdata/x86_64-cpuid-Ice-Lake-Server-host.xml
++++ b/tests/cputestdata/x86_64-cpuid-Ice-Lake-Server-host.xml
+@@ -28,6 +28,7 @@
+   <feature name='sha-ni'/>
+   <feature name='ospke'/>
+   <feature name='rdpid'/>
++  <feature name='sgxlc'/>
+   <feature name='fsrm'/>
+   <feature name='stibp'/>
+   <feature name='arch-capabilities'/>
diff --git a/debian/patches/ubuntu/lp-2028057-10-add-missing-feature-sgx-exinfo.patch b/debian/patches/ubuntu/lp-2028057-10-add-missing-feature-sgx-exinfo.patch
new file mode 100644
index 0000000..c7c1b5a
--- /dev/null
+++ b/debian/patches/ubuntu/lp-2028057-10-add-missing-feature-sgx-exinfo.patch
@@ -0,0 +1,22 @@
+Description: Add cpu feature sgx-exinfo.
+Author: Tim Wiederhake <[e-mail]>
+Origin: upstream, https://gitlab.com/libvirt/libvirt/-/commit/4b5c9678d17f135e77ddab7c2643949fb2408048
+Bug-Ubuntu: https://launchpad.net/bugs/2028057
+Forwarded: not-needed
+Last-Update: 2023-11-29
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+--- a/src/cpu_map/x86_features.xml
++++ b/src/cpu_map/x86_features.xml
+@@ -418,6 +418,11 @@
+     <cpuid eax_in='0x0f' ecx_in='0x01' edx='0x00000004'/>
+   </feature>
+ 
++  <!-- cpuid level 0x00000012 ecx 0x0 features -->
++  <feature name='sgx-exinfo'>
++    <cpuid eax_in='0x12' ecx_in='0x00' ebx='0x00000001'/>
++  </feature>
++
+   <!-- extended features, EDX -->
+   <feature name='syscall'>
+     <cpuid eax_in='0x80000001' edx='0x00000800'/>
diff --git a/debian/patches/ubuntu/lp-2028057-11-add-missing-feature-sgx1.patch b/debian/patches/ubuntu/lp-2028057-11-add-missing-feature-sgx1.patch
new file mode 100644
index 0000000..356703c
--- /dev/null
+++ b/debian/patches/ubuntu/lp-2028057-11-add-missing-feature-sgx1.patch
@@ -0,0 +1,21 @@
+Description: Add cpu feature sgx1.
+Author: Tim Wiederhake <[e-mail]>
+Origin: upstream, https://gitlab.com/libvirt/libvirt/-/commit/5d9cabd0c7f67f4a7a4d21bb965ce1167ae02945
+Bug-Ubuntu: https://launchpad.net/bugs/2028057
+Forwarded: not-needed
+Last-Update: 2023-11-29
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+--- a/src/cpu_map/x86_features.xml
++++ b/src/cpu_map/x86_features.xml
+@@ -419,6 +419,10 @@
+   </feature>
+ 
+   <!-- cpuid level 0x00000012 ecx 0x0 features -->
++  <feature name='sgx1'>
++    <cpuid eax_in='0x12' ecx_in='0x00' eax='0x00000001'/>
++  </feature>
++
+   <feature name='sgx-exinfo'>
+     <cpuid eax_in='0x12' ecx_in='0x00' ebx='0x00000001'/>
+   </feature>
diff --git a/debian/patches/ubuntu/lp-2028057-12-add-missing-feature-sgx2.patch b/debian/patches/ubuntu/lp-2028057-12-add-missing-feature-sgx2.patch
new file mode 100644
index 0000000..6dba3c6
--- /dev/null
+++ b/debian/patches/ubuntu/lp-2028057-12-add-missing-feature-sgx2.patch
@@ -0,0 +1,20 @@
+Description: Add cpu feature sgx2.
+Author: Tim Wiederhake <[e-mail]>
+Origin: upstream, https://gitlab.com/libvirt/libvirt/-/commit/4b5c9678d17f135e77ddab7c2643949fb2408048
+Bug-Ubuntu: https://launchpad.net/bugs/2028057
+Forwarded: not-needed
+Last-Update: 2023-11-29
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+--- a/src/cpu_map/x86_features.xml
++++ b/src/cpu_map/x86_features.xml
+@@ -422,6 +422,9 @@
+   <feature name='sgx1'>
+     <cpuid eax_in='0x12' ecx_in='0x00' eax='0x00000001'/>
+   </feature>
++  <feature name='sgx2'>
++    <cpuid eax_in='0x12' ecx_in='0x00' eax='0x00000002'/>
++  </feature>
+ 
+   <feature name='sgx-exinfo'>
+     <cpuid eax_in='0x12' ecx_in='0x00' ebx='0x00000001'/>
diff --git a/debian/patches/ubuntu/lp-2028057-13-add-missing-feature-sgx-additional.patch b/debian/patches/ubuntu/lp-2028057-13-add-missing-feature-sgx-additional.patch
new file mode 100644
index 0000000..6bcd7df
--- /dev/null
+++ b/debian/patches/ubuntu/lp-2028057-13-add-missing-feature-sgx-additional.patch
@@ -0,0 +1,36 @@
+Description: Add additional sgx-related features.
