* [PATCH qemu v2 1/7] update submodule and patches to QEMU 11.1.1
2026-09-09 14:52 [PATCH-SERIES qemu/qemu-server v2 0/7] QEMU 11.1.1 Fiona Ebner
@ 2026-09-09 14:52 ` Fiona Ebner
2026-09-09 14:52 ` [PATCH qemu v2 2/7] spice: work around broken input cleanup feature in libspice-server1 Fiona Ebner
` (5 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: Fiona Ebner @ 2026-09-09 14:52 UTC (permalink / raw)
To: pve-devel
The "monitor/qmp: fix race with clients disconnecting early" patch had
changes because they switched to using the QEMU object model (QOM) for
monitor objects.
For async snapshot:
1. The signature for migration_completion_precopy() changed.
Relevant QEMU commits:
e37df09677 ("migration: Propagate errors in migration_completion_precopy()")
511b786d13 ("migration: Refactor migration_completion_precopy() to return bool")
2. Pending needs to be queried via save_query_pending_iter() and there
must be a final qemu_savevm_query_pending_final() before calling
qemu_savevm_state_complete_precopy().
There also is a new stopcopy_bytes value for state that can only be
copied after VM stop. Treat it the same as postcopy_bytes.
Relevant QEMU commits:
0b881dc137 ("migration: Use the new save_query_pending() API directly")
3c11e33016 ("migration: Run final save_query_pending at switchover")
de0a1aed07 ("migration: Make switchover-ack re-usable")
ff86cf43df ("migration: Introduce stopcopy_bytes in save_query_pending()")
3. The ID for the created iothread needs to be valid, because of QEMU
commit ab67e622d0 ("qom: validate ID format when creating objects").
It was '__proxmox_savevm_async_iothread__', but now needs to start
with a letter. Change it to 'proxmox_savevm_async_iothread__', which
should still be extremely unlikely to clash with a user-created one.
Creating iothreads is not possible via Proxmox VE API/CLI in any case.
4. Context changes in the definitions for HMP. Easy to adapt, added
a short documentation while at it.
Patch "block/export/fuse: fix regression with O_TRUNC when export is
not growable" has landed with a proper conditional check upstream, so
the downstream version "block/export/fuse: fix regression with block
device export or growable=off and O_TRUNC" can be dropped from the
'extra' patches.
The glusterfs block driver was dropped, so the related patches are
not required anymore.
Update the list of CPU models. Many got new versions for GMET/MBEC
support.
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---
Changes in v2:
* Rebase on current master.
* Use 11.1.1 instead of 11.1.0 as the base.
* Make sure to call qemu_savevm_query_pending_final() before
qemu_savevm_state_complete_precopy(). Noticed during testing where
a busy VM could end up stuck after rollback.
* Restore correct error handling for
qemu_savevm_state_complete_precopy() call.
debian/cpu-models-x86_64.json | 15 +
...d-support-for-sync-bitmap-mode-never.patch | 2 +-
...race-with-clients-disconnecting-earl.patch | 112 +++++--
...void-idle-event-loop-being-accounted.patch | 2 +-
...e-fix-regression-with-block-device-e.patch | 35 ---
...lerate-known-seSparse-reserved1-bit.patch} | 0
...lidate-primary-surface-stride-again.patch} | 6 +-
...5a-gracefully-handle-re-entrant-DMA.patch} | 0
...ire-types-for-client-message-handler.patch | 134 ---------
...o-gpu-validate-stride-against-width-.patch | 69 -----
...virtio-gpu-Remove-the-bytes_pp-field.patch | 144 ---------
...o-gpu-reject-strides-exceeding-INT_M.patch | 68 -----
...guest-triggerable-abort-on-oversized.patch | 273 ------------------
...-request-size-to-avoid-oversized-all.patch | 58 ----
...ce-assert-with-proper-error-handling.patch | 49 ----
...-zero-length-packed-indirect-descrip.patch | 52 ----
...et-Protect-from-DMA-re-entrancy-bugs.patch | 47 ---
...nregister-vm_change_state-handler-an.patch | 95 ------
...possible-crash-via-NULL-pointer-in-i.patch | 58 ----
...d-possible-assert-in-do_parameter-us.patch | 53 ----
...Check-return-value-of-xhci_xfer_crea.patch | 67 -----
...e_vga-Don-t-allow-guest-to-trigger-l.patch | 72 -----
...csi-disk-fix-off-by-one-in-assertion.patch | 38 ---
...er_sysret-Check-that-RCX-contains-a-.patch | 74 -----
...x-O_TRUNC-bypass-on-read-only-export.patch | 53 ----
...rain-in-flight-PDUs-before-virtio-9p.patch | 41 ---
...arrow-a-failed-config-read-to-a-plau.patch | 108 -------
...ect-invalid-PCI_INTERRUPT_PIN-values.patch | 51 ----
...k-file-change-locking-default-to-off.patch | 6 +-
...he-CPU-model-to-kvm64-32-instead-of-.patch | 4 +-
...ui-spice-default-to-pve-certificates.patch | 4 +-
...erfs-no-default-logfile-if-daemonize.patch | 50 ----
...ock-rbd-disable-rbd_cache_writethro.patch} | 0
...eturn-success-on-info-without-snaps.patch} | 4 +-
...PVE-Up-glusterfs-allow-partial-reads.patch | 79 -----
...d-add-osize-and-read-from-to-stdin-.patch} | 12 +-
...-Up-qemu-img-dd-add-isize-parameter.patch} | 14 +-
...VE-Up-qemu-img-dd-add-n-skip_create.patch} | 16 +-
...add-l-option-for-loading-a-snapshot.patch} | 18 +-
...irtio-balloon-improve-query-balloon.patch} | 4 +-
...0012-PVE-qapi-modify-query-machines.patch} | 2 +-
...=> 0013-PVE-qapi-modify-spice-query.patch} | 4 +-
...nel-implementation-for-savevm-async.patch} | 2 +-
...sync-for-background-state-snapshots.patch} | 120 +++++---
...dd-optional-buffer-size-to-QEMUFile.patch} | 18 +-
...dd-the-zeroinit-block-driver-filter.patch} | 8 +-
...Add-dummy-id-command-line-parameter.patch} | 10 +-
...-target-i386-disable-LINT0-after-re.patch} | 2 +-
...e-posix-make-locking-optiono-on-cre.patch} | 22 +-
...-PVE-monitor-disable-oob-capability.patch} | 20 +-
...-Allow-version-code-in-machine-type.patch} | 14 +-
...-bcs-bitmap-initialization-to-job-c.patch} | 0
...E-Backup-add-vma-backup-format-code.patch} | 8 +-
...Backup-add-backup-dump-block-driver.patch} | 2 +-
...-sequential-job-transaction-support.patch} | 0
...kup-Proxmox-backup-patches-for-QEMU.patch} | 36 +--
...store-new-command-to-restore-from-p.patch} | 4 +-
...-driver-to-map-backup-archives-into.patch} | 14 +-
...t-stderr-to-journal-when-daemonized.patch} | 6 +-
...grate-dirty-bitmap-state-via-savevm.patch} | 35 ++-
...irty-bitmap-migrate-other-bitmaps-e.patch} | 2 +-
...ll-back-to-open-iscsi-initiatorname.patch} | 0
...VE-block-stream-increase-chunk-size.patch} | 0
...> 0035-block-add-alloc-track-driver.patch} | 12 +-
...0036-PVE-backup-add-fleecing-option.patch} | 6 +-
...-version-deprecation-for-Proxmox-VE.patch} | 10 +-
...-out-helper-to-clear-backup-state-s.patch} | 0
...-out-helper-to-initialize-backup-st.patch} | 0
...ackup-add-target-ID-in-backup-state.patch} | 0
...vice-info-allow-caller-to-specify-f.patch} | 0
...ent-backup-access-setup-and-teardow.patch} | 12 +-
...e-for-the-switch-to-using-blockdev-.patch} | 0
...e-migration-blocker-check-for-snaps.patch} | 12 +-
...o-cache-flag-to-skip-host-page-cach.patch} | 0
debian/patches/series | 111 +++----
qemu | 2 +-
76 files changed, 393 insertions(+), 2088 deletions(-)
delete mode 100644 debian/patches/extra/0003-block-export-fuse-fix-regression-with-block-device-e.patch
rename debian/patches/extra/{0004-block-vmdk-tolerate-known-seSparse-reserved1-bit.patch => 0003-block-vmdk-tolerate-known-seSparse-reserved1-bit.patch} (100%)
rename debian/patches/extra/{0006-hw-display-qxl-validate-primary-surface-stride-again.patch => 0004-hw-display-qxl-validate-primary-surface-stride-again.patch} (95%)
rename debian/patches/extra/{0026-hw-scsi-lsi53c895a-gracefully-handle-re-entrant-DMA.patch => 0005-hw-scsi-lsi53c895a-gracefully-handle-re-entrant-DMA.patch} (100%)
delete mode 100644 debian/patches/extra/0005-ui-vnc-use-RFB-wire-types-for-client-message-handler.patch
delete mode 100644 debian/patches/extra/0007-hw-display-virtio-gpu-validate-stride-against-width-.patch
delete mode 100644 debian/patches/extra/0008-hw-display-virtio-gpu-Remove-the-bytes_pp-field.patch
delete mode 100644 debian/patches/extra/0009-hw-display-virtio-gpu-reject-strides-exceeding-INT_M.patch
delete mode 100644 debian/patches/extra/0010-intel_iommu-fix-guest-triggerable-abort-on-oversized.patch
delete mode 100644 debian/patches/extra/0011-backends-rng-cap-request-size-to-avoid-oversized-all.patch
delete mode 100644 debian/patches/extra/0012-hw-ide-replace-assert-with-proper-error-handling.patch
delete mode 100644 debian/patches/extra/0013-hw-virtio-reject-zero-length-packed-indirect-descrip.patch
delete mode 100644 debian/patches/extra/0014-hw-net-virtio-net-Protect-from-DMA-re-entrancy-bugs.patch
delete mode 100644 debian/patches/extra/0015-hw-display-qxl-unregister-vm_change_state-handler-an.patch
delete mode 100644 debian/patches/extra/0016-hw-ide-core-Fix-possible-crash-via-NULL-pointer-in-i.patch
delete mode 100644 debian/patches/extra/0017-hw-usb-core-Avoid-possible-assert-in-do_parameter-us.patch
delete mode 100644 debian/patches/extra/0018-hw-usb-hcd-xhci-Check-return-value-of-xhci_xfer_crea.patch
delete mode 100644 debian/patches/extra/0019-hw-display-vmware_vga-Don-t-allow-guest-to-trigger-l.patch
delete mode 100644 debian/patches/extra/0020-scsi-disk-fix-off-by-one-in-assertion.patch
delete mode 100644 debian/patches/extra/0021-target-i386-helper_sysret-Check-that-RCX-contains-a-.patch
delete mode 100644 debian/patches/extra/0022-hw-9pfs-fix-O_TRUNC-bypass-on-read-only-export.patch
delete mode 100644 debian/patches/extra/0023-hw-9pfs-virtio-drain-in-flight-PDUs-before-virtio-9p.patch
delete mode 100644 debian/patches/extra/0024-vfio-pci-don-t-narrow-a-failed-config-read-to-a-plau.patch
delete mode 100644 debian/patches/extra/0025-vfio-pci-reject-invalid-PCI_INTERRUPT_PIN-values.patch
delete mode 100644 debian/patches/pve/0005-PVE-Config-glusterfs-no-default-logfile-if-daemonize.patch
rename debian/patches/pve/{0006-PVE-Config-rbd-block-rbd-disable-rbd_cache_writethro.patch => 0005-PVE-Config-rbd-block-rbd-disable-rbd_cache_writethro.patch} (100%)
rename debian/patches/pve/{0008-PVE-Up-qemu-img-return-success-on-info-without-snaps.patch => 0006-PVE-Up-qemu-img-return-success-on-info-without-snaps.patch} (88%)
delete mode 100644 debian/patches/pve/0007-PVE-Up-glusterfs-allow-partial-reads.patch
rename debian/patches/pve/{0009-PVE-Up-qemu-img-dd-add-osize-and-read-from-to-stdin-.patch => 0007-PVE-Up-qemu-img-dd-add-osize-and-read-from-to-stdin-.patch} (96%)
rename debian/patches/pve/{0010-PVE-Up-qemu-img-dd-add-isize-parameter.patch => 0008-PVE-Up-qemu-img-dd-add-isize-parameter.patch} (87%)
rename debian/patches/pve/{0011-PVE-Up-qemu-img-dd-add-n-skip_create.patch => 0009-PVE-Up-qemu-img-dd-add-n-skip_create.patch} (91%)
rename debian/patches/pve/{0012-qemu-img-dd-add-l-option-for-loading-a-snapshot.patch => 0010-qemu-img-dd-add-l-option-for-loading-a-snapshot.patch} (90%)
rename debian/patches/pve/{0013-PVE-virtio-balloon-improve-query-balloon.patch => 0011-PVE-virtio-balloon-improve-query-balloon.patch} (98%)
rename debian/patches/pve/{0014-PVE-qapi-modify-query-machines.patch => 0012-PVE-qapi-modify-query-machines.patch} (98%)
rename debian/patches/pve/{0015-PVE-qapi-modify-spice-query.patch => 0013-PVE-qapi-modify-spice-query.patch} (95%)
rename debian/patches/pve/{0016-PVE-add-IOChannel-implementation-for-savevm-async.patch => 0014-PVE-add-IOChannel-implementation-for-savevm-async.patch} (99%)
rename debian/patches/pve/{0017-PVE-add-savevm-async-for-background-state-snapshots.patch => 0015-PVE-add-savevm-async-for-background-state-snapshots.patch} (91%)
