import QEMU 5.0.0-rc2 and rebase patches

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>

debian/patches/extra/0001-util-add-slirp_fmt-helpers.patch

@@ -1,126 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
-Date: Mon, 27 Jan 2020 10:24:09 +0100
-Subject: [PATCH 1/2] util: add slirp_fmt() helpers
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Various calls to snprintf() in libslirp assume that snprintf() returns
-"only" the number of bytes written (excluding terminating NUL).
-
-https://pubs.opengroup.org/onlinepubs/9699919799/functions/snprintf.html#tag_16_159_04
-
-"Upon successful completion, the snprintf() function shall return the
-number of bytes that would be written to s had n been sufficiently
-large excluding the terminating null byte."
-
-Introduce slirp_fmt() that handles several pathological cases the
-way libslirp usually expect:
-
-- treat error as fatal (instead of silently returning -1)
-
-- fmt0() will always \0 end
-
-- return the number of bytes actually written (instead of what would
-have been written, which would usually result in OOB later), including
-the ending \0 for fmt0()
-
-- warn if truncation happened (instead of ignoring)
-
-Other less common cases can still be handled with strcpy/snprintf() etc.
-
-Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
-Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
-Message-Id: <20200127092414.169796-2-marcandre.lureau@redhat.com>
-Signed-off-by: Oguz Bektas <o.bektas@proxmox.com>
----
- slirp/src/util.c | 62 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
- slirp/src/util.h |  3 +++
- 2 files changed, 65 insertions(+)
-
-diff --git a/slirp/src/util.c b/slirp/src/util.c
-index e596087..e3b6257 100644
---- a/slirp/src/util.c
-+++ b/slirp/src/util.c
-@@ -364,3 +364,65 @@ void slirp_pstrcpy(char *buf, int buf_size, const char *str)
-     }
-     *q = '\0';
- }
-+
-+static int slirp_vsnprintf(char *str, size_t size,
-+                           const char *format, va_list args)
-+{
-+    int rv = vsnprintf(str, size, format, args);
-+
-+    if (rv < 0) {
-+        g_error("vsnprintf() failed: %s", g_strerror(errno));
-+    }
-+
-+    return rv;
-+}
-+
-+/*
-+ * A snprintf()-like function that:
-+ * - returns the number of bytes written (excluding optional \0-ending)
-+ * - dies on error
-+ * - warn on truncation
-+ */
-+int slirp_fmt(char *str, size_t size, const char *format, ...)
-+{
-+    va_list args;
-+    int rv;
-+
-+    va_start(args, format);
-+    rv = slirp_vsnprintf(str, size, format, args);
-+    va_end(args);
-+
-+    if (rv > size) {
-+        g_critical("vsnprintf() truncation");
-+    }
-+
-+    return MIN(rv, size);
-+}
-+
-+/*
-+ * A snprintf()-like function that:
-+ * - always \0-end (unless size == 0)
-+ * - returns the number of bytes actually written, including \0 ending
-+ * - dies on error
-+ * - warn on truncation
-+ */
-+int slirp_fmt0(char *str, size_t size, const char *format, ...)
-+{
-+    va_list args;
-+    int rv;
-+
-+    va_start(args, format);
-+    rv = slirp_vsnprintf(str, size, format, args);
-+    va_end(args);
-+
-+    if (rv >= size) {
-+        g_critical("vsnprintf() truncation");
-+        if (size > 0)
-+            str[size - 1] = '\0';
-+        rv = size;
-+    } else {
-+        rv += 1; /* include \0 */
-+    }
-+
-+    return rv;
-+}
-diff --git a/slirp/src/util.h b/slirp/src/util.h
-index 3c6223c..0558dfc 100644
---- a/slirp/src/util.h
-+++ b/slirp/src/util.h
-@@ -177,4 +177,7 @@ static inline int slirp_socket_set_fast_reuse(int fd)
- 
- void slirp_pstrcpy(char *buf, int buf_size, const char *str);
- 
-+int slirp_fmt(char *str, size_t size, const char *format, ...);
-+int slirp_fmt0(char *str, size_t size, const char *format, ...);
-+
- #endif
--- 
-2.20.1
-

debian/patches/extra/0002-tcp_emu-fix-unsafe-snprintf-usages.patch

@@ -1,135 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
-Date: Mon, 27 Jan 2020 10:24:14 +0100
-Subject: [PATCH 2/2] tcp_emu: fix unsafe snprintf() usages
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Various calls to snprintf() assume that snprintf() returns "only" the
-number of bytes written (excluding terminating NUL).
-
-https://pubs.opengroup.org/onlinepubs/9699919799/functions/snprintf.html#tag_16_159_04
-
-"Upon successful completion, the snprintf() function shall return the
-number of bytes that would be written to s had n been sufficiently
-large excluding the terminating null byte."
-
-Before patch ce131029, if there isn't enough room in "m_data" for the
-"DCC ..." message, we overflow "m_data".
-
-After the patch, if there isn't enough room for the same, we don't
-overflow "m_data", but we set "m_len" out-of-bounds. The next time an
-access is bounded by "m_len", we'll have a buffer overflow then.
-
-Use slirp_fmt*() to fix potential OOB memory access.
-
-Reported-by: Laszlo Ersek <lersek@redhat.com>
-Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
-Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
-Message-Id: <20200127092414.169796-7-marcandre.lureau@redhat.com>
-Signed-off-by: Oguz Bektas <o.bektas@proxmox.com>
----
- slirp/src/tcp_subr.c | 44 +++++++++++++++++++++-----------------------
- 1 file changed, 21 insertions(+), 23 deletions(-)
-
-diff --git a/slirp/src/tcp_subr.c b/slirp/src/tcp_subr.c
-index d6dd133..93b3488 100644
---- a/slirp/src/tcp_subr.c
-+++ b/slirp/src/tcp_subr.c
-@@ -655,8 +655,7 @@ int tcp_emu(struct socket *so, struct mbuf *m)
-                 NTOHS(n1);
-                 NTOHS(n2);
-                 m_inc(m, snprintf(NULL, 0, "%d,%d\r\n", n1, n2) + 1);
--                m->m_len = snprintf(m->m_data, M_ROOM(m), "%d,%d\r\n", n1, n2);
--                assert(m->m_len < M_ROOM(m));
-+                m->m_len = slirp_fmt(m->m_data, M_ROOM(m), "%d,%d\r\n", n1, n2);
-             } else {
-                 *eol = '\r';
-             }
-@@ -696,9 +695,9 @@ int tcp_emu(struct socket *so, struct mbuf *m)
-             n4 = (laddr & 0xff);
- 
-             m->m_len = bptr - m->m_data; /* Adjust length */
--            m->m_len += snprintf(bptr, m->m_size - m->m_len,
--                                 "ORT %d,%d,%d,%d,%d,%d\r\n%s", n1, n2, n3, n4,
--                                 n5, n6, x == 7 ? buff : "");
-+            m->m_len += slirp_fmt(bptr, M_FREEROOM(m),
-+                                  "ORT %d,%d,%d,%d,%d,%d\r\n%s",
-+                                  n1, n2, n3, n4, n5, n6, x == 7 ? buff : "");
-             return 1;
-         } else if ((bptr = (char *)strstr(m->m_data, "27 Entering")) != NULL) {
-             /*
-@@ -731,11 +730,9 @@ int tcp_emu(struct socket *so, struct mbuf *m)
-             n4 = (laddr & 0xff);
- 
-             m->m_len = bptr - m->m_data; /* Adjust length */
--            m->m_len +=
--                snprintf(bptr, m->m_size - m->m_len,
--                         "27 Entering Passive Mode (%d,%d,%d,%d,%d,%d)\r\n%s",
--                         n1, n2, n3, n4, n5, n6, x == 7 ? buff : "");
--
-+            m->m_len += slirp_fmt(bptr, M_FREEROOM(m),
-+                                  "27 Entering Passive Mode (%d,%d,%d,%d,%d,%d)\r\n%s",
-+                                  n1, n2, n3, n4, n5, n6, x == 7 ? buff : "");
-             return 1;
-         }
- 
-@@ -758,8 +755,8 @@ int tcp_emu(struct socket *so, struct mbuf *m)
-         if (m->m_data[m->m_len - 1] == '\0' && lport != 0 &&
-             (so = tcp_listen(slirp, INADDR_ANY, 0, so->so_laddr.s_addr,
-                              htons(lport), SS_FACCEPTONCE)) != NULL)
--            m->m_len =
--                snprintf(m->m_data, m->m_size, "%d", ntohs(so->so_fport)) + 1;
-+            m->m_len = slirp_fmt0(m->m_data, M_ROOM(m),
-+                                  "%d", ntohs(so->so_fport));
-         return 1;
- 
-     case EMU_IRC:
-@@ -778,9 +775,10 @@ int tcp_emu(struct socket *so, struct mbuf *m)
-                 return 1;
-             }
-             m->m_len = bptr - m->m_data; /* Adjust length */
--            m->m_len += snprintf(bptr, m->m_size, "DCC CHAT chat %lu %u%c\n",
--                                 (unsigned long)ntohl(so->so_faddr.s_addr),
--                                 ntohs(so->so_fport), 1);
-+            m->m_len += slirp_fmt(bptr, M_FREEROOM(m),
-+                                  "DCC CHAT chat %lu %u%c\n",
-+                                  (unsigned long)ntohl(so->so_faddr.s_addr),
-+                                  ntohs(so->so_fport), 1);
-         } else if (sscanf(bptr, "DCC SEND %256s %u %u %u", buff, &laddr, &lport,
-                           &n1) == 4) {
-             if ((so = tcp_listen(slirp, INADDR_ANY, 0, htonl(laddr),
-@@ -788,10 +786,10 @@ int tcp_emu(struct socket *so, struct mbuf *m)
-                 return 1;
-             }
-             m->m_len = bptr - m->m_data; /* Adjust length */
--            m->m_len +=
--                snprintf(bptr, m->m_size, "DCC SEND %s %lu %u %u%c\n", buff,
--                         (unsigned long)ntohl(so->so_faddr.s_addr),
--                         ntohs(so->so_fport), n1, 1);
-+            m->m_len += slirp_fmt(bptr, M_FREEROOM(m),
-+                                  "DCC SEND %s %lu %u %u%c\n", buff,
-+                                  (unsigned long)ntohl(so->so_faddr.s_addr),
-+                                  ntohs(so->so_fport), n1, 1);
-         } else if (sscanf(bptr, "DCC MOVE %256s %u %u %u", buff, &laddr, &lport,
-                           &n1) == 4) {
-             if ((so = tcp_listen(slirp, INADDR_ANY, 0, htonl(laddr),
-@@ -799,10 +797,10 @@ int tcp_emu(struct socket *so, struct mbuf *m)
-                 return 1;
-             }
-             m->m_len = bptr - m->m_data; /* Adjust length */
--            m->m_len +=
--                snprintf(bptr, m->m_size, "DCC MOVE %s %lu %u %u%c\n", buff,
--                         (unsigned long)ntohl(so->so_faddr.s_addr),
--                         ntohs(so->so_fport), n1, 1);
-+            m->m_len += slirp_fmt(bptr, M_FREEROOM(m),
-+                                  "DCC MOVE %s %lu %u %u%c\n", buff,
-+                                  (unsigned long)ntohl(so->so_faddr.s_addr),
-+                                  ntohs(so->so_fport), n1, 1);
-         }
-         return 1;
- 
--- 
-2.20.1
-

debian/patches/extra/0003-ip_reass-Fix-use-after-free.patch

@@ -1,46 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Samuel Thibault <samuel.thibault@ens-lyon.org>
-Date: Mon, 26 Aug 2019 00:55:03 +0200
-Subject: [PATCH] ip_reass: Fix use after free
-
-Using ip_deq after m_free might read pointers from an allocation reuse.
-
-This would be difficult to exploit, but that is still related with
-CVE-2019-14378 which generates fragmented IP packets that would trigger this
-issue and at least produce a DoS.
-
-Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
-(cherry picked from commit c59279437eda91841b9d26079c70b8a540d41204)
-Signed-off-by: Oguz Bektas <o.bektas@proxmox.com>
----
- src/ip_input.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/slirp/src/ip_input.c b/slirp/src/ip_input.c
-index 8c75d91..c07d7d4 100644
---- a/slirp/src/ip_input.c
-+++ b/slirp/src/ip_input.c
-@@ -292,6 +292,7 @@ static struct ip *ip_reass(Slirp *slirp, struct ip *ip, struct ipq *fp)
-      */
-     while (q != (struct ipasfrag *)&fp->frag_link &&
-            ip->ip_off + ip->ip_len > q->ipf_off) {
-+        struct ipasfrag *prev;
-         i = (ip->ip_off + ip->ip_len) - q->ipf_off;
-         if (i < q->ipf_len) {
-             q->ipf_len -= i;
-@@ -299,9 +300,10 @@ static struct ip *ip_reass(Slirp *slirp, struct ip *ip, struct ipq *fp)
-             m_adj(dtom(slirp, q), i);
-             break;
-         }
-+        prev = q;
-         q = q->ipf_next;
--        m_free(dtom(slirp, q->ipf_prev));
--        ip_deq(q->ipf_prev);
-+        ip_deq(prev);
-+        m_free(dtom(slirp, prev));
-     }
- 
- insert:
--- 
-2.20.1
-

debian/patches/pve/0001-PVE-Config-block-file-change-locking-default-to-off.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Wolfgang Bumiller <w.bumiller@proxmox.com>
-Date: Tue, 10 Mar 2020 12:54:58 +0100
-Subject: [PATCH 01/32] PVE: [Config] block/file: change locking default to off
+Date: Mon, 6 Apr 2020 12:16:30 +0200
+Subject: [PATCH] PVE: [Config] block/file: change locking default to off
 
 'auto' only checks whether the system generally supports OFD
 locks but not whether the storage the file resides on
@@ -14,10 +14,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/block/file-posix.c b/block/file-posix.c
-index 1b805bd938..44b49265ae 100644
+index 7e19bbff5f..b527e82a82 100644
 --- a/block/file-posix.c
 +++ b/block/file-posix.c
-@@ -449,7 +449,7 @@ static QemuOptsList raw_runtime_opts = {
+@@ -450,7 +450,7 @@ static QemuOptsList raw_runtime_opts = {
          {
              .name = "locking",
              .type = QEMU_OPT_STRING,
@@ -26,7 +26,7 @@ index 1b805bd938..44b49265ae 100644
          },
          {
              .name = "pr-manager",
-@@ -538,7 +538,7 @@ static int raw_open_common(BlockDriverState *bs, QDict *options,
+@@ -550,7 +550,7 @@ static int raw_open_common(BlockDriverState *bs, QDict *options,
          s->use_lock = false;
          break;
      case ON_OFF_AUTO_AUTO:

debian/patches/pve/0002-PVE-Config-Adjust-network-script-path-to-etc-kvm.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Wolfgang Bumiller <w.bumiller@proxmox.com>
-Date: Tue, 10 Mar 2020 12:54:59 +0100
-Subject: [PATCH 02/32] PVE: [Config] Adjust network script path to /etc/kvm/
+Date: Mon, 6 Apr 2020 12:16:31 +0200
+Subject: [PATCH] PVE: [Config] Adjust network script path to /etc/kvm/
 
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
@@ -9,10 +9,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 3 insertions(+), 2 deletions(-)
 
 diff --git a/include/net/net.h b/include/net/net.h
-index e175ba9677..5b9f099d21 100644
+index 39085d9444..487e3ea1b4 100644
 --- a/include/net/net.h
 +++ b/include/net/net.h
-@@ -208,8 +208,9 @@ void qmp_netdev_add(QDict *qdict, QObject **ret, Error **errp);
+@@ -208,8 +208,9 @@ void netdev_add(QemuOpts *opts, Error **errp);
  int net_hub_id_for_client(NetClientState *nc, int *id);
  NetClientState *net_hub_port_find(int hub_id);
  

debian/patches/pve/0003-PVE-Config-set-the-CPU-model-to-kvm64-32-instead-of-.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Wolfgang Bumiller <w.bumiller@proxmox.com>
-Date: Tue, 10 Mar 2020 12:55:00 +0100
-Subject: [PATCH 03/32] PVE: [Config] set the CPU model to kvm64/32 instead of
+Date: Mon, 6 Apr 2020 12:16:32 +0200
+Subject: [PATCH] PVE: [Config] set the CPU model to kvm64/32 instead of
  qemu64/32
 
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
@@ -10,10 +10,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/target/i386/cpu.h b/target/i386/cpu.h
-index cde2a16b94..3e73104bf9 100644
+index e818fc712a..dd9bf7b3da 100644
 --- a/target/i386/cpu.h
 +++ b/target/i386/cpu.h
-@@ -1940,9 +1940,9 @@ uint64_t cpu_get_tsc(CPUX86State *env);
+@@ -1954,9 +1954,9 @@ uint64_t cpu_get_tsc(CPUX86State *env);
  #define CPU_RESOLVING_TYPE TYPE_X86_CPU
  
  #ifdef TARGET_X86_64

debian/patches/pve/0004-PVE-Config-ui-spice-default-to-pve-certificates.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Wolfgang Bumiller <w.bumiller@proxmox.com>
-Date: Tue, 10 Mar 2020 12:55:01 +0100
-Subject: [PATCH 04/32] PVE: [Config] ui/spice: default to pve certificates
+Date: Mon, 6 Apr 2020 12:16:33 +0200
+Subject: [PATCH] PVE: [Config] ui/spice: default to pve certificates
 
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---

debian/patches/pve/0005-PVE-Config-smm_available-false.patch

@@ -1,19 +1,19 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Alexandre Derumier <aderumier@odiso.com>
-Date: Tue, 10 Mar 2020 12:55:02 +0100
-Subject: [PATCH 05/32] PVE: [Config] smm_available = false
+Date: Mon, 6 Apr 2020 12:16:34 +0200
+Subject: [PATCH] PVE: [Config] smm_available = false
 
 Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
- hw/i386/pc.c | 2 +-
+ hw/i386/x86.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
-diff --git a/hw/i386/pc.c b/hw/i386/pc.c
-index ac08e63604..4bd9ab52a0 100644
---- a/hw/i386/pc.c
-+++ b/hw/i386/pc.c
-@@ -2040,7 +2040,7 @@ bool pc_machine_is_smm_enabled(PCMachineState *pcms)
+diff --git a/hw/i386/x86.c b/hw/i386/x86.c
+index b82770024c..bd05b3c79a 100644
+--- a/hw/i386/x86.c
++++ b/hw/i386/x86.c
+@@ -896,7 +896,7 @@ bool x86_machine_is_smm_enabled(X86MachineState *x86ms)
      if (tcg_enabled() || qtest_enabled()) {
          smm_available = true;
      } else if (kvm_enabled()) {

debian/patches/pve/0006-PVE-Config-glusterfs-no-default-logfile-if-daemonize.patch

@@ -1,8 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Wolfgang Bumiller <w.bumiller@proxmox.com>
-Date: Tue, 10 Mar 2020 12:55:03 +0100
-Subject: [PATCH 06/32] PVE: [Config] glusterfs: no default logfile if
- daemonized
+Date: Mon, 6 Apr 2020 12:16:35 +0200
+Subject: [PATCH] PVE: [Config] glusterfs: no default logfile if daemonized
 
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
@@ -10,7 +9,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 11 insertions(+), 4 deletions(-)
 
 diff --git a/block/gluster.c b/block/gluster.c
-index 4fa4a77a47..bfb57ba098 100644
+index 0aa1f2cda4..dcd1ef7ebc 100644
 --- a/block/gluster.c
 +++ b/block/gluster.c
 @@ -42,7 +42,7 @@

debian/patches/pve/0007-PVE-Config-rbd-block-rbd-disable-rbd_cache_writethro.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Wolfgang Bumiller <w.bumiller@proxmox.com>
-Date: Tue, 10 Mar 2020 12:55:04 +0100
-Subject: [PATCH 07/32] PVE: [Config] rbd: block: rbd: disable
+Date: Mon, 6 Apr 2020 12:16:36 +0200
+Subject: [PATCH] PVE: [Config] rbd: block: rbd: disable
  rbd_cache_writethrough_until_flush
 
 Either the cache mode asks for a cache or not. There's no
@@ -18,10 +18,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 2 insertions(+)
 
 diff --git a/block/rbd.c b/block/rbd.c
-index 027cbcc695..3ac7ff7bd5 100644
+index e637639a07..5717e7258c 100644
 --- a/block/rbd.c
 +++ b/block/rbd.c
-@@ -637,6 +637,8 @@ static int qemu_rbd_connect(rados_t *cluster, rados_ioctx_t *io_ctx,
+@@ -651,6 +651,8 @@ static int qemu_rbd_connect(rados_t *cluster, rados_ioctx_t *io_ctx,
          rados_conf_set(*cluster, "rbd_cache", "false");
      }
  

debian/patches/pve/0008-PVE-Up-qmp-add-get_link_status.patch

@@ -1,20 +1,20 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Wolfgang Bumiller <w.bumiller@proxmox.com>
-Date: Tue, 10 Mar 2020 12:55:05 +0100
-Subject: [PATCH 08/32] PVE: [Up] qmp: add get_link_status
+Date: Mon, 6 Apr 2020 12:16:37 +0200
+Subject: [PATCH] PVE: [Up] qmp: add get_link_status
 
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
- net/net.c             | 27 +++++++++++++++++++++++++++
- qapi/net.json         | 15 +++++++++++++++
- qapi/qapi-schema.json |  1 +
+ net/net.c        | 27 +++++++++++++++++++++++++++
+ qapi/net.json    | 15 +++++++++++++++
+ qapi/pragma.json |  1 +
  3 files changed, 43 insertions(+)
 
 diff --git a/net/net.c b/net/net.c
-index 84aa6d8d00..f548202ec6 100644
+index 38778e831d..dabfb482f0 100644
 --- a/net/net.c
 +++ b/net/net.c
-@@ -1349,6 +1349,33 @@ void hmp_info_network(Monitor *mon, const QDict *qdict)
+@@ -1331,6 +1331,33 @@ void hmp_info_network(Monitor *mon, const QDict *qdict)
      }
  }
  
