Improve performance by adding io_uring support, fix iothread compat

Add bdrv_co_block_status
Add Vitastor support
2023-07-19 02:27:08 +03:00 · 2023-07-18 18:26:09 +03:00 · 2022-12-15 19:32:46 +03:00
122 changed files with 12443 additions and 5578 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -1,7 +0,0 @@
 /*.build
 /*.buildinfo
 /*.changes
 /*.deb
 /*.dsc
 /*.tar*
 /pve-qemu-kvm-*.*/
--- a/82
+++ b/82
@@ -1,90 +1,60 @@
-include /usr/share/dpkg/default.mk
+include /usr/share/dpkg/pkg-info.mk
 include /usr/share/dpkg/architecture.mk
 PACKAGE = pve-qemu-kvm
 SRCDIR := qemu
-BUILDDIR ?= $(PACKAGE)-$(DEB_VERSION_UPSTREAM)
+BUILDDIR ?= ${PACKAGE}-${DEB_VERSION_UPSTREAM}
 ORIG_SRC_TAR=$(PACKAGE)_$(DEB_VERSION_UPSTREAM).orig.tar.gz
 GITVERSION := $(shell git rev-parse HEAD)
-DSC=$(PACKAGE)_$(DEB_VERSION_UPSTREAM_REVISION).dsc
+DEB = ${PACKAGE}_${DEB_VERSION_UPSTREAM_REVISION}_${DEB_BUILD_ARCH}.deb
-DEB = $(PACKAGE)_$(DEB_VERSION_UPSTREAM_REVISION)_$(DEB_BUILD_ARCH).deb
+DEB_DBG = ${PACKAGE}-dbg_${DEB_VERSION_UPSTREAM_REVISION}_${DEB_BUILD_ARCH}.deb
 DEB_DBG = $(PACKAGE)-dbgsym_$(DEB_VERSION_UPSTREAM_REVISION)_$(DEB_BUILD_ARCH).deb
 DEBS = $(DEB) $(DEB_DBG)
 all: $(DEBS)
 .PHONY: submodule
 submodule:
-ifeq ($(shell test -f "$(SRCDIR)/configure" && echo 1 || echo 0), 0)
+	test -f "${SRCDIR}/configure" || git submodule update --init --recursive
 	git submodule update --init --recursive
 	cd $(SRCDIR); meson subprojects download
 endif
-PC_BIOS_FW_PURGE_LIST_IN = \
+$(BUILDDIR): keycodemapdb | submodule
 	hppa-firmware.img \
 	hppa-firmware64.img \
 	openbios-ppc \
 	openbios-sparc32 \
 	openbios-sparc64 \
 	palcode-clipper \
 	s390-ccw.img \
 	s390-netboot.img \
 	u-boot.e500 \
 	.*[a-zA-Z0-9]\.dtb \
 	.*[a-zA-Z0-9]\.dts \
 	qemu_vga.ndrv \
 	slof.bin \
 	opensbi-riscv.*-generic-fw_dynamic.bin \
 BLOB_PURGE_SED_CMDS = $(foreach FILE,$(PC_BIOS_FW_PURGE_LIST_IN),-e "/$(FILE)/d")
 BLOB_PURGE_FILTER = $(foreach FILE,$(PC_BIOS_FW_PURGE_LIST_IN),-e "$(FILE)")
 $(BUILDDIR): submodule
 	# check if qemu/ was used for a build
 	# if so, please run 'make distclean' in the submodule and try again
 	test ! -f $(SRCDIR)/build/config.status
-	rm -rf $@.tmp $@
+	rm -rf $(BUILDDIR)
-	cp -a $(SRCDIR) $@.tmp
+	cp -a $(SRCDIR) $(BUILDDIR)
-	cp -a debian $@.tmp/debian
+	cp -a debian $(BUILDDIR)/debian
-	rm -rf $@.tmp/roms/edk2 # packaged separately
+	rm -rf $(BUILDDIR)/ui/keycodemapdb
-	find $@.tmp/pc-bios -type f | grep $(BLOB_PURGE_FILTER) | xargs rm -f
+	cp -a keycodemapdb $(BUILDDIR)/ui/
-	sed -i $(BLOB_PURGE_SED_CMDS) $@.tmp/pc-bios/meson.build
+	echo "git clone git://git.proxmox.com/git/pve-qemu.git\\ngit checkout $(GITVERSION)" > $(BUILDDIR)/debian/SOURCE
 	echo "git clone git://git.proxmox.com/git/pve-qemu.git\\ngit checkout $(GITVERSION)" > $@.tmp/debian/SOURCE
 	mv $@.tmp $@
 .PHONY: deb kvm
 deb kvm: $(DEBS)
 $(DEB_DBG): $(DEB)
 $(DEB): $(BUILDDIR)
-	cd $(BUILDDIR); dpkg-buildpackage -b -us -uc
+	cd $(BUILDDIR); dpkg-buildpackage -b -us -uc -j8
 	lintian $(DEBS)
-sbuild: $(DSC)
+.PHONY: update
-	sbuild $(DSC)
+update:
-
+	cd $(SRCDIR) && git submodule deinit ui/keycodemapdb || true
-$(ORIG_SRC_TAR): $(BUILDDIR)
+	rm -rf $(SRCDIR)/ui/keycodemapdb
-	tar czf $(ORIG_SRC_TAR) --exclude="$(BUILDDIR)/debian" $(BUILDDIR)
+	mkdir $(SRCDIR)/ui/keycodemapdb
-
+	cd $(SRCDIR) && git submodule update --init ui/keycodemapdb
-.PHONY: dsc
+	rm -rf keycodemapdb
-dsc:
+	mkdir keycodemapdb
-	rm -rf *.dsc $(BUILDDIR)
+	cp -R $(SRCDIR)/ui/keycodemapdb/* keycodemapdb/
-	$(MAKE) $(DSC)
+	git add keycodemapdb
 	lintian $(DSC)
 $(DSC): $(ORIG_SRC_TAR) $(BUILDDIR)
 	cd $(BUILDDIR); dpkg-buildpackage -S -us -uc -d
 .PHONY: upload
 upload: UPLOAD_DIST ?= $(DEB_DISTRIBUTION)
 upload: $(DEBS)
-	tar cf - $(DEBS) | ssh repoman@repo.proxmox.com upload --product pve --dist $(UPLOAD_DIST)
+	tar cf - ${DEBS} | ssh repoman@repo.proxmox.com upload --product pve --dist bullseye
 .PHONY: distclean clean
 distclean: clean
 clean:
-	rm -rf $(PACKAGE)-[0-9]*/ $(PACKAGE)*.tar* *.deb *.dsc *.build *.buildinfo *.changes
+	rm -rf $(BUILDDIR) $(PACKAGE)*.deb *.buildinfo *.changes
 .PHONY: dinstall
 dinstall: $(DEBS)
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,377 +1,21 @@
-pve-qemu-kvm (9.1.2-1) bookworm; urgency=medium
+pve-qemu-kvm (7.1.0-4+vitastor4) bullseye; urgency=medium
-  * update submodule and patches to QEMU 9.1.2
+  * Improve performance by adding io_uring support
  * Fix compatibility with iothread
-  * improve error handling and edge cases with fleecing backups.
+ -- Vitaliy Filippov <vitalif@yourcmc.ru>  Tue, 18 Jul 2023 02:22:28 +0300
- -- Proxmox Support Team <support@proxmox.com>  Wed, 11 Dec 2024 16:47:21 +0100
+pve-qemu-kvm (7.1.0-4+vitastor3) bullseye; urgency=medium
-pve-qemu-kvm (9.0.2-4) bookworm; urgency=medium
+  * Add bdrv_co_block_status implementation for QCOW2 export support
-  * async snapshot: ensure any dynamic vCPU-throttling applied for
+ -- Vitaliy Filippov <vitalif@yourcmc.ru>  Thu, 12 Jan 2023 02:31:18 +0300
    auto-converge gets always disabled again after finishing the snapshot.
- -- Proxmox Support Team <support@proxmox.com>  Sun, 10 Nov 2024 11:23:09 +0100
+pve-qemu-kvm (7.1.0-4+vitastor2) bullseye; urgency=medium
-pve-qemu-kvm (9.0.2-3) bookworm; urgency=medium
+  * Add Vitastor support
-  * pick up fix for VirtIO PCI regressions
+ -- Vitaliy Filippov <vitalif@yourcmc.ru>  Thu, 15 Dec 2022 19:32:28 +0300
  * pick up stable fixes for 9.0, including fixes for VirtIO-net, ARM and
    x86(_64) emulation, CVEs to harden NBD server against malicious clients,
    as well as a few others (VNC, physmem, Intel IOMMU, ...).
 -- Proxmox Support Team <support@proxmox.com>  Fri, 06 Sep 2024 16:21:42 +0200
 pve-qemu-kvm (9.0.2-2) bookworm; urgency=medium
  * actually update submodule to QEMU 9.0.2. The previous release was still
    based on 9.0.0 by mistake.
 -- Proxmox Support Team <support@proxmox.com>  Wed, 07 Aug 2024 10:16:01 +0200
 pve-qemu-kvm (9.0.2-1) bookworm; urgency=medium
  * update submodule and patches to QEMU 9.0.2. While our version had most
    stable fixes included already, there are new fixes for VirtIO and VGA
    display screen blanking (#4786)
  * backport fix for a regression with the LSI-53c895a controller and one for
    the boot order getting ignored for USB storage
 -- Proxmox Support Team <support@proxmox.com>  Mon, 29 Jul 2024 18:59:40 +0200
 pve-qemu-kvm (9.0.0-6) bookworm; urgency=medium
  * fix a regression in the zeroinit block driver that prevented importing and
    cloning disks to RBD storages which are not using the krbd setting
 -- Proxmox Support Team <support@proxmox.com>  Mon, 08 Jul 2024 16:11:15 +0200
 pve-qemu-kvm (9.0.0-5) bookworm; urgency=medium
  * backport fix for CVE-2024-4467 to prevent malicious qcow2 image files from
    already causing bad effects if being queried via 'qemu-img info'. For
    Proxmox VE, this is an additional safe guard, as currently it directly
    creates and manages the qcow2 images used by VMs and does not allow
    unprivileged users to import them
  * fix #4726: code cleanup: avoid superfluous check in vma backup code
 -- Proxmox Support Team <support@proxmox.com>  Wed, 03 Jul 2024 13:13:35 +0200
 pve-qemu-kvm (9.0.0-4) bookworm; urgency=medium
  * fix crash after saving a snapshot without including VM state when a VirtIO
    block device with iothread is configured.
  * fix edge case in error handling when opening a block device from PBS fails
  * minor code cleanup in backup code
 -- Proxmox Support Team <support@proxmox.com>  Mon, 01 Jul 2024 11:26:11 +0200
 pve-qemu-kvm (9.0.0-3) bookworm; urgency=medium
  * fix crash when doing resize after hotplugging a disk using io_uring
  * fix some minor issues in software CPU emulation (i.e. non-KVM) for ARM and
    x86(_64)
 -- Proxmox Support Team <support@proxmox.com>  Wed, 29 May 2024 15:55:44 +0200
 pve-qemu-kvm (9.0.0-2) bookworm; urgency=medium
  * fix #5409: backup: fix copy-before-write timeout
  * backup: improve error when copy-before-write fails for fleecing
  * fix forwards and backwards migration with VirtIO-GPU display
  * fix a regression in pflash device introduced in 8.2
  * revert a commit for VirtIO PCI devices that turned out to cause more
    potential security issues than what it fixed
  * move compatibility flags for a new VirtIO-net feature to the correct
    machine type. The feature was introduced in QEMU 8.2, but the
    compatibility flags got added to machine version 8.0 instead of 8.1. This
    breaks backwards migration with machine version 8.1 from a 8.2/9.0 binary
    to an 8.1 binary, in cases where the guest kernel enables the feature
    (e.g. Ubuntu 23.10).
    While that breaks migration with machine version 8.1 from an unpatched to
    a patched binary, Proxmox VE only ever had 8.2 on the test repository and
    9.0 not yet in any public repository.
 -- Proxmox Support Team <support@proxmox.com>  Fri, 17 May 2024 17:04:52 +0200
 pve-qemu-kvm (9.0.0-1) bookworm; urgency=medium
  * update submodule and patches to QEMU 9.0.0
 -- Proxmox Support Team <support@proxmox.com>  Mon, 29 Apr 2024 10:51:37 +0200
 pve-qemu-kvm (8.2.2-1) bookworm; urgency=medium
  * update submodule and patches to QEMU 8.2.2
 -- Proxmox Support Team <support@proxmox.com>  Sat, 27 Apr 2024 12:44:30 +0200
 pve-qemu-kvm (8.1.5-5) bookworm; urgency=medium
  * implement support for backup fleecing
 -- Proxmox Support Team <support@proxmox.com>  Thu, 11 Apr 2024 17:46:48 +0200
 pve-qemu-kvm (8.1.5-4) bookworm; urgency=medium
  * fix live-import for certain kinds of VMDK images that rely on padding
  * backup: avoid bubbling up first error if it's an ECANCELED one, as those
    are often a result of cancling the job due to running into an actual
    issue.
  * backup: factor out & clean up gathering device info into helper
 -- Proxmox Support Team <support@proxmox.com>  Tue, 12 Mar 2024 14:08:40 +0100
 pve-qemu-kvm (8.1.5-3) bookworm; urgency=medium
  * backport fix for potential deadlock during QMP stop command if the VM has
    disks attached through VirtIO-Block and IO-Thread enabled
  * fix #4507: add patch to automatically increase NOFILE soft limit
 -- Proxmox Support Team <support@proxmox.com>  Wed, 21 Feb 2024 20:11:23 +0100
 pve-qemu-kvm (8.1.5-2) bookworm; urgency=medium
  * work around for a situation where guest IO might get stuck, if the VM is
    configure  with iothread and VirtIO block/SCSI
 -- Proxmox Support Team <support@proxmox.com>  Fri, 02 Feb 2024 19:41:27 +0100
 pve-qemu-kvm (8.1.5-1) bookworm; urgency=medium
  * update to 8.1.5 stable release, including more relevant fixes like:
    - virtio-net: correctly copy vnet header when flushing TX
    - hw/pflash: implement update buffer for block writes
    - Fixes to i386 emulation and ARM emulation.
 -- Proxmox Support Team <support@proxmox.com>  Fri, 02 Feb 2024 19:08:13 +0100
 pve-qemu-kvm (8.1.2-6) bookworm; urgency=medium
  * revert attempted fix to avoid rare issue with stuck guest IO when using
    iothread, because it caused a much more common issue with iothreads
    consuming too much CPU
 -- Proxmox Support Team <support@proxmox.com>  Fri, 15 Dec 2023 14:22:06 +0100
 pve-qemu-kvm (8.1.2-5) bookworm; urgency=medium
  * backport workaround for stuck guest IO with iothread and VirtIO block/SCSI
    in some rare edge cases
  * backport fix for potential deadlock when issuing the "resize" QMP command
    for a disk that is using iothread
 -- Proxmox Support Team <support@proxmox.com>  Mon, 11 Dec 2023 16:58:27 +0100
 pve-qemu-kvm (8.1.2-4) bookworm; urgency=medium
  * fix vnc clipboard in the host to guest direction
 -- Proxmox Support Team <support@proxmox.com>  Wed, 22 Nov 2023 14:28:21 +0100
 pve-qemu-kvm (8.1.2-3) bookworm; urgency=medium
  * fix #5054: backport fix for software reset with SATA, avoiding breakage
    with, e.g., some FreeBSD VMs
 -- Proxmox Support Team <support@proxmox.com>  Mon, 20 Nov 2023 10:24:50 +0100
 pve-qemu-kvm (8.1.2-2) bookworm; urgency=medium
  * revert "x86: acpi: workaround Windows not handling name references in
    Package properly" as that seems to have broken networking (and possibly
    other things) one some localized variants of Windows (e.g., the German
    versions).
 -- Proxmox Support Team <support@proxmox.com>  Fri, 17 Nov 2023 11:55:23 +0100
 pve-qemu-kvm (8.1.2-1) bookworm; urgency=medium
  * update submodule and patches to QEMU 8.1.2
  * use QEMU's keycode-map-db again instead of our static copy from QEMU 6.0
  * disable graph locking, newly introduced in the 8.1 release, as it has
    still various deadlock issuess, e.g., during canceling backup jobs.
 -- Proxmox Support Team <support@proxmox.com>  Tue, 24 Oct 2023 13:42:45 +0200
 pve-qemu-kvm (8.0.2-7) bookworm; urgency=medium
  * fix #2874: SATA: avoid unsolicited write to sector 0 during reset
 -- Proxmox Support Team <support@proxmox.com>  Wed, 04 Oct 2023 08:33:35 +0200
 pve-qemu-kvm (8.0.2-6) bookworm; urgency=medium
  * fix #1534: vma: add extract-filter for disk images allowing users to pass
    a comma separated list of the disks they want to extract from an archive.
  * backup: create jobs in a drained section to avoid subtle bugs where
    something interferes with the block-copy-state bitmap on initialization
  * backup: drop experimental, and since a while also fully broken, directory
    backup format (BACKUP_FORMAT_DIR). This format was never exposed via the
    Proxmox VE API, but only available via QMP, as its broken since QEMU 8 and
    we got zero reports about that, it's safe to assume that there are no
    public users, so just remove it completely.
 -- Proxmox Support Team <support@proxmox.com>  Wed, 06 Sep 2023 17:03:59 +0200
 pve-qemu-kvm (8.0.2-5) bookworm; urgency=medium
  * improve memory footprint after backup by not keeping as much memory
    resident.
  * fix file descriptor leak for vhost (used by default by vNICs).
 -- Proxmox Support Team <support@proxmox.com>  Wed, 16 Aug 2023 11:52:24 +0200
 pve-qemu-kvm (8.0.2-4) bookworm; urgency=medium
  * fix resume for snapshot and hibernate in combination with iothread and
    dirty bitmap
 -- Proxmox Support Team <support@proxmox.com>  Fri, 28 Jul 2023 12:58:22 +0200
 pve-qemu-kvm (8.0.2-3) bookworm; urgency=medium
  * fix regression in QEMU 8.0 for drive mirror with bitmap
 -- Proxmox Support Team <support@proxmox.com>  Thu, 15 Jun 2023 13:57:46 +0200
 pve-qemu-kvm (8.0.2-2) bookworm; urgency=medium
  * drop custom get_link_status QMP command, was never really used.
  * drop custom & deprecated drive snapshot QMP commands, we use a better
    alternative since a while.
 -- Proxmox Support Team <support@proxmox.com>  Fri, 09 Jun 2023 07:57:56 +0200
 pve-qemu-kvm (8.0.2-1) bookworm; urgency=medium
  * update to QEMU stable release 8.0.2
  * update patches for avoiding issues with DMA reentrancy to current,
    slightly optimized version.
 -- Proxmox Support Team <support@proxmox.com>  Tue, 06 Jun 2023 16:34:50 +0200
 pve-qemu-kvm (8.0.0-1) bookworm; urgency=medium
  * update to QEMU stable release 8.0.0
  * re-build for Proxmox VE 8 / Debian 12 Bookworm
  * adapt to the local virtiofsd C variant being dropped, it has been
    rewritten in Rust and is now hosted in a separate source repository.
 -- Proxmox Support Team <support@proxmox.com>  Mon, 22 May 2023 13:45:49 +0200
 pve-qemu-kvm (7.2.0-8) bullseye; urgency=medium
  * backport fix for ACPI CPU hotplug issue with TCG
  * cherry-pick TCG-related stable fixes for 7.2 for users that turned off KVM
    HW acceleration
 -- Proxmox Support Team <support@proxmox.com>  Fri, 17 Mar 2023 15:47:08 +0100
 pve-qemu-kvm (7.2.0-7) bullseye; urgency=medium
  * improve fix for potential deadlock with trim for IDE/SATA and draining
  * backport stable fixes:
    - hw/nvme: fix missing endian conversions for doorbell buffers
    - hw/smbios: fix field corruption in type 4 table
    - virtio-rng-pci: fix transitional migration compat for vectors
    - hw/timer/hpet: Fix expiration time overflow
    - vhost/vdpa: stop all svq on device deletion
    - vhost: avoid a potential use of an uninitialized variable in the call to
      vhost_svq_poll
    - chardev/char-socket: set s->listener = NULL in char_socket_finalize to
      fix a potential crash after live-migration
    - intel-iommu: fail MAP notifier without caching mode
    - intel-iommu: fail DEVIOTLB_UNMAP without dt mode
  * fix a regression for when the LSI SCSI controller is used
 -- Proxmox Support Team <support@proxmox.com>  Mon, 13 Mar 2023 17:42:49 +0100
 pve-qemu-kvm (7.2.0-6) bullseye; urgency=medium
  * fix 7.2 regression for Linux boot failures with megasas SCSI
  * fix 7.0 regression for a potential deadlock with trim for IDE/SATA and
    draining
 -- Proxmox Support Team <support@proxmox.com>  Wed, 08 Mar 2023 14:32:17 +0100
 pve-qemu-kvm (7.2.0-5) bullseye; urgency=medium
  * fix #4476: savevm-async: avoid looping without progress
  * savevm-async: decrease the boundary for free space for (memory) state left
    on target from 30 MiB to 100 MiB, improving the heuristic for when to
    enter the final "pause and sync" stage.
  * QMP backup: use correct error number when getting blockdrive length fails
  * backport fix for some DMA reentrancy issues, better protecting against
    malicious guests
  * backport fix for iSCSI double free issue leading to crashes
 -- Proxmox Support Team <support@proxmox.com>  Tue, 21 Feb 2023 13:49:43 +0100
 pve-qemu-kvm (7.2.0-4) bullseye; urgency=medium
  * backport fix for a 7.2 regression when using VirtIO disk with
    detect-zeroes=unmap
 -- Proxmox Support Team <support@proxmox.com>  Fri, 27 Jan 2023 09:37:49 +0100
 pve-qemu-kvm (7.2.0-3) bullseye; urgency=medium
  * add fix for live-migration with virtio-rng devices, which regressed in
    QEMU 7.2.0.
 -- Proxmox Support Team <support@proxmox.com>  Thu, 12 Jan 2023 13:13:14 +0100
 pve-qemu-kvm (7.2.0-2) bullseye; urgency=medium
  * enable slirp again for now, as in qemu-server, user networking is
    supported (via CLI/API) when no bridge is set on a virtual NIC
  * cherry-pick stable fixes for 7.2. Two for virtio-mem and one for vIOMMU.
    Both features are not yet exposed in PVE's qemu-server, but there's work
    going on to change that.
 -- Proxmox Support Team <support@proxmox.com>  Tue, 10 Jan 2023 15:47:48 +0100
 pve-qemu-kvm (7.2.0-1) bullseye; urgency=medium
  * update to QEMU stable release 7.2.0
  * drop 'slirp' networking
 -- Proxmox Support Team <support@proxmox.com>  Fri, 16 Dec 2022 13:18:21 +0100
 pve-qemu-kvm (7.1.0-4) bullseye; urgency=medium
--- a/debian/compat
+++ b/debian/compat
@@ -0,0 +1 @@
 10
--- a/debian/control
+++ b/debian/control
@@ -2,8 +2,9 @@ Source: pve-qemu-kvm
 Section: admin
 Priority: optional
 Maintainer: Proxmox Support Team <support@proxmox.com>
-Build-Depends: debhelper-compat (= 13),
+Build-Depends: autotools-dev,
               check,
               debhelper (>= 9),
               libacl1-dev,
               libaio-dev,
               libattr1-dev,
@@ -15,21 +16,21 @@ Build-Depends: debhelper-compat (= 13),
               libglusterfs-dev (>= 5.2-2),
               libgnutls28-dev,
               libiscsi-dev (>= 1.12.0),
               libjemalloc-dev,
               libjpeg-dev,
               libjson-perl,
               libnuma-dev,
               libpci-dev,
               libpixman-1-dev,
-               libproxmox-backup-qemu0-dev (>= 1.3.0),
+               libproxmox-backup-qemu0-dev (>= 1.3.0-1),
               librbd-dev (>= 0.48),
               libsdl1.2-dev,
               libseccomp-dev,
               libslirp-dev,
               libspice-protocol-dev (>= 0.12.14~),
               libspice-server-dev (>= 0.14.0~),
               libsystemd-dev,
               liburing-dev,
-               libusb-1.0-0-dev (>= 1.0.17),
+               libusb-1.0-0-dev (>= 1.0.17-1),
               libusbredirparser-dev (>= 0.6-2),
               libvirglrenderer-dev,
               libzstd-dev,
@@ -37,8 +38,9 @@ Build-Depends: debhelper-compat (= 13),
               python3-minimal,
               python3-sphinx,
               python3-sphinx-rtd-theme,
               python3-venv,
               quilt,
               texi2html,
               texinfo,
               uuid-dev,
               xfslibs-dev,
 Standards-Version: 3.7.2
@@ -55,15 +57,17 @@ Depends: ceph-common (>= 0.48),
         libglusterfs-dev | glusterfs-common (>= 5.6),
         libglusterfs0 | glusterfs-common (>= 5.6),
         libiscsi4 (>= 1.12.0) | libiscsi7,
         libjemalloc2,
         libjpeg62-turbo,
         libspice-server1 (>= 0.14.0~),
         libusb-1.0-0 (>= 1.0.17-1),
         libusbredirparser1 (>= 0.6-2),
         vitastor-client (>= 0.9.4),
         libuuid1,
         ${misc:Depends},
         ${shlibs:Depends},
-Recommends: numactl,
+Recommends: numactl
-Suggests: libgl1,
+Suggests: libgl1
 Conflicts: kvm,
           pve-kvm,
           pve-qemu-kvm-2.6.18,
@@ -71,17 +75,22 @@ Conflicts: kvm,
           qemu-kvm,
           qemu-system-arm,
           qemu-system-common,
           qemu-system-data,
           qemu-system-x86,
           qemu-utils,
-Provides: qemu-system-arm, qemu-system-x86, qemu-utils,
+Provides: qemu-system-arm, qemu-system-x86, qemu-utils
 Replaces: pve-kvm,
          pve-qemu-kvm-2.6.18,
          qemu-system-arm,
          qemu-system-x86,
          qemu-utils,
 Breaks: qemu-server (<= 8.0.6)
 Description: Full virtualization on x86 hardware
 Using KVM, one can run multiple virtual PCs, each running unmodified Linux or
 Windows images. Each virtual machine has private virtualized hardware: a
 network card, disk, graphics adapter, etc.
 Package: pve-qemu-kvm-dbg
 Architecture: any
 Section: debug
 Depends: pve-qemu-kvm (= ${binary:Version})
 Description: pve qemu debugging symbols
 This package contains the debugging symbols for pve-qemu-kvm.
--- a/debian/parse-machines.pl
+++ b/debian/parse-machines.pl
@@ -24,5 +24,4 @@ while (<STDIN>) {
 die "no QEMU machine types detected from STDIN input" if scalar (@$machines) <= 0;
-print to_json($machines, { utf8 => 1, canonical => 1 })
+print to_json($machines, { utf8 => 1 }) or die "$!\n";
    or die "failed to encode detected machines as JSON - $!\n";
--- a/debian/patches/bitmap-mirror/0001-drive-mirror-add-support-for-sync-bitmap-mode-never.patch
+++ b/debian/patches/bitmap-mirror/0001-drive-mirror-add-support-for-sync-bitmap-mode-never.patch
@@ -27,18 +27,16 @@ Signed-off-by: Ma Haocong <mahaocong@didichuxing.com>
 Signed-off-by: John Snow <jsnow@redhat.com>
 Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 [FE: rebased for 9.1.2]
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
- block/mirror.c                         | 99 ++++++++++++++++++++------
+ block/mirror.c                         | 98 +++++++++++++++++++++-----
- blockdev.c                             | 38 +++++++++-
+ blockdev.c                             | 39 +++++++++-
 include/block/block_int-global-state.h |  4 +-
- qapi/block-core.json                   | 25 ++++++-
+ qapi/block-core.json                   | 29 ++++++--
 tests/unit/test-block-iothread.c       |  4 +-
- 5 files changed, 142 insertions(+), 28 deletions(-)
+ 5 files changed, 145 insertions(+), 29 deletions(-)
 diff --git a/block/mirror.c b/block/mirror.c
-index 61f0a717b7..83a88562c5 100644
+index 3c4ab1159d..f2eca983f1 100644
 --- a/block/mirror.c
 +++ b/block/mirror.c
@@ -51,7 +51,7 @@ typedef struct MirrorBlockJob {
@@ -50,7 +48,7 @@ index 61f0a717b7..83a88562c5 100644
     BlockMirrorBackingMode backing_mode;
     /* Whether the target image requires explicit zero-initialization */
     bool zero_target;
-@@ -73,6 +73,8 @@ typedef struct MirrorBlockJob {
+@@ -65,6 +65,8 @@ typedef struct MirrorBlockJob {
     size_t buf_size;
     int64_t bdev_length;
     unsigned long *cow_bitmap;
@@ -59,9 +57,9 @@ index 61f0a717b7..83a88562c5 100644
     BdrvDirtyBitmap *dirty_bitmap;
     BdrvDirtyBitmapIter *dbi;
     uint8_t *buf;
-@@ -723,7 +725,8 @@ static int mirror_exit_common(Job *job)
+@@ -696,7 +698,8 @@ static int mirror_exit_common(Job *job)
     bdrv_child_refresh_perms(mirror_top_bs, mirror_top_bs->backing,
                              &error_abort);
     if (!abort && s->backing_mode == MIRROR_SOURCE_BACKING_CHAIN) {
 -        BlockDriverState *backing = s->is_none_mode ? src : s->base;
 +        BlockDriverState *backing;
@@ -69,7 +67,7 @@ index 61f0a717b7..83a88562c5 100644
         BlockDriverState *unfiltered_target = bdrv_skip_filters(target_bs);
         if (bdrv_cow_bs(unfiltered_target) != backing) {
-@@ -824,6 +827,16 @@ static void mirror_abort(Job *job)
+@@ -794,6 +797,16 @@ static void mirror_abort(Job *job)
     assert(ret == 0);
 }
@@ -86,7 +84,7 @@ index 61f0a717b7..83a88562c5 100644
 static void coroutine_fn mirror_throttle(MirrorBlockJob *s)
 {
     int64_t now = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);
-@@ -1020,7 +1033,8 @@ static int coroutine_fn mirror_run(Job *job, Error **errp)
+@@ -973,7 +986,8 @@ static int coroutine_fn mirror_run(Job *job, Error **errp)
     mirror_free_init(s);
     s->last_pause_ns = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);
@@ -96,7 +94,7 @@ index 61f0a717b7..83a88562c5 100644
         ret = mirror_dirty_init(s);
         if (ret < 0 || job_is_cancelled(&s->common.job)) {
             goto immediate_exit;
-@@ -1309,6 +1323,7 @@ static const BlockJobDriver mirror_job_driver = {
+@@ -1212,6 +1226,7 @@ static const BlockJobDriver mirror_job_driver = {
         .run                    = mirror_run,
         .prepare                = mirror_prepare,
         .abort                  = mirror_abort,
@@ -104,7 +102,7 @@ index 61f0a717b7..83a88562c5 100644
         .pause                  = mirror_pause,
         .complete               = mirror_complete,
         .cancel                 = mirror_cancel,
-@@ -1327,6 +1342,7 @@ static const BlockJobDriver commit_active_job_driver = {
+@@ -1228,6 +1243,7 @@ static const BlockJobDriver commit_active_job_driver = {
         .run                    = mirror_run,
         .prepare                = mirror_prepare,
         .abort                  = mirror_abort,
@@ -112,7 +110,7 @@ index 61f0a717b7..83a88562c5 100644
         .pause                  = mirror_pause,
         .complete               = mirror_complete,
         .cancel                 = commit_active_cancel,
-@@ -1719,7 +1735,10 @@ static BlockJob *mirror_start_job(
+@@ -1593,7 +1609,10 @@ static BlockJob *mirror_start_job(
                              BlockCompletionFunc *cb,
                              void *opaque,
                              const BlockJobDriver *driver,
@@ -123,10 +121,10 @@ index 61f0a717b7..83a88562c5 100644
 +                             BlockDriverState *base,
                              bool auto_complete, const char *filter_node_name,
                              bool is_mirror, MirrorCopyMode copy_mode,
-                              bool base_ro,
+                              Error **errp)
-@@ -1734,10 +1753,39 @@ static BlockJob *mirror_start_job(
+@@ -1605,10 +1624,39 @@ static BlockJob *mirror_start_job(
- 
+     uint64_t target_perms, target_shared_perms;
-     GLOBAL_STATE_CODE();
+     int ret;
 -    if (granularity == 0) {
 -        granularity = bdrv_get_default_bitmap_granularity(target);
@@ -166,7 +164,7 @@ index 61f0a717b7..83a88562c5 100644
     assert(is_power_of_2(granularity));
     if (buf_size < 0) {
-@@ -1878,7 +1926,9 @@ static BlockJob *mirror_start_job(
+@@ -1740,7 +1788,9 @@ static BlockJob *mirror_start_job(
     s->replaces = g_strdup(replaces);
     s->on_source_error = on_source_error;
     s->on_target_error = on_target_error;
@@ -176,10 +174,10 @@ index 61f0a717b7..83a88562c5 100644
 +    s->bitmap_mode = bitmap_mode;
     s->backing_mode = backing_mode;
     s->zero_target = zero_target;
-     qatomic_set(&s->copy_mode, copy_mode);
+     s->copy_mode = copy_mode;
-@@ -1904,6 +1954,18 @@ static BlockJob *mirror_start_job(
+@@ -1761,6 +1811,18 @@ static BlockJob *mirror_start_job(
      */
         bdrv_disable_dirty_bitmap(s->dirty_bitmap);
     }
 +    if (s->sync_bitmap) {
 +        bdrv_dirty_bitmap_set_busy(s->sync_bitmap, true);
@@ -193,10 +191,10 @@ index 61f0a717b7..83a88562c5 100644
 +        }
 +    }
 +
     bdrv_graph_wrlock();
     ret = block_job_add_bdrv(&s->common, "source", bs, 0,
                              BLK_PERM_WRITE_UNCHANGED | BLK_PERM_WRITE |
-@@ -1986,6 +2048,9 @@ fail:
+                              BLK_PERM_CONSISTENT_READ,
@@ -1838,6 +1900,9 @@ fail:
         if (s->dirty_bitmap) {
             bdrv_release_dirty_bitmap(s->dirty_bitmap);
         }
@@ -206,7 +204,7 @@ index 61f0a717b7..83a88562c5 100644
         job_early_fail(&s->common.job);
     }
-@@ -2008,35 +2073,28 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
+@@ -1855,31 +1920,25 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
                   BlockDriverState *target, const char *replaces,
                   int creation_flags, int64_t speed,
                   uint32_t granularity, int64_t buf_size,
@@ -231,23 +229,19 @@ index 61f0a717b7..83a88562c5 100644
 -                   MirrorSyncMode_str(mode));
 -        return;
 -    }
 -
     bdrv_graph_rdlock_main_loop();
 -    is_none_mode = mode == MIRROR_SYNC_MODE_NONE;
     base = mode == MIRROR_SYNC_MODE_TOP ? bdrv_backing_chain_next(bs) : NULL;
     bdrv_graph_rdunlock_main_loop();
     mirror_start_job(job_id, bs, creation_flags, target, replaces,
                      speed, granularity, buf_size, backing_mode, zero_target,
                      on_source_error, on_target_error, unmap, NULL, NULL,
 -                     &mirror_job_driver, is_none_mode, base, false,
-                     filter_node_name, true, copy_mode, false, errp);
+-                     filter_node_name, true, copy_mode, errp);
 +                     &mirror_job_driver, mode, bitmap, bitmap_mode, base,
-+                     false, filter_node_name, true, copy_mode, false, errp);
+                     false, filter_node_name, true, copy_mode, errp);
 }
 BlockJob *commit_active_start(const char *job_id, BlockDriverState *bs,
-@@ -2063,7 +2121,8 @@ BlockJob *commit_active_start(const char *job_id, BlockDriverState *bs,
+@@ -1906,7 +1965,8 @@ BlockJob *commit_active_start(const char *job_id, BlockDriverState *bs,
                      job_id, bs, creation_flags, base, NULL, speed, 0, 0,
                      MIRROR_LEAVE_BACKING_CHAIN, false,
                      on_error, on_error, true, cb, opaque,
@@ -255,35 +249,36 @@ index 61f0a717b7..83a88562c5 100644
 +                     &commit_active_job_driver, MIRROR_SYNC_MODE_FULL,
 +                     NULL, 0, base, auto_complete,
                      filter_node_name, false, MIRROR_COPY_MODE_BACKGROUND,
-                      base_read_only, errp);
+                      errp);
     if (!job) {
 diff --git a/blockdev.c b/blockdev.c
-index 835064ed03..9b10e3917c 100644
+index 9230888e34..9a1a3118ed 100644
 --- a/blockdev.c
 +++ b/blockdev.c
-@@ -2778,6 +2778,9 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
+@@ -2951,6 +2951,10 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
                                    BlockDriverState *target,
-                                    const char *replaces,
+                                    bool has_replaces, const char *replaces,
                                    enum MirrorSyncMode sync,
 +                                   bool has_bitmap,
 +                                   const char *bitmap_name,
 +                                   bool has_bitmap_mode,
 +                                   BitmapSyncMode bitmap_mode,
                                    BlockMirrorBackingMode backing_mode,
                                    bool zero_target,
                                    bool has_speed, int64_t speed,
-@@ -2796,6 +2799,7 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
+@@ -2970,6 +2974,7 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
 {
     BlockDriverState *unfiltered_bs;
     int job_flags = JOB_DEFAULT;
 +    BdrvDirtyBitmap *bitmap = NULL;
-     GLOBAL_STATE_CODE();
+     if (!has_speed) {
-     GRAPH_RDLOCK_GUARD_MAINLOOP();
+         speed = 0;
-@@ -2850,6 +2854,29 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
+@@ -3024,6 +3029,29 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
         sync = MIRROR_SYNC_MODE_FULL;
     }
-+    if (bitmap_name) {
+    if (has_bitmap) {
 +        if (granularity) {
 +            error_setg(errp, "Granularity and bitmap cannot both be set");
 +            return;
@@ -306,53 +301,53 @@ index 835064ed03..9b10e3917c 100644
 +        }
 +    }
 +
-     if (!replaces) {
+     if (!has_replaces) {
         /* We want to mirror from @bs, but keep implicit filters on top */
         unfiltered_bs = bdrv_skip_implicit_filters(bs);
-@@ -2891,8 +2918,8 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
+@@ -3070,8 +3098,8 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
      * and will allow to check whether the node still exist at mirror completion
      */
     mirror_start(job_id, bs, target,
-                 replaces, job_flags,
+-                 has_replaces ? replaces : NULL, job_flags,
 -                 speed, granularity, buf_size, sync, backing_mode, zero_target,
-+                 replaces, job_flags, speed, granularity, buf_size, sync,
+                 has_replaces ? replaces : NULL, job_flags, speed, granularity,
-+                 bitmap, bitmap_mode, backing_mode, zero_target,
+                 buf_size, sync, bitmap, bitmap_mode, backing_mode, zero_target,
                  on_source_error, on_target_error, unmap, filter_node_name,
                  copy_mode, errp);
 }
-@@ -3036,6 +3063,8 @@ void qmp_drive_mirror(DriveMirror *arg, Error **errp)
+@@ -3216,6 +3244,8 @@ void qmp_drive_mirror(DriveMirror *arg, Error **errp)
-     blockdev_mirror_common(arg->job_id, bs, target_bs,
+     blockdev_mirror_common(arg->has_job_id ? arg->job_id : NULL, bs, target_bs,
-                            arg->replaces, arg->sync,
+                            arg->has_replaces, arg->replaces, arg->sync,
-+                           arg->bitmap,
+                           arg->has_bitmap, arg->bitmap,
 +                           arg->has_bitmap_mode, arg->bitmap_mode,
                            backing_mode, zero_target,
                            arg->has_speed, arg->speed,
                            arg->has_granularity, arg->granularity,
-@@ -3055,6 +3084,8 @@ void qmp_blockdev_mirror(const char *job_id,
+@@ -3237,6 +3267,8 @@ void qmp_blockdev_mirror(bool has_job_id, const char *job_id,
                          const char *device, const char *target,
-                          const char *replaces,
+                          bool has_replaces, const char *replaces,
                          MirrorSyncMode sync,
-+                         const char *bitmap,
+                         bool has_bitmap, const char *bitmap,
 +                         bool has_bitmap_mode, BitmapSyncMode bitmap_mode,
                          bool has_speed, int64_t speed,
                          bool has_granularity, uint32_t granularity,
                          bool has_buf_size, int64_t buf_size,
-@@ -3095,7 +3126,8 @@ void qmp_blockdev_mirror(const char *job_id,
+@@ -3286,7 +3318,8 @@ void qmp_blockdev_mirror(bool has_job_id, const char *job_id,
     }
-     blockdev_mirror_common(job_id, bs, target_bs,
+     blockdev_mirror_common(has_job_id ? job_id : NULL, bs, target_bs,
-                           replaces, sync, backing_mode,
+-                           has_replaces, replaces, sync, backing_mode,
-+                           replaces, sync,
+                           has_replaces, replaces, sync, has_bitmap,
 +                           bitmap, has_bitmap_mode, bitmap_mode, backing_mode,
                            zero_target, has_speed, speed,
                            has_granularity, granularity,
                            has_buf_size, buf_size,
 diff --git a/include/block/block_int-global-state.h b/include/block/block_int-global-state.h
-index eb2d92a226..f0c642b194 100644
+index b49f4eb35b..9d744db618 100644
 --- a/include/block/block_int-global-state.h
 +++ b/include/block/block_int-global-state.h
-@@ -158,7 +158,9 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
+@@ -149,7 +149,9 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
                   BlockDriverState *target, const char *replaces,
                   int creation_flags, int64_t speed,
                   uint32_t granularity, int64_t buf_size,
@@ -364,26 +359,31 @@ index eb2d92a226..f0c642b194 100644
                   BlockdevOnError on_source_error,
                   BlockdevOnError on_target_error,
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index aa40d44f1d..c2a337cc04 100644
+index 2173e7734a..e1857e7094 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -2174,6 +2174,15 @@
+@@ -2000,10 +2000,19 @@
- #     destination (all the disk, only the sectors allocated in the
+ #        (all the disk, only the sectors allocated in the topmost image, or
- #     topmost image, or only new I/O).
+ #        only new I/O).
 #
-+# @bitmap: The name of a bitmap to use for sync=bitmap mode. This
+# @bitmap: The name of a bitmap to use for sync=bitmap mode. This argument must
-+#     argument must be present for bitmap mode and absent otherwise.
+#          be present for bitmap mode and absent otherwise. The bitmap's
-+#     The bitmap's granularity is used instead of @granularity (Since
+#          granularity is used instead of @granularity (since 4.1).
 +#     4.1).
 +#
-+# @bitmap-mode: Specifies the type of data the bitmap should contain
+# @bitmap-mode: Specifies the type of data the bitmap should contain after
-+#     after the operation concludes. Must be present if sync is
+#               the operation concludes. Must be present if sync is "bitmap".
-+#     "bitmap". Must NOT be present otherwise. (Since 4.1)
+#               Must NOT be present otherwise. (Since 4.1)
 +#
- # @granularity: granularity of the dirty bitmap, default is 64K if the
+ # @granularity: granularity of the dirty bitmap, default is 64K
- #     image format doesn't have clusters, 4K if the clusters are
+ #               if the image format doesn't have clusters, 4K if the clusters
- #     smaller than that, else the cluster size.  Must be a power of 2
+ #               are smaller than that, else the cluster size.  Must be a
-@@ -2216,7 +2225,9 @@
+-#               power of 2 between 512 and 64M (since 1.4).
 +#               power of 2 between 512 and 64M. Must not be specified if
 +#               @bitmap is present (since 1.4).
 #
 # @buf-size: maximum amount of data in flight from source to
 #            target (since 1.4).
@@ -2043,7 +2052,9 @@
 { 'struct': 'DriveMirror',
   'data': { '*job-id': 'str', 'device': 'str', 'target': 'str',
             '*format': 'str', '*node-name': 'str', '*replaces': 'str',
@@ -394,23 +394,28 @@ index aa40d44f1d..c2a337cc04 100644
             '*speed': 'int', '*granularity': 'uint32',
             '*buf-size': 'int', '*on-source-error': 'BlockdevOnError',
             '*on-target-error': 'BlockdevOnError',
-@@ -2496,6 +2507,15 @@
+@@ -2322,10 +2333,19 @@
- #     destination (all the disk, only the sectors allocated in the
+ #        (all the disk, only the sectors allocated in the topmost image, or
- #     topmost image, or only new I/O).
+ #        only new I/O).
 #
-+# @bitmap: The name of a bitmap to use for sync=bitmap mode. This
+# @bitmap: The name of a bitmap to use for sync=bitmap mode. This argument must
-+#     argument must be present for bitmap mode and absent otherwise.
+#          be present for bitmap mode and absent otherwise. The bitmap's
-+#     The bitmap's granularity is used instead of @granularity (since
+#          granularity is used instead of @granularity (since 4.1).
 +#     4.1).
 +#
-+# @bitmap-mode: Specifies the type of data the bitmap should contain
+# @bitmap-mode: Specifies the type of data the bitmap should contain after
-+#     after the operation concludes. Must be present if sync is
+#               the operation concludes. Must be present if sync is "bitmap".
-+#     "bitmap". Must NOT be present otherwise. (Since 4.1)
+#               Must NOT be present otherwise. (Since 4.1)
 +#
- # @granularity: granularity of the dirty bitmap, default is 64K if the
+ # @granularity: granularity of the dirty bitmap, default is 64K
- #     image format doesn't have clusters, 4K if the clusters are
+ #               if the image format doesn't have clusters, 4K if the clusters
- #     smaller than that, else the cluster size.  Must be a power of 2
+ #               are smaller than that, else the cluster size.  Must be a
-@@ -2544,7 +2564,8 @@
+-#               power of 2 between 512 and 64M
 +#               power of 2 between 512 and 64M . Must not be specified if
 +#               @bitmap is present.
 #
 # @buf-size: maximum amount of data in flight from source to
 #            target
@@ -2375,7 +2395,8 @@
 { 'command': 'blockdev-mirror',
   'data': { '*job-id': 'str', 'device': 'str', 'target': 'str',
             '*replaces': 'str',
@@ -421,10 +426,10 @@ index aa40d44f1d..c2a337cc04 100644
             '*buf-size': 'int', '*on-source-error': 'BlockdevOnError',
             '*on-target-error': 'BlockdevOnError',
 diff --git a/tests/unit/test-block-iothread.c b/tests/unit/test-block-iothread.c
-index 3766d5de6b..afa44cbd34 100644
+index 8b55eccc89..f4650be8e5 100644
 --- a/tests/unit/test-block-iothread.c
 +++ b/tests/unit/test-block-iothread.c
-@@ -755,8 +755,8 @@ static void test_propagate_mirror(void)
+@@ -753,8 +753,8 @@ static void test_propagate_mirror(void)
     /* Start a mirror job */
     mirror_start("job0", src, target, NULL, JOB_DEFAULT, 0, 0, 0,
@@ -434,4 +439,4 @@ index 3766d5de6b..afa44cbd34 100644
 +                 false, BLOCKDEV_ON_ERROR_REPORT, BLOCKDEV_ON_ERROR_REPORT,
                  false, "filter_node", MIRROR_COPY_MODE_BACKGROUND,
                  &error_abort);
- 
+     job = job_get("job0");
--- a/debian/patches/bitmap-mirror/0002-drive-mirror-add-support-for-conditional-and-always-.patch
+++ b/debian/patches/bitmap-mirror/0002-drive-mirror-add-support-for-conditional-and-always-.patch
@@ -24,10 +24,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 1 file changed, 18 insertions(+), 6 deletions(-)
 diff --git a/block/mirror.c b/block/mirror.c
-index 83a88562c5..fc439ea936 100644
+index f2eca983f1..b6475d50ad 100644
 --- a/block/mirror.c
 +++ b/block/mirror.c
-@@ -694,8 +694,6 @@ static int mirror_exit_common(Job *job)
+@@ -673,8 +673,6 @@ static int mirror_exit_common(Job *job)
         bdrv_unfreeze_backing_chain(mirror_top_bs, target_bs);
     }
@@ -36,9 +36,9 @@ index 83a88562c5..fc439ea936 100644
     /* Make sure that the source BDS doesn't go away during bdrv_replace_node,
      * before we can call bdrv_drained_end */
     bdrv_ref(src);
-@@ -805,6 +803,18 @@ static int mirror_exit_common(Job *job)
+@@ -775,6 +773,18 @@ static int mirror_exit_common(Job *job)
-     bdrv_drained_end(target_bs);
+     block_job_remove_all_bdrv(bjob);
-     bdrv_unref(target_bs);
+     bdrv_replace_node(mirror_top_bs, mirror_top_bs->backing->bs, &error_abort);
 +    if (s->sync_bitmap) {
 +        if (s->bitmap_mode == BITMAP_SYNC_MODE_ALWAYS ||
@@ -55,7 +55,7 @@ index 83a88562c5..fc439ea936 100644
     bs_opaque->job = NULL;
     bdrv_drained_end(src);
-@@ -1763,10 +1773,6 @@ static BlockJob *mirror_start_job(
+@@ -1634,10 +1644,6 @@ static BlockJob *mirror_start_job(
                        " sync mode",
                        MirrorSyncMode_str(sync_mode));
             return NULL;
@@ -66,7 +66,7 @@ index 83a88562c5..fc439ea936 100644
         }
     } else if (bitmap) {
         error_setg(errp,
-@@ -1783,6 +1789,12 @@ static BlockJob *mirror_start_job(
+@@ -1654,6 +1660,12 @@ static BlockJob *mirror_start_job(
             return NULL;
         }
         granularity = bdrv_dirty_bitmap_granularity(bitmap);
--- a/debian/patches/bitmap-mirror/0003-mirror-add-check-for-bitmap-mode-without-bitmap.patch
+++ b/debian/patches/bitmap-mirror/0003-mirror-add-check-for-bitmap-mode-without-bitmap.patch
@@ -16,10 +16,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 1 file changed, 3 insertions(+)
 diff --git a/blockdev.c b/blockdev.c
-index 9b10e3917c..c3fa897289 100644
+index 9a1a3118ed..a57b0af2e7 100644
 --- a/blockdev.c
 +++ b/blockdev.c
-@@ -2875,6 +2875,9 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
+@@ -3050,6 +3050,9 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
         if (bdrv_dirty_bitmap_check(bitmap, BDRV_BITMAP_ALLOW_RO, errp)) {
             return;
         }
@@ -28,4 +28,4 @@ index 9b10e3917c..c3fa897289 100644
 +        return;
     }
-     if (!replaces) {
+     if (!has_replaces) {
--- a/debian/patches/bitmap-mirror/0004-mirror-switch-to-bdrv_dirty_bitmap_merge_internal.patch
+++ b/debian/patches/bitmap-mirror/0004-mirror-switch-to-bdrv_dirty_bitmap_merge_internal.patch
@@ -16,10 +16,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 1 file changed, 4 insertions(+), 7 deletions(-)
 diff --git a/block/mirror.c b/block/mirror.c
-index fc439ea936..cde5d710fd 100644
+index b6475d50ad..8b3342f9ec 100644
 --- a/block/mirror.c
 +++ b/block/mirror.c
-@@ -809,8 +809,8 @@ static int mirror_exit_common(Job *job)
+@@ -779,8 +779,8 @@ static int mirror_exit_common(Job *job)
              job->ret == 0 && ret == 0)) {
             /* Success; synchronize copy back to sync. */
             bdrv_clear_dirty_bitmap(s->sync_bitmap, NULL);
@@ -30,7 +30,7 @@ index fc439ea936..cde5d710fd 100644
         }
     }
     bdrv_release_dirty_bitmap(s->dirty_bitmap);
-@@ -1971,11 +1971,8 @@ static BlockJob *mirror_start_job(
+@@ -1828,11 +1828,8 @@ static BlockJob *mirror_start_job(
     }
     if (s->sync_mode == MIRROR_SYNC_MODE_BITMAP) {
@@ -43,4 +43,4 @@ index fc439ea936..cde5d710fd 100644
 +                                         NULL, true);
     }
-     bdrv_graph_wrlock();
+     ret = block_job_add_bdrv(&s->common, "source", bs, 0,
--- a/debian/patches/bitmap-mirror/0006-mirror-move-some-checks-to-qmp.patch
+++ b/debian/patches/bitmap-mirror/0006-mirror-move-some-checks-to-qmp.patch
@@ -12,8 +12,6 @@ uniform w.r.t. backup block jobs.
 Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 [FE: rebase for 8.2.2]
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 block/mirror.c             | 28 +++------------
 blockdev.c                 | 29 +++++++++++++++
@@ -21,12 +19,12 @@ Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 3 files changed, 70 insertions(+), 59 deletions(-)
 diff --git a/block/mirror.c b/block/mirror.c
-index cde5d710fd..e20f50e5fb 100644
+index 8b3342f9ec..1d4ff0efad 100644
 --- a/block/mirror.c
 +++ b/block/mirror.c
-@@ -1763,31 +1763,13 @@ static BlockJob *mirror_start_job(
+@@ -1634,31 +1634,13 @@ static BlockJob *mirror_start_job(
- 
+     uint64_t target_perms, target_shared_perms;
-     GLOBAL_STATE_CODE();
+     int ret;
 -    if (sync_mode == MIRROR_SYNC_MODE_INCREMENTAL) {
 -        error_setg(errp, "Sync mode '%s' not supported",
@@ -62,17 +60,17 @@ index cde5d710fd..e20f50e5fb 100644
         if (bitmap_mode != BITMAP_SYNC_MODE_NEVER) {
 diff --git a/blockdev.c b/blockdev.c
-index c3fa897289..9cbd166674 100644
+index a57b0af2e7..ce62a9b439 100644
 --- a/blockdev.c
 +++ b/blockdev.c
-@@ -2854,7 +2854,36 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
+@@ -3029,7 +3029,36 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
         sync = MIRROR_SYNC_MODE_FULL;
     }
 +    if ((sync == MIRROR_SYNC_MODE_BITMAP) ||
 +        (sync == MIRROR_SYNC_MODE_INCREMENTAL)) {
 +        /* done before desugaring 'incremental' to print the right message */
-+        if (!bitmap_name) {
+        if (!has_bitmap) {
 +            error_setg(errp, "Must provide a valid bitmap name for "
 +                       "'%s' sync mode", MirrorSyncMode_str(sync));
 +            return;
@@ -93,7 +91,7 @@ index c3fa897289..9cbd166674 100644
 +        bitmap_mode = BITMAP_SYNC_MODE_ON_SUCCESS;
 +    }
 +
-     if (bitmap_name) {
+     if (has_bitmap) {
 +        if (sync != MIRROR_SYNC_MODE_BITMAP) {
 +            error_setg(errp, "Sync mode '%s' not supported with bitmap.",
 +                       MirrorSyncMode_str(sync));
--- a/debian/patches/extra/0001-monitor-qmp-fix-race-with-clients-disconnecting-earl.patch
+++ b/debian/patches/extra/0001-monitor-qmp-fix-race-with-clients-disconnecting-earl.patch
@@ -48,7 +48,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 6 files changed, 59 insertions(+), 5 deletions(-)
 diff --git a/include/monitor/monitor.h b/include/monitor/monitor.h
-index c3740ec616..7f38ce6b8b 100644
+index a4b40e8391..d64ae8f34e 100644
 --- a/include/monitor/monitor.h
 +++ b/include/monitor/monitor.h
@@ -16,6 +16,7 @@ extern QemuOptsList qemu_mon_opts;
@@ -60,10 +60,10 @@ index c3740ec616..7f38ce6b8b 100644
 void monitor_init_globals(void);
 void monitor_init_globals_core(void);
 diff --git a/monitor/monitor-internal.h b/monitor/monitor-internal.h
-index cb628f681d..93dbd62fc2 100644
+index caa2e90ef2..e1596f79ab 100644
 --- a/monitor/monitor-internal.h
 +++ b/monitor/monitor-internal.h
-@@ -151,6 +151,13 @@ typedef struct {
+@@ -152,6 +152,13 @@ typedef struct {
     QemuMutex qmp_queue_lock;
     /* Input queue that holds all the parsed QMP requests */
     GQueue *qmp_requests;
@@ -78,10 +78,10 @@ index cb628f681d..93dbd62fc2 100644
 /**
 diff --git a/monitor/monitor.c b/monitor/monitor.c
-index db52a9c7ef..2d63959351 100644
+index 86949024f6..c306cadcf4 100644
 --- a/monitor/monitor.c
 +++ b/monitor/monitor.c
-@@ -116,6 +116,21 @@ bool monitor_cur_is_qmp(void)
+@@ -135,6 +135,21 @@ bool monitor_cur_is_qmp(void)
     return cur_mon && monitor_is_qmp(cur_mon);
 }
@@ -104,10 +104,10 @@ index db52a9c7ef..2d63959351 100644
  * Is @mon is using readline?
  * Note: not all HMP monitors use readline, e.g., gdbserver has a
 diff --git a/monitor/qmp.c b/monitor/qmp.c
-index 5e538f34c0..eb181d5979 100644
+index 092c527b6f..6b8cfcf6d8 100644
 --- a/monitor/qmp.c
 +++ b/monitor/qmp.c
-@@ -165,6 +165,8 @@ static void monitor_qmp_dispatch(MonitorQMP *mon, QObject *req)
+@@ -141,6 +141,8 @@ static void monitor_qmp_dispatch(MonitorQMP *mon, QObject *req)
     QDict *rsp;
     QDict *error;
@@ -116,7 +116,7 @@ index 5e538f34c0..eb181d5979 100644
     rsp = qmp_dispatch(mon->commands, req, qmp_oob_enabled(mon),
                        &mon->common);
-@@ -180,7 +182,17 @@ static void monitor_qmp_dispatch(MonitorQMP *mon, QObject *req)
+@@ -156,7 +158,17 @@ static void monitor_qmp_dispatch(MonitorQMP *mon, QObject *req)
         }
     }
@@ -135,7 +135,7 @@ index 5e538f34c0..eb181d5979 100644
     qobject_unref(rsp);
 }
-@@ -461,6 +473,7 @@ static void monitor_qmp_event(void *opaque, QEMUChrEvent event)
+@@ -444,6 +456,7 @@ static void monitor_qmp_event(void *opaque, QEMUChrEvent event)
     switch (event) {
     case CHR_EVENT_OPENED:
@@ -144,7 +144,7 @@ index 5e538f34c0..eb181d5979 100644
         monitor_qmp_caps_reset(mon);
         data = qmp_greeting(mon);
 diff --git a/qapi/qmp-dispatch.c b/qapi/qmp-dispatch.c
-index 176b549473..790bb7d1da 100644
+index 0990873ec8..e605003771 100644
 --- a/qapi/qmp-dispatch.c
 +++ b/qapi/qmp-dispatch.c
@@ -117,16 +117,28 @@ typedef struct QmpDispatchBH {
@@ -180,16 +180,16 @@ index 176b549473..790bb7d1da 100644
     aio_co_wake(data->co);
 }
-@@ -253,6 +265,7 @@ QDict *coroutine_mixed_fn qmp_dispatch(const QmpCommandList *cmds, QObject *requ
+@@ -231,6 +243,7 @@ QDict *qmp_dispatch(const QmpCommandList *cmds, QObject *request,
             .ret        = &ret,
             .errp       = &err,
             .co         = qemu_coroutine_self(),
 +            .conn_nr    = monitor_get_connection_nr(cur_mon),
         };
-         aio_bh_schedule_oneshot(iohandler_get_aio_context(), do_qmp_dispatch_bh,
+         aio_bh_schedule_oneshot(qemu_get_aio_context(), do_qmp_dispatch_bh,
                                 &data);
 diff --git a/stubs/monitor-core.c b/stubs/monitor-core.c
-index 1894cdfe1f..d74d0459f0 100644
+index afa477aae6..d3ff124bf3 100644
 --- a/stubs/monitor-core.c
 +++ b/stubs/monitor-core.c
@@ -12,6 +12,11 @@ Monitor *monitor_set_cur(Coroutine *co, Monitor *mon)
@@ -201,6 +201,6 @@ index 1894cdfe1f..d74d0459f0 100644
 +    return -1;
 +}
 +
- void qapi_event_emit(QAPIEvent event, QDict *qdict)
+ void monitor_init_qmp(Chardev *chr, bool pretty, Error **errp)
 {
 }
--- a/debian/patches/extra/0002-block-io_uring-revert-Use-io_uring_register_ring_fd-.patch
+++ b/debian/patches/extra/0002-block-io_uring-revert-Use-io_uring_register_ring_fd-.patch
@@ -0,0 +1,76 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Sam Li <faithilikerun@gmail.com>
 Date: Sat, 24 Sep 2022 22:48:15 +0800
 Subject: [PATCH] block/io_uring: revert "Use io_uring_register_ring_fd() to
 skip fd operations"
 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1193
 The commit "Use io_uring_register_ring_fd() to skip fd operations" broke
 when booting a guest with iothread and io_uring. That is because the
 io_uring_register_ring_fd() call is made from the main thread instead of
 IOThread where io_uring_submit() is called. It can not be guaranteed
 to register the ring fd in the correct thread or unregister the same ring
 fd if the IOThread is disabled. This optimization is not critical so we
 will revert previous commit.
 This reverts commit e2848bc574fe2715c694bf8fe9a1ba7f78a1125a
 and 77e3f038af1764983087e3551a0fde9951952c4d.
 Signed-off-by: Sam Li <faithilikerun@gmail.com>
 ---
 block/io_uring.c | 13 +------------
 meson.build      |  1 -
 2 files changed, 1 insertion(+), 13 deletions(-)
 diff --git a/block/io_uring.c b/block/io_uring.c
 index a1760152e0..973e15d876 100644
 --- a/block/io_uring.c
 +++ b/block/io_uring.c
@@ -11,7 +11,6 @@
 #include "qemu/osdep.h"
 #include <liburing.h>
 #include "block/aio.h"
 -#include "qemu/error-report.h"
 #include "qemu/queue.h"
 #include "block/block.h"
 #include "block/raw-aio.h"
@@ -19,7 +18,6 @@
 #include "qapi/error.h"
 #include "trace.h"
 -
 /* io_uring ring size */
 #define MAX_ENTRIES 128
@@ -432,17 +430,8 @@ LuringState *luring_init(Error **errp)
     }
     ioq_init(&s->io_q);
 -#ifdef CONFIG_LIBURING_REGISTER_RING_FD
 -    if (io_uring_register_ring_fd(&s->ring) < 0) {
 -        /*
 -         * Only warn about this error: we will fallback to the non-optimized
 -         * io_uring operations.
 -         */
 -        warn_report("failed to register linux io_uring ring file descriptor");
 -    }
 -#endif
 -
     return s;
 +
 }
 void luring_cleanup(LuringState *s)
 diff --git a/meson.build b/meson.build
 index 20fddbd707..d5230eadd6 100644
 --- a/meson.build
 +++ b/meson.build
@@ -1793,7 +1793,6 @@ config_host_data.set('CONFIG_LIBNFS', libnfs.found())
 config_host_data.set('CONFIG_LIBSSH', libssh.found())
 config_host_data.set('CONFIG_LINUX_AIO', libaio.found())
 config_host_data.set('CONFIG_LINUX_IO_URING', linux_io_uring.found())
 -config_host_data.set('CONFIG_LIBURING_REGISTER_RING_FD', cc.has_function('io_uring_register_ring_fd', prefix: '#include <liburing.h>', dependencies:linux_io_uring))
 config_host_data.set('CONFIG_LIBPMEM', libpmem.found())
 config_host_data.set('CONFIG_NUMA', numa.found())
 config_host_data.set('CONFIG_OPENGL', opengl.found())
--- a/debian/patches/extra/0002-scsi-megasas-Internal-cdbs-have-16-byte-length.patch
+++ b/debian/patches/extra/0002-scsi-megasas-Internal-cdbs-have-16-byte-length.patch
@@ -1,69 +0,0 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Guenter Roeck <linux@roeck-us.net>
 Date: Tue, 28 Feb 2023 09:11:29 -0800
 Subject: [PATCH] scsi: megasas: Internal cdbs have 16-byte length
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Host drivers do not necessarily set cdb_len in megasas io commands.
 With commits 6d1511cea0 ("scsi: Reject commands if the CDB length
 exceeds buf_len") and fe9d8927e2 ("scsi: Add buf_len parameter to
 scsi_req_new()"), this results in failures to boot Linux from affected
 SCSI drives because cdb_len is set to 0 by the host driver.
 Set the cdb length to its actual size to solve the problem.
 Signed-off-by: Guenter Roeck <linux@roeck-us.net>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 (picked-up from https://lists.nongnu.org/archive/html/qemu-devel/2023-02/msg08653.html)
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 hw/scsi/megasas.c | 14 ++------------
 1 file changed, 2 insertions(+), 12 deletions(-)
 diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
 index 2d0c607177..97e51733af 100644
 --- a/hw/scsi/megasas.c
 +++ b/hw/scsi/megasas.c
@@ -1781,7 +1781,7 @@ static int megasas_handle_io(MegasasState *s, MegasasCmd *cmd, int frame_cmd)
     uint8_t cdb[16];
     int len;
     struct SCSIDevice *sdev = NULL;
 -    int target_id, lun_id, cdb_len;
 +    int target_id, lun_id;
     lba_count = le32_to_cpu(cmd->frame->io.header.data_len);
     lba_start_lo = le32_to_cpu(cmd->frame->io.lba_lo);
@@ -1790,7 +1790,6 @@ static int megasas_handle_io(MegasasState *s, MegasasCmd *cmd, int frame_cmd)
     target_id = cmd->frame->header.target_id;
     lun_id = cmd->frame->header.lun_id;
 -    cdb_len = cmd->frame->header.cdb_len;
     if (target_id < MFI_MAX_LD && lun_id == 0) {
         sdev = scsi_device_find(&s->bus, 0, target_id, lun_id);
@@ -1805,15 +1804,6 @@ static int megasas_handle_io(MegasasState *s, MegasasCmd *cmd, int frame_cmd)
         return MFI_STAT_DEVICE_NOT_FOUND;
     }
 -    if (cdb_len > 16) {
 -        trace_megasas_scsi_invalid_cdb_len(
 -            mfi_frame_desc(frame_cmd), 1, target_id, lun_id, cdb_len);
 -        megasas_write_sense(cmd, SENSE_CODE(INVALID_OPCODE));
 -        cmd->frame->header.scsi_status = CHECK_CONDITION;
 -        s->event_count++;
 -        return MFI_STAT_SCSI_DONE_WITH_ERROR;
 -    }
 -
     cmd->iov_size = lba_count * sdev->blocksize;
     if (megasas_map_sgl(s, cmd, &cmd->frame->io.sgl)) {
         megasas_write_sense(cmd, SENSE_CODE(TARGET_FAILURE));
@@ -1824,7 +1814,7 @@ static int megasas_handle_io(MegasasState *s, MegasasCmd *cmd, int frame_cmd)
     megasas_encode_lba(cdb, lba_start, lba_count, is_write);
     cmd->req = scsi_req_new(sdev, cmd->index,
 -                            lun_id, cdb, cdb_len, cmd);
 +                            lun_id, cdb, sizeof(cdb), cmd);
     if (!cmd->req) {
         trace_megasas_scsi_req_alloc_failed(
             mfi_frame_desc(frame_cmd), target_id, lun_id);
--- a/debian/patches/extra/0003-ide-avoid-potential-deadlock-when-draining-during-tr.patch
+++ b/debian/patches/extra/0003-ide-avoid-potential-deadlock-when-draining-during-tr.patch
@@ -1,100 +0,0 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Fiona Ebner <f.ebner@proxmox.com>
 Date: Tue, 7 Mar 2023 15:03:02 +0100
 Subject: [PATCH] ide: avoid potential deadlock when draining during trim
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 The deadlock can happen as follows:
 1. ide_issue_trim is called, and increments the in_flight counter.