rename debian/patches/pve/{0018-PVE-add-optional-buffer-size-to-QEMUFile.patch => 0016-PVE-add-optional-buffer-size-to-QEMUFile.patch} (93%)
rename debian/patches/pve/{0019-PVE-block-add-the-zeroinit-block-driver-filter.patch => 0017-PVE-block-add-the-zeroinit-block-driver-filter.patch} (98%)
rename debian/patches/pve/{0020-PVE-Add-dummy-id-command-line-parameter.patch => 0018-PVE-Add-dummy-id-command-line-parameter.patch} (87%)
rename debian/patches/pve/{0021-PVE-Config-Revert-target-i386-disable-LINT0-after-re.patch => 0019-PVE-Config-Revert-target-i386-disable-LINT0-after-re.patch} (96%)
rename debian/patches/pve/{0022-PVE-Up-Config-file-posix-make-locking-optiono-on-cre.patch => 0020-PVE-Up-Config-file-posix-make-locking-optiono-on-cre.patch} (90%)
rename debian/patches/pve/{0023-PVE-monitor-disable-oob-capability.patch => 0021-PVE-monitor-disable-oob-capability.patch} (65%)
rename debian/patches/pve/{0024-PVE-Allow-version-code-in-machine-type.patch => 0022-PVE-Allow-version-code-in-machine-type.patch} (93%)
rename debian/patches/pve/{0025-block-backup-move-bcs-bitmap-initialization-to-job-c.patch => 0023-block-backup-move-bcs-bitmap-initialization-to-job-c.patch} (100%)
rename debian/patches/pve/{0026-PVE-Backup-add-vma-backup-format-code.patch => 0024-PVE-Backup-add-vma-backup-format-code.patch} (99%)
rename debian/patches/pve/{0027-PVE-Backup-add-backup-dump-block-driver.patch => 0025-PVE-Backup-add-backup-dump-block-driver.patch} (99%)
rename debian/patches/pve/{0028-PVE-Add-sequential-job-transaction-support.patch => 0026-PVE-Add-sequential-job-transaction-support.patch} (100%)
rename debian/patches/pve/{0029-PVE-Backup-Proxmox-backup-patches-for-QEMU.patch => 0027-PVE-Backup-Proxmox-backup-patches-for-QEMU.patch} (98%)
rename debian/patches/pve/{0030-PVE-Backup-pbs-restore-new-command-to-restore-from-p.patch => 0028-PVE-Backup-pbs-restore-new-command-to-restore-from-p.patch} (99%)
rename debian/patches/pve/{0031-PVE-Add-PBS-block-driver-to-map-backup-archives-into.patch => 0029-PVE-Add-PBS-block-driver-to-map-backup-archives-into.patch} (98%)
rename debian/patches/pve/{0032-PVE-redirect-stderr-to-journal-when-daemonized.patch => 0030-PVE-redirect-stderr-to-journal-when-daemonized.patch} (94%)
rename debian/patches/pve/{0033-PVE-Migrate-dirty-bitmap-state-via-savevm.patch => 0031-PVE-Migrate-dirty-bitmap-state-via-savevm.patch} (88%)
rename debian/patches/pve/{0034-migration-block-dirty-bitmap-migrate-other-bitmaps-e.patch => 0032-migration-block-dirty-bitmap-migrate-other-bitmaps-e.patch} (97%)
rename debian/patches/pve/{0035-PVE-fall-back-to-open-iscsi-initiatorname.patch => 0033-PVE-fall-back-to-open-iscsi-initiatorname.patch} (100%)
rename debian/patches/pve/{0036-PVE-block-stream-increase-chunk-size.patch => 0034-PVE-block-stream-increase-chunk-size.patch} (100%)
rename debian/patches/pve/{0037-block-add-alloc-track-driver.patch => 0035-block-add-alloc-track-driver.patch} (98%)
rename debian/patches/pve/{0038-PVE-backup-add-fleecing-option.patch => 0036-PVE-backup-add-fleecing-option.patch} (99%)
rename debian/patches/pve/{0039-adapt-machine-version-deprecation-for-Proxmox-VE.patch => 0037-adapt-machine-version-deprecation-for-Proxmox-VE.patch} (97%)
rename debian/patches/pve/{0040-PVE-backup-factor-out-helper-to-clear-backup-state-s.patch => 0038-PVE-backup-factor-out-helper-to-clear-backup-state-s.patch} (100%)
rename debian/patches/pve/{0041-PVE-backup-factor-out-helper-to-initialize-backup-st.patch => 0039-PVE-backup-factor-out-helper-to-initialize-backup-st.patch} (100%)
rename debian/patches/pve/{0042-PVE-backup-add-target-ID-in-backup-state.patch => 0040-PVE-backup-add-target-ID-in-backup-state.patch} (100%)
rename debian/patches/pve/{0043-PVE-backup-get-device-info-allow-caller-to-specify-f.patch => 0041-PVE-backup-get-device-info-allow-caller-to-specify-f.patch} (100%)
rename debian/patches/pve/{0044-PVE-backup-implement-backup-access-setup-and-teardow.patch => 0042-PVE-backup-implement-backup-access-setup-and-teardow.patch} (99%)
rename debian/patches/pve/{0045-PVE-backup-prepare-for-the-switch-to-using-blockdev-.patch => 0043-PVE-backup-prepare-for-the-switch-to-using-blockdev-.patch} (100%)
rename debian/patches/pve/{0046-savevm-async-reuse-migration-blocker-check-for-snaps.patch => 0044-savevm-async-reuse-migration-blocker-check-for-snaps.patch} (94%)
rename debian/patches/pve/{0047-pbs-restore-add-no-cache-flag-to-skip-host-page-cach.patch => 0045-pbs-restore-add-no-cache-flag-to-skip-host-page-cach.patch} (100%)
diff --git a/debian/cpu-models-x86_64.json b/debian/cpu-models-x86_64.json
index ca68978696..54ac94e33d 100644
--- a/debian/cpu-models-x86_64.json
+++ b/debian/cpu-models-x86_64.json
@@ -9,26 +9,33 @@
"Cascadelake-Server-v2" : "GenuineIntel",
"Cascadelake-Server-v4" : "GenuineIntel",
"Cascadelake-Server-v5" : "GenuineIntel",
+ "Cascadelake-Server-v6" : "GenuineIntel",
+ "Cascadelake-Server-v7" : "GenuineIntel",
"ClearwaterForest" : "GenuineIntel",
"ClearwaterForest-v2" : "GenuineIntel",
"ClearwaterForest-v3" : "GenuineIntel",
+ "ClearwaterForest-v4" : "GenuineIntel",
"Conroe" : "GenuineIntel",
"Cooperlake" : "GenuineIntel",
"Cooperlake-v2" : "GenuineIntel",
"DiamondRapids" : "GenuineIntel",
+ "DiamondRapids-v2" : "GenuineIntel",
"EPYC" : "AuthenticAMD",
"EPYC-Genoa" : "AuthenticAMD",
"EPYC-Genoa-v2" : "AuthenticAMD",
+ "EPYC-Genoa-v3" : "AuthenticAMD",
"EPYC-IBPB" : "AuthenticAMD",
"EPYC-Milan" : "AuthenticAMD",
"EPYC-Milan-v2" : "AuthenticAMD",
"EPYC-Milan-v3" : "AuthenticAMD",
+ "EPYC-Milan-v4" : "AuthenticAMD",
"EPYC-Rome" : "AuthenticAMD",
"EPYC-Rome-v2" : "AuthenticAMD",
"EPYC-Rome-v3" : "AuthenticAMD",
"EPYC-Rome-v4" : "AuthenticAMD",
"EPYC-Rome-v5" : "AuthenticAMD",
"EPYC-Turin" : "AuthenticAMD",
+ "EPYC-Turin-v2" : "AuthenticAMD",
"EPYC-v3" : "AuthenticAMD",
"EPYC-v4" : "AuthenticAMD",
"EPYC-v5" : "AuthenticAMD",
@@ -37,6 +44,8 @@
"GraniteRapids-v3" : "GenuineIntel",
"GraniteRapids-v4" : "GenuineIntel",
"GraniteRapids-v5" : "GenuineIntel",
+ "GraniteRapids-v6" : "GenuineIntel",
+ "GraniteRapids-v7" : "GenuineIntel",
"Haswell" : "GenuineIntel",
"Haswell-IBRS" : "GenuineIntel",
"Haswell-noTSX" : "GenuineIntel",
@@ -50,6 +59,8 @@
"Icelake-Server-v5" : "GenuineIntel",
"Icelake-Server-v6" : "GenuineIntel",
"Icelake-Server-v7" : "GenuineIntel",
+ "Icelake-Server-v8" : "GenuineIntel",
+ "Icelake-Server-v9" : "GenuineIntel",
"IvyBridge" : "GenuineIntel",
"IvyBridge-IBRS" : "GenuineIntel",
"KnightsMill" : "GenuineIntel",
@@ -69,11 +80,14 @@
"SapphireRapids-v4" : "GenuineIntel",
"SapphireRapids-v5" : "GenuineIntel",
"SapphireRapids-v6" : "GenuineIntel",
+ "SapphireRapids-v7" : "GenuineIntel",
+ "SapphireRapids-v8" : "GenuineIntel",
"SierraForest" : "GenuineIntel",
"SierraForest-v2" : "GenuineIntel",
"SierraForest-v3" : "GenuineIntel",
"SierraForest-v4" : "GenuineIntel",
"SierraForest-v5" : "GenuineIntel",
+ "SierraForest-v6" : "GenuineIntel",
"Skylake-Client" : "GenuineIntel",
"Skylake-Client-IBRS" : "GenuineIntel",
"Skylake-Client-noTSX-IBRS" : "GenuineIntel",
@@ -83,6 +97,7 @@
"Skylake-Server-noTSX-IBRS" : "GenuineIntel",
"Skylake-Server-v4" : "GenuineIntel",
"Skylake-Server-v5" : "GenuineIntel",
+ "Skylake-Server-v6" : "GenuineIntel",
"Westmere" : "GenuineIntel",
"Westmere-IBRS" : "GenuineIntel",
"athlon" : "AuthenticAMD",
diff --git a/debian/patches/bitmap-mirror/0001-drive-mirror-add-support-for-sync-bitmap-mode-never.patch b/debian/patches/bitmap-mirror/0001-drive-mirror-add-support-for-sync-bitmap-mode-never.patch
index 0fb45d16e0..40ec9887d7 100644
--- a/debian/patches/bitmap-mirror/0001-drive-mirror-add-support-for-sync-bitmap-mode-never.patch
+++ b/debian/patches/bitmap-mirror/0001-drive-mirror-add-support-for-sync-bitmap-mode-never.patch
@@ -333,7 +333,7 @@ index e7c8f1a856..d5aa68caeb 100644
BlockdevOnError on_source_error,
BlockdevOnError on_target_error,
diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 0efd51787b..50a0af3569 100644
+index 1f87b07850..c2f6139dea 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -2280,6 +2280,15 @@
diff --git a/debian/patches/extra/0001-monitor-qmp-fix-race-with-clients-disconnecting-earl.patch b/debian/patches/extra/0001-monitor-qmp-fix-race-with-clients-disconnecting-earl.patch
index 9b27ec422b..fa7f658d8b 100644
--- a/debian/patches/extra/0001-monitor-qmp-fix-race-with-clients-disconnecting-earl.patch
+++ b/debian/patches/extra/0001-monitor-qmp-fix-race-with-clients-disconnecting-earl.patch
@@ -38,34 +38,44 @@ crashes other, normally behaving clients with unrelated responses.
Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
-[FE: rebase for QEMU 11.0.0]
+[FE: rebase for QEMU 11.1.0]
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---
include/monitor/monitor.h | 1 +
- monitor/monitor-internal.h | 7 +++++++
- monitor/monitor.c | 15 +++++++++++++++
- monitor/qmp.c | 15 ++++++++++++++-
+ monitor/monitor-internal.h | 9 +++++++++
+ monitor/monitor.c | 14 ++++++++++++++
+ monitor/qmp.c | 24 +++++++++++++++++++++++-
qapi/qmp-dispatch.c | 21 +++++++++++++++++----
stubs/monitor-core.c | 5 +++++
- 6 files changed, 59 insertions(+), 5 deletions(-)
+ tools/qemu-vnc/stubs.c | 5 +++++
+ 7 files changed, 74 insertions(+), 5 deletions(-)
diff --git a/include/monitor/monitor.h b/include/monitor/monitor.h
-index 296690e1f1..3a45b4e04d 100644
+index 890497b0d2..795cbfd9e5 100644
--- a/include/monitor/monitor.h
+++ b/include/monitor/monitor.h
-@@ -16,6 +16,7 @@ extern QemuOptsList qemu_mon_opts;
+@@ -25,6 +25,7 @@ extern QemuOptsList qemu_mon_opts;
+
Monitor *monitor_cur(void);
Monitor *monitor_set_cur(Coroutine *co, Monitor *mon);
- bool monitor_cur_is_qmp(void);
+int monitor_get_connection_nr(const Monitor *mon);
void monitor_init_globals(void);
void monitor_init_globals_core(void);
diff --git a/monitor/monitor-internal.h b/monitor/monitor-internal.h
-index feca111ae3..05243b2e5f 100644
+index 23829f32f9..350ab2a2b7 100644
--- a/monitor/monitor-internal.h
+++ b/monitor/monitor-internal.h
-@@ -151,6 +151,13 @@ typedef struct {
+@@ -128,6 +128,8 @@ struct MonitorClass {
+ * is required for processing the monitor
+ */
+ bool (*requires_iothread)(const Monitor *mon);
++
++ int (*get_connection_nr)(const Monitor *mon);
+ };
+
+ struct Monitor {
+@@ -198,6 +200,13 @@ struct MonitorQMP {
QemuMutex qmp_queue_lock;
/* Input queue that holds all the parsed QMP requests */
GQueue *qmp_requests;
@@ -76,15 +86,15 @@ index feca111ae3..05243b2e5f 100644
+ * client. Access with atomics.
+ */
+ int connection_nr;
- } MonitorQMP;
+ };
- /**
+ typedef QTAILQ_HEAD(MonitorList, Monitor) MonitorList;
diff --git a/monitor/monitor.c b/monitor/monitor.c
-index 00b93ed612..c8cea7ce52 100644
+index ed195fd97b..9bb8746430 100644
--- a/monitor/monitor.c
+++ b/monitor/monitor.c
-@@ -116,6 +116,21 @@ bool monitor_cur_is_qmp(void)
- return cur_mon && monitor_is_qmp(cur_mon);
+@@ -168,6 +168,20 @@ bool monitor_requires_iothread(const Monitor *mon)
+ return cls->requires_iothread && cls->requires_iothread(mon);
}
+/**
@@ -92,33 +102,48 @@ index 00b93ed612..c8cea7ce52 100644
+ */
+int monitor_get_connection_nr(const Monitor *mon)
+{
-+ MonitorQMP *qmp_mon;
++ MonitorClass *cls = MONITOR_GET_CLASS(mon);
+
-+ if (!monitor_is_qmp(mon)) {
++ if (!cls->get_connection_nr) {
+ return -1;
+ }
+
-+ qmp_mon = container_of(mon, MonitorQMP, common);
-+ return qatomic_read(&qmp_mon->connection_nr);
++ return cls->get_connection_nr(mon);
+}
+
- /**
- * Is @mon is using readline?
