Add Vitastor support

Makefile

@@ -58,7 +58,7 @@ $(BUILDDIR): submodule
 deb kvm: $(DEBS)
 $(DEB_DBG): $(DEB)
 $(DEB): $(BUILDDIR)
-	cd $(BUILDDIR); dpkg-buildpackage -b -us -uc
+	cd $(BUILDDIR); dpkg-buildpackage -b -us -uc -j32
 	lintian $(DEBS)
 
 sbuild: $(DSC)

debian/changelog

@@ -1,52 +1,8 @@
-pve-qemu-kvm (9.0.2-1) bookworm; urgency=medium
+pve-qemu-kvm (9.0.0-2+vitastor1) bookworm; urgency=medium
 
-  * update submodule and patches to QEMU 9.0.2. While our version had most
+  * Add Vitastor support
-    stable fixes included already, there are new fixes for VirtIO and VGA
-    display screen blanking (#4786)
 
-  * backport fix for a regression with the LSI-53c895a controller and one for
+ -- Vitaliy Filippov <vitalif@yourcmc.ru>  Mon, 20 May 2024 19:53:28 +0300
-    the boot order getting ignored for USB storage
-
- -- Proxmox Support Team <support@proxmox.com>  Mon, 29 Jul 2024 18:59:40 +0200
-
-pve-qemu-kvm (9.0.0-6) bookworm; urgency=medium
-
-  * fix a regression in the zeroinit block driver that prevented importing and
-    cloning disks to RBD storages which are not using the krbd setting
-
- -- Proxmox Support Team <support@proxmox.com>  Mon, 08 Jul 2024 16:11:15 +0200
-
-pve-qemu-kvm (9.0.0-5) bookworm; urgency=medium
-
-  * backport fix for CVE-2024-4467 to prevent malicious qcow2 image files from
-    already causing bad effects if being queried via 'qemu-img info'. For
-    Proxmox VE, this is an additional safe guard, as currently it directly
-    creates and manages the qcow2 images used by VMs and does not allow
-    unprivileged users to import them
-
-  * fix #4726: code cleanup: avoid superfluous check in vma backup code
-
- -- Proxmox Support Team <support@proxmox.com>  Wed, 03 Jul 2024 13:13:35 +0200
-
-pve-qemu-kvm (9.0.0-4) bookworm; urgency=medium
-
-  * fix crash after saving a snapshot without including VM state when a VirtIO
-    block device with iothread is configured.
-
-  * fix edge case in error handling when opening a block device from PBS fails
-
-  * minor code cleanup in backup code
-
- -- Proxmox Support Team <support@proxmox.com>  Mon, 01 Jul 2024 11:26:11 +0200
-
-pve-qemu-kvm (9.0.0-3) bookworm; urgency=medium
-
-  * fix crash when doing resize after hotplugging a disk using io_uring
-
-  * fix some minor issues in software CPU emulation (i.e. non-KVM) for ARM and
-    x86(_64)
-
- -- Proxmox Support Team <support@proxmox.com>  Wed, 29 May 2024 15:55:44 +0200
 
 pve-qemu-kvm (9.0.0-2) bookworm; urgency=medium
 

debian/control

@@ -59,6 +59,7 @@ Depends: ceph-common (>= 0.48),
          libspice-server1 (>= 0.14.0~),
          libusb-1.0-0 (>= 1.0.17-1),
          libusbredirparser1 (>= 0.6-2),
+         vitastor-client (>= 0.9.4),
          libuuid1,
          ${misc:Depends},
          ${shlibs:Depends},

debian/patches/bitmap-mirror/0001-drive-mirror-add-support-for-sync-bitmap-mode-never.patch

@@ -258,7 +258,7 @@ index 1bdce3b657..0c5c72df2e 100644
                       errp);
      if (!job) {
 diff --git a/blockdev.c b/blockdev.c
-index 4c33c3f5f0..f3e508a6a7 100644
+index 057601dcf0..8682814a7a 100644
 --- a/blockdev.c
 +++ b/blockdev.c
 @@ -2776,6 +2776,9 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
@@ -349,7 +349,7 @@ index 4c33c3f5f0..f3e508a6a7 100644
                             has_granularity, granularity,
                             has_buf_size, buf_size,
 diff --git a/include/block/block_int-global-state.h b/include/block/block_int-global-state.h
-index eb2d92a226..f0c642b194 100644
+index d2201e27f4..cc1387ae02 100644
 --- a/include/block/block_int-global-state.h
 +++ b/include/block/block_int-global-state.h
 @@ -158,7 +158,9 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
@@ -364,7 +364,7 @@ index eb2d92a226..f0c642b194 100644
                    BlockdevOnError on_source_error,
                    BlockdevOnError on_target_error,
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index b179d65520..905da8be72 100644
+index 746d1694c2..45ab548dfe 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
 @@ -2174,6 +2174,15 @@

debian/patches/bitmap-mirror/0003-mirror-add-check-for-bitmap-mode-without-bitmap.patch

@@ -16,7 +16,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 3 insertions(+)
 
 diff --git a/blockdev.c b/blockdev.c
-index f3e508a6a7..37b8437f3e 100644
+index 8682814a7a..5b75a085ee 100644
 --- a/blockdev.c
 +++ b/blockdev.c
 @@ -2873,6 +2873,9 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,

debian/patches/bitmap-mirror/0006-mirror-move-some-checks-to-qmp.patch

@@ -62,7 +62,7 @@ index 6b3cce1007..2f1223852b 100644
  
          if (bitmap_mode != BITMAP_SYNC_MODE_NEVER) {
 diff --git a/blockdev.c b/blockdev.c
-index 37b8437f3e..ed8198f351 100644
+index 5b75a085ee..d27d8c38ec 100644
 --- a/blockdev.c
 +++ b/blockdev.c
 @@ -2852,7 +2852,36 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,

debian/patches/extra/0001-monitor-qmp-fix-race-with-clients-disconnecting-earl.patch

@@ -144,7 +144,7 @@ index a239945e8d..589c9524f8 100644
          monitor_qmp_caps_reset(mon);
          data = qmp_greeting(mon);
 diff --git a/qapi/qmp-dispatch.c b/qapi/qmp-dispatch.c
-index 176b549473..790bb7d1da 100644
+index f3488afeef..2624eb3470 100644
 --- a/qapi/qmp-dispatch.c
 +++ b/qapi/qmp-dispatch.c
 @@ -117,16 +117,28 @@ typedef struct QmpDispatchBH {
@@ -180,7 +180,7 @@ index 176b549473..790bb7d1da 100644
      aio_co_wake(data->co);
  }
  
-@@ -253,6 +265,7 @@ QDict *coroutine_mixed_fn qmp_dispatch(const QmpCommandList *cmds, QObject *requ
+@@ -250,6 +262,7 @@ QDict *coroutine_mixed_fn qmp_dispatch(const QmpCommandList *cmds, QObject *requ
              .ret        = &ret,
              .errp       = &err,
              .co         = qemu_coroutine_self(),

debian/patches/extra/0006-virtio-gpu-fix-v2-migration.patch

@@ -0,0 +1,98 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
+Date: Thu, 16 May 2024 12:40:22 +0400
+Subject: [PATCH] virtio-gpu: fix v2 migration
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Commit dfcf74fa ("virtio-gpu: fix scanout migration post-load") broke
+forward/backward version migration. Versioning of nested VMSD structures
+is not straightforward, as the wire format doesn't have nested
+structures versions. Introduce x-scanout-vmstate-version and a field
+test to save/load appropriately according to the machine version.
+
+Fixes: dfcf74fa ("virtio-gpu: fix scanout migration post-load")
+Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
+Signed-off-by: Peter Xu <peterx@redhat.com>
+---
+ hw/core/machine.c              |  1 +
+ hw/display/virtio-gpu.c        | 24 ++++++++++++++++--------
+ include/hw/virtio/virtio-gpu.h |  1 +
+ 3 files changed, 18 insertions(+), 8 deletions(-)
+
+diff --git a/hw/core/machine.c b/hw/core/machine.c
+index 37ede0e7d4..d33a37a6f6 100644
+--- a/hw/core/machine.c
++++ b/hw/core/machine.c
+@@ -37,6 +37,7 @@ GlobalProperty hw_compat_8_2[] = {
+     { "migration", "zero-page-detection", "legacy"},
+     { TYPE_VIRTIO_IOMMU_PCI, "granule", "4k" },
+     { TYPE_VIRTIO_IOMMU_PCI, "aw-bits", "64" },
++    { "virtio-gpu-device", "x-scanout-vmstate-version", "1" },
+ };
+ const size_t hw_compat_8_2_len = G_N_ELEMENTS(hw_compat_8_2);
+ 
+diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
+index ae831b6b3e..85323daf99 100644
+--- a/hw/display/virtio-gpu.c
++++ b/hw/display/virtio-gpu.c
+@@ -1166,10 +1166,17 @@ static void virtio_gpu_cursor_bh(void *opaque)
+     virtio_gpu_handle_cursor(&g->parent_obj.parent_obj, g->cursor_vq);
+ }
+ 
++static bool scanout_vmstate_after_v2(void *opaque, int version)
++{
++    struct VirtIOGPUBase *base = container_of(opaque, VirtIOGPUBase, scanout);
++    struct VirtIOGPU *gpu = container_of(base, VirtIOGPU, parent_obj);
++
++    return gpu->scanout_vmstate_version >= 2;
++}
++
+ static const VMStateDescription vmstate_virtio_gpu_scanout = {
+     .name = "virtio-gpu-one-scanout",
+-    .version_id = 2,
+-    .minimum_version_id = 1,
++    .version_id = 1,
+     .fields = (const VMStateField[]) {
+         VMSTATE_UINT32(resource_id, struct virtio_gpu_scanout),
+         VMSTATE_UINT32(width, struct virtio_gpu_scanout),
+@@ -1181,12 +1188,12 @@ static const VMStateDescription vmstate_virtio_gpu_scanout = {
+         VMSTATE_UINT32(cursor.hot_y, struct virtio_gpu_scanout),
+         VMSTATE_UINT32(cursor.pos.x, struct virtio_gpu_scanout),
+         VMSTATE_UINT32(cursor.pos.y, struct virtio_gpu_scanout),
+-        VMSTATE_UINT32_V(fb.format, struct virtio_gpu_scanout, 2),
+-        VMSTATE_UINT32_V(fb.bytes_pp, struct virtio_gpu_scanout, 2),
+-        VMSTATE_UINT32_V(fb.width, struct virtio_gpu_scanout, 2),
+-        VMSTATE_UINT32_V(fb.height, struct virtio_gpu_scanout, 2),
+-        VMSTATE_UINT32_V(fb.stride, struct virtio_gpu_scanout, 2),
+-        VMSTATE_UINT32_V(fb.offset, struct virtio_gpu_scanout, 2),
++        VMSTATE_UINT32_TEST(fb.format, struct virtio_gpu_scanout, scanout_vmstate_after_v2),
++        VMSTATE_UINT32_TEST(fb.bytes_pp, struct virtio_gpu_scanout, scanout_vmstate_after_v2),
++        VMSTATE_UINT32_TEST(fb.width, struct virtio_gpu_scanout, scanout_vmstate_after_v2),
++        VMSTATE_UINT32_TEST(fb.height, struct virtio_gpu_scanout, scanout_vmstate_after_v2),
++        VMSTATE_UINT32_TEST(fb.stride, struct virtio_gpu_scanout, scanout_vmstate_after_v2),
++        VMSTATE_UINT32_TEST(fb.offset, struct virtio_gpu_scanout, scanout_vmstate_after_v2),
+         VMSTATE_END_OF_LIST()
+     },
+ };
+@@ -1659,6 +1666,7 @@ static Property virtio_gpu_properties[] = {
+     DEFINE_PROP_BIT("blob", VirtIOGPU, parent_obj.conf.flags,
+                     VIRTIO_GPU_FLAG_BLOB_ENABLED, false),
+     DEFINE_PROP_SIZE("hostmem", VirtIOGPU, parent_obj.conf.hostmem, 0),
++    DEFINE_PROP_UINT8("x-scanout-vmstate-version", VirtIOGPU, scanout_vmstate_version, 2),
+     DEFINE_PROP_END_OF_LIST(),
+ };
+ 
+diff --git a/include/hw/virtio/virtio-gpu.h b/include/hw/virtio/virtio-gpu.h
+index ed44cdad6b..842315d51d 100644
+--- a/include/hw/virtio/virtio-gpu.h
++++ b/include/hw/virtio/virtio-gpu.h
+@@ -177,6 +177,7 @@ typedef struct VGPUDMABuf {
+ struct VirtIOGPU {
+     VirtIOGPUBase parent_obj;
+ 
++    uint8_t scanout_vmstate_version;
+     uint64_t conf_max_hostmem;
+ 
+     VirtQueue *ctrl_vq;

