Add bdrv_co_block_status

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>

debian/changelog

@@ -1,8 +1,113 @@
-pve-qemu-kvm (6.1.1-2+vitastor1) bullseye; urgency=medium
+pve-qemu-kvm (6.2.0-11+vitastor2) bullseye; urgency=medium
+
+  * Add bdrv_co_block_status implementation for QCOW2 export support
+
+ -- Vitaliy Filippov <vitalif@yourcmc.ru>  Fri, 13 Jan 2023 20:14:59 +0300
+
+pve-qemu-kvm (6.2.0-11+vitastor1) bullseye; urgency=medium
 
   * Add Vitastor support
 
- -- Vitaliy Filippov <vitalif@yourcmc.ru>  Thu, 14 Dec 2022 19:15:40 +0300
+ -- Vitaliy Filippov <vitalif@yourcmc.ru>  Thu, 14 Dec 2022 18:13:59 +0300
+
+pve-qemu-kvm (6.2.0-11) bullseye; urgency=medium
+
+  * add 'namespace' to BlockdevOptionsPbs for live-restore support
+
+  * vma: create: support 64KiB-unaligned input images like to improve backing
+    up some VM templates
+
+  * block: alloc-track: avoid unlikely, but possible premature break
+
+ -- Proxmox Support Team <support@proxmox.com>  Wed, 22 Jun 2022 15:54:54 +0200
+
+pve-qemu-kvm (6.2.0-10) bullseye; urgency=medium
+
+  * fix #4101: fix backup cancellation bug with iothreads
+
+ -- Proxmox Support Team <support@proxmox.com>  Thu, 9 Jun 2022 16:35:51 +0200
+
+pve-qemu-kvm (6.2.0-9) bullseye; urgency=medium
+
+  * fix possible race conditions during cancellation of a PBS backup
+
+ -- Proxmox Support Team <support@proxmox.com>  Wed, 08 Jun 2022 14:03:22 +0200
+
+pve-qemu-kvm (6.2.0-8) bullseye; urgency=medium
+
+  * revert "block/rbd: implement bdrv_co_block_status" to work around
+    performance regression when backing up large RBD disk
+
+ -- Proxmox Support Team <support@proxmox.com>  Thu, 19 May 2022 09:24:45 +0200
+
+pve-qemu-kvm (6.2.0-7) bullseye; urgency=medium
+
+  * Proxmox Backup Server namespace support
+
+ -- Proxmox Support Team <support@proxmox.com>  Thu, 12 May 2022 16:05:56 +0200
+
+pve-qemu-kvm (6.2.0-6) bullseye; urgency=medium
+
+  * block/gluster: correctly set max_pdiscard which is int64_t to avoid
+    triggering assertion
+
+  * ui/vnc.c: Fixed a deadlock bug
+
+  * display/qxl-render: fix race condition in qxl_cursor (CVE-2021-4207) and
+    integer overflow in cursor_alloc (CVE-2021-4206)
+
+ -- Proxmox Support Team <support@proxmox.com>  Wed, 11 May 2022 10:42:53 +0200
+
+pve-qemu-kvm (6.2.0-5) bullseye; urgency=medium
+
+  * vma: allow partial restore by skipping some disk
+
+ -- Proxmox Support Team <support@proxmox.com>  Mon, 25 Apr 2022 10:13:46 +0200
+
+pve-qemu-kvm (6.2.0-4) bullseye; urgency=medium
+
+  * d/control: add libgbm to build dependencies
+
+  * d/control: add suggest dependency-hint for libgl1
+
+  * various stable backports:
+    + virtio-net: fix map leaking on error during receive
+    + memory: Fix incorrect calls of log_global_start/stop
+    + acpi: fix OEM ID/OEM Table ID padding
+    + vhost-vsock: detach the virqueue element in case of error
+    + vhost-user: remove VirtQ notifier restore
+    + vhost-user: fix VirtQ notifier cleanup
+    + virtio: fix the condition for iommu_platform not supported
+
+ -- Proxmox Support Team <support@proxmox.com>  Fri, 22 Apr 2022 11:52:30 +0200
+
+pve-qemu-kvm (6.2.0-3) bullseye; urgency=medium
+
+  *  cherry-pick fix for some manually added ACPI table SLIC entries via the
+     custom args flag.
+
+ -- Proxmox Support Team <support@proxmox.com>  Fri, 15 Apr 2022 09:09:37 +0200
+
+pve-qemu-kvm (6.2.0-2) bullseye; urgency=medium
+
+  * compile in virgl support
+
+  * enable zstd support
+
+  * drop sdl dependency (it was disabled at compile time already)
+
+  * recommend 'numactl'
+
+  * fix an issue with multi-disk backups where chunks would be written
+    multiple times
+
+ -- Proxmox Support Team <support@proxmox.com>  Thu, 03 Mar 2022 12:03:44 +0100
+
+pve-qemu-kvm (6.2.0-1) bullseye; urgency=medium
+
+  * update to QEMU stable release 6.2.0
+
+ -- Proxmox Support Team <support@proxmox.com>  Thu, 17 Feb 2022 06:23:14 +0100
 
 pve-qemu-kvm (6.1.1-2) bullseye; urgency=medium
 

debian/control

@@ -10,7 +10,9 @@ Build-Depends: autotools-dev,
                libattr1-dev,
                libcap-ng-dev,
                libcurl4-gnutls-dev,
+               libepoxy-dev,
                libfdt-dev,
+               libgbm-dev,
                libglusterfs-dev (>= 5.2-2),
                libgnutls28-dev,
                libiscsi-dev (>= 1.12.0),
@@ -20,7 +22,7 @@ Build-Depends: autotools-dev,
                libnuma-dev,
                libpci-dev,
                libpixman-1-dev,
-               libproxmox-backup-qemu0-dev (>= 1.0.3-1),
+               libproxmox-backup-qemu0-dev (>= 1.3.0-1),
                librbd-dev (>= 0.48),
                libsdl1.2-dev,
                libseccomp-dev,
@@ -30,6 +32,8 @@ Build-Depends: autotools-dev,
                liburing-dev,
                libusb-1.0-0-dev (>= 1.0.17-1),
                libusbredirparser-dev (>= 0.6-2),
+               libvirglrenderer-dev,
+               libzstd-dev,
                meson,
                python3-minimal,
                python3-sphinx,
@@ -45,7 +49,6 @@ Package: pve-qemu-kvm
 Architecture: any
 Depends: ceph-common (>= 0.48),
          iproute2,
-         libaio1,
          libgfapi0 | glusterfs-common (>= 5.6),
          libgfchangelog0 | glusterfs-common (>= 5.6),
          libgfdb0 | glusterfs-common (>= 5.6),
@@ -56,14 +59,14 @@ Depends: ceph-common (>= 0.48),
          libiscsi4 (>= 1.12.0) | libiscsi7,
          libjemalloc2,
          libjpeg62-turbo,
-         libsdl1.2debian,
          libspice-server1 (>= 0.14.0~),
          libusb-1.0-0 (>= 1.0.17-1),
          libusbredirparser1 (>= 0.6-2),
          libuuid1,
-         numactl,
          ${misc:Depends},
          ${shlibs:Depends},
+Recommends: numactl
+Suggests: libgl1
 Conflicts: kvm,
            pve-kvm,
            pve-qemu-kvm-2.6.18,

debian/copyright

@@ -25,7 +25,7 @@ License:
 
     In particular, the QEMU virtual CPU core library (libqemu.a) is
     released under the GNU Lesser General Public License version 2 or later.
-    On Debian systems, the complete text of the GNU Lesser General Public 
+    On Debian systems, the complete text of the GNU Lesser General Public
     License can be found in the file /usr/share/common-licenses/LGPL.
 
     Some hardware device emulation sources and other QEMU functionality are

debian/patches/bitmap-mirror/0001-drive-mirror-add-support-for-sync-bitmap-mode-never.patch

@@ -36,7 +36,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  5 files changed, 145 insertions(+), 29 deletions(-)
 
 diff --git a/block/mirror.c b/block/mirror.c
-index 85b781bc21..0821214138 100644
+index efec2c7674..f7804638f9 100644
 --- a/block/mirror.c
 +++ b/block/mirror.c
 @@ -50,7 +50,7 @@ typedef struct MirrorBlockJob {
@@ -48,7 +48,7 @@ index 85b781bc21..0821214138 100644
      BlockMirrorBackingMode backing_mode;
      /* Whether the target image requires explicit zero-initialization */
      bool zero_target;
-@@ -65,6 +65,8 @@ typedef struct MirrorBlockJob {
+@@ -64,6 +64,8 @@ typedef struct MirrorBlockJob {
      size_t buf_size;
      int64_t bdev_length;
      unsigned long *cow_bitmap;
@@ -57,7 +57,7 @@ index 85b781bc21..0821214138 100644
      BdrvDirtyBitmap *dirty_bitmap;
      BdrvDirtyBitmapIter *dbi;
      uint8_t *buf;
-@@ -697,7 +699,8 @@ static int mirror_exit_common(Job *job)
+@@ -695,7 +697,8 @@ static int mirror_exit_common(Job *job)
      bdrv_child_refresh_perms(mirror_top_bs, mirror_top_bs->backing,
                               &error_abort);
      if (!abort && s->backing_mode == MIRROR_SOURCE_BACKING_CHAIN) {
@@ -67,7 +67,7 @@ index 85b781bc21..0821214138 100644
          BlockDriverState *unfiltered_target = bdrv_skip_filters(target_bs);
  
          if (bdrv_cow_bs(unfiltered_target) != backing) {
-@@ -802,6 +805,16 @@ static void mirror_abort(Job *job)
+@@ -800,6 +803,16 @@ static void mirror_abort(Job *job)
      assert(ret == 0);
  }
  
@@ -84,7 +84,7 @@ index 85b781bc21..0821214138 100644
  static void coroutine_fn mirror_throttle(MirrorBlockJob *s)
  {
      int64_t now = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);
-@@ -983,7 +996,8 @@ static int coroutine_fn mirror_run(Job *job, Error **errp)
+@@ -979,7 +992,8 @@ static int coroutine_fn mirror_run(Job *job, Error **errp)
      mirror_free_init(s);
  
      s->last_pause_ns = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);
@@ -94,7 +94,7 @@ index 85b781bc21..0821214138 100644
          ret = mirror_dirty_init(s);
          if (ret < 0 || job_is_cancelled(&s->common.job)) {
              goto immediate_exit;
-@@ -1216,6 +1230,7 @@ static const BlockJobDriver mirror_job_driver = {
+@@ -1221,6 +1235,7 @@ static const BlockJobDriver mirror_job_driver = {
          .run                    = mirror_run,
          .prepare                = mirror_prepare,
          .abort                  = mirror_abort,
@@ -102,15 +102,15 @@ index 85b781bc21..0821214138 100644
          .pause                  = mirror_pause,
          .complete               = mirror_complete,
          .cancel                 = mirror_cancel,
-@@ -1232,6 +1247,7 @@ static const BlockJobDriver commit_active_job_driver = {
+@@ -1237,6 +1252,7 @@ static const BlockJobDriver commit_active_job_driver = {
          .run                    = mirror_run,
          .prepare                = mirror_prepare,
          .abort                  = mirror_abort,
 +        .clean                  = mirror_clean,
          .pause                  = mirror_pause,
          .complete               = mirror_complete,
-     },
-@@ -1594,7 +1610,10 @@ static BlockJob *mirror_start_job(
+         .cancel                 = commit_active_cancel,
+@@ -1602,7 +1618,10 @@ static BlockJob *mirror_start_job(
                               BlockCompletionFunc *cb,
                               void *opaque,
                               const BlockJobDriver *driver,
@@ -122,7 +122,7 @@ index 85b781bc21..0821214138 100644
                               bool auto_complete, const char *filter_node_name,
                               bool is_mirror, MirrorCopyMode copy_mode,
                               Error **errp)
-@@ -1606,10 +1625,39 @@ static BlockJob *mirror_start_job(
+@@ -1614,10 +1633,39 @@ static BlockJob *mirror_start_job(
      uint64_t target_perms, target_shared_perms;
      int ret;
  
@@ -164,7 +164,7 @@ index 85b781bc21..0821214138 100644
      assert(is_power_of_2(granularity));
  
      if (buf_size < 0) {
-@@ -1747,7 +1795,9 @@ static BlockJob *mirror_start_job(
+@@ -1755,7 +1803,9 @@ static BlockJob *mirror_start_job(
      s->replaces = g_strdup(replaces);
      s->on_source_error = on_source_error;
      s->on_target_error = on_target_error;
@@ -175,7 +175,7 @@ index 85b781bc21..0821214138 100644
      s->backing_mode = backing_mode;
      s->zero_target = zero_target;
      s->copy_mode = copy_mode;
-@@ -1768,6 +1818,18 @@ static BlockJob *mirror_start_job(
+@@ -1776,6 +1826,18 @@ static BlockJob *mirror_start_job(
          bdrv_disable_dirty_bitmap(s->dirty_bitmap);
      }
  
@@ -194,7 +194,7 @@ index 85b781bc21..0821214138 100644
      ret = block_job_add_bdrv(&s->common, "source", bs, 0,
                               BLK_PERM_WRITE_UNCHANGED | BLK_PERM_WRITE |
                               BLK_PERM_CONSISTENT_READ,
-@@ -1845,6 +1907,9 @@ fail:
+@@ -1853,6 +1915,9 @@ fail:
          if (s->dirty_bitmap) {
              bdrv_release_dirty_bitmap(s->dirty_bitmap);
          }
@@ -204,7 +204,7 @@ index 85b781bc21..0821214138 100644
          job_early_fail(&s->common.job);
      }
  
-@@ -1862,29 +1927,23 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
+@@ -1870,29 +1935,23 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
                    BlockDriverState *target, const char *replaces,
                    int creation_flags, int64_t speed,
                    uint32_t granularity, int64_t buf_size,
@@ -239,7 +239,7 @@ index 85b781bc21..0821214138 100644
  }
  
  BlockJob *commit_active_start(const char *job_id, BlockDriverState *bs,
-@@ -1909,7 +1968,8 @@ BlockJob *commit_active_start(const char *job_id, BlockDriverState *bs,
+@@ -1917,7 +1976,8 @@ BlockJob *commit_active_start(const char *job_id, BlockDriverState *bs,
                       job_id, bs, creation_flags, base, NULL, speed, 0, 0,
                       MIRROR_LEAVE_BACKING_CHAIN, false,
                       on_error, on_error, true, cb, opaque,
@@ -250,10 +250,10 @@ index 85b781bc21..0821214138 100644
                       errp);
      if (!job) {
 diff --git a/blockdev.c b/blockdev.c
-index 3d8ac368a1..03e99264dc 100644
+index b35072644e..9940116fe0 100644
 --- a/blockdev.c
 +++ b/blockdev.c
-@@ -2957,6 +2957,10 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
+@@ -2956,6 +2956,10 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
                                     BlockDriverState *target,
                                     bool has_replaces, const char *replaces,
                                     enum MirrorSyncMode sync,
@@ -264,7 +264,7 @@ index 3d8ac368a1..03e99264dc 100644
                                     BlockMirrorBackingMode backing_mode,
                                     bool zero_target,
                                     bool has_speed, int64_t speed,
-@@ -2976,6 +2980,7 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
+@@ -2975,6 +2979,7 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
  {
      BlockDriverState *unfiltered_bs;
      int job_flags = JOB_DEFAULT;
@@ -272,7 +272,7 @@ index 3d8ac368a1..03e99264dc 100644
  
      if (!has_speed) {
          speed = 0;
-@@ -3030,6 +3035,29 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
+@@ -3029,6 +3034,29 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
          sync = MIRROR_SYNC_MODE_FULL;
      }
  
@@ -302,7 +302,7 @@ index 3d8ac368a1..03e99264dc 100644
      if (!has_replaces) {
          /* We want to mirror from @bs, but keep implicit filters on top */
          unfiltered_bs = bdrv_skip_implicit_filters(bs);
-@@ -3076,8 +3104,8 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
+@@ -3075,8 +3103,8 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
       * and will allow to check whether the node still exist at mirror completion
       */
      mirror_start(job_id, bs, target,
@@ -313,7 +313,7 @@ index 3d8ac368a1..03e99264dc 100644
                   on_source_error, on_target_error, unmap, filter_node_name,
                   copy_mode, errp);
  }
-@@ -3222,6 +3250,8 @@ void qmp_drive_mirror(DriveMirror *arg, Error **errp)
+@@ -3221,6 +3249,8 @@ void qmp_drive_mirror(DriveMirror *arg, Error **errp)
  
      blockdev_mirror_common(arg->has_job_id ? arg->job_id : NULL, bs, target_bs,
                             arg->has_replaces, arg->replaces, arg->sync,
@@ -322,7 +322,7 @@ index 3d8ac368a1..03e99264dc 100644
                             backing_mode, zero_target,
                             arg->has_speed, arg->speed,
                             arg->has_granularity, arg->granularity,
-@@ -3243,6 +3273,8 @@ void qmp_blockdev_mirror(bool has_job_id, const char *job_id,
+@@ -3242,6 +3272,8 @@ void qmp_blockdev_mirror(bool has_job_id, const char *job_id,
                           const char *device, const char *target,
                           bool has_replaces, const char *replaces,
                           MirrorSyncMode sync,
@@ -331,7 +331,7 @@ index 3d8ac368a1..03e99264dc 100644
                           bool has_speed, int64_t speed,
                           bool has_granularity, uint32_t granularity,
                           bool has_buf_size, int64_t buf_size,
-@@ -3292,7 +3324,8 @@ void qmp_blockdev_mirror(bool has_job_id, const char *job_id,
+@@ -3291,7 +3323,8 @@ void qmp_blockdev_mirror(bool has_job_id, const char *job_id,
      }
  
      blockdev_mirror_common(has_job_id ? job_id : NULL, bs, target_bs,
@@ -342,10 +342,10 @@ index 3d8ac368a1..03e99264dc 100644
                             has_granularity, granularity,
                             has_buf_size, buf_size,
 diff --git a/include/block/block_int.h b/include/block/block_int.h
-index c31cbd034a..11442893d0 100644
+index f4c75e8ba9..ee0aeb1414 100644
 --- a/include/block/block_int.h
 +++ b/include/block/block_int.h
-@@ -1254,7 +1254,9 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
+@@ -1287,7 +1287,9 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
                    BlockDriverState *target, const char *replaces,
                    int creation_flags, int64_t speed,
                    uint32_t granularity, int64_t buf_size,
@@ -357,10 +357,10 @@ index c31cbd034a..11442893d0 100644
                    BlockdevOnError on_source_error,
                    BlockdevOnError on_target_error,
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 675d8265eb..6356a63695 100644
+index 1d3dd9cb48..da5dca1e3b 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -1938,10 +1938,19 @@
+@@ -1995,10 +1995,19 @@
  #        (all the disk, only the sectors allocated in the topmost image, or
  #        only new I/O).
  #
@@ -381,7 +381,7 @@ index 675d8265eb..6356a63695 100644
  #
  # @buf-size: maximum amount of data in flight from source to
  #            target (since 1.4).
-@@ -1979,7 +1988,9 @@
+@@ -2036,7 +2045,9 @@
  { 'struct': 'DriveMirror',
    'data': { '*job-id': 'str', 'device': 'str', 'target': 'str',
              '*format': 'str', '*node-name': 'str', '*replaces': 'str',
@@ -392,7 +392,7 @@ index 675d8265eb..6356a63695 100644
              '*speed': 'int', '*granularity': 'uint32',
              '*buf-size': 'int', '*on-source-error': 'BlockdevOnError',
              '*on-target-error': 'BlockdevOnError',
-@@ -2247,10 +2258,19 @@
+@@ -2308,10 +2319,19 @@
  #        (all the disk, only the sectors allocated in the topmost image, or
  #        only new I/O).
  #
@@ -413,7 +413,7 @@ index 675d8265eb..6356a63695 100644
  #
  # @buf-size: maximum amount of data in flight from source to
  #            target
-@@ -2299,7 +2319,8 @@
+@@ -2360,7 +2380,8 @@
  { 'command': 'blockdev-mirror',
    'data': { '*job-id': 'str', 'device': 'str', 'target': 'str',
              '*replaces': 'str',
@@ -424,10 +424,10 @@ index 675d8265eb..6356a63695 100644
              '*buf-size': 'int', '*on-source-error': 'BlockdevOnError',
              '*on-target-error': 'BlockdevOnError',
 diff --git a/tests/unit/test-block-iothread.c b/tests/unit/test-block-iothread.c
-index c39e70b2f5..470ef79ae0 100644
+index aea660aeed..22b9770a3e 100644
 --- a/tests/unit/test-block-iothread.c
 +++ b/tests/unit/test-block-iothread.c
-@@ -617,8 +617,8 @@ static void test_propagate_mirror(void)
+@@ -626,8 +626,8 @@ static void test_propagate_mirror(void)
  
      /* Start a mirror job */
      mirror_start("job0", src, target, NULL, JOB_DEFAULT, 0, 0, 0,

debian/patches/bitmap-mirror/0002-drive-mirror-add-support-for-conditional-and-always-.patch

@@ -24,10 +24,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 18 insertions(+), 6 deletions(-)
 
 diff --git a/block/mirror.c b/block/mirror.c
-index 0821214138..c688726fae 100644
+index f7804638f9..4f5f74e2cf 100644
 --- a/block/mirror.c
 +++ b/block/mirror.c
-@@ -674,8 +674,6 @@ static int mirror_exit_common(Job *job)
+@@ -672,8 +672,6 @@ static int mirror_exit_common(Job *job)
          bdrv_unfreeze_backing_chain(mirror_top_bs, target_bs);
      }
  
@@ -36,7 +36,7 @@ index 0821214138..c688726fae 100644
      /* Make sure that the source BDS doesn't go away during bdrv_replace_node,
       * before we can call bdrv_drained_end */
      bdrv_ref(src);
-@@ -783,6 +781,18 @@ static int mirror_exit_common(Job *job)
+@@ -781,6 +779,18 @@ static int mirror_exit_common(Job *job)
      blk_set_perm(bjob->blk, 0, BLK_PERM_ALL, &error_abort);
      blk_insert_bs(bjob->blk, mirror_top_bs, &error_abort);
  
@@ -55,7 +55,7 @@ index 0821214138..c688726fae 100644
      bs_opaque->job = NULL;
  
      bdrv_drained_end(src);
-@@ -1635,10 +1645,6 @@ static BlockJob *mirror_start_job(
+@@ -1643,10 +1653,6 @@ static BlockJob *mirror_start_job(
                         " sync mode",
                         MirrorSyncMode_str(sync_mode));
              return NULL;
@@ -66,7 +66,7 @@ index 0821214138..c688726fae 100644
          }
      } else if (bitmap) {
          error_setg(errp,
-@@ -1655,6 +1661,12 @@ static BlockJob *mirror_start_job(
+@@ -1663,6 +1669,12 @@ static BlockJob *mirror_start_job(
              return NULL;
          }
          granularity = bdrv_dirty_bitmap_granularity(bitmap);

debian/patches/bitmap-mirror/0003-mirror-add-check-for-bitmap-mode-without-bitmap.patch

@@ -16,10 +16,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 3 insertions(+)
 
 diff --git a/blockdev.c b/blockdev.c
-index 03e99264dc..9e14feec87 100644
+index 9940116fe0..b113e57d68 100644
 --- a/blockdev.c
 +++ b/blockdev.c
-@@ -3056,6 +3056,9 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
+@@ -3055,6 +3055,9 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
          if (bdrv_dirty_bitmap_check(bitmap, BDRV_BITMAP_ALLOW_RO, errp)) {
              return;
          }

debian/patches/bitmap-mirror/0004-mirror-switch-to-bdrv_dirty_bitmap_merge_internal.patch

@@ -16,10 +16,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 4 insertions(+), 7 deletions(-)
 
 diff --git a/block/mirror.c b/block/mirror.c
-index c688726fae..a7f829f766 100644
+index 4f5f74e2cf..7024f3bbf0 100644
 --- a/block/mirror.c
 +++ b/block/mirror.c
-@@ -787,8 +787,8 @@ static int mirror_exit_common(Job *job)
+@@ -785,8 +785,8 @@ static int mirror_exit_common(Job *job)
               job->ret == 0 && ret == 0)) {
              /* Success; synchronize copy back to sync. */
              bdrv_clear_dirty_bitmap(s->sync_bitmap, NULL);
@@ -30,7 +30,7 @@ index c688726fae..a7f829f766 100644
          }
      }
      bdrv_release_dirty_bitmap(s->dirty_bitmap);
-@@ -1835,11 +1835,8 @@ static BlockJob *mirror_start_job(
+@@ -1843,11 +1843,8 @@ static BlockJob *mirror_start_job(
      }
  
      if (s->sync_mode == MIRROR_SYNC_MODE_BITMAP) {

debian/patches/bitmap-mirror/0006-mirror-move-some-checks-to-qmp.patch

@@ -19,10 +19,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  3 files changed, 70 insertions(+), 59 deletions(-)
 
 diff --git a/block/mirror.c b/block/mirror.c
-index a7f829f766..6a126d18c8 100644
+index 7024f3bbf0..6211ff22fc 100644
 --- a/block/mirror.c
 +++ b/block/mirror.c
-@@ -1635,31 +1635,13 @@ static BlockJob *mirror_start_job(
+@@ -1643,31 +1643,13 @@ static BlockJob *mirror_start_job(
      uint64_t target_perms, target_shared_perms;
      int ret;
  
@@ -60,10 +60,10 @@ index a7f829f766..6a126d18c8 100644
  
          if (bitmap_mode != BITMAP_SYNC_MODE_NEVER) {
 diff --git a/blockdev.c b/blockdev.c
-index 9e14feec87..b6f797b41f 100644
+index b113e57d68..4be0863050 100644
 --- a/blockdev.c
 +++ b/blockdev.c
-@@ -3035,7 +3035,36 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
+@@ -3034,7 +3034,36 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
          sync = MIRROR_SYNC_MODE_FULL;
      }
  

debian/patches/extra/0001-monitor-qmp-fix-race-with-clients-disconnecting-earl.patch

@@ -48,7 +48,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  6 files changed, 59 insertions(+), 5 deletions(-)
 
 diff --git a/include/monitor/monitor.h b/include/monitor/monitor.h
-index 1a8a369b50..2c8a558c67 100644
+index 12d395d62d..b182943324 100644
 --- a/include/monitor/monitor.h
 +++ b/include/monitor/monitor.h
 @@ -16,6 +16,7 @@ extern QemuOptsList qemu_mon_opts;
@@ -60,10 +60,10 @@ index 1a8a369b50..2c8a558c67 100644
  void monitor_init_globals(void);
  void monitor_init_globals_core(void);
 diff --git a/monitor/monitor-internal.h b/monitor/monitor-internal.h
-index 9c3a09cb01..a92be8c3f7 100644
+index 3da3f86c6a..9953e0cd2d 100644
 --- a/monitor/monitor-internal.h
 +++ b/monitor/monitor-internal.h
-@@ -144,6 +144,13 @@ typedef struct {
+@@ -151,6 +151,13 @@ typedef struct {
      QemuMutex qmp_queue_lock;
      /* Input queue that holds all the parsed QMP requests */
      GQueue *qmp_requests;
@@ -78,7 +78,7 @@ index 9c3a09cb01..a92be8c3f7 100644
  
  /**
 diff --git a/monitor/monitor.c b/monitor/monitor.c
-index 46a171bca6..5ccdd2424b 100644
+index 21c7a68758..ad9813567a 100644
 --- a/monitor/monitor.c
 +++ b/monitor/monitor.c
 @@ -135,6 +135,21 @@ bool monitor_cur_is_qmp(void)
@@ -144,10 +144,10 @@ index 092c527b6f..6b8cfcf6d8 100644
          monitor_qmp_caps_reset(mon);
          data = qmp_greeting(mon);
 diff --git a/qapi/qmp-dispatch.c b/qapi/qmp-dispatch.c
-index 59600210ce..95602446eb 100644
+index d378bccac7..fb8936e7cd 100644
 --- a/qapi/qmp-dispatch.c
 +++ b/qapi/qmp-dispatch.c
-@@ -120,16 +120,28 @@ typedef struct QmpDispatchBH {
+@@ -118,16 +118,28 @@ typedef struct QmpDispatchBH {
      QObject **ret;
      Error **errp;
      Coroutine *co;
@@ -180,7 +180,7 @@ index 59600210ce..95602446eb 100644
      aio_co_wake(data->co);
  }
  
-@@ -243,6 +255,7 @@ QDict *qmp_dispatch(const QmpCommandList *cmds, QObject *request,
+@@ -232,6 +244,7 @@ QDict *qmp_dispatch(const QmpCommandList *cmds, QObject *request,
              .ret        = &ret,
              .errp       = &err,
              .co         = qemu_coroutine_self(),

debian/patches/extra/0002-monitor-hmp-add-support-for-flag-argument-with-value.patch

@@ -18,10 +18,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 16 insertions(+), 1 deletion(-)
 
 diff --git a/monitor/hmp.c b/monitor/hmp.c
-index d50c3124e1..a32dce7a35 100644
+index b20737e63c..b29dbb1833 100644
 --- a/monitor/hmp.c
 +++ b/monitor/hmp.c
-@@ -980,6 +980,7 @@ static QDict *monitor_parse_arguments(Monitor *mon,
+@@ -981,6 +981,7 @@ static QDict *monitor_parse_arguments(Monitor *mon,
              {
                  const char *tmp = p;
                  int skip_key = 0;
@@ -29,7 +29,7 @@ index d50c3124e1..a32dce7a35 100644
                  /* option */
  
                  c = *typestr++;
-@@ -1002,8 +1003,22 @@ static QDict *monitor_parse_arguments(Monitor *mon,
+@@ -1003,8 +1004,22 @@ static QDict *monitor_parse_arguments(Monitor *mon,
                      }
                      if (skip_key) {
                          p = tmp;

debian/patches/extra/0003-monitor-refactor-set-expire_password-and-allow-VNC-d.patch

@@ -24,18 +24,19 @@ Suggested-by: Eric Blake <eblake@redhat.com>
 Suggested-by: Markus Armbruster <armbru@redhat.com>
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 ---
- hmp-commands.hx    |  29 ++++----
+ hmp-commands.hx    |  24 ++++---
  monitor/hmp-cmds.c |  57 +++++++++++++++-
  monitor/qmp-cmds.c |  62 ++++++-----------
  qapi/ui.json       | 165 ++++++++++++++++++++++++++++++++++++++-------
- 4 files changed, 233 insertions(+), 80 deletions(-)
+ 4 files changed, 231 insertions(+), 77 deletions(-)
 
 diff --git a/hmp-commands.hx b/hmp-commands.hx
-index 8e45bce2cd..d78e4cfc47 100644
+index 70a9136ac2..5efb47fc32 100644
 --- a/hmp-commands.hx
 +++ b/hmp-commands.hx
-@@ -1514,34 +1514,35 @@ ERST
+@@ -1514,33 +1514,35 @@ ERST
  
      {
          .name       = "set_password",
@@ -49,19 +50,16 @@ index 8e45bce2cd..d78e4cfc47 100644
  
  SRST
 -``set_password [ vnc | spice ] password [ action-if-connected ]``
--  Change spice/vnc password.  Use zero to make the password stay valid
--  forever.  *action-if-connected* specifies what should happen in
--  case a connection is established: *fail* makes the password change
--  fail.  *disconnect* changes the password and disconnects the
--  client.  *keep* changes the password and keeps the connection up.
--  *keep* is the default.
+-  Change spice/vnc password.  *action-if-connected* specifies what
+-  should happen in case a connection is established: *fail* makes the
+-  password change fail.  *disconnect* changes the password and
 +``set_password [ vnc | spice ] password [ -d display ] [ action-if-connected ]``
 +  Change spice/vnc password.  *display* can be used with 'vnc' to specify
 +  which display to set the password on.  *action-if-connected* specifies
 +  what should happen in case a connection is established: *fail* makes
 +  the password change fail.  *disconnect* changes the password and
-+  disconnects the client.  *keep* changes the password and keeps the
-+  connection up.  *keep* is the default.
+   disconnects the client.  *keep* changes the password and keeps the
+   connection up.  *keep* is the default.
  ERST
  
      {
@@ -86,10 +84,10 @@ index 8e45bce2cd..d78e4cfc47 100644
    ``now``
      Invalidate password instantly.
 diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
-index a7e197a90b..f4ef58d257 100644
+index 9c91bf93e9..2e91ccb738 100644
 --- a/monitor/hmp-cmds.c
 +++ b/monitor/hmp-cmds.c
-@@ -1451,10 +1451,41 @@ void hmp_set_password(Monitor *mon, const QDict *qdict)
+@@ -1384,10 +1384,41 @@ void hmp_set_password(Monitor *mon, const QDict *qdict)
  {
      const char *protocol  = qdict_get_str(qdict, "protocol");
      const char *password  = qdict_get_str(qdict, "password");
@@ -132,7 +130,7 @@ index a7e197a90b..f4ef58d257 100644
      hmp_handle_error(mon, err);
  }
  
-@@ -1462,9 +1493,31 @@ void hmp_expire_password(Monitor *mon, const QDict *qdict)
+@@ -1395,9 +1426,31 @@ void hmp_expire_password(Monitor *mon, const QDict *qdict)
  {
      const char *protocol  = qdict_get_str(qdict, "protocol");
      const char *whenstr = qdict_get_str(qdict, "time");
@@ -166,10 +164,10 @@ index a7e197a90b..f4ef58d257 100644
  }
  
 diff --git a/monitor/qmp-cmds.c b/monitor/qmp-cmds.c
-index f7d64a6457..65882b5997 100644
+index 343353e27a..729ca7cceb 100644
 --- a/monitor/qmp-cmds.c
 +++ b/monitor/qmp-cmds.c
-@@ -164,45 +164,30 @@ void qmp_system_wakeup(Error **errp)
+@@ -167,45 +167,30 @@ void qmp_system_wakeup(Error **errp)
      qemu_system_wakeup_request(QEMU_WAKEUP_REASON_OTHER, errp);
  }
  
@@ -231,7 +229,7 @@ index f7d64a6457..65882b5997 100644
      }
  
      if (rc != 0) {
-@@ -210,11 +195,11 @@ void qmp_set_password(const char *protocol, const char *password,
+@@ -213,11 +198,11 @@ void qmp_set_password(const char *protocol, const char *password,
      }
  }
  
@@ -245,7 +243,7 @@ index f7d64a6457..65882b5997 100644
  
      if (strcmp(whenstr, "now") == 0) {
          when = 0;
-@@ -226,17 +211,14 @@ void qmp_expire_password(const char *protocol, const char *whenstr,
+@@ -229,17 +214,14 @@ void qmp_expire_password(const char *protocol, const char *whenstr,
          when = strtoull(whenstr, NULL, 10);
      }
  
@@ -268,7 +266,7 @@ index f7d64a6457..65882b5997 100644
  
      if (rc != 0) {
 diff --git a/qapi/ui.json b/qapi/ui.json
-index fd9677d48e..cba8665b73 100644
+index d7567ac866..4244c62c30 100644
 --- a/qapi/ui.json
 +++ b/qapi/ui.json
 @@ -9,22 +9,23 @@
@@ -284,8 +282,8 @@ index fd9677d48e..cba8665b73 100644
 +#
 +##
 +{ 'enum': 'DisplayProtocol',
-+  'data': [ { 'name': 'vnc', 'if': 'defined(CONFIG_VNC)' },
-+            { 'name': 'spice', 'if': 'defined(CONFIG_SPICE)' } ] }
++  'data': [ { 'name': 'vnc', 'if': 'CONFIG_VNC' },
++            { 'name': 'spice', 'if': 'CONFIG_SPICE' } ] }
 +
  ##
  # @set_password:

debian/patches/extra/0004-block-mirror-fix-NULL-pointer-dereference-in-mirror_.patch

