Merge ~sergiodj/ubuntu/+source/qemu:enhanced-interpretation-pci-functions-jammy into ubuntu/+source/qemu:ubuntu/jammy-devel

[Sergio Durigan Junior]

This is the backport of multiple upstream patches to implement the support for "Enhanced Interpretation for PCI Functions" on Jammy.

PPA: https://launchpad.net/~sergiodj/+archive/ubuntu/qemu/+packages

dep8 tests are still running; I'll post their results when they finish.

qemu-migration-test results so far:

prep (x86_64) : Pass 30 F/S/N 0/0/0 - RC 0 (20 min 63526 lin)
migrate (x86_64) : Pass 33 F/S/N 16/0/0 - RC 999 (81 min 70737 lin)
cross (x86_64) : Pass 80 F/S/N 0/0/0 - RC 0 (164 min 134751 lin)
misc (x86_64) : Pass 16 F/S/N 0/0/0 - RC 999 (7 min 6548 lin)

prep (s390x) : Pass 30 F/S/N 0/0/0 - RC 0 (12 min 41074 lin)
migrate (s390x) : Pass 260 F/S/N 0/5/0 - RC 0 (67 min 162299 lin)
cross (s390x) : Pass 80 F/S/N 0/0/0 - RC 0 (143 min 117002 lin)
misc (s390x) : Pass 67 F/S/N 0/0/0 - RC 0 (26 min 32766 lin)

I'll rerun the amd64 test after checking what went wrong, but I'm happy to see that s390x passed because that's the architecture affected by the backport.

[Sergio Durigan Junior (sergiodj)]

Second run on amd64:

prep (x86_64) : Pass 30 F/S/N 0/0/0 - RC 0 (20 min 63971 lin)
migrate (x86_64) : Pass 126 F/S/N 0/0/0 - RC 999 (44 min 100551 lin)
misc (x86_64) : Pass 73 F/S/N 0/0/0 - RC 0 (35 min 42966 lin)

Everything passed; the RC 999 on migrate happened because the script failed to stop the test containers.

[Sergio Durigan Junior (sergiodj)]

Results: (from http://autopkgtest.ubuntu.com/results/autopkgtest-jammy-sergiodj-qemu/?format=plain)
  qemu @ amd64:
    05.07.23 22:58:21 Log 🗒️ ✅ Triggers: qemu/1:6.2+dfsg-2ubuntu6.13~ppa1
  qemu @ arm64:
    05.07.23 23:28:01 Log 🗒️ ✅ Triggers: qemu/1:6.2+dfsg-2ubuntu6.13~ppa1
  qemu @ armhf:
    05.07.23 22:56:43 Log 🗒️ ✅ Triggers: qemu/1:6.2+dfsg-2ubuntu6.13~ppa1
  qemu @ ppc64el:
    05.07.23 22:57:52 Log 🗒️ ✅ Triggers: qemu/1:6.2+dfsg-2ubuntu6.13~ppa1
  qemu @ s390x:
    06.07.23 01:41:45 Log 🗒️ ✅ Triggers: qemu/1:6.2+dfsg-2ubuntu6.13~ppa1

[Lucas Kanashiro (lucaskanashiro)]

Thanks for this MP Sergio! I reviewed just the packaging changes, and those look good to me, +1.

Just to be clear, I did not test the feature itself.

review: Approve

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: sergiodj, lucaskanashiro
Uploaders: sergiodj, lucaskanashiro
MP auto-approved

review: Approve

[Sergio Durigan Junior (sergiodj)]

On Friday, July 07 2023, Lucas Kanashiro wrote:

> Thanks for this MP Sergio! I reviewed just the packaging changes, and those look good to me, +1.
>
> Just to be clear, I did not test the feature itself.

Thanks, Lucas.

The feature itself will be tested by the IBM folks, so I'll follow up
with them.

Uploaded:

$ dput qemu_6.2+dfsg-2ubuntu6.13_source.changes
Trying to upload package to ubuntu
Checking signature on .changes
gpg: /home/sergio/work/qemu/qemu_6.2+dfsg-2ubuntu6.13_source.changes: Valid signature from 106DA1C8C3CBBF14
Checking signature on .dsc
gpg: /home/sergio/work/qemu/qemu_6.2+dfsg-2ubuntu6.13.dsc: Valid signature from 106DA1C8C3CBBF14
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading qemu_6.2+dfsg-2ubuntu6.13.dsc: done.
  Uploading qemu_6.2+dfsg-2ubuntu6.13.debian.tar.xz: done.
  Uploading qemu_6.2+dfsg-2ubuntu6.13_source.buildinfo: done.
  Uploading qemu_6.2+dfsg-2ubuntu6.13_source.changes: done.
Successfully uploaded packages.

--
Sergio
GPG key ID: E92F D0B3 6B14 F1F4 D8E0 EB2F 106D A1C8 C3CB BF14

diff --git a/debian/changelog b/debian/changelog
index 4a8e1c2..0a8434d 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+qemu (1:6.2+dfsg-2ubuntu6.13) jammy; urgency=medium
+
+  * d/p/u/lp-1853307-*.patch: Backport patches to implement Enhanced
+    Interpretation for PCI Functions (s390x).  (LP: #1853307)
+
+ -- Sergio Durigan Junior <[e-mail]>  Wed, 05 Jul 2023 10:47:05 -0400
+
 qemu (1:6.2+dfsg-2ubuntu6.12) jammy; urgency=medium
 