 2. ide_issue_trim_cb calls blk_aio_pdiscard.
 3. Somebody else starts draining (e.g. backup to insert the cbw node).
 4. ide_issue_trim_cb is called as the completion callback for
   blk_aio_pdiscard.
 5. ide_issue_trim_cb issues yet another blk_aio_pdiscard request.
 6. The request is added to the wait queue via blk_wait_while_drained,
   because draining has been started.
 7. Nobody ever decrements the in_flight counter and draining can't
   finish. This would be done by ide_trim_bh_cb, which is called after
   ide_issue_trim_cb has issued its last request, but
   ide_issue_trim_cb is not called anymore, because it's the
   completion callback of blk_aio_pdiscard, which waits on draining.
 Quoting Hanna Czenczek:
 > The point of 7e5cdb345f was that we need any in-flight count to
 > accompany a set s->bus->dma->aiocb. While blk_aio_pdiscard() is
 > happening, we don’t necessarily need another count. But we do need
 > it while there is no blk_aio_pdiscard().
 > ide_issue_trim_cb() returns in two cases (and, recursively through
 > its callers, leaves s->bus->dma->aiocb set):
 > 1. After calling blk_aio_pdiscard(), which will keep an in-flight
 >    count,
 > 2. After calling replay_bh_schedule_event() (i.e.
 >    qemu_bh_schedule()), which does not keep an in-flight count.
 Thus, even after moving the blk_inc_in_flight to above the
 replay_bh_schedule_event call, the invariant "ide_issue_trim_cb
 returns with an accompanying in-flight count" is still satisfied.
 However, the issue 7e5cdb345f fixed for canceling resurfaces, because
 ide_cancel_dma_sync assumes that it just needs to drain once. But now
 the in_flight count is not consistently > 0 during the trim operation.
 So, change it to drain until !s->bus->dma->aiocb, which means that the
 operation finished (s->bus->dma->aiocb is cleared by ide_set_inactive
 via the ide_dma_cb when the end of the transfer is reached).
 Discussion here:
 https://lists.nongnu.org/archive/html/qemu-devel/2023-03/msg02506.html
 Fixes: 7e5cdb345f ("ide: Increment BB in-flight counter for TRIM BH")
 Suggested-by: Hanna Czenczek <hreitz@redhat.com>
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 hw/ide/core.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)
 diff --git a/hw/ide/core.c b/hw/ide/core.c
 index 08d9218455..20d8c0cf66 100644
 --- a/hw/ide/core.c
 +++ b/hw/ide/core.c
@@ -456,7 +456,7 @@ static void ide_trim_bh_cb(void *opaque)
     iocb->bh = NULL;
     qemu_aio_unref(iocb);
 -    /* Paired with an increment in ide_issue_trim() */
 +    /* Paired with an increment in ide_issue_trim_cb() */
     blk_dec_in_flight(blk);
 }
@@ -516,6 +516,8 @@ static void ide_issue_trim_cb(void *opaque, int ret)
 done:
     iocb->aiocb = NULL;
     if (iocb->bh) {
 +        /* Paired with a decrement in ide_trim_bh_cb() */
 +        blk_inc_in_flight(s->blk);
         replay_bh_schedule_event(iocb->bh);
     }
 }
@@ -528,9 +530,6 @@ BlockAIOCB *ide_issue_trim(
     IDEDevice *dev = s->unit ? s->bus->slave : s->bus->master;
     TrimAIOCB *iocb;
 -    /* Paired with a decrement in ide_trim_bh_cb() */
 -    blk_inc_in_flight(s->blk);
 -
     iocb = blk_aio_get(&trim_aiocb_info, s->blk, cb, cb_opaque);
     iocb->s = s;
     iocb->bh = qemu_bh_new_guarded(ide_trim_bh_cb, iocb,
@@ -754,8 +753,9 @@ void ide_cancel_dma_sync(IDEState *s)
      */
     if (s->bus->dma->aiocb) {
         trace_ide_cancel_dma_sync_remaining();
 -        blk_drain(s->blk);
 -        assert(s->bus->dma->aiocb == NULL);
 +        while (s->bus->dma->aiocb) {
 +            blk_drain(s->blk);
 +        }
     }
 }
--- a/debian/patches/extra/0003-virtiofsd-use-g_date_time_get_microsecond-to-get-sub.patch
+++ b/debian/patches/extra/0003-virtiofsd-use-g_date_time_get_microsecond-to-get-sub.patch
@@ -0,0 +1,51 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Yusuke Okada <okada.yusuke@jp.fujitsu.com>
 Date: Thu, 18 Aug 2022 14:46:19 -0400
 Subject: [PATCH] virtiofsd: use g_date_time_get_microsecond to get subsecond
 The "%f" specifier in g_date_time_format() is only available in glib
 2.65.2 or later. If combined with older glib, the function returns null
 and the timestamp displayed as "(null)".
 For backward compatibility, g_date_time_get_microsecond should be used
 to retrieve subsecond.
 In this patch the g_date_time_format() leaves subsecond field as "%06d"
 and let next snprintf to format with g_date_time_get_microsecond.
 Signed-off-by: Yusuke Okada <okada.yusuke@jp.fujitsu.com>
 Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Message-id: 20220818184618.2205172-1-yokada.996@gmail.com
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 (cherry-picked from commit f16d15c9276bd8f501f861c39cbd4adc812d0c1d)
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 tools/virtiofsd/passthrough_ll.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)
 diff --git a/tools/virtiofsd/passthrough_ll.c b/tools/virtiofsd/passthrough_ll.c
 index 371a7bead6..20f0f41f99 100644
 --- a/tools/virtiofsd/passthrough_ll.c
 +++ b/tools/virtiofsd/passthrough_ll.c
@@ -4185,6 +4185,7 @@ static void setup_nofile_rlimit(unsigned long rlimit_nofile)
 static void log_func(enum fuse_log_level level, const char *fmt, va_list ap)
 {
     g_autofree char *localfmt = NULL;
 +    char buf[64];
     if (current_log_level < level) {
         return;
@@ -4197,9 +4198,11 @@ static void log_func(enum fuse_log_level level, const char *fmt, va_list ap)
                                        fmt);
         } else {
             g_autoptr(GDateTime) now = g_date_time_new_now_utc();
 -            g_autofree char *nowstr = g_date_time_format(now, "%Y-%m-%d %H:%M:%S.%f%z");
 +            g_autofree char *nowstr = g_date_time_format(now,
 +                                       "%Y-%m-%d %H:%M:%S.%%06d%z");
 +            snprintf(buf, 64, nowstr, g_date_time_get_microsecond(now));
             localfmt = g_strdup_printf("[%s] [ID: %08ld] %s",
 -                                       nowstr, syscall(__NR_gettid), fmt);
 +                                       buf, syscall(__NR_gettid), fmt);
         }
         fmt = localfmt;
     }
--- a/debian/patches/extra/0004-Revert-x86-acpi-workaround-Windows-not-handling-name.patch
+++ b/debian/patches/extra/0004-Revert-x86-acpi-workaround-Windows-not-handling-name.patch
@@ -1,45 +0,0 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Fiona Ebner <f.ebner@proxmox.com>
 Date: Fri, 17 Nov 2023 11:18:06 +0100
 Subject: [PATCH] Revert "x86: acpi: workaround Windows not handling name
 references in Package properly"
 This reverts commit 44d975ef340e2f21f236f9520c53e1b30d2213a4.
 As reported in the community forum [0] and reproduced locally this
 breaks VirtIO network adapters in (at least) the German ISO of Windows
 Server 2022. The fix itself was for
 > Issue is not fatal but as result acpi-index/"PCI Label ID" property
 > is either not shown in device details page or shows incorrect value.
 so revert and tolerate that as a stop-gap, rather than have the
 devices not working at all.
 [0]: https://forum.proxmox.com/threads/92094/post-605684
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 hw/i386/acpi-build.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)
 diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
 index 5d4bd2b710..67194bb705 100644
 --- a/hw/i386/acpi-build.c
 +++ b/hw/i386/acpi-build.c
@@ -346,13 +346,9 @@ Aml *aml_pci_device_dsm(void)
     {
         Aml *params = aml_local(0);
         Aml *pkg = aml_package(2);
 -        aml_append(pkg, aml_int(0));
 -        aml_append(pkg, aml_int(0));
 +        aml_append(pkg, aml_name("BSEL"));
 +        aml_append(pkg, aml_name("ASUN"));
         aml_append(method, aml_store(pkg, params));
 -        aml_append(method,
 -            aml_store(aml_name("BSEL"), aml_index(params, aml_int(0))));
 -        aml_append(method,
 -            aml_store(aml_name("ASUN"), aml_index(params, aml_int(1))));
         aml_append(method,
             aml_return(aml_call5("PDSM", aml_arg(0), aml_arg(1),
                                  aml_arg(2), aml_arg(3), params))
--- a/debian/patches/extra/0004-chardev-fix-segfault-in-finalize.patch
+++ b/debian/patches/extra/0004-chardev-fix-segfault-in-finalize.patch
@@ -0,0 +1,56 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Maksim Davydov <davydov-max@yandex-team.ru>
 Date: Thu, 25 Aug 2022 19:52:47 +0300
 Subject: [PATCH] chardev: fix segfault in finalize
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 If finalize chardev-msmouse or chardev-wctable is called immediately after
 init it cases QEMU to crash with segfault. This happens because of
 QTAILQ_REMOVE in qemu_input_handler_unregister tries to dereference
 NULL pointer.
 For instance, this error can be reproduced via `qom-list-properties`
 command.
 Signed-off-by: Maksim Davydov <davydov-max@yandex-team.ru>
 Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
 Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
 Message-Id: <20220825165247.33704-1-davydov-max@yandex-team.ru>
 (trivial backport from fc0c128531ed55f058bfbad4f1348ebd9a0187f2)
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 chardev/msmouse.c  | 4 +++-
 chardev/wctablet.c | 4 +++-
 2 files changed, 6 insertions(+), 2 deletions(-)
 diff --git a/chardev/msmouse.c b/chardev/msmouse.c
 index eb9231dcdb..2cc1b16561 100644
 --- a/chardev/msmouse.c
 +++ b/chardev/msmouse.c
@@ -146,7 +146,9 @@ static void char_msmouse_finalize(Object *obj)
 {
     MouseChardev *mouse = MOUSE_CHARDEV(obj);
 -    qemu_input_handler_unregister(mouse->hs);
 +    if (mouse->hs) {
 +        qemu_input_handler_unregister(mouse->hs);
 +    }
 }
 static QemuInputHandler msmouse_handler = {
 diff --git a/chardev/wctablet.c b/chardev/wctablet.c
 index e8b292c43c..43bdf6b608 100644
 --- a/chardev/wctablet.c
 +++ b/chardev/wctablet.c
@@ -319,7 +319,9 @@ static void wctablet_chr_finalize(Object *obj)
 {
     TabletChardev *tablet = WCTABLET_CHARDEV(obj);
 -    qemu_input_handler_unregister(tablet->hs);
 +    if (tablet->hs) {
 +        qemu_input_handler_unregister(tablet->hs);
 +    }
 }
 static void wctablet_chr_open(Chardev *chr,
--- a/debian/patches/extra/0005-init-daemonize-defuse-PID-file-resolve-error.patch
+++ b/debian/patches/extra/0005-init-daemonize-defuse-PID-file-resolve-error.patch
@@ -0,0 +1,42 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Fiona Ebner <f.ebner@proxmox.com>
 Date: Fri, 28 Oct 2022 10:09:46 +0200
 Subject: [PATCH] init: daemonize: defuse PID file resolve error
 When proxmox-file-restore invokes QEMU, the PID file is a (temporary)
 file that's already unlinked, so resolving the absolute path here
 failed.
 It should not be a critical error when the PID file unlink handler
 can't be registered, because the path can't be resolved for whatever
 reason. If the file is already gone from QEMU's perspective (i.e.
 errno is ENOENT), silently ignore the error. Otherwise, print a
 warning.
 Reported-by: Dominik Csapak <d.csapak@proxmox.com>
 Suggested-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 softmmu/vl.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)
 diff --git a/softmmu/vl.c b/softmmu/vl.c
 index 706bd7cff7..3381c56af7 100644
 --- a/softmmu/vl.c
 +++ b/softmmu/vl.c
@@ -2438,10 +2438,11 @@ static void qemu_maybe_daemonize(const char *pid_file)
         pid_file_realpath = g_malloc0(PATH_MAX);
         if (!realpath(pid_file, pid_file_realpath)) {
 -            error_report("cannot resolve PID file path: %s: %s",
 -                         pid_file, strerror(errno));
 -            unlink(pid_file);
 -            exit(1);
 +            if (errno != ENOENT) {
 +                warn_report("not removing PID file on exit: cannot resolve PID "
 +                            "file path: %s: %s", pid_file, strerror(errno));
 +            }
 +            return;
         }
         qemu_unlink_pidfile_notifier = (struct UnlinkPidfileNotifier) {
--- a/debian/patches/extra/0005-virtio-net-Add-queues-before-loading-them.patch
+++ b/debian/patches/extra/0005-virtio-net-Add-queues-before-loading-them.patch
@@ -1,81 +0,0 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Akihiko Odaki <akihiko.odaki@daynix.com>
 Date: Tue, 22 Oct 2024 15:49:01 +0900
 Subject: [PATCH] virtio-net: Add queues before loading them
 Call virtio_net_set_multiqueue() to add queues before loading their
 states. Otherwise the loaded queues will not have handlers and elements
 in them will not be processed.
 Cc: qemu-stable@nongnu.org
 Fixes: 8c49756825da ("virtio-net: Add only one queue pair when realizing")
 Reported-by: Laurent Vivier <lvivier@redhat.com>
 Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
 Acked-by: Michael S. Tsirkin <mst@redhat.com>
 (picked from https://lore.kernel.org/qemu-devel/20241022-load-v1-1-99df0bff7939@daynix.com/)
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 hw/net/virtio-net.c        | 10 ++++++++++
 hw/virtio/virtio.c         |  7 +++++++
 include/hw/virtio/virtio.h |  2 ++
 3 files changed, 19 insertions(+)
 diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
 index ed33a32877..90d05f94d4 100644
 --- a/hw/net/virtio-net.c
 +++ b/hw/net/virtio-net.c
@@ -3032,6 +3032,15 @@ static void virtio_net_set_multiqueue(VirtIONet *n, int multiqueue)
     virtio_net_set_queue_pairs(n);
 }
 +static int virtio_net_pre_load_queues(VirtIODevice *vdev)
 +{
 +    virtio_net_set_multiqueue(VIRTIO_NET(vdev),
 +                              virtio_has_feature(vdev->guest_features, VIRTIO_NET_F_RSS) ||
 +                              virtio_has_feature(vdev->guest_features, VIRTIO_NET_F_MQ));
 +
 +    return 0;
 +}
 +
 static int virtio_net_post_load_device(void *opaque, int version_id)
 {
     VirtIONet *n = opaque;
@@ -4010,6 +4019,7 @@ static void virtio_net_class_init(ObjectClass *klass, void *data)
     vdc->guest_notifier_mask = virtio_net_guest_notifier_mask;
     vdc->guest_notifier_pending = virtio_net_guest_notifier_pending;
     vdc->legacy_features |= (0x1 << VIRTIO_NET_F_GSO);
 +    vdc->pre_load_queues = virtio_net_pre_load_queues;
     vdc->post_load = virtio_net_post_load_virtio;
     vdc->vmsd = &vmstate_virtio_net_device;
     vdc->primary_unplug_pending = primary_unplug_pending;
 diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
 index 9e10cbc058..10f24a58dd 100644
 --- a/hw/virtio/virtio.c
 +++ b/hw/virtio/virtio.c
@@ -3251,6 +3251,13 @@ virtio_load(VirtIODevice *vdev, QEMUFile *f, int version_id)
         config_len--;
     }
 +    if (vdc->pre_load_queues) {
 +        ret = vdc->pre_load_queues(vdev);
 +        if (ret) {
 +            return ret;
 +        }
 +    }
 +
     num = qemu_get_be32(f);
     if (num > VIRTIO_QUEUE_MAX) {
 diff --git a/include/hw/virtio/virtio.h b/include/hw/virtio/virtio.h
 index 0fcbc5c0c6..953dfca27c 100644
 --- a/include/hw/virtio/virtio.h
 +++ b/include/hw/virtio/virtio.h
@@ -210,6 +210,8 @@ struct VirtioDeviceClass {
     void (*guest_notifier_mask)(VirtIODevice *vdev, int n, bool mask);
     int (*start_ioeventfd)(VirtIODevice *vdev);
     void (*stop_ioeventfd)(VirtIODevice *vdev);
 +    /* Called before loading queues. Useful to add queues before loading. */
 +    int (*pre_load_queues)(VirtIODevice *vdev);
     /* Saving and loading of a device; trying to deprecate save/load
      * use vmsd for new devices.
      */
--- a/debian/patches/extra/0006-block-block-backend-blk_set_enable_write_cache-is-IO.patch
+++ b/debian/patches/extra/0006-block-block-backend-blk_set_enable_write_cache-is-IO.patch
@@ -0,0 +1,77 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Date: Thu, 27 Oct 2022 03:27:26 -0400
 Subject: [PATCH] block/block-backend: blk_set_enable_write_cache is IO_CODE
 blk_set_enable_write_cache() is defined as GLOBAL_STATE_CODE
 but can be invoked from iothreads when handling scsi requests.
 This triggers an assertion failure:
 0x00007fd6c3515ce1 in raise () from /lib/x86_64-linux-gnu/libc.so.6
 0x00007fd6c34ff537 in abort () from /lib/x86_64-linux-gnu/libc.so.6
 0x00007fd6c34ff40f in ?? () from /lib/x86_64-linux-gnu/libc.so.6
 0x00007fd6c350e662 in __assert_fail () from /lib/x86_64-linux-gnu/libc.so.6
 0x000056149e2cea03 in blk_set_enable_write_cache (wce=true, blk=0x5614a01c27f0)
   at ../src/block/block-backend.c:1949
 0x000056149e2d0a67 in blk_set_enable_write_cache (blk=0x5614a01c27f0,
   wce=<optimized out>) at ../src/block/block-backend.c:1951
 0x000056149dfe9c59 in scsi_disk_apply_mode_select (p=0x7fd6b400c00e "\004",
   page=<optimized out>, s=<optimized out>) at ../src/hw/scsi/scsi-disk.c:1520
 mode_select_pages (change=true, len=18, p=0x7fd6b400c00e "\004", r=0x7fd6b4001ff0)
   at ../src/hw/scsi/scsi-disk.c:1570
 scsi_disk_emulate_mode_select (inbuf=<optimized out>, r=0x7fd6b4001ff0) at
   ../src/hw/scsi/scsi-disk.c:1640
 scsi_disk_emulate_write_data (req=0x7fd6b4001ff0) at ../src/hw/scsi/scsi-disk.c:1934
 0x000056149e18ff16 in virtio_scsi_handle_cmd_req_submit (req=<optimized out>,
   req=<optimized out>, s=0x5614a12f16b0) at ../src/hw/scsi/virtio-scsi.c:719
 virtio_scsi_handle_cmd_vq (vq=0x7fd6bab92140, s=0x5614a12f16b0) at
   ../src/hw/scsi/virtio-scsi.c:761
 virtio_scsi_handle_cmd (vq=<optimized out>, vdev=<optimized out>) at
   ../src/hw/scsi/virtio-scsi.c:775
 virtio_scsi_handle_cmd (vdev=0x5614a12f16b0, vq=0x7fd6bab92140) at
   ../src/hw/scsi/virtio-scsi.c:765
 0x000056149e1a8aa6 in virtio_queue_notify_vq (vq=0x7fd6bab92140) at
   ../src/hw/virtio/virtio.c:2365
 0x000056149e3ccea5 in aio_dispatch_handler (ctx=ctx@entry=0x5614a01babe0,
   node=<optimized out>) at ../src/util/aio-posix.c:369
 0x000056149e3cd868 in aio_dispatch_ready_handlers (ready_list=0x7fd6c09b2680,
   ctx=0x5614a01babe0) at ../src/util/aio-posix.c:399
 aio_poll (ctx=0x5614a01babe0, blocking=blocking@entry=true) at
   ../src/util/aio-posix.c:713
 0x000056149e2a7796 in iothread_run (opaque=opaque@entry=0x56149ffde500) at
   ../src/iothread.c:67
 0x000056149e3d0859 in qemu_thread_start (args=0x7fd6c09b26f0) at
   ../src/util/qemu-thread-posix.c:504
 0x00007fd6c36b9ea7 in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0
 0x00007fd6c35d9aef in clone () from /lib/x86_64-linux-gnu/libc.so.6
 Changing GLOBAL_STATE_CODE in IO_CODE is allowed, since GSC callers are
 allowed to call IO_CODE.
 Resolves: #1272
 Signed-off-by: Emanuele Giuseppe Esposito <eesposit@redhat.com>
 Message-Id: <20221027072726.2681500-1-eesposit@redhat.com>
 Reviewed-by: Kevin Wolf <kwolf@redhat.com>
 Reviewed-by: Hanna Reitz <hreitz@redhat.com>
 Tested-by: Antoine Damhet <antoine.damhet@shadow.tech>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 (cherry picked from commit be8da05b5ed8fb546731b9edb997f303f272bad8)
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
 block/block-backend.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/block/block-backend.c b/block/block-backend.c
 index d4a5df2ac2..1b563e628b 100644
 --- a/block/block-backend.c
 +++ b/block/block-backend.c
@@ -1946,7 +1946,7 @@ bool blk_enable_write_cache(BlockBackend *blk)
 void blk_set_enable_write_cache(BlockBackend *blk, bool wce)
 {
 -    GLOBAL_STATE_CODE();
 +    IO_CODE();
     blk->enable_write_cache = wce;
 }
--- a/debian/patches/extra/0006-virtio-net-Fix-size-check-in-dhclient-workaround.patch
+++ b/debian/patches/extra/0006-virtio-net-Fix-size-check-in-dhclient-workaround.patch
@@ -1,36 +0,0 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Akihiko Odaki <akihiko.odaki@daynix.com>
 Date: Fri, 22 Nov 2024 14:03:08 +0900
 Subject: [PATCH] virtio-net: Fix size check in dhclient workaround
 work_around_broken_dhclient() accesses IP and UDP headers to detect
 relevant packets and to calculate checksums, but it didn't check if
 the packet has size sufficient to accommodate them, causing out-of-bound
 access hazards. Fix this by correcting the size requirement.
 Fixes: 1d41b0c1ec66 ("Work around dhclient brokenness")
 Cc: qemu-stable@nongnu.org
 Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
 (picked from https://lore.kernel.org/qemu-devel/20241122-queue-v3-2-f2ff03b8dbfd@daynix.com/#t)
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 hw/net/virtio-net.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)
 diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
 index 90d05f94d4..c1fe457359 100644
 --- a/hw/net/virtio-net.c
 +++ b/hw/net/virtio-net.c
@@ -1692,8 +1692,11 @@ static void virtio_net_hdr_swap(VirtIODevice *vdev, struct virtio_net_hdr *hdr)
 static void work_around_broken_dhclient(struct virtio_net_hdr *hdr,
                                         uint8_t *buf, size_t size)
 {
 +    size_t csum_size = ETH_HLEN + sizeof(struct ip_header) +
 +                       sizeof(struct udp_header);
 +
     if ((hdr->flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) && /* missing csum */
 -        (size > 27 && size < 1500) && /* normal sized MTU */
 +        (size >= csum_size && size < 1500) && /* normal sized MTU */
         (buf[12] == 0x08 && buf[13] == 0x00) && /* ethertype == IPv4 */
         (buf[23] == 17) && /* ip.protocol == UDP */
         (buf[34] == 0 && buf[35] == 67)) { /* udp.srcport == bootps */
--- a/debian/patches/pve-qemu-7.1-vitastor.patch
+++ b/debian/patches/pve-qemu-7.1-vitastor.patch
@@ -1,8 +1,8 @@
-Index: pve-qemu-kvm-9.1.2/block/meson.build
+Index: qemu/block/meson.build
 ===================================================================
--- pve-qemu-kvm-9.1.2.orig/block/meson.build
+--- qemu.orig/block/meson.build
-+++ pve-qemu-kvm-9.1.2/block/meson.build
+++ qemu/block/meson.build
-@@ -126,6 +126,7 @@ foreach m : [
+@@ -111,6 +111,7 @@ foreach m : [
   [libnfs, 'nfs', files('nfs.c')],
   [libssh, 'ssh', files('ssh.c')],
   [rbd, 'rbd', files('rbd.c')],
@@ -10,18 +10,18 @@ Index: pve-qemu-kvm-9.1.2/block/meson.build
 ]
   if m[0].found()
     module_ss = ss.source_set()
-Index: pve-qemu-kvm-9.1.2/meson.build
+Index: qemu/meson.build
 ===================================================================
--- pve-qemu-kvm-9.1.2.orig/meson.build
+--- qemu.orig/meson.build
-+++ pve-qemu-kvm-9.1.2/meson.build
+++ qemu/meson.build
-@@ -1516,6 +1516,26 @@ if not get_option('rbd').auto() or have_
+@@ -967,6 +967,26 @@ if not get_option('rbd').auto() or have_
   endif
 endif
 +vitastor = not_found
 +if not get_option('vitastor').auto() or have_block
 +  libvitastor_client = cc.find_library('vitastor_client', has_headers: ['vitastor_c.h'],
-+    required: get_option('vitastor'))
+    required: get_option('vitastor'), kwargs: static_kwargs)
 +  if libvitastor_client.found()
 +    if cc.links('''
 +      #include <vitastor_c.h>
@@ -41,27 +41,27 @@ Index: pve-qemu-kvm-9.1.2/meson.build
 glusterfs = not_found
 glusterfs_ftruncate_has_stat = false
 glusterfs_iocb_has_stat = false
-@@ -2367,6 +2387,7 @@ endif
+@@ -1802,6 +1822,7 @@ config_host_data.set('CONFIG_NUMA', numa
 config_host_data.set('CONFIG_OPENGL', opengl.found())
- config_host_data.set('CONFIG_PLUGIN', get_option('plugins'))
+ config_host_data.set('CONFIG_PROFILER', get_option('profiler'))
 config_host_data.set('CONFIG_RBD', rbd.found())
 +config_host_data.set('CONFIG_VITASTOR', vitastor.found())
 config_host_data.set('CONFIG_RDMA', rdma.found())
- config_host_data.set('CONFIG_RELOCATABLE', get_option('relocatable'))
+ config_host_data.set('CONFIG_SDL', sdl.found())
- config_host_data.set('CONFIG_SAFESTACK', get_option('safe_stack'))
+ config_host_data.set('CONFIG_SDL_IMAGE', sdl_image.found())
-@@ -4534,6 +4555,7 @@ summary_info += {'fdt support':       fd
+@@ -3965,6 +3986,7 @@ if spice_protocol.found()
- summary_info += {'libcap-ng support': libcap_ng}
+   summary_info += {'  spice server support': spice}
- summary_info += {'bpf support':       libbpf}
+ endif
 summary_info += {'rbd support':       rbd}
 +summary_info += {'vitastor support':  vitastor}
 summary_info += {'smartcard support': cacard}
 summary_info += {'U2F support':       u2f}
 summary_info += {'libusb':            libusb}
-Index: pve-qemu-kvm-9.1.2/meson_options.txt
+Index: qemu/meson_options.txt
 ===================================================================
--- pve-qemu-kvm-9.1.2.orig/meson_options.txt
+--- qemu.orig/meson_options.txt
-+++ pve-qemu-kvm-9.1.2/meson_options.txt
+++ qemu/meson_options.txt
-@@ -194,6 +194,8 @@ option('lzo', type : 'feature', value :
+@@ -167,6 +167,8 @@ option('lzo', type : 'feature', value :
        description: 'lzo compression support')
 option('rbd', type : 'feature', value : 'auto',
        description: 'Ceph block device driver')
@@ -70,20 +70,20 @@ Index: pve-qemu-kvm-9.1.2/meson_options.txt
 option('opengl', type : 'feature', value : 'auto',
        description: 'OpenGL support')
 option('rdma', type : 'feature', value : 'auto',
-Index: pve-qemu-kvm-9.1.2/qapi/block-core.json
+Index: qemu/qapi/block-core.json
 ===================================================================
--- pve-qemu-kvm-9.1.2.orig/qapi/block-core.json
+--- qemu.orig/qapi/block-core.json
-+++ pve-qemu-kvm-9.1.2/qapi/block-core.json
+++ qemu/qapi/block-core.json
-@@ -3477,7 +3477,7 @@
+@@ -3209,7 +3209,7 @@
-             'raw', 'rbd',
+             'preallocate', 'qcow', 'qcow2', 'qed', 'quorum', 'raw', 'rbd',
             { 'name': 'replication', 'if': 'CONFIG_REPLICATION' },
             'pbs',
-            'ssh', 'throttle', 'vdi', 'vhdx',
+-            'ssh', 'throttle', 'vdi', 'vhdx', 'vmdk', 'vpc', 'vvfat' ] }
-+            'ssh', 'throttle', 'vdi', 'vhdx', 'vitastor',
+            'ssh', 'throttle', 'vdi', 'vhdx', 'vitastor', 'vmdk', 'vpc', 'vvfat' ] }
-             { 'name': 'virtio-blk-vfio-pci', 'if': 'CONFIG_BLKIO' },
+ 
-             { 'name': 'virtio-blk-vhost-user', 'if': 'CONFIG_BLKIO' },
+ ##
-             { 'name': 'virtio-blk-vhost-vdpa', 'if': 'CONFIG_BLKIO' },
+ # @BlockdevOptionsFile:
-@@ -4588,6 +4588,28 @@
+@@ -4149,6 +4149,28 @@
             '*server': ['InetSocketAddressBase'] } }
 ##
@@ -112,15 +112,15 @@ Index: pve-qemu-kvm-9.1.2/qapi/block-core.json
 # @ReplicationMode:
 #
 # An enumeration of replication modes.
-@@ -5050,6 +5072,7 @@
+@@ -4593,6 +4615,7 @@
       'throttle':   'BlockdevOptionsThrottle',
       'vdi':        'BlockdevOptionsGenericFormat',
       'vhdx':       'BlockdevOptionsGenericFormat',
 +      'vitastor':   'BlockdevOptionsVitastor',
-       'virtio-blk-vfio-pci':
+       'vmdk':       'BlockdevOptionsGenericCOWFormat',
-                     { 'type': 'BlockdevOptionsVirtioBlkVfioPci',
+       'vpc':        'BlockdevOptionsGenericFormat',
-                       'if': 'CONFIG_BLKIO' },
+       'vvfat':      'BlockdevOptionsVVFAT'
-@@ -5497,6 +5520,20 @@
+@@ -4985,6 +5008,17 @@
             '*encrypt' :        'RbdEncryptionCreateOptions' } }
 ##
@@ -128,9 +128,6 @@ Index: pve-qemu-kvm-9.1.2/qapi/block-core.json
 +#
 +# Driver specific image creation options for Vitastor.
 +#
 +# @location: Where to store the new image file.  This location cannot
 +#     point to a snapshot.
 +#
 +# @size: Size of the virtual disk in bytes
 +##
 +{ 'struct': 'BlockdevCreateOptionsVitastor',
@@ -141,7 +138,7 @@ Index: pve-qemu-kvm-9.1.2/qapi/block-core.json
 # @BlockdevVmdkSubformat:
 #
 # Subformat options for VMDK images
-@@ -5718,6 +5755,7 @@
+@@ -5182,6 +5216,7 @@
       'ssh':            'BlockdevCreateOptionsSsh',
       'vdi':            'BlockdevCreateOptionsVdi',
       'vhdx':           'BlockdevCreateOptionsVhdx',
@@ -149,32 +146,32 @@ Index: pve-qemu-kvm-9.1.2/qapi/block-core.json
       'vmdk':           'BlockdevCreateOptionsVmdk',
       'vpc':            'BlockdevCreateOptionsVpc'
   } }
-Index: pve-qemu-kvm-9.1.2/scripts/meson-buildoptions.sh
+Index: qemu/scripts/ci/org.centos/stream/8/x86_64/configure
 ===================================================================
--- pve-qemu-kvm-9.1.2.orig/scripts/meson-buildoptions.sh
+--- qemu.orig/scripts/ci/org.centos/stream/8/x86_64/configure
-+++ pve-qemu-kvm-9.1.2/scripts/meson-buildoptions.sh
+++ qemu/scripts/ci/org.centos/stream/8/x86_64/configure
-@@ -168,6 +168,7 @@ meson_options_help() {
+@@ -31,7 +31,7 @@
-   printf "%s\n" '  qga-vss         build QGA VSS support (broken with MinGW)'
+ --with-git=meson \
-   printf "%s\n" '  qpl             Query Processing Library support'
+ --with-git-submodules=update \
-   printf "%s\n" '  rbd             Ceph block device driver'
+ --target-list="x86_64-softmmu" \
-+  printf "%s\n" '  vitastor        Vitastor block device driver'
+---block-drv-rw-whitelist="qcow2,raw,file,host_device,nbd,iscsi,rbd,blkdebug,luks,null-co,nvme,copy-on-read,throttle,gluster" \
-   printf "%s\n" '  rdma            Enable RDMA-based migration'
+--block-drv-rw-whitelist="qcow2,raw,file,host_device,nbd,iscsi,rbd,vitastor,blkdebug,luks,null-co,nvme,copy-on-read,throttle,gluster" \
-   printf "%s\n" '  replication     replication support'
+ --audio-drv-list="" \
-   printf "%s\n" '  rutabaga-gfx    rutabaga_gfx support'
+ --block-drv-ro-whitelist="vmdk,vhdx,vpc,https,ssh" \
-@@ -444,6 +445,8 @@ _meson_option_parse() {
+ --with-coroutine=ucontext \
-     --disable-qpl) printf "%s" -Dqpl=disabled ;;
+@@ -179,6 +179,7 @@
-     --enable-rbd) printf "%s" -Drbd=enabled ;;
+ --enable-opengl \
-     --disable-rbd) printf "%s" -Drbd=disabled ;;
+ --enable-pie \
-+    --enable-vitastor) printf "%s" -Dvitastor=enabled ;;
+ --enable-rbd \
-+    --disable-vitastor) printf "%s" -Dvitastor=disabled ;;
+--enable-vitastor \
-     --enable-rdma) printf "%s" -Drdma=enabled ;;
+ --enable-rdma \
-     --disable-rdma) printf "%s" -Drdma=disabled ;;
+ --enable-seccomp \
-     --enable-relocatable) printf "%s" -Drelocatable=true ;;
+ --enable-snappy \
 Index: a/block/vitastor.c
 ===================================================================
 --- /dev/null
 +++ a/block/vitastor.c
-@@ -0,0 +1,1079 @@
+@@ -0,0 +1,1017 @@
 +// Copyright (c) Vitaliy Filippov, 2019+
 +// License: VNPL-1.1 or GNU GPL-2.0+ (see README.md for details)
 +
@@ -193,6 +190,7 @@ Index: a/block/vitastor.c
 +#include "qapi/error.h"
 +#include "qapi/qmp/qdict.h"
 +#include "qapi/qmp/qerror.h"
 +#include "qemu/uri.h"
 +#include "qemu/error-report.h"
 +#include "qemu/module.h"
 +#include "qemu/option.h"
@@ -372,13 +370,8 @@ Index: a/block/vitastor.c
 +            !strcmp(name, "rdma-gid-index") ||
 +            !strcmp(name, "rdma-mtu"))
 +        {
 +#if QEMU_VERSION_MAJOR < 8 || QEMU_VERSION_MAJOR == 8 && QEMU_VERSION_MINOR < 1
 +            unsigned long long num_val;
 +            if (parse_uint_full(value, &num_val, 0))
 +#else
 +            uint64_t num_val;
 +            if (parse_uint_full(value, 0, &num_val))
 +#endif
 +            {
 +                error_setg(errp, "Illegal %s: %s", name, value);
 +                goto out;
@@ -421,7 +414,10 @@ Index: a/block/vitastor.c
 +    VitastorClient *client = (VitastorClient*)opaque;
 +    qemu_mutex_lock(&client->mutex);
 +    client->bh_uring_scheduled = 0;
 +    do
 +    {
 +        vitastor_c_uring_handle_events(client->proxy);
 +    } while (vitastor_c_uring_has_work(client->proxy));
 +    qemu_mutex_unlock(&client->mutex);
 +}
 +
@@ -501,7 +497,7 @@ Index: a/block/vitastor.c
 +static void universal_aio_set_fd_handler(AioContext *ctx, int fd, IOHandler *fd_read, IOHandler *fd_write, void *opaque)
 +{
 +    aio_set_fd_handler(ctx, fd,
-+#if QEMU_VERSION_MAJOR == 2 && QEMU_VERSION_MINOR >= 5 || QEMU_VERSION_MAJOR >= 3 && (QEMU_VERSION_MAJOR < 8 || QEMU_VERSION_MAJOR == 8 && QEMU_VERSION_MINOR < 1)
+#if QEMU_VERSION_MAJOR == 2 && QEMU_VERSION_MINOR >= 5 || QEMU_VERSION_MAJOR >= 3
 +        0 /*is_external*/,
 +#endif
 +        fd_read,
@@ -565,45 +561,6 @@ Index: a/block/vitastor.c
 +    );
 +}
 +
 +#if defined VITASTOR_C_API_VERSION && VITASTOR_C_API_VERSION >= 2
 +typedef struct str_array
 +{
 +    const char **items;
 +    int len, alloc;
 +} str_array;
 +
 +static void strarray_push(str_array *a, const char *str)
 +{
 +    if (a->len >= a->alloc)
 +    {
 +        a->alloc = !a->alloc ? 4 : 2*a->alloc;
 +        a->items = (const char**)realloc(a->items, a->alloc*sizeof(char*));
 +        if (!a->items)
 +        {
 +            fprintf(stderr, "bad alloc\n");
 +            abort();
 +        }
 +    }
 +    a->items[a->len++] = str;
 +}
 +
 +static void strarray_push_kv(str_array *a, const char *key, const char *value)
 +{
 +    if (key && value)
 +    {
 +        strarray_push(a, key);
 +        strarray_push(a, value);
 +    }
 +}
 +
 +static void strarray_free(str_array *a)
 +{
 +    free(a->items);
 +    a->items = NULL;
 +    a->len = a->alloc = 0;
 +}
 +#endif
 +
 +static int vitastor_file_open(BlockDriverState *bs, QDict *options, int flags, Error **errp)
 +{
 +    VitastorRPC task;
@@ -623,19 +580,22 @@ Index: a/block/vitastor.c
 +    client->rdma_mtu = qdict_get_try_int(options, "rdma-mtu", 0);
 +    client->ctx = bdrv_get_aio_context(bs);
 +#if defined VITASTOR_C_API_VERSION && VITASTOR_C_API_VERSION >= 2
-+    str_array opt = {};
+    client->proxy = vitastor_c_create_qemu_uring(
-+    strarray_push_kv(&opt, "config_path", qdict_get_try_str(options, "config-path"));
+        vitastor_aio_set_fd_handler, client, client->config_path, client->etcd_host, client->etcd_prefix,
-+    strarray_push_kv(&opt, "etcd_address", qdict_get_try_str(options, "etcd-host"));
+        client->use_rdma, client->rdma_device, client->rdma_port_num, client->rdma_gid_index, client->rdma_mtu, 0
-+    strarray_push_kv(&opt, "etcd_prefix", qdict_get_try_str(options, "etcd-prefix"));
+    );
-+    strarray_push_kv(&opt, "use_rdma", qdict_get_try_str(options, "use-rdma"));
+    if (!client->proxy)
-+    strarray_push_kv(&opt, "rdma_device", qdict_get_try_str(options, "rdma-device"));
+    {
-+    strarray_push_kv(&opt, "rdma_port_num", qdict_get_try_str(options, "rdma-port-num"));
+        fprintf(stderr, "vitastor: failed to create io_uring: %s - I/O will be slower\n", strerror(errno));
-+    strarray_push_kv(&opt, "rdma_gid_index", qdict_get_try_str(options, "rdma-gid-index"));
+        client->uring_eventfd = -1;
-+    strarray_push_kv(&opt, "rdma_mtu", qdict_get_try_str(options, "rdma-mtu"));
+#endif
-+    strarray_push_kv(&opt, "client_writeback_allowed", (flags & BDRV_O_NOCACHE) ? "0" : "1");
+        client->proxy = vitastor_c_create_qemu(
-+    client->proxy = vitastor_c_create_uring_json(opt.items, opt.len);
+            vitastor_aio_set_fd_handler, client, client->config_path, client->etcd_host, client->etcd_prefix,
-+    strarray_free(&opt);
+            client->use_rdma, client->rdma_device, client->rdma_port_num, client->rdma_gid_index, client->rdma_mtu, 0
-+    if (client->proxy)
+        );
 +#if defined VITASTOR_C_API_VERSION && VITASTOR_C_API_VERSION >= 2
 +    }
 +    else
 +    {
 +        client->uring_eventfd = vitastor_c_uring_register_eventfd(client->proxy);
 +        if (client->uring_eventfd < 0)
@@ -647,19 +607,6 @@ Index: a/block/vitastor.c
 +        }
 +        universal_aio_set_fd_handler(client->ctx, client->uring_eventfd, vitastor_uring_handler, NULL, client);
 +    }
 +    else
 +    {
 +        // Writeback cache is unusable without io_uring because the client can't correctly flush on exit
 +        fprintf(stderr, "vitastor: failed to create io_uring: %s - I/O will be slower%s\n",
 +            strerror(errno), (flags & BDRV_O_NOCACHE ? "" : " and writeback cache will be disabled"));
 +#endif
 +        client->uring_eventfd = -1;
 +        client->proxy = vitastor_c_create_qemu(
 +            vitastor_aio_set_fd_handler, client, client->config_path, client->etcd_host, client->etcd_prefix,
 +            client->use_rdma, client->rdma_device, client->rdma_port_num, client->rdma_gid_index, client->rdma_mtu, 0
 +        );
 +#if defined VITASTOR_C_API_VERSION && VITASTOR_C_API_VERSION >= 2
 +    }
 +#endif
 +    image = client->image = g_strdup(qdict_get_try_str(options, "image"));
 +    client->readonly = (flags & BDRV_O_RDWR) ? 1 : 0;
@@ -719,10 +666,6 @@ Index: a/block/vitastor.c
 +        return -1;
 +    }
 +    bs->total_sectors = client->size / BDRV_SECTOR_SIZE;
 +#if QEMU_VERSION_MAJOR > 5 || QEMU_VERSION_MAJOR == 5 && QEMU_VERSION_MINOR >= 1
 +    /* When extending regular files, we get zeros from the OS */
 +    bs->supported_truncate_flags = BDRV_REQ_ZERO_WRITE;
 +#endif
 +    //client->aio_context = bdrv_get_aio_context(bs);
 +    qdict_del(options, "use-rdma");
 +    qdict_del(options, "rdma-mtu");
@@ -819,11 +762,7 @@ Index: a/block/vitastor.c
 +    }
 +
 +    // TODO: Resize inode to <offset> bytes
-+#if QEMU_VERSION_MAJOR >= 4
+    client->size = offset / BDRV_SECTOR_SIZE;
 +    client->size = exact || client->size < offset ? offset : client->size;
 +#else
 +    client->size = offset;
 +#endif
 +
 +    return 0;
 +}
@@ -1197,11 +1136,7 @@ Index: a/block/vitastor.c
 +    // FIXME: Implement it along with per-inode statistics
 +    //.bdrv_get_allocated_file_size   = vitastor_get_allocated_file_size,
 +
 +#if QEMU_VERSION_MAJOR > 9 || QEMU_VERSION_MAJOR == 9 && QEMU_VERSION_MINOR > 0
 +    .bdrv_open                      = vitastor_file_open,
 +#else
 +    .bdrv_file_open                 = vitastor_file_open,
 +#endif
 +    .bdrv_close                     = vitastor_close,
 +
 +    // Option list for the create operation
--- a/debian/patches/pve/0001-PVE-Config-block-file-change-locking-default-to-off.patch
+++ b/debian/patches/pve/0001-PVE-Config-block-file-change-locking-default-to-off.patch
@@ -14,10 +14,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 1 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/block/file-posix.c b/block/file-posix.c
-index ff928b5e85..99e5bea1cc 100644
+index 48cd096624..3d60b80286 100644
 --- a/block/file-posix.c
 +++ b/block/file-posix.c
-@@ -564,7 +564,7 @@ static QemuOptsList raw_runtime_opts = {
+@@ -553,7 +553,7 @@ static QemuOptsList raw_runtime_opts = {
         {
             .name = "locking",
             .type = QEMU_OPT_STRING,
@@ -26,7 +26,7 @@ index ff928b5e85..99e5bea1cc 100644
         },
         {
             .name = "pr-manager",
-@@ -664,7 +664,7 @@ static int raw_open_common(BlockDriverState *bs, QDict *options,
+@@ -653,7 +653,7 @@ static int raw_open_common(BlockDriverState *bs, QDict *options,
         s->use_lock = false;
         break;
     case ON_OFF_AUTO_AUTO:
--- a/debian/patches/pve/0002-PVE-Config-Adjust-network-script-path-to-etc-kvm.patch
+++ b/debian/patches/pve/0002-PVE-Config-Adjust-network-script-path-to-etc-kvm.patch
@@ -9,10 +9,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 1 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/include/net/net.h b/include/net/net.h
-index c8f679761b..35a1338e40 100644
+index 523136c7ac..c27859b4f6 100644
 --- a/include/net/net.h
 +++ b/include/net/net.h
-@@ -309,8 +309,8 @@ void netdev_add(QemuOpts *opts, Error **errp);
+@@ -226,8 +226,8 @@ void netdev_add(QemuOpts *opts, Error **errp);
 int net_hub_id_for_client(NetClientState *nc, int *id);
 NetClientState *net_hub_port_find(int hub_id);
--- a/debian/patches/pve/0003-PVE-Config-set-the-CPU-model-to-kvm64-32-instead-of-.patch
+++ b/debian/patches/pve/0003-PVE-Config-set-the-CPU-model-to-kvm64-32-instead-of-.patch
@@ -10,10 +10,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 1 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/target/i386/cpu.h b/target/i386/cpu.h
-index fa027cc206..da7ef0cbe6 100644
+index 82004b65b9..4868db8f94 100644
 --- a/target/i386/cpu.h
 +++ b/target/i386/cpu.h
-@@ -2418,9 +2418,9 @@ uint64_t cpu_get_tsc(CPUX86State *env);
+@@ -2133,9 +2133,9 @@ uint64_t cpu_get_tsc(CPUX86State *env);
 #define CPU_RESOLVING_TYPE TYPE_X86_CPU
 #ifdef TARGET_X86_64
--- a/debian/patches/pve/0004-PVE-Config-ui-spice-default-to-pve-certificates.patch
+++ b/debian/patches/pve/0004-PVE-Config-ui-spice-default-to-pve-certificates.patch
@@ -9,10 +9,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 1 file changed, 9 insertions(+), 6 deletions(-)
 diff --git a/ui/spice-core.c b/ui/spice-core.c
-index 15be640286..ea20e6153c 100644
+index c3ac20ad43..37774f1c0a 100644
 --- a/ui/spice-core.c
 +++ b/ui/spice-core.c
-@@ -690,32 +690,35 @@ static void qemu_spice_init(void)
+@@ -689,32 +689,35 @@ static void qemu_spice_init(void)
     if (tls_port) {
         x509_dir = qemu_opt_get(opts, "x509-dir");
--- a/debian/patches/pve/0005-PVE-Config-glusterfs-no-default-logfile-if-daemonize.patch
+++ b/debian/patches/pve/0005-PVE-Config-glusterfs-no-default-logfile-if-daemonize.patch
@@ -9,7 +9,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 1 file changed, 11 insertions(+), 4 deletions(-)
 diff --git a/block/gluster.c b/block/gluster.c
-index f8b415f381..02bde39d94 100644
+index b60213ab80..93da76bc31 100644
 --- a/block/gluster.c
 +++ b/block/gluster.c
@@ -42,7 +42,7 @@
@@ -21,15 +21,15 @@ index f8b415f381..02bde39d94 100644
 /*
  * Several versions of GlusterFS (3.12? -> 6.0.1) fail when the transfer size
  * is greater or equal to 1024 MiB, so we are limiting the transfer size to 512
-@@ -421,6 +421,7 @@ static struct glfs *qemu_gluster_glfs_init(BlockdevOptionsGluster *gconf,
+@@ -424,6 +424,7 @@ static struct glfs *qemu_gluster_glfs_init(BlockdevOptionsGluster *gconf,
     int old_errno;
     SocketAddressList *server;
-     uint64_t port;
+     unsigned long long port;
 +    const char *logfile;
     glfs = glfs_find_preopened(gconf->volume);
     if (glfs) {
-@@ -463,9 +464,15 @@ static struct glfs *qemu_gluster_glfs_init(BlockdevOptionsGluster *gconf,
+@@ -466,9 +467,15 @@ static struct glfs *qemu_gluster_glfs_init(BlockdevOptionsGluster *gconf,
         }
     }
--- a/debian/patches/pve/0006-PVE-Config-rbd-block-rbd-disable-rbd_cache_writethro.patch
+++ b/debian/patches/pve/0006-PVE-Config-rbd-block-rbd-disable-rbd_cache_writethro.patch
@@ -18,10 +18,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 1 file changed, 2 insertions(+)
 diff --git a/block/rbd.c b/block/rbd.c
-index 9c0fd0cb3f..101ee59d6e 100644
+index f826410f40..64a8d7d48b 100644
 --- a/block/rbd.c
 +++ b/block/rbd.c
-@@ -963,6 +963,8 @@ static int qemu_rbd_connect(rados_t *cluster, rados_ioctx_t *io_ctx,
+@@ -820,6 +820,8 @@ static int qemu_rbd_connect(rados_t *cluster, rados_ioctx_t *io_ctx,
         rados_conf_set(*cluster, "rbd_cache", "false");
     }
--- a/debian/patches/pve/0007-PVE-Up-qmp-add-get_link_status.patch
+++ b/debian/patches/pve/0007-PVE-Up-qmp-add-get_link_status.patch
@@ -0,0 +1,88 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Wolfgang Bumiller <w.bumiller@proxmox.com>
 Date: Mon, 6 Apr 2020 12:16:37 +0200
 Subject: [PATCH] PVE: [Up] qmp: add get_link_status
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
 net/net.c        | 27 +++++++++++++++++++++++++++
 qapi/net.json    | 15 +++++++++++++++
 qapi/pragma.json |  1 +
 3 files changed, 43 insertions(+)
 diff --git a/net/net.c b/net/net.c
 index 2db160e063..8329347891 100644
 --- a/net/net.c
 +++ b/net/net.c
@@ -1343,6 +1343,33 @@ void hmp_info_network(Monitor *mon, const QDict *qdict)
     }
 }
 +int64_t qmp_get_link_status(const char *name, Error **errp)
 +{
 +    NetClientState *ncs[MAX_QUEUE_NUM];
 +    NetClientState *nc;
 +    int queues;
 +    bool ret;
 +
 +    queues = qemu_find_net_clients_except(name, ncs,
 +                                          NET_CLIENT_DRIVER__MAX,
 +                                          MAX_QUEUE_NUM);
 +
 +    if (queues == 0) {
 +        error_set(errp, ERROR_CLASS_DEVICE_NOT_FOUND,
 +                  "Device '%s' not found", name);
 +        return (int64_t) -1;
 +    }
 +
 +    nc = ncs[0];
 +    ret = ncs[0]->link_down;
 +
 +    if (nc->peer->info->type == NET_CLIENT_DRIVER_NIC) {
 +      ret = ncs[0]->peer->link_down;
 +    }
 +
 +    return (int64_t) ret ? 0 : 1;
 +}
 +
 void colo_notify_filters_event(int event, Error **errp)
 {
     NetClientState *nc;
 diff --git a/qapi/net.json b/qapi/net.json
 index 75ba2cb989..a3c93ab88f 100644
 --- a/qapi/net.json
 +++ b/qapi/net.json
@@ -35,6 +35,21 @@
 ##
 { 'command': 'set_link', 'data': {'name': 'str', 'up': 'bool'} }
 +##
 +# @get_link_status:
 +#
 +# Get the current link state of the nics or nic.
 +#
 +# @name: name of the nic you get the state of
 +#
 +# Return: If link is up 1
 +#         If link is down 0
 +#         If an error occure an empty string.
 +#
 +# Notes: this is an Proxmox VE extension and not offical part of Qemu.
 +##
 +{ 'command': 'get_link_status', 'data': {'name': 'str'} , 'returns': 'int' }
 +
 ##
 # @netdev_add:
 #
 diff --git a/qapi/pragma.json b/qapi/pragma.json
 index 7f810b0e97..a2358e303a 100644
 --- a/qapi/pragma.json
 +++ b/qapi/pragma.json
@@ -26,6 +26,7 @@
         'system_wakeup' ],
     # Commands allowed to return a non-dictionary
     'command-returns-exceptions': [
 +        'get_link_status',
         'human-monitor-command',
         'qom-get',
         'query-tpm-models',
--- a/debian/patches/pve/0008-PVE-Up-glusterfs-allow-partial-reads.patch
+++ b/debian/patches/pve/0008-PVE-Up-glusterfs-allow-partial-reads.patch
@@ -16,7 +16,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 1 file changed, 9 insertions(+), 1 deletion(-)
 diff --git a/block/gluster.c b/block/gluster.c
-index 02bde39d94..36c00088cc 100644
+index 93da76bc31..1079b6186b 100644
 --- a/block/gluster.c
 +++ b/block/gluster.c
@@ -57,6 +57,7 @@ typedef struct GlusterAIOCB {
@@ -27,7 +27,7 @@ index 02bde39d94..36c00088cc 100644
 } GlusterAIOCB;
 typedef struct BDRVGlusterState {
-@@ -749,8 +750,10 @@ static void gluster_finish_aiocb(struct glfs_fd *fd, ssize_t ret,
+@@ -752,8 +753,10 @@ static void gluster_finish_aiocb(struct glfs_fd *fd, ssize_t ret,
         acb->ret = 0; /* Success */
     } else if (ret < 0) {
         acb->ret = -errno; /* Read/Write failed */
@@ -39,7 +39,7 @@ index 02bde39d94..36c00088cc 100644
     }
     aio_co_schedule(acb->aio_context, acb->coroutine);
-@@ -1019,6 +1022,7 @@ static coroutine_fn int qemu_gluster_co_pwrite_zeroes(BlockDriverState *bs,
+@@ -1022,6 +1025,7 @@ static coroutine_fn int qemu_gluster_co_pwrite_zeroes(BlockDriverState *bs,
     acb.ret = 0;
     acb.coroutine = qemu_coroutine_self();
     acb.aio_context = bdrv_get_aio_context(bs);
@@ -47,7 +47,7 @@ index 02bde39d94..36c00088cc 100644
     ret = glfs_zerofill_async(s->fd, offset, bytes, gluster_finish_aiocb, &acb);
     if (ret < 0) {
-@@ -1199,9 +1203,11 @@ static coroutine_fn int qemu_gluster_co_rw(BlockDriverState *bs,
+@@ -1203,9 +1207,11 @@ static coroutine_fn int qemu_gluster_co_rw(BlockDriverState *bs,
     acb.aio_context = bdrv_get_aio_context(bs);
     if (write) {
@@ -59,7 +59,7 @@ index 02bde39d94..36c00088cc 100644
         ret = glfs_preadv_async(s->fd, qiov->iov, qiov->niov, offset, 0,
                                 gluster_finish_aiocb, &acb);
     }
-@@ -1264,6 +1270,7 @@ static coroutine_fn int qemu_gluster_co_flush_to_disk(BlockDriverState *bs)
+@@ -1269,6 +1275,7 @@ static coroutine_fn int qemu_gluster_co_flush_to_disk(BlockDriverState *bs)
     acb.ret = 0;
     acb.coroutine = qemu_coroutine_self();
     acb.aio_context = bdrv_get_aio_context(bs);
@@ -67,7 +67,7 @@ index 02bde39d94..36c00088cc 100644
     ret = glfs_fsync_async(s->fd, gluster_finish_aiocb, &acb);
     if (ret < 0) {
-@@ -1312,6 +1319,7 @@ static coroutine_fn int qemu_gluster_co_pdiscard(BlockDriverState *bs,
+@@ -1317,6 +1324,7 @@ static coroutine_fn int qemu_gluster_co_pdiscard(BlockDriverState *bs,
     acb.ret = 0;
     acb.coroutine = qemu_coroutine_self();
     acb.aio_context = bdrv_get_aio_context(bs);
--- a/debian/patches/pve/0009-PVE-Up-qemu-img-return-success-on-info-without-snaps.patch
+++ b/debian/patches/pve/0009-PVE-Up-qemu-img-return-success-on-info-without-snaps.patch
@@ -9,10 +9,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 1 file changed, 2 insertions(+), 1 deletion(-)
 diff --git a/qemu-img.c b/qemu-img.c
-index 7668f86769..2575e97b43 100644
+index 7d4b33b3da..bb36f42dd2 100644
 --- a/qemu-img.c
 +++ b/qemu-img.c
-@@ -3075,7 +3075,8 @@ static int img_info(int argc, char **argv)
+@@ -3010,7 +3010,8 @@ static int img_info(int argc, char **argv)
     list = collect_image_info_list(image_opts, filename, fmt, chain,
                                    force_share);
     if (!list) {
--- a/debian/patches/pve/0010-PVE-Up-qemu-img-dd-add-osize-and-read-from-to-stdin-.patch
+++ b/debian/patches/pve/0010-PVE-Up-qemu-img-dd-add-osize-and-read-from-to-stdin-.patch
@@ -38,10 +38,10 @@ Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 2 files changed, 133 insertions(+), 73 deletions(-)
 diff --git a/qemu-img-cmds.hx b/qemu-img-cmds.hx
-index c9dd70a892..048788b23d 100644
+index 1b1dab5b17..d1616c045a 100644
 --- a/qemu-img-cmds.hx
 +++ b/qemu-img-cmds.hx
-@@ -60,9 +60,9 @@ SRST
+@@ -58,9 +58,9 @@ SRST
 ERST
 DEF("dd", img_dd,
@@ -54,10 +54,10 @@ index c9dd70a892..048788b23d 100644
 DEF("info", img_info,
 diff --git a/qemu-img.c b/qemu-img.c
-index 2575e97b43..8ec68b346f 100644
+index bb36f42dd2..74afcb79ef 100644
 --- a/qemu-img.c
 +++ b/qemu-img.c
-@@ -4993,10 +4993,12 @@ static int img_bitmap(int argc, char **argv)
+@@ -4826,10 +4826,12 @@ static int img_bitmap(int argc, char **argv)
 #define C_IF      04
 #define C_OF      010
 #define C_SKIP    020
@@ -70,7 +70,7 @@ index 2575e97b43..8ec68b346f 100644
 };
 struct DdIo {
-@@ -5072,6 +5074,19 @@ static int img_dd_skip(const char *arg,
+@@ -4905,6 +4907,19 @@ static int img_dd_skip(const char *arg,
     return 0;
 }
@@ -90,7 +90,7 @@ index 2575e97b43..8ec68b346f 100644
 static int img_dd(int argc, char **argv)
 {
     int ret = 0;
-@@ -5112,6 +5127,7 @@ static int img_dd(int argc, char **argv)
+@@ -4945,6 +4960,7 @@ static int img_dd(int argc, char **argv)
         { "if", img_dd_if, C_IF },
         { "of", img_dd_of, C_OF },
         { "skip", img_dd_skip, C_SKIP },
@@ -98,7 +98,7 @@ index 2575e97b43..8ec68b346f 100644
         { NULL, NULL, 0 }
     };
     const struct option long_options[] = {
-@@ -5187,91 +5203,112 @@ static int img_dd(int argc, char **argv)
+@@ -5020,91 +5036,112 @@ static int img_dd(int argc, char **argv)
         arg = NULL;
     }
@@ -275,10 +275,10 @@ index 2575e97b43..8ec68b346f 100644
     }
     if (dd.flags & C_SKIP && (in.offset > INT64_MAX / in.bsz ||
-@@ -5288,20 +5325,43 @@ static int img_dd(int argc, char **argv)
+@@ -5121,20 +5158,43 @@ static int img_dd(int argc, char **argv)
     in.buf = g_new(uint8_t, in.bsz);
-     for (out_pos = 0; in_pos < size; ) {
+     for (out_pos = 0; in_pos < size; block_count++) {
 +        int in_ret, out_ret;
         int bytes = (in_pos + in.bsz > size) ? size - in_pos : in.bsz;
 -
--- a/debian/patches/pve/0011-PVE-Up-qemu-img-dd-add-isize-parameter.patch
+++ b/debian/patches/pve/0011-PVE-Up-qemu-img-dd-add-isize-parameter.patch
@@ -16,10 +16,10 @@ Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 1 file changed, 25 insertions(+), 3 deletions(-)
 diff --git a/qemu-img.c b/qemu-img.c
-index 8ec68b346f..b98184bba1 100644
+index 74afcb79ef..14594d44b6 100644
 --- a/qemu-img.c
 +++ b/qemu-img.c
-@@ -4994,11 +4994,13 @@ static int img_bitmap(int argc, char **argv)
+@@ -4827,11 +4827,13 @@ static int img_bitmap(int argc, char **argv)
 #define C_OF      010
 #define C_SKIP    020
 #define C_OSIZE   040
@@ -33,7 +33,7 @@ index 8ec68b346f..b98184bba1 100644
 };
 struct DdIo {
-@@ -5087,6 +5089,19 @@ static int img_dd_osize(const char *arg,
+@@ -4920,6 +4922,19 @@ static int img_dd_osize(const char *arg,
     return 0;
 }
@@ -53,13 +53,13 @@ index 8ec68b346f..b98184bba1 100644
 static int img_dd(int argc, char **argv)
 {
     int ret = 0;
-@@ -5101,12 +5116,14 @@ static int img_dd(int argc, char **argv)
+@@ -4934,12 +4949,14 @@ static int img_dd(int argc, char **argv)
     int c, i;
     const char *out_fmt = "raw";
     const char *fmt = NULL;
 -    int64_t size = 0;
 +    int64_t size = 0, readsize = 0;
-     int64_t out_pos, in_pos;
+     int64_t block_count = 0, out_pos, in_pos;
     bool force_share = false;
     struct DdInfo dd = {
         .flags = 0,
@@ -69,7 +69,7 @@ index 8ec68b346f..b98184bba1 100644
     };
     struct DdIo in = {
         .bsz = 512, /* Block size is by default 512 bytes */
-@@ -5128,6 +5145,7 @@ static int img_dd(int argc, char **argv)
+@@ -4961,6 +4978,7 @@ static int img_dd(int argc, char **argv)
         { "of", img_dd_of, C_OF },
         { "skip", img_dd_skip, C_SKIP },
         { "osize", img_dd_osize, C_OSIZE },
@@ -77,20 +77,20 @@ index 8ec68b346f..b98184bba1 100644
         { NULL, NULL, 0 }
     };
     const struct option long_options[] = {
-@@ -5324,9 +5342,10 @@ static int img_dd(int argc, char **argv)
+@@ -5157,9 +5175,10 @@ static int img_dd(int argc, char **argv)
     in.buf = g_new(uint8_t, in.bsz);
-    for (out_pos = 0; in_pos < size; ) {
+-    for (out_pos = 0; in_pos < size; block_count++) {
 +    readsize = (dd.isize > 0) ? dd.isize : size;
-+    for (out_pos = 0; in_pos < readsize; ) {
+    for (out_pos = 0; in_pos < readsize; block_count++) {
         int in_ret, out_ret;
 -        int bytes = (in_pos + in.bsz > size) ? size - in_pos : in.bsz;
 +        int bytes = (in_pos + in.bsz > readsize) ? readsize - in_pos : in.bsz;
         if (blk1) {
             in_ret = blk_pread(blk1, in_pos, bytes, in.buf, 0);
             if (in_ret == 0) {
-@@ -5335,6 +5354,9 @@ static int img_dd(int argc, char **argv)
+@@ -5168,6 +5187,9 @@ static int img_dd(int argc, char **argv)
         } else {
             in_ret = read(STDIN_FILENO, in.buf, bytes);
             if (in_ret == 0) {
--- a/debian/patches/pve/0012-PVE-Up-qemu-img-dd-add-n-skip_create.patch
+++ b/debian/patches/pve/0012-PVE-Up-qemu-img-dd-add-n-skip_create.patch
@@ -5,7 +5,7 @@ Subject: [PATCH] PVE: [Up] qemu-img dd: add -n skip_create
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 [FE: fix getopt-string + add documentation]
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
+Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 ---
 docs/tools/qemu-img.rst | 11 ++++++++++-
 qemu-img-cmds.hx        |  4 ++--
@@ -13,10 +13,10 @@ Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 3 files changed, 26 insertions(+), 12 deletions(-)
 diff --git a/docs/tools/qemu-img.rst b/docs/tools/qemu-img.rst
-index 3653adb963..d83e8fb3c0 100644
+index 85a6e05b35..699229eef6 100644
 --- a/docs/tools/qemu-img.rst
 +++ b/docs/tools/qemu-img.rst
-@@ -212,6 +212,10 @@ Parameters to convert subcommand:
+@@ -208,6 +208,10 @@ Parameters to convert subcommand:
 Parameters to dd subcommand:
@@ -27,7 +27,7 @@ index 3653adb963..d83e8fb3c0 100644
 .. program:: qemu-img-dd
 .. option:: bs=BLOCK_SIZE
-@@ -492,7 +496,7 @@ Command description:
+@@ -488,7 +492,7 @@ Command description:
   it doesn't need to be specified separately in this case.
@@ -36,7 +36,7 @@ index 3653adb963..d83e8fb3c0 100644
   dd copies from *INPUT* file to *OUTPUT* file converting it from
   *FMT* format to *OUTPUT_FMT* format.