@@ -1,83 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Stefano Garzarella <sgarzare@redhat.com>
-Date: Fri, 10 Sep 2021 14:45:33 +0200
-Subject: [PATCH] block/mirror: fix NULL pointer dereference in
- mirror_wait_on_conflicts()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-In mirror_iteration() we call mirror_wait_on_conflicts() with
-`self` parameter set to NULL.
-
-Starting from commit d44dae1a7c we dereference `self` pointer in
-mirror_wait_on_conflicts() without checks if it is not NULL.
-
-Backtrace:
-  Program terminated with signal SIGSEGV, Segmentation fault.
-  #0  mirror_wait_on_conflicts (self=0x0, s=<optimized out>, offset=<optimized out>, bytes=<optimized out>)
-      at ../block/mirror.c:172
-  172	                self->waiting_for_op = op;
-  [Current thread is 1 (Thread 0x7f0908931ec0 (LWP 380249))]
-  (gdb) bt
-  #0  mirror_wait_on_conflicts (self=0x0, s=<optimized out>, offset=<optimized out>, bytes=<optimized out>)
-      at ../block/mirror.c:172
-  #1  0x00005610c5d9d631 in mirror_run (job=0x5610c76a2c00, errp=<optimized out>) at ../block/mirror.c:491
-  #2  0x00005610c5d58726 in job_co_entry (opaque=0x5610c76a2c00) at ../job.c:917
-  #3  0x00005610c5f046c6 in coroutine_trampoline (i0=<optimized out>, i1=<optimized out>)
-      at ../util/coroutine-ucontext.c:173
-  #4  0x00007f0909975820 in ?? () at ../sysdeps/unix/sysv/linux/x86_64/__start_context.S:91
-      from /usr/lib64/libc.so.6
-
-Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2001404
-Fixes: d44dae1a7c ("block/mirror: fix active mirror dead-lock in mirror_wait_on_conflicts")
-Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
-Message-Id: <20210910124533.288318-1-sgarzare@redhat.com>
-Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Signed-off-by: Hanna Reitz <hreitz@redhat.com>
-(cherry picked from commit 66fed30c9cd11854fc878a4eceb507e915d7c9cd)
-Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
-Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
----
- block/mirror.c | 25 ++++++++++++++++---------
- 1 file changed, 16 insertions(+), 9 deletions(-)
-
-diff --git a/block/mirror.c b/block/mirror.c
-index 98fc66eabf..85b781bc21 100644
---- a/block/mirror.c
-+++ b/block/mirror.c
-@@ -160,18 +160,25 @@ static void coroutine_fn mirror_wait_on_conflicts(MirrorOp *self,
-             if (ranges_overlap(self_start_chunk, self_nb_chunks,
-                                op_start_chunk, op_nb_chunks))
-             {
--                /*
--                 * If the operation is already (indirectly) waiting for us, or
--                 * will wait for us as soon as it wakes up, then just go on
--                 * (instead of producing a deadlock in the former case).
--                 */
--                if (op->waiting_for_op) {
--                    continue;
-+                if (self) {
-+                    /*
-+                     * If the operation is already (indirectly) waiting for us,
-+                     * or will wait for us as soon as it wakes up, then just go
-+                     * on (instead of producing a deadlock in the former case).
-+                     */
-+                    if (op->waiting_for_op) {
-+                        continue;
-+                    }
-+
-+                    self->waiting_for_op = op;
-                 }
- 
--                self->waiting_for_op = op;
-                 qemu_co_queue_wait(&op->waiting_requests, NULL);
--                self->waiting_for_op = NULL;
-+
-+                if (self) {
-+                    self->waiting_for_op = NULL;
-+                }
-+
-                 break;
-             }
-         }

debian/patches/extra/0006-block-io-Update-BSC-only-if-want_zero-is-true.patch

@@ -0,0 +1,43 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Hanna Reitz <hreitz@redhat.com>
+Date: Tue, 18 Jan 2022 17:59:59 +0100
+Subject: [PATCH] block/io: Update BSC only if want_zero is true
+
+We update the block-status cache whenever we get new information from a
+bdrv_co_block_status() call to the block driver.  However, if we have
+passed want_zero=false to that call, it may flag areas containing zeroes
+as data, and so we would update the block-status cache with wrong
+information.
+
+Therefore, we should not update the cache with want_zero=false.
+
+Reported-by: Nir Soffer <nsoffer@redhat.com>
+Fixes: 0bc329fbb00 ("block: block-status cache for data regions")
+Reviewed-by: Nir Soffer <nsoffer@redhat.com>
+Cc: qemu-stable@nongnu.org
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+Message-Id: <20220118170000.49423-2-hreitz@redhat.com>
+Reviewed-by: Eric Blake <eblake@redhat.com>
+Signed-off-by: Eric Blake <eblake@redhat.com>
+---
+ block/io.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/block/io.c b/block/io.c
+index bb0a254def..4e4cb556c5 100644
+--- a/block/io.c
++++ b/block/io.c
+@@ -2497,8 +2497,12 @@ static int coroutine_fn bdrv_co_block_status(BlockDriverState *bs,
+              * non-protocol nodes, and then it is never used.  However, filling
+              * the cache requires an RCU update, so double check here to avoid
+              * such an update if possible.
++             *
++             * Check want_zero, because we only want to update the cache when we
++             * have accurate information about what is zero and what is data.
+              */
+-            if (ret == (BDRV_BLOCK_DATA | BDRV_BLOCK_OFFSET_VALID) &&
++            if (want_zero &&
++                ret == (BDRV_BLOCK_DATA | BDRV_BLOCK_OFFSET_VALID) &&
+                 QLIST_EMPTY(&bs->children))
+             {
+                 /*

debian/patches/extra/0007-block-nbd-Delete-reconnect-delay-timer-when-done.patch

@@ -0,0 +1,40 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Hanna Reitz <hreitz@redhat.com>
+Date: Wed, 9 Feb 2022 15:02:52 +0100
+Subject: [PATCH] block/nbd: Delete reconnect delay timer when done
+
+We start the reconnect delay timer to cancel the reconnection attempt
+after a while.  Once nbd_co_do_establish_connection() has returned, this
+attempt is over, and we no longer need the timer.
+
+Delete it before returning from nbd_reconnect_attempt(), so that it does
+not persist beyond the I/O request that was paused for reconnecting; we
+do not want it to fire in a drained section, because all sort of things
+can happen in such a section (e.g. the AioContext might be changed, and
+we do not want the timer to fire in the wrong context; or the BDS might
+even be deleted, and so the timer CB would access already-freed data).
+
+Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+---
+ block/nbd.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/block/nbd.c b/block/nbd.c
+index 5ef462db1b..b8e5a9b4cc 100644
+--- a/block/nbd.c
++++ b/block/nbd.c
+@@ -353,6 +353,13 @@ static coroutine_fn void nbd_reconnect_attempt(BDRVNBDState *s)
+     }
+ 
+     nbd_co_do_establish_connection(s->bs, NULL);
++
++    /*
++     * The reconnect attempt is done (maybe successfully, maybe not), so
++     * we no longer need this timer.  Delete it so it will not outlive
++     * this I/O request (so draining removes all timers).
++     */
++    reconnect_delay_timer_del(s);
+ }
+ 
+ static coroutine_fn int nbd_receive_replies(BDRVNBDState *s, uint64_t handle)

debian/patches/extra/0008-block-nbd-Assert-there-are-no-timers-when-closed.patch

@@ -0,0 +1,34 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Hanna Reitz <hreitz@redhat.com>
+Date: Wed, 9 Feb 2022 15:02:54 +0100
+Subject: [PATCH] block/nbd: Assert there are no timers when closed
+
+Our two timers must not remain armed beyond nbd_clear_bdrvstate(), or
+they will access freed data when they fire.
+
+This patch is separate from the patches that actually fix the issue
+(HEAD^^ and HEAD^) so that you can run the associated regression iotest
+(281) on a configuration that reproducibly exposes the bug.
+
+Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+[FE: backport (open_timer doesn't exist yet in 6.2.0)]
+Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
+---
+ block/nbd.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/block/nbd.c b/block/nbd.c
+index b8e5a9b4cc..aab20125d8 100644
+--- a/block/nbd.c
++++ b/block/nbd.c
+@@ -108,6 +108,9 @@ static void nbd_clear_bdrvstate(BlockDriverState *bs)
+ 
+     yank_unregister_instance(BLOCKDEV_YANK_INSTANCE(bs->node_name));
+ 
++    /* Must not leave timers behind that would access freed data */
++    assert(!s->reconnect_delay_timer);
++
+     object_unref(OBJECT(s->tlscreds));
+     qapi_free_SocketAddress(s->saddr);
+     s->saddr = NULL;

debian/patches/extra/0009-block-nbd-Move-s-ioc-on-AioContext-change.patch

@@ -0,0 +1,90 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Hanna Reitz <hreitz@redhat.com>
+Date: Wed, 9 Feb 2022 15:02:57 +0100
+Subject: [PATCH] block/nbd: Move s->ioc on AioContext change
+
+s->ioc must always be attached to the NBD node's AioContext.  If that
+context changes, s->ioc must be attached to the new context.
+
+Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2033626
+Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+[FE: backport (open_timer doesn't exist yet in 6.2.0)]
+Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
+---
+ block/nbd.c | 41 +++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 41 insertions(+)
+
+diff --git a/block/nbd.c b/block/nbd.c
+index aab20125d8..a3896c7f5f 100644
+--- a/block/nbd.c
++++ b/block/nbd.c
+@@ -2003,6 +2003,38 @@ static void nbd_cancel_in_flight(BlockDriverState *bs)
+     nbd_co_establish_connection_cancel(s->conn);
+ }
+ 
++static void nbd_attach_aio_context(BlockDriverState *bs,
++                                   AioContext *new_context)
++{
++    BDRVNBDState *s = bs->opaque;
++
++    /*
++     * The reconnect_delay_timer is scheduled in I/O paths when the
++     * connection is lost, to cancel the reconnection attempt after a
++     * given time.  Once this attempt is done (successfully or not),
++     * nbd_reconnect_attempt() ensures the timer is deleted before the
++     * respective I/O request is resumed.
++     * Since the AioContext can only be changed when a node is drained,
++     * the reconnect_delay_timer cannot be active here.
++     */
++    assert(!s->reconnect_delay_timer);
++
++    if (s->ioc) {
++        qio_channel_attach_aio_context(s->ioc, new_context);
++    }
++}
++
++static void nbd_detach_aio_context(BlockDriverState *bs)
++{
++    BDRVNBDState *s = bs->opaque;
++
++    assert(!s->reconnect_delay_timer);
++
++    if (s->ioc) {
++        qio_channel_detach_aio_context(s->ioc);
++    }
++}
++
+ static BlockDriver bdrv_nbd = {
+     .format_name                = "nbd",
+     .protocol_name              = "nbd",
+@@ -2026,6 +2058,9 @@ static BlockDriver bdrv_nbd = {
+     .bdrv_dirname               = nbd_dirname,
+     .strong_runtime_opts        = nbd_strong_runtime_opts,
+     .bdrv_cancel_in_flight      = nbd_cancel_in_flight,
++
++    .bdrv_attach_aio_context    = nbd_attach_aio_context,
++    .bdrv_detach_aio_context    = nbd_detach_aio_context,
+ };
+ 
+ static BlockDriver bdrv_nbd_tcp = {
+@@ -2051,6 +2086,9 @@ static BlockDriver bdrv_nbd_tcp = {
+     .bdrv_dirname               = nbd_dirname,
+     .strong_runtime_opts        = nbd_strong_runtime_opts,
+     .bdrv_cancel_in_flight      = nbd_cancel_in_flight,
++
++    .bdrv_attach_aio_context    = nbd_attach_aio_context,
++    .bdrv_detach_aio_context    = nbd_detach_aio_context,
+ };
+ 
+ static BlockDriver bdrv_nbd_unix = {
+@@ -2076,6 +2114,9 @@ static BlockDriver bdrv_nbd_unix = {
+     .bdrv_dirname               = nbd_dirname,
+     .strong_runtime_opts        = nbd_strong_runtime_opts,
+     .bdrv_cancel_in_flight      = nbd_cancel_in_flight,
++
++    .bdrv_attach_aio_context    = nbd_attach_aio_context,
++    .bdrv_detach_aio_context    = nbd_detach_aio_context,
+ };
+ 
+ static void bdrv_nbd_init(void)

debian/patches/extra/0010-acpi-fix-QEMU-crash-when-started-with-SLIC-table.patch

@@ -0,0 +1,89 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Igor Mammedov <imammedo@redhat.com>
+Date: Mon, 27 Dec 2021 14:31:17 -0500
+Subject: [PATCH] acpi: fix QEMU crash when started with SLIC table
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+if QEMU is started with used provided SLIC table blob,
+
+  -acpitable sig=SLIC,oem_id='CRASH ',oem_table_id="ME",oem_rev=00002210,asl_compiler_id="",asl_compiler_rev=00000000,data=/dev/null
+it will assert with:
+
+  hw/acpi/aml-build.c:61:build_append_padded_str: assertion failed: (len <= maxlen)
+
+and following backtrace:
+
+  ...
+  build_append_padded_str (array=0x555556afe320, str=0x555556afdb2e "CRASH ME", maxlen=0x6, pad=0x20) at hw/acpi/aml-build.c:61
+  acpi_table_begin (desc=0x7fffffffd1b0, array=0x555556afe320) at hw/acpi/aml-build.c:1727
+  build_fadt (tbl=0x555556afe320, linker=0x555557ca3830, f=0x7fffffffd318, oem_id=0x555556afdb2e "CRASH ME", oem_table_id=0x555556afdb34 "ME") at hw/acpi/aml-build.c:2064
+  ...
+
+which happens due to acpi_table_begin() expecting NULL terminated
+oem_id and oem_table_id strings, which is normally the case, but
+in case of user provided SLIC table, oem_id points to table's blob
+directly and as result oem_id became longer than expected.
+
+Fix issue by handling oem_id consistently and make acpi_get_slic_oem()
+return NULL terminated strings.
+
+PS:
+After [1] refactoring, oem_id semantics became inconsistent, where
+NULL terminated string was coming from machine and old way pointer
+into byte array coming from -acpitable option. That used to work
+since build_header() wasn't expecting NULL terminated string and
+blindly copied the 1st 6 bytes only.
+
+However commit [2] broke that by replacing build_header() with
+acpi_table_begin(), which was expecting NULL terminated string
+and was checking oem_id size.
+
+1) 602b45820 ("acpi: Permit OEM ID and OEM table ID fields to be changed")
+2)
+Fixes: 4b56e1e4eb08 ("acpi: build_fadt: use acpi_table_begin()/acpi_table_end() instead of build_header()")
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/786
+Signed-off-by: Igor Mammedov <imammedo@redhat.com>
+Message-Id: <20211227193120.1084176-2-imammedo@redhat.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Tested-by: Denis Lisov <dennis.lissov@gmail.com>
+Tested-by: Alexander Tsoy <alexander@tsoy.me>
+Cc: qemu-stable@nongnu.org
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+(cherry picked from commit 8cdb99af45365727ac17f45239a9b8c1d5155c6d)
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+---
+ hw/acpi/core.c       | 4 ++--
+ hw/i386/acpi-build.c | 2 ++
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/hw/acpi/core.c b/hw/acpi/core.c
+index 1e004d0078..3e811bf03c 100644
+--- a/hw/acpi/core.c
++++ b/hw/acpi/core.c
+@@ -345,8 +345,8 @@ int acpi_get_slic_oem(AcpiSlicOem *oem)
+         struct acpi_table_header *hdr = (void *)(u - sizeof(hdr->_length));
+ 
+         if (memcmp(hdr->sig, "SLIC", 4) == 0) {
+-            oem->id = hdr->oem_id;
+-            oem->table_id = hdr->oem_table_id;
++            oem->id = g_strndup(hdr->oem_id, 6);
++            oem->table_id = g_strndup(hdr->oem_table_id, 8);
+             return 0;
+         }
+     }
+diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
+index a99c6e4fe3..570f82997b 100644
+--- a/hw/i386/acpi-build.c
++++ b/hw/i386/acpi-build.c
+@@ -2721,6 +2721,8 @@ void acpi_build(AcpiBuildTables *tables, MachineState *machine)
+ 
+     /* Cleanup memory that's no longer used. */
+     g_array_free(table_offsets, true);
++    g_free(slic_oem.id);
++    g_free(slic_oem.table_id);
+ }
+ 
+ static void acpi_ram_update(MemoryRegion *mr, GArray *data)

debian/patches/extra/0011-virtio-net-fix-map-leaking-on-error-during-receive.patch

@@ -0,0 +1,38 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Jason Wang <jasowang@redhat.com>
+Date: Tue, 8 Mar 2022 10:42:51 +0800
+Subject: [PATCH] virtio-net: fix map leaking on error during receive
+
+Commit bedd7e93d0196 ("virtio-net: fix use after unmap/free for sg")
+tries to fix the use after free of the sg by caching the virtqueue
+elements in an array and unmap them at once after receiving the
+packets, But it forgot to unmap the cached elements on error which
+will lead to leaking of mapping and other unexpected results.
+
+Fixing this by detaching the cached elements on error. This addresses
+CVE-2022-26353.
+
+Reported-by: Victor Tom <vv474172261@gmail.com>
+Cc: qemu-stable@nongnu.org
+Fixes: CVE-2022-26353
+Fixes: bedd7e93d0196 ("virtio-net: fix use after unmap/free for sg")
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+(cherry picked from commit abe300d9d894f7138e1af7c8e9c88c04bfe98b37)
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+---
+ hw/net/virtio-net.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
+index f2014d5ea0..e1f4748831 100644
+--- a/hw/net/virtio-net.c
++++ b/hw/net/virtio-net.c
+@@ -1862,6 +1862,7 @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
+ 
+ err:
+     for (j = 0; j < i; j++) {
++        virtqueue_detach_element(q->rx_vq, elems[j], lens[j]);
+         g_free(elems[j]);
+     }
+ 

debian/patches/extra/0012-memory-Fix-incorrect-calls-of-log_global_start-stop.patch

@@ -0,0 +1,86 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Peter Xu <peterx@redhat.com>
+Date: Tue, 30 Nov 2021 16:00:28 +0800
+Subject: [PATCH] memory: Fix incorrect calls of log_global_start/stop
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+We should only call the log_global_start/stop when the global dirty track
+bitmask changes from zero<->non-zero.
+
+No real issue reported for this yet probably because no immediate user to
+enable both dirty rate measurement and migration at the same time.  However
+it'll be good to be prepared for it.
+
+Fixes: 63b41db4bc ("memory: make global_dirty_tracking a bitmask")
+Cc: qemu-stable@nongnu.org
+Cc: Hyman Huang <huangy81@chinatelecom.cn>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Cc: Dr. David Alan Gilbert <dgilbert@redhat.com>
+Cc: Juan Quintela <quintela@redhat.com>
+Cc: David Hildenbrand <david@redhat.com>
+Signed-off-by: Peter Xu <peterx@redhat.com>
+Reviewed-by: David Hildenbrand <david@redhat.com>
+Message-Id: <20211130080028.6474-1-peterx@redhat.com>
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+(cherry picked from commit 7b0538ed3a22ce30817f818449d10701fb0821f9)
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+---
+ softmmu/memory.c | 27 ++++++++++++++-------------
+ 1 file changed, 14 insertions(+), 13 deletions(-)
+
+diff --git a/softmmu/memory.c b/softmmu/memory.c
+index 7340e19ff5..81d4bf1454 100644
+--- a/softmmu/memory.c
++++ b/softmmu/memory.c
+@@ -2773,6 +2773,8 @@ static VMChangeStateEntry *vmstate_change;
+ 
+ void memory_global_dirty_log_start(unsigned int flags)
+ {
++    unsigned int old_flags = global_dirty_tracking;
++
+     if (vmstate_change) {
+         qemu_del_vm_change_state_handler(vmstate_change);
+         vmstate_change = NULL;
+@@ -2781,15 +2783,14 @@ void memory_global_dirty_log_start(unsigned int flags)
+     assert(flags && !(flags & (~GLOBAL_DIRTY_MASK)));
+     assert(!(global_dirty_tracking & flags));
+     global_dirty_tracking |= flags;
+-
+     trace_global_dirty_changed(global_dirty_tracking);
+ 
+-    MEMORY_LISTENER_CALL_GLOBAL(log_global_start, Forward);
+-
+-    /* Refresh DIRTY_MEMORY_MIGRATION bit.  */
+-    memory_region_transaction_begin();
+-    memory_region_update_pending = true;
+-    memory_region_transaction_commit();
++    if (!old_flags) {
++        MEMORY_LISTENER_CALL_GLOBAL(log_global_start, Forward);
++        memory_region_transaction_begin();
++        memory_region_update_pending = true;
++        memory_region_transaction_commit();
++    }
+ }
+ 
+ static void memory_global_dirty_log_do_stop(unsigned int flags)
+@@ -2800,12 +2801,12 @@ static void memory_global_dirty_log_do_stop(unsigned int flags)
+ 
+     trace_global_dirty_changed(global_dirty_tracking);
+ 
+-    /* Refresh DIRTY_MEMORY_MIGRATION bit.  */
+-    memory_region_transaction_begin();
+-    memory_region_update_pending = true;
+-    memory_region_transaction_commit();
+-
+-    MEMORY_LISTENER_CALL_GLOBAL(log_global_stop, Reverse);
++    if (!global_dirty_tracking) {
++        memory_region_transaction_begin();
++        memory_region_update_pending = true;
++        memory_region_transaction_commit();
++        MEMORY_LISTENER_CALL_GLOBAL(log_global_stop, Reverse);
++    }
+ }
+ 
+ static void memory_vm_change_state_handler(void *opaque, bool running,

debian/patches/extra/0013-acpi-fix-OEM-ID-OEM-Table-ID-padding.patch

@@ -0,0 +1,59 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Igor Mammedov <imammedo@redhat.com>
+Date: Wed, 12 Jan 2022 08:03:31 -0500
+Subject: [PATCH] acpi: fix OEM ID/OEM Table ID padding
+
+Commit [2] broke original '\0' padding of OEM ID and OEM Table ID
+fields in headers of ACPI tables. While it doesn't have impact on
+default values since QEMU uses 6 and 8 characters long values
+respectively, it broke usecase where IDs are provided on QEMU CLI.
+It shouldn't affect guest (but may cause licensing verification
+issues in guest OS).
+One of the broken usecases is user supplied SLIC table with IDs
+shorter than max possible length, where [2] mangles IDs with extra
+spaces in RSDT and FADT tables whereas guest OS expects those to
+mirror the respective values of the used SLIC table.
+
+Fix it by replacing whitespace padding with '\0' padding in
+accordance with [1] and expectations of guest OS
+
+1) ACPI spec, v2.0b
+       17.2 AML Grammar Definition
+       ...
+       //OEM ID of up to 6 characters. If the OEM ID is
+       //shorter than 6 characters, it can be terminated
+       //with a NULL character.
+
+2)
+Fixes: 602b458201 ("acpi: Permit OEM ID and OEM table ID fields to be changed")
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/707
+Reported-by: Dmitry V. Orekhov <dima.orekhov@gmail.com>
+Signed-off-by: Igor Mammedov <imammedo@redhat.com>
+Cc: qemu-stable@nongnu.org
+Message-Id: <20220112130332.1648664-4-imammedo@redhat.com>
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: Ani Sinha <ani@anisinha.ca>
+Tested-by: Dmitry V. Orekhov dima.orekhov@gmail.com
+(cherry picked from commit 748c030f360a940fe0c9382c8ca1649096c3a80d)
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+---
+ hw/acpi/aml-build.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/hw/acpi/aml-build.c b/hw/acpi/aml-build.c
+index b3b3310df3..65148d5b9d 100644
+--- a/hw/acpi/aml-build.c
++++ b/hw/acpi/aml-build.c
+@@ -1724,9 +1724,9 @@ void acpi_table_begin(AcpiTable *desc, GArray *array)
+     build_append_int_noprefix(array, 0, 4); /* Length */
+     build_append_int_noprefix(array, desc->rev, 1); /* Revision */
+     build_append_int_noprefix(array, 0, 1); /* Checksum */
+-    build_append_padded_str(array, desc->oem_id, 6, ' '); /* OEMID */
++    build_append_padded_str(array, desc->oem_id, 6, '\0'); /* OEMID */
+     /* OEM Table ID */
+-    build_append_padded_str(array, desc->oem_table_id, 8, ' ');
++    build_append_padded_str(array, desc->oem_table_id, 8, '\0');
+     build_append_int_noprefix(array, 1, 4); /* OEM Revision */
+     g_array_append_vals(array, ACPI_BUILD_APPNAME8, 4); /* Creator ID */
+     build_append_int_noprefix(array, 1, 4); /* Creator Revision */

debian/patches/extra/0014-vhost-vsock-detach-the-virqueue-element-in-case-of-e.patch

@@ -0,0 +1,55 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Stefano Garzarella <sgarzare@redhat.com>
+Date: Mon, 28 Feb 2022 10:50:58 +0100
+Subject: [PATCH] vhost-vsock: detach the virqueue element in case of error
+
+In vhost_vsock_common_send_transport_reset(), if an element popped from
+the virtqueue is invalid, we should call virtqueue_detach_element() to
+detach it from the virtqueue before freeing its memory.
+
+Fixes: fc0b9b0e1c ("vhost-vsock: add virtio sockets device")
+Fixes: CVE-2022-26354
+Cc: qemu-stable@nongnu.org
+Reported-by: VictorV <vv474172261@gmail.com>
+Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
+Message-Id: <20220228095058.27899-1-sgarzare@redhat.com>
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+(cherry picked from commit 8d1b247f3748ac4078524130c6d7ae42b6140aaf)
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+---
+ hw/virtio/vhost-vsock-common.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/hw/virtio/vhost-vsock-common.c b/hw/virtio/vhost-vsock-common.c
+index 3f3771274e..ed706681ac 100644
+--- a/hw/virtio/vhost-vsock-common.c
++++ b/hw/virtio/vhost-vsock-common.c
+@@ -153,19 +153,23 @@ static void vhost_vsock_common_send_transport_reset(VHostVSockCommon *vvc)
+     if (elem->out_num) {
+         error_report("invalid vhost-vsock event virtqueue element with "
+                      "out buffers");
+-        goto out;
++        goto err;
+     }
+ 
+     if (iov_from_buf(elem->in_sg, elem->in_num, 0,
+                      &event, sizeof(event)) != sizeof(event)) {
+         error_report("vhost-vsock event virtqueue element is too short");
+-        goto out;
++        goto err;
+     }
+ 
+     virtqueue_push(vq, elem, sizeof(event));
+     virtio_notify(VIRTIO_DEVICE(vvc), vq);
+ 
+-out:
++    g_free(elem);
++    return;
++
++err:
++    virtqueue_detach_element(vq, elem, 0);
+     g_free(elem);
+ }
+ 

debian/patches/extra/0015-vhost-user-remove-VirtQ-notifier-restore.patch

@@ -0,0 +1,98 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Xueming Li <xuemingl@nvidia.com>
+Date: Mon, 7 Feb 2022 15:19:28 +0800
+Subject: [PATCH] vhost-user: remove VirtQ notifier restore
+
+Notifier set when vhost-user backend asks qemu to mmap an FD and
+offset. When vhost-user backend restart or getting killed, VQ notifier
+FD and mmap addresses become invalid. After backend restart, MR contains
+the invalid address will be restored and fail on notifier access.
+
+On the other hand, qemu should munmap the notifier, release underlying
+hardware resources to enable backend restart and allocate hardware
+notifier resources correctly.
+
+Qemu shouldn't reference and use resources of disconnected backend.
+
+This patch removes VQ notifier restore, uses the default vhost-user
+notifier to avoid invalid address access.
+
+After backend restart, the backend should ask qemu to install a hardware
+notifier if needed.
+
+Fixes: 44866521bd6e ("vhost-user: support registering external host notifiers")
+Cc: qemu-stable@nongnu.org
+Signed-off-by: Xueming Li <xuemingl@nvidia.com>
+Message-Id: <20220207071929.527149-2-xuemingl@nvidia.com>
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+(cherry picked from commit e867144b73b3c5009266b6df07d5ff44acfb82c3)
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+---
+ hw/virtio/vhost-user.c         | 19 +------------------
+ include/hw/virtio/vhost-user.h |  1 -
+ 2 files changed, 1 insertion(+), 19 deletions(-)
+
+diff --git a/hw/virtio/vhost-user.c b/hw/virtio/vhost-user.c
+index bf6e50223c..c671719e9b 100644
+--- a/hw/virtio/vhost-user.c
++++ b/hw/virtio/vhost-user.c
+@@ -1143,19 +1143,6 @@ static int vhost_user_set_vring_num(struct vhost_dev *dev,
+     return vhost_set_vring(dev, VHOST_USER_SET_VRING_NUM, ring);
+ }
+ 
+-static void vhost_user_host_notifier_restore(struct vhost_dev *dev,
+-                                             int queue_idx)
+-{
+-    struct vhost_user *u = dev->opaque;
+-    VhostUserHostNotifier *n = &u->user->notifier[queue_idx];
+-    VirtIODevice *vdev = dev->vdev;
+-
+-    if (n->addr && !n->set) {
+-        virtio_queue_set_host_notifier_mr(vdev, queue_idx, &n->mr, true);
+-        n->set = true;
+-    }
+-}
+-
+ static void vhost_user_host_notifier_remove(struct vhost_dev *dev,
+                                             int queue_idx)
+ {
+@@ -1163,17 +1150,14 @@ static void vhost_user_host_notifier_remove(struct vhost_dev *dev,
+     VhostUserHostNotifier *n = &u->user->notifier[queue_idx];
+     VirtIODevice *vdev = dev->vdev;
+ 
+-    if (n->addr && n->set) {
++    if (n->addr) {
+         virtio_queue_set_host_notifier_mr(vdev, queue_idx, &n->mr, false);
+-        n->set = false;
+     }
+ }
+ 
+ static int vhost_user_set_vring_base(struct vhost_dev *dev,
+                                      struct vhost_vring_state *ring)
+ {
+-    vhost_user_host_notifier_restore(dev, ring->index);
+-
+     return vhost_set_vring(dev, VHOST_USER_SET_VRING_BASE, ring);
+ }
+ 
+@@ -1538,7 +1522,6 @@ static int vhost_user_slave_handle_vring_host_notifier(struct vhost_dev *dev,
+     }
+ 
+     n->addr = addr;
+-    n->set = true;
+ 
+     return 0;
+ }
+diff --git a/include/hw/virtio/vhost-user.h b/include/hw/virtio/vhost-user.h
+index a9abca3288..f6012b2078 100644
+--- a/include/hw/virtio/vhost-user.h
++++ b/include/hw/virtio/vhost-user.h
+@@ -14,7 +14,6 @@
+ typedef struct VhostUserHostNotifier {
+     MemoryRegion mr;
+     void *addr;
+-    bool set;
+ } VhostUserHostNotifier;
+ 
+ typedef struct VhostUserState {

debian/patches/extra/0016-vhost-user-fix-VirtQ-notifier-cleanup.patch

@@ -0,0 +1,149 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Xueming Li <xuemingl@nvidia.com>
+Date: Mon, 7 Feb 2022 15:19:29 +0800
+Subject: [PATCH] vhost-user: fix VirtQ notifier cleanup
+
+When vhost-user device cleanup, remove notifier MR and munmaps notifier
+address in the event-handling thread, VM CPU thread writing the notifier
+in concurrent fails with an error of accessing invalid address. It
+happens because MR is still being referenced and accessed in another
+thread while the underlying notifier mmap address is being freed and
+becomes invalid.
+
+This patch calls RCU and munmap notifiers in the callback after the
+memory flatview update finish.
+
+Fixes: 44866521bd6e ("vhost-user: support registering external host notifiers")
+Cc: qemu-stable@nongnu.org
+Signed-off-by: Xueming Li <xuemingl@nvidia.com>
+Message-Id: <20220207071929.527149-3-xuemingl@nvidia.com>
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+(cherry picked from commit 0b0af4d62f7002b31cd7b2762b26d2fcb76bb2ba)
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+---
+ hw/virtio/vhost-user.c         | 48 ++++++++++++++++++++--------------
+ include/hw/virtio/vhost-user.h |  2 ++
+ 2 files changed, 31 insertions(+), 19 deletions(-)
+
+diff --git a/hw/virtio/vhost-user.c b/hw/virtio/vhost-user.c
+index c671719e9b..ed5f9a5471 100644
+--- a/hw/virtio/vhost-user.c
++++ b/hw/virtio/vhost-user.c
+@@ -25,6 +25,7 @@
+ #include "migration/migration.h"
+ #include "migration/postcopy-ram.h"
+ #include "trace.h"
++#include "exec/ramblock.h"
+ 
+ #include <sys/ioctl.h>
+ #include <sys/socket.h>
+@@ -1143,15 +1144,26 @@ static int vhost_user_set_vring_num(struct vhost_dev *dev,
+     return vhost_set_vring(dev, VHOST_USER_SET_VRING_NUM, ring);
+ }
+ 
+-static void vhost_user_host_notifier_remove(struct vhost_dev *dev,
+-                                            int queue_idx)
++static void vhost_user_host_notifier_free(VhostUserHostNotifier *n)
+ {
+-    struct vhost_user *u = dev->opaque;
+-    VhostUserHostNotifier *n = &u->user->notifier[queue_idx];
+-    VirtIODevice *vdev = dev->vdev;
++    assert(n && n->unmap_addr);
++    munmap(n->unmap_addr, qemu_real_host_page_size);
++    n->unmap_addr = NULL;
++}
++
++static void vhost_user_host_notifier_remove(VhostUserState *user,
++                                            VirtIODevice *vdev, int queue_idx)
++{
++    VhostUserHostNotifier *n = &user->notifier[queue_idx];
+ 
+     if (n->addr) {
+-        virtio_queue_set_host_notifier_mr(vdev, queue_idx, &n->mr, false);
++        if (vdev) {
++            virtio_queue_set_host_notifier_mr(vdev, queue_idx, &n->mr, false);
++        }
++        assert(!n->unmap_addr);
++        n->unmap_addr = n->addr;
++        n->addr = NULL;
++        call_rcu(n, vhost_user_host_notifier_free, rcu);
+     }
+ }
+ 
+@@ -1190,8 +1202,9 @@ static int vhost_user_get_vring_base(struct vhost_dev *dev,
+         .payload.state = *ring,
+         .hdr.size = sizeof(msg.payload.state),
+     };
++    struct vhost_user *u = dev->opaque;
+ 
+-    vhost_user_host_notifier_remove(dev, ring->index);
++    vhost_user_host_notifier_remove(u->user, dev->vdev, ring->index);
+ 
+     if (vhost_user_write(dev, &msg, NULL, 0) < 0) {
+         return -1;
+@@ -1486,12 +1499,7 @@ static int vhost_user_slave_handle_vring_host_notifier(struct vhost_dev *dev,
+ 
+     n = &user->notifier[queue_idx];
+ 
+-    if (n->addr) {
+-        virtio_queue_set_host_notifier_mr(vdev, queue_idx, &n->mr, false);
+-        object_unparent(OBJECT(&n->mr));
+-        munmap(n->addr, page_size);
+-        n->addr = NULL;
+-    }
++    vhost_user_host_notifier_remove(user, vdev, queue_idx);
+ 
+     if (area->u64 & VHOST_USER_VRING_NOFD_MASK) {
+         return 0;
+@@ -1510,9 +1518,12 @@ static int vhost_user_slave_handle_vring_host_notifier(struct vhost_dev *dev,
+ 
+     name = g_strdup_printf("vhost-user/host-notifier@%p mmaps[%d]",
+                            user, queue_idx);
+-    if (!n->mr.ram) /* Don't init again after suspend. */
++    if (!n->mr.ram) { /* Don't init again after suspend. */
+         memory_region_init_ram_device_ptr(&n->mr, OBJECT(vdev), name,
+                                           page_size, addr);
++    } else {
++        n->mr.ram_block->host = addr;
++    }
+     g_free(name);
+ 
+     if (virtio_queue_set_host_notifier_mr(vdev, queue_idx, &n->mr, true)) {
+@@ -2460,17 +2471,16 @@ bool vhost_user_init(VhostUserState *user, CharBackend *chr, Error **errp)
+ void vhost_user_cleanup(VhostUserState *user)
+ {
+     int i;
++    VhostUserHostNotifier *n;
+ 
+     if (!user->chr) {
+         return;
+     }
+     memory_region_transaction_begin();
+     for (i = 0; i < VIRTIO_QUEUE_MAX; i++) {
+-        if (user->notifier[i].addr) {
+-            object_unparent(OBJECT(&user->notifier[i].mr));
+-            munmap(user->notifier[i].addr, qemu_real_host_page_size);
+-            user->notifier[i].addr = NULL;
+-        }
++        n = &user->notifier[i];
++        vhost_user_host_notifier_remove(user, NULL, i);
++        object_unparent(OBJECT(&n->mr));
+     }
+     memory_region_transaction_commit();
+     user->chr = NULL;
+diff --git a/include/hw/virtio/vhost-user.h b/include/hw/virtio/vhost-user.h
+index f6012b2078..e44a41bb70 100644
+--- a/include/hw/virtio/vhost-user.h
++++ b/include/hw/virtio/vhost-user.h
+@@ -12,8 +12,10 @@
+ #include "hw/virtio/virtio.h"
+ 
+ typedef struct VhostUserHostNotifier {
++    struct rcu_head rcu;
+     MemoryRegion mr;
+     void *addr;
++    void *unmap_addr;
+ } VhostUserHostNotifier;
+ 
+ typedef struct VhostUserState {

debian/patches/extra/0017-virtio-fix-the-condition-for-iommu_platform-not-supp.patch