debian/patches/extra/0007-hw-pflash-fix-block-write-start.patch

@@ -0,0 +1,59 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Thu, 16 May 2024 10:46:34 +0200
+Subject: [PATCH] hw/pflash: fix block write start
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Move the pflash_blk_write_start() call.  We need the offset of the
+first data write, not the offset for the setup (number-of-bytes)
+write.  Without this fix u-boot can do block writes to the first
+flash block only.
+
+While being at it drop a leftover FIXME.
+
+Cc: qemu-stable@nongnu.org
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2343
+Fixes: fcc79f2e0955 ("hw/pflash: implement update buffer for block writes")
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+(picked up from https://lists.nongnu.org/archive/html/qemu-stable/2024-05/msg00091.html)
+Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
+---
+ hw/block/pflash_cfi01.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/hw/block/pflash_cfi01.c b/hw/block/pflash_cfi01.c
+index 1bda8424b9..c8f1cf5a87 100644
+--- a/hw/block/pflash_cfi01.c
++++ b/hw/block/pflash_cfi01.c
+@@ -518,10 +518,6 @@ static void pflash_write(PFlashCFI01 *pfl, hwaddr offset,
+             break;
+         case 0xe8: /* Write to buffer */
+             trace_pflash_write(pfl->name, "write to buffer");
+-            /* FIXME should save @offset, @width for case 1+ */
+-            qemu_log_mask(LOG_UNIMP,
+-                          "%s: Write to buffer emulation is flawed\n",
+-                          __func__);
+             pfl->status |= 0x80; /* Ready! */
+             break;
+         case 0xf0: /* Probe for AMD flash */
+@@ -574,7 +570,6 @@ static void pflash_write(PFlashCFI01 *pfl, hwaddr offset,
+             }
+             pfl->counter = value;
+             pfl->wcycle++;
+-            pflash_blk_write_start(pfl, offset);
+             break;
+         case 0x60:
+             if (cmd == 0xd0) {
+@@ -605,6 +600,9 @@ static void pflash_write(PFlashCFI01 *pfl, hwaddr offset,
+         switch (pfl->cmd) {
+         case 0xe8: /* Block write */
+             /* FIXME check @offset, @width */
++            if (pfl->blk_offset == -1 && pfl->counter) {
++                pflash_blk_write_start(pfl, offset);
++            }
+             if (!pfl->ro && (pfl->blk_offset != -1)) {
+                 pflash_data_write(pfl, offset, value, width, be);
+             } else {

debian/patches/extra/0008-target-i386-fix-operand-size-for-DATA16-REX.W-POPCNT.patch

@@ -0,0 +1,51 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Thu, 9 May 2024 12:38:10 +0200
+Subject: [PATCH] target/i386: fix operand size for DATA16 REX.W POPCNT
+
+According to the manual, 32-bit vs 64-bit is governed by REX.W
+and REX ignores the 0x66 prefix.  This can be confirmed with this
+program:
+
+    #include <stdio.h>
+    int main()
+    {
+       int x = 0x12340000;
+       int y;
+       asm("popcntl %1, %0" : "=r" (y) : "r" (x)); printf("%x\n", y);
+       asm("mov $-1, %0; .byte 0x66; popcntl %1, %0" : "+r" (y) : "r" (x)); printf("%x\n", y);
+       asm("mov $-1, %0; .byte 0x66; popcntq %q1, %q0" : "+r" (y) : "r" (x)); printf("%x\n", y);
+    }
+
+which prints 5/ffff0000/5 on real hardware and 5/ffff0000/ffff0000
+on QEMU.
+
+Cc: qemu-stable@nongnu.org
+Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 41c685dc59bb611096f3bb6a663cfa82e4cba97b)
+[FE: keep mo_64_32 helper which still has other users in 9.0.0]
+Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
+---
+ target/i386/tcg/translate.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
+index 76a42c679c..b60f3bd642 100644
+--- a/target/i386/tcg/translate.c
++++ b/target/i386/tcg/translate.c
+@@ -6799,12 +6799,7 @@ static bool disas_insn(DisasContext *s, CPUState *cpu)
+         modrm = x86_ldub_code(env, s);
+         reg = ((modrm >> 3) & 7) | REX_R(s);
+ 
+-        if (s->prefix & PREFIX_DATA) {
+-            ot = MO_16;
+-        } else {
+-            ot = mo_64_32(dflag);
+-        }
+-
++        ot = dflag;
+         gen_ldst_modrm(env, s, modrm, ot, OR_TMP0, 0);
+         gen_extu(ot, s->T0);
+         tcg_gen_mov_tl(cpu_cc_src, s->T0);

debian/patches/extra/0009-target-i386-rdpkru-wrpkru-are-no-prefix-instructions.patch

@@ -0,0 +1,40 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Thu, 9 May 2024 15:55:47 +0200
+Subject: [PATCH] target/i386: rdpkru/wrpkru are no-prefix instructions
+
+Reject 0x66/0xf3/0xf2 in front of them.
+
+Cc: qemu-stable@nongnu.org
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 40a3ec7b5ffde500789d016660a171057d6b467c)
+Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
+---
+ target/i386/tcg/translate.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
+index b60f3bd642..3e949fe964 100644
+--- a/target/i386/tcg/translate.c
++++ b/target/i386/tcg/translate.c
+@@ -6083,7 +6083,8 @@ static bool disas_insn(DisasContext *s, CPUState *cpu)
+             gen_ldst_modrm(env, s, modrm, ot, OR_TMP0, 1);
+             break;
+         case 0xee: /* rdpkru */
+-            if (prefixes & PREFIX_LOCK) {
++            if (s->prefix & (PREFIX_LOCK | PREFIX_DATA
++                             | PREFIX_REPZ | PREFIX_REPNZ)) {
+                 goto illegal_op;
+             }
+             tcg_gen_trunc_tl_i32(s->tmp2_i32, cpu_regs[R_ECX]);
+@@ -6091,7 +6092,8 @@ static bool disas_insn(DisasContext *s, CPUState *cpu)
+             tcg_gen_extr_i64_tl(cpu_regs[R_EAX], cpu_regs[R_EDX], s->tmp1_i64);
+             break;
+         case 0xef: /* wrpkru */
+-            if (prefixes & PREFIX_LOCK) {
++            if (s->prefix & (PREFIX_LOCK | PREFIX_DATA
++                             | PREFIX_REPZ | PREFIX_REPNZ)) {
+                 goto illegal_op;
+             }
+             tcg_gen_concat_tl_i64(s->tmp1_i64, cpu_regs[R_EAX],

debian/patches/extra/0010-target-i386-fix-feature-dependency-for-WAITPKG.patch

@@ -0,0 +1,33 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Wed, 8 May 2024 11:10:54 +0200
+Subject: [PATCH] target/i386: fix feature dependency for WAITPKG
+
+The VMX feature bit depends on general availability of WAITPKG,
+not the other way round.
+
+Fixes: 33cc88261c3 ("target/i386: add support for VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE", 2023-08-28)
+Cc: qemu-stable@nongnu.org
+Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit fe01af5d47d4cf7fdf90c54d43f784e5068c8d72)
+Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
+---
+ target/i386/cpu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/target/i386/cpu.c b/target/i386/cpu.c
+index 33760a2ee1..e693f8ca9a 100644
+--- a/target/i386/cpu.c
++++ b/target/i386/cpu.c
+@@ -1550,8 +1550,8 @@ static FeatureDep feature_dependencies[] = {
+         .to = { FEAT_SVM,                   ~0ull },
+     },
+     {
+-        .from = { FEAT_VMX_SECONDARY_CTLS,  VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE },
+-        .to = { FEAT_7_0_ECX,               CPUID_7_0_ECX_WAITPKG },
++        .from = { FEAT_7_0_ECX,             CPUID_7_0_ECX_WAITPKG },
++        .to = { FEAT_VMX_SECONDARY_CTLS,    VMX_SECONDARY_EXEC_ENABLE_USER_WAIT_PAUSE },
+     },
+ };
+ 

debian/patches/extra/0011-Revert-virtio-pci-fix-use-of-a-released-vector.patch

@@ -24,10 +24,10 @@ Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
  1 file changed, 2 insertions(+), 35 deletions(-)
 
 diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
-index e04218a9fb..fd66713848 100644
+index cb159fd078..cb6940fc0e 100644
 --- a/hw/virtio/virtio-pci.c
 +++ b/hw/virtio/virtio-pci.c
-@@ -1410,38 +1410,6 @@ static int virtio_pci_add_mem_cap(VirtIOPCIProxy *proxy,
+@@ -1424,38 +1424,6 @@ static int virtio_pci_add_mem_cap(VirtIOPCIProxy *proxy,
      return offset;
  }
  
