Fix truncation, add write-back cache support

Improve performance by adding io_uring support, fix iothread compat
Add bdrv_co_block_status
2023-10-27 21:05:44 +03:00 · 2023-07-19 02:27:08 +03:00 · 2023-07-18 18:26:09 +03:00 · 2022-12-15 19:32:46 +03:00
101 changed files with 5755 additions and 3034 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -1,7 +0,0 @@
 /*.build
 /*.buildinfo
 /*.changes
 /*.deb
 /*.dsc
 /*.tar*
 /pve-qemu-kvm-*.*/
--- a/68
+++ b/68
@@ -1,78 +1,41 @@
-include /usr/share/dpkg/default.mk
+include /usr/share/dpkg/pkg-info.mk
 include /usr/share/dpkg/architecture.mk
 PACKAGE = pve-qemu-kvm
 SRCDIR := qemu
-BUILDDIR ?= $(PACKAGE)-$(DEB_VERSION_UPSTREAM)
+BUILDDIR ?= ${PACKAGE}-${DEB_VERSION_UPSTREAM}
 ORIG_SRC_TAR=$(PACKAGE)_$(DEB_VERSION_UPSTREAM).orig.tar.gz
 GITVERSION := $(shell git rev-parse HEAD)
-DSC=$(PACKAGE)_$(DEB_VERSION_UPSTREAM_REVISION).dsc
+DEB = ${PACKAGE}_${DEB_VERSION_UPSTREAM_REVISION}_${DEB_BUILD_ARCH}.deb
-DEB = $(PACKAGE)_$(DEB_VERSION_UPSTREAM_REVISION)_$(DEB_BUILD_ARCH).deb
+DEB_DBG = ${PACKAGE}-dbg_${DEB_VERSION_UPSTREAM_REVISION}_${DEB_BUILD_ARCH}.deb
 DEB_DBG = $(PACKAGE)-dbgsym_$(DEB_VERSION_UPSTREAM_REVISION)_$(DEB_BUILD_ARCH).deb
 DEBS = $(DEB) $(DEB_DBG)
 all: $(DEBS)
 .PHONY: submodule
 submodule:
-	test -f "$(SRCDIR)/configure" || git submodule update --init --recursive
+	test -f "${SRCDIR}/configure" || git submodule update --init --recursive
 PC_BIOS_FW_PURGE_LIST_IN = \
 	hppa-firmware.img \
 	openbios-ppc \
 	openbios-sparc32 \
 	openbios-sparc64 \
 	palcode-clipper \
 	s390-ccw.img \
 	s390-netboot.img \
 	u-boot.e500 \
 	.*\.dtb \
 	qemu_vga.ndrv \
 	slof.bin \
 	opensbi-riscv.*-generic-fw_dynamic.bin \
 BLOB_PURGE_SED_CMDS = $(foreach FILE,$(PC_BIOS_FW_PURGE_LIST_IN),-e "/$(FILE)/d")
 BLOB_PURGE_FILTER = $(foreach FILE,$(PC_BIOS_FW_PURGE_LIST_IN),-e "$(FILE)")
 $(BUILDDIR): keycodemapdb | submodule
 	# check if qemu/ was used for a build
 	# if so, please run 'make distclean' in the submodule and try again
 	test ! -f $(SRCDIR)/build/config.status
-	rm -rf $@.tmp $@
+	rm -rf $(BUILDDIR)
-	cp -a $(SRCDIR) $@.tmp
+	cp -a $(SRCDIR) $(BUILDDIR)
-	cp -a debian $@.tmp/debian
+	cp -a debian $(BUILDDIR)/debian
-	rm -rf $@.tmp/ui/keycodemapdb
+	rm -rf $(BUILDDIR)/ui/keycodemapdb
-	rm -rf $@.tmp/roms/edk2 # packaged separately
+	cp -a keycodemapdb $(BUILDDIR)/ui/
-	cp -a keycodemapdb $@.tmp/ui/
+	echo "git clone git://git.proxmox.com/git/pve-qemu.git\\ngit checkout $(GITVERSION)" > $(BUILDDIR)/debian/SOURCE
 	find $@.tmp/pc-bios -type f | grep $(BLOB_PURGE_FILTER) | xargs rm -f
 	sed -i $(BLOB_PURGE_SED_CMDS) $@.tmp/pc-bios/meson.build
 	echo "git clone git://git.proxmox.com/git/pve-qemu.git\\ngit checkout $(GITVERSION)" > $@.tmp/debian/SOURCE
 	mv $@.tmp $@
 .PHONY: deb kvm
 deb kvm: $(DEBS)
 $(DEB_DBG): $(DEB)
 $(DEB): $(BUILDDIR)
-	cd $(BUILDDIR); dpkg-buildpackage -b -us -uc -j32
+	cd $(BUILDDIR); dpkg-buildpackage -b -us -uc -j8
 	lintian $(DEBS)
 sbuild: $(DSC)
 	sbuild $(DSC)
 $(ORIG_SRC_TAR): $(BUILDDIR)
 	tar czf $(ORIG_SRC_TAR) --exclude="$(BUILDDIR)/debian" $(BUILDDIR)
 .PHONY: dsc
 dsc:
 	rm -rf *.dsc $(BUILDDIR)
 	$(MAKE) $(DSC)
 	lintian $(DSC)
 $(DSC): $(ORIG_SRC_TAR) $(BUILDDIR)
 	cd $(BUILDDIR); dpkg-buildpackage -S -us -uc -d
 .PHONY: update
 update:
 	cd $(SRCDIR) && git submodule deinit ui/keycodemapdb || true
@@ -85,14 +48,13 @@ update:
 	git add keycodemapdb
 .PHONY: upload
 upload: UPLOAD_DIST ?= $(DEB_DISTRIBUTION)
 upload: $(DEBS)
-	tar cf - $(DEBS) | ssh repoman@repo.proxmox.com upload --product pve --dist $(UPLOAD_DIST)
+	tar cf - ${DEBS} | ssh repoman@repo.proxmox.com upload --product pve --dist bullseye
 .PHONY: distclean clean
 distclean: clean
 clean:
-	rm -rf $(PACKAGE)-[0-9]*/ $(PACKAGE)*.tar* *.deb *.dsc *.build *.buildinfo *.changes
+	rm -rf $(BUILDDIR) $(PACKAGE)*.deb *.buildinfo *.changes
 .PHONY: dinstall
 dinstall: $(DEBS)
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,170 +1,28 @@
-pve-qemu-kvm (8.0.2-7+vitastor1) bookworm; urgency=medium
+pve-qemu-kvm (7.1.0-4+vitastor5) bullseye; urgency=medium
  * Fix truncation
  * Add write-back cache support
 -- Vitaliy Filippov <vitalif@yourcmc.ru>  Fri, 27 Oct 2023 21:04:05 +0300
 pve-qemu-kvm (7.1.0-4+vitastor4) bullseye; urgency=medium
  * Improve performance by adding io_uring support
  * Fix compatibility with iothread
 -- Vitaliy Filippov <vitalif@yourcmc.ru>  Tue, 18 Jul 2023 02:22:28 +0300
 pve-qemu-kvm (7.1.0-4+vitastor3) bullseye; urgency=medium
  * Add bdrv_co_block_status implementation for QCOW2 export support
 -- Vitaliy Filippov <vitalif@yourcmc.ru>  Thu, 12 Jan 2023 02:31:18 +0300
 pve-qemu-kvm (7.1.0-4+vitastor2) bullseye; urgency=medium
  * Add Vitastor support
- -- Vitaliy Filippov <vitalif@yourcmc.ru>  Fri, 27 Oct 2023 17:27:01 +0300
+ -- Vitaliy Filippov <vitalif@yourcmc.ru>  Thu, 15 Dec 2022 19:32:28 +0300
 pve-qemu-kvm (8.0.2-7) bookworm; urgency=medium
  * fix #2874: SATA: avoid unsolicited write to sector 0 during reset
 -- Proxmox Support Team <support@proxmox.com>  Wed, 04 Oct 2023 08:33:35 +0200
 pve-qemu-kvm (8.0.2-6) bookworm; urgency=medium
  * fix #1534: vma: add extract-filter for disk images allowing users to pass
    a comma separated list of the disks they want to extract from an archive.
  * backup: create jobs in a drained section to avoid subtle bugs where
    something interferes with the block-copy-state bitmap on initialization
  * backup: drop experimental, and since a while also fully broken, directory
    backup format (BACKUP_FORMAT_DIR). This format was never exposed via the
    Proxmox VE API, but only available via QMP, as its broken since QEMU 8 and
    we got zero reports about that, it's safe to assume that there are no
    public users, so just remove it completely.
 -- Proxmox Support Team <support@proxmox.com>  Wed, 06 Sep 2023 17:03:59 +0200
 pve-qemu-kvm (8.0.2-5) bookworm; urgency=medium
  * improve memory footprint after backup by not keeping as much memory
    resident.
  * fix file descriptor leak for vhost (used by default by vNICs).
 -- Proxmox Support Team <support@proxmox.com>  Wed, 16 Aug 2023 11:52:24 +0200
 pve-qemu-kvm (8.0.2-4) bookworm; urgency=medium
  * fix resume for snapshot and hibernate in combination with iothread and
    dirty bitmap
 -- Proxmox Support Team <support@proxmox.com>  Fri, 28 Jul 2023 12:58:22 +0200
 pve-qemu-kvm (8.0.2-3) bookworm; urgency=medium
  * fix regression in QEMU 8.0 for drive mirror with bitmap
 -- Proxmox Support Team <support@proxmox.com>  Thu, 15 Jun 2023 13:57:46 +0200
 pve-qemu-kvm (8.0.2-2) bookworm; urgency=medium
  * drop custom get_link_status QMP command, was never really used.
  * drop custom & deprecated drive snapshot QMP commands, we use a better
    alternative since a while.
 -- Proxmox Support Team <support@proxmox.com>  Fri, 09 Jun 2023 07:57:56 +0200
 pve-qemu-kvm (8.0.2-1) bookworm; urgency=medium
  * update to QEMU stable release 8.0.2
  * update patches for avoiding issues with DMA reentrancy to current,
    slightly optimized version.
 -- Proxmox Support Team <support@proxmox.com>  Tue, 06 Jun 2023 16:34:50 +0200
 pve-qemu-kvm (8.0.0-1) bookworm; urgency=medium
  * update to QEMU stable release 8.0.0
  * re-build for Proxmox VE 8 / Debian 12 Bookworm
  * adapt to the local virtiofsd C variant being dropped, it has been
    rewritten in Rust and is now hosted in a separate source repository.
 -- Proxmox Support Team <support@proxmox.com>  Mon, 22 May 2023 13:45:49 +0200
 pve-qemu-kvm (7.2.0-8) bullseye; urgency=medium
  * backport fix for ACPI CPU hotplug issue with TCG
  * cherry-pick TCG-related stable fixes for 7.2 for users that turned off KVM
    HW acceleration
 -- Proxmox Support Team <support@proxmox.com>  Fri, 17 Mar 2023 15:47:08 +0100
 pve-qemu-kvm (7.2.0-7) bullseye; urgency=medium
  * improve fix for potential deadlock with trim for IDE/SATA and draining
  * backport stable fixes:
    - hw/nvme: fix missing endian conversions for doorbell buffers
    - hw/smbios: fix field corruption in type 4 table
    - virtio-rng-pci: fix transitional migration compat for vectors
    - hw/timer/hpet: Fix expiration time overflow
    - vhost/vdpa: stop all svq on device deletion
    - vhost: avoid a potential use of an uninitialized variable in the call to
      vhost_svq_poll
    - chardev/char-socket: set s->listener = NULL in char_socket_finalize to
      fix a potential crash after live-migration
    - intel-iommu: fail MAP notifier without caching mode
    - intel-iommu: fail DEVIOTLB_UNMAP without dt mode
  * fix a regression for when the LSI SCSI controller is used
 -- Proxmox Support Team <support@proxmox.com>  Mon, 13 Mar 2023 17:42:49 +0100
 pve-qemu-kvm (7.2.0-6) bullseye; urgency=medium
  * fix 7.2 regression for Linux boot failures with megasas SCSI
  * fix 7.0 regression for a potential deadlock with trim for IDE/SATA and
    draining
 -- Proxmox Support Team <support@proxmox.com>  Wed, 08 Mar 2023 14:32:17 +0100
 pve-qemu-kvm (7.2.0-5) bullseye; urgency=medium
  * fix #4476: savevm-async: avoid looping without progress
  * savevm-async: decrease the boundary for free space for (memory) state left
    on target from 30 MiB to 100 MiB, improving the heuristic for when to
    enter the final "pause and sync" stage.
  * QMP backup: use correct error number when getting blockdrive length fails
  * backport fix for some DMA reentrancy issues, better protecting against
    malicious guests
  * backport fix for iSCSI double free issue leading to crashes
 -- Proxmox Support Team <support@proxmox.com>  Tue, 21 Feb 2023 13:49:43 +0100
 pve-qemu-kvm (7.2.0-4) bullseye; urgency=medium
  * backport fix for a 7.2 regression when using VirtIO disk with
    detect-zeroes=unmap
 -- Proxmox Support Team <support@proxmox.com>  Fri, 27 Jan 2023 09:37:49 +0100
 pve-qemu-kvm (7.2.0-3) bullseye; urgency=medium
  * add fix for live-migration with virtio-rng devices, which regressed in
    QEMU 7.2.0.
 -- Proxmox Support Team <support@proxmox.com>  Thu, 12 Jan 2023 13:13:14 +0100
 pve-qemu-kvm (7.2.0-2) bullseye; urgency=medium
  * enable slirp again for now, as in qemu-server, user networking is
    supported (via CLI/API) when no bridge is set on a virtual NIC
  * cherry-pick stable fixes for 7.2. Two for virtio-mem and one for vIOMMU.
    Both features are not yet exposed in PVE's qemu-server, but there's work
    going on to change that.
 -- Proxmox Support Team <support@proxmox.com>  Tue, 10 Jan 2023 15:47:48 +0100
 pve-qemu-kvm (7.2.0-1) bullseye; urgency=medium
  * update to QEMU stable release 7.2.0
  * drop 'slirp' networking
 -- Proxmox Support Team <support@proxmox.com>  Fri, 16 Dec 2022 13:18:21 +0100
 pve-qemu-kvm (7.1.0-4) bullseye; urgency=medium
--- a/debian/compat
+++ b/debian/compat
@@ -0,0 +1 @@
 10
--- a/debian/control
+++ b/debian/control
@@ -2,8 +2,9 @@ Source: pve-qemu-kvm
 Section: admin
 Priority: optional
 Maintainer: Proxmox Support Team <support@proxmox.com>
-Build-Depends: debhelper-compat (= 13),
+Build-Depends: autotools-dev,
               check,
               debhelper (>= 9),
               libacl1-dev,
               libaio-dev,
               libattr1-dev,
@@ -15,21 +16,21 @@ Build-Depends: debhelper-compat (= 13),
               libglusterfs-dev (>= 5.2-2),
               libgnutls28-dev,
               libiscsi-dev (>= 1.12.0),
               libjemalloc-dev,
               libjpeg-dev,
               libjson-perl,
               libnuma-dev,
               libpci-dev,
               libpixman-1-dev,
-               libproxmox-backup-qemu0-dev (>= 1.3.0),
+               libproxmox-backup-qemu0-dev (>= 1.3.0-1),
               librbd-dev (>= 0.48),
               libsdl1.2-dev,
               libseccomp-dev,
               libslirp-dev,
               libspice-protocol-dev (>= 0.12.14~),
               libspice-server-dev (>= 0.14.0~),
               libsystemd-dev,
               liburing-dev,
-               libusb-1.0-0-dev (>= 1.0.17),
+               libusb-1.0-0-dev (>= 1.0.17-1),
               libusbredirparser-dev (>= 0.6-2),
               libvirglrenderer-dev,
               libzstd-dev,
@@ -38,6 +39,8 @@ Build-Depends: debhelper-compat (= 13),
               python3-sphinx,
               python3-sphinx-rtd-theme,
               quilt,
               texi2html,
               texinfo,
               uuid-dev,
               xfslibs-dev,
 Standards-Version: 3.7.2
@@ -54,6 +57,7 @@ Depends: ceph-common (>= 0.48),
         libglusterfs-dev | glusterfs-common (>= 5.6),
         libglusterfs0 | glusterfs-common (>= 5.6),
         libiscsi4 (>= 1.12.0) | libiscsi7,
         libjemalloc2,
         libjpeg62-turbo,
         libspice-server1 (>= 0.14.0~),
         libusb-1.0-0 (>= 1.0.17-1),
@@ -62,8 +66,8 @@ Depends: ceph-common (>= 0.48),
         libuuid1,
         ${misc:Depends},
         ${shlibs:Depends},
-Recommends: numactl,
+Recommends: numactl
-Suggests: libgl1,
+Suggests: libgl1
 Conflicts: kvm,
           pve-kvm,
           pve-qemu-kvm-2.6.18,
@@ -71,10 +75,9 @@ Conflicts: kvm,
           qemu-kvm,
           qemu-system-arm,
           qemu-system-common,
           qemu-system-data,
           qemu-system-x86,
           qemu-utils,
-Provides: qemu-system-arm, qemu-system-x86, qemu-utils,
+Provides: qemu-system-arm, qemu-system-x86, qemu-utils
 Replaces: pve-kvm,
          pve-qemu-kvm-2.6.18,
          qemu-system-arm,
@@ -84,3 +87,10 @@ Description: Full virtualization on x86 hardware
 Using KVM, one can run multiple virtual PCs, each running unmodified Linux or
 Windows images. Each virtual machine has private virtualized hardware: a
 network card, disk, graphics adapter, etc.
 Package: pve-qemu-kvm-dbg
 Architecture: any
 Section: debug
 Depends: pve-qemu-kvm (= ${binary:Version})
 Description: pve qemu debugging symbols
 This package contains the debugging symbols for pve-qemu-kvm.
--- a/debian/parse-machines.pl
+++ b/debian/parse-machines.pl
@@ -24,5 +24,4 @@ while (<STDIN>) {
 die "no QEMU machine types detected from STDIN input" if scalar (@$machines) <= 0;
-print to_json($machines, { utf8 => 1, canonical => 1 })
+print to_json($machines, { utf8 => 1 }) or die "$!\n";
    or die "failed to encode detected machines as JSON - $!\n";
--- a/debian/patches/bitmap-mirror/0001-drive-mirror-add-support-for-sync-bitmap-mode-never.patch
+++ b/debian/patches/bitmap-mirror/0001-drive-mirror-add-support-for-sync-bitmap-mode-never.patch
@@ -27,18 +27,16 @@ Signed-off-by: Ma Haocong <mahaocong@didichuxing.com>
 Signed-off-by: John Snow <jsnow@redhat.com>
 Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 [FE: rebased for 8.0]
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 block/mirror.c                         | 98 +++++++++++++++++++++-----
- blockdev.c                             | 38 +++++++++-
+ blockdev.c                             | 39 +++++++++-
 include/block/block_int-global-state.h |  4 +-
 qapi/block-core.json                   | 29 ++++++--
 tests/unit/test-block-iothread.c       |  4 +-
- 5 files changed, 144 insertions(+), 29 deletions(-)
+ 5 files changed, 145 insertions(+), 29 deletions(-)
 diff --git a/block/mirror.c b/block/mirror.c
-index 663e2b7002..9099c75992 100644
+index 3c4ab1159d..f2eca983f1 100644
 --- a/block/mirror.c
 +++ b/block/mirror.c
@@ -51,7 +51,7 @@ typedef struct MirrorBlockJob {
@@ -59,7 +57,7 @@ index 663e2b7002..9099c75992 100644
     BdrvDirtyBitmap *dirty_bitmap;
     BdrvDirtyBitmapIter *dbi;
     uint8_t *buf;
-@@ -703,7 +705,8 @@ static int mirror_exit_common(Job *job)
+@@ -696,7 +698,8 @@ static int mirror_exit_common(Job *job)
     bdrv_child_refresh_perms(mirror_top_bs, mirror_top_bs->backing,
                              &error_abort);
     if (!abort && s->backing_mode == MIRROR_SOURCE_BACKING_CHAIN) {
@@ -69,7 +67,7 @@ index 663e2b7002..9099c75992 100644
         BlockDriverState *unfiltered_target = bdrv_skip_filters(target_bs);
         if (bdrv_cow_bs(unfiltered_target) != backing) {
-@@ -801,6 +804,16 @@ static void mirror_abort(Job *job)
+@@ -794,6 +797,16 @@ static void mirror_abort(Job *job)
     assert(ret == 0);
 }
@@ -86,7 +84,7 @@ index 663e2b7002..9099c75992 100644
 static void coroutine_fn mirror_throttle(MirrorBlockJob *s)
 {
     int64_t now = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);
-@@ -987,7 +1000,8 @@ static int coroutine_fn mirror_run(Job *job, Error **errp)
+@@ -973,7 +986,8 @@ static int coroutine_fn mirror_run(Job *job, Error **errp)
     mirror_free_init(s);
     s->last_pause_ns = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);
@@ -96,7 +94,7 @@ index 663e2b7002..9099c75992 100644
         ret = mirror_dirty_init(s);
         if (ret < 0 || job_is_cancelled(&s->common.job)) {
             goto immediate_exit;
-@@ -1240,6 +1254,7 @@ static const BlockJobDriver mirror_job_driver = {
+@@ -1212,6 +1226,7 @@ static const BlockJobDriver mirror_job_driver = {
         .run                    = mirror_run,
         .prepare                = mirror_prepare,
         .abort                  = mirror_abort,
@@ -104,7 +102,7 @@ index 663e2b7002..9099c75992 100644
         .pause                  = mirror_pause,
         .complete               = mirror_complete,
         .cancel                 = mirror_cancel,
-@@ -1256,6 +1271,7 @@ static const BlockJobDriver commit_active_job_driver = {
+@@ -1228,6 +1243,7 @@ static const BlockJobDriver commit_active_job_driver = {
         .run                    = mirror_run,
         .prepare                = mirror_prepare,
         .abort                  = mirror_abort,
@@ -112,7 +110,7 @@ index 663e2b7002..9099c75992 100644
         .pause                  = mirror_pause,
         .complete               = mirror_complete,
         .cancel                 = commit_active_cancel,
-@@ -1647,7 +1663,10 @@ static BlockJob *mirror_start_job(
+@@ -1593,7 +1609,10 @@ static BlockJob *mirror_start_job(
                              BlockCompletionFunc *cb,
                              void *opaque,
                              const BlockJobDriver *driver,
@@ -124,7 +122,7 @@ index 663e2b7002..9099c75992 100644
                              bool auto_complete, const char *filter_node_name,
                              bool is_mirror, MirrorCopyMode copy_mode,
                              Error **errp)
-@@ -1659,10 +1678,39 @@ static BlockJob *mirror_start_job(
+@@ -1605,10 +1624,39 @@ static BlockJob *mirror_start_job(
     uint64_t target_perms, target_shared_perms;
     int ret;
@@ -166,7 +164,7 @@ index 663e2b7002..9099c75992 100644
     assert(is_power_of_2(granularity));
     if (buf_size < 0) {
-@@ -1793,7 +1841,9 @@ static BlockJob *mirror_start_job(
+@@ -1740,7 +1788,9 @@ static BlockJob *mirror_start_job(
     s->replaces = g_strdup(replaces);
     s->on_source_error = on_source_error;
     s->on_target_error = on_target_error;
@@ -177,7 +175,7 @@ index 663e2b7002..9099c75992 100644
     s->backing_mode = backing_mode;
     s->zero_target = zero_target;
     s->copy_mode = copy_mode;
-@@ -1814,6 +1864,18 @@ static BlockJob *mirror_start_job(
+@@ -1761,6 +1811,18 @@ static BlockJob *mirror_start_job(
         bdrv_disable_dirty_bitmap(s->dirty_bitmap);
     }
@@ -196,7 +194,7 @@ index 663e2b7002..9099c75992 100644
     ret = block_job_add_bdrv(&s->common, "source", bs, 0,
                              BLK_PERM_WRITE_UNCHANGED | BLK_PERM_WRITE |
                              BLK_PERM_CONSISTENT_READ,
-@@ -1891,6 +1953,9 @@ fail:
+@@ -1838,6 +1900,9 @@ fail:
         if (s->dirty_bitmap) {
             bdrv_release_dirty_bitmap(s->dirty_bitmap);
         }
@@ -206,7 +204,7 @@ index 663e2b7002..9099c75992 100644
         job_early_fail(&s->common.job);
     }
-@@ -1908,31 +1973,25 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
+@@ -1855,31 +1920,25 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
                   BlockDriverState *target, const char *replaces,
                   int creation_flags, int64_t speed,
                   uint32_t granularity, int64_t buf_size,
@@ -243,7 +241,7 @@ index 663e2b7002..9099c75992 100644
 }
 BlockJob *commit_active_start(const char *job_id, BlockDriverState *bs,
-@@ -1959,7 +2018,8 @@ BlockJob *commit_active_start(const char *job_id, BlockDriverState *bs,
+@@ -1906,7 +1965,8 @@ BlockJob *commit_active_start(const char *job_id, BlockDriverState *bs,
                      job_id, bs, creation_flags, base, NULL, speed, 0, 0,
                      MIRROR_LEAVE_BACKING_CHAIN, false,
                      on_error, on_error, true, cb, opaque,
@@ -254,20 +252,21 @@ index 663e2b7002..9099c75992 100644
                      errp);
     if (!job) {
 diff --git a/blockdev.c b/blockdev.c
-index e464daea58..50e4a9c682 100644
+index 9230888e34..9a1a3118ed 100644
 --- a/blockdev.c
 +++ b/blockdev.c
-@@ -2942,6 +2942,9 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
+@@ -2951,6 +2951,10 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
                                    BlockDriverState *target,
-                                    const char *replaces,
+                                    bool has_replaces, const char *replaces,
                                    enum MirrorSyncMode sync,
 +                                   bool has_bitmap,
 +                                   const char *bitmap_name,
 +                                   bool has_bitmap_mode,
 +                                   BitmapSyncMode bitmap_mode,
                                    BlockMirrorBackingMode backing_mode,
                                    bool zero_target,
                                    bool has_speed, int64_t speed,
-@@ -2960,6 +2963,7 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
+@@ -2970,6 +2974,7 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
 {
     BlockDriverState *unfiltered_bs;
     int job_flags = JOB_DEFAULT;
@@ -275,11 +274,11 @@ index e464daea58..50e4a9c682 100644
     if (!has_speed) {
         speed = 0;
-@@ -3011,6 +3015,29 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
+@@ -3024,6 +3029,29 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
         sync = MIRROR_SYNC_MODE_FULL;
     }
-+    if (bitmap_name) {
+    if (has_bitmap) {
 +        if (granularity) {
 +            error_setg(errp, "Granularity and bitmap cannot both be set");
 +            return;
@@ -302,53 +301,53 @@ index e464daea58..50e4a9c682 100644
 +        }
 +    }
 +
-     if (!replaces) {
+     if (!has_replaces) {
         /* We want to mirror from @bs, but keep implicit filters on top */
         unfiltered_bs = bdrv_skip_implicit_filters(bs);
-@@ -3056,8 +3083,8 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
+@@ -3070,8 +3098,8 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
      * and will allow to check whether the node still exist at mirror completion
      */
     mirror_start(job_id, bs, target,
-                 replaces, job_flags,
+-                 has_replaces ? replaces : NULL, job_flags,
 -                 speed, granularity, buf_size, sync, backing_mode, zero_target,
-+                 replaces, job_flags, speed, granularity, buf_size, sync,
+                 has_replaces ? replaces : NULL, job_flags, speed, granularity,
-+                 bitmap, bitmap_mode, backing_mode, zero_target,
+                 buf_size, sync, bitmap, bitmap_mode, backing_mode, zero_target,
                  on_source_error, on_target_error, unmap, filter_node_name,
                  copy_mode, errp);
 }
-@@ -3202,6 +3229,8 @@ void qmp_drive_mirror(DriveMirror *arg, Error **errp)
+@@ -3216,6 +3244,8 @@ void qmp_drive_mirror(DriveMirror *arg, Error **errp)
-     blockdev_mirror_common(arg->job_id, bs, target_bs,
+     blockdev_mirror_common(arg->has_job_id ? arg->job_id : NULL, bs, target_bs,
-                            arg->replaces, arg->sync,
+                            arg->has_replaces, arg->replaces, arg->sync,
-+                           arg->bitmap,
+                           arg->has_bitmap, arg->bitmap,
 +                           arg->has_bitmap_mode, arg->bitmap_mode,
                            backing_mode, zero_target,
                            arg->has_speed, arg->speed,
                            arg->has_granularity, arg->granularity,
-@@ -3223,6 +3252,8 @@ void qmp_blockdev_mirror(const char *job_id,
+@@ -3237,6 +3267,8 @@ void qmp_blockdev_mirror(bool has_job_id, const char *job_id,
                          const char *device, const char *target,
-                          const char *replaces,
+                          bool has_replaces, const char *replaces,
                          MirrorSyncMode sync,
-+                         const char *bitmap,
+                         bool has_bitmap, const char *bitmap,
 +                         bool has_bitmap_mode, BitmapSyncMode bitmap_mode,
                          bool has_speed, int64_t speed,
                          bool has_granularity, uint32_t granularity,
                          bool has_buf_size, int64_t buf_size,
-@@ -3271,7 +3302,8 @@ void qmp_blockdev_mirror(const char *job_id,
+@@ -3286,7 +3318,8 @@ void qmp_blockdev_mirror(bool has_job_id, const char *job_id,
     }
-     blockdev_mirror_common(job_id, bs, target_bs,
+     blockdev_mirror_common(has_job_id ? job_id : NULL, bs, target_bs,
-                           replaces, sync, backing_mode,
+-                           has_replaces, replaces, sync, backing_mode,
-+                           replaces, sync,
+                           has_replaces, replaces, sync, has_bitmap,
 +                           bitmap, has_bitmap_mode, bitmap_mode, backing_mode,
                            zero_target, has_speed, speed,
                            has_granularity, granularity,
                            has_buf_size, buf_size,
 diff --git a/include/block/block_int-global-state.h b/include/block/block_int-global-state.h
-index 902406eb99..d559be928c 100644
+index b49f4eb35b..9d744db618 100644
 --- a/include/block/block_int-global-state.h
 +++ b/include/block/block_int-global-state.h
-@@ -152,7 +152,9 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
+@@ -149,7 +149,9 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
                   BlockDriverState *target, const char *replaces,
                   int creation_flags, int64_t speed,
                   uint32_t granularity, int64_t buf_size,
@@ -360,10 +359,10 @@ index 902406eb99..d559be928c 100644
                   BlockdevOnError on_source_error,
                   BlockdevOnError on_target_error,
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index c05ad0c07e..3c945c1f93 100644
+index 2173e7734a..e1857e7094 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -2095,10 +2095,19 @@
+@@ -2000,10 +2000,19 @@
 #        (all the disk, only the sectors allocated in the topmost image, or
 #        only new I/O).
 #
@@ -384,7 +383,7 @@ index c05ad0c07e..3c945c1f93 100644
 #
 # @buf-size: maximum amount of data in flight from source to
 #            target (since 1.4).
-@@ -2138,7 +2147,9 @@
+@@ -2043,7 +2052,9 @@
 { 'struct': 'DriveMirror',
   'data': { '*job-id': 'str', 'device': 'str', 'target': 'str',
             '*format': 'str', '*node-name': 'str', '*replaces': 'str',
@@ -395,7 +394,7 @@ index c05ad0c07e..3c945c1f93 100644
             '*speed': 'int', '*granularity': 'uint32',
             '*buf-size': 'int', '*on-source-error': 'BlockdevOnError',
             '*on-target-error': 'BlockdevOnError',
-@@ -2417,10 +2428,19 @@
+@@ -2322,10 +2333,19 @@
 #        (all the disk, only the sectors allocated in the topmost image, or
 #        only new I/O).
 #
@@ -416,7 +415,7 @@ index c05ad0c07e..3c945c1f93 100644
 #
 # @buf-size: maximum amount of data in flight from source to
 #            target
-@@ -2470,7 +2490,8 @@
+@@ -2375,7 +2395,8 @@
 { 'command': 'blockdev-mirror',
   'data': { '*job-id': 'str', 'device': 'str', 'target': 'str',
             '*replaces': 'str',
@@ -427,10 +426,10 @@ index c05ad0c07e..3c945c1f93 100644
             '*buf-size': 'int', '*on-source-error': 'BlockdevOnError',
             '*on-target-error': 'BlockdevOnError',
 diff --git a/tests/unit/test-block-iothread.c b/tests/unit/test-block-iothread.c
-index 3a5e1eb2c4..c1ecc49073 100644
+index 8b55eccc89..f4650be8e5 100644
 --- a/tests/unit/test-block-iothread.c
 +++ b/tests/unit/test-block-iothread.c
-@@ -757,8 +757,8 @@ static void test_propagate_mirror(void)
+@@ -753,8 +753,8 @@ static void test_propagate_mirror(void)
     /* Start a mirror job */
     mirror_start("job0", src, target, NULL, JOB_DEFAULT, 0, 0, 0,
@@ -440,4 +439,4 @@ index 3a5e1eb2c4..c1ecc49073 100644
 +                 false, BLOCKDEV_ON_ERROR_REPORT, BLOCKDEV_ON_ERROR_REPORT,
                  false, "filter_node", MIRROR_COPY_MODE_BACKGROUND,
                  &error_abort);
-     WITH_JOB_LOCK_GUARD() {
+     job = job_get("job0");
--- a/debian/patches/bitmap-mirror/0002-drive-mirror-add-support-for-conditional-and-always-.patch
+++ b/debian/patches/bitmap-mirror/0002-drive-mirror-add-support-for-conditional-and-always-.patch
@@ -24,10 +24,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 1 file changed, 18 insertions(+), 6 deletions(-)
 diff --git a/block/mirror.c b/block/mirror.c
-index 9099c75992..e2ff42067b 100644
+index f2eca983f1..b6475d50ad 100644
 --- a/block/mirror.c
 +++ b/block/mirror.c
-@@ -680,8 +680,6 @@ static int mirror_exit_common(Job *job)
+@@ -673,8 +673,6 @@ static int mirror_exit_common(Job *job)
         bdrv_unfreeze_backing_chain(mirror_top_bs, target_bs);
     }
@@ -36,7 +36,7 @@ index 9099c75992..e2ff42067b 100644
     /* Make sure that the source BDS doesn't go away during bdrv_replace_node,
      * before we can call bdrv_drained_end */
     bdrv_ref(src);
-@@ -782,6 +780,18 @@ static int mirror_exit_common(Job *job)
+@@ -775,6 +773,18 @@ static int mirror_exit_common(Job *job)
     block_job_remove_all_bdrv(bjob);
     bdrv_replace_node(mirror_top_bs, mirror_top_bs->backing->bs, &error_abort);
@@ -55,7 +55,7 @@ index 9099c75992..e2ff42067b 100644
     bs_opaque->job = NULL;
     bdrv_drained_end(src);
-@@ -1688,10 +1698,6 @@ static BlockJob *mirror_start_job(
+@@ -1634,10 +1644,6 @@ static BlockJob *mirror_start_job(
                        " sync mode",
                        MirrorSyncMode_str(sync_mode));
             return NULL;
@@ -66,7 +66,7 @@ index 9099c75992..e2ff42067b 100644
         }
     } else if (bitmap) {
         error_setg(errp,
-@@ -1708,6 +1714,12 @@ static BlockJob *mirror_start_job(
+@@ -1654,6 +1660,12 @@ static BlockJob *mirror_start_job(
             return NULL;
         }
         granularity = bdrv_dirty_bitmap_granularity(bitmap);
--- a/debian/patches/bitmap-mirror/0003-mirror-add-check-for-bitmap-mode-without-bitmap.patch
+++ b/debian/patches/bitmap-mirror/0003-mirror-add-check-for-bitmap-mode-without-bitmap.patch
@@ -16,10 +16,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 1 file changed, 3 insertions(+)
 diff --git a/blockdev.c b/blockdev.c
-index 50e4a9c682..e6b2b1e338 100644
+index 9a1a3118ed..a57b0af2e7 100644
 --- a/blockdev.c
 +++ b/blockdev.c
-@@ -3036,6 +3036,9 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
+@@ -3050,6 +3050,9 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
         if (bdrv_dirty_bitmap_check(bitmap, BDRV_BITMAP_ALLOW_RO, errp)) {
             return;
         }
@@ -28,4 +28,4 @@ index 50e4a9c682..e6b2b1e338 100644
 +        return;
     }
-     if (!replaces) {
+     if (!has_replaces) {
--- a/debian/patches/bitmap-mirror/0004-mirror-switch-to-bdrv_dirty_bitmap_merge_internal.patch
+++ b/debian/patches/bitmap-mirror/0004-mirror-switch-to-bdrv_dirty_bitmap_merge_internal.patch
@@ -16,10 +16,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 1 file changed, 4 insertions(+), 7 deletions(-)
 diff --git a/block/mirror.c b/block/mirror.c
-index e2ff42067b..f42953837b 100644
+index b6475d50ad..8b3342f9ec 100644
 --- a/block/mirror.c
 +++ b/block/mirror.c
-@@ -786,8 +786,8 @@ static int mirror_exit_common(Job *job)
+@@ -779,8 +779,8 @@ static int mirror_exit_common(Job *job)
              job->ret == 0 && ret == 0)) {
             /* Success; synchronize copy back to sync. */
             bdrv_clear_dirty_bitmap(s->sync_bitmap, NULL);
@@ -30,7 +30,7 @@ index e2ff42067b..f42953837b 100644
         }
     }
     bdrv_release_dirty_bitmap(s->dirty_bitmap);
-@@ -1881,11 +1881,8 @@ static BlockJob *mirror_start_job(
+@@ -1828,11 +1828,8 @@ static BlockJob *mirror_start_job(
     }
     if (s->sync_mode == MIRROR_SYNC_MODE_BITMAP) {
--- a/debian/patches/bitmap-mirror/0006-mirror-move-some-checks-to-qmp.patch
+++ b/debian/patches/bitmap-mirror/0006-mirror-move-some-checks-to-qmp.patch
@@ -12,8 +12,6 @@ uniform w.r.t. backup block jobs.
 Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 [FE: rebase for 8.0]
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 block/mirror.c             | 28 +++------------
 blockdev.c                 | 29 +++++++++++++++
@@ -21,10 +19,10 @@ Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 3 files changed, 70 insertions(+), 59 deletions(-)
 diff --git a/block/mirror.c b/block/mirror.c
-index f42953837b..8f79efaa87 100644
+index 8b3342f9ec..1d4ff0efad 100644
 --- a/block/mirror.c
 +++ b/block/mirror.c
-@@ -1688,31 +1688,13 @@ static BlockJob *mirror_start_job(
+@@ -1634,31 +1634,13 @@ static BlockJob *mirror_start_job(
     uint64_t target_perms, target_shared_perms;
     int ret;
@@ -62,17 +60,17 @@ index f42953837b..8f79efaa87 100644
         if (bitmap_mode != BITMAP_SYNC_MODE_NEVER) {
 diff --git a/blockdev.c b/blockdev.c
-index e6b2b1e338..bdae211a54 100644
+index a57b0af2e7..ce62a9b439 100644
 --- a/blockdev.c
 +++ b/blockdev.c
-@@ -3015,7 +3015,36 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
+@@ -3029,7 +3029,36 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
         sync = MIRROR_SYNC_MODE_FULL;
     }
 +    if ((sync == MIRROR_SYNC_MODE_BITMAP) ||
 +        (sync == MIRROR_SYNC_MODE_INCREMENTAL)) {
 +        /* done before desugaring 'incremental' to print the right message */
-+        if (!bitmap_name) {
+        if (!has_bitmap) {
 +            error_setg(errp, "Must provide a valid bitmap name for "
 +                       "'%s' sync mode", MirrorSyncMode_str(sync));
 +            return;
@@ -93,7 +91,7 @@ index e6b2b1e338..bdae211a54 100644
 +        bitmap_mode = BITMAP_SYNC_MODE_ON_SUCCESS;
 +    }
 +
-     if (bitmap_name) {
+     if (has_bitmap) {
 +        if (sync != MIRROR_SYNC_MODE_BITMAP) {
 +            error_setg(errp, "Sync mode '%s' not supported with bitmap.",
 +                       MirrorSyncMode_str(sync));
--- a/debian/patches/extra/0001-monitor-qmp-fix-race-with-clients-disconnecting-earl.patch
+++ b/debian/patches/extra/0001-monitor-qmp-fix-race-with-clients-disconnecting-earl.patch
@@ -48,7 +48,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 6 files changed, 59 insertions(+), 5 deletions(-)
 diff --git a/include/monitor/monitor.h b/include/monitor/monitor.h
-index 033390f699..ad35d4fea8 100644
+index a4b40e8391..d64ae8f34e 100644
 --- a/include/monitor/monitor.h
 +++ b/include/monitor/monitor.h
@@ -16,6 +16,7 @@ extern QemuOptsList qemu_mon_opts;
@@ -60,7 +60,7 @@ index 033390f699..ad35d4fea8 100644
 void monitor_init_globals(void);
 void monitor_init_globals_core(void);
 diff --git a/monitor/monitor-internal.h b/monitor/monitor-internal.h
-index 53e3808054..a19f8cbc2b 100644
+index caa2e90ef2..e1596f79ab 100644
 --- a/monitor/monitor-internal.h
 +++ b/monitor/monitor-internal.h
@@ -152,6 +152,13 @@ typedef struct {
@@ -78,7 +78,7 @@ index 53e3808054..a19f8cbc2b 100644
 /**
 diff --git a/monitor/monitor.c b/monitor/monitor.c
-index 8dc96f6af9..f3c38cb714 100644
+index 86949024f6..c306cadcf4 100644
 --- a/monitor/monitor.c
 +++ b/monitor/monitor.c
@@ -135,6 +135,21 @@ bool monitor_cur_is_qmp(void)
--- a/debian/patches/extra/0002-block-io_uring-revert-Use-io_uring_register_ring_fd-.patch
+++ b/debian/patches/extra/0002-block-io_uring-revert-Use-io_uring_register_ring_fd-.patch
@@ -0,0 +1,76 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Sam Li <faithilikerun@gmail.com>
 Date: Sat, 24 Sep 2022 22:48:15 +0800
 Subject: [PATCH] block/io_uring: revert "Use io_uring_register_ring_fd() to
 skip fd operations"
 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1193
 The commit "Use io_uring_register_ring_fd() to skip fd operations" broke
 when booting a guest with iothread and io_uring. That is because the
 io_uring_register_ring_fd() call is made from the main thread instead of
 IOThread where io_uring_submit() is called. It can not be guaranteed
 to register the ring fd in the correct thread or unregister the same ring
 fd if the IOThread is disabled. This optimization is not critical so we
 will revert previous commit.
 This reverts commit e2848bc574fe2715c694bf8fe9a1ba7f78a1125a
 and 77e3f038af1764983087e3551a0fde9951952c4d.
 Signed-off-by: Sam Li <faithilikerun@gmail.com>
 ---
 block/io_uring.c | 13 +------------
 meson.build      |  1 -
 2 files changed, 1 insertion(+), 13 deletions(-)
 diff --git a/block/io_uring.c b/block/io_uring.c
 index a1760152e0..973e15d876 100644
 --- a/block/io_uring.c
 +++ b/block/io_uring.c
@@ -11,7 +11,6 @@
 #include "qemu/osdep.h"
 #include <liburing.h>
 #include "block/aio.h"
 -#include "qemu/error-report.h"
 #include "qemu/queue.h"
 #include "block/block.h"
 #include "block/raw-aio.h"
@@ -19,7 +18,6 @@
 #include "qapi/error.h"
 #include "trace.h"
 -
 /* io_uring ring size */
 #define MAX_ENTRIES 128
@@ -432,17 +430,8 @@ LuringState *luring_init(Error **errp)
     }
     ioq_init(&s->io_q);
 -#ifdef CONFIG_LIBURING_REGISTER_RING_FD
 -    if (io_uring_register_ring_fd(&s->ring) < 0) {
 -        /*
 -         * Only warn about this error: we will fallback to the non-optimized
 -         * io_uring operations.
 -         */
 -        warn_report("failed to register linux io_uring ring file descriptor");
 -    }
 -#endif
 -
     return s;
 +
 }
 void luring_cleanup(LuringState *s)
 diff --git a/meson.build b/meson.build
 index 20fddbd707..d5230eadd6 100644
 --- a/meson.build
 +++ b/meson.build
@@ -1793,7 +1793,6 @@ config_host_data.set('CONFIG_LIBNFS', libnfs.found())
 config_host_data.set('CONFIG_LIBSSH', libssh.found())
 config_host_data.set('CONFIG_LINUX_AIO', libaio.found())
 config_host_data.set('CONFIG_LINUX_IO_URING', linux_io_uring.found())
 -config_host_data.set('CONFIG_LIBURING_REGISTER_RING_FD', cc.has_function('io_uring_register_ring_fd', prefix: '#include <liburing.h>', dependencies:linux_io_uring))
 config_host_data.set('CONFIG_LIBPMEM', libpmem.found())
 config_host_data.set('CONFIG_NUMA', numa.found())
 config_host_data.set('CONFIG_OPENGL', opengl.found())
--- a/debian/patches/extra/0002-scsi-megasas-Internal-cdbs-have-16-byte-length.patch
+++ b/debian/patches/extra/0002-scsi-megasas-Internal-cdbs-have-16-byte-length.patch
@@ -1,69 +0,0 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Guenter Roeck <linux@roeck-us.net>
 Date: Tue, 28 Feb 2023 09:11:29 -0800
 Subject: [PATCH] scsi: megasas: Internal cdbs have 16-byte length
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Host drivers do not necessarily set cdb_len in megasas io commands.
 With commits 6d1511cea0 ("scsi: Reject commands if the CDB length
 exceeds buf_len") and fe9d8927e2 ("scsi: Add buf_len parameter to
 scsi_req_new()"), this results in failures to boot Linux from affected
 SCSI drives because cdb_len is set to 0 by the host driver.
 Set the cdb length to its actual size to solve the problem.
 Signed-off-by: Guenter Roeck <linux@roeck-us.net>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 (picked-up from https://lists.nongnu.org/archive/html/qemu-devel/2023-02/msg08653.html)
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 hw/scsi/megasas.c | 14 ++------------
 1 file changed, 2 insertions(+), 12 deletions(-)
 diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
 index 9cbbb16121..d624866bb6 100644
 --- a/hw/scsi/megasas.c
 +++ b/hw/scsi/megasas.c
@@ -1780,7 +1780,7 @@ static int megasas_handle_io(MegasasState *s, MegasasCmd *cmd, int frame_cmd)
     uint8_t cdb[16];
     int len;
     struct SCSIDevice *sdev = NULL;
 -    int target_id, lun_id, cdb_len;
 +    int target_id, lun_id;
     lba_count = le32_to_cpu(cmd->frame->io.header.data_len);
     lba_start_lo = le32_to_cpu(cmd->frame->io.lba_lo);
@@ -1789,7 +1789,6 @@ static int megasas_handle_io(MegasasState *s, MegasasCmd *cmd, int frame_cmd)
     target_id = cmd->frame->header.target_id;
     lun_id = cmd->frame->header.lun_id;
 -    cdb_len = cmd->frame->header.cdb_len;
     if (target_id < MFI_MAX_LD && lun_id == 0) {
         sdev = scsi_device_find(&s->bus, 0, target_id, lun_id);
@@ -1804,15 +1803,6 @@ static int megasas_handle_io(MegasasState *s, MegasasCmd *cmd, int frame_cmd)
         return MFI_STAT_DEVICE_NOT_FOUND;
     }
 -    if (cdb_len > 16) {
 -        trace_megasas_scsi_invalid_cdb_len(
 -            mfi_frame_desc(frame_cmd), 1, target_id, lun_id, cdb_len);
 -        megasas_write_sense(cmd, SENSE_CODE(INVALID_OPCODE));
 -        cmd->frame->header.scsi_status = CHECK_CONDITION;
 -        s->event_count++;
 -        return MFI_STAT_SCSI_DONE_WITH_ERROR;
 -    }
 -
     cmd->iov_size = lba_count * sdev->blocksize;
     if (megasas_map_sgl(s, cmd, &cmd->frame->io.sgl)) {
         megasas_write_sense(cmd, SENSE_CODE(TARGET_FAILURE));
@@ -1823,7 +1813,7 @@ static int megasas_handle_io(MegasasState *s, MegasasCmd *cmd, int frame_cmd)
     megasas_encode_lba(cdb, lba_start, lba_count, is_write);
     cmd->req = scsi_req_new(sdev, cmd->index,
 -                            lun_id, cdb, cdb_len, cmd);
 +                            lun_id, cdb, sizeof(cdb), cmd);
     if (!cmd->req) {
         trace_megasas_scsi_req_alloc_failed(
             mfi_frame_desc(frame_cmd), target_id, lun_id);
--- a/debian/patches/extra/0003-ide-avoid-potential-deadlock-when-draining-during-tr.patch
+++ b/debian/patches/extra/0003-ide-avoid-potential-deadlock-when-draining-during-tr.patch
@@ -1,100 +0,0 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Fiona Ebner <f.ebner@proxmox.com>
 Date: Tue, 7 Mar 2023 15:03:02 +0100
 Subject: [PATCH] ide: avoid potential deadlock when draining during trim
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 The deadlock can happen as follows:
 1. ide_issue_trim is called, and increments the in_flight counter.
 2. ide_issue_trim_cb calls blk_aio_pdiscard.
 3. Somebody else starts draining (e.g. backup to insert the cbw node).
 4. ide_issue_trim_cb is called as the completion callback for
   blk_aio_pdiscard.
 5. ide_issue_trim_cb issues yet another blk_aio_pdiscard request.
 6. The request is added to the wait queue via blk_wait_while_drained,
   because draining has been started.
 7. Nobody ever decrements the in_flight counter and draining can't
   finish. This would be done by ide_trim_bh_cb, which is called after
   ide_issue_trim_cb has issued its last request, but
   ide_issue_trim_cb is not called anymore, because it's the
   completion callback of blk_aio_pdiscard, which waits on draining.
 Quoting Hanna Czenczek:
 > The point of 7e5cdb345f was that we need any in-flight count to
 > accompany a set s->bus->dma->aiocb. While blk_aio_pdiscard() is
 > happening, we don’t necessarily need another count. But we do need
 > it while there is no blk_aio_pdiscard().
 > ide_issue_trim_cb() returns in two cases (and, recursively through
 > its callers, leaves s->bus->dma->aiocb set):
 > 1. After calling blk_aio_pdiscard(), which will keep an in-flight
 >    count,
 > 2. After calling replay_bh_schedule_event() (i.e.
 >    qemu_bh_schedule()), which does not keep an in-flight count.
 Thus, even after moving the blk_inc_in_flight to above the
 replay_bh_schedule_event call, the invariant "ide_issue_trim_cb
 returns with an accompanying in-flight count" is still satisfied.
 However, the issue 7e5cdb345f fixed for canceling resurfaces, because
 ide_cancel_dma_sync assumes that it just needs to drain once. But now
 the in_flight count is not consistently > 0 during the trim operation.
 So, change it to drain until !s->bus->dma->aiocb, which means that the
 operation finished (s->bus->dma->aiocb is cleared by ide_set_inactive
 via the ide_dma_cb when the end of the transfer is reached).
 Discussion here:
 https://lists.nongnu.org/archive/html/qemu-devel/2023-03/msg02506.html
 Fixes: 7e5cdb345f ("ide: Increment BB in-flight counter for TRIM BH")
 Suggested-by: Hanna Czenczek <hreitz@redhat.com>
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 hw/ide/core.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)
 diff --git a/hw/ide/core.c b/hw/ide/core.c
 index 45d14a25e9..08e1f0c3d7 100644
 --- a/hw/ide/core.c
 +++ b/hw/ide/core.c
@@ -444,7 +444,7 @@ static void ide_trim_bh_cb(void *opaque)
     iocb->bh = NULL;
     qemu_aio_unref(iocb);
 -    /* Paired with an increment in ide_issue_trim() */
 +    /* Paired with an increment in ide_issue_trim_cb() */
     blk_dec_in_flight(blk);
 }
@@ -504,6 +504,8 @@ static void ide_issue_trim_cb(void *opaque, int ret)
 done:
     iocb->aiocb = NULL;
     if (iocb->bh) {
 +        /* Paired with a decrement in ide_trim_bh_cb() */
 +        blk_inc_in_flight(s->blk);
         replay_bh_schedule_event(iocb->bh);
     }
 }
@@ -515,9 +517,6 @@ BlockAIOCB *ide_issue_trim(
     IDEState *s = opaque;
     TrimAIOCB *iocb;
 -    /* Paired with a decrement in ide_trim_bh_cb() */
 -    blk_inc_in_flight(s->blk);
 -
     iocb = blk_aio_get(&trim_aiocb_info, s->blk, cb, cb_opaque);
     iocb->s = s;
     iocb->bh = qemu_bh_new(ide_trim_bh_cb, iocb);
@@ -740,8 +739,9 @@ void ide_cancel_dma_sync(IDEState *s)
      */
     if (s->bus->dma->aiocb) {
         trace_ide_cancel_dma_sync_remaining();
 -        blk_drain(s->blk);
 -        assert(s->bus->dma->aiocb == NULL);
 +        while (s->bus->dma->aiocb) {
 +            blk_drain(s->blk);
 +        }
     }
 }
--- a/debian/patches/extra/0003-virtiofsd-use-g_date_time_get_microsecond-to-get-sub.patch
+++ b/debian/patches/extra/0003-virtiofsd-use-g_date_time_get_microsecond-to-get-sub.patch
@@ -0,0 +1,51 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Yusuke Okada <okada.yusuke@jp.fujitsu.com>
 Date: Thu, 18 Aug 2022 14:46:19 -0400
 Subject: [PATCH] virtiofsd: use g_date_time_get_microsecond to get subsecond
 The "%f" specifier in g_date_time_format() is only available in glib
 2.65.2 or later. If combined with older glib, the function returns null
 and the timestamp displayed as "(null)".
 For backward compatibility, g_date_time_get_microsecond should be used
 to retrieve subsecond.
 In this patch the g_date_time_format() leaves subsecond field as "%06d"
 and let next snprintf to format with g_date_time_get_microsecond.
 Signed-off-by: Yusuke Okada <okada.yusuke@jp.fujitsu.com>
 Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Message-id: 20220818184618.2205172-1-yokada.996@gmail.com
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 (cherry-picked from commit f16d15c9276bd8f501f861c39cbd4adc812d0c1d)
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 tools/virtiofsd/passthrough_ll.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)
 diff --git a/tools/virtiofsd/passthrough_ll.c b/tools/virtiofsd/passthrough_ll.c
 index 371a7bead6..20f0f41f99 100644
 --- a/tools/virtiofsd/passthrough_ll.c
 +++ b/tools/virtiofsd/passthrough_ll.c
@@ -4185,6 +4185,7 @@ static void setup_nofile_rlimit(unsigned long rlimit_nofile)
 static void log_func(enum fuse_log_level level, const char *fmt, va_list ap)
 {
     g_autofree char *localfmt = NULL;
 +    char buf[64];
     if (current_log_level < level) {
         return;
@@ -4197,9 +4198,11 @@ static void log_func(enum fuse_log_level level, const char *fmt, va_list ap)
                                        fmt);
         } else {
             g_autoptr(GDateTime) now = g_date_time_new_now_utc();
 -            g_autofree char *nowstr = g_date_time_format(now, "%Y-%m-%d %H:%M:%S.%f%z");
 +            g_autofree char *nowstr = g_date_time_format(now,
 +                                       "%Y-%m-%d %H:%M:%S.%%06d%z");
 +            snprintf(buf, 64, nowstr, g_date_time_get_microsecond(now));
             localfmt = g_strdup_printf("[%s] [ID: %08ld] %s",
 -                                       nowstr, syscall(__NR_gettid), fmt);
 +                                       buf, syscall(__NR_gettid), fmt);
         }
         fmt = localfmt;
     }
--- a/debian/patches/extra/0004-chardev-fix-segfault-in-finalize.patch
+++ b/debian/patches/extra/0004-chardev-fix-segfault-in-finalize.patch
@@ -0,0 +1,56 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Maksim Davydov <davydov-max@yandex-team.ru>
 Date: Thu, 25 Aug 2022 19:52:47 +0300
 Subject: [PATCH] chardev: fix segfault in finalize
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 If finalize chardev-msmouse or chardev-wctable is called immediately after
 init it cases QEMU to crash with segfault. This happens because of
 QTAILQ_REMOVE in qemu_input_handler_unregister tries to dereference
 NULL pointer.