@@ -0,0 +1,101 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Halil Pasic <pasic@linux.ibm.com>
+Date: Mon, 7 Feb 2022 12:28:57 +0100
+Subject: [PATCH] virtio: fix the condition for iommu_platform not supported
+
+The commit 04ceb61a40 ("virtio: Fail if iommu_platform is requested, but
+unsupported") claims to fail the device hotplug when iommu_platform
+is requested, but not supported by the (vhost) device. On the first
+glance the condition for detecting that situation looks perfect, but
+because a certain peculiarity of virtio_platform it ain't.
+
+In fact the aforementioned commit introduces a regression. It breaks
+virtio-fs support for Secure Execution, and most likely also for AMD SEV
+or any other confidential guest scenario that relies encrypted guest
+memory.  The same also applies to any other vhost device that does not
+support _F_ACCESS_PLATFORM.
+
+The peculiarity is that iommu_platform and _F_ACCESS_PLATFORM collates
+"device can not access all of the guest RAM" and "iova != gpa, thus
+device needs to translate iova".
+
+Confidential guest technologies currently rely on the device/hypervisor
+offering _F_ACCESS_PLATFORM, so that, after the feature has been
+negotiated, the guest  grants access to the portions of memory the
+device needs to see. So in for confidential guests, generally,
+_F_ACCESS_PLATFORM is about the restricted access to memory, but not
+about the addresses used being something else than guest physical
+addresses.
+
+This is the very reason for which commit f7ef7e6e3b ("vhost: correctly
+turn on VIRTIO_F_IOMMU_PLATFORM") fences _F_ACCESS_PLATFORM from the
+vhost device that does not need it, because on the vhost interface it
+only means "I/O address translation is needed".
+
+This patch takes inspiration from f7ef7e6e3b ("vhost: correctly turn on
+VIRTIO_F_IOMMU_PLATFORM"), and uses the same condition for detecting the
+situation when _F_ACCESS_PLATFORM is requested, but no I/O translation
+by the device, and thus no device capability is needed. In this
+situation claiming that the device does not support iommu_plattform=on
+is counter-productive. So let us stop doing that!
+
+Signed-off-by: Halil Pasic <pasic@linux.ibm.com>
+Reported-by: Jakob Naucke <Jakob.Naucke@ibm.com>
+Fixes: 04ceb61a40 ("virtio: Fail if iommu_platform is requested, but
+unsupported")
+Acked-by: Cornelia Huck <cohuck@redhat.com>
+Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
+Tested-by: Daniel Henrique Barboza <danielhb413@gmail.com>
+Cc: Kevin Wolf <kwolf@redhat.com>
+Cc: qemu-stable@nongnu.org
+
+Message-Id: <20220207112857.607829-1-pasic@linux.ibm.com>
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+(cherry picked from commit e65902a913bf31ba79a83a3bd3621108b85cf645)
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+---
+ hw/virtio/virtio-bus.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/hw/virtio/virtio-bus.c b/hw/virtio/virtio-bus.c
+index d23db98c56..0f69d1c742 100644
+--- a/hw/virtio/virtio-bus.c
++++ b/hw/virtio/virtio-bus.c
+@@ -48,6 +48,7 @@ void virtio_bus_device_plugged(VirtIODevice *vdev, Error **errp)
+     VirtioBusClass *klass = VIRTIO_BUS_GET_CLASS(bus);
+     VirtioDeviceClass *vdc = VIRTIO_DEVICE_GET_CLASS(vdev);
+     bool has_iommu = virtio_host_has_feature(vdev, VIRTIO_F_IOMMU_PLATFORM);
++    bool vdev_has_iommu;
+     Error *local_err = NULL;
+ 
+     DPRINTF("%s: plug device.\n", qbus->name);
+@@ -69,11 +70,6 @@ void virtio_bus_device_plugged(VirtIODevice *vdev, Error **errp)
+         return;
+     }
+ 
+-    if (has_iommu && !virtio_host_has_feature(vdev, VIRTIO_F_IOMMU_PLATFORM)) {
+-        error_setg(errp, "iommu_platform=true is not supported by the device");
+-        return;
+-    }
+-
+     if (klass->device_plugged != NULL) {
+         klass->device_plugged(qbus->parent, &local_err);
+     }
+@@ -82,9 +78,15 @@ void virtio_bus_device_plugged(VirtIODevice *vdev, Error **errp)
+         return;
+     }
+ 
++    vdev_has_iommu = virtio_host_has_feature(vdev, VIRTIO_F_IOMMU_PLATFORM);
+     if (klass->get_dma_as != NULL && has_iommu) {
+         virtio_add_feature(&vdev->host_features, VIRTIO_F_IOMMU_PLATFORM);
+         vdev->dma_as = klass->get_dma_as(qbus->parent);
++        if (!vdev_has_iommu && vdev->dma_as != &address_space_memory) {
++            error_setg(errp,
++                       "iommu_platform=true is not supported by the device");
++            return;
++        }
+     } else {
+         vdev->dma_as = &address_space_memory;
+     }

debian/patches/extra/0018-block-gluster-correctly-set-max_pdiscard-which-is-in.patch

@@ -0,0 +1,38 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Fabian Ebner <f.ebner@proxmox.com>
+Date: Fri, 6 May 2022 14:38:35 +0200
+Subject: [PATCH] block/gluster: correctly set max_pdiscard which is int64_t
+
+Previously, max_pdiscard would be zero in the following assertion:
+qemu-system-x86_64: ../block/io.c:3166: bdrv_co_pdiscard: Assertion
+`max_pdiscard >= bs->bl.request_alignment' failed.
+
+Fixes: 0c8022876f ("block: use int64_t instead of int in driver discard handlers")
+Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+---
+ block/gluster.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/block/gluster.c b/block/gluster.c
+index 398976bc66..592e71b22a 100644
+--- a/block/gluster.c
++++ b/block/gluster.c
+@@ -891,7 +891,7 @@ out:
+ static void qemu_gluster_refresh_limits(BlockDriverState *bs, Error **errp)
+ {
+     bs->bl.max_transfer = GLUSTER_MAX_TRANSFER;
+-    bs->bl.max_pdiscard = SIZE_MAX;
++    bs->bl.max_pdiscard = INT64_MAX;
+ }
+ 
+ static int qemu_gluster_reopen_prepare(BDRVReopenState *state,
+@@ -1304,7 +1304,7 @@ static coroutine_fn int qemu_gluster_co_pdiscard(BlockDriverState *bs,
+     GlusterAIOCB acb;
+     BDRVGlusterState *s = bs->opaque;
+ 
+-    assert(bytes <= SIZE_MAX); /* rely on max_pdiscard */
++    assert(bytes <= INT64_MAX); /* rely on max_pdiscard */
+ 
+     acb.size = 0;
+     acb.ret = 0;

debian/patches/extra/0019-ui-vnc.c-Fixed-a-deadlock-bug.patch

@@ -0,0 +1,72 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Rao Lei <lei.rao@intel.com>
+Date: Fri, 6 May 2022 14:38:36 +0200
+Subject: [PATCH] ui/vnc.c: Fixed a deadlock bug.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The GDB statck is as follows:
+(gdb) bt
+0  __lll_lock_wait (futex=futex@entry=0x56211df20360, private=0) at lowlevellock.c:52
+1  0x00007f263caf20a3 in __GI___pthread_mutex_lock (mutex=0x56211df20360) at ../nptl/pthread_mutex_lock.c:80
+2  0x000056211a757364 in qemu_mutex_lock_impl (mutex=0x56211df20360, file=0x56211a804857 "../ui/vnc-jobs.h", line=60)
+    at ../util/qemu-thread-posix.c:80
+3  0x000056211a0ef8c7 in vnc_lock_output (vs=0x56211df14200) at ../ui/vnc-jobs.h:60
+4  0x000056211a0efcb7 in vnc_clipboard_send (vs=0x56211df14200, count=1, dwords=0x7ffdf1701338) at ../ui/vnc-clipboard.c:138
+5  0x000056211a0f0129 in vnc_clipboard_notify (notifier=0x56211df244c8, data=0x56211dd1bbf0) at ../ui/vnc-clipboard.c:209
+6  0x000056211a75dde8 in notifier_list_notify (list=0x56211afa17d0 <clipboard_notifiers>, data=0x56211dd1bbf0) at ../util/notify.c:39
+7  0x000056211a0bf0e6 in qemu_clipboard_update (info=0x56211dd1bbf0) at ../ui/clipboard.c:50
+8  0x000056211a0bf05d in qemu_clipboard_peer_release (peer=0x56211df244c0, selection=QEMU_CLIPBOARD_SELECTION_CLIPBOARD)
+    at ../ui/clipboard.c:41
+9  0x000056211a0bef9b in qemu_clipboard_peer_unregister (peer=0x56211df244c0) at ../ui/clipboard.c:19
+10 0x000056211a0d45f3 in vnc_disconnect_finish (vs=0x56211df14200) at ../ui/vnc.c:1358
+11 0x000056211a0d4c9d in vnc_client_read (vs=0x56211df14200) at ../ui/vnc.c:1611
+12 0x000056211a0d4df8 in vnc_client_io (ioc=0x56211ce70690, condition=G_IO_IN, opaque=0x56211df14200) at ../ui/vnc.c:1649
+13 0x000056211a5b976c in qio_channel_fd_source_dispatch
+    (source=0x56211ce50a00, callback=0x56211a0d4d71 <vnc_client_io>, user_data=0x56211df14200) at ../io/channel-watch.c:84
+14 0x00007f263ccede8e in g_main_context_dispatch () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
+15 0x000056211a77d4a1 in glib_pollfds_poll () at ../util/main-loop.c:232
+16 0x000056211a77d51f in os_host_main_loop_wait (timeout=958545) at ../util/main-loop.c:255
+17 0x000056211a77d630 in main_loop_wait (nonblocking=0) at ../util/main-loop.c:531
+18 0x000056211a45bc8e in qemu_main_loop () at ../softmmu/runstate.c:726
+19 0x000056211a0b45fa in main (argc=69, argv=0x7ffdf1701778, envp=0x7ffdf17019a8) at ../softmmu/main.c:50
+
+From the call trace, we can see it is a deadlock bug.
+vnc_disconnect_finish will acquire the output_mutex.
+But, the output_mutex will be acquired again in vnc_clipboard_send.
+Repeated locking will cause deadlock. So, I move
+qemu_clipboard_peer_unregister() behind vnc_unlock_output();
+
+Fixes: 0bf41cab93e ("ui/vnc: clipboard support")
+Signed-off-by: Lei Rao <lei.rao@intel.com>
+Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
+Message-Id: <20220105020808.597325-1-lei.rao@intel.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry-picked from commit 1dbbe6f172810026c51dc84ed927a3cc23017949)
+[FE: trivial backport for 6.2]
+Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+---
+ ui/vnc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/ui/vnc.c b/ui/vnc.c
+index af02522e84..b253e85c65 100644
+--- a/ui/vnc.c
++++ b/ui/vnc.c
+@@ -1354,12 +1354,12 @@ void vnc_disconnect_finish(VncState *vs)
+         /* last client gone */
+         vnc_update_server_surface(vs->vd);
+     }
++    vnc_unlock_output(vs);
++
+     if (vs->cbpeer.update.notify) {
+         qemu_clipboard_peer_unregister(&vs->cbpeer);
+     }
+ 
+-    vnc_unlock_output(vs);
+-
+     qemu_mutex_destroy(&vs->output_mutex);
+     if (vs->bh != NULL) {
+         qemu_bh_delete(vs->bh);

debian/patches/extra/0020-display-qxl-render-fix-race-condition-in-qxl_cursor-.patch

@@ -0,0 +1,37 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Mauro Matteo Cascella <mcascell@redhat.com>
+Date: Thu, 7 Apr 2022 10:11:06 +0200
+Subject: [PATCH] display/qxl-render: fix race condition in qxl_cursor
+ (CVE-2021-4207)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Avoid fetching 'width' and 'height' a second time to prevent possible
+race condition. Refer to security advisory
+https://starlabs.sg/advisories/22-4207/ for more information.
+
+Fixes: CVE-2021-4207
+Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>
+Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
+Message-Id: <20220407081106.343235-1-mcascell@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 9569f5cb5b4bffa9d3ebc8ba7da1e03830a9a895)
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+---
+ hw/display/qxl-render.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/hw/display/qxl-render.c b/hw/display/qxl-render.c
+index d28849b121..237ed293ba 100644
+--- a/hw/display/qxl-render.c
++++ b/hw/display/qxl-render.c
+@@ -266,7 +266,7 @@ static QEMUCursor *qxl_cursor(PCIQXLDevice *qxl, QXLCursor *cursor,
+         }
+         break;
+     case SPICE_CURSOR_TYPE_ALPHA:
+-        size = sizeof(uint32_t) * cursor->header.width * cursor->header.height;
++        size = sizeof(uint32_t) * c->width * c->height;
+         qxl_unpack_chunks(c->data, size, qxl, &cursor->chunk, group_id);
+         if (qxl->debug > 2) {
+             cursor_print_ascii_art(c, "qxl/alpha");

debian/patches/extra/0021-ui-cursor-fix-integer-overflow-in-cursor_alloc-CVE-2.patch

@@ -0,0 +1,83 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Mauro Matteo Cascella <mcascell@redhat.com>
+Date: Thu, 7 Apr 2022 10:17:12 +0200
+Subject: [PATCH] ui/cursor: fix integer overflow in cursor_alloc
+ (CVE-2021-4206)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Prevent potential integer overflow by limiting 'width' and 'height' to
+512x512. Also change 'datasize' type to size_t. Refer to security
+advisory https://starlabs.sg/advisories/22-4206/ for more information.
+
+Fixes: CVE-2021-4206
+Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>
+Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
+Message-Id: <20220407081712.345609-1-mcascell@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit fa892e9abb728e76afcf27323ab29c57fb0fe7aa)
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+---
+ hw/display/qxl-render.c | 7 +++++++
+ hw/display/vmware_vga.c | 2 ++
+ ui/cursor.c             | 8 +++++++-
+ 3 files changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/hw/display/qxl-render.c b/hw/display/qxl-render.c
+index 237ed293ba..ca217004bf 100644
+--- a/hw/display/qxl-render.c
++++ b/hw/display/qxl-render.c
+@@ -247,6 +247,13 @@ static QEMUCursor *qxl_cursor(PCIQXLDevice *qxl, QXLCursor *cursor,
+     size_t size;
+ 
+     c = cursor_alloc(cursor->header.width, cursor->header.height);
++
++    if (!c) {
++        qxl_set_guest_bug(qxl, "%s: cursor %ux%u alloc error", __func__,
++                cursor->header.width, cursor->header.height);
++        goto fail;
++    }
++
+     c->hot_x = cursor->header.hot_spot_x;
+     c->hot_y = cursor->header.hot_spot_y;
+     switch (cursor->header.type) {
+diff --git a/hw/display/vmware_vga.c b/hw/display/vmware_vga.c
+index e2969a6c81..2b81d6122f 100644
+--- a/hw/display/vmware_vga.c
++++ b/hw/display/vmware_vga.c
+@@ -509,6 +509,8 @@ static inline void vmsvga_cursor_define(struct vmsvga_state_s *s,
+     int i, pixels;
+ 
+     qc = cursor_alloc(c->width, c->height);
++    assert(qc != NULL);
++
+     qc->hot_x = c->hot_x;
+     qc->hot_y = c->hot_y;
+     switch (c->bpp) {
+diff --git a/ui/cursor.c b/ui/cursor.c
+index 1d62ddd4d0..835f0802f9 100644
+--- a/ui/cursor.c
++++ b/ui/cursor.c
+@@ -46,6 +46,8 @@ static QEMUCursor *cursor_parse_xpm(const char *xpm[])
+ 
+     /* parse pixel data */
+     c = cursor_alloc(width, height);
++    assert(c != NULL);
++
+     for (pixel = 0, y = 0; y < height; y++, line++) {
+         for (x = 0; x < height; x++, pixel++) {
+             idx = xpm[line][x];
+@@ -91,7 +93,11 @@ QEMUCursor *cursor_builtin_left_ptr(void)
+ QEMUCursor *cursor_alloc(int width, int height)
+ {
+     QEMUCursor *c;
+-    int datasize = width * height * sizeof(uint32_t);
++    size_t datasize = width * height * sizeof(uint32_t);
++
++    if (width > 512 || height > 512) {
++        return NULL;
++    }
+ 
+     c = g_malloc0(sizeof(QEMUCursor) + datasize);
+     c->width  = width;

debian/patches/pve-qemu-6.2-vitastor.patch

@@ -1,17 +1,89 @@
-Index: pve-qemu-kvm-6.1.0/qapi/block-core.json
+Index: qemu/block/meson.build
 ===================================================================
---- pve-qemu-kvm-6.1.0.orig/qapi/block-core.json
-+++ pve-qemu-kvm-6.1.0/qapi/block-core.json
-@@ -3084,7 +3084,7 @@
+--- qemu.orig/block/meson.build
++++ qemu/block/meson.build
+@@ -91,6 +91,7 @@ foreach m : [
+   [libnfs, 'nfs', files('nfs.c')],
+   [libssh, 'ssh', files('ssh.c')],
+   [rbd, 'rbd', files('rbd.c')],
++  [vitastor, 'vitastor', files('vitastor.c')],
+ ]
+   if m[0].found()
+     module_ss = ss.source_set()
+Index: qemu/meson.build
+===================================================================
+--- qemu.orig/meson.build
++++ qemu/meson.build
+@@ -838,6 +838,26 @@ if not get_option('rbd').auto() or have_
+   endif
+ endif
+ 
++vitastor = not_found
++if not get_option('vitastor').auto() or have_block
++  libvitastor_client = cc.find_library('vitastor_client', has_headers: ['vitastor_c.h'],
++    required: get_option('vitastor'), kwargs: static_kwargs)
++  if libvitastor_client.found()
++    if cc.links('''
++      #include <vitastor_c.h>
++      int main(void) {
++        vitastor_c_create_qemu(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
++        return 0;
++      }''', dependencies: libvitastor_client)
++      vitastor = declare_dependency(dependencies: libvitastor_client)
++    elif get_option('vitastor').enabled()
++      error('could not link libvitastor_client')
++    else
++      warning('could not link libvitastor_client, disabling')
++    endif
++  endif
++endif
++
+ glusterfs = not_found
+ glusterfs_ftruncate_has_stat = false
+ glusterfs_iocb_has_stat = false
+@@ -1459,6 +1479,7 @@ config_host_data.set('CONFIG_LINUX_AIO',
+ config_host_data.set('CONFIG_LINUX_IO_URING', linux_io_uring.found())
+ config_host_data.set('CONFIG_LIBPMEM', libpmem.found())
+ config_host_data.set('CONFIG_RBD', rbd.found())
++config_host_data.set('CONFIG_VITASTOR', vitastor.found())
+ config_host_data.set('CONFIG_SDL', sdl.found())
+ config_host_data.set('CONFIG_SDL_IMAGE', sdl_image.found())
+ config_host_data.set('CONFIG_SECCOMP', seccomp.found())
+@@ -3424,6 +3445,7 @@ if spice_protocol.found()
+   summary_info += {'  spice server support': spice}
+ endif
+ summary_info += {'rbd support':       rbd}
++summary_info += {'vitastor support':  vitastor}
+ summary_info += {'xfsctl support':    config_host.has_key('CONFIG_XFS')}
+ summary_info += {'smartcard support': cacard}
+ summary_info += {'U2F support':       u2f}
+Index: qemu/meson_options.txt
+===================================================================
+--- qemu.orig/meson_options.txt
++++ qemu/meson_options.txt
+@@ -121,6 +121,8 @@ option('lzo', type : 'feature', value :
+        description: 'lzo compression support')
+ option('rbd', type : 'feature', value : 'auto',
+        description: 'Ceph block device driver')
++option('vitastor', type : 'feature', value : 'auto',
++       description: 'Vitastor block device driver')
+ option('gtk', type : 'feature', value : 'auto',
+        description: 'GTK+ user interface')
+ option('sdl', type : 'feature', value : 'auto',
+Index: qemu/qapi/block-core.json
+===================================================================
+--- qemu.orig/qapi/block-core.json
++++ qemu/qapi/block-core.json
+@@ -3179,7 +3179,7 @@
              'preallocate', 'qcow', 'qcow2', 'qed', 'quorum', 'raw', 'rbd',
-             { 'name': 'replication', 'if': 'defined(CONFIG_REPLICATION)' },
+             { 'name': 'replication', 'if': 'CONFIG_REPLICATION' },
              'pbs',
 -            'ssh', 'throttle', 'vdi', 'vhdx', 'vmdk', 'vpc', 'vvfat' ] }
 +            'ssh', 'throttle', 'vdi', 'vhdx', 'vitastor', 'vmdk', 'vpc', 'vvfat' ] }
  
  ##
  # @BlockdevOptionsFile:
-@@ -4020,6 +4020,28 @@
+@@ -4125,6 +4125,28 @@
              '*server': ['InetSocketAddressBase'] } }
  
  ##
@@ -40,7 +112,7 @@ Index: pve-qemu-kvm-6.1.0/qapi/block-core.json
  # @ReplicationMode:
  #
  # An enumeration of replication modes.
-@@ -4392,6 +4414,7 @@
+@@ -4520,6 +4542,7 @@
        'throttle':   'BlockdevOptionsThrottle',
        'vdi':        'BlockdevOptionsGenericFormat',
        'vhdx':       'BlockdevOptionsGenericFormat',
@@ -48,7 +120,7 @@ Index: pve-qemu-kvm-6.1.0/qapi/block-core.json
        'vmdk':       'BlockdevOptionsGenericCOWFormat',
        'vpc':        'BlockdevOptionsGenericFormat',
        'vvfat':      'BlockdevOptionsVVFAT'
-@@ -4782,6 +4805,17 @@
+@@ -4910,6 +4933,17 @@
              '*encrypt' :        'RbdEncryptionCreateOptions' } }
  
  ##
@@ -66,7 +138,7 @@ Index: pve-qemu-kvm-6.1.0/qapi/block-core.json
  # @BlockdevVmdkSubformat:
  #
  # Subformat options for VMDK images
-@@ -4977,6 +5011,7 @@
+@@ -5108,6 +5142,7 @@
        'ssh':            'BlockdevCreateOptionsSsh',
        'vdi':            'BlockdevCreateOptionsVdi',
        'vhdx':           'BlockdevCreateOptionsVhdx',
@@ -74,123 +146,32 @@ Index: pve-qemu-kvm-6.1.0/qapi/block-core.json
        'vmdk':           'BlockdevCreateOptionsVmdk',
        'vpc':            'BlockdevCreateOptionsVpc'
    } }
-Index: pve-qemu-kvm-6.1.0/block/meson.build
+Index: qemu/scripts/ci/org.centos/stream/8/x86_64/configure
 ===================================================================
---- pve-qemu-kvm-6.1.0.orig/block/meson.build
-+++ pve-qemu-kvm-6.1.0/block/meson.build
-@@ -91,6 +91,7 @@ foreach m : [
-   [libnfs, 'nfs', files('nfs.c')],
-   [libssh, 'ssh', files('ssh.c')],
-   [rbd, 'rbd', files('rbd.c')],
-+  [vitastor, 'vitastor', files('vitastor.c')],
- ]
-   if m[0].found()
-     module_ss = ss.source_set()
-Index: pve-qemu-kvm-6.1.0/configure
-===================================================================
---- pve-qemu-kvm-6.1.0.orig/configure
-+++ pve-qemu-kvm-6.1.0/configure
-@@ -375,6 +375,7 @@ trace_file="trace"
- spice="$default_feature"
- spice_protocol="auto"
- rbd="auto"
-+vitastor="auto"
- smartcard="auto"
- u2f="auto"
- libusb="auto"
-@@ -1293,6 +1294,10 @@ for opt do
-   ;;
-   --enable-rbd) rbd="enabled"
-   ;;
-+  --disable-vitastor) vitastor="disabled"
-+  ;;
-+  --enable-vitastor) vitastor="enabled"
-+  ;;
-   --disable-xfsctl) xfs="no"
-   ;;
-   --enable-xfsctl) xfs="yes"
-@@ -1921,6 +1926,7 @@ disabled with --disable-FEATURE, default
-   spice           spice
-   spice-protocol  spice-protocol
-   rbd             rados block device (rbd)
-+  vitastor        vitastor block device
-   libiscsi        iscsi support
-   libnfs          nfs support
-   smartcard       smartcard support (libcacard)
-@@ -5211,7 +5217,7 @@ if test "$skip_meson" = no; then
-         -Dcapstone=$capstone -Dslirp=$slirp -Dfdt=$fdt -Dbrlapi=$brlapi \
-         -Dcurl=$curl -Dglusterfs=$glusterfs -Dbzip2=$bzip2 -Dlibiscsi=$libiscsi \
-         -Dlibnfs=$libnfs -Diconv=$iconv -Dcurses=$curses -Dlibudev=$libudev\
--        -Drbd=$rbd -Dlzo=$lzo -Dsnappy=$snappy -Dlzfse=$lzfse -Dlibxml2=$libxml2 \
-+        -Drbd=$rbd -Dvitastor=$vitastor -Dlzo=$lzo -Dsnappy=$snappy -Dlzfse=$lzfse -Dlibxml2=$libxml2 \
-         -Dlibdaxctl=$libdaxctl -Dlibpmem=$libpmem -Dlinux_io_uring=$linux_io_uring \
-         -Dgnutls=$gnutls -Dnettle=$nettle -Dgcrypt=$gcrypt -Dauth_pam=$auth_pam \
-         -Dzstd=$zstd -Dseccomp=$seccomp -Dvirtfs=$virtfs -Dcap_ng=$cap_ng \
-Index: pve-qemu-kvm-6.1.0/meson.build
-===================================================================
---- pve-qemu-kvm-6.1.0.orig/meson.build
-+++ pve-qemu-kvm-6.1.0/meson.build
-@@ -729,6 +729,26 @@ if not get_option('rbd').auto() or have_
-   endif
- endif
- 
-+vitastor = not_found
-+if not get_option('vitastor').auto() or have_block
-+  libvitastor_client = cc.find_library('vitastor_client', has_headers: ['vitastor_c.h'],
-+    required: get_option('vitastor'), kwargs: static_kwargs)
-+  if libvitastor_client.found()
-+    if cc.links('''
-+      #include <vitastor_c.h>
-+      int main(void) {
-+        vitastor_c_create_qemu(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
-+        return 0;
-+      }''', dependencies: libvitastor_client)
-+      vitastor = declare_dependency(dependencies: libvitastor_client)
-+    elif get_option('vitastor').enabled()
-+      error('could not link libvitastor_client')
-+    else
-+      warning('could not link libvitastor_client, disabling')
-+    endif
-+  endif
-+endif
-+
- glusterfs = not_found
- glusterfs_ftruncate_has_stat = false
- glusterfs_iocb_has_stat = false
-@@ -1268,6 +1288,7 @@ config_host_data.set('CONFIG_LIBNFS', li
- config_host_data.set('CONFIG_LINUX_IO_URING', linux_io_uring.found())
- config_host_data.set('CONFIG_LIBPMEM', libpmem.found())
- config_host_data.set('CONFIG_RBD', rbd.found())
-+config_host_data.set('CONFIG_VITASTOR', vitastor.found())
- config_host_data.set('CONFIG_SDL', sdl.found())
- config_host_data.set('CONFIG_SDL_IMAGE', sdl_image.found())
- config_host_data.set('CONFIG_SECCOMP', seccomp.found())
-@@ -3087,6 +3108,7 @@ summary_info += {'bpf support': libbpf.f
- # TODO: add back protocol and server version
- summary_info += {'spice support':     config_host.has_key('CONFIG_SPICE')}
- summary_info += {'rbd support':       rbd.found()}
-+summary_info += {'vitastor support':  vitastor.found()}
- summary_info += {'xfsctl support':    config_host.has_key('CONFIG_XFS')}
- summary_info += {'smartcard support': cacard.found()}
- summary_info += {'U2F support':       u2f.found()}
-Index: pve-qemu-kvm-6.1.0/meson_options.txt
-===================================================================
---- pve-qemu-kvm-6.1.0.orig/meson_options.txt
-+++ pve-qemu-kvm-6.1.0/meson_options.txt
-@@ -102,6 +102,8 @@ option('lzo', type : 'feature', value :
-        description: 'lzo compression support')
- option('rbd', type : 'feature', value : 'auto',
-        description: 'Ceph block device driver')
-+option('vitastor', type : 'feature', value : 'auto',
-+       description: 'Vitastor block device driver')
- option('gtk', type : 'feature', value : 'auto',
-        description: 'GTK+ user interface')
- option('sdl', type : 'feature', value : 'auto',
-Index: pve-qemu-kvm-6.1.0/block/vitastor.c
+--- qemu.orig/scripts/ci/org.centos/stream/8/x86_64/configure
++++ qemu/scripts/ci/org.centos/stream/8/x86_64/configure
+@@ -31,7 +31,7 @@
+ --with-git=meson \
+ --with-git-submodules=update \
+ --target-list="x86_64-softmmu" \
+---block-drv-rw-whitelist="qcow2,raw,file,host_device,nbd,iscsi,rbd,blkdebug,luks,null-co,nvme,copy-on-read,throttle,gluster" \
++--block-drv-rw-whitelist="qcow2,raw,file,host_device,nbd,iscsi,rbd,vitastor,blkdebug,luks,null-co,nvme,copy-on-read,throttle,gluster" \
+ --audio-drv-list="" \
+ --block-drv-ro-whitelist="vmdk,vhdx,vpc,https,ssh" \
+ --with-coroutine=ucontext \
+@@ -183,6 +183,7 @@
+ --enable-opengl \
+ --enable-pie \
+ --enable-rbd \
++--enable-vitastor \
+ --enable-rdma \
+ --enable-seccomp \
+ --enable-snappy \
+Index: a/block/vitastor.c
 ===================================================================
 --- /dev/null
-+++ pve-qemu-kvm-6.1.0/block/vitastor.c
-@@ -0,0 +1,598 @@
++++ a/block/vitastor.c
+@@ -0,0 +1,797 @@
 +// Copyright (c) Vitaliy Filippov, 2019+
 +// License: VNPL-1.1 or GNU GPL-2.0+ (see README.md for details)
 +
@@ -246,6 +227,7 @@ Index: pve-qemu-kvm-6.1.0/block/vitastor.c
 +    char *etcd_host;
 +    char *etcd_prefix;
 +    char *image;
++    int skip_parents;
 +    uint64_t inode;
 +    uint64_t pool;
 +    uint64_t size;
@@ -256,6 +238,10 @@ Index: pve-qemu-kvm-6.1.0/block/vitastor.c
 +    int rdma_gid_index;
 +    int rdma_mtu;
 +    QemuMutex mutex;
++
++    uint64_t last_bitmap_inode, last_bitmap_offset, last_bitmap_len;
++    uint32_t last_bitmap_granularity;
++    uint8_t *last_bitmap;
 +} VitastorClient;
 +
 +typedef struct VitastorRPC
@@ -265,6 +251,9 @@ Index: pve-qemu-kvm-6.1.0/block/vitastor.c
 +    QEMUIOVector *iov;
 +    long ret;
 +    int complete;
++    uint64_t inode, offset, len;
++    uint32_t bitmap_granularity;
++    uint8_t *bitmap;
 +} VitastorRPC;
 +
 +static void vitastor_co_init_task(BlockDriverState *bs, VitastorRPC *task);
@@ -340,6 +329,7 @@ Index: pve-qemu-kvm-6.1.0/block/vitastor.c
 +        if (!strcmp(name, "inode") ||
 +            !strcmp(name, "pool") ||
 +            !strcmp(name, "size") ||
++            !strcmp(name, "skip-parents") ||
 +            !strcmp(name, "use-rdma") ||
 +            !strcmp(name, "rdma-port_num") ||
 +            !strcmp(name, "rdma-gid-index") ||
@@ -399,41 +389,65 @@ Index: pve-qemu-kvm-6.1.0/block/vitastor.c
 +    }
 +}
 +
++static void vitastor_aio_set_fd_handler(void *ctx, int fd, int unused1, IOHandler *fd_read, IOHandler *fd_write, void *unused2, void *opaque)
++{
++    aio_set_fd_handler(ctx, fd,
++#if QEMU_VERSION_MAJOR == 2 && QEMU_VERSION_MINOR >= 5 || QEMU_VERSION_MAJOR >= 3
++        0 /*is_external*/,
++#endif
++        fd_read, fd_write,
++#if QEMU_VERSION_MAJOR == 1 && QEMU_VERSION_MINOR <= 6 || QEMU_VERSION_MAJOR < 1
++        NULL /*io_flush*/,
++#endif
++#if QEMU_VERSION_MAJOR == 2 && QEMU_VERSION_MINOR >= 9 || QEMU_VERSION_MAJOR >= 3
++        NULL /*io_poll*/,
++#endif
++#if QEMU_VERSION_MAJOR >= 7
++        NULL /*io_poll_ready*/,
++#endif
++        opaque);
++}
++
 +static int vitastor_file_open(BlockDriverState *bs, QDict *options, int flags, Error **errp)
 +{
++    VitastorRPC task;
 +    VitastorClient *client = bs->opaque;
++    void *image = NULL;
 +    int64_t ret = 0;
 +    qemu_mutex_init(&client->mutex);
 +    client->config_path = g_strdup(qdict_get_try_str(options, "config-path"));
 +    // FIXME: Rename to etcd_address
 +    client->etcd_host = g_strdup(qdict_get_try_str(options, "etcd-host"));
 +    client->etcd_prefix = g_strdup(qdict_get_try_str(options, "etcd-prefix"));
++    client->skip_parents = qdict_get_try_int(options, "skip-parents", 0);
 +    client->use_rdma = qdict_get_try_int(options, "use-rdma", -1);
 +    client->rdma_device = g_strdup(qdict_get_try_str(options, "rdma-device"));
 +    client->rdma_port_num = qdict_get_try_int(options, "rdma-port-num", 0);
 +    client->rdma_gid_index = qdict_get_try_int(options, "rdma-gid-index", 0);
 +    client->rdma_mtu = qdict_get_try_int(options, "rdma-mtu", 0);
 +    client->proxy = vitastor_c_create_qemu(
-+        (QEMUSetFDHandler*)aio_set_fd_handler, bdrv_get_aio_context(bs), client->config_path, client->etcd_host, client->etcd_prefix,
++        vitastor_aio_set_fd_handler, bdrv_get_aio_context(bs), client->config_path, client->etcd_host, client->etcd_prefix,
 +        client->use_rdma, client->rdma_device, client->rdma_port_num, client->rdma_gid_index, client->rdma_mtu, 0
 +    );
-+    client->image = g_strdup(qdict_get_try_str(options, "image"));
++    image = client->image = g_strdup(qdict_get_try_str(options, "image"));
 +    client->readonly = (flags & BDRV_O_RDWR) ? 1 : 0;
++    // Get image metadata (size and readonly flag) or just wait until the client is ready
++    if (!image)
++        client->image = (char*)"x";
++    task.complete = 0;
++    task.bs = bs;
++    if (qemu_in_coroutine())
++    {
++        vitastor_co_get_metadata(&task);
++    }
++    else
++    {
++        bdrv_coroutine_enter(bs, qemu_coroutine_create((void(*)(void*))vitastor_co_get_metadata, &task));
++        BDRV_POLL_WHILE(bs, !task.complete);
++    }
++    client->image = image;
 +    if (client->image)
 +    {
-+        // Get image metadata (size and readonly flag)
-+        VitastorRPC task;
-+        task.complete = 0;
-+        task.bs = bs;
-+        if (qemu_in_coroutine())
-+        {
-+            vitastor_co_get_metadata(&task);
-+        }
-+        else
-+        {
-+            qemu_coroutine_enter(qemu_coroutine_create((void(*)(void*))vitastor_co_get_metadata, &task));
-+        }
-+        BDRV_POLL_WHILE(bs, !task.complete);
 +        client->watch = (void*)task.ret;
 +        client->readonly = client->readonly || vitastor_c_inode_get_readonly(client->watch);
 +        client->size = vitastor_c_inode_get_size(client->watch);
@@ -455,9 +469,10 @@ Index: pve-qemu-kvm-6.1.0/block/vitastor.c
 +        client->pool = qdict_get_try_int(options, "pool", 0);
 +        if (client->pool)
 +        {
-+            client->inode = (client->inode & ((1l << (64-POOL_ID_BITS)) - 1)) | (client->pool << (64-POOL_ID_BITS));
++            client->inode = (client->inode & (((uint64_t)1 << (64-POOL_ID_BITS)) - 1)) | (client->pool << (64-POOL_ID_BITS));
 +        }
 +        client->size = qdict_get_try_int(options, "size", 0);
++        vitastor_c_close_watch(client->proxy, (void*)task.ret);
 +    }
 +    if (!client->size)
 +    {
@@ -479,6 +494,7 @@ Index: pve-qemu-kvm-6.1.0/block/vitastor.c
 +    qdict_del(options, "inode");
 +    qdict_del(options, "pool");
 +    qdict_del(options, "size");
++    qdict_del(options, "skip-parents");
 +    return ret;
 +}
 +
@@ -495,13 +511,15 @@ Index: pve-qemu-kvm-6.1.0/block/vitastor.c
 +        g_free(client->etcd_prefix);
 +    if (client->image)
 +        g_free(client->image);
++    free(client->last_bitmap);
++    client->last_bitmap = NULL;
 +}
 +
 +#if QEMU_VERSION_MAJOR >= 3 || QEMU_VERSION_MAJOR == 2 && QEMU_VERSION_MINOR > 2
 +static int vitastor_probe_blocksizes(BlockDriverState *bs, BlockSizes *bsz)
 +{
 +    bsz->phys = 4096;
-+    bsz->log = 4096;
++    bsz->log = 512;
 +    return 0;
 +}
 +#endif
@@ -621,7 +639,13 @@ Index: pve-qemu-kvm-6.1.0/block/vitastor.c
 +    vitastor_co_generic_bh_cb(opaque, retval);
 +}
 +
-+static int coroutine_fn vitastor_co_preadv(BlockDriverState *bs, uint64_t offset, uint64_t bytes, QEMUIOVector *iov, int flags)
++static int coroutine_fn vitastor_co_preadv(BlockDriverState *bs,
++#if QEMU_VERSION_MAJOR >= 7 || QEMU_VERSION_MAJOR == 6 && QEMU_VERSION_MINOR >= 2
++    int64_t offset, int64_t bytes, QEMUIOVector *iov, BdrvRequestFlags flags
++#else
++    uint64_t offset, uint64_t bytes, QEMUIOVector *iov, int flags
++#endif
++)
 +{
 +    VitastorClient *client = bs->opaque;
 +    VitastorRPC task;
@@ -641,13 +665,26 @@ Index: pve-qemu-kvm-6.1.0/block/vitastor.c
 +    return task.ret;
 +}
 +
-+static int coroutine_fn vitastor_co_pwritev(BlockDriverState *bs, uint64_t offset, uint64_t bytes, QEMUIOVector *iov, int flags)
++static int coroutine_fn vitastor_co_pwritev(BlockDriverState *bs,
++#if QEMU_VERSION_MAJOR >= 7 || QEMU_VERSION_MAJOR == 6 && QEMU_VERSION_MINOR >= 2
++    int64_t offset, int64_t bytes, QEMUIOVector *iov, BdrvRequestFlags flags
++#else
++    uint64_t offset, uint64_t bytes, QEMUIOVector *iov, int flags
++#endif
++)
 +{
 +    VitastorClient *client = bs->opaque;
 +    VitastorRPC task;
 +    vitastor_co_init_task(bs, &task);
 +    task.iov = iov;
 +
++    if (client->last_bitmap)
++    {
++        // Invalidate last bitmap on write
++        free(client->last_bitmap);
++        client->last_bitmap = NULL;
++    }
++
 +    uint64_t inode = client->watch ? vitastor_c_inode_get_num(client->watch) : client->inode;
 +    qemu_mutex_lock(&client->mutex);
 +    vitastor_c_write(client->proxy, inode, offset, bytes, 0, iov->iov, iov->niov, vitastor_co_generic_bh_cb, &task);
@@ -661,6 +698,140 @@ Index: pve-qemu-kvm-6.1.0/block/vitastor.c
 +    return task.ret;
 +}
 +
++#if defined VITASTOR_C_API_VERSION && VITASTOR_C_API_VERSION >= 1
++#if QEMU_VERSION_MAJOR >= 2 || QEMU_VERSION_MAJOR == 1 && QEMU_VERSION_MINOR >= 7
++static void vitastor_co_read_bitmap_cb(void *opaque, long retval, uint8_t *bitmap)
++{
++    VitastorRPC *task = opaque;
++    VitastorClient *client = task->bs->opaque;
++    task->ret = retval;
++    task->complete = 1;
++    if (retval >= 0)
++    {
++        task->bitmap = bitmap;
++        if (client->last_bitmap_inode == task->inode &&
++            client->last_bitmap_offset == task->offset &&
++            client->last_bitmap_len == task->len)
++        {
++            free(client->last_bitmap);
++            client->last_bitmap = bitmap;
++        }
++    }
++    if (qemu_coroutine_self() != task->co)
++    {
++#if QEMU_VERSION_MAJOR >= 3 || QEMU_VERSION_MAJOR == 2 && QEMU_VERSION_MINOR > 8
++        aio_co_wake(task->co);
++#else
++        qemu_coroutine_enter(task->co, NULL);
++        qemu_aio_release(task);
++#endif
++    }
++}
++
++static int coroutine_fn vitastor_co_block_status(
++    BlockDriverState *bs, bool want_zero, int64_t offset, int64_t bytes,
++    int64_t *pnum, int64_t *map, BlockDriverState **file)
++{
++    // Allocated => return BDRV_BLOCK_DATA|BDRV_BLOCK_OFFSET_VALID
++    // Not allocated => return 0
++    // Error => return -errno
++    // Set pnum to length of the extent, `*map` = `offset`, `*file` = `bs`
++    VitastorRPC task;
++    VitastorClient *client = bs->opaque;
++    uint64_t inode = client->watch ? vitastor_c_inode_get_num(client->watch) : client->inode;
++    uint8_t bit = 0;
++    if (client->last_bitmap && client->last_bitmap_inode == inode &&
++        client->last_bitmap_offset <= offset &&
++        client->last_bitmap_offset+client->last_bitmap_len >= (want_zero ? offset+1 : offset+bytes))
++    {
++        // Use the previously read bitmap
++        task.bitmap_granularity = client->last_bitmap_granularity;
++        task.offset = client->last_bitmap_offset;
++        task.len = client->last_bitmap_len;
++        task.bitmap = client->last_bitmap;
++    }
++    else
++    {
++        // Read bitmap from this position, rounding to full inode PG blocks
++        uint32_t block_size = vitastor_c_inode_get_block_size(client->proxy, inode);
++        if (!block_size)
++            return -EAGAIN;
++        // Init coroutine
++        vitastor_co_init_task(bs, &task);
++        free(client->last_bitmap);
++        task.inode = client->last_bitmap_inode = inode;
++        task.bitmap_granularity = client->last_bitmap_granularity = vitastor_c_inode_get_bitmap_granularity(client->proxy, inode);
++        task.offset = client->last_bitmap_offset = offset / block_size * block_size;
++        task.len = client->last_bitmap_len = (offset+bytes+block_size-1) / block_size * block_size - task.offset;
++        task.bitmap = client->last_bitmap = NULL;
++        qemu_mutex_lock(&client->mutex);
++        vitastor_c_read_bitmap(client->proxy, task.inode, task.offset, task.len, !client->skip_parents, vitastor_co_read_bitmap_cb, &task);
++        qemu_mutex_unlock(&client->mutex);
++        while (!task.complete)
++        {
++            qemu_coroutine_yield();
++        }
++        if (task.ret < 0)
++        {
++            // Error
++            return task.ret;
++        }
++    }
++    if (want_zero)
++    {
++        // Get precise mapping with all holes
++        uint64_t bmp_pos = (offset-task.offset) / task.bitmap_granularity;
++        uint64_t bmp_len = task.len / task.bitmap_granularity;
++        uint64_t bmp_end = bmp_pos+1;
++        bit = (task.bitmap[bmp_pos >> 3] >> (bmp_pos & 0x7)) & 1;
++        while (bmp_end < bmp_len && ((task.bitmap[bmp_end >> 3] >> (bmp_end & 0x7)) & 1) == bit)
++        {
++            bmp_end++;
++        }
++        *pnum = (bmp_end-bmp_pos) * task.bitmap_granularity;
++    }
++    else
++    {
++        // Get larger allocated extents, possibly with false positives
++        uint64_t bmp_pos = (offset-task.offset) / task.bitmap_granularity;
++        uint64_t bmp_end = (offset+bytes-task.offset) / task.bitmap_granularity - bmp_pos;
++        while (bmp_pos < bmp_end)
++        {
++            if (!(bmp_pos & 7) && bmp_end >= bmp_pos+8)
++            {
++                bit = bit || task.bitmap[bmp_pos >> 3];
++                bmp_pos += 8;
++            }
++            else
++            {
++                bit = bit || ((task.bitmap[bmp_pos >> 3] >> (bmp_pos & 0x7)) & 1);
++                bmp_pos++;
++            }
++        }
++        *pnum = bytes;
++    }
++    if (bit)
++    {
++        *map = offset;
++        *file = bs;
++    }
++    return (bit ? (BDRV_BLOCK_DATA|BDRV_BLOCK_OFFSET_VALID) : 0);
++}
++#endif
++#if QEMU_VERSION_MAJOR == 1 && QEMU_VERSION_MINOR >= 7 || QEMU_VERSION_MAJOR == 2 && QEMU_VERSION_MINOR < 12
++// QEMU 1.7-2.11
++static int64_t coroutine_fn vitastor_co_get_block_status(BlockDriverState *bs,
++    int64_t sector_num, int nb_sectors, int *pnum, BlockDriverState **file)
++{
++    int64_t map = 0;
++    int64_t pnumbytes = 0;
++    int r = vitastor_co_block_status(bs, 1, sector_num*BDRV_SECTOR_SIZE, nb_sectors*BDRV_SECTOR_SIZE, &pnumbytes, &map, &file);
++    *pnum = pnumbytes/BDRV_SECTOR_SIZE;
++    return r;
++}
++#endif
++#endif
++
 +#if !( QEMU_VERSION_MAJOR >= 3 || QEMU_VERSION_MAJOR == 2 && QEMU_VERSION_MINOR >= 7 )
 +static int coroutine_fn vitastor_co_readv(BlockDriverState *bs, int64_t sector_num, int nb_sectors, QEMUIOVector *iov)
 +{
@@ -768,6 +939,15 @@ Index: pve-qemu-kvm-6.1.0/block/vitastor.c
 +    .bdrv_co_truncate               = vitastor_co_truncate,
 +#endif
 +
++#if defined VITASTOR_C_API_VERSION && VITASTOR_C_API_VERSION >= 1
++#if QEMU_VERSION_MAJOR >= 3 || QEMU_VERSION_MAJOR == 2 && QEMU_VERSION_MINOR >= 12
++    // For snapshot export
++    .bdrv_co_block_status           = vitastor_co_block_status,
++#elif QEMU_VERSION_MAJOR == 1 && QEMU_VERSION_MINOR >= 7 || QEMU_VERSION_MAJOR == 2 && QEMU_VERSION_MINOR < 12
++    .bdrv_co_get_block_status       = vitastor_co_get_block_status,
++#endif
++#endif
++
 +#if QEMU_VERSION_MAJOR >= 3 || QEMU_VERSION_MAJOR == 2 && QEMU_VERSION_MINOR >= 7
 +    .bdrv_co_preadv                 = vitastor_co_preadv,
 +    .bdrv_co_pwritev                = vitastor_co_pwritev,