-@@ -503,6 +507,11 @@ Command description:
+@@ -499,6 +503,11 @@ Command description:
   The size syntax is similar to :manpage:`dd(1)`'s size syntax.
@@ -49,10 +49,10 @@ index 3653adb963..d83e8fb3c0 100644
   Give information about the disk image *FILENAME*. Use it in
 diff --git a/qemu-img-cmds.hx b/qemu-img-cmds.hx
-index 048788b23d..0b29a67a06 100644
+index d1616c045a..b5b0bb4467 100644
 --- a/qemu-img-cmds.hx
 +++ b/qemu-img-cmds.hx
-@@ -60,9 +60,9 @@ SRST
+@@ -58,9 +58,9 @@ SRST
 ERST
 DEF("dd", img_dd,
@@ -65,19 +65,19 @@ index 048788b23d..0b29a67a06 100644
 DEF("info", img_info,
 diff --git a/qemu-img.c b/qemu-img.c
-index b98184bba1..6fc8384f64 100644
+index 14594d44b6..c6b4a5567d 100644
 --- a/qemu-img.c
 +++ b/qemu-img.c
-@@ -5118,7 +5118,7 @@ static int img_dd(int argc, char **argv)
+@@ -4951,7 +4951,7 @@ static int img_dd(int argc, char **argv)
     const char *fmt = NULL;
     int64_t size = 0, readsize = 0;
-     int64_t out_pos, in_pos;
+     int64_t block_count = 0, out_pos, in_pos;
 -    bool force_share = false;
 +    bool force_share = false, skip_create = false;
     struct DdInfo dd = {
         .flags = 0,
         .count = 0,
-@@ -5156,7 +5156,7 @@ static int img_dd(int argc, char **argv)
+@@ -4989,7 +4989,7 @@ static int img_dd(int argc, char **argv)
         { 0, 0, 0, 0 }
     };
@@ -86,7 +86,7 @@ index b98184bba1..6fc8384f64 100644
         if (c == EOF) {
             break;
         }
-@@ -5176,6 +5176,9 @@ static int img_dd(int argc, char **argv)
+@@ -5009,6 +5009,9 @@ static int img_dd(int argc, char **argv)
         case 'h':
             help();
             break;
@@ -96,7 +96,7 @@ index b98184bba1..6fc8384f64 100644
         case 'U':
             force_share = true;
             break;
-@@ -5306,13 +5309,15 @@ static int img_dd(int argc, char **argv)
+@@ -5139,13 +5142,15 @@ static int img_dd(int argc, char **argv)
                                 size - in.bsz * in.offset, &error_abort);
         }
--- a/debian/patches/pve/0013-PVE-virtio-balloon-improve-query-balloon.patch
+++ b/debian/patches/pve/0013-PVE-virtio-balloon-improve-query-balloon.patch
@@ -7,62 +7,17 @@ Actually provide memory information via the query-balloon
 command.
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 [FE: add BalloonInfo to member name exceptions list
     rebase for 8.0 - moved to hw/core/machine-hmp-cmds.c]
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 hw/core/machine-hmp-cmds.c | 30 +++++++++++++++++++++++++++++-
 hw/virtio/virtio-balloon.c | 33 +++++++++++++++++++++++++++++++--
 monitor/hmp-cmds.c         | 30 +++++++++++++++++++++++++++++-
 qapi/machine.json          | 22 +++++++++++++++++++++-
- qapi/pragma.json           |  1 +
+ 3 files changed, 81 insertions(+), 4 deletions(-)
 4 files changed, 82 insertions(+), 4 deletions(-)
 diff --git a/hw/core/machine-hmp-cmds.c b/hw/core/machine-hmp-cmds.c
 index 8701f00cc7..3b4c5ef403 100644
 --- a/hw/core/machine-hmp-cmds.c
 +++ b/hw/core/machine-hmp-cmds.c
@@ -179,7 +179,35 @@ void hmp_info_balloon(Monitor *mon, const QDict *qdict)
         return;
     }
 -    monitor_printf(mon, "balloon: actual=%" PRId64 "\n", info->actual >> 20);
 +    monitor_printf(mon, "balloon: actual=%" PRId64, info->actual >> 20);
 +    monitor_printf(mon, " max_mem=%" PRId64, info->max_mem >> 20);
 +    if (info->has_total_mem) {
 +        monitor_printf(mon, " total_mem=%" PRId64, info->total_mem >> 20);
 +    }
 +    if (info->has_free_mem) {
 +        monitor_printf(mon, " free_mem=%" PRId64, info->free_mem >> 20);
 +    }
 +
 +    if (info->has_mem_swapped_in) {
 +        monitor_printf(mon, " mem_swapped_in=%" PRId64, info->mem_swapped_in);
 +    }
 +    if (info->has_mem_swapped_out) {
 +        monitor_printf(mon, " mem_swapped_out=%" PRId64, info->mem_swapped_out);
 +    }
 +    if (info->has_major_page_faults) {
 +        monitor_printf(mon, " major_page_faults=%" PRId64,
 +                       info->major_page_faults);
 +    }
 +    if (info->has_minor_page_faults) {
 +        monitor_printf(mon, " minor_page_faults=%" PRId64,
 +                       info->minor_page_faults);
 +    }
 +    if (info->has_last_update) {
 +        monitor_printf(mon, " last_update=%" PRId64,
 +                       info->last_update);
 +    }
 +
 +    monitor_printf(mon, "\n");
     qapi_free_BalloonInfo(info);
 }
 diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
-index 609e39a821..8cb6dfcac3 100644
+index 73ac5eb675..bbfe7eca62 100644
 --- a/hw/virtio/virtio-balloon.c
 +++ b/hw/virtio/virtio-balloon.c
-@@ -781,8 +781,37 @@ static uint64_t virtio_balloon_get_features(VirtIODevice *vdev, uint64_t f,
+@@ -806,8 +806,37 @@ static uint64_t virtio_balloon_get_features(VirtIODevice *vdev, uint64_t f,
 static void virtio_balloon_stat(void *opaque, BalloonInfo *info)
 {
     VirtIOBalloon *dev = opaque;
@@ -102,13 +57,54 @@ index 609e39a821..8cb6dfcac3 100644
 }
 static void virtio_balloon_to_target(void *opaque, ram_addr_t target)
 diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
 index c6cd6f91dd..15572befb1 100644
 --- a/monitor/hmp-cmds.c
 +++ b/monitor/hmp-cmds.c
@@ -715,7 +715,35 @@ void hmp_info_balloon(Monitor *mon, const QDict *qdict)
         return;
     }
 -    monitor_printf(mon, "balloon: actual=%" PRId64 "\n", info->actual >> 20);
 +    monitor_printf(mon, "balloon: actual=%" PRId64, info->actual >> 20);
 +    monitor_printf(mon, " max_mem=%" PRId64, info->max_mem >> 20);
 +    if (info->has_total_mem) {
 +        monitor_printf(mon, " total_mem=%" PRId64, info->total_mem >> 20);
 +    }
 +    if (info->has_free_mem) {
 +        monitor_printf(mon, " free_mem=%" PRId64, info->free_mem >> 20);
 +    }
 +
 +    if (info->has_mem_swapped_in) {
 +        monitor_printf(mon, " mem_swapped_in=%" PRId64, info->mem_swapped_in);
 +    }
 +    if (info->has_mem_swapped_out) {
 +        monitor_printf(mon, " mem_swapped_out=%" PRId64, info->mem_swapped_out);
 +    }
 +    if (info->has_major_page_faults) {
 +        monitor_printf(mon, " major_page_faults=%" PRId64,
 +                       info->major_page_faults);
 +    }
 +    if (info->has_minor_page_faults) {
 +        monitor_printf(mon, " minor_page_faults=%" PRId64,
 +                       info->minor_page_faults);
 +    }
 +    if (info->has_last_update) {
 +        monitor_printf(mon, " last_update=%" PRId64,
 +                       info->last_update);
 +    }
 +
 +    monitor_printf(mon, "\n");
     qapi_free_BalloonInfo(info);
 }
 diff --git a/qapi/machine.json b/qapi/machine.json
-index d4317435e7..db8ed2e357 100644
+index 6afd1936b0..8b4be9b718 100644
 --- a/qapi/machine.json
 +++ b/qapi/machine.json
-@@ -1164,9 +1164,29 @@
+@@ -1054,9 +1054,29 @@
- # @actual: the logical size of the VM in bytes Formula used:
+ # @actual: the logical size of the VM in bytes
- #     logical_vm_size = vm_ram_size - balloon_size
+ #          Formula used: logical_vm_size = vm_ram_size - balloon_size
 #
 +# @last_update: time when stats got updated from guest
 +#
@@ -137,15 +133,3 @@ index d4317435e7..db8ed2e357 100644
 ##
 # @query-balloon:
 diff --git a/qapi/pragma.json b/qapi/pragma.json
 index 59fbe74b8c..be8fa304c5 100644
 --- a/qapi/pragma.json
 +++ b/qapi/pragma.json
@@ -90,6 +90,7 @@
     'member-name-exceptions': [     # visible in:
         'ACPISlotType',             # query-acpi-ospm-status
         'AcpiTableOptions',         # -acpitable
 +        'BalloonInfo',              # query-balloon
         'BlkdebugEvent',            # blockdev-add, -blockdev
         'BlkdebugSetStateOptions',  # blockdev-add, -blockdev
         'BlockDeviceInfo',          # query-block
--- a/debian/patches/pve/0014-PVE-qapi-modify-query-machines.patch
+++ b/debian/patches/pve/0014-PVE-qapi-modify-query-machines.patch
@@ -13,13 +13,13 @@ Signed-off-by: Dietmar Maurer <dietmar@proxmox.com>
 2 files changed, 9 insertions(+), 1 deletion(-)
 diff --git a/hw/core/machine-qmp-cmds.c b/hw/core/machine-qmp-cmds.c
-index 130217da8f..52a6d74820 100644
+index 4f4ab30f8c..76fff60a6b 100644
 --- a/hw/core/machine-qmp-cmds.c
 +++ b/hw/core/machine-qmp-cmds.c
-@@ -90,6 +90,12 @@ MachineInfoList *qmp_query_machines(bool has_compat_props, bool compat_props,
+@@ -99,6 +99,12 @@ MachineInfoList *qmp_query_machines(Error **errp)
         info->hotpluggable_cpus = mc->has_hotpluggable_cpus;
         info->numa_mem_supported = mc->numa_mem_supported;
         info->deprecated = !!mc->deprecation_reason;
         info->acpi = !!object_class_property_find(OBJECT_CLASS(mc), "acpi");
 +
 +        if (strcmp(mc->name, MACHINE_GET_CLASS(current_machine)->name) == 0) {
 +            info->has_is_current = true;
@@ -28,12 +28,12 @@ index 130217da8f..52a6d74820 100644
 +
         if (mc->default_cpu_type) {
             info->default_cpu_type = g_strdup(mc->default_cpu_type);
-         }
+             info->has_default_cpu_type = true;
 diff --git a/qapi/machine.json b/qapi/machine.json
-index db8ed2e357..0c703316f5 100644
+index 8b4be9b718..555458f785 100644
 --- a/qapi/machine.json
 +++ b/qapi/machine.json
-@@ -168,6 +168,8 @@
+@@ -138,6 +138,8 @@
 #
 # @is-default: whether the machine is default
 #
@@ -42,7 +42,7 @@ index db8ed2e357..0c703316f5 100644
 # @cpu-max: maximum number of CPUs supported by the machine type
 #           (since 1.5)
 #
-@@ -200,7 +202,7 @@
+@@ -159,7 +161,7 @@
 ##
 { 'struct': 'MachineInfo',
   'data': { 'name': 'str', '*alias': 'str',
@@ -50,4 +50,4 @@ index db8ed2e357..0c703316f5 100644
 +            '*is-default': 'bool', '*is-current': 'bool', 'cpu-max': 'int',
             'hotpluggable-cpus': 'bool',  'numa-mem-supported': 'bool',
             'deprecated': 'bool', '*default-cpu-type': 'str',
-             '*default-ram-id': 'str', 'acpi': 'bool',
+             '*default-ram-id': 'str' } }
--- a/debian/patches/pve/0015-PVE-qapi-modify-spice-query.patch
+++ b/debian/patches/pve/0015-PVE-qapi-modify-spice-query.patch
@@ -6,18 +6,16 @@ Subject: [PATCH] PVE: qapi: modify spice query
 Provide the last ticket in the SpiceInfo struct optionally.
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 [FE: adapt to QAPI change]
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 qapi/ui.json    | 3 +++
- ui/spice-core.c | 4 ++++
+ ui/spice-core.c | 5 +++++
- 2 files changed, 7 insertions(+)
+ 2 files changed, 8 insertions(+)
 diff --git a/qapi/ui.json b/qapi/ui.json
-index 8c8464faac..cebda37f8f 100644
+index cf58ab4283..0be2388941 100644
 --- a/qapi/ui.json
 +++ b/qapi/ui.json
-@@ -312,11 +312,14 @@
+@@ -310,11 +310,14 @@
 #
 # @channels: a list of @SpiceChannel for each active spice channel
 #
@@ -33,14 +31,15 @@ index 8c8464faac..cebda37f8f 100644
   'if': 'CONFIG_SPICE' }
 diff --git a/ui/spice-core.c b/ui/spice-core.c
-index ea20e6153c..55a15fba8b 100644
+index 37774f1c0a..367f77f2b4 100644
 --- a/ui/spice-core.c
 +++ b/ui/spice-core.c
-@@ -548,6 +548,10 @@ static SpiceInfo *qmp_query_spice_real(Error **errp)
+@@ -534,6 +534,11 @@ static SpiceInfo *qmp_query_spice_real(Error **errp)
     micro = SPICE_SERVER_VERSION & 0xff;
     info->compiled_version = g_strdup_printf("%d.%d.%d", major, minor, micro);
 +    if (auth_passwd) {
 +        info->has_ticket = true;
 +        info->ticket =  g_strdup(auth_passwd);
 +    }
 +
--- a/debian/patches/pve/0016-PVE-add-IOChannel-implementation-for-savevm-async.patch
+++ b/debian/patches/pve/0016-PVE-add-IOChannel-implementation-for-savevm-async.patch
@@ -14,21 +14,20 @@ Additionally, allows tracking the current position from the outside
 (intended to be used for progress tracking).
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
- migration/channel-savevm-async.c | 184 +++++++++++++++++++++++++++++++
+ migration/channel-savevm-async.c | 182 +++++++++++++++++++++++++++++++
 migration/channel-savevm-async.h |  51 +++++++++
 migration/meson.build            |   1 +
- 3 files changed, 236 insertions(+)
+ 3 files changed, 234 insertions(+)
 create mode 100644 migration/channel-savevm-async.c
 create mode 100644 migration/channel-savevm-async.h
 diff --git a/migration/channel-savevm-async.c b/migration/channel-savevm-async.c
 new file mode 100644
-index 0000000000..081a192f49
+index 0000000000..06d5484778
 --- /dev/null
 +++ b/migration/channel-savevm-async.c
-@@ -0,0 +1,184 @@
+@@ -0,0 +1,182 @@
 +/*
 + * QIO Channel implementation to be used by savevm-async QMP calls
 + */
@@ -72,7 +71,6 @@ index 0000000000..081a192f49
 +                               size_t niov,
 +                               int **fds,
 +                               size_t *nfds,
 +                               int flags,
 +                               Error **errp)
 +{
 +    QIOChannelSavevmAsync *saioc = QIO_CHANNEL_SAVEVM_ASYNC(ioc);
@@ -175,9 +173,8 @@ index 0000000000..081a192f49
 +
 +static void
 +qio_channel_savevm_async_set_aio_fd_handler(QIOChannel *ioc,
-+                                            AioContext *read_ctx,
+                                            AioContext *ctx,
 +                                            IOHandler *io_read,
 +                                            AioContext *write_ctx,
 +                                            IOHandler *io_write,
 +                                            void *opaque)
 +{
@@ -271,14 +268,14 @@ index 0000000000..17ae2cb261
 +
 +#endif /* QIO_CHANNEL_SAVEVM_ASYNC_H */
 diff --git a/migration/meson.build b/migration/meson.build
-index 5ce2acb41e..020127d901 100644
+index 690487cf1a..8cac83c06c 100644
 --- a/migration/meson.build
 +++ b/migration/meson.build
-@@ -13,6 +13,7 @@ system_ss.add(files(
+@@ -13,6 +13,7 @@ softmmu_ss.add(files(
   'block-dirty-bitmap.c',
   'channel.c',
   'channel-block.c',
 +  'channel-savevm-async.c',
-   'dirtyrate.c',
+   'colo-failover.c',
   'colo.c',
   'exec.c',
   'fd.c',
--- a/debian/patches/pve/0017-PVE-add-savevm-async-for-background-state-snapshots.patch
+++ b/debian/patches/pve/0017-PVE-add-savevm-async-for-background-state-snapshots.patch
@@ -21,36 +21,31 @@ still opened by QEMU.
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 Signed-off-by: Dietmar Maurer <dietmar@proxmox.com>
 Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
-[SR: improve aborting
+[improve aborting]
     register yank before migration_incoming_state_destroy]
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 [FE: further improve aborting
-     adapt to removal of QEMUFileOps
+     adapt to removal of QEMUFileOps]
     improve condition for entering final stage
     adapt to QAPI and other changes for 8.2
     make sure to not call vm_start() from coroutine
     stop CPU throttling after finishing]
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 hmp-commands-info.hx         |  13 +
- hmp-commands.hx              |  17 ++
+ hmp-commands.hx              |  33 +++
 include/migration/snapshot.h |   2 +
- include/monitor/hmp.h        |   3 +
+ include/monitor/hmp.h        |   5 +
 migration/meson.build        |   1 +
- migration/savevm-async.c     | 549 +++++++++++++++++++++++++++++++++++
+ migration/savevm-async.c     | 531 +++++++++++++++++++++++++++++++++++
- monitor/hmp-cmds.c           |  38 +++
+ monitor/hmp-cmds.c           |  57 ++++
 qapi/migration.json          |  34 +++
- qapi/misc.json               |  18 ++
+ qapi/misc.json               |  32 +++
 qemu-options.hx              |  12 +
- system/vl.c                  |  10 +
+ softmmu/vl.c                 |  10 +
- 11 files changed, 697 insertions(+)
+ 11 files changed, 730 insertions(+)
 create mode 100644 migration/savevm-async.c
 diff --git a/hmp-commands-info.hx b/hmp-commands-info.hx
-index c59cd6637b..d1a7b99add 100644
+index 188d9ece3b..97b88eaaad 100644
 --- a/hmp-commands-info.hx
 +++ b/hmp-commands-info.hx
-@@ -512,6 +512,19 @@ SRST
+@@ -538,6 +538,19 @@ SRST
     Show current migration parameters.
 ERST
@@ -71,13 +66,13 @@ index c59cd6637b..d1a7b99add 100644
         .name       = "balloon",
         .args_type  = "",
 diff --git a/hmp-commands.hx b/hmp-commands.hx
-index 06746f0afc..0c7c6f2c16 100644
+index 182e639d14..bbcc73e942 100644
 --- a/hmp-commands.hx
 +++ b/hmp-commands.hx
-@@ -1859,3 +1859,20 @@ SRST
+@@ -1800,3 +1800,36 @@ ERST
-   List event channels in the guest
+                       "\n\t\t\t\t\t limit on a specified virtual cpu",
- ERST
+         .cmd        = hmp_cancel_vcpu_dirty_limit,
- #endif
+     },
 +
 +    {
 +        .name       = "savevm-start",
@@ -88,6 +83,22 @@ index 06746f0afc..0c7c6f2c16 100644
 +    },
 +
 +    {
 +        .name       = "snapshot-drive",
 +        .args_type  = "device:s,name:s",
 +        .params     = "device name",
 +        .help       = "Create internal snapshot.",
 +        .cmd = hmp_snapshot_drive,
 +    },
 +
 +    {
 +        .name       = "delete-drive-snapshot",
 +        .args_type  = "device:s,name:s",
 +        .params     = "device name",
 +        .help       = "Delete internal snapshot.",
 +        .cmd = hmp_delete_drive_snapshot,
 +    },
 +
 +    {
 +        .name       = "savevm-end",
 +        .args_type  = "",
 +        .params     = "",
@@ -96,21 +107,21 @@ index 06746f0afc..0c7c6f2c16 100644
 +        .coroutine  = true,
 +    },
 diff --git a/include/migration/snapshot.h b/include/migration/snapshot.h
-index 9e4dcaaa75..2581730d74 100644
+index e72083b117..c846d37806 100644
 --- a/include/migration/snapshot.h
 +++ b/include/migration/snapshot.h
-@@ -68,4 +68,6 @@ bool delete_snapshot(const char *name,
+@@ -61,4 +61,6 @@ bool delete_snapshot(const char *name,
-  */
+                     bool has_devices, strList *devices,
- void load_snapshot_resume(RunState state);
+                     Error **errp);
 +int load_snapshot_from_blockdev(const char *filename, Error **errp);
 +
 #endif
 diff --git a/include/monitor/hmp.h b/include/monitor/hmp.h
-index ae116d9804..2596cc2426 100644
+index a618eb1e4e..55067beff1 100644
 --- a/include/monitor/hmp.h
 +++ b/include/monitor/hmp.h
-@@ -28,6 +28,7 @@ void hmp_info_status(Monitor *mon, const QDict *qdict);
+@@ -26,6 +26,7 @@ void hmp_info_status(Monitor *mon, const QDict *qdict);
 void hmp_info_uuid(Monitor *mon, const QDict *qdict);
 void hmp_info_chardev(Monitor *mon, const QDict *qdict);
 void hmp_info_mice(Monitor *mon, const QDict *qdict);
@@ -118,44 +129,43 @@ index ae116d9804..2596cc2426 100644
 void hmp_info_migrate(Monitor *mon, const QDict *qdict);
 void hmp_info_migrate_capabilities(Monitor *mon, const QDict *qdict);
 void hmp_info_migrate_parameters(Monitor *mon, const QDict *qdict);
-@@ -92,6 +93,8 @@ void hmp_closefd(Monitor *mon, const QDict *qdict);
+@@ -80,6 +81,10 @@ void hmp_netdev_add(Monitor *mon, const QDict *qdict);
- void hmp_mouse_move(Monitor *mon, const QDict *qdict);
+ void hmp_netdev_del(Monitor *mon, const QDict *qdict);
- void hmp_mouse_button(Monitor *mon, const QDict *qdict);
+ void hmp_getfd(Monitor *mon, const QDict *qdict);
- void hmp_mouse_set(Monitor *mon, const QDict *qdict);
+ void hmp_closefd(Monitor *mon, const QDict *qdict);
 +void hmp_savevm_start(Monitor *mon, const QDict *qdict);
 +void hmp_snapshot_drive(Monitor *mon, const QDict *qdict);
 +void hmp_delete_drive_snapshot(Monitor *mon, const QDict *qdict);
 +void hmp_savevm_end(Monitor *mon, const QDict *qdict);
 void hmp_sendkey(Monitor *mon, const QDict *qdict);
- void coroutine_fn hmp_screendump(Monitor *mon, const QDict *qdict);
+ void hmp_screendump(Monitor *mon, const QDict *qdict);
 void hmp_chardev_add(Monitor *mon, const QDict *qdict);
 diff --git a/migration/meson.build b/migration/meson.build
-index 020127d901..4b0c4f0f51 100644
+index 8cac83c06c..0842d00cd2 100644
 --- a/migration/meson.build
 +++ b/migration/meson.build
-@@ -27,6 +27,7 @@ system_ss.add(files(
+@@ -24,6 +24,7 @@ softmmu_ss.add(files(
-   'options.c',
+   'multifd-zlib.c',
   'postcopy-ram.c',
   'savevm.c',
 +  'savevm-async.c',
   'socket.c',
   'tls.c',
-   'threadinfo.c',
+ ), gnutls)
 diff --git a/migration/savevm-async.c b/migration/savevm-async.c
 new file mode 100644
-index 0000000000..4c90209188
+index 0000000000..05d394c0e2
 --- /dev/null
 +++ b/migration/savevm-async.c
-@@ -0,0 +1,549 @@
+@@ -0,0 +1,531 @@
 +#include "qemu/osdep.h"
 +#include "migration/channel-savevm-async.h"
 +#include "migration/migration.h"
 +#include "migration/migration-stats.h"
 +#include "migration/options.h"
 +#include "migration/savevm.h"
 +#include "migration/snapshot.h"
 +#include "migration/global_state.h"
 +#include "migration/ram.h"
 +#include "migration/qemu-file.h"
 +#include "sysemu/cpu-throttle.h"
 +#include "sysemu/sysemu.h"
 +#include "sysemu/runstate.h"
 +#include "block/block.h"
@@ -167,11 +177,9 @@ index 0000000000..4c90209188
 +#include "qapi/qapi-commands-misc.h"
 +#include "qapi/qapi-commands-block.h"
 +#include "qemu/cutils.h"
 +#include "qemu/error-report.h"
 +#include "qemu/timer.h"
 +#include "qemu/main-loop.h"
 +#include "qemu/rcu.h"
 +#include "qemu/yank.h"
 +
 +/* #define DEBUG_SAVEVM_STATE */
 +
@@ -222,20 +230,24 @@ index 0000000000..4c90209188
 +        info->bytes = s->bs_pos;
 +        switch (s->state) {
 +        case SAVE_STATE_ERROR:
 +            info->has_status = true;
 +            info->status = g_strdup("failed");
 +            info->has_total_time = true;
 +            info->total_time = s->total_time;
 +            if (s->error) {
 +                info->has_error = true;
 +                info->error = g_strdup(error_get_pretty(s->error));
 +            }
 +            break;
 +        case SAVE_STATE_ACTIVE:
 +            info->has_status = true;
 +            info->status = g_strdup("active");
 +            info->has_total_time = true;
 +            info->total_time = qemu_clock_get_ms(QEMU_CLOCK_REALTIME)
 +                - s->total_time;
 +            break;
 +        case SAVE_STATE_COMPLETED:
 +            info->has_status = true;
 +            info->status = g_strdup("completed");
 +            info->has_total_time = true;
 +            info->total_time = s->total_time;
@@ -281,7 +293,7 @@ index 0000000000..4c90209188
 +    return ret;
 +}
 +
-+static void G_GNUC_PRINTF(1, 2) save_snapshot_error(const char *fmt, ...)
+static void save_snapshot_error(const char *fmt, ...)
 +{
 +    va_list ap;
 +    char *msg;
@@ -293,7 +305,7 @@ index 0000000000..4c90209188
 +    DPRINTF("save_snapshot_error: %s\n", msg);
 +
 +    if (!snap_state.error) {
-+        error_setg(&snap_state.error, "%s", msg);
+        error_set(&snap_state.error, ERROR_CLASS_GENERIC_ERROR, "%s", msg);
 +    }
 +
 +    g_free (msg);
@@ -304,6 +316,7 @@ index 0000000000..4c90209188
 +static void process_savevm_finalize(void *opaque)
 +{
 +    int ret;
 +    AioContext *iohandler_ctx = iohandler_get_aio_context();
 +    MigrationState *ms = migrate_get_current();
 +
 +    bool aborted = savevm_aborted();
@@ -320,7 +333,9 @@ index 0000000000..4c90209188
 +     * so move it back. It can stay in the main context and live out its live
 +     * there, since we're done with it after this method ends anyway.
 +     */
 +    aio_context_acquire(iohandler_ctx);
 +    blk_set_aio_context(snap_state.target, qemu_get_aio_context(), NULL);
 +    aio_context_release(iohandler_ctx);
 +
 +    ret = vm_stop_force_state(RUN_STATE_FINISH_MIGRATE);
 +    if (ret < 0) {
@@ -332,7 +347,7 @@ index 0000000000..4c90209188
 +        (void)qemu_savevm_state_complete_precopy(snap_state.file, false, false);
 +        ret = qemu_file_get_error(snap_state.file);
 +        if (ret < 0) {
-+            save_snapshot_error("qemu_savevm_state_complete_precopy error %d", ret);
+                save_snapshot_error("qemu_savevm_state_iterate error %d", ret);
 +        }
 +    }
 +
@@ -345,12 +360,6 @@ index 0000000000..4c90209188
 +        ret || aborted ? MIGRATION_STATUS_FAILED : MIGRATION_STATUS_COMPLETED);
 +    ms->to_dst_file = NULL;
 +
 +    /*
 +     * Same as in migration_iteration_finish(): saving RAM might've turned on CPU throttling for
 +     * auto-converge, make sure to disable it.
 +     */
 +    cpu_throttle_stop();
 +
 +    qemu_savevm_state_cleanup();
 +
 +    ret = save_snapshot_cleanup();
@@ -395,32 +404,18 @@ index 0000000000..4c90209188
 +    }
 +
 +    while (snap_state.state == SAVE_STATE_ACTIVE) {
-+        uint64_t pending_size, pend_precopy, pend_postcopy;
+        uint64_t pending_size, pend_precopy, pend_compatible, pend_postcopy;
 +        uint64_t threshold = 400 * 1000;
 +
-+        /*
+        /* pending is expected to be called without iothread lock */
-+         * pending_{estimate,exact} are expected to be called without iothread
+        qemu_mutex_unlock_iothread();
-+         * lock. Similar to what is done in migration.c, call the exact variant
+        qemu_savevm_state_pending(snap_state.file, 0, &pend_precopy, &pend_compatible, &pend_postcopy);
-+         * only once pend_precopy in the estimate is below the threshold.
+        qemu_mutex_lock_iothread();
 +         */
 +        bql_unlock();
 +        qemu_savevm_state_pending_estimate(&pend_precopy, &pend_postcopy);
 +        if (pend_precopy <= threshold) {
 +            qemu_savevm_state_pending_exact(&pend_precopy, &pend_postcopy);
 +        }
 +        bql_lock();
 +        pending_size = pend_precopy + pend_postcopy;
 +
-+        /*
+        pending_size = pend_precopy + pend_compatible + pend_postcopy;
 +         * A guest reaching this cutoff is dirtying lots of RAM. It should be
 +         * large enough so that the guest can't dirty this much between the
 +         * check and the guest actually being stopped, but it should be small
 +         * enough to avoid long downtimes for non-hibernation snapshots.
 +         */
 +        maxlen = blk_getlength(snap_state.target) - 100*1024*1024;
 +
-+        /* Note that there is no progress for pend_postcopy when iterating */
+        maxlen = blk_getlength(snap_state.target) - 30*1024*1024;
-+        if (pend_precopy > threshold && snap_state.bs_pos + pending_size < maxlen) {
+
 +        if (pending_size > 400000 && snap_state.bs_pos + pending_size < maxlen) {
 +            ret = qemu_savevm_state_iterate(snap_state.file, false);
 +            if (ret < 0) {
 +                save_snapshot_error("qemu_savevm_state_iterate error %d", ret);
@@ -429,7 +424,11 @@ index 0000000000..4c90209188
 +            DPRINTF("savevm iterate pending size %lu ret %d\n", pending_size, ret);
 +        } else {
 +            qemu_system_wakeup_request(QEMU_WAKEUP_REASON_OTHER, NULL);
-+            global_state_store();
+            ret = global_state_store();
 +            if (ret) {
 +                save_snapshot_error("global_state_store error %d", ret);
 +                break;
 +            }
 +
 +            DPRINTF("savevm iterate complete\n");
 +            break;
@@ -448,26 +447,20 @@ index 0000000000..4c90209188
 +     * so move there now and after every flush.
 +     */
 +    aio_co_reschedule_self(qemu_get_aio_context());
-+    bdrv_graph_co_rdlock();
+    for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {
 +    bs = bdrv_first(&it);
 +    bdrv_graph_co_rdunlock();
 +    while (bs) {
 +        /* target has BDRV_O_NO_FLUSH, no sense calling bdrv_flush on it */
-+        if (bs != blk_bs(snap_state.target)) {
+        if (bs == blk_bs(snap_state.target)) {
 +            continue;
 +        }
 +
 +        AioContext *bs_ctx = bdrv_get_aio_context(bs);
 +        if (bs_ctx != qemu_get_aio_context()) {
 +            DPRINTF("savevm: async flushing drive %s\n", bs->filename);
 +            aio_co_reschedule_self(bs_ctx);
 +                bdrv_graph_co_rdlock();
 +            bdrv_flush(bs);
 +                bdrv_graph_co_rdunlock();
 +            aio_co_reschedule_self(qemu_get_aio_context());
 +        }
 +    }
 +        bdrv_graph_co_rdlock();
 +        bs = bdrv_next(&it);
 +        bdrv_graph_co_rdunlock();
 +    }
 +
 +    DPRINTF("timing: async flushing took %ld ms\n",
 +        qemu_clock_get_ms(QEMU_CLOCK_REALTIME) - start_time_flush);
@@ -475,22 +468,28 @@ index 0000000000..4c90209188
 +    qemu_bh_schedule(snap_state.finalize_bh);
 +}
 +
-+void qmp_savevm_start(const char *statefile, Error **errp)
+void qmp_savevm_start(bool has_statefile, const char *statefile, Error **errp)
 +{
 +    Error *local_err = NULL;
 +    MigrationState *ms = migrate_get_current();
 +    AioContext *iohandler_ctx = iohandler_get_aio_context();
 +    int ret = 0;
 +
 +    int bdrv_oflags = BDRV_O_RDWR | BDRV_O_RESIZE | BDRV_O_NO_FLUSH;
 +
 +    if (snap_state.state != SAVE_STATE_DONE) {
-+        error_setg(errp, "VM snapshot already started\n");
+        error_set(errp, ERROR_CLASS_GENERIC_ERROR,
 +                  "VM snapshot already started\n");
 +        return;
 +    }
 +
-+    if (migration_is_running()) {
+    if (migration_is_running(ms->state)) {
-+        error_setg(errp, "There's a migration process in progress");
+        error_set(errp, ERROR_CLASS_GENERIC_ERROR, QERR_MIGRATION_ACTIVE);
 +        return;
 +    }
 +
 +    if (migrate_use_block()) {
 +        error_set(errp, ERROR_CLASS_GENERIC_ERROR,
 +                  "Block migration and snapshots are incompatible");
 +        return;
 +    }
 +
@@ -506,7 +505,7 @@ index 0000000000..4c90209188
 +        snap_state.error = NULL;
 +    }
 +
-+    if (!statefile) {
+    if (!has_statefile) {
 +        vm_stop(RUN_STATE_SAVE_VM);
 +        snap_state.state = SAVE_STATE_COMPLETED;
 +        return;
@@ -522,7 +521,7 @@ index 0000000000..4c90209188
 +    qdict_put_str(options, "driver", "raw");
 +    snap_state.target = blk_new_open(statefile, NULL, options, bdrv_oflags, &local_err);
 +    if (!snap_state.target) {
-+        error_setg(errp, "failed to open '%s'", statefile);
+        error_set(errp, ERROR_CLASS_GENERIC_ERROR, "failed to open '%s'", statefile);
 +        goto restart;
 +    }
 +
@@ -531,7 +530,7 @@ index 0000000000..4c90209188
 +    snap_state.file = qemu_file_new_output(ioc);
 +
 +    if (!snap_state.file) {
-+        error_setg(errp, "failed to open '%s'", statefile);
+        error_set(errp, ERROR_CLASS_GENERIC_ERROR, "failed to open '%s'", statefile);
 +        goto restart;
 +    }
 +
@@ -540,10 +539,8 @@ index 0000000000..4c90209188
 +     * State is cleared in process_savevm_co, but has to be initialized
 +     * here (blocking main thread, from QMP) to avoid race conditions.
 +     */
-+    if (migrate_init(ms, errp)) {
+    migrate_init(ms);
-+        return;
+    memset(&ram_counters, 0, sizeof(ram_counters));
 +    }
 +    memset(&mig_stats, 0, sizeof(mig_stats));
 +    ms->to_dst_file = snap_state.file;
 +
 +    error_setg(&snap_state.blocker, "block device is in use by savevm");
@@ -551,25 +548,17 @@ index 0000000000..4c90209188
 +
 +    snap_state.state = SAVE_STATE_ACTIVE;
 +    snap_state.finalize_bh = qemu_bh_new(process_savevm_finalize, &snap_state);
 +    snap_state.co = qemu_coroutine_create(&process_savevm_co, NULL);
 +    qemu_mutex_unlock_iothread();
 +    qemu_savevm_state_header(snap_state.file);
-+    ret = qemu_savevm_state_setup(snap_state.file, &local_err);
+    qemu_savevm_state_setup(snap_state.file);
-+    if (ret != 0) {
+    qemu_mutex_lock_iothread();
 +        error_setg_errno(errp, -ret, "savevm state setup failed: %s",
 +                         local_err ? error_get_pretty(local_err) : "unknown error");
 +        return;
 +    }
 +
 +    /* Async processing from here on out happens in iohandler context, so let
 +     * the target bdrv have its home there.
 +     */
-+    ret = blk_set_aio_context(snap_state.target, iohandler_ctx, &local_err);
+    blk_set_aio_context(snap_state.target, iohandler_ctx, &local_err);
 +    if (ret != 0) {
 +        warn_report("failed to set iohandler context for VM state target: %s %s",
 +                    local_err ? error_get_pretty(local_err) : "unknown error",
 +                    strerror(-ret));
 +    }
 +
 +    snap_state.co = qemu_coroutine_create(&process_savevm_co, NULL);
 +    aio_co_schedule(iohandler_ctx, snap_state.co);
 +
 +    return;
@@ -584,10 +573,29 @@ index 0000000000..4c90209188
 +    }
 +}
 +
-+static void coroutine_fn wait_for_close_co(void *opaque)
+void coroutine_fn qmp_savevm_end(Error **errp)
 +{
 +    int64_t timeout;
 +
 +    if (snap_state.state == SAVE_STATE_DONE) {
 +        error_set(errp, ERROR_CLASS_GENERIC_ERROR,
 +                  "VM snapshot not started\n");
 +        return;
 +    }
 +
 +    if (snap_state.state == SAVE_STATE_ACTIVE) {
 +        snap_state.state = SAVE_STATE_CANCELLED;
 +        goto wait_for_close;
 +    }
 +
 +    if (snap_state.saved_vm_running) {
 +        vm_start();
 +        snap_state.saved_vm_running = false;
 +    }
 +
 +    snap_state.state = SAVE_STATE_DONE;
 +
 +wait_for_close:
 +    if (!snap_state.target) {
 +        DPRINTF("savevm-end: no target file open\n");
 +        return;
@@ -615,29 +623,20 @@ index 0000000000..4c90209188
 +    DPRINTF("savevm-end: cleanup done\n");
 +}
 +
-+void qmp_savevm_end(Error **errp)
+// FIXME: Deprecated
 +void qmp_snapshot_drive(const char *device, const char *name, Error **errp)
 +{
-+    if (snap_state.state == SAVE_STATE_DONE) {
+    // Compatibility to older qemu-server.
-+        error_setg(errp, "VM snapshot not started\n");
+    qmp_blockdev_snapshot_internal_sync(device, name, errp);
-+        return;
+}
 +    }
 +
-+    Coroutine *wait_for_close = qemu_coroutine_create(wait_for_close_co, NULL);
+// FIXME: Deprecated
-+
+void qmp_delete_drive_snapshot(const char *device, const char *name,
-+    if (snap_state.state == SAVE_STATE_ACTIVE) {
+                               Error **errp)
-+        snap_state.state = SAVE_STATE_CANCELLED;
+{
-+        qemu_coroutine_enter(wait_for_close);
+    // Compatibility to older qemu-server.
-+        return;
+    (void)qmp_blockdev_snapshot_delete_internal_sync(device, false, NULL,
-+    }
+                                                     true, name, errp);
 +
 +    if (snap_state.saved_vm_running) {
 +        vm_start();
 +        snap_state.saved_vm_running = false;
 +    }
 +
 +    snap_state.state = SAVE_STATE_DONE;
 +
 +    qemu_coroutine_enter(wait_for_close);
 +}
 +
 +int load_snapshot_from_blockdev(const char *filename, Error **errp)
@@ -674,10 +673,6 @@ index 0000000000..4c90209188
 +    dirty_bitmap_mig_before_vm_start();
 +
 +    qemu_fclose(f);
 +
 +    /* state_destroy assumes a real migration which would have added a yank */
 +    yank_register_instance(MIGRATION_YANK_INSTANCE, &error_abort);
 +
 +    migration_incoming_state_destroy();
 +    if (ret < 0) {
 +        error_setg_errno(errp, -ret, "Error while loading VM state");
@@ -695,28 +690,39 @@ index 0000000000..4c90209188
 +    return ret;
 +}
 diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
-index f601d06ab8..874084565f 100644
+index 15572befb1..1507180990 100644
 --- a/monitor/hmp-cmds.c
 +++ b/monitor/hmp-cmds.c
-@@ -24,6 +24,7 @@
+@@ -1925,6 +1925,63 @@ void hmp_info_memory_devices(Monitor *mon, const QDict *qdict)
- #include "qapi/error.h"
+     hmp_handle_error(mon, err);
 #include "qapi/qapi-commands-control.h"
 #include "qapi/qapi-commands-machine.h"
 +#include "qapi/qapi-commands-migration.h"
 #include "qapi/qapi-commands-misc.h"
 #include "qapi/qmp/qdict.h"
 #include "qemu/cutils.h"
@@ -434,3 +435,40 @@ void hmp_dumpdtb(Monitor *mon, const QDict *qdict)
     monitor_printf(mon, "dtb dumped to %s", filename);
 }
- #endif
+ 
 +
 +void hmp_savevm_start(Monitor *mon, const QDict *qdict)
 +{
 +    Error *errp = NULL;
 +    const char *statefile = qdict_get_try_str(qdict, "statefile");
 +
-+    qmp_savevm_start(statefile, &errp);
+    qmp_savevm_start(statefile != NULL, statefile, &errp);
 +    hmp_handle_error(mon, errp);
 +}
 +
 +void hmp_snapshot_drive(Monitor *mon, const QDict *qdict)
 +{
 +    Error *errp = NULL;
 +    const char *name = qdict_get_str(qdict, "name");
 +    const char *device = qdict_get_str(qdict, "device");
 +
 +    qmp_snapshot_drive(device, name, &errp);
 +    hmp_handle_error(mon, errp);
 +}
 +
 +void hmp_delete_drive_snapshot(Monitor *mon, const QDict *qdict)
 +{
 +    Error *errp = NULL;
 +    const char *name = qdict_get_str(qdict, "name");
 +    const char *device = qdict_get_str(qdict, "device");
 +
 +    qmp_delete_drive_snapshot(device, name, &errp);
 +    hmp_handle_error(mon, errp);
 +}
 +
@@ -733,7 +739,7 @@ index f601d06ab8..874084565f 100644
 +    SaveVMInfo *info;
 +    info = qmp_query_savevm(NULL);
 +
-+    if (info->status) {
+    if (info->has_status) {
 +        monitor_printf(mon, "savevm status: %s\n", info->status);
 +        monitor_printf(mon, "total time: %" PRIu64 " milliseconds\n",
 +                       info->total_time);
@@ -743,17 +749,21 @@ index f601d06ab8..874084565f 100644
 +    if (info->has_bytes) {
 +        monitor_printf(mon, "Bytes saved: %"PRIu64"\n", info->bytes);
 +    }
-+    if (info->error) {
+    if (info->has_error) {
 +        monitor_printf(mon, "Error: %s\n", info->error);
 +    }
 +}
 +
 void hmp_info_iothreads(Monitor *mon, const QDict *qdict)
 {
     IOThreadInfoList *info_list = qmp_query_iothreads(NULL);
 diff --git a/qapi/migration.json b/qapi/migration.json
-index 7324571e92..d6e94a7c41 100644
+index 81185d4311..3129f71fa8 100644
 --- a/qapi/migration.json
 +++ b/qapi/migration.json
-@@ -276,6 +276,40 @@
+@@ -261,6 +261,40 @@
-            '*dirty-limit-throttle-time-per-round': 'uint64',
+            '*compression': 'CompressionStats',
-            '*dirty-limit-ring-full-time': 'uint64'} }
+            '*socket-address': ['SocketAddress'] } }
 +##
 +# @SaveVMInfo:
@@ -793,10 +803,10 @@ index 7324571e92..d6e94a7c41 100644
 # @query-migrate:
 #
 diff --git a/qapi/misc.json b/qapi/misc.json
-index 559b66f201..7959e89c1e 100644
+index 27ef5a2b20..b3ce75dcae 100644
 --- a/qapi/misc.json
 +++ b/qapi/misc.json
-@@ -454,6 +454,24 @@
+@@ -435,6 +435,38 @@
 ##
 { 'command': 'query-fdsets', 'returns': ['FdsetInfo'] }
@@ -805,27 +815,41 @@ index 559b66f201..7959e89c1e 100644
 +#
 +# Prepare for snapshot and halt VM. Save VM state to statefile.
 +#
 +# @statefile: target file that state should be written to.
 +#
 +##
 +{ 'command': 'savevm-start', 'data': { '*statefile': 'str' } }
 +
 +##
 +# @snapshot-drive:
 +#
 +# Create an internal drive snapshot.
 +#
 +##
 +{ 'command': 'snapshot-drive', 'data': { 'device': 'str', 'name': 'str' } }
 +
 +##
 +# @delete-drive-snapshot:
 +#
 +# Delete a drive snapshot.
 +#
 +##
 +{ 'command': 'delete-drive-snapshot', 'data': { 'device': 'str', 'name': 'str' } }
 +
 +##
 +# @savevm-end:
 +#
 +# Resume VM after a snapshot.
 +#
 +##
-+{ 'command': 'savevm-end' }
+{ 'command': 'savevm-end', 'coroutine': true }
 +
 ##
 # @CommandLineParameterType:
 #
 diff --git a/qemu-options.hx b/qemu-options.hx
-index d94e2cbbae..07730f9e65 100644
+index 31c04f7eea..c2ca6e91b5 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
-@@ -4805,6 +4805,18 @@ SRST
+@@ -4341,6 +4341,18 @@ SRST
     Start right away with a saved state (``loadvm`` in monitor)
 ERST
@@ -844,11 +868,11 @@ index d94e2cbbae..07730f9e65 100644
 #ifndef _WIN32
 DEF("daemonize", 0, QEMU_OPTION_daemonize, \
     "-daemonize      daemonize QEMU after initializing\n", QEMU_ARCH_ALL)
-diff --git a/system/vl.c b/system/vl.c
+diff --git a/softmmu/vl.c b/softmmu/vl.c
-index 01b8b8e77a..d6bbdc906e 100644
+index 706bd7cff7..b8637c4262 100644
--- a/system/vl.c
+--- a/softmmu/vl.c
-+++ b/system/vl.c
+++ b/softmmu/vl.c
-@@ -164,6 +164,7 @@ static const char *accelerators;
+@@ -165,6 +165,7 @@ static const char *accelerators;
 static bool have_custom_ram_size;
 static const char *ram_memdev_id;
 static QDict *machine_opts_dict;
@@ -856,10 +880,10 @@ index 01b8b8e77a..d6bbdc906e 100644
 static QTAILQ_HEAD(, ObjectOption) object_opts = QTAILQ_HEAD_INITIALIZER(object_opts);
 static QTAILQ_HEAD(, DeviceOption) device_opts = QTAILQ_HEAD_INITIALIZER(device_opts);
 static int display_remote;
-@@ -2727,6 +2728,12 @@ void qmp_x_exit_preconfig(Error **errp)
+@@ -2584,6 +2585,12 @@ void qmp_x_exit_preconfig(Error **errp)
-         RunState state = autostart ? RUN_STATE_RUNNING : runstate_get();
+ 
     if (loadvm) {
         load_snapshot(loadvm, NULL, false, NULL, &error_fatal);
         load_snapshot_resume(state);
 +    } else if (loadstate) {
 +        Error *local_err = NULL;
 +        if (load_snapshot_from_blockdev(loadstate, &local_err) < 0) {
@@ -869,7 +893,7 @@ index 01b8b8e77a..d6bbdc906e 100644
     }
     if (replay_mode != REPLAY_MODE_NONE) {
         replay_vmstate_init();
-@@ -3275,6 +3282,9 @@ void qemu_init(int argc, char **argv)
+@@ -3133,6 +3140,9 @@ void qemu_init(int argc, char **argv, char **envp)
             case QEMU_OPTION_loadvm:
                 loadvm = optarg;
                 break;
--- a/debian/patches/pve/0018-PVE-add-optional-buffer-size-to-QEMUFile.patch
+++ b/debian/patches/pve/0018-PVE-add-optional-buffer-size-to-QEMUFile.patch
@@ -13,18 +13,18 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 [FE: adapt to removal of QEMUFileOps]
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
- migration/qemu-file.c    | 48 +++++++++++++++++++++++++++-------------
+ migration/qemu-file.c    | 49 +++++++++++++++++++++++++++-------------
 migration/qemu-file.h    |  2 ++
- migration/savevm-async.c |  5 +++--
+ migration/savevm-async.c |  5 ++--
- 3 files changed, 38 insertions(+), 17 deletions(-)
+ 3 files changed, 38 insertions(+), 18 deletions(-)
 diff --git a/migration/qemu-file.c b/migration/qemu-file.c
-index b6d2f588bd..754dc0b3f7 100644
+index 4f400c2e52..21e8998867 100644
 --- a/migration/qemu-file.c
 +++ b/migration/qemu-file.c
-@@ -34,8 +34,8 @@
+@@ -31,8 +31,8 @@
- #include "rdma.h"
+ #include "trace.h"
- #include "io/channel-file.h"
+ #include "qapi/error.h"
 -#define IO_BUF_SIZE 32768
 -#define MAX_IOV_SIZE MIN_CONST(IOV_MAX, 64)
@@ -32,8 +32,8 @@ index b6d2f588bd..754dc0b3f7 100644
 +#define MAX_IOV_SIZE MIN_CONST(IOV_MAX, 256)
 struct QEMUFile {
-     QIOChannel *ioc;
+     const QEMUFileHooks *hooks;
-@@ -43,7 +43,8 @@ struct QEMUFile {
+@@ -55,7 +55,8 @@ struct QEMUFile {
     int buf_index;
     int buf_size; /* 0 when writing */
@@ -43,8 +43,8 @@ index b6d2f588bd..754dc0b3f7 100644
     DECLARE_BITMAP(may_free, MAX_IOV_SIZE);
     struct iovec iov[MAX_IOV_SIZE];
-@@ -100,7 +101,9 @@ int qemu_file_shutdown(QEMUFile *f)
+@@ -106,7 +107,9 @@ bool qemu_file_mode_is_not_valid(const char *mode)
-     return 0;
+     return false;
 }
 -static QEMUFile *qemu_file_new_impl(QIOChannel *ioc, bool is_writable)
@@ -54,7 +54,7 @@ index b6d2f588bd..754dc0b3f7 100644
 {
     QEMUFile *f;
-@@ -109,6 +112,8 @@ static QEMUFile *qemu_file_new_impl(QIOChannel *ioc, bool is_writable)
+@@ -115,6 +118,8 @@ static QEMUFile *qemu_file_new_impl(QIOChannel *ioc, bool is_writable)
     object_ref(ioc);
     f->ioc = ioc;
     f->is_writable = is_writable;
@@ -63,7 +63,7 @@ index b6d2f588bd..754dc0b3f7 100644
     return f;
 }
-@@ -119,17 +124,27 @@ static QEMUFile *qemu_file_new_impl(QIOChannel *ioc, bool is_writable)
+@@ -125,17 +130,27 @@ static QEMUFile *qemu_file_new_impl(QIOChannel *ioc, bool is_writable)
  */
 QEMUFile *qemu_file_get_return_path(QEMUFile *f)
 {
@@ -93,8 +93,8 @@ index b6d2f588bd..754dc0b3f7 100644
 +    return qemu_file_new_impl(ioc, false, buffer_size);
 }
- /*
+ void qemu_file_set_hooks(QEMUFile *f, const QEMUFileHooks *hooks)
-@@ -327,7 +342,7 @@ static ssize_t coroutine_mixed_fn qemu_fill_buffer(QEMUFile *f)
+@@ -393,7 +408,7 @@ static ssize_t qemu_fill_buffer(QEMUFile *f)
     do {
         len = qio_channel_read(f->ioc,
                                (char *)f->buf + pending,
@@ -103,17 +103,16 @@ index b6d2f588bd..754dc0b3f7 100644
                                &local_error);
         if (len == QIO_CHANNEL_ERR_BLOCK) {
             if (qemu_in_coroutine()) {
-@@ -367,6 +382,9 @@ int qemu_fclose(QEMUFile *f)
+@@ -443,6 +458,8 @@ int qemu_fclose(QEMUFile *f)
         ret = ret2;
     }
     g_clear_pointer(&f->ioc, object_unref);
-+
+ 
 +    free(f->buf);
 +
-     error_free(f->last_error_obj);
+     /* If any error was spotted before closing, we should report it
-     g_free(f);
+      * instead of the close() return value.
-     trace_qemu_file_fclose();
+      */
-@@ -415,7 +433,7 @@ static void add_buf_to_iovec(QEMUFile *f, size_t len)
+@@ -497,7 +514,7 @@ static void add_buf_to_iovec(QEMUFile *f, size_t len)
 {
     if (!add_to_iovec(f, f->buf + f->buf_index, len, false)) {
         f->buf_index += len;
@@ -122,7 +121,7 @@ index b6d2f588bd..754dc0b3f7 100644
             qemu_fflush(f);
         }
     }
-@@ -440,7 +458,7 @@ void qemu_put_buffer(QEMUFile *f, const uint8_t *buf, size_t size)
+@@ -523,7 +540,7 @@ void qemu_put_buffer(QEMUFile *f, const uint8_t *buf, size_t size)
     }
     while (size > 0) {
@@ -131,7 +130,7 @@ index b6d2f588bd..754dc0b3f7 100644
         if (l > size) {
             l = size;
         }
-@@ -586,8 +604,8 @@ size_t coroutine_mixed_fn qemu_peek_buffer(QEMUFile *f, uint8_t **buf, size_t si
+@@ -570,8 +587,8 @@ size_t qemu_peek_buffer(QEMUFile *f, uint8_t **buf, size_t size, size_t offset)
     size_t index;
     assert(!qemu_file_is_writable(f));
@@ -142,7 +141,7 @@ index b6d2f588bd..754dc0b3f7 100644
     /* The 1st byte to read from */
     index = f->buf_index + offset;
-@@ -637,7 +655,7 @@ size_t coroutine_mixed_fn qemu_get_buffer(QEMUFile *f, uint8_t *buf, size_t size
+@@ -621,7 +638,7 @@ size_t qemu_get_buffer(QEMUFile *f, uint8_t *buf, size_t size)
         size_t res;
         uint8_t *src;
@@ -151,16 +150,16 @@ index b6d2f588bd..754dc0b3f7 100644
         if (res == 0) {
             return done;
         }
-@@ -671,7 +689,7 @@ size_t coroutine_mixed_fn qemu_get_buffer(QEMUFile *f, uint8_t *buf, size_t size
+@@ -655,7 +672,7 @@ size_t qemu_get_buffer(QEMUFile *f, uint8_t *buf, size_t size)
  */
- size_t coroutine_mixed_fn qemu_get_buffer_in_place(QEMUFile *f, uint8_t **buf, size_t size)
+ size_t qemu_get_buffer_in_place(QEMUFile *f, uint8_t **buf, size_t size)
 {
 -    if (size < IO_BUF_SIZE) {
 +    if (size < f->buf_allocated_size) {
         size_t res;
         uint8_t *src = NULL;
-@@ -696,7 +714,7 @@ int coroutine_mixed_fn qemu_peek_byte(QEMUFile *f, int offset)
+@@ -680,7 +697,7 @@ int qemu_peek_byte(QEMUFile *f, int offset)
     int index = f->buf_index + offset;
     assert(!qemu_file_is_writable(f));
@@ -169,25 +168,34 @@ index b6d2f588bd..754dc0b3f7 100644
     if (index >= f->buf_size) {
         qemu_fill_buffer(f);
@@ -832,7 +849,7 @@ static int qemu_compress_data(z_stream *stream, uint8_t *dest, size_t dest_len,
 ssize_t qemu_put_compression_data(QEMUFile *f, z_stream *stream,
                                   const uint8_t *p, size_t size)
 {
 -    ssize_t blen = IO_BUF_SIZE - f->buf_index - sizeof(int32_t);
 +    ssize_t blen = f->buf_allocated_size - f->buf_index - sizeof(int32_t);
     if (blen < compressBound(size)) {
         return -1;
 diff --git a/migration/qemu-file.h b/migration/qemu-file.h
-index 11c2120edd..edf3c5d147 100644
+index fa13d04d78..914f1a63a8 100644
 --- a/migration/qemu-file.h
 +++ b/migration/qemu-file.h
-@@ -30,7 +30,9 @@
+@@ -63,7 +63,9 @@ typedef struct QEMUFileHooks {
- #include "io/channel.h"
+ } QEMUFileHooks;
 QEMUFile *qemu_file_new_input(QIOChannel *ioc);
 +QEMUFile *qemu_file_new_input_sized(QIOChannel *ioc, size_t buffer_size);
 QEMUFile *qemu_file_new_output(QIOChannel *ioc);
 +QEMUFile *qemu_file_new_output_sized(QIOChannel *ioc, size_t buffer_size);
 void qemu_file_set_hooks(QEMUFile *f, const QEMUFileHooks *hooks);
 int qemu_fclose(QEMUFile *f);
 /*
 diff --git a/migration/savevm-async.c b/migration/savevm-async.c
-index 4c90209188..eb562d3dcf 100644
+index b3692739a0..e65a5e3482 100644
 --- a/migration/savevm-async.c
 +++ b/migration/savevm-async.c
-@@ -381,7 +381,7 @@ void qmp_savevm_start(const char *statefile, Error **errp)
+@@ -367,7 +367,7 @@ void qmp_savevm_start(bool has_statefile, const char *statefile, Error **errp)
     QIOChannel *ioc = QIO_CHANNEL(qio_channel_savevm_async_new(snap_state.target,
                                                                &snap_state.bs_pos));
@@ -195,8 +203,8 @@ index 4c90209188..eb562d3dcf 100644
 +    snap_state.file = qemu_file_new_output_sized(ioc, 4 * 1024 * 1024);
     if (!snap_state.file) {
-         error_setg(errp, "failed to open '%s'", statefile);
+         error_set(errp, ERROR_CLASS_GENERIC_ERROR, "failed to open '%s'", statefile);
-@@ -514,7 +514,8 @@ int load_snapshot_from_blockdev(const char *filename, Error **errp)
+@@ -500,7 +500,8 @@ int load_snapshot_from_blockdev(const char *filename, Error **errp)
     blk_op_block_all(be, blocker);
     /* restore the VM state */
--- a/debian/patches/pve/0019-PVE-block-add-the-zeroinit-block-driver-filter.patch
+++ b/debian/patches/pve/0019-PVE-block-add-the-zeroinit-block-driver-filter.patch
@@ -4,34 +4,32 @@ Date: Mon, 6 Apr 2020 12:16:47 +0200
 Subject: [PATCH] PVE: block: add the zeroinit block driver filter
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
-[FE: adapt to changed function signatures
+[adapt to changed function signatures]
-     adhere to block graph lock requirements
+Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
     use dedicated function to open file child]
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 block/meson.build |   1 +
- block/zeroinit.c  | 207 ++++++++++++++++++++++++++++++++++++++++++++++
+ block/zeroinit.c  | 196 ++++++++++++++++++++++++++++++++++++++++++++++
- 2 files changed, 208 insertions(+)
+ 2 files changed, 197 insertions(+)
 create mode 100644 block/zeroinit.c
 diff --git a/block/meson.build b/block/meson.build
-index f1262ec2ba..6a60b5d6b9 100644
+index 60bc305597..ad40c10b6a 100644
 --- a/block/meson.build
 +++ b/block/meson.build
-@@ -39,6 +39,7 @@ block_ss.add(files(
+@@ -43,6 +43,7 @@ block_ss.add(files(
-   'throttle.c',
+   'vmdk.c',
-   'throttle-groups.c',
+   'vpc.c',
   'write-threshold.c',
 +  'zeroinit.c',
- ), zstd, zlib)
+ ), zstd, zlib, gnutls)
- system_ss.add(when: 'CONFIG_TCG', if_true: files('blkreplay.c'))
+ softmmu_ss.add(when: 'CONFIG_TCG', if_true: files('blkreplay.c'))
 diff --git a/block/zeroinit.c b/block/zeroinit.c
 new file mode 100644
-index 0000000000..2b2b194ccf
+index 0000000000..20ee611f22
 --- /dev/null
 +++ b/block/zeroinit.c
-@@ -0,0 +1,207 @@
+@@ -0,0 +1,196 @@
 +/*
 + * Filter to fake a zero-initialized block device.
 + *
@@ -45,8 +43,6 @@ index 0000000000..2b2b194ccf
 +#include "qemu/osdep.h"
 +#include "qapi/error.h"
 +#include "block/block_int.h"
 +#include "block/block-io.h"
 +#include "block/graph-lock.h"
 +#include "qapi/qmp/qdict.h"
 +#include "qapi/qmp/qstring.h"
 +#include "qemu/cutils.h"
@@ -112,9 +108,10 @@ index 0000000000..2b2b194ccf
 +    }
 +
 +    /* Open the raw file */
-+    ret = bdrv_open_file_child(qemu_opt_get(opts, "x-next"), options, "next",
+    bs->file = bdrv_open_child(qemu_opt_get(opts, "x-next"), options, "next",
-+                               bs, &local_err);
+                               bs, &child_of_bds, BDRV_CHILD_FILTERED, false, &local_err);
-+    if (ret < 0) {
+    if (local_err) {
 +        ret = -EINVAL;
 +        error_propagate(errp, local_err);
 +        goto fail;
 +    }
@@ -125,9 +122,7 @@ index 0000000000..2b2b194ccf
 +    ret = 0;
 +fail:
 +    if (ret < 0) {
 +        bdrv_graph_wrlock();
 +        bdrv_unref_child(bs, bs->file);
 +        bdrv_graph_wrunlock();
 +    }
 +    qemu_opts_del(opts);
 +    return ret;
@@ -139,22 +134,19 @@ index 0000000000..2b2b194ccf
 +    (void)s;
 +}
 +
-+static coroutine_fn int64_t GRAPH_RDLOCK
+static int64_t zeroinit_getlength(BlockDriverState *bs)
 +zeroinit_co_getlength(BlockDriverState *bs)
 +{
-+    return bdrv_co_getlength(bs->file->bs);
+    return bdrv_getlength(bs->file->bs);
 +}
 +
-+static int coroutine_fn GRAPH_RDLOCK
+static int coroutine_fn zeroinit_co_preadv(BlockDriverState *bs,
-+zeroinit_co_preadv(BlockDriverState *bs, int64_t offset, int64_t bytes,
+    int64_t offset, int64_t bytes, QEMUIOVector *qiov, BdrvRequestFlags flags)
 +                   QEMUIOVector *qiov, BdrvRequestFlags flags)
 +{
 +    return bdrv_co_preadv(bs->file, offset, bytes, qiov, flags);
 +}
 +
-+static int coroutine_fn GRAPH_RDLOCK
+static int coroutine_fn zeroinit_co_pwrite_zeroes(BlockDriverState *bs, int64_t offset,
-+zeroinit_co_pwrite_zeroes(BlockDriverState *bs, int64_t offset, int64_t bytes,
+                                                 int64_t bytes, BdrvRequestFlags flags)
 +                          BdrvRequestFlags flags)
 +{
 +    BDRVZeroinitState *s = bs->opaque;
 +    if (offset >= s->extents)
@@ -162,9 +154,8 @@ index 0000000000..2b2b194ccf
 +    return bdrv_pwrite_zeroes(bs->file, offset, bytes, flags);
 +}
 +
-+static int coroutine_fn GRAPH_RDLOCK
+static int coroutine_fn zeroinit_co_pwritev(BlockDriverState *bs,
-+zeroinit_co_pwritev(BlockDriverState *bs, int64_t offset, int64_t bytes,
+    int64_t offset, int64_t bytes, QEMUIOVector *qiov, BdrvRequestFlags flags)
 +                    QEMUIOVector *qiov, BdrvRequestFlags flags)
 +{
 +    BDRVZeroinitState *s = bs->opaque;
 +    int64_t extents = offset + bytes;
@@ -173,37 +164,33 @@ index 0000000000..2b2b194ccf
 +    return bdrv_co_pwritev(bs->file, offset, bytes, qiov, flags);
 +}
 +
-+static coroutine_fn int GRAPH_RDLOCK
+static coroutine_fn int zeroinit_co_flush(BlockDriverState *bs)
 +zeroinit_co_flush(BlockDriverState *bs)
 +{
 +    return bdrv_co_flush(bs->file->bs);
 +}
 +
-+static int GRAPH_RDLOCK
+static int zeroinit_has_zero_init(BlockDriverState *bs)
 +zeroinit_has_zero_init(BlockDriverState *bs)
 +{
 +    BDRVZeroinitState *s = bs->opaque;
 +    return s->has_zero_init;
 +}
 +
-+static int coroutine_fn GRAPH_RDLOCK
+static int coroutine_fn zeroinit_co_pdiscard(BlockDriverState *bs,
-+zeroinit_co_pdiscard(BlockDriverState *bs, int64_t offset, int64_t bytes)
+                                             int64_t offset, int64_t bytes)
 +{
 +    return bdrv_co_pdiscard(bs->file, offset, bytes);
 +}
 +
-+static int GRAPH_RDLOCK
+static int zeroinit_co_truncate(BlockDriverState *bs, int64_t offset,
-+zeroinit_co_truncate(BlockDriverState *bs, int64_t offset, _Bool exact,
+                                _Bool exact, PreallocMode prealloc,
-+                     PreallocMode prealloc, BdrvRequestFlags req_flags,
+                                BdrvRequestFlags req_flags, Error **errp)
 +                     Error **errp)
 +{
 +    return bdrv_co_truncate(bs->file, offset, exact, prealloc, req_flags, errp);
 +}
 +
-+static coroutine_fn int GRAPH_RDLOCK
+static int zeroinit_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
 +zeroinit_co_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
 +{
-+    return bdrv_co_get_info(bs->file->bs, bdi);
+    return bdrv_get_info(bs->file->bs, bdi);
 +}
 +
 +static BlockDriver bdrv_zeroinit = {
@@ -212,9 +199,9 @@ index 0000000000..2b2b194ccf
 +    .instance_size                    = sizeof(BDRVZeroinitState),
 +
 +    .bdrv_parse_filename              = zeroinit_parse_filename,
-+    .bdrv_open                        = zeroinit_open,
+    .bdrv_file_open                   = zeroinit_open,
 +    .bdrv_close                       = zeroinit_close,
-+    .bdrv_co_getlength                = zeroinit_co_getlength,
+    .bdrv_getlength                   = zeroinit_getlength,
 +    .bdrv_child_perm                  = bdrv_default_perms,
 +    .bdrv_co_flush_to_disk            = zeroinit_co_flush,
 +
@@ -230,7 +217,7 @@ index 0000000000..2b2b194ccf
 +    .bdrv_co_pdiscard                 = zeroinit_co_pdiscard,
 +
 +    .bdrv_co_truncate                 = zeroinit_co_truncate,
-+    .bdrv_co_get_info                 = zeroinit_co_get_info,
+    .bdrv_get_info                    = zeroinit_get_info,
 +};
 +
 +static void bdrv_zeroinit_init(void)
--- a/debian/patches/pve/0020-PVE-Add-dummy-id-command-line-parameter.patch
+++ b/debian/patches/pve/0020-PVE-Add-dummy-id-command-line-parameter.patch
@@ -10,14 +10,14 @@ Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
 qemu-options.hx | 3 +++
- system/vl.c     | 8 ++++++++
+ softmmu/vl.c    | 8 ++++++++
 2 files changed, 11 insertions(+)
 diff --git a/qemu-options.hx b/qemu-options.hx
-index 07730f9e65..7fdc944965 100644
+index c2ca6e91b5..ab4734ef32 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
-@@ -1239,6 +1239,9 @@ legacy PC, they are not recommended for modern configurations.
