update and rebase to QEMU v6.1.0

Very clean rebase, only the +pve version handling needed manual fixing.
Drops two applied patches from extra/ and adds one new from upstream
(extra/0001*, fixes VNC over unix sockets) as well as 3 of my own for
allowing password changes on custom VNC displays again (as seen and
reviewed upstream, but not yet applied).

Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>

debian/control

@@ -33,6 +33,7 @@ Build-Depends: autotools-dev,
                meson,
                python3-minimal,
                python3-sphinx,
+               python3-sphinx-rtd-theme,
                quilt,
                texi2html,
                texinfo,

debian/patches/bitmap-mirror/0001-drive-mirror-add-support-for-sync-bitmap-mode-never.patch

@@ -35,7 +35,7 @@ Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
  5 files changed, 145 insertions(+), 29 deletions(-)
 
 diff --git a/block/mirror.c b/block/mirror.c
-index 5a71bd8bbc..f1416d96f3 100644
+index 98fc66eabf..9d73875bd6 100644
 --- a/block/mirror.c
 +++ b/block/mirror.c
 @@ -50,7 +50,7 @@ typedef struct MirrorBlockJob {
@@ -56,7 +56,7 @@ index 5a71bd8bbc..f1416d96f3 100644
      BdrvDirtyBitmap *dirty_bitmap;
      BdrvDirtyBitmapIter *dbi;
      uint8_t *buf;
-@@ -678,7 +680,8 @@ static int mirror_exit_common(Job *job)
+@@ -690,7 +692,8 @@ static int mirror_exit_common(Job *job)
      bdrv_child_refresh_perms(mirror_top_bs, mirror_top_bs->backing,
                               &error_abort);
      if (!abort && s->backing_mode == MIRROR_SOURCE_BACKING_CHAIN) {
@@ -66,7 +66,7 @@ index 5a71bd8bbc..f1416d96f3 100644
          BlockDriverState *unfiltered_target = bdrv_skip_filters(target_bs);
  
          if (bdrv_cow_bs(unfiltered_target) != backing) {
-@@ -783,6 +786,16 @@ static void mirror_abort(Job *job)
+@@ -795,6 +798,16 @@ static void mirror_abort(Job *job)
      assert(ret == 0);
  }
  
@@ -83,7 +83,7 @@ index 5a71bd8bbc..f1416d96f3 100644
  static void coroutine_fn mirror_throttle(MirrorBlockJob *s)
  {
      int64_t now = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);
-@@ -964,7 +977,8 @@ static int coroutine_fn mirror_run(Job *job, Error **errp)
+@@ -976,7 +989,8 @@ static int coroutine_fn mirror_run(Job *job, Error **errp)
      mirror_free_init(s);
  
      s->last_pause_ns = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);
@@ -93,7 +93,7 @@ index 5a71bd8bbc..f1416d96f3 100644
          ret = mirror_dirty_init(s);
          if (ret < 0 || job_is_cancelled(&s->common.job)) {
              goto immediate_exit;
-@@ -1195,6 +1209,7 @@ static const BlockJobDriver mirror_job_driver = {
+@@ -1209,6 +1223,7 @@ static const BlockJobDriver mirror_job_driver = {
          .run                    = mirror_run,
          .prepare                = mirror_prepare,
          .abort                  = mirror_abort,
@@ -101,7 +101,7 @@ index 5a71bd8bbc..f1416d96f3 100644
          .pause                  = mirror_pause,
          .complete               = mirror_complete,
          .cancel                 = mirror_cancel,
-@@ -1211,6 +1226,7 @@ static const BlockJobDriver commit_active_job_driver = {
+@@ -1225,6 +1240,7 @@ static const BlockJobDriver commit_active_job_driver = {
          .run                    = mirror_run,
          .prepare                = mirror_prepare,
          .abort                  = mirror_abort,
@@ -109,7 +109,7 @@ index 5a71bd8bbc..f1416d96f3 100644
          .pause                  = mirror_pause,
          .complete               = mirror_complete,
      },
-@@ -1572,7 +1588,10 @@ static BlockJob *mirror_start_job(
+@@ -1587,7 +1603,10 @@ static BlockJob *mirror_start_job(
                               BlockCompletionFunc *cb,
                               void *opaque,
                               const BlockJobDriver *driver,
@@ -121,7 +121,7 @@ index 5a71bd8bbc..f1416d96f3 100644
                               bool auto_complete, const char *filter_node_name,
                               bool is_mirror, MirrorCopyMode copy_mode,
                               Error **errp)
-@@ -1584,10 +1603,39 @@ static BlockJob *mirror_start_job(
+@@ -1599,10 +1618,39 @@ static BlockJob *mirror_start_job(
      uint64_t target_perms, target_shared_perms;
      int ret;
  
@@ -163,7 +163,7 @@ index 5a71bd8bbc..f1416d96f3 100644
      assert(is_power_of_2(granularity));
  
      if (buf_size < 0) {
-@@ -1728,7 +1776,9 @@ static BlockJob *mirror_start_job(
+@@ -1740,7 +1788,9 @@ static BlockJob *mirror_start_job(
      s->replaces = g_strdup(replaces);
      s->on_source_error = on_source_error;
      s->on_target_error = on_target_error;
@@ -174,7 +174,7 @@ index 5a71bd8bbc..f1416d96f3 100644
      s->backing_mode = backing_mode;
      s->zero_target = zero_target;
      s->copy_mode = copy_mode;
-@@ -1749,6 +1799,18 @@ static BlockJob *mirror_start_job(
+@@ -1761,6 +1811,18 @@ static BlockJob *mirror_start_job(
          bdrv_disable_dirty_bitmap(s->dirty_bitmap);
      }
  
@@ -193,7 +193,7 @@ index 5a71bd8bbc..f1416d96f3 100644
      ret = block_job_add_bdrv(&s->common, "source", bs, 0,
                               BLK_PERM_WRITE_UNCHANGED | BLK_PERM_WRITE |
                               BLK_PERM_CONSISTENT_READ,
-@@ -1826,6 +1888,9 @@ fail:
+@@ -1838,6 +1900,9 @@ fail:
          if (s->dirty_bitmap) {
              bdrv_release_dirty_bitmap(s->dirty_bitmap);
          }
@@ -203,7 +203,7 @@ index 5a71bd8bbc..f1416d96f3 100644
          job_early_fail(&s->common.job);
      }
  
-@@ -1843,29 +1908,23 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
+@@ -1855,29 +1920,23 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
                    BlockDriverState *target, const char *replaces,
                    int creation_flags, int64_t speed,
                    uint32_t granularity, int64_t buf_size,
@@ -238,7 +238,7 @@ index 5a71bd8bbc..f1416d96f3 100644
  }
  
  BlockJob *commit_active_start(const char *job_id, BlockDriverState *bs,
-@@ -1890,7 +1949,8 @@ BlockJob *commit_active_start(const char *job_id, BlockDriverState *bs,
+@@ -1902,7 +1961,8 @@ BlockJob *commit_active_start(const char *job_id, BlockDriverState *bs,
                       job_id, bs, creation_flags, base, NULL, speed, 0, 0,
                       MIRROR_LEAVE_BACKING_CHAIN, false,
                       on_error, on_error, true, cb, opaque,
@@ -249,10 +249,10 @@ index 5a71bd8bbc..f1416d96f3 100644
                       errp);
      if (!job) {
 diff --git a/blockdev.c b/blockdev.c
-index a57590aae4..798d02704f 100644
+index 3d8ac368a1..03e99264dc 100644
 --- a/blockdev.c
 +++ b/blockdev.c
-@@ -2963,6 +2963,10 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
+@@ -2957,6 +2957,10 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
                                     BlockDriverState *target,
                                     bool has_replaces, const char *replaces,
                                     enum MirrorSyncMode sync,
@@ -263,7 +263,7 @@ index a57590aae4..798d02704f 100644
                                     BlockMirrorBackingMode backing_mode,
                                     bool zero_target,
                                     bool has_speed, int64_t speed,
-@@ -2982,6 +2986,7 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
+@@ -2976,6 +2980,7 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
  {
      BlockDriverState *unfiltered_bs;
      int job_flags = JOB_DEFAULT;
@@ -271,7 +271,7 @@ index a57590aae4..798d02704f 100644
  
      if (!has_speed) {
          speed = 0;
-@@ -3036,6 +3041,29 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
+@@ -3030,6 +3035,29 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
          sync = MIRROR_SYNC_MODE_FULL;
      }
  
@@ -301,7 +301,7 @@ index a57590aae4..798d02704f 100644
      if (!has_replaces) {
          /* We want to mirror from @bs, but keep implicit filters on top */
          unfiltered_bs = bdrv_skip_implicit_filters(bs);
-@@ -3082,8 +3110,8 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
+@@ -3076,8 +3104,8 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
       * and will allow to check whether the node still exist at mirror completion
       */
      mirror_start(job_id, bs, target,
@@ -312,7 +312,7 @@ index a57590aae4..798d02704f 100644
                   on_source_error, on_target_error, unmap, filter_node_name,
                   copy_mode, errp);
  }
-@@ -3228,6 +3256,8 @@ void qmp_drive_mirror(DriveMirror *arg, Error **errp)
+@@ -3222,6 +3250,8 @@ void qmp_drive_mirror(DriveMirror *arg, Error **errp)
  
      blockdev_mirror_common(arg->has_job_id ? arg->job_id : NULL, bs, target_bs,
                             arg->has_replaces, arg->replaces, arg->sync,
@@ -321,7 +321,7 @@ index a57590aae4..798d02704f 100644
                             backing_mode, zero_target,
                             arg->has_speed, arg->speed,
                             arg->has_granularity, arg->granularity,
-@@ -3249,6 +3279,8 @@ void qmp_blockdev_mirror(bool has_job_id, const char *job_id,
+@@ -3243,6 +3273,8 @@ void qmp_blockdev_mirror(bool has_job_id, const char *job_id,
                           const char *device, const char *target,
                           bool has_replaces, const char *replaces,
                           MirrorSyncMode sync,
@@ -330,7 +330,7 @@ index a57590aae4..798d02704f 100644
                           bool has_speed, int64_t speed,
                           bool has_granularity, uint32_t granularity,
                           bool has_buf_size, int64_t buf_size,
-@@ -3298,7 +3330,8 @@ void qmp_blockdev_mirror(bool has_job_id, const char *job_id,
+@@ -3292,7 +3324,8 @@ void qmp_blockdev_mirror(bool has_job_id, const char *job_id,
      }
  
      blockdev_mirror_common(has_job_id ? job_id : NULL, bs, target_bs,
@@ -341,10 +341,10 @@ index a57590aae4..798d02704f 100644
                             has_granularity, granularity,
                             has_buf_size, buf_size,
 diff --git a/include/block/block_int.h b/include/block/block_int.h
-index 88e4111939..1c399bdb16 100644
+index f1a54db0f8..3e625a4261 100644
 --- a/include/block/block_int.h
 +++ b/include/block/block_int.h
-@@ -1258,7 +1258,9 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
+@@ -1247,7 +1247,9 @@ void mirror_start(const char *job_id, BlockDriverState *bs,
                    BlockDriverState *target, const char *replaces,
                    int creation_flags, int64_t speed,
                    uint32_t granularity, int64_t buf_size,
@@ -356,10 +356,10 @@ index 88e4111939..1c399bdb16 100644
                    BlockdevOnError on_source_error,
                    BlockdevOnError on_target_error,
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 6d227924d0..4b6fb6ca44 100644
+index 675d8265eb..6356a63695 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -1921,10 +1921,19 @@
+@@ -1938,10 +1938,19 @@
  #        (all the disk, only the sectors allocated in the topmost image, or
  #        only new I/O).
  #
@@ -380,7 +380,7 @@ index 6d227924d0..4b6fb6ca44 100644
  #
  # @buf-size: maximum amount of data in flight from source to
  #            target (since 1.4).
-@@ -1962,7 +1971,9 @@
+@@ -1979,7 +1988,9 @@
  { 'struct': 'DriveMirror',
    'data': { '*job-id': 'str', 'device': 'str', 'target': 'str',
              '*format': 'str', '*node-name': 'str', '*replaces': 'str',
@@ -391,7 +391,7 @@ index 6d227924d0..4b6fb6ca44 100644
              '*speed': 'int', '*granularity': 'uint32',
              '*buf-size': 'int', '*on-source-error': 'BlockdevOnError',
              '*on-target-error': 'BlockdevOnError',
-@@ -2230,10 +2241,19 @@
+@@ -2247,10 +2258,19 @@
  #        (all the disk, only the sectors allocated in the topmost image, or
  #        only new I/O).
  #
@@ -412,7 +412,7 @@ index 6d227924d0..4b6fb6ca44 100644
  #
  # @buf-size: maximum amount of data in flight from source to
  #            target
-@@ -2282,7 +2302,8 @@
+@@ -2299,7 +2319,8 @@
  { 'command': 'blockdev-mirror',
    'data': { '*job-id': 'str', 'device': 'str', 'target': 'str',
              '*replaces': 'str',
@@ -423,10 +423,10 @@ index 6d227924d0..4b6fb6ca44 100644
              '*buf-size': 'int', '*on-source-error': 'BlockdevOnError',
              '*on-target-error': 'BlockdevOnError',
 diff --git a/tests/unit/test-block-iothread.c b/tests/unit/test-block-iothread.c
-index 8cf172cb7a..65f652819d 100644
+index c39e70b2f5..470ef79ae0 100644
 --- a/tests/unit/test-block-iothread.c
 +++ b/tests/unit/test-block-iothread.c
-@@ -623,8 +623,8 @@ static void test_propagate_mirror(void)
+@@ -617,8 +617,8 @@ static void test_propagate_mirror(void)
  
      /* Start a mirror job */
      mirror_start("job0", src, target, NULL, JOB_DEFAULT, 0, 0, 0,

debian/patches/bitmap-mirror/0002-drive-mirror-add-support-for-conditional-and-always-.patch

@@ -23,10 +23,10 @@ Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
  1 file changed, 18 insertions(+), 6 deletions(-)
 
 diff --git a/block/mirror.c b/block/mirror.c
-index f1416d96f3..3e37967365 100644
+index 9d73875bd6..8148df1f80 100644
 --- a/block/mirror.c
 +++ b/block/mirror.c
-@@ -655,8 +655,6 @@ static int mirror_exit_common(Job *job)
+@@ -667,8 +667,6 @@ static int mirror_exit_common(Job *job)
          bdrv_unfreeze_backing_chain(mirror_top_bs, target_bs);
      }
  
@@ -35,7 +35,7 @@ index f1416d96f3..3e37967365 100644
      /* Make sure that the source BDS doesn't go away during bdrv_replace_node,
       * before we can call bdrv_drained_end */
      bdrv_ref(src);
-@@ -764,6 +762,18 @@ static int mirror_exit_common(Job *job)
+@@ -776,6 +774,18 @@ static int mirror_exit_common(Job *job)
      blk_set_perm(bjob->blk, 0, BLK_PERM_ALL, &error_abort);
      blk_insert_bs(bjob->blk, mirror_top_bs, &error_abort);
  
@@ -54,7 +54,7 @@ index f1416d96f3..3e37967365 100644
      bs_opaque->job = NULL;
  
      bdrv_drained_end(src);
-@@ -1613,10 +1623,6 @@ static BlockJob *mirror_start_job(
+@@ -1628,10 +1638,6 @@ static BlockJob *mirror_start_job(
                         " sync mode",
                         MirrorSyncMode_str(sync_mode));
              return NULL;
@@ -65,7 +65,7 @@ index f1416d96f3..3e37967365 100644
          }
      } else if (bitmap) {
          error_setg(errp,
-@@ -1633,6 +1639,12 @@ static BlockJob *mirror_start_job(
+@@ -1648,6 +1654,12 @@ static BlockJob *mirror_start_job(
              return NULL;
          }
          granularity = bdrv_dirty_bitmap_granularity(bitmap);

debian/patches/bitmap-mirror/0003-mirror-add-check-for-bitmap-mode-without-bitmap.patch

@@ -15,10 +15,10 @@ Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
  1 file changed, 3 insertions(+)
 
 diff --git a/blockdev.c b/blockdev.c
-index 798d02704f..c025fbf567 100644
+index 03e99264dc..9e14feec87 100644
 --- a/blockdev.c
 +++ b/blockdev.c
-@@ -3062,6 +3062,9 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
+@@ -3056,6 +3056,9 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
          if (bdrv_dirty_bitmap_check(bitmap, BDRV_BITMAP_ALLOW_RO, errp)) {
              return;
          }

debian/patches/bitmap-mirror/0004-mirror-switch-to-bdrv_dirty_bitmap_merge_internal.patch