+ Add additional sgx features - sgx-debug, sgx-mode64, sgx-provisionkey,
+ sgx-tokenkey, and sgx-kss.
+Author: Tim Wiederhake <[e-mail]>
+Origin: upstream, https://gitlab.com/libvirt/libvirt/-/commit/e864f3b50a3ca57b0ebb33677b94e1da638147d9
+Bug-Ubuntu: https://launchpad.net/bugs/2028057
+Forwarded: not-needed
+Last-Update: 2023-11-29
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+--- a/src/cpu_map/x86_features.xml
++++ b/src/cpu_map/x86_features.xml
+@@ -430,6 +430,23 @@
+     <cpuid eax_in='0x12' ecx_in='0x00' ebx='0x00000001'/>
+   </feature>
+ 
++  <!-- cpuid level 0x00000012 ecx 0x1 features -->
++  <feature name='sgx-debug'>
++    <cpuid eax_in='0x12' ecx_in='0x01' eax='0x00000002'/>
++  </feature>
++  <feature name='sgx-mode64'>
++    <cpuid eax_in='0x12' ecx_in='0x01' eax='0x00000004'/>
++  </feature>
++  <feature name='sgx-provisionkey'>
++    <cpuid eax_in='0x12' ecx_in='0x01' eax='0x00000010'/>
++  </feature>
++  <feature name='sgx-tokenkey'>
++    <cpuid eax_in='0x12' ecx_in='0x01' eax='0x00000020'/>
++  </feature>
++  <feature name='sgx-kss'>
++    <cpuid eax_in='0x12' ecx_in='0x01' eax='0x00000080'/>
++  </feature>
++
+   <!-- extended features, EDX -->
+   <feature name='syscall'>
+     <cpuid eax_in='0x80000001' edx='0x00000800'/>
diff --git a/debian/patches/ubuntu/lp-2028057-14-add-missing-feature-bus-lock-detect.patch b/debian/patches/ubuntu/lp-2028057-14-add-missing-feature-bus-lock-detect.patch
new file mode 100644
index 0000000..ba00ffa
--- /dev/null
+++ b/debian/patches/ubuntu/lp-2028057-14-add-missing-feature-bus-lock-detect.patch
@@ -0,0 +1,20 @@
+Description: Add cpu feature bus-lock-detect.
+Author: Tim Wiederhake <[e-mail]>
+Origin: upstream, https://gitlab.com/libvirt/libvirt/-/commit/1f3cd74e4a8770ed69af0241c600c62a3f3ddb22
+Bug-Ubuntu: https://launchpad.net/bugs/2028057
+Forwarded: not-needed
+Last-Update: 2023-11-29
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+--- a/src/cpu_map/x86_features.xml
++++ b/src/cpu_map/x86_features.xml
+@@ -334,6 +334,9 @@
+   <feature name='rdpid'>
+     <cpuid eax_in='0x07' ecx_in='0x00' ecx='0x00400000'/>
+   </feature>
++  <feature name='bus-lock-detect'>
++    <cpuid eax_in='0x07' ecx_in='0x00' ecx='0x01000000'/>
++  </feature>
+   <feature name='cldemote'>
+     <cpuid eax_in='0x07' ecx_in='0x00' ecx='0x02000000'/>
+   </feature>
diff --git a/debian/patches/ubuntu/lp-2028057-15-add-missing-feature-pks.patch b/debian/patches/ubuntu/lp-2028057-15-add-missing-feature-pks.patch
new file mode 100644
index 0000000..eafdfcc
--- /dev/null
+++ b/debian/patches/ubuntu/lp-2028057-15-add-missing-feature-pks.patch
@@ -0,0 +1,52 @@
+Description: Add cpu feature pks.
+ Add the pks feature definition along with its entries in QEMU feature lists,
+ ignoring the 7.* entries from this commit upstream.