debian/patches/pve/0001-PVE-Config-block-file-change-locking-default-to-off.patch

@@ -14,10 +14,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/block/file-posix.c b/block/file-posix.c
-index dd295cfc6d..3ac5177cbb 100644
+index b283093e5b..821405fd02 100644
 --- a/block/file-posix.c
 +++ b/block/file-posix.c
-@@ -533,7 +533,7 @@ static QemuOptsList raw_runtime_opts = {
+@@ -552,7 +552,7 @@ static QemuOptsList raw_runtime_opts = {
          {
              .name = "locking",
              .type = QEMU_OPT_STRING,
@@ -26,7 +26,7 @@ index dd295cfc6d..3ac5177cbb 100644
          },
          {
              .name = "pr-manager",
-@@ -631,7 +631,7 @@ static int raw_open_common(BlockDriverState *bs, QDict *options,
+@@ -652,7 +652,7 @@ static int raw_open_common(BlockDriverState *bs, QDict *options,
          s->use_lock = false;
          break;
      case ON_OFF_AUTO_AUTO:

debian/patches/pve/0002-PVE-Config-Adjust-network-script-path-to-etc-kvm.patch

@@ -9,10 +9,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/include/net/net.h b/include/net/net.h
-index 5d1508081f..f665924193 100644
+index 523136c7ac..c27859b4f6 100644
 --- a/include/net/net.h
 +++ b/include/net/net.h
-@@ -219,8 +219,8 @@ void netdev_add(QemuOpts *opts, Error **errp);
+@@ -226,8 +226,8 @@ void netdev_add(QemuOpts *opts, Error **errp);
  int net_hub_id_for_client(NetClientState *nc, int *id);
  NetClientState *net_hub_port_find(int hub_id);
  

debian/patches/pve/0003-PVE-Config-set-the-CPU-model-to-kvm64-32-instead-of-.patch

@@ -10,10 +10,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/target/i386/cpu.h b/target/i386/cpu.h
-index 21b33fbe2e..32514193a9 100644
+index 04f2b790c9..19fdbb981c 100644
 --- a/target/i386/cpu.h
 +++ b/target/i386/cpu.h
-@@ -2007,9 +2007,9 @@ uint64_t cpu_get_tsc(CPUX86State *env);
+@@ -2039,9 +2039,9 @@ uint64_t cpu_get_tsc(CPUX86State *env);
  #define CPU_RESOLVING_TYPE TYPE_X86_CPU
  
  #ifdef TARGET_X86_64
@@ -24,4 +24,4 @@ index 21b33fbe2e..32514193a9 100644
 +#define TARGET_DEFAULT_CPU_TYPE X86_CPU_TYPE_NAME("kvm32")
  #endif
  
- #define cpu_signal_handler cpu_x86_signal_handler
+ #define cpu_list x86_cpu_list

debian/patches/pve/0004-PVE-Config-ui-spice-default-to-pve-certificates.patch

@@ -9,10 +9,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 9 insertions(+), 6 deletions(-)
 
 diff --git a/ui/spice-core.c b/ui/spice-core.c
-index 0371055e6c..840cf56923 100644
+index 31974b8d6c..a3acdbd682 100644
 --- a/ui/spice-core.c
 +++ b/ui/spice-core.c
-@@ -694,32 +694,35 @@ static void qemu_spice_init(void)
+@@ -689,32 +689,35 @@ static void qemu_spice_init(void)
  
      if (tls_port) {
          x509_dir = qemu_opt_get(opts, "x509-dir");

debian/patches/pve/0005-PVE-Config-glusterfs-no-default-logfile-if-daemonize.patch

@@ -9,7 +9,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 11 insertions(+), 4 deletions(-)
 
 diff --git a/block/gluster.c b/block/gluster.c
-index e8ee14c8e9..3eb6a05500 100644
+index 592e71b22a..aebfece6eb 100644
 --- a/block/gluster.c
 +++ b/block/gluster.c
 @@ -42,7 +42,7 @@

debian/patches/pve/0006-PVE-Config-rbd-block-rbd-disable-rbd_cache_writethro.patch

@@ -18,10 +18,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 2 insertions(+)
 
 diff --git a/block/rbd.c b/block/rbd.c
-index dcf82b15b8..feeec452f0 100644
+index def96292e0..a4b8fb482c 100644
 --- a/block/rbd.c
 +++ b/block/rbd.c
-@@ -814,6 +814,8 @@ static int qemu_rbd_connect(rados_t *cluster, rados_ioctx_t *io_ctx,
+@@ -820,6 +820,8 @@ static int qemu_rbd_connect(rados_t *cluster, rados_ioctx_t *io_ctx,
          rados_conf_set(*cluster, "rbd_cache", "false");
      }
  

debian/patches/pve/0007-PVE-Up-qmp-add-get_link_status.patch

@@ -11,10 +11,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  3 files changed, 43 insertions(+)
 
 diff --git a/net/net.c b/net/net.c
-index 76bbb7c31b..82e0a768b4 100644
+index f0d14dbfc1..6d476c47ef 100644
 --- a/net/net.c
 +++ b/net/net.c
-@@ -1314,6 +1314,33 @@ void hmp_info_network(Monitor *mon, const QDict *qdict)
+@@ -1334,6 +1334,33 @@ void hmp_info_network(Monitor *mon, const QDict *qdict)
      }
  }
  

debian/patches/pve/0008-PVE-Up-glusterfs-allow-partial-reads.patch

@@ -16,7 +16,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 9 insertions(+), 1 deletion(-)
 
 diff --git a/block/gluster.c b/block/gluster.c
-index 3eb6a05500..b612918ee8 100644
+index aebfece6eb..3b7ee2f649 100644
 --- a/block/gluster.c
 +++ b/block/gluster.c
 @@ -57,6 +57,7 @@ typedef struct GlusterAIOCB {
@@ -39,15 +39,15 @@ index 3eb6a05500..b612918ee8 100644
      }
  
      aio_co_schedule(acb->aio_context, acb->coroutine);
-@@ -1021,6 +1024,7 @@ static coroutine_fn int qemu_gluster_co_pwrite_zeroes(BlockDriverState *bs,
+@@ -1022,6 +1025,7 @@ static coroutine_fn int qemu_gluster_co_pwrite_zeroes(BlockDriverState *bs,
      acb.ret = 0;
      acb.coroutine = qemu_coroutine_self();
      acb.aio_context = bdrv_get_aio_context(bs);
 +    acb.is_write = true;
  
-     ret = glfs_zerofill_async(s->fd, offset, size, gluster_finish_aiocb, &acb);
+     ret = glfs_zerofill_async(s->fd, offset, bytes, gluster_finish_aiocb, &acb);
      if (ret < 0) {
-@@ -1202,9 +1206,11 @@ static coroutine_fn int qemu_gluster_co_rw(BlockDriverState *bs,
+@@ -1203,9 +1207,11 @@ static coroutine_fn int qemu_gluster_co_rw(BlockDriverState *bs,
      acb.aio_context = bdrv_get_aio_context(bs);
  
      if (write) {
@@ -59,7 +59,7 @@ index 3eb6a05500..b612918ee8 100644
          ret = glfs_preadv_async(s->fd, qiov->iov, qiov->niov, offset, 0,
                                  gluster_finish_aiocb, &acb);
      }
-@@ -1268,6 +1274,7 @@ static coroutine_fn int qemu_gluster_co_flush_to_disk(BlockDriverState *bs)
+@@ -1269,6 +1275,7 @@ static coroutine_fn int qemu_gluster_co_flush_to_disk(BlockDriverState *bs)
      acb.ret = 0;
      acb.coroutine = qemu_coroutine_self();
      acb.aio_context = bdrv_get_aio_context(bs);
@@ -67,11 +67,11 @@ index 3eb6a05500..b612918ee8 100644
  
      ret = glfs_fsync_async(s->fd, gluster_finish_aiocb, &acb);
      if (ret < 0) {
-@@ -1314,6 +1321,7 @@ static coroutine_fn int qemu_gluster_co_pdiscard(BlockDriverState *bs,
+@@ -1317,6 +1324,7 @@ static coroutine_fn int qemu_gluster_co_pdiscard(BlockDriverState *bs,
      acb.ret = 0;
      acb.coroutine = qemu_coroutine_self();
      acb.aio_context = bdrv_get_aio_context(bs);
 +    acb.is_write = true;
  
-     ret = glfs_discard_async(s->fd, offset, size, gluster_finish_aiocb, &acb);
+     ret = glfs_discard_async(s->fd, offset, bytes, gluster_finish_aiocb, &acb);
      if (ret < 0) {

debian/patches/pve/0009-PVE-Up-qemu-img-return-success-on-info-without-snaps.patch

@@ -9,10 +9,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/qemu-img.c b/qemu-img.c
-index 908fd0cce5..5dc1d0a2ca 100644
+index f036a1d428..080ad9bca7 100644
 --- a/qemu-img.c
 +++ b/qemu-img.c
-@@ -2977,7 +2977,8 @@ static int img_info(int argc, char **argv)
+@@ -2989,7 +2989,8 @@ static int img_info(int argc, char **argv)
      list = collect_image_info_list(image_opts, filename, fmt, chain,
                                     force_share);
      if (!list) {

debian/patches/pve/0010-PVE-Up-qemu-img-dd-add-osize-and-read-from-to-stdin-.patch

@@ -37,7 +37,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  2 files changed, 119 insertions(+), 72 deletions(-)
 
 diff --git a/qemu-img-cmds.hx b/qemu-img-cmds.hx
-index b3620f29e5..e70ef3dc91 100644
+index 72bcdcfbfa..0b2999f3ab 100644
 --- a/qemu-img-cmds.hx
 +++ b/qemu-img-cmds.hx
 @@ -58,9 +58,9 @@ SRST
@@ -53,10 +53,10 @@ index b3620f29e5..e70ef3dc91 100644
  
  DEF("info", img_info,
 diff --git a/qemu-img.c b/qemu-img.c
-index 5dc1d0a2ca..f773182bd0 100644
+index 080ad9bca7..1f457d9e80 100644
 --- a/qemu-img.c
 +++ b/qemu-img.c
-@@ -4793,10 +4793,12 @@ static int img_bitmap(int argc, char **argv)
+@@ -4805,10 +4805,12 @@ static int img_bitmap(int argc, char **argv)
  #define C_IF      04
  #define C_OF      010
  #define C_SKIP    020
@@ -69,7 +69,7 @@ index 5dc1d0a2ca..f773182bd0 100644
  };
  
  struct DdIo {
-@@ -4872,6 +4874,19 @@ static int img_dd_skip(const char *arg,
+@@ -4884,6 +4886,19 @@ static int img_dd_skip(const char *arg,
      return 0;
  }
  
@@ -89,7 +89,7 @@ index 5dc1d0a2ca..f773182bd0 100644
  static int img_dd(int argc, char **argv)
  {
      int ret = 0;
-@@ -4912,6 +4927,7 @@ static int img_dd(int argc, char **argv)
+@@ -4924,6 +4939,7 @@ static int img_dd(int argc, char **argv)
          { "if", img_dd_if, C_IF },
          { "of", img_dd_of, C_OF },
          { "skip", img_dd_skip, C_SKIP },
@@ -97,7 +97,7 @@ index 5dc1d0a2ca..f773182bd0 100644
          { NULL, NULL, 0 }
      };
      const struct option long_options[] = {
-@@ -4987,91 +5003,112 @@ static int img_dd(int argc, char **argv)
+@@ -4999,91 +5015,112 @@ static int img_dd(int argc, char **argv)
          arg = NULL;
      }
  
@@ -134,11 +134,7 @@ index 5dc1d0a2ca..f773182bd0 100644
 -        error_report_err(local_err);
 -        ret = -1;
 -        goto out;
-+        if (!blk1) {
-+            ret = -1;
-+            goto out;
-+        }
-     }
+-    }
 -    if (!drv->create_opts) {
 -        error_report("Format driver '%s' does not support image creation",
 -                     drv->format_name);
@@ -150,12 +146,16 @@ index 5dc1d0a2ca..f773182bd0 100644
 -                     proto_drv->format_name);
 -        ret = -1;
 -        goto out;
--    }
++        if (!blk1) {
++            ret = -1;
++            goto out;
++        }
+     }
 -    create_opts = qemu_opts_append(create_opts, drv->create_opts);
 -    create_opts = qemu_opts_append(create_opts, proto_drv->create_opts);
--
--    opts = qemu_opts_create(create_opts, NULL, 0, &error_abort);
  
+-    opts = qemu_opts_create(create_opts, NULL, 0, &error_abort);
+-
 -    size = blk_getlength(blk1);
 -    if (size < 0) {
 -        error_report("Failed to get size for '%s'", in.filename);
@@ -274,7 +274,7 @@ index 5dc1d0a2ca..f773182bd0 100644
      }
  
      if (dd.flags & C_SKIP && (in.offset > INT64_MAX / in.bsz ||
-@@ -5089,11 +5126,17 @@ static int img_dd(int argc, char **argv)
+@@ -5101,11 +5138,17 @@ static int img_dd(int argc, char **argv)
  
      for (out_pos = 0; in_pos < size; block_count++) {
          int in_ret, out_ret;
@@ -296,7 +296,7 @@ index 5dc1d0a2ca..f773182bd0 100644
          }
          if (in_ret < 0) {
              error_report("error while reading from input image file: %s",
-@@ -5103,9 +5146,13 @@ static int img_dd(int argc, char **argv)
+@@ -5115,9 +5158,13 @@ static int img_dd(int argc, char **argv)
          }
          in_pos += in_ret;
  

debian/patches/pve/0011-PVE-Up-qemu-img-dd-add-isize-parameter.patch

@@ -15,10 +15,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 25 insertions(+), 3 deletions(-)
 
 diff --git a/qemu-img.c b/qemu-img.c
-index f773182bd0..98a6562364 100644
+index 1f457d9e80..d9e8a8c4d4 100644
 --- a/qemu-img.c
 +++ b/qemu-img.c
-@@ -4794,11 +4794,13 @@ static int img_bitmap(int argc, char **argv)
+@@ -4806,11 +4806,13 @@ static int img_bitmap(int argc, char **argv)
  #define C_OF      010
  #define C_SKIP    020
  #define C_OSIZE   040
@@ -32,7 +32,7 @@ index f773182bd0..98a6562364 100644
  };
  
  struct DdIo {
-@@ -4887,6 +4889,19 @@ static int img_dd_osize(const char *arg,
+@@ -4899,6 +4901,19 @@ static int img_dd_osize(const char *arg,
      return 0;
  }
  
@@ -52,7 +52,7 @@ index f773182bd0..98a6562364 100644
  static int img_dd(int argc, char **argv)
  {
      int ret = 0;
-@@ -4901,12 +4916,14 @@ static int img_dd(int argc, char **argv)
+@@ -4913,12 +4928,14 @@ static int img_dd(int argc, char **argv)
      int c, i;
      const char *out_fmt = "raw";
      const char *fmt = NULL;
@@ -68,7 +68,7 @@ index f773182bd0..98a6562364 100644
      };
      struct DdIo in = {
          .bsz = 512, /* Block size is by default 512 bytes */
-@@ -4928,6 +4945,7 @@ static int img_dd(int argc, char **argv)
+@@ -4940,6 +4957,7 @@ static int img_dd(int argc, char **argv)
          { "of", img_dd_of, C_OF },
          { "skip", img_dd_skip, C_SKIP },
          { "osize", img_dd_osize, C_OSIZE },
@@ -76,7 +76,7 @@ index f773182bd0..98a6562364 100644
          { NULL, NULL, 0 }
      };
      const struct option long_options[] = {
-@@ -5124,14 +5142,18 @@ static int img_dd(int argc, char **argv)
+@@ -5136,14 +5154,18 @@ static int img_dd(int argc, char **argv)
  
      in.buf = g_new(uint8_t, in.bsz);
  

debian/patches/pve/0012-PVE-Up-qemu-img-dd-add-n-skip_create.patch

@@ -4,15 +4,71 @@ Date: Mon, 6 Apr 2020 12:16:42 +0200
 Subject: [PATCH] PVE: [Up] qemu-img dd: add -n skip_create
 
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+[FE: fix getopt-string + add documentation]
+Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 ---
- qemu-img.c | 23 ++++++++++++++---------
- 1 file changed, 14 insertions(+), 9 deletions(-)
+ docs/tools/qemu-img.rst | 11 ++++++++++-
+ qemu-img-cmds.hx        |  4 ++--
+ qemu-img.c              | 23 ++++++++++++++---------
+ 3 files changed, 26 insertions(+), 12 deletions(-)
 
+diff --git a/docs/tools/qemu-img.rst b/docs/tools/qemu-img.rst
+index d663dd92bd..a49badb158 100644
+--- a/docs/tools/qemu-img.rst
++++ b/docs/tools/qemu-img.rst
+@@ -208,6 +208,10 @@ Parameters to convert subcommand:
+ 
+ Parameters to dd subcommand:
+ 
++.. option:: -n
++
++  Skip the creation of the target volume
++
+ .. program:: qemu-img-dd
+ 
+ .. option:: bs=BLOCK_SIZE
+@@ -488,7 +492,7 @@ Command description:
+   it doesn't need to be specified separately in this case.
+ 
+ 
+-.. option:: dd [--image-opts] [-U] [-f FMT] [-O OUTPUT_FMT] [bs=BLOCK_SIZE] [count=BLOCKS] [skip=BLOCKS] if=INPUT of=OUTPUT
++.. option:: dd [--image-opts] [-U] [-f FMT] [-O OUTPUT_FMT] [-n] [bs=BLOCK_SIZE] [count=BLOCKS] [skip=BLOCKS] if=INPUT of=OUTPUT
+ 
+   dd copies from *INPUT* file to *OUTPUT* file converting it from
+   *FMT* format to *OUTPUT_FMT* format.
+@@ -499,6 +503,11 @@ Command description:
+ 
+   The size syntax is similar to :manpage:`dd(1)`'s size syntax.
+ 
++  If the ``-n`` option is specified, the target volume creation will be
++  skipped. This is useful for formats such as ``rbd`` if the target
++  volume has already been created with site specific options that cannot
++  be supplied through ``qemu-img``.
++
+ .. option:: info [--object OBJECTDEF] [--image-opts] [-f FMT] [--output=OFMT] [--backing-chain] [-U] FILENAME
+ 
+   Give information about the disk image *FILENAME*. Use it in
+diff --git a/qemu-img-cmds.hx b/qemu-img-cmds.hx
+index 0b2999f3ab..f3b2b1b4de 100644
+--- a/qemu-img-cmds.hx
++++ b/qemu-img-cmds.hx
+@@ -58,9 +58,9 @@ SRST
+ ERST
+ 
+ DEF("dd", img_dd,
+-    "dd [--image-opts] [-U] [-f fmt] [-O output_fmt] [bs=block_size] [count=blocks] [skip=blocks] [osize=output_size] if=input of=output")
++    "dd [--image-opts] [-U] [-f fmt] [-O output_fmt] [-n] [bs=block_size] [count=blocks] [skip=blocks] [osize=output_size] if=input of=output")
+ SRST
+-.. option:: dd [--image-opts] [-U] [-f FMT] [-O OUTPUT_FMT] [bs=BLOCK_SIZE] [count=BLOCKS] [skip=BLOCKS] [osize=OUTPUT_SIZE] if=INPUT of=OUTPUT
++.. option:: dd [--image-opts] [-U] [-f FMT] [-O OUTPUT_FMT] [-n] [bs=BLOCK_SIZE] [count=BLOCKS] [skip=BLOCKS] [osize=OUTPUT_SIZE] if=INPUT of=OUTPUT
+ ERST
+ 
+ DEF("info", img_info,
 diff --git a/qemu-img.c b/qemu-img.c
-index 98a6562364..355b3b82f4 100644
+index d9e8a8c4d4..015d6d2ce4 100644
 --- a/qemu-img.c
 +++ b/qemu-img.c
-@@ -4918,7 +4918,7 @@ static int img_dd(int argc, char **argv)
+@@ -4930,7 +4930,7 @@ static int img_dd(int argc, char **argv)
      const char *fmt = NULL;
      int64_t size = 0, readsize = 0;
      int64_t block_count = 0, out_pos, in_pos;
@@ -21,16 +77,16 @@ index 98a6562364..355b3b82f4 100644
      struct DdInfo dd = {
          .flags = 0,
          .count = 0,
-@@ -4956,7 +4956,7 @@ static int img_dd(int argc, char **argv)
+@@ -4968,7 +4968,7 @@ static int img_dd(int argc, char **argv)
          { 0, 0, 0, 0 }
      };
  
 -    while ((c = getopt_long(argc, argv, ":hf:O:U", long_options, NULL))) {
-+    while ((c = getopt_long(argc, argv, ":hf:O:U:n", long_options, NULL))) {
++    while ((c = getopt_long(argc, argv, ":hf:O:Un", long_options, NULL))) {
          if (c == EOF) {
              break;
          }
-@@ -4976,6 +4976,9 @@ static int img_dd(int argc, char **argv)
+@@ -4988,6 +4988,9 @@ static int img_dd(int argc, char **argv)
          case 'h':
              help();
              break;
@@ -40,7 +96,7 @@ index 98a6562364..355b3b82f4 100644
          case 'U':
              force_share = true;
              break;
-@@ -5106,13 +5109,15 @@ static int img_dd(int argc, char **argv)
+@@ -5118,13 +5121,15 @@ static int img_dd(int argc, char **argv)
                                  size - in.bsz * in.offset, &error_abort);
          }
  

debian/patches/pve/0013-PVE-virtio-balloon-improve-query-balloon.patch

@@ -14,10 +14,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  3 files changed, 81 insertions(+), 4 deletions(-)
 
 diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
-index ae7867a8db..956e3f4e46 100644
+index 9a4f491b54..1faa16234e 100644
 --- a/hw/virtio/virtio-balloon.c
 +++ b/hw/virtio/virtio-balloon.c
-@@ -820,8 +820,37 @@ static uint64_t virtio_balloon_get_features(VirtIODevice *vdev, uint64_t f,
+@@ -812,8 +812,37 @@ static uint64_t virtio_balloon_get_features(VirtIODevice *vdev, uint64_t f,
  static void virtio_balloon_stat(void *opaque, BalloonInfo *info)
  {
      VirtIOBalloon *dev = opaque;
@@ -58,10 +58,10 @@ index ae7867a8db..956e3f4e46 100644
  
  static void virtio_balloon_to_target(void *opaque, ram_addr_t target)
 diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
-index f4ef58d257..c8b97909e7 100644
+index 2e91ccb738..e9fa9af6bd 100644
 --- a/monitor/hmp-cmds.c
 +++ b/monitor/hmp-cmds.c
-@@ -698,7 +698,35 @@ void hmp_info_balloon(Monitor *mon, const QDict *qdict)
+@@ -696,7 +696,35 @@ void hmp_info_balloon(Monitor *mon, const QDict *qdict)
          return;
      }
  
@@ -99,7 +99,7 @@ index f4ef58d257..c8b97909e7 100644
      qapi_free_BalloonInfo(info);
  }
 diff --git a/qapi/machine.json b/qapi/machine.json
-index 157712f006..34035c25d1 100644
+index 067e3f5378..91f3be6f44 100644
 --- a/qapi/machine.json
 +++ b/qapi/machine.json
 @@ -1018,10 +1018,30 @@

debian/patches/pve/0014-PVE-qapi-modify-query-machines.patch

@@ -13,10 +13,10 @@ Signed-off-by: Dietmar Maurer <dietmar@proxmox.com>
  2 files changed, 9 insertions(+), 1 deletion(-)
 
 diff --git a/hw/core/machine-qmp-cmds.c b/hw/core/machine-qmp-cmds.c
-index 216fdfaf3a..8f8d5d5276 100644
+index 4f4ab30f8c..76fff60a6b 100644
 --- a/hw/core/machine-qmp-cmds.c
 +++ b/hw/core/machine-qmp-cmds.c
-@@ -98,6 +98,12 @@ MachineInfoList *qmp_query_machines(Error **errp)
+@@ -99,6 +99,12 @@ MachineInfoList *qmp_query_machines(Error **errp)
          info->hotpluggable_cpus = mc->has_hotpluggable_cpus;
          info->numa_mem_supported = mc->numa_mem_supported;
          info->deprecated = !!mc->deprecation_reason;
@@ -30,7 +30,7 @@ index 216fdfaf3a..8f8d5d5276 100644
              info->default_cpu_type = g_strdup(mc->default_cpu_type);
              info->has_default_cpu_type = true;
 diff --git a/qapi/machine.json b/qapi/machine.json
-index 34035c25d1..cf120ac343 100644
+index 91f3be6f44..0905618e25 100644
 --- a/qapi/machine.json
 +++ b/qapi/machine.json
 @@ -141,6 +141,8 @@

debian/patches/pve/0015-PVE-qapi-modify-spice-query.patch

@@ -12,7 +12,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  2 files changed, 8 insertions(+)
 
 diff --git a/qapi/ui.json b/qapi/ui.json
-index cba8665b73..081115ea8a 100644
+index 4244c62c30..f946fbd8c1 100644
 --- a/qapi/ui.json
 +++ b/qapi/ui.json
 @@ -333,11 +333,14 @@
@@ -28,10 +28,10 @@ index cba8665b73..081115ea8a 100644
             '*tls-port': 'int', '*auth': 'str', '*compiled-version': 'str',
 +           '*ticket': 'str',
             'mouse-mode': 'SpiceQueryMouseMode', '*channels': ['SpiceChannel']},
-   'if': 'defined(CONFIG_SPICE)' }
+   'if': 'CONFIG_SPICE' }
  
 diff --git a/ui/spice-core.c b/ui/spice-core.c
-index 840cf56923..96be349635 100644
+index a3acdbd682..756776778d 100644
 --- a/ui/spice-core.c
 +++ b/ui/spice-core.c
 @@ -534,6 +534,11 @@ static SpiceInfo *qmp_query_spice_real(Error **errp)

debian/patches/pve/0016-PVE-add-savevm-async-for-background-state-snapshots.patch

