From 330481bc1c576fc2bdb1419825e2db134e32ce5a Mon Sep 17 00:00:00 2001
From: Cole Robinson <crobinso@redhat.com>
Date: Tue, 5 Jun 2018 14:28:06 -0400
Subject: [PATCH 01/20] Fix qxl memslot_get_virt crashes (bz #1565354)

---
 0001-qxl-fix-local-renderer-crash.patch | 43 +++++++++++++++++++++++++
 qemu.spec                               |  8 ++++-
 2 files changed, 50 insertions(+), 1 deletion(-)
 create mode 100644 0001-qxl-fix-local-renderer-crash.patch

diff --git a/0001-qxl-fix-local-renderer-crash.patch b/0001-qxl-fix-local-renderer-crash.patch
new file mode 100644
index 0000000..a839d38
--- /dev/null
+++ b/0001-qxl-fix-local-renderer-crash.patch
@@ -0,0 +1,43 @@
+From 5bd5c27c7d284d01477c5cc022ce22438c46bf9f Mon Sep 17 00:00:00 2001
+Message-Id: <5bd5c27c7d284d01477c5cc022ce22438c46bf9f.1528219523.git.crobinso@redhat.com>
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Fri, 27 Apr 2018 13:55:28 +0200
+Subject: [PATCH] qxl: fix local renderer crash
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Make sure we only ask the spice local renderer for display updates in
+case we have a valid primary surface.  Without that spice is confused
+and throws errors in case a display update request (triggered by
+screendump for example) happens in parallel to a mode switch and hits
+the race window where the old primary surface is gone and the new isn't
+establisted yet.
+
+Cc: qemu-stable@nongnu.org
+Fixes: https://bugzilla.redhat.com//show_bug.cgi?id=1567733
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
+Message-id: 20180427115528.345-1-kraxel@redhat.com
+Signed-off-by: Cole Robinson <crobinso@redhat.com>
+---
+ hw/display/qxl-render.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/hw/display/qxl-render.c b/hw/display/qxl-render.c
+index e7ac4f8789..c62b9a5e75 100644
+--- a/hw/display/qxl-render.c
++++ b/hw/display/qxl-render.c
+@@ -169,7 +169,8 @@ void qxl_render_update(PCIQXLDevice *qxl)
+ 
+     qemu_mutex_lock(&qxl->ssd.lock);
+ 
+-    if (!runstate_is_running() || !qxl->guest_primary.commands) {
++    if (!runstate_is_running() || !qxl->guest_primary.commands ||
++        qxl->mode == QXL_MODE_UNDEFINED) {
+         qxl_render_update_area_unlocked(qxl);
+         qemu_mutex_unlock(&qxl->ssd.lock);
+         return;
+-- 
+2.17.1
+
diff --git a/qemu.spec b/qemu.spec
index 71c07a1..355eac2 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -104,7 +104,7 @@ Requires: %{name}-ui-sdl = %{epoch}:%{version}-%{release}
 Summary: QEMU is a FAST! processor emulator
 Name: qemu
 Version: 2.12.0
-Release: 1%{?rcrel}%{?dist}
+Release: 2%{?rcrel}%{?dist}
 Epoch: 2
 License: GPLv2 and BSD and MIT and CC-BY
 URL: http://www.qemu.org/
@@ -137,6 +137,9 @@ Source21: 50-kvm-s390x.conf
 # /etc/security/limits.d/95-kvm-ppc64-memlock.conf
 Source22: 95-kvm-ppc64-memlock.conf
 
+# Fix qxl memslot_get_virt crashes (bz #1565354)
+Patch0001: 0001-qxl-fix-local-renderer-crash.patch
+
 # documentation deps
 BuildRequires: texinfo
 # For /usr/bin/pod2man
@@ -1663,6 +1666,9 @@ getent passwd qemu >/dev/null || \
 
 
 %changelog
+* Tue Jun 05 2018 Cole Robinson <crobinso@redhat.com> - 2:2.12.0-2
+- Fix qxl memslot_get_virt crashes (bz #1565354)
+
 * Mon Apr 30 2018 Cole Robinson <crobinso@redhat.com> - 2:2.12.0-1
 - Update to qemu-2.12.0 GA
 

From b91dae7a8f11a5c756fdc0e6af2c5302b1735900 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Mon, 18 Jun 2018 13:45:14 +0100
Subject: [PATCH 02/20] New CPU features for speculative store bypass
 (CVE-2018-3639)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 ...ssbd-CPUID-feature-bit-CVE-2018-3639.patch |  51 ++++++
 ...Virt-SSBD-MSR-and-handling-of-it-CVE.patch | 148 ++++++++++++++++++
 ...AMD-virt-ssbd-CPUID-feature-bit-CVE-.patch |  41 +++++
 qemu.spec                                     |  11 +-
 4 files changed, 250 insertions(+), 1 deletion(-)
 create mode 100644 0001-i386-define-the-ssbd-CPUID-feature-bit-CVE-2018-3639.patch
 create mode 100644 0002-i386-Define-the-Virt-SSBD-MSR-and-handling-of-it-CVE.patch
 create mode 100644 0003-i386-define-the-AMD-virt-ssbd-CPUID-feature-bit-CVE-.patch

diff --git a/0001-i386-define-the-ssbd-CPUID-feature-bit-CVE-2018-3639.patch b/0001-i386-define-the-ssbd-CPUID-feature-bit-CVE-2018-3639.patch
new file mode 100644
index 0000000..00cad34
--- /dev/null
+++ b/0001-i386-define-the-ssbd-CPUID-feature-bit-CVE-2018-3639.patch
@@ -0,0 +1,51 @@
+From 7920d78dc80e7206e07f2a35f942e9f33174d251 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
+Date: Mon, 21 May 2018 22:54:22 +0100
+Subject: [PATCH 1/3] i386: define the 'ssbd' CPUID feature bit (CVE-2018-3639)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+New microcode introduces the "Speculative Store Bypass Disable"
+CPUID feature bit. This needs to be exposed to guest OS to allow
+them to protect against CVE-2018-3639.
+
+Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
+Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Message-Id: <20180521215424.13520-2-berrange@redhat.com>
+Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
+(cherry picked from commit d19d1f965904a533998739698020ff4ee8a103da)
+---
+ target/i386/cpu.c | 2 +-
+ target/i386/cpu.h | 1 +
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/target/i386/cpu.c b/target/i386/cpu.c
+index a20fe26573..2f5263e22f 100644
+--- a/target/i386/cpu.c
++++ b/target/i386/cpu.c
+@@ -510,7 +510,7 @@ static FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
+             NULL, NULL, NULL, NULL,
+             NULL, NULL, NULL, NULL,
+             NULL, NULL, "spec-ctrl", NULL,
+-            NULL, NULL, NULL, NULL,
++            NULL, NULL, NULL, "ssbd",
+         },
+         .cpuid_eax = 7,
+         .cpuid_needs_ecx = true, .cpuid_ecx = 0,
+diff --git a/target/i386/cpu.h b/target/i386/cpu.h
+index 1b219fafc4..970ab96e54 100644
+--- a/target/i386/cpu.h
++++ b/target/i386/cpu.h
+@@ -684,6 +684,7 @@ typedef uint32_t FeatureWordArray[FEATURE_WORDS];
+ #define CPUID_7_0_EDX_AVX512_4VNNIW (1U << 2) /* AVX512 Neural Network Instructions */
+ #define CPUID_7_0_EDX_AVX512_4FMAPS (1U << 3) /* AVX512 Multiply Accumulation Single Precision */
+ #define CPUID_7_0_EDX_SPEC_CTRL     (1U << 26) /* Speculation Control */
++#define CPUID_7_0_EDX_SPEC_CTRL_SSBD  (1U << 31) /* Speculative Store Bypass Disable */
+ 
+ #define KVM_HINTS_DEDICATED (1U << 0)
+ 
+-- 
+2.17.0
+
diff --git a/0002-i386-Define-the-Virt-SSBD-MSR-and-handling-of-it-CVE.patch b/0002-i386-Define-the-Virt-SSBD-MSR-and-handling-of-it-CVE.patch
new file mode 100644
index 0000000..4fc3e74
--- /dev/null
+++ b/0002-i386-Define-the-Virt-SSBD-MSR-and-handling-of-it-CVE.patch
@@ -0,0 +1,148 @@
+From 70913a1bded444b1d264c3723fca2f6a7966d667 Mon Sep 17 00:00:00 2001
+From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Date: Mon, 21 May 2018 22:54:24 +0100
+Subject: [PATCH 2/3] i386: Define the Virt SSBD MSR and handling of it
+ (CVE-2018-3639)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+"Some AMD processors only support a non-architectural means of enabling
+speculative store bypass disable (SSBD).  To allow a simplified view of
+this to a guest, an architectural definition has been created through a new
+CPUID bit, 0x80000008_EBX[25], and a new MSR, 0xc001011f.  With this, a
+hypervisor can virtualize the existence of this definition and provide an
+architectural method for using SSBD to a guest.
+
+Add the new CPUID feature, the new MSR and update the existing SSBD
+support to use this MSR when present." (from x86/speculation: Add virtualized
+speculative store bypass disable support in Linux).
+
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
+Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
+Message-Id: <20180521215424.13520-4-berrange@redhat.com>
+Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
+(cherry picked from commit cfeea0c021db6234c154dbc723730e81553924ff)
+---
+ target/i386/cpu.h     |  2 ++
+ target/i386/kvm.c     | 16 ++++++++++++++--
+ target/i386/machine.c | 20 ++++++++++++++++++++
+ 3 files changed, 36 insertions(+), 2 deletions(-)
+
+diff --git a/target/i386/cpu.h b/target/i386/cpu.h
+index 970ab96e54..75e821cefe 100644
+--- a/target/i386/cpu.h
++++ b/target/i386/cpu.h
+@@ -351,6 +351,7 @@ typedef enum X86Seg {
+ #define MSR_IA32_FEATURE_CONTROL        0x0000003a
+ #define MSR_TSC_ADJUST                  0x0000003b
+ #define MSR_IA32_SPEC_CTRL              0x48
++#define MSR_VIRT_SSBD                   0xc001011f
+ #define MSR_IA32_TSCDEADLINE            0x6e0
+ 
+ #define FEATURE_CONTROL_LOCKED                    (1<<0)
+@@ -1150,6 +1151,7 @@ typedef struct CPUX86State {
+     uint32_t pkru;
+ 
+     uint64_t spec_ctrl;
++    uint64_t virt_ssbd;
+ 
+     /* End of state preserved by INIT (dummy marker).  */
+     struct {} end_init_save;
+diff --git a/target/i386/kvm.c b/target/i386/kvm.c
+index 6c49954e68..19e6aa320d 100644
+--- a/target/i386/kvm.c
++++ b/target/i386/kvm.c
+@@ -92,6 +92,7 @@ static bool has_msr_hv_stimer;
+ static bool has_msr_hv_frequencies;
+ static bool has_msr_xss;
+ static bool has_msr_spec_ctrl;
++static bool has_msr_virt_ssbd;
+ static bool has_msr_smi_count;
+ 
+ static uint32_t has_architectural_pmu_version;
+@@ -1218,6 +1219,9 @@ static int kvm_get_supported_msrs(KVMState *s)
+                 case MSR_IA32_SPEC_CTRL:
+                     has_msr_spec_ctrl = true;
+                     break;
++                case MSR_VIRT_SSBD:
++                    has_msr_virt_ssbd = true;
++                    break;
+                 }
+             }
+         }
+@@ -1706,6 +1710,10 @@ static int kvm_put_msrs(X86CPU *cpu, int level)
+     if (has_msr_spec_ctrl) {
+         kvm_msr_entry_add(cpu, MSR_IA32_SPEC_CTRL, env->spec_ctrl);
+     }
++    if (has_msr_virt_ssbd) {
++        kvm_msr_entry_add(cpu, MSR_VIRT_SSBD, env->virt_ssbd);
++    }
++
+ #ifdef TARGET_X86_64
+     if (lm_capable_kernel) {
+         kvm_msr_entry_add(cpu, MSR_CSTAR, env->cstar);
+@@ -2077,8 +2085,9 @@ static int kvm_get_msrs(X86CPU *cpu)
+     if (has_msr_spec_ctrl) {
+         kvm_msr_entry_add(cpu, MSR_IA32_SPEC_CTRL, 0);
+     }
+-
+-
++    if (has_msr_virt_ssbd) {
++        kvm_msr_entry_add(cpu, MSR_VIRT_SSBD, 0);
++    }
+     if (!env->tsc_valid) {
+         kvm_msr_entry_add(cpu, MSR_IA32_TSC, 0);
+         env->tsc_valid = !runstate_is_running();
+@@ -2444,6 +2453,9 @@ static int kvm_get_msrs(X86CPU *cpu)
+         case MSR_IA32_SPEC_CTRL:
+             env->spec_ctrl = msrs[i].data;
+             break;
++        case MSR_VIRT_SSBD:
++            env->virt_ssbd = msrs[i].data;
++            break;
+         case MSR_IA32_RTIT_CTL:
+             env->msr_rtit_ctrl = msrs[i].data;
+             break;
+diff --git a/target/i386/machine.c b/target/i386/machine.c
+index bd2d82e91b..f0a835c292 100644
+--- a/target/i386/machine.c
++++ b/target/i386/machine.c
+@@ -893,6 +893,25 @@ static const VMStateDescription vmstate_msr_intel_pt = {
+     }
+ };
+ 
++static bool virt_ssbd_needed(void *opaque)
++{
++    X86CPU *cpu = opaque;
++    CPUX86State *env = &cpu->env;
++
++    return env->virt_ssbd != 0;
++}
++
++static const VMStateDescription vmstate_msr_virt_ssbd = {
++    .name = "cpu/virt_ssbd",
++    .version_id = 1,
++    .minimum_version_id = 1,
++    .needed = virt_ssbd_needed,
++    .fields = (VMStateField[]){
++        VMSTATE_UINT64(env.virt_ssbd, X86CPU),
++        VMSTATE_END_OF_LIST()
++    }
++};
++
+ VMStateDescription vmstate_x86_cpu = {
+     .name = "cpu",
+     .version_id = 12,
+@@ -1015,6 +1034,7 @@ VMStateDescription vmstate_x86_cpu = {
+         &vmstate_spec_ctrl,
+         &vmstate_mcg_ext_ctl,
+         &vmstate_msr_intel_pt,
++        &vmstate_msr_virt_ssbd,
+         NULL
+     }
+ };
+-- 
+2.17.0
+
diff --git a/0003-i386-define-the-AMD-virt-ssbd-CPUID-feature-bit-CVE-.patch b/0003-i386-define-the-AMD-virt-ssbd-CPUID-feature-bit-CVE-.patch
new file mode 100644
index 0000000..09f7116
--- /dev/null
+++ b/0003-i386-define-the-AMD-virt-ssbd-CPUID-feature-bit-CVE-.patch
@@ -0,0 +1,41 @@
+From f956cd4aed74d55ecc03d3c33ea66b1d933cb28f Mon Sep 17 00:00:00 2001
+From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Date: Mon, 21 May 2018 22:54:23 +0100
+Subject: [PATCH 3/3] i386: define the AMD 'virt-ssbd' CPUID feature bit
+ (CVE-2018-3639)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+AMD Zen expose the Intel equivalant to Speculative Store Bypass Disable
+via the 0x80000008_EBX[25] CPUID feature bit.
+
+This needs to be exposed to guest OS to allow them to protect
+against CVE-2018-3639.
+
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
+Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
+Message-Id: <20180521215424.13520-3-berrange@redhat.com>
+Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
+(cherry picked from commit 403503b162ffc33fb64cfefdf7b880acf41772cd)
+---
+ target/i386/cpu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/target/i386/cpu.c b/target/i386/cpu.c
+index 2f5263e22f..2e305ab689 100644
+--- a/target/i386/cpu.c
++++ b/target/i386/cpu.c
+@@ -541,7 +541,7 @@ static FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
+             "ibpb", NULL, NULL, NULL,
+             NULL, NULL, NULL, NULL,
+             NULL, NULL, NULL, NULL,
+-            NULL, NULL, NULL, NULL,
++            NULL, "virt-ssbd", NULL, NULL,
+             NULL, NULL, NULL, NULL,
+         },
+         .cpuid_eax = 0x80000008,
+-- 
+2.17.0
+
diff --git a/qemu.spec b/qemu.spec
index 355eac2..73c416e 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -104,7 +104,7 @@ Requires: %{name}-ui-sdl = %{epoch}:%{version}-%{release}
 Summary: QEMU is a FAST! processor emulator
 Name: qemu
 Version: 2.12.0
-Release: 2%{?rcrel}%{?dist}
+Release: 3%{?rcrel}%{?dist}
 Epoch: 2
 License: GPLv2 and BSD and MIT and CC-BY
 URL: http://www.qemu.org/
@@ -140,6 +140,12 @@ Source22: 95-kvm-ppc64-memlock.conf
 # Fix qxl memslot_get_virt crashes (bz #1565354)
 Patch0001: 0001-qxl-fix-local-renderer-crash.patch
 