   [ Chengen Du ]
diff --git a/debian/patches/series b/debian/patches/series
index a3c005c..d7cebc7 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -66,3 +66,25 @@ CVE-2022-4144-4.patch
 CVE-2022-4144-5.patch
 CVE-2023-0330.patch
 ubuntu/lp2025591-block-use-the-request-length-for-iov-alignment.patch
+ubuntu/lp-1853307-virtio-gpu-do-not-byteswap-padding.patch
+ubuntu/lp-1853307-linux-headers-update-to-5.16-rc1.patch
+ubuntu/lp-1853307-update-linux-headers-Add-asm-riscv-kvm.h.patch
+ubuntu/lp-1853307-linux-headers-Update-headers-to-v5.17-rc1.patch
+ubuntu/lp-1853307-linux-headers-include-missing-changes-from-5.17.patch
+ubuntu/lp-1853307-linux-headers-Update-to-v5.18-rc6.patch
+ubuntu/lp-1853307-linux-headers-Add-vduse.h.patch
+ubuntu/lp-1853307-kvm-add-support-for-boolean-statistics.patch
+ubuntu/lp-1853307-hw-i386-pass-RNG-seed-via-setup_data-entry.patch
+ubuntu/lp-1853307-s390x-pci-use-a-reserved-ID-for-the-default-PCI-grou.patch
+ubuntu/lp-1853307-s390x-pci-add-supported-DT-information-to-clp-respon.patch
+ubuntu/lp-1853307-configure-Add-Wno-gnu-variable-sized-type-not-at-end.patch
+ubuntu/lp-1853307-Update-linux-headers-to-v6.0-rc4.patch
+ubuntu/lp-1853307-s390x-pci-add-routine-to-get-host-function-handle-fr.patch
+ubuntu/lp-1853307-s390x-pci-enable-for-load-store-interpretation.patch
+ubuntu/lp-1853307-s390x-pci-don-t-fence-interpreted-devices-without-MS.patch
+ubuntu/lp-1853307-s390x-pci-enable-adapter-event-notification-for-inte.patch
+ubuntu/lp-1853307-s390x-pci-let-intercept-devices-have-separate-PCI-gr.patch
+ubuntu/lp-1853307-s390x-pci-reflect-proper-maxstbl-for-groups-of-inter.patch
+ubuntu/lp-1853307-s390x-pci-RPCIT-second-pass-when-mappings-exhausted.patch
+ubuntu/lp-1853307-s390x-pci-shrink-DMA-aperture-to-be-bound-by-vfio-DM.patch
+ubuntu/lp-1853307-s390x-pci-reset-ISM-passthrough-devices-on-shutdown-.patch
diff --git a/debian/patches/ubuntu/lp-1853307-Update-linux-headers-to-v6.0-rc4.patch b/debian/patches/ubuntu/lp-1853307-Update-linux-headers-to-v6.0-rc4.patch
new file mode 100644
index 0000000..73dc627
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1853307-Update-linux-headers-to-v6.0-rc4.patch
@@ -0,0 +1,1400 @@
+From d525f73f9186a5bc641b8caf0b2c9bb94e5aa963 Mon Sep 17 00:00:00 2001
+From: Chenyi Qiang <[e-mail]>
+Date: Thu, 15 Sep 2022 17:10:35 +0800
+Subject: [PATCH] Update linux headers to v6.0-rc4
+
+commit 7e18e42e4b280c85b76967a9106a13ca61c16179
+
+Signed-off-by: Chenyi Qiang <[e-mail]>
+Reviewed-by: Cornelia Huck <[e-mail]>
+Message-Id: <[e-mail]>
+Signed-off-by: Thomas Huth <[e-mail]>
+
+Origin: upstream, https://gitlab.com/qemu-project/qemu/commit/d525f73f91
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1853307
+Last-Update: 2023-07-04
+
+---
+ include/standard-headers/asm-x86/bootparam.h  |   7 +-
+ include/standard-headers/drm/drm_fourcc.h     |  73 +++++++-
+ include/standard-headers/linux/ethtool.h      |  29 +--
+ include/standard-headers/linux/input.h        |  12 +-
+ include/standard-headers/linux/pci_regs.h     |  30 ++-
+ include/standard-headers/linux/vhost_types.h  |  17 +-
+ include/standard-headers/linux/virtio_9p.h    |   2 +-
+ .../standard-headers/linux/virtio_config.h    |   7 +-
+ include/standard-headers/linux/virtio_ids.h   |  14 +-
+ include/standard-headers/linux/virtio_net.h   |  34 +++-
+ include/standard-headers/linux/virtio_pci.h   |   2 +
+ include/standard-headers/linux/virtio_ring.h  |  16 +-
+ linux-headers/asm-arm64/kvm.h                 |  33 +++-
+ linux-headers/asm-generic/unistd.h            |   4 +-
+ linux-headers/asm-riscv/kvm.h                 |  22 +++
+ linux-headers/asm-riscv/unistd.h              |   3 +-
+ linux-headers/asm-s390/kvm.h                  |   1 +
+ linux-headers/asm-x86/kvm.h                   |  33 ++--
+ linux-headers/asm-x86/mman.h                  |  14 --
+ linux-headers/linux/kvm.h                     | 172 +++++++++++++++++-
+ linux-headers/linux/userfaultfd.h             |  10 +-
+ linux-headers/linux/vduse.h                   |  47 +++++
+ linux-headers/linux/vfio.h                    |   4 +-
+ linux-headers/linux/vfio_zdev.h               |   7 +
+ linux-headers/linux/vhost.h                   |  35 +++-
+ 25 files changed, 538 insertions(+), 90 deletions(-)
+
+Index: qemu/include/standard-headers/asm-x86/bootparam.h
+===================================================================
+--- qemu.orig/include/standard-headers/asm-x86/bootparam.h	2023-07-04 20:49:59.000000000 -0400
++++ qemu/include/standard-headers/asm-x86/bootparam.h	2023-07-04 20:49:59.000000000 -0400
+@@ -10,12 +10,13 @@
+ #define SETUP_EFI			4
+ #define SETUP_APPLE_PROPERTIES		5
+ #define SETUP_JAILHOUSE			6
++#define SETUP_CC_BLOB			7
++#define SETUP_IMA			8
+ #define SETUP_RNG_SEED			9
++#define SETUP_ENUM_MAX			SETUP_RNG_SEED
+ 
+ #define SETUP_INDIRECT			(1<<31)
+-
+-/* SETUP_INDIRECT | max(SETUP_*) */
+-#define SETUP_TYPE_MAX			(SETUP_INDIRECT | SETUP_JAILHOUSE)
++#define SETUP_TYPE_MAX			(SETUP_ENUM_MAX | SETUP_INDIRECT)
+ 
+ /* ram_size flags */
+ #define RAMDISK_IMAGE_START_MASK	0x07FF
+Index: qemu/include/standard-headers/drm/drm_fourcc.h
+===================================================================
+--- qemu.orig/include/standard-headers/drm/drm_fourcc.h	2023-07-04 20:49:59.000000000 -0400
++++ qemu/include/standard-headers/drm/drm_fourcc.h	2023-07-04 20:49:59.000000000 -0400
+@@ -558,7 +558,7 @@
+  *
+  * The main surface is Y-tiled and is at plane index 0 whereas CCS is linear
+  * and at index 1. The clear color is stored at index 2, and the pitch should
+- * be ignored. The clear color structure is 256 bits. The first 128 bits
++ * be 64 bytes aligned. The clear color structure is 256 bits. The first 128 bits
+  * represents Raw Clear Color Red, Green, Blue and Alpha color each represented
+  * by 32 bits. The raw clear color is consumed by the 3d engine and generates
+  * the converted clear color of size 64 bits. The first 32 bits store the Lower
+@@ -572,6 +572,53 @@
+ #define I915_FORMAT_MOD_Y_TILED_GEN12_RC_CCS_CC fourcc_mod_code(INTEL, 8)
+ 
+ /*
++ * Intel Tile 4 layout
++ *
++ * This is a tiled layout using 4KB tiles in a row-major layout. It has the same
++ * shape as Tile Y at two granularities: 4KB (128B x 32) and 64B (16B x 4). It
++ * only differs from Tile Y at the 256B granularity in between. At this
++ * granularity, Tile Y has a shape of 16B x 32 rows, but this tiling has a shape
++ * of 64B x 8 rows.
++ */
++#define I915_FORMAT_MOD_4_TILED         fourcc_mod_code(INTEL, 9)
++
++/*
++ * Intel color control surfaces (CCS) for DG2 render compression.
++ *
++ * The main surface is Tile 4 and at plane index 0. The CCS data is stored
++ * outside of the GEM object in a reserved memory area dedicated for the
++ * storage of the CCS data for all RC/RC_CC/MC compressible GEM objects. The
++ * main surface pitch is required to be a multiple of four Tile 4 widths.
++ */
++#define I915_FORMAT_MOD_4_TILED_DG2_RC_CCS fourcc_mod_code(INTEL, 10)
++
++/*
++ * Intel color control surfaces (CCS) for DG2 media compression.
++ *
++ * The main surface is Tile 4 and at plane index 0. For semi-planar formats
++ * like NV12, the Y and UV planes are Tile 4 and are located at plane indices
++ * 0 and 1, respectively. The CCS for all planes are stored outside of the
++ * GEM object in a reserved memory area dedicated for the storage of the
++ * CCS data for all RC/RC_CC/MC compressible GEM objects. The main surface
++ * pitch is required to be a multiple of four Tile 4 widths.
++ */
++#define I915_FORMAT_MOD_4_TILED_DG2_MC_CCS fourcc_mod_code(INTEL, 11)
++
++/*
++ * Intel Color Control Surface with Clear Color (CCS) for DG2 render compression.
++ *
++ * The main surface is Tile 4 and at plane index 0. The CCS data is stored
++ * outside of the GEM object in a reserved memory area dedicated for the
++ * storage of the CCS data for all RC/RC_CC/MC compressible GEM objects. The
++ * main surface pitch is required to be a multiple of four Tile 4 widths. The
++ * clear color is stored at plane index 1 and the pitch should be 64 bytes
++ * aligned. The format of the 256 bits of clear color data matches the one used
++ * for the I915_FORMAT_MOD_Y_TILED_GEN12_RC_CCS_CC modifier, see its description
++ * for details.
++ */
++#define I915_FORMAT_MOD_4_TILED_DG2_RC_CCS_CC fourcc_mod_code(INTEL, 12)
++
++/*
+  * Tiled, NV12MT, grouped in 64 (pixels) x 32 (lines) -sized macroblocks
+  *
+  * Macroblocks are laid in a Z-shape, and each pixel data is following the
+@@ -608,6 +655,28 @@
+  */
+ #define DRM_FORMAT_MOD_QCOM_COMPRESSED	fourcc_mod_code(QCOM, 1)
+ 
++/*
++ * Qualcomm Tiled Format
++ *
++ * Similar to DRM_FORMAT_MOD_QCOM_COMPRESSED but not compressed.
++ * Implementation may be platform and base-format specific.
++ *
++ * Each macrotile consists of m x n (mostly 4 x 4) tiles.
++ * Pixel data pitch/stride is aligned with macrotile width.
++ * Pixel data height is aligned with macrotile height.
++ * Entire pixel data buffer is aligned with 4k(bytes).
++ */
++#define DRM_FORMAT_MOD_QCOM_TILED3	fourcc_mod_code(QCOM, 3)
++
++/*
++ * Qualcomm Alternate Tiled Format
++ *
++ * Alternate tiled format typically only used within GMEM.
++ * Implementation may be platform and base-format specific.
++ */
++#define DRM_FORMAT_MOD_QCOM_TILED2	fourcc_mod_code(QCOM, 2)
++
++
+ /* Vivante framebuffer modifiers */
+ 
+ /*
+@@ -1293,6 +1362,7 @@
+ #define AMD_FMT_MOD_TILE_VER_GFX9 1
+ #define AMD_FMT_MOD_TILE_VER_GFX10 2
+ #define AMD_FMT_MOD_TILE_VER_GFX10_RBPLUS 3
++#define AMD_FMT_MOD_TILE_VER_GFX11 4
+ 
+ /*
+  * 64K_S is the same for GFX9/GFX10/GFX10_RBPLUS and hence has GFX9 as canonical
+@@ -1308,6 +1378,7 @@
+ #define AMD_FMT_MOD_TILE_GFX9_64K_S_X 25
+ #define AMD_FMT_MOD_TILE_GFX9_64K_D_X 26
+ #define AMD_FMT_MOD_TILE_GFX9_64K_R_X 27
++#define AMD_FMT_MOD_TILE_GFX11_256K_R_X 31
+ 
+ #define AMD_FMT_MOD_DCC_BLOCK_64B 0
+ #define AMD_FMT_MOD_DCC_BLOCK_128B 1
+Index: qemu/include/standard-headers/linux/ethtool.h
+===================================================================
+--- qemu.orig/include/standard-headers/linux/ethtool.h	2023-07-04 20:49:59.000000000 -0400
++++ qemu/include/standard-headers/linux/ethtool.h	2023-07-04 20:49:59.000000000 -0400
+@@ -257,7 +257,7 @@
+ 	uint32_t	id;
+ 	uint32_t	type_id;
+ 	uint32_t	len;
+-	void	*data[0];
++	void	*data[];
+ };
+ 
+ #define DOWNSHIFT_DEV_DEFAULT_COUNT	0xff
+@@ -322,7 +322,7 @@
+ 	uint32_t	cmd;
+ 	uint32_t	version;
+ 	uint32_t	len;
+-	uint8_t	data[0];
++	uint8_t	data[];
+ };
+ 
+ /**
+@@ -348,7 +348,7 @@
+ 	uint32_t	magic;
+ 	uint32_t	offset;
+ 	uint32_t	len;
+-	uint8_t	data[0];
++	uint8_t	data[];
+ };
+ 
+ /**
+@@ -752,7 +752,7 @@
+ 	uint32_t	cmd;
+ 	uint32_t	string_set;
+ 	uint32_t	len;
+-	uint8_t	data[0];
++	uint8_t	data[];
+ };
+ 
+ /**
+@@ -777,7 +777,7 @@
+ 	uint32_t	cmd;
+ 	uint32_t	reserved;
+ 	uint64_t	sset_mask;
+-	uint32_t	data[0];
++	uint32_t	data[];
+ };
+ 
+ /**
+@@ -817,7 +817,7 @@
+ 	uint32_t	flags;
+ 	uint32_t	reserved;
+ 	uint32_t	len;
+-	uint64_t	data[0];
++	uint64_t	data[];
+ };
+ 
+ /**
+@@ -834,7 +834,7 @@
+ struct ethtool_stats {
+ 	uint32_t	cmd;
+ 	uint32_t	n_stats;
+-	uint64_t	data[0];
++	uint64_t	data[];
+ };
+ 
+ /**
+@@ -851,7 +851,7 @@
+ struct ethtool_perm_addr {
+ 	uint32_t	cmd;
+ 	uint32_t	size;
+-	uint8_t	data[0];
++	uint8_t	data[];
+ };
+ 
+ /* boolean flags controlling per-interface behavior characteristics.
+@@ -1160,7 +1160,7 @@
+ struct ethtool_rxfh_indir {
+ 	uint32_t	cmd;
+ 	uint32_t	size;
+-	uint32_t	ring_index[0];
++	uint32_t	ring_index[];
+ };
+ 
+ /**
+@@ -1201,7 +1201,7 @@
+ 	uint8_t	hfunc;
+ 	uint8_t	rsvd8[3];
+ 	uint32_t	rsvd32;
+-	uint32_t   rss_config[0];
++	uint32_t   rss_config[];
+ };
+ #define ETH_RXFH_CONTEXT_ALLOC		0xffffffff
+ #define ETH_RXFH_INDIR_NO_CHANGE	0xffffffff
+@@ -1286,7 +1286,7 @@
+ 	uint32_t	version;
+ 	uint32_t	flag;
+ 	uint32_t	len;
+-	uint8_t	data[0];
++	uint8_t	data[];
+ };
+ 
+ #define ETH_FW_DUMP_DISABLE 0
+@@ -1318,7 +1318,7 @@
+ struct ethtool_gfeatures {
+ 	uint32_t	cmd;
+ 	uint32_t	size;
+-	struct ethtool_get_features_block features[0];
++	struct ethtool_get_features_block features[];
+ };
+ 
+ /**
+@@ -1340,7 +1340,7 @@
+ struct ethtool_sfeatures {
+ 	uint32_t	cmd;
+ 	uint32_t	size;
+-	struct ethtool_set_features_block features[0];
++	struct ethtool_set_features_block features[];
+ };
+ 
+ /**
+@@ -1691,6 +1691,7 @@
+ 	ETHTOOL_LINK_MODE_400000baseCR4_Full_BIT	 = 89,
+ 	ETHTOOL_LINK_MODE_100baseFX_Half_BIT		 = 90,
+ 	ETHTOOL_LINK_MODE_100baseFX_Full_BIT		 = 91,
++	ETHTOOL_LINK_MODE_10baseT1L_Full_BIT		 = 92,
+ 	/* must be last entry */
+ 	__ETHTOOL_LINK_MODE_MASK_NBITS
+ };
+@@ -2086,7 +2087,7 @@
+ 	uint8_t	master_slave_state;
+ 	uint8_t	reserved1[1];
+ 	uint32_t	reserved[7];
+-	uint32_t	link_mode_masks[0];
++	uint32_t	link_mode_masks[];
+ 	/* layout of link_mode_masks fields:
+ 	 * uint32_t map_supported[link_mode_masks_nwords];
+ 	 * uint32_t map_advertising[link_mode_masks_nwords];
+Index: qemu/include/standard-headers/linux/input.h
+===================================================================
+--- qemu.orig/include/standard-headers/linux/input.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/include/standard-headers/linux/input.h	2023-07-04 20:49:59.000000000 -0400
+@@ -75,10 +75,13 @@
+  * Note that input core does not clamp reported values to the
+  * [minimum, maximum] limits, such task is left to userspace.
+  *
+- * The default resolution for main axes (ABS_X, ABS_Y, ABS_Z)
+- * is reported in units per millimeter (units/mm), resolution
+- * for rotational axes (ABS_RX, ABS_RY, ABS_RZ) is reported
+- * in units per radian.
++ * The default resolution for main axes (ABS_X, ABS_Y, ABS_Z,
++ * ABS_MT_POSITION_X, ABS_MT_POSITION_Y) is reported in units
++ * per millimeter (units/mm), resolution for rotational axes
++ * (ABS_RX, ABS_RY, ABS_RZ) is reported in units per radian.
++ * The resolution for the size axes (ABS_MT_TOUCH_MAJOR,
++ * ABS_MT_TOUCH_MINOR, ABS_MT_WIDTH_MAJOR, ABS_MT_WIDTH_MINOR)
++ * is reported in units per millimeter (units/mm).
+  * When INPUT_PROP_ACCELEROMETER is set the resolution changes.
+  * The main axes (ABS_X, ABS_Y, ABS_Z) are then reported in
+  * units per g (units/g) and in units per degree per second
+@@ -268,6 +271,7 @@
+ #define BUS_RMI			0x1D
+ #define BUS_CEC			0x1E
+ #define BUS_INTEL_ISHTP		0x1F
++#define BUS_AMD_SFH		0x20
+ 
+ /*
+  * MT_TOOL types
+Index: qemu/include/standard-headers/linux/pci_regs.h
+===================================================================
+--- qemu.orig/include/standard-headers/linux/pci_regs.h	2023-07-04 20:49:59.000000000 -0400
++++ qemu/include/standard-headers/linux/pci_regs.h	2023-07-04 20:49:59.000000000 -0400
+@@ -616,6 +616,7 @@
+ #define  PCI_EXP_SLTCTL_PWR_OFF        0x0400 /* Power Off */
+ #define  PCI_EXP_SLTCTL_EIC	0x0800	/* Electromechanical Interlock Control */
+ #define  PCI_EXP_SLTCTL_DLLSCE	0x1000	/* Data Link Layer State Changed Enable */
++#define  PCI_EXP_SLTCTL_ASPL_DISABLE	0x2000 /* Auto Slot Power Limit Disable */
+ #define  PCI_EXP_SLTCTL_IBPD_DISABLE	0x4000 /* In-band PD disable */
+ #define PCI_EXP_SLTSTA		0x1a	/* Slot Status */
+ #define  PCI_EXP_SLTSTA_ABP	0x0001	/* Attention Button Pressed */
+@@ -736,7 +737,8 @@
+ #define PCI_EXT_CAP_ID_DVSEC	0x23	/* Designated Vendor-Specific */
+ #define PCI_EXT_CAP_ID_DLF	0x25	/* Data Link Feature */
+ #define PCI_EXT_CAP_ID_PL_16GT	0x26	/* Physical Layer 16.0 GT/s */
+-#define PCI_EXT_CAP_ID_MAX	PCI_EXT_CAP_ID_PL_16GT
++#define PCI_EXT_CAP_ID_DOE	0x2E	/* Data Object Exchange */
++#define PCI_EXT_CAP_ID_MAX	PCI_EXT_CAP_ID_DOE
+ 
+ #define PCI_EXT_CAP_DSN_SIZEOF	12
+ #define PCI_EXT_CAP_MCAST_ENDPOINT_SIZEOF 40
+@@ -1102,4 +1104,30 @@
+ #define  PCI_PL_16GT_LE_CTRL_USP_TX_PRESET_MASK		0x000000F0
+ #define  PCI_PL_16GT_LE_CTRL_USP_TX_PRESET_SHIFT	4
+ 
++/* Data Object Exchange */
++#define PCI_DOE_CAP		0x04    /* DOE Capabilities Register */
++#define  PCI_DOE_CAP_INT_SUP			0x00000001  /* Interrupt Support */
++#define  PCI_DOE_CAP_INT_MSG_NUM		0x00000ffe  /* Interrupt Message Number */
++#define PCI_DOE_CTRL		0x08    /* DOE Control Register */
++#define  PCI_DOE_CTRL_ABORT			0x00000001  /* DOE Abort */
++#define  PCI_DOE_CTRL_INT_EN			0x00000002  /* DOE Interrupt Enable */
++#define  PCI_DOE_CTRL_GO			0x80000000  /* DOE Go */
++#define PCI_DOE_STATUS		0x0c    /* DOE Status Register */
++#define  PCI_DOE_STATUS_BUSY			0x00000001  /* DOE Busy */
++#define  PCI_DOE_STATUS_INT_STATUS		0x00000002  /* DOE Interrupt Status */
++#define  PCI_DOE_STATUS_ERROR			0x00000004  /* DOE Error */
++#define  PCI_DOE_STATUS_DATA_OBJECT_READY	0x80000000  /* Data Object Ready */
++#define PCI_DOE_WRITE		0x10    /* DOE Write Data Mailbox Register */
++#define PCI_DOE_READ		0x14    /* DOE Read Data Mailbox Register */
++
++/* DOE Data Object - note not actually registers */
++#define PCI_DOE_DATA_OBJECT_HEADER_1_VID		0x0000ffff
++#define PCI_DOE_DATA_OBJECT_HEADER_1_TYPE		0x00ff0000
++#define PCI_DOE_DATA_OBJECT_HEADER_2_LENGTH		0x0003ffff
++
++#define PCI_DOE_DATA_OBJECT_DISC_REQ_3_INDEX		0x000000ff
++#define PCI_DOE_DATA_OBJECT_DISC_RSP_3_VID		0x0000ffff
++#define PCI_DOE_DATA_OBJECT_DISC_RSP_3_PROTOCOL		0x00ff0000
++#define PCI_DOE_DATA_OBJECT_DISC_RSP_3_NEXT_INDEX	0xff000000
++
+ #endif /* LINUX_PCI_REGS_H */
+Index: qemu/include/standard-headers/linux/vhost_types.h
+===================================================================
+--- qemu.orig/include/standard-headers/linux/vhost_types.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/include/standard-headers/linux/vhost_types.h	2023-07-04 20:49:59.000000000 -0400
+@@ -87,7 +87,7 @@
+ 
+ struct vhost_msg_v2 {
+ 	uint32_t type;
+-	uint32_t reserved;
++	uint32_t asid;
+ 	union {
+ 		struct vhost_iotlb_msg iotlb;
+ 		uint8_t padding[64];
+@@ -107,7 +107,7 @@
+ struct vhost_memory {
+ 	uint32_t nregions;
+ 	uint32_t padding;
+-	struct vhost_memory_region regions[0];
++	struct vhost_memory_region regions[];
+ };
+ 
+ /* VHOST_SCSI specific definitions */
+@@ -135,7 +135,7 @@
+ struct vhost_vdpa_config {
+ 	uint32_t off;
+ 	uint32_t len;
+-	uint8_t buf[0];
++	uint8_t buf[];
+ };
+ 
+ /* vhost vdpa IOVA range
+@@ -153,4 +153,15 @@
+ /* vhost-net should add virtio_net_hdr for RX, and strip for TX packets. */
+ #define VHOST_NET_F_VIRTIO_NET_HDR 27
+ 
++/* Use message type V2 */
++#define VHOST_BACKEND_F_IOTLB_MSG_V2 0x1
++/* IOTLB can accept batching hints */
++#define VHOST_BACKEND_F_IOTLB_BATCH  0x2
++/* IOTLB can accept address space identifier through V2 type of IOTLB
++ * message
++ */
++#define VHOST_BACKEND_F_IOTLB_ASID  0x3
++/* Device can be suspended */
++#define VHOST_BACKEND_F_SUSPEND  0x4
++
+ #endif
+Index: qemu/include/standard-headers/linux/virtio_9p.h
+===================================================================
+--- qemu.orig/include/standard-headers/linux/virtio_9p.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/include/standard-headers/linux/virtio_9p.h	2023-07-04 20:49:59.000000000 -0400
+@@ -38,7 +38,7 @@
+ 	/* length of the tag name */
+ 	__virtio16 tag_len;
+ 	/* non-NULL terminated tag name */
+-	uint8_t tag[0];
++	uint8_t tag[];
+ } QEMU_PACKED;
+ 
+ #endif /* _LINUX_VIRTIO_9P_H */
+Index: qemu/include/standard-headers/linux/virtio_config.h
+===================================================================
+--- qemu.orig/include/standard-headers/linux/virtio_config.h	2023-07-04 20:49:59.000000000 -0400
++++ qemu/include/standard-headers/linux/virtio_config.h	2023-07-04 20:49:59.000000000 -0400
+@@ -52,7 +52,7 @@
+  * rest are per-device feature bits.
+  */
+ #define VIRTIO_TRANSPORT_F_START	28
+-#define VIRTIO_TRANSPORT_F_END		38
++#define VIRTIO_TRANSPORT_F_END		41
+ 
+ #ifndef VIRTIO_CONFIG_NO_LEGACY
+ /* Do we get callbacks when the ring is completely used, even if we've
+@@ -96,4 +96,9 @@
+  * Does the device support Single Root I/O Virtualization?
+  */
+ #define VIRTIO_F_SR_IOV			37
++
++/*
++ * This feature indicates that the driver can reset a queue individually.
++ */
++#define VIRTIO_F_RING_RESET		40
+ #endif /* _LINUX_VIRTIO_CONFIG_H */
+Index: qemu/include/standard-headers/linux/virtio_ids.h
+===================================================================
+--- qemu.orig/include/standard-headers/linux/virtio_ids.h	2023-07-04 20:49:59.000000000 -0400
++++ qemu/include/standard-headers/linux/virtio_ids.h	2023-07-04 20:49:59.000000000 -0400
+@@ -73,12 +73,12 @@
+  * Virtio Transitional IDs
+  */
+ 
+-#define VIRTIO_TRANS_ID_NET		1000 /* transitional virtio net */
+-#define VIRTIO_TRANS_ID_BLOCK		1001 /* transitional virtio block */
+-#define VIRTIO_TRANS_ID_BALLOON		1002 /* transitional virtio balloon */
+-#define VIRTIO_TRANS_ID_CONSOLE		1003 /* transitional virtio console */
+-#define VIRTIO_TRANS_ID_SCSI		1004 /* transitional virtio SCSI */
+-#define VIRTIO_TRANS_ID_RNG		1005 /* transitional virtio rng */
+-#define VIRTIO_TRANS_ID_9P		1009 /* transitional virtio 9p console */
++#define VIRTIO_TRANS_ID_NET		0x1000 /* transitional virtio net */
++#define VIRTIO_TRANS_ID_BLOCK		0x1001 /* transitional virtio block */
++#define VIRTIO_TRANS_ID_BALLOON		0x1002 /* transitional virtio balloon */
++#define VIRTIO_TRANS_ID_CONSOLE		0x1003 /* transitional virtio console */
++#define VIRTIO_TRANS_ID_SCSI		0x1004 /* transitional virtio SCSI */
++#define VIRTIO_TRANS_ID_RNG		0x1005 /* transitional virtio rng */
++#define VIRTIO_TRANS_ID_9P		0x1009 /* transitional virtio 9p console */
+ 
+ #endif /* _LINUX_VIRTIO_IDS_H */
+Index: qemu/include/standard-headers/linux/virtio_net.h
+===================================================================
+--- qemu.orig/include/standard-headers/linux/virtio_net.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/include/standard-headers/linux/virtio_net.h	2023-07-04 20:49:59.000000000 -0400
+@@ -56,7 +56,7 @@
+ #define VIRTIO_NET_F_MQ	22	/* Device supports Receive Flow
+ 					 * Steering */
+ #define VIRTIO_NET_F_CTRL_MAC_ADDR 23	/* Set MAC address */
+-
++#define VIRTIO_NET_F_NOTF_COAL	53	/* Device supports notifications coalescing */
+ #define VIRTIO_NET_F_HASH_REPORT  57	/* Supports hash report */
+ #define VIRTIO_NET_F_RSS	  60	/* Supports RSS RX steering */
+ #define VIRTIO_NET_F_RSC_EXT	  61	/* extended coalescing info */
+@@ -355,4 +355,36 @@
+ #define VIRTIO_NET_CTRL_GUEST_OFFLOADS   5
+ #define VIRTIO_NET_CTRL_GUEST_OFFLOADS_SET        0
+ 
++/*
++ * Control notifications coalescing.
++ *
++ * Request the device to change the notifications coalescing parameters.
++ *
++ * Available with the VIRTIO_NET_F_NOTF_COAL feature bit.
++ */
++#define VIRTIO_NET_CTRL_NOTF_COAL		6
++/*
++ * Set the tx-usecs/tx-max-packets parameters.
++ */
++struct virtio_net_ctrl_coal_tx {
++	/* Maximum number of packets to send before a TX notification */
++	uint32_t tx_max_packets;
++	/* Maximum number of usecs to delay a TX notification */
++	uint32_t tx_usecs;
++};
++
++#define VIRTIO_NET_CTRL_NOTF_COAL_TX_SET		0
++
++/*
++ * Set the rx-usecs/rx-max-packets parameters.
++ */
++struct virtio_net_ctrl_coal_rx {
++	/* Maximum number of packets to receive before a RX notification */
++	uint32_t rx_max_packets;
++	/* Maximum number of usecs to delay a RX notification */
++	uint32_t rx_usecs;
++};
++
++#define VIRTIO_NET_CTRL_NOTF_COAL_RX_SET		1
++
+ #endif /* _LINUX_VIRTIO_NET_H */
+Index: qemu/include/standard-headers/linux/virtio_pci.h
+===================================================================
+--- qemu.orig/include/standard-headers/linux/virtio_pci.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/include/standard-headers/linux/virtio_pci.h	2023-07-04 20:49:59.000000000 -0400
+@@ -202,6 +202,8 @@
+ #define VIRTIO_PCI_COMMON_Q_AVAILHI	44
+ #define VIRTIO_PCI_COMMON_Q_USEDLO	48
+ #define VIRTIO_PCI_COMMON_Q_USEDHI	52
++#define VIRTIO_PCI_COMMON_Q_NDATA	56
++#define VIRTIO_PCI_COMMON_Q_RESET	58
+ 
+ #endif /* VIRTIO_PCI_NO_MODERN */
+ 
+Index: qemu/include/standard-headers/linux/virtio_ring.h
+===================================================================
+--- qemu.orig/include/standard-headers/linux/virtio_ring.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/include/standard-headers/linux/virtio_ring.h	2023-07-04 20:49:59.000000000 -0400
+@@ -91,15 +91,21 @@
+ #define VRING_USED_ALIGN_SIZE 4
+ #define VRING_DESC_ALIGN_SIZE 16
+ 
+-/* Virtio ring descriptors: 16 bytes.  These can chain together via "next". */
++/**
++ * struct vring_desc - Virtio ring descriptors,
++ * 16 bytes long. These can chain together via @next.
++ *
++ * @addr: buffer address (guest-physical)
++ * @len: buffer length
++ * @flags: descriptor flags
++ * @next: index of the next descriptor in the chain,
++ *        if the VRING_DESC_F_NEXT flag is set. We chain unused
++ *        descriptors via this, too.
++ */
+ struct vring_desc {
+-	/* Address (guest-physical). */
+ 	__virtio64 addr;
+-	/* Length. */
+ 	__virtio32 len;
+-	/* The flags as indicated above. */
+ 	__virtio16 flags;
+-	/* We chain unused descriptors via this, too */
+ 	__virtio16 next;
+ };
+ 
+Index: qemu/linux-headers/asm-arm64/kvm.h
+===================================================================
+--- qemu.orig/linux-headers/asm-arm64/kvm.h	2023-07-04 20:49:59.000000000 -0400
++++ qemu/linux-headers/asm-arm64/kvm.h	2023-07-04 20:49:59.000000000 -0400
+@@ -75,9 +75,11 @@
+ 
+ /* KVM_ARM_SET_DEVICE_ADDR ioctl id encoding */
+ #define KVM_ARM_DEVICE_TYPE_SHIFT	0
+-#define KVM_ARM_DEVICE_TYPE_MASK	(0xffff << KVM_ARM_DEVICE_TYPE_SHIFT)
++#define KVM_ARM_DEVICE_TYPE_MASK	GENMASK(KVM_ARM_DEVICE_TYPE_SHIFT + 15, \
++						KVM_ARM_DEVICE_TYPE_SHIFT)
+ #define KVM_ARM_DEVICE_ID_SHIFT		16
+-#define KVM_ARM_DEVICE_ID_MASK		(0xffff << KVM_ARM_DEVICE_ID_SHIFT)
++#define KVM_ARM_DEVICE_ID_MASK		GENMASK(KVM_ARM_DEVICE_ID_SHIFT + 15, \
++						KVM_ARM_DEVICE_ID_SHIFT)
+ 
+ /* Supported device IDs */
+ #define KVM_ARM_DEVICE_VGIC_V2		0
+@@ -139,8 +141,10 @@
+ 	__u64 dbg_wvr[KVM_ARM_MAX_DBG_REGS];
+ };
+ 
++#define KVM_DEBUG_ARCH_HSR_HIGH_VALID	(1 << 0)
+ struct kvm_debug_exit_arch {
+ 	__u32 hsr;
++	__u32 hsr_high;	/* ESR_EL2[61:32] */
+ 	__u64 far;	/* used for watchpoints */
+ };
+ 
+@@ -332,6 +336,31 @@
+ #define KVM_ARM64_SVE_VLS_WORDS	\
+ 	((KVM_ARM64_SVE_VQ_MAX - KVM_ARM64_SVE_VQ_MIN) / 64 + 1)
+ 
++/* Bitmap feature firmware registers */
++#define KVM_REG_ARM_FW_FEAT_BMAP		(0x0016 << KVM_REG_ARM_COPROC_SHIFT)
++#define KVM_REG_ARM_FW_FEAT_BMAP_REG(r)		(KVM_REG_ARM64 | KVM_REG_SIZE_U64 | \
++						KVM_REG_ARM_FW_FEAT_BMAP |	\
++						((r) & 0xffff))
++
++#define KVM_REG_ARM_STD_BMAP			KVM_REG_ARM_FW_FEAT_BMAP_REG(0)
++
++enum {
++	KVM_REG_ARM_STD_BIT_TRNG_V1_0	= 0,
++};
++
++#define KVM_REG_ARM_STD_HYP_BMAP		KVM_REG_ARM_FW_FEAT_BMAP_REG(1)
++
++enum {
++	KVM_REG_ARM_STD_HYP_BIT_PV_TIME	= 0,
++};
++
++#define KVM_REG_ARM_VENDOR_HYP_BMAP		KVM_REG_ARM_FW_FEAT_BMAP_REG(2)
++
++enum {
++	KVM_REG_ARM_VENDOR_HYP_BIT_FUNC_FEAT	= 0,
++	KVM_REG_ARM_VENDOR_HYP_BIT_PTP		= 1,
++};
++
+ /* Device Control API: ARM VGIC */
+ #define KVM_DEV_ARM_VGIC_GRP_ADDR	0
+ #define KVM_DEV_ARM_VGIC_GRP_DIST_REGS	1
+Index: qemu/linux-headers/asm-generic/unistd.h
+===================================================================
+--- qemu.orig/linux-headers/asm-generic/unistd.h	2023-07-04 20:49:59.000000000 -0400
++++ qemu/linux-headers/asm-generic/unistd.h	2023-07-04 20:49:59.000000000 -0400
+@@ -383,7 +383,7 @@
+ 
+ /* kernel/ptrace.c */
+ #define __NR_ptrace 117
+-__SYSCALL(__NR_ptrace, sys_ptrace)
++__SC_COMP(__NR_ptrace, sys_ptrace, compat_sys_ptrace)
+ 
+ /* kernel/sched/core.c */
+ #define __NR_sched_setparam 118
+@@ -779,7 +779,7 @@
+ #define __NR_kexec_file_load 294
+ __SYSCALL(__NR_kexec_file_load,     sys_kexec_file_load)
+ /* 295 through 402 are unassigned to sync up with generic numbers, don't use */
+-#if __BITS_PER_LONG == 32
++#if defined(__SYSCALL_COMPAT) || __BITS_PER_LONG == 32
+ #define __NR_clock_gettime64 403
+ __SYSCALL(__NR_clock_gettime64, sys_clock_gettime)
+ #define __NR_clock_settime64 404
+Index: qemu/linux-headers/asm-riscv/kvm.h
+===================================================================
+--- qemu.orig/linux-headers/asm-riscv/kvm.h	2023-07-04 20:49:59.000000000 -0400
++++ qemu/linux-headers/asm-riscv/kvm.h	2023-07-04 20:49:59.000000000 -0400
+@@ -82,6 +82,25 @@
+ 	__u64 state;
+ };
+ 
++/*
++ * ISA extension IDs specific to KVM. This is not the same as the host ISA
++ * extension IDs as that is internal to the host and should not be exposed