@@ -39,10 +39,10 @@ Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
  create mode 100644 migration/savevm-async.c
 
 diff --git a/hmp-commands-info.hx b/hmp-commands-info.hx
-index 27206ac049..e6dd3be07a 100644
+index 407a1da800..245f8acc55 100644
 --- a/hmp-commands-info.hx
 +++ b/hmp-commands-info.hx
-@@ -551,6 +551,19 @@ SRST
+@@ -536,6 +536,19 @@ SRST
      Show current migration parameters.
  ERST
  
@@ -63,11 +63,11 @@ index 27206ac049..e6dd3be07a 100644
          .name       = "balloon",
          .args_type  = "",
 diff --git a/hmp-commands.hx b/hmp-commands.hx
-index d78e4cfc47..42203dbe92 100644
+index 5efb47fc32..1ad13b668b 100644
 --- a/hmp-commands.hx
 +++ b/hmp-commands.hx
-@@ -1744,3 +1744,36 @@ ERST
-         .help       = "start a round of guest dirty rate measurement",
+@@ -1746,3 +1746,36 @@ ERST
+                       "\n\t\t\t -b to specify dirty bitmap as method of calculation)",
          .cmd        = hmp_calc_dirty_rate,
      },
 +
@@ -115,10 +115,10 @@ index e72083b117..c846d37806 100644
 +
  #endif
 diff --git a/include/monitor/hmp.h b/include/monitor/hmp.h
-index 3baa1058e2..1247d7362a 100644
+index 96d014826a..3a39ba41b5 100644
 --- a/include/monitor/hmp.h
 +++ b/include/monitor/hmp.h
-@@ -25,6 +25,7 @@ void hmp_info_status(Monitor *mon, const QDict *qdict);
+@@ -26,6 +26,7 @@ void hmp_info_status(Monitor *mon, const QDict *qdict);
  void hmp_info_uuid(Monitor *mon, const QDict *qdict);
  void hmp_info_chardev(Monitor *mon, const QDict *qdict);
  void hmp_info_mice(Monitor *mon, const QDict *qdict);
@@ -126,7 +126,7 @@ index 3baa1058e2..1247d7362a 100644
  void hmp_info_migrate(Monitor *mon, const QDict *qdict);
  void hmp_info_migrate_capabilities(Monitor *mon, const QDict *qdict);
  void hmp_info_migrate_parameters(Monitor *mon, const QDict *qdict);
-@@ -79,6 +80,10 @@ void hmp_netdev_add(Monitor *mon, const QDict *qdict);
+@@ -80,6 +81,10 @@ void hmp_netdev_add(Monitor *mon, const QDict *qdict);
  void hmp_netdev_del(Monitor *mon, const QDict *qdict);
  void hmp_getfd(Monitor *mon, const QDict *qdict);
  void hmp_closefd(Monitor *mon, const QDict *qdict);
@@ -754,10 +754,10 @@ index 0000000000..79a0cda906
 +    return ret;
 +}
 diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
-index c8b97909e7..64a84cf4ee 100644
+index e9fa9af6bd..5000ce39d1 100644
 --- a/monitor/hmp-cmds.c
 +++ b/monitor/hmp-cmds.c
-@@ -1961,6 +1961,63 @@ void hmp_info_memory_devices(Monitor *mon, const QDict *qdict)
+@@ -1903,6 +1903,63 @@ void hmp_info_memory_devices(Monitor *mon, const QDict *qdict)
      hmp_handle_error(mon, err);
  }
  
@@ -822,7 +822,7 @@ index c8b97909e7..64a84cf4ee 100644
  {
      IOThreadInfoList *info_list = qmp_query_iothreads(NULL);
 diff --git a/qapi/migration.json b/qapi/migration.json
-index 1124a2dda8..3d72b3e3f3 100644
+index bbfd48cf0b..45686390a2 100644
 --- a/qapi/migration.json
 +++ b/qapi/migration.json
 @@ -247,6 +247,40 @@
@@ -867,10 +867,10 @@ index 1124a2dda8..3d72b3e3f3 100644
  # @query-migrate:
  #
 diff --git a/qapi/misc.json b/qapi/misc.json
-index 5c2ca3b556..9bc14e1032 100644
+index 358548abe1..25b3febc52 100644
 --- a/qapi/misc.json
 +++ b/qapi/misc.json
-@@ -431,6 +431,38 @@
+@@ -435,6 +435,38 @@
  ##
  { 'command': 'query-fdsets', 'returns': ['FdsetInfo'] }
  
@@ -910,10 +910,10 @@ index 5c2ca3b556..9bc14e1032 100644
  # @CommandLineParameterType:
  #
 diff --git a/qemu-options.hx b/qemu-options.hx
-index 83aa59a920..002ba697e9 100644
+index ae2c6dbbfc..423144abeb 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
-@@ -4131,6 +4131,18 @@ SRST
+@@ -4171,6 +4171,18 @@ SRST
      Start right away with a saved state (``loadvm`` in monitor)
  ERST
  
@@ -933,21 +933,21 @@ index 83aa59a920..002ba697e9 100644
  DEF("daemonize", 0, QEMU_OPTION_daemonize, \
      "-daemonize      daemonize QEMU after initializing\n", QEMU_ARCH_ALL)
 diff --git a/softmmu/vl.c b/softmmu/vl.c
-index 5ca11e7469..220c67cd32 100644
+index 620a1f1367..fd82efb8b3 100644
 --- a/softmmu/vl.c
 +++ b/softmmu/vl.c
-@@ -150,6 +150,7 @@ static const char *incoming;
+@@ -156,6 +156,7 @@ static const char *incoming;
  static const char *loadvm;
  static const char *accelerators;
  static QDict *machine_opts_dict;
 +static const char *loadstate;
  static QTAILQ_HEAD(, ObjectOption) object_opts = QTAILQ_HEAD_INITIALIZER(object_opts);
+ static QTAILQ_HEAD(, DeviceOption) device_opts = QTAILQ_HEAD_INITIALIZER(device_opts);
  static ram_addr_t maxram_size;
- static uint64_t ram_slots;
-@@ -2700,6 +2701,12 @@ void qmp_x_exit_preconfig(Error **errp)
-             autostart = 0;
-             exit(1);
-         }
+@@ -2743,6 +2744,12 @@ void qmp_x_exit_preconfig(Error **errp)
+ 
+     if (loadvm) {
+         load_snapshot(loadvm, NULL, false, NULL, &error_fatal);
 +    } else if (loadstate) {
 +        Error *local_err = NULL;
 +        if (load_snapshot_from_blockdev(loadstate, &local_err) < 0) {
@@ -957,7 +957,7 @@ index 5ca11e7469..220c67cd32 100644
      }
      if (replay_mode != REPLAY_MODE_NONE) {
          replay_vmstate_init();
-@@ -3238,6 +3245,9 @@ void qemu_init(int argc, char **argv, char **envp)
+@@ -3284,6 +3291,9 @@ void qemu_init(int argc, char **argv, char **envp)
              case QEMU_OPTION_loadvm:
                  loadvm = optarg;
                  break;

debian/patches/pve/0018-PVE-block-add-the-zeroinit-block-driver-filter.patch

@@ -4,6 +4,8 @@ Date: Mon, 6 Apr 2020 12:16:47 +0200
 Subject: [PATCH] PVE: block: add the zeroinit block driver filter
 
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+[adapt to changed function signatures]
+Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 ---
  block/meson.build |   1 +
  block/zeroinit.c  | 196 ++++++++++++++++++++++++++++++++++++++++++++++
@@ -11,7 +13,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  create mode 100644 block/zeroinit.c
 
 diff --git a/block/meson.build b/block/meson.build
-index 0450914c7a..7a0bc3df09 100644
+index deb73ca389..c9d1fdca7d 100644
 --- a/block/meson.build
 +++ b/block/meson.build
 @@ -41,6 +41,7 @@ block_ss.add(files(
@@ -24,7 +26,7 @@ index 0450914c7a..7a0bc3df09 100644
  softmmu_ss.add(when: 'CONFIG_TCG', if_true: files('blkreplay.c'))
 diff --git a/block/zeroinit.c b/block/zeroinit.c
 new file mode 100644
-index 0000000000..5529627f7e
+index 0000000000..20ee611f22
 --- /dev/null
 +++ b/block/zeroinit.c
 @@ -0,0 +1,196 @@
@@ -138,22 +140,22 @@ index 0000000000..5529627f7e
 +}
 +
 +static int coroutine_fn zeroinit_co_preadv(BlockDriverState *bs,
-+    uint64_t offset, uint64_t bytes, QEMUIOVector *qiov, int flags)
++    int64_t offset, int64_t bytes, QEMUIOVector *qiov, BdrvRequestFlags flags)
 +{
 +    return bdrv_co_preadv(bs->file, offset, bytes, qiov, flags);
 +}
 +
 +static int coroutine_fn zeroinit_co_pwrite_zeroes(BlockDriverState *bs, int64_t offset,
-+                                                 int count, BdrvRequestFlags flags)
++                                                 int64_t bytes, BdrvRequestFlags flags)
 +{
 +    BDRVZeroinitState *s = bs->opaque;
 +    if (offset >= s->extents)
 +        return 0;
-+    return bdrv_pwrite_zeroes(bs->file, offset, count, flags);
++    return bdrv_pwrite_zeroes(bs->file, offset, bytes, flags);
 +}
 +
 +static int coroutine_fn zeroinit_co_pwritev(BlockDriverState *bs,
-+    uint64_t offset, uint64_t bytes, QEMUIOVector *qiov, int flags)
++    int64_t offset, int64_t bytes, QEMUIOVector *qiov, BdrvRequestFlags flags)
 +{
 +    BDRVZeroinitState *s = bs->opaque;
 +    int64_t extents = offset + bytes;
@@ -174,9 +176,9 @@ index 0000000000..5529627f7e
 +}
 +
 +static int coroutine_fn zeroinit_co_pdiscard(BlockDriverState *bs,
-+                                             int64_t offset, int count)
++                                             int64_t offset, int64_t bytes)
 +{
-+    return bdrv_co_pdiscard(bs->file, offset, count);
++    return bdrv_co_pdiscard(bs->file, offset, bytes);
 +}
 +
 +static int zeroinit_co_truncate(BlockDriverState *bs, int64_t offset,

debian/patches/pve/0019-PVE-Add-dummy-id-command-line-parameter.patch

@@ -14,10 +14,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  2 files changed, 11 insertions(+)
 
 diff --git a/qemu-options.hx b/qemu-options.hx
-index 002ba697e9..a05959b9f1 100644
+index 423144abeb..4879471aeb 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
-@@ -1005,6 +1005,9 @@ DEFHEADING()
+@@ -1019,6 +1019,9 @@ DEFHEADING()
  
  DEFHEADING(Block device options:)
  
@@ -28,10 +28,10 @@ index 002ba697e9..a05959b9f1 100644
      "-fda/-fdb file  use 'file' as floppy disk 0/1 image\n", QEMU_ARCH_ALL)
  DEF("fdb", HAS_ARG, QEMU_OPTION_fdb, "", QEMU_ARCH_ALL)
 diff --git a/softmmu/vl.c b/softmmu/vl.c
-index 220c67cd32..d87cf6e103 100644
+index fd82efb8b3..eb05e5a000 100644
 --- a/softmmu/vl.c
 +++ b/softmmu/vl.c
-@@ -2736,6 +2736,7 @@ void qemu_init(int argc, char **argv, char **envp)
+@@ -2779,6 +2779,7 @@ void qemu_init(int argc, char **argv, char **envp)
      MachineClass *machine_class;
      bool userconfig = true;
      FILE *vmstate_dump_file = NULL;
@@ -39,9 +39,9 @@ index 220c67cd32..d87cf6e103 100644
  
      qemu_add_opts(&qemu_drive_opts);
      qemu_add_drive_opts(&qemu_legacy_drive_opts);
-@@ -3360,6 +3361,13 @@ void qemu_init(int argc, char **argv, char **envp)
-             case QEMU_OPTION_smp:
-                 machine_parse_property_opt(qemu_find_opts("smp-opts"), "smp", optarg, &error_fatal);
+@@ -3421,6 +3422,13 @@ void qemu_init(int argc, char **argv, char **envp)
+                 machine_parse_property_opt(qemu_find_opts("smp-opts"),
+                                            "smp", optarg);
                  break;
 +            case QEMU_OPTION_id:
 +                vm_id = strtol(optarg, (char **)&optarg, 10);

debian/patches/pve/0021-PVE-Up-Config-file-posix-make-locking-optiono-on-cre.patch

@@ -13,10 +13,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  2 files changed, 42 insertions(+), 20 deletions(-)
 
 diff --git a/block/file-posix.c b/block/file-posix.c
-index 3ac5177cbb..907aa3f22e 100644
+index 821405fd02..e3b6c3c524 100644
 --- a/block/file-posix.c
 +++ b/block/file-posix.c
-@@ -2443,6 +2443,7 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
+@@ -2465,6 +2465,7 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
      int fd;
      uint64_t perm, shared;
      int result = 0;
@@ -24,7 +24,7 @@ index 3ac5177cbb..907aa3f22e 100644
  
      /* Validate options and set default values */
      assert(options->driver == BLOCKDEV_DRIVER_FILE);
-@@ -2483,19 +2484,22 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
+@@ -2505,19 +2506,22 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
      perm = BLK_PERM_WRITE | BLK_PERM_RESIZE;
      shared = BLK_PERM_ALL & ~BLK_PERM_RESIZE;
  
@@ -59,7 +59,7 @@ index 3ac5177cbb..907aa3f22e 100644
      }
  
      /* Clear the file by truncating it to 0 */
-@@ -2549,13 +2553,15 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
+@@ -2571,13 +2575,15 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
      }
  
  out_unlock:
@@ -82,7 +82,7 @@ index 3ac5177cbb..907aa3f22e 100644
      }
  
  out_close:
-@@ -2580,6 +2586,7 @@ static int coroutine_fn raw_co_create_opts(BlockDriver *drv,
+@@ -2602,6 +2608,7 @@ static int coroutine_fn raw_co_create_opts(BlockDriver *drv,
      PreallocMode prealloc;
      char *buf = NULL;
      Error *local_err = NULL;
@@ -90,7 +90,7 @@ index 3ac5177cbb..907aa3f22e 100644
  
      /* Skip file: protocol prefix */
      strstart(filename, "file:", &filename);
-@@ -2602,6 +2609,18 @@ static int coroutine_fn raw_co_create_opts(BlockDriver *drv,
+@@ -2624,6 +2631,18 @@ static int coroutine_fn raw_co_create_opts(BlockDriver *drv,
          return -EINVAL;
      }
  
@@ -109,7 +109,7 @@ index 3ac5177cbb..907aa3f22e 100644
      options = (BlockdevCreateOptions) {
          .driver     = BLOCKDEV_DRIVER_FILE,
          .u.file     = {
-@@ -2613,6 +2632,8 @@ static int coroutine_fn raw_co_create_opts(BlockDriver *drv,
+@@ -2635,6 +2654,8 @@ static int coroutine_fn raw_co_create_opts(BlockDriver *drv,
              .nocow              = nocow,
              .has_extent_size_hint = has_extent_size_hint,
              .extent_size_hint   = extent_size_hint,
@@ -119,10 +119,10 @@ index 3ac5177cbb..907aa3f22e 100644
      };
      return raw_co_create(&options, errp);
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 6356a63695..fdfa579d00 100644
+index 1d3dd9cb48..3f81d6a5c0 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -4341,7 +4341,8 @@
+@@ -4445,7 +4445,8 @@
              'size':                 'size',
              '*preallocation':       'PreallocMode',
              '*nocow':               'bool',

debian/patches/pve/0023-PVE-Compat-4.0-used-balloon-qemu-4-0-config-size-fal.patch

@@ -26,10 +26,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/hw/core/machine.c b/hw/core/machine.c
-index 2cf2f321f9..e0f857820d 100644
+index 53a99abc56..ad2cb2592e 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
-@@ -107,7 +107,8 @@ GlobalProperty hw_compat_4_0[] = {
+@@ -113,7 +113,8 @@ GlobalProperty hw_compat_4_0[] = {
      { "virtio-vga",     "edid", "false" },
      { "virtio-gpu-device", "edid", "false" },
      { "virtio-device", "use-started", "false" },

debian/patches/pve/0024-PVE-Allow-version-code-in-machine-type.patch

@@ -19,10 +19,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  4 files changed, 36 insertions(+), 1 deletion(-)
 
 diff --git a/hw/core/machine-qmp-cmds.c b/hw/core/machine-qmp-cmds.c
-index 8f8d5d5276..370e66d9cc 100644
+index 76fff60a6b..ec9201fb9a 100644
 --- a/hw/core/machine-qmp-cmds.c
 +++ b/hw/core/machine-qmp-cmds.c
-@@ -102,6 +102,12 @@ MachineInfoList *qmp_query_machines(Error **errp)
+@@ -103,6 +103,12 @@ MachineInfoList *qmp_query_machines(Error **errp)
          if (strcmp(mc->name, MACHINE_GET_CLASS(current_machine)->name) == 0) {
              info->has_is_current = true;
              info->is_current = true;
@@ -36,10 +36,10 @@ index 8f8d5d5276..370e66d9cc 100644
  
          if (mc->default_cpu_type) {
 diff --git a/include/hw/boards.h b/include/hw/boards.h
-index accd6eff35..1b16728389 100644
+index 9c1c190104..51e04bde62 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
-@@ -205,6 +205,8 @@ struct MachineClass {
+@@ -227,6 +227,8 @@ struct MachineClass {
      const char *desc;
      const char *deprecation_reason;
  
@@ -49,7 +49,7 @@ index accd6eff35..1b16728389 100644
      void (*reset)(MachineState *state);
      void (*wakeup)(MachineState *state);
 diff --git a/qapi/machine.json b/qapi/machine.json
-index cf120ac343..a6f483af4f 100644
+index 0905618e25..a05c46e253 100644
 --- a/qapi/machine.json
 +++ b/qapi/machine.json
 @@ -160,6 +160,8 @@
@@ -71,10 +71,10 @@ index cf120ac343..a6f483af4f 100644
  ##
  # @query-machines:
 diff --git a/softmmu/vl.c b/softmmu/vl.c
-index d87cf6e103..e9d40065bc 100644
+index eb05e5a000..f306d21d63 100644
 --- a/softmmu/vl.c
 +++ b/softmmu/vl.c
-@@ -1621,6 +1621,7 @@ static const QEMUOption *lookup_opt(int argc, char **argv,
+@@ -1655,6 +1655,7 @@ static const QEMUOption *lookup_opt(int argc, char **argv,
  static MachineClass *select_machine(QDict *qdict, Error **errp)
  {
      const char *optarg = qdict_get_try_str(qdict, "type");
@@ -82,7 +82,7 @@ index d87cf6e103..e9d40065bc 100644
      GSList *machines = object_class_get_list(TYPE_MACHINE, false);
      MachineClass *machine_class;
      Error *local_err = NULL;
-@@ -1638,6 +1639,11 @@ static MachineClass *select_machine(QDict *qdict, Error **errp)
+@@ -1672,6 +1673,11 @@ static MachineClass *select_machine(QDict *qdict, Error **errp)
          }
      }
  
@@ -94,7 +94,7 @@ index d87cf6e103..e9d40065bc 100644
      g_slist_free(machines);
      if (local_err) {
          error_append_hint(&local_err, "Use -machine help to list supported machines\n");
-@@ -3312,12 +3318,31 @@ void qemu_init(int argc, char **argv, char **envp)
+@@ -3363,12 +3369,31 @@ void qemu_init(int argc, char **argv, char **envp)
              case QEMU_OPTION_machine:
                  {
                      bool help;

debian/patches/pve/0025-block-backup-move-bcs-bitmap-initialization-to-job-c.patch

@@ -0,0 +1,59 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Fabian Ebner <f.ebner@proxmox.com>
+Date: Wed, 2 Mar 2022 08:35:05 +0100
+Subject: [PATCH] block/backup: move bcs bitmap initialization to job creation
+
+For backing up the state of multiple disks from the same time, a job
+for each disk has to be created. It's convenient if the jobs don't
+have to be started at the same time and if operation of the VM can be
+resumed after job creation. This would lead to a window between job
+creation and running the job, where writes can happen. But no writes
+should happen between setting up the copy-before-write filter and
+setting up the block copy state bitmap, because then new writes would
+just pass through.
+
+Commit 06e0a9c16405c0a4c1eca33cf286cc04c42066a2 moved initalization of
+the bitmap to setting up the copy-before-write filter when sync_mode
+is not MIRROR_SYNC_MODE_BITMAP. Ensure that the bitmap is initialized
+upon job creation for the remaining case too, by moving the
+backup_init_bcs_bitmap call to backup_job_create.
+
+Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+---
+ block/backup.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/block/backup.c b/block/backup.c
+index 21d5983779..47e218857d 100644
+--- a/block/backup.c
++++ b/block/backup.c
+@@ -239,8 +239,8 @@ static void backup_init_bcs_bitmap(BackupBlockJob *job)
+         assert(ret);
+     } else if (job->sync_mode == MIRROR_SYNC_MODE_TOP) {
+         /*
+-         * We can't hog the coroutine to initialize this thoroughly.
+-         * Set a flag and resume work when we are able to yield safely.
++         * Initialization is costly here. Simply set a flag and let the
++         * backup_run coroutine resume work once it can yield safely.
+          */
+         block_copy_set_skip_unallocated(job->bcs, true);
+     }
+@@ -254,8 +254,6 @@ static int coroutine_fn backup_run(Job *job, Error **errp)
+     BackupBlockJob *s = container_of(job, BackupBlockJob, common.job);
+     int ret;
+ 
+-    backup_init_bcs_bitmap(s);
+-
+     if (s->sync_mode == MIRROR_SYNC_MODE_TOP) {
+         int64_t offset = 0;
+         int64_t count;
+@@ -493,6 +491,8 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
+     block_job_add_bdrv(&job->common, "target", target, 0, BLK_PERM_ALL,
+                        &error_abort);
+ 
++    backup_init_bcs_bitmap(job);
++
+     return &job->common;
+ 
+  error:

debian/patches/pve/0026-PVE-Backup-add-vma-backup-format-code.patch

@@ -9,18 +9,18 @@ Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 ---
  block/meson.build |   2 +
  meson.build       |   5 +
- vma-reader.c      | 857 ++++++++++++++++++++++++++++++++++++++++++++++
+ vma-reader.c      | 860 ++++++++++++++++++++++++++++++++++++++++++++++
  vma-writer.c      | 790 ++++++++++++++++++++++++++++++++++++++++++
- vma.c             | 851 +++++++++++++++++++++++++++++++++++++++++++++
+ vma.c             | 849 +++++++++++++++++++++++++++++++++++++++++++++
  vma.h             | 150 ++++++++
- 6 files changed, 2655 insertions(+)
+ 6 files changed, 2656 insertions(+)
  create mode 100644 vma-reader.c
  create mode 100644 vma-writer.c
  create mode 100644 vma.c
  create mode 100644 vma.h
 
 diff --git a/block/meson.build b/block/meson.build
-index 7a0bc3df09..9ce9246194 100644
+index c9d1fdca7d..72081a9974 100644
 --- a/block/meson.build
 +++ b/block/meson.build
 @@ -44,6 +44,8 @@ block_ss.add(files(
@@ -33,21 +33,21 @@ index 7a0bc3df09..9ce9246194 100644
  
  block_ss.add(when: 'CONFIG_QCOW1', if_true: files('qcow.c'))
 diff --git a/meson.build b/meson.build
-index b3e7ec0e92..cc46eabb42 100644
+index 96de1a6ef9..54c23b9567 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -1064,6 +1064,8 @@ keyutils = dependency('libkeyutils', required: false,
+@@ -1202,6 +1202,8 @@ keyutils = dependency('libkeyutils', required: false,
  
  has_gettid = cc.has_function('gettid')
  
 +libuuid = cc.find_library('uuid', required: true)
 +
- # Malloc tests
- 
- malloc = []
-@@ -2743,6 +2745,9 @@ if have_tools
-   qemu_nbd = executable('qemu-nbd', files('qemu-nbd.c'),
-                dependencies: [blockdev, qemuutil, gnutls], install: true)
+ # libselinux
+ selinux = dependency('libselinux',
+                      required: get_option('selinux'),
+@@ -3070,6 +3072,9 @@ if have_tools
+                dependencies: [blockdev, qemuutil, gnutls, selinux],
+                install: true)
  
 +  vma = executable('vma', files('vma.c', 'vma-reader.c') + genh,
 +                   dependencies: [authz, block, crypto, io, qom], install: true)
@@ -57,10 +57,10 @@ index b3e7ec0e92..cc46eabb42 100644
    subdir('contrib/elf2dmp')
 diff --git a/vma-reader.c b/vma-reader.c
 new file mode 100644
-index 0000000000..2b1d1cdab3
+index 0000000000..4f4ee2b47b
 --- /dev/null
 +++ b/vma-reader.c
-@@ -0,0 +1,857 @@
+@@ -0,0 +1,860 @@
 +/*
 + * VMA: Virtual Machine Archive
 + *
@@ -255,6 +255,9 @@ index 0000000000..2b1d1cdab3
 +        if (vmar->rstate[i].bitmap) {
 +            g_free(vmar->rstate[i].bitmap);
 +        }
++        if (vmar->rstate[i].target) {
++            blk_unref(vmar->rstate[i].target);
++        }
 +    }
 +
 +    if (vmar->md5csum) {
@@ -1716,10 +1719,10 @@ index 0000000000..11d8321ffd
 +}
 diff --git a/vma.c b/vma.c
 new file mode 100644
-index 0000000000..df542b7732
+index 0000000000..89440733b1
 --- /dev/null
 +++ b/vma.c
-@@ -0,0 +1,851 @@
+@@ -0,0 +1,849 @@
 +/*
 + * VMA: Virtual Machine Archive
 + *
@@ -2031,8 +2034,6 @@ index 0000000000..df542b7732
 +    int vmstate_fd = -1;
 +    guint8 vmstate_stream = 0;
 +
-+    BlockBackend *blk = NULL;
-+
 +    for (i = 1; i < 255; i++) {
 +        VmaDeviceInfo *di = vma_reader_get_device_info(vmar, i);
 +        if (di && (strcmp(di->devname, "vmstate") == 0)) {
@@ -2053,6 +2054,8 @@ index 0000000000..df542b7732
 +            int flags = BDRV_O_RDWR;
 +            bool write_zero = true;
 +
++            BlockBackend *blk = NULL;
++
 +            if (readmap) {
 +                RestoreMap *map;
 +                map = (RestoreMap *)g_hash_table_lookup(devmap, di->devname);
@@ -2165,8 +2168,6 @@ index 0000000000..df542b7732
 +
 +    vma_reader_destroy(vmar);
 +
-+    blk_unref(blk);
-+
 +    bdrv_close_all();
 +
 +    return ret;

debian/patches/pve/0027-PVE-Backup-add-backup-dump-block-driver.patch

@@ -11,11 +11,11 @@ Subject: [PATCH] PVE-Backup: add backup-dump block driver
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
  block/backup-dump.c       | 168 ++++++++++++++++++++++++++++++++++++++
- block/backup.c            |  32 +++-----
+ block/backup.c            |  30 ++-----
  block/meson.build         |   1 +
  include/block/block_int.h |  35 ++++++++
  job.c                     |   3 +-
- 5 files changed, 216 insertions(+), 23 deletions(-)
+ 5 files changed, 214 insertions(+), 23 deletions(-)
  create mode 100644 block/backup-dump.c
 
 diff --git a/block/backup-dump.c b/block/backup-dump.c
@@ -193,16 +193,16 @@ index 0000000000..93d7f46950
 +    return bs;
 +}
 diff --git a/block/backup.c b/block/backup.c
-index bd3614ce70..8bae9b060e 100644
+index 47e218857d..4d8fad70c4 100644
 --- a/block/backup.c
 +++ b/block/backup.c
-@@ -31,28 +31,6 @@
+@@ -29,28 +29,6 @@
  
- #define BACKUP_CLUSTER_SIZE_DEFAULT (1 << 16)
+ #include "block/copy-before-write.h"
  
 -typedef struct BackupBlockJob {
 -    BlockJob common;
--    BlockDriverState *backup_top;
+-    BlockDriverState *cbw;
 -    BlockDriverState *source_bs;
 -    BlockDriverState *target_bs;
 -
@@ -225,11 +225,10 @@ index bd3614ce70..8bae9b060e 100644
  static const BlockJobDriver backup_job_driver;
  
  static void backup_cleanup_sync_bitmap(BackupBlockJob *job, int ret)
-@@ -504,6 +482,16 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
-         goto error;
+@@ -455,6 +433,14 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
      }
  
-+    cluster_size = backup_calculate_cluster_size(target, errp);
+     cluster_size = block_copy_cluster_size(bcs);
 +    if (cluster_size < 0) {
 +        goto error;
 +    }
@@ -238,12 +237,11 @@ index bd3614ce70..8bae9b060e 100644
 +    if (bdrv_get_info(bs, &bdi) == 0) {
 +        cluster_size = MAX(cluster_size, bdi.cluster_size);
 +    }
-+
-     /*
-      * If source is in backing chain of target assume that target is going to be
-      * used for "image fleecing", i.e. it should represent a kind of snapshot of
+ 
+     if (perf->max_chunk && perf->max_chunk < cluster_size) {
+         error_setg(errp, "Required max-chunk (%" PRIi64 ") is less than backup "
 diff --git a/block/meson.build b/block/meson.build
-index 9ce9246194..19bc2b7cbb 100644
+index 72081a9974..7883df047c 100644
 --- a/block/meson.build
 +++ b/block/meson.build
 @@ -4,6 +4,7 @@ block_ss.add(files(
@@ -251,11 +249,11 @@ index 9ce9246194..19bc2b7cbb 100644
    'amend.c',
    'backup.c',
 +  'backup-dump.c',
-   'backup-top.c',
+   'copy-before-write.c',
    'blkdebug.c',
    'blklogwrites.c',
 diff --git a/include/block/block_int.h b/include/block/block_int.h
-index 11442893d0..8f6135e6a5 100644
+index f4c75e8ba9..169dc43d59 100644
 --- a/include/block/block_int.h
 +++ b/include/block/block_int.h
 @@ -26,6 +26,7 @@
@@ -266,7 +264,7 @@ index 11442893d0..8f6135e6a5 100644
  #include "block/aio-wait.h"
  #include "qemu/queue.h"
  #include "qemu/coroutine.h"
-@@ -63,6 +64,40 @@
+@@ -64,6 +65,40 @@
  
  #define BLOCK_PROBE_BUF_SIZE        512
  
@@ -284,7 +282,7 @@ index 11442893d0..8f6135e6a5 100644
 +typedef struct BlockCopyState BlockCopyState;
 +typedef struct BackupBlockJob {
 +    BlockJob common;
-+    BlockDriverState *backup_top;
++    BlockDriverState *cbw;
 +    BlockDriverState *source_bs;
 +    BlockDriverState *target_bs;
 +
@@ -308,10 +306,10 @@ index 11442893d0..8f6135e6a5 100644
      BDRV_TRACKED_READ,
      BDRV_TRACKED_WRITE,
 diff --git a/job.c b/job.c
-index e7a5d28854..44eec9a441 100644
+index dbfa67bb0a..af25dd5b98 100644
 --- a/job.c
 +++ b/job.c
-@@ -269,7 +269,8 @@ static bool job_started(Job *job)
+@@ -276,7 +276,8 @@ static bool job_started(Job *job)
      return job->co;
  }
  

debian/patches/pve/0028-PVE-Backup-proxmox-backup-patches-for-qemu.patch

@@ -7,6 +7,8 @@ Signed-off-by: Dietmar Maurer <dietmar@proxmox.com>
 [PVE-Backup: avoid coroutines to fix AIO freeze, cleanups]
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+[add new force parameter to job_cancel_sync calls]
+Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 ---
  block/meson.build              |   5 +
  block/monitor/block-hmp-cmds.c |  33 ++
@@ -29,7 +31,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  create mode 100644 pve-backup.c
 
 diff --git a/block/meson.build b/block/meson.build
-index 19bc2b7cbb..9e433daf2e 100644
+index 7883df047c..9d3dd5b7c3 100644
 --- a/block/meson.build
 +++ b/block/meson.build
 @@ -46,6 +46,11 @@ block_ss.add(files(
@@ -45,7 +47,7 @@ index 19bc2b7cbb..9e433daf2e 100644
  softmmu_ss.add(when: 'CONFIG_TCG', if_true: files('blkreplay.c'))
  
 diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
-index 3e6670c963..1e29681d30 100644
+index 2ac4aedfff..f6668ab01d 100644
 --- a/block/monitor/block-hmp-cmds.c
 +++ b/block/monitor/block-hmp-cmds.c
 @@ -1015,3 +1015,36 @@ void hmp_info_snapshots(Monitor *mon, const QDict *qdict)
@@ -86,7 +88,7 @@ index 3e6670c963..1e29681d30 100644
 +    hmp_handle_error(mon, error);
 +}
 diff --git a/blockdev.c b/blockdev.c
-index b6f797b41f..84e9b898be 100644
+index b35072644e..c0bc3db33e 100644
 --- a/blockdev.c
 +++ b/blockdev.c
 @@ -36,6 +36,7 @@
@@ -98,10 +100,10 @@ index b6f797b41f..84e9b898be 100644
  #include "monitor/monitor.h"
  #include "qemu/error-report.h"
 diff --git a/hmp-commands-info.hx b/hmp-commands-info.hx
-index e6dd3be07a..15ddecada1 100644
+index 245f8acc55..3e7f2421eb 100644
 --- a/hmp-commands-info.hx
 +++ b/hmp-commands-info.hx
-@@ -497,6 +497,20 @@ SRST
+@@ -482,6 +482,20 @@ SRST
      Show the current VM UUID.
  ERST
  
@@ -123,7 +125,7 @@ index e6dd3be07a..15ddecada1 100644
      {
          .name       = "usernet",
 diff --git a/hmp-commands.hx b/hmp-commands.hx
-index 42203dbe92..7faba36b39 100644
+index 1ad13b668b..d4bb00216e 100644
 --- a/hmp-commands.hx
 +++ b/hmp-commands.hx
 @@ -99,6 +99,35 @@ ERST
@@ -163,10 +165,10 @@ index 42203dbe92..7faba36b39 100644
  
      {
 diff --git a/include/block/block_int.h b/include/block/block_int.h
-index 8f6135e6a5..4a572a2e34 100644
+index 169dc43d59..92f90c43eb 100644
 --- a/include/block/block_int.h
 +++ b/include/block/block_int.h
-@@ -66,7 +66,7 @@
+@@ -67,7 +67,7 @@
  
  typedef int BackupDumpFunc(void *opaque, uint64_t offset, uint64_t bytes, const void *buf);
  
@@ -176,10 +178,10 @@ index 8f6135e6a5..4a572a2e34 100644
      uint64_t byte_size,
      BackupDumpFunc *dump_cb,
 diff --git a/include/monitor/hmp.h b/include/monitor/hmp.h
-index 1247d7362a..8d3df46c93 100644
+index 3a39ba41b5..d269b4c99c 100644
 --- a/include/monitor/hmp.h
 +++ b/include/monitor/hmp.h
-@@ -29,6 +29,7 @@ void hmp_info_savevm(Monitor *mon, const QDict *qdict);
+@@ -30,6 +30,7 @@ void hmp_info_savevm(Monitor *mon, const QDict *qdict);
  void hmp_info_migrate(Monitor *mon, const QDict *qdict);
  void hmp_info_migrate_capabilities(Monitor *mon, const QDict *qdict);
  void hmp_info_migrate_parameters(Monitor *mon, const QDict *qdict);
@@ -187,7 +189,7 @@ index 1247d7362a..8d3df46c93 100644
  void hmp_info_cpus(Monitor *mon, const QDict *qdict);
  void hmp_info_vnc(Monitor *mon, const QDict *qdict);
  void hmp_info_spice(Monitor *mon, const QDict *qdict);
-@@ -72,6 +73,8 @@ void hmp_x_colo_lost_heartbeat(Monitor *mon, const QDict *qdict);
+@@ -73,6 +74,8 @@ void hmp_x_colo_lost_heartbeat(Monitor *mon, const QDict *qdict);
  void hmp_set_password(Monitor *mon, const QDict *qdict);
  void hmp_expire_password(Monitor *mon, const QDict *qdict);
  void hmp_change(Monitor *mon, const QDict *qdict);
@@ -197,19 +199,19 @@ index 1247d7362a..8d3df46c93 100644
  void hmp_device_add(Monitor *mon, const QDict *qdict);
  void hmp_device_del(Monitor *mon, const QDict *qdict);
 diff --git a/meson.build b/meson.build
-index cc46eabb42..7d7e474313 100644
+index 54c23b9567..37dab249cc 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -1065,6 +1065,7 @@ keyutils = dependency('libkeyutils', required: false,
+@@ -1203,6 +1203,7 @@ keyutils = dependency('libkeyutils', required: false,
  has_gettid = cc.has_function('gettid')
  
  libuuid = cc.find_library('uuid', required: true)
 +libproxmox_backup_qemu = cc.find_library('proxmox_backup_qemu', required: true)
  