@@ -49,7 +49,7 @@ index 84aa6d8d00..f548202ec6 100644
  {
      NetClientState *nc;
 diff --git a/qapi/net.json b/qapi/net.json
-index 335295be50..7f3ea194c8 100644
+index cebb1b52e3..f6854483b1 100644
 --- a/qapi/net.json
 +++ b/qapi/net.json
 @@ -34,6 +34,21 @@
@@ -69,20 +69,20 @@ index 335295be50..7f3ea194c8 100644
 +#
 +# Notes: this is an Proxmox VE extension and not offical part of Qemu.
 +##
-+{ 'command': 'get_link_status', 'data': {'name': 'str'}, 'returns': 'int'}
++{ 'command': 'get_link_status', 'data': {'name': 'str'} , 'returns': 'int' }
 +
  ##
  # @netdev_add:
  #
-diff --git a/qapi/qapi-schema.json b/qapi/qapi-schema.json
-index 9751b11f8f..a449f158e1 100644
---- a/qapi/qapi-schema.json
-+++ b/qapi/qapi-schema.json
-@@ -61,6 +61,7 @@
+diff --git a/qapi/pragma.json b/qapi/pragma.json
+index cffae27666..5a3e3de95f 100644
+--- a/qapi/pragma.json
++++ b/qapi/pragma.json
+@@ -5,6 +5,7 @@
+ { 'pragma': {
+     # Commands allowed to return a non-dictionary:
+     'returns-whitelist': [
++	'get_link_status',
+         'human-monitor-command',
+         'qom-get',
          'query-migrate-cache-size',
-         'query-tpm-models',
-         'query-tpm-types',
-+        'get_link_status',
-         'ringbuf-read' ],
-     'name-case-whitelist': [
-         'ACPISlotType',             # DIMM, visible through query-acpi-ospm-status

debian/patches/pve/0009-PVE-Up-glusterfs-allow-partial-reads.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Wolfgang Bumiller <w.bumiller@proxmox.com>
-Date: Tue, 10 Mar 2020 12:55:06 +0100
-Subject: [PATCH 09/32] PVE: [Up] glusterfs: allow partial reads
+Date: Mon, 6 Apr 2020 12:16:38 +0200
+Subject: [PATCH] PVE: [Up] glusterfs: allow partial reads
 
 This should deal with qemu bug #1644754 until upstream
 decides which way to go. The general direction seems to be
@@ -16,7 +16,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 9 insertions(+), 1 deletion(-)
 
 diff --git a/block/gluster.c b/block/gluster.c
-index bfb57ba098..81fff09c6c 100644
+index dcd1ef7ebc..ac79b4bdb4 100644
 --- a/block/gluster.c
 +++ b/block/gluster.c
 @@ -57,6 +57,7 @@ typedef struct GlusterAIOCB {
@@ -47,7 +47,7 @@ index bfb57ba098..81fff09c6c 100644
  
      ret = glfs_zerofill_async(s->fd, offset, size, gluster_finish_aiocb, &acb);
      if (ret < 0) {
-@@ -1215,9 +1219,11 @@ static coroutine_fn int qemu_gluster_co_rw(BlockDriverState *bs,
+@@ -1216,9 +1220,11 @@ static coroutine_fn int qemu_gluster_co_rw(BlockDriverState *bs,
      acb.aio_context = bdrv_get_aio_context(bs);
  
      if (write) {
@@ -59,7 +59,7 @@ index bfb57ba098..81fff09c6c 100644
          ret = glfs_preadv_async(s->fd, qiov->iov, qiov->niov, offset, 0,
                                  gluster_finish_aiocb, &acb);
      }
-@@ -1280,6 +1286,7 @@ static coroutine_fn int qemu_gluster_co_flush_to_disk(BlockDriverState *bs)
+@@ -1281,6 +1287,7 @@ static coroutine_fn int qemu_gluster_co_flush_to_disk(BlockDriverState *bs)
      acb.ret = 0;
      acb.coroutine = qemu_coroutine_self();
      acb.aio_context = bdrv_get_aio_context(bs);
@@ -67,7 +67,7 @@ index bfb57ba098..81fff09c6c 100644
  
      ret = glfs_fsync_async(s->fd, gluster_finish_aiocb, &acb);
      if (ret < 0) {
-@@ -1326,6 +1333,7 @@ static coroutine_fn int qemu_gluster_co_pdiscard(BlockDriverState *bs,
+@@ -1327,6 +1334,7 @@ static coroutine_fn int qemu_gluster_co_pdiscard(BlockDriverState *bs,
      acb.ret = 0;
      acb.coroutine = qemu_coroutine_self();
      acb.aio_context = bdrv_get_aio_context(bs);

debian/patches/pve/0010-PVE-Up-qemu-img-return-success-on-info-without-snaps.patch

@@ -1,8 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Wolfgang Bumiller <w.bumiller@proxmox.com>
-Date: Tue, 10 Mar 2020 12:55:07 +0100
-Subject: [PATCH 10/32] PVE: [Up] qemu-img: return success on info without
- snapshots
+Date: Mon, 6 Apr 2020 12:16:39 +0200
+Subject: [PATCH] PVE: [Up] qemu-img: return success on info without snapshots
 
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
@@ -10,10 +9,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/qemu-img.c b/qemu-img.c
-index 95a24b9762..12211bed76 100644
+index 821cbf610e..667c540a89 100644
 --- a/qemu-img.c
 +++ b/qemu-img.c
-@@ -2791,7 +2791,8 @@ static int img_info(int argc, char **argv)
+@@ -2821,7 +2821,8 @@ static int img_info(int argc, char **argv)
      list = collect_image_info_list(image_opts, filename, fmt, chain,
                                     force_share);
      if (!list) {

debian/patches/pve/0011-PVE-Up-qemu-img-dd-add-osize-and-read-from-to-stdin-.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Wolfgang Bumiller <w.bumiller@proxmox.com>
-Date: Tue, 10 Mar 2020 12:55:08 +0100
-Subject: [PATCH 11/32] PVE: [Up] qemu-img dd: add osize and read from/to
+Date: Mon, 6 Apr 2020 12:16:40 +0200
+Subject: [PATCH] PVE: [Up] qemu-img dd: add osize and read from/to
  stdin/stdout
 
 Neither convert nor dd were previously able to write to or
@@ -37,26 +37,26 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  2 files changed, 122 insertions(+), 74 deletions(-)
 
 diff --git a/qemu-img-cmds.hx b/qemu-img-cmds.hx
-index 1c93e6d185..8094abb3ee 100644
+index c9c54de1df..0f98033658 100644
 --- a/qemu-img-cmds.hx
 +++ b/qemu-img-cmds.hx
-@@ -56,9 +56,9 @@ STEXI
- ETEXI
+@@ -51,9 +51,9 @@ SRST
+ ERST
  
  DEF("dd", img_dd,
 -    "dd [--image-opts] [-U] [-f fmt] [-O output_fmt] [bs=block_size] [count=blocks] [skip=blocks] if=input of=output")
 +    "dd [--image-opts] [-U] [-f fmt] [-O output_fmt] [bs=block_size] [count=blocks] [skip=blocks] [osize=output_size] if=input of=output")
- STEXI
--@item dd [--image-opts] [-U] [-f @var{fmt}] [-O @var{output_fmt}] [bs=@var{block_size}] [count=@var{blocks}] [skip=@var{blocks}] if=@var{input} of=@var{output}
-+@item dd [--image-opts] [-U] [-f @var{fmt}] [-O @var{output_fmt}] [bs=@var{block_size}] [count=@var{blocks}] [skip=@var{blocks}] [osize=output_size] if=@var{input} of=@var{output}
- ETEXI
+ SRST
+-.. option:: dd [--image-opts] [-U] [-f FMT] [-O OUTPUT_FMT] [bs=BLOCK_SIZE] [count=BLOCKS] [skip=BLOCKS] if=INPUT of=OUTPUT
++.. option:: dd [--image-opts] [-U] [-f FMT] [-O OUTPUT_FMT] [bs=BLOCK_SIZE] [count=BLOCKS] [skip=BLOCKS] [osize=OUTPUT_SIZE] if=INPUT of=OUTPUT
+ ERST
  
  DEF("info", img_info,
 diff --git a/qemu-img.c b/qemu-img.c
-index 12211bed76..d2516968c6 100644
+index 667c540a89..6b7d1fcb51 100644
 --- a/qemu-img.c
 +++ b/qemu-img.c
-@@ -4405,10 +4405,12 @@ out:
+@@ -4444,10 +4444,12 @@ out:
  #define C_IF      04
  #define C_OF      010
  #define C_SKIP    020
@@ -69,7 +69,7 @@ index 12211bed76..d2516968c6 100644
  };
  
  struct DdIo {
-@@ -4487,6 +4489,20 @@ static int img_dd_skip(const char *arg,
+@@ -4526,6 +4528,20 @@ static int img_dd_skip(const char *arg,
      return 0;
  }
  
@@ -90,7 +90,7 @@ index 12211bed76..d2516968c6 100644
  static int img_dd(int argc, char **argv)
  {
      int ret = 0;
-@@ -4527,6 +4543,7 @@ static int img_dd(int argc, char **argv)
+@@ -4566,6 +4582,7 @@ static int img_dd(int argc, char **argv)
          { "if", img_dd_if, C_IF },
          { "of", img_dd_of, C_OF },
          { "skip", img_dd_skip, C_SKIP },
@@ -98,7 +98,7 @@ index 12211bed76..d2516968c6 100644
          { NULL, NULL, 0 }
      };
      const struct option long_options[] = {
-@@ -4605,8 +4622,13 @@ static int img_dd(int argc, char **argv)
+@@ -4644,8 +4661,13 @@ static int img_dd(int argc, char **argv)
          arg = NULL;
      }
  
@@ -114,7 +114,7 @@ index 12211bed76..d2516968c6 100644
          ret = -1;
          goto out;
      }
-@@ -4618,85 +4640,101 @@ static int img_dd(int argc, char **argv)
+@@ -4657,85 +4679,101 @@ static int img_dd(int argc, char **argv)
          goto out;
      }
  
@@ -280,7 +280,7 @@ index 12211bed76..d2516968c6 100644
      }
  
      if (dd.flags & C_SKIP && (in.offset > INT64_MAX / in.bsz ||
-@@ -4714,11 +4752,17 @@ static int img_dd(int argc, char **argv)
+@@ -4753,11 +4791,17 @@ static int img_dd(int argc, char **argv)
  
      for (out_pos = 0; in_pos < size; block_count++) {
          int in_ret, out_ret;
@@ -302,7 +302,7 @@ index 12211bed76..d2516968c6 100644
          }
          if (in_ret < 0) {
              error_report("error while reading from input image file: %s",
-@@ -4728,9 +4772,13 @@ static int img_dd(int argc, char **argv)
+@@ -4767,9 +4811,13 @@ static int img_dd(int argc, char **argv)
          }
          in_pos += in_ret;
  

debian/patches/pve/0012-PVE-Up-qemu-img-dd-add-isize-parameter.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Wolfgang Bumiller <w.bumiller@proxmox.com>
-Date: Tue, 10 Mar 2020 12:55:09 +0100
-Subject: [PATCH 12/32] PVE: [Up] qemu-img dd: add isize parameter
+Date: Mon, 6 Apr 2020 12:16:41 +0200
+Subject: [PATCH] PVE: [Up] qemu-img dd: add isize parameter
 
 for writing small images from stdin to bigger ones
 
@@ -15,10 +15,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 26 insertions(+), 3 deletions(-)
 
 diff --git a/qemu-img.c b/qemu-img.c
-index d2516968c6..8da1ea3951 100644
+index 6b7d1fcb51..17393b2f53 100644
 --- a/qemu-img.c
 +++ b/qemu-img.c
-@@ -4406,11 +4406,13 @@ out:
+@@ -4445,11 +4445,13 @@ out:
  #define C_OF      010
  #define C_SKIP    020
  #define C_OSIZE   040
@@ -32,7 +32,7 @@ index d2516968c6..8da1ea3951 100644
  };
  
  struct DdIo {
-@@ -4503,6 +4505,20 @@ static int img_dd_osize(const char *arg,
+@@ -4542,6 +4544,20 @@ static int img_dd_osize(const char *arg,
      return 0;
  }
  
@@ -53,7 +53,7 @@ index d2516968c6..8da1ea3951 100644
  static int img_dd(int argc, char **argv)
  {
      int ret = 0;
-@@ -4517,12 +4533,14 @@ static int img_dd(int argc, char **argv)
+@@ -4556,12 +4572,14 @@ static int img_dd(int argc, char **argv)
      int c, i;
      const char *out_fmt = "raw";
      const char *fmt = NULL;
@@ -69,7 +69,7 @@ index d2516968c6..8da1ea3951 100644
      };
      struct DdIo in = {
          .bsz = 512, /* Block size is by default 512 bytes */
-@@ -4544,6 +4562,7 @@ static int img_dd(int argc, char **argv)
+@@ -4583,6 +4601,7 @@ static int img_dd(int argc, char **argv)
          { "of", img_dd_of, C_OF },
          { "skip", img_dd_skip, C_SKIP },
          { "osize", img_dd_osize, C_OSIZE },
@@ -77,7 +77,7 @@ index d2516968c6..8da1ea3951 100644
          { NULL, NULL, 0 }
      };
      const struct option long_options[] = {
-@@ -4750,14 +4769,18 @@ static int img_dd(int argc, char **argv)
+@@ -4789,14 +4808,18 @@ static int img_dd(int argc, char **argv)
  
      in.buf = g_new(uint8_t, in.bsz);
  

debian/patches/pve/0013-PVE-Up-qemu-img-dd-add-n-skip_create.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Alexandre Derumier <aderumier@odiso.com>
-Date: Tue, 10 Mar 2020 12:55:10 +0100
-Subject: [PATCH 13/32] PVE: [Up] qemu-img dd : add -n skip_create
+Date: Mon, 6 Apr 2020 12:16:42 +0200
+Subject: [PATCH] PVE: [Up] qemu-img dd : add -n skip_create
 
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
@@ -9,10 +9,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 14 insertions(+), 9 deletions(-)
 
 diff --git a/qemu-img.c b/qemu-img.c
-index 8da1ea3951..ea3edb4f04 100644
+index 17393b2f53..574bb3c73d 100644
 --- a/qemu-img.c
 +++ b/qemu-img.c
-@@ -4535,7 +4535,7 @@ static int img_dd(int argc, char **argv)
+@@ -4574,7 +4574,7 @@ static int img_dd(int argc, char **argv)
      const char *fmt = NULL;
      int64_t size = 0, readsize = 0;
      int64_t block_count = 0, out_pos, in_pos;
@@ -21,7 +21,7 @@ index 8da1ea3951..ea3edb4f04 100644
      struct DdInfo dd = {
          .flags = 0,
          .count = 0,
-@@ -4573,7 +4573,7 @@ static int img_dd(int argc, char **argv)
+@@ -4612,7 +4612,7 @@ static int img_dd(int argc, char **argv)
          { 0, 0, 0, 0 }
      };
  
@@ -30,7 +30,7 @@ index 8da1ea3951..ea3edb4f04 100644
          if (c == EOF) {
              break;
          }
-@@ -4593,6 +4593,9 @@ static int img_dd(int argc, char **argv)
+@@ -4632,6 +4632,9 @@ static int img_dd(int argc, char **argv)
          case 'h':
              help();
              break;
@@ -40,7 +40,7 @@ index 8da1ea3951..ea3edb4f04 100644
          case 'U':
              force_share = true;
              break;
-@@ -4733,13 +4736,15 @@ static int img_dd(int argc, char **argv)
+@@ -4772,13 +4775,15 @@ static int img_dd(int argc, char **argv)
                                  size - in.bsz * in.offset, &error_abort);
          }
  

debian/patches/pve/0014-PVE-virtio-balloon-improve-query-balloon.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Wolfgang Bumiller <w.bumiller@proxmox.com>
-Date: Tue, 10 Mar 2020 12:55:11 +0100
-Subject: [PATCH 14/32] PVE: virtio-balloon: improve query-balloon
+Date: Mon, 6 Apr 2020 12:16:43 +0200
+Subject: [PATCH] PVE: virtio-balloon: improve query-balloon
 
 Actually provide memory information via the query-balloon
 command.
@@ -14,7 +14,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  3 files changed, 81 insertions(+), 4 deletions(-)
 
 diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
-index 40b04f5180..76e907e628 100644
+index a4729f7fc9..97c1c16ccf 100644
 --- a/hw/virtio/virtio-balloon.c
 +++ b/hw/virtio/virtio-balloon.c
 @@ -713,8 +713,37 @@ static uint64_t virtio_balloon_get_features(VirtIODevice *vdev, uint64_t f,
@@ -58,10 +58,10 @@ index 40b04f5180..76e907e628 100644
  
  static void virtio_balloon_to_target(void *opaque, ram_addr_t target)
 diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
-index b2551c16d1..2e725ed818 100644
+index 9b94e67879..0c6f6ff331 100644
 --- a/monitor/hmp-cmds.c
 +++ b/monitor/hmp-cmds.c
-@@ -854,7 +854,35 @@ void hmp_info_balloon(Monitor *mon, const QDict *qdict)
+@@ -653,7 +653,35 @@ void hmp_info_balloon(Monitor *mon, const QDict *qdict)
          return;
      }
  
@@ -99,10 +99,10 @@ index b2551c16d1..2e725ed818 100644
      qapi_free_BalloonInfo(info);
  }
 diff --git a/qapi/misc.json b/qapi/misc.json
-index 33b94e3589..ed65ed27e3 100644
+index 99b90ac80b..e2a6678eae 100644
 --- a/qapi/misc.json
 +++ b/qapi/misc.json
-@@ -408,10 +408,30 @@
+@@ -225,10 +225,30 @@
  #
  # @actual: the number of bytes the balloon currently contains
  #

debian/patches/pve/0015-PVE-qapi-modify-query-machines.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Dietmar Maurer <dietmar@proxmox.com>
-Date: Tue, 10 Mar 2020 12:55:12 +0100
-Subject: [PATCH 15/32] PVE: qapi: modify query machines
+Date: Mon, 6 Apr 2020 12:16:44 +0200
+Subject: [PATCH] PVE: qapi: modify query machines
 
 provide '*is-current' in MachineInfo struct
 
@@ -30,10 +30,10 @@ index eed5aeb2f7..1953633e82 100644
              info->default_cpu_type = g_strdup(mc->default_cpu_type);
              info->has_default_cpu_type = true;
 diff --git a/qapi/machine.json b/qapi/machine.json
-index ca26779f1a..cbdb6f6d66 100644
+index ff7b5032e3..f6cf28f9fd 100644
 --- a/qapi/machine.json
 +++ b/qapi/machine.json
-@@ -336,6 +336,8 @@
+@@ -340,6 +340,8 @@
  #
  # @is-default: whether the machine is default
  #
@@ -42,7 +42,7 @@ index ca26779f1a..cbdb6f6d66 100644
  # @cpu-max: maximum number of CPUs supported by the machine type
  #           (since 1.5.0)
  #
-@@ -355,7 +357,7 @@
+@@ -359,7 +361,7 @@
  ##
  { 'struct': 'MachineInfo',
    'data': { 'name': 'str', '*alias': 'str',

debian/patches/pve/0016-PVE-qapi-modify-spice-query.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Wolfgang Bumiller <w.bumiller@proxmox.com>
-Date: Tue, 10 Mar 2020 12:55:13 +0100
-Subject: [PATCH 16/32] PVE: qapi: modify spice query
+Date: Mon, 6 Apr 2020 12:16:45 +0200
+Subject: [PATCH] PVE: qapi: modify spice query
 
 Provide the last ticket in the SpiceInfo struct optionally.
 