++ * to the guest. This should always be contiguous to keep the mapping simple
++ * in KVM implementation.
++ */
++enum KVM_RISCV_ISA_EXT_ID {
++	KVM_RISCV_ISA_EXT_A = 0,
++	KVM_RISCV_ISA_EXT_C,
++	KVM_RISCV_ISA_EXT_D,
++	KVM_RISCV_ISA_EXT_F,
++	KVM_RISCV_ISA_EXT_H,
++	KVM_RISCV_ISA_EXT_I,
++	KVM_RISCV_ISA_EXT_M,
++	KVM_RISCV_ISA_EXT_SVPBMT,
++	KVM_RISCV_ISA_EXT_SSTC,
++	KVM_RISCV_ISA_EXT_MAX,
++};
++
+ /* Possible states for kvm_riscv_timer */
+ #define KVM_RISCV_TIMER_STATE_OFF	0
+ #define KVM_RISCV_TIMER_STATE_ON	1
+@@ -123,6 +142,9 @@
+ #define KVM_REG_RISCV_FP_D_REG(name)	\
+ 		(offsetof(struct __riscv_d_ext_state, name) / sizeof(__u64))
+ 
++/* ISA Extension registers are mapped as type 7 */
++#define KVM_REG_RISCV_ISA_EXT		(0x07 << KVM_REG_RISCV_TYPE_SHIFT)
++
+ #endif
+ 
+ #endif /* __LINUX_KVM_RISCV_H */
+Index: qemu/linux-headers/asm-riscv/unistd.h
+===================================================================
+--- qemu.orig/linux-headers/asm-riscv/unistd.h	2023-07-04 20:49:59.000000000 -0400
++++ qemu/linux-headers/asm-riscv/unistd.h	2023-07-04 20:49:59.000000000 -0400
+@@ -15,12 +15,13 @@
+  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+  */
+ 
+-#ifdef __LP64__
++#if defined(__LP64__) && !defined(__SYSCALL_COMPAT)
+ #define __ARCH_WANT_NEW_STAT
+ #define __ARCH_WANT_SET_GET_RLIMIT
+ #endif /* __LP64__ */
+ 
+ #define __ARCH_WANT_SYS_CLONE3
++#define __ARCH_WANT_MEMFD_SECRET
+ 
+ #include <asm-generic/unistd.h>
+ 
+Index: qemu/linux-headers/asm-s390/kvm.h
+===================================================================
+--- qemu.orig/linux-headers/asm-s390/kvm.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/linux-headers/asm-s390/kvm.h	2023-07-04 20:49:59.000000000 -0400
+@@ -74,6 +74,7 @@
+ #define KVM_S390_VM_CRYPTO		2
+ #define KVM_S390_VM_CPU_MODEL		3
+ #define KVM_S390_VM_MIGRATION		4
++#define KVM_S390_VM_CPU_TOPOLOGY	5
+ 
+ /* kvm attributes for mem_ctrl */
+ #define KVM_S390_VM_MEM_ENABLE_CMMA	0
+Index: qemu/linux-headers/asm-x86/kvm.h
+===================================================================
+--- qemu.orig/linux-headers/asm-x86/kvm.h	2023-07-04 20:49:59.000000000 -0400
++++ qemu/linux-headers/asm-x86/kvm.h	2023-07-04 20:49:59.000000000 -0400
+@@ -198,13 +198,13 @@
+ 	__u32 nmsrs; /* number of msrs in entries */
+ 	__u32 pad;
+ 
+-	struct kvm_msr_entry entries[0];
++	struct kvm_msr_entry entries[];
+ };
+ 
+ /* for KVM_GET_MSR_INDEX_LIST */
+ struct kvm_msr_list {
+ 	__u32 nmsrs; /* number of msrs in entries */
+-	__u32 indices[0];
++	__u32 indices[];
+ };
+ 
+ /* Maximum size of any access bitmap in bytes */
+@@ -241,7 +241,7 @@
+ struct kvm_cpuid {
+ 	__u32 nent;
+ 	__u32 padding;
+-	struct kvm_cpuid_entry entries[0];
++	struct kvm_cpuid_entry entries[];
+ };
+ 
+ struct kvm_cpuid_entry2 {
+@@ -263,7 +263,7 @@
+ struct kvm_cpuid2 {
+ 	__u32 nent;
+ 	__u32 padding;
+-	struct kvm_cpuid_entry2 entries[0];
++	struct kvm_cpuid_entry2 entries[];
+ };
+ 
+ /* for KVM_GET_PIT and KVM_SET_PIT */
+@@ -306,7 +306,8 @@
+ 	struct kvm_pit_channel_state channels[3];
+ };
+ 
+-#define KVM_PIT_FLAGS_HPET_LEGACY  0x00000001
++#define KVM_PIT_FLAGS_HPET_LEGACY     0x00000001
++#define KVM_PIT_FLAGS_SPEAKER_DATA_ON 0x00000002
+ 
+ struct kvm_pit_state2 {
+ 	struct kvm_pit_channel_state channels[3];
+@@ -325,6 +326,7 @@
+ #define KVM_VCPUEVENT_VALID_SHADOW	0x00000004
+ #define KVM_VCPUEVENT_VALID_SMM		0x00000008
+ #define KVM_VCPUEVENT_VALID_PAYLOAD	0x00000010
++#define KVM_VCPUEVENT_VALID_TRIPLE_FAULT	0x00000020
+ 
+ /* Interrupt shadow states */
+ #define KVM_X86_SHADOW_INT_MOV_SS	0x01
+@@ -359,7 +361,10 @@
+ 		__u8 smm_inside_nmi;
+ 		__u8 latched_init;
+ 	} smi;
+-	__u8 reserved[27];
++	struct {
++		__u8 pending;
++	} triple_fault;
++	__u8 reserved[26];
+ 	__u8 exception_has_payload;
+ 	__u64 exception_payload;
+ };
+@@ -389,7 +394,7 @@
+ 	 * the contents of CPUID leaf 0xD on the host.
+ 	 */
+ 	__u32 region[1024];
+-	__u32 extra[0];
++	__u32 extra[];
+ };
+ 
+ #define KVM_MAX_XCRS	16
+@@ -428,11 +433,13 @@
+ 	struct kvm_vcpu_events events;
+ };
+ 
+-#define KVM_X86_QUIRK_LINT0_REENABLED	   (1 << 0)
+-#define KVM_X86_QUIRK_CD_NW_CLEARED	   (1 << 1)
+-#define KVM_X86_QUIRK_LAPIC_MMIO_HOLE	   (1 << 2)
+-#define KVM_X86_QUIRK_OUT_7E_INC_RIP	   (1 << 3)
+-#define KVM_X86_QUIRK_MISC_ENABLE_NO_MWAIT (1 << 4)
++#define KVM_X86_QUIRK_LINT0_REENABLED		(1 << 0)
++#define KVM_X86_QUIRK_CD_NW_CLEARED		(1 << 1)
++#define KVM_X86_QUIRK_LAPIC_MMIO_HOLE		(1 << 2)
++#define KVM_X86_QUIRK_OUT_7E_INC_RIP		(1 << 3)
++#define KVM_X86_QUIRK_MISC_ENABLE_NO_MWAIT	(1 << 4)
++#define KVM_X86_QUIRK_FIX_HYPERCALL_INSN	(1 << 5)
++#define KVM_X86_QUIRK_MWAIT_NEVER_UD_FAULTS	(1 << 6)
+ 
+ #define KVM_STATE_NESTED_FORMAT_VMX	0
+ #define KVM_STATE_NESTED_FORMAT_SVM	1
+@@ -515,7 +522,7 @@
+ 	__u32 fixed_counter_bitmap;
+ 	__u32 flags;
+ 	__u32 pad[4];
+-	__u64 events[0];
++	__u64 events[];
+ };
+ 
+ #define KVM_PMU_EVENT_ALLOW 0
+Index: qemu/linux-headers/asm-x86/mman.h
+===================================================================
+--- qemu.orig/linux-headers/asm-x86/mman.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/linux-headers/asm-x86/mman.h	2023-07-04 20:49:59.000000000 -0400
+@@ -5,20 +5,6 @@
+ #define MAP_32BIT	0x40		/* only give out 32bit addresses */
+ 
+ #ifdef CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS
+-/*
+- * Take the 4 protection key bits out of the vma->vm_flags
+- * value and turn them in to the bits that we can put in
+- * to a pte.
+- *
+- * Only override these if Protection Keys are available
+- * (which is only on 64-bit).
+- */
+-#define arch_vm_get_page_prot(vm_flags)	__pgprot(	\
+-		((vm_flags) & VM_PKEY_BIT0 ? _PAGE_PKEY_BIT0 : 0) |	\
+-		((vm_flags) & VM_PKEY_BIT1 ? _PAGE_PKEY_BIT1 : 0) |	\
+-		((vm_flags) & VM_PKEY_BIT2 ? _PAGE_PKEY_BIT2 : 0) |	\
+-		((vm_flags) & VM_PKEY_BIT3 ? _PAGE_PKEY_BIT3 : 0))
+-
+ #define arch_calc_vm_prot_bits(prot, key) (		\
+ 		((key) & 0x1 ? VM_PKEY_BIT0 : 0) |      \
+ 		((key) & 0x2 ? VM_PKEY_BIT1 : 0) |      \
+Index: qemu/linux-headers/linux/kvm.h
+===================================================================
+--- qemu.orig/linux-headers/linux/kvm.h	2023-07-04 20:49:59.000000000 -0400
++++ qemu/linux-headers/linux/kvm.h	2023-07-04 20:49:59.000000000 -0400
+@@ -270,6 +270,8 @@
+ #define KVM_EXIT_X86_BUS_LOCK     33
+ #define KVM_EXIT_XEN              34
+ #define KVM_EXIT_RISCV_SBI        35
++#define KVM_EXIT_RISCV_CSR        36
++#define KVM_EXIT_NOTIFY           37
+ 
+ /* For KVM_EXIT_INTERNAL_ERROR */
+ /* Emulate instruction failed. */
+@@ -444,6 +446,9 @@
+ #define KVM_SYSTEM_EVENT_SHUTDOWN       1
+ #define KVM_SYSTEM_EVENT_RESET          2
+ #define KVM_SYSTEM_EVENT_CRASH          3
++#define KVM_SYSTEM_EVENT_WAKEUP         4
++#define KVM_SYSTEM_EVENT_SUSPEND        5
++#define KVM_SYSTEM_EVENT_SEV_TERM       6
+ 			__u32 type;
+ 			__u32 ndata;
+ 			union {
+@@ -491,6 +496,18 @@
+ 			unsigned long args[6];
+ 			unsigned long ret[2];
+ 		} riscv_sbi;
++		/* KVM_EXIT_RISCV_CSR */
++		struct {
++			unsigned long csr_num;
++			unsigned long new_value;
++			unsigned long write_mask;
++			unsigned long ret_value;
++		} riscv_csr;
++		/* KVM_EXIT_NOTIFY */
++		struct {
++#define KVM_NOTIFY_CONTEXT_INVALID	(1 << 0)
++			__u32 flags;
++		} notify;
+ 		/* Fix the size of the union. */
+ 		char padding[256];
+ 	};
+@@ -537,7 +554,7 @@
+ 
+ struct kvm_coalesced_mmio_ring {
+ 	__u32 first, last;
+-	struct kvm_coalesced_mmio coalesced_mmio[0];
++	struct kvm_coalesced_mmio coalesced_mmio[];
+ };
+ 
+ #define KVM_COALESCED_MMIO_MAX \
+@@ -616,7 +633,7 @@
+ /* for KVM_SET_SIGNAL_MASK */
+ struct kvm_signal_mask {
+ 	__u32 len;
+-	__u8  sigset[0];
++	__u8  sigset[];
+ };
+ 
+ /* for KVM_TPR_ACCESS_REPORTING */
+@@ -644,6 +661,7 @@
+ #define KVM_MP_STATE_OPERATING         7
+ #define KVM_MP_STATE_LOAD              8
+ #define KVM_MP_STATE_AP_RESET_HOLD     9
++#define KVM_MP_STATE_SUSPENDED         10
+ 
+ struct kvm_mp_state {
+ 	__u32 mp_state;
+@@ -1148,8 +1166,15 @@
+ #define KVM_CAP_S390_MEM_OP_EXTENSION 211
+ #define KVM_CAP_PMU_CAPABILITY 212
+ #define KVM_CAP_DISABLE_QUIRKS2 213
+-/* #define KVM_CAP_VM_TSC_CONTROL 214 */
++#define KVM_CAP_VM_TSC_CONTROL 214
+ #define KVM_CAP_SYSTEM_EVENT_DATA 215
++#define KVM_CAP_ARM_SYSTEM_SUSPEND 216
++#define KVM_CAP_S390_PROTECTED_DUMP 217
++#define KVM_CAP_X86_TRIPLE_FAULT_EVENT 218
++#define KVM_CAP_X86_NOTIFY_VMEXIT 219
++#define KVM_CAP_VM_DISABLE_NX_HUGE_PAGES 220
++#define KVM_CAP_S390_ZPCI_OP 221
++#define KVM_CAP_S390_CPU_TOPOLOGY 222
+ 
+ #ifdef KVM_CAP_IRQ_ROUTING
+ 
+@@ -1214,7 +1239,7 @@
+ struct kvm_irq_routing {
+ 	__u32 nr;
+ 	__u32 flags;
+-	struct kvm_irq_routing_entry entries[0];
++	struct kvm_irq_routing_entry entries[];
+ };
+ 
+ #endif
+@@ -1238,6 +1263,7 @@
+ #define KVM_XEN_HVM_CONFIG_SHARED_INFO		(1 << 2)
+ #define KVM_XEN_HVM_CONFIG_RUNSTATE		(1 << 3)
+ #define KVM_XEN_HVM_CONFIG_EVTCHN_2LEVEL	(1 << 4)
++#define KVM_XEN_HVM_CONFIG_EVTCHN_SEND		(1 << 5)
+ 
+ struct kvm_xen_hvm_config {
+ 	__u32 flags;
+@@ -1333,7 +1359,7 @@
+ 
+ struct kvm_reg_list {
+ 	__u64 n; /* number of regs */
+-	__u64 reg[0];
++	__u64 reg[];
+ };
+ 
+ struct kvm_one_reg {
+@@ -1476,7 +1502,8 @@
+ #define KVM_SET_PIT2              _IOW(KVMIO,  0xa0, struct kvm_pit_state2)
+ /* Available with KVM_CAP_PPC_GET_PVINFO */
+ #define KVM_PPC_GET_PVINFO	  _IOW(KVMIO,  0xa1, struct kvm_ppc_pvinfo)
+-/* Available with KVM_CAP_TSC_CONTROL */
++/* Available with KVM_CAP_TSC_CONTROL for a vCPU, or with
++*  KVM_CAP_VM_TSC_CONTROL to set defaults for a VM */
+ #define KVM_SET_TSC_KHZ           _IO(KVMIO,  0xa2)
+ #define KVM_GET_TSC_KHZ           _IO(KVMIO,  0xa3)
+ /* Available with KVM_CAP_PCI_2_3 */
+@@ -1651,6 +1678,55 @@
+ 	__u64 tweak;
+ };
+ 
++enum pv_cmd_dmp_id {
++	KVM_PV_DUMP_INIT,
++	KVM_PV_DUMP_CONFIG_STOR_STATE,
++	KVM_PV_DUMP_COMPLETE,
++	KVM_PV_DUMP_CPU,
++};
++
++struct kvm_s390_pv_dmp {
++	__u64 subcmd;
++	__u64 buff_addr;
++	__u64 buff_len;
++	__u64 gaddr;		/* For dump storage state */
++	__u64 reserved[4];
++};
++
++enum pv_cmd_info_id {
++	KVM_PV_INFO_VM,
++	KVM_PV_INFO_DUMP,
++};
++
++struct kvm_s390_pv_info_dump {
++	__u64 dump_cpu_buffer_len;
++	__u64 dump_config_mem_buffer_per_1m;
++	__u64 dump_config_finalize_len;
++};
++
++struct kvm_s390_pv_info_vm {
++	__u64 inst_calls_list[4];
++	__u64 max_cpus;
++	__u64 max_guests;
++	__u64 max_guest_addr;
++	__u64 feature_indication;
++};
++
++struct kvm_s390_pv_info_header {
++	__u32 id;
++	__u32 len_max;
++	__u32 len_written;
++	__u32 reserved;
++};
++
++struct kvm_s390_pv_info {
++	struct kvm_s390_pv_info_header header;
++	union {
++		struct kvm_s390_pv_info_dump dump;
++		struct kvm_s390_pv_info_vm vm;
++	};
++};
++
+ enum pv_cmd_id {
+ 	KVM_PV_ENABLE,
+ 	KVM_PV_DISABLE,
+@@ -1659,6 +1735,8 @@
+ 	KVM_PV_VERIFY,
+ 	KVM_PV_PREP_RESET,
+ 	KVM_PV_UNSHARE_ALL,
++	KVM_PV_INFO,
++	KVM_PV_DUMP,
+ };
+ 
+ struct kvm_pv_cmd {
+@@ -1692,6 +1770,32 @@
+ 		struct {
+ 			__u64 gfn;
+ 		} shared_info;
++		struct {
++			__u32 send_port;
++			__u32 type; /* EVTCHNSTAT_ipi / EVTCHNSTAT_interdomain */
++			__u32 flags;
++#define KVM_XEN_EVTCHN_DEASSIGN		(1 << 0)
++#define KVM_XEN_EVTCHN_UPDATE		(1 << 1)
++#define KVM_XEN_EVTCHN_RESET		(1 << 2)
++			/*
++			 * Events sent by the guest are either looped back to
++			 * the guest itself (potentially on a different port#)
++			 * or signalled via an eventfd.
++			 */
++			union {
++				struct {
++					__u32 port;
++					__u32 vcpu;
++					__u32 priority;
++				} port;
++				struct {
++					__u32 port; /* Zero for eventfd */
++					__s32 fd;
++				} eventfd;
++				__u32 padding[4];
++			} deliver;
++		} evtchn;
++		__u32 xen_version;
+ 		__u64 pad[8];
+ 	} u;
+ };
+@@ -1700,11 +1804,17 @@
+ #define KVM_XEN_ATTR_TYPE_LONG_MODE		0x0
+ #define KVM_XEN_ATTR_TYPE_SHARED_INFO		0x1
+ #define KVM_XEN_ATTR_TYPE_UPCALL_VECTOR		0x2
++/* Available with KVM_CAP_XEN_HVM / KVM_XEN_HVM_CONFIG_EVTCHN_SEND */
++#define KVM_XEN_ATTR_TYPE_EVTCHN		0x3
++#define KVM_XEN_ATTR_TYPE_XEN_VERSION		0x4
+ 
+ /* Per-vCPU Xen attributes */
+ #define KVM_XEN_VCPU_GET_ATTR	_IOWR(KVMIO, 0xca, struct kvm_xen_vcpu_attr)
+ #define KVM_XEN_VCPU_SET_ATTR	_IOW(KVMIO,  0xcb, struct kvm_xen_vcpu_attr)
+ 
++/* Available with KVM_CAP_XEN_HVM / KVM_XEN_HVM_CONFIG_EVTCHN_SEND */
++#define KVM_XEN_HVM_EVTCHN_SEND	_IOW(KVMIO,  0xd0, struct kvm_irq_routing_xen_evtchn)
++
+ #define KVM_GET_SREGS2             _IOR(KVMIO,  0xcc, struct kvm_sregs2)
+ #define KVM_SET_SREGS2             _IOW(KVMIO,  0xcd, struct kvm_sregs2)
+ 
+@@ -1722,6 +1832,13 @@
+ 			__u64 time_blocked;
+ 			__u64 time_offline;
+ 		} runstate;
++		__u32 vcpu_id;
++		struct {
++			__u32 port;
++			__u32 priority;
++			__u64 expires_ns;
++		} timer;
++		__u8 vector;
+ 	} u;
+ };
+ 
+@@ -1732,6 +1849,10 @@
+ #define KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_CURRENT	0x3
+ #define KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_DATA	0x4
+ #define KVM_XEN_VCPU_ATTR_TYPE_RUNSTATE_ADJUST	0x5
++/* Available with KVM_CAP_XEN_HVM / KVM_XEN_HVM_CONFIG_EVTCHN_SEND */
++#define KVM_XEN_VCPU_ATTR_TYPE_VCPU_ID		0x6
++#define KVM_XEN_VCPU_ATTR_TYPE_TIMER		0x7
++#define KVM_XEN_VCPU_ATTR_TYPE_UPCALL_VECTOR	0x8
+ 
+ /* Secure Encrypted Virtualization command */
+ enum sev_cmd_id {
+@@ -2032,7 +2153,7 @@
+ #define KVM_STATS_UNIT_SECONDS		(0x2 << KVM_STATS_UNIT_SHIFT)
+ #define KVM_STATS_UNIT_CYCLES		(0x3 << KVM_STATS_UNIT_SHIFT)
+ #define KVM_STATS_UNIT_BOOLEAN		(0x4 << KVM_STATS_UNIT_SHIFT)
+-#define KVM_STATS_UNIT_MAX		KVM_STATS_UNIT_CYCLES
++#define KVM_STATS_UNIT_MAX		KVM_STATS_UNIT_BOOLEAN
+ 
+ #define KVM_STATS_BASE_SHIFT		8
+ #define KVM_STATS_BASE_MASK		(0xF << KVM_STATS_BASE_SHIFT)
+@@ -2067,4 +2188,41 @@
+ /* Available with KVM_CAP_XSAVE2 */
+ #define KVM_GET_XSAVE2		  _IOR(KVMIO,  0xcf, struct kvm_xsave)
+ 
++/* Available with KVM_CAP_S390_PROTECTED_DUMP */
++#define KVM_S390_PV_CPU_COMMAND	_IOWR(KVMIO, 0xd0, struct kvm_pv_cmd)
++
++/* Available with KVM_CAP_X86_NOTIFY_VMEXIT */
++#define KVM_X86_NOTIFY_VMEXIT_ENABLED		(1ULL << 0)
++#define KVM_X86_NOTIFY_VMEXIT_USER		(1ULL << 1)
++
++/* Available with KVM_CAP_S390_ZPCI_OP */
++#define KVM_S390_ZPCI_OP         _IOW(KVMIO,  0xd1, struct kvm_s390_zpci_op)
++
++struct kvm_s390_zpci_op {
++	/* in */
++	__u32 fh;               /* target device */
++	__u8  op;               /* operation to perform */
++	__u8  pad[3];
++	union {
++		/* for KVM_S390_ZPCIOP_REG_AEN */
++		struct {
++			__u64 ibv;      /* Guest addr of interrupt bit vector */
++			__u64 sb;       /* Guest addr of summary bit */
++			__u32 flags;
++			__u32 noi;      /* Number of interrupts */
++			__u8 isc;       /* Guest interrupt subclass */
++			__u8 sbo;       /* Offset of guest summary bit vector */
++			__u16 pad;
++		} reg_aen;
++		__u64 reserved[8];
++	} u;
++};
++
++/* types for kvm_s390_zpci_op->op */
++#define KVM_S390_ZPCIOP_REG_AEN                0
++#define KVM_S390_ZPCIOP_DEREG_AEN      1
++
++/* flags for kvm_s390_zpci_op->u.reg_aen.flags */
++#define KVM_S390_ZPCIOP_REGAEN_HOST    (1 << 0)
++
+ #endif /* __LINUX_KVM_H */
+Index: qemu/linux-headers/linux/userfaultfd.h
+===================================================================
+--- qemu.orig/linux-headers/linux/userfaultfd.h	2023-07-04 20:49:59.000000000 -0400
++++ qemu/linux-headers/linux/userfaultfd.h	2023-07-04 20:49:59.000000000 -0400
+@@ -33,7 +33,8 @@
+ 			   UFFD_FEATURE_THREAD_ID |		\
+ 			   UFFD_FEATURE_MINOR_HUGETLBFS |	\
+ 			   UFFD_FEATURE_MINOR_SHMEM |		\
+-			   UFFD_FEATURE_EXACT_ADDRESS)
++			   UFFD_FEATURE_EXACT_ADDRESS |		\
++			   UFFD_FEATURE_WP_HUGETLBFS_SHMEM)
+ #define UFFD_API_IOCTLS				\
+ 	((__u64)1 << _UFFDIO_REGISTER |		\
+ 	 (__u64)1 << _UFFDIO_UNREGISTER |	\
+@@ -47,7 +48,8 @@
+ #define UFFD_API_RANGE_IOCTLS_BASIC		\
+ 	((__u64)1 << _UFFDIO_WAKE |		\
+ 	 (__u64)1 << _UFFDIO_COPY |		\
+-	 (__u64)1 << _UFFDIO_CONTINUE)
++	 (__u64)1 << _UFFDIO_CONTINUE |		\
++	 (__u64)1 << _UFFDIO_WRITEPROTECT)
+ 
+ /*
+  * Valid ioctl command number range with this API is from 0x00 to
+@@ -194,6 +196,9 @@
+ 	 * UFFD_FEATURE_EXACT_ADDRESS indicates that the exact address of page
+ 	 * faults would be provided and the offset within the page would not be
+ 	 * masked.
++	 *
++	 * UFFD_FEATURE_WP_HUGETLBFS_SHMEM indicates that userfaultfd
++	 * write-protection mode is supported on both shmem and hugetlbfs.
+ 	 */
+ #define UFFD_FEATURE_PAGEFAULT_FLAG_WP		(1<<0)
+ #define UFFD_FEATURE_EVENT_FORK			(1<<1)
+@@ -207,6 +212,7 @@
+ #define UFFD_FEATURE_MINOR_HUGETLBFS		(1<<9)
+ #define UFFD_FEATURE_MINOR_SHMEM		(1<<10)
+ #define UFFD_FEATURE_EXACT_ADDRESS		(1<<11)
++#define UFFD_FEATURE_WP_HUGETLBFS_SHMEM		(1<<12)
+ 	__u64 features;
+ 
+ 	__u64 ioctls;
+Index: qemu/linux-headers/linux/vduse.h
+===================================================================
+--- qemu.orig/linux-headers/linux/vduse.h	2023-07-04 20:49:59.000000000 -0400
++++ qemu/linux-headers/linux/vduse.h	2023-07-04 20:49:59.000000000 -0400
+@@ -210,6 +210,53 @@
+  */
+ #define VDUSE_VQ_INJECT_IRQ	_IOW(VDUSE_BASE, 0x17, __u32)
+ 
++/**
++ * struct vduse_iova_umem - userspace memory configuration for one IOVA region
++ * @uaddr: start address of userspace memory, it must be aligned to page size
++ * @iova: start of the IOVA region
++ * @size: size of the IOVA region
++ * @reserved: for future use, needs to be initialized to zero
++ *
++ * Structure used by VDUSE_IOTLB_REG_UMEM and VDUSE_IOTLB_DEREG_UMEM
++ * ioctls to register/de-register userspace memory for IOVA regions
++ */
++struct vduse_iova_umem {
++	__u64 uaddr;
++	__u64 iova;
++	__u64 size;
++	__u64 reserved[3];
++};
++
++/* Register userspace memory for IOVA regions */
++#define VDUSE_IOTLB_REG_UMEM	_IOW(VDUSE_BASE, 0x18, struct vduse_iova_umem)
++
++/* De-register the userspace memory. Caller should set iova and size field. */
++#define VDUSE_IOTLB_DEREG_UMEM	_IOW(VDUSE_BASE, 0x19, struct vduse_iova_umem)
++
++/**
++ * struct vduse_iova_info - information of one IOVA region
++ * @start: start of the IOVA region
++ * @last: last of the IOVA region
++ * @capability: capability of the IOVA regsion
++ * @reserved: for future use, needs to be initialized to zero
++ *
++ * Structure used by VDUSE_IOTLB_GET_INFO ioctl to get information of
++ * one IOVA region.
++ */
++struct vduse_iova_info {
++	__u64 start;
++	__u64 last;
++#define VDUSE_IOVA_CAP_UMEM (1 << 0)
++	__u64 capability;
++	__u64 reserved[3];
++};
++
++/*
++ * Find the first IOVA region that overlaps with the range [start, last]
++ * and return some information on it. Caller should set start and last fields.
++ */
++#define VDUSE_IOTLB_GET_INFO	_IOWR(VDUSE_BASE, 0x1a, struct vduse_iova_info)
++
+ /* The control messages definition for read(2)/write(2) on /dev/vduse/$NAME */
+ 
+ /**
+Index: qemu/linux-headers/linux/vfio.h
+===================================================================
+--- qemu.orig/linux-headers/linux/vfio.h	2023-07-04 20:49:59.000000000 -0400
++++ qemu/linux-headers/linux/vfio.h	2023-07-04 20:49:59.000000000 -0400
+@@ -643,7 +643,7 @@
+ };
+ 
+ /**
+- * VFIO_DEVICE_GET_PCI_HOT_RESET_INFO - _IORW(VFIO_TYPE, VFIO_BASE + 12,
++ * VFIO_DEVICE_GET_PCI_HOT_RESET_INFO - _IOWR(VFIO_TYPE, VFIO_BASE + 12,
+  *					      struct vfio_pci_hot_reset_info)
+  *
+  * Return: 0 on success, -errno on failure:
+@@ -770,7 +770,7 @@
+ #define VFIO_DEVICE_IOEVENTFD		_IO(VFIO_TYPE, VFIO_BASE + 16)
+ 
+ /**
+- * VFIO_DEVICE_FEATURE - _IORW(VFIO_TYPE, VFIO_BASE + 17,
++ * VFIO_DEVICE_FEATURE - _IOWR(VFIO_TYPE, VFIO_BASE + 17,
+  *			       struct vfio_device_feature)
+  *
+  * Get, set, or probe feature data of the device.  The feature is selected
+Index: qemu/linux-headers/linux/vfio_zdev.h
+===================================================================
+--- qemu.orig/linux-headers/linux/vfio_zdev.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/linux-headers/linux/vfio_zdev.h	2023-07-04 20:49:59.000000000 -0400
+@@ -29,6 +29,9 @@
+ 	__u16 fmb_length;	/* Measurement Block Length (in bytes) */
+ 	__u8 pft;		/* PCI Function Type */
+ 	__u8 gid;		/* PCI function group ID */
++	/* End of version 1 */
++	__u32 fh;		/* PCI function handle */
++	/* End of version 2 */
+ };
+ 
+ /**
+@@ -47,6 +50,10 @@
+ 	__u16 noi;		/* Maximum number of MSIs */
+ 	__u16 maxstbl;		/* Maximum Store Block Length */
+ 	__u8 version;		/* Supported PCI Version */
++	/* End of version 1 */
++	__u8 reserved;
++	__u16 imaxstbl;		/* Maximum Interpreted Store Block Length */
++	/* End of version 2 */
+ };
+ 
+ /**
+Index: qemu/linux-headers/linux/vhost.h
+===================================================================
+--- qemu.orig/linux-headers/linux/vhost.h	2023-07-04 20:49:59.000000000 -0400
++++ qemu/linux-headers/linux/vhost.h	2023-07-04 20:49:59.000000000 -0400
+@@ -89,11 +89,6 @@
+ 
+ /* Set or get vhost backend capability */
+ 
+-/* Use message type V2 */
+-#define VHOST_BACKEND_F_IOTLB_MSG_V2 0x1
+-/* IOTLB can accept batching hints */
+-#define VHOST_BACKEND_F_IOTLB_BATCH  0x2
+-
+ #define VHOST_SET_BACKEND_FEATURES _IOW(VHOST_VIRTIO, 0x25, __u64)
+ #define VHOST_GET_BACKEND_FEATURES _IOR(VHOST_VIRTIO, 0x26, __u64)
+ 
+@@ -150,11 +145,39 @@
+ /* Get the valid iova range */
+ #define VHOST_VDPA_GET_IOVA_RANGE	_IOR(VHOST_VIRTIO, 0x78, \
+ 					     struct vhost_vdpa_iova_range)
+-
+ /* Get the config size */
+ #define VHOST_VDPA_GET_CONFIG_SIZE	_IOR(VHOST_VIRTIO, 0x79, __u32)
+ 
+ /* Get the count of all virtqueues */
+ #define VHOST_VDPA_GET_VQS_COUNT	_IOR(VHOST_VIRTIO, 0x80, __u32)
+ 
++/* Get the number of virtqueue groups. */
++#define VHOST_VDPA_GET_GROUP_NUM	_IOR(VHOST_VIRTIO, 0x81, __u32)
++
++/* Get the number of address spaces. */
++#define VHOST_VDPA_GET_AS_NUM		_IOR(VHOST_VIRTIO, 0x7A, unsigned int)
++
++/* Get the group for a virtqueue: read index, write group in num,
++ * The virtqueue index is stored in the index field of
++ * vhost_vring_state. The group for this specific virtqueue is
++ * returned via num field of vhost_vring_state.
++ */
++#define VHOST_VDPA_GET_VRING_GROUP	_IOWR(VHOST_VIRTIO, 0x7B,	\
++					      struct vhost_vring_state)
++/* Set the ASID for a virtqueue group. The group index is stored in
++ * the index field of vhost_vring_state, the ASID associated with this
++ * group is stored at num field of vhost_vring_state.
++ */
++#define VHOST_VDPA_SET_GROUP_ASID	_IOW(VHOST_VIRTIO, 0x7C, \
++					     struct vhost_vring_state)
++
++/* Suspend a device so it does not process virtqueue requests anymore
++ *
++ * After the return of ioctl the device must preserve all the necessary state
++ * (the virtqueue vring base plus the possible device specific states) that is
++ * required for restoring in the future. The device must not change its
++ * configuration after that point.
++ */
++#define VHOST_VDPA_SUSPEND		_IO(VHOST_VIRTIO, 0x7D)
++
+ #endif
diff --git a/debian/patches/ubuntu/lp-1853307-configure-Add-Wno-gnu-variable-sized-type-not-at-end.patch b/debian/patches/ubuntu/lp-1853307-configure-Add-Wno-gnu-variable-sized-type-not-at-end.patch
new file mode 100644
index 0000000..3ab96c1
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1853307-configure-Add-Wno-gnu-variable-sized-type-not-at-end.patch
@@ -0,0 +1,69 @@
+From 28d01b1d69e947a50b9ab9b45113fda1c4f96ac9 Mon Sep 17 00:00:00 2001
+From: Chenyi Qiang <[e-mail]>
+Date: Thu, 15 Sep 2022 17:10:34 +0800
+Subject: [PATCH] configure: Add -Wno-gnu-variable-sized-type-not-at-end
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+A Linux headers update to v6.0-rc switches some definitions from GNU
+'zero-length-array' extension to the C-standard-defined flexible array
+member. e.g.
+
+struct kvm_msrs {
+        __u32 nmsrs; /* number of msrs in entries */
+        __u32 pad;
+
+-       struct kvm_msr_entry entries[0];
++       struct kvm_msr_entry entries[];
+};
+
+Those (unlike the GNU zero-length-array) have some extra restrictions like
+'this must be put at the end of a struct', which clang build would complain
+about. e.g. the current code
+
+struct {
+        struct kvm_msrs info;
+        struct kvm_msr_entry entries[1];
+} msr_data = { }
+
+generates the warning like:
+
+target/i386/kvm/kvm.c:2868:25: error: field 'info' with variable sized
+type 'struct kvm_msrs' not at the end of a struct or class is a GNU
+extension [-Werror,-Wgnu-variable-sized-type-not-at-end]
+        struct kvm_msrs info;
+                        ^
+In fact, the variable length 'entries[]' field in 'info' is zero-sized in
+GNU defined semantics, which can give predictable offset for 'entries[1]'
+in local msr_data. The local defined struct is just there to force a stack
+allocation large enough for 1 kvm_msr_entry, a clever trick but requires to
+turn off this clang warning.
+
+Suggested-by: Daniel P. Berrangé <[e-mail]>
+Signed-off-by: Chenyi Qiang <[e-mail]>
+Reviewed-by: Richard Henderson <[e-mail]>
+Reviewed-by: Cornelia Huck <[e-mail]>
+Message-Id: <[e-mail]>
+Signed-off-by: Thomas Huth <[e-mail]>
+
+Origin: upstream, https://gitlab.com/qemu-project/qemu/commit/28d01b1d69
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1853307
+Last-Update: 2023-07-04
+
+---
+ configure | 1 +
+ 1 file changed, 1 insertion(+)
+
+Index: qemu/configure
+===================================================================
+--- qemu.orig/configure	2023-07-04 20:38:39.000000000 -0400
++++ qemu/configure	2023-07-04 20:49:59.000000000 -0400
+@@ -1641,6 +1641,7 @@
+ add_to nowarn_flags -Wno-typedef-redefinition
+ add_to nowarn_flags -Wno-tautological-type-limit-compare
+ add_to nowarn_flags -Wno-psabi
++add_to nowarn_flags -Wno-gnu-variable-sized-type-not-at-end
+ 
+ gcc_flags="$warn_flags $nowarn_flags"
+ 
diff --git a/debian/patches/ubuntu/lp-1853307-hw-i386-pass-RNG-seed-via-setup_data-entry.patch b/debian/patches/ubuntu/lp-1853307-hw-i386-pass-RNG-seed-via-setup_data-entry.patch
new file mode 100644
index 0000000..c17c3c8
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1853307-hw-i386-pass-RNG-seed-via-setup_data-entry.patch
@@ -0,0 +1,53 @@
+From 94abf6cf290d849681a6d374c73fff1032a4c672 Mon Sep 17 00:00:00 2001
+From: "Jason A. Donenfeld" <[e-mail]>
+Date: Thu, 21 Jul 2022 14:56:36 +0200
+Subject: [PATCH 2/2] hw/i386: pass RNG seed via setup_data entry
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Tiny machines optimized for fast boot time generally don't use EFI,
+which means a random seed has to be supplied some other way. For this
+purpose, Linux (≥5.20) supports passing a seed in the setup_data table
+with SETUP_RNG_SEED, specially intended for hypervisors, kexec, and
+specialized bootloaders. The linked commit shows the upstream kernel
+implementation.
+
+At Paolo's request, we don't pass these to versioned machine types ≤7.0.
+
+Link: https://git.kernel.org/tip/tip/c/68b8e9713c8
+Cc: Marcel Apfelbaum <[e-mail]>
+Cc: Paolo Bonzini <[e-mail]>
+Cc: Richard Henderson <[e-mail]>
+Cc: Eduardo Habkost <[e-mail]>
+Cc: Peter Maydell <[e-mail]>
+Cc: Philippe Mathieu-Daudé <[e-mail]>
+Cc: Laurent Vivier <[e-mail]>
+Reviewed-by: Michael S. Tsirkin <[e-mail]>
+Signed-off-by: Jason A. Donenfeld <[e-mail]>
+Message-Id: <[e-mail]>
+Signed-off-by: Paolo Bonzini <[e-mail]>
+(backported from commit 67f7e426e53833a5db75b0d813e8d537b8a75bd2)
+[MR: only backport the standard-headers change]
+Signed-off-by: Matthew Rosato <[e-mail]>
+
+Origin: backport, https://gitlab.com/qemu-project/qemu/commit/67f7e426e5
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1853307
+Last-Update: 2023-07-04
+
+---
+ include/standard-headers/asm-x86/bootparam.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+Index: qemu/include/standard-headers/asm-x86/bootparam.h
+===================================================================
+--- qemu.orig/include/standard-headers/asm-x86/bootparam.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/include/standard-headers/asm-x86/bootparam.h	2023-07-04 20:51:04.000000000 -0400
+@@ -10,6 +10,7 @@
+ #define SETUP_EFI			4
+ #define SETUP_APPLE_PROPERTIES		5
+ #define SETUP_JAILHOUSE			6
++#define SETUP_RNG_SEED			9
+ 
+ #define SETUP_INDIRECT			(1<<31)
+ 
diff --git a/debian/patches/ubuntu/lp-1853307-kvm-add-support-for-boolean-statistics.patch b/debian/patches/ubuntu/lp-1853307-kvm-add-support-for-boolean-statistics.patch
new file mode 100644
index 0000000..93dc181
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1853307-kvm-add-support-for-boolean-statistics.patch
@@ -0,0 +1,34 @@