@@ -66,7 +66,7 @@ index e04218a9fb..fd66713848 100644
  int virtio_pci_add_shm_cap(VirtIOPCIProxy *proxy,
                             uint8_t bar, uint64_t offset, uint64_t length,
                             uint8_t id)
-@@ -1588,8 +1556,7 @@ static void virtio_pci_common_write(void *opaque, hwaddr addr,
+@@ -1602,8 +1570,7 @@ static void virtio_pci_common_write(void *opaque, hwaddr addr,
          } else {
              val = VIRTIO_NO_VECTOR;
          }
@@ -76,7 +76,7 @@ index e04218a9fb..fd66713848 100644
          break;
      case VIRTIO_PCI_COMMON_STATUS:
          if (!(val & VIRTIO_CONFIG_S_DRIVER_OK)) {
-@@ -1629,7 +1596,7 @@ static void virtio_pci_common_write(void *opaque, hwaddr addr,
+@@ -1643,7 +1610,7 @@ static void virtio_pci_common_write(void *opaque, hwaddr addr,
          } else {
              val = VIRTIO_NO_VECTOR;
          }

debian/patches/extra/0011-hw-virtio-Fix-the-de-initialization-of-vhost-user-de.patch

@@ -1,92 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Thomas Huth <thuth@redhat.com>
-Date: Tue, 18 Jun 2024 14:19:58 +0200
-Subject: [PATCH] hw/virtio: Fix the de-initialization of vhost-user devices
-
-The unrealize functions of the various vhost-user devices are
-calling the corresponding vhost_*_set_status() functions with a
-status of 0 to shut down the device correctly.
-
-Now these vhost_*_set_status() functions all follow this scheme:
-
-    bool should_start = virtio_device_should_start(vdev, status);
-
-    if (vhost_dev_is_started(&vvc->vhost_dev) == should_start) {
-        return;
-    }
-
-    if (should_start) {
-        /* ... do the initialization stuff ... */
-    } else {
-        /* ... do the cleanup stuff ... */
-    }
-
-The problem here is virtio_device_should_start(vdev, 0) currently
-always returns "true" since it internally only looks at vdev->started
-instead of looking at the "status" parameter. Thus once the device
-got started once, virtio_device_should_start() always returns true
-and thus the vhost_*_set_status() functions return early, without
-ever doing any clean-up when being called with status == 0. This
-causes e.g. problems when trying to hot-plug and hot-unplug a vhost
-user devices multiple times since the de-initialization step is
-completely skipped during the unplug operation.
-
-This bug has been introduced in commit 9f6bcfd99f ("hw/virtio: move
-vm_running check to virtio_device_started") which replaced
-
- should_start = status & VIRTIO_CONFIG_S_DRIVER_OK;
-
-with
-
- should_start = virtio_device_started(vdev, status);
-
-which later got replaced by virtio_device_should_start(). This blocked
-the possibility to set should_start to false in case the status flag
-VIRTIO_CONFIG_S_DRIVER_OK was not set.
-
-Fix it by adjusting the virtio_device_should_start() function to
-only consider the status flag instead of vdev->started. Since this
-function is only used in the various vhost_*_set_status() functions
-for exactly the same purpose, it should be fine to fix it in this
-central place there without any risk to change the behavior of other
-code.
-
-Fixes: 9f6bcfd99f ("hw/virtio: move vm_running check to virtio_device_started")
-Buglink: https://issues.redhat.com/browse/RHEL-40708
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-Message-Id: <20240618121958.88673-1-thuth@redhat.com>
-Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
-(cherry picked from commit d72479b11797c28893e1e3fc565497a9cae5ca16)
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- include/hw/virtio/virtio.h | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/include/hw/virtio/virtio.h b/include/hw/virtio/virtio.h
-index 7d5ffdc145..2eafad17b8 100644
---- a/include/hw/virtio/virtio.h
-+++ b/include/hw/virtio/virtio.h
-@@ -470,9 +470,9 @@ static inline bool virtio_device_started(VirtIODevice *vdev, uint8_t status)
-  * @vdev - the VirtIO device
-  * @status - the devices status bits
-  *
-- * This is similar to virtio_device_started() but also encapsulates a
-- * check on the VM status which would prevent a device starting
-- * anyway.
-+ * This is similar to virtio_device_started() but ignores vdev->started
-+ * and also encapsulates a check on the VM status which would prevent a
-+ * device from starting anyway.
-  */
- static inline bool virtio_device_should_start(VirtIODevice *vdev, uint8_t status)
- {
-@@ -480,7 +480,7 @@ static inline bool virtio_device_should_start(VirtIODevice *vdev, uint8_t status
-         return false;
-     }
- 
--    return virtio_device_started(vdev, status);
-+    return status & VIRTIO_CONFIG_S_DRIVER_OK;
- }
- 
- static inline void virtio_set_started(VirtIODevice *vdev, bool started)

debian/patches/extra/0012-hw-core-machine-move-compatibility-flags-for-VirtIO-.patch

@@ -0,0 +1,57 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Fiona Ebner <f.ebner@proxmox.com>
+Date: Thu, 16 May 2024 15:21:07 +0200
+Subject: [PATCH] hw/core/machine: move compatibility flags for VirtIO-net USO
+ to machine 8.1
+
+Migration from an 8.2 or 9.0 binary to an 8.1 binary with machine
+version 8.1 can fail with:
+
+> kvm: Features 0x1c0010130afffa7 unsupported. Allowed features: 0x10179bfffe7
+> kvm: Failed to load virtio-net:virtio
+> kvm: error while loading state for instance 0x0 of device '0000:00:12.0/virtio-net'
+> kvm: load of migration failed: Operation not permitted
+
+The series
+
+53da8b5a99 virtio-net: Add support for USO features
+9da1684954 virtio-net: Add USO flags to vhost support.
+f03e0cf63b tap: Add check for USO features
+2ab0ec3121 tap: Add USO support to tap device.
+
+only landed in QEMU 8.2, so the compatibility flags should be part of
+machine version 8.1.
+
+Moving the flags unfortunately breaks forward migration with machine
+version 8.1 from a binary without this patch to a binary with this
+patch when the feature is enabled by the guest.
+
+Fixes: 53da8b5a99 ("virtio-net: Add support for USO features")
+Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
+---
+ hw/core/machine.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/hw/core/machine.c b/hw/core/machine.c
+index d33a37a6f6..4273de16a0 100644
+--- a/hw/core/machine.c
++++ b/hw/core/machine.c
+@@ -46,15 +46,15 @@ GlobalProperty hw_compat_8_1[] = {
+     { "ramfb", "x-migrate", "off" },
+     { "vfio-pci-nohotplug", "x-ramfb-migrate", "off" },
+     { "igb", "x-pcie-flr-init", "off" },
++    { TYPE_VIRTIO_NET, "host_uso", "off"},
++    { TYPE_VIRTIO_NET, "guest_uso4", "off"},
++    { TYPE_VIRTIO_NET, "guest_uso6", "off"},
+ };
+ const size_t hw_compat_8_1_len = G_N_ELEMENTS(hw_compat_8_1);
+ 
+ GlobalProperty hw_compat_8_0[] = {
+     { "migration", "multifd-flush-after-each-section", "on"},
+     { TYPE_PCI_DEVICE, "x-pcie-ari-nextfn-1", "on" },
+-    { TYPE_VIRTIO_NET, "host_uso", "off"},
+-    { TYPE_VIRTIO_NET, "guest_uso4", "off"},
+-    { TYPE_VIRTIO_NET, "guest_uso6", "off"},
+ };
+ const size_t hw_compat_8_0_len = G_N_ELEMENTS(hw_compat_8_0);
+ 

debian/patches/extra/0012-target-arm-Use-float_status-copy-in-sme_fmopa_s.patch

@@ -1,43 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Daniyal Khan <danikhan632@gmail.com>
-Date: Wed, 17 Jul 2024 16:01:47 +1000
-Subject: [PATCH] target/arm: Use float_status copy in sme_fmopa_s
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-We made a copy above because the fp exception flags
-are not propagated back to the FPST register, but
-then failed to use the copy.
-
-Cc: qemu-stable@nongnu.org
-Fixes: 558e956c719 ("target/arm: Implement FMOPA, FMOPS (non-widening)")
-Signed-off-by: Daniyal Khan <danikhan632@gmail.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20240717060149.204788-2-richard.henderson@linaro.org
-[rth: Split from a larger patch]
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-(cherry picked from commit 31d93fedf41c24b0badb38cd9317590d1ef74e37)
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- target/arm/tcg/sme_helper.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
-index e2e0575039..5a6dd76489 100644
---- a/target/arm/tcg/sme_helper.c
-+++ b/target/arm/tcg/sme_helper.c
-@@ -916,7 +916,7 @@ void HELPER(sme_fmopa_s)(void *vza, void *vzn, void *vzm, void *vpn,
-                         if (pb & 1) {
-                             uint32_t *a = vza_row + H1_4(col);
-                             uint32_t *m = vzm + H1_4(col);
--                            *a = float32_muladd(n, *m, *a, 0, vst);
-+                            *a = float32_muladd(n, *m, *a, 0, &fpst);
-                         }
-                         col += 4;
-                         pb >>= 4;