@@ -12,10 +12,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  2 files changed, 8 insertions(+)
 
 diff --git a/qapi/ui.json b/qapi/ui.json
-index e04525d8b4..6127990e23 100644
+index e16e98a060..feda6ef090 100644
 --- a/qapi/ui.json
 +++ b/qapi/ui.json
-@@ -211,11 +211,14 @@
+@@ -213,11 +213,14 @@
  #
  # @channels: a list of @SpiceChannel for each active spice channel
  #

debian/patches/pve/0017-PVE-internal-snapshot-async.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Dietmar Maurer <dietmar@proxmox.com>
-Date: Tue, 10 Mar 2020 13:49:27 +0100
-Subject: [PATCH 17/32] PVE: internal snapshot async
+Date: Mon, 6 Apr 2020 12:16:46 +0200
+Subject: [PATCH] PVE: internal snapshot async
 
 Truncate at 1024 boundary (Fabian Ebner will send a patch for stable)
 
@@ -16,34 +16,32 @@ Signed-off-by: Dietmar Maurer <dietmar@proxmox.com>
  monitor/hmp-cmds.c           |  57 +++++
  qapi/migration.json          |  34 +++
  qapi/misc.json               |  32 +++
- qemu-options.hx              |  13 +
+ qemu-options.hx              |  12 +
  savevm-async.c               | 464 +++++++++++++++++++++++++++++++++++
- vl.c                         |  10 +
- 11 files changed, 662 insertions(+)
+ softmmu/vl.c                 |  10 +
+ 11 files changed, 661 insertions(+)
  create mode 100644 savevm-async.c
 
 diff --git a/Makefile.objs b/Makefile.objs
-index 11ba1a36bd..f97b40f232 100644
+index a7c967633a..d0b4dde836 100644
 --- a/Makefile.objs
 +++ b/Makefile.objs
-@@ -48,6 +48,7 @@ common-obj-y += bootdevice.o iothread.o
+@@ -47,6 +47,7 @@ common-obj-y += bootdevice.o iothread.o
  common-obj-y += dump/
  common-obj-y += job-qmp.o
  common-obj-y += monitor/
 +common-obj-y += savevm-async.o
  common-obj-y += net/
- common-obj-y += qdev-monitor.o device-hotplug.o
+ common-obj-y += qdev-monitor.o
  common-obj-$(CONFIG_WIN32) += os-win32.o
 diff --git a/hmp-commands-info.hx b/hmp-commands-info.hx
-index 257ee7d7a3..139e673bea 100644
+index ca5198438d..89fea71972 100644
 --- a/hmp-commands-info.hx
 +++ b/hmp-commands-info.hx
-@@ -608,6 +608,19 @@ STEXI
- @item info migrate_cache_size
- @findex info migrate_cache_size
- Show current migration xbzrle cache size.
-+ETEXI
-+
+@@ -579,6 +579,19 @@ SRST
+     Show current migration xbzrle cache size.
+ ERST
+ 
 +    {
 +        .name       = "savevm",
 +        .args_type  = "",
@@ -52,20 +50,22 @@ index 257ee7d7a3..139e673bea 100644
 +        .cmd = hmp_info_savevm,
 +    },
 +
-+STEXI
-+@item info savevm
-+show savevm status
- ETEXI
- 
++SRST
++  ``info savevm``
++    Show savevm status.
++ERST
++
      {
+         .name       = "balloon",
+         .args_type  = "",
 diff --git a/hmp-commands.hx b/hmp-commands.hx
-index cfcc044ce4..104288322d 100644
+index 7f0f3974ad..81fe305d07 100644
 --- a/hmp-commands.hx
 +++ b/hmp-commands.hx
-@@ -1945,3 +1945,35 @@ ETEXI
- STEXI
- @end table
- ETEXI
+@@ -1814,3 +1814,35 @@ ERST
+         .flags      = "p",
+     },
+ 
 +
 +    {
 +        .name       = "savevm-start",
@@ -110,7 +110,7 @@ index c85b6ec75b..4411b7121d 100644
  
  #endif
 diff --git a/include/monitor/hmp.h b/include/monitor/hmp.h
-index a0e9511440..c6ee8295f0 100644
+index e33ca5a911..601827d43f 100644
 --- a/include/monitor/hmp.h
 +++ b/include/monitor/hmp.h
 @@ -25,6 +25,7 @@ void hmp_info_status(Monitor *mon, const QDict *qdict);
@@ -121,7 +121,7 @@ index a0e9511440..c6ee8295f0 100644
  void hmp_info_migrate(Monitor *mon, const QDict *qdict);
  void hmp_info_migrate_capabilities(Monitor *mon, const QDict *qdict);
  void hmp_info_migrate_parameters(Monitor *mon, const QDict *qdict);
-@@ -102,6 +103,10 @@ void hmp_netdev_add(Monitor *mon, const QDict *qdict);
+@@ -83,6 +84,10 @@ void hmp_netdev_add(Monitor *mon, const QDict *qdict);
  void hmp_netdev_del(Monitor *mon, const QDict *qdict);
  void hmp_getfd(Monitor *mon, const QDict *qdict);
  void hmp_closefd(Monitor *mon, const QDict *qdict);
@@ -131,13 +131,13 @@ index a0e9511440..c6ee8295f0 100644
 +void hmp_savevm_end(Monitor *mon, const QDict *qdict);
  void hmp_sendkey(Monitor *mon, const QDict *qdict);
  void hmp_screendump(Monitor *mon, const QDict *qdict);
- void hmp_nbd_server_start(Monitor *mon, const QDict *qdict);
+ void hmp_chardev_add(Monitor *mon, const QDict *qdict);
 diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
-index 2e725ed818..90aa34be25 100644
+index 0c6f6ff331..39c7474cea 100644
 --- a/monitor/hmp-cmds.c
 +++ b/monitor/hmp-cmds.c
-@@ -2607,6 +2607,63 @@ void hmp_info_memory_devices(Monitor *mon, const QDict *qdict)
-     hmp_handle_error(mon, &err);
+@@ -1876,6 +1876,63 @@ void hmp_info_memory_devices(Monitor *mon, const QDict *qdict)
+     hmp_handle_error(mon, err);
  }
  
 +void hmp_savevm_start(Monitor *mon, const QDict *qdict)
@@ -146,7 +146,7 @@ index 2e725ed818..90aa34be25 100644
 +    const char *statefile = qdict_get_try_str(qdict, "statefile");
 +
 +    qmp_savevm_start(statefile != NULL, statefile, &errp);
-+    hmp_handle_error(mon, &errp);
++    hmp_handle_error(mon, errp);
 +}
 +
 +void hmp_snapshot_drive(Monitor *mon, const QDict *qdict)
@@ -156,7 +156,7 @@ index 2e725ed818..90aa34be25 100644
 +    const char *device = qdict_get_str(qdict, "device");
 +
 +    qmp_snapshot_drive(device, name, &errp);
-+    hmp_handle_error(mon, &errp);
++    hmp_handle_error(mon, errp);
 +}
 +
 +void hmp_delete_drive_snapshot(Monitor *mon, const QDict *qdict)
@@ -166,7 +166,7 @@ index 2e725ed818..90aa34be25 100644
 +    const char *device = qdict_get_str(qdict, "device");
 +
 +    qmp_delete_drive_snapshot(device, name, &errp);
-+    hmp_handle_error(mon, &errp);
++    hmp_handle_error(mon, errp);
 +}
 +
 +void hmp_savevm_end(Monitor *mon, const QDict *qdict)
@@ -174,7 +174,7 @@ index 2e725ed818..90aa34be25 100644
 +    Error *errp = NULL;
 +
 +    qmp_savevm_end(&errp);
-+    hmp_handle_error(mon, &errp);
++    hmp_handle_error(mon, errp);
 +}
 +
 +void hmp_info_savevm(Monitor *mon, const QDict *qdict)
@@ -201,7 +201,7 @@ index 2e725ed818..90aa34be25 100644
  {
      IOThreadInfoList *info_list = qmp_query_iothreads(NULL);
 diff --git a/qapi/migration.json b/qapi/migration.json
-index b7348d0c8b..2792409977 100644
+index eca2981d0a..081663d67a 100644
 --- a/qapi/migration.json
 +++ b/qapi/migration.json
 @@ -222,6 +222,40 @@
@@ -246,10 +246,10 @@ index b7348d0c8b..2792409977 100644
  # @query-migrate:
  #
 diff --git a/qapi/misc.json b/qapi/misc.json
-index ed65ed27e3..4c4618a574 100644
+index e2a6678eae..0868de22b7 100644
 --- a/qapi/misc.json
 +++ b/qapi/misc.json
-@@ -1368,6 +1368,38 @@
+@@ -1165,6 +1165,38 @@
  ##
  { 'command': 'query-fdsets', 'returns': ['FdsetInfo'] }
  
@@ -289,25 +289,24 @@ index ed65ed27e3..4c4618a574 100644
  # @AcpiTableOptions:
  #
 diff --git a/qemu-options.hx b/qemu-options.hx
-index 65c9473b73..4cb2681bfc 100644
+index 16debd03cb..ab80cc46fc 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
-@@ -3818,6 +3818,19 @@ STEXI
- Start right away with a saved state (@code{loadvm} in monitor)
- ETEXI
+@@ -3820,6 +3820,18 @@ SRST
+     Start right away with a saved state (``loadvm`` in monitor)
+ ERST
  
 +DEF("loadstate", HAS_ARG, QEMU_OPTION_loadstate, \
 +    "-loadstate file\n" \
 +    "                start right away with a saved state\n",
 +    QEMU_ARCH_ALL)
-+STEXI
-+@item -loadstate @var{file}
-+@findex -loadstate
-+Start right away with a saved state. This option does not rollback
-+disk state like @code{loadvm}, so user must make sure that disk
-+have correct state. @var{file} can be any valid device URL. See the section
-+for "Device URL Syntax" for more information.
-+ETEXI
++SRST
++``-loadstate file``
++  Start right away with a saved state. This option does not rollback
++  disk state like @code{loadvm}, so user must make sure that disk
++  have correct state. @var{file} can be any valid device URL. See the section
++  for "Device URL Syntax" for more information.
++ERST
 +
  #ifndef _WIN32
  DEF("daemonize", 0, QEMU_OPTION_daemonize, \
@@ -782,11 +781,11 @@ index 0000000000..54ceeae26c
 +    }
 +    return ret;
 +}
-diff --git a/vl.c b/vl.c
-index 6a65a64bfd..1616f55a38 100644
---- a/vl.c
-+++ b/vl.c
-@@ -2840,6 +2840,7 @@ int main(int argc, char **argv, char **envp)
+diff --git a/softmmu/vl.c b/softmmu/vl.c
+index 58a40bcfc1..312fa8ccda 100644
+--- a/softmmu/vl.c
++++ b/softmmu/vl.c
+@@ -2827,6 +2827,7 @@ void qemu_init(int argc, char **argv, char **envp)
      int optind;
      const char *optarg;
      const char *loadvm = NULL;
@@ -794,7 +793,7 @@ index 6a65a64bfd..1616f55a38 100644
      MachineClass *machine_class;
      const char *cpu_option;
      const char *vga_model = NULL;
-@@ -3430,6 +3431,9 @@ int main(int argc, char **argv, char **envp)
+@@ -3391,6 +3392,9 @@ void qemu_init(int argc, char **argv, char **envp)
              case QEMU_OPTION_loadvm:
                  loadvm = optarg;
                  break;
@@ -804,7 +803,7 @@ index 6a65a64bfd..1616f55a38 100644
              case QEMU_OPTION_full_screen:
                  dpy.has_full_screen = true;
                  dpy.full_screen = true;
-@@ -4442,6 +4446,12 @@ int main(int argc, char **argv, char **envp)
+@@ -4442,6 +4446,12 @@ void qemu_init(int argc, char **argv, char **envp)
              autostart = 0;
              exit(1);
          }

debian/patches/pve/0018-PVE-block-add-the-zeroinit-block-driver-filter.patch

@@ -1,17 +1,17 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Wolfgang Bumiller <w.bumiller@proxmox.com>
-Date: Tue, 10 Mar 2020 12:55:15 +0100
-Subject: [PATCH 18/32] PVE: block: add the zeroinit block driver filter
+Date: Mon, 6 Apr 2020 12:16:47 +0200
+Subject: [PATCH] PVE: block: add the zeroinit block driver filter
 
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
  block/Makefile.objs |   1 +
- block/zeroinit.c    | 204 ++++++++++++++++++++++++++++++++++++++++++++
- 2 files changed, 205 insertions(+)
+ block/zeroinit.c    | 197 ++++++++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 198 insertions(+)
  create mode 100644 block/zeroinit.c
 
 diff --git a/block/Makefile.objs b/block/Makefile.objs
-index e394fe0b6c..a10ceabf5b 100644
+index 3635b6b4c1..1282445672 100644
 --- a/block/Makefile.objs
 +++ b/block/Makefile.objs
 @@ -11,6 +11,7 @@ block-obj-$(CONFIG_QED) += qed.o qed-l2-cache.o qed-table.o qed-cluster.o
@@ -24,10 +24,10 @@ index e394fe0b6c..a10ceabf5b 100644
  block-obj-y += blklogwrites.o
 diff --git a/block/zeroinit.c b/block/zeroinit.c
 new file mode 100644
-index 0000000000..b74a78ece6
+index 0000000000..ff38388d94
 --- /dev/null
 +++ b/block/zeroinit.c
-@@ -0,0 +1,204 @@
+@@ -0,0 +1,197 @@
 +/*
 + * Filter to fake a zero-initialized block device.
 + *
@@ -162,12 +162,6 @@ index 0000000000..b74a78ece6
 +    return bdrv_co_pwritev(bs->file, offset, bytes, qiov, flags);
 +}
 +
-+static bool zeroinit_recurse_is_first_non_filter(BlockDriverState *bs,
-+                                                  BlockDriverState *candidate)
-+{
-+    return bdrv_recurse_is_first_non_filter(bs->file->bs, candidate);
-+}
-+
 +static coroutine_fn int zeroinit_co_flush(BlockDriverState *bs)
 +{
 +    return bdrv_co_flush(bs->file->bs);
@@ -214,7 +208,6 @@ index 0000000000..b74a78ece6
 +    .bdrv_co_flush                    = zeroinit_co_flush,
 +
 +    .is_filter                        = true,
-+    .bdrv_recurse_is_first_non_filter = zeroinit_recurse_is_first_non_filter,
 +
 +    .bdrv_has_zero_init               = zeroinit_has_zero_init,
 +

debian/patches/pve/0019-PVE-Add-dummy-id-command-line-parameter.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Wolfgang Bumiller <w.bumiller@proxmox.com>
-Date: Tue, 10 Mar 2020 12:55:17 +0100
-Subject: [PATCH 20/32] PVE: Add dummy -id command line parameter
+Date: Mon, 6 Apr 2020 12:16:48 +0200
+Subject: [PATCH] PVE: Add dummy -id command line parameter
 
 This used to be part of the qemu-side PVE authentication for
 VNC. Now this does nothing.
@@ -10,16 +10,16 @@ Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
  qemu-options.hx | 3 +++
- vl.c            | 8 ++++++++
+ softmmu/vl.c    | 8 ++++++++
  2 files changed, 11 insertions(+)
 
 diff --git a/qemu-options.hx b/qemu-options.hx
-index 4cb2681bfc..b84e260fa5 100644
+index ab80cc46fc..726f006576 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
-@@ -826,6 +826,9 @@ STEXI
- @table @option
- ETEXI
+@@ -904,6 +904,9 @@ DEFHEADING()
+ 
+ DEFHEADING(Block device options:)
  
 +DEF("id", HAS_ARG, QEMU_OPTION_id,
 +    "-id n           set the VMID", QEMU_ARCH_ALL)
@@ -27,19 +27,19 @@ index 4cb2681bfc..b84e260fa5 100644
  DEF("fda", HAS_ARG, QEMU_OPTION_fda,
      "-fda/-fdb file  use 'file' as floppy disk 0/1 image\n", QEMU_ARCH_ALL)
  DEF("fdb", HAS_ARG, QEMU_OPTION_fdb, "", QEMU_ARCH_ALL)
-diff --git a/vl.c b/vl.c
-index 1616f55a38..4df15640c5 100644
---- a/vl.c
-+++ b/vl.c
-@@ -2828,6 +2828,7 @@ static void user_register_global_props(void)
- int main(int argc, char **argv, char **envp)
+diff --git a/softmmu/vl.c b/softmmu/vl.c
+index 312fa8ccda..4dcde069a8 100644
+--- a/softmmu/vl.c
++++ b/softmmu/vl.c
+@@ -2815,6 +2815,7 @@ static void create_default_memdev(MachineState *ms, const char *path)
+ void qemu_init(int argc, char **argv, char **envp)
  {
      int i;
 +    long vm_id;
      int snapshot, linux_boot;
      const char *initrd_filename;
      const char *kernel_filename, *kernel_cmdline;
-@@ -3560,6 +3561,13 @@ int main(int argc, char **argv, char **envp)
+@@ -3518,6 +3519,13 @@ void qemu_init(int argc, char **argv, char **envp)
                      exit(1);
                  }
                  break;

debian/patches/pve/0020-PVE-Config-Revert-target-i386-disable-LINT0-after-re.patch

@@ -1,8 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Wolfgang Bumiller <w.bumiller@proxmox.com>
-Date: Tue, 10 Mar 2020 12:55:18 +0100
-Subject: [PATCH 21/32] PVE: [Config] Revert "target-i386: disable LINT0 after
- reset"
+Date: Mon, 6 Apr 2020 12:16:49 +0200
+Subject: [PATCH] PVE: [Config] Revert "target-i386: disable LINT0 after reset"
 
 This reverts commit b8eb5512fd8a115f164edbbe897cdf8884920ccb.
 
@@ -12,7 +11,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 9 insertions(+)
 
 diff --git a/hw/intc/apic_common.c b/hw/intc/apic_common.c
-index 375cb6abe9..e7d479c7e9 100644
+index 9ec0f2deb2..a00d45251f 100644
 --- a/hw/intc/apic_common.c
 +++ b/hw/intc/apic_common.c
 @@ -259,6 +259,15 @@ static void apic_reset_common(DeviceState *dev)

debian/patches/pve/0021-PVE-Up-Config-file-posix-make-locking-optiono-on-cre.patch

@@ -1,8 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Wolfgang Bumiller <w.bumiller@proxmox.com>
-Date: Tue, 10 Mar 2020 12:55:19 +0100
-Subject: [PATCH 22/32] PVE: [Up+Config] file-posix: make locking optiono on
- create
+Date: Mon, 6 Apr 2020 12:16:50 +0200
+Subject: [PATCH] PVE: [Up+Config] file-posix: make locking optiono on create
 
 Otherwise creating images on nfs/cifs can be problematic.
 
@@ -14,10 +13,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  2 files changed, 43 insertions(+), 21 deletions(-)
 
 diff --git a/block/file-posix.c b/block/file-posix.c
-index 44b49265ae..0722b0f529 100644
+index b527e82a82..36ebd0967e 100644
 --- a/block/file-posix.c
 +++ b/block/file-posix.c
-@@ -2250,6 +2250,7 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
+@@ -2309,6 +2309,7 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
      int fd;
      uint64_t perm, shared;
      int result = 0;
@@ -25,7 +24,7 @@ index 44b49265ae..0722b0f529 100644
  
      /* Validate options and set default values */
      assert(options->driver == BLOCKDEV_DRIVER_FILE);
-@@ -2283,19 +2284,22 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
+@@ -2342,19 +2343,22 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
      perm = BLK_PERM_WRITE | BLK_PERM_RESIZE;
      shared = BLK_PERM_ALL & ~BLK_PERM_RESIZE;
  
@@ -60,7 +59,7 @@ index 44b49265ae..0722b0f529 100644
      }
  
      /* Clear the file by truncating it to 0 */
-@@ -2328,13 +2332,15 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
+@@ -2387,13 +2391,15 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
      }
  
  out_unlock:
@@ -83,7 +82,7 @@ index 44b49265ae..0722b0f529 100644
      }
  
  out_close:
-@@ -2355,6 +2361,7 @@ static int coroutine_fn raw_co_create_opts(const char *filename, QemuOpts *opts,
+@@ -2416,6 +2422,7 @@ static int coroutine_fn raw_co_create_opts(BlockDriver *drv,
      PreallocMode prealloc;
      char *buf = NULL;
      Error *local_err = NULL;
@@ -91,7 +90,7 @@ index 44b49265ae..0722b0f529 100644
  
      /* Skip file: protocol prefix */
      strstart(filename, "file:", &filename);
-@@ -2372,6 +2379,18 @@ static int coroutine_fn raw_co_create_opts(const char *filename, QemuOpts *opts,
+@@ -2433,6 +2440,18 @@ static int coroutine_fn raw_co_create_opts(BlockDriver *drv,
          return -EINVAL;
      }
  
@@ -110,7 +109,7 @@ index 44b49265ae..0722b0f529 100644
      options = (BlockdevCreateOptions) {
          .driver     = BLOCKDEV_DRIVER_FILE,
          .u.file     = {
-@@ -2381,6 +2400,8 @@ static int coroutine_fn raw_co_create_opts(const char *filename, QemuOpts *opts,
+@@ -2442,6 +2461,8 @@ static int coroutine_fn raw_co_create_opts(BlockDriver *drv,
              .preallocation      = prealloc,
              .has_nocow          = true,
              .nocow              = nocow,
@@ -119,7 +118,7 @@ index 44b49265ae..0722b0f529 100644
          },
      };
      return raw_co_create(&options, errp);
-@@ -2901,7 +2922,7 @@ static int raw_check_perm(BlockDriverState *bs, uint64_t perm, uint64_t shared,
+@@ -2983,7 +3004,7 @@ static int raw_check_perm(BlockDriverState *bs, uint64_t perm, uint64_t shared,
      }
  
      /* Copy locks to the new fd */
@@ -129,10 +128,10 @@ index 44b49265ae..0722b0f529 100644
                                     false, errp);
          if (ret < 0) {
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 0cf68fea14..783a868eb2 100644
+index 943df1926a..4c55464f86 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -4259,7 +4259,8 @@
+@@ -4183,7 +4183,8 @@
    'data': { 'filename':         'str',
              'size':             'size',
              '*preallocation':   'PreallocMode',

debian/patches/pve/0022-PVE-savevm-async-kick-AIO-wait-on-block-state-write.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Thomas Lamprecht <t.lamprecht@proxmox.com>
-Date: Tue, 10 Mar 2020 12:55:20 +0100
-Subject: [PATCH 23/32] PVE: savevm-async: kick AIO wait on block state write
+Date: Mon, 6 Apr 2020 12:16:51 +0200
+Subject: [PATCH] PVE: savevm-async: kick AIO wait on block state write
 
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---

debian/patches/pve/0023-PVE-move-snapshot-cleanup-into-bottom-half.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Wolfgang Bumiller <w.bumiller@proxmox.com>
-Date: Tue, 10 Mar 2020 12:55:21 +0100
-Subject: [PATCH 24/32] PVE: move snapshot cleanup into bottom half
+Date: Mon, 6 Apr 2020 12:16:52 +0200
+Subject: [PATCH] PVE: move snapshot cleanup into bottom half
 
 as per:
     (0ceccd858a8d) migration: qemu_savevm_state_cleanup() in cleanup

debian/patches/pve/0024-PVE-monitor-disable-oob-capability.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Wolfgang Bumiller <w.bumiller@proxmox.com>
-Date: Tue, 10 Mar 2020 12:55:22 +0100
-Subject: [PATCH 25/32] PVE: monitor: disable oob capability
+Date: Mon, 6 Apr 2020 12:16:53 +0200
+Subject: [PATCH] PVE: monitor: disable oob capability
 
 A bisect revealed that commit 8258292e18c3
 ("monitor: Remove "x-oob", offer capability "oob" unconditionally")
@@ -18,11 +18,11 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 1 insertion(+), 2 deletions(-)
 
 diff --git a/monitor/qmp.c b/monitor/qmp.c
-index b67a8e7d1f..8f44fed944 100644
+index f89e7daf27..ed5e39fcf7 100644
 --- a/monitor/qmp.c
 +++ b/monitor/qmp.c
-@@ -395,8 +395,7 @@ void monitor_init_qmp(Chardev *chr, bool pretty)
-     MonitorQMP *mon = g_new0(MonitorQMP, 1);
+@@ -406,8 +406,7 @@ void monitor_init_qmp(Chardev *chr, bool pretty, Error **errp)
+     qemu_chr_fe_set_echo(&mon->common.chr, true);
  