 For instance, this error can be reproduced via `qom-list-properties`
 command.
 Signed-off-by: Maksim Davydov <davydov-max@yandex-team.ru>
 Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
 Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
 Message-Id: <20220825165247.33704-1-davydov-max@yandex-team.ru>
 (trivial backport from fc0c128531ed55f058bfbad4f1348ebd9a0187f2)
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 chardev/msmouse.c  | 4 +++-
 chardev/wctablet.c | 4 +++-
 2 files changed, 6 insertions(+), 2 deletions(-)
 diff --git a/chardev/msmouse.c b/chardev/msmouse.c
 index eb9231dcdb..2cc1b16561 100644
 --- a/chardev/msmouse.c
 +++ b/chardev/msmouse.c
@@ -146,7 +146,9 @@ static void char_msmouse_finalize(Object *obj)
 {
     MouseChardev *mouse = MOUSE_CHARDEV(obj);
 -    qemu_input_handler_unregister(mouse->hs);
 +    if (mouse->hs) {
 +        qemu_input_handler_unregister(mouse->hs);
 +    }
 }
 static QemuInputHandler msmouse_handler = {
 diff --git a/chardev/wctablet.c b/chardev/wctablet.c
 index e8b292c43c..43bdf6b608 100644
 --- a/chardev/wctablet.c
 +++ b/chardev/wctablet.c
@@ -319,7 +319,9 @@ static void wctablet_chr_finalize(Object *obj)
 {
     TabletChardev *tablet = WCTABLET_CHARDEV(obj);
 -    qemu_input_handler_unregister(tablet->hs);
 +    if (tablet->hs) {
 +        qemu_input_handler_unregister(tablet->hs);
 +    }
 }
 static void wctablet_chr_open(Chardev *chr,
--- a/debian/patches/extra/0004-ui-return-NULL-when-getting-cursor-without-a-console.patch
+++ b/debian/patches/extra/0004-ui-return-NULL-when-getting-cursor-without-a-console.patch
@@ -1,36 +0,0 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
 Date: Fri, 28 Apr 2023 19:48:06 +0400
 Subject: [PATCH] ui: return NULL when getting cursor without a console
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 VNC may try to get the current cursor even when there are no consoles
 and crashes. Simple reproducer is qemu with -nodefaults.
 Fixes: (again)
 https://gitlab.com/qemu-project/qemu/-/issues/1548
 Fixes: commit 385ac97f8 ("ui: keep current cursor with QemuConsole")
 Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 (picked up from https://lists.nongnu.org/archive/html/qemu-devel/2023-04/msg05598.html)
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 ui/console.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/ui/console.c b/ui/console.c
 index e173731e20..7461446e71 100644
 --- a/ui/console.c
 +++ b/ui/console.c
@@ -2306,7 +2306,7 @@ QEMUCursor *qemu_console_get_cursor(QemuConsole *con)
     if (con == NULL) {
         con = active_console;
     }
 -    return con->cursor;
 +    return con ? con->cursor : NULL;
 }
 bool qemu_console_is_visible(QemuConsole *con)
--- a/debian/patches/extra/0005-init-daemonize-defuse-PID-file-resolve-error.patch
+++ b/debian/patches/extra/0005-init-daemonize-defuse-PID-file-resolve-error.patch
@@ -0,0 +1,42 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Fiona Ebner <f.ebner@proxmox.com>
 Date: Fri, 28 Oct 2022 10:09:46 +0200
 Subject: [PATCH] init: daemonize: defuse PID file resolve error
 When proxmox-file-restore invokes QEMU, the PID file is a (temporary)
 file that's already unlinked, so resolving the absolute path here
 failed.
 It should not be a critical error when the PID file unlink handler
 can't be registered, because the path can't be resolved for whatever
 reason. If the file is already gone from QEMU's perspective (i.e.
 errno is ENOENT), silently ignore the error. Otherwise, print a
 warning.
 Reported-by: Dominik Csapak <d.csapak@proxmox.com>
 Suggested-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 softmmu/vl.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)
 diff --git a/softmmu/vl.c b/softmmu/vl.c
 index 706bd7cff7..3381c56af7 100644
 --- a/softmmu/vl.c
 +++ b/softmmu/vl.c
@@ -2438,10 +2438,11 @@ static void qemu_maybe_daemonize(const char *pid_file)
         pid_file_realpath = g_malloc0(PATH_MAX);
         if (!realpath(pid_file, pid_file_realpath)) {
 -            error_report("cannot resolve PID file path: %s: %s",
 -                         pid_file, strerror(errno));
 -            unlink(pid_file);
 -            exit(1);
 +            if (errno != ENOENT) {
 +                warn_report("not removing PID file on exit: cannot resolve PID "
 +                            "file path: %s: %s", pid_file, strerror(errno));
 +            }
 +            return;
         }
         qemu_unlink_pidfile_notifier = (struct UnlinkPidfileNotifier) {
--- a/debian/patches/extra/0005-memory-prevent-dma-reentracy-issues.patch
+++ b/debian/patches/extra/0005-memory-prevent-dma-reentracy-issues.patch
@@ -1,130 +0,0 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Alexander Bulekov <alxndr@bu.edu>
 Date: Thu, 27 Apr 2023 17:10:06 -0400
 Subject: [PATCH] memory: prevent dma-reentracy issues
 Add a flag to the DeviceState, when a device is engaged in PIO/MMIO/DMA.
 This flag is set/checked prior to calling a device's MemoryRegion
 handlers, and set when device code initiates DMA.  The purpose of this
 flag is to prevent two types of DMA-based reentrancy issues:
 1.) mmio -> dma -> mmio case
 2.) bh -> dma write -> mmio case
 These issues have led to problems such as stack-exhaustion and
 use-after-frees.
 Summary of the problem from Peter Maydell:
 https://lore.kernel.org/qemu-devel/CAFEAcA_23vc7hE3iaM-JVA6W38LK4hJoWae5KcknhPRD5fPBZA@mail.gmail.com
 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/62
 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/540
 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/541
 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/556
 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/557
 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/827
 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1282
 Resolves: CVE-2023-0330
 Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
 Reviewed-by: Thomas Huth <thuth@redhat.com>
 Message-Id: <20230427211013.2994127-2-alxndr@bu.edu>
 [thuth: Replace warn_report() with warn_report_once()]
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 (cherry-picked from commit a2e1753b8054344f32cf94f31c6399a58794a380)
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 include/exec/memory.h  |  5 +++++
 include/hw/qdev-core.h |  7 +++++++
 softmmu/memory.c       | 16 ++++++++++++++++
 3 files changed, 28 insertions(+)
 diff --git a/include/exec/memory.h b/include/exec/memory.h
 index 15ade918ba..e45ce6061f 100644
 --- a/include/exec/memory.h
 +++ b/include/exec/memory.h
@@ -767,6 +767,8 @@ struct MemoryRegion {
     bool is_iommu;
     RAMBlock *ram_block;
     Object *owner;
 +    /* owner as TYPE_DEVICE. Used for re-entrancy checks in MR access hotpath */
 +    DeviceState *dev;
     const MemoryRegionOps *ops;
     void *opaque;
@@ -791,6 +793,9 @@ struct MemoryRegion {
     unsigned ioeventfd_nb;
     MemoryRegionIoeventfd *ioeventfds;
     RamDiscardManager *rdm; /* Only for RAM */
 +
 +    /* For devices designed to perform re-entrant IO into their own IO MRs */
 +    bool disable_reentrancy_guard;
 };
 struct IOMMUMemoryRegion {
 diff --git a/include/hw/qdev-core.h b/include/hw/qdev-core.h
 index bd50ad5ee1..7623703943 100644
 --- a/include/hw/qdev-core.h
 +++ b/include/hw/qdev-core.h
@@ -162,6 +162,10 @@ struct NamedClockList {
     QLIST_ENTRY(NamedClockList) node;
 };
 +typedef struct {
 +    bool engaged_in_io;
 +} MemReentrancyGuard;
 +
 /**
  * DeviceState:
  * @realized: Indicates whether the device has been fully constructed.
@@ -194,6 +198,9 @@ struct DeviceState {
     int alias_required_for_version;
     ResettableState reset;
     GSList *unplug_blockers;
 +
 +    /* Is the device currently in mmio/pio/dma? Used to prevent re-entrancy */
 +    MemReentrancyGuard mem_reentrancy_guard;
 };
 struct DeviceListener {
 diff --git a/softmmu/memory.c b/softmmu/memory.c
 index b1a6cae6f5..b7b3386e9d 100644
 --- a/softmmu/memory.c
 +++ b/softmmu/memory.c
@@ -542,6 +542,18 @@ static MemTxResult access_with_adjusted_size(hwaddr addr,
         access_size_max = 4;
     }
 +    /* Do not allow more than one simultaneous access to a device's IO Regions */
 +    if (mr->dev && !mr->disable_reentrancy_guard &&
 +        !mr->ram_device && !mr->ram && !mr->rom_device && !mr->readonly) {
 +        if (mr->dev->mem_reentrancy_guard.engaged_in_io) {
 +            warn_report_once("Blocked re-entrant IO on MemoryRegion: "
 +                             "%s at addr: 0x%" HWADDR_PRIX,
 +                             memory_region_name(mr), addr);
 +            return MEMTX_ACCESS_ERROR;
 +        }
 +        mr->dev->mem_reentrancy_guard.engaged_in_io = true;
 +    }
 +
     /* FIXME: support unaligned access? */
     access_size = MAX(MIN(size, access_size_max), access_size_min);
     access_mask = MAKE_64BIT_MASK(0, access_size * 8);
@@ -556,6 +568,9 @@ static MemTxResult access_with_adjusted_size(hwaddr addr,
                         access_mask, attrs);
         }
     }
 +    if (mr->dev) {
 +        mr->dev->mem_reentrancy_guard.engaged_in_io = false;
 +    }
     return r;
 }
@@ -1170,6 +1185,7 @@ static void memory_region_do_init(MemoryRegion *mr,
     }
     mr->name = g_strdup(name);
     mr->owner = owner;
 +    mr->dev = (DeviceState *) object_dynamic_cast(mr->owner, TYPE_DEVICE);
     mr->ram_block = NULL;
     if (name) {
--- a/debian/patches/extra/0006-block-block-backend-blk_set_enable_write_cache-is-IO.patch
+++ b/debian/patches/extra/0006-block-block-backend-blk_set_enable_write_cache-is-IO.patch
@@ -0,0 +1,77 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date: Thu, 27 Oct 2022 03:27:26 -0400
 Subject: [PATCH] block/block-backend: blk_set_enable_write_cache is IO_CODE
 blk_set_enable_write_cache() is defined as GLOBAL_STATE_CODE
 but can be invoked from iothreads when handling scsi requests.
 This triggers an assertion failure:
 0x00007fd6c3515ce1 in raise () from /lib/x86_64-linux-gnu/libc.so.6
 0x00007fd6c34ff537 in abort () from /lib/x86_64-linux-gnu/libc.so.6
 0x00007fd6c34ff40f in ?? () from /lib/x86_64-linux-gnu/libc.so.6
 0x00007fd6c350e662 in __assert_fail () from /lib/x86_64-linux-gnu/libc.so.6
 0x000056149e2cea03 in blk_set_enable_write_cache (wce=true, blk=0x5614a01c27f0)
   at ../src/block/block-backend.c:1949
 0x000056149e2d0a67 in blk_set_enable_write_cache (blk=0x5614a01c27f0,
   wce=<optimized out>) at ../src/block/block-backend.c:1951
 0x000056149dfe9c59 in scsi_disk_apply_mode_select (p=0x7fd6b400c00e "\004",
   page=<optimized out>, s=<optimized out>) at ../src/hw/scsi/scsi-disk.c:1520
 mode_select_pages (change=true, len=18, p=0x7fd6b400c00e "\004", r=0x7fd6b4001ff0)
   at ../src/hw/scsi/scsi-disk.c:1570
 scsi_disk_emulate_mode_select (inbuf=<optimized out>, r=0x7fd6b4001ff0) at
   ../src/hw/scsi/scsi-disk.c:1640
 scsi_disk_emulate_write_data (req=0x7fd6b4001ff0) at ../src/hw/scsi/scsi-disk.c:1934
 0x000056149e18ff16 in virtio_scsi_handle_cmd_req_submit (req=<optimized out>,
   req=<optimized out>, s=0x5614a12f16b0) at ../src/hw/scsi/virtio-scsi.c:719
 virtio_scsi_handle_cmd_vq (vq=0x7fd6bab92140, s=0x5614a12f16b0) at
   ../src/hw/scsi/virtio-scsi.c:761
 virtio_scsi_handle_cmd (vq=<optimized out>, vdev=<optimized out>) at
   ../src/hw/scsi/virtio-scsi.c:775
 virtio_scsi_handle_cmd (vdev=0x5614a12f16b0, vq=0x7fd6bab92140) at
   ../src/hw/scsi/virtio-scsi.c:765
 0x000056149e1a8aa6 in virtio_queue_notify_vq (vq=0x7fd6bab92140) at
   ../src/hw/virtio/virtio.c:2365
 0x000056149e3ccea5 in aio_dispatch_handler (ctx=ctx@entry=0x5614a01babe0,
   node=<optimized out>) at ../src/util/aio-posix.c:369
 0x000056149e3cd868 in aio_dispatch_ready_handlers (ready_list=0x7fd6c09b2680,
   ctx=0x5614a01babe0) at ../src/util/aio-posix.c:399
 aio_poll (ctx=0x5614a01babe0, blocking=blocking@entry=true) at
   ../src/util/aio-posix.c:713
 0x000056149e2a7796 in iothread_run (opaque=opaque@entry=0x56149ffde500) at
   ../src/iothread.c:67
 0x000056149e3d0859 in qemu_thread_start (args=0x7fd6c09b26f0) at
   ../src/util/qemu-thread-posix.c:504
 0x00007fd6c36b9ea7 in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0
 0x00007fd6c35d9aef in clone () from /lib/x86_64-linux-gnu/libc.so.6
 Changing GLOBAL_STATE_CODE in IO_CODE is allowed, since GSC callers are
 allowed to call IO_CODE.
 Resolves: #1272
 Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Message-Id: <20221027072726.2681500-1-eesposit@redhat.com>
 Reviewed-by: Kevin Wolf <kwolf@redhat.com>
 Reviewed-by: Hanna Reitz <hreitz@redhat.com>
 Tested-by: Antoine Damhet <antoine.damhet@shadow.tech>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit be8da05b5ed8fb546731b9edb997f303f272bad8)
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
 block/block-backend.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/block/block-backend.c b/block/block-backend.c
 index d4a5df2ac2..1b563e628b 100644
 --- a/block/block-backend.c
 +++ b/block/block-backend.c
@@ -1946,7 +1946,7 @@ bool blk_enable_write_cache(BlockBackend *blk)
 void blk_set_enable_write_cache(BlockBackend *blk, bool wce)
 {
 -    GLOBAL_STATE_CODE();
 +    IO_CODE();
     blk->enable_write_cache = wce;
 }
--- a/debian/patches/extra/0006-lsi53c895a-disable-reentrancy-detection-for-script-R.patch
+++ b/debian/patches/extra/0006-lsi53c895a-disable-reentrancy-detection-for-script-R.patch
@@ -1,39 +0,0 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Alexander Bulekov <alxndr@bu.edu>
 Date: Thu, 27 Apr 2023 17:10:10 -0400
 Subject: [PATCH] lsi53c895a: disable reentrancy detection for script RAM
 As the code is designed to use the memory APIs to access the script ram,
 disable reentrancy checks for the pseudo-RAM ram_io MemoryRegion.
 In the future, ram_io may be converted from an IO to a proper RAM MemoryRegion.
 Reported-by: Fiona Ebner <f.ebner@proxmox.com>
 Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
 Reviewed-by: Thomas Huth <thuth@redhat.com>
 Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
 Message-Id: <20230427211013.2994127-6-alxndr@bu.edu>
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 (cherry-picked from commit bfd6e7ae6a72b84e2eb9574f56e6ec037f05182c)
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 hw/scsi/lsi53c895a.c | 6 ++++++
 1 file changed, 6 insertions(+)
 diff --git a/hw/scsi/lsi53c895a.c b/hw/scsi/lsi53c895a.c
 index bbf32d3f73..17af67935f 100644
 --- a/hw/scsi/lsi53c895a.c
 +++ b/hw/scsi/lsi53c895a.c
@@ -2313,6 +2313,12 @@ static void lsi_scsi_realize(PCIDevice *dev, Error **errp)
     memory_region_init_io(&s->io_io, OBJECT(s), &lsi_io_ops, s,
                           "lsi-io", 256);
 +    /*
 +     * Since we use the address-space API to interact with ram_io, disable the
 +     * re-entrancy guard.
 +     */
 +    s->ram_io.disable_reentrancy_guard = true;
 +
     address_space_init(&s->pci_io_as, pci_address_space_io(dev), "lsi-pci-io");
     qdev_init_gpio_out(d, &s->ext_irq, 1);
--- a/debian/patches/extra/0007-bcm2835_property-disable-reentrancy-detection-for-io.patch
+++ b/debian/patches/extra/0007-bcm2835_property-disable-reentrancy-detection-for-io.patch
@@ -1,37 +0,0 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Alexander Bulekov <alxndr@bu.edu>
 Date: Thu, 27 Apr 2023 17:10:11 -0400
 Subject: [PATCH] bcm2835_property: disable reentrancy detection for iomem
 As the code is designed for re-entrant calls from bcm2835_property to
 bcm2835_mbox and back into bcm2835_property, mark iomem as
 reentrancy-safe.
 Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
 Reviewed-by: Thomas Huth <thuth@redhat.com>
 Message-Id: <20230427211013.2994127-7-alxndr@bu.edu>
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 (cherry-picked from commit 985c4a4e547afb9573b6bd6843d20eb2c3d1d1cd)
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 hw/misc/bcm2835_property.c | 7 +++++++
 1 file changed, 7 insertions(+)
 diff --git a/hw/misc/bcm2835_property.c b/hw/misc/bcm2835_property.c
 index 890ae7bae5..de056ea2df 100644
 --- a/hw/misc/bcm2835_property.c
 +++ b/hw/misc/bcm2835_property.c
@@ -382,6 +382,13 @@ static void bcm2835_property_init(Object *obj)
     memory_region_init_io(&s->iomem, OBJECT(s), &bcm2835_property_ops, s,
                           TYPE_BCM2835_PROPERTY, 0x10);
 +
 +    /*
 +     * bcm2835_property_ops call into bcm2835_mbox, which in-turn reads from
 +     * iomem. As such, mark iomem as re-entracy safe.
 +     */
 +    s->iomem.disable_reentrancy_guard = true;
 +
     sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
     sysbus_init_irq(SYS_BUS_DEVICE(s), &s->mbox_irq);
 }
--- a/debian/patches/extra/0008-raven-disable-reentrancy-detection-for-iomem.patch
+++ b/debian/patches/extra/0008-raven-disable-reentrancy-detection-for-iomem.patch
@@ -1,35 +0,0 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Alexander Bulekov <alxndr@bu.edu>
 Date: Thu, 27 Apr 2023 17:10:12 -0400
 Subject: [PATCH] raven: disable reentrancy detection for iomem
 As the code is designed for re-entrant calls from raven_io_ops to
 pci-conf, mark raven_io_ops as reentrancy-safe.
 Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
 Message-Id: <20230427211013.2994127-8-alxndr@bu.edu>
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 (cherry-picked from commit 6dad5a6810d9c60ca320d01276f6133bbcfa1fc7)
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 hw/pci-host/raven.c | 7 +++++++
 1 file changed, 7 insertions(+)
 diff --git a/hw/pci-host/raven.c b/hw/pci-host/raven.c
 index 072ffe3c5e..9a11ac4b2b 100644
 --- a/hw/pci-host/raven.c
 +++ b/hw/pci-host/raven.c
@@ -294,6 +294,13 @@ static void raven_pcihost_initfn(Object *obj)
     memory_region_init(&s->pci_memory, obj, "pci-memory", 0x3f000000);
     address_space_init(&s->pci_io_as, &s->pci_io, "raven-io");
 +    /*
 +     * Raven's raven_io_ops use the address-space API to access pci-conf-idx
 +     * (which is also owned by the raven device). As such, mark the
 +     * pci_io_non_contiguous as re-entrancy safe.
 +     */
 +    s->pci_io_non_contiguous.disable_reentrancy_guard = true;
 +
     /* CPU address space */
     memory_region_add_subregion(address_space_mem, PCI_IO_BASE_ADDR,
                                 &s->pci_io);
--- a/debian/patches/extra/0009-apic-disable-reentrancy-detection-for-apic-msi.patch
+++ b/debian/patches/extra/0009-apic-disable-reentrancy-detection-for-apic-msi.patch
@@ -1,36 +0,0 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Alexander Bulekov <alxndr@bu.edu>
 Date: Thu, 27 Apr 2023 17:10:13 -0400
 Subject: [PATCH] apic: disable reentrancy detection for apic-msi
 As the code is designed for re-entrant calls to apic-msi, mark apic-msi
 as reentrancy-safe.
 Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
 Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
 Message-Id: <20230427211013.2994127-9-alxndr@bu.edu>
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 (cherry-picked from commit 50795ee051a342c681a9b45671c552fbd6274db8)
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 hw/intc/apic.c | 7 +++++++
 1 file changed, 7 insertions(+)
 diff --git a/hw/intc/apic.c b/hw/intc/apic.c
 index 20b5a94073..ac3d47d231 100644
 --- a/hw/intc/apic.c
 +++ b/hw/intc/apic.c
@@ -885,6 +885,13 @@ static void apic_realize(DeviceState *dev, Error **errp)
     memory_region_init_io(&s->io_memory, OBJECT(s), &apic_io_ops, s, "apic-msi",
                           APIC_SPACE_SIZE);
 +    /*
 +     * apic-msi's apic_mem_write can call into ioapic_eoi_broadcast, which can
 +     * write back to apic-msi. As such mark the apic-msi region re-entrancy
 +     * safe.
 +     */
 +    s->io_memory.disable_reentrancy_guard = true;
 +
     s->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, apic_timer, s);
     local_apics[s->id] = s;
--- a/debian/patches/extra/0010-migration-block-dirty-bitmap-fix-loading-bitmap-when.patch
+++ b/debian/patches/extra/0010-migration-block-dirty-bitmap-fix-loading-bitmap-when.patch
@@ -1,48 +0,0 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Fiona Ebner <f.ebner@proxmox.com>
 Date: Fri, 28 Jul 2023 10:47:48 +0200
 Subject: [PATCH] migration/block-dirty-bitmap: fix loading bitmap when there
 is an iothread
 The bdrv_create_dirty_bitmap() function (which is also called by
 bdrv_dirty_bitmap_create_successor()) uses bdrv_getlength(bs). This is
 a wrapper around a coroutine, and thus uses bdrv_poll_co(). Polling
 tries to release the AioContext which will trigger an assert() if it
 hasn't been acquired before.
 The issue does not happen for migration, because there we are in a
 coroutine already, so the wrapper will just call bdrv_co_getlength()
 directly without polling.
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 migration/block-dirty-bitmap.c | 6 ++++++
 1 file changed, 6 insertions(+)
 diff --git a/migration/block-dirty-bitmap.c b/migration/block-dirty-bitmap.c
 index fe73aa94b1..7eaf498439 100644
 --- a/migration/block-dirty-bitmap.c
 +++ b/migration/block-dirty-bitmap.c
@@ -805,8 +805,11 @@ static int dirty_bitmap_load_start(QEMUFile *f, DBMLoadState *s)
                      "destination", bdrv_dirty_bitmap_name(s->bitmap));
         return -EINVAL;
     } else {
 +        AioContext *ctx = bdrv_get_aio_context(s->bs);
 +        aio_context_acquire(ctx);
         s->bitmap = bdrv_create_dirty_bitmap(s->bs, granularity,
                                              s->bitmap_name, &local_err);
 +        aio_context_release(ctx);
         if (!s->bitmap) {
             error_report_err(local_err);
             return -EINVAL;
@@ -833,7 +836,10 @@ static int dirty_bitmap_load_start(QEMUFile *f, DBMLoadState *s)
     bdrv_disable_dirty_bitmap(s->bitmap);
     if (flags & DIRTY_BITMAP_MIG_START_FLAG_ENABLED) {
 +        AioContext *ctx = bdrv_get_aio_context(s->bs);
 +        aio_context_acquire(ctx);
         bdrv_dirty_bitmap_create_successor(s->bitmap, &local_err);
 +        aio_context_release(ctx);
         if (local_err) {
             error_report_err(local_err);
             return -EINVAL;
--- a/debian/patches/extra/0011-vhost-fix-the-fd-leak.patch
+++ b/debian/patches/extra/0011-vhost-fix-the-fd-leak.patch
@@ -1,29 +0,0 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Li Feng <fengli@smartx.com>
 Date: Mon, 31 Jul 2023 20:10:06 +0800
 Subject: [PATCH] vhost: fix the fd leak
 When the vhost-user reconnect to the backend, the notifer should be
 cleanup. Otherwise, the fd resource will be exhausted.
 Fixes: f9a09ca3ea ("vhost: add support for configure interrupt")
 Signed-off-by: Li Feng <fengli@smartx.com>
 Reviewed-by: Raphael Norwitz <raphael.norwitz@nutanix.com>
 ---
 hw/virtio/vhost.c | 2 ++
 1 file changed, 2 insertions(+)
 diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
 index a266396576..8e3311781f 100644
 --- a/hw/virtio/vhost.c
 +++ b/hw/virtio/vhost.c
@@ -2034,6 +2034,8 @@ void vhost_dev_stop(struct vhost_dev *hdev, VirtIODevice *vdev, bool vrings)
     event_notifier_test_and_clear(
         &hdev->vqs[VHOST_QUEUE_NUM_CONFIG_INR].masked_config_notifier);
     event_notifier_test_and_clear(&vdev->config_notifier);
 +    event_notifier_cleanup(
 +        &hdev->vqs[VHOST_QUEUE_NUM_CONFIG_INR].masked_config_notifier);
     trace_vhost_dev_stop(hdev, vdev->name, vrings);
--- a/debian/patches/extra/0012-hw-ide-reset-cancel-async-DMA-operation-before-reset.patch
+++ b/debian/patches/extra/0012-hw-ide-reset-cancel-async-DMA-operation-before-reset.patch
@@ -1,100 +0,0 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Fiona Ebner <f.ebner@proxmox.com>
 Date: Thu, 24 Aug 2023 11:22:21 +0200
 Subject: [PATCH] hw/ide: reset: cancel async DMA operation before reseting
 state
 If there is a pending DMA operation during ide_bus_reset(), the fact
 that the IDEstate is already reset before the operation is canceled
 can be problematic. In particular, ide_dma_cb() might be called and
 then use the reset IDEstate which contains the signature after the
 reset. When used to construct the IO operation this leads to
 ide_get_sector() returning 0 and nsector being 1. This is particularly
 bad, because a write command will thus destroy the first sector which
 often contains a partition table or similar.
 Traces showing the unsolicited write happening with IDEstate
 0x5595af6949d0 being used after reset:
 > ahci_port_write ahci(0x5595af6923f0)[0]: port write [reg:PxSCTL] @ 0x2c: 0x00000300
 > ahci_reset_port ahci(0x5595af6923f0)[0]: reset port
 > ide_reset IDEstate 0x5595af6949d0
 > ide_reset IDEstate 0x5595af694da8
 > ide_bus_reset_aio aio_cancel
 > dma_aio_cancel dbs=0x7f64600089a0
 > dma_blk_cb dbs=0x7f64600089a0 ret=0
 > dma_complete dbs=0x7f64600089a0 ret=0 cb=0x5595acd40b30
 > ahci_populate_sglist ahci(0x5595af6923f0)[0]
 > ahci_dma_prepare_buf ahci(0x5595af6923f0)[0]: prepare buf limit=512 prepared=512
 > ide_dma_cb IDEState 0x5595af6949d0; sector_num=0 n=1 cmd=DMA WRITE
 > dma_blk_io dbs=0x7f6420802010 bs=0x5595ae2c6c30 offset=0 to_dev=1
 > dma_blk_cb dbs=0x7f6420802010 ret=0
 > (gdb) p *qiov
 > $11 = {iov = 0x7f647c76d840, niov = 1, {{nalloc = 1, local_iov = {iov_base = 0x0,
 >       iov_len = 512}}, {__pad = "\001\000\000\000\000\000\000\000\000\000\000",
 >       size = 512}}}
 > (gdb) bt
 > #0  blk_aio_pwritev (blk=0x5595ae2c6c30, offset=0, qiov=0x7f6420802070, flags=0,
 >     cb=0x5595ace6f0b0 <dma_blk_cb>, opaque=0x7f6420802010)
 >     at ../block/block-backend.c:1682
 > #1  0x00005595ace6f185 in dma_blk_cb (opaque=0x7f6420802010, ret=<optimized out>)
 >     at ../softmmu/dma-helpers.c:179
 > #2  0x00005595ace6f778 in dma_blk_io (ctx=0x5595ae0609f0,
 >     sg=sg@entry=0x5595af694d00, offset=offset@entry=0, align=align@entry=512,
 >     io_func=io_func@entry=0x5595ace6ee30 <dma_blk_write_io_func>,
 >     io_func_opaque=io_func_opaque@entry=0x5595ae2c6c30,
 >     cb=0x5595acd40b30 <ide_dma_cb>, opaque=0x5595af6949d0,
 >     dir=DMA_DIRECTION_TO_DEVICE) at ../softmmu/dma-helpers.c:244
 > #3  0x00005595ace6f90a in dma_blk_write (blk=0x5595ae2c6c30,
 >     sg=sg@entry=0x5595af694d00, offset=offset@entry=0, align=align@entry=512,
 >     cb=cb@entry=0x5595acd40b30 <ide_dma_cb>, opaque=opaque@entry=0x5595af6949d0)
 >     at ../softmmu/dma-helpers.c:280
 > #4  0x00005595acd40e18 in ide_dma_cb (opaque=0x5595af6949d0, ret=<optimized out>)
 >     at ../hw/ide/core.c:953
 > #5  0x00005595ace6f319 in dma_complete (ret=0, dbs=0x7f64600089a0)
 >     at ../softmmu/dma-helpers.c:107
 > #6  dma_blk_cb (opaque=0x7f64600089a0, ret=0) at ../softmmu/dma-helpers.c:127
 > #7  0x00005595ad12227d in blk_aio_complete (acb=0x7f6460005b10)
 >     at ../block/block-backend.c:1527
 > #8  blk_aio_complete (acb=0x7f6460005b10) at ../block/block-backend.c:1524
 > #9  blk_aio_write_entry (opaque=0x7f6460005b10) at ../block/block-backend.c:1594
 > #10 0x00005595ad258cfb in coroutine_trampoline (i0=<optimized out>,
 >     i1=<optimized out>) at ../util/coroutine-ucontext.c:177
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 hw/ide/core.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)
 diff --git a/hw/ide/core.c b/hw/ide/core.c
 index 08e1f0c3d7..148fccdef2 100644
 --- a/hw/ide/core.c
 +++ b/hw/ide/core.c
@@ -2513,19 +2513,19 @@ static void ide_dummy_transfer_stop(IDEState *s)
 void ide_bus_reset(IDEBus *bus)
 {
 -    bus->unit = 0;
 -    bus->cmd = 0;
 -    ide_reset(&bus->ifs[0]);
 -    ide_reset(&bus->ifs[1]);
 -    ide_clear_hob(bus);
 -
 -    /* pending async DMA */
 +    /* pending async DMA - needs the IDEState before it is reset */
     if (bus->dma->aiocb) {
         trace_ide_bus_reset_aio();
         blk_aio_cancel(bus->dma->aiocb);
         bus->dma->aiocb = NULL;
     }
 +    bus->unit = 0;
 +    bus->cmd = 0;
 +    ide_reset(&bus->ifs[0]);
 +    ide_reset(&bus->ifs[1]);
 +    ide_clear_hob(bus);
 +
     /* reset dma provider too */
     if (bus->dma->ops->reset) {
         bus->dma->ops->reset(bus->dma);
--- a/debian/patches/pve-qemu-7.1-vitastor.patch
+++ b/debian/patches/pve-qemu-7.1-vitastor.patch
@@ -1,8 +1,8 @@
-diff --git a/block/meson.build b/block/meson.build
+Index: qemu/block/meson.build
-index 382bec0e7d..af6207dbce 100644
+===================================================================
--- a/block/meson.build
+--- qemu.orig/block/meson.build
-+++ b/block/meson.build
+++ qemu/block/meson.build
-@@ -114,6 +114,7 @@ foreach m : [
+@@ -111,6 +111,7 @@ foreach m : [
   [libnfs, 'nfs', files('nfs.c')],
   [libssh, 'ssh', files('ssh.c')],
   [rbd, 'rbd', files('rbd.c')],
@@ -10,11 +10,11 @@ index 382bec0e7d..af6207dbce 100644
 ]
   if m[0].found()
     module_ss = ss.source_set()
-diff --git a/meson.build b/meson.build
+Index: qemu/meson.build
-index c44d05a13f..ebedb42843 100644
+===================================================================
--- a/meson.build
+--- qemu.orig/meson.build
-+++ b/meson.build
+++ qemu/meson.build
-@@ -1028,6 +1028,26 @@ if not get_option('rbd').auto() or have_block
+@@ -967,6 +967,26 @@ if not get_option('rbd').auto() or have_
   endif
 endif
@@ -41,7 +41,7 @@ index c44d05a13f..ebedb42843 100644
 glusterfs = not_found
 glusterfs_ftruncate_has_stat = false
 glusterfs_iocb_has_stat = false
-@@ -1882,6 +1902,7 @@ endif
+@@ -1802,6 +1822,7 @@ config_host_data.set('CONFIG_NUMA', numa
 config_host_data.set('CONFIG_OPENGL', opengl.found())
 config_host_data.set('CONFIG_PROFILER', get_option('profiler'))
 config_host_data.set('CONFIG_RBD', rbd.found())
@@ -49,7 +49,7 @@ index c44d05a13f..ebedb42843 100644
 config_host_data.set('CONFIG_RDMA', rdma.found())
 config_host_data.set('CONFIG_SDL', sdl.found())
 config_host_data.set('CONFIG_SDL_IMAGE', sdl_image.found())
-@@ -4020,6 +4041,7 @@ if spice_protocol.found()
+@@ -3965,6 +3986,7 @@ if spice_protocol.found()
   summary_info += {'  spice server support': spice}
 endif
 summary_info += {'rbd support':       rbd}
@@ -57,11 +57,11 @@ index c44d05a13f..ebedb42843 100644
 summary_info += {'smartcard support': cacard}
 summary_info += {'U2F support':       u2f}
 summary_info += {'libusb':            libusb}
-diff --git a/meson_options.txt b/meson_options.txt
+Index: qemu/meson_options.txt
-index fc9447d267..c4ac55c283 100644
+===================================================================
--- a/meson_options.txt
+--- qemu.orig/meson_options.txt
-+++ b/meson_options.txt
+++ qemu/meson_options.txt
-@@ -173,6 +173,8 @@ option('lzo', type : 'feature', value : 'auto',
+@@ -167,6 +167,8 @@ option('lzo', type : 'feature', value :
        description: 'lzo compression support')
 option('rbd', type : 'feature', value : 'auto',
        description: 'Ceph block device driver')
@@ -70,24 +70,23 @@ index fc9447d267..c4ac55c283 100644
 option('opengl', type : 'feature', value : 'auto',
        description: 'OpenGL support')
 option('rdma', type : 'feature', value : 'auto',
-diff --git a/qapi/block-core.json b/qapi/block-core.json
+Index: qemu/qapi/block-core.json
-index c05ad0c07e..f5eb701604 100644
+===================================================================
--- a/qapi/block-core.json
+--- qemu.orig/qapi/block-core.json
-+++ b/qapi/block-core.json
+++ qemu/qapi/block-core.json
-@@ -3308,7 +3308,7 @@
+@@ -3209,7 +3209,7 @@
-             'raw', 'rbd',
+             'preallocate', 'qcow', 'qcow2', 'qed', 'quorum', 'raw', 'rbd',
             { 'name': 'replication', 'if': 'CONFIG_REPLICATION' },
             'pbs',
-            'ssh', 'throttle', 'vdi', 'vhdx',
+-            'ssh', 'throttle', 'vdi', 'vhdx', 'vmdk', 'vpc', 'vvfat' ] }
-+            'ssh', 'throttle', 'vdi', 'vhdx', 'vitastor',
+            'ssh', 'throttle', 'vdi', 'vhdx', 'vitastor', 'vmdk', 'vpc', 'vvfat' ] }
-             { 'name': 'virtio-blk-vfio-pci', 'if': 'CONFIG_BLKIO' },
+ 
-             { 'name': 'virtio-blk-vhost-user', 'if': 'CONFIG_BLKIO' },
+ ##
-             { 'name': 'virtio-blk-vhost-vdpa', 'if': 'CONFIG_BLKIO' },
+ # @BlockdevOptionsFile:
-@@ -4338,6 +4338,28 @@
+@@ -4149,6 +4149,28 @@
             '*key-secret': 'str',
             '*server': ['InetSocketAddressBase'] } }
-+##
+ ##
 +# @BlockdevOptionsVitastor:
 +#
 +# Driver specific block device options for vitastor
@@ -109,22 +108,22 @@ index c05ad0c07e..f5eb701604 100644
 +            '*etcd-host': 'str',
 +            '*etcd-prefix': 'str' } }
 +
- ##
+##
 # @ReplicationMode:
 #
-@@ -4787,6 +4809,7 @@
+ # An enumeration of replication modes.
@@ -4593,6 +4615,7 @@
       'throttle':   'BlockdevOptionsThrottle',
       'vdi':        'BlockdevOptionsGenericFormat',
       'vhdx':       'BlockdevOptionsGenericFormat',
 +      'vitastor':   'BlockdevOptionsVitastor',
-       'virtio-blk-vfio-pci':
+       'vmdk':       'BlockdevOptionsGenericCOWFormat',
-                     { 'type': 'BlockdevOptionsVirtioBlkVfioPci',
+       'vpc':        'BlockdevOptionsGenericFormat',
-                       'if': 'CONFIG_BLKIO' },
+       'vvfat':      'BlockdevOptionsVVFAT'
-@@ -5187,6 +5210,17 @@
+@@ -4985,6 +5008,17 @@
             '*cluster-size' :   'size',
             '*encrypt' :        'RbdEncryptionCreateOptions' } }
-+##
+ ##
 +# @BlockdevCreateOptionsVitastor:
 +#
 +# Driver specific image creation options for Vitastor.
@@ -135,10 +134,11 @@ index c05ad0c07e..f5eb701604 100644
 +  'data': { 'location':         'BlockdevOptionsVitastor',
 +            'size':             'size' } }
 +
- ##
+##
 # @BlockdevVmdkSubformat:
 #
-@@ -5385,6 +5419,7 @@
+ # Subformat options for VMDK images
@@ -5182,6 +5216,7 @@
       'ssh':            'BlockdevCreateOptionsSsh',
       'vdi':            'BlockdevCreateOptionsVdi',
       'vhdx':           'BlockdevCreateOptionsVhdx',
@@ -146,11 +146,11 @@ index c05ad0c07e..f5eb701604 100644
       'vmdk':           'BlockdevCreateOptionsVmdk',
       'vpc':            'BlockdevCreateOptionsVpc'
   } }
-diff --git a/scripts/ci/org.centos/stream/8/x86_64/configure b/scripts/ci/org.centos/stream/8/x86_64/configure
+Index: qemu/scripts/ci/org.centos/stream/8/x86_64/configure
-index 6e8983f39c..1b0b9fcf3e 100755
+===================================================================
--- a/scripts/ci/org.centos/stream/8/x86_64/configure
+--- qemu.orig/scripts/ci/org.centos/stream/8/x86_64/configure
-+++ b/scripts/ci/org.centos/stream/8/x86_64/configure
+++ qemu/scripts/ci/org.centos/stream/8/x86_64/configure
-@@ -32,7 +32,7 @@
+@@ -31,7 +31,7 @@
 --with-git=meson \
 --with-git-submodules=update \
 --target-list="x86_64-softmmu" \
@@ -167,27 +167,6 @@ index 6e8983f39c..1b0b9fcf3e 100755
 --enable-rdma \
 --enable-seccomp \
 --enable-snappy \
 diff --git a/scripts/meson-buildoptions.sh b/scripts/meson-buildoptions.sh
 index 009fab1515..95914e6ebc 100644
 --- a/scripts/meson-buildoptions.sh
 +++ b/scripts/meson-buildoptions.sh
@@ -144,6 +144,7 @@ meson_options_help() {
   printf "%s\n" '  qed             qed image format support'
   printf "%s\n" '  qga-vss         build QGA VSS support (broken with MinGW)'
   printf "%s\n" '  rbd             Ceph block device driver'
 +  printf "%s\n" '  vitastor        Vitastor block device driver'
   printf "%s\n" '  rdma            Enable RDMA-based migration'
   printf "%s\n" '  replication     replication support'
   printf "%s\n" '  sdl             SDL user interface'
@@ -392,6 +393,8 @@ _meson_option_parse() {
     --disable-qom-cast-debug) printf "%s" -Dqom_cast_debug=false ;;
     --enable-rbd) printf "%s" -Drbd=enabled ;;
     --disable-rbd) printf "%s" -Drbd=disabled ;;
 +    --enable-vitastor) printf "%s" -Dvitastor=enabled ;;
 +    --disable-vitastor) printf "%s" -Dvitastor=disabled ;;
     --enable-rdma) printf "%s" -Drdma=enabled ;;
     --disable-rdma) printf "%s" -Drdma=disabled ;;
     --enable-replication) printf "%s" -Dreplication=enabled ;;
 Index: a/block/vitastor.c
 ===================================================================
 --- /dev/null
--- a/debian/patches/pve/0001-PVE-Config-block-file-change-locking-default-to-off.patch
+++ b/debian/patches/pve/0001-PVE-Config-block-file-change-locking-default-to-off.patch
@@ -14,7 +14,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 1 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/block/file-posix.c b/block/file-posix.c
-index c2dee3f056..9681bd0434 100644
+index 48cd096624..3d60b80286 100644
 --- a/block/file-posix.c
 +++ b/block/file-posix.c
@@ -553,7 +553,7 @@ static QemuOptsList raw_runtime_opts = {
--- a/debian/patches/pve/0002-PVE-Config-Adjust-network-script-path-to-etc-kvm.patch
+++ b/debian/patches/pve/0002-PVE-Config-Adjust-network-script-path-to-etc-kvm.patch
@@ -9,10 +9,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 1 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/include/net/net.h b/include/net/net.h
-index 1448d00afb..d1601d32c1 100644
+index 523136c7ac..c27859b4f6 100644
 --- a/include/net/net.h
 +++ b/include/net/net.h
-@@ -258,8 +258,8 @@ void netdev_add(QemuOpts *opts, Error **errp);
+@@ -226,8 +226,8 @@ void netdev_add(QemuOpts *opts, Error **errp);
 int net_hub_id_for_client(NetClientState *nc, int *id);
 NetClientState *net_hub_port_find(int hub_id);
--- a/debian/patches/pve/0003-PVE-Config-set-the-CPU-model-to-kvm64-32-instead-of-.patch
+++ b/debian/patches/pve/0003-PVE-Config-set-the-CPU-model-to-kvm64-32-instead-of-.patch
@@ -10,10 +10,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 1 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/target/i386/cpu.h b/target/i386/cpu.h
-index d243e290d3..3489b05ec4 100644
+index 82004b65b9..4868db8f94 100644
 --- a/target/i386/cpu.h
 +++ b/target/i386/cpu.h
-@@ -2203,9 +2203,9 @@ uint64_t cpu_get_tsc(CPUX86State *env);
+@@ -2133,9 +2133,9 @@ uint64_t cpu_get_tsc(CPUX86State *env);
 #define CPU_RESOLVING_TYPE TYPE_X86_CPU
 #ifdef TARGET_X86_64
--- a/debian/patches/pve/0004-PVE-Config-ui-spice-default-to-pve-certificates.patch
+++ b/debian/patches/pve/0004-PVE-Config-ui-spice-default-to-pve-certificates.patch
@@ -9,10 +9,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 1 file changed, 9 insertions(+), 6 deletions(-)
 diff --git a/ui/spice-core.c b/ui/spice-core.c
-index 52a59386d7..b20c25aee0 100644
+index c3ac20ad43..37774f1c0a 100644
 --- a/ui/spice-core.c
 +++ b/ui/spice-core.c
-@@ -691,32 +691,35 @@ static void qemu_spice_init(void)
+@@ -689,32 +689,35 @@ static void qemu_spice_init(void)
     if (tls_port) {
         x509_dir = qemu_opt_get(opts, "x509-dir");
--- a/debian/patches/pve/0005-PVE-Config-glusterfs-no-default-logfile-if-daemonize.patch
+++ b/debian/patches/pve/0005-PVE-Config-glusterfs-no-default-logfile-if-daemonize.patch
@@ -9,10 +9,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 1 file changed, 11 insertions(+), 4 deletions(-)
 diff --git a/block/gluster.c b/block/gluster.c
-index 185a83e5e5..f11a40aa9e 100644
+index b60213ab80..93da76bc31 100644
 --- a/block/gluster.c
 +++ b/block/gluster.c
-@@ -43,7 +43,7 @@
+@@ -42,7 +42,7 @@
 #define GLUSTER_DEBUG_DEFAULT       4
 #define GLUSTER_DEBUG_MAX           9
 #define GLUSTER_OPT_LOGFILE         "logfile"
@@ -21,7 +21,7 @@ index 185a83e5e5..f11a40aa9e 100644
 /*
  * Several versions of GlusterFS (3.12? -> 6.0.1) fail when the transfer size
  * is greater or equal to 1024 MiB, so we are limiting the transfer size to 512
-@@ -425,6 +425,7 @@ static struct glfs *qemu_gluster_glfs_init(BlockdevOptionsGluster *gconf,
+@@ -424,6 +424,7 @@ static struct glfs *qemu_gluster_glfs_init(BlockdevOptionsGluster *gconf,
     int old_errno;
     SocketAddressList *server;
     unsigned long long port;
@@ -29,7 +29,7 @@ index 185a83e5e5..f11a40aa9e 100644
     glfs = glfs_find_preopened(gconf->volume);
     if (glfs) {
-@@ -467,9 +468,15 @@ static struct glfs *qemu_gluster_glfs_init(BlockdevOptionsGluster *gconf,
+@@ -466,9 +467,15 @@ static struct glfs *qemu_gluster_glfs_init(BlockdevOptionsGluster *gconf,
         }
     }
--- a/debian/patches/pve/0006-PVE-Config-rbd-block-rbd-disable-rbd_cache_writethro.patch
+++ b/debian/patches/pve/0006-PVE-Config-rbd-block-rbd-disable-rbd_cache_writethro.patch
@@ -18,10 +18,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 1 file changed, 2 insertions(+)
 diff --git a/block/rbd.c b/block/rbd.c
-index 978671411e..a4749f3b1b 100644
+index f826410f40..64a8d7d48b 100644
 --- a/block/rbd.c
 +++ b/block/rbd.c
-@@ -963,6 +963,8 @@ static int qemu_rbd_connect(rados_t *cluster, rados_ioctx_t *io_ctx,
+@@ -820,6 +820,8 @@ static int qemu_rbd_connect(rados_t *cluster, rados_ioctx_t *io_ctx,
         rados_conf_set(*cluster, "rbd_cache", "false");
     }
--- a/debian/patches/pve/0007-PVE-Up-qmp-add-get_link_status.patch
+++ b/debian/patches/pve/0007-PVE-Up-qmp-add-get_link_status.patch
@@ -0,0 +1,88 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Wolfgang Bumiller <w.bumiller@proxmox.com>
 Date: Mon, 6 Apr 2020 12:16:37 +0200
 Subject: [PATCH] PVE: [Up] qmp: add get_link_status
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
 net/net.c        | 27 +++++++++++++++++++++++++++
 qapi/net.json    | 15 +++++++++++++++
 qapi/pragma.json |  1 +
 3 files changed, 43 insertions(+)
 diff --git a/net/net.c b/net/net.c
 index 2db160e063..8329347891 100644
 --- a/net/net.c
 +++ b/net/net.c
@@ -1343,6 +1343,33 @@ void hmp_info_network(Monitor *mon, const QDict *qdict)
     }
 }
 +int64_t qmp_get_link_status(const char *name, Error **errp)
 +{
 +    NetClientState *ncs[MAX_QUEUE_NUM];
 +    NetClientState *nc;
 +    int queues;
 +    bool ret;
 +
 +    queues = qemu_find_net_clients_except(name, ncs,
 +                                          NET_CLIENT_DRIVER__MAX,
 +                                          MAX_QUEUE_NUM);
 +
 +    if (queues == 0) {
 +        error_set(errp, ERROR_CLASS_DEVICE_NOT_FOUND,
 +                  "Device '%s' not found", name);
 +        return (int64_t) -1;
 +    }
 +
 +    nc = ncs[0];
 +    ret = ncs[0]->link_down;
 +
 +    if (nc->peer->info->type == NET_CLIENT_DRIVER_NIC) {
 +      ret = ncs[0]->peer->link_down;
 +    }
 +
 +    return (int64_t) ret ? 0 : 1;
 +}
 +
 void colo_notify_filters_event(int event, Error **errp)
 {
     NetClientState *nc;
 diff --git a/qapi/net.json b/qapi/net.json
 index 75ba2cb989..a3c93ab88f 100644
 --- a/qapi/net.json
 +++ b/qapi/net.json
@@ -35,6 +35,21 @@
 ##
 { 'command': 'set_link', 'data': {'name': 'str', 'up': 'bool'} }
 +##
 +# @get_link_status:
 +#
 +# Get the current link state of the nics or nic.
 +#
 +# @name: name of the nic you get the state of
 +#
 +# Return: If link is up 1
 +#         If link is down 0
 +#         If an error occure an empty string.
 +#
 +# Notes: this is an Proxmox VE extension and not offical part of Qemu.