+Author: Tim Wiederhake <[e-mail]>
+Origin: backport, https://gitlab.com/libvirt/libvirt/-/commit/40d6a6d98702452df7c034bfe81e3a334f0f8e45
+Bug-Ubuntu: https://launchpad.net/bugs/2028057
+Forwarded: not-needed
+Last-Update: 2023-11-29
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+--- a/src/cpu_map/x86_features.xml
++++ b/src/cpu_map/x86_features.xml
+@@ -349,6 +349,9 @@
+   <feature name='sgxlc'>
+     <cpuid eax_in='0x07' ecx_in='0x00' ecx='0x40000000'/>
+   </feature>
++  <feature name='pks'>
++    <cpuid eax_in='0x07' ecx_in='0x00' ecx='0x80000000'/>
++  </feature>
+ 
+   <feature name='avx512-4vnniw'>
+     <cpuid eax_in='0x07' ecx_in='0x00' edx='0x00000004'/>
+--- a/tests/domaincapsdata/qemu_6.0.0-tcg.x86_64.xml
++++ b/tests/domaincapsdata/qemu_6.0.0-tcg.x86_64.xml
+@@ -48,6 +48,7 @@
+       <feature policy='require' name='clwb'/>
+       <feature policy='require' name='pku'/>
+       <feature policy='require' name='la57'/>
++      <feature policy='require' name='pks'/>
+       <feature policy='require' name='3dnowext'/>
+       <feature policy='require' name='3dnow'/>
+       <feature policy='require' name='npt'/>
+--- a/tests/domaincapsdata/qemu_6.1.0-tcg.x86_64.xml
++++ b/tests/domaincapsdata/qemu_6.1.0-tcg.x86_64.xml
+@@ -48,6 +48,7 @@
+       <feature policy='require' name='clwb'/>
+       <feature policy='require' name='pku'/>
+       <feature policy='require' name='la57'/>
++      <feature policy='require' name='pks'/>
+       <feature policy='require' name='3dnowext'/>
+       <feature policy='require' name='3dnow'/>
+       <feature policy='require' name='npt'/>
+--- a/tests/domaincapsdata/qemu_6.2.0-tcg.x86_64.xml
++++ b/tests/domaincapsdata/qemu_6.2.0-tcg.x86_64.xml
+@@ -48,6 +48,7 @@
+       <feature policy='require' name='clwb'/>
+       <feature policy='require' name='pku'/>
+       <feature policy='require' name='la57'/>
++      <feature policy='require' name='pks'/>
+       <feature policy='require' name='3dnowext'/>
+       <feature policy='require' name='3dnow'/>
+       <feature policy='require' name='npt'/>
diff --git a/debian/patches/ubuntu/lp-2028057-16-add-missing-feature-avx512-vp2intersect.patch b/debian/patches/ubuntu/lp-2028057-16-add-missing-feature-avx512-vp2intersect.patch
new file mode 100644
index 0000000..eb264bf
--- /dev/null
+++ b/debian/patches/ubuntu/lp-2028057-16-add-missing-feature-avx512-vp2intersect.patch
@@ -0,0 +1,20 @@
+Description: Add cpu feature avx512-vp2intersect.
+Author: Tim Wiederhake <[e-mail]>
+Origin: upstream, https://gitlab.com/libvirt/libvirt/-/commit/3306c6ded067c79ea96cbf1b59d8001560448230
+Bug-Ubuntu: https://launchpad.net/bugs/2028057
+Forwarded: not-needed
+Last-Update: 2023-11-29
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+--- a/src/cpu_map/x86_features.xml
++++ b/src/cpu_map/x86_features.xml
+@@ -362,6 +362,9 @@
+   <feature name='fsrm'>
+     <cpuid eax_in='0x07' ecx_in='0x00' edx='0x00000010'/>
+   </feature>
++  <feature name='avx512-vp2intersect'>
++    <cpuid eax_in='0x07' ecx_in='0x00' edx='0x00000100'/>
++  </feature>
+   <feature name='md-clear'>
+     <alias name='md_clear' source='linux'/>
+     <cpuid eax_in='0x07' ecx_in='0x00' edx='0x00000400'/>
diff --git a/debian/patches/ubuntu/lp-2028057-17-add-missing-feature-avx512-fp16.patch b/debian/patches/ubuntu/lp-2028057-17-add-missing-feature-avx512-fp16.patch
new file mode 100644
index 0000000..2b0700f
--- /dev/null
+++ b/debian/patches/ubuntu/lp-2028057-17-add-missing-feature-avx512-fp16.patch
@@ -0,0 +1,20 @@
+Description: Add cpu feature avx512-fp16.