+@@ -1118,6 +1118,9 @@ backend describes how QEMU handles the data.
 ERST
@@ -27,11 +27,11 @@ index 07730f9e65..7fdc944965 100644
 DEF("fda", HAS_ARG, QEMU_OPTION_fda,
     "-fda/-fdb file  use 'file' as floppy disk 0/1 image\n", QEMU_ARCH_ALL)
 DEF("fdb", HAS_ARG, QEMU_OPTION_fdb, "", QEMU_ARCH_ALL)
-diff --git a/system/vl.c b/system/vl.c
+diff --git a/softmmu/vl.c b/softmmu/vl.c
-index d6bbdc906e..200468a753 100644
+index b8637c4262..39f149924e 100644
--- a/system/vl.c
+--- a/softmmu/vl.c
-+++ b/system/vl.c
+++ b/softmmu/vl.c
-@@ -2764,6 +2764,7 @@ void qemu_init(int argc, char **argv)
+@@ -2620,6 +2620,7 @@ void qemu_init(int argc, char **argv, char **envp)
     MachineClass *machine_class;
     bool userconfig = true;
     FILE *vmstate_dump_file = NULL;
@@ -39,7 +39,7 @@ index d6bbdc906e..200468a753 100644
     qemu_add_opts(&qemu_drive_opts);
     qemu_add_drive_opts(&qemu_legacy_drive_opts);
-@@ -3387,6 +3388,13 @@ void qemu_init(int argc, char **argv)
+@@ -3245,6 +3246,13 @@ void qemu_init(int argc, char **argv, char **envp)
                 machine_parse_property_opt(qemu_find_opts("smp-opts"),
                                            "smp", optarg);
                 break;
@@ -50,6 +50,6 @@ index d6bbdc906e..200468a753 100644
 +                    exit(1);
 +                }
 +                break;
 #ifdef CONFIG_VNC
             case QEMU_OPTION_vnc:
                 vnc_parse(optarg);
                 break;
--- a/debian/patches/pve/0021-PVE-Config-Revert-target-i386-disable-LINT0-after-re.patch
+++ b/debian/patches/pve/0021-PVE-Config-Revert-target-i386-disable-LINT0-after-re.patch
@@ -11,10 +11,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 1 file changed, 9 insertions(+)
 diff --git a/hw/intc/apic_common.c b/hw/intc/apic_common.c
-index c13cdd7994..fd5808cdc0 100644
+index 2a20982066..7968ad5a93 100644
 --- a/hw/intc/apic_common.c
 +++ b/hw/intc/apic_common.c
-@@ -263,6 +263,15 @@ static void apic_reset_common(DeviceState *dev)
+@@ -278,6 +278,15 @@ static void apic_reset_common(DeviceState *dev)
     info->vapic_base_update(s);
     apic_init_reset(dev);
--- a/debian/patches/pve/0022-PVE-Up-Config-file-posix-make-locking-optiono-on-cre.patch
+++ b/debian/patches/pve/0022-PVE-Up-Config-file-posix-make-locking-optiono-on-cre.patch
@@ -9,14 +9,14 @@ Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
 block/file-posix.c   | 59 ++++++++++++++++++++++++++++++--------------
- qapi/block-core.json |  7 +++++-
+ qapi/block-core.json |  3 ++-
- 2 files changed, 46 insertions(+), 20 deletions(-)
+ 2 files changed, 42 insertions(+), 20 deletions(-)
 diff --git a/block/file-posix.c b/block/file-posix.c
-index 99e5bea1cc..6a4f6a25e6 100644
+index 3d60b80286..49ee1db5f9 100644
 --- a/block/file-posix.c
 +++ b/block/file-posix.c
-@@ -2884,6 +2884,7 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
+@@ -2475,6 +2475,7 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
     int fd;
     uint64_t perm, shared;
     int result = 0;
@@ -24,7 +24,7 @@ index 99e5bea1cc..6a4f6a25e6 100644
     /* Validate options and set default values */
     assert(options->driver == BLOCKDEV_DRIVER_FILE);
-@@ -2924,19 +2925,22 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
+@@ -2515,19 +2516,22 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
     perm = BLK_PERM_WRITE | BLK_PERM_RESIZE;
     shared = BLK_PERM_ALL & ~BLK_PERM_RESIZE;
@@ -59,7 +59,7 @@ index 99e5bea1cc..6a4f6a25e6 100644
     }
     /* Clear the file by truncating it to 0 */
-@@ -2990,13 +2994,15 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
+@@ -2581,13 +2585,15 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
     }
 out_unlock:
@@ -82,7 +82,7 @@ index 99e5bea1cc..6a4f6a25e6 100644
     }
 out_close:
-@@ -3020,6 +3026,7 @@ raw_co_create_opts(BlockDriver *drv, const char *filename,
+@@ -2612,6 +2618,7 @@ static int coroutine_fn raw_co_create_opts(BlockDriver *drv,
     PreallocMode prealloc;
     char *buf = NULL;
     Error *local_err = NULL;
@@ -90,7 +90,7 @@ index 99e5bea1cc..6a4f6a25e6 100644
     /* Skip file: protocol prefix */
     strstart(filename, "file:", &filename);
-@@ -3042,6 +3049,18 @@ raw_co_create_opts(BlockDriver *drv, const char *filename,
+@@ -2634,6 +2641,18 @@ static int coroutine_fn raw_co_create_opts(BlockDriver *drv,
         return -EINVAL;
     }
@@ -109,7 +109,7 @@ index 99e5bea1cc..6a4f6a25e6 100644
     options = (BlockdevCreateOptions) {
         .driver     = BLOCKDEV_DRIVER_FILE,
         .u.file     = {
-@@ -3053,6 +3072,8 @@ raw_co_create_opts(BlockDriver *drv, const char *filename,
+@@ -2645,6 +2664,8 @@ static int coroutine_fn raw_co_create_opts(BlockDriver *drv,
             .nocow              = nocow,
             .has_extent_size_hint = has_extent_size_hint,
             .extent_size_hint   = extent_size_hint,
@@ -119,21 +119,10 @@ index 99e5bea1cc..6a4f6a25e6 100644
     };
     return raw_co_create(&options, errp);
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index c2a337cc04..1cb6f04db3 100644
+index e1857e7094..ddac91e8f6 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -4959,6 +4959,10 @@
+@@ -4537,7 +4537,8 @@
 # @extent-size-hint: Extent size hint to add to the image file; 0 for
 #     not adding an extent size hint (default: 1 MB, since 5.1)
 #
 +# @locking: whether to enable file locking.  If set to 'auto', only
 +#     enable when Open File Descriptor (OFD) locking API is available
 +#     (default: auto).
 +#
 # Since: 2.12
 ##
 { 'struct': 'BlockdevCreateOptionsFile',
@@ -4966,7 +4970,8 @@
             'size':                 'size',
             '*preallocation':       'PreallocMode',
             '*nocow':               'bool',
--- a/debian/patches/pve/0023-PVE-monitor-disable-oob-capability.patch
+++ b/debian/patches/pve/0023-PVE-monitor-disable-oob-capability.patch
@@ -18,10 +18,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 1 file changed, 1 insertion(+), 2 deletions(-)
 diff --git a/monitor/qmp.c b/monitor/qmp.c
-index eb181d5979..20fc0d20a6 100644
+index 6b8cfcf6d8..3ec67e32d3 100644
 --- a/monitor/qmp.c
 +++ b/monitor/qmp.c
-@@ -534,8 +534,7 @@ void monitor_init_qmp(Chardev *chr, bool pretty, Error **errp)
+@@ -519,8 +519,7 @@ void monitor_init_qmp(Chardev *chr, bool pretty, Error **errp)
     qemu_chr_fe_set_echo(&mon->common.chr, true);
     /* Note: we run QMP monitor in I/O thread when @chr supports that */
--- a/debian/patches/pve/0024-PVE-Compat-4.0-used-balloon-qemu-4-0-config-size-fal.patch
+++ b/debian/patches/pve/0024-PVE-Compat-4.0-used-balloon-qemu-4-0-config-size-fal.patch
@@ -26,10 +26,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 1 file changed, 2 insertions(+), 1 deletion(-)
 diff --git a/hw/core/machine.c b/hw/core/machine.c
-index 27dcda0248..7a13e9f014 100644
+index a673302cce..fa424440bd 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
-@@ -173,7 +173,8 @@ GlobalProperty hw_compat_4_0[] = {
+@@ -127,7 +127,8 @@ GlobalProperty hw_compat_4_0[] = {
     { "virtio-vga",     "edid", "false" },
     { "virtio-gpu-device", "edid", "false" },
     { "virtio-device", "use-started", "false" },
--- a/debian/patches/pve/0025-PVE-Allow-version-code-in-machine-type.patch
+++ b/debian/patches/pve/0025-PVE-Allow-version-code-in-machine-type.patch
@@ -11,90 +11,90 @@ and only if 'is-current').
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 [FE: adapt to QAPI changes]
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
- hw/core/machine-qmp-cmds.c |  5 +++++
+ hw/core/machine-qmp-cmds.c |  6 ++++++
 include/hw/boards.h        |  2 ++
- qapi/machine.json          |  3 +++
+ qapi/machine.json          |  4 +++-
- system/vl.c                | 24 ++++++++++++++++++++++++
+ softmmu/vl.c               | 25 +++++++++++++++++++++++++
- 4 files changed, 34 insertions(+)
+ 4 files changed, 36 insertions(+), 1 deletion(-)
 diff --git a/hw/core/machine-qmp-cmds.c b/hw/core/machine-qmp-cmds.c
-index 52a6d74820..362128842d 100644
+index 76fff60a6b..ec9201fb9a 100644
 --- a/hw/core/machine-qmp-cmds.c
 +++ b/hw/core/machine-qmp-cmds.c
-@@ -94,6 +94,11 @@ MachineInfoList *qmp_query_machines(bool has_compat_props, bool compat_props,
+@@ -103,6 +103,12 @@ MachineInfoList *qmp_query_machines(Error **errp)
         if (strcmp(mc->name, MACHINE_GET_CLASS(current_machine)->name) == 0) {
             info->has_is_current = true;
             info->is_current = true;
 +
 +            // PVE version string only exists for current machine
 +            if (mc->pve_version) {
 +                info->has_pve_version = true;
 +                info->pve_version = g_strdup(mc->pve_version);
 +            }
         }
         if (mc->default_cpu_type) {
 diff --git a/include/hw/boards.h b/include/hw/boards.h
-index 48ff6d8b93..5cddeb7fcb 100644
+index 7b416c9787..8ae15c51aa 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
-@@ -252,6 +252,8 @@ struct MachineClass {
+@@ -230,6 +230,8 @@ struct MachineClass {
     const char *desc;
     const char *deprecation_reason;
 +    const char *pve_version;
 +
     void (*init)(MachineState *state);
-     void (*reset)(MachineState *state, ShutdownCause reason);
+     void (*reset)(MachineState *state);
     void (*wakeup)(MachineState *state);
 diff --git a/qapi/machine.json b/qapi/machine.json
-index 0c703316f5..dc46a3e93f 100644
+index 555458f785..d868e4d31d 100644
 --- a/qapi/machine.json
 +++ b/qapi/machine.json
-@@ -190,6 +190,8 @@
+@@ -157,6 +157,8 @@
 #
- # @acpi: machine type supports ACPI (since 8.0)
+ # @default-ram-id: the default ID of initial RAM memory backend (since 5.2)
 #
 +# @pve-version: custom PVE version suffix specified as 'machine+pveN'
 +#
- # @compat-props: The machine type's compatibility properties.  Only
+ # Since: 1.2
- #     present when query-machines argument @compat-props is true.
+ ##
- #     (since 9.1)
+ { 'struct': 'MachineInfo',
-@@ -206,6 +208,7 @@
+@@ -164,7 +166,7 @@
             '*is-default': 'bool', '*is-current': 'bool', 'cpu-max': 'int',
             'hotpluggable-cpus': 'bool',  'numa-mem-supported': 'bool',
             'deprecated': 'bool', '*default-cpu-type': 'str',
-             '*default-ram-id': 'str', 'acpi': 'bool',
+-            '*default-ram-id': 'str' } }
-+            '*pve-version': 'str',
+            '*default-ram-id': 'str', '*pve-version': 'str' } }
             '*compat-props': { 'type': ['CompatProperty'],
                                'features': ['unstable'] } } }
-diff --git a/system/vl.c b/system/vl.c
+ ##
-index 200468a753..0dbdba6421 100644
+ # @query-machines:
--- a/system/vl.c
+diff --git a/softmmu/vl.c b/softmmu/vl.c
-+++ b/system/vl.c
+index 39f149924e..0d233d55f3 100644
-@@ -1675,6 +1675,7 @@ static MachineClass *select_machine(QDict *qdict, Error **errp)
+--- a/softmmu/vl.c
 +++ b/softmmu/vl.c
@@ -1580,6 +1580,7 @@ static const QEMUOption *lookup_opt(int argc, char **argv,
 static MachineClass *select_machine(QDict *qdict, Error **errp)
 {
-     ERRP_GUARD();
+     const char *optarg = qdict_get_try_str(qdict, "type");
     const char *machine_type = qdict_get_try_str(qdict, "type");
 +    const char *pvever = qdict_get_try_str(qdict, "pvever");
-     g_autoptr(GSList) machines = object_class_get_list(TYPE_MACHINE, false);
+     GSList *machines = object_class_get_list(TYPE_MACHINE, false);
-     MachineClass *machine_class = NULL;
+     MachineClass *machine_class;
     Error *local_err = NULL;
@@ -1597,6 +1598,11 @@ static MachineClass *select_machine(QDict *qdict, Error **errp)
         }
     }
-@@ -1694,7 +1695,11 @@ static MachineClass *select_machine(QDict *qdict, Error **errp)
+    if (machine_class) {
     if (!machine_class) {
         error_append_hint(errp,
                           "Use -machine help to list supported machines\n");
 +    } else {
 +        machine_class->pve_version = g_strdup(pvever);
 +        qdict_del(qdict, "pvever");
-     }
+    }
 +
-     return machine_class;
+     g_slist_free(machines);
- }
+     if (local_err) {
- 
+         error_append_hint(&local_err, "Use -machine help to list supported machines\n");
-@@ -3329,12 +3334,31 @@ void qemu_init(int argc, char **argv)
+@@ -3187,12 +3193,31 @@ void qemu_init(int argc, char **argv, char **envp)
             case QEMU_OPTION_machine:
                 {
                     bool help;
--- a/debian/patches/pve/0026-block-backup-move-bcs-bitmap-initialization-to-job-c.patch
+++ b/debian/patches/pve/0026-block-backup-move-bcs-bitmap-initialization-to-job-c.patch
@@ -25,7 +25,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 1 file changed, 4 insertions(+), 4 deletions(-)
 diff --git a/block/backup.c b/block/backup.c
-index 3dd2e229d2..eba5b11493 100644
+index b2b649e305..b6fa9e8a69 100644
 --- a/block/backup.c
 +++ b/block/backup.c
@@ -237,8 +237,8 @@ static void backup_init_bcs_bitmap(BackupBlockJob *job)
@@ -48,9 +48,9 @@ index 3dd2e229d2..eba5b11493 100644
     if (s->sync_mode == MIRROR_SYNC_MODE_TOP) {
         int64_t offset = 0;
         int64_t count;
-@@ -502,6 +500,8 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
+@@ -492,6 +490,8 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
     block_job_add_bdrv(&job->common, "target", target, 0, BLK_PERM_ALL,
                        &error_abort);
     bdrv_graph_wrunlock();
 +    backup_init_bcs_bitmap(job);
 +
--- a/debian/patches/pve/0027-PVE-Backup-add-vma-backup-format-code.patch
+++ b/debian/patches/pve/0027-PVE-Backup-add-vma-backup-format-code.patch
@@ -3,46 +3,40 @@ From: Dietmar Maurer <dietmar@proxmox.com>
 Date: Mon, 6 Apr 2020 12:16:57 +0200
 Subject: [PATCH] PVE-Backup: add vma backup format code
 Notes about partial restoring: skipping a certain drive is done via a
 map line of the form skip=drive-scsi0. Since in PVE, most archives are
 compressed and piped to vma for restore, it's not easily possible to
 skip reads.
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
-[FE: improvements during create
+[FE: create: register all streams before entering coroutines]
-     allow partial restore]
+Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 block/meson.build |   2 +
 meson.build       |   5 +
- vma-reader.c      | 870 ++++++++++++++++++++++++++++++++++++++++++++
+ vma-reader.c      | 859 ++++++++++++++++++++++++++++++++++++++++++++++
- vma-writer.c      | 817 +++++++++++++++++++++++++++++++++++++++++
+ vma-writer.c      | 791 ++++++++++++++++++++++++++++++++++++++++++
- vma.c             | 901 ++++++++++++++++++++++++++++++++++++++++++++++
+ vma.c             | 849 +++++++++++++++++++++++++++++++++++++++++++++
 vma.h             | 150 ++++++++
- 6 files changed, 2745 insertions(+)
+ 6 files changed, 2656 insertions(+)
 create mode 100644 vma-reader.c
 create mode 100644 vma-writer.c
 create mode 100644 vma.c
 create mode 100644 vma.h
 diff --git a/block/meson.build b/block/meson.build
-index 6a60b5d6b9..652c8cbdb7 100644
+index ad40c10b6a..3a0b84bc11 100644
 --- a/block/meson.build
 +++ b/block/meson.build
-@@ -42,6 +42,8 @@ block_ss.add(files(
+@@ -46,6 +46,8 @@ block_ss.add(files(
   'zeroinit.c',
- ), zstd, zlib)
+ ), zstd, zlib, gnutls)
 +block_ss.add(files('../vma-writer.c'), libuuid)
 +
- system_ss.add(when: 'CONFIG_TCG', if_true: files('blkreplay.c'))
+ softmmu_ss.add(when: 'CONFIG_TCG', if_true: files('blkreplay.c'))
 system_ss.add(files('block-ram-registrar.c'))
 if get_option('qcow1').allowed()
 diff --git a/meson.build b/meson.build
-index aa7ea85d0b..7eee5b4249 100644
+index d5230eadd6..ffff66c0cc 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -2012,6 +2012,8 @@ endif
+@@ -1462,6 +1462,8 @@ keyutils = dependency('libkeyutils', required: false,
 has_gettid = cc.has_function('gettid')
@@ -51,22 +45,22 @@ index aa7ea85d0b..7eee5b4249 100644
 # libselinux
 selinux = dependency('libselinux',
                      required: get_option('selinux'),
-@@ -4097,6 +4099,9 @@ if have_tools
+@@ -3607,6 +3609,9 @@ if have_tools
-                dependencies: [blockdev, qemuutil, selinux],
+                dependencies: [blockdev, qemuutil, gnutls, selinux],
                install: true)
 +  vma = executable('vma', files('vma.c', 'vma-reader.c') + genh,
-+                   dependencies: [authz, block, crypto, io, qemuutil, qom], install: true)
+                   dependencies: [authz, block, crypto, io, qom], install: true)
 +
   subdir('storage-daemon')
- 
+   subdir('contrib/rdmacm-mux')
-   foreach exe: [ 'qemu-img', 'qemu-io', 'qemu-nbd', 'qemu-storage-daemon']
+   subdir('contrib/elf2dmp')
 diff --git a/vma-reader.c b/vma-reader.c
 new file mode 100644
-index 0000000000..d0b6721812
+index 0000000000..e65f1e8415
 --- /dev/null
 +++ b/vma-reader.c
-@@ -0,0 +1,870 @@
+@@ -0,0 +1,859 @@
 +/*
 + * VMA: Virtual Machine Archive
 + *
@@ -88,7 +82,6 @@ index 0000000000..d0b6721812
 +#include "qemu/ratelimit.h"
 +#include "vma.h"
 +#include "block/block.h"
 +#include "block/graph-lock.h"
 +#include "sysemu/block-backend.h"
 +
 +static unsigned char zero_vma_block[VMA_BLOCK_SIZE];
@@ -98,7 +91,6 @@ index 0000000000..d0b6721812
 +    bool write_zeroes;
 +    unsigned long *bitmap;
 +    int bitmap_size;
 +    bool skip;
 +}  VmaRestoreState;
 +
 +struct VmaReader {
@@ -496,14 +488,13 @@ index 0000000000..d0b6721812
 +}
 +
 +static void allocate_rstate(VmaReader *vmar,  guint8 dev_id,
-+                            BlockBackend *target, bool write_zeroes, bool skip)
+                            BlockBackend *target, bool write_zeroes)
 +{
 +    assert(vmar);
 +    assert(dev_id);
 +
 +    vmar->rstate[dev_id].target = target;
 +    vmar->rstate[dev_id].write_zeroes = write_zeroes;
 +    vmar->rstate[dev_id].skip = skip;
 +
 +    int64_t size = vmar->devinfo[dev_id].size;
 +
@@ -518,14 +509,13 @@ index 0000000000..d0b6721812
 +}
 +
 +int vma_reader_register_bs(VmaReader *vmar, guint8 dev_id, BlockBackend *target,
-+                           bool write_zeroes, bool skip, Error **errp)
+                           bool write_zeroes, Error **errp)
 +{
 +    assert(vmar);
-+    assert(target != NULL || skip);
+    assert(target != NULL);
 +    assert(dev_id);
-+    assert(vmar->rstate[dev_id].target == NULL && !vmar->rstate[dev_id].skip);
+    assert(vmar->rstate[dev_id].target == NULL);
 +
 +    if (target != NULL) {
 +    int64_t size = blk_getlength(target);
 +    int64_t size_diff = size - vmar->devinfo[dev_id].size;
 +
@@ -539,9 +529,8 @@ index 0000000000..d0b6721812
 +                   size, vmar->devinfo[dev_id].size);
 +        return -1;
 +    }
 +    }
 +
-+    allocate_rstate(vmar, dev_id, target, write_zeroes, skip);
+    allocate_rstate(vmar, dev_id, target, write_zeroes);
 +
 +    return 0;
 +}
@@ -601,10 +590,8 @@ index 0000000000..d0b6721812
 +    } else {
 +        int res = blk_pwrite(target, sector_num * BDRV_SECTOR_SIZE, nb_sectors * BDRV_SECTOR_SIZE, buf, 0);
 +        if (res < 0) {
 +            bdrv_graph_rdlock_main_loop();
 +            error_setg(errp, "blk_pwrite to %s failed (%d)",
 +                       bdrv_get_device_name(blk_bs(target)), res);
 +            bdrv_graph_rdunlock_main_loop();
 +            return -1;
 +        }
 +    }
@@ -636,23 +623,19 @@ index 0000000000..d0b6721812
 +        VmaRestoreState *rstate = &vmar->rstate[dev_id];
 +        BlockBackend *target = NULL;
 +
 +        bool skip = rstate->skip;
 +
 +        if (dev_id != vmar->vmstate_stream) {
 +            target = rstate->target;
-+            if (!verify && !target && !skip) {
+            if (!verify && !target) {
 +                error_setg(errp, "got wrong dev id %d", dev_id);
 +                return -1;
 +            }
 +
 +            if (!skip) {
 +            if (vma_reader_get_bitmap(rstate, cluster_num)) {
 +                error_setg(errp, "found duplicated cluster %zd for stream %s",
 +                          cluster_num, vmar->devinfo[dev_id].devname);
 +                return -1;
 +            }
 +            vma_reader_set_bitmap(rstate, cluster_num, 1);
 +            }
 +
 +            max_sector = vmar->devinfo[dev_id].size/BDRV_SECTOR_SIZE;
 +        } else {
@@ -698,7 +681,7 @@ index 0000000000..d0b6721812
 +                return -1;
 +            }
 +
-+            if (!verify && !skip) {
+            if (!verify) {
 +                int nb_sectors = end_sector - sector_num;
 +                if (restore_write_data(vmar, dev_id, target, vmstate_fd,
 +                                       buf + start, sector_num, nb_sectors,
@@ -734,7 +717,7 @@ index 0000000000..d0b6721812
 +                        return -1;
 +                    }
 +
-+                    if (!verify && !skip) {
+                    if (!verify) {
 +                        int nb_sectors = end_sector - sector_num;
 +                        if (restore_write_data(vmar, dev_id, target, vmstate_fd,
 +                                               buf + start, sector_num,
@@ -759,7 +742,7 @@ index 0000000000..d0b6721812
 +                            vmar->partial_zero_cluster_data += zero_size;
 +                        }
 +
-+                        if (rstate->write_zeroes && !verify && !skip) {
+                        if (rstate->write_zeroes && !verify) {
 +                            if (restore_write_data(vmar, dev_id, target, vmstate_fd,
 +                                                   zero_vma_block, sector_num,
 +                                                   nb_sectors, errp) < 0) {
@@ -930,7 +913,7 @@ index 0000000000..d0b6721812
 +
 +    for (dev_id = 1; dev_id < 255; dev_id++) {
 +        if (vma_reader_get_device_info(vmar, dev_id)) {
-+            allocate_rstate(vmar, dev_id, NULL, false, false);
+            allocate_rstate(vmar, dev_id, NULL, false);
 +        }
 +    }
 +
@@ -939,10 +922,10 @@ index 0000000000..d0b6721812
 +
 diff --git a/vma-writer.c b/vma-writer.c
 new file mode 100644
-index 0000000000..a466652a5d
+index 0000000000..df4b20793d
 --- /dev/null
 +++ b/vma-writer.c
-@@ -0,0 +1,817 @@
+@@ -0,0 +1,791 @@
 +/*
 + * VMA: Virtual Machine Archive
 + *
@@ -958,8 +941,6 @@ index 0000000000..a466652a5d
 +
 +#include "qemu/osdep.h"
 +#include <glib.h>
 +#include <linux/magic.h>
 +#include <sys/vfs.h>
 +#include <uuid/uuid.h>
 +
 +#include "vma.h"
@@ -968,7 +949,6 @@ index 0000000000..a466652a5d
 +#include "qemu/main-loop.h"
 +#include "qemu/coroutine.h"
 +#include "qemu/cutils.h"
 +#include "qemu/error-report.h"
 +#include "qemu/memalign.h"
 +
 +#define DEBUG_VMA 0
@@ -1152,10 +1132,10 @@ index 0000000000..a466652a5d
 +{
 +    assert(qemu_in_coroutine());
 +    AioContext *ctx = qemu_get_current_aio_context();
-+    aio_set_fd_handler(ctx, fd, NULL, (IOHandler *)qemu_coroutine_enter, NULL,
+    aio_set_fd_handler(ctx, fd, false, NULL, (IOHandler *)qemu_coroutine_enter,
-+                       NULL, qemu_coroutine_self());
+                       NULL, NULL, qemu_coroutine_self());
 +    qemu_coroutine_yield();
-+    aio_set_fd_handler(ctx, fd, NULL, NULL, NULL, NULL, NULL);
+    aio_set_fd_handler(ctx, fd, false, NULL, NULL, NULL, NULL, NULL);
 +}
 +
 +static ssize_t coroutine_fn
@@ -1204,23 +1184,6 @@ index 0000000000..a466652a5d
 +    return (done == bytes) ? bytes : -1;
 +}
 +
 +static bool is_path_tmpfs(const char *path) {
 +    struct statfs fs;
 +    int ret;
 +
 +    do {
 +        ret = statfs(path, &fs);
 +    } while (ret != 0 && errno == EINTR);
 +
 +    if (ret != 0) {
 +        warn_report("statfs call for %s failed, assuming not tmpfs - %s\n",
 +                    path, strerror(errno));
 +        return false;
 +    }
 +
 +    return fs.f_type == TMPFS_MAGIC;
 +}
 +
 +VmaWriter *vma_writer_create(const char *filename, uuid_t uuid, Error **errp)
 +{
 +    const char *p;
@@ -1271,18 +1234,11 @@ index 0000000000..a466652a5d
 +            /* try to use O_NONBLOCK */
 +            fcntl(vmaw->fd, F_SETFL, fcntl(vmaw->fd, F_GETFL)|O_NONBLOCK);
 +        } else  {
-+            gchar *dirname = g_path_get_dirname(filename);
+            oflags = O_NONBLOCK|O_DIRECT|O_WRONLY|O_EXCL;
 +            oflags = O_NONBLOCK|O_WRONLY|O_EXCL;
 +            if (!is_path_tmpfs(dirname)) {
 +                oflags |= O_DIRECT;
 +            }
 +            g_free(dirname);
 +            vmaw->fd = qemu_create(filename, oflags, 0644, errp);
 +        }
 +
 +        if (vmaw->fd < 0) {
 +            error_free(*errp);
 +            *errp = NULL;
 +            error_setg(errp, "can't open file %s - %s\n", filename,
 +                       g_strerror(errno));
 +            goto err;
@@ -1517,8 +1473,8 @@ index 0000000000..a466652a5d
 +    int i;
 +
 +    g_assert(vmaw != NULL);
 +    g_assert(status != NULL);
 +
 +    if (status) {
 +        status->status = vmaw->status;
 +        g_strlcpy(status->errmsg, vmaw->errmsg, sizeof(status->errmsg));
 +        for (i = 0; i <= 255; i++) {
@@ -1526,6 +1482,7 @@ index 0000000000..a466652a5d
 +        }
 +
 +        uuid_unparse_lower(vmaw->uuid, status->uuid_str);
 +    }
 +
 +    status->closed = vmaw->closed;
 +
@@ -1762,10 +1719,10 @@ index 0000000000..a466652a5d
 +}
 diff --git a/vma.c b/vma.c
 new file mode 100644
-index 0000000000..bb715e9061
+index 0000000000..e8dffb43e0
 --- /dev/null
 +++ b/vma.c
-@@ -0,0 +1,901 @@
+@@ -0,0 +1,849 @@
 +/*
 + * VMA: Virtual Machine Archive
 + *
@@ -1799,7 +1756,7 @@ index 0000000000..bb715e9061
 +        "vma list <filename>\n"
 +        "vma config <filename> [-c config]\n"
 +        "vma create <filename> [-c config] pathname ...\n"
-+        "vma extract <filename> [-d <drive-list>] [-r <fifo>] <targetdir>\n"
+        "vma extract <filename> [-r <fifo>] <targetdir>\n"
 +        "vma verify <filename> [-v]\n"
 +        ;
 +
@@ -1906,7 +1863,6 @@ index 0000000000..bb715e9061
 +    char *throttling_group;
 +    char *cache;
 +    bool write_zero;
 +    bool skip;
 +} RestoreMap;
 +
 +static bool try_parse_option(char **line, const char *optname, char **out, const char *inbuf) {
@@ -1944,10 +1900,9 @@ index 0000000000..bb715e9061
 +    const char *filename;
 +    const char *dirname;
 +    const char *readmap = NULL;
 +    gchar **drive_list = NULL;
 +
 +    for (;;) {
-+        c = getopt(argc, argv, "hvd:r:");
+        c = getopt(argc, argv, "hvr:");
 +        if (c == -1) {
 +            break;
 +        }
@@ -1956,9 +1911,6 @@ index 0000000000..bb715e9061
 +        case 'h':
 +            help();
 +            break;
 +        case 'd':
 +            drive_list = g_strsplit(optarg, ",", 254);
 +            break;
 +        case 'r':
 +            readmap = optarg;
 +            break;
@@ -2018,33 +1970,17 @@ index 0000000000..bb715e9061
 +            char *bps = NULL;
 +            char *group = NULL;
 +            char *cache = NULL;
 +            char *devname = NULL;
 +            bool skip = false;
 +            uint64_t bps_value = 0;
 +            const char *path = NULL;
 +            bool write_zero = true;
 +
 +            if (!line || line[0] == '\0' || !strcmp(line, "done\n")) {
 +                break;
 +            }
 +            int len = strlen(line);
 +            if (line[len - 1] == '\n') {
 +                line[len - 1] = '\0';
-+                len = len - 1;
+                if (len == 1) {
 +                if (len == 0) {
 +                    break;
 +                }
 +            }
 +
 +            if (strncmp(line, "skip", 4) == 0) {
 +                if (len < 6 || line[4] != '=') {
 +                    g_error("read map failed - option 'skip' has no value ('%s')",
 +                            inbuf);
 +                } else {
 +                    devname = line + 5;
 +                    skip = true;
 +                }
 +            } else {
 +            while (1) {
 +                if (!try_parse_option(&line, "format", &format, inbuf) &&
 +                    !try_parse_option(&line, "throttling.bps", &bps, inbuf) &&
@@ -2055,11 +1991,14 @@ index 0000000000..bb715e9061
 +                }
 +            }
 +
 +            uint64_t bps_value = 0;
 +            if (bps) {
 +                bps_value = verify_u64(bps);
 +                g_free(bps);
 +            }
 +
 +            const char *path;
 +            bool write_zero;
 +            if (line[0] == '0' && line[1] == ':') {
 +                path = line + 2;
 +                write_zero = false;
@@ -2070,37 +2009,35 @@ index 0000000000..bb715e9061
 +                g_error("read map failed - parse error ('%s')", inbuf);
 +            }
 +
 +            char *devname = NULL;
 +            path = extract_devname(path, &devname, -1);
 +            }
 +
 +            if (!devname) {
 +                g_error("read map failed - no dev name specified ('%s')",
 +                        inbuf);
 +            }
 +
-+            RestoreMap *restore_map = g_new0(RestoreMap, 1);
+            RestoreMap *map = g_new0(RestoreMap, 1);
-+            restore_map->devname = g_strdup(devname);
+            map->devname = g_strdup(devname);
-+            restore_map->path = g_strdup(path);
+            map->path = g_strdup(path);
-+            restore_map->format = format;
+            map->format = format;
-+            restore_map->throttling_bps = bps_value;
+            map->throttling_bps = bps_value;
-+            restore_map->throttling_group = group;
+            map->throttling_group = group;
-+            restore_map->cache = cache;
+            map->cache = cache;
-+            restore_map->write_zero = write_zero;
+            map->write_zero = write_zero;
 +            restore_map->skip = skip;
 +
-+            g_hash_table_insert(devmap, restore_map->devname, restore_map);
+            g_hash_table_insert(devmap, map->devname, map);
 +
 +        };
 +    }
 +
 +    int i;
 +    int vmstate_fd = -1;
-+    bool drive_rename_bitmap[255];
+    guint8 vmstate_stream = 0;
 +    memset(drive_rename_bitmap, 0, sizeof(drive_rename_bitmap));
 +
 +    for (i = 1; i < 255; i++) {
 +        VmaDeviceInfo *di = vma_reader_get_device_info(vmar, i);
 +        if (di && (strcmp(di->devname, "vmstate") == 0)) {
 +            vmstate_stream = i;
 +            char *statefn = g_strdup_printf("%s/vmstate.bin", dirname);
 +            vmstate_fd = open(statefn, O_WRONLY|O_CREAT|O_EXCL, 0644);
 +            if (vmstate_fd < 0) {
@@ -2116,25 +2053,10 @@ index 0000000000..bb715e9061
 +            const char *cache = NULL;
 +            int flags = BDRV_O_RDWR;
 +            bool write_zero = true;
 +            bool skip = false;
 +
 +            BlockBackend *blk = NULL;
 +
-+            if (drive_list) {
+            if (readmap) {
 +                skip = true;
 +                int j;
 +                for (j = 0; drive_list[j]; j++) {
 +                    if (strcmp(drive_list[j], di->devname) == 0) {
 +                        skip = false;
 +                        drive_rename_bitmap[i] = true;
 +                        break;
 +                    }
 +                }
 +            } else {
 +                drive_rename_bitmap[i] = true;
 +            }
 +
 +            if (!skip && readmap) {
 +                RestoreMap *map;
 +                map = (RestoreMap *)g_hash_table_lookup(devmap, di->devname);
 +                if (map == NULL) {
@@ -2146,8 +2068,7 @@ index 0000000000..bb715e9061
 +                throttling_group = map->throttling_group;
 +                cache = map->cache;
 +                write_zero = map->write_zero;
-+                skip = map->skip;
+            } else {
 +            } else if (!skip) {
 +                devfn = g_strdup_printf("%s/tmp-disk-%s.raw",
 +                                        dirname, di->devname);
 +                printf("DEVINFO %s %zd\n", devfn, di->size);
@@ -2165,7 +2086,6 @@ index 0000000000..bb715e9061
 +                write_zero = false;
 +            }
 +
 +            if (!skip) {
 +	    size_t devlen = strlen(devfn);
 +	    QDict *options = NULL;
 +            bool writethrough;
@@ -2183,7 +2103,6 @@ index 0000000000..bb715e9061
 +		options = qdict_new();
 +		qdict_put_str(options, "driver", "raw");
 +	    }
 +
 +            if (cache && bdrv_parse_cache_mode(cache, &flags, &writethrough)) {
 +                g_error("invalid cache option: %s\n", cache);
 +            }
@@ -2216,9 +2135,8 @@ index 0000000000..bb715e9061
 +                }
 +                blk_set_io_limits(blk, &cfg);
 +            }
 +            }
 +
-+            if (vma_reader_register_bs(vmar, i, blk, write_zero, skip, &errp) < 0) {
+            if (vma_reader_register_bs(vmar, i, blk, write_zero, &errp) < 0) {
 +                g_error("%s", error_get_pretty(errp));
 +            }
 +
@@ -2228,10 +2146,6 @@ index 0000000000..bb715e9061
 +        }
 +    }
 +
 +    if (drive_list) {
 +        g_strfreev(drive_list);
 +    }
 +
 +    if (vma_reader_restore(vmar, vmstate_fd, verbose, &errp) < 0) {
 +        g_error("restore failed - %s", error_get_pretty(errp));
 +    }
@@ -2239,7 +2153,7 @@ index 0000000000..bb715e9061
 +    if (!readmap) {
 +        for (i = 1; i < 255; i++) {
 +            VmaDeviceInfo *di = vma_reader_get_device_info(vmar, i);
-+            if (di && drive_rename_bitmap[i]) {
+            if (di && (i != vmstate_stream)) {
 +                char *tmpfn = g_strdup_printf("%s/tmp-disk-%s.raw",
 +                                              dirname, di->devname);
 +                char *fn = g_strdup_printf("%s/disk-%s.raw",
@@ -2338,7 +2252,7 @@ index 0000000000..bb715e9061
 +    struct iovec iov;
 +    QEMUIOVector qiov;
 +
-+    int64_t start, end, readlen;
+    int64_t start, end;
 +    int ret = 0;
 +
 +    unsigned char *buf = blk_blockalign(job->target, VMA_CLUSTER_SIZE);
@@ -2352,24 +2266,16 @@ index 0000000000..bb715e9061
 +        iov.iov_len = VMA_CLUSTER_SIZE;
 +        qemu_iovec_init_external(&qiov, &iov, 1);
 +
 +        if (start + 1 == end) {
 +            memset(buf, 0, VMA_CLUSTER_SIZE);
 +            readlen = job->len - start * VMA_CLUSTER_SIZE;
 +            assert(readlen > 0 && readlen <= VMA_CLUSTER_SIZE);
 +        } else {
 +            readlen = VMA_CLUSTER_SIZE;
 +        }
 +
 +        ret = blk_co_preadv(job->target, start * VMA_CLUSTER_SIZE,
-+                            readlen, &qiov, 0);
+                            VMA_CLUSTER_SIZE, &qiov, 0);
 +        if (ret < 0) {
-+            vma_writer_set_error(job->vmaw, "read error");
+            vma_writer_set_error(job->vmaw, "read error", -1);
 +            goto out;
 +        }
 +
 +        size_t zb = 0;
 +        if (vma_writer_write(job->vmaw, job->dev_id, start, buf, &zb) < 0) {
-+            vma_writer_set_error(job->vmaw, "backup_dump_cb vma_writer_write failed");
+            vma_writer_set_error(job->vmaw, "backup_dump_cb vma_writer_write failed", -1);
 +            goto out;
 +        }
 +    }
@@ -2387,7 +2293,7 @@ index 0000000000..bb715e9061
 +
 +static int create_archive(int argc, char **argv)
 +{
-+    int c;
+    int i, c;
 +    int verbose = 0;
 +    const char *archivename;
 +    GList *backup_coroutines = NULL;
@@ -2545,7 +2451,6 @@ index 0000000000..bb715e9061
 +    vma_writer_get_status(vmaw, &vmastat);
 +
 +    if (verbose) {
 +        int i;
 +        for (i = 0; i < 256; i++) {
 +            VmaStreamInfo *si = &vmastat.stream_info[i];
 +            if (si->size) {
@@ -2669,7 +2574,7 @@ index 0000000000..bb715e9061
 +}
 diff --git a/vma.h b/vma.h
 new file mode 100644
-index 0000000000..86d2873aa5
+index 0000000000..c895c97f6d
 --- /dev/null
 +++ b/vma.h
@@ -0,0 +1,150 @@
@@ -2807,7 +2712,7 @@ index 0000000000..86d2873aa5
 +int coroutine_fn vma_writer_flush_output(VmaWriter *vmaw);
 +
 +int vma_writer_get_status(VmaWriter *vmaw, VmaStatus *status);
-+void vma_writer_set_error(VmaWriter *vmaw, const char *fmt, ...) G_GNUC_PRINTF(2, 3);
+void vma_writer_set_error(VmaWriter *vmaw, const char *fmt, ...);
 +
 +
 +VmaReader *vma_reader_create(const char *filename, Error **errp);
@@ -2817,7 +2722,7 @@ index 0000000000..86d2873aa5
 +VmaDeviceInfo *vma_reader_get_device_info(VmaReader *vmar, guint8 dev_id);
 +int vma_reader_register_bs(VmaReader *vmar, guint8 dev_id,
 +                           BlockBackend *target, bool write_zeroes,
-+                           bool skip, Error **errp);
+                           Error **errp);
 +int vma_reader_restore(VmaReader *vmar, int vmstate_fd, bool verbose,
 +                       Error **errp);
 +int vma_reader_verify(VmaReader *vmar, bool verbose, Error **errp);
--- a/debian/patches/pve/0028-PVE-Backup-add-backup-dump-block-driver.patch
+++ b/debian/patches/pve/0028-PVE-Backup-add-backup-dump-block-driver.patch
@@ -9,23 +9,21 @@ Subject: [PATCH] PVE-Backup: add backup-dump block driver
 - job.c: make job_should_pause non-static
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 [FE: adapt to coroutine changes]
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
- block/backup-dump.c              | 172 +++++++++++++++++++++++++++++++
+ block/backup-dump.c              | 167 +++++++++++++++++++++++++++++++
 block/backup.c                   |  30 ++----
 block/meson.build                |   1 +
 include/block/block_int-common.h |  35 +++++++
 job.c                            |   3 +-
- 5 files changed, 218 insertions(+), 23 deletions(-)
+ 5 files changed, 213 insertions(+), 23 deletions(-)
 create mode 100644 block/backup-dump.c
 diff --git a/block/backup-dump.c b/block/backup-dump.c
 new file mode 100644
-index 0000000000..e46abf1070
+index 0000000000..04718a94e2
 --- /dev/null
 +++ b/block/backup-dump.c
-@@ -0,0 +1,172 @@
+@@ -0,0 +1,167 @@
 +/*
 + * BlockDriver to send backup data stream to a callback function
 + *
@@ -37,8 +35,6 @@ index 0000000000..e46abf1070
 + */
 +
 +#include "qemu/osdep.h"
 +
 +#include "qapi/qmp/qdict.h"
 +#include "qom/object_interfaces.h"
 +#include "block/block_int.h"
 +
@@ -49,8 +45,7 @@ index 0000000000..e46abf1070
 +    void           *dump_cb_data;
 +} BDRVBackupDumpState;
 +
-+static coroutine_fn int qemu_backup_dump_co_get_info(BlockDriverState *bs,
+static int qemu_backup_dump_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
 +                                                     BlockDriverInfo *bdi)
 +{
 +    BDRVBackupDumpState *s = bs->opaque;
 +
@@ -91,7 +86,7 @@ index 0000000000..e46abf1070
 +    /* Nothing to do. */
 +}
 +
-+static coroutine_fn int64_t qemu_backup_dump_co_getlength(BlockDriverState *bs)
+static int64_t qemu_backup_dump_getlength(BlockDriverState *bs)
 +{
 +    BDRVBackupDumpState *s = bs->opaque;
 +
@@ -151,8 +146,8 @@ index 0000000000..e46abf1070
 +
 +    .bdrv_close                   = qemu_backup_dump_close,
 +    .bdrv_has_zero_init           = bdrv_has_zero_init_1,
-+    .bdrv_co_getlength            = qemu_backup_dump_co_getlength,
+    .bdrv_getlength               = qemu_backup_dump_getlength,
-+    .bdrv_co_get_info             = qemu_backup_dump_co_get_info,
+    .bdrv_get_info                = qemu_backup_dump_get_info,
 +
 +    .bdrv_co_writev               = qemu_backup_dump_co_writev,
 +
@@ -171,7 +166,7 @@ index 0000000000..e46abf1070
 +block_init(bdrv_backup_dump_init);
 +
 +
-+BlockDriverState *coroutine_fn bdrv_co_backup_dump_create(
+BlockDriverState *bdrv_backup_dump_create(
 +    int dump_cb_block_size,
 +    uint64_t byte_size,
 +    BackupDumpFunc *dump_cb,
@@ -179,11 +174,9 @@ index 0000000000..e46abf1070
 +    Error **errp)
 +{
 +    BDRVBackupDumpState *state;
 +    BlockDriverState *bs = bdrv_new_open_driver(
 +        &bdrv_backup_dump_drive, NULL, BDRV_O_RDWR, errp);
 +
 +    QDict *options = qdict_new();
 +    qdict_put_str(options, "driver", "backup-dump-drive");
 +
 +    BlockDriverState *bs = bdrv_co_open(NULL, NULL, options, BDRV_O_RDWR, errp);
 +    if (!bs) {
 +        return NULL;
 +    }
@@ -199,7 +192,7 @@ index 0000000000..e46abf1070
 +    return bs;
 +}
 diff --git a/block/backup.c b/block/backup.c
-index eba5b11493..1963e47ab9 100644
+index b6fa9e8a69..789f8b7799 100644
 --- a/block/backup.c
 +++ b/block/backup.c
@@ -29,28 +29,6 @@
@@ -231,7 +224,7 @@ index eba5b11493..1963e47ab9 100644
 static const BlockJobDriver backup_job_driver;
 static void backup_cleanup_sync_bitmap(BackupBlockJob *job, int ret)
-@@ -462,6 +440,14 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
+@@ -454,6 +432,14 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
     }
     cluster_size = block_copy_cluster_size(bcs);
@@ -247,7 +240,7 @@ index eba5b11493..1963e47ab9 100644
     if (perf->max_chunk && perf->max_chunk < cluster_size) {
         error_setg(errp, "Required max-chunk (%" PRIi64 ") is less than backup "
 diff --git a/block/meson.build b/block/meson.build
-index 652c8cbdb7..e1cf5a2e65 100644
+index 3a0b84bc11..7f22e7f177 100644
 --- a/block/meson.build
 +++ b/block/meson.build
@@ -4,6 +4,7 @@ block_ss.add(files(
@@ -255,28 +248,28 @@ index 652c8cbdb7..e1cf5a2e65 100644
   'amend.c',
   'backup.c',
 +  'backup-dump.c',
   'copy-before-write.c',
   'blkdebug.c',
   'blklogwrites.c',
   'blkverify.c',
 diff --git a/include/block/block_int-common.h b/include/block/block_int-common.h
-index ebb4e56a50..e717a74e5f 100644
+index 8947abab76..f272d0d8dc 100644
 --- a/include/block/block_int-common.h
 +++ b/include/block/block_int-common.h
@@ -26,6 +26,7 @@
- #include "block/aio.h"
+ #include "block/accounting.h"
- #include "block/block-common.h"
+ #include "block/block.h"
 +#include "block/block-copy.h"
- #include "block/block-global-state.h"
+ #include "block/aio-wait.h"
- #include "block/snapshot.h"
+ #include "qemu/queue.h"
- #include "qemu/iov.h"
+ #include "qemu/coroutine.h"
-@@ -60,6 +61,40 @@
+@@ -64,6 +65,40 @@
 #define BLOCK_PROBE_BUF_SIZE        512
 +typedef int BackupDumpFunc(void *opaque, uint64_t offset, uint64_t bytes, const void *buf);
 +
-+BlockDriverState *coroutine_fn bdrv_co_backup_dump_create(
+BlockDriverState *bdrv_backup_dump_create(
 +    int dump_cb_block_size,
 +    uint64_t byte_size,
 +    BackupDumpFunc *dump_cb,
@@ -312,16 +305,16 @@ index ebb4e56a50..e717a74e5f 100644
     BDRV_TRACKED_READ,
     BDRV_TRACKED_WRITE,
 diff --git a/job.c b/job.c
-index 660ce22c56..baf54c8d60 100644
+index 075c6f3a20..e5699ad200 100644
 --- a/job.c
 +++ b/job.c
-@@ -331,7 +331,8 @@ static bool job_started_locked(Job *job)
+@@ -276,7 +276,8 @@ static bool job_started(Job *job)
     return job->co;
 }
- /* Called with job_mutex held. */
+-static bool job_should_pause(Job *job)
-static bool job_should_pause_locked(Job *job)
+bool job_should_pause(Job *job);
-+bool job_should_pause_locked(Job *job);
+bool job_should_pause(Job *job)
 +bool job_should_pause_locked(Job *job)
 {
     return job->pause_count > 0;
 }
--- a/debian/patches/pve/0029-PVE-Backup-proxmox-backup-patches-for-qemu.patch
+++ b/debian/patches/pve/0029-PVE-Backup-proxmox-backup-patches-for-qemu.patch
--- a/debian/patches/pve/0030-PVE-Backup-Proxmox-backup-patches-for-QEMU.patch
+++ b/debian/patches/pve/0030-PVE-Backup-Proxmox-backup-patches-for-QEMU.patch
--- a/debian/patches/pve/0030-PVE-Backup-pbs-restore-new-command-to-restore-from-p.patch
+++ b/debian/patches/pve/0030-PVE-Backup-pbs-restore-new-command-to-restore-from-p.patch
@@ -5,35 +5,33 @@ Subject: [PATCH] PVE-Backup: pbs-restore - new command to restore from proxmox
 backup server
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 [WB: add namespace support]
 Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
 ---
 meson.build   |   4 +
- pbs-restore.c | 236 ++++++++++++++++++++++++++++++++++++++++++++++++++
+ pbs-restore.c | 223 ++++++++++++++++++++++++++++++++++++++++++++++++++
- 2 files changed, 240 insertions(+)
+ 2 files changed, 227 insertions(+)
 create mode 100644 pbs-restore.c
 diff --git a/meson.build b/meson.build
-index 979c452f74..426f382178 100644
+index 0bc2fb5b10..f48d2e0457 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -4103,6 +4103,10 @@ if have_tools
+@@ -3613,6 +3613,10 @@ if have_tools
   vma = executable('vma', files('vma.c', 'vma-reader.c') + genh,
-                    dependencies: [authz, block, crypto, io, qemuutil, qom], install: true)
+                    dependencies: [authz, block, crypto, io, qom], install: true)
 +  pbs_restore = executable('pbs-restore', files('pbs-restore.c') + genh,
-+                  dependencies: [authz, block, crypto, io, qemuutil, qom,
+                  dependencies: [authz, block, crypto, io, qom,
 +                    libproxmox_backup_qemu], install: true)
 +
   subdir('storage-daemon')
- 
+   subdir('contrib/rdmacm-mux')
-   foreach exe: [ 'qemu-img', 'qemu-io', 'qemu-nbd', 'qemu-storage-daemon']
+   subdir('contrib/elf2dmp')
 diff --git a/pbs-restore.c b/pbs-restore.c
 new file mode 100644
-index 0000000000..f03d9bab8d
+index 0000000000..2f834cf42e
 --- /dev/null
 +++ b/pbs-restore.c
-@@ -0,0 +1,236 @@
+@@ -0,0 +1,223 @@
 +/*
 + * Qemu image restore helper for Proxmox Backup
 + *
@@ -65,7 +63,7 @@ index 0000000000..f03d9bab8d
 +static void help(void)
 +{
 +    const char *help_msg =
-+        "usage: pbs-restore [--repository <repo>] [--ns namespace] snapshot archive-name target [command options]\n"
+        "usage: pbs-restore [--repository <repo>] snapshot archive-name target [command options]\n"
 +        ;
 +
 +    printf("%s", help_msg);
@@ -113,7 +111,6 @@ index 0000000000..f03d9bab8d
 +    Error *main_loop_err = NULL;
 +    const char *format = "raw";
 +    const char *repository = NULL;
 +    const char *backup_ns = NULL;
 +    const char *keyfile = NULL;
 +    int verbose = false;
 +    bool skip_zero = false;
@@ -127,7 +124,6 @@ index 0000000000..f03d9bab8d
 +            {"verbose", no_argument, 0, 'v'},
 +            {"format", required_argument, 0, 'f'},
 +            {"repository", required_argument, 0, 'r'},
 +            {"ns", required_argument, 0, 'n'},
 +            {"keyfile", required_argument, 0, 'k'},
 +            {0, 0, 0, 0}
 +        };
@@ -148,9 +144,6 @@ index 0000000000..f03d9bab8d
 +            case 'r':
 +                repository = g_strdup(argv[optind - 1]);
 +                break;
 +            case 'n':
 +                backup_ns = g_strdup(argv[optind - 1]);
 +                break;
 +            case 'k':
 +                keyfile = g_strdup(argv[optind - 1]);
 +                break;
@@ -201,16 +194,8 @@ index 0000000000..f03d9bab8d
 +        fprintf(stderr, "connecting to repository '%s'\n", repository);
 +    }
 +    char *pbs_error = NULL;
-+    ProxmoxRestoreHandle *conn = proxmox_restore_new_ns(
+    ProxmoxRestoreHandle *conn = proxmox_restore_new(
-+        repository,
+        repository, snapshot, password, keyfile, key_password, fingerprint, &pbs_error);
 +        snapshot,
 +        backup_ns,
 +        password,
 +        keyfile,
 +        key_password,
 +        fingerprint,
 +        &pbs_error
 +    );
 +    if (conn == NULL) {
 +        fprintf(stderr, "restore failed: %s\n", pbs_error);
 +        return -1;
--- a/debian/patches/pve/0031-PVE-Backup-Add-dirty-bitmap-tracking-for-incremental.patch
+++ b/debian/patches/pve/0031-PVE-Backup-Add-dirty-bitmap-tracking-for-incremental.patch
@@ -0,0 +1,452 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Stefan Reiter <s.reiter@proxmox.com>
 Date: Mon, 29 Jun 2020 11:06:03 +0200
 Subject: [PATCH] PVE-Backup: Add dirty-bitmap tracking for incremental backups
 Uses QEMU's existing MIRROR_SYNC_MODE_BITMAP and a dirty-bitmap on top
 of all backed-up drives. This will only execute the data-write callback
 for any changed chunks, the PBS rust code will reuse chunks from the
 previous index for everything it doesn't receive if reuse_index is true.
 On error or cancellation, remove all dirty bitmaps to ensure
 consistency.
 Add PBS/incremental specific information to query backup info QMP and
 HMP commands.
 Only supported for PBS backups.
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 Signed-off-by: Dietmar Maurer <dietmar@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
 block/monitor/block-hmp-cmds.c |   1 +
 monitor/hmp-cmds.c             |  45 ++++++++++----
 proxmox-backup-client.c        |   3 +-
 proxmox-backup-client.h        |   1 +
 pve-backup.c                   | 103 ++++++++++++++++++++++++++++++---
 qapi/block-core.json           |  12 +++-
 6 files changed, 142 insertions(+), 23 deletions(-)
 diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
 index 89ca64444d..45da74d7a0 100644
 --- a/block/monitor/block-hmp-cmds.c
 +++ b/block/monitor/block-hmp-cmds.c
@@ -1042,6 +1042,7 @@ void hmp_backup(Monitor *mon, const QDict *qdict)
         false, NULL, // PBS fingerprint
         false, NULL, // PBS backup-id
         false, 0, // PBS backup-time
 +        false, false, // PBS incremental
         true, dir ? BACKUP_FORMAT_DIR : BACKUP_FORMAT_VMA,
         false, NULL, false, NULL, !!devlist,
         devlist, qdict_haskey(qdict, "speed"), speed, &error);
 diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
 index 1168773da7..4c1671e289 100644
 --- a/monitor/hmp-cmds.c
 +++ b/monitor/hmp-cmds.c
@@ -223,19 +223,42 @@ void hmp_info_backup(Monitor *mon, const QDict *qdict)
             monitor_printf(mon, "End time: %s", ctime(&info->end_time));
         }
 -        int per = (info->has_total && info->total &&
 -            info->has_transferred && info->transferred) ?
 -            (info->transferred * 100)/info->total : 0;
 -        int zero_per = (info->has_total && info->total &&
 -                        info->has_zero_bytes && info->zero_bytes) ?
 -            (info->zero_bytes * 100)/info->total : 0;
         monitor_printf(mon, "Backup file: %s\n", info->backup_file);
         monitor_printf(mon, "Backup uuid: %s\n", info->uuid);
 -        monitor_printf(mon, "Total size: %zd\n", info->total);
 -        monitor_printf(mon, "Transferred bytes: %zd (%d%%)\n",
 -                       info->transferred, per);
 -        monitor_printf(mon, "Zero bytes: %zd (%d%%)\n",
 -                       info->zero_bytes, zero_per);
 +
 +        if (!(info->has_total && info->total))  {
 +            // this should not happen normally
 +            monitor_printf(mon, "Total size: %d\n", 0);
 +        } else {
 +            bool incremental = false;
 +            size_t total_or_dirty = info->total;
 +            if (info->has_transferred) {
 +                if (info->has_dirty && info->dirty) {
 +                     if (info->dirty < info->total) {
 +                        total_or_dirty = info->dirty;
 +                        incremental = true;
 +                    }
 +                }
 +            }
 +
 +            int per = (info->transferred * 100)/total_or_dirty;
 +
 +            monitor_printf(mon, "Backup mode: %s\n", incremental ? "incremental" : "full");
 +
 +            int zero_per = (info->has_zero_bytes && info->zero_bytes) ?
 +                (info->zero_bytes * 100)/info->total : 0;
 +            monitor_printf(mon, "Total size: %zd\n", info->total);
 +            monitor_printf(mon, "Transferred bytes: %zd (%d%%)\n",
 +                           info->transferred, per);
 +            monitor_printf(mon, "Zero bytes: %zd (%d%%)\n",
 +                           info->zero_bytes, zero_per);
 +
 +            if (info->has_reused) {
 +                int reused_per = (info->reused * 100)/total_or_dirty;
 +                monitor_printf(mon, "Reused bytes: %zd (%d%%)\n",
 +                               info->reused, reused_per);
 +            }
 +        }
     }
     qapi_free_BackupStatus(info);
 diff --git a/proxmox-backup-client.c b/proxmox-backup-client.c
 index a8f6653a81..4ce7bc0b5e 100644
 --- a/proxmox-backup-client.c
 +++ b/proxmox-backup-client.c
@@ -89,6 +89,7 @@ proxmox_backup_co_register_image(
     ProxmoxBackupHandle *pbs,
     const char *device_name,
     uint64_t size,
 +    bool incremental,
     Error **errp)
 {
     Coroutine *co = qemu_coroutine_self();
@@ -98,7 +99,7 @@ proxmox_backup_co_register_image(
     int pbs_res = -1;
     proxmox_backup_register_image_async(
 -        pbs, device_name, size ,proxmox_backup_schedule_wake, &waker, &pbs_res, &pbs_err);
 +        pbs, device_name, size, incremental, proxmox_backup_schedule_wake, &waker, &pbs_res, &pbs_err);
     qemu_coroutine_yield();
     if (pbs_res < 0) {
         if (errp) error_setg(errp, "backup register image failed: %s", pbs_err ? pbs_err : "unknown error");
 diff --git a/proxmox-backup-client.h b/proxmox-backup-client.h
 index 1dda8b7d8f..8cbf645b2c 100644
 --- a/proxmox-backup-client.h
 +++ b/proxmox-backup-client.h
@@ -32,6 +32,7 @@ proxmox_backup_co_register_image(
     ProxmoxBackupHandle *pbs,
     const char *device_name,
     uint64_t size,
 +    bool incremental,
     Error **errp);
 diff --git a/pve-backup.c b/pve-backup.c
 index 88f5ee133f..1c49cd178d 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
@@ -28,6 +28,8 @@
  *
  */
 +const char *PBS_BITMAP_NAME = "pbs-incremental-dirty-bitmap";
 +
 static struct PVEBackupState {
     struct {
         // Everithing accessed from qmp_backup_query command is protected using lock
@@ -39,7 +41,9 @@ static struct PVEBackupState {
         uuid_t uuid;
         char uuid_str[37];
         size_t total;
 +        size_t dirty;
         size_t transferred;
 +        size_t reused;
         size_t zero_bytes;
     } stat;
     int64_t speed;
@@ -66,6 +70,7 @@ typedef struct PVEBackupDevInfo {
     uint8_t dev_id;
     bool completed;
     char targetfile[PATH_MAX];
 +    BdrvDirtyBitmap *bitmap;
     BlockDriverState *target;
 } PVEBackupDevInfo;
@@ -105,11 +110,12 @@ static bool pvebackup_error_or_canceled(void)
     return error_or_canceled;
 }
 -static void pvebackup_add_transfered_bytes(size_t transferred, size_t zero_bytes)
 +static void pvebackup_add_transfered_bytes(size_t transferred, size_t zero_bytes, size_t reused)
 {
     qemu_mutex_lock(&backup_state.stat.lock);
     backup_state.stat.zero_bytes += zero_bytes;
     backup_state.stat.transferred += transferred;
 +    backup_state.stat.reused += reused;
     qemu_mutex_unlock(&backup_state.stat.lock);
 }
@@ -148,7 +154,8 @@ pvebackup_co_dump_pbs_cb(
         pvebackup_propagate_error(local_err);
         return pbs_res;
     } else {
 -        pvebackup_add_transfered_bytes(size, !buf ? size : 0);
 +        size_t reused = (pbs_res == 0) ? size : 0;
 +        pvebackup_add_transfered_bytes(size, !buf ? size : 0, reused);
     }
     return size;
@@ -208,11 +215,11 @@ pvebackup_co_dump_vma_cb(
         } else {
             if (remaining >= VMA_CLUSTER_SIZE) {
                 assert(ret == VMA_CLUSTER_SIZE);
 -                pvebackup_add_transfered_bytes(VMA_CLUSTER_SIZE, zero_bytes);
 +                pvebackup_add_transfered_bytes(VMA_CLUSTER_SIZE, zero_bytes, 0);
                 remaining -= VMA_CLUSTER_SIZE;
             } else {
                 assert(ret == remaining);
 -                pvebackup_add_transfered_bytes(remaining, zero_bytes);
 +                pvebackup_add_transfered_bytes(remaining, zero_bytes, 0);
                 remaining = 0;
             }
         }
@@ -248,6 +255,18 @@ static void coroutine_fn pvebackup_co_cleanup(void *unused)
             if (local_err != NULL) {
                 pvebackup_propagate_error(local_err);
             }
 +        } else {
 +            // on error or cancel we cannot ensure synchronization of dirty
 +            // bitmaps with backup server, so remove all and do full backup next
 +            GList *l = backup_state.di_list;
 +            while (l) {
 +                PVEBackupDevInfo *di = (PVEBackupDevInfo *)l->data;
 +                l = g_list_next(l);
 +
 +                if (di->bitmap) {
 +                    bdrv_release_dirty_bitmap(di->bitmap);
 +                }
 +            }
         }
         proxmox_backup_disconnect(backup_state.pbs);
@@ -303,6 +322,12 @@ static void pvebackup_complete_cb(void *opaque, int ret)
     // remove self from job queue
     backup_state.di_list = g_list_remove(backup_state.di_list, di);
 +    if (di->bitmap && ret < 0) {
 +        // on error or cancel we cannot ensure synchronization of dirty
 +        // bitmaps with backup server, so remove all and do full backup next
 +        bdrv_release_dirty_bitmap(di->bitmap);
 +    }
 +
     g_free(di);
     qemu_mutex_unlock(&backup_state.backup_mutex);
@@ -472,12 +497,18 @@ static bool create_backup_jobs(void) {
         assert(di->target != NULL);
 +        MirrorSyncMode sync_mode = MIRROR_SYNC_MODE_FULL;
 +        BitmapSyncMode bitmap_mode = BITMAP_SYNC_MODE_NEVER;
 +        if (di->bitmap) {
 +            sync_mode = MIRROR_SYNC_MODE_BITMAP;
 +            bitmap_mode = BITMAP_SYNC_MODE_ON_SUCCESS;
 +        }
         AioContext *aio_context = bdrv_get_aio_context(di->bs);
         aio_context_acquire(aio_context);
         BlockJob *job = backup_job_create(
 -            NULL, di->bs, di->target, backup_state.speed, MIRROR_SYNC_MODE_FULL, NULL,
 -            BITMAP_SYNC_MODE_NEVER, false, NULL, &perf, BLOCKDEV_ON_ERROR_REPORT, BLOCKDEV_ON_ERROR_REPORT,
 +            NULL, di->bs, di->target, backup_state.speed, sync_mode, di->bitmap,
 +            bitmap_mode, false, NULL, &perf, BLOCKDEV_ON_ERROR_REPORT, BLOCKDEV_ON_ERROR_REPORT,
             JOB_DEFAULT, pvebackup_complete_cb, di, NULL, &local_err);
         aio_context_release(aio_context);
@@ -528,6 +559,8 @@ typedef struct QmpBackupTask {
     const char *fingerprint;
     bool has_fingerprint;
     int64_t backup_time;
 +    bool has_use_dirty_bitmap;
 +    bool use_dirty_bitmap;
     bool has_format;
     BackupFormat format;
     bool has_config_file;
@@ -619,6 +652,7 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
     }
     size_t total = 0;
 +    size_t dirty = 0;
     l = di_list;
     while (l) {
@@ -656,6 +690,8 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
         int dump_cb_block_size = PROXMOX_BACKUP_DEFAULT_CHUNK_SIZE; // Hardcoded (4M)
         firewall_name = "fw.conf";
 +        bool use_dirty_bitmap = task->has_use_dirty_bitmap && task->use_dirty_bitmap;
 +
         char *pbs_err = NULL;
         pbs = proxmox_backup_new(
             task->backup_file,
@@ -675,7 +711,8 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
             goto err;
         }
 -        if (proxmox_backup_co_connect(pbs, task->errp) < 0)
 +        int connect_result = proxmox_backup_co_connect(pbs, task->errp);
 +        if (connect_result < 0)
             goto err;
         /* register all devices */
@@ -686,9 +723,40 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
             const char *devname = bdrv_get_device_name(di->bs);
 -            int dev_id = proxmox_backup_co_register_image(pbs, devname, di->size, task->errp);
 -            if (dev_id < 0)
 +            BdrvDirtyBitmap *bitmap = bdrv_find_dirty_bitmap(di->bs, PBS_BITMAP_NAME);
 +            bool expect_only_dirty = false;
 +
 +            if (use_dirty_bitmap) {
 +                if (bitmap == NULL) {
 +                    bitmap = bdrv_create_dirty_bitmap(di->bs, dump_cb_block_size, PBS_BITMAP_NAME, task->errp);
 +                    if (!bitmap) {
 +                        goto err;
 +                    }
 +                } else {
 +                    expect_only_dirty = proxmox_backup_check_incremental(pbs, devname, di->size) != 0;
 +                }
 +
 +                if (expect_only_dirty) {
 +                    dirty += bdrv_get_dirty_count(bitmap);
 +                } else {
 +                    /* mark entire bitmap as dirty to make full backup */
 +                    bdrv_set_dirty_bitmap(bitmap, 0, di->size);
 +                    dirty += di->size;
 +                }
 +                di->bitmap = bitmap;
 +            } else {
 +                dirty += di->size;
 +
 +                /* after a full backup the old dirty bitmap is invalid anyway */
 +                if (bitmap != NULL) {
 +                    bdrv_release_dirty_bitmap(bitmap);
 +                }
 +            }
 +
 +            int dev_id = proxmox_backup_co_register_image(pbs, devname, di->size, expect_only_dirty, task->errp);
 +            if (dev_id < 0) {
                 goto err;
 +            }
             if (!(di->target = bdrv_backup_dump_create(dump_cb_block_size, di->size, pvebackup_co_dump_pbs_cb, di, task->errp))) {
                 goto err;
@@ -697,6 +765,8 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
             di->dev_id = dev_id;
         }
     } else if (format == BACKUP_FORMAT_VMA) {
 +        dirty = total;
 +
         vmaw = vma_writer_create(task->backup_file, uuid, &local_err);
         if (!vmaw) {
             if (local_err) {
@@ -724,6 +794,8 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
             }
         }
     } else if (format == BACKUP_FORMAT_DIR) {
 +        dirty = total;
 +
         if (mkdir(task->backup_file, 0640) != 0) {
             error_setg_errno(task->errp, errno, "can't create directory '%s'\n",
                              task->backup_file);
@@ -796,8 +868,10 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
     char *uuid_str = g_strdup(backup_state.stat.uuid_str);
     backup_state.stat.total = total;
 +    backup_state.stat.dirty = dirty;
     backup_state.stat.transferred = 0;
     backup_state.stat.zero_bytes = 0;
 +    backup_state.stat.reused = format == BACKUP_FORMAT_PBS && dirty >= total ? 0 : total - dirty;
     qemu_mutex_unlock(&backup_state.stat.lock);
@@ -821,6 +895,10 @@ err:
         PVEBackupDevInfo *di = (PVEBackupDevInfo *)l->data;
         l = g_list_next(l);
 +        if (di->bitmap) {
 +            bdrv_release_dirty_bitmap(di->bitmap);
 +        }
 +
         if (di->target) {
             bdrv_unref(di->target);
         }
@@ -862,6 +940,7 @@ UuidInfo *qmp_backup(
     bool has_fingerprint, const char *fingerprint,
     bool has_backup_id, const char *backup_id,
     bool has_backup_time, int64_t backup_time,
 +    bool has_use_dirty_bitmap, bool use_dirty_bitmap,
     bool has_format, BackupFormat format,
     bool has_config_file, const char *config_file,
     bool has_firewall_file, const char *firewall_file,
@@ -880,6 +959,8 @@ UuidInfo *qmp_backup(
         .backup_id = backup_id,
         .has_backup_time = has_backup_time,
         .backup_time = backup_time,
 +        .has_use_dirty_bitmap = has_use_dirty_bitmap,
 +        .use_dirty_bitmap = use_dirty_bitmap,
         .has_format = has_format,
         .format = format,
         .has_config_file = has_config_file,
@@ -948,10 +1029,14 @@ BackupStatus *qmp_query_backup(Error **errp)
     info->has_total = true;
     info->total = backup_state.stat.total;
 +    info->has_dirty = true;
 +    info->dirty = backup_state.stat.dirty;
     info->has_zero_bytes = true;
     info->zero_bytes = backup_state.stat.zero_bytes;
     info->has_transferred = true;
     info->transferred = backup_state.stat.transferred;
 +    info->has_reused = true;
 +    info->reused = backup_state.stat.reused;
     qemu_mutex_unlock(&backup_state.stat.lock);
 diff --git a/qapi/block-core.json b/qapi/block-core.json
 index 90ad07b7ee..3ad9eb5d1a 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
@@ -753,8 +753,13 @@
 #
 # @total: total amount of bytes involved in the backup process
 #
 +# @dirty: with incremental mode (PBS) this is the amount of bytes involved
 +#         in the backup process which are marked dirty.
