Add bdrv_co_block_status

Makefile

@@ -33,7 +33,7 @@ $(BUILDDIR): keycodemapdb | submodule
 deb kvm: $(DEBS)
 $(DEB_DBG): $(DEB)
 $(DEB): $(BUILDDIR)
-	cd $(BUILDDIR); dpkg-buildpackage -b -us -uc -j8
+	cd $(BUILDDIR); dpkg-buildpackage -b -us -uc -j
 	lintian $(DEBS)
 
 .PHONY: update

debian/changelog

@@ -1,80 +1,14 @@
-pve-qemu-kvm (7.1.0-4+vitastor4) bullseye; urgency=medium
-
-  * Improve performance by adding io_uring support
-  * Fix compatibility with iothread
-
- -- Vitaliy Filippov <vitalif@yourcmc.ru>  Tue, 18 Jul 2023 02:22:28 +0300
-
-pve-qemu-kvm (7.1.0-4+vitastor3) bullseye; urgency=medium
+pve-qemu-kvm (6.2.0-11+vitastor2) bullseye; urgency=medium
 
   * Add bdrv_co_block_status implementation for QCOW2 export support
 
- -- Vitaliy Filippov <vitalif@yourcmc.ru>  Thu, 12 Jan 2023 02:31:18 +0300
+ -- Vitaliy Filippov <vitalif@yourcmc.ru>  Fri, 13 Jan 2023 20:14:59 +0300
 
-pve-qemu-kvm (7.1.0-4+vitastor2) bullseye; urgency=medium
+pve-qemu-kvm (6.2.0-11+vitastor1) bullseye; urgency=medium
 
   * Add Vitastor support
 
- -- Vitaliy Filippov <vitalif@yourcmc.ru>  Thu, 15 Dec 2022 19:32:28 +0300
-
-pve-qemu-kvm (7.1.0-4) bullseye; urgency=medium
-
-  * cherry-pick "block/block-backend: blk_set_enable_write_cache is IO_CODE"
-
- -- Proxmox Support Team <support@proxmox.com>  Tue, 22 Nov 2022 09:21:06 +0100
-
-pve-qemu-kvm (7.1.0-3) bullseye; urgency=medium
-
-  * init: daemonize: defuse PID file resolve error to a warning at max, fixing
-    some usecases that regressed with 7.1, like tracking start up in our
-    file-restore VM.
-
- -- Proxmox Support Team <support@proxmox.com>  Fri, 28 Oct 2022 10:27:49 +0200
-
-pve-qemu-kvm (7.1.0-2) bullseye; urgency=medium
-
-  * fix an issue with error handling in async backup code
-
- -- Proxmox Support Team <support@proxmox.com>  Tue, 18 Oct 2022 15:33:44 +0200
-
-pve-qemu-kvm (7.1.0-1) bullseye; urgency=medium
-
-  * update to QEMU stable release 7.1.0
-
-  * add fix for io_uring_register_ring_fd from upstream
-
- -- Proxmox Support Team <support@proxmox.com>  Fri, 14 Oct 2022 14:54:09 +0200
-
-pve-qemu-kvm (7.0.0-4) bullseye; urgency=medium
-
-  * add revision to version output
-
-  * PVE Backup: allow passing max-workers performance setting
-
- -- Proxmox Support Team <support@proxmox.com>  Mon, 10 Oct 2022 11:55:37 +0200
-
-pve-qemu-kvm (7.0.0-3) bullseye; urgency=medium
-
-  * savevm-async: avoid segfault when aborting snapshot creation task
-
-  * savevm-async: set SAVE_STATE_DONE when closing state file was successful
-    allowing one to start a new snapshot task after aborting one.
-
- -- Proxmox Support Team <support@proxmox.com>  Tue, 30 Aug 2022 12:54:03 +0200
-
-pve-qemu-kvm (7.0.0-2) bullseye; urgency=medium
-
-  * backport "io_uring: fix short read slow path"
-
-  * backport "e1000: set RX descriptor status in a separate operation"
-
- -- Proxmox Support Team <support@proxmox.com>  Wed, 20 Jul 2022 09:17:07 +0200
-
-pve-qemu-kvm (7.0.0-1) bullseye; urgency=medium
-
-  * update to QEMU stable release 7.0.0
-
- -- Proxmox Support Team <support@proxmox.com>  Thu, 30 Jun 2022 11:07:37 +0200
+ -- Vitaliy Filippov <vitalif@yourcmc.ru>  Thu, 14 Dec 2022 18:13:59 +0300
 
 pve-qemu-kvm (6.2.0-11) bullseye; urgency=medium
 

debian/control

@@ -62,7 +62,6 @@ Depends: ceph-common (>= 0.48),
          libspice-server1 (>= 0.14.0~),
          libusb-1.0-0 (>= 1.0.17-1),
          libusbredirparser1 (>= 0.6-2),
-         vitastor-client (>= 0.9.4),
          libuuid1,
          ${misc:Depends},
          ${shlibs:Depends},

debian/patches/bitmap-mirror/0001-drive-mirror-add-support-for-sync-bitmap-mode-never.patch

@@ -28,18 +28,18 @@ Signed-off-by: John Snow <jsnow@redhat.com>
 Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
- block/mirror.c                         | 98 +++++++++++++++++++++-----
- blockdev.c                             | 39 +++++++++-
- include/block/block_int-global-state.h |  4 +-
- qapi/block-core.json                   | 29 ++++++--
- tests/unit/test-block-iothread.c       |  4 +-
+ block/mirror.c                   | 98 +++++++++++++++++++++++++-------
+ blockdev.c                       | 39 ++++++++++++-
+ include/block/block_int.h        |  4 +-
+ qapi/block-core.json             | 29 ++++++++--
+ tests/unit/test-block-iothread.c |  4 +-
  5 files changed, 145 insertions(+), 29 deletions(-)
 
 diff --git a/block/mirror.c b/block/mirror.c
-index 3c4ab1159d..f2eca983f1 100644
+index efec2c7674..f7804638f9 100644
 --- a/block/mirror.c
 +++ b/block/mirror.c
-@@ -51,7 +51,7 @@ typedef struct MirrorBlockJob {
+@@ -50,7 +50,7 @@ typedef struct MirrorBlockJob {
      BlockDriverState *to_replace;
      /* Used to block operations on the drive-mirror-replace target */
      Error *replace_blocker;
@@ -48,7 +48,7 @@ index 3c4ab1159d..f2eca983f1 100644
      BlockMirrorBackingMode backing_mode;
      /* Whether the target image requires explicit zero-initialization */
      bool zero_target;
-@@ -65,6 +65,8 @@ typedef struct MirrorBlockJob {
+@@ -64,6 +64,8 @@ typedef struct MirrorBlockJob {
      size_t buf_size;
      int64_t bdev_length;
      unsigned long *cow_bitmap;
@@ -57,7 +57,7 @@ index 3c4ab1159d..f2eca983f1 100644
      BdrvDirtyBitmap *dirty_bitmap;
      BdrvDirtyBitmapIter *dbi;
      uint8_t *buf;
-@@ -696,7 +698,8 @@ static int mirror_exit_common(Job *job)
+@@ -695,7 +697,8 @@ static int mirror_exit_common(Job *job)
      bdrv_child_refresh_perms(mirror_top_bs, mirror_top_bs->backing,
                               &error_abort);
      if (!abort && s->backing_mode == MIRROR_SOURCE_BACKING_CHAIN) {
@@ -67,7 +67,7 @@ index 3c4ab1159d..f2eca983f1 100644
          BlockDriverState *unfiltered_target = bdrv_skip_filters(target_bs);
  
          if (bdrv_cow_bs(unfiltered_target) != backing) {
-@@ -794,6 +797,16 @@ static void mirror_abort(Job *job)
+@@ -800,6 +803,16 @@ static void mirror_abort(Job *job)
      assert(ret == 0);
  }
  
@@ -84,7 +84,7 @@ index 3c4ab1159d..f2eca983f1 100644
  static void coroutine_fn mirror_throttle(MirrorBlockJob *s)
  {
      int64_t now = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);
-@@ -973,7 +986,8 @@ static int coroutine_fn mirror_run(Job *job, Error **errp)
+@@ -979,7 +992,8 @@ static int coroutine_fn mirror_run(Job *job, Error **errp)
      mirror_free_init(s);
  
      s->last_pause_ns = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);
@@ -94,7 +94,7 @@ index 3c4ab1159d..f2eca983f1 100644
          ret = mirror_dirty_init(s);
          if (ret < 0 || job_is_cancelled(&s->common.job)) {
              goto immediate_exit;
-@@ -1212,6 +1226,7 @@ static const BlockJobDriver mirror_job_driver = {
+@@ -1221,6 +1235,7 @@ static const BlockJobDriver mirror_job_driver = {
          .run                    = mirror_run,
          .prepare                = mirror_prepare,
          .abort                  = mirror_abort,
@@ -102,7 +102,7 @@ index 3c4ab1159d..f2eca983f1 100644
          .pause                  = mirror_pause,
          .complete               = mirror_complete,
          .cancel                 = mirror_cancel,
-@@ -1228,6 +1243,7 @@ static const BlockJobDriver commit_active_job_driver = {
+@@ -1237,6 +1252,7 @@ static const BlockJobDriver commit_active_job_driver = {
          .run                    = mirror_run,
          .prepare                = mirror_prepare,
          .abort                  = mirror_abort,
@@ -110,7 +110,7 @@ index 3c4ab1159d..f2eca983f1 100644
          .pause                  = mirror_pause,
          .complete               = mirror_complete,
          .cancel                 = commit_active_cancel,
-@@ -1593,7 +1609,10 @@ static BlockJob *mirror_start_job(
+@@ -1602,7 +1618,10 @@ static BlockJob *mirror_start_job(
                               BlockCompletionFunc *cb,
                               void *opaque,
                               const BlockJobDriver *driver,
@@ -122,12 +122,11 @@ index 3c4ab1159d..f2eca983f1 100644
                               bool auto_complete, const char *filter_node_name,
                               bool is_mirror, MirrorCopyMode copy_mode,
                               Error **errp)
-@@ -1605,10 +1624,39 @@ static BlockJob *mirror_start_job(
+@@ -1614,10 +1633,39 @@ static BlockJob *mirror_start_job(
      uint64_t target_perms, target_shared_perms;
      int ret;
  
 -    if (granularity == 0) {
--        granularity = bdrv_get_default_bitmap_granularity(target);
 +    if (sync_mode == MIRROR_SYNC_MODE_INCREMENTAL) {
 +        error_setg(errp, "Sync mode '%s' not supported",
 +                   MirrorSyncMode_str(sync_mode));
@@ -148,8 +147,8 @@ index 3c4ab1159d..f2eca983f1 100644
 +                   "sync mode '%s' is not compatible with bitmaps",
 +                   MirrorSyncMode_str(sync_mode));
 +        return NULL;
-     }
- 
++    }
++
 +    if (bitmap) {
 +        if (granularity) {
 +            error_setg(errp, "granularity (%d)"
@@ -159,12 +158,13 @@ index 3c4ab1159d..f2eca983f1 100644
 +        }
 +        granularity = bdrv_dirty_bitmap_granularity(bitmap);
 +    } else if (granularity == 0) {
-+        granularity = bdrv_get_default_bitmap_granularity(target);
-+    }
+         granularity = bdrv_get_default_bitmap_granularity(target);
+     }
+-
      assert(is_power_of_2(granularity));
  
      if (buf_size < 0) {
-@@ -1740,7 +1788,9 @@ static BlockJob *mirror_start_job(
+@@ -1755,7 +1803,9 @@ static BlockJob *mirror_start_job(
      s->replaces = g_strdup(replaces);
      s->on_source_error = on_source_error;
      s->on_target_error = on_target_error;
@@ -175,7 +175,7 @@ index 3c4ab1159d..f2eca983f1 100644
      s->backing_mode = backing_mode;
      s->zero_target = zero_target;
      s->copy_mode = copy_mode;
-@@ -1761,6 +1811,18 @@ static BlockJob *mirror_start_job(
+@@ -1776,6 +1826,18 @@ static BlockJob *mirror_start_job(
          bdrv_disable_dirty_bitmap(s->dirty_bitmap);
      }
  
@@ -194,7 +194,7 @@ index 3c4ab1159d..f2eca983f1 100644
      ret = block_job_add_bdrv(&s->common, "source", bs, 0,
                               BLK_PERM_WRITE_UNCHANGED | BLK_PERM_WRITE |
                               BLK_PERM_CONSISTENT_READ,
-@@ -1838,6 +1900,9 @@ fail:
+@@ -1853,6 +1915,9 @@ fail:
          if (s->dirty_bitmap) {
              bdrv_release_dirty_bitmap(s->dirty_bitmap);
          }
@@ -204,7 +204,7 @@ index 3c4ab1159d..f2eca983f1 100644
          job_early_fail(&s->common.job);
      }
  
-@@ -1855,31 +1920,25 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
+@@ -1870,29 +1935,23 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
                    BlockDriverState *target, const char *replaces,
                    int creation_flags, int64_t speed,
                    uint32_t granularity, int64_t buf_size,
@@ -221,8 +221,6 @@ index 3c4ab1159d..f2eca983f1 100644
 -    bool is_none_mode;
      BlockDriverState *base;
  
-     GLOBAL_STATE_CODE();
- 
 -    if ((mode == MIRROR_SYNC_MODE_INCREMENTAL) ||
 -        (mode == MIRROR_SYNC_MODE_BITMAP)) {
 -        error_setg(errp, "Sync mode '%s' not supported",
@@ -241,7 +239,7 @@ index 3c4ab1159d..f2eca983f1 100644
  }
  
  BlockJob *commit_active_start(const char *job_id, BlockDriverState *bs,
-@@ -1906,7 +1965,8 @@ BlockJob *commit_active_start(const char *job_id, BlockDriverState *bs,
+@@ -1917,7 +1976,8 @@ BlockJob *commit_active_start(const char *job_id, BlockDriverState *bs,
                       job_id, bs, creation_flags, base, NULL, speed, 0, 0,
                       MIRROR_LEAVE_BACKING_CHAIN, false,
                       on_error, on_error, true, cb, opaque,
@@ -252,10 +250,10 @@ index 3c4ab1159d..f2eca983f1 100644
                       errp);
      if (!job) {
 diff --git a/blockdev.c b/blockdev.c
-index 9230888e34..9a1a3118ed 100644
+index b35072644e..9940116fe0 100644
 --- a/blockdev.c
 +++ b/blockdev.c
-@@ -2951,6 +2951,10 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
+@@ -2956,6 +2956,10 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
                                     BlockDriverState *target,
                                     bool has_replaces, const char *replaces,
                                     enum MirrorSyncMode sync,
@@ -266,7 +264,7 @@ index 9230888e34..9a1a3118ed 100644
                                     BlockMirrorBackingMode backing_mode,
                                     bool zero_target,
                                     bool has_speed, int64_t speed,
-@@ -2970,6 +2974,7 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
+@@ -2975,6 +2979,7 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
  {
      BlockDriverState *unfiltered_bs;
      int job_flags = JOB_DEFAULT;
@@ -274,7 +272,7 @@ index 9230888e34..9a1a3118ed 100644
  
      if (!has_speed) {
          speed = 0;
-@@ -3024,6 +3029,29 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
+@@ -3029,6 +3034,29 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
          sync = MIRROR_SYNC_MODE_FULL;
      }
  
@@ -304,7 +302,7 @@ index 9230888e34..9a1a3118ed 100644
      if (!has_replaces) {
          /* We want to mirror from @bs, but keep implicit filters on top */
          unfiltered_bs = bdrv_skip_implicit_filters(bs);
-@@ -3070,8 +3098,8 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
+@@ -3075,8 +3103,8 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
       * and will allow to check whether the node still exist at mirror completion
       */
      mirror_start(job_id, bs, target,
@@ -315,7 +313,7 @@ index 9230888e34..9a1a3118ed 100644
                   on_source_error, on_target_error, unmap, filter_node_name,
                   copy_mode, errp);
  }
-@@ -3216,6 +3244,8 @@ void qmp_drive_mirror(DriveMirror *arg, Error **errp)
+@@ -3221,6 +3249,8 @@ void qmp_drive_mirror(DriveMirror *arg, Error **errp)
  
      blockdev_mirror_common(arg->has_job_id ? arg->job_id : NULL, bs, target_bs,
                             arg->has_replaces, arg->replaces, arg->sync,
@@ -324,7 +322,7 @@ index 9230888e34..9a1a3118ed 100644
                             backing_mode, zero_target,
                             arg->has_speed, arg->speed,
                             arg->has_granularity, arg->granularity,
-@@ -3237,6 +3267,8 @@ void qmp_blockdev_mirror(bool has_job_id, const char *job_id,
+@@ -3242,6 +3272,8 @@ void qmp_blockdev_mirror(bool has_job_id, const char *job_id,
                           const char *device, const char *target,
                           bool has_replaces, const char *replaces,
                           MirrorSyncMode sync,
@@ -333,7 +331,7 @@ index 9230888e34..9a1a3118ed 100644
                           bool has_speed, int64_t speed,
                           bool has_granularity, uint32_t granularity,
                           bool has_buf_size, int64_t buf_size,
-@@ -3286,7 +3318,8 @@ void qmp_blockdev_mirror(bool has_job_id, const char *job_id,
+@@ -3291,7 +3323,8 @@ void qmp_blockdev_mirror(bool has_job_id, const char *job_id,
      }
  
      blockdev_mirror_common(has_job_id ? job_id : NULL, bs, target_bs,
@@ -343,11 +341,11 @@ index 9230888e34..9a1a3118ed 100644
                             zero_target, has_speed, speed,
                             has_granularity, granularity,
                             has_buf_size, buf_size,
-diff --git a/include/block/block_int-global-state.h b/include/block/block_int-global-state.h
-index b49f4eb35b..9d744db618 100644
---- a/include/block/block_int-global-state.h
-+++ b/include/block/block_int-global-state.h
-@@ -149,7 +149,9 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
+diff --git a/include/block/block_int.h b/include/block/block_int.h
+index f4c75e8ba9..ee0aeb1414 100644
+--- a/include/block/block_int.h
++++ b/include/block/block_int.h
+@@ -1287,7 +1287,9 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
                    BlockDriverState *target, const char *replaces,
                    int creation_flags, int64_t speed,
                    uint32_t granularity, int64_t buf_size,
@@ -359,10 +357,10 @@ index b49f4eb35b..9d744db618 100644
                    BlockdevOnError on_source_error,
                    BlockdevOnError on_target_error,
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 2173e7734a..e1857e7094 100644
+index 1d3dd9cb48..da5dca1e3b 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -2000,10 +2000,19 @@
+@@ -1995,10 +1995,19 @@
  #        (all the disk, only the sectors allocated in the topmost image, or
  #        only new I/O).
  #
@@ -383,7 +381,7 @@ index 2173e7734a..e1857e7094 100644
  #
  # @buf-size: maximum amount of data in flight from source to
  #            target (since 1.4).
-@@ -2043,7 +2052,9 @@
+@@ -2036,7 +2045,9 @@
  { 'struct': 'DriveMirror',
    'data': { '*job-id': 'str', 'device': 'str', 'target': 'str',
              '*format': 'str', '*node-name': 'str', '*replaces': 'str',
@@ -394,7 +392,7 @@ index 2173e7734a..e1857e7094 100644
              '*speed': 'int', '*granularity': 'uint32',
              '*buf-size': 'int', '*on-source-error': 'BlockdevOnError',
              '*on-target-error': 'BlockdevOnError',
-@@ -2322,10 +2333,19 @@
+@@ -2308,10 +2319,19 @@
  #        (all the disk, only the sectors allocated in the topmost image, or
  #        only new I/O).
  #
@@ -415,7 +413,7 @@ index 2173e7734a..e1857e7094 100644
  #
  # @buf-size: maximum amount of data in flight from source to
  #            target
-@@ -2375,7 +2395,8 @@
+@@ -2360,7 +2380,8 @@
  { 'command': 'blockdev-mirror',
    'data': { '*job-id': 'str', 'device': 'str', 'target': 'str',
              '*replaces': 'str',
@@ -426,10 +424,10 @@ index 2173e7734a..e1857e7094 100644
              '*buf-size': 'int', '*on-source-error': 'BlockdevOnError',
              '*on-target-error': 'BlockdevOnError',
 diff --git a/tests/unit/test-block-iothread.c b/tests/unit/test-block-iothread.c
-index 8b55eccc89..f4650be8e5 100644
+index aea660aeed..22b9770a3e 100644
 --- a/tests/unit/test-block-iothread.c
 +++ b/tests/unit/test-block-iothread.c
-@@ -753,8 +753,8 @@ static void test_propagate_mirror(void)
+@@ -626,8 +626,8 @@ static void test_propagate_mirror(void)
  
      /* Start a mirror job */
      mirror_start("job0", src, target, NULL, JOB_DEFAULT, 0, 0, 0,

debian/patches/bitmap-mirror/0002-drive-mirror-add-support-for-conditional-and-always-.patch

@@ -24,10 +24,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 18 insertions(+), 6 deletions(-)
 
 diff --git a/block/mirror.c b/block/mirror.c
-index f2eca983f1..b6475d50ad 100644
+index f7804638f9..4f5f74e2cf 100644
 --- a/block/mirror.c
 +++ b/block/mirror.c
-@@ -673,8 +673,6 @@ static int mirror_exit_common(Job *job)
+@@ -672,8 +672,6 @@ static int mirror_exit_common(Job *job)
          bdrv_unfreeze_backing_chain(mirror_top_bs, target_bs);
      }
  
@@ -36,9 +36,9 @@ index f2eca983f1..b6475d50ad 100644
      /* Make sure that the source BDS doesn't go away during bdrv_replace_node,
       * before we can call bdrv_drained_end */
      bdrv_ref(src);
-@@ -775,6 +773,18 @@ static int mirror_exit_common(Job *job)
-     block_job_remove_all_bdrv(bjob);
-     bdrv_replace_node(mirror_top_bs, mirror_top_bs->backing->bs, &error_abort);
+@@ -781,6 +779,18 @@ static int mirror_exit_common(Job *job)
+     blk_set_perm(bjob->blk, 0, BLK_PERM_ALL, &error_abort);
+     blk_insert_bs(bjob->blk, mirror_top_bs, &error_abort);
  
 +    if (s->sync_bitmap) {
 +        if (s->bitmap_mode == BITMAP_SYNC_MODE_ALWAYS ||
@@ -55,7 +55,7 @@ index f2eca983f1..b6475d50ad 100644
      bs_opaque->job = NULL;
  
      bdrv_drained_end(src);
-@@ -1634,10 +1644,6 @@ static BlockJob *mirror_start_job(
+@@ -1643,10 +1653,6 @@ static BlockJob *mirror_start_job(
                         " sync mode",
                         MirrorSyncMode_str(sync_mode));
              return NULL;
@@ -66,7 +66,7 @@ index f2eca983f1..b6475d50ad 100644
          }
      } else if (bitmap) {
          error_setg(errp,
-@@ -1654,6 +1660,12 @@ static BlockJob *mirror_start_job(
+@@ -1663,6 +1669,12 @@ static BlockJob *mirror_start_job(
              return NULL;
          }
          granularity = bdrv_dirty_bitmap_granularity(bitmap);

debian/patches/bitmap-mirror/0003-mirror-add-check-for-bitmap-mode-without-bitmap.patch

@@ -16,10 +16,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 3 insertions(+)
 
 diff --git a/blockdev.c b/blockdev.c
-index 9a1a3118ed..a57b0af2e7 100644
+index 9940116fe0..b113e57d68 100644
 --- a/blockdev.c
 +++ b/blockdev.c
-@@ -3050,6 +3050,9 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
+@@ -3055,6 +3055,9 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
          if (bdrv_dirty_bitmap_check(bitmap, BDRV_BITMAP_ALLOW_RO, errp)) {
              return;
          }

debian/patches/bitmap-mirror/0004-mirror-switch-to-bdrv_dirty_bitmap_merge_internal.patch

@@ -16,10 +16,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 4 insertions(+), 7 deletions(-)
 
 diff --git a/block/mirror.c b/block/mirror.c
-index b6475d50ad..8b3342f9ec 100644
+index 4f5f74e2cf..7024f3bbf0 100644
 --- a/block/mirror.c
 +++ b/block/mirror.c
-@@ -779,8 +779,8 @@ static int mirror_exit_common(Job *job)
+@@ -785,8 +785,8 @@ static int mirror_exit_common(Job *job)
               job->ret == 0 && ret == 0)) {
              /* Success; synchronize copy back to sync. */
              bdrv_clear_dirty_bitmap(s->sync_bitmap, NULL);
@@ -30,7 +30,7 @@ index b6475d50ad..8b3342f9ec 100644
          }
      }
      bdrv_release_dirty_bitmap(s->dirty_bitmap);
-@@ -1828,11 +1828,8 @@ static BlockJob *mirror_start_job(
+@@ -1843,11 +1843,8 @@ static BlockJob *mirror_start_job(
      }
  
      if (s->sync_mode == MIRROR_SYNC_MODE_BITMAP) {

debian/patches/bitmap-mirror/0006-mirror-move-some-checks-to-qmp.patch

@@ -19,10 +19,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  3 files changed, 70 insertions(+), 59 deletions(-)
 
 diff --git a/block/mirror.c b/block/mirror.c
-index 8b3342f9ec..1d4ff0efad 100644
+index 7024f3bbf0..6211ff22fc 100644
 --- a/block/mirror.c
 +++ b/block/mirror.c
-@@ -1634,31 +1634,13 @@ static BlockJob *mirror_start_job(
+@@ -1643,31 +1643,13 @@ static BlockJob *mirror_start_job(
      uint64_t target_perms, target_shared_perms;
      int ret;
  
@@ -60,10 +60,10 @@ index 8b3342f9ec..1d4ff0efad 100644
  
          if (bitmap_mode != BITMAP_SYNC_MODE_NEVER) {
 diff --git a/blockdev.c b/blockdev.c
-index a57b0af2e7..ce62a9b439 100644
+index b113e57d68..4be0863050 100644
 --- a/blockdev.c
 +++ b/blockdev.c
-@@ -3029,7 +3029,36 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
+@@ -3034,7 +3034,36 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
          sync = MIRROR_SYNC_MODE_FULL;
      }
  

debian/patches/extra/0001-monitor-qmp-fix-race-with-clients-disconnecting-earl.patch

@@ -48,7 +48,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  6 files changed, 59 insertions(+), 5 deletions(-)
 
 diff --git a/include/monitor/monitor.h b/include/monitor/monitor.h
-index a4b40e8391..d64ae8f34e 100644
+index 12d395d62d..b182943324 100644
 --- a/include/monitor/monitor.h
 +++ b/include/monitor/monitor.h
 @@ -16,6 +16,7 @@ extern QemuOptsList qemu_mon_opts;
@@ -60,10 +60,10 @@ index a4b40e8391..d64ae8f34e 100644
  void monitor_init_globals(void);
  void monitor_init_globals_core(void);
 diff --git a/monitor/monitor-internal.h b/monitor/monitor-internal.h
-index caa2e90ef2..e1596f79ab 100644
+index 3da3f86c6a..9953e0cd2d 100644
 --- a/monitor/monitor-internal.h
 +++ b/monitor/monitor-internal.h
-@@ -152,6 +152,13 @@ typedef struct {
+@@ -151,6 +151,13 @@ typedef struct {
      QemuMutex qmp_queue_lock;
      /* Input queue that holds all the parsed QMP requests */
      GQueue *qmp_requests;
@@ -78,7 +78,7 @@ index caa2e90ef2..e1596f79ab 100644
  
  /**
 diff --git a/monitor/monitor.c b/monitor/monitor.c
-index 86949024f6..c306cadcf4 100644
+index 21c7a68758..ad9813567a 100644
 --- a/monitor/monitor.c
 +++ b/monitor/monitor.c
 @@ -135,6 +135,21 @@ bool monitor_cur_is_qmp(void)
@@ -144,10 +144,10 @@ index 092c527b6f..6b8cfcf6d8 100644
          monitor_qmp_caps_reset(mon);
          data = qmp_greeting(mon);
 diff --git a/qapi/qmp-dispatch.c b/qapi/qmp-dispatch.c
-index 0990873ec8..e605003771 100644
+index d378bccac7..fb8936e7cd 100644
 --- a/qapi/qmp-dispatch.c
 +++ b/qapi/qmp-dispatch.c
-@@ -117,16 +117,28 @@ typedef struct QmpDispatchBH {
+@@ -118,16 +118,28 @@ typedef struct QmpDispatchBH {
      QObject **ret;
      Error **errp;
      Coroutine *co;
@@ -180,7 +180,7 @@ index 0990873ec8..e605003771 100644
      aio_co_wake(data->co);
  }
  
-@@ -231,6 +243,7 @@ QDict *qmp_dispatch(const QmpCommandList *cmds, QObject *request,
+@@ -232,6 +244,7 @@ QDict *qmp_dispatch(const QmpCommandList *cmds, QObject *request,
              .ret        = &ret,
              .errp       = &err,
              .co         = qemu_coroutine_self(),
@@ -189,10 +189,10 @@ index 0990873ec8..e605003771 100644
          aio_bh_schedule_oneshot(qemu_get_aio_context(), do_qmp_dispatch_bh,
                                  &data);
 diff --git a/stubs/monitor-core.c b/stubs/monitor-core.c
-index afa477aae6..d3ff124bf3 100644
+index d058a2a00d..3290b58120 100644
 --- a/stubs/monitor-core.c
 +++ b/stubs/monitor-core.c
-@@ -12,6 +12,11 @@ Monitor *monitor_set_cur(Coroutine *co, Monitor *mon)
+@@ -13,6 +13,11 @@ Monitor *monitor_set_cur(Coroutine *co, Monitor *mon)
      return NULL;
  }
  

debian/patches/extra/0002-block-io_uring-revert-Use-io_uring_register_ring_fd-.patch

@@ -1,76 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Sam Li <faithilikerun@gmail.com>
-Date: Sat, 24 Sep 2022 22:48:15 +0800
-Subject: [PATCH] block/io_uring: revert "Use io_uring_register_ring_fd() to
- skip fd operations"
-
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1193
-
-The commit "Use io_uring_register_ring_fd() to skip fd operations" broke
-when booting a guest with iothread and io_uring. That is because the
-io_uring_register_ring_fd() call is made from the main thread instead of
-IOThread where io_uring_submit() is called. It can not be guaranteed
-to register the ring fd in the correct thread or unregister the same ring
-fd if the IOThread is disabled. This optimization is not critical so we
-will revert previous commit.
-
-This reverts commit e2848bc574fe2715c694bf8fe9a1ba7f78a1125a
-and 77e3f038af1764983087e3551a0fde9951952c4d.
-
-Signed-off-by: Sam Li <faithilikerun@gmail.com>
----
- block/io_uring.c | 13 +------------
- meson.build      |  1 -
- 2 files changed, 1 insertion(+), 13 deletions(-)
-
-diff --git a/block/io_uring.c b/block/io_uring.c
-index a1760152e0..973e15d876 100644
---- a/block/io_uring.c
-+++ b/block/io_uring.c
-@@ -11,7 +11,6 @@
- #include "qemu/osdep.h"
- #include <liburing.h>
- #include "block/aio.h"
--#include "qemu/error-report.h"
- #include "qemu/queue.h"
- #include "block/block.h"
- #include "block/raw-aio.h"
-@@ -19,7 +18,6 @@
- #include "qapi/error.h"
- #include "trace.h"
- 
--
- /* io_uring ring size */
- #define MAX_ENTRIES 128
- 
-@@ -432,17 +430,8 @@ LuringState *luring_init(Error **errp)
-     }
- 
-     ioq_init(&s->io_q);
--#ifdef CONFIG_LIBURING_REGISTER_RING_FD
--    if (io_uring_register_ring_fd(&s->ring) < 0) {
--        /*
--         * Only warn about this error: we will fallback to the non-optimized
--         * io_uring operations.
--         */
--        warn_report("failed to register linux io_uring ring file descriptor");
--    }
--#endif
--
-     return s;
-+
- }
- 
- void luring_cleanup(LuringState *s)
-diff --git a/meson.build b/meson.build
-index 20fddbd707..d5230eadd6 100644
---- a/meson.build
-+++ b/meson.build
-@@ -1793,7 +1793,6 @@ config_host_data.set('CONFIG_LIBNFS', libnfs.found())
- config_host_data.set('CONFIG_LIBSSH', libssh.found())
- config_host_data.set('CONFIG_LINUX_AIO', libaio.found())
- config_host_data.set('CONFIG_LINUX_IO_URING', linux_io_uring.found())
--config_host_data.set('CONFIG_LIBURING_REGISTER_RING_FD', cc.has_function('io_uring_register_ring_fd', prefix: '#include <liburing.h>', dependencies:linux_io_uring))
- config_host_data.set('CONFIG_LIBPMEM', libpmem.found())
- config_host_data.set('CONFIG_NUMA', numa.found())
- config_host_data.set('CONFIG_OPENGL', opengl.found())

debian/patches/extra/0002-monitor-hmp-add-support-for-flag-argument-with-value.patch

@@ -0,0 +1,55 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Stefan Reiter <s.reiter@proxmox.com>
+Date: Wed, 1 Sep 2021 16:51:04 +0200
+Subject: [PATCH] monitor/hmp: add support for flag argument with value
+
+Adds support for the "-xS" parameter type, where "-x" denotes a flag
+name and the "S" suffix indicates that this flag is supposed to take an
+arbitrary string parameter.
+
+These parameters are always optional, the entry in the qdict will be
+omitted if the flag is not given.
+
+Reviewed-by: Eric Blake <eblake@redhat.com>
+Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+---
+ monitor/hmp.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/monitor/hmp.c b/monitor/hmp.c
+index b20737e63c..b29dbb1833 100644
+--- a/monitor/hmp.c
++++ b/monitor/hmp.c
+@@ -981,6 +981,7 @@ static QDict *monitor_parse_arguments(Monitor *mon,
+             {
+                 const char *tmp = p;
+                 int skip_key = 0;
++                int ret;
+                 /* option */
+ 
+                 c = *typestr++;
+@@ -1003,8 +1004,22 @@ static QDict *monitor_parse_arguments(Monitor *mon,
+                     }
+                     if (skip_key) {
+                         p = tmp;
++                    } else if (*typestr == 'S') {
++                        /* has option with string value */
++                        typestr++;
++                        tmp = p++;
++                        while (qemu_isspace(*p)) {
++                            p++;
++                        }
++                        ret = get_str(buf, sizeof(buf), &p);
++                        if (ret < 0) {
++                            monitor_printf(mon, "%s: value expected for -%c\n",
++                                           cmd->name, *tmp);
++                            goto fail;
++                        }
++                        qdict_put_str(qdict, key, buf);
+                     } else {
+-                        /* has option */
++                        /* has boolean option */
+                         p++;
+                         qdict_put_bool(qdict, key, true);
+                     }

debian/patches/extra/0003-monitor-refactor-set-expire_password-and-allow-VNC-d.patch

