feat: kvm and qemu patches grouped by the detection each clears

patches/qemu/01-firmware.patch

@@ -0,0 +1,397 @@
+Subject: [PATCH] firmware: FIRMWARE
+
+Targets VMAware check: FIRMWARE
+
+ACPI table fingerprints: PCI link-device names, PNP0A06 resource stubs, the
+FADT C-state latencies and the AML the checker string-matches on.
+
+Applies to QEMU v11.1.1. Apply from the source root with:
+    patch -p1 < 01-firmware.patch
+
+---
+diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
+index 8837b69..4001d9d 100644
+--- a/hw/i386/acpi-build.c
++++ b/hw/i386/acpi-build.c
+@@ -165,8 +165,8 @@ static void init_common_fadt_data(MachineState *ms, Object *o,
+                         (1 << ACPI_FADT_F_FORCE_APIC_CLUSTER_MODEL) : 0),
+         .int_model = 1 /* Multiple APIC */,
+         .rtc_century = RTC_CENTURY,
+-        .plvl2_lat = 0xfff /* C2 state not supported */,
+-        .plvl3_lat = 0xfff /* C3 state not supported */,
++        .plvl2_lat = 0xffe /* C2 state not supported */,
++        .plvl3_lat = 0xffe /* C3 state not supported */,
+         .smi_cmd = smm_enabled ? ACPI_PORT_SMI_CMD : 0,
+         .sci_int = object_property_get_uint(o, ACPI_PM_PROP_SCI_INT, NULL),
+         .acpi_enable_cmd =
+@@ -748,9 +748,9 @@ static void build_q35_pci0_int(Aml *table)
+     aml_append(table, method);
+ 
+     aml_append(pci0_scope,
+-        aml_name_decl("PRTP", build_q35_routing_table("LNK")));
++        aml_name_decl("IRQP", build_q35_routing_table("LNK")));
+     aml_append(pci0_scope,
+-        aml_name_decl("PRTA", build_q35_routing_table("GSI")));
++        aml_name_decl("IRQA", build_q35_routing_table("APC")));
+ 
+     method = aml_method("_PRT", 0, AML_NOTSERIALIZED);
+     {
+@@ -762,10 +762,10 @@ static void build_q35_pci0_int(Aml *table)
+         /* Note: we provide the same info as the PCI routing
+            table of the Bochs BIOS */
+         if_ctx = aml_if(aml_equal(aml_name("PICF"), aml_int(0)));
+-        aml_append(if_ctx, aml_return(aml_name("PRTP")));
++        aml_append(if_ctx, aml_return(aml_name("IRQP")));
+         aml_append(method, if_ctx);
+         else_ctx = aml_else();
+-        aml_append(else_ctx, aml_return(aml_name("PRTA")));
++        aml_append(else_ctx, aml_return(aml_name("IRQA")));
+         aml_append(method, else_ctx);
+     }
+     aml_append(pci0_scope, method);
+@@ -783,14 +783,14 @@ static void build_q35_pci0_int(Aml *table)
+     aml_append(sb_scope, build_link_dev("LNKG", 6, aml_name("PRQG")));
+     aml_append(sb_scope, build_link_dev("LNKH", 7, aml_name("PRQH")));
+ 
+-    aml_append(sb_scope, build_gsi_link_dev("GSIA", 0x10, 0x10));
+-    aml_append(sb_scope, build_gsi_link_dev("GSIB", 0x11, 0x11));
+-    aml_append(sb_scope, build_gsi_link_dev("GSIC", 0x12, 0x12));
+-    aml_append(sb_scope, build_gsi_link_dev("GSID", 0x13, 0x13));
+-    aml_append(sb_scope, build_gsi_link_dev("GSIE", 0x14, 0x14));
+-    aml_append(sb_scope, build_gsi_link_dev("GSIF", 0x15, 0x15));
+-    aml_append(sb_scope, build_gsi_link_dev("GSIG", 0x16, 0x16));
+-    aml_append(sb_scope, build_gsi_link_dev("GSIH", 0x17, 0x17));
++    aml_append(sb_scope, build_gsi_link_dev("APCA", 0x10, 0x10));
++    aml_append(sb_scope, build_gsi_link_dev("APCB", 0x11, 0x11));
++    aml_append(sb_scope, build_gsi_link_dev("APCC", 0x12, 0x12));
++    aml_append(sb_scope, build_gsi_link_dev("APCD", 0x13, 0x13));
++    aml_append(sb_scope, build_gsi_link_dev("APCE", 0x14, 0x14));
++    aml_append(sb_scope, build_gsi_link_dev("APCF", 0x15, 0x15));
++    aml_append(sb_scope, build_gsi_link_dev("APCG", 0x16, 0x16));
++    aml_append(sb_scope, build_gsi_link_dev("APCH", 0x17, 0x17));
+ 
+     aml_append(table, sb_scope);
+ }
+@@ -801,7 +801,7 @@ static Aml *build_q35_dram_controller(const AcpiMcfgInfo *mcfg)
+     Aml *resource_template;
+ 
+     /* DRAM controller */
+-    dev = aml_device("DRAC");
++    dev = aml_device("MCFG");
+     aml_append(dev, aml_name_decl("_HID", aml_string("PNP0C01")));
+ 
+     resource_template = aml_resource_template();
+@@ -885,7 +885,6 @@ build_dsdt(GArray *table_data, BIOSLinker *linker,
+     acpi_table_begin(&table, table_data);
+     dsdt = init_aml_allocator();
+ 
+-    build_dbg_aml(dsdt);
+     if (i440fx) {
+         sb_scope = aml_scope("_SB");
+         dev = aml_device("PCI0");
+@@ -901,6 +900,36 @@ build_dsdt(GArray *table_data, BIOSLinker *linker,
+         build_piix4_pci0_int(dsdt);
+     } else if (q35) {
+         sb_scope = aml_scope("_SB");
++
++        /*
++         * Emulate Windows ACPI OSYS/_OSI logic in DSDT.
++         * Adds Windows 2001/2006/2009/2012/2013/2015.
++         */
++        static const struct {
++            const char *osi;
++            uint32_t    osys;
++        } win_osi[] = {
++            { "Windows 2001",     0x07D1 },
++            { "Windows 2001 SP1", 0x07D1 },
++            { "Windows 2001 SP2", 0x07D2 },
++            { "Windows 2001.1",   0x07D3 },
++            { "Windows 2006",     0x07D6 },
++            { "Windows 2009",     0x07D9 },
++            { "Windows 2012",     0x07DC },
++            { "Windows 2013",     0x07DD },
++            { "Windows 2015",     0x07DF },
++        };
++
++        aml_append(sb_scope, aml_name_decl("OSYS", aml_int(0x03E8)));
++
++        for (unsigned n = 0; n < ARRAY_SIZE(win_osi); n++) {
++            Aml *osi = aml_if(aml_equal(
++                aml_call1("_OSI", aml_string("%s", win_osi[n].osi)), aml_int(1)));
++            aml_append(osi, aml_store(aml_int(win_osi[n].osys),
++                                      aml_name("OSYS")));
++            aml_append(sb_scope, osi);
++        }
++
+         dev = aml_device("PCI0");