@@ -15,10 +15,10 @@ Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
  1 file changed, 4 insertions(+), 7 deletions(-)
 
 diff --git a/block/mirror.c b/block/mirror.c
-index 3e37967365..c6f759e279 100644
+index 8148df1f80..46e3d0860b 100644
 --- a/block/mirror.c
 +++ b/block/mirror.c
-@@ -768,8 +768,8 @@ static int mirror_exit_common(Job *job)
+@@ -780,8 +780,8 @@ static int mirror_exit_common(Job *job)
               job->ret == 0 && ret == 0)) {
              /* Success; synchronize copy back to sync. */
              bdrv_clear_dirty_bitmap(s->sync_bitmap, NULL);
@@ -29,7 +29,7 @@ index 3e37967365..c6f759e279 100644
          }
      }
      bdrv_release_dirty_bitmap(s->dirty_bitmap);
-@@ -1816,11 +1816,8 @@ static BlockJob *mirror_start_job(
+@@ -1828,11 +1828,8 @@ static BlockJob *mirror_start_job(
      }
  
      if (s->sync_mode == MIRROR_SYNC_MODE_BITMAP) {

debian/patches/bitmap-mirror/0006-mirror-move-some-checks-to-qmp.patch

@@ -18,10 +18,10 @@ Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
  3 files changed, 70 insertions(+), 59 deletions(-)
 
 diff --git a/block/mirror.c b/block/mirror.c
-index c6f759e279..ce2b13b4d8 100644
+index 46e3d0860b..33477ade1b 100644
 --- a/block/mirror.c
 +++ b/block/mirror.c
-@@ -1613,31 +1613,13 @@ static BlockJob *mirror_start_job(
+@@ -1628,31 +1628,13 @@ static BlockJob *mirror_start_job(
      uint64_t target_perms, target_shared_perms;
      int ret;
  
@@ -59,10 +59,10 @@ index c6f759e279..ce2b13b4d8 100644
  
          if (bitmap_mode != BITMAP_SYNC_MODE_NEVER) {
 diff --git a/blockdev.c b/blockdev.c
-index c025fbf567..9cab29e567 100644
+index 9e14feec87..b6f797b41f 100644
 --- a/blockdev.c
 +++ b/blockdev.c
-@@ -3041,7 +3041,36 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
+@@ -3035,7 +3035,36 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
          sync = MIRROR_SYNC_MODE_FULL;
      }
  

debian/patches/extra/0001-monitor-qmp-fix-race-on-CHR_EVENT_CLOSED-without-OOB.patch

@@ -1,84 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Stefan Reiter <s.reiter@proxmox.com>
-Date: Mon, 22 Mar 2021 16:40:24 +0100
-Subject: [PATCH] monitor/qmp: fix race on CHR_EVENT_CLOSED without OOB
-
-The QMP dispatcher coroutine holds the qmp_queue_lock over a yield
-point, where it expects to be rescheduled from the main context. If a
-CHR_EVENT_CLOSED event is received just then, it can race and block the
-main thread on the mutex in monitor_qmp_cleanup_queue_and_resume.
-
-monitor_resume does not need to be called from main context, so we can
-call it immediately after popping a request from the queue, which allows
-us to drop the qmp_queue_lock mutex before yielding.
-
-Suggested-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
-Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
-Message-Id: <20210322154024.15011-1-s.reiter@proxmox.com>
-Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Cc: qemu-stable@nongnu.org
-Signed-off-by: Markus Armbruster <armbru@redhat.com>
----
- monitor/qmp.c | 40 ++++++++++++++++++++++------------------
- 1 file changed, 22 insertions(+), 18 deletions(-)
-
-diff --git a/monitor/qmp.c b/monitor/qmp.c
-index 2b0308f933..092c527b6f 100644
---- a/monitor/qmp.c
-+++ b/monitor/qmp.c
-@@ -257,24 +257,6 @@ void coroutine_fn monitor_qmp_dispatcher_co(void *data)
-         trace_monitor_qmp_in_band_dequeue(req_obj,
-                                           req_obj->mon->qmp_requests->length);
- 
--        if (qatomic_xchg(&qmp_dispatcher_co_busy, true) == true) {
--            /*
--             * Someone rescheduled us (probably because a new requests
--             * came in), but we didn't actually yield. Do that now,
--             * only to be immediately reentered and removed from the
--             * list of scheduled coroutines.
--             */
--            qemu_coroutine_yield();
--        }
--
--        /*
--         * Move the coroutine from iohandler_ctx to qemu_aio_context for
--         * executing the command handler so that it can make progress if it
--         * involves an AIO_WAIT_WHILE().
--         */
--        aio_co_schedule(qemu_get_aio_context(), qmp_dispatcher_co);
--        qemu_coroutine_yield();
--
-         /*
-          * @req_obj has a request, we hold req_obj->mon->qmp_queue_lock
-          */
-@@ -298,8 +280,30 @@ void coroutine_fn monitor_qmp_dispatcher_co(void *data)
-             monitor_resume(&mon->common);
-         }
- 
-+        /*
-+         * Drop the queue mutex now, before yielding, otherwise we might
-+         * deadlock if the main thread tries to lock it.
-+         */
-         qemu_mutex_unlock(&mon->qmp_queue_lock);
- 
-+        if (qatomic_xchg(&qmp_dispatcher_co_busy, true) == true) {
-+            /*
-+             * Someone rescheduled us (probably because a new requests
-+             * came in), but we didn't actually yield. Do that now,
-+             * only to be immediately reentered and removed from the
-+             * list of scheduled coroutines.
-+             */
-+            qemu_coroutine_yield();
-+        }
-+
-+        /*
-+         * Move the coroutine from iohandler_ctx to qemu_aio_context for
-+         * executing the command handler so that it can make progress if it
-+         * involves an AIO_WAIT_WHILE().
-+         */
-+        aio_co_schedule(qemu_get_aio_context(), qmp_dispatcher_co);
-+        qemu_coroutine_yield();
-+
-         /* Process request */
-         if (req_obj->req) {
-             if (trace_event_get_state(TRACE_MONITOR_QMP_CMD_IN_BAND)) {

debian/patches/extra/0001-qemu-sockets-fix-unix-socket-path-copy-again.patch

@@ -0,0 +1,81 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Michael Tokarev <mjt@tls.msk.ru>
+Date: Wed, 1 Sep 2021 16:16:24 +0300
+Subject: [PATCH] qemu-sockets: fix unix socket path copy (again)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Commit 4cfd970ec188558daa6214f26203fe553fb1e01f added an
+assert which ensures the path within an address of a unix
+socket returned from the kernel is at least one byte and
+does not exceed sun_path buffer. Both of this constraints
+are wrong:
+
+A unix socket can be unnamed, in this case the path is
+completely empty (not even \0)
+
+And some implementations (notable linux) can add extra
+trailing byte (\0) _after_ the sun_path buffer if we
+passed buffer larger than it (and we do).
+
+So remove the assertion (since it causes real-life breakage)
+but at the same time fix the usage of sun_path. Namely,
+we should not access sun_path[0] if kernel did not return
+it at all (this is the case for unnamed sockets),
+and use the returned salen when copyig actual path as an
+upper constraint for the amount of bytes to copy - this
+will ensure we wont exceed the information provided by
+the kernel, regardless whenever there is a trailing \0
+or not. This also helps with unnamed sockets.
+
+Note the case of abstract socket, the sun_path is actually
+a blob and can contain \0 characters, - it should not be
+passed to g_strndup and the like, it should be accessed by
+memcpy-like functions.
+
+Fixes: 4cfd970ec188558daa6214f26203fe553fb1e01f
+Fixes: http://bugs.debian.org/993145
+Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
+Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
+Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
+CC: qemu-stable@nongnu.org
+---
+ util/qemu-sockets.c | 13 +++++--------
+ 1 file changed, 5 insertions(+), 8 deletions(-)
+
+diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
+index f2f3676d1f..c5043999e9 100644
+--- a/util/qemu-sockets.c
++++ b/util/qemu-sockets.c
+@@ -1345,25 +1345,22 @@ socket_sockaddr_to_address_unix(struct sockaddr_storage *sa,
+     SocketAddress *addr;
+     struct sockaddr_un *su = (struct sockaddr_un *)sa;
+ 
+-    assert(salen >= sizeof(su->sun_family) + 1 &&
+-           salen <= sizeof(struct sockaddr_un));
+-
+     addr = g_new0(SocketAddress, 1);
+     addr->type = SOCKET_ADDRESS_TYPE_UNIX;
++    salen -= offsetof(struct sockaddr_un, sun_path);
+ #ifdef CONFIG_LINUX
+-    if (!su->sun_path[0]) {
++    if (salen > 0 && !su->sun_path[0]) {
+         /* Linux abstract socket */
+-        addr->u.q_unix.path = g_strndup(su->sun_path + 1,
+-                                        salen - sizeof(su->sun_family) - 1);
++        addr->u.q_unix.path = g_strndup(su->sun_path + 1, salen - 1);
+         addr->u.q_unix.has_abstract = true;
+         addr->u.q_unix.abstract = true;
+         addr->u.q_unix.has_tight = true;
+-        addr->u.q_unix.tight = salen < sizeof(*su);
++        addr->u.q_unix.tight = salen < sizeof(su->sun_path);
+         return addr;
+     }
+ #endif
+ 
+-    addr->u.q_unix.path = g_strndup(su->sun_path, sizeof(su->sun_path));
++    addr->u.q_unix.path = g_strndup(su->sun_path, salen);
+     return addr;
+ }
+ #endif /* WIN32 */

debian/patches/extra/0002-block-io_uring-resubmit-when-result-is-EAGAIN.patch

@@ -1,49 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Fabian Ebner <f.ebner@proxmox.com>
-Date: Fri, 23 Jul 2021 12:42:23 +0200
-Subject: [PATCH] block/io_uring: resubmit when result is -EAGAIN
-
-Linux SCSI can throw spurious -EAGAIN in some corner cases in its
-completion path, which will end up being the result in the completed
-io_uring request.
-
-Resubmitting such requests should allow block jobs to complete, even
-if such spurious errors are encountered.
-
-Co-authored-by: Stefan Hajnoczi <stefanha@gmail.com>
-Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
-Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
----
- block/io_uring.c | 16 +++++++++++++++-
- 1 file changed, 15 insertions(+), 1 deletion(-)
-
-diff --git a/block/io_uring.c b/block/io_uring.c
-index 00a3ee9fb8..dfa475cc87 100644
---- a/block/io_uring.c
-+++ b/block/io_uring.c
-@@ -165,7 +165,21 @@ static void luring_process_completions(LuringState *s)
-         total_bytes = ret + luringcb->total_read;
- 
-         if (ret < 0) {
--            if (ret == -EINTR) {
-+            /*
-+             * Only writev/readv/fsync requests on regular files or host block
-+             * devices are submitted. Therefore -EAGAIN is not expected but it's
-+             * known to happen sometimes with Linux SCSI. Submit again and hope
-+             * the request completes successfully.
-+             *
-+             * For more information, see:
-+             * https://lore.kernel.org/io-uring/20210727165811.284510-3-axboe@kernel.dk/T/#u
-+             *
-+             * If the code is changed to submit other types of requests in the
-+             * future, then this workaround may need to be extended to deal with
-+             * genuine -EAGAIN results that should not be resubmitted
-+             * immediately.
-+             */
-+            if (ret == -EINTR || ret == -EAGAIN) {
-                 luring_resubmit(s, luringcb);
-                 continue;
-             }
--- 
-2.30.2
-

debian/patches/extra/0002-monitor-qmp-fix-race-with-clients-disconnecting-earl.patch

@@ -47,7 +47,7 @@ Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
  6 files changed, 59 insertions(+), 5 deletions(-)
 
 diff --git a/include/monitor/monitor.h b/include/monitor/monitor.h
-index af3887bb71..ff6db1448b 100644
+index 1a8a369b50..2c8a558c67 100644
 --- a/include/monitor/monitor.h
 +++ b/include/monitor/monitor.h
 @@ -16,6 +16,7 @@ extern QemuOptsList qemu_mon_opts;
@@ -77,10 +77,10 @@ index 9c3a09cb01..a92be8c3f7 100644
  
  /**
 diff --git a/monitor/monitor.c b/monitor/monitor.c
-index 636bcc81c5..ee5ac26c37 100644
+index 46a171bca6..5ccdd2424b 100644
 --- a/monitor/monitor.c
 +++ b/monitor/monitor.c
-@@ -136,6 +136,21 @@ bool monitor_cur_is_qmp(void)
+@@ -135,6 +135,21 @@ bool monitor_cur_is_qmp(void)
      return cur_mon && monitor_is_qmp(cur_mon);
  }
  
@@ -103,7 +103,7 @@ index 636bcc81c5..ee5ac26c37 100644
   * Is @mon is using readline?
   * Note: not all HMP monitors use readline, e.g., gdbserver has a
 diff --git a/monitor/qmp.c b/monitor/qmp.c
-index 0ef7cebb78..3ec67e32d3 100644
+index 092c527b6f..6b8cfcf6d8 100644
 --- a/monitor/qmp.c
 +++ b/monitor/qmp.c
 @@ -141,6 +141,8 @@ static void monitor_qmp_dispatch(MonitorQMP *mon, QObject *req)

debian/patches/extra/0003-monitor-hmp-add-support-for-flag-argument-with-value.patch

@@ -0,0 +1,54 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Stefan Reiter <s.reiter@proxmox.com>
+Date: Wed, 1 Sep 2021 16:51:04 +0200
+Subject: [PATCH] monitor/hmp: add support for flag argument with value
+
+Adds support for the "-xS" parameter type, where "-x" denotes a flag
+name and the "S" suffix indicates that this flag is supposed to take an
+arbitrary string parameter.
+
+These parameters are always optional, the entry in the qdict will be
+omitted if the flag is not given.
+
+Reviewed-by: Eric Blake <eblake@redhat.com>
+Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
+---
+ monitor/hmp.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/monitor/hmp.c b/monitor/hmp.c
+index d50c3124e1..a32dce7a35 100644
+--- a/monitor/hmp.c
++++ b/monitor/hmp.c
+@@ -980,6 +980,7 @@ static QDict *monitor_parse_arguments(Monitor *mon,
+             {
+                 const char *tmp = p;
+                 int skip_key = 0;
++                int ret;
+                 /* option */
+ 
+                 c = *typestr++;
+@@ -1002,8 +1003,22 @@ static QDict *monitor_parse_arguments(Monitor *mon,
+                     }
+                     if (skip_key) {
+                         p = tmp;
++                    } else if (*typestr == 'S') {
++                        /* has option with string value */
++                        typestr++;
++                        tmp = p++;
++                        while (qemu_isspace(*p)) {
++                            p++;
++                        }
++                        ret = get_str(buf, sizeof(buf), &p);
++                        if (ret < 0) {
++                            monitor_printf(mon, "%s: value expected for -%c\n",
++                                           cmd->name, *tmp);
++                            goto fail;
++                        }
++                        qdict_put_str(qdict, key, buf);
+                     } else {
+-                        /* has option */
++                        /* has boolean option */
+                         p++;
+                         qdict_put_bool(qdict, key, true);
+                     }

debian/patches/extra/0004-monitor-refactor-set-expire_password-and-allow-VNC-d.patch