 +#
 # @transferred: amount of bytes already backed up.
 #
 +# @reused: amount of bytes reused due to deduplication.
 +#
 # @zero-bytes: amount of 'zero' bytes detected.
 #
 # @start-time: time (epoch) when backup job started.
@@ -767,8 +772,8 @@
 #
 ##
 { 'struct': 'BackupStatus',
 -  'data': {'*status': 'str', '*errmsg': 'str', '*total': 'int',
 -           '*transferred': 'int', '*zero-bytes': 'int',
 +  'data': {'*status': 'str', '*errmsg': 'str', '*total': 'int', '*dirty': 'int',
 +           '*transferred': 'int', '*zero-bytes': 'int', '*reused': 'int',
            '*start-time': 'int', '*end-time': 'int',
            '*backup-file': 'str', '*uuid': 'str' } }
@@ -811,6 +816,8 @@
 #
 # @backup-time: backup timestamp (Unix epoch, required for format 'pbs')
 #
 +# @use-dirty-bitmap: use dirty bitmap to detect incremental changes since last job (optional for format 'pbs')
 +#
 # Returns: the uuid of the backup job
 #
 ##
@@ -821,6 +828,7 @@
                                     '*fingerprint': 'str',
                                     '*backup-id': 'str',
                                     '*backup-time': 'int',
 +                                    '*use-dirty-bitmap': 'bool',
                                     '*format': 'BackupFormat',
                                     '*config-file': 'str',
                                     '*firewall-file': 'str',
--- a/debian/patches/pve/0032-PVE-various-PBS-fixes.patch
+++ b/debian/patches/pve/0032-PVE-various-PBS-fixes.patch
@@ -0,0 +1,219 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Dietmar Maurer <dietmar@proxmox.com>
 Date: Thu, 9 Jul 2020 12:53:08 +0200
 Subject: [PATCH] PVE: various PBS fixes
 pbs: fix crypt and compress parameters
 Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
 PVE: handle PBS write callback with big blocks correctly
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 PVE: add zero block handling to PBS dump callback
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
 block/monitor/block-hmp-cmds.c |  4 ++-
 pve-backup.c                   | 57 +++++++++++++++++++++++++++-------
 qapi/block-core.json           |  6 ++++
 3 files changed, 54 insertions(+), 13 deletions(-)
 diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
 index 45da74d7a0..ea7b665aa2 100644
 --- a/block/monitor/block-hmp-cmds.c
 +++ b/block/monitor/block-hmp-cmds.c
@@ -1042,7 +1042,9 @@ void hmp_backup(Monitor *mon, const QDict *qdict)
         false, NULL, // PBS fingerprint
         false, NULL, // PBS backup-id
         false, 0, // PBS backup-time
 -        false, false, // PBS incremental
 +        false, false, // PBS use-dirty-bitmap
 +        false, false, // PBS compress
 +        false, false, // PBS encrypt
         true, dir ? BACKUP_FORMAT_DIR : BACKUP_FORMAT_VMA,
         false, NULL, false, NULL, !!devlist,
         devlist, qdict_haskey(qdict, "speed"), speed, &error);
 diff --git a/pve-backup.c b/pve-backup.c
 index 1c49cd178d..c15abefdda 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
@@ -8,6 +8,7 @@
 #include "block/blockjob.h"
 #include "qapi/qapi-commands-block.h"
 #include "qapi/qmp/qerror.h"
 +#include "qemu/cutils.h"
 /* PVE backup state and related function */
@@ -67,6 +68,7 @@ opts_init(pvebackup_init);
 typedef struct PVEBackupDevInfo {
     BlockDriverState *bs;
     size_t size;
 +    uint64_t block_size;
     uint8_t dev_id;
     bool completed;
     char targetfile[PATH_MAX];
@@ -135,10 +137,13 @@ pvebackup_co_dump_pbs_cb(
     PVEBackupDevInfo *di = opaque;
     assert(backup_state.pbs);
 +    assert(buf);
     Error *local_err = NULL;
     int pbs_res = -1;
 +    bool is_zero_block = size == di->block_size && buffer_is_zero(buf, size);
 +
     qemu_co_mutex_lock(&backup_state.dump_callback_mutex);
     // avoid deadlock if job is cancelled
@@ -147,17 +152,29 @@ pvebackup_co_dump_pbs_cb(
         return -1;
     }
 -    pbs_res = proxmox_backup_co_write_data(backup_state.pbs, di->dev_id, buf, start, size, &local_err);
 -    qemu_co_mutex_unlock(&backup_state.dump_callback_mutex);
 +    uint64_t transferred = 0;
 +    uint64_t reused = 0;
 +    while (transferred < size) {
 +        uint64_t left = size - transferred;
 +        uint64_t to_transfer = left < di->block_size ? left : di->block_size;
 -    if (pbs_res < 0) {
 -        pvebackup_propagate_error(local_err);
 -        return pbs_res;
 -    } else {
 -        size_t reused = (pbs_res == 0) ? size : 0;
 -        pvebackup_add_transfered_bytes(size, !buf ? size : 0, reused);
 +        pbs_res = proxmox_backup_co_write_data(backup_state.pbs, di->dev_id,
 +            is_zero_block ? NULL : buf + transferred, start + transferred,
 +            to_transfer, &local_err);
 +        transferred += to_transfer;
 +
 +        if (pbs_res < 0) {
 +            pvebackup_propagate_error(local_err);
 +            qemu_co_mutex_unlock(&backup_state.dump_callback_mutex);
 +            return pbs_res;
 +        }
 +
 +        reused += pbs_res == 0 ? to_transfer : 0;
     }
 +    qemu_co_mutex_unlock(&backup_state.dump_callback_mutex);
 +    pvebackup_add_transfered_bytes(size, is_zero_block ? size : 0, reused);
 +
     return size;
 }
@@ -178,6 +195,7 @@ pvebackup_co_dump_vma_cb(
     int ret = -1;
     assert(backup_state.vmaw);
 +    assert(buf);
     uint64_t remaining = size;
@@ -204,9 +222,7 @@ pvebackup_co_dump_vma_cb(
         qemu_co_mutex_unlock(&backup_state.dump_callback_mutex);
         ++cluster_num;
 -        if (buf) {
 -            buf += VMA_CLUSTER_SIZE;
 -        }
 +        buf += VMA_CLUSTER_SIZE;
         if (ret < 0) {
             Error *local_err = NULL;
             vma_writer_error_propagate(backup_state.vmaw, &local_err);
@@ -569,6 +585,10 @@ typedef struct QmpBackupTask {
     const char *firewall_file;
     bool has_devlist;
     const char *devlist;
 +    bool has_compress;
 +    bool compress;
 +    bool has_encrypt;
 +    bool encrypt;
     bool has_speed;
     int64_t speed;
     Error **errp;
@@ -692,6 +712,7 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
         bool use_dirty_bitmap = task->has_use_dirty_bitmap && task->use_dirty_bitmap;
 +
         char *pbs_err = NULL;
         pbs = proxmox_backup_new(
             task->backup_file,
@@ -701,8 +722,10 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
             task->has_password ? task->password : NULL,
             task->has_keyfile ? task->keyfile : NULL,
             task->has_key_password ? task->key_password : NULL,
 +            task->has_compress ? task->compress : true,
 +            task->has_encrypt ? task->encrypt : task->has_keyfile,
             task->has_fingerprint ? task->fingerprint : NULL,
 -            &pbs_err);
 +             &pbs_err);
         if (!pbs) {
             error_set(task->errp, ERROR_CLASS_GENERIC_ERROR,
@@ -721,6 +744,8 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
             PVEBackupDevInfo *di = (PVEBackupDevInfo *)l->data;
             l = g_list_next(l);
 +            di->block_size = dump_cb_block_size;
 +
             const char *devname = bdrv_get_device_name(di->bs);
             BdrvDirtyBitmap *bitmap = bdrv_find_dirty_bitmap(di->bs, PBS_BITMAP_NAME);
@@ -941,6 +966,8 @@ UuidInfo *qmp_backup(
     bool has_backup_id, const char *backup_id,
     bool has_backup_time, int64_t backup_time,
     bool has_use_dirty_bitmap, bool use_dirty_bitmap,
 +    bool has_compress, bool compress,
 +    bool has_encrypt, bool encrypt,
     bool has_format, BackupFormat format,
     bool has_config_file, const char *config_file,
     bool has_firewall_file, const char *firewall_file,
@@ -951,6 +978,8 @@ UuidInfo *qmp_backup(
         .backup_file = backup_file,
         .has_password = has_password,
         .password = password,
 +        .has_keyfile = has_keyfile,
 +        .keyfile = keyfile,
         .has_key_password = has_key_password,
         .key_password = key_password,
         .has_fingerprint = has_fingerprint,
@@ -961,6 +990,10 @@ UuidInfo *qmp_backup(
         .backup_time = backup_time,
         .has_use_dirty_bitmap = has_use_dirty_bitmap,
         .use_dirty_bitmap = use_dirty_bitmap,
 +        .has_compress = has_compress,
 +        .compress = compress,
 +        .has_encrypt = has_encrypt,
 +        .encrypt = encrypt,
         .has_format = has_format,
         .format = format,
         .has_config_file = has_config_file,
 diff --git a/qapi/block-core.json b/qapi/block-core.json
 index 3ad9eb5d1a..4120052690 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
@@ -818,6 +818,10 @@
 #
 # @use-dirty-bitmap: use dirty bitmap to detect incremental changes since last job (optional for format 'pbs')
 #
 +# @compress: use compression (optional for format 'pbs', defaults to true)
 +#
 +# @encrypt: use encryption ((optional for format 'pbs', defaults to true if there is a keyfile)
 +#
 # Returns: the uuid of the backup job
 #
 ##
@@ -829,6 +833,8 @@
                                     '*backup-id': 'str',
                                     '*backup-time': 'int',
                                     '*use-dirty-bitmap': 'bool',
 +                                    '*compress': 'bool',
 +                                    '*encrypt': 'bool',
                                     '*format': 'BackupFormat',
                                     '*config-file': 'str',
                                     '*firewall-file': 'str',
--- a/debian/patches/pve/0033-PVE-Add-PBS-block-driver-to-map-backup-archives-into.patch
+++ b/debian/patches/pve/0033-PVE-Add-PBS-block-driver-to-map-backup-archives-into.patch
@@ -7,40 +7,38 @@ Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 [error cleanups, file_open implementation]
 Signed-off-by: Dietmar Maurer <dietmar@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 [WB: add namespace support]
 Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
 [FE: adapt to changed function signatures
-     make pbs_co_preadv return values consistent with QEMU
+     make pbs_co_preadv return values consistent with QEMU]
     getlength is now a coroutine function]
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
- block/meson.build    |   2 +
+ block/meson.build    |   3 +
- block/pbs.c          | 306 +++++++++++++++++++++++++++++++++++++++++++
+ block/pbs.c          | 276 +++++++++++++++++++++++++++++++++++++++++++
 configure            |   9 ++
 meson.build          |   2 +-
- qapi/block-core.json |  29 ++++
+ qapi/block-core.json |  13 ++
- qapi/pragma.json     |   1 +
+ 5 files changed, 302 insertions(+), 1 deletion(-)
 5 files changed, 339 insertions(+), 1 deletion(-)
 create mode 100644 block/pbs.c
 diff --git a/block/meson.build b/block/meson.build
-index 2367e1ac1b..e178047ec9 100644
+index 2783b77e9c..a26a69434e 100644
 --- a/block/meson.build
 +++ b/block/meson.build
-@@ -49,6 +49,8 @@ block_ss.add(files(
+@@ -53,6 +53,9 @@ block_ss.add(files(
   '../pve-backup.c',
 ), libproxmox_backup_qemu)
-+block_ss.add(files('pbs.c'), libproxmox_backup_qemu)
+block_ss.add(when: 'CONFIG_PBS_BDRV', if_true: files('pbs.c'))
 +block_ss.add(when: 'CONFIG_PBS_BDRV', if_true: libproxmox_backup_qemu)
 +
- system_ss.add(when: 'CONFIG_TCG', if_true: files('blkreplay.c'))
+ softmmu_ss.add(when: 'CONFIG_TCG', if_true: files('blkreplay.c'))
- system_ss.add(files('block-ram-registrar.c'))
+ 
 diff --git a/block/pbs.c b/block/pbs.c
 new file mode 100644
-index 0000000000..2d5e28ce8f
+index 0000000000..9d1f1f39d4
 --- /dev/null
 +++ b/block/pbs.c
-@@ -0,0 +1,306 @@
+@@ -0,0 +1,276 @@
 +/*
 + * Proxmox Backup Server read-only block driver
 + */
@@ -53,12 +51,10 @@ index 0000000000..2d5e28ce8f
 +#include "qemu/option.h"
 +#include "qemu/cutils.h"
 +#include "block/block_int.h"
 +#include "block/block-io.h"
 +
 +#include <proxmox-backup-qemu.h>
 +
 +#define PBS_OPT_REPOSITORY "repository"
 +#define PBS_OPT_NAMESPACE "namespace"
 +#define PBS_OPT_SNAPSHOT "snapshot"
 +#define PBS_OPT_ARCHIVE "archive"
 +#define PBS_OPT_KEYFILE "keyfile"
@@ -68,11 +64,10 @@ index 0000000000..2d5e28ce8f
 +
 +typedef struct {
 +    ProxmoxRestoreHandle *conn;
-+    uint8_t aid;
+    char aid;
 +    int64_t length;
 +
 +    char *repository;
 +    char *namespace;
 +    char *snapshot;
 +    char *archive;
 +} BDRVPBSState;
@@ -87,11 +82,6 @@ index 0000000000..2d5e28ce8f
 +            .help = "The server address and repository to connect to.",
 +        },
 +        {
 +            .name = PBS_OPT_NAMESPACE,
 +            .type = QEMU_OPT_STRING,
 +            .help = "Optional: The snapshot's namespace.",
 +        },
 +        {
 +            .name = PBS_OPT_SNAPSHOT,
 +            .type = QEMU_OPT_STRING,
 +            .help = "The snapshot to read.",
@@ -127,7 +117,7 @@ index 0000000000..2d5e28ce8f
 +
 +
 +// filename format:
-+// pbs:repository=<repo>,namespace=<ns>,snapshot=<snap>,password=<pw>,key_password=<kpw>,fingerprint=<fp>,archive=<archive>
+// pbs:repository=<repo>,snapshot=<snap>,password=<pw>,key_password=<kpw>,fingerprint=<fp>,archive=<archive>
 +static void pbs_parse_filename(const char *filename, QDict *options,
 +                                     Error **errp)
 +{
@@ -163,7 +153,6 @@ index 0000000000..2d5e28ce8f
 +    s->archive = g_strdup(qemu_opt_get(opts, PBS_OPT_ARCHIVE));
 +    const char *keyfile = qemu_opt_get(opts, PBS_OPT_KEYFILE);
 +    const char *password = qemu_opt_get(opts, PBS_OPT_PASSWORD);
 +    const char *namespace = qemu_opt_get(opts, PBS_OPT_NAMESPACE);
 +    const char *fingerprint = qemu_opt_get(opts, PBS_OPT_FINGERPRINT);
 +    const char *key_password = qemu_opt_get(opts, PBS_OPT_ENCRYPTION_PASSWORD);
 +
@@ -176,12 +165,9 @@ index 0000000000..2d5e28ce8f
 +    if (!key_password) {
 +        key_password = getenv("PBS_ENCRYPTION_PASSWORD");
 +    }
 +    if (namespace) {
 +        s->namespace = g_strdup(namespace);
 +    }
 +
 +    /* connect to PBS server in read mode */
-+    s->conn = proxmox_restore_new_ns(s->repository, s->snapshot, s->namespace, password,
+    s->conn = proxmox_restore_new(s->repository, s->snapshot, password,
 +        keyfile, key_password, fingerprint, &pbs_error);
 +
 +    /* invalidates qemu_opt_get char pointers from above */
@@ -201,18 +187,12 @@ index 0000000000..2d5e28ce8f
 +    }
 +
 +    /* acquire handle and length */
-+    ret = proxmox_restore_open_image(s->conn, s->archive, &pbs_error);
+    s->aid = proxmox_restore_open_image(s->conn, s->archive, &pbs_error);
-+    if (ret < 0) {
+    if (s->aid < 0) {
 +        if (pbs_error && errp) error_setg(errp, "PBS open_image failed: %s", pbs_error);
 +        if (pbs_error) proxmox_backup_free_error(pbs_error);
 +        return -ENODEV;
 +    }
 +    if (ret > UINT8_MAX) {
 +        error_setg(errp, "PBS open_image returned an ID larger than %u", UINT8_MAX);
 +        return -ENODEV;
 +    }
 +    s->aid = ret;
 +
 +    s->length = proxmox_restore_get_image_length(s->conn, s->aid, &pbs_error);
 +    if (s->length < 0) {
 +        if (pbs_error && errp) error_setg(errp, "PBS get_image_length failed: %s", pbs_error);
@@ -223,17 +203,21 @@ index 0000000000..2d5e28ce8f
 +    return 0;
 +}
 +
 +static int pbs_file_open(BlockDriverState *bs, QDict *options, int flags,
 +                         Error **errp)
 +{
 +    return pbs_open(bs, options, flags, errp);
 +}
 +
 +static void pbs_close(BlockDriverState *bs) {
 +    BDRVPBSState *s = bs->opaque;
 +    g_free(s->repository);
 +    g_free(s->namespace);
 +    g_free(s->snapshot);
 +    g_free(s->archive);
 +    proxmox_restore_disconnect(s->conn);
 +}
 +
-+static coroutine_fn int64_t GRAPH_RDLOCK
+static int64_t pbs_getlength(BlockDriverState *bs)
 +pbs_co_getlength(BlockDriverState *bs)
 +{
 +    BDRVPBSState *s = bs->opaque;
 +    return s->length;
@@ -250,23 +234,14 @@ index 0000000000..2d5e28ce8f
 +    aio_co_schedule(rcb->ctx, rcb->co);
 +}
 +
-+static coroutine_fn int GRAPH_RDLOCK
+static coroutine_fn int pbs_co_preadv(BlockDriverState *bs,
-+pbs_co_preadv(BlockDriverState *bs, int64_t offset, int64_t bytes,
+                                      int64_t offset, int64_t bytes,
 +                                      QEMUIOVector *qiov, BdrvRequestFlags flags)
 +{
 +    BDRVPBSState *s = bs->opaque;
 +    int ret;
 +    char *pbs_error = NULL;
-+    uint8_t *buf;
+    uint8_t *buf = malloc(bytes);
 +    bool inline_buf = true;
 +
 +    /* for single-buffer IO vectors we can fast-path the write directly to it */
 +    if (qiov->niov == 1 && qiov->iov->iov_len >= bytes) {
 +        buf = qiov->iov->iov_base;
 +    } else {
 +        inline_buf = false;
 +        buf = g_malloc(bytes);
 +    }
 +
 +    if (offset < 0 || bytes < 0) {
 +        fprintf(stderr, "unexpected negative 'offset' or 'bytes' value!\n");
@@ -289,16 +264,14 @@ index 0000000000..2d5e28ce8f
 +        return -EIO;
 +    }
 +
 +    if (!inline_buf) {
 +    qemu_iovec_from_buf(qiov, 0, buf, bytes);
-+        g_free(buf);
+    free(buf);
 +    }
 +
 +    return 0;
 +}
 +
-+static coroutine_fn int GRAPH_RDLOCK
+static coroutine_fn int pbs_co_pwritev(BlockDriverState *bs,
-+pbs_co_pwritev(BlockDriverState *bs, int64_t offset, int64_t bytes,
+                                       int64_t offset, int64_t bytes,
 +                                       QEMUIOVector *qiov, BdrvRequestFlags flags)
 +{
 +    fprintf(stderr, "pbs-bdrv: cannot write to backup file, make sure "
@@ -306,17 +279,11 @@ index 0000000000..2d5e28ce8f
 +    return -EPERM;
 +}
 +
-+static void GRAPH_RDLOCK
+static void pbs_refresh_filename(BlockDriverState *bs)
 +pbs_refresh_filename(BlockDriverState *bs)
 +{
 +    BDRVPBSState *s = bs->opaque;
 +    if (s->namespace) {
 +        snprintf(bs->exact_filename, sizeof(bs->exact_filename), "%s/%s:%s(%s)",
 +                 s->repository, s->namespace, s->snapshot, s->archive);
 +    } else {
 +    snprintf(bs->exact_filename, sizeof(bs->exact_filename), "%s/%s(%s)",
 +             s->repository, s->snapshot, s->archive);
 +    }
 +}
 +
 +static const char *const pbs_strong_runtime_opts[] = {
@@ -330,9 +297,10 @@ index 0000000000..2d5e28ce8f
 +
 +    .bdrv_parse_filename    = pbs_parse_filename,
 +
 +    .bdrv_file_open         = pbs_file_open,
 +    .bdrv_open              = pbs_open,
 +    .bdrv_close             = pbs_close,
-+    .bdrv_co_getlength      = pbs_co_getlength,
+    .bdrv_getlength         = pbs_getlength,
 +
 +    .bdrv_co_preadv         = pbs_co_preadv,
 +    .bdrv_co_pwritev        = pbs_co_pwritev,
@@ -347,13 +315,54 @@ index 0000000000..2d5e28ce8f
 +}
 +
 +block_init(bdrv_pbs_init);
 diff --git a/configure b/configure
 index 72ab03f11a..7203c270ec 100755
 --- a/configure
 +++ b/configure
@@ -309,6 +309,7 @@ linux_user=""
 bsd_user=""
 pie=""
 coroutine=""
 +pbs_bdrv="yes"
 plugins="$default_feature"
 meson=""
 meson_args=""
@@ -902,6 +903,10 @@ for opt do
   --enable-uuid|--disable-uuid)
       echo "$0: $opt is obsolete, UUID support is always built" >&2
   ;;
 +  --disable-pbs-bdrv) pbs_bdrv="no"
 +  ;;
 +  --enable-pbs-bdrv) pbs_bdrv="yes"
 +  ;;
   --with-git=*) git="$optarg"
   ;;
   --with-git-submodules=*)
@@ -1087,6 +1092,7 @@ cat << EOF
   debug-info      debugging information
   safe-stack      SafeStack Stack Smash Protection. Depends on
                   clang/llvm >= 3.7 and requires coroutine backend ucontext.
 +  pbs-bdrv        Proxmox backup server read-only block driver support
 NOTE: The object files are built at the place where configure is launched
 EOF
@@ -2463,6 +2469,9 @@ echo "TARGET_DIRS=$target_list" >> $config_host_mak
 if test "$modules" = "yes"; then
   echo "CONFIG_MODULES=y" >> $config_host_mak
 fi
 +if test "$pbs_bdrv" = "yes" ; then
 +  echo "CONFIG_PBS_BDRV=y" >> $config_host_mak
 +fi
 # XXX: suppress that
 if [ "$bsd" = "yes" ] ; then
 diff --git a/meson.build b/meson.build
-index 426f382178..7e6130cfdf 100644
+index f48d2e0457..be4785e2f6 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -4559,7 +4559,7 @@ summary_info += {'zstd support':      zstd}
+@@ -3986,7 +3986,7 @@ summary_info += {'bzip2 support':     libbzip2}
- summary_info += {'Query Processing Library support': qpl}
+ summary_info += {'lzfse support':     liblzfse}
- summary_info += {'UADK Library support': uadk}
+ summary_info += {'zstd support':      zstd}
 summary_info += {'NUMA host support': numa}
 -summary_info += {'capstone':          capstone}
 +summary_info += {'PBS bdrv support':  config_host.has_key('CONFIG_PBS_BDRV')}
@@ -361,18 +370,18 @@ index 426f382178..7e6130cfdf 100644
 summary_info += {'libdaxctl support': libdaxctl}
 summary_info += {'libudev':           libudev}
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index ac83c3495d..fe0eefcea6 100644
+index 4120052690..96bc696aaa 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -3457,6 +3457,7 @@
+@@ -3099,6 +3099,7 @@
-             'parallels', 'preallocate', 'qcow', 'qcow2', 'qed', 'quorum',
+             'luks', 'nbd', 'nfs', 'null-aio', 'null-co', 'nvme', 'parallels',
-             'raw', 'rbd',
+             'preallocate', 'qcow', 'qcow2', 'qed', 'quorum', 'raw', 'rbd',
             { 'name': 'replication', 'if': 'CONFIG_REPLICATION' },
 +            'pbs',
-             'ssh', 'throttle', 'vdi', 'vhdx',
+             'ssh', 'throttle', 'vdi', 'vhdx', 'vmdk', 'vpc', 'vvfat' ] }
-             { 'name': 'virtio-blk-vfio-pci', 'if': 'CONFIG_BLKIO' },
+ 
-             { 'name': 'virtio-blk-vhost-user', 'if': 'CONFIG_BLKIO' },
+ ##
-@@ -3543,6 +3544,33 @@
+@@ -3171,6 +3172,17 @@
 { 'struct': 'BlockdevOptionsNull',
   'data': { '*size': 'int', '*latency-ns': 'uint64', '*read-zeroes': 'bool' } }
@@ -381,48 +390,20 @@ index ac83c3495d..fe0eefcea6 100644
 +#
 +# Driver specific block device options for the PBS backend.
 +#
 +# @repository: Proxmox Backup Server repository.
 +#
 +# @snapshot: backup snapshots ID.
 +#
 +# @archive: archive name.
 +#
 +# @keyfile: keyfile to use for encryption.
 +#
 +# @password: password to use for connection.
 +#
 +# @fingerprint: backup server fingerprint.
 +#
 +# @key_password: password to unlock key.
 +#
 +# @namespace: namespace where backup snapshot lives.
 +#
 +##
 +{ 'struct': 'BlockdevOptionsPbs',
 +  'data': { 'repository': 'str', 'snapshot': 'str', 'archive': 'str',
 +            '*keyfile': 'str', '*password': 'str', '*fingerprint': 'str',
-+            '*key_password': 'str', '*namespace': 'str' } }
+            '*key_password': 'str' } }
 +
 ##
 # @BlockdevOptionsNVMe:
 #
-@@ -4978,6 +5006,7 @@
+@@ -4455,6 +4467,7 @@
       'nfs':        'BlockdevOptionsNfs',
       'null-aio':   'BlockdevOptionsNull',
       'null-co':    'BlockdevOptionsNull',
 +      'pbs':        'BlockdevOptionsPbs',
       'nvme':       'BlockdevOptionsNVMe',
-       'nvme-io_uring': { 'type': 'BlockdevOptionsNvmeIoUring',
+       'parallels':  'BlockdevOptionsGenericFormat',
-                          'if': 'CONFIG_BLKIO' },
+       'preallocate':'BlockdevOptionsPreallocate',
 diff --git a/qapi/pragma.json b/qapi/pragma.json
 index be8fa304c5..7ff46bd128 100644
 --- a/qapi/pragma.json
 +++ b/qapi/pragma.json
@@ -100,6 +100,7 @@
         'BlockInfo',                # query-block
         'BlockdevAioOptions',       # blockdev-add, -blockdev
         'BlockdevDriver',           # blockdev-add, query-blockstats, ...
 +        'BlockdevOptionsPbs',       # for PBS backwards compat
         'BlockdevVmdkAdapterType',  # blockdev-create (to match VMDK spec)
         'BlockdevVmdkSubformat',    # blockdev-create (to match VMDK spec)
         'ColoCompareProperties',    # object_add, -object
--- a/debian/patches/pve/0034-PVE-add-query_proxmox_support-QMP-command.patch
+++ b/debian/patches/pve/0034-PVE-add-query_proxmox_support-QMP-command.patch
@@ -0,0 +1,74 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Stefan Reiter <s.reiter@proxmox.com>
 Date: Wed, 8 Jul 2020 11:57:53 +0200
 Subject: [PATCH] PVE: add query_proxmox_support QMP command
 Generic interface for future use, currently used for PBS dirty-bitmap
 backup support.
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 [PVE: query-proxmox-support: include library version]
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 ---
 pve-backup.c         |  9 +++++++++
 qapi/block-core.json | 29 +++++++++++++++++++++++++++++
 2 files changed, 38 insertions(+)
 diff --git a/pve-backup.c b/pve-backup.c
 index c15abefdda..4684789813 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
@@ -1075,3 +1075,12 @@ BackupStatus *qmp_query_backup(Error **errp)
     return info;
 }
 +
 +ProxmoxSupportStatus *qmp_query_proxmox_support(Error **errp)
 +{
 +    ProxmoxSupportStatus *ret = g_malloc0(sizeof(*ret));
 +    ret->pbs_library_version = g_strdup(proxmox_backup_qemu_version());
 +    ret->pbs_dirty_bitmap = true;
 +    ret->pbs_dirty_bitmap_savevm = true;
 +    return ret;
 +}
 diff --git a/qapi/block-core.json b/qapi/block-core.json
 index 96bc696aaa..0b453c61d4 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
@@ -863,6 +863,35 @@
 ##
 { 'command': 'backup-cancel' }
 +##
 +# @ProxmoxSupportStatus:
 +#
 +# Contains info about supported features added by Proxmox.
 +#
 +# @pbs-dirty-bitmap: True if dirty-bitmap-incremental backups to PBS are
 +#                    supported.
 +#
 +# @pbs-dirty-bitmap-savevm: True if 'dirty-bitmaps' migration capability can
 +#                           safely be set for savevm-async.
 +#
 +# @pbs-library-version: Running version of libproxmox-backup-qemu0 library.
 +#
 +##
 +{ 'struct': 'ProxmoxSupportStatus',
 +  'data': { 'pbs-dirty-bitmap': 'bool',
 +            'pbs-dirty-bitmap-savevm': 'bool',
 +            'pbs-library-version': 'str' } }
 +
 +##
 +# @query-proxmox-support:
 +#
 +# Returns information about supported features added by Proxmox.
 +#
 +# Returns: @ProxmoxSupportStatus
 +#
 +##
 +{ 'command': 'query-proxmox-support', 'returns': 'ProxmoxSupportStatus' }
 +
 ##
 # @BlockDeviceTimedStats:
 #
--- a/debian/patches/pve/0035-PVE-add-query-pbs-bitmap-info-QMP-call.patch
+++ b/debian/patches/pve/0035-PVE-add-query-pbs-bitmap-info-QMP-call.patch
@@ -0,0 +1,441 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Stefan Reiter <s.reiter@proxmox.com>
 Date: Wed, 19 Aug 2020 17:02:00 +0200
 Subject: [PATCH] PVE: add query-pbs-bitmap-info QMP call
 Returns advanced information about dirty bitmaps used (or not used) for
 the latest PBS backup.
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
 monitor/hmp-cmds.c   |  28 ++++++-----
 pve-backup.c         | 117 ++++++++++++++++++++++++++++++++-----------
 qapi/block-core.json |  56 +++++++++++++++++++++
 3 files changed, 159 insertions(+), 42 deletions(-)
 diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
 index 4c1671e289..c1152f55a7 100644
 --- a/monitor/hmp-cmds.c
 +++ b/monitor/hmp-cmds.c
@@ -200,6 +200,7 @@ void hmp_info_mice(Monitor *mon, const QDict *qdict)
 void hmp_info_backup(Monitor *mon, const QDict *qdict)
 {
     BackupStatus *info;
 +    PBSBitmapInfoList *bitmap_info;
     info = qmp_query_backup(NULL);
@@ -230,26 +231,29 @@ void hmp_info_backup(Monitor *mon, const QDict *qdict)
             // this should not happen normally
             monitor_printf(mon, "Total size: %d\n", 0);
         } else {
 -            bool incremental = false;
             size_t total_or_dirty = info->total;
 -            if (info->has_transferred) {
 -                if (info->has_dirty && info->dirty) {
 -                     if (info->dirty < info->total) {
 -                        total_or_dirty = info->dirty;
 -                        incremental = true;
 -                    }
 -                }
 +            bitmap_info = qmp_query_pbs_bitmap_info(NULL);
 +
 +            while (bitmap_info) {
 +                monitor_printf(mon, "Drive %s:\n",
 +                        bitmap_info->value->drive);
 +                monitor_printf(mon, "  bitmap action: %s\n",
 +                        PBSBitmapAction_str(bitmap_info->value->action));
 +                monitor_printf(mon, "  size: %zd\n",
 +                        bitmap_info->value->size);
 +                monitor_printf(mon, "  dirty: %zd\n",
 +                        bitmap_info->value->dirty);
 +                bitmap_info = bitmap_info->next;
             }
 -            int per = (info->transferred * 100)/total_or_dirty;
 -
 -            monitor_printf(mon, "Backup mode: %s\n", incremental ? "incremental" : "full");
 +            qapi_free_PBSBitmapInfoList(bitmap_info);
             int zero_per = (info->has_zero_bytes && info->zero_bytes) ?
                 (info->zero_bytes * 100)/info->total : 0;
             monitor_printf(mon, "Total size: %zd\n", info->total);
 +            int trans_per = (info->transferred * 100)/total_or_dirty;
             monitor_printf(mon, "Transferred bytes: %zd (%d%%)\n",
 -                           info->transferred, per);
 +                           info->transferred, trans_per);
             monitor_printf(mon, "Zero bytes: %zd (%d%%)\n",
                            info->zero_bytes, zero_per);
 diff --git a/pve-backup.c b/pve-backup.c
 index 4684789813..f90abaa50a 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
@@ -46,6 +46,7 @@ static struct PVEBackupState {
         size_t transferred;
         size_t reused;
         size_t zero_bytes;
 +        GList *bitmap_list;
     } stat;
     int64_t speed;
     VmaWriter *vmaw;
@@ -672,7 +673,6 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
     }
     size_t total = 0;
 -    size_t dirty = 0;
     l = di_list;
     while (l) {
@@ -693,18 +693,33 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
     uuid_generate(uuid);
 +    qemu_mutex_lock(&backup_state.stat.lock);
 +    backup_state.stat.reused = 0;
 +
 +    /* clear previous backup's bitmap_list */
 +    if (backup_state.stat.bitmap_list) {
 +        GList *bl = backup_state.stat.bitmap_list;
 +        while (bl) {
 +            g_free(((PBSBitmapInfo *)bl->data)->drive);
 +            g_free(bl->data);
 +            bl = g_list_next(bl);
 +        }
 +        g_list_free(backup_state.stat.bitmap_list);
 +        backup_state.stat.bitmap_list = NULL;
 +    }
 +
     if (format == BACKUP_FORMAT_PBS) {
         if (!task->has_password) {
             error_set(task->errp, ERROR_CLASS_GENERIC_ERROR, "missing parameter 'password'");
 -            goto err;
 +            goto err_mutex;
         }
         if (!task->has_backup_id) {
             error_set(task->errp, ERROR_CLASS_GENERIC_ERROR, "missing parameter 'backup-id'");
 -            goto err;
 +            goto err_mutex;
         }
         if (!task->has_backup_time) {
             error_set(task->errp, ERROR_CLASS_GENERIC_ERROR, "missing parameter 'backup-time'");
 -            goto err;
 +            goto err_mutex;
         }
         int dump_cb_block_size = PROXMOX_BACKUP_DEFAULT_CHUNK_SIZE; // Hardcoded (4M)
@@ -731,12 +746,12 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
             error_set(task->errp, ERROR_CLASS_GENERIC_ERROR,
                       "proxmox_backup_new failed: %s", pbs_err);
             proxmox_backup_free_error(pbs_err);
 -            goto err;
 +            goto err_mutex;
         }
         int connect_result = proxmox_backup_co_connect(pbs, task->errp);
         if (connect_result < 0)
 -            goto err;
 +            goto err_mutex;
         /* register all devices */
         l = di_list;
@@ -747,6 +762,8 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
             di->block_size = dump_cb_block_size;
             const char *devname = bdrv_get_device_name(di->bs);
 +            PBSBitmapAction action = PBS_BITMAP_ACTION_NOT_USED;
 +            size_t dirty = di->size;
             BdrvDirtyBitmap *bitmap = bdrv_find_dirty_bitmap(di->bs, PBS_BITMAP_NAME);
             bool expect_only_dirty = false;
@@ -755,49 +772,59 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
                 if (bitmap == NULL) {
                     bitmap = bdrv_create_dirty_bitmap(di->bs, dump_cb_block_size, PBS_BITMAP_NAME, task->errp);
                     if (!bitmap) {
 -                        goto err;
 +                        goto err_mutex;
                     }
 +                    action = PBS_BITMAP_ACTION_NEW;
                 } else {
                     expect_only_dirty = proxmox_backup_check_incremental(pbs, devname, di->size) != 0;
                 }
                 if (expect_only_dirty) {
 -                    dirty += bdrv_get_dirty_count(bitmap);
 +                    /* track clean chunks as reused */
 +                    dirty = MIN(bdrv_get_dirty_count(bitmap), di->size);
 +                    backup_state.stat.reused += di->size - dirty;
 +                    action = PBS_BITMAP_ACTION_USED;
                 } else {
                     /* mark entire bitmap as dirty to make full backup */
                     bdrv_set_dirty_bitmap(bitmap, 0, di->size);
 -                    dirty += di->size;
 +                    if (action != PBS_BITMAP_ACTION_NEW) {
 +                        action = PBS_BITMAP_ACTION_INVALID;
 +                    }
                 }
                 di->bitmap = bitmap;
             } else {
 -                dirty += di->size;
 -
                 /* after a full backup the old dirty bitmap is invalid anyway */
                 if (bitmap != NULL) {
                     bdrv_release_dirty_bitmap(bitmap);
 +                    action = PBS_BITMAP_ACTION_NOT_USED_REMOVED;
                 }
             }
             int dev_id = proxmox_backup_co_register_image(pbs, devname, di->size, expect_only_dirty, task->errp);
             if (dev_id < 0) {
 -                goto err;
 +                goto err_mutex;
             }
             if (!(di->target = bdrv_backup_dump_create(dump_cb_block_size, di->size, pvebackup_co_dump_pbs_cb, di, task->errp))) {
 -                goto err;
 +                goto err_mutex;
             }
             di->dev_id = dev_id;
 +
 +            PBSBitmapInfo *info = g_malloc(sizeof(*info));
 +            info->drive = g_strdup(devname);
 +            info->action = action;
 +            info->size = di->size;
 +            info->dirty = dirty;
 +            backup_state.stat.bitmap_list = g_list_append(backup_state.stat.bitmap_list, info);
         }
     } else if (format == BACKUP_FORMAT_VMA) {
 -        dirty = total;
 -
         vmaw = vma_writer_create(task->backup_file, uuid, &local_err);
         if (!vmaw) {
             if (local_err) {
                 error_propagate(task->errp, local_err);
             }
 -            goto err;
 +            goto err_mutex;
         }
         /* register all devices for vma writer */
@@ -807,7 +834,7 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
             l = g_list_next(l);
             if (!(di->target = bdrv_backup_dump_create(VMA_CLUSTER_SIZE, di->size, pvebackup_co_dump_vma_cb, di, task->errp))) {
 -                goto err;
 +                goto err_mutex;
             }
             const char *devname = bdrv_get_device_name(di->bs);
@@ -815,16 +842,14 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
             if (di->dev_id <= 0) {
                 error_set(task->errp, ERROR_CLASS_GENERIC_ERROR,
                           "register_stream failed");
 -                goto err;
 +                goto err_mutex;
             }
         }
     } else if (format == BACKUP_FORMAT_DIR) {
 -        dirty = total;
 -
         if (mkdir(task->backup_file, 0640) != 0) {
             error_setg_errno(task->errp, errno, "can't create directory '%s'\n",
                              task->backup_file);
 -            goto err;
 +            goto err_mutex;
         }
         backup_dir = task->backup_file;
@@ -841,18 +866,18 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
                             di->size, flags, false, &local_err);
             if (local_err) {
                 error_propagate(task->errp, local_err);
 -                goto err;
 +                goto err_mutex;
             }
             di->target = bdrv_open(di->targetfile, NULL, NULL, flags, &local_err);
             if (!di->target) {
                 error_propagate(task->errp, local_err);
 -                goto err;
 +                goto err_mutex;
             }
         }
     } else {
         error_set(task->errp, ERROR_CLASS_GENERIC_ERROR, "unknown backup format");
 -        goto err;
 +        goto err_mutex;
     }
@@ -860,7 +885,7 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
     if (task->has_config_file) {
         if (pvebackup_co_add_config(task->config_file, config_name, format, backup_dir,
                                     vmaw, pbs, task->errp) != 0) {
 -            goto err;
 +            goto err_mutex;
         }
     }
@@ -868,12 +893,11 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
     if (task->has_firewall_file) {
         if (pvebackup_co_add_config(task->firewall_file, firewall_name, format, backup_dir,
                                     vmaw, pbs, task->errp) != 0) {
 -            goto err;
 +            goto err_mutex;
         }
     }
     /* initialize global backup_state now */
 -
 -    qemu_mutex_lock(&backup_state.stat.lock);
 +    /* note: 'reused' and 'bitmap_list' are initialized earlier */
     if (backup_state.stat.error) {
         error_free(backup_state.stat.error);
@@ -893,10 +917,9 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
     char *uuid_str = g_strdup(backup_state.stat.uuid_str);
     backup_state.stat.total = total;
 -    backup_state.stat.dirty = dirty;
 +    backup_state.stat.dirty = total - backup_state.stat.reused;
     backup_state.stat.transferred = 0;
     backup_state.stat.zero_bytes = 0;
 -    backup_state.stat.reused = format == BACKUP_FORMAT_PBS && dirty >= total ? 0 : total - dirty;
     qemu_mutex_unlock(&backup_state.stat.lock);
@@ -913,6 +936,9 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
     task->result = uuid_info;
     return;
 +err_mutex:
 +    qemu_mutex_unlock(&backup_state.stat.lock);
 +
 err:
     l = di_list;
@@ -1076,11 +1102,42 @@ BackupStatus *qmp_query_backup(Error **errp)
     return info;
 }
 +PBSBitmapInfoList *qmp_query_pbs_bitmap_info(Error **errp)
 +{
 +    PBSBitmapInfoList *head = NULL, **p_next = &head;
 +
 +    qemu_mutex_lock(&backup_state.stat.lock);
 +
 +    GList *l = backup_state.stat.bitmap_list;
 +    while (l) {
 +        PBSBitmapInfo *info = (PBSBitmapInfo *)l->data;
 +        l = g_list_next(l);
 +
 +        /* clone bitmap info to avoid auto free after QMP marshalling */
 +        PBSBitmapInfo *info_ret = g_malloc0(sizeof(*info_ret));
 +        info_ret->drive = g_strdup(info->drive);
 +        info_ret->action = info->action;
 +        info_ret->size = info->size;
 +        info_ret->dirty = info->dirty;
 +
 +        PBSBitmapInfoList *info_list = g_malloc0(sizeof(*info_list));
 +        info_list->value = info_ret;
 +
 +        *p_next = info_list;
 +        p_next = &info_list->next;
 +    }
 +
 +    qemu_mutex_unlock(&backup_state.stat.lock);
 +
 +    return head;
 +}
 +
 ProxmoxSupportStatus *qmp_query_proxmox_support(Error **errp)
 {
     ProxmoxSupportStatus *ret = g_malloc0(sizeof(*ret));
     ret->pbs_library_version = g_strdup(proxmox_backup_qemu_version());
     ret->pbs_dirty_bitmap = true;
     ret->pbs_dirty_bitmap_savevm = true;
 +    ret->query_bitmap_info = true;
     return ret;
 }
 diff --git a/qapi/block-core.json b/qapi/block-core.json
 index 0b453c61d4..16e184dd28 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
@@ -871,6 +871,8 @@
 # @pbs-dirty-bitmap: True if dirty-bitmap-incremental backups to PBS are
 #                    supported.
 #
 +# @query-bitmap-info: True if the 'query-pbs-bitmap-info' QMP call is supported.
 +#
 # @pbs-dirty-bitmap-savevm: True if 'dirty-bitmaps' migration capability can
 #                           safely be set for savevm-async.
 #
@@ -879,6 +881,7 @@
 ##
 { 'struct': 'ProxmoxSupportStatus',
   'data': { 'pbs-dirty-bitmap': 'bool',
 +            'query-bitmap-info': 'bool',
             'pbs-dirty-bitmap-savevm': 'bool',
             'pbs-library-version': 'str' } }
@@ -892,6 +895,59 @@
 ##
 { 'command': 'query-proxmox-support', 'returns': 'ProxmoxSupportStatus' }
 +##
 +# @PBSBitmapAction:
 +#
 +# An action taken on a dirty-bitmap when a backup job was started.
 +#
 +# @not-used: Bitmap mode was not enabled.
 +#
 +# @not-used-removed: Bitmap mode was not enabled, but a bitmap from a
 +#                    previous backup still existed and was removed.
 +#
 +# @new: A new bitmap was attached to the drive for this backup.
 +#
 +# @used: An existing bitmap will be used to only backup changed data.
 +#
 +# @invalid: A bitmap existed, but had to be cleared since it's associated
 +#           base snapshot did not match the base given for the current job or
 +#           the crypt mode has changed.
 +#
 +##
 +{ 'enum': 'PBSBitmapAction',
 +  'data': ['not-used', 'not-used-removed', 'new', 'used', 'invalid'] }
 +
 +##
 +# @PBSBitmapInfo:
 +#
 +# Contains information about dirty bitmaps used for each drive in a PBS backup.
 +#
 +# @drive: The underlying drive.
 +#
 +# @action: The action that was taken when the backup started.
 +#
 +# @size: The total size of the drive.
 +#
 +# @dirty: How much of the drive is considered dirty and will be backed up,
 +#         or 'size' if everything will be.
 +#
 +##
 +{ 'struct': 'PBSBitmapInfo',
 +  'data': { 'drive': 'str', 'action': 'PBSBitmapAction', 'size': 'int',
 +            'dirty': 'int' } }
 +
 +##
 +# @query-pbs-bitmap-info:
 +#
 +# Returns information about dirty bitmaps used on the most recently started
 +# backup. Returns nothing when the last backup was not using PBS or if no
 +# backup occured in this session.
 +#
 +# Returns: @PBSBitmapInfo
 +#
 +##
 +{ 'command': 'query-pbs-bitmap-info', 'returns': ['PBSBitmapInfo'] }
 +
 ##
 # @BlockDeviceTimedStats:
 #
--- a/debian/patches/pve/0036-PVE-redirect-stderr-to-journal-when-daemonized.patch
+++ b/debian/patches/pve/0036-PVE-redirect-stderr-to-journal-when-daemonized.patch
@@ -9,15 +9,15 @@ fitting.
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
- meson.build | 3 ++-
+ meson.build | 2 ++
 os-posix.c  | 7 +++++--
- 2 files changed, 7 insertions(+), 3 deletions(-)
+ 2 files changed, 7 insertions(+), 2 deletions(-)
 diff --git a/meson.build b/meson.build
-index 7e6130cfdf..984f858bdc 100644
+index be4785e2f6..3fc7c8d435 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -2013,6 +2013,7 @@ endif
+@@ -1463,6 +1463,7 @@ keyutils = dependency('libkeyutils', required: false,
 has_gettid = cc.has_function('gettid')
 libuuid = cc.find_library('uuid', required: true)
@@ -25,29 +25,28 @@ index 7e6130cfdf..984f858bdc 100644
 libproxmox_backup_qemu = cc.find_library('proxmox_backup_qemu', required: true)
 # libselinux
-@@ -3597,7 +3598,7 @@ if have_block
+@@ -3105,6 +3106,7 @@ if have_block
-   if host_os == 'windows'
+   # os-posix.c contains POSIX-specific functions used by qemu-storage-daemon,
-     system_ss.add(files('os-win32.c'))
+   # os-win32.c does not
-   else
+   blockdev_ss.add(when: 'CONFIG_POSIX', if_true: files('os-posix.c'))
-    blockdev_ss.add(files('os-posix.c'))
+  blockdev_ss.add(when: 'CONFIG_POSIX', if_true: libsystemd)
-+    blockdev_ss.add(files('os-posix.c'), libsystemd)
+   softmmu_ss.add(when: 'CONFIG_WIN32', if_true: [files('os-win32.c')])
   endif
 endif
 diff --git a/os-posix.c b/os-posix.c
-index 43f9a43f3f..a47e46d1c2 100644
+index 321fc4bd13..b1870d2690 100644
 --- a/os-posix.c
 +++ b/os-posix.c
-@@ -29,6 +29,8 @@
+@@ -28,6 +28,8 @@
 #include <pwd.h>
 #include <grp.h>
 #include <libgen.h>
 +#include <systemd/sd-journal.h>
 +#include <syslog.h>
- #include "qemu/error-report.h"
+ /* Needed early for CONFIG_BSD etc. */
- #include "qemu/log.h"
+ #include "net/slirp.h"
-@@ -306,9 +308,10 @@ void os_setup_post(void)
+@@ -281,9 +283,10 @@ void os_setup_post(void)
         dup2(fd, 0);
         dup2(fd, 1);
--- a/debian/patches/pve/0037-PVE-Add-sequential-job-transaction-support.patch
+++ b/debian/patches/pve/0037-PVE-Add-sequential-job-transaction-support.patch
@@ -7,14 +7,14 @@ Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
 include/qemu/job.h | 12 ++++++++++++
- job.c              | 34 ++++++++++++++++++++++++++++++++++
+ job.c              | 31 +++++++++++++++++++++++++++++++
- 2 files changed, 46 insertions(+)
+ 2 files changed, 43 insertions(+)
 diff --git a/include/qemu/job.h b/include/qemu/job.h
-index 2b873f2576..528cd6acb9 100644
+index c105b31076..5096679571 100644
 --- a/include/qemu/job.h
 +++ b/include/qemu/job.h
-@@ -362,6 +362,18 @@ void job_unlock(void);
+@@ -316,6 +316,18 @@ typedef enum JobCreateFlags {
  */
 JobTxn *job_txn_new(void);
@@ -34,10 +34,10 @@ index 2b873f2576..528cd6acb9 100644
  * Release a reference that was previously acquired with job_txn_add_job or
  * job_txn_new. If it's the last reference to the object, it will be freed.
 diff --git a/job.c b/job.c
-index baf54c8d60..3ac5e5cde2 100644
+index e5699ad200..34c9758349 100644
 --- a/job.c
 +++ b/job.c
-@@ -94,6 +94,8 @@ struct JobTxn {
+@@ -72,6 +72,8 @@ struct JobTxn {
     /* Reference count */
     int refcnt;
@@ -45,8 +45,8 @@ index baf54c8d60..3ac5e5cde2 100644
 +    bool sequential;
 };
- void job_lock(void)
+ /* Right now, this mutex is only needed to synchronize accesses to job->busy
-@@ -119,6 +121,25 @@ JobTxn *job_txn_new(void)
+@@ -102,6 +104,25 @@ JobTxn *job_txn_new(void)
     return txn;
 }
@@ -69,23 +69,20 @@ index baf54c8d60..3ac5e5cde2 100644
 +    job_start(first);
 +}
 +
- /* Called with job_mutex held. */
+ static void job_txn_ref(JobTxn *txn)
 static void job_txn_ref_locked(JobTxn *txn)
 {
-@@ -1042,6 +1063,12 @@ static void job_completed_txn_success_locked(Job *job)
+     txn->refcnt++;
@@ -897,6 +918,9 @@ static void job_completed_txn_success(Job *job)
      */
     QLIST_FOREACH(other_job, &txn->jobs, txn_list) {
-         if (!job_is_completed_locked(other_job)) {
+         if (!job_is_completed(other_job)) {
 +            if (txn->sequential) {
 +                job_unlock();
 +                /* Needs to be called without holding the job lock */
 +                job_start(other_job);
 +                job_lock();
 +            }
             return;
         }
         assert(other_job->ret == 0);
-@@ -1253,6 +1280,13 @@ int job_finish_sync_locked(Job *job,
+@@ -1093,6 +1117,13 @@ int job_finish_sync(Job *job, void (*finish)(Job *, Error **errp), Error **errp)
         return -EBUSY;
     }
@@ -93,9 +90,9 @@ index baf54c8d60..3ac5e5cde2 100644
 +     * of cancelling, these have not begun work so job_enter won't do anything,
 +     * let's ensure they are marked as ABORTING if required */
 +    if (job->status == JOB_STATUS_CREATED && job->txn->sequential) {
-+        job_update_rc_locked(job);
+        job_update_rc(job);
 +    }
 +
-     job_unlock();
+     AIO_WAIT_WHILE(job->aio_context,
     AIO_WAIT_WHILE_UNLOCKED(job->aio_context,
                    (job_enter(job), !job_is_completed(job)));
--- a/debian/patches/pve/0038-PVE-Backup-Use-a-transaction-to-synchronize-job-stat.patch
+++ b/debian/patches/pve/0038-PVE-Backup-Use-a-transaction-to-synchronize-job-stat.patch
@@ -0,0 +1,295 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Stefan Reiter <s.reiter@proxmox.com>
 Date: Thu, 20 Aug 2020 14:25:00 +0200
 Subject: [PATCH] PVE-Backup: Use a transaction to synchronize job states
 By using a JobTxn, we can sync dirty bitmaps only when *all* jobs were
 successful - meaning we don't need to remove them when the backup fails,
 since QEMU's BITMAP_SYNC_MODE_ON_SUCCESS will now handle that for us.
 To keep the rate-limiting and IO impact from before, we use a sequential
 transaction, so drives will still be backed up one after the other.
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 [add new force parameter to job_cancel_sync calls]
 Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 ---
 pve-backup.c | 167 +++++++++++++++------------------------------------
 1 file changed, 49 insertions(+), 118 deletions(-)
 diff --git a/pve-backup.c b/pve-backup.c
 index f90abaa50a..63c686463f 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
@@ -52,6 +52,7 @@ static struct PVEBackupState {
     VmaWriter *vmaw;
     ProxmoxBackupHandle *pbs;
     GList *di_list;
 +    JobTxn *txn;
     QemuMutex backup_mutex;
     CoMutex dump_callback_mutex;
 } backup_state;
@@ -71,32 +72,12 @@ typedef struct PVEBackupDevInfo {
     size_t size;
     uint64_t block_size;
     uint8_t dev_id;
 -    bool completed;
     char targetfile[PATH_MAX];
     BdrvDirtyBitmap *bitmap;
     BlockDriverState *target;
 +    BlockJob *job;
 } PVEBackupDevInfo;
 -static void pvebackup_run_next_job(void);
 -
 -static BlockJob *
 -lookup_active_block_job(PVEBackupDevInfo *di)
 -{
 -    if (!di->completed && di->bs) {
 -        for (BlockJob *job = block_job_next(NULL); job; job = block_job_next(job)) {
 -            if (job->job.driver->job_type != JOB_TYPE_BACKUP) {
 -                continue;
 -            }
 -
 -            BackupBlockJob *bjob = container_of(job, BackupBlockJob, common);
 -            if (bjob && bjob->source_bs == di->bs) {
 -                return job;
 -            }
 -        }
 -    }
 -    return NULL;
 -}
 -
 static void pvebackup_propagate_error(Error *err)
 {
     qemu_mutex_lock(&backup_state.stat.lock);
@@ -272,18 +253,6 @@ static void coroutine_fn pvebackup_co_cleanup(void *unused)
             if (local_err != NULL) {
                 pvebackup_propagate_error(local_err);
             }
 -        } else {
 -            // on error or cancel we cannot ensure synchronization of dirty
 -            // bitmaps with backup server, so remove all and do full backup next
 -            GList *l = backup_state.di_list;
 -            while (l) {
 -                PVEBackupDevInfo *di = (PVEBackupDevInfo *)l->data;
 -                l = g_list_next(l);
 -
 -                if (di->bitmap) {
 -                    bdrv_release_dirty_bitmap(di->bitmap);
 -                }
 -            }
         }
         proxmox_backup_disconnect(backup_state.pbs);
@@ -322,8 +291,6 @@ static void pvebackup_complete_cb(void *opaque, int ret)
     qemu_mutex_lock(&backup_state.backup_mutex);
 -    di->completed = true;
 -
     if (ret < 0) {
         Error *local_err = NULL;
         error_setg(&local_err, "job failed with err %d - %s", ret, strerror(-ret));
@@ -336,20 +303,17 @@ static void pvebackup_complete_cb(void *opaque, int ret)
     block_on_coroutine_fn(pvebackup_complete_stream, di);
 -    // remove self from job queue
 +    // remove self from job list
     backup_state.di_list = g_list_remove(backup_state.di_list, di);
 -    if (di->bitmap && ret < 0) {
 -        // on error or cancel we cannot ensure synchronization of dirty
 -        // bitmaps with backup server, so remove all and do full backup next
 -        bdrv_release_dirty_bitmap(di->bitmap);
 -    }
 -
     g_free(di);
 -    qemu_mutex_unlock(&backup_state.backup_mutex);
 +    /* call cleanup if we're the last job */
 +    if (!g_list_first(backup_state.di_list)) {
 +        block_on_coroutine_fn(pvebackup_co_cleanup, NULL);
 +    }
 -    pvebackup_run_next_job();
 +    qemu_mutex_unlock(&backup_state.backup_mutex);
 }
 static void pvebackup_cancel(void)
@@ -371,36 +335,28 @@ static void pvebackup_cancel(void)
         proxmox_backup_abort(backup_state.pbs, "backup canceled");
     }
 -    qemu_mutex_unlock(&backup_state.backup_mutex);
 -
 -    for(;;) {
 -
 -        BlockJob *next_job = NULL;
 -
 -        qemu_mutex_lock(&backup_state.backup_mutex);
 -
 -        GList *l = backup_state.di_list;
 -        while (l) {
 -            PVEBackupDevInfo *di = (PVEBackupDevInfo *)l->data;
 -            l = g_list_next(l);
 +    /* it's enough to cancel one job in the transaction, the rest will follow
 +     * automatically */
 +    GList *bdi = g_list_first(backup_state.di_list);
 +    BlockJob *cancel_job = bdi && bdi->data ?
 +        ((PVEBackupDevInfo *)bdi->data)->job :
 +        NULL;
 -            BlockJob *job = lookup_active_block_job(di);
 -            if (job != NULL) {
 -                next_job = job;
 -                break;
 -            }
 -        }
 +    /* ref the job before releasing the mutex, just to be safe */
 +    if (cancel_job) {
 +        job_ref(&cancel_job->job);
 +    }
 -        qemu_mutex_unlock(&backup_state.backup_mutex);
 +    /* job_cancel_sync may enter the job, so we need to release the
 +     * backup_mutex to avoid deadlock */
 +    qemu_mutex_unlock(&backup_state.backup_mutex);
 -        if (next_job) {
 -            AioContext *aio_context = next_job->job.aio_context;
 -            aio_context_acquire(aio_context);
 -            job_cancel_sync(&next_job->job, true);
 -            aio_context_release(aio_context);
 -        } else {
 -            break;
 -        }
 +    if (cancel_job) {
 +        AioContext *aio_context = cancel_job->job.aio_context;
 +        aio_context_acquire(aio_context);
 +        job_cancel_sync(&cancel_job->job, true);
 +        job_unref(&cancel_job->job);
 +        aio_context_release(aio_context);
     }
 }
@@ -459,51 +415,19 @@ static int coroutine_fn pvebackup_co_add_config(
     goto out;
 }
 -bool job_should_pause(Job *job);
 -
 -static void pvebackup_run_next_job(void)
 -{
 -    assert(!qemu_in_coroutine());
 -
 -    qemu_mutex_lock(&backup_state.backup_mutex);
 -
 -    GList *l = backup_state.di_list;
 -    while (l) {
 -        PVEBackupDevInfo *di = (PVEBackupDevInfo *)l->data;
 -        l = g_list_next(l);
 -
 -        BlockJob *job = lookup_active_block_job(di);
 -
 -        if (job) {
 -            qemu_mutex_unlock(&backup_state.backup_mutex);
 -
 -            AioContext *aio_context = job->job.aio_context;
 -            aio_context_acquire(aio_context);
 -
 -            if (job_should_pause(&job->job)) {
 -                bool error_or_canceled = pvebackup_error_or_canceled();
 -                if (error_or_canceled) {
 -                    job_cancel_sync(&job->job, true);
 -                } else {
 -                    job_resume(&job->job);
 -                }
 -            }
 -            aio_context_release(aio_context);
 -            return;
 -        }
 -    }
 -
 -    block_on_coroutine_fn(pvebackup_co_cleanup, NULL); // no more jobs, run cleanup
 -
 -    qemu_mutex_unlock(&backup_state.backup_mutex);
 -}
 -
 static bool create_backup_jobs(void) {
     assert(!qemu_in_coroutine());
     Error *local_err = NULL;
 +    /* create job transaction to synchronize bitmap commit and cancel all
 +     * jobs in case one errors */
 +    if (backup_state.txn) {
 +        job_txn_unref(backup_state.txn);
 +    }
 +    backup_state.txn = job_txn_new_seq();
 +
     BackupPerf perf = { .max_workers = 16 };
     /* create and start all jobs (paused state) */
@@ -526,7 +450,7 @@ static bool create_backup_jobs(void) {
         BlockJob *job = backup_job_create(
             NULL, di->bs, di->target, backup_state.speed, sync_mode, di->bitmap,
             bitmap_mode, false, NULL, &perf, BLOCKDEV_ON_ERROR_REPORT, BLOCKDEV_ON_ERROR_REPORT,
 -            JOB_DEFAULT, pvebackup_complete_cb, di, NULL, &local_err);
 +            JOB_DEFAULT, pvebackup_complete_cb, di, backup_state.txn, &local_err);
         aio_context_release(aio_context);
@@ -538,7 +462,8 @@ static bool create_backup_jobs(void) {
             pvebackup_propagate_error(create_job_err);
             break;
         }
 -        job_start(&job->job);
 +
 +        di->job = job;
         bdrv_unref(di->target);
         di->target = NULL;
@@ -556,6 +481,10 @@ static bool create_backup_jobs(void) {
                 bdrv_unref(di->target);
                 di->target = NULL;
             }
 +
 +            if (di->job) {
 +                job_unref(&di->job->job);
 +            }
         }
     }
@@ -946,10 +875,6 @@ err:
         PVEBackupDevInfo *di = (PVEBackupDevInfo *)l->data;
         l = g_list_next(l);
 -        if (di->bitmap) {
 -            bdrv_release_dirty_bitmap(di->bitmap);
 -        }
 -
         if (di->target) {
             bdrv_unref(di->target);
         }
@@ -1038,9 +963,15 @@ UuidInfo *qmp_backup(
     block_on_coroutine_fn(pvebackup_co_prepare, &task);
     if (*errp == NULL) {
 -        create_backup_jobs();
 +        bool errors = create_backup_jobs();
         qemu_mutex_unlock(&backup_state.backup_mutex);
 -        pvebackup_run_next_job();
 +
 +        if (!errors) {
 +            /* start the first job in the transaction
 +             * note: this might directly enter the job, so we need to do this
 +             * after unlocking the backup_mutex */
 +            job_txn_start_seq(backup_state.txn);
 +        }
     } else {
         qemu_mutex_unlock(&backup_state.backup_mutex);
     }
--- a/debian/patches/pve/0039-PVE-Backup-Don-t-block-on-finishing-and-cleanup-crea.patch
+++ b/debian/patches/pve/0039-PVE-Backup-Don-t-block-on-finishing-and-cleanup-crea.patch
@@ -0,0 +1,503 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Stefan Reiter <s.reiter@proxmox.com>
 Date: Mon, 28 Sep 2020 13:40:51 +0200
 Subject: [PATCH] PVE-Backup: Don't block on finishing and cleanup
 create_backup_jobs
 proxmox_backup_co_finish is already async, but previously we would wait
 for the coroutine using block_on_coroutine_fn(). Avoid this by
 scheduling pvebackup_co_complete_stream (and thus pvebackup_co_cleanup)
 as a real coroutine when calling from pvebackup_complete_cb. This is ok,
 since complete_stream uses the backup_mutex internally to synchronize,
 and other streams can happily continue writing in the meantime anyway.