 +##
 +{ 'command': 'get_link_status', 'data': {'name': 'str'} , 'returns': 'int' }
 +
 ##
 # @netdev_add:
 #
 diff --git a/qapi/pragma.json b/qapi/pragma.json
 index 7f810b0e97..a2358e303a 100644
 --- a/qapi/pragma.json
 +++ b/qapi/pragma.json
@@ -26,6 +26,7 @@
         'system_wakeup' ],
     # Commands allowed to return a non-dictionary
     'command-returns-exceptions': [
 +        'get_link_status',
         'human-monitor-command',
         'qom-get',
         'query-tpm-models',
--- a/debian/patches/pve/0008-PVE-Up-glusterfs-allow-partial-reads.patch
+++ b/debian/patches/pve/0008-PVE-Up-glusterfs-allow-partial-reads.patch
@@ -16,10 +16,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 1 file changed, 9 insertions(+), 1 deletion(-)
 diff --git a/block/gluster.c b/block/gluster.c
-index f11a40aa9e..6756e6b886 100644
+index 93da76bc31..1079b6186b 100644
 --- a/block/gluster.c
 +++ b/block/gluster.c
-@@ -58,6 +58,7 @@ typedef struct GlusterAIOCB {
+@@ -57,6 +57,7 @@ typedef struct GlusterAIOCB {
     int ret;
     Coroutine *coroutine;
     AioContext *aio_context;
@@ -27,7 +27,7 @@ index f11a40aa9e..6756e6b886 100644
 } GlusterAIOCB;
 typedef struct BDRVGlusterState {
-@@ -753,8 +754,10 @@ static void gluster_finish_aiocb(struct glfs_fd *fd, ssize_t ret,
+@@ -752,8 +753,10 @@ static void gluster_finish_aiocb(struct glfs_fd *fd, ssize_t ret,
         acb->ret = 0; /* Success */
     } else if (ret < 0) {
         acb->ret = -errno; /* Read/Write failed */
@@ -39,7 +39,7 @@ index f11a40aa9e..6756e6b886 100644
     }
     aio_co_schedule(acb->aio_context, acb->coroutine);
-@@ -1021,6 +1024,7 @@ static coroutine_fn int qemu_gluster_co_pwrite_zeroes(BlockDriverState *bs,
+@@ -1022,6 +1025,7 @@ static coroutine_fn int qemu_gluster_co_pwrite_zeroes(BlockDriverState *bs,
     acb.ret = 0;
     acb.coroutine = qemu_coroutine_self();
     acb.aio_context = bdrv_get_aio_context(bs);
@@ -47,7 +47,7 @@ index f11a40aa9e..6756e6b886 100644
     ret = glfs_zerofill_async(s->fd, offset, bytes, gluster_finish_aiocb, &acb);
     if (ret < 0) {
-@@ -1201,9 +1205,11 @@ static coroutine_fn int qemu_gluster_co_rw(BlockDriverState *bs,
+@@ -1203,9 +1207,11 @@ static coroutine_fn int qemu_gluster_co_rw(BlockDriverState *bs,
     acb.aio_context = bdrv_get_aio_context(bs);
     if (write) {
@@ -59,7 +59,7 @@ index f11a40aa9e..6756e6b886 100644
         ret = glfs_preadv_async(s->fd, qiov->iov, qiov->niov, offset, 0,
                                 gluster_finish_aiocb, &acb);
     }
-@@ -1266,6 +1272,7 @@ static coroutine_fn int qemu_gluster_co_flush_to_disk(BlockDriverState *bs)
+@@ -1269,6 +1275,7 @@ static coroutine_fn int qemu_gluster_co_flush_to_disk(BlockDriverState *bs)
     acb.ret = 0;
     acb.coroutine = qemu_coroutine_self();
     acb.aio_context = bdrv_get_aio_context(bs);
@@ -67,7 +67,7 @@ index f11a40aa9e..6756e6b886 100644
     ret = glfs_fsync_async(s->fd, gluster_finish_aiocb, &acb);
     if (ret < 0) {
-@@ -1314,6 +1321,7 @@ static coroutine_fn int qemu_gluster_co_pdiscard(BlockDriverState *bs,
+@@ -1317,6 +1324,7 @@ static coroutine_fn int qemu_gluster_co_pdiscard(BlockDriverState *bs,
     acb.ret = 0;
     acb.coroutine = qemu_coroutine_self();
     acb.aio_context = bdrv_get_aio_context(bs);
--- a/debian/patches/pve/0009-PVE-Up-qemu-img-return-success-on-info-without-snaps.patch
+++ b/debian/patches/pve/0009-PVE-Up-qemu-img-return-success-on-info-without-snaps.patch
@@ -9,10 +9,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 1 file changed, 2 insertions(+), 1 deletion(-)
 diff --git a/qemu-img.c b/qemu-img.c
-index 9aeac69fa6..0919fac1f1 100644
+index 7d4b33b3da..bb36f42dd2 100644
 --- a/qemu-img.c
 +++ b/qemu-img.c
-@@ -3059,7 +3059,8 @@ static int img_info(int argc, char **argv)
+@@ -3010,7 +3010,8 @@ static int img_info(int argc, char **argv)
     list = collect_image_info_list(image_opts, filename, fmt, chain,
                                    force_share);
     if (!list) {
--- a/debian/patches/pve/0010-PVE-Up-qemu-img-dd-add-osize-and-read-from-to-stdin-.patch
+++ b/debian/patches/pve/0010-PVE-Up-qemu-img-dd-add-osize-and-read-from-to-stdin-.patch
@@ -54,10 +54,10 @@ index 1b1dab5b17..d1616c045a 100644
 DEF("info", img_info,
 diff --git a/qemu-img.c b/qemu-img.c
-index 0919fac1f1..c584de648c 100644
+index bb36f42dd2..74afcb79ef 100644
 --- a/qemu-img.c
 +++ b/qemu-img.c
-@@ -4885,10 +4885,12 @@ static int img_bitmap(int argc, char **argv)
+@@ -4826,10 +4826,12 @@ static int img_bitmap(int argc, char **argv)
 #define C_IF      04
 #define C_OF      010
 #define C_SKIP    020
@@ -70,7 +70,7 @@ index 0919fac1f1..c584de648c 100644
 };
 struct DdIo {
-@@ -4964,6 +4966,19 @@ static int img_dd_skip(const char *arg,
+@@ -4905,6 +4907,19 @@ static int img_dd_skip(const char *arg,
     return 0;
 }
@@ -90,7 +90,7 @@ index 0919fac1f1..c584de648c 100644
 static int img_dd(int argc, char **argv)
 {
     int ret = 0;
-@@ -5004,6 +5019,7 @@ static int img_dd(int argc, char **argv)
+@@ -4945,6 +4960,7 @@ static int img_dd(int argc, char **argv)
         { "if", img_dd_if, C_IF },
         { "of", img_dd_of, C_OF },
         { "skip", img_dd_skip, C_SKIP },
@@ -98,7 +98,7 @@ index 0919fac1f1..c584de648c 100644
         { NULL, NULL, 0 }
     };
     const struct option long_options[] = {
-@@ -5079,91 +5095,112 @@ static int img_dd(int argc, char **argv)
+@@ -5020,91 +5036,112 @@ static int img_dd(int argc, char **argv)
         arg = NULL;
     }
@@ -275,10 +275,10 @@ index 0919fac1f1..c584de648c 100644
     }
     if (dd.flags & C_SKIP && (in.offset > INT64_MAX / in.bsz ||
-@@ -5180,20 +5217,43 @@ static int img_dd(int argc, char **argv)
+@@ -5121,20 +5158,43 @@ static int img_dd(int argc, char **argv)
     in.buf = g_new(uint8_t, in.bsz);
-     for (out_pos = 0; in_pos < size; ) {
+     for (out_pos = 0; in_pos < size; block_count++) {
 +        int in_ret, out_ret;
         int bytes = (in_pos + in.bsz > size) ? size - in_pos : in.bsz;
 -
--- a/debian/patches/pve/0011-PVE-Up-qemu-img-dd-add-isize-parameter.patch
+++ b/debian/patches/pve/0011-PVE-Up-qemu-img-dd-add-isize-parameter.patch
@@ -16,10 +16,10 @@ Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 1 file changed, 25 insertions(+), 3 deletions(-)
 diff --git a/qemu-img.c b/qemu-img.c
-index c584de648c..a57ceeddfe 100644
+index 74afcb79ef..14594d44b6 100644
 --- a/qemu-img.c
 +++ b/qemu-img.c
-@@ -4886,11 +4886,13 @@ static int img_bitmap(int argc, char **argv)
+@@ -4827,11 +4827,13 @@ static int img_bitmap(int argc, char **argv)
 #define C_OF      010
 #define C_SKIP    020
 #define C_OSIZE   040
@@ -33,7 +33,7 @@ index c584de648c..a57ceeddfe 100644
 };
 struct DdIo {
-@@ -4979,6 +4981,19 @@ static int img_dd_osize(const char *arg,
+@@ -4920,6 +4922,19 @@ static int img_dd_osize(const char *arg,
     return 0;
 }
@@ -53,13 +53,13 @@ index c584de648c..a57ceeddfe 100644
 static int img_dd(int argc, char **argv)
 {
     int ret = 0;
-@@ -4993,12 +5008,14 @@ static int img_dd(int argc, char **argv)
+@@ -4934,12 +4949,14 @@ static int img_dd(int argc, char **argv)
     int c, i;
     const char *out_fmt = "raw";
     const char *fmt = NULL;
 -    int64_t size = 0;
 +    int64_t size = 0, readsize = 0;
-     int64_t out_pos, in_pos;
+     int64_t block_count = 0, out_pos, in_pos;
     bool force_share = false;
     struct DdInfo dd = {
         .flags = 0,
@@ -69,7 +69,7 @@ index c584de648c..a57ceeddfe 100644
     };
     struct DdIo in = {
         .bsz = 512, /* Block size is by default 512 bytes */
-@@ -5020,6 +5037,7 @@ static int img_dd(int argc, char **argv)
+@@ -4961,6 +4978,7 @@ static int img_dd(int argc, char **argv)
         { "of", img_dd_of, C_OF },
         { "skip", img_dd_skip, C_SKIP },
         { "osize", img_dd_osize, C_OSIZE },
@@ -77,20 +77,20 @@ index c584de648c..a57ceeddfe 100644
         { NULL, NULL, 0 }
     };
     const struct option long_options[] = {
-@@ -5216,9 +5234,10 @@ static int img_dd(int argc, char **argv)
+@@ -5157,9 +5175,10 @@ static int img_dd(int argc, char **argv)
     in.buf = g_new(uint8_t, in.bsz);
-    for (out_pos = 0; in_pos < size; ) {
+-    for (out_pos = 0; in_pos < size; block_count++) {
 +    readsize = (dd.isize > 0) ? dd.isize : size;
-+    for (out_pos = 0; in_pos < readsize; ) {
+    for (out_pos = 0; in_pos < readsize; block_count++) {
         int in_ret, out_ret;
 -        int bytes = (in_pos + in.bsz > size) ? size - in_pos : in.bsz;
 +        int bytes = (in_pos + in.bsz > readsize) ? readsize - in_pos : in.bsz;
         if (blk1) {
             in_ret = blk_pread(blk1, in_pos, bytes, in.buf, 0);
             if (in_ret == 0) {
-@@ -5227,6 +5246,9 @@ static int img_dd(int argc, char **argv)
+@@ -5168,6 +5187,9 @@ static int img_dd(int argc, char **argv)
         } else {
             in_ret = read(STDIN_FILENO, in.buf, bytes);
             if (in_ret == 0) {
--- a/debian/patches/pve/0012-PVE-Up-qemu-img-dd-add-n-skip_create.patch
+++ b/debian/patches/pve/0012-PVE-Up-qemu-img-dd-add-n-skip_create.patch
@@ -5,7 +5,7 @@ Subject: [PATCH] PVE: [Up] qemu-img dd: add -n skip_create
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 [FE: fix getopt-string + add documentation]
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
+Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 ---
 docs/tools/qemu-img.rst | 11 ++++++++++-
 qemu-img-cmds.hx        |  4 ++--
@@ -13,7 +13,7 @@ Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 3 files changed, 26 insertions(+), 12 deletions(-)
 diff --git a/docs/tools/qemu-img.rst b/docs/tools/qemu-img.rst
-index 15aeddc6d8..5e713e231d 100644
+index 85a6e05b35..699229eef6 100644
 --- a/docs/tools/qemu-img.rst
 +++ b/docs/tools/qemu-img.rst
@@ -208,6 +208,10 @@ Parameters to convert subcommand:
@@ -65,19 +65,19 @@ index d1616c045a..b5b0bb4467 100644
 DEF("info", img_info,
 diff --git a/qemu-img.c b/qemu-img.c
-index a57ceeddfe..06d814e39c 100644
+index 14594d44b6..c6b4a5567d 100644
 --- a/qemu-img.c
 +++ b/qemu-img.c
-@@ -5010,7 +5010,7 @@ static int img_dd(int argc, char **argv)
+@@ -4951,7 +4951,7 @@ static int img_dd(int argc, char **argv)
     const char *fmt = NULL;
     int64_t size = 0, readsize = 0;
-     int64_t out_pos, in_pos;
+     int64_t block_count = 0, out_pos, in_pos;
 -    bool force_share = false;
 +    bool force_share = false, skip_create = false;
     struct DdInfo dd = {
         .flags = 0,
         .count = 0,
-@@ -5048,7 +5048,7 @@ static int img_dd(int argc, char **argv)
+@@ -4989,7 +4989,7 @@ static int img_dd(int argc, char **argv)
         { 0, 0, 0, 0 }
     };
@@ -86,7 +86,7 @@ index a57ceeddfe..06d814e39c 100644
         if (c == EOF) {
             break;
         }
-@@ -5068,6 +5068,9 @@ static int img_dd(int argc, char **argv)
+@@ -5009,6 +5009,9 @@ static int img_dd(int argc, char **argv)
         case 'h':
             help();
             break;
@@ -96,7 +96,7 @@ index a57ceeddfe..06d814e39c 100644
         case 'U':
             force_share = true;
             break;
-@@ -5198,13 +5201,15 @@ static int img_dd(int argc, char **argv)
+@@ -5139,13 +5142,15 @@ static int img_dd(int argc, char **argv)
                                 size - in.bsz * in.offset, &error_abort);
         }
--- a/debian/patches/pve/0013-PVE-virtio-balloon-improve-query-balloon.patch
+++ b/debian/patches/pve/0013-PVE-virtio-balloon-improve-query-balloon.patch
@@ -7,62 +7,17 @@ Actually provide memory information via the query-balloon
 command.
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 [FE: add BalloonInfo to member name exceptions list
     rebase for 8.0 - moved to hw/core/machine-hmp-cmds.c]
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 hw/core/machine-hmp-cmds.c | 30 +++++++++++++++++++++++++++++-
 hw/virtio/virtio-balloon.c | 33 +++++++++++++++++++++++++++++++--
 monitor/hmp-cmds.c         | 30 +++++++++++++++++++++++++++++-
 qapi/machine.json          | 22 +++++++++++++++++++++-
- qapi/pragma.json           |  1 +
+ 3 files changed, 81 insertions(+), 4 deletions(-)
 4 files changed, 82 insertions(+), 4 deletions(-)
 diff --git a/hw/core/machine-hmp-cmds.c b/hw/core/machine-hmp-cmds.c
 index c3e55ef9e9..0e32e6201f 100644
 --- a/hw/core/machine-hmp-cmds.c
 +++ b/hw/core/machine-hmp-cmds.c
@@ -169,7 +169,35 @@ void hmp_info_balloon(Monitor *mon, const QDict *qdict)
         return;
     }
 -    monitor_printf(mon, "balloon: actual=%" PRId64 "\n", info->actual >> 20);
 +    monitor_printf(mon, "balloon: actual=%" PRId64, info->actual >> 20);
 +    monitor_printf(mon, " max_mem=%" PRId64, info->max_mem >> 20);
 +    if (info->has_total_mem) {
 +        monitor_printf(mon, " total_mem=%" PRId64, info->total_mem >> 20);
 +    }
 +    if (info->has_free_mem) {
 +        monitor_printf(mon, " free_mem=%" PRId64, info->free_mem >> 20);
 +    }
 +
 +    if (info->has_mem_swapped_in) {
 +        monitor_printf(mon, " mem_swapped_in=%" PRId64, info->mem_swapped_in);
 +    }
 +    if (info->has_mem_swapped_out) {
 +        monitor_printf(mon, " mem_swapped_out=%" PRId64, info->mem_swapped_out);
 +    }
 +    if (info->has_major_page_faults) {
 +        monitor_printf(mon, " major_page_faults=%" PRId64,
 +                       info->major_page_faults);
 +    }
 +    if (info->has_minor_page_faults) {
 +        monitor_printf(mon, " minor_page_faults=%" PRId64,
 +                       info->minor_page_faults);
 +    }
 +    if (info->has_last_update) {
 +        monitor_printf(mon, " last_update=%" PRId64,
 +                       info->last_update);
 +    }
 +
 +    monitor_printf(mon, "\n");
     qapi_free_BalloonInfo(info);
 }
 diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
-index 746f07c4d2..a41854b902 100644
+index 73ac5eb675..bbfe7eca62 100644
 --- a/hw/virtio/virtio-balloon.c
 +++ b/hw/virtio/virtio-balloon.c
-@@ -804,8 +804,37 @@ static uint64_t virtio_balloon_get_features(VirtIODevice *vdev, uint64_t f,
+@@ -806,8 +806,37 @@ static uint64_t virtio_balloon_get_features(VirtIODevice *vdev, uint64_t f,
 static void virtio_balloon_stat(void *opaque, BalloonInfo *info)
 {
     VirtIOBalloon *dev = opaque;
@@ -102,11 +57,52 @@ index 746f07c4d2..a41854b902 100644
 }
 static void virtio_balloon_to_target(void *opaque, ram_addr_t target)
 diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
 index c6cd6f91dd..15572befb1 100644
 --- a/monitor/hmp-cmds.c
 +++ b/monitor/hmp-cmds.c
@@ -715,7 +715,35 @@ void hmp_info_balloon(Monitor *mon, const QDict *qdict)
         return;
     }
 -    monitor_printf(mon, "balloon: actual=%" PRId64 "\n", info->actual >> 20);
 +    monitor_printf(mon, "balloon: actual=%" PRId64, info->actual >> 20);
 +    monitor_printf(mon, " max_mem=%" PRId64, info->max_mem >> 20);
 +    if (info->has_total_mem) {
 +        monitor_printf(mon, " total_mem=%" PRId64, info->total_mem >> 20);
 +    }
 +    if (info->has_free_mem) {
 +        monitor_printf(mon, " free_mem=%" PRId64, info->free_mem >> 20);
 +    }
 +
 +    if (info->has_mem_swapped_in) {
 +        monitor_printf(mon, " mem_swapped_in=%" PRId64, info->mem_swapped_in);
 +    }
 +    if (info->has_mem_swapped_out) {
 +        monitor_printf(mon, " mem_swapped_out=%" PRId64, info->mem_swapped_out);
 +    }
 +    if (info->has_major_page_faults) {
 +        monitor_printf(mon, " major_page_faults=%" PRId64,
 +                       info->major_page_faults);
 +    }
 +    if (info->has_minor_page_faults) {
 +        monitor_printf(mon, " minor_page_faults=%" PRId64,
 +                       info->minor_page_faults);
 +    }
 +    if (info->has_last_update) {
 +        monitor_printf(mon, " last_update=%" PRId64,
 +                       info->last_update);
 +    }
 +
 +    monitor_printf(mon, "\n");
     qapi_free_BalloonInfo(info);
 }
 diff --git a/qapi/machine.json b/qapi/machine.json
-index 604b686e59..15f5f86683 100644
+index 6afd1936b0..8b4be9b718 100644
 --- a/qapi/machine.json
 +++ b/qapi/machine.json
-@@ -1056,9 +1056,29 @@
+@@ -1054,9 +1054,29 @@
 # @actual: the logical size of the VM in bytes
 #          Formula used: logical_vm_size = vm_ram_size - balloon_size
 #
@@ -137,15 +133,3 @@ index 604b686e59..15f5f86683 100644
 ##
 # @query-balloon:
 diff --git a/qapi/pragma.json b/qapi/pragma.json
 index 7f810b0e97..325e684411 100644
 --- a/qapi/pragma.json
 +++ b/qapi/pragma.json
@@ -35,6 +35,7 @@
     'member-name-exceptions': [     # visible in:
         'ACPISlotType',             # query-acpi-ospm-status
         'AcpiTableOptions',         # -acpitable
 +        'BalloonInfo',              # query-balloon
         'BlkdebugEvent',            # blockdev-add, -blockdev
         'BlkdebugSetStateOptions',  # blockdev-add, -blockdev
         'BlockDeviceInfo',          # query-block
--- a/debian/patches/pve/0014-PVE-qapi-modify-query-machines.patch
+++ b/debian/patches/pve/0014-PVE-qapi-modify-query-machines.patch
@@ -13,13 +13,13 @@ Signed-off-by: Dietmar Maurer <dietmar@proxmox.com>
 2 files changed, 9 insertions(+), 1 deletion(-)
 diff --git a/hw/core/machine-qmp-cmds.c b/hw/core/machine-qmp-cmds.c
-index b98ff15089..24595f618c 100644
+index 4f4ab30f8c..76fff60a6b 100644
 --- a/hw/core/machine-qmp-cmds.c
 +++ b/hw/core/machine-qmp-cmds.c
-@@ -103,6 +103,12 @@ MachineInfoList *qmp_query_machines(Error **errp)
+@@ -99,6 +99,12 @@ MachineInfoList *qmp_query_machines(Error **errp)
         info->hotpluggable_cpus = mc->has_hotpluggable_cpus;
         info->numa_mem_supported = mc->numa_mem_supported;
         info->deprecated = !!mc->deprecation_reason;
         info->acpi = !!object_class_property_find(OBJECT_CLASS(mc), "acpi");
 +
 +        if (strcmp(mc->name, MACHINE_GET_CLASS(current_machine)->name) == 0) {
 +            info->has_is_current = true;
@@ -28,9 +28,9 @@ index b98ff15089..24595f618c 100644
 +
         if (mc->default_cpu_type) {
             info->default_cpu_type = g_strdup(mc->default_cpu_type);
-         }
+             info->has_default_cpu_type = true;
 diff --git a/qapi/machine.json b/qapi/machine.json
-index 15f5f86683..c904280085 100644
+index 8b4be9b718..555458f785 100644
 --- a/qapi/machine.json
 +++ b/qapi/machine.json
@@ -138,6 +138,8 @@
@@ -42,7 +42,7 @@ index 15f5f86683..c904280085 100644
 # @cpu-max: maximum number of CPUs supported by the machine type
 #           (since 1.5)
 #
-@@ -161,7 +163,7 @@
+@@ -159,7 +161,7 @@
 ##
 { 'struct': 'MachineInfo',
   'data': { 'name': 'str', '*alias': 'str',
@@ -50,4 +50,4 @@ index 15f5f86683..c904280085 100644
 +            '*is-default': 'bool', '*is-current': 'bool', 'cpu-max': 'int',
             'hotpluggable-cpus': 'bool',  'numa-mem-supported': 'bool',
             'deprecated': 'bool', '*default-cpu-type': 'str',
-             '*default-ram-id': 'str', 'acpi': 'bool' } }
+             '*default-ram-id': 'str' } }
--- a/debian/patches/pve/0015-PVE-qapi-modify-spice-query.patch
+++ b/debian/patches/pve/0015-PVE-qapi-modify-spice-query.patch
@@ -6,15 +6,13 @@ Subject: [PATCH] PVE: qapi: modify spice query
 Provide the last ticket in the SpiceInfo struct optionally.
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 [FE: adapt to QAPI change]
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 qapi/ui.json    | 3 +++
- ui/spice-core.c | 4 ++++
+ ui/spice-core.c | 5 +++++
- 2 files changed, 7 insertions(+)
+ 2 files changed, 8 insertions(+)
 diff --git a/qapi/ui.json b/qapi/ui.json
-index 98322342f7..316d4dc933 100644
+index cf58ab4283..0be2388941 100644
 --- a/qapi/ui.json
 +++ b/qapi/ui.json
@@ -310,11 +310,14 @@
@@ -33,14 +31,15 @@ index 98322342f7..316d4dc933 100644
   'if': 'CONFIG_SPICE' }
 diff --git a/ui/spice-core.c b/ui/spice-core.c
-index b20c25aee0..26baeb7846 100644
+index 37774f1c0a..367f77f2b4 100644
 --- a/ui/spice-core.c
 +++ b/ui/spice-core.c
-@@ -548,6 +548,10 @@ static SpiceInfo *qmp_query_spice_real(Error **errp)
+@@ -534,6 +534,11 @@ static SpiceInfo *qmp_query_spice_real(Error **errp)
     micro = SPICE_SERVER_VERSION & 0xff;
     info->compiled_version = g_strdup_printf("%d.%d.%d", major, minor, micro);
 +    if (auth_passwd) {
 +        info->has_ticket = true;
 +        info->ticket =  g_strdup(auth_passwd);
 +    }
 +
--- a/debian/patches/pve/0016-PVE-add-IOChannel-implementation-for-savevm-async.patch
+++ b/debian/patches/pve/0016-PVE-add-IOChannel-implementation-for-savevm-async.patch
@@ -15,19 +15,19 @@ Additionally, allows tracking the current position from the outside
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
- migration/channel-savevm-async.c | 183 +++++++++++++++++++++++++++++++
+ migration/channel-savevm-async.c | 182 +++++++++++++++++++++++++++++++
 migration/channel-savevm-async.h |  51 +++++++++
 migration/meson.build            |   1 +
- 3 files changed, 235 insertions(+)
+ 3 files changed, 234 insertions(+)
 create mode 100644 migration/channel-savevm-async.c
 create mode 100644 migration/channel-savevm-async.h
 diff --git a/migration/channel-savevm-async.c b/migration/channel-savevm-async.c
 new file mode 100644
-index 0000000000..aab081ce07
+index 0000000000..06d5484778
 --- /dev/null
 +++ b/migration/channel-savevm-async.c
-@@ -0,0 +1,183 @@
+@@ -0,0 +1,182 @@
 +/*
 + * QIO Channel implementation to be used by savevm-async QMP calls
 + */
@@ -71,7 +71,6 @@ index 0000000000..aab081ce07
 +                               size_t niov,
 +                               int **fds,
 +                               size_t *nfds,
 +                               int flags,
 +                               Error **errp)
 +{
 +    QIOChannelSavevmAsync *saioc = QIO_CHANNEL_SAVEVM_ASYNC(ioc);
@@ -269,7 +268,7 @@ index 0000000000..17ae2cb261
 +
 +#endif /* QIO_CHANNEL_SAVEVM_ASYNC_H */
 diff --git a/migration/meson.build b/migration/meson.build
-index 0d1bb9f96e..8a142fc7a9 100644
+index 690487cf1a..8cac83c06c 100644
 --- a/migration/meson.build
 +++ b/migration/meson.build
@@ -13,6 +13,7 @@ softmmu_ss.add(files(
--- a/debian/patches/pve/0017-PVE-add-savevm-async-for-background-state-snapshots.patch
+++ b/debian/patches/pve/0017-PVE-add-savevm-async-for-background-state-snapshots.patch
@@ -21,34 +21,31 @@ still opened by QEMU.
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 Signed-off-by: Dietmar Maurer <dietmar@proxmox.com>
 Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
-[SR: improve aborting
+[improve aborting]
     register yank before migration_incoming_state_destroy]
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 [FE: further improve aborting
-     adapt to removal of QEMUFileOps
+     adapt to removal of QEMUFileOps]
     improve condition for entering final stage
     adapt to QAPI and other changes for 8.0]
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 hmp-commands-info.hx         |  13 +
- hmp-commands.hx              |  17 ++
+ hmp-commands.hx              |  33 +++
 include/migration/snapshot.h |   2 +
- include/monitor/hmp.h        |   3 +
+ include/monitor/hmp.h        |   5 +
 migration/meson.build        |   1 +
- migration/savevm-async.c     | 533 +++++++++++++++++++++++++++++++++++
+ migration/savevm-async.c     | 531 +++++++++++++++++++++++++++++++++++
- monitor/hmp-cmds.c           |  38 +++
+ monitor/hmp-cmds.c           |  57 ++++
 qapi/migration.json          |  34 +++
- qapi/misc.json               |  16 ++
+ qapi/misc.json               |  32 +++
 qemu-options.hx              |  12 +
 softmmu/vl.c                 |  10 +
- 11 files changed, 679 insertions(+)
+ 11 files changed, 730 insertions(+)
 create mode 100644 migration/savevm-async.c
 diff --git a/hmp-commands-info.hx b/hmp-commands-info.hx
-index 47d63d26db..a166bff3d5 100644
+index 188d9ece3b..97b88eaaad 100644
 --- a/hmp-commands-info.hx
 +++ b/hmp-commands-info.hx
-@@ -540,6 +540,19 @@ SRST
+@@ -538,6 +538,19 @@ SRST
     Show current migration parameters.
 ERST
@@ -69,13 +66,13 @@ index 47d63d26db..a166bff3d5 100644
         .name       = "balloon",
         .args_type  = "",
 diff --git a/hmp-commands.hx b/hmp-commands.hx
-index bb85ee1d26..d9f9f42d11 100644
+index 182e639d14..bbcc73e942 100644
 --- a/hmp-commands.hx
 +++ b/hmp-commands.hx
-@@ -1846,3 +1846,20 @@ SRST
+@@ -1800,3 +1800,36 @@ ERST
-   List event channels in the guest
+                       "\n\t\t\t\t\t limit on a specified virtual cpu",
- ERST
+         .cmd        = hmp_cancel_vcpu_dirty_limit,
- #endif
+     },
 +
 +    {
 +        .name       = "savevm-start",
@@ -86,6 +83,22 @@ index bb85ee1d26..d9f9f42d11 100644
 +    },
 +
 +    {
 +        .name       = "snapshot-drive",
 +        .args_type  = "device:s,name:s",
 +        .params     = "device name",
 +        .help       = "Create internal snapshot.",
 +        .cmd = hmp_snapshot_drive,
 +    },
 +
 +    {
 +        .name       = "delete-drive-snapshot",
 +        .args_type  = "device:s,name:s",
 +        .params     = "device name",
 +        .help       = "Delete internal snapshot.",
 +        .cmd = hmp_delete_drive_snapshot,
 +    },
 +
 +    {
 +        .name       = "savevm-end",
 +        .args_type  = "",
 +        .params     = "",
@@ -105,10 +118,10 @@ index e72083b117..c846d37806 100644
 +
 #endif
 diff --git a/include/monitor/hmp.h b/include/monitor/hmp.h
-index fdb69b7f9c..fdf6b45fb8 100644
+index a618eb1e4e..55067beff1 100644
 --- a/include/monitor/hmp.h
 +++ b/include/monitor/hmp.h
-@@ -28,6 +28,7 @@ void hmp_info_status(Monitor *mon, const QDict *qdict);
+@@ -26,6 +26,7 @@ void hmp_info_status(Monitor *mon, const QDict *qdict);
 void hmp_info_uuid(Monitor *mon, const QDict *qdict);
 void hmp_info_chardev(Monitor *mon, const QDict *qdict);
 void hmp_info_mice(Monitor *mon, const QDict *qdict);
@@ -116,33 +129,35 @@ index fdb69b7f9c..fdf6b45fb8 100644
 void hmp_info_migrate(Monitor *mon, const QDict *qdict);
 void hmp_info_migrate_capabilities(Monitor *mon, const QDict *qdict);
 void hmp_info_migrate_parameters(Monitor *mon, const QDict *qdict);
-@@ -94,6 +95,8 @@ void hmp_closefd(Monitor *mon, const QDict *qdict);
+@@ -80,6 +81,10 @@ void hmp_netdev_add(Monitor *mon, const QDict *qdict);
- void hmp_mouse_move(Monitor *mon, const QDict *qdict);
+ void hmp_netdev_del(Monitor *mon, const QDict *qdict);
- void hmp_mouse_button(Monitor *mon, const QDict *qdict);
+ void hmp_getfd(Monitor *mon, const QDict *qdict);
- void hmp_mouse_set(Monitor *mon, const QDict *qdict);
+ void hmp_closefd(Monitor *mon, const QDict *qdict);
 +void hmp_savevm_start(Monitor *mon, const QDict *qdict);
 +void hmp_snapshot_drive(Monitor *mon, const QDict *qdict);
 +void hmp_delete_drive_snapshot(Monitor *mon, const QDict *qdict);
 +void hmp_savevm_end(Monitor *mon, const QDict *qdict);
 void hmp_sendkey(Monitor *mon, const QDict *qdict);
- void coroutine_fn hmp_screendump(Monitor *mon, const QDict *qdict);
+ void hmp_screendump(Monitor *mon, const QDict *qdict);
 void hmp_chardev_add(Monitor *mon, const QDict *qdict);
 diff --git a/migration/meson.build b/migration/meson.build
-index 8a142fc7a9..a7824b5266 100644
+index 8cac83c06c..0842d00cd2 100644
 --- a/migration/meson.build
 +++ b/migration/meson.build
-@@ -25,6 +25,7 @@ softmmu_ss.add(files(
+@@ -24,6 +24,7 @@ softmmu_ss.add(files(
   'multifd-zlib.c',
   'postcopy-ram.c',
   'savevm.c',
 +  'savevm-async.c',
   'socket.c',
   'tls.c',
-   'threadinfo.c',
+ ), gnutls)
 diff --git a/migration/savevm-async.c b/migration/savevm-async.c
 new file mode 100644
-index 0000000000..aa2017d496
+index 0000000000..05d394c0e2
 --- /dev/null
 +++ b/migration/savevm-async.c
-@@ -0,0 +1,533 @@
+@@ -0,0 +1,531 @@
 +#include "qemu/osdep.h"
 +#include "migration/channel-savevm-async.h"
 +#include "migration/migration.h"
@@ -165,7 +180,6 @@ index 0000000000..aa2017d496
 +#include "qemu/timer.h"
 +#include "qemu/main-loop.h"
 +#include "qemu/rcu.h"
 +#include "qemu/yank.h"
 +
 +/* #define DEBUG_SAVEVM_STATE */
 +
@@ -216,20 +230,24 @@ index 0000000000..aa2017d496
 +        info->bytes = s->bs_pos;
 +        switch (s->state) {
 +        case SAVE_STATE_ERROR:
 +            info->has_status = true;
 +            info->status = g_strdup("failed");
 +            info->has_total_time = true;
 +            info->total_time = s->total_time;
 +            if (s->error) {
 +                info->has_error = true;
 +                info->error = g_strdup(error_get_pretty(s->error));
 +            }
 +            break;
 +        case SAVE_STATE_ACTIVE:
 +            info->has_status = true;
 +            info->status = g_strdup("active");
 +            info->has_total_time = true;
 +            info->total_time = qemu_clock_get_ms(QEMU_CLOCK_REALTIME)
 +                - s->total_time;
 +            break;
 +        case SAVE_STATE_COMPLETED:
 +            info->has_status = true;
 +            info->status = g_strdup("completed");
 +            info->has_total_time = true;
 +            info->total_time = s->total_time;
@@ -275,7 +293,7 @@ index 0000000000..aa2017d496
 +    return ret;
 +}
 +
-+static void G_GNUC_PRINTF(1, 2) save_snapshot_error(const char *fmt, ...)
+static void save_snapshot_error(const char *fmt, ...)
 +{
 +    va_list ap;
 +    char *msg;
@@ -329,7 +347,7 @@ index 0000000000..aa2017d496
 +        (void)qemu_savevm_state_complete_precopy(snap_state.file, false, false);
 +        ret = qemu_file_get_error(snap_state.file);
 +        if (ret < 0) {
-+            save_snapshot_error("qemu_savevm_state_complete_precopy error %d", ret);
+                save_snapshot_error("qemu_savevm_state_iterate error %d", ret);
 +        }
 +    }
 +
@@ -386,32 +404,18 @@ index 0000000000..aa2017d496
 +    }
 +
 +    while (snap_state.state == SAVE_STATE_ACTIVE) {
-+        uint64_t pending_size, pend_precopy, pend_postcopy;
+        uint64_t pending_size, pend_precopy, pend_compatible, pend_postcopy;
 +        uint64_t threshold = 400 * 1000;
 +
-+        /*
+        /* pending is expected to be called without iothread lock */
 +         * pending_{estimate,exact} are expected to be called without iothread
 +         * lock. Similar to what is done in migration.c, call the exact variant
 +         * only once pend_precopy in the estimate is below the threshold.
 +         */
 +        qemu_mutex_unlock_iothread();
-+        qemu_savevm_state_pending_estimate(&pend_precopy, &pend_postcopy);
+        qemu_savevm_state_pending(snap_state.file, 0, &pend_precopy, &pend_compatible, &pend_postcopy);
 +        if (pend_precopy <= threshold) {
 +            qemu_savevm_state_pending_exact(&pend_precopy, &pend_postcopy);
 +        }
 +        qemu_mutex_lock_iothread();
 +        pending_size = pend_precopy + pend_postcopy;
 +
-+        /*
+        pending_size = pend_precopy + pend_compatible + pend_postcopy;
 +         * A guest reaching this cutoff is dirtying lots of RAM. It should be
 +         * large enough so that the guest can't dirty this much between the
 +         * check and the guest actually being stopped, but it should be small
 +         * enough to avoid long downtimes for non-hibernation snapshots.
 +         */
 +        maxlen = blk_getlength(snap_state.target) - 100*1024*1024;
 +
-+        /* Note that there is no progress for pend_postcopy when iterating */
+        maxlen = blk_getlength(snap_state.target) - 30*1024*1024;
-+        if (pend_precopy > threshold && snap_state.bs_pos + pending_size < maxlen) {
+
 +        if (pending_size > 400000 && snap_state.bs_pos + pending_size < maxlen) {
 +            ret = qemu_savevm_state_iterate(snap_state.file, false);
 +            if (ret < 0) {
 +                save_snapshot_error("qemu_savevm_state_iterate error %d", ret);
@@ -453,9 +457,7 @@ index 0000000000..aa2017d496
 +        if (bs_ctx != qemu_get_aio_context()) {
 +            DPRINTF("savevm: async flushing drive %s\n", bs->filename);
 +            aio_co_reschedule_self(bs_ctx);
 +            bdrv_graph_co_rdlock();
 +            bdrv_flush(bs);
 +            bdrv_graph_co_rdunlock();
 +            aio_co_reschedule_self(qemu_get_aio_context());
 +        }
 +    }
@@ -466,7 +468,7 @@ index 0000000000..aa2017d496
 +    qemu_bh_schedule(snap_state.finalize_bh);
 +}
 +
-+void qmp_savevm_start(const char *statefile, Error **errp)
+void qmp_savevm_start(bool has_statefile, const char *statefile, Error **errp)
 +{
 +    Error *local_err = NULL;
 +    MigrationState *ms = migrate_get_current();
@@ -503,7 +505,7 @@ index 0000000000..aa2017d496
 +        snap_state.error = NULL;
 +    }
 +
-+    if (!statefile) {
+    if (!has_statefile) {
 +        vm_stop(RUN_STATE_SAVE_VM);
 +        snap_state.state = SAVE_STATE_COMPLETED;
 +        return;
@@ -539,7 +541,6 @@ index 0000000000..aa2017d496
 +     */
 +    migrate_init(ms);
 +    memset(&ram_counters, 0, sizeof(ram_counters));
 +    memset(&compression_counters, 0, sizeof(compression_counters));
 +    ms->to_dst_file = snap_state.file;
 +
 +    error_setg(&snap_state.blocker, "block device is in use by savevm");
@@ -622,6 +623,22 @@ index 0000000000..aa2017d496
 +    DPRINTF("savevm-end: cleanup done\n");
 +}
 +
 +// FIXME: Deprecated
 +void qmp_snapshot_drive(const char *device, const char *name, Error **errp)
 +{
 +    // Compatibility to older qemu-server.
 +    qmp_blockdev_snapshot_internal_sync(device, name, errp);
 +}
 +
 +// FIXME: Deprecated
 +void qmp_delete_drive_snapshot(const char *device, const char *name,
 +                               Error **errp)
 +{
 +    // Compatibility to older qemu-server.
 +    (void)qmp_blockdev_snapshot_delete_internal_sync(device, false, NULL,
 +                                                     true, name, errp);
 +}
 +
 +int load_snapshot_from_blockdev(const char *filename, Error **errp)
 +{
 +    BlockBackend *be;
@@ -656,10 +673,6 @@ index 0000000000..aa2017d496
 +    dirty_bitmap_mig_before_vm_start();
 +
 +    qemu_fclose(f);
 +
 +    /* state_destroy assumes a real migration which would have added a yank */
 +    yank_register_instance(MIGRATION_YANK_INSTANCE, &error_abort);
 +
 +    migration_incoming_state_destroy();
 +    if (ret < 0) {
 +        error_setg_errno(errp, -ret, "Error while loading VM state");
@@ -677,28 +690,39 @@ index 0000000000..aa2017d496
 +    return ret;
 +}
 diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
-index 6c559b48c8..91be698308 100644
+index 15572befb1..1507180990 100644
 --- a/monitor/hmp-cmds.c
 +++ b/monitor/hmp-cmds.c
-@@ -22,6 +22,7 @@
+@@ -1925,6 +1925,63 @@ void hmp_info_memory_devices(Monitor *mon, const QDict *qdict)
- #include "monitor/monitor-internal.h"
+     hmp_handle_error(mon, err);
 #include "qapi/error.h"
 #include "qapi/qapi-commands-control.h"
 +#include "qapi/qapi-commands-migration.h"
 #include "qapi/qapi-commands-misc.h"
 #include "qapi/qmp/qdict.h"
 #include "qapi/qmp/qerror.h"
@@ -443,3 +444,40 @@ void hmp_info_mtree(Monitor *mon, const QDict *qdict)
     mtree_info(flatview, dispatch_tree, owner, disabled);
 }
-+
+ 
 +void hmp_savevm_start(Monitor *mon, const QDict *qdict)
 +{
 +    Error *errp = NULL;
 +    const char *statefile = qdict_get_try_str(qdict, "statefile");
 +
-+    qmp_savevm_start(statefile, &errp);
+    qmp_savevm_start(statefile != NULL, statefile, &errp);
 +    hmp_handle_error(mon, errp);
 +}
 +
 +void hmp_snapshot_drive(Monitor *mon, const QDict *qdict)
 +{
 +    Error *errp = NULL;
 +    const char *name = qdict_get_str(qdict, "name");
 +    const char *device = qdict_get_str(qdict, "device");
 +
 +    qmp_snapshot_drive(device, name, &errp);
 +    hmp_handle_error(mon, errp);
 +}
 +
 +void hmp_delete_drive_snapshot(Monitor *mon, const QDict *qdict)
 +{
 +    Error *errp = NULL;
 +    const char *name = qdict_get_str(qdict, "name");
 +    const char *device = qdict_get_str(qdict, "device");
 +
 +    qmp_delete_drive_snapshot(device, name, &errp);
 +    hmp_handle_error(mon, errp);
 +}
 +
@@ -715,7 +739,7 @@ index 6c559b48c8..91be698308 100644
 +    SaveVMInfo *info;
 +    info = qmp_query_savevm(NULL);
 +
-+    if (info->status) {
+    if (info->has_status) {
 +        monitor_printf(mon, "savevm status: %s\n", info->status);
 +        monitor_printf(mon, "total time: %" PRIu64 " milliseconds\n",
 +                       info->total_time);
@@ -725,12 +749,16 @@ index 6c559b48c8..91be698308 100644
 +    if (info->has_bytes) {
 +        monitor_printf(mon, "Bytes saved: %"PRIu64"\n", info->bytes);
 +    }
-+    if (info->error) {
+    if (info->has_error) {
 +        monitor_printf(mon, "Error: %s\n", info->error);
 +    }
 +}
 +
 void hmp_info_iothreads(Monitor *mon, const QDict *qdict)
 {
     IOThreadInfoList *info_list = qmp_query_iothreads(NULL);
 diff --git a/qapi/migration.json b/qapi/migration.json
-index c84fa10e86..1702b92553 100644
+index 81185d4311..3129f71fa8 100644
 --- a/qapi/migration.json
 +++ b/qapi/migration.json
@@ -261,6 +261,40 @@
@@ -775,10 +803,10 @@ index c84fa10e86..1702b92553 100644
 # @query-migrate:
 #
 diff --git a/qapi/misc.json b/qapi/misc.json
-index 6ddd16ea28..e5681ae8a2 100644
+index 27ef5a2b20..b3ce75dcae 100644
 --- a/qapi/misc.json
 +++ b/qapi/misc.json
-@@ -469,6 +469,22 @@
+@@ -435,6 +435,38 @@
 ##
 { 'command': 'query-fdsets', 'returns': ['FdsetInfo'] }
@@ -791,6 +819,22 @@ index 6ddd16ea28..e5681ae8a2 100644
 +{ 'command': 'savevm-start', 'data': { '*statefile': 'str' } }
 +
 +##
 +# @snapshot-drive:
 +#
 +# Create an internal drive snapshot.
 +#
 +##
 +{ 'command': 'snapshot-drive', 'data': { 'device': 'str', 'name': 'str' } }
 +
 +##
 +# @delete-drive-snapshot:
 +#
 +# Delete a drive snapshot.
 +#
 +##
 +{ 'command': 'delete-drive-snapshot', 'data': { 'device': 'str', 'name': 'str' } }
 +
 +##
 +# @savevm-end:
 +#
 +# Resume VM after a snapshot.
@@ -802,10 +846,10 @@ index 6ddd16ea28..e5681ae8a2 100644
 # @CommandLineParameterType:
 #
 diff --git a/qemu-options.hx b/qemu-options.hx
-index fdddfab6ff..fdd551c2bb 100644
+index 31c04f7eea..c2ca6e91b5 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
-@@ -4398,6 +4398,18 @@ SRST
+@@ -4341,6 +4341,18 @@ SRST
     Start right away with a saved state (``loadvm`` in monitor)
 ERST
@@ -825,10 +869,10 @@ index fdddfab6ff..fdd551c2bb 100644
 DEF("daemonize", 0, QEMU_OPTION_daemonize, \
     "-daemonize      daemonize QEMU after initializing\n", QEMU_ARCH_ALL)
 diff --git a/softmmu/vl.c b/softmmu/vl.c
-index ea20b23e4c..0eabc71b68 100644
+index 706bd7cff7..b8637c4262 100644
 --- a/softmmu/vl.c
 +++ b/softmmu/vl.c
-@@ -164,6 +164,7 @@ static const char *accelerators;
+@@ -165,6 +165,7 @@ static const char *accelerators;
 static bool have_custom_ram_size;
 static const char *ram_memdev_id;
 static QDict *machine_opts_dict;
@@ -836,7 +880,7 @@ index ea20b23e4c..0eabc71b68 100644
 static QTAILQ_HEAD(, ObjectOption) object_opts = QTAILQ_HEAD_INITIALIZER(object_opts);
 static QTAILQ_HEAD(, DeviceOption) device_opts = QTAILQ_HEAD_INITIALIZER(device_opts);
 static int display_remote;
-@@ -2612,6 +2613,12 @@ void qmp_x_exit_preconfig(Error **errp)
+@@ -2584,6 +2585,12 @@ void qmp_x_exit_preconfig(Error **errp)
     if (loadvm) {
         load_snapshot(loadvm, NULL, false, NULL, &error_fatal);
@@ -849,7 +893,7 @@ index ea20b23e4c..0eabc71b68 100644
     }
     if (replay_mode != REPLAY_MODE_NONE) {
         replay_vmstate_init();
-@@ -3159,6 +3166,9 @@ void qemu_init(int argc, char **argv)
+@@ -3133,6 +3140,9 @@ void qemu_init(int argc, char **argv, char **envp)
             case QEMU_OPTION_loadvm:
                 loadvm = optarg;
                 break;
--- a/debian/patches/pve/0018-PVE-add-optional-buffer-size-to-QEMUFile.patch
+++ b/debian/patches/pve/0018-PVE-add-optional-buffer-size-to-QEMUFile.patch
@@ -19,7 +19,7 @@ Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 3 files changed, 38 insertions(+), 18 deletions(-)
 diff --git a/migration/qemu-file.c b/migration/qemu-file.c
-index 102ab3b439..5ced17aba4 100644
+index 4f400c2e52..21e8998867 100644
 --- a/migration/qemu-file.c
 +++ b/migration/qemu-file.c
@@ -31,8 +31,8 @@
@@ -43,7 +43,7 @@ index 102ab3b439..5ced17aba4 100644
     DECLARE_BITMAP(may_free, MAX_IOV_SIZE);
     struct iovec iov[MAX_IOV_SIZE];
-@@ -127,7 +128,9 @@ bool qemu_file_mode_is_not_valid(const char *mode)
+@@ -106,7 +107,9 @@ bool qemu_file_mode_is_not_valid(const char *mode)
     return false;
 }
@@ -54,7 +54,7 @@ index 102ab3b439..5ced17aba4 100644
 {
     QEMUFile *f;
-@@ -136,6 +139,8 @@ static QEMUFile *qemu_file_new_impl(QIOChannel *ioc, bool is_writable)
+@@ -115,6 +118,8 @@ static QEMUFile *qemu_file_new_impl(QIOChannel *ioc, bool is_writable)
     object_ref(ioc);
     f->ioc = ioc;
     f->is_writable = is_writable;
@@ -63,7 +63,7 @@ index 102ab3b439..5ced17aba4 100644
     return f;
 }
-@@ -146,17 +151,27 @@ static QEMUFile *qemu_file_new_impl(QIOChannel *ioc, bool is_writable)
+@@ -125,17 +130,27 @@ static QEMUFile *qemu_file_new_impl(QIOChannel *ioc, bool is_writable)
  */
 QEMUFile *qemu_file_get_return_path(QEMUFile *f)
 {
@@ -94,7 +94,7 @@ index 102ab3b439..5ced17aba4 100644
 }
 void qemu_file_set_hooks(QEMUFile *f, const QEMUFileHooks *hooks)
-@@ -414,7 +429,7 @@ static ssize_t qemu_fill_buffer(QEMUFile *f)
+@@ -393,7 +408,7 @@ static ssize_t qemu_fill_buffer(QEMUFile *f)
     do {
         len = qio_channel_read(f->ioc,
                                (char *)f->buf + pending,
@@ -103,7 +103,7 @@ index 102ab3b439..5ced17aba4 100644
                                &local_error);
         if (len == QIO_CHANNEL_ERR_BLOCK) {
             if (qemu_in_coroutine()) {
-@@ -464,6 +479,8 @@ int qemu_fclose(QEMUFile *f)
+@@ -443,6 +458,8 @@ int qemu_fclose(QEMUFile *f)
     }
     g_clear_pointer(&f->ioc, object_unref);
@@ -112,7 +112,7 @@ index 102ab3b439..5ced17aba4 100644
     /* If any error was spotted before closing, we should report it
      * instead of the close() return value.
      */
-@@ -518,7 +535,7 @@ static void add_buf_to_iovec(QEMUFile *f, size_t len)
+@@ -497,7 +514,7 @@ static void add_buf_to_iovec(QEMUFile *f, size_t len)
 {
     if (!add_to_iovec(f, f->buf + f->buf_index, len, false)) {
         f->buf_index += len;
@@ -121,7 +121,7 @@ index 102ab3b439..5ced17aba4 100644
             qemu_fflush(f);
         }
     }
-@@ -544,7 +561,7 @@ void qemu_put_buffer(QEMUFile *f, const uint8_t *buf, size_t size)
+@@ -523,7 +540,7 @@ void qemu_put_buffer(QEMUFile *f, const uint8_t *buf, size_t size)
     }
     while (size > 0) {
@@ -130,7 +130,7 @@ index 102ab3b439..5ced17aba4 100644
         if (l > size) {
             l = size;
         }
-@@ -591,8 +608,8 @@ size_t qemu_peek_buffer(QEMUFile *f, uint8_t **buf, size_t size, size_t offset)
+@@ -570,8 +587,8 @@ size_t qemu_peek_buffer(QEMUFile *f, uint8_t **buf, size_t size, size_t offset)
     size_t index;
     assert(!qemu_file_is_writable(f));
@@ -141,7 +141,7 @@ index 102ab3b439..5ced17aba4 100644
     /* The 1st byte to read from */
     index = f->buf_index + offset;
-@@ -642,7 +659,7 @@ size_t qemu_get_buffer(QEMUFile *f, uint8_t *buf, size_t size)
+@@ -621,7 +638,7 @@ size_t qemu_get_buffer(QEMUFile *f, uint8_t *buf, size_t size)
         size_t res;
         uint8_t *src;
@@ -150,7 +150,7 @@ index 102ab3b439..5ced17aba4 100644
         if (res == 0) {
             return done;
         }
-@@ -676,7 +693,7 @@ size_t qemu_get_buffer(QEMUFile *f, uint8_t *buf, size_t size)
+@@ -655,7 +672,7 @@ size_t qemu_get_buffer(QEMUFile *f, uint8_t *buf, size_t size)
  */
 size_t qemu_get_buffer_in_place(QEMUFile *f, uint8_t **buf, size_t size)
 {
@@ -159,7 +159,7 @@ index 102ab3b439..5ced17aba4 100644
         size_t res;
         uint8_t *src = NULL;
-@@ -701,7 +718,7 @@ int qemu_peek_byte(QEMUFile *f, int offset)
+@@ -680,7 +697,7 @@ int qemu_peek_byte(QEMUFile *f, int offset)
     int index = f->buf_index + offset;
     assert(!qemu_file_is_writable(f));
@@ -168,7 +168,7 @@ index 102ab3b439..5ced17aba4 100644
     if (index >= f->buf_size) {
         qemu_fill_buffer(f);
-@@ -853,7 +870,7 @@ static int qemu_compress_data(z_stream *stream, uint8_t *dest, size_t dest_len,
+@@ -832,7 +849,7 @@ static int qemu_compress_data(z_stream *stream, uint8_t *dest, size_t dest_len,
 ssize_t qemu_put_compression_data(QEMUFile *f, z_stream *stream,
                                   const uint8_t *p, size_t size)
 {
@@ -178,7 +178,7 @@ index 102ab3b439..5ced17aba4 100644
     if (blen < compressBound(size)) {
         return -1;
 diff --git a/migration/qemu-file.h b/migration/qemu-file.h
-index 9d0155a2a1..cc06240e8d 100644
+index fa13d04d78..914f1a63a8 100644
 --- a/migration/qemu-file.h
 +++ b/migration/qemu-file.h
@@ -63,7 +63,9 @@ typedef struct QEMUFileHooks {
@@ -192,10 +192,10 @@ index 9d0155a2a1..cc06240e8d 100644
 int qemu_fclose(QEMUFile *f);
 diff --git a/migration/savevm-async.c b/migration/savevm-async.c
-index aa2017d496..b97f2c4f14 100644
+index b3692739a0..e65a5e3482 100644
 --- a/migration/savevm-async.c
 +++ b/migration/savevm-async.c
-@@ -380,7 +380,7 @@ void qmp_savevm_start(const char *statefile, Error **errp)
+@@ -367,7 +367,7 @@ void qmp_savevm_start(bool has_statefile, const char *statefile, Error **errp)
     QIOChannel *ioc = QIO_CHANNEL(qio_channel_savevm_async_new(snap_state.target,
                                                                &snap_state.bs_pos));
@@ -204,7 +204,7 @@ index aa2017d496..b97f2c4f14 100644
     if (!snap_state.file) {
         error_set(errp, ERROR_CLASS_GENERIC_ERROR, "failed to open '%s'", statefile);
-@@ -498,7 +498,8 @@ int load_snapshot_from_blockdev(const char *filename, Error **errp)
+@@ -500,7 +500,8 @@ int load_snapshot_from_blockdev(const char *filename, Error **errp)
     blk_op_block_all(be, blocker);
     /* restore the VM state */
--- a/debian/patches/pve/0019-PVE-block-add-the-zeroinit-block-driver-filter.patch
+++ b/debian/patches/pve/0019-PVE-block-add-the-zeroinit-block-driver-filter.patch
@@ -4,19 +4,19 @@ Date: Mon, 6 Apr 2020 12:16:47 +0200
 Subject: [PATCH] PVE: block: add the zeroinit block driver filter
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
-[FE: adapt to changed function signatures]
+[adapt to changed function signatures]
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
+Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 ---
 block/meson.build |   1 +
- block/zeroinit.c  | 200 ++++++++++++++++++++++++++++++++++++++++++++++
+ block/zeroinit.c  | 196 ++++++++++++++++++++++++++++++++++++++++++++++
- 2 files changed, 201 insertions(+)
+ 2 files changed, 197 insertions(+)
 create mode 100644 block/zeroinit.c
 diff --git a/block/meson.build b/block/meson.build
-index 382bec0e7d..253fe49fa2 100644
+index 60bc305597..ad40c10b6a 100644
 --- a/block/meson.build
 +++ b/block/meson.build
-@@ -44,6 +44,7 @@ block_ss.add(files(
+@@ -43,6 +43,7 @@ block_ss.add(files(
   'vmdk.c',
   'vpc.c',
   'write-threshold.c',
@@ -26,10 +26,10 @@ index 382bec0e7d..253fe49fa2 100644
 softmmu_ss.add(when: 'CONFIG_TCG', if_true: files('blkreplay.c'))
 diff --git a/block/zeroinit.c b/block/zeroinit.c
 new file mode 100644
-index 0000000000..1257342724
+index 0000000000..20ee611f22
 --- /dev/null
 +++ b/block/zeroinit.c
-@@ -0,0 +1,200 @@
+@@ -0,0 +1,196 @@
 +/*
 + * Filter to fake a zero-initialized block device.
 + *
@@ -43,7 +43,6 @@ index 0000000000..1257342724
 +#include "qemu/osdep.h"
 +#include "qapi/error.h"
 +#include "block/block_int.h"
 +#include "block/block-io.h"
 +#include "qapi/qmp/qdict.h"
 +#include "qapi/qmp/qstring.h"
 +#include "qemu/cutils.h"
@@ -110,9 +109,7 @@ index 0000000000..1257342724
 +
 +    /* Open the raw file */
 +    bs->file = bdrv_open_child(qemu_opt_get(opts, "x-next"), options, "next",
-+                               bs, &child_of_bds,
+                               bs, &child_of_bds, BDRV_CHILD_FILTERED, false, &local_err);
 +                               BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
 +                               false, &local_err);
 +    if (local_err) {
 +        ret = -EINVAL;
 +        error_propagate(errp, local_err);
@@ -137,9 +134,9 @@ index 0000000000..1257342724
 +    (void)s;
 +}
 +
-+static coroutine_fn int64_t zeroinit_co_getlength(BlockDriverState *bs)
+static int64_t zeroinit_getlength(BlockDriverState *bs)
 +{
-+    return bdrv_co_getlength(bs->file->bs);
+    return bdrv_getlength(bs->file->bs);
 +}
 +
 +static int coroutine_fn zeroinit_co_preadv(BlockDriverState *bs,
@@ -191,10 +188,9 @@ index 0000000000..1257342724
 +    return bdrv_co_truncate(bs->file, offset, exact, prealloc, req_flags, errp);
 +}
 +
-+static coroutine_fn int zeroinit_co_get_info(BlockDriverState *bs,
+static int zeroinit_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
 +                                             BlockDriverInfo *bdi)
 +{
-+    return bdrv_co_get_info(bs->file->bs, bdi);
+    return bdrv_get_info(bs->file->bs, bdi);
 +}
 +
 +static BlockDriver bdrv_zeroinit = {
@@ -205,7 +201,7 @@ index 0000000000..1257342724
 +    .bdrv_parse_filename              = zeroinit_parse_filename,
 +    .bdrv_file_open                   = zeroinit_open,
 +    .bdrv_close                       = zeroinit_close,
-+    .bdrv_co_getlength                = zeroinit_co_getlength,
+    .bdrv_getlength                   = zeroinit_getlength,
 +    .bdrv_child_perm                  = bdrv_default_perms,
 +    .bdrv_co_flush_to_disk            = zeroinit_co_flush,
 +
@@ -221,7 +217,7 @@ index 0000000000..1257342724
 +    .bdrv_co_pdiscard                 = zeroinit_co_pdiscard,
 +
 +    .bdrv_co_truncate                 = zeroinit_co_truncate,
-+    .bdrv_co_get_info                 = zeroinit_co_get_info,
+    .bdrv_get_info                    = zeroinit_get_info,
 +};
 +
 +static void bdrv_zeroinit_init(void)
--- a/debian/patches/pve/0020-PVE-Add-dummy-id-command-line-parameter.patch
+++ b/debian/patches/pve/0020-PVE-Add-dummy-id-command-line-parameter.patch
@@ -14,10 +14,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 2 files changed, 11 insertions(+)
 diff --git a/qemu-options.hx b/qemu-options.hx
-index fdd551c2bb..4eb43b7bc5 100644
+index c2ca6e91b5..ab4734ef32 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
-@@ -1162,6 +1162,9 @@ legacy PC, they are not recommended for modern configurations.