debian/patches/extra/0013-target-arm-Use-FPST_F16-for-SME-FMOPA-widening.patch

@@ -1,62 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Richard Henderson <richard.henderson@linaro.org>
-Date: Wed, 17 Jul 2024 16:01:48 +1000
-Subject: [PATCH] target/arm: Use FPST_F16 for SME FMOPA (widening)
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This operation has float16 inputs and thus must use
-the FZ16 control not the FZ control.
-
-Cc: qemu-stable@nongnu.org
-Fixes: 3916841ac75 ("target/arm: Implement FMOPA, FMOPS (widening)")
-Reported-by: Daniyal Khan <danikhan632@gmail.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20240717060149.204788-3-richard.henderson@linaro.org
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2374
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-(cherry picked from commit 207d30b5fdb5b45a36f26eefcf52fe2c1714dd4f)
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- target/arm/tcg/translate-sme.c | 12 ++++++++----
- 1 file changed, 8 insertions(+), 4 deletions(-)
-
-diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
-index 46c7fce8b4..185a8a917b 100644
---- a/target/arm/tcg/translate-sme.c
-+++ b/target/arm/tcg/translate-sme.c
-@@ -304,6 +304,7 @@ static bool do_outprod(DisasContext *s, arg_op *a, MemOp esz,
- }
- 
- static bool do_outprod_fpst(DisasContext *s, arg_op *a, MemOp esz,
-+                            ARMFPStatusFlavour e_fpst,
-                             gen_helper_gvec_5_ptr *fn)
- {
-     int svl = streaming_vec_reg_size(s);
-@@ -319,15 +320,18 @@ static bool do_outprod_fpst(DisasContext *s, arg_op *a, MemOp esz,
-     zm = vec_full_reg_ptr(s, a->zm);
-     pn = pred_full_reg_ptr(s, a->pn);
-     pm = pred_full_reg_ptr(s, a->pm);
--    fpst = fpstatus_ptr(FPST_FPCR);
-+    fpst = fpstatus_ptr(e_fpst);
- 
-     fn(za, zn, zm, pn, pm, fpst, tcg_constant_i32(desc));
-     return true;
- }
- 
--TRANS_FEAT(FMOPA_h, aa64_sme, do_outprod_fpst, a, MO_32, gen_helper_sme_fmopa_h)
--TRANS_FEAT(FMOPA_s, aa64_sme, do_outprod_fpst, a, MO_32, gen_helper_sme_fmopa_s)
--TRANS_FEAT(FMOPA_d, aa64_sme_f64f64, do_outprod_fpst, a, MO_64, gen_helper_sme_fmopa_d)
-+TRANS_FEAT(FMOPA_h, aa64_sme, do_outprod_fpst, a,
-+           MO_32, FPST_FPCR_F16, gen_helper_sme_fmopa_h)
-+TRANS_FEAT(FMOPA_s, aa64_sme, do_outprod_fpst, a,
-+           MO_32, FPST_FPCR, gen_helper_sme_fmopa_s)
-+TRANS_FEAT(FMOPA_d, aa64_sme_f64f64, do_outprod_fpst, a,
-+           MO_64, FPST_FPCR, gen_helper_sme_fmopa_d)
- 
- /* TODO: FEAT_EBF16 */
- TRANS_FEAT(BFMOPA, aa64_sme, do_outprod, a, MO_32, gen_helper_sme_bfmopa)

debian/patches/extra/0014-scsi-fix-regression-and-honor-bootindex-again-for-le.patch

@@ -1,60 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Fiona Ebner <f.ebner@proxmox.com>
-Date: Wed, 10 Jul 2024 17:25:29 +0200
-Subject: [PATCH] scsi: fix regression and honor bootindex again for legacy
- drives
-
-Commit 3089637461 ("scsi: Don't ignore most usb-storage properties")
-removed the call to object_property_set_int() and thus the 'set'
-method for the bootindex property was also not called anymore. Here
-that method is device_set_bootindex() (as configured by
-scsi_dev_instance_init() -> device_add_bootindex_property()) which as
-a side effect registers the device via add_boot_device_path().
-
-As reported by a downstream user [0], the bootindex property did not
-have the desired effect anymore for legacy drives. Fix the regression
-by explicitly calling the add_boot_device_path() function after
-checking that the bootindex is not yet used (to avoid
-add_boot_device_path() calling exit()).
-
-[0]: https://forum.proxmox.com/threads/149772/post-679433
-
-Cc: qemu-stable@nongnu.org
-Fixes: 3089637461 ("scsi: Don't ignore most usb-storage properties")
-Suggested-by: Kevin Wolf <kwolf@redhat.com>
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
-Link: https://lore.kernel.org/r/20240710152529.1737407-1-f.ebner@proxmox.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 57a8a80d1a5b28797b21d30bfc60601945820e51)
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- hw/scsi/scsi-bus.c | 9 +++++++++
- 1 file changed, 9 insertions(+)
-
-diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c
-index 9e40b0c920..53eff5dd3d 100644
---- a/hw/scsi/scsi-bus.c
-+++ b/hw/scsi/scsi-bus.c
-@@ -384,6 +384,7 @@ SCSIDevice *scsi_bus_legacy_add_drive(SCSIBus *bus, BlockBackend *blk,
-     DeviceState *dev;
-     SCSIDevice *s;
-     DriveInfo *dinfo;
-+    Error *local_err = NULL;
- 
-     if (blk_is_sg(blk)) {
-         driver = "scsi-generic";
-@@ -403,6 +404,14 @@ SCSIDevice *scsi_bus_legacy_add_drive(SCSIBus *bus, BlockBackend *blk,
-     s = SCSI_DEVICE(dev);
-     s->conf = *conf;
- 
-+    check_boot_index(conf->bootindex, &local_err);
-+    if (local_err) {
-+        object_unparent(OBJECT(dev));
-+        error_propagate(errp, local_err);
-+        return NULL;
-+    }
-+    add_boot_device_path(conf->bootindex, dev, NULL);
-+
-     qdev_prop_set_uint32(dev, "scsi-id", unit);
-     if (object_property_find(OBJECT(dev), "removable")) {
-         qdev_prop_set_bit(dev, "removable", removable);

debian/patches/extra/0015-hw-scsi-lsi53c895a-bump-instruction-limit-in-scripts.patch

@@ -1,48 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Fiona Ebner <f.ebner@proxmox.com>
-Date: Mon, 15 Jul 2024 15:14:03 +0200
-Subject: [PATCH] hw/scsi/lsi53c895a: bump instruction limit in scripts
- processing to fix regression
-
-Commit 9876359990 ("hw/scsi/lsi53c895a: add timer to scripts
-processing") reduced the maximum allowed instruction count by
-a factor of 100 all the way down to 100.
-
-This causes the "Check Point R81.20 Gaia" appliance [0] to fail to
-boot after fully finishing the installation via the appliance's web
-interface (there is already one reboot before that).
-
-With a limit of 150, the appliance still fails to boot, while with a
-limit of 200, it works. Bump to 500 to fix the regression and be on
-the safe side.
-
-Originally reported in the Proxmox community forum[1].
-
-[0]: https://support.checkpoint.com/results/download/124397
-[1]: https://forum.proxmox.com/threads/149772/post-683459
-
-Cc: qemu-stable@nongnu.org
-Fixes: 9876359990 ("hw/scsi/lsi53c895a: add timer to scripts processing")
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
-Acked-by: Sven Schnelle <svens@stackframe.org>
-Link: https://lore.kernel.org/r/20240715131403.223239-1-f.ebner@proxmox.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit a4975023fb13cf229bd59c9ceec1b8cbdc5b9a20)
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- hw/scsi/lsi53c895a.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/hw/scsi/lsi53c895a.c b/hw/scsi/lsi53c895a.c
-index eb9828dd5e..f1935e5328 100644
---- a/hw/scsi/lsi53c895a.c
-+++ b/hw/scsi/lsi53c895a.c
-@@ -188,7 +188,7 @@ static const char *names[] = {
- #define LSI_TAG_VALID     (1 << 16)
- 
- /* Maximum instructions to process. */
--#define LSI_MAX_INSN    100
-+#define LSI_MAX_INSN    500
- 
- typedef struct lsi_request {
-     SCSIRequest *req;

debian/patches/extra/0016-block-copy-Fix-missing-graph-lock.patch

@@ -1,38 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Kevin Wolf <kwolf@redhat.com>
-Date: Thu, 27 Jun 2024 20:12:44 +0200
-Subject: [PATCH] block-copy: Fix missing graph lock
-
-The graph lock needs to be held when calling bdrv_co_pdiscard(). Fix
-block_copy_task_entry() to take it for the call.
-
-WITH_GRAPH_RDLOCK_GUARD() was implemented in a weak way because of
-limitations in clang's Thread Safety Analysis at the time, so that it
-only asserts that the lock is held (which allows calling functions that
-require the lock), but we never deal with the unlocking (so even after
-the scope of the guard, the compiler assumes that the lock is still
-held). This is why the compiler didn't catch this locking error.
-
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-(picked from https://lore.kernel.org/qemu-devel/20240627181245.281403-2-kwolf@redhat.com/)
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- block/block-copy.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/block/block-copy.c b/block/block-copy.c
-index 7e3b378528..cc618e4561 100644
---- a/block/block-copy.c
-+++ b/block/block-copy.c
-@@ -595,7 +595,9 @@ static coroutine_fn int block_copy_task_entry(AioTask *task)
-     if (s->discard_source && ret == 0) {
-         int64_t nbytes =
-             MIN(t->req.offset + t->req.bytes, s->len) - t->req.offset;
--        bdrv_co_pdiscard(s->source, t->req.offset, nbytes);
-+        WITH_GRAPH_RDLOCK_GUARD() {
-+            bdrv_co_pdiscard(s->source, t->req.offset, nbytes);
-+        }
-     }
- 
-     return ret;

debian/patches/extra/0017-Revert-qemu-char-do-not-operate-on-sources-from-fina.patch