@@ -0,0 +1,477 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Stefan Reiter <s.reiter@proxmox.com>
+Date: Wed, 25 Aug 2021 11:14:13 +0200
+Subject: [PATCH] monitor: refactor set/expire_password and allow VNC display
+ id
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+It is possible to specify more than one VNC server on the command line,
+either with an explicit ID or the auto-generated ones à la "default",
+"vnc2", "vnc3", ...
+
+It is not possible to change the password on one of these extra VNC
+displays though. Fix this by adding a "display" parameter to the
+"set_password" and "expire_password" QMP and HMP commands.
+
+For HMP, the display is specified using the "-d" value flag.
+
+For QMP, the schema is updated to explicitly express the supported
+variants of the commands with protocol-discriminated unions.
+
+Suggested-by: Eric Blake <eblake@redhat.com>
+Suggested-by: Markus Armbruster <armbru@redhat.com>
+Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
+---
+ hmp-commands.hx    |  24 ++++---
+ monitor/hmp-cmds.c |  57 +++++++++++++++-
+ monitor/qmp-cmds.c |  62 ++++++-----------
+ qapi/ui.json       | 165 ++++++++++++++++++++++++++++++++++++++-------
+ 4 files changed, 231 insertions(+), 77 deletions(-)
+
+diff --git a/hmp-commands.hx b/hmp-commands.hx
+index 70a9136ac2..5efb47fc32 100644
+--- a/hmp-commands.hx
++++ b/hmp-commands.hx
+@@ -1514,33 +1514,35 @@ ERST
+ 
+     {
+         .name       = "set_password",
+-        .args_type  = "protocol:s,password:s,connected:s?",
+-        .params     = "protocol password action-if-connected",
++        .args_type  = "protocol:s,password:s,display:-dS,connected:s?",
++        .params     = "protocol password [-d display] [action-if-connected]",
+         .help       = "set spice/vnc password",
+         .cmd        = hmp_set_password,
+     },
+ 
+ SRST
+-``set_password [ vnc | spice ] password [ action-if-connected ]``
+-  Change spice/vnc password.  *action-if-connected* specifies what
+-  should happen in case a connection is established: *fail* makes the
+-  password change fail.  *disconnect* changes the password and
++``set_password [ vnc | spice ] password [ -d display ] [ action-if-connected ]``
++  Change spice/vnc password.  *display* can be used with 'vnc' to specify
++  which display to set the password on.  *action-if-connected* specifies
++  what should happen in case a connection is established: *fail* makes
++  the password change fail.  *disconnect* changes the password and
+   disconnects the client.  *keep* changes the password and keeps the
+   connection up.  *keep* is the default.
+ ERST
+ 
+     {
+         .name       = "expire_password",
+-        .args_type  = "protocol:s,time:s",
+-        .params     = "protocol time",
++        .args_type  = "protocol:s,time:s,display:-dS",
++        .params     = "protocol time [-d display]",
+         .help       = "set spice/vnc password expire-time",
+         .cmd        = hmp_expire_password,
+     },
+ 
+ SRST
+-``expire_password [ vnc | spice ]`` *expire-time*
+-  Specify when a password for spice/vnc becomes
+-  invalid. *expire-time* accepts:
++``expire_password [ vnc | spice ] expire-time [ -d display ]``
++  Specify when a password for spice/vnc becomes invalid.
++  *display* behaves the same as in ``set_password``.
++  *expire-time* accepts:
+ 
+   ``now``
+     Invalidate password instantly.
+diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
+index 9c91bf93e9..2e91ccb738 100644
+--- a/monitor/hmp-cmds.c
++++ b/monitor/hmp-cmds.c
+@@ -1384,10 +1384,41 @@ void hmp_set_password(Monitor *mon, const QDict *qdict)
+ {
+     const char *protocol  = qdict_get_str(qdict, "protocol");
+     const char *password  = qdict_get_str(qdict, "password");
++    const char *display = qdict_get_try_str(qdict, "display");
+     const char *connected = qdict_get_try_str(qdict, "connected");
+     Error *err = NULL;
++    DisplayProtocol proto;
+ 
+-    qmp_set_password(protocol, password, !!connected, connected, &err);
++    SetPasswordOptions opts = {
++        .password = g_strdup(password),
++        .u.vnc.display = NULL,
++    };
++
++    proto = qapi_enum_parse(&DisplayProtocol_lookup, protocol,
++                            DISPLAY_PROTOCOL_VNC, &err);
++    if (err) {
++        hmp_handle_error(mon, err);
++        return;
++    }
++    opts.protocol = proto;
++
++    if (proto == DISPLAY_PROTOCOL_VNC) {
++        opts.u.vnc.has_display = !!display;
++        opts.u.vnc.display = g_strdup(display);
++    } else if (proto == DISPLAY_PROTOCOL_SPICE) {
++        opts.u.spice.has_connected = !!connected;
++        opts.u.spice.connected =
++            qapi_enum_parse(&SetPasswordAction_lookup, connected,
++                            SET_PASSWORD_ACTION_KEEP, &err);
++        if (err) {
++            hmp_handle_error(mon, err);
++            return;
++        }
++    }
++
++    qmp_set_password(&opts, &err);
++    g_free(opts.password);
++    g_free(opts.u.vnc.display);
+     hmp_handle_error(mon, err);
+ }
+ 
+@@ -1395,9 +1426,31 @@ void hmp_expire_password(Monitor *mon, const QDict *qdict)
+ {
+     const char *protocol  = qdict_get_str(qdict, "protocol");
+     const char *whenstr = qdict_get_str(qdict, "time");
++    const char *display = qdict_get_try_str(qdict, "display");
+     Error *err = NULL;
++    DisplayProtocol proto;
+ 
+-    qmp_expire_password(protocol, whenstr, &err);
++    ExpirePasswordOptions opts = {
++        .time = g_strdup(whenstr),
++        .u.vnc.display = NULL,
++    };
++
++    proto = qapi_enum_parse(&DisplayProtocol_lookup, protocol,
++                            DISPLAY_PROTOCOL_VNC, &err);
++    if (err) {
++        hmp_handle_error(mon, err);
++        return;
++    }
++    opts.protocol = proto;
++
++    if (proto == DISPLAY_PROTOCOL_VNC) {
++        opts.u.vnc.has_display = !!display;
++        opts.u.vnc.display = g_strdup(display);
++    }
++
++    qmp_expire_password(&opts, &err);
++    g_free(opts.time);
++    g_free(opts.u.vnc.display);
+     hmp_handle_error(mon, err);
+ }
+ 
+diff --git a/monitor/qmp-cmds.c b/monitor/qmp-cmds.c
+index 343353e27a..729ca7cceb 100644
+--- a/monitor/qmp-cmds.c
++++ b/monitor/qmp-cmds.c
+@@ -167,45 +167,30 @@ void qmp_system_wakeup(Error **errp)
+     qemu_system_wakeup_request(QEMU_WAKEUP_REASON_OTHER, errp);
+ }
+ 
+-void qmp_set_password(const char *protocol, const char *password,
+-                      bool has_connected, const char *connected, Error **errp)
++void qmp_set_password(SetPasswordOptions *opts, Error **errp)
+ {
+-    int disconnect_if_connected = 0;
+-    int fail_if_connected = 0;
+-    int rc;
++    bool disconnect_if_connected = false;
++    bool fail_if_connected = false;
++    int rc = 0;
+ 
+-    if (has_connected) {
+-        if (strcmp(connected, "fail") == 0) {
+-            fail_if_connected = 1;
+-        } else if (strcmp(connected, "disconnect") == 0) {
+-            disconnect_if_connected = 1;
+-        } else if (strcmp(connected, "keep") == 0) {
+-            /* nothing */
+-        } else {
+-            error_setg(errp, QERR_INVALID_PARAMETER, "connected");
+-            return;
+-        }
+-    }
+-
+-    if (strcmp(protocol, "spice") == 0) {
++    if (opts->protocol == DISPLAY_PROTOCOL_SPICE) {
+         if (!qemu_using_spice(errp)) {
+             return;
+         }
+-        rc = qemu_spice.set_passwd(password, fail_if_connected,
++        if (opts->u.spice.has_connected) {
++            fail_if_connected =
++                opts->u.spice.connected == SET_PASSWORD_ACTION_FAIL;
++            disconnect_if_connected =
++                opts->u.spice.connected == SET_PASSWORD_ACTION_DISCONNECT;
++        }
++        rc = qemu_spice.set_passwd(opts->password, fail_if_connected,
+                                    disconnect_if_connected);
+-    } else if (strcmp(protocol, "vnc") == 0) {
+-        if (fail_if_connected || disconnect_if_connected) {
+-            /* vnc supports "connected=keep" only */
+-            error_setg(errp, QERR_INVALID_PARAMETER, "connected");
+-            return;
+-        }
++    } else if (opts->protocol == DISPLAY_PROTOCOL_VNC) {
+         /* Note that setting an empty password will not disable login through
+          * this interface. */
+-        rc = vnc_display_password(NULL, password);
+-    } else {
+-        error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "protocol",
+-                   "'vnc' or 'spice'");
+-        return;
++        rc = vnc_display_password(
++                opts->u.vnc.has_display ? opts->u.vnc.display : NULL,
++                opts->password);
+     }
+ 
+     if (rc != 0) {
+@@ -213,11 +198,11 @@ void qmp_set_password(const char *protocol, const char *password,
+     }
+ }
+ 
+-void qmp_expire_password(const char *protocol, const char *whenstr,
+-                         Error **errp)
++void qmp_expire_password(ExpirePasswordOptions *opts, Error **errp)
+ {
+     time_t when;
+     int rc;
++    const char* whenstr = opts->time;
+ 
+     if (strcmp(whenstr, "now") == 0) {
+         when = 0;
+@@ -229,17 +214,14 @@ void qmp_expire_password(const char *protocol, const char *whenstr,
+         when = strtoull(whenstr, NULL, 10);
+     }
+ 
+-    if (strcmp(protocol, "spice") == 0) {
++    if (opts->protocol == DISPLAY_PROTOCOL_SPICE) {
+         if (!qemu_using_spice(errp)) {
+             return;
+         }
+         rc = qemu_spice.set_pw_expire(when);
+-    } else if (strcmp(protocol, "vnc") == 0) {
+-        rc = vnc_display_pw_expire(NULL, when);
+-    } else {
+-        error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "protocol",
+-                   "'vnc' or 'spice'");
+-        return;
++    } else if (opts->protocol == DISPLAY_PROTOCOL_VNC) {
++        rc = vnc_display_pw_expire(
++                opts->u.vnc.has_display ? opts->u.vnc.display : NULL, when);
+     }
+ 
+     if (rc != 0) {
+diff --git a/qapi/ui.json b/qapi/ui.json
+index d7567ac866..4244c62c30 100644
+--- a/qapi/ui.json
++++ b/qapi/ui.json
+@@ -9,22 +9,23 @@
+ { 'include': 'common.json' }
+ { 'include': 'sockets.json' }
+ 
++##
++# @DisplayProtocol:
++#
++# Display protocols which support changing password options.
++#
++# Since: 6.2
++#
++##
++{ 'enum': 'DisplayProtocol',
++  'data': [ { 'name': 'vnc', 'if': 'CONFIG_VNC' },
++            { 'name': 'spice', 'if': 'CONFIG_SPICE' } ] }
++
+ ##
+ # @set_password:
+ #
+ # Sets the password of a remote display session.
+ #
+-# @protocol: - 'vnc' to modify the VNC server password
+-#            - 'spice' to modify the Spice server password
+-#
+-# @password: the new password
+-#
+-# @connected: how to handle existing clients when changing the
+-#             password.  If nothing is specified, defaults to 'keep'
+-#             'fail' to fail the command if clients are connected
+-#             'disconnect' to disconnect existing clients
+-#             'keep' to maintain existing clients
+-#
+ # Returns: - Nothing on success
+ #          - If Spice is not enabled, DeviceNotFound
+ #
+@@ -37,16 +38,123 @@
+ # <- { "return": {} }
+ #
+ ##
+-{ 'command': 'set_password',
+-  'data': {'protocol': 'str', 'password': 'str', '*connected': 'str'} }
++{ 'command': 'set_password', 'boxed': true, 'data': 'SetPasswordOptions' }
++
++##
++# @SetPasswordOptions:
++#
++# Data required to set a new password on a display server protocol.
++#
++# @protocol: - 'vnc' to modify the VNC server password
++#            - 'spice' to modify the Spice server password
++#
++# @password: the new password
++#
++# Since: 6.2
++#
++##
++{ 'union': 'SetPasswordOptions',
++  'base': { 'protocol': 'DisplayProtocol',
++            'password': 'str' },
++  'discriminator': 'protocol',
++  'data': { 'vnc': 'SetPasswordOptionsVnc',
++            'spice': 'SetPasswordOptionsSpice' } }
++
++##
++# @SetPasswordAction:
++#
++# An action to take on changing a password on a connection with active clients.
++#
++# @fail: fail the command if clients are connected
++#
++# @disconnect: disconnect existing clients
++#
++# @keep: maintain existing clients
++#
++# Since: 6.2
++#
++##
++{ 'enum': 'SetPasswordAction',
++  'data': [ 'fail', 'disconnect', 'keep' ] }
++
++##
++# @SetPasswordActionVnc:
++#
++# See @SetPasswordAction. VNC only supports the keep action. 'connection'
++# should just be omitted for VNC, this is kept for backwards compatibility.
++#
++# @keep: maintain existing clients
++#
++# Since: 6.2
++#
++##
++{ 'enum': 'SetPasswordActionVnc',
++  'data': [ 'keep' ] }
++
++##
++# @SetPasswordOptionsSpice:
++#
++# Options for set_password specific to the VNC procotol.
++#
++# @connected: How to handle existing clients when changing the
++#             password. If nothing is specified, defaults to 'keep'.
++#
++# Since: 6.2
++#
++##
++{ 'struct': 'SetPasswordOptionsSpice',
++  'data': { '*connected': 'SetPasswordAction' } }
++
++##
++# @SetPasswordOptionsVnc:
++#
++# Options for set_password specific to the VNC procotol.
++#
++# @display: The id of the display where the password should be changed.
++#           Defaults to the first.
++#
++# @connected: How to handle existing clients when changing the
++#             password.
++#
++# Features:
++# @deprecated: For VNC, @connected will always be 'keep', parameter should be
++#              omitted.
++#
++# Since: 6.2
++#
++##
++{ 'struct': 'SetPasswordOptionsVnc',
++  'data': { '*display': 'str',
++            '*connected': { 'type': 'SetPasswordActionVnc',
++                            'features': ['deprecated'] } } }
+ 
+ ##
+ # @expire_password:
+ #
+ # Expire the password of a remote display server.
+ #
+-# @protocol: the name of the remote display protocol 'vnc' or 'spice'
++# Returns: - Nothing on success
++#          - If @protocol is 'spice' and Spice is not active, DeviceNotFound
+ #
++# Since: 0.14
++#
++# Example:
++#
++# -> { "execute": "expire_password", "arguments": { "protocol": "vnc",
++#                                                   "time": "+60" } }
++# <- { "return": {} }
++#
++##
++{ 'command': 'expire_password', 'boxed': true, 'data': 'ExpirePasswordOptions' }
++
++##
++# @ExpirePasswordOptions:
++#
++# Data required to set password expiration on a display server protocol.
++#
++# @protocol: - 'vnc' to modify the VNC server expiration
++#            - 'spice' to modify the Spice server expiration
++
+ # @time: when to expire the password.
+ #
+ #        - 'now' to expire the password immediately
+@@ -54,24 +162,33 @@
+ #        - '+INT' where INT is the number of seconds from now (integer)
+ #        - 'INT' where INT is the absolute time in seconds
+ #
+-# Returns: - Nothing on success
+-#          - If @protocol is 'spice' and Spice is not active, DeviceNotFound
+-#
+-# Since: 0.14
+-#
+ # Notes: Time is relative to the server and currently there is no way to
+ #        coordinate server time with client time.  It is not recommended to
+ #        use the absolute time version of the @time parameter unless you're
+ #        sure you are on the same machine as the QEMU instance.
+ #
+-# Example:
++# Since: 6.2
+ #
+-# -> { "execute": "expire_password", "arguments": { "protocol": "vnc",
+-#                                                   "time": "+60" } }
+-# <- { "return": {} }
++##
++{ 'union': 'ExpirePasswordOptions',
++  'base': { 'protocol': 'DisplayProtocol',
++            'time': 'str' },
++  'discriminator': 'protocol',
++  'data': { 'vnc': 'ExpirePasswordOptionsVnc' } }
++
++##
++# @ExpirePasswordOptionsVnc:
++#
++# Options for expire_password specific to the VNC procotol.
++#
++# @display: The id of the display where the expiration should be changed.
++#           Defaults to the first.
++#
++# Since: 6.2
+ #
+ ##
+-{ 'command': 'expire_password', 'data': {'protocol': 'str', 'time': 'str'} }
++{ 'struct': 'ExpirePasswordOptionsVnc',
++  'data': { '*display': 'str' } }
+ 
+ ##
+ # @screendump:

debian/patches/extra/0003-virtiofsd-use-g_date_time_get_microsecond-to-get-sub.patch

@@ -1,51 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Yusuke Okada <okada.yusuke@jp.fujitsu.com>
-Date: Thu, 18 Aug 2022 14:46:19 -0400
-Subject: [PATCH] virtiofsd: use g_date_time_get_microsecond to get subsecond
-
-The "%f" specifier in g_date_time_format() is only available in glib
-2.65.2 or later. If combined with older glib, the function returns null
-and the timestamp displayed as "(null)".
-
-For backward compatibility, g_date_time_get_microsecond should be used
-to retrieve subsecond.
-
-In this patch the g_date_time_format() leaves subsecond field as "%06d"
-and let next snprintf to format with g_date_time_get_microsecond.
-
-Signed-off-by: Yusuke Okada <okada.yusuke@jp.fujitsu.com>
-Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
-Message-id: 20220818184618.2205172-1-yokada.996@gmail.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry-picked from commit f16d15c9276bd8f501f861c39cbd4adc812d0c1d)
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- tools/virtiofsd/passthrough_ll.c | 7 +++++--
- 1 file changed, 5 insertions(+), 2 deletions(-)
-
-diff --git a/tools/virtiofsd/passthrough_ll.c b/tools/virtiofsd/passthrough_ll.c
-index 371a7bead6..20f0f41f99 100644
---- a/tools/virtiofsd/passthrough_ll.c
-+++ b/tools/virtiofsd/passthrough_ll.c
-@@ -4185,6 +4185,7 @@ static void setup_nofile_rlimit(unsigned long rlimit_nofile)
- static void log_func(enum fuse_log_level level, const char *fmt, va_list ap)
- {
-     g_autofree char *localfmt = NULL;
-+    char buf[64];
- 
-     if (current_log_level < level) {
-         return;
-@@ -4197,9 +4198,11 @@ static void log_func(enum fuse_log_level level, const char *fmt, va_list ap)
-                                        fmt);
-         } else {
-             g_autoptr(GDateTime) now = g_date_time_new_now_utc();
--            g_autofree char *nowstr = g_date_time_format(now, "%Y-%m-%d %H:%M:%S.%f%z");
-+            g_autofree char *nowstr = g_date_time_format(now,
-+                                       "%Y-%m-%d %H:%M:%S.%%06d%z");
-+            snprintf(buf, 64, nowstr, g_date_time_get_microsecond(now));
-             localfmt = g_strdup_printf("[%s] [ID: %08ld] %s",
--                                       nowstr, syscall(__NR_gettid), fmt);
-+                                       buf, syscall(__NR_gettid), fmt);
-         }
-         fmt = localfmt;
-     }

debian/patches/extra/0004-chardev-fix-segfault-in-finalize.patch

@@ -1,56 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Maksim Davydov <davydov-max@yandex-team.ru>
-Date: Thu, 25 Aug 2022 19:52:47 +0300
-Subject: [PATCH] chardev: fix segfault in finalize
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-If finalize chardev-msmouse or chardev-wctable is called immediately after
-init it cases QEMU to crash with segfault. This happens because of
-QTAILQ_REMOVE in qemu_input_handler_unregister tries to dereference
-NULL pointer.
-For instance, this error can be reproduced via `qom-list-properties`
-command.
-
-Signed-off-by: Maksim Davydov <davydov-max@yandex-team.ru>
-Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
-Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
-Message-Id: <20220825165247.33704-1-davydov-max@yandex-team.ru>
-(trivial backport from fc0c128531ed55f058bfbad4f1348ebd9a0187f2)
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- chardev/msmouse.c  | 4 +++-
- chardev/wctablet.c | 4 +++-
- 2 files changed, 6 insertions(+), 2 deletions(-)
-
-diff --git a/chardev/msmouse.c b/chardev/msmouse.c
-index eb9231dcdb..2cc1b16561 100644
---- a/chardev/msmouse.c
-+++ b/chardev/msmouse.c
-@@ -146,7 +146,9 @@ static void char_msmouse_finalize(Object *obj)
- {
-     MouseChardev *mouse = MOUSE_CHARDEV(obj);
- 
--    qemu_input_handler_unregister(mouse->hs);
-+    if (mouse->hs) {
-+        qemu_input_handler_unregister(mouse->hs);
-+    }
- }
- 
- static QemuInputHandler msmouse_handler = {
-diff --git a/chardev/wctablet.c b/chardev/wctablet.c
-index e8b292c43c..43bdf6b608 100644
---- a/chardev/wctablet.c
-+++ b/chardev/wctablet.c
-@@ -319,7 +319,9 @@ static void wctablet_chr_finalize(Object *obj)
- {
-     TabletChardev *tablet = WCTABLET_CHARDEV(obj);
- 
--    qemu_input_handler_unregister(tablet->hs);
-+    if (tablet->hs) {
-+        qemu_input_handler_unregister(tablet->hs);
-+    }
- }
- 
- static void wctablet_chr_open(Chardev *chr,

debian/patches/extra/0005-init-daemonize-defuse-PID-file-resolve-error.patch

@@ -1,42 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Fiona Ebner <f.ebner@proxmox.com>
-Date: Fri, 28 Oct 2022 10:09:46 +0200
-Subject: [PATCH] init: daemonize: defuse PID file resolve error
-
-When proxmox-file-restore invokes QEMU, the PID file is a (temporary)
-file that's already unlinked, so resolving the absolute path here
-failed.
-
-It should not be a critical error when the PID file unlink handler
-can't be registered, because the path can't be resolved for whatever
-reason. If the file is already gone from QEMU's perspective (i.e.
-errno is ENOENT), silently ignore the error. Otherwise, print a
-warning.
-
-Reported-by: Dominik Csapak <d.csapak@proxmox.com>
-Suggested-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- softmmu/vl.c | 9 +++++----
- 1 file changed, 5 insertions(+), 4 deletions(-)
-
-diff --git a/softmmu/vl.c b/softmmu/vl.c
-index 706bd7cff7..3381c56af7 100644
---- a/softmmu/vl.c
-+++ b/softmmu/vl.c
-@@ -2438,10 +2438,11 @@ static void qemu_maybe_daemonize(const char *pid_file)
- 
-         pid_file_realpath = g_malloc0(PATH_MAX);
-         if (!realpath(pid_file, pid_file_realpath)) {
--            error_report("cannot resolve PID file path: %s: %s",
--                         pid_file, strerror(errno));
--            unlink(pid_file);
--            exit(1);
-+            if (errno != ENOENT) {
-+                warn_report("not removing PID file on exit: cannot resolve PID "
-+                            "file path: %s: %s", pid_file, strerror(errno));
-+            }
-+            return;
-         }
- 
-         qemu_unlink_pidfile_notifier = (struct UnlinkPidfileNotifier) {

debian/patches/extra/0006-block-block-backend-blk_set_enable_write_cache-is-IO.patch

@@ -1,77 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
-Date: Thu, 27 Oct 2022 03:27:26 -0400
-Subject: [PATCH] block/block-backend: blk_set_enable_write_cache is IO_CODE
-
-blk_set_enable_write_cache() is defined as GLOBAL_STATE_CODE
-but can be invoked from iothreads when handling scsi requests.
-This triggers an assertion failure:
-
- 0x00007fd6c3515ce1 in raise () from /lib/x86_64-linux-gnu/libc.so.6
- 0x00007fd6c34ff537 in abort () from /lib/x86_64-linux-gnu/libc.so.6
- 0x00007fd6c34ff40f in ?? () from /lib/x86_64-linux-gnu/libc.so.6
- 0x00007fd6c350e662 in __assert_fail () from /lib/x86_64-linux-gnu/libc.so.6
- 0x000056149e2cea03 in blk_set_enable_write_cache (wce=true, blk=0x5614a01c27f0)
-   at ../src/block/block-backend.c:1949
- 0x000056149e2d0a67 in blk_set_enable_write_cache (blk=0x5614a01c27f0,
-   wce=<optimized out>) at ../src/block/block-backend.c:1951
- 0x000056149dfe9c59 in scsi_disk_apply_mode_select (p=0x7fd6b400c00e "\004",
-   page=<optimized out>, s=<optimized out>) at ../src/hw/scsi/scsi-disk.c:1520
- mode_select_pages (change=true, len=18, p=0x7fd6b400c00e "\004", r=0x7fd6b4001ff0)
-   at ../src/hw/scsi/scsi-disk.c:1570
- scsi_disk_emulate_mode_select (inbuf=<optimized out>, r=0x7fd6b4001ff0) at
-   ../src/hw/scsi/scsi-disk.c:1640
- scsi_disk_emulate_write_data (req=0x7fd6b4001ff0) at ../src/hw/scsi/scsi-disk.c:1934
- 0x000056149e18ff16 in virtio_scsi_handle_cmd_req_submit (req=<optimized out>,
-   req=<optimized out>, s=0x5614a12f16b0) at ../src/hw/scsi/virtio-scsi.c:719
- virtio_scsi_handle_cmd_vq (vq=0x7fd6bab92140, s=0x5614a12f16b0) at
-   ../src/hw/scsi/virtio-scsi.c:761
- virtio_scsi_handle_cmd (vq=<optimized out>, vdev=<optimized out>) at
-   ../src/hw/scsi/virtio-scsi.c:775
- virtio_scsi_handle_cmd (vdev=0x5614a12f16b0, vq=0x7fd6bab92140) at
-   ../src/hw/scsi/virtio-scsi.c:765
- 0x000056149e1a8aa6 in virtio_queue_notify_vq (vq=0x7fd6bab92140) at
-   ../src/hw/virtio/virtio.c:2365
- 0x000056149e3ccea5 in aio_dispatch_handler (ctx=ctx@entry=0x5614a01babe0,
-   node=<optimized out>) at ../src/util/aio-posix.c:369
- 0x000056149e3cd868 in aio_dispatch_ready_handlers (ready_list=0x7fd6c09b2680,
-   ctx=0x5614a01babe0) at ../src/util/aio-posix.c:399
- aio_poll (ctx=0x5614a01babe0, blocking=blocking@entry=true) at
-   ../src/util/aio-posix.c:713
- 0x000056149e2a7796 in iothread_run (opaque=opaque@entry=0x56149ffde500) at
-   ../src/iothread.c:67
- 0x000056149e3d0859 in qemu_thread_start (args=0x7fd6c09b26f0) at
-   ../src/util/qemu-thread-posix.c:504
- 0x00007fd6c36b9ea7 in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0
- 0x00007fd6c35d9aef in clone () from /lib/x86_64-linux-gnu/libc.so.6
-
-Changing GLOBAL_STATE_CODE in IO_CODE is allowed, since GSC callers are
-allowed to call IO_CODE.
-
-Resolves: #1272
-
-Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
-Message-Id: <20221027072726.2681500-1-eesposit@redhat.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Reviewed-by: Hanna Reitz <hreitz@redhat.com>
-Tested-by: Antoine Damhet <antoine.damhet@shadow.tech>
-Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-(cherry picked from commit be8da05b5ed8fb546731b9edb997f303f272bad8)
-Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
----
- block/block-backend.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/block/block-backend.c b/block/block-backend.c
-index d4a5df2ac2..1b563e628b 100644
---- a/block/block-backend.c
-+++ b/block/block-backend.c
-@@ -1946,7 +1946,7 @@ bool blk_enable_write_cache(BlockBackend *blk)
- 
- void blk_set_enable_write_cache(BlockBackend *blk, bool wce)
- {
--    GLOBAL_STATE_CODE();
-+    IO_CODE();
-     blk->enable_write_cache = wce;
- }
- 

debian/patches/extra/0006-block-io-Update-BSC-only-if-want_zero-is-true.patch

@@ -0,0 +1,43 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Hanna Reitz <hreitz@redhat.com>
+Date: Tue, 18 Jan 2022 17:59:59 +0100
+Subject: [PATCH] block/io: Update BSC only if want_zero is true
+
+We update the block-status cache whenever we get new information from a
+bdrv_co_block_status() call to the block driver.  However, if we have
+passed want_zero=false to that call, it may flag areas containing zeroes
+as data, and so we would update the block-status cache with wrong
+information.
+
+Therefore, we should not update the cache with want_zero=false.
+
+Reported-by: Nir Soffer <nsoffer@redhat.com>
+Fixes: 0bc329fbb00 ("block: block-status cache for data regions")
+Reviewed-by: Nir Soffer <nsoffer@redhat.com>
+Cc: qemu-stable@nongnu.org
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+Message-Id: <20220118170000.49423-2-hreitz@redhat.com>
+Reviewed-by: Eric Blake <eblake@redhat.com>
+Signed-off-by: Eric Blake <eblake@redhat.com>
+---
+ block/io.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/block/io.c b/block/io.c
+index bb0a254def..4e4cb556c5 100644
+--- a/block/io.c
++++ b/block/io.c
+@@ -2497,8 +2497,12 @@ static int coroutine_fn bdrv_co_block_status(BlockDriverState *bs,
+              * non-protocol nodes, and then it is never used.  However, filling
+              * the cache requires an RCU update, so double check here to avoid
+              * such an update if possible.
++             *
++             * Check want_zero, because we only want to update the cache when we
++             * have accurate information about what is zero and what is data.
+              */
+-            if (ret == (BDRV_BLOCK_DATA | BDRV_BLOCK_OFFSET_VALID) &&
++            if (want_zero &&
++                ret == (BDRV_BLOCK_DATA | BDRV_BLOCK_OFFSET_VALID) &&
+                 QLIST_EMPTY(&bs->children))
+             {
+                 /*

debian/patches/extra/0007-block-nbd-Delete-reconnect-delay-timer-when-done.patch

@@ -0,0 +1,40 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Hanna Reitz <hreitz@redhat.com>
+Date: Wed, 9 Feb 2022 15:02:52 +0100
+Subject: [PATCH] block/nbd: Delete reconnect delay timer when done
+
+We start the reconnect delay timer to cancel the reconnection attempt
+after a while.  Once nbd_co_do_establish_connection() has returned, this
+attempt is over, and we no longer need the timer.
+
+Delete it before returning from nbd_reconnect_attempt(), so that it does
+not persist beyond the I/O request that was paused for reconnecting; we
+do not want it to fire in a drained section, because all sort of things
+can happen in such a section (e.g. the AioContext might be changed, and
+we do not want the timer to fire in the wrong context; or the BDS might
+even be deleted, and so the timer CB would access already-freed data).
+
+Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+---
+ block/nbd.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/block/nbd.c b/block/nbd.c
+index 5ef462db1b..b8e5a9b4cc 100644
+--- a/block/nbd.c
++++ b/block/nbd.c
+@@ -353,6 +353,13 @@ static coroutine_fn void nbd_reconnect_attempt(BDRVNBDState *s)
+     }
+ 
+     nbd_co_do_establish_connection(s->bs, NULL);
++
++    /*
++     * The reconnect attempt is done (maybe successfully, maybe not), so
++     * we no longer need this timer.  Delete it so it will not outlive
++     * this I/O request (so draining removes all timers).
++     */
++    reconnect_delay_timer_del(s);
+ }
+ 
+ static coroutine_fn int nbd_receive_replies(BDRVNBDState *s, uint64_t handle)

debian/patches/extra/0008-block-nbd-Assert-there-are-no-timers-when-closed.patch

@@ -0,0 +1,34 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Hanna Reitz <hreitz@redhat.com>
+Date: Wed, 9 Feb 2022 15:02:54 +0100
+Subject: [PATCH] block/nbd: Assert there are no timers when closed
+
+Our two timers must not remain armed beyond nbd_clear_bdrvstate(), or
+they will access freed data when they fire.
+
+This patch is separate from the patches that actually fix the issue
+(HEAD^^ and HEAD^) so that you can run the associated regression iotest
+(281) on a configuration that reproducibly exposes the bug.
+
+Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+[FE: backport (open_timer doesn't exist yet in 6.2.0)]
+Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
+---
+ block/nbd.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/block/nbd.c b/block/nbd.c
+index b8e5a9b4cc..aab20125d8 100644
+--- a/block/nbd.c
++++ b/block/nbd.c
+@@ -108,6 +108,9 @@ static void nbd_clear_bdrvstate(BlockDriverState *bs)
+ 
+     yank_unregister_instance(BLOCKDEV_YANK_INSTANCE(bs->node_name));
+ 
++    /* Must not leave timers behind that would access freed data */
++    assert(!s->reconnect_delay_timer);
++
+     object_unref(OBJECT(s->tlscreds));
+     qapi_free_SocketAddress(s->saddr);
+     s->saddr = NULL;

debian/patches/extra/0009-block-nbd-Move-s-ioc-on-AioContext-change.patch

@@ -0,0 +1,90 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Hanna Reitz <hreitz@redhat.com>
+Date: Wed, 9 Feb 2022 15:02:57 +0100
+Subject: [PATCH] block/nbd: Move s->ioc on AioContext change
+
+s->ioc must always be attached to the NBD node's AioContext.  If that
+context changes, s->ioc must be attached to the new context.
+
+Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=2033626
+Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Signed-off-by: Hanna Reitz <hreitz@redhat.com>
+[FE: backport (open_timer doesn't exist yet in 6.2.0)]
+Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
+---
+ block/nbd.c | 41 +++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 41 insertions(+)
+
+diff --git a/block/nbd.c b/block/nbd.c
+index aab20125d8..a3896c7f5f 100644
+--- a/block/nbd.c
++++ b/block/nbd.c
+@@ -2003,6 +2003,38 @@ static void nbd_cancel_in_flight(BlockDriverState *bs)
+     nbd_co_establish_connection_cancel(s->conn);
+ }
+ 
++static void nbd_attach_aio_context(BlockDriverState *bs,
++                                   AioContext *new_context)
++{
++    BDRVNBDState *s = bs->opaque;
++
++    /*
++     * The reconnect_delay_timer is scheduled in I/O paths when the
++     * connection is lost, to cancel the reconnection attempt after a
++     * given time.  Once this attempt is done (successfully or not),
++     * nbd_reconnect_attempt() ensures the timer is deleted before the
++     * respective I/O request is resumed.
++     * Since the AioContext can only be changed when a node is drained,
++     * the reconnect_delay_timer cannot be active here.
++     */
++    assert(!s->reconnect_delay_timer);
++
++    if (s->ioc) {
++        qio_channel_attach_aio_context(s->ioc, new_context);
++    }
++}
++
++static void nbd_detach_aio_context(BlockDriverState *bs)
++{
++    BDRVNBDState *s = bs->opaque;
++
++    assert(!s->reconnect_delay_timer);
++
++    if (s->ioc) {
++        qio_channel_detach_aio_context(s->ioc);
++    }
++}
++
+ static BlockDriver bdrv_nbd = {
+     .format_name                = "nbd",
+     .protocol_name              = "nbd",
+@@ -2026,6 +2058,9 @@ static BlockDriver bdrv_nbd = {
+     .bdrv_dirname               = nbd_dirname,
+     .strong_runtime_opts        = nbd_strong_runtime_opts,
+     .bdrv_cancel_in_flight      = nbd_cancel_in_flight,
++
++    .bdrv_attach_aio_context    = nbd_attach_aio_context,
++    .bdrv_detach_aio_context    = nbd_detach_aio_context,
+ };
+ 
+ static BlockDriver bdrv_nbd_tcp = {
+@@ -2051,6 +2086,9 @@ static BlockDriver bdrv_nbd_tcp = {
+     .bdrv_dirname               = nbd_dirname,
+     .strong_runtime_opts        = nbd_strong_runtime_opts,
+     .bdrv_cancel_in_flight      = nbd_cancel_in_flight,
++
++    .bdrv_attach_aio_context    = nbd_attach_aio_context,
++    .bdrv_detach_aio_context    = nbd_detach_aio_context,
+ };
+ 
+ static BlockDriver bdrv_nbd_unix = {
+@@ -2076,6 +2114,9 @@ static BlockDriver bdrv_nbd_unix = {
+     .bdrv_dirname               = nbd_dirname,
+     .strong_runtime_opts        = nbd_strong_runtime_opts,
+     .bdrv_cancel_in_flight      = nbd_cancel_in_flight,
++
++    .bdrv_attach_aio_context    = nbd_attach_aio_context,
++    .bdrv_detach_aio_context    = nbd_detach_aio_context,
+ };
+ 
+ static void bdrv_nbd_init(void)

debian/patches/extra/0010-acpi-fix-QEMU-crash-when-started-with-SLIC-table.patch

@@ -0,0 +1,89 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Igor Mammedov <imammedo@redhat.com>
+Date: Mon, 27 Dec 2021 14:31:17 -0500
+Subject: [PATCH] acpi: fix QEMU crash when started with SLIC table
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+if QEMU is started with used provided SLIC table blob,
+
+  -acpitable sig=SLIC,oem_id='CRASH ',oem_table_id="ME",oem_rev=00002210,asl_compiler_id="",asl_compiler_rev=00000000,data=/dev/null
+it will assert with:
+
+  hw/acpi/aml-build.c:61:build_append_padded_str: assertion failed: (len <= maxlen)
+
+and following backtrace:
+
+  ...
+  build_append_padded_str (array=0x555556afe320, str=0x555556afdb2e "CRASH ME", maxlen=0x6, pad=0x20) at hw/acpi/aml-build.c:61
+  acpi_table_begin (desc=0x7fffffffd1b0, array=0x555556afe320) at hw/acpi/aml-build.c:1727
+  build_fadt (tbl=0x555556afe320, linker=0x555557ca3830, f=0x7fffffffd318, oem_id=0x555556afdb2e "CRASH ME", oem_table_id=0x555556afdb34 "ME") at hw/acpi/aml-build.c:2064
+  ...
+
+which happens due to acpi_table_begin() expecting NULL terminated
+oem_id and oem_table_id strings, which is normally the case, but
+in case of user provided SLIC table, oem_id points to table's blob
+directly and as result oem_id became longer than expected.
+
+Fix issue by handling oem_id consistently and make acpi_get_slic_oem()
+return NULL terminated strings.
+
+PS:
+After [1] refactoring, oem_id semantics became inconsistent, where
+NULL terminated string was coming from machine and old way pointer
+into byte array coming from -acpitable option. That used to work
+since build_header() wasn't expecting NULL terminated string and
+blindly copied the 1st 6 bytes only.
+
+However commit [2] broke that by replacing build_header() with
+acpi_table_begin(), which was expecting NULL terminated string
+and was checking oem_id size.
+
+1) 602b45820 ("acpi: Permit OEM ID and OEM table ID fields to be changed")
+2)
+Fixes: 4b56e1e4eb08 ("acpi: build_fadt: use acpi_table_begin()/acpi_table_end() instead of build_header()")
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/786
+Signed-off-by: Igor Mammedov <imammedo@redhat.com>
+Message-Id: <20211227193120.1084176-2-imammedo@redhat.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Tested-by: Denis Lisov <dennis.lissov@gmail.com>
+Tested-by: Alexander Tsoy <alexander@tsoy.me>
+Cc: qemu-stable@nongnu.org
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+(cherry picked from commit 8cdb99af45365727ac17f45239a9b8c1d5155c6d)
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+---
+ hw/acpi/core.c       | 4 ++--
+ hw/i386/acpi-build.c | 2 ++
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/hw/acpi/core.c b/hw/acpi/core.c
+index 1e004d0078..3e811bf03c 100644
+--- a/hw/acpi/core.c
++++ b/hw/acpi/core.c
+@@ -345,8 +345,8 @@ int acpi_get_slic_oem(AcpiSlicOem *oem)
+         struct acpi_table_header *hdr = (void *)(u - sizeof(hdr->_length));
+ 
+         if (memcmp(hdr->sig, "SLIC", 4) == 0) {
+-            oem->id = hdr->oem_id;
+-            oem->table_id = hdr->oem_table_id;
++            oem->id = g_strndup(hdr->oem_id, 6);
++            oem->table_id = g_strndup(hdr->oem_table_id, 8);
+             return 0;
+         }
+     }
+diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
+index a99c6e4fe3..570f82997b 100644
+--- a/hw/i386/acpi-build.c
++++ b/hw/i386/acpi-build.c
+@@ -2721,6 +2721,8 @@ void acpi_build(AcpiBuildTables *tables, MachineState *machine)
+ 
+     /* Cleanup memory that's no longer used. */
+     g_array_free(table_offsets, true);
++    g_free(slic_oem.id);
++    g_free(slic_oem.table_id);
+ }
+ 
+ static void acpi_ram_update(MemoryRegion *mr, GArray *data)

debian/patches/extra/0011-virtio-net-fix-map-leaking-on-error-during-receive.patch