+@@ -1118,6 +1118,9 @@ backend describes how QEMU handles the data.
 ERST
@@ -28,10 +28,10 @@ index fdd551c2bb..4eb43b7bc5 100644
     "-fda/-fdb file  use 'file' as floppy disk 0/1 image\n", QEMU_ARCH_ALL)
 DEF("fdb", HAS_ARG, QEMU_OPTION_fdb, "", QEMU_ARCH_ALL)
 diff --git a/softmmu/vl.c b/softmmu/vl.c
-index 0eabc71b68..323f6a23d4 100644
+index b8637c4262..39f149924e 100644
 --- a/softmmu/vl.c
 +++ b/softmmu/vl.c
-@@ -2648,6 +2648,7 @@ void qemu_init(int argc, char **argv)
+@@ -2620,6 +2620,7 @@ void qemu_init(int argc, char **argv, char **envp)
     MachineClass *machine_class;
     bool userconfig = true;
     FILE *vmstate_dump_file = NULL;
@@ -39,7 +39,7 @@ index 0eabc71b68..323f6a23d4 100644
     qemu_add_opts(&qemu_drive_opts);
     qemu_add_drive_opts(&qemu_legacy_drive_opts);
-@@ -3271,6 +3272,13 @@ void qemu_init(int argc, char **argv)
+@@ -3245,6 +3246,13 @@ void qemu_init(int argc, char **argv, char **envp)
                 machine_parse_property_opt(qemu_find_opts("smp-opts"),
                                            "smp", optarg);
                 break;
--- a/debian/patches/pve/0021-PVE-Config-Revert-target-i386-disable-LINT0-after-re.patch
+++ b/debian/patches/pve/0021-PVE-Config-Revert-target-i386-disable-LINT0-after-re.patch
@@ -11,10 +11,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 1 file changed, 9 insertions(+)
 diff --git a/hw/intc/apic_common.c b/hw/intc/apic_common.c
-index 4a34f03047..59b917e50c 100644
+index 2a20982066..7968ad5a93 100644
 --- a/hw/intc/apic_common.c
 +++ b/hw/intc/apic_common.c
-@@ -252,6 +252,15 @@ static void apic_reset_common(DeviceState *dev)
+@@ -278,6 +278,15 @@ static void apic_reset_common(DeviceState *dev)
     info->vapic_base_update(s);
     apic_init_reset(dev);
--- a/debian/patches/pve/0022-PVE-Up-Config-file-posix-make-locking-optiono-on-cre.patch
+++ b/debian/patches/pve/0022-PVE-Up-Config-file-posix-make-locking-optiono-on-cre.patch
@@ -13,10 +13,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 2 files changed, 42 insertions(+), 20 deletions(-)
 diff --git a/block/file-posix.c b/block/file-posix.c
-index 9681bd0434..044890822d 100644
+index 3d60b80286..49ee1db5f9 100644
 --- a/block/file-posix.c
 +++ b/block/file-posix.c
-@@ -2483,6 +2483,7 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
+@@ -2475,6 +2475,7 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
     int fd;
     uint64_t perm, shared;
     int result = 0;
@@ -24,7 +24,7 @@ index 9681bd0434..044890822d 100644
     /* Validate options and set default values */
     assert(options->driver == BLOCKDEV_DRIVER_FILE);
-@@ -2523,19 +2524,22 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
+@@ -2515,19 +2516,22 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
     perm = BLK_PERM_WRITE | BLK_PERM_RESIZE;
     shared = BLK_PERM_ALL & ~BLK_PERM_RESIZE;
@@ -59,7 +59,7 @@ index 9681bd0434..044890822d 100644
     }
     /* Clear the file by truncating it to 0 */
-@@ -2589,13 +2593,15 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
+@@ -2581,13 +2585,15 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
     }
 out_unlock:
@@ -82,7 +82,7 @@ index 9681bd0434..044890822d 100644
     }
 out_close:
-@@ -2619,6 +2625,7 @@ raw_co_create_opts(BlockDriver *drv, const char *filename,
+@@ -2612,6 +2618,7 @@ static int coroutine_fn raw_co_create_opts(BlockDriver *drv,
     PreallocMode prealloc;
     char *buf = NULL;
     Error *local_err = NULL;
@@ -90,7 +90,7 @@ index 9681bd0434..044890822d 100644
     /* Skip file: protocol prefix */
     strstart(filename, "file:", &filename);
-@@ -2641,6 +2648,18 @@ raw_co_create_opts(BlockDriver *drv, const char *filename,
+@@ -2634,6 +2641,18 @@ static int coroutine_fn raw_co_create_opts(BlockDriver *drv,
         return -EINVAL;
     }
@@ -109,7 +109,7 @@ index 9681bd0434..044890822d 100644
     options = (BlockdevCreateOptions) {
         .driver     = BLOCKDEV_DRIVER_FILE,
         .u.file     = {
-@@ -2652,6 +2671,8 @@ raw_co_create_opts(BlockDriver *drv, const char *filename,
+@@ -2645,6 +2664,8 @@ static int coroutine_fn raw_co_create_opts(BlockDriver *drv,
             .nocow              = nocow,
             .has_extent_size_hint = has_extent_size_hint,
             .extent_size_hint   = extent_size_hint,
@@ -119,10 +119,10 @@ index 9681bd0434..044890822d 100644
     };
     return raw_co_create(&options, errp);
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 3c945c1f93..542add004b 100644
+index e1857e7094..ddac91e8f6 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -4740,7 +4740,8 @@
+@@ -4537,7 +4537,8 @@
             'size':                 'size',
             '*preallocation':       'PreallocMode',
             '*nocow':               'bool',
--- a/debian/patches/pve/0024-PVE-Compat-4.0-used-balloon-qemu-4-0-config-size-fal.patch
+++ b/debian/patches/pve/0024-PVE-Compat-4.0-used-balloon-qemu-4-0-config-size-fal.patch
@@ -26,10 +26,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 1 file changed, 2 insertions(+), 1 deletion(-)
 diff --git a/hw/core/machine.c b/hw/core/machine.c
-index 2f6ccf5623..a5927e92f1 100644
+index a673302cce..fa424440bd 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
-@@ -142,7 +142,8 @@ GlobalProperty hw_compat_4_0[] = {
+@@ -127,7 +127,8 @@ GlobalProperty hw_compat_4_0[] = {
     { "virtio-vga",     "edid", "false" },
     { "virtio-gpu-device", "edid", "false" },
     { "virtio-device", "use-started", "false" },
--- a/debian/patches/pve/0025-PVE-Allow-version-code-in-machine-type.patch
+++ b/debian/patches/pve/0025-PVE-Allow-version-code-in-machine-type.patch
@@ -11,71 +11,70 @@ and only if 'is-current').
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 [FE: adapt to QAPI changes]
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
- hw/core/machine-qmp-cmds.c |  5 +++++
+ hw/core/machine-qmp-cmds.c |  6 ++++++
 include/hw/boards.h        |  2 ++
 qapi/machine.json          |  4 +++-
 softmmu/vl.c               | 25 +++++++++++++++++++++++++
- 4 files changed, 35 insertions(+), 1 deletion(-)
+ 4 files changed, 36 insertions(+), 1 deletion(-)
 diff --git a/hw/core/machine-qmp-cmds.c b/hw/core/machine-qmp-cmds.c
-index 24595f618c..ee9cb0cd04 100644
+index 76fff60a6b..ec9201fb9a 100644
 --- a/hw/core/machine-qmp-cmds.c
 +++ b/hw/core/machine-qmp-cmds.c
-@@ -107,6 +107,11 @@ MachineInfoList *qmp_query_machines(Error **errp)
+@@ -103,6 +103,12 @@ MachineInfoList *qmp_query_machines(Error **errp)
         if (strcmp(mc->name, MACHINE_GET_CLASS(current_machine)->name) == 0) {
             info->has_is_current = true;
             info->is_current = true;
 +
 +            // PVE version string only exists for current machine
 +            if (mc->pve_version) {
 +                info->has_pve_version = true;
 +                info->pve_version = g_strdup(mc->pve_version);
 +            }
         }
         if (mc->default_cpu_type) {
 diff --git a/include/hw/boards.h b/include/hw/boards.h
-index 6fbbfd56c8..61a526e97d 100644
+index 7b416c9787..8ae15c51aa 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
-@@ -232,6 +232,8 @@ struct MachineClass {
+@@ -230,6 +230,8 @@ struct MachineClass {
     const char *desc;
     const char *deprecation_reason;
 +    const char *pve_version;
 +
     void (*init)(MachineState *state);
-     void (*reset)(MachineState *state, ShutdownCause reason);
+     void (*reset)(MachineState *state);
     void (*wakeup)(MachineState *state);
 diff --git a/qapi/machine.json b/qapi/machine.json
-index c904280085..47f3facdb2 100644
+index 555458f785..d868e4d31d 100644
 --- a/qapi/machine.json
 +++ b/qapi/machine.json
-@@ -159,6 +159,8 @@
+@@ -157,6 +157,8 @@
 #
- # @acpi: machine type supports ACPI (since 8.0)
+ # @default-ram-id: the default ID of initial RAM memory backend (since 5.2)
 #
 +# @pve-version: custom PVE version suffix specified as 'machine+pveN'
 +#
 # Since: 1.2
 ##
 { 'struct': 'MachineInfo',
-@@ -166,7 +168,7 @@
+@@ -164,7 +166,7 @@
             '*is-default': 'bool', '*is-current': 'bool', 'cpu-max': 'int',
             'hotpluggable-cpus': 'bool',  'numa-mem-supported': 'bool',
             'deprecated': 'bool', '*default-cpu-type': 'str',
-            '*default-ram-id': 'str', 'acpi': 'bool' } }
+-            '*default-ram-id': 'str' } }
-+            '*default-ram-id': 'str', 'acpi': 'bool', '*pve-version': 'str' } }
+            '*default-ram-id': 'str', '*pve-version': 'str' } }
 ##
 # @query-machines:
 diff --git a/softmmu/vl.c b/softmmu/vl.c
-index 323f6a23d4..25abdc9da7 100644
+index 39f149924e..0d233d55f3 100644
 --- a/softmmu/vl.c
 +++ b/softmmu/vl.c
-@@ -1578,6 +1578,7 @@ static const QEMUOption *lookup_opt(int argc, char **argv,
+@@ -1580,6 +1580,7 @@ static const QEMUOption *lookup_opt(int argc, char **argv,
 static MachineClass *select_machine(QDict *qdict, Error **errp)
 {
     const char *optarg = qdict_get_try_str(qdict, "type");
@@ -83,7 +82,7 @@ index 323f6a23d4..25abdc9da7 100644
     GSList *machines = object_class_get_list(TYPE_MACHINE, false);
     MachineClass *machine_class;
     Error *local_err = NULL;
-@@ -1595,6 +1596,11 @@ static MachineClass *select_machine(QDict *qdict, Error **errp)
+@@ -1597,6 +1598,11 @@ static MachineClass *select_machine(QDict *qdict, Error **errp)
         }
     }
@@ -95,7 +94,7 @@ index 323f6a23d4..25abdc9da7 100644
     g_slist_free(machines);
     if (local_err) {
         error_append_hint(&local_err, "Use -machine help to list supported machines\n");
-@@ -3213,12 +3219,31 @@ void qemu_init(int argc, char **argv)
+@@ -3187,12 +3193,31 @@ void qemu_init(int argc, char **argv, char **envp)
             case QEMU_OPTION_machine:
                 {
                     bool help;
--- a/debian/patches/pve/0026-block-backup-move-bcs-bitmap-initialization-to-job-c.patch
+++ b/debian/patches/pve/0026-block-backup-move-bcs-bitmap-initialization-to-job-c.patch
@@ -25,7 +25,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 1 file changed, 4 insertions(+), 4 deletions(-)
 diff --git a/block/backup.c b/block/backup.c
-index db3791f4d1..39410dcf8d 100644
+index b2b649e305..b6fa9e8a69 100644
 --- a/block/backup.c
 +++ b/block/backup.c
@@ -237,8 +237,8 @@ static void backup_init_bcs_bitmap(BackupBlockJob *job)
@@ -48,7 +48,7 @@ index db3791f4d1..39410dcf8d 100644
     if (s->sync_mode == MIRROR_SYNC_MODE_TOP) {
         int64_t offset = 0;
         int64_t count;
-@@ -495,6 +493,8 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
+@@ -492,6 +490,8 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
     block_job_add_bdrv(&job->common, "target", target, 0, BLK_PERM_ALL,
                        &error_abort);
--- a/debian/patches/pve/0027-PVE-Backup-add-vma-backup-format-code.patch
+++ b/debian/patches/pve/0027-PVE-Backup-add-vma-backup-format-code.patch
@@ -3,46 +3,40 @@ From: Dietmar Maurer <dietmar@proxmox.com>
 Date: Mon, 6 Apr 2020 12:16:57 +0200
 Subject: [PATCH] PVE-Backup: add vma backup format code
 Notes about partial restoring: skipping a certain drive is done via a
 map line of the form skip=drive-scsi0. Since in PVE, most archives are
 compressed and piped to vma for restore, it's not easily possible to
 skip reads.
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
-[FE: improvements during create
+[FE: create: register all streams before entering coroutines]
-     allow partial restore]
+Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 block/meson.build |   2 +
 meson.build       |   5 +
- vma-reader.c      | 867 ++++++++++++++++++++++++++++++++++++++++++++
+ vma-reader.c      | 859 ++++++++++++++++++++++++++++++++++++++++++++++
- vma-writer.c      | 793 ++++++++++++++++++++++++++++++++++++++++
+ vma-writer.c      | 791 ++++++++++++++++++++++++++++++++++++++++++
- vma.c             | 900 ++++++++++++++++++++++++++++++++++++++++++++++
+ vma.c             | 849 +++++++++++++++++++++++++++++++++++++++++++++
 vma.h             | 150 ++++++++
- 6 files changed, 2717 insertions(+)
+ 6 files changed, 2656 insertions(+)
 create mode 100644 vma-reader.c
 create mode 100644 vma-writer.c
 create mode 100644 vma.c
 create mode 100644 vma.h
 diff --git a/block/meson.build b/block/meson.build
-index 253fe49fa2..744b698a82 100644
+index ad40c10b6a..3a0b84bc11 100644
 --- a/block/meson.build
 +++ b/block/meson.build
-@@ -47,6 +47,8 @@ block_ss.add(files(
+@@ -46,6 +46,8 @@ block_ss.add(files(
   'zeroinit.c',
 ), zstd, zlib, gnutls)
 +block_ss.add(files('../vma-writer.c'), libuuid)
 +
 softmmu_ss.add(when: 'CONFIG_TCG', if_true: files('blkreplay.c'))
 softmmu_ss.add(files('block-ram-registrar.c'))
 if get_option('qcow1').allowed()
 diff --git a/meson.build b/meson.build
-index 30447cfaef..38a4e2bcef 100644
+index d5230eadd6..ffff66c0cc 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -1527,6 +1527,8 @@ keyutils = dependency('libkeyutils', required: false,
+@@ -1462,6 +1462,8 @@ keyutils = dependency('libkeyutils', required: false,
 has_gettid = cc.has_function('gettid')
@@ -51,7 +45,7 @@ index 30447cfaef..38a4e2bcef 100644
 # libselinux
 selinux = dependency('libselinux',
                      required: get_option('selinux'),
-@@ -3650,6 +3652,9 @@ if have_tools
+@@ -3607,6 +3609,9 @@ if have_tools
                dependencies: [blockdev, qemuutil, gnutls, selinux],
                install: true)
@@ -63,10 +57,10 @@ index 30447cfaef..38a4e2bcef 100644
   subdir('contrib/elf2dmp')
 diff --git a/vma-reader.c b/vma-reader.c
 new file mode 100644
-index 0000000000..81a891c6b1
+index 0000000000..e65f1e8415
 --- /dev/null
 +++ b/vma-reader.c
-@@ -0,0 +1,867 @@
+@@ -0,0 +1,859 @@
 +/*
 + * VMA: Virtual Machine Archive
 + *
@@ -97,7 +91,6 @@ index 0000000000..81a891c6b1
 +    bool write_zeroes;
 +    unsigned long *bitmap;
 +    int bitmap_size;
 +    bool skip;
 +}  VmaRestoreState;
 +
 +struct VmaReader {
@@ -495,14 +488,13 @@ index 0000000000..81a891c6b1
 +}
 +
 +static void allocate_rstate(VmaReader *vmar,  guint8 dev_id,
-+                            BlockBackend *target, bool write_zeroes, bool skip)
+                            BlockBackend *target, bool write_zeroes)
 +{
 +    assert(vmar);
 +    assert(dev_id);
 +
 +    vmar->rstate[dev_id].target = target;
 +    vmar->rstate[dev_id].write_zeroes = write_zeroes;
 +    vmar->rstate[dev_id].skip = skip;
 +
 +    int64_t size = vmar->devinfo[dev_id].size;
 +
@@ -517,30 +509,28 @@ index 0000000000..81a891c6b1
 +}
 +
 +int vma_reader_register_bs(VmaReader *vmar, guint8 dev_id, BlockBackend *target,
-+                           bool write_zeroes, bool skip, Error **errp)
+                           bool write_zeroes, Error **errp)
 +{
 +    assert(vmar);
-+    assert(target != NULL || skip);
+    assert(target != NULL);
 +    assert(dev_id);
-+    assert(vmar->rstate[dev_id].target == NULL && !vmar->rstate[dev_id].skip);
+    assert(vmar->rstate[dev_id].target == NULL);
 +
-+    if (target != NULL) {
+    int64_t size = blk_getlength(target);
-+        int64_t size = blk_getlength(target);
+    int64_t size_diff = size - vmar->devinfo[dev_id].size;
 +        int64_t size_diff = size - vmar->devinfo[dev_id].size;
 +
-+        /* storage types can have different size restrictions, so it
+    /* storage types can have different size restrictions, so it
-+         * is not always possible to create an image with exact size.
+     * is not always possible to create an image with exact size.
-+         * So we tolerate a size difference up to 4MB.
+     * So we tolerate a size difference up to 4MB.
-+         */
+     */
-+        if ((size_diff < 0) || (size_diff > 4*1024*1024)) {
+    if ((size_diff < 0) || (size_diff > 4*1024*1024)) {
-+            error_setg(errp, "vma_reader_register_bs for stream %s failed - "
+        error_setg(errp, "vma_reader_register_bs for stream %s failed - "
-+                       "unexpected size %zd != %zd", vmar->devinfo[dev_id].devname,
+                   "unexpected size %zd != %zd", vmar->devinfo[dev_id].devname,
-+                       size, vmar->devinfo[dev_id].size);
+                   size, vmar->devinfo[dev_id].size);
-+            return -1;
+        return -1;
 +        }
 +    }
 +
-+    allocate_rstate(vmar, dev_id, target, write_zeroes, skip);
+    allocate_rstate(vmar, dev_id, target, write_zeroes);
 +
 +    return 0;
 +}
@@ -633,23 +623,19 @@ index 0000000000..81a891c6b1
 +        VmaRestoreState *rstate = &vmar->rstate[dev_id];
 +        BlockBackend *target = NULL;
 +
 +        bool skip = rstate->skip;
 +
 +        if (dev_id != vmar->vmstate_stream) {
 +            target = rstate->target;
-+            if (!verify && !target && !skip) {
+            if (!verify && !target) {
 +                error_setg(errp, "got wrong dev id %d", dev_id);
 +                return -1;
 +            }
 +
-+            if (!skip) {
+            if (vma_reader_get_bitmap(rstate, cluster_num)) {
-+                if (vma_reader_get_bitmap(rstate, cluster_num)) {
+                error_setg(errp, "found duplicated cluster %zd for stream %s",
-+                    error_setg(errp, "found duplicated cluster %zd for stream %s",
+                          cluster_num, vmar->devinfo[dev_id].devname);
-+                              cluster_num, vmar->devinfo[dev_id].devname);
+                return -1;
 +                    return -1;
 +                }
 +                vma_reader_set_bitmap(rstate, cluster_num, 1);
 +            }
 +            vma_reader_set_bitmap(rstate, cluster_num, 1);
 +
 +            max_sector = vmar->devinfo[dev_id].size/BDRV_SECTOR_SIZE;
 +        } else {
@@ -695,7 +681,7 @@ index 0000000000..81a891c6b1
 +                return -1;
 +            }
 +
-+            if (!verify && !skip) {
+            if (!verify) {
 +                int nb_sectors = end_sector - sector_num;
 +                if (restore_write_data(vmar, dev_id, target, vmstate_fd,
 +                                       buf + start, sector_num, nb_sectors,
@@ -731,7 +717,7 @@ index 0000000000..81a891c6b1
 +                        return -1;
 +                    }
 +
-+                    if (!verify && !skip) {
+                    if (!verify) {
 +                        int nb_sectors = end_sector - sector_num;
 +                        if (restore_write_data(vmar, dev_id, target, vmstate_fd,
 +                                               buf + start, sector_num,
@@ -756,7 +742,7 @@ index 0000000000..81a891c6b1
 +                            vmar->partial_zero_cluster_data += zero_size;
 +                        }
 +
-+                        if (rstate->write_zeroes && !verify && !skip) {
+                        if (rstate->write_zeroes && !verify) {
 +                            if (restore_write_data(vmar, dev_id, target, vmstate_fd,
 +                                                   zero_vma_block, sector_num,
 +                                                   nb_sectors, errp) < 0) {
@@ -927,7 +913,7 @@ index 0000000000..81a891c6b1
 +
 +    for (dev_id = 1; dev_id < 255; dev_id++) {
 +        if (vma_reader_get_device_info(vmar, dev_id)) {
-+            allocate_rstate(vmar, dev_id, NULL, false, false);
+            allocate_rstate(vmar, dev_id, NULL, false);
 +        }
 +    }
 +
@@ -936,10 +922,10 @@ index 0000000000..81a891c6b1
 +
 diff --git a/vma-writer.c b/vma-writer.c
 new file mode 100644
-index 0000000000..ac7da237d0
+index 0000000000..df4b20793d
 --- /dev/null
 +++ b/vma-writer.c
-@@ -0,0 +1,793 @@
+@@ -0,0 +1,791 @@
 +/*
 + * VMA: Virtual Machine Archive
 + *
@@ -1253,8 +1239,6 @@ index 0000000000..ac7da237d0
 +        }
 +
 +        if (vmaw->fd < 0) {
 +            error_free(*errp);
 +            *errp = NULL;
 +            error_setg(errp, "can't open file %s - %s\n", filename,
 +                       g_strerror(errno));
 +            goto err;
@@ -1735,10 +1719,10 @@ index 0000000000..ac7da237d0
 +}
 diff --git a/vma.c b/vma.c
 new file mode 100644
-index 0000000000..347f6283ca
+index 0000000000..e8dffb43e0
 --- /dev/null
 +++ b/vma.c
-@@ -0,0 +1,900 @@
+@@ -0,0 +1,849 @@
 +/*
 + * VMA: Virtual Machine Archive
 + *
@@ -1772,7 +1756,7 @@ index 0000000000..347f6283ca
 +        "vma list <filename>\n"
 +        "vma config <filename> [-c config]\n"
 +        "vma create <filename> [-c config] pathname ...\n"
-+        "vma extract <filename> [-d <drive-list>] [-r <fifo>] <targetdir>\n"
+        "vma extract <filename> [-r <fifo>] <targetdir>\n"
 +        "vma verify <filename> [-v]\n"
 +        ;
 +
@@ -1879,7 +1863,6 @@ index 0000000000..347f6283ca
 +    char *throttling_group;
 +    char *cache;
 +    bool write_zero;
 +    bool skip;
 +} RestoreMap;
 +
 +static bool try_parse_option(char **line, const char *optname, char **out, const char *inbuf) {
@@ -1917,10 +1900,9 @@ index 0000000000..347f6283ca
 +    const char *filename;
 +    const char *dirname;
 +    const char *readmap = NULL;
 +    gchar **drive_list = NULL;
 +
 +    for (;;) {
-+        c = getopt(argc, argv, "hvd:r:");
+        c = getopt(argc, argv, "hvr:");
 +        if (c == -1) {
 +            break;
 +        }
@@ -1929,9 +1911,6 @@ index 0000000000..347f6283ca
 +        case 'h':
 +            help();
 +            break;
 +        case 'd':
 +            drive_list = g_strsplit(optarg, ",", 254);
 +            break;
 +        case 'r':
 +            readmap = optarg;
 +            break;
@@ -1991,61 +1970,47 @@ index 0000000000..347f6283ca
 +            char *bps = NULL;
 +            char *group = NULL;
 +            char *cache = NULL;
 +            char *devname = NULL;
 +            bool skip = false;
 +            uint64_t bps_value = 0;
 +            const char *path = NULL;
 +            bool write_zero = true;
 +
 +            if (!line || line[0] == '\0' || !strcmp(line, "done\n")) {
 +                break;
 +            }
 +            int len = strlen(line);
 +            if (line[len - 1] == '\n') {
 +                line[len - 1] = '\0';
-+                len = len - 1;
+                if (len == 1) {
 +                if (len == 0) {
 +                    break;
 +                }
 +            }
 +
-+            if (strncmp(line, "skip", 4) == 0) {
+            while (1) {
-+                if (len < 6 || line[4] != '=') {
+                if (!try_parse_option(&line, "format", &format, inbuf) &&
-+                    g_error("read map failed - option 'skip' has no value ('%s')",
+                    !try_parse_option(&line, "throttling.bps", &bps, inbuf) &&
-+                            inbuf);
+                    !try_parse_option(&line, "throttling.group", &group, inbuf) &&
-+                } else {
+                    !try_parse_option(&line, "cache", &cache, inbuf))
-+                    devname = line + 5;
+                {
-+                    skip = true;
+                    break;
 +                }
 +            } else {
 +                while (1) {
 +                    if (!try_parse_option(&line, "format", &format, inbuf) &&
 +                        !try_parse_option(&line, "throttling.bps", &bps, inbuf) &&
 +                        !try_parse_option(&line, "throttling.group", &group, inbuf) &&
 +                        !try_parse_option(&line, "cache", &cache, inbuf))
 +                    {
 +                        break;
 +                    }
 +                }
 +
 +                if (bps) {
 +                    bps_value = verify_u64(bps);
 +                    g_free(bps);
 +                }
 +
 +                if (line[0] == '0' && line[1] == ':') {
 +                    path = line + 2;
 +                    write_zero = false;
 +                } else if (line[0] == '1' && line[1] == ':') {
 +                    path = line + 2;
 +                    write_zero = true;
 +                } else {
 +                    g_error("read map failed - parse error ('%s')", inbuf);
 +                }
 +
 +                path = extract_devname(path, &devname, -1);
 +            }
 +
 +            uint64_t bps_value = 0;
 +            if (bps) {
 +                bps_value = verify_u64(bps);
 +                g_free(bps);
 +            }
 +
 +            const char *path;
 +            bool write_zero;
 +            if (line[0] == '0' && line[1] == ':') {
 +                path = line + 2;
 +                write_zero = false;
 +            } else if (line[0] == '1' && line[1] == ':') {
 +                path = line + 2;
 +                write_zero = true;
 +            } else {
 +                g_error("read map failed - parse error ('%s')", inbuf);
 +            }
 +
 +            char *devname = NULL;
 +            path = extract_devname(path, &devname, -1);
 +            if (!devname) {
 +                g_error("read map failed - no dev name specified ('%s')",
 +                        inbuf);
@@ -2059,7 +2024,6 @@ index 0000000000..347f6283ca
 +            map->throttling_group = group;
 +            map->cache = cache;
 +            map->write_zero = write_zero;
 +            map->skip = skip;
 +
 +            g_hash_table_insert(devmap, map->devname, map);
 +
@@ -2068,12 +2032,12 @@ index 0000000000..347f6283ca
 +
 +    int i;
 +    int vmstate_fd = -1;
-+    bool drive_rename_bitmap[255];
+    guint8 vmstate_stream = 0;
 +    memset(drive_rename_bitmap, 0, sizeof(drive_rename_bitmap));
 +
 +    for (i = 1; i < 255; i++) {
 +        VmaDeviceInfo *di = vma_reader_get_device_info(vmar, i);
 +        if (di && (strcmp(di->devname, "vmstate") == 0)) {
 +            vmstate_stream = i;
 +            char *statefn = g_strdup_printf("%s/vmstate.bin", dirname);
 +            vmstate_fd = open(statefn, O_WRONLY|O_CREAT|O_EXCL, 0644);
 +            if (vmstate_fd < 0) {
@@ -2089,25 +2053,10 @@ index 0000000000..347f6283ca
 +            const char *cache = NULL;
 +            int flags = BDRV_O_RDWR;
 +            bool write_zero = true;
 +            bool skip = false;
 +
 +            BlockBackend *blk = NULL;
 +
-+            if (drive_list) {
+            if (readmap) {
 +                skip = true;
 +                int j;
 +                for (j = 0; drive_list[j]; j++) {
 +                    if (strcmp(drive_list[j], di->devname) == 0) {
 +                        skip = false;
 +                        drive_rename_bitmap[i] = true;
 +                        break;
 +                    }
 +                }
 +            } else {
 +                drive_rename_bitmap[i] = true;
 +            }
 +
 +            if (!skip && readmap) {
 +                RestoreMap *map;
 +                map = (RestoreMap *)g_hash_table_lookup(devmap, di->devname);
 +                if (map == NULL) {
@@ -2119,8 +2068,7 @@ index 0000000000..347f6283ca
 +                throttling_group = map->throttling_group;
 +                cache = map->cache;
 +                write_zero = map->write_zero;
-+                skip = map->skip;
+            } else {
 +            } else if (!skip) {
 +                devfn = g_strdup_printf("%s/tmp-disk-%s.raw",
 +                                        dirname, di->devname);
 +                printf("DEVINFO %s %zd\n", devfn, di->size);
@@ -2138,60 +2086,57 @@ index 0000000000..347f6283ca
 +                write_zero = false;
 +            }
 +
-+            if (!skip) {
+	    size_t devlen = strlen(devfn);
-+                size_t devlen = strlen(devfn);
+	    QDict *options = NULL;
-+                QDict *options = NULL;
+            bool writethrough;
-+                bool writethrough;
+            if (format) {
-+                if (format) {
+                /* explicit format from commandline */
-+                    /* explicit format from commandline */
+                options = qdict_new();
-+                    options = qdict_new();
+                qdict_put_str(options, "driver", format);
-+                    qdict_put_str(options, "driver", format);
+            } else if ((devlen > 4 && strcmp(devfn+devlen-4, ".raw") == 0) ||
-+                } else if ((devlen > 4 && strcmp(devfn+devlen-4, ".raw") == 0) ||
+	               strncmp(devfn, "/dev/", 5) == 0)
-+                    strncmp(devfn, "/dev/", 5) == 0)
+	    {
-+                {
+                /* This part is now deprecated for PVE as well (just as qemu
-+                    /* This part is now deprecated for PVE as well (just as qemu
+                 * deprecated not specifying an explicit raw format, too.
-+                     * deprecated not specifying an explicit raw format, too.
+                 */
-+                     */
+		/* explicit raw format */
-+                    /* explicit raw format */
+		options = qdict_new();
-+                    options = qdict_new();
+		qdict_put_str(options, "driver", "raw");
-+                    qdict_put_str(options, "driver", "raw");
+	    }
-+                }
+            if (cache && bdrv_parse_cache_mode(cache, &flags, &writethrough)) {
-+
+                g_error("invalid cache option: %s\n", cache);
 +                if (cache && bdrv_parse_cache_mode(cache, &flags, &writethrough)) {
 +                    g_error("invalid cache option: %s\n", cache);
 +                }
 +
 +                if (errp || !(blk = blk_new_open(devfn, NULL, options, flags, &errp))) {
 +                    g_error("can't open file %s - %s", devfn,
 +                            error_get_pretty(errp));
 +                }
 +
 +                if (cache) {
 +                    blk_set_enable_write_cache(blk, !writethrough);
 +                }
 +
 +                if (throttling_group) {
 +                    blk_io_limits_enable(blk, throttling_group);
 +                }
 +
 +                if (throttling_bps) {
 +                    if (!throttling_group) {
 +                        blk_io_limits_enable(blk, devfn);
 +                    }
 +
 +                    ThrottleConfig cfg;
 +                    throttle_config_init(&cfg);
 +                    cfg.buckets[THROTTLE_BPS_WRITE].avg = throttling_bps;
 +                    Error *err = NULL;
 +                    if (!throttle_is_valid(&cfg, &err)) {
 +                        error_report_err(err);
 +                        g_error("failed to apply throttling");
 +                    }
 +                    blk_set_io_limits(blk, &cfg);
 +                }
 +            }
 +
-+            if (vma_reader_register_bs(vmar, i, blk, write_zero, skip, &errp) < 0) {
+	    if (errp || !(blk = blk_new_open(devfn, NULL, options, flags, &errp))) {
 +                g_error("can't open file %s - %s", devfn,
 +                        error_get_pretty(errp));
 +            }
 +
 +            if (cache) {
 +                blk_set_enable_write_cache(blk, !writethrough);
 +            }
 +
 +            if (throttling_group) {
 +                blk_io_limits_enable(blk, throttling_group);
 +            }
 +
 +            if (throttling_bps) {
 +                if (!throttling_group) {
 +                    blk_io_limits_enable(blk, devfn);
 +                }
 +
 +                ThrottleConfig cfg;
 +                throttle_config_init(&cfg);
 +                cfg.buckets[THROTTLE_BPS_WRITE].avg = throttling_bps;
 +                Error *err = NULL;
 +                if (!throttle_is_valid(&cfg, &err)) {
 +                    error_report_err(err);
 +                    g_error("failed to apply throttling");
 +                }
 +                blk_set_io_limits(blk, &cfg);
 +            }
 +
 +            if (vma_reader_register_bs(vmar, i, blk, write_zero, &errp) < 0) {
 +                g_error("%s", error_get_pretty(errp));
 +            }
 +
@@ -2201,10 +2146,6 @@ index 0000000000..347f6283ca
 +        }
 +    }
 +
 +    if (drive_list) {
 +        g_strfreev(drive_list);
 +    }
 +
 +    if (vma_reader_restore(vmar, vmstate_fd, verbose, &errp) < 0) {
 +        g_error("restore failed - %s", error_get_pretty(errp));
 +    }
@@ -2212,7 +2153,7 @@ index 0000000000..347f6283ca
 +    if (!readmap) {
 +        for (i = 1; i < 255; i++) {
 +            VmaDeviceInfo *di = vma_reader_get_device_info(vmar, i);
-+            if (di && drive_rename_bitmap[i]) {
+            if (di && (i != vmstate_stream)) {
 +                char *tmpfn = g_strdup_printf("%s/tmp-disk-%s.raw",
 +                                              dirname, di->devname);
 +                char *fn = g_strdup_printf("%s/disk-%s.raw",
@@ -2311,7 +2252,7 @@ index 0000000000..347f6283ca
 +    struct iovec iov;
 +    QEMUIOVector qiov;
 +
-+    int64_t start, end, readlen;
+    int64_t start, end;
 +    int ret = 0;
 +
 +    unsigned char *buf = blk_blockalign(job->target, VMA_CLUSTER_SIZE);
@@ -2325,24 +2266,16 @@ index 0000000000..347f6283ca
 +        iov.iov_len = VMA_CLUSTER_SIZE;
 +        qemu_iovec_init_external(&qiov, &iov, 1);
 +
 +        if (start + 1 == end) {
 +            memset(buf, 0, VMA_CLUSTER_SIZE);
 +            readlen = job->len - start * VMA_CLUSTER_SIZE;
 +            assert(readlen > 0 && readlen <= VMA_CLUSTER_SIZE);
 +        } else {
 +            readlen = VMA_CLUSTER_SIZE;
 +        }
 +
 +        ret = blk_co_preadv(job->target, start * VMA_CLUSTER_SIZE,
-+                            readlen, &qiov, 0);
+                            VMA_CLUSTER_SIZE, &qiov, 0);
 +        if (ret < 0) {
-+            vma_writer_set_error(job->vmaw, "read error");
+            vma_writer_set_error(job->vmaw, "read error", -1);
 +            goto out;
 +        }
 +
 +        size_t zb = 0;
 +        if (vma_writer_write(job->vmaw, job->dev_id, start, buf, &zb) < 0) {
-+            vma_writer_set_error(job->vmaw, "backup_dump_cb vma_writer_write failed");
+            vma_writer_set_error(job->vmaw, "backup_dump_cb vma_writer_write failed", -1);
 +            goto out;
 +        }
 +    }
@@ -2641,7 +2574,7 @@ index 0000000000..347f6283ca
 +}
 diff --git a/vma.h b/vma.h
 new file mode 100644
-index 0000000000..86d2873aa5
+index 0000000000..c895c97f6d
 --- /dev/null
 +++ b/vma.h
@@ -0,0 +1,150 @@
@@ -2779,7 +2712,7 @@ index 0000000000..86d2873aa5
 +int coroutine_fn vma_writer_flush_output(VmaWriter *vmaw);
 +
 +int vma_writer_get_status(VmaWriter *vmaw, VmaStatus *status);
-+void vma_writer_set_error(VmaWriter *vmaw, const char *fmt, ...) G_GNUC_PRINTF(2, 3);
+void vma_writer_set_error(VmaWriter *vmaw, const char *fmt, ...);
 +
 +
 +VmaReader *vma_reader_create(const char *filename, Error **errp);
@@ -2789,7 +2722,7 @@ index 0000000000..86d2873aa5
 +VmaDeviceInfo *vma_reader_get_device_info(VmaReader *vmar, guint8 dev_id);
 +int vma_reader_register_bs(VmaReader *vmar, guint8 dev_id,
 +                           BlockBackend *target, bool write_zeroes,
-+                           bool skip, Error **errp);
+                           Error **errp);
 +int vma_reader_restore(VmaReader *vmar, int vmstate_fd, bool verbose,
 +                       Error **errp);
 +int vma_reader_verify(VmaReader *vmar, bool verbose, Error **errp);
--- a/debian/patches/pve/0028-PVE-Backup-add-backup-dump-block-driver.patch
+++ b/debian/patches/pve/0028-PVE-Backup-add-backup-dump-block-driver.patch
@@ -9,23 +9,21 @@ Subject: [PATCH] PVE-Backup: add backup-dump block driver
 - job.c: make job_should_pause non-static
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 [FE: adapt to coroutine changes]
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
- block/backup-dump.c              | 168 +++++++++++++++++++++++++++++++
+ block/backup-dump.c              | 167 +++++++++++++++++++++++++++++++
 block/backup.c                   |  30 ++----
 block/meson.build                |   1 +
 include/block/block_int-common.h |  35 +++++++
 job.c                            |   3 +-
- 5 files changed, 214 insertions(+), 23 deletions(-)
+ 5 files changed, 213 insertions(+), 23 deletions(-)
 create mode 100644 block/backup-dump.c
 diff --git a/block/backup-dump.c b/block/backup-dump.c
 new file mode 100644
-index 0000000000..232a094426
+index 0000000000..04718a94e2
 --- /dev/null
 +++ b/block/backup-dump.c
-@@ -0,0 +1,168 @@
+@@ -0,0 +1,167 @@
 +/*
 + * BlockDriver to send backup data stream to a callback function
 + *
@@ -47,8 +45,7 @@ index 0000000000..232a094426
 +    void           *dump_cb_data;
 +} BDRVBackupDumpState;
 +
-+static coroutine_fn int qemu_backup_dump_co_get_info(BlockDriverState *bs,
+static int qemu_backup_dump_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
 +                                                     BlockDriverInfo *bdi)
 +{
 +    BDRVBackupDumpState *s = bs->opaque;
 +
@@ -89,7 +86,7 @@ index 0000000000..232a094426
 +    /* Nothing to do. */
 +}
 +
-+static coroutine_fn int64_t qemu_backup_dump_co_getlength(BlockDriverState *bs)
+static int64_t qemu_backup_dump_getlength(BlockDriverState *bs)
 +{
 +    BDRVBackupDumpState *s = bs->opaque;
 +
@@ -149,8 +146,8 @@ index 0000000000..232a094426
 +
 +    .bdrv_close                   = qemu_backup_dump_close,
 +    .bdrv_has_zero_init           = bdrv_has_zero_init_1,
-+    .bdrv_co_getlength            = qemu_backup_dump_co_getlength,
+    .bdrv_getlength               = qemu_backup_dump_getlength,
-+    .bdrv_co_get_info             = qemu_backup_dump_co_get_info,
+    .bdrv_get_info                = qemu_backup_dump_get_info,
 +
 +    .bdrv_co_writev               = qemu_backup_dump_co_writev,
 +
@@ -195,7 +192,7 @@ index 0000000000..232a094426
 +    return bs;
 +}
 diff --git a/block/backup.c b/block/backup.c
-index 39410dcf8d..af87fa6aa9 100644
+index b6fa9e8a69..789f8b7799 100644
 --- a/block/backup.c
 +++ b/block/backup.c
@@ -29,28 +29,6 @@
@@ -227,7 +224,7 @@ index 39410dcf8d..af87fa6aa9 100644
 static const BlockJobDriver backup_job_driver;
 static void backup_cleanup_sync_bitmap(BackupBlockJob *job, int ret)
-@@ -457,6 +435,14 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
+@@ -454,6 +432,14 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
     }
     cluster_size = block_copy_cluster_size(bcs);
@@ -243,7 +240,7 @@ index 39410dcf8d..af87fa6aa9 100644
     if (perf->max_chunk && perf->max_chunk < cluster_size) {
         error_setg(errp, "Required max-chunk (%" PRIi64 ") is less than backup "
 diff --git a/block/meson.build b/block/meson.build
-index 744b698a82..f580f95395 100644
+index 3a0b84bc11..7f22e7f177 100644
 --- a/block/meson.build
 +++ b/block/meson.build
@@ -4,6 +4,7 @@ block_ss.add(files(
@@ -255,18 +252,18 @@ index 744b698a82..f580f95395 100644
   'blkdebug.c',
   'blklogwrites.c',
 diff --git a/include/block/block_int-common.h b/include/block/block_int-common.h
-index f01bb8b617..d7ffd1826e 100644
+index 8947abab76..f272d0d8dc 100644
 --- a/include/block/block_int-common.h
 +++ b/include/block/block_int-common.h
@@ -26,6 +26,7 @@
- #include "block/aio.h"
+ #include "block/accounting.h"
- #include "block/block-common.h"
+ #include "block/block.h"
 +#include "block/block-copy.h"
- #include "block/block-global-state.h"
+ #include "block/aio-wait.h"
- #include "block/snapshot.h"
+ #include "qemu/queue.h"
- #include "qemu/iov.h"
+ #include "qemu/coroutine.h"
-@@ -60,6 +61,40 @@
+@@ -64,6 +65,40 @@
 #define BLOCK_PROBE_BUF_SIZE        512
@@ -308,16 +305,16 @@ index f01bb8b617..d7ffd1826e 100644
     BDRV_TRACKED_READ,
     BDRV_TRACKED_WRITE,
 diff --git a/job.c b/job.c
-index 72d57f0934..93e22d180b 100644
+index 075c6f3a20..e5699ad200 100644
 --- a/job.c
 +++ b/job.c
-@@ -330,7 +330,8 @@ static bool job_started_locked(Job *job)
+@@ -276,7 +276,8 @@ static bool job_started(Job *job)
     return job->co;
 }
- /* Called with job_mutex held. */
+-static bool job_should_pause(Job *job)
-static bool job_should_pause_locked(Job *job)
+bool job_should_pause(Job *job);
-+bool job_should_pause_locked(Job *job);
+bool job_should_pause(Job *job)
 +bool job_should_pause_locked(Job *job)
 {
     return job->pause_count > 0;
 }
--- a/debian/patches/pve/0029-PVE-Backup-proxmox-backup-patches-for-qemu.patch
+++ b/debian/patches/pve/0029-PVE-Backup-proxmox-backup-patches-for-qemu.patch
--- a/debian/patches/pve/0030-PVE-Backup-pbs-restore-new-command-to-restore-from-p.patch
+++ b/debian/patches/pve/0030-PVE-Backup-pbs-restore-new-command-to-restore-from-p.patch
@@ -5,19 +5,17 @@ Subject: [PATCH] PVE-Backup: pbs-restore - new command to restore from proxmox
 backup server
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 [WB: add namespace support]
 Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
 ---
 meson.build   |   4 +
- pbs-restore.c | 236 ++++++++++++++++++++++++++++++++++++++++++++++++++
+ pbs-restore.c | 223 ++++++++++++++++++++++++++++++++++++++++++++++++++
- 2 files changed, 240 insertions(+)
+ 2 files changed, 227 insertions(+)
 create mode 100644 pbs-restore.c
 diff --git a/meson.build b/meson.build
-index 443b3238f9..32ab849ce6 100644
+index 0bc2fb5b10..f48d2e0457 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -3656,6 +3656,10 @@ if have_tools
+@@ -3613,6 +3613,10 @@ if have_tools
   vma = executable('vma', files('vma.c', 'vma-reader.c') + genh,
                    dependencies: [authz, block, crypto, io, qom], install: true)
@@ -30,10 +28,10 @@ index 443b3238f9..32ab849ce6 100644
   subdir('contrib/elf2dmp')
 diff --git a/pbs-restore.c b/pbs-restore.c
 new file mode 100644
-index 0000000000..f03d9bab8d
+index 0000000000..2f834cf42e
 --- /dev/null
 +++ b/pbs-restore.c
-@@ -0,0 +1,236 @@
+@@ -0,0 +1,223 @@
 +/*
 + * Qemu image restore helper for Proxmox Backup
 + *
@@ -65,7 +63,7 @@ index 0000000000..f03d9bab8d
 +static void help(void)
 +{
 +    const char *help_msg =
-+        "usage: pbs-restore [--repository <repo>] [--ns namespace] snapshot archive-name target [command options]\n"
+        "usage: pbs-restore [--repository <repo>] snapshot archive-name target [command options]\n"
 +        ;
 +
 +    printf("%s", help_msg);
@@ -113,7 +111,6 @@ index 0000000000..f03d9bab8d
 +    Error *main_loop_err = NULL;
 +    const char *format = "raw";
 +    const char *repository = NULL;
 +    const char *backup_ns = NULL;
 +    const char *keyfile = NULL;
 +    int verbose = false;
 +    bool skip_zero = false;
@@ -127,7 +124,6 @@ index 0000000000..f03d9bab8d
 +            {"verbose", no_argument, 0, 'v'},
 +            {"format", required_argument, 0, 'f'},
 +            {"repository", required_argument, 0, 'r'},
 +            {"ns", required_argument, 0, 'n'},
 +            {"keyfile", required_argument, 0, 'k'},
 +            {0, 0, 0, 0}
 +        };
@@ -148,9 +144,6 @@ index 0000000000..f03d9bab8d
 +            case 'r':
 +                repository = g_strdup(argv[optind - 1]);
 +                break;
 +            case 'n':
 +                backup_ns = g_strdup(argv[optind - 1]);
 +                break;
 +            case 'k':
 +                keyfile = g_strdup(argv[optind - 1]);
 +                break;
@@ -201,16 +194,8 @@ index 0000000000..f03d9bab8d
 +        fprintf(stderr, "connecting to repository '%s'\n", repository);
 +    }
 +    char *pbs_error = NULL;
-+    ProxmoxRestoreHandle *conn = proxmox_restore_new_ns(
+    ProxmoxRestoreHandle *conn = proxmox_restore_new(
-+        repository,
+        repository, snapshot, password, keyfile, key_password, fingerprint, &pbs_error);
 +        snapshot,
 +        backup_ns,
 +        password,
 +        keyfile,
 +        key_password,
 +        fingerprint,
 +        &pbs_error
 +    );
 +    if (conn == NULL) {
 +        fprintf(stderr, "restore failed: %s\n", pbs_error);
 +        return -1;
--- a/debian/patches/pve/0031-PVE-Backup-Add-dirty-bitmap-tracking-for-incremental.patch
+++ b/debian/patches/pve/0031-PVE-Backup-Add-dirty-bitmap-tracking-for-incremental.patch
@@ -0,0 +1,452 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Stefan Reiter <s.reiter@proxmox.com>
 Date: Mon, 29 Jun 2020 11:06:03 +0200
 Subject: [PATCH] PVE-Backup: Add dirty-bitmap tracking for incremental backups
 Uses QEMU's existing MIRROR_SYNC_MODE_BITMAP and a dirty-bitmap on top
 of all backed-up drives. This will only execute the data-write callback
 for any changed chunks, the PBS rust code will reuse chunks from the
 previous index for everything it doesn't receive if reuse_index is true.
 On error or cancellation, remove all dirty bitmaps to ensure
 consistency.
 Add PBS/incremental specific information to query backup info QMP and
 HMP commands.
 Only supported for PBS backups.
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 Signed-off-by: Dietmar Maurer <dietmar@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
 block/monitor/block-hmp-cmds.c |   1 +
 monitor/hmp-cmds.c             |  45 ++++++++++----
 proxmox-backup-client.c        |   3 +-
 proxmox-backup-client.h        |   1 +
 pve-backup.c                   | 103 ++++++++++++++++++++++++++++++---
 qapi/block-core.json           |  12 +++-
 6 files changed, 142 insertions(+), 23 deletions(-)
 diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
 index 89ca64444d..45da74d7a0 100644
 --- a/block/monitor/block-hmp-cmds.c
 +++ b/block/monitor/block-hmp-cmds.c
@@ -1042,6 +1042,7 @@ void hmp_backup(Monitor *mon, const QDict *qdict)
         false, NULL, // PBS fingerprint
         false, NULL, // PBS backup-id
         false, 0, // PBS backup-time
 +        false, false, // PBS incremental
         true, dir ? BACKUP_FORMAT_DIR : BACKUP_FORMAT_VMA,
         false, NULL, false, NULL, !!devlist,
         devlist, qdict_haskey(qdict, "speed"), speed, &error);
 diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
 index 1168773da7..4c1671e289 100644
 --- a/monitor/hmp-cmds.c
 +++ b/monitor/hmp-cmds.c
@@ -223,19 +223,42 @@ void hmp_info_backup(Monitor *mon, const QDict *qdict)
             monitor_printf(mon, "End time: %s", ctime(&info->end_time));
         }
 -        int per = (info->has_total && info->total &&
 -            info->has_transferred && info->transferred) ?
 -            (info->transferred * 100)/info->total : 0;
 -        int zero_per = (info->has_total && info->total &&
 -                        info->has_zero_bytes && info->zero_bytes) ?
 -            (info->zero_bytes * 100)/info->total : 0;
         monitor_printf(mon, "Backup file: %s\n", info->backup_file);
         monitor_printf(mon, "Backup uuid: %s\n", info->uuid);
 -        monitor_printf(mon, "Total size: %zd\n", info->total);
 -        monitor_printf(mon, "Transferred bytes: %zd (%d%%)\n",
 -                       info->transferred, per);
 -        monitor_printf(mon, "Zero bytes: %zd (%d%%)\n",
 -                       info->zero_bytes, zero_per);
 +
 +        if (!(info->has_total && info->total))  {
 +            // this should not happen normally
 +            monitor_printf(mon, "Total size: %d\n", 0);
 +        } else {
 +            bool incremental = false;
 +            size_t total_or_dirty = info->total;
 +            if (info->has_transferred) {
 +                if (info->has_dirty && info->dirty) {
 +                     if (info->dirty < info->total) {
 +                        total_or_dirty = info->dirty;
 +                        incremental = true;
 +                    }
 +                }
 +            }
 +
 +            int per = (info->transferred * 100)/total_or_dirty;
 +
 +            monitor_printf(mon, "Backup mode: %s\n", incremental ? "incremental" : "full");
 +
 +            int zero_per = (info->has_zero_bytes && info->zero_bytes) ?