+From f36271513241b0df0b78e15c9774bcf63f2d929e Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <[e-mail]>
+Date: Thu, 14 Jul 2022 14:10:22 +0200
+Subject: [PATCH 1/2] kvm: add support for boolean statistics
+
+The next version of Linux will introduce boolean statistics, which
+can only have 0 or 1 values.  Convert them to the new QAPI fields
+added in the previous commit.
+
+Signed-off-by: Paolo Bonzini <[e-mail]>
+(backported from commit 105bb7cdbe9b60129034410e228535f5ea5648ea)
+[MR: only backport linux-header changes]
+Signed-off-by: Matthew Rosato <[e-mail]>
+
+Origin: backport, https://gitlab.com/qemu-project/qemu/commit/105bb7cdbe
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1853307
+Last-Update: 2023-07-04
+
+---
+ linux-headers/linux/kvm.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+Index: qemu/linux-headers/linux/kvm.h
+===================================================================
+--- qemu.orig/linux-headers/linux/kvm.h	2023-07-04 20:49:59.000000000 -0400
++++ qemu/linux-headers/linux/kvm.h	2023-07-04 20:51:04.000000000 -0400
+@@ -2031,6 +2031,7 @@
+ #define KVM_STATS_UNIT_BYTES		(0x1 << KVM_STATS_UNIT_SHIFT)
+ #define KVM_STATS_UNIT_SECONDS		(0x2 << KVM_STATS_UNIT_SHIFT)
+ #define KVM_STATS_UNIT_CYCLES		(0x3 << KVM_STATS_UNIT_SHIFT)
++#define KVM_STATS_UNIT_BOOLEAN		(0x4 << KVM_STATS_UNIT_SHIFT)
+ #define KVM_STATS_UNIT_MAX		KVM_STATS_UNIT_CYCLES
+ 
+ #define KVM_STATS_BASE_SHIFT		8
diff --git a/debian/patches/ubuntu/lp-1853307-linux-headers-Add-vduse.h.patch b/debian/patches/ubuntu/lp-1853307-linux-headers-Add-vduse.h.patch
new file mode 100644
index 0000000..7b398b8
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1853307-linux-headers-Add-vduse.h.patch
@@ -0,0 +1,347 @@
+From 92e879505feb70d141acdb78c0331c796fda8f96 Mon Sep 17 00:00:00 2001
+From: Xie Yongji <[e-mail]>
+Date: Mon, 23 May 2022 16:46:07 +0800
+Subject: [PATCH] linux-headers: Add vduse.h
+
+This adds vduse header to linux headers so that the
+relevant VDUSE API can be used in subsequent patches.
+
+Signed-off-by: Xie Yongji <[e-mail]>
+Reviewed-by: Stefan Hajnoczi <[e-mail]>
+Message-Id: <[e-mail]>
+Signed-off-by: Kevin Wolf <[e-mail]>
+
+Origin: upstream, https://gitlab.com/qemu-project/qemu/commit/92e879505f
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1853307
+Last-Update: 2023-07-04
+
+---
+ linux-headers/linux/vduse.h     | 306 ++++++++++++++++++++++++++++++++
+ scripts/update-linux-headers.sh |   2 +-
+ 2 files changed, 307 insertions(+), 1 deletion(-)
+ create mode 100644 linux-headers/linux/vduse.h
+
+Index: qemu/linux-headers/linux/vduse.h
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ qemu/linux-headers/linux/vduse.h	2023-07-04 20:51:04.000000000 -0400
+@@ -0,0 +1,306 @@
++/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
++#ifndef _VDUSE_H_
++#define _VDUSE_H_
++
++#include <linux/types.h>
++
++#define VDUSE_BASE	0x81
++
++/* The ioctls for control device (/dev/vduse/control) */
++
++#define VDUSE_API_VERSION	0
++
++/*
++ * Get the version of VDUSE API that kernel supported (VDUSE_API_VERSION).
++ * This is used for future extension.
++ */
++#define VDUSE_GET_API_VERSION	_IOR(VDUSE_BASE, 0x00, __u64)
++
++/* Set the version of VDUSE API that userspace supported. */
++#define VDUSE_SET_API_VERSION	_IOW(VDUSE_BASE, 0x01, __u64)
++
++/**
++ * struct vduse_dev_config - basic configuration of a VDUSE device
++ * @name: VDUSE device name, needs to be NUL terminated
++ * @vendor_id: virtio vendor id
++ * @device_id: virtio device id
++ * @features: virtio features
++ * @vq_num: the number of virtqueues
++ * @vq_align: the allocation alignment of virtqueue's metadata
++ * @reserved: for future use, needs to be initialized to zero
++ * @config_size: the size of the configuration space
++ * @config: the buffer of the configuration space
++ *
++ * Structure used by VDUSE_CREATE_DEV ioctl to create VDUSE device.
++ */
++struct vduse_dev_config {
++#define VDUSE_NAME_MAX	256
++	char name[VDUSE_NAME_MAX];
++	__u32 vendor_id;
++	__u32 device_id;
++	__u64 features;
++	__u32 vq_num;
++	__u32 vq_align;
++	__u32 reserved[13];
++	__u32 config_size;
++	__u8 config[];
++};
++
++/* Create a VDUSE device which is represented by a char device (/dev/vduse/$NAME) */
++#define VDUSE_CREATE_DEV	_IOW(VDUSE_BASE, 0x02, struct vduse_dev_config)
++
++/*
++ * Destroy a VDUSE device. Make sure there are no more references
++ * to the char device (/dev/vduse/$NAME).
++ */
++#define VDUSE_DESTROY_DEV	_IOW(VDUSE_BASE, 0x03, char[VDUSE_NAME_MAX])
++
++/* The ioctls for VDUSE device (/dev/vduse/$NAME) */
++
++/**
++ * struct vduse_iotlb_entry - entry of IOTLB to describe one IOVA region [start, last]
++ * @offset: the mmap offset on returned file descriptor
++ * @start: start of the IOVA region
++ * @last: last of the IOVA region
++ * @perm: access permission of the IOVA region
++ *
++ * Structure used by VDUSE_IOTLB_GET_FD ioctl to find an overlapped IOVA region.
++ */
++struct vduse_iotlb_entry {
++	__u64 offset;
++	__u64 start;
++	__u64 last;
++#define VDUSE_ACCESS_RO 0x1
++#define VDUSE_ACCESS_WO 0x2
++#define VDUSE_ACCESS_RW 0x3
++	__u8 perm;
++};
++
++/*
++ * Find the first IOVA region that overlaps with the range [start, last]
++ * and return the corresponding file descriptor. Return -EINVAL means the
++ * IOVA region doesn't exist. Caller should set start and last fields.
++ */
++#define VDUSE_IOTLB_GET_FD	_IOWR(VDUSE_BASE, 0x10, struct vduse_iotlb_entry)
++
++/*
++ * Get the negotiated virtio features. It's a subset of the features in
++ * struct vduse_dev_config which can be accepted by virtio driver. It's
++ * only valid after FEATURES_OK status bit is set.
++ */
++#define VDUSE_DEV_GET_FEATURES	_IOR(VDUSE_BASE, 0x11, __u64)
++
++/**
++ * struct vduse_config_data - data used to update configuration space
++ * @offset: the offset from the beginning of configuration space
++ * @length: the length to write to configuration space
++ * @buffer: the buffer used to write from
++ *
++ * Structure used by VDUSE_DEV_SET_CONFIG ioctl to update device
++ * configuration space.
++ */
++struct vduse_config_data {
++	__u32 offset;
++	__u32 length;
++	__u8 buffer[];
++};
++
++/* Set device configuration space */
++#define VDUSE_DEV_SET_CONFIG	_IOW(VDUSE_BASE, 0x12, struct vduse_config_data)
++
++/*
++ * Inject a config interrupt. It's usually used to notify virtio driver
++ * that device configuration space has changed.
++ */
++#define VDUSE_DEV_INJECT_CONFIG_IRQ	_IO(VDUSE_BASE, 0x13)
++
++/**
++ * struct vduse_vq_config - basic configuration of a virtqueue
++ * @index: virtqueue index
++ * @max_size: the max size of virtqueue
++ * @reserved: for future use, needs to be initialized to zero
++ *
++ * Structure used by VDUSE_VQ_SETUP ioctl to setup a virtqueue.
++ */
++struct vduse_vq_config {
++	__u32 index;
++	__u16 max_size;
++	__u16 reserved[13];
++};
++
++/*
++ * Setup the specified virtqueue. Make sure all virtqueues have been
++ * configured before the device is attached to vDPA bus.
++ */
++#define VDUSE_VQ_SETUP		_IOW(VDUSE_BASE, 0x14, struct vduse_vq_config)
++
++/**
++ * struct vduse_vq_state_split - split virtqueue state
++ * @avail_index: available index
++ */
++struct vduse_vq_state_split {
++	__u16 avail_index;
++};
++
++/**
++ * struct vduse_vq_state_packed - packed virtqueue state
++ * @last_avail_counter: last driver ring wrap counter observed by device
++ * @last_avail_idx: device available index
++ * @last_used_counter: device ring wrap counter
++ * @last_used_idx: used index
++ */
++struct vduse_vq_state_packed {
++	__u16 last_avail_counter;
++	__u16 last_avail_idx;
++	__u16 last_used_counter;
++	__u16 last_used_idx;
++};
++
++/**
++ * struct vduse_vq_info - information of a virtqueue
++ * @index: virtqueue index
++ * @num: the size of virtqueue
++ * @desc_addr: address of desc area
++ * @driver_addr: address of driver area
++ * @device_addr: address of device area
++ * @split: split virtqueue state
++ * @packed: packed virtqueue state
++ * @ready: ready status of virtqueue
++ *
++ * Structure used by VDUSE_VQ_GET_INFO ioctl to get virtqueue's information.
++ */
++struct vduse_vq_info {
++	__u32 index;
++	__u32 num;
++	__u64 desc_addr;
++	__u64 driver_addr;
++	__u64 device_addr;
++	union {
++		struct vduse_vq_state_split split;
++		struct vduse_vq_state_packed packed;
++	};
++	__u8 ready;
++};
++
++/* Get the specified virtqueue's information. Caller should set index field. */
++#define VDUSE_VQ_GET_INFO	_IOWR(VDUSE_BASE, 0x15, struct vduse_vq_info)
++
++/**
++ * struct vduse_vq_eventfd - eventfd configuration for a virtqueue
++ * @index: virtqueue index
++ * @fd: eventfd, -1 means de-assigning the eventfd
++ *
++ * Structure used by VDUSE_VQ_SETUP_KICKFD ioctl to setup kick eventfd.
++ */
++struct vduse_vq_eventfd {
++	__u32 index;
++#define VDUSE_EVENTFD_DEASSIGN -1
++	int fd;
++};
++
++/*
++ * Setup kick eventfd for specified virtqueue. The kick eventfd is used
++ * by VDUSE kernel module to notify userspace to consume the avail vring.
++ */
++#define VDUSE_VQ_SETUP_KICKFD	_IOW(VDUSE_BASE, 0x16, struct vduse_vq_eventfd)
++
++/*
++ * Inject an interrupt for specific virtqueue. It's used to notify virtio driver
++ * to consume the used vring.
++ */
++#define VDUSE_VQ_INJECT_IRQ	_IOW(VDUSE_BASE, 0x17, __u32)
++
++/* The control messages definition for read(2)/write(2) on /dev/vduse/$NAME */
++
++/**
++ * enum vduse_req_type - request type
++ * @VDUSE_GET_VQ_STATE: get the state for specified virtqueue from userspace
++ * @VDUSE_SET_STATUS: set the device status
++ * @VDUSE_UPDATE_IOTLB: Notify userspace to update the memory mapping for
++ *                      specified IOVA range via VDUSE_IOTLB_GET_FD ioctl
++ */
++enum vduse_req_type {
++	VDUSE_GET_VQ_STATE,
++	VDUSE_SET_STATUS,
++	VDUSE_UPDATE_IOTLB,
++};
++
++/**
++ * struct vduse_vq_state - virtqueue state
++ * @index: virtqueue index
++ * @split: split virtqueue state
++ * @packed: packed virtqueue state
++ */
++struct vduse_vq_state {
++	__u32 index;
++	union {
++		struct vduse_vq_state_split split;
++		struct vduse_vq_state_packed packed;
++	};
++};
++
++/**
++ * struct vduse_dev_status - device status
++ * @status: device status
++ */
++struct vduse_dev_status {
++	__u8 status;
++};
++
++/**
++ * struct vduse_iova_range - IOVA range [start, last]
++ * @start: start of the IOVA range
++ * @last: last of the IOVA range
++ */
++struct vduse_iova_range {
++	__u64 start;
++	__u64 last;
++};
++
++/**
++ * struct vduse_dev_request - control request
++ * @type: request type
++ * @request_id: request id
++ * @reserved: for future use
++ * @vq_state: virtqueue state, only index field is available
++ * @s: device status
++ * @iova: IOVA range for updating
++ * @padding: padding
++ *
++ * Structure used by read(2) on /dev/vduse/$NAME.
++ */
++struct vduse_dev_request {
++	__u32 type;
++	__u32 request_id;
++	__u32 reserved[4];
++	union {
++		struct vduse_vq_state vq_state;
++		struct vduse_dev_status s;
++		struct vduse_iova_range iova;
++		__u32 padding[32];
++	};
++};
++
++/**
++ * struct vduse_dev_response - response to control request
++ * @request_id: corresponding request id
++ * @result: the result of request
++ * @reserved: for future use, needs to be initialized to zero
++ * @vq_state: virtqueue state
++ * @padding: padding
++ *
++ * Structure used by write(2) on /dev/vduse/$NAME.
++ */
++struct vduse_dev_response {
++	__u32 request_id;
++#define VDUSE_REQ_RESULT_OK	0x00
++#define VDUSE_REQ_RESULT_FAILED	0x01
++	__u32 result;
++	__u32 reserved[4];
++	union {
++		struct vduse_vq_state vq_state;
++		__u32 padding[32];
++	};
++};
++
++#endif /* _VDUSE_H_ */
+Index: qemu/scripts/update-linux-headers.sh
+===================================================================
+--- qemu.orig/scripts/update-linux-headers.sh	2023-07-04 20:38:39.000000000 -0400
++++ qemu/scripts/update-linux-headers.sh	2023-07-04 20:49:59.000000000 -0400
+@@ -145,7 +145,7 @@
+ rm -rf "$output/linux-headers/linux"
+ mkdir -p "$output/linux-headers/linux"
+ for header in kvm.h vfio.h vfio_ccw.h vfio_zdev.h vhost.h \
+-              psci.h psp-sev.h userfaultfd.h mman.h; do
++              psci.h psp-sev.h userfaultfd.h mman.h vduse.h; do
+     cp "$tmpdir/include/linux/$header" "$output/linux-headers/linux"
+ done
+ 
diff --git a/debian/patches/ubuntu/lp-1853307-linux-headers-Update-headers-to-v5.17-rc1.patch b/debian/patches/ubuntu/lp-1853307-linux-headers-Update-headers-to-v5.17-rc1.patch
new file mode 100644
index 0000000..19f8a7f
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1853307-linux-headers-Update-headers-to-v5.17-rc1.patch
@@ -0,0 +1,1212 @@
+From ef17dd6a8e6b6e3aeb29233996d44dfcb736d515 Mon Sep 17 00:00:00 2001
+From: Vivek Goyal <[e-mail]>
+Date: Tue, 8 Feb 2022 15:48:05 -0500
+Subject: [PATCH] linux-headers: Update headers to v5.17-rc1
+
+Update headers to 5.17-rc1. I need latest fuse changes.
+
+Reviewed-by: Dr. David Alan Gilbert <[e-mail]>
+Signed-off-by: Vivek Goyal <[e-mail]>
+Message-Id: <[e-mail]>
+Signed-off-by: Dr. David Alan Gilbert <[e-mail]>
+
+Origin: upstream, https://gitlab.com/qemu-project/qemu/commit/ef17dd6a8e
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1853307
+Last-Update: 2023-07-04
+
+---
+ include/standard-headers/asm-x86/kvm_para.h   |   1 +
+ include/standard-headers/drm/drm_fourcc.h     |  11 ++
+ include/standard-headers/linux/ethtool.h      |   1 +
+ include/standard-headers/linux/fuse.h         |  60 +++++++-
+ include/standard-headers/linux/pci_regs.h     | 142 +++++++++---------
+ include/standard-headers/linux/virtio_gpio.h  |  72 +++++++++
+ include/standard-headers/linux/virtio_i2c.h   |  47 ++++++
+ include/standard-headers/linux/virtio_iommu.h |   8 +-
+ .../standard-headers/linux/virtio_pcidev.h    |  65 ++++++++
+ include/standard-headers/linux/virtio_scmi.h  |  24 +++
+ linux-headers/asm-generic/unistd.h            |   5 +-
+ linux-headers/asm-mips/unistd_n32.h           |   2 +
+ linux-headers/asm-mips/unistd_n64.h           |   2 +
+ linux-headers/asm-mips/unistd_o32.h           |   2 +
+ linux-headers/asm-powerpc/unistd_32.h         |   2 +
+ linux-headers/asm-powerpc/unistd_64.h         |   2 +
+ linux-headers/asm-riscv/bitsperlong.h         |  14 ++
+ linux-headers/asm-riscv/mman.h                |   1 +
+ linux-headers/asm-riscv/unistd.h              |  44 ++++++
+ linux-headers/asm-s390/unistd_32.h            |   2 +
+ linux-headers/asm-s390/unistd_64.h            |   2 +
+ linux-headers/asm-x86/kvm.h                   |  16 +-
+ linux-headers/asm-x86/unistd_32.h             |   1 +
+ linux-headers/asm-x86/unistd_64.h             |   1 +
+ linux-headers/asm-x86/unistd_x32.h            |   1 +
+ linux-headers/linux/kvm.h                     |  17 +++
+ 26 files changed, 469 insertions(+), 76 deletions(-)
+ create mode 100644 include/standard-headers/linux/virtio_gpio.h
+ create mode 100644 include/standard-headers/linux/virtio_i2c.h
+ create mode 100644 include/standard-headers/linux/virtio_pcidev.h
+ create mode 100644 include/standard-headers/linux/virtio_scmi.h
+ create mode 100644 linux-headers/asm-riscv/bitsperlong.h
+ create mode 100644 linux-headers/asm-riscv/mman.h
+ create mode 100644 linux-headers/asm-riscv/unistd.h
+
+Index: qemu/include/standard-headers/asm-x86/kvm_para.h
+===================================================================
+--- qemu.orig/include/standard-headers/asm-x86/kvm_para.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/include/standard-headers/asm-x86/kvm_para.h	2023-07-04 20:49:59.000000000 -0400
+@@ -8,6 +8,7 @@
+  * should be used to determine that a VM is running under KVM.
+  */
+ #define KVM_CPUID_SIGNATURE	0x40000000
++#define KVM_SIGNATURE "KVMKVMKVM\0\0\0"
+ 
+ /* This CPUID returns two feature bitmaps in eax, edx. Before enabling
+  * a particular paravirtualization, the appropriate feature bit should
+Index: qemu/include/standard-headers/drm/drm_fourcc.h
+===================================================================
+--- qemu.orig/include/standard-headers/drm/drm_fourcc.h	2023-07-04 20:49:59.000000000 -0400
++++ qemu/include/standard-headers/drm/drm_fourcc.h	2023-07-04 20:51:04.000000000 -0400
+@@ -313,6 +313,13 @@
+  */
+ #define DRM_FORMAT_P016		fourcc_code('P', '0', '1', '6') /* 2x2 subsampled Cr:Cb plane 16 bits per channel */
+ 
++/* 2 plane YCbCr420.
++ * 3 10 bit components and 2 padding bits packed into 4 bytes.
++ * index 0 = Y plane, [31:0] x:Y2:Y1:Y0 2:10:10:10 little endian
++ * index 1 = Cr:Cb plane, [63:0] x:Cr2:Cb2:Cr1:x:Cb1:Cr0:Cb0 [2:10:10:10:2:10:10:10] little endian
++ */
++#define DRM_FORMAT_P030		fourcc_code('P', '0', '3', '0') /* 2x2 subsampled Cr:Cb plane 10 bits per channel packed */
++
+ /* 3 plane non-subsampled (444) YCbCr
+  * 16 bits per component, but only 10 bits are used and 6 bits are padded
+  * index 0: Y plane, [15:0] Y:x [10:6] little endian
+@@ -853,6 +860,10 @@
+  * and UV.  Some SAND-using hardware stores UV in a separate tiled
+  * image from Y to reduce the column height, which is not supported
+  * with these modifiers.
++ *
++ * The DRM_FORMAT_MOD_BROADCOM_SAND128_COL_HEIGHT modifier is also
++ * supported for DRM_FORMAT_P030 where the columns remain as 128 bytes
++ * wide, but as this is a 10 bpp format that translates to 96 pixels.
+  */
+ 
+ #define DRM_FORMAT_MOD_BROADCOM_SAND32_COL_HEIGHT(v) \
+Index: qemu/include/standard-headers/linux/ethtool.h
+===================================================================
+--- qemu.orig/include/standard-headers/linux/ethtool.h	2023-07-04 20:49:59.000000000 -0400
++++ qemu/include/standard-headers/linux/ethtool.h	2023-07-04 20:51:04.000000000 -0400
+@@ -231,6 +231,7 @@
+ 	ETHTOOL_RX_COPYBREAK,
+ 	ETHTOOL_TX_COPYBREAK,
+ 	ETHTOOL_PFC_PREVENTION_TOUT, /* timeout in msecs */
++	ETHTOOL_TX_COPYBREAK_BUF_SIZE,
+ 	/*
+ 	 * Add your fresh new tunable attribute above and remember to update
+ 	 * tunable_strings[] in net/ethtool/common.c
+Index: qemu/include/standard-headers/linux/fuse.h
+===================================================================
+--- qemu.orig/include/standard-headers/linux/fuse.h	2023-07-04 20:49:59.000000000 -0400
++++ qemu/include/standard-headers/linux/fuse.h	2023-07-04 20:49:59.000000000 -0400
+@@ -184,6 +184,16 @@
+  *
+  *  7.34
+  *  - add FUSE_SYNCFS
++ *
++ *  7.35
++ *  - add FOPEN_NOFLUSH
++ *
++ *  7.36
++ *  - extend fuse_init_in with reserved fields, add FUSE_INIT_EXT init flag
++ *  - add flags2 to fuse_init_in and fuse_init_out
++ *  - add FUSE_SECURITY_CTX init flag
++ *  - add security context to create, mkdir, symlink, and mknod requests
++ *  - add FUSE_HAS_INODE_DAX, FUSE_ATTR_DAX
+  */
+ 
+ #ifndef _LINUX_FUSE_H
+@@ -215,7 +225,7 @@
+ #define FUSE_KERNEL_VERSION 7
+ 
+ /** Minor version number of this interface */
+-#define FUSE_KERNEL_MINOR_VERSION 34
++#define FUSE_KERNEL_MINOR_VERSION 36
+ 
+ /** The node ID of the root inode */
+ #define FUSE_ROOT_ID 1
+@@ -286,12 +296,14 @@
+  * FOPEN_NONSEEKABLE: the file is not seekable
+  * FOPEN_CACHE_DIR: allow caching this directory
+  * FOPEN_STREAM: the file is stream-like (no file position at all)
++ * FOPEN_NOFLUSH: don't flush data cache on close (unless FUSE_WRITEBACK_CACHE)
+  */
+ #define FOPEN_DIRECT_IO		(1 << 0)
+ #define FOPEN_KEEP_CACHE	(1 << 1)
+ #define FOPEN_NONSEEKABLE	(1 << 2)
+ #define FOPEN_CACHE_DIR		(1 << 3)
+ #define FOPEN_STREAM		(1 << 4)
++#define FOPEN_NOFLUSH		(1 << 5)
+ 
+ /**
+  * INIT request/reply flags
+@@ -332,6 +344,11 @@
+  *			write/truncate sgid is killed only if file has group
+  *			execute permission. (Same as Linux VFS behavior).
+  * FUSE_SETXATTR_EXT:	Server supports extended struct fuse_setxattr_in
++ * FUSE_INIT_EXT: extended fuse_init_in request
++ * FUSE_INIT_RESERVED: reserved, do not use
++ * FUSE_SECURITY_CTX:	add security context to create, mkdir, symlink, and
++ *			mknod
++ * FUSE_HAS_INODE_DAX:  use per inode DAX
+  */
+ #define FUSE_ASYNC_READ		(1 << 0)
+ #define FUSE_POSIX_LOCKS	(1 << 1)
+@@ -363,6 +380,11 @@
+ #define FUSE_SUBMOUNTS		(1 << 27)
+ #define FUSE_HANDLE_KILLPRIV_V2	(1 << 28)
+ #define FUSE_SETXATTR_EXT	(1 << 29)
++#define FUSE_INIT_EXT		(1 << 30)
++#define FUSE_INIT_RESERVED	(1 << 31)
++/* bits 32..63 get shifted down 32 bits into the flags2 field */
++#define FUSE_SECURITY_CTX	(1ULL << 32)
++#define FUSE_HAS_INODE_DAX	(1ULL << 33)
+ 
+ /**
+  * CUSE INIT request/reply flags
+@@ -445,8 +467,10 @@
+  * fuse_attr flags
+  *
+  * FUSE_ATTR_SUBMOUNT: Object is a submount root
++ * FUSE_ATTR_DAX: Enable DAX for this file in per inode DAX mode
+  */
+ #define FUSE_ATTR_SUBMOUNT      (1 << 0)
++#define FUSE_ATTR_DAX		(1 << 1)
+ 
+ /**
+  * Open flags
+@@ -732,6 +756,8 @@
+ 	uint32_t	minor;
+ 	uint32_t	max_readahead;
+ 	uint32_t	flags;
++	uint32_t	flags2;
++	uint32_t	unused[11];
+ };
+ 
+ #define FUSE_COMPAT_INIT_OUT_SIZE 8
+@@ -748,7 +774,8 @@
+ 	uint32_t	time_gran;
+ 	uint16_t	max_pages;
+ 	uint16_t	map_alignment;
+-	uint32_t	unused[8];
++	uint32_t	flags2;
++	uint32_t	unused[7];
+ };
+ 
+ #define CUSE_INIT_INFO_MAX 4096
+@@ -856,9 +883,12 @@
+ 	char name[];
+ };
+ 
+-#define FUSE_NAME_OFFSET offsetof(struct fuse_dirent, name)
+-#define FUSE_DIRENT_ALIGN(x) \
++/* Align variable length records to 64bit boundary */
++#define FUSE_REC_ALIGN(x) \
+ 	(((x) + sizeof(uint64_t) - 1) & ~(sizeof(uint64_t) - 1))
++
++#define FUSE_NAME_OFFSET offsetof(struct fuse_dirent, name)
++#define FUSE_DIRENT_ALIGN(x) FUSE_REC_ALIGN(x)
+ #define FUSE_DIRENT_SIZE(d) \
+ 	FUSE_DIRENT_ALIGN(FUSE_NAME_OFFSET + (d)->namelen)
+ 
+@@ -975,4 +1005,26 @@
+ 	uint64_t	padding;
+ };
+ 
++/*
++ * For each security context, send fuse_secctx with size of security context
++ * fuse_secctx will be followed by security context name and this in turn
++ * will be followed by actual context label.
++ * fuse_secctx, name, context
++ */
++struct fuse_secctx {
++	uint32_t	size;
++	uint32_t	padding;
++};
++
++/*
++ * Contains the information about how many fuse_secctx structures are being
++ * sent and what's the total size of all security contexts (including
++ * size of fuse_secctx_header).
++ *
++ */
++struct fuse_secctx_header {
++	uint32_t	size;
++	uint32_t	nr_secctx;
++};
++
+ #endif /* _LINUX_FUSE_H */
+Index: qemu/include/standard-headers/linux/pci_regs.h
+===================================================================
+--- qemu.orig/include/standard-headers/linux/pci_regs.h	2023-07-04 20:49:59.000000000 -0400
++++ qemu/include/standard-headers/linux/pci_regs.h	2023-07-04 20:51:04.000000000 -0400
+@@ -301,23 +301,23 @@
+ #define  PCI_SID_ESR_FIC	0x20	/* First In Chassis Flag */
+ #define PCI_SID_CHASSIS_NR	3	/* Chassis Number */
+ 
+-/* Message Signalled Interrupt registers */
++/* Message Signaled Interrupt registers */
+ 
+-#define PCI_MSI_FLAGS		2	/* Message Control */
++#define PCI_MSI_FLAGS		0x02	/* Message Control */
+ #define  PCI_MSI_FLAGS_ENABLE	0x0001	/* MSI feature enabled */
+ #define  PCI_MSI_FLAGS_QMASK	0x000e	/* Maximum queue size available */
+ #define  PCI_MSI_FLAGS_QSIZE	0x0070	/* Message queue size configured */
+ #define  PCI_MSI_FLAGS_64BIT	0x0080	/* 64-bit addresses allowed */
+ #define  PCI_MSI_FLAGS_MASKBIT	0x0100	/* Per-vector masking capable */
+ #define PCI_MSI_RFU		3	/* Rest of capability flags */
+-#define PCI_MSI_ADDRESS_LO	4	/* Lower 32 bits */
+-#define PCI_MSI_ADDRESS_HI	8	/* Upper 32 bits (if PCI_MSI_FLAGS_64BIT set) */
+-#define PCI_MSI_DATA_32		8	/* 16 bits of data for 32-bit devices */
+-#define PCI_MSI_MASK_32		12	/* Mask bits register for 32-bit devices */
+-#define PCI_MSI_PENDING_32	16	/* Pending intrs for 32-bit devices */
+-#define PCI_MSI_DATA_64		12	/* 16 bits of data for 64-bit devices */
+-#define PCI_MSI_MASK_64		16	/* Mask bits register for 64-bit devices */
+-#define PCI_MSI_PENDING_64	20	/* Pending intrs for 64-bit devices */
++#define PCI_MSI_ADDRESS_LO	0x04	/* Lower 32 bits */
++#define PCI_MSI_ADDRESS_HI	0x08	/* Upper 32 bits (if PCI_MSI_FLAGS_64BIT set) */
++#define PCI_MSI_DATA_32		0x08	/* 16 bits of data for 32-bit devices */
++#define PCI_MSI_MASK_32		0x0c	/* Mask bits register for 32-bit devices */
++#define PCI_MSI_PENDING_32	0x10	/* Pending intrs for 32-bit devices */
++#define PCI_MSI_DATA_64		0x0c	/* 16 bits of data for 64-bit devices */
++#define PCI_MSI_MASK_64		0x10	/* Mask bits register for 64-bit devices */
++#define PCI_MSI_PENDING_64	0x14	/* Pending intrs for 64-bit devices */
+ 
+ /* MSI-X registers (in MSI-X capability) */
+ #define PCI_MSIX_FLAGS		2	/* Message Control */
+@@ -335,10 +335,10 @@
+ 
+ /* MSI-X Table entry format (in memory mapped by a BAR) */
+ #define PCI_MSIX_ENTRY_SIZE		16
+-#define PCI_MSIX_ENTRY_LOWER_ADDR	0  /* Message Address */
+-#define PCI_MSIX_ENTRY_UPPER_ADDR	4  /* Message Upper Address */
+-#define PCI_MSIX_ENTRY_DATA		8  /* Message Data */
+-#define PCI_MSIX_ENTRY_VECTOR_CTRL	12 /* Vector Control */
++#define PCI_MSIX_ENTRY_LOWER_ADDR	0x0  /* Message Address */
++#define PCI_MSIX_ENTRY_UPPER_ADDR	0x4  /* Message Upper Address */
++#define PCI_MSIX_ENTRY_DATA		0x8  /* Message Data */
++#define PCI_MSIX_ENTRY_VECTOR_CTRL	0xc  /* Vector Control */
+ #define  PCI_MSIX_ENTRY_CTRL_MASKBIT	0x00000001
+ 
+ /* CompactPCI Hotswap Register */
+@@ -470,7 +470,7 @@
+ 
+ /* PCI Express capability registers */
+ 
+-#define PCI_EXP_FLAGS		2	/* Capabilities register */
++#define PCI_EXP_FLAGS		0x02	/* Capabilities register */
+ #define  PCI_EXP_FLAGS_VERS	0x000f	/* Capability version */
+ #define  PCI_EXP_FLAGS_TYPE	0x00f0	/* Device/Port type */
+ #define   PCI_EXP_TYPE_ENDPOINT	   0x0	/* Express Endpoint */
+@@ -484,7 +484,7 @@
+ #define   PCI_EXP_TYPE_RC_EC	   0xa	/* Root Complex Event Collector */
+ #define  PCI_EXP_FLAGS_SLOT	0x0100	/* Slot implemented */
+ #define  PCI_EXP_FLAGS_IRQ	0x3e00	/* Interrupt message number */
+-#define PCI_EXP_DEVCAP		4	/* Device capabilities */
++#define PCI_EXP_DEVCAP		0x04	/* Device capabilities */
+ #define  PCI_EXP_DEVCAP_PAYLOAD	0x00000007 /* Max_Payload_Size */
+ #define  PCI_EXP_DEVCAP_PHANTOM	0x00000018 /* Phantom functions */
+ #define  PCI_EXP_DEVCAP_EXT_TAG	0x00000020 /* Extended tags */
+@@ -497,7 +497,7 @@
+ #define  PCI_EXP_DEVCAP_PWR_VAL	0x03fc0000 /* Slot Power Limit Value */
+ #define  PCI_EXP_DEVCAP_PWR_SCL	0x0c000000 /* Slot Power Limit Scale */
+ #define  PCI_EXP_DEVCAP_FLR     0x10000000 /* Function Level Reset */
+-#define PCI_EXP_DEVCTL		8	/* Device Control */
++#define PCI_EXP_DEVCTL		0x08	/* Device Control */
+ #define  PCI_EXP_DEVCTL_CERE	0x0001	/* Correctable Error Reporting En. */
+ #define  PCI_EXP_DEVCTL_NFERE	0x0002	/* Non-Fatal Error Reporting Enable */
+ #define  PCI_EXP_DEVCTL_FERE	0x0004	/* Fatal Error Reporting Enable */
+@@ -522,7 +522,7 @@
+ #define  PCI_EXP_DEVCTL_READRQ_2048B 0x4000 /* 2048 Bytes */
+ #define  PCI_EXP_DEVCTL_READRQ_4096B 0x5000 /* 4096 Bytes */
+ #define  PCI_EXP_DEVCTL_BCR_FLR 0x8000  /* Bridge Configuration Retry / FLR */
+-#define PCI_EXP_DEVSTA		10	/* Device Status */
++#define PCI_EXP_DEVSTA		0x0a	/* Device Status */
+ #define  PCI_EXP_DEVSTA_CED	0x0001	/* Correctable Error Detected */
+ #define  PCI_EXP_DEVSTA_NFED	0x0002	/* Non-Fatal Error Detected */
+ #define  PCI_EXP_DEVSTA_FED	0x0004	/* Fatal Error Detected */
+@@ -530,7 +530,7 @@
+ #define  PCI_EXP_DEVSTA_AUXPD	0x0010	/* AUX Power Detected */
+ #define  PCI_EXP_DEVSTA_TRPND	0x0020	/* Transactions Pending */
+ #define PCI_CAP_EXP_RC_ENDPOINT_SIZEOF_V1	12	/* v1 endpoints without link end here */
+-#define PCI_EXP_LNKCAP		12	/* Link Capabilities */
++#define PCI_EXP_LNKCAP		0x0c	/* Link Capabilities */
+ #define  PCI_EXP_LNKCAP_SLS	0x0000000f /* Supported Link Speeds */
+ #define  PCI_EXP_LNKCAP_SLS_2_5GB 0x00000001 /* LNKCAP2 SLS Vector bit 0 */
+ #define  PCI_EXP_LNKCAP_SLS_5_0GB 0x00000002 /* LNKCAP2 SLS Vector bit 1 */
+@@ -549,7 +549,7 @@
+ #define  PCI_EXP_LNKCAP_DLLLARC	0x00100000 /* Data Link Layer Link Active Reporting Capable */
+ #define  PCI_EXP_LNKCAP_LBNC	0x00200000 /* Link Bandwidth Notification Capability */
+ #define  PCI_EXP_LNKCAP_PN	0xff000000 /* Port Number */
+-#define PCI_EXP_LNKCTL		16	/* Link Control */
++#define PCI_EXP_LNKCTL		0x10	/* Link Control */
+ #define  PCI_EXP_LNKCTL_ASPMC	0x0003	/* ASPM Control */
+ #define  PCI_EXP_LNKCTL_ASPM_L0S 0x0001	/* L0s Enable */
+ #define  PCI_EXP_LNKCTL_ASPM_L1  0x0002	/* L1 Enable */
+@@ -562,7 +562,7 @@
+ #define  PCI_EXP_LNKCTL_HAWD	0x0200	/* Hardware Autonomous Width Disable */
+ #define  PCI_EXP_LNKCTL_LBMIE	0x0400	/* Link Bandwidth Management Interrupt Enable */
+ #define  PCI_EXP_LNKCTL_LABIE	0x0800	/* Link Autonomous Bandwidth Interrupt Enable */
+-#define PCI_EXP_LNKSTA		18	/* Link Status */
++#define PCI_EXP_LNKSTA		0x12	/* Link Status */
+ #define  PCI_EXP_LNKSTA_CLS	0x000f	/* Current Link Speed */
+ #define  PCI_EXP_LNKSTA_CLS_2_5GB 0x0001 /* Current Link Speed 2.5GT/s */
+ #define  PCI_EXP_LNKSTA_CLS_5_0GB 0x0002 /* Current Link Speed 5.0GT/s */
+@@ -582,7 +582,7 @@
+ #define  PCI_EXP_LNKSTA_LBMS	0x4000	/* Link Bandwidth Management Status */
+ #define  PCI_EXP_LNKSTA_LABS	0x8000	/* Link Autonomous Bandwidth Status */
+ #define PCI_CAP_EXP_ENDPOINT_SIZEOF_V1	20	/* v1 endpoints with link end here */
+-#define PCI_EXP_SLTCAP		20	/* Slot Capabilities */
++#define PCI_EXP_SLTCAP		0x14	/* Slot Capabilities */
+ #define  PCI_EXP_SLTCAP_ABP	0x00000001 /* Attention Button Present */
+ #define  PCI_EXP_SLTCAP_PCP	0x00000002 /* Power Controller Present */
+ #define  PCI_EXP_SLTCAP_MRLSP	0x00000004 /* MRL Sensor Present */
+@@ -595,7 +595,7 @@
+ #define  PCI_EXP_SLTCAP_EIP	0x00020000 /* Electromechanical Interlock Present */
+ #define  PCI_EXP_SLTCAP_NCCS	0x00040000 /* No Command Completed Support */
+ #define  PCI_EXP_SLTCAP_PSN	0xfff80000 /* Physical Slot Number */
+-#define PCI_EXP_SLTCTL		24	/* Slot Control */
++#define PCI_EXP_SLTCTL		0x18	/* Slot Control */
+ #define  PCI_EXP_SLTCTL_ABPE	0x0001	/* Attention Button Pressed Enable */
+ #define  PCI_EXP_SLTCTL_PFDE	0x0002	/* Power Fault Detected Enable */
+ #define  PCI_EXP_SLTCTL_MRLSCE	0x0004	/* MRL Sensor Changed Enable */
+@@ -617,7 +617,7 @@
+ #define  PCI_EXP_SLTCTL_EIC	0x0800	/* Electromechanical Interlock Control */
+ #define  PCI_EXP_SLTCTL_DLLSCE	0x1000	/* Data Link Layer State Changed Enable */
+ #define  PCI_EXP_SLTCTL_IBPD_DISABLE	0x4000 /* In-band PD disable */
+-#define PCI_EXP_SLTSTA		26	/* Slot Status */
++#define PCI_EXP_SLTSTA		0x1a	/* Slot Status */
+ #define  PCI_EXP_SLTSTA_ABP	0x0001	/* Attention Button Pressed */
+ #define  PCI_EXP_SLTSTA_PFD	0x0002	/* Power Fault Detected */
+ #define  PCI_EXP_SLTSTA_MRLSC	0x0004	/* MRL Sensor Changed */
+@@ -627,15 +627,15 @@
+ #define  PCI_EXP_SLTSTA_PDS	0x0040	/* Presence Detect State */
+ #define  PCI_EXP_SLTSTA_EIS	0x0080	/* Electromechanical Interlock Status */
+ #define  PCI_EXP_SLTSTA_DLLSC	0x0100	/* Data Link Layer State Changed */
+-#define PCI_EXP_RTCTL		28	/* Root Control */
++#define PCI_EXP_RTCTL		0x1c	/* Root Control */
+ #define  PCI_EXP_RTCTL_SECEE	0x0001	/* System Error on Correctable Error */
+ #define  PCI_EXP_RTCTL_SENFEE	0x0002	/* System Error on Non-Fatal Error */
+ #define  PCI_EXP_RTCTL_SEFEE	0x0004	/* System Error on Fatal Error */
+ #define  PCI_EXP_RTCTL_PMEIE	0x0008	/* PME Interrupt Enable */
+ #define  PCI_EXP_RTCTL_CRSSVE	0x0010	/* CRS Software Visibility Enable */
+-#define PCI_EXP_RTCAP		30	/* Root Capabilities */
++#define PCI_EXP_RTCAP		0x1e	/* Root Capabilities */
+ #define  PCI_EXP_RTCAP_CRSVIS	0x0001	/* CRS Software Visibility capability */
+-#define PCI_EXP_RTSTA		32	/* Root Status */
++#define PCI_EXP_RTSTA		0x20	/* Root Status */
+ #define  PCI_EXP_RTSTA_PME	0x00010000 /* PME status */
+ #define  PCI_EXP_RTSTA_PENDING	0x00020000 /* PME pending */
+ /*
+@@ -646,7 +646,7 @@
+  * Use pcie_capability_read_word() and similar interfaces to use them
+  * safely.
+  */
+-#define PCI_EXP_DEVCAP2		36	/* Device Capabilities 2 */
++#define PCI_EXP_DEVCAP2		0x24	/* Device Capabilities 2 */
+ #define  PCI_EXP_DEVCAP2_COMP_TMOUT_DIS	0x00000010 /* Completion Timeout Disable supported */
+ #define  PCI_EXP_DEVCAP2_ARI		0x00000020 /* Alternative Routing-ID */
+ #define  PCI_EXP_DEVCAP2_ATOMIC_ROUTE	0x00000040 /* Atomic Op routing */
+@@ -658,7 +658,7 @@
+ #define  PCI_EXP_DEVCAP2_OBFF_MSG	0x00040000 /* New message signaling */
+ #define  PCI_EXP_DEVCAP2_OBFF_WAKE	0x00080000 /* Re-use WAKE# for OBFF */
+ #define  PCI_EXP_DEVCAP2_EE_PREFIX	0x00200000 /* End-End TLP Prefix */
+-#define PCI_EXP_DEVCTL2		40	/* Device Control 2 */
++#define PCI_EXP_DEVCTL2		0x28	/* Device Control 2 */
+ #define  PCI_EXP_DEVCTL2_COMP_TIMEOUT	0x000f	/* Completion Timeout Value */
+ #define  PCI_EXP_DEVCTL2_COMP_TMOUT_DIS	0x0010	/* Completion Timeout Disable */
+ #define  PCI_EXP_DEVCTL2_ARI		0x0020	/* Alternative Routing-ID */
+@@ -670,9 +670,9 @@
+ #define  PCI_EXP_DEVCTL2_OBFF_MSGA_EN	0x2000	/* Enable OBFF Message type A */
+ #define  PCI_EXP_DEVCTL2_OBFF_MSGB_EN	0x4000	/* Enable OBFF Message type B */
+ #define  PCI_EXP_DEVCTL2_OBFF_WAKE_EN	0x6000	/* OBFF using WAKE# signaling */
+-#define PCI_EXP_DEVSTA2		42	/* Device Status 2 */
+-#define PCI_CAP_EXP_RC_ENDPOINT_SIZEOF_V2	44	/* v2 endpoints without link end here */
+-#define PCI_EXP_LNKCAP2		44	/* Link Capabilities 2 */
++#define PCI_EXP_DEVSTA2		0x2a	/* Device Status 2 */
++#define PCI_CAP_EXP_RC_ENDPOINT_SIZEOF_V2 0x2c	/* end of v2 EPs w/o link */
++#define PCI_EXP_LNKCAP2		0x2c	/* Link Capabilities 2 */
+ #define  PCI_EXP_LNKCAP2_SLS_2_5GB	0x00000002 /* Supported Speed 2.5GT/s */
+ #define  PCI_EXP_LNKCAP2_SLS_5_0GB	0x00000004 /* Supported Speed 5GT/s */
+ #define  PCI_EXP_LNKCAP2_SLS_8_0GB	0x00000008 /* Supported Speed 8GT/s */
+@@ -680,7 +680,7 @@
+ #define  PCI_EXP_LNKCAP2_SLS_32_0GB	0x00000020 /* Supported Speed 32GT/s */
+ #define  PCI_EXP_LNKCAP2_SLS_64_0GB	0x00000040 /* Supported Speed 64GT/s */
+ #define  PCI_EXP_LNKCAP2_CROSSLINK	0x00000100 /* Crosslink supported */
+-#define PCI_EXP_LNKCTL2		48	/* Link Control 2 */
++#define PCI_EXP_LNKCTL2		0x30	/* Link Control 2 */
+ #define  PCI_EXP_LNKCTL2_TLS		0x000f
+ #define  PCI_EXP_LNKCTL2_TLS_2_5GT	0x0001 /* Supported Speed 2.5GT/s */
+ #define  PCI_EXP_LNKCTL2_TLS_5_0GT	0x0002 /* Supported Speed 5GT/s */
+@@ -691,12 +691,12 @@
+ #define  PCI_EXP_LNKCTL2_ENTER_COMP	0x0010 /* Enter Compliance */
+ #define  PCI_EXP_LNKCTL2_TX_MARGIN	0x0380 /* Transmit Margin */
+ #define  PCI_EXP_LNKCTL2_HASD		0x0020 /* HW Autonomous Speed Disable */
+-#define PCI_EXP_LNKSTA2		50	/* Link Status 2 */
+-#define PCI_CAP_EXP_ENDPOINT_SIZEOF_V2	52	/* v2 endpoints with link end here */
+-#define PCI_EXP_SLTCAP2		52	/* Slot Capabilities 2 */
++#define PCI_EXP_LNKSTA2		0x32	/* Link Status 2 */
++#define PCI_CAP_EXP_ENDPOINT_SIZEOF_V2	0x32	/* end of v2 EPs w/ link */
++#define PCI_EXP_SLTCAP2		0x34	/* Slot Capabilities 2 */
+ #define  PCI_EXP_SLTCAP2_IBPD	0x00000001 /* In-band PD Disable Supported */
+-#define PCI_EXP_SLTCTL2		56	/* Slot Control 2 */
+-#define PCI_EXP_SLTSTA2		58	/* Slot Status 2 */
++#define PCI_EXP_SLTCTL2		0x38	/* Slot Control 2 */
++#define PCI_EXP_SLTSTA2		0x3a	/* Slot Status 2 */
+ 
+ /* Extended Capabilities (PCI-X 2.0 and Express) */
+ #define PCI_EXT_CAP_ID(header)		(header & 0x0000ffff)
+@@ -742,7 +742,7 @@
+ #define PCI_EXT_CAP_MCAST_ENDPOINT_SIZEOF 40
+ 
+ /* Advanced Error Reporting */
+-#define PCI_ERR_UNCOR_STATUS	4	/* Uncorrectable Error Status */
++#define PCI_ERR_UNCOR_STATUS	0x04	/* Uncorrectable Error Status */
+ #define  PCI_ERR_UNC_UND	0x00000001	/* Undefined */
+ #define  PCI_ERR_UNC_DLP	0x00000010	/* Data Link Protocol */
+ #define  PCI_ERR_UNC_SURPDN	0x00000020	/* Surprise Down */
+@@ -760,11 +760,11 @@
+ #define  PCI_ERR_UNC_MCBTLP	0x00800000	/* MC blocked TLP */
+ #define  PCI_ERR_UNC_ATOMEG	0x01000000	/* Atomic egress blocked */
+ #define  PCI_ERR_UNC_TLPPRE	0x02000000	/* TLP prefix blocked */
+-#define PCI_ERR_UNCOR_MASK	8	/* Uncorrectable Error Mask */
++#define PCI_ERR_UNCOR_MASK	0x08	/* Uncorrectable Error Mask */
+ 	/* Same bits as above */
+-#define PCI_ERR_UNCOR_SEVER	12	/* Uncorrectable Error Severity */
++#define PCI_ERR_UNCOR_SEVER	0x0c	/* Uncorrectable Error Severity */
+ 	/* Same bits as above */
+-#define PCI_ERR_COR_STATUS	16	/* Correctable Error Status */
++#define PCI_ERR_COR_STATUS	0x10	/* Correctable Error Status */
+ #define  PCI_ERR_COR_RCVR	0x00000001	/* Receiver Error Status */
+ #define  PCI_ERR_COR_BAD_TLP	0x00000040	/* Bad TLP Status */
+ #define  PCI_ERR_COR_BAD_DLLP	0x00000080	/* Bad DLLP Status */
+@@ -773,20 +773,20 @@
+ #define  PCI_ERR_COR_ADV_NFAT	0x00002000	/* Advisory Non-Fatal */
+ #define  PCI_ERR_COR_INTERNAL	0x00004000	/* Corrected Internal */
+ #define  PCI_ERR_COR_LOG_OVER	0x00008000	/* Header Log Overflow */
+-#define PCI_ERR_COR_MASK	20	/* Correctable Error Mask */
++#define PCI_ERR_COR_MASK	0x14	/* Correctable Error Mask */
+ 	/* Same bits as above */
+-#define PCI_ERR_CAP		24	/* Advanced Error Capabilities */
+-#define  PCI_ERR_CAP_FEP(x)	((x) & 31)	/* First Error Pointer */
++#define PCI_ERR_CAP		0x18	/* Advanced Error Capabilities & Ctrl*/
++#define  PCI_ERR_CAP_FEP(x)	((x) & 0x1f)	/* First Error Pointer */
+ #define  PCI_ERR_CAP_ECRC_GENC	0x00000020	/* ECRC Generation Capable */
+ #define  PCI_ERR_CAP_ECRC_GENE	0x00000040	/* ECRC Generation Enable */
+ #define  PCI_ERR_CAP_ECRC_CHKC	0x00000080	/* ECRC Check Capable */
+ #define  PCI_ERR_CAP_ECRC_CHKE	0x00000100	/* ECRC Check Enable */
+-#define PCI_ERR_HEADER_LOG	28	/* Header Log Register (16 bytes) */
+-#define PCI_ERR_ROOT_COMMAND	44	/* Root Error Command */
++#define PCI_ERR_HEADER_LOG	0x1c	/* Header Log Register (16 bytes) */
++#define PCI_ERR_ROOT_COMMAND	0x2c	/* Root Error Command */
+ #define  PCI_ERR_ROOT_CMD_COR_EN	0x00000001 /* Correctable Err Reporting Enable */
+ #define  PCI_ERR_ROOT_CMD_NONFATAL_EN	0x00000002 /* Non-Fatal Err Reporting Enable */
+ #define  PCI_ERR_ROOT_CMD_FATAL_EN	0x00000004 /* Fatal Err Reporting Enable */
+-#define PCI_ERR_ROOT_STATUS	48
++#define PCI_ERR_ROOT_STATUS	0x30
+ #define  PCI_ERR_ROOT_COR_RCV		0x00000001 /* ERR_COR Received */
+ #define  PCI_ERR_ROOT_MULTI_COR_RCV	0x00000002 /* Multiple ERR_COR */
+ #define  PCI_ERR_ROOT_UNCOR_RCV		0x00000004 /* ERR_FATAL/NONFATAL */
+@@ -795,52 +795,52 @@
+ #define  PCI_ERR_ROOT_NONFATAL_RCV	0x00000020 /* Non-Fatal Received */
+ #define  PCI_ERR_ROOT_FATAL_RCV		0x00000040 /* Fatal Received */
+ #define  PCI_ERR_ROOT_AER_IRQ		0xf8000000 /* Advanced Error Interrupt Message Number */
+-#define PCI_ERR_ROOT_ERR_SRC	52	/* Error Source Identification */
++#define PCI_ERR_ROOT_ERR_SRC	0x34	/* Error Source Identification */
+ 
+ /* Virtual Channel */
+-#define PCI_VC_PORT_CAP1	4
++#define PCI_VC_PORT_CAP1	0x04
+ #define  PCI_VC_CAP1_EVCC	0x00000007	/* extended VC count */
+ #define  PCI_VC_CAP1_LPEVCC	0x00000070	/* low prio extended VC count */
+ #define  PCI_VC_CAP1_ARB_SIZE	0x00000c00
+-#define PCI_VC_PORT_CAP2	8
++#define PCI_VC_PORT_CAP2	0x08
+ #define  PCI_VC_CAP2_32_PHASE		0x00000002
+ #define  PCI_VC_CAP2_64_PHASE		0x00000004
+ #define  PCI_VC_CAP2_128_PHASE		0x00000008
+ #define  PCI_VC_CAP2_ARB_OFF		0xff000000
+-#define PCI_VC_PORT_CTRL	12
++#define PCI_VC_PORT_CTRL	0x0c
+ #define  PCI_VC_PORT_CTRL_LOAD_TABLE	0x00000001
+-#define PCI_VC_PORT_STATUS	14
++#define PCI_VC_PORT_STATUS	0x0e
+ #define  PCI_VC_PORT_STATUS_TABLE	0x00000001
+-#define PCI_VC_RES_CAP		16
++#define PCI_VC_RES_CAP		0x10
+ #define  PCI_VC_RES_CAP_32_PHASE	0x00000002
+ #define  PCI_VC_RES_CAP_64_PHASE	0x00000004
+ #define  PCI_VC_RES_CAP_128_PHASE	0x00000008
+ #define  PCI_VC_RES_CAP_128_PHASE_TB	0x00000010
+ #define  PCI_VC_RES_CAP_256_PHASE	0x00000020
+ #define  PCI_VC_RES_CAP_ARB_OFF		0xff000000
+-#define PCI_VC_RES_CTRL		20
++#define PCI_VC_RES_CTRL		0x14
+ #define  PCI_VC_RES_CTRL_LOAD_TABLE	0x00010000
+ #define  PCI_VC_RES_CTRL_ARB_SELECT	0x000e0000
+ #define  PCI_VC_RES_CTRL_ID		0x07000000
+ #define  PCI_VC_RES_CTRL_ENABLE		0x80000000
+-#define PCI_VC_RES_STATUS	26
++#define PCI_VC_RES_STATUS	0x1a
+ #define  PCI_VC_RES_STATUS_TABLE	0x00000001
+ #define  PCI_VC_RES_STATUS_NEGO		0x00000002
+ #define PCI_CAP_VC_BASE_SIZEOF		0x10
+-#define PCI_CAP_VC_PER_VC_SIZEOF	0x0C
++#define PCI_CAP_VC_PER_VC_SIZEOF	0x0c
+ 
+ /* Power Budgeting */
+-#define PCI_PWR_DSR		4	/* Data Select Register */
+-#define PCI_PWR_DATA		8	/* Data Register */
++#define PCI_PWR_DSR		0x04	/* Data Select Register */
++#define PCI_PWR_DATA		0x08	/* Data Register */
+ #define  PCI_PWR_DATA_BASE(x)	((x) & 0xff)	    /* Base Power */
+ #define  PCI_PWR_DATA_SCALE(x)	(((x) >> 8) & 3)    /* Data Scale */
+ #define  PCI_PWR_DATA_PM_SUB(x)	(((x) >> 10) & 7)   /* PM Sub State */
+ #define  PCI_PWR_DATA_PM_STATE(x) (((x) >> 13) & 3) /* PM State */
+ #define  PCI_PWR_DATA_TYPE(x)	(((x) >> 15) & 7)   /* Type */
+ #define  PCI_PWR_DATA_RAIL(x)	(((x) >> 18) & 7)   /* Power Rail */
+-#define PCI_PWR_CAP		12	/* Capability */
++#define PCI_PWR_CAP		0x0c	/* Capability */
+ #define  PCI_PWR_CAP_BUDGET(x)	((x) & 1)	/* Included in system budget */
+-#define PCI_EXT_CAP_PWR_SIZEOF	16
++#define PCI_EXT_CAP_PWR_SIZEOF	0x10
+ 
+ /* Root Complex Event Collector Endpoint Association  */
+ #define PCI_RCEC_RCIEP_BITMAP	4	/* Associated Bitmap for RCiEPs */
+@@ -964,7 +964,7 @@
+ #define  PCI_SRIOV_VFM_MI	0x1	/* Dormant.MigrateIn */
+ #define  PCI_SRIOV_VFM_MO	0x2	/* Active.MigrateOut */
+ #define  PCI_SRIOV_VFM_AV	0x3	/* Active.Available */
+-#define PCI_EXT_CAP_SRIOV_SIZEOF 64
++#define PCI_EXT_CAP_SRIOV_SIZEOF 0x40
+ 
+ #define PCI_LTR_MAX_SNOOP_LAT	0x4
+ #define PCI_LTR_MAX_NOSNOOP_LAT	0x6
+@@ -1017,12 +1017,12 @@
+ #define   PCI_TPH_LOC_NONE	0x000	/* no location */
+ #define   PCI_TPH_LOC_CAP	0x200	/* in capability */
+ #define   PCI_TPH_LOC_MSIX	0x400	/* in MSI-X */
+-#define PCI_TPH_CAP_ST_MASK	0x07FF0000	/* st table mask */
+-#define PCI_TPH_CAP_ST_SHIFT	16	/* st table shift */
+-#define PCI_TPH_BASE_SIZEOF	12	/* size with no st table */
++#define PCI_TPH_CAP_ST_MASK	0x07FF0000	/* ST table mask */
++#define PCI_TPH_CAP_ST_SHIFT	16	/* ST table shift */
++#define PCI_TPH_BASE_SIZEOF	0xc	/* size with no ST table */
+ 
+ /* Downstream Port Containment */
+-#define PCI_EXP_DPC_CAP			4	/* DPC Capability */
++#define PCI_EXP_DPC_CAP			0x04	/* DPC Capability */
+ #define PCI_EXP_DPC_IRQ			0x001F	/* Interrupt Message Number */
+ #define  PCI_EXP_DPC_CAP_RP_EXT		0x0020	/* Root Port Extensions */
+ #define  PCI_EXP_DPC_CAP_POISONED_TLP	0x0040	/* Poisoned TLP Egress Blocking Supported */
+@@ -1030,19 +1030,19 @@
+ #define  PCI_EXP_DPC_RP_PIO_LOG_SIZE	0x0F00	/* RP PIO Log Size */
+ #define  PCI_EXP_DPC_CAP_DL_ACTIVE	0x1000	/* ERR_COR signal on DL_Active supported */
+ 
+-#define PCI_EXP_DPC_CTL			6	/* DPC control */
++#define PCI_EXP_DPC_CTL			0x06	/* DPC control */
+ #define  PCI_EXP_DPC_CTL_EN_FATAL	0x0001	/* Enable trigger on ERR_FATAL message */
+ #define  PCI_EXP_DPC_CTL_EN_NONFATAL	0x0002	/* Enable trigger on ERR_NONFATAL message */
+ #define  PCI_EXP_DPC_CTL_INT_EN		0x0008	/* DPC Interrupt Enable */
+ 
+-#define PCI_EXP_DPC_STATUS		8	/* DPC Status */
++#define PCI_EXP_DPC_STATUS		0x08	/* DPC Status */
+ #define  PCI_EXP_DPC_STATUS_TRIGGER	    0x0001 /* Trigger Status */
+ #define  PCI_EXP_DPC_STATUS_TRIGGER_RSN	    0x0006 /* Trigger Reason */
+ #define  PCI_EXP_DPC_STATUS_INTERRUPT	    0x0008 /* Interrupt Status */
+ #define  PCI_EXP_DPC_RP_BUSY		    0x0010 /* Root Port Busy */
+ #define  PCI_EXP_DPC_STATUS_TRIGGER_RSN_EXT 0x0060 /* Trig Reason Extension */
+ 
+-#define PCI_EXP_DPC_SOURCE_ID		10	/* DPC Source Identifier */
++#define PCI_EXP_DPC_SOURCE_ID		 0x0A	/* DPC Source Identifier */
+ 
+ #define PCI_EXP_DPC_RP_PIO_STATUS	 0x0C	/* RP PIO Status */
+ #define PCI_EXP_DPC_RP_PIO_MASK		 0x10	/* RP PIO Mask */
+@@ -1086,7 +1086,11 @@
+ 
+ /* Designated Vendor-Specific (DVSEC, PCI_EXT_CAP_ID_DVSEC) */
+ #define PCI_DVSEC_HEADER1		0x4 /* Designated Vendor-Specific Header1 */
++#define  PCI_DVSEC_HEADER1_VID(x)	((x) & 0xffff)
++#define  PCI_DVSEC_HEADER1_REV(x)	(((x) >> 16) & 0xf)
++#define  PCI_DVSEC_HEADER1_LEN(x)	(((x) >> 20) & 0xfff)
+ #define PCI_DVSEC_HEADER2		0x8 /* Designated Vendor-Specific Header2 */
++#define  PCI_DVSEC_HEADER2_ID(x)		((x) & 0xffff)
+ 
+ /* Data Link Feature */
+ #define PCI_DLF_CAP		0x04	/* Capabilities Register */
+Index: qemu/include/standard-headers/linux/virtio_gpio.h
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ qemu/include/standard-headers/linux/virtio_gpio.h	2023-07-04 20:49:59.000000000 -0400
+@@ -0,0 +1,72 @@
++/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
++
++#ifndef _LINUX_VIRTIO_GPIO_H
++#define _LINUX_VIRTIO_GPIO_H
++
++#include "standard-headers/linux/types.h"
++
++/* Virtio GPIO Feature bits */
++#define VIRTIO_GPIO_F_IRQ			0
++
++/* Virtio GPIO request types */
++#define VIRTIO_GPIO_MSG_GET_NAMES		0x0001
++#define VIRTIO_GPIO_MSG_GET_DIRECTION		0x0002
++#define VIRTIO_GPIO_MSG_SET_DIRECTION		0x0003
++#define VIRTIO_GPIO_MSG_GET_VALUE		0x0004
++#define VIRTIO_GPIO_MSG_SET_VALUE		0x0005
++#define VIRTIO_GPIO_MSG_IRQ_TYPE		0x0006
++
++/* Possible values of the status field */
++#define VIRTIO_GPIO_STATUS_OK			0x0
++#define VIRTIO_GPIO_STATUS_ERR			0x1
++
++/* Direction types */
++#define VIRTIO_GPIO_DIRECTION_NONE		0x00
++#define VIRTIO_GPIO_DIRECTION_OUT		0x01
++#define VIRTIO_GPIO_DIRECTION_IN		0x02
++
++/* Virtio GPIO IRQ types */
++#define VIRTIO_GPIO_IRQ_TYPE_NONE		0x00
++#define VIRTIO_GPIO_IRQ_TYPE_EDGE_RISING	0x01
++#define VIRTIO_GPIO_IRQ_TYPE_EDGE_FALLING	0x02
++#define VIRTIO_GPIO_IRQ_TYPE_EDGE_BOTH		0x03
++#define VIRTIO_GPIO_IRQ_TYPE_LEVEL_HIGH		0x04
++#define VIRTIO_GPIO_IRQ_TYPE_LEVEL_LOW		0x08
++
++struct virtio_gpio_config {
++	uint16_t ngpio;
++	uint8_t padding[2];
++	uint32_t gpio_names_size;
++};
++
++/* Virtio GPIO Request / Response */
++struct virtio_gpio_request {
++	uint16_t type;
++	uint16_t gpio;
++	uint32_t value;
++};
++
++struct virtio_gpio_response {
++	uint8_t status;
++	uint8_t value;
++};
++
++struct virtio_gpio_response_get_names {
++	uint8_t status;
++	uint8_t value[];
++};
++
++/* Virtio GPIO IRQ Request / Response */
++struct virtio_gpio_irq_request {
++	uint16_t gpio;
++};
++
++struct virtio_gpio_irq_response {
++	uint8_t status;
++};
++
++/* Possible values of the interrupt status field */
++#define VIRTIO_GPIO_IRQ_STATUS_INVALID		0x0
++#define VIRTIO_GPIO_IRQ_STATUS_VALID		0x1
++
++#endif /* _LINUX_VIRTIO_GPIO_H */
+Index: qemu/include/standard-headers/linux/virtio_i2c.h
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ qemu/include/standard-headers/linux/virtio_i2c.h	2023-07-04 20:49:59.000000000 -0400
+@@ -0,0 +1,47 @@
++/* SPDX-License-Identifier: GPL-2.0-or-later WITH Linux-syscall-note */
++/*
++ * Definitions for virtio I2C Adpter
++ *
++ * Copyright (c) 2021 Intel Corporation. All rights reserved.
++ */
++
++#ifndef _LINUX_VIRTIO_I2C_H
++#define _LINUX_VIRTIO_I2C_H
++
++#include "standard-headers/linux/const.h"
++#include "standard-headers/linux/types.h"
++
++/* Virtio I2C Feature bits */
++#define VIRTIO_I2C_F_ZERO_LENGTH_REQUEST	0
++
++/* The bit 0 of the @virtio_i2c_out_hdr.@flags, used to group the requests */
++#define VIRTIO_I2C_FLAGS_FAIL_NEXT	_BITUL(0)
++
++/* The bit 1 of the @virtio_i2c_out_hdr.@flags, used to mark a buffer as read */
++#define VIRTIO_I2C_FLAGS_M_RD		_BITUL(1)
++
++/**
++ * struct virtio_i2c_out_hdr - the virtio I2C message OUT header
++ * @addr: the controlled device address
++ * @padding: used to pad to full dword
++ * @flags: used for feature extensibility
++ */
++struct virtio_i2c_out_hdr {
++	uint16_t addr;
++	uint16_t padding;
++	uint32_t flags;
++};
++
++/**
++ * struct virtio_i2c_in_hdr - the virtio I2C message IN header
++ * @status: the processing result from the backend
++ */
++struct virtio_i2c_in_hdr {
++	uint8_t status;
++};
++
++/* The final status written by the device */
++#define VIRTIO_I2C_MSG_OK	0
++#define VIRTIO_I2C_MSG_ERR	1
++
++#endif /* _LINUX_VIRTIO_I2C_H */
+Index: qemu/include/standard-headers/linux/virtio_iommu.h
+===================================================================
+--- qemu.orig/include/standard-headers/linux/virtio_iommu.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/include/standard-headers/linux/virtio_iommu.h	2023-07-04 20:49:59.000000000 -0400
+@@ -16,6 +16,7 @@
+ #define VIRTIO_IOMMU_F_BYPASS			3
+ #define VIRTIO_IOMMU_F_PROBE			4
+ #define VIRTIO_IOMMU_F_MMIO			5
++#define VIRTIO_IOMMU_F_BYPASS_CONFIG		6
+ 
+ struct virtio_iommu_range_64 {
+ 	uint64_t					start;
+@@ -36,6 +37,8 @@
+ 	struct virtio_iommu_range_32		domain_range;
+ 	/* Probe buffer size */
+ 	uint32_t					probe_size;
++	uint8_t					bypass;
++	uint8_t					reserved[3];
+ };
+ 
+ /* Request types */
+@@ -66,11 +69,14 @@
+ 	uint8_t					reserved[3];
+ };
+ 
++#define VIRTIO_IOMMU_ATTACH_F_BYPASS		(1 << 0)
++
+ struct virtio_iommu_req_attach {
+ 	struct virtio_iommu_req_head		head;
+ 	uint32_t					domain;
+ 	uint32_t					endpoint;
+-	uint8_t					reserved[8];
++	uint32_t					flags;
++	uint8_t					reserved[4];
+ 	struct virtio_iommu_req_tail		tail;
+ };
+ 
+Index: qemu/include/standard-headers/linux/virtio_pcidev.h
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ qemu/include/standard-headers/linux/virtio_pcidev.h	2023-07-04 20:49:59.000000000 -0400
+@@ -0,0 +1,65 @@
++/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause) */
++/*
++ * Copyright (C) 2021 Intel Corporation
++ * Author: Johannes Berg <[e-mail]>
++ */
++#ifndef _LINUX_VIRTIO_PCIDEV_H
++#define _LINUX_VIRTIO_PCIDEV_H
++#include "standard-headers/linux/types.h"
++
++/**
++ * enum virtio_pcidev_ops - virtual PCI device operations
++ * @VIRTIO_PCIDEV_OP_RESERVED: reserved to catch errors
++ * @VIRTIO_PCIDEV_OP_CFG_READ: read config space, size is 1, 2, 4 or 8;
++ *	the @data field should be filled in by the device (in little endian).
++ * @VIRTIO_PCIDEV_OP_CFG_WRITE: write config space, size is 1, 2, 4 or 8;
++ *	the @data field contains the data to write (in little endian).
++ * @VIRTIO_PCIDEV_OP_MMIO_READ: read BAR mem/pio, size can be variable;
++ *	the @data field should be filled in by the device (in little endian).
++ * @VIRTIO_PCIDEV_OP_MMIO_WRITE: write BAR mem/pio, size can be variable;
++ *	the @data field contains the data to write (in little endian).
++ * @VIRTIO_PCIDEV_OP_MMIO_MEMSET: memset MMIO, size is variable but
++ *	the @data field only has one byte (unlike @VIRTIO_PCIDEV_OP_MMIO_WRITE)
++ * @VIRTIO_PCIDEV_OP_INT: legacy INTx# pin interrupt, the addr field is 1-4 for
++ *	the number
++ * @VIRTIO_PCIDEV_OP_MSI: MSI(-X) interrupt, this message basically transports
++ *	the 16- or 32-bit write that would otherwise be done into memory,
++ *	analogous to the write messages (@VIRTIO_PCIDEV_OP_MMIO_WRITE) above
++ * @VIRTIO_PCIDEV_OP_PME: Dummy message whose content is ignored (and should be
++ *	all zeroes) to signal the PME# pin.
++ */
++enum virtio_pcidev_ops {
++	VIRTIO_PCIDEV_OP_RESERVED = 0,
++	VIRTIO_PCIDEV_OP_CFG_READ,
++	VIRTIO_PCIDEV_OP_CFG_WRITE,
++	VIRTIO_PCIDEV_OP_MMIO_READ,
++	VIRTIO_PCIDEV_OP_MMIO_WRITE,
++	VIRTIO_PCIDEV_OP_MMIO_MEMSET,
++	VIRTIO_PCIDEV_OP_INT,
++	VIRTIO_PCIDEV_OP_MSI,
++	VIRTIO_PCIDEV_OP_PME,
++};
++
++/**
++ * struct virtio_pcidev_msg - virtio PCI device operation
++ * @op: the operation to do
++ * @bar: the bar (only with BAR read/write messages)
++ * @reserved: reserved
++ * @size: the size of the read/write (in bytes)
++ * @addr: the address to read/write
++ * @data: the data, normally @size long, but just one byte for
++ *	%VIRTIO_PCIDEV_OP_MMIO_MEMSET
++ *
++ * Note: the fields are all in native (CPU) endian, however, the
++ * @data values will often be in little endian (see the ops above.)
++ */
++struct virtio_pcidev_msg {
++	uint8_t op;
++	uint8_t bar;
++	uint16_t reserved;
++	uint32_t size;
++	uint64_t addr;
++	uint8_t data[];
++};
++
++#endif /* _LINUX_VIRTIO_PCIDEV_H */
+Index: qemu/include/standard-headers/linux/virtio_scmi.h
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ qemu/include/standard-headers/linux/virtio_scmi.h	2023-07-04 20:49:59.000000000 -0400
+@@ -0,0 +1,24 @@
++/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause) */
++/*
++ * Copyright (C) 2020-2021 OpenSynergy GmbH
++ * Copyright (C) 2021 ARM Ltd.
++ */
++
++#ifndef _LINUX_VIRTIO_SCMI_H
++#define _LINUX_VIRTIO_SCMI_H
++
++#include "standard-headers/linux/virtio_types.h"
++
++/* Device implements some SCMI notifications, or delayed responses. */
++#define VIRTIO_SCMI_F_P2A_CHANNELS 0
++
++/* Device implements any SCMI statistics shared memory region */
++#define VIRTIO_SCMI_F_SHARED_MEMORY 1
++
++/* Virtqueues */
++
++#define VIRTIO_SCMI_VQ_TX 0 /* cmdq */
++#define VIRTIO_SCMI_VQ_RX 1 /* eventq */
++#define VIRTIO_SCMI_VQ_MAX_CNT 2
++
++#endif /* _LINUX_VIRTIO_SCMI_H */
+Index: qemu/linux-headers/asm-generic/unistd.h
+===================================================================
+--- qemu.orig/linux-headers/asm-generic/unistd.h	2023-07-04 20:49:59.000000000 -0400
++++ qemu/linux-headers/asm-generic/unistd.h	2023-07-04 20:51:04.000000000 -0400
+@@ -883,8 +883,11 @@
+ #define __NR_futex_waitv 449
+ __SYSCALL(__NR_futex_waitv, sys_futex_waitv)
+ 
++#define __NR_set_mempolicy_home_node 450
++__SYSCALL(__NR_set_mempolicy_home_node, sys_set_mempolicy_home_node)
++
+ #undef __NR_syscalls
+-#define __NR_syscalls 450
++#define __NR_syscalls 451
+ 
+ /*
+  * 32 bit systems traditionally used different
+Index: qemu/linux-headers/asm-mips/unistd_n32.h
+===================================================================
+--- qemu.orig/linux-headers/asm-mips/unistd_n32.h	2023-07-04 20:49:59.000000000 -0400
++++ qemu/linux-headers/asm-mips/unistd_n32.h	2023-07-04 20:49:59.000000000 -0400
+@@ -377,5 +377,7 @@
+ #define __NR_landlock_add_rule (__NR_Linux + 445)
+ #define __NR_landlock_restrict_self (__NR_Linux + 446)
+ #define __NR_process_mrelease (__NR_Linux + 448)
++#define __NR_futex_waitv (__NR_Linux + 449)
++#define __NR_set_mempolicy_home_node (__NR_Linux + 450)
+ 
+ #endif /* _ASM_UNISTD_N32_H */
+Index: qemu/linux-headers/asm-mips/unistd_n64.h
+===================================================================
+--- qemu.orig/linux-headers/asm-mips/unistd_n64.h	2023-07-04 20:49:59.000000000 -0400
++++ qemu/linux-headers/asm-mips/unistd_n64.h	2023-07-04 20:49:59.000000000 -0400
+@@ -353,5 +353,7 @@
+ #define __NR_landlock_add_rule (__NR_Linux + 445)
+ #define __NR_landlock_restrict_self (__NR_Linux + 446)
+ #define __NR_process_mrelease (__NR_Linux + 448)
++#define __NR_futex_waitv (__NR_Linux + 449)
++#define __NR_set_mempolicy_home_node (__NR_Linux + 450)
+ 
+ #endif /* _ASM_UNISTD_N64_H */
+Index: qemu/linux-headers/asm-mips/unistd_o32.h
+===================================================================
+--- qemu.orig/linux-headers/asm-mips/unistd_o32.h	2023-07-04 20:49:59.000000000 -0400
++++ qemu/linux-headers/asm-mips/unistd_o32.h	2023-07-04 20:49:59.000000000 -0400
+@@ -423,5 +423,7 @@
+ #define __NR_landlock_add_rule (__NR_Linux + 445)
+ #define __NR_landlock_restrict_self (__NR_Linux + 446)
+ #define __NR_process_mrelease (__NR_Linux + 448)
++#define __NR_futex_waitv (__NR_Linux + 449)
++#define __NR_set_mempolicy_home_node (__NR_Linux + 450)
+ 
+ #endif /* _ASM_UNISTD_O32_H */
+Index: qemu/linux-headers/asm-powerpc/unistd_32.h
+===================================================================
+--- qemu.orig/linux-headers/asm-powerpc/unistd_32.h	2023-07-04 20:49:59.000000000 -0400
++++ qemu/linux-headers/asm-powerpc/unistd_32.h	2023-07-04 20:49:59.000000000 -0400
+@@ -430,6 +430,8 @@
+ #define __NR_landlock_add_rule 445
+ #define __NR_landlock_restrict_self 446
+ #define __NR_process_mrelease 448
++#define __NR_futex_waitv 449
++#define __NR_set_mempolicy_home_node 450
+ 
+ 
+ #endif /* _ASM_UNISTD_32_H */
+Index: qemu/linux-headers/asm-powerpc/unistd_64.h
+===================================================================
+--- qemu.orig/linux-headers/asm-powerpc/unistd_64.h	2023-07-04 20:49:59.000000000 -0400
++++ qemu/linux-headers/asm-powerpc/unistd_64.h	2023-07-04 20:49:59.000000000 -0400
+@@ -402,6 +402,8 @@
+ #define __NR_landlock_add_rule 445
+ #define __NR_landlock_restrict_self 446
+ #define __NR_process_mrelease 448
++#define __NR_futex_waitv 449
++#define __NR_set_mempolicy_home_node 450
+ 
+ 
+ #endif /* _ASM_UNISTD_64_H */
+Index: qemu/linux-headers/asm-riscv/bitsperlong.h
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ qemu/linux-headers/asm-riscv/bitsperlong.h	2023-07-04 20:49:59.000000000 -0400
+@@ -0,0 +1,14 @@
++/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */
++/*
++ * Copyright (C) 2012 ARM Ltd.
++ * Copyright (C) 2015 Regents of the University of California
++ */
++
++#ifndef _ASM_RISCV_BITSPERLONG_H
++#define _ASM_RISCV_BITSPERLONG_H
++
++#define __BITS_PER_LONG (__SIZEOF_POINTER__ * 8)
++
++#include <asm-generic/bitsperlong.h>
++
++#endif /* _ASM_RISCV_BITSPERLONG_H */
+Index: qemu/linux-headers/asm-riscv/mman.h
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ qemu/linux-headers/asm-riscv/mman.h	2023-07-04 20:49:59.000000000 -0400
+@@ -0,0 +1 @@
++#include <asm-generic/mman.h>
+Index: qemu/linux-headers/asm-riscv/unistd.h
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ qemu/linux-headers/asm-riscv/unistd.h	2023-07-04 20:51:04.000000000 -0400
+@@ -0,0 +1,44 @@
++/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
++/*
++ * Copyright (C) 2018 David Abdurachmanov <[e-mail]>
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
++ */
++
++#ifdef __LP64__
++#define __ARCH_WANT_NEW_STAT
++#define __ARCH_WANT_SET_GET_RLIMIT
++#endif /* __LP64__ */
++
++#define __ARCH_WANT_SYS_CLONE3
++
++#include <asm-generic/unistd.h>
++
++/*
++ * Allows the instruction cache to be flushed from userspace.  Despite RISC-V
++ * having a direct 'fence.i' instruction available to userspace (which we
++ * can't trap!), that's not actually viable when running on Linux because the
++ * kernel might schedule a process on another hart.  There is no way for
++ * userspace to handle this without invoking the kernel (as it doesn't know the
++ * thread->hart mappings), so we've defined a RISC-V specific system call to
++ * flush the instruction cache.
++ *
++ * __NR_riscv_flush_icache is defined to flush the instruction cache over an
++ * address range, with the flush applying to either all threads or just the
++ * caller.  We don't currently do anything with the address range, that's just
++ * in there for forwards compatibility.
++ */
++#ifndef __NR_riscv_flush_icache
++#define __NR_riscv_flush_icache (__NR_arch_specific_syscall + 15)
++#endif
++__SYSCALL(__NR_riscv_flush_icache, sys_riscv_flush_icache)
+Index: qemu/linux-headers/asm-s390/unistd_32.h
+===================================================================
+--- qemu.orig/linux-headers/asm-s390/unistd_32.h	2023-07-04 20:49:59.000000000 -0400
++++ qemu/linux-headers/asm-s390/unistd_32.h	2023-07-04 20:49:59.000000000 -0400
+@@ -420,5 +420,7 @@
+ #define __NR_landlock_add_rule 445
+ #define __NR_landlock_restrict_self 446
+ #define __NR_process_mrelease 448
++#define __NR_futex_waitv 449
++#define __NR_set_mempolicy_home_node 450
+ 
+ #endif /* _ASM_S390_UNISTD_32_H */
+Index: qemu/linux-headers/asm-s390/unistd_64.h
+===================================================================
+--- qemu.orig/linux-headers/asm-s390/unistd_64.h	2023-07-04 20:49:59.000000000 -0400
++++ qemu/linux-headers/asm-s390/unistd_64.h	2023-07-04 20:49:59.000000000 -0400
+@@ -368,5 +368,7 @@
+ #define __NR_landlock_add_rule 445
+ #define __NR_landlock_restrict_self 446
+ #define __NR_process_mrelease 448
++#define __NR_futex_waitv 449
++#define __NR_set_mempolicy_home_node 450
+ 
+ #endif /* _ASM_S390_UNISTD_64_H */
+Index: qemu/linux-headers/asm-x86/kvm.h
+===================================================================
+--- qemu.orig/linux-headers/asm-x86/kvm.h	2023-07-04 20:49:59.000000000 -0400
++++ qemu/linux-headers/asm-x86/kvm.h	2023-07-04 20:51:11.000000000 -0400
+@@ -373,9 +373,23 @@
+ 	__u64 reserved[9];
+ };
+ 
+-/* for KVM_CAP_XSAVE */
++/* for KVM_CAP_XSAVE and KVM_CAP_XSAVE2 */
+ struct kvm_xsave {
++	/*
++	 * KVM_GET_XSAVE2 and KVM_SET_XSAVE write and read as many bytes
++	 * as are returned by KVM_CHECK_EXTENSION(KVM_CAP_XSAVE2)
++	 * respectively, when invoked on the vm file descriptor.
++	 *
++	 * The size value returned by KVM_CHECK_EXTENSION(KVM_CAP_XSAVE2)
++	 * will always be at least 4096. Currently, it is only greater
++	 * than 4096 if a dynamic feature has been enabled with
++	 * ``arch_prctl()``, but this may change in the future.
++	 *
++	 * The offsets of the state save areas in struct kvm_xsave follow
++	 * the contents of CPUID leaf 0xD on the host.
++	 */
+ 	__u32 region[1024];
++	__u32 extra[0];
+ };
+ 
+ #define KVM_MAX_XCRS	16
+Index: qemu/linux-headers/asm-x86/unistd_32.h
+===================================================================
+--- qemu.orig/linux-headers/asm-x86/unistd_32.h	2023-07-04 20:49:59.000000000 -0400
++++ qemu/linux-headers/asm-x86/unistd_32.h	2023-07-04 20:49:59.000000000 -0400
+@@ -440,6 +440,7 @@
+ #define __NR_memfd_secret 447
+ #define __NR_process_mrelease 448
+ #define __NR_futex_waitv 449
++#define __NR_set_mempolicy_home_node 450
+ 
+ 
+ #endif /* _ASM_UNISTD_32_H */
+Index: qemu/linux-headers/asm-x86/unistd_64.h
+===================================================================
+--- qemu.orig/linux-headers/asm-x86/unistd_64.h	2023-07-04 20:49:59.000000000 -0400
++++ qemu/linux-headers/asm-x86/unistd_64.h	2023-07-04 20:49:59.000000000 -0400
+@@ -362,6 +362,7 @@
+ #define __NR_memfd_secret 447
+ #define __NR_process_mrelease 448
+ #define __NR_futex_waitv 449
++#define __NR_set_mempolicy_home_node 450
+ 
+ 
+ #endif /* _ASM_UNISTD_64_H */
+Index: qemu/linux-headers/asm-x86/unistd_x32.h
+===================================================================
+--- qemu.orig/linux-headers/asm-x86/unistd_x32.h	2023-07-04 20:49:59.000000000 -0400
++++ qemu/linux-headers/asm-x86/unistd_x32.h	2023-07-04 20:49:59.000000000 -0400
+@@ -315,6 +315,7 @@
+ #define __NR_memfd_secret (__X32_SYSCALL_BIT + 447)
+ #define __NR_process_mrelease (__X32_SYSCALL_BIT + 448)
+ #define __NR_futex_waitv (__X32_SYSCALL_BIT + 449)
++#define __NR_set_mempolicy_home_node (__X32_SYSCALL_BIT + 450)
+ #define __NR_rt_sigaction (__X32_SYSCALL_BIT + 512)
+ #define __NR_rt_sigreturn (__X32_SYSCALL_BIT + 513)
+ #define __NR_ioctl (__X32_SYSCALL_BIT + 514)
+Index: qemu/linux-headers/linux/kvm.h
+===================================================================
+--- qemu.orig/linux-headers/linux/kvm.h	2023-07-04 20:49:59.000000000 -0400
++++ qemu/linux-headers/linux/kvm.h	2023-07-04 20:51:11.000000000 -0400
+@@ -1130,6 +1130,9 @@
+ #define KVM_CAP_BINARY_STATS_FD 203
+ #define KVM_CAP_EXIT_ON_EMULATION_FAILURE 204
+ #define KVM_CAP_ARM_MTE 205
++#define KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM 206
++#define KVM_CAP_VM_GPA_BITS 207
++#define KVM_CAP_XSAVE2 208
+ 
+ #ifdef KVM_CAP_IRQ_ROUTING
+ 
+@@ -1161,11 +1164,20 @@
+ 	__u32 sint;
+ };
+ 
++struct kvm_irq_routing_xen_evtchn {
++	__u32 port;
++	__u32 vcpu;
++	__u32 priority;
++};
++
++#define KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL ((__u32)(-1))
++
+ /* gsi routing entry types */
+ #define KVM_IRQ_ROUTING_IRQCHIP 1
+ #define KVM_IRQ_ROUTING_MSI 2
+ #define KVM_IRQ_ROUTING_S390_ADAPTER 3
+ #define KVM_IRQ_ROUTING_HV_SINT 4
++#define KVM_IRQ_ROUTING_XEN_EVTCHN 5
+ 
+ struct kvm_irq_routing_entry {
+ 	__u32 gsi;
+@@ -1177,6 +1189,7 @@
+ 		struct kvm_irq_routing_msi msi;
+ 		struct kvm_irq_routing_s390_adapter adapter;
+ 		struct kvm_irq_routing_hv_sint hv_sint;
++		struct kvm_irq_routing_xen_evtchn xen_evtchn;
+ 		__u32 pad[8];
+ 	} u;
+ };
+@@ -1207,6 +1220,7 @@
+ #define KVM_XEN_HVM_CONFIG_INTERCEPT_HCALL	(1 << 1)
+ #define KVM_XEN_HVM_CONFIG_SHARED_INFO		(1 << 2)
+ #define KVM_XEN_HVM_CONFIG_RUNSTATE		(1 << 3)
++#define KVM_XEN_HVM_CONFIG_EVTCHN_2LEVEL	(1 << 4)
+ 
+ struct kvm_xen_hvm_config {
+ 	__u32 flags;
+@@ -1609,6 +1623,9 @@
+ #define KVM_S390_NORMAL_RESET	_IO(KVMIO,   0xc3)
+ #define KVM_S390_CLEAR_RESET	_IO(KVMIO,   0xc4)
+ 
++/* Available with KVM_CAP_XSAVE2 */
++#define KVM_GET_XSAVE2		  _IOR(KVMIO,  0xcf, struct kvm_xsave)
++
+ struct kvm_s390_pv_sec_parm {
+ 	__u64 origin;
+ 	__u64 length;
diff --git a/debian/patches/ubuntu/lp-1853307-linux-headers-Update-to-v5.18-rc6.patch b/debian/patches/ubuntu/lp-1853307-linux-headers-Update-to-v5.18-rc6.patch
new file mode 100644
index 0000000..b939ec2
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1853307-linux-headers-Update-to-v5.18-rc6.patch
@@ -0,0 +1,1009 @@
+From e4082063e47e9731dbeb1c26174c17f6038f577f Mon Sep 17 00:00:00 2001
+From: Alex Williamson <[e-mail]>
+Date: Fri, 13 May 2022 08:20:08 -0600
+Subject: [PATCH] linux-headers: Update to v5.18-rc6
+
+Update to c5eb0a61238d ("Linux 5.18-rc6").  Mechanical search and
+replace of vfio defines with white space massaging.
+
+Signed-off-by: Alex Williamson <[e-mail]>
+
+Origin: upstream, https://gitlab.com/qemu-project/qemu/commit/e4082063e4
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1853307
+Last-Update: 2023-07-04
+
+---
+ hw/vfio/common.c                              |   6 +-
+ hw/vfio/migration.c                           |  27 +-
+ .../linux/input-event-codes.h                 |  25 +-
+ .../standard-headers/linux/virtio_config.h    |   6 +
+ .../standard-headers/linux/virtio_crypto.h    |  82 +++-
+ linux-headers/asm-arm64/kvm.h                 |  16 +
+ linux-headers/asm-generic/mman-common.h       |   2 +
+ linux-headers/asm-mips/mman.h                 |   2 +
+ linux-headers/linux/kvm.h                     |  27 +-
+ linux-headers/linux/psci.h                    |   4 +
+ linux-headers/linux/userfaultfd.h             |   8 +-
+ linux-headers/linux/vfio.h                    | 406 +++++++++---------
+ linux-headers/linux/vhost.h                   |   7 +
+ 13 files changed, 383 insertions(+), 235 deletions(-)
+
+Index: qemu/hw/vfio/common.c
+===================================================================
+--- qemu.orig/hw/vfio/common.c	2023-07-04 20:49:59.000000000 -0400
++++ qemu/hw/vfio/common.c	2023-07-04 20:49:59.000000000 -0400
+@@ -354,7 +354,7 @@
+             }
+ 
+             if ((vbasedev->pre_copy_dirty_page_tracking == ON_OFF_AUTO_OFF)
+-                && (migration->device_state & VFIO_DEVICE_STATE_RUNNING)) {
++                && (migration->device_state & VFIO_DEVICE_STATE_V1_RUNNING)) {
+                 return false;
+             }
+         }
+@@ -380,8 +380,8 @@
+                 return false;
+             }
+ 
+-            if ((migration->device_state & VFIO_DEVICE_STATE_SAVING) &&
+-                (migration->device_state & VFIO_DEVICE_STATE_RUNNING)) {
++            if ((migration->device_state & VFIO_DEVICE_STATE_V1_SAVING) &&
++                (migration->device_state & VFIO_DEVICE_STATE_V1_RUNNING)) {
+                 continue;
+             } else {
+                 return false;
+Index: qemu/hw/vfio/migration.c
+===================================================================
+--- qemu.orig/hw/vfio/migration.c	2023-07-04 20:38:39.000000000 -0400
++++ qemu/hw/vfio/migration.c	2023-07-04 20:49:59.000000000 -0400
+@@ -432,7 +432,7 @@
+     }
+ 
+     ret = vfio_migration_set_state(vbasedev, VFIO_DEVICE_STATE_MASK,
+-                                   VFIO_DEVICE_STATE_SAVING);
++                                   VFIO_DEVICE_STATE_V1_SAVING);
+     if (ret) {
+         error_report("%s: Failed to set state SAVING", vbasedev->name);
+         return ret;
+@@ -531,8 +531,8 @@
+     uint64_t data_size;
+     int ret;
+ 
+-    ret = vfio_migration_set_state(vbasedev, ~VFIO_DEVICE_STATE_RUNNING,
+-                                   VFIO_DEVICE_STATE_SAVING);
++    ret = vfio_migration_set_state(vbasedev, ~VFIO_DEVICE_STATE_V1_RUNNING,
++                                   VFIO_DEVICE_STATE_V1_SAVING);
+     if (ret) {
+         error_report("%s: Failed to set state STOP and SAVING",
+                      vbasedev->name);
+@@ -569,7 +569,7 @@
+         return ret;
+     }
+ 
+-    ret = vfio_migration_set_state(vbasedev, ~VFIO_DEVICE_STATE_SAVING, 0);
++    ret = vfio_migration_set_state(vbasedev, ~VFIO_DEVICE_STATE_V1_SAVING, 0);
+     if (ret) {
+         error_report("%s: Failed to set state STOPPED", vbasedev->name);
+         return ret;
+@@ -609,7 +609,7 @@
+     }
+ 
+     ret = vfio_migration_set_state(vbasedev, ~VFIO_DEVICE_STATE_MASK,
+-                                   VFIO_DEVICE_STATE_RESUMING);
++                                   VFIO_DEVICE_STATE_V1_RESUMING);
+     if (ret) {
+         error_report("%s: Failed to set state RESUMING", vbasedev->name);
+         if (migration->region.mmaps) {
+@@ -717,20 +717,20 @@
+          * In both the above cases, set _RUNNING bit.
+          */
+         mask = ~VFIO_DEVICE_STATE_MASK;
+-        value = VFIO_DEVICE_STATE_RUNNING;
++        value = VFIO_DEVICE_STATE_V1_RUNNING;
+     } else {
+         /*
+          * Here device state could be either _RUNNING or _SAVING|_RUNNING. Reset
+          * _RUNNING bit
+          */
+-        mask = ~VFIO_DEVICE_STATE_RUNNING;
++        mask = ~VFIO_DEVICE_STATE_V1_RUNNING;
+ 
+         /*
+          * When VM state transition to stop for savevm command, device should
+          * start saving data.
+          */
+         if (state == RUN_STATE_SAVE_VM) {
+-            value = VFIO_DEVICE_STATE_SAVING;
++            value = VFIO_DEVICE_STATE_V1_SAVING;
+         } else {
+             value = 0;
+         }
+@@ -768,8 +768,9 @@
+     case MIGRATION_STATUS_FAILED:
+         bytes_transferred = 0;
+         ret = vfio_migration_set_state(vbasedev,
+-                      ~(VFIO_DEVICE_STATE_SAVING | VFIO_DEVICE_STATE_RESUMING),
+-                      VFIO_DEVICE_STATE_RUNNING);
++                                       ~(VFIO_DEVICE_STATE_V1_SAVING |
++                                         VFIO_DEVICE_STATE_V1_RESUMING),
++                                       VFIO_DEVICE_STATE_V1_RUNNING);
+         if (ret) {
+             error_report("%s: Failed to set state RUNNING", vbasedev->name);
+         }
+@@ -864,8 +865,10 @@
+         goto add_blocker;
+     }
+ 
+-    ret = vfio_get_dev_region_info(vbasedev, VFIO_REGION_TYPE_MIGRATION,
+-                                   VFIO_REGION_SUBTYPE_MIGRATION, &info);
++    ret = vfio_get_dev_region_info(vbasedev,
++                                   VFIO_REGION_TYPE_MIGRATION_DEPRECATED,
++                                   VFIO_REGION_SUBTYPE_MIGRATION_DEPRECATED,
++                                   &info);
+     if (ret) {
+         goto add_blocker;
+     }
+Index: qemu/include/standard-headers/linux/input-event-codes.h
+===================================================================
+--- qemu.orig/include/standard-headers/linux/input-event-codes.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/include/standard-headers/linux/input-event-codes.h	2023-07-04 20:49:59.000000000 -0400
+@@ -278,7 +278,8 @@
+ #define KEY_PAUSECD		201
+ #define KEY_PROG3		202
+ #define KEY_PROG4		203
+-#define KEY_DASHBOARD		204	/* AL Dashboard */
++#define KEY_ALL_APPLICATIONS	204	/* AC Desktop Show All Applications */
++#define KEY_DASHBOARD		KEY_ALL_APPLICATIONS
+ #define KEY_SUSPEND		205
+ #define KEY_CLOSE		206	/* AC Close */
+ #define KEY_PLAY		207
+@@ -612,6 +613,7 @@
+ #define KEY_ASSISTANT		0x247	/* AL Context-aware desktop assistant */
+ #define KEY_KBD_LAYOUT_NEXT	0x248	/* AC Next Keyboard Layout Select */
+ #define KEY_EMOJI_PICKER	0x249	/* Show/hide emoji picker (HUTRR101) */
++#define KEY_DICTATE		0x24a	/* Start or Stop Voice Dictation Session (HUTRR99) */
+ 
+ #define KEY_BRIGHTNESS_MIN		0x250	/* Set Brightness to Minimum */
+ #define KEY_BRIGHTNESS_MAX		0x251	/* Set Brightness to Maximum */
+@@ -660,6 +662,27 @@
+ /* Select an area of screen to be copied */
+ #define KEY_SELECTIVE_SCREENSHOT	0x27a
+ 
++/* Move the focus to the next or previous user controllable element within a UI container */
++#define KEY_NEXT_ELEMENT               0x27b
++#define KEY_PREVIOUS_ELEMENT           0x27c
++
++/* Toggle Autopilot engagement */
++#define KEY_AUTOPILOT_ENGAGE_TOGGLE    0x27d
++
++/* Shortcut Keys */
++#define KEY_MARK_WAYPOINT              0x27e
++#define KEY_SOS                                0x27f
++#define KEY_NAV_CHART                  0x280
++#define KEY_FISHING_CHART              0x281
++#define KEY_SINGLE_RANGE_RADAR         0x282
++#define KEY_DUAL_RANGE_RADAR           0x283
++#define KEY_RADAR_OVERLAY              0x284
++#define KEY_TRADITIONAL_SONAR          0x285
++#define KEY_CLEARVU_SONAR              0x286
++#define KEY_SIDEVU_SONAR               0x287
++#define KEY_NAV_INFO                   0x288
++#define KEY_BRIGHTNESS_MENU            0x289
++
+ /*
+  * Some keyboards have keys which do not have a defined meaning, these keys
+  * are intended to be programmed / bound to macros by the user. For most
+Index: qemu/include/standard-headers/linux/virtio_config.h
+===================================================================
+--- qemu.orig/include/standard-headers/linux/virtio_config.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/include/standard-headers/linux/virtio_config.h	2023-07-04 20:51:04.000000000 -0400
+@@ -81,6 +81,12 @@
+ #define VIRTIO_F_RING_PACKED		34
+ 
+ /*
++ * Inorder feature indicates that all buffers are used by the device
++ * in the same order in which they have been made available.
++ */
++#define VIRTIO_F_IN_ORDER		35
++
++/*
+  * This feature indicates that memory accesses by the driver and the
+  * device are ordered in a way described by the platform.
+  */
+Index: qemu/include/standard-headers/linux/virtio_crypto.h
+===================================================================
+--- qemu.orig/include/standard-headers/linux/virtio_crypto.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/include/standard-headers/linux/virtio_crypto.h	2023-07-04 20:49:59.000000000 -0400
+@@ -37,6 +37,7 @@
+ #define VIRTIO_CRYPTO_SERVICE_HASH   1
+ #define VIRTIO_CRYPTO_SERVICE_MAC    2
+ #define VIRTIO_CRYPTO_SERVICE_AEAD   3
++#define VIRTIO_CRYPTO_SERVICE_AKCIPHER 4
+ 
+ #define VIRTIO_CRYPTO_OPCODE(service, op)   (((service) << 8) | (op))
+ 
+@@ -57,6 +58,10 @@
+ 	   VIRTIO_CRYPTO_OPCODE(VIRTIO_CRYPTO_SERVICE_AEAD, 0x02)
+ #define VIRTIO_CRYPTO_AEAD_DESTROY_SESSION \
+ 	   VIRTIO_CRYPTO_OPCODE(VIRTIO_CRYPTO_SERVICE_AEAD, 0x03)
++#define VIRTIO_CRYPTO_AKCIPHER_CREATE_SESSION \
++	   VIRTIO_CRYPTO_OPCODE(VIRTIO_CRYPTO_SERVICE_AKCIPHER, 0x04)
++#define VIRTIO_CRYPTO_AKCIPHER_DESTROY_SESSION \
++	   VIRTIO_CRYPTO_OPCODE(VIRTIO_CRYPTO_SERVICE_AKCIPHER, 0x05)
+ 	uint32_t opcode;
+ 	uint32_t algo;
+ 	uint32_t flag;
+@@ -180,6 +185,58 @@
+ 	uint8_t padding[32];
+ };
+ 
++struct virtio_crypto_rsa_session_para {
++#define VIRTIO_CRYPTO_RSA_RAW_PADDING   0
++#define VIRTIO_CRYPTO_RSA_PKCS1_PADDING 1
++	uint32_t padding_algo;
++
++#define VIRTIO_CRYPTO_RSA_NO_HASH   0
++#define VIRTIO_CRYPTO_RSA_MD2       1
++#define VIRTIO_CRYPTO_RSA_MD3       2
++#define VIRTIO_CRYPTO_RSA_MD4       3
++#define VIRTIO_CRYPTO_RSA_MD5       4
++#define VIRTIO_CRYPTO_RSA_SHA1      5
++#define VIRTIO_CRYPTO_RSA_SHA256    6
++#define VIRTIO_CRYPTO_RSA_SHA384    7
++#define VIRTIO_CRYPTO_RSA_SHA512    8
++#define VIRTIO_CRYPTO_RSA_SHA224    9
++	uint32_t hash_algo;
++};
++
++struct virtio_crypto_ecdsa_session_para {
++#define VIRTIO_CRYPTO_CURVE_UNKNOWN   0
++#define VIRTIO_CRYPTO_CURVE_NIST_P192 1
++#define VIRTIO_CRYPTO_CURVE_NIST_P224 2
++#define VIRTIO_CRYPTO_CURVE_NIST_P256 3
++#define VIRTIO_CRYPTO_CURVE_NIST_P384 4
++#define VIRTIO_CRYPTO_CURVE_NIST_P521 5
++	uint32_t curve_id;
++	uint32_t padding;
++};
++
++struct virtio_crypto_akcipher_session_para {
++#define VIRTIO_CRYPTO_NO_AKCIPHER    0
++#define VIRTIO_CRYPTO_AKCIPHER_RSA   1
++#define VIRTIO_CRYPTO_AKCIPHER_DSA   2
++#define VIRTIO_CRYPTO_AKCIPHER_ECDSA 3
++	uint32_t algo;
++
++#define VIRTIO_CRYPTO_AKCIPHER_KEY_TYPE_PUBLIC  1
++#define VIRTIO_CRYPTO_AKCIPHER_KEY_TYPE_PRIVATE 2
++	uint32_t keytype;
++	uint32_t keylen;
++
++	union {
++		struct virtio_crypto_rsa_session_para rsa;
++		struct virtio_crypto_ecdsa_session_para ecdsa;
++	} u;
++};
++
++struct virtio_crypto_akcipher_create_session_req {
++	struct virtio_crypto_akcipher_session_para para;
++	uint8_t padding[36];
++};
++
+ struct virtio_crypto_alg_chain_session_para {
+ #define VIRTIO_CRYPTO_SYM_ALG_CHAIN_ORDER_HASH_THEN_CIPHER  1
+ #define VIRTIO_CRYPTO_SYM_ALG_CHAIN_ORDER_CIPHER_THEN_HASH  2
+@@ -247,6 +304,8 @@
+ 			mac_create_session;
+ 		struct virtio_crypto_aead_create_session_req
+ 			aead_create_session;
++		struct virtio_crypto_akcipher_create_session_req
++			akcipher_create_session;
+ 		struct virtio_crypto_destroy_session_req
+ 			destroy_session;
+ 		uint8_t padding[56];
+@@ -266,6 +325,14 @@
+ 	VIRTIO_CRYPTO_OPCODE(VIRTIO_CRYPTO_SERVICE_AEAD, 0x00)
+ #define VIRTIO_CRYPTO_AEAD_DECRYPT \
+ 	VIRTIO_CRYPTO_OPCODE(VIRTIO_CRYPTO_SERVICE_AEAD, 0x01)
++#define VIRTIO_CRYPTO_AKCIPHER_ENCRYPT \
++	VIRTIO_CRYPTO_OPCODE(VIRTIO_CRYPTO_SERVICE_AKCIPHER, 0x00)
++#define VIRTIO_CRYPTO_AKCIPHER_DECRYPT \
++	VIRTIO_CRYPTO_OPCODE(VIRTIO_CRYPTO_SERVICE_AKCIPHER, 0x01)
++#define VIRTIO_CRYPTO_AKCIPHER_SIGN \
++	VIRTIO_CRYPTO_OPCODE(VIRTIO_CRYPTO_SERVICE_AKCIPHER, 0x02)
++#define VIRTIO_CRYPTO_AKCIPHER_VERIFY \
++	VIRTIO_CRYPTO_OPCODE(VIRTIO_CRYPTO_SERVICE_AKCIPHER, 0x03)
+ 	uint32_t opcode;
+ 	/* algo should be service-specific algorithms */
+ 	uint32_t algo;
+@@ -390,6 +457,16 @@
+ 	uint8_t padding[32];
+ };
+ 
++struct virtio_crypto_akcipher_para {
++	uint32_t src_data_len;
++	uint32_t dst_data_len;
++};
++
++struct virtio_crypto_akcipher_data_req {
++	struct virtio_crypto_akcipher_para para;
++	uint8_t padding[40];
++};
++
+ /* The request of the data virtqueue's packet */
+ struct virtio_crypto_op_data_req {
+ 	struct virtio_crypto_op_header header;
+@@ -399,6 +476,7 @@
+ 		struct virtio_crypto_hash_data_req hash_req;
+ 		struct virtio_crypto_mac_data_req mac_req;
+ 		struct virtio_crypto_aead_data_req aead_req;
++		struct virtio_crypto_akcipher_data_req akcipher_req;
+ 		uint8_t padding[48];
+ 	} u;
+ };
+@@ -408,6 +486,8 @@
+ #define VIRTIO_CRYPTO_BADMSG    2
+ #define VIRTIO_CRYPTO_NOTSUPP   3
+ #define VIRTIO_CRYPTO_INVSESS   4 /* Invalid session id */
++#define VIRTIO_CRYPTO_NOSPC     5 /* no free session ID */
++#define VIRTIO_CRYPTO_KEY_REJECTED 6 /* Signature verification failed */
+ 
+ /* The accelerator hardware is ready */
+ #define VIRTIO_CRYPTO_S_HW_READY  (1 << 0)
+@@ -438,7 +518,7 @@
+ 	uint32_t max_cipher_key_len;
+ 	/* Maximum length of authenticated key */
+ 	uint32_t max_auth_key_len;
+-	uint32_t reserve;
++	uint32_t akcipher_algo;
+ 	/* Maximum size of each crypto request's content */
+ 	uint64_t max_size;
+ };
+Index: qemu/linux-headers/asm-arm64/kvm.h
+===================================================================
+--- qemu.orig/linux-headers/asm-arm64/kvm.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/linux-headers/asm-arm64/kvm.h	2023-07-04 20:51:04.000000000 -0400
+@@ -281,6 +281,11 @@
+ #define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_REQUIRED	3
+ #define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_ENABLED     	(1U << 4)
+ 
++#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3	KVM_REG_ARM_FW_REG(3)
++#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3_NOT_AVAIL		0
++#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3_AVAIL		1
++#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3_NOT_REQUIRED	2
++
+ /* SVE registers */
+ #define KVM_REG_ARM64_SVE		(0x15 << KVM_REG_ARM_COPROC_SHIFT)
+ 
+@@ -362,6 +367,7 @@
+ #define   KVM_ARM_VCPU_PMU_V3_IRQ	0
+ #define   KVM_ARM_VCPU_PMU_V3_INIT	1
+ #define   KVM_ARM_VCPU_PMU_V3_FILTER	2
++#define   KVM_ARM_VCPU_PMU_V3_SET_PMU	3
+ #define KVM_ARM_VCPU_TIMER_CTRL		1
+ #define   KVM_ARM_VCPU_TIMER_IRQ_VTIMER		0
+ #define   KVM_ARM_VCPU_TIMER_IRQ_PTIMER		1
+@@ -411,6 +417,16 @@
+ #define KVM_PSCI_RET_INVAL		PSCI_RET_INVALID_PARAMS
+ #define KVM_PSCI_RET_DENIED		PSCI_RET_DENIED
+ 
++/* arm64-specific kvm_run::system_event flags */
++/*
++ * Reset caused by a PSCI v1.1 SYSTEM_RESET2 call.
++ * Valid only when the system event has a type of KVM_SYSTEM_EVENT_RESET.
++ */
++#define KVM_SYSTEM_EVENT_RESET_FLAG_PSCI_RESET2	(1ULL << 0)
++
++/* run->fail_entry.hardware_entry_failure_reason codes. */
++#define KVM_EXIT_FAIL_ENTRY_CPU_UNSUPPORTED	(1ULL << 0)
++
+ #endif
+ 
+ #endif /* __ARM_KVM_H__ */
+Index: qemu/linux-headers/asm-generic/mman-common.h
+===================================================================
+--- qemu.orig/linux-headers/asm-generic/mman-common.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/linux-headers/asm-generic/mman-common.h	2023-07-04 20:49:59.000000000 -0400
+@@ -75,6 +75,8 @@
+ #define MADV_POPULATE_READ	22	/* populate (prefault) page tables readable */
+ #define MADV_POPULATE_WRITE	23	/* populate (prefault) page tables writable */
+ 
++#define MADV_DONTNEED_LOCKED	24	/* like DONTNEED, but drop locked pages too */
++
+ /* compatibility flags */
+ #define MAP_FILE	0
+ 
+Index: qemu/linux-headers/asm-mips/mman.h
+===================================================================
+--- qemu.orig/linux-headers/asm-mips/mman.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/linux-headers/asm-mips/mman.h	2023-07-04 20:49:59.000000000 -0400
+@@ -101,6 +101,8 @@
+ #define MADV_POPULATE_READ	22	/* populate (prefault) page tables readable */
+ #define MADV_POPULATE_WRITE	23	/* populate (prefault) page tables writable */
+ 
++#define MADV_DONTNEED_LOCKED	24	/* like DONTNEED, but drop locked pages too */
++
+ /* compatibility flags */
+ #define MAP_FILE	0
+ 
+Index: qemu/linux-headers/linux/kvm.h
+===================================================================
+--- qemu.orig/linux-headers/linux/kvm.h	2023-07-04 20:49:59.000000000 -0400
++++ qemu/linux-headers/linux/kvm.h	2023-07-04 20:51:08.000000000 -0400
+@@ -445,7 +445,11 @@
+ #define KVM_SYSTEM_EVENT_RESET          2
+ #define KVM_SYSTEM_EVENT_CRASH          3
+ 			__u32 type;
+-			__u64 flags;
++			__u32 ndata;
++			union {
++				__u64 flags;
++				__u64 data[16];
++			};
+ 		} system_event;
+ 		/* KVM_EXIT_S390_STSI */
+ 		struct {
+@@ -562,9 +566,12 @@
+ 	__u32 op;		/* type of operation */
+ 	__u64 buf;		/* buffer in userspace */
+ 	union {
+-		__u8 ar;	/* the access register number */
++		struct {
++			__u8 ar;	/* the access register number */
++			__u8 key;	/* access key, ignored if flag unset */
++		};
+ 		__u32 sida_offset; /* offset into the sida */
+-		__u8 reserved[32]; /* should be set to 0 */
++		__u8 reserved[32]; /* ignored */
+ 	};
+ };
+ /* types for kvm_s390_mem_op->op */
+@@ -572,9 +579,12 @@
+ #define KVM_S390_MEMOP_LOGICAL_WRITE	1
+ #define KVM_S390_MEMOP_SIDA_READ	2
+ #define KVM_S390_MEMOP_SIDA_WRITE	3
++#define KVM_S390_MEMOP_ABSOLUTE_READ	4
++#define KVM_S390_MEMOP_ABSOLUTE_WRITE	5
+ /* flags for kvm_s390_mem_op->flags */
+ #define KVM_S390_MEMOP_F_CHECK_ONLY		(1ULL << 0)
+ #define KVM_S390_MEMOP_F_INJECT_EXCEPTION	(1ULL << 1)
++#define KVM_S390_MEMOP_F_SKEY_PROTECTION	(1ULL << 2)
+ 
+ /* for KVM_INTERRUPT */
+ struct kvm_interrupt {
+@@ -1134,6 +1144,12 @@
+ #define KVM_CAP_VM_GPA_BITS 207
+ #define KVM_CAP_XSAVE2 208
+ #define KVM_CAP_SYS_ATTRIBUTES 209
++#define KVM_CAP_PPC_AIL_MODE_3 210
++#define KVM_CAP_S390_MEM_OP_EXTENSION 211
++#define KVM_CAP_PMU_CAPABILITY 212
++#define KVM_CAP_DISABLE_QUIRKS2 213
++/* #define KVM_CAP_VM_TSC_CONTROL 214 */
++#define KVM_CAP_SYSTEM_EVENT_DATA 215
+ 
+ #ifdef KVM_CAP_IRQ_ROUTING
+ 
+@@ -1624,9 +1640,6 @@
+ #define KVM_S390_NORMAL_RESET	_IO(KVMIO,   0xc3)
+ #define KVM_S390_CLEAR_RESET	_IO(KVMIO,   0xc4)
+ 
+-/* Available with KVM_CAP_XSAVE2 */
+-#define KVM_GET_XSAVE2		  _IOR(KVMIO,  0xcf, struct kvm_xsave)
+-
+ struct kvm_s390_pv_sec_parm {
+ 	__u64 origin;
+ 	__u64 length;
+@@ -1973,6 +1986,8 @@
+ #define KVM_BUS_LOCK_DETECTION_OFF             (1 << 0)
+ #define KVM_BUS_LOCK_DETECTION_EXIT            (1 << 1)
+ 
++#define KVM_PMU_CAP_DISABLE                    (1 << 0)
++
+ /**
+  * struct kvm_stats_header - Header of per vm/vcpu binary statistics data.
+  * @flags: Some extra information for header, always 0 for now.
+Index: qemu/linux-headers/linux/psci.h
+===================================================================
+--- qemu.orig/linux-headers/linux/psci.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/linux-headers/linux/psci.h	2023-07-04 20:49:59.000000000 -0400
+@@ -82,6 +82,10 @@
+ #define PSCI_0_2_TOS_UP_NO_MIGRATE		1
+ #define PSCI_0_2_TOS_MP				2
+ 
++/* PSCI v1.1 reset type encoding for SYSTEM_RESET2 */
++#define PSCI_1_1_RESET_TYPE_SYSTEM_WARM_RESET	0
++#define PSCI_1_1_RESET_TYPE_VENDOR_START	0x80000000U
++
+ /* PSCI version decoding (independent of PSCI version) */
+ #define PSCI_VERSION_MAJOR_SHIFT		16
+ #define PSCI_VERSION_MINOR_MASK			\
+Index: qemu/linux-headers/linux/userfaultfd.h
+===================================================================
+--- qemu.orig/linux-headers/linux/userfaultfd.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/linux-headers/linux/userfaultfd.h	2023-07-04 20:51:04.000000000 -0400
+@@ -32,7 +32,8 @@
+ 			   UFFD_FEATURE_SIGBUS |		\
+ 			   UFFD_FEATURE_THREAD_ID |		\
+ 			   UFFD_FEATURE_MINOR_HUGETLBFS |	\
+-			   UFFD_FEATURE_MINOR_SHMEM)
++			   UFFD_FEATURE_MINOR_SHMEM |		\
++			   UFFD_FEATURE_EXACT_ADDRESS)
+ #define UFFD_API_IOCTLS				\