@@ -0,0 +1,38 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Jason Wang <jasowang@redhat.com>
+Date: Tue, 8 Mar 2022 10:42:51 +0800
+Subject: [PATCH] virtio-net: fix map leaking on error during receive
+
+Commit bedd7e93d0196 ("virtio-net: fix use after unmap/free for sg")
+tries to fix the use after free of the sg by caching the virtqueue
+elements in an array and unmap them at once after receiving the
+packets, But it forgot to unmap the cached elements on error which
+will lead to leaking of mapping and other unexpected results.
+
+Fixing this by detaching the cached elements on error. This addresses
+CVE-2022-26353.
+
+Reported-by: Victor Tom <vv474172261@gmail.com>
+Cc: qemu-stable@nongnu.org
+Fixes: CVE-2022-26353
+Fixes: bedd7e93d0196 ("virtio-net: fix use after unmap/free for sg")
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+(cherry picked from commit abe300d9d894f7138e1af7c8e9c88c04bfe98b37)
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+---
+ hw/net/virtio-net.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
+index f2014d5ea0..e1f4748831 100644
+--- a/hw/net/virtio-net.c
++++ b/hw/net/virtio-net.c
+@@ -1862,6 +1862,7 @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
+ 
+ err:
+     for (j = 0; j < i; j++) {
++        virtqueue_detach_element(q->rx_vq, elems[j], lens[j]);
+         g_free(elems[j]);
+     }
+ 

debian/patches/extra/0012-memory-Fix-incorrect-calls-of-log_global_start-stop.patch

@@ -0,0 +1,86 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Peter Xu <peterx@redhat.com>
+Date: Tue, 30 Nov 2021 16:00:28 +0800
+Subject: [PATCH] memory: Fix incorrect calls of log_global_start/stop
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+We should only call the log_global_start/stop when the global dirty track
+bitmask changes from zero<->non-zero.
+
+No real issue reported for this yet probably because no immediate user to
+enable both dirty rate measurement and migration at the same time.  However
+it'll be good to be prepared for it.
+
+Fixes: 63b41db4bc ("memory: make global_dirty_tracking a bitmask")
+Cc: qemu-stable@nongnu.org
+Cc: Hyman Huang <huangy81@chinatelecom.cn>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Cc: Dr. David Alan Gilbert <dgilbert@redhat.com>
+Cc: Juan Quintela <quintela@redhat.com>
+Cc: David Hildenbrand <david@redhat.com>
+Signed-off-by: Peter Xu <peterx@redhat.com>
+Reviewed-by: David Hildenbrand <david@redhat.com>
+Message-Id: <20211130080028.6474-1-peterx@redhat.com>
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+(cherry picked from commit 7b0538ed3a22ce30817f818449d10701fb0821f9)
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+---
+ softmmu/memory.c | 27 ++++++++++++++-------------
+ 1 file changed, 14 insertions(+), 13 deletions(-)
+
+diff --git a/softmmu/memory.c b/softmmu/memory.c
+index 7340e19ff5..81d4bf1454 100644
+--- a/softmmu/memory.c
++++ b/softmmu/memory.c
+@@ -2773,6 +2773,8 @@ static VMChangeStateEntry *vmstate_change;
+ 
+ void memory_global_dirty_log_start(unsigned int flags)
+ {
++    unsigned int old_flags = global_dirty_tracking;
++
+     if (vmstate_change) {
+         qemu_del_vm_change_state_handler(vmstate_change);
+         vmstate_change = NULL;
+@@ -2781,15 +2783,14 @@ void memory_global_dirty_log_start(unsigned int flags)
+     assert(flags && !(flags & (~GLOBAL_DIRTY_MASK)));
+     assert(!(global_dirty_tracking & flags));
+     global_dirty_tracking |= flags;
+-
+     trace_global_dirty_changed(global_dirty_tracking);
+ 
+-    MEMORY_LISTENER_CALL_GLOBAL(log_global_start, Forward);
+-
+-    /* Refresh DIRTY_MEMORY_MIGRATION bit.  */
+-    memory_region_transaction_begin();
+-    memory_region_update_pending = true;
+-    memory_region_transaction_commit();
++    if (!old_flags) {
++        MEMORY_LISTENER_CALL_GLOBAL(log_global_start, Forward);
++        memory_region_transaction_begin();
++        memory_region_update_pending = true;
++        memory_region_transaction_commit();
++    }
+ }
+ 
+ static void memory_global_dirty_log_do_stop(unsigned int flags)
+@@ -2800,12 +2801,12 @@ static void memory_global_dirty_log_do_stop(unsigned int flags)
+ 
+     trace_global_dirty_changed(global_dirty_tracking);
+ 
+-    /* Refresh DIRTY_MEMORY_MIGRATION bit.  */
+-    memory_region_transaction_begin();
+-    memory_region_update_pending = true;
+-    memory_region_transaction_commit();
+-
+-    MEMORY_LISTENER_CALL_GLOBAL(log_global_stop, Reverse);
++    if (!global_dirty_tracking) {
++        memory_region_transaction_begin();
++        memory_region_update_pending = true;
++        memory_region_transaction_commit();
++        MEMORY_LISTENER_CALL_GLOBAL(log_global_stop, Reverse);
++    }
+ }
+ 
+ static void memory_vm_change_state_handler(void *opaque, bool running,

debian/patches/extra/0013-acpi-fix-OEM-ID-OEM-Table-ID-padding.patch

@@ -0,0 +1,59 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Igor Mammedov <imammedo@redhat.com>
+Date: Wed, 12 Jan 2022 08:03:31 -0500
+Subject: [PATCH] acpi: fix OEM ID/OEM Table ID padding
+
+Commit [2] broke original '\0' padding of OEM ID and OEM Table ID
+fields in headers of ACPI tables. While it doesn't have impact on
+default values since QEMU uses 6 and 8 characters long values
+respectively, it broke usecase where IDs are provided on QEMU CLI.
+It shouldn't affect guest (but may cause licensing verification
+issues in guest OS).
+One of the broken usecases is user supplied SLIC table with IDs
+shorter than max possible length, where [2] mangles IDs with extra
+spaces in RSDT and FADT tables whereas guest OS expects those to
+mirror the respective values of the used SLIC table.
+
+Fix it by replacing whitespace padding with '\0' padding in
+accordance with [1] and expectations of guest OS
+
+1) ACPI spec, v2.0b
+       17.2 AML Grammar Definition
+       ...
+       //OEM ID of up to 6 characters. If the OEM ID is
+       //shorter than 6 characters, it can be terminated
+       //with a NULL character.
+
+2)
+Fixes: 602b458201 ("acpi: Permit OEM ID and OEM table ID fields to be changed")
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/707
+Reported-by: Dmitry V. Orekhov <dima.orekhov@gmail.com>
+Signed-off-by: Igor Mammedov <imammedo@redhat.com>
+Cc: qemu-stable@nongnu.org
+Message-Id: <20220112130332.1648664-4-imammedo@redhat.com>
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: Ani Sinha <ani@anisinha.ca>
+Tested-by: Dmitry V. Orekhov dima.orekhov@gmail.com
+(cherry picked from commit 748c030f360a940fe0c9382c8ca1649096c3a80d)
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+---
+ hw/acpi/aml-build.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/hw/acpi/aml-build.c b/hw/acpi/aml-build.c
+index b3b3310df3..65148d5b9d 100644
+--- a/hw/acpi/aml-build.c
++++ b/hw/acpi/aml-build.c
+@@ -1724,9 +1724,9 @@ void acpi_table_begin(AcpiTable *desc, GArray *array)
+     build_append_int_noprefix(array, 0, 4); /* Length */
+     build_append_int_noprefix(array, desc->rev, 1); /* Revision */
+     build_append_int_noprefix(array, 0, 1); /* Checksum */
+-    build_append_padded_str(array, desc->oem_id, 6, ' '); /* OEMID */
++    build_append_padded_str(array, desc->oem_id, 6, '\0'); /* OEMID */
+     /* OEM Table ID */
+-    build_append_padded_str(array, desc->oem_table_id, 8, ' ');
++    build_append_padded_str(array, desc->oem_table_id, 8, '\0');
+     build_append_int_noprefix(array, 1, 4); /* OEM Revision */
+     g_array_append_vals(array, ACPI_BUILD_APPNAME8, 4); /* Creator ID */
+     build_append_int_noprefix(array, 1, 4); /* Creator Revision */

debian/patches/extra/0014-vhost-vsock-detach-the-virqueue-element-in-case-of-e.patch

@@ -0,0 +1,55 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Stefano Garzarella <sgarzare@redhat.com>
+Date: Mon, 28 Feb 2022 10:50:58 +0100
+Subject: [PATCH] vhost-vsock: detach the virqueue element in case of error
+
+In vhost_vsock_common_send_transport_reset(), if an element popped from
+the virtqueue is invalid, we should call virtqueue_detach_element() to
+detach it from the virtqueue before freeing its memory.
+
+Fixes: fc0b9b0e1c ("vhost-vsock: add virtio sockets device")
+Fixes: CVE-2022-26354
+Cc: qemu-stable@nongnu.org
+Reported-by: VictorV <vv474172261@gmail.com>
+Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
+Message-Id: <20220228095058.27899-1-sgarzare@redhat.com>
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+(cherry picked from commit 8d1b247f3748ac4078524130c6d7ae42b6140aaf)
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+---
+ hw/virtio/vhost-vsock-common.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/hw/virtio/vhost-vsock-common.c b/hw/virtio/vhost-vsock-common.c
+index 3f3771274e..ed706681ac 100644
+--- a/hw/virtio/vhost-vsock-common.c
++++ b/hw/virtio/vhost-vsock-common.c
+@@ -153,19 +153,23 @@ static void vhost_vsock_common_send_transport_reset(VHostVSockCommon *vvc)
+     if (elem->out_num) {
+         error_report("invalid vhost-vsock event virtqueue element with "
+                      "out buffers");
+-        goto out;
++        goto err;
+     }
+ 
+     if (iov_from_buf(elem->in_sg, elem->in_num, 0,
+                      &event, sizeof(event)) != sizeof(event)) {
+         error_report("vhost-vsock event virtqueue element is too short");
+-        goto out;
++        goto err;
+     }
+ 
+     virtqueue_push(vq, elem, sizeof(event));
+     virtio_notify(VIRTIO_DEVICE(vvc), vq);
+ 
+-out:
++    g_free(elem);
++    return;
++
++err:
++    virtqueue_detach_element(vq, elem, 0);
+     g_free(elem);
+ }
+ 

debian/patches/extra/0015-vhost-user-remove-VirtQ-notifier-restore.patch

@@ -0,0 +1,98 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Xueming Li <xuemingl@nvidia.com>
+Date: Mon, 7 Feb 2022 15:19:28 +0800
+Subject: [PATCH] vhost-user: remove VirtQ notifier restore
+
+Notifier set when vhost-user backend asks qemu to mmap an FD and
+offset. When vhost-user backend restart or getting killed, VQ notifier
+FD and mmap addresses become invalid. After backend restart, MR contains
+the invalid address will be restored and fail on notifier access.
+
+On the other hand, qemu should munmap the notifier, release underlying
+hardware resources to enable backend restart and allocate hardware
+notifier resources correctly.
+
+Qemu shouldn't reference and use resources of disconnected backend.
+
+This patch removes VQ notifier restore, uses the default vhost-user
+notifier to avoid invalid address access.
+
+After backend restart, the backend should ask qemu to install a hardware
+notifier if needed.
+
+Fixes: 44866521bd6e ("vhost-user: support registering external host notifiers")
+Cc: qemu-stable@nongnu.org
+Signed-off-by: Xueming Li <xuemingl@nvidia.com>
+Message-Id: <20220207071929.527149-2-xuemingl@nvidia.com>
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+(cherry picked from commit e867144b73b3c5009266b6df07d5ff44acfb82c3)
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+---
+ hw/virtio/vhost-user.c         | 19 +------------------
+ include/hw/virtio/vhost-user.h |  1 -
+ 2 files changed, 1 insertion(+), 19 deletions(-)
+
+diff --git a/hw/virtio/vhost-user.c b/hw/virtio/vhost-user.c
+index bf6e50223c..c671719e9b 100644
+--- a/hw/virtio/vhost-user.c
++++ b/hw/virtio/vhost-user.c
+@@ -1143,19 +1143,6 @@ static int vhost_user_set_vring_num(struct vhost_dev *dev,
+     return vhost_set_vring(dev, VHOST_USER_SET_VRING_NUM, ring);
+ }
+ 
+-static void vhost_user_host_notifier_restore(struct vhost_dev *dev,
+-                                             int queue_idx)
+-{
+-    struct vhost_user *u = dev->opaque;
+-    VhostUserHostNotifier *n = &u->user->notifier[queue_idx];
+-    VirtIODevice *vdev = dev->vdev;
+-
+-    if (n->addr && !n->set) {
+-        virtio_queue_set_host_notifier_mr(vdev, queue_idx, &n->mr, true);
+-        n->set = true;
+-    }
+-}
+-
+ static void vhost_user_host_notifier_remove(struct vhost_dev *dev,
+                                             int queue_idx)
+ {
+@@ -1163,17 +1150,14 @@ static void vhost_user_host_notifier_remove(struct vhost_dev *dev,
+     VhostUserHostNotifier *n = &u->user->notifier[queue_idx];
+     VirtIODevice *vdev = dev->vdev;
+ 
+-    if (n->addr && n->set) {
++    if (n->addr) {
+         virtio_queue_set_host_notifier_mr(vdev, queue_idx, &n->mr, false);
+-        n->set = false;
+     }
+ }
+ 
+ static int vhost_user_set_vring_base(struct vhost_dev *dev,
+                                      struct vhost_vring_state *ring)
+ {
+-    vhost_user_host_notifier_restore(dev, ring->index);
+-
+     return vhost_set_vring(dev, VHOST_USER_SET_VRING_BASE, ring);
+ }
+ 
+@@ -1538,7 +1522,6 @@ static int vhost_user_slave_handle_vring_host_notifier(struct vhost_dev *dev,
+     }
+ 
+     n->addr = addr;
+-    n->set = true;
+ 
+     return 0;
+ }
+diff --git a/include/hw/virtio/vhost-user.h b/include/hw/virtio/vhost-user.h
+index a9abca3288..f6012b2078 100644
+--- a/include/hw/virtio/vhost-user.h
++++ b/include/hw/virtio/vhost-user.h
+@@ -14,7 +14,6 @@
+ typedef struct VhostUserHostNotifier {
+     MemoryRegion mr;
+     void *addr;
+-    bool set;
+ } VhostUserHostNotifier;
+ 
+ typedef struct VhostUserState {

debian/patches/extra/0016-vhost-user-fix-VirtQ-notifier-cleanup.patch

@@ -0,0 +1,149 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Xueming Li <xuemingl@nvidia.com>
+Date: Mon, 7 Feb 2022 15:19:29 +0800
+Subject: [PATCH] vhost-user: fix VirtQ notifier cleanup
+
+When vhost-user device cleanup, remove notifier MR and munmaps notifier
+address in the event-handling thread, VM CPU thread writing the notifier
+in concurrent fails with an error of accessing invalid address. It
+happens because MR is still being referenced and accessed in another
+thread while the underlying notifier mmap address is being freed and
+becomes invalid.
+
+This patch calls RCU and munmap notifiers in the callback after the
+memory flatview update finish.
+
+Fixes: 44866521bd6e ("vhost-user: support registering external host notifiers")
+Cc: qemu-stable@nongnu.org
+Signed-off-by: Xueming Li <xuemingl@nvidia.com>
+Message-Id: <20220207071929.527149-3-xuemingl@nvidia.com>
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+(cherry picked from commit 0b0af4d62f7002b31cd7b2762b26d2fcb76bb2ba)
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+---
+ hw/virtio/vhost-user.c         | 48 ++++++++++++++++++++--------------
+ include/hw/virtio/vhost-user.h |  2 ++
+ 2 files changed, 31 insertions(+), 19 deletions(-)
+
+diff --git a/hw/virtio/vhost-user.c b/hw/virtio/vhost-user.c
+index c671719e9b..ed5f9a5471 100644
+--- a/hw/virtio/vhost-user.c
++++ b/hw/virtio/vhost-user.c
+@@ -25,6 +25,7 @@
+ #include "migration/migration.h"
+ #include "migration/postcopy-ram.h"
+ #include "trace.h"
++#include "exec/ramblock.h"
+ 
+ #include <sys/ioctl.h>
+ #include <sys/socket.h>
+@@ -1143,15 +1144,26 @@ static int vhost_user_set_vring_num(struct vhost_dev *dev,
+     return vhost_set_vring(dev, VHOST_USER_SET_VRING_NUM, ring);
+ }
+ 
+-static void vhost_user_host_notifier_remove(struct vhost_dev *dev,
+-                                            int queue_idx)
++static void vhost_user_host_notifier_free(VhostUserHostNotifier *n)
+ {
+-    struct vhost_user *u = dev->opaque;
+-    VhostUserHostNotifier *n = &u->user->notifier[queue_idx];
+-    VirtIODevice *vdev = dev->vdev;
++    assert(n && n->unmap_addr);
++    munmap(n->unmap_addr, qemu_real_host_page_size);
++    n->unmap_addr = NULL;
++}
++
++static void vhost_user_host_notifier_remove(VhostUserState *user,
++                                            VirtIODevice *vdev, int queue_idx)
++{
++    VhostUserHostNotifier *n = &user->notifier[queue_idx];
+ 
+     if (n->addr) {
+-        virtio_queue_set_host_notifier_mr(vdev, queue_idx, &n->mr, false);
++        if (vdev) {
++            virtio_queue_set_host_notifier_mr(vdev, queue_idx, &n->mr, false);
++        }
++        assert(!n->unmap_addr);
++        n->unmap_addr = n->addr;
++        n->addr = NULL;
++        call_rcu(n, vhost_user_host_notifier_free, rcu);
+     }
+ }
+ 
+@@ -1190,8 +1202,9 @@ static int vhost_user_get_vring_base(struct vhost_dev *dev,
+         .payload.state = *ring,
+         .hdr.size = sizeof(msg.payload.state),
+     };
++    struct vhost_user *u = dev->opaque;
+ 
+-    vhost_user_host_notifier_remove(dev, ring->index);
++    vhost_user_host_notifier_remove(u->user, dev->vdev, ring->index);
+ 
+     if (vhost_user_write(dev, &msg, NULL, 0) < 0) {
+         return -1;
+@@ -1486,12 +1499,7 @@ static int vhost_user_slave_handle_vring_host_notifier(struct vhost_dev *dev,
+ 
+     n = &user->notifier[queue_idx];
+ 
+-    if (n->addr) {
+-        virtio_queue_set_host_notifier_mr(vdev, queue_idx, &n->mr, false);
+-        object_unparent(OBJECT(&n->mr));
+-        munmap(n->addr, page_size);
+-        n->addr = NULL;
+-    }
++    vhost_user_host_notifier_remove(user, vdev, queue_idx);
+ 
+     if (area->u64 & VHOST_USER_VRING_NOFD_MASK) {
+         return 0;
+@@ -1510,9 +1518,12 @@ static int vhost_user_slave_handle_vring_host_notifier(struct vhost_dev *dev,
+ 
+     name = g_strdup_printf("vhost-user/host-notifier@%p mmaps[%d]",
+                            user, queue_idx);
+-    if (!n->mr.ram) /* Don't init again after suspend. */
++    if (!n->mr.ram) { /* Don't init again after suspend. */
+         memory_region_init_ram_device_ptr(&n->mr, OBJECT(vdev), name,
+                                           page_size, addr);
++    } else {
++        n->mr.ram_block->host = addr;
++    }
+     g_free(name);
+ 
+     if (virtio_queue_set_host_notifier_mr(vdev, queue_idx, &n->mr, true)) {
+@@ -2460,17 +2471,16 @@ bool vhost_user_init(VhostUserState *user, CharBackend *chr, Error **errp)
+ void vhost_user_cleanup(VhostUserState *user)
+ {
+     int i;
++    VhostUserHostNotifier *n;
+ 
+     if (!user->chr) {
+         return;
+     }
+     memory_region_transaction_begin();
+     for (i = 0; i < VIRTIO_QUEUE_MAX; i++) {
+-        if (user->notifier[i].addr) {
+-            object_unparent(OBJECT(&user->notifier[i].mr));
+-            munmap(user->notifier[i].addr, qemu_real_host_page_size);
+-            user->notifier[i].addr = NULL;
+-        }
++        n = &user->notifier[i];
++        vhost_user_host_notifier_remove(user, NULL, i);
++        object_unparent(OBJECT(&n->mr));
+     }
+     memory_region_transaction_commit();
+     user->chr = NULL;
+diff --git a/include/hw/virtio/vhost-user.h b/include/hw/virtio/vhost-user.h
+index f6012b2078..e44a41bb70 100644
+--- a/include/hw/virtio/vhost-user.h
++++ b/include/hw/virtio/vhost-user.h
+@@ -12,8 +12,10 @@
+ #include "hw/virtio/virtio.h"
+ 
+ typedef struct VhostUserHostNotifier {
++    struct rcu_head rcu;
+     MemoryRegion mr;
+     void *addr;
++    void *unmap_addr;
+ } VhostUserHostNotifier;
+ 
+ typedef struct VhostUserState {

debian/patches/extra/0017-virtio-fix-the-condition-for-iommu_platform-not-supp.patch

@@ -0,0 +1,101 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Halil Pasic <pasic@linux.ibm.com>
+Date: Mon, 7 Feb 2022 12:28:57 +0100
+Subject: [PATCH] virtio: fix the condition for iommu_platform not supported
+
+The commit 04ceb61a40 ("virtio: Fail if iommu_platform is requested, but
+unsupported") claims to fail the device hotplug when iommu_platform
+is requested, but not supported by the (vhost) device. On the first
+glance the condition for detecting that situation looks perfect, but
+because a certain peculiarity of virtio_platform it ain't.
+
+In fact the aforementioned commit introduces a regression. It breaks
+virtio-fs support for Secure Execution, and most likely also for AMD SEV
+or any other confidential guest scenario that relies encrypted guest
+memory.  The same also applies to any other vhost device that does not
+support _F_ACCESS_PLATFORM.
+
+The peculiarity is that iommu_platform and _F_ACCESS_PLATFORM collates
+"device can not access all of the guest RAM" and "iova != gpa, thus
+device needs to translate iova".
+
+Confidential guest technologies currently rely on the device/hypervisor
+offering _F_ACCESS_PLATFORM, so that, after the feature has been
+negotiated, the guest  grants access to the portions of memory the
+device needs to see. So in for confidential guests, generally,
+_F_ACCESS_PLATFORM is about the restricted access to memory, but not
+about the addresses used being something else than guest physical
+addresses.
+
+This is the very reason for which commit f7ef7e6e3b ("vhost: correctly
+turn on VIRTIO_F_IOMMU_PLATFORM") fences _F_ACCESS_PLATFORM from the
+vhost device that does not need it, because on the vhost interface it
+only means "I/O address translation is needed".
+
+This patch takes inspiration from f7ef7e6e3b ("vhost: correctly turn on
+VIRTIO_F_IOMMU_PLATFORM"), and uses the same condition for detecting the
+situation when _F_ACCESS_PLATFORM is requested, but no I/O translation
+by the device, and thus no device capability is needed. In this
+situation claiming that the device does not support iommu_plattform=on
+is counter-productive. So let us stop doing that!
+
+Signed-off-by: Halil Pasic <pasic@linux.ibm.com>
+Reported-by: Jakob Naucke <Jakob.Naucke@ibm.com>
+Fixes: 04ceb61a40 ("virtio: Fail if iommu_platform is requested, but
+unsupported")
+Acked-by: Cornelia Huck <cohuck@redhat.com>
+Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
+Tested-by: Daniel Henrique Barboza <danielhb413@gmail.com>
+Cc: Kevin Wolf <kwolf@redhat.com>
+Cc: qemu-stable@nongnu.org
+
+Message-Id: <20220207112857.607829-1-pasic@linux.ibm.com>
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+(cherry picked from commit e65902a913bf31ba79a83a3bd3621108b85cf645)
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+---
+ hw/virtio/virtio-bus.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/hw/virtio/virtio-bus.c b/hw/virtio/virtio-bus.c
+index d23db98c56..0f69d1c742 100644
+--- a/hw/virtio/virtio-bus.c
++++ b/hw/virtio/virtio-bus.c
+@@ -48,6 +48,7 @@ void virtio_bus_device_plugged(VirtIODevice *vdev, Error **errp)
+     VirtioBusClass *klass = VIRTIO_BUS_GET_CLASS(bus);
+     VirtioDeviceClass *vdc = VIRTIO_DEVICE_GET_CLASS(vdev);
+     bool has_iommu = virtio_host_has_feature(vdev, VIRTIO_F_IOMMU_PLATFORM);
++    bool vdev_has_iommu;
+     Error *local_err = NULL;
+ 
+     DPRINTF("%s: plug device.\n", qbus->name);
+@@ -69,11 +70,6 @@ void virtio_bus_device_plugged(VirtIODevice *vdev, Error **errp)
+         return;
+     }
+ 
+-    if (has_iommu && !virtio_host_has_feature(vdev, VIRTIO_F_IOMMU_PLATFORM)) {
+-        error_setg(errp, "iommu_platform=true is not supported by the device");
+-        return;
+-    }
+-
+     if (klass->device_plugged != NULL) {
+         klass->device_plugged(qbus->parent, &local_err);
+     }
+@@ -82,9 +78,15 @@ void virtio_bus_device_plugged(VirtIODevice *vdev, Error **errp)
+         return;
+     }
+ 
++    vdev_has_iommu = virtio_host_has_feature(vdev, VIRTIO_F_IOMMU_PLATFORM);
+     if (klass->get_dma_as != NULL && has_iommu) {
+         virtio_add_feature(&vdev->host_features, VIRTIO_F_IOMMU_PLATFORM);
+         vdev->dma_as = klass->get_dma_as(qbus->parent);
++        if (!vdev_has_iommu && vdev->dma_as != &address_space_memory) {
++            error_setg(errp,
++                       "iommu_platform=true is not supported by the device");
++            return;
++        }
+     } else {
+         vdev->dma_as = &address_space_memory;
+     }

debian/patches/extra/0018-block-gluster-correctly-set-max_pdiscard-which-is-in.patch

@@ -0,0 +1,38 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Fabian Ebner <f.ebner@proxmox.com>
+Date: Fri, 6 May 2022 14:38:35 +0200
+Subject: [PATCH] block/gluster: correctly set max_pdiscard which is int64_t
+
+Previously, max_pdiscard would be zero in the following assertion:
+qemu-system-x86_64: ../block/io.c:3166: bdrv_co_pdiscard: Assertion
+`max_pdiscard >= bs->bl.request_alignment' failed.
+
+Fixes: 0c8022876f ("block: use int64_t instead of int in driver discard handlers")
+Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+---
+ block/gluster.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/block/gluster.c b/block/gluster.c
+index 398976bc66..592e71b22a 100644
+--- a/block/gluster.c
++++ b/block/gluster.c
+@@ -891,7 +891,7 @@ out:
+ static void qemu_gluster_refresh_limits(BlockDriverState *bs, Error **errp)
+ {
+     bs->bl.max_transfer = GLUSTER_MAX_TRANSFER;
+-    bs->bl.max_pdiscard = SIZE_MAX;
++    bs->bl.max_pdiscard = INT64_MAX;
+ }
+ 
+ static int qemu_gluster_reopen_prepare(BDRVReopenState *state,
+@@ -1304,7 +1304,7 @@ static coroutine_fn int qemu_gluster_co_pdiscard(BlockDriverState *bs,
+     GlusterAIOCB acb;
+     BDRVGlusterState *s = bs->opaque;
+ 
+-    assert(bytes <= SIZE_MAX); /* rely on max_pdiscard */
++    assert(bytes <= INT64_MAX); /* rely on max_pdiscard */
+ 
+     acb.size = 0;
+     acb.ret = 0;

debian/patches/extra/0019-ui-vnc.c-Fixed-a-deadlock-bug.patch

@@ -0,0 +1,72 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Rao Lei <lei.rao@intel.com>
+Date: Fri, 6 May 2022 14:38:36 +0200
+Subject: [PATCH] ui/vnc.c: Fixed a deadlock bug.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The GDB statck is as follows:
+(gdb) bt
+0  __lll_lock_wait (futex=futex@entry=0x56211df20360, private=0) at lowlevellock.c:52
+1  0x00007f263caf20a3 in __GI___pthread_mutex_lock (mutex=0x56211df20360) at ../nptl/pthread_mutex_lock.c:80
+2  0x000056211a757364 in qemu_mutex_lock_impl (mutex=0x56211df20360, file=0x56211a804857 "../ui/vnc-jobs.h", line=60)
+    at ../util/qemu-thread-posix.c:80
+3  0x000056211a0ef8c7 in vnc_lock_output (vs=0x56211df14200) at ../ui/vnc-jobs.h:60
+4  0x000056211a0efcb7 in vnc_clipboard_send (vs=0x56211df14200, count=1, dwords=0x7ffdf1701338) at ../ui/vnc-clipboard.c:138
+5  0x000056211a0f0129 in vnc_clipboard_notify (notifier=0x56211df244c8, data=0x56211dd1bbf0) at ../ui/vnc-clipboard.c:209
+6  0x000056211a75dde8 in notifier_list_notify (list=0x56211afa17d0 <clipboard_notifiers>, data=0x56211dd1bbf0) at ../util/notify.c:39
+7  0x000056211a0bf0e6 in qemu_clipboard_update (info=0x56211dd1bbf0) at ../ui/clipboard.c:50
+8  0x000056211a0bf05d in qemu_clipboard_peer_release (peer=0x56211df244c0, selection=QEMU_CLIPBOARD_SELECTION_CLIPBOARD)
+    at ../ui/clipboard.c:41
+9  0x000056211a0bef9b in qemu_clipboard_peer_unregister (peer=0x56211df244c0) at ../ui/clipboard.c:19
+10 0x000056211a0d45f3 in vnc_disconnect_finish (vs=0x56211df14200) at ../ui/vnc.c:1358
+11 0x000056211a0d4c9d in vnc_client_read (vs=0x56211df14200) at ../ui/vnc.c:1611
+12 0x000056211a0d4df8 in vnc_client_io (ioc=0x56211ce70690, condition=G_IO_IN, opaque=0x56211df14200) at ../ui/vnc.c:1649
+13 0x000056211a5b976c in qio_channel_fd_source_dispatch
+    (source=0x56211ce50a00, callback=0x56211a0d4d71 <vnc_client_io>, user_data=0x56211df14200) at ../io/channel-watch.c:84
+14 0x00007f263ccede8e in g_main_context_dispatch () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
+15 0x000056211a77d4a1 in glib_pollfds_poll () at ../util/main-loop.c:232
+16 0x000056211a77d51f in os_host_main_loop_wait (timeout=958545) at ../util/main-loop.c:255
+17 0x000056211a77d630 in main_loop_wait (nonblocking=0) at ../util/main-loop.c:531
+18 0x000056211a45bc8e in qemu_main_loop () at ../softmmu/runstate.c:726
+19 0x000056211a0b45fa in main (argc=69, argv=0x7ffdf1701778, envp=0x7ffdf17019a8) at ../softmmu/main.c:50
+
+From the call trace, we can see it is a deadlock bug.
+vnc_disconnect_finish will acquire the output_mutex.
+But, the output_mutex will be acquired again in vnc_clipboard_send.
+Repeated locking will cause deadlock. So, I move
+qemu_clipboard_peer_unregister() behind vnc_unlock_output();
+
+Fixes: 0bf41cab93e ("ui/vnc: clipboard support")
+Signed-off-by: Lei Rao <lei.rao@intel.com>
+Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
+Message-Id: <20220105020808.597325-1-lei.rao@intel.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry-picked from commit 1dbbe6f172810026c51dc84ed927a3cc23017949)
+[FE: trivial backport for 6.2]
+Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+---
+ ui/vnc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/ui/vnc.c b/ui/vnc.c
+index af02522e84..b253e85c65 100644
+--- a/ui/vnc.c
++++ b/ui/vnc.c
+@@ -1354,12 +1354,12 @@ void vnc_disconnect_finish(VncState *vs)
+         /* last client gone */
+         vnc_update_server_surface(vs->vd);
+     }
++    vnc_unlock_output(vs);
++
+     if (vs->cbpeer.update.notify) {
+         qemu_clipboard_peer_unregister(&vs->cbpeer);
+     }
+ 
+-    vnc_unlock_output(vs);
+-
+     qemu_mutex_destroy(&vs->output_mutex);
+     if (vs->bh != NULL) {
+         qemu_bh_delete(vs->bh);

debian/patches/extra/0020-display-qxl-render-fix-race-condition-in-qxl_cursor-.patch

@@ -0,0 +1,37 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Mauro Matteo Cascella <mcascell@redhat.com>
+Date: Thu, 7 Apr 2022 10:11:06 +0200
+Subject: [PATCH] display/qxl-render: fix race condition in qxl_cursor
+ (CVE-2021-4207)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Avoid fetching 'width' and 'height' a second time to prevent possible
+race condition. Refer to security advisory
+https://starlabs.sg/advisories/22-4207/ for more information.
+
+Fixes: CVE-2021-4207
+Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>
+Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
+Message-Id: <20220407081106.343235-1-mcascell@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 9569f5cb5b4bffa9d3ebc8ba7da1e03830a9a895)
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+---
+ hw/display/qxl-render.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/hw/display/qxl-render.c b/hw/display/qxl-render.c
+index d28849b121..237ed293ba 100644
+--- a/hw/display/qxl-render.c
++++ b/hw/display/qxl-render.c
+@@ -266,7 +266,7 @@ static QEMUCursor *qxl_cursor(PCIQXLDevice *qxl, QXLCursor *cursor,
+         }
+         break;
+     case SPICE_CURSOR_TYPE_ALPHA:
+-        size = sizeof(uint32_t) * cursor->header.width * cursor->header.height;
++        size = sizeof(uint32_t) * c->width * c->height;
+         qxl_unpack_chunks(c->data, size, qxl, &cursor->chunk, group_id);
+         if (qxl->debug > 2) {
+             cursor_print_ascii_art(c, "qxl/alpha");

debian/patches/extra/0021-ui-cursor-fix-integer-overflow-in-cursor_alloc-CVE-2.patch

@@ -0,0 +1,83 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Mauro Matteo Cascella <mcascell@redhat.com>
+Date: Thu, 7 Apr 2022 10:17:12 +0200
+Subject: [PATCH] ui/cursor: fix integer overflow in cursor_alloc
+ (CVE-2021-4206)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Prevent potential integer overflow by limiting 'width' and 'height' to
+512x512. Also change 'datasize' type to size_t. Refer to security
+advisory https://starlabs.sg/advisories/22-4206/ for more information.
+
+Fixes: CVE-2021-4206
+Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>
+Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
+Message-Id: <20220407081712.345609-1-mcascell@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit fa892e9abb728e76afcf27323ab29c57fb0fe7aa)
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+---
+ hw/display/qxl-render.c | 7 +++++++
+ hw/display/vmware_vga.c | 2 ++
+ ui/cursor.c             | 8 +++++++-
+ 3 files changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/hw/display/qxl-render.c b/hw/display/qxl-render.c
+index 237ed293ba..ca217004bf 100644
+--- a/hw/display/qxl-render.c
++++ b/hw/display/qxl-render.c
+@@ -247,6 +247,13 @@ static QEMUCursor *qxl_cursor(PCIQXLDevice *qxl, QXLCursor *cursor,
+     size_t size;
+ 
+     c = cursor_alloc(cursor->header.width, cursor->header.height);
++
++    if (!c) {
++        qxl_set_guest_bug(qxl, "%s: cursor %ux%u alloc error", __func__,
++                cursor->header.width, cursor->header.height);
++        goto fail;
++    }
++
+     c->hot_x = cursor->header.hot_spot_x;
+     c->hot_y = cursor->header.hot_spot_y;
+     switch (cursor->header.type) {
+diff --git a/hw/display/vmware_vga.c b/hw/display/vmware_vga.c
+index e2969a6c81..2b81d6122f 100644
+--- a/hw/display/vmware_vga.c
++++ b/hw/display/vmware_vga.c
+@@ -509,6 +509,8 @@ static inline void vmsvga_cursor_define(struct vmsvga_state_s *s,
+     int i, pixels;
+ 
+     qc = cursor_alloc(c->width, c->height);
++    assert(qc != NULL);
++
+     qc->hot_x = c->hot_x;
+     qc->hot_y = c->hot_y;
+     switch (c->bpp) {
+diff --git a/ui/cursor.c b/ui/cursor.c
+index 1d62ddd4d0..835f0802f9 100644
+--- a/ui/cursor.c
++++ b/ui/cursor.c
+@@ -46,6 +46,8 @@ static QEMUCursor *cursor_parse_xpm(const char *xpm[])
+ 
+     /* parse pixel data */
+     c = cursor_alloc(width, height);
++    assert(c != NULL);
++
+     for (pixel = 0, y = 0; y < height; y++, line++) {
+         for (x = 0; x < height; x++, pixel++) {
+             idx = xpm[line][x];
+@@ -91,7 +93,11 @@ QEMUCursor *cursor_builtin_left_ptr(void)
+ QEMUCursor *cursor_alloc(int width, int height)
+ {
+     QEMUCursor *c;
+-    int datasize = width * height * sizeof(uint32_t);
++    size_t datasize = width * height * sizeof(uint32_t);
++
++    if (width > 512 || height > 512) {
++        return NULL;
++    }
+ 
+     c = g_malloc0(sizeof(QEMUCursor) + datasize);
+     c->width  = width;

debian/patches/pve-qemu-6.2-vitastor.patch

@@ -2,7 +2,7 @@ Index: qemu/block/meson.build
 ===================================================================
 --- qemu.orig/block/meson.build
 +++ qemu/block/meson.build
-@@ -111,6 +111,7 @@ foreach m : [
+@@ -91,6 +91,7 @@ foreach m : [
    [libnfs, 'nfs', files('nfs.c')],
    [libssh, 'ssh', files('ssh.c')],
    [rbd, 'rbd', files('rbd.c')],
@@ -14,7 +14,7 @@ Index: qemu/meson.build
 ===================================================================
 --- qemu.orig/meson.build
 +++ qemu/meson.build
-@@ -967,6 +967,26 @@ if not get_option('rbd').auto() or have_
+@@ -838,6 +838,26 @@ if not get_option('rbd').auto() or have_
    endif
  endif
  