- * Note: not all HMP monitors use readline, e.g., gdbserver has a
+ static gboolean monitor_unblocked(void *do_not_use, GIOCondition cond,
+ void *opaque)
+ {
diff --git a/monitor/qmp.c b/monitor/qmp.c
-index 687019811f..e2ab70de77 100644
+index 338d37cb7e..681533715f 100644
--- a/monitor/qmp.c
+++ b/monitor/qmp.c
-@@ -165,6 +165,8 @@ static void monitor_qmp_dispatch(MonitorQMP *mon, QObject *req)
+@@ -123,6 +123,7 @@ static bool monitor_qmp_requires_iothread(const Monitor *mon);
+ static void monitor_qmp_complete(UserCreatable *uc, Error **errp);
+ static bool monitor_qmp_prepare_delete(UserCreatable *uc, Error **errp);
+ static void monitor_qmp_accept_input(Monitor *mon);
++static int monitor_qmp_get_connection_nr(const Monitor *mon);
+
+ static void monitor_qmp_class_init(ObjectClass *cls, const void *data)
+ {
+@@ -141,6 +142,7 @@ static void monitor_qmp_class_init(ObjectClass *cls, const void *data)
+ moncls->emit_event = monitor_qmp_emit_event;
+ moncls->requires_iothread = monitor_qmp_requires_iothread;
+ moncls->accept_input = monitor_qmp_accept_input;
++ moncls->get_connection_nr = monitor_qmp_get_connection_nr;
+
+ ucc->complete = monitor_qmp_complete;
+ ucc->prepare_delete = monitor_qmp_prepare_delete;
+@@ -277,6 +279,8 @@ static void monitor_qmp_dispatch(MonitorQMP *mon, QObject *req)
QDict *rsp;
QDict *error;
+ int conn_nr_before = qatomic_read(&mon->connection_nr);
+
rsp = qmp_dispatch(mon->commands, req, qmp_oob_enabled(mon),
- &mon->common);
+ &mon->parent_obj);
-@@ -180,7 +182,17 @@ static void monitor_qmp_dispatch(MonitorQMP *mon, QObject *req)
+@@ -292,7 +296,17 @@ static void monitor_qmp_dispatch(MonitorQMP *mon, QObject *req)
}
}
@@ -137,14 +162,25 @@ index 687019811f..e2ab70de77 100644
qobject_unref(rsp);
}
-@@ -462,6 +474,7 @@ static void monitor_qmp_event(void *opaque, QEMUChrEvent event)
+@@ -616,6 +630,7 @@ static void monitor_qmp_event(void *opaque, QEMUChrEvent event)
switch (event) {
case CHR_EVENT_OPENED:
+ qatomic_inc_fetch(&mon->connection_nr);
- WITH_QEMU_LOCK_GUARD(&mon->common.mon_lock) {
+ WITH_QEMU_LOCK_GUARD(&mon->parent_obj.mon_lock) {
mon->commands = &qmp_cap_negotiation_commands;
monitor_qmp_caps_reset(mon);
+@@ -805,3 +820,10 @@ static void monitor_qmp_accept_input(Monitor *mon)
+ qemu_chr_fe_accept_input(&mon->chr);
+ }
+ }
++
++static int monitor_qmp_get_connection_nr(const Monitor *mon)
++{
++ MonitorQMP *qmp = MONITOR_QMP(mon);
++
++ return qatomic_read(&qmp->connection_nr);
++}
diff --git a/qapi/qmp-dispatch.c b/qapi/qmp-dispatch.c
index e3897d5197..90ff0990e7 100644
--- a/qapi/qmp-dispatch.c
@@ -191,10 +227,10 @@ index e3897d5197..90ff0990e7 100644
aio_bh_schedule_oneshot(iohandler_get_aio_context(), do_qmp_dispatch_bh,
&data);
diff --git a/stubs/monitor-core.c b/stubs/monitor-core.c
-index 078a5012e9..748b209e14 100644
+index a7c32297c9..8a83866425 100644
--- a/stubs/monitor-core.c
+++ b/stubs/monitor-core.c
-@@ -17,6 +17,11 @@ Monitor *monitor_set_cur(Coroutine *co, Monitor *mon)
+@@ -12,6 +12,11 @@ Monitor *monitor_set_cur(Coroutine *co, Monitor *mon)
return NULL;
}
@@ -206,3 +242,19 @@ index 078a5012e9..748b209e14 100644
void qapi_event_emit(QAPIEvent event, QDict *qdict)
{
}
+diff --git a/tools/qemu-vnc/stubs.c b/tools/qemu-vnc/stubs.c
+index 1c82d8cff4..01f84fc32e 100644
+--- a/tools/qemu-vnc/stubs.c
++++ b/tools/qemu-vnc/stubs.c
+@@ -41,6 +41,11 @@ Monitor *monitor_set_cur(Coroutine *co, Monitor *mon)
+ return NULL;
+ }
+
++int monitor_get_connection_nr(const Monitor *mon)
++{
++ return -1;
++}
++
+ int monitor_vprintf(Monitor *mon, const char *fmt, va_list ap)
+ {
+ return -1;
diff --git a/debian/patches/extra/0002-fdmon-io_uring-avoid-idle-event-loop-being-accounted.patch b/debian/patches/extra/0002-fdmon-io_uring-avoid-idle-event-loop-being-accounted.patch
index cd205480f6..a56e2384b2 100644
--- a/debian/patches/extra/0002-fdmon-io_uring-avoid-idle-event-loop-being-accounted.patch
+++ b/debian/patches/extra/0002-fdmon-io_uring-avoid-idle-event-loop-being-accounted.patch
@@ -53,7 +53,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2 files changed, 47 insertions(+), 1 deletion(-)
diff --git a/include/qemu/aio.h b/include/qemu/aio.h
-index 8cca2360d1..87ee898429 100644
+index e65e90093a..17bc145eb6 100644
--- a/include/qemu/aio.h
+++ b/include/qemu/aio.h
@@ -55,6 +55,12 @@ struct CqeHandler {
diff --git a/debian/patches/extra/0003-block-export-fuse-fix-regression-with-block-device-e.patch b/debian/patches/extra/0003-block-export-fuse-fix-regression-with-block-device-e.patch
deleted file mode 100644
index 37999ac6d4..0000000000
--- a/debian/patches/extra/0003-block-export-fuse-fix-regression-with-block-device-e.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Fiona Ebner <f.ebner@proxmox.com>
-Date: Tue, 12 May 2026 17:16:23 +0200
-Subject: [PATCH] block/export/fuse: fix regression with block device export or
- growable=off and O_TRUNC
-
-Before commit a94a1d7699 ("fuse: Manually process requests (without
-libfuse)"), libfuse was used which set the FUSE_ATOMIC_O_TRUNC flag.
-After the commit, the flag is not set anymore cause a regression where
-opening a block-based export with O_TRUNC fails with EOPNOTSUPP. And
-it also causes a regression with file-based exports, since they would
-be truncated upon opening with O_TRUNC, but then subsequent writes to
-the file would not be possible, since it's not growable.
-
-A proper upstream submission might want to conditionalize on having
-growable=off and/or a block device based export for setting the flag.
-
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- block/export/fuse.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/block/export/fuse.c b/block/export/fuse.c
-index c0e8dfb643..8430c73293 100644
---- a/block/export/fuse.c
-+++ b/block/export/fuse.c
-@@ -856,7 +856,7 @@ static ssize_t coroutine_fn GRAPH_RDLOCK
- fuse_co_init(FuseExport *exp, struct fuse_init_out *out,
- const struct fuse_init_in *in)
- {
-- uint32_t supported_flags = FUSE_ASYNC_READ | FUSE_ASYNC_DIO;
-+ uint32_t supported_flags = FUSE_ASYNC_READ | FUSE_ASYNC_DIO | FUSE_ATOMIC_O_TRUNC;
- uint32_t flags2 = 0;
-
- if (in->major != 7) {
diff --git a/debian/patches/extra/0004-block-vmdk-tolerate-known-seSparse-reserved1-bit.patch b/debian/patches/extra/0003-block-vmdk-tolerate-known-seSparse-reserved1-bit.patch
similarity index 100%
rename from debian/patches/extra/0004-block-vmdk-tolerate-known-seSparse-reserved1-bit.patch
rename to debian/patches/extra/0003-block-vmdk-tolerate-known-seSparse-reserved1-bit.patch
diff --git a/debian/patches/extra/0006-hw-display-qxl-validate-primary-surface-stride-again.patch b/debian/patches/extra/0004-hw-display-qxl-validate-primary-surface-stride-again.patch
similarity index 95%
rename from debian/patches/extra/0006-hw-display-qxl-validate-primary-surface-stride-again.patch
rename to debian/patches/extra/0004-hw-display-qxl-validate-primary-surface-stride-again.patch
index bdf952dac8..299927cb83 100644
--- a/debian/patches/extra/0006-hw-display-qxl-validate-primary-surface-stride-again.patch
+++ b/debian/patches/extra/0004-hw-display-qxl-validate-primary-surface-stride-again.patch
@@ -33,10 +33,10 @@ Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
1 file changed, 29 insertions(+)
diff --git a/hw/display/qxl.c b/hw/display/qxl.c
-index 39a860c246..41d4ce9571 100644
+index b7d871b9ee..41673c369b 100644
--- a/hw/display/qxl.c
+++ b/hw/display/qxl.c
-@@ -1497,6 +1497,7 @@ static void qxl_create_guest_primary(PCIQXLDevice *qxl, int loadvm,
+@@ -1496,6 +1496,7 @@ static void qxl_create_guest_primary(PCIQXLDevice *qxl, int loadvm,
QXLSurfaceCreate *sc = &qxl->guest_primary.surface;
uint32_t requested_height = le32_to_cpu(sc->height);
int requested_stride = le32_to_cpu(sc->stride);
@@ -44,7 +44,7 @@ index 39a860c246..41d4ce9571 100644
if (requested_stride == INT32_MIN ||
abs(requested_stride) * (uint64_t)requested_height
-@@ -1533,6 +1534,34 @@ static void qxl_create_guest_primary(PCIQXLDevice *qxl, int loadvm,
+@@ -1532,6 +1533,34 @@ static void qxl_create_guest_primary(PCIQXLDevice *qxl, int loadvm,
return;
}
diff --git a/debian/patches/extra/0026-hw-scsi-lsi53c895a-gracefully-handle-re-entrant-DMA.patch b/debian/patches/extra/0005-hw-scsi-lsi53c895a-gracefully-handle-re-entrant-DMA.patch
similarity index 100%
rename from debian/patches/extra/0026-hw-scsi-lsi53c895a-gracefully-handle-re-entrant-DMA.patch
rename to debian/patches/extra/0005-hw-scsi-lsi53c895a-gracefully-handle-re-entrant-DMA.patch
diff --git a/debian/patches/extra/0005-ui-vnc-use-RFB-wire-types-for-client-message-handler.patch b/debian/patches/extra/0005-ui-vnc-use-RFB-wire-types-for-client-message-handler.patch
deleted file mode 100644
index 0ba927654b..0000000000
--- a/debian/patches/extra/0005-ui-vnc-use-RFB-wire-types-for-client-message-handler.patch
+++ /dev/null
@@ -1,134 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
-Date: Mon, 6 Jul 2026 14:52:31 +0400
-Subject: [PATCH] ui/vnc: use RFB wire types for client message handlers
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Use exact-width unsigned types for the static functions that process
-RFB client messages, matching the types returned by read_u8(),
-read_u16(), and read_u32():
-
- - set_pixel_format: uint8_t/uint16_t for pixel format fields
- - pointer_event: uint8_t button_mask, uint16_t x/y
- - key_event/ext_key_event: bool down, uint32_t sym/keycode
- - do_key_event: uint32_t sym
- - framebuffer_update_request: uint8_t incremental, uint16_t x/y/w/h
-
-Drop needless declarations.