- # Malloc tests
- 
+ # libselinux
+ selinux = dependency('libselinux',
 diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
-index 64a84cf4ee..7efcd2d641 100644
+index 5000ce39d1..b2687eae3a 100644
 --- a/monitor/hmp-cmds.c
 +++ b/monitor/hmp-cmds.c
 @@ -195,6 +195,50 @@ void hmp_info_mice(Monitor *mon, const QDict *qdict)
@@ -512,7 +514,7 @@ index 0000000000..1dda8b7d8f
 +#endif /* PROXMOX_BACKUP_CLIENT_H */
 diff --git a/pve-backup.c b/pve-backup.c
 new file mode 100644
-index 0000000000..66868dec14
+index 0000000000..88f5ee133f
 --- /dev/null
 +++ b/pve-backup.c
 @@ -0,0 +1,959 @@
@@ -872,7 +874,7 @@ index 0000000000..66868dec14
 +        if (next_job) {
 +            AioContext *aio_context = next_job->job.aio_context;
 +            aio_context_acquire(aio_context);
-+            job_cancel_sync(&next_job->job);
++            job_cancel_sync(&next_job->job, true);
 +            aio_context_release(aio_context);
 +        } else {
 +            break;
@@ -959,7 +961,7 @@ index 0000000000..66868dec14
 +            if (job_should_pause(&job->job)) {
 +                bool error_or_canceled = pvebackup_error_or_canceled();
 +                if (error_or_canceled) {
-+                    job_cancel_sync(&job->job);
++                    job_cancel_sync(&job->job, true);
 +                } else {
 +                    job_resume(&job->job);
 +                }
@@ -1476,10 +1478,10 @@ index 0000000000..66868dec14
 +    return info;
 +}
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index fdfa579d00..c5d604693f 100644
+index 3f81d6a5c0..551ee28275 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -699,6 +699,115 @@
+@@ -744,6 +744,115 @@
  { 'command': 'query-block', 'returns': ['BlockInfo'] }
  
  
@@ -1596,13 +1598,13 @@ index fdfa579d00..c5d604693f 100644
  # @BlockDeviceTimedStats:
  #
 diff --git a/qapi/common.json b/qapi/common.json
-index 7c976296f0..0690b07903 100644
+index 412cc4f5ae..3e7a77ea66 100644
 --- a/qapi/common.json
 +++ b/qapi/common.json
-@@ -197,3 +197,16 @@
- { 'enum': 'GrabToggleKeys',
-   'data': [ 'ctrl-ctrl', 'alt-alt', 'shift-shift','meta-meta', 'scrolllock',
-             'ctrl-scrolllock' ] }
+@@ -208,3 +208,16 @@
+ ##
+ { 'struct': 'HumanReadableText',
+   'data': { 'human-readable-text': 'str' } }
 +
 +##
 +# @UuidInfo:
@@ -1617,7 +1619,7 @@ index 7c976296f0..0690b07903 100644
 +##
 +{ 'struct': 'UuidInfo', 'data': {'UUID': 'str'} }
 diff --git a/qapi/machine.json b/qapi/machine.json
-index a6f483af4f..6effa7ad30 100644
+index a05c46e253..e2cec7922f 100644
 --- a/qapi/machine.json
 +++ b/qapi/machine.json
 @@ -4,6 +4,8 @@

debian/patches/pve/0029-PVE-Backup-pbs-restore-new-command-to-restore-from-p.patch

@@ -12,10 +12,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  create mode 100644 pbs-restore.c
 
 diff --git a/meson.build b/meson.build
-index 7d7e474313..dd1c5bdb4e 100644
+index 37dab249cc..1a4dfab4e2 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -2749,6 +2749,10 @@ if have_tools
+@@ -3076,6 +3076,10 @@ if have_tools
    vma = executable('vma', files('vma.c', 'vma-reader.c') + genh,
                     dependencies: [authz, block, crypto, io, qom], install: true)
  

debian/patches/pve/0030-PVE-Backup-Add-dirty-bitmap-tracking-for-incremental.patch

@@ -29,7 +29,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  6 files changed, 142 insertions(+), 23 deletions(-)
 
 diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
-index 1e29681d30..3fca3ce3e9 100644
+index f6668ab01d..3c06734e6d 100644
 --- a/block/monitor/block-hmp-cmds.c
 +++ b/block/monitor/block-hmp-cmds.c
 @@ -1042,6 +1042,7 @@ void hmp_backup(Monitor *mon, const QDict *qdict)
@@ -41,7 +41,7 @@ index 1e29681d30..3fca3ce3e9 100644
          false, NULL, false, NULL, !!devlist,
          devlist, qdict_haskey(qdict, "speed"), speed, &error);
 diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
-index 7efcd2d641..b2b5f1298b 100644
+index b2687eae3a..cfd7a60f32 100644
 --- a/monitor/hmp-cmds.c
 +++ b/monitor/hmp-cmds.c
 @@ -221,19 +221,42 @@ void hmp_info_backup(Monitor *mon, const QDict *qdict)
@@ -132,7 +132,7 @@ index 1dda8b7d8f..8cbf645b2c 100644
  
  
 diff --git a/pve-backup.c b/pve-backup.c
-index 66868dec14..6cdbd40529 100644
+index 88f5ee133f..1c49cd178d 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
 @@ -28,6 +28,8 @@
@@ -405,10 +405,10 @@ index 66868dec14..6cdbd40529 100644
      qemu_mutex_unlock(&backup_state.stat.lock);
  
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index c5d604693f..a138ad08d4 100644
+index 551ee28275..b9d6f52f0c 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -712,8 +712,13 @@
+@@ -757,8 +757,13 @@
  #
  # @total: total amount of bytes involved in the backup process
  #
@@ -422,7 +422,7 @@ index c5d604693f..a138ad08d4 100644
  # @zero-bytes: amount of 'zero' bytes detected.
  #
  # @start-time: time (epoch) when backup job started.
-@@ -726,8 +731,8 @@
+@@ -771,8 +776,8 @@
  #
  ##
  { 'struct': 'BackupStatus',
@@ -433,7 +433,7 @@ index c5d604693f..a138ad08d4 100644
             '*start-time': 'int', '*end-time': 'int',
             '*backup-file': 'str', '*uuid': 'str' } }
  
-@@ -770,6 +775,8 @@
+@@ -815,6 +820,8 @@
  #
  # @backup-time: backup timestamp (Unix epoch, required for format 'pbs')
  #
@@ -442,7 +442,7 @@ index c5d604693f..a138ad08d4 100644
  # Returns: the uuid of the backup job
  #
  ##
-@@ -780,6 +787,7 @@
+@@ -825,6 +832,7 @@
                                      '*fingerprint': 'str',
                                      '*backup-id': 'str',
                                      '*backup-time': 'int',

debian/patches/pve/0031-PVE-various-PBS-fixes.patch

@@ -14,12 +14,12 @@ Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
  block/monitor/block-hmp-cmds.c |  4 ++-
- pve-backup.c                   | 59 ++++++++++++++++++++++++++--------
+ pve-backup.c                   | 57 +++++++++++++++++++++++++++-------
  qapi/block-core.json           |  6 ++++
- 3 files changed, 55 insertions(+), 14 deletions(-)
+ 3 files changed, 54 insertions(+), 13 deletions(-)
 
 diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
-index 3fca3ce3e9..69254396d5 100644
+index 3c06734e6d..4481b60a5c 100644
 --- a/block/monitor/block-hmp-cmds.c
 +++ b/block/monitor/block-hmp-cmds.c
 @@ -1042,7 +1042,9 @@ void hmp_backup(Monitor *mon, const QDict *qdict)
@@ -34,7 +34,7 @@ index 3fca3ce3e9..69254396d5 100644
          false, NULL, false, NULL, !!devlist,
          devlist, qdict_haskey(qdict, "speed"), speed, &error);
 diff --git a/pve-backup.c b/pve-backup.c
-index 6cdbd40529..7527885251 100644
+index 1c49cd178d..c15abefdda 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
 @@ -8,6 +8,7 @@
@@ -67,17 +67,24 @@ index 6cdbd40529..7527885251 100644
      qemu_co_mutex_lock(&backup_state.dump_callback_mutex);
  
      // avoid deadlock if job is cancelled
-@@ -147,16 +152,28 @@ pvebackup_co_dump_pbs_cb(
+@@ -147,17 +152,29 @@ pvebackup_co_dump_pbs_cb(
          return -1;
      }
  
 -    pbs_res = proxmox_backup_co_write_data(backup_state.pbs, di->dev_id, buf, start, size, &local_err);
+-    qemu_co_mutex_unlock(&backup_state.dump_callback_mutex);
 +    uint64_t transferred = 0;
 +    uint64_t reused = 0;
 +    while (transferred < size) {
 +        uint64_t left = size - transferred;
 +        uint64_t to_transfer = left < di->block_size ? left : di->block_size;
-+
+ 
+-    if (pbs_res < 0) {
+-        pvebackup_propagate_error(local_err);
+-        return pbs_res;
+-    } else {
+-        size_t reused = (pbs_res == 0) ? size : 0;
+-        pvebackup_add_transfered_bytes(size, !buf ? size : 0, reused);
 +        pbs_res = proxmox_backup_co_write_data(backup_state.pbs, di->dev_id,
 +            is_zero_block ? NULL : buf + transferred, start + transferred,
 +            to_transfer, &local_err);
@@ -90,21 +97,14 @@ index 6cdbd40529..7527885251 100644
 +        }
 +
 +        reused += pbs_res == 0 ? to_transfer : 0;
-+    }
-+
-     qemu_co_mutex_unlock(&backup_state.dump_callback_mutex);
--
--    if (pbs_res < 0) {
--        pvebackup_propagate_error(local_err);
--        return pbs_res;
--    } else {
--        size_t reused = (pbs_res == 0) ? size : 0;
--        pvebackup_add_transfered_bytes(size, !buf ? size : 0, reused);
--    }
-+    pvebackup_add_transfered_bytes(size, is_zero_block ? size : 0, reused);
+     }
  
++    qemu_co_mutex_unlock(&backup_state.dump_callback_mutex);
++    pvebackup_add_transfered_bytes(size, is_zero_block ? size : 0, reused);
++
      return size;
  }
+ 
 @@ -178,6 +195,7 @@ pvebackup_co_dump_vma_cb(
      int ret = -1;
  
@@ -194,10 +194,10 @@ index 6cdbd40529..7527885251 100644
          .format = format,
          .has_config_file = has_config_file,
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index a138ad08d4..a75f1b4687 100644
+index b9d6f52f0c..5d8e2eb303 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -777,6 +777,10 @@
+@@ -822,6 +822,10 @@
  #
  # @use-dirty-bitmap: use dirty bitmap to detect incremental changes since last job (optional for format 'pbs')
  #
@@ -208,7 +208,7 @@ index a138ad08d4..a75f1b4687 100644
  # Returns: the uuid of the backup job
  #
  ##
-@@ -788,6 +792,8 @@
+@@ -833,6 +837,8 @@
                                      '*backup-id': 'str',
                                      '*backup-time': 'int',
                                      '*use-dirty-bitmap': 'bool',

debian/patches/pve/0032-PVE-Add-PBS-block-driver-to-map-backup-archives-into.patch

@@ -7,17 +7,19 @@ Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 [error cleanups, file_open implementation]
 Signed-off-by: Dietmar Maurer <dietmar@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+[adapt to changed function signatures]
+Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 ---
  block/meson.build    |   3 +
- block/pbs.c          | 271 +++++++++++++++++++++++++++++++++++++++++++
+ block/pbs.c          | 276 +++++++++++++++++++++++++++++++++++++++++++
  configure            |   9 ++
  meson.build          |   1 +
- qapi/block-core.json |  13 +++
- 5 files changed, 297 insertions(+)
+ qapi/block-core.json |  13 ++
+ 5 files changed, 302 insertions(+)
  create mode 100644 block/pbs.c
 
 diff --git a/block/meson.build b/block/meson.build
-index 9e433daf2e..e3ed5ac97c 100644
+index 9d3dd5b7c3..8c758c0218 100644
 --- a/block/meson.build
 +++ b/block/meson.build
 @@ -51,6 +51,9 @@ block_ss.add(files(
@@ -32,10 +34,10 @@ index 9e433daf2e..e3ed5ac97c 100644
  
 diff --git a/block/pbs.c b/block/pbs.c
 new file mode 100644
-index 0000000000..78dad0dcc4
+index 0000000000..0b05ea9080
 --- /dev/null
 +++ b/block/pbs.c
-@@ -0,0 +1,271 @@
+@@ -0,0 +1,276 @@
 +/*
 + * Proxmox Backup Server read-only block driver
 + */
@@ -232,20 +234,25 @@ index 0000000000..78dad0dcc4
 +}
 +
 +static coroutine_fn int pbs_co_preadv(BlockDriverState *bs,
-+                                      uint64_t offset, uint64_t bytes,
-+                                      QEMUIOVector *qiov, int flags)
++                                      int64_t offset, int64_t bytes,
++                                      QEMUIOVector *qiov, BdrvRequestFlags flags)
 +{
 +    BDRVPBSState *s = bs->opaque;
 +    int ret;
 +    char *pbs_error = NULL;
 +    uint8_t *buf = malloc(bytes);
 +
++    if (offset < 0 || bytes < 0) {
++        fprintf(stderr, "unexpected negative 'offset' or 'bytes' value!\n");
++        return -EINVAL;
++    }
++
 +    ReadCallbackData rcb = {
 +        .co = qemu_coroutine_self(),
 +        .ctx = bdrv_get_aio_context(bs),
 +    };
 +
-+    proxmox_restore_read_image_at_async(s->conn, s->aid, buf, offset, bytes,
++    proxmox_restore_read_image_at_async(s->conn, s->aid, buf, (uint64_t)offset, (uint64_t)bytes,
 +                                        read_callback, (void *) &rcb, &ret, &pbs_error);
 +
 +    qemu_coroutine_yield();
@@ -263,8 +270,8 @@ index 0000000000..78dad0dcc4
 +}
 +
 +static coroutine_fn int pbs_co_pwritev(BlockDriverState *bs,
-+                                       uint64_t offset, uint64_t bytes,
-+                                       QEMUIOVector *qiov, int flags)
++                                       int64_t offset, int64_t bytes,
++                                       QEMUIOVector *qiov, BdrvRequestFlags flags)
 +{
 +    fprintf(stderr, "pbs-bdrv: cannot write to backup file, make sure "
 +           "any attached disk devices are set to read-only!\n");
@@ -308,18 +315,18 @@ index 0000000000..78dad0dcc4
 +
 +block_init(bdrv_pbs_init);
 diff --git a/configure b/configure
-index 6e308ed77f..869e97c72f 100755
+index 48c21775f3..eda4e9225a 100755
 --- a/configure
 +++ b/configure
-@@ -428,6 +428,7 @@ vdi=${default_feature:-yes}
+@@ -356,6 +356,7 @@ vdi=${default_feature:-yes}
  vvfat=${default_feature:-yes}
  qed=${default_feature:-yes}
  parallels=${default_feature:-yes}
 +pbs_bdrv="yes"
- libxml2="auto"
  debug_mutex="no"
- libpmem="auto"
-@@ -1486,6 +1487,10 @@ for opt do
+ plugins="$default_feature"
+ rng_none="no"
+@@ -1126,6 +1127,10 @@ for opt do
    ;;
    --enable-parallels) parallels="yes"
    ;;
@@ -330,17 +337,17 @@ index 6e308ed77f..869e97c72f 100755
    --disable-vhost-user) vhost_user="no"
    ;;
    --enable-vhost-user) vhost_user="yes"
-@@ -1956,6 +1961,7 @@ disabled with --disable-FEATURE, default is enabled if available
+@@ -1465,6 +1470,7 @@ cat << EOF
    vvfat           vvfat image format support
    qed             qed image format support
    parallels       parallels image format support
 +  pbs-bdrv        Proxmox backup server read-only block driver support
    crypto-afalg    Linux AF_ALG crypto backend driver
-   capstone        capstone disassembler support
    debug-mutex     mutex debugging support
-@@ -4624,6 +4630,9 @@ fi
- if test "$linux_aio" = "yes" ; then
-   echo "CONFIG_LINUX_AIO=y" >> $config_host_mak
+   rng-none        dummy RNG, avoid using /dev/(u)random and getrandom()
+@@ -3534,6 +3540,9 @@ if test "$xen" = "enabled" ; then
+   echo "XEN_CFLAGS=$xen_cflags" >> $config_host_mak
+   echo "XEN_LIBS=$xen_libs" >> $config_host_mak
  fi
 +if test "$pbs_bdrv" = "yes" ; then
 +  echo "CONFIG_PBS_BDRV=y" >> $config_host_mak
@@ -349,30 +356,30 @@ index 6e308ed77f..869e97c72f 100755
    echo "CONFIG_VHOST_SCSI=y" >> $config_host_mak
  fi
 diff --git a/meson.build b/meson.build
-index dd1c5bdb4e..45c1f2de73 100644
+index 1a4dfab4e2..85b3c63199 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -3111,6 +3111,7 @@ summary_info += {'lzfse support':     liblzfse.found()}
- summary_info += {'zstd support':      zstd.found()}
+@@ -3448,6 +3448,7 @@ summary_info += {'lzfse support':     liblzfse}
+ summary_info += {'zstd support':      zstd}
  summary_info += {'NUMA host support': config_host.has_key('CONFIG_NUMA')}
- summary_info += {'libxml2':           libxml2.found()}
+ summary_info += {'libxml2':           libxml2}
 +summary_info += {'PBS bdrv support':  config_host.has_key('CONFIG_PBS_BDRV')}
- summary_info += {'capstone':          capstone_opt == 'disabled' ? false : capstone_opt}
- summary_info += {'libpmem support':   libpmem.found()}
- summary_info += {'libdaxctl support': libdaxctl.found()}
+ summary_info += {'capstone':          capstone_opt == 'internal' ? capstone_opt : capstone}
+ summary_info += {'libpmem support':   libpmem}
+ summary_info += {'libdaxctl support': libdaxctl}
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index a75f1b4687..e4d0c923a4 100644
+index 5d8e2eb303..777863e33b 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -2982,6 +2982,7 @@
+@@ -3053,6 +3053,7 @@
              'luks', 'nbd', 'nfs', 'null-aio', 'null-co', 'nvme', 'parallels',
              'preallocate', 'qcow', 'qcow2', 'qed', 'quorum', 'raw', 'rbd',
-             { 'name': 'replication', 'if': 'defined(CONFIG_REPLICATION)' },
+             { 'name': 'replication', 'if': 'CONFIG_REPLICATION' },
 +            'pbs',
              'ssh', 'throttle', 'vdi', 'vhdx', 'vmdk', 'vpc', 'vvfat' ] }
  
  ##
-@@ -3045,6 +3046,17 @@
+@@ -3125,6 +3126,17 @@
  { 'struct': 'BlockdevOptionsNull',
    'data': { '*size': 'int', '*latency-ns': 'uint64', '*read-zeroes': 'bool' } }
  
@@ -390,7 +397,7 @@ index a75f1b4687..e4d0c923a4 100644
  ##
  # @BlockdevOptionsNVMe:
  #
-@@ -4263,6 +4275,7 @@
+@@ -4367,6 +4379,7 @@
        'nfs':        'BlockdevOptionsNfs',
        'null-aio':   'BlockdevOptionsNull',
        'null-co':    'BlockdevOptionsNull',

debian/patches/pve/0033-PVE-add-query_proxmox_support-QMP-command.patch

@@ -16,7 +16,7 @@ Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
  2 files changed, 38 insertions(+)
 
 diff --git a/pve-backup.c b/pve-backup.c
-index 7527885251..8cba8e97d3 100644
+index c15abefdda..4684789813 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
 @@ -1075,3 +1075,12 @@ BackupStatus *qmp_query_backup(Error **errp)
@@ -33,10 +33,10 @@ index 7527885251..8cba8e97d3 100644
 +    return ret;
 +}
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index e4d0c923a4..3eebe7ff71 100644
+index 777863e33b..cfd980b70f 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -822,6 +822,35 @@
+@@ -867,6 +867,35 @@
  ##
  { 'command': 'backup-cancel' }
  

debian/patches/pve/0034-PVE-add-query-pbs-bitmap-info-QMP-call.patch

@@ -15,7 +15,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  3 files changed, 159 insertions(+), 42 deletions(-)
 
 diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
-index b2b5f1298b..7a449edafa 100644
+index cfd7a60f32..b613190a3c 100644
 --- a/monitor/hmp-cmds.c
 +++ b/monitor/hmp-cmds.c
 @@ -198,6 +198,7 @@ void hmp_info_mice(Monitor *mon, const QDict *qdict)
@@ -69,7 +69,7 @@ index b2b5f1298b..7a449edafa 100644
                             info->zero_bytes, zero_per);
  
 diff --git a/pve-backup.c b/pve-backup.c
-index 8cba8e97d3..22420db26a 100644
+index 4684789813..f90abaa50a 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
 @@ -46,6 +46,7 @@ static struct PVEBackupState {
@@ -359,10 +359,10 @@ index 8cba8e97d3..22420db26a 100644
      return ret;
  }
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 3eebe7ff71..170c13984d 100644
+index cfd980b70f..8833060385 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -830,6 +830,8 @@
+@@ -875,6 +875,8 @@
  # @pbs-dirty-bitmap: True if dirty-bitmap-incremental backups to PBS are
  #                    supported.
  #
@@ -371,7 +371,7 @@ index 3eebe7ff71..170c13984d 100644
  # @pbs-dirty-bitmap-savevm: True if 'dirty-bitmaps' migration capability can
  #                           safely be set for savevm-async.
  #
-@@ -838,6 +840,7 @@
+@@ -883,6 +885,7 @@
  ##
  { 'struct': 'ProxmoxSupportStatus',
    'data': { 'pbs-dirty-bitmap': 'bool',
@@ -379,7 +379,7 @@ index 3eebe7ff71..170c13984d 100644
              'pbs-dirty-bitmap-savevm': 'bool',
              'pbs-library-version': 'str' } }
  
-@@ -851,6 +854,59 @@
+@@ -896,6 +899,59 @@
  ##
  { 'command': 'query-proxmox-support', 'returns': 'ProxmoxSupportStatus' }
  

debian/patches/pve/0035-PVE-redirect-stderr-to-journal-when-daemonized.patch

@@ -14,18 +14,18 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  2 files changed, 7 insertions(+), 2 deletions(-)
 
 diff --git a/meson.build b/meson.build
-index 45c1f2de73..44071acbb7 100644
+index 85b3c63199..31ba7d70d6 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -1065,6 +1065,7 @@ keyutils = dependency('libkeyutils', required: false,
+@@ -1203,6 +1203,7 @@ keyutils = dependency('libkeyutils', required: false,
  has_gettid = cc.has_function('gettid')
  
  libuuid = cc.find_library('uuid', required: true)
 +libsystemd = cc.find_library('systemd', required: true)
  libproxmox_backup_qemu = cc.find_library('proxmox_backup_qemu', required: true)
  
- # Malloc tests
-@@ -2246,6 +2247,7 @@ if have_block
+ # libselinux
+@@ -2571,6 +2572,7 @@ if have_block
    # os-posix.c contains POSIX-specific functions used by qemu-storage-daemon,
    # os-win32.c does not
    blockdev_ss.add(when: 'CONFIG_POSIX', if_true: files('os-posix.c'))

debian/patches/pve/0036-PVE-Add-sequential-job-transaction-support.patch

@@ -11,10 +11,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  2 files changed, 43 insertions(+)
 
 diff --git a/include/qemu/job.h b/include/qemu/job.h
-index 41162ed494..6662c63519 100644
+index 6e67b6977f..60376c99ee 100644
 --- a/include/qemu/job.h
 +++ b/include/qemu/job.h
-@@ -285,6 +285,18 @@ typedef enum JobCreateFlags {
+@@ -294,6 +294,18 @@ typedef enum JobCreateFlags {
   */
  JobTxn *job_txn_new(void);
  
@@ -34,7 +34,7 @@ index 41162ed494..6662c63519 100644
   * Release a reference that was previously acquired with job_txn_add_job or
   * job_txn_new. If it's the last reference to the object, it will be freed.
 diff --git a/job.c b/job.c
-index 44eec9a441..a0753ff2f1 100644
+index af25dd5b98..d0d152e697 100644
 --- a/job.c
 +++ b/job.c
 @@ -72,6 +72,8 @@ struct JobTxn {
@@ -72,7 +72,7 @@ index 44eec9a441..a0753ff2f1 100644
  static void job_txn_ref(JobTxn *txn)
  {
      txn->refcnt++;
-@@ -850,6 +871,9 @@ static void job_completed_txn_success(Job *job)
+@@ -888,6 +909,9 @@ static void job_completed_txn_success(Job *job)
       */
      QLIST_FOREACH(other_job, &txn->jobs, txn_list) {
          if (!job_is_completed(other_job)) {
@@ -82,7 +82,7 @@ index 44eec9a441..a0753ff2f1 100644
              return;
          }
          assert(other_job->ret == 0);
-@@ -1020,6 +1044,13 @@ int job_finish_sync(Job *job, void (*finish)(Job *, Error **errp), Error **errp)
+@@ -1082,6 +1106,13 @@ int job_finish_sync(Job *job, void (*finish)(Job *, Error **errp), Error **errp)
          return -EBUSY;
      }
  

debian/patches/pve/0037-PVE-Backup-Use-a-transaction-to-synchronize-job-stat.patch

@@ -12,12 +12,14 @@ transaction, so drives will still be backed up one after the other.
 
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+[add new force parameter to job_cancel_sync calls]
+Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 ---
- pve-backup.c | 169 +++++++++++++++------------------------------------
- 1 file changed, 50 insertions(+), 119 deletions(-)
+ pve-backup.c | 167 +++++++++++++++------------------------------------
+ 1 file changed, 49 insertions(+), 118 deletions(-)
 
 diff --git a/pve-backup.c b/pve-backup.c
-index 22420db26a..2e628d68e4 100644
+index f90abaa50a..63c686463f 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
 @@ -52,6 +52,7 @@ static struct PVEBackupState {
@@ -121,22 +123,8 @@ index 22420db26a..2e628d68e4 100644
          proxmox_backup_abort(backup_state.pbs, "backup canceled");
      }
  
-+    /* it's enough to cancel one job in the transaction, the rest will follow
-+     * automatically */
-+    GList *bdi = g_list_first(backup_state.di_list);
-+    BlockJob *cancel_job = bdi && bdi->data ?
-+        ((PVEBackupDevInfo *)bdi->data)->job :
-+        NULL;
-+
-+    /* ref the job before releasing the mutex, just to be safe */
-+    if (cancel_job) {
-+        job_ref(&cancel_job->job);
-+    }
-+
-+    /* job_cancel_sync may enter the job, so we need to release the
-+     * backup_mutex to avoid deadlock */
-     qemu_mutex_unlock(&backup_state.backup_mutex);
- 
+-    qemu_mutex_unlock(&backup_state.backup_mutex);
+-
 -    for(;;) {
 -
 -        BlockJob *next_job = NULL;
@@ -147,20 +135,33 @@ index 22420db26a..2e628d68e4 100644
 -        while (l) {
 -            PVEBackupDevInfo *di = (PVEBackupDevInfo *)l->data;
 -            l = g_list_next(l);
--
++    /* it's enough to cancel one job in the transaction, the rest will follow
++     * automatically */
++    GList *bdi = g_list_first(backup_state.di_list);
++    BlockJob *cancel_job = bdi && bdi->data ?
++        ((PVEBackupDevInfo *)bdi->data)->job :
++        NULL;
+ 
 -            BlockJob *job = lookup_active_block_job(di);
 -            if (job != NULL) {
 -                next_job = job;
 -                break;
 -            }
 -        }
--
++    /* ref the job before releasing the mutex, just to be safe */
++    if (cancel_job) {
++        job_ref(&cancel_job->job);
++    }
+ 
 -        qemu_mutex_unlock(&backup_state.backup_mutex);
--
++    /* job_cancel_sync may enter the job, so we need to release the
++     * backup_mutex to avoid deadlock */
++    qemu_mutex_unlock(&backup_state.backup_mutex);
+ 
 -        if (next_job) {
 -            AioContext *aio_context = next_job->job.aio_context;
 -            aio_context_acquire(aio_context);
--            job_cancel_sync(&next_job->job);
+-            job_cancel_sync(&next_job->job, true);
 -            aio_context_release(aio_context);
 -        } else {
 -            break;
@@ -168,7 +169,7 @@ index 22420db26a..2e628d68e4 100644
 +    if (cancel_job) {
 +        AioContext *aio_context = cancel_job->job.aio_context;
 +        aio_context_acquire(aio_context);
-+        job_cancel_sync(&cancel_job->job);
++        job_cancel_sync(&cancel_job->job, true);
 +        job_unref(&cancel_job->job);
 +        aio_context_release(aio_context);
      }
@@ -202,7 +203,7 @@ index 22420db26a..2e628d68e4 100644
 -            if (job_should_pause(&job->job)) {
 -                bool error_or_canceled = pvebackup_error_or_canceled();
 -                if (error_or_canceled) {
--                    job_cancel_sync(&job->job);
+-                    job_cancel_sync(&job->job, true);
 -                } else {
 -                    job_resume(&job->job);
 -                }

debian/patches/pve/0038-PVE-Backup-Don-t-block-on-finishing-and-cleanup-crea.patch

@@ -49,13 +49,15 @@ before.
 
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+[add new force parameter to job_cancel_sync calls]
+Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 ---
  pve-backup.c         | 217 ++++++++++++++++++++++++++++---------------
  qapi/block-core.json |   5 +-
  2 files changed, 144 insertions(+), 78 deletions(-)
 
 diff --git a/pve-backup.c b/pve-backup.c
-index 2e628d68e4..9c20ef3a5e 100644
+index 63c686463f..6f05796fad 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
 @@ -33,7 +33,9 @@ const char *PBS_BITMAP_NAME = "pbs-incremental-dirty-bitmap";
@@ -208,7 +210,7 @@ index 2e628d68e4..9c20ef3a5e 100644
 -    assert(!qemu_in_coroutine());
 +    PVEBackupDevInfo *di = opaque;
 +    di->completed_ret = ret;
- 
++
 +    /*
 +     * Schedule stream cleanup in async coroutine. close_image and finish might
 +     * take a while, so we can't block on them here. This way it also doesn't
@@ -229,11 +231,11 @@ index 2e628d68e4..9c20ef3a5e 100644
 +    Job *job = (Job*)data->data;
 +    AioContext *job_ctx = job->aio_context;
 +    aio_context_acquire(job_ctx);
-+    job_cancel_sync(job);
++    job_cancel_sync(job, true);
 +    aio_context_release(job_ctx);
 +    aio_co_enter(data->ctx, data->co);
 +}
-+
+ 
 +static void coroutine_fn pvebackup_co_cancel(void *opaque)
 +{
      Error *cancel_err = NULL;
@@ -268,7 +270,7 @@ index 2e628d68e4..9c20ef3a5e 100644
 -    if (cancel_job) {
 -        AioContext *aio_context = cancel_job->job.aio_context;
 -        aio_context_acquire(aio_context);
--        job_cancel_sync(&cancel_job->job);
+-        job_cancel_sync(&cancel_job->job, true);
 -        job_unref(&cancel_job->job);
 -        aio_context_release(aio_context);
 -    }
@@ -309,13 +311,13 @@ index 2e628d68e4..9c20ef3a5e 100644
 -        if (!job || local_err != NULL) {
 -            Error *create_job_err = NULL;
 -            error_setg(&create_job_err, "backup_job_create failed: %s",
+-                       local_err ? error_get_pretty(local_err) : "null");
 +        di->job = job;
-+
+ 
+-            pvebackup_propagate_error(create_job_err);
 +        if (!job || local_err) {
 +            error_setg(errp, "backup_job_create failed: %s",
-                        local_err ? error_get_pretty(local_err) : "null");
--
--            pvebackup_propagate_error(create_job_err);
++                       local_err ? error_get_pretty(local_err) : "null");
              break;
          }
  
@@ -338,7 +340,7 @@ index 2e628d68e4..9c20ef3a5e 100644
              if (di->job) {
 +                AioContext *ctx = di->job->job.aio_context;
 +                aio_context_acquire(ctx);
-+                job_cancel_sync(&di->job->job);
++                job_cancel_sync(&di->job->job, true);
                  job_unref(&di->job->job);
 +                aio_context_release(ctx);
              }
@@ -479,10 +481,10 @@ index 2e628d68e4..9c20ef3a5e 100644
      qemu_mutex_unlock(&backup_state.stat.lock);
  
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 170c13984d..a0d1d278e9 100644
+index 8833060385..6a67adf923 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -729,12 +729,15 @@
+@@ -774,12 +774,15 @@
  #
  # @uuid: uuid for this backup job
  #

debian/patches/pve/0039-PVE-Migrate-dirty-bitmap-state-via-savevm.patch

@@ -51,17 +51,17 @@ index ea9aedeefc..c27dc9bd97 100644
  softmmu_ss.add(files(
    'block-dirty-bitmap.c',
 diff --git a/migration/migration.c b/migration/migration.c
-index 041b8451a6..9df2eed75e 100644
+index abaf6f9e3d..d925fd7488 100644
 --- a/migration/migration.c
 +++ b/migration/migration.c
-@@ -218,6 +218,7 @@ void migration_object_init(void)
+@@ -213,6 +213,7 @@ void migration_object_init(void)
      blk_mig_init();
      ram_mig_init();
      dirty_bitmap_mig_init();
 +    pbs_state_mig_init();
  }
  
- void migration_cancel(void)
+ void migration_cancel(const Error *error)
 diff --git a/migration/pbs-state.c b/migration/pbs-state.c
 new file mode 100644
 index 0000000000..29f2b3860d
@@ -175,7 +175,7 @@ index 0000000000..29f2b3860d
 +                         NULL);
 +}
 diff --git a/pve-backup.c b/pve-backup.c
-index 9c20ef3a5e..59ccb38ceb 100644
+index 6f05796fad..5fa3cc1352 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
 @@ -1132,6 +1132,7 @@ ProxmoxSupportStatus *qmp_query_proxmox_support(Error **errp)
@@ -187,10 +187,10 @@ index 9c20ef3a5e..59ccb38ceb 100644
      return ret;
  }
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index a0d1d278e9..e5de769dc1 100644
+index 6a67adf923..c99ddf8628 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -838,6 +838,11 @@
+@@ -883,6 +883,11 @@
  # @pbs-dirty-bitmap-savevm: True if 'dirty-bitmaps' migration capability can
  #                           safely be set for savevm-async.
  #
@@ -202,7 +202,7 @@ index a0d1d278e9..e5de769dc1 100644
  # @pbs-library-version: Running version of libproxmox-backup-qemu0 library.
  #
  ##
-@@ -845,6 +850,7 @@
+@@ -890,6 +895,7 @@
    'data': { 'pbs-dirty-bitmap': 'bool',
              'query-bitmap-info': 'bool',
              'pbs-dirty-bitmap-savevm': 'bool',

debian/patches/pve/0040-migration-block-dirty-bitmap-migrate-other-bitmaps-e.patch