 To accomodate, backup_mutex is converted to a CoMutex. This means
 converting every user to a coroutine. This is not just useful here, but
 will come in handy once this series[0] is merged, and QMP calls can be
 yield-able coroutines too. Then we can also finally get rid of
 block_on_coroutine_fn.
 Cases of aio_context_acquire/release from within what is now a coroutine
 are changed to aio_co_reschedule_self, which works since a running
 coroutine always holds the aio lock for the context it is running in.
 job_cancel_sync is called from a BH since it can't be run from a
 coroutine (uses AIO_WAIT_WHILE internally).
 Same thing for create_backup_jobs, which is converted to a BH too.
 To communicate the finishing state, a new property is introduced to
 query-backup: 'finishing'. A new state is explicitly not used, since
 that would break compatibility with older qemu-server versions.
 Also fix create_backup_jobs:
 No more weird bool returns, just the standard "errp" format used
 everywhere else too. With this, if backup_job_create fails, the error
 message is actually returned over QMP and can be shown to the user.
 To facilitate correct cleanup on such an error, we call
 create_backup_jobs as a bottom half directly from pvebackup_co_prepare.
 This additionally allows us to actually hold the backup_mutex during
 operation.
 Also add a job_cancel_sync before job_unref, since a job must be in
 STATUS_NULL to be deleted by unref, which could trigger an assert
 before.
 [0] https://lists.gnu.org/archive/html/qemu-devel/2020-09/msg03515.html
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 [add new force parameter to job_cancel_sync calls]
 Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 ---
 pve-backup.c         | 217 ++++++++++++++++++++++++++++---------------
 qapi/block-core.json |   5 +-
 2 files changed, 144 insertions(+), 78 deletions(-)
 diff --git a/pve-backup.c b/pve-backup.c
 index 63c686463f..6f05796fad 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
@@ -33,7 +33,9 @@ const char *PBS_BITMAP_NAME = "pbs-incremental-dirty-bitmap";
 static struct PVEBackupState {
     struct {
 -        // Everithing accessed from qmp_backup_query command is protected using lock
 +        // Everything accessed from qmp_backup_query command is protected using
 +        // this lock. Do NOT hold this lock for long times, as it is sometimes
 +        // acquired from coroutines, and thus any wait time may block the guest.
         QemuMutex lock;
         Error *error;
         time_t start_time;
@@ -47,20 +49,22 @@ static struct PVEBackupState {
         size_t reused;
         size_t zero_bytes;
         GList *bitmap_list;
 +        bool finishing;
 +        bool starting;
     } stat;
     int64_t speed;
     VmaWriter *vmaw;
     ProxmoxBackupHandle *pbs;
     GList *di_list;
     JobTxn *txn;
 -    QemuMutex backup_mutex;
 +    CoMutex backup_mutex;
     CoMutex dump_callback_mutex;
 } backup_state;
 static void pvebackup_init(void)
 {
     qemu_mutex_init(&backup_state.stat.lock);
 -    qemu_mutex_init(&backup_state.backup_mutex);
 +    qemu_co_mutex_init(&backup_state.backup_mutex);
     qemu_co_mutex_init(&backup_state.dump_callback_mutex);
 }
@@ -72,6 +76,7 @@ typedef struct PVEBackupDevInfo {
     size_t size;
     uint64_t block_size;
     uint8_t dev_id;
 +    int completed_ret; // INT_MAX if not completed
     char targetfile[PATH_MAX];
     BdrvDirtyBitmap *bitmap;
     BlockDriverState *target;
@@ -227,12 +232,12 @@ pvebackup_co_dump_vma_cb(
 }
 // assumes the caller holds backup_mutex
 -static void coroutine_fn pvebackup_co_cleanup(void *unused)
 +static void coroutine_fn pvebackup_co_cleanup(void)
 {
     assert(qemu_in_coroutine());
     qemu_mutex_lock(&backup_state.stat.lock);
 -    backup_state.stat.end_time = time(NULL);
 +    backup_state.stat.finishing = true;
     qemu_mutex_unlock(&backup_state.stat.lock);
     if (backup_state.vmaw) {
@@ -261,35 +266,29 @@ static void coroutine_fn pvebackup_co_cleanup(void *unused)
     g_list_free(backup_state.di_list);
     backup_state.di_list = NULL;
 +
 +    qemu_mutex_lock(&backup_state.stat.lock);
 +    backup_state.stat.end_time = time(NULL);
 +    backup_state.stat.finishing = false;
 +    qemu_mutex_unlock(&backup_state.stat.lock);
 }
 -// assumes the caller holds backup_mutex
 -static void coroutine_fn pvebackup_complete_stream(void *opaque)
 +static void coroutine_fn pvebackup_co_complete_stream(void *opaque)
 {
     PVEBackupDevInfo *di = opaque;
 +    int ret = di->completed_ret;
 -    bool error_or_canceled = pvebackup_error_or_canceled();
 -
 -    if (backup_state.vmaw) {
 -        vma_writer_close_stream(backup_state.vmaw, di->dev_id);
 +    qemu_mutex_lock(&backup_state.stat.lock);
 +    bool starting = backup_state.stat.starting;
 +    qemu_mutex_unlock(&backup_state.stat.lock);
 +    if (starting) {
 +        /* in 'starting' state, no tasks have been run yet, meaning we can (and
 +         * must) skip all cleanup, as we don't know what has and hasn't been
 +         * initialized yet. */
 +        return;
     }
 -    if (backup_state.pbs && !error_or_canceled) {
 -        Error *local_err = NULL;
 -        proxmox_backup_co_close_image(backup_state.pbs, di->dev_id, &local_err);
 -        if (local_err != NULL) {
 -            pvebackup_propagate_error(local_err);
 -        }
 -    }
 -}
 -
 -static void pvebackup_complete_cb(void *opaque, int ret)
 -{
 -    assert(!qemu_in_coroutine());
 -
 -    PVEBackupDevInfo *di = opaque;
 -
 -    qemu_mutex_lock(&backup_state.backup_mutex);
 +    qemu_co_mutex_lock(&backup_state.backup_mutex);
     if (ret < 0) {
         Error *local_err = NULL;
@@ -301,7 +300,19 @@ static void pvebackup_complete_cb(void *opaque, int ret)
     assert(di->target == NULL);
 -    block_on_coroutine_fn(pvebackup_complete_stream, di);
 +    bool error_or_canceled = pvebackup_error_or_canceled();
 +
 +    if (backup_state.vmaw) {
 +        vma_writer_close_stream(backup_state.vmaw, di->dev_id);
 +    }
 +
 +    if (backup_state.pbs && !error_or_canceled) {
 +        Error *local_err = NULL;
 +        proxmox_backup_co_close_image(backup_state.pbs, di->dev_id, &local_err);
 +        if (local_err != NULL) {
 +            pvebackup_propagate_error(local_err);
 +        }
 +    }
     // remove self from job list
     backup_state.di_list = g_list_remove(backup_state.di_list, di);
@@ -310,21 +321,49 @@ static void pvebackup_complete_cb(void *opaque, int ret)
     /* call cleanup if we're the last job */
     if (!g_list_first(backup_state.di_list)) {
 -        block_on_coroutine_fn(pvebackup_co_cleanup, NULL);
 +        pvebackup_co_cleanup();
     }
 -    qemu_mutex_unlock(&backup_state.backup_mutex);
 +    qemu_co_mutex_unlock(&backup_state.backup_mutex);
 }
 -static void pvebackup_cancel(void)
 +static void pvebackup_complete_cb(void *opaque, int ret)
 {
 -    assert(!qemu_in_coroutine());
 +    PVEBackupDevInfo *di = opaque;
 +    di->completed_ret = ret;
 +
 +    /*
 +     * Schedule stream cleanup in async coroutine. close_image and finish might
 +     * take a while, so we can't block on them here. This way it also doesn't
 +     * matter if we're already running in a coroutine or not.
 +     * Note: di is a pointer to an entry in the global backup_state struct, so
 +     * it stays valid.
 +     */
 +    Coroutine *co = qemu_coroutine_create(pvebackup_co_complete_stream, di);
 +    aio_co_enter(qemu_get_aio_context(), co);
 +}
 +
 +/*
 + * job_cancel(_sync) does not like to be called from coroutines, so defer to
 + * main loop processing via a bottom half.
 + */
 +static void job_cancel_bh(void *opaque) {
 +    CoCtxData *data = (CoCtxData*)opaque;
 +    Job *job = (Job*)data->data;
 +    AioContext *job_ctx = job->aio_context;
 +    aio_context_acquire(job_ctx);
 +    job_cancel_sync(job, true);
 +    aio_context_release(job_ctx);
 +    aio_co_enter(data->ctx, data->co);
 +}
 +static void coroutine_fn pvebackup_co_cancel(void *opaque)
 +{
     Error *cancel_err = NULL;
     error_setg(&cancel_err, "backup canceled");
     pvebackup_propagate_error(cancel_err);
 -    qemu_mutex_lock(&backup_state.backup_mutex);
 +    qemu_co_mutex_lock(&backup_state.backup_mutex);
     if (backup_state.vmaw) {
         /* make sure vma writer does not block anymore */
@@ -342,27 +381,22 @@ static void pvebackup_cancel(void)
         ((PVEBackupDevInfo *)bdi->data)->job :
         NULL;
 -    /* ref the job before releasing the mutex, just to be safe */
     if (cancel_job) {
 -        job_ref(&cancel_job->job);
 +        CoCtxData data = {
 +            .ctx = qemu_get_current_aio_context(),
 +            .co = qemu_coroutine_self(),
 +            .data = &cancel_job->job,
 +        };
 +        aio_bh_schedule_oneshot(data.ctx, job_cancel_bh, &data);
 +        qemu_coroutine_yield();
     }
 -    /* job_cancel_sync may enter the job, so we need to release the
 -     * backup_mutex to avoid deadlock */
 -    qemu_mutex_unlock(&backup_state.backup_mutex);
 -
 -    if (cancel_job) {
 -        AioContext *aio_context = cancel_job->job.aio_context;
 -        aio_context_acquire(aio_context);
 -        job_cancel_sync(&cancel_job->job, true);
 -        job_unref(&cancel_job->job);
 -        aio_context_release(aio_context);
 -    }
 +    qemu_co_mutex_unlock(&backup_state.backup_mutex);
 }
 void qmp_backup_cancel(Error **errp)
 {
 -    pvebackup_cancel();
 +    block_on_coroutine_fn(pvebackup_co_cancel, NULL);
 }
 // assumes the caller holds backup_mutex
@@ -415,10 +449,18 @@ static int coroutine_fn pvebackup_co_add_config(
     goto out;
 }
 -static bool create_backup_jobs(void) {
 +/*
 + * backup_job_create can *not* be run from a coroutine (and requires an
 + * acquired AioContext), so this can't either.
 + * The caller is responsible that backup_mutex is held nonetheless.
 + */
 +static void create_backup_jobs_bh(void *opaque) {
     assert(!qemu_in_coroutine());
 +    CoCtxData *data = (CoCtxData*)opaque;
 +    Error **errp = (Error**)data->data;
 +
     Error *local_err = NULL;
     /* create job transaction to synchronize bitmap commit and cancel all
@@ -454,24 +496,19 @@ static bool create_backup_jobs(void) {
         aio_context_release(aio_context);
 -        if (!job || local_err != NULL) {
 -            Error *create_job_err = NULL;
 -            error_setg(&create_job_err, "backup_job_create failed: %s",
 -                       local_err ? error_get_pretty(local_err) : "null");
 +        di->job = job;
 -            pvebackup_propagate_error(create_job_err);
 +        if (!job || local_err) {
 +            error_setg(errp, "backup_job_create failed: %s",
 +                       local_err ? error_get_pretty(local_err) : "null");
             break;
         }
 -        di->job = job;
 -
         bdrv_unref(di->target);
         di->target = NULL;
     }
 -    bool errors = pvebackup_error_or_canceled();
 -
 -    if (errors) {
 +    if (*errp) {
         l = backup_state.di_list;
         while (l) {
             PVEBackupDevInfo *di = (PVEBackupDevInfo *)l->data;
@@ -483,12 +520,17 @@ static bool create_backup_jobs(void) {
             }
             if (di->job) {
 +                AioContext *ctx = di->job->job.aio_context;
 +                aio_context_acquire(ctx);
 +                job_cancel_sync(&di->job->job, true);
                 job_unref(&di->job->job);
 +                aio_context_release(ctx);
             }
         }
     }
 -    return errors;
 +    /* return */
 +    aio_co_enter(data->ctx, data->co);
 }
 typedef struct QmpBackupTask {
@@ -525,11 +567,12 @@ typedef struct QmpBackupTask {
     UuidInfo *result;
 } QmpBackupTask;
 -// assumes the caller holds backup_mutex
 static void coroutine_fn pvebackup_co_prepare(void *opaque)
 {
     assert(qemu_in_coroutine());
 +    qemu_co_mutex_lock(&backup_state.backup_mutex);
 +
     QmpBackupTask *task = opaque;
     task->result = NULL; // just to be sure
@@ -550,8 +593,9 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
     const char *firewall_name = "qemu-server.fw";
     if (backup_state.di_list) {
 -         error_set(task->errp, ERROR_CLASS_GENERIC_ERROR,
 +        error_set(task->errp, ERROR_CLASS_GENERIC_ERROR,
                   "previous backup not finished");
 +        qemu_co_mutex_unlock(&backup_state.backup_mutex);
         return;
     }
@@ -618,6 +662,8 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
         }
         di->size = size;
         total += size;
 +
 +        di->completed_ret = INT_MAX;
     }
     uuid_generate(uuid);
@@ -849,6 +895,8 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
     backup_state.stat.dirty = total - backup_state.stat.reused;
     backup_state.stat.transferred = 0;
     backup_state.stat.zero_bytes = 0;
 +    backup_state.stat.finishing = false;
 +    backup_state.stat.starting = true;
     qemu_mutex_unlock(&backup_state.stat.lock);
@@ -863,6 +911,33 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
     uuid_info->UUID = uuid_str;
     task->result = uuid_info;
 +
 +    /* Run create_backup_jobs_bh outside of coroutine (in BH) but keep
 +    * backup_mutex locked. This is fine, a CoMutex can be held across yield
 +    * points, and we'll release it as soon as the BH reschedules us.
 +    */
 +    CoCtxData waker = {
 +        .co = qemu_coroutine_self(),
 +        .ctx = qemu_get_current_aio_context(),
 +        .data = &local_err,
 +    };
 +    aio_bh_schedule_oneshot(waker.ctx, create_backup_jobs_bh, &waker);
 +    qemu_coroutine_yield();
 +
 +    if (local_err) {
 +        error_propagate(task->errp, local_err);
 +        goto err;
 +    }
 +
 +    qemu_co_mutex_unlock(&backup_state.backup_mutex);
 +
 +    qemu_mutex_lock(&backup_state.stat.lock);
 +    backup_state.stat.starting = false;
 +    qemu_mutex_unlock(&backup_state.stat.lock);
 +
 +    /* start the first job in the transaction */
 +    job_txn_start_seq(backup_state.txn);
 +
     return;
 err_mutex:
@@ -885,6 +960,7 @@ err:
         g_free(di);
     }
     g_list_free(di_list);
 +    backup_state.di_list = NULL;
     if (devs) {
         g_strfreev(devs);
@@ -905,6 +981,8 @@ err:
     }
     task->result = NULL;
 +
 +    qemu_co_mutex_unlock(&backup_state.backup_mutex);
     return;
 }
@@ -958,24 +1036,8 @@ UuidInfo *qmp_backup(
         .errp = errp,
     };
 -    qemu_mutex_lock(&backup_state.backup_mutex);
 -
     block_on_coroutine_fn(pvebackup_co_prepare, &task);
 -    if (*errp == NULL) {
 -        bool errors = create_backup_jobs();
 -        qemu_mutex_unlock(&backup_state.backup_mutex);
 -
 -        if (!errors) {
 -            /* start the first job in the transaction
 -             * note: this might directly enter the job, so we need to do this
 -             * after unlocking the backup_mutex */
 -            job_txn_start_seq(backup_state.txn);
 -        }
 -    } else {
 -        qemu_mutex_unlock(&backup_state.backup_mutex);
 -    }
 -
     return task.result;
 }
@@ -1027,6 +1089,7 @@ BackupStatus *qmp_query_backup(Error **errp)
     info->transferred = backup_state.stat.transferred;
     info->has_reused = true;
     info->reused = backup_state.stat.reused;
 +    info->finishing = backup_state.stat.finishing;
     qemu_mutex_unlock(&backup_state.stat.lock);
 diff --git a/qapi/block-core.json b/qapi/block-core.json
 index 16e184dd28..cb17d00fe0 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
@@ -770,12 +770,15 @@
 #
 # @uuid: uuid for this backup job
 #
 +# @finishing: if status='active' and finishing=true, then the backup process is
 +#             waiting for the target to finish.
 +#
 ##
 { 'struct': 'BackupStatus',
   'data': {'*status': 'str', '*errmsg': 'str', '*total': 'int', '*dirty': 'int',
            '*transferred': 'int', '*zero-bytes': 'int', '*reused': 'int',
            '*start-time': 'int', '*end-time': 'int',
 -           '*backup-file': 'str', '*uuid': 'str' } }
 +           '*backup-file': 'str', '*uuid': 'str', 'finishing': 'bool' } }
 ##
 # @BackupFormat:
--- a/debian/patches/pve/0040-PVE-Migrate-dirty-bitmap-state-via-savevm.patch
+++ b/debian/patches/pve/0040-PVE-Migrate-dirty-bitmap-state-via-savevm.patch
@@ -13,23 +13,21 @@ safe migration is possible and makes sense.
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 [FE: split up state_pending for 8.0]
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 include/migration/misc.h |   3 ++
 migration/meson.build    |   2 +
 migration/migration.c    |   1 +
- migration/pbs-state.c    | 104 +++++++++++++++++++++++++++++++++++++++
+ migration/pbs-state.c    | 106 +++++++++++++++++++++++++++++++++++++++
 pve-backup.c             |   1 +
 qapi/block-core.json     |   6 +++
- 6 files changed, 117 insertions(+)
+ 6 files changed, 119 insertions(+)
 create mode 100644 migration/pbs-state.c
 diff --git a/include/migration/misc.h b/include/migration/misc.h
-index bfadc5613b..e2e51fcf6b 100644
+index 465906710d..4f0aeceb6f 100644
 --- a/include/migration/misc.h
 +++ b/include/migration/misc.h
-@@ -111,4 +111,7 @@ bool migration_in_bg_snapshot(void);
+@@ -75,4 +75,7 @@ bool migration_in_bg_snapshot(void);
 /* migration/block-dirty-bitmap.c */
 void dirty_bitmap_mig_init(void);
@@ -38,43 +36,38 @@ index bfadc5613b..e2e51fcf6b 100644
 +
 #endif
 diff --git a/migration/meson.build b/migration/meson.build
-index 4b0c4f0f51..d039797132 100644
+index 0842d00cd2..d012f4d8d3 100644
 --- a/migration/meson.build
 +++ b/migration/meson.build
-@@ -8,6 +8,7 @@ migration_files = files(
+@@ -6,8 +6,10 @@ migration_files = files(
   'vmstate.c',
   'qemu-file.c',
   'yank_functions.c',
 )
 +system_ss.add(libproxmox_backup_qemu)
 system_ss.add(files(
   'block-dirty-bitmap.c',
@@ -25,6 +26,7 @@ system_ss.add(files(
   'multifd-zlib.c',
   'multifd-zero-page.c',
   'options.c',
 +  'pbs-state.c',
-   'postcopy-ram.c',
+ )
-   'savevm.c',
+ softmmu_ss.add(migration_files)
-   'savevm-async.c',
+softmmu_ss.add(libproxmox_backup_qemu)
 softmmu_ss.add(files(
   'block-dirty-bitmap.c',
 diff --git a/migration/migration.c b/migration/migration.c
-index ae2be31557..fab4c20ee4 100644
+index bb8bbddfe4..8109e468eb 100644
 --- a/migration/migration.c
 +++ b/migration/migration.c
-@@ -263,6 +263,7 @@ void migration_object_init(void)
+@@ -229,6 +229,7 @@ void migration_object_init(void)
- 
+     blk_mig_init();
     ram_mig_init();
     dirty_bitmap_mig_init();
 +    pbs_state_mig_init();
 }
- typedef struct {
+ void migration_cancel(const Error *error)
 diff --git a/migration/pbs-state.c b/migration/pbs-state.c
 new file mode 100644
-index 0000000000..a97187e4d7
+index 0000000000..29f2b3860d
 --- /dev/null
 +++ b/migration/pbs-state.c
-@@ -0,0 +1,104 @@
+@@ -0,0 +1,106 @@
 +/*
 + * PBS (dirty-bitmap) state migration
 + */
@@ -93,8 +86,11 @@ index 0000000000..a97187e4d7
 +/* state is accessed via this static variable directly, 'opaque' is NULL */
 +static PBSState pbs_state;
 +
-+static void pbs_state_pending(void *opaque, uint64_t *must_precopy,
+static void pbs_state_save_pending(QEMUFile *f, void *opaque,
-+                              uint64_t *can_postcopy)
+                                      uint64_t max_size,
 +                                      uint64_t *res_precopy_only,
 +                                      uint64_t *res_compatible,
 +                                      uint64_t *res_postcopy_only)
 +{
 +    /* we send everything in save_setup, so nothing is ever pending */
 +}
@@ -120,7 +116,7 @@ index 0000000000..a97187e4d7
 +}
 +
 +/* serialize PBS state and send to target via f, called on source */
-+static int pbs_state_save_setup(QEMUFile *f, void *opaque, Error **errp)
+static int pbs_state_save_setup(QEMUFile *f, void *opaque)
 +{
 +    size_t buf_size;
 +    uint8_t *buf = proxmox_export_state(&buf_size);
@@ -164,8 +160,7 @@ index 0000000000..a97187e4d7
 +static SaveVMHandlers savevm_pbs_state_handlers = {
 +    .save_setup = pbs_state_save_setup,
 +    .has_postcopy = pbs_state_has_postcopy,
-+    .state_pending_exact = pbs_state_pending,
+    .save_live_pending = pbs_state_save_pending,
 +    .state_pending_estimate = pbs_state_pending,
 +    .is_active_iterate = pbs_state_is_active_iterate,
 +    .load_state = pbs_state_load,
 +    .is_active = pbs_state_is_active,
@@ -180,22 +175,22 @@ index 0000000000..a97187e4d7
 +                         NULL);
 +}
 diff --git a/pve-backup.c b/pve-backup.c
-index 9f83ecb310..57477f7f2a 100644
+index 6f05796fad..5fa3cc1352 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
-@@ -1085,6 +1085,7 @@ ProxmoxSupportStatus *qmp_query_proxmox_support(Error **errp)
+@@ -1132,6 +1132,7 @@ ProxmoxSupportStatus *qmp_query_proxmox_support(Error **errp)
     ret->pbs_library_version = g_strdup(proxmox_backup_qemu_version());
     ret->pbs_dirty_bitmap = true;
     ret->pbs_dirty_bitmap_savevm = true;
 +    ret->pbs_dirty_bitmap_migration = true;
     ret->query_bitmap_info = true;
-     ret->pbs_masterkey = true;
+     return ret;
-     ret->backup_max_workers = true;
+ }
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index fe0eefcea6..521a1914e8 100644
+index cb17d00fe0..bd978ea562 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -1004,6 +1004,11 @@
+@@ -879,6 +879,11 @@
 # @pbs-dirty-bitmap-savevm: True if 'dirty-bitmaps' migration capability can
 #                           safely be set for savevm-async.
 #
@@ -204,14 +199,14 @@ index fe0eefcea6..521a1914e8 100644
 +#                              migration cap if this is false/unset may lead
 +#                              to crashes on migration!
 +#
- # @pbs-masterkey: True if the QMP backup call supports the 'master_keyfile'
+ # @pbs-library-version: Running version of libproxmox-backup-qemu0 library.
 #                 parameter.
 #
-@@ -1017,6 +1022,7 @@
+ ##
@@ -886,6 +891,7 @@
   'data': { 'pbs-dirty-bitmap': 'bool',
             'query-bitmap-info': 'bool',
             'pbs-dirty-bitmap-savevm': 'bool',
 +            'pbs-dirty-bitmap-migration': 'bool',
-             'pbs-masterkey': 'bool',
+             'pbs-library-version': 'str' } }
-             'pbs-library-version': 'str',
+ 
-             'backup-max-workers': 'bool' } }
+ ##
--- a/debian/patches/pve/0041-migration-block-dirty-bitmap-migrate-other-bitmaps-e.patch
+++ b/debian/patches/pve/0041-migration-block-dirty-bitmap-migrate-other-bitmaps-e.patch
@@ -15,21 +15,18 @@ transferred.
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
- migration/block-dirty-bitmap.c | 5 ++++-
+ migration/block-dirty-bitmap.c | 2 +-
- 1 file changed, 4 insertions(+), 1 deletion(-)
+ 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/migration/block-dirty-bitmap.c b/migration/block-dirty-bitmap.c
-index a7d55048c2..77346a5fa2 100644
+index 9aba7d9c22..f4ecf9c9f9 100644
 --- a/migration/block-dirty-bitmap.c
 +++ b/migration/block-dirty-bitmap.c
-@@ -539,7 +539,10 @@ static int add_bitmaps_to_list(DBMSaveState *s, BlockDriverState *bs,
+@@ -538,7 +538,7 @@ static int add_bitmaps_to_list(DBMSaveState *s, BlockDriverState *bs,
         }
-         if (bdrv_dirty_bitmap_check(bitmap, BDRV_BITMAP_DEFAULT, errp)) {
+         if (bdrv_dirty_bitmap_check(bitmap, BDRV_BITMAP_DEFAULT, &local_err)) {
             error_report_err(local_err);
 -            return -1;
 +            if (errp != NULL) {
 +                error_report_err(*errp);
 +            }
 +            continue;
         }
--- a/debian/patches/pve/0042-PVE-fall-back-to-open-iscsi-initiatorname.patch
+++ b/debian/patches/pve/0042-PVE-fall-back-to-open-iscsi-initiatorname.patch
@@ -21,10 +21,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 1 file changed, 30 insertions(+)
 diff --git a/block/iscsi.c b/block/iscsi.c
-index 979bf90cb7..961714a4be 100644
+index d707d0b354..da6ed52323 100644
 --- a/block/iscsi.c
 +++ b/block/iscsi.c
-@@ -1392,12 +1392,42 @@ static char *get_initiator_name(QemuOpts *opts)
+@@ -1386,12 +1386,42 @@ static char *get_initiator_name(QemuOpts *opts)
     const char *name;
     char *iscsi_name;
     UuidInfo *uuid_info;
--- a/debian/patches/pve/0042-alloc-track-error-out-when-auto-remove-is-not-set.patch
+++ b/debian/patches/pve/0042-alloc-track-error-out-when-auto-remove-is-not-set.patch
@@ -1,43 +0,0 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Fiona Ebner <f.ebner@proxmox.com>
 Date: Tue, 26 Mar 2024 14:57:51 +0100
 Subject: [PATCH] alloc-track: error out when auto-remove is not set
 Since replacing the node now happens in the stream job, where the
 option cannot be read from (it's internal to the driver), it will
 always be treated as on.
 qemu-server will always set it, make sure to have other users notice
 the change (should they even exist). The option can be fully dropped
 in the future while adding a version guard in qemu-server.
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 block/alloc-track.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)
 diff --git a/block/alloc-track.c b/block/alloc-track.c
 index b4a9851144..fc7d58a5d0 100644
 --- a/block/alloc-track.c
 +++ b/block/alloc-track.c
@@ -34,7 +34,6 @@ typedef struct {
     BdrvDirtyBitmap *bitmap;
     uint64_t granularity;
     DropState drop_state;
 -    bool auto_remove;
 } BDRVAllocTrackState;
 static QemuOptsList runtime_opts = {
@@ -86,7 +85,11 @@ static int track_open(BlockDriverState *bs, QDict *options, int flags,
         goto fail;
     }
 -    s->auto_remove = qemu_opt_get_bool(opts, TRACK_OPT_AUTO_REMOVE, false);
 +    if (!qemu_opt_get_bool(opts, TRACK_OPT_AUTO_REMOVE, false)) {
 +        error_setg(errp, "alloc-track: requires auto-remove option to be set to on");
 +        ret = -EINVAL;
 +        goto fail;
 +    }
     /* open the target (write) node, backing will be attached by block layer */
     file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
--- a/debian/patches/pve/0043-PVE-Use-coroutine-QMP-for-backup-cancel_backup.patch
+++ b/debian/patches/pve/0043-PVE-Use-coroutine-QMP-for-backup-cancel_backup.patch
@@ -0,0 +1,598 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Stefan Reiter <s.reiter@proxmox.com>
 Date: Tue, 26 Jan 2021 15:45:30 +0100
 Subject: [PATCH] PVE: Use coroutine QMP for backup/cancel_backup
 Finally turn backup QMP calls into coroutines, now that it's possible.
 This has the benefit that calls are asynchronous to the main loop, i.e.
 long running operations like connecting to a PBS server will no longer
 hang the VM.
 Additionally, it allows us to get rid of block_on_coroutine_fn, which
 was always a hacky workaround.
 While we're already spring cleaning, also remove the QmpBackupTask
 struct, since we can now put the 'prepare' function directly into
 qmp_backup and thus no longer need those giant walls of text.
 (Note that for our patches to work with 5.2.0 this change is actually
 required, otherwise monitor_get_fd() fails as we're not in a QMP
 coroutine, but one we start ourselves - we could of course set the
 monitor for that coroutine ourselves, but let's just fix it the right
 way instead)
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
 block/monitor/block-hmp-cmds.c |   4 +-
 hmp-commands.hx                |   2 +
 proxmox-backup-client.c        |  31 -----
 pve-backup.c                   | 232 ++++++++++-----------------------
 qapi/block-core.json           |   4 +-
 5 files changed, 77 insertions(+), 196 deletions(-)
 diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
 index ea7b665aa2..ef45552e3b 100644
 --- a/block/monitor/block-hmp-cmds.c
 +++ b/block/monitor/block-hmp-cmds.c
@@ -1016,7 +1016,7 @@ void hmp_info_snapshots(Monitor *mon, const QDict *qdict)
     g_free(global_snapshots);
 }
 -void hmp_backup_cancel(Monitor *mon, const QDict *qdict)
 +void coroutine_fn hmp_backup_cancel(Monitor *mon, const QDict *qdict)
 {
     Error *error = NULL;
@@ -1025,7 +1025,7 @@ void hmp_backup_cancel(Monitor *mon, const QDict *qdict)
     hmp_handle_error(mon, error);
 }
 -void hmp_backup(Monitor *mon, const QDict *qdict)
 +void coroutine_fn hmp_backup(Monitor *mon, const QDict *qdict)
 {
     Error *error = NULL;
 diff --git a/hmp-commands.hx b/hmp-commands.hx
 index 97f24942b3..7a2be816da 100644
 --- a/hmp-commands.hx
 +++ b/hmp-commands.hx
@@ -111,6 +111,7 @@ ERST
 		    "\n\t\t\t Use -d to dump data into a directory instead"
 		    "\n\t\t\t of using VMA format.",
         .cmd = hmp_backup,
 +        .coroutine  = true,
     },
 SRST
@@ -124,6 +125,7 @@ ERST
         .params     = "",
         .help       = "cancel the current VM backup",
         .cmd        = hmp_backup_cancel,
 +        .coroutine  = true,
     },
 SRST
 diff --git a/proxmox-backup-client.c b/proxmox-backup-client.c
 index 4ce7bc0b5e..0923037dec 100644
 --- a/proxmox-backup-client.c
 +++ b/proxmox-backup-client.c
@@ -5,37 +5,6 @@
 /* Proxmox Backup Server client bindings using coroutines */
 -typedef struct BlockOnCoroutineWrapper {
 -    AioContext *ctx;
 -    CoroutineEntry *entry;
 -    void *entry_arg;
 -    bool finished;
 -} BlockOnCoroutineWrapper;
 -
 -static void coroutine_fn block_on_coroutine_wrapper(void *opaque)
 -{
 -    BlockOnCoroutineWrapper *wrapper = opaque;
 -    wrapper->entry(wrapper->entry_arg);
 -    wrapper->finished = true;
 -    aio_wait_kick();
 -}
 -
 -void block_on_coroutine_fn(CoroutineEntry *entry, void *entry_arg)
 -{
 -    assert(!qemu_in_coroutine());
 -
 -    AioContext *ctx = qemu_get_current_aio_context();
 -    BlockOnCoroutineWrapper wrapper = {
 -        .finished = false,
 -        .entry = entry,
 -        .entry_arg = entry_arg,
 -        .ctx = ctx,
 -    };
 -    Coroutine *wrapper_co = qemu_coroutine_create(block_on_coroutine_wrapper, &wrapper);
 -    aio_co_enter(ctx, wrapper_co);
 -    AIO_WAIT_WHILE(ctx, !wrapper.finished);
 -}
 -
 // This is called from another thread, so we use aio_co_schedule()
 static void proxmox_backup_schedule_wake(void *data) {
     CoCtxData *waker = (CoCtxData *)data;
 diff --git a/pve-backup.c b/pve-backup.c
 index 5fa3cc1352..323014744c 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
@@ -357,7 +357,7 @@ static void job_cancel_bh(void *opaque) {
     aio_co_enter(data->ctx, data->co);
 }
 -static void coroutine_fn pvebackup_co_cancel(void *opaque)
 +void coroutine_fn qmp_backup_cancel(Error **errp)
 {
     Error *cancel_err = NULL;
     error_setg(&cancel_err, "backup canceled");
@@ -394,11 +394,6 @@ static void coroutine_fn pvebackup_co_cancel(void *opaque)
     qemu_co_mutex_unlock(&backup_state.backup_mutex);
 }
 -void qmp_backup_cancel(Error **errp)
 -{
 -    block_on_coroutine_fn(pvebackup_co_cancel, NULL);
 -}
 -
 // assumes the caller holds backup_mutex
 static int coroutine_fn pvebackup_co_add_config(
     const char *file,
@@ -533,50 +528,27 @@ static void create_backup_jobs_bh(void *opaque) {
     aio_co_enter(data->ctx, data->co);
 }
 -typedef struct QmpBackupTask {
 -    const char *backup_file;
 -    bool has_password;
 -    const char *password;
 -    bool has_keyfile;
 -    const char *keyfile;
 -    bool has_key_password;
 -    const char *key_password;
 -    bool has_backup_id;
 -    const char *backup_id;
 -    bool has_backup_time;
 -    const char *fingerprint;
 -    bool has_fingerprint;
 -    int64_t backup_time;
 -    bool has_use_dirty_bitmap;
 -    bool use_dirty_bitmap;
 -    bool has_format;
 -    BackupFormat format;
 -    bool has_config_file;
 -    const char *config_file;
 -    bool has_firewall_file;
 -    const char *firewall_file;
 -    bool has_devlist;
 -    const char *devlist;
 -    bool has_compress;
 -    bool compress;
 -    bool has_encrypt;
 -    bool encrypt;
 -    bool has_speed;
 -    int64_t speed;
 -    Error **errp;
 -    UuidInfo *result;
 -} QmpBackupTask;
 -
 -static void coroutine_fn pvebackup_co_prepare(void *opaque)
 +UuidInfo coroutine_fn *qmp_backup(
 +    const char *backup_file,
 +    bool has_password, const char *password,
 +    bool has_keyfile, const char *keyfile,
 +    bool has_key_password, const char *key_password,
 +    bool has_fingerprint, const char *fingerprint,
 +    bool has_backup_id, const char *backup_id,
 +    bool has_backup_time, int64_t backup_time,
 +    bool has_use_dirty_bitmap, bool use_dirty_bitmap,
 +    bool has_compress, bool compress,
 +    bool has_encrypt, bool encrypt,
 +    bool has_format, BackupFormat format,
 +    bool has_config_file, const char *config_file,
 +    bool has_firewall_file, const char *firewall_file,
 +    bool has_devlist, const char *devlist,
 +    bool has_speed, int64_t speed, Error **errp)
 {
     assert(qemu_in_coroutine());
     qemu_co_mutex_lock(&backup_state.backup_mutex);
 -    QmpBackupTask *task = opaque;
 -
 -    task->result = NULL; // just to be sure
 -
     BlockBackend *blk;
     BlockDriverState *bs = NULL;
     const char *backup_dir = NULL;
@@ -593,17 +565,17 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
     const char *firewall_name = "qemu-server.fw";
     if (backup_state.di_list) {
 -        error_set(task->errp, ERROR_CLASS_GENERIC_ERROR,
 +        error_set(errp, ERROR_CLASS_GENERIC_ERROR,
                   "previous backup not finished");
         qemu_co_mutex_unlock(&backup_state.backup_mutex);
 -        return;
 +        return NULL;
     }
     /* Todo: try to auto-detect format based on file name */
 -    BackupFormat format = task->has_format ? task->format : BACKUP_FORMAT_VMA;
 +    format = has_format ? format : BACKUP_FORMAT_VMA;
 -    if (task->has_devlist) {
 -        devs = g_strsplit_set(task->devlist, ",;:", -1);
 +    if (has_devlist) {
 +        devs = g_strsplit_set(devlist, ",;:", -1);
         gchar **d = devs;
         while (d && *d) {
@@ -611,14 +583,14 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
             if (blk) {
                 bs = blk_bs(blk);
                 if (!bdrv_is_inserted(bs)) {
 -                    error_setg(task->errp, QERR_DEVICE_HAS_NO_MEDIUM, *d);
 +                    error_setg(errp, QERR_DEVICE_HAS_NO_MEDIUM, *d);
                     goto err;
                 }
                 PVEBackupDevInfo *di = g_new0(PVEBackupDevInfo, 1);
                 di->bs = bs;
                 di_list = g_list_append(di_list, di);
             } else {
 -                error_set(task->errp, ERROR_CLASS_DEVICE_NOT_FOUND,
 +                error_set(errp, ERROR_CLASS_DEVICE_NOT_FOUND,
                           "Device '%s' not found", *d);
                 goto err;
             }
@@ -641,7 +613,7 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
     }
     if (!di_list) {
 -        error_set(task->errp, ERROR_CLASS_GENERIC_ERROR, "empty device list");
 +        error_set(errp, ERROR_CLASS_GENERIC_ERROR, "empty device list");
         goto err;
     }
@@ -651,13 +623,13 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
     while (l) {
         PVEBackupDevInfo *di = (PVEBackupDevInfo *)l->data;
         l = g_list_next(l);
 -        if (bdrv_op_is_blocked(di->bs, BLOCK_OP_TYPE_BACKUP_SOURCE, task->errp)) {
 +        if (bdrv_op_is_blocked(di->bs, BLOCK_OP_TYPE_BACKUP_SOURCE, errp)) {
             goto err;
         }
         ssize_t size = bdrv_getlength(di->bs);
         if (size < 0) {
 -            error_setg_errno(task->errp, -di->size, "bdrv_getlength failed");
 +            error_setg_errno(errp, -di->size, "bdrv_getlength failed");
             goto err;
         }
         di->size = size;
@@ -684,47 +656,44 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
     }
     if (format == BACKUP_FORMAT_PBS) {
 -        if (!task->has_password) {
 -            error_set(task->errp, ERROR_CLASS_GENERIC_ERROR, "missing parameter 'password'");
 +        if (!has_password) {
 +            error_set(errp, ERROR_CLASS_GENERIC_ERROR, "missing parameter 'password'");
             goto err_mutex;
         }
 -        if (!task->has_backup_id) {
 -            error_set(task->errp, ERROR_CLASS_GENERIC_ERROR, "missing parameter 'backup-id'");
 +        if (!has_backup_id) {
 +            error_set(errp, ERROR_CLASS_GENERIC_ERROR, "missing parameter 'backup-id'");
             goto err_mutex;
         }
 -        if (!task->has_backup_time) {
 -            error_set(task->errp, ERROR_CLASS_GENERIC_ERROR, "missing parameter 'backup-time'");
 +        if (!has_backup_time) {
 +            error_set(errp, ERROR_CLASS_GENERIC_ERROR, "missing parameter 'backup-time'");
             goto err_mutex;
         }
         int dump_cb_block_size = PROXMOX_BACKUP_DEFAULT_CHUNK_SIZE; // Hardcoded (4M)
         firewall_name = "fw.conf";
 -        bool use_dirty_bitmap = task->has_use_dirty_bitmap && task->use_dirty_bitmap;
 -
 -
         char *pbs_err = NULL;
         pbs = proxmox_backup_new(
 -            task->backup_file,
 -            task->backup_id,
 -            task->backup_time,
 +            backup_file,
 +            backup_id,
 +            backup_time,
             dump_cb_block_size,
 -            task->has_password ? task->password : NULL,
 -            task->has_keyfile ? task->keyfile : NULL,
 -            task->has_key_password ? task->key_password : NULL,
 -            task->has_compress ? task->compress : true,
 -            task->has_encrypt ? task->encrypt : task->has_keyfile,
 -            task->has_fingerprint ? task->fingerprint : NULL,
 +            has_password ? password : NULL,
 +            has_keyfile ? keyfile : NULL,
 +            has_key_password ? key_password : NULL,
 +            has_compress ? compress : true,
 +            has_encrypt ? encrypt : has_keyfile,
 +            has_fingerprint ? fingerprint : NULL,
              &pbs_err);
         if (!pbs) {
 -            error_set(task->errp, ERROR_CLASS_GENERIC_ERROR,
 +            error_set(errp, ERROR_CLASS_GENERIC_ERROR,
                       "proxmox_backup_new failed: %s", pbs_err);
             proxmox_backup_free_error(pbs_err);
             goto err_mutex;
         }
 -        int connect_result = proxmox_backup_co_connect(pbs, task->errp);
 +        int connect_result = proxmox_backup_co_connect(pbs, errp);
         if (connect_result < 0)
             goto err_mutex;
@@ -743,9 +712,9 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
             BdrvDirtyBitmap *bitmap = bdrv_find_dirty_bitmap(di->bs, PBS_BITMAP_NAME);
             bool expect_only_dirty = false;
 -            if (use_dirty_bitmap) {
 +            if (has_use_dirty_bitmap && use_dirty_bitmap) {
                 if (bitmap == NULL) {
 -                    bitmap = bdrv_create_dirty_bitmap(di->bs, dump_cb_block_size, PBS_BITMAP_NAME, task->errp);
 +                    bitmap = bdrv_create_dirty_bitmap(di->bs, dump_cb_block_size, PBS_BITMAP_NAME, errp);
                     if (!bitmap) {
                         goto err_mutex;
                     }
@@ -775,12 +744,12 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
                 }
             }
 -            int dev_id = proxmox_backup_co_register_image(pbs, devname, di->size, expect_only_dirty, task->errp);
 +            int dev_id = proxmox_backup_co_register_image(pbs, devname, di->size, expect_only_dirty, errp);
             if (dev_id < 0) {
                 goto err_mutex;
             }
 -            if (!(di->target = bdrv_backup_dump_create(dump_cb_block_size, di->size, pvebackup_co_dump_pbs_cb, di, task->errp))) {
 +            if (!(di->target = bdrv_backup_dump_create(dump_cb_block_size, di->size, pvebackup_co_dump_pbs_cb, di, errp))) {
                 goto err_mutex;
             }
@@ -794,10 +763,10 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
             backup_state.stat.bitmap_list = g_list_append(backup_state.stat.bitmap_list, info);
         }
     } else if (format == BACKUP_FORMAT_VMA) {
 -        vmaw = vma_writer_create(task->backup_file, uuid, &local_err);
 +        vmaw = vma_writer_create(backup_file, uuid, &local_err);
         if (!vmaw) {
             if (local_err) {
 -                error_propagate(task->errp, local_err);
 +                error_propagate(errp, local_err);
             }
             goto err_mutex;
         }
@@ -808,25 +777,25 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
             PVEBackupDevInfo *di = (PVEBackupDevInfo *)l->data;
             l = g_list_next(l);
 -            if (!(di->target = bdrv_backup_dump_create(VMA_CLUSTER_SIZE, di->size, pvebackup_co_dump_vma_cb, di, task->errp))) {
 +            if (!(di->target = bdrv_backup_dump_create(VMA_CLUSTER_SIZE, di->size, pvebackup_co_dump_vma_cb, di, errp))) {
                 goto err_mutex;
             }
             const char *devname = bdrv_get_device_name(di->bs);
             di->dev_id = vma_writer_register_stream(vmaw, devname, di->size);
             if (di->dev_id <= 0) {
 -                error_set(task->errp, ERROR_CLASS_GENERIC_ERROR,
 +                error_set(errp, ERROR_CLASS_GENERIC_ERROR,
                           "register_stream failed");
                 goto err_mutex;
             }
         }
     } else if (format == BACKUP_FORMAT_DIR) {
 -        if (mkdir(task->backup_file, 0640) != 0) {
 -            error_setg_errno(task->errp, errno, "can't create directory '%s'\n",
 -                             task->backup_file);
 +        if (mkdir(backup_file, 0640) != 0) {
 +            error_setg_errno(errp, errno, "can't create directory '%s'\n",
 +                             backup_file);
             goto err_mutex;
         }
 -        backup_dir = task->backup_file;
 +        backup_dir = backup_file;
         l = di_list;
         while (l) {
@@ -840,34 +809,34 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
             bdrv_img_create(di->targetfile, "raw", NULL, NULL, NULL,
                             di->size, flags, false, &local_err);
             if (local_err) {
 -                error_propagate(task->errp, local_err);
 +                error_propagate(errp, local_err);
                 goto err_mutex;
             }
             di->target = bdrv_open(di->targetfile, NULL, NULL, flags, &local_err);
             if (!di->target) {
 -                error_propagate(task->errp, local_err);
 +                error_propagate(errp, local_err);
                 goto err_mutex;
             }
         }
     } else {
 -        error_set(task->errp, ERROR_CLASS_GENERIC_ERROR, "unknown backup format");
 +        error_set(errp, ERROR_CLASS_GENERIC_ERROR, "unknown backup format");
         goto err_mutex;
     }
     /* add configuration file to archive */
 -    if (task->has_config_file) {
 -        if (pvebackup_co_add_config(task->config_file, config_name, format, backup_dir,
 -                                    vmaw, pbs, task->errp) != 0) {
 +    if (has_config_file) {
 +        if (pvebackup_co_add_config(config_file, config_name, format, backup_dir,
 +                                    vmaw, pbs, errp) != 0) {
             goto err_mutex;
         }
     }
     /* add firewall file to archive */
 -    if (task->has_firewall_file) {
 -        if (pvebackup_co_add_config(task->firewall_file, firewall_name, format, backup_dir,
 -                                    vmaw, pbs, task->errp) != 0) {
 +    if (has_firewall_file) {
 +        if (pvebackup_co_add_config(firewall_file, firewall_name, format, backup_dir,
 +                                    vmaw, pbs, errp) != 0) {
             goto err_mutex;
         }
     }
@@ -885,7 +854,7 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
     if (backup_state.stat.backup_file) {
         g_free(backup_state.stat.backup_file);
     }
 -    backup_state.stat.backup_file = g_strdup(task->backup_file);
 +    backup_state.stat.backup_file = g_strdup(backup_file);
     uuid_copy(backup_state.stat.uuid, uuid);
     uuid_unparse_lower(uuid, backup_state.stat.uuid_str);
@@ -900,7 +869,7 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
     qemu_mutex_unlock(&backup_state.stat.lock);
 -    backup_state.speed = (task->has_speed && task->speed > 0) ? task->speed : 0;
 +    backup_state.speed = (has_speed && speed > 0) ? speed : 0;
     backup_state.vmaw = vmaw;
     backup_state.pbs = pbs;
@@ -910,8 +879,6 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
     uuid_info = g_malloc0(sizeof(*uuid_info));
     uuid_info->UUID = uuid_str;
 -    task->result = uuid_info;
 -
     /* Run create_backup_jobs_bh outside of coroutine (in BH) but keep
     * backup_mutex locked. This is fine, a CoMutex can be held across yield
     * points, and we'll release it as soon as the BH reschedules us.
@@ -925,7 +892,7 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
     qemu_coroutine_yield();
     if (local_err) {
 -        error_propagate(task->errp, local_err);
 +        error_propagate(errp, local_err);
         goto err;
     }
@@ -938,7 +905,7 @@ static void coroutine_fn pvebackup_co_prepare(void *opaque)
     /* start the first job in the transaction */
     job_txn_start_seq(backup_state.txn);
 -    return;
 +    return uuid_info;
 err_mutex:
     qemu_mutex_unlock(&backup_state.stat.lock);
@@ -969,7 +936,7 @@ err:
     if (vmaw) {
         Error *err = NULL;
         vma_writer_close(vmaw, &err);
 -        unlink(task->backup_file);
 +        unlink(backup_file);
     }
     if (pbs) {
@@ -980,65 +947,8 @@ err:
         rmdir(backup_dir);
     }
 -    task->result = NULL;
 -
     qemu_co_mutex_unlock(&backup_state.backup_mutex);
 -    return;
 -}
 -
 -UuidInfo *qmp_backup(
 -    const char *backup_file,
 -    bool has_password, const char *password,
 -    bool has_keyfile, const char *keyfile,
 -    bool has_key_password, const char *key_password,
 -    bool has_fingerprint, const char *fingerprint,
 -    bool has_backup_id, const char *backup_id,
 -    bool has_backup_time, int64_t backup_time,
 -    bool has_use_dirty_bitmap, bool use_dirty_bitmap,
 -    bool has_compress, bool compress,
 -    bool has_encrypt, bool encrypt,
 -    bool has_format, BackupFormat format,
 -    bool has_config_file, const char *config_file,
 -    bool has_firewall_file, const char *firewall_file,
 -    bool has_devlist, const char *devlist,
 -    bool has_speed, int64_t speed, Error **errp)
 -{
 -    QmpBackupTask task = {
 -        .backup_file = backup_file,
 -        .has_password = has_password,
 -        .password = password,
 -        .has_keyfile = has_keyfile,
 -        .keyfile = keyfile,
 -        .has_key_password = has_key_password,
 -        .key_password = key_password,
 -        .has_fingerprint = has_fingerprint,
 -        .fingerprint = fingerprint,
 -        .has_backup_id = has_backup_id,
 -        .backup_id = backup_id,
 -        .has_backup_time = has_backup_time,
 -        .backup_time = backup_time,
 -        .has_use_dirty_bitmap = has_use_dirty_bitmap,
 -        .use_dirty_bitmap = use_dirty_bitmap,
 -        .has_compress = has_compress,
 -        .compress = compress,
 -        .has_encrypt = has_encrypt,
 -        .encrypt = encrypt,
 -        .has_format = has_format,
 -        .format = format,
 -        .has_config_file = has_config_file,
 -        .config_file = config_file,
 -        .has_firewall_file = has_firewall_file,
 -        .firewall_file = firewall_file,
 -        .has_devlist = has_devlist,
 -        .devlist = devlist,
 -        .has_speed = has_speed,
 -        .speed = speed,
 -        .errp = errp,
 -    };
 -
 -    block_on_coroutine_fn(pvebackup_co_prepare, &task);
 -
 -    return task.result;
 +    return NULL;
 }
 BackupStatus *qmp_query_backup(Error **errp)
 diff --git a/qapi/block-core.json b/qapi/block-core.json
 index bd978ea562..ca1966f54b 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
@@ -842,7 +842,7 @@
                                     '*config-file': 'str',
                                     '*firewall-file': 'str',
                                     '*devlist': 'str', '*speed': 'int' },
 -  'returns': 'UuidInfo' }
 +  'returns': 'UuidInfo', 'coroutine': true }
 ##
 # @query-backup:
@@ -864,7 +864,7 @@
 # Notes: This command succeeds even if there is no backup process running.
 #
 ##
 -{ 'command': 'backup-cancel' }
 +{ 'command': 'backup-cancel', 'coroutine': true }
 ##
 # @ProxmoxSupportStatus:
--- a/debian/patches/pve/0043-alloc-track-avoid-seemingly-superfluous-child-permis.patch
+++ b/debian/patches/pve/0043-alloc-track-avoid-seemingly-superfluous-child-permis.patch
@@ -1,84 +0,0 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Fiona Ebner <f.ebner@proxmox.com>
 Date: Wed, 27 Mar 2024 11:15:39 +0100
 Subject: [PATCH] alloc-track: avoid seemingly superfluous child permission
 update
 Doesn't seem necessary nowadays (maybe after commit "alloc-track: fix
 deadlock during drop" where the dropping is not rescheduled and delayed
 anymore or some upstream change). Should there really be some issue,
 instead of having a drop state, this could also be just based off the
 fact whether there is still a backing child.
 Dumping the cumulative (shared) permissions for the BDS with a debug
 print yields the same values after this patch and with QEMU 8.1,
 namely 3 and 5.
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 block/alloc-track.c | 26 --------------------------
 1 file changed, 26 deletions(-)
 diff --git a/block/alloc-track.c b/block/alloc-track.c
 index fc7d58a5d0..b56425b7f0 100644
 --- a/block/alloc-track.c
 +++ b/block/alloc-track.c
@@ -25,15 +25,9 @@
 #define TRACK_OPT_AUTO_REMOVE "auto-remove"
 -typedef enum DropState {
 -    DropNone,
 -    DropInProgress,
 -} DropState;
 -
 typedef struct {
     BdrvDirtyBitmap *bitmap;
     uint64_t granularity;
 -    DropState drop_state;
 } BDRVAllocTrackState;
 static QemuOptsList runtime_opts = {
@@ -137,8 +131,6 @@ static int track_open(BlockDriverState *bs, QDict *options, int flags,
         goto fail;
     }
 -    s->drop_state = DropNone;
 -
 fail:
     if (ret < 0) {
         bdrv_graph_wrlock();
@@ -289,18 +281,8 @@ track_child_perm(BlockDriverState *bs, BdrvChild *c, BdrvChildRole role,
                  BlockReopenQueue *reopen_queue, uint64_t perm, uint64_t shared,
                  uint64_t *nperm, uint64_t *nshared)
 {
 -    BDRVAllocTrackState *s = bs->opaque;
 -
     *nshared = BLK_PERM_ALL;
 -    /* in case we're currently dropping ourselves, claim to not use any
 -     * permissions at all - which is fine, since from this point on we will
 -     * never issue a read or write anymore */
 -    if (s->drop_state == DropInProgress) {
 -        *nperm = 0;
 -        return;
 -    }
 -
     if (role & BDRV_CHILD_DATA) {
         *nperm = perm & DEFAULT_PERM_PASSTHROUGH;
     } else {
@@ -326,14 +308,6 @@ track_co_change_backing_file(BlockDriverState *bs, const char *backing_file,
      * kinda fits better, but in the long-term, a special parameter would be
      * nice (or done via qemu-server via upcoming blockdev-replace QMP command).
      */
 -    if (backing_file == NULL) {
 -        BDRVAllocTrackState *s = bs->opaque;
 -        bdrv_drained_begin(bs);
 -        s->drop_state = DropInProgress;
 -        bdrv_child_refresh_perms(bs, bs->file, &error_abort);
 -        bdrv_drained_end(bs);
 -    }
 -
     return 0;
 }
--- a/debian/patches/pve/0044-PBS-add-master-key-support.patch
+++ b/debian/patches/pve/0044-PBS-add-master-key-support.patch
@@ -0,0 +1,98 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Stefan Reiter <s.reiter@proxmox.com>
 Date: Wed, 10 Feb 2021 11:07:06 +0100
 Subject: [PATCH] PBS: add master key support
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 this requires a new enough libproxmox-backup-qemu0, and allows querying
 from the PVE side to avoid QMP calls with unsupported parameters.
 Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
 block/monitor/block-hmp-cmds.c | 1 +
 pve-backup.c                   | 3 +++
 qapi/block-core.json           | 7 +++++++
 3 files changed, 11 insertions(+)
 diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
 index ef45552e3b..4c799f00d9 100644
 --- a/block/monitor/block-hmp-cmds.c
 +++ b/block/monitor/block-hmp-cmds.c
@@ -1039,6 +1039,7 @@ void coroutine_fn hmp_backup(Monitor *mon, const QDict *qdict)
         false, NULL, // PBS password
         false, NULL, // PBS keyfile
         false, NULL, // PBS key_password
 +        false, NULL, // PBS master_keyfile
         false, NULL, // PBS fingerprint
         false, NULL, // PBS backup-id
         false, 0, // PBS backup-time
 diff --git a/pve-backup.c b/pve-backup.c
 index 323014744c..9f6c04a512 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
@@ -533,6 +533,7 @@ UuidInfo coroutine_fn *qmp_backup(
     bool has_password, const char *password,
     bool has_keyfile, const char *keyfile,
     bool has_key_password, const char *key_password,
 +    bool has_master_keyfile, const char *master_keyfile,
     bool has_fingerprint, const char *fingerprint,
     bool has_backup_id, const char *backup_id,
     bool has_backup_time, int64_t backup_time,
@@ -681,6 +682,7 @@ UuidInfo coroutine_fn *qmp_backup(
             has_password ? password : NULL,
             has_keyfile ? keyfile : NULL,
             has_key_password ? key_password : NULL,
 +            has_master_keyfile ? master_keyfile : NULL,
             has_compress ? compress : true,
             has_encrypt ? encrypt : has_keyfile,
             has_fingerprint ? fingerprint : NULL,
@@ -1044,5 +1046,6 @@ ProxmoxSupportStatus *qmp_query_proxmox_support(Error **errp)
     ret->pbs_dirty_bitmap_savevm = true;
     ret->pbs_dirty_bitmap_migration = true;
     ret->query_bitmap_info = true;
 +    ret->pbs_masterkey = true;
     return ret;
 }
 diff --git a/qapi/block-core.json b/qapi/block-core.json
 index ca1966f54b..fc8a125451 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
@@ -813,6 +813,8 @@
 #
 # @key-password: password for keyfile (optional for format 'pbs')
 #
 +# @master-keyfile: PEM-formatted master public keyfile (optional for format 'pbs')
 +#
 # @fingerprint: server cert fingerprint (optional for format 'pbs')
 #
 # @backup-id: backup ID (required for format 'pbs')
@@ -832,6 +834,7 @@
                                     '*password': 'str',
                                     '*keyfile': 'str',
                                     '*key-password': 'str',
 +                                    '*master-keyfile': 'str',
                                     '*fingerprint': 'str',
                                     '*backup-id': 'str',
                                     '*backup-time': 'int',
@@ -884,6 +887,9 @@
 #                              migration cap if this is false/unset may lead
 #                              to crashes on migration!
 #
 +# @pbs-masterkey: True if the QMP backup call supports the 'master_keyfile'
 +#                 parameter.
 +#
 # @pbs-library-version: Running version of libproxmox-backup-qemu0 library.
 #
 ##
@@ -892,6 +898,7 @@
             'query-bitmap-info': 'bool',
             'pbs-dirty-bitmap-savevm': 'bool',
             'pbs-dirty-bitmap-migration': 'bool',
 +            'pbs-masterkey': 'bool',
             'pbs-library-version': 'str' } }
 ##
--- a/debian/patches/pve/0044-copy-before-write-allow-specifying-minimum-cluster-s.patch
+++ b/debian/patches/pve/0044-copy-before-write-allow-specifying-minimum-cluster-s.patch
@@ -1,133 +0,0 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Fiona Ebner <f.ebner@proxmox.com>
 Date: Thu, 11 Apr 2024 11:29:26 +0200
 Subject: [PATCH] copy-before-write: allow specifying minimum cluster size
 Useful to make discard-source work in the context of backup fleecing
 when the fleecing image has a larger granularity than the backup
 target.
 Copy-before-write operations will use at least this granularity and in
 particular, discard requests to the source node will too. If the
 granularity is too small, they will just be aligned down in
 cbw_co_pdiscard_snapshot() and thus effectively ignored.
 The QAPI uses uint32 so the value will be non-negative, but still fit
 into a uint64_t.
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
 block/block-copy.c         | 17 +++++++++++++----
 block/copy-before-write.c  |  3 ++-
 include/block/block-copy.h |  1 +
 qapi/block-core.json       |  8 +++++++-
 4 files changed, 23 insertions(+), 6 deletions(-)
 diff --git a/block/block-copy.c b/block/block-copy.c
 index cc618e4561..12d662e9d4 100644
 --- a/block/block-copy.c
 +++ b/block/block-copy.c
@@ -310,6 +310,7 @@ void block_copy_set_copy_opts(BlockCopyState *s, bool use_copy_range,
 }
 static int64_t block_copy_calculate_cluster_size(BlockDriverState *target,
 +                                                 int64_t min_cluster_size,
                                                  Error **errp)
 {
     int ret;
@@ -335,7 +336,7 @@ static int64_t block_copy_calculate_cluster_size(BlockDriverState *target,
                     "used. If the actual block size of the target exceeds "
                     "this default, the backup may be unusable",
                     BLOCK_COPY_CLUSTER_SIZE_DEFAULT);
 -        return BLOCK_COPY_CLUSTER_SIZE_DEFAULT;
 +        return MAX(min_cluster_size, BLOCK_COPY_CLUSTER_SIZE_DEFAULT);
     } else if (ret < 0 && !target_does_cow) {
         error_setg_errno(errp, -ret,
             "Couldn't determine the cluster size of the target image, "
@@ -345,16 +346,18 @@ static int64_t block_copy_calculate_cluster_size(BlockDriverState *target,
         return ret;
     } else if (ret < 0 && target_does_cow) {
         /* Not fatal; just trudge on ahead. */
 -        return BLOCK_COPY_CLUSTER_SIZE_DEFAULT;
 +        return MAX(min_cluster_size, BLOCK_COPY_CLUSTER_SIZE_DEFAULT);
     }
 -    return MAX(BLOCK_COPY_CLUSTER_SIZE_DEFAULT, bdi.cluster_size);
 +    return MAX(min_cluster_size,
 +               MAX(BLOCK_COPY_CLUSTER_SIZE_DEFAULT, bdi.cluster_size));
 }
 BlockCopyState *block_copy_state_new(BdrvChild *source, BdrvChild *target,
                                      BlockDriverState *copy_bitmap_bs,
                                      const BdrvDirtyBitmap *bitmap,
                                      bool discard_source,
 +                                     int64_t min_cluster_size,
                                      Error **errp)
 {
     ERRP_GUARD();
@@ -365,7 +368,13 @@ BlockCopyState *block_copy_state_new(BdrvChild *source, BdrvChild *target,
     GLOBAL_STATE_CODE();
 -    cluster_size = block_copy_calculate_cluster_size(target->bs, errp);
 +    if (min_cluster_size && !is_power_of_2(min_cluster_size)) {
 +        error_setg(errp, "min-cluster-size needs to be a power of 2");
 +        return NULL;
 +    }
 +
 +    cluster_size = block_copy_calculate_cluster_size(target->bs,
 +                                                     min_cluster_size, errp);
     if (cluster_size < 0) {
         return NULL;
     }
 diff --git a/block/copy-before-write.c b/block/copy-before-write.c
 index 28f6a096cd..ef4e666303 100644
 --- a/block/copy-before-write.c
 +++ b/block/copy-before-write.c
@@ -478,7 +478,8 @@ static int cbw_open(BlockDriverState *bs, QDict *options, int flags,
     s->discard_source = flags & BDRV_O_CBW_DISCARD_SOURCE;
     s->bcs = block_copy_state_new(bs->file, s->target, bs, bitmap,
 -                                  flags & BDRV_O_CBW_DISCARD_SOURCE, errp);
 +                                  flags & BDRV_O_CBW_DISCARD_SOURCE,
 +                                  opts->min_cluster_size, errp);
     if (!s->bcs) {
         error_prepend(errp, "Cannot create block-copy-state: ");
         return -EINVAL;
 diff --git a/include/block/block-copy.h b/include/block/block-copy.h
 index bdc703bacd..77857c6c68 100644
 --- a/include/block/block-copy.h
 +++ b/include/block/block-copy.h
@@ -28,6 +28,7 @@ BlockCopyState *block_copy_state_new(BdrvChild *source, BdrvChild *target,
                                      BlockDriverState *copy_bitmap_bs,
                                      const BdrvDirtyBitmap *bitmap,
                                      bool discard_source,
 +                                     int64_t min_cluster_size,
                                      Error **errp);
 /* Function should be called prior any actual copy request */
 diff --git a/qapi/block-core.json b/qapi/block-core.json
 index 521a1914e8..171846deb1 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
@@ -4927,12 +4927,18 @@
 #     @on-cbw-error parameter will decide how this failure is handled.
 #     Default 0.  (Since 7.1)
 #
 +# @min-cluster-size: Minimum size of blocks used by copy-before-write
 +#     operations.  Has to be a power of 2.  No effect if smaller than
 +#     the maximum of the target's cluster size and 64 KiB.  Default 0.