+Author: Tim Wiederhake <[e-mail]>
+Origin: upstream, https://gitlab.com/libvirt/libvirt/-/commit/18ebce7c5320e200a2b2c4a256d02ab087d2bac5
+Bug-Ubuntu: https://launchpad.net/bugs/2028057
+Forwarded: not-needed
+Last-Update: 2023-11-29
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+--- a/src/cpu_map/x86_features.xml
++++ b/src/cpu_map/x86_features.xml
+@@ -375,6 +375,9 @@
+   <feature name='amx-bf16'>
+     <cpuid eax_in='0x07' ecx_in='0x00' edx='0x00400000'/>
+   </feature>
++  <feature name='avx512-fp16'>
++    <cpuid eax_in='0x07' ecx_in='0x00' edx='0x00800000'/>
++  </feature>
+   <feature name='amx-tile'>
+     <cpuid eax_in='0x07' ecx_in='0x00' edx='0x01000000'/>
+   </feature>
diff --git a/debian/patches/ubuntu/lp-2028057-18-add-missing-feature-serialize.patch b/debian/patches/ubuntu/lp-2028057-18-add-missing-feature-serialize.patch
new file mode 100644
index 0000000..aa8c587
--- /dev/null
+++ b/debian/patches/ubuntu/lp-2028057-18-add-missing-feature-serialize.patch
@@ -0,0 +1,20 @@
+Description: Add cpu feature serialize.
+Author: Tim Wiederhake <[e-mail]>
+Origin: upstream, https://gitlab.com/libvirt/libvirt/-/commit/3f73c3c4fbcd81f3a7e29f3bffa9e3b55f39f041
+Bug-Ubuntu: https://launchpad.net/bugs/2028057
+Forwarded: not-needed
+Last-Update: 2023-11-29
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+--- a/src/cpu_map/x86_features.xml
++++ b/src/cpu_map/x86_features.xml
+@@ -369,6 +369,9 @@
+     <alias name='md_clear' source='linux'/>
+     <cpuid eax_in='0x07' ecx_in='0x00' edx='0x00000400'/>
+   </feature>
++  <feature name='serialize'>
++    <cpuid eax_in='0x07' ecx_in='0x00' edx='0x00004000'/>
++  </feature>
+   <feature name='pconfig'>
+     <cpuid eax_in='0x07' ecx_in='0x00' edx='0x00040000'/>
+   </feature>
diff --git a/debian/patches/ubuntu/lp-2028057-19-add-missing-feature-tsx-ldtrk.patch b/debian/patches/ubuntu/lp-2028057-19-add-missing-feature-tsx-ldtrk.patch
new file mode 100644
index 0000000..db71f0c
--- /dev/null
+++ b/debian/patches/ubuntu/lp-2028057-19-add-missing-feature-tsx-ldtrk.patch
@@ -0,0 +1,20 @@
+Description: Add cpu feature tsx-ldtrk.
+Author: Tim Wiederhake <[e-mail]>
+Origin: upstream, https://gitlab.com/libvirt/libvirt/-/commit/1e309109677f192a1dc47ef0a2fc16b31450f129
+Bug-Ubuntu: https://launchpad.net/bugs/2028057
+Forwarded: not-needed
+Last-Update: 2023-11-29
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+--- a/src/cpu_map/x86_features.xml
++++ b/src/cpu_map/x86_features.xml
+@@ -372,6 +372,9 @@
+   <feature name='serialize'>
+     <cpuid eax_in='0x07' ecx_in='0x00' edx='0x00004000'/>
+   </feature>
++  <feature name='tsx-ldtrk'>
++    <cpuid eax_in='0x07' ecx_in='0x00' edx='0x00010000'/>
++  </feature>
+   <feature name='pconfig'>
+     <cpuid eax_in='0x07' ecx_in='0x00' edx='0x00040000'/>
+   </feature>
diff --git a/debian/patches/ubuntu/lp-2028057-20-add-missing-feature-arch-lbr.patch b/debian/patches/ubuntu/lp-2028057-20-add-missing-feature-arch-lbr.patch
new file mode 100644
index 0000000..a82f9c5
--- /dev/null
+++ b/debian/patches/ubuntu/lp-2028057-20-add-missing-feature-arch-lbr.patch
@@ -0,0 +1,20 @@
+Description: Add cpu feature arch-lbr.
+Author: Tim Wiederhake <[e-mail]>
+Origin: upstream, https://gitlab.com/libvirt/libvirt/-/commit/4ba1e382f7d5aeb650a9bf367cd760ac824e2171
+Bug-Ubuntu: https://launchpad.net/bugs/2028057
+Forwarded: not-needed
+Last-Update: 2023-11-29
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+--- a/src/cpu_map/x86_features.xml
++++ b/src/cpu_map/x86_features.xml
+@@ -378,6 +378,9 @@
+   <feature name='pconfig'>
+     <cpuid eax_in='0x07' ecx_in='0x00' edx='0x00040000'/>
+   </feature>
++  <feature name='arch-lbr'>
++    <cpuid eax_in='0x07' ecx_in='0x00' edx='0x00080000'/>
++  </feature>
+   <feature name='amx-bf16'>
+     <cpuid eax_in='0x07' ecx_in='0x00' edx='0x00400000'/>
+   </feature>
diff --git a/debian/patches/ubuntu/lp-2028057-21-add-missing-feature-xfd.patch b/debian/patches/ubuntu/lp-2028057-21-add-missing-feature-xfd.patch
new file mode 100644
index 0000000..87cecf1
--- /dev/null
+++ b/debian/patches/ubuntu/lp-2028057-21-add-missing-feature-xfd.patch
@@ -0,0 +1,20 @@
+Description: Add cpu feature xfd.