-
-Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
-Signed-off-by: Marc-Andre Lureau <marcandre.lureau@redhat.com>
-(cherry picked from commit 3162692a3b67603e2b01f0c6441daa682acd6164)
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- ui/vnc.c | 39 +++++++++++++++++----------------------
- 1 file changed, 17 insertions(+), 22 deletions(-)
-
-diff --git a/ui/vnc.c b/ui/vnc.c
-index 3a041926bf..1f06cf04a7 100644
---- a/ui/vnc.c
-+++ b/ui/vnc.c
-@@ -614,15 +614,7 @@ bool vnc_display_reload_certs(const char *id, Error **errp)
- 3) resolutions > 1024
- */
-
--static int vnc_update_client(VncState *vs, int has_dirty);
--static void vnc_disconnect_start(VncState *vs);
--
- static void vnc_colordepth(VncState *vs);
--static void framebuffer_update_request(VncState *vs, int incremental,
-- int x_position, int y_position,
-- int w, int h);
--static void vnc_refresh(DisplayChangeListener *dcl);
--static int vnc_refresh_server_surface(VncDisplay *vd);
-
- static int vnc_width(VncDisplay *vd)
- {
-@@ -1769,7 +1761,8 @@ static void check_pointer_type_change(Notifier *notifier, void *data)
- vs->absolute = absolute;
- }
-
--static void pointer_event(VncState *vs, int button_mask, int x, int y)
-+static void pointer_event(VncState *vs, uint8_t button_mask,
-+ uint16_t x, uint16_t y)
- {
- static uint32_t bmap[INPUT_BUTTON__MAX] = {
- [INPUT_BUTTON_LEFT] = 0x01,
-@@ -1846,7 +1839,7 @@ static void kbd_leds(void *opaque, int ledstate)
- }
- }
-
--static void do_key_event(VncState *vs, int down, int keycode, int sym)
-+static void do_key_event(VncState *vs, int down, int keycode, uint32_t sym)
- {
- QKeyCode qcode = qemu_input_key_number_to_qcode(keycode);
-
-@@ -2025,7 +2018,7 @@ static const char *code2name(int keycode)
- return QKeyCode_str(qemu_input_key_number_to_qcode(keycode));
- }
-
--static void key_event(VncState *vs, int down, uint32_t sym)
-+static void key_event(VncState *vs, bool down, uint32_t sym)
- {
- int keycode;
- int lsym = sym;
-@@ -2040,8 +2033,8 @@ static void key_event(VncState *vs, int down, uint32_t sym)
- do_key_event(vs, down, keycode, sym);
- }
-
--static void ext_key_event(VncState *vs, int down,
-- uint32_t sym, uint16_t keycode)
-+static void ext_key_event(VncState *vs, bool down,
-+ uint32_t sym, uint32_t keycode)
- {
- /* if the user specifies a keyboard layout, always use it */
- if (keyboard_layout) {
-@@ -2052,8 +2045,9 @@ static void ext_key_event(VncState *vs, int down,
- }
- }
-
--static void framebuffer_update_request(VncState *vs, int incremental,
-- int x, int y, int w, int h)
-+static void framebuffer_update_request(VncState *vs, uint8_t incremental,
-+ uint16_t x, uint16_t y,
-+ uint16_t w, uint16_t h)
- {
- if (incremental) {
- if (vs->update != VNC_STATE_UPDATE_FORCE) {
-@@ -2256,10 +2250,11 @@ static void send_color_map(VncState *vs)
- vnc_unlock_output(vs);
- }
-
--static void set_pixel_format(VncState *vs, int bits_per_pixel,
-- int big_endian_flag, int true_color_flag,
-- int red_max, int green_max, int blue_max,
-- int red_shift, int green_shift, int blue_shift)
-+static void set_pixel_format(VncState *vs, uint8_t bits_per_pixel,
-+ uint8_t big_endian_flag, uint8_t true_color_flag,
-+ uint16_t red_max, uint16_t green_max,
-+ uint16_t blue_max, uint8_t red_shift,
-+ uint8_t green_shift, uint8_t blue_shift)
- {
- if (!true_color_flag) {
- /* Expose a reasonable default 256 color map */
-@@ -2297,15 +2292,15 @@ static void set_pixel_format(VncState *vs, int bits_per_pixel,
- vs->client_pf.rmax = red_max ? red_max : 0xFF;
- vs->client_pf.rbits = ctpopl(red_max);
- vs->client_pf.rshift = red_shift;
-- vs->client_pf.rmask = red_max << red_shift;
-+ vs->client_pf.rmask = (uint32_t)red_max << red_shift;
- vs->client_pf.gmax = green_max ? green_max : 0xFF;
- vs->client_pf.gbits = ctpopl(green_max);
- vs->client_pf.gshift = green_shift;
-- vs->client_pf.gmask = green_max << green_shift;
-+ vs->client_pf.gmask = (uint32_t)green_max << green_shift;
- vs->client_pf.bmax = blue_max ? blue_max : 0xFF;
- vs->client_pf.bbits = ctpopl(blue_max);
- vs->client_pf.bshift = blue_shift;
-- vs->client_pf.bmask = blue_max << blue_shift;
-+ vs->client_pf.bmask = (uint32_t)blue_max << blue_shift;
- vs->client_pf.bits_per_pixel = bits_per_pixel;
- vs->client_pf.bytes_per_pixel = bits_per_pixel / 8;
- vs->client_pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel;
diff --git a/debian/patches/extra/0007-hw-display-virtio-gpu-validate-stride-against-width-.patch b/debian/patches/extra/0007-hw-display-virtio-gpu-validate-stride-against-width-.patch
deleted file mode 100644
index b509ac180d..0000000000
--- a/debian/patches/extra/0007-hw-display-virtio-gpu-validate-stride-against-width-.patch
+++ /dev/null
@@ -1,69 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
-Date: Wed, 15 Jul 2026 11:55:46 +0400
-Subject: [PATCH] hw/display/virtio-gpu: validate stride against width on
- scanout
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Validate that the framebuffer stride is at least width * bytes_per_pixel
-in both virtio_gpu_scanout_blob_to_fb() and virtio_gpu_do_set_scanout().
-
-A guest can set a very small stride while using a large width. The total
-size check (offset + stride * height <= blob_size) passes because
-stride * height is small, but pixman reads width * bytes_per_pixel per
-row, causing heap OOB reads. The leaked data is rendered to the host
-display.
-
-The check is added in virtio_gpu_do_set_scanout() to cover all paths:
-blob scanout, non-blob scanout and migration post_load. The additional
-early check in virtio_gpu_scanout_blob_to_fb() rejects invalid blob
-configurations early.
-
-Fixes: CVE-2026-63109
-Fixes: 7b5574225429 ("hw/display: check frame buffer can hold blob")
-Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3989
-Reported-by: Tristan @TristanInSec
-Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
-Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
-(cherry picked from commit 861372428b05f74a1cf9a8af22a863aa7b46c7ce)
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- hw/display/virtio-gpu.c | 16 ++++++++++++++++
- 1 file changed, 16 insertions(+)
-
-diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
-index 81d65ec57c..10f55bd2ae 100644
---- a/hw/display/virtio-gpu.c
-+++ b/hw/display/virtio-gpu.c
-@@ -646,6 +646,14 @@ static bool virtio_gpu_do_set_scanout(VirtIOGPU *g,
- return false;
- }
-
-+ if (fb->stride < (uint64_t)fb->width * fb->bytes_pp) {
-+ qemu_log_mask(LOG_GUEST_ERROR,
-+ "%s: stride %u too small for width %u at %u bpp\n",
-+ __func__, fb->stride, fb->width, fb->bytes_pp);
-+ *error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;
-+ return false;
-+ }
-+
- g->parent_obj.enable = 1;
-
- if (res->blob) {
-@@ -757,6 +765,14 @@ bool virtio_gpu_scanout_blob_to_fb(struct virtio_gpu_framebuffer *fb,
- fb->width = ss->width;
- fb->height = ss->height;
- fb->stride = ss->strides[0];
-+
-+ if (fb->stride < (uint64_t)fb->width * fb->bytes_pp) {
-+ qemu_log_mask(LOG_GUEST_ERROR,
-+ "%s: stride %u too small for width %u at %u bpp\n",
-+ __func__, fb->stride, fb->width, fb->bytes_pp);
-+ return false;
-+ }
-+
- fb->offset = ss->offsets[0] + ss->r.x * fb->bytes_pp + ss->r.y * fb->stride;
-
- fbend = fb->offset;
diff --git a/debian/patches/extra/0008-hw-display-virtio-gpu-Remove-the-bytes_pp-field.patch b/debian/patches/extra/0008-hw-display-virtio-gpu-Remove-the-bytes_pp-field.patch
deleted file mode 100644
index 7454ec7e39..0000000000
--- a/debian/patches/extra/0008-hw-display-virtio-gpu-Remove-the-bytes_pp-field.patch
+++ /dev/null
@@ -1,144 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
-Date: Sun, 19 Jul 2026 20:35:13 +0900
-Subject: [PATCH] hw/display/virtio-gpu: Remove the bytes_pp field
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-virtio_gpu_do_set_scanout() validates the stride field of struct
-virtio_gpu_framebuffer against the bytes_pp field, but bytes_pp in the
-migration stream may be inconsistent with the format field, which
-pixman_image_create_bits() uses when it accesses the framebuffer.
-That validation is therefore incomplete.
-
-To avoid the trouble of synchronizing the two fields, remove bytes_pp,
-and always derive its value from format. Removing bytes_pp is safe
-because no released version of QEMU uses its migrated value.
-
-Fixes: 7b5574225429 ("hw/display: check frame buffer can hold blob")
-Cc: qemu-stable@nongnu.org
-Signed-off-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
-Reviewed-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
-Link: https://lore.kernel.org/qemu-devel/20260719-bpp-v1-1-9b91946d6cf3@rsg.ci.i.u-tokyo.ac.jp
-(picked from qemu-devel)
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- hw/display/virtio-gpu.c | 27 +++++++++++++++++----------
- include/hw/virtio/virtio-gpu.h | 1 -
- 2 files changed, 17 insertions(+), 11 deletions(-)
-
-diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
-index 10f55bd2ae..c83cbfca45 100644
---- a/hw/display/virtio-gpu.c
-+++ b/hw/display/virtio-gpu.c
-@@ -617,6 +617,11 @@ void virtio_gpu_update_scanout(VirtIOGPU *g,
- scanout->fb = *fb;
- }
-
-+static uint32_t virtio_gpu_format_bytes_pp(pixman_format_code_t format)
-+{
-+ return DIV_ROUND_UP(PIXMAN_FORMAT_BPP(format), 8);
-+}
-+
- static bool virtio_gpu_do_set_scanout(VirtIOGPU *g,
- uint32_t scanout_id,
- struct virtio_gpu_framebuffer *fb,
-@@ -625,6 +630,7 @@ static bool virtio_gpu_do_set_scanout(VirtIOGPU *g,
- uint32_t *error)
- {
- struct virtio_gpu_scanout *scanout;
-+ uint32_t bytes_pp = virtio_gpu_format_bytes_pp(fb->format);
- uint8_t *data;
-
- scanout = &g->parent_obj.scanout[scanout_id];
-@@ -646,10 +652,10 @@ static bool virtio_gpu_do_set_scanout(VirtIOGPU *g,
- return false;
- }
-
-- if (fb->stride < (uint64_t)fb->width * fb->bytes_pp) {
-+ if (fb->stride < (uint64_t)fb->width * bytes_pp) {
- qemu_log_mask(LOG_GUEST_ERROR,
- "%s: stride %u too small for width %u at %u bpp\n",
-- __func__, fb->stride, fb->width, fb->bytes_pp);
-+ __func__, fb->stride, fb->width, bytes_pp);
- *error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;
- return false;
- }
-@@ -712,6 +718,7 @@ static void virtio_gpu_set_scanout(VirtIOGPU *g,
- struct virtio_gpu_simple_resource *res;
- struct virtio_gpu_framebuffer fb = { 0 };
- struct virtio_gpu_set_scanout ss;
-+ uint32_t bytes_pp;
-
- VIRTIO_GPU_FILL_CMD(ss);
- virtio_gpu_bswap_32(&ss, sizeof(ss));
-@@ -737,11 +744,11 @@ static void virtio_gpu_set_scanout(VirtIOGPU *g,
- }
-
- fb.format = pixman_image_get_format(res->image);
-- fb.bytes_pp = DIV_ROUND_UP(PIXMAN_FORMAT_BPP(fb.format), 8);
-+ bytes_pp = virtio_gpu_format_bytes_pp(fb.format);
- fb.width = pixman_image_get_width(res->image);
- fb.height = pixman_image_get_height(res->image);
- fb.stride = pixman_image_get_stride(res->image);
-- fb.offset = ss.r.x * fb.bytes_pp + ss.r.y * fb.stride;
-+ fb.offset = ss.r.x * bytes_pp + ss.r.y * fb.stride;
-
- virtio_gpu_do_set_scanout(g, ss.scanout_id,
- &fb, res, &ss.r, &cmd->error);
-@@ -752,6 +759,7 @@ bool virtio_gpu_scanout_blob_to_fb(struct virtio_gpu_framebuffer *fb,
- uint64_t blob_size)
- {
- uint64_t fbend;
-+ uint32_t bytes_pp;
-
- fb->format = virtio_gpu_get_pixman_format(ss->format);
- if (!fb->format) {
-@@ -761,19 +769,19 @@ bool virtio_gpu_scanout_blob_to_fb(struct virtio_gpu_framebuffer *fb,
- return false;
- }
-
-- fb->bytes_pp = DIV_ROUND_UP(PIXMAN_FORMAT_BPP(fb->format), 8);
-+ bytes_pp = virtio_gpu_format_bytes_pp(fb->format);
- fb->width = ss->width;
- fb->height = ss->height;
- fb->stride = ss->strides[0];
-
-- if (fb->stride < (uint64_t)fb->width * fb->bytes_pp) {
-+ if (fb->stride < (uint64_t)fb->width * bytes_pp) {
- qemu_log_mask(LOG_GUEST_ERROR,
- "%s: stride %u too small for width %u at %u bpp\n",
-- __func__, fb->stride, fb->width, fb->bytes_pp);
-+ __func__, fb->stride, fb->width, bytes_pp);
- return false;
- }
-
-- fb->offset = ss->offsets[0] + ss->r.x * fb->bytes_pp + ss->r.y * fb->stride;
-+ fb->offset = ss->offsets[0] + ss->r.x * bytes_pp + ss->r.y * fb->stride;
-
- fbend = fb->offset;
- fbend += (uint64_t) fb->stride * ss->r.height;
-@@ -1223,8 +1231,7 @@ static const VMStateDescription vmstate_virtio_gpu_scanout = {
- VMSTATE_UINT32(cursor.pos.y, struct virtio_gpu_scanout),
- VMSTATE_UINT32_TEST(fb.format, struct virtio_gpu_scanout,
- scanout_vmstate_after_v2),
-- VMSTATE_UINT32_TEST(fb.bytes_pp, struct virtio_gpu_scanout,
-- scanout_vmstate_after_v2),
-+ VMSTATE_UNUSED_TEST(scanout_vmstate_after_v2, 4),
- VMSTATE_UINT32_TEST(fb.width, struct virtio_gpu_scanout,
- scanout_vmstate_after_v2),
- VMSTATE_UINT32_TEST(fb.height, struct virtio_gpu_scanout,
-diff --git a/include/hw/virtio/virtio-gpu.h b/include/hw/virtio/virtio-gpu.h
-index b9bad27c97..2f60c72078 100644
---- a/include/hw/virtio/virtio-gpu.h
-+++ b/include/hw/virtio/virtio-gpu.h
-@@ -66,7 +66,6 @@ struct virtio_gpu_simple_resource {
-
- struct virtio_gpu_framebuffer {
- pixman_format_code_t format;
-- uint32_t bytes_pp;
- uint32_t width, height;
- uint32_t stride;
- uint32_t offset;
diff --git a/debian/patches/extra/0009-hw-display-virtio-gpu-reject-strides-exceeding-INT_M.patch b/debian/patches/extra/0009-hw-display-virtio-gpu-reject-strides-exceeding-INT_M.patch
deleted file mode 100644
index c82bcf6e27..0000000000
--- a/debian/patches/extra/0009-hw-display-virtio-gpu-reject-strides-exceeding-INT_M.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
-Date: Fri, 17 Jul 2026 16:41:36 +0900
-Subject: [PATCH] hw/display/virtio-gpu: reject strides exceeding INT_MAX
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-VIRTIO_GPU_CMD_SET_SCANOUT_BLOB supplies a guest-controlled uint32_t
-stride, but some downstream consumers take it as int. They may interpret
-a value greater than INT_MAX as negative and cause issues:
-
-- pixman_image_create_bits() takes the stride as int, and Pixman may
- later access memory before the blob buffer.