@@ -0,0 +1,475 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Stefan Reiter <s.reiter@proxmox.com>
+Date: Wed, 25 Aug 2021 11:14:13 +0200
+Subject: [PATCH] monitor: refactor set/expire_password and allow VNC display
+ id
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+It is possible to specify more than one VNC server on the command line,
+either with an explicit ID or the auto-generated ones à la "default",
+"vnc2", "vnc3", ...
+
+It is not possible to change the password on one of these extra VNC
+displays though. Fix this by adding a "display" parameter to the
+"set_password" and "expire_password" QMP and HMP commands.
+
+For HMP, the display is specified using the "-d" value flag.
+
+For QMP, the schema is updated to explicitly express the supported
+variants of the commands with protocol-discriminated unions.
+
+Suggested-by: Eric Blake <eblake@redhat.com>
+Suggested-by: Markus Armbruster <armbru@redhat.com>
+Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
+---
+ hmp-commands.hx    |  29 ++++----
+ monitor/hmp-cmds.c |  57 +++++++++++++++-
+ monitor/qmp-cmds.c |  62 ++++++-----------
+ qapi/ui.json       | 163 ++++++++++++++++++++++++++++++++++++++-------
+ 4 files changed, 232 insertions(+), 79 deletions(-)
+
+diff --git a/hmp-commands.hx b/hmp-commands.hx
+index 8e45bce2cd..d78e4cfc47 100644
+--- a/hmp-commands.hx
++++ b/hmp-commands.hx
+@@ -1514,34 +1514,35 @@ ERST
+ 
+     {
+         .name       = "set_password",
+-        .args_type  = "protocol:s,password:s,connected:s?",
+-        .params     = "protocol password action-if-connected",
++        .args_type  = "protocol:s,password:s,display:-dS,connected:s?",
++        .params     = "protocol password [-d display] [action-if-connected]",
+         .help       = "set spice/vnc password",
+         .cmd        = hmp_set_password,
+     },
+ 
+ SRST
+-``set_password [ vnc | spice ] password [ action-if-connected ]``
+-  Change spice/vnc password.  Use zero to make the password stay valid
+-  forever.  *action-if-connected* specifies what should happen in
+-  case a connection is established: *fail* makes the password change
+-  fail.  *disconnect* changes the password and disconnects the
+-  client.  *keep* changes the password and keeps the connection up.
+-  *keep* is the default.
++``set_password [ vnc | spice ] password [ -d display ] [ action-if-connected ]``
++  Change spice/vnc password.  *display* can be used with 'vnc' to specify
++  which display to set the password on.  *action-if-connected* specifies
++  what should happen in case a connection is established: *fail* makes
++  the password change fail.  *disconnect* changes the password and
++  disconnects the client.  *keep* changes the password and keeps the
++  connection up.  *keep* is the default.
+ ERST
+ 
+     {
+         .name       = "expire_password",
+-        .args_type  = "protocol:s,time:s",
+-        .params     = "protocol time",
++        .args_type  = "protocol:s,time:s,display:-dS",
++        .params     = "protocol time [-d display]",
+         .help       = "set spice/vnc password expire-time",
+         .cmd        = hmp_expire_password,
+     },
+ 
+ SRST
+-``expire_password [ vnc | spice ]`` *expire-time*
+-  Specify when a password for spice/vnc becomes
+-  invalid. *expire-time* accepts:
++``expire_password [ vnc | spice ] expire-time [ -d display ]``
++  Specify when a password for spice/vnc becomes invalid.
++  *display* behaves the same as in ``set_password``.
++  *expire-time* accepts:
+ 
+   ``now``
+     Invalidate password instantly.
+diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
+index e00255f7ee..047294e1ed 100644
+--- a/monitor/hmp-cmds.c
++++ b/monitor/hmp-cmds.c
+@@ -1451,10 +1451,41 @@ void hmp_set_password(Monitor *mon, const QDict *qdict)
+ {
+     const char *protocol  = qdict_get_str(qdict, "protocol");
+     const char *password  = qdict_get_str(qdict, "password");
++    const char *display = qdict_get_try_str(qdict, "display");
+     const char *connected = qdict_get_try_str(qdict, "connected");
+     Error *err = NULL;
++    DisplayProtocol proto;
+ 
+-    qmp_set_password(protocol, password, !!connected, connected, &err);
++    SetPasswordOptions opts = {
++        .password = g_strdup(password),
++        .u.vnc.display = NULL,
++    };
++
++    proto = qapi_enum_parse(&DisplayProtocol_lookup, protocol,
++                            DISPLAY_PROTOCOL_VNC, &err);
++    if (err) {
++        hmp_handle_error(mon, err);
++        return;
++    }
++    opts.protocol = proto;
++
++    if (proto == DISPLAY_PROTOCOL_VNC) {
++        opts.u.vnc.has_display = !!display;
++        opts.u.vnc.display = g_strdup(display);
++    } else if (proto == DISPLAY_PROTOCOL_SPICE) {
++        opts.u.spice.has_connected = !!connected;
++        opts.u.spice.connected =
++            qapi_enum_parse(&SetPasswordAction_lookup, connected,
++                            SET_PASSWORD_ACTION_KEEP, &err);
++        if (err) {
++            hmp_handle_error(mon, err);
++            return;
++        }
++    }
++
++    qmp_set_password(&opts, &err);
++    g_free(opts.password);
++    g_free(opts.u.vnc.display);
+     hmp_handle_error(mon, err);
+ }
+ 
+@@ -1462,9 +1493,31 @@ void hmp_expire_password(Monitor *mon, const QDict *qdict)
+ {
+     const char *protocol  = qdict_get_str(qdict, "protocol");
+     const char *whenstr = qdict_get_str(qdict, "time");
++    const char *display = qdict_get_try_str(qdict, "display");
+     Error *err = NULL;
++    DisplayProtocol proto;
++
++    ExpirePasswordOptions opts = {
++        .time = g_strdup(whenstr),
++        .u.vnc.display = NULL,
++    };
++
++    proto = qapi_enum_parse(&DisplayProtocol_lookup, protocol,
++                            DISPLAY_PROTOCOL_VNC, &err);
++    if (err) {
++        hmp_handle_error(mon, err);
++        return;
++    }
++    opts.protocol = proto;
++
++    if (proto == DISPLAY_PROTOCOL_VNC) {
++        opts.u.vnc.has_display = !!display;
++        opts.u.vnc.display = g_strdup(display);
++    }
+ 
+-    qmp_expire_password(protocol, whenstr, &err);
++    qmp_expire_password(&opts, &err);
++    g_free(opts.time);
++    g_free(opts.u.vnc.display);
+     hmp_handle_error(mon, err);
+ }
+ 
+diff --git a/monitor/qmp-cmds.c b/monitor/qmp-cmds.c
+index f7d64a6457..65882b5997 100644
+--- a/monitor/qmp-cmds.c
++++ b/monitor/qmp-cmds.c
+@@ -164,45 +164,30 @@ void qmp_system_wakeup(Error **errp)
+     qemu_system_wakeup_request(QEMU_WAKEUP_REASON_OTHER, errp);
+ }
+ 
+-void qmp_set_password(const char *protocol, const char *password,
+-                      bool has_connected, const char *connected, Error **errp)
++void qmp_set_password(SetPasswordOptions *opts, Error **errp)
+ {
+-    int disconnect_if_connected = 0;
+-    int fail_if_connected = 0;
+-    int rc;
+-
+-    if (has_connected) {
+-        if (strcmp(connected, "fail") == 0) {
+-            fail_if_connected = 1;
+-        } else if (strcmp(connected, "disconnect") == 0) {
+-            disconnect_if_connected = 1;
+-        } else if (strcmp(connected, "keep") == 0) {
+-            /* nothing */
+-        } else {
+-            error_setg(errp, QERR_INVALID_PARAMETER, "connected");
+-            return;
+-        }
+-    }
++    bool disconnect_if_connected = false;
++    bool fail_if_connected = false;
++    int rc = 0;
+ 
+-    if (strcmp(protocol, "spice") == 0) {
++    if (opts->protocol == DISPLAY_PROTOCOL_SPICE) {
+         if (!qemu_using_spice(errp)) {
+             return;
+         }
+-        rc = qemu_spice.set_passwd(password, fail_if_connected,
+-                                   disconnect_if_connected);
+-    } else if (strcmp(protocol, "vnc") == 0) {
+-        if (fail_if_connected || disconnect_if_connected) {
+-            /* vnc supports "connected=keep" only */
+-            error_setg(errp, QERR_INVALID_PARAMETER, "connected");
+-            return;
++        if (opts->u.spice.has_connected) {
++            fail_if_connected =
++                opts->u.spice.connected == SET_PASSWORD_ACTION_FAIL;
++            disconnect_if_connected =
++                opts->u.spice.connected == SET_PASSWORD_ACTION_DISCONNECT;
+         }
++        rc = qemu_spice.set_passwd(opts->password, fail_if_connected,
++                                   disconnect_if_connected);
++    } else if (opts->protocol == DISPLAY_PROTOCOL_VNC) {
+         /* Note that setting an empty password will not disable login through
+          * this interface. */
+-        rc = vnc_display_password(NULL, password);
+-    } else {
+-        error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "protocol",
+-                   "'vnc' or 'spice'");
+-        return;
++        rc = vnc_display_password(
++                opts->u.vnc.has_display ? opts->u.vnc.display : NULL,
++                opts->password);
+     }
+ 
+     if (rc != 0) {
+@@ -210,11 +195,11 @@ void qmp_set_password(const char *protocol, const char *password,
+     }
+ }
+ 
+-void qmp_expire_password(const char *protocol, const char *whenstr,
+-                         Error **errp)
++void qmp_expire_password(ExpirePasswordOptions *opts, Error **errp)
+ {
+     time_t when;
+     int rc;
++    const char* whenstr = opts->time;
+ 
+     if (strcmp(whenstr, "now") == 0) {
+         when = 0;
+@@ -226,17 +211,14 @@ void qmp_expire_password(const char *protocol, const char *whenstr,
+         when = strtoull(whenstr, NULL, 10);
+     }
+ 
+-    if (strcmp(protocol, "spice") == 0) {
++    if (opts->protocol == DISPLAY_PROTOCOL_SPICE) {
+         if (!qemu_using_spice(errp)) {
+             return;
+         }
+         rc = qemu_spice.set_pw_expire(when);
+-    } else if (strcmp(protocol, "vnc") == 0) {
+-        rc = vnc_display_pw_expire(NULL, when);
+-    } else {
+-        error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "protocol",
+-                   "'vnc' or 'spice'");
+-        return;
++    } else if (opts->protocol == DISPLAY_PROTOCOL_VNC) {
++        rc = vnc_display_pw_expire(
++                opts->u.vnc.has_display ? opts->u.vnc.display : NULL, when);
+     }
+ 
+     if (rc != 0) {
+diff --git a/qapi/ui.json b/qapi/ui.json
+index fd9677d48e..0177cf4ee9 100644
+--- a/qapi/ui.json
++++ b/qapi/ui.json
+@@ -10,20 +10,21 @@
+ { 'include': 'sockets.json' }
+ 
+ ##
+-# @set_password:
++# @DisplayProtocol:
+ #
+-# Sets the password of a remote display session.
++# Display protocols which support changing password options.
+ #
+-# @protocol: - 'vnc' to modify the VNC server password
+-#            - 'spice' to modify the Spice server password
++# Since: 6.2
+ #
+-# @password: the new password
++##
++{ 'enum': 'DisplayProtocol',
++  'data': [ { 'name': 'vnc', 'if': 'defined(CONFIG_VNC)' },
++            { 'name': 'spice', 'if': 'defined(CONFIG_SPICE)' } ] }
++
++##
++# @set_password:
+ #
+-# @connected: how to handle existing clients when changing the
+-#             password.  If nothing is specified, defaults to 'keep'
+-#             'fail' to fail the command if clients are connected
+-#             'disconnect' to disconnect existing clients
+-#             'keep' to maintain existing clients
++# Sets the password of a remote display session.
+ #
+ # Returns: - Nothing on success
+ #          - If Spice is not enabled, DeviceNotFound
+@@ -37,16 +38,123 @@
+ # <- { "return": {} }
+ #
+ ##
+-{ 'command': 'set_password',
+-  'data': {'protocol': 'str', 'password': 'str', '*connected': 'str'} }
++{ 'command': 'set_password', 'boxed': true, 'data': 'SetPasswordOptions' }
++
++##
++# @SetPasswordOptions:
++#
++# Data required to set a new password on a display server protocol.
++#
++# @protocol: - 'vnc' to modify the VNC server password
++#            - 'spice' to modify the Spice server password
++#
++# @password: the new password
++#
++# Since: 6.2
++#
++##
++{ 'union': 'SetPasswordOptions',
++  'base': { 'protocol': 'DisplayProtocol',
++            'password': 'str' },
++  'discriminator': 'protocol',
++  'data': { 'vnc': 'SetPasswordOptionsVnc',
++            'spice': 'SetPasswordOptionsSpice' } }
++
++##
++# @SetPasswordAction:
++#
++# An action to take on changing a password on a connection with active clients.
++#
++# @fail: fail the command if clients are connected
++#
++# @disconnect: disconnect existing clients
++#
++# @keep: maintain existing clients
++#
++# Since: 6.2
++#
++##
++{ 'enum': 'SetPasswordAction',
++  'data': [ 'fail', 'disconnect', 'keep' ] }
++
++##
++# @SetPasswordActionVnc:
++#
++# See @SetPasswordAction. VNC only supports the keep action. 'connection'
++# should just be omitted for VNC, this is kept for backwards compatibility.
++#
++# @keep: maintain existing clients
++#
++# Since: 6.2
++#
++##
++{ 'enum': 'SetPasswordActionVnc',
++  'data': [ 'keep' ] }
++
++##
++# @SetPasswordOptionsSpice:
++#
++# Options for set_password specific to the VNC procotol.
++#
++# @connected: How to handle existing clients when changing the
++#             password. If nothing is specified, defaults to 'keep'.
++#
++# Since: 6.2
++#
++##
++{ 'struct': 'SetPasswordOptionsSpice',
++  'data': { '*connected': 'SetPasswordAction' } }
++
++##
++# @SetPasswordOptionsVnc:
++#
++# Options for set_password specific to the VNC procotol.
++#
++# @display: The id of the display where the password should be changed.
++#           Defaults to the first.
++#
++# @connected: How to handle existing clients when changing the
++#             password.
++#
++# Features:
++# @deprecated: For VNC, @connected will always be 'keep', parameter should be
++#              omitted.
++#
++# Since: 6.2
++#
++##
++{ 'struct': 'SetPasswordOptionsVnc',
++  'data': { '*display': 'str',
++            '*connected': { 'type': 'SetPasswordActionVnc',
++                            'features': ['deprecated'] } } }
+ 
+ ##
+ # @expire_password:
+ #
+ # Expire the password of a remote display server.
+ #
+-# @protocol: the name of the remote display protocol 'vnc' or 'spice'
++# Returns: - Nothing on success
++#          - If @protocol is 'spice' and Spice is not active, DeviceNotFound
++#
++# Since: 0.14
++#
++# Example:
++#
++# -> { "execute": "expire_password", "arguments": { "protocol": "vnc",
++#                                                   "time": "+60" } }
++# <- { "return": {} }
++#
++##
++{ 'command': 'expire_password', 'boxed': true, 'data': 'ExpirePasswordOptions' }
++
++##
++# @ExpirePasswordOptions:
++#
++# Data required to set password expiration on a display server protocol.
+ #
++# @protocol: - 'vnc' to modify the VNC server expiration
++#            - 'spice' to modify the Spice server expiration
++
+ # @time: when to expire the password.
+ #
+ #        - 'now' to expire the password immediately
+@@ -54,24 +162,33 @@
+ #        - '+INT' where INT is the number of seconds from now (integer)
+ #        - 'INT' where INT is the absolute time in seconds
+ #
+-# Returns: - Nothing on success
+-#          - If @protocol is 'spice' and Spice is not active, DeviceNotFound
+-#
+-# Since: 0.14
+-#
+ # Notes: Time is relative to the server and currently there is no way to
+ #        coordinate server time with client time.  It is not recommended to
+ #        use the absolute time version of the @time parameter unless you're
+ #        sure you are on the same machine as the QEMU instance.
+ #
+-# Example:
++# Since: 6.2
+ #
+-# -> { "execute": "expire_password", "arguments": { "protocol": "vnc",
+-#                                                   "time": "+60" } }
+-# <- { "return": {} }
++##
++{ 'union': 'ExpirePasswordOptions',
++  'base': { 'protocol': 'DisplayProtocol',
++            'time': 'str' },
++  'discriminator': 'protocol',
++  'data': { 'vnc': 'ExpirePasswordOptionsVnc' } }
++
++##
++# @ExpirePasswordOptionsVnc:
++#
++# Options for expire_password specific to the VNC procotol.
++#
++# @display: The id of the display where the expiration should be changed.
++#           Defaults to the first.
++#
++# Since: 6.2
+ #
+ ##
+-{ 'command': 'expire_password', 'data': {'protocol': 'str', 'time': 'str'} }
++{ 'struct': 'ExpirePasswordOptionsVnc',
++  'data': { '*display': 'str' } }
+ 
+ ##
+ # @screendump:

debian/patches/extra/0005-monitor-hmp-correctly-invert-password-argument-detec.patch

@@ -0,0 +1,36 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Stefan Reiter <s.reiter@proxmox.com>
+Date: Wed, 25 Aug 2021 11:08:41 +0200
+Subject: [PATCH] monitor/hmp: correctly invert password argument detection
+ again
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Commit cfb5387a1d 'hmp: remove "change vnc TARGET" command' claims to
+remove the HMP "change vnc" command, but doesn't actually do that.
+Instead it rewires it to use 'qmp_change_vnc_password', and in the
+process inverts the argument detection - ignoring the first issue, this
+inversion is wrong, as this will now ask the user for a password if one
+is already provided, and simply fail if none is given.
+
+Fixes: cfb5387a1d ("hmp: remove "change vnc TARGET" command")
+Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
+Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
+---
+ monitor/hmp-cmds.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
+index 047294e1ed..f4ef58d257 100644
+--- a/monitor/hmp-cmds.c
++++ b/monitor/hmp-cmds.c
+@@ -1549,7 +1549,7 @@ void hmp_change(Monitor *mon, const QDict *qdict)
+         }
+         if (strcmp(target, "passwd") == 0 ||
+             strcmp(target, "password") == 0) {
+-            if (arg) {
++            if (!arg) {
+                 MonitorHMP *hmp_mon = container_of(mon, MonitorHMP, common);
+                 monitor_read_password(hmp_mon, hmp_change_read_arg, NULL);
+                 return;

debian/patches/pve/0001-PVE-Config-block-file-change-locking-default-to-off.patch