 +#     (Since 8.1)
 +#
 # Since: 6.2
 ##
 { 'struct': 'BlockdevOptionsCbw',
   'base': 'BlockdevOptionsGenericFormat',
   'data': { 'target': 'BlockdevRef', '*bitmap': 'BlockDirtyBitmap',
 -            '*on-cbw-error': 'OnCbwError', '*cbw-timeout': 'uint32' } }
 +            '*on-cbw-error': 'OnCbwError', '*cbw-timeout': 'uint32',
 +            '*min-cluster-size': 'uint32' } }
 ##
 # @BlockdevOptions:
--- a/debian/patches/pve/0045-PVE-block-pbs-fast-path-reads-without-allocation-if-.patch
+++ b/debian/patches/pve/0045-PVE-block-pbs-fast-path-reads-without-allocation-if-.patch
@@ -0,0 +1,53 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Stefan Reiter <s.reiter@proxmox.com>
 Date: Wed, 9 Dec 2020 11:46:57 +0100
 Subject: [PATCH] PVE: block/pbs: fast-path reads without allocation if
 possible
 ...and switch over to g_malloc/g_free while at it to align with other
 QEMU code.
 Tracing shows the fast-path is taken almost all the time, though not
 100% so the slow one is still necessary.
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
 block/pbs.c | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)
 diff --git a/block/pbs.c b/block/pbs.c
 index 0b05ea9080..c5eb4d5bad 100644
 --- a/block/pbs.c
 +++ b/block/pbs.c
@@ -200,7 +200,16 @@ static coroutine_fn int pbs_co_preadv(BlockDriverState *bs,
     BDRVPBSState *s = bs->opaque;
     int ret;
     char *pbs_error = NULL;
 -    uint8_t *buf = malloc(bytes);
 +    uint8_t *buf;
 +    bool inline_buf = true;
 +
 +    /* for single-buffer IO vectors we can fast-path the write directly to it */
 +    if (qiov->niov == 1 && qiov->iov->iov_len >= bytes) {
 +        buf = qiov->iov->iov_base;
 +    } else {
 +        inline_buf = false;
 +        buf = g_malloc(bytes);
 +    }
     if (offset < 0 || bytes < 0) {
         fprintf(stderr, "unexpected negative 'offset' or 'bytes' value!\n");
@@ -223,8 +232,10 @@ static coroutine_fn int pbs_co_preadv(BlockDriverState *bs,
         return -EIO;
     }
 -    qemu_iovec_from_buf(qiov, 0, buf, bytes);
 -    free(buf);
 +    if (!inline_buf) {
 +        qemu_iovec_from_buf(qiov, 0, buf, bytes);
 +        g_free(buf);
 +    }
     return 0;
 }
--- a/debian/patches/pve/0045-backup-add-minimum-cluster-size-to-performance-optio.patch
+++ b/debian/patches/pve/0045-backup-add-minimum-cluster-size-to-performance-optio.patch
@@ -1,106 +0,0 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Fiona Ebner <f.ebner@proxmox.com>
 Date: Thu, 11 Apr 2024 11:29:27 +0200
 Subject: [PATCH] backup: add minimum cluster size to performance options
 Useful to make discard-source work in the context of backup fleecing
 when the fleecing image has a larger granularity than the backup
 target.
 Backup/block-copy will use at least this granularity for copy operations
 and in particular, discard requests to the backup source will too. If
 the granularity is too small, they will just be aligned down in
 cbw_co_pdiscard_snapshot() and thus effectively ignored.
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
 block/backup.c            | 2 +-
 block/copy-before-write.c | 2 ++
 block/copy-before-write.h | 1 +
 blockdev.c                | 3 +++
 qapi/block-core.json      | 9 +++++++--
 5 files changed, 14 insertions(+), 3 deletions(-)
 diff --git a/block/backup.c b/block/backup.c
 index 1963e47ab9..fe69723ada 100644
 --- a/block/backup.c
 +++ b/block/backup.c
@@ -434,7 +434,7 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
     }
     cbw = bdrv_cbw_append(bs, target, filter_node_name, discard_source,
 -                          &bcs, errp);
 +                          perf->min_cluster_size, &bcs, errp);
     if (!cbw) {
         goto error;
     }
 diff --git a/block/copy-before-write.c b/block/copy-before-write.c
 index ef4e666303..adb27649a8 100644
 --- a/block/copy-before-write.c
 +++ b/block/copy-before-write.c
@@ -547,6 +547,7 @@ BlockDriverState *bdrv_cbw_append(BlockDriverState *source,
                                   BlockDriverState *target,
                                   const char *filter_node_name,
                                   bool discard_source,
 +                                  int64_t min_cluster_size,
                                   BlockCopyState **bcs,
                                   Error **errp)
 {
@@ -565,6 +566,7 @@ BlockDriverState *bdrv_cbw_append(BlockDriverState *source,
     }
     qdict_put_str(opts, "file", bdrv_get_node_name(source));
     qdict_put_str(opts, "target", bdrv_get_node_name(target));
 +    qdict_put_int(opts, "min-cluster-size", min_cluster_size);
     top = bdrv_insert_node(source, opts, flags, errp);
     if (!top) {
 diff --git a/block/copy-before-write.h b/block/copy-before-write.h
 index 01af0cd3c4..dc6cafe7fa 100644
 --- a/block/copy-before-write.h
 +++ b/block/copy-before-write.h
@@ -40,6 +40,7 @@ BlockDriverState *bdrv_cbw_append(BlockDriverState *source,
                                   BlockDriverState *target,
                                   const char *filter_node_name,
                                   bool discard_source,
 +                                  int64_t min_cluster_size,
                                   BlockCopyState **bcs,
                                   Error **errp);
 void bdrv_cbw_drop(BlockDriverState *bs);
 diff --git a/blockdev.c b/blockdev.c
 index 8080c47fa6..3f67eb413d 100644
 --- a/blockdev.c
 +++ b/blockdev.c
@@ -2656,6 +2656,9 @@ static BlockJob *do_backup_common(BackupCommon *backup,
         if (backup->x_perf->has_max_chunk) {
             perf.max_chunk = backup->x_perf->max_chunk;
         }
 +        if (backup->x_perf->has_min_cluster_size) {
 +            perf.min_cluster_size = backup->x_perf->min_cluster_size;
 +        }
     }
     if ((backup->sync == MIRROR_SYNC_MODE_BITMAP) ||
 diff --git a/qapi/block-core.json b/qapi/block-core.json
 index 171846deb1..653df22046 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
@@ -1790,11 +1790,16 @@
 #     it should not be less than job cluster size which is calculated
 #     as maximum of target image cluster size and 64k.  Default 0.
 #
 +# @min-cluster-size: Minimum size of blocks used by copy-before-write
 +#     and background copy operations.  Has to be a power of 2.  No
 +#     effect if smaller than the maximum of the target's cluster size
 +#     and 64 KiB.  Default 0. (Since 8.1)
 +#
 # Since: 6.0
 ##
 { 'struct': 'BackupPerf',
 -  'data': { '*use-copy-range': 'bool',
 -            '*max-workers': 'int', '*max-chunk': 'int64' } }
 +  'data': { '*use-copy-range': 'bool', '*max-workers': 'int',
 +            '*max-chunk': 'int64', '*min-cluster-size': 'uint32' } }
 ##
 # @BackupCommon:
--- a/debian/patches/pve/0046-PVE-backup-add-fleecing-option.patch
+++ b/debian/patches/pve/0046-PVE-backup-add-fleecing-option.patch
@@ -1,337 +0,0 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Fiona Ebner <f.ebner@proxmox.com>
 Date: Thu, 11 Apr 2024 11:29:28 +0200
 Subject: [PATCH] PVE backup: add fleecing option
 When a fleecing option is given, it is expected that each device has
 a corresponding "-fleecing" block device already attached, except for
 EFI disk and TPM state, where fleecing is never used.
 The following graph was adapted from [0] which also contains more
 details about fleecing.
 [guest]
   |
   | root
   v                 file
 [copy-before-write]<------[snapshot-access]
   |           |
   | file      | target
   v           v
 [source] [fleecing]
 For fleecing, a copy-before-write filter is inserted on top of the
 source node, as well as a snapshot-access node pointing to the filter
 node which allows to read the consistent state of the image at the
 time it was inserted. New guest writes are passed through the
 copy-before-write filter which will first copy over old data to the
 fleecing image in case that old data is still needed by the
 snapshot-access node.
 The backup process will sequentially read from the snapshot access,
 which has a bitmap and knows whether to read from the original image
 or the fleecing image to get the "snapshot" state, i.e. data from the
 source image at the time when the copy-before-write filter was
 inserted. After reading, the copied sections are discarded from the
 fleecing image to reduce space usage.
 All of this can be restricted by an initial dirty bitmap to parts of
 the source image that are required for an incremental backup.
 For discard to work, it is necessary that the fleecing image does not
 have a larger cluster size than the backup job granularity. Since
 querying that size does not always work, e.g. for RBD with krbd, the
 cluster size will not be reported, a minimum of 4 MiB is used. A job
 with PBS target already has at least this granularity, so it's just
 relevant for other targets. I.e. edge cases where this minimum is not
 enough should be very rare in practice. If ever necessary in the
 future, can still add a passed-in value for the backup QMP command to
 override.
 Additionally, the cbw-timeout and on-cbw-error=break-snapshot options
 are set when installing the copy-before-write filter and
 snapshot-access. When an error or timeout occurs, the problematic (and
 each further) snapshot operation will fail and thus cancel the backup
 instead of breaking the guest write.
 Note that job_id cannot be inferred from the snapshot-access bs because
 it has no parent, so just pass the one from the original bs.
 [0]: https://www.mail-archive.com/qemu-devel@nongnu.org/msg876056.html
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
 block/monitor/block-hmp-cmds.c |   1 +
 pve-backup.c                   | 135 ++++++++++++++++++++++++++++++++-
 qapi/block-core.json           |  10 ++-
 3 files changed, 142 insertions(+), 4 deletions(-)
 diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
 index 439a7a14c8..d0e7771dcc 100644
 --- a/block/monitor/block-hmp-cmds.c
 +++ b/block/monitor/block-hmp-cmds.c
@@ -1044,6 +1044,7 @@ void coroutine_fn hmp_backup(Monitor *mon, const QDict *qdict)
         NULL, NULL,
         devlist, qdict_haskey(qdict, "speed"), speed,
         false, 0, // BackupPerf max-workers
 +        false, false, // fleecing
         &error);
     hmp_handle_error(mon, error);
 diff --git a/pve-backup.c b/pve-backup.c
 index 57477f7f2a..0f098000dd 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
@@ -7,9 +7,11 @@
 #include "sysemu/blockdev.h"
 #include "block/block_int-global-state.h"
 #include "block/blockjob.h"
 +#include "block/copy-before-write.h"
 #include "block/dirty-bitmap.h"
 #include "block/graph-lock.h"
 #include "qapi/qapi-commands-block.h"
 +#include "qapi/qmp/qdict.h"
 #include "qapi/qmp/qerror.h"
 #include "qemu/cutils.h"
@@ -80,8 +82,15 @@ static void pvebackup_init(void)
 // initialize PVEBackupState at startup
 opts_init(pvebackup_init);
 +typedef struct PVEBackupFleecingInfo {
 +    BlockDriverState *bs;
 +    BlockDriverState *cbw;
 +    BlockDriverState *snapshot_access;
 +} PVEBackupFleecingInfo;
 +
 typedef struct PVEBackupDevInfo {
     BlockDriverState *bs;
 +    PVEBackupFleecingInfo fleecing;
     size_t size;
     uint64_t block_size;
     uint8_t dev_id;
@@ -353,6 +362,22 @@ static void pvebackup_complete_cb(void *opaque, int ret)
     PVEBackupDevInfo *di = opaque;
     di->completed_ret = ret;
 +    /*
 +     * Handle block-graph specific cleanup (for fleecing) outside of the coroutine, because the work
 +     * won't be done as a coroutine anyways:
 +     * - For snapshot_access, allows doing bdrv_unref() directly. Doing it via bdrv_co_unref() would
 +     *   just spawn a BH calling bdrv_unref().
 +     * - For cbw, draining would need to spawn a BH.
 +     */
 +    if (di->fleecing.snapshot_access) {
 +        bdrv_unref(di->fleecing.snapshot_access);
 +        di->fleecing.snapshot_access = NULL;
 +    }
 +    if (di->fleecing.cbw) {
 +        bdrv_cbw_drop(di->fleecing.cbw);
 +        di->fleecing.cbw = NULL;
 +    }
 +
     /*
      * Needs to happen outside of coroutine, because it takes the graph write lock.
      */
@@ -519,9 +544,77 @@ static void create_backup_jobs_bh(void *opaque) {
         }
         bdrv_drained_begin(di->bs);
 +        BackupPerf perf = (BackupPerf){ .max_workers = backup_state.perf.max_workers };
 +
 +        BlockDriverState *source_bs = di->bs;
 +        bool discard_source = false;
 +        bdrv_graph_co_rdlock();
 +        const char *job_id = bdrv_get_device_name(di->bs);
 +        bdrv_graph_co_rdunlock();
 +        if (di->fleecing.bs) {
 +            QDict *cbw_opts = qdict_new();
 +            qdict_put_str(cbw_opts, "driver", "copy-before-write");
 +            qdict_put_str(cbw_opts, "file", bdrv_get_node_name(di->bs));
 +            qdict_put_str(cbw_opts, "target", bdrv_get_node_name(di->fleecing.bs));
 +
 +            if (di->bitmap) {
 +                /*
 +                 * Only guest writes to parts relevant for the backup need to be intercepted with
 +                 * old data being copied to the fleecing image.
 +                 */
 +                qdict_put_str(cbw_opts, "bitmap.node", bdrv_get_node_name(di->bs));
 +                qdict_put_str(cbw_opts, "bitmap.name", bdrv_dirty_bitmap_name(di->bitmap));
 +            }
 +            /*
 +             * Fleecing storage is supposed to be fast and it's better to break backup than guest
 +             * writes. Certain guest drivers like VirtIO-win have 60 seconds timeout by default, so
 +             * abort a bit before that.
 +             */
 +            qdict_put_str(cbw_opts, "on-cbw-error", "break-snapshot");
 +            qdict_put_int(cbw_opts, "cbw-timeout", 45);
 +
 +            di->fleecing.cbw = bdrv_insert_node(di->bs, cbw_opts, BDRV_O_RDWR, &local_err);
 +
 +            if (!di->fleecing.cbw) {
 +                error_setg(errp, "appending cbw node for fleecing failed: %s",
 +                           local_err ? error_get_pretty(local_err) : "unknown error");
 +                break;
 +            }
 +
 +            QDict *snapshot_access_opts = qdict_new();
 +            qdict_put_str(snapshot_access_opts, "driver", "snapshot-access");
 +            qdict_put_str(snapshot_access_opts, "file", bdrv_get_node_name(di->fleecing.cbw));
 +
 +            di->fleecing.snapshot_access =
 +                bdrv_open(NULL, NULL, snapshot_access_opts, BDRV_O_RDWR | BDRV_O_UNMAP, &local_err);
 +            if (!di->fleecing.snapshot_access) {
 +                error_setg(errp, "setting up snapshot access for fleecing failed: %s",
 +                           local_err ? error_get_pretty(local_err) : "unknown error");
 +                break;
 +            }
 +            source_bs = di->fleecing.snapshot_access;
 +            discard_source = true;
 +
 +            /*
 +             * bdrv_get_info() just retuns 0 (= doesn't matter) for RBD when using krbd. But discard
 +             * on the fleecing image won't work if the backup job's granularity is less than the RBD
 +             * object size (default 4 MiB), so it does matter. Always use at least 4 MiB. With a PBS
 +             * target, the backup job granularity would already be at least this much.
 +             */
 +            perf.min_cluster_size = 4 * 1024 * 1024;
 +            /*
 +             * For discard to work, cluster size for the backup job must be at least the same as for
 +             * the fleecing image.
 +             */
 +            BlockDriverInfo bdi;
 +            if (bdrv_get_info(di->fleecing.bs, &bdi) >= 0) {
 +                perf.min_cluster_size = MAX(perf.min_cluster_size, bdi.cluster_size);
 +            }
 +        }
 +
         BlockJob *job = backup_job_create(
 -            NULL, di->bs, di->target, backup_state.speed, sync_mode, di->bitmap,
 -            bitmap_mode, false, NULL, &backup_state.perf, BLOCKDEV_ON_ERROR_REPORT,
 +            job_id, source_bs, di->target, backup_state.speed, sync_mode, di->bitmap,
 +            bitmap_mode, false, discard_source, NULL, &perf, BLOCKDEV_ON_ERROR_REPORT,
             BLOCKDEV_ON_ERROR_REPORT, JOB_DEFAULT, pvebackup_complete_cb, di, backup_state.txn,
             &local_err);
@@ -577,6 +670,14 @@ static void create_backup_jobs_bh(void *opaque) {
     aio_co_enter(data->ctx, data->co);
 }
 +/*
 + * EFI disk and TPM state are small and it's just not worth setting up fleecing for them.
 + */
 +static bool device_uses_fleecing(const char *device_id)
 +{
 +    return strncmp(device_id, "drive-efidisk", 13) && strncmp(device_id, "drive-tpmstate", 14);
 +}
 +
 /*
  * Returns a list of device infos, which needs to be freed by the caller. In
  * case of an error, errp will be set, but the returned value might still be a
@@ -584,6 +685,7 @@ static void create_backup_jobs_bh(void *opaque) {
  */
 static GList coroutine_fn GRAPH_RDLOCK *get_device_info(
     const char *devlist,
 +    bool fleecing,
     Error **errp)
 {
     gchar **devs = NULL;
@@ -607,6 +709,31 @@ static GList coroutine_fn GRAPH_RDLOCK *get_device_info(
             }
             PVEBackupDevInfo *di = g_new0(PVEBackupDevInfo, 1);
             di->bs = bs;
 +
 +            if (fleecing && device_uses_fleecing(*d)) {
 +                g_autofree gchar *fleecing_devid = g_strconcat(*d, "-fleecing", NULL);
 +                BlockBackend *fleecing_blk = blk_by_name(fleecing_devid);
 +                if (!fleecing_blk) {
 +                    error_set(errp, ERROR_CLASS_DEVICE_NOT_FOUND,
 +                              "Device '%s' not found", fleecing_devid);
 +                    goto err;
 +                }
 +                BlockDriverState *fleecing_bs = blk_bs(fleecing_blk);
 +                if (!bdrv_co_is_inserted(fleecing_bs)) {
 +                    error_setg(errp, "Device '%s' has no medium", fleecing_devid);
 +                    goto err;
 +                }
 +                /*
 +                 * Fleecing image needs to be the same size to act as a cbw target.
 +                 */
 +                if (bs->total_sectors != fleecing_bs->total_sectors) {
 +                    error_setg(errp, "Size mismatch for '%s' - sector count %ld != %ld",
 +                               fleecing_devid, fleecing_bs->total_sectors, bs->total_sectors);
 +                    goto err;
 +                }
 +                di->fleecing.bs = fleecing_bs;
 +            }
 +
             di_list = g_list_append(di_list, di);
             d++;
         }
@@ -656,6 +783,7 @@ UuidInfo coroutine_fn *qmp_backup(
     const char *devlist,
     bool has_speed, int64_t speed,
     bool has_max_workers, int64_t max_workers,
 +    bool has_fleecing, bool fleecing,
     Error **errp)
 {
     assert(qemu_in_coroutine());
@@ -684,7 +812,7 @@ UuidInfo coroutine_fn *qmp_backup(
     format = has_format ? format : BACKUP_FORMAT_VMA;
     bdrv_graph_co_rdlock();
 -    di_list = get_device_info(devlist, &local_err);
 +    di_list = get_device_info(devlist, has_fleecing && fleecing, &local_err);
     bdrv_graph_co_rdunlock();
     if (local_err) {
         error_propagate(errp, local_err);
@@ -1089,5 +1217,6 @@ ProxmoxSupportStatus *qmp_query_proxmox_support(Error **errp)
     ret->query_bitmap_info = true;
     ret->pbs_masterkey = true;
     ret->backup_max_workers = true;
 +    ret->backup_fleecing = true;
     return ret;
 }
 diff --git a/qapi/block-core.json b/qapi/block-core.json
 index 653df22046..9f25c398ec 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
@@ -948,6 +948,10 @@
 #
 # @max-workers: see @BackupPerf for details. Default 16.
 #
 +# @fleecing: perform a backup with fleecing. For each device in @devlist, a
 +#            corresponing '-fleecing' device with the same size already needs to
 +#            be present.
 +#
 # Returns: the uuid of the backup job
 #
 ##
@@ -968,7 +972,8 @@
                                     '*firewall-file': 'str',
                                     '*devlist': 'str',
                                     '*speed': 'int',
 -                                    '*max-workers': 'int' },
 +                                    '*max-workers': 'int',
 +                                    '*fleecing': 'bool' },
   'returns': 'UuidInfo', 'coroutine': true }
 ##
@@ -1014,6 +1019,8 @@
 #
 # @pbs-library-version: Running version of libproxmox-backup-qemu0 library.
 #
 +# @backup-fleecing: Whether backup fleecing is supported or not.
 +#
 # @backup-max-workers: Whether the 'max-workers' @BackupPerf setting is
 #     supported or not.
 #
@@ -1025,6 +1032,7 @@
             'pbs-dirty-bitmap-migration': 'bool',
             'pbs-masterkey': 'bool',
             'pbs-library-version': 'str',
 +            'backup-fleecing': 'bool',
             'backup-max-workers': 'bool' } }
 ##
--- a/debian/patches/pve/0046-PVE-block-stream-increase-chunk-size.patch
+++ b/debian/patches/pve/0046-PVE-block-stream-increase-chunk-size.patch
@@ -11,10 +11,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/block/stream.c b/block/stream.c
-index 7031eef12b..d2da83ae7c 100644
+index 694709bd25..e09bd5c4ef 100644
 --- a/block/stream.c
 +++ b/block/stream.c
-@@ -27,7 +27,7 @@ enum {
+@@ -28,7 +28,7 @@ enum {
      * large enough to process multiple clusters in a single call, so
      * that populating contiguous regions of the image is efficient.
      */
--- a/debian/patches/pve/0047-PVE-backup-improve-error-when-copy-before-write-fail.patch
+++ b/debian/patches/pve/0047-PVE-backup-improve-error-when-copy-before-write-fail.patch
@@ -1,117 +0,0 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Fiona Ebner <f.ebner@proxmox.com>
 Date: Mon, 29 Apr 2024 14:43:58 +0200
 Subject: [PATCH] PVE backup: improve error when copy-before-write fails for
 fleecing
 With fleecing, failure for copy-before-write does not fail the guest
 write, but only sets the snapshot error that is associated to the
 copy-before-write filter, making further requests to the snapshot
 access fail with EACCES, which then also fails the job. But that error
 code is not the root cause of why the backup failed, so bubble up the
 original snapshot error instead.
 Reported-by: Friedrich Weber <f.weber@proxmox.com>
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 Tested-by: Friedrich Weber <f.weber@proxmox.com>
 ---
 block/copy-before-write.c | 18 ++++++++++++------
 block/copy-before-write.h |  1 +
 pve-backup.c              |  9 +++++++++
 3 files changed, 22 insertions(+), 6 deletions(-)
 diff --git a/block/copy-before-write.c b/block/copy-before-write.c
 index adb27649a8..a5bb4d14f6 100644
 --- a/block/copy-before-write.c
 +++ b/block/copy-before-write.c
@@ -27,6 +27,7 @@
 #include "qapi/qmp/qjson.h"
 #include "sysemu/block-backend.h"
 +#include "qemu/atomic.h"
 #include "qemu/cutils.h"
 #include "qapi/error.h"
 #include "block/block_int.h"
@@ -75,7 +76,8 @@ typedef struct BDRVCopyBeforeWriteState {
      * @snapshot_error is normally zero. But on first copy-before-write failure
      * when @on_cbw_error == ON_CBW_ERROR_BREAK_SNAPSHOT, @snapshot_error takes
      * value of this error (<0). After that all in-flight and further
 -     * snapshot-API requests will fail with that error.
 +     * snapshot-API requests will fail with that error. To be accessed with
 +     * atomics.
      */
     int snapshot_error;
 } BDRVCopyBeforeWriteState;
@@ -115,7 +117,7 @@ static coroutine_fn int cbw_do_copy_before_write(BlockDriverState *bs,
         return 0;
     }
 -    if (s->snapshot_error) {
 +    if (qatomic_read(&s->snapshot_error)) {
         return 0;
     }
@@ -139,9 +141,7 @@ static coroutine_fn int cbw_do_copy_before_write(BlockDriverState *bs,
     WITH_QEMU_LOCK_GUARD(&s->lock) {
         if (ret < 0) {
             assert(s->on_cbw_error == ON_CBW_ERROR_BREAK_SNAPSHOT);
 -            if (!s->snapshot_error) {
 -                s->snapshot_error = ret;
 -            }
 +            qatomic_cmpxchg(&s->snapshot_error, 0, ret);
         } else {
             bdrv_set_dirty_bitmap(s->done_bitmap, off, end - off);
         }
@@ -215,7 +215,7 @@ cbw_snapshot_read_lock(BlockDriverState *bs, int64_t offset, int64_t bytes,
     QEMU_LOCK_GUARD(&s->lock);
 -    if (s->snapshot_error) {
 +    if (qatomic_read(&s->snapshot_error)) {
         g_free(req);
         return NULL;
     }
@@ -586,6 +586,12 @@ void bdrv_cbw_drop(BlockDriverState *bs)
     bdrv_unref(bs);
 }
 +int bdrv_cbw_snapshot_error(BlockDriverState *bs)
 +{
 +    BDRVCopyBeforeWriteState *s = bs->opaque;
 +    return qatomic_read(&s->snapshot_error);
 +}
 +
 static void cbw_init(void)
 {
     bdrv_register(&bdrv_cbw_filter);
 diff --git a/block/copy-before-write.h b/block/copy-before-write.h
 index dc6cafe7fa..a27d2d7d9f 100644
 --- a/block/copy-before-write.h
 +++ b/block/copy-before-write.h
@@ -44,5 +44,6 @@ BlockDriverState *bdrv_cbw_append(BlockDriverState *source,
                                   BlockCopyState **bcs,
                                   Error **errp);
 void bdrv_cbw_drop(BlockDriverState *bs);
 +int bdrv_cbw_snapshot_error(BlockDriverState *bs);
 #endif /* COPY_BEFORE_WRITE_H */
 diff --git a/pve-backup.c b/pve-backup.c
 index 0f098000dd..75da1dc051 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
@@ -374,6 +374,15 @@ static void pvebackup_complete_cb(void *opaque, int ret)
         di->fleecing.snapshot_access = NULL;
     }
     if (di->fleecing.cbw) {
 +        /*
 +         * With fleecing, failure for cbw does not fail the guest write, but only sets the snapshot
 +         * error, making further requests to the snapshot fail with EACCES, which then also fail the
 +         * job. But that code is not the root cause and just confusing, so update it.
 +         */
 +        int snapshot_error = bdrv_cbw_snapshot_error(di->fleecing.cbw);
 +        if (di->completed_ret == -EACCES && snapshot_error) {
 +            di->completed_ret = snapshot_error;
 +        }
         bdrv_cbw_drop(di->fleecing.cbw);
         di->fleecing.cbw = NULL;
     }
--- a/debian/patches/pve/0047-block-io-accept-NULL-qiov-in-bdrv_pad_request.patch
+++ b/debian/patches/pve/0047-block-io-accept-NULL-qiov-in-bdrv_pad_request.patch
@@ -0,0 +1,33 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Stefan Reiter <s.reiter@proxmox.com>
 Date: Tue, 2 Mar 2021 16:11:54 +0100
 Subject: [PATCH] block/io: accept NULL qiov in bdrv_pad_request
 Some operations, e.g. block-stream, perform reads while discarding the
 results (only copy-on-read matters). In this case they will pass NULL as
 the target QEMUIOVector, which will however trip bdrv_pad_request, since
 it wants to extend its passed vector.
 Simply check for NULL and do nothing, there's no reason to pad the
 target if it will be discarded anyway.
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
 block/io.c | 4 ++++
 1 file changed, 4 insertions(+)
 diff --git a/block/io.c b/block/io.c
 index 0a8cbefe86..531b3b7a2d 100644
 --- a/block/io.c
 +++ b/block/io.c
@@ -1734,6 +1734,10 @@ static int bdrv_pad_request(BlockDriverState *bs,
 {
     int ret;
 +    if (!qiov) {
 +        return 0;
 +    }
 +
     bdrv_check_qiov_request(*offset, *bytes, *qiov, *qiov_offset, &error_abort);
     if (!bdrv_init_padding(bs, *offset, *bytes, pad)) {
--- a/debian/patches/pve/0048-PVE-backup-fixup-error-handling-for-fleecing.patch
+++ b/debian/patches/pve/0048-PVE-backup-fixup-error-handling-for-fleecing.patch
@@ -1,103 +0,0 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Fiona Ebner <f.ebner@proxmox.com>
 Date: Thu, 7 Nov 2024 17:51:14 +0100
 Subject: [PATCH] PVE backup: fixup error handling for fleecing
 The drained section needs to be terminated before breaking out of the
 loop in the error scenarios. Otherwise, guest IO on the drive would
 become stuck.
 If the job is created successfully, then the job completion callback
 will clean up the snapshot access block nodes. In case failure
 happened before the job is created, there was no cleanup for the
 snapshot access block nodes yet. Add it.
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 pve-backup.c | 38 +++++++++++++++++++++++++-------------
 1 file changed, 25 insertions(+), 13 deletions(-)
 diff --git a/pve-backup.c b/pve-backup.c
 index 75da1dc051..167f0b5c3f 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
@@ -357,22 +357,23 @@ static void coroutine_fn pvebackup_co_complete_stream(void *opaque)
     qemu_co_mutex_unlock(&backup_state.backup_mutex);
 }
 -static void pvebackup_complete_cb(void *opaque, int ret)
 +static void cleanup_snapshot_access(PVEBackupDevInfo *di)
 {
 -    PVEBackupDevInfo *di = opaque;
 -    di->completed_ret = ret;
 -
 -    /*
 -     * Handle block-graph specific cleanup (for fleecing) outside of the coroutine, because the work
 -     * won't be done as a coroutine anyways:
 -     * - For snapshot_access, allows doing bdrv_unref() directly. Doing it via bdrv_co_unref() would
 -     *   just spawn a BH calling bdrv_unref().
 -     * - For cbw, draining would need to spawn a BH.
 -     */
     if (di->fleecing.snapshot_access) {
         bdrv_unref(di->fleecing.snapshot_access);
         di->fleecing.snapshot_access = NULL;
     }
 +    if (di->fleecing.cbw) {
 +        bdrv_cbw_drop(di->fleecing.cbw);
 +        di->fleecing.cbw = NULL;
 +    }
 +}
 +
 +static void pvebackup_complete_cb(void *opaque, int ret)
 +{
 +    PVEBackupDevInfo *di = opaque;
 +    di->completed_ret = ret;
 +
     if (di->fleecing.cbw) {
         /*
          * With fleecing, failure for cbw does not fail the guest write, but only sets the snapshot
@@ -383,10 +384,17 @@ static void pvebackup_complete_cb(void *opaque, int ret)
         if (di->completed_ret == -EACCES && snapshot_error) {
             di->completed_ret = snapshot_error;
         }
 -        bdrv_cbw_drop(di->fleecing.cbw);
 -        di->fleecing.cbw = NULL;
     }
 +    /*
 +     * Handle block-graph specific cleanup (for fleecing) outside of the coroutine, because the work
 +     * won't be done as a coroutine anyways:
 +     * - For snapshot_access, allows doing bdrv_unref() directly. Doing it via bdrv_co_unref() would
 +     *   just spawn a BH calling bdrv_unref().
 +     * - For cbw, draining would need to spawn a BH.
 +     */
 +    cleanup_snapshot_access(di);
 +
     /*
      * Needs to happen outside of coroutine, because it takes the graph write lock.
      */
@@ -587,6 +595,7 @@ static void create_backup_jobs_bh(void *opaque) {
             if (!di->fleecing.cbw) {
                 error_setg(errp, "appending cbw node for fleecing failed: %s",
                            local_err ? error_get_pretty(local_err) : "unknown error");
 +                bdrv_drained_end(di->bs);
                 break;
             }
@@ -599,6 +608,8 @@ static void create_backup_jobs_bh(void *opaque) {
             if (!di->fleecing.snapshot_access) {
                 error_setg(errp, "setting up snapshot access for fleecing failed: %s",
                            local_err ? error_get_pretty(local_err) : "unknown error");
 +                cleanup_snapshot_access(di);
 +                bdrv_drained_end(di->bs);
                 break;
             }
             source_bs = di->fleecing.snapshot_access;
@@ -637,6 +648,7 @@ static void create_backup_jobs_bh(void *opaque) {
         }
         if (!job || local_err) {
 +            cleanup_snapshot_access(di);
             error_setg(errp, "backup_job_create failed: %s",
                        local_err ? error_get_pretty(local_err) : "null");
             break;
--- a/debian/patches/pve/0048-block-add-alloc-track-driver.patch
+++ b/debian/patches/pve/0048-block-add-alloc-track-driver.patch
@@ -19,33 +19,26 @@ well.
 This only worked if the target supports backing images, so up until now
 only for qcow2, with alloc-track any driver for the target can be used.
-Replacing the node cannot be done in the
+If 'auto-remove' is set, alloc-track will automatically detach itself
-track_co_change_backing_file() callback, because replacing a node
+once the backing image is removed. It will be replaced by 'file'.
 cannot happen in a coroutine and requires the block graph lock
 exclusively. Could either become a special option for the stream job,
 or maybe the upcoming blockdev-replace QMP command can be used in the
 future.
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 [FE: adapt to changed function signatures
-     make error return value consistent with QEMU
+     make error return value consistent with QEMU]
     avoid premature break during read
     adhere to block graph lock requirements]
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
- block/alloc-track.c | 366 ++++++++++++++++++++++++++++++++++++++++++++
+ block/alloc-track.c | 350 ++++++++++++++++++++++++++++++++++++++++++++
 block/meson.build   |   1 +
- block/stream.c      |  34 ++++
+ 2 files changed, 351 insertions(+)
 3 files changed, 401 insertions(+)
 create mode 100644 block/alloc-track.c
 diff --git a/block/alloc-track.c b/block/alloc-track.c
 new file mode 100644
-index 0000000000..b4a9851144
+index 0000000000..43d40d11af
 --- /dev/null
 +++ b/block/alloc-track.c
-@@ -0,0 +1,366 @@
+@@ -0,0 +1,350 @@
 +/*
 + * Node to allow backing images to be applied to any node. Assumes a blank
 + * image to begin with, only new writes are tracked as allocated, thus this
@@ -61,12 +54,9 @@ index 0000000000..b4a9851144
 +#include "qemu/osdep.h"
 +#include "qapi/error.h"
 +#include "block/block_int.h"
 +#include "block/dirty-bitmap.h"
 +#include "block/graph-lock.h"
 +#include "qapi/qmp/qdict.h"
 +#include "qapi/qmp/qstring.h"
 +#include "qemu/cutils.h"
 +#include "qemu/error-report.h"
 +#include "qemu/option.h"
 +#include "qemu/module.h"
 +#include "sysemu/block-backend.h"
@@ -75,12 +65,12 @@ index 0000000000..b4a9851144
 +
 +typedef enum DropState {
 +    DropNone,
 +    DropRequested,
 +    DropInProgress,
 +} DropState;
 +
 +typedef struct {
 +    BdrvDirtyBitmap *bitmap;
 +    uint64_t granularity;
 +    DropState drop_state;
 +    bool auto_remove;
 +} BDRVAllocTrackState;
@@ -99,29 +89,26 @@ index 0000000000..b4a9851144
 +    },
 +};
 +
-+static void GRAPH_RDLOCK
+static void track_refresh_limits(BlockDriverState *bs, Error **errp)
 +track_refresh_limits(BlockDriverState *bs, Error **errp)
 +{
-+    BDRVAllocTrackState *s = bs->opaque;
+    BlockDriverInfo bdi;
 +
 +    if (!bs->file) {
 +        return;
 +    }
 +
-+    /*
+    /* always use alignment from underlying write device so RMW cycle for
-+     * Always use alignment from underlying write device so RMW cycle for
+     * bdrv_pwritev reads data from our backing via track_co_preadv (no partial
-+     * bdrv_pwritev reads data from our backing via track_co_preadv. Also use at
+     * cluster allocation in 'file') */
-+     * least the bitmap granularity.
+    bdrv_get_info(bs->file->bs, &bdi);
 +     */
 +    bs->bl.request_alignment = MAX(bs->file->bs->bl.request_alignment,
-+                                   s->granularity);
+                                   MAX(bdi.cluster_size, BDRV_SECTOR_SIZE));
 +}
 +
 +static int track_open(BlockDriverState *bs, QDict *options, int flags,
 +                      Error **errp)
 +{
 +    BDRVAllocTrackState *s = bs->opaque;
 +    BdrvChild *file = NULL;
 +    QemuOpts *opts;
 +    Error *local_err = NULL;
 +    int ret = 0;
@@ -137,45 +124,18 @@ index 0000000000..b4a9851144
 +    s->auto_remove = qemu_opt_get_bool(opts, TRACK_OPT_AUTO_REMOVE, false);
 +
 +    /* open the target (write) node, backing will be attached by block layer */
-+    file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
+    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
 +                               BDRV_CHILD_DATA | BDRV_CHILD_METADATA, false,
 +                               &local_err);
 +    bdrv_graph_wrlock();
 +    bs->file = file;
 +    bdrv_graph_wrunlock();
 +    if (local_err) {
 +        ret = -EINVAL;
 +        error_propagate(errp, local_err);
 +        goto fail;
 +    }
 +
 +    bdrv_graph_rdlock_main_loop();
 +    BlockDriverInfo bdi = {0};
 +    ret = bdrv_get_info(bs->file->bs, &bdi);
 +    if (ret < 0) {
 +        /*
 +         * Not a hard failure. Worst that can happen is partial cluster
 +         * allocation in the write target. However, the driver here returns its
 +         * allocation status based on the dirty bitmap, so any other data that
 +         * maps to such a cluster will still be copied later by a stream job (or
 +         * during writes to that cluster).
 +         */
 +        warn_report("alloc-track: unable to query cluster size for write target: %s",
 +                    strerror(ret));
 +    }
 +    ret = 0;
 +    /*
 +     * Always consider alignment from underlying write device so RMW cycle for
 +     * bdrv_pwritev reads data from our backing via track_co_preadv. Also try to
 +     * avoid partial cluster allocation in the write target by considering the
 +     * cluster size.
 +     */
 +    s->granularity = MAX(bs->file->bs->bl.request_alignment,
 +                         MAX(bdi.cluster_size, BDRV_SECTOR_SIZE));
 +    track_refresh_limits(bs, errp);
-+    s->bitmap = bdrv_create_dirty_bitmap(bs->file->bs, s->granularity, NULL,
+    uint64_t gran = bs->bl.request_alignment;
-+                                         &local_err);
+    s->bitmap = bdrv_create_dirty_bitmap(bs->file->bs, gran, NULL, &local_err);
 +    bdrv_graph_rdunlock_main_loop();
 +    if (local_err) {
 +        ret = -EIO;
 +        error_propagate(errp, local_err);
@@ -186,9 +146,7 @@ index 0000000000..b4a9851144
 +
 +fail:
 +    if (ret < 0) {
 +        bdrv_graph_wrlock();
 +        bdrv_unref_child(bs, bs->file);
 +        bdrv_graph_wrunlock();
 +        if (s->bitmap) {
 +            bdrv_release_dirty_bitmap(s->bitmap);
 +        }
@@ -205,15 +163,13 @@ index 0000000000..b4a9851144
 +    }
 +}
 +
-+static coroutine_fn int64_t GRAPH_RDLOCK
+static int64_t track_getlength(BlockDriverState *bs)
 +track_co_getlength(BlockDriverState *bs)
 +{
-+    return bdrv_co_getlength(bs->file->bs);
+    return bdrv_getlength(bs->file->bs);
 +}
 +
-+static int coroutine_fn GRAPH_RDLOCK
+static int coroutine_fn track_co_preadv(BlockDriverState *bs,
-+track_co_preadv(BlockDriverState *bs, int64_t offset, int64_t bytes,
+    int64_t offset, int64_t bytes, QEMUIOVector *qiov, BdrvRequestFlags flags)
 +                QEMUIOVector *qiov, BdrvRequestFlags flags)
 +{
 +    BDRVAllocTrackState *s = bs->opaque;
 +    QEMUIOVector local_qiov;
@@ -259,8 +215,7 @@ index 0000000000..b4a9851144
 +            ret = bdrv_co_preadv(bs->backing, local_offset, local_bytes,
 +                                 &local_qiov, flags);
 +        } else {
-+            qemu_iovec_memset(&local_qiov, cur_offset, 0, local_bytes);
+            ret = qemu_iovec_memset(&local_qiov, cur_offset, 0, local_bytes);
 +            ret = 0;
 +        }
 +
 +        if (ret != 0) {
@@ -271,34 +226,31 @@ index 0000000000..b4a9851144
 +    return ret;
 +}
 +
-+static int coroutine_fn GRAPH_RDLOCK
+static int coroutine_fn track_co_pwritev(BlockDriverState *bs,
-+track_co_pwritev(BlockDriverState *bs, int64_t offset, int64_t bytes,
+    int64_t offset, int64_t bytes, QEMUIOVector *qiov, BdrvRequestFlags flags)
 +                 QEMUIOVector *qiov, BdrvRequestFlags flags)
 +{
 +    return bdrv_co_pwritev(bs->file, offset, bytes, qiov, flags);
 +}
 +
-+static int coroutine_fn GRAPH_RDLOCK
+static int coroutine_fn track_co_pwrite_zeroes(BlockDriverState *bs,
-+track_co_pwrite_zeroes(BlockDriverState *bs, int64_t offset, int64_t bytes,
+    int64_t offset, int64_t bytes, BdrvRequestFlags flags)
 +                       BdrvRequestFlags flags)
 +{
 +    return bdrv_co_pwrite_zeroes(bs->file, offset, bytes, flags);
 +}
 +
-+static int coroutine_fn GRAPH_RDLOCK
+static int coroutine_fn track_co_pdiscard(BlockDriverState *bs,
-+track_co_pdiscard(BlockDriverState *bs, int64_t offset, int64_t bytes)
+    int64_t offset, int64_t bytes)
 +{
 +    return bdrv_co_pdiscard(bs->file, offset, bytes);
 +}
 +
-+static coroutine_fn int GRAPH_RDLOCK
+static coroutine_fn int track_co_flush(BlockDriverState *bs)
 +track_co_flush(BlockDriverState *bs)
 +{
 +    return bdrv_co_flush(bs->file->bs);
 +}
 +
-+static int coroutine_fn GRAPH_RDLOCK
+static int coroutine_fn track_co_block_status(BlockDriverState *bs,
-+track_co_block_status(BlockDriverState *bs, bool want_zero,
+                                              bool want_zero,
 +                                              int64_t offset,
 +                                              int64_t bytes,
 +                                              int64_t *pnum,
@@ -329,9 +281,9 @@ index 0000000000..b4a9851144
 +    return 0;
 +}
 +
-+static void GRAPH_RDLOCK
+static void track_child_perm(BlockDriverState *bs, BdrvChild *c,
-+track_child_perm(BlockDriverState *bs, BdrvChild *c, BdrvChildRole role,
+                             BdrvChildRole role, BlockReopenQueue *reopen_queue,
-+                 BlockReopenQueue *reopen_queue, uint64_t perm, uint64_t shared,
+                             uint64_t perm, uint64_t shared,
 +                             uint64_t *nperm, uint64_t *nshared)
 +{
 +    BDRVAllocTrackState *s = bs->opaque;
@@ -355,28 +307,53 @@ index 0000000000..b4a9851144
 +    }
 +}
 +
-+static int coroutine_fn GRAPH_RDLOCK
+static void track_drop(void *opaque)
 +track_co_change_backing_file(BlockDriverState *bs, const char *backing_file,
 +                             const char *backing_fmt)
 +{
-+    /*
+    BlockDriverState *bs = (BlockDriverState*)opaque;
-+     * Note that the actual backing file graph change is already done in the
+    BlockDriverState *file = bs->file->bs;
 +     * stream job itself with bdrv_set_backing_hd_drained(), so no need to
 +     * actually do anything here. But still needs to be implemented, to make
 +     * our caller (i.e. bdrv_co_change_backing_file() do the right thing).
 +     *
 +     * FIXME
 +     * We'd like to auto-remove ourselves from the block graph, but it cannot
 +     * be done from a coroutine. Currently done in the stream job, where it
 +     * kinda fits better, but in the long-term, a special parameter would be
 +     * nice (or done via qemu-server via upcoming blockdev-replace QMP command).
 +     */
 +    if (backing_file == NULL) {
 +    BDRVAllocTrackState *s = bs->opaque;
 +
 +    assert(file);
 +
 +    /* we rely on the fact that we're not used anywhere else, so let's wait
 +     * until we're only used once - in the drive connected to the guest (and one
 +     * ref is held by bdrv_ref in track_change_backing_file) */
 +    if (bs->refcnt > 2) {
 +        aio_bh_schedule_oneshot(qemu_get_aio_context(), track_drop, opaque);
 +        return;
 +    }
 +    AioContext *aio_context = bdrv_get_aio_context(bs);
 +    aio_context_acquire(aio_context);
 +
 +    bdrv_drained_begin(bs);
 +
 +    /* now that we're drained, we can safely set 'DropInProgress' */
 +    s->drop_state = DropInProgress;
 +    bdrv_child_refresh_perms(bs, bs->file, &error_abort);
 +
 +    bdrv_replace_node(bs, file, &error_abort);
 +    bdrv_set_backing_hd(bs, NULL, &error_abort);
 +    bdrv_drained_end(bs);
 +    bdrv_unref(bs);
 +    aio_context_release(aio_context);
 +}
 +
 +static int track_change_backing_file(BlockDriverState *bs,
 +                                     const char *backing_file,
 +                                     const char *backing_fmt)
 +{
 +    BDRVAllocTrackState *s = bs->opaque;
 +    if (s->auto_remove && s->drop_state == DropNone &&
 +        backing_file == NULL && backing_fmt == NULL)
 +    {
 +        /* backing file has been disconnected, there's no longer any use for
 +         * this node, so let's remove ourselves from the block graph - we need
 +         * to schedule this for later however, since when this function is
 +         * called, the blockjob modifying us is probably not done yet and has a
 +         * blocker on 'bs' */
 +        s->drop_state = DropRequested;
 +        bdrv_ref(bs);
 +        aio_bh_schedule_oneshot(qemu_get_aio_context(), track_drop, (void*)bs);
 +    }
 +
 +    return 0;
@@ -386,9 +363,9 @@ index 0000000000..b4a9851144
 +    .format_name                      = "alloc-track",
 +    .instance_size                    = sizeof(BDRVAllocTrackState),
 +
-+    .bdrv_open                        = track_open,
+    .bdrv_file_open                   = track_open,
 +    .bdrv_close                       = track_close,
-+    .bdrv_co_getlength                = track_co_getlength,
+    .bdrv_getlength                   = track_getlength,
 +    .bdrv_child_perm                  = track_child_perm,
 +    .bdrv_refresh_limits              = track_refresh_limits,
 +
@@ -403,7 +380,7 @@ index 0000000000..b4a9851144
 +    .supports_backing                 = true,
 +
 +    .bdrv_co_block_status             = track_co_block_status,
-+    .bdrv_co_change_backing_file      = track_co_change_backing_file,
+    .bdrv_change_backing_file         = track_change_backing_file,
 +};
 +
 +static void bdrv_alloc_track_init(void)
@@ -413,7 +390,7 @@ index 0000000000..b4a9851144
 +
 +block_init(bdrv_alloc_track_init);
 diff --git a/block/meson.build b/block/meson.build
-index e178047ec9..7ef7250d31 100644
+index a26a69434e..74e5f49758 100644
 --- a/block/meson.build
 +++ b/block/meson.build
@@ -2,6 +2,7 @@ block_ss.add(genh)
@@ -424,48 +401,3 @@ index e178047ec9..7ef7250d31 100644
   'amend.c',
   'backup.c',
   'backup-dump.c',
 diff --git a/block/stream.c b/block/stream.c
 index d2da83ae7c..f941cba14e 100644
 --- a/block/stream.c
 +++ b/block/stream.c
@@ -120,6 +120,40 @@ static int stream_prepare(Job *job)
             ret = -EPERM;
             goto out;
         }
 +
 +        /*
 +         * This cannot be done in the co_change_backing_file callback, because
 +         * bdrv_replace_node() cannot be done in a coroutine. The latter also
 +         * requires the graph lock exclusively. Only required for the
 +         * alloc-track driver.
 +         *
 +         * The long-term plan is to either have an explicit parameter for the
 +         * stream job or use the upcoming blockdev-replace QMP command.
 +         */
 +        if (base_id == NULL && strcmp(unfiltered_bs->drv->format_name, "alloc-track") == 0) {
 +            BlockDriverState *file_bs;
 +
 +            bdrv_graph_rdlock_main_loop();
 +            file_bs = unfiltered_bs->file->bs;
 +            bdrv_graph_rdunlock_main_loop();
 +
 +            bdrv_ref(unfiltered_bs); // unrefed by bdrv_replace_node()
 +            bdrv_drained_begin(file_bs);
 +            bdrv_graph_wrlock();
 +
 +            bdrv_replace_node(unfiltered_bs, file_bs, &local_err);
 +
 +            bdrv_graph_wrunlock();
 +            bdrv_drained_end(file_bs);
 +            bdrv_unref(unfiltered_bs);
 +
 +            if (local_err) {
 +                error_prepend(&local_err, "failed to replace alloc-track node: ");
 +                error_report_err(local_err);
 +                ret = -EPERM;
 +                goto out;
 +            }
 +        }
     }
 out:
--- a/debian/patches/pve/0049-PVE-backup-factor-out-setting-up-snapshot-access-for.patch
+++ b/debian/patches/pve/0049-PVE-backup-factor-out-setting-up-snapshot-access-for.patch
@@ -1,135 +0,0 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Fiona Ebner <f.ebner@proxmox.com>
 Date: Thu, 7 Nov 2024 17:51:15 +0100
 Subject: [PATCH] PVE backup: factor out setting up snapshot access for
 fleecing
 Avoids some line bloat in the create_backup_jobs_bh() function and is
 in preparation for setting up the snapshot access independently of
 fleecing, in particular that will be useful for providing access to
 the snapshot via NBD.
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 pve-backup.c | 95 ++++++++++++++++++++++++++++++++--------------------
 1 file changed, 58 insertions(+), 37 deletions(-)
 diff --git a/pve-backup.c b/pve-backup.c
 index 167f0b5c3f..f136d004c4 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
@@ -525,6 +525,62 @@ static int coroutine_fn pvebackup_co_add_config(
     goto out;
 }
 +/*
 + * Setup a snapshot-access block node for a device with associated fleecing image.
 + */
 +static int setup_snapshot_access(PVEBackupDevInfo *di, Error **errp)
 +{
 +    Error *local_err = NULL;
 +
 +    if (!di->fleecing.bs) {
 +        error_setg(errp, "no associated fleecing image");
 +        return -1;
 +    }
 +
 +    QDict *cbw_opts = qdict_new();
 +    qdict_put_str(cbw_opts, "driver", "copy-before-write");
 +    qdict_put_str(cbw_opts, "file", bdrv_get_node_name(di->bs));
 +    qdict_put_str(cbw_opts, "target", bdrv_get_node_name(di->fleecing.bs));
 +
 +    if (di->bitmap) {
 +        /*
 +         * Only guest writes to parts relevant for the backup need to be intercepted with
 +         * old data being copied to the fleecing image.
 +         */
 +        qdict_put_str(cbw_opts, "bitmap.node", bdrv_get_node_name(di->bs));
 +        qdict_put_str(cbw_opts, "bitmap.name", bdrv_dirty_bitmap_name(di->bitmap));
 +    }
 +    /*
 +     * Fleecing storage is supposed to be fast and it's better to break backup than guest
 +     * writes. Certain guest drivers like VirtIO-win have 60 seconds timeout by default, so
 +     * abort a bit before that.
 +     */
 +    qdict_put_str(cbw_opts, "on-cbw-error", "break-snapshot");
 +    qdict_put_int(cbw_opts, "cbw-timeout", 45);
 +
 +    di->fleecing.cbw = bdrv_insert_node(di->bs, cbw_opts, BDRV_O_RDWR, &local_err);
 +
 +    if (!di->fleecing.cbw) {
 +        error_setg(errp, "appending cbw node for fleecing failed: %s",
 +                   local_err ? error_get_pretty(local_err) : "unknown error");
 +        return -1;
 +    }
 +
 +    QDict *snapshot_access_opts = qdict_new();
 +    qdict_put_str(snapshot_access_opts, "driver", "snapshot-access");
 +    qdict_put_str(snapshot_access_opts, "file", bdrv_get_node_name(di->fleecing.cbw));
 +
 +    di->fleecing.snapshot_access =
 +        bdrv_open(NULL, NULL, snapshot_access_opts, BDRV_O_RDWR | BDRV_O_UNMAP, &local_err);
 +    if (!di->fleecing.snapshot_access) {
 +        error_setg(errp, "setting up snapshot access for fleecing failed: %s",
 +                   local_err ? error_get_pretty(local_err) : "unknown error");
 +        return -1;
 +    }
 +
 +    return 0;
 +}
 +
 /*
  * backup_job_create can *not* be run from a coroutine, so this can't either.
  * The caller is responsible that backup_mutex is held nonetheless.
@@ -569,49 +625,14 @@ static void create_backup_jobs_bh(void *opaque) {
         const char *job_id = bdrv_get_device_name(di->bs);
         bdrv_graph_co_rdunlock();
         if (di->fleecing.bs) {
 -            QDict *cbw_opts = qdict_new();
 -            qdict_put_str(cbw_opts, "driver", "copy-before-write");
 -            qdict_put_str(cbw_opts, "file", bdrv_get_node_name(di->bs));
 -            qdict_put_str(cbw_opts, "target", bdrv_get_node_name(di->fleecing.bs));
 -
 -            if (di->bitmap) {
 -                /*
 -                 * Only guest writes to parts relevant for the backup need to be intercepted with
 -                 * old data being copied to the fleecing image.
 -                 */
 -                qdict_put_str(cbw_opts, "bitmap.node", bdrv_get_node_name(di->bs));
 -                qdict_put_str(cbw_opts, "bitmap.name", bdrv_dirty_bitmap_name(di->bitmap));
 -            }
 -            /*
 -             * Fleecing storage is supposed to be fast and it's better to break backup than guest
 -             * writes. Certain guest drivers like VirtIO-win have 60 seconds timeout by default, so
 -             * abort a bit before that.
 -             */
 -            qdict_put_str(cbw_opts, "on-cbw-error", "break-snapshot");
 -            qdict_put_int(cbw_opts, "cbw-timeout", 45);
 -
 -            di->fleecing.cbw = bdrv_insert_node(di->bs, cbw_opts, BDRV_O_RDWR, &local_err);
 -
 -            if (!di->fleecing.cbw) {
 -                error_setg(errp, "appending cbw node for fleecing failed: %s",
 -                           local_err ? error_get_pretty(local_err) : "unknown error");
 -                bdrv_drained_end(di->bs);
 -                break;
 -            }
 -
 -            QDict *snapshot_access_opts = qdict_new();
 -            qdict_put_str(snapshot_access_opts, "driver", "snapshot-access");
 -            qdict_put_str(snapshot_access_opts, "file", bdrv_get_node_name(di->fleecing.cbw));
 -
 -            di->fleecing.snapshot_access =
 -                bdrv_open(NULL, NULL, snapshot_access_opts, BDRV_O_RDWR | BDRV_O_UNMAP, &local_err);
 -            if (!di->fleecing.snapshot_access) {
 +            if (setup_snapshot_access(di, &local_err) < 0) {
                 error_setg(errp, "setting up snapshot access for fleecing failed: %s",
                            local_err ? error_get_pretty(local_err) : "unknown error");
                 cleanup_snapshot_access(di);
                 bdrv_drained_end(di->bs);
                 break;
             }
 +
             source_bs = di->fleecing.snapshot_access;
             discard_source = true;
--- a/debian/patches/pve/0049-PVE-whitelist-invalid-QAPI-names-for-backwards-compa.patch
+++ b/debian/patches/pve/0049-PVE-whitelist-invalid-QAPI-names-for-backwards-compa.patch
@@ -0,0 +1,33 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Stefan Reiter <s.reiter@proxmox.com>
 Date: Wed, 26 May 2021 15:26:30 +0200
 Subject: [PATCH] PVE: whitelist 'invalid' QAPI names for backwards compat
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
 qapi/pragma.json | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)
 diff --git a/qapi/pragma.json b/qapi/pragma.json
 index a2358e303a..9ff5c84ffd 100644
 --- a/qapi/pragma.json
 +++ b/qapi/pragma.json
@@ -15,6 +15,7 @@
         'device_add',
         'device_del',
         'expire_password',
 +        'get_link_status',
         'migrate_cancel',
         'netdev_add',
         'netdev_del',
@@ -64,6 +65,8 @@
         'SysEmuTarget',             # query-cpu-fast, query-target
         'UuidInfo',                 # query-uuid
         'VncClientInfo',            # query-vnc, query-vnc-servers, ...
 -        'X86CPURegister32'          # qom-get of x86 CPU properties
 +        'X86CPURegister32',         # qom-get of x86 CPU properties
                                     # feature-words, filtered-features
 +        'BlockdevOptionsPbs',       # for PBS backwards compat
 +        'BalloonInfo'
     ] } }
--- a/debian/patches/pve/0050-PVE-backup-save-device-name-in-device-info-structure.patch
+++ b/debian/patches/pve/0050-PVE-backup-save-device-name-in-device-info-structure.patch
@@ -1,135 +0,0 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Fiona Ebner <f.ebner@proxmox.com>
 Date: Thu, 7 Nov 2024 17:51:16 +0100
 Subject: [PATCH] PVE backup: save device name in device info structure
 The device name needs to be queried while holding the graph read lock
 and since it doesn't change during the whole operation, just get it
 once during setup and avoid the need to query it again in different
 places.
 Also in preparation to use it more often in error messages and for the
 upcoming external backup access API.
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 pve-backup.c | 29 +++++++++++++++--------------
 1 file changed, 15 insertions(+), 14 deletions(-)
 diff --git a/pve-backup.c b/pve-backup.c
 index f136d004c4..8ccb281c8c 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
@@ -94,6 +94,7 @@ typedef struct PVEBackupDevInfo {
     size_t size;
     uint64_t block_size;
     uint8_t dev_id;
 +    char* device_name;
     int completed_ret; // INT_MAX if not completed
     BdrvDirtyBitmap *bitmap;
     BlockDriverState *target;
@@ -327,6 +328,8 @@ static void coroutine_fn pvebackup_co_complete_stream(void *opaque)
     }
     di->bs = NULL;
 +    g_free(di->device_name);
 +    di->device_name = NULL;
     assert(di->target == NULL);
@@ -621,9 +624,6 @@ static void create_backup_jobs_bh(void *opaque) {
         BlockDriverState *source_bs = di->bs;
         bool discard_source = false;
 -        bdrv_graph_co_rdlock();
 -        const char *job_id = bdrv_get_device_name(di->bs);
 -        bdrv_graph_co_rdunlock();
         if (di->fleecing.bs) {
             if (setup_snapshot_access(di, &local_err) < 0) {
                 error_setg(errp, "setting up snapshot access for fleecing failed: %s",
@@ -654,7 +654,7 @@ static void create_backup_jobs_bh(void *opaque) {
         }
         BlockJob *job = backup_job_create(
 -            job_id, source_bs, di->target, backup_state.speed, sync_mode, di->bitmap,
 +            di->device_name, source_bs, di->target, backup_state.speed, sync_mode, di->bitmap,
             bitmap_mode, false, discard_source, NULL, &perf, BLOCKDEV_ON_ERROR_REPORT,
             BLOCKDEV_ON_ERROR_REPORT, JOB_DEFAULT, pvebackup_complete_cb, di, backup_state.txn,
             &local_err);
@@ -751,6 +751,7 @@ static GList coroutine_fn GRAPH_RDLOCK *get_device_info(
             }
             PVEBackupDevInfo *di = g_new0(PVEBackupDevInfo, 1);
             di->bs = bs;
 +            di->device_name = g_strdup(bdrv_get_device_name(bs));
             if (fleecing && device_uses_fleecing(*d)) {
                 g_autofree gchar *fleecing_devid = g_strconcat(*d, "-fleecing", NULL);
@@ -789,6 +790,7 @@ static GList coroutine_fn GRAPH_RDLOCK *get_device_info(
             PVEBackupDevInfo *di = g_new0(PVEBackupDevInfo, 1);
             di->bs = bs;
 +            di->device_name = g_strdup(bdrv_get_device_name(bs));
             di_list = g_list_append(di_list, di);
         }
     }
@@ -956,9 +958,6 @@ UuidInfo coroutine_fn *qmp_backup(
             di->block_size = dump_cb_block_size;
 -            bdrv_graph_co_rdlock();
 -            const char *devname = bdrv_get_device_name(di->bs);
 -            bdrv_graph_co_rdunlock();
             PBSBitmapAction action = PBS_BITMAP_ACTION_NOT_USED;
             size_t dirty = di->size;
@@ -973,7 +972,8 @@ UuidInfo coroutine_fn *qmp_backup(
                     }
                     action = PBS_BITMAP_ACTION_NEW;
                 } else {
 -                    expect_only_dirty = proxmox_backup_check_incremental(pbs, devname, di->size) != 0;
 +                    expect_only_dirty =
 +                        proxmox_backup_check_incremental(pbs, di->device_name, di->size) != 0;
                 }
                 if (expect_only_dirty) {
@@ -997,7 +997,8 @@ UuidInfo coroutine_fn *qmp_backup(
                 }
             }
 -            int dev_id = proxmox_backup_co_register_image(pbs, devname, di->size, expect_only_dirty, errp);
 +            int dev_id = proxmox_backup_co_register_image(pbs, di->device_name, di->size,
 +                                                          expect_only_dirty, errp);
             if (dev_id < 0) {
                 goto err_mutex;
             }
@@ -1009,7 +1010,7 @@ UuidInfo coroutine_fn *qmp_backup(
             di->dev_id = dev_id;
             PBSBitmapInfo *info = g_malloc(sizeof(*info));
 -            info->drive = g_strdup(devname);
 +            info->drive = g_strdup(di->device_name);
             info->action = action;
             info->size = di->size;
             info->dirty = dirty;
@@ -1034,10 +1035,7 @@ UuidInfo coroutine_fn *qmp_backup(
                 goto err_mutex;
             }
 -            bdrv_graph_co_rdlock();
 -            const char *devname = bdrv_get_device_name(di->bs);
 -            bdrv_graph_co_rdunlock();
 -            di->dev_id = vma_writer_register_stream(vmaw, devname, di->size);
 +            di->dev_id = vma_writer_register_stream(vmaw, di->device_name, di->size);
             if (di->dev_id <= 0) {
                 error_set(errp, ERROR_CLASS_GENERIC_ERROR,
                           "register_stream failed");
@@ -1148,6 +1146,9 @@ err:
             bdrv_co_unref(di->target);
         }
 +        g_free(di->device_name);
 +        di->device_name = NULL;
 +
         g_free(di);
     }
     g_list_free(di_list);
--- a/debian/patches/pve/0050-PVE-savevm-async-register-yank-before-migration_inco.patch
+++ b/debian/patches/pve/0050-PVE-savevm-async-register-yank-before-migration_inco.patch
@@ -0,0 +1,35 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Stefan Reiter <s.reiter@proxmox.com>
 Date: Wed, 26 May 2021 17:36:55 +0200
 Subject: [PATCH] PVE: savevm-async: register yank before
 migration_incoming_state_destroy
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
 migration/savevm-async.c | 5 +++++
 1 file changed, 5 insertions(+)
 diff --git a/migration/savevm-async.c b/migration/savevm-async.c
 index e65a5e3482..2ed2536816 100644
 --- a/migration/savevm-async.c
 +++ b/migration/savevm-async.c
@@ -20,6 +20,7 @@
 #include "qemu/timer.h"
 #include "qemu/main-loop.h"
 #include "qemu/rcu.h"
 +#include "qemu/yank.h"
 /* #define DEBUG_SAVEVM_STATE */
@@ -514,6 +515,10 @@ int load_snapshot_from_blockdev(const char *filename, Error **errp)
     dirty_bitmap_mig_before_vm_start();
     qemu_fclose(f);
 +
 +    /* state_destroy assumes a real migration which would have added a yank */
 +    yank_register_instance(MIGRATION_YANK_INSTANCE, &error_abort);
 +
     migration_incoming_state_destroy();
     if (ret < 0) {
         error_setg_errno(errp, -ret, "Error while loading VM state");
--- a/debian/patches/pve/0051-PVE-backup-include-device-name-in-error-when-setting.patch
+++ b/debian/patches/pve/0051-PVE-backup-include-device-name-in-error-when-setting.patch
@@ -1,25 +0,0 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Fiona Ebner <f.ebner@proxmox.com>
 Date: Thu, 7 Nov 2024 17:51:17 +0100
 Subject: [PATCH] PVE backup: include device name in error when setting up
 snapshot access fails
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 pve-backup.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
 diff --git a/pve-backup.c b/pve-backup.c
 index 8ccb281c8c..255465676c 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
@@ -626,7 +626,8 @@ static void create_backup_jobs_bh(void *opaque) {
         bool discard_source = false;
         if (di->fleecing.bs) {
             if (setup_snapshot_access(di, &local_err) < 0) {
 -                error_setg(errp, "setting up snapshot access for fleecing failed: %s",
 +                error_setg(errp, "%s - setting up snapshot access for fleecing failed: %s",
 +                           di->device_name,
                            local_err ? error_get_pretty(local_err) : "unknown error");
                 cleanup_snapshot_access(di);
                 bdrv_drained_end(di->bs);
--- a/debian/patches/pve/0051-qemu-img-dd-add-l-option-for-loading-a-snapshot.patch
+++ b/debian/patches/pve/0051-qemu-img-dd-add-l-option-for-loading-a-snapshot.patch
@@ -1,9 +1,9 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Fabian Ebner <f.ebner@proxmox.com>
 Date: Mon, 7 Feb 2022 14:21:01 +0100
-Subject: [PATCH] qemu-img dd: add -l option for loading a snapshot
+Subject: [PATCH] qemu-img: dd: add -l option for loading a snapshot
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
+Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
 docs/tools/qemu-img.rst |  6 +++---
@@ -12,10 +12,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 3 files changed, 36 insertions(+), 7 deletions(-)
 diff --git a/docs/tools/qemu-img.rst b/docs/tools/qemu-img.rst
-index d83e8fb3c0..61c6b21859 100644
+index 699229eef6..4189ced8bc 100644
 --- a/docs/tools/qemu-img.rst
 +++ b/docs/tools/qemu-img.rst
-@@ -496,10 +496,10 @@ Command description:
+@@ -492,10 +492,10 @@ Command description:
   it doesn't need to be specified separately in this case.