@@ -19,7 +19,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/migration/block-dirty-bitmap.c b/migration/block-dirty-bitmap.c
-index 35f5ef688d..c4640925e7 100644
+index 9aba7d9c22..f4ecf9c9f9 100644
 --- a/migration/block-dirty-bitmap.c
 +++ b/migration/block-dirty-bitmap.c
 @@ -538,7 +538,7 @@ static int add_bitmaps_to_list(DBMSaveState *s, BlockDriverState *bs,

debian/patches/pve/0041-PVE-fall-back-to-open-iscsi-initiatorname.patch

@@ -21,10 +21,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 30 insertions(+)
 
 diff --git a/block/iscsi.c b/block/iscsi.c
-index 4d2a416ce7..c345d30812 100644
+index 57aa07a40d..a8902b84d5 100644
 --- a/block/iscsi.c
 +++ b/block/iscsi.c
-@@ -1372,12 +1372,42 @@ static char *get_initiator_name(QemuOpts *opts)
+@@ -1386,12 +1386,42 @@ static char *get_initiator_name(QemuOpts *opts)
      const char *name;
      char *iscsi_name;
      UuidInfo *uuid_info;

debian/patches/pve/0042-PVE-Use-coroutine-QMP-for-backup-cancel_backup.patch

@@ -32,7 +32,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  5 files changed, 77 insertions(+), 196 deletions(-)
 
 diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
-index 69254396d5..b838586fc0 100644
+index 4481b60a5c..c9849a5b29 100644
 --- a/block/monitor/block-hmp-cmds.c
 +++ b/block/monitor/block-hmp-cmds.c
 @@ -1016,7 +1016,7 @@ void hmp_info_snapshots(Monitor *mon, const QDict *qdict)
@@ -54,7 +54,7 @@ index 69254396d5..b838586fc0 100644
      Error *error = NULL;
  
 diff --git a/hmp-commands.hx b/hmp-commands.hx
-index 7faba36b39..dca4e58858 100644
+index d4bb00216e..4e21911fa6 100644
 --- a/hmp-commands.hx
 +++ b/hmp-commands.hx
 @@ -109,6 +109,7 @@ ERST
@@ -116,7 +116,7 @@ index 4ce7bc0b5e..0923037dec 100644
  static void proxmox_backup_schedule_wake(void *data) {
      CoCtxData *waker = (CoCtxData *)data;
 diff --git a/pve-backup.c b/pve-backup.c
-index 59ccb38ceb..f858003a06 100644
+index 5fa3cc1352..323014744c 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
 @@ -357,7 +357,7 @@ static void job_cancel_bh(void *opaque) {
@@ -575,10 +575,10 @@ index 59ccb38ceb..f858003a06 100644
  
  BackupStatus *qmp_query_backup(Error **errp)
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index e5de769dc1..afa67c28d2 100644
+index c99ddf8628..829dc7b8e9 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -801,7 +801,7 @@
+@@ -846,7 +846,7 @@
                                      '*config-file': 'str',
                                      '*firewall-file': 'str',
                                      '*devlist': 'str', '*speed': 'int' },
@@ -587,7 +587,7 @@ index e5de769dc1..afa67c28d2 100644
  
  ##
  # @query-backup:
-@@ -823,7 +823,7 @@
+@@ -868,7 +868,7 @@
  # Notes: This command succeeds even if there is no backup process running.
  #
  ##

debian/patches/pve/0043-PBS-add-master-key-support.patch

@@ -19,7 +19,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  3 files changed, 11 insertions(+)
 
 diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
-index b838586fc0..5b52b93232 100644
+index c9849a5b29..52ddbf95ad 100644
 --- a/block/monitor/block-hmp-cmds.c
 +++ b/block/monitor/block-hmp-cmds.c
 @@ -1039,6 +1039,7 @@ void coroutine_fn hmp_backup(Monitor *mon, const QDict *qdict)
@@ -31,7 +31,7 @@ index b838586fc0..5b52b93232 100644
          false, NULL, // PBS backup-id
          false, 0, // PBS backup-time
 diff --git a/pve-backup.c b/pve-backup.c
-index f858003a06..04ebfc1e33 100644
+index 323014744c..9f6c04a512 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
 @@ -533,6 +533,7 @@ UuidInfo coroutine_fn *qmp_backup(
@@ -58,10 +58,10 @@ index f858003a06..04ebfc1e33 100644
      return ret;
  }
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index afa67c28d2..84e4406d21 100644
+index 829dc7b8e9..d089328a1f 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -772,6 +772,8 @@
+@@ -817,6 +817,8 @@
  #
  # @key-password: password for keyfile (optional for format 'pbs')
  #
@@ -70,7 +70,7 @@ index afa67c28d2..84e4406d21 100644
  # @fingerprint: server cert fingerprint (optional for format 'pbs')
  #
  # @backup-id: backup ID (required for format 'pbs')
-@@ -791,6 +793,7 @@
+@@ -836,6 +838,7 @@
                                      '*password': 'str',
                                      '*keyfile': 'str',
                                      '*key-password': 'str',
@@ -78,7 +78,7 @@ index afa67c28d2..84e4406d21 100644
                                      '*fingerprint': 'str',
                                      '*backup-id': 'str',
                                      '*backup-time': 'int',
-@@ -843,6 +846,9 @@
+@@ -888,6 +891,9 @@
  #                              migration cap if this is false/unset may lead
  #                              to crashes on migration!
  #
@@ -88,7 +88,7 @@ index afa67c28d2..84e4406d21 100644
  # @pbs-library-version: Running version of libproxmox-backup-qemu0 library.
  #
  ##
-@@ -851,6 +857,7 @@
+@@ -896,6 +902,7 @@
              'query-bitmap-info': 'bool',
              'pbs-dirty-bitmap-savevm': 'bool',
              'pbs-dirty-bitmap-migration': 'bool',

debian/patches/pve/0044-PVE-block-pbs-fast-path-reads-without-allocation-if-.patch

@@ -17,7 +17,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 14 insertions(+), 3 deletions(-)
 
 diff --git a/block/pbs.c b/block/pbs.c
-index 78dad0dcc4..ac54e816c0 100644
+index 0b05ea9080..c5eb4d5bad 100644
 --- a/block/pbs.c
 +++ b/block/pbs.c
 @@ -200,7 +200,16 @@ static coroutine_fn int pbs_co_preadv(BlockDriverState *bs,
@@ -36,9 +36,9 @@ index 78dad0dcc4..ac54e816c0 100644
 +        buf = g_malloc(bytes);
 +    }
  
-     ReadCallbackData rcb = {
-         .co = qemu_coroutine_self(),
-@@ -218,8 +227,10 @@ static coroutine_fn int pbs_co_preadv(BlockDriverState *bs,
+     if (offset < 0 || bytes < 0) {
+         fprintf(stderr, "unexpected negative 'offset' or 'bytes' value!\n");
+@@ -223,8 +232,10 @@ static coroutine_fn int pbs_co_preadv(BlockDriverState *bs,
          return -EIO;
      }
  

debian/patches/pve/0045-PVE-block-stream-increase-chunk-size.patch

@@ -11,7 +11,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/block/stream.c b/block/stream.c
-index 97bee482dc..50093c9f57 100644
+index e45113aed6..c3c0c5febe 100644
 --- a/block/stream.c
 +++ b/block/stream.c
 @@ -28,7 +28,7 @@ enum {

debian/patches/pve/0046-block-io-accept-NULL-qiov-in-bdrv_pad_request.patch

@@ -17,10 +17,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 4 insertions(+)
 
 diff --git a/block/io.c b/block/io.c
-index f38e7f81d8..28c3a712b6 100644
+index 4e4cb556c5..04061f1e68 100644
 --- a/block/io.c
 +++ b/block/io.c
-@@ -1764,6 +1764,10 @@ static int bdrv_pad_request(BlockDriverState *bs,
+@@ -1765,6 +1765,10 @@ static int bdrv_pad_request(BlockDriverState *bs,
  {
      int ret;
  

debian/patches/pve/0047-block-add-alloc-track-driver.patch

@@ -24,18 +24,20 @@ once the backing image is removed. It will be replaced by 'file'.
 
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+[adapt to changed function signatures]
+Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 ---
- block/alloc-track.c | 345 ++++++++++++++++++++++++++++++++++++++++++++
+ block/alloc-track.c | 350 ++++++++++++++++++++++++++++++++++++++++++++
  block/meson.build   |   1 +
- 2 files changed, 346 insertions(+)
+ 2 files changed, 351 insertions(+)
  create mode 100644 block/alloc-track.c
 
 diff --git a/block/alloc-track.c b/block/alloc-track.c
 new file mode 100644
-index 0000000000..35f2737c89
+index 0000000000..6b50fbe537
 --- /dev/null
 +++ b/block/alloc-track.c
-@@ -0,0 +1,345 @@
+@@ -0,0 +1,350 @@
 +/*
 + * Node to allow backing images to be applied to any node. Assumes a blank
 + * image to begin with, only new writes are tracked as allocated, thus this
@@ -166,7 +168,7 @@ index 0000000000..35f2737c89
 +}
 +
 +static int coroutine_fn track_co_preadv(BlockDriverState *bs,
-+    uint64_t offset, uint64_t bytes, QEMUIOVector *qiov, int flags)
++    int64_t offset, int64_t bytes, QEMUIOVector *qiov, BdrvRequestFlags flags)
 +{
 +    BDRVAllocTrackState *s = bs->opaque;
 +    QEMUIOVector local_qiov;
@@ -177,6 +179,11 @@ index 0000000000..35f2737c89
 +    int64_t local_bytes;
 +    bool alloc;
 +
++    if (offset < 0 || bytes < 0) {
++        fprintf(stderr, "unexpected negative 'offset' or 'bytes' value!\n");
++        return -EINVAL;
++    }
++
 +    /* a read request can span multiple granularity-sized chunks, and can thus
 +     * contain blocks with different allocation status - we could just iterate
 +     * granularity-wise, but for better performance use bdrv_dirty_bitmap_next_X
@@ -219,21 +226,21 @@ index 0000000000..35f2737c89
 +}
 +
 +static int coroutine_fn track_co_pwritev(BlockDriverState *bs,
-+    uint64_t offset, uint64_t bytes, QEMUIOVector *qiov, int flags)
++    int64_t offset, int64_t bytes, QEMUIOVector *qiov, BdrvRequestFlags flags)
 +{
 +    return bdrv_co_pwritev(bs->file, offset, bytes, qiov, flags);
 +}
 +
 +static int coroutine_fn track_co_pwrite_zeroes(BlockDriverState *bs,
-+    int64_t offset, int count, BdrvRequestFlags flags)
++    int64_t offset, int64_t bytes, BdrvRequestFlags flags)
 +{
-+    return bdrv_co_pwrite_zeroes(bs->file, offset, count, flags);
++    return bdrv_co_pwrite_zeroes(bs->file, offset, bytes, flags);
 +}
 +
 +static int coroutine_fn track_co_pdiscard(BlockDriverState *bs,
-+    int64_t offset, int count)
++    int64_t offset, int64_t bytes)
 +{
-+    return bdrv_co_pdiscard(bs->file, offset, count);
++    return bdrv_co_pdiscard(bs->file, offset, bytes);
 +}
 +
 +static coroutine_fn int track_co_flush(BlockDriverState *bs)
@@ -382,7 +389,7 @@ index 0000000000..35f2737c89
 +
 +block_init(bdrv_alloc_track_init);
 diff --git a/block/meson.build b/block/meson.build
-index e3ed5ac97c..d1ee260048 100644
+index 8c758c0218..45b72e10f1 100644
 --- a/block/meson.build
 +++ b/block/meson.build
 @@ -2,6 +2,7 @@ block_ss.add(genh)

debian/patches/pve/0050-qemu-img-dd-add-l-option-for-loading-a-snapshot.patch

@@ -0,0 +1,130 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Fabian Ebner <f.ebner@proxmox.com>
+Date: Mon, 7 Feb 2022 14:21:01 +0100
+Subject: [PATCH] qemu-img: dd: add -l option for loading a snapshot
+
+Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+---
+ docs/tools/qemu-img.rst |  6 +++---
+ qemu-img-cmds.hx        |  4 ++--
+ qemu-img.c              | 33 +++++++++++++++++++++++++++++++--
+ 3 files changed, 36 insertions(+), 7 deletions(-)
+
+diff --git a/docs/tools/qemu-img.rst b/docs/tools/qemu-img.rst
+index a49badb158..1039aec01c 100644
+--- a/docs/tools/qemu-img.rst
++++ b/docs/tools/qemu-img.rst
+@@ -492,10 +492,10 @@ Command description:
+   it doesn't need to be specified separately in this case.
+ 
+ 
+-.. option:: dd [--image-opts] [-U] [-f FMT] [-O OUTPUT_FMT] [-n] [bs=BLOCK_SIZE] [count=BLOCKS] [skip=BLOCKS] if=INPUT of=OUTPUT
++.. option:: dd [--image-opts] [-U] [-f FMT] [-O OUTPUT_FMT] [-n] [-l SNAPSHOT_PARAM] [bs=BLOCK_SIZE] [count=BLOCKS] [skip=BLOCKS] if=INPUT of=OUTPUT
+ 
+-  dd copies from *INPUT* file to *OUTPUT* file converting it from
+-  *FMT* format to *OUTPUT_FMT* format.
++  dd copies from *INPUT* file or snapshot *SNAPSHOT_PARAM* to *OUTPUT* file
++  converting it from *FMT* format to *OUTPUT_FMT* format.
+ 
+   The data is by default read and written using blocks of 512 bytes but can be
+   modified by specifying *BLOCK_SIZE*. If count=\ *BLOCKS* is specified
+diff --git a/qemu-img-cmds.hx b/qemu-img-cmds.hx
+index f3b2b1b4de..e77ed9347f 100644
+--- a/qemu-img-cmds.hx
++++ b/qemu-img-cmds.hx
+@@ -58,9 +58,9 @@ SRST
+ ERST
+ 
+ DEF("dd", img_dd,
+-    "dd [--image-opts] [-U] [-f fmt] [-O output_fmt] [-n] [bs=block_size] [count=blocks] [skip=blocks] [osize=output_size] if=input of=output")
++    "dd [--image-opts] [-U] [-f fmt] [-O output_fmt] [-n] [-l snapshot_param] [bs=block_size] [count=blocks] [skip=blocks] [osize=output_size] if=input of=output")
+ SRST
+-.. option:: dd [--image-opts] [-U] [-f FMT] [-O OUTPUT_FMT] [-n] [bs=BLOCK_SIZE] [count=BLOCKS] [skip=BLOCKS] [osize=OUTPUT_SIZE] if=INPUT of=OUTPUT
++.. option:: dd [--image-opts] [-U] [-f FMT] [-O OUTPUT_FMT] [-n] [-l SNAPSHOT_PARAM] [bs=BLOCK_SIZE] [count=BLOCKS] [skip=BLOCKS] [osize=OUTPUT_SIZE] if=INPUT of=OUTPUT
+ ERST
+ 
+ DEF("info", img_info,
+diff --git a/qemu-img.c b/qemu-img.c
+index 015d6d2ce4..7031195e32 100644
+--- a/qemu-img.c
++++ b/qemu-img.c
+@@ -4922,6 +4922,7 @@ static int img_dd(int argc, char **argv)
+     BlockDriver *drv = NULL, *proto_drv = NULL;
+     BlockBackend *blk1 = NULL, *blk2 = NULL;
+     QemuOpts *opts = NULL;
++    QemuOpts *sn_opts = NULL;
+     QemuOptsList *create_opts = NULL;
+     Error *local_err = NULL;
+     bool image_opts = false;
+@@ -4931,6 +4932,7 @@ static int img_dd(int argc, char **argv)
+     int64_t size = 0, readsize = 0;
+     int64_t block_count = 0, out_pos, in_pos;
+     bool force_share = false, skip_create = false;
++    const char *snapshot_name = NULL;
+     struct DdInfo dd = {
+         .flags = 0,
+         .count = 0,
+@@ -4968,7 +4970,7 @@ static int img_dd(int argc, char **argv)
+         { 0, 0, 0, 0 }
+     };
+ 
+-    while ((c = getopt_long(argc, argv, ":hf:O:Un", long_options, NULL))) {
++    while ((c = getopt_long(argc, argv, ":hf:O:l:Un", long_options, NULL))) {
+         if (c == EOF) {
+             break;
+         }
+@@ -4991,6 +4993,19 @@ static int img_dd(int argc, char **argv)
+         case 'n':
+             skip_create = true;
+             break;
++        case 'l':
++            if (strstart(optarg, SNAPSHOT_OPT_BASE, NULL)) {
++                sn_opts = qemu_opts_parse_noisily(&internal_snapshot_opts,
++                                                  optarg, false);
++                if (!sn_opts) {
++                    error_report("Failed in parsing snapshot param '%s'",
++                                 optarg);
++                    goto out;
++                }
++            } else {
++                snapshot_name = optarg;
++            }
++            break;
+         case 'U':
+             force_share = true;
+             break;
+@@ -5050,11 +5065,24 @@ static int img_dd(int argc, char **argv)
+     if (dd.flags & C_IF) {
+         blk1 = img_open(image_opts, in.filename, fmt, 0, false, false,
+                         force_share);
+-
+         if (!blk1) {
+             ret = -1;
+             goto out;
+         }
++        if (sn_opts) {
++            bdrv_snapshot_load_tmp(blk_bs(blk1),
++                                   qemu_opt_get(sn_opts, SNAPSHOT_OPT_ID),
++                                   qemu_opt_get(sn_opts, SNAPSHOT_OPT_NAME),
++                                   &local_err);
++        } else if (snapshot_name != NULL) {
++            bdrv_snapshot_load_tmp_by_id_or_name(blk_bs(blk1), snapshot_name,
++                                                 &local_err);
++        }
++        if (local_err) {
++            error_reportf_err(local_err, "Failed to load snapshot: ");
++            ret = -1;
++            goto out;
++        }
+     }
+ 
+     if (dd.flags & C_OSIZE) {
+@@ -5203,6 +5231,7 @@ static int img_dd(int argc, char **argv)
+ out:
+     g_free(arg);
+     qemu_opts_del(opts);
++    qemu_opts_del(sn_opts);
+     qemu_opts_free(create_opts);
+     blk_unref(blk1);
+     blk_unref(blk2);

debian/patches/pve/0051-vma-allow-partial-restore.patch

@@ -0,0 +1,407 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Fabian Ebner <f.ebner@proxmox.com>
+Date: Thu, 21 Apr 2022 13:26:48 +0200
+Subject: [PATCH] vma: allow partial restore
+
+Introduce a new map line for skipping a certain drive, of the form
+skip=drive-scsi0
+
+Since in PVE, most archives are compressed and piped to vma for
+restore, it's not easily possible to skip reads.
+
+For the reader, a new skip flag for VmaRestoreState is added and the
+target is allowed to be NULL if skip is specified when registering. If
+the skip flag is set, no writes will be made as well as no check for
+duplicate clusters. Therefore, the flag is not set for verify.
+
+Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
+Acked-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+---
+ vma-reader.c |  64 ++++++++++++---------
+ vma.c        | 157 +++++++++++++++++++++++++++++----------------------
+ vma.h        |   2 +-
+ 3 files changed, 126 insertions(+), 97 deletions(-)
+
+diff --git a/vma-reader.c b/vma-reader.c
+index 4f4ee2b47b..844d95a5ba 100644
+--- a/vma-reader.c
++++ b/vma-reader.c
+@@ -29,6 +29,7 @@ typedef struct VmaRestoreState {
+     bool write_zeroes;
+     unsigned long *bitmap;
+     int bitmap_size;
++    bool skip;
+ }  VmaRestoreState;
+ 
+ struct VmaReader {
+@@ -426,13 +427,14 @@ VmaDeviceInfo *vma_reader_get_device_info(VmaReader *vmar, guint8 dev_id)
+ }
+ 
+ static void allocate_rstate(VmaReader *vmar,  guint8 dev_id,
+-                            BlockBackend *target, bool write_zeroes)
++                            BlockBackend *target, bool write_zeroes, bool skip)
+ {
+     assert(vmar);
+     assert(dev_id);
+ 
+     vmar->rstate[dev_id].target = target;
+     vmar->rstate[dev_id].write_zeroes = write_zeroes;
++    vmar->rstate[dev_id].skip = skip;
+ 
+     int64_t size = vmar->devinfo[dev_id].size;
+ 
+@@ -447,28 +449,30 @@ static void allocate_rstate(VmaReader *vmar,  guint8 dev_id,
+ }
+ 
+ int vma_reader_register_bs(VmaReader *vmar, guint8 dev_id, BlockBackend *target,
+-                           bool write_zeroes, Error **errp)
++                           bool write_zeroes, bool skip, Error **errp)
+ {
+     assert(vmar);
+-    assert(target != NULL);
++    assert(target != NULL || skip);
+     assert(dev_id);
+-    assert(vmar->rstate[dev_id].target == NULL);
+-
+-    int64_t size = blk_getlength(target);
+-    int64_t size_diff = size - vmar->devinfo[dev_id].size;
+-
+-    /* storage types can have different size restrictions, so it
+-     * is not always possible to create an image with exact size.
+-     * So we tolerate a size difference up to 4MB.
+-     */
+-    if ((size_diff < 0) || (size_diff > 4*1024*1024)) {
+-        error_setg(errp, "vma_reader_register_bs for stream %s failed - "
+-                   "unexpected size %zd != %zd", vmar->devinfo[dev_id].devname,
+-                   size, vmar->devinfo[dev_id].size);
+-        return -1;
++    assert(vmar->rstate[dev_id].target == NULL && !vmar->rstate[dev_id].skip);
++
++    if (target != NULL) {
++        int64_t size = blk_getlength(target);
++        int64_t size_diff = size - vmar->devinfo[dev_id].size;
++
++        /* storage types can have different size restrictions, so it
++         * is not always possible to create an image with exact size.
++         * So we tolerate a size difference up to 4MB.
++         */
++        if ((size_diff < 0) || (size_diff > 4*1024*1024)) {
++            error_setg(errp, "vma_reader_register_bs for stream %s failed - "
++                       "unexpected size %zd != %zd", vmar->devinfo[dev_id].devname,
++                       size, vmar->devinfo[dev_id].size);
++            return -1;
++        }
+     }
+ 
+-    allocate_rstate(vmar, dev_id, target, write_zeroes);
++    allocate_rstate(vmar, dev_id, target, write_zeroes, skip);
+ 
+     return 0;
+ }
+@@ -561,19 +565,23 @@ static int restore_extent(VmaReader *vmar, unsigned char *buf,
+         VmaRestoreState *rstate = &vmar->rstate[dev_id];
+         BlockBackend *target = NULL;
+ 
++        bool skip = rstate->skip;
++
+         if (dev_id != vmar->vmstate_stream) {
+             target = rstate->target;
+-            if (!verify && !target) {
++            if (!verify && !target && !skip) {
+                 error_setg(errp, "got wrong dev id %d", dev_id);
+                 return -1;
+             }
+ 
+-            if (vma_reader_get_bitmap(rstate, cluster_num)) {
+-                error_setg(errp, "found duplicated cluster %zd for stream %s",
+-                          cluster_num, vmar->devinfo[dev_id].devname);
+-                return -1;
++            if (!skip) {
++                if (vma_reader_get_bitmap(rstate, cluster_num)) {
++                    error_setg(errp, "found duplicated cluster %zd for stream %s",
++                              cluster_num, vmar->devinfo[dev_id].devname);
++                    return -1;
++                }
++                vma_reader_set_bitmap(rstate, cluster_num, 1);
+             }
+-            vma_reader_set_bitmap(rstate, cluster_num, 1);
+ 
+             max_sector = vmar->devinfo[dev_id].size/BDRV_SECTOR_SIZE;
+         } else {
+@@ -619,7 +627,7 @@ static int restore_extent(VmaReader *vmar, unsigned char *buf,
+                 return -1;
+             }
+ 
+-            if (!verify) {
++            if (!verify && !skip) {
+                 int nb_sectors = end_sector - sector_num;
+                 if (restore_write_data(vmar, dev_id, target, vmstate_fd,
+                                        buf + start, sector_num, nb_sectors,
+@@ -655,7 +663,7 @@ static int restore_extent(VmaReader *vmar, unsigned char *buf,
+                         return -1;
+                     }
+ 
+-                    if (!verify) {
++                    if (!verify && !skip) {
+                         int nb_sectors = end_sector - sector_num;
+                         if (restore_write_data(vmar, dev_id, target, vmstate_fd,
+                                                buf + start, sector_num,
+@@ -680,7 +688,7 @@ static int restore_extent(VmaReader *vmar, unsigned char *buf,
+                             vmar->partial_zero_cluster_data += zero_size;
+                         }
+ 
+-                        if (rstate->write_zeroes && !verify) {
++                        if (rstate->write_zeroes && !verify && !skip) {
+                             if (restore_write_data(vmar, dev_id, target, vmstate_fd,
+                                                    zero_vma_block, sector_num,
+                                                    nb_sectors, errp) < 0) {
+@@ -851,7 +859,7 @@ int vma_reader_verify(VmaReader *vmar, bool verbose, Error **errp)
+ 
+     for (dev_id = 1; dev_id < 255; dev_id++) {
+         if (vma_reader_get_device_info(vmar, dev_id)) {
+-            allocate_rstate(vmar, dev_id, NULL, false);
++            allocate_rstate(vmar, dev_id, NULL, false, false);
+         }
+     }
+ 
+diff --git a/vma.c b/vma.c
+index 89440733b1..21e765a469 100644
+--- a/vma.c
++++ b/vma.c
+@@ -138,6 +138,7 @@ typedef struct RestoreMap {
+     char *throttling_group;
+     char *cache;
+     bool write_zero;
++    bool skip;
+ } RestoreMap;
+ 
+ static bool try_parse_option(char **line, const char *optname, char **out, const char *inbuf) {
+@@ -245,47 +246,61 @@ static int extract_content(int argc, char **argv)
+             char *bps = NULL;
+             char *group = NULL;
+             char *cache = NULL;
++            char *devname = NULL;
++            bool skip = false;
++            uint64_t bps_value = 0;
++            const char *path = NULL;
++            bool write_zero = true;
++
+             if (!line || line[0] == '\0' || !strcmp(line, "done\n")) {
+                 break;
+             }
+             int len = strlen(line);
+             if (line[len - 1] == '\n') {
+                 line[len - 1] = '\0';
+-                if (len == 1) {
++                len = len - 1;
++                if (len == 0) {
+                     break;
+                 }
+             }
+ 
+-            while (1) {
+-                if (!try_parse_option(&line, "format", &format, inbuf) &&
+-                    !try_parse_option(&line, "throttling.bps", &bps, inbuf) &&
+-                    !try_parse_option(&line, "throttling.group", &group, inbuf) &&
+-                    !try_parse_option(&line, "cache", &cache, inbuf))
+-                {
+-                    break;
++            if (strncmp(line, "skip", 4) == 0) {
++                if (len < 6 || line[4] != '=') {
++                    g_error("read map failed - option 'skip' has no value ('%s')",
++                            inbuf);
++                } else {
++                    devname = line + 5;
++                    skip = true;
++                }
++            } else {
++                while (1) {
++                    if (!try_parse_option(&line, "format", &format, inbuf) &&
++                        !try_parse_option(&line, "throttling.bps", &bps, inbuf) &&
++                        !try_parse_option(&line, "throttling.group", &group, inbuf) &&
++                        !try_parse_option(&line, "cache", &cache, inbuf))
++                    {
++                        break;
++                    }
+                 }
+-            }
+ 
+-            uint64_t bps_value = 0;
+-            if (bps) {
+-                bps_value = verify_u64(bps);
+-                g_free(bps);
+-            }
++                if (bps) {
++                    bps_value = verify_u64(bps);
++                    g_free(bps);
++                }
+ 
+-            const char *path;
+-            bool write_zero;
+-            if (line[0] == '0' && line[1] == ':') {
+-                path = line + 2;
+-                write_zero = false;
+-            } else if (line[0] == '1' && line[1] == ':') {
+-                path = line + 2;
+-                write_zero = true;
+-            } else {
+-                g_error("read map failed - parse error ('%s')", inbuf);
++                if (line[0] == '0' && line[1] == ':') {
++                    path = line + 2;
++                    write_zero = false;
++                } else if (line[0] == '1' && line[1] == ':') {
++                    path = line + 2;
++                    write_zero = true;
++                } else {
++                    g_error("read map failed - parse error ('%s')", inbuf);
++                }
++
++                path = extract_devname(path, &devname, -1);
+             }
+ 
+-            char *devname = NULL;
+-            path = extract_devname(path, &devname, -1);
+             if (!devname) {
+                 g_error("read map failed - no dev name specified ('%s')",
+                         inbuf);
+@@ -299,6 +314,7 @@ static int extract_content(int argc, char **argv)
+             map->throttling_group = group;
+             map->cache = cache;
+             map->write_zero = write_zero;
++            map->skip = skip;
+ 
+             g_hash_table_insert(devmap, map->devname, map);
+ 
+@@ -328,6 +344,7 @@ static int extract_content(int argc, char **argv)
+             const char *cache = NULL;
+             int flags = BDRV_O_RDWR;
+             bool write_zero = true;
++            bool skip = false;
+ 
+             BlockBackend *blk = NULL;
+ 
+@@ -343,6 +360,7 @@ static int extract_content(int argc, char **argv)
+                 throttling_group = map->throttling_group;
+                 cache = map->cache;
+                 write_zero = map->write_zero;
++                skip = map->skip;
+             } else {
+                 devfn = g_strdup_printf("%s/tmp-disk-%s.raw",
+                                         dirname, di->devname);
+@@ -361,57 +379,60 @@ static int extract_content(int argc, char **argv)
+                 write_zero = false;
+             }
+ 
+-	    size_t devlen = strlen(devfn);
+-	    QDict *options = NULL;
+-            bool writethrough;
+-            if (format) {
+-                /* explicit format from commandline */
+-                options = qdict_new();
+-                qdict_put_str(options, "driver", format);
+-            } else if ((devlen > 4 && strcmp(devfn+devlen-4, ".raw") == 0) ||
+-	               strncmp(devfn, "/dev/", 5) == 0)
+-	    {
+-                /* This part is now deprecated for PVE as well (just as qemu
+-                 * deprecated not specifying an explicit raw format, too.
+-                 */
+-		/* explicit raw format */
+-		options = qdict_new();
+-		qdict_put_str(options, "driver", "raw");
+-	    }
+-            if (cache && bdrv_parse_cache_mode(cache, &flags, &writethrough)) {
+-                g_error("invalid cache option: %s\n", cache);
+-            }
++            if (!skip) {
++                size_t devlen = strlen(devfn);
++                QDict *options = NULL;
++                bool writethrough;
++                if (format) {
++                    /* explicit format from commandline */
++                    options = qdict_new();
++                    qdict_put_str(options, "driver", format);
++                } else if ((devlen > 4 && strcmp(devfn+devlen-4, ".raw") == 0) ||
++                    strncmp(devfn, "/dev/", 5) == 0)
++                {
++                    /* This part is now deprecated for PVE as well (just as qemu
++                     * deprecated not specifying an explicit raw format, too.
++                     */
++                    /* explicit raw format */
++                    options = qdict_new();
++                    qdict_put_str(options, "driver", "raw");
++                }
+ 
+-	    if (errp || !(blk = blk_new_open(devfn, NULL, options, flags, &errp))) {
+-                g_error("can't open file %s - %s", devfn,
+-                        error_get_pretty(errp));
+-            }
++                if (cache && bdrv_parse_cache_mode(cache, &flags, &writethrough)) {
++                    g_error("invalid cache option: %s\n", cache);
++                }
+ 
+-            if (cache) {
+-                blk_set_enable_write_cache(blk, !writethrough);
+-            }
++                if (errp || !(blk = blk_new_open(devfn, NULL, options, flags, &errp))) {
++                    g_error("can't open file %s - %s", devfn,
++                            error_get_pretty(errp));
++                }
+ 
+-            if (throttling_group) {
+-                blk_io_limits_enable(blk, throttling_group);
+-            }
++                if (cache) {
++                    blk_set_enable_write_cache(blk, !writethrough);
++                }
+ 
+-            if (throttling_bps) {
+-                if (!throttling_group) {
+-                    blk_io_limits_enable(blk, devfn);
++                if (throttling_group) {
++                    blk_io_limits_enable(blk, throttling_group);
+                 }
+ 
+-                ThrottleConfig cfg;
+-                throttle_config_init(&cfg);
+-                cfg.buckets[THROTTLE_BPS_WRITE].avg = throttling_bps;
+-                Error *err = NULL;
+-                if (!throttle_is_valid(&cfg, &err)) {
+-                    error_report_err(err);
+-                    g_error("failed to apply throttling");
++                if (throttling_bps) {
++                    if (!throttling_group) {
++                        blk_io_limits_enable(blk, devfn);
++                    }
++
++                    ThrottleConfig cfg;
++                    throttle_config_init(&cfg);
++                    cfg.buckets[THROTTLE_BPS_WRITE].avg = throttling_bps;
++                    Error *err = NULL;
++                    if (!throttle_is_valid(&cfg, &err)) {
++                        error_report_err(err);
++                        g_error("failed to apply throttling");
++                    }
++                    blk_set_io_limits(blk, &cfg);
+                 }
+-                blk_set_io_limits(blk, &cfg);
+             }
+ 
+-            if (vma_reader_register_bs(vmar, i, blk, write_zero, &errp) < 0) {
++            if (vma_reader_register_bs(vmar, i, blk, write_zero, skip, &errp) < 0) {
+                 g_error("%s", error_get_pretty(errp));
+             }
+ 
+diff --git a/vma.h b/vma.h
+index c895c97f6d..1b62859165 100644
+--- a/vma.h
++++ b/vma.h
+@@ -142,7 +142,7 @@ GList *vma_reader_get_config_data(VmaReader *vmar);
+ VmaDeviceInfo *vma_reader_get_device_info(VmaReader *vmar, guint8 dev_id);
+ int vma_reader_register_bs(VmaReader *vmar, guint8 dev_id,
+                            BlockBackend *target, bool write_zeroes,
+-                           Error **errp);
++                           bool skip, Error **errp);
+ int vma_reader_restore(VmaReader *vmar, int vmstate_fd, bool verbose,
+                        Error **errp);
+ int vma_reader_verify(VmaReader *vmar, bool verbose, Error **errp);