 +                (info->zero_bytes * 100)/info->total : 0;
 +            monitor_printf(mon, "Total size: %zd\n", info->total);
 +            monitor_printf(mon, "Transferred bytes: %zd (%d%%)\n",
 +                           info->transferred, per);
 +            monitor_printf(mon, "Zero bytes: %zd (%d%%)\n",
 +                           info->zero_bytes, zero_per);
 +
 +            if (info->has_reused) {
 +                int reused_per = (info->reused * 100)/total_or_dirty;
 +                monitor_printf(mon, "Reused bytes: %zd (%d%%)\n",
 +                               info->reused, reused_per);
 +            }
 +        }
     }
     qapi_free_BackupStatus(info);
 diff --git a/proxmox-backup-client.c b/proxmox-backup-client.c
 index a8f6653a81..4ce7bc0b5e 100644
 --- a/proxmox-backup-client.c
 +++ b/proxmox-backup-client.c
@@ -89,6 +89,7 @@ proxmox_backup_co_register_image(
     ProxmoxBackupHandle *pbs,
     const char *device_name,
     uint64_t size,
 +    bool incremental,
     Error **errp)
 {
     Coroutine *co = qemu_coroutine_self();
@@ -98,7 +99,7 @@ proxmox_backup_co_register_image(
     int pbs_res = -1;
     proxmox_backup_register_image_async(
 -        pbs, device_name, size ,proxmox_backup_schedule_wake, &waker, &pbs_res, &pbs_err);
 +        pbs, device_name, size, incremental, proxmox_backup_schedule_wake, &waker, &pbs_res, &pbs_err);
     qemu_coroutine_yield();
     if (pbs_res < 0) {
         if (errp) error_setg(errp, "backup register image failed: %s", pbs_err ? pbs_err : "unknown error");
 diff --git a/proxmox-backup-client.h b/proxmox-backup-client.h
 index 1dda8b7d8f..8cbf645b2c 100644
 --- a/proxmox-backup-client.h
 +++ b/proxmox-backup-client.h
@@ -32,6 +32,7 @@ proxmox_backup_co_register_image(
     ProxmoxBackupHandle *pbs,
     const char *device_name,
     uint64_t size,
 +    bool incremental,
     Error **errp);
 diff --git a/pve-backup.c b/pve-backup.c
 index 88f5ee133f..1c49cd178d 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
@@ -28,6 +28,8 @@
  *
  */
 +const char *PBS_BITMAP_NAME = "pbs-incremental-dirty-bitmap";
 +
 static struct PVEBackupState {
     struct {
         // Everithing accessed from qmp_backup_query command is protected using lock
@@ -39,7 +41,9 @@ static struct PVEBackupState {
         uuid_t uuid;
         char uuid_str[37];
         size_t total;
 +        size_t dirty;
         size_t transferred;
 +        size_t reused;
         size_t zero_bytes;
     } stat;
     int64_t speed;
@@ -66,6 +70,7 @@ typedef struct PVEBackupDevInfo {
     uint8_t dev_id;
     bool completed;
     char targetfile[PATH_MAX];
 +    BdrvDirtyBitmap *bitmap;
     BlockDriverState *target;
 } PVEBackupDevInfo;
@@ -105,11 +110,12 @@ static bool pvebackup_error_or_canceled(void)
     return error_or_canceled;
 }
 -static void pvebackup_add_transfered_bytes(size_t transferred, size_t zero_bytes)
 +static void pvebackup_add_transfered_bytes(size_t transferred, size_t zero_bytes, size_t reused)
 {
     qemu_mutex_lock(&backup_state.stat.lock);
     backup_state.stat.zero_bytes += zero_bytes;
     backup_state.stat.transferred += transferred;
 +    backup_state.stat.reused += reused;
     qemu_mutex_unlock(&backup_state.stat.lock);
 }
@@ -148,7 +154,8 @@ pvebackup_co_dump_pbs_cb(
         pvebackup_propagate_error(local_err);
         return pbs_res;
     } else {
 -        pvebackup_add_transfered_bytes(size, !buf ? size : 0);
 +        size_t reused = (pbs_res == 0) ? size : 0;
 +        pvebackup_add_transfered_bytes(size, !buf ? size : 0, reused);
     }
     return size;
@@ -208,11 +215,11 @@ pvebackup_co_dump_vma_cb(
         } else {
             if (remaining >= VMA_CLUSTER_SIZE) {
                 assert(ret == VMA_CLUSTER_SIZE);
 -                pvebackup_add_transfered_bytes(VMA_CLUSTER_SIZE, zero_bytes);
 +                pvebackup_add_transfered_bytes(VMA_CLUSTER_SIZE, zero_bytes, 0);
                 remaining -= VMA_CLUSTER_SIZE;
             } else {
                 assert(ret == remaining);
 -                pvebackup_add_transfered_bytes(remaining, zero_bytes);
 +                pvebackup_add_transfered_bytes(remaining, zero_bytes, 0);
                 remaining = 0;
             }
         }
@@ -248,6 +255,18 @@ static void coroutine_fn pvebackup_co_cleanup(void *unused)
             if (local_err != NULL) {
                 pvebackup_propagate_error(local_err);
             }
 +        } else {
 +            // on error or cancel we cannot ensure synchronization of dirty
 +            // bitmaps with backup server, so remove all and do full backup next
 +            GList *l = backup_state.di_list;
 +            while (l) {
 +                PVEBackupDevInfo *di = (PVEBackupDevInfo *)l->data;
 +                l = g_list_next(l);
 +
 +                if (di->bitmap) {
 +                    bdrv_release_dirty_bitmap(di->bitmap);
 +                }
 +            }
         }
         proxmox_backup_disconnect(backup_state.pbs);
@@ -303,6 +322,12 @@ static void pvebackup_complete_cb(void *opaque, int ret)
     // remove self from job queue
     backup_state.di_list = g_list_remove(backup_state.di_list, di);
 +    if (di->bitmap && ret < 0) {
 +        // on error or cancel we cannot ensure synchronization of dirty
 +        // bitmaps with backup server, so remove all and do full backup next
 +        bdrv_release_dirty_bitmap(di->bitmap);
 +    }
 +
     g_free(di);
     qemu_mutex_unlock(&backup_state.backup_mutex);
@@ -472,12 +497,18 @@ static bool create_backup_jobs(void) {
         assert(di->target != NULL);
 +        MirrorSyncMode sync_mode = MIRROR_SYNC_MODE_FULL;
 +        BitmapSyncMode bitmap_mode = BITMAP_SYNC_MODE_NEVER;
 +        if (di->bitmap) {
 +            sync_mode = MIRROR_SYNC_MODE_BITMAP;
 +            bitmap_mode = BITMAP_SYNC_MODE_ON_SUCCESS;
 +        }
         AioContext *aio_context = bdrv_get_aio_context(di->bs);
         aio_context_acquire(aio_context);
         BlockJob *job = backup_job_create(
 -            NULL, di->bs, di->target, backup_state.speed, MIRROR_SYNC_MODE_FULL, NULL,
 -            BITMAP_SYNC_MODE_NEVER, false, NULL, &perf, BLOCKDEV_ON_ERROR_REPORT, BLOCKDEV_ON_ERROR_REPORT,
 +            NULL, di->bs, di->target, backup_state.speed, sync_mode, di->bitmap,
 +            bitmap_mode, false, NULL, &perf, BLOCKDEV_ON_ERROR_REPORT, BLOCKDEV_ON_ERROR_REPORT,
             JOB_DEFAULT, pvebackup_complete_cb, di, NULL, &local_err);
         aio_context_release(aio_context);
@@ -528,6 +559,8 @@ typedef struct QmpBackupTask {
     const char *fingerprint;
     bool has_fingerprint;
     int64_t backup_time;
 +    bool has_use_dirty_bitmap;
 +    bool use_dirty_bitmap;
     bool has_format;
     BackupFormat format;
     bool has_config_file;
@@ -619,6 +652,7 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
     }
     size_t total = 0;
 +    size_t dirty = 0;
     l = di_list;
     while (l) {
@@ -656,6 +690,8 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
         int dump_cb_block_size = PROXMOX_BACKUP_DEFAULT_CHUNK_SIZE; // Hardcoded (4M)
         firewall_name = "fw.conf";
 +        bool use_dirty_bitmap = task->has_use_dirty_bitmap && task->use_dirty_bitmap;
 +
         char *pbs_err = NULL;
         pbs = proxmox_backup_new(
             task->backup_file,
@@ -675,7 +711,8 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
             goto err;
         }
 -        if (proxmox_backup_co_connect(pbs, task->errp) < 0)
 +        int connect_result = proxmox_backup_co_connect(pbs, task->errp);
 +        if (connect_result < 0)
             goto err;
         /* register all devices */
@@ -686,9 +723,40 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
             const char *devname = bdrv_get_device_name(di->bs);
 -            int dev_id = proxmox_backup_co_register_image(pbs, devname, di->size, task->errp);
 -            if (dev_id < 0)
 +            BdrvDirtyBitmap *bitmap = bdrv_find_dirty_bitmap(di->bs, PBS_BITMAP_NAME);
 +            bool expect_only_dirty = false;
 +
 +            if (use_dirty_bitmap) {
 +                if (bitmap == NULL) {
 +                    bitmap = bdrv_create_dirty_bitmap(di->bs, dump_cb_block_size, PBS_BITMAP_NAME, task->errp);
 +                    if (!bitmap) {
 +                        goto err;
 +                    }
 +                } else {
 +                    expect_only_dirty = proxmox_backup_check_incremental(pbs, devname, di->size) != 0;
 +                }
 +
 +                if (expect_only_dirty) {
 +                    dirty += bdrv_get_dirty_count(bitmap);
 +                } else {
 +                    /* mark entire bitmap as dirty to make full backup */
 +                    bdrv_set_dirty_bitmap(bitmap, 0, di->size);
 +                    dirty += di->size;
 +                }
 +                di->bitmap = bitmap;
 +            } else {
 +                dirty += di->size;
 +
 +                /* after a full backup the old dirty bitmap is invalid anyway */
 +                if (bitmap != NULL) {
 +                    bdrv_release_dirty_bitmap(bitmap);
 +                }
 +            }
 +
 +            int dev_id = proxmox_backup_co_register_image(pbs, devname, di->size, expect_only_dirty, task->errp);
 +            if (dev_id < 0) {
                 goto err;
 +            }
             if (!(di->target = bdrv_backup_dump_create(dump_cb_block_size, di->size, pvebackup_co_dump_pbs_cb, di, task->errp))) {
                 goto err;
@@ -697,6 +765,8 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
             di->dev_id = dev_id;
         }
     } else if (format == BACKUP_FORMAT_VMA) {
 +        dirty = total;
 +
         vmaw = vma_writer_create(task->backup_file, uuid, &local_err);
         if (!vmaw) {
             if (local_err) {
@@ -724,6 +794,8 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
             }
         }
     } else if (format == BACKUP_FORMAT_DIR) {
 +        dirty = total;
 +
         if (mkdir(task->backup_file, 0640) != 0) {
             error_setg_errno(task->errp, errno, "can't create directory '%s'\n",
                              task->backup_file);
@@ -796,8 +868,10 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
     char *uuid_str = g_strdup(backup_state.stat.uuid_str);
     backup_state.stat.total = total;
 +    backup_state.stat.dirty = dirty;
     backup_state.stat.transferred = 0;
     backup_state.stat.zero_bytes = 0;
 +    backup_state.stat.reused = format == BACKUP_FORMAT_PBS && dirty >= total ? 0 : total - dirty;
     qemu_mutex_unlock(&backup_state.stat.lock);
@@ -821,6 +895,10 @@ err:
         PVEBackupDevInfo *di = (PVEBackupDevInfo *)l->data;
         l = g_list_next(l);
 +        if (di->bitmap) {
 +            bdrv_release_dirty_bitmap(di->bitmap);
 +        }
 +
         if (di->target) {
             bdrv_unref(di->target);
         }
@@ -862,6 +940,7 @@ UuidInfo *qmp_backup(
     bool has_fingerprint, const char *fingerprint,
     bool has_backup_id, const char *backup_id,
     bool has_backup_time, int64_t backup_time,
 +    bool has_use_dirty_bitmap, bool use_dirty_bitmap,
     bool has_format, BackupFormat format,
     bool has_config_file, const char *config_file,
     bool has_firewall_file, const char *firewall_file,
@@ -880,6 +959,8 @@ UuidInfo *qmp_backup(
         .backup_id = backup_id,
         .has_backup_time = has_backup_time,
         .backup_time = backup_time,
 +        .has_use_dirty_bitmap = has_use_dirty_bitmap,
 +        .use_dirty_bitmap = use_dirty_bitmap,
         .has_format = has_format,
         .format = format,
         .has_config_file = has_config_file,
@@ -948,10 +1029,14 @@ BackupStatus *qmp_query_backup(Error **errp)
     info->has_total = true;
     info->total = backup_state.stat.total;
 +    info->has_dirty = true;
 +    info->dirty = backup_state.stat.dirty;
     info->has_zero_bytes = true;
     info->zero_bytes = backup_state.stat.zero_bytes;
     info->has_transferred = true;
     info->transferred = backup_state.stat.transferred;
 +    info->has_reused = true;
 +    info->reused = backup_state.stat.reused;
     qemu_mutex_unlock(&backup_state.stat.lock);
 diff --git a/qapi/block-core.json b/qapi/block-core.json
 index 90ad07b7ee..3ad9eb5d1a 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
@@ -753,8 +753,13 @@
 #
 # @total: total amount of bytes involved in the backup process
 #
 +# @dirty: with incremental mode (PBS) this is the amount of bytes involved
 +#         in the backup process which are marked dirty.
 +#
 # @transferred: amount of bytes already backed up.
 #
 +# @reused: amount of bytes reused due to deduplication.
 +#
 # @zero-bytes: amount of 'zero' bytes detected.
 #
 # @start-time: time (epoch) when backup job started.
@@ -767,8 +772,8 @@
 #
 ##
 { 'struct': 'BackupStatus',
 -  'data': {'*status': 'str', '*errmsg': 'str', '*total': 'int',
 -           '*transferred': 'int', '*zero-bytes': 'int',
 +  'data': {'*status': 'str', '*errmsg': 'str', '*total': 'int', '*dirty': 'int',
 +           '*transferred': 'int', '*zero-bytes': 'int', '*reused': 'int',
            '*start-time': 'int', '*end-time': 'int',
            '*backup-file': 'str', '*uuid': 'str' } }
@@ -811,6 +816,8 @@
 #
 # @backup-time: backup timestamp (Unix epoch, required for format 'pbs')
 #
 +# @use-dirty-bitmap: use dirty bitmap to detect incremental changes since last job (optional for format 'pbs')
 +#
 # Returns: the uuid of the backup job
 #
 ##
@@ -821,6 +828,7 @@
                                     '*fingerprint': 'str',
                                     '*backup-id': 'str',
                                     '*backup-time': 'int',
 +                                    '*use-dirty-bitmap': 'bool',
                                     '*format': 'BackupFormat',
                                     '*config-file': 'str',
                                     '*firewall-file': 'str',
--- a/debian/patches/pve/0032-PVE-various-PBS-fixes.patch
+++ b/debian/patches/pve/0032-PVE-various-PBS-fixes.patch
@@ -0,0 +1,219 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Dietmar Maurer <dietmar@proxmox.com>
 Date: Thu, 9 Jul 2020 12:53:08 +0200
 Subject: [PATCH] PVE: various PBS fixes
 pbs: fix crypt and compress parameters
 Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
 PVE: handle PBS write callback with big blocks correctly
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 PVE: add zero block handling to PBS dump callback
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
 block/monitor/block-hmp-cmds.c |  4 ++-
 pve-backup.c                   | 57 +++++++++++++++++++++++++++-------
 qapi/block-core.json           |  6 ++++
 3 files changed, 54 insertions(+), 13 deletions(-)
 diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
 index 45da74d7a0..ea7b665aa2 100644
 --- a/block/monitor/block-hmp-cmds.c
 +++ b/block/monitor/block-hmp-cmds.c
@@ -1042,7 +1042,9 @@ void hmp_backup(Monitor *mon, const QDict *qdict)
         false, NULL, // PBS fingerprint
         false, NULL, // PBS backup-id
         false, 0, // PBS backup-time
 -        false, false, // PBS incremental
 +        false, false, // PBS use-dirty-bitmap
 +        false, false, // PBS compress
 +        false, false, // PBS encrypt
         true, dir ? BACKUP_FORMAT_DIR : BACKUP_FORMAT_VMA,
         false, NULL, false, NULL, !!devlist,
         devlist, qdict_haskey(qdict, "speed"), speed, &error);
 diff --git a/pve-backup.c b/pve-backup.c
 index 1c49cd178d..c15abefdda 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
@@ -8,6 +8,7 @@
 #include "block/blockjob.h"
 #include "qapi/qapi-commands-block.h"
 #include "qapi/qmp/qerror.h"
 +#include "qemu/cutils.h"
 /* PVE backup state and related function */
@@ -67,6 +68,7 @@ opts_init(pvebackup_init);
 typedef struct PVEBackupDevInfo {
     BlockDriverState *bs;
     size_t size;
 +    uint64_t block_size;
     uint8_t dev_id;
     bool completed;
     char targetfile[PATH_MAX];
@@ -135,10 +137,13 @@ pvebackup_co_dump_pbs_cb(
     PVEBackupDevInfo *di = opaque;
     assert(backup_state.pbs);
 +    assert(buf);
     Error *local_err = NULL;
     int pbs_res = -1;
 +    bool is_zero_block = size == di->block_size && buffer_is_zero(buf, size);
 +
     qemu_co_mutex_lock(&backup_state.dump_callback_mutex);
     // avoid deadlock if job is cancelled
@@ -147,17 +152,29 @@ pvebackup_co_dump_pbs_cb(
         return -1;
     }
 -    pbs_res = proxmox_backup_co_write_data(backup_state.pbs, di->dev_id, buf, start, size, &local_err);
 -    qemu_co_mutex_unlock(&backup_state.dump_callback_mutex);
 +    uint64_t transferred = 0;
 +    uint64_t reused = 0;
 +    while (transferred < size) {
 +        uint64_t left = size - transferred;
 +        uint64_t to_transfer = left < di->block_size ? left : di->block_size;
 -    if (pbs_res < 0) {
 -        pvebackup_propagate_error(local_err);
 -        return pbs_res;
 -    } else {
 -        size_t reused = (pbs_res == 0) ? size : 0;
 -        pvebackup_add_transfered_bytes(size, !buf ? size : 0, reused);
 +        pbs_res = proxmox_backup_co_write_data(backup_state.pbs, di->dev_id,
 +            is_zero_block ? NULL : buf + transferred, start + transferred,
 +            to_transfer, &local_err);
 +        transferred += to_transfer;
 +
 +        if (pbs_res < 0) {
 +            pvebackup_propagate_error(local_err);
 +            qemu_co_mutex_unlock(&backup_state.dump_callback_mutex);
 +            return pbs_res;
 +        }
 +
 +        reused += pbs_res == 0 ? to_transfer : 0;
     }
 +    qemu_co_mutex_unlock(&backup_state.dump_callback_mutex);
 +    pvebackup_add_transfered_bytes(size, is_zero_block ? size : 0, reused);
 +
     return size;
 }
@@ -178,6 +195,7 @@ pvebackup_co_dump_vma_cb(
     int ret = -1;
     assert(backup_state.vmaw);
 +    assert(buf);
     uint64_t remaining = size;
@@ -204,9 +222,7 @@ pvebackup_co_dump_vma_cb(
         qemu_co_mutex_unlock(&backup_state.dump_callback_mutex);
         ++cluster_num;
 -        if (buf) {
 -            buf += VMA_CLUSTER_SIZE;
 -        }
 +        buf += VMA_CLUSTER_SIZE;
         if (ret < 0) {
             Error *local_err = NULL;
             vma_writer_error_propagate(backup_state.vmaw, &local_err);
@@ -569,6 +585,10 @@ typedef struct QmpBackupTask {
     const char *firewall_file;
     bool has_devlist;
     const char *devlist;
 +    bool has_compress;
 +    bool compress;
 +    bool has_encrypt;
 +    bool encrypt;
     bool has_speed;
     int64_t speed;
     Error **errp;
@@ -692,6 +712,7 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
         bool use_dirty_bitmap = task->has_use_dirty_bitmap && task->use_dirty_bitmap;
 +
         char *pbs_err = NULL;
         pbs = proxmox_backup_new(
             task->backup_file,
@@ -701,8 +722,10 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
             task->has_password ? task->password : NULL,
             task->has_keyfile ? task->keyfile : NULL,
             task->has_key_password ? task->key_password : NULL,
 +            task->has_compress ? task->compress : true,
 +            task->has_encrypt ? task->encrypt : task->has_keyfile,
             task->has_fingerprint ? task->fingerprint : NULL,
 -            &pbs_err);
 +             &pbs_err);
         if (!pbs) {
             error_set(task->errp, ERROR_CLASS_GENERIC_ERROR,
@@ -721,6 +744,8 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
             PVEBackupDevInfo *di = (PVEBackupDevInfo *)l->data;
             l = g_list_next(l);
 +            di->block_size = dump_cb_block_size;
 +
             const char *devname = bdrv_get_device_name(di->bs);
             BdrvDirtyBitmap *bitmap = bdrv_find_dirty_bitmap(di->bs, PBS_BITMAP_NAME);
@@ -941,6 +966,8 @@ UuidInfo *qmp_backup(
     bool has_backup_id, const char *backup_id,
     bool has_backup_time, int64_t backup_time,
     bool has_use_dirty_bitmap, bool use_dirty_bitmap,
 +    bool has_compress, bool compress,
 +    bool has_encrypt, bool encrypt,
     bool has_format, BackupFormat format,
     bool has_config_file, const char *config_file,
     bool has_firewall_file, const char *firewall_file,
@@ -951,6 +978,8 @@ UuidInfo *qmp_backup(
         .backup_file = backup_file,
         .has_password = has_password,
         .password = password,
 +        .has_keyfile = has_keyfile,
 +        .keyfile = keyfile,
         .has_key_password = has_key_password,
         .key_password = key_password,
         .has_fingerprint = has_fingerprint,
@@ -961,6 +990,10 @@ UuidInfo *qmp_backup(
         .backup_time = backup_time,
         .has_use_dirty_bitmap = has_use_dirty_bitmap,
         .use_dirty_bitmap = use_dirty_bitmap,
 +        .has_compress = has_compress,
 +        .compress = compress,
 +        .has_encrypt = has_encrypt,
 +        .encrypt = encrypt,
         .has_format = has_format,
         .format = format,
         .has_config_file = has_config_file,
 diff --git a/qapi/block-core.json b/qapi/block-core.json
 index 3ad9eb5d1a..4120052690 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
@@ -818,6 +818,10 @@
 #
 # @use-dirty-bitmap: use dirty bitmap to detect incremental changes since last job (optional for format 'pbs')
 #
 +# @compress: use compression (optional for format 'pbs', defaults to true)
 +#
 +# @encrypt: use encryption ((optional for format 'pbs', defaults to true if there is a keyfile)
 +#
 # Returns: the uuid of the backup job
 #
 ##
@@ -829,6 +833,8 @@
                                     '*backup-id': 'str',
                                     '*backup-time': 'int',
                                     '*use-dirty-bitmap': 'bool',
 +                                    '*compress': 'bool',
 +                                    '*encrypt': 'bool',
                                     '*format': 'BackupFormat',
                                     '*config-file': 'str',
                                     '*firewall-file': 'str',
--- a/debian/patches/pve/0033-PVE-Add-PBS-block-driver-to-map-backup-archives-into.patch
+++ b/debian/patches/pve/0033-PVE-Add-PBS-block-driver-to-map-backup-archives-into.patch
@@ -7,27 +7,23 @@ Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 [error cleanups, file_open implementation]
 Signed-off-by: Dietmar Maurer <dietmar@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 [WB: add namespace support]
 Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
 [FE: adapt to changed function signatures
-     make pbs_co_preadv return values consistent with QEMU
+     make pbs_co_preadv return values consistent with QEMU]
     getlength is now a coroutine function]
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 block/meson.build    |   3 +
- block/pbs.c          | 305 +++++++++++++++++++++++++++++++++++++++++++
+ block/pbs.c          | 276 +++++++++++++++++++++++++++++++++++++++++++
 configure            |   9 ++
 meson.build          |   2 +-
 qapi/block-core.json |  13 ++
- qapi/pragma.json     |   1 +
+ 5 files changed, 302 insertions(+), 1 deletion(-)
 6 files changed, 332 insertions(+), 1 deletion(-)
 create mode 100644 block/pbs.c
 diff --git a/block/meson.build b/block/meson.build
-index 5bcebb934b..eece0d5743 100644
+index 2783b77e9c..a26a69434e 100644
 --- a/block/meson.build
 +++ b/block/meson.build
-@@ -54,6 +54,9 @@ block_ss.add(files(
+@@ -53,6 +53,9 @@ block_ss.add(files(
   '../pve-backup.c',
 ), libproxmox_backup_qemu)
@@ -36,13 +32,13 @@ index 5bcebb934b..eece0d5743 100644
 +
 softmmu_ss.add(when: 'CONFIG_TCG', if_true: files('blkreplay.c'))
- softmmu_ss.add(files('block-ram-registrar.c'))
+ 
 diff --git a/block/pbs.c b/block/pbs.c
 new file mode 100644
-index 0000000000..a2211e0f3b
+index 0000000000..9d1f1f39d4
 --- /dev/null
 +++ b/block/pbs.c
-@@ -0,0 +1,305 @@
+@@ -0,0 +1,276 @@
 +/*
 + * Proxmox Backup Server read-only block driver
 + */
@@ -55,12 +51,10 @@ index 0000000000..a2211e0f3b
 +#include "qemu/option.h"
 +#include "qemu/cutils.h"
 +#include "block/block_int.h"
 +#include "block/block-io.h"
 +
 +#include <proxmox-backup-qemu.h>
 +
 +#define PBS_OPT_REPOSITORY "repository"
 +#define PBS_OPT_NAMESPACE "namespace"
 +#define PBS_OPT_SNAPSHOT "snapshot"
 +#define PBS_OPT_ARCHIVE "archive"
 +#define PBS_OPT_KEYFILE "keyfile"
@@ -74,7 +68,6 @@ index 0000000000..a2211e0f3b
 +    int64_t length;
 +
 +    char *repository;
 +    char *namespace;
 +    char *snapshot;
 +    char *archive;
 +} BDRVPBSState;
@@ -89,11 +82,6 @@ index 0000000000..a2211e0f3b
 +            .help = "The server address and repository to connect to.",
 +        },
 +        {
 +            .name = PBS_OPT_NAMESPACE,
 +            .type = QEMU_OPT_STRING,
 +            .help = "Optional: The snapshot's namespace.",
 +        },
 +        {
 +            .name = PBS_OPT_SNAPSHOT,
 +            .type = QEMU_OPT_STRING,
 +            .help = "The snapshot to read.",
@@ -129,7 +117,7 @@ index 0000000000..a2211e0f3b
 +
 +
 +// filename format:
-+// pbs:repository=<repo>,namespace=<ns>,snapshot=<snap>,password=<pw>,key_password=<kpw>,fingerprint=<fp>,archive=<archive>
+// pbs:repository=<repo>,snapshot=<snap>,password=<pw>,key_password=<kpw>,fingerprint=<fp>,archive=<archive>
 +static void pbs_parse_filename(const char *filename, QDict *options,
 +                                     Error **errp)
 +{
@@ -165,7 +153,6 @@ index 0000000000..a2211e0f3b
 +    s->archive = g_strdup(qemu_opt_get(opts, PBS_OPT_ARCHIVE));
 +    const char *keyfile = qemu_opt_get(opts, PBS_OPT_KEYFILE);
 +    const char *password = qemu_opt_get(opts, PBS_OPT_PASSWORD);
 +    const char *namespace = qemu_opt_get(opts, PBS_OPT_NAMESPACE);
 +    const char *fingerprint = qemu_opt_get(opts, PBS_OPT_FINGERPRINT);
 +    const char *key_password = qemu_opt_get(opts, PBS_OPT_ENCRYPTION_PASSWORD);
 +
@@ -178,12 +165,9 @@ index 0000000000..a2211e0f3b
 +    if (!key_password) {
 +        key_password = getenv("PBS_ENCRYPTION_PASSWORD");
 +    }
 +    if (namespace) {
 +        s->namespace = g_strdup(namespace);
 +    }
 +
 +    /* connect to PBS server in read mode */
-+    s->conn = proxmox_restore_new_ns(s->repository, s->snapshot, s->namespace, password,
+    s->conn = proxmox_restore_new(s->repository, s->snapshot, password,
 +        keyfile, key_password, fingerprint, &pbs_error);
 +
 +    /* invalidates qemu_opt_get char pointers from above */
@@ -228,13 +212,12 @@ index 0000000000..a2211e0f3b
 +static void pbs_close(BlockDriverState *bs) {
 +    BDRVPBSState *s = bs->opaque;
 +    g_free(s->repository);
 +    g_free(s->namespace);
 +    g_free(s->snapshot);
 +    g_free(s->archive);
 +    proxmox_restore_disconnect(s->conn);
 +}
 +
-+static coroutine_fn int64_t pbs_co_getlength(BlockDriverState *bs)
+static int64_t pbs_getlength(BlockDriverState *bs)
 +{
 +    BDRVPBSState *s = bs->opaque;
 +    return s->length;
@@ -258,16 +241,7 @@ index 0000000000..a2211e0f3b
 +    BDRVPBSState *s = bs->opaque;
 +    int ret;
 +    char *pbs_error = NULL;
-+    uint8_t *buf;
+    uint8_t *buf = malloc(bytes);
 +    bool inline_buf = true;
 +
 +    /* for single-buffer IO vectors we can fast-path the write directly to it */
 +    if (qiov->niov == 1 && qiov->iov->iov_len >= bytes) {
 +        buf = qiov->iov->iov_base;
 +    } else {
 +        inline_buf = false;
 +        buf = g_malloc(bytes);
 +    }
 +
 +    if (offset < 0 || bytes < 0) {
 +        fprintf(stderr, "unexpected negative 'offset' or 'bytes' value!\n");
@@ -290,10 +264,8 @@ index 0000000000..a2211e0f3b
 +        return -EIO;
 +    }
 +
-+    if (!inline_buf) {
+    qemu_iovec_from_buf(qiov, 0, buf, bytes);
-+        qemu_iovec_from_buf(qiov, 0, buf, bytes);
+    free(buf);
 +        g_free(buf);
 +    }
 +
 +    return 0;
 +}
@@ -310,13 +282,8 @@ index 0000000000..a2211e0f3b
 +static void pbs_refresh_filename(BlockDriverState *bs)
 +{
 +    BDRVPBSState *s = bs->opaque;
-+    if (s->namespace) {
+    snprintf(bs->exact_filename, sizeof(bs->exact_filename), "%s/%s(%s)",
-+        snprintf(bs->exact_filename, sizeof(bs->exact_filename), "%s/%s:%s(%s)",
+             s->repository, s->snapshot, s->archive);
 +                 s->repository, s->namespace, s->snapshot, s->archive);
 +    } else {
 +        snprintf(bs->exact_filename, sizeof(bs->exact_filename), "%s/%s(%s)",
 +                 s->repository, s->snapshot, s->archive);
 +    }
 +}
 +
 +static const char *const pbs_strong_runtime_opts[] = {
@@ -333,7 +300,7 @@ index 0000000000..a2211e0f3b
 +    .bdrv_file_open         = pbs_file_open,
 +    .bdrv_open              = pbs_open,
 +    .bdrv_close             = pbs_close,
-+    .bdrv_co_getlength      = pbs_co_getlength,
+    .bdrv_getlength         = pbs_getlength,
 +
 +    .bdrv_co_preadv         = pbs_co_preadv,
 +    .bdrv_co_pwritev        = pbs_co_pwritev,
@@ -349,20 +316,20 @@ index 0000000000..a2211e0f3b
 +
 +block_init(bdrv_pbs_init);
 diff --git a/configure b/configure
-index a62a3e6be9..1ac0feb46b 100755
+index 72ab03f11a..7203c270ec 100755
 --- a/configure
 +++ b/configure
-@@ -288,6 +288,7 @@ linux_user=""
+@@ -309,6 +309,7 @@ linux_user=""
 bsd_user=""
 pie=""
 coroutine=""
 +pbs_bdrv="yes"
 plugins="$default_feature"
 meson=""
- ninja=""
+ meson_args=""
-@@ -873,6 +874,10 @@ for opt do
+@@ -902,6 +903,10 @@ for opt do
-   ;;
+   --enable-uuid|--disable-uuid)
-   --with-coroutine=*) coroutine="$optarg"
+       echo "$0: $opt is obsolete, UUID support is always built" >&2
   ;;
 +  --disable-pbs-bdrv) pbs_bdrv="no"
 +  ;;
@@ -371,15 +338,15 @@ index a62a3e6be9..1ac0feb46b 100755
   --with-git=*) git="$optarg"
   ;;
   --with-git-submodules=*)
-@@ -1049,6 +1054,7 @@ cat << EOF
+@@ -1087,6 +1092,7 @@ cat << EOF
   debug-info      debugging information
   safe-stack      SafeStack Stack Smash Protection. Depends on
-                   clang/llvm and requires coroutine backend ucontext.
+                   clang/llvm >= 3.7 and requires coroutine backend ucontext.
 +  pbs-bdrv        Proxmox backup server read-only block driver support
 NOTE: The object files are built at the place where configure is launched
 EOF
-@@ -2386,6 +2392,9 @@ echo "TARGET_DIRS=$target_list" >> $config_host_mak
+@@ -2463,6 +2469,9 @@ echo "TARGET_DIRS=$target_list" >> $config_host_mak
 if test "$modules" = "yes"; then
   echo "CONFIG_MODULES=y" >> $config_host_mak
 fi
@@ -390,10 +357,10 @@ index a62a3e6be9..1ac0feb46b 100755
 # XXX: suppress that
 if [ "$bsd" = "yes" ] ; then
 diff --git a/meson.build b/meson.build
-index 32ab849ce6..69afe3441b 100644
+index f48d2e0457..be4785e2f6 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -4041,7 +4041,7 @@ summary_info += {'bzip2 support':     libbzip2}
+@@ -3986,7 +3986,7 @@ summary_info += {'bzip2 support':     libbzip2}
 summary_info += {'lzfse support':     liblzfse}
 summary_info += {'zstd support':      zstd}
 summary_info += {'NUMA host support': numa}
@@ -403,18 +370,18 @@ index 32ab849ce6..69afe3441b 100644
 summary_info += {'libdaxctl support': libdaxctl}
 summary_info += {'libudev':           libudev}
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 985859ddee..d601fb4ab2 100644
+index 4120052690..96bc696aaa 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -3304,6 +3304,7 @@
+@@ -3099,6 +3099,7 @@
-             'parallels', 'preallocate', 'qcow', 'qcow2', 'qed', 'quorum',
+             'luks', 'nbd', 'nfs', 'null-aio', 'null-co', 'nvme', 'parallels',
-             'raw', 'rbd',
+             'preallocate', 'qcow', 'qcow2', 'qed', 'quorum', 'raw', 'rbd',
             { 'name': 'replication', 'if': 'CONFIG_REPLICATION' },
 +            'pbs',
-             'ssh', 'throttle', 'vdi', 'vhdx',
+             'ssh', 'throttle', 'vdi', 'vhdx', 'vmdk', 'vpc', 'vvfat' ] }
-             { 'name': 'virtio-blk-vfio-pci', 'if': 'CONFIG_BLKIO' },
+ 
-             { 'name': 'virtio-blk-vhost-user', 'if': 'CONFIG_BLKIO' },
+ ##
-@@ -3380,6 +3381,17 @@
+@@ -3171,6 +3172,17 @@
 { 'struct': 'BlockdevOptionsNull',
   'data': { '*size': 'int', '*latency-ns': 'uint64', '*read-zeroes': 'bool' } }
@@ -427,28 +394,16 @@ index 985859ddee..d601fb4ab2 100644
 +{ 'struct': 'BlockdevOptionsPbs',
 +  'data': { 'repository': 'str', 'snapshot': 'str', 'archive': 'str',
 +            '*keyfile': 'str', '*password': 'str', '*fingerprint': 'str',
-+            '*key_password': 'str', '*namespace': 'str' } }
+            '*key_password': 'str' } }
 +
 ##
 # @BlockdevOptionsNVMe:
 #
-@@ -4753,6 +4765,7 @@
+@@ -4455,6 +4467,7 @@
       'nfs':        'BlockdevOptionsNfs',
       'null-aio':   'BlockdevOptionsNull',
       'null-co':    'BlockdevOptionsNull',
 +      'pbs':        'BlockdevOptionsPbs',
       'nvme':       'BlockdevOptionsNVMe',
-       'nvme-io_uring': { 'type': 'BlockdevOptionsNvmeIoUring',
+       'parallels':  'BlockdevOptionsGenericFormat',
-                          'if': 'CONFIG_BLKIO' },
+       'preallocate':'BlockdevOptionsPreallocate',
 diff --git a/qapi/pragma.json b/qapi/pragma.json
 index 325e684411..b6079f6a0e 100644
 --- a/qapi/pragma.json
 +++ b/qapi/pragma.json
@@ -45,6 +45,7 @@
         'BlockInfo',                # query-block
         'BlockdevAioOptions',       # blockdev-add, -blockdev
         'BlockdevDriver',           # blockdev-add, query-blockstats, ...
 +        'BlockdevOptionsPbs',       # for PBS backwards compat
         'BlockdevVmdkAdapterType',  # blockdev-create (to match VMDK spec)
         'BlockdevVmdkSubformat',    # blockdev-create (to match VMDK spec)
         'ColoCompareProperties',    # object_add, -object
--- a/debian/patches/pve/0034-PVE-add-query_proxmox_support-QMP-command.patch
+++ b/debian/patches/pve/0034-PVE-add-query_proxmox_support-QMP-command.patch
@@ -0,0 +1,74 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Stefan Reiter <s.reiter@proxmox.com>
 Date: Wed, 8 Jul 2020 11:57:53 +0200
 Subject: [PATCH] PVE: add query_proxmox_support QMP command
 Generic interface for future use, currently used for PBS dirty-bitmap
 backup support.
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 [PVE: query-proxmox-support: include library version]
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 ---
 pve-backup.c         |  9 +++++++++
 qapi/block-core.json | 29 +++++++++++++++++++++++++++++
 2 files changed, 38 insertions(+)
 diff --git a/pve-backup.c b/pve-backup.c
 index c15abefdda..4684789813 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
@@ -1075,3 +1075,12 @@ BackupStatus *qmp_query_backup(Error **errp)
     return info;
 }
 +
 +ProxmoxSupportStatus *qmp_query_proxmox_support(Error **errp)
 +{
 +    ProxmoxSupportStatus *ret = g_malloc0(sizeof(*ret));
 +    ret->pbs_library_version = g_strdup(proxmox_backup_qemu_version());
 +    ret->pbs_dirty_bitmap = true;
 +    ret->pbs_dirty_bitmap_savevm = true;
 +    return ret;
 +}
 diff --git a/qapi/block-core.json b/qapi/block-core.json
 index 96bc696aaa..0b453c61d4 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
@@ -863,6 +863,35 @@
 ##
 { 'command': 'backup-cancel' }
 +##
 +# @ProxmoxSupportStatus:
 +#
 +# Contains info about supported features added by Proxmox.
 +#
 +# @pbs-dirty-bitmap: True if dirty-bitmap-incremental backups to PBS are
 +#                    supported.
 +#
 +# @pbs-dirty-bitmap-savevm: True if 'dirty-bitmaps' migration capability can
 +#                           safely be set for savevm-async.
 +#
 +# @pbs-library-version: Running version of libproxmox-backup-qemu0 library.
 +#
 +##
 +{ 'struct': 'ProxmoxSupportStatus',
 +  'data': { 'pbs-dirty-bitmap': 'bool',
 +            'pbs-dirty-bitmap-savevm': 'bool',
 +            'pbs-library-version': 'str' } }
 +
 +##
 +# @query-proxmox-support:
 +#
 +# Returns information about supported features added by Proxmox.
 +#
 +# Returns: @ProxmoxSupportStatus
 +#
 +##
 +{ 'command': 'query-proxmox-support', 'returns': 'ProxmoxSupportStatus' }
 +
 ##
 # @BlockDeviceTimedStats:
 #
--- a/debian/patches/pve/0035-PVE-add-query-pbs-bitmap-info-QMP-call.patch
+++ b/debian/patches/pve/0035-PVE-add-query-pbs-bitmap-info-QMP-call.patch
@@ -0,0 +1,441 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Stefan Reiter <s.reiter@proxmox.com>
 Date: Wed, 19 Aug 2020 17:02:00 +0200
 Subject: [PATCH] PVE: add query-pbs-bitmap-info QMP call
 Returns advanced information about dirty bitmaps used (or not used) for
 the latest PBS backup.
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
 monitor/hmp-cmds.c   |  28 ++++++-----
 pve-backup.c         | 117 ++++++++++++++++++++++++++++++++-----------
 qapi/block-core.json |  56 +++++++++++++++++++++
 3 files changed, 159 insertions(+), 42 deletions(-)
 diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
 index 4c1671e289..c1152f55a7 100644
 --- a/monitor/hmp-cmds.c
 +++ b/monitor/hmp-cmds.c
@@ -200,6 +200,7 @@ void hmp_info_mice(Monitor *mon, const QDict *qdict)
 void hmp_info_backup(Monitor *mon, const QDict *qdict)
 {
     BackupStatus *info;
 +    PBSBitmapInfoList *bitmap_info;
     info = qmp_query_backup(NULL);
@@ -230,26 +231,29 @@ void hmp_info_backup(Monitor *mon, const QDict *qdict)
             // this should not happen normally
             monitor_printf(mon, "Total size: %d\n", 0);
         } else {
 -            bool incremental = false;
             size_t total_or_dirty = info->total;
 -            if (info->has_transferred) {
 -                if (info->has_dirty && info->dirty) {
 -                     if (info->dirty < info->total) {
 -                        total_or_dirty = info->dirty;
 -                        incremental = true;
 -                    }
 -                }
 +            bitmap_info = qmp_query_pbs_bitmap_info(NULL);
 +
 +            while (bitmap_info) {
 +                monitor_printf(mon, "Drive %s:\n",
 +                        bitmap_info->value->drive);
 +                monitor_printf(mon, "  bitmap action: %s\n",
 +                        PBSBitmapAction_str(bitmap_info->value->action));
 +                monitor_printf(mon, "  size: %zd\n",
 +                        bitmap_info->value->size);
 +                monitor_printf(mon, "  dirty: %zd\n",
 +                        bitmap_info->value->dirty);
 +                bitmap_info = bitmap_info->next;
             }
 -            int per = (info->transferred * 100)/total_or_dirty;
 -
 -            monitor_printf(mon, "Backup mode: %s\n", incremental ? "incremental" : "full");
 +            qapi_free_PBSBitmapInfoList(bitmap_info);
             int zero_per = (info->has_zero_bytes && info->zero_bytes) ?
                 (info->zero_bytes * 100)/info->total : 0;
             monitor_printf(mon, "Total size: %zd\n", info->total);
 +            int trans_per = (info->transferred * 100)/total_or_dirty;
             monitor_printf(mon, "Transferred bytes: %zd (%d%%)\n",
 -                           info->transferred, per);
 +                           info->transferred, trans_per);
             monitor_printf(mon, "Zero bytes: %zd (%d%%)\n",
                            info->zero_bytes, zero_per);
 diff --git a/pve-backup.c b/pve-backup.c
 index 4684789813..f90abaa50a 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
@@ -46,6 +46,7 @@ static struct PVEBackupState {
         size_t transferred;
         size_t reused;
         size_t zero_bytes;
 +        GList *bitmap_list;
     } stat;
     int64_t speed;
     VmaWriter *vmaw;
@@ -672,7 +673,6 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
     }
     size_t total = 0;
 -    size_t dirty = 0;
     l = di_list;
     while (l) {
@@ -693,18 +693,33 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
     uuid_generate(uuid);
 +    qemu_mutex_lock(&backup_state.stat.lock);
 +    backup_state.stat.reused = 0;
 +
 +    /* clear previous backup's bitmap_list */
 +    if (backup_state.stat.bitmap_list) {
 +        GList *bl = backup_state.stat.bitmap_list;
 +        while (bl) {
 +            g_free(((PBSBitmapInfo *)bl->data)->drive);
 +            g_free(bl->data);
 +            bl = g_list_next(bl);
 +        }
 +        g_list_free(backup_state.stat.bitmap_list);
 +        backup_state.stat.bitmap_list = NULL;
 +    }
 +
     if (format == BACKUP_FORMAT_PBS) {
         if (!task->has_password) {
             error_set(task->errp, ERROR_CLASS_GENERIC_ERROR, "missing parameter 'password'");
 -            goto err;
 +            goto err_mutex;
         }
         if (!task->has_backup_id) {
             error_set(task->errp, ERROR_CLASS_GENERIC_ERROR, "missing parameter 'backup-id'");
 -            goto err;
 +            goto err_mutex;
         }
         if (!task->has_backup_time) {
             error_set(task->errp, ERROR_CLASS_GENERIC_ERROR, "missing parameter 'backup-time'");
 -            goto err;
 +            goto err_mutex;
         }
         int dump_cb_block_size = PROXMOX_BACKUP_DEFAULT_CHUNK_SIZE; // Hardcoded (4M)
@@ -731,12 +746,12 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
             error_set(task->errp, ERROR_CLASS_GENERIC_ERROR,
                       "proxmox_backup_new failed: %s", pbs_err);
             proxmox_backup_free_error(pbs_err);
 -            goto err;
 +            goto err_mutex;
         }
         int connect_result = proxmox_backup_co_connect(pbs, task->errp);
         if (connect_result < 0)
 -            goto err;
 +            goto err_mutex;
         /* register all devices */
         l = di_list;
@@ -747,6 +762,8 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
             di->block_size = dump_cb_block_size;
             const char *devname = bdrv_get_device_name(di->bs);
 +            PBSBitmapAction action = PBS_BITMAP_ACTION_NOT_USED;
 +            size_t dirty = di->size;
             BdrvDirtyBitmap *bitmap = bdrv_find_dirty_bitmap(di->bs, PBS_BITMAP_NAME);
             bool expect_only_dirty = false;
@@ -755,49 +772,59 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
                 if (bitmap == NULL) {
                     bitmap = bdrv_create_dirty_bitmap(di->bs, dump_cb_block_size, PBS_BITMAP_NAME, task->errp);
                     if (!bitmap) {
 -                        goto err;
 +                        goto err_mutex;
                     }
 +                    action = PBS_BITMAP_ACTION_NEW;
                 } else {
                     expect_only_dirty = proxmox_backup_check_incremental(pbs, devname, di->size) != 0;
                 }
                 if (expect_only_dirty) {
 -                    dirty += bdrv_get_dirty_count(bitmap);
 +                    /* track clean chunks as reused */
 +                    dirty = MIN(bdrv_get_dirty_count(bitmap), di->size);
 +                    backup_state.stat.reused += di->size - dirty;
 +                    action = PBS_BITMAP_ACTION_USED;
                 } else {
                     /* mark entire bitmap as dirty to make full backup */
                     bdrv_set_dirty_bitmap(bitmap, 0, di->size);
 -                    dirty += di->size;
 +                    if (action != PBS_BITMAP_ACTION_NEW) {
 +                        action = PBS_BITMAP_ACTION_INVALID;
 +                    }
                 }
                 di->bitmap = bitmap;
             } else {
 -                dirty += di->size;
 -
                 /* after a full backup the old dirty bitmap is invalid anyway */
                 if (bitmap != NULL) {
                     bdrv_release_dirty_bitmap(bitmap);
 +                    action = PBS_BITMAP_ACTION_NOT_USED_REMOVED;
                 }
             }
             int dev_id = proxmox_backup_co_register_image(pbs, devname, di->size, expect_only_dirty, task->errp);
             if (dev_id < 0) {
 -                goto err;
 +                goto err_mutex;
             }
             if (!(di->target = bdrv_backup_dump_create(dump_cb_block_size, di->size, pvebackup_co_dump_pbs_cb, di, task->errp))) {
 -                goto err;
 +                goto err_mutex;
             }
             di->dev_id = dev_id;
 +
 +            PBSBitmapInfo *info = g_malloc(sizeof(*info));
 +            info->drive = g_strdup(devname);
 +            info->action = action;
 +            info->size = di->size;
 +            info->dirty = dirty;
 +            backup_state.stat.bitmap_list = g_list_append(backup_state.stat.bitmap_list, info);
         }
     } else if (format == BACKUP_FORMAT_VMA) {
 -        dirty = total;
 -
         vmaw = vma_writer_create(task->backup_file, uuid, &local_err);
         if (!vmaw) {
             if (local_err) {
                 error_propagate(task->errp, local_err);
             }
 -            goto err;
 +            goto err_mutex;
         }
         /* register all devices for vma writer */
@@ -807,7 +834,7 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
             l = g_list_next(l);
             if (!(di->target = bdrv_backup_dump_create(VMA_CLUSTER_SIZE, di->size, pvebackup_co_dump_vma_cb, di, task->errp))) {
 -                goto err;
 +                goto err_mutex;
             }
             const char *devname = bdrv_get_device_name(di->bs);
@@ -815,16 +842,14 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
             if (di->dev_id <= 0) {
                 error_set(task->errp, ERROR_CLASS_GENERIC_ERROR,
                           "register_stream failed");
 -                goto err;
 +                goto err_mutex;
             }
         }
     } else if (format == BACKUP_FORMAT_DIR) {
 -        dirty = total;
 -
         if (mkdir(task->backup_file, 0640) != 0) {
             error_setg_errno(task->errp, errno, "can't create directory '%s'\n",
                              task->backup_file);
 -            goto err;
 +            goto err_mutex;
         }
         backup_dir = task->backup_file;
@@ -841,18 +866,18 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
                             di->size, flags, false, &local_err);
             if (local_err) {
                 error_propagate(task->errp, local_err);
 -                goto err;
 +                goto err_mutex;
             }
             di->target = bdrv_open(di->targetfile, NULL, NULL, flags, &local_err);
             if (!di->target) {
                 error_propagate(task->errp, local_err);
 -                goto err;
 +                goto err_mutex;
             }
         }
     } else {
         error_set(task->errp, ERROR_CLASS_GENERIC_ERROR, "unknown backup format");
 -        goto err;
 +        goto err_mutex;
     }
@@ -860,7 +885,7 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
     if (task->has_config_file) {
         if (pvebackup_co_add_config(task->config_file, config_name, format, backup_dir,
                                     vmaw, pbs, task->errp) != 0) {
 -            goto err;
 +            goto err_mutex;
         }
     }
@@ -868,12 +893,11 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
     if (task->has_firewall_file) {
         if (pvebackup_co_add_config(task->firewall_file, firewall_name, format, backup_dir,
                                     vmaw, pbs, task->errp) != 0) {
 -            goto err;
 +            goto err_mutex;
         }
     }
     /* initialize global backup_state now */
 -
 -    qemu_mutex_lock(&backup_state.stat.lock);
 +    /* note: 'reused' and 'bitmap_list' are initialized earlier */
     if (backup_state.stat.error) {
         error_free(backup_state.stat.error);
@@ -893,10 +917,9 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
     char *uuid_str = g_strdup(backup_state.stat.uuid_str);
     backup_state.stat.total = total;
 -    backup_state.stat.dirty = dirty;
 +    backup_state.stat.dirty = total - backup_state.stat.reused;
     backup_state.stat.transferred = 0;
     backup_state.stat.zero_bytes = 0;
 -    backup_state.stat.reused = format == BACKUP_FORMAT_PBS && dirty >= total ? 0 : total - dirty;
     qemu_mutex_unlock(&backup_state.stat.lock);
@@ -913,6 +936,9 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
     task->result = uuid_info;
     return;
 +err_mutex:
 +    qemu_mutex_unlock(&backup_state.stat.lock);
 +
 err:
     l = di_list;
@@ -1076,11 +1102,42 @@ BackupStatus *qmp_query_backup(Error **errp)
     return info;
 }
 +PBSBitmapInfoList *qmp_query_pbs_bitmap_info(Error **errp)
 +{
 +    PBSBitmapInfoList *head = NULL, **p_next = &head;
 +
 +    qemu_mutex_lock(&backup_state.stat.lock);
 +
 +    GList *l = backup_state.stat.bitmap_list;
 +    while (l) {
 +        PBSBitmapInfo *info = (PBSBitmapInfo *)l->data;
 +        l = g_list_next(l);
 +
 +        /* clone bitmap info to avoid auto free after QMP marshalling */
 +        PBSBitmapInfo *info_ret = g_malloc0(sizeof(*info_ret));
 +        info_ret->drive = g_strdup(info->drive);
 +        info_ret->action = info->action;
 +        info_ret->size = info->size;
 +        info_ret->dirty = info->dirty;
 +
 +        PBSBitmapInfoList *info_list = g_malloc0(sizeof(*info_list));
 +        info_list->value = info_ret;
 +
 +        *p_next = info_list;
 +        p_next = &info_list->next;
 +    }
 +
 +    qemu_mutex_unlock(&backup_state.stat.lock);
 +
 +    return head;
 +}
 +
 ProxmoxSupportStatus *qmp_query_proxmox_support(Error **errp)
 {
     ProxmoxSupportStatus *ret = g_malloc0(sizeof(*ret));
     ret->pbs_library_version = g_strdup(proxmox_backup_qemu_version());
     ret->pbs_dirty_bitmap = true;
     ret->pbs_dirty_bitmap_savevm = true;
 +    ret->query_bitmap_info = true;
     return ret;
 }
 diff --git a/qapi/block-core.json b/qapi/block-core.json
 index 0b453c61d4..16e184dd28 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
@@ -871,6 +871,8 @@
 # @pbs-dirty-bitmap: True if dirty-bitmap-incremental backups to PBS are
 #                    supported.
 #
 +# @query-bitmap-info: True if the 'query-pbs-bitmap-info' QMP call is supported.
 +#
 # @pbs-dirty-bitmap-savevm: True if 'dirty-bitmaps' migration capability can
 #                           safely be set for savevm-async.
 #
@@ -879,6 +881,7 @@
 ##
 { 'struct': 'ProxmoxSupportStatus',
   'data': { 'pbs-dirty-bitmap': 'bool',
 +            'query-bitmap-info': 'bool',
             'pbs-dirty-bitmap-savevm': 'bool',
             'pbs-library-version': 'str' } }
@@ -892,6 +895,59 @@
 ##
 { 'command': 'query-proxmox-support', 'returns': 'ProxmoxSupportStatus' }
 +##
 +# @PBSBitmapAction:
 +#
 +# An action taken on a dirty-bitmap when a backup job was started.
 +#
 +# @not-used: Bitmap mode was not enabled.
 +#
 +# @not-used-removed: Bitmap mode was not enabled, but a bitmap from a
 +#                    previous backup still existed and was removed.
 +#
 +# @new: A new bitmap was attached to the drive for this backup.
 +#
 +# @used: An existing bitmap will be used to only backup changed data.
 +#
 +# @invalid: A bitmap existed, but had to be cleared since it's associated
 +#           base snapshot did not match the base given for the current job or
 +#           the crypt mode has changed.
 +#
 +##
 +{ 'enum': 'PBSBitmapAction',
 +  'data': ['not-used', 'not-used-removed', 'new', 'used', 'invalid'] }
 +
 +##
 +# @PBSBitmapInfo:
 +#
 +# Contains information about dirty bitmaps used for each drive in a PBS backup.
 +#
 +# @drive: The underlying drive.
 +#
 +# @action: The action that was taken when the backup started.
 +#
 +# @size: The total size of the drive.
 +#
 +# @dirty: How much of the drive is considered dirty and will be backed up,
 +#         or 'size' if everything will be.
 +#
 +##
 +{ 'struct': 'PBSBitmapInfo',
 +  'data': { 'drive': 'str', 'action': 'PBSBitmapAction', 'size': 'int',
 +            'dirty': 'int' } }
 +
 +##
 +# @query-pbs-bitmap-info:
 +#
 +# Returns information about dirty bitmaps used on the most recently started
 +# backup. Returns nothing when the last backup was not using PBS or if no
 +# backup occured in this session.