@@ -30,10 +30,10 @@ index d83e8fb3c0..61c6b21859 100644
   The data is by default read and written using blocks of 512 bytes but can be
   modified by specifying *BLOCK_SIZE*. If count=\ *BLOCKS* is specified
 diff --git a/qemu-img-cmds.hx b/qemu-img-cmds.hx
-index 0b29a67a06..758f397232 100644
+index b5b0bb4467..36f97e1f19 100644
 --- a/qemu-img-cmds.hx
 +++ b/qemu-img-cmds.hx
-@@ -60,9 +60,9 @@ SRST
+@@ -58,9 +58,9 @@ SRST
 ERST
 DEF("dd", img_dd,
@@ -46,10 +46,10 @@ index 0b29a67a06..758f397232 100644
 DEF("info", img_info,
 diff --git a/qemu-img.c b/qemu-img.c
-index 6fc8384f64..a6c88e0860 100644
+index c6b4a5567d..041c203fc3 100644
 --- a/qemu-img.c
 +++ b/qemu-img.c
-@@ -5110,6 +5110,7 @@ static int img_dd(int argc, char **argv)
+@@ -4943,6 +4943,7 @@ static int img_dd(int argc, char **argv)
     BlockDriver *drv = NULL, *proto_drv = NULL;
     BlockBackend *blk1 = NULL, *blk2 = NULL;
     QemuOpts *opts = NULL;
@@ -57,15 +57,15 @@ index 6fc8384f64..a6c88e0860 100644
     QemuOptsList *create_opts = NULL;
     Error *local_err = NULL;
     bool image_opts = false;
-@@ -5119,6 +5120,7 @@ static int img_dd(int argc, char **argv)
+@@ -4952,6 +4953,7 @@ static int img_dd(int argc, char **argv)
     int64_t size = 0, readsize = 0;
-     int64_t out_pos, in_pos;
+     int64_t block_count = 0, out_pos, in_pos;
     bool force_share = false, skip_create = false;
 +    const char *snapshot_name = NULL;
     struct DdInfo dd = {
         .flags = 0,
         .count = 0,
-@@ -5156,7 +5158,7 @@ static int img_dd(int argc, char **argv)
+@@ -4989,7 +4991,7 @@ static int img_dd(int argc, char **argv)
         { 0, 0, 0, 0 }
     };
@@ -74,7 +74,7 @@ index 6fc8384f64..a6c88e0860 100644
         if (c == EOF) {
             break;
         }
-@@ -5179,6 +5181,19 @@ static int img_dd(int argc, char **argv)
+@@ -5012,6 +5014,19 @@ static int img_dd(int argc, char **argv)
         case 'n':
             skip_create = true;
             break;
@@ -94,7 +94,7 @@ index 6fc8384f64..a6c88e0860 100644
         case 'U':
             force_share = true;
             break;
-@@ -5238,11 +5253,24 @@ static int img_dd(int argc, char **argv)
+@@ -5071,11 +5086,24 @@ static int img_dd(int argc, char **argv)
     if (dd.flags & C_IF) {
         blk1 = img_open(image_opts, in.filename, fmt, 0, false, false,
                         force_share);
@@ -120,7 +120,7 @@ index 6fc8384f64..a6c88e0860 100644
     }
     if (dd.flags & C_OSIZE) {
-@@ -5397,6 +5425,7 @@ static int img_dd(int argc, char **argv)
+@@ -5230,6 +5258,7 @@ static int img_dd(int argc, char **argv)
 out:
     g_free(arg);
     qemu_opts_del(opts);
--- a/debian/patches/pve/0052-vma-allow-partial-restore.patch
+++ b/debian/patches/pve/0052-vma-allow-partial-restore.patch
@@ -0,0 +1,407 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Fabian Ebner <f.ebner@proxmox.com>
 Date: Thu, 21 Apr 2022 13:26:48 +0200
 Subject: [PATCH] vma: allow partial restore
 Introduce a new map line for skipping a certain drive, of the form
 skip=drive-scsi0
 Since in PVE, most archives are compressed and piped to vma for
 restore, it's not easily possible to skip reads.
 For the reader, a new skip flag for VmaRestoreState is added and the
 target is allowed to be NULL if skip is specified when registering. If
 the skip flag is set, no writes will be made as well as no check for
 duplicate clusters. Therefore, the flag is not set for verify.
 Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 Acked-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
 vma-reader.c |  64 ++++++++++++---------
 vma.c        | 157 +++++++++++++++++++++++++++++----------------------
 vma.h        |   2 +-
 3 files changed, 126 insertions(+), 97 deletions(-)
 diff --git a/vma-reader.c b/vma-reader.c
 index e65f1e8415..81a891c6b1 100644
 --- a/vma-reader.c
 +++ b/vma-reader.c
@@ -28,6 +28,7 @@ typedef struct VmaRestoreState {
     bool write_zeroes;
     unsigned long *bitmap;
     int bitmap_size;
 +    bool skip;
 }  VmaRestoreState;
 struct VmaReader {
@@ -425,13 +426,14 @@ VmaDeviceInfo *vma_reader_get_device_info(VmaReader *vmar, guint8 dev_id)
 }
 static void allocate_rstate(VmaReader *vmar,  guint8 dev_id,
 -                            BlockBackend *target, bool write_zeroes)
 +                            BlockBackend *target, bool write_zeroes, bool skip)
 {
     assert(vmar);
     assert(dev_id);
     vmar->rstate[dev_id].target = target;
     vmar->rstate[dev_id].write_zeroes = write_zeroes;
 +    vmar->rstate[dev_id].skip = skip;
     int64_t size = vmar->devinfo[dev_id].size;
@@ -446,28 +448,30 @@ static void allocate_rstate(VmaReader *vmar,  guint8 dev_id,
 }
 int vma_reader_register_bs(VmaReader *vmar, guint8 dev_id, BlockBackend *target,
 -                           bool write_zeroes, Error **errp)
 +                           bool write_zeroes, bool skip, Error **errp)
 {
     assert(vmar);
 -    assert(target != NULL);
 +    assert(target != NULL || skip);
     assert(dev_id);
 -    assert(vmar->rstate[dev_id].target == NULL);
 -
 -    int64_t size = blk_getlength(target);
 -    int64_t size_diff = size - vmar->devinfo[dev_id].size;
 -
 -    /* storage types can have different size restrictions, so it
 -     * is not always possible to create an image with exact size.
 -     * So we tolerate a size difference up to 4MB.
 -     */
 -    if ((size_diff < 0) || (size_diff > 4*1024*1024)) {
 -        error_setg(errp, "vma_reader_register_bs for stream %s failed - "
 -                   "unexpected size %zd != %zd", vmar->devinfo[dev_id].devname,
 -                   size, vmar->devinfo[dev_id].size);
 -        return -1;
 +    assert(vmar->rstate[dev_id].target == NULL && !vmar->rstate[dev_id].skip);
 +
 +    if (target != NULL) {
 +        int64_t size = blk_getlength(target);
 +        int64_t size_diff = size - vmar->devinfo[dev_id].size;
 +
 +        /* storage types can have different size restrictions, so it
 +         * is not always possible to create an image with exact size.
 +         * So we tolerate a size difference up to 4MB.
 +         */
 +        if ((size_diff < 0) || (size_diff > 4*1024*1024)) {
 +            error_setg(errp, "vma_reader_register_bs for stream %s failed - "
 +                       "unexpected size %zd != %zd", vmar->devinfo[dev_id].devname,
 +                       size, vmar->devinfo[dev_id].size);
 +            return -1;
 +        }
     }
 -    allocate_rstate(vmar, dev_id, target, write_zeroes);
 +    allocate_rstate(vmar, dev_id, target, write_zeroes, skip);
     return 0;
 }
@@ -560,19 +564,23 @@ static int restore_extent(VmaReader *vmar, unsigned char *buf,
         VmaRestoreState *rstate = &vmar->rstate[dev_id];
         BlockBackend *target = NULL;
 +        bool skip = rstate->skip;
 +
         if (dev_id != vmar->vmstate_stream) {
             target = rstate->target;
 -            if (!verify && !target) {
 +            if (!verify && !target && !skip) {
                 error_setg(errp, "got wrong dev id %d", dev_id);
                 return -1;
             }
 -            if (vma_reader_get_bitmap(rstate, cluster_num)) {
 -                error_setg(errp, "found duplicated cluster %zd for stream %s",
 -                          cluster_num, vmar->devinfo[dev_id].devname);
 -                return -1;
 +            if (!skip) {
 +                if (vma_reader_get_bitmap(rstate, cluster_num)) {
 +                    error_setg(errp, "found duplicated cluster %zd for stream %s",
 +                              cluster_num, vmar->devinfo[dev_id].devname);
 +                    return -1;
 +                }
 +                vma_reader_set_bitmap(rstate, cluster_num, 1);
             }
 -            vma_reader_set_bitmap(rstate, cluster_num, 1);
             max_sector = vmar->devinfo[dev_id].size/BDRV_SECTOR_SIZE;
         } else {
@@ -618,7 +626,7 @@ static int restore_extent(VmaReader *vmar, unsigned char *buf,
                 return -1;
             }
 -            if (!verify) {
 +            if (!verify && !skip) {
                 int nb_sectors = end_sector - sector_num;
                 if (restore_write_data(vmar, dev_id, target, vmstate_fd,
                                        buf + start, sector_num, nb_sectors,
@@ -654,7 +662,7 @@ static int restore_extent(VmaReader *vmar, unsigned char *buf,
                         return -1;
                     }
 -                    if (!verify) {
 +                    if (!verify && !skip) {
                         int nb_sectors = end_sector - sector_num;
                         if (restore_write_data(vmar, dev_id, target, vmstate_fd,
                                                buf + start, sector_num,
@@ -679,7 +687,7 @@ static int restore_extent(VmaReader *vmar, unsigned char *buf,
                             vmar->partial_zero_cluster_data += zero_size;
                         }
 -                        if (rstate->write_zeroes && !verify) {
 +                        if (rstate->write_zeroes && !verify && !skip) {
                             if (restore_write_data(vmar, dev_id, target, vmstate_fd,
                                                    zero_vma_block, sector_num,
                                                    nb_sectors, errp) < 0) {
@@ -850,7 +858,7 @@ int vma_reader_verify(VmaReader *vmar, bool verbose, Error **errp)
     for (dev_id = 1; dev_id < 255; dev_id++) {
         if (vma_reader_get_device_info(vmar, dev_id)) {
 -            allocate_rstate(vmar, dev_id, NULL, false);
 +            allocate_rstate(vmar, dev_id, NULL, false, false);
         }
     }
 diff --git a/vma.c b/vma.c
 index e8dffb43e0..e6e9ffc7fe 100644
 --- a/vma.c
 +++ b/vma.c
@@ -138,6 +138,7 @@ typedef struct RestoreMap {
     char *throttling_group;
     char *cache;
     bool write_zero;
 +    bool skip;
 } RestoreMap;
 static bool try_parse_option(char **line, const char *optname, char **out, const char *inbuf) {
@@ -245,47 +246,61 @@ static int extract_content(int argc, char **argv)
             char *bps = NULL;
             char *group = NULL;
             char *cache = NULL;
 +            char *devname = NULL;
 +            bool skip = false;
 +            uint64_t bps_value = 0;
 +            const char *path = NULL;
 +            bool write_zero = true;
 +
             if (!line || line[0] == '\0' || !strcmp(line, "done\n")) {
                 break;
             }
             int len = strlen(line);
             if (line[len - 1] == '\n') {
                 line[len - 1] = '\0';
 -                if (len == 1) {
 +                len = len - 1;
 +                if (len == 0) {
                     break;
                 }
             }
 -            while (1) {
 -                if (!try_parse_option(&line, "format", &format, inbuf) &&
 -                    !try_parse_option(&line, "throttling.bps", &bps, inbuf) &&
 -                    !try_parse_option(&line, "throttling.group", &group, inbuf) &&
 -                    !try_parse_option(&line, "cache", &cache, inbuf))
 -                {
 -                    break;
 +            if (strncmp(line, "skip", 4) == 0) {
 +                if (len < 6 || line[4] != '=') {
 +                    g_error("read map failed - option 'skip' has no value ('%s')",
 +                            inbuf);
 +                } else {
 +                    devname = line + 5;
 +                    skip = true;
 +                }
 +            } else {
 +                while (1) {
 +                    if (!try_parse_option(&line, "format", &format, inbuf) &&
 +                        !try_parse_option(&line, "throttling.bps", &bps, inbuf) &&
 +                        !try_parse_option(&line, "throttling.group", &group, inbuf) &&
 +                        !try_parse_option(&line, "cache", &cache, inbuf))
 +                    {
 +                        break;
 +                    }
                 }
 -            }
 -            uint64_t bps_value = 0;
 -            if (bps) {
 -                bps_value = verify_u64(bps);
 -                g_free(bps);
 -            }
 +                if (bps) {
 +                    bps_value = verify_u64(bps);
 +                    g_free(bps);
 +                }
 -            const char *path;
 -            bool write_zero;
 -            if (line[0] == '0' && line[1] == ':') {
 -                path = line + 2;
 -                write_zero = false;
 -            } else if (line[0] == '1' && line[1] == ':') {
 -                path = line + 2;
 -                write_zero = true;
 -            } else {
 -                g_error("read map failed - parse error ('%s')", inbuf);
 +                if (line[0] == '0' && line[1] == ':') {
 +                    path = line + 2;
 +                    write_zero = false;
 +                } else if (line[0] == '1' && line[1] == ':') {
 +                    path = line + 2;
 +                    write_zero = true;
 +                } else {
 +                    g_error("read map failed - parse error ('%s')", inbuf);
 +                }
 +
 +                path = extract_devname(path, &devname, -1);
             }
 -            char *devname = NULL;
 -            path = extract_devname(path, &devname, -1);
             if (!devname) {
                 g_error("read map failed - no dev name specified ('%s')",
                         inbuf);
@@ -299,6 +314,7 @@ static int extract_content(int argc, char **argv)
             map->throttling_group = group;
             map->cache = cache;
             map->write_zero = write_zero;
 +            map->skip = skip;
             g_hash_table_insert(devmap, map->devname, map);
@@ -328,6 +344,7 @@ static int extract_content(int argc, char **argv)
             const char *cache = NULL;
             int flags = BDRV_O_RDWR;
             bool write_zero = true;
 +            bool skip = false;
             BlockBackend *blk = NULL;
@@ -343,6 +360,7 @@ static int extract_content(int argc, char **argv)
                 throttling_group = map->throttling_group;
                 cache = map->cache;
                 write_zero = map->write_zero;
 +                skip = map->skip;
             } else {
                 devfn = g_strdup_printf("%s/tmp-disk-%s.raw",
                                         dirname, di->devname);
@@ -361,57 +379,60 @@ static int extract_content(int argc, char **argv)
                 write_zero = false;
             }
 -	    size_t devlen = strlen(devfn);
 -	    QDict *options = NULL;
 -            bool writethrough;
 -            if (format) {
 -                /* explicit format from commandline */
 -                options = qdict_new();
 -                qdict_put_str(options, "driver", format);
 -            } else if ((devlen > 4 && strcmp(devfn+devlen-4, ".raw") == 0) ||
 -	               strncmp(devfn, "/dev/", 5) == 0)
 -	    {
 -                /* This part is now deprecated for PVE as well (just as qemu
 -                 * deprecated not specifying an explicit raw format, too.
 -                 */
 -		/* explicit raw format */
 -		options = qdict_new();
 -		qdict_put_str(options, "driver", "raw");
 -	    }
 -            if (cache && bdrv_parse_cache_mode(cache, &flags, &writethrough)) {
 -                g_error("invalid cache option: %s\n", cache);
 -            }
 +            if (!skip) {
 +                size_t devlen = strlen(devfn);
 +                QDict *options = NULL;
 +                bool writethrough;
 +                if (format) {
 +                    /* explicit format from commandline */
 +                    options = qdict_new();
 +                    qdict_put_str(options, "driver", format);
 +                } else if ((devlen > 4 && strcmp(devfn+devlen-4, ".raw") == 0) ||
 +                    strncmp(devfn, "/dev/", 5) == 0)
 +                {
 +                    /* This part is now deprecated for PVE as well (just as qemu
 +                     * deprecated not specifying an explicit raw format, too.
 +                     */
 +                    /* explicit raw format */
 +                    options = qdict_new();
 +                    qdict_put_str(options, "driver", "raw");
 +                }
 -	    if (errp || !(blk = blk_new_open(devfn, NULL, options, flags, &errp))) {
 -                g_error("can't open file %s - %s", devfn,
 -                        error_get_pretty(errp));
 -            }
 +                if (cache && bdrv_parse_cache_mode(cache, &flags, &writethrough)) {
 +                    g_error("invalid cache option: %s\n", cache);
 +                }
 -            if (cache) {
 -                blk_set_enable_write_cache(blk, !writethrough);
 -            }
 +                if (errp || !(blk = blk_new_open(devfn, NULL, options, flags, &errp))) {
 +                    g_error("can't open file %s - %s", devfn,
 +                            error_get_pretty(errp));
 +                }
 -            if (throttling_group) {
 -                blk_io_limits_enable(blk, throttling_group);
 -            }
 +                if (cache) {
 +                    blk_set_enable_write_cache(blk, !writethrough);
 +                }
 -            if (throttling_bps) {
 -                if (!throttling_group) {
 -                    blk_io_limits_enable(blk, devfn);
 +                if (throttling_group) {
 +                    blk_io_limits_enable(blk, throttling_group);
                 }
 -                ThrottleConfig cfg;
 -                throttle_config_init(&cfg);
 -                cfg.buckets[THROTTLE_BPS_WRITE].avg = throttling_bps;
 -                Error *err = NULL;
 -                if (!throttle_is_valid(&cfg, &err)) {
 -                    error_report_err(err);
 -                    g_error("failed to apply throttling");
 +                if (throttling_bps) {
 +                    if (!throttling_group) {
 +                        blk_io_limits_enable(blk, devfn);
 +                    }
 +
 +                    ThrottleConfig cfg;
 +                    throttle_config_init(&cfg);
 +                    cfg.buckets[THROTTLE_BPS_WRITE].avg = throttling_bps;
 +                    Error *err = NULL;
 +                    if (!throttle_is_valid(&cfg, &err)) {
 +                        error_report_err(err);
 +                        g_error("failed to apply throttling");
 +                    }
 +                    blk_set_io_limits(blk, &cfg);
                 }
 -                blk_set_io_limits(blk, &cfg);
             }
 -            if (vma_reader_register_bs(vmar, i, blk, write_zero, &errp) < 0) {
 +            if (vma_reader_register_bs(vmar, i, blk, write_zero, skip, &errp) < 0) {
                 g_error("%s", error_get_pretty(errp));
             }
 diff --git a/vma.h b/vma.h
 index c895c97f6d..1b62859165 100644
 --- a/vma.h
 +++ b/vma.h
@@ -142,7 +142,7 @@ GList *vma_reader_get_config_data(VmaReader *vmar);
 VmaDeviceInfo *vma_reader_get_device_info(VmaReader *vmar, guint8 dev_id);
 int vma_reader_register_bs(VmaReader *vmar, guint8 dev_id,
                            BlockBackend *target, bool write_zeroes,
 -                           Error **errp);
 +                           bool skip, Error **errp);
 int vma_reader_restore(VmaReader *vmar, int vmstate_fd, bool verbose,
                        Error **errp);
 int vma_reader_verify(VmaReader *vmar, bool verbose, Error **errp);
--- a/debian/patches/pve/0053-pbs-namespace-support.patch
+++ b/debian/patches/pve/0053-pbs-namespace-support.patch
@@ -0,0 +1,233 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Wolfgang Bumiller <w.bumiller@proxmox.com>
 Date: Tue, 26 Apr 2022 16:06:28 +0200
 Subject: [PATCH] pbs: namespace support
 Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
 ---
 block/monitor/block-hmp-cmds.c |  1 +
 block/pbs.c                    | 25 +++++++++++++++++++++----
 pbs-restore.c                  | 19 ++++++++++++++++---
 pve-backup.c                   |  6 +++++-
 qapi/block-core.json           |  5 ++++-
 5 files changed, 47 insertions(+), 9 deletions(-)
 diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
 index 4c799f00d9..0502f42be6 100644
 --- a/block/monitor/block-hmp-cmds.c
 +++ b/block/monitor/block-hmp-cmds.c
@@ -1041,6 +1041,7 @@ void coroutine_fn hmp_backup(Monitor *mon, const QDict *qdict)
         false, NULL, // PBS key_password
         false, NULL, // PBS master_keyfile
         false, NULL, // PBS fingerprint
 +        false, NULL, // PBS backup-ns
         false, NULL, // PBS backup-id
         false, 0, // PBS backup-time
         false, false, // PBS use-dirty-bitmap
 diff --git a/block/pbs.c b/block/pbs.c
 index c5eb4d5bad..7471e2ef9d 100644
 --- a/block/pbs.c
 +++ b/block/pbs.c
@@ -14,6 +14,7 @@
 #include <proxmox-backup-qemu.h>
 #define PBS_OPT_REPOSITORY "repository"
 +#define PBS_OPT_NAMESPACE "namespace"
 #define PBS_OPT_SNAPSHOT "snapshot"
 #define PBS_OPT_ARCHIVE "archive"
 #define PBS_OPT_KEYFILE "keyfile"
@@ -27,6 +28,7 @@ typedef struct {
     int64_t length;
     char *repository;
 +    char *namespace;
     char *snapshot;
     char *archive;
 } BDRVPBSState;
@@ -40,6 +42,11 @@ static QemuOptsList runtime_opts = {
             .type = QEMU_OPT_STRING,
             .help = "The server address and repository to connect to.",
         },
 +        {
 +            .name = PBS_OPT_NAMESPACE,
 +            .type = QEMU_OPT_STRING,
 +            .help = "Optional: The snapshot's namespace.",
 +        },
         {
             .name = PBS_OPT_SNAPSHOT,
             .type = QEMU_OPT_STRING,
@@ -76,7 +83,7 @@ static QemuOptsList runtime_opts = {
 // filename format:
 -// pbs:repository=<repo>,snapshot=<snap>,password=<pw>,key_password=<kpw>,fingerprint=<fp>,archive=<archive>
 +// pbs:repository=<repo>,namespace=<ns>,snapshot=<snap>,password=<pw>,key_password=<kpw>,fingerprint=<fp>,archive=<archive>
 static void pbs_parse_filename(const char *filename, QDict *options,
                                      Error **errp)
 {
@@ -112,6 +119,7 @@ static int pbs_open(BlockDriverState *bs, QDict *options, int flags,
     s->archive = g_strdup(qemu_opt_get(opts, PBS_OPT_ARCHIVE));
     const char *keyfile = qemu_opt_get(opts, PBS_OPT_KEYFILE);
     const char *password = qemu_opt_get(opts, PBS_OPT_PASSWORD);
 +    const char *namespace = qemu_opt_get(opts, PBS_OPT_NAMESPACE);
     const char *fingerprint = qemu_opt_get(opts, PBS_OPT_FINGERPRINT);
     const char *key_password = qemu_opt_get(opts, PBS_OPT_ENCRYPTION_PASSWORD);
@@ -124,9 +132,12 @@ static int pbs_open(BlockDriverState *bs, QDict *options, int flags,
     if (!key_password) {
         key_password = getenv("PBS_ENCRYPTION_PASSWORD");
     }
 +    if (namespace) {
 +        s->namespace = g_strdup(namespace);
 +    }
     /* connect to PBS server in read mode */
 -    s->conn = proxmox_restore_new(s->repository, s->snapshot, password,
 +    s->conn = proxmox_restore_new_ns(s->repository, s->snapshot, s->namespace, password,
         keyfile, key_password, fingerprint, &pbs_error);
     /* invalidates qemu_opt_get char pointers from above */
@@ -171,6 +182,7 @@ static int pbs_file_open(BlockDriverState *bs, QDict *options, int flags,
 static void pbs_close(BlockDriverState *bs) {
     BDRVPBSState *s = bs->opaque;
     g_free(s->repository);
 +    g_free(s->namespace);
     g_free(s->snapshot);
     g_free(s->archive);
     proxmox_restore_disconnect(s->conn);
@@ -252,8 +264,13 @@ static coroutine_fn int pbs_co_pwritev(BlockDriverState *bs,
 static void pbs_refresh_filename(BlockDriverState *bs)
 {
     BDRVPBSState *s = bs->opaque;
 -    snprintf(bs->exact_filename, sizeof(bs->exact_filename), "%s/%s(%s)",
 -             s->repository, s->snapshot, s->archive);
 +    if (s->namespace) {
 +        snprintf(bs->exact_filename, sizeof(bs->exact_filename), "%s/%s:%s(%s)",
 +                 s->repository, s->namespace, s->snapshot, s->archive);
 +    } else {
 +        snprintf(bs->exact_filename, sizeof(bs->exact_filename), "%s/%s(%s)",
 +                 s->repository, s->snapshot, s->archive);
 +    }
 }
 static const char *const pbs_strong_runtime_opts[] = {
 diff --git a/pbs-restore.c b/pbs-restore.c
 index 2f834cf42e..f03d9bab8d 100644
 --- a/pbs-restore.c
 +++ b/pbs-restore.c
@@ -29,7 +29,7 @@
 static void help(void)
 {
     const char *help_msg =
 -        "usage: pbs-restore [--repository <repo>] snapshot archive-name target [command options]\n"
 +        "usage: pbs-restore [--repository <repo>] [--ns namespace] snapshot archive-name target [command options]\n"
         ;
     printf("%s", help_msg);
@@ -77,6 +77,7 @@ int main(int argc, char **argv)
     Error *main_loop_err = NULL;
     const char *format = "raw";
     const char *repository = NULL;
 +    const char *backup_ns = NULL;
     const char *keyfile = NULL;
     int verbose = false;
     bool skip_zero = false;
@@ -90,6 +91,7 @@ int main(int argc, char **argv)
             {"verbose", no_argument, 0, 'v'},
             {"format", required_argument, 0, 'f'},
             {"repository", required_argument, 0, 'r'},
 +            {"ns", required_argument, 0, 'n'},
             {"keyfile", required_argument, 0, 'k'},
             {0, 0, 0, 0}
         };
@@ -110,6 +112,9 @@ int main(int argc, char **argv)
             case 'r':
                 repository = g_strdup(argv[optind - 1]);
                 break;
 +            case 'n':
 +                backup_ns = g_strdup(argv[optind - 1]);
 +                break;
             case 'k':
                 keyfile = g_strdup(argv[optind - 1]);
                 break;
@@ -160,8 +165,16 @@ int main(int argc, char **argv)
         fprintf(stderr, "connecting to repository '%s'\n", repository);
     }
     char *pbs_error = NULL;
 -    ProxmoxRestoreHandle *conn = proxmox_restore_new(
 -        repository, snapshot, password, keyfile, key_password, fingerprint, &pbs_error);
 +    ProxmoxRestoreHandle *conn = proxmox_restore_new_ns(
 +        repository,
 +        snapshot,
 +        backup_ns,
 +        password,
 +        keyfile,
 +        key_password,
 +        fingerprint,
 +        &pbs_error
 +    );
     if (conn == NULL) {
         fprintf(stderr, "restore failed: %s\n", pbs_error);
         return -1;
 diff --git a/pve-backup.c b/pve-backup.c
 index 9f6c04a512..f6a5f8c785 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
@@ -10,6 +10,8 @@
 #include "qapi/qmp/qerror.h"
 #include "qemu/cutils.h"
 +#include <proxmox-backup-qemu.h>
 +
 /* PVE backup state and related function */
 /*
@@ -535,6 +537,7 @@ UuidInfo coroutine_fn *qmp_backup(
     bool has_key_password, const char *key_password,
     bool has_master_keyfile, const char *master_keyfile,
     bool has_fingerprint, const char *fingerprint,
 +    bool has_backup_ns, const char *backup_ns,
     bool has_backup_id, const char *backup_id,
     bool has_backup_time, int64_t backup_time,
     bool has_use_dirty_bitmap, bool use_dirty_bitmap,
@@ -674,8 +677,9 @@ UuidInfo coroutine_fn *qmp_backup(
         firewall_name = "fw.conf";
         char *pbs_err = NULL;
 -        pbs = proxmox_backup_new(
 +        pbs = proxmox_backup_new_ns(
             backup_file,
 +            has_backup_ns ? backup_ns : NULL,
             backup_id,
             backup_time,
             dump_cb_block_size,
 diff --git a/qapi/block-core.json b/qapi/block-core.json
 index fc8a125451..cc2ead0b75 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
@@ -817,6 +817,8 @@
 #
 # @fingerprint: server cert fingerprint (optional for format 'pbs')
 #
 +# @backup-ns: backup namespace (required for format 'pbs')
 +#
 # @backup-id: backup ID (required for format 'pbs')
 #
 # @backup-time: backup timestamp (Unix epoch, required for format 'pbs')
@@ -836,6 +838,7 @@
                                     '*key-password': 'str',
                                     '*master-keyfile': 'str',
                                     '*fingerprint': 'str',
 +                                    '*backup-ns': 'str',
                                     '*backup-id': 'str',
                                     '*backup-time': 'int',
                                     '*use-dirty-bitmap': 'bool',
@@ -3282,7 +3285,7 @@
 { 'struct': 'BlockdevOptionsPbs',
   'data': { 'repository': 'str', 'snapshot': 'str', 'archive': 'str',
             '*keyfile': 'str', '*password': 'str', '*fingerprint': 'str',
 -            '*key_password': 'str' } }
 +            '*key_password': 'str', '*namespace': 'str' } }
 ##
 # @BlockdevOptionsNVMe:
--- a/debian/patches/pve/0054-Revert-block-rbd-workaround-for-ceph-issue-53784.patch
+++ b/debian/patches/pve/0054-Revert-block-rbd-workaround-for-ceph-issue-53784.patch
@@ -7,16 +7,15 @@ This reverts commit fc176116cdea816ceb8dd969080b2b95f58edbc0 in
 preparation to revert 0347a8fd4c3faaedf119be04c197804be40a384b.
 Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
 block/rbd.c | 42 ++----------------------------------------
 1 file changed, 2 insertions(+), 40 deletions(-)
 diff --git a/block/rbd.c b/block/rbd.c
-index 101ee59d6e..4ad3b1a7b1 100644
+index 64a8d7d48b..9fc6dcb957 100644
 --- a/block/rbd.c
 +++ b/block/rbd.c
-@@ -1515,7 +1515,6 @@ static int coroutine_fn qemu_rbd_co_block_status(BlockDriverState *bs,
+@@ -1348,7 +1348,6 @@ static int coroutine_fn qemu_rbd_co_block_status(BlockDriverState *bs,
     int status, r;
     RBDDiffIterateReq req = { .offs = offset };
     uint64_t features, flags;
@@ -24,7 +23,7 @@ index 101ee59d6e..4ad3b1a7b1 100644
     assert(offset + bytes <= s->image_size);
-@@ -1543,43 +1542,7 @@ static int coroutine_fn qemu_rbd_co_block_status(BlockDriverState *bs,
+@@ -1376,43 +1375,7 @@ static int coroutine_fn qemu_rbd_co_block_status(BlockDriverState *bs,
         return status;
     }
@@ -69,7 +68,7 @@ index 101ee59d6e..4ad3b1a7b1 100644
                           qemu_rbd_diff_iterate_cb, &req);
     if (r < 0 && r != QEMU_RBD_EXIT_DIFF_ITERATE2) {
         return status;
-@@ -1598,8 +1561,7 @@ static int coroutine_fn qemu_rbd_co_block_status(BlockDriverState *bs,
+@@ -1431,8 +1394,7 @@ static int coroutine_fn qemu_rbd_co_block_status(BlockDriverState *bs,
         status = BDRV_BLOCK_ZERO | BDRV_BLOCK_OFFSET_VALID;
     }
--- a/debian/patches/pve/0055-Revert-block-rbd-fix-handling-of-holes-in-.bdrv_co_b.patch
+++ b/debian/patches/pve/0055-Revert-block-rbd-fix-handling-of-holes-in-.bdrv_co_b.patch
@@ -8,16 +8,15 @@ This reverts commit 9e302f64bb407a9bb097b626da97228c2654cfee in
 preparation to revert 0347a8fd4c3faaedf119be04c197804be40a384b.
 Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
 block/rbd.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)
 diff --git a/block/rbd.c b/block/rbd.c
-index 4ad3b1a7b1..e341745255 100644
+index 9fc6dcb957..98f4ba2620 100644
 --- a/block/rbd.c
 +++ b/block/rbd.c
-@@ -1474,11 +1474,11 @@ static int qemu_rbd_diff_iterate_cb(uint64_t offs, size_t len,
+@@ -1307,11 +1307,11 @@ static int qemu_rbd_diff_iterate_cb(uint64_t offs, size_t len,
     RBDDiffIterateReq *req = opaque;
     assert(req->offs + req->bytes <= offs);
--- a/debian/patches/pve/0056-Revert-block-rbd-implement-bdrv_co_block_status.patch
+++ b/debian/patches/pve/0056-Revert-block-rbd-implement-bdrv_co_block_status.patch
@@ -18,16 +18,15 @@ Upstream bug report:
 https://gitlab.com/qemu-project/qemu/-/issues/1026
 Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
 block/rbd.c | 112 ----------------------------------------------------
 1 file changed, 112 deletions(-)
 diff --git a/block/rbd.c b/block/rbd.c
-index e341745255..436d3d7811 100644
+index 98f4ba2620..efcbbe5949 100644
 --- a/block/rbd.c
 +++ b/block/rbd.c
-@@ -108,12 +108,6 @@ typedef struct RBDTask {
+@@ -97,12 +97,6 @@ typedef struct RBDTask {
     int64_t ret;
 } RBDTask;
@@ -40,7 +39,7 @@ index e341745255..436d3d7811 100644
 static int qemu_rbd_connect(rados_t *cluster, rados_ioctx_t *io_ctx,
                             BlockdevOptionsRbd *opts, bool cache,
                             const char *keypairs, const char *secretid,
-@@ -1460,111 +1454,6 @@ static ImageInfoSpecific *qemu_rbd_get_specific_info(BlockDriverState *bs,
+@@ -1293,111 +1287,6 @@ static ImageInfoSpecific *qemu_rbd_get_specific_info(BlockDriverState *bs,
     return spec_info;
 }
@@ -149,10 +148,10 @@ index e341745255..436d3d7811 100644
 -    return status;
 -}
 -
- static int64_t coroutine_fn qemu_rbd_co_getlength(BlockDriverState *bs)
+ static int64_t qemu_rbd_getlength(BlockDriverState *bs)
 {
     BDRVRBDState *s = bs->opaque;
-@@ -1801,7 +1690,6 @@ static BlockDriver bdrv_rbd = {
+@@ -1633,7 +1522,6 @@ static BlockDriver bdrv_rbd = {
 #ifdef LIBRBD_SUPPORTS_WRITE_ZEROES
     .bdrv_co_pwrite_zeroes  = qemu_rbd_co_pwrite_zeroes,
 #endif
--- a/debian/patches/pve/0057-PVE-Backup-create-jobs-correctly-cancel-in-error-sce.patch
+++ b/debian/patches/pve/0057-PVE-Backup-create-jobs-correctly-cancel-in-error-sce.patch
@@ -0,0 +1,59 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Fabian Ebner <f.ebner@proxmox.com>
 Date: Wed, 25 May 2022 13:59:37 +0200
 Subject: [PATCH] PVE-Backup: create jobs: correctly cancel in error scenario
 The first call to job_cancel_sync() will cancel and free all jobs in
 the transaction, so ensure that it's called only once and get rid of
 the job_unref() that would operate on freed memory.
 It's also necessary to NULL backup_state.pbs in the error scenario,
 because a subsequent backup_cancel QMP call (as happens in PVE when
 the backup QMP command fails) would try to call proxmox_backup_abort()
 and run into a segfault.
 Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
 ---
 pve-backup.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)
 diff --git a/pve-backup.c b/pve-backup.c
 index f6a5f8c785..5bed6f4014 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
@@ -506,6 +506,11 @@ static void create_backup_jobs_bh(void *opaque) {
     }
     if (*errp) {
 +        /*
 +         * It's enough to cancel one job in the transaction, the rest will
 +         * follow automatically.
 +         */
 +        bool canceled = false;
         l = backup_state.di_list;
         while (l) {
             PVEBackupDevInfo *di = (PVEBackupDevInfo *)l->data;
@@ -516,12 +521,12 @@ static void create_backup_jobs_bh(void *opaque) {
                 di->target = NULL;
             }
 -            if (di->job) {
 +            if (!canceled && di->job) {
                 AioContext *ctx = di->job->job.aio_context;
                 aio_context_acquire(ctx);
                 job_cancel_sync(&di->job->job, true);
 -                job_unref(&di->job->job);
                 aio_context_release(ctx);
 +                canceled = true;
             }
         }
     }
@@ -947,6 +952,7 @@ err:
     if (pbs) {
         proxmox_backup_disconnect(pbs);
 +        backup_state.pbs = NULL;
     }
     if (backup_dir) {
--- a/debian/patches/pve/0058-PVE-Backup-ensure-jobs-in-di_list-are-referenced.patch
+++ b/debian/patches/pve/0058-PVE-Backup-ensure-jobs-in-di_list-are-referenced.patch
@@ -0,0 +1,76 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Fabian Ebner <f.ebner@proxmox.com>
 Date: Wed, 25 May 2022 13:59:38 +0200
 Subject: [PATCH] PVE-Backup: ensure jobs in di_list are referenced
 Ensures that qmp_backup_cancel doesn't pick a job that's already been
 freed. With unlucky timings it seems possible that:
 1. job_exit -> job_completed -> job_finalize_single starts
 2. pvebackup_co_complete_stream gets spawned in completion callback
 3. job finalize_single finishes -> job's refcount hits zero -> job is
   freed
 4. qmp_backup_cancel comes in and locks backup_state.backup_mutex
   before pvebackup_co_complete_stream can remove the job from the
   di_list
 5. qmp_backup_cancel will pick a job that's already been freed
 Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
 ---
 pve-backup.c | 25 ++++++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)
 diff --git a/pve-backup.c b/pve-backup.c
 index 5bed6f4014..0c34428713 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
@@ -316,6 +316,14 @@ static void coroutine_fn pvebackup_co_complete_stream(void *opaque)
         }
     }
 +    if (di->job) {
 +        AioContext *ctx = di->job->job.aio_context;
 +        aio_context_acquire(ctx);
 +        job_unref(&di->job->job);
 +        di->job = NULL;
 +        aio_context_release(ctx);
 +    }
 +
     // remove self from job list
     backup_state.di_list = g_list_remove(backup_state.di_list, di);
@@ -491,9 +499,12 @@ static void create_backup_jobs_bh(void *opaque) {
             bitmap_mode, false, NULL, &perf, BLOCKDEV_ON_ERROR_REPORT, BLOCKDEV_ON_ERROR_REPORT,
             JOB_DEFAULT, pvebackup_complete_cb, di, backup_state.txn, &local_err);
 -        aio_context_release(aio_context);
 -
         di->job = job;
 +        if (job) {
 +            job_ref(&job->job);
 +        }
 +
 +        aio_context_release(aio_context);
         if (!job || local_err) {
             error_setg(errp, "backup_job_create failed: %s",
@@ -521,12 +532,16 @@ static void create_backup_jobs_bh(void *opaque) {
                 di->target = NULL;
             }
 -            if (!canceled && di->job) {
 +            if (di->job) {
                 AioContext *ctx = di->job->job.aio_context;
                 aio_context_acquire(ctx);
 -                job_cancel_sync(&di->job->job, true);
 +                if (!canceled) {
 +                    job_cancel_sync(&di->job->job, true);
 +                    canceled = true;
 +                }
 +                job_unref(&di->job->job);
 +                di->job = NULL;
                 aio_context_release(ctx);
 -                canceled = true;
             }
         }
     }
--- a/debian/patches/pve/0059-PVE-Backup-avoid-segfault-issues-upon-backup-cancel.patch
+++ b/debian/patches/pve/0059-PVE-Backup-avoid-segfault-issues-upon-backup-cancel.patch
@@ -0,0 +1,120 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Fabian Ebner <f.ebner@proxmox.com>
 Date: Wed, 25 May 2022 13:59:39 +0200
 Subject: [PATCH] PVE-Backup: avoid segfault issues upon backup-cancel
 When canceling a backup in PVE via a signal it's easy to run into a
 situation where the job is already failing when the backup_cancel QMP
 command comes in. With a bit of unlucky timing on top, it can happen
 that job_exit() runs between schedulung of job_cancel_bh() and
 execution of job_cancel_bh(). But job_cancel_sync() does not expect
 that the job is already finalized (in fact, the job might've been
 freed already, but even if it isn't, job_cancel_sync() would try to
 deref job->txn which would be NULL at that point).
 It is not possible to simply use the job_cancel() (which is advertised
 as being async but isn't in all cases) in qmp_backup_cancel() for the
 same reason job_cancel_sync() cannot be used. Namely, because it can
 invoke job_finish_sync() (which uses AIO_WAIT_WHILE and thus hangs if
 called from a coroutine). This happens when there's multiple jobs in
 the transaction and job->deferred_to_main_loop is true (is set before
 scheduling job_exit()) or if the job was not started yet.
 Fix the issue by selecting the job to cancel in job_cancel_bh() itself
 using the first job that's not completed yet. This is not necessarily
 the first job in the list, because pvebackup_co_complete_stream()
 might not yet have removed a completed job when job_cancel_bh() runs.
 An alternative would be to continue using only the first job and
 checking against JOB_STATUS_CONCLUDED or JOB_STATUS_NULL to decide if
 it's still necessary and possible to cancel, but the approach with
 using the first non-completed job seemed more robust.
 Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
 ---
 pve-backup.c | 61 +++++++++++++++++++++++++++++++++-------------------
 1 file changed, 39 insertions(+), 22 deletions(-)
 diff --git a/pve-backup.c b/pve-backup.c
 index 0c34428713..2e22030eec 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
@@ -355,15 +355,42 @@ static void pvebackup_complete_cb(void *opaque, int ret)
 /*
  * job_cancel(_sync) does not like to be called from coroutines, so defer to
 - * main loop processing via a bottom half.
 + * main loop processing via a bottom half. Assumes that caller holds
 + * backup_mutex.
  */
 static void job_cancel_bh(void *opaque) {
     CoCtxData *data = (CoCtxData*)opaque;
 -    Job *job = (Job*)data->data;
 -    AioContext *job_ctx = job->aio_context;
 -    aio_context_acquire(job_ctx);
 -    job_cancel_sync(job, true);
 -    aio_context_release(job_ctx);
 +
 +    /*
 +     * Be careful to pick a valid job to cancel:
 +     * 1. job_cancel_sync() does not expect the job to be finalized already.
 +     * 2. job_exit() might run between scheduling and running job_cancel_bh()
 +     *    and pvebackup_co_complete_stream() might not have removed the job from
 +     *    the list yet (in fact, cannot, because it waits for the backup_mutex).
 +     * Requiring !job_is_completed() ensures that no finalized job is picked.
 +     */
 +    GList *bdi = g_list_first(backup_state.di_list);
 +    while (bdi) {
 +        if (bdi->data) {
 +            BlockJob *bj = ((PVEBackupDevInfo *)bdi->data)->job;
 +            if (bj) {
 +                Job *job = &bj->job;
 +                if (!job_is_completed(job)) {
 +                    AioContext *job_ctx = job->aio_context;
 +                    aio_context_acquire(job_ctx);
 +                    job_cancel_sync(job, true);
 +                    aio_context_release(job_ctx);
 +                    /*
 +                     * It's enough to cancel one job in the transaction, the
 +                     * rest will follow automatically.
 +                     */
 +                    break;
 +                }
 +            }
 +        }
 +        bdi = g_list_next(bdi);
 +    }
 +
     aio_co_enter(data->ctx, data->co);
 }
@@ -384,22 +411,12 @@ void coroutine_fn qmp_backup_cancel(Error **errp)
         proxmox_backup_abort(backup_state.pbs, "backup canceled");
     }
 -    /* it's enough to cancel one job in the transaction, the rest will follow
 -     * automatically */
 -    GList *bdi = g_list_first(backup_state.di_list);
 -    BlockJob *cancel_job = bdi && bdi->data ?
 -        ((PVEBackupDevInfo *)bdi->data)->job :
 -        NULL;
 -
 -    if (cancel_job) {
 -        CoCtxData data = {
 -            .ctx = qemu_get_current_aio_context(),
 -            .co = qemu_coroutine_self(),
 -            .data = &cancel_job->job,
 -        };
 -        aio_bh_schedule_oneshot(data.ctx, job_cancel_bh, &data);
 -        qemu_coroutine_yield();
 -    }
 +    CoCtxData data = {
 +        .ctx = qemu_get_current_aio_context(),
 +        .co = qemu_coroutine_self(),
 +    };
 +    aio_bh_schedule_oneshot(data.ctx, job_cancel_bh, &data);
 +    qemu_coroutine_yield();
     qemu_co_mutex_unlock(&backup_state.backup_mutex);
 }
--- a/debian/patches/pve/0060-vma-create-support-64KiB-unaligned-input-images.patch
+++ b/debian/patches/pve/0060-vma-create-support-64KiB-unaligned-input-images.patch
@@ -0,0 +1,57 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Fabian Ebner <f.ebner@proxmox.com>
 Date: Wed, 22 Jun 2022 10:45:11 +0200
 Subject: [PATCH] vma: create: support 64KiB-unaligned input images
 which fixes backing up templates with such disks in PVE, for example
 efitype=4m EFI disks on a file-based storage (size = 540672).
 If there is not enough left to read, blk_co_preadv will return -EIO,
 so limit the size in the last iteration.
 For writing, an unaligned end is already handled correctly.
 The call to memset is not strictly necessary, because writing also
 checks that it doesn't write data beyond the end of the image. But
 there are two reasons to do it:
 1. It's cleaner that way.
 2. It allows detecting when the final piece is all zeroes, which might
   not happen if the buffer still contains data from the previous
   iteration.
 Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 ---
 vma.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)
 diff --git a/vma.c b/vma.c
 index e6e9ffc7fe..304f02bc84 100644
 --- a/vma.c
 +++ b/vma.c
@@ -548,7 +548,7 @@ static void coroutine_fn backup_run(void *opaque)
     struct iovec iov;
     QEMUIOVector qiov;
 -    int64_t start, end;
 +    int64_t start, end, readlen;
     int ret = 0;
     unsigned char *buf = blk_blockalign(job->target, VMA_CLUSTER_SIZE);
@@ -562,8 +562,16 @@ static void coroutine_fn backup_run(void *opaque)
         iov.iov_len = VMA_CLUSTER_SIZE;
         qemu_iovec_init_external(&qiov, &iov, 1);
 +        if (start + 1 == end) {
 +            memset(buf, 0, VMA_CLUSTER_SIZE);
 +            readlen = job->len - start * VMA_CLUSTER_SIZE;
 +            assert(readlen > 0 && readlen <= VMA_CLUSTER_SIZE);
 +        } else {
 +            readlen = VMA_CLUSTER_SIZE;
 +        }
 +
         ret = blk_co_preadv(job->target, start * VMA_CLUSTER_SIZE,
 -                            VMA_CLUSTER_SIZE, &qiov, 0);
 +                            readlen, &qiov, 0);
         if (ret < 0) {
             vma_writer_set_error(job->vmaw, "read error", -1);
             goto out;
--- a/debian/patches/pve/0061-vma-create-avoid-triggering-assertion-in-error-case.patch
+++ b/debian/patches/pve/0061-vma-create-avoid-triggering-assertion-in-error-case.patch
@@ -0,0 +1,25 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Fabian Ebner <f.ebner@proxmox.com>
 Date: Wed, 22 Jun 2022 10:45:12 +0200
 Subject: [PATCH] vma: create: avoid triggering assertion in error case
 error_setg expects its argument to not be initialized yet.
 Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 ---
 vma-writer.c | 2 ++
 1 file changed, 2 insertions(+)
 diff --git a/vma-writer.c b/vma-writer.c
 index df4b20793d..ac7da237d0 100644
 --- a/vma-writer.c
 +++ b/vma-writer.c
@@ -311,6 +311,8 @@ VmaWriter *vma_writer_create(const char *filename, uuid_t uuid, Error **errp)
         }
         if (vmaw->fd < 0) {
 +            error_free(*errp);
 +            *errp = NULL;
             error_setg(errp, "can't open file %s - %s\n", filename,
                        g_strerror(errno));
             goto err;
--- a/debian/patches/pve/0062-block-alloc-track-avoid-premature-break.patch
+++ b/debian/patches/pve/0062-block-alloc-track-avoid-premature-break.patch
@@ -0,0 +1,36 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Fabian Ebner <f.ebner@proxmox.com>
 Date: Wed, 22 Jun 2022 10:45:13 +0200
 Subject: [PATCH] block: alloc-track: avoid premature break
 While the bdrv_co_preadv() calls are expected to return 0 on success,
 qemu_iovec_memset() will return the number of bytes set (will be
 local_bytes, because the slice with that size was just initialized).
 Don't break out of the loop after the branch with qemu_iovec_memset(),
 because there might still be work to do. Additionally, ret is an int,
 which on 64-bit platforms is too small to hold the size_t returned by
 qemu_iovec_memset().
 The branch seems to be difficult to reach in practice, because the
 whole point of alloc-track is to be used with a backing device.
 Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
 ---
 block/alloc-track.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
 diff --git a/block/alloc-track.c b/block/alloc-track.c
 index 6b50fbe537..c1160af04b 100644
 --- a/block/alloc-track.c
 +++ b/block/alloc-track.c
@@ -174,7 +174,8 @@ static int coroutine_fn track_co_preadv(BlockDriverState *bs,
             ret = bdrv_co_preadv(bs->backing, local_offset, local_bytes,
                                  &local_qiov, flags);
         } else {
 -            ret = qemu_iovec_memset(&local_qiov, cur_offset, 0, local_bytes);
 +            qemu_iovec_memset(&local_qiov, cur_offset, 0, local_bytes);
 +            ret = 0;
         }
         if (ret != 0) {
--- a/debian/patches/pve/0063-PVE-Backup-allow-passing-max-workers-performance-set.patch
+++ b/debian/patches/pve/0063-PVE-Backup-allow-passing-max-workers-performance-set.patch
@@ -0,0 +1,144 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Fiona Ebner <f.ebner@proxmox.com>
 Date: Mon, 3 Oct 2022 15:52:04 +0200
 Subject: [PATCH] PVE Backup: allow passing max-workers performance setting
 For query-proxmox-support, add an indication that it's possible to use
 the setting.
 For now, the other two BackupPerf settings are not exposed:
 * use-copy-range: would need to be implemented by the backup-dump
 block driver first, and in fact, the default for backup was changed,
 because it wasn't as fast for backup in QEMU, see commit
 6a30f663d4c0b3c45a544d541e0c4e214b2473a1.
 * max-chunk: enforced to be at least the backup cluster size, which is
 4 MiB for PBS and otherwise maximum of source and target cluster size.
 And block-copy has a maximum buffer size of 1 MiB, so setting a larger
 max-chunk doesn't even have an effect. To make the setting sensibly
 usable the check would need to be removed and optionally the
 block-copy max buffer size would need to be bumped. I tried doing just
 that, and tested different source/target combinations with different
 max-chunk settings, but there were no noticable improvements over the
 default "unlimited" (resulting in 1 MiB for block-copy).
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
 block/monitor/block-hmp-cmds.c |  4 +++-
 pve-backup.c                   | 18 +++++++++++++-----
 qapi/block-core.json           |  9 +++++++--
 3 files changed, 23 insertions(+), 8 deletions(-)
 diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
 index 0502f42be6..cc231ec3f2 100644
 --- a/block/monitor/block-hmp-cmds.c
 +++ b/block/monitor/block-hmp-cmds.c
@@ -1049,7 +1049,9 @@ void coroutine_fn hmp_backup(Monitor *mon, const QDict *qdict)
         false, false, // PBS encrypt
         true, dir ? BACKUP_FORMAT_DIR : BACKUP_FORMAT_VMA,
         false, NULL, false, NULL, !!devlist,
 -        devlist, qdict_haskey(qdict, "speed"), speed, &error);
 +        devlist, qdict_haskey(qdict, "speed"), speed,
 +        false, 0, // BackupPerf max-workers
 +        &error);
     hmp_handle_error(mon, error);
 }
 diff --git a/pve-backup.c b/pve-backup.c
 index 2e22030eec..e9aa7e0f49 100644
 --- a/pve-backup.c
 +++ b/pve-backup.c
@@ -55,6 +55,7 @@ static struct PVEBackupState {
         bool starting;
     } stat;
     int64_t speed;
 +    BackupPerf perf;
     VmaWriter *vmaw;
     ProxmoxBackupHandle *pbs;
     GList *di_list;
@@ -492,8 +493,6 @@ static void create_backup_jobs_bh(void *opaque) {
     }
     backup_state.txn = job_txn_new_seq();
 -    BackupPerf perf = { .max_workers = 16 };
 -
     /* create and start all jobs (paused state) */
     GList *l =  backup_state.di_list;
     while (l) {
@@ -513,8 +512,9 @@ static void create_backup_jobs_bh(void *opaque) {
         BlockJob *job = backup_job_create(
             NULL, di->bs, di->target, backup_state.speed, sync_mode, di->bitmap,
 -            bitmap_mode, false, NULL, &perf, BLOCKDEV_ON_ERROR_REPORT, BLOCKDEV_ON_ERROR_REPORT,
 -            JOB_DEFAULT, pvebackup_complete_cb, di, backup_state.txn, &local_err);
 +            bitmap_mode, false, NULL, &backup_state.perf, BLOCKDEV_ON_ERROR_REPORT,
 +            BLOCKDEV_ON_ERROR_REPORT, JOB_DEFAULT, pvebackup_complete_cb, di, backup_state.txn,
 +            &local_err);
         di->job = job;
         if (job) {
@@ -584,7 +584,9 @@ UuidInfo coroutine_fn *qmp_backup(
     bool has_config_file, const char *config_file,
     bool has_firewall_file, const char *firewall_file,
     bool has_devlist, const char *devlist,
 -    bool has_speed, int64_t speed, Error **errp)
 +    bool has_speed, int64_t speed,
 +    bool has_max_workers, int64_t max_workers,
 +    Error **errp)
 {
     assert(qemu_in_coroutine());
@@ -914,6 +916,11 @@ UuidInfo coroutine_fn *qmp_backup(
     backup_state.speed = (has_speed && speed > 0) ? speed : 0;
 +    backup_state.perf = (BackupPerf){ .max_workers = 16 };
 +    if (has_max_workers) {
 +        backup_state.perf.max_workers = max_workers;
 +    }
 +
     backup_state.vmaw = vmaw;
     backup_state.pbs = pbs;
@@ -1089,5 +1096,6 @@ ProxmoxSupportStatus *qmp_query_proxmox_support(Error **errp)
     ret->pbs_dirty_bitmap_migration = true;
     ret->query_bitmap_info = true;
     ret->pbs_masterkey = true;
 +    ret->backup_max_workers = true;
     return ret;
 }
 diff --git a/qapi/block-core.json b/qapi/block-core.json
 index cc2ead0b75..e3f62faa81 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
@@ -829,6 +829,8 @@
 #
 # @encrypt: use encryption ((optional for format 'pbs', defaults to true if there is a keyfile)
 #
 +# @max-workers: see @BackupPerf for details. Default 16.
 +#
 # Returns: the uuid of the backup job
 #
 ##
@@ -847,7 +849,9 @@
                                     '*format': 'BackupFormat',
                                     '*config-file': 'str',
                                     '*firewall-file': 'str',
 -                                    '*devlist': 'str', '*speed': 'int' },
 +                                    '*devlist': 'str',
 +                                    '*speed': 'int',
 +                                    '*max-workers': 'int' },
   'returns': 'UuidInfo', 'coroutine': true }
 ##
@@ -902,7 +906,8 @@
             'pbs-dirty-bitmap-savevm': 'bool',
             'pbs-dirty-bitmap-migration': 'bool',
             'pbs-masterkey': 'bool',
 -            'pbs-library-version': 'str' } }
 +            'pbs-library-version': 'str',
 +            'backup-max-workers': 'bool' } }
 ##
 # @query-proxmox-support:
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,9 +1,9 @@
 extra/0001-monitor-qmp-fix-race-with-clients-disconnecting-earl.patch
-extra/0002-scsi-megasas-Internal-cdbs-have-16-byte-length.patch
+extra/0002-block-io_uring-revert-Use-io_uring_register_ring_fd-.patch
-extra/0003-ide-avoid-potential-deadlock-when-draining-during-tr.patch
+extra/0003-virtiofsd-use-g_date_time_get_microsecond-to-get-sub.patch
-extra/0004-Revert-x86-acpi-workaround-Windows-not-handling-name.patch
+extra/0004-chardev-fix-segfault-in-finalize.patch
-extra/0005-virtio-net-Add-queues-before-loading-them.patch
+extra/0005-init-daemonize-defuse-PID-file-resolve-error.patch
-extra/0006-virtio-net-Fix-size-check-in-dhclient-workaround.patch
+extra/0006-block-block-backend-blk_set_enable_write_cache-is-IO.patch
 bitmap-mirror/0001-drive-mirror-add-support-for-sync-bitmap-mode-never.patch
 bitmap-mirror/0002-drive-mirror-add-support-for-conditional-and-always-.patch
 bitmap-mirror/0003-mirror-add-check-for-bitmap-mode-without-bitmap.patch
@@ -16,12 +16,12 @@ pve/0003-PVE-Config-set-the-CPU-model-to-kvm64-32-instead-of-.patch
 pve/0004-PVE-Config-ui-spice-default-to-pve-certificates.patch
 pve/0005-PVE-Config-glusterfs-no-default-logfile-if-daemonize.patch
 pve/0006-PVE-Config-rbd-block-rbd-disable-rbd_cache_writethro.patch
-pve/0007-PVE-Up-glusterfs-allow-partial-reads.patch
+pve/0007-PVE-Up-qmp-add-get_link_status.patch
-pve/0008-PVE-Up-qemu-img-return-success-on-info-without-snaps.patch
+pve/0008-PVE-Up-glusterfs-allow-partial-reads.patch
-pve/0009-PVE-Up-qemu-img-dd-add-osize-and-read-from-to-stdin-.patch
+pve/0009-PVE-Up-qemu-img-return-success-on-info-without-snaps.patch
-pve/0010-PVE-Up-qemu-img-dd-add-isize-parameter.patch
+pve/0010-PVE-Up-qemu-img-dd-add-osize-and-read-from-to-stdin-.patch
-pve/0011-PVE-Up-qemu-img-dd-add-n-skip_create.patch
+pve/0011-PVE-Up-qemu-img-dd-add-isize-parameter.patch
-pve/0012-qemu-img-dd-add-l-option-for-loading-a-snapshot.patch
+pve/0012-PVE-Up-qemu-img-dd-add-n-skip_create.patch
 pve/0013-PVE-virtio-balloon-improve-query-balloon.patch
 pve/0014-PVE-qapi-modify-query-machines.patch
 pve/0015-PVE-qapi-modify-spice-query.patch
@@ -38,27 +38,39 @@ pve/0025-PVE-Allow-version-code-in-machine-type.patch
 pve/0026-block-backup-move-bcs-bitmap-initialization-to-job-c.patch
 pve/0027-PVE-Backup-add-vma-backup-format-code.patch
 pve/0028-PVE-Backup-add-backup-dump-block-driver.patch
-pve/0029-PVE-Add-sequential-job-transaction-support.patch
+pve/0029-PVE-Backup-proxmox-backup-patches-for-qemu.patch
-pve/0030-PVE-Backup-Proxmox-backup-patches-for-QEMU.patch
+pve/0030-PVE-Backup-pbs-restore-new-command-to-restore-from-p.patch
-pve/0031-PVE-Backup-pbs-restore-new-command-to-restore-from-p.patch
+pve/0031-PVE-Backup-Add-dirty-bitmap-tracking-for-incremental.patch
-pve/0032-PVE-Add-PBS-block-driver-to-map-backup-archives-into.patch
+pve/0032-PVE-various-PBS-fixes.patch
-pve/0033-PVE-redirect-stderr-to-journal-when-daemonized.patch
+pve/0033-PVE-Add-PBS-block-driver-to-map-backup-archives-into.patch
-pve/0034-PVE-Migrate-dirty-bitmap-state-via-savevm.patch
+pve/0034-PVE-add-query_proxmox_support-QMP-command.patch
-pve/0035-migration-block-dirty-bitmap-migrate-other-bitmaps-e.patch
+pve/0035-PVE-add-query-pbs-bitmap-info-QMP-call.patch
-pve/0036-PVE-fall-back-to-open-iscsi-initiatorname.patch
+pve/0036-PVE-redirect-stderr-to-journal-when-daemonized.patch
-pve/0037-PVE-block-stream-increase-chunk-size.patch
+pve/0037-PVE-Add-sequential-job-transaction-support.patch
-pve/0038-block-add-alloc-track-driver.patch
+pve/0038-PVE-Backup-Use-a-transaction-to-synchronize-job-stat.patch
-pve/0039-Revert-block-rbd-workaround-for-ceph-issue-53784.patch
+pve/0039-PVE-Backup-Don-t-block-on-finishing-and-cleanup-crea.patch
-pve/0040-Revert-block-rbd-fix-handling-of-holes-in-.bdrv_co_b.patch
+pve/0040-PVE-Migrate-dirty-bitmap-state-via-savevm.patch
-pve/0041-Revert-block-rbd-implement-bdrv_co_block_status.patch
+pve/0041-migration-block-dirty-bitmap-migrate-other-bitmaps-e.patch
-pve/0042-alloc-track-error-out-when-auto-remove-is-not-set.patch
+pve/0042-PVE-fall-back-to-open-iscsi-initiatorname.patch
-pve/0043-alloc-track-avoid-seemingly-superfluous-child-permis.patch
+pve/0043-PVE-Use-coroutine-QMP-for-backup-cancel_backup.patch
-pve/0044-copy-before-write-allow-specifying-minimum-cluster-s.patch
+pve/0044-PBS-add-master-key-support.patch
-pve/0045-backup-add-minimum-cluster-size-to-performance-optio.patch
+pve/0045-PVE-block-pbs-fast-path-reads-without-allocation-if-.patch
-pve/0046-PVE-backup-add-fleecing-option.patch
+pve/0046-PVE-block-stream-increase-chunk-size.patch
-pve/0047-PVE-backup-improve-error-when-copy-before-write-fail.patch
+pve/0047-block-io-accept-NULL-qiov-in-bdrv_pad_request.patch
-pve/0048-PVE-backup-fixup-error-handling-for-fleecing.patch
+pve/0048-block-add-alloc-track-driver.patch
-pve/0049-PVE-backup-factor-out-setting-up-snapshot-access-for.patch
+pve/0049-PVE-whitelist-invalid-QAPI-names-for-backwards-compa.patch
-pve/0050-PVE-backup-save-device-name-in-device-info-structure.patch
+pve/0050-PVE-savevm-async-register-yank-before-migration_inco.patch
-pve/0051-PVE-backup-include-device-name-in-error-when-setting.patch
+pve/0051-qemu-img-dd-add-l-option-for-loading-a-snapshot.patch
-pve-qemu-9.1-vitastor.patch
+pve/0052-vma-allow-partial-restore.patch
 pve/0053-pbs-namespace-support.patch
 pve/0054-Revert-block-rbd-workaround-for-ceph-issue-53784.patch
 pve/0055-Revert-block-rbd-fix-handling-of-holes-in-.bdrv_co_b.patch
 pve/0056-Revert-block-rbd-implement-bdrv_co_block_status.patch
 pve/0057-PVE-Backup-create-jobs-correctly-cancel-in-error-sce.patch
 pve/0058-PVE-Backup-ensure-jobs-in-di_list-are-referenced.patch
 pve/0059-PVE-Backup-avoid-segfault-issues-upon-backup-cancel.patch
 pve/0060-vma-create-support-64KiB-unaligned-input-images.patch
 pve/0061-vma-create-avoid-triggering-assertion-in-error-case.patch
 pve/0062-block-alloc-track-avoid-premature-break.patch
 pve/0063-PVE-Backup-allow-passing-max-workers-performance-set.patch
 pve-qemu-7.1-vitastor.patch
--- a/debian/pve-qemu-kvm.install
+++ b/debian/pve-qemu-kvm.install
@@ -1,6 +1,7 @@
 # install the userspace utilities
 debian/kvm-ifup etc/kvm/
 debian/kvm-ifdown etc/kvm/
 #install ovmf uefi rom
 debian/OVMF_CODE-pure-efi.fd usr/share/kvm/
 debian/OVMF_VARS-pure-efi.fd usr/share/kvm/
 debian/kvm-ifdown etc/kvm/
 # install the userspace utilities
 debian/kvm-ifup etc/kvm/
--- a/debian/pve-qemu-kvm.links
+++ b/debian/pve-qemu-kvm.links
@@ -1,13 +1,16 @@
 # also use aarch64 for 32 bit arm
 usr/bin/qemu-system-aarch64 usr/bin/qemu-system-arm
 usr/bin/qemu-system-x86_64 usr/bin/kvm
 # qemu-system-i386 and qemu-system-x86_64 provides the same hardware emulation
 usr/bin/qemu-system-x86_64 usr/bin/qemu-system-i386
 # also use aarch64 for 32 bit arm
 usr/bin/qemu-system-aarch64 usr/bin/qemu-system-arm
 # upstream provides a qemu man page,
 # we symlink to kvm for backward compatibility
 # and to qemu-system-{i386,x86_64} to fullfill our 'Provides: qemu-system-x86'
 usr/share/man/man1/qemu.1  usr/share/man/man1/kvm.1
 usr/share/man/man1/qemu.1  usr/share/man/man1/qemu-system-aarch64.1
 usr/share/man/man1/qemu.1  usr/share/man/man1/qemu-system-arm.1
 usr/share/man/man1/qemu.1  usr/share/man/man1/qemu-system-i386.1
 usr/share/man/man1/qemu.1  usr/share/man/man1/qemu-system-x86_64.1
 usr/share/man/man1/qemu.1  usr/share/man/man1/qemu-system-arm.1
 usr/share/man/man1/qemu.1  usr/share/man/man1/qemu-system-aarch64.1
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Vitaliy Filippov	a3b2ef93ab	Improve performance by adding io_uring support, fix iothread compat	2023-07-19 02:27:08 +03:00
Vitaliy Filippov	0fa004b912	Add bdrv_co_block_status	2023-07-18 18:26:09 +03:00
Vitaliy Filippov	78a75914b3	Add Vitastor support	2022-12-15 19:32:46 +03:00