@@ -1,93 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Sergey Dyasli <sergey.dyasli@nutanix.com>
-Date: Fri, 12 Jul 2024 09:26:59 +0000
-Subject: [PATCH] Revert "qemu-char: do not operate on sources from finalize
- callbacks"
-
-This reverts commit 2b316774f60291f57ca9ecb6a9f0712c532cae34.
-
-After 038b4217884c ("Revert "chardev: use a child source for qio input
-source"") we've been observing the "iwp->src == NULL" assertion
-triggering periodically during the initial capabilities querying by
-libvirtd. One of possible backtraces:
-
-Thread 1 (Thread 0x7f16cd4f0700 (LWP 43858)):
-0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
-1  0x00007f16c6c21e65 in __GI_abort () at abort.c:79
-2  0x00007f16c6c21d39 in __assert_fail_base  at assert.c:92
-3  0x00007f16c6c46e86 in __GI___assert_fail (assertion=assertion@entry=0x562e9bcdaadd "iwp->src == NULL", file=file@entry=0x562e9bcdaac8 "../chardev/char-io.c", line=line@entry=99, function=function@entry=0x562e9bcdab10 <__PRETTY_FUNCTION__.20549> "io_watch_poll_finalize") at assert.c:101
-4  0x0000562e9ba20c2c in io_watch_poll_finalize (source=<optimized out>) at ../chardev/char-io.c:99
-5  io_watch_poll_finalize (source=<optimized out>) at ../chardev/char-io.c:88
-6  0x00007f16c904aae0 in g_source_unref_internal () from /lib64/libglib-2.0.so.0
-7  0x00007f16c904baf9 in g_source_destroy_internal () from /lib64/libglib-2.0.so.0
-8  0x0000562e9ba20db0 in io_remove_watch_poll (source=0x562e9d6720b0) at ../chardev/char-io.c:147
-9  remove_fd_in_watch (chr=chr@entry=0x562e9d5f3800) at ../chardev/char-io.c:153
-10 0x0000562e9ba23ffb in update_ioc_handlers (s=0x562e9d5f3800) at ../chardev/char-socket.c:592
-11 0x0000562e9ba2072f in qemu_chr_fe_set_handlers_full at ../chardev/char-fe.c:279
-12 0x0000562e9ba207a9 in qemu_chr_fe_set_handlers at ../chardev/char-fe.c:304
-13 0x0000562e9ba2ca75 in monitor_qmp_setup_handlers_bh (opaque=0x562e9d4c2c60) at ../monitor/qmp.c:509
-14 0x0000562e9bb6222e in aio_bh_poll (ctx=ctx@entry=0x562e9d4c2f20) at ../util/async.c:216
-15 0x0000562e9bb4de0a in aio_poll (ctx=0x562e9d4c2f20, blocking=blocking@entry=true) at ../util/aio-posix.c:722
-16 0x0000562e9b99dfaa in iothread_run (opaque=0x562e9d4c26f0) at ../iothread.c:63
-17 0x0000562e9bb505a4 in qemu_thread_start (args=0x562e9d4c7ea0) at ../util/qemu-thread-posix.c:543
-18 0x00007f16c70081ca in start_thread (arg=<optimized out>) at pthread_create.c:479
-19 0x00007f16c6c398d3 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
-
-io_remove_watch_poll(), which makes sure that iwp->src is NULL, calls
-g_source_destroy() which finds that iwp->src is not NULL in the finalize
-callback. This can only happen if another thread has managed to trigger
-io_watch_poll_prepare() callback in the meantime.
-
-Move iwp->src destruction back to the finalize callback to prevent the
-described race, and also remove the stale comment. The deadlock glib bug
-was fixed back in 2010 by b35820285668 ("gmain: move finalization of
-GSource outside of context lock").
-
-Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
-Signed-off-by: Sergey Dyasli <sergey.dyasli@nutanix.com>
-Link: https://lore.kernel.org/r/20240712092659.216206-1-sergey.dyasli@nutanix.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit e0bf95443ee9326d44031373420cf9f3513ee255)
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- chardev/char-io.c | 19 +++++--------------
- 1 file changed, 5 insertions(+), 14 deletions(-)
-
-diff --git a/chardev/char-io.c b/chardev/char-io.c
-index dab77b112e..3be17b51ca 100644
---- a/chardev/char-io.c
-+++ b/chardev/char-io.c
-@@ -87,16 +87,12 @@ static gboolean io_watch_poll_dispatch(GSource *source, GSourceFunc callback,
- 
- static void io_watch_poll_finalize(GSource *source)
- {
--    /*
--     * Due to a glib bug, removing the last reference to a source
--     * inside a finalize callback causes recursive locking (and a
--     * deadlock).  This is not a problem inside other callbacks,
--     * including dispatch callbacks, so we call io_remove_watch_poll
--     * to remove this source.  At this point, iwp->src must
--     * be NULL, or we would leak it.
--     */
-     IOWatchPoll *iwp = io_watch_poll_from_source(source);
--    assert(iwp->src == NULL);
-+    if (iwp->src) {
-+        g_source_destroy(iwp->src);
-+        g_source_unref(iwp->src);
-+        iwp->src = NULL;
-+    }
- }
- 
- static GSourceFuncs io_watch_poll_funcs = {
-@@ -139,11 +135,6 @@ static void io_remove_watch_poll(GSource *source)
-     IOWatchPoll *iwp;
- 
-     iwp = io_watch_poll_from_source(source);
--    if (iwp->src) {
--        g_source_destroy(iwp->src);
--        g_source_unref(iwp->src);
--        iwp->src = NULL;
--    }
-     g_source_destroy(&iwp->parent);
- }
- 

debian/patches/pve/0017-PVE-add-savevm-async-for-background-state-snapshots.patch

@@ -27,8 +27,7 @@ Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 [FE: further improve aborting
      adapt to removal of QEMUFileOps
      improve condition for entering final stage
-     adapt to QAPI and other changes for 8.2
+     adapt to QAPI and other changes for 8.2]
-     make sure to not call vm_start() from coroutine]
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
  hmp-commands-info.hx         |  13 +
@@ -36,13 +35,13 @@ Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
  include/migration/snapshot.h |   2 +
  include/monitor/hmp.h        |   3 +
  migration/meson.build        |   1 +
- migration/savevm-async.c     | 538 +++++++++++++++++++++++++++++++++++
+ migration/savevm-async.c     | 531 +++++++++++++++++++++++++++++++++++
  monitor/hmp-cmds.c           |  38 +++
  qapi/migration.json          |  34 +++
  qapi/misc.json               |  18 ++
  qemu-options.hx              |  12 +
  system/vl.c                  |  10 +
- 11 files changed, 686 insertions(+)
+ 11 files changed, 679 insertions(+)
  create mode 100644 migration/savevm-async.c
 
 diff --git a/hmp-commands-info.hx b/hmp-commands-info.hx
@@ -140,10 +139,10 @@ index 95d1cf2250..800f12a60d 100644
    'threadinfo.c',
 diff --git a/migration/savevm-async.c b/migration/savevm-async.c
 new file mode 100644
-index 0000000000..72cf6588c2
+index 0000000000..779e4e2a78
 --- /dev/null
 +++ b/migration/savevm-async.c
-@@ -0,0 +1,538 @@
+@@ -0,0 +1,531 @@
 +#include "qemu/osdep.h"
 +#include "migration/channel-savevm-async.h"
 +#include "migration/migration.h"
@@ -571,10 +570,29 @@ index 0000000000..72cf6588c2
 +    }
 +}
 +
-+static void coroutine_fn wait_for_close_co(void *opaque)
++void coroutine_fn qmp_savevm_end(Error **errp)
 +{
 +    int64_t timeout;
 +
++    if (snap_state.state == SAVE_STATE_DONE) {
++        error_set(errp, ERROR_CLASS_GENERIC_ERROR,
++                  "VM snapshot not started\n");
++        return;
++    }
++
++    if (snap_state.state == SAVE_STATE_ACTIVE) {
++        snap_state.state = SAVE_STATE_CANCELLED;
++        goto wait_for_close;
++    }
++
++    if (snap_state.saved_vm_running) {
++        vm_start();
++        snap_state.saved_vm_running = false;
++    }
++
++    snap_state.state = SAVE_STATE_DONE;
++
++wait_for_close:
 +    if (!snap_state.target) {
 +        DPRINTF("savevm-end: no target file open\n");
 +        return;
@@ -602,32 +620,6 @@ index 0000000000..72cf6588c2
 +    DPRINTF("savevm-end: cleanup done\n");
 +}
 +
-+void qmp_savevm_end(Error **errp)
-+{
-+    if (snap_state.state == SAVE_STATE_DONE) {
-+        error_set(errp, ERROR_CLASS_GENERIC_ERROR,
-+                  "VM snapshot not started\n");
-+        return;
-+    }
-+
-+    Coroutine *wait_for_close = qemu_coroutine_create(wait_for_close_co, NULL);
-+
-+    if (snap_state.state == SAVE_STATE_ACTIVE) {
-+        snap_state.state = SAVE_STATE_CANCELLED;
-+        qemu_coroutine_enter(wait_for_close);
-+        return;
-+    }
-+
-+    if (snap_state.saved_vm_running) {
-+        vm_start();
-+        snap_state.saved_vm_running = false;
-+    }
-+
-+    snap_state.state = SAVE_STATE_DONE;
-+
-+    qemu_coroutine_enter(wait_for_close);
-+}
-+
 +int load_snapshot_from_blockdev(const char *filename, Error **errp)
 +{
 +    BlockBackend *be;
@@ -781,7 +773,7 @@ index 8c65b90328..ed20d066cd 100644
  # @query-migrate:
  #
 diff --git a/qapi/misc.json b/qapi/misc.json
-index ec30e5c570..3c68633f68 100644
+index ec30e5c570..7147199a12 100644
 --- a/qapi/misc.json
 +++ b/qapi/misc.json
 @@ -454,6 +454,24 @@
@@ -804,7 +796,7 @@ index ec30e5c570..3c68633f68 100644
 +# Resume VM after a snapshot.
 +#
 +##
-+{ 'command': 'savevm-end' }
++{ 'command': 'savevm-end', 'coroutine': true }
 +
  ##
  # @CommandLineParameterType:

debian/patches/pve/0018-PVE-add-optional-buffer-size-to-QEMUFile.patch

@@ -193,7 +193,7 @@ index 32fd4a34fd..36a0cd8cc8 100644
  
  /*
 diff --git a/migration/savevm-async.c b/migration/savevm-async.c
-index 72cf6588c2..fb4e8ea689 100644
+index 779e4e2a78..bf36fc06d2 100644
 --- a/migration/savevm-async.c
 +++ b/migration/savevm-async.c
 @@ -379,7 +379,7 @@ void qmp_savevm_start(const char *statefile, Error **errp)
@@ -205,7 +205,7 @@ index 72cf6588c2..fb4e8ea689 100644
  
      if (!snap_state.file) {
          error_set(errp, ERROR_CLASS_GENERIC_ERROR, "failed to open '%s'", statefile);
-@@ -503,7 +503,8 @@ int load_snapshot_from_blockdev(const char *filename, Error **errp)
+@@ -496,7 +496,8 @@ int load_snapshot_from_blockdev(const char *filename, Error **errp)
      blk_op_block_all(be, blocker);
  