+Author: Tim Wiederhake <[e-mail]>
+Origin: upstream, https://gitlab.com/libvirt/libvirt/-/commit/29b0b9bb0eb966f9c49b78b97101c6623306a39a
+Bug-Ubuntu: https://launchpad.net/bugs/2028057
+Forwarded: not-needed
+Last-Update: 2023-11-29
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+--- a/src/cpu_map/x86_features.xml
++++ b/src/cpu_map/x86_features.xml
+@@ -430,6 +430,9 @@
+   <feature name='xsaves' migratable='no'>
+     <cpuid eax_in='0x0d' ecx_in='0x01' eax='0x00000008'/>
+   </feature>
++  <feature name='xfd'>
++    <cpuid eax_in='0x0d' ecx_in='0x01' eax='0x00000010'/>
++  </feature>
+ 
+   <!-- cpuid level 0x0000000f:1 (edx) -->
+   <feature name='mbm_total'>
diff --git a/debian/patches/ubuntu/lp-2028057-22-add-missing-feature-intel-pt-lip.patch b/debian/patches/ubuntu/lp-2028057-22-add-missing-feature-intel-pt-lip.patch
new file mode 100644
index 0000000..5dd6160
--- /dev/null
+++ b/debian/patches/ubuntu/lp-2028057-22-add-missing-feature-intel-pt-lip.patch
@@ -0,0 +1,54 @@
+Description: Add cpu feature intel-pt-lip.
+ This patch adds the feature definition for Intel pt-lip, and adds the feature
+ to the Intel Atom P5362 processor.
+Author: Tim Wiederhake <[e-mail]>
+Origin: upstream, https://gitlab.com/libvirt/libvirt/-/commit/501e7c780bbec6eddd8bc7bcb13fdafba94c5358
+Bug-Ubuntu: https://launchpad.net/bugs/2028057
+Forwarded: not-needed
+Last-Update: 2023-11-29
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+--- a/src/cpu_map/x86_features.xml
++++ b/src/cpu_map/x86_features.xml
+@@ -471,6 +471,11 @@
+     <cpuid eax_in='0x12' ecx_in='0x01' eax='0x00000080'/>
+   </feature>
+ 
++  <!-- cpuid level 0x00000014 ecx 0x0 features -->
++  <feature name='intel-pt-lip'>
++    <cpuid eax_in='0x14' ecx_in='0x00' ecx='0x80000000'/>
++  </feature>
++
+   <!-- extended features, EDX -->
+   <feature name='syscall'>
+     <cpuid eax_in='0x80000001' edx='0x00000800'/>
+--- a/tests/cputestdata/x86_64-cpuid-Atom-P5362-disabled.xml
++++ b/tests/cputestdata/x86_64-cpuid-Atom-P5362-disabled.xml
+@@ -3,6 +3,7 @@
+   <cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x080041dc' edx='0xb0600000'/>
+   <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02001000' ecx='0x00000020' edx='0x40000000'/>
+   <cpuid eax_in='0x0000000f' ecx_in='0x01' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000006'/>
++  <cpuid eax_in='0x00000014' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x80000000' edx='0x00000000'/>
+   <cpuid eax_in='0x80000007' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000100'/>
+   <msr index='0xcf' edx='0x00000000' eax='0x00000020'/>
+   <msr index='0x10a' edx='0x00000000' eax='0x00000100'/>
+--- a/tests/cputestdata/x86_64-cpuid-Atom-P5362-guest.xml
++++ b/tests/cputestdata/x86_64-cpuid-Atom-P5362-guest.xml
+@@ -27,6 +27,7 @@
+   <feature policy='require' name='xsaves'/>
+   <feature policy='require' name='mbm_total'/>
+   <feature policy='require' name='mbm_local'/>
++  <feature policy='require' name='intel-pt-lip'/>
+   <feature policy='require' name='invtsc'/>
+   <feature policy='require' name='rdctl-no'/>
+   <feature policy='require' name='ibrs-all'/>
+--- a/tests/cputestdata/x86_64-cpuid-Atom-P5362-host.xml
++++ b/tests/cputestdata/x86_64-cpuid-Atom-P5362-host.xml
+@@ -56,6 +56,7 @@
+   <feature name='xsaves'/>
+   <feature name='mbm_total'/>
+   <feature name='mbm_local'/>
++  <feature name='intel-pt-lip'/>
+   <feature name='rdtscp'/>
+   <feature name='3dnowprefetch'/>
+   <feature name='invtsc'/>
diff --git a/debian/patches/ubuntu/lp-2028057-23-add-new-CPU-model-Intel-SapphireRapids.patch b/debian/patches/ubuntu/lp-2028057-23-add-new-CPU-model-Intel-SapphireRapids.patch