@@ -14,10 +14,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/block/file-posix.c b/block/file-posix.c
-index 20e14f8e96..9242b76c04 100644
+index cb9bffe047..1bbeb9e658 100644
 --- a/block/file-posix.c
 +++ b/block/file-posix.c
-@@ -522,7 +522,7 @@ static QemuOptsList raw_runtime_opts = {
+@@ -533,7 +533,7 @@ static QemuOptsList raw_runtime_opts = {
          {
              .name = "locking",
              .type = QEMU_OPT_STRING,
@@ -26,7 +26,7 @@ index 20e14f8e96..9242b76c04 100644
          },
          {
              .name = "pr-manager",
-@@ -620,7 +620,7 @@ static int raw_open_common(BlockDriverState *bs, QDict *options,
+@@ -631,7 +631,7 @@ static int raw_open_common(BlockDriverState *bs, QDict *options,
          s->use_lock = false;
          break;
      case ON_OFF_AUTO_AUTO:

debian/patches/pve/0002-PVE-Config-Adjust-network-script-path-to-etc-kvm.patch

@@ -9,10 +9,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/include/net/net.h b/include/net/net.h
-index 1ef536d771..2f4073678b 100644
+index 5d1508081f..f665924193 100644
 --- a/include/net/net.h
 +++ b/include/net/net.h
-@@ -217,8 +217,8 @@ void netdev_add(QemuOpts *opts, Error **errp);
+@@ -219,8 +219,8 @@ void netdev_add(QemuOpts *opts, Error **errp);
  int net_hub_id_for_client(NetClientState *nc, int *id);
  NetClientState *net_hub_port_find(int hub_id);
  

debian/patches/pve/0003-PVE-Config-set-the-CPU-model-to-kvm64-32-instead-of-.patch

@@ -10,10 +10,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/target/i386/cpu.h b/target/i386/cpu.h
-index 570f916878..796cd534ee 100644
+index 6c50d3ab4f..00289a798a 100644
 --- a/target/i386/cpu.h
 +++ b/target/i386/cpu.h
-@@ -1973,9 +1973,9 @@ uint64_t cpu_get_tsc(CPUX86State *env);
+@@ -2006,9 +2006,9 @@ uint64_t cpu_get_tsc(CPUX86State *env);
  #define CPU_RESOLVING_TYPE TYPE_X86_CPU
  
  #ifdef TARGET_X86_64

debian/patches/pve/0004-PVE-Config-ui-spice-default-to-pve-certificates.patch

@@ -9,7 +9,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 9 insertions(+), 6 deletions(-)
 
 diff --git a/ui/spice-core.c b/ui/spice-core.c
-index 272d19b0c1..9719214f19 100644
+index 0371055e6c..840cf56923 100644
 --- a/ui/spice-core.c
 +++ b/ui/spice-core.c
 @@ -694,32 +694,35 @@ static void qemu_spice_init(void)

debian/patches/pve/0006-PVE-Config-rbd-block-rbd-disable-rbd_cache_writethro.patch

@@ -18,10 +18,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 2 insertions(+)
 
 diff --git a/block/rbd.c b/block/rbd.c
-index f098a89c7b..b691c32c70 100644
+index dcf82b15b8..feeec452f0 100644
 --- a/block/rbd.c
 +++ b/block/rbd.c
-@@ -610,6 +610,8 @@ static int qemu_rbd_connect(rados_t *cluster, rados_ioctx_t *io_ctx,
+@@ -814,6 +814,8 @@ static int qemu_rbd_connect(rados_t *cluster, rados_ioctx_t *io_ctx,
          rados_conf_set(*cluster, "rbd_cache", "false");
      }
  

debian/patches/pve/0007-PVE-Up-qmp-add-get_link_status.patch

@@ -11,10 +11,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  3 files changed, 43 insertions(+)
 
 diff --git a/net/net.c b/net/net.c
-index edf9b95418..c2fa8bc9b4 100644
+index 76bbb7c31b..82e0a768b4 100644
 --- a/net/net.c
 +++ b/net/net.c
-@@ -1315,6 +1315,33 @@ void hmp_info_network(Monitor *mon, const QDict *qdict)
+@@ -1314,6 +1314,33 @@ void hmp_info_network(Monitor *mon, const QDict *qdict)
      }
  }
  
@@ -49,7 +49,7 @@ index edf9b95418..c2fa8bc9b4 100644
  {
      NetClientState *nc;
 diff --git a/qapi/net.json b/qapi/net.json
-index af3f5b0fda..6e3ec838c7 100644
+index 7fab2e7cd8..74c9a6109e 100644
 --- a/qapi/net.json
 +++ b/qapi/net.json
 @@ -35,6 +35,21 @@

debian/patches/pve/0009-PVE-Up-qemu-img-return-success-on-info-without-snaps.patch

@@ -9,10 +9,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/qemu-img.c b/qemu-img.c
-index babb5573ab..6377499c5e 100644
+index 908fd0cce5..5dc1d0a2ca 100644
 --- a/qemu-img.c
 +++ b/qemu-img.c
-@@ -2932,7 +2932,8 @@ static int img_info(int argc, char **argv)
+@@ -2977,7 +2977,8 @@ static int img_info(int argc, char **argv)
      list = collect_image_info_list(image_opts, filename, fmt, chain,
                                     force_share);
      if (!list) {

debian/patches/pve/0010-PVE-Up-qemu-img-dd-add-osize-and-read-from-to-stdin-.patch

@@ -53,10 +53,10 @@ index b3620f29e5..e70ef3dc91 100644
  
  DEF("info", img_info,
 diff --git a/qemu-img.c b/qemu-img.c
-index 6377499c5e..10db094561 100644
+index 5dc1d0a2ca..f773182bd0 100644
 --- a/qemu-img.c
 +++ b/qemu-img.c
-@@ -4742,10 +4742,12 @@ static int img_bitmap(int argc, char **argv)
+@@ -4793,10 +4793,12 @@ static int img_bitmap(int argc, char **argv)
  #define C_IF      04
  #define C_OF      010
  #define C_SKIP    020
@@ -69,7 +69,7 @@ index 6377499c5e..10db094561 100644
  };
  
  struct DdIo {
-@@ -4821,6 +4823,19 @@ static int img_dd_skip(const char *arg,
+@@ -4872,6 +4874,19 @@ static int img_dd_skip(const char *arg,
      return 0;
  }
  
@@ -89,7 +89,7 @@ index 6377499c5e..10db094561 100644
  static int img_dd(int argc, char **argv)
  {
      int ret = 0;
-@@ -4861,6 +4876,7 @@ static int img_dd(int argc, char **argv)
+@@ -4912,6 +4927,7 @@ static int img_dd(int argc, char **argv)
          { "if", img_dd_if, C_IF },
          { "of", img_dd_of, C_OF },
          { "skip", img_dd_skip, C_SKIP },
@@ -97,7 +97,7 @@ index 6377499c5e..10db094561 100644
          { NULL, NULL, 0 }
      };
      const struct option long_options[] = {
-@@ -4936,91 +4952,112 @@ static int img_dd(int argc, char **argv)
+@@ -4987,91 +5003,112 @@ static int img_dd(int argc, char **argv)
          arg = NULL;
      }
  
@@ -274,7 +274,7 @@ index 6377499c5e..10db094561 100644
      }
  
      if (dd.flags & C_SKIP && (in.offset > INT64_MAX / in.bsz ||
-@@ -5038,11 +5075,17 @@ static int img_dd(int argc, char **argv)
+@@ -5089,11 +5126,17 @@ static int img_dd(int argc, char **argv)
  
      for (out_pos = 0; in_pos < size; block_count++) {
          int in_ret, out_ret;
@@ -296,7 +296,7 @@ index 6377499c5e..10db094561 100644
          }
          if (in_ret < 0) {
              error_report("error while reading from input image file: %s",
-@@ -5052,9 +5095,13 @@ static int img_dd(int argc, char **argv)
+@@ -5103,9 +5146,13 @@ static int img_dd(int argc, char **argv)
          }
          in_pos += in_ret;
  

debian/patches/pve/0011-PVE-Up-qemu-img-dd-add-isize-parameter.patch

@@ -15,10 +15,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 25 insertions(+), 3 deletions(-)
 
 diff --git a/qemu-img.c b/qemu-img.c
-index 10db094561..fb1031223d 100644
+index f773182bd0..98a6562364 100644
 --- a/qemu-img.c
 +++ b/qemu-img.c
-@@ -4743,11 +4743,13 @@ static int img_bitmap(int argc, char **argv)
+@@ -4794,11 +4794,13 @@ static int img_bitmap(int argc, char **argv)
  #define C_OF      010
  #define C_SKIP    020
  #define C_OSIZE   040
@@ -32,7 +32,7 @@ index 10db094561..fb1031223d 100644
  };
  
  struct DdIo {
-@@ -4836,6 +4838,19 @@ static int img_dd_osize(const char *arg,
+@@ -4887,6 +4889,19 @@ static int img_dd_osize(const char *arg,
      return 0;
  }
  
@@ -52,7 +52,7 @@ index 10db094561..fb1031223d 100644
  static int img_dd(int argc, char **argv)
  {
      int ret = 0;
-@@ -4850,12 +4865,14 @@ static int img_dd(int argc, char **argv)
+@@ -4901,12 +4916,14 @@ static int img_dd(int argc, char **argv)
      int c, i;
      const char *out_fmt = "raw";
      const char *fmt = NULL;
@@ -68,7 +68,7 @@ index 10db094561..fb1031223d 100644
      };
      struct DdIo in = {
          .bsz = 512, /* Block size is by default 512 bytes */
-@@ -4877,6 +4894,7 @@ static int img_dd(int argc, char **argv)
+@@ -4928,6 +4945,7 @@ static int img_dd(int argc, char **argv)
          { "of", img_dd_of, C_OF },
          { "skip", img_dd_skip, C_SKIP },
          { "osize", img_dd_osize, C_OSIZE },
@@ -76,7 +76,7 @@ index 10db094561..fb1031223d 100644
          { NULL, NULL, 0 }
      };
      const struct option long_options[] = {
-@@ -5073,14 +5091,18 @@ static int img_dd(int argc, char **argv)
+@@ -5124,14 +5142,18 @@ static int img_dd(int argc, char **argv)
  
      in.buf = g_new(uint8_t, in.bsz);
  

debian/patches/pve/0012-PVE-Up-qemu-img-dd-add-n-skip_create.patch

@@ -9,10 +9,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 14 insertions(+), 9 deletions(-)
 
 diff --git a/qemu-img.c b/qemu-img.c
-index fb1031223d..855d4fa7d3 100644
+index 98a6562364..355b3b82f4 100644
 --- a/qemu-img.c
 +++ b/qemu-img.c
-@@ -4867,7 +4867,7 @@ static int img_dd(int argc, char **argv)
+@@ -4918,7 +4918,7 @@ static int img_dd(int argc, char **argv)
      const char *fmt = NULL;
      int64_t size = 0, readsize = 0;
      int64_t block_count = 0, out_pos, in_pos;
@@ -21,7 +21,7 @@ index fb1031223d..855d4fa7d3 100644
      struct DdInfo dd = {
          .flags = 0,
          .count = 0,
-@@ -4905,7 +4905,7 @@ static int img_dd(int argc, char **argv)
+@@ -4956,7 +4956,7 @@ static int img_dd(int argc, char **argv)
          { 0, 0, 0, 0 }
      };
  
@@ -30,7 +30,7 @@ index fb1031223d..855d4fa7d3 100644
          if (c == EOF) {
              break;
          }
-@@ -4925,6 +4925,9 @@ static int img_dd(int argc, char **argv)
+@@ -4976,6 +4976,9 @@ static int img_dd(int argc, char **argv)
          case 'h':
              help();
              break;
@@ -40,7 +40,7 @@ index fb1031223d..855d4fa7d3 100644
          case 'U':
              force_share = true;
              break;
-@@ -5055,13 +5058,15 @@ static int img_dd(int argc, char **argv)
+@@ -5106,13 +5109,15 @@ static int img_dd(int argc, char **argv)
                                  size - in.bsz * in.offset, &error_abort);
          }
  

debian/patches/pve/0013-PVE-virtio-balloon-improve-query-balloon.patch

@@ -14,10 +14,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  3 files changed, 81 insertions(+), 4 deletions(-)
 
 diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
-index d120bf8f43..26077223ac 100644
+index 4b5d9e5e50..fddb5a4b82 100644
 --- a/hw/virtio/virtio-balloon.c
 +++ b/hw/virtio/virtio-balloon.c
-@@ -809,8 +809,37 @@ static uint64_t virtio_balloon_get_features(VirtIODevice *vdev, uint64_t f,
+@@ -807,8 +807,37 @@ static uint64_t virtio_balloon_get_features(VirtIODevice *vdev, uint64_t f,
  static void virtio_balloon_stat(void *opaque, BalloonInfo *info)
  {
      VirtIOBalloon *dev = opaque;
@@ -58,7 +58,7 @@ index d120bf8f43..26077223ac 100644
  
  static void virtio_balloon_to_target(void *opaque, ram_addr_t target)
 diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
-index 0ad5b77477..1116767275 100644
+index e00255f7ee..f528055cb6 100644
 --- a/monitor/hmp-cmds.c
 +++ b/monitor/hmp-cmds.c
 @@ -698,7 +698,35 @@ void hmp_info_balloon(Monitor *mon, const QDict *qdict)
@@ -99,10 +99,10 @@ index 0ad5b77477..1116767275 100644
      qapi_free_BalloonInfo(info);
  }
 diff --git a/qapi/machine.json b/qapi/machine.json
-index 6e90d463fc..f8da4a0d98 100644
+index 157712f006..34035c25d1 100644
 --- a/qapi/machine.json
 +++ b/qapi/machine.json
-@@ -1008,10 +1008,30 @@
+@@ -1018,10 +1018,30 @@
  # @actual: the logical size of the VM in bytes
  #          Formula used: logical_vm_size = vm_ram_size - balloon_size
  #

debian/patches/pve/0014-PVE-qapi-modify-query-machines.patch

@@ -13,10 +13,10 @@ Signed-off-by: Dietmar Maurer <dietmar@proxmox.com>
  2 files changed, 9 insertions(+), 1 deletion(-)
 
 diff --git a/hw/core/machine-qmp-cmds.c b/hw/core/machine-qmp-cmds.c
-index 68a942595a..76195de9e0 100644
+index 216fdfaf3a..8f8d5d5276 100644
 --- a/hw/core/machine-qmp-cmds.c
 +++ b/hw/core/machine-qmp-cmds.c
-@@ -100,6 +100,12 @@ MachineInfoList *qmp_query_machines(Error **errp)
+@@ -98,6 +98,12 @@ MachineInfoList *qmp_query_machines(Error **errp)
          info->hotpluggable_cpus = mc->has_hotpluggable_cpus;
          info->numa_mem_supported = mc->numa_mem_supported;
          info->deprecated = !!mc->deprecation_reason;
@@ -30,7 +30,7 @@ index 68a942595a..76195de9e0 100644
              info->default_cpu_type = g_strdup(mc->default_cpu_type);
              info->has_default_cpu_type = true;
 diff --git a/qapi/machine.json b/qapi/machine.json
-index f8da4a0d98..6e7e93d68f 100644
+index 34035c25d1..cf120ac343 100644
 --- a/qapi/machine.json
 +++ b/qapi/machine.json
 @@ -141,6 +141,8 @@

debian/patches/pve/0015-PVE-qapi-modify-spice-query.patch

@@ -12,7 +12,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  2 files changed, 8 insertions(+)
 
 diff --git a/qapi/ui.json b/qapi/ui.json
-index 1052ca9c38..16bf03224f 100644
+index fd9677d48e..4497bb9c1f 100644
 --- a/qapi/ui.json
 +++ b/qapi/ui.json
 @@ -216,11 +216,14 @@
@@ -31,7 +31,7 @@ index 1052ca9c38..16bf03224f 100644
    'if': 'defined(CONFIG_SPICE)' }
  
 diff --git a/ui/spice-core.c b/ui/spice-core.c
-index 9719214f19..982b1dc05f 100644
+index 840cf56923..96be349635 100644
 --- a/ui/spice-core.c
 +++ b/ui/spice-core.c
 @@ -534,6 +534,11 @@ static SpiceInfo *qmp_query_spice_real(Error **errp)

debian/patches/pve/0016-PVE-add-savevm-async-for-background-state-snapshots.patch

@@ -39,10 +39,10 @@ Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
  create mode 100644 migration/savevm-async.c
 
 diff --git a/hmp-commands-info.hx b/hmp-commands-info.hx
-index ab0c7aa5ee..c72db5f666 100644
+index 27206ac049..e6dd3be07a 100644
 --- a/hmp-commands-info.hx
 +++ b/hmp-commands-info.hx
-@@ -567,6 +567,19 @@ SRST
+@@ -551,6 +551,19 @@ SRST
      Show current migration parameters.
  ERST
  
@@ -63,13 +63,13 @@ index ab0c7aa5ee..c72db5f666 100644
          .name       = "balloon",
          .args_type  = "",
 diff --git a/hmp-commands.hx b/hmp-commands.hx
-index 435c591a1c..0b9d526937 100644
+index 8e45bce2cd..96bd7e00bd 100644
 --- a/hmp-commands.hx
 +++ b/hmp-commands.hx
-@@ -1725,3 +1725,36 @@ ERST
-         .flags      = "p",
+@@ -1743,3 +1743,36 @@ ERST
+         .help       = "start a round of guest dirty rate measurement",
+         .cmd        = hmp_calc_dirty_rate,
      },
- 
 +
 +    {
 +        .name       = "savevm-start",
@@ -115,7 +115,7 @@ index e72083b117..c846d37806 100644
 +
  #endif
 diff --git a/include/monitor/hmp.h b/include/monitor/hmp.h
-index 605d57287a..e287e071d8 100644
+index 3baa1058e2..1247d7362a 100644
 --- a/include/monitor/hmp.h
 +++ b/include/monitor/hmp.h
 @@ -25,6 +25,7 @@ void hmp_info_status(Monitor *mon, const QDict *qdict);
@@ -138,7 +138,7 @@ index 605d57287a..e287e071d8 100644
  void hmp_screendump(Monitor *mon, const QDict *qdict);
  void hmp_chardev_add(Monitor *mon, const QDict *qdict);
 diff --git a/migration/meson.build b/migration/meson.build
-index 3ecedce94d..c8ae813a48 100644
+index f8714dcb15..ea9aedeefc 100644
 --- a/migration/meson.build
 +++ b/migration/meson.build
 @@ -23,6 +23,7 @@ softmmu_ss.add(files(
@@ -151,7 +151,7 @@ index 3ecedce94d..c8ae813a48 100644
  ), gnutls)
 diff --git a/migration/savevm-async.c b/migration/savevm-async.c
 new file mode 100644
-index 0000000000..593a619088
+index 0000000000..79a0cda906
 --- /dev/null
 +++ b/migration/savevm-async.c
 @@ -0,0 +1,598 @@
@@ -210,7 +210,7 @@ index 0000000000..593a619088
 +    int64_t total_time;
 +    QEMUBH *finalize_bh;
 +    Coroutine *co;
-+    QemuCoSleepState *target_close_wait;
++    QemuCoSleep *target_close_wait;
 +} snap_state;
 +
 +static bool savevm_aborted(void)
@@ -653,8 +653,8 @@ index 0000000000..593a619088
 +     * call exits the statefile will be closed and can be removed immediately */
 +    DPRINTF("savevm-end: waiting for cleanup\n");
 +    timeout = 30L * 1000 * 1000 * 1000;
-+    qemu_co_sleep_ns_wakeable(QEMU_CLOCK_REALTIME, timeout,
-+                              &snap_state.target_close_wait);
++    qemu_co_sleep_ns_wakeable(snap_state.target_close_wait,
++                              QEMU_CLOCK_REALTIME, timeout);
 +    snap_state.target_close_wait = NULL;
 +    if (snap_state.target) {
 +        save_snapshot_error("timeout waiting for target file close in "
@@ -754,10 +754,10 @@ index 0000000000..593a619088
 +    return ret;
 +}
 diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
-index 1116767275..948c9d9ff8 100644
+index f528055cb6..42a1eaf370 100644
 --- a/monitor/hmp-cmds.c
 +++ b/monitor/hmp-cmds.c
-@@ -1904,6 +1904,63 @@ void hmp_info_memory_devices(Monitor *mon, const QDict *qdict)
+@@ -1908,6 +1908,63 @@ void hmp_info_memory_devices(Monitor *mon, const QDict *qdict)
      hmp_handle_error(mon, err);
  }
  
@@ -822,10 +822,10 @@ index 1116767275..948c9d9ff8 100644
  {
      IOThreadInfoList *info_list = qmp_query_iothreads(NULL);
 diff --git a/qapi/migration.json b/qapi/migration.json
-index 0b17cce46b..db80401817 100644
+index 1124a2dda8..3d72b3e3f3 100644
 --- a/qapi/migration.json
 +++ b/qapi/migration.json
-@@ -253,6 +253,40 @@
+@@ -247,6 +247,40 @@
             '*compression': 'CompressionStats',
             '*socket-address': ['SocketAddress'] } }
  
@@ -867,10 +867,10 @@ index 0b17cce46b..db80401817 100644
  # @query-migrate:
  #
 diff --git a/qapi/misc.json b/qapi/misc.json
-index 156f98203e..ad6c7713e2 100644
+index 5c2ca3b556..9bc14e1032 100644
 --- a/qapi/misc.json
 +++ b/qapi/misc.json
-@@ -427,6 +427,38 @@
+@@ -431,6 +431,38 @@
  ##
  { 'command': 'query-fdsets', 'returns': ['FdsetInfo'] }
  
@@ -910,10 +910,10 @@ index 156f98203e..ad6c7713e2 100644
  # @CommandLineParameterType:
  #
 diff --git a/qemu-options.hx b/qemu-options.hx
-index fd21002bd6..83841e6703 100644
+index 83aa59a920..002ba697e9 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
-@@ -4015,6 +4015,18 @@ SRST
+@@ -4131,6 +4131,18 @@ SRST
      Start right away with a saved state (``loadvm`` in monitor)
  ERST
  
@@ -933,18 +933,18 @@ index fd21002bd6..83841e6703 100644
  DEF("daemonize", 0, QEMU_OPTION_daemonize, \
      "-daemonize      daemonize QEMU after initializing\n", QEMU_ARCH_ALL)
 diff --git a/softmmu/vl.c b/softmmu/vl.c
-index aadb526138..721196281c 100644
+index 5ca11e7469..220c67cd32 100644
 --- a/softmmu/vl.c
 +++ b/softmmu/vl.c
-@@ -145,6 +145,7 @@ static const char *cpu_option;
- static const char *mem_path;
- static const char *incoming;
+@@ -150,6 +150,7 @@ static const char *incoming;
  static const char *loadvm;
+ static const char *accelerators;
+ static QDict *machine_opts_dict;
 +static const char *loadstate;
  static QTAILQ_HEAD(, ObjectOption) object_opts = QTAILQ_HEAD_INITIALIZER(object_opts);
  static ram_addr_t maxram_size;
  static uint64_t ram_slots;
-@@ -2596,6 +2597,12 @@ void qmp_x_exit_preconfig(Error **errp)
+@@ -2700,6 +2701,12 @@ void qmp_x_exit_preconfig(Error **errp)
              autostart = 0;
              exit(1);
          }
@@ -957,7 +957,7 @@ index aadb526138..721196281c 100644
      }
      if (replay_mode != REPLAY_MODE_NONE) {
          replay_vmstate_init();
-@@ -3131,6 +3138,9 @@ void qemu_init(int argc, char **argv, char **envp)
+@@ -3238,6 +3245,9 @@ void qemu_init(int argc, char **argv, char **envp)
              case QEMU_OPTION_loadvm:
                  loadvm = optarg;
                  break;

debian/patches/pve/0017-PVE-add-optional-buffer-size-to-QEMUFile.patch

@@ -16,7 +16,7 @@ Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
  3 files changed, 28 insertions(+), 15 deletions(-)
 
 diff --git a/migration/qemu-file.c b/migration/qemu-file.c
-index d6e03dbc0e..1ac188c8e4 100644
+index 6338d8e2ff..6697a93a7e 100644
 --- a/migration/qemu-file.c
 +++ b/migration/qemu-file.c
 @@ -30,8 +30,8 @@
@@ -40,34 +40,34 @@ index d6e03dbc0e..1ac188c8e4 100644
  
      DECLARE_BITMAP(may_free, MAX_IOV_SIZE);
      struct iovec iov[MAX_IOV_SIZE];
-@@ -101,7 +102,7 @@ bool qemu_file_mode_is_not_valid(const char *mode)
+@@ -103,7 +104,7 @@ bool qemu_file_mode_is_not_valid(const char *mode)
      return false;
  }
  
--QEMUFile *qemu_fopen_ops(void *opaque, const QEMUFileOps *ops)
-+QEMUFile *qemu_fopen_ops_sized(void *opaque, const QEMUFileOps *ops, size_t buffer_size)
+-QEMUFile *qemu_fopen_ops(void *opaque, const QEMUFileOps *ops, bool has_ioc)
++QEMUFile *qemu_fopen_ops_sized(void *opaque, const QEMUFileOps *ops, bool has_ioc, size_t buffer_size)
  {
      QEMUFile *f;
  
-@@ -109,9 +110,17 @@ QEMUFile *qemu_fopen_ops(void *opaque, const QEMUFileOps *ops)
- 
+@@ -112,9 +113,17 @@ QEMUFile *qemu_fopen_ops(void *opaque, const QEMUFileOps *ops, bool has_ioc)
      f->opaque = opaque;
      f->ops = ops;
+     f->has_ioc = has_ioc;
 +    f->buf_allocated_size = buffer_size;
 +    f->buf = malloc(buffer_size);
 +
      return f;
  }
  
-+QEMUFile *qemu_fopen_ops(void *opaque, const QEMUFileOps *ops)
++QEMUFile *qemu_fopen_ops(void *opaque, const QEMUFileOps *ops, bool has_ioc)
 +{
-+    return qemu_fopen_ops_sized(opaque, ops, DEFAULT_IO_BUF_SIZE);
++    return qemu_fopen_ops_sized(opaque, ops, has_ioc, DEFAULT_IO_BUF_SIZE);
 +}
 +
  
  void qemu_file_set_hooks(QEMUFile *f, const QEMUFileHooks *hooks)
  {
-@@ -346,7 +355,7 @@ static ssize_t qemu_fill_buffer(QEMUFile *f)
+@@ -349,7 +358,7 @@ static ssize_t qemu_fill_buffer(QEMUFile *f)
      }
  
      len = f->ops->get_buffer(f->opaque, f->buf + pending, f->pos,
@@ -76,7 +76,7 @@ index d6e03dbc0e..1ac188c8e4 100644
      if (len > 0) {
          f->buf_size += len;
          f->pos += len;
-@@ -386,6 +395,9 @@ int qemu_fclose(QEMUFile *f)
+@@ -389,6 +398,9 @@ int qemu_fclose(QEMUFile *f)
              ret = ret2;
          }
      }
@@ -86,7 +86,7 @@ index d6e03dbc0e..1ac188c8e4 100644
      /* If any error was spotted before closing, we should report it
       * instead of the close() return value.
       */
-@@ -435,7 +447,7 @@ static void add_buf_to_iovec(QEMUFile *f, size_t len)
+@@ -443,7 +455,7 @@ static void add_buf_to_iovec(QEMUFile *f, size_t len)
  {
      if (!add_to_iovec(f, f->buf + f->buf_index, len, false)) {
          f->buf_index += len;
@@ -95,7 +95,7 @@ index d6e03dbc0e..1ac188c8e4 100644
              qemu_fflush(f);
          }
      }
-@@ -461,7 +473,7 @@ void qemu_put_buffer(QEMUFile *f, const uint8_t *buf, size_t size)
+@@ -469,7 +481,7 @@ void qemu_put_buffer(QEMUFile *f, const uint8_t *buf, size_t size)
      }
  
      while (size > 0) {
@@ -104,7 +104,7 @@ index d6e03dbc0e..1ac188c8e4 100644
          if (l > size) {
              l = size;
          }
-@@ -508,8 +520,8 @@ size_t qemu_peek_buffer(QEMUFile *f, uint8_t **buf, size_t size, size_t offset)
+@@ -516,8 +528,8 @@ size_t qemu_peek_buffer(QEMUFile *f, uint8_t **buf, size_t size, size_t offset)
      size_t index;
  
      assert(!qemu_file_is_writable(f));
@@ -115,7 +115,7 @@ index d6e03dbc0e..1ac188c8e4 100644
  
      /* The 1st byte to read from */
      index = f->buf_index + offset;
-@@ -559,7 +571,7 @@ size_t qemu_get_buffer(QEMUFile *f, uint8_t *buf, size_t size)
+@@ -567,7 +579,7 @@ size_t qemu_get_buffer(QEMUFile *f, uint8_t *buf, size_t size)
          size_t res;
          uint8_t *src;
  
@@ -124,7 +124,7 @@ index d6e03dbc0e..1ac188c8e4 100644
          if (res == 0) {
              return done;
          }
-@@ -593,7 +605,7 @@ size_t qemu_get_buffer(QEMUFile *f, uint8_t *buf, size_t size)
+@@ -601,7 +613,7 @@ size_t qemu_get_buffer(QEMUFile *f, uint8_t *buf, size_t size)
   */
  size_t qemu_get_buffer_in_place(QEMUFile *f, uint8_t **buf, size_t size)
  {
@@ -133,7 +133,7 @@ index d6e03dbc0e..1ac188c8e4 100644
          size_t res;
          uint8_t *src = NULL;
  
-@@ -618,7 +630,7 @@ int qemu_peek_byte(QEMUFile *f, int offset)
+@@ -626,7 +638,7 @@ int qemu_peek_byte(QEMUFile *f, int offset)
      int index = f->buf_index + offset;
  
      assert(!qemu_file_is_writable(f));
@@ -142,7 +142,7 @@ index d6e03dbc0e..1ac188c8e4 100644
  
      if (index >= f->buf_size) {
          qemu_fill_buffer(f);
-@@ -770,7 +782,7 @@ static int qemu_compress_data(z_stream *stream, uint8_t *dest, size_t dest_len,
+@@ -778,7 +790,7 @@ static int qemu_compress_data(z_stream *stream, uint8_t *dest, size_t dest_len,
  ssize_t qemu_put_compression_data(QEMUFile *f, z_stream *stream,
                                    const uint8_t *p, size_t size)
  {
@@ -152,19 +152,19 @@ index d6e03dbc0e..1ac188c8e4 100644
      if (blen < compressBound(size)) {
          return -1;
 diff --git a/migration/qemu-file.h b/migration/qemu-file.h
-index a9b6d6ccb7..8752d27c74 100644
+index 3f36d4dc8c..67501fd9cf 100644
 --- a/migration/qemu-file.h
 +++ b/migration/qemu-file.h
-@@ -120,6 +120,7 @@ typedef struct QEMUFileHooks {
+@@ -121,6 +121,7 @@ typedef struct QEMUFileHooks {
  } QEMUFileHooks;
  
- QEMUFile *qemu_fopen_ops(void *opaque, const QEMUFileOps *ops);
-+QEMUFile *qemu_fopen_ops_sized(void *opaque, const QEMUFileOps *ops, size_t buffer_size);
+ QEMUFile *qemu_fopen_ops(void *opaque, const QEMUFileOps *ops, bool has_ioc);
++QEMUFile *qemu_fopen_ops_sized(void *opaque, const QEMUFileOps *ops, bool has_ioc, size_t buffer_size);
  void qemu_file_set_hooks(QEMUFile *f, const QEMUFileHooks *hooks);
  int qemu_get_fd(QEMUFile *f);
  int qemu_fclose(QEMUFile *f);
 diff --git a/migration/savevm-async.c b/migration/savevm-async.c
-index 593a619088..cc2552d977 100644
+index 79a0cda906..970ee3b3fc 100644
 --- a/migration/savevm-async.c
 +++ b/migration/savevm-async.c
 @@ -418,7 +418,7 @@ void qmp_savevm_start(bool has_statefile, const char *statefile, Error **errp)
@@ -172,7 +172,7 @@ index 593a619088..cc2552d977 100644
      }
  
 -    snap_state.file = qemu_fopen_ops(&snap_state, &block_file_ops);
-+    snap_state.file = qemu_fopen_ops_sized(&snap_state, &block_file_ops, 4 * 1024 * 1024);
++    snap_state.file = qemu_fopen_ops_sized(&snap_state, &block_file_ops, false, 4 * 1024 * 1024);
  
      if (!snap_state.file) {
          error_set(errp, ERROR_CLASS_GENERIC_ERROR, "failed to open '%s'", statefile);
@@ -181,7 +181,7 @@ index 593a619088..cc2552d977 100644
  