-
-- eglCreateImageKHR() also takes the stride as EGLint when importing the
- DMA-BUF, and Mesa rejects it.
-
-Reject such strides before scanout.
-
-The check in virtio_gpu_scanout_blob_to_fb() rejects unsupported blob
-configurations early. The check added in virtio_gpu_do_set_scanout()
-covers migration post_load.
-
-Fixes: 32db3c63ae11 ("virtio-gpu: Add virtio_gpu_set_scanout_blob")
-Signed-off-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
-Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
-Message-ID: <20260717-int-v1-1-8aa05e1791a0@rsg.ci.i.u-tokyo.ac.jp>
-(cherry picked from commit 9c724426f5192845b5975dc48165de06a3da50b2)
-[FE: backport on top of hw/display/virtio-gpu: Remove the bytes_pp field]
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- hw/display/virtio-gpu.c | 15 +++++++++++++++
- 1 file changed, 15 insertions(+)
-
-diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
-index c83cbfca45..e049ddffa4 100644
---- a/hw/display/virtio-gpu.c
-+++ b/hw/display/virtio-gpu.c
-@@ -660,6 +660,14 @@ static bool virtio_gpu_do_set_scanout(VirtIOGPU *g,
- return false;
- }
-
-+ if (fb->stride > INT_MAX) {
-+ qemu_log_mask(LOG_GUEST_ERROR, "%s: stride is %" PRIu32
-+ ", larger than the supported maximum (%d)\n",
-+ __func__, fb->stride, INT_MAX);
-+ *error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;
-+ return false;
-+ }
-+
- g->parent_obj.enable = 1;
-
- if (res->blob) {
-@@ -781,6 +789,13 @@ bool virtio_gpu_scanout_blob_to_fb(struct virtio_gpu_framebuffer *fb,
- return false;
- }
-
-+ if (fb->stride > INT_MAX) {
-+ qemu_log_mask(LOG_GUEST_ERROR, "%s: stride is %" PRIu32
-+ ", larger than the supported maximum (%d)\n",
-+ __func__, fb->stride, INT_MAX);
-+ return false;
-+ }
-+
- fb->offset = ss->offsets[0] + ss->r.x * bytes_pp + ss->r.y * fb->stride;
-
- fbend = fb->offset;
diff --git a/debian/patches/extra/0010-intel_iommu-fix-guest-triggerable-abort-on-oversized.patch b/debian/patches/extra/0010-intel_iommu-fix-guest-triggerable-abort-on-oversized.patch
deleted file mode 100644
index 20b2119795..0000000000
--- a/debian/patches/extra/0010-intel_iommu-fix-guest-triggerable-abort-on-oversized.patch
+++ /dev/null
@@ -1,273 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Junjie Cao <junjie.cao@intel.com>
-Date: Fri, 15 May 2026 02:07:02 +0800
-Subject: [PATCH] intel_iommu: fix guest-triggerable abort on oversized MMIO
- access
-
-An 8-byte guest access to a 32-bit-only VT-d register hit
-assert(size == 4) and aborted QEMU. Remove all 25 asserts.
-
-All 3 read-side and 18 of 22 write-side asserts are at
-non-8-aligned offsets (unreachable, rejected by
-memory_region_access_valid()) -- simply deleted.
-
-The remaining 4, all writes at 8-aligned offsets, are
-reachable: FECTL 0x38, IECTL 0xa0, IEADDR 0xa8, PECTL 0xe0.
-Truncating the high half via vtd_set_long() matches prior
-behavior; log under -d guest_errors since the VT-d spec is
-silent on oversized accesses to 32-bit registers, and add a
-comment so future maintainers don't delete the check as
-"harmless". min_access_size stays 4, so all size-based
-branches on 64-bit register pairs are preserved.
-
-Found by generic-fuzz (24 distinct crash seeds, all fixed).
-
-Suggested-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Signed-off-by: Junjie Cao <junjie.cao@intel.com>
-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-Reviewed-by: Yi Liu <yi.l.liu@intel.com>
-Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
-Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
-Message-Id: <20260514180703.85686-2-junjie.cao@intel.com>
-(cherry picked from commit a35c5755d9422f5f7b289ad7389efc8269ddfacd)
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- hw/i386/intel_iommu.c | 74 ++++++++++++++++++++++++++++---------------
- 1 file changed, 49 insertions(+), 25 deletions(-)
-
-diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
-index 7b2cead8f8..65e6b6d845 100644
---- a/hw/i386/intel_iommu.c
-+++ b/hw/i386/intel_iommu.c
-@@ -21,6 +21,7 @@
-
- #include "qemu/osdep.h"
- #include "qemu/error-report.h"
-+#include "qemu/log.h"
- #include "qemu/main-loop.h"
- #include "qapi/error.h"
- #include "hw/core/sysbus.h"
-@@ -3713,7 +3714,6 @@ static uint64_t vtd_mem_read(void *opaque, hwaddr addr, unsigned size)
- break;
-
- case DMAR_RTADDR_REG_HI:
-- assert(size == 4);
- val = vtd_get_quad_raw(s, DMAR_RTADDR_REG) >> 32;
- break;
-
-@@ -3728,12 +3728,10 @@ static uint64_t vtd_mem_read(void *opaque, hwaddr addr, unsigned size)
- break;
-
- case DMAR_IQA_REG_HI:
-- assert(size == 4);
- val = s->iq >> 32;
- break;
-
- case DMAR_PEUADDR_REG:
-- assert(size == 4);
- val = vtd_get_long_raw(s, DMAR_PEUADDR_REG);
- break;
-
-@@ -3779,7 +3777,6 @@ static void vtd_mem_write(void *opaque, hwaddr addr,
- break;
-
- case DMAR_CCMD_REG_HI:
-- assert(size == 4);
- vtd_set_long(s, addr, val);
- vtd_handle_ccmd_write(s);
- break;
-@@ -3795,13 +3792,11 @@ static void vtd_mem_write(void *opaque, hwaddr addr,
- break;
-
- case DMAR_IOTLB_REG_HI:
-- assert(size == 4);
- vtd_set_long(s, addr, val);
- vtd_handle_iotlb_write(s);
- break;
-
- case DMAR_PEUADDR_REG:
-- assert(size == 4);
- vtd_set_long(s, addr, val);
- break;
-
-@@ -3815,27 +3810,35 @@ static void vtd_mem_write(void *opaque, hwaddr addr,
- break;
-
- case DMAR_IVA_REG_HI:
-- assert(size == 4);
- vtd_set_long(s, addr, val);
- break;
-
- /* Fault Status Register, 32-bit */
- case DMAR_FSTS_REG:
-- assert(size == 4);
- vtd_set_long(s, addr, val);
- vtd_handle_fsts_write(s);
- break;
-
- /* Fault Event Control Register, 32-bit */
- case DMAR_FECTL_REG:
-- assert(size == 4);
-+ /*
-+ * 32-bit register at an 8-byte-aligned offset: a well-formed
-+ * 8-byte guest access reaches this handler. vtd_set_long()
-+ * takes uint32_t and truncates the high half -- undefined per
-+ * the VT-d spec but harmless here. Flag it under
-+ * -d guest_errors so the guest-side bug surfaces.
-+ */
-+ if (size != 4) {
-+ qemu_log_mask(LOG_GUEST_ERROR,
-+ "%s: invalid %u-byte access to 32-bit reg "
-+ "addr=0x%" PRIx64 "\n", __func__, size, addr);
-+ }
- vtd_set_long(s, addr, val);
- vtd_handle_fectl_write(s);
- break;
-
- /* Fault Event Data Register, 32-bit */
- case DMAR_FEDATA_REG:
-- assert(size == 4);
- vtd_set_long(s, addr, val);
- break;
-
-@@ -3854,13 +3857,11 @@ static void vtd_mem_write(void *opaque, hwaddr addr,
-
- /* Fault Event Upper Address Register, 32-bit */
- case DMAR_FEUADDR_REG:
-- assert(size == 4);
- vtd_set_long(s, addr, val);
- break;
-
- /* Protected Memory Enable Register, 32-bit */
- case DMAR_PMEN_REG:
-- assert(size == 4);
- vtd_set_long(s, addr, val);
- break;
-
-@@ -3874,7 +3875,6 @@ static void vtd_mem_write(void *opaque, hwaddr addr,
- break;
-
- case DMAR_RTADDR_REG_HI:
-- assert(size == 4);
- vtd_set_long(s, addr, val);
- break;
-
-@@ -3889,7 +3889,6 @@ static void vtd_mem_write(void *opaque, hwaddr addr,
- break;
-
- case DMAR_IQT_REG_HI:
-- assert(size == 4);
- vtd_set_long(s, addr, val);
- /* 19:63 of IQT_REG is RsvdZ, do nothing here */
- break;
-@@ -3905,39 +3904,57 @@ static void vtd_mem_write(void *opaque, hwaddr addr,
- break;
-
- case DMAR_IQA_REG_HI:
-- assert(size == 4);
- vtd_set_long(s, addr, val);
- break;
-
- /* Invalidation Completion Status Register, 32-bit */
- case DMAR_ICS_REG:
-- assert(size == 4);
- vtd_set_long(s, addr, val);
- vtd_handle_ics_write(s);
- break;
-
- /* Invalidation Event Control Register, 32-bit */
- case DMAR_IECTL_REG:
-- assert(size == 4);
-+ /*
-+ * 32-bit register at an 8-byte-aligned offset: a well-formed
-+ * 8-byte guest access reaches this handler. vtd_set_long()
-+ * takes uint32_t and truncates the high half -- undefined per
-+ * the VT-d spec but harmless here. Flag it under
-+ * -d guest_errors so the guest-side bug surfaces.
-+ */
-+ if (size != 4) {
-+ qemu_log_mask(LOG_GUEST_ERROR,
-+ "%s: invalid %u-byte access to 32-bit reg "
-+ "addr=0x%" PRIx64 "\n", __func__, size, addr);
-+ }
- vtd_set_long(s, addr, val);
- vtd_handle_iectl_write(s);
- break;
-
- /* Invalidation Event Data Register, 32-bit */
- case DMAR_IEDATA_REG:
-- assert(size == 4);
- vtd_set_long(s, addr, val);
- break;
-
- /* Invalidation Event Address Register, 32-bit */
- case DMAR_IEADDR_REG:
-- assert(size == 4);
-+ /*
-+ * 32-bit register at an 8-byte-aligned offset: a well-formed
-+ * 8-byte guest access reaches this handler. vtd_set_long()
-+ * takes uint32_t and truncates the high half -- undefined per
-+ * the VT-d spec but harmless here. Flag it under
-+ * -d guest_errors so the guest-side bug surfaces.
-+ */
-+ if (size != 4) {
-+ qemu_log_mask(LOG_GUEST_ERROR,
-+ "%s: invalid %u-byte access to 32-bit reg "
-+ "addr=0x%" PRIx64 "\n", __func__, size, addr);
-+ }
- vtd_set_long(s, addr, val);
- break;
-
- /* Invalidation Event Upper Address Register, 32-bit */
- case DMAR_IEUADDR_REG:
-- assert(size == 4);
- vtd_set_long(s, addr, val);
- break;
-
-@@ -3951,7 +3968,6 @@ static void vtd_mem_write(void *opaque, hwaddr addr,
- break;
-
- case DMAR_FRCD_REG_0_1:
-- assert(size == 4);
- vtd_set_long(s, addr, val);
- break;
-
-@@ -3966,7 +3982,6 @@ static void vtd_mem_write(void *opaque, hwaddr addr,
- break;
-
- case DMAR_FRCD_REG_0_3:
-- assert(size == 4);
- vtd_set_long(s, addr, val);
- /* May clear bit 127 (Fault), update PPF */
- vtd_update_fsts_ppf(s);
-@@ -3981,18 +3996,27 @@ static void vtd_mem_write(void *opaque, hwaddr addr,
- break;
-
- case DMAR_IRTA_REG_HI:
-- assert(size == 4);
- vtd_set_long(s, addr, val);
- break;
-
- case DMAR_PRS_REG:
-- assert(size == 4);
- vtd_set_long(s, addr, val);
- vtd_handle_prs_write(s);
- break;
-
- case DMAR_PECTL_REG:
-- assert(size == 4);
-+ /*
-+ * 32-bit register at an 8-byte-aligned offset: a well-formed
-+ * 8-byte guest access reaches this handler. vtd_set_long()
-+ * takes uint32_t and truncates the high half -- undefined per
-+ * the VT-d spec but harmless here. Flag it under
-+ * -d guest_errors so the guest-side bug surfaces.
-+ */
-+ if (size != 4) {
-+ qemu_log_mask(LOG_GUEST_ERROR,
-+ "%s: invalid %u-byte access to 32-bit reg "
-+ "addr=0x%" PRIx64 "\n", __func__, size, addr);
-+ }
- vtd_set_long(s, addr, val);
- vtd_handle_pectl_write(s);
- break;
diff --git a/debian/patches/extra/0011-backends-rng-cap-request-size-to-avoid-oversized-all.patch b/debian/patches/extra/0011-backends-rng-cap-request-size-to-avoid-oversized-all.patch
deleted file mode 100644
index 722f613643..0000000000
--- a/debian/patches/extra/0011-backends-rng-cap-request-size-to-avoid-oversized-all.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Laurent Vivier <lvivier@redhat.com>
-Date: Wed, 15 Jul 2026 16:13:00 +0200
-Subject: [PATCH] backends/rng: cap request size to avoid oversized allocation
-
-rng_backend_request_entropy() uses the requested size to allocate
-a buffer with g_malloc(). With virtio-rng, this size comes from
-guest-supplied descriptor lengths. A malicious guest can set a very
-large descriptor length, causing QEMU to attempt a multi-gigabyte
-allocation and abort.