new file mode 100644
index 0000000..30085cd
--- /dev/null
+++ b/debian/patches/ubuntu/lp-2028057-23-add-new-CPU-model-Intel-SapphireRapids.patch
@@ -0,0 +1,310 @@
+Description: Add new CPU model SapphireRapids
+ The new CPU model mostly inherits features from Icelake-Server, while
+ adding new features:
+ - AMX (Advance Matrix eXtensions)
+ - Bus Lock Debug Exception
+ and new instructions:
+ - AVX VNNI (Vector Neural Network Instruction):
+    - VPDPBUS: Multiply and Add Unsigned and Signed Bytes
+    - VPDPBUSDS: Multiply and Add Unsigned and Signed Bytes with Saturation
+    - VPDPWSSD: Multiply and Add Signed Word Integers
+    - VPDPWSSDS: Multiply and Add Signed Integers with Saturation
+ - FP16: Replicates existing AVX512 computational SP (FP32) instructions
+   using FP16 instead of FP32 for ~2X performance gain
+ - SERIALIZE: Provide software with a simple way to force the processor to
+   complete all modifications, faster, allowed in all privilege levels and
+   not causing an unconditional VM exit
+ - TSX Suspend Load Address Tracking: Allows programmers to choose which
+   memory accesses do not need to be tracked in the TSX read set
+ - AVX512_BF16: Vector Neural Network Instructions supporting BFLOAT16
+   inputs and conversion instructions from IEEE single precision
+Author: Wang, Lei <[e-mail]>
+Origin: other, https://lore.kernel.org/all/[e-mail]/
+Bug-Ubuntu: https://launchpad.net/bugs/2028057
+Forwarded: not-needed
+Last-Update: 2023-11-29
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+--- a/src/cpu_map/index.xml
++++ b/src/cpu_map/index.xml
+@@ -56,6 +56,8 @@
+     <include filename='x86_Icelake-Server-noTSX.xml'/>
+     <include filename='x86_Cooperlake.xml'/>
+     <include filename='x86_Snowridge.xml'/>
++    <include filename='x86_SapphireRapids.xml'/>
++    <include filename='x86_SapphireRapids-noTSX.xml'/>
+ 
+     <!-- AMD CPUs -->
+     <include filename='x86_athlon.xml'/>
+--- a/src/cpu_map/meson.build
++++ b/src/cpu_map/meson.build
+@@ -67,6 +67,8 @@
+   'x86_qemu64.xml',
+   'x86_SandyBridge-IBRS.xml',
+   'x86_SandyBridge.xml',
++  'x86_SapphireRapids.xml',
++  'x86_SapphireRapids-noTSX.xml',
+   'x86_Skylake-Client-IBRS.xml',
+   'x86_Skylake-Client-noTSX-IBRS.xml',
+   'x86_Skylake-Client.xml',
+--- a/src/cpu_map/sync_qemu_models_i386.py
++++ b/src/cpu_map/sync_qemu_models_i386.py
+@@ -54,6 +54,7 @@
+         "CPUID_7_0_ECX_AVX512_VBMI": "avx512vbmi",
+         "CPUID_7_0_ECX_AVX512VNNI": "avx512vnni",
+         "CPUID_7_0_ECX_AVX512_VPOPCNTDQ": "avx512-vpopcntdq",
++        "CPUID_7_0_ECX_BUS_LOCK_DETECT": "bus-lock-detect",
+         "CPUID_7_0_ECX_CLDEMOTE": "cldemote",
+         "CPUID_7_0_ECX_GFNI": "gfni",
+         "CPUID_7_0_ECX_LA57": "la57",
+@@ -67,16 +68,20 @@
+         "CPUID_7_0_EDX_ARCH_CAPABILITIES": "arch-capabilities",
+         "CPUID_7_0_EDX_AVX512_4FMAPS": "avx512-4fmaps",
+         "CPUID_7_0_EDX_AVX512_4VNNIW": "avx512-4vnniw",
++        "CPUID_7_0_EDX_AVX512_FP16": "avx512-fp16",
+         "CPUID_7_0_EDX_CORE_CAPABILITY": "core-capability",
+         "CPUID_7_0_EDX_FSRM": "fsrm",
++        "CPUID_7_0_EDX_SERIALIZE": "serialize",
+         "CPUID_7_0_EDX_SPEC_CTRL": "spec-ctrl",
+         "CPUID_7_0_EDX_SPEC_CTRL_SSBD": "ssbd",
+         "CPUID_7_0_EDX_STIBP": "stibp",
++        "CPUID_7_0_EDX_TSX_LDTRK": "tsx-ldtrk",
+         "CPUID_7_0_EDX_AMX_BF16": "amx-bf16",
+         "CPUID_7_0_EDX_AMX_TILE": "amx-tile",
+         "CPUID_7_0_EDX_AMX_INT8": "amx-int8",
+         "CPUID_7_1_EAX_AVX512_BF16": "avx512-bf16",
+         "CPUID_7_1_EAX_AVX_VNNI": "avx-vnni",