+Patch0002: 0001-i386-define-the-ssbd-CPUID-feature-bit-CVE-2018-3639.patch
+Patch0003: 0002-i386-Define-the-Virt-SSBD-MSR-and-handling-of-it-CVE.patch
+Patch0004: 0003-i386-define-the-AMD-virt-ssbd-CPUID-feature-bit-CVE-.patch
+
+
+
 # documentation deps
 BuildRequires: texinfo
 # For /usr/bin/pod2man
@@ -1666,6 +1672,9 @@ getent passwd qemu >/dev/null || \
 
 
 %changelog
+* Mon Jun 18 2018 Daniel P. Berrangé <berrange@redhat.com> - 2:2.12.0-3
+- New CPU features for speculative store bypass (CVE-2018-3639)
+
 * Tue Jun 05 2018 Cole Robinson <crobinso@redhat.com> - 2:2.12.0-2
 - Fix qxl memslot_get_virt crashes (bz #1565354)
 

From b12f5aef3a0979528e4902d368090308ef7db2ca Mon Sep 17 00:00:00 2001
From: Peter Robinson <pbrobinson@gmail.com>
Date: Fri, 13 Jul 2018 11:36:41 +0100
Subject: [PATCH 03/20] Rebuild for Xen 4.11

---
 qemu.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/qemu.spec b/qemu.spec
index 73c416e..6f576ee 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -104,7 +104,7 @@ Requires: %{name}-ui-sdl = %{epoch}:%{version}-%{release}
 Summary: QEMU is a FAST! processor emulator
 Name: qemu
 Version: 2.12.0
-Release: 3%{?rcrel}%{?dist}
+Release: 4%{?rcrel}%{?dist}
 Epoch: 2
 License: GPLv2 and BSD and MIT and CC-BY
 URL: http://www.qemu.org/
@@ -1672,6 +1672,9 @@ getent passwd qemu >/dev/null || \
 
 
 %changelog
+* Fri Jul 13 2018 Peter Robinson <pbrobinson@fedoraproject.org> 2:2.12.0-4
+- Rebuild for Xen 4.11
+
 * Mon Jun 18 2018 Daniel P. Berrangé <berrange@redhat.com> - 2:2.12.0-3
 - New CPU features for speculative store bypass (CVE-2018-3639)
 

From d4c45075335265d7f03d6f79ffd6b8d49580c435 Mon Sep 17 00:00:00 2001
From: Cole Robinson <crobinso@redhat.com>
Date: Tue, 31 Jul 2018 16:36:31 -0400
Subject: [PATCH 04/20] Rebase to qemu-3.0.0-rc3

Drop now unneeded s390x conf (bz #1609706)
---
 .gitignore        |  1 +
 50-kvm-s390x.conf |  3 ---
 qemu.spec         | 23 +++++++++--------------
 sources           |  2 +-
 4 files changed, 11 insertions(+), 18 deletions(-)
 delete mode 100644 50-kvm-s390x.conf

diff --git a/.gitignore b/.gitignore
index 793c8ea..c275aa8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -22,3 +22,4 @@
 /qemu-2.12.0-rc2.tar.xz
 /qemu-2.12.0-rc3.tar.xz
 /qemu-2.12.0.tar.xz
+/qemu-3.0.0-rc3.tar.xz
diff --git a/50-kvm-s390x.conf b/50-kvm-s390x.conf
deleted file mode 100644
index 0df7f0d..0000000
--- a/50-kvm-s390x.conf
+++ /dev/null
@@ -1,3 +0,0 @@
-# KVM S390 VM creation fails without this set
-# https://www.mail-archive.com/kvm@vger.kernel.org/msg115576.html
-vm.allocate_pgste = 1
diff --git a/qemu.spec b/qemu.spec
index 6f576ee..99e8bc8 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -94,7 +94,7 @@ Requires: %{name}-ui-sdl = %{epoch}:%{version}-%{release}
 
 
 # Release candidate version tracking
-#global rcver rc3
+%global rcver rc3
 %if 0%{?rcver:1}
 %global rcrel .%{rcver}
 %global rcstr -%{rcver}
@@ -103,8 +103,8 @@ Requires: %{name}-ui-sdl = %{epoch}:%{version}-%{release}
 
 Summary: QEMU is a FAST! processor emulator
 Name: qemu
-Version: 2.12.0
-Release: 4%{?rcrel}%{?dist}
+Version: 3.0.0
+Release: 0.1%{?rcrel}%{?dist}
 Epoch: 2
 License: GPLv2 and BSD and MIT and CC-BY
 URL: http://www.qemu.org/
@@ -132,17 +132,8 @@ Source14: qemu-pr-helper.service
 Source15: qemu-pr-helper.socket
 # /etc/modprobe.d/kvm.conf
 Source20: kvm.conf
-# /etc/sysctl.d/50-kvm-s390x.conf
-Source21: 50-kvm-s390x.conf
 # /etc/security/limits.d/95-kvm-ppc64-memlock.conf
-Source22: 95-kvm-ppc64-memlock.conf
-
-# Fix qxl memslot_get_virt crashes (bz #1565354)
-Patch0001: 0001-qxl-fix-local-renderer-crash.patch
-
-Patch0002: 0001-i386-define-the-ssbd-CPUID-feature-bit-CVE-2018-3639.patch
-Patch0003: 0002-i386-Define-the-Virt-SSBD-MSR-and-handling-of-it-CVE.patch
-Patch0004: 0003-i386-define-the-AMD-virt-ssbd-CPUID-feature-bit-CVE-.patch
+Source21: 95-kvm-ppc64-memlock.conf
 
 
 
@@ -878,9 +869,9 @@ run_configure() {
         --prefix=%{_prefix} \
         --libdir=%{_libdir} \
         --sysconfdir=%{_sysconfdir} \
-        --interp-prefix=%{_prefix}/qemu-%%M \
         --localstatedir=%{_localstatedir} \
         --libexecdir=%{_libexecdir} \
+        --interp-prefix=%{_prefix}/qemu-%%M \
         --with-pkgversion=%{name}-%{version}-%{release} \
         --disable-strip \
         --disable-werror \
@@ -1672,6 +1663,10 @@ getent passwd qemu >/dev/null || \
 