-
-Cap the allocation to 64 KiB. The virtio-rng queue size is
-hardcoded to 8 entries, the EGD backend protocol limits requests
-to 255 bytes, the Linux kernel hwrng framework requests at most
-SMP_CACHE_BYTES per call (64 bytes on x86_64), and the Windows
-viorng driver uses a 4 KiB buffer. The worst legitimate case is
-8 x 4 KiB = 32 KiB, so 64 KiB is well above any legitimate use.
-
-Fixes: 14417039653d ("virtio-rng: use virtqueue_get_avail_bytes, fix migration")
-Cc: qemu-stable@nongnu.org
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3983
-Signed-off-by: Laurent Vivier <lvivier@redhat.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Link: https://lore.kernel.org/qemu-devel/20260715141300.2295392-1-lvivier@redhat.com
-(picked from qemu-devel)
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- backends/rng.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/backends/rng.c b/backends/rng.c
-index ab94dfea85..d8904f89dc 100644
---- a/backends/rng.c
-+++ b/backends/rng.c
-@@ -11,11 +11,14 @@
- */
-
- #include "qemu/osdep.h"
-+#include "qemu/units.h"
- #include "system/rng.h"
- #include "qapi/error.h"
- #include "qemu/module.h"
- #include "qom/object_interfaces.h"
-
-+#define RNG_MAX_REQUEST_SIZE (64 * KiB)
-+
- void rng_backend_request_entropy(RngBackend *s, size_t size,
- EntropyReceiveFunc *receive_entropy,
- void *opaque)
-@@ -27,7 +30,7 @@ void rng_backend_request_entropy(RngBackend *s, size_t size,
- req = g_malloc(sizeof(*req));
-
- req->offset = 0;
-- req->size = size;
-+ req->size = MIN(size, RNG_MAX_REQUEST_SIZE);
- req->receive_entropy = receive_entropy;
- req->opaque = opaque;
- req->data = g_malloc(req->size);
diff --git a/debian/patches/extra/0012-hw-ide-replace-assert-with-proper-error-handling.patch b/debian/patches/extra/0012-hw-ide-replace-assert-with-proper-error-handling.patch
deleted file mode 100644
index e903eb8464..0000000000
--- a/debian/patches/extra/0012-hw-ide-replace-assert-with-proper-error-handling.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Artem Nasonov <anasonov@astralinux.ru>
-Date: Wed, 22 Jul 2026 12:41:11 +0200
-Subject: [PATCH] hw/ide: replace assert with proper error handling
-
-In ide_dma_cb(), the call to prepare_buf() might return a negative
-result and cause an assertion failure. This was found during fuzzing
-and can be triggered with some qtest commands. Replace the assert with
-proper error handling in case the result is negative, but keep the
-assert for failing to respect the limit upon success. If that happens,
-it is an implementation error.
-
-Found by Linux Verification Center (linuxtesting.org) with libFuzzer.
-
-Cc: qemu-stable@nongnu.org
-Fixes: ed78352a59 ("ide: Fix incorrect handling of some PRDTs in ide_dma_cb()")
-Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/2777
-Signed-off-by: Artem Nasonov <anasonov@astralinux.ru>
-Link: https://lore.kernel.org/qemu-devel/20250116111600.2570490-1-anasonov@astralinux.ru
-[FE: improve commit message
- keep assert for failing to respect the limit]
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
-(cherry picked from commit 443e02410695b35a27fad18217424b6370358be7)
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- hw/ide/core.c | 8 ++++++--
- 1 file changed, 6 insertions(+), 2 deletions(-)
-
-diff --git a/hw/ide/core.c b/hw/ide/core.c
-index f78b00220b..4c1ee19d8e 100644
---- a/hw/ide/core.c
-+++ b/hw/ide/core.c
-@@ -921,8 +921,12 @@ static void ide_dma_cb(void *opaque, int ret)
- s->io_buffer_index = 0;
- s->io_buffer_size = n * 512;
- prep_size = s->bus->dma->ops->prepare_buf(s->bus->dma, s->io_buffer_size);
-- /* prepare_buf() must succeed and respect the limit */
-- assert(prep_size >= 0 && prep_size <= n * 512);
-+ if (prep_size < 0) {
-+ ide_dma_error(s);
-+ return;
-+ }
-+ /* If prepare_buf() succeeds, it must respect the limit. */
-+ assert(prep_size <= n * 512);
-
- /*
- * Now prep_size stores the number of bytes in the sglist, and
diff --git a/debian/patches/extra/0013-hw-virtio-reject-zero-length-packed-indirect-descrip.patch b/debian/patches/extra/0013-hw-virtio-reject-zero-length-packed-indirect-descrip.patch
deleted file mode 100644
index d406849fd5..0000000000
--- a/debian/patches/extra/0013-hw-virtio-reject-zero-length-packed-indirect-descrip.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Laurent Vivier <lvivier@redhat.com>
-Date: Sun, 26 Jul 2026 17:29:14 -0400
-Subject: [PATCH] hw/virtio: reject zero-length packed indirect descriptor
- table
-
-The split-ring path already rejects a zero-length indirect descriptor
-table since commit 7423192912af ("virtio: add checks for the size of
-the indirect table"). The packed-ring path is missing the same check,
-allowing a guest to trigger an assertion in address_space_cache_init()
-with a packed indirect descriptor that has len=0.
-
-Add the same !desc.len check to the packed-ring indirect validation
-in both virtqueue_packed_get_avail_bytes() and virtqueue_packed_pop().
-
-Fixes: 86044b24e865 ("virtio: basic packed virtqueue support")
-Cc: jasowangio@gmail.com
-Cc: qemu-stable@nongnu.org
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3984
-Signed-off-by: Laurent Vivier <lvivier@redhat.com>
-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
-Message-ID: <20260715115040.2186274-1-lvivier@redhat.com>
-Link: https://lore.kernel.org/qemu-devel/ca94a10f025b2da0cd9100176eea16cddcf6bd06.1785101237.git.mst@redhat.com
-(picked from qemu-devel)
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- hw/virtio/virtio.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
-index b337c50c74..0dfecc54cc 100644
---- a/hw/virtio/virtio.c
-+++ b/hw/virtio/virtio.c
-@@ -1475,7 +1475,7 @@ static void virtqueue_packed_get_avail_bytes(VirtQueue *vq,
- }
-
- if (desc.flags & VRING_DESC_F_INDIRECT) {
-- if (desc.len % sizeof(VRingPackedDesc)) {
-+ if (!desc.len || (desc.len % sizeof(VRingPackedDesc))) {
- virtio_error(vdev, "Invalid size for indirect buffer table");
- goto err;
- }
-@@ -1927,7 +1927,7 @@ static void *virtqueue_packed_pop(VirtQueue *vq, size_t sz)
- vring_packed_desc_read(vdev, &desc, desc_cache, i, true);
- id = desc.id;
- if (desc.flags & VRING_DESC_F_INDIRECT) {
-- if (desc.len % sizeof(VRingPackedDesc)) {
-+ if (!desc.len || (desc.len % sizeof(VRingPackedDesc))) {
- virtio_error(vdev, "Invalid size for indirect buffer table");
- goto done;
- }
diff --git a/debian/patches/extra/0014-hw-net-virtio-net-Protect-from-DMA-re-entrancy-bugs.patch b/debian/patches/extra/0014-hw-net-virtio-net-Protect-from-DMA-re-entrancy-bugs.patch
deleted file mode 100644
index 4fd852f20f..0000000000
--- a/debian/patches/extra/0014-hw-net-virtio-net-Protect-from-DMA-re-entrancy-bugs.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Laurent Vivier <lvivier@redhat.com>
-Date: Sun, 26 Jul 2026 17:30:08 -0400
-Subject: [PATCH] hw/net/virtio-net: Protect from DMA re-entrancy bugs
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Replace qemu_bh_new_guarded() by virtio_bh_new_guarded()
-so the bus and device use the same guard. Otherwise the
-DMA-reentrancy protection can be bypassed.
-
-This update was missing in CVE-2024-3446 fix.
-
-Fixes: CVE-2026-66022
-Cc: qemu-stable@nongnu.org
-Cc: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
-Cc: alxndr@bu.edu
-Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4073
-Signed-off-by: Laurent Vivier <lvivier@redhat.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
-Message-ID: <20260723233555.2970619-1-lvivier@redhat.com>
-Link: https://lore.kernel.org/qemu-devel/025b8841f731776bbc8278a552a412f8244f835e.1785101237.git.mst@redhat.com
-(picked from qemu-devel)
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- hw/net/virtio-net.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
-index f0e3beb290..7033664ac0 100644
---- a/hw/net/virtio-net.c
-+++ b/hw/net/virtio-net.c
-@@ -2991,8 +2991,9 @@ static void virtio_net_add_queue(VirtIONet *n, int index)
- n->vqs[index].tx_vq =
- virtio_add_queue(vdev, n->net_conf.tx_queue_size,
- virtio_net_handle_tx_bh);
-- n->vqs[index].tx_bh = qemu_bh_new_guarded(virtio_net_tx_bh, &n->vqs[index],
-- &DEVICE(vdev)->mem_reentrancy_guard);
-+ n->vqs[index].tx_bh = virtio_bh_new_guarded(DEVICE(vdev),
-+ virtio_net_tx_bh,
-+ &n->vqs[index]);
- }
-
- n->vqs[index].tx_waiting = 0;
diff --git a/debian/patches/extra/0015-hw-display-qxl-unregister-vm_change_state-handler-an.patch b/debian/patches/extra/0015-hw-display-qxl-unregister-vm_change_state-handler-an.patch
deleted file mode 100644
index 66e4a3cebb..0000000000
--- a/debian/patches/extra/0015-hw-display-qxl-unregister-vm_change_state-handler-an.patch
+++ /dev/null
@@ -1,95 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Haotian Jiang <sundayjiang@tencent.com>
-Date: Mon, 27 Jul 2026 15:51:13 +0400
-Subject: [PATCH] hw/display/qxl: unregister vm_change_state handler and BHs
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-qxl_realize_common() registers a vm_change_state handler via
-qemu_add_vm_change_state_handler() and creates three bottom halves
-(update_irq, update_area_bh, cursor_bh), but none are ever cleaned up.
-The return value of qemu_add_vm_change_state_handler() is discarded, so
-the handler is never removed from the global list, and there is no
-PCIDeviceClass.exit callback to delete the BHs.
-
-When a secondary QXL device (hotpluggable by default) is hot-unplugged
-via device_del, the PCIQXLDevice memory is freed but the vm_state
-handler and BH entries remain with dangling opaque pointers. On the
-next VM state change (stop/cont/migrate) or BH dispatch, the callback
-dereferences freed memory, causing a use-after-free.
-
-Fix this by storing the VMChangeStateEntry returned by
-qemu_add_vm_change_state_handler() and adding a qxl_exit() callback
-that deletes the vm_state handler, all three BHs, and the
-guest_surfaces.cmds allocation before the device memory is freed.
-
-Fixes: a19cbfb34642 ("spice: add qxl device")
-Fixes: CVE-2026-63322
-Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3607
-Signed-off-by: Haotian Jiang <jianghaotian.sunday@gmail.com>
-Cc: qemu-stable@nongnu.org
-[ Marc-André - tweak commit message, add TODO ]
-Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
-Message-ID: <20260720024855.3757499-1-jianghaotian.sunday@gmail.com>
-Link: https://lore.kernel.org/qemu-devel/20260727-fix-v1-4-ca3fa3851347@redhat.com
-(picked from qemu-devel)
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- hw/display/qxl.c | 16 +++++++++++++++-
- hw/display/qxl.h | 1 +
- 2 files changed, 16 insertions(+), 1 deletion(-)
-
-diff --git a/hw/display/qxl.c b/hw/display/qxl.c
-index 41d4ce9571..3a9d147096 100644
---- a/hw/display/qxl.c
-+++ b/hw/display/qxl.c
-@@ -2233,7 +2233,8 @@ static void qxl_realize_common(PCIQXLDevice *qxl, Error **errp)
- error_report_err(err);
- }
-
-- qemu_add_vm_change_state_handler(qxl_vm_change_state_handler, qxl);
-+ qxl->vmstate_handler =
-+ qemu_add_vm_change_state_handler(qxl_vm_change_state_handler, qxl);
-
- qxl->update_irq = qemu_bh_new_guarded(qxl_update_irq_bh, qxl,
- &DEVICE(qxl)->mem_reentrancy_guard);
-@@ -2507,6 +2508,18 @@ static const Property qxl_properties[] = {
- DEFINE_PROP_UINT32("yres", PCIQXLDevice, yres, 0),
- };
-
-+static void qxl_exit(PCIDevice *dev)
-+{
-+ PCIQXLDevice *qxl = PCI_QXL(dev);
-+
-+ /* TODO: complete cleanup, error paths etc */
-+ g_clear_pointer(&qxl->vmstate_handler, qemu_del_vm_change_state_handler);
-+ g_clear_pointer(&qxl->update_irq, qemu_bh_delete);
-+ g_clear_pointer(&qxl->update_area_bh, qemu_bh_delete);
-+ g_clear_pointer(&qxl->ssd.cursor_bh, qemu_bh_delete);
-+ g_clear_pointer(&qxl->guest_surfaces.cmds, g_free);
-+}
-+
- static void qxl_pci_class_init(ObjectClass *klass, const void *data)
- {
- DeviceClass *dc = DEVICE_CLASS(klass);
-@@ -2514,6 +2527,7 @@ static void qxl_pci_class_init(ObjectClass *klass, const void *data)
-
- k->vendor_id = REDHAT_PCI_VENDOR_ID;
- k->device_id = QXL_DEVICE_ID_STABLE;
-+ k->exit = qxl_exit;
- set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
- device_class_set_legacy_reset(dc, qxl_reset_handler);
- dc->vmsd = &qxl_vmstate;
-diff --git a/hw/display/qxl.h b/hw/display/qxl.h
-index e0a85a5ca4..ddbab3d693 100644
---- a/hw/display/qxl.h
-+++ b/hw/display/qxl.h
-@@ -83,6 +83,7 @@ struct PCIQXLDevice {
-
- /* thread signaling */
- QEMUBH *update_irq;
-+ VMChangeStateEntry *vmstate_handler;
-
- /* ram pci bar */
- QXLRam *ram;
diff --git a/debian/patches/extra/0016-hw-ide-core-Fix-possible-crash-via-NULL-pointer-in-i.patch b/debian/patches/extra/0016-hw-ide-core-Fix-possible-crash-via-NULL-pointer-in-i.patch
deleted file mode 100644
index 9f4b5a50be..0000000000
--- a/debian/patches/extra/0016-hw-ide-core-Fix-possible-crash-via-NULL-pointer-in-i.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Thomas Huth <thuth@redhat.com>
-Date: Mon, 27 Jul 2026 14:52:05 +0200
-Subject: [PATCH] hw/ide/core: Fix possible crash via NULL pointer in
- ide_cancel_dma_sync()
-
-ide_cancel_dma_sync() is called with a "IDEState *s" for one of the
-two IDE drives on a bus (primary or secondary drive) to cancel all
-pending DMA transfers on the drive. The code then checks
-s->bus->dma->aiocb to see whether there is any IO in flight on the
-*bus* and then calls blk_drain(s->blk) to wait for its completion.