++        "CPUID_D_1_EAX_XFD": "xfd",
+         "CPUID_8000_0008_EBX_AMD_SSBD": "amd-ssbd",
+         "CPUID_8000_0008_EBX_CLZERO": "clzero",
+         "CPUID_8000_0008_EBX_IBPB": "ibpb",
+--- /dev/null
++++ b/src/cpu_map/x86_SapphireRapids-noTSX.xml
+@@ -0,0 +1,111 @@
++<cpus>
++  <model name='SapphireRapids-noTSX'>
++    <decode host='on' guest='off'/>
++    <signature family='6' model='143'/>
++    <vendor name='Intel'/>
++    <feature name='3dnowprefetch'/>
++    <feature name='abm'/>
++    <feature name='adx'/>
++    <feature name='aes'/>
++    <feature name='amx-bf16'/>
++    <feature name='amx-int8'/>
++    <feature name='amx-tile'/>
++    <feature name='apic'/>
++    <feature name='arat'/>
++    <feature name='arch-capabilities'/>
++    <feature name='avx'/>
++    <feature name='avx-vnni'/>
++    <feature name='avx2'/>
++    <feature name='avx512-bf16'/>
++    <feature name='avx512-fp16'/>
++    <feature name='avx512-vpopcntdq'/>
++    <feature name='avx512bitalg'/>
++    <feature name='avx512bw'/>
++    <feature name='avx512cd'/>
++    <feature name='avx512dq'/>
++    <feature name='avx512f'/>
++    <feature name='avx512ifma'/>
++    <feature name='avx512vbmi'/>
++    <feature name='avx512vbmi2'/>
++    <feature name='avx512vl'/>
++    <feature name='avx512vnni'/>
++    <feature name='bmi1'/>
++    <feature name='bmi2'/>
++    <feature name='bus-lock-detect'/>
++    <feature name='clflush'/>
++    <feature name='clflushopt'/>
++    <feature name='clwb'/>
++    <feature name='cmov'/>
++    <feature name='cx16'/>
++    <feature name='cx8'/>
++    <feature name='de'/>
++    <feature name='erms'/>
++    <feature name='f16c'/>
++    <feature name='fma'/>
++    <feature name='fpu'/>
++    <feature name='fsgsbase'/>
++    <feature name='fsrm'/>
++    <feature name='fxsr'/>
++    <feature name='gfni'/>
++    <feature name='ibrs-all'/>
++    <feature name='invpcid'/>
++    <feature name='la57'/>
++    <feature name='lahf_lm'/>
++    <feature name='lm'/>
++    <feature name='mca'/>
++    <feature name='mce'/>
++    <feature name='mds-no'/>
++    <feature name='mmx'/>
++    <feature name='movbe'/>
++    <feature name='msr'/>
++    <feature name='mtrr'/>
++    <feature name='nx'/>
++    <feature name='pae'/>
++    <feature name='pat'/>
++    <feature name='pcid'/>
++    <feature name='pclmuldq'/>
++    <feature name='pdpe1gb'/>
++    <feature name='pge'/>
++    <feature name='pku'/>
++    <feature name='pni'/>
++    <feature name='popcnt'/>
++    <feature name='pschange-mc-no'/>
++    <feature name='pse'/>
++    <feature name='pse36'/>
++    <feature name='rdctl-no'/>
++    <feature name='rdpid'/>
++    <feature name='rdrand'/>
++    <feature name='rdseed'/>
++    <feature name='rdtscp'/>
++    <feature name='sep'/>
++    <feature name='serialize'/>
++    <feature name='sha-ni'/>
++    <feature name='skip-l1dfl-vmentry'/>
++    <feature name='smap'/>
++    <feature name='smep'/>
++    <feature name='spec-ctrl'/>
++    <feature name='ssbd'/>
++    <feature name='sse'/>
++    <feature name='sse2'/>
++    <feature name='sse4.1'/>
++    <feature name='sse4.2'/>
++    <feature name='ssse3'/>
++    <feature name='syscall'/>
++    <feature name='taa-no'/>
++    <feature name='tsc'/>
++    <feature name='tsc-deadline'/>
++    <feature name='tsx-ldtrk'/>
++    <feature name='umip'/>
++    <feature name='vaes'/>
++    <feature name='vme'/>
++    <feature name='vpclmulqdq'/>
++    <feature name='wbnoinvd'/>
++    <feature name='x2apic'/>
++    <feature name='xfd'/>
++    <feature name='xgetbv1'/>
++    <feature name='xsave'/>
++    <feature name='xsavec'/>