 
 %changelog
+* Tue Jul 31 2018 Cole Robinson <crobinso@redhat.com> - 2:3.0.0-0.1.rc3
+- Rebase to qemu-3.0.0-rc3
+- Drop now unneeded s390x conf (bz #1609706)
+
 * Fri Jul 13 2018 Peter Robinson <pbrobinson@fedoraproject.org> 2:2.12.0-4
 - Rebuild for Xen 4.11
 
diff --git a/sources b/sources
index 4cc5147..46ca94a 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (qemu-2.12.0.tar.xz) = dda057c52cf5fe460b029448049266ace061d21fb5f1cf71a6a37f67b3b7fc3350f6712bf22803fc38fa91f0bd438896ba01b5817b3b94ba9b6925aeaae053b7
+SHA512 (qemu-3.0.0-rc3.tar.xz) = e1483c8fd0bc5e4fb2298e5afcf60ea82934a2b4569a5e19d8ae29ebc1ae19a6d192d8d24a3c0c1af807a0da755c05c2ae0e1624a1e727891005937a81eed106

From 5bdb061bca98179b74bf76dabd7c5a8abeca203c Mon Sep 17 00:00:00 2001
From: Cole Robinson <crobinso@redhat.com>
Date: Tue, 31 Jul 2018 18:39:03 -0400
Subject: [PATCH 05/20] Fix s390x file removal

Only install modprobe kvm.conf on x86 (bz #1517989)
---
 kvm.conf => kvm-x86.modprobe.conf |  0
 qemu.spec                         | 15 +++++----------
 2 files changed, 5 insertions(+), 10 deletions(-)
 rename kvm.conf => kvm-x86.modprobe.conf (100%)

diff --git a/kvm.conf b/kvm-x86.modprobe.conf
similarity index 100%
rename from kvm.conf
rename to kvm-x86.modprobe.conf
diff --git a/qemu.spec b/qemu.spec
index 99e8bc8..053f17a 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -130,8 +130,8 @@ Source13: qemu-kvm.sh
 # PR manager service
 Source14: qemu-pr-helper.service
 Source15: qemu-pr-helper.socket
-# /etc/modprobe.d/kvm.conf
-Source20: kvm.conf
+# /etc/modprobe.d/kvm.conf, for x86
+Source20: kvm-x86.modprobe.conf
 # /etc/security/limits.d/95-kvm-ppc64-memlock.conf
 Source21: 95-kvm-ppc64-memlock.conf
 
@@ -961,8 +961,6 @@ install -D -p -m 0644 %{_sourcedir}/ksmtuned.service %{buildroot}%{_unitdir}
 install -D -p -m 0755 %{_sourcedir}/ksmtuned %{buildroot}%{_sbindir}/ksmtuned
 install -D -p -m 0644 %{_sourcedir}/ksmtuned.conf %{buildroot}%{_sysconfdir}/ksmtuned.conf
 
-install -D -p -m 0644 %{_sourcedir}/kvm.conf %{buildroot}%{_sysconfdir}/modprobe.d/kvm.conf
-
 # Install qemu-guest-agent service and udev rules
 install -m 0644 %{_sourcedir}/qemu-guest-agent.service %{buildroot}%{_unitdir}
 install -m 0644 %{_sourcedir}/qemu-ga.sysconfig %{buildroot}%{_sysconfdir}/sysconfig/qemu-ga
@@ -978,11 +976,6 @@ touch %{buildroot}%{_localstatedir}/log/qga-fsfreeze-hook.log
 install -m 0644 %{_sourcedir}/qemu-pr-helper.service %{buildroot}%{_unitdir}
 install -m 0644 %{_sourcedir}/qemu-pr-helper.socket %{buildroot}%{_unitdir}
 
-%ifarch s390x
-install -d %{buildroot}%{_sysconfdir}/sysctl.d
-install -m 0644 %{_sourcedir}/50-kvm-s390x.conf %{buildroot}%{_sysconfdir}/sysctl.d
-%endif
-
 %ifarch %{power64}
 install -d %{buildroot}%{_sysconfdir}/security/limits.d
 install -m 0644 %{_sourcedir}/95-kvm-ppc64-memlock.conf %{buildroot}%{_sysconfdir}/security/limits.d
@@ -1032,6 +1025,7 @@ done
 %if 0%{?need_qemu_kvm}
 install -m 0755 %{_sourcedir}/qemu-kvm.sh %{buildroot}%{_bindir}/qemu-kvm
 ln -sf qemu.1.gz %{buildroot}%{_mandir}/man1/qemu-kvm.1.gz
+install -D -p -m 0644 %{_sourcedir}/kvm-x86.modprobe.conf %{buildroot}%{_sysconfdir}/modprobe.d/kvm.conf
 %endif
 
 install -D -p -m 0644 qemu.sasl %{buildroot}%{_sysconfdir}/sasl2/qemu.conf
@@ -1259,7 +1253,6 @@ getent passwd qemu >/dev/null || \
 %{_unitdir}/qemu-pr-helper.socket
 %attr(4755, root, root) %{_libexecdir}/qemu-bridge-helper
 %config(noreplace) %{_sysconfdir}/sasl2/qemu.conf
-%config(noreplace) %{_sysconfdir}/modprobe.d/kvm.conf
 %dir %{_sysconfdir}/qemu
 %config(noreplace) %{_sysconfdir}/qemu/bridge.conf
 %dir %{_libdir}/qemu
@@ -1650,6 +1643,7 @@ getent passwd qemu >/dev/null || \
 %if 0%{?need_qemu_kvm}
 %{_bindir}/qemu-kvm
 %{_mandir}/man1/qemu-kvm.1*
+%config(noreplace) %{_sysconfdir}/modprobe.d/kvm.conf
 %endif
 
 
@@ -1666,6 +1660,7 @@ getent passwd qemu >/dev/null || \
 * Tue Jul 31 2018 Cole Robinson <crobinso@redhat.com> - 2:3.0.0-0.1.rc3
 - Rebase to qemu-3.0.0-rc3
 - Drop now unneeded s390x conf (bz #1609706)
+- Only install modprobe kvm.conf on x86 (bz #1517989)
 
 * Fri Jul 13 2018 Peter Robinson <pbrobinson@fedoraproject.org> 2:2.12.0-4
 - Rebuild for Xen 4.11

From e4ec8b672deba423bafc2db4e3a6c508f25e2449 Mon Sep 17 00:00:00 2001
From: Cole Robinson <crobinso@redhat.com>
Date: Wed, 1 Aug 2018 05:54:39 -0400
Subject: [PATCH 06/20] Another attempt to remove 50-kvm-sysctl

---
 qemu.spec | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/qemu.spec b/qemu.spec
index 053f17a..b8142f9 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -1148,15 +1148,6 @@ qemu-sanity-check --qemu=%{?hostqemu} ||:
 popd
 
 
-%if %{have_kvm}
-%post %{kvm_package}
-
-%ifarch s390x
-%sysctl_apply 50-kvm-s390x.conf
-%endif
-%endif
-
-
 %post common
 getent group kvm >/dev/null || groupadd -g 36 -r kvm
 getent group qemu >/dev/null || groupadd -g 107 -r qemu
@@ -1586,9 +1577,6 @@ getent passwd qemu >/dev/null || \
 %{_mandir}/man1/qemu-system-s390x.1*
 %{_datadir}/%{name}/s390-ccw.img
 %{_datadir}/%{name}/s390-netboot.img
-%ifarch s390x
-%{_sysconfdir}/sysctl.d/50-kvm-s390x.conf
-%endif
 
 
 %files system-sh4

From 13b2fd93a9dbe228438301c5497a1c95a6de8c4a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Wed, 1 Aug 2018 14:29:02 +0100
Subject: [PATCH 07/20] Add missing requires on ssh block module accidentally
 lost
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The rebase to 2.12 accidentally lost the %{name}-block-ssh
module dep.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 qemu.spec | 1 +
 1 file changed, 1 insertion(+)

diff --git a/qemu.spec b/qemu.spec
index b8142f9..311f16a 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -84,6 +84,7 @@ Requires: %{name}-block-gluster = %{epoch}:%{version}-%{release} \
 Requires: %{name}-block-iscsi = %{epoch}:%{version}-%{release}   \
 Requires: %{name}-block-nfs = %{epoch}:%{version}-%{release}     \
 Requires: %{name}-block-rbd = %{epoch}:%{version}-%{release}     \
+Requires: %{name}-block-ssh = %{epoch}:%{version}-%{release}     \
 Requires: %{name}-audio-alsa = %{epoch}:%{version}-%{release}    \
 Requires: %{name}-audio-oss = %{epoch}:%{version}-%{release}     \
 Requires: %{name}-audio-pa = %{epoch}:%{version}-%{release}      \

From c90305980d0bd416d9882b5ea43ea389bb109e00 Mon Sep 17 00:00:00 2001
From: Cole Robinson <crobinso@redhat.com>
Date: Mon, 13 Aug 2018 17:06:42 -0400
Subject: [PATCH 08/20] Drop ksm package, moved to ksmtuned srpm

---
 ksm.service      |  14 -----
 ksm.sysconfig    |   4 --
 ksmctl.c         |  77 --------------------------
 ksmtuned         | 139 -----------------------------------------------
 ksmtuned.conf    |  21 -------
 ksmtuned.service |  13 -----
 qemu.spec        |  48 ----------------
 7 files changed, 316 deletions(-)
 delete mode 100644 ksm.service
 delete mode 100644 ksm.sysconfig
 delete mode 100644 ksmctl.c
 delete mode 100644 ksmtuned
 delete mode 100644 ksmtuned.conf
 delete mode 100644 ksmtuned.service

diff --git a/ksm.service b/ksm.service
deleted file mode 100644
index 42d67d9..0000000
--- a/ksm.service
+++ /dev/null
@@ -1,14 +0,0 @@
-[Unit]
-Description=Kernel Samepage Merging
-ConditionPathExists=/sys/kernel/mm/ksm
-ConditionVirtualization=no
-
-[Service]
-Type=oneshot
-RemainAfterExit=yes
-EnvironmentFile=-/etc/sysconfig/ksm
-ExecStart=/usr/libexec/ksmctl start
-ExecStop=/usr/libexec/ksmctl stop
-
-[Install]
-WantedBy=multi-user.target
diff --git a/ksm.sysconfig b/ksm.sysconfig
deleted file mode 100644
index d99656d..0000000
--- a/ksm.sysconfig
+++ /dev/null
@@ -1,4 +0,0 @@
-# The maximum number of unswappable kernel pages
-# which may be allocated by ksm (0 for unlimited)
-# If unset, defaults to half of total memory
-# KSM_MAX_KERNEL_PAGES=
diff --git a/ksmctl.c b/ksmctl.c
deleted file mode 100644
index af39591..0000000
--- a/ksmctl.c
+++ /dev/null
@@ -1,77 +0,0 @@
-/* Start/stop KSM, for systemd.
- * Copyright (C) 2009, 2011 Red Hat, Inc.
- * Written by Paolo Bonzini <pbonzini@redhat.com>.
- * Based on the original sysvinit script by Dan Kenigsberg <danken@redhat.com>
- * This file is distributed under the GNU General Public License, version 2
- * or later.  */
-
-#include <unistd.h>
-#include <stdio.h>
-#include <limits.h>
-#include <stdint.h>
-#include <stdlib.h>
-#include <string.h>
-
-#define KSM_MAX_KERNEL_PAGES_FILE "/sys/kernel/mm/ksm/max_kernel_pages"
-#define KSM_RUN_FILE		  "/sys/kernel/mm/ksm/run"
-
-char *program_name;
-
-int usage(void)
-{
-	fprintf(stderr, "Usage: %s {start|stop}\n", program_name);
-	return 1;
-}
-
-int write_value(uint64_t value, char *filename)
-{
-	FILE *fp;
-	if (!(fp = fopen(filename, "w")) ||
-	    fprintf(fp, "%llu\n", (unsigned long long) value) == EOF ||
-	    fflush(fp) == EOF ||
-	    fclose(fp) == EOF)
-		return 1;
-
-	return 0;
-}
-
-uint64_t ksm_max_kernel_pages()
-{
-	char *var = getenv("KSM_MAX_KERNEL_PAGES");
-	char *endptr;
-	uint64_t value;
-	if (var && *var) {
-		value = strtoll(var, &endptr, 0);
-		if (value < LLONG_MAX && !*endptr)
-			return value;
-	}
-	/* Unless KSM_MAX_KERNEL_PAGES is set, let KSM munch up to half of
-	 * total memory.  */
-	return sysconf(_SC_PHYS_PAGES) / 2;
-}
-
-int start(void)
-{
-	if (access(KSM_MAX_KERNEL_PAGES_FILE, R_OK) >= 0)
-		write_value(ksm_max_kernel_pages(), KSM_MAX_KERNEL_PAGES_FILE);
-	return write_value(1, KSM_RUN_FILE);
-}
-
-int stop(void)
-{
-	return write_value(0, KSM_RUN_FILE);
-}
-
-int main(int argc, char **argv)
-{
-	program_name = argv[0];
-	if (argc < 2) {
-		return usage();
-	} else if (!strcmp(argv[1], "start")) {
-		return start();
-	} else if (!strcmp(argv[1], "stop")) {
-		return stop();
-	} else {
-		return usage();
-	}
-}
diff --git a/ksmtuned b/ksmtuned
deleted file mode 100644
index 7bc5743..0000000
--- a/ksmtuned
+++ /dev/null
@@ -1,139 +0,0 @@
-#!/bin/bash
-#
-# Copyright 2009 Red Hat, Inc. and/or its affiliates.
-# Released under the GPL
-#
-# Author:      Dan Kenigsberg <danken@redhat.com>
-#
-# ksmtuned - a simple script that controls whether (and with what vigor) ksm
-# should search for duplicated pages.
-#
-# starts ksm when memory commited to qemu processes exceeds a threshold, and
-# make ksm work harder and harder untill memory load falls below that
-# threshold.
-#
-# send SIGUSR1 to this process right after a new qemu process is started, or
-# following its death, to retune ksm accordingly
-#
-# needs testing and ironing. contact danken@redhat.com if something breaks.
-
-if [ -f /etc/ksmtuned.conf ]; then
-    . /etc/ksmtuned.conf
-fi
-
-debug() {
-    if [ -n "$DEBUG" ]; then
-        s="`/bin/date`: $*"
-        [ -n "$LOGFILE" ] && echo "$s" >> "$LOGFILE" || echo "$s"
-    fi
-}
-
-
-KSM_MONITOR_INTERVAL=${KSM_MONITOR_INTERVAL:-60}
-KSM_NPAGES_BOOST=${KSM_NPAGES_BOOST:-300}
-KSM_NPAGES_DECAY=${KSM_NPAGES_DECAY:--50}
-
-KSM_NPAGES_MIN=${KSM_NPAGES_MIN:-64}
-KSM_NPAGES_MAX=${KSM_NPAGES_MAX:-1250}
-# millisecond sleep between ksm scans for 16Gb server. Smaller servers sleep
-# more, bigger sleep less.
-KSM_SLEEP_MSEC=${KSM_SLEEP_MSEC:-10}
-
-KSM_THRES_COEF=${KSM_THRES_COEF:-20}
-KSM_THRES_CONST=${KSM_THRES_CONST:-2048}
-
-total=`awk '/^MemTotal:/ {print $2}' /proc/meminfo`
-debug total $total
-
-npages=0
-sleep=$[KSM_SLEEP_MSEC * 16 * 1024 * 1024 / total]
-[ $sleep -le 10 ] && sleep=10
-debug sleep $sleep
-thres=$[total * KSM_THRES_COEF / 100]
-if [ $KSM_THRES_CONST -gt $thres ]; then
-    thres=$KSM_THRES_CONST
-fi
-debug thres $thres
-
-KSMCTL () {
-    case x$1 in
-        xstop)
-            echo 0 > /sys/kernel/mm/ksm/run
-            ;;
-        xstart)
-            echo $2 > /sys/kernel/mm/ksm/pages_to_scan
-            echo $3 > /sys/kernel/mm/ksm/sleep_millisecs
-            echo 1 > /sys/kernel/mm/ksm/run
-            ;;
-    esac
-}
-
-committed_memory () {
-    # calculate how much memory is committed to running qemu processes
-    local pidlist
-    pidlist=$(pgrep -d ' ' -- '^qemu(-(kvm|system-.+)|:.{1,11})$')
-    if [ -n "$pidlist" ]; then
-        ps -p "$pidlist" -o rsz=
-    fi | awk '{ sum += $1 }; END { print 0+sum }'
-}
-
-free_memory () {
-    awk '/^(MemFree|Buffers|Cached):/ {free += $2}; END {print free}' \
-                /proc/meminfo
-}
-
-increase_npages() {
-    local delta
-    delta=${1:-0}
-    npages=$[npages + delta]
-    if [ $npages -lt $KSM_NPAGES_MIN ]; then
-        npages=$KSM_NPAGES_MIN
-    elif [ $npages -gt $KSM_NPAGES_MAX ]; then
-        npages=$KSM_NPAGES_MAX
-    fi
-    echo $npages
-}
-
-
-adjust () {
-    local free committed
-    free=`free_memory`
-    committed=`committed_memory`
-    debug committed $committed free $free
-    if [ $[committed + thres] -lt $total -a $free -gt $thres ]; then
-        KSMCTL stop
-        debug "$[committed + thres] < $total and free > $thres, stop ksm"
-        return 1
-    fi
-    debug "$[committed + thres] > $total, start ksm"
-    if [ $free -lt $thres ]; then
-        npages=`increase_npages $KSM_NPAGES_BOOST`
-        debug "$free < $thres, boost"
-    else
-        npages=`increase_npages $KSM_NPAGES_DECAY`
-        debug "$free > $thres, decay"
-    fi
-    KSMCTL start $npages $sleep
-    debug "KSMCTL start $npages $sleep"
-    return 0
-}
-
-function nothing () {
-    :
-}
-
-loop () {
-    trap nothing SIGUSR1
-    while true
-    do
-        sleep $KSM_MONITOR_INTERVAL &
-        wait $!
-        adjust
-    done
-}
-
-PIDFILE=${PIDFILE-/var/run/ksmtune.pid}
-if touch "$PIDFILE"; then
-  loop &
-  echo $! > "$PIDFILE"
-fi
diff --git a/ksmtuned.conf b/ksmtuned.conf
deleted file mode 100644
index fc4518c..0000000
--- a/ksmtuned.conf
+++ /dev/null
@@ -1,21 +0,0 @@
-# Configuration file for ksmtuned.
-
-# How long ksmtuned should sleep between tuning adjustments
-# KSM_MONITOR_INTERVAL=60
-
-# Millisecond sleep between ksm scans for 16Gb server.
-# Smaller servers sleep more, bigger sleep less.
-# KSM_SLEEP_MSEC=10
-
-# KSM_NPAGES_BOOST=300
-# KSM_NPAGES_DECAY=-50
-# KSM_NPAGES_MIN=64
-# KSM_NPAGES_MAX=1250
-
-# KSM_THRES_COEF=20
-# KSM_THRES_CONST=2048
-
-# uncomment the following if you want ksmtuned debug info
-
-# LOGFILE=/var/log/ksmtuned
-# DEBUG=1
diff --git a/ksmtuned.service b/ksmtuned.service
deleted file mode 100644
index 09dffa1..0000000
--- a/ksmtuned.service
+++ /dev/null
@@ -1,13 +0,0 @@
-[Unit]
-Description=Kernel Samepage Merging (KSM) Tuning Daemon
-After=ksm.service
-Requires=ksm.service
-ConditionVirtualization=no
-
-[Service]
-ExecStart=/usr/sbin/ksmtuned
-ExecReload=/bin/kill -USR1 $MAINPID
-Type=forking
-
-[Install]
-WantedBy=multi-user.target
diff --git a/qemu.spec b/qemu.spec
index 311f16a..fd40e56 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -112,13 +112,6 @@ URL: http://www.qemu.org/
 
 Source0: http://wiki.qemu-project.org/download/%{name}-%{version}%{?rcstr}.tar.xz
 
-# KSM control scripts
-Source4: ksm.service
-Source5: ksm.sysconfig
-Source6: ksmctl.c
-Source7: ksmtuned.service
-Source8: ksmtuned
-Source9: ksmtuned.conf
 # guest agent service
 Source10: qemu-guest-agent.service
 Source17: qemu-ga.sysconfig
@@ -316,17 +309,6 @@ Requires(postun): systemd-units
 This package provides the common files needed by all QEMU targets
 
 
-%package -n ksm
-Summary: Kernel Samepage Merging services
-Requires(post): systemd-units
-Requires(postun): systemd-units
-%description -n ksm
-Kernel Samepage Merging (KSM) is a memory-saving de-duplication feature,
-that merges anonymous (private) pages (not pagecache ones).
-
-This package provides service files for disabling and tuning KSM.
-
-
 %package guest-agent
 Summary: QEMU guest agent
 Requires(post): systemd-units
@@ -942,8 +924,6 @@ make V=1 %{?_smp_mflags} $buildldflags
 popd
 %endif
 
-gcc %{_sourcedir}/ksmctl.c $RPM_OPT_FLAGS $RPM_LD_FLAGS -o ksmctl
-
 
 %install
 
@@ -954,14 +934,6 @@ mkdir -p %{buildroot}%{_udevdir}
 mkdir -p %{buildroot}%{_unitdir}
 mkdir -p %{buildroot}%{_sysconfdir}/qemu
 
-install -D -p -m 0644 %{_sourcedir}/ksm.service %{buildroot}%{_unitdir}
-install -D -p -m 0644 %{_sourcedir}/ksm.sysconfig %{buildroot}%{_sysconfdir}/sysconfig/ksm
-install -D -p -m 0755 ksmctl %{buildroot}%{_libexecdir}/ksmctl
-
-install -D -p -m 0644 %{_sourcedir}/ksmtuned.service %{buildroot}%{_unitdir}
-install -D -p -m 0755 %{_sourcedir}/ksmtuned %{buildroot}%{_sbindir}/ksmtuned
-install -D -p -m 0644 %{_sourcedir}/ksmtuned.conf %{buildroot}%{_sysconfdir}/ksmtuned.conf
-
 # Install qemu-guest-agent service and udev rules
 install -m 0644 %{_sourcedir}/qemu-guest-agent.service %{buildroot}%{_unitdir}
 install -m 0644 %{_sourcedir}/qemu-ga.sysconfig %{buildroot}%{_sysconfdir}/sysconfig/qemu-ga
@@ -1157,17 +1129,6 @@ getent passwd qemu >/dev/null || \
     -c "qemu user" qemu
 
 
-%post -n ksm
-%systemd_post ksm.service
-%systemd_post ksmtuned.service
-%preun -n ksm
-%systemd_preun ksm.service
-%systemd_preun ksmtuned.service
-%postun -n ksm
-%systemd_postun_with_restart ksm.service
-%systemd_postun_with_restart ksmtuned.service
-
-
 %post user-binfmt
 /bin/systemctl --system try-restart systemd-binfmt.service &>/dev/null || :
 %postun user-binfmt
@@ -1250,15 +1211,6 @@ getent passwd qemu >/dev/null || \
 %dir %{_libdir}/qemu
 
 
-%files -n ksm
-%{_libexecdir}/ksmctl
-%{_sbindir}/ksmtuned
-%{_unitdir}/ksmtuned.service
-%{_unitdir}/ksm.service
-%config(noreplace) %{_sysconfdir}/ksmtuned.conf
-%config(noreplace) %{_sysconfdir}/sysconfig/ksm
-
-
 %files guest-agent
 %{_bindir}/qemu-ga
 %{_mandir}/man8/qemu-ga.8*

From 748bb2f566d1efe19cd35393a923b1d37e462e69 Mon Sep 17 00:00:00 2001
From: Cole Robinson <crobinso@redhat.com>
Date: Mon, 13 Aug 2018 17:07:28 -0400
Subject: [PATCH 09/20] Drop ksm package, moved to ksmtuned srpm

---
 qemu.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/qemu.spec b/qemu.spec
index fd40e56..9554c85 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -105,7 +105,7 @@ Requires: %{name}-ui-sdl = %{epoch}:%{version}-%{release}
 Summary: QEMU is a FAST! processor emulator
 Name: qemu
 Version: 3.0.0
-Release: 0.1%{?rcrel}%{?dist}
+Release: 0.2%{?rcrel}%{?dist}
 Epoch: 2
 License: GPLv2 and BSD and MIT and CC-BY
 URL: http://www.qemu.org/
@@ -1598,6 +1598,9 @@ getent passwd qemu >/dev/null || \
 
 
 %changelog
+* Mon Aug 13 2018 Cole Robinson <crobinso@redhat.com> - 2:3.0.0-0.2.rc3
+- Drop ksm package, moved to ksmtuned srpm
+
 * Tue Jul 31 2018 Cole Robinson <crobinso@redhat.com> - 2:3.0.0-0.1.rc3
 - Rebase to qemu-3.0.0-rc3
 - Drop now unneeded s390x conf (bz #1609706)

From 91efacc5720c5d0bbe4b1ac41ad253d1d9a59ff5 Mon Sep 17 00:00:00 2001
From: Cole Robinson <crobinso@redhat.com>
Date: Mon, 13 Aug 2018 18:31:29 -0400
Subject: [PATCH 10/20] Fix build after ksm removal

---
 qemu.spec | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/qemu.spec b/qemu.spec
index 9554c85..e43f354 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -935,8 +935,8 @@ mkdir -p %{buildroot}%{_unitdir}
 mkdir -p %{buildroot}%{_sysconfdir}/qemu
 
 # Install qemu-guest-agent service and udev rules
-install -m 0644 %{_sourcedir}/qemu-guest-agent.service %{buildroot}%{_unitdir}
-install -m 0644 %{_sourcedir}/qemu-ga.sysconfig %{buildroot}%{_sysconfdir}/sysconfig/qemu-ga
+install -p -m 0644 %{_sourcedir}/qemu-guest-agent.service %{buildroot}%{_unitdir}
+install -D -p -m 0644 %{_sourcedir}/qemu-ga.sysconfig %{buildroot}%{_sysconfdir}/sysconfig/qemu-ga
 install -m 0644 %{_sourcedir}/99-qemu-guest-agent.rules %{buildroot}%{_udevdir}
 
 mkdir -p %{buildroot}%{_sysconfdir}/qemu-ga/fsfreeze-hook.d

From a6f68877d004483062fb64b4e17f9f170d964ea3 Mon Sep 17 00:00:00 2001
From: Cole Robinson <crobinso@redhat.com>
Date: Wed, 15 Aug 2018 10:19:27 -0400
Subject: [PATCH 11/20] Rebase to qemu-3.0.0 GA

---
 .gitignore | 1 +
 qemu.spec  | 7 +++++--
 sources    | 2 +-
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/.gitignore b/.gitignore
index c275aa8..e46378c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -23,3 +23,4 @@
 /qemu-2.12.0-rc3.tar.xz
 /qemu-2.12.0.tar.xz
 /qemu-3.0.0-rc3.tar.xz
+/qemu-3.0.0.tar.xz
diff --git a/qemu.spec b/qemu.spec
index e43f354..57b6a87 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -95,7 +95,7 @@ Requires: %{name}-ui-sdl = %{epoch}:%{version}-%{release}
 
 
 # Release candidate version tracking
-%global rcver rc3
+#global rcver rc3
 %if 0%{?rcver:1}
 %global rcrel .%{rcver}
 %global rcstr -%{rcver}
@@ -105,7 +105,7 @@ Requires: %{name}-ui-sdl = %{epoch}:%{version}-%{release}
 Summary: QEMU is a FAST! processor emulator
 Name: qemu
 Version: 3.0.0
-Release: 0.2%{?rcrel}%{?dist}
+Release: 1%{?rcrel}%{?dist}
 Epoch: 2
 License: GPLv2 and BSD and MIT and CC-BY
 URL: http://www.qemu.org/
@@ -1598,6 +1598,9 @@ getent passwd qemu >/dev/null || \
 
 
 %changelog
+* Wed Aug 15 2018 Cole Robinson <crobinso@redhat.com> - 2:3.0.0-1
+- Rebase to qemu-3.0.0 GA
+
 * Mon Aug 13 2018 Cole Robinson <crobinso@redhat.com> - 2:3.0.0-0.2.rc3
 - Drop ksm package, moved to ksmtuned srpm
 
diff --git a/sources b/sources
index 46ca94a..c7b3cb2 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (qemu-3.0.0-rc3.tar.xz) = e1483c8fd0bc5e4fb2298e5afcf60ea82934a2b4569a5e19d8ae29ebc1ae19a6d192d8d24a3c0c1af807a0da755c05c2ae0e1624a1e727891005937a81eed106
+SHA512 (qemu-3.0.0.tar.xz) = a764302f50b9aca4134bbbc1f361b98e71240cdc7b25600dfe733bf4cf17bd86000bd28357697b08f3b656899dceb9e459350b8d55557817444ed5d7fa380a5a

From e4323bc8b2aacf3134d3689652e57da1d971d952 Mon Sep 17 00:00:00 2001
From: Cole Robinson <crobinso@redhat.com>
Date: Wed, 3 Oct 2018 11:13:53 -0400
Subject: [PATCH 12/20] Remove unused patches

---
 ...ssbd-CPUID-feature-bit-CVE-2018-3639.patch |  51 ------
 0001-qxl-fix-local-renderer-crash.patch       |  43 -----
 ...Virt-SSBD-MSR-and-handling-of-it-CVE.patch | 148 ------------------
 ...AMD-virt-ssbd-CPUID-feature-bit-CVE-.patch |  41 -----
 4 files changed, 283 deletions(-)
 delete mode 100644 0001-i386-define-the-ssbd-CPUID-feature-bit-CVE-2018-3639.patch
 delete mode 100644 0001-qxl-fix-local-renderer-crash.patch
 delete mode 100644 0002-i386-Define-the-Virt-SSBD-MSR-and-handling-of-it-CVE.patch
 delete mode 100644 0003-i386-define-the-AMD-virt-ssbd-CPUID-feature-bit-CVE-.patch

diff --git a/0001-i386-define-the-ssbd-CPUID-feature-bit-CVE-2018-3639.patch b/0001-i386-define-the-ssbd-CPUID-feature-bit-CVE-2018-3639.patch
deleted file mode 100644
index 00cad34..0000000
--- a/0001-i386-define-the-ssbd-CPUID-feature-bit-CVE-2018-3639.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From 7920d78dc80e7206e07f2a35f942e9f33174d251 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Mon, 21 May 2018 22:54:22 +0100
-Subject: [PATCH 1/3] i386: define the 'ssbd' CPUID feature bit (CVE-2018-3639)
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-New microcode introduces the "Speculative Store Bypass Disable"
-CPUID feature bit. This needs to be exposed to guest OS to allow
-them to protect against CVE-2018-3639.
-
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
-Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
-Message-Id: <20180521215424.13520-2-berrange@redhat.com>
-Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
-(cherry picked from commit d19d1f965904a533998739698020ff4ee8a103da)
----
- target/i386/cpu.c | 2 +-
- target/i386/cpu.h | 1 +
- 2 files changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index a20fe26573..2f5263e22f 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -510,7 +510,7 @@ static FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
-             NULL, NULL, NULL, NULL,
-             NULL, NULL, NULL, NULL,
-             NULL, NULL, "spec-ctrl", NULL,
--            NULL, NULL, NULL, NULL,
-+            NULL, NULL, NULL, "ssbd",
-         },
-         .cpuid_eax = 7,
-         .cpuid_needs_ecx = true, .cpuid_ecx = 0,
-diff --git a/target/i386/cpu.h b/target/i386/cpu.h
-index 1b219fafc4..970ab96e54 100644
---- a/target/i386/cpu.h
-+++ b/target/i386/cpu.h
-@@ -684,6 +684,7 @@ typedef uint32_t FeatureWordArray[FEATURE_WORDS];
- #define CPUID_7_0_EDX_AVX512_4VNNIW (1U << 2) /* AVX512 Neural Network Instructions */
- #define CPUID_7_0_EDX_AVX512_4FMAPS (1U << 3) /* AVX512 Multiply Accumulation Single Precision */
- #define CPUID_7_0_EDX_SPEC_CTRL     (1U << 26) /* Speculation Control */
-+#define CPUID_7_0_EDX_SPEC_CTRL_SSBD  (1U << 31) /* Speculative Store Bypass Disable */
- 
- #define KVM_HINTS_DEDICATED (1U << 0)
- 
--- 
-2.17.0
-
diff --git a/0001-qxl-fix-local-renderer-crash.patch b/0001-qxl-fix-local-renderer-crash.patch
deleted file mode 100644
index a839d38..0000000
--- a/0001-qxl-fix-local-renderer-crash.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From 5bd5c27c7d284d01477c5cc022ce22438c46bf9f Mon Sep 17 00:00:00 2001
-Message-Id: <5bd5c27c7d284d01477c5cc022ce22438c46bf9f.1528219523.git.crobinso@redhat.com>
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Fri, 27 Apr 2018 13:55:28 +0200
-Subject: [PATCH] qxl: fix local renderer crash
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Make sure we only ask the spice local renderer for display updates in
-case we have a valid primary surface.  Without that spice is confused
-and throws errors in case a display update request (triggered by
-screendump for example) happens in parallel to a mode switch and hits
-the race window where the old primary surface is gone and the new isn't
-establisted yet.
-
-Cc: qemu-stable@nongnu.org
-Fixes: https://bugzilla.redhat.com//show_bug.cgi?id=1567733
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
-Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
-Message-id: 20180427115528.345-1-kraxel@redhat.com
-Signed-off-by: Cole Robinson <crobinso@redhat.com>
----
- hw/display/qxl-render.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/hw/display/qxl-render.c b/hw/display/qxl-render.c
-index e7ac4f8789..c62b9a5e75 100644
---- a/hw/display/qxl-render.c
-+++ b/hw/display/qxl-render.c
-@@ -169,7 +169,8 @@ void qxl_render_update(PCIQXLDevice *qxl)
- 
-     qemu_mutex_lock(&qxl->ssd.lock);
- 
--    if (!runstate_is_running() || !qxl->guest_primary.commands) {
-+    if (!runstate_is_running() || !qxl->guest_primary.commands ||
-+        qxl->mode == QXL_MODE_UNDEFINED) {
-         qxl_render_update_area_unlocked(qxl);
-         qemu_mutex_unlock(&qxl->ssd.lock);
-         return;
--- 
-2.17.1
-
diff --git a/0002-i386-Define-the-Virt-SSBD-MSR-and-handling-of-it-CVE.patch b/0002-i386-Define-the-Virt-SSBD-MSR-and-handling-of-it-CVE.patch
deleted file mode 100644
index 4fc3e74..0000000
--- a/0002-i386-Define-the-Virt-SSBD-MSR-and-handling-of-it-CVE.patch
+++ /dev/null
@@ -1,148 +0,0 @@
-From 70913a1bded444b1d264c3723fca2f6a7966d667 Mon Sep 17 00:00:00 2001
-From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
-Date: Mon, 21 May 2018 22:54:24 +0100
-Subject: [PATCH 2/3] i386: Define the Virt SSBD MSR and handling of it
- (CVE-2018-3639)
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-"Some AMD processors only support a non-architectural means of enabling
-speculative store bypass disable (SSBD).  To allow a simplified view of
-this to a guest, an architectural definition has been created through a new
-CPUID bit, 0x80000008_EBX[25], and a new MSR, 0xc001011f.  With this, a
-hypervisor can virtualize the existence of this definition and provide an
-architectural method for using SSBD to a guest.
-
-Add the new CPUID feature, the new MSR and update the existing SSBD
-support to use this MSR when present." (from x86/speculation: Add virtualized
-speculative store bypass disable support in Linux).
-
-Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-Message-Id: <20180521215424.13520-4-berrange@redhat.com>
-Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
-(cherry picked from commit cfeea0c021db6234c154dbc723730e81553924ff)
----
- target/i386/cpu.h     |  2 ++
- target/i386/kvm.c     | 16 ++++++++++++++--
- target/i386/machine.c | 20 ++++++++++++++++++++
- 3 files changed, 36 insertions(+), 2 deletions(-)
-
-diff --git a/target/i386/cpu.h b/target/i386/cpu.h
-index 970ab96e54..75e821cefe 100644
---- a/target/i386/cpu.h
-+++ b/target/i386/cpu.h
-@@ -351,6 +351,7 @@ typedef enum X86Seg {
- #define MSR_IA32_FEATURE_CONTROL        0x0000003a
- #define MSR_TSC_ADJUST                  0x0000003b
- #define MSR_IA32_SPEC_CTRL              0x48
-+#define MSR_VIRT_SSBD                   0xc001011f
- #define MSR_IA32_TSCDEADLINE            0x6e0
- 
- #define FEATURE_CONTROL_LOCKED                    (1<<0)
-@@ -1150,6 +1151,7 @@ typedef struct CPUX86State {
-     uint32_t pkru;
- 
-     uint64_t spec_ctrl;
-+    uint64_t virt_ssbd;
- 
-     /* End of state preserved by INIT (dummy marker).  */
-     struct {} end_init_save;
-diff --git a/target/i386/kvm.c b/target/i386/kvm.c
-index 6c49954e68..19e6aa320d 100644
---- a/target/i386/kvm.c
-+++ b/target/i386/kvm.c
-@@ -92,6 +92,7 @@ static bool has_msr_hv_stimer;
- static bool has_msr_hv_frequencies;
- static bool has_msr_xss;
- static bool has_msr_spec_ctrl;
-+static bool has_msr_virt_ssbd;
- static bool has_msr_smi_count;
- 
- static uint32_t has_architectural_pmu_version;
-@@ -1218,6 +1219,9 @@ static int kvm_get_supported_msrs(KVMState *s)
-                 case MSR_IA32_SPEC_CTRL:
-                     has_msr_spec_ctrl = true;
-                     break;
-+                case MSR_VIRT_SSBD:
-+                    has_msr_virt_ssbd = true;
-+                    break;
-                 }
-             }
-         }
-@@ -1706,6 +1710,10 @@ static int kvm_put_msrs(X86CPU *cpu, int level)
-     if (has_msr_spec_ctrl) {
-         kvm_msr_entry_add(cpu, MSR_IA32_SPEC_CTRL, env->spec_ctrl);
-     }
-+    if (has_msr_virt_ssbd) {
-+        kvm_msr_entry_add(cpu, MSR_VIRT_SSBD, env->virt_ssbd);
-+    }
-+
- #ifdef TARGET_X86_64
-     if (lm_capable_kernel) {
-         kvm_msr_entry_add(cpu, MSR_CSTAR, env->cstar);
-@@ -2077,8 +2085,9 @@ static int kvm_get_msrs(X86CPU *cpu)
-     if (has_msr_spec_ctrl) {
-         kvm_msr_entry_add(cpu, MSR_IA32_SPEC_CTRL, 0);
-     }
--
--
-+    if (has_msr_virt_ssbd) {
-+        kvm_msr_entry_add(cpu, MSR_VIRT_SSBD, 0);
-+    }
-     if (!env->tsc_valid) {
-         kvm_msr_entry_add(cpu, MSR_IA32_TSC, 0);
-         env->tsc_valid = !runstate_is_running();
-@@ -2444,6 +2453,9 @@ static int kvm_get_msrs(X86CPU *cpu)
-         case MSR_IA32_SPEC_CTRL:
-             env->spec_ctrl = msrs[i].data;
-             break;
-+        case MSR_VIRT_SSBD:
-+            env->virt_ssbd = msrs[i].data;
-+            break;
-         case MSR_IA32_RTIT_CTL:
-             env->msr_rtit_ctrl = msrs[i].data;
-             break;
-diff --git a/target/i386/machine.c b/target/i386/machine.c
-index bd2d82e91b..f0a835c292 100644
---- a/target/i386/machine.c
-+++ b/target/i386/machine.c
-@@ -893,6 +893,25 @@ static const VMStateDescription vmstate_msr_intel_pt = {
-     }
- };
- 
-+static bool virt_ssbd_needed(void *opaque)
-+{
-+    X86CPU *cpu = opaque;
-+    CPUX86State *env = &cpu->env;
-+
-+    return env->virt_ssbd != 0;
-+}
-+
-+static const VMStateDescription vmstate_msr_virt_ssbd = {
-+    .name = "cpu/virt_ssbd",
-+    .version_id = 1,
-+    .minimum_version_id = 1,
-+    .needed = virt_ssbd_needed,
-+    .fields = (VMStateField[]){
-+        VMSTATE_UINT64(env.virt_ssbd, X86CPU),
-+        VMSTATE_END_OF_LIST()
-+    }
-+};
-+
- VMStateDescription vmstate_x86_cpu = {
-     .name = "cpu",
-     .version_id = 12,
-@@ -1015,6 +1034,7 @@ VMStateDescription vmstate_x86_cpu = {
-         &vmstate_spec_ctrl,
-         &vmstate_mcg_ext_ctl,
-         &vmstate_msr_intel_pt,
-+        &vmstate_msr_virt_ssbd,
-         NULL
-     }
- };
--- 
-2.17.0
-
diff --git a/0003-i386-define-the-AMD-virt-ssbd-CPUID-feature-bit-CVE-.patch b/0003-i386-define-the-AMD-virt-ssbd-CPUID-feature-bit-CVE-.patch
deleted file mode 100644
index 09f7116..0000000
--- a/0003-i386-define-the-AMD-virt-ssbd-CPUID-feature-bit-CVE-.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From f956cd4aed74d55ecc03d3c33ea66b1d933cb28f Mon Sep 17 00:00:00 2001
-From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
-Date: Mon, 21 May 2018 22:54:23 +0100
-Subject: [PATCH 3/3] i386: define the AMD 'virt-ssbd' CPUID feature bit
- (CVE-2018-3639)
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-AMD Zen expose the Intel equivalant to Speculative Store Bypass Disable
-via the 0x80000008_EBX[25] CPUID feature bit.
-
-This needs to be exposed to guest OS to allow them to protect
-against CVE-2018-3639.
-
-Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-Message-Id: <20180521215424.13520-3-berrange@redhat.com>
-Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
-(cherry picked from commit 403503b162ffc33fb64cfefdf7b880acf41772cd)
----
- target/i386/cpu.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/target/i386/cpu.c b/target/i386/cpu.c
-index 2f5263e22f..2e305ab689 100644
---- a/target/i386/cpu.c
-+++ b/target/i386/cpu.c
-@@ -541,7 +541,7 @@ static FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
-             "ibpb", NULL, NULL, NULL,
-             NULL, NULL, NULL, NULL,
-             NULL, NULL, NULL, NULL,
--            NULL, NULL, NULL, NULL,
-+            NULL, "virt-ssbd", NULL, NULL,
-             NULL, NULL, NULL, NULL,
-         },
-         .cpuid_eax = 0x80000008,
--- 
-2.17.0
-

From 007776f3e41111f448bd5937aecf0a92e3f150b3 Mon Sep 17 00:00:00 2001
From: Cole Robinson <crobinso@redhat.com>
Date: Thu, 15 Nov 2018 19:50:28 -0500
Subject: [PATCH 13/20] Rebase to qemu-3.1.0-rc1

---
 .gitignore |  1 +
 qemu.spec  | 22 +++++++++++++++-------
 sources    |  2 +-
 3 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/.gitignore b/.gitignore
index e46378c..a334f10 100644
--- a/.gitignore
+++ b/.gitignore
@@ -24,3 +24,4 @@
 /qemu-2.12.0.tar.xz
 /qemu-3.0.0-rc3.tar.xz
 /qemu-3.0.0.tar.xz
+/qemu-3.1.0-rc1.tar.xz
diff --git a/qemu.spec b/qemu.spec
index 57b6a87..eb15f91 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -95,7 +95,7 @@ Requires: %{name}-ui-sdl = %{epoch}:%{version}-%{release}
 
 
 # Release candidate version tracking
-#global rcver rc3
+%global rcver rc1
 %if 0%{?rcver:1}
 %global rcrel .%{rcver}
 %global rcstr -%{rcver}
@@ -104,8 +104,8 @@ Requires: %{name}-ui-sdl = %{epoch}:%{version}-%{release}
 
 Summary: QEMU is a FAST! processor emulator
 Name: qemu
-Version: 3.0.0
-Release: 1%{?rcrel}%{?dist}
+Version: 3.1.0
+Release: 0.1%{?rcrel}%{?dist}
 Epoch: 2
 License: GPLv2 and BSD and MIT and CC-BY
 URL: http://www.qemu.org/
@@ -246,6 +246,10 @@ BuildRequires: capstone-devel
 BuildRequires: libxml2-devel
 # python scripts in the build process
 BuildRequires: python3
+# qemu 3.1: Used for nvdimm
+BuildRequires: libpmem-devel
+# qemu 3.1: Used for qemu-ga
+BuildRequires: libudev-devel
 
 BuildRequires: glibc-static pcre-static glib2-static zlib-static
 
@@ -882,7 +886,6 @@ run_configure \
     --enable-mpath \
     %{spiceflag} \
     --with-sdlabi="2.0" \
-    --with-gtkabi="3.0"
 
 echo "config-host.mak contents:"
 echo "==="
@@ -917,7 +920,9 @@ run_configure \
     --disable-brlapi \
     --disable-mpath \
     --disable-libnfs \
-    --disable-capstone
+    --disable-capstone \
+    --disable-xen \
+    --disable-rdma
 
 make V=1 %{?_smp_mflags} $buildldflags
 
@@ -1197,9 +1202,11 @@ getent passwd qemu >/dev/null || \
 %{_mandir}/man1/qemu.1*
 %{_mandir}/man1/virtfs-proxy-helper.1*
 %{_mandir}/man7/qemu-block-drivers.7*
+%{_mandir}/man7/qemu-cpu-models.7*
 %{_mandir}/man7/qemu-ga-ref.7*
 %{_mandir}/man7/qemu-qmp-ref.7*
 %{_bindir}/virtfs-proxy-helper
+%{_bindir}/qemu-edid
 %{_bindir}/qemu-keymap
 %{_bindir}/qemu-pr-helper
 %{_unitdir}/qemu-pr-helper.service
@@ -1497,11 +1504,9 @@ getent passwd qemu >/dev/null || \
 %files system-ppc-core
 %{_bindir}/qemu-system-ppc
 %{_bindir}/qemu-system-ppc64
-%{_bindir}/qemu-system-ppcemb
 %{_datadir}/systemtap/tapset/qemu-system-ppc*.stp
 %{_mandir}/man1/qemu-system-ppc.1*
 %{_mandir}/man1/qemu-system-ppc64.1*
-%{_mandir}/man1/qemu-system-ppcemb.1*
 %{_datadir}/%{name}/bamboo.dtb
 %{_datadir}/%{name}/canyonlands.dtb
 %{_datadir}/%{name}/ppc_rom.bin
@@ -1598,6 +1603,9 @@ getent passwd qemu >/dev/null || \
 
 
 %changelog
+* Thu Nov 15 2018 Cole Robinson <crobinso@redhat.com> - 2:3.1.0-0.1.rc1
+- Rebase to qemu-3.1.0-rc1
+
 * Wed Aug 15 2018 Cole Robinson <crobinso@redhat.com> - 2:3.0.0-1
 - Rebase to qemu-3.0.0 GA
 
diff --git a/sources b/sources
index c7b3cb2..77f4f37 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (qemu-3.0.0.tar.xz) = a764302f50b9aca4134bbbc1f361b98e71240cdc7b25600dfe733bf4cf17bd86000bd28357697b08f3b656899dceb9e459350b8d55557817444ed5d7fa380a5a
+SHA512 (qemu-3.1.0-rc1.tar.xz) = 20f4e8516419c308025bb349a2abb9b8ce43d9ce5220c2c1d949c26c4de91fbbe0cc713f632e1baec4cc99307bbbeb8aa4296b52321e3d39faa3731d904bf897

From 0af132aa98e45e478894ca9f7daedf832da34517 Mon Sep 17 00:00:00 2001
From: Cole Robinson <crobinso@redhat.com>
Date: Fri, 16 Nov 2018 11:00:57 -0500
Subject: [PATCH 14/20] BR libpmem is only available on x86_64

---
 qemu.spec | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/qemu.spec b/qemu.spec
index eb15f91..cca4801 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -246,8 +246,10 @@ BuildRequires: capstone-devel
 BuildRequires: libxml2-devel
 # python scripts in the build process
 BuildRequires: python3
+%ifarch x86_64
 # qemu 3.1: Used for nvdimm
 BuildRequires: libpmem-devel
+%endif
 # qemu 3.1: Used for qemu-ga
 BuildRequires: libudev-devel
 

From a4b3db71515a4b55c85b6218df3d37d7ab306090 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Mon, 10 Dec 2018 18:39:46 +0000
Subject: [PATCH 15/20] Disable RBD on 32-bit arches
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 qemu.spec | 36 +++++++++++++++++++++++++++++++++---
 1 file changed, 33 insertions(+), 3 deletions(-)

diff --git a/qemu.spec b/qemu.spec
index cca4801..18bbff4 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -77,6 +77,13 @@
 %endif
 
 # All modules should be listed here.
+%ifarch %{ix86} %{arm}
+%define with_block_rbd 0
+%else
+%define with_block_rbd 1
+%endif
+
+%if %{with_block_rbd}
 %global requires_all_modules                               \
 Requires: %{name}-block-curl = %{epoch}:%{version}-%{release}    \
 Requires: %{name}-block-dmg = %{epoch}:%{version}-%{release}     \
@@ -92,7 +99,22 @@ Requires: %{name}-audio-sdl = %{epoch}:%{version}-%{release}     \
 Requires: %{name}-ui-curses = %{epoch}:%{version}-%{release}     \
 Requires: %{name}-ui-gtk = %{epoch}:%{version}-%{release}        \
 Requires: %{name}-ui-sdl = %{epoch}:%{version}-%{release}
-
+%else
+%global requires_all_modules                               \
+Requires: %{name}-block-curl = %{epoch}:%{version}-%{release}    \
+Requires: %{name}-block-dmg = %{epoch}:%{version}-%{release}     \
+Requires: %{name}-block-gluster = %{epoch}:%{version}-%{release} \
+Requires: %{name}-block-iscsi = %{epoch}:%{version}-%{release}   \
+Requires: %{name}-block-nfs = %{epoch}:%{version}-%{release}     \
+Requires: %{name}-block-ssh = %{epoch}:%{version}-%{release}     \
+Requires: %{name}-audio-alsa = %{epoch}:%{version}-%{release}    \
+Requires: %{name}-audio-oss = %{epoch}:%{version}-%{release}     \
+Requires: %{name}-audio-pa = %{epoch}:%{version}-%{release}      \
+Requires: %{name}-audio-sdl = %{epoch}:%{version}-%{release}     \
+Requires: %{name}-ui-curses = %{epoch}:%{version}-%{release}     \
+Requires: %{name}-ui-gtk = %{epoch}:%{version}-%{release}        \
+Requires: %{name}-ui-sdl = %{epoch}:%{version}-%{release}
+%endif
 
 # Release candidate version tracking
 %global rcver rc1
@@ -105,7 +127,7 @@ Requires: %{name}-ui-sdl = %{epoch}:%{version}-%{release}
 Summary: QEMU is a FAST! processor emulator
 Name: qemu
 Version: 3.1.0
-Release: 0.1%{?rcrel}%{?dist}
+Release: 0.2%{?rcrel}%{?dist}
 Epoch: 2
 License: GPLv2 and BSD and MIT and CC-BY
 URL: http://www.qemu.org/
@@ -188,9 +210,11 @@ BuildRequires: spice-server-devel >= 0.12.0
 BuildRequires: libseccomp-devel >= 2.3.0
 # For network block driver
 BuildRequires: libcurl-devel
+%if %{with_block_rbd}
 # For rbd block driver
 BuildRequires: librados2-devel
 BuildRequires: librbd1-devel
+%endif
 # We need both because the 'stap' binary is probed for by configure
 BuildRequires: systemtap
 BuildRequires: systemtap-sdt-devel
@@ -386,6 +410,7 @@ This package provides the additional NFS block driver for QEMU.
 Install this package if you want to access remote NFS storage.
 
 
+%if %{with_block_rbd}
 %package  block-rbd
 Summary: QEMU Ceph/RBD block driver
 Requires: %{name}-common%{?_isa} = %{epoch}:%{version}-%{release}
@@ -394,7 +419,7 @@ This package provides the additional Ceph/RBD block driver for QEMU.
 
 Install this package if you want to access remote Ceph volumes
 using the rbd protocol.
-
+%endif
 
 %package  block-ssh
 Summary: QEMU SSH block driver
@@ -1248,8 +1273,10 @@ getent passwd qemu >/dev/null || \
 %{_libdir}/qemu/block-iscsi.so
 %files block-nfs
 %{_libdir}/qemu/block-nfs.so
+%if %{with_block_rbd}
 %files block-rbd
 %{_libdir}/qemu/block-rbd.so
+%endif
 %files block-ssh
 %{_libdir}/qemu/block-ssh.so
 
@@ -1605,6 +1632,9 @@ getent passwd qemu >/dev/null || \
 
 
 %changelog
+* Mon Dec 10 2018 Daniel P. Berrangé <berrange@redhat.com> - 2:3.1.0-0.2.rc1
+- Disable RBD on 32-bit arches
+
 * Thu Nov 15 2018 Cole Robinson <crobinso@redhat.com> - 2:3.1.0-0.1.rc1
 - Rebase to qemu-3.1.0-rc1
 

From 5704646898151256badc8bff4d34e6e272322f2b Mon Sep 17 00:00:00 2001
From: Cole Robinson <crobinso@redhat.com>
Date: Tue, 11 Dec 2018 18:40:51 -0500
Subject: [PATCH 16/20] Rebase to qemu-3.1.0 GA

---
 .gitignore | 1 +
 qemu.spec  | 7 +++++--
 sources    | 2 +-
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/.gitignore b/.gitignore
index a334f10..b6c828a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -25,3 +25,4 @@
 /qemu-3.0.0-rc3.tar.xz
 /qemu-3.0.0.tar.xz
 /qemu-3.1.0-rc1.tar.xz
+/qemu-3.1.0.tar.xz
diff --git a/qemu.spec b/qemu.spec
index 18bbff4..c125827 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -117,7 +117,7 @@ Requires: %{name}-ui-sdl = %{epoch}:%{version}-%{release}
 %endif
 
 # Release candidate version tracking
-%global rcver rc1
+# global rcver rc1
 %if 0%{?rcver:1}
 %global rcrel .%{rcver}
 %global rcstr -%{rcver}
@@ -127,7 +127,7 @@ Requires: %{name}-ui-sdl = %{epoch}:%{version}-%{release}
 Summary: QEMU is a FAST! processor emulator
 Name: qemu
 Version: 3.1.0
-Release: 0.2%{?rcrel}%{?dist}
+Release: 1%{?rcrel}%{?dist}
 Epoch: 2
 License: GPLv2 and BSD and MIT and CC-BY
 URL: http://www.qemu.org/
@@ -1632,6 +1632,9 @@ getent passwd qemu >/dev/null || \
 
 
 %changelog
+* Tue Dec 11 2018 Cole Robinson <crobinso@redhat.com> - 2:3.1.0-1
+- Rebase to qemu-3.1.0 GA
+
 * Mon Dec 10 2018 Daniel P. Berrangé <berrange@redhat.com> - 2:3.1.0-0.2.rc1
 - Disable RBD on 32-bit arches
 
diff --git a/sources b/sources
index 77f4f37..d417a06 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (qemu-3.1.0-rc1.tar.xz) = 20f4e8516419c308025bb349a2abb9b8ce43d9ce5220c2c1d949c26c4de91fbbe0cc713f632e1baec4cc99307bbbeb8aa4296b52321e3d39faa3731d904bf897
+SHA512 (qemu-3.1.0.tar.xz) = 7e8dae823937cfac2f0c60406bd3bdcb89df40313dab2a4bed327d5198f7fcc68ac8b31e44692caa09299cc71256ee0b8c17e4f49f78ada8043d424f5daf82fe

From 61ad1f41fd601d95488d23f7a7c476e30e49f926 Mon Sep 17 00:00:00 2001
From: Adam Williamson <awilliam@redhat.com>
Date: Tue, 18 Dec 2018 10:35:22 -0800
Subject: [PATCH 17/20] Restore patch to drop phantom 86 key from en-us keymap
 (bz #1658676)