      /* restore the VM state */
 -    f = qemu_fopen_ops(be, &loadstate_file_ops);
-+    f = qemu_fopen_ops_sized(be, &loadstate_file_ops, 4 * 1024 * 1024);
++    f = qemu_fopen_ops_sized(be, &loadstate_file_ops, false, 4 * 1024 * 1024);
      if (!f) {
          error_setg(errp, "Could not open VM state file");
          goto the_end;

debian/patches/pve/0018-PVE-block-add-the-zeroinit-block-driver-filter.patch

@@ -11,10 +11,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  create mode 100644 block/zeroinit.c
 
 diff --git a/block/meson.build b/block/meson.build
-index d21990ec95..cf9b278fa2 100644
+index 0450914c7a..7a0bc3df09 100644
 --- a/block/meson.build
 +++ b/block/meson.build
-@@ -40,6 +40,7 @@ block_ss.add(files(
+@@ -41,6 +41,7 @@ block_ss.add(files(
    'vmdk.c',
    'vpc.c',
    'write-threshold.c',

debian/patches/pve/0019-PVE-Add-dummy-id-command-line-parameter.patch

@@ -14,10 +14,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  2 files changed, 11 insertions(+)
 
 diff --git a/qemu-options.hx b/qemu-options.hx
-index 83841e6703..e70dd295d6 100644
+index 002ba697e9..a05959b9f1 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
-@@ -943,6 +943,9 @@ DEFHEADING()
+@@ -1005,6 +1005,9 @@ DEFHEADING()
  
  DEFHEADING(Block device options:)
  
@@ -28,10 +28,10 @@ index 83841e6703..e70dd295d6 100644
      "-fda/-fdb file  use 'file' as floppy disk 0/1 image\n", QEMU_ARCH_ALL)
  DEF("fdb", HAS_ARG, QEMU_OPTION_fdb, "", QEMU_ARCH_ALL)
 diff --git a/softmmu/vl.c b/softmmu/vl.c
-index 721196281c..12ec053422 100644
+index 220c67cd32..d87cf6e103 100644
 --- a/softmmu/vl.c
 +++ b/softmmu/vl.c
-@@ -2632,6 +2632,7 @@ void qemu_init(int argc, char **argv, char **envp)
+@@ -2736,6 +2736,7 @@ void qemu_init(int argc, char **argv, char **envp)
      MachineClass *machine_class;
      bool userconfig = true;
      FILE *vmstate_dump_file = NULL;
@@ -39,9 +39,9 @@ index 721196281c..12ec053422 100644
  
      qemu_add_opts(&qemu_drive_opts);
      qemu_add_drive_opts(&qemu_legacy_drive_opts);
-@@ -3253,6 +3254,13 @@ void qemu_init(int argc, char **argv, char **envp)
-                     exit(1);
-                 }
+@@ -3360,6 +3361,13 @@ void qemu_init(int argc, char **argv, char **envp)
+             case QEMU_OPTION_smp:
+                 machine_parse_property_opt(qemu_find_opts("smp-opts"), "smp", optarg, &error_fatal);
                  break;
 +            case QEMU_OPTION_id:
 +                vm_id = strtol(optarg, (char **)&optarg, 10);

debian/patches/pve/0020-PVE-Config-Revert-target-i386-disable-LINT0-after-re.patch

@@ -11,10 +11,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 9 insertions(+)
 
 diff --git a/hw/intc/apic_common.c b/hw/intc/apic_common.c
-index 97dd96dffa..15e5acd238 100644
+index 2a20982066..7968ad5a93 100644
 --- a/hw/intc/apic_common.c
 +++ b/hw/intc/apic_common.c
-@@ -279,6 +279,15 @@ static void apic_reset_common(DeviceState *dev)
+@@ -278,6 +278,15 @@ static void apic_reset_common(DeviceState *dev)
      info->vapic_base_update(s);
  
      apic_init_reset(dev);

debian/patches/pve/0021-PVE-Up-Config-file-posix-make-locking-optiono-on-cre.patch

@@ -13,10 +13,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  2 files changed, 42 insertions(+), 20 deletions(-)
 
 diff --git a/block/file-posix.c b/block/file-posix.c
-index 9242b76c04..316c5e34bb 100644
+index 1bbeb9e658..f28c5a3e52 100644
 --- a/block/file-posix.c
 +++ b/block/file-posix.c
-@@ -2401,6 +2401,7 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
+@@ -2443,6 +2443,7 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
      int fd;
      uint64_t perm, shared;
      int result = 0;
@@ -24,7 +24,7 @@ index 9242b76c04..316c5e34bb 100644
  
      /* Validate options and set default values */
      assert(options->driver == BLOCKDEV_DRIVER_FILE);
-@@ -2441,19 +2442,22 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
+@@ -2483,19 +2484,22 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
      perm = BLK_PERM_WRITE | BLK_PERM_RESIZE;
      shared = BLK_PERM_ALL & ~BLK_PERM_RESIZE;
  
@@ -59,7 +59,7 @@ index 9242b76c04..316c5e34bb 100644
      }
  
      /* Clear the file by truncating it to 0 */
-@@ -2507,13 +2511,15 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
+@@ -2549,13 +2553,15 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
      }
  
  out_unlock:
@@ -82,7 +82,7 @@ index 9242b76c04..316c5e34bb 100644
      }
  
  out_close:
-@@ -2538,6 +2544,7 @@ static int coroutine_fn raw_co_create_opts(BlockDriver *drv,
+@@ -2580,6 +2586,7 @@ static int coroutine_fn raw_co_create_opts(BlockDriver *drv,
      PreallocMode prealloc;
      char *buf = NULL;
      Error *local_err = NULL;
@@ -90,7 +90,7 @@ index 9242b76c04..316c5e34bb 100644
  
      /* Skip file: protocol prefix */
      strstart(filename, "file:", &filename);
-@@ -2560,6 +2567,18 @@ static int coroutine_fn raw_co_create_opts(BlockDriver *drv,
+@@ -2602,6 +2609,18 @@ static int coroutine_fn raw_co_create_opts(BlockDriver *drv,
          return -EINVAL;
      }
  
@@ -109,7 +109,7 @@ index 9242b76c04..316c5e34bb 100644
      options = (BlockdevCreateOptions) {
          .driver     = BLOCKDEV_DRIVER_FILE,
          .u.file     = {
-@@ -2571,6 +2590,8 @@ static int coroutine_fn raw_co_create_opts(BlockDriver *drv,
+@@ -2613,6 +2632,8 @@ static int coroutine_fn raw_co_create_opts(BlockDriver *drv,
              .nocow              = nocow,
              .has_extent_size_hint = has_extent_size_hint,
              .extent_size_hint   = extent_size_hint,
@@ -119,10 +119,10 @@ index 9242b76c04..316c5e34bb 100644
      };
      return raw_co_create(&options, errp);
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 4b6fb6ca44..46b14cdf67 100644
+index 6356a63695..fdfa579d00 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -4247,7 +4247,8 @@
+@@ -4341,7 +4341,8 @@
              'size':                 'size',
              '*preallocation':       'PreallocMode',
              '*nocow':               'bool',

debian/patches/pve/0023-PVE-Compat-4.0-used-balloon-qemu-4-0-config-size-fal.patch

@@ -26,10 +26,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/hw/core/machine.c b/hw/core/machine.c
-index 40def78183..30c24331b4 100644
+index 54e040587d..905fcdc03d 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
-@@ -96,7 +96,8 @@ GlobalProperty hw_compat_4_0[] = {
+@@ -106,7 +106,8 @@ GlobalProperty hw_compat_4_0[] = {
      { "virtio-vga",     "edid", "false" },
      { "virtio-gpu-device", "edid", "false" },
      { "virtio-device", "use-started", "false" },

debian/patches/pve/0024-PVE-Allow-version-code-in-machine-type.patch

@@ -14,14 +14,14 @@ Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
  hw/core/machine-qmp-cmds.c |  6 ++++++
  include/hw/boards.h        |  2 ++
  qapi/machine.json          |  4 +++-
- softmmu/vl.c               | 15 ++++++++++++++-
- 4 files changed, 25 insertions(+), 2 deletions(-)
+ softmmu/vl.c               | 23 +++++++++++++++++++++++
+ 4 files changed, 34 insertions(+), 1 deletion(-)
 
 diff --git a/hw/core/machine-qmp-cmds.c b/hw/core/machine-qmp-cmds.c
-index 76195de9e0..e622f65bca 100644
+index 8f8d5d5276..370e66d9cc 100644
 --- a/hw/core/machine-qmp-cmds.c
 +++ b/hw/core/machine-qmp-cmds.c
-@@ -104,6 +104,12 @@ MachineInfoList *qmp_query_machines(Error **errp)
+@@ -102,6 +102,12 @@ MachineInfoList *qmp_query_machines(Error **errp)
          if (strcmp(mc->name, MACHINE_GET_CLASS(current_machine)->name) == 0) {
              info->has_is_current = true;
              info->is_current = true;
@@ -35,10 +35,10 @@ index 76195de9e0..e622f65bca 100644
  
          if (mc->default_cpu_type) {
 diff --git a/include/hw/boards.h b/include/hw/boards.h
-index ad6c8fd537..00ee74c5eb 100644
+index accd6eff35..1b16728389 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
-@@ -206,6 +206,8 @@ struct MachineClass {
+@@ -205,6 +205,8 @@ struct MachineClass {
      const char *desc;
      const char *deprecation_reason;
  
@@ -48,7 +48,7 @@ index ad6c8fd537..00ee74c5eb 100644
      void (*reset)(MachineState *state);
      void (*wakeup)(MachineState *state);
 diff --git a/qapi/machine.json b/qapi/machine.json
-index 6e7e93d68f..7f5ba02c95 100644
+index cf120ac343..a6f483af4f 100644
 --- a/qapi/machine.json
 +++ b/qapi/machine.json
 @@ -160,6 +160,8 @@
@@ -70,40 +70,56 @@ index 6e7e93d68f..7f5ba02c95 100644
  ##
  # @query-machines:
 diff --git a/softmmu/vl.c b/softmmu/vl.c
-index 12ec053422..a3c7ef0ab4 100644
+index d87cf6e103..e5010236f3 100644
 --- a/softmmu/vl.c
 +++ b/softmmu/vl.c
-@@ -1537,6 +1537,8 @@ static MachineClass *machine_parse(const char *name, GSList *machines)
+@@ -1621,6 +1621,7 @@ static const QEMUOption *lookup_opt(int argc, char **argv,
+ static MachineClass *select_machine(QDict *qdict, Error **errp)
  {
-     MachineClass *mc;
-     GSList *el;
-+    size_t pvever_index = 0;
-+    gchar *name_clean;
- 
-     if (is_help_option(name)) {
-         printf("Supported machines are:\n");
-@@ -1553,12 +1555,23 @@ static MachineClass *machine_parse(const char *name, GSList *machines)
-         exit(0);
+     const char *optarg = qdict_get_try_str(qdict, "type");
++    const char *pvever = qdict_get_try_str(qdict, "pvever");
+     GSList *machines = object_class_get_list(TYPE_MACHINE, false);
+     MachineClass *machine_class;
+     Error *local_err = NULL;
+@@ -1638,6 +1639,11 @@ static MachineClass *select_machine(QDict *qdict, Error **errp)
+         }
      }
  
--    mc = find_machine(name, machines);
-+    // PVE version is specified with '+' as seperator, e.g. pc-i440fx+pvever
-+    pvever_index = strcspn(name, "+");
-+
-+    name_clean = g_strndup(name, pvever_index);
-+    mc = find_machine(name_clean, machines);
-+    g_free(name_clean);
-+
-     if (!mc) {
-         error_report("unsupported machine type");
-         error_printf("Use -machine help to list supported machines\n");
-         exit(1);
-     }
-+
-+    if (pvever_index < strlen(name)) {
-+        mc->pve_version = &name[pvever_index+1];
++    if (machine_class) {
++        machine_class->pve_version = g_strdup(pvever);
++        qdict_del(qdict, "pvever");
 +    }
 +
-     return mc;
- }
+     g_slist_free(machines);
+     if (local_err) {
+         error_append_hint(&local_err, "Use -machine help to list supported machines\n");
+@@ -3312,12 +3318,29 @@ void qemu_init(int argc, char **argv, char **envp)
+             case QEMU_OPTION_machine:
+                 {
+                     bool help;
++                    size_t pvever_index, name_len;
++                    const gchar *name;
++                    gchar *name_clean, *pvever;
  
+                     keyval_parse_into(machine_opts_dict, optarg, "type", &help, &error_fatal);
+                     if (help) {
+                         machine_help_func(machine_opts_dict);
+                         exit(EXIT_SUCCESS);
+                     }
++
++                    // PVE version is specified with '+' as seperator, e.g. pc-i440fx+pvever
++                    name = qdict_get_try_str(machine_opts_dict, "type");
++                    name_len = strlen(name);
++                    pvever_index = strcspn(name, "+");
++                    if (pvever_index < name_len) {
++                        name_clean = g_strndup(name, pvever_index);
++                        pvever = g_strndup(name + pvever_index + 1, name_len - pvever_index - 1);
++                        qdict_put_str(machine_opts_dict, "pvever", pvever);
++                        qdict_put_str(machine_opts_dict, "type", name_clean);
++                        g_free(name_clean);
++                        g_free(pvever);
++                    }
++
+                     break;
+                 }
+             case QEMU_OPTION_accel:

debian/patches/pve/0025-PVE-Backup-add-vma-backup-format-code.patch

@@ -17,10 +17,10 @@ Subject: [PATCH] PVE-Backup: add vma backup format code
  create mode 100644 vma.h
 
 diff --git a/block/meson.build b/block/meson.build
-index cf9b278fa2..d0a8397edf 100644
+index 7a0bc3df09..9ce9246194 100644
 --- a/block/meson.build
 +++ b/block/meson.build
-@@ -43,6 +43,8 @@ block_ss.add(files(
+@@ -44,6 +44,8 @@ block_ss.add(files(
    'zeroinit.c',
  ), zstd, zlib, gnutls)
  
@@ -30,10 +30,10 @@ index cf9b278fa2..d0a8397edf 100644
  
  block_ss.add(when: 'CONFIG_QCOW1', if_true: files('qcow.c'))
 diff --git a/meson.build b/meson.build
-index c6f4b0cf5e..7db08406bd 100644
+index b3e7ec0e92..b84f62f882 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -945,6 +945,8 @@ keyutils = dependency('libkeyutils', required: false,
+@@ -1064,6 +1064,8 @@ keyutils = dependency('libkeyutils', required: false,
  
  has_gettid = cc.has_function('gettid')
  
@@ -42,7 +42,7 @@ index c6f4b0cf5e..7db08406bd 100644
  # Malloc tests
  
  malloc = []
-@@ -2344,6 +2346,9 @@ if have_tools
+@@ -2743,6 +2745,9 @@ if have_tools
    qemu_nbd = executable('qemu-nbd', files('qemu-nbd.c'),
                 dependencies: [blockdev, qemuutil, gnutls], install: true)
  

debian/patches/pve/0026-PVE-Backup-add-backup-dump-block-driver.patch

@@ -191,7 +191,7 @@ index 0000000000..93d7f46950
 +    return bs;
 +}
 diff --git a/block/backup.c b/block/backup.c
-index 6cf2f974aa..8c865a43a8 100644
+index bd3614ce70..8bae9b060e 100644
 --- a/block/backup.c
 +++ b/block/backup.c
 @@ -31,28 +31,6 @@
@@ -241,7 +241,7 @@ index 6cf2f974aa..8c865a43a8 100644
       * If source is in backing chain of target assume that target is going to be
       * used for "image fleecing", i.e. it should represent a kind of snapshot of
 diff --git a/block/meson.build b/block/meson.build
-index d0a8397edf..12797a5ca3 100644
+index 9ce9246194..19bc2b7cbb 100644
 --- a/block/meson.build
 +++ b/block/meson.build
 @@ -4,6 +4,7 @@ block_ss.add(files(
@@ -253,7 +253,7 @@ index d0a8397edf..12797a5ca3 100644
    'blkdebug.c',
    'blklogwrites.c',
 diff --git a/include/block/block_int.h b/include/block/block_int.h
-index 1c399bdb16..bd88198792 100644
+index 3e625a4261..4bd5fdb191 100644
 --- a/include/block/block_int.h
 +++ b/include/block/block_int.h
 @@ -26,6 +26,7 @@
@@ -306,7 +306,7 @@ index 1c399bdb16..bd88198792 100644
      BDRV_TRACKED_READ,
      BDRV_TRACKED_WRITE,
 diff --git a/job.c b/job.c
-index 4aff13d95a..3999b7728c 100644
+index e7a5d28854..44eec9a441 100644
 --- a/job.c
 +++ b/job.c
 @@ -269,7 +269,8 @@ static bool job_started(Job *job)