++    <feature name='xsaveopt'/>
++    <feature name='xsaves'/>
++  </model>
++</cpus>
+--- /dev/null
++++ b/src/cpu_map/x86_SapphireRapids.xml
+@@ -0,0 +1,113 @@
++<cpus>
++  <model name='SapphireRapids'>
++    <decode host='on' guest='on'/>
++    <signature family='6' model='143'/>
++    <vendor name='Intel'/>
++    <feature name='3dnowprefetch'/>
++    <feature name='abm'/>
++    <feature name='adx'/>
++    <feature name='aes'/>
++    <feature name='amx-bf16'/>
++    <feature name='amx-int8'/>
++    <feature name='amx-tile'/>
++    <feature name='apic'/>
++    <feature name='arat'/>
++    <feature name='arch-capabilities'/>
++    <feature name='avx'/>
++    <feature name='avx-vnni'/>
++    <feature name='avx2'/>
++    <feature name='avx512-bf16'/>
++    <feature name='avx512-fp16'/>
++    <feature name='avx512-vpopcntdq'/>
++    <feature name='avx512bitalg'/>
++    <feature name='avx512bw'/>
++    <feature name='avx512cd'/>
++    <feature name='avx512dq'/>
++    <feature name='avx512f'/>
++    <feature name='avx512ifma'/>
++    <feature name='avx512vbmi'/>
++    <feature name='avx512vbmi2'/>
++    <feature name='avx512vl'/>
++    <feature name='avx512vnni'/>
++    <feature name='bmi1'/>
++    <feature name='bmi2'/>
++    <feature name='bus-lock-detect'/>
++    <feature name='clflush'/>
++    <feature name='clflushopt'/>
++    <feature name='clwb'/>
++    <feature name='cmov'/>
++    <feature name='cx16'/>
++    <feature name='cx8'/>
++    <feature name='de'/>
++    <feature name='erms'/>
++    <feature name='f16c'/>
++    <feature name='fma'/>
++    <feature name='fpu'/>
++    <feature name='fsgsbase'/>
++    <feature name='fsrm'/>
++    <feature name='fxsr'/>
++    <feature name='gfni'/>
++    <feature name='hle'/>
++    <feature name='ibrs-all'/>
++    <feature name='invpcid'/>
++    <feature name='la57'/>
++    <feature name='lahf_lm'/>
++    <feature name='lm'/>
++    <feature name='mca'/>
++    <feature name='mce'/>
++    <feature name='mds-no'/>
++    <feature name='mmx'/>
++    <feature name='movbe'/>
++    <feature name='msr'/>
++    <feature name='mtrr'/>
++    <feature name='nx'/>
++    <feature name='pae'/>
++    <feature name='pat'/>
++    <feature name='pcid'/>
++    <feature name='pclmuldq'/>
++    <feature name='pdpe1gb'/>
++    <feature name='pge'/>
++    <feature name='pku'/>
++    <feature name='pni'/>
++    <feature name='popcnt'/>
++    <feature name='pschange-mc-no'/>
++    <feature name='pse'/>
++    <feature name='pse36'/>
++    <feature name='rdctl-no'/>
++    <feature name='rdpid'/>
++    <feature name='rdrand'/>
++    <feature name='rdseed'/>
++    <feature name='rdtscp'/>
++    <feature name='rtm'/>
++    <feature name='sep'/>
++    <feature name='serialize'/>
++    <feature name='sha-ni'/>
++    <feature name='skip-l1dfl-vmentry'/>
++    <feature name='smap'/>
++    <feature name='smep'/>
++    <feature name='spec-ctrl'/>
++    <feature name='ssbd'/>
++    <feature name='sse'/>
++    <feature name='sse2'/>
++    <feature name='sse4.1'/>
++    <feature name='sse4.2'/>
++    <feature name='ssse3'/>
++    <feature name='syscall'/>
++    <feature name='taa-no'/>
++    <feature name='tsc'/>
++    <feature name='tsc-deadline'/>
++    <feature name='tsx-ldtrk'/>
++    <feature name='umip'/>
++    <feature name='vaes'/>
++    <feature name='vme'/>
++    <feature name='vpclmulqdq'/>
++    <feature name='wbnoinvd'/>
++    <feature name='x2apic'/>
++    <feature name='xfd'/>
++    <feature name='xgetbv1'/>
++    <feature name='xsave'/>
++    <feature name='xsavec'/>
++    <feature name='xsaveopt'/>
++    <feature name='xsaves'/>
++  </model>
++</cpus>