 +#
 +# Returns: @PBSBitmapInfo
 +#
 +##
 +{ 'command': 'query-pbs-bitmap-info', 'returns': ['PBSBitmapInfo'] }
 +
 ##
 # @BlockDeviceTimedStats:
 #
--- a/debian/patches/pve/0036-PVE-redirect-stderr-to-journal-when-daemonized.patch
+++ b/debian/patches/pve/0036-PVE-redirect-stderr-to-journal-when-daemonized.patch
@@ -14,10 +14,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 2 files changed, 7 insertions(+), 2 deletions(-)
 diff --git a/meson.build b/meson.build
-index 69afe3441b..b2e9b2aec7 100644
+index be4785e2f6..3fc7c8d435 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -1528,6 +1528,7 @@ keyutils = dependency('libkeyutils', required: false,
+@@ -1463,6 +1463,7 @@ keyutils = dependency('libkeyutils', required: false,
 has_gettid = cc.has_function('gettid')
 libuuid = cc.find_library('uuid', required: true)
@@ -25,7 +25,7 @@ index 69afe3441b..b2e9b2aec7 100644
 libproxmox_backup_qemu = cc.find_library('proxmox_backup_qemu', required: true)
 # libselinux
-@@ -3144,6 +3145,7 @@ if have_block
+@@ -3105,6 +3106,7 @@ if have_block
   # os-posix.c contains POSIX-specific functions used by qemu-storage-daemon,
   # os-win32.c does not
   blockdev_ss.add(when: 'CONFIG_POSIX', if_true: files('os-posix.c'))
@@ -34,7 +34,7 @@ index 69afe3441b..b2e9b2aec7 100644
 endif
 diff --git a/os-posix.c b/os-posix.c
-index 90ea71725f..33745a8c22 100644
+index 321fc4bd13..b1870d2690 100644
 --- a/os-posix.c
 +++ b/os-posix.c
@@ -28,6 +28,8 @@
@@ -46,7 +46,7 @@ index 90ea71725f..33745a8c22 100644
 /* Needed early for CONFIG_BSD etc. */
 #include "net/slirp.h"
-@@ -301,9 +303,10 @@ void os_setup_post(void)
+@@ -281,9 +283,10 @@ void os_setup_post(void)
         dup2(fd, 0);
         dup2(fd, 1);
--- a/debian/patches/pve/0037-PVE-Add-sequential-job-transaction-support.patch
+++ b/debian/patches/pve/0037-PVE-Add-sequential-job-transaction-support.patch
@@ -7,14 +7,14 @@ Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
 include/qemu/job.h | 12 ++++++++++++
- job.c              | 34 ++++++++++++++++++++++++++++++++++
+ job.c              | 31 +++++++++++++++++++++++++++++++
- 2 files changed, 46 insertions(+)
+ 2 files changed, 43 insertions(+)
 diff --git a/include/qemu/job.h b/include/qemu/job.h
-index e502787dd8..963cf2bef5 100644
+index c105b31076..5096679571 100644
 --- a/include/qemu/job.h
 +++ b/include/qemu/job.h
-@@ -381,6 +381,18 @@ void job_unlock(void);
+@@ -316,6 +316,18 @@ typedef enum JobCreateFlags {
  */
 JobTxn *job_txn_new(void);
@@ -34,10 +34,10 @@ index e502787dd8..963cf2bef5 100644
  * Release a reference that was previously acquired with job_txn_add_job or
  * job_txn_new. If it's the last reference to the object, it will be freed.
 diff --git a/job.c b/job.c
-index 93e22d180b..2b31f1e14f 100644
+index e5699ad200..34c9758349 100644
 --- a/job.c
 +++ b/job.c
-@@ -93,6 +93,8 @@ struct JobTxn {
+@@ -72,6 +72,8 @@ struct JobTxn {
     /* Reference count */
     int refcnt;
@@ -45,8 +45,8 @@ index 93e22d180b..2b31f1e14f 100644
 +    bool sequential;
 };
- void job_lock(void)
+ /* Right now, this mutex is only needed to synchronize accesses to job->busy
-@@ -118,6 +120,25 @@ JobTxn *job_txn_new(void)
+@@ -102,6 +104,25 @@ JobTxn *job_txn_new(void)
     return txn;
 }
@@ -69,23 +69,20 @@ index 93e22d180b..2b31f1e14f 100644
 +    job_start(first);
 +}
 +
- /* Called with job_mutex held. */
+ static void job_txn_ref(JobTxn *txn)
 static void job_txn_ref_locked(JobTxn *txn)
 {
-@@ -1057,6 +1078,12 @@ static void job_completed_txn_success_locked(Job *job)
+     txn->refcnt++;
@@ -897,6 +918,9 @@ static void job_completed_txn_success(Job *job)
      */
     QLIST_FOREACH(other_job, &txn->jobs, txn_list) {
-         if (!job_is_completed_locked(other_job)) {
+         if (!job_is_completed(other_job)) {
 +            if (txn->sequential) {
 +                job_unlock();
 +                /* Needs to be called without holding the job lock */
 +                job_start(other_job);
 +                job_lock();
 +            }
             return;
         }
         assert(other_job->ret == 0);
-@@ -1268,6 +1295,13 @@ int job_finish_sync_locked(Job *job,
+@@ -1093,6 +1117,13 @@ int job_finish_sync(Job *job, void (*finish)(Job *, Error **errp), Error **errp)
         return -EBUSY;
     }
@@ -93,9 +90,9 @@ index 93e22d180b..2b31f1e14f 100644
 +     * of cancelling, these have not begun work so job_enter won't do anything,
 +     * let's ensure they are marked as ABORTING if required */
 +    if (job->status == JOB_STATUS_CREATED && job->txn->sequential) {
-+        job_update_rc_locked(job);
+        job_update_rc(job);
 +    }
 +
-     job_unlock();
+     AIO_WAIT_WHILE(job->aio_context,
-     AIO_WAIT_WHILE_UNLOCKED(job->aio_context,
+                    (job_enter(job), !job_is_completed(job)));
-                             (job_enter(job), !job_is_completed(job)));
+ 
--- a/debian/patches/pve/0038-PVE-Backup-Use-a-transaction-to-synchronize-job-stat.patch
+++ b/debian/patches/pve/0038-PVE-Backup-Use-a-transaction-to-synchronize-job-stat.patch
@@ -0,0 +1,295 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Stefan Reiter <s.reiter@proxmox.com>
 Date: Thu, 20 Aug 2020 14:25:00 +0200
 Subject: [PATCH] PVE-Backup: Use a transaction to synchronize job states
 By using a JobTxn, we can sync dirty bitmaps only when *all* jobs were
 successful - meaning we don't need to remove them when the backup fails,
 since QEMU's BITMAP_SYNC_MODE_ON_SUCCESS will now handle that for us.
 To keep the rate-limiting and IO impact from before, we use a sequential
 transaction, so drives will still be backed up one after the other.
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 [add new force parameter to job_cancel_sync calls]
 Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 ---
 pve-backup.c | 167 +++++++++++++++------------------------------------
 1 file changed, 49 insertions(+), 118 deletions(-)
 diff --git a/pve-backup.c b/pve-backup.c
 index f90abaa50a..63c686463f 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
@@ -52,6 +52,7 @@ static struct PVEBackupState {
     VmaWriter *vmaw;
     ProxmoxBackupHandle *pbs;
     GList *di_list;
 +    JobTxn *txn;
     QemuMutex backup_mutex;
     CoMutex dump_callback_mutex;
 } backup_state;
@@ -71,32 +72,12 @@ typedef struct PVEBackupDevInfo {
     size_t size;
     uint64_t block_size;
     uint8_t dev_id;
 -    bool completed;
     char targetfile[PATH_MAX];
     BdrvDirtyBitmap *bitmap;
     BlockDriverState *target;
 +    BlockJob *job;
 } PVEBackupDevInfo;
 -static void pvebackup_run_next_job(void);
 -
 -static BlockJob *
 -lookup_active_block_job(PVEBackupDevInfo *di)
 -{
 -    if (!di->completed && di->bs) {
 -        for (BlockJob *job = block_job_next(NULL); job; job = block_job_next(job)) {
 -            if (job->job.driver->job_type != JOB_TYPE_BACKUP) {
 -                continue;
 -            }
 -
 -            BackupBlockJob *bjob = container_of(job, BackupBlockJob, common);
 -            if (bjob && bjob->source_bs == di->bs) {
 -                return job;
 -            }
 -        }
 -    }
 -    return NULL;
 -}
 -
 static void pvebackup_propagate_error(Error *err)
 {
     qemu_mutex_lock(&backup_state.stat.lock);
@@ -272,18 +253,6 @@ static void coroutine_fn pvebackup_co_cleanup(void *unused)
             if (local_err != NULL) {
                 pvebackup_propagate_error(local_err);
             }
 -        } else {
 -            // on error or cancel we cannot ensure synchronization of dirty
 -            // bitmaps with backup server, so remove all and do full backup next
 -            GList *l = backup_state.di_list;
 -            while (l) {
 -                PVEBackupDevInfo *di = (PVEBackupDevInfo *)l->data;
 -                l = g_list_next(l);
 -
 -                if (di->bitmap) {
 -                    bdrv_release_dirty_bitmap(di->bitmap);
 -                }
 -            }
         }
         proxmox_backup_disconnect(backup_state.pbs);
@@ -322,8 +291,6 @@ static void pvebackup_complete_cb(void *opaque, int ret)
     qemu_mutex_lock(&backup_state.backup_mutex);
 -    di->completed = true;
 -
     if (ret < 0) {
         Error *local_err = NULL;
         error_setg(&local_err, "job failed with err %d - %s", ret, strerror(-ret));
@@ -336,20 +303,17 @@ static void pvebackup_complete_cb(void *opaque, int ret)
     block_on_coroutine_fn(pvebackup_complete_stream, di);
 -    // remove self from job queue
 +    // remove self from job list
     backup_state.di_list = g_list_remove(backup_state.di_list, di);
 -    if (di->bitmap && ret < 0) {
 -        // on error or cancel we cannot ensure synchronization of dirty
 -        // bitmaps with backup server, so remove all and do full backup next
 -        bdrv_release_dirty_bitmap(di->bitmap);
 -    }
 -
     g_free(di);
 -    qemu_mutex_unlock(&backup_state.backup_mutex);
 +    /* call cleanup if we're the last job */
 +    if (!g_list_first(backup_state.di_list)) {
 +        block_on_coroutine_fn(pvebackup_co_cleanup, NULL);
 +    }
 -    pvebackup_run_next_job();
 +    qemu_mutex_unlock(&backup_state.backup_mutex);
 }
 static void pvebackup_cancel(void)
@@ -371,36 +335,28 @@ static void pvebackup_cancel(void)
         proxmox_backup_abort(backup_state.pbs, "backup canceled");
     }
 -    qemu_mutex_unlock(&backup_state.backup_mutex);
 -
 -    for(;;) {
 -
 -        BlockJob *next_job = NULL;
 -
 -        qemu_mutex_lock(&backup_state.backup_mutex);
 -
 -        GList *l = backup_state.di_list;
 -        while (l) {
 -            PVEBackupDevInfo *di = (PVEBackupDevInfo *)l->data;
 -            l = g_list_next(l);
 +    /* it's enough to cancel one job in the transaction, the rest will follow
 +     * automatically */
 +    GList *bdi = g_list_first(backup_state.di_list);
 +    BlockJob *cancel_job = bdi && bdi->data ?
 +        ((PVEBackupDevInfo *)bdi->data)->job :
 +        NULL;
 -            BlockJob *job = lookup_active_block_job(di);
 -            if (job != NULL) {
 -                next_job = job;
 -                break;
 -            }
 -        }
 +    /* ref the job before releasing the mutex, just to be safe */
 +    if (cancel_job) {
 +        job_ref(&cancel_job->job);
 +    }
 -        qemu_mutex_unlock(&backup_state.backup_mutex);
 +    /* job_cancel_sync may enter the job, so we need to release the
 +     * backup_mutex to avoid deadlock */
 +    qemu_mutex_unlock(&backup_state.backup_mutex);
 -        if (next_job) {
 -            AioContext *aio_context = next_job->job.aio_context;
 -            aio_context_acquire(aio_context);
 -            job_cancel_sync(&next_job->job, true);
 -            aio_context_release(aio_context);
 -        } else {
 -            break;
 -        }
 +    if (cancel_job) {
 +        AioContext *aio_context = cancel_job->job.aio_context;
 +        aio_context_acquire(aio_context);
 +        job_cancel_sync(&cancel_job->job, true);
 +        job_unref(&cancel_job->job);
 +        aio_context_release(aio_context);
     }
 }
@@ -459,51 +415,19 @@ static int coroutine_fn pvebackup_co_add_config(
     goto out;
 }
 -bool job_should_pause(Job *job);
 -
 -static void pvebackup_run_next_job(void)
 -{
 -    assert(!qemu_in_coroutine());
 -
 -    qemu_mutex_lock(&backup_state.backup_mutex);
 -
 -    GList *l = backup_state.di_list;
 -    while (l) {
 -        PVEBackupDevInfo *di = (PVEBackupDevInfo *)l->data;
 -        l = g_list_next(l);
 -
 -        BlockJob *job = lookup_active_block_job(di);
 -
 -        if (job) {
 -            qemu_mutex_unlock(&backup_state.backup_mutex);
 -
 -            AioContext *aio_context = job->job.aio_context;
 -            aio_context_acquire(aio_context);
 -
 -            if (job_should_pause(&job->job)) {
 -                bool error_or_canceled = pvebackup_error_or_canceled();
 -                if (error_or_canceled) {
 -                    job_cancel_sync(&job->job, true);
 -                } else {
 -                    job_resume(&job->job);
 -                }
 -            }
 -            aio_context_release(aio_context);
 -            return;
 -        }
 -    }
 -
 -    block_on_coroutine_fn(pvebackup_co_cleanup, NULL); // no more jobs, run cleanup
 -
 -    qemu_mutex_unlock(&backup_state.backup_mutex);
 -}
 -
 static bool create_backup_jobs(void) {
     assert(!qemu_in_coroutine());
     Error *local_err = NULL;
 +    /* create job transaction to synchronize bitmap commit and cancel all
 +     * jobs in case one errors */
 +    if (backup_state.txn) {
 +        job_txn_unref(backup_state.txn);
 +    }
 +    backup_state.txn = job_txn_new_seq();
 +
     BackupPerf perf = { .max_workers = 16 };
     /* create and start all jobs (paused state) */
@@ -526,7 +450,7 @@ static bool create_backup_jobs(void) {
         BlockJob *job = backup_job_create(
             NULL, di->bs, di->target, backup_state.speed, sync_mode, di->bitmap,
             bitmap_mode, false, NULL, &perf, BLOCKDEV_ON_ERROR_REPORT, BLOCKDEV_ON_ERROR_REPORT,
 -            JOB_DEFAULT, pvebackup_complete_cb, di, NULL, &local_err);
 +            JOB_DEFAULT, pvebackup_complete_cb, di, backup_state.txn, &local_err);
         aio_context_release(aio_context);
@@ -538,7 +462,8 @@ static bool create_backup_jobs(void) {
             pvebackup_propagate_error(create_job_err);
             break;
         }
 -        job_start(&job->job);
 +
 +        di->job = job;
         bdrv_unref(di->target);
         di->target = NULL;
@@ -556,6 +481,10 @@ static bool create_backup_jobs(void) {
                 bdrv_unref(di->target);
                 di->target = NULL;
             }
 +
 +            if (di->job) {
 +                job_unref(&di->job->job);
 +            }
         }
     }
@@ -946,10 +875,6 @@ err:
         PVEBackupDevInfo *di = (PVEBackupDevInfo *)l->data;
         l = g_list_next(l);
 -        if (di->bitmap) {
 -            bdrv_release_dirty_bitmap(di->bitmap);
 -        }
 -
         if (di->target) {
             bdrv_unref(di->target);
         }
@@ -1038,9 +963,15 @@ UuidInfo *qmp_backup(
     block_on_coroutine_fn(pvebackup_co_prepare, &task);
     if (*errp == NULL) {
 -        create_backup_jobs();
 +        bool errors = create_backup_jobs();
         qemu_mutex_unlock(&backup_state.backup_mutex);
 -        pvebackup_run_next_job();
 +
 +        if (!errors) {
 +            /* start the first job in the transaction
 +             * note: this might directly enter the job, so we need to do this
 +             * after unlocking the backup_mutex */
 +            job_txn_start_seq(backup_state.txn);
 +        }
     } else {
         qemu_mutex_unlock(&backup_state.backup_mutex);
     }
--- a/debian/patches/pve/0039-PVE-Backup-Don-t-block-on-finishing-and-cleanup-crea.patch
+++ b/debian/patches/pve/0039-PVE-Backup-Don-t-block-on-finishing-and-cleanup-crea.patch
@@ -0,0 +1,503 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Stefan Reiter <s.reiter@proxmox.com>
 Date: Mon, 28 Sep 2020 13:40:51 +0200
 Subject: [PATCH] PVE-Backup: Don't block on finishing and cleanup
 create_backup_jobs
 proxmox_backup_co_finish is already async, but previously we would wait
 for the coroutine using block_on_coroutine_fn(). Avoid this by
 scheduling pvebackup_co_complete_stream (and thus pvebackup_co_cleanup)
 as a real coroutine when calling from pvebackup_complete_cb. This is ok,
 since complete_stream uses the backup_mutex internally to synchronize,
 and other streams can happily continue writing in the meantime anyway.
 To accomodate, backup_mutex is converted to a CoMutex. This means
 converting every user to a coroutine. This is not just useful here, but
 will come in handy once this series[0] is merged, and QMP calls can be
 yield-able coroutines too. Then we can also finally get rid of
 block_on_coroutine_fn.
 Cases of aio_context_acquire/release from within what is now a coroutine
 are changed to aio_co_reschedule_self, which works since a running
 coroutine always holds the aio lock for the context it is running in.
 job_cancel_sync is called from a BH since it can't be run from a
 coroutine (uses AIO_WAIT_WHILE internally).
 Same thing for create_backup_jobs, which is converted to a BH too.
 To communicate the finishing state, a new property is introduced to
 query-backup: 'finishing'. A new state is explicitly not used, since
 that would break compatibility with older qemu-server versions.
 Also fix create_backup_jobs:
 No more weird bool returns, just the standard "errp" format used
 everywhere else too. With this, if backup_job_create fails, the error
 message is actually returned over QMP and can be shown to the user.
 To facilitate correct cleanup on such an error, we call
 create_backup_jobs as a bottom half directly from pvebackup_co_prepare.
 This additionally allows us to actually hold the backup_mutex during
 operation.
 Also add a job_cancel_sync before job_unref, since a job must be in
 STATUS_NULL to be deleted by unref, which could trigger an assert
 before.
 [0] https://lists.gnu.org/archive/html/qemu-devel/2020-09/msg03515.html
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 [add new force parameter to job_cancel_sync calls]
 Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 ---
 pve-backup.c         | 217 ++++++++++++++++++++++++++++---------------
 qapi/block-core.json |   5 +-
 2 files changed, 144 insertions(+), 78 deletions(-)
 diff --git a/pve-backup.c b/pve-backup.c
 index 63c686463f..6f05796fad 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
@@ -33,7 +33,9 @@ const char *PBS_BITMAP_NAME = "pbs-incremental-dirty-bitmap";
 static struct PVEBackupState {
     struct {
 -        // Everithing accessed from qmp_backup_query command is protected using lock
 +        // Everything accessed from qmp_backup_query command is protected using
 +        // this lock. Do NOT hold this lock for long times, as it is sometimes
 +        // acquired from coroutines, and thus any wait time may block the guest.
         QemuMutex lock;
         Error *error;
         time_t start_time;
@@ -47,20 +49,22 @@ static struct PVEBackupState {
         size_t reused;
         size_t zero_bytes;
         GList *bitmap_list;
 +        bool finishing;
 +        bool starting;
     } stat;
     int64_t speed;
     VmaWriter *vmaw;
     ProxmoxBackupHandle *pbs;
     GList *di_list;
     JobTxn *txn;
 -    QemuMutex backup_mutex;
 +    CoMutex backup_mutex;
     CoMutex dump_callback_mutex;
 } backup_state;
 static void pvebackup_init(void)
 {
     qemu_mutex_init(&backup_state.stat.lock);
 -    qemu_mutex_init(&backup_state.backup_mutex);
 +    qemu_co_mutex_init(&backup_state.backup_mutex);
     qemu_co_mutex_init(&backup_state.dump_callback_mutex);
 }
@@ -72,6 +76,7 @@ typedef struct PVEBackupDevInfo {
     size_t size;
     uint64_t block_size;
     uint8_t dev_id;
 +    int completed_ret; // INT_MAX if not completed
     char targetfile[PATH_MAX];
     BdrvDirtyBitmap *bitmap;
     BlockDriverState *target;
@@ -227,12 +232,12 @@ pvebackup_co_dump_vma_cb(
 }
 // assumes the caller holds backup_mutex
 -static void coroutine_fn pvebackup_co_cleanup(void *unused)
 +static void coroutine_fn pvebackup_co_cleanup(void)
 {
     assert(qemu_in_coroutine());
     qemu_mutex_lock(&backup_state.stat.lock);
 -    backup_state.stat.end_time = time(NULL);
 +    backup_state.stat.finishing = true;
     qemu_mutex_unlock(&backup_state.stat.lock);
     if (backup_state.vmaw) {
@@ -261,35 +266,29 @@ static void coroutine_fn pvebackup_co_cleanup(void *unused)
     g_list_free(backup_state.di_list);
     backup_state.di_list = NULL;
 +
 +    qemu_mutex_lock(&backup_state.stat.lock);
 +    backup_state.stat.end_time = time(NULL);
 +    backup_state.stat.finishing = false;
 +    qemu_mutex_unlock(&backup_state.stat.lock);
 }
 -// assumes the caller holds backup_mutex
 -static void coroutine_fn pvebackup_complete_stream(void *opaque)
 +static void coroutine_fn pvebackup_co_complete_stream(void *opaque)
 {
     PVEBackupDevInfo *di = opaque;
 +    int ret = di->completed_ret;
 -    bool error_or_canceled = pvebackup_error_or_canceled();
 -
 -    if (backup_state.vmaw) {
 -        vma_writer_close_stream(backup_state.vmaw, di->dev_id);
 +    qemu_mutex_lock(&backup_state.stat.lock);
 +    bool starting = backup_state.stat.starting;
 +    qemu_mutex_unlock(&backup_state.stat.lock);
 +    if (starting) {
 +        /* in 'starting' state, no tasks have been run yet, meaning we can (and
 +         * must) skip all cleanup, as we don't know what has and hasn't been
 +         * initialized yet. */
 +        return;
     }
 -    if (backup_state.pbs && !error_or_canceled) {
 -        Error *local_err = NULL;
 -        proxmox_backup_co_close_image(backup_state.pbs, di->dev_id, &local_err);
 -        if (local_err != NULL) {
 -            pvebackup_propagate_error(local_err);
 -        }
 -    }
 -}
 -
 -static void pvebackup_complete_cb(void *opaque, int ret)
 -{
 -    assert(!qemu_in_coroutine());
 -
 -    PVEBackupDevInfo *di = opaque;
 -
 -    qemu_mutex_lock(&backup_state.backup_mutex);
 +    qemu_co_mutex_lock(&backup_state.backup_mutex);
     if (ret < 0) {
         Error *local_err = NULL;
@@ -301,7 +300,19 @@ static void pvebackup_complete_cb(void *opaque, int ret)
     assert(di->target == NULL);
 -    block_on_coroutine_fn(pvebackup_complete_stream, di);
 +    bool error_or_canceled = pvebackup_error_or_canceled();
 +
 +    if (backup_state.vmaw) {
 +        vma_writer_close_stream(backup_state.vmaw, di->dev_id);
 +    }
 +
 +    if (backup_state.pbs && !error_or_canceled) {
 +        Error *local_err = NULL;
 +        proxmox_backup_co_close_image(backup_state.pbs, di->dev_id, &local_err);
 +        if (local_err != NULL) {
 +            pvebackup_propagate_error(local_err);
 +        }
 +    }
     // remove self from job list
     backup_state.di_list = g_list_remove(backup_state.di_list, di);
@@ -310,21 +321,49 @@ static void pvebackup_complete_cb(void *opaque, int ret)
     /* call cleanup if we're the last job */
     if (!g_list_first(backup_state.di_list)) {
 -        block_on_coroutine_fn(pvebackup_co_cleanup, NULL);
 +        pvebackup_co_cleanup();
     }
 -    qemu_mutex_unlock(&backup_state.backup_mutex);
 +    qemu_co_mutex_unlock(&backup_state.backup_mutex);
 }
 -static void pvebackup_cancel(void)
 +static void pvebackup_complete_cb(void *opaque, int ret)
 {
 -    assert(!qemu_in_coroutine());
 +    PVEBackupDevInfo *di = opaque;
 +    di->completed_ret = ret;
 +
 +    /*
 +     * Schedule stream cleanup in async coroutine. close_image and finish might
 +     * take a while, so we can't block on them here. This way it also doesn't
 +     * matter if we're already running in a coroutine or not.
 +     * Note: di is a pointer to an entry in the global backup_state struct, so
 +     * it stays valid.
 +     */
 +    Coroutine *co = qemu_coroutine_create(pvebackup_co_complete_stream, di);
 +    aio_co_enter(qemu_get_aio_context(), co);
 +}
 +
 +/*
 + * job_cancel(_sync) does not like to be called from coroutines, so defer to
 + * main loop processing via a bottom half.
 + */
 +static void job_cancel_bh(void *opaque) {
 +    CoCtxData *data = (CoCtxData*)opaque;
 +    Job *job = (Job*)data->data;
 +    AioContext *job_ctx = job->aio_context;
 +    aio_context_acquire(job_ctx);
 +    job_cancel_sync(job, true);
 +    aio_context_release(job_ctx);
 +    aio_co_enter(data->ctx, data->co);
 +}
 +static void coroutine_fn pvebackup_co_cancel(void *opaque)
 +{
     Error *cancel_err = NULL;
     error_setg(&cancel_err, "backup canceled");
     pvebackup_propagate_error(cancel_err);
 -    qemu_mutex_lock(&backup_state.backup_mutex);
 +    qemu_co_mutex_lock(&backup_state.backup_mutex);
     if (backup_state.vmaw) {
         /* make sure vma writer does not block anymore */
@@ -342,27 +381,22 @@ static void pvebackup_cancel(void)
         ((PVEBackupDevInfo *)bdi->data)->job :
         NULL;
 -    /* ref the job before releasing the mutex, just to be safe */
     if (cancel_job) {
 -        job_ref(&cancel_job->job);
 +        CoCtxData data = {
 +            .ctx = qemu_get_current_aio_context(),
 +            .co = qemu_coroutine_self(),
 +            .data = &cancel_job->job,
 +        };
 +        aio_bh_schedule_oneshot(data.ctx, job_cancel_bh, &data);
 +        qemu_coroutine_yield();
     }
 -    /* job_cancel_sync may enter the job, so we need to release the
 -     * backup_mutex to avoid deadlock */
 -    qemu_mutex_unlock(&backup_state.backup_mutex);
 -
 -    if (cancel_job) {
 -        AioContext *aio_context = cancel_job->job.aio_context;
 -        aio_context_acquire(aio_context);
 -        job_cancel_sync(&cancel_job->job, true);
 -        job_unref(&cancel_job->job);
 -        aio_context_release(aio_context);
 -    }
 +    qemu_co_mutex_unlock(&backup_state.backup_mutex);
 }
 void qmp_backup_cancel(Error **errp)
 {
 -    pvebackup_cancel();
 +    block_on_coroutine_fn(pvebackup_co_cancel, NULL);
 }
 // assumes the caller holds backup_mutex
@@ -415,10 +449,18 @@ static int coroutine_fn pvebackup_co_add_config(
     goto out;
 }
 -static bool create_backup_jobs(void) {
 +/*
 + * backup_job_create can *not* be run from a coroutine (and requires an
 + * acquired AioContext), so this can't either.
 + * The caller is responsible that backup_mutex is held nonetheless.
 + */
 +static void create_backup_jobs_bh(void *opaque) {
     assert(!qemu_in_coroutine());
 +    CoCtxData *data = (CoCtxData*)opaque;
 +    Error **errp = (Error**)data->data;
 +
     Error *local_err = NULL;
     /* create job transaction to synchronize bitmap commit and cancel all
@@ -454,24 +496,19 @@ static bool create_backup_jobs(void) {
         aio_context_release(aio_context);
 -        if (!job || local_err != NULL) {
 -            Error *create_job_err = NULL;
 -            error_setg(&create_job_err, "backup_job_create failed: %s",
 -                       local_err ? error_get_pretty(local_err) : "null");
 +        di->job = job;
 -            pvebackup_propagate_error(create_job_err);
 +        if (!job || local_err) {
 +            error_setg(errp, "backup_job_create failed: %s",
 +                       local_err ? error_get_pretty(local_err) : "null");
             break;
         }
 -        di->job = job;
 -
         bdrv_unref(di->target);
         di->target = NULL;
     }
 -    bool errors = pvebackup_error_or_canceled();
 -
 -    if (errors) {
 +    if (*errp) {
         l = backup_state.di_list;
         while (l) {
             PVEBackupDevInfo *di = (PVEBackupDevInfo *)l->data;
@@ -483,12 +520,17 @@ static bool create_backup_jobs(void) {
             }
             if (di->job) {
 +                AioContext *ctx = di->job->job.aio_context;
 +                aio_context_acquire(ctx);
 +                job_cancel_sync(&di->job->job, true);
                 job_unref(&di->job->job);
 +                aio_context_release(ctx);
             }
         }
     }
 -    return errors;
 +    /* return */
 +    aio_co_enter(data->ctx, data->co);
 }
 typedef struct QmpBackupTask {
@@ -525,11 +567,12 @@ typedef struct QmpBackupTask {
     UuidInfo *result;
 } QmpBackupTask;
 -// assumes the caller holds backup_mutex
 static void coroutine_fn pvebackup_co_prepare(void *opaque)
 {
     assert(qemu_in_coroutine());
 +    qemu_co_mutex_lock(&backup_state.backup_mutex);
 +
     QmpBackupTask *task = opaque;
     task->result = NULL; // just to be sure
@@ -550,8 +593,9 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
     const char *firewall_name = "qemu-server.fw";
     if (backup_state.di_list) {
 -         error_set(task->errp, ERROR_CLASS_GENERIC_ERROR,
 +        error_set(task->errp, ERROR_CLASS_GENERIC_ERROR,
                   "previous backup not finished");
 +        qemu_co_mutex_unlock(&backup_state.backup_mutex);
         return;
     }
@@ -618,6 +662,8 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
         }
         di->size = size;
         total += size;
 +
 +        di->completed_ret = INT_MAX;
     }
     uuid_generate(uuid);
@@ -849,6 +895,8 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
     backup_state.stat.dirty = total - backup_state.stat.reused;
     backup_state.stat.transferred = 0;
     backup_state.stat.zero_bytes = 0;
 +    backup_state.stat.finishing = false;
 +    backup_state.stat.starting = true;
     qemu_mutex_unlock(&backup_state.stat.lock);
@@ -863,6 +911,33 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
     uuid_info->UUID = uuid_str;
     task->result = uuid_info;
 +
 +    /* Run create_backup_jobs_bh outside of coroutine (in BH) but keep
 +    * backup_mutex locked. This is fine, a CoMutex can be held across yield
 +    * points, and we'll release it as soon as the BH reschedules us.
 +    */
 +    CoCtxData waker = {
 +        .co = qemu_coroutine_self(),
 +        .ctx = qemu_get_current_aio_context(),
 +        .data = &local_err,
 +    };
 +    aio_bh_schedule_oneshot(waker.ctx, create_backup_jobs_bh, &waker);
 +    qemu_coroutine_yield();
 +
 +    if (local_err) {
 +        error_propagate(task->errp, local_err);
 +        goto err;
 +    }
 +
 +    qemu_co_mutex_unlock(&backup_state.backup_mutex);
 +
 +    qemu_mutex_lock(&backup_state.stat.lock);
 +    backup_state.stat.starting = false;
 +    qemu_mutex_unlock(&backup_state.stat.lock);
 +
 +    /* start the first job in the transaction */
 +    job_txn_start_seq(backup_state.txn);
 +
     return;
 err_mutex:
@@ -885,6 +960,7 @@ err:
         g_free(di);
     }
     g_list_free(di_list);
 +    backup_state.di_list = NULL;
     if (devs) {
         g_strfreev(devs);
@@ -905,6 +981,8 @@ err:
     }
     task->result = NULL;
 +
 +    qemu_co_mutex_unlock(&backup_state.backup_mutex);
     return;
 }
@@ -958,24 +1036,8 @@ UuidInfo *qmp_backup(
         .errp = errp,
     };
 -    qemu_mutex_lock(&backup_state.backup_mutex);
 -
     block_on_coroutine_fn(pvebackup_co_prepare, &task);
 -    if (*errp == NULL) {
 -        bool errors = create_backup_jobs();
 -        qemu_mutex_unlock(&backup_state.backup_mutex);
 -
 -        if (!errors) {
 -            /* start the first job in the transaction
 -             * note: this might directly enter the job, so we need to do this
 -             * after unlocking the backup_mutex */
 -            job_txn_start_seq(backup_state.txn);
 -        }
 -    } else {
 -        qemu_mutex_unlock(&backup_state.backup_mutex);
 -    }
 -
     return task.result;
 }
@@ -1027,6 +1089,7 @@ BackupStatus *qmp_query_backup(Error **errp)
     info->transferred = backup_state.stat.transferred;
     info->has_reused = true;
     info->reused = backup_state.stat.reused;
 +    info->finishing = backup_state.stat.finishing;
     qemu_mutex_unlock(&backup_state.stat.lock);
 diff --git a/qapi/block-core.json b/qapi/block-core.json
 index 16e184dd28..cb17d00fe0 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
@@ -770,12 +770,15 @@
 #
 # @uuid: uuid for this backup job
 #
 +# @finishing: if status='active' and finishing=true, then the backup process is
 +#             waiting for the target to finish.
 +#
 ##
 { 'struct': 'BackupStatus',
   'data': {'*status': 'str', '*errmsg': 'str', '*total': 'int', '*dirty': 'int',
            '*transferred': 'int', '*zero-bytes': 'int', '*reused': 'int',
            '*start-time': 'int', '*end-time': 'int',
 -           '*backup-file': 'str', '*uuid': 'str' } }
 +           '*backup-file': 'str', '*uuid': 'str', 'finishing': 'bool' } }
 ##
 # @BackupFormat:
--- a/debian/patches/pve/0040-PVE-Migrate-dirty-bitmap-state-via-savevm.patch
+++ b/debian/patches/pve/0040-PVE-Migrate-dirty-bitmap-state-via-savevm.patch
@@ -13,23 +13,21 @@ safe migration is possible and makes sense.
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 [FE: split up state_pending for 8.0]
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 include/migration/misc.h |   3 ++
 migration/meson.build    |   2 +
 migration/migration.c    |   1 +
- migration/pbs-state.c    | 104 +++++++++++++++++++++++++++++++++++++++
+ migration/pbs-state.c    | 106 +++++++++++++++++++++++++++++++++++++++
 pve-backup.c             |   1 +
 qapi/block-core.json     |   6 +++
- 6 files changed, 117 insertions(+)
+ 6 files changed, 119 insertions(+)
 create mode 100644 migration/pbs-state.c
 diff --git a/include/migration/misc.h b/include/migration/misc.h
-index 8b49841016..78f63ca400 100644
+index 465906710d..4f0aeceb6f 100644
 --- a/include/migration/misc.h
 +++ b/include/migration/misc.h
-@@ -77,4 +77,7 @@ bool migration_in_bg_snapshot(void);
+@@ -75,4 +75,7 @@ bool migration_in_bg_snapshot(void);
 /* migration/block-dirty-bitmap.c */
 void dirty_bitmap_mig_init(void);
@@ -38,7 +36,7 @@ index 8b49841016..78f63ca400 100644
 +
 #endif
 diff --git a/migration/meson.build b/migration/meson.build
-index a7824b5266..de6a271b58 100644
+index 0842d00cd2..d012f4d8d3 100644
 --- a/migration/meson.build
 +++ b/migration/meson.build
@@ -6,8 +6,10 @@ migration_files = files(
@@ -53,10 +51,10 @@ index a7824b5266..de6a271b58 100644
 softmmu_ss.add(files(
   'block-dirty-bitmap.c',
 diff --git a/migration/migration.c b/migration/migration.c
-index 99f86bd6c2..db229e72c9 100644
+index bb8bbddfe4..8109e468eb 100644
 --- a/migration/migration.c
 +++ b/migration/migration.c
-@@ -245,6 +245,7 @@ void migration_object_init(void)
+@@ -229,6 +229,7 @@ void migration_object_init(void)
     blk_mig_init();
     ram_mig_init();
     dirty_bitmap_mig_init();
@@ -66,10 +64,10 @@ index 99f86bd6c2..db229e72c9 100644
 void migration_cancel(const Error *error)
 diff --git a/migration/pbs-state.c b/migration/pbs-state.c
 new file mode 100644
-index 0000000000..887e998b9e
+index 0000000000..29f2b3860d
 --- /dev/null
 +++ b/migration/pbs-state.c
-@@ -0,0 +1,104 @@
+@@ -0,0 +1,106 @@
 +/*
 + * PBS (dirty-bitmap) state migration
 + */
@@ -88,8 +86,11 @@ index 0000000000..887e998b9e
 +/* state is accessed via this static variable directly, 'opaque' is NULL */
 +static PBSState pbs_state;
 +
-+static void pbs_state_pending(void *opaque, uint64_t *must_precopy,
+static void pbs_state_save_pending(QEMUFile *f, void *opaque,
-+                              uint64_t *can_postcopy)
+                                      uint64_t max_size,
 +                                      uint64_t *res_precopy_only,
 +                                      uint64_t *res_compatible,
 +                                      uint64_t *res_postcopy_only)
 +{
 +    /* we send everything in save_setup, so nothing is ever pending */
 +}
@@ -159,8 +160,7 @@ index 0000000000..887e998b9e
 +static SaveVMHandlers savevm_pbs_state_handlers = {
 +    .save_setup = pbs_state_save_setup,
 +    .has_postcopy = pbs_state_has_postcopy,
-+    .state_pending_exact = pbs_state_pending,
+    .save_live_pending = pbs_state_save_pending,
 +    .state_pending_estimate = pbs_state_pending,
 +    .is_active_iterate = pbs_state_is_active_iterate,
 +    .load_state = pbs_state_load,
 +    .is_active = pbs_state_is_active,
@@ -175,22 +175,22 @@ index 0000000000..887e998b9e
 +                         NULL);
 +}
 diff --git a/pve-backup.c b/pve-backup.c
-index 21441b2f97..5e5c37e06d 100644
+index 6f05796fad..5fa3cc1352 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
-@@ -1060,6 +1060,7 @@ ProxmoxSupportStatus *qmp_query_proxmox_support(Error **errp)
+@@ -1132,6 +1132,7 @@ ProxmoxSupportStatus *qmp_query_proxmox_support(Error **errp)
     ret->pbs_library_version = g_strdup(proxmox_backup_qemu_version());
     ret->pbs_dirty_bitmap = true;
     ret->pbs_dirty_bitmap_savevm = true;
 +    ret->pbs_dirty_bitmap_migration = true;
     ret->query_bitmap_info = true;
-     ret->pbs_masterkey = true;
+     return ret;
-     ret->backup_max_workers = true;
+ }
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index d601fb4ab2..16be1e02ec 100644
+index cb17d00fe0..bd978ea562 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -987,6 +987,11 @@
+@@ -879,6 +879,11 @@
 # @pbs-dirty-bitmap-savevm: True if 'dirty-bitmaps' migration capability can
 #                           safely be set for savevm-async.
 #
@@ -199,14 +199,14 @@ index d601fb4ab2..16be1e02ec 100644
 +#                              migration cap if this is false/unset may lead
 +#                              to crashes on migration!
 +#
- # @pbs-masterkey: True if the QMP backup call supports the 'master_keyfile'
+ # @pbs-library-version: Running version of libproxmox-backup-qemu0 library.
 #                 parameter.
 #
-@@ -997,6 +1002,7 @@
+ ##
@@ -886,6 +891,7 @@
   'data': { 'pbs-dirty-bitmap': 'bool',
             'query-bitmap-info': 'bool',
             'pbs-dirty-bitmap-savevm': 'bool',
 +            'pbs-dirty-bitmap-migration': 'bool',
-             'pbs-masterkey': 'bool',
+             'pbs-library-version': 'str' } }
-             'pbs-library-version': 'str',
+ 
-             'backup-max-workers': 'bool' } }
+ ##
--- a/debian/patches/pve/0041-migration-block-dirty-bitmap-migrate-other-bitmaps-e.patch
+++ b/debian/patches/pve/0041-migration-block-dirty-bitmap-migrate-other-bitmaps-e.patch
@@ -19,10 +19,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/migration/block-dirty-bitmap.c b/migration/block-dirty-bitmap.c
-index 7eaf498439..509f3df0a6 100644
+index 9aba7d9c22..f4ecf9c9f9 100644
 --- a/migration/block-dirty-bitmap.c
 +++ b/migration/block-dirty-bitmap.c
-@@ -539,7 +539,7 @@ static int add_bitmaps_to_list(DBMSaveState *s, BlockDriverState *bs,
+@@ -538,7 +538,7 @@ static int add_bitmaps_to_list(DBMSaveState *s, BlockDriverState *bs,
         if (bdrv_dirty_bitmap_check(bitmap, BDRV_BITMAP_DEFAULT, &local_err)) {
             error_report_err(local_err);
--- a/debian/patches/pve/0042-PVE-fall-back-to-open-iscsi-initiatorname.patch
+++ b/debian/patches/pve/0042-PVE-fall-back-to-open-iscsi-initiatorname.patch
@@ -21,10 +21,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 1 file changed, 30 insertions(+)
 diff --git a/block/iscsi.c b/block/iscsi.c
-index 9fc0bed90b..1d40933165 100644
+index d707d0b354..da6ed52323 100644
 --- a/block/iscsi.c
 +++ b/block/iscsi.c
-@@ -1392,12 +1392,42 @@ static char *get_initiator_name(QemuOpts *opts)
+@@ -1386,12 +1386,42 @@ static char *get_initiator_name(QemuOpts *opts)
     const char *name;
     char *iscsi_name;
     UuidInfo *uuid_info;
--- a/debian/patches/pve/0043-PVE-Use-coroutine-QMP-for-backup-cancel_backup.patch
+++ b/debian/patches/pve/0043-PVE-Use-coroutine-QMP-for-backup-cancel_backup.patch
@@ -0,0 +1,598 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Stefan Reiter <s.reiter@proxmox.com>
 Date: Tue, 26 Jan 2021 15:45:30 +0100
 Subject: [PATCH] PVE: Use coroutine QMP for backup/cancel_backup
 Finally turn backup QMP calls into coroutines, now that it's possible.
 This has the benefit that calls are asynchronous to the main loop, i.e.
 long running operations like connecting to a PBS server will no longer
 hang the VM.
 Additionally, it allows us to get rid of block_on_coroutine_fn, which
 was always a hacky workaround.
 While we're already spring cleaning, also remove the QmpBackupTask
 struct, since we can now put the 'prepare' function directly into
 qmp_backup and thus no longer need those giant walls of text.
 (Note that for our patches to work with 5.2.0 this change is actually
 required, otherwise monitor_get_fd() fails as we're not in a QMP
 coroutine, but one we start ourselves - we could of course set the
 monitor for that coroutine ourselves, but let's just fix it the right
 way instead)
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
 block/monitor/block-hmp-cmds.c |   4 +-
 hmp-commands.hx                |   2 +
 proxmox-backup-client.c        |  31 -----
 pve-backup.c                   | 232 ++++++++++-----------------------
 qapi/block-core.json           |   4 +-
 5 files changed, 77 insertions(+), 196 deletions(-)
 diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
 index ea7b665aa2..ef45552e3b 100644
 --- a/block/monitor/block-hmp-cmds.c
 +++ b/block/monitor/block-hmp-cmds.c
@@ -1016,7 +1016,7 @@ void hmp_info_snapshots(Monitor *mon, const QDict *qdict)
     g_free(global_snapshots);
 }
 -void hmp_backup_cancel(Monitor *mon, const QDict *qdict)
 +void coroutine_fn hmp_backup_cancel(Monitor *mon, const QDict *qdict)
 {
     Error *error = NULL;
@@ -1025,7 +1025,7 @@ void hmp_backup_cancel(Monitor *mon, const QDict *qdict)
     hmp_handle_error(mon, error);
 }
 -void hmp_backup(Monitor *mon, const QDict *qdict)
 +void coroutine_fn hmp_backup(Monitor *mon, const QDict *qdict)
 {
     Error *error = NULL;
 diff --git a/hmp-commands.hx b/hmp-commands.hx
 index 97f24942b3..7a2be816da 100644
 --- a/hmp-commands.hx
 +++ b/hmp-commands.hx
@@ -111,6 +111,7 @@ ERST
 		    "\n\t\t\t Use -d to dump data into a directory instead"
 		    "\n\t\t\t of using VMA format.",
         .cmd = hmp_backup,
 +        .coroutine  = true,
     },
 SRST
@@ -124,6 +125,7 @@ ERST
         .params     = "",
         .help       = "cancel the current VM backup",
         .cmd        = hmp_backup_cancel,
 +        .coroutine  = true,
     },
 SRST
 diff --git a/proxmox-backup-client.c b/proxmox-backup-client.c
 index 4ce7bc0b5e..0923037dec 100644
 --- a/proxmox-backup-client.c
 +++ b/proxmox-backup-client.c
@@ -5,37 +5,6 @@
 /* Proxmox Backup Server client bindings using coroutines */
 -typedef struct BlockOnCoroutineWrapper {
 -    AioContext *ctx;
 -    CoroutineEntry *entry;
 -    void *entry_arg;
 -    bool finished;
 -} BlockOnCoroutineWrapper;
 -
 -static void coroutine_fn block_on_coroutine_wrapper(void *opaque)
 -{
 -    BlockOnCoroutineWrapper *wrapper = opaque;
 -    wrapper->entry(wrapper->entry_arg);
 -    wrapper->finished = true;
 -    aio_wait_kick();
 -}
 -
 -void block_on_coroutine_fn(CoroutineEntry *entry, void *entry_arg)
 -{
 -    assert(!qemu_in_coroutine());
 -
 -    AioContext *ctx = qemu_get_current_aio_context();
 -    BlockOnCoroutineWrapper wrapper = {
 -        .finished = false,
 -        .entry = entry,
 -        .entry_arg = entry_arg,
 -        .ctx = ctx,
 -    };
 -    Coroutine *wrapper_co = qemu_coroutine_create(block_on_coroutine_wrapper, &wrapper);
 -    aio_co_enter(ctx, wrapper_co);
 -    AIO_WAIT_WHILE(ctx, !wrapper.finished);
 -}
 -
 // This is called from another thread, so we use aio_co_schedule()
 static void proxmox_backup_schedule_wake(void *data) {
     CoCtxData *waker = (CoCtxData *)data;
 diff --git a/pve-backup.c b/pve-backup.c
 index 5fa3cc1352..323014744c 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
@@ -357,7 +357,7 @@ static void job_cancel_bh(void *opaque) {
     aio_co_enter(data->ctx, data->co);
 }
 -static void coroutine_fn pvebackup_co_cancel(void *opaque)
 +void coroutine_fn qmp_backup_cancel(Error **errp)
 {
     Error *cancel_err = NULL;
     error_setg(&cancel_err, "backup canceled");
@@ -394,11 +394,6 @@ static void coroutine_fn pvebackup_co_cancel(void *opaque)
     qemu_co_mutex_unlock(&backup_state.backup_mutex);
 }
 -void qmp_backup_cancel(Error **errp)
 -{
 -    block_on_coroutine_fn(pvebackup_co_cancel, NULL);
 -}
 -
 // assumes the caller holds backup_mutex
 static int coroutine_fn pvebackup_co_add_config(
     const char *file,
@@ -533,50 +528,27 @@ static void create_backup_jobs_bh(void *opaque) {
     aio_co_enter(data->ctx, data->co);
 }
 -typedef struct QmpBackupTask {
 -    const char *backup_file;
 -    bool has_password;
 -    const char *password;
 -    bool has_keyfile;
 -    const char *keyfile;
 -    bool has_key_password;
 -    const char *key_password;
 -    bool has_backup_id;
 -    const char *backup_id;
 -    bool has_backup_time;
 -    const char *fingerprint;
 -    bool has_fingerprint;
 -    int64_t backup_time;
 -    bool has_use_dirty_bitmap;
 -    bool use_dirty_bitmap;
 -    bool has_format;
 -    BackupFormat format;
 -    bool has_config_file;
 -    const char *config_file;
 -    bool has_firewall_file;
 -    const char *firewall_file;
 -    bool has_devlist;
 -    const char *devlist;
 -    bool has_compress;
 -    bool compress;
 -    bool has_encrypt;
 -    bool encrypt;
 -    bool has_speed;
 -    int64_t speed;
 -    Error **errp;
 -    UuidInfo *result;
 -} QmpBackupTask;
 -
 -static void coroutine_fn pvebackup_co_prepare(void *opaque)
 +UuidInfo coroutine_fn *qmp_backup(
 +    const char *backup_file,
 +    bool has_password, const char *password,
 +    bool has_keyfile, const char *keyfile,
 +    bool has_key_password, const char *key_password,
 +    bool has_fingerprint, const char *fingerprint,
 +    bool has_backup_id, const char *backup_id,
 +    bool has_backup_time, int64_t backup_time,
 +    bool has_use_dirty_bitmap, bool use_dirty_bitmap,
 +    bool has_compress, bool compress,
 +    bool has_encrypt, bool encrypt,
 +    bool has_format, BackupFormat format,
 +    bool has_config_file, const char *config_file,
 +    bool has_firewall_file, const char *firewall_file,
 +    bool has_devlist, const char *devlist,
 +    bool has_speed, int64_t speed, Error **errp)
 {
     assert(qemu_in_coroutine());
     qemu_co_mutex_lock(&backup_state.backup_mutex);
 -    QmpBackupTask *task = opaque;
 -
 -    task->result = NULL; // just to be sure
 -
     BlockBackend *blk;
     BlockDriverState *bs = NULL;
     const char *backup_dir = NULL;
@@ -593,17 +565,17 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
     const char *firewall_name = "qemu-server.fw";
     if (backup_state.di_list) {
 -        error_set(task->errp, ERROR_CLASS_GENERIC_ERROR,
 +        error_set(errp, ERROR_CLASS_GENERIC_ERROR,
                   "previous backup not finished");
         qemu_co_mutex_unlock(&backup_state.backup_mutex);
 -        return;
 +        return NULL;
     }
     /* Todo: try to auto-detect format based on file name */
 -    BackupFormat format = task->has_format ? task->format : BACKUP_FORMAT_VMA;
 +    format = has_format ? format : BACKUP_FORMAT_VMA;
 -    if (task->has_devlist) {
 -        devs = g_strsplit_set(task->devlist, ",;:", -1);
 +    if (has_devlist) {
 +        devs = g_strsplit_set(devlist, ",;:", -1);
         gchar **d = devs;
         while (d && *d) {
@@ -611,14 +583,14 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
             if (blk) {
                 bs = blk_bs(blk);
                 if (!bdrv_is_inserted(bs)) {
 -                    error_setg(task->errp, QERR_DEVICE_HAS_NO_MEDIUM, *d);
 +                    error_setg(errp, QERR_DEVICE_HAS_NO_MEDIUM, *d);
                     goto err;
                 }
                 PVEBackupDevInfo *di = g_new0(PVEBackupDevInfo, 1);
                 di->bs = bs;
                 di_list = g_list_append(di_list, di);
             } else {
 -                error_set(task->errp, ERROR_CLASS_DEVICE_NOT_FOUND,
 +                error_set(errp, ERROR_CLASS_DEVICE_NOT_FOUND,
                           "Device '%s' not found", *d);
                 goto err;
             }
@@ -641,7 +613,7 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
     }
     if (!di_list) {
 -        error_set(task->errp, ERROR_CLASS_GENERIC_ERROR, "empty device list");
 +        error_set(errp, ERROR_CLASS_GENERIC_ERROR, "empty device list");
         goto err;
     }
@@ -651,13 +623,13 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
     while (l) {
         PVEBackupDevInfo *di = (PVEBackupDevInfo *)l->data;
         l = g_list_next(l);
 -        if (bdrv_op_is_blocked(di->bs, BLOCK_OP_TYPE_BACKUP_SOURCE, task->errp)) {
 +        if (bdrv_op_is_blocked(di->bs, BLOCK_OP_TYPE_BACKUP_SOURCE, errp)) {
             goto err;
         }
         ssize_t size = bdrv_getlength(di->bs);
         if (size < 0) {
 -            error_setg_errno(task->errp, -di->size, "bdrv_getlength failed");
 +            error_setg_errno(errp, -di->size, "bdrv_getlength failed");
             goto err;
         }
         di->size = size;
@@ -684,47 +656,44 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
     }
     if (format == BACKUP_FORMAT_PBS) {
 -        if (!task->has_password) {
 -            error_set(task->errp, ERROR_CLASS_GENERIC_ERROR, "missing parameter 'password'");
 +        if (!has_password) {
 +            error_set(errp, ERROR_CLASS_GENERIC_ERROR, "missing parameter 'password'");
             goto err_mutex;
         }
 -        if (!task->has_backup_id) {
 -            error_set(task->errp, ERROR_CLASS_GENERIC_ERROR, "missing parameter 'backup-id'");
 +        if (!has_backup_id) {
 +            error_set(errp, ERROR_CLASS_GENERIC_ERROR, "missing parameter 'backup-id'");
             goto err_mutex;
         }
 -        if (!task->has_backup_time) {
 -            error_set(task->errp, ERROR_CLASS_GENERIC_ERROR, "missing parameter 'backup-time'");
 +        if (!has_backup_time) {
 +            error_set(errp, ERROR_CLASS_GENERIC_ERROR, "missing parameter 'backup-time'");
             goto err_mutex;
         }
         int dump_cb_block_size = PROXMOX_BACKUP_DEFAULT_CHUNK_SIZE; // Hardcoded (4M)
         firewall_name = "fw.conf";
 -        bool use_dirty_bitmap = task->has_use_dirty_bitmap && task->use_dirty_bitmap;
 -
 -
         char *pbs_err = NULL;
         pbs = proxmox_backup_new(
 -            task->backup_file,
 -            task->backup_id,
 -            task->backup_time,
 +            backup_file,
 +            backup_id,
 +            backup_time,
             dump_cb_block_size,
 -            task->has_password ? task->password : NULL,
 -            task->has_keyfile ? task->keyfile : NULL,
 -            task->has_key_password ? task->key_password : NULL,
 -            task->has_compress ? task->compress : true,
 -            task->has_encrypt ? task->encrypt : task->has_keyfile,
 -            task->has_fingerprint ? task->fingerprint : NULL,
 +            has_password ? password : NULL,
 +            has_keyfile ? keyfile : NULL,
 +            has_key_password ? key_password : NULL,
 +            has_compress ? compress : true,
 +            has_encrypt ? encrypt : has_keyfile,
 +            has_fingerprint ? fingerprint : NULL,
              &pbs_err);
         if (!pbs) {
 -            error_set(task->errp, ERROR_CLASS_GENERIC_ERROR,
 +            error_set(errp, ERROR_CLASS_GENERIC_ERROR,
                       "proxmox_backup_new failed: %s", pbs_err);
             proxmox_backup_free_error(pbs_err);
             goto err_mutex;
         }
 -        int connect_result = proxmox_backup_co_connect(pbs, task->errp);
 +        int connect_result = proxmox_backup_co_connect(pbs, errp);
         if (connect_result < 0)
             goto err_mutex;
@@ -743,9 +712,9 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
             BdrvDirtyBitmap *bitmap = bdrv_find_dirty_bitmap(di->bs, PBS_BITMAP_NAME);
             bool expect_only_dirty = false;
 -            if (use_dirty_bitmap) {
 +            if (has_use_dirty_bitmap && use_dirty_bitmap) {
                 if (bitmap == NULL) {
 -                    bitmap = bdrv_create_dirty_bitmap(di->bs, dump_cb_block_size, PBS_BITMAP_NAME, task->errp);
 +                    bitmap = bdrv_create_dirty_bitmap(di->bs, dump_cb_block_size, PBS_BITMAP_NAME, errp);
                     if (!bitmap) {
                         goto err_mutex;
                     }
@@ -775,12 +744,12 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
                 }
             }
 -            int dev_id = proxmox_backup_co_register_image(pbs, devname, di->size, expect_only_dirty, task->errp);
 +            int dev_id = proxmox_backup_co_register_image(pbs, devname, di->size, expect_only_dirty, errp);
             if (dev_id < 0) {
                 goto err_mutex;
             }
 -            if (!(di->target = bdrv_backup_dump_create(dump_cb_block_size, di->size, pvebackup_co_dump_pbs_cb, di, task->errp))) {
 +            if (!(di->target = bdrv_backup_dump_create(dump_cb_block_size, di->size, pvebackup_co_dump_pbs_cb, di, errp))) {
                 goto err_mutex;
             }
@@ -794,10 +763,10 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
             backup_state.stat.bitmap_list = g_list_append(backup_state.stat.bitmap_list, info);
         }
     } else if (format == BACKUP_FORMAT_VMA) {
 -        vmaw = vma_writer_create(task->backup_file, uuid, &local_err);
 +        vmaw = vma_writer_create(backup_file, uuid, &local_err);
         if (!vmaw) {
             if (local_err) {
 -                error_propagate(task->errp, local_err);
 +                error_propagate(errp, local_err);
             }
             goto err_mutex;
         }
@@ -808,25 +777,25 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
             PVEBackupDevInfo *di = (PVEBackupDevInfo *)l->data;
             l = g_list_next(l);
 -            if (!(di->target = bdrv_backup_dump_create(VMA_CLUSTER_SIZE, di->size, pvebackup_co_dump_vma_cb, di, task->errp))) {
 +            if (!(di->target = bdrv_backup_dump_create(VMA_CLUSTER_SIZE, di->size, pvebackup_co_dump_vma_cb, di, errp))) {
                 goto err_mutex;
             }
             const char *devname = bdrv_get_device_name(di->bs);
             di->dev_id = vma_writer_register_stream(vmaw, devname, di->size);
             if (di->dev_id <= 0) {
 -                error_set(task->errp, ERROR_CLASS_GENERIC_ERROR,
 +                error_set(errp, ERROR_CLASS_GENERIC_ERROR,
                           "register_stream failed");
                 goto err_mutex;
             }
         }
     } else if (format == BACKUP_FORMAT_DIR) {
 -        if (mkdir(task->backup_file, 0640) != 0) {
 -            error_setg_errno(task->errp, errno, "can't create directory '%s'\n",
 -                             task->backup_file);
 +        if (mkdir(backup_file, 0640) != 0) {
 +            error_setg_errno(errp, errno, "can't create directory '%s'\n",
 +                             backup_file);
             goto err_mutex;
         }
 -        backup_dir = task->backup_file;
 +        backup_dir = backup_file;
         l = di_list;
         while (l) {
@@ -840,34 +809,34 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
             bdrv_img_create(di->targetfile, "raw", NULL, NULL, NULL,
                             di->size, flags, false, &local_err);
             if (local_err) {
 -                error_propagate(task->errp, local_err);
 +                error_propagate(errp, local_err);
                 goto err_mutex;
             }
             di->target = bdrv_open(di->targetfile, NULL, NULL, flags, &local_err);
             if (!di->target) {
 -                error_propagate(task->errp, local_err);
 +                error_propagate(errp, local_err);
                 goto err_mutex;
             }
         }
     } else {
 -        error_set(task->errp, ERROR_CLASS_GENERIC_ERROR, "unknown backup format");
 +        error_set(errp, ERROR_CLASS_GENERIC_ERROR, "unknown backup format");
         goto err_mutex;
     }
     /* add configuration file to archive */
 -    if (task->has_config_file) {
 -        if (pvebackup_co_add_config(task->config_file, config_name, format, backup_dir,
 -                                    vmaw, pbs, task->errp) != 0) {
 +    if (has_config_file) {
 +        if (pvebackup_co_add_config(config_file, config_name, format, backup_dir,
 +                                    vmaw, pbs, errp) != 0) {
             goto err_mutex;
         }
     }
     /* add firewall file to archive */
 -    if (task->has_firewall_file) {
 -        if (pvebackup_co_add_config(task->firewall_file, firewall_name, format, backup_dir,
 -                                    vmaw, pbs, task->errp) != 0) {
 +    if (has_firewall_file) {
 +        if (pvebackup_co_add_config(firewall_file, firewall_name, format, backup_dir,
 +                                    vmaw, pbs, errp) != 0) {
             goto err_mutex;
         }
     }
@@ -885,7 +854,7 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
     if (backup_state.stat.backup_file) {
         g_free(backup_state.stat.backup_file);
     }
 -    backup_state.stat.backup_file = g_strdup(task->backup_file);
 +    backup_state.stat.backup_file = g_strdup(backup_file);
     uuid_copy(backup_state.stat.uuid, uuid);
     uuid_unparse_lower(uuid, backup_state.stat.uuid_str);
@@ -900,7 +869,7 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
     qemu_mutex_unlock(&backup_state.stat.lock);
 -    backup_state.speed = (task->has_speed && task->speed > 0) ? task->speed : 0;
 +    backup_state.speed = (has_speed && speed > 0) ? speed : 0;
     backup_state.vmaw = vmaw;
     backup_state.pbs = pbs;
@@ -910,8 +879,6 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
     uuid_info = g_malloc0(sizeof(*uuid_info));
     uuid_info->UUID = uuid_str;
 -    task->result = uuid_info;
 -
     /* Run create_backup_jobs_bh outside of coroutine (in BH) but keep
     * backup_mutex locked. This is fine, a CoMutex can be held across yield
     * points, and we'll release it as soon as the BH reschedules us.