The exact bug this was initially added to workaround was fixed
in 2.12, so @crobinso dropped the patch. However, the phantom
key turns out to still cause problems in another case, so until
that is fixed, we need to put this back. See
https://bugzilla.redhat.com/show_bug.cgi?id=1658676 for full
details on the outstanding bug.
---
 ...matic-evdev-86-key-from-en-us-keymap.patch | 32 +++++++++++++++++++
 qemu.spec                                     |  8 ++++-
 2 files changed, 39 insertions(+), 1 deletion(-)
 create mode 100644 0001-Remove-problematic-evdev-86-key-from-en-us-keymap.patch

diff --git a/0001-Remove-problematic-evdev-86-key-from-en-us-keymap.patch b/0001-Remove-problematic-evdev-86-key-from-en-us-keymap.patch
new file mode 100644
index 0000000..837be82
--- /dev/null
+++ b/0001-Remove-problematic-evdev-86-key-from-en-us-keymap.patch
@@ -0,0 +1,32 @@
+From 2c25ad161d7714f15b1951c69c50844ea81f4186 Mon Sep 17 00:00:00 2001
+From: Adam Williamson <awilliam@redhat.com>
+Date: Wed, 20 Dec 2017 15:43:07 -0800
+Subject: [PATCH] Remove problematic 'evdev 86' key from en-us keymap
+
+This causes LP#1738283. Gerd will have to come up with a better
+fix, but just hacking out the problematic key definition should
+work for now.
+---
+ pc-bios/keymaps/en-us | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/pc-bios/keymaps/en-us b/pc-bios/keymaps/en-us
+index a70e03adc0..e518a9dc35 100644
+--- a/pc-bios/keymaps/en-us
++++ b/pc-bios/keymaps/en-us
+@@ -343,12 +343,6 @@ KP_Decimal 0x53 numlock
+ 
+ # evdev 85 (0x55): no evdev -> QKeyCode mapping (xkb keysym NoSymbol)
+ 
+-# evdev 86 (0x56), QKeyCode "less", number 0x56
+-less 0x56
+-greater 0x56 shift
+-bar 0x56 altgr
+-brokenbar 0x56 shift altgr
+-
+ # evdev 87 (0x57), QKeyCode "f11", number 0x57
+ F11 0x57
+ 
+-- 
+2.15.1
+
diff --git a/qemu.spec b/qemu.spec
index c125827..eef5b60 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -127,7 +127,7 @@ Requires: %{name}-ui-sdl = %{epoch}:%{version}-%{release}
 Summary: QEMU is a FAST! processor emulator
 Name: qemu
 Version: 3.1.0
-Release: 1%{?rcrel}%{?dist}
+Release: 2%{?rcrel}%{?dist}
 Epoch: 2
 License: GPLv2 and BSD and MIT and CC-BY
 URL: http://www.qemu.org/
@@ -151,6 +151,9 @@ Source20: kvm-x86.modprobe.conf
 # /etc/security/limits.d/95-kvm-ppc64-memlock.conf
 Source21: 95-kvm-ppc64-memlock.conf
 
+# Good ol' keymap 86 still messin with us
+Patch0: 0001-Remove-problematic-evdev-86-key-from-en-us-keymap.patch
+
 
 
 # documentation deps
@@ -1632,6 +1635,9 @@ getent passwd qemu >/dev/null || \
 
 
 %changelog
+* Tue Dec 18 2018 Adam Williamson <awilliam@redhat.com> - 2:3.1.0-1.1
+- Restore patch to drop phantom 86 key from en-us keymap (bz #1658676)
+
 * Tue Dec 11 2018 Cole Robinson <crobinso@redhat.com> - 2:3.1.0-1
 - Rebase to qemu-3.1.0 GA
 

From 84339254339d0fc5215a87a92656eca7ebef82b4 Mon Sep 17 00:00:00 2001
From: "Richard W.M. Jones" <rjones@redhat.com>
Date: Fri, 11 Jan 2019 09:16:11 +0000
Subject: [PATCH 18/20] Rebuild for unannounced libcapstone soname bump from 3
 to 4.

---
 qemu.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/qemu.spec b/qemu.spec
index eef5b60..2591729 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -127,7 +127,7 @@ Requires: %{name}-ui-sdl = %{epoch}:%{version}-%{release}
 Summary: QEMU is a FAST! processor emulator
 Name: qemu
 Version: 3.1.0
-Release: 2%{?rcrel}%{?dist}
+Release: 3%{?rcrel}%{?dist}
 Epoch: 2
 License: GPLv2 and BSD and MIT and CC-BY
 URL: http://www.qemu.org/
@@ -1635,6 +1635,9 @@ getent passwd qemu >/dev/null || \
 
 
 %changelog
+* Fri Jan 11 2019 Richard W.M. Jones <rjones@redhat.com> - 2:3.1.0-3
+- Rebuild for unannounced libcapstone soname bump from 3 to 4.
+
 * Tue Dec 18 2018 Adam Williamson <awilliam@redhat.com> - 2:3.1.0-1.1
 - Restore patch to drop phantom 86 key from en-us keymap (bz #1658676)
 

From e0155fb5bed6f77a0f683416c053e0c583054695 Mon Sep 17 00:00:00 2001
From: "Richard W.M. Jones" <rjones@redhat.com>
Date: Fri, 11 Jan 2019 09:43:39 +0000
Subject: [PATCH 19/20] Add a temporary patch to fix capstone header location.

---
 ...ound-Fix-location-of-capstone-header.patch | 27 +++++++++++++++++++
 qemu.spec                                     |  5 ++++
 2 files changed, 32 insertions(+)
 create mode 100644 0001-Temporary-workaround-Fix-location-of-capstone-header.patch

diff --git a/0001-Temporary-workaround-Fix-location-of-capstone-header.patch b/0001-Temporary-workaround-Fix-location-of-capstone-header.patch
new file mode 100644
index 0000000..6f30e9d
--- /dev/null
+++ b/0001-Temporary-workaround-Fix-location-of-capstone-header.patch
@@ -0,0 +1,27 @@
+From 429451516fe80ccd83163e279a81b1440aa27781 Mon Sep 17 00:00:00 2001
+From: "Richard W.M. Jones" <rjones@redhat.com>
+Date: Fri, 11 Jan 2019 09:41:06 +0000
+Subject: [PATCH] Temporary workaround: Fix location of capstone headers.
+
+See:
+https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/NTFMIAACL7ALBHUC3FZDSB3UMNR2SYJT/
+---
+ include/disas/capstone.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/disas/capstone.h b/include/disas/capstone.h
+index 84e214956d..2eb6be222b 100644
+--- a/include/disas/capstone.h
++++ b/include/disas/capstone.h
+@@ -3,7 +3,7 @@
+ 
+ #ifdef CONFIG_CAPSTONE
+ 
+-#include <capstone.h>
++#include <capstone/capstone.h>
+ 
+ #else
+ 
+-- 
+2.19.1
+
diff --git a/qemu.spec b/qemu.spec
index 2591729..e206b96 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -154,6 +154,10 @@ Source21: 95-kvm-ppc64-memlock.conf
 # Good ol' keymap 86 still messin with us
 Patch0: 0001-Remove-problematic-evdev-86-key-from-en-us-keymap.patch
 
+# Temporary workaround for capstone 4.  See:
+# https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/NTFMIAACL7ALBHUC3FZDSB3UMNR2SYJT/
+Patch1: 0001-Temporary-workaround-Fix-location-of-capstone-header.patch
+
 
 
 # documentation deps
@@ -1637,6 +1641,7 @@ getent passwd qemu >/dev/null || \
 %changelog
 * Fri Jan 11 2019 Richard W.M. Jones <rjones@redhat.com> - 2:3.1.0-3
 - Rebuild for unannounced libcapstone soname bump from 3 to 4.
+- Add a temporary patch to fix capstone header location.
 
 * Tue Dec 18 2018 Adam Williamson <awilliam@redhat.com> - 2:3.1.0-1.1
 - Restore patch to drop phantom 86 key from en-us keymap (bz #1658676)

From f1ea04bd67b7ff92eb971c8a9328ae943214fa54 Mon Sep 17 00:00:00 2001
From: "Richard W.M. Jones" <rjones@redhat.com>
Date: Sat, 12 Jan 2019 07:35:33 +0000
Subject: [PATCH 20/20] Revert "Add a temporary patch to fix capstone header
 location."

This has now been fixed in capstone, see
https://github.com/aquynh/capstone/issues/1339

This reverts commit e0155fb5bed6f77a0f683416c053e0c583054695.
---
 ...ound-Fix-location-of-capstone-header.patch | 27 -------------------
 qemu.spec                                     |  9 +++----
 2 files changed, 4 insertions(+), 32 deletions(-)
 delete mode 100644 0001-Temporary-workaround-Fix-location-of-capstone-header.patch

diff --git a/0001-Temporary-workaround-Fix-location-of-capstone-header.patch b/0001-Temporary-workaround-Fix-location-of-capstone-header.patch
deleted file mode 100644
index 6f30e9d..0000000
--- a/0001-Temporary-workaround-Fix-location-of-capstone-header.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From 429451516fe80ccd83163e279a81b1440aa27781 Mon Sep 17 00:00:00 2001
-From: "Richard W.M. Jones" <rjones@redhat.com>
-Date: Fri, 11 Jan 2019 09:41:06 +0000
-Subject: [PATCH] Temporary workaround: Fix location of capstone headers.
-
-See:
-https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/NTFMIAACL7ALBHUC3FZDSB3UMNR2SYJT/
----
- include/disas/capstone.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/include/disas/capstone.h b/include/disas/capstone.h
-index 84e214956d..2eb6be222b 100644
---- a/include/disas/capstone.h
-+++ b/include/disas/capstone.h
-@@ -3,7 +3,7 @@
- 
- #ifdef CONFIG_CAPSTONE
- 
--#include <capstone.h>
-+#include <capstone/capstone.h>
- 
- #else
- 
--- 
-2.19.1
-
diff --git a/qemu.spec b/qemu.spec
index e206b96..50593c5 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -127,7 +127,7 @@ Requires: %{name}-ui-sdl = %{epoch}:%{version}-%{release}
 Summary: QEMU is a FAST! processor emulator
 Name: qemu
 Version: 3.1.0
-Release: 3%{?rcrel}%{?dist}
+Release: 4%{?rcrel}%{?dist}
 Epoch: 2
 License: GPLv2 and BSD and MIT and CC-BY
 URL: http://www.qemu.org/
@@ -154,10 +154,6 @@ Source21: 95-kvm-ppc64-memlock.conf
 # Good ol' keymap 86 still messin with us
 Patch0: 0001-Remove-problematic-evdev-86-key-from-en-us-keymap.patch
 
-# Temporary workaround for capstone 4.  See:
-# https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/NTFMIAACL7ALBHUC3FZDSB3UMNR2SYJT/
-Patch1: 0001-Temporary-workaround-Fix-location-of-capstone-header.patch
-
 
 
 # documentation deps
@@ -1639,6 +1635,9 @@ getent passwd qemu >/dev/null || \
 
 
 %changelog
+* Sat Jan 12 2019 Richard W.M. Jones <rjones@redhat.com> - 2:3.1.0-4
+- Remove temporary patch and rebuild against fixed capstone.
+
 * Fri Jan 11 2019 Richard W.M. Jones <rjones@redhat.com> - 2:3.1.0-3
 - Rebuild for unannounced libcapstone soname bump from 3 to 4.
 - Add a temporary patch to fix capstone header location.