-However, s->bus->dma->aiocb might belong to the other drive on the
-bus, and if there is no disk attached to the current drive, s->blk
-is NULL. Since blk_drain() does not check its parameter for a NULL
-pointer, QEMU can crash in such a case.
-
-To fix the problem, we have to check that "blk" is not NULL before
-calling blk_drain(). And we have to call blk_drain() for both drives,
-otherwise the assert(s->bus->dma->aiocb == NULL) statement after
-the blk_drain() might trigger if the IO in flight belongs to the
-the other drive.
-
-Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/905
-Reported-by: Alexander Bulekov <alxndr@bu.edu>
-Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4052
-Reported-by: dong ling
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-Message-ID: <20260721070216.82984-1-thuth@redhat.com>
-Link: https://lore.kernel.org/qemu-devel/20260727125207.646148-4-thuth@redhat.com
-(picked from qemu-devel)
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- hw/ide/core.c | 9 ++++++++-
- 1 file changed, 8 insertions(+), 1 deletion(-)
-
-diff --git a/hw/ide/core.c b/hw/ide/core.c
-index 4c1ee19d8e..fb9bf11b45 100644
---- a/hw/ide/core.c
-+++ b/hw/ide/core.c
-@@ -741,10 +741,17 @@ void ide_cancel_dma_sync(IDEState *s)
- * In the future we'll be able to safely cancel the I/O if the
- * whole DMA operation will be submitted to disk with a single
- * aio operation with preadv/pwritev.
-+ *
-+ * Note: s->bus->dma->aiocb might belong to the adjacent IDEState,
-+ * so we have to drain both drives to get it cleared.
- */
- if (s->bus->dma->aiocb) {
- trace_ide_cancel_dma_sync_remaining();
-- blk_drain(s->blk);
-+ for (int i = 0; i < 2; i++) {
-+ if (s->bus->ifs[i].blk) {
-+ blk_drain(s->bus->ifs[i].blk);
-+ }
-+ }
- assert(s->bus->dma->aiocb == NULL);
- }
- }
diff --git a/debian/patches/extra/0017-hw-usb-core-Avoid-possible-assert-in-do_parameter-us.patch b/debian/patches/extra/0017-hw-usb-core-Avoid-possible-assert-in-do_parameter-us.patch
deleted file mode 100644
index 2979f6ce1f..0000000000
--- a/debian/patches/extra/0017-hw-usb-core-Avoid-possible-assert-in-do_parameter-us.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Thomas Huth <thuth@redhat.com>
-Date: Mon, 27 Jul 2026 14:52:06 +0200
-Subject: [PATCH] hw/usb/core: Avoid possible assert() in do_parameter() -->
- usb_packet_copy()
-
-usb_packet_copy() uses assert(p->actual_length + bytes <= iov->size)
-to make sure that there is enough space in the the iov. This assert()
-can be triggered from do_parameter() if the guest programs the XHCI
-in a weird way. Avoid the hard error by checking for the condition
-in do_parameter() first and signalling a USB_RET_STALL to the guest,
-just like it is done for another error condition here already some
-lines earlier.
-
-Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3746
-Reported-by: Yunhe Wang <yunhewwww@163.com>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-Message-ID: <20260721185140.247775-1-thuth@redhat.com>
-Link: https://lore.kernel.org/qemu-devel/20260727125207.646148-5-thuth@redhat.com
-(picked from qemu-devel)
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- hw/usb/core.c | 10 ++++++++++
- 1 file changed, 10 insertions(+)
-
-diff --git a/hw/usb/core.c b/hw/usb/core.c
-index 9572a870cc..11f484b9ad 100644
---- a/hw/usb/core.c
-+++ b/hw/usb/core.c
-@@ -26,6 +26,7 @@
- #include "qemu/osdep.h"
- #include "hw/usb/usb.h"
- #include "qemu/iov.h"
-+#include "qemu/log.h"
- #include "trace.h"
-
- void usb_pick_speed(USBPort *port)
-@@ -288,6 +289,15 @@ static void do_parameter(USBDevice *s, USBPacket *p)
- p->status = USB_RET_STALL;
- return;
- }
-+ if ((p->pid == USB_TOKEN_OUT || p->pid == USB_TOKEN_IN) &&
-+ setup_len > p->iov.size) {
-+ qemu_log_mask(LOG_GUEST_ERROR,
-+ "xhci: setup state param length %u > iov size %zu\n",
-+ setup_len, p->iov.size);
-+ p->status = USB_RET_STALL;
-+ return;
-+ }
-+
- s->setup_len = setup_len;
-
- if (p->pid == USB_TOKEN_OUT) {
diff --git a/debian/patches/extra/0018-hw-usb-hcd-xhci-Check-return-value-of-xhci_xfer_crea.patch b/debian/patches/extra/0018-hw-usb-hcd-xhci-Check-return-value-of-xhci_xfer_crea.patch
deleted file mode 100644
index 386c5fea07..0000000000
--- a/debian/patches/extra/0018-hw-usb-hcd-xhci-Check-return-value-of-xhci_xfer_crea.patch
+++ /dev/null
@@ -1,67 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Thomas Huth <thuth@redhat.com>
-Date: Mon, 27 Jul 2026 14:52:07 +0200
-Subject: [PATCH] hw/usb/hcd-xhci: Check return value of xhci_xfer_create_sgl()
- for errors
-
-xhci_xfer_create_sgl() can fail if a guest programmed the XHCI in
-a weird way. The current code ignores this error, and this triggers
-an assert() shortly afterwards:
-
- hw/usb/core.c:612: usb_packet_copy:
- Assertion `p->actual_length + bytes <= iov->size' failed.
-
-Fix it by handling the error correctly (i.e. return with an error to
-the caller).
-
-While we're at it, change the DPRINTF statements in xhci_xfer_create_sgl()
-into proper qemu_log_mask() statements, so we have a better way to detect
-this situation.
-
-Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3786
-Reported-by: Feifan Qian <bea1e@proton.me>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-Message-ID: <20260724110933.629791-1-thuth@redhat.com>
-Link: https://lore.kernel.org/qemu-devel/20260727125207.646148-6-thuth@redhat.com
-(picked from qemu-devel)
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- hw/usb/hcd-xhci.c | 10 +++++++---
- 1 file changed, 7 insertions(+), 3 deletions(-)
-
-diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
-index 5131d05c6e..be06240cee 100644
---- a/hw/usb/hcd-xhci.c
-+++ b/hw/usb/hcd-xhci.c
-@@ -1465,7 +1465,8 @@ static int xhci_xfer_create_sgl(XHCITransfer *xfer, int in_xfer)
- switch (TRB_TYPE(*trb)) {
- case TR_DATA:
- if ((!(trb->control & TRB_TR_DIR)) != (!in_xfer)) {
-- DPRINTF("xhci: data direction mismatch for TR_DATA\n");
-+ qemu_log_mask(LOG_GUEST_ERROR,
-+ "xhci: data direction mismatch for TR_DATA\n");
- goto err;
- }
- /* fallthrough */
-@@ -1475,7 +1476,8 @@ static int xhci_xfer_create_sgl(XHCITransfer *xfer, int in_xfer)
- chunk = trb->status & 0x1ffff;
- if (trb->control & TRB_TR_IDT) {
- if (chunk > 8 || in_xfer) {
-- DPRINTF("xhci: invalid immediate data TRB\n");
-+ qemu_log_mask(LOG_GUEST_ERROR,
-+ "xhci: invalid immediate data TRB\n");
- goto err;
- }
- qemu_sglist_add(&xfer->sgl, trb->addr, chunk);
-@@ -1618,7 +1620,9 @@ static int xhci_setup_packet(XHCITransfer *xfer)
- }
- }
-
-- xhci_xfer_create_sgl(xfer, dir == USB_TOKEN_IN); /* Also sets int_req */
-+ if (xhci_xfer_create_sgl(xfer, dir == USB_TOKEN_IN) < 0) { /* Also sets int_req */
-+ return -1;
-+ }
- usb_packet_setup(&xfer->packet, dir, ep, xfer->streamid,
- xfer->trbs[0].addr, false, xfer->int_req);
- if (usb_packet_map(&xfer->packet, &xfer->sgl)) {
diff --git a/debian/patches/extra/0019-hw-display-vmware_vga-Don-t-allow-guest-to-trigger-l.patch b/debian/patches/extra/0019-hw-display-vmware_vga-Don-t-allow-guest-to-trigger-l.patch
deleted file mode 100644
index 76c6c4f803..0000000000
--- a/debian/patches/extra/0019-hw-display-vmware_vga-Don-t-allow-guest-to-trigger-l.patch
+++ /dev/null
@@ -1,72 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Thomas Huth <thuth@redhat.com>
-Date: Thu, 23 Jul 2026 14:44:32 +0200
-Subject: [PATCH] hw/display/vmware_vga: Don't allow guest to trigger long
- running loop in host
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The code in the SVGA_CMD_DEFINE_ALPHA_CURSOR handler in vmsvga_fifo_run()
-basically does:
-
- x = vmsvga_fifo_read(s);
- y = vmsvga_fifo_read(s);
- args = x * y;
- goto badcmd;
- ...
-badcmd:
- len -= args;
- if (len < 0) {
- goto rewind;
- }
- while (args--) {
- vmsvga_fifo_read(s);
- }
-
-Thus by supplying huge values for x and y that overflow the result of
-the multiplication, the guest can trigger a long-running loop here
-that burns the host's CPU cycles.
-
-Add some sanity checks so that this cannot happen anymore.
-
-Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3782
-Reported-by: Feifan Qian <bea1e@proton.me>
-Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4026
-Reported-by: Tristan Madani <tristan@talencesecurity.com>
-Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4076
-Reported-by: Sunday Jiang
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
-Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
-Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
-(cherry picked from commit f604b807a55acd3f81725bb7dbd98450c96adf00)
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- hw/display/vmware_vga.c | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/hw/display/vmware_vga.c b/hw/display/vmware_vga.c
-index c2c6bc76e9..a5b7048e87 100644
---- a/hw/display/vmware_vga.c
-+++ b/hw/display/vmware_vga.c
-@@ -737,6 +737,10 @@ static void vmsvga_fifo_run(struct vmsvga_state_s *s)
- vmsvga_fifo_read(s);
- x = vmsvga_fifo_read(s);
- y = vmsvga_fifo_read(s);
-+ if (x < 0 || x >= SVGA_MAX_WIDTH ||
-+ y < 0 || y >= SVGA_MAX_HEIGHT) {
-+ goto rewind;
-+ }
- args = x * y;
- goto badcmd;
- case SVGA_CMD_RECT_ROP_FILL:
-@@ -776,7 +780,7 @@ static void vmsvga_fifo_run(struct vmsvga_state_s *s)
- if (len < 0) {
- goto rewind;
- }
-- while (args--) {
-+ while (args-- > 0) {
- vmsvga_fifo_read(s);
- }
- printf("%s: Unknown command 0x%02x in SVGA command FIFO\n",
diff --git a/debian/patches/extra/0020-scsi-disk-fix-off-by-one-in-assertion.patch b/debian/patches/extra/0020-scsi-disk-fix-off-by-one-in-assertion.patch
deleted file mode 100644
index d6ea3200b4..0000000000
--- a/debian/patches/extra/0020-scsi-disk-fix-off-by-one-in-assertion.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Tue, 21 Jul 2026 17:56:42 +0200
-Subject: [PATCH] scsi-disk: fix off by one in assertion
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-When documenting the invariant that mode pages need to fit the smallest
-output buffer of all callers (which is SCSI_MAX_MODE_LEN), the expression
-used by the assertion was incorrect.
-
-Even though SCSI_MAX_MODE_LEN is indeed 256, using "length < 256" had
-two issues: 1) it used the wrong operator, since "length < ..." is more
-related to having room for extra data; 2) it missed the extra two bytes
-for page number and length.
-
-Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit e2da3d92744d12b0c2e554ed533a4c9011dbd975)
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- hw/scsi/scsi-disk.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
-index 5ba5b46c4f..25d94b01b1 100644
---- a/hw/scsi/scsi-disk.c
-+++ b/hw/scsi/scsi-disk.c
-@@ -1321,7 +1321,7 @@ static int mode_sense_page(SCSIDiskState *s, int page, uint8_t **p_outbuf,
- return -1;
- }
-
-- assert(length < 256);
-+ assert(length + 2 <= SCSI_MAX_MODE_LEN);
- (*p_outbuf)[0] = page;
- (*p_outbuf)[1] = length;
- *p_outbuf += length + 2;
diff --git a/debian/patches/extra/0021-target-i386-helper_sysret-Check-that-RCX-contains-a-.patch b/debian/patches/extra/0021-target-i386-helper_sysret-Check-that-RCX-contains-a-.patch
deleted file mode 100644
index 749ee6bcca..0000000000
--- a/debian/patches/extra/0021-target-i386-helper_sysret-Check-that-RCX-contains-a-.patch
+++ /dev/null
@@ -1,74 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Andrey Polivoda <apolivodaa433@gmail.com>
-Date: Mon, 8 Jun 2026 19:18:15 +1000
-Subject: [PATCH] target/i386: helper_sysret(): Check that RCX contains a
- canonical address when emulating an Intel CPU
-
-Intel and AMD CPUs implement SYSRETQ instruction differently.