@@ -925,7 +892,7 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
     qemu_coroutine_yield();
     if (local_err) {
 -        error_propagate(task->errp, local_err);
 +        error_propagate(errp, local_err);
         goto err;
     }
@@ -938,7 +905,7 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
     /* start the first job in the transaction */
     job_txn_start_seq(backup_state.txn);
 -    return;
 +    return uuid_info;
 err_mutex:
     qemu_mutex_unlock(&backup_state.stat.lock);
@@ -969,7 +936,7 @@ err:
     if (vmaw) {
         Error *err = NULL;
         vma_writer_close(vmaw, &err);
 -        unlink(task->backup_file);
 +        unlink(backup_file);
     }
     if (pbs) {
@@ -980,65 +947,8 @@ err:
         rmdir(backup_dir);
     }
 -    task->result = NULL;
 -
     qemu_co_mutex_unlock(&backup_state.backup_mutex);
 -    return;
 -}
 -
 -UuidInfo *qmp_backup(
 -    const char *backup_file,
 -    bool has_password, const char *password,
 -    bool has_keyfile, const char *keyfile,
 -    bool has_key_password, const char *key_password,
 -    bool has_fingerprint, const char *fingerprint,
 -    bool has_backup_id, const char *backup_id,
 -    bool has_backup_time, int64_t backup_time,
 -    bool has_use_dirty_bitmap, bool use_dirty_bitmap,
 -    bool has_compress, bool compress,
 -    bool has_encrypt, bool encrypt,
 -    bool has_format, BackupFormat format,
 -    bool has_config_file, const char *config_file,
 -    bool has_firewall_file, const char *firewall_file,
 -    bool has_devlist, const char *devlist,
 -    bool has_speed, int64_t speed, Error **errp)
 -{
 -    QmpBackupTask task = {
 -        .backup_file = backup_file,
 -        .has_password = has_password,
 -        .password = password,
 -        .has_keyfile = has_keyfile,
 -        .keyfile = keyfile,
 -        .has_key_password = has_key_password,
 -        .key_password = key_password,
 -        .has_fingerprint = has_fingerprint,
 -        .fingerprint = fingerprint,
 -        .has_backup_id = has_backup_id,
 -        .backup_id = backup_id,
 -        .has_backup_time = has_backup_time,
 -        .backup_time = backup_time,
 -        .has_use_dirty_bitmap = has_use_dirty_bitmap,
 -        .use_dirty_bitmap = use_dirty_bitmap,
 -        .has_compress = has_compress,
 -        .compress = compress,
 -        .has_encrypt = has_encrypt,
 -        .encrypt = encrypt,
 -        .has_format = has_format,
 -        .format = format,
 -        .has_config_file = has_config_file,
 -        .config_file = config_file,
 -        .has_firewall_file = has_firewall_file,
 -        .firewall_file = firewall_file,
 -        .has_devlist = has_devlist,
 -        .devlist = devlist,
 -        .has_speed = has_speed,
 -        .speed = speed,
 -        .errp = errp,
 -    };
 -
 -    block_on_coroutine_fn(pvebackup_co_prepare, &task);
 -
 -    return task.result;
 +    return NULL;
 }
 BackupStatus *qmp_query_backup(Error **errp)
 diff --git a/qapi/block-core.json b/qapi/block-core.json
 index bd978ea562..ca1966f54b 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
@@ -842,7 +842,7 @@
                                     '*config-file': 'str',
                                     '*firewall-file': 'str',
                                     '*devlist': 'str', '*speed': 'int' },
 -  'returns': 'UuidInfo' }
 +  'returns': 'UuidInfo', 'coroutine': true }
 ##
 # @query-backup:
@@ -864,7 +864,7 @@
 # Notes: This command succeeds even if there is no backup process running.
 #
 ##
 -{ 'command': 'backup-cancel' }
 +{ 'command': 'backup-cancel', 'coroutine': true }
 ##
 # @ProxmoxSupportStatus:
--- a/debian/patches/pve/0043-alloc-track-fix-deadlock-during-drop.patch
+++ b/debian/patches/pve/0043-alloc-track-fix-deadlock-during-drop.patch
@@ -1,153 +0,0 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Fiona Ebner <f.ebner@proxmox.com>
 Date: Thu, 6 Apr 2023 14:59:31 +0200
 Subject: [PATCH] alloc-track: fix deadlock during drop
 by replacing the block node directly after changing the backing file
 instead of rescheduling it.
 With changes in QEMU 8.0, calling bdrv_get_info (and bdrv_unref)
 during drop can lead to a deadlock when using iothread (only triggered
 with multiple disks, except during debugging where it also triggered
 with one disk sometimes):
 1. job_unref_locked acquires the AioContext and calls job->driver->free
 2. track_drop gets scheduled
 3. bdrv_graph_wrlock is called and polls which leads to track_drop being
   called
 4. track_drop acquires the AioContext recursively
 5. bdrv_get_info is a wrapped coroutine (since 8.0) and thus polls for
   bdrv_co_get_info. This releases the AioContext, but only once! The
   documentation for the AIO_WAIT_WHILE macro states that the
   AioContext lock needs to be acquired exactly once, but there does
   not seem to be a way for track_drop to know if it acquired the lock
   recursively or not (without adding further hacks).
 6. Because the AioContext is still held by the main thread once, it can't
   be acquired before entering bdrv_co_get_info in co_schedule_bh_cb
   which happens in the iothread
 When doing the operation in change_backing_file, the AioContext has
 already been acquired by the caller, so the issue with the recursive
 lock goes away.
 The comment explaining why delaying the replace is necessary is
 > we need to schedule this for later however, since when this function
 > is called, the blockjob modifying us is probably not done yet and
 > has a blocker on 'bs'
 However, there is no check for blockers in bdrv_replace_node. It would
 need to be done by us, the caller, with check_to_replace_node.
 Furthermore, the mirror job also does its call to bdrv_replace_node
 while there is an active blocker (inserted by mirror itself) and they
 use a specialized version to check for blockers instead of
 check_to_replace_node there. Alloc-track could also do something
 similar to check for other blockers, but it should be fine to rely on
 Proxmox VE that no other operation with the blockdev is going on.
 Mirror also drains the target before replacing the node, but the
 target can have other users. In case of alloc-track the file child
 should not be accessible by anybody else and so there can't be an
 in-flight operation for the file child when alloc-track is drained.
 The rescheduling based on refcounting is a hack and it doesn't seem to
 be necessary anymore. It's not clear what the original issue from the
 comment was. Testing with older builds with track_drop done directly
 without rescheduling also didn't lead to any noticable issue for me.
 One issue it might have been is the one fixed by b1e1af394d
 ("block/stream: Drain subtree around graph change"), where
 block-stream had a use-after-free if the base node changed at an
 inconvenient time (which alloc-track's auto-drop does).
 It's also not possible to just not auto-replace the alloc-track. Not
 replacing it at all leads to other operations like block resize
 hanging, and there is no good way to replace it manually via QMP
 (there is x-blockdev-change, but it is experimental and doesn't
 implement the required operation yet). Also, it's just cleaner in
 general to not leave unnecessary block nodes lying around.
 Suggested-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 block/alloc-track.c | 54 ++++++++++++++-------------------------------
 1 file changed, 16 insertions(+), 38 deletions(-)
 diff --git a/block/alloc-track.c b/block/alloc-track.c
 index b75d7c6460..76da140a68 100644
 --- a/block/alloc-track.c
 +++ b/block/alloc-track.c
@@ -25,7 +25,6 @@
 typedef enum DropState {
     DropNone,
 -    DropRequested,
     DropInProgress,
 } DropState;
@@ -268,37 +267,6 @@ static void track_child_perm(BlockDriverState *bs, BdrvChild *c,
     }
 }
 -static void track_drop(void *opaque)
 -{
 -    BlockDriverState *bs = (BlockDriverState*)opaque;
 -    BlockDriverState *file = bs->file->bs;
 -    BDRVAllocTrackState *s = bs->opaque;
 -
 -    assert(file);
 -
 -    /* we rely on the fact that we're not used anywhere else, so let's wait
 -     * until we're only used once - in the drive connected to the guest (and one
 -     * ref is held by bdrv_ref in track_change_backing_file) */
 -    if (bs->refcnt > 2) {
 -        aio_bh_schedule_oneshot(qemu_get_aio_context(), track_drop, opaque);
 -        return;
 -    }
 -    AioContext *aio_context = bdrv_get_aio_context(bs);
 -    aio_context_acquire(aio_context);
 -
 -    bdrv_drained_begin(bs);
 -
 -    /* now that we're drained, we can safely set 'DropInProgress' */
 -    s->drop_state = DropInProgress;
 -    bdrv_child_refresh_perms(bs, bs->file, &error_abort);
 -
 -    bdrv_replace_node(bs, file, &error_abort);
 -    bdrv_set_backing_hd(bs, NULL, &error_abort);
 -    bdrv_drained_end(bs);
 -    bdrv_unref(bs);
 -    aio_context_release(aio_context);
 -}
 -
 static int track_change_backing_file(BlockDriverState *bs,
                                      const char *backing_file,
                                      const char *backing_fmt)
@@ -308,13 +276,23 @@ static int track_change_backing_file(BlockDriverState *bs,
         backing_file == NULL && backing_fmt == NULL)
     {
         /* backing file has been disconnected, there's no longer any use for
 -         * this node, so let's remove ourselves from the block graph - we need
 -         * to schedule this for later however, since when this function is
 -         * called, the blockjob modifying us is probably not done yet and has a
 -         * blocker on 'bs' */
 -        s->drop_state = DropRequested;
 +         * this node, so let's remove ourselves from the block graph */
 +        BlockDriverState *file = bs->file->bs;
 +
 +        /* Just to be sure, because bdrv_replace_node unrefs it */
         bdrv_ref(bs);
 -        aio_bh_schedule_oneshot(qemu_get_aio_context(), track_drop, (void*)bs);
 +        bdrv_drained_begin(bs);
 +
 +        /* now that we're drained, we can safely set 'DropInProgress' */
 +        s->drop_state = DropInProgress;
 +
 +        bdrv_child_refresh_perms(bs, bs->file, &error_abort);
 +
 +        bdrv_replace_node(bs, file, &error_abort);
 +        bdrv_set_backing_hd(bs, NULL, &error_abort);
 +
 +        bdrv_drained_end(bs);
 +        bdrv_unref(bs);
     }
     return 0;
--- a/debian/patches/pve/0044-PBS-add-master-key-support.patch
+++ b/debian/patches/pve/0044-PBS-add-master-key-support.patch
@@ -0,0 +1,98 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Stefan Reiter <s.reiter@proxmox.com>
 Date: Wed, 10 Feb 2021 11:07:06 +0100
 Subject: [PATCH] PBS: add master key support
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 this requires a new enough libproxmox-backup-qemu0, and allows querying
 from the PVE side to avoid QMP calls with unsupported parameters.
 Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
 block/monitor/block-hmp-cmds.c | 1 +
 pve-backup.c                   | 3 +++
 qapi/block-core.json           | 7 +++++++
 3 files changed, 11 insertions(+)
 diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
 index ef45552e3b..4c799f00d9 100644
 --- a/block/monitor/block-hmp-cmds.c
 +++ b/block/monitor/block-hmp-cmds.c
@@ -1039,6 +1039,7 @@ void coroutine_fn hmp_backup(Monitor *mon, const QDict *qdict)
         false, NULL, // PBS password
         false, NULL, // PBS keyfile
         false, NULL, // PBS key_password
 +        false, NULL, // PBS master_keyfile
         false, NULL, // PBS fingerprint
         false, NULL, // PBS backup-id
         false, 0, // PBS backup-time
 diff --git a/pve-backup.c b/pve-backup.c
 index 323014744c..9f6c04a512 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
@@ -533,6 +533,7 @@ UuidInfo coroutine_fn *qmp_backup(
     bool has_password, const char *password,
     bool has_keyfile, const char *keyfile,
     bool has_key_password, const char *key_password,
 +    bool has_master_keyfile, const char *master_keyfile,
     bool has_fingerprint, const char *fingerprint,
     bool has_backup_id, const char *backup_id,
     bool has_backup_time, int64_t backup_time,
@@ -681,6 +682,7 @@ UuidInfo coroutine_fn *qmp_backup(
             has_password ? password : NULL,
             has_keyfile ? keyfile : NULL,
             has_key_password ? key_password : NULL,
 +            has_master_keyfile ? master_keyfile : NULL,
             has_compress ? compress : true,
             has_encrypt ? encrypt : has_keyfile,
             has_fingerprint ? fingerprint : NULL,
@@ -1044,5 +1046,6 @@ ProxmoxSupportStatus *qmp_query_proxmox_support(Error **errp)
     ret->pbs_dirty_bitmap_savevm = true;
     ret->pbs_dirty_bitmap_migration = true;
     ret->query_bitmap_info = true;
 +    ret->pbs_masterkey = true;
     return ret;
 }
 diff --git a/qapi/block-core.json b/qapi/block-core.json
 index ca1966f54b..fc8a125451 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
@@ -813,6 +813,8 @@
 #
 # @key-password: password for keyfile (optional for format 'pbs')
 #
 +# @master-keyfile: PEM-formatted master public keyfile (optional for format 'pbs')
 +#
 # @fingerprint: server cert fingerprint (optional for format 'pbs')
 #
 # @backup-id: backup ID (required for format 'pbs')
@@ -832,6 +834,7 @@
                                     '*password': 'str',
                                     '*keyfile': 'str',
                                     '*key-password': 'str',
 +                                    '*master-keyfile': 'str',
                                     '*fingerprint': 'str',
                                     '*backup-id': 'str',
                                     '*backup-time': 'int',
@@ -884,6 +887,9 @@
 #                              migration cap if this is false/unset may lead
 #                              to crashes on migration!
 #
 +# @pbs-masterkey: True if the QMP backup call supports the 'master_keyfile'
 +#                 parameter.
 +#
 # @pbs-library-version: Running version of libproxmox-backup-qemu0 library.
 #
 ##
@@ -892,6 +898,7 @@
             'query-bitmap-info': 'bool',
             'pbs-dirty-bitmap-savevm': 'bool',
             'pbs-dirty-bitmap-migration': 'bool',
 +            'pbs-masterkey': 'bool',
             'pbs-library-version': 'str' } }
 ##
--- a/debian/patches/pve/0044-migration-for-snapshots-hold-the-BQL-during-setup-ca.patch
+++ b/debian/patches/pve/0044-migration-for-snapshots-hold-the-BQL-during-setup-ca.patch
@@ -1,190 +0,0 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Fiona Ebner <f.ebner@proxmox.com>
 Date: Fri, 5 May 2023 13:39:53 +0200
 Subject: [PATCH] migration: for snapshots, hold the BQL during setup callbacks
 In spirit, this is a partial revert of commit 9b09503752 ("migration:
 run setup callbacks out of big lock"), but only for the snapshot case.
 For snapshots, the bdrv_writev_vmstate() function is used during setup
 (in QIOChannelBlock backing the QEMUFile), but not holding the BQL
 while calling it could lead to an assertion failure. To understand
 how, first note the following:
 1. Generated coroutine wrappers for block layer functions spawn the
 coroutine and use AIO_WAIT_WHILE()/aio_poll() to wait for it.
 2. If the host OS switches threads at an inconvenient time, it can
 happen that a bottom half scheduled for the main thread's AioContext
 is executed as part of a vCPU thread's aio_poll().
 An example leading to the assertion failure is as follows:
 main thread:
 1. A snapshot-save QMP command gets issued.
 2. snapshot_save_job_bh() is scheduled.
 vCPU thread:
 3. aio_poll() for the main thread's AioContext is called (e.g. when
 the guest writes to a pflash device, as part of blk_pwrite which is a
 generated coroutine wrapper).
 4. snapshot_save_job_bh() is executed as part of aio_poll().
 3. qemu_savevm_state() is called.
 4. qemu_mutex_unlock_iothread() is called. Now
 qemu_get_current_aio_context() returns 0x0.
 5. bdrv_writev_vmstate() is executed during the usual savevm setup.
 But this function is a generated coroutine wrapper, so it uses
 AIO_WAIT_WHILE. There, the assertion
 assert(qemu_get_current_aio_context() == qemu_get_aio_context());
 will fail.
 To fix it, ensure that the BQL is held during setup. To avoid changing
 the behavior for migration too, introduce conditionals for the setup
 callbacks that need the BQL and only take the lock if it's not already
 held.
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 include/migration/register.h   |  2 +-
 migration/block-dirty-bitmap.c | 15 ++++++++++++---
 migration/block.c              | 15 ++++++++++++---
 migration/ram.c                | 16 +++++++++++++---
 migration/savevm.c             |  2 --
 5 files changed, 38 insertions(+), 12 deletions(-)
 diff --git a/include/migration/register.h b/include/migration/register.h
 index a8dfd8fefd..fa9b0b0f10 100644
 --- a/include/migration/register.h
 +++ b/include/migration/register.h
@@ -43,9 +43,9 @@ typedef struct SaveVMHandlers {
      * by other locks.
      */
     int (*save_live_iterate)(QEMUFile *f, void *opaque);
 +    int (*save_setup)(QEMUFile *f, void *opaque);
     /* This runs outside the iothread lock!  */
 -    int (*save_setup)(QEMUFile *f, void *opaque);
     /* Note for save_live_pending:
      * must_precopy:
      * - must be migrated in precopy or in stopped state
 diff --git a/migration/block-dirty-bitmap.c b/migration/block-dirty-bitmap.c
 index 509f3df0a6..42dc4a8d61 100644
 --- a/migration/block-dirty-bitmap.c
 +++ b/migration/block-dirty-bitmap.c
@@ -1220,10 +1220,17 @@ static int dirty_bitmap_save_setup(QEMUFile *f, void *opaque)
 {
     DBMSaveState *s = &((DBMState *)opaque)->save;
     SaveBitmapState *dbms = NULL;
 +    bool release_lock = false;
 -    qemu_mutex_lock_iothread();
 +    /* For snapshots, the BQL is held during setup. */
 +    if (!qemu_mutex_iothread_locked()) {
 +        qemu_mutex_lock_iothread();
 +        release_lock = true;
 +    }
     if (init_dirty_bitmap_migration(s) < 0) {
 -        qemu_mutex_unlock_iothread();
 +        if (release_lock) {
 +            qemu_mutex_unlock_iothread();
 +        }
         return -1;
     }
@@ -1231,7 +1238,9 @@ static int dirty_bitmap_save_setup(QEMUFile *f, void *opaque)
         send_bitmap_start(f, s, dbms);
     }
     qemu_put_bitmap_flags(f, DIRTY_BITMAP_MIG_FLAG_EOS);
 -    qemu_mutex_unlock_iothread();
 +    if (release_lock) {
 +        qemu_mutex_unlock_iothread();
 +    }
     return 0;
 }
 diff --git a/migration/block.c b/migration/block.c
 index b2497bbd32..c9d55be642 100644
 --- a/migration/block.c
 +++ b/migration/block.c
@@ -716,21 +716,30 @@ static void block_migration_cleanup(void *opaque)
 static int block_save_setup(QEMUFile *f, void *opaque)
 {
     int ret;
 +    bool release_lock = false;
     trace_migration_block_save("setup", block_mig_state.submitted,
                                block_mig_state.transferred);
 -    qemu_mutex_lock_iothread();
 +    /* For snapshots, the BQL is held during setup. */
 +    if (!qemu_mutex_iothread_locked()) {
 +        qemu_mutex_lock_iothread();
 +        release_lock = true;
 +    }
     ret = init_blk_migration(f);
     if (ret < 0) {
 -        qemu_mutex_unlock_iothread();
 +        if (release_lock) {
 +            qemu_mutex_unlock_iothread();
 +        }
         return ret;
     }
     /* start track dirty blocks */
     ret = set_dirty_tracking();
 -    qemu_mutex_unlock_iothread();
 +    if (release_lock) {
 +        qemu_mutex_unlock_iothread();
 +    }
     if (ret) {
         return ret;
 diff --git a/migration/ram.c b/migration/ram.c
 index 79d881f735..0ecbbc3202 100644
 --- a/migration/ram.c
 +++ b/migration/ram.c
@@ -3117,8 +3117,16 @@ static void migration_bitmap_clear_discarded_pages(RAMState *rs)
 static void ram_init_bitmaps(RAMState *rs)
 {
 -    /* For memory_global_dirty_log_start below.  */
 -    qemu_mutex_lock_iothread();
 +    bool release_lock = false;
 +
 +    /*
 +     * For memory_global_dirty_log_start below.
 +     * For snapshots, the BQL is held during setup.
 +     */
 +    if (!qemu_mutex_iothread_locked()) {
 +        qemu_mutex_lock_iothread();
 +        release_lock = true;
 +    }
     qemu_mutex_lock_ramlist();
     WITH_RCU_READ_LOCK_GUARD() {
@@ -3130,7 +3138,9 @@ static void ram_init_bitmaps(RAMState *rs)
         }
     }
     qemu_mutex_unlock_ramlist();
 -    qemu_mutex_unlock_iothread();
 +    if (release_lock) {
 +        qemu_mutex_unlock_iothread();
 +    }
     /*
      * After an eventual first bitmap sync, fixup the initial bitmap
 diff --git a/migration/savevm.c b/migration/savevm.c
 index aa54a67fda..fc6a82a555 100644
 --- a/migration/savevm.c
 +++ b/migration/savevm.c
@@ -1621,10 +1621,8 @@ static int qemu_savevm_state(QEMUFile *f, Error **errp)
     memset(&compression_counters, 0, sizeof(compression_counters));
     ms->to_dst_file = f;
 -    qemu_mutex_unlock_iothread();
     qemu_savevm_state_header(f);
     qemu_savevm_state_setup(f);
 -    qemu_mutex_lock_iothread();
     while (qemu_file_get_error(f) == 0) {
         if (qemu_savevm_state_iterate(f, false) > 0) {
--- a/debian/patches/pve/0045-PVE-block-pbs-fast-path-reads-without-allocation-if-.patch
+++ b/debian/patches/pve/0045-PVE-block-pbs-fast-path-reads-without-allocation-if-.patch
@@ -0,0 +1,53 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Stefan Reiter <s.reiter@proxmox.com>
 Date: Wed, 9 Dec 2020 11:46:57 +0100
 Subject: [PATCH] PVE: block/pbs: fast-path reads without allocation if
 possible
 ...and switch over to g_malloc/g_free while at it to align with other
 QEMU code.
 Tracing shows the fast-path is taken almost all the time, though not
 100% so the slow one is still necessary.
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
 block/pbs.c | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)
 diff --git a/block/pbs.c b/block/pbs.c
 index 0b05ea9080..c5eb4d5bad 100644
 --- a/block/pbs.c
 +++ b/block/pbs.c
@@ -200,7 +200,16 @@ static coroutine_fn int pbs_co_preadv(BlockDriverState *bs,
     BDRVPBSState *s = bs->opaque;
     int ret;
     char *pbs_error = NULL;
 -    uint8_t *buf = malloc(bytes);
 +    uint8_t *buf;
 +    bool inline_buf = true;
 +
 +    /* for single-buffer IO vectors we can fast-path the write directly to it */
 +    if (qiov->niov == 1 && qiov->iov->iov_len >= bytes) {
 +        buf = qiov->iov->iov_base;
 +    } else {
 +        inline_buf = false;
 +        buf = g_malloc(bytes);
 +    }
     if (offset < 0 || bytes < 0) {
         fprintf(stderr, "unexpected negative 'offset' or 'bytes' value!\n");
@@ -223,8 +232,10 @@ static coroutine_fn int pbs_co_preadv(BlockDriverState *bs,
         return -EIO;
     }
 -    qemu_iovec_from_buf(qiov, 0, buf, bytes);
 -    free(buf);
 +    if (!inline_buf) {
 +        qemu_iovec_from_buf(qiov, 0, buf, bytes);
 +        g_free(buf);
 +    }
     return 0;
 }
--- a/debian/patches/pve/0045-savevm-async-don-t-hold-BQL-during-setup.patch
+++ b/debian/patches/pve/0045-savevm-async-don-t-hold-BQL-during-setup.patch
@@ -1,29 +0,0 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Fiona Ebner <f.ebner@proxmox.com>
 Date: Fri, 5 May 2023 15:30:16 +0200
 Subject: [PATCH] savevm-async: don't hold BQL during setup
 See commit "migration: for snapshots, hold the BQL during setup
 callbacks" for why. This is separate, because a version of that one
 will hopefully land upstream.
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 migration/savevm-async.c | 2 --
 1 file changed, 2 deletions(-)
 diff --git a/migration/savevm-async.c b/migration/savevm-async.c
 index b97f2c4f14..87ea0573d3 100644
 --- a/migration/savevm-async.c
 +++ b/migration/savevm-async.c
@@ -403,10 +403,8 @@ void qmp_savevm_start(const char *statefile, Error **errp)
     snap_state.state = SAVE_STATE_ACTIVE;
     snap_state.finalize_bh = qemu_bh_new(process_savevm_finalize, &snap_state);
     snap_state.co = qemu_coroutine_create(&process_savevm_co, NULL);
 -    qemu_mutex_unlock_iothread();
     qemu_savevm_state_header(snap_state.file);
     qemu_savevm_state_setup(snap_state.file);
 -    qemu_mutex_lock_iothread();
     /* Async processing from here on out happens in iohandler context, so let
      * the target bdrv have its home there.
--- a/debian/patches/pve/0046-PVE-block-stream-increase-chunk-size.patch
+++ b/debian/patches/pve/0046-PVE-block-stream-increase-chunk-size.patch
@@ -11,10 +11,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/block/stream.c b/block/stream.c
-index 7f9e1ecdbb..6a29d80398 100644
+index 694709bd25..e09bd5c4ef 100644
 --- a/block/stream.c
 +++ b/block/stream.c
-@@ -27,7 +27,7 @@ enum {
+@@ -28,7 +28,7 @@ enum {
      * large enough to process multiple clusters in a single call, so
      * that populating contiguous regions of the image is efficient.
      */
--- a/debian/patches/pve/0047-block-io-accept-NULL-qiov-in-bdrv_pad_request.patch
+++ b/debian/patches/pve/0047-block-io-accept-NULL-qiov-in-bdrv_pad_request.patch
@@ -17,10 +17,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 1 file changed, 4 insertions(+)
 diff --git a/block/io.c b/block/io.c
-index 2e267a85ab..449a44bf20 100644
+index 0a8cbefe86..531b3b7a2d 100644
 --- a/block/io.c
 +++ b/block/io.c
-@@ -1576,6 +1576,10 @@ static int bdrv_pad_request(BlockDriverState *bs,
+@@ -1734,6 +1734,10 @@ static int bdrv_pad_request(BlockDriverState *bs,
 {
     int ret;
--- a/debian/patches/pve/0048-block-add-alloc-track-driver.patch
+++ b/debian/patches/pve/0048-block-add-alloc-track-driver.patch
@@ -25,21 +25,20 @@ once the backing image is removed. It will be replaced by 'file'.
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 [FE: adapt to changed function signatures
-     make error return value consistent with QEMU
+     make error return value consistent with QEMU]
     avoid premature break during read]
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
- block/alloc-track.c | 352 ++++++++++++++++++++++++++++++++++++++++++++
+ block/alloc-track.c | 350 ++++++++++++++++++++++++++++++++++++++++++++
 block/meson.build   |   1 +
- 2 files changed, 353 insertions(+)
+ 2 files changed, 351 insertions(+)
 create mode 100644 block/alloc-track.c
 diff --git a/block/alloc-track.c b/block/alloc-track.c
 new file mode 100644
-index 0000000000..b75d7c6460
+index 0000000000..43d40d11af
 --- /dev/null
 +++ b/block/alloc-track.c
-@@ -0,0 +1,352 @@
+@@ -0,0 +1,350 @@
 +/*
 + * Node to allow backing images to be applied to any node. Assumes a blank
 + * image to begin with, only new writes are tracked as allocated, thus this
@@ -55,7 +54,6 @@ index 0000000000..b75d7c6460
 +#include "qemu/osdep.h"
 +#include "qapi/error.h"
 +#include "block/block_int.h"
 +#include "block/dirty-bitmap.h"
 +#include "qapi/qmp/qdict.h"
 +#include "qapi/qmp/qstring.h"
 +#include "qemu/cutils.h"
@@ -165,9 +163,9 @@ index 0000000000..b75d7c6460
 +    }
 +}
 +
-+static coroutine_fn int64_t track_co_getlength(BlockDriverState *bs)
+static int64_t track_getlength(BlockDriverState *bs)
 +{
-+    return bdrv_co_getlength(bs->file->bs);
+    return bdrv_getlength(bs->file->bs);
 +}
 +
 +static int coroutine_fn track_co_preadv(BlockDriverState *bs,
@@ -217,8 +215,7 @@ index 0000000000..b75d7c6460
 +            ret = bdrv_co_preadv(bs->backing, local_offset, local_bytes,
 +                                 &local_qiov, flags);
 +        } else {
-+            qemu_iovec_memset(&local_qiov, cur_offset, 0, local_bytes);
+            ret = qemu_iovec_memset(&local_qiov, cur_offset, 0, local_bytes);
 +            ret = 0;
 +        }
 +
 +        if (ret != 0) {
@@ -368,7 +365,7 @@ index 0000000000..b75d7c6460
 +
 +    .bdrv_file_open                   = track_open,
 +    .bdrv_close                       = track_close,
-+    .bdrv_co_getlength                = track_co_getlength,
+    .bdrv_getlength                   = track_getlength,
 +    .bdrv_child_perm                  = track_child_perm,
 +    .bdrv_refresh_limits              = track_refresh_limits,
 +
@@ -393,7 +390,7 @@ index 0000000000..b75d7c6460
 +
 +block_init(bdrv_alloc_track_init);
 diff --git a/block/meson.build b/block/meson.build
-index eece0d5743..8a68162cc0 100644
+index a26a69434e..74e5f49758 100644
 --- a/block/meson.build
 +++ b/block/meson.build
@@ -2,6 +2,7 @@ block_ss.add(genh)
--- a/debian/patches/pve/0049-PVE-whitelist-invalid-QAPI-names-for-backwards-compa.patch
+++ b/debian/patches/pve/0049-PVE-whitelist-invalid-QAPI-names-for-backwards-compa.patch
@@ -0,0 +1,33 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Stefan Reiter <s.reiter@proxmox.com>
 Date: Wed, 26 May 2021 15:26:30 +0200
 Subject: [PATCH] PVE: whitelist 'invalid' QAPI names for backwards compat
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
 qapi/pragma.json | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)
 diff --git a/qapi/pragma.json b/qapi/pragma.json
 index a2358e303a..9ff5c84ffd 100644
 --- a/qapi/pragma.json
 +++ b/qapi/pragma.json
@@ -15,6 +15,7 @@
         'device_add',
         'device_del',
         'expire_password',
 +        'get_link_status',
         'migrate_cancel',
         'netdev_add',
         'netdev_del',
@@ -64,6 +65,8 @@
         'SysEmuTarget',             # query-cpu-fast, query-target
         'UuidInfo',                 # query-uuid
         'VncClientInfo',            # query-vnc, query-vnc-servers, ...
 -        'X86CPURegister32'          # qom-get of x86 CPU properties
 +        'X86CPURegister32',         # qom-get of x86 CPU properties
                                     # feature-words, filtered-features
 +        'BlockdevOptionsPbs',       # for PBS backwards compat
 +        'BalloonInfo'
     ] } }
--- a/debian/patches/pve/0050-PVE-savevm-async-register-yank-before-migration_inco.patch
+++ b/debian/patches/pve/0050-PVE-savevm-async-register-yank-before-migration_inco.patch
@@ -0,0 +1,35 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Stefan Reiter <s.reiter@proxmox.com>
 Date: Wed, 26 May 2021 17:36:55 +0200
 Subject: [PATCH] PVE: savevm-async: register yank before
 migration_incoming_state_destroy
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
 migration/savevm-async.c | 5 +++++
 1 file changed, 5 insertions(+)
 diff --git a/migration/savevm-async.c b/migration/savevm-async.c
 index e65a5e3482..2ed2536816 100644
 --- a/migration/savevm-async.c
 +++ b/migration/savevm-async.c
@@ -20,6 +20,7 @@
 #include "qemu/timer.h"
 #include "qemu/main-loop.h"
 #include "qemu/rcu.h"
 +#include "qemu/yank.h"
 /* #define DEBUG_SAVEVM_STATE */
@@ -514,6 +515,10 @@ int load_snapshot_from_blockdev(const char *filename, Error **errp)
     dirty_bitmap_mig_before_vm_start();
     qemu_fclose(f);
 +
 +    /* state_destroy assumes a real migration which would have added a yank */
 +    yank_register_instance(MIGRATION_YANK_INSTANCE, &error_abort);
 +
     migration_incoming_state_destroy();
     if (ret < 0) {
         error_setg_errno(errp, -ret, "Error while loading VM state");
--- a/debian/patches/pve/0051-qemu-img-dd-add-l-option-for-loading-a-snapshot.patch
+++ b/debian/patches/pve/0051-qemu-img-dd-add-l-option-for-loading-a-snapshot.patch
@@ -1,9 +1,9 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Fabian Ebner <f.ebner@proxmox.com>
 Date: Mon, 7 Feb 2022 14:21:01 +0100
-Subject: [PATCH] qemu-img dd: add -l option for loading a snapshot
+Subject: [PATCH] qemu-img: dd: add -l option for loading a snapshot
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
+Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
 docs/tools/qemu-img.rst |  6 +++---
@@ -12,7 +12,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 3 files changed, 36 insertions(+), 7 deletions(-)
 diff --git a/docs/tools/qemu-img.rst b/docs/tools/qemu-img.rst
-index 5e713e231d..9390d5e5cf 100644
+index 699229eef6..4189ced8bc 100644
 --- a/docs/tools/qemu-img.rst
 +++ b/docs/tools/qemu-img.rst
@@ -492,10 +492,10 @@ Command description:
@@ -46,10 +46,10 @@ index b5b0bb4467..36f97e1f19 100644
 DEF("info", img_info,
 diff --git a/qemu-img.c b/qemu-img.c
-index 06d814e39c..e2c06c496d 100644
+index c6b4a5567d..041c203fc3 100644
 --- a/qemu-img.c
 +++ b/qemu-img.c
-@@ -5002,6 +5002,7 @@ static int img_dd(int argc, char **argv)
+@@ -4943,6 +4943,7 @@ static int img_dd(int argc, char **argv)
     BlockDriver *drv = NULL, *proto_drv = NULL;
     BlockBackend *blk1 = NULL, *blk2 = NULL;
     QemuOpts *opts = NULL;
@@ -57,15 +57,15 @@ index 06d814e39c..e2c06c496d 100644
     QemuOptsList *create_opts = NULL;
     Error *local_err = NULL;
     bool image_opts = false;
-@@ -5011,6 +5012,7 @@ static int img_dd(int argc, char **argv)
+@@ -4952,6 +4953,7 @@ static int img_dd(int argc, char **argv)
     int64_t size = 0, readsize = 0;
-     int64_t out_pos, in_pos;
+     int64_t block_count = 0, out_pos, in_pos;
     bool force_share = false, skip_create = false;
 +    const char *snapshot_name = NULL;
     struct DdInfo dd = {
         .flags = 0,
         .count = 0,
-@@ -5048,7 +5050,7 @@ static int img_dd(int argc, char **argv)
+@@ -4989,7 +4991,7 @@ static int img_dd(int argc, char **argv)
         { 0, 0, 0, 0 }
     };
@@ -74,7 +74,7 @@ index 06d814e39c..e2c06c496d 100644
         if (c == EOF) {
             break;
         }
-@@ -5071,6 +5073,19 @@ static int img_dd(int argc, char **argv)
+@@ -5012,6 +5014,19 @@ static int img_dd(int argc, char **argv)
         case 'n':
             skip_create = true;
             break;
@@ -94,7 +94,7 @@ index 06d814e39c..e2c06c496d 100644
         case 'U':
             force_share = true;
             break;
-@@ -5130,11 +5145,24 @@ static int img_dd(int argc, char **argv)
+@@ -5071,11 +5086,24 @@ static int img_dd(int argc, char **argv)
     if (dd.flags & C_IF) {
         blk1 = img_open(image_opts, in.filename, fmt, 0, false, false,
                         force_share);
@@ -120,7 +120,7 @@ index 06d814e39c..e2c06c496d 100644
     }
     if (dd.flags & C_OSIZE) {
-@@ -5289,6 +5317,7 @@ static int img_dd(int argc, char **argv)
+@@ -5230,6 +5258,7 @@ static int img_dd(int argc, char **argv)
 out:
     g_free(arg);
     qemu_opts_del(opts);
--- a/debian/patches/pve/0052-vma-allow-partial-restore.patch
+++ b/debian/patches/pve/0052-vma-allow-partial-restore.patch
@@ -0,0 +1,407 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Fabian Ebner <f.ebner@proxmox.com>
 Date: Thu, 21 Apr 2022 13:26:48 +0200
 Subject: [PATCH] vma: allow partial restore
 Introduce a new map line for skipping a certain drive, of the form
 skip=drive-scsi0
 Since in PVE, most archives are compressed and piped to vma for
 restore, it's not easily possible to skip reads.
 For the reader, a new skip flag for VmaRestoreState is added and the
 target is allowed to be NULL if skip is specified when registering. If
 the skip flag is set, no writes will be made as well as no check for
 duplicate clusters. Therefore, the flag is not set for verify.
 Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 Acked-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
 vma-reader.c |  64 ++++++++++++---------
 vma.c        | 157 +++++++++++++++++++++++++++++----------------------
 vma.h        |   2 +-
 3 files changed, 126 insertions(+), 97 deletions(-)
 diff --git a/vma-reader.c b/vma-reader.c
 index e65f1e8415..81a891c6b1 100644
 --- a/vma-reader.c
 +++ b/vma-reader.c
@@ -28,6 +28,7 @@ typedef struct VmaRestoreState {
     bool write_zeroes;
     unsigned long *bitmap;
     int bitmap_size;
 +    bool skip;
 }  VmaRestoreState;
 struct VmaReader {
@@ -425,13 +426,14 @@ VmaDeviceInfo *vma_reader_get_device_info(VmaReader *vmar, guint8 dev_id)
 }
 static void allocate_rstate(VmaReader *vmar,  guint8 dev_id,
 -                            BlockBackend *target, bool write_zeroes)
 +                            BlockBackend *target, bool write_zeroes, bool skip)
 {
     assert(vmar);
     assert(dev_id);
     vmar->rstate[dev_id].target = target;
     vmar->rstate[dev_id].write_zeroes = write_zeroes;
 +    vmar->rstate[dev_id].skip = skip;
     int64_t size = vmar->devinfo[dev_id].size;
@@ -446,28 +448,30 @@ static void allocate_rstate(VmaReader *vmar,  guint8 dev_id,
 }
 int vma_reader_register_bs(VmaReader *vmar, guint8 dev_id, BlockBackend *target,
 -                           bool write_zeroes, Error **errp)
 +                           bool write_zeroes, bool skip, Error **errp)
 {
     assert(vmar);
 -    assert(target != NULL);
 +    assert(target != NULL || skip);
     assert(dev_id);
 -    assert(vmar->rstate[dev_id].target == NULL);
 -
 -    int64_t size = blk_getlength(target);
 -    int64_t size_diff = size - vmar->devinfo[dev_id].size;
 -
 -    /* storage types can have different size restrictions, so it
 -     * is not always possible to create an image with exact size.
 -     * So we tolerate a size difference up to 4MB.
 -     */
 -    if ((size_diff < 0) || (size_diff > 4*1024*1024)) {
 -        error_setg(errp, "vma_reader_register_bs for stream %s failed - "
 -                   "unexpected size %zd != %zd", vmar->devinfo[dev_id].devname,
 -                   size, vmar->devinfo[dev_id].size);
 -        return -1;
 +    assert(vmar->rstate[dev_id].target == NULL && !vmar->rstate[dev_id].skip);
 +
 +    if (target != NULL) {
 +        int64_t size = blk_getlength(target);
 +        int64_t size_diff = size - vmar->devinfo[dev_id].size;
 +
 +        /* storage types can have different size restrictions, so it
 +         * is not always possible to create an image with exact size.
 +         * So we tolerate a size difference up to 4MB.
 +         */
 +        if ((size_diff < 0) || (size_diff > 4*1024*1024)) {
 +            error_setg(errp, "vma_reader_register_bs for stream %s failed - "
 +                       "unexpected size %zd != %zd", vmar->devinfo[dev_id].devname,
 +                       size, vmar->devinfo[dev_id].size);
 +            return -1;
 +        }
     }
 -    allocate_rstate(vmar, dev_id, target, write_zeroes);
 +    allocate_rstate(vmar, dev_id, target, write_zeroes, skip);
     return 0;
 }
@@ -560,19 +564,23 @@ static int restore_extent(VmaReader *vmar, unsigned char *buf,
         VmaRestoreState *rstate = &vmar->rstate[dev_id];
         BlockBackend *target = NULL;
 +        bool skip = rstate->skip;
 +
         if (dev_id != vmar->vmstate_stream) {
             target = rstate->target;
 -            if (!verify && !target) {
 +            if (!verify && !target && !skip) {
                 error_setg(errp, "got wrong dev id %d", dev_id);
                 return -1;
             }
 -            if (vma_reader_get_bitmap(rstate, cluster_num)) {
 -                error_setg(errp, "found duplicated cluster %zd for stream %s",
 -                          cluster_num, vmar->devinfo[dev_id].devname);
 -                return -1;
 +            if (!skip) {
 +                if (vma_reader_get_bitmap(rstate, cluster_num)) {
 +                    error_setg(errp, "found duplicated cluster %zd for stream %s",
 +                              cluster_num, vmar->devinfo[dev_id].devname);
 +                    return -1;
 +                }
 +                vma_reader_set_bitmap(rstate, cluster_num, 1);
             }
 -            vma_reader_set_bitmap(rstate, cluster_num, 1);
             max_sector = vmar->devinfo[dev_id].size/BDRV_SECTOR_SIZE;
         } else {
@@ -618,7 +626,7 @@ static int restore_extent(VmaReader *vmar, unsigned char *buf,
                 return -1;
             }
 -            if (!verify) {
 +            if (!verify && !skip) {
                 int nb_sectors = end_sector - sector_num;
                 if (restore_write_data(vmar, dev_id, target, vmstate_fd,
                                        buf + start, sector_num, nb_sectors,
@@ -654,7 +662,7 @@ static int restore_extent(VmaReader *vmar, unsigned char *buf,
                         return -1;
                     }
 -                    if (!verify) {
 +                    if (!verify && !skip) {
                         int nb_sectors = end_sector - sector_num;
                         if (restore_write_data(vmar, dev_id, target, vmstate_fd,
                                                buf + start, sector_num,
@@ -679,7 +687,7 @@ static int restore_extent(VmaReader *vmar, unsigned char *buf,
                             vmar->partial_zero_cluster_data += zero_size;
                         }
 -                        if (rstate->write_zeroes && !verify) {
 +                        if (rstate->write_zeroes && !verify && !skip) {
                             if (restore_write_data(vmar, dev_id, target, vmstate_fd,
                                                    zero_vma_block, sector_num,
                                                    nb_sectors, errp) < 0) {
@@ -850,7 +858,7 @@ int vma_reader_verify(VmaReader *vmar, bool verbose, Error **errp)
     for (dev_id = 1; dev_id < 255; dev_id++) {
         if (vma_reader_get_device_info(vmar, dev_id)) {
 -            allocate_rstate(vmar, dev_id, NULL, false);
 +            allocate_rstate(vmar, dev_id, NULL, false, false);
         }
     }
 diff --git a/vma.c b/vma.c
 index e8dffb43e0..e6e9ffc7fe 100644
 --- a/vma.c
 +++ b/vma.c
@@ -138,6 +138,7 @@ typedef struct RestoreMap {
     char *throttling_group;
     char *cache;
     bool write_zero;
 +    bool skip;
 } RestoreMap;
 static bool try_parse_option(char **line, const char *optname, char **out, const char *inbuf) {
@@ -245,47 +246,61 @@ static int extract_content(int argc, char **argv)
             char *bps = NULL;
             char *group = NULL;
             char *cache = NULL;
 +            char *devname = NULL;
 +            bool skip = false;
 +            uint64_t bps_value = 0;
 +            const char *path = NULL;
 +            bool write_zero = true;
 +
             if (!line || line[0] == '\0' || !strcmp(line, "done\n")) {
                 break;
             }
             int len = strlen(line);
             if (line[len - 1] == '\n') {
                 line[len - 1] = '\0';
 -                if (len == 1) {
 +                len = len - 1;
 +                if (len == 0) {
                     break;
                 }
             }
 -            while (1) {
 -                if (!try_parse_option(&line, "format", &format, inbuf) &&
 -                    !try_parse_option(&line, "throttling.bps", &bps, inbuf) &&
 -                    !try_parse_option(&line, "throttling.group", &group, inbuf) &&
 -                    !try_parse_option(&line, "cache", &cache, inbuf))
 -                {
 -                    break;
 +            if (strncmp(line, "skip", 4) == 0) {
 +                if (len < 6 || line[4] != '=') {
 +                    g_error("read map failed - option 'skip' has no value ('%s')",
 +                            inbuf);
 +                } else {
 +                    devname = line + 5;
 +                    skip = true;
 +                }
 +            } else {
 +                while (1) {
 +                    if (!try_parse_option(&line, "format", &format, inbuf) &&
 +                        !try_parse_option(&line, "throttling.bps", &bps, inbuf) &&
 +                        !try_parse_option(&line, "throttling.group", &group, inbuf) &&
 +                        !try_parse_option(&line, "cache", &cache, inbuf))
 +                    {
 +                        break;
 +                    }
                 }
 -            }
 -            uint64_t bps_value = 0;
 -            if (bps) {
 -                bps_value = verify_u64(bps);
 -                g_free(bps);
 -            }
 +                if (bps) {
 +                    bps_value = verify_u64(bps);
 +                    g_free(bps);
 +                }
 -            const char *path;
 -            bool write_zero;
 -            if (line[0] == '0' && line[1] == ':') {
 -                path = line + 2;
 -                write_zero = false;
 -            } else if (line[0] == '1' && line[1] == ':') {
 -                path = line + 2;
 -                write_zero = true;
 -            } else {
 -                g_error("read map failed - parse error ('%s')", inbuf);
 +                if (line[0] == '0' && line[1] == ':') {
 +                    path = line + 2;
 +                    write_zero = false;
 +                } else if (line[0] == '1' && line[1] == ':') {
 +                    path = line + 2;
 +                    write_zero = true;
 +                } else {
 +                    g_error("read map failed - parse error ('%s')", inbuf);
 +                }
 +
 +                path = extract_devname(path, &devname, -1);
             }
 -            char *devname = NULL;
 -            path = extract_devname(path, &devname, -1);
             if (!devname) {
                 g_error("read map failed - no dev name specified ('%s')",
                         inbuf);
@@ -299,6 +314,7 @@ static int extract_content(int argc, char **argv)
             map->throttling_group = group;
             map->cache = cache;
             map->write_zero = write_zero;
 +            map->skip = skip;
             g_hash_table_insert(devmap, map->devname, map);
@@ -328,6 +344,7 @@ static int extract_content(int argc, char **argv)
             const char *cache = NULL;
             int flags = BDRV_O_RDWR;
             bool write_zero = true;
 +            bool skip = false;
             BlockBackend *blk = NULL;
@@ -343,6 +360,7 @@ static int extract_content(int argc, char **argv)
                 throttling_group = map->throttling_group;
                 cache = map->cache;
                 write_zero = map->write_zero;
 +                skip = map->skip;
             } else {
                 devfn = g_strdup_printf("%s/tmp-disk-%s.raw",
                                         dirname, di->devname);
@@ -361,57 +379,60 @@ static int extract_content(int argc, char **argv)
                 write_zero = false;
             }
 -	    size_t devlen = strlen(devfn);
 -	    QDict *options = NULL;
 -            bool writethrough;
 -            if (format) {
 -                /* explicit format from commandline */
 -                options = qdict_new();
 -                qdict_put_str(options, "driver", format);
 -            } else if ((devlen > 4 && strcmp(devfn+devlen-4, ".raw") == 0) ||
 -	               strncmp(devfn, "/dev/", 5) == 0)
 -	    {
 -                /* This part is now deprecated for PVE as well (just as qemu
 -                 * deprecated not specifying an explicit raw format, too.
 -                 */
 -		/* explicit raw format */
 -		options = qdict_new();
 -		qdict_put_str(options, "driver", "raw");
 -	    }
 -            if (cache && bdrv_parse_cache_mode(cache, &flags, &writethrough)) {
 -                g_error("invalid cache option: %s\n", cache);
 -            }
 +            if (!skip) {
 +                size_t devlen = strlen(devfn);
 +                QDict *options = NULL;
 +                bool writethrough;
 +                if (format) {
 +                    /* explicit format from commandline */
 +                    options = qdict_new();
 +                    qdict_put_str(options, "driver", format);
 +                } else if ((devlen > 4 && strcmp(devfn+devlen-4, ".raw") == 0) ||
 +                    strncmp(devfn, "/dev/", 5) == 0)
 +                {
 +                    /* This part is now deprecated for PVE as well (just as qemu
 +                     * deprecated not specifying an explicit raw format, too.