@@ -41,40 +41,40 @@ Index: qemu/meson.build
  glusterfs = not_found
  glusterfs_ftruncate_has_stat = false
  glusterfs_iocb_has_stat = false
-@@ -1802,6 +1822,7 @@ config_host_data.set('CONFIG_NUMA', numa
- config_host_data.set('CONFIG_OPENGL', opengl.found())
- config_host_data.set('CONFIG_PROFILER', get_option('profiler'))
+@@ -1459,6 +1479,7 @@ config_host_data.set('CONFIG_LINUX_AIO',
+ config_host_data.set('CONFIG_LINUX_IO_URING', linux_io_uring.found())
+ config_host_data.set('CONFIG_LIBPMEM', libpmem.found())
  config_host_data.set('CONFIG_RBD', rbd.found())
 +config_host_data.set('CONFIG_VITASTOR', vitastor.found())
- config_host_data.set('CONFIG_RDMA', rdma.found())
  config_host_data.set('CONFIG_SDL', sdl.found())
  config_host_data.set('CONFIG_SDL_IMAGE', sdl_image.found())
-@@ -3965,6 +3986,7 @@ if spice_protocol.found()
+ config_host_data.set('CONFIG_SECCOMP', seccomp.found())
+@@ -3424,6 +3445,7 @@ if spice_protocol.found()
    summary_info += {'  spice server support': spice}
  endif
  summary_info += {'rbd support':       rbd}
 +summary_info += {'vitastor support':  vitastor}
+ summary_info += {'xfsctl support':    config_host.has_key('CONFIG_XFS')}
  summary_info += {'smartcard support': cacard}
  summary_info += {'U2F support':       u2f}
- summary_info += {'libusb':            libusb}
 Index: qemu/meson_options.txt
 ===================================================================
 --- qemu.orig/meson_options.txt
 +++ qemu/meson_options.txt
-@@ -167,6 +167,8 @@ option('lzo', type : 'feature', value :
+@@ -121,6 +121,8 @@ option('lzo', type : 'feature', value :
         description: 'lzo compression support')
  option('rbd', type : 'feature', value : 'auto',
         description: 'Ceph block device driver')
 +option('vitastor', type : 'feature', value : 'auto',
 +       description: 'Vitastor block device driver')
- option('opengl', type : 'feature', value : 'auto',
-        description: 'OpenGL support')
- option('rdma', type : 'feature', value : 'auto',
+ option('gtk', type : 'feature', value : 'auto',
+        description: 'GTK+ user interface')
+ option('sdl', type : 'feature', value : 'auto',
 Index: qemu/qapi/block-core.json
 ===================================================================
 --- qemu.orig/qapi/block-core.json
 +++ qemu/qapi/block-core.json
-@@ -3209,7 +3209,7 @@
+@@ -3179,7 +3179,7 @@
              'preallocate', 'qcow', 'qcow2', 'qed', 'quorum', 'raw', 'rbd',
              { 'name': 'replication', 'if': 'CONFIG_REPLICATION' },
              'pbs',
@@ -83,7 +83,7 @@ Index: qemu/qapi/block-core.json
  
  ##
  # @BlockdevOptionsFile:
-@@ -4149,6 +4149,28 @@
+@@ -4125,6 +4125,28 @@
              '*server': ['InetSocketAddressBase'] } }
  
  ##
@@ -112,7 +112,7 @@ Index: qemu/qapi/block-core.json
  # @ReplicationMode:
  #
  # An enumeration of replication modes.
-@@ -4593,6 +4615,7 @@
+@@ -4520,6 +4542,7 @@
        'throttle':   'BlockdevOptionsThrottle',
        'vdi':        'BlockdevOptionsGenericFormat',
        'vhdx':       'BlockdevOptionsGenericFormat',
@@ -120,7 +120,7 @@ Index: qemu/qapi/block-core.json
        'vmdk':       'BlockdevOptionsGenericCOWFormat',
        'vpc':        'BlockdevOptionsGenericFormat',
        'vvfat':      'BlockdevOptionsVVFAT'
-@@ -4985,6 +5008,17 @@
+@@ -4910,6 +4933,17 @@
              '*encrypt' :        'RbdEncryptionCreateOptions' } }
  
  ##
@@ -138,7 +138,7 @@ Index: qemu/qapi/block-core.json
  # @BlockdevVmdkSubformat:
  #
  # Subformat options for VMDK images
-@@ -5182,6 +5216,7 @@
+@@ -5108,6 +5142,7 @@
        'ssh':            'BlockdevCreateOptionsSsh',
        'vdi':            'BlockdevCreateOptionsVdi',
        'vhdx':           'BlockdevCreateOptionsVhdx',
@@ -159,7 +159,7 @@ Index: qemu/scripts/ci/org.centos/stream/8/x86_64/configure
  --audio-drv-list="" \
  --block-drv-ro-whitelist="vmdk,vhdx,vpc,https,ssh" \
  --with-coroutine=ucontext \
-@@ -179,6 +179,7 @@
+@@ -183,6 +183,7 @@
  --enable-opengl \
  --enable-pie \
  --enable-rbd \
@@ -171,7 +171,7 @@ Index: a/block/vitastor.c
 ===================================================================
 --- /dev/null
 +++ a/block/vitastor.c
-@@ -0,0 +1,1017 @@
+@@ -0,0 +1,797 @@
 +// Copyright (c) Vitaliy Filippov, 2019+
 +// License: VNPL-1.1 or GNU GPL-2.0+ (see README.md for details)
 +
@@ -183,9 +183,6 @@ Index: a/block/vitastor.c
 +#endif
 +#include "qemu/osdep.h"
 +#include "qemu/main-loop.h"
-+#if QEMU_VERSION_MAJOR >= 8
-+#include "block/block-io.h"
-+#endif
 +#include "block/block_int.h"
 +#include "qapi/error.h"
 +#include "qapi/qmp/qdict.h"
@@ -209,11 +206,6 @@ Index: a/block/vitastor.c
 +#define qdict_put_str(options, name, value) qdict_put_obj(options, name, QOBJECT(qstring_from_str(value)))
 +#define qobject_unref QDECREF
 +#endif
-+#if QEMU_VERSION_MAJOR == 4 && QEMU_VERSION_MINOR >= 2 || QEMU_VERSION_MAJOR > 4
-+#include "sysemu/replay.h"
-+#else
-+#include "sysemu/sysemu.h"
-+#endif
 +
 +#include "vitastor_c.h"
 +
@@ -227,13 +219,9 @@ Index: a/block/vitastor.c
 +}
 +#endif
 +
-+typedef struct VitastorFdData VitastorFdData;
-+
 +typedef struct VitastorClient
 +{
 +    void *proxy;
-+    int uring_eventfd;
-+
 +    void *watch;
 +    char *config_path;
 +    char *etcd_host;
@@ -250,24 +238,12 @@ Index: a/block/vitastor.c
 +    int rdma_gid_index;
 +    int rdma_mtu;
 +    QemuMutex mutex;
-+    AioContext *ctx;
-+    VitastorFdData **fds;
-+    int fd_count, fd_alloc;
-+    int bh_uring_scheduled;
 +
 +    uint64_t last_bitmap_inode, last_bitmap_offset, last_bitmap_len;
 +    uint32_t last_bitmap_granularity;
 +    uint8_t *last_bitmap;
 +} VitastorClient;
 +
-+typedef struct VitastorFdData
-+{
-+    VitastorClient *cli;
-+    int fd;
-+    IOHandler *fd_read, *fd_write;
-+    void *opaque;
-+} VitastorFdData;
-+
 +typedef struct VitastorRPC
 +{
 +    BlockDriverState *bs;
@@ -278,21 +254,10 @@ Index: a/block/vitastor.c
 +    uint64_t inode, offset, len;
 +    uint32_t bitmap_granularity;
 +    uint8_t *bitmap;
-+#if QEMU_VERSION_MAJOR == 2 && QEMU_VERSION_MINOR < 8
-+    QEMUBH *bh;
-+#endif
 +} VitastorRPC;
 +
-+#if QEMU_VERSION_MAJOR == 2 && QEMU_VERSION_MINOR < 8
-+typedef struct VitastorBH
-+{
-+    VitastorClient *cli;
-+    QEMUBH *bh;
-+} VitastorBH;
-+#endif
-+
 +static void vitastor_co_init_task(BlockDriverState *bs, VitastorRPC *task);
-+static void vitastor_co_generic_cb(void *opaque, long retval);
++static void vitastor_co_generic_bh_cb(void *opaque, long retval);
 +static void vitastor_co_read_cb(void *opaque, long retval, uint64_t version);
 +static void vitastor_close(BlockDriverState *bs);
 +
@@ -408,57 +373,6 @@ Index: a/block/vitastor.c
 +    return;
 +}
 +
-+#if defined VITASTOR_C_API_VERSION && VITASTOR_C_API_VERSION >= 2
-+static void vitastor_uring_handler(void *opaque)
-+{
-+    VitastorClient *client = (VitastorClient*)opaque;
-+    qemu_mutex_lock(&client->mutex);
-+    client->bh_uring_scheduled = 0;
-+    do
-+    {
-+        vitastor_c_uring_handle_events(client->proxy);
-+    } while (vitastor_c_uring_has_work(client->proxy));
-+    qemu_mutex_unlock(&client->mutex);
-+}
-+
-+#if QEMU_VERSION_MAJOR == 2 && QEMU_VERSION_MINOR < 8
-+static void vitastor_bh_uring_handler(void *opaque)
-+{
-+    VitastorBH *vbh = opaque;
-+    vitastor_bh_handler(vbh->cli);
-+    qemu_bh_delete(vbh->bh);
-+    free(vbh);
-+}
-+#endif
-+
-+static void vitastor_schedule_uring_handler(VitastorClient *client)
-+{
-+    void *opaque = client;
-+    if (client->uring_eventfd >= 0 && !client->bh_uring_scheduled)
-+    {
-+        client->bh_uring_scheduled = 1;
-+#if QEMU_VERSION_MAJOR > 4 || QEMU_VERSION_MAJOR == 4 && QEMU_VERSION_MINOR >= 2
-+        replay_bh_schedule_oneshot_event(client->ctx, vitastor_uring_handler, opaque);
-+#elif QEMU_VERSION_MAJOR >= 3 || QEMU_VERSION_MAJOR == 2 && QEMU_VERSION_MINOR >= 8
-+        aio_bh_schedule_oneshot(client->ctx, vitastor_uring_handler, opaque);
-+#else
-+        VitastorBH *vbh = (VitastorBH*)malloc(sizeof(VitastorBH));
-+        vbh->cli = client;
-+#if QEMU_VERSION_MAJOR >= 2
-+        vbh->bh = aio_bh_new(bdrv_get_aio_context(task->bs), vitastor_bh_uring_handler, vbh);
-+#else
-+        vbh->bh = qemu_bh_new(vitastor_bh_uring_handler, vbh);
-+#endif
-+        qemu_bh_schedule(vbh->bh);
-+#endif
-+    }
-+}
-+#else
-+static void vitastor_schedule_uring_handler(VitastorClient *client)
-+{
-+}
-+#endif
-+
 +static void coroutine_fn vitastor_co_get_metadata(VitastorRPC *task)
 +{
 +    BlockDriverState *bs = task->bs;
@@ -466,8 +380,7 @@ Index: a/block/vitastor.c
 +    task->co = qemu_coroutine_self();
 +
 +    qemu_mutex_lock(&client->mutex);
-+    vitastor_c_watch_inode(client->proxy, client->image, vitastor_co_generic_cb, task);
-+    vitastor_schedule_uring_handler(client);
++    vitastor_c_watch_inode(client->proxy, client->image, vitastor_co_generic_bh_cb, task);
 +    qemu_mutex_unlock(&client->mutex);
 +
 +    while (!task->complete)
@@ -476,32 +389,13 @@ Index: a/block/vitastor.c
 +    }
 +}
 +
-+static void vitastor_aio_fd_read(void *fddv)
-+{
-+    VitastorFdData *fdd = (VitastorFdData*)fddv;
-+    qemu_mutex_lock(&fdd->cli->mutex);
-+    fdd->fd_read(fdd->opaque);
-+    vitastor_schedule_uring_handler(fdd->cli);
-+    qemu_mutex_unlock(&fdd->cli->mutex);
-+}
-+
-+static void vitastor_aio_fd_write(void *fddv)
-+{
-+    VitastorFdData *fdd = (VitastorFdData*)fddv;
-+    qemu_mutex_lock(&fdd->cli->mutex);
-+    fdd->fd_write(fdd->opaque);
-+    vitastor_schedule_uring_handler(fdd->cli);
-+    qemu_mutex_unlock(&fdd->cli->mutex);
-+}
-+
-+static void universal_aio_set_fd_handler(AioContext *ctx, int fd, IOHandler *fd_read, IOHandler *fd_write, void *opaque)
++static void vitastor_aio_set_fd_handler(void *ctx, int fd, int unused1, IOHandler *fd_read, IOHandler *fd_write, void *unused2, void *opaque)
 +{
 +    aio_set_fd_handler(ctx, fd,
 +#if QEMU_VERSION_MAJOR == 2 && QEMU_VERSION_MINOR >= 5 || QEMU_VERSION_MAJOR >= 3
 +        0 /*is_external*/,
 +#endif
-+        fd_read,
-+        fd_write,
++        fd_read, fd_write,
 +#if QEMU_VERSION_MAJOR == 1 && QEMU_VERSION_MINOR <= 6 || QEMU_VERSION_MAJOR < 1
 +        NULL /*io_flush*/,
 +#endif
@@ -514,53 +408,6 @@ Index: a/block/vitastor.c
 +        opaque);
 +}
 +
-+static void vitastor_aio_set_fd_handler(void *vcli, int fd, int unused1, IOHandler *fd_read, IOHandler *fd_write, void *unused2, void *opaque)
-+{
-+    VitastorClient *client = (VitastorClient*)vcli;
-+    VitastorFdData *fdd = NULL;
-+    int i;
-+    for (i = 0; i < client->fd_count; i++)
-+    {
-+        if (client->fds[i]->fd == fd)
-+        {
-+            if (fd_read || fd_write)
-+            {
-+                fdd = client->fds[i];
-+                fdd->opaque = opaque;
-+                fdd->fd_read = fd_read;
-+                fdd->fd_write = fd_write;
-+            }
-+            else
-+            {
-+                for (int j = i+1; j < client->fd_count; j++)
-+                    client->fds[j-1] = client->fds[j];
-+                client->fd_count--;
-+            }
-+            break;
-+        }
-+    }
-+    if ((fd_read || fd_write) && !fdd)
-+    {
-+        fdd = (VitastorFdData*)malloc(sizeof(VitastorFdData));
-+        fdd->cli = client;
-+        fdd->fd = fd;
-+        fdd->fd_read = fd_read;
-+        fdd->fd_write = fd_write;
-+        fdd->opaque = opaque;
-+        if (client->fd_count >= client->fd_alloc)
-+        {
-+            client->fd_alloc = client->fd_alloc*2;
-+            if (client->fd_alloc < 16)
-+                client->fd_alloc = 16;
-+            client->fds = (VitastorFdData**)realloc(client->fds, sizeof(VitastorFdData*) * client->fd_alloc);
-+        }
-+        client->fds[client->fd_count++] = fdd;
-+    }
-+    universal_aio_set_fd_handler(
-+        client->ctx, fd, fd_read ? vitastor_aio_fd_read : NULL, fd_write ? vitastor_aio_fd_write : NULL, fdd
-+    );
-+}
-+
 +static int vitastor_file_open(BlockDriverState *bs, QDict *options, int flags, Error **errp)
 +{
 +    VitastorRPC task;
@@ -578,36 +425,10 @@ Index: a/block/vitastor.c
 +    client->rdma_port_num = qdict_get_try_int(options, "rdma-port-num", 0);
 +    client->rdma_gid_index = qdict_get_try_int(options, "rdma-gid-index", 0);
 +    client->rdma_mtu = qdict_get_try_int(options, "rdma-mtu", 0);
-+    client->ctx = bdrv_get_aio_context(bs);
-+#if defined VITASTOR_C_API_VERSION && VITASTOR_C_API_VERSION >= 2
-+    client->proxy = vitastor_c_create_qemu_uring(
-+        vitastor_aio_set_fd_handler, client, client->config_path, client->etcd_host, client->etcd_prefix,
++    client->proxy = vitastor_c_create_qemu(
++        vitastor_aio_set_fd_handler, bdrv_get_aio_context(bs), client->config_path, client->etcd_host, client->etcd_prefix,
 +        client->use_rdma, client->rdma_device, client->rdma_port_num, client->rdma_gid_index, client->rdma_mtu, 0
 +    );
-+    if (!client->proxy)
-+    {
-+        fprintf(stderr, "vitastor: failed to create io_uring: %s - I/O will be slower\n", strerror(errno));
-+        client->uring_eventfd = -1;
-+#endif
-+        client->proxy = vitastor_c_create_qemu(
-+            vitastor_aio_set_fd_handler, client, client->config_path, client->etcd_host, client->etcd_prefix,
-+            client->use_rdma, client->rdma_device, client->rdma_port_num, client->rdma_gid_index, client->rdma_mtu, 0
-+        );
-+#if defined VITASTOR_C_API_VERSION && VITASTOR_C_API_VERSION >= 2
-+    }
-+    else
-+    {
-+        client->uring_eventfd = vitastor_c_uring_register_eventfd(client->proxy);
-+        if (client->uring_eventfd < 0)
-+        {
-+            fprintf(stderr, "vitastor: failed to create io_uring eventfd: %s\n", strerror(errno));
-+            error_setg(errp, "failed to create io_uring eventfd");
-+            vitastor_close(bs);
-+            return -1;
-+        }
-+        universal_aio_set_fd_handler(client->ctx, client->uring_eventfd, vitastor_uring_handler, NULL, client);
-+    }
-+#endif
 +    image = client->image = g_strdup(qdict_get_try_str(options, "image"));
 +    client->readonly = (flags & BDRV_O_RDWR) ? 1 : 0;
 +    // Get image metadata (size and readonly flag) or just wait until the client is ready
@@ -621,13 +442,7 @@ Index: a/block/vitastor.c
 +    }
 +    else
 +    {
-+#if QEMU_VERSION_MAJOR >= 8
-+        aio_co_enter(bdrv_get_aio_context(bs), qemu_coroutine_create((void(*)(void*))vitastor_co_get_metadata, &task));
-+#elif QEMU_VERSION_MAJOR == 2 && QEMU_VERSION_MINOR >= 9 || QEMU_VERSION_MAJOR >= 3
 +        bdrv_coroutine_enter(bs, qemu_coroutine_create((void(*)(void*))vitastor_co_get_metadata, &task));
-+#else
-+        qemu_coroutine_enter(qemu_coroutine_create((void(*)(void*))vitastor_co_get_metadata, &task));
-+#endif
 +        BDRV_POLL_WHILE(bs, !task.complete);
 +    }
 +    client->image = image;
@@ -687,12 +502,6 @@ Index: a/block/vitastor.c
 +{
 +    VitastorClient *client = bs->opaque;
 +    vitastor_c_destroy(client->proxy);
-+    if (client->fds)
-+    {
-+        free(client->fds);
-+        client->fds = NULL;
-+        client->fd_alloc = client->fd_count = 0;
-+    }
 +    qemu_mutex_destroy(&client->mutex);
 +    if (client->config_path)
 +        g_free(client->config_path);
@@ -809,44 +618,25 @@ Index: a/block/vitastor.c
 +    };
 +}
 +
-+static void vitastor_co_generic_bh_cb(void *opaque)
++static void vitastor_co_generic_bh_cb(void *opaque, long retval)
 +{
 +    VitastorRPC *task = opaque;
++    task->ret = retval;
 +    task->complete = 1;
 +    if (qemu_coroutine_self() != task->co)
 +    {
 +#if QEMU_VERSION_MAJOR >= 3 || QEMU_VERSION_MAJOR == 2 && QEMU_VERSION_MINOR > 8
 +        aio_co_wake(task->co);
 +#else
-+#if QEMU_VERSION_MAJOR == 2
-+        qemu_bh_delete(task->bh);
-+#endif
 +        qemu_coroutine_enter(task->co, NULL);
 +        qemu_aio_release(task);
 +#endif
 +    }
 +}
 +
-+static void vitastor_co_generic_cb(void *opaque, long retval)
-+{
-+    VitastorRPC *task = opaque;
-+    task->ret = retval;
-+#if QEMU_VERSION_MAJOR > 4 || QEMU_VERSION_MAJOR == 4 && QEMU_VERSION_MINOR >= 2
-+    replay_bh_schedule_oneshot_event(bdrv_get_aio_context(task->bs), vitastor_co_generic_bh_cb, opaque);
-+#elif QEMU_VERSION_MAJOR >= 3 || QEMU_VERSION_MAJOR == 2 && QEMU_VERSION_MINOR >= 8
-+    aio_bh_schedule_oneshot(bdrv_get_aio_context(task->bs), vitastor_co_generic_bh_cb, opaque);
-+#elif QEMU_VERSION_MAJOR >= 2
-+    task->bh = aio_bh_new(bdrv_get_aio_context(task->bs), vitastor_co_generic_bh_cb, opaque);
-+    qemu_bh_schedule(task->bh);
-+#else
-+    task->bh = qemu_bh_new(vitastor_co_generic_bh_cb, opaque);
-+    qemu_bh_schedule(task->bh);
-+#endif
-+}
-+
 +static void vitastor_co_read_cb(void *opaque, long retval, uint64_t version)
 +{
-+    vitastor_co_generic_cb(opaque, retval);
++    vitastor_co_generic_bh_cb(opaque, retval);
 +}
 +
 +static int coroutine_fn vitastor_co_preadv(BlockDriverState *bs,
@@ -865,7 +655,6 @@ Index: a/block/vitastor.c
 +    uint64_t inode = client->watch ? vitastor_c_inode_get_num(client->watch) : client->inode;
 +    qemu_mutex_lock(&client->mutex);
 +    vitastor_c_read(client->proxy, inode, offset, bytes, iov->iov, iov->niov, vitastor_co_read_cb, &task);
-+    vitastor_schedule_uring_handler(client);
 +    qemu_mutex_unlock(&client->mutex);
 +
 +    while (!task.complete)
@@ -898,8 +687,7 @@ Index: a/block/vitastor.c
 +
 +    uint64_t inode = client->watch ? vitastor_c_inode_get_num(client->watch) : client->inode;
 +    qemu_mutex_lock(&client->mutex);
-+    vitastor_c_write(client->proxy, inode, offset, bytes, 0, iov->iov, iov->niov, vitastor_co_generic_cb, &task);
-+    vitastor_schedule_uring_handler(client);
++    vitastor_c_write(client->proxy, inode, offset, bytes, 0, iov->iov, iov->niov, vitastor_co_generic_bh_cb, &task);
 +    qemu_mutex_unlock(&client->mutex);
 +
 +    while (!task.complete)
@@ -917,6 +705,7 @@ Index: a/block/vitastor.c
 +    VitastorRPC *task = opaque;
 +    VitastorClient *client = task->bs->opaque;
 +    task->ret = retval;
++    task->complete = 1;
 +    if (retval >= 0)
 +    {
 +        task->bitmap = bitmap;
@@ -928,17 +717,15 @@ Index: a/block/vitastor.c
 +            client->last_bitmap = bitmap;
 +        }
 +    }
-+#if QEMU_VERSION_MAJOR > 4 || QEMU_VERSION_MAJOR == 4 && QEMU_VERSION_MINOR >= 2
-+    replay_bh_schedule_oneshot_event(bdrv_get_aio_context(task->bs), vitastor_co_generic_bh_cb, opaque);
-+#elif QEMU_VERSION_MAJOR >= 3 || QEMU_VERSION_MAJOR == 2 && QEMU_VERSION_MINOR >= 8
-+    aio_bh_schedule_oneshot(bdrv_get_aio_context(task->bs), vitastor_co_generic_bh_cb, opaque);
-+#elif QEMU_VERSION_MAJOR >= 2
-+    task->bh = aio_bh_new(bdrv_get_aio_context(task->bs), vitastor_co_generic_bh_cb, opaque);
-+    qemu_bh_schedule(task->bh);
++    if (qemu_coroutine_self() != task->co)
++    {
++#if QEMU_VERSION_MAJOR >= 3 || QEMU_VERSION_MAJOR == 2 && QEMU_VERSION_MINOR > 8
++        aio_co_wake(task->co);
 +#else
-+    task->bh = qemu_bh_new(vitastor_co_generic_bh_cb, opaque);
-+    qemu_bh_schedule(task->bh);
++        qemu_coroutine_enter(task->co, NULL);
++        qemu_aio_release(task);
 +#endif
++    }
 +}
 +
 +static int coroutine_fn vitastor_co_block_status(
@@ -979,7 +766,6 @@ Index: a/block/vitastor.c
 +        task.bitmap = client->last_bitmap = NULL;
 +        qemu_mutex_lock(&client->mutex);
 +        vitastor_c_read_bitmap(client->proxy, task.inode, task.offset, task.len, !client->skip_parents, vitastor_co_read_bitmap_cb, &task);
-+        vitastor_schedule_uring_handler(client);
 +        qemu_mutex_unlock(&client->mutex);
 +        while (!task.complete)
 +        {
@@ -1065,8 +851,7 @@ Index: a/block/vitastor.c
 +    vitastor_co_init_task(bs, &task);
 +
 +    qemu_mutex_lock(&client->mutex);
-+    vitastor_c_sync(client->proxy, vitastor_co_generic_cb, &task);
-+    vitastor_schedule_uring_handler(client);
++    vitastor_c_sync(client->proxy, vitastor_co_generic_bh_cb, &task);
 +    qemu_mutex_unlock(&client->mutex);
 +
 +    while (!task.complete)
@@ -1121,13 +906,8 @@ Index: a/block/vitastor.c
 +    .bdrv_parse_filename            = vitastor_parse_filename,
 +
 +    .bdrv_has_zero_init             = bdrv_has_zero_init_1,
-+#if QEMU_VERSION_MAJOR >= 8
-+    .bdrv_co_get_info               = vitastor_get_info,
-+    .bdrv_co_getlength              = vitastor_getlength,
-+#else
 +    .bdrv_get_info                  = vitastor_get_info,
 +    .bdrv_getlength                 = vitastor_getlength,
-+#endif
 +#if QEMU_VERSION_MAJOR >= 3 || QEMU_VERSION_MAJOR == 2 && QEMU_VERSION_MINOR > 2
 +    .bdrv_probe_blocksizes          = vitastor_probe_blocksizes,
 +#endif

debian/patches/pve/0001-PVE-Config-block-file-change-locking-default-to-off.patch

@@ -14,10 +14,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/block/file-posix.c b/block/file-posix.c
-index 48cd096624..3d60b80286 100644
+index b283093e5b..821405fd02 100644
 --- a/block/file-posix.c
 +++ b/block/file-posix.c
-@@ -553,7 +553,7 @@ static QemuOptsList raw_runtime_opts = {
+@@ -552,7 +552,7 @@ static QemuOptsList raw_runtime_opts = {
          {
              .name = "locking",
              .type = QEMU_OPT_STRING,
@@ -26,7 +26,7 @@ index 48cd096624..3d60b80286 100644
          },
          {
              .name = "pr-manager",
-@@ -653,7 +653,7 @@ static int raw_open_common(BlockDriverState *bs, QDict *options,
+@@ -652,7 +652,7 @@ static int raw_open_common(BlockDriverState *bs, QDict *options,
          s->use_lock = false;
          break;
      case ON_OFF_AUTO_AUTO:

debian/patches/pve/0003-PVE-Config-set-the-CPU-model-to-kvm64-32-instead-of-.patch

@@ -10,10 +10,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/target/i386/cpu.h b/target/i386/cpu.h
-index 82004b65b9..4868db8f94 100644
+index 04f2b790c9..19fdbb981c 100644
 --- a/target/i386/cpu.h
 +++ b/target/i386/cpu.h
-@@ -2133,9 +2133,9 @@ uint64_t cpu_get_tsc(CPUX86State *env);
+@@ -2039,9 +2039,9 @@ uint64_t cpu_get_tsc(CPUX86State *env);
  #define CPU_RESOLVING_TYPE TYPE_X86_CPU
  
  #ifdef TARGET_X86_64

debian/patches/pve/0004-PVE-Config-ui-spice-default-to-pve-certificates.patch

@@ -9,7 +9,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 9 insertions(+), 6 deletions(-)
 
 diff --git a/ui/spice-core.c b/ui/spice-core.c
-index c3ac20ad43..37774f1c0a 100644
+index 31974b8d6c..a3acdbd682 100644
 --- a/ui/spice-core.c
 +++ b/ui/spice-core.c
 @@ -689,32 +689,35 @@ static void qemu_spice_init(void)

debian/patches/pve/0005-PVE-Config-glusterfs-no-default-logfile-if-daemonize.patch

@@ -9,7 +9,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 11 insertions(+), 4 deletions(-)
 
 diff --git a/block/gluster.c b/block/gluster.c
-index b60213ab80..93da76bc31 100644
+index 592e71b22a..aebfece6eb 100644
 --- a/block/gluster.c
 +++ b/block/gluster.c
 @@ -42,7 +42,7 @@

debian/patches/pve/0006-PVE-Config-rbd-block-rbd-disable-rbd_cache_writethro.patch

@@ -18,7 +18,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 2 insertions(+)
 
 diff --git a/block/rbd.c b/block/rbd.c
-index f826410f40..64a8d7d48b 100644
+index def96292e0..a4b8fb482c 100644
 --- a/block/rbd.c
 +++ b/block/rbd.c
 @@ -820,6 +820,8 @@ static int qemu_rbd_connect(rados_t *cluster, rados_ioctx_t *io_ctx,

debian/patches/pve/0007-PVE-Up-qmp-add-get_link_status.patch

@@ -11,10 +11,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  3 files changed, 43 insertions(+)
 
 diff --git a/net/net.c b/net/net.c
-index 2db160e063..8329347891 100644
+index f0d14dbfc1..6d476c47ef 100644
 --- a/net/net.c
 +++ b/net/net.c
-@@ -1343,6 +1343,33 @@ void hmp_info_network(Monitor *mon, const QDict *qdict)
+@@ -1334,6 +1334,33 @@ void hmp_info_network(Monitor *mon, const QDict *qdict)
      }
  }
  
@@ -49,7 +49,7 @@ index 2db160e063..8329347891 100644
  {
      NetClientState *nc;
 diff --git a/qapi/net.json b/qapi/net.json
-index 75ba2cb989..a3c93ab88f 100644
+index 7fab2e7cd8..74c9a6109e 100644
 --- a/qapi/net.json
 +++ b/qapi/net.json
 @@ -35,6 +35,21 @@
@@ -75,12 +75,12 @@ index 75ba2cb989..a3c93ab88f 100644
  # @netdev_add:
  #
 diff --git a/qapi/pragma.json b/qapi/pragma.json
-index 7f810b0e97..a2358e303a 100644
+index 3bc0335d1f..7c91ea3685 100644
 --- a/qapi/pragma.json
 +++ b/qapi/pragma.json
-@@ -26,6 +26,7 @@
+@@ -22,6 +22,7 @@
+         'system_reset',
          'system_wakeup' ],
-     # Commands allowed to return a non-dictionary
      'command-returns-exceptions': [
 +        'get_link_status',
          'human-monitor-command',

debian/patches/pve/0008-PVE-Up-glusterfs-allow-partial-reads.patch

@@ -16,7 +16,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 9 insertions(+), 1 deletion(-)
 
 diff --git a/block/gluster.c b/block/gluster.c
-index 93da76bc31..1079b6186b 100644
+index aebfece6eb..3b7ee2f649 100644
 --- a/block/gluster.c
 +++ b/block/gluster.c
 @@ -57,6 +57,7 @@ typedef struct GlusterAIOCB {

debian/patches/pve/0009-PVE-Up-qemu-img-return-success-on-info-without-snaps.patch

@@ -9,10 +9,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/qemu-img.c b/qemu-img.c
-index 7d4b33b3da..bb36f42dd2 100644
+index f036a1d428..080ad9bca7 100644
 --- a/qemu-img.c
 +++ b/qemu-img.c
-@@ -3010,7 +3010,8 @@ static int img_info(int argc, char **argv)
+@@ -2989,7 +2989,8 @@ static int img_info(int argc, char **argv)
      list = collect_image_info_list(image_opts, filename, fmt, chain,
                                     force_share);
      if (!list) {

debian/patches/pve/0010-PVE-Up-qemu-img-dd-add-osize-and-read-from-to-stdin-.patch

@@ -31,14 +31,13 @@ override the output file's size.
 
 Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
  qemu-img-cmds.hx |   4 +-
- qemu-img.c       | 202 ++++++++++++++++++++++++++++++-----------------
- 2 files changed, 133 insertions(+), 73 deletions(-)
+ qemu-img.c       | 187 +++++++++++++++++++++++++++++------------------
+ 2 files changed, 119 insertions(+), 72 deletions(-)
 
 diff --git a/qemu-img-cmds.hx b/qemu-img-cmds.hx
-index 1b1dab5b17..d1616c045a 100644
+index 72bcdcfbfa..0b2999f3ab 100644
 --- a/qemu-img-cmds.hx
 +++ b/qemu-img-cmds.hx
 @@ -58,9 +58,9 @@ SRST
@@ -54,10 +53,10 @@ index 1b1dab5b17..d1616c045a 100644
  
  DEF("info", img_info,
 diff --git a/qemu-img.c b/qemu-img.c
-index bb36f42dd2..74afcb79ef 100644
+index 080ad9bca7..1f457d9e80 100644
 --- a/qemu-img.c
 +++ b/qemu-img.c
-@@ -4826,10 +4826,12 @@ static int img_bitmap(int argc, char **argv)
+@@ -4805,10 +4805,12 @@ static int img_bitmap(int argc, char **argv)
  #define C_IF      04
  #define C_OF      010
  #define C_SKIP    020
@@ -70,7 +69,7 @@ index bb36f42dd2..74afcb79ef 100644
  };
  
  struct DdIo {
-@@ -4905,6 +4907,19 @@ static int img_dd_skip(const char *arg,
+@@ -4884,6 +4886,19 @@ static int img_dd_skip(const char *arg,
      return 0;
  }
  
@@ -90,7 +89,7 @@ index bb36f42dd2..74afcb79ef 100644
  static int img_dd(int argc, char **argv)
  {
      int ret = 0;
-@@ -4945,6 +4960,7 @@ static int img_dd(int argc, char **argv)
+@@ -4924,6 +4939,7 @@ static int img_dd(int argc, char **argv)
          { "if", img_dd_if, C_IF },
          { "of", img_dd_of, C_OF },
          { "skip", img_dd_skip, C_SKIP },
@@ -98,7 +97,7 @@ index bb36f42dd2..74afcb79ef 100644
          { NULL, NULL, 0 }
      };
      const struct option long_options[] = {
-@@ -5020,91 +5036,112 @@ static int img_dd(int argc, char **argv)
+@@ -4999,91 +5015,112 @@ static int img_dd(int argc, char **argv)
          arg = NULL;
      }
  
@@ -154,9 +153,9 @@ index bb36f42dd2..74afcb79ef 100644
      }
 -    create_opts = qemu_opts_append(create_opts, drv->create_opts);
 -    create_opts = qemu_opts_append(create_opts, proto_drv->create_opts);
--
--    opts = qemu_opts_create(create_opts, NULL, 0, &error_abort);
  
+-    opts = qemu_opts_create(create_opts, NULL, 0, &error_abort);
+-
 -    size = blk_getlength(blk1);
 -    if (size < 0) {
 -        error_report("Failed to get size for '%s'", in.filename);
@@ -275,54 +274,41 @@ index bb36f42dd2..74afcb79ef 100644
      }
  
      if (dd.flags & C_SKIP && (in.offset > INT64_MAX / in.bsz ||
-@@ -5121,20 +5158,43 @@ static int img_dd(int argc, char **argv)
-     in.buf = g_new(uint8_t, in.bsz);
+@@ -5101,11 +5138,17 @@ static int img_dd(int argc, char **argv)
  
      for (out_pos = 0; in_pos < size; block_count++) {
-+        int in_ret, out_ret;
-         int bytes = (in_pos + in.bsz > size) ? size - in_pos : in.bsz;
+         int in_ret, out_ret;
 -
--        ret = blk_pread(blk1, in_pos, bytes, in.buf, 0);
--        if (ret < 0) {
+-        if (in_pos + in.bsz > size) {
+-            in_ret = blk_pread(blk1, in_pos, in.buf, size - in_pos);
++        size_t in_bsz = in_pos + in.bsz > size ? size - in_pos : in.bsz;
 +        if (blk1) {
-+            in_ret = blk_pread(blk1, in_pos, bytes, in.buf, 0);
-+            if (in_ret == 0) {
-+                in_ret = bytes;
-+            }
-+        } else {
-+            in_ret = read(STDIN_FILENO, in.buf, bytes);
++            in_ret = blk_pread(blk1, in_pos, in.buf, in_bsz);
+         } else {
+-            in_ret = blk_pread(blk1, in_pos, in.buf, in.bsz);
++            in_ret = read(STDIN_FILENO, in.buf, in_bsz);
 +            if (in_ret == 0) {
 +                /* early EOF is considered an error */
 +                error_report("Input ended unexpectedly");
 +                ret = -1;
 +                goto out;
 +            }
-+        }
-+        if (in_ret < 0) {
-             error_report("error while reading from input image file: %s",
--                         strerror(-ret));
-+                         strerror(-in_ret));
-+            ret = -1;
-             goto out;
          }
-         in_pos += bytes;
+         if (in_ret < 0) {
+             error_report("error while reading from input image file: %s",
+@@ -5115,9 +5158,13 @@ static int img_dd(int argc, char **argv)
+         }
+         in_pos += in_ret;
  
--        ret = blk_pwrite(blk2, out_pos, bytes, in.buf, 0);
--        if (ret < 0) {
+-        out_ret = blk_pwrite(blk2, out_pos, in.buf, in_ret, 0);
 +        if (blk2) {
-+            out_ret = blk_pwrite(blk2, out_pos, in_ret, in.buf, 0);
-+            if (out_ret == 0) {
-+                out_ret = in_ret;
-+            }
++            out_ret = blk_pwrite(blk2, out_pos, in.buf, in_ret, 0);
 +        } else {
 +            out_ret = write(STDOUT_FILENO, in.buf, in_ret);
 +        }
-+
+ 
+-        if (out_ret < 0) {
 +        if (out_ret != in_ret) {
              error_report("error while writing to output image file: %s",
--                         strerror(-ret));
-+                         strerror(-out_ret));
-+            ret = -1;
-             goto out;
-         }
-         out_pos += bytes;
+                          strerror(-out_ret));
+             ret = -1;

debian/patches/pve/0011-PVE-Up-qemu-img-dd-add-isize-parameter.patch

@@ -10,16 +10,15 @@ an expected end of input.
 
 Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
  qemu-img.c | 28 +++++++++++++++++++++++++---
  1 file changed, 25 insertions(+), 3 deletions(-)
 
 diff --git a/qemu-img.c b/qemu-img.c
-index 74afcb79ef..14594d44b6 100644
+index 1f457d9e80..d9e8a8c4d4 100644
 --- a/qemu-img.c
 +++ b/qemu-img.c
-@@ -4827,11 +4827,13 @@ static int img_bitmap(int argc, char **argv)
+@@ -4806,11 +4806,13 @@ static int img_bitmap(int argc, char **argv)
  #define C_OF      010
  #define C_SKIP    020
  #define C_OSIZE   040
@@ -33,7 +32,7 @@ index 74afcb79ef..14594d44b6 100644
  };
  
  struct DdIo {
-@@ -4920,6 +4922,19 @@ static int img_dd_osize(const char *arg,
+@@ -4899,6 +4901,19 @@ static int img_dd_osize(const char *arg,
      return 0;
  }
  
@@ -53,7 +52,7 @@ index 74afcb79ef..14594d44b6 100644
  static int img_dd(int argc, char **argv)
  {
      int ret = 0;
-@@ -4934,12 +4949,14 @@ static int img_dd(int argc, char **argv)
+@@ -4913,12 +4928,14 @@ static int img_dd(int argc, char **argv)
      int c, i;
      const char *out_fmt = "raw";
      const char *fmt = NULL;
@@ -69,7 +68,7 @@ index 74afcb79ef..14594d44b6 100644
      };
      struct DdIo in = {
          .bsz = 512, /* Block size is by default 512 bytes */
-@@ -4961,6 +4978,7 @@ static int img_dd(int argc, char **argv)
+@@ -4940,6 +4957,7 @@ static int img_dd(int argc, char **argv)
          { "of", img_dd_of, C_OF },
          { "skip", img_dd_skip, C_SKIP },
          { "osize", img_dd_osize, C_OSIZE },
@@ -77,7 +76,7 @@ index 74afcb79ef..14594d44b6 100644
          { NULL, NULL, 0 }
      };
      const struct option long_options[] = {
-@@ -5157,9 +5175,10 @@ static int img_dd(int argc, char **argv)
+@@ -5136,14 +5154,18 @@ static int img_dd(int argc, char **argv)
  
      in.buf = g_new(uint8_t, in.bsz);
  
@@ -85,14 +84,12 @@ index 74afcb79ef..14594d44b6 100644
 +    readsize = (dd.isize > 0) ? dd.isize : size;
 +    for (out_pos = 0; in_pos < readsize; block_count++) {
          int in_ret, out_ret;
--        int bytes = (in_pos + in.bsz > size) ? size - in_pos : in.bsz;
-+        int bytes = (in_pos + in.bsz > readsize) ? readsize - in_pos : in.bsz;
+-        size_t in_bsz = in_pos + in.bsz > size ? size - in_pos : in.bsz;
++        size_t in_bsz = in_pos + in.bsz > readsize ? readsize - in_pos : in.bsz;
          if (blk1) {
-             in_ret = blk_pread(blk1, in_pos, bytes, in.buf, 0);
-             if (in_ret == 0) {
-@@ -5168,6 +5187,9 @@ static int img_dd(int argc, char **argv)
+             in_ret = blk_pread(blk1, in_pos, in.buf, in_bsz);
          } else {
-             in_ret = read(STDIN_FILENO, in.buf, bytes);
+             in_ret = read(STDIN_FILENO, in.buf, in_bsz);
              if (in_ret == 0) {
 +                if (dd.isize == 0) {
 +                    goto out;

debian/patches/pve/0012-PVE-Up-qemu-img-dd-add-n-skip_create.patch

@@ -13,7 +13,7 @@ Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
  3 files changed, 26 insertions(+), 12 deletions(-)
 
 diff --git a/docs/tools/qemu-img.rst b/docs/tools/qemu-img.rst
-index 85a6e05b35..699229eef6 100644
+index d663dd92bd..a49badb158 100644
 --- a/docs/tools/qemu-img.rst
 +++ b/docs/tools/qemu-img.rst
 @@ -208,6 +208,10 @@ Parameters to convert subcommand:
@@ -49,7 +49,7 @@ index 85a6e05b35..699229eef6 100644
  
    Give information about the disk image *FILENAME*. Use it in
 diff --git a/qemu-img-cmds.hx b/qemu-img-cmds.hx
-index d1616c045a..b5b0bb4467 100644
+index 0b2999f3ab..f3b2b1b4de 100644
 --- a/qemu-img-cmds.hx
 +++ b/qemu-img-cmds.hx
 @@ -58,9 +58,9 @@ SRST
@@ -65,10 +65,10 @@ index d1616c045a..b5b0bb4467 100644
  
  DEF("info", img_info,
 diff --git a/qemu-img.c b/qemu-img.c
-index 14594d44b6..c6b4a5567d 100644
+index d9e8a8c4d4..015d6d2ce4 100644
 --- a/qemu-img.c
 +++ b/qemu-img.c
-@@ -4951,7 +4951,7 @@ static int img_dd(int argc, char **argv)
+@@ -4930,7 +4930,7 @@ static int img_dd(int argc, char **argv)
      const char *fmt = NULL;
      int64_t size = 0, readsize = 0;
      int64_t block_count = 0, out_pos, in_pos;
@@ -77,7 +77,7 @@ index 14594d44b6..c6b4a5567d 100644
      struct DdInfo dd = {
          .flags = 0,
          .count = 0,
-@@ -4989,7 +4989,7 @@ static int img_dd(int argc, char **argv)
+@@ -4968,7 +4968,7 @@ static int img_dd(int argc, char **argv)
          { 0, 0, 0, 0 }
      };
  
@@ -86,7 +86,7 @@ index 14594d44b6..c6b4a5567d 100644
          if (c == EOF) {
              break;
          }
-@@ -5009,6 +5009,9 @@ static int img_dd(int argc, char **argv)
+@@ -4988,6 +4988,9 @@ static int img_dd(int argc, char **argv)
          case 'h':
              help();
              break;
@@ -96,7 +96,7 @@ index 14594d44b6..c6b4a5567d 100644
          case 'U':
              force_share = true;
              break;
-@@ -5139,13 +5142,15 @@ static int img_dd(int argc, char **argv)
+@@ -5118,13 +5121,15 @@ static int img_dd(int argc, char **argv)
                                  size - in.bsz * in.offset, &error_abort);
          }
  

debian/patches/pve/0013-PVE-virtio-balloon-improve-query-balloon.patch

@@ -14,10 +14,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  3 files changed, 81 insertions(+), 4 deletions(-)
 
 diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
-index 73ac5eb675..bbfe7eca62 100644
+index 9a4f491b54..1faa16234e 100644
 --- a/hw/virtio/virtio-balloon.c
 +++ b/hw/virtio/virtio-balloon.c
-@@ -806,8 +806,37 @@ static uint64_t virtio_balloon_get_features(VirtIODevice *vdev, uint64_t f,
+@@ -812,8 +812,37 @@ static uint64_t virtio_balloon_get_features(VirtIODevice *vdev, uint64_t f,
  static void virtio_balloon_stat(void *opaque, BalloonInfo *info)
  {
      VirtIOBalloon *dev = opaque;
@@ -58,10 +58,10 @@ index 73ac5eb675..bbfe7eca62 100644
  
  static void virtio_balloon_to_target(void *opaque, ram_addr_t target)
 diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
-index c6cd6f91dd..15572befb1 100644
+index 2e91ccb738..e9fa9af6bd 100644
 --- a/monitor/hmp-cmds.c
 +++ b/monitor/hmp-cmds.c
-@@ -715,7 +715,35 @@ void hmp_info_balloon(Monitor *mon, const QDict *qdict)
+@@ -696,7 +696,35 @@ void hmp_info_balloon(Monitor *mon, const QDict *qdict)
          return;
      }
  
@@ -99,10 +99,10 @@ index c6cd6f91dd..15572befb1 100644
      qapi_free_BalloonInfo(info);
  }
 diff --git a/qapi/machine.json b/qapi/machine.json
-index 6afd1936b0..8b4be9b718 100644
+index 067e3f5378..91f3be6f44 100644
 --- a/qapi/machine.json
 +++ b/qapi/machine.json
-@@ -1054,9 +1054,29 @@
+@@ -1018,10 +1018,30 @@
  # @actual: the logical size of the VM in bytes
  #          Formula used: logical_vm_size = vm_ram_size - balloon_size
  #
@@ -123,6 +123,7 @@ index 6afd1936b0..8b4be9b718 100644
 +# @max_mem: amount of memory (in bytes) assigned to the guest
 +#
  # Since: 0.14
+ #
  ##
 -{ 'struct': 'BalloonInfo', 'data': {'actual': 'int' } }
 +{ 'struct': 'BalloonInfo',

debian/patches/pve/0014-PVE-qapi-modify-query-machines.patch

@@ -30,10 +30,10 @@ index 4f4ab30f8c..76fff60a6b 100644
              info->default_cpu_type = g_strdup(mc->default_cpu_type);
              info->has_default_cpu_type = true;
 diff --git a/qapi/machine.json b/qapi/machine.json
-index 8b4be9b718..555458f785 100644
+index 91f3be6f44..0905618e25 100644
 --- a/qapi/machine.json
 +++ b/qapi/machine.json
-@@ -138,6 +138,8 @@
+@@ -141,6 +141,8 @@
  #
  # @is-default: whether the machine is default
  #
@@ -42,7 +42,7 @@ index 8b4be9b718..555458f785 100644
  # @cpu-max: maximum number of CPUs supported by the machine type
  #           (since 1.5)
  #
-@@ -159,7 +161,7 @@
+@@ -162,7 +164,7 @@
  ##
  { 'struct': 'MachineInfo',
    'data': { 'name': 'str', '*alias': 'str',

debian/patches/pve/0015-PVE-qapi-modify-spice-query.patch

@@ -12,10 +12,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  2 files changed, 8 insertions(+)
 
 diff --git a/qapi/ui.json b/qapi/ui.json
-index cf58ab4283..0be2388941 100644
+index 4244c62c30..f946fbd8c1 100644
 --- a/qapi/ui.json
 +++ b/qapi/ui.json
-@@ -310,11 +310,14 @@
+@@ -333,11 +333,14 @@
  #
  # @channels: a list of @SpiceChannel for each active spice channel
  #
@@ -31,7 +31,7 @@ index cf58ab4283..0be2388941 100644
    'if': 'CONFIG_SPICE' }
  
 diff --git a/ui/spice-core.c b/ui/spice-core.c
-index 37774f1c0a..367f77f2b4 100644
+index a3acdbd682..756776778d 100644
 --- a/ui/spice-core.c
 +++ b/ui/spice-core.c
 @@ -534,6 +534,11 @@ static SpiceInfo *qmp_query_spice_real(Error **errp)

debian/patches/pve/0016-PVE-add-IOChannel-implementation-for-savevm-async.patch

@@ -1,281 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Fiona Ebner <f.ebner@proxmox.com>
-Date: Thu, 13 Oct 2022 11:33:50 +0200
-Subject: [PATCH] PVE: add IOChannel implementation for savevm-async
-
-based on migration/channel-block.c and the implementation that was
-present in migration/savevm-async.c before QEMU 7.1.
-
-Passes along read/write requests to the given BlockBackend, while
-ensuring that a read request going beyond the end results in a
-graceful short read.
-
-Additionally, allows tracking the current position from the outside
-(intended to be used for progress tracking).
-
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- migration/channel-savevm-async.c | 182 +++++++++++++++++++++++++++++++
- migration/channel-savevm-async.h |  51 +++++++++
- migration/meson.build            |   1 +
- 3 files changed, 234 insertions(+)
- create mode 100644 migration/channel-savevm-async.c
- create mode 100644 migration/channel-savevm-async.h
-
-diff --git a/migration/channel-savevm-async.c b/migration/channel-savevm-async.c
-new file mode 100644
-index 0000000000..06d5484778
---- /dev/null
-+++ b/migration/channel-savevm-async.c
-@@ -0,0 +1,182 @@
-+/*
-+ * QIO Channel implementation to be used by savevm-async QMP calls
-+ */
-+#include "qemu/osdep.h"
-+#include "migration/channel-savevm-async.h"
-+#include "qapi/error.h"
-+#include "sysemu/block-backend.h"
-+#include "trace.h"
-+
-+QIOChannelSavevmAsync *
-+qio_channel_savevm_async_new(BlockBackend *be, size_t *bs_pos)
-+{
-+    QIOChannelSavevmAsync *ioc;
-+
-+    ioc = QIO_CHANNEL_SAVEVM_ASYNC(object_new(TYPE_QIO_CHANNEL_SAVEVM_ASYNC));
-+
-+    bdrv_ref(blk_bs(be));
-+    ioc->be = be;
-+    ioc->bs_pos = bs_pos;
-+
-+    return ioc;
-+}
-+
-+
-+static void
-+qio_channel_savevm_async_finalize(Object *obj)
-+{
-+    QIOChannelSavevmAsync *ioc = QIO_CHANNEL_SAVEVM_ASYNC(obj);
-+
-+    if (ioc->be) {
-+        bdrv_unref(blk_bs(ioc->be));
-+        ioc->be = NULL;
-+    }
-+    ioc->bs_pos = NULL;
-+}
-+
-+
-+static ssize_t
-+qio_channel_savevm_async_readv(QIOChannel *ioc,
-+                               const struct iovec *iov,
-+                               size_t niov,
-+                               int **fds,
-+                               size_t *nfds,
-+                               Error **errp)
-+{
-+    QIOChannelSavevmAsync *saioc = QIO_CHANNEL_SAVEVM_ASYNC(ioc);
-+    BlockBackend *be = saioc->be;
-+    int64_t maxlen = blk_getlength(be);
-+    QEMUIOVector qiov;
-+    size_t size;
-+    int ret;
-+
-+    qemu_iovec_init_external(&qiov, (struct iovec *)iov, niov);
-+
-+    if (*saioc->bs_pos >= maxlen) {
-+        error_setg(errp, "cannot read beyond maxlen");
-+        return -1;
-+    }
-+
-+    if (maxlen - *saioc->bs_pos < qiov.size) {
-+        size = maxlen - *saioc->bs_pos;
-+    } else {
-+        size = qiov.size;
-+    }
-+
-+    // returns 0 on success
-+    ret = blk_preadv(be, *saioc->bs_pos, size, &qiov, 0);
-+    if (ret < 0) {
-+        error_setg_errno(errp, -ret, "blk_preadv failed");
-+        return -1;
-+    }
-+
-+    *saioc->bs_pos += size;
-+    return size;
-+}
-+
-+
-+static ssize_t
-+qio_channel_savevm_async_writev(QIOChannel *ioc,
-+                                const struct iovec *iov,
-+                                size_t niov,
-+                                int *fds,
-+                                size_t nfds,
-+                                int flags,
-+                                Error **errp)
-+{
-+    QIOChannelSavevmAsync *saioc = QIO_CHANNEL_SAVEVM_ASYNC(ioc);
-+    BlockBackend *be = saioc->be;
-+    QEMUIOVector qiov;
-+    int ret;
-+
-+    qemu_iovec_init_external(&qiov, (struct iovec *)iov, niov);
-+
-+    if (qemu_in_coroutine()) {
-+        ret = blk_co_pwritev(be, *saioc->bs_pos, qiov.size, &qiov, 0);
-+        aio_wait_kick();
-+    } else {
-+        ret = blk_pwritev(be, *saioc->bs_pos, qiov.size, &qiov, 0);
-+    }
-+
-+    if (ret < 0) {
-+        error_setg_errno(errp, -ret, "blk(_co)_pwritev failed");
-+        return -1;
-+    }
-+
-+    *saioc->bs_pos += qiov.size;
-+    return qiov.size;
-+}
-+
-+
-+static int
-+qio_channel_savevm_async_set_blocking(QIOChannel *ioc,
-+                                      bool enabled,
-+                                      Error **errp)
-+{
-+    if (!enabled) {
-+        error_setg(errp, "Non-blocking mode not supported for savevm-async");
-+        return -1;
-+    }
-+    return 0;
-+}
-+
-+
-+static int
-+qio_channel_savevm_async_close(QIOChannel *ioc,
-+                               Error **errp)
-+{
-+    QIOChannelSavevmAsync *saioc = QIO_CHANNEL_SAVEVM_ASYNC(ioc);
-+    int rv = bdrv_flush(blk_bs(saioc->be));
-+
-+    if (rv < 0) {
-+        error_setg_errno(errp, -rv, "Unable to flush VMState");
-+        return -1;
-+    }
-+
-+    bdrv_unref(blk_bs(saioc->be));
-+    saioc->be = NULL;
-+    saioc->bs_pos = NULL;
-+
-+    return 0;
-+}
-+
-+
-+static void
-+qio_channel_savevm_async_set_aio_fd_handler(QIOChannel *ioc,
-+                                            AioContext *ctx,
-+                                            IOHandler *io_read,
-+                                            IOHandler *io_write,
-+                                            void *opaque)
-+{
-+    // if channel-block starts doing something, check if this needs adaptation
-+}
-+
-+
-+static void
-+qio_channel_savevm_async_class_init(ObjectClass *klass,
-+                             void *class_data G_GNUC_UNUSED)
-+{
-+    QIOChannelClass *ioc_klass = QIO_CHANNEL_CLASS(klass);
-+
-+    ioc_klass->io_writev = qio_channel_savevm_async_writev;
-+    ioc_klass->io_readv = qio_channel_savevm_async_readv;
-+    ioc_klass->io_set_blocking = qio_channel_savevm_async_set_blocking;
-+    ioc_klass->io_close = qio_channel_savevm_async_close;
-+    ioc_klass->io_set_aio_fd_handler = qio_channel_savevm_async_set_aio_fd_handler;
-+}
-+
-+static const TypeInfo qio_channel_savevm_async_info = {
-+    .parent = TYPE_QIO_CHANNEL,
-+    .name = TYPE_QIO_CHANNEL_SAVEVM_ASYNC,
-+    .instance_size = sizeof(QIOChannelSavevmAsync),
-+    .instance_finalize = qio_channel_savevm_async_finalize,
-+    .class_init = qio_channel_savevm_async_class_init,
-+};
-+
-+static void
-+qio_channel_savevm_async_register_types(void)
-+{
-+    type_register_static(&qio_channel_savevm_async_info);
-+}
-+
-+type_init(qio_channel_savevm_async_register_types);
-diff --git a/migration/channel-savevm-async.h b/migration/channel-savevm-async.h
-new file mode 100644
-index 0000000000..17ae2cb261
---- /dev/null
-+++ b/migration/channel-savevm-async.h
-@@ -0,0 +1,51 @@
-+/*
-+ * QEMU I/O channels driver for savevm-async.c
-+ *
-+ * Copyright (c) 2022 Proxmox Server Solutions
-+ *
-+ * Authors:
-+ *  Fiona Ebner (f.ebner@proxmox.com)
-+ *
-+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
-+ * See the COPYING file in the top-level directory.
-+ */
-+
-+#ifndef QIO_CHANNEL_SAVEVM_ASYNC_H
-+#define QIO_CHANNEL_SAVEVM_ASYNC_H
-+
-+#include "io/channel.h"
-+#include "qom/object.h"
-+
-+#define TYPE_QIO_CHANNEL_SAVEVM_ASYNC "qio-channel-savevm-async"
-+OBJECT_DECLARE_SIMPLE_TYPE(QIOChannelSavevmAsync, QIO_CHANNEL_SAVEVM_ASYNC)
-+
-+
-+/**
-+ * QIOChannelSavevmAsync:
-+ *
-+ * The QIOChannelBlock object provides a channel implementation that is able to
-+ * perform I/O on any BlockBackend whose BlockDriverState directly contains a
-+ * VMState (as opposed to indirectly, like qcow2). It allows tracking the
-+ * current position from the outside.
-+ */
-+struct QIOChannelSavevmAsync {
-+    QIOChannel parent;
-+    BlockBackend *be;
-+    size_t *bs_pos;
-+};
-+
-+
-+/**
-+ * qio_channel_savevm_async_new:
-+ * @be: the block backend
-+ * @bs_pos: used to keep track of the IOChannels current position
-+ *
-+ * Create a new IO channel object that can perform I/O on a BlockBackend object
-+ * whose BlockDriverState directly contains a VMState.
-+ *
-+ * Returns: the new channel object
-+ */
-+QIOChannelSavevmAsync *
-+qio_channel_savevm_async_new(BlockBackend *be, size_t *bs_pos);
-+
-+#endif /* QIO_CHANNEL_SAVEVM_ASYNC_H */
-diff --git a/migration/meson.build b/migration/meson.build
-index 690487cf1a..8cac83c06c 100644
---- a/migration/meson.build
-+++ b/migration/meson.build
-@@ -13,6 +13,7 @@ softmmu_ss.add(files(
-   'block-dirty-bitmap.c',
-   'channel.c',
-   'channel-block.c',
-+  'channel-savevm-async.c',
-   'colo-failover.c',
-   'colo.c',
-   'exec.c',

debian/patches/pve/0016-PVE-add-savevm-async-for-background-state-snapshots.patch

@@ -23,29 +23,26 @@ Signed-off-by: Dietmar Maurer <dietmar@proxmox.com>
 Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
 [improve aborting]
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
-[FE: further improve aborting
-     adapt to removal of QEMUFileOps]
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
  hmp-commands-info.hx         |  13 +
- hmp-commands.hx              |  33 +++
+ hmp-commands.hx              |  33 ++
  include/migration/snapshot.h |   2 +
  include/monitor/hmp.h        |   5 +
  migration/meson.build        |   1 +
- migration/savevm-async.c     | 531 +++++++++++++++++++++++++++++++++++
+ migration/savevm-async.c     | 598 +++++++++++++++++++++++++++++++++++
  monitor/hmp-cmds.c           |  57 ++++
- qapi/migration.json          |  34 +++
- qapi/misc.json               |  32 +++
+ qapi/migration.json          |  34 ++
+ qapi/misc.json               |  32 ++
  qemu-options.hx              |  12 +
  softmmu/vl.c                 |  10 +
- 11 files changed, 730 insertions(+)
+ 11 files changed, 797 insertions(+)
  create mode 100644 migration/savevm-async.c
 
 diff --git a/hmp-commands-info.hx b/hmp-commands-info.hx
-index 188d9ece3b..97b88eaaad 100644
+index 407a1da800..245f8acc55 100644
 --- a/hmp-commands-info.hx
 +++ b/hmp-commands-info.hx
-@@ -538,6 +538,19 @@ SRST
+@@ -536,6 +536,19 @@ SRST
      Show current migration parameters.
  ERST
  
@@ -66,12 +63,12 @@ index 188d9ece3b..97b88eaaad 100644
          .name       = "balloon",
          .args_type  = "",
 diff --git a/hmp-commands.hx b/hmp-commands.hx
-index 182e639d14..bbcc73e942 100644
+index 5efb47fc32..1ad13b668b 100644
 --- a/hmp-commands.hx
 +++ b/hmp-commands.hx
-@@ -1800,3 +1800,36 @@ ERST
-                       "\n\t\t\t\t\t limit on a specified virtual cpu",
-         .cmd        = hmp_cancel_vcpu_dirty_limit,
+@@ -1746,3 +1746,36 @@ ERST
+                       "\n\t\t\t -b to specify dirty bitmap as method of calculation)",
+         .cmd        = hmp_calc_dirty_rate,
      },
 +
 +    {
@@ -118,7 +115,7 @@ index e72083b117..c846d37806 100644
 +
  #endif
 diff --git a/include/monitor/hmp.h b/include/monitor/hmp.h
-index a618eb1e4e..55067beff1 100644
+index 96d014826a..3a39ba41b5 100644
 --- a/include/monitor/hmp.h
 +++ b/include/monitor/hmp.h
 @@ -26,6 +26,7 @@ void hmp_info_status(Monitor *mon, const QDict *qdict);
@@ -141,10 +138,10 @@ index a618eb1e4e..55067beff1 100644
  void hmp_screendump(Monitor *mon, const QDict *qdict);
  void hmp_chardev_add(Monitor *mon, const QDict *qdict);
 diff --git a/migration/meson.build b/migration/meson.build
-index 8cac83c06c..0842d00cd2 100644
+index f8714dcb15..ea9aedeefc 100644
 --- a/migration/meson.build
 +++ b/migration/meson.build
-@@ -24,6 +24,7 @@ softmmu_ss.add(files(
+@@ -23,6 +23,7 @@ softmmu_ss.add(files(
    'multifd-zlib.c',
    'postcopy-ram.c',
    'savevm.c',
@@ -154,12 +151,11 @@ index 8cac83c06c..0842d00cd2 100644
  ), gnutls)
 diff --git a/migration/savevm-async.c b/migration/savevm-async.c
 new file mode 100644
-index 0000000000..05d394c0e2
+index 0000000000..79a0cda906
 --- /dev/null
 +++ b/migration/savevm-async.c
-@@ -0,0 +1,531 @@
+@@ -0,0 +1,598 @@
 +#include "qemu/osdep.h"
-+#include "migration/channel-savevm-async.h"
 +#include "migration/migration.h"
 +#include "migration/savevm.h"
 +#include "migration/snapshot.h"
@@ -183,6 +179,9 @@ index 0000000000..05d394c0e2
 +
 +/* #define DEBUG_SAVEVM_STATE */
 +
++/* used while emulated sync operation in progress */
++#define NOT_DONE -EINPROGRESS
++
 +#ifdef DEBUG_SAVEVM_STATE
 +#define DPRINTF(fmt, ...) \
 +    do { printf("savevm-async: " fmt, ## __VA_ARGS__); } while (0)
@@ -211,7 +210,7 @@ index 0000000000..05d394c0e2
 +    int64_t total_time;
 +    QEMUBH *finalize_bh;
 +    Coroutine *co;
-+    QemuCoSleep target_close_wait;
++    QemuCoSleep *target_close_wait;
 +} snap_state;
 +
 +static bool savevm_aborted(void)
@@ -269,7 +268,6 @@ index 0000000000..05d394c0e2
 +
 +    if (snap_state.file) {
 +        ret = qemu_fclose(snap_state.file);
-+        snap_state.file = NULL;
 +    }
 +
 +    if (snap_state.target) {
@@ -287,7 +285,9 @@ index 0000000000..05d394c0e2
 +        blk_unref(snap_state.target);
 +        snap_state.target = NULL;
 +
-+        qemu_co_sleep_wake(&snap_state.target_close_wait);
++        if (snap_state.target_close_wait) {
++            qemu_co_sleep_wake(snap_state.target_close_wait);
++        }
 +    }
 +
 +    return ret;
@@ -313,6 +313,60 @@ index 0000000000..05d394c0e2
 +    snap_state.state = SAVE_STATE_ERROR;
 +}
 +
++static int block_state_close(void *opaque, Error **errp)
++{
++    snap_state.file = NULL;
++    return blk_flush(snap_state.target);
++}
++
++typedef struct BlkRwCo {
++    int64_t offset;
++    QEMUIOVector *qiov;
++    ssize_t ret;
++} BlkRwCo;
++
++static void coroutine_fn block_state_write_entry(void *opaque) {
++    BlkRwCo *rwco = opaque;
++    rwco->ret = blk_co_pwritev(snap_state.target, rwco->offset, rwco->qiov->size,
++                               rwco->qiov, 0);
++    aio_wait_kick();
++}
++
++static ssize_t block_state_writev_buffer(void *opaque, struct iovec *iov,
++                                         int iovcnt, int64_t pos, Error **errp)
++{
++    QEMUIOVector qiov;
++    BlkRwCo rwco;
++
++    assert(pos == snap_state.bs_pos);
++    rwco = (BlkRwCo) {
++        .offset = pos,
++        .qiov = &qiov,
++        .ret = NOT_DONE,
++    };
++
++    qemu_iovec_init_external(&qiov, iov, iovcnt);
++
++    if (qemu_in_coroutine()) {
++        block_state_write_entry(&rwco);
++    } else {
++        Coroutine *co = qemu_coroutine_create(&block_state_write_entry, &rwco);
++        bdrv_coroutine_enter(blk_bs(snap_state.target), co);
++        BDRV_POLL_WHILE(blk_bs(snap_state.target), rwco.ret == NOT_DONE);
++    }
++    if (rwco.ret < 0) {
++        return rwco.ret;
++    }
++
++    snap_state.bs_pos += qiov.size;
++    return qiov.size;
++}
++
++static const QEMUFileOps block_file_ops = {
++    .writev_buffer =  block_state_writev_buffer,
++    .close =          block_state_close,
++};
++
 +static void process_savevm_finalize(void *opaque)
 +{
 +    int ret;
@@ -368,11 +422,8 @@ index 0000000000..05d394c0e2
 +    } else if (snap_state.state == SAVE_STATE_ACTIVE) {
 +        snap_state.state = SAVE_STATE_COMPLETED;
 +    } else if (aborted) {
-+        /*
-+         * If there was an error, there's no need to set a new one here.
-+         * If the snapshot was canceled, leave setting the state to
-+         * qmp_savevm_end(), which is waked by save_snapshot_cleanup().
-+         */
++        save_snapshot_error("process_savevm_cleanup: found aborted state: %d",
++                            snap_state.state);
 +    } else {
 +        save_snapshot_error("process_savevm_cleanup: invalid state: %d",
 +                            snap_state.state);
@@ -498,7 +549,6 @@ index 0000000000..05d394c0e2
 +    snap_state.bs_pos = 0;
 +    snap_state.total_time = qemu_clock_get_ms(QEMU_CLOCK_REALTIME);
 +    snap_state.blocker = NULL;
-+    snap_state.target_close_wait = (QemuCoSleep){ .to_wake = NULL };
 +
 +    if (snap_state.error) {
 +        error_free(snap_state.error);
@@ -525,9 +575,7 @@ index 0000000000..05d394c0e2
 +        goto restart;
 +    }
 +
-+    QIOChannel *ioc = QIO_CHANNEL(qio_channel_savevm_async_new(snap_state.target,
-+                                                               &snap_state.bs_pos));
-+    snap_state.file = qemu_file_new_output(ioc);
++    snap_state.file = qemu_fopen_ops(&snap_state, &block_file_ops);
 +
 +    if (!snap_state.file) {
 +        error_set(errp, ERROR_CLASS_GENERIC_ERROR, "failed to open '%s'", statefile);
@@ -605,8 +653,9 @@ index 0000000000..05d394c0e2
 +     * call exits the statefile will be closed and can be removed immediately */
 +    DPRINTF("savevm-end: waiting for cleanup\n");
 +    timeout = 30L * 1000 * 1000 * 1000;
-+    qemu_co_sleep_ns_wakeable(&snap_state.target_close_wait,
++    qemu_co_sleep_ns_wakeable(snap_state.target_close_wait,
 +                              QEMU_CLOCK_REALTIME, timeout);
++    snap_state.target_close_wait = NULL;
 +    if (snap_state.target) {
 +        save_snapshot_error("timeout waiting for target file close in "
 +                            "qmp_savevm_end");
@@ -615,11 +664,6 @@ index 0000000000..05d394c0e2
 +        return;
 +    }
 +
-+    // File closed and no other error, so ensure next snapshot can be started.
-+    if (snap_state.state != SAVE_STATE_ERROR) {
-+        snap_state.state = SAVE_STATE_DONE;
-+    }
-+
 +    DPRINTF("savevm-end: cleanup done\n");
 +}
 +
@@ -639,6 +683,27 @@ index 0000000000..05d394c0e2
 +                                                     true, name, errp);
 +}
 +
++static ssize_t loadstate_get_buffer(void *opaque, uint8_t *buf, int64_t pos,
++                                    size_t size, Error **errp)
++{
++    BlockBackend *be = opaque;
++    int64_t maxlen = blk_getlength(be);
++    if (pos > maxlen) {
++        return -EIO;
++    }
++    if ((pos + size) > maxlen) {
++        size = maxlen - pos - 1;
++    }
++    if (size == 0) {
++        return 0;
++    }
++    return blk_pread(be, pos, buf, size);
++}
++
++static const QEMUFileOps loadstate_file_ops = {
++    .get_buffer = loadstate_get_buffer,
++};
++
 +int load_snapshot_from_blockdev(const char *filename, Error **errp)
 +{
 +    BlockBackend *be;
@@ -646,7 +711,6 @@ index 0000000000..05d394c0e2
 +    Error *blocker = NULL;
 +
 +    QEMUFile *f;
-+    size_t bs_pos = 0;
 +    int ret = -EINVAL;
 +
 +    be = blk_new_open(filename, NULL, NULL, 0, &local_err);
@@ -660,7 +724,7 @@ index 0000000000..05d394c0e2
 +    blk_op_block_all(be, blocker);
 +
 +    /* restore the VM state */
-+    f = qemu_file_new_input(QIO_CHANNEL(qio_channel_savevm_async_new(be, &bs_pos)));
++    f = qemu_fopen_ops(be, &loadstate_file_ops);
 +    if (!f) {
 +        error_setg(errp, "Could not open VM state file");
 +        goto the_end;
@@ -690,10 +754,10 @@ index 0000000000..05d394c0e2
 +    return ret;
 +}
 diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
-index 15572befb1..1507180990 100644
+index e9fa9af6bd..5000ce39d1 100644
 --- a/monitor/hmp-cmds.c
 +++ b/monitor/hmp-cmds.c
-@@ -1925,6 +1925,63 @@ void hmp_info_memory_devices(Monitor *mon, const QDict *qdict)
+@@ -1903,6 +1903,63 @@ void hmp_info_memory_devices(Monitor *mon, const QDict *qdict)
      hmp_handle_error(mon, err);
  }
  
@@ -758,10 +822,10 @@ index 15572befb1..1507180990 100644
  {
      IOThreadInfoList *info_list = qmp_query_iothreads(NULL);
 diff --git a/qapi/migration.json b/qapi/migration.json
-index 81185d4311..3129f71fa8 100644
+index bbfd48cf0b..45686390a2 100644
 --- a/qapi/migration.json
 +++ b/qapi/migration.json
-@@ -261,6 +261,40 @@
+@@ -247,6 +247,40 @@
             '*compression': 'CompressionStats',
             '*socket-address': ['SocketAddress'] } }
  
@@ -803,7 +867,7 @@ index 81185d4311..3129f71fa8 100644
  # @query-migrate:
  #
 diff --git a/qapi/misc.json b/qapi/misc.json
-index 27ef5a2b20..b3ce75dcae 100644
+index 358548abe1..25b3febc52 100644
 --- a/qapi/misc.json
 +++ b/qapi/misc.json
 @@ -435,6 +435,38 @@
@@ -846,10 +910,10 @@ index 27ef5a2b20..b3ce75dcae 100644
  # @CommandLineParameterType:
  #
 diff --git a/qemu-options.hx b/qemu-options.hx
-index 31c04f7eea..c2ca6e91b5 100644
+index ae2c6dbbfc..423144abeb 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
-@@ -4341,6 +4341,18 @@ SRST
+@@ -4171,6 +4171,18 @@ SRST
      Start right away with a saved state (``loadvm`` in monitor)
  ERST
  
@@ -869,18 +933,18 @@ index 31c04f7eea..c2ca6e91b5 100644
  DEF("daemonize", 0, QEMU_OPTION_daemonize, \
      "-daemonize      daemonize QEMU after initializing\n", QEMU_ARCH_ALL)
 diff --git a/softmmu/vl.c b/softmmu/vl.c
-index 706bd7cff7..b8637c4262 100644
+index 620a1f1367..fd82efb8b3 100644
 --- a/softmmu/vl.c
 +++ b/softmmu/vl.c
-@@ -165,6 +165,7 @@ static const char *accelerators;
- static bool have_custom_ram_size;
- static const char *ram_memdev_id;
+@@ -156,6 +156,7 @@ static const char *incoming;
+ static const char *loadvm;
+ static const char *accelerators;
  static QDict *machine_opts_dict;
 +static const char *loadstate;
  static QTAILQ_HEAD(, ObjectOption) object_opts = QTAILQ_HEAD_INITIALIZER(object_opts);
  static QTAILQ_HEAD(, DeviceOption) device_opts = QTAILQ_HEAD_INITIALIZER(device_opts);
- static int display_remote;
-@@ -2584,6 +2585,12 @@ void qmp_x_exit_preconfig(Error **errp)
+ static ram_addr_t maxram_size;
+@@ -2743,6 +2744,12 @@ void qmp_x_exit_preconfig(Error **errp)
  
      if (loadvm) {
          load_snapshot(loadvm, NULL, false, NULL, &error_fatal);
@@ -893,7 +957,7 @@ index 706bd7cff7..b8637c4262 100644
      }
      if (replay_mode != REPLAY_MODE_NONE) {
          replay_vmstate_init();
-@@ -3133,6 +3140,9 @@ void qemu_init(int argc, char **argv, char **envp)
+@@ -3284,6 +3291,9 @@ void qemu_init(int argc, char **argv, char **envp)
              case QEMU_OPTION_loadvm:
                  loadvm = optarg;
                  break;

debian/patches/pve/0017-PVE-add-optional-buffer-size-to-QEMUFile.patch

@@ -10,19 +10,17 @@ Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
 [increase max IOV count in QEMUFile to actually write more data]
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
-[FE: adapt to removal of QEMUFileOps]
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
- migration/qemu-file.c    | 49 +++++++++++++++++++++++++++-------------
- migration/qemu-file.h    |  2 ++
- migration/savevm-async.c |  5 ++--
- 3 files changed, 38 insertions(+), 18 deletions(-)
+ migration/qemu-file.c    | 38 +++++++++++++++++++++++++-------------
+ migration/qemu-file.h    |  1 +
+ migration/savevm-async.c |  4 ++--
+ 3 files changed, 28 insertions(+), 15 deletions(-)
 
 diff --git a/migration/qemu-file.c b/migration/qemu-file.c
-index 4f400c2e52..21e8998867 100644
+index 6338d8e2ff..6697a93a7e 100644
 --- a/migration/qemu-file.c
 +++ b/migration/qemu-file.c
-@@ -31,8 +31,8 @@
+@@ -30,8 +30,8 @@
  #include "trace.h"
  #include "qapi/error.h"
  