debian/patches/pve/0052-pbs-namespace-support.patch

@@ -0,0 +1,233 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Wolfgang Bumiller <w.bumiller@proxmox.com>
+Date: Tue, 26 Apr 2022 16:06:28 +0200
+Subject: [PATCH] pbs: namespace support
+
+Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
+---
+ block/monitor/block-hmp-cmds.c |  1 +
+ block/pbs.c                    | 25 +++++++++++++++++++++----
+ pbs-restore.c                  | 19 ++++++++++++++++---
+ pve-backup.c                   |  6 +++++-
+ qapi/block-core.json           |  5 ++++-
+ 5 files changed, 47 insertions(+), 9 deletions(-)
+
+diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
+index 52ddbf95ad..69c868887a 100644
+--- a/block/monitor/block-hmp-cmds.c
++++ b/block/monitor/block-hmp-cmds.c
+@@ -1041,6 +1041,7 @@ void coroutine_fn hmp_backup(Monitor *mon, const QDict *qdict)
+         false, NULL, // PBS key_password
+         false, NULL, // PBS master_keyfile
+         false, NULL, // PBS fingerprint
++        false, NULL, // PBS backup-ns
+         false, NULL, // PBS backup-id
+         false, 0, // PBS backup-time
+         false, false, // PBS use-dirty-bitmap
+diff --git a/block/pbs.c b/block/pbs.c
+index c5eb4d5bad..7471e2ef9d 100644
+--- a/block/pbs.c
++++ b/block/pbs.c
+@@ -14,6 +14,7 @@
+ #include <proxmox-backup-qemu.h>
+ 
+ #define PBS_OPT_REPOSITORY "repository"
++#define PBS_OPT_NAMESPACE "namespace"
+ #define PBS_OPT_SNAPSHOT "snapshot"
+ #define PBS_OPT_ARCHIVE "archive"
+ #define PBS_OPT_KEYFILE "keyfile"
+@@ -27,6 +28,7 @@ typedef struct {
+     int64_t length;
+ 
+     char *repository;
++    char *namespace;
+     char *snapshot;
+     char *archive;
+ } BDRVPBSState;
+@@ -40,6 +42,11 @@ static QemuOptsList runtime_opts = {
+             .type = QEMU_OPT_STRING,
+             .help = "The server address and repository to connect to.",
+         },
++        {
++            .name = PBS_OPT_NAMESPACE,
++            .type = QEMU_OPT_STRING,
++            .help = "Optional: The snapshot's namespace.",
++        },
+         {
+             .name = PBS_OPT_SNAPSHOT,
+             .type = QEMU_OPT_STRING,
+@@ -76,7 +83,7 @@ static QemuOptsList runtime_opts = {
+ 
+ 
+ // filename format:
+-// pbs:repository=<repo>,snapshot=<snap>,password=<pw>,key_password=<kpw>,fingerprint=<fp>,archive=<archive>
++// pbs:repository=<repo>,namespace=<ns>,snapshot=<snap>,password=<pw>,key_password=<kpw>,fingerprint=<fp>,archive=<archive>
+ static void pbs_parse_filename(const char *filename, QDict *options,
+                                      Error **errp)
+ {
+@@ -112,6 +119,7 @@ static int pbs_open(BlockDriverState *bs, QDict *options, int flags,
+     s->archive = g_strdup(qemu_opt_get(opts, PBS_OPT_ARCHIVE));
+     const char *keyfile = qemu_opt_get(opts, PBS_OPT_KEYFILE);
+     const char *password = qemu_opt_get(opts, PBS_OPT_PASSWORD);
++    const char *namespace = qemu_opt_get(opts, PBS_OPT_NAMESPACE);
+     const char *fingerprint = qemu_opt_get(opts, PBS_OPT_FINGERPRINT);
+     const char *key_password = qemu_opt_get(opts, PBS_OPT_ENCRYPTION_PASSWORD);
+ 
+@@ -124,9 +132,12 @@ static int pbs_open(BlockDriverState *bs, QDict *options, int flags,
+     if (!key_password) {
+         key_password = getenv("PBS_ENCRYPTION_PASSWORD");
+     }
++    if (namespace) {
++        s->namespace = g_strdup(namespace);
++    }
+ 
+     /* connect to PBS server in read mode */
+-    s->conn = proxmox_restore_new(s->repository, s->snapshot, password,
++    s->conn = proxmox_restore_new_ns(s->repository, s->snapshot, s->namespace, password,
+         keyfile, key_password, fingerprint, &pbs_error);
+ 
+     /* invalidates qemu_opt_get char pointers from above */
+@@ -171,6 +182,7 @@ static int pbs_file_open(BlockDriverState *bs, QDict *options, int flags,
+ static void pbs_close(BlockDriverState *bs) {
+     BDRVPBSState *s = bs->opaque;
+     g_free(s->repository);
++    g_free(s->namespace);
+     g_free(s->snapshot);
+     g_free(s->archive);
+     proxmox_restore_disconnect(s->conn);
+@@ -252,8 +264,13 @@ static coroutine_fn int pbs_co_pwritev(BlockDriverState *bs,
+ static void pbs_refresh_filename(BlockDriverState *bs)
+ {
+     BDRVPBSState *s = bs->opaque;
+-    snprintf(bs->exact_filename, sizeof(bs->exact_filename), "%s/%s(%s)",
+-             s->repository, s->snapshot, s->archive);
++    if (s->namespace) {
++        snprintf(bs->exact_filename, sizeof(bs->exact_filename), "%s/%s:%s(%s)",
++                 s->repository, s->namespace, s->snapshot, s->archive);
++    } else {
++        snprintf(bs->exact_filename, sizeof(bs->exact_filename), "%s/%s(%s)",
++                 s->repository, s->snapshot, s->archive);
++    }
+ }
+ 
+ static const char *const pbs_strong_runtime_opts[] = {
+diff --git a/pbs-restore.c b/pbs-restore.c
+index 4d3f925a1b..62042bdd93 100644
+--- a/pbs-restore.c
++++ b/pbs-restore.c
+@@ -30,7 +30,7 @@
+ static void help(void)
+ {
+     const char *help_msg =
+-        "usage: pbs-restore [--repository <repo>] snapshot archive-name target [command options]\n"
++        "usage: pbs-restore [--repository <repo>] [--ns namespace] snapshot archive-name target [command options]\n"
+         ;
+ 
+     printf("%s", help_msg);
+@@ -78,6 +78,7 @@ int main(int argc, char **argv)
+     Error *main_loop_err = NULL;
+     const char *format = "raw";
+     const char *repository = NULL;
++    const char *backup_ns = NULL;
+     const char *keyfile = NULL;
+     int verbose = false;
+     bool skip_zero = false;
+@@ -91,6 +92,7 @@ int main(int argc, char **argv)
+             {"verbose", no_argument, 0, 'v'},
+             {"format", required_argument, 0, 'f'},
+             {"repository", required_argument, 0, 'r'},
++            {"ns", required_argument, 0, 'n'},
+             {"keyfile", required_argument, 0, 'k'},
+             {0, 0, 0, 0}
+         };
+@@ -111,6 +113,9 @@ int main(int argc, char **argv)
+             case 'r':
+                 repository = g_strdup(argv[optind - 1]);
+                 break;
++            case 'n':
++                backup_ns = g_strdup(argv[optind - 1]);
++                break;
+             case 'k':
+                 keyfile = g_strdup(argv[optind - 1]);
+                 break;
+@@ -161,8 +166,16 @@ int main(int argc, char **argv)
+         fprintf(stderr, "connecting to repository '%s'\n", repository);
+     }
+     char *pbs_error = NULL;
+-    ProxmoxRestoreHandle *conn = proxmox_restore_new(
+-        repository, snapshot, password, keyfile, key_password, fingerprint, &pbs_error);
++    ProxmoxRestoreHandle *conn = proxmox_restore_new_ns(
++        repository,
++        snapshot,
++        backup_ns,
++        password,
++        keyfile,
++        key_password,
++        fingerprint,
++        &pbs_error
++    );
+     if (conn == NULL) {
+         fprintf(stderr, "restore failed: %s\n", pbs_error);
+         return -1;
+diff --git a/pve-backup.c b/pve-backup.c
+index 9f6c04a512..f6a5f8c785 100644
+--- a/pve-backup.c
++++ b/pve-backup.c
+@@ -10,6 +10,8 @@
+ #include "qapi/qmp/qerror.h"
+ #include "qemu/cutils.h"
+ 
++#include <proxmox-backup-qemu.h>
++
+ /* PVE backup state and related function */
+ 
+ /*
+@@ -535,6 +537,7 @@ UuidInfo coroutine_fn *qmp_backup(
+     bool has_key_password, const char *key_password,
+     bool has_master_keyfile, const char *master_keyfile,
+     bool has_fingerprint, const char *fingerprint,
++    bool has_backup_ns, const char *backup_ns,
+     bool has_backup_id, const char *backup_id,
+     bool has_backup_time, int64_t backup_time,
+     bool has_use_dirty_bitmap, bool use_dirty_bitmap,
+@@ -674,8 +677,9 @@ UuidInfo coroutine_fn *qmp_backup(
+         firewall_name = "fw.conf";
+ 
+         char *pbs_err = NULL;
+-        pbs = proxmox_backup_new(
++        pbs = proxmox_backup_new_ns(
+             backup_file,
++            has_backup_ns ? backup_ns : NULL,
+             backup_id,
+             backup_time,
+             dump_cb_block_size,
+diff --git a/qapi/block-core.json b/qapi/block-core.json
+index d089328a1f..705f0c97ba 100644
+--- a/qapi/block-core.json
++++ b/qapi/block-core.json
+@@ -821,6 +821,8 @@
+ #
+ # @fingerprint: server cert fingerprint (optional for format 'pbs')
+ #
++# @backup-ns: backup namespace (required for format 'pbs')
++#
+ # @backup-id: backup ID (required for format 'pbs')
+ #
+ # @backup-time: backup timestamp (Unix epoch, required for format 'pbs')
+@@ -840,6 +842,7 @@
+                                     '*key-password': 'str',
+                                     '*master-keyfile': 'str',
+                                     '*fingerprint': 'str',
++                                    '*backup-ns': 'str',
+                                     '*backup-id': 'str',
+                                     '*backup-time': 'int',
+                                     '*use-dirty-bitmap': 'bool',
+@@ -3236,7 +3239,7 @@
+ { 'struct': 'BlockdevOptionsPbs',
+   'data': { 'repository': 'str', 'snapshot': 'str', 'archive': 'str',
+             '*keyfile': 'str', '*password': 'str', '*fingerprint': 'str',
+-            '*key_password': 'str' } }
++            '*key_password': 'str', '*namespace': 'str' } }
+ 
+ ##
+ # @BlockdevOptionsNVMe:

debian/patches/pve/0053-Revert-block-rbd-implement-bdrv_co_block_status.patch

@@ -0,0 +1,161 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Fabian Ebner <f.ebner@proxmox.com>
+Date: Tue, 17 May 2022 09:46:02 +0200
+Subject: [PATCH] Revert "block/rbd: implement bdrv_co_block_status"
+
+During backup, bdrv_co_block_status is called for each block copy
+chunk. When RBD is used, the current implementation with
+rbd_diff_iterate2() using whole_object=true takes about linearly more
+time, depending on the image size. Since there are linearly more
+chunks, the slowdown is quadratic, becoming unacceptable for large
+images (starting somewhere between 500-1000 GiB in my testing).
+
+This reverts commit 0347a8fd4c3faaedf119be04c197804be40a384b as a
+stop-gap measure, until it's clear how to make the implemenation
+more efficient.
+
+Upstream bug report:
+https://gitlab.com/qemu-project/qemu/-/issues/1026
+
+Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
+---
+ block/rbd.c | 112 ----------------------------------------------------
+ 1 file changed, 112 deletions(-)
+
+diff --git a/block/rbd.c b/block/rbd.c
+index a4b8fb482c..3393b06a4e 100644
+--- a/block/rbd.c
++++ b/block/rbd.c
+@@ -97,12 +97,6 @@ typedef struct RBDTask {
+     int64_t ret;
+ } RBDTask;
+ 
+-typedef struct RBDDiffIterateReq {
+-    uint64_t offs;
+-    uint64_t bytes;
+-    bool exists;
+-} RBDDiffIterateReq;
+-
+ static int qemu_rbd_connect(rados_t *cluster, rados_ioctx_t *io_ctx,
+                             BlockdevOptionsRbd *opts, bool cache,
+                             const char *keypairs, const char *secretid,
+@@ -1267,111 +1261,6 @@ static ImageInfoSpecific *qemu_rbd_get_specific_info(BlockDriverState *bs,
+     return spec_info;
+ }
+ 
+-/*
+- * rbd_diff_iterate2 allows to interrupt the exection by returning a negative
+- * value in the callback routine. Choose a value that does not conflict with
+- * an existing exitcode and return it if we want to prematurely stop the
+- * execution because we detected a change in the allocation status.
+- */
+-#define QEMU_RBD_EXIT_DIFF_ITERATE2 -9000
+-
+-static int qemu_rbd_diff_iterate_cb(uint64_t offs, size_t len,
+-                                    int exists, void *opaque)
+-{
+-    RBDDiffIterateReq *req = opaque;
+-
+-    assert(req->offs + req->bytes <= offs);
+-    /*
+-     * we do not diff against a snapshot so we should never receive a callback
+-     * for a hole.
+-     */
+-    assert(exists);
+-
+-    if (!req->exists && offs > req->offs) {
+-        /*
+-         * we started in an unallocated area and hit the first allocated
+-         * block. req->bytes must be set to the length of the unallocated area
+-         * before the allocated area. stop further processing.
+-         */
+-        req->bytes = offs - req->offs;
+-        return QEMU_RBD_EXIT_DIFF_ITERATE2;
+-    }
+-
+-    if (req->exists && offs > req->offs + req->bytes) {
+-        /*
+-         * we started in an allocated area and jumped over an unallocated area,
+-         * req->bytes contains the length of the allocated area before the
+-         * unallocated area. stop further processing.
+-         */
+-        return QEMU_RBD_EXIT_DIFF_ITERATE2;
+-    }
+-
+-    req->bytes += len;
+-    req->exists = true;
+-
+-    return 0;
+-}
+-
+-static int coroutine_fn qemu_rbd_co_block_status(BlockDriverState *bs,
+-                                                 bool want_zero, int64_t offset,
+-                                                 int64_t bytes, int64_t *pnum,
+-                                                 int64_t *map,
+-                                                 BlockDriverState **file)
+-{
+-    BDRVRBDState *s = bs->opaque;
+-    int status, r;
+-    RBDDiffIterateReq req = { .offs = offset };
+-    uint64_t features, flags;
+-
+-    assert(offset + bytes <= s->image_size);
+-
+-    /* default to all sectors allocated */
+-    status = BDRV_BLOCK_DATA | BDRV_BLOCK_OFFSET_VALID;
+-    *map = offset;
+-    *file = bs;
+-    *pnum = bytes;
+-
+-    /* check if RBD image supports fast-diff */
+-    r = rbd_get_features(s->image, &features);
+-    if (r < 0) {
+-        return status;
+-    }
+-    if (!(features & RBD_FEATURE_FAST_DIFF)) {
+-        return status;
+-    }
+-
+-    /* check if RBD fast-diff result is valid */
+-    r = rbd_get_flags(s->image, &flags);
+-    if (r < 0) {
+-        return status;
+-    }
+-    if (flags & RBD_FLAG_FAST_DIFF_INVALID) {
+-        return status;
+-    }
+-
+-    r = rbd_diff_iterate2(s->image, NULL, offset, bytes, true, true,
+-                          qemu_rbd_diff_iterate_cb, &req);
+-    if (r < 0 && r != QEMU_RBD_EXIT_DIFF_ITERATE2) {
+-        return status;
+-    }
+-    assert(req.bytes <= bytes);
+-    if (!req.exists) {
+-        if (r == 0) {
+-            /*
+-             * rbd_diff_iterate2 does not invoke callbacks for unallocated
+-             * areas. This here catches the case where no callback was
+-             * invoked at all (req.bytes == 0).
+-             */
+-            assert(req.bytes == 0);
+-            req.bytes = bytes;
+-        }
+-        status = BDRV_BLOCK_ZERO | BDRV_BLOCK_OFFSET_VALID;
+-    }
+-
+-    *pnum = req.bytes;
+-    return status;
+-}
+-
+ static int64_t qemu_rbd_getlength(BlockDriverState *bs)
+ {
+     BDRVRBDState *s = bs->opaque;
+@@ -1607,7 +1496,6 @@ static BlockDriver bdrv_rbd = {
+ #ifdef LIBRBD_SUPPORTS_WRITE_ZEROES
+     .bdrv_co_pwrite_zeroes  = qemu_rbd_co_pwrite_zeroes,
+ #endif
+-    .bdrv_co_block_status   = qemu_rbd_co_block_status,
+ 
+     .bdrv_snapshot_create   = qemu_rbd_snap_create,
+     .bdrv_snapshot_delete   = qemu_rbd_snap_remove,

debian/patches/pve/0054-PVE-Backup-create-jobs-correctly-cancel-in-error-sce.patch

@@ -0,0 +1,59 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Fabian Ebner <f.ebner@proxmox.com>
+Date: Wed, 25 May 2022 13:59:37 +0200
+Subject: [PATCH] PVE-Backup: create jobs: correctly cancel in error scenario
+
+The first call to job_cancel_sync() will cancel and free all jobs in
+the transaction, so ensure that it's called only once and get rid of
+the job_unref() that would operate on freed memory.
+
+It's also necessary to NULL backup_state.pbs in the error scenario,
+because a subsequent backup_cancel QMP call (as happens in PVE when
+the backup QMP command fails) would try to call proxmox_backup_abort()
+and run into a segfault.
+
+Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
+Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
+---
+ pve-backup.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/pve-backup.c b/pve-backup.c
+index f6a5f8c785..5bed6f4014 100644
+--- a/pve-backup.c
++++ b/pve-backup.c
+@@ -506,6 +506,11 @@ static void create_backup_jobs_bh(void *opaque) {
+     }
+ 
+     if (*errp) {
++        /*
++         * It's enough to cancel one job in the transaction, the rest will
++         * follow automatically.
++         */
++        bool canceled = false;
+         l = backup_state.di_list;
+         while (l) {
+             PVEBackupDevInfo *di = (PVEBackupDevInfo *)l->data;
+@@ -516,12 +521,12 @@ static void create_backup_jobs_bh(void *opaque) {
+                 di->target = NULL;
+             }
+ 
+-            if (di->job) {
++            if (!canceled && di->job) {
+                 AioContext *ctx = di->job->job.aio_context;
+                 aio_context_acquire(ctx);
+                 job_cancel_sync(&di->job->job, true);
+-                job_unref(&di->job->job);
+                 aio_context_release(ctx);
++                canceled = true;
+             }
+         }
+     }
+@@ -947,6 +952,7 @@ err:
+ 
+     if (pbs) {
+         proxmox_backup_disconnect(pbs);
++        backup_state.pbs = NULL;
+     }
+ 
+     if (backup_dir) {

debian/patches/pve/0055-PVE-Backup-ensure-jobs-in-di_list-are-referenced.patch

@@ -0,0 +1,76 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Fabian Ebner <f.ebner@proxmox.com>
+Date: Wed, 25 May 2022 13:59:38 +0200
+Subject: [PATCH] PVE-Backup: ensure jobs in di_list are referenced
+
+Ensures that qmp_backup_cancel doesn't pick a job that's already been
+freed. With unlucky timings it seems possible that:
+1. job_exit -> job_completed -> job_finalize_single starts
+2. pvebackup_co_complete_stream gets spawned in completion callback
+3. job finalize_single finishes -> job's refcount hits zero -> job is
+   freed
+4. qmp_backup_cancel comes in and locks backup_state.backup_mutex
+   before pvebackup_co_complete_stream can remove the job from the
+   di_list
+5. qmp_backup_cancel will pick a job that's already been freed
+
+Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
+Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
+---
+ pve-backup.c | 25 ++++++++++++++++++++-----
+ 1 file changed, 20 insertions(+), 5 deletions(-)
+
+diff --git a/pve-backup.c b/pve-backup.c
+index 5bed6f4014..0c34428713 100644
+--- a/pve-backup.c
++++ b/pve-backup.c
+@@ -316,6 +316,14 @@ static void coroutine_fn pvebackup_co_complete_stream(void *opaque)
+         }
+     }
+ 
++    if (di->job) {
++        AioContext *ctx = di->job->job.aio_context;
++        aio_context_acquire(ctx);
++        job_unref(&di->job->job);
++        di->job = NULL;
++        aio_context_release(ctx);
++    }
++
+     // remove self from job list
+     backup_state.di_list = g_list_remove(backup_state.di_list, di);
+ 
+@@ -491,9 +499,12 @@ static void create_backup_jobs_bh(void *opaque) {
+             bitmap_mode, false, NULL, &perf, BLOCKDEV_ON_ERROR_REPORT, BLOCKDEV_ON_ERROR_REPORT,
+             JOB_DEFAULT, pvebackup_complete_cb, di, backup_state.txn, &local_err);
+ 
+-        aio_context_release(aio_context);
+-
+         di->job = job;
++        if (job) {
++            job_ref(&job->job);
++        }
++
++        aio_context_release(aio_context);
+ 
+         if (!job || local_err) {
+             error_setg(errp, "backup_job_create failed: %s",
+@@ -521,12 +532,16 @@ static void create_backup_jobs_bh(void *opaque) {
+                 di->target = NULL;
+             }
+ 
+-            if (!canceled && di->job) {
++            if (di->job) {
+                 AioContext *ctx = di->job->job.aio_context;
+                 aio_context_acquire(ctx);
+-                job_cancel_sync(&di->job->job, true);
++                if (!canceled) {
++                    job_cancel_sync(&di->job->job, true);
++                    canceled = true;
++                }
++                job_unref(&di->job->job);
++                di->job = NULL;
+                 aio_context_release(ctx);
+-                canceled = true;
+             }
+         }
+     }

debian/patches/pve/0056-PVE-Backup-avoid-segfault-issues-upon-backup-cancel.patch

@@ -0,0 +1,120 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Fabian Ebner <f.ebner@proxmox.com>
+Date: Wed, 25 May 2022 13:59:39 +0200
+Subject: [PATCH] PVE-Backup: avoid segfault issues upon backup-cancel
+
+When canceling a backup in PVE via a signal it's easy to run into a
+situation where the job is already failing when the backup_cancel QMP
+command comes in. With a bit of unlucky timing on top, it can happen
+that job_exit() runs between schedulung of job_cancel_bh() and
+execution of job_cancel_bh(). But job_cancel_sync() does not expect
+that the job is already finalized (in fact, the job might've been
+freed already, but even if it isn't, job_cancel_sync() would try to
+deref job->txn which would be NULL at that point).
+
+It is not possible to simply use the job_cancel() (which is advertised
+as being async but isn't in all cases) in qmp_backup_cancel() for the
+same reason job_cancel_sync() cannot be used. Namely, because it can
+invoke job_finish_sync() (which uses AIO_WAIT_WHILE and thus hangs if
+called from a coroutine). This happens when there's multiple jobs in
+the transaction and job->deferred_to_main_loop is true (is set before
+scheduling job_exit()) or if the job was not started yet.
+
+Fix the issue by selecting the job to cancel in job_cancel_bh() itself
+using the first job that's not completed yet. This is not necessarily
+the first job in the list, because pvebackup_co_complete_stream()
+might not yet have removed a completed job when job_cancel_bh() runs.
+
+An alternative would be to continue using only the first job and
+checking against JOB_STATUS_CONCLUDED or JOB_STATUS_NULL to decide if
+it's still necessary and possible to cancel, but the approach with
+using the first non-completed job seemed more robust.
+
+Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
+Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
+---
+ pve-backup.c | 61 +++++++++++++++++++++++++++++++++-------------------
+ 1 file changed, 39 insertions(+), 22 deletions(-)
+
+diff --git a/pve-backup.c b/pve-backup.c
+index 0c34428713..2e22030eec 100644
+--- a/pve-backup.c
++++ b/pve-backup.c
+@@ -355,15 +355,42 @@ static void pvebackup_complete_cb(void *opaque, int ret)
+ 
+ /*
+  * job_cancel(_sync) does not like to be called from coroutines, so defer to
+- * main loop processing via a bottom half.
++ * main loop processing via a bottom half. Assumes that caller holds
++ * backup_mutex.
+  */
+ static void job_cancel_bh(void *opaque) {
+     CoCtxData *data = (CoCtxData*)opaque;
+-    Job *job = (Job*)data->data;
+-    AioContext *job_ctx = job->aio_context;
+-    aio_context_acquire(job_ctx);
+-    job_cancel_sync(job, true);
+-    aio_context_release(job_ctx);
++
++    /*
++     * Be careful to pick a valid job to cancel:
++     * 1. job_cancel_sync() does not expect the job to be finalized already.
++     * 2. job_exit() might run between scheduling and running job_cancel_bh()
++     *    and pvebackup_co_complete_stream() might not have removed the job from
++     *    the list yet (in fact, cannot, because it waits for the backup_mutex).
++     * Requiring !job_is_completed() ensures that no finalized job is picked.
++     */
++    GList *bdi = g_list_first(backup_state.di_list);
++    while (bdi) {
++        if (bdi->data) {
++            BlockJob *bj = ((PVEBackupDevInfo *)bdi->data)->job;
++            if (bj) {
++                Job *job = &bj->job;
++                if (!job_is_completed(job)) {
++                    AioContext *job_ctx = job->aio_context;
++                    aio_context_acquire(job_ctx);
++                    job_cancel_sync(job, true);
++                    aio_context_release(job_ctx);
++                    /*
++                     * It's enough to cancel one job in the transaction, the
++                     * rest will follow automatically.
++                     */
++                    break;
++                }
++            }
++        }
++        bdi = g_list_next(bdi);
++    }
++
+     aio_co_enter(data->ctx, data->co);
+ }
+ 
+@@ -384,22 +411,12 @@ void coroutine_fn qmp_backup_cancel(Error **errp)
+         proxmox_backup_abort(backup_state.pbs, "backup canceled");
+     }
+ 
+-    /* it's enough to cancel one job in the transaction, the rest will follow
+-     * automatically */
+-    GList *bdi = g_list_first(backup_state.di_list);
+-    BlockJob *cancel_job = bdi && bdi->data ?
+-        ((PVEBackupDevInfo *)bdi->data)->job :
+-        NULL;
+-
+-    if (cancel_job) {
+-        CoCtxData data = {
+-            .ctx = qemu_get_current_aio_context(),
+-            .co = qemu_coroutine_self(),
+-            .data = &cancel_job->job,
+-        };
+-        aio_bh_schedule_oneshot(data.ctx, job_cancel_bh, &data);
+-        qemu_coroutine_yield();
+-    }
++    CoCtxData data = {
++        .ctx = qemu_get_current_aio_context(),
++        .co = qemu_coroutine_self(),
++    };
++    aio_bh_schedule_oneshot(data.ctx, job_cancel_bh, &data);
++    qemu_coroutine_yield();
+ 
+     qemu_co_mutex_unlock(&backup_state.backup_mutex);
+ }

debian/patches/pve/0057-vma-create-support-64KiB-unaligned-input-images.patch

@@ -0,0 +1,57 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Fabian Ebner <f.ebner@proxmox.com>
+Date: Wed, 22 Jun 2022 10:45:11 +0200
+Subject: [PATCH] vma: create: support 64KiB-unaligned input images
+
+which fixes backing up templates with such disks in PVE, for example
+efitype=4m EFI disks on a file-based storage (size = 540672).
+
+If there is not enough left to read, blk_co_preadv will return -EIO,
+so limit the size in the last iteration.
+
+For writing, an unaligned end is already handled correctly.
+
+The call to memset is not strictly necessary, because writing also
+checks that it doesn't write data beyond the end of the image. But
+there are two reasons to do it:
+1. It's cleaner that way.
+2. It allows detecting when the final piece is all zeroes, which might
+   not happen if the buffer still contains data from the previous
+   iteration.
+
+Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
+---
+ vma.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/vma.c b/vma.c
+index 21e765a469..6d02b29047 100644
+--- a/vma.c
++++ b/vma.c
+@@ -548,7 +548,7 @@ static void coroutine_fn backup_run(void *opaque)
+     struct iovec iov;
+     QEMUIOVector qiov;
+ 
+-    int64_t start, end;
++    int64_t start, end, readlen;
+     int ret = 0;
+ 
+     unsigned char *buf = blk_blockalign(job->target, VMA_CLUSTER_SIZE);
+@@ -562,8 +562,16 @@ static void coroutine_fn backup_run(void *opaque)
+         iov.iov_len = VMA_CLUSTER_SIZE;
+         qemu_iovec_init_external(&qiov, &iov, 1);
+ 
++        if (start + 1 == end) {
++            memset(buf, 0, VMA_CLUSTER_SIZE);
++            readlen = job->len - start * VMA_CLUSTER_SIZE;
++            assert(readlen > 0 && readlen <= VMA_CLUSTER_SIZE);
++        } else {
++            readlen = VMA_CLUSTER_SIZE;
++        }
++
+         ret = blk_co_preadv(job->target, start * VMA_CLUSTER_SIZE,
+-                            VMA_CLUSTER_SIZE, &qiov, 0);
++                            readlen, &qiov, 0);
+         if (ret < 0) {
+             vma_writer_set_error(job->vmaw, "read error", -1);
+             goto out;

debian/patches/pve/0058-vma-create-avoid-triggering-assertion-in-error-case.patch

@@ -0,0 +1,25 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Fabian Ebner <f.ebner@proxmox.com>
+Date: Wed, 22 Jun 2022 10:45:12 +0200
+Subject: [PATCH] vma: create: avoid triggering assertion in error case
+
+error_setg expects its argument to not be initialized yet.
+
+Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
+---
+ vma-writer.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/vma-writer.c b/vma-writer.c
+index 11d8321ffd..29567cba68 100644
+--- a/vma-writer.c
++++ b/vma-writer.c
+@@ -310,6 +310,8 @@ VmaWriter *vma_writer_create(const char *filename, uuid_t uuid, Error **errp)
+         }
+ 
+         if (vmaw->fd < 0) {
++            error_free(*errp);
++            *errp = NULL;
+             error_setg(errp, "can't open file %s - %s\n", filename,
+                        g_strerror(errno));
+             goto err;

debian/patches/pve/0059-block-alloc-track-avoid-premature-break.patch

@@ -0,0 +1,36 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Fabian Ebner <f.ebner@proxmox.com>
+Date: Wed, 22 Jun 2022 10:45:13 +0200
+Subject: [PATCH] block: alloc-track: avoid premature break
+
+While the bdrv_co_preadv() calls are expected to return 0 on success,
+qemu_iovec_memset() will return the number of bytes set (will be
+local_bytes, because the slice with that size was just initialized).
+
+Don't break out of the loop after the branch with qemu_iovec_memset(),
+because there might still be work to do. Additionally, ret is an int,
+which on 64-bit platforms is too small to hold the size_t returned by
+qemu_iovec_memset().
+
+The branch seems to be difficult to reach in practice, because the
+whole point of alloc-track is to be used with a backing device.
+
+Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
+---
+ block/alloc-track.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/block/alloc-track.c b/block/alloc-track.c
+index 6b50fbe537..c1160af04b 100644
+--- a/block/alloc-track.c
++++ b/block/alloc-track.c
+@@ -174,7 +174,8 @@ static int coroutine_fn track_co_preadv(BlockDriverState *bs,
+             ret = bdrv_co_preadv(bs->backing, local_offset, local_bytes,
+                                  &local_qiov, flags);
+         } else {
+-            ret = qemu_iovec_memset(&local_qiov, cur_offset, 0, local_bytes);
++            qemu_iovec_memset(&local_qiov, cur_offset, 0, local_bytes);
++            ret = 0;
+         }
+ 
+         if (ret != 0) {

debian/patches/series

@@ -1,7 +1,22 @@
 extra/0001-monitor-qmp-fix-race-with-clients-disconnecting-earl.patch
 extra/0002-monitor-hmp-add-support-for-flag-argument-with-value.patch
 extra/0003-monitor-refactor-set-expire_password-and-allow-VNC-d.patch
-extra/0004-block-mirror-fix-NULL-pointer-dereference-in-mirror_.patch
+extra/0006-block-io-Update-BSC-only-if-want_zero-is-true.patch
+extra/0007-block-nbd-Delete-reconnect-delay-timer-when-done.patch
+extra/0008-block-nbd-Assert-there-are-no-timers-when-closed.patch
+extra/0009-block-nbd-Move-s-ioc-on-AioContext-change.patch
+extra/0010-acpi-fix-QEMU-crash-when-started-with-SLIC-table.patch
+extra/0011-virtio-net-fix-map-leaking-on-error-during-receive.patch
+extra/0012-memory-Fix-incorrect-calls-of-log_global_start-stop.patch
+extra/0013-acpi-fix-OEM-ID-OEM-Table-ID-padding.patch
+extra/0014-vhost-vsock-detach-the-virqueue-element-in-case-of-e.patch
+extra/0015-vhost-user-remove-VirtQ-notifier-restore.patch
+extra/0016-vhost-user-fix-VirtQ-notifier-cleanup.patch
+extra/0017-virtio-fix-the-condition-for-iommu_platform-not-supp.patch
+extra/0018-block-gluster-correctly-set-max_pdiscard-which-is-in.patch
+extra/0019-ui-vnc.c-Fixed-a-deadlock-bug.patch
+extra/0020-display-qxl-render-fix-race-condition-in-qxl_cursor-.patch
+extra/0021-ui-cursor-fix-integer-overflow-in-cursor_alloc-CVE-2.patch
 bitmap-mirror/0001-drive-mirror-add-support-for-sync-bitmap-mode-never.patch
 bitmap-mirror/0002-drive-mirror-add-support-for-conditional-and-always-.patch
 bitmap-mirror/0003-mirror-add-check-for-bitmap-mode-without-bitmap.patch
@@ -32,28 +47,39 @@ pve/0021-PVE-Up-Config-file-posix-make-locking-optiono-on-cre.patch
 pve/0022-PVE-monitor-disable-oob-capability.patch
 pve/0023-PVE-Compat-4.0-used-balloon-qemu-4-0-config-size-fal.patch
 pve/0024-PVE-Allow-version-code-in-machine-type.patch
-pve/0025-PVE-Backup-add-vma-backup-format-code.patch
-pve/0026-PVE-Backup-add-backup-dump-block-driver.patch
-pve/0027-PVE-Backup-proxmox-backup-patches-for-qemu.patch
-pve/0028-PVE-Backup-pbs-restore-new-command-to-restore-from-p.patch
-pve/0029-PVE-Backup-Add-dirty-bitmap-tracking-for-incremental.patch
-pve/0030-PVE-various-PBS-fixes.patch
-pve/0031-PVE-Add-PBS-block-driver-to-map-backup-archives-into.patch
-pve/0032-PVE-add-query_proxmox_support-QMP-command.patch
-pve/0033-PVE-add-query-pbs-bitmap-info-QMP-call.patch
-pve/0034-PVE-redirect-stderr-to-journal-when-daemonized.patch
-pve/0035-PVE-Add-sequential-job-transaction-support.patch
-pve/0036-PVE-Backup-Use-a-transaction-to-synchronize-job-stat.patch
-pve/0037-PVE-Backup-Don-t-block-on-finishing-and-cleanup-crea.patch
-pve/0038-PVE-Migrate-dirty-bitmap-state-via-savevm.patch
-pve/0039-migration-block-dirty-bitmap-migrate-other-bitmaps-e.patch
-pve/0040-PVE-fall-back-to-open-iscsi-initiatorname.patch
-pve/0041-PVE-Use-coroutine-QMP-for-backup-cancel_backup.patch
-pve/0042-PBS-add-master-key-support.patch
-pve/0043-PVE-block-pbs-fast-path-reads-without-allocation-if-.patch
-pve/0044-PVE-block-stream-increase-chunk-size.patch
-pve/0045-block-io-accept-NULL-qiov-in-bdrv_pad_request.patch
-pve/0046-block-add-alloc-track-driver.patch
-pve/0047-PVE-whitelist-invalid-QAPI-names-for-backwards-compa.patch
-pve/0048-PVE-savevm-async-register-yank-before-migration_inco.patch
-pve-qemu-6.1-vitastor.patch
+pve/0025-block-backup-move-bcs-bitmap-initialization-to-job-c.patch
+pve/0026-PVE-Backup-add-vma-backup-format-code.patch
+pve/0027-PVE-Backup-add-backup-dump-block-driver.patch
+pve/0028-PVE-Backup-proxmox-backup-patches-for-qemu.patch
+pve/0029-PVE-Backup-pbs-restore-new-command-to-restore-from-p.patch
+pve/0030-PVE-Backup-Add-dirty-bitmap-tracking-for-incremental.patch
+pve/0031-PVE-various-PBS-fixes.patch
+pve/0032-PVE-Add-PBS-block-driver-to-map-backup-archives-into.patch
+pve/0033-PVE-add-query_proxmox_support-QMP-command.patch
+pve/0034-PVE-add-query-pbs-bitmap-info-QMP-call.patch
+pve/0035-PVE-redirect-stderr-to-journal-when-daemonized.patch
+pve/0036-PVE-Add-sequential-job-transaction-support.patch
+pve/0037-PVE-Backup-Use-a-transaction-to-synchronize-job-stat.patch
+pve/0038-PVE-Backup-Don-t-block-on-finishing-and-cleanup-crea.patch
+pve/0039-PVE-Migrate-dirty-bitmap-state-via-savevm.patch
+pve/0040-migration-block-dirty-bitmap-migrate-other-bitmaps-e.patch
+pve/0041-PVE-fall-back-to-open-iscsi-initiatorname.patch
+pve/0042-PVE-Use-coroutine-QMP-for-backup-cancel_backup.patch
+pve/0043-PBS-add-master-key-support.patch
+pve/0044-PVE-block-pbs-fast-path-reads-without-allocation-if-.patch
+pve/0045-PVE-block-stream-increase-chunk-size.patch
+pve/0046-block-io-accept-NULL-qiov-in-bdrv_pad_request.patch
+pve/0047-block-add-alloc-track-driver.patch
+pve/0048-PVE-whitelist-invalid-QAPI-names-for-backwards-compa.patch
+pve/0049-PVE-savevm-async-register-yank-before-migration_inco.patch
+pve/0050-qemu-img-dd-add-l-option-for-loading-a-snapshot.patch
+pve/0051-vma-allow-partial-restore.patch
+pve/0052-pbs-namespace-support.patch
+pve/0053-Revert-block-rbd-implement-bdrv_co_block_status.patch
+pve/0054-PVE-Backup-create-jobs-correctly-cancel-in-error-sce.patch
+pve/0055-PVE-Backup-ensure-jobs-in-di_list-are-referenced.patch
+pve/0056-PVE-Backup-avoid-segfault-issues-upon-backup-cancel.patch
+pve/0057-vma-create-support-64KiB-unaligned-input-images.patch
+pve/0058-vma-create-avoid-triggering-assertion-in-error-case.patch
+pve/0059-block-alloc-track-avoid-premature-break.patch
+pve-qemu-6.2-vitastor.patch

debian/rules

@@ -57,6 +57,7 @@ ${BUILDDIR}/config.status: configure
 	--disable-guest-agent \
 	--disable-guest-agent-msi \
 	--disable-libnfs \
+	--disable-libssh \
 	--disable-libxml2 \
 	--disable-sdl \
 	--disable-smartcard \
@@ -71,13 +72,16 @@ ${BUILDDIR}/config.status: configure
 	--enable-linux-aio \
 	--enable-linux-io-uring \
 	--enable-numa \
+	--enable-opengl \
 	--enable-rbd \
 	--enable-seccomp \
 	--enable-spice \
 	--enable-usb-redir \
+	--enable-virglrenderer \
 	--enable-virtfs \
 	--enable-virtiofsd \
-	--enable-xfsctl
+	--enable-xfsctl \
+	--enable-zstd
 
 build: build-stamp
 

debian/source/include-binaries

@@ -0,0 +1,3 @@
+debian/OVMF_CODE-pure-efi.fd
+debian/OVMF_VARS-pure-efi.fd
+debian/Logo.bmp