      /* Note: we run QMP monitor in I/O thread when @chr supports that */
 -    monitor_data_init(&mon->common, true, false,

debian/patches/pve/0025-PVE-Compat-4.0-used-balloon-qemu-4-0-config-size-fal.patch

@@ -1,8 +1,8 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Thomas Lamprecht <t.lamprecht@proxmox.com>
-Date: Tue, 10 Mar 2020 12:55:24 +0100
-Subject: [PATCH 27/32] PVE: [Compat]: 4.0 used balloon qemu-4-0-config-size
- false here
+Date: Mon, 6 Apr 2020 12:16:54 +0200
+Subject: [PATCH] PVE: [Compat]: 4.0 used balloon qemu-4-0-config-size false
+ here
 
 The underlying issue why this change from upstream to us arised in
 the first place is that QEMU 4.0 was already released at the point we
@@ -26,12 +26,12 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/hw/core/machine.c b/hw/core/machine.c
-index 1689ad3bf8..bdcb351ede 100644
+index de0c425605..d5a892680f 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
-@@ -39,7 +39,8 @@ GlobalProperty hw_compat_4_0[] = {
+@@ -55,7 +55,8 @@ GlobalProperty hw_compat_4_0[] = {
      { "virtio-vga",     "edid", "false" },
-     { "virtio-gpu",     "edid", "false" },
+     { "virtio-gpu-device", "edid", "false" },
      { "virtio-device", "use-started", "false" },
 -    { "virtio-balloon-device", "qemu-4-0-config-size", "true" },
 +    // PVE differed from upstream for 4.0 balloon cfg size

debian/patches/pve/0026-PVE-Allow-version-code-in-machine-type.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Dietmar Maurer <dietmar@proxmox.com>
-Date: Tue, 10 Mar 2020 12:55:25 +0100
-Subject: [PATCH 28/32] PVE: Allow version code in machine type
+Date: Mon, 6 Apr 2020 12:16:55 +0200
+Subject: [PATCH] PVE: Allow version code in machine type
 
 E.g. pc-i440fx-4.0+pve3 would print 'pve3' as version code while
 selecting pc-i440fx-4.0 as machine type.
@@ -14,7 +14,7 @@ Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
  hw/core/machine-qmp-cmds.c |  6 ++++++
  include/hw/boards.h        |  2 ++
  qapi/machine.json          |  3 ++-
- vl.c                       | 15 ++++++++++++++-
+ softmmu/vl.c               | 15 ++++++++++++++-
  4 files changed, 24 insertions(+), 2 deletions(-)
 
 diff --git a/hw/core/machine-qmp-cmds.c b/hw/core/machine-qmp-cmds.c
@@ -35,10 +35,10 @@ index 1953633e82..ca8c0dc53d 100644
  
          if (mc->default_cpu_type) {
 diff --git a/include/hw/boards.h b/include/hw/boards.h
-index de45087f34..e24d2134c0 100644
+index fd4d62b501..dd395e9232 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
-@@ -185,6 +185,8 @@ struct MachineClass {
+@@ -170,6 +170,8 @@ struct MachineClass {
      const char *desc;
      const char *deprecation_reason;
  
@@ -48,10 +48,10 @@ index de45087f34..e24d2134c0 100644
      void (*reset)(MachineState *state);
      void (*wakeup)(MachineState *state);
 diff --git a/qapi/machine.json b/qapi/machine.json
-index cbdb6f6d66..a2bd4dd304 100644
+index f6cf28f9fd..a7f9c79a59 100644
 --- a/qapi/machine.json
 +++ b/qapi/machine.json
-@@ -359,7 +359,8 @@
+@@ -363,7 +363,8 @@
    'data': { 'name': 'str', '*alias': 'str',
              '*is-default': 'bool', '*is-current': 'bool', 'cpu-max': 'int',
              'hotpluggable-cpus': 'bool',  'numa-mem-supported': 'bool',
@@ -61,11 +61,11 @@ index cbdb6f6d66..a2bd4dd304 100644
  
  ##
  # @query-machines:
-diff --git a/vl.c b/vl.c
-index 4df15640c5..e7f3ce7607 100644
---- a/vl.c
-+++ b/vl.c
-@@ -2475,6 +2475,8 @@ static MachineClass *machine_parse(const char *name, GSList *machines)
+diff --git a/softmmu/vl.c b/softmmu/vl.c
+index 4dcde069a8..b08956ac90 100644
+--- a/softmmu/vl.c
++++ b/softmmu/vl.c
+@@ -2300,6 +2300,8 @@ static MachineClass *machine_parse(const char *name, GSList *machines)
  {
      MachineClass *mc;
      GSList *el;
@@ -74,7 +74,7 @@ index 4df15640c5..e7f3ce7607 100644
  
      if (is_help_option(name)) {
          printf("Supported machines are:\n");
-@@ -2491,12 +2493,23 @@ static MachineClass *machine_parse(const char *name, GSList *machines)
+@@ -2316,12 +2318,23 @@ static MachineClass *machine_parse(const char *name, GSList *machines)
          exit(0);
      }
  

debian/patches/pve/0027-PVE-Backup-modify-job-api.patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Wolfgang Bumiller <w.bumiller@proxmox.com>
-Date: Tue, 10 Mar 2020 12:55:16 +0100
-Subject: [PATCH 19/32] PVE: backup: modify job api
+Date: Mon, 6 Apr 2020 12:16:56 +0200
+Subject: [PATCH] PVE-Backup: modify job api
 
 Introduce a pause_count parameter to start a backup in
 paused mode. This way backups of multiple drives can be
@@ -18,10 +18,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  5 files changed, 8 insertions(+), 3 deletions(-)
 
 diff --git a/block/backup.c b/block/backup.c
-index cf62b1a38c..c155081de2 100644
+index a7a7dcaf4c..ecd93e91e0 100644
 --- a/block/backup.c
 +++ b/block/backup.c
-@@ -347,6 +347,7 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
+@@ -338,6 +338,7 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
                    BlockdevOnError on_target_error,
                    int creation_flags,
                    BlockCompletionFunc *cb, void *opaque,
@@ -29,7 +29,7 @@ index cf62b1a38c..c155081de2 100644
                    JobTxn *txn, Error **errp)
  {
      int64_t len;
-@@ -468,6 +469,8 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
+@@ -459,6 +460,8 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
      block_job_add_bdrv(&job->common, "target", target, 0, BLK_PERM_ALL,
                         &error_abort);
  
@@ -39,10 +39,10 @@ index cf62b1a38c..c155081de2 100644
  
   error:
 diff --git a/block/replication.c b/block/replication.c
-index 99532ce521..ec8de7b427 100644
+index da013c2041..17246a822c 100644
 --- a/block/replication.c
 +++ b/block/replication.c
-@@ -546,7 +546,7 @@ static void replication_start(ReplicationState *rs, ReplicationMode mode,
+@@ -554,7 +554,7 @@ static void replication_start(ReplicationState *rs, ReplicationMode mode,
                                  0, MIRROR_SYNC_MODE_NONE, NULL, 0, false, NULL,
                                  BLOCKDEV_ON_ERROR_REPORT,
                                  BLOCKDEV_ON_ERROR_REPORT, JOB_INTERNAL,
@@ -52,10 +52,10 @@ index 99532ce521..ec8de7b427 100644
              error_propagate(errp, local_err);
              backup_job_cleanup(bs);
 diff --git a/blockdev.c b/blockdev.c
-index 8e029e9c01..c7fa663ebf 100644
+index 5faddaa705..65c358e4ef 100644
 --- a/blockdev.c
 +++ b/blockdev.c
-@@ -3583,7 +3583,8 @@ static BlockJob *do_backup_common(BackupCommon *backup,
+@@ -3114,7 +3114,8 @@ static BlockJob *do_backup_common(BackupCommon *backup,
                              backup->filter_node_name,
                              backup->on_source_error,
                              backup->on_target_error,
@@ -66,22 +66,22 @@ index 8e029e9c01..c7fa663ebf 100644
  }
  
 diff --git a/include/block/block_int.h b/include/block/block_int.h
-index dd033d0b37..b0d5eb9485 100644
+index 4c3587ea19..336f71e69d 100644
 --- a/include/block/block_int.h
 +++ b/include/block/block_int.h
-@@ -1215,6 +1215,7 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
+@@ -1219,6 +1219,7 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
                              BlockdevOnError on_target_error,
                              int creation_flags,
                              BlockCompletionFunc *cb, void *opaque,
 +                            int pause_count,
                              JobTxn *txn, Error **errp);
  
- void hmp_drive_add_node(Monitor *mon, const char *optstr);
+ BdrvChild *bdrv_root_attach_child(BlockDriverState *child_bs,
 diff --git a/job.c b/job.c
-index 04409b40aa..7554f735e3 100644
+index 53be57a3a0..e82253e041 100644
 --- a/job.c
 +++ b/job.c
-@@ -888,7 +888,7 @@ void job_start(Job *job)
+@@ -918,7 +918,7 @@ void job_start(Job *job)
      job->co = qemu_coroutine_create(job_co_entry, job);
      job->pause_count--;
      job->busy = true;

debian/patches/pve/0028-PVE-Backup-add-vma-backup-format-code.patch

@@ -1,26 +1,26 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Dietmar Maurer <dietmar@proxmox.com>
-Date: Tue, 10 Mar 2020 12:55:26 +0100
-Subject: [PATCH 29/32] PVE-Backup: add vma backup format code
+Date: Mon, 6 Apr 2020 12:16:57 +0200
+Subject: [PATCH] PVE-Backup: add vma backup format code
 
 ---
  Makefile      |   3 +-
  Makefile.objs |   1 +
  vma-reader.c  | 857 ++++++++++++++++++++++++++++++++++++++++++++++++++
  vma-writer.c  | 771 +++++++++++++++++++++++++++++++++++++++++++++
- vma.c         | 838 ++++++++++++++++++++++++++++++++++++++++++++++++
+ vma.c         | 837 ++++++++++++++++++++++++++++++++++++++++++++++++
  vma.h         | 150 +++++++++
- 6 files changed, 2619 insertions(+), 1 deletion(-)
+ 6 files changed, 2618 insertions(+), 1 deletion(-)
  create mode 100644 vma-reader.c
  create mode 100644 vma-writer.c
  create mode 100644 vma.c
  create mode 100644 vma.h
 
 diff --git a/Makefile b/Makefile
-index b437a346d7..18d2dba2e4 100644
+index 84ef881600..da4c7d982d 100644
 --- a/Makefile
 +++ b/Makefile
-@@ -453,7 +453,7 @@ dummy := $(call unnest-vars,, \
+@@ -479,7 +479,7 @@ dummy := $(call unnest-vars,, \
  
  include $(SRC_PATH)/tests/Makefile.include
  
@@ -29,16 +29,16 @@ index b437a346d7..18d2dba2e4 100644
  
  qemu-version.h: FORCE
  	$(call quiet-command, \
-@@ -567,6 +567,7 @@ qemu-img.o: qemu-img-cmds.h
- qemu-img$(EXESUF): qemu-img.o $(authz-obj-y) $(block-obj-y) $(crypto-obj-y) $(io-obj-y) $(qom-obj-y) $(COMMON_LDADDS)
+@@ -608,6 +608,7 @@ qemu-img$(EXESUF): qemu-img.o $(authz-obj-y) $(block-obj-y) $(crypto-obj-y) $(io
  qemu-nbd$(EXESUF): qemu-nbd.o $(authz-obj-y) $(block-obj-y) $(crypto-obj-y) $(io-obj-y) $(qom-obj-y) $(COMMON_LDADDS)
  qemu-io$(EXESUF): qemu-io.o $(authz-obj-y) $(block-obj-y) $(crypto-obj-y) $(io-obj-y) $(qom-obj-y) $(COMMON_LDADDS)
+ qemu-storage-daemon$(EXESUF): qemu-storage-daemon.o $(authz-obj-y) $(block-obj-y) $(crypto-obj-y) $(chardev-obj-y) $(io-obj-y) $(qom-obj-y) $(storage-daemon-obj-y) $(COMMON_LDADDS)
 +vma$(EXESUF): vma.o vma-reader.o $(authz-obj-y) $(block-obj-y) $(crypto-obj-y) $(io-obj-y) $(qom-obj-y) $(COMMON_LDADDS)
  
  qemu-bridge-helper$(EXESUF): qemu-bridge-helper.o $(COMMON_LDADDS)
  
 diff --git a/Makefile.objs b/Makefile.objs
-index f97b40f232..db7fbbe73b 100644
+index d0b4dde836..05031a3da7 100644
 --- a/Makefile.objs
 +++ b/Makefile.objs
 @@ -18,6 +18,7 @@ block-obj-y += block.o blockjob.o job.o
@@ -1694,7 +1694,7 @@ new file mode 100644
 index 0000000000..a82752448a
 --- /dev/null
 +++ b/vma.c
-@@ -0,0 +1,838 @@
+@@ -0,0 +1,837 @@
 +/*
 + * VMA: Virtual Machine Archive
 + *
@@ -2330,7 +2330,6 @@ index 0000000000..a82752448a
 +    }
 +
 +    int devcount = 0;
-+    VmaStatus vmastat;
 +    while (optind < argc) {
 +        const char *path = argv[optind++];
 +        char *devname = NULL;
@@ -2348,8 +2347,7 @@ index 0000000000..a82752448a
 +        int dev_id = vma_writer_register_stream(vmaw, devname, size);
 +        if (dev_id <= 0) {
 +            unlink(archivename);
-+            vma_writer_get_status(vmaw, &vmastat);
-+            g_error("error for device '%s': %s", devname, vmastat.errmsg);
++            g_error("vma_writer_register_stream '%s' failed", devname);
 +        }
 +
 +        BackupJob *job = g_new0(BackupJob, 1);
@@ -2362,6 +2360,7 @@ index 0000000000..a82752448a
 +        qemu_coroutine_enter(co);
 +    }
 +
++    VmaStatus vmastat;
 +    int percent = 0;
 +    int last_percent = -1;
 +

debian/patches/pve/0029-PVE-Backup-add-backup-dump-block-driver.patch

@@ -1,28 +1,26 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Dietmar Maurer <dietmar@proxmox.com>
-Date: Tue, 10 Mar 2020 12:55:27 +0100
-Subject: [PATCH 30/32] PVE-Backup: add backup-dump block driver
+Date: Mon, 6 Apr 2020 12:16:58 +0200
+Subject: [PATCH] PVE-Backup: add backup-dump block driver
 
 - add backup-dump block driver block/backup-dump.c
 - move BackupBlockJob declaration from block/backup.c to include/block/block_int.h
 - block/backup.c - backup-job-create: also consider source cluster size
-- block/io.c - bdrv_do_drained_begin_quiesce: check for coroutine
 - job.c: make job_should_pause non-static
 ---
  block/Makefile.objs       |   1 +
  block/backup-dump.c       | 169 ++++++++++++++++++++++++++++++++++++++
  block/backup.c            |  23 ++----
- block/io.c                |   8 +-
  include/block/block_int.h |  30 +++++++
  job.c                     |   3 +-
- 6 files changed, 214 insertions(+), 20 deletions(-)
+ 5 files changed, 207 insertions(+), 19 deletions(-)
  create mode 100644 block/backup-dump.c
 
 diff --git a/block/Makefile.objs b/block/Makefile.objs
-index a10ceabf5b..5cd9e40d8d 100644
+index 1282445672..8af7073c83 100644
 --- a/block/Makefile.objs
 +++ b/block/Makefile.objs
-@@ -33,6 +33,7 @@ block-obj-$(CONFIG_RBD) += rbd.o
+@@ -34,6 +34,7 @@ block-obj-$(CONFIG_RBD) += rbd.o
  block-obj-$(CONFIG_GLUSTERFS) += gluster.o
  block-obj-$(CONFIG_VXHS) += vxhs.o
  block-obj-$(CONFIG_LIBSSH) += ssh.o
@@ -206,7 +204,7 @@ index 0000000000..3066ab0698
 +    return bs;
 +}
 diff --git a/block/backup.c b/block/backup.c
-index c155081de2..9d23da027f 100644
+index ecd93e91e0..cf8f5ad25d 100644
 --- a/block/backup.c
 +++ b/block/backup.c
 @@ -32,24 +32,6 @@
@@ -234,7 +232,7 @@ index c155081de2..9d23da027f 100644
  static const BlockJobDriver backup_job_driver;
  
  static void backup_progress_bytes_callback(int64_t bytes, void *opaque)
-@@ -420,6 +402,11 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
+@@ -411,6 +393,11 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
          goto error;
      }
  
@@ -246,27 +244,8 @@ index c155081de2..9d23da027f 100644
      /*
       * If source is in backing chain of target assume that target is going to be
       * used for "image fleecing", i.e. it should represent a kind of snapshot of
-diff --git a/block/io.c b/block/io.c
-index f75777f5ea..75dea5ae33 100644
---- a/block/io.c
-+++ b/block/io.c
-@@ -381,7 +381,13 @@ static void coroutine_fn bdrv_co_yield_to_drain(BlockDriverState *bs,
- void bdrv_do_drained_begin_quiesce(BlockDriverState *bs,
-                                    BdrvChild *parent, bool ignore_bds_parents)
- {
--    assert(!qemu_in_coroutine());
-+    // AFAICT this function is just an optimization, but sadly it doesn't play
-+    // nice with the PVE backup code (when we're in a coroutine, even in
-+    // pvebackup_co_start), so just call the full-blown drain begin instead
-+    if (qemu_in_coroutine()) {
-+        bdrv_do_drained_begin(bs, false, parent, ignore_bds_parents, false);
-+        return;
-+    }
- 
-     /* Stop things in parent-to-child order */
-     if (atomic_fetch_inc(&bs->quiesce_counter) == 0) {
 diff --git a/include/block/block_int.h b/include/block/block_int.h
-index b0d5eb9485..105bffe0f7 100644
+index 336f71e69d..62e5579723 100644
 --- a/include/block/block_int.h
 +++ b/include/block/block_int.h
 @@ -60,6 +60,36 @@
@@ -307,10 +286,10 @@ index b0d5eb9485..105bffe0f7 100644
      BDRV_TRACKED_READ,
      BDRV_TRACKED_WRITE,
 diff --git a/job.c b/job.c
-index 7554f735e3..b03ef989e2 100644
+index e82253e041..bcbbb0be02 100644
 --- a/job.c
 +++ b/job.c
-@@ -248,7 +248,8 @@ static bool job_started(Job *job)
+@@ -269,7 +269,8 @@ static bool job_started(Job *job)
      return job->co;
  }
  

debian/patches/pve/0030-PVE-Backup-proxmox-backup-patches-for-qemu.patch

@@ -1,33 +1,55 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Dietmar Maurer <dietmar@proxmox.com>
-Date: Tue, 10 Mar 2020 12:55:28 +0100
-Subject: [PATCH 31/32] PVE-Backup: proxmox backup patches for qemu
+Date: Mon, 6 Apr 2020 12:16:59 +0200
+Subject: [PATCH] PVE-Backup: proxmox backup patches for qemu
 
 ---
- Makefile.objs             |   1 +
- Makefile.target           |   2 +-
- blockdev.c                |   1 +
- hmp-commands-info.hx      |  13 +
- hmp-commands.hx           |  31 ++
- include/block/block_int.h |   2 +-
- include/monitor/hmp.h     |   3 +
- monitor/hmp-cmds.c        |  77 +++
- proxmox-backup-client.c   | 182 ++++++++
- proxmox-backup-client.h   |  52 +++
- pve-backup.c              | 959 ++++++++++++++++++++++++++++++++++++++
- qapi/block-core.json      | 109 +++++
- qapi/common.json          |  13 +
- qapi/misc.json            |  13 -
- 14 files changed, 1443 insertions(+), 15 deletions(-)
+ Makefile                       |   1 +
+ Makefile.objs                  |   2 +
+ Makefile.target                |   2 +-
+ block/monitor/block-hmp-cmds.c |  33 ++
+ blockdev.c                     |   1 +
+ hmp-commands-info.hx           |  13 +
+ hmp-commands.hx                |  29 +
+ include/block/block_int.h      |   2 +-
+ include/monitor/hmp.h          |   3 +
+ monitor/hmp-cmds.c             |  44 ++
+ proxmox-backup-client.c        | 182 +++++++
+ proxmox-backup-client.h        |  52 ++
+ pve-backup.c                   | 959 +++++++++++++++++++++++++++++++++
+ qapi/block-core.json           | 109 ++++
+ qapi/common.json               |  13 +
+ qapi/misc.json                 |  13 -
+ 16 files changed, 1443 insertions(+), 15 deletions(-)
  create mode 100644 proxmox-backup-client.c
  create mode 100644 proxmox-backup-client.h
  create mode 100644 pve-backup.c
 