@@ -32,9 +30,9 @@ index 4f400c2e52..21e8998867 100644
 +#define MAX_IOV_SIZE MIN_CONST(IOV_MAX, 256)
  
  struct QEMUFile {
-     const QEMUFileHooks *hooks;
-@@ -55,7 +55,8 @@ struct QEMUFile {
- 
+     const QEMUFileOps *ops;
+@@ -45,7 +45,8 @@ struct QEMUFile {
+                     when reading */
      int buf_index;
      int buf_size; /* 0 when writing */
 -    uint8_t buf[IO_BUF_SIZE];
@@ -43,76 +41,53 @@ index 4f400c2e52..21e8998867 100644
  
      DECLARE_BITMAP(may_free, MAX_IOV_SIZE);
      struct iovec iov[MAX_IOV_SIZE];
-@@ -106,7 +107,9 @@ bool qemu_file_mode_is_not_valid(const char *mode)
+@@ -103,7 +104,7 @@ bool qemu_file_mode_is_not_valid(const char *mode)
      return false;
  }
  
--static QEMUFile *qemu_file_new_impl(QIOChannel *ioc, bool is_writable)
-+static QEMUFile *qemu_file_new_impl(QIOChannel *ioc,
-+                                    bool is_writable,
-+                                    size_t buffer_size)
+-QEMUFile *qemu_fopen_ops(void *opaque, const QEMUFileOps *ops, bool has_ioc)
++QEMUFile *qemu_fopen_ops_sized(void *opaque, const QEMUFileOps *ops, bool has_ioc, size_t buffer_size)
  {
      QEMUFile *f;
  
-@@ -115,6 +118,8 @@ static QEMUFile *qemu_file_new_impl(QIOChannel *ioc, bool is_writable)
-     object_ref(ioc);
-     f->ioc = ioc;
-     f->is_writable = is_writable;
+@@ -112,9 +113,17 @@ QEMUFile *qemu_fopen_ops(void *opaque, const QEMUFileOps *ops, bool has_ioc)
+     f->opaque = opaque;
+     f->ops = ops;
+     f->has_ioc = has_ioc;
 +    f->buf_allocated_size = buffer_size;
 +    f->buf = malloc(buffer_size);
- 
++
      return f;
  }
-@@ -125,17 +130,27 @@ static QEMUFile *qemu_file_new_impl(QIOChannel *ioc, bool is_writable)
-  */
- QEMUFile *qemu_file_get_return_path(QEMUFile *f)
- {
--    return qemu_file_new_impl(f->ioc, !f->is_writable);
-+    return qemu_file_new_impl(f->ioc, !f->is_writable, DEFAULT_IO_BUF_SIZE);
- }
  
- QEMUFile *qemu_file_new_output(QIOChannel *ioc)
- {
--    return qemu_file_new_impl(ioc, true);
-+    return qemu_file_new_impl(ioc, true, DEFAULT_IO_BUF_SIZE);
++QEMUFile *qemu_fopen_ops(void *opaque, const QEMUFileOps *ops, bool has_ioc)
++{
++    return qemu_fopen_ops_sized(opaque, ops, has_ioc, DEFAULT_IO_BUF_SIZE);
 +}
 +
-+QEMUFile *qemu_file_new_output_sized(QIOChannel *ioc, size_t buffer_size)
-+{
-+    return qemu_file_new_impl(ioc, true, buffer_size);
- }
- 
- QEMUFile *qemu_file_new_input(QIOChannel *ioc)
- {
--    return qemu_file_new_impl(ioc, false);
-+    return qemu_file_new_impl(ioc, false, DEFAULT_IO_BUF_SIZE);
-+}
-+
-+QEMUFile *qemu_file_new_input_sized(QIOChannel *ioc, size_t buffer_size)
-+{
-+    return qemu_file_new_impl(ioc, false, buffer_size);
- }
  
  void qemu_file_set_hooks(QEMUFile *f, const QEMUFileHooks *hooks)
-@@ -393,7 +408,7 @@ static ssize_t qemu_fill_buffer(QEMUFile *f)
-     do {
-         len = qio_channel_read(f->ioc,
-                                (char *)f->buf + pending,
--                               IO_BUF_SIZE - pending,
-+                               f->buf_allocated_size - pending,
-                                &local_error);
-         if (len == QIO_CHANNEL_ERR_BLOCK) {
-             if (qemu_in_coroutine()) {
-@@ -443,6 +458,8 @@ int qemu_fclose(QEMUFile *f)
+ {
+@@ -349,7 +358,7 @@ static ssize_t qemu_fill_buffer(QEMUFile *f)
      }
-     g_clear_pointer(&f->ioc, object_unref);
  
+     len = f->ops->get_buffer(f->opaque, f->buf + pending, f->pos,
+-                             IO_BUF_SIZE - pending, &local_error);
++                             f->buf_allocated_size - pending, &local_error);
+     if (len > 0) {
+         f->buf_size += len;
+         f->pos += len;
+@@ -389,6 +398,9 @@ int qemu_fclose(QEMUFile *f)
+             ret = ret2;
+         }
+     }
++
 +    free(f->buf);
 +
      /* If any error was spotted before closing, we should report it
       * instead of the close() return value.
       */
-@@ -497,7 +514,7 @@ static void add_buf_to_iovec(QEMUFile *f, size_t len)
+@@ -443,7 +455,7 @@ static void add_buf_to_iovec(QEMUFile *f, size_t len)
  {
      if (!add_to_iovec(f, f->buf + f->buf_index, len, false)) {
          f->buf_index += len;
@@ -121,7 +96,7 @@ index 4f400c2e52..21e8998867 100644
              qemu_fflush(f);
          }
      }
-@@ -523,7 +540,7 @@ void qemu_put_buffer(QEMUFile *f, const uint8_t *buf, size_t size)
+@@ -469,7 +481,7 @@ void qemu_put_buffer(QEMUFile *f, const uint8_t *buf, size_t size)
      }
  
      while (size > 0) {
@@ -130,7 +105,7 @@ index 4f400c2e52..21e8998867 100644
          if (l > size) {
              l = size;
          }
-@@ -570,8 +587,8 @@ size_t qemu_peek_buffer(QEMUFile *f, uint8_t **buf, size_t size, size_t offset)
+@@ -516,8 +528,8 @@ size_t qemu_peek_buffer(QEMUFile *f, uint8_t **buf, size_t size, size_t offset)
      size_t index;
  
      assert(!qemu_file_is_writable(f));
@@ -141,7 +116,7 @@ index 4f400c2e52..21e8998867 100644
  
      /* The 1st byte to read from */
      index = f->buf_index + offset;
-@@ -621,7 +638,7 @@ size_t qemu_get_buffer(QEMUFile *f, uint8_t *buf, size_t size)
+@@ -567,7 +579,7 @@ size_t qemu_get_buffer(QEMUFile *f, uint8_t *buf, size_t size)
          size_t res;
          uint8_t *src;
  
@@ -150,7 +125,7 @@ index 4f400c2e52..21e8998867 100644
          if (res == 0) {
              return done;
          }
-@@ -655,7 +672,7 @@ size_t qemu_get_buffer(QEMUFile *f, uint8_t *buf, size_t size)
+@@ -601,7 +613,7 @@ size_t qemu_get_buffer(QEMUFile *f, uint8_t *buf, size_t size)
   */
  size_t qemu_get_buffer_in_place(QEMUFile *f, uint8_t **buf, size_t size)
  {
@@ -159,7 +134,7 @@ index 4f400c2e52..21e8998867 100644
          size_t res;
          uint8_t *src = NULL;
  
-@@ -680,7 +697,7 @@ int qemu_peek_byte(QEMUFile *f, int offset)
+@@ -626,7 +638,7 @@ int qemu_peek_byte(QEMUFile *f, int offset)
      int index = f->buf_index + offset;
  
      assert(!qemu_file_is_writable(f));
@@ -168,7 +143,7 @@ index 4f400c2e52..21e8998867 100644
  
      if (index >= f->buf_size) {
          qemu_fill_buffer(f);
-@@ -832,7 +849,7 @@ static int qemu_compress_data(z_stream *stream, uint8_t *dest, size_t dest_len,
+@@ -778,7 +790,7 @@ static int qemu_compress_data(z_stream *stream, uint8_t *dest, size_t dest_len,
  ssize_t qemu_put_compression_data(QEMUFile *f, z_stream *stream,
                                    const uint8_t *p, size_t size)
  {
@@ -178,39 +153,36 @@ index 4f400c2e52..21e8998867 100644
      if (blen < compressBound(size)) {
          return -1;
 diff --git a/migration/qemu-file.h b/migration/qemu-file.h
-index fa13d04d78..914f1a63a8 100644
+index 3f36d4dc8c..67501fd9cf 100644
 --- a/migration/qemu-file.h
 +++ b/migration/qemu-file.h
-@@ -63,7 +63,9 @@ typedef struct QEMUFileHooks {
+@@ -121,6 +121,7 @@ typedef struct QEMUFileHooks {
  } QEMUFileHooks;
  
- QEMUFile *qemu_file_new_input(QIOChannel *ioc);
-+QEMUFile *qemu_file_new_input_sized(QIOChannel *ioc, size_t buffer_size);
- QEMUFile *qemu_file_new_output(QIOChannel *ioc);
-+QEMUFile *qemu_file_new_output_sized(QIOChannel *ioc, size_t buffer_size);
+ QEMUFile *qemu_fopen_ops(void *opaque, const QEMUFileOps *ops, bool has_ioc);
++QEMUFile *qemu_fopen_ops_sized(void *opaque, const QEMUFileOps *ops, bool has_ioc, size_t buffer_size);
  void qemu_file_set_hooks(QEMUFile *f, const QEMUFileHooks *hooks);
+ int qemu_get_fd(QEMUFile *f);
  int qemu_fclose(QEMUFile *f);
- 
 diff --git a/migration/savevm-async.c b/migration/savevm-async.c
-index b3692739a0..e65a5e3482 100644
+index 79a0cda906..970ee3b3fc 100644
 --- a/migration/savevm-async.c
 +++ b/migration/savevm-async.c
-@@ -367,7 +367,7 @@ void qmp_savevm_start(bool has_statefile, const char *statefile, Error **errp)
+@@ -418,7 +418,7 @@ void qmp_savevm_start(bool has_statefile, const char *statefile, Error **errp)
+         goto restart;
+     }
  
-     QIOChannel *ioc = QIO_CHANNEL(qio_channel_savevm_async_new(snap_state.target,
-                                                                &snap_state.bs_pos));
--    snap_state.file = qemu_file_new_output(ioc);
-+    snap_state.file = qemu_file_new_output_sized(ioc, 4 * 1024 * 1024);
+-    snap_state.file = qemu_fopen_ops(&snap_state, &block_file_ops);
++    snap_state.file = qemu_fopen_ops_sized(&snap_state, &block_file_ops, false, 4 * 1024 * 1024);
  
      if (!snap_state.file) {
          error_set(errp, ERROR_CLASS_GENERIC_ERROR, "failed to open '%s'", statefile);
-@@ -500,7 +500,8 @@ int load_snapshot_from_blockdev(const char *filename, Error **errp)
+@@ -567,7 +567,7 @@ int load_snapshot_from_blockdev(const char *filename, Error **errp)
      blk_op_block_all(be, blocker);
  
      /* restore the VM state */
--    f = qemu_file_new_input(QIO_CHANNEL(qio_channel_savevm_async_new(be, &bs_pos)));
-+    f = qemu_file_new_input_sized(QIO_CHANNEL(qio_channel_savevm_async_new(be, &bs_pos)),
-+                                  4 * 1024 * 1024);
+-    f = qemu_fopen_ops(be, &loadstate_file_ops);
++    f = qemu_fopen_ops_sized(be, &loadstate_file_ops, false, 4 * 1024 * 1024);
      if (!f) {
          error_setg(errp, "Could not open VM state file");
          goto the_end;

debian/patches/pve/0018-PVE-block-add-the-zeroinit-block-driver-filter.patch

@@ -13,10 +13,10 @@ Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
  create mode 100644 block/zeroinit.c
 
 diff --git a/block/meson.build b/block/meson.build
-index 60bc305597..ad40c10b6a 100644
+index deb73ca389..c9d1fdca7d 100644
 --- a/block/meson.build
 +++ b/block/meson.build
-@@ -43,6 +43,7 @@ block_ss.add(files(
+@@ -41,6 +41,7 @@ block_ss.add(files(
    'vmdk.c',
    'vpc.c',
    'write-threshold.c',

debian/patches/pve/0019-PVE-Add-dummy-id-command-line-parameter.patch

@@ -14,12 +14,12 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  2 files changed, 11 insertions(+)
 
 diff --git a/qemu-options.hx b/qemu-options.hx
-index c2ca6e91b5..ab4734ef32 100644
+index 423144abeb..4879471aeb 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
-@@ -1118,6 +1118,9 @@ backend describes how QEMU handles the data.
+@@ -1019,6 +1019,9 @@ DEFHEADING()
  
- ERST
+ DEFHEADING(Block device options:)
  
 +DEF("id", HAS_ARG, QEMU_OPTION_id,
 +    "-id n           set the VMID", QEMU_ARCH_ALL)
@@ -28,10 +28,10 @@ index c2ca6e91b5..ab4734ef32 100644
      "-fda/-fdb file  use 'file' as floppy disk 0/1 image\n", QEMU_ARCH_ALL)
  DEF("fdb", HAS_ARG, QEMU_OPTION_fdb, "", QEMU_ARCH_ALL)
 diff --git a/softmmu/vl.c b/softmmu/vl.c
-index b8637c4262..39f149924e 100644
+index fd82efb8b3..eb05e5a000 100644
 --- a/softmmu/vl.c
 +++ b/softmmu/vl.c
-@@ -2620,6 +2620,7 @@ void qemu_init(int argc, char **argv, char **envp)
+@@ -2779,6 +2779,7 @@ void qemu_init(int argc, char **argv, char **envp)
      MachineClass *machine_class;
      bool userconfig = true;
      FILE *vmstate_dump_file = NULL;
@@ -39,7 +39,7 @@ index b8637c4262..39f149924e 100644
  
      qemu_add_opts(&qemu_drive_opts);
      qemu_add_drive_opts(&qemu_legacy_drive_opts);
-@@ -3245,6 +3246,13 @@ void qemu_init(int argc, char **argv, char **envp)
+@@ -3421,6 +3422,13 @@ void qemu_init(int argc, char **argv, char **envp)
                  machine_parse_property_opt(qemu_find_opts("smp-opts"),
                                             "smp", optarg);
                  break;

debian/patches/pve/0021-PVE-Up-Config-file-posix-make-locking-optiono-on-cre.patch

@@ -13,10 +13,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  2 files changed, 42 insertions(+), 20 deletions(-)
 
 diff --git a/block/file-posix.c b/block/file-posix.c
-index 3d60b80286..49ee1db5f9 100644
+index 821405fd02..e3b6c3c524 100644
 --- a/block/file-posix.c
 +++ b/block/file-posix.c
-@@ -2475,6 +2475,7 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
+@@ -2465,6 +2465,7 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
      int fd;
      uint64_t perm, shared;
      int result = 0;
@@ -24,7 +24,7 @@ index 3d60b80286..49ee1db5f9 100644
  
      /* Validate options and set default values */
      assert(options->driver == BLOCKDEV_DRIVER_FILE);
-@@ -2515,19 +2516,22 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
+@@ -2505,19 +2506,22 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
      perm = BLK_PERM_WRITE | BLK_PERM_RESIZE;
      shared = BLK_PERM_ALL & ~BLK_PERM_RESIZE;
  
@@ -59,7 +59,7 @@ index 3d60b80286..49ee1db5f9 100644
      }
  
      /* Clear the file by truncating it to 0 */
-@@ -2581,13 +2585,15 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
+@@ -2571,13 +2575,15 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
      }
  
  out_unlock:
@@ -82,7 +82,7 @@ index 3d60b80286..49ee1db5f9 100644
      }
  
  out_close:
-@@ -2612,6 +2618,7 @@ static int coroutine_fn raw_co_create_opts(BlockDriver *drv,
+@@ -2602,6 +2608,7 @@ static int coroutine_fn raw_co_create_opts(BlockDriver *drv,
      PreallocMode prealloc;
      char *buf = NULL;
      Error *local_err = NULL;
@@ -90,7 +90,7 @@ index 3d60b80286..49ee1db5f9 100644
  
      /* Skip file: protocol prefix */
      strstart(filename, "file:", &filename);
-@@ -2634,6 +2641,18 @@ static int coroutine_fn raw_co_create_opts(BlockDriver *drv,
+@@ -2624,6 +2631,18 @@ static int coroutine_fn raw_co_create_opts(BlockDriver *drv,
          return -EINVAL;
      }
  
@@ -109,7 +109,7 @@ index 3d60b80286..49ee1db5f9 100644
      options = (BlockdevCreateOptions) {
          .driver     = BLOCKDEV_DRIVER_FILE,
          .u.file     = {
-@@ -2645,6 +2664,8 @@ static int coroutine_fn raw_co_create_opts(BlockDriver *drv,
+@@ -2635,6 +2654,8 @@ static int coroutine_fn raw_co_create_opts(BlockDriver *drv,
              .nocow              = nocow,
              .has_extent_size_hint = has_extent_size_hint,
              .extent_size_hint   = extent_size_hint,
@@ -119,10 +119,10 @@ index 3d60b80286..49ee1db5f9 100644
      };
      return raw_co_create(&options, errp);
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index e1857e7094..ddac91e8f6 100644
+index 1d3dd9cb48..3f81d6a5c0 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -4537,7 +4537,8 @@
+@@ -4445,7 +4445,8 @@
              'size':                 'size',
              '*preallocation':       'PreallocMode',
              '*nocow':               'bool',

debian/patches/pve/0023-PVE-Compat-4.0-used-balloon-qemu-4-0-config-size-fal.patch

@@ -26,10 +26,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/hw/core/machine.c b/hw/core/machine.c
-index a673302cce..fa424440bd 100644
+index 53a99abc56..ad2cb2592e 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
-@@ -127,7 +127,8 @@ GlobalProperty hw_compat_4_0[] = {
+@@ -113,7 +113,8 @@ GlobalProperty hw_compat_4_0[] = {
      { "virtio-vga",     "edid", "false" },
      { "virtio-gpu-device", "edid", "false" },
      { "virtio-device", "use-started", "false" },

debian/patches/pve/0024-PVE-Allow-version-code-in-machine-type.patch

@@ -36,10 +36,10 @@ index 76fff60a6b..ec9201fb9a 100644
  
          if (mc->default_cpu_type) {
 diff --git a/include/hw/boards.h b/include/hw/boards.h
-index 7b416c9787..8ae15c51aa 100644
+index 9c1c190104..51e04bde62 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
-@@ -230,6 +230,8 @@ struct MachineClass {
+@@ -227,6 +227,8 @@ struct MachineClass {
      const char *desc;
      const char *deprecation_reason;
  
@@ -49,10 +49,10 @@ index 7b416c9787..8ae15c51aa 100644
      void (*reset)(MachineState *state);
      void (*wakeup)(MachineState *state);
 diff --git a/qapi/machine.json b/qapi/machine.json
-index 555458f785..d868e4d31d 100644
+index 0905618e25..a05c46e253 100644
 --- a/qapi/machine.json
 +++ b/qapi/machine.json
-@@ -157,6 +157,8 @@
+@@ -160,6 +160,8 @@
  #
  # @default-ram-id: the default ID of initial RAM memory backend (since 5.2)
  #
@@ -61,7 +61,7 @@ index 555458f785..d868e4d31d 100644
  # Since: 1.2
  ##
  { 'struct': 'MachineInfo',
-@@ -164,7 +166,7 @@
+@@ -167,7 +169,7 @@
              '*is-default': 'bool', '*is-current': 'bool', 'cpu-max': 'int',
              'hotpluggable-cpus': 'bool',  'numa-mem-supported': 'bool',
              'deprecated': 'bool', '*default-cpu-type': 'str',
@@ -71,10 +71,10 @@ index 555458f785..d868e4d31d 100644
  ##
  # @query-machines:
 diff --git a/softmmu/vl.c b/softmmu/vl.c
-index 39f149924e..0d233d55f3 100644
+index eb05e5a000..f306d21d63 100644
 --- a/softmmu/vl.c
 +++ b/softmmu/vl.c
-@@ -1580,6 +1580,7 @@ static const QEMUOption *lookup_opt(int argc, char **argv,
+@@ -1655,6 +1655,7 @@ static const QEMUOption *lookup_opt(int argc, char **argv,
  static MachineClass *select_machine(QDict *qdict, Error **errp)
  {
      const char *optarg = qdict_get_try_str(qdict, "type");
@@ -82,7 +82,7 @@ index 39f149924e..0d233d55f3 100644
      GSList *machines = object_class_get_list(TYPE_MACHINE, false);
      MachineClass *machine_class;
      Error *local_err = NULL;
-@@ -1597,6 +1598,11 @@ static MachineClass *select_machine(QDict *qdict, Error **errp)
+@@ -1672,6 +1673,11 @@ static MachineClass *select_machine(QDict *qdict, Error **errp)
          }
      }
  
@@ -94,7 +94,7 @@ index 39f149924e..0d233d55f3 100644
      g_slist_free(machines);
      if (local_err) {
          error_append_hint(&local_err, "Use -machine help to list supported machines\n");
-@@ -3187,12 +3193,31 @@ void qemu_init(int argc, char **argv, char **envp)
+@@ -3363,12 +3369,31 @@ void qemu_init(int argc, char **argv, char **envp)
              case QEMU_OPTION_machine:
                  {
                      bool help;

debian/patches/pve/0025-block-backup-move-bcs-bitmap-initialization-to-job-c.patch

@@ -25,11 +25,11 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 4 insertions(+), 4 deletions(-)
 
 diff --git a/block/backup.c b/block/backup.c
-index b2b649e305..b6fa9e8a69 100644
+index 21d5983779..47e218857d 100644
 --- a/block/backup.c
 +++ b/block/backup.c
-@@ -237,8 +237,8 @@ static void backup_init_bcs_bitmap(BackupBlockJob *job)
-                                          true);
+@@ -239,8 +239,8 @@ static void backup_init_bcs_bitmap(BackupBlockJob *job)
+         assert(ret);
      } else if (job->sync_mode == MIRROR_SYNC_MODE_TOP) {
          /*
 -         * We can't hog the coroutine to initialize this thoroughly.
@@ -39,7 +39,7 @@ index b2b649e305..b6fa9e8a69 100644
           */
          block_copy_set_skip_unallocated(job->bcs, true);
      }
-@@ -252,8 +252,6 @@ static int coroutine_fn backup_run(Job *job, Error **errp)
+@@ -254,8 +254,6 @@ static int coroutine_fn backup_run(Job *job, Error **errp)
      BackupBlockJob *s = container_of(job, BackupBlockJob, common.job);
      int ret;
  
@@ -48,7 +48,7 @@ index b2b649e305..b6fa9e8a69 100644
      if (s->sync_mode == MIRROR_SYNC_MODE_TOP) {
          int64_t offset = 0;
          int64_t count;
-@@ -492,6 +490,8 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
+@@ -493,6 +491,8 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
      block_job_add_bdrv(&job->common, "target", target, 0, BLK_PERM_ALL,
                         &error_abort);
  

debian/patches/pve/0026-PVE-Backup-add-vma-backup-format-code.patch

@@ -9,8 +9,8 @@ Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 ---
  block/meson.build |   2 +
  meson.build       |   5 +
- vma-reader.c      | 859 ++++++++++++++++++++++++++++++++++++++++++++++
- vma-writer.c      | 791 ++++++++++++++++++++++++++++++++++++++++++
+ vma-reader.c      | 860 ++++++++++++++++++++++++++++++++++++++++++++++
+ vma-writer.c      | 790 ++++++++++++++++++++++++++++++++++++++++++
  vma.c             | 849 +++++++++++++++++++++++++++++++++++++++++++++
  vma.h             | 150 ++++++++
  6 files changed, 2656 insertions(+)
@@ -20,10 +20,10 @@ Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
  create mode 100644 vma.h
 
 diff --git a/block/meson.build b/block/meson.build
-index ad40c10b6a..3a0b84bc11 100644
+index c9d1fdca7d..72081a9974 100644
 --- a/block/meson.build
 +++ b/block/meson.build
-@@ -46,6 +46,8 @@ block_ss.add(files(
+@@ -44,6 +44,8 @@ block_ss.add(files(
    'zeroinit.c',
  ), zstd, zlib, gnutls)
  
@@ -31,12 +31,12 @@ index ad40c10b6a..3a0b84bc11 100644
 +
  softmmu_ss.add(when: 'CONFIG_TCG', if_true: files('blkreplay.c'))
  
- if get_option('qcow1').allowed()
+ block_ss.add(when: 'CONFIG_QCOW1', if_true: files('qcow.c'))
 diff --git a/meson.build b/meson.build
-index d5230eadd6..ffff66c0cc 100644
+index 96de1a6ef9..54c23b9567 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -1462,6 +1462,8 @@ keyutils = dependency('libkeyutils', required: false,
+@@ -1202,6 +1202,8 @@ keyutils = dependency('libkeyutils', required: false,
  
  has_gettid = cc.has_function('gettid')
  
@@ -45,7 +45,7 @@ index d5230eadd6..ffff66c0cc 100644
  # libselinux
  selinux = dependency('libselinux',
                       required: get_option('selinux'),
-@@ -3607,6 +3609,9 @@ if have_tools
+@@ -3070,6 +3072,9 @@ if have_tools
                 dependencies: [blockdev, qemuutil, gnutls, selinux],
                 install: true)
  
@@ -57,10 +57,10 @@ index d5230eadd6..ffff66c0cc 100644
    subdir('contrib/elf2dmp')
 diff --git a/vma-reader.c b/vma-reader.c
 new file mode 100644
-index 0000000000..e65f1e8415
+index 0000000000..4f4ee2b47b
 --- /dev/null
 +++ b/vma-reader.c
-@@ -0,0 +1,859 @@
+@@ -0,0 +1,860 @@
 +/*
 + * VMA: Virtual Machine Archive
 + *
@@ -78,6 +78,7 @@ index 0000000000..e65f1e8415
 +#include <glib.h>
 +#include <uuid/uuid.h>
 +
++#include "qemu-common.h"
 +#include "qemu/timer.h"
 +#include "qemu/ratelimit.h"
 +#include "vma.h"
@@ -588,7 +589,7 @@ index 0000000000..e65f1e8415
 +            }
 +        }
 +    } else {
-+        int res = blk_pwrite(target, sector_num * BDRV_SECTOR_SIZE, nb_sectors * BDRV_SECTOR_SIZE, buf, 0);
++        int res = blk_pwrite(target, sector_num * BDRV_SECTOR_SIZE, buf, nb_sectors * BDRV_SECTOR_SIZE, 0);
 +        if (res < 0) {
 +            error_setg(errp, "blk_pwrite to %s failed (%d)",
 +                       bdrv_get_device_name(blk_bs(target)), res);
@@ -922,10 +923,10 @@ index 0000000000..e65f1e8415
 +
 diff --git a/vma-writer.c b/vma-writer.c
 new file mode 100644
-index 0000000000..df4b20793d
+index 0000000000..11d8321ffd
 --- /dev/null
 +++ b/vma-writer.c
-@@ -0,0 +1,791 @@
+@@ -0,0 +1,790 @@
 +/*
 + * VMA: Virtual Machine Archive
 + *
@@ -949,7 +950,6 @@ index 0000000000..df4b20793d
 +#include "qemu/main-loop.h"
 +#include "qemu/coroutine.h"
 +#include "qemu/cutils.h"
-+#include "qemu/memalign.h"
 +
 +#define DEBUG_VMA 0
 +
@@ -1133,9 +1133,9 @@ index 0000000000..df4b20793d
 +    assert(qemu_in_coroutine());
 +    AioContext *ctx = qemu_get_current_aio_context();
 +    aio_set_fd_handler(ctx, fd, false, NULL, (IOHandler *)qemu_coroutine_enter,
-+                       NULL, NULL, qemu_coroutine_self());
++                       NULL, qemu_coroutine_self());
 +    qemu_coroutine_yield();
-+    aio_set_fd_handler(ctx, fd, false, NULL, NULL, NULL, NULL, NULL);
++    aio_set_fd_handler(ctx, fd, false, NULL, NULL, NULL, NULL);
 +}
 +
 +static ssize_t coroutine_fn
@@ -1719,7 +1719,7 @@ index 0000000000..df4b20793d
 +}
 diff --git a/vma.c b/vma.c
 new file mode 100644
-index 0000000000..e8dffb43e0
+index 0000000000..89440733b1
 --- /dev/null
 +++ b/vma.c
 @@ -0,0 +1,849 @@
@@ -1740,11 +1740,11 @@ index 0000000000..e8dffb43e0
 +#include <glib.h>
 +
 +#include "vma.h"
++#include "qemu-common.h"
 +#include "qemu/module.h"
 +#include "qemu/error-report.h"
 +#include "qemu/main-loop.h"
 +#include "qemu/cutils.h"
-+#include "qemu/memalign.h"
 +#include "qapi/qmp/qdict.h"
 +#include "sysemu/block-backend.h"
 +

debian/patches/pve/0027-PVE-Backup-add-backup-dump-block-driver.patch

@@ -10,20 +10,20 @@ Subject: [PATCH] PVE-Backup: add backup-dump block driver
 
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
- block/backup-dump.c              | 167 +++++++++++++++++++++++++++++++
- block/backup.c                   |  30 ++----
- block/meson.build                |   1 +
- include/block/block_int-common.h |  35 +++++++
- job.c                            |   3 +-
- 5 files changed, 213 insertions(+), 23 deletions(-)
+ block/backup-dump.c       | 168 ++++++++++++++++++++++++++++++++++++++
+ block/backup.c            |  30 ++-----
+ block/meson.build         |   1 +
+ include/block/block_int.h |  35 ++++++++
+ job.c                     |   3 +-
+ 5 files changed, 214 insertions(+), 23 deletions(-)
  create mode 100644 block/backup-dump.c
 
 diff --git a/block/backup-dump.c b/block/backup-dump.c
 new file mode 100644
-index 0000000000..04718a94e2
+index 0000000000..93d7f46950
 --- /dev/null
 +++ b/block/backup-dump.c
-@@ -0,0 +1,167 @@
+@@ -0,0 +1,168 @@
 +/*
 + * BlockDriver to send backup data stream to a callback function
 + *
@@ -35,6 +35,7 @@ index 0000000000..04718a94e2
 + */
 +
 +#include "qemu/osdep.h"
++#include "qemu-common.h"
 +#include "qom/object_interfaces.h"
 +#include "block/block_int.h"
 +
@@ -192,7 +193,7 @@ index 0000000000..04718a94e2
 +    return bs;
 +}
 diff --git a/block/backup.c b/block/backup.c
-index b6fa9e8a69..789f8b7799 100644
+index 47e218857d..4d8fad70c4 100644
 --- a/block/backup.c
 +++ b/block/backup.c
 @@ -29,28 +29,6 @@
@@ -224,7 +225,7 @@ index b6fa9e8a69..789f8b7799 100644
  static const BlockJobDriver backup_job_driver;
  
  static void backup_cleanup_sync_bitmap(BackupBlockJob *job, int ret)
-@@ -454,6 +432,14 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
+@@ -455,6 +433,14 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
      }
  
      cluster_size = block_copy_cluster_size(bcs);
@@ -240,7 +241,7 @@ index b6fa9e8a69..789f8b7799 100644
      if (perf->max_chunk && perf->max_chunk < cluster_size) {
          error_setg(errp, "Required max-chunk (%" PRIi64 ") is less than backup "
 diff --git a/block/meson.build b/block/meson.build
-index 3a0b84bc11..7f22e7f177 100644
+index 72081a9974..7883df047c 100644
 --- a/block/meson.build
 +++ b/block/meson.build
 @@ -4,6 +4,7 @@ block_ss.add(files(
@@ -251,10 +252,10 @@ index 3a0b84bc11..7f22e7f177 100644
    'copy-before-write.c',
    'blkdebug.c',
    'blklogwrites.c',
-diff --git a/include/block/block_int-common.h b/include/block/block_int-common.h
-index 8947abab76..f272d0d8dc 100644
---- a/include/block/block_int-common.h
-+++ b/include/block/block_int-common.h
+diff --git a/include/block/block_int.h b/include/block/block_int.h
+index f4c75e8ba9..169dc43d59 100644
+--- a/include/block/block_int.h
++++ b/include/block/block_int.h
 @@ -26,6 +26,7 @@
  
  #include "block/accounting.h"
@@ -269,7 +270,7 @@ index 8947abab76..f272d0d8dc 100644
  
 +typedef int BackupDumpFunc(void *opaque, uint64_t offset, uint64_t bytes, const void *buf);
 +
-+BlockDriverState *bdrv_backup_dump_create(
++BlockDriverState *bdrv_backuo_dump_create(
 +    int dump_cb_block_size,
 +    uint64_t byte_size,
 +    BackupDumpFunc *dump_cb,
@@ -305,7 +306,7 @@ index 8947abab76..f272d0d8dc 100644
      BDRV_TRACKED_READ,
      BDRV_TRACKED_WRITE,
 diff --git a/job.c b/job.c
-index 075c6f3a20..e5699ad200 100644
+index dbfa67bb0a..af25dd5b98 100644
 --- a/job.c
 +++ b/job.c
 @@ -276,7 +276,8 @@ static bool job_started(Job *job)

debian/patches/pve/0028-PVE-Backup-proxmox-backup-patches-for-qemu.patch

@@ -15,6 +15,7 @@ Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
  blockdev.c                     |   1 +
  hmp-commands-info.hx           |  14 +
  hmp-commands.hx                |  29 +
+ include/block/block_int.h      |   2 +-
  include/monitor/hmp.h          |   3 +
  meson.build                    |   1 +
  monitor/hmp-cmds.c             |  44 ++
@@ -24,16 +25,16 @@ Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
  qapi/block-core.json           | 109 ++++
  qapi/common.json               |  13 +
  qapi/machine.json              |  15 +-
- 14 files changed, 1448 insertions(+), 13 deletions(-)
+ 15 files changed, 1449 insertions(+), 14 deletions(-)
  create mode 100644 proxmox-backup-client.c
  create mode 100644 proxmox-backup-client.h
  create mode 100644 pve-backup.c
 
 diff --git a/block/meson.build b/block/meson.build
-index 7f22e7f177..2783b77e9c 100644
+index 7883df047c..9d3dd5b7c3 100644
 --- a/block/meson.build
 +++ b/block/meson.build
-@@ -48,6 +48,11 @@ block_ss.add(files(
+@@ -46,6 +46,11 @@ block_ss.add(files(
  ), zstd, zlib, gnutls)
  
  block_ss.add(files('../vma-writer.c'), libuuid)
@@ -46,7 +47,7 @@ index 7f22e7f177..2783b77e9c 100644
  softmmu_ss.add(when: 'CONFIG_TCG', if_true: files('blkreplay.c'))
  
 diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
-index bfb3c043a0..89ca64444d 100644
+index 2ac4aedfff..f6668ab01d 100644
 --- a/block/monitor/block-hmp-cmds.c
 +++ b/block/monitor/block-hmp-cmds.c
 @@ -1015,3 +1015,36 @@ void hmp_info_snapshots(Monitor *mon, const QDict *qdict)
@@ -87,7 +88,7 @@ index bfb3c043a0..89ca64444d 100644
 +    hmp_handle_error(mon, error);
 +}
 diff --git a/blockdev.c b/blockdev.c
-index ce62a9b439..1600b24eab 100644
+index b35072644e..c0bc3db33e 100644
 --- a/blockdev.c
 +++ b/blockdev.c
 @@ -36,6 +36,7 @@
@@ -99,10 +100,10 @@ index ce62a9b439..1600b24eab 100644
  #include "monitor/monitor.h"
  #include "qemu/error-report.h"
 diff --git a/hmp-commands-info.hx b/hmp-commands-info.hx
-index 97b88eaaad..92a8867afb 100644
+index 245f8acc55..3e7f2421eb 100644
 --- a/hmp-commands-info.hx
 +++ b/hmp-commands-info.hx
-@@ -484,6 +484,20 @@ SRST
+@@ -482,6 +482,20 @@ SRST
      Show the current VM UUID.
  ERST
  
@@ -124,10 +125,10 @@ index 97b88eaaad..92a8867afb 100644
      {
          .name       = "usernet",
 diff --git a/hmp-commands.hx b/hmp-commands.hx
-index bbcc73e942..97f24942b3 100644
+index 1ad13b668b..d4bb00216e 100644
 --- a/hmp-commands.hx
 +++ b/hmp-commands.hx
-@@ -101,6 +101,35 @@ ERST
+@@ -99,6 +99,35 @@ ERST
  SRST
  ``block_stream``
    Copy data from a backing file into a block device.
@@ -163,8 +164,21 @@ index bbcc73e942..97f24942b3 100644
  ERST
  
      {
+diff --git a/include/block/block_int.h b/include/block/block_int.h
+index 169dc43d59..92f90c43eb 100644
+--- a/include/block/block_int.h
++++ b/include/block/block_int.h
+@@ -67,7 +67,7 @@
+ 
+ typedef int BackupDumpFunc(void *opaque, uint64_t offset, uint64_t bytes, const void *buf);
+ 
+-BlockDriverState *bdrv_backuo_dump_create(
++BlockDriverState *bdrv_backup_dump_create(
+     int dump_cb_block_size,
+     uint64_t byte_size,
+     BackupDumpFunc *dump_cb,
 diff --git a/include/monitor/hmp.h b/include/monitor/hmp.h
-index 55067beff1..5a98d2d927 100644
+index 3a39ba41b5..d269b4c99c 100644
 --- a/include/monitor/hmp.h
 +++ b/include/monitor/hmp.h
 @@ -30,6 +30,7 @@ void hmp_info_savevm(Monitor *mon, const QDict *qdict);
@@ -185,10 +199,10 @@ index 55067beff1..5a98d2d927 100644
  void hmp_device_add(Monitor *mon, const QDict *qdict);
  void hmp_device_del(Monitor *mon, const QDict *qdict);
 diff --git a/meson.build b/meson.build
-index ffff66c0cc..0bc2fb5b10 100644
+index 54c23b9567..37dab249cc 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -1463,6 +1463,7 @@ keyutils = dependency('libkeyutils', required: false,
+@@ -1203,6 +1203,7 @@ keyutils = dependency('libkeyutils', required: false,
  has_gettid = cc.has_function('gettid')
  
  libuuid = cc.find_library('uuid', required: true)
@@ -197,10 +211,10 @@ index ffff66c0cc..0bc2fb5b10 100644
  # libselinux
  selinux = dependency('libselinux',
 diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
-index 1507180990..1168773da7 100644
+index 5000ce39d1..b2687eae3a 100644
 --- a/monitor/hmp-cmds.c
 +++ b/monitor/hmp-cmds.c
-@@ -197,6 +197,50 @@ void hmp_info_mice(Monitor *mon, const QDict *qdict)
+@@ -195,6 +195,50 @@ void hmp_info_mice(Monitor *mon, const QDict *qdict)
      qapi_free_MouseInfoList(mice_list);
  }
  
@@ -1464,12 +1478,12 @@ index 0000000000..88f5ee133f
 +    return info;
 +}
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index ddac91e8f6..90ad07b7ee 100644
+index 3f81d6a5c0..551ee28275 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -740,6 +740,115 @@
- { 'command': 'query-block', 'returns': ['BlockInfo'],
-   'allow-preconfig': true }
+@@ -744,6 +744,115 @@
+ { 'command': 'query-block', 'returns': ['BlockInfo'] }
+ 
  
 +##
 +# @BackupStatus:
@@ -1584,10 +1598,10 @@ index ddac91e8f6..90ad07b7ee 100644
  # @BlockDeviceTimedStats:
  #
 diff --git a/qapi/common.json b/qapi/common.json
-index 356db3f670..aae8a3b682 100644
+index 412cc4f5ae..3e7a77ea66 100644
 --- a/qapi/common.json
 +++ b/qapi/common.json
-@@ -206,3 +206,16 @@
+@@ -208,3 +208,16 @@
  ##
  { 'struct': 'HumanReadableText',
    'data': { 'human-readable-text': 'str' } }
@@ -1605,7 +1619,7 @@ index 356db3f670..aae8a3b682 100644
 +##
 +{ 'struct': 'UuidInfo', 'data': {'UUID': 'str'} }
 diff --git a/qapi/machine.json b/qapi/machine.json
-index d868e4d31d..a63d9a078d 100644
+index a05c46e253..e2cec7922f 100644
 --- a/qapi/machine.json
 +++ b/qapi/machine.json
 @@ -4,6 +4,8 @@
@@ -1617,7 +1631,7 @@ index d868e4d31d..a63d9a078d 100644
  ##
  # = Machines
  ##
-@@ -226,19 +228,6 @@
+@@ -229,19 +231,6 @@
  ##
  { 'command': 'query-target', 'returns': 'TargetInfo' }
  

debian/patches/pve/0029-PVE-Backup-pbs-restore-new-command-to-restore-from-p.patch

@@ -7,15 +7,15 @@ Subject: [PATCH] PVE-Backup: pbs-restore - new command to restore from proxmox
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
  meson.build   |   4 +
- pbs-restore.c | 223 ++++++++++++++++++++++++++++++++++++++++++++++++++
- 2 files changed, 227 insertions(+)
+ pbs-restore.c | 224 ++++++++++++++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 228 insertions(+)
  create mode 100644 pbs-restore.c
 
 diff --git a/meson.build b/meson.build
-index 0bc2fb5b10..f48d2e0457 100644
+index 37dab249cc..1a4dfab4e2 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -3613,6 +3613,10 @@ if have_tools
+@@ -3076,6 +3076,10 @@ if have_tools
    vma = executable('vma', files('vma.c', 'vma-reader.c') + genh,
                     dependencies: [authz, block, crypto, io, qom], install: true)
  
@@ -28,10 +28,10 @@ index 0bc2fb5b10..f48d2e0457 100644
    subdir('contrib/elf2dmp')
 diff --git a/pbs-restore.c b/pbs-restore.c
 new file mode 100644
-index 0000000000..2f834cf42e
+index 0000000000..4d3f925a1b
 --- /dev/null
 +++ b/pbs-restore.c
-@@ -0,0 +1,223 @@
+@@ -0,0 +1,224 @@
 +/*
 + * Qemu image restore helper for Proxmox Backup
 + *
@@ -50,6 +50,7 @@ index 0000000000..2f834cf42e
 +#include <getopt.h>
 +#include <string.h>
 +
++#include "qemu-common.h"
 +#include "qemu/module.h"
 +#include "qemu/error-report.h"
 +#include "qemu/main-loop.h"
@@ -95,7 +96,7 @@ index 0000000000..2f834cf42e
 +        }
 +        res = blk_pwrite_zeroes(callback_data->target, offset, data_len, 0);
 +    } else {
-+        res = blk_pwrite(callback_data->target, offset, data_len, data, 0);
++        res = blk_pwrite(callback_data->target, offset, data, data_len, 0);
 +    }
 +
 +    if (res < 0) {

debian/patches/pve/0030-PVE-Backup-Add-dirty-bitmap-tracking-for-incremental.patch

@@ -29,7 +29,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  6 files changed, 142 insertions(+), 23 deletions(-)
 
 diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
-index 89ca64444d..45da74d7a0 100644
+index f6668ab01d..3c06734e6d 100644
 --- a/block/monitor/block-hmp-cmds.c
 +++ b/block/monitor/block-hmp-cmds.c
 @@ -1042,6 +1042,7 @@ void hmp_backup(Monitor *mon, const QDict *qdict)
@@ -41,10 +41,10 @@ index 89ca64444d..45da74d7a0 100644
          false, NULL, false, NULL, !!devlist,
          devlist, qdict_haskey(qdict, "speed"), speed, &error);
 diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
-index 1168773da7..4c1671e289 100644
+index b2687eae3a..cfd7a60f32 100644
 --- a/monitor/hmp-cmds.c
 +++ b/monitor/hmp-cmds.c
-@@ -223,19 +223,42 @@ void hmp_info_backup(Monitor *mon, const QDict *qdict)
+@@ -221,19 +221,42 @@ void hmp_info_backup(Monitor *mon, const QDict *qdict)
              monitor_printf(mon, "End time: %s", ctime(&info->end_time));
          }
  
@@ -405,10 +405,10 @@ index 88f5ee133f..1c49cd178d 100644
      qemu_mutex_unlock(&backup_state.stat.lock);
  
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 90ad07b7ee..3ad9eb5d1a 100644
+index 551ee28275..b9d6f52f0c 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -753,8 +753,13 @@
+@@ -757,8 +757,13 @@
  #
  # @total: total amount of bytes involved in the backup process
  #
@@ -422,7 +422,7 @@ index 90ad07b7ee..3ad9eb5d1a 100644
  # @zero-bytes: amount of 'zero' bytes detected.
  #
  # @start-time: time (epoch) when backup job started.
-@@ -767,8 +772,8 @@
+@@ -771,8 +776,8 @@
  #
  ##
  { 'struct': 'BackupStatus',
@@ -433,7 +433,7 @@ index 90ad07b7ee..3ad9eb5d1a 100644
             '*start-time': 'int', '*end-time': 'int',
             '*backup-file': 'str', '*uuid': 'str' } }
  
-@@ -811,6 +816,8 @@
+@@ -815,6 +820,8 @@
  #
  # @backup-time: backup timestamp (Unix epoch, required for format 'pbs')
  #
@@ -442,7 +442,7 @@ index 90ad07b7ee..3ad9eb5d1a 100644
  # Returns: the uuid of the backup job
  #
  ##
-@@ -821,6 +828,7 @@
+@@ -825,6 +832,7 @@
                                      '*fingerprint': 'str',
                                      '*backup-id': 'str',
                                      '*backup-time': 'int',

debian/patches/pve/0031-PVE-various-PBS-fixes.patch

@@ -19,7 +19,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  3 files changed, 54 insertions(+), 13 deletions(-)
 
 diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
-index 45da74d7a0..ea7b665aa2 100644
+index 3c06734e6d..4481b60a5c 100644
 --- a/block/monitor/block-hmp-cmds.c
 +++ b/block/monitor/block-hmp-cmds.c
 @@ -1042,7 +1042,9 @@ void hmp_backup(Monitor *mon, const QDict *qdict)
@@ -194,10 +194,10 @@ index 1c49cd178d..c15abefdda 100644
          .format = format,
          .has_config_file = has_config_file,
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 3ad9eb5d1a..4120052690 100644
+index b9d6f52f0c..5d8e2eb303 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -818,6 +818,10 @@
+@@ -822,6 +822,10 @@
  #
  # @use-dirty-bitmap: use dirty bitmap to detect incremental changes since last job (optional for format 'pbs')
  #
@@ -208,7 +208,7 @@ index 3ad9eb5d1a..4120052690 100644
  # Returns: the uuid of the backup job
  #
  ##
-@@ -829,6 +833,8 @@
+@@ -833,6 +837,8 @@
                                      '*backup-id': 'str',
                                      '*backup-time': 'int',
                                      '*use-dirty-bitmap': 'bool',

debian/patches/pve/0032-PVE-Add-PBS-block-driver-to-map-backup-archives-into.patch

@@ -7,23 +7,22 @@ Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 [error cleanups, file_open implementation]
 Signed-off-by: Dietmar Maurer <dietmar@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
-[FE: adapt to changed function signatures
-     make pbs_co_preadv return values consistent with QEMU]
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
+[adapt to changed function signatures]
+Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 ---
  block/meson.build    |   3 +
  block/pbs.c          | 276 +++++++++++++++++++++++++++++++++++++++++++
  configure            |   9 ++
- meson.build          |   2 +-
+ meson.build          |   1 +
  qapi/block-core.json |  13 ++
- 5 files changed, 302 insertions(+), 1 deletion(-)
+ 5 files changed, 302 insertions(+)
  create mode 100644 block/pbs.c
 
 diff --git a/block/meson.build b/block/meson.build
-index 2783b77e9c..a26a69434e 100644
+index 9d3dd5b7c3..8c758c0218 100644
 --- a/block/meson.build
 +++ b/block/meson.build
-@@ -53,6 +53,9 @@ block_ss.add(files(
+@@ -51,6 +51,9 @@ block_ss.add(files(
    '../pve-backup.c',
  ), libproxmox_backup_qemu)
  
@@ -35,7 +34,7 @@ index 2783b77e9c..a26a69434e 100644
  
 diff --git a/block/pbs.c b/block/pbs.c
 new file mode 100644
-index 0000000000..9d1f1f39d4
+index 0000000000..0b05ea9080
 --- /dev/null
 +++ b/block/pbs.c
 @@ -0,0 +1,276 @@
@@ -245,7 +244,7 @@ index 0000000000..9d1f1f39d4
 +
 +    if (offset < 0 || bytes < 0) {
 +        fprintf(stderr, "unexpected negative 'offset' or 'bytes' value!\n");
-+        return -EIO;
++        return -EINVAL;
 +    }
 +
 +    ReadCallbackData rcb = {
@@ -267,7 +266,7 @@ index 0000000000..9d1f1f39d4
 +    qemu_iovec_from_buf(qiov, 0, buf, bytes);
 +    free(buf);
 +
-+    return 0;
++    return ret;
 +}
 +
 +static coroutine_fn int pbs_co_pwritev(BlockDriverState *bs,
@@ -316,64 +315,63 @@ index 0000000000..9d1f1f39d4
 +
 +block_init(bdrv_pbs_init);
 diff --git a/configure b/configure
-index 72ab03f11a..7203c270ec 100755
+index 48c21775f3..eda4e9225a 100755
 --- a/configure
 +++ b/configure
-@@ -309,6 +309,7 @@ linux_user=""
- bsd_user=""
- pie=""
- coroutine=""
+@@ -356,6 +356,7 @@ vdi=${default_feature:-yes}
+ vvfat=${default_feature:-yes}
+ qed=${default_feature:-yes}
+ parallels=${default_feature:-yes}
 +pbs_bdrv="yes"
+ debug_mutex="no"
  plugins="$default_feature"
- meson=""
- meson_args=""
-@@ -902,6 +903,10 @@ for opt do
-   --enable-uuid|--disable-uuid)
-       echo "$0: $opt is obsolete, UUID support is always built" >&2
+ rng_none="no"
+@@ -1126,6 +1127,10 @@ for opt do
+   ;;
+   --enable-parallels) parallels="yes"
    ;;
 +  --disable-pbs-bdrv) pbs_bdrv="no"
 +  ;;
 +  --enable-pbs-bdrv) pbs_bdrv="yes"
 +  ;;
-   --with-git=*) git="$optarg"
+   --disable-vhost-user) vhost_user="no"
    ;;
-   --with-git-submodules=*)
-@@ -1087,6 +1092,7 @@ cat << EOF
-   debug-info      debugging information
-   safe-stack      SafeStack Stack Smash Protection. Depends on
-                   clang/llvm >= 3.7 and requires coroutine backend ucontext.
+   --enable-vhost-user) vhost_user="yes"
+@@ -1465,6 +1470,7 @@ cat << EOF
+   vvfat           vvfat image format support
+   qed             qed image format support
+   parallels       parallels image format support
 +  pbs-bdrv        Proxmox backup server read-only block driver support
- 
- NOTE: The object files are built at the place where configure is launched
- EOF
-@@ -2463,6 +2469,9 @@ echo "TARGET_DIRS=$target_list" >> $config_host_mak
- if test "$modules" = "yes"; then
-   echo "CONFIG_MODULES=y" >> $config_host_mak
+   crypto-afalg    Linux AF_ALG crypto backend driver
+   debug-mutex     mutex debugging support
+   rng-none        dummy RNG, avoid using /dev/(u)random and getrandom()
+@@ -3534,6 +3540,9 @@ if test "$xen" = "enabled" ; then
+   echo "XEN_CFLAGS=$xen_cflags" >> $config_host_mak
+   echo "XEN_LIBS=$xen_libs" >> $config_host_mak
  fi
 +if test "$pbs_bdrv" = "yes" ; then
 +  echo "CONFIG_PBS_BDRV=y" >> $config_host_mak
 +fi
- 
- # XXX: suppress that
- if [ "$bsd" = "yes" ] ; then
+ if test "$vhost_scsi" = "yes" ; then
+   echo "CONFIG_VHOST_SCSI=y" >> $config_host_mak
+ fi
 diff --git a/meson.build b/meson.build
-index f48d2e0457..be4785e2f6 100644
+index 1a4dfab4e2..85b3c63199 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -3986,7 +3986,7 @@ summary_info += {'bzip2 support':     libbzip2}
- summary_info += {'lzfse support':     liblzfse}
+@@ -3448,6 +3448,7 @@ summary_info += {'lzfse support':     liblzfse}
  summary_info += {'zstd support':      zstd}
- summary_info += {'NUMA host support': numa}
--summary_info += {'capstone':          capstone}
+ summary_info += {'NUMA host support': config_host.has_key('CONFIG_NUMA')}
+ summary_info += {'libxml2':           libxml2}
 +summary_info += {'PBS bdrv support':  config_host.has_key('CONFIG_PBS_BDRV')}
+ summary_info += {'capstone':          capstone_opt == 'internal' ? capstone_opt : capstone}
  summary_info += {'libpmem support':   libpmem}
  summary_info += {'libdaxctl support': libdaxctl}
- summary_info += {'libudev':           libudev}
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 4120052690..96bc696aaa 100644
+index 5d8e2eb303..777863e33b 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -3099,6 +3099,7 @@
+@@ -3053,6 +3053,7 @@
              'luks', 'nbd', 'nfs', 'null-aio', 'null-co', 'nvme', 'parallels',
              'preallocate', 'qcow', 'qcow2', 'qed', 'quorum', 'raw', 'rbd',
              { 'name': 'replication', 'if': 'CONFIG_REPLICATION' },
@@ -381,7 +379,7 @@ index 4120052690..96bc696aaa 100644
              'ssh', 'throttle', 'vdi', 'vhdx', 'vmdk', 'vpc', 'vvfat' ] }
  
  ##
-@@ -3171,6 +3172,17 @@
+@@ -3125,6 +3126,17 @@
  { 'struct': 'BlockdevOptionsNull',
    'data': { '*size': 'int', '*latency-ns': 'uint64', '*read-zeroes': 'bool' } }
  
@@ -399,7 +397,7 @@ index 4120052690..96bc696aaa 100644
  ##
  # @BlockdevOptionsNVMe:
  #
-@@ -4455,6 +4467,7 @@
+@@ -4367,6 +4379,7 @@
        'nfs':        'BlockdevOptionsNfs',
        'null-aio':   'BlockdevOptionsNull',
        'null-co':    'BlockdevOptionsNull',

debian/patches/pve/0033-PVE-add-query_proxmox_support-QMP-command.patch

@@ -33,10 +33,10 @@ index c15abefdda..4684789813 100644
 +    return ret;
 +}
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 96bc696aaa..0b453c61d4 100644
+index 777863e33b..cfd980b70f 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -863,6 +863,35 @@
+@@ -867,6 +867,35 @@
  ##
  { 'command': 'backup-cancel' }
  

debian/patches/pve/0034-PVE-add-query-pbs-bitmap-info-QMP-call.patch

@@ -15,10 +15,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  3 files changed, 159 insertions(+), 42 deletions(-)
 
 diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
-index 4c1671e289..c1152f55a7 100644
+index cfd7a60f32..b613190a3c 100644
 --- a/monitor/hmp-cmds.c
 +++ b/monitor/hmp-cmds.c
-@@ -200,6 +200,7 @@ void hmp_info_mice(Monitor *mon, const QDict *qdict)
+@@ -198,6 +198,7 @@ void hmp_info_mice(Monitor *mon, const QDict *qdict)
  void hmp_info_backup(Monitor *mon, const QDict *qdict)
  {
      BackupStatus *info;
@@ -26,7 +26,7 @@ index 4c1671e289..c1152f55a7 100644
  
      info = qmp_query_backup(NULL);
  
-@@ -230,26 +231,29 @@ void hmp_info_backup(Monitor *mon, const QDict *qdict)
+@@ -228,26 +229,29 @@ void hmp_info_backup(Monitor *mon, const QDict *qdict)
              // this should not happen normally
              monitor_printf(mon, "Total size: %d\n", 0);
          } else {
@@ -359,10 +359,10 @@ index 4684789813..f90abaa50a 100644
      return ret;
  }
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 0b453c61d4..16e184dd28 100644
+index cfd980b70f..8833060385 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -871,6 +871,8 @@
+@@ -875,6 +875,8 @@
  # @pbs-dirty-bitmap: True if dirty-bitmap-incremental backups to PBS are
  #                    supported.
  #
@@ -371,7 +371,7 @@ index 0b453c61d4..16e184dd28 100644
  # @pbs-dirty-bitmap-savevm: True if 'dirty-bitmaps' migration capability can
  #                           safely be set for savevm-async.
  #
-@@ -879,6 +881,7 @@
+@@ -883,6 +885,7 @@
  ##
  { 'struct': 'ProxmoxSupportStatus',
    'data': { 'pbs-dirty-bitmap': 'bool',
@@ -379,7 +379,7 @@ index 0b453c61d4..16e184dd28 100644
              'pbs-dirty-bitmap-savevm': 'bool',
              'pbs-library-version': 'str' } }
  
-@@ -892,6 +895,59 @@
+@@ -896,6 +899,59 @@
  ##
  { 'command': 'query-proxmox-support', 'returns': 'ProxmoxSupportStatus' }
  

debian/patches/pve/0035-PVE-redirect-stderr-to-journal-when-daemonized.patch

@@ -14,10 +14,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  2 files changed, 7 insertions(+), 2 deletions(-)
 
 diff --git a/meson.build b/meson.build
-index be4785e2f6..3fc7c8d435 100644
+index 85b3c63199..31ba7d70d6 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -1463,6 +1463,7 @@ keyutils = dependency('libkeyutils', required: false,
+@@ -1203,6 +1203,7 @@ keyutils = dependency('libkeyutils', required: false,
  has_gettid = cc.has_function('gettid')
  
  libuuid = cc.find_library('uuid', required: true)
@@ -25,7 +25,7 @@ index be4785e2f6..3fc7c8d435 100644
  libproxmox_backup_qemu = cc.find_library('proxmox_backup_qemu', required: true)
  
  # libselinux
-@@ -3105,6 +3106,7 @@ if have_block
+@@ -2571,6 +2572,7 @@ if have_block
    # os-posix.c contains POSIX-specific functions used by qemu-storage-daemon,
    # os-win32.c does not
    blockdev_ss.add(when: 'CONFIG_POSIX', if_true: files('os-posix.c'))
@@ -34,7 +34,7 @@ index be4785e2f6..3fc7c8d435 100644
  endif
  
 diff --git a/os-posix.c b/os-posix.c
-index 321fc4bd13..b1870d2690 100644
+index ae6c9f2a5e..36807806bf 100644
 --- a/os-posix.c
 +++ b/os-posix.c
 @@ -28,6 +28,8 @@
@@ -44,15 +44,15 @@ index 321fc4bd13..b1870d2690 100644
 +#include <systemd/sd-journal.h>
 +#include <syslog.h>
  
+ #include "qemu-common.h"
  /* Needed early for CONFIG_BSD etc. */
- #include "net/slirp.h"
-@@ -281,9 +283,10 @@ void os_setup_post(void)
+@@ -291,9 +293,10 @@ void os_setup_post(void)
  
          dup2(fd, 0);
          dup2(fd, 1);
 -        /* In case -D is given do not redirect stderr to /dev/null */
 +        /* In case -D is given do not redirect stderr to journal */
-         if (!qemu_log_enabled()) {
+         if (!qemu_logfile) {
 -            dup2(fd, 2);
 +            int journal_fd = sd_journal_stream_fd("QEMU", LOG_ERR, 0);
 +            dup2(journal_fd, 2);

debian/patches/pve/0036-PVE-Add-sequential-job-transaction-support.patch

@@ -11,10 +11,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  2 files changed, 43 insertions(+)
 
 diff --git a/include/qemu/job.h b/include/qemu/job.h
-index c105b31076..5096679571 100644
+index 6e67b6977f..60376c99ee 100644
 --- a/include/qemu/job.h
 +++ b/include/qemu/job.h
-@@ -316,6 +316,18 @@ typedef enum JobCreateFlags {
+@@ -294,6 +294,18 @@ typedef enum JobCreateFlags {
   */
  JobTxn *job_txn_new(void);
  
@@ -34,7 +34,7 @@ index c105b31076..5096679571 100644
   * Release a reference that was previously acquired with job_txn_add_job or
   * job_txn_new. If it's the last reference to the object, it will be freed.
 diff --git a/job.c b/job.c
-index e5699ad200..34c9758349 100644
+index af25dd5b98..d0d152e697 100644
 --- a/job.c
 +++ b/job.c
 @@ -72,6 +72,8 @@ struct JobTxn {
@@ -72,7 +72,7 @@ index e5699ad200..34c9758349 100644
  static void job_txn_ref(JobTxn *txn)
  {
      txn->refcnt++;
-@@ -897,6 +918,9 @@ static void job_completed_txn_success(Job *job)
+@@ -888,6 +909,9 @@ static void job_completed_txn_success(Job *job)
       */
      QLIST_FOREACH(other_job, &txn->jobs, txn_list) {
          if (!job_is_completed(other_job)) {
@@ -82,7 +82,7 @@ index e5699ad200..34c9758349 100644
              return;
          }
          assert(other_job->ret == 0);
-@@ -1093,6 +1117,13 @@ int job_finish_sync(Job *job, void (*finish)(Job *, Error **errp), Error **errp)
+@@ -1082,6 +1106,13 @@ int job_finish_sync(Job *job, void (*finish)(Job *, Error **errp), Error **errp)
          return -EBUSY;
      }
  

debian/patches/pve/0038-PVE-Backup-Don-t-block-on-finishing-and-cleanup-crea.patch

@@ -481,10 +481,10 @@ index 63c686463f..6f05796fad 100644
      qemu_mutex_unlock(&backup_state.stat.lock);
  
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 16e184dd28..cb17d00fe0 100644
+index 8833060385..6a67adf923 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -770,12 +770,15 @@
+@@ -774,12 +774,15 @@
  #
  # @uuid: uuid for this backup job
  #

debian/patches/pve/0039-PVE-Migrate-dirty-bitmap-state-via-savevm.patch

@@ -36,11 +36,11 @@ index 465906710d..4f0aeceb6f 100644
 +
  #endif
 diff --git a/migration/meson.build b/migration/meson.build
-index 0842d00cd2..d012f4d8d3 100644
+index ea9aedeefc..c27dc9bd97 100644
 --- a/migration/meson.build
 +++ b/migration/meson.build
-@@ -6,8 +6,10 @@ migration_files = files(
-   'vmstate.c',
+@@ -7,8 +7,10 @@ migration_files = files(
+   'qemu-file-channel.c',
    'qemu-file.c',
    'yank_functions.c',
 +  'pbs-state.c',
@@ -51,10 +51,10 @@ index 0842d00cd2..d012f4d8d3 100644
  softmmu_ss.add(files(
    'block-dirty-bitmap.c',
 diff --git a/migration/migration.c b/migration/migration.c
-index bb8bbddfe4..8109e468eb 100644
+index abaf6f9e3d..d925fd7488 100644
 --- a/migration/migration.c
 +++ b/migration/migration.c
-@@ -229,6 +229,7 @@ void migration_object_init(void)
+@@ -213,6 +213,7 @@ void migration_object_init(void)
      blk_mig_init();
      ram_mig_init();
      dirty_bitmap_mig_init();
@@ -187,10 +187,10 @@ index 6f05796fad..5fa3cc1352 100644
      return ret;
  }
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index cb17d00fe0..bd978ea562 100644
+index 6a67adf923..c99ddf8628 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -879,6 +879,11 @@
+@@ -883,6 +883,11 @@
  # @pbs-dirty-bitmap-savevm: True if 'dirty-bitmaps' migration capability can
  #                           safely be set for savevm-async.
  #
@@ -202,7 +202,7 @@ index cb17d00fe0..bd978ea562 100644
  # @pbs-library-version: Running version of libproxmox-backup-qemu0 library.
  #
  ##
-@@ -886,6 +891,7 @@
+@@ -890,6 +895,7 @@
    'data': { 'pbs-dirty-bitmap': 'bool',
              'query-bitmap-info': 'bool',
              'pbs-dirty-bitmap-savevm': 'bool',

debian/patches/pve/0041-PVE-fall-back-to-open-iscsi-initiatorname.patch

@@ -21,7 +21,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 30 insertions(+)
 
 diff --git a/block/iscsi.c b/block/iscsi.c
-index d707d0b354..da6ed52323 100644
+index 57aa07a40d..a8902b84d5 100644
 --- a/block/iscsi.c
 +++ b/block/iscsi.c
 @@ -1386,12 +1386,42 @@ static char *get_initiator_name(QemuOpts *opts)

debian/patches/pve/0042-PVE-Use-coroutine-QMP-for-backup-cancel_backup.patch

@@ -32,7 +32,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  5 files changed, 77 insertions(+), 196 deletions(-)
 
 diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
-index ea7b665aa2..ef45552e3b 100644
+index 4481b60a5c..c9849a5b29 100644
 --- a/block/monitor/block-hmp-cmds.c
 +++ b/block/monitor/block-hmp-cmds.c
 @@ -1016,7 +1016,7 @@ void hmp_info_snapshots(Monitor *mon, const QDict *qdict)
@@ -54,10 +54,10 @@ index ea7b665aa2..ef45552e3b 100644
      Error *error = NULL;
  
 diff --git a/hmp-commands.hx b/hmp-commands.hx
-index 97f24942b3..7a2be816da 100644
+index d4bb00216e..4e21911fa6 100644
 --- a/hmp-commands.hx
 +++ b/hmp-commands.hx
-@@ -111,6 +111,7 @@ ERST
+@@ -109,6 +109,7 @@ ERST
  		    "\n\t\t\t Use -d to dump data into a directory instead"
  		    "\n\t\t\t of using VMA format.",
          .cmd = hmp_backup,
@@ -65,7 +65,7 @@ index 97f24942b3..7a2be816da 100644
      },
  
  SRST
-@@ -124,6 +125,7 @@ ERST
+@@ -122,6 +123,7 @@ ERST
          .params     = "",
          .help       = "cancel the current VM backup",
          .cmd        = hmp_backup_cancel,
@@ -575,10 +575,10 @@ index 5fa3cc1352..323014744c 100644
  
  BackupStatus *qmp_query_backup(Error **errp)
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index bd978ea562..ca1966f54b 100644
+index c99ddf8628..829dc7b8e9 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -842,7 +842,7 @@
+@@ -846,7 +846,7 @@
                                      '*config-file': 'str',
                                      '*firewall-file': 'str',
                                      '*devlist': 'str', '*speed': 'int' },
@@ -587,7 +587,7 @@ index bd978ea562..ca1966f54b 100644
  
  ##
  # @query-backup:
-@@ -864,7 +864,7 @@
+@@ -868,7 +868,7 @@
  # Notes: This command succeeds even if there is no backup process running.
  #
  ##

debian/patches/pve/0043-PBS-add-master-key-support.patch

@@ -19,7 +19,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  3 files changed, 11 insertions(+)
 
 diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
-index ef45552e3b..4c799f00d9 100644
+index c9849a5b29..52ddbf95ad 100644
 --- a/block/monitor/block-hmp-cmds.c
 +++ b/block/monitor/block-hmp-cmds.c
 @@ -1039,6 +1039,7 @@ void coroutine_fn hmp_backup(Monitor *mon, const QDict *qdict)
@@ -58,10 +58,10 @@ index 323014744c..9f6c04a512 100644
      return ret;
  }
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index ca1966f54b..fc8a125451 100644
+index 829dc7b8e9..d089328a1f 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -813,6 +813,8 @@
+@@ -817,6 +817,8 @@
  #
  # @key-password: password for keyfile (optional for format 'pbs')
  #
@@ -70,7 +70,7 @@ index ca1966f54b..fc8a125451 100644
  # @fingerprint: server cert fingerprint (optional for format 'pbs')
  #
  # @backup-id: backup ID (required for format 'pbs')
-@@ -832,6 +834,7 @@
+@@ -836,6 +838,7 @@
                                      '*password': 'str',
                                      '*keyfile': 'str',
                                      '*key-password': 'str',
@@ -78,7 +78,7 @@ index ca1966f54b..fc8a125451 100644
                                      '*fingerprint': 'str',
                                      '*backup-id': 'str',
                                      '*backup-time': 'int',
-@@ -884,6 +887,9 @@
+@@ -888,6 +891,9 @@
  #                              migration cap if this is false/unset may lead
  #                              to crashes on migration!
  #
@@ -88,7 +88,7 @@ index ca1966f54b..fc8a125451 100644
  # @pbs-library-version: Running version of libproxmox-backup-qemu0 library.
  #
  ##
-@@ -892,6 +898,7 @@
+@@ -896,6 +902,7 @@
              'query-bitmap-info': 'bool',
              'pbs-dirty-bitmap-savevm': 'bool',
              'pbs-dirty-bitmap-migration': 'bool',

debian/patches/pve/0044-PVE-block-pbs-fast-path-reads-without-allocation-if-.patch

@@ -49,5 +49,5 @@ index 0b05ea9080..c5eb4d5bad 100644
 +        g_free(buf);
 +    }
  
-     return 0;
+     return ret;
  }

debian/patches/pve/0045-PVE-block-stream-increase-chunk-size.patch

@@ -11,7 +11,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/block/stream.c b/block/stream.c
-index 694709bd25..e09bd5c4ef 100644
+index e45113aed6..c3c0c5febe 100644
 --- a/block/stream.c
 +++ b/block/stream.c
 @@ -28,7 +28,7 @@ enum {

debian/patches/pve/0046-block-io-accept-NULL-qiov-in-bdrv_pad_request.patch

@@ -17,10 +17,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 4 insertions(+)
 
 diff --git a/block/io.c b/block/io.c
-index 0a8cbefe86..531b3b7a2d 100644
+index 4e4cb556c5..04061f1e68 100644
 --- a/block/io.c
 +++ b/block/io.c
-@@ -1734,6 +1734,10 @@ static int bdrv_pad_request(BlockDriverState *bs,
+@@ -1765,6 +1765,10 @@ static int bdrv_pad_request(BlockDriverState *bs,
  {
      int ret;
  

debian/patches/pve/0047-block-add-alloc-track-driver.patch

@@ -24,9 +24,8 @@ once the backing image is removed. It will be replaced by 'file'.
 
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
-[FE: adapt to changed function signatures
-     make error return value consistent with QEMU]
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
+[adapt to changed function signatures]
+Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 ---
  block/alloc-track.c | 350 ++++++++++++++++++++++++++++++++++++++++++++
  block/meson.build   |   1 +
@@ -35,7 +34,7 @@ Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 
 diff --git a/block/alloc-track.c b/block/alloc-track.c
 new file mode 100644
-index 0000000000..43d40d11af
+index 0000000000..6b50fbe537
 --- /dev/null
 +++ b/block/alloc-track.c
 @@ -0,0 +1,350 @@
@@ -182,7 +181,7 @@ index 0000000000..43d40d11af
 +
 +    if (offset < 0 || bytes < 0) {
 +        fprintf(stderr, "unexpected negative 'offset' or 'bytes' value!\n");
-+        return -EIO;
++        return -EINVAL;
 +    }
 +
 +    /* a read request can span multiple granularity-sized chunks, and can thus
@@ -390,7 +389,7 @@ index 0000000000..43d40d11af
 +
 +block_init(bdrv_alloc_track_init);
 diff --git a/block/meson.build b/block/meson.build
-index a26a69434e..74e5f49758 100644
+index 8c758c0218..45b72e10f1 100644
 --- a/block/meson.build
 +++ b/block/meson.build
 @@ -2,6 +2,7 @@ block_ss.add(genh)

debian/patches/pve/0048-PVE-whitelist-invalid-QAPI-names-for-backwards-compa.patch

@@ -10,10 +10,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 4 insertions(+), 1 deletion(-)
 
 diff --git a/qapi/pragma.json b/qapi/pragma.json
-index a2358e303a..9ff5c84ffd 100644
+index 7c91ea3685..c3888d654c 100644
 --- a/qapi/pragma.json
 +++ b/qapi/pragma.json
-@@ -15,6 +15,7 @@
+@@ -12,6 +12,7 @@
          'device_add',
          'device_del',
          'expire_password',
@@ -21,7 +21,7 @@ index a2358e303a..9ff5c84ffd 100644
          'migrate_cancel',
          'netdev_add',
          'netdev_del',
-@@ -64,6 +65,8 @@
+@@ -60,6 +61,8 @@
          'SysEmuTarget',             # query-cpu-fast, query-target
          'UuidInfo',                 # query-uuid
          'VncClientInfo',            # query-vnc, query-vnc-servers, ...

debian/patches/pve/0049-PVE-savevm-async-register-yank-before-migration_inco.patch

@@ -11,10 +11,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 5 insertions(+)
 
 diff --git a/migration/savevm-async.c b/migration/savevm-async.c
-index e65a5e3482..2ed2536816 100644
+index 970ee3b3fc..b3ccc069f1 100644
 --- a/migration/savevm-async.c
 +++ b/migration/savevm-async.c
-@@ -20,6 +20,7 @@
+@@ -19,6 +19,7 @@
  #include "qemu/timer.h"
  #include "qemu/main-loop.h"
  #include "qemu/rcu.h"
@@ -22,7 +22,7 @@ index e65a5e3482..2ed2536816 100644
  
  /* #define DEBUG_SAVEVM_STATE */
  
-@@ -514,6 +515,10 @@ int load_snapshot_from_blockdev(const char *filename, Error **errp)
+@@ -580,6 +581,10 @@ int load_snapshot_from_blockdev(const char *filename, Error **errp)
      dirty_bitmap_mig_before_vm_start();
  
      qemu_fclose(f);

debian/patches/pve/0050-qemu-img-dd-add-l-option-for-loading-a-snapshot.patch

@@ -12,7 +12,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  3 files changed, 36 insertions(+), 7 deletions(-)
 
 diff --git a/docs/tools/qemu-img.rst b/docs/tools/qemu-img.rst
-index 699229eef6..4189ced8bc 100644
+index a49badb158..1039aec01c 100644
 --- a/docs/tools/qemu-img.rst
 +++ b/docs/tools/qemu-img.rst
 @@ -492,10 +492,10 @@ Command description:
@@ -30,7 +30,7 @@ index 699229eef6..4189ced8bc 100644
    The data is by default read and written using blocks of 512 bytes but can be
    modified by specifying *BLOCK_SIZE*. If count=\ *BLOCKS* is specified
 diff --git a/qemu-img-cmds.hx b/qemu-img-cmds.hx
-index b5b0bb4467..36f97e1f19 100644
+index f3b2b1b4de..e77ed9347f 100644
 --- a/qemu-img-cmds.hx
 +++ b/qemu-img-cmds.hx
 @@ -58,9 +58,9 @@ SRST
@@ -46,10 +46,10 @@ index b5b0bb4467..36f97e1f19 100644
  
  DEF("info", img_info,
 diff --git a/qemu-img.c b/qemu-img.c
-index c6b4a5567d..041c203fc3 100644
+index 015d6d2ce4..7031195e32 100644
 --- a/qemu-img.c
 +++ b/qemu-img.c
-@@ -4943,6 +4943,7 @@ static int img_dd(int argc, char **argv)
+@@ -4922,6 +4922,7 @@ static int img_dd(int argc, char **argv)
      BlockDriver *drv = NULL, *proto_drv = NULL;
      BlockBackend *blk1 = NULL, *blk2 = NULL;
      QemuOpts *opts = NULL;
@@ -57,7 +57,7 @@ index c6b4a5567d..041c203fc3 100644
      QemuOptsList *create_opts = NULL;
      Error *local_err = NULL;
      bool image_opts = false;
-@@ -4952,6 +4953,7 @@ static int img_dd(int argc, char **argv)
+@@ -4931,6 +4932,7 @@ static int img_dd(int argc, char **argv)
      int64_t size = 0, readsize = 0;
      int64_t block_count = 0, out_pos, in_pos;
      bool force_share = false, skip_create = false;
@@ -65,7 +65,7 @@ index c6b4a5567d..041c203fc3 100644
      struct DdInfo dd = {
          .flags = 0,
          .count = 0,
-@@ -4989,7 +4991,7 @@ static int img_dd(int argc, char **argv)
+@@ -4968,7 +4970,7 @@ static int img_dd(int argc, char **argv)
          { 0, 0, 0, 0 }
      };
  
@@ -74,7 +74,7 @@ index c6b4a5567d..041c203fc3 100644
          if (c == EOF) {
              break;
          }
-@@ -5012,6 +5014,19 @@ static int img_dd(int argc, char **argv)
+@@ -4991,6 +4993,19 @@ static int img_dd(int argc, char **argv)
          case 'n':
              skip_create = true;
              break;
@@ -94,7 +94,7 @@ index c6b4a5567d..041c203fc3 100644
          case 'U':
              force_share = true;
              break;
-@@ -5071,11 +5086,24 @@ static int img_dd(int argc, char **argv)
+@@ -5050,11 +5065,24 @@ static int img_dd(int argc, char **argv)
      if (dd.flags & C_IF) {
          blk1 = img_open(image_opts, in.filename, fmt, 0, false, false,
                          force_share);
@@ -120,7 +120,7 @@ index c6b4a5567d..041c203fc3 100644
      }
  
      if (dd.flags & C_OSIZE) {
-@@ -5230,6 +5258,7 @@ static int img_dd(int argc, char **argv)
+@@ -5203,6 +5231,7 @@ static int img_dd(int argc, char **argv)
  out:
      g_free(arg);
      qemu_opts_del(opts);

debian/patches/pve/0051-vma-allow-partial-restore.patch

@@ -24,10 +24,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  3 files changed, 126 insertions(+), 97 deletions(-)
 
 diff --git a/vma-reader.c b/vma-reader.c
-index e65f1e8415..81a891c6b1 100644
+index 4f4ee2b47b..844d95a5ba 100644
 --- a/vma-reader.c
 +++ b/vma-reader.c
-@@ -28,6 +28,7 @@ typedef struct VmaRestoreState {
+@@ -29,6 +29,7 @@ typedef struct VmaRestoreState {
      bool write_zeroes;
      unsigned long *bitmap;
      int bitmap_size;
@@ -35,7 +35,7 @@ index e65f1e8415..81a891c6b1 100644
  }  VmaRestoreState;
  
  struct VmaReader {
-@@ -425,13 +426,14 @@ VmaDeviceInfo *vma_reader_get_device_info(VmaReader *vmar, guint8 dev_id)
+@@ -426,13 +427,14 @@ VmaDeviceInfo *vma_reader_get_device_info(VmaReader *vmar, guint8 dev_id)
  }
  
  static void allocate_rstate(VmaReader *vmar,  guint8 dev_id,
@@ -51,7 +51,7 @@ index e65f1e8415..81a891c6b1 100644
  
      int64_t size = vmar->devinfo[dev_id].size;
  
-@@ -446,28 +448,30 @@ static void allocate_rstate(VmaReader *vmar,  guint8 dev_id,
+@@ -447,28 +449,30 @@ static void allocate_rstate(VmaReader *vmar,  guint8 dev_id,
  }
  
  int vma_reader_register_bs(VmaReader *vmar, guint8 dev_id, BlockBackend *target,
@@ -99,7 +99,7 @@ index e65f1e8415..81a891c6b1 100644
  
      return 0;
  }
-@@ -560,19 +564,23 @@ static int restore_extent(VmaReader *vmar, unsigned char *buf,
+@@ -561,19 +565,23 @@ static int restore_extent(VmaReader *vmar, unsigned char *buf,
          VmaRestoreState *rstate = &vmar->rstate[dev_id];
          BlockBackend *target = NULL;
  
@@ -129,7 +129,7 @@ index e65f1e8415..81a891c6b1 100644
  
              max_sector = vmar->devinfo[dev_id].size/BDRV_SECTOR_SIZE;
          } else {
-@@ -618,7 +626,7 @@ static int restore_extent(VmaReader *vmar, unsigned char *buf,
+@@ -619,7 +627,7 @@ static int restore_extent(VmaReader *vmar, unsigned char *buf,
                  return -1;
              }
  
@@ -138,7 +138,7 @@ index e65f1e8415..81a891c6b1 100644
                  int nb_sectors = end_sector - sector_num;
                  if (restore_write_data(vmar, dev_id, target, vmstate_fd,
                                         buf + start, sector_num, nb_sectors,
-@@ -654,7 +662,7 @@ static int restore_extent(VmaReader *vmar, unsigned char *buf,
+@@ -655,7 +663,7 @@ static int restore_extent(VmaReader *vmar, unsigned char *buf,
                          return -1;
                      }
  
@@ -147,7 +147,7 @@ index e65f1e8415..81a891c6b1 100644
                          int nb_sectors = end_sector - sector_num;
                          if (restore_write_data(vmar, dev_id, target, vmstate_fd,
                                                 buf + start, sector_num,
-@@ -679,7 +687,7 @@ static int restore_extent(VmaReader *vmar, unsigned char *buf,
+@@ -680,7 +688,7 @@ static int restore_extent(VmaReader *vmar, unsigned char *buf,
                              vmar->partial_zero_cluster_data += zero_size;
                          }
  
@@ -156,7 +156,7 @@ index e65f1e8415..81a891c6b1 100644
                              if (restore_write_data(vmar, dev_id, target, vmstate_fd,
                                                     zero_vma_block, sector_num,
                                                     nb_sectors, errp) < 0) {
-@@ -850,7 +858,7 @@ int vma_reader_verify(VmaReader *vmar, bool verbose, Error **errp)
+@@ -851,7 +859,7 @@ int vma_reader_verify(VmaReader *vmar, bool verbose, Error **errp)
  
      for (dev_id = 1; dev_id < 255; dev_id++) {
          if (vma_reader_get_device_info(vmar, dev_id)) {
@@ -166,7 +166,7 @@ index e65f1e8415..81a891c6b1 100644
      }
  
 diff --git a/vma.c b/vma.c
-index e8dffb43e0..e6e9ffc7fe 100644
+index 89440733b1..21e765a469 100644
 --- a/vma.c
 +++ b/vma.c
 @@ -138,6 +138,7 @@ typedef struct RestoreMap {

debian/patches/pve/0052-pbs-namespace-support.patch

@@ -13,7 +13,7 @@ Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
  5 files changed, 47 insertions(+), 9 deletions(-)
 
 diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
-index 4c799f00d9..0502f42be6 100644
+index 52ddbf95ad..69c868887a 100644
 --- a/block/monitor/block-hmp-cmds.c
 +++ b/block/monitor/block-hmp-cmds.c
 @@ -1041,6 +1041,7 @@ void coroutine_fn hmp_backup(Monitor *mon, const QDict *qdict)
@@ -112,10 +112,10 @@ index c5eb4d5bad..7471e2ef9d 100644
  
  static const char *const pbs_strong_runtime_opts[] = {
 diff --git a/pbs-restore.c b/pbs-restore.c
-index 2f834cf42e..f03d9bab8d 100644
+index 4d3f925a1b..62042bdd93 100644
 --- a/pbs-restore.c
 +++ b/pbs-restore.c
-@@ -29,7 +29,7 @@
+@@ -30,7 +30,7 @@
  static void help(void)
  {
      const char *help_msg =
@@ -124,7 +124,7 @@ index 2f834cf42e..f03d9bab8d 100644
          ;
  
      printf("%s", help_msg);
-@@ -77,6 +77,7 @@ int main(int argc, char **argv)
+@@ -78,6 +78,7 @@ int main(int argc, char **argv)
      Error *main_loop_err = NULL;
      const char *format = "raw";
      const char *repository = NULL;
@@ -132,7 +132,7 @@ index 2f834cf42e..f03d9bab8d 100644
      const char *keyfile = NULL;
      int verbose = false;
      bool skip_zero = false;
-@@ -90,6 +91,7 @@ int main(int argc, char **argv)
+@@ -91,6 +92,7 @@ int main(int argc, char **argv)
              {"verbose", no_argument, 0, 'v'},
              {"format", required_argument, 0, 'f'},
              {"repository", required_argument, 0, 'r'},
@@ -140,7 +140,7 @@ index 2f834cf42e..f03d9bab8d 100644
              {"keyfile", required_argument, 0, 'k'},
              {0, 0, 0, 0}
          };
-@@ -110,6 +112,9 @@ int main(int argc, char **argv)
+@@ -111,6 +113,9 @@ int main(int argc, char **argv)
              case 'r':
                  repository = g_strdup(argv[optind - 1]);
                  break;
@@ -150,7 +150,7 @@ index 2f834cf42e..f03d9bab8d 100644
              case 'k':
                  keyfile = g_strdup(argv[optind - 1]);
                  break;
-@@ -160,8 +165,16 @@ int main(int argc, char **argv)
+@@ -161,8 +166,16 @@ int main(int argc, char **argv)
          fprintf(stderr, "connecting to repository '%s'\n", repository);
      }
      char *pbs_error = NULL;
@@ -202,10 +202,10 @@ index 9f6c04a512..f6a5f8c785 100644
              backup_time,
              dump_cb_block_size,
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index fc8a125451..cc2ead0b75 100644
+index d089328a1f..705f0c97ba 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -817,6 +817,8 @@
+@@ -821,6 +821,8 @@
  #
  # @fingerprint: server cert fingerprint (optional for format 'pbs')
  #
@@ -214,7 +214,7 @@ index fc8a125451..cc2ead0b75 100644
  # @backup-id: backup ID (required for format 'pbs')
  #
  # @backup-time: backup timestamp (Unix epoch, required for format 'pbs')
-@@ -836,6 +838,7 @@
+@@ -840,6 +842,7 @@
                                      '*key-password': 'str',
                                      '*master-keyfile': 'str',
                                      '*fingerprint': 'str',
@@ -222,7 +222,7 @@ index fc8a125451..cc2ead0b75 100644
                                      '*backup-id': 'str',
                                      '*backup-time': 'int',
                                      '*use-dirty-bitmap': 'bool',
-@@ -3282,7 +3285,7 @@
+@@ -3236,7 +3239,7 @@
  { 'struct': 'BlockdevOptionsPbs',
    'data': { 'repository': 'str', 'snapshot': 'str', 'archive': 'str',
              '*keyfile': 'str', '*password': 'str', '*fingerprint': 'str',

debian/patches/pve/0053-Revert-block-rbd-implement-bdrv_co_block_status.patch

@@ -23,7 +23,7 @@ Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
  1 file changed, 112 deletions(-)
 
 diff --git a/block/rbd.c b/block/rbd.c
-index 98f4ba2620..efcbbe5949 100644
+index a4b8fb482c..3393b06a4e 100644
 --- a/block/rbd.c
 +++ b/block/rbd.c
 @@ -97,12 +97,6 @@ typedef struct RBDTask {
@@ -39,7 +39,7 @@ index 98f4ba2620..efcbbe5949 100644
  static int qemu_rbd_connect(rados_t *cluster, rados_ioctx_t *io_ctx,
                              BlockdevOptionsRbd *opts, bool cache,
                              const char *keypairs, const char *secretid,
-@@ -1293,111 +1287,6 @@ static ImageInfoSpecific *qemu_rbd_get_specific_info(BlockDriverState *bs,
+@@ -1267,111 +1261,6 @@ static ImageInfoSpecific *qemu_rbd_get_specific_info(BlockDriverState *bs,
      return spec_info;
  }
  
@@ -151,7 +151,7 @@ index 98f4ba2620..efcbbe5949 100644
  static int64_t qemu_rbd_getlength(BlockDriverState *bs)
  {
      BDRVRBDState *s = bs->opaque;
-@@ -1633,7 +1522,6 @@ static BlockDriver bdrv_rbd = {
+@@ -1607,7 +1496,6 @@ static BlockDriver bdrv_rbd = {
  #ifdef LIBRBD_SUPPORTS_WRITE_ZEROES
      .bdrv_co_pwrite_zeroes  = qemu_rbd_co_pwrite_zeroes,
  #endif

debian/patches/pve/0054-Revert-block-rbd-workaround-for-ceph-issue-53784.patch

@@ -1,80 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Fabian Ebner <f.ebner@proxmox.com>
-Date: Thu, 23 Jun 2022 14:00:05 +0200
-Subject: [PATCH] Revert "block/rbd: workaround for ceph issue #53784"
-
-This reverts commit fc176116cdea816ceb8dd969080b2b95f58edbc0 in
-preparation to revert 0347a8fd4c3faaedf119be04c197804be40a384b.
-
-Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
----
- block/rbd.c | 42 ++----------------------------------------
- 1 file changed, 2 insertions(+), 40 deletions(-)
-
-diff --git a/block/rbd.c b/block/rbd.c
-index 64a8d7d48b..9fc6dcb957 100644
---- a/block/rbd.c
-+++ b/block/rbd.c
-@@ -1348,7 +1348,6 @@ static int coroutine_fn qemu_rbd_co_block_status(BlockDriverState *bs,
-     int status, r;
-     RBDDiffIterateReq req = { .offs = offset };
-     uint64_t features, flags;
--    uint64_t head = 0;
- 
-     assert(offset + bytes <= s->image_size);
- 
-@@ -1376,43 +1375,7 @@ static int coroutine_fn qemu_rbd_co_block_status(BlockDriverState *bs,
-         return status;
-     }
- 
--#if LIBRBD_VERSION_CODE < LIBRBD_VERSION(1, 17, 0)
--    /*
--     * librbd had a bug until early 2022 that affected all versions of ceph that
--     * supported fast-diff. This bug results in reporting of incorrect offsets
--     * if the offset parameter to rbd_diff_iterate2 is not object aligned.
--     * Work around this bug by rounding down the offset to object boundaries.
--     * This is OK because we call rbd_diff_iterate2 with whole_object = true.
--     * However, this workaround only works for non cloned images with default
--     * striping.
--     *
--     * See: https://tracker.ceph.com/issues/53784
--     */
--
--    /* check if RBD image has non-default striping enabled */
--    if (features & RBD_FEATURE_STRIPINGV2) {
--        return status;
--    }
--
--#pragma GCC diagnostic push
--#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
--    /*
--     * check if RBD image is a clone (= has a parent).
--     *
--     * rbd_get_parent_info is deprecated from Nautilus onwards, but the
--     * replacement rbd_get_parent is not present in Luminous and Mimic.
--     */
--    if (rbd_get_parent_info(s->image, NULL, 0, NULL, 0, NULL, 0) != -ENOENT) {
--        return status;
--    }
--#pragma GCC diagnostic pop
--
--    head = req.offs & (s->object_size - 1);
--    req.offs -= head;
--    bytes += head;
--#endif
--
--    r = rbd_diff_iterate2(s->image, NULL, req.offs, bytes, true, true,
-+    r = rbd_diff_iterate2(s->image, NULL, offset, bytes, true, true,
-                           qemu_rbd_diff_iterate_cb, &req);
-     if (r < 0 && r != QEMU_RBD_EXIT_DIFF_ITERATE2) {
-         return status;
-@@ -1431,8 +1394,7 @@ static int coroutine_fn qemu_rbd_co_block_status(BlockDriverState *bs,
-         status = BDRV_BLOCK_ZERO | BDRV_BLOCK_OFFSET_VALID;
-     }
- 
--    assert(req.bytes > head);
--    *pnum = req.bytes - head;
-+    *pnum = req.bytes;
-     return status;
- }
- 

debian/patches/pve/0055-Revert-block-rbd-fix-handling-of-holes-in-.bdrv_co_b.patch

@@ -1,35 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Fabian Ebner <f.ebner@proxmox.com>
-Date: Thu, 23 Jun 2022 14:00:07 +0200
-Subject: [PATCH] Revert "block/rbd: fix handling of holes in
- .bdrv_co_block_status"
-
-This reverts commit 9e302f64bb407a9bb097b626da97228c2654cfee in
-preparation to revert 0347a8fd4c3faaedf119be04c197804be40a384b.
-
-Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
----
- block/rbd.c | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/block/rbd.c b/block/rbd.c
-index 9fc6dcb957..98f4ba2620 100644
---- a/block/rbd.c
-+++ b/block/rbd.c
-@@ -1307,11 +1307,11 @@ static int qemu_rbd_diff_iterate_cb(uint64_t offs, size_t len,
-     RBDDiffIterateReq *req = opaque;
- 
-     assert(req->offs + req->bytes <= offs);
--
--    /* treat a hole like an unallocated area and bail out */
--    if (!exists) {
--        return 0;
--    }
-+    /*
-+     * we do not diff against a snapshot so we should never receive a callback
-+     * for a hole.
-+     */
-+    assert(exists);
- 
-     if (!req->exists && offs > req->offs) {
-         /*

debian/patches/pve/0057-vma-create-support-64KiB-unaligned-input-images.patch

@@ -25,7 +25,7 @@ Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
  1 file changed, 10 insertions(+), 2 deletions(-)
 
 diff --git a/vma.c b/vma.c
-index e6e9ffc7fe..304f02bc84 100644
+index 21e765a469..6d02b29047 100644
 --- a/vma.c
 +++ b/vma.c
 @@ -548,7 +548,7 @@ static void coroutine_fn backup_run(void *opaque)

debian/patches/pve/0058-vma-create-avoid-triggering-assertion-in-error-case.patch

@@ -11,10 +11,10 @@ Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
  1 file changed, 2 insertions(+)
 
 diff --git a/vma-writer.c b/vma-writer.c
-index df4b20793d..ac7da237d0 100644
+index 11d8321ffd..29567cba68 100644
 --- a/vma-writer.c
 +++ b/vma-writer.c
-@@ -311,6 +311,8 @@ VmaWriter *vma_writer_create(const char *filename, uuid_t uuid, Error **errp)
+@@ -310,6 +310,8 @@ VmaWriter *vma_writer_create(const char *filename, uuid_t uuid, Error **errp)
          }
  
          if (vmaw->fd < 0) {

debian/patches/pve/0063-PVE-Backup-allow-passing-max-workers-performance-set.patch

@@ -1,144 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Fiona Ebner <f.ebner@proxmox.com>
-Date: Mon, 3 Oct 2022 15:52:04 +0200
-Subject: [PATCH] PVE Backup: allow passing max-workers performance setting
-
-For query-proxmox-support, add an indication that it's possible to use
-the setting.
-
-For now, the other two BackupPerf settings are not exposed:
-
-* use-copy-range: would need to be implemented by the backup-dump
-block driver first, and in fact, the default for backup was changed,
-because it wasn't as fast for backup in QEMU, see commit
-6a30f663d4c0b3c45a544d541e0c4e214b2473a1.
-
-* max-chunk: enforced to be at least the backup cluster size, which is
-4 MiB for PBS and otherwise maximum of source and target cluster size.
-And block-copy has a maximum buffer size of 1 MiB, so setting a larger
-max-chunk doesn't even have an effect. To make the setting sensibly
-usable the check would need to be removed and optionally the
-block-copy max buffer size would need to be bumped. I tried doing just
-that, and tested different source/target combinations with different
-max-chunk settings, but there were no noticable improvements over the
-default "unlimited" (resulting in 1 MiB for block-copy).
-
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- block/monitor/block-hmp-cmds.c |  4 +++-
- pve-backup.c                   | 18 +++++++++++++-----
- qapi/block-core.json           |  9 +++++++--
- 3 files changed, 23 insertions(+), 8 deletions(-)
-
-diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
-index 0502f42be6..cc231ec3f2 100644
---- a/block/monitor/block-hmp-cmds.c
-+++ b/block/monitor/block-hmp-cmds.c
-@@ -1049,7 +1049,9 @@ void coroutine_fn hmp_backup(Monitor *mon, const QDict *qdict)
-         false, false, // PBS encrypt
-         true, dir ? BACKUP_FORMAT_DIR : BACKUP_FORMAT_VMA,
-         false, NULL, false, NULL, !!devlist,
--        devlist, qdict_haskey(qdict, "speed"), speed, &error);
-+        devlist, qdict_haskey(qdict, "speed"), speed,
-+        false, 0, // BackupPerf max-workers
-+        &error);
- 
-     hmp_handle_error(mon, error);
- }
-diff --git a/pve-backup.c b/pve-backup.c
-index 2e22030eec..e9aa7e0f49 100644
---- a/pve-backup.c
-+++ b/pve-backup.c
-@@ -55,6 +55,7 @@ static struct PVEBackupState {
-         bool starting;
-     } stat;
-     int64_t speed;
-+    BackupPerf perf;
-     VmaWriter *vmaw;
-     ProxmoxBackupHandle *pbs;
-     GList *di_list;
-@@ -492,8 +493,6 @@ static void create_backup_jobs_bh(void *opaque) {
-     }
-     backup_state.txn = job_txn_new_seq();
- 
--    BackupPerf perf = { .max_workers = 16 };
--
-     /* create and start all jobs (paused state) */
-     GList *l =  backup_state.di_list;
-     while (l) {
-@@ -513,8 +512,9 @@ static void create_backup_jobs_bh(void *opaque) {
- 
-         BlockJob *job = backup_job_create(
-             NULL, di->bs, di->target, backup_state.speed, sync_mode, di->bitmap,
--            bitmap_mode, false, NULL, &perf, BLOCKDEV_ON_ERROR_REPORT, BLOCKDEV_ON_ERROR_REPORT,
--            JOB_DEFAULT, pvebackup_complete_cb, di, backup_state.txn, &local_err);
-+            bitmap_mode, false, NULL, &backup_state.perf, BLOCKDEV_ON_ERROR_REPORT,
-+            BLOCKDEV_ON_ERROR_REPORT, JOB_DEFAULT, pvebackup_complete_cb, di, backup_state.txn,
-+            &local_err);
- 
-         di->job = job;
-         if (job) {
-@@ -584,7 +584,9 @@ UuidInfo coroutine_fn *qmp_backup(
-     bool has_config_file, const char *config_file,
-     bool has_firewall_file, const char *firewall_file,
-     bool has_devlist, const char *devlist,
--    bool has_speed, int64_t speed, Error **errp)
-+    bool has_speed, int64_t speed,
-+    bool has_max_workers, int64_t max_workers,
-+    Error **errp)
- {
-     assert(qemu_in_coroutine());
- 
-@@ -914,6 +916,11 @@ UuidInfo coroutine_fn *qmp_backup(
- 
-     backup_state.speed = (has_speed && speed > 0) ? speed : 0;
- 
-+    backup_state.perf = (BackupPerf){ .max_workers = 16 };
-+    if (has_max_workers) {
-+        backup_state.perf.max_workers = max_workers;
-+    }
-+
-     backup_state.vmaw = vmaw;
-     backup_state.pbs = pbs;
- 
-@@ -1089,5 +1096,6 @@ ProxmoxSupportStatus *qmp_query_proxmox_support(Error **errp)
-     ret->pbs_dirty_bitmap_migration = true;
-     ret->query_bitmap_info = true;
-     ret->pbs_masterkey = true;
-+    ret->backup_max_workers = true;
-     return ret;
- }
-diff --git a/qapi/block-core.json b/qapi/block-core.json
-index cc2ead0b75..e3f62faa81 100644
---- a/qapi/block-core.json
-+++ b/qapi/block-core.json
-@@ -829,6 +829,8 @@
- #
- # @encrypt: use encryption ((optional for format 'pbs', defaults to true if there is a keyfile)
- #
-+# @max-workers: see @BackupPerf for details. Default 16.
-+#
- # Returns: the uuid of the backup job
- #
- ##
-@@ -847,7 +849,9 @@
-                                     '*format': 'BackupFormat',
-                                     '*config-file': 'str',
-                                     '*firewall-file': 'str',
--                                    '*devlist': 'str', '*speed': 'int' },
-+                                    '*devlist': 'str',
-+                                    '*speed': 'int',
-+                                    '*max-workers': 'int' },
-   'returns': 'UuidInfo', 'coroutine': true }
- 
- ##
-@@ -902,7 +906,8 @@
-             'pbs-dirty-bitmap-savevm': 'bool',
-             'pbs-dirty-bitmap-migration': 'bool',
-             'pbs-masterkey': 'bool',
--            'pbs-library-version': 'str' } }
-+            'pbs-library-version': 'str',
-+            'backup-max-workers': 'bool' } }
- 
- ##
- # @query-proxmox-support:

debian/patches/series

@@ -1,9 +1,22 @@
 extra/0001-monitor-qmp-fix-race-with-clients-disconnecting-earl.patch
-extra/0002-block-io_uring-revert-Use-io_uring_register_ring_fd-.patch
-extra/0003-virtiofsd-use-g_date_time_get_microsecond-to-get-sub.patch
-extra/0004-chardev-fix-segfault-in-finalize.patch
-extra/0005-init-daemonize-defuse-PID-file-resolve-error.patch
-extra/0006-block-block-backend-blk_set_enable_write_cache-is-IO.patch
+extra/0002-monitor-hmp-add-support-for-flag-argument-with-value.patch
+extra/0003-monitor-refactor-set-expire_password-and-allow-VNC-d.patch
+extra/0006-block-io-Update-BSC-only-if-want_zero-is-true.patch
+extra/0007-block-nbd-Delete-reconnect-delay-timer-when-done.patch
+extra/0008-block-nbd-Assert-there-are-no-timers-when-closed.patch
+extra/0009-block-nbd-Move-s-ioc-on-AioContext-change.patch
+extra/0010-acpi-fix-QEMU-crash-when-started-with-SLIC-table.patch
+extra/0011-virtio-net-fix-map-leaking-on-error-during-receive.patch
+extra/0012-memory-Fix-incorrect-calls-of-log_global_start-stop.patch
+extra/0013-acpi-fix-OEM-ID-OEM-Table-ID-padding.patch
+extra/0014-vhost-vsock-detach-the-virqueue-element-in-case-of-e.patch
+extra/0015-vhost-user-remove-VirtQ-notifier-restore.patch
+extra/0016-vhost-user-fix-VirtQ-notifier-cleanup.patch
+extra/0017-virtio-fix-the-condition-for-iommu_platform-not-supp.patch
+extra/0018-block-gluster-correctly-set-max_pdiscard-which-is-in.patch
+extra/0019-ui-vnc.c-Fixed-a-deadlock-bug.patch
+extra/0020-display-qxl-render-fix-race-condition-in-qxl_cursor-.patch
+extra/0021-ui-cursor-fix-integer-overflow-in-cursor_alloc-CVE-2.patch
 bitmap-mirror/0001-drive-mirror-add-support-for-sync-bitmap-mode-never.patch
 bitmap-mirror/0002-drive-mirror-add-support-for-conditional-and-always-.patch
 bitmap-mirror/0003-mirror-add-check-for-bitmap-mode-without-bitmap.patch
@@ -25,52 +38,48 @@ pve/0012-PVE-Up-qemu-img-dd-add-n-skip_create.patch
 pve/0013-PVE-virtio-balloon-improve-query-balloon.patch
 pve/0014-PVE-qapi-modify-query-machines.patch
 pve/0015-PVE-qapi-modify-spice-query.patch
-pve/0016-PVE-add-IOChannel-implementation-for-savevm-async.patch
-pve/0017-PVE-add-savevm-async-for-background-state-snapshots.patch
-pve/0018-PVE-add-optional-buffer-size-to-QEMUFile.patch
-pve/0019-PVE-block-add-the-zeroinit-block-driver-filter.patch
-pve/0020-PVE-Add-dummy-id-command-line-parameter.patch
-pve/0021-PVE-Config-Revert-target-i386-disable-LINT0-after-re.patch
-pve/0022-PVE-Up-Config-file-posix-make-locking-optiono-on-cre.patch
-pve/0023-PVE-monitor-disable-oob-capability.patch
-pve/0024-PVE-Compat-4.0-used-balloon-qemu-4-0-config-size-fal.patch
-pve/0025-PVE-Allow-version-code-in-machine-type.patch
-pve/0026-block-backup-move-bcs-bitmap-initialization-to-job-c.patch
-pve/0027-PVE-Backup-add-vma-backup-format-code.patch
-pve/0028-PVE-Backup-add-backup-dump-block-driver.patch
-pve/0029-PVE-Backup-proxmox-backup-patches-for-qemu.patch
-pve/0030-PVE-Backup-pbs-restore-new-command-to-restore-from-p.patch
-pve/0031-PVE-Backup-Add-dirty-bitmap-tracking-for-incremental.patch
-pve/0032-PVE-various-PBS-fixes.patch
-pve/0033-PVE-Add-PBS-block-driver-to-map-backup-archives-into.patch
-pve/0034-PVE-add-query_proxmox_support-QMP-command.patch
-pve/0035-PVE-add-query-pbs-bitmap-info-QMP-call.patch
-pve/0036-PVE-redirect-stderr-to-journal-when-daemonized.patch
-pve/0037-PVE-Add-sequential-job-transaction-support.patch
-pve/0038-PVE-Backup-Use-a-transaction-to-synchronize-job-stat.patch
-pve/0039-PVE-Backup-Don-t-block-on-finishing-and-cleanup-crea.patch
-pve/0040-PVE-Migrate-dirty-bitmap-state-via-savevm.patch
-pve/0041-migration-block-dirty-bitmap-migrate-other-bitmaps-e.patch
-pve/0042-PVE-fall-back-to-open-iscsi-initiatorname.patch
-pve/0043-PVE-Use-coroutine-QMP-for-backup-cancel_backup.patch
-pve/0044-PBS-add-master-key-support.patch
-pve/0045-PVE-block-pbs-fast-path-reads-without-allocation-if-.patch
-pve/0046-PVE-block-stream-increase-chunk-size.patch
-pve/0047-block-io-accept-NULL-qiov-in-bdrv_pad_request.patch
-pve/0048-block-add-alloc-track-driver.patch
-pve/0049-PVE-whitelist-invalid-QAPI-names-for-backwards-compa.patch
-pve/0050-PVE-savevm-async-register-yank-before-migration_inco.patch
-pve/0051-qemu-img-dd-add-l-option-for-loading-a-snapshot.patch
-pve/0052-vma-allow-partial-restore.patch
-pve/0053-pbs-namespace-support.patch
-pve/0054-Revert-block-rbd-workaround-for-ceph-issue-53784.patch
-pve/0055-Revert-block-rbd-fix-handling-of-holes-in-.bdrv_co_b.patch
-pve/0056-Revert-block-rbd-implement-bdrv_co_block_status.patch
-pve/0057-PVE-Backup-create-jobs-correctly-cancel-in-error-sce.patch
-pve/0058-PVE-Backup-ensure-jobs-in-di_list-are-referenced.patch
-pve/0059-PVE-Backup-avoid-segfault-issues-upon-backup-cancel.patch
-pve/0060-vma-create-support-64KiB-unaligned-input-images.patch
-pve/0061-vma-create-avoid-triggering-assertion-in-error-case.patch
-pve/0062-block-alloc-track-avoid-premature-break.patch
-pve/0063-PVE-Backup-allow-passing-max-workers-performance-set.patch
-pve-qemu-7.1-vitastor.patch
+pve/0016-PVE-add-savevm-async-for-background-state-snapshots.patch
+pve/0017-PVE-add-optional-buffer-size-to-QEMUFile.patch
+pve/0018-PVE-block-add-the-zeroinit-block-driver-filter.patch
+pve/0019-PVE-Add-dummy-id-command-line-parameter.patch
+pve/0020-PVE-Config-Revert-target-i386-disable-LINT0-after-re.patch
+pve/0021-PVE-Up-Config-file-posix-make-locking-optiono-on-cre.patch
+pve/0022-PVE-monitor-disable-oob-capability.patch
+pve/0023-PVE-Compat-4.0-used-balloon-qemu-4-0-config-size-fal.patch
+pve/0024-PVE-Allow-version-code-in-machine-type.patch
+pve/0025-block-backup-move-bcs-bitmap-initialization-to-job-c.patch
+pve/0026-PVE-Backup-add-vma-backup-format-code.patch
+pve/0027-PVE-Backup-add-backup-dump-block-driver.patch
+pve/0028-PVE-Backup-proxmox-backup-patches-for-qemu.patch
+pve/0029-PVE-Backup-pbs-restore-new-command-to-restore-from-p.patch
+pve/0030-PVE-Backup-Add-dirty-bitmap-tracking-for-incremental.patch
+pve/0031-PVE-various-PBS-fixes.patch
+pve/0032-PVE-Add-PBS-block-driver-to-map-backup-archives-into.patch
+pve/0033-PVE-add-query_proxmox_support-QMP-command.patch
+pve/0034-PVE-add-query-pbs-bitmap-info-QMP-call.patch
+pve/0035-PVE-redirect-stderr-to-journal-when-daemonized.patch
+pve/0036-PVE-Add-sequential-job-transaction-support.patch
+pve/0037-PVE-Backup-Use-a-transaction-to-synchronize-job-stat.patch
+pve/0038-PVE-Backup-Don-t-block-on-finishing-and-cleanup-crea.patch
+pve/0039-PVE-Migrate-dirty-bitmap-state-via-savevm.patch
+pve/0040-migration-block-dirty-bitmap-migrate-other-bitmaps-e.patch
+pve/0041-PVE-fall-back-to-open-iscsi-initiatorname.patch
+pve/0042-PVE-Use-coroutine-QMP-for-backup-cancel_backup.patch
+pve/0043-PBS-add-master-key-support.patch
+pve/0044-PVE-block-pbs-fast-path-reads-without-allocation-if-.patch
+pve/0045-PVE-block-stream-increase-chunk-size.patch
+pve/0046-block-io-accept-NULL-qiov-in-bdrv_pad_request.patch
+pve/0047-block-add-alloc-track-driver.patch
+pve/0048-PVE-whitelist-invalid-QAPI-names-for-backwards-compa.patch
+pve/0049-PVE-savevm-async-register-yank-before-migration_inco.patch
+pve/0050-qemu-img-dd-add-l-option-for-loading-a-snapshot.patch
+pve/0051-vma-allow-partial-restore.patch
+pve/0052-pbs-namespace-support.patch
+pve/0053-Revert-block-rbd-implement-bdrv_co_block_status.patch
+pve/0054-PVE-Backup-create-jobs-correctly-cancel-in-error-sce.patch
+pve/0055-PVE-Backup-ensure-jobs-in-di_list-are-referenced.patch
+pve/0056-PVE-Backup-avoid-segfault-issues-upon-backup-cancel.patch
+pve/0057-vma-create-support-64KiB-unaligned-input-images.patch
+pve/0058-vma-create-avoid-triggering-assertion-in-error-case.patch
+pve/0059-block-alloc-track-avoid-premature-break.patch
+pve-qemu-6.2-vitastor.patch

debian/rules

@@ -48,7 +48,7 @@ ${BUILDDIR}/config.status: configure
 	--sysconfdir=/etc \
 	--target-list=$(ARCH)-softmmu,aarch64-softmmu \
 	--with-suffix="kvm" \
-	--with-pkgversion="${DEB_SOURCE}_${DEB_VERSION_UPSTREAM_REVISION}" \
+	--with-pkgversion="${DEB_SOURCE}_${DEB_VERSION_UPSTREAM}" \
 	--audio-drv-list="alsa" \
 	--datadir=/usr/share \
 	--libexecdir=/usr/lib/kvm \
@@ -58,6 +58,7 @@ ${BUILDDIR}/config.status: configure
 	--disable-guest-agent-msi \
 	--disable-libnfs \
 	--disable-libssh \
+	--disable-libxml2 \
 	--disable-sdl \
 	--disable-smartcard \
 	--disable-strip \
@@ -79,6 +80,7 @@ ${BUILDDIR}/config.status: configure
 	--enable-virglrenderer \
 	--enable-virtfs \
 	--enable-virtiofsd \
+	--enable-xfsctl \
 	--enable-zstd
 
 build: build-stamp
@@ -132,8 +134,8 @@ install: build
 	# remove Alpha files
 	rm $(destdir)/usr/share/kvm/palcode-clipper
 	# remove RISC-V files
-	rm $(destdir)/usr/share/kvm/opensbi-riscv32-generic-fw_dynamic.bin
-	rm $(destdir)/usr/share/kvm/opensbi-riscv64-generic-fw_dynamic.bin
+	rm $(destdir)/usr/share/kvm/opensbi-riscv32-generic-fw_dynamic.elf
+	rm $(destdir)/usr/share/kvm/opensbi-riscv64-generic-fw_dynamic.elf
 
 	# Remove things we don't package at all, would be a "kvm-dev" package
 	rm -Rf $(destdir)/usr/include/linux/