debian/patches/pve/0027-PVE-Backup-proxmox-backup-patches-for-qemu.patch

@@ -10,7 +10,7 @@ Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
  block/meson.build              |   5 +
  block/monitor/block-hmp-cmds.c |  33 ++
  blockdev.c                     |   1 +
- hmp-commands-info.hx           |  13 +
+ hmp-commands-info.hx           |  14 +
  hmp-commands.hx                |  29 +
  include/block/block_int.h      |   2 +-
  include/monitor/hmp.h          |   3 +
@@ -22,16 +22,16 @@ Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
  qapi/block-core.json           | 109 ++++
  qapi/common.json               |  13 +
  qapi/machine.json              |  15 +-
- 15 files changed, 1448 insertions(+), 14 deletions(-)
+ 15 files changed, 1449 insertions(+), 14 deletions(-)
  create mode 100644 proxmox-backup-client.c
  create mode 100644 proxmox-backup-client.h
  create mode 100644 pve-backup.c
 
 diff --git a/block/meson.build b/block/meson.build
-index 12797a5ca3..500d2bf5b3 100644
+index 19bc2b7cbb..9e433daf2e 100644
 --- a/block/meson.build
 +++ b/block/meson.build
-@@ -45,6 +45,11 @@ block_ss.add(files(
+@@ -46,6 +46,11 @@ block_ss.add(files(
  ), zstd, zlib, gnutls)
  
  block_ss.add(files('../vma-writer.c'), libuuid)
@@ -44,10 +44,10 @@ index 12797a5ca3..500d2bf5b3 100644
  softmmu_ss.add(when: 'CONFIG_TCG', if_true: files('blkreplay.c'))
  
 diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
-index ebf1033f31..fc71740026 100644
+index 3e6670c963..1e29681d30 100644
 --- a/block/monitor/block-hmp-cmds.c
 +++ b/block/monitor/block-hmp-cmds.c
-@@ -1004,3 +1004,36 @@ void hmp_info_snapshots(Monitor *mon, const QDict *qdict)
+@@ -1015,3 +1015,36 @@ void hmp_info_snapshots(Monitor *mon, const QDict *qdict)
      g_free(sn_tab);
      g_free(global_snapshots);
  }
@@ -85,7 +85,7 @@ index ebf1033f31..fc71740026 100644
 +    hmp_handle_error(mon, error);
 +}
 diff --git a/blockdev.c b/blockdev.c
-index 9cab29e567..5c23744346 100644
+index b6f797b41f..84e9b898be 100644
 --- a/blockdev.c
 +++ b/blockdev.c
 @@ -36,6 +36,7 @@
@@ -97,13 +97,14 @@ index 9cab29e567..5c23744346 100644
  #include "monitor/monitor.h"
  #include "qemu/error-report.h"
 diff --git a/hmp-commands-info.hx b/hmp-commands-info.hx
-index c72db5f666..be4d252b8e 100644
+index e6dd3be07a..15ddecada1 100644
 --- a/hmp-commands-info.hx
 +++ b/hmp-commands-info.hx
-@@ -513,6 +513,19 @@ SRST
-     Show CPU statistics.
+@@ -497,6 +497,20 @@ SRST
+     Show the current VM UUID.
  ERST
  
++
 +    {
 +        .name       = "backup",
 +        .args_type  = "",
@@ -121,7 +122,7 @@ index c72db5f666..be4d252b8e 100644
      {
          .name       = "usernet",
 diff --git a/hmp-commands.hx b/hmp-commands.hx
-index 0b9d526937..a7bd174e5a 100644
+index 96bd7e00bd..b18063ce19 100644
 --- a/hmp-commands.hx
 +++ b/hmp-commands.hx
 @@ -99,6 +99,35 @@ ERST
@@ -161,7 +162,7 @@ index 0b9d526937..a7bd174e5a 100644
  
      {
 diff --git a/include/block/block_int.h b/include/block/block_int.h
-index bd88198792..03eec075e1 100644
+index 4bd5fdb191..10452dd50b 100644
 --- a/include/block/block_int.h
 +++ b/include/block/block_int.h
 @@ -66,7 +66,7 @@
@@ -174,7 +175,7 @@ index bd88198792..03eec075e1 100644
      uint64_t byte_size,
      BackupDumpFunc *dump_cb,
 diff --git a/include/monitor/hmp.h b/include/monitor/hmp.h
-index e287e071d8..1468530adf 100644
+index 1247d7362a..8d3df46c93 100644
 --- a/include/monitor/hmp.h
 +++ b/include/monitor/hmp.h
 @@ -29,6 +29,7 @@ void hmp_info_savevm(Monitor *mon, const QDict *qdict);
@@ -195,10 +196,10 @@ index e287e071d8..1468530adf 100644
  void hmp_device_add(Monitor *mon, const QDict *qdict);
  void hmp_device_del(Monitor *mon, const QDict *qdict);
 diff --git a/meson.build b/meson.build
-index 7db08406bd..b4a0f7d314 100644
+index b84f62f882..c05c926cc3 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -946,6 +946,7 @@ keyutils = dependency('libkeyutils', required: false,
+@@ -1065,6 +1065,7 @@ keyutils = dependency('libkeyutils', required: false,
  has_gettid = cc.has_function('gettid')
  
  libuuid = cc.find_library('uuid', required: true)
@@ -207,7 +208,7 @@ index 7db08406bd..b4a0f7d314 100644
  # Malloc tests
  
 diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
-index 948c9d9ff8..65f9148118 100644
+index 42a1eaf370..55033530fb 100644
 --- a/monitor/hmp-cmds.c
 +++ b/monitor/hmp-cmds.c
 @@ -195,6 +195,50 @@ void hmp_info_mice(Monitor *mon, const QDict *qdict)
@@ -1474,10 +1475,10 @@ index 0000000000..66868dec14
 +    return info;
 +}
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 46b14cdf67..890fc9dede 100644
+index fdfa579d00..c5d604693f 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -683,6 +683,115 @@
+@@ -699,6 +699,115 @@
  { 'command': 'query-block', 'returns': ['BlockInfo'] }
  
  
@@ -1615,7 +1616,7 @@ index 7c976296f0..0690b07903 100644
 +##
 +{ 'struct': 'UuidInfo', 'data': {'UUID': 'str'} }
 diff --git a/qapi/machine.json b/qapi/machine.json
-index 7f5ba02c95..9923098e40 100644
+index a6f483af4f..6effa7ad30 100644
 --- a/qapi/machine.json
 +++ b/qapi/machine.json
 @@ -4,6 +4,8 @@

debian/patches/pve/0028-PVE-Backup-pbs-restore-new-command-to-restore-from-p.patch

@@ -12,10 +12,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  create mode 100644 pbs-restore.c
 
 diff --git a/meson.build b/meson.build
-index b4a0f7d314..3287cd8a6d 100644
+index c05c926cc3..69a0fe80ef 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -2350,6 +2350,10 @@ if have_tools
+@@ -2749,6 +2749,10 @@ if have_tools
    vma = executable('vma', files('vma.c', 'vma-reader.c'),
                     dependencies: [authz, block, crypto, io, qom], install: true)
  

debian/patches/pve/0029-PVE-Backup-Add-dirty-bitmap-tracking-for-incremental.patch

@@ -29,10 +29,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  6 files changed, 142 insertions(+), 23 deletions(-)
 
 diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
-index fc71740026..da5043b973 100644
+index 1e29681d30..3fca3ce3e9 100644
 --- a/block/monitor/block-hmp-cmds.c
 +++ b/block/monitor/block-hmp-cmds.c
-@@ -1031,6 +1031,7 @@ void hmp_backup(Monitor *mon, const QDict *qdict)
+@@ -1042,6 +1042,7 @@ void hmp_backup(Monitor *mon, const QDict *qdict)
          false, NULL, // PBS fingerprint
          false, NULL, // PBS backup-id
          false, 0, // PBS backup-time
@@ -41,7 +41,7 @@ index fc71740026..da5043b973 100644
          false, NULL, false, NULL, !!devlist,
          devlist, qdict_haskey(qdict, "speed"), speed, &error);
 diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
-index 65f9148118..a6a289968f 100644
+index 55033530fb..27d35ab91b 100644
 --- a/monitor/hmp-cmds.c
 +++ b/monitor/hmp-cmds.c
 @@ -221,19 +221,42 @@ void hmp_info_backup(Monitor *mon, const QDict *qdict)
@@ -405,10 +405,10 @@ index 66868dec14..6cdbd40529 100644
      qemu_mutex_unlock(&backup_state.stat.lock);
  
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 890fc9dede..eb1e851606 100644
+index c5d604693f..a138ad08d4 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -696,8 +696,13 @@
+@@ -712,8 +712,13 @@
  #
  # @total: total amount of bytes involved in the backup process
  #
@@ -422,7 +422,7 @@ index 890fc9dede..eb1e851606 100644
  # @zero-bytes: amount of 'zero' bytes detected.
  #
  # @start-time: time (epoch) when backup job started.
-@@ -710,8 +715,8 @@
+@@ -726,8 +731,8 @@
  #
  ##
  { 'struct': 'BackupStatus',
@@ -433,7 +433,7 @@ index 890fc9dede..eb1e851606 100644
             '*start-time': 'int', '*end-time': 'int',
             '*backup-file': 'str', '*uuid': 'str' } }
  
-@@ -754,6 +759,8 @@
+@@ -770,6 +775,8 @@
  #
  # @backup-time: backup timestamp (Unix epoch, required for format 'pbs')
  #
@@ -442,7 +442,7 @@ index 890fc9dede..eb1e851606 100644
  # Returns: the uuid of the backup job
  #
  ##
-@@ -764,6 +771,7 @@
+@@ -780,6 +787,7 @@
                                      '*fingerprint': 'str',
                                      '*backup-id': 'str',
                                      '*backup-time': 'int',

debian/patches/pve/0030-PVE-various-PBS-fixes.patch

@@ -18,10 +18,10 @@ Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
  3 files changed, 54 insertions(+), 13 deletions(-)
 
 diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
-index da5043b973..f509959a32 100644
+index 3fca3ce3e9..69254396d5 100644
 --- a/block/monitor/block-hmp-cmds.c
 +++ b/block/monitor/block-hmp-cmds.c
-@@ -1031,7 +1031,9 @@ void hmp_backup(Monitor *mon, const QDict *qdict)
+@@ -1042,7 +1042,9 @@ void hmp_backup(Monitor *mon, const QDict *qdict)
          false, NULL, // PBS fingerprint
          false, NULL, // PBS backup-id
          false, 0, // PBS backup-time
@@ -193,10 +193,10 @@ index 6cdbd40529..7527885251 100644
          .format = format,
          .has_config_file = has_config_file,
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index eb1e851606..8845742870 100644
+index a138ad08d4..a75f1b4687 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -761,6 +761,10 @@
+@@ -777,6 +777,10 @@
  #
  # @use-dirty-bitmap: use dirty bitmap to detect incremental changes since last job (optional for format 'pbs')
  #
@@ -207,7 +207,7 @@ index eb1e851606..8845742870 100644
  # Returns: the uuid of the backup job
  #
  ##
-@@ -772,6 +776,8 @@
+@@ -788,6 +792,8 @@
                                      '*backup-id': 'str',
                                      '*backup-time': 'int',
                                      '*use-dirty-bitmap': 'bool',

debian/patches/pve/0031-PVE-Add-PBS-block-driver-to-map-backup-archives-into.patch

@@ -11,15 +11,15 @@ Signed-off-by: Dietmar Maurer <dietmar@proxmox.com>
  block/pbs.c          | 271 +++++++++++++++++++++++++++++++++++++++++++
  configure            |   9 ++
  meson.build          |   1 +
- qapi/block-core.json |  14 ++-
- 5 files changed, 297 insertions(+), 1 deletion(-)
+ qapi/block-core.json |  13 +++
+ 5 files changed, 297 insertions(+)
  create mode 100644 block/pbs.c
 
 diff --git a/block/meson.build b/block/meson.build
-index 500d2bf5b3..574165e577 100644
+index 9e433daf2e..e3ed5ac97c 100644
 --- a/block/meson.build
 +++ b/block/meson.build
-@@ -50,6 +50,9 @@ block_ss.add(files(
+@@ -51,6 +51,9 @@ block_ss.add(files(
    '../pve-backup.c',
  ), libproxmox_backup_qemu)
  
@@ -307,20 +307,20 @@ index 0000000000..78dad0dcc4
 +
 +block_init(bdrv_pbs_init);
 diff --git a/configure b/configure
-index 4f374b4889..0f44d77455 100755
+index 9a79a004d7..7cb181b61a 100755
 --- a/configure
 +++ b/configure
-@@ -447,6 +447,7 @@ vvfat=${default_feature:-yes}
+@@ -428,6 +428,7 @@ vdi=${default_feature:-yes}
+ vvfat=${default_feature:-yes}
  qed=${default_feature:-yes}
  parallels=${default_feature:-yes}
- sheepdog="no"
 +pbs_bdrv="yes"
- libxml2="$default_feature"
+ libxml2="auto"
  debug_mutex="no"
- libpmem="$default_feature"
-@@ -1478,6 +1479,10 @@ for opt do
+ libpmem="auto"
+@@ -1486,6 +1487,10 @@ for opt do
    ;;
-   --enable-sheepdog) sheepdog="yes"
+   --enable-parallels) parallels="yes"
    ;;
 +  --disable-pbs-bdrv) pbs_bdrv="no"
 +  ;;
@@ -329,50 +329,49 @@ index 4f374b4889..0f44d77455 100755
    --disable-vhost-user) vhost_user="no"
    ;;
    --enable-vhost-user) vhost_user="yes"
-@@ -1908,6 +1913,7 @@ disabled with --disable-FEATURE, default is enabled if available
+@@ -1956,6 +1961,7 @@ disabled with --disable-FEATURE, default is enabled if available
+   vvfat           vvfat image format support
    qed             qed image format support
    parallels       parallels image format support
-   sheepdog        sheepdog block driver support (deprecated)
 +  pbs-bdrv        Proxmox backup server read-only block driver support
    crypto-afalg    Linux AF_ALG crypto backend driver
    capstone        capstone disassembler support
    debug-mutex     mutex debugging support
-@@ -6077,6 +6083,9 @@ if test "$sheepdog" = "yes" ; then
-   add_to deprecated_features "sheepdog"
-   echo "CONFIG_SHEEPDOG=y" >> $config_host_mak
+@@ -4622,6 +4628,9 @@ fi
+ if test "$linux_aio" = "yes" ; then
+   echo "CONFIG_LINUX_AIO=y" >> $config_host_mak
  fi
 +if test "$pbs_bdrv" = "yes" ; then
 +  echo "CONFIG_PBS_BDRV=y" >> $config_host_mak
 +fi
- if test "$have_mlockall" = "yes" ; then
-   echo "HAVE_MLOCKALL=y" >> $config_host_mak
+ if test "$vhost_scsi" = "yes" ; then
+   echo "CONFIG_VHOST_SCSI=y" >> $config_host_mak
  fi
 diff --git a/meson.build b/meson.build
-index 3287cd8a6d..b77b4cd017 100644
+index 69a0fe80ef..3faec72a80 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -2719,6 +2719,7 @@ summary_info += {'lzfse support':     liblzfse.found()}
+@@ -3111,6 +3111,7 @@ summary_info += {'lzfse support':     liblzfse.found()}
  summary_info += {'zstd support':      zstd.found()}
  summary_info += {'NUMA host support': config_host.has_key('CONFIG_NUMA')}
- summary_info += {'libxml2':           config_host.has_key('CONFIG_LIBXML2')}
+ summary_info += {'libxml2':           libxml2.found()}
 +summary_info += {'PBS bdrv support':  config_host.has_key('CONFIG_PBS_BDRV')}
  summary_info += {'capstone':          capstone_opt == 'disabled' ? false : capstone_opt}
- summary_info += {'libpmem support':   config_host.has_key('CONFIG_LIBPMEM')}
- summary_info += {'libdaxctl support': config_host.has_key('CONFIG_LIBDAXCTL')}
+ summary_info += {'libpmem support':   libpmem.found()}
+ summary_info += {'libdaxctl support': libdaxctl.found()}
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 8845742870..db11dd6aae 100644
+index a75f1b4687..e4d0c923a4 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -2962,7 +2962,7 @@
+@@ -2982,6 +2982,7 @@
              'luks', 'nbd', 'nfs', 'null-aio', 'null-co', 'nvme', 'parallels',
              'preallocate', 'qcow', 'qcow2', 'qed', 'quorum', 'raw', 'rbd',
              { 'name': 'replication', 'if': 'defined(CONFIG_REPLICATION)' },
--            'sheepdog',
-+            'sheepdog', 'pbs',
++            'pbs',
              'ssh', 'throttle', 'vdi', 'vhdx', 'vmdk', 'vpc', 'vvfat' ] }
  
  ##
-@@ -3026,6 +3026,17 @@
+@@ -3045,6 +3046,17 @@
  { 'struct': 'BlockdevOptionsNull',
    'data': { '*size': 'int', '*latency-ns': 'uint64', '*read-zeroes': 'bool' } }
  