+diff --git a/Makefile b/Makefile
+index da4c7d982d..49c1d8c1b6 100644
+--- a/Makefile
++++ b/Makefile
+@@ -608,6 +608,7 @@ qemu-img$(EXESUF): qemu-img.o $(authz-obj-y) $(block-obj-y) $(crypto-obj-y) $(io
+ qemu-nbd$(EXESUF): qemu-nbd.o $(authz-obj-y) $(block-obj-y) $(crypto-obj-y) $(io-obj-y) $(qom-obj-y) $(COMMON_LDADDS)
+ qemu-io$(EXESUF): qemu-io.o $(authz-obj-y) $(block-obj-y) $(crypto-obj-y) $(io-obj-y) $(qom-obj-y) $(COMMON_LDADDS)
+ qemu-storage-daemon$(EXESUF): qemu-storage-daemon.o $(authz-obj-y) $(block-obj-y) $(crypto-obj-y) $(chardev-obj-y) $(io-obj-y) $(qom-obj-y) $(storage-daemon-obj-y) $(COMMON_LDADDS)
++qemu-storage-daemon$(EXESUF): LIBS += -lproxmox_backup_qemu
+ vma$(EXESUF): vma.o vma-reader.o $(authz-obj-y) $(block-obj-y) $(crypto-obj-y) $(io-obj-y) $(qom-obj-y) $(COMMON_LDADDS)
+ 
+ qemu-bridge-helper$(EXESUF): qemu-bridge-helper.o $(COMMON_LDADDS)
 diff --git a/Makefile.objs b/Makefile.objs
-index db7fbbe73b..4406dcfeba 100644
+index 05031a3da7..b7d58e592e 100644
 --- a/Makefile.objs
 +++ b/Makefile.objs
-@@ -46,6 +46,7 @@ io-obj-y = io/
+@@ -34,6 +34,7 @@ endif # CONFIG_SOFTMMU or CONFIG_TOOLS
+ 
+ storage-daemon-obj-y = block/ monitor/ qapi/ qom/ storage-daemon/
+ storage-daemon-obj-y += blockdev.o blockdev-nbd.o iothread.o job-qmp.o
++storage-daemon-obj-y += proxmox-backup-client.o pve-backup.o
+ storage-daemon-obj-$(CONFIG_WIN32) += os-win32.o
+ storage-daemon-obj-$(CONFIG_POSIX) += os-posix.o
+ 
+@@ -45,6 +46,7 @@ storage-daemon-obj-$(CONFIG_POSIX) += os-posix.o
  ifeq ($(CONFIG_SOFTMMU),y)
  common-obj-y = blockdev.o blockdev-nbd.o block/
  common-obj-y += bootdevice.o iothread.o
@@ -36,20 +58,61 @@ index db7fbbe73b..4406dcfeba 100644
  common-obj-y += job-qmp.o
  common-obj-y += monitor/
 diff --git a/Makefile.target b/Makefile.target
-index 24d79d26eb..d7d91085a4 100644
+index 8ed1eba95b..f453a95efc 100644
 --- a/Makefile.target
 +++ b/Makefile.target
-@@ -160,7 +160,7 @@ obj-y += qapi/
- obj-y += memory.o
+@@ -162,7 +162,7 @@ obj-y += memory.o
  obj-y += memory_mapping.o
  obj-y += migration/ram.o
+ obj-y += softmmu/
 -LIBS := $(libs_softmmu) $(LIBS)
-+LIBS := $(libs_softmmu) $(LIBS) -lproxmox_backup_qemu
++LIBS := $(libs_softmmu) $(LIBS)  -lproxmox_backup_qemu
  
  # Hardware support
  ifeq ($(TARGET_NAME), sparc64)
+diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
+index 4c8c375172..4f03881286 100644
+--- a/block/monitor/block-hmp-cmds.c
++++ b/block/monitor/block-hmp-cmds.c
+@@ -1011,3 +1011,36 @@ void hmp_info_snapshots(Monitor *mon, const QDict *qdict)
+     g_free(sn_tab);
+     g_free(global_snapshots);
+ }
++
++void hmp_backup_cancel(Monitor *mon, const QDict *qdict)
++{
++    Error *error = NULL;
++
++    qmp_backup_cancel(&error);
++
++    hmp_handle_error(mon, error);
++}
++
++void hmp_backup(Monitor *mon, const QDict *qdict)
++{
++    Error *error = NULL;
++
++    int dir = qdict_get_try_bool(qdict, "directory", 0);
++    const char *backup_file = qdict_get_str(qdict, "backupfile");
++    const char *devlist = qdict_get_try_str(qdict, "devlist");
++    int64_t speed = qdict_get_try_int(qdict, "speed", 0);
++
++    qmp_backup(
++        backup_file,
++        false, NULL, // BPS password
++        false, NULL, // BPS keyfile
++        false, NULL, // BPS key_password
++        false, NULL, // BPS fingerprint
++        false, NULL, // BPS backup-id
++        false, 0, // BPS backup-time
++        true, dir ? BACKUP_FORMAT_DIR : BACKUP_FORMAT_VMA,
++        false, NULL, false, NULL, !!devlist,
++        devlist, qdict_haskey(qdict, "speed"), speed, &error);
++
++    hmp_handle_error(mon, error);
++}
 diff --git a/blockdev.c b/blockdev.c
-index c7fa663ebf..e5310cb939 100644
+index 65c358e4ef..f391c3b3c7 100644
 --- a/blockdev.c
 +++ b/blockdev.c
 @@ -36,6 +36,7 @@
@@ -61,38 +124,38 @@ index c7fa663ebf..e5310cb939 100644
  #include "monitor/monitor.h"
  #include "qemu/error-report.h"
 diff --git a/hmp-commands-info.hx b/hmp-commands-info.hx
-index 139e673bea..8db5ce03a7 100644
+index 89fea71972..64995443d4 100644
 --- a/hmp-commands-info.hx
 +++ b/hmp-commands-info.hx
-@@ -536,6 +536,19 @@ STEXI
- @item info cpustats
- @findex info cpustats
- Show CPU statistics.
-+ETEXI
-+
+@@ -512,6 +512,19 @@ SRST
+     Show CPU statistics.
+ ERST
+ 
 +    {
 +        .name       = "backup",
 +        .args_type  = "",
 +        .params     = "",
 +        .help       = "show backup status",
-+        .cmd = hmp_info_backup,
++        .cmd        = hmp_info_backup,
 +    },
 +
-+STEXI
-+@item info backup
-+show backup status
- ETEXI
- 
++SRST
++  ``info backup``
++    Show backup status.
++ERST
++
  #if defined(CONFIG_SLIRP)
+     {
+         .name       = "usernet",
 diff --git a/hmp-commands.hx b/hmp-commands.hx
-index 104288322d..29d11dd321 100644
+index 81fe305d07..8a03b45c44 100644
 --- a/hmp-commands.hx
 +++ b/hmp-commands.hx
-@@ -105,6 +105,37 @@ STEXI
- @item block_stream
- @findex block_stream
- Copy data from a backing file into a block device.
-+ETEXI
+@@ -97,6 +97,35 @@ ERST
+ SRST
+ ``block_stream``
+   Copy data from a backing file into a block device.
++ERST
 +
 +   {
 +        .name       = "backup",
@@ -104,30 +167,28 @@ index 104288322d..29d11dd321 100644
 +        .cmd = hmp_backup,
 +    },
 +
-+STEXI
-+@item backup
-+@findex backup
-+Create a VM backup.
-+ETEXI
++SRST
++``backup``
++  Create a VM backup.
++ERST
 +
 +    {
 +        .name       = "backup_cancel",
 +        .args_type  = "",
 +        .params     = "",
 +        .help       = "cancel the current VM backup",
-+        .cmd = hmp_backup_cancel,
++        .cmd        = hmp_backup_cancel,
 +    },
 +
-+STEXI
-+@item backup_cancel
-+@findex backup_cancel
-+Cancel the current VM backup.
++SRST
++``backup_cancel``
++  Cancel the current VM backup.
 +
- ETEXI
+ ERST
  
      {
 diff --git a/include/block/block_int.h b/include/block/block_int.h
-index 105bffe0f7..43b00c15ac 100644
+index 62e5579723..6d234f1de9 100644
 --- a/include/block/block_int.h
 +++ b/include/block/block_int.h
 @@ -62,7 +62,7 @@
@@ -140,7 +201,7 @@ index 105bffe0f7..43b00c15ac 100644
      uint64_t byte_size,
      BackupDumpFunc *dump_cb,
 diff --git a/include/monitor/hmp.h b/include/monitor/hmp.h
-index c6ee8295f0..0f2f96c4af 100644
+index 601827d43f..6653d04c3c 100644
 --- a/include/monitor/hmp.h
 +++ b/include/monitor/hmp.h
 @@ -30,6 +30,7 @@ void hmp_info_migrate(Monitor *mon, const QDict *qdict);
@@ -149,22 +210,22 @@ index c6ee8295f0..0f2f96c4af 100644
  void hmp_info_migrate_cache_size(Monitor *mon, const QDict *qdict);
 +void hmp_info_backup(Monitor *mon, const QDict *qdict);
  void hmp_info_cpus(Monitor *mon, const QDict *qdict);
- void hmp_info_block(Monitor *mon, const QDict *qdict);
- void hmp_info_blockstats(Monitor *mon, const QDict *qdict);
-@@ -90,6 +91,8 @@ void hmp_eject(Monitor *mon, const QDict *qdict);
+ void hmp_info_vnc(Monitor *mon, const QDict *qdict);
+ void hmp_info_spice(Monitor *mon, const QDict *qdict);
+@@ -76,6 +77,8 @@ void hmp_x_colo_lost_heartbeat(Monitor *mon, const QDict *qdict);
+ void hmp_set_password(Monitor *mon, const QDict *qdict);
+ void hmp_expire_password(Monitor *mon, const QDict *qdict);
  void hmp_change(Monitor *mon, const QDict *qdict);
- void hmp_block_set_io_throttle(Monitor *mon, const QDict *qdict);
- void hmp_block_stream(Monitor *mon, const QDict *qdict);
 +void hmp_backup(Monitor *mon, const QDict *qdict);
 +void hmp_backup_cancel(Monitor *mon, const QDict *qdict);
- void hmp_block_job_set_speed(Monitor *mon, const QDict *qdict);
- void hmp_block_job_cancel(Monitor *mon, const QDict *qdict);
- void hmp_block_job_pause(Monitor *mon, const QDict *qdict);
+ void hmp_migrate(Monitor *mon, const QDict *qdict);
+ void hmp_device_add(Monitor *mon, const QDict *qdict);
+ void hmp_device_del(Monitor *mon, const QDict *qdict);
 diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
-index 90aa34be25..1e33c61a2c 100644
+index 39c7474cea..7fd59b1c22 100644
 --- a/monitor/hmp-cmds.c
 +++ b/monitor/hmp-cmds.c
-@@ -194,6 +194,50 @@ void hmp_info_mice(Monitor *mon, const QDict *qdict)
+@@ -192,6 +192,50 @@ void hmp_info_mice(Monitor *mon, const QDict *qdict)
      qapi_free_MouseInfoList(mice_list);
  }
  
@@ -215,46 +276,6 @@ index 90aa34be25..1e33c61a2c 100644
  static char *SocketAddress_to_str(SocketAddress *addr)
  {
      switch (addr->type) {
-@@ -2062,6 +2106,39 @@ void hmp_block_stream(Monitor *mon, const QDict *qdict)
-     hmp_handle_error(mon, &error);
- }
- 
-+void hmp_backup_cancel(Monitor *mon, const QDict *qdict)
-+{
-+    Error *error = NULL;
-+
-+    qmp_backup_cancel(&error);
-+
-+    hmp_handle_error(mon, &error);
-+}
-+
-+void hmp_backup(Monitor *mon, const QDict *qdict)
-+{
-+    Error *error = NULL;
-+
-+    int dir = qdict_get_try_bool(qdict, "directory", 0);
-+    const char *backup_file = qdict_get_str(qdict, "backupfile");
-+    const char *devlist = qdict_get_try_str(qdict, "devlist");
-+    int64_t speed = qdict_get_try_int(qdict, "speed", 0);
-+
-+    qmp_backup(
-+        backup_file,
-+        false, NULL, // BPS password
-+        false, NULL, // BPS keyfile
-+        false, NULL, // BPS key_password
-+        false, NULL, // BPS fingerprint
-+        false, NULL, // BPS backup-id
-+        false, 0, // BPS backup-time
-+        true, dir ? BACKUP_FORMAT_DIR : BACKUP_FORMAT_VMA,
-+        false, NULL, false, NULL, !!devlist,
-+        devlist, qdict_haskey(qdict, "speed"), speed, &error);
-+
-+    hmp_handle_error(mon, &error);
-+}
-+
- void hmp_block_job_set_speed(Monitor *mon, const QDict *qdict)
- {
-     Error *error = NULL;
 diff --git a/proxmox-backup-client.c b/proxmox-backup-client.c
 new file mode 100644
 index 0000000000..b7bc7f2574
@@ -1467,10 +1488,10 @@ index 0000000000..9ae89fb679
 +    return task.result;
 +}
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 783a868eb2..0b987ad6e3 100644
+index 4c55464f86..97d1f64636 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -800,6 +800,115 @@
+@@ -744,6 +744,115 @@
  { 'command': 'query-block', 'returns': ['BlockInfo'] }
  
  
@@ -1608,10 +1629,10 @@ index 7b9cbcd97b..c3b8bb7b48 100644
 +##
 +{ 'struct': 'UuidInfo', 'data': {'UUID': 'str'} }
 diff --git a/qapi/misc.json b/qapi/misc.json
-index 4c4618a574..7d506b5300 100644
+index 0868de22b7..c690a3707d 100644
 --- a/qapi/misc.json
 +++ b/qapi/misc.json
-@@ -270,19 +270,6 @@
+@@ -129,19 +129,6 @@
  ##
  { 'command': 'query-kvm', 'returns': 'KvmInfo' }
  

debian/patches/pve/0031-PVE-Backup-aquire-aio_context-before-calling-backup_.patch

@@ -1,6 +1,6 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Dietmar Maurer <dietmar@proxmox.com>
-Date: Wed, 11 Mar 2020 13:00:56 +0100
+Date: Mon, 6 Apr 2020 12:17:00 +0200
 Subject: [PATCH] PVE-Backup: aquire aio_context before calling
  backup_job_create
 
@@ -37,6 +37,3 @@ index 9ae89fb679..38dd33e28b 100644
          if (!job || local_err != NULL) {
              qemu_co_rwlock_wrlock(&backup_state.stat.rwlock);
              error_setg(&backup_state.stat.error, "backup_job_create failed");
--- 
-2.20.1
-

debian/patches/pve/0032-PVE-Backup-pbs-restore-new-command-to-restore-from-p.patch

@@ -1,8 +1,8 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Dietmar Maurer <dietmar@proxmox.com>
-Date: Tue, 10 Mar 2020 12:55:29 +0100
-Subject: [PATCH 32/32] PVE-Backup: pbs-restore - new command to restore from
- proxmox backup server
+Date: Mon, 6 Apr 2020 12:17:01 +0200
+Subject: [PATCH] PVE-Backup: pbs-restore - new command to restore from proxmox
+ backup server
 
 ---
  Makefile      |   4 +-
@@ -11,10 +11,10 @@ Subject: [PATCH 32/32] PVE-Backup: pbs-restore - new command to restore from
  create mode 100644 pbs-restore.c
 
 diff --git a/Makefile b/Makefile
-index 18d2dba2e4..469a1e3666 100644
+index 49c1d8c1b6..0096b83be5 100644
 --- a/Makefile
 +++ b/Makefile
-@@ -453,7 +453,7 @@ dummy := $(call unnest-vars,, \
+@@ -479,7 +479,7 @@ dummy := $(call unnest-vars,, \
  
  include $(SRC_PATH)/tests/Makefile.include
  
@@ -23,9 +23,9 @@ index 18d2dba2e4..469a1e3666 100644
  
  qemu-version.h: FORCE
  	$(call quiet-command, \
-@@ -568,6 +568,8 @@ qemu-img$(EXESUF): qemu-img.o $(authz-obj-y) $(block-obj-y) $(crypto-obj-y) $(io
- qemu-nbd$(EXESUF): qemu-nbd.o $(authz-obj-y) $(block-obj-y) $(crypto-obj-y) $(io-obj-y) $(qom-obj-y) $(COMMON_LDADDS)
- qemu-io$(EXESUF): qemu-io.o $(authz-obj-y) $(block-obj-y) $(crypto-obj-y) $(io-obj-y) $(qom-obj-y) $(COMMON_LDADDS)
+@@ -610,6 +610,8 @@ qemu-io$(EXESUF): qemu-io.o $(authz-obj-y) $(block-obj-y) $(crypto-obj-y) $(io-o
+ qemu-storage-daemon$(EXESUF): qemu-storage-daemon.o $(authz-obj-y) $(block-obj-y) $(crypto-obj-y) $(chardev-obj-y) $(io-obj-y) $(qom-obj-y) $(storage-daemon-obj-y) $(COMMON_LDADDS)
+ qemu-storage-daemon$(EXESUF): LIBS += -lproxmox_backup_qemu
  vma$(EXESUF): vma.o vma-reader.o $(authz-obj-y) $(block-obj-y) $(crypto-obj-y) $(io-obj-y) $(qom-obj-y) $(COMMON_LDADDS)
 +pbs-restore$(EXESUF): pbs-restore.o $(authz-obj-y) $(block-obj-y) $(crypto-obj-y) $(io-obj-y) $(qom-obj-y) $(COMMON_LDADDS)
 +pbs-restore$(EXESUF): LIBS += -lproxmox_backup_qemu

debian/patches/pve/0033-PVE-Backup-avoid-coroutines-to-fix-AIO-freeze-cleanu.patch