+ 	((__u64)1 << _UFFDIO_REGISTER |		\
+ 	 (__u64)1 << _UFFDIO_UNREGISTER |	\
+@@ -189,6 +190,10 @@
+ 	 *
+ 	 * UFFD_FEATURE_MINOR_SHMEM indicates the same support as
+ 	 * UFFD_FEATURE_MINOR_HUGETLBFS, but for shmem-backed pages instead.
++	 *
++	 * UFFD_FEATURE_EXACT_ADDRESS indicates that the exact address of page
++	 * faults would be provided and the offset within the page would not be
++	 * masked.
+ 	 */
+ #define UFFD_FEATURE_PAGEFAULT_FLAG_WP		(1<<0)
+ #define UFFD_FEATURE_EVENT_FORK			(1<<1)
+@@ -201,6 +206,7 @@
+ #define UFFD_FEATURE_THREAD_ID			(1<<8)
+ #define UFFD_FEATURE_MINOR_HUGETLBFS		(1<<9)
+ #define UFFD_FEATURE_MINOR_SHMEM		(1<<10)
++#define UFFD_FEATURE_EXACT_ADDRESS		(1<<11)
+ 	__u64 features;
+ 
+ 	__u64 ioctls;
+Index: qemu/linux-headers/linux/vfio.h
+===================================================================
+--- qemu.orig/linux-headers/linux/vfio.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/linux-headers/linux/vfio.h	2023-07-04 20:51:04.000000000 -0400
+@@ -323,7 +323,7 @@
+ #define VFIO_REGION_TYPE_PCI_VENDOR_MASK	(0xffff)
+ #define VFIO_REGION_TYPE_GFX                    (1)
+ #define VFIO_REGION_TYPE_CCW			(2)
+-#define VFIO_REGION_TYPE_MIGRATION              (3)
++#define VFIO_REGION_TYPE_MIGRATION_DEPRECATED   (3)
+ 
+ /* sub-types for VFIO_REGION_TYPE_PCI_* */
+ 
+@@ -405,225 +405,29 @@
+ #define VFIO_REGION_SUBTYPE_CCW_CRW		(3)
+ 
+ /* sub-types for VFIO_REGION_TYPE_MIGRATION */
+-#define VFIO_REGION_SUBTYPE_MIGRATION           (1)
+-
+-/*
+- * The structure vfio_device_migration_info is placed at the 0th offset of
+- * the VFIO_REGION_SUBTYPE_MIGRATION region to get and set VFIO device related
+- * migration information. Field accesses from this structure are only supported
+- * at their native width and alignment. Otherwise, the result is undefined and
+- * vendor drivers should return an error.
+- *
+- * device_state: (read/write)
+- *      - The user application writes to this field to inform the vendor driver
+- *        about the device state to be transitioned to.
+- *      - The vendor driver should take the necessary actions to change the
+- *        device state. After successful transition to a given state, the
+- *        vendor driver should return success on write(device_state, state)
+- *        system call. If the device state transition fails, the vendor driver
+- *        should return an appropriate -errno for the fault condition.
+- *      - On the user application side, if the device state transition fails,
+- *	  that is, if write(device_state, state) returns an error, read
+- *	  device_state again to determine the current state of the device from
+- *	  the vendor driver.
+- *      - The vendor driver should return previous state of the device unless
+- *        the vendor driver has encountered an internal error, in which case
+- *        the vendor driver may report the device_state VFIO_DEVICE_STATE_ERROR.
+- *      - The user application must use the device reset ioctl to recover the
+- *        device from VFIO_DEVICE_STATE_ERROR state. If the device is
+- *        indicated to be in a valid device state by reading device_state, the
+- *        user application may attempt to transition the device to any valid
+- *        state reachable from the current state or terminate itself.
+- *
+- *      device_state consists of 3 bits:
+- *      - If bit 0 is set, it indicates the _RUNNING state. If bit 0 is clear,
+- *        it indicates the _STOP state. When the device state is changed to
+- *        _STOP, driver should stop the device before write() returns.
+- *      - If bit 1 is set, it indicates the _SAVING state, which means that the
+- *        driver should start gathering device state information that will be
+- *        provided to the VFIO user application to save the device's state.
+- *      - If bit 2 is set, it indicates the _RESUMING state, which means that
+- *        the driver should prepare to resume the device. Data provided through
+- *        the migration region should be used to resume the device.
+- *      Bits 3 - 31 are reserved for future use. To preserve them, the user
+- *      application should perform a read-modify-write operation on this
+- *      field when modifying the specified bits.
+- *
+- *  +------- _RESUMING
+- *  |+------ _SAVING
+- *  ||+----- _RUNNING
+- *  |||
+- *  000b => Device Stopped, not saving or resuming
+- *  001b => Device running, which is the default state
+- *  010b => Stop the device & save the device state, stop-and-copy state
+- *  011b => Device running and save the device state, pre-copy state
+- *  100b => Device stopped and the device state is resuming
+- *  101b => Invalid state
+- *  110b => Error state
+- *  111b => Invalid state
+- *
+- * State transitions:
+- *
+- *              _RESUMING  _RUNNING    Pre-copy    Stop-and-copy   _STOP
+- *                (100b)     (001b)     (011b)        (010b)       (000b)
+- * 0. Running or default state
+- *                             |
+- *
+- * 1. Normal Shutdown (optional)
+- *                             |------------------------------------->|
+- *
+- * 2. Save the state or suspend
+- *                             |------------------------->|---------->|
+- *
+- * 3. Save the state during live migration
+- *                             |----------->|------------>|---------->|
+- *
+- * 4. Resuming
+- *                  |<---------|
+- *
+- * 5. Resumed
+- *                  |--------->|
+- *
+- * 0. Default state of VFIO device is _RUNNING when the user application starts.
+- * 1. During normal shutdown of the user application, the user application may
+- *    optionally change the VFIO device state from _RUNNING to _STOP. This
+- *    transition is optional. The vendor driver must support this transition but
+- *    must not require it.
+- * 2. When the user application saves state or suspends the application, the
+- *    device state transitions from _RUNNING to stop-and-copy and then to _STOP.
+- *    On state transition from _RUNNING to stop-and-copy, driver must stop the
+- *    device, save the device state and send it to the application through the
+- *    migration region. The sequence to be followed for such transition is given
+- *    below.
+- * 3. In live migration of user application, the state transitions from _RUNNING
+- *    to pre-copy, to stop-and-copy, and to _STOP.
+- *    On state transition from _RUNNING to pre-copy, the driver should start
+- *    gathering the device state while the application is still running and send
+- *    the device state data to application through the migration region.
+- *    On state transition from pre-copy to stop-and-copy, the driver must stop
+- *    the device, save the device state and send it to the user application
+- *    through the migration region.
+- *    Vendor drivers must support the pre-copy state even for implementations
+- *    where no data is provided to the user before the stop-and-copy state. The
+- *    user must not be required to consume all migration data before the device
+- *    transitions to a new state, including the stop-and-copy state.
+- *    The sequence to be followed for above two transitions is given below.
+- * 4. To start the resuming phase, the device state should be transitioned from
+- *    the _RUNNING to the _RESUMING state.
+- *    In the _RESUMING state, the driver should use the device state data
+- *    received through the migration region to resume the device.
+- * 5. After providing saved device data to the driver, the application should
+- *    change the state from _RESUMING to _RUNNING.
+- *
+- * reserved:
+- *      Reads on this field return zero and writes are ignored.
+- *
+- * pending_bytes: (read only)
+- *      The number of pending bytes still to be migrated from the vendor driver.
+- *
+- * data_offset: (read only)
+- *      The user application should read data_offset field from the migration
+- *      region. The user application should read the device data from this
+- *      offset within the migration region during the _SAVING state or write
+- *      the device data during the _RESUMING state. See below for details of
+- *      sequence to be followed.
+- *
+- * data_size: (read/write)
+- *      The user application should read data_size to get the size in bytes of
+- *      the data copied in the migration region during the _SAVING state and
+- *      write the size in bytes of the data copied in the migration region
+- *      during the _RESUMING state.
+- *
+- * The format of the migration region is as follows:
+- *  ------------------------------------------------------------------
+- * |vfio_device_migration_info|    data section                      |
+- * |                          |     ///////////////////////////////  |
+- * ------------------------------------------------------------------
+- *   ^                              ^
+- *  offset 0-trapped part        data_offset
+- *
+- * The structure vfio_device_migration_info is always followed by the data
+- * section in the region, so data_offset will always be nonzero. The offset
+- * from where the data is copied is decided by the kernel driver. The data
+- * section can be trapped, mmapped, or partitioned, depending on how the kernel
+- * driver defines the data section. The data section partition can be defined
+- * as mapped by the sparse mmap capability. If mmapped, data_offset must be
+- * page aligned, whereas initial section which contains the
+- * vfio_device_migration_info structure, might not end at the offset, which is
+- * page aligned. The user is not required to access through mmap regardless
+- * of the capabilities of the region mmap.
+- * The vendor driver should determine whether and how to partition the data
+- * section. The vendor driver should return data_offset accordingly.
+- *
+- * The sequence to be followed while in pre-copy state and stop-and-copy state
+- * is as follows:
+- * a. Read pending_bytes, indicating the start of a new iteration to get device
+- *    data. Repeated read on pending_bytes at this stage should have no side
+- *    effects.
+- *    If pending_bytes == 0, the user application should not iterate to get data
+- *    for that device.
+- *    If pending_bytes > 0, perform the following steps.
+- * b. Read data_offset, indicating that the vendor driver should make data
+- *    available through the data section. The vendor driver should return this
+- *    read operation only after data is available from (region + data_offset)
+- *    to (region + data_offset + data_size).
+- * c. Read data_size, which is the amount of data in bytes available through
+- *    the migration region.
+- *    Read on data_offset and data_size should return the offset and size of
+- *    the current buffer if the user application reads data_offset and
+- *    data_size more than once here.
+- * d. Read data_size bytes of data from (region + data_offset) from the
+- *    migration region.
+- * e. Process the data.
+- * f. Read pending_bytes, which indicates that the data from the previous
+- *    iteration has been read. If pending_bytes > 0, go to step b.
+- *
+- * The user application can transition from the _SAVING|_RUNNING
+- * (pre-copy state) to the _SAVING (stop-and-copy) state regardless of the
+- * number of pending bytes. The user application should iterate in _SAVING
+- * (stop-and-copy) until pending_bytes is 0.
+- *
+- * The sequence to be followed while _RESUMING device state is as follows:
+- * While data for this device is available, repeat the following steps:
+- * a. Read data_offset from where the user application should write data.
+- * b. Write migration data starting at the migration region + data_offset for
+- *    the length determined by data_size from the migration source.
+- * c. Write data_size, which indicates to the vendor driver that data is
+- *    written in the migration region. Vendor driver must return this write
+- *    operations on consuming data. Vendor driver should apply the
+- *    user-provided migration region data to the device resume state.
+- *
+- * If an error occurs during the above sequences, the vendor driver can return
+- * an error code for next read() or write() operation, which will terminate the
+- * loop. The user application should then take the next necessary action, for
+- * example, failing migration or terminating the user application.
+- *
+- * For the user application, data is opaque. The user application should write
+- * data in the same order as the data is received and the data should be of
+- * same transaction size at the source.
+- */
++#define VFIO_REGION_SUBTYPE_MIGRATION_DEPRECATED (1)
+ 
+ struct vfio_device_migration_info {
+ 	__u32 device_state;         /* VFIO device state */
+-#define VFIO_DEVICE_STATE_STOP      (0)
+-#define VFIO_DEVICE_STATE_RUNNING   (1 << 0)
+-#define VFIO_DEVICE_STATE_SAVING    (1 << 1)
+-#define VFIO_DEVICE_STATE_RESUMING  (1 << 2)
+-#define VFIO_DEVICE_STATE_MASK      (VFIO_DEVICE_STATE_RUNNING | \
+-				     VFIO_DEVICE_STATE_SAVING |  \
+-				     VFIO_DEVICE_STATE_RESUMING)
++#define VFIO_DEVICE_STATE_V1_STOP      (0)
++#define VFIO_DEVICE_STATE_V1_RUNNING   (1 << 0)
++#define VFIO_DEVICE_STATE_V1_SAVING    (1 << 1)
++#define VFIO_DEVICE_STATE_V1_RESUMING  (1 << 2)
++#define VFIO_DEVICE_STATE_MASK      (VFIO_DEVICE_STATE_V1_RUNNING | \
++				     VFIO_DEVICE_STATE_V1_SAVING |  \
++				     VFIO_DEVICE_STATE_V1_RESUMING)
+ 
+ #define VFIO_DEVICE_STATE_VALID(state) \
+-	(state & VFIO_DEVICE_STATE_RESUMING ? \
+-	(state & VFIO_DEVICE_STATE_MASK) == VFIO_DEVICE_STATE_RESUMING : 1)
++	(state & VFIO_DEVICE_STATE_V1_RESUMING ? \
++	(state & VFIO_DEVICE_STATE_MASK) == VFIO_DEVICE_STATE_V1_RESUMING : 1)
+ 
+ #define VFIO_DEVICE_STATE_IS_ERROR(state) \
+-	((state & VFIO_DEVICE_STATE_MASK) == (VFIO_DEVICE_STATE_SAVING | \
+-					      VFIO_DEVICE_STATE_RESUMING))
++	((state & VFIO_DEVICE_STATE_MASK) == (VFIO_DEVICE_STATE_V1_SAVING | \
++					      VFIO_DEVICE_STATE_V1_RESUMING))
+ 
+ #define VFIO_DEVICE_STATE_SET_ERROR(state) \
+-	((state & ~VFIO_DEVICE_STATE_MASK) | VFIO_DEVICE_SATE_SAVING | \
+-					     VFIO_DEVICE_STATE_RESUMING)
++	((state & ~VFIO_DEVICE_STATE_MASK) | VFIO_DEVICE_STATE_V1_SAVING | \
++					     VFIO_DEVICE_STATE_V1_RESUMING)
+ 
+ 	__u32 reserved;
+ 	__u64 pending_bytes;
+@@ -1002,6 +806,186 @@
+  */
+ #define VFIO_DEVICE_FEATURE_PCI_VF_TOKEN	(0)
+ 
++/*
++ * Indicates the device can support the migration API through
++ * VFIO_DEVICE_FEATURE_MIG_DEVICE_STATE. If this GET succeeds, the RUNNING and
++ * ERROR states are always supported. Support for additional states is
++ * indicated via the flags field; at least VFIO_MIGRATION_STOP_COPY must be
++ * set.
++ *
++ * VFIO_MIGRATION_STOP_COPY means that STOP, STOP_COPY and
++ * RESUMING are supported.
++ *
++ * VFIO_MIGRATION_STOP_COPY | VFIO_MIGRATION_P2P means that RUNNING_P2P
++ * is supported in addition to the STOP_COPY states.
++ *
++ * Other combinations of flags have behavior to be defined in the future.
++ */
++struct vfio_device_feature_migration {
++	__aligned_u64 flags;
++#define VFIO_MIGRATION_STOP_COPY	(1 << 0)
++#define VFIO_MIGRATION_P2P		(1 << 1)
++};
++#define VFIO_DEVICE_FEATURE_MIGRATION 1
++
++/*
++ * Upon VFIO_DEVICE_FEATURE_SET, execute a migration state change on the VFIO
++ * device. The new state is supplied in device_state, see enum
++ * vfio_device_mig_state for details
++ *
++ * The kernel migration driver must fully transition the device to the new state
++ * value before the operation returns to the user.
++ *
++ * The kernel migration driver must not generate asynchronous device state
++ * transitions outside of manipulation by the user or the VFIO_DEVICE_RESET
++ * ioctl as described above.
++ *
++ * If this function fails then current device_state may be the original
++ * operating state or some other state along the combination transition path.
++ * The user can then decide if it should execute a VFIO_DEVICE_RESET, attempt
++ * to return to the original state, or attempt to return to some other state
++ * such as RUNNING or STOP.
++ *
++ * If the new_state starts a new data transfer session then the FD associated
++ * with that session is returned in data_fd. The user is responsible to close
++ * this FD when it is finished. The user must consider the migration data stream
++ * carried over the FD to be opaque and must preserve the byte order of the
++ * stream. The user is not required to preserve buffer segmentation when writing
++ * the data stream during the RESUMING operation.
++ *
++ * Upon VFIO_DEVICE_FEATURE_GET, get the current migration state of the VFIO
++ * device, data_fd will be -1.
++ */
++struct vfio_device_feature_mig_state {
++	__u32 device_state; /* From enum vfio_device_mig_state */
++	__s32 data_fd;
++};
++#define VFIO_DEVICE_FEATURE_MIG_DEVICE_STATE 2
++
++/*
++ * The device migration Finite State Machine is described by the enum
++ * vfio_device_mig_state. Some of the FSM arcs will create a migration data
++ * transfer session by returning a FD, in this case the migration data will
++ * flow over the FD using read() and write() as discussed below.
++ *
++ * There are 5 states to support VFIO_MIGRATION_STOP_COPY:
++ *  RUNNING - The device is running normally
++ *  STOP - The device does not change the internal or external state
++ *  STOP_COPY - The device internal state can be read out
++ *  RESUMING - The device is stopped and is loading a new internal state
++ *  ERROR - The device has failed and must be reset
++ *
++ * And 1 optional state to support VFIO_MIGRATION_P2P:
++ *  RUNNING_P2P - RUNNING, except the device cannot do peer to peer DMA
++ *
++ * The FSM takes actions on the arcs between FSM states. The driver implements
++ * the following behavior for the FSM arcs:
++ *
++ * RUNNING_P2P -> STOP
++ * STOP_COPY -> STOP
++ *   While in STOP the device must stop the operation of the device. The device
++ *   must not generate interrupts, DMA, or any other change to external state.
++ *   It must not change its internal state. When stopped the device and kernel
++ *   migration driver must accept and respond to interaction to support external
++ *   subsystems in the STOP state, for example PCI MSI-X and PCI config space.
++ *   Failure by the user to restrict device access while in STOP must not result
++ *   in error conditions outside the user context (ex. host system faults).
++ *
++ *   The STOP_COPY arc will terminate a data transfer session.
++ *
++ * RESUMING -> STOP
++ *   Leaving RESUMING terminates a data transfer session and indicates the
++ *   device should complete processing of the data delivered by write(). The
++ *   kernel migration driver should complete the incorporation of data written
++ *   to the data transfer FD into the device internal state and perform
++ *   final validity and consistency checking of the new device state. If the
++ *   user provided data is found to be incomplete, inconsistent, or otherwise
++ *   invalid, the migration driver must fail the SET_STATE ioctl and
++ *   optionally go to the ERROR state as described below.
++ *
++ *   While in STOP the device has the same behavior as other STOP states
++ *   described above.
++ *
++ *   To abort a RESUMING session the device must be reset.
++ *
++ * RUNNING_P2P -> RUNNING
++ *   While in RUNNING the device is fully operational, the device may generate
++ *   interrupts, DMA, respond to MMIO, all vfio device regions are functional,
++ *   and the device may advance its internal state.
++ *
++ * RUNNING -> RUNNING_P2P
++ * STOP -> RUNNING_P2P
++ *   While in RUNNING_P2P the device is partially running in the P2P quiescent
++ *   state defined below.
++ *
++ * STOP -> STOP_COPY
++ *   This arc begin the process of saving the device state and will return a
++ *   new data_fd.
++ *
++ *   While in the STOP_COPY state the device has the same behavior as STOP
++ *   with the addition that the data transfers session continues to stream the
++ *   migration state. End of stream on the FD indicates the entire device
++ *   state has been transferred.
++ *
++ *   The user should take steps to restrict access to vfio device regions while
++ *   the device is in STOP_COPY or risk corruption of the device migration data
++ *   stream.
++ *
++ * STOP -> RESUMING
++ *   Entering the RESUMING state starts a process of restoring the device state
++ *   and will return a new data_fd. The data stream fed into the data_fd should
++ *   be taken from the data transfer output of a single FD during saving from
++ *   a compatible device. The migration driver may alter/reset the internal
++ *   device state for this arc if required to prepare the device to receive the
++ *   migration data.
++ *
++ * any -> ERROR
++ *   ERROR cannot be specified as a device state, however any transition request
++ *   can be failed with an errno return and may then move the device_state into
++ *   ERROR. In this case the device was unable to execute the requested arc and
++ *   was also unable to restore the device to any valid device_state.
++ *   To recover from ERROR VFIO_DEVICE_RESET must be used to return the
++ *   device_state back to RUNNING.
++ *
++ * The optional peer to peer (P2P) quiescent state is intended to be a quiescent
++ * state for the device for the purposes of managing multiple devices within a
++ * user context where peer-to-peer DMA between devices may be active. The
++ * RUNNING_P2P states must prevent the device from initiating
++ * any new P2P DMA transactions. If the device can identify P2P transactions
++ * then it can stop only P2P DMA, otherwise it must stop all DMA. The migration
++ * driver must complete any such outstanding operations prior to completing the
++ * FSM arc into a P2P state. For the purpose of specification the states
++ * behave as though the device was fully running if not supported. Like while in
++ * STOP or STOP_COPY the user must not touch the device, otherwise the state
++ * can be exited.
++ *
++ * The remaining possible transitions are interpreted as combinations of the
++ * above FSM arcs. As there are multiple paths through the FSM arcs the path
++ * should be selected based on the following rules:
++ *   - Select the shortest path.
++ * Refer to vfio_mig_get_next_state() for the result of the algorithm.
++ *
++ * The automatic transit through the FSM arcs that make up the combination
++ * transition is invisible to the user. When working with combination arcs the
++ * user may see any step along the path in the device_state if SET_STATE
++ * fails. When handling these types of errors users should anticipate future
++ * revisions of this protocol using new states and those states becoming
++ * visible in this case.
++ *
++ * The optional states cannot be used with SET_STATE if the device does not
++ * support them. The user can discover if these states are supported by using
++ * VFIO_DEVICE_FEATURE_MIGRATION. By using combination transitions the user can
++ * avoid knowing about these optional states if the kernel driver supports them.
++ */
++enum vfio_device_mig_state {
++	VFIO_DEVICE_STATE_ERROR = 0,
++	VFIO_DEVICE_STATE_STOP = 1,
++	VFIO_DEVICE_STATE_RUNNING = 2,
++	VFIO_DEVICE_STATE_STOP_COPY = 3,
++	VFIO_DEVICE_STATE_RESUMING = 4,
++	VFIO_DEVICE_STATE_RUNNING_P2P = 5,
++};
++
+ /* -------- API for Type1 VFIO IOMMU -------- */
+ 
+ /**
+Index: qemu/linux-headers/linux/vhost.h
+===================================================================
+--- qemu.orig/linux-headers/linux/vhost.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/linux-headers/linux/vhost.h	2023-07-04 20:51:04.000000000 -0400
+@@ -150,4 +150,11 @@
+ /* Get the valid iova range */
+ #define VHOST_VDPA_GET_IOVA_RANGE	_IOR(VHOST_VIRTIO, 0x78, \
+ 					     struct vhost_vdpa_iova_range)
++
++/* Get the config size */
++#define VHOST_VDPA_GET_CONFIG_SIZE	_IOR(VHOST_VIRTIO, 0x79, __u32)
++
++/* Get the count of all virtqueues */
++#define VHOST_VDPA_GET_VQS_COUNT	_IOR(VHOST_VIRTIO, 0x80, __u32)
++
+ #endif
diff --git a/debian/patches/ubuntu/lp-1853307-linux-headers-include-missing-changes-from-5.17.patch b/debian/patches/ubuntu/lp-1853307-linux-headers-include-missing-changes-from-5.17.patch
new file mode 100644
index 0000000..83b84bd
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1853307-linux-headers-include-missing-changes-from-5.17.patch
@@ -0,0 +1,50 @@
+From 1ea5208febcc068449b63282d72bb719ab67a466 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <[e-mail]>
+Date: Tue, 22 Feb 2022 17:58:11 +0100
+Subject: [PATCH] linux-headers: include missing changes from 5.17
+
+Signed-off-by: Paolo Bonzini <[e-mail]>
+
+Origin: upstream, https://gitlab.com/qemu-project/qemu/commit/1ea5208feb
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1853307
+Last-Update: 2023-07-04
+
+---
+ linux-headers/asm-x86/kvm.h | 3 +++
+ linux-headers/linux/kvm.h   | 4 ++++
+ 2 files changed, 7 insertions(+)
+
+Index: qemu/linux-headers/asm-x86/kvm.h
+===================================================================
+--- qemu.orig/linux-headers/asm-x86/kvm.h	2023-07-04 20:49:59.000000000 -0400
++++ qemu/linux-headers/asm-x86/kvm.h	2023-07-04 20:51:04.000000000 -0400
+@@ -452,6 +452,9 @@
+ 
+ #define KVM_STATE_VMX_PREEMPTION_TIMER_DEADLINE	0x00000001
+ 
++/* attributes for system fd (group 0) */
++#define KVM_X86_XCOMP_GUEST_SUPP	0
++
+ struct kvm_vmx_nested_state_data {
+ 	__u8 vmcs12[KVM_STATE_NESTED_VMX_VMCS_SIZE];
+ 	__u8 shadow_vmcs12[KVM_STATE_NESTED_VMX_VMCS_SIZE];
+Index: qemu/linux-headers/linux/kvm.h
+===================================================================
+--- qemu.orig/linux-headers/linux/kvm.h	2023-07-04 20:49:59.000000000 -0400
++++ qemu/linux-headers/linux/kvm.h	2023-07-04 20:51:10.000000000 -0400
+@@ -1133,6 +1133,7 @@
+ #define KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM 206
+ #define KVM_CAP_VM_GPA_BITS 207
+ #define KVM_CAP_XSAVE2 208
++#define KVM_CAP_SYS_ATTRIBUTES 209
+ 
+ #ifdef KVM_CAP_IRQ_ROUTING
+ 
+@@ -2047,4 +2048,7 @@
+ 
+ #define KVM_GET_STATS_FD  _IO(KVMIO,  0xce)
+ 
++/* Available with KVM_CAP_XSAVE2 */
++#define KVM_GET_XSAVE2		  _IOR(KVMIO,  0xcf, struct kvm_xsave)
++
+ #endif /* __LINUX_KVM_H */
diff --git a/debian/patches/ubuntu/lp-1853307-linux-headers-update-to-5.16-rc1.patch b/debian/patches/ubuntu/lp-1853307-linux-headers-update-to-5.16-rc1.patch
new file mode 100644
index 0000000..251b03a
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1853307-linux-headers-update-to-5.16-rc1.patch
@@ -0,0 +1,717 @@
+From 43709a0ca3b09e952bde3f38112f1d7fbf7c65b1 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <[e-mail]>
+Date: Thu, 11 Nov 2021 12:06:01 +0100
+Subject: [PATCH] linux-headers: update to 5.16-rc1
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Paolo Bonzini <[e-mail]>
+Acked-by: Cornelia Huck <[e-mail]>
+Reviewed-by: Alex Bennée <[e-mail]>
+Message-Id: <[e-mail]>
+Signed-off-by: Paolo Bonzini <[e-mail]>
+
+Origin: upstream, https://gitlab.com/qemu-project/qemu/commit/43709a0ca3
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1853307
+Last-Update: 2023-07-04
+
+---
+ include/standard-headers/drm/drm_fourcc.h     | 121 +++++++++++++++++-
+ include/standard-headers/linux/ethtool.h      |  31 +++++
+ include/standard-headers/linux/fuse.h         |  10 +-
+ include/standard-headers/linux/pci_regs.h     |   6 +
+ include/standard-headers/linux/virtio_gpu.h   |  18 ++-
+ include/standard-headers/linux/virtio_ids.h   |  24 ++++
+ include/standard-headers/linux/virtio_vsock.h |   3 +-
+ linux-headers/asm-arm64/unistd.h              |   1 +
+ linux-headers/asm-generic/unistd.h            |  22 +++-
+ linux-headers/asm-mips/unistd_n32.h           |   1 +
+ linux-headers/asm-mips/unistd_n64.h           |   1 +
+ linux-headers/asm-mips/unistd_o32.h           |   1 +
+ linux-headers/asm-powerpc/unistd_32.h         |   1 +
+ linux-headers/asm-powerpc/unistd_64.h         |   1 +
+ linux-headers/asm-s390/unistd_32.h            |   1 +
+ linux-headers/asm-s390/unistd_64.h            |   1 +
+ linux-headers/asm-x86/kvm.h                   |   5 +
+ linux-headers/asm-x86/unistd_32.h             |   3 +
+ linux-headers/asm-x86/unistd_64.h             |   3 +
+ linux-headers/asm-x86/unistd_x32.h            |   3 +
+ linux-headers/linux/kvm.h                     |  40 +++++-
+ 21 files changed, 276 insertions(+), 21 deletions(-)
+