@@ -390,7 +389,7 @@ index 8845742870..db11dd6aae 100644
  ##
  # @BlockdevOptionsNVMe:
  #
-@@ -4170,6 +4181,7 @@
+@@ -4263,6 +4275,7 @@
        'nfs':        'BlockdevOptionsNfs',
        'null-aio':   'BlockdevOptionsNull',
        'null-co':    'BlockdevOptionsNull',

debian/patches/pve/0032-PVE-add-query_proxmox_support-QMP-command.patch

@@ -33,10 +33,10 @@ index 7527885251..8cba8e97d3 100644
 +    return ret;
 +}
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index db11dd6aae..79aef65616 100644
+index e4d0c923a4..3eebe7ff71 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -806,6 +806,35 @@
+@@ -822,6 +822,35 @@
  ##
  { 'command': 'backup-cancel' }
  

debian/patches/pve/0033-PVE-add-query-pbs-bitmap-info-QMP-call.patch

@@ -14,7 +14,7 @@ Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
  3 files changed, 159 insertions(+), 42 deletions(-)
 
 diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
-index a6a289968f..f7a211e5a4 100644
+index 27d35ab91b..4fe2bbb26d 100644
 --- a/monitor/hmp-cmds.c
 +++ b/monitor/hmp-cmds.c
 @@ -198,6 +198,7 @@ void hmp_info_mice(Monitor *mon, const QDict *qdict)
@@ -358,10 +358,10 @@ index 8cba8e97d3..22420db26a 100644
      return ret;
  }
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 79aef65616..808ec6027e 100644
+index 3eebe7ff71..170c13984d 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -814,6 +814,8 @@
+@@ -830,6 +830,8 @@
  # @pbs-dirty-bitmap: True if dirty-bitmap-incremental backups to PBS are
  #                    supported.
  #
@@ -370,7 +370,7 @@ index 79aef65616..808ec6027e 100644
  # @pbs-dirty-bitmap-savevm: True if 'dirty-bitmaps' migration capability can
  #                           safely be set for savevm-async.
  #
-@@ -822,6 +824,7 @@
+@@ -838,6 +840,7 @@
  ##
  { 'struct': 'ProxmoxSupportStatus',
    'data': { 'pbs-dirty-bitmap': 'bool',
@@ -378,7 +378,7 @@ index 79aef65616..808ec6027e 100644
              'pbs-dirty-bitmap-savevm': 'bool',
              'pbs-library-version': 'str' } }
  
-@@ -835,6 +838,59 @@
+@@ -851,6 +854,59 @@
  ##
  { 'command': 'query-proxmox-support', 'returns': 'ProxmoxSupportStatus' }
  

debian/patches/pve/0034-PVE-redirect-stderr-to-journal-when-daemonized.patch

@@ -13,10 +13,10 @@ Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
  2 files changed, 7 insertions(+), 2 deletions(-)
 
 diff --git a/meson.build b/meson.build
-index b77b4cd017..f2ecd82ad5 100644
+index 3faec72a80..bae9ebe0c0 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -946,6 +946,7 @@ keyutils = dependency('libkeyutils', required: false,
+@@ -1065,6 +1065,7 @@ keyutils = dependency('libkeyutils', required: false,
  has_gettid = cc.has_function('gettid')
  
  libuuid = cc.find_library('uuid', required: true)
@@ -24,7 +24,7 @@ index b77b4cd017..f2ecd82ad5 100644
  libproxmox_backup_qemu = cc.find_library('proxmox_backup_qemu', required: true)
  
  # Malloc tests
-@@ -1927,6 +1928,7 @@ if have_block
+@@ -2246,6 +2247,7 @@ if have_block
    # os-posix.c contains POSIX-specific functions used by qemu-storage-daemon,
    # os-win32.c does not
    blockdev_ss.add(when: 'CONFIG_POSIX', if_true: files('os-posix.c'))
@@ -33,7 +33,7 @@ index b77b4cd017..f2ecd82ad5 100644
  endif
  
 diff --git a/os-posix.c b/os-posix.c
-index a6846f51c1..5ce5eaf3a6 100644
+index ae6c9f2a5e..36807806bf 100644
 --- a/os-posix.c
 +++ b/os-posix.c
 @@ -28,6 +28,8 @@

debian/patches/pve/0035-PVE-Add-sequential-job-transaction-support.patch

@@ -10,7 +10,7 @@ Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
  2 files changed, 43 insertions(+)
 
 diff --git a/include/qemu/job.h b/include/qemu/job.h
-index efc6fa7544..942ee43bca 100644
+index 41162ed494..6662c63519 100644
 --- a/include/qemu/job.h
 +++ b/include/qemu/job.h
 @@ -285,6 +285,18 @@ typedef enum JobCreateFlags {
@@ -33,7 +33,7 @@ index efc6fa7544..942ee43bca 100644
   * Release a reference that was previously acquired with job_txn_add_job or
   * job_txn_new. If it's the last reference to the object, it will be freed.
 diff --git a/job.c b/job.c
-index 3999b7728c..3ae018cdad 100644
+index 44eec9a441..a0753ff2f1 100644
 --- a/job.c
 +++ b/job.c
 @@ -72,6 +72,8 @@ struct JobTxn {
@@ -71,7 +71,7 @@ index 3999b7728c..3ae018cdad 100644
  static void job_txn_ref(JobTxn *txn)
  {
      txn->refcnt++;
-@@ -847,6 +868,9 @@ static void job_completed_txn_success(Job *job)
+@@ -850,6 +871,9 @@ static void job_completed_txn_success(Job *job)
       */
      QLIST_FOREACH(other_job, &txn->jobs, txn_list) {
          if (!job_is_completed(other_job)) {
@@ -81,7 +81,7 @@ index 3999b7728c..3ae018cdad 100644
              return;
          }
          assert(other_job->ret == 0);
-@@ -1017,6 +1041,13 @@ int job_finish_sync(Job *job, void (*finish)(Job *, Error **errp), Error **errp)
+@@ -1020,6 +1044,13 @@ int job_finish_sync(Job *job, void (*finish)(Job *, Error **errp), Error **errp)
          return -EBUSY;
      }
  

debian/patches/pve/0037-PVE-Backup-Don-t-block-on-finishing-and-cleanup-crea.patch

@@ -478,10 +478,10 @@ index 2e628d68e4..9c20ef3a5e 100644
      qemu_mutex_unlock(&backup_state.stat.lock);
  
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 808ec6027e..710b8dfb2d 100644
+index 170c13984d..a0d1d278e9 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -713,12 +713,15 @@
+@@ -729,12 +729,15 @@
  #
  # @uuid: uuid for this backup job
  #

debian/patches/pve/0038-PVE-Migrate-dirty-bitmap-state-via-savevm.patch

@@ -23,10 +23,10 @@ Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
  create mode 100644 migration/pbs-state.c
 
 diff --git a/include/migration/misc.h b/include/migration/misc.h
-index 738675ef52..2b89db4b8e 100644
+index 465906710d..4f0aeceb6f 100644
 --- a/include/migration/misc.h
 +++ b/include/migration/misc.h
-@@ -76,4 +76,7 @@ bool migration_in_bg_snapshot(void);
+@@ -75,4 +75,7 @@ bool migration_in_bg_snapshot(void);
  /* migration/block-dirty-bitmap.c */
  void dirty_bitmap_mig_init(void);
  
@@ -35,7 +35,7 @@ index 738675ef52..2b89db4b8e 100644
 +
  #endif
 diff --git a/migration/meson.build b/migration/meson.build
-index c8ae813a48..49108c79ef 100644
+index ea9aedeefc..c27dc9bd97 100644
 --- a/migration/meson.build
 +++ b/migration/meson.build
 @@ -7,8 +7,10 @@ migration_files = files(
@@ -50,17 +50,17 @@ index c8ae813a48..49108c79ef 100644
  softmmu_ss.add(files(
    'block-dirty-bitmap.c',
 diff --git a/migration/migration.c b/migration/migration.c
-index 8ca034136b..a5ce875685 100644
+index 041b8451a6..9df2eed75e 100644
 --- a/migration/migration.c
 +++ b/migration/migration.c
-@@ -221,6 +221,7 @@ void migration_object_init(void)
+@@ -218,6 +218,7 @@ void migration_object_init(void)
      blk_mig_init();
      ram_mig_init();
      dirty_bitmap_mig_init();
 +    pbs_state_mig_init();
  }
  
- void migration_shutdown(void)
+ void migration_cancel(void)
 diff --git a/migration/pbs-state.c b/migration/pbs-state.c
 new file mode 100644
 index 0000000000..29f2b3860d
@@ -186,10 +186,10 @@ index 9c20ef3a5e..59ccb38ceb 100644
      return ret;
  }
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 710b8dfb2d..cf3cbf2a56 100644
+index a0d1d278e9..e5de769dc1 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -822,6 +822,11 @@
+@@ -838,6 +838,11 @@
  # @pbs-dirty-bitmap-savevm: True if 'dirty-bitmaps' migration capability can
  #                           safely be set for savevm-async.
  #
@@ -201,7 +201,7 @@ index 710b8dfb2d..cf3cbf2a56 100644
  # @pbs-library-version: Running version of libproxmox-backup-qemu0 library.
  #
  ##
-@@ -829,6 +834,7 @@
+@@ -845,6 +850,7 @@
    'data': { 'pbs-dirty-bitmap': 'bool',
              'query-bitmap-info': 'bool',
              'pbs-dirty-bitmap-savevm': 'bool',

debian/patches/pve/0041-PVE-Use-coroutine-QMP-for-backup-cancel_backup.patch

@@ -31,10 +31,10 @@ Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
  5 files changed, 77 insertions(+), 196 deletions(-)
 
 diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
-index f509959a32..89336d93ef 100644
+index 69254396d5..b838586fc0 100644
 --- a/block/monitor/block-hmp-cmds.c
 +++ b/block/monitor/block-hmp-cmds.c
-@@ -1005,7 +1005,7 @@ void hmp_info_snapshots(Monitor *mon, const QDict *qdict)
+@@ -1016,7 +1016,7 @@ void hmp_info_snapshots(Monitor *mon, const QDict *qdict)
      g_free(global_snapshots);
  }
  
@@ -43,7 +43,7 @@ index f509959a32..89336d93ef 100644
  {
      Error *error = NULL;
  
-@@ -1014,7 +1014,7 @@ void hmp_backup_cancel(Monitor *mon, const QDict *qdict)
+@@ -1025,7 +1025,7 @@ void hmp_backup_cancel(Monitor *mon, const QDict *qdict)
      hmp_handle_error(mon, error);
  }
  
@@ -53,7 +53,7 @@ index f509959a32..89336d93ef 100644
      Error *error = NULL;
  
 diff --git a/hmp-commands.hx b/hmp-commands.hx
-index a7bd174e5a..e01ca13ca8 100644
+index b18063ce19..02c8f83ca3 100644
 --- a/hmp-commands.hx
 +++ b/hmp-commands.hx
 @@ -109,6 +109,7 @@ ERST
@@ -574,10 +574,10 @@ index 59ccb38ceb..f858003a06 100644
  
  BackupStatus *qmp_query_backup(Error **errp)
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index cf3cbf2a56..7b6e79df9f 100644
+index e5de769dc1..afa67c28d2 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -785,7 +785,7 @@
+@@ -801,7 +801,7 @@
                                      '*config-file': 'str',
                                      '*firewall-file': 'str',
                                      '*devlist': 'str', '*speed': 'int' },
@@ -586,7 +586,7 @@ index cf3cbf2a56..7b6e79df9f 100644
  
  ##
  # @query-backup:
-@@ -807,7 +807,7 @@
+@@ -823,7 +823,7 @@
  # Notes: This command succeeds even if there is no backup process running.
  #
  ##

debian/patches/pve/0042-PBS-add-master-key-support.patch

@@ -18,10 +18,10 @@ Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
  3 files changed, 11 insertions(+)
 
 diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
-index 89336d93ef..b9e659a0d2 100644
+index b838586fc0..5b52b93232 100644
 --- a/block/monitor/block-hmp-cmds.c
 +++ b/block/monitor/block-hmp-cmds.c
-@@ -1028,6 +1028,7 @@ void coroutine_fn hmp_backup(Monitor *mon, const QDict *qdict)
+@@ -1039,6 +1039,7 @@ void coroutine_fn hmp_backup(Monitor *mon, const QDict *qdict)
          false, NULL, // PBS password
          false, NULL, // PBS keyfile
          false, NULL, // PBS key_password
@@ -57,10 +57,10 @@ index f858003a06..04ebfc1e33 100644
      return ret;
  }
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 7b6e79df9f..6d3ea72706 100644
+index afa67c28d2..84e4406d21 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -756,6 +756,8 @@
+@@ -772,6 +772,8 @@
  #
  # @key-password: password for keyfile (optional for format 'pbs')
  #
@@ -69,7 +69,7 @@ index 7b6e79df9f..6d3ea72706 100644
  # @fingerprint: server cert fingerprint (optional for format 'pbs')
  #
  # @backup-id: backup ID (required for format 'pbs')
-@@ -775,6 +777,7 @@
+@@ -791,6 +793,7 @@
                                      '*password': 'str',
                                      '*keyfile': 'str',
                                      '*key-password': 'str',
@@ -77,7 +77,7 @@ index 7b6e79df9f..6d3ea72706 100644
                                      '*fingerprint': 'str',
                                      '*backup-id': 'str',
                                      '*backup-time': 'int',
-@@ -827,6 +830,9 @@
+@@ -843,6 +846,9 @@
  #                              migration cap if this is false/unset may lead
  #                              to crashes on migration!
  #
@@ -87,7 +87,7 @@ index 7b6e79df9f..6d3ea72706 100644
  # @pbs-library-version: Running version of libproxmox-backup-qemu0 library.
  #
  ##
-@@ -835,6 +841,7 @@
+@@ -851,6 +857,7 @@
              'query-bitmap-info': 'bool',
              'pbs-dirty-bitmap-savevm': 'bool',
              'pbs-dirty-bitmap-migration': 'bool',

debian/patches/pve/0045-block-io-accept-NULL-qiov-in-bdrv_pad_request.patch

@@ -15,10 +15,10 @@ target if it will be discarded anyway.
  1 file changed, 4 insertions(+)
 
 diff --git a/block/io.c b/block/io.c
-index ca2dca3007..a9e70a4f91 100644
+index a19942718b..9fa8252258 100644
 --- a/block/io.c
 +++ b/block/io.c
-@@ -1731,6 +1731,10 @@ static int bdrv_pad_request(BlockDriverState *bs,
+@@ -1763,6 +1763,10 @@ static int bdrv_pad_request(BlockDriverState *bs,
  {
      int ret;
  

debian/patches/pve/0046-block-add-alloc-track-driver.patch

@@ -381,7 +381,7 @@ index 0000000000..35f2737c89
 +
 +block_init(bdrv_alloc_track_init);
 diff --git a/block/meson.build b/block/meson.build
-index 574165e577..f56ec7f6bf 100644
+index e3ed5ac97c..d1ee260048 100644
 --- a/block/meson.build
 +++ b/block/meson.build
 @@ -2,6 +2,7 @@ block_ss.add(genh)

debian/patches/pve/0048-PVE-savevm-async-register-yank-before-migration_inco.patch

@@ -10,7 +10,7 @@ Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
  1 file changed, 5 insertions(+)
 
 diff --git a/migration/savevm-async.c b/migration/savevm-async.c
-index cc2552d977..f863411dea 100644
+index 970ee3b3fc..b3ccc069f1 100644
 --- a/migration/savevm-async.c
 +++ b/migration/savevm-async.c
 @@ -19,6 +19,7 @@

debian/patches/series

@@ -1,6 +1,8 @@
-extra/0001-monitor-qmp-fix-race-on-CHR_EVENT_CLOSED-without-OOB.patch
-extra/0002-block-io_uring-resubmit-when-result-is-EAGAIN.patch
-extra/0003-monitor-qmp-fix-race-with-clients-disconnecting-earl.patch
+extra/0001-qemu-sockets-fix-unix-socket-path-copy-again.patch
+extra/0002-monitor-qmp-fix-race-with-clients-disconnecting-earl.patch
+extra/0003-monitor-hmp-add-support-for-flag-argument-with-value.patch
+extra/0004-monitor-refactor-set-expire_password-and-allow-VNC-d.patch
+extra/0005-monitor-hmp-correctly-invert-password-argument-detec.patch
 bitmap-mirror/0001-drive-mirror-add-support-for-sync-bitmap-mode-never.patch
 bitmap-mirror/0002-drive-mirror-add-support-for-conditional-and-always-.patch
 bitmap-mirror/0003-mirror-add-check-for-bitmap-mode-without-bitmap.patch

qemu

@@ -1 +1 @@
-Subproject commit 609d7596524ab204ccd71ef42c9eee4c7c338ea4
+Subproject commit f9baca549e44791be0dd98de15add3d8452a8af0