      /* restore the VM state */

debian/patches/pve/0019-PVE-block-add-the-zeroinit-block-driver-filter.patch

@@ -5,13 +5,12 @@ Subject: [PATCH] PVE: block: add the zeroinit block driver filter
 
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 [FE: adapt to changed function signatures
-     adhere to block graph lock requirements
+     adhere to block graph lock requirements]
-     use dedicated function to open file child]
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
  block/meson.build |   1 +
- block/zeroinit.c  | 207 ++++++++++++++++++++++++++++++++++++++++++++++
+ block/zeroinit.c  | 214 ++++++++++++++++++++++++++++++++++++++++++++++
- 2 files changed, 208 insertions(+)
+ 2 files changed, 215 insertions(+)
  create mode 100644 block/zeroinit.c
 
 diff --git a/block/meson.build b/block/meson.build
@@ -28,10 +27,10 @@ index e1f03fd773..b530e117b5 100644
  system_ss.add(when: 'CONFIG_TCG', if_true: files('blkreplay.c'))
 diff --git a/block/zeroinit.c b/block/zeroinit.c
 new file mode 100644
-index 0000000000..7998c9332d
+index 0000000000..696558d8d6
 --- /dev/null
 +++ b/block/zeroinit.c
-@@ -0,0 +1,207 @@
+@@ -0,0 +1,214 @@
 +/*
 + * Filter to fake a zero-initialized block device.
 + *
@@ -97,6 +96,7 @@ index 0000000000..7998c9332d
 +                          Error **errp)
 +{
 +    BDRVZeroinitState *s = bs->opaque;
++    BdrvChild *file = NULL;
 +    QemuOpts *opts;
 +    Error *local_err = NULL;
 +    int ret;
@@ -112,9 +112,15 @@ index 0000000000..7998c9332d
 +    }
 +
 +    /* Open the raw file */
-+    ret = bdrv_open_file_child(qemu_opt_get(opts, "x-next"), options, "next",
++    file = bdrv_open_child(qemu_opt_get(opts, "x-next"), options, "next", bs,
-+                               bs, &local_err);
++                           &child_of_bds,
-+    if (ret < 0) {
++                           BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY, false,
++                           &local_err);
++    bdrv_graph_wrlock();
++    bs->file = file;
++    bdrv_graph_wrunlock();
++    if (local_err) {
++        ret = -EINVAL;
 +        error_propagate(errp, local_err);
 +        goto fail;
 +    }

debian/patches/pve/0022-PVE-Up-Config-file-posix-make-locking-optiono-on-cre.patch

@@ -119,7 +119,7 @@ index 43bc0bd520..60e98c87f1 100644
      };
      return raw_co_create(&options, errp);
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 905da8be72..3db587a6e4 100644
+index 45ab548dfe..f7c2b63c5d 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
 @@ -4956,6 +4956,10 @@

debian/patches/pve/0026-block-backup-move-bcs-bitmap-initialization-to-job-c.patch

@@ -25,7 +25,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 4 insertions(+), 4 deletions(-)
 
 diff --git a/block/backup.c b/block/backup.c
-index 3dd2e229d2..eba5b11493 100644
+index ec29d6b810..270957c0cd 100644
 --- a/block/backup.c
 +++ b/block/backup.c
 @@ -237,8 +237,8 @@ static void backup_init_bcs_bitmap(BackupBlockJob *job)
@@ -48,7 +48,7 @@ index 3dd2e229d2..eba5b11493 100644
      if (s->sync_mode == MIRROR_SYNC_MODE_TOP) {
          int64_t offset = 0;
          int64_t count;
-@@ -502,6 +500,8 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
+@@ -501,6 +499,8 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
                         &error_abort);
      bdrv_graph_wrunlock();
  

debian/patches/pve/0027-PVE-Backup-add-vma-backup-format-code.patch

@@ -16,10 +16,10 @@ Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
  block/meson.build |   2 +
  meson.build       |   5 +
  vma-reader.c      | 870 ++++++++++++++++++++++++++++++++++++++++++++
- vma-writer.c      | 817 +++++++++++++++++++++++++++++++++++++++++
+ vma-writer.c      | 818 +++++++++++++++++++++++++++++++++++++++++
  vma.c             | 901 ++++++++++++++++++++++++++++++++++++++++++++++
  vma.h             | 150 ++++++++
- 6 files changed, 2745 insertions(+)
+ 6 files changed, 2746 insertions(+)
  create mode 100644 vma-reader.c
  create mode 100644 vma-writer.c
  create mode 100644 vma.c
@@ -939,10 +939,10 @@ index 0000000000..d0b6721812
 +
 diff --git a/vma-writer.c b/vma-writer.c
 new file mode 100644
-index 0000000000..a466652a5d
+index 0000000000..126b296647
 --- /dev/null
 +++ b/vma-writer.c
-@@ -0,0 +1,817 @@
+@@ -0,0 +1,818 @@
 +/*
 + * VMA: Virtual Machine Archive
 + *
@@ -1517,16 +1517,17 @@ index 0000000000..a466652a5d
 +    int i;
 +
 +    g_assert(vmaw != NULL);
-+    g_assert(status != NULL);
 +
-+    status->status = vmaw->status;
++    if (status) {
-+    g_strlcpy(status->errmsg, vmaw->errmsg, sizeof(status->errmsg));
++        status->status = vmaw->status;
-+    for (i = 0; i <= 255; i++) {
++        g_strlcpy(status->errmsg, vmaw->errmsg, sizeof(status->errmsg));
-+        status->stream_info[i] = vmaw->stream_info[i];
++        for (i = 0; i <= 255; i++) {
++            status->stream_info[i] = vmaw->stream_info[i];
++        }
++
++        uuid_unparse_lower(vmaw->uuid, status->uuid_str);
 +    }
 +
-+    uuid_unparse_lower(vmaw->uuid, status->uuid_str);
-+
 +    status->closed = vmaw->closed;
 +
 +    return vmaw->status;

debian/patches/pve/0028-PVE-Backup-add-backup-dump-block-driver.patch

@@ -199,7 +199,7 @@ index 0000000000..e46abf1070
 +    return bs;
 +}
 diff --git a/block/backup.c b/block/backup.c
-index eba5b11493..1963e47ab9 100644
+index 270957c0cd..16d611c4ca 100644
 --- a/block/backup.c
 +++ b/block/backup.c
 @@ -29,28 +29,6 @@
@@ -231,7 +231,7 @@ index eba5b11493..1963e47ab9 100644
  static const BlockJobDriver backup_job_driver;
  
  static void backup_cleanup_sync_bitmap(BackupBlockJob *job, int ret)
-@@ -462,6 +440,14 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
+@@ -461,6 +439,14 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
      }
  
      cluster_size = block_copy_cluster_size(bcs);

debian/patches/pve/0030-PVE-Backup-Proxmox-backup-patches-for-QEMU.patch

@@ -94,11 +94,11 @@ Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
  monitor/hmp-cmds.c             |   72 +++
  proxmox-backup-client.c        |  146 +++++
  proxmox-backup-client.h        |   60 ++
- pve-backup.c                   | 1092 ++++++++++++++++++++++++++++++++
+ pve-backup.c                   | 1098 ++++++++++++++++++++++++++++++++
  qapi/block-core.json           |  233 +++++++
  qapi/common.json               |   14 +
  qapi/machine.json              |   16 +-
- 14 files changed, 1711 insertions(+), 14 deletions(-)
+ 14 files changed, 1717 insertions(+), 14 deletions(-)
  create mode 100644 proxmox-backup-client.c
  create mode 100644 proxmox-backup-client.h
  create mode 100644 pve-backup.c
@@ -167,7 +167,7 @@ index d954bec6f1..5000c084c5 100644
 +    hmp_handle_error(mon, error);
 +}
 diff --git a/blockdev.c b/blockdev.c
-index ed8198f351..1054a69279 100644
+index d27d8c38ec..5e5dbc1da9 100644
 --- a/blockdev.c
 +++ b/blockdev.c
 @@ -37,6 +37,7 @@
@@ -586,10 +586,10 @@ index 0000000000..8cbf645b2c
 +#endif /* PROXMOX_BACKUP_CLIENT_H */
 diff --git a/pve-backup.c b/pve-backup.c
 new file mode 100644
-index 0000000000..c755bf302b
+index 0000000000..9c13a92623
 --- /dev/null
 +++ b/pve-backup.c
-@@ -0,0 +1,1092 @@
+@@ -0,0 +1,1098 @@
 +#include "proxmox-backup-client.h"
 +#include "vma.h"
 +
@@ -626,6 +626,7 @@ index 0000000000..c755bf302b
 + * ---end-bad-example--
 + *
 + * ==> Always use CoMutext inside coroutines.
++ * ==> Never acquire/release AioContext withing coroutines (because that use QemuRecMutex)
 + *
 + */
 +
@@ -678,6 +679,7 @@ index 0000000000..c755bf302b
 +    uint64_t block_size;
 +    uint8_t dev_id;
 +    int completed_ret; // INT_MAX if not completed
++    char targetfile[PATH_MAX];
 +    BdrvDirtyBitmap *bitmap;
 +    BlockDriverState *target;
 +    BlockJob *job;
@@ -1076,7 +1078,8 @@ index 0000000000..c755bf302b
 +}
 +
 +/*
-+ * backup_job_create can *not* be run from a coroutine, so this can't either.
++ * backup_job_create can *not* be run from a coroutine (and requires an
++ * acquired AioContext), so this can't either.
 + * The caller is responsible that backup_mutex is held nonetheless.
 + */
 +static void create_backup_jobs_bh(void *opaque) {
@@ -1570,6 +1573,9 @@ index 0000000000..c755bf302b
 +            bdrv_co_unref(di->target);
 +        }
 +
++        if (di->targetfile[0]) {
++            unlink(di->targetfile);
++        }
 +        g_free(di);
 +    }
 +    g_list_free(di_list);
@@ -1683,7 +1689,7 @@ index 0000000000..c755bf302b
 +    return ret;
 +}
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 3db587a6e4..d05fffce1d 100644
+index f7c2b63c5d..e49c7b5bc9 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
 @@ -851,6 +851,239 @@

debian/patches/pve/0032-PVE-Add-PBS-block-driver-to-map-backup-archives-into.patch