@@ -0,0 +1,884 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Dietmar Maurer <dietmar@proxmox.com>
+Date: Mon, 6 Apr 2020 12:17:02 +0200
+Subject: [PATCH] PVE-Backup: avoid coroutines to fix AIO freeze, cleanups
+
+We observed various AIO pool loop freezes, so we decided to avoid
+coroutines and restrict ourselfes using similar code as upstream
+(see blockdev.c: do_backup_common).
+
+* avoid coroutine for job related code (causes hangs with iothreads)
+    - this imply to use normal QemuRecMutex instead of CoMutex
+
+* split pvebackup_co_dump_cb into:
+    - pvebackup_co_dump_pbs_cb and
+    - pvebackup_co_dump_pbs_cb
+
+* new helper functions
+    - pvebackup_propagate_error
+    - pvebackup_error_or_canceled
+    - pvebackup_add_transfered_bytes
+
+* avoid cancel flag (not needed)
+
+* simplify backup_cancel logic
+
+There is progress on upstream to support running qmp commands inside
+coroutines, see:
+
+https://lists.gnu.org/archive/html/qemu-devel/2020-02/msg04852.html
+
+We should consider using that when it is available in upstream qemu.
+---
+ pve-backup.c | 611 +++++++++++++++++++++++++--------------------------
+ 1 file changed, 299 insertions(+), 312 deletions(-)
+
+diff --git a/pve-backup.c b/pve-backup.c
+index 38dd33e28b..169f0c68d0 100644
+--- a/pve-backup.c
++++ b/pve-backup.c
+@@ -11,11 +11,10 @@
+ 
+ /* PVE backup state and related function */
+ 
+-
+ static struct PVEBackupState {
+     struct {
+-        // Everithing accessed from qmp command, protected using rwlock
+-        CoRwlock rwlock;
++        // Everithing accessed from qmp_backup_query command is protected using lock
++        QemuRecMutex lock;
+         Error *error;
+         time_t start_time;
+         time_t end_time;
+@@ -25,19 +24,18 @@ static struct PVEBackupState {
+         size_t total;
+         size_t transferred;
+         size_t zero_bytes;
+-        bool cancel;
+     } stat;
+     int64_t speed;
+     VmaWriter *vmaw;
+     ProxmoxBackupHandle *pbs;
+     GList *di_list;
+-    CoMutex backup_mutex;
++    QemuRecMutex backup_mutex;
+ } backup_state;
+ 
+ static void pvebackup_init(void)
+ {
+-    qemu_co_rwlock_init(&backup_state.stat.rwlock);
+-    qemu_co_mutex_init(&backup_state.backup_mutex);
++    qemu_rec_mutex_init(&backup_state.stat.lock);
++    qemu_rec_mutex_init(&backup_state.backup_mutex);
+ }
+ 
+ // initialize PVEBackupState at startup
+@@ -52,10 +50,54 @@ typedef struct PVEBackupDevInfo {
+     BlockDriverState *target;
+ } PVEBackupDevInfo;
+ 
+-static void pvebackup_co_run_next_job(void);
++static void pvebackup_run_next_job(void);
++
++static BlockJob *
++lookup_active_block_job(PVEBackupDevInfo *di)
++{
++    if (!di->completed && di->bs) {
++        for (BlockJob *job = block_job_next(NULL); job; job = block_job_next(job)) {
++            if (job->job.driver->job_type != JOB_TYPE_BACKUP) {
++                continue;
++            }
++
++            BackupBlockJob *bjob = container_of(job, BackupBlockJob, common);
++            if (bjob && bjob->source_bs == di->bs) {
++                return job;
++            }
++        }
++    }
++    return NULL;
++}
++
++static void pvebackup_propagate_error(Error *err)
++{
++    qemu_rec_mutex_lock(&backup_state.stat.lock);
++    error_propagate(&backup_state.stat.error, err);
++    qemu_rec_mutex_unlock(&backup_state.stat.lock);
++}
++
++static bool pvebackup_error_or_canceled(void)
++{
++    qemu_rec_mutex_lock(&backup_state.stat.lock);
++    bool error_or_canceled = !!backup_state.stat.error;
++    qemu_rec_mutex_unlock(&backup_state.stat.lock);
++
++    return error_or_canceled;
++}
+ 
++static void pvebackup_add_transfered_bytes(size_t transferred, size_t zero_bytes)
++{
++    qemu_rec_mutex_lock(&backup_state.stat.lock);
++    backup_state.stat.zero_bytes += zero_bytes;
++    backup_state.stat.transferred += transferred;
++    qemu_rec_mutex_unlock(&backup_state.stat.lock);
++}
++
++// This may get called from multiple coroutines in multiple io-threads
++// Note1: this may get called after job_cancel()
+ static int coroutine_fn
+-pvebackup_co_dump_cb(
++pvebackup_co_dump_pbs_cb(
+     void *opaque,
+     uint64_t start,
+     uint64_t bytes,
+@@ -67,137 +109,129 @@ pvebackup_co_dump_cb(
+     const unsigned char *buf = pbuf;
+     PVEBackupDevInfo *di = opaque;
+ 
+-    qemu_co_rwlock_rdlock(&backup_state.stat.rwlock);
+-    bool cancel = backup_state.stat.cancel;
+-    qemu_co_rwlock_unlock(&backup_state.stat.rwlock);
++    assert(backup_state.pbs);
++
++    Error *local_err = NULL;
++    int pbs_res = -1;
++
++    qemu_rec_mutex_lock(&backup_state.backup_mutex);
+ 
+-    if (cancel) {
+-        return size; // return success
++    // avoid deadlock if job is cancelled
++    if (pvebackup_error_or_canceled()) {
++        qemu_rec_mutex_unlock(&backup_state.backup_mutex);
++        return -1;
+     }
+ 
+-    qemu_co_mutex_lock(&backup_state.backup_mutex);
++    pbs_res = proxmox_backup_co_write_data(backup_state.pbs, di->dev_id, buf, start, size, &local_err);
++    qemu_rec_mutex_unlock(&backup_state.backup_mutex);
+ 
+-    int ret = -1;
++    if (pbs_res < 0) {
++        pvebackup_propagate_error(local_err);
++        return pbs_res;
++    } else {
++        pvebackup_add_transfered_bytes(size, !buf ? size : 0);
++    }
+ 
+-    if (backup_state.vmaw) {
+-        size_t zero_bytes = 0;
+-        uint64_t remaining = size;
+-
+-        uint64_t cluster_num = start / VMA_CLUSTER_SIZE;
+-        if ((cluster_num * VMA_CLUSTER_SIZE) != start) {
+-            qemu_co_rwlock_rdlock(&backup_state.stat.rwlock);
+-            if (!backup_state.stat.error) {
+-                qemu_co_rwlock_upgrade(&backup_state.stat.rwlock);
+-                error_setg(&backup_state.stat.error,
+-                           "got unaligned write inside backup dump "
+-                           "callback (sector %ld)", start);
+-            }
+-            qemu_co_rwlock_unlock(&backup_state.stat.rwlock);
+-            qemu_co_mutex_unlock(&backup_state.backup_mutex);
+-            return -1; // not aligned to cluster size
+-        }
++    return size;
++}
+ 
+-        while (remaining > 0) {
+-            ret = vma_writer_write(backup_state.vmaw, di->dev_id, cluster_num,
+-                                   buf, &zero_bytes);
+-            ++cluster_num;
+-            if (buf) {
+-                buf += VMA_CLUSTER_SIZE;
+-            }
+-            if (ret < 0) {
+-                qemu_co_rwlock_rdlock(&backup_state.stat.rwlock);
+-                if (!backup_state.stat.error) {
+-                    qemu_co_rwlock_upgrade(&backup_state.stat.rwlock);
+-                    vma_writer_error_propagate(backup_state.vmaw, &backup_state.stat.error);
+-                }
+-                qemu_co_rwlock_unlock(&backup_state.stat.rwlock);
++// This may get called from multiple coroutines in multiple io-threads
++static int coroutine_fn
++pvebackup_co_dump_vma_cb(
++    void *opaque,
++    uint64_t start,
++    uint64_t bytes,
++    const void *pbuf)
++{
++    assert(qemu_in_coroutine());
+ 
+-                qemu_co_mutex_unlock(&backup_state.backup_mutex);
+-                return ret;
+-            } else {
+-                qemu_co_rwlock_wrlock(&backup_state.stat.rwlock);
+-                backup_state.stat.zero_bytes += zero_bytes;
+-                if (remaining >= VMA_CLUSTER_SIZE) {
+-                    backup_state.stat.transferred += VMA_CLUSTER_SIZE;
+-                    remaining -= VMA_CLUSTER_SIZE;
+-                } else {
+-                    backup_state.stat.transferred += remaining;
+-                    remaining = 0;
+-                }
+-                qemu_co_rwlock_unlock(&backup_state.stat.rwlock);
+-            }
+-        }
+-    } else if (backup_state.pbs) {
+-        Error *local_err = NULL;
+-        int pbs_res = -1;
++    const uint64_t size = bytes;
++    const unsigned char *buf = pbuf;
++    PVEBackupDevInfo *di = opaque;
+ 
+-        pbs_res = proxmox_backup_co_write_data(backup_state.pbs, di->dev_id, buf, start, size, &local_err);
+ 
+-        qemu_co_rwlock_wrlock(&backup_state.stat.rwlock);
++    int ret = -1;
+ 
+-        if (pbs_res < 0) {
+-            error_propagate(&backup_state.stat.error, local_err);
+-            qemu_co_rwlock_unlock(&backup_state.stat.rwlock);
+-            qemu_co_mutex_unlock(&backup_state.backup_mutex);
+-            return pbs_res;
+-        } else {
+-            if (!buf) {
+-                backup_state.stat.zero_bytes += size;
+-            }
+-            backup_state.stat.transferred += size;
++    assert(backup_state.vmaw);
++
++    uint64_t remaining = size;
++
++    uint64_t cluster_num = start / VMA_CLUSTER_SIZE;
++    if ((cluster_num * VMA_CLUSTER_SIZE) != start) {
++        Error *local_err = NULL;
++        error_setg(&local_err,
++                   "got unaligned write inside backup dump "
++                   "callback (sector %ld)", start);
++        pvebackup_propagate_error(local_err);
++        return -1; // not aligned to cluster size
++    }
++
++    while (remaining > 0) {
++        qemu_rec_mutex_lock(&backup_state.backup_mutex);
++        // avoid deadlock if job is cancelled
++        if (pvebackup_error_or_canceled()) {
++            qemu_rec_mutex_unlock(&backup_state.backup_mutex);
++            return -1;
+         }
+ 
+-        qemu_co_rwlock_unlock(&backup_state.stat.rwlock);
++        size_t zero_bytes = 0;
++        ret = vma_writer_write(backup_state.vmaw, di->dev_id, cluster_num, buf, &zero_bytes);
++        qemu_rec_mutex_unlock(&backup_state.backup_mutex);
+ 
+-    } else {
+-        qemu_co_rwlock_wrlock(&backup_state.stat.rwlock);
+-        if (!buf) {
+-            backup_state.stat.zero_bytes += size;
++        ++cluster_num;
++        if (buf) {
++            buf += VMA_CLUSTER_SIZE;
++        }
++        if (ret < 0) {
++            Error *local_err = NULL;
++            vma_writer_error_propagate(backup_state.vmaw, &local_err);
++            pvebackup_propagate_error(local_err);
++            return ret;
++        } else {
++            if (remaining >= VMA_CLUSTER_SIZE) {
++                assert(ret == VMA_CLUSTER_SIZE);
++                pvebackup_add_transfered_bytes(VMA_CLUSTER_SIZE, zero_bytes);
++                remaining -= VMA_CLUSTER_SIZE;
++            } else {
++                assert(ret == remaining);
++                pvebackup_add_transfered_bytes(remaining, zero_bytes);
++                remaining = 0;
++            }
+         }
+-        backup_state.stat.transferred += size;
+-        qemu_co_rwlock_unlock(&backup_state.stat.rwlock);
+     }
+ 
+-    qemu_co_mutex_unlock(&backup_state.backup_mutex);
+-
+     return size;
+ }
+ 
+-static void coroutine_fn pvebackup_co_cleanup(void)
++static void coroutine_fn pvebackup_co_cleanup(void *unused)
+ {
+     assert(qemu_in_coroutine());
+ 
+-    qemu_co_mutex_lock(&backup_state.backup_mutex);
++    qemu_rec_mutex_lock(&backup_state.backup_mutex);
+ 
+-    qemu_co_rwlock_wrlock(&backup_state.stat.rwlock);
++    qemu_rec_mutex_lock(&backup_state.stat.lock);
+     backup_state.stat.end_time = time(NULL);
+-    qemu_co_rwlock_unlock(&backup_state.stat.rwlock);
++    qemu_rec_mutex_unlock(&backup_state.stat.lock);
+ 
+     if (backup_state.vmaw) {
+         Error *local_err = NULL;
+         vma_writer_close(backup_state.vmaw, &local_err);
+ 
+         if (local_err != NULL) {
+-            qemu_co_rwlock_wrlock(&backup_state.stat.rwlock);
+-            error_propagate(&backup_state.stat.error, local_err);
+-            qemu_co_rwlock_unlock(&backup_state.stat.rwlock);
+-        }
++            pvebackup_propagate_error(local_err);
++         }
+ 
+         backup_state.vmaw = NULL;
+     }
+ 
+     if (backup_state.pbs) {
+-        qemu_co_rwlock_rdlock(&backup_state.stat.rwlock);
+-        bool error_or_canceled = backup_state.stat.error || backup_state.stat.cancel;
+-        if (!error_or_canceled) {
++        if (!pvebackup_error_or_canceled()) {
+             Error *local_err = NULL;
+             proxmox_backup_co_finish(backup_state.pbs, &local_err);
+             if (local_err != NULL) {
+-                qemu_co_rwlock_upgrade(&backup_state.stat.rwlock);
+-                error_propagate(&backup_state.stat.error, local_err);
+-             }
++                pvebackup_propagate_error(local_err);
++            }
+         }
+-        qemu_co_rwlock_unlock(&backup_state.stat.rwlock);
+ 
+         proxmox_backup_disconnect(backup_state.pbs);
+         backup_state.pbs = NULL;
+@@ -205,43 +239,14 @@ static void coroutine_fn pvebackup_co_cleanup(void)
+ 
+     g_list_free(backup_state.di_list);
+     backup_state.di_list = NULL;
+-    qemu_co_mutex_unlock(&backup_state.backup_mutex);
++    qemu_rec_mutex_unlock(&backup_state.backup_mutex);
+ }
+ 
+-typedef struct PVEBackupCompeteCallbackData {
+-    PVEBackupDevInfo *di;
+-    int result;
+-} PVEBackupCompeteCallbackData;
+-
+-static void coroutine_fn pvebackup_co_complete_cb(void *opaque)
++static void coroutine_fn pvebackup_complete_stream(void *opaque)
+ {
+-    assert(qemu_in_coroutine());
+-
+-    PVEBackupCompeteCallbackData *cb_data = opaque;
+-
+-    qemu_co_mutex_lock(&backup_state.backup_mutex);
+-
+-    PVEBackupDevInfo *di = cb_data->di;
+-    int ret = cb_data->result;
+-
+-    di->completed = true;
+-
+-    qemu_co_rwlock_rdlock(&backup_state.stat.rwlock);
+-    bool error_or_canceled = backup_state.stat.error || backup_state.stat.cancel;
+-
+-    if (ret < 0 && !backup_state.stat.error) {
+-        qemu_co_rwlock_upgrade(&backup_state.stat.rwlock);
+-        error_setg(&backup_state.stat.error, "job failed with err %d - %s",
+-                   ret, strerror(-ret));
+-    }
+-    qemu_co_rwlock_unlock(&backup_state.stat.rwlock);
+-
+-    di->bs = NULL;
++    PVEBackupDevInfo *di = opaque;
+ 
+-    if (di->target) {
+-        bdrv_unref(di->target);
+-        di->target = NULL;
+-    }
++    bool error_or_canceled = pvebackup_error_or_canceled();
+ 
+     if (backup_state.vmaw) {
+         vma_writer_close_stream(backup_state.vmaw, di->dev_id);
+@@ -251,108 +256,96 @@ static void coroutine_fn pvebackup_co_complete_cb(void *opaque)
+         Error *local_err = NULL;
+         proxmox_backup_co_close_image(backup_state.pbs, di->dev_id, &local_err);
+         if (local_err != NULL) {
+-            qemu_co_rwlock_wrlock(&backup_state.stat.rwlock);
+-            error_propagate(&backup_state.stat.error, local_err);
+-            qemu_co_rwlock_unlock(&backup_state.stat.rwlock);
++            pvebackup_propagate_error(local_err);
+         }
+     }
++}
+ 
+-    // remove self from job queue
+-    backup_state.di_list = g_list_remove(backup_state.di_list, di);
+-    g_free(di);
++static void pvebackup_complete_cb(void *opaque, int ret)
++{
++    assert(!qemu_in_coroutine());
++
++    PVEBackupDevInfo *di = opaque;
+ 
+-    int pending_jobs = g_list_length(backup_state.di_list);
++    qemu_rec_mutex_lock(&backup_state.backup_mutex);
+ 
+-    qemu_co_mutex_unlock(&backup_state.backup_mutex);
++    di->completed = true;
+ 
+-    if (pending_jobs > 0) {
+-        pvebackup_co_run_next_job();
+-    } else {
+-        pvebackup_co_cleanup();
++    if (ret < 0) {
++        Error *local_err = NULL;
++        error_setg(&local_err, "job failed with err %d - %s", ret, strerror(-ret));
++        pvebackup_propagate_error(local_err);
+     }
+-}
+ 
+-static void pvebackup_complete_cb(void *opaque, int ret)
+-{
+-    // This can be called from the main loop, or from a coroutine
+-    PVEBackupCompeteCallbackData cb_data = {
+-        .di = opaque,
+-        .result = ret,
+-    };
++    di->bs = NULL;
+ 
+-    if (qemu_in_coroutine()) {
+-        pvebackup_co_complete_cb(&cb_data);
+-    } else {
+-        block_on_coroutine_fn(pvebackup_co_complete_cb, &cb_data);
+-    }
+-}
++    assert(di->target == NULL);
+ 
+-static void coroutine_fn pvebackup_co_cancel(void *opaque)
+-{
+-    assert(qemu_in_coroutine());
++    block_on_coroutine_fn(pvebackup_complete_stream, di);
+ 
+-    qemu_co_rwlock_wrlock(&backup_state.stat.rwlock);
+-    backup_state.stat.cancel = true;
+-    qemu_co_rwlock_unlock(&backup_state.stat.rwlock);
++    // remove self from job queue
++    backup_state.di_list = g_list_remove(backup_state.di_list, di);
+ 
+-    qemu_co_mutex_lock(&backup_state.backup_mutex);
++    g_free(di);
+ 
+-    // Avoid race between block jobs and backup-cancel command:
+-    if (!(backup_state.vmaw || backup_state.pbs)) {
+-        qemu_co_mutex_unlock(&backup_state.backup_mutex);
+-        return;
+-    }
++    qemu_rec_mutex_unlock(&backup_state.backup_mutex);
+ 
+-    qemu_co_rwlock_rdlock(&backup_state.stat.rwlock);
+-    if (!backup_state.stat.error) {
+-        qemu_co_rwlock_upgrade(&backup_state.stat.rwlock);
+-        error_setg(&backup_state.stat.error, "backup cancelled");
+-    }
+-    qemu_co_rwlock_unlock(&backup_state.stat.rwlock);
++    pvebackup_run_next_job();
++}
++
++static void pvebackup_cancel(void)
++{
++    Error *cancel_err = NULL;
++    error_setg(&cancel_err, "backup canceled");
++    pvebackup_propagate_error(cancel_err);
++
++    qemu_rec_mutex_lock(&backup_state.backup_mutex);
+ 
+     if (backup_state.vmaw) {
+         /* make sure vma writer does not block anymore */
+-        vma_writer_set_error(backup_state.vmaw, "backup cancelled");
++        vma_writer_set_error(backup_state.vmaw, "backup canceled");
+     }
+ 
+     if (backup_state.pbs) {
+-        proxmox_backup_abort(backup_state.pbs, "backup cancelled");
++        proxmox_backup_abort(backup_state.pbs, "backup canceled");
+     }
+ 
+-    bool running_jobs = 0;
+-    GList *l = backup_state.di_list;
+-    while (l) {
+-        PVEBackupDevInfo *di = (PVEBackupDevInfo *)l->data;
+-        l = g_list_next(l);
+-        if (!di->completed && di->bs) {
+-            for (BlockJob *job = block_job_next(NULL); job; job = block_job_next(job)) {
+-                if (job->job.driver->job_type != JOB_TYPE_BACKUP) {
+-                    continue;
+-                }
++    qemu_rec_mutex_unlock(&backup_state.backup_mutex);
+ 
+-                BackupBlockJob *bjob = container_of(job, BackupBlockJob, common);
+-                if (bjob && bjob->source_bs == di->bs) {
+-                    AioContext *aio_context = job->job.aio_context;
+-                    aio_context_acquire(aio_context);
++    for(;;) {
+ 
+-                    if (!di->completed) {
+-                        running_jobs += 1;
+-                        job_cancel(&job->job, false);
+-                    }
+-                    aio_context_release(aio_context);
+-                }
++        BlockJob *next_job = NULL;
++
++        qemu_rec_mutex_lock(&backup_state.backup_mutex);
++
++        GList *l = backup_state.di_list;
++        while (l) {
++            PVEBackupDevInfo *di = (PVEBackupDevInfo *)l->data;
++            l = g_list_next(l);
++
++            BlockJob *job = lookup_active_block_job(di);
++            if (job != NULL) {
++                next_job = job;
++                break;
+             }
+         }
+-    }
+ 
+-    qemu_co_mutex_unlock(&backup_state.backup_mutex);
++        qemu_rec_mutex_unlock(&backup_state.backup_mutex);
+ 
+-    if (running_jobs == 0) pvebackup_co_cleanup(); // else job will call completion handler
++        if (next_job) {
++            AioContext *aio_context = next_job->job.aio_context;
++            aio_context_acquire(aio_context);
++            job_cancel_sync(&next_job->job);
++            aio_context_release(aio_context);
++        } else {
++            break;
++        }
++    }
+ }
+ 
+ void qmp_backup_cancel(Error **errp)
+ {
+-    block_on_coroutine_fn(pvebackup_co_cancel, NULL);
++    pvebackup_cancel();
+ }
+ 
+ static int coroutine_fn pvebackup_co_add_config(
+@@ -406,46 +399,97 @@ static int coroutine_fn pvebackup_co_add_config(
+ 
+ bool job_should_pause(Job *job);
+ 
+-static void coroutine_fn pvebackup_co_run_next_job(void)
++static void pvebackup_run_next_job(void)
+ {
+-    assert(qemu_in_coroutine());
++    assert(!qemu_in_coroutine());
+ 
+-    qemu_co_mutex_lock(&backup_state.backup_mutex);
++    qemu_rec_mutex_lock(&backup_state.backup_mutex);
+ 
+     GList *l = backup_state.di_list;
+     while (l) {
+         PVEBackupDevInfo *di = (PVEBackupDevInfo *)l->data;
+         l = g_list_next(l);
+-        if (!di->completed && di->bs) {
+-            for (BlockJob *job = block_job_next(NULL); job; job = block_job_next(job)) {
+-                if (job->job.driver->job_type != JOB_TYPE_BACKUP) {
+-                    continue;
+-                }
+ 
+-                BackupBlockJob *bjob = container_of(job, BackupBlockJob, common);
+-                if (bjob && bjob->source_bs == di->bs) {
+-                    AioContext *aio_context = job->job.aio_context;
+-                    qemu_co_mutex_unlock(&backup_state.backup_mutex);
+-                    aio_context_acquire(aio_context);
+-
+-                    if (job_should_pause(&job->job)) {
+-                        qemu_co_rwlock_rdlock(&backup_state.stat.rwlock);
+-                        bool error_or_canceled = backup_state.stat.error || backup_state.stat.cancel;
+-                        qemu_co_rwlock_unlock(&backup_state.stat.rwlock);
+-
+-                        if (error_or_canceled) {
+-                            job_cancel(&job->job, false);
+-                        } else {
+-                            job_resume(&job->job);
+-                        }
+-                    }
+-                    aio_context_release(aio_context);
+-                    return;
++        BlockJob *job = lookup_active_block_job(di);
++
++        if (job) {
++            qemu_rec_mutex_unlock(&backup_state.backup_mutex);
++
++            AioContext *aio_context = job->job.aio_context;
++            aio_context_acquire(aio_context);
++
++            if (job_should_pause(&job->job)) {
++                bool error_or_canceled = pvebackup_error_or_canceled();
++                if (error_or_canceled) {
++                    job_cancel_sync(&job->job);
++                } else {
++                    job_resume(&job->job);
+                 }
+             }
++            aio_context_release(aio_context);
++            return;
+         }
+     }
+-    qemu_co_mutex_unlock(&backup_state.backup_mutex);
++
++    qemu_rec_mutex_unlock(&backup_state.backup_mutex);
++
++    block_on_coroutine_fn(pvebackup_co_cleanup, NULL); // no more jobs, run cleanup
++}
++
++static bool create_backup_jobs(void) {
++
++    assert(!qemu_in_coroutine());
++
++    Error *local_err = NULL;
++
++    /* create and start all jobs (paused state) */
++    GList *l =  backup_state.di_list;
++    while (l) {
++        PVEBackupDevInfo *di = (PVEBackupDevInfo *)l->data;
++        l = g_list_next(l);
++
++        assert(di->target != NULL);
++
++        AioContext *aio_context = bdrv_get_aio_context(di->bs);
++        aio_context_acquire(aio_context);
++
++        BlockJob *job = backup_job_create(
++            NULL, di->bs, di->target, backup_state.speed, MIRROR_SYNC_MODE_FULL, NULL,
++            BITMAP_SYNC_MODE_NEVER, false, NULL, BLOCKDEV_ON_ERROR_REPORT, BLOCKDEV_ON_ERROR_REPORT,
++            JOB_DEFAULT, pvebackup_complete_cb, di, 1, NULL, &local_err);
++
++        aio_context_release(aio_context);
++
++        if (!job || local_err != NULL) {
++            Error *create_job_err = NULL;
++            error_setg(&create_job_err, "backup_job_create failed: %s",
++                       local_err ? error_get_pretty(local_err) : "null");
++
++            pvebackup_propagate_error(create_job_err);
++            break;
++        }
++        job_start(&job->job);
++
++        bdrv_unref(di->target);
++        di->target = NULL;
++    }
++
++    bool errors = pvebackup_error_or_canceled();
++
++    if (errors) {
++        l = backup_state.di_list;
++        while (l) {
++            PVEBackupDevInfo *di = (PVEBackupDevInfo *)l->data;
++            l = g_list_next(l);
++
++            if (di->target) {
++                bdrv_unref(di->target);
++                di->target = NULL;
++            }
++        }
++    }
++
++    return errors;
+ }
+ 
+ typedef struct QmpBackupTask {
+@@ -476,7 +520,7 @@ typedef struct QmpBackupTask {
+     UuidInfo *result;
+ } QmpBackupTask;
+ 
+-static void coroutine_fn pvebackup_co_start(void *opaque)
++static void coroutine_fn pvebackup_co_prepare(void *opaque)
+ {
+     assert(qemu_in_coroutine());
+ 
+@@ -495,15 +539,14 @@ static void coroutine_fn pvebackup_co_start(void *opaque)
+     GList *di_list = NULL;
+     GList *l;
+     UuidInfo *uuid_info;
+-    BlockJob *job;
+ 
+     const char *config_name = "qemu-server.conf";
+     const char *firewall_name = "qemu-server.fw";
+ 
+-    qemu_co_mutex_lock(&backup_state.backup_mutex);
++    qemu_rec_mutex_lock(&backup_state.backup_mutex);
+ 
+     if (backup_state.di_list) {
+-        qemu_co_mutex_unlock(&backup_state.backup_mutex);
++        qemu_rec_mutex_unlock(&backup_state.backup_mutex);
+         error_set(task->errp, ERROR_CLASS_GENERIC_ERROR,
+                   "previous backup not finished");
+         return;
+@@ -631,7 +674,7 @@ static void coroutine_fn pvebackup_co_start(void *opaque)
+             if (dev_id < 0)
+                 goto err;
+ 
+-            if (!(di->target = bdrv_backup_dump_create(dump_cb_block_size, di->size, pvebackup_co_dump_cb, di, task->errp))) {
++            if (!(di->target = bdrv_backup_dump_create(dump_cb_block_size, di->size, pvebackup_co_dump_pbs_cb, di, task->errp))) {
+                 goto err;
+             }
+ 
+@@ -652,7 +695,7 @@ static void coroutine_fn pvebackup_co_start(void *opaque)
+             PVEBackupDevInfo *di = (PVEBackupDevInfo *)l->data;
+             l = g_list_next(l);
+ 
+-            if (!(di->target = bdrv_backup_dump_create(VMA_CLUSTER_SIZE, di->size, pvebackup_co_dump_cb, di, task->errp))) {
++            if (!(di->target = bdrv_backup_dump_create(VMA_CLUSTER_SIZE, di->size, pvebackup_co_dump_vma_cb, di, task->errp))) {
+                 goto err;
+             }
+ 
+@@ -717,9 +760,7 @@ static void coroutine_fn pvebackup_co_start(void *opaque)
+     }
+     /* initialize global backup_state now */
+ 
+-    qemu_co_rwlock_wrlock(&backup_state.stat.rwlock);
+-
+-    backup_state.stat.cancel = false;
++    qemu_rec_mutex_lock(&backup_state.stat.lock);
+ 
+     if (backup_state.stat.error) {
+         error_free(backup_state.stat.error);
+@@ -742,7 +783,7 @@ static void coroutine_fn pvebackup_co_start(void *opaque)
+     backup_state.stat.transferred = 0;
+     backup_state.stat.zero_bytes = 0;
+ 
+-    qemu_co_rwlock_unlock(&backup_state.stat.rwlock);
++    qemu_rec_mutex_unlock(&backup_state.stat.lock);
+ 
+     backup_state.speed = (task->has_speed && task->speed > 0) ? task->speed : 0;
+ 
+@@ -751,45 +792,7 @@ static void coroutine_fn pvebackup_co_start(void *opaque)
+ 
+     backup_state.di_list = di_list;
+ 
+-    /* start all jobs (paused state) */
+-    l = di_list;
+-    while (l) {
+-        PVEBackupDevInfo *di = (PVEBackupDevInfo *)l->data;
+-        l = g_list_next(l);
+-
+-        AioContext *aio_context = bdrv_get_aio_context(di->bs);
+-        aio_context_acquire(aio_context);
+-
+-        job = backup_job_create(NULL, di->bs, di->target, backup_state.speed, MIRROR_SYNC_MODE_FULL, NULL,
+-                                BITMAP_SYNC_MODE_NEVER, false, NULL, BLOCKDEV_ON_ERROR_REPORT, BLOCKDEV_ON_ERROR_REPORT,
+-                                JOB_DEFAULT, pvebackup_complete_cb, di, 1, NULL, &local_err);
+-
+-        aio_context_release(aio_context);
+-
+-        if (!job || local_err != NULL) {
+-            qemu_co_rwlock_wrlock(&backup_state.stat.rwlock);
+-            error_setg(&backup_state.stat.error, "backup_job_create failed");
+-            qemu_co_rwlock_unlock(&backup_state.stat.rwlock);
+-            break;
+-        }
+-        job_start(&job->job);
+-        if (di->target) {
+-            bdrv_unref(di->target);
+-            di->target = NULL;
+-        }
+-    }
+-
+-    qemu_co_mutex_unlock(&backup_state.backup_mutex);
+-
+-    qemu_co_rwlock_rdlock(&backup_state.stat.rwlock);
+-    bool no_errors = !backup_state.stat.error;
+-    qemu_co_rwlock_unlock(&backup_state.stat.rwlock);
+-
+-    if (no_errors) {
+-        pvebackup_co_run_next_job(); // run one job
+-    } else {
+-        pvebackup_co_cancel(NULL);
+-    }
++    qemu_rec_mutex_unlock(&backup_state.backup_mutex);
+ 
+     uuid_info = g_malloc0(sizeof(*uuid_info));
+     uuid_info->UUID = uuid_str;
+@@ -833,7 +836,7 @@ err:
+         rmdir(backup_dir);
+     }
+ 
+-    qemu_co_mutex_unlock(&backup_state.backup_mutex);
++    qemu_rec_mutex_unlock(&backup_state.backup_mutex);
+ 
+     task->result = NULL;
+     return;
+@@ -878,32 +881,28 @@ UuidInfo *qmp_backup(
+         .errp = errp,
+     };
+ 
+-    block_on_coroutine_fn(pvebackup_co_start, &task);
++    block_on_coroutine_fn(pvebackup_co_prepare, &task);
++
++    if (*errp == NULL) {
++        qemu_rec_mutex_lock(&backup_state.backup_mutex);
++        create_backup_jobs();
++        qemu_rec_mutex_unlock(&backup_state.backup_mutex);
++        pvebackup_run_next_job();
++    }
+ 
+     return task.result;
+ }
+ 
+-
+-typedef struct QmpQueryBackupTask {
+-    Error **errp;
+-    BackupStatus *result;
+-} QmpQueryBackupTask;
+-
+-static void coroutine_fn pvebackup_co_query(void *opaque)
++BackupStatus *qmp_query_backup(Error **errp)
+ {
+-    assert(qemu_in_coroutine());
+-
+-    QmpQueryBackupTask *task = opaque;
+-
+     BackupStatus *info = g_malloc0(sizeof(*info));
+ 
+-    qemu_co_rwlock_rdlock(&backup_state.stat.rwlock);
++    qemu_rec_mutex_lock(&backup_state.stat.lock);
+ 
+     if (!backup_state.stat.start_time) {
+         /* not started, return {} */
+-        task->result = info;
+-        qemu_co_rwlock_unlock(&backup_state.stat.rwlock);
+-        return;
++        qemu_rec_mutex_unlock(&backup_state.stat.lock);
++        return info;
+     }
+ 
+     info->has_status = true;
+@@ -939,19 +938,7 @@ static void coroutine_fn pvebackup_co_query(void *opaque)
+     info->has_transferred = true;
+     info->transferred = backup_state.stat.transferred;
+ 
+-    task->result = info;
++    qemu_rec_mutex_unlock(&backup_state.stat.lock);
+ 
+-    qemu_co_rwlock_unlock(&backup_state.stat.rwlock);
+-}
+-
+-BackupStatus *qmp_query_backup(Error **errp)
+-{
+-    QmpQueryBackupTask task = {
+-        .errp = errp,
+-        .result = NULL,
+-    };
+-
+-    block_on_coroutine_fn(pvebackup_co_query, &task);
+-
+-    return task.result;
++    return info;
+ }

debian/patches/pve/0034-drive-mirror-add-support-for-sync-bitmap-mode-never.patch

@@ -1,8 +1,7 @@
-From 1bfdb0492d8b70983342cf96576b294d60172e05 Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: John Snow <jsnow@redhat.com>
-Date: Tue, 9 Jul 2019 21:12:21 -0400
-Subject: [PATCH qemu 34/39] drive-mirror: add support for sync=bitmap
- mode=never
+Date: Mon, 6 Apr 2020 12:17:03 +0200
+Subject: [PATCH] drive-mirror: add support for sync=bitmap mode=never
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -28,30 +27,15 @@ Signed-off-by: Ma Haocong <mahaocong@didichuxing.com>
 Signed-off-by: John Snow <jsnow@redhat.com>
 Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
 ---
- include/block/block_int.h   |  4 +-
  block/mirror.c              | 98 ++++++++++++++++++++++++++++++-------
  blockdev.c                  | 39 +++++++++++++--
- tests/test-block-iothread.c |  4 +-
+ include/block/block_int.h   |  4 +-
  qapi/block-core.json        | 29 +++++++++--
+ tests/test-block-iothread.c |  4 +-
  5 files changed, 145 insertions(+), 29 deletions(-)
 
-diff --git a/include/block/block_int.h b/include/block/block_int.h
-index 43b00c15ac..bd2e11c4d9 100644
---- a/include/block/block_int.h
-+++ b/include/block/block_int.h
-@@ -1206,7 +1206,9 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
-                   BlockDriverState *target, const char *replaces,
-                   int creation_flags, int64_t speed,
-                   uint32_t granularity, int64_t buf_size,
--                  MirrorSyncMode mode, BlockMirrorBackingMode backing_mode,
-+                  MirrorSyncMode mode, BdrvDirtyBitmap *bitmap,
-+                  BitmapSyncMode bitmap_mode,
-+                  BlockMirrorBackingMode backing_mode,
-                   bool zero_target,
-                   BlockdevOnError on_source_error,
-                   BlockdevOnError on_target_error,
 diff --git a/block/mirror.c b/block/mirror.c
-index f0f2d9dff1..fd7f574365 100644
+index c26fd9260d..3c9cd42c50 100644
 --- a/block/mirror.c
 +++ b/block/mirror.c
 @@ -49,7 +49,7 @@ typedef struct MirrorBlockJob {
@@ -72,7 +56,7 @@ index f0f2d9dff1..fd7f574365 100644
      BdrvDirtyBitmap *dirty_bitmap;
      BdrvDirtyBitmapIter *dbi;
      uint8_t *buf;
-@@ -668,7 +670,8 @@ static int mirror_exit_common(Job *job)
+@@ -676,7 +678,8 @@ static int mirror_exit_common(Job *job)
      bdrv_child_refresh_perms(mirror_top_bs, mirror_top_bs->backing,
                               &error_abort);
      if (!abort && s->backing_mode == MIRROR_SOURCE_BACKING_CHAIN) {
@@ -82,7 +66,7 @@ index f0f2d9dff1..fd7f574365 100644
          if (backing_bs(target_bs) != backing) {
              bdrv_set_backing_hd(target_bs, backing, &local_err);
              if (local_err) {
-@@ -750,6 +753,16 @@ static void mirror_abort(Job *job)
+@@ -771,6 +774,16 @@ static void mirror_abort(Job *job)
      assert(ret == 0);
  }
  
@@ -99,7 +83,7 @@ index f0f2d9dff1..fd7f574365 100644
  static void coroutine_fn mirror_throttle(MirrorBlockJob *s)
  {
      int64_t now = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);
-@@ -928,7 +941,8 @@ static int coroutine_fn mirror_run(Job *job, Error **errp)
+@@ -949,7 +962,8 @@ static int coroutine_fn mirror_run(Job *job, Error **errp)
      mirror_free_init(s);
  
      s->last_pause_ns = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);
@@ -109,7 +93,7 @@ index f0f2d9dff1..fd7f574365 100644
          ret = mirror_dirty_init(s);
          if (ret < 0 || job_is_cancelled(&s->common.job)) {
              goto immediate_exit;
-@@ -1160,6 +1174,7 @@ static const BlockJobDriver mirror_job_driver = {
+@@ -1181,6 +1195,7 @@ static const BlockJobDriver mirror_job_driver = {
          .run                    = mirror_run,
          .prepare                = mirror_prepare,
          .abort                  = mirror_abort,
@@ -117,7 +101,7 @@ index f0f2d9dff1..fd7f574365 100644
          .pause                  = mirror_pause,
          .complete               = mirror_complete,
      },
-@@ -1175,6 +1190,7 @@ static const BlockJobDriver commit_active_job_driver = {
+@@ -1196,6 +1211,7 @@ static const BlockJobDriver commit_active_job_driver = {
          .run                    = mirror_run,
          .prepare                = mirror_prepare,
          .abort                  = mirror_abort,
@@ -125,7 +109,7 @@ index f0f2d9dff1..fd7f574365 100644
          .pause                  = mirror_pause,
          .complete               = mirror_complete,
      },
-@@ -1520,7 +1536,10 @@ static BlockJob *mirror_start_job(
+@@ -1542,7 +1558,10 @@ static BlockJob *mirror_start_job(
                               BlockCompletionFunc *cb,
                               void *opaque,
                               const BlockJobDriver *driver,
@@ -137,7 +121,7 @@ index f0f2d9dff1..fd7f574365 100644
                               bool auto_complete, const char *filter_node_name,
                               bool is_mirror, MirrorCopyMode copy_mode,
                               Error **errp)
-@@ -1533,10 +1552,39 @@ static BlockJob *mirror_start_job(
+@@ -1555,10 +1574,39 @@ static BlockJob *mirror_start_job(
      Error *local_err = NULL;
      int ret;
  
@@ -179,7 +163,7 @@ index f0f2d9dff1..fd7f574365 100644
      assert(is_power_of_2(granularity));
  
      if (buf_size < 0) {
-@@ -1640,7 +1688,9 @@ static BlockJob *mirror_start_job(
+@@ -1662,7 +1710,9 @@ static BlockJob *mirror_start_job(
      s->replaces = g_strdup(replaces);
      s->on_source_error = on_source_error;
      s->on_target_error = on_target_error;
@@ -190,7 +174,7 @@ index f0f2d9dff1..fd7f574365 100644
      s->backing_mode = backing_mode;
      s->zero_target = zero_target;
      s->copy_mode = copy_mode;
-@@ -1660,6 +1710,18 @@ static BlockJob *mirror_start_job(
+@@ -1682,6 +1732,18 @@ static BlockJob *mirror_start_job(
          bdrv_disable_dirty_bitmap(s->dirty_bitmap);
      }
  
@@ -209,7 +193,7 @@ index f0f2d9dff1..fd7f574365 100644
      ret = block_job_add_bdrv(&s->common, "source", bs, 0,
                               BLK_PERM_WRITE_UNCHANGED | BLK_PERM_WRITE |
                               BLK_PERM_CONSISTENT_READ,
-@@ -1713,6 +1775,9 @@ fail:
+@@ -1735,6 +1797,9 @@ fail:
          if (s->dirty_bitmap) {
              bdrv_release_dirty_bitmap(s->dirty_bitmap);
          }
@@ -219,7 +203,7 @@ index f0f2d9dff1..fd7f574365 100644
          job_early_fail(&s->common.job);
      }
  
-@@ -1730,29 +1795,23 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
+@@ -1752,29 +1817,23 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
                    BlockDriverState *target, const char *replaces,
                    int creation_flags, int64_t speed,
                    uint32_t granularity, int64_t buf_size,
@@ -254,7 +238,7 @@ index f0f2d9dff1..fd7f574365 100644
  }
  
  BlockJob *commit_active_start(const char *job_id, BlockDriverState *bs,
-@@ -1778,7 +1837,8 @@ BlockJob *commit_active_start(const char *job_id, BlockDriverState *bs,
+@@ -1800,7 +1859,8 @@ BlockJob *commit_active_start(const char *job_id, BlockDriverState *bs,
                       job_id, bs, creation_flags, base, NULL, speed, 0, 0,
                       MIRROR_LEAVE_BACKING_CHAIN, false,
                       on_error, on_error, true, cb, opaque,
@@ -265,10 +249,10 @@ index f0f2d9dff1..fd7f574365 100644
                       &local_err);
      if (local_err) {
 diff --git a/blockdev.c b/blockdev.c
-index e5310cb939..08285b9e86 100644
+index f391c3b3c7..bbeff9c439 100644
 --- a/blockdev.c
 +++ b/blockdev.c
-@@ -3763,6 +3763,10 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
+@@ -3159,6 +3159,10 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
                                     BlockDriverState *target,
                                     bool has_replaces, const char *replaces,
                                     enum MirrorSyncMode sync,
@@ -279,7 +263,7 @@ index e5310cb939..08285b9e86 100644
                                     BlockMirrorBackingMode backing_mode,
                                     bool zero_target,
                                     bool has_speed, int64_t speed,
-@@ -3781,6 +3785,7 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
+@@ -3177,6 +3181,7 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
                                     Error **errp)
  {
      int job_flags = JOB_DEFAULT;
@@ -287,7 +271,7 @@ index e5310cb939..08285b9e86 100644
  
      if (!has_speed) {
          speed = 0;
-@@ -3835,6 +3840,29 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
+@@ -3231,6 +3236,29 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
          sync = MIRROR_SYNC_MODE_FULL;
      }
  
@@ -317,7 +301,7 @@ index e5310cb939..08285b9e86 100644
      if (has_replaces) {
          BlockDriverState *to_replace_bs;
          AioContext *replace_aio_context;
-@@ -3872,8 +3900,8 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
+@@ -3268,8 +3296,8 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
       * and will allow to check whether the node still exist at mirror completion
       */
      mirror_start(job_id, bs, target,
@@ -328,7 +312,7 @@ index e5310cb939..08285b9e86 100644
                   on_source_error, on_target_error, unmap, filter_node_name,
                   copy_mode, errp);
  }
-@@ -4003,6 +4031,8 @@ void qmp_drive_mirror(DriveMirror *arg, Error **errp)
+@@ -3410,6 +3438,8 @@ void qmp_drive_mirror(DriveMirror *arg, Error **errp)
  
      blockdev_mirror_common(arg->has_job_id ? arg->job_id : NULL, bs, target_bs,
                             arg->has_replaces, arg->replaces, arg->sync,
@@ -337,7 +321,7 @@ index e5310cb939..08285b9e86 100644
                             backing_mode, zero_target,
                             arg->has_speed, arg->speed,
                             arg->has_granularity, arg->granularity,
-@@ -4025,6 +4055,8 @@ void qmp_blockdev_mirror(bool has_job_id, const char *job_id,
+@@ -3432,6 +3462,8 @@ void qmp_blockdev_mirror(bool has_job_id, const char *job_id,
                           const char *device, const char *target,
                           bool has_replaces, const char *replaces,
                           MirrorSyncMode sync,
@@ -346,7 +330,7 @@ index e5310cb939..08285b9e86 100644
                           bool has_speed, int64_t speed,
                           bool has_granularity, uint32_t granularity,
                           bool has_buf_size, int64_t buf_size,
-@@ -4068,7 +4100,8 @@ void qmp_blockdev_mirror(bool has_job_id, const char *job_id,
+@@ -3482,7 +3514,8 @@ void qmp_blockdev_mirror(bool has_job_id, const char *job_id,
      }
  
      blockdev_mirror_common(has_job_id ? job_id : NULL, bs, target_bs,
@@ -356,26 +340,26 @@ index e5310cb939..08285b9e86 100644
                             zero_target, has_speed, speed,
                             has_granularity, granularity,
                             has_buf_size, buf_size,
-diff --git a/tests/test-block-iothread.c b/tests/test-block-iothread.c
-index 0c861809f0..da87a67a57 100644
---- a/tests/test-block-iothread.c
-+++ b/tests/test-block-iothread.c
-@@ -611,8 +611,8 @@ static void test_propagate_mirror(void)
- 
-     /* Start a mirror job */
-     mirror_start("job0", src, target, NULL, JOB_DEFAULT, 0, 0, 0,
--                 MIRROR_SYNC_MODE_NONE, MIRROR_OPEN_BACKING_CHAIN, false,
--                 BLOCKDEV_ON_ERROR_REPORT, BLOCKDEV_ON_ERROR_REPORT,
-+                 MIRROR_SYNC_MODE_NONE, NULL, 0, MIRROR_OPEN_BACKING_CHAIN,
-+                 false, BLOCKDEV_ON_ERROR_REPORT, BLOCKDEV_ON_ERROR_REPORT,
-                  false, "filter_node", MIRROR_COPY_MODE_BACKGROUND,
-                  &error_abort);
-     job = job_get("job0");
+diff --git a/include/block/block_int.h b/include/block/block_int.h
+index 6d234f1de9..180a5e00fd 100644
+--- a/include/block/block_int.h
++++ b/include/block/block_int.h
+@@ -1210,7 +1210,9 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
+                   BlockDriverState *target, const char *replaces,
+                   int creation_flags, int64_t speed,
+                   uint32_t granularity, int64_t buf_size,
+-                  MirrorSyncMode mode, BlockMirrorBackingMode backing_mode,
++                  MirrorSyncMode mode, BdrvDirtyBitmap *bitmap,
++                  BitmapSyncMode bitmap_mode,
++                  BlockMirrorBackingMode backing_mode,
+                   bool zero_target,
+                   BlockdevOnError on_source_error,
+                   BlockdevOnError on_target_error,
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 0b987ad6e3..e2050bab1d 100644
+index 97d1f64636..8bdbccb397 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -2086,10 +2086,19 @@
+@@ -2054,10 +2054,19 @@
  #        (all the disk, only the sectors allocated in the topmost image, or
  #        only new I/O).
  #
@@ -396,7 +380,7 @@ index 0b987ad6e3..e2050bab1d 100644
  #
  # @buf-size: maximum amount of data in flight from source to
  #            target (since 1.4).
-@@ -2127,7 +2136,9 @@
+@@ -2095,7 +2104,9 @@
  { 'struct': 'DriveMirror',
    'data': { '*job-id': 'str', 'device': 'str', 'target': 'str',
              '*format': 'str', '*node-name': 'str', '*replaces': 'str',
@@ -407,7 +391,7 @@ index 0b987ad6e3..e2050bab1d 100644
              '*speed': 'int', '*granularity': 'uint32',
              '*buf-size': 'int', '*on-source-error': 'BlockdevOnError',
              '*on-target-error': 'BlockdevOnError',
-@@ -2394,10 +2405,19 @@
+@@ -2362,10 +2373,19 @@
  #        (all the disk, only the sectors allocated in the topmost image, or
  #        only new I/O).
  #
@@ -428,7 +412,7 @@ index 0b987ad6e3..e2050bab1d 100644
  #
  # @buf-size: maximum amount of data in flight from source to
  #            target
-@@ -2446,7 +2466,8 @@
+@@ -2414,7 +2434,8 @@
  { 'command': 'blockdev-mirror',
    'data': { '*job-id': 'str', 'device': 'str', 'target': 'str',
              '*replaces': 'str',
@@ -438,6 +422,18 @@ index 0b987ad6e3..e2050bab1d 100644
              '*speed': 'int', '*granularity': 'uint32',
              '*buf-size': 'int', '*on-source-error': 'BlockdevOnError',
              '*on-target-error': 'BlockdevOnError',
--- 
-2.20.1
-
+diff --git a/tests/test-block-iothread.c b/tests/test-block-iothread.c
+index 0c861809f0..da87a67a57 100644
+--- a/tests/test-block-iothread.c
++++ b/tests/test-block-iothread.c
+@@ -611,8 +611,8 @@ static void test_propagate_mirror(void)
+ 
+     /* Start a mirror job */
+     mirror_start("job0", src, target, NULL, JOB_DEFAULT, 0, 0, 0,
+-                 MIRROR_SYNC_MODE_NONE, MIRROR_OPEN_BACKING_CHAIN, false,
+-                 BLOCKDEV_ON_ERROR_REPORT, BLOCKDEV_ON_ERROR_REPORT,
++                 MIRROR_SYNC_MODE_NONE, NULL, 0, MIRROR_OPEN_BACKING_CHAIN,
++                 false, BLOCKDEV_ON_ERROR_REPORT, BLOCKDEV_ON_ERROR_REPORT,
+                  false, "filter_node", MIRROR_COPY_MODE_BACKGROUND,
+                  &error_abort);
+     job = job_get("job0");

debian/patches/pve/0035-drive-mirror-add-support-for-conditional-and-always-.patch

@@ -1,8 +1,8 @@
-From 4c46f8b0f6fd8efba5e4d0b738b4f01ffcb92d33 Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: John Snow <jsnow@redhat.com>
-Date: Tue, 9 Jul 2019 21:12:30 -0400
-Subject: [PATCH qemu 35/39] drive-mirror: add support for conditional and
- always bitmap sync modes
+Date: Mon, 6 Apr 2020 12:17:04 +0200
+Subject: [PATCH] drive-mirror: add support for conditional and always bitmap
+ sync modes
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -23,10 +23,10 @@ Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
  1 file changed, 18 insertions(+), 6 deletions(-)
 
 diff --git a/block/mirror.c b/block/mirror.c
-index fd7f574365..40d174a625 100644
+index 3c9cd42c50..08ac9827f2 100644
 --- a/block/mirror.c
 +++ b/block/mirror.c
-@@ -645,8 +645,6 @@ static int mirror_exit_common(Job *job)
+@@ -653,8 +653,6 @@ static int mirror_exit_common(Job *job)
          bdrv_unfreeze_backing_chain(mirror_top_bs, target_bs);
      }
  
@@ -35,7 +35,7 @@ index fd7f574365..40d174a625 100644
      /* Make sure that the source BDS doesn't go away during bdrv_replace_node,
       * before we can call bdrv_drained_end */
      bdrv_ref(src);
-@@ -731,6 +729,18 @@ static int mirror_exit_common(Job *job)
+@@ -752,6 +750,18 @@ static int mirror_exit_common(Job *job)
      blk_set_perm(bjob->blk, 0, BLK_PERM_ALL, &error_abort);
      blk_insert_bs(bjob->blk, mirror_top_bs, &error_abort);
  
@@ -54,7 +54,7 @@ index fd7f574365..40d174a625 100644
      bs_opaque->job = NULL;
  
      bdrv_drained_end(src);
-@@ -1562,10 +1572,6 @@ static BlockJob *mirror_start_job(
+@@ -1584,10 +1594,6 @@ static BlockJob *mirror_start_job(
                         " sync mode",
                         MirrorSyncMode_str(sync_mode));
              return NULL;
@@ -65,7 +65,7 @@ index fd7f574365..40d174a625 100644
          }
      } else if (bitmap) {
          error_setg(errp,
-@@ -1582,6 +1588,12 @@ static BlockJob *mirror_start_job(
+@@ -1604,6 +1610,12 @@ static BlockJob *mirror_start_job(
              return NULL;
          }
          granularity = bdrv_dirty_bitmap_granularity(bitmap);
@@ -78,6 +78,3 @@ index fd7f574365..40d174a625 100644
      } else if (granularity == 0) {
          granularity = bdrv_get_default_bitmap_granularity(target);
      }
--- 
-2.20.1
-

debian/patches/pve/0036-mirror-add-check-for-bitmap-mode-without-bitmap.patch

@@ -1,7 +1,7 @@
-From daec2f64e120a23a8d263f7d058bd84c48397bc8 Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Fabian=20Gr=C3=BCnbichler?= <f.gruenbichler@proxmox.com>
-Date: Mon, 17 Feb 2020 11:59:20 +0100
-Subject: [PATCH qemu 36/39] mirror: add check for bitmap-mode without bitmap
+Date: Mon, 6 Apr 2020 12:17:05 +0200
+Subject: [PATCH] mirror: add check for bitmap-mode without bitmap
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -15,10 +15,10 @@ Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
  1 file changed, 3 insertions(+)
 
 diff --git a/blockdev.c b/blockdev.c
-index 08285b9e86..768a0b0fd4 100644
+index bbeff9c439..fa3c2f5548 100644
 --- a/blockdev.c
 +++ b/blockdev.c
-@@ -3861,6 +3861,9 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
+@@ -3257,6 +3257,9 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
          if (bdrv_dirty_bitmap_check(bitmap, BDRV_BITMAP_ALLOW_RO, errp)) {
              return;
          }
@@ -28,6 +28,3 @@ index 08285b9e86..768a0b0fd4 100644
      }
  
      if (has_replaces) {
--- 
-2.20.1
-

debian/patches/pve/0037-mirror-switch-to-bdrv_dirty_bitmap_merge_internal.patch

@@ -1,7 +1,7 @@
-From 31ea5889c25012189aabe51157b32cfbe87a63be Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Fabian=20Gr=C3=BCnbichler?= <f.gruenbichler@proxmox.com>
-Date: Mon, 17 Feb 2020 10:43:22 +0100
-Subject: [PATCH qemu 37/39] mirror: switch to bdrv_dirty_bitmap_merge_internal
+Date: Mon, 6 Apr 2020 12:17:06 +0200
+Subject: [PATCH] mirror: switch to bdrv_dirty_bitmap_merge_internal
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -15,10 +15,10 @@ Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
  1 file changed, 4 insertions(+), 4 deletions(-)
 
 diff --git a/block/mirror.c b/block/mirror.c
-index 40d174a625..d6aca2874e 100644
+index 08ac9827f2..c56b0f87e3 100644
 --- a/block/mirror.c
 +++ b/block/mirror.c
-@@ -735,8 +735,8 @@ static int mirror_exit_common(Job *job)
+@@ -756,8 +756,8 @@ static int mirror_exit_common(Job *job)
               job->ret == 0 && ret == 0)) {
              /* Success; synchronize copy back to sync. */
              bdrv_clear_dirty_bitmap(s->sync_bitmap, NULL);
@@ -29,7 +29,7 @@ index 40d174a625..d6aca2874e 100644
          }
      }
      bdrv_release_dirty_bitmap(s->dirty_bitmap);
-@@ -1727,8 +1727,8 @@ static BlockJob *mirror_start_job(
+@@ -1749,8 +1749,8 @@ static BlockJob *mirror_start_job(
      }
  
      if (s->sync_mode == MIRROR_SYNC_MODE_BITMAP) {
@@ -40,6 +40,3 @@ index 40d174a625..d6aca2874e 100644
          if (local_err) {
              goto fail;
          }
--- 
-2.20.1
-

debian/patches/pve/0038-iotests-add-test-for-bitmap-mirror.patch

@@ -1,7 +1,7 @@
-From 145eea36a4a34919e2551cc14774c47dfb32ac3c Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Fabian=20Gr=C3=BCnbichler?= <f.gruenbichler@proxmox.com>
-Date: Mon, 17 Feb 2020 10:47:07 +0100
-Subject: [PATCH qemu 38/39] iotests: add test for bitmap mirror
+Date: Mon, 6 Apr 2020 12:17:07 +0200
+Subject: [PATCH] iotests: add test for bitmap mirror
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -21,18 +21,18 @@ honor provenance.
 
 Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
 ---
- tests/qemu-iotests/284     |  547 +++++++
- tests/qemu-iotests/284.out | 2846 ++++++++++++++++++++++++++++++++++++
+ tests/qemu-iotests/384     |  547 +++++++
+ tests/qemu-iotests/384.out | 2846 ++++++++++++++++++++++++++++++++++++
  tests/qemu-iotests/group   |    1 +
  3 files changed, 3394 insertions(+)
- create mode 100755 tests/qemu-iotests/284
- create mode 100644 tests/qemu-iotests/284.out
+ create mode 100755 tests/qemu-iotests/384
+ create mode 100644 tests/qemu-iotests/384.out
 
-diff --git a/tests/qemu-iotests/284 b/tests/qemu-iotests/284
+diff --git a/tests/qemu-iotests/384 b/tests/qemu-iotests/384
 new file mode 100755
 index 0000000000..b04a8e651a
 --- /dev/null
-+++ b/tests/qemu-iotests/284
++++ b/tests/qemu-iotests/384
 @@ -0,0 +1,547 @@
 +#!/usr/bin/env python3
 +#
@@ -581,11 +581,11 @@ index 0000000000..b04a8e651a
 +if __name__ == '__main__':
 +    iotests.script_main(main, supported_fmts=['qcow2'],
 +                        supported_protocols=['file'])
-diff --git a/tests/qemu-iotests/284.out b/tests/qemu-iotests/284.out
+diff --git a/tests/qemu-iotests/384.out b/tests/qemu-iotests/384.out
 new file mode 100644
 index 0000000000..9b7408b6d6
 --- /dev/null
-+++ b/tests/qemu-iotests/284.out
++++ b/tests/qemu-iotests/384.out
 @@ -0,0 +1,2846 @@
 +
 +=== Mode bitmap; Bitmap Sync never with simulated failure ===
@@ -3434,14 +3434,14 @@ index 0000000000..9b7408b6d6
 +{"error": {"class": "GenericError", "desc": "bitmap-mode must be specified if a bitmap is provided"}}
 +
 diff --git a/tests/qemu-iotests/group b/tests/qemu-iotests/group
-index 6b10a6a762..a4db887d5d 100644
+index 435dccd5af..939efd9c70 100644
 --- a/tests/qemu-iotests/group
 +++ b/tests/qemu-iotests/group
-@@ -286,3 +286,4 @@
- 272 rw
- 273 backing quick
- 277 rw quick
-+284 rw
--- 
-2.20.1
-
+@@ -270,6 +270,7 @@
+ 253 rw quick
+ 254 rw backing quick
+ 255 rw quick
++384 rw
+ 256 rw auto quick
+ 257 rw
+ 258 rw quick

debian/patches/pve/0039-mirror-move-some-checks-to-qmp.patch

@@ -1,7 +1,7 @@
-From 1beb9c370adff5e8c674d57e7a17672c0a8eaa2a Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Fabian=20Gr=C3=BCnbichler?= <f.gruenbichler@proxmox.com>
-Date: Mon, 10 Feb 2020 10:15:16 +0100
-Subject: [PATCH qemu 39/39] mirror: move some checks to qmp
+Date: Mon, 6 Apr 2020 12:17:08 +0200
+Subject: [PATCH] mirror: move some checks to qmp
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -14,14 +14,14 @@ Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
 ---
  block/mirror.c             | 28 +++------------
  blockdev.c                 | 29 +++++++++++++++
- tests/qemu-iotests/284.out | 72 +++++++++++++++++++-------------------
+ tests/qemu-iotests/384.out | 72 +++++++++++++++++++-------------------
  3 files changed, 70 insertions(+), 59 deletions(-)
 
 diff --git a/block/mirror.c b/block/mirror.c
-index d6aca2874e..7a3373fca7 100644
+index c56b0f87e3..dbba6fc80e 100644
 --- a/block/mirror.c
 +++ b/block/mirror.c
-@@ -1562,31 +1562,13 @@ static BlockJob *mirror_start_job(
+@@ -1584,31 +1584,13 @@ static BlockJob *mirror_start_job(
      Error *local_err = NULL;
      int ret;
  
@@ -59,10 +59,10 @@ index d6aca2874e..7a3373fca7 100644
  
          if (bitmap_mode != BITMAP_SYNC_MODE_NEVER) {
 diff --git a/blockdev.c b/blockdev.c
-index 768a0b0fd4..4b196a2785 100644
+index fa3c2f5548..206de2b6c2 100644
 --- a/blockdev.c
 +++ b/blockdev.c
-@@ -3840,7 +3840,36 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
+@@ -3236,7 +3236,36 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
          sync = MIRROR_SYNC_MODE_FULL;
      }
  
@@ -99,10 +99,10 @@ index 768a0b0fd4..4b196a2785 100644
          if (granularity) {
              error_setg(errp, "Granularity and bitmap cannot both be set");
              return;
-diff --git a/tests/qemu-iotests/284.out b/tests/qemu-iotests/284.out
+diff --git a/tests/qemu-iotests/384.out b/tests/qemu-iotests/384.out
 index 9b7408b6d6..06a2e29058 100644
---- a/tests/qemu-iotests/284.out
-+++ b/tests/qemu-iotests/284.out
+--- a/tests/qemu-iotests/384.out
++++ b/tests/qemu-iotests/384.out
 @@ -2681,45 +2681,45 @@ qemu_img compare "TEST_DIR/PID-img" "TEST_DIR/PID-fmirror3" ==> Identical, OK!
  -- Sync mode incremental tests --
  
@@ -270,6 +270,3 @@ index 9b7408b6d6..06a2e29058 100644
 -{"error": {"class": "GenericError", "desc": "bitmap-mode must be specified if a bitmap is provided"}}
 +{"error": {"class": "GenericError", "desc": "Sync mode 'none' not supported with bitmap."}}
  
--- 
-2.20.1
-

debian/patches/pve/0040-PVE-savevm-async-set-up-migration-state.patch

@@ -0,0 +1,88 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Stefan Reiter <s.reiter@proxmox.com>
+Date: Wed, 8 Apr 2020 15:29:03 +0200
+Subject: [PATCH] PVE: savevm-async: set up migration state
+
+code mostly adapted from upstream savevm.c
+
+Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
+---
+ savevm-async.c | 30 ++++++++++++++++++++++++++++--
+ 1 file changed, 28 insertions(+), 2 deletions(-)
+
+diff --git a/savevm-async.c b/savevm-async.c
+index 790e27ae37..a38b15d652 100644
+--- a/savevm-async.c
++++ b/savevm-async.c
+@@ -225,6 +225,7 @@ static void *process_savevm_thread(void *opaque)
+ {
+     int ret;
+     int64_t maxlen;
++    MigrationState *ms = migrate_get_current();
+ 
+     rcu_register_thread();
+ 
+@@ -234,8 +235,7 @@ static void *process_savevm_thread(void *opaque)
+ 
+     if (ret < 0) {
+         save_snapshot_error("qemu_savevm_state_setup failed");
+-        rcu_unregister_thread();
+-        return NULL;
++        goto out;
+     }
+ 
+     while (snap_state.state == SAVE_STATE_ACTIVE) {
+@@ -287,6 +287,12 @@ static void *process_savevm_thread(void *opaque)
+     qemu_bh_schedule(snap_state.cleanup_bh);
+     qemu_mutex_unlock_iothread();
+ 
++out:
++    /* set migration state accordingly and clear soon-to-be stale file */
++    migrate_set_state(&ms->state, MIGRATION_STATUS_SETUP,
++                      ret ? MIGRATION_STATUS_FAILED : MIGRATION_STATUS_COMPLETED);
++    ms->to_dst_file = NULL;
++
+     rcu_unregister_thread();
+     return NULL;
+ }
+@@ -294,6 +300,7 @@ static void *process_savevm_thread(void *opaque)
+ void qmp_savevm_start(bool has_statefile, const char *statefile, Error **errp)
+ {
+     Error *local_err = NULL;
++    MigrationState *ms = migrate_get_current();
+ 
+     int bdrv_oflags = BDRV_O_RDWR | BDRV_O_RESIZE | BDRV_O_NO_FLUSH;
+ 
+@@ -303,6 +310,17 @@ void qmp_savevm_start(bool has_statefile, const char *statefile, Error **errp)
+         return;
+     }
+ 
++    if (migration_is_running(ms->state)) {
++        error_set(errp, ERROR_CLASS_GENERIC_ERROR, QERR_MIGRATION_ACTIVE);
++        return;
++    }
++
++    if (migrate_use_block()) {
++        error_set(errp, ERROR_CLASS_GENERIC_ERROR,
++                  "Block migration and snapshots are incompatible");
++        return;
++    }
++
+     /* initialize snapshot info */
+     snap_state.saved_vm_running = runstate_is_running();
+     snap_state.bs_pos = 0;
+@@ -341,6 +359,14 @@ void qmp_savevm_start(bool has_statefile, const char *statefile, Error **errp)
+         goto restart;
+     }
+ 
++    /*
++     * qemu_savevm_* paths use migration code and expect a migration state.
++     * State is cleared in process_savevm_thread, but has to be initialized
++     * here (blocking main thread, from QMP) to avoid race conditions.
++     */
++    migrate_init(ms);
++    memset(&ram_counters, 0, sizeof(ram_counters));
++    ms->to_dst_file = snap_state.file;
+ 
+     error_setg(&snap_state.blocker, "block device is in use by savevm");
+     blk_op_block_all(snap_state.target, snap_state.blocker);

debian/patches/series

@@ -1,6 +1,3 @@
-extra/0001-util-add-slirp_fmt-helpers.patch
-extra/0002-tcp_emu-fix-unsafe-snprintf-usages.patch
-extra/0003-ip_reass-Fix-use-after-free.patch
 pve/0001-PVE-Config-block-file-change-locking-default-to-off.patch
 pve/0002-PVE-Config-Adjust-network-script-path-to-etc-kvm.patch
 pve/0003-PVE-Config-set-the-CPU-model-to-kvm64-32-instead-of-.patch
@@ -19,23 +16,25 @@ pve/0015-PVE-qapi-modify-query-machines.patch
 pve/0016-PVE-qapi-modify-spice-query.patch
 pve/0017-PVE-internal-snapshot-async.patch
 pve/0018-PVE-block-add-the-zeroinit-block-driver-filter.patch
-pve/0019-PVE-backup-modify-job-api.patch
-pve/0020-PVE-Add-dummy-id-command-line-parameter.patch
-pve/0021-PVE-Config-Revert-target-i386-disable-LINT0-after-re.patch
-pve/0022-PVE-Up-Config-file-posix-make-locking-optiono-on-cre.patch
-pve/0023-PVE-savevm-async-kick-AIO-wait-on-block-state-write.patch
-pve/0024-PVE-move-snapshot-cleanup-into-bottom-half.patch
-pve/0025-PVE-monitor-disable-oob-capability.patch
-pve/0027-PVE-Compat-4.0-used-balloon-qemu-4-0-config-size-fal.patch
-pve/0028-PVE-Allow-version-code-in-machine-type.patch
-pve/0029-PVE-Backup-add-vma-backup-format-code.patch
-pve/0030-PVE-Backup-add-backup-dump-block-driver.patch
-pve/0031-PVE-Backup-proxmox-backup-patches-for-qemu.patch
+pve/0019-PVE-Add-dummy-id-command-line-parameter.patch
+pve/0020-PVE-Config-Revert-target-i386-disable-LINT0-after-re.patch
+pve/0021-PVE-Up-Config-file-posix-make-locking-optiono-on-cre.patch
+pve/0022-PVE-savevm-async-kick-AIO-wait-on-block-state-write.patch
+pve/0023-PVE-move-snapshot-cleanup-into-bottom-half.patch
+pve/0024-PVE-monitor-disable-oob-capability.patch
+pve/0025-PVE-Compat-4.0-used-balloon-qemu-4-0-config-size-fal.patch
+pve/0026-PVE-Allow-version-code-in-machine-type.patch
+pve/0027-PVE-Backup-modify-job-api.patch
+pve/0028-PVE-Backup-add-vma-backup-format-code.patch
+pve/0029-PVE-Backup-add-backup-dump-block-driver.patch
+pve/0030-PVE-Backup-proxmox-backup-patches-for-qemu.patch
+pve/0031-PVE-Backup-aquire-aio_context-before-calling-backup_.patch
 pve/0032-PVE-Backup-pbs-restore-new-command-to-restore-from-p.patch
-pve/0033-PVE-Backup-aquire-aio_context-before-calling-backup_.patch
+pve/0033-PVE-Backup-avoid-coroutines-to-fix-AIO-freeze-cleanu.patch
 pve/0034-drive-mirror-add-support-for-sync-bitmap-mode-never.patch
 pve/0035-drive-mirror-add-support-for-conditional-and-always-.patch
 pve/0036-mirror-add-check-for-bitmap-mode-without-bitmap.patch
 pve/0037-mirror-switch-to-bdrv_dirty_bitmap_merge_internal.patch
 pve/0038-iotests-add-test-for-bitmap-mirror.patch
 pve/0039-mirror-move-some-checks-to-qmp.patch
+pve/0040-PVE-savevm-async-set-up-migration-state.patch

debian/rules

@@ -115,7 +115,6 @@ install: build
 	rm -rf $(destdir)/usr/share/kvm/openbios-*
 	# remove ppc files
 	rm $(destdir)/usr/share/kvm/*.dtb
-	rm $(destdir)/usr/share/kvm/ppc_rom.bin
 	rm $(destdir)/usr/share/kvm/s390-ccw.img
 	rm $(destdir)/usr/share/kvm/s390-netboot.img
 	rm $(destdir)/usr/share/kvm/qemu_vga.ndrv

qemu

@@ -1 +1 @@
-Subproject commit b0ca999a43a22b38158a222233d3f5881648bb4f
+Subproject commit f3bac27cc1e303e1860cc55b9b6889ba39dee587