 +                     */
 +                    /* explicit raw format */
 +                    options = qdict_new();
 +                    qdict_put_str(options, "driver", "raw");
 +                }
 -	    if (errp || !(blk = blk_new_open(devfn, NULL, options, flags, &errp))) {
 -                g_error("can't open file %s - %s", devfn,
 -                        error_get_pretty(errp));
 -            }
 +                if (cache && bdrv_parse_cache_mode(cache, &flags, &writethrough)) {
 +                    g_error("invalid cache option: %s\n", cache);
 +                }
 -            if (cache) {
 -                blk_set_enable_write_cache(blk, !writethrough);
 -            }
 +                if (errp || !(blk = blk_new_open(devfn, NULL, options, flags, &errp))) {
 +                    g_error("can't open file %s - %s", devfn,
 +                            error_get_pretty(errp));
 +                }
 -            if (throttling_group) {
 -                blk_io_limits_enable(blk, throttling_group);
 -            }
 +                if (cache) {
 +                    blk_set_enable_write_cache(blk, !writethrough);
 +                }
 -            if (throttling_bps) {
 -                if (!throttling_group) {
 -                    blk_io_limits_enable(blk, devfn);
 +                if (throttling_group) {
 +                    blk_io_limits_enable(blk, throttling_group);
                 }
 -                ThrottleConfig cfg;
 -                throttle_config_init(&cfg);
 -                cfg.buckets[THROTTLE_BPS_WRITE].avg = throttling_bps;
 -                Error *err = NULL;
 -                if (!throttle_is_valid(&cfg, &err)) {
 -                    error_report_err(err);
 -                    g_error("failed to apply throttling");
 +                if (throttling_bps) {
 +                    if (!throttling_group) {
 +                        blk_io_limits_enable(blk, devfn);
 +                    }
 +
 +                    ThrottleConfig cfg;
 +                    throttle_config_init(&cfg);
 +                    cfg.buckets[THROTTLE_BPS_WRITE].avg = throttling_bps;
 +                    Error *err = NULL;
 +                    if (!throttle_is_valid(&cfg, &err)) {
 +                        error_report_err(err);
 +                        g_error("failed to apply throttling");
 +                    }
 +                    blk_set_io_limits(blk, &cfg);
                 }
 -                blk_set_io_limits(blk, &cfg);
             }
 -            if (vma_reader_register_bs(vmar, i, blk, write_zero, &errp) < 0) {
 +            if (vma_reader_register_bs(vmar, i, blk, write_zero, skip, &errp) < 0) {
                 g_error("%s", error_get_pretty(errp));
             }
 diff --git a/vma.h b/vma.h
 index c895c97f6d..1b62859165 100644
 --- a/vma.h
 +++ b/vma.h
@@ -142,7 +142,7 @@ GList *vma_reader_get_config_data(VmaReader *vmar);
 VmaDeviceInfo *vma_reader_get_device_info(VmaReader *vmar, guint8 dev_id);
 int vma_reader_register_bs(VmaReader *vmar, guint8 dev_id,
                            BlockBackend *target, bool write_zeroes,
 -                           Error **errp);
 +                           bool skip, Error **errp);
 int vma_reader_restore(VmaReader *vmar, int vmstate_fd, bool verbose,
                        Error **errp);
 int vma_reader_verify(VmaReader *vmar, bool verbose, Error **errp);
--- a/debian/patches/pve/0053-pbs-namespace-support.patch
+++ b/debian/patches/pve/0053-pbs-namespace-support.patch
@@ -0,0 +1,233 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Wolfgang Bumiller <w.bumiller@proxmox.com>
 Date: Tue, 26 Apr 2022 16:06:28 +0200
 Subject: [PATCH] pbs: namespace support
 Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
 ---
 block/monitor/block-hmp-cmds.c |  1 +
 block/pbs.c                    | 25 +++++++++++++++++++++----
 pbs-restore.c                  | 19 ++++++++++++++++---
 pve-backup.c                   |  6 +++++-
 qapi/block-core.json           |  5 ++++-
 5 files changed, 47 insertions(+), 9 deletions(-)
 diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
 index 4c799f00d9..0502f42be6 100644
 --- a/block/monitor/block-hmp-cmds.c
 +++ b/block/monitor/block-hmp-cmds.c
@@ -1041,6 +1041,7 @@ void coroutine_fn hmp_backup(Monitor *mon, const QDict *qdict)
         false, NULL, // PBS key_password
         false, NULL, // PBS master_keyfile
         false, NULL, // PBS fingerprint
 +        false, NULL, // PBS backup-ns
         false, NULL, // PBS backup-id
         false, 0, // PBS backup-time
         false, false, // PBS use-dirty-bitmap
 diff --git a/block/pbs.c b/block/pbs.c
 index c5eb4d5bad..7471e2ef9d 100644
 --- a/block/pbs.c
 +++ b/block/pbs.c
@@ -14,6 +14,7 @@
 #include <proxmox-backup-qemu.h>
 #define PBS_OPT_REPOSITORY "repository"
 +#define PBS_OPT_NAMESPACE "namespace"
 #define PBS_OPT_SNAPSHOT "snapshot"
 #define PBS_OPT_ARCHIVE "archive"
 #define PBS_OPT_KEYFILE "keyfile"
@@ -27,6 +28,7 @@ typedef struct {
     int64_t length;
     char *repository;
 +    char *namespace;
     char *snapshot;
     char *archive;
 } BDRVPBSState;
@@ -40,6 +42,11 @@ static QemuOptsList runtime_opts = {
             .type = QEMU_OPT_STRING,
             .help = "The server address and repository to connect to.",
         },
 +        {
 +            .name = PBS_OPT_NAMESPACE,
 +            .type = QEMU_OPT_STRING,
 +            .help = "Optional: The snapshot's namespace.",
 +        },
         {
             .name = PBS_OPT_SNAPSHOT,
             .type = QEMU_OPT_STRING,
@@ -76,7 +83,7 @@ static QemuOptsList runtime_opts = {
 // filename format:
 -// pbs:repository=<repo>,snapshot=<snap>,password=<pw>,key_password=<kpw>,fingerprint=<fp>,archive=<archive>
 +// pbs:repository=<repo>,namespace=<ns>,snapshot=<snap>,password=<pw>,key_password=<kpw>,fingerprint=<fp>,archive=<archive>
 static void pbs_parse_filename(const char *filename, QDict *options,
                                      Error **errp)
 {
@@ -112,6 +119,7 @@ static int pbs_open(BlockDriverState *bs, QDict *options, int flags,
     s->archive = g_strdup(qemu_opt_get(opts, PBS_OPT_ARCHIVE));
     const char *keyfile = qemu_opt_get(opts, PBS_OPT_KEYFILE);
     const char *password = qemu_opt_get(opts, PBS_OPT_PASSWORD);
 +    const char *namespace = qemu_opt_get(opts, PBS_OPT_NAMESPACE);
     const char *fingerprint = qemu_opt_get(opts, PBS_OPT_FINGERPRINT);
     const char *key_password = qemu_opt_get(opts, PBS_OPT_ENCRYPTION_PASSWORD);
@@ -124,9 +132,12 @@ static int pbs_open(BlockDriverState *bs, QDict *options, int flags,
     if (!key_password) {
         key_password = getenv("PBS_ENCRYPTION_PASSWORD");
     }
 +    if (namespace) {
 +        s->namespace = g_strdup(namespace);
 +    }
     /* connect to PBS server in read mode */
 -    s->conn = proxmox_restore_new(s->repository, s->snapshot, password,
 +    s->conn = proxmox_restore_new_ns(s->repository, s->snapshot, s->namespace, password,
         keyfile, key_password, fingerprint, &pbs_error);
     /* invalidates qemu_opt_get char pointers from above */
@@ -171,6 +182,7 @@ static int pbs_file_open(BlockDriverState *bs, QDict *options, int flags,
 static void pbs_close(BlockDriverState *bs) {
     BDRVPBSState *s = bs->opaque;
     g_free(s->repository);
 +    g_free(s->namespace);
     g_free(s->snapshot);
     g_free(s->archive);
     proxmox_restore_disconnect(s->conn);
@@ -252,8 +264,13 @@ static coroutine_fn int pbs_co_pwritev(BlockDriverState *bs,
 static void pbs_refresh_filename(BlockDriverState *bs)
 {
     BDRVPBSState *s = bs->opaque;
 -    snprintf(bs->exact_filename, sizeof(bs->exact_filename), "%s/%s(%s)",
 -             s->repository, s->snapshot, s->archive);
 +    if (s->namespace) {
 +        snprintf(bs->exact_filename, sizeof(bs->exact_filename), "%s/%s:%s(%s)",
 +                 s->repository, s->namespace, s->snapshot, s->archive);
 +    } else {
 +        snprintf(bs->exact_filename, sizeof(bs->exact_filename), "%s/%s(%s)",
 +                 s->repository, s->snapshot, s->archive);
 +    }
 }
 static const char *const pbs_strong_runtime_opts[] = {
 diff --git a/pbs-restore.c b/pbs-restore.c
 index 2f834cf42e..f03d9bab8d 100644
 --- a/pbs-restore.c
 +++ b/pbs-restore.c
@@ -29,7 +29,7 @@
 static void help(void)
 {
     const char *help_msg =
 -        "usage: pbs-restore [--repository <repo>] snapshot archive-name target [command options]\n"
 +        "usage: pbs-restore [--repository <repo>] [--ns namespace] snapshot archive-name target [command options]\n"
         ;
     printf("%s", help_msg);
@@ -77,6 +77,7 @@ int main(int argc, char **argv)
     Error *main_loop_err = NULL;
     const char *format = "raw";
     const char *repository = NULL;
 +    const char *backup_ns = NULL;
     const char *keyfile = NULL;
     int verbose = false;
     bool skip_zero = false;
@@ -90,6 +91,7 @@ int main(int argc, char **argv)
             {"verbose", no_argument, 0, 'v'},
             {"format", required_argument, 0, 'f'},
             {"repository", required_argument, 0, 'r'},
 +            {"ns", required_argument, 0, 'n'},
             {"keyfile", required_argument, 0, 'k'},
             {0, 0, 0, 0}
         };
@@ -110,6 +112,9 @@ int main(int argc, char **argv)
             case 'r':
                 repository = g_strdup(argv[optind - 1]);
                 break;
 +            case 'n':
 +                backup_ns = g_strdup(argv[optind - 1]);
 +                break;
             case 'k':
                 keyfile = g_strdup(argv[optind - 1]);
                 break;
@@ -160,8 +165,16 @@ int main(int argc, char **argv)
         fprintf(stderr, "connecting to repository '%s'\n", repository);
     }
     char *pbs_error = NULL;
 -    ProxmoxRestoreHandle *conn = proxmox_restore_new(
 -        repository, snapshot, password, keyfile, key_password, fingerprint, &pbs_error);
 +    ProxmoxRestoreHandle *conn = proxmox_restore_new_ns(
 +        repository,
 +        snapshot,
 +        backup_ns,
 +        password,
 +        keyfile,
 +        key_password,
 +        fingerprint,
 +        &pbs_error
 +    );
     if (conn == NULL) {
         fprintf(stderr, "restore failed: %s\n", pbs_error);
         return -1;
 diff --git a/pve-backup.c b/pve-backup.c
 index 9f6c04a512..f6a5f8c785 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
@@ -10,6 +10,8 @@
 #include "qapi/qmp/qerror.h"
 #include "qemu/cutils.h"
 +#include <proxmox-backup-qemu.h>
 +
 /* PVE backup state and related function */
 /*
@@ -535,6 +537,7 @@ UuidInfo coroutine_fn *qmp_backup(
     bool has_key_password, const char *key_password,
     bool has_master_keyfile, const char *master_keyfile,
     bool has_fingerprint, const char *fingerprint,
 +    bool has_backup_ns, const char *backup_ns,
     bool has_backup_id, const char *backup_id,
     bool has_backup_time, int64_t backup_time,
     bool has_use_dirty_bitmap, bool use_dirty_bitmap,
@@ -674,8 +677,9 @@ UuidInfo coroutine_fn *qmp_backup(
         firewall_name = "fw.conf";
         char *pbs_err = NULL;
 -        pbs = proxmox_backup_new(
 +        pbs = proxmox_backup_new_ns(
             backup_file,
 +            has_backup_ns ? backup_ns : NULL,
             backup_id,
             backup_time,
             dump_cb_block_size,
 diff --git a/qapi/block-core.json b/qapi/block-core.json
 index fc8a125451..cc2ead0b75 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
@@ -817,6 +817,8 @@
 #
 # @fingerprint: server cert fingerprint (optional for format 'pbs')
 #
 +# @backup-ns: backup namespace (required for format 'pbs')
 +#
 # @backup-id: backup ID (required for format 'pbs')
 #
 # @backup-time: backup timestamp (Unix epoch, required for format 'pbs')
@@ -836,6 +838,7 @@
                                     '*key-password': 'str',
                                     '*master-keyfile': 'str',
                                     '*fingerprint': 'str',
 +                                    '*backup-ns': 'str',
                                     '*backup-id': 'str',
                                     '*backup-time': 'int',
                                     '*use-dirty-bitmap': 'bool',
@@ -3282,7 +3285,7 @@
 { 'struct': 'BlockdevOptionsPbs',
   'data': { 'repository': 'str', 'snapshot': 'str', 'archive': 'str',
             '*keyfile': 'str', '*password': 'str', '*fingerprint': 'str',
 -            '*key_password': 'str' } }
 +            '*key_password': 'str', '*namespace': 'str' } }
 ##
 # @BlockdevOptionsNVMe:
--- a/debian/patches/pve/0054-Revert-block-rbd-workaround-for-ceph-issue-53784.patch
+++ b/debian/patches/pve/0054-Revert-block-rbd-workaround-for-ceph-issue-53784.patch
@@ -12,10 +12,10 @@ Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 1 file changed, 2 insertions(+), 40 deletions(-)
 diff --git a/block/rbd.c b/block/rbd.c
-index a4749f3b1b..53e0396b51 100644
+index 64a8d7d48b..9fc6dcb957 100644
 --- a/block/rbd.c
 +++ b/block/rbd.c
-@@ -1511,7 +1511,6 @@ static int coroutine_fn qemu_rbd_co_block_status(BlockDriverState *bs,
+@@ -1348,7 +1348,6 @@ static int coroutine_fn qemu_rbd_co_block_status(BlockDriverState *bs,
     int status, r;
     RBDDiffIterateReq req = { .offs = offset };
     uint64_t features, flags;
@@ -23,7 +23,7 @@ index a4749f3b1b..53e0396b51 100644
     assert(offset + bytes <= s->image_size);
-@@ -1539,43 +1538,7 @@ static int coroutine_fn qemu_rbd_co_block_status(BlockDriverState *bs,
+@@ -1376,43 +1375,7 @@ static int coroutine_fn qemu_rbd_co_block_status(BlockDriverState *bs,
         return status;
     }
@@ -68,7 +68,7 @@ index a4749f3b1b..53e0396b51 100644
                           qemu_rbd_diff_iterate_cb, &req);
     if (r < 0 && r != QEMU_RBD_EXIT_DIFF_ITERATE2) {
         return status;
-@@ -1594,8 +1557,7 @@ static int coroutine_fn qemu_rbd_co_block_status(BlockDriverState *bs,
+@@ -1431,8 +1394,7 @@ static int coroutine_fn qemu_rbd_co_block_status(BlockDriverState *bs,
         status = BDRV_BLOCK_ZERO | BDRV_BLOCK_OFFSET_VALID;
     }
--- a/debian/patches/pve/0055-Revert-block-rbd-fix-handling-of-holes-in-.bdrv_co_b.patch
+++ b/debian/patches/pve/0055-Revert-block-rbd-fix-handling-of-holes-in-.bdrv_co_b.patch
@@ -13,10 +13,10 @@ Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 1 file changed, 5 insertions(+), 5 deletions(-)
 diff --git a/block/rbd.c b/block/rbd.c
-index 53e0396b51..0913a0af39 100644
+index 9fc6dcb957..98f4ba2620 100644
 --- a/block/rbd.c
 +++ b/block/rbd.c
-@@ -1470,11 +1470,11 @@ static int qemu_rbd_diff_iterate_cb(uint64_t offs, size_t len,
+@@ -1307,11 +1307,11 @@ static int qemu_rbd_diff_iterate_cb(uint64_t offs, size_t len,
     RBDDiffIterateReq *req = opaque;
     assert(req->offs + req->bytes <= offs);
--- a/debian/patches/pve/0056-Revert-block-rbd-implement-bdrv_co_block_status.patch
+++ b/debian/patches/pve/0056-Revert-block-rbd-implement-bdrv_co_block_status.patch
@@ -23,10 +23,10 @@ Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 1 file changed, 112 deletions(-)
 diff --git a/block/rbd.c b/block/rbd.c
-index 0913a0af39..1dab254517 100644
+index 98f4ba2620..efcbbe5949 100644
 --- a/block/rbd.c
 +++ b/block/rbd.c
-@@ -108,12 +108,6 @@ typedef struct RBDTask {
+@@ -97,12 +97,6 @@ typedef struct RBDTask {
     int64_t ret;
 } RBDTask;
@@ -39,7 +39,7 @@ index 0913a0af39..1dab254517 100644
 static int qemu_rbd_connect(rados_t *cluster, rados_ioctx_t *io_ctx,
                             BlockdevOptionsRbd *opts, bool cache,
                             const char *keypairs, const char *secretid,
-@@ -1456,111 +1450,6 @@ static ImageInfoSpecific *qemu_rbd_get_specific_info(BlockDriverState *bs,
+@@ -1293,111 +1287,6 @@ static ImageInfoSpecific *qemu_rbd_get_specific_info(BlockDriverState *bs,
     return spec_info;
 }
@@ -148,10 +148,10 @@ index 0913a0af39..1dab254517 100644
 -    return status;
 -}
 -
- static int64_t coroutine_fn qemu_rbd_co_getlength(BlockDriverState *bs)
+ static int64_t qemu_rbd_getlength(BlockDriverState *bs)
 {
     BDRVRBDState *s = bs->opaque;
-@@ -1796,7 +1685,6 @@ static BlockDriver bdrv_rbd = {
+@@ -1633,7 +1522,6 @@ static BlockDriver bdrv_rbd = {
 #ifdef LIBRBD_SUPPORTS_WRITE_ZEROES
     .bdrv_co_pwrite_zeroes  = qemu_rbd_co_pwrite_zeroes,
 #endif
--- a/debian/patches/pve/0057-PVE-Backup-create-jobs-correctly-cancel-in-error-sce.patch
+++ b/debian/patches/pve/0057-PVE-Backup-create-jobs-correctly-cancel-in-error-sce.patch
@@ -0,0 +1,59 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Fabian Ebner <f.ebner@proxmox.com>
 Date: Wed, 25 May 2022 13:59:37 +0200
 Subject: [PATCH] PVE-Backup: create jobs: correctly cancel in error scenario
 The first call to job_cancel_sync() will cancel and free all jobs in
 the transaction, so ensure that it's called only once and get rid of
 the job_unref() that would operate on freed memory.
 It's also necessary to NULL backup_state.pbs in the error scenario,
 because a subsequent backup_cancel QMP call (as happens in PVE when
 the backup QMP command fails) would try to call proxmox_backup_abort()
 and run into a segfault.
 Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
 ---
 pve-backup.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)
 diff --git a/pve-backup.c b/pve-backup.c
 index f6a5f8c785..5bed6f4014 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
@@ -506,6 +506,11 @@ static void create_backup_jobs_bh(void *opaque) {
     }
     if (*errp) {
 +        /*
 +         * It's enough to cancel one job in the transaction, the rest will
 +         * follow automatically.
 +         */
 +        bool canceled = false;
         l = backup_state.di_list;
         while (l) {
             PVEBackupDevInfo *di = (PVEBackupDevInfo *)l->data;
@@ -516,12 +521,12 @@ static void create_backup_jobs_bh(void *opaque) {
                 di->target = NULL;
             }
 -            if (di->job) {
 +            if (!canceled && di->job) {
                 AioContext *ctx = di->job->job.aio_context;
                 aio_context_acquire(ctx);
                 job_cancel_sync(&di->job->job, true);
 -                job_unref(&di->job->job);
                 aio_context_release(ctx);
 +                canceled = true;
             }
         }
     }
@@ -947,6 +952,7 @@ err:
     if (pbs) {
         proxmox_backup_disconnect(pbs);
 +        backup_state.pbs = NULL;
     }
     if (backup_dir) {
--- a/debian/patches/pve/0058-PVE-Backup-ensure-jobs-in-di_list-are-referenced.patch
+++ b/debian/patches/pve/0058-PVE-Backup-ensure-jobs-in-di_list-are-referenced.patch
@@ -0,0 +1,76 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Fabian Ebner <f.ebner@proxmox.com>
 Date: Wed, 25 May 2022 13:59:38 +0200
 Subject: [PATCH] PVE-Backup: ensure jobs in di_list are referenced
 Ensures that qmp_backup_cancel doesn't pick a job that's already been
 freed. With unlucky timings it seems possible that:
 1. job_exit -> job_completed -> job_finalize_single starts
 2. pvebackup_co_complete_stream gets spawned in completion callback
 3. job finalize_single finishes -> job's refcount hits zero -> job is
   freed
 4. qmp_backup_cancel comes in and locks backup_state.backup_mutex
   before pvebackup_co_complete_stream can remove the job from the
   di_list
 5. qmp_backup_cancel will pick a job that's already been freed
 Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
 ---
 pve-backup.c | 25 ++++++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)
 diff --git a/pve-backup.c b/pve-backup.c
 index 5bed6f4014..0c34428713 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
@@ -316,6 +316,14 @@ static void coroutine_fn pvebackup_co_complete_stream(void *opaque)
         }
     }
 +    if (di->job) {
 +        AioContext *ctx = di->job->job.aio_context;
 +        aio_context_acquire(ctx);
 +        job_unref(&di->job->job);
 +        di->job = NULL;
 +        aio_context_release(ctx);
 +    }
 +
     // remove self from job list
     backup_state.di_list = g_list_remove(backup_state.di_list, di);
@@ -491,9 +499,12 @@ static void create_backup_jobs_bh(void *opaque) {
             bitmap_mode, false, NULL, &perf, BLOCKDEV_ON_ERROR_REPORT, BLOCKDEV_ON_ERROR_REPORT,
             JOB_DEFAULT, pvebackup_complete_cb, di, backup_state.txn, &local_err);
 -        aio_context_release(aio_context);
 -
         di->job = job;
 +        if (job) {
 +            job_ref(&job->job);
 +        }
 +
 +        aio_context_release(aio_context);
         if (!job || local_err) {
             error_setg(errp, "backup_job_create failed: %s",
@@ -521,12 +532,16 @@ static void create_backup_jobs_bh(void *opaque) {
                 di->target = NULL;
             }
 -            if (!canceled && di->job) {
 +            if (di->job) {
                 AioContext *ctx = di->job->job.aio_context;
                 aio_context_acquire(ctx);
 -                job_cancel_sync(&di->job->job, true);
 +                if (!canceled) {
 +                    job_cancel_sync(&di->job->job, true);
 +                    canceled = true;
 +                }
 +                job_unref(&di->job->job);
 +                di->job = NULL;
                 aio_context_release(ctx);
 -                canceled = true;
             }
         }
     }
--- a/debian/patches/pve/0059-PVE-Backup-avoid-segfault-issues-upon-backup-cancel.patch
+++ b/debian/patches/pve/0059-PVE-Backup-avoid-segfault-issues-upon-backup-cancel.patch
@@ -0,0 +1,120 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Fabian Ebner <f.ebner@proxmox.com>
 Date: Wed, 25 May 2022 13:59:39 +0200
 Subject: [PATCH] PVE-Backup: avoid segfault issues upon backup-cancel
 When canceling a backup in PVE via a signal it's easy to run into a
 situation where the job is already failing when the backup_cancel QMP
 command comes in. With a bit of unlucky timing on top, it can happen
 that job_exit() runs between schedulung of job_cancel_bh() and
 execution of job_cancel_bh(). But job_cancel_sync() does not expect
 that the job is already finalized (in fact, the job might've been
 freed already, but even if it isn't, job_cancel_sync() would try to
 deref job->txn which would be NULL at that point).
 It is not possible to simply use the job_cancel() (which is advertised
 as being async but isn't in all cases) in qmp_backup_cancel() for the
 same reason job_cancel_sync() cannot be used. Namely, because it can
 invoke job_finish_sync() (which uses AIO_WAIT_WHILE and thus hangs if
 called from a coroutine). This happens when there's multiple jobs in
 the transaction and job->deferred_to_main_loop is true (is set before
 scheduling job_exit()) or if the job was not started yet.
 Fix the issue by selecting the job to cancel in job_cancel_bh() itself
 using the first job that's not completed yet. This is not necessarily
 the first job in the list, because pvebackup_co_complete_stream()
 might not yet have removed a completed job when job_cancel_bh() runs.
 An alternative would be to continue using only the first job and
 checking against JOB_STATUS_CONCLUDED or JOB_STATUS_NULL to decide if
 it's still necessary and possible to cancel, but the approach with
 using the first non-completed job seemed more robust.
 Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
 ---
 pve-backup.c | 61 +++++++++++++++++++++++++++++++++-------------------
 1 file changed, 39 insertions(+), 22 deletions(-)
 diff --git a/pve-backup.c b/pve-backup.c
 index 0c34428713..2e22030eec 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
@@ -355,15 +355,42 @@ static void pvebackup_complete_cb(void *opaque, int ret)
 /*
  * job_cancel(_sync) does not like to be called from coroutines, so defer to
 - * main loop processing via a bottom half.
 + * main loop processing via a bottom half. Assumes that caller holds
 + * backup_mutex.
  */
 static void job_cancel_bh(void *opaque) {
     CoCtxData *data = (CoCtxData*)opaque;
 -    Job *job = (Job*)data->data;
 -    AioContext *job_ctx = job->aio_context;
 -    aio_context_acquire(job_ctx);
 -    job_cancel_sync(job, true);
 -    aio_context_release(job_ctx);
 +
 +    /*
 +     * Be careful to pick a valid job to cancel:
 +     * 1. job_cancel_sync() does not expect the job to be finalized already.
 +     * 2. job_exit() might run between scheduling and running job_cancel_bh()
 +     *    and pvebackup_co_complete_stream() might not have removed the job from
 +     *    the list yet (in fact, cannot, because it waits for the backup_mutex).
 +     * Requiring !job_is_completed() ensures that no finalized job is picked.
 +     */
 +    GList *bdi = g_list_first(backup_state.di_list);
 +    while (bdi) {
 +        if (bdi->data) {
 +            BlockJob *bj = ((PVEBackupDevInfo *)bdi->data)->job;
 +            if (bj) {
 +                Job *job = &bj->job;
 +                if (!job_is_completed(job)) {
 +                    AioContext *job_ctx = job->aio_context;
 +                    aio_context_acquire(job_ctx);
 +                    job_cancel_sync(job, true);
 +                    aio_context_release(job_ctx);
 +                    /*
 +                     * It's enough to cancel one job in the transaction, the
 +                     * rest will follow automatically.
 +                     */
 +                    break;
 +                }
 +            }
 +        }
 +        bdi = g_list_next(bdi);
 +    }
 +
     aio_co_enter(data->ctx, data->co);
 }
@@ -384,22 +411,12 @@ void coroutine_fn qmp_backup_cancel(Error **errp)
         proxmox_backup_abort(backup_state.pbs, "backup canceled");
     }
 -    /* it's enough to cancel one job in the transaction, the rest will follow
 -     * automatically */
 -    GList *bdi = g_list_first(backup_state.di_list);
 -    BlockJob *cancel_job = bdi && bdi->data ?
 -        ((PVEBackupDevInfo *)bdi->data)->job :
 -        NULL;
 -
 -    if (cancel_job) {
 -        CoCtxData data = {
 -            .ctx = qemu_get_current_aio_context(),
 -            .co = qemu_coroutine_self(),
 -            .data = &cancel_job->job,
 -        };
 -        aio_bh_schedule_oneshot(data.ctx, job_cancel_bh, &data);
 -        qemu_coroutine_yield();
 -    }
 +    CoCtxData data = {
 +        .ctx = qemu_get_current_aio_context(),
 +        .co = qemu_coroutine_self(),
 +    };
 +    aio_bh_schedule_oneshot(data.ctx, job_cancel_bh, &data);
 +    qemu_coroutine_yield();
     qemu_co_mutex_unlock(&backup_state.backup_mutex);
 }
--- a/debian/patches/pve/0060-vma-create-support-64KiB-unaligned-input-images.patch
+++ b/debian/patches/pve/0060-vma-create-support-64KiB-unaligned-input-images.patch
@@ -0,0 +1,57 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Fabian Ebner <f.ebner@proxmox.com>
 Date: Wed, 22 Jun 2022 10:45:11 +0200
 Subject: [PATCH] vma: create: support 64KiB-unaligned input images
 which fixes backing up templates with such disks in PVE, for example
 efitype=4m EFI disks on a file-based storage (size = 540672).
 If there is not enough left to read, blk_co_preadv will return -EIO,
 so limit the size in the last iteration.
 For writing, an unaligned end is already handled correctly.
 The call to memset is not strictly necessary, because writing also
 checks that it doesn't write data beyond the end of the image. But
 there are two reasons to do it:
 1. It's cleaner that way.
 2. It allows detecting when the final piece is all zeroes, which might
   not happen if the buffer still contains data from the previous
   iteration.
 Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 ---
 vma.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)
 diff --git a/vma.c b/vma.c
 index e6e9ffc7fe..304f02bc84 100644
 --- a/vma.c
 +++ b/vma.c
@@ -548,7 +548,7 @@ static void coroutine_fn backup_run(void *opaque)
     struct iovec iov;
     QEMUIOVector qiov;
 -    int64_t start, end;
 +    int64_t start, end, readlen;
     int ret = 0;
     unsigned char *buf = blk_blockalign(job->target, VMA_CLUSTER_SIZE);
@@ -562,8 +562,16 @@ static void coroutine_fn backup_run(void *opaque)
         iov.iov_len = VMA_CLUSTER_SIZE;
         qemu_iovec_init_external(&qiov, &iov, 1);
 +        if (start + 1 == end) {
 +            memset(buf, 0, VMA_CLUSTER_SIZE);
 +            readlen = job->len - start * VMA_CLUSTER_SIZE;
 +            assert(readlen > 0 && readlen <= VMA_CLUSTER_SIZE);
 +        } else {
 +            readlen = VMA_CLUSTER_SIZE;
 +        }
 +
         ret = blk_co_preadv(job->target, start * VMA_CLUSTER_SIZE,
 -                            VMA_CLUSTER_SIZE, &qiov, 0);
 +                            readlen, &qiov, 0);
         if (ret < 0) {
             vma_writer_set_error(job->vmaw, "read error", -1);
             goto out;
--- a/debian/patches/pve/0061-vma-create-avoid-triggering-assertion-in-error-case.patch
+++ b/debian/patches/pve/0061-vma-create-avoid-triggering-assertion-in-error-case.patch
@@ -0,0 +1,25 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Fabian Ebner <f.ebner@proxmox.com>
 Date: Wed, 22 Jun 2022 10:45:12 +0200
 Subject: [PATCH] vma: create: avoid triggering assertion in error case
 error_setg expects its argument to not be initialized yet.
 Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 ---
 vma-writer.c | 2 ++
 1 file changed, 2 insertions(+)
 diff --git a/vma-writer.c b/vma-writer.c
 index df4b20793d..ac7da237d0 100644
 --- a/vma-writer.c
 +++ b/vma-writer.c
@@ -311,6 +311,8 @@ VmaWriter *vma_writer_create(const char *filename, uuid_t uuid, Error **errp)
         }
         if (vmaw->fd < 0) {
 +            error_free(*errp);
 +            *errp = NULL;
             error_setg(errp, "can't open file %s - %s\n", filename,
                        g_strerror(errno));
             goto err;
--- a/debian/patches/pve/0062-block-alloc-track-avoid-premature-break.patch
+++ b/debian/patches/pve/0062-block-alloc-track-avoid-premature-break.patch
@@ -0,0 +1,36 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Fabian Ebner <f.ebner@proxmox.com>
 Date: Wed, 22 Jun 2022 10:45:13 +0200
 Subject: [PATCH] block: alloc-track: avoid premature break
 While the bdrv_co_preadv() calls are expected to return 0 on success,
 qemu_iovec_memset() will return the number of bytes set (will be
 local_bytes, because the slice with that size was just initialized).
 Don't break out of the loop after the branch with qemu_iovec_memset(),
 because there might still be work to do. Additionally, ret is an int,
 which on 64-bit platforms is too small to hold the size_t returned by
 qemu_iovec_memset().
 The branch seems to be difficult to reach in practice, because the
 whole point of alloc-track is to be used with a backing device.
 Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 ---
 block/alloc-track.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
 diff --git a/block/alloc-track.c b/block/alloc-track.c
 index 6b50fbe537..c1160af04b 100644
 --- a/block/alloc-track.c
 +++ b/block/alloc-track.c
@@ -174,7 +174,8 @@ static int coroutine_fn track_co_preadv(BlockDriverState *bs,
             ret = bdrv_co_preadv(bs->backing, local_offset, local_bytes,
                                  &local_qiov, flags);
         } else {
 -            ret = qemu_iovec_memset(&local_qiov, cur_offset, 0, local_bytes);
 +            qemu_iovec_memset(&local_qiov, cur_offset, 0, local_bytes);
 +            ret = 0;
         }
         if (ret != 0) {
--- a/debian/patches/pve/0063-PVE-Backup-allow-passing-max-workers-performance-set.patch
+++ b/debian/patches/pve/0063-PVE-Backup-allow-passing-max-workers-performance-set.patch
@@ -0,0 +1,144 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Fiona Ebner <f.ebner@proxmox.com>
 Date: Mon, 3 Oct 2022 15:52:04 +0200
 Subject: [PATCH] PVE Backup: allow passing max-workers performance setting
 For query-proxmox-support, add an indication that it's possible to use
 the setting.
 For now, the other two BackupPerf settings are not exposed:
 * use-copy-range: would need to be implemented by the backup-dump
 block driver first, and in fact, the default for backup was changed,
 because it wasn't as fast for backup in QEMU, see commit
 6a30f663d4c0b3c45a544d541e0c4e214b2473a1.
 * max-chunk: enforced to be at least the backup cluster size, which is
 4 MiB for PBS and otherwise maximum of source and target cluster size.
 And block-copy has a maximum buffer size of 1 MiB, so setting a larger
 max-chunk doesn't even have an effect. To make the setting sensibly
 usable the check would need to be removed and optionally the
 block-copy max buffer size would need to be bumped. I tried doing just
 that, and tested different source/target combinations with different
 max-chunk settings, but there were no noticable improvements over the
 default "unlimited" (resulting in 1 MiB for block-copy).
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 block/monitor/block-hmp-cmds.c |  4 +++-
 pve-backup.c                   | 18 +++++++++++++-----
 qapi/block-core.json           |  9 +++++++--
 3 files changed, 23 insertions(+), 8 deletions(-)
 diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
 index 0502f42be6..cc231ec3f2 100644
 --- a/block/monitor/block-hmp-cmds.c
 +++ b/block/monitor/block-hmp-cmds.c
@@ -1049,7 +1049,9 @@ void coroutine_fn hmp_backup(Monitor *mon, const QDict *qdict)
         false, false, // PBS encrypt
         true, dir ? BACKUP_FORMAT_DIR : BACKUP_FORMAT_VMA,
         false, NULL, false, NULL, !!devlist,
 -        devlist, qdict_haskey(qdict, "speed"), speed, &error);
 +        devlist, qdict_haskey(qdict, "speed"), speed,
 +        false, 0, // BackupPerf max-workers
 +        &error);
     hmp_handle_error(mon, error);
 }
 diff --git a/pve-backup.c b/pve-backup.c
 index 2e22030eec..e9aa7e0f49 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
@@ -55,6 +55,7 @@ static struct PVEBackupState {
         bool starting;
     } stat;
     int64_t speed;
 +    BackupPerf perf;
     VmaWriter *vmaw;
     ProxmoxBackupHandle *pbs;
     GList *di_list;
@@ -492,8 +493,6 @@ static void create_backup_jobs_bh(void *opaque) {
     }
     backup_state.txn = job_txn_new_seq();
 -    BackupPerf perf = { .max_workers = 16 };
 -
     /* create and start all jobs (paused state) */
     GList *l =  backup_state.di_list;
     while (l) {
@@ -513,8 +512,9 @@ static void create_backup_jobs_bh(void *opaque) {
         BlockJob *job = backup_job_create(
             NULL, di->bs, di->target, backup_state.speed, sync_mode, di->bitmap,
 -            bitmap_mode, false, NULL, &perf, BLOCKDEV_ON_ERROR_REPORT, BLOCKDEV_ON_ERROR_REPORT,
 -            JOB_DEFAULT, pvebackup_complete_cb, di, backup_state.txn, &local_err);
 +            bitmap_mode, false, NULL, &backup_state.perf, BLOCKDEV_ON_ERROR_REPORT,
 +            BLOCKDEV_ON_ERROR_REPORT, JOB_DEFAULT, pvebackup_complete_cb, di, backup_state.txn,
 +            &local_err);
         di->job = job;
         if (job) {
@@ -584,7 +584,9 @@ UuidInfo coroutine_fn *qmp_backup(
     bool has_config_file, const char *config_file,
     bool has_firewall_file, const char *firewall_file,
     bool has_devlist, const char *devlist,
 -    bool has_speed, int64_t speed, Error **errp)
 +    bool has_speed, int64_t speed,
 +    bool has_max_workers, int64_t max_workers,
 +    Error **errp)
 {
     assert(qemu_in_coroutine());
@@ -914,6 +916,11 @@ UuidInfo coroutine_fn *qmp_backup(
     backup_state.speed = (has_speed && speed > 0) ? speed : 0;
 +    backup_state.perf = (BackupPerf){ .max_workers = 16 };
 +    if (has_max_workers) {
 +        backup_state.perf.max_workers = max_workers;
 +    }
 +
     backup_state.vmaw = vmaw;
     backup_state.pbs = pbs;
@@ -1089,5 +1096,6 @@ ProxmoxSupportStatus *qmp_query_proxmox_support(Error **errp)
     ret->pbs_dirty_bitmap_migration = true;
     ret->query_bitmap_info = true;
     ret->pbs_masterkey = true;
 +    ret->backup_max_workers = true;
     return ret;
 }
 diff --git a/qapi/block-core.json b/qapi/block-core.json
 index cc2ead0b75..e3f62faa81 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
@@ -829,6 +829,8 @@
 #
 # @encrypt: use encryption ((optional for format 'pbs', defaults to true if there is a keyfile)
 #
 +# @max-workers: see @BackupPerf for details. Default 16.
 +#
 # Returns: the uuid of the backup job
 #
 ##
@@ -847,7 +849,9 @@
                                     '*format': 'BackupFormat',
                                     '*config-file': 'str',
                                     '*firewall-file': 'str',
 -                                    '*devlist': 'str', '*speed': 'int' },
 +                                    '*devlist': 'str',
 +                                    '*speed': 'int',
 +                                    '*max-workers': 'int' },
   'returns': 'UuidInfo', 'coroutine': true }
 ##
@@ -902,7 +906,8 @@
             'pbs-dirty-bitmap-savevm': 'bool',
             'pbs-dirty-bitmap-migration': 'bool',
             'pbs-masterkey': 'bool',
 -            'pbs-library-version': 'str' } }
 +            'pbs-library-version': 'str',
 +            'backup-max-workers': 'bool' } }
 ##
 # @query-proxmox-support:
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,15 +1,9 @@
 extra/0001-monitor-qmp-fix-race-with-clients-disconnecting-earl.patch
-extra/0002-scsi-megasas-Internal-cdbs-have-16-byte-length.patch
+extra/0002-block-io_uring-revert-Use-io_uring_register_ring_fd-.patch
-extra/0003-ide-avoid-potential-deadlock-when-draining-during-tr.patch
+extra/0003-virtiofsd-use-g_date_time_get_microsecond-to-get-sub.patch
-extra/0004-ui-return-NULL-when-getting-cursor-without-a-console.patch
+extra/0004-chardev-fix-segfault-in-finalize.patch
-extra/0005-memory-prevent-dma-reentracy-issues.patch
+extra/0005-init-daemonize-defuse-PID-file-resolve-error.patch
-extra/0006-lsi53c895a-disable-reentrancy-detection-for-script-R.patch
+extra/0006-block-block-backend-blk_set_enable_write_cache-is-IO.patch
 extra/0007-bcm2835_property-disable-reentrancy-detection-for-io.patch
 extra/0008-raven-disable-reentrancy-detection-for-iomem.patch
 extra/0009-apic-disable-reentrancy-detection-for-apic-msi.patch
 extra/0010-migration-block-dirty-bitmap-fix-loading-bitmap-when.patch
 extra/0011-vhost-fix-the-fd-leak.patch
 extra/0012-hw-ide-reset-cancel-async-DMA-operation-before-reset.patch
 bitmap-mirror/0001-drive-mirror-add-support-for-sync-bitmap-mode-never.patch
 bitmap-mirror/0002-drive-mirror-add-support-for-conditional-and-always-.patch
 bitmap-mirror/0003-mirror-add-check-for-bitmap-mode-without-bitmap.patch
@@ -22,12 +16,12 @@ pve/0003-PVE-Config-set-the-CPU-model-to-kvm64-32-instead-of-.patch
 pve/0004-PVE-Config-ui-spice-default-to-pve-certificates.patch
 pve/0005-PVE-Config-glusterfs-no-default-logfile-if-daemonize.patch
 pve/0006-PVE-Config-rbd-block-rbd-disable-rbd_cache_writethro.patch
-pve/0007-PVE-Up-glusterfs-allow-partial-reads.patch
+pve/0007-PVE-Up-qmp-add-get_link_status.patch
-pve/0008-PVE-Up-qemu-img-return-success-on-info-without-snaps.patch
+pve/0008-PVE-Up-glusterfs-allow-partial-reads.patch
-pve/0009-PVE-Up-qemu-img-dd-add-osize-and-read-from-to-stdin-.patch
+pve/0009-PVE-Up-qemu-img-return-success-on-info-without-snaps.patch
-pve/0010-PVE-Up-qemu-img-dd-add-isize-parameter.patch
+pve/0010-PVE-Up-qemu-img-dd-add-osize-and-read-from-to-stdin-.patch
-pve/0011-PVE-Up-qemu-img-dd-add-n-skip_create.patch
+pve/0011-PVE-Up-qemu-img-dd-add-isize-parameter.patch
-pve/0012-qemu-img-dd-add-l-option-for-loading-a-snapshot.patch
+pve/0012-PVE-Up-qemu-img-dd-add-n-skip_create.patch
 pve/0013-PVE-virtio-balloon-improve-query-balloon.patch
 pve/0014-PVE-qapi-modify-query-machines.patch
 pve/0015-PVE-qapi-modify-spice-query.patch
@@ -44,21 +38,39 @@ pve/0025-PVE-Allow-version-code-in-machine-type.patch
 pve/0026-block-backup-move-bcs-bitmap-initialization-to-job-c.patch
 pve/0027-PVE-Backup-add-vma-backup-format-code.patch
 pve/0028-PVE-Backup-add-backup-dump-block-driver.patch
-pve/0029-PVE-Add-sequential-job-transaction-support.patch
+pve/0029-PVE-Backup-proxmox-backup-patches-for-qemu.patch
-pve/0030-PVE-Backup-Proxmox-backup-patches-for-QEMU.patch
+pve/0030-PVE-Backup-pbs-restore-new-command-to-restore-from-p.patch
-pve/0031-PVE-Backup-pbs-restore-new-command-to-restore-from-p.patch
+pve/0031-PVE-Backup-Add-dirty-bitmap-tracking-for-incremental.patch
-pve/0032-PVE-Add-PBS-block-driver-to-map-backup-archives-into.patch
+pve/0032-PVE-various-PBS-fixes.patch
-pve/0033-PVE-redirect-stderr-to-journal-when-daemonized.patch
+pve/0033-PVE-Add-PBS-block-driver-to-map-backup-archives-into.patch
-pve/0034-PVE-Migrate-dirty-bitmap-state-via-savevm.patch
+pve/0034-PVE-add-query_proxmox_support-QMP-command.patch
-pve/0035-migration-block-dirty-bitmap-migrate-other-bitmaps-e.patch
+pve/0035-PVE-add-query-pbs-bitmap-info-QMP-call.patch
-pve/0036-PVE-fall-back-to-open-iscsi-initiatorname.patch
+pve/0036-PVE-redirect-stderr-to-journal-when-daemonized.patch
-pve/0037-PVE-block-stream-increase-chunk-size.patch
+pve/0037-PVE-Add-sequential-job-transaction-support.patch
-pve/0038-block-io-accept-NULL-qiov-in-bdrv_pad_request.patch
+pve/0038-PVE-Backup-Use-a-transaction-to-synchronize-job-stat.patch
-pve/0039-block-add-alloc-track-driver.patch
+pve/0039-PVE-Backup-Don-t-block-on-finishing-and-cleanup-crea.patch
-pve/0040-Revert-block-rbd-workaround-for-ceph-issue-53784.patch
+pve/0040-PVE-Migrate-dirty-bitmap-state-via-savevm.patch
-pve/0041-Revert-block-rbd-fix-handling-of-holes-in-.bdrv_co_b.patch
+pve/0041-migration-block-dirty-bitmap-migrate-other-bitmaps-e.patch
-pve/0042-Revert-block-rbd-implement-bdrv_co_block_status.patch
+pve/0042-PVE-fall-back-to-open-iscsi-initiatorname.patch
-pve/0043-alloc-track-fix-deadlock-during-drop.patch
+pve/0043-PVE-Use-coroutine-QMP-for-backup-cancel_backup.patch
-pve/0044-migration-for-snapshots-hold-the-BQL-during-setup-ca.patch
+pve/0044-PBS-add-master-key-support.patch
-pve/0045-savevm-async-don-t-hold-BQL-during-setup.patch
+pve/0045-PVE-block-pbs-fast-path-reads-without-allocation-if-.patch
-pve-qemu-8.0-vitastor.patch
+pve/0046-PVE-block-stream-increase-chunk-size.patch
 pve/0047-block-io-accept-NULL-qiov-in-bdrv_pad_request.patch
 pve/0048-block-add-alloc-track-driver.patch
 pve/0049-PVE-whitelist-invalid-QAPI-names-for-backwards-compa.patch
 pve/0050-PVE-savevm-async-register-yank-before-migration_inco.patch
 pve/0051-qemu-img-dd-add-l-option-for-loading-a-snapshot.patch
 pve/0052-vma-allow-partial-restore.patch
 pve/0053-pbs-namespace-support.patch
 pve/0054-Revert-block-rbd-workaround-for-ceph-issue-53784.patch
 pve/0055-Revert-block-rbd-fix-handling-of-holes-in-.bdrv_co_b.patch
 pve/0056-Revert-block-rbd-implement-bdrv_co_block_status.patch
 pve/0057-PVE-Backup-create-jobs-correctly-cancel-in-error-sce.patch
 pve/0058-PVE-Backup-ensure-jobs-in-di_list-are-referenced.patch
 pve/0059-PVE-Backup-avoid-segfault-issues-upon-backup-cancel.patch
 pve/0060-vma-create-support-64KiB-unaligned-input-images.patch
 pve/0061-vma-create-avoid-triggering-assertion-in-error-case.patch
 pve/0062-block-alloc-track-avoid-premature-break.patch
 pve/0063-PVE-Backup-allow-passing-max-workers-performance-set.patch
 pve-qemu-7.1-vitastor.patch
--- a/debian/pve-qemu-kvm.install
+++ b/debian/pve-qemu-kvm.install
@@ -1,6 +1,7 @@
 # install the userspace utilities
 debian/kvm-ifup etc/kvm/
 debian/kvm-ifdown etc/kvm/
 #install ovmf uefi rom
 debian/OVMF_CODE-pure-efi.fd usr/share/kvm/
 debian/OVMF_VARS-pure-efi.fd usr/share/kvm/
 debian/kvm-ifdown etc/kvm/
 # install the userspace utilities
 debian/kvm-ifup etc/kvm/
--- a/debian/pve-qemu-kvm.links
+++ b/debian/pve-qemu-kvm.links
@@ -1,13 +1,16 @@
 # also use aarch64 for 32 bit arm
 usr/bin/qemu-system-aarch64 usr/bin/qemu-system-arm
 usr/bin/qemu-system-x86_64 usr/bin/kvm
 # qemu-system-i386 and qemu-system-x86_64 provides the same hardware emulation
 usr/bin/qemu-system-x86_64 usr/bin/qemu-system-i386
 # also use aarch64 for 32 bit arm
 usr/bin/qemu-system-aarch64 usr/bin/qemu-system-arm
 # upstream provides a qemu man page,
 # we symlink to kvm for backward compatibility
 # and to qemu-system-{i386,x86_64} to fullfill our 'Provides: qemu-system-x86'
 usr/share/man/man1/qemu.1  usr/share/man/man1/kvm.1
 usr/share/man/man1/qemu.1  usr/share/man/man1/qemu-system-aarch64.1
 usr/share/man/man1/qemu.1  usr/share/man/man1/qemu-system-arm.1
 usr/share/man/man1/qemu.1  usr/share/man/man1/qemu-system-i386.1
 usr/share/man/man1/qemu.1  usr/share/man/man1/qemu-system-x86_64.1
 usr/share/man/man1/qemu.1  usr/share/man/man1/qemu-system-arm.1
 usr/share/man/man1/qemu.1  usr/share/man/man1/qemu-system-aarch64.1
--- a/debian/pve-qemu-kvm.lintian-overrides
+++ b/debian/pve-qemu-kvm.lintian-overrides
@@ -1,7 +1,4 @@
-pve-qemu-kvm: arch-dependent-file-in-usr-share [usr/share/kvm/hppa-firmware.img]
+pve-qemu-kvm: arch-dependent-file-in-usr-share usr/share/kvm/hppa-firmware.img
-pve-qemu-kvm: binary-from-other-architecture [usr/share/kvm/hppa-firmware.img]
+pve-qemu-kvm: binary-from-other-architecture usr/share/kvm/hppa-firmware.img
-pve-qemu-kvm: embedded-javascript-library please use * [usr/share/doc/pve-qemu-kvm/kvm/_static/*]
+pve-qemu-kvm: unstripped-binary-or-object usr/share/kvm/hppa-firmware.img
-pve-qemu-kvm: groff-message *: warning [*]: can't break line [usr/share/man/*]
+pve-qemu-kvm: statically-linked-binary usr/share/kvm/hppa-firmware.img
 pve-qemu-kvm: groff-message *: warning [*]: cannot adjust line [usr/share/man/*]
 pve-qemu-kvm: statically-linked-binary [usr/share/kvm/hppa-firmware.img]
 pve-qemu-kvm: unstripped-binary-or-object [usr/share/kvm/hppa-firmware.img]
--- a/debian/rules
+++ b/debian/rules
@@ -1,12 +1,22 @@
 #!/usr/bin/make -f
 # -*- makefile -*-
 # Sample debian/rules that uses debhelper.
 # This file was originally written by Joey Hess and Craig Small.
 # As a special exception, when this file is copied by dh-make into a
 # dh-make output file, you may use that output file without restriction.
 # This special exception was added by Craig Small in version 0.37 of dh-make.
 # Uncomment this to turn on verbose mode.
 #export DH_VERBOSE=1
-include /usr/share/dpkg/default.mk
+include /usr/share/dpkg/pkg-info.mk
-HOST_CPU ?= $(DEB_HOST_GNU_CPU)
+# These are used for cross-compiling and for saving the configure script
 # from having to guess our platform (since we know it already)
 DEB_HOST_GNU_TYPE   ?= $(shell dpkg-architecture -qDEB_HOST_GNU_TYPE)
 DEB_BUILD_GNU_TYPE  ?= $(shell dpkg-architecture -qDEB_BUILD_GNU_TYPE)
 ARCH ?= $(shell dpkg-architecture -qDEB_HOST_GNU_CPU)
 PACKAGE=pve-qemu-kvm
 destdir := $(CURDIR)/debian/$(PACKAGE)
@@ -17,70 +27,60 @@ machinefile := $(destdir)/usr/share/kvm/machine-versions-x86_64.json
 # default QEMU out-of-tree build directory is ./build
 BUILDDIR=build
-# FIXME: pass to configure as --extra-cflags=CFLAGS ?! also LDFLAGS?
+CFLAGS = -Wall
 CFLAGS += -Wall
-export CFLAGS
+ifneq (,$(findstring noopt,$(DEB_BUILD_OPTIONS)))
-
+	CFLAGS += -O0
-# DEB_BUILD_OPTIONS=parallel=N
+else
-MAKEFLAGS += $(subst parallel=,-j,$(filter parallel=%,${DEB_BUILD_OPTIONS}))
+	CFLAGS += -O2
 endif
 ${BUILDDIR}/config.status: configure
 	dh_testdir
 	# Add here commands to configure the package.
 ifneq "$(wildcard /usr/share/misc/config.sub)" ""
 	cp -f /usr/share/misc/config.sub config.sub
 endif
 ifneq "$(wildcard /usr/share/misc/config.guess)" ""
 	cp -f /usr/share/misc/config.guess config.guess
 endif
 	# guest-agent is only required for guest systems
 	./configure \
-	    --with-git-submodules=ignore \
+	--with-git-submodules=ignore \
-	    --docdir=/usr/share/doc/pve-qemu-kvm \
+	--docdir=/usr/share/doc/pve-qemu-kvm \
-	    --localstatedir=/var \
+	--localstatedir=/var \
-	    --prefix=/usr \
+	--prefix=/usr \
-	    --sysconfdir=/etc \
+	--sysconfdir=/etc \
-	    --target-list=$(HOST_CPU)-softmmu,aarch64-softmmu \
+	--target-list=$(ARCH)-softmmu,aarch64-softmmu \
-	    --with-suffix="kvm" \
+	--with-suffix="kvm" \
-	    --with-pkgversion="${DEB_SOURCE}_${DEB_VERSION_UPSTREAM_REVISION}" \
+	--with-pkgversion="${DEB_SOURCE}_${DEB_VERSION_UPSTREAM_REVISION}" \
-	    --audio-drv-list="alsa" \
+	--audio-drv-list="alsa" \
-	    --datadir=/usr/share \
+	--datadir=/usr/share \
-	    --libexecdir=/usr/lib/kvm \
+	--libexecdir=/usr/lib/kvm \
-	    --disable-capstone \
+	--disable-capstone \
-	    --disable-gtk \
+	--disable-gtk \
-	    --disable-guest-agent \
+	--disable-guest-agent \
-	    --disable-guest-agent-msi \
+	--disable-guest-agent-msi \
-	    --disable-libnfs \
+	--disable-libnfs \
-	    --disable-libssh \
+	--disable-libssh \
-	    --disable-sdl \
+	--disable-sdl \
-	    --disable-smartcard \
+	--disable-smartcard \
-	    --disable-strip \
+	--disable-strip \
-	    --disable-xen \
+	--disable-xen \
-	    --enable-curl \
+	--enable-curl \
-	    --enable-docs \
+	--enable-docs \
-	    --enable-glusterfs \
+	--enable-glusterfs \
-	    --enable-gnutls \
+	--enable-gnutls \
-	    --enable-libiscsi \
+	--enable-libiscsi \
-	    --enable-libusb \
+	--enable-libusb \
-	    --enable-linux-aio \
+	--enable-linux-aio \
-	    --enable-linux-io-uring \
+	--enable-linux-io-uring \
-	    --enable-numa \
+	--enable-numa \
-	    --enable-opengl \
+	--enable-opengl \
-	    --enable-rbd \
+	--enable-rbd \
-	    --enable-seccomp \
+	--enable-seccomp \
-	    --enable-slirp \
+	--enable-spice \
-	    --enable-spice \
+	--enable-usb-redir \
-	    --enable-usb-redir \
+	--enable-virglrenderer \
-	    --enable-virglrenderer \
+	--enable-virtfs \
-	    --enable-virtfs \
+	--enable-virtiofsd \
-	    --enable-zstd
+	--enable-zstd
 build: build-arch build-indep
 build-arch: build-stamp
 build-indep: build-stamp
 build: build-stamp
 build-stamp: ${BUILDDIR}/config.status
@@ -98,8 +98,15 @@ clean:
 	dh_testroot
 	rm -f build-stamp
-	# Add here commands to clean up before the build process.
+	# Add here commands to clean up after the build process.
 	-$(MAKE) distclean
 ifneq "$(wildcard /usr/share/misc/config.sub)" ""
 	cp -f /usr/share/misc/config.sub config.sub
 endif
 ifneq "$(wildcard /usr/share/misc/config.guess)" ""
 	cp -f /usr/share/misc/config.guess config.guess
 endif
 	dh_clean
@@ -113,6 +120,21 @@ install: build
 	# Add here commands to install the package into debian/pve-kvm.
 	$(MAKE) DESTDIR=$(destdir) install
 	# we do not need openbios files (sparc/ppc)
 	rm -rf $(destdir)/usr/share/kvm/openbios-*
 	# remove ppc files
 	rm $(destdir)/usr/share/kvm/*.dtb
 	rm $(destdir)/usr/share/kvm/s390-ccw.img
 	rm $(destdir)/usr/share/kvm/s390-netboot.img
 	rm $(destdir)/usr/share/kvm/qemu_vga.ndrv
 	rm $(destdir)/usr/share/kvm/slof.bin
 	rm $(destdir)/usr/share/kvm/u-boot.e500
 	# remove Alpha files
 	rm $(destdir)/usr/share/kvm/palcode-clipper
 	# remove RISC-V files
 	rm $(destdir)/usr/share/kvm/opensbi-riscv32-generic-fw_dynamic.bin
 	rm $(destdir)/usr/share/kvm/opensbi-riscv64-generic-fw_dynamic.bin
 	# Remove things we don't package at all, would be a "kvm-dev" package
 	rm -Rf $(destdir)/usr/include/linux/
 	rm -Rf $(destdir)/usr/include
@@ -148,7 +170,7 @@ binary-arch: build install
 #	dh_installinfo
 	dh_installman
 	dh_link
-	dh_strip --dbgsym-migration='pve-qemu-kvm-dbg (<<8.0.0-1~)'
+	dh_strip --dbg-package=pve-qemu-kvm-dbg
 	dh_compress
 	dh_fixperms
 #	dh_perl
--- a/debian/source/lintian-overrides
+++ b/debian/source/lintian-overrides
@@ -1 +0,0 @@
 source-is-missing [roms/SLOF/*.oco]
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Vitaliy Filippov	bf8b97b3d8	Fix truncation, add write-back cache support	2023-10-27 21:05:44 +03:00
Vitaliy Filippov	a3b2ef93ab	Improve performance by adding io_uring support, fix iothread compat	2023-07-19 02:27:08 +03:00
Vitaliy Filippov	0fa004b912	Add bdrv_co_block_status	2023-07-18 18:26:09 +03:00
Vitaliy Filippov	78a75914b3	Add Vitastor support	2022-12-15 19:32:46 +03:00