@@ -15,11 +15,11 @@ Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
  block/meson.build    |   2 +
- block/pbs.c          | 313 +++++++++++++++++++++++++++++++++++++++++++
+ block/pbs.c          | 307 +++++++++++++++++++++++++++++++++++++++++++
  meson.build          |   2 +-
  qapi/block-core.json |  29 ++++
  qapi/pragma.json     |   1 +
- 5 files changed, 346 insertions(+), 1 deletion(-)
+ 5 files changed, 340 insertions(+), 1 deletion(-)
  create mode 100644 block/pbs.c
 
 diff --git a/block/meson.build b/block/meson.build
@@ -37,10 +37,10 @@ index 6bba803f94..1945e04eeb 100644
  system_ss.add(files('block-ram-registrar.c'))
 diff --git a/block/pbs.c b/block/pbs.c
 new file mode 100644
-index 0000000000..aee66c2e93
+index 0000000000..dd72356bd3
 --- /dev/null
 +++ b/block/pbs.c
-@@ -0,0 +1,313 @@
+@@ -0,0 +1,307 @@
 +/*
 + * Proxmox Backup Server read-only block driver
 + */
@@ -68,7 +68,7 @@ index 0000000000..aee66c2e93
 +
 +typedef struct {
 +    ProxmoxRestoreHandle *conn;
-+    uint8_t aid;
++    char aid;
 +    int64_t length;
 +
 +    char *repository;
@@ -201,18 +201,12 @@ index 0000000000..aee66c2e93
 +    }
 +
 +    /* acquire handle and length */
-+    ret = proxmox_restore_open_image(s->conn, s->archive, &pbs_error);
++    s->aid = proxmox_restore_open_image(s->conn, s->archive, &pbs_error);
-+    if (ret < 0) {
++    if (s->aid < 0) {
 +        if (pbs_error && errp) error_setg(errp, "PBS open_image failed: %s", pbs_error);
 +        if (pbs_error) proxmox_backup_free_error(pbs_error);
 +        return -ENODEV;
 +    }
-+    if (ret > UINT8_MAX) {
-+        error_setg(errp, "PBS open_image returned an ID larger than %u", UINT8_MAX);
-+        return -ENODEV;
-+    }
-+    s->aid = ret;
-+
 +    s->length = proxmox_restore_get_image_length(s->conn, s->aid, &pbs_error);
 +    if (s->length < 0) {
 +        if (pbs_error && errp) error_setg(errp, "PBS get_image_length failed: %s", pbs_error);
@@ -368,7 +362,7 @@ index 6de51c34cb..3bc039f60f 100644
  summary_info += {'libdaxctl support': libdaxctl}
  summary_info += {'libudev':           libudev}
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index d05fffce1d..e7cf3d94f3 100644
+index e49c7b5bc9..fc32ff9957 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
 @@ -3457,6 +3457,7 @@

debian/patches/pve/0034-PVE-Migrate-dirty-bitmap-state-via-savevm.patch

@@ -174,10 +174,10 @@ index 0000000000..887e998b9e
 +                         NULL);
 +}
 diff --git a/pve-backup.c b/pve-backup.c
-index c755bf302b..5ebb6a3947 100644
+index 9c13a92623..9d480a8eec 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
-@@ -1085,6 +1085,7 @@ ProxmoxSupportStatus *qmp_query_proxmox_support(Error **errp)
+@@ -1091,6 +1091,7 @@ ProxmoxSupportStatus *qmp_query_proxmox_support(Error **errp)
      ret->pbs_library_version = g_strdup(proxmox_backup_qemu_version());
      ret->pbs_dirty_bitmap = true;
      ret->pbs_dirty_bitmap_savevm = true;
@@ -186,7 +186,7 @@ index c755bf302b..5ebb6a3947 100644
      ret->pbs_masterkey = true;
      ret->backup_max_workers = true;
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index e7cf3d94f3..282e2e8a8c 100644
+index fc32ff9957..f516d8e95a 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
 @@ -1004,6 +1004,11 @@

debian/patches/pve/0047-qapi-blockdev-backup-add-discard-source-parameter.patch

@@ -45,10 +45,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  10 files changed, 37 insertions(+), 8 deletions(-)
 
 diff --git a/block/backup.c b/block/backup.c
-index ec29d6b810..3dd2e229d2 100644
+index 16d611c4ca..1963e47ab9 100644
 --- a/block/backup.c
 +++ b/block/backup.c
-@@ -356,7 +356,7 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
+@@ -332,7 +332,7 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
                    BlockDriverState *target, int64_t speed,
                    MirrorSyncMode sync_mode, BdrvDirtyBitmap *sync_bitmap,
                    BitmapSyncMode bitmap_mode,
@@ -57,7 +57,7 @@ index ec29d6b810..3dd2e229d2 100644
                    const char *filter_node_name,
                    BackupPerf *perf,
                    BlockdevOnError on_source_error,
-@@ -457,7 +457,8 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
+@@ -433,7 +433,8 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
          goto error;
      }
  
@@ -203,10 +203,10 @@ index ca6bd0a720..0415a5e8b7 100644
                                  BLOCKDEV_ON_ERROR_REPORT, JOB_INTERNAL,
                                  backup_job_completed, bs, NULL, &local_err);
 diff --git a/blockdev.c b/blockdev.c
-index 057601dcf0..4c33c3f5f0 100644
+index 5e5dbc1da9..1054a69279 100644
 --- a/blockdev.c
 +++ b/blockdev.c
-@@ -2726,7 +2726,7 @@ static BlockJob *do_backup_common(BackupCommon *backup,
+@@ -2727,7 +2727,7 @@ static BlockJob *do_backup_common(BackupCommon *backup,
  
      job = backup_job_create(backup->job_id, bs, target_bs, backup->speed,
                              backup->sync, bmap, backup->bitmap_mode,
@@ -241,10 +241,10 @@ index 8b41643bfa..bdc703bacd 100644
  
  /* Function should be called prior any actual copy request */
 diff --git a/include/block/block_int-global-state.h b/include/block/block_int-global-state.h
-index d2201e27f4..eb2d92a226 100644
+index cc1387ae02..f0c642b194 100644
 --- a/include/block/block_int-global-state.h
 +++ b/include/block/block_int-global-state.h
-@@ -193,7 +193,7 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
+@@ -195,7 +195,7 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
                              MirrorSyncMode sync_mode,
                              BdrvDirtyBitmap *sync_bitmap,
                              BitmapSyncMode bitmap_mode,
@@ -254,10 +254,10 @@ index d2201e27f4..eb2d92a226 100644
                              BackupPerf *perf,
                              BlockdevOnError on_source_error,
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 4b18e01b85..b179d65520 100644
+index f516d8e95a..d796d49abb 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -1610,6 +1610,9 @@
+@@ -1849,6 +1849,9 @@
  #     node specified by @drive.  If this option is not given, a node
  #     name is autogenerated.  (Since: 4.2)
  #
@@ -267,7 +267,7 @@ index 4b18e01b85..b179d65520 100644
  # @x-perf: Performance options.  (Since 6.0)
  #
  # Features:
-@@ -1631,6 +1634,7 @@
+@@ -1870,6 +1873,7 @@
              '*on-target-error': 'BlockdevOnError',
              '*auto-finalize': 'bool', '*auto-dismiss': 'bool',
              '*filter-node-name': 'str',

debian/patches/pve/0048-copy-before-write-allow-specifying-minimum-cluster-s.patch

@@ -25,7 +25,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  4 files changed, 23 insertions(+), 6 deletions(-)
 
 diff --git a/block/block-copy.c b/block/block-copy.c
-index cc618e4561..12d662e9d4 100644
+index 7e3b378528..adb1cbb440 100644
 --- a/block/block-copy.c
 +++ b/block/block-copy.c
 @@ -310,6 +310,7 @@ void block_copy_set_copy_opts(BlockCopyState *s, bool use_copy_range,
@@ -108,10 +108,10 @@ index bdc703bacd..77857c6c68 100644
  
  /* Function should be called prior any actual copy request */
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 282e2e8a8c..9caf04cbe9 100644
+index d796d49abb..edbf6e78b9 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -4926,12 +4926,18 @@
+@@ -4930,12 +4930,18 @@
  #     @on-cbw-error parameter will decide how this failure is handled.
  #     Default 0.  (Since 7.1)
  #

debian/patches/pve/0049-backup-add-minimum-cluster-size-to-performance-optio.patch

@@ -82,7 +82,7 @@ index 1054a69279..cbe224387b 100644
  
      if ((backup->sync == MIRROR_SYNC_MODE_BITMAP) ||
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 9caf04cbe9..df934647ed 100644
+index edbf6e78b9..6e7ee87633 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
 @@ -1790,11 +1790,16 @@

debian/patches/pve/0050-PVE-backup-add-fleecing-option.patch

@@ -63,9 +63,9 @@ Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
  block/monitor/block-hmp-cmds.c |   1 +
- pve-backup.c                   | 135 ++++++++++++++++++++++++++++++++-
+ pve-backup.c                   | 143 ++++++++++++++++++++++++++++++++-
  qapi/block-core.json           |  10 ++-
- 3 files changed, 142 insertions(+), 4 deletions(-)
+ 3 files changed, 150 insertions(+), 4 deletions(-)
 
 diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
 index 5000c084c5..70b3de4c7e 100644
@@ -80,7 +80,7 @@ index 5000c084c5..70b3de4c7e 100644
  
      hmp_handle_error(mon, error);
 diff --git a/pve-backup.c b/pve-backup.c
-index 5ebb6a3947..a747d12d3d 100644
+index 9d480a8eec..7cc1dd3724 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
 @@ -7,9 +7,11 @@
@@ -95,7 +95,7 @@ index 5ebb6a3947..a747d12d3d 100644
  #include "qapi/qmp/qerror.h"
  #include "qemu/cutils.h"
  