+Index: qemu/include/standard-headers/drm/drm_fourcc.h
+===================================================================
+--- qemu.orig/include/standard-headers/drm/drm_fourcc.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/include/standard-headers/drm/drm_fourcc.h	2023-07-04 20:51:12.000000000 -0400
+@@ -103,6 +103,12 @@
+ /* 8 bpp Red */
+ #define DRM_FORMAT_R8		fourcc_code('R', '8', ' ', ' ') /* [7:0] R */
+ 
++/* 10 bpp Red */
++#define DRM_FORMAT_R10		fourcc_code('R', '1', '0', ' ') /* [15:0] x:R 6:10 little endian */
++
++/* 12 bpp Red */
++#define DRM_FORMAT_R12		fourcc_code('R', '1', '2', ' ') /* [15:0] x:R 4:12 little endian */
++
+ /* 16 bpp Red */
+ #define DRM_FORMAT_R16		fourcc_code('R', '1', '6', ' ') /* [15:0] R little endian */
+ 
+@@ -372,6 +378,12 @@
+ 
+ #define DRM_FORMAT_RESERVED	      ((1ULL << 56) - 1)
+ 
++#define fourcc_mod_get_vendor(modifier) \
++	(((modifier) >> 56) & 0xff)
++
++#define fourcc_mod_is_vendor(modifier, vendor) \
++	(fourcc_mod_get_vendor(modifier) == DRM_FORMAT_MOD_VENDOR_## vendor)
++
+ #define fourcc_mod_code(vendor, val) \
+ 	((((uint64_t)DRM_FORMAT_MOD_VENDOR_## vendor) << 56) | ((val) & 0x00ffffffffffffffULL))
+ 
+@@ -899,9 +911,9 @@
+ 
+ /*
+  * The top 4 bits (out of the 56 bits alloted for specifying vendor specific
+- * modifiers) denote the category for modifiers. Currently we have only two
+- * categories of modifiers ie AFBC and MISC. We can have a maximum of sixteen
+- * different categories.
++ * modifiers) denote the category for modifiers. Currently we have three
++ * categories of modifiers ie AFBC, MISC and AFRC. We can have a maximum of
++ * sixteen different categories.
+  */
+ #define DRM_FORMAT_MOD_ARM_CODE(__type, __val) \
+ 	fourcc_mod_code(ARM, ((uint64_t)(__type) << 52) | ((__val) & 0x000fffffffffffffULL))
+@@ -1017,6 +1029,109 @@
+ #define AFBC_FORMAT_MOD_USM	(1ULL << 12)
+ 
+ /*
++ * Arm Fixed-Rate Compression (AFRC) modifiers
++ *
++ * AFRC is a proprietary fixed rate image compression protocol and format,
++ * designed to provide guaranteed bandwidth and memory footprint
++ * reductions in graphics and media use-cases.
++ *
++ * AFRC buffers consist of one or more planes, with the same components
++ * and meaning as an uncompressed buffer using the same pixel format.
++ *
++ * Within each plane, the pixel/luma/chroma values are grouped into
++ * "coding unit" blocks which are individually compressed to a
++ * fixed size (in bytes). All coding units within a given plane of a buffer
++ * store the same number of values, and have the same compressed size.
++ *
++ * The coding unit size is configurable, allowing different rates of compression.
++ *
++ * The start of each AFRC buffer plane must be aligned to an alignment granule which
++ * depends on the coding unit size.
++ *
++ * Coding Unit Size   Plane Alignment
++ * ----------------   ---------------
++ * 16 bytes           1024 bytes
++ * 24 bytes           512  bytes
++ * 32 bytes           2048 bytes
++ *
++ * Coding units are grouped into paging tiles. AFRC buffer dimensions must be aligned
++ * to a multiple of the paging tile dimensions.
++ * The dimensions of each paging tile depend on whether the buffer is optimised for
++ * scanline (SCAN layout) or rotated (ROT layout) access.
++ *
++ * Layout   Paging Tile Width   Paging Tile Height
++ * ------   -----------------   ------------------
++ * SCAN     16 coding units     4 coding units
++ * ROT      8  coding units     8 coding units
++ *
++ * The dimensions of each coding unit depend on the number of components
++ * in the compressed plane and whether the buffer is optimised for
++ * scanline (SCAN layout) or rotated (ROT layout) access.
++ *
++ * Number of Components in Plane   Layout      Coding Unit Width   Coding Unit Height
++ * -----------------------------   ---------   -----------------   ------------------
++ * 1                               SCAN        16 samples          4 samples
++ * Example: 16x4 luma samples in a 'Y' plane
++ *          16x4 chroma 'V' values, in the 'V' plane of a fully-planar YUV buffer
++ * -----------------------------   ---------   -----------------   ------------------
++ * 1                               ROT         8 samples           8 samples
++ * Example: 8x8 luma samples in a 'Y' plane
++ *          8x8 chroma 'V' values, in the 'V' plane of a fully-planar YUV buffer
++ * -----------------------------   ---------   -----------------   ------------------
++ * 2                               DONT CARE   8 samples           4 samples
++ * Example: 8x4 chroma pairs in the 'UV' plane of a semi-planar YUV buffer
++ * -----------------------------   ---------   -----------------   ------------------
++ * 3                               DONT CARE   4 samples           4 samples
++ * Example: 4x4 pixels in an RGB buffer without alpha
++ * -----------------------------   ---------   -----------------   ------------------
++ * 4                               DONT CARE   4 samples           4 samples
++ * Example: 4x4 pixels in an RGB buffer with alpha
++ */
++
++#define DRM_FORMAT_MOD_ARM_TYPE_AFRC 0x02
++
++#define DRM_FORMAT_MOD_ARM_AFRC(__afrc_mode) \
++	DRM_FORMAT_MOD_ARM_CODE(DRM_FORMAT_MOD_ARM_TYPE_AFRC, __afrc_mode)
++
++/*
++ * AFRC coding unit size modifier.
++ *
++ * Indicates the number of bytes used to store each compressed coding unit for
++ * one or more planes in an AFRC encoded buffer. The coding unit size for chrominance
++ * is the same for both Cb and Cr, which may be stored in separate planes.
++ *
++ * AFRC_FORMAT_MOD_CU_SIZE_P0 indicates the number of bytes used to store
++ * each compressed coding unit in the first plane of the buffer. For RGBA buffers
++ * this is the only plane, while for semi-planar and fully-planar YUV buffers,
++ * this corresponds to the luma plane.
++ *
++ * AFRC_FORMAT_MOD_CU_SIZE_P12 indicates the number of bytes used to store
++ * each compressed coding unit in the second and third planes in the buffer.
++ * For semi-planar and fully-planar YUV buffers, this corresponds to the chroma plane(s).
++ *
++ * For single-plane buffers, AFRC_FORMAT_MOD_CU_SIZE_P0 must be specified
++ * and AFRC_FORMAT_MOD_CU_SIZE_P12 must be zero.
++ * For semi-planar and fully-planar buffers, both AFRC_FORMAT_MOD_CU_SIZE_P0 and
++ * AFRC_FORMAT_MOD_CU_SIZE_P12 must be specified.
++ */
++#define AFRC_FORMAT_MOD_CU_SIZE_MASK 0xf
++#define AFRC_FORMAT_MOD_CU_SIZE_16 (1ULL)
++#define AFRC_FORMAT_MOD_CU_SIZE_24 (2ULL)
++#define AFRC_FORMAT_MOD_CU_SIZE_32 (3ULL)
++
++#define AFRC_FORMAT_MOD_CU_SIZE_P0(__afrc_cu_size) (__afrc_cu_size)
++#define AFRC_FORMAT_MOD_CU_SIZE_P12(__afrc_cu_size) ((__afrc_cu_size) << 4)
++
++/*
++ * AFRC scanline memory layout.
++ *
++ * Indicates if the buffer uses the scanline-optimised layout
++ * for an AFRC encoded buffer, otherwise, it uses the rotation-optimised layout.
++ * The memory layout is the same for all planes.
++ */
++#define AFRC_FORMAT_MOD_LAYOUT_SCAN (1ULL << 8)
++
++/*
+  * Arm 16x16 Block U-Interleaved modifier
+  *
+  * This is used by Arm Mali Utgard and Midgard GPUs. It divides the image
+Index: qemu/include/standard-headers/linux/ethtool.h
+===================================================================
+--- qemu.orig/include/standard-headers/linux/ethtool.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/include/standard-headers/linux/ethtool.h	2023-07-04 20:51:12.000000000 -0400
+@@ -603,6 +603,7 @@
+ 	ETHTOOL_LINK_EXT_STATE_CALIBRATION_FAILURE,
+ 	ETHTOOL_LINK_EXT_STATE_POWER_BUDGET_EXCEEDED,
+ 	ETHTOOL_LINK_EXT_STATE_OVERHEAT,
++	ETHTOOL_LINK_EXT_STATE_MODULE,
+ };
+ 
+ /* More information in addition to ETHTOOL_LINK_EXT_STATE_AUTONEG. */
+@@ -639,6 +640,8 @@
+ enum ethtool_link_ext_substate_bad_signal_integrity {
+ 	ETHTOOL_LINK_EXT_SUBSTATE_BSI_LARGE_NUMBER_OF_PHYSICAL_ERRORS = 1,
+ 	ETHTOOL_LINK_EXT_SUBSTATE_BSI_UNSUPPORTED_RATE,
++	ETHTOOL_LINK_EXT_SUBSTATE_BSI_SERDES_REFERENCE_CLOCK_LOST,
++	ETHTOOL_LINK_EXT_SUBSTATE_BSI_SERDES_ALOS,
+ };
+ 
+ /* More information in addition to ETHTOOL_LINK_EXT_STATE_CABLE_ISSUE. */
+@@ -647,6 +650,11 @@
+ 	ETHTOOL_LINK_EXT_SUBSTATE_CI_CABLE_TEST_FAILURE,
+ };
+ 
++/* More information in addition to ETHTOOL_LINK_EXT_STATE_MODULE. */
++enum ethtool_link_ext_substate_module {
++	ETHTOOL_LINK_EXT_SUBSTATE_MODULE_CMIS_NOT_READY = 1,
++};
++
+ #define ETH_GSTRING_LEN		32
+ 
+ /**
+@@ -705,6 +713,29 @@
+ };
+ 
+ /**
++ * enum ethtool_module_power_mode_policy - plug-in module power mode policy
++ * @ETHTOOL_MODULE_POWER_MODE_POLICY_HIGH: Module is always in high power mode.
++ * @ETHTOOL_MODULE_POWER_MODE_POLICY_AUTO: Module is transitioned by the host
++ *	to high power mode when the first port using it is put administratively
++ *	up and to low power mode when the last port using it is put
++ *	administratively down.
++ */
++enum ethtool_module_power_mode_policy {
++	ETHTOOL_MODULE_POWER_MODE_POLICY_HIGH = 1,
++	ETHTOOL_MODULE_POWER_MODE_POLICY_AUTO,
++};
++
++/**
++ * enum ethtool_module_power_mode - plug-in module power mode
++ * @ETHTOOL_MODULE_POWER_MODE_LOW: Module is in low power mode.
++ * @ETHTOOL_MODULE_POWER_MODE_HIGH: Module is in high power mode.
++ */
++enum ethtool_module_power_mode {
++	ETHTOOL_MODULE_POWER_MODE_LOW = 1,
++	ETHTOOL_MODULE_POWER_MODE_HIGH,
++};
++
++/**
+  * struct ethtool_gstrings - string set for data tagging
+  * @cmd: Command number = %ETHTOOL_GSTRINGS
+  * @string_set: String set ID; one of &enum ethtool_stringset
+Index: qemu/include/standard-headers/linux/fuse.h
+===================================================================
+--- qemu.orig/include/standard-headers/linux/fuse.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/include/standard-headers/linux/fuse.h	2023-07-04 20:51:12.000000000 -0400
+@@ -181,6 +181,9 @@
+  *  - add FUSE_OPEN_KILL_SUIDGID
+  *  - extend fuse_setxattr_in, add FUSE_SETXATTR_EXT
+  *  - add FUSE_SETXATTR_ACL_KILL_SGID
++ *
++ *  7.34
++ *  - add FUSE_SYNCFS
+  */
+ 
+ #ifndef _LINUX_FUSE_H
+@@ -212,7 +215,7 @@
+ #define FUSE_KERNEL_VERSION 7
+ 
+ /** Minor version number of this interface */
+-#define FUSE_KERNEL_MINOR_VERSION 33
++#define FUSE_KERNEL_MINOR_VERSION 34
+ 
+ /** The node ID of the root inode */
+ #define FUSE_ROOT_ID 1
+@@ -505,6 +508,7 @@
+ 	FUSE_COPY_FILE_RANGE	= 47,
+ 	FUSE_SETUPMAPPING	= 48,
+ 	FUSE_REMOVEMAPPING	= 49,
++	FUSE_SYNCFS		= 50,
+ 
+ 	/* CUSE specific operations */
+ 	CUSE_INIT		= 4096,
+@@ -967,4 +971,8 @@
+ #define FUSE_REMOVEMAPPING_MAX_ENTRY   \
+ 		(PAGE_SIZE / sizeof(struct fuse_removemapping_one))
+ 
++struct fuse_syncfs_in {
++	uint64_t	padding;
++};
++
+ #endif /* _LINUX_FUSE_H */
+Index: qemu/include/standard-headers/linux/pci_regs.h
+===================================================================
+--- qemu.orig/include/standard-headers/linux/pci_regs.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/include/standard-headers/linux/pci_regs.h	2023-07-04 20:51:12.000000000 -0400
+@@ -504,6 +504,12 @@
+ #define  PCI_EXP_DEVCTL_URRE	0x0008	/* Unsupported Request Reporting En. */
+ #define  PCI_EXP_DEVCTL_RELAX_EN 0x0010 /* Enable relaxed ordering */
+ #define  PCI_EXP_DEVCTL_PAYLOAD	0x00e0	/* Max_Payload_Size */
++#define  PCI_EXP_DEVCTL_PAYLOAD_128B 0x0000 /* 128 Bytes */
++#define  PCI_EXP_DEVCTL_PAYLOAD_256B 0x0020 /* 256 Bytes */
++#define  PCI_EXP_DEVCTL_PAYLOAD_512B 0x0040 /* 512 Bytes */
++#define  PCI_EXP_DEVCTL_PAYLOAD_1024B 0x0060 /* 1024 Bytes */
++#define  PCI_EXP_DEVCTL_PAYLOAD_2048B 0x0080 /* 2048 Bytes */
++#define  PCI_EXP_DEVCTL_PAYLOAD_4096B 0x00a0 /* 4096 Bytes */
+ #define  PCI_EXP_DEVCTL_EXT_TAG	0x0100	/* Extended Tag Field Enable */
+ #define  PCI_EXP_DEVCTL_PHANTOM	0x0200	/* Phantom Functions Enable */
+ #define  PCI_EXP_DEVCTL_AUX_PME	0x0400	/* Auxiliary Power PM Enable */
+Index: qemu/include/standard-headers/linux/virtio_gpu.h
+===================================================================
+--- qemu.orig/include/standard-headers/linux/virtio_gpu.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/include/standard-headers/linux/virtio_gpu.h	2023-07-04 20:49:59.000000000 -0400
+@@ -59,6 +59,11 @@
+  * VIRTIO_GPU_CMD_RESOURCE_CREATE_BLOB
+  */
+ #define VIRTIO_GPU_F_RESOURCE_BLOB       3
++/*
++ * VIRTIO_GPU_CMD_CREATE_CONTEXT with
++ * context_init and multiple timelines
++ */
++#define VIRTIO_GPU_F_CONTEXT_INIT        4
+ 
+ enum virtio_gpu_ctrl_type {
+ 	VIRTIO_GPU_UNDEFINED = 0,
+@@ -122,14 +127,20 @@
+ 	VIRTIO_GPU_SHM_ID_HOST_VISIBLE = 1
+ };
+ 
+-#define VIRTIO_GPU_FLAG_FENCE (1 << 0)
++#define VIRTIO_GPU_FLAG_FENCE         (1 << 0)
++/*
++ * If the following flag is set, then ring_idx contains the index
++ * of the command ring that needs to used when creating the fence
++ */
++#define VIRTIO_GPU_FLAG_INFO_RING_IDX (1 << 1)
+ 
+ struct virtio_gpu_ctrl_hdr {
+ 	uint32_t type;
+ 	uint32_t flags;
+ 	uint64_t fence_id;
+ 	uint32_t ctx_id;
+-	uint32_t padding;
++	uint8_t ring_idx;
++	uint8_t padding[3];
+ };
+ 
+ /* data passed in the cursor vq */
+@@ -269,10 +280,11 @@
+ };
+ 
+ /* VIRTIO_GPU_CMD_CTX_CREATE */
++#define VIRTIO_GPU_CONTEXT_INIT_CAPSET_ID_MASK 0x000000ff
+ struct virtio_gpu_ctx_create {
+ 	struct virtio_gpu_ctrl_hdr hdr;
+ 	uint32_t nlen;
+-	uint32_t padding;
++	uint32_t context_init;
+ 	char debug_name[64];
+ };
+ 
+Index: qemu/include/standard-headers/linux/virtio_ids.h
+===================================================================
+--- qemu.orig/include/standard-headers/linux/virtio_ids.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/include/standard-headers/linux/virtio_ids.h	2023-07-04 20:51:04.000000000 -0400
+@@ -54,7 +54,31 @@
+ #define VIRTIO_ID_SOUND			25 /* virtio sound */
+ #define VIRTIO_ID_FS			26 /* virtio filesystem */
+ #define VIRTIO_ID_PMEM			27 /* virtio pmem */
++#define VIRTIO_ID_RPMB			28 /* virtio rpmb */
+ #define VIRTIO_ID_MAC80211_HWSIM	29 /* virtio mac80211-hwsim */
++#define VIRTIO_ID_VIDEO_ENCODER		30 /* virtio video encoder */
++#define VIRTIO_ID_VIDEO_DECODER		31 /* virtio video decoder */
++#define VIRTIO_ID_SCMI			32 /* virtio SCMI */
++#define VIRTIO_ID_NITRO_SEC_MOD		33 /* virtio nitro secure module*/
++#define VIRTIO_ID_I2C_ADAPTER		34 /* virtio i2c adapter */
++#define VIRTIO_ID_WATCHDOG		35 /* virtio watchdog */
++#define VIRTIO_ID_CAN			36 /* virtio can */
++#define VIRTIO_ID_DMABUF		37 /* virtio dmabuf */
++#define VIRTIO_ID_PARAM_SERV		38 /* virtio parameter server */
++#define VIRTIO_ID_AUDIO_POLICY		39 /* virtio audio policy */
+ #define VIRTIO_ID_BT			40 /* virtio bluetooth */
++#define VIRTIO_ID_GPIO			41 /* virtio gpio */
++
++/*
++ * Virtio Transitional IDs
++ */
++
++#define VIRTIO_TRANS_ID_NET		1000 /* transitional virtio net */
++#define VIRTIO_TRANS_ID_BLOCK		1001 /* transitional virtio block */
++#define VIRTIO_TRANS_ID_BALLOON		1002 /* transitional virtio balloon */
++#define VIRTIO_TRANS_ID_CONSOLE		1003 /* transitional virtio console */
++#define VIRTIO_TRANS_ID_SCSI		1004 /* transitional virtio SCSI */
++#define VIRTIO_TRANS_ID_RNG		1005 /* transitional virtio rng */
++#define VIRTIO_TRANS_ID_9P		1009 /* transitional virtio 9p console */
+ 
+ #endif /* _LINUX_VIRTIO_IDS_H */
+Index: qemu/include/standard-headers/linux/virtio_vsock.h
+===================================================================
+--- qemu.orig/include/standard-headers/linux/virtio_vsock.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/include/standard-headers/linux/virtio_vsock.h	2023-07-04 20:49:59.000000000 -0400
+@@ -97,7 +97,8 @@
+ 
+ /* VIRTIO_VSOCK_OP_RW flags values */
+ enum virtio_vsock_rw {
+-	VIRTIO_VSOCK_SEQ_EOR = 1,
++	VIRTIO_VSOCK_SEQ_EOM = 1,
++	VIRTIO_VSOCK_SEQ_EOR = 2,
+ };
+ 
+ #endif /* _LINUX_VIRTIO_VSOCK_H */
+Index: qemu/linux-headers/asm-arm64/unistd.h
+===================================================================
+--- qemu.orig/linux-headers/asm-arm64/unistd.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/linux-headers/asm-arm64/unistd.h	2023-07-04 20:49:59.000000000 -0400
+@@ -20,5 +20,6 @@
+ #define __ARCH_WANT_SET_GET_RLIMIT
+ #define __ARCH_WANT_TIME32_SYSCALLS
+ #define __ARCH_WANT_SYS_CLONE3
++#define __ARCH_WANT_MEMFD_SECRET
+ 
+ #include <asm-generic/unistd.h>
+Index: qemu/linux-headers/asm-generic/unistd.h
+===================================================================
+--- qemu.orig/linux-headers/asm-generic/unistd.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/linux-headers/asm-generic/unistd.h	2023-07-04 20:51:12.000000000 -0400
+@@ -673,15 +673,15 @@
+ #define __NR_remap_file_pages 234
+ __SYSCALL(__NR_remap_file_pages, sys_remap_file_pages)
+ #define __NR_mbind 235
+-__SC_COMP(__NR_mbind, sys_mbind, compat_sys_mbind)
++__SYSCALL(__NR_mbind, sys_mbind)
+ #define __NR_get_mempolicy 236
+-__SC_COMP(__NR_get_mempolicy, sys_get_mempolicy, compat_sys_get_mempolicy)
++__SYSCALL(__NR_get_mempolicy, sys_get_mempolicy)
+ #define __NR_set_mempolicy 237
+-__SC_COMP(__NR_set_mempolicy, sys_set_mempolicy, compat_sys_set_mempolicy)
++__SYSCALL(__NR_set_mempolicy, sys_set_mempolicy)
+ #define __NR_migrate_pages 238
+-__SC_COMP(__NR_migrate_pages, sys_migrate_pages, compat_sys_migrate_pages)
++__SYSCALL(__NR_migrate_pages, sys_migrate_pages)
+ #define __NR_move_pages 239
+-__SC_COMP(__NR_move_pages, sys_move_pages, compat_sys_move_pages)
++__SYSCALL(__NR_move_pages, sys_move_pages)
+ #endif
+ 
+ #define __NR_rt_tgsigqueueinfo 240
+@@ -873,8 +873,18 @@
+ #define __NR_landlock_restrict_self 446
+ __SYSCALL(__NR_landlock_restrict_self, sys_landlock_restrict_self)
+ 
++#ifdef __ARCH_WANT_MEMFD_SECRET
++#define __NR_memfd_secret 447
++__SYSCALL(__NR_memfd_secret, sys_memfd_secret)
++#endif
++#define __NR_process_mrelease 448
++__SYSCALL(__NR_process_mrelease, sys_process_mrelease)
++
++#define __NR_futex_waitv 449
++__SYSCALL(__NR_futex_waitv, sys_futex_waitv)
++
+ #undef __NR_syscalls
+-#define __NR_syscalls 447
++#define __NR_syscalls 450
+ 
+ /*
+  * 32 bit systems traditionally used different
+Index: qemu/linux-headers/asm-mips/unistd_n32.h
+===================================================================
+--- qemu.orig/linux-headers/asm-mips/unistd_n32.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/linux-headers/asm-mips/unistd_n32.h	2023-07-04 20:51:12.000000000 -0400
+@@ -376,5 +376,6 @@
+ #define __NR_landlock_create_ruleset (__NR_Linux + 444)
+ #define __NR_landlock_add_rule (__NR_Linux + 445)
+ #define __NR_landlock_restrict_self (__NR_Linux + 446)
++#define __NR_process_mrelease (__NR_Linux + 448)
+ 
+ #endif /* _ASM_UNISTD_N32_H */
+Index: qemu/linux-headers/asm-mips/unistd_n64.h
+===================================================================
+--- qemu.orig/linux-headers/asm-mips/unistd_n64.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/linux-headers/asm-mips/unistd_n64.h	2023-07-04 20:51:12.000000000 -0400
+@@ -352,5 +352,6 @@
+ #define __NR_landlock_create_ruleset (__NR_Linux + 444)
+ #define __NR_landlock_add_rule (__NR_Linux + 445)
+ #define __NR_landlock_restrict_self (__NR_Linux + 446)
++#define __NR_process_mrelease (__NR_Linux + 448)
+ 
+ #endif /* _ASM_UNISTD_N64_H */
+Index: qemu/linux-headers/asm-mips/unistd_o32.h
+===================================================================
+--- qemu.orig/linux-headers/asm-mips/unistd_o32.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/linux-headers/asm-mips/unistd_o32.h	2023-07-04 20:51:12.000000000 -0400
+@@ -422,5 +422,6 @@
+ #define __NR_landlock_create_ruleset (__NR_Linux + 444)
+ #define __NR_landlock_add_rule (__NR_Linux + 445)
+ #define __NR_landlock_restrict_self (__NR_Linux + 446)
++#define __NR_process_mrelease (__NR_Linux + 448)
+ 
+ #endif /* _ASM_UNISTD_O32_H */
+Index: qemu/linux-headers/asm-powerpc/unistd_32.h
+===================================================================
+--- qemu.orig/linux-headers/asm-powerpc/unistd_32.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/linux-headers/asm-powerpc/unistd_32.h	2023-07-04 20:51:12.000000000 -0400
+@@ -429,6 +429,7 @@
+ #define __NR_landlock_create_ruleset 444
+ #define __NR_landlock_add_rule 445
+ #define __NR_landlock_restrict_self 446
++#define __NR_process_mrelease 448
+ 
+ 
+ #endif /* _ASM_UNISTD_32_H */
+Index: qemu/linux-headers/asm-powerpc/unistd_64.h
+===================================================================
+--- qemu.orig/linux-headers/asm-powerpc/unistd_64.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/linux-headers/asm-powerpc/unistd_64.h	2023-07-04 20:51:12.000000000 -0400
+@@ -401,6 +401,7 @@
+ #define __NR_landlock_create_ruleset 444
+ #define __NR_landlock_add_rule 445
+ #define __NR_landlock_restrict_self 446
++#define __NR_process_mrelease 448
+ 
+ 
+ #endif /* _ASM_UNISTD_64_H */
+Index: qemu/linux-headers/asm-s390/unistd_32.h
+===================================================================
+--- qemu.orig/linux-headers/asm-s390/unistd_32.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/linux-headers/asm-s390/unistd_32.h	2023-07-04 20:51:12.000000000 -0400
+@@ -419,5 +419,6 @@
+ #define __NR_landlock_create_ruleset 444
+ #define __NR_landlock_add_rule 445
+ #define __NR_landlock_restrict_self 446
++#define __NR_process_mrelease 448
+ 
+ #endif /* _ASM_S390_UNISTD_32_H */
+Index: qemu/linux-headers/asm-s390/unistd_64.h
+===================================================================
+--- qemu.orig/linux-headers/asm-s390/unistd_64.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/linux-headers/asm-s390/unistd_64.h	2023-07-04 20:51:12.000000000 -0400
+@@ -367,5 +367,6 @@
+ #define __NR_landlock_create_ruleset 444
+ #define __NR_landlock_add_rule 445
+ #define __NR_landlock_restrict_self 446
++#define __NR_process_mrelease 448
+ 
+ #endif /* _ASM_S390_UNISTD_64_H */
+Index: qemu/linux-headers/asm-x86/kvm.h
+===================================================================
+--- qemu.orig/linux-headers/asm-x86/kvm.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/linux-headers/asm-x86/kvm.h	2023-07-04 20:51:12.000000000 -0400
+@@ -295,6 +295,7 @@
+ #define KVM_GUESTDBG_USE_HW_BP		0x00020000
+ #define KVM_GUESTDBG_INJECT_DB		0x00040000
+ #define KVM_GUESTDBG_INJECT_BP		0x00080000
++#define KVM_GUESTDBG_BLOCKIRQ		0x00100000
+ 
+ /* for KVM_SET_GUEST_DEBUG */
+ struct kvm_guest_debug_arch {
+@@ -503,4 +504,8 @@
+ #define KVM_PMU_EVENT_ALLOW 0
+ #define KVM_PMU_EVENT_DENY 1
+ 
++/* for KVM_{GET,SET,HAS}_DEVICE_ATTR */
++#define KVM_VCPU_TSC_CTRL 0 /* control group for the timestamp counter (TSC) */
++#define   KVM_VCPU_TSC_OFFSET 0 /* attribute for the TSC offset */
++
+ #endif /* _ASM_X86_KVM_H */
+Index: qemu/linux-headers/asm-x86/unistd_32.h
+===================================================================
+--- qemu.orig/linux-headers/asm-x86/unistd_32.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/linux-headers/asm-x86/unistd_32.h	2023-07-04 20:51:12.000000000 -0400
+@@ -437,6 +437,9 @@
+ #define __NR_landlock_create_ruleset 444
+ #define __NR_landlock_add_rule 445
+ #define __NR_landlock_restrict_self 446
++#define __NR_memfd_secret 447
++#define __NR_process_mrelease 448
++#define __NR_futex_waitv 449
+ 
+ 
+ #endif /* _ASM_UNISTD_32_H */
+Index: qemu/linux-headers/asm-x86/unistd_64.h
+===================================================================
+--- qemu.orig/linux-headers/asm-x86/unistd_64.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/linux-headers/asm-x86/unistd_64.h	2023-07-04 20:51:12.000000000 -0400
+@@ -359,6 +359,9 @@
+ #define __NR_landlock_create_ruleset 444
+ #define __NR_landlock_add_rule 445
+ #define __NR_landlock_restrict_self 446
++#define __NR_memfd_secret 447
++#define __NR_process_mrelease 448
++#define __NR_futex_waitv 449
+ 
+ 
+ #endif /* _ASM_UNISTD_64_H */
+Index: qemu/linux-headers/asm-x86/unistd_x32.h
+===================================================================
+--- qemu.orig/linux-headers/asm-x86/unistd_x32.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/linux-headers/asm-x86/unistd_x32.h	2023-07-04 20:51:12.000000000 -0400
+@@ -312,6 +312,9 @@
+ #define __NR_landlock_create_ruleset (__X32_SYSCALL_BIT + 444)
+ #define __NR_landlock_add_rule (__X32_SYSCALL_BIT + 445)
+ #define __NR_landlock_restrict_self (__X32_SYSCALL_BIT + 446)
++#define __NR_memfd_secret (__X32_SYSCALL_BIT + 447)
++#define __NR_process_mrelease (__X32_SYSCALL_BIT + 448)
++#define __NR_futex_waitv (__X32_SYSCALL_BIT + 449)
+ #define __NR_rt_sigaction (__X32_SYSCALL_BIT + 512)
+ #define __NR_rt_sigreturn (__X32_SYSCALL_BIT + 513)
+ #define __NR_ioctl (__X32_SYSCALL_BIT + 514)
+Index: qemu/linux-headers/linux/kvm.h
+===================================================================
+--- qemu.orig/linux-headers/linux/kvm.h	2023-07-04 20:38:39.000000000 -0400
++++ qemu/linux-headers/linux/kvm.h	2023-07-04 20:51:12.000000000 -0400
+@@ -269,6 +269,7 @@
+ #define KVM_EXIT_AP_RESET_HOLD    32
+ #define KVM_EXIT_X86_BUS_LOCK     33
+ #define KVM_EXIT_XEN              34
++#define KVM_EXIT_RISCV_SBI        35
+ 
+ /* For KVM_EXIT_INTERNAL_ERROR */
+ /* Emulate instruction failed. */
+@@ -397,13 +398,23 @@
+ 		 * "ndata" is correct, that new fields are enumerated in "flags",
+ 		 * and that each flag enumerates fields that are 64-bit aligned
+ 		 * and sized (so that ndata+internal.data[] is valid/accurate).
++		 *
++		 * Space beyond the defined fields may be used to store arbitrary
++		 * debug information relating to the emulation failure. It is
++		 * accounted for in "ndata" but the format is unspecified and is
++		 * not represented in "flags". Any such information is *not* ABI!
+ 		 */
+ 		struct {
+ 			__u32 suberror;
+ 			__u32 ndata;
+ 			__u64 flags;
+-			__u8  insn_size;
+-			__u8  insn_bytes[15];
++			union {
++				struct {
++					__u8  insn_size;
++					__u8  insn_bytes[15];
++				};
++			};
++			/* Arbitrary debug data may follow. */
+ 		} emulation_failure;
+ 		/* KVM_EXIT_OSI */
+ 		struct {
+@@ -469,6 +480,13 @@
+ 		} msr;
+ 		/* KVM_EXIT_XEN */
+ 		struct kvm_xen_exit xen;
++		/* KVM_EXIT_RISCV_SBI */
++		struct {
++			unsigned long extension_id;
++			unsigned long function_id;
++			unsigned long args[6];
++			unsigned long ret[2];
++		} riscv_sbi;
+ 		/* Fix the size of the union. */
+ 		char padding[256];
+ 	};
+@@ -1223,11 +1241,16 @@
+ 
+ /* Do not use 1, KVM_CHECK_EXTENSION returned it before we had flags.  */
+ #define KVM_CLOCK_TSC_STABLE		2
++#define KVM_CLOCK_REALTIME		(1 << 2)
++#define KVM_CLOCK_HOST_TSC		(1 << 3)
+ 
+ struct kvm_clock_data {
+ 	__u64 clock;
+ 	__u32 flags;
+-	__u32 pad[9];
++	__u32 pad0;
++	__u64 realtime;
++	__u64 host_tsc;
++	__u32 pad[4];
+ };
+ 
+ /* For KVM_CAP_SW_TLB */
+@@ -1965,7 +1988,9 @@
+ #define KVM_STATS_TYPE_CUMULATIVE	(0x0 << KVM_STATS_TYPE_SHIFT)
+ #define KVM_STATS_TYPE_INSTANT		(0x1 << KVM_STATS_TYPE_SHIFT)
+ #define KVM_STATS_TYPE_PEAK		(0x2 << KVM_STATS_TYPE_SHIFT)
+-#define KVM_STATS_TYPE_MAX		KVM_STATS_TYPE_PEAK
++#define KVM_STATS_TYPE_LINEAR_HIST	(0x3 << KVM_STATS_TYPE_SHIFT)
++#define KVM_STATS_TYPE_LOG_HIST		(0x4 << KVM_STATS_TYPE_SHIFT)
++#define KVM_STATS_TYPE_MAX		KVM_STATS_TYPE_LOG_HIST
+ 
+ #define KVM_STATS_UNIT_SHIFT		4
+ #define KVM_STATS_UNIT_MASK		(0xF << KVM_STATS_UNIT_SHIFT)
+@@ -1988,8 +2013,9 @@
+  * @size: The number of data items for this stats.
+  *        Every data item is of type __u64.
+  * @offset: The offset of the stats to the start of stat structure in
+- *          struture kvm or kvm_vcpu.
+- * @unused: Unused field for future usage. Always 0 for now.
++ *          structure kvm or kvm_vcpu.
++ * @bucket_size: A parameter value used for histogram stats. It is only used
++ *		for linear histogram stats, specifying the size of the bucket;
+  * @name: The name string for the stats. Its size is indicated by the
+  *        &kvm_stats_header->name_size.
+  */
+@@ -1998,7 +2024,7 @@
+ 	__s16 exponent;
+ 	__u16 size;
+ 	__u32 offset;
+-	__u32 unused;
++	__u32 bucket_size;
+ 	char name[];
+ };
+ 
diff --git a/debian/patches/ubuntu/lp-1853307-s390x-pci-RPCIT-second-pass-when-mappings-exhausted.patch b/debian/patches/ubuntu/lp-1853307-s390x-pci-RPCIT-second-pass-when-mappings-exhausted.patch
new file mode 100644
index 0000000..dd5d063
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1853307-s390x-pci-RPCIT-second-pass-when-mappings-exhausted.patch
@@ -0,0 +1,103 @@
+From 4a8d21ba50fc8625c3bd51dab903872952f95718 Mon Sep 17 00:00:00 2001
+From: Matthew Rosato <[e-mail]>
+Date: Fri, 28 Oct 2022 15:47:56 -0400
+Subject: [PATCH] s390x/pci: RPCIT second pass when mappings exhausted