--- /dev/null
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Fri, 10 Sep 2021 11:42:03 +0200
+Subject: [PATCH] qxl: fix pre-save logic
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Oops. Logic is backwards.
+
+Fixes: 39b8a183e2f3 ("qxl: remove assert in qxl_pre_save.")
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/610
+Resolves: https://bugzilla.redhat.com//show_bug.cgi?id=2002907
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
+Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
+Message-Id: <20210910094203.3582378-1-kraxel@redhat.com>
+---
+ hw/display/qxl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/hw/display/qxl.c b/hw/display/qxl.c
+index 43482d4364..29c80b4289 100644
+--- a/hw/display/qxl.c
++++ b/hw/display/qxl.c
+@@ -2252,7 +2252,7 @@ static int qxl_pre_save(void *opaque)
+ } else {
+ d->last_release_offset = (uint8_t *)d->last_release - ram_start;
+ }
+- if (d->last_release_offset < d->vga.vram_size) {
++ if (d->last_release_offset >= d->vga.vram_size) {
+ return 1;
+ }
+
extra/0003-monitor-hmp-add-support-for-flag-argument-with-value.patch
extra/0004-monitor-refactor-set-expire_password-and-allow-VNC-d.patch
extra/0005-monitor-hmp-correctly-invert-password-argument-detec.patch
+extra/0006-qxl-fix-pre-save-logic.patch
bitmap-mirror/0001-drive-mirror-add-support-for-sync-bitmap-mode-never.patch
bitmap-mirror/0002-drive-mirror-add-support-for-conditional-and-always-.patch
bitmap-mirror/0003-mirror-add-check-for-bitmap-mode-without-bitmap.patch