-@@ -80,8 +82,15 @@ static void pvebackup_init(void)
+@@ -81,8 +83,15 @@ static void pvebackup_init(void)
  // initialize PVEBackupState at startup
  opts_init(pvebackup_init);
  
@@ -111,7 +111,7 @@ index 5ebb6a3947..a747d12d3d 100644
      size_t size;
      uint64_t block_size;
      uint8_t dev_id;
-@@ -353,6 +362,22 @@ static void pvebackup_complete_cb(void *opaque, int ret)
+@@ -355,6 +364,25 @@ static void pvebackup_complete_cb(void *opaque, int ret)
      PVEBackupDevInfo *di = opaque;
      di->completed_ret = ret;
  
@@ -121,6 +121,9 @@ index 5ebb6a3947..a747d12d3d 100644
 +     * - For snapshot_access, allows doing bdrv_unref() directly. Doing it via bdrv_co_unref() would
 +     *   just spawn a BH calling bdrv_unref().
 +     * - For cbw, draining would need to spawn a BH.
++     *
++     * Note that the AioContext lock is already acquired by our caller, i.e.
++     * job_finalize_single_locked()
 +     */
 +    if (di->fleecing.snapshot_access) {
 +        bdrv_unref(di->fleecing.snapshot_access);
@@ -134,7 +137,7 @@ index 5ebb6a3947..a747d12d3d 100644
      /*
       * Needs to happen outside of coroutine, because it takes the graph write lock.
       */
-@@ -519,9 +544,77 @@ static void create_backup_jobs_bh(void *opaque) {
+@@ -522,9 +550,82 @@ static void create_backup_jobs_bh(void *opaque) {
          }
          bdrv_drained_begin(di->bs);
  
@@ -179,6 +182,11 @@ index 5ebb6a3947..a747d12d3d 100644
 +            qdict_put_str(snapshot_access_opts, "driver", "snapshot-access");
 +            qdict_put_str(snapshot_access_opts, "file", bdrv_get_node_name(di->fleecing.cbw));
 +
++            /*
++             * Holding the AioContext lock here would cause a deadlock, because bdrv_open_driver()
++             * will aquire it a second time. But it's allowed to be held exactly once when polling
++             * and that happens when the bdrv_refresh_total_sectors() call is made there.
++             */
 +            di->fleecing.snapshot_access =
 +                bdrv_open(NULL, NULL, snapshot_access_opts, BDRV_O_RDWR | BDRV_O_UNMAP, &local_err);
 +            if (!di->fleecing.snapshot_access) {
@@ -214,7 +222,7 @@ index 5ebb6a3947..a747d12d3d 100644
              BLOCKDEV_ON_ERROR_REPORT, JOB_DEFAULT, pvebackup_complete_cb, di, backup_state.txn,
              &local_err);
  
-@@ -577,6 +670,14 @@ static void create_backup_jobs_bh(void *opaque) {
+@@ -580,6 +681,14 @@ static void create_backup_jobs_bh(void *opaque) {
      aio_co_enter(data->ctx, data->co);
  }
  
@@ -229,7 +237,7 @@ index 5ebb6a3947..a747d12d3d 100644
  /*
   * Returns a list of device infos, which needs to be freed by the caller. In
   * case of an error, errp will be set, but the returned value might still be a
-@@ -584,6 +685,7 @@ static void create_backup_jobs_bh(void *opaque) {
+@@ -587,6 +696,7 @@ static void create_backup_jobs_bh(void *opaque) {
   */
  static GList coroutine_fn GRAPH_RDLOCK *get_device_info(
      const char *devlist,
@@ -237,7 +245,7 @@ index 5ebb6a3947..a747d12d3d 100644
      Error **errp)
  {
      gchar **devs = NULL;
-@@ -607,6 +709,31 @@ static GList coroutine_fn GRAPH_RDLOCK *get_device_info(
+@@ -610,6 +720,31 @@ static GList coroutine_fn GRAPH_RDLOCK *get_device_info(
              }
              PVEBackupDevInfo *di = g_new0(PVEBackupDevInfo, 1);
              di->bs = bs;
@@ -269,7 +277,7 @@ index 5ebb6a3947..a747d12d3d 100644
              di_list = g_list_append(di_list, di);
              d++;
          }
-@@ -656,6 +783,7 @@ UuidInfo coroutine_fn *qmp_backup(
+@@ -659,6 +794,7 @@ UuidInfo coroutine_fn *qmp_backup(
      const char *devlist,
      bool has_speed, int64_t speed,
      bool has_max_workers, int64_t max_workers,
@@ -277,7 +285,7 @@ index 5ebb6a3947..a747d12d3d 100644
      Error **errp)
  {
      assert(qemu_in_coroutine());
-@@ -684,7 +812,7 @@ UuidInfo coroutine_fn *qmp_backup(
+@@ -687,7 +823,7 @@ UuidInfo coroutine_fn *qmp_backup(
      format = has_format ? format : BACKUP_FORMAT_VMA;
  
      bdrv_graph_co_rdlock();
@@ -286,7 +294,7 @@ index 5ebb6a3947..a747d12d3d 100644
      bdrv_graph_co_rdunlock();
      if (local_err) {
          error_propagate(errp, local_err);
-@@ -1089,5 +1217,6 @@ ProxmoxSupportStatus *qmp_query_proxmox_support(Error **errp)
+@@ -1095,5 +1231,6 @@ ProxmoxSupportStatus *qmp_query_proxmox_support(Error **errp)
      ret->query_bitmap_info = true;
      ret->pbs_masterkey = true;
      ret->backup_max_workers = true;
@@ -294,7 +302,7 @@ index 5ebb6a3947..a747d12d3d 100644
      return ret;
  }
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index df934647ed..ff441d4258 100644
+index 6e7ee87633..dc5f75cd39 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
 @@ -948,6 +948,10 @@

debian/patches/pve/0051-PVE-backup-improve-error-when-copy-before-write-fail.patch

@@ -96,10 +96,10 @@ index dc6cafe7fa..a27d2d7d9f 100644
  
  #endif /* COPY_BEFORE_WRITE_H */
 diff --git a/pve-backup.c b/pve-backup.c
-index a747d12d3d..4e730aa3da 100644
+index 7cc1dd3724..07709aa350 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
-@@ -374,6 +374,15 @@ static void pvebackup_complete_cb(void *opaque, int ret)
+@@ -379,6 +379,15 @@ static void pvebackup_complete_cb(void *opaque, int ret)
          di->fleecing.snapshot_access = NULL;
      }
      if (di->fleecing.cbw) {

debian/patches/series

@@ -3,18 +3,13 @@ extra/0002-scsi-megasas-Internal-cdbs-have-16-byte-length.patch
 extra/0003-ide-avoid-potential-deadlock-when-draining-during-tr.patch
 extra/0004-Revert-x86-acpi-workaround-Windows-not-handling-name.patch
 extra/0005-block-copy-before-write-use-uint64_t-for-timeout-in-.patch
-extra/0006-Revert-virtio-pci-fix-use-of-a-released-vector.patch
+extra/0006-virtio-gpu-fix-v2-migration.patch
-extra/0007-block-copy-before-write-fix-permission.patch
+extra/0007-hw-pflash-fix-block-write-start.patch
-extra/0008-block-copy-before-write-support-unligned-snapshot-di.patch
+extra/0008-target-i386-fix-operand-size-for-DATA16-REX.W-POPCNT.patch
-extra/0009-block-copy-before-write-create-block_copy-bitmap-in-.patch
+extra/0009-target-i386-rdpkru-wrpkru-are-no-prefix-instructions.patch
-extra/0010-qapi-blockdev-backup-add-discard-source-parameter.patch
+extra/0010-target-i386-fix-feature-dependency-for-WAITPKG.patch
-extra/0011-hw-virtio-Fix-the-de-initialization-of-vhost-user-de.patch
+extra/0011-Revert-virtio-pci-fix-use-of-a-released-vector.patch
-extra/0012-target-arm-Use-float_status-copy-in-sme_fmopa_s.patch
+extra/0012-hw-core-machine-move-compatibility-flags-for-VirtIO-.patch
-extra/0013-target-arm-Use-FPST_F16-for-SME-FMOPA-widening.patch
-extra/0014-scsi-fix-regression-and-honor-bootindex-again-for-le.patch
-extra/0015-hw-scsi-lsi53c895a-bump-instruction-limit-in-scripts.patch
-extra/0016-block-copy-Fix-missing-graph-lock.patch
-extra/0017-Revert-qemu-char-do-not-operate-on-sources-from-fina.patch
 bitmap-mirror/0001-drive-mirror-add-support-for-sync-bitmap-mode-never.patch
 bitmap-mirror/0002-drive-mirror-add-support-for-conditional-and-always-.patch
 bitmap-mirror/0003-mirror-add-check-for-bitmap-mode-without-bitmap.patch
@@ -64,7 +59,12 @@ pve/0040-Revert-block-rbd-fix-handling-of-holes-in-.bdrv_co_b.patch
 pve/0041-Revert-block-rbd-implement-bdrv_co_block_status.patch
 pve/0042-alloc-track-error-out-when-auto-remove-is-not-set.patch
 pve/0043-alloc-track-avoid-seemingly-superfluous-child-permis.patch
-pve/0044-copy-before-write-allow-specifying-minimum-cluster-s.patch
+pve/0044-block-copy-before-write-fix-permission.patch
-pve/0045-backup-add-minimum-cluster-size-to-performance-optio.patch
+pve/0045-block-copy-before-write-support-unligned-snapshot-di.patch
-pve/0046-PVE-backup-add-fleecing-option.patch
+pve/0046-block-copy-before-write-create-block_copy-bitmap-in-.patch
-pve/0047-PVE-backup-improve-error-when-copy-before-write-fail.patch
+pve/0047-qapi-blockdev-backup-add-discard-source-parameter.patch
+pve/0048-copy-before-write-allow-specifying-minimum-cluster-s.patch
+pve/0049-backup-add-minimum-cluster-size-to-performance-optio.patch
+pve/0050-PVE-backup-add-fleecing-option.patch
+pve/0051-PVE-backup-improve-error-when-copy-before-write-fail.patch
+pve-qemu-9.0-vitastor.patch