+         aml_append(dev, aml_name_decl("_HID", aml_eisaid("PNP0A08")));
+         aml_append(dev, aml_name_decl("_CID", aml_eisaid("PNP0A03")));
+@@ -916,7 +945,7 @@ build_dsdt(GArray *table_data, BIOSLinker *linker,
+             /* reserve SMI block resources, IO ports 0xB2, 0xB3 */
+             dev = aml_device("PCI0.SMI0");
+             aml_append(dev, aml_name_decl("_HID", aml_eisaid("PNP0A06")));
+-            aml_append(dev, aml_name_decl("_UID", aml_string("SMI resources")));
++            aml_append(dev, aml_name_decl("_UID", aml_string("Reserved resources A")));
+             crs = aml_resource_template();
+             aml_append(crs,
+                 aml_io(
+@@ -967,22 +996,6 @@ build_dsdt(GArray *table_data, BIOSLinker *linker,
+     }
+     aml_append(dsdt, scope);
+ 
+-    {
+-        CPUHotplugFeatures opts = {
+-            .acpi_1_compatible = true,
+-            .smi_path = pm->smi_on_cpuhp ? "\\_SB.PCI0.SMI0.SMIC" : NULL,
+-            .fw_unplugs_cpu = pm->smi_on_cpu_unplug,
+-        };
+-        build_cpus_aml(dsdt, machine, opts, pc_madt_cpu_entry,
+-                       pm->cpu_hp_io_base, "\\_SB.PCI0", "\\_GPE._E02",
+-                       AML_SYSTEM_IO);
+-    }
+-
+-    if (pcms->memhp_io_base && nr_mem) {
+-        build_memory_hotplug_aml(dsdt, nr_mem, "\\_SB.PCI0",
+-                                 "\\_GPE._E03", AML_SYSTEM_IO,
+-                                 pcms->memhp_io_base);
+-    }
+ 
+     crs_range_set_init(&crs_range_set);
+     bus = PC_MACHINE(machine)->pcibus;
+@@ -1133,9 +1146,9 @@ build_dsdt(GArray *table_data, BIOSLinker *linker,
+     aml_append(scope, aml_name_decl("_CRS", crs));
+ 
+     /* reserve GPE0 block resources */
+-    dev = aml_device("GPE0");
++    dev = aml_device("RSRA");
+     aml_append(dev, aml_name_decl("_HID", aml_string("PNP0A06")));
+-    aml_append(dev, aml_name_decl("_UID", aml_string("GPE0 resources")));
++    aml_append(dev, aml_name_decl("_UID", aml_int(0)));
+     /* device present, functioning, decoding, not shown in UI */
+     aml_append(dev, aml_name_decl("_STA", aml_int(0xB)));
+     crs = aml_resource_template();
+@@ -1188,12 +1201,6 @@ build_dsdt(GArray *table_data, BIOSLinker *linker,
+     aml_append(scope, aml_name_decl("_S5", pkg));
+     aml_append(dsdt, scope);
+ 
+-    /* create fw_cfg node, unconditionally */
+-    {
+-        scope = aml_scope("\\_SB.PCI0");
+-        fw_cfg_add_acpi_dsdt(scope, x86ms->fw_cfg);
+-        aml_append(dsdt, scope);
+-    }
+ 
+     sb_scope = aml_scope("\\_SB");
+     {
+@@ -2168,8 +2175,6 @@ void acpi_build(AcpiBuildTables *tables, MachineState *machine)
+                        x86ms->oem_id, x86ms->oem_table_id, &pcms->cxl_devices_state);
+     }
+ 
+-    acpi_add_table(table_offsets, tables_blob);
+-    build_waet(tables_blob, tables->linker, x86ms->oem_id, x86ms->oem_table_id);
+ 
+     if (pcms->wdat_enabled == true) {
+         g_assert(pm.tco_io_base);
+diff --git a/hw/acpi/pcihp.c b/hw/acpi/pcihp.c
+index 87162ff..4c303cb 100644
+--- a/hw/acpi/pcihp.c
++++ b/hw/acpi/pcihp.c
+@@ -687,10 +687,10 @@ void build_append_pcihp_resources(Aml *scope /* \\_SB.PCI0 */,
+ {
+     Aml *dev, *crs;
+ 
+-    dev = aml_device("PHPR");
++    dev = aml_device("RSRB");
+     aml_append(dev, aml_name_decl("_HID", aml_string("PNP0A06")));
+     aml_append(dev,
+-               aml_name_decl("_UID", aml_string("PCI Hotplug resources")));
++               aml_name_decl("_UID", aml_string("Reserved resources B")));
+     /* device present, functioning, decoding, not shown in UI */
+     aml_append(dev, aml_name_decl("_STA", aml_int(0xB)));
+     crs = aml_resource_template();
+@@ -699,6 +699,83 @@ void build_append_pcihp_resources(Aml *scope /* \\_SB.PCI0 */,
+     aml_append(scope, dev);
+ }
+ 
++/*
++ * Helper to generate "Real Hardware" looking ACPI names.
++ * This removes the "S<hex>" signature and ensures unique naming
++ * for multifunction devices.
++ */
++static void get_mimic_pci_name(char *name, int devfn) {
++    int slot = PCI_SLOT(devfn);
++    int func = PCI_FUNC(devfn);
++
++    switch (slot) {
++        case 0:
++            // Host Bridge is almost always Slot 0, Function 0 (and also bus 0 but we cant access bus number in this context)
++            if (func == 0) sprintf(name, "MCHC");
++            else sprintf(name, "H%X", func);
++            break;
++
++        case 2:
++            // Slot 2: Graphics + associated HDMI Audio
++            if (func == 0) sprintf(name, "GFX0");      // Primary GPU
++            else if (func == 1) sprintf(name, "HDAU"); // HDMI Audio
++            else sprintf(name, "GFX%X", func);         // Fallback uniqueness
++            break;
++
++        case 3:
++            // Slot 3: Network
++            if (func == 0) sprintf(name, "GLAN");
++            else sprintf(name, "NET%X", func);
++            break;
++
++        case 4:
++            // Slot 4: Multimedia / Audio
++            if (func == 0) sprintf(name, "HDEF");
++            else sprintf(name, "MM%02X", func);
++            break;
++
++        case 5:
++            // Slot 5: USB XHCI (QEMU default often)
++            if (func == 0) sprintf(name, "XHC1");
++            else sprintf(name, "XHC%X", func);
++            break;
++
++        case 6:
++            // Slot 6: SATA (AHCI)
++            if (func == 0) sprintf(name, "SAT0");
++            else sprintf(name, "SAT%X", func);
++            break;
++
++        case 29:
++            // Slot 29 (0x1D): USB EHCI (Intel Standard)
++            if (func == 0) sprintf(name, "EHC1");
++            else sprintf(name, "EHC%X", func);
++            break;
++
++        case 20:
++            // Slot 20 (0x14): LPC / SMBus / SATA 2
++            if (func == 0) sprintf(name, "LPCB");      // ISA Bridge
++            else if (func == 2) sprintf(name, "SAT1"); // 2nd SATA
++            else if (func == 3) sprintf(name, "SBUS"); // SMBus
++            else sprintf(name, "S20%X", func);         // Fallback
++            break;
++
++        default:
++            /*
++             * For generic slots, we use "RP" (Root Port) + devfn (Hex).
++             *
++             * Why 'devfn' and not 'slot'?
++             * - Slot 10, Func 0 (devfn 0x50) -> RP50
++             * - Slot 10, Func 1 (devfn 0x51) -> RP51
++             *
++             * This guarantees ACPI uniqueness for multifunction devices
++             * while completely breaking the "S" + hex signature.
++             */
++            sprintf(name, "RP%02X", devfn);
++            break;
++    }
++}
++
+ bool build_append_notification_callback(Aml *parent_scope, const PCIBus *bus)
+ {
+     Aml *method;
+@@ -912,7 +989,11 @@ void build_append_pci_bus_devices(Aml *parent_scope, PCIBus *bus)
+         }
+ 
+         /* start to compose PCI device descriptor */
+-        dev = aml_device("S%.02X", devfn);
++
++        char mimic_name[5];
++        get_mimic_pci_name(mimic_name, devfn);
++        dev = aml_device("%s", mimic_name);
++
+         aml_append(dev, aml_name_decl("_ADR", aml_int(adr)));
+ 
+         call_dev_aml_func(DEVICE(bus->devices[devfn]), dev);
+diff --git a/hw/acpi/aml-build.c b/hw/acpi/aml-build.c
+index 990abc6..01c8fc4 100644
+--- a/hw/acpi/aml-build.c
++++ b/hw/acpi/aml-build.c
+@@ -1751,15 +1751,14 @@ void acpi_table_begin(AcpiTable *desc, GArray *array)
+      * reserve space for Length field, which will be patched by
+      * acpi_table_end() when the table creation is finished.
+      */
+-    build_append_int_noprefix(array, 0, 4); /* Length */
+-    build_append_int_noprefix(array, desc->rev, 1); /* Revision */
+-    build_append_int_noprefix(array, 0, 1); /* Checksum */
+-    build_append_padded_str(array, desc->oem_id, 6, '\0'); /* OEMID */
+-    /* OEM Table ID */
+-    build_append_padded_str(array, desc->oem_table_id, 8, '\0');
+-    build_append_int_noprefix(array, 1, 4); /* OEM Revision */
+-    g_array_append_vals(array, ACPI_BUILD_APPNAME8, 4); /* Creator ID */
+-    build_append_int_noprefix(array, 1, 4); /* Creator Revision */
++    build_append_int_noprefix(array, 0, 4);                       /* Length */
++    build_append_int_noprefix(array, desc->rev, 1);               /* Revision */
++    build_append_int_noprefix(array, 0, 1);                       /* Checksum */
++    build_append_padded_str(array, ACPI_BUILD_APPNAME6, 6, '\0'); /* OEMID */
++    build_append_padded_str(array, ACPI_BUILD_APPNAME8, 8, '\0'); /* OEM Table ID */
++    build_append_int_noprefix(array, 1, 4);                       /* OEM Revision */
++    g_array_append_vals(array, "ACPI", 4);                        /* Creator ID */
++    build_append_int_noprefix(array, 1, 4);                       /* Creator Revision */
+ }
+ 
+ void acpi_table_end(BIOSLinker *linker, AcpiTable *desc)
+@@ -2488,7 +2487,7 @@ void build_fadt(GArray *tbl, BIOSLinker *linker, const AcpiFadtData *f,
+     /* ACPI1.0: INT_MODEL, ACPI2.0+: Reserved */
+     build_append_int_noprefix(tbl, f->int_model /* Multiple APIC */, 1);
+     /* Preferred_PM_Profile */
+-    build_append_int_noprefix(tbl, 0 /* Unspecified */, 1);
++    build_append_int_noprefix(tbl, 1 /* Desktop */, 1);
+     build_append_int_noprefix(tbl, f->sci_int, 2); /* SCI_INT */
+     build_append_int_noprefix(tbl, f->smi_cmd, 4); /* SMI_CMD */
+     build_append_int_noprefix(tbl, f->acpi_enable_cmd, 1); /* ACPI_ENABLE */
+@@ -2585,7 +2584,7 @@ void build_fadt(GArray *tbl, BIOSLinker *linker, const AcpiFadtData *f,
+     }
+ 
+     /* Hypervisor Vendor Identity */
+-    build_append_padded_str(tbl, "QEMU", 8, '\0');
++    build_append_int_noprefix(tbl, 0, 8);
+ 
+     /* TODO: extra fields need to be added to support revisions above rev6 */
+     assert(f->rev == 6);
+diff --git a/include/hw/acpi/aml-build.h b/include/hw/acpi/aml-build.h
+index eaff025..9c3b434 100644
+--- a/include/hw/acpi/aml-build.h
++++ b/include/hw/acpi/aml-build.h
+@@ -5,8 +5,8 @@
+ #include "hw/acpi/bios-linker-loader.h"
+ #include "hw/core/cpu.h"
+ 
+-#define ACPI_BUILD_APPNAME6 "BOCHS "
+-#define ACPI_BUILD_APPNAME8 "BXPC    "
++#define ACPI_BUILD_APPNAME6 "ALASKA"
++#define ACPI_BUILD_APPNAME8 "A M I   "
+ 
+ #define ACPI_BUILD_TABLE_FILE "etc/acpi/tables"
+ #define ACPI_BUILD_RSDP_FILE "etc/acpi/rsdp"
+diff --git a/include/hw/i386/x86.h b/include/hw/i386/x86.h
+index 71fe6b5..755c9d8 100644
+--- a/include/hw/i386/x86.h
++++ b/include/hw/i386/x86.h
+@@ -136,7 +136,7 @@ bool x86_machine_is_acpi_enabled(const X86MachineState *x86ms);
+ 
+ /* Global System Interrupts */
+ 
+-#define ACPI_BUILD_PCI_IRQS ((1<<5) | (1<<9) | (1<<10) | (1<<11))
++#define ACPI_BUILD_PCI_IRQS ((1<<4) | (1<<5) | (1<<6) | (1<<10) | (1<<11) | (1<<14) | (1<<15))
+ 
+ typedef struct GSIState {
+     qemu_irq i8259_irq[ISA_NUM_IRQS];
+diff --git a/hw/pci-host/gpex.c b/hw/pci-host/gpex.c
+index e66784c..8f748f9 100644
+--- a/hw/pci-host/gpex.c
++++ b/hw/pci-host/gpex.c
+@@ -243,8 +243,8 @@ static void gpex_root_class_init(ObjectClass *klass, const void *data)
+ 
+     dc->desc = "QEMU generic PCIe host bridge";
+     dc->vmsd = &vmstate_gpex_root;
+-    k->vendor_id = PCI_VENDOR_ID_REDHAT;
+-    k->device_id = PCI_DEVICE_ID_REDHAT_PCIE_HOST;
++    k->vendor_id = PCI_VENDOR_ID_AMD;
++    k->device_id = PCI_DEVICE_ID_INTEL_P35_MCH;
+     k->revision = 0;
+     k->class_id = PCI_CLASS_BRIDGE_HOST;
+     /*

patches/qemu/02-disk-identity.patch

@@ -0,0 +1,115 @@
+Subject: [PATCH] disk-identity: VIRTUAL_DISK / DISK_SERIAL
+
+Targets VMAware check: VIRTUAL_DISK / DISK_SERIAL
+
+Storage that announces itself as emulated: 'QEMU HARDDISK', 'QEMU DVD-ROM',
+empty serials and the QEMU vendor string in SCSI inquiry data.
+
+Applies to QEMU v11.1.1. Apply from the source root with:
+    patch -p1 < 02-disk-identity.patch
+
+---
+diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
+index 1b0cce1..0e8ded4 100644
+--- a/hw/scsi/scsi-disk.c
++++ b/hw/scsi/scsi-disk.c
+@@ -2551,7 +2551,7 @@ static void scsi_realize(SCSIDevice *dev, Error **errp)
+         s->version = g_strdup(QEMU_HW_VERSION);
+     }
+     if (!s->vendor) {
+-        s->vendor = g_strdup("QEMU");
++        s->vendor = g_strdup("ATA");
+     }
+     if (s->serial && strlen(s->serial) > MAX_SERIAL_LEN) {
+         error_setg(errp, "The serial number can't be longer than %d characters",
+@@ -2615,7 +2615,7 @@ static void scsi_hd_realize(SCSIDevice *dev, Error **errp)
+     s->qdev.blocksize = s->qdev.conf.logical_block_size;
+     s->qdev.type = TYPE_DISK;
+     if (!s->product) {
+-        s->product = g_strdup("QEMU HARDDISK");
++        s->product = g_strdup("Samsung SSD 870 EVO 1TB");
+     }
+     scsi_realize(&s->qdev, errp);
+ }
+@@ -2642,7 +2642,7 @@ static void scsi_cd_realize(SCSIDevice *dev, Error **errp)
+     s->qdev.type = TYPE_ROM;
+     s->features |= 1 << SCSI_DISK_F_REMOVABLE;
+     if (!s->product) {
+-        s->product = g_strdup("QEMU CD-ROM");
++        s->product = g_strdup("HL-DT-ST BD-RE WH16NS60");
+     }
+     scsi_realize(&s->qdev, errp);
+ }
+diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c
+index deb43d5..36e4ebd 100644
+--- a/hw/scsi/scsi-bus.c
++++ b/hw/scsi/scsi-bus.c
+@@ -696,8 +696,8 @@ static bool scsi_target_emulate_inquiry(SCSITargetReq *r)
+         r->buf[3] = 2 | 0x10; /* HiSup, response data format */
+         r->buf[4] = r->len - 5; /* Additional Length = (Len - 1) - 4 */
+         r->buf[7] = 0x10 | (r->req.bus->info->tcq ? 0x02 : 0); /* Sync, TCQ.  */
+-        memcpy(&r->buf[8], "QEMU    ", 8);
+-        memcpy(&r->buf[16], "QEMU TARGET     ", 16);
++        memcpy(&r->buf[8], "ATA     ", 8);
++        memcpy(&r->buf[16], "ATA TARGET      ", 16);
+         pstrcpy((char *) &r->buf[32], 4, QEMU_HW_VERSION);
+     }
+     return true;
+diff --git a/hw/ide/core.c b/hw/ide/core.c
+index fb9bf11..7f44de2 100644
+--- a/hw/ide/core.c
++++ b/hw/ide/core.c
+@@ -2640,21 +2640,20 @@ int ide_init_drive(IDEState *s, IDEDevice *dev, IDEDriveKind kind, Error **errp)
+     if (dev->serial) {
+         pstrcpy(s->drive_serial_str, sizeof(s->drive_serial_str), dev->serial);
+     } else {
+-        snprintf(s->drive_serial_str, sizeof(s->drive_serial_str),
+-                 "QM%05d", s->drive_serial);
++        pstrcpy(s->drive_serial_str, sizeof(s->drive_serial_str), "S0123456789ABCD");  /* placeholder; set <serial> on the disk instead */
+     }
+     if (dev->model) {
+         pstrcpy(s->drive_model_str, sizeof(s->drive_model_str), dev->model);
+     } else {
+         switch (kind) {
+         case IDE_CD:
+-            strcpy(s->drive_model_str, "QEMU DVD-ROM");
++            strcpy(s->drive_model_str, "HL-DT-ST BD-RE WH16NS60");
+             break;
+         case IDE_CFATA:
+-            strcpy(s->drive_model_str, "QEMU MICRODRIVE");
++            strcpy(s->drive_model_str, "Samsung SSD 870 EVO 1TB");
+             break;
+         default:
+-            strcpy(s->drive_model_str, "QEMU HARDDISK");
++            strcpy(s->drive_model_str, "Samsung SSD 870 EVO 1TB");
+             break;
+         }
+     }
+diff --git a/hw/ide/atapi.c b/hw/ide/atapi.c
+index 0ea149a..f012ad8 100644
+--- a/hw/ide/atapi.c
++++ b/hw/ide/atapi.c
+@@ -786,8 +786,8 @@ static void cmd_inquiry(IDEState *s, uint8_t *buf)
+         buf[5] = 0;    /* reserved */
+         buf[6] = 0;    /* reserved */
+         buf[7] = 0;    /* reserved */
+-        padstr8(buf + 8, 8, "QEMU");
+-        padstr8(buf + 16, 16, "QEMU DVD-ROM");
++        padstr8(buf + 8, 8, "Samsung");
++        padstr8(buf + 16, 16, "DVD-ROM");
+         padstr8(buf + 32, 4, s->version);
+         idx = 36;
+     }
+diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
+index 4893cf7..7d05b82 100644
+--- a/hw/nvme/ctrl.c
++++ b/hw/nvme/ctrl.c
+@@ -9268,7 +9268,7 @@ static void nvme_init_ctrl(NvmeCtrl *n, PCIDevice *pci_dev)
+     id->vid = cpu_to_le16(pci_get_word(pci_conf + PCI_VENDOR_ID));
+     id->ssvid = cpu_to_le16(pci_get_word(pci_conf + PCI_SUBSYSTEM_VENDOR_ID));
+     strpadcpy((char *)id->mn, sizeof(id->mn),
+-              n->params.model ? n->params.model : "QEMU NVMe Ctrl", ' ');
++              n->params.model ? n->params.model : "NVMe Ctrl", ' ');
+     strpadcpy((char *)id->fr, sizeof(id->fr),
+               n->params.firmware_version ? n->params.firmware_version : QEMU_VERSION, ' ');
+     strpadcpy((char *)id->sn, sizeof(id->sn), n->params.serial, ' ');

patches/qemu/03-pci-ids.patch

@@ -0,0 +1,181 @@
+Subject: [PATCH] pci-ids: PCI_VENDOR / DEVICES
+
+Targets VMAware check: PCI_VENDOR / DEVICES
+
+PCI vendor, device and subsystem IDs that read as Red Hat / QEMU, and the
+ICH9 southbridge layout OVMF expects to find at 1f:0.
+
+Applies to QEMU v11.1.1. Apply from the source root with:
+    patch -p1 < 03-pci-ids.patch
+
+---
+diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
+index f2448e9..4eea405 100644
+--- a/include/hw/pci/pci.h
++++ b/include/hw/pci/pci.h
+@@ -57,8 +57,8 @@ extern bool pci_available;
+ #define PCI_DEVICE_ID_MARVELL_GT6412X    0x4620
+ 
+ /* QEMU/Bochs VGA (0x1234) */
+-#define PCI_VENDOR_ID_QEMU               0x1234
+-#define PCI_DEVICE_ID_QEMU_VGA           0x1111
++#define PCI_VENDOR_ID_QEMU               0x1002 // "???" | AMD/ATI Vendor ID Replacement from 0x1234
++#define PCI_DEVICE_ID_QEMU_VGA           0x164e // "???" | AMD/ATI Vendor ID Replacement from 0x1111
+ #define PCI_DEVICE_ID_QEMU_IPMI          0x1112
+ 
+ /* VMWare (0x15ad) */
+@@ -77,9 +77,9 @@ extern bool pci_available;
+ #define PCI_DEVICE_ID_INTEL_82801IR      0x2922
+ 
+ /* Red Hat / Qumranet (for QEMU) -- see pci-ids.txt */
+-#define PCI_VENDOR_ID_REDHAT_QUMRANET    0x1af4
+-#define PCI_SUBVENDOR_ID_REDHAT_QUMRANET 0x1af4
+-#define PCI_SUBDEVICE_ID_QEMU            0x1100
++#define PCI_VENDOR_ID_REDHAT_QUMRANET    0x1af4 // VirtIO devices | IVSHMEM Driver | Looking Glass
++#define PCI_SUBVENDOR_ID_REDHAT_QUMRANET 0x8086 // VirtIO devices | IVSHMEM Driver | Looking Glass
++#define PCI_SUBDEVICE_ID_QEMU            0x0000 // VirtIO devices | IVSHMEM Driver | Looking Glass
+ 
+ /* legacy virtio-pci devices */
+ #define PCI_DEVICE_ID_VIRTIO_NET         0x1000
+@@ -100,21 +100,21 @@ extern bool pci_available;
+  */
+ #define PCI_DEVICE_ID_VIRTIO_10_BASE     0x1040
+ 
+-#define PCI_VENDOR_ID_REDHAT             0x1b36
+-#define PCI_DEVICE_ID_REDHAT_BRIDGE      0x0001
+-#define PCI_DEVICE_ID_REDHAT_SERIAL      0x0002
++#define PCI_VENDOR_ID_REDHAT             0x1022 // "Red Hat, Inc." | AMD Vendor ID Replacement from 0x1b36
++#define PCI_DEVICE_ID_REDHAT_BRIDGE      0x57a3 // "QEMU PCI-PCI bridge" | AMD Device ID Replacement from 0x0001 | hw/pci-bridge/pci_bridge_dev.c
++#define PCI_DEVICE_ID_REDHAT_SERIAL      0x0002 // TODO: find device_id | AMD Device ID Replacement from 0x???? | hw/char/serial-pci.c
+ #define PCI_DEVICE_ID_REDHAT_SERIAL2     0x0003
+ #define PCI_DEVICE_ID_REDHAT_SERIAL4     0x0004
+ #define PCI_DEVICE_ID_REDHAT_TEST        0x0005
+ #define PCI_DEVICE_ID_REDHAT_ROCKER      0x0006
+ #define PCI_DEVICE_ID_REDHAT_SDHCI       0x0007
+-#define PCI_DEVICE_ID_REDHAT_PCIE_HOST   0x0008
++#define PCI_DEVICE_ID_REDHAT_PCIE_HOST   0x1482 // "QEMU PCIe Host bridge" | AMD Device ID Replacement from 0x0008 | hw/pci-host/gpex.c
+ #define PCI_DEVICE_ID_REDHAT_PXB         0x0009
+ #define PCI_DEVICE_ID_REDHAT_BRIDGE_SEAT 0x000a
+ #define PCI_DEVICE_ID_REDHAT_PXB_PCIE    0x000b
+-#define PCI_DEVICE_ID_REDHAT_PCIE_RP     0x000c
+-#define PCI_DEVICE_ID_REDHAT_XHCI        0x000d
+-#define PCI_DEVICE_ID_REDHAT_PCIE_BRIDGE 0x000e
++#define PCI_DEVICE_ID_REDHAT_PCIE_RP     0x1483 // "QEMU PCIe Root Port" | AMD Device ID Replacement from 0x000c | hw/pci-bridge/gen_pcie_root_port.c
++#define PCI_DEVICE_ID_REDHAT_XHCI        0x149c // "QEMU XHCI Host Controller" | AMD Device ID Replacement from 0x000d | hw/usb/hcd-xhci-pci.c
++#define PCI_DEVICE_ID_REDHAT_PCIE_BRIDGE 0x57ad // "Red Hat, Device ID: 000E" | AMD Device ID Replacement from 0x000e | hw/pci-bridge/pcie_pci_bridge.c
+ #define PCI_DEVICE_ID_REDHAT_MDPY        0x000f
+ #define PCI_DEVICE_ID_REDHAT_NVME        0x0010
+ #define PCI_DEVICE_ID_REDHAT_PVPANIC     0x0011
+diff --git a/include/hw/pci/pci_ids.h b/include/hw/pci/pci_ids.h
+index 16034aa..5c33c9e 100644
+--- a/include/hw/pci/pci_ids.h
++++ b/include/hw/pci/pci_ids.h
+@@ -178,6 +178,7 @@
+ #define PCI_VENDOR_ID_AMD                0x1022
+ #define PCI_DEVICE_ID_AMD_LANCE          0x2000
+ #define PCI_DEVICE_ID_AMD_SCSI           0x2020
++#define PCI_DEVICE_ID_AMD_SATA           0x43f6 // SATA controller [0106] | hw/ide/ich.c
+ 
+ #define PCI_VENDOR_ID_HP                 0x103c
+ 
+@@ -241,7 +242,7 @@
+ #define PCI_DEVICE_ID_INTEL_82378        0x0484
+ #define PCI_DEVICE_ID_INTEL_82441        0x1237
+ #define PCI_DEVICE_ID_INTEL_82801AA_5    0x2415
+-#define PCI_DEVICE_ID_INTEL_82801BA_11   0x244e
++#define PCI_DEVICE_ID_INTEL_82801BA_11   0x14db // PCI bridge [0604] | hw/pci-bridge/i82801b11.c
+ #define PCI_DEVICE_ID_INTEL_82801D       0x24CD
+ #define PCI_DEVICE_ID_INTEL_ESB_9        0x25ab
+ #define PCI_DEVICE_ID_INTEL_NVME         0x5845
+diff --git a/include/hw/southbridge/ich9.h b/include/hw/southbridge/ich9.h
+index 2c35dd0..2b6a39c 100644
+--- a/include/hw/southbridge/ich9.h
++++ b/include/hw/southbridge/ich9.h
+@@ -128,7 +128,7 @@ struct ICH9LPCState {
+ #define ICH9_LPC_DEV                            31
+ #define ICH9_LPC_FUNC                           0
+ 
+-#define ICH9_A2_LPC_REVISION                    0x2
++#define ICH9_A2_LPC_REVISION                    0x51 // ISA bridge [0601] | hw/isa/lpc_ich9.c
+ #define ICH9_LPC_NB_PIRQS                       8       /* PCI A-H */
+ 
+ #define ICH9_LPC_PMBASE                         0x40
+@@ -177,7 +177,7 @@ struct ICH9LPCState {
+ #define ICH9_GPIO_GSI "gsi"
+ 
+ /* D31:F2 SATA Controller #1 */
+-#define ICH9_SATA1_DEV                          31
++#define ICH9_SATA1_DEV                          20
+ #define ICH9_SATA1_FUNC                         2
+ 
+ /* D31:F0 power management I/O registers
+@@ -213,7 +213,7 @@ struct ICH9LPCState {
+ /* D31:F3 SMBus controller */
+ #define TYPE_ICH9_SMB_DEVICE "ICH9-SMB"
+ 
+-#define ICH9_A2_SMB_REVISION                    0x02
++#define ICH9_A2_SMB_REVISION                    0x71 // SMBus [0c05] | hw/i2c/smbus_ich9.c
+ #define ICH9_SMB_PI                             0x00
+ 
+ #define ICH9_SMB_SMBMBAR0                       0x10
+@@ -230,7 +230,7 @@ struct ICH9LPCState {
+ #define ICH9_SMB_HOSTC_HST_EN                   ((uint8_t)(1 << 0))
+ 
+ /* D31:F3 SMBus I/O and memory mapped I/O registers */
+-#define ICH9_SMB_DEV                            31
++#define ICH9_SMB_DEV                            20
+ #define ICH9_SMB_FUNC                           3
+ 
+ #define ICH9_SMB_HST_STS                        0x00
+diff --git a/hw/isa/lpc_ich9.c b/hw/isa/lpc_ich9.c
+index edf9783..00365e1 100644
+--- a/hw/isa/lpc_ich9.c
++++ b/hw/isa/lpc_ich9.c
+@@ -864,7 +864,7 @@ static void build_ich9_isa_aml(AcpiDevAmlIf *adev, Aml *scope)
+     aml_append(scope, aml_operation_region("PIRQ", AML_PCI_CONFIG,
+                                            aml_int(0x60), 0x0C));
+     /* Fields declarion has to happen *after* operation region */
+-    field = aml_field("PCI0.SF8.PIRQ", AML_BYTE_ACC, AML_NOLOCK, AML_PRESERVE);
++    field = aml_field("PCI0.LPCB.PIRQ", AML_BYTE_ACC, AML_NOLOCK, AML_PRESERVE);
+     aml_append(field, aml_named_field("PRQA", 8));
+     aml_append(field, aml_named_field("PRQB", 8));
+     aml_append(field, aml_named_field("PRQC", 8));
+diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
+index f4556ad..547a901 100644
+--- a/hw/pci-host/q35.c
++++ b/hw/pci-host/q35.c
+@@ -694,7 +694,7 @@ static void mch_class_init(ObjectClass *klass, const void *data)
+     set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
+     dc->desc = "Host bridge";
+     dc->vmsd = &vmstate_mch;
+-    k->vendor_id = PCI_VENDOR_ID_INTEL;
++    k->vendor_id = PCI_VENDOR_ID_AMD;
+     /*
+      * The 'q35' machine type implements an Intel Series 3 chipset,
+      * of which there are several variants. The key difference between
+diff --git a/hw/core/qdev.c b/hw/core/qdev.c
+index e2aab3d..9131b5d 100644
+--- a/hw/core/qdev.c
++++ b/hw/core/qdev.c
+@@ -765,7 +765,7 @@ static void device_class_init(ObjectClass *class, const void *data)
+      * hotpluggable. Devices that shouldn't be hotpluggable,
+      * should override it in their class_init()
+      */
+-    dc->hotpluggable = true;
++    dc->hotpluggable = false;
+     dc->user_creatable = true;
+     vc->get_id = device_vmstate_if_get_id;
+     rc->get_state = device_get_reset_state;
+diff --git a/hw/i386/pc.c b/hw/i386/pc.c
+index f064aa2..cfdbbc1 100644
+--- a/hw/i386/pc.c
++++ b/hw/i386/pc.c
+@@ -1689,7 +1689,7 @@ static void pc_machine_class_init(ObjectClass *oc, const void *data)
+ 
+     pcmc->pci_enabled = true;
+     pcmc->has_acpi_build = true;
+-    pcmc->smbios_defaults = true;
++    pcmc->smbios_defaults = false;
+     pcmc->gigabyte_align = true;
+     pcmc->has_reserved_memory = true;
+     pcmc->enforce_amd_1tb_hole = true;

patches/qemu/04-fw-cfg.patch

@@ -0,0 +1,58 @@
+Subject: [PATCH] fw-cfg: QEMU_FW_CFG
+
+Targets VMAware check: QEMU_FW_CFG
+
+The fw_cfg device signature, which names QEMU literally.
+
+Applies to QEMU v11.1.1. Apply from the source root with:
+    patch -p1 < 04-fw-cfg.patch
+
+---
+diff --git a/hw/i386/fw_cfg.c b/hw/i386/fw_cfg.c
+index 5903994..e5fddbc 100644
+--- a/hw/i386/fw_cfg.c
++++ b/hw/i386/fw_cfg.c
+@@ -77,7 +77,7 @@ void fw_cfg_build_smbios(PCMachineState *pcms, FWCfgState *fw_cfg,
+ 
+     if (pcmc->smbios_defaults) {
+         /* These values are guest ABI, do not change */
+-        smbios_set_defaults("QEMU", mc->desc, mc->name);
++        smbios_set_defaults("Unknown", mc->desc, mc->name);
+     }
+ 
+     /* tell smbios about cpuid version and features */
+diff --git a/hw/nvram/fw_cfg.c b/hw/nvram/fw_cfg.c
+index b057d87..a253fe8 100644
+--- a/hw/nvram/fw_cfg.c
++++ b/hw/nvram/fw_cfg.c
+@@ -56,7 +56,7 @@
+ #define FW_CFG_DMA_CTL_SELECT  0x08
+ #define FW_CFG_DMA_CTL_WRITE   0x10
+ 
+-#define FW_CFG_DMA_SIGNATURE 0x51454d5520434647ULL /* "QEMU CFG" */
++#define FW_CFG_DMA_SIGNATURE 0x51434f4d20434647ULL /* "QCOM CFG" */
+ 
+ struct FWCfgEntry {
+     uint32_t len;
+@@ -1002,7 +1002,7 @@ static void fw_cfg_common_realize(DeviceState *dev, Error **errp)
+         return;
+     }
+ 
+-    fw_cfg_add_bytes(s, FW_CFG_SIGNATURE, (char *)"QEMU", 4);
++    fw_cfg_add_bytes(s, FW_CFG_SIGNATURE, (char *)"QEMU", 4); // "QEMU"
+     fw_cfg_add_bytes(s, FW_CFG_UUID, &qemu_uuid, 16);
+     fw_cfg_add_i16(s, FW_CFG_NOGRAPHIC, (uint16_t)!machine->enable_graphics);
+     fw_cfg_add_i16(s, FW_CFG_BOOT_MENU, (uint16_t)(machine->boot_config.has_menu && machine->boot_config.menu));
+diff --git a/include/standard-headers/linux/qemu_fw_cfg.h b/include/standard-headers/linux/qemu_fw_cfg.h
+index cb93f66..0527126 100644
+--- a/include/standard-headers/linux/qemu_fw_cfg.h
++++ b/include/standard-headers/linux/qemu_fw_cfg.h
+@@ -71,7 +71,7 @@ struct fw_cfg_file {
+ #define FW_CFG_DMA_CTL_SELECT	0x08
+ #define FW_CFG_DMA_CTL_WRITE	0x10
+ 
+-#define FW_CFG_DMA_SIGNATURE    0x51454d5520434647ULL /* "QEMU CFG" */
++#define FW_CFG_DMA_SIGNATURE    0x51434f4d20434647ULL /* "QCOM CFG" */
+ 
+ /* Control as first field allows for different structures selected by this
+  * field, which might be useful in the future

patches/qemu/05-usb-hid.patch

@@ -0,0 +1,111 @@
+Subject: [PATCH] usb-hid: QEMU_USB
+
+Targets VMAware check: QEMU_USB
+
+USB HID descriptors carrying QEMU vendor strings and product IDs.
+
+Applies to QEMU v11.1.1. Apply from the source root with:
+    patch -p1 < 05-usb-hid.patch
+
+---
+diff --git a/hw/usb/dev-hid.c b/hw/usb/dev-hid.c
+index ae19d60..9fe1223 100644
+--- a/hw/usb/dev-hid.c
++++ b/hw/usb/dev-hid.c
+@@ -63,17 +63,17 @@ enum {
+ };
+ 
+ static const USBDescStrings desc_strings = {
+-    [STR_MANUFACTURER]     = "QEMU",
+-    [STR_PRODUCT_MOUSE]    = "QEMU USB Mouse",
+-    [STR_PRODUCT_TABLET]   = "QEMU USB Tablet",
+-    [STR_PRODUCT_KEYBOARD] = "QEMU USB Keyboard",
+-    [STR_SERIAL_COMPAT]    = "42",
++    [STR_MANUFACTURER]     = "Logitech",
++    [STR_PRODUCT_MOUSE]    = "USB Mouse",
++    [STR_PRODUCT_TABLET]   = "USB Tablet",
++    [STR_PRODUCT_KEYBOARD] = "USB Keyboard",
++    [STR_SERIAL_COMPAT]    = "",
+     [STR_CONFIG_MOUSE]     = "HID Mouse",
+     [STR_CONFIG_TABLET]    = "HID Tablet",
+     [STR_CONFIG_KEYBOARD]  = "HID Keyboard",
+-    [STR_SERIAL_MOUSE]     = "89126",
+-    [STR_SERIAL_TABLET]    = "28754",
+-    [STR_SERIAL_KEYBOARD]  = "68284",
++    [STR_SERIAL_MOUSE]     = "",
++    [STR_SERIAL_TABLET]    = "",
++    [STR_SERIAL_KEYBOARD]  = "",
+ };
+ 
+ static const USBDescIface desc_iface_mouse = {
+@@ -368,8 +368,8 @@ static const USBDescMSOS desc_msos_suspend = {
+ 
+ static const USBDesc desc_mouse = {
+     .id = {
+-        .idVendor          = 0x0627,
+-        .idProduct         = 0x0001,
++        .idVendor          = 0x046D,
++        .idProduct         = 0xC077,
+         .bcdDevice         = 0,
+         .iManufacturer     = STR_MANUFACTURER,
+         .iProduct          = STR_PRODUCT_MOUSE,
+@@ -382,8 +382,8 @@ static const USBDesc desc_mouse = {
+ 
+ static const USBDesc desc_mouse2 = {
+     .id = {
+-        .idVendor          = 0x0627,
+-        .idProduct         = 0x0001,
++        .idVendor          = 0x046D,
++        .idProduct         = 0xC077,
+         .bcdDevice         = 0,
+         .iManufacturer     = STR_MANUFACTURER,
+         .iProduct          = STR_PRODUCT_MOUSE,
+@@ -426,8 +426,8 @@ static const USBDesc desc_tablet2 = {
+ 
+ static const USBDesc desc_keyboard = {
+     .id = {
+-        .idVendor          = 0x0627,
+-        .idProduct         = 0x0001,
++        .idVendor          = 0x046D,
++        .idProduct         = 0xC31C,
+         .bcdDevice         = 0,
+         .iManufacturer     = STR_MANUFACTURER,
+         .iProduct          = STR_PRODUCT_KEYBOARD,
+@@ -440,8 +440,8 @@ static const USBDesc desc_keyboard = {
+ 
+ static const USBDesc desc_keyboard2 = {
+     .id = {
+-        .idVendor          = 0x0627,
+-        .idProduct         = 0x0001,
++        .idVendor          = 0x046D,
++        .idProduct         = 0xC31C,
+         .bcdDevice         = 0,
+         .iManufacturer     = STR_MANUFACTURER,
+         .iProduct          = STR_PRODUCT_KEYBOARD,
+@@ -805,7 +805,7 @@ static void usb_tablet_class_initfn(ObjectClass *klass, const void *data)
+     USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
+ 
+     uc->realize        = usb_tablet_realize;
+-    uc->product_desc   = "QEMU USB Tablet";
++    uc->product_desc   = "USB Tablet";
+     dc->vmsd = &vmstate_usb_ptr;
+     device_class_set_props(dc, usb_tablet_properties);
+     set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
+@@ -827,7 +827,7 @@ static void usb_mouse_class_initfn(ObjectClass *klass, const void *data)
+     USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
+ 
+     uc->realize        = usb_mouse_realize;
+-    uc->product_desc   = "QEMU USB Mouse";
++    uc->product_desc   = "USB Mouse";
+     dc->vmsd = &vmstate_usb_ptr;
+     device_class_set_props(dc, usb_mouse_properties);
+     set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
+@@ -850,7 +850,7 @@ static void usb_keyboard_class_initfn(ObjectClass *klass, const void *data)
+     USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
+ 
+     uc->realize        = usb_keyboard_realize;
+-    uc->product_desc   = "QEMU USB Keyboard";
++    uc->product_desc   = "USB Keyboard";
+     dc->vmsd = &vmstate_usb_kbd;
+     device_class_set_props(dc, usb_keyboard_properties);
+     set_bit(DEVICE_CATEGORY_INPUT, dc->categories);

patches/qemu/06-audio.patch

@@ -0,0 +1,58 @@
+Subject: [PATCH] audio: DEVICES
+
+Targets VMAware check: DEVICES
+
+Intel HDA codec and controller identity strings.
+
+Applies to QEMU v11.1.1. Apply from the source root with:
+    patch -p1 < 06-audio.patch
+
+---
+diff --git a/hw/audio/hda-codec.c b/hw/audio/hda-codec.c
+index 173fe56..4d8a73b 100644
+--- a/hw/audio/hda-codec.c
++++ b/hw/audio/hda-codec.c
+@@ -118,7 +118,7 @@ static void hda_codec_parse_fmt(uint32_t format, struct audsettings *as)
+ 
+ /* some defines */
+ 
+-#define QEMU_HDA_ID_VENDOR  0x1af4
++#define QEMU_HDA_ID_VENDOR  0x10ec /* Realtek HDA Codec Vendor ID */
+ #define QEMU_HDA_PCM_FORMATS (AC_SUPPCM_BITS_16 |       \
+                               0x1fc /* 16 -> 96 kHz */)
+ #define QEMU_HDA_AMP_NONE    (0)
+diff --git a/hw/audio/intel-hda.c b/hw/audio/intel-hda.c
+index 3d361a4..66c4e3b 100644
+--- a/hw/audio/intel-hda.c
++++ b/hw/audio/intel-hda.c
+@@ -1230,7 +1230,7 @@ static void intel_hda_class_init(ObjectClass *klass, const void *data)
+ 
+     k->realize = intel_hda_realize;
+     k->exit = intel_hda_exit;
+-    k->vendor_id = PCI_VENDOR_ID_INTEL;
++    k->vendor_id = PCI_VENDOR_ID_AMD;
+     k->class_id = PCI_CLASS_MULTIMEDIA_HD_AUDIO;
+     device_class_set_legacy_reset(dc, intel_hda_reset);
+     dc->vmsd = &vmstate_intel_hda;
+@@ -1242,8 +1242,8 @@ static void intel_hda_class_init_ich6(ObjectClass *klass, const void *data)
+     DeviceClass *dc = DEVICE_CLASS(klass);
+     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+ 
+-    k->device_id = 0x2668;
+-    k->revision = 1;
++    k->device_id = 0x15e3; // AMD - Ryzen HD Audio Controller
++    k->revision = 0;
+     set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
+     dc->desc = "Intel HD Audio Controller (ich6)";
+ }
+@@ -1253,8 +1253,8 @@ static void intel_hda_class_init_ich9(ObjectClass *klass, const void *data)
+     DeviceClass *dc = DEVICE_CLASS(klass);
+     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+ 
+-    k->device_id = 0x293e;
+-    k->revision = 3;
++    k->device_id = 0x15e3; // AMD - Ryzen HD Audio Controller
++    k->revision = 0;
+     set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
+     dc->desc = "Intel HD Audio Controller (ich9)";
+ }

patches/qemu/07-edid.patch

@@ -0,0 +1,62 @@
+Subject: [PATCH] edid: (display identity)
+
+Targets VMAware check: (display identity)
+
+Generated EDID vendor and model. Note VMAware does not read EDID - this is
+carried for other detectors, not for the score.
+
+Applies to QEMU v11.1.1. Apply from the source root with:
+    patch -p1 < 07-edid.patch
+
+---
+diff --git a/hw/display/edid-generate.c b/hw/display/edid-generate.c
+index 2cb8196..45003e8 100644
+--- a/hw/display/edid-generate.c
++++ b/hw/display/edid-generate.c
+@@ -388,22 +388,22 @@ void qemu_edid_generate(uint8_t *edid, size_t size,
+     uint8_t *did = NULL;
+     uint32_t width_mm, height_mm;
+     uint32_t refresh_rate = info->refresh_rate ? info->refresh_rate : 75000;
+-    uint32_t dpi = 100; /* if no width_mm/height_mm */
++    uint32_t dpi = 93; /* if no width_mm/height_mm */
+     uint32_t large_screen = 0;
+ 
+     /* =============== set defaults  =============== */
+ 
+     if (!info->vendor || strlen(info->vendor) != 3) {
+-        info->vendor = "RHT";
++        info->vendor = "SAM";
+     }
+     if (!info->name) {
+-        info->name = "QEMU Monitor";
++        info->name = "SyncMaster";
+     }
+     if (!info->prefx) {
+-        info->prefx = 1280;
++        info->prefx = 1920;
+     }
+     if (!info->prefy) {
+-        info->prefy = 800;
++        info->prefy = 1080;
+     }
+     if (info->width_mm && info->height_mm) {
+         width_mm = info->width_mm;
+@@ -449,15 +449,15 @@ void qemu_edid_generate(uint8_t *edid, size_t size,
+     uint16_t vendor_id = ((((info->vendor[0] - '@') & 0x1f) << 10) |
+                           (((info->vendor[1] - '@') & 0x1f) <<  5) |
+                           (((info->vendor[2] - '@') & 0x1f) <<  0));
+-    uint16_t model_nr = 0x1234;
++    uint16_t model_nr = 0x0dca;
+     uint32_t serial_nr = info->serial ? atoi(info->serial) : 0;
+     stw_be_p(edid +  8, vendor_id);
+     stw_le_p(edid + 10, model_nr);
+     stl_le_p(edid + 12, serial_nr);
+ 
+     /* manufacture week and year */
+-    edid[16] = 42;
+-    edid[17] = 2014 - 1990;
++    edid[16] = 17;
++    edid[17] = 2018 - 1990;
+ 
+     /* edid version */
+     edid[18] = 1;

patches/qemu/08-cpu-misc.patch

@@ -0,0 +1,110 @@
+Subject: [PATCH] cpu-misc: (CPU model plumbing)
+
+Targets VMAware check: (CPU model plumbing)
+
+CPU feature-word plumbing and an upstream backport; not aimed at a check.
+
+Applies to QEMU v11.1.1. Apply from the source root with:
+    patch -p1 < 08-cpu-misc.patch
+
+---
+diff --git a/target/i386/cpu.c b/target/i386/cpu.c
+index 5805d33..1b0203e 100644
+--- a/target/i386/cpu.c
++++ b/target/i386/cpu.c
+@@ -1009,6 +1009,7 @@ void x86_cpu_vendor_words2str(char *dst, uint32_t vendor1,
+ #define TCG_7_2_EDX_FEATURES 0
+ #define TCG_APM_FEATURES 0
+ #define TCG_6_EAX_FEATURES CPUID_6_EAX_ARAT
++#define TCG_6_ECX_FEATURES 0
+ #define TCG_XSAVE_FEATURES (CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XGETBV1)
+           /* missing:
+           CPUID_XSAVE_XSAVEC, CPUID_XSAVE_XSAVES */
+@@ -1545,6 +1546,21 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
+         .cpuid = { .eax = 6, .reg = R_EAX, },
+         .tcg_features = TCG_6_EAX_FEATURES,
+     },
++    [FEAT_6_ECX] = {
++        .type = CPUID_FEATURE_WORD,
++        .feat_names = {
++            "aperfmperf", NULL, NULL, NULL,
++            NULL, NULL, NULL, NULL,
++            NULL, NULL, NULL, NULL,
++            NULL, NULL, NULL, NULL,
++            NULL, NULL, NULL, NULL,
++            NULL, NULL, NULL, NULL,
++            NULL, NULL, NULL, NULL,
++            NULL, NULL, NULL, NULL,
++        },
++        .cpuid = { .eax = 6, .reg = R_ECX, },
++        .tcg_features = TCG_6_ECX_FEATURES,
++    },
+     [FEAT_XSAVE_XCR0_LO] = {
+         .type = CPUID_FEATURE_WORD,
+         .cpuid = {
+@@ -8778,7 +8794,7 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
+         /* Thermal and Power Leaf */
+         *eax = env->features[FEAT_6_EAX];
+         *ebx = 0;
+-        *ecx = 0;
++        *ecx = env->features[FEAT_6_ECX];
+         *edx = 0;
+         break;
+     case 7:
+@@ -9809,6 +9825,7 @@ void x86_cpu_expand_features(X86CPU *cpu, Error **errp)
+     x86_cpu_adjust_feat_level(cpu, FEAT_1_EDX);
+     x86_cpu_adjust_feat_level(cpu, FEAT_1_ECX);
+     x86_cpu_adjust_feat_level(cpu, FEAT_6_EAX);
++    x86_cpu_adjust_feat_level(cpu, FEAT_6_ECX);
+     x86_cpu_adjust_feat_level(cpu, FEAT_7_0_ECX);
+     x86_cpu_adjust_feat_level(cpu, FEAT_7_1_EAX);
+     x86_cpu_adjust_feat_level(cpu, FEAT_7_1_ECX);
+diff --git a/target/i386/cpu.h b/target/i386/cpu.h
+index e6a1976..2a6dbbf 100644
+--- a/target/i386/cpu.h
++++ b/target/i386/cpu.h
+@@ -700,6 +700,7 @@ typedef enum FeatureWord {
+     FEAT_SVM,           /* CPUID[8000_000A].EDX */
+     FEAT_XSAVE,         /* CPUID[EAX=0xd,ECX=1].EAX */
+     FEAT_6_EAX,         /* CPUID[6].EAX */
++    FEAT_6_ECX,         /* CPUID[6].ECX */
+     FEAT_XSAVE_XCR0_LO, /* CPUID[EAX=0xd,ECX=0].EAX */
+     FEAT_XSAVE_XCR0_HI, /* CPUID[EAX=0xd,ECX=0].EDX */
+     FEAT_ARCH_CAPABILITIES,
+@@ -1232,6 +1233,7 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w);
+ #define CPUID_XSAVE_XFD        (1U << 4)
+ 
+ #define CPUID_6_EAX_ARAT       (1U << 2)
++#define CPUID_6_ECX_APERFMPERF (1U << 0)
+ 
+ /* CPUID[0x80000007].EDX flags: */
+ #define CPUID_APM_INVTSC       (1U << 8)
+diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
+index 644c45f..6f6862e 100644
+--- a/target/i386/kvm/kvm.c
++++ b/target/i386/kvm/kvm.c
+@@ -499,6 +499,14 @@ uint32_t kvm_arch_get_supported_cpuid(KVMState *s, uint32_t function,
+         }
+     } else if (function == 6 && reg == R_EAX) {
+         ret |= CPUID_6_EAX_ARAT; /* safe to allow because of emulated APIC */
++    } else if (function == 6 && reg == R_ECX) {
++        if (enable_cpu_pm) {
++            int disable_exits = kvm_check_extension(s,
++                                                    KVM_CAP_X86_DISABLE_EXITS);
++            if (disable_exits & KVM_X86_DISABLE_EXITS_APERFMPERF) {
++                ret |= CPUID_6_ECX_APERFMPERF;
++            }
++        }
+     } else if (function == 7 && index == 0 && reg == R_EBX) {
+         /* Not new instructions, just an optimization.  */
+         uint32_t ebx;
+@@ -3292,7 +3300,8 @@ static int kvm_vm_enable_disable_exits(KVMState *s)
+         disable_exits &= (KVM_X86_DISABLE_EXITS_MWAIT |
+                           KVM_X86_DISABLE_EXITS_HLT |
+                           KVM_X86_DISABLE_EXITS_PAUSE |
+-                          KVM_X86_DISABLE_EXITS_CSTATE);
++                          KVM_X86_DISABLE_EXITS_CSTATE |
++                          KVM_X86_DISABLE_EXITS_APERFMPERF);
+     }
+ 
+     return kvm_vm_enable_cap(s, KVM_CAP_X86_DISABLE_EXITS, 0,