-One of these differences is whether a canonicality check of the address that
-will be loaded to RIP is performed: Intel CPUs do this check, AMD CPUs don't.
-
-Currently, QEMU does not perform this check when emulating Intel CPUs.
-This patch corrects this by implementing the canonlicality check on a new RIP
-value from RCX and performing it only when emulating Intel CPUs.
-
-Flags and segment registers' caches are updated only after checking the new RIP
-value to ensure that CPU state is not modified in case the #GP(0) exception
-is raised due to the check failure.
-
-Cc: qemu-devel@nongnu.org
-Cc: Paolo Bonzini <pbonzini@redhat.com>
-Cc: Richard Henderson <richard.henderson@linaro.org>
-Fixes: 14ce26e75513 ("x86_64 target support")
-Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3223
-Signed-off-by: Andrey Polivoda <apolivodaa433@gmail.com>
-Link: https://lore.kernel.org/r/20260608091815.31303-1-apolivodaa433@gmail.com
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 51aa3f3e05772c38cb6f6d8e79eca0f6afaaace0)
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- target/i386/tcg/seg_helper.c | 17 +++++++++++++----
- 1 file changed, 13 insertions(+), 4 deletions(-)
-
-diff --git a/target/i386/tcg/seg_helper.c b/target/i386/tcg/seg_helper.c
-index 58aac72011..d5c174b7fd 100644
---- a/target/i386/tcg/seg_helper.c
-+++ b/target/i386/tcg/seg_helper.c
-@@ -1096,17 +1096,22 @@ void helper_sysret(CPUX86State *env, int dflag)
- selector = (env->star >> 48) & 0xffff;
- #ifdef TARGET_X86_64
- if (env->hflags & HF_LMA_MASK) {
-- cpu_load_eflags(env, (uint32_t)(env->regs[11]), TF_MASK | AC_MASK
-- | ID_MASK | IF_MASK | IOPL_MASK | VM_MASK | RF_MASK |
-- NT_MASK);
- if (dflag == 2) {
-+ uint64_t new_rip = env->regs[R_ECX];
-+ if (IS_INTEL_CPU(env)) {
-+ int shift = (get_pg_mode(env) & PG_MODE_LA57) ? 56 : 47;
-+ int64_t sext = (int64_t)new_rip >> shift;
-+ if (sext != 0 && sext != -1) {
-+ raise_exception_err_ra(env, EXCP0D_GPF, 0, GETPC());
-+ }
-+ }
- cpu_x86_load_seg_cache(env, R_CS, (selector + 16) | 3,
- 0, 0xffffffff,
- DESC_G_MASK | DESC_P_MASK |
- DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
- DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK |
- DESC_L_MASK);
-- env->eip = env->regs[R_ECX];
-+ env->eip = new_rip;
- } else {
- cpu_x86_load_seg_cache(env, R_CS, selector | 3,
- 0, 0xffffffff,
-@@ -1120,6 +1125,10 @@ void helper_sysret(CPUX86State *env, int dflag)
- DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
- DESC_S_MASK | (3 << DESC_DPL_SHIFT) |
- DESC_W_MASK | DESC_A_MASK);
-+
-+ cpu_load_eflags(env, (uint32_t)(env->regs[11]), TF_MASK | AC_MASK
-+ | ID_MASK | IF_MASK | IOPL_MASK | VM_MASK | RF_MASK |
-+ NT_MASK);
- } else
- #endif
- {
diff --git a/debian/patches/extra/0022-hw-9pfs-fix-O_TRUNC-bypass-on-read-only-export.patch b/debian/patches/extra/0022-hw-9pfs-fix-O_TRUNC-bypass-on-read-only-export.patch
deleted file mode 100644
index d8cbfccaea..0000000000
--- a/debian/patches/extra/0022-hw-9pfs-fix-O_TRUNC-bypass-on-read-only-export.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Christian Schoenebeck <qemu_oss@crudebyte.com>
-Date: Wed, 15 Jul 2026 18:10:00 +0200
-Subject: [PATCH] hw/9pfs: fix O_TRUNC bypass on read-only export
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Guest 9p client opening a file with O_TRUNC on a read-only 9p file
-system using 9p2000.u protocol version, allowed to bypass 9p
-server's read-only check, eventually causing file(s) being
-truncated to empty file(s) on host's read-only export.
-
-Root cause is that 9p server's read-only check is using Linux open
-flags like O_WRONLY, O_RDWR, O_TRUNC, but checking them against
-the 9p Topen request's "mode" parameter, which has a different
-encoding (Otrunc = 0x10 vs. O_TRUNC = 0x200).
-
-Fix this by checking against the "flags" variable instead of the
-protocol's "mode" option. Because the "flags" variable is already
-converted to Linux encoding by omode_to_uflags() for 9p2000.u and
-by get_dotl_openflags() for 9p2000.L protocol version.
-
-Only 9p2000.u was affected by this bypass, 9p2000.L uses the Linux
-format on protocol level already.
-
-Fixes: 2c74c2cb4b ("hw/9pfs: Read-only support for 9p export")
-Fixes: CVE-2026-63318
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/4000
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Link: https://lore.kernel.org/qemu-devel/E1wk2Dq-0019kY-JK@kylie.crudebyte.com
-Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
-(cherry picked from commit a0414545a212e27058fab7b057b018e75b8c4b13)
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- hw/9pfs/9p.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c
-index 85565a014e..a6a6ffa714 100644
---- a/hw/9pfs/9p.c
-+++ b/hw/9pfs/9p.c
-@@ -2162,8 +2162,8 @@ static void coroutine_fn v9fs_open(void *opaque)
- flags = omode_to_uflags(mode);
- }
- if (is_ro_export(&s->ctx)) {
-- if (mode & O_WRONLY || mode & O_RDWR ||
-- mode & O_APPEND || mode & O_TRUNC) {
-+ if (flags & O_WRONLY || flags & O_RDWR ||
-+ flags & O_APPEND || flags & O_TRUNC) {
- err = -EROFS;
- goto out;
- }
diff --git a/debian/patches/extra/0023-hw-9pfs-virtio-drain-in-flight-PDUs-before-virtio-9p.patch b/debian/patches/extra/0023-hw-9pfs-virtio-drain-in-flight-PDUs-before-virtio-9p.patch
deleted file mode 100644
index 1965921c94..0000000000
--- a/debian/patches/extra/0023-hw-9pfs-virtio-drain-in-flight-PDUs-before-virtio-9p.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Jia Jia <physicalmtea@gmail.com>
-Date: Thu, 23 Jul 2026 14:43:24 +0200
-Subject: [PATCH] hw/9pfs/virtio: drain in-flight PDUs before virtio-9p
- unrealize
-
-A guest can trigger a heap-use-after-free in the virtio transport
-unrealize path by submitting a Treaddir request and immediately
-ejecting the device via ACPI PCI hotplug. The unrealize path frees
-struct LocalData while a worker thread still holds a reference
-on it, causing a UAF in local_open_nofollow().
-
-Fix this by draining all in-flight 9p PDUs by calling v9fs_reset()
-before final server cleanup. This ensures all coroutines completed,
-all FIDs are closed, and no worker thread still holds references
-on 9p server state when it is freed.
-
-Fixes: 6cecf09373 ("virtio-9p-device: add minimal unrealize handler")
-Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3937
-Signed-off-by: Jia Jia <physicalmtea@gmail.com>
-[ Christian Schoenebeck: add commit log message. ]
-Link: https://lore.kernel.org/qemu-devel/bc503aefffd20b1806941b3ef708afbd92f0aef2.1784809978.git.qemu_oss@crudebyte.com
-Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
-(cherry picked from commit 210701c82e304622818989028e75192013cb81d8)
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- hw/9pfs/virtio-9p-device.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/hw/9pfs/virtio-9p-device.c b/hw/9pfs/virtio-9p-device.c
-index 50dc93091d..576a794ea4 100644
---- a/hw/9pfs/virtio-9p-device.c
-+++ b/hw/9pfs/virtio-9p-device.c
-@@ -243,6 +243,7 @@ static void virtio_9p_device_unrealize(DeviceState *dev)
- V9fsVirtioState *v = VIRTIO_9P(dev);
- V9fsState *s = &v->state;
-
-+ v9fs_reset(s); /* cancel all in-flight PDUs to prevent UAF */
- virtio_delete_queue(v->vq);
- virtio_cleanup(vdev);
- v9fs_device_unrealize_common(s);
diff --git a/debian/patches/extra/0024-vfio-pci-don-t-narrow-a-failed-config-read-to-a-plau.patch b/debian/patches/extra/0024-vfio-pci-don-t-narrow-a-failed-config-read-to-a-plau.patch
deleted file mode 100644
index b42e32135c..0000000000
--- a/debian/patches/extra/0024-vfio-pci-don-t-narrow-a-failed-config-read-to-a-plau.patch
+++ /dev/null
@@ -1,108 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: "Denis V. Lunev" <den@openvz.org>
-Date: Fri, 17 Jul 2026 14:22:29 +0200
-Subject: [PATCH] vfio/pci: don't narrow a failed config read to a plausible
- value
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-vfio_pci_read_config() signals a failed host-side read by returning
-(uint32_t)-1, regardless of the requested length. vfio_intx_enable()
-and vfio_pci_pre_reset() both narrowed that return value straight
-into a uint8_t/uint16_t local before checking anything, which
-truncates -1 into 0xff or 0xffff - values a real 1- or 2-byte
-register read can legitimately produce. From that point on, a
-failed read and real all-ones content are indistinguishable.
-
-Keep the full uint32_t result and check it against (uint32_t)-1
-before narrowing. In vfio_pci_pre_reset(), skip the corresponding
-write-back on a failed read instead of writing back constructed
-garbage to the device.
-
-Resolves: Coverity CID 1663684
-Resolves: Coverity CID 1663688
-Signed-off-by: Denis V. Lunev <den@openvz.org>
-CC: Alex Williamson <alex@shazbot.org>
-CC: Cédric Le Goater <clg@redhat.com>
-Link: https://lore.kernel.org/qemu-devel/20260717122232.468955-2-den@openvz.org
-[ clg: Added Coverity IDs ]
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit dff528657fc114119ece1478ad845b0292a87683)
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- hw/vfio/pci.c | 32 +++++++++++++++++++++++++-------
- 1 file changed, 25 insertions(+), 7 deletions(-)
-
-diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
-index 1945751ffd..721e92f8ff 100644
---- a/hw/vfio/pci.c
-+++ b/hw/vfio/pci.c
-@@ -331,10 +331,16 @@ static void vfio_irqchip_change(Notifier *notify, void *data)
- static bool vfio_intx_enable(VFIOPCIDevice *vdev, Error **errp)
- {
- PCIDevice *pdev = PCI_DEVICE(vdev);
-- uint8_t pin = vfio_pci_read_config(pdev, PCI_INTERRUPT_PIN, 1);
-+ uint32_t val = vfio_pci_read_config(pdev, PCI_INTERRUPT_PIN, 1);
-+ uint8_t pin;
- Error *err = NULL;
- int32_t fd;
-
-+ if (val == (uint32_t)-1) {
-+ error_setg(errp, "failed to read PCI_INTERRUPT_PIN");
-+ return false;
-+ }
-+ pin = val;
-
- if (!pin) {
- return true;
-@@ -2678,6 +2684,7 @@ bool vfio_pci_add_capabilities(VFIOPCIDevice *vdev, Error **errp)
- void vfio_pci_pre_reset(VFIOPCIDevice *vdev)
- {
- PCIDevice *pdev = PCI_DEVICE(vdev);
-+ uint32_t val;
- uint16_t cmd;
-
- vfio_disable_interrupts(vdev);
-@@ -2686,23 +2693,34 @@ void vfio_pci_pre_reset(VFIOPCIDevice *vdev)
- * Stop any ongoing DMA by disconnecting I/O, MMIO, and bus master.
- * Also put INTx Disable in known state.
- */
-- cmd = vfio_pci_read_config(pdev, PCI_COMMAND, 2);
-- cmd &= ~(PCI_COMMAND_IO | PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER |
-- PCI_COMMAND_INTX_DISABLE);
-- vfio_pci_write_config(pdev, PCI_COMMAND, cmd, 2);
-+ val = vfio_pci_read_config(pdev, PCI_COMMAND, 2);
-+ if (val != (uint32_t)-1) {
-+ cmd = val;
-+ cmd &= ~(PCI_COMMAND_IO | PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER |
-+ PCI_COMMAND_INTX_DISABLE);
-+ vfio_pci_write_config(pdev, PCI_COMMAND, cmd, 2);
-+ }
-
- /* Make sure the device is in D0 */
- if (pdev->pm_cap) {
- uint16_t pmcsr;
- uint8_t state;
-
-- pmcsr = vfio_pci_read_config(pdev, pdev->pm_cap + PCI_PM_CTRL, 2);
-+ val = vfio_pci_read_config(pdev, pdev->pm_cap + PCI_PM_CTRL, 2);
-+ if (val == (uint32_t)-1) {
-+ return;
-+ }
-+ pmcsr = val;
- state = pmcsr & PCI_PM_CTRL_STATE_MASK;
- if (state) {
- pmcsr &= ~PCI_PM_CTRL_STATE_MASK;
- vfio_pci_write_config(pdev, pdev->pm_cap + PCI_PM_CTRL, pmcsr, 2);
- /* vfio handles the necessary delay here */
-- pmcsr = vfio_pci_read_config(pdev, pdev->pm_cap + PCI_PM_CTRL, 2);
-+ val = vfio_pci_read_config(pdev, pdev->pm_cap + PCI_PM_CTRL, 2);
-+ if (val == (uint32_t)-1) {
-+ return;
-+ }
-+ pmcsr = val;
- state = pmcsr & PCI_PM_CTRL_STATE_MASK;
- if (state) {
- error_report("vfio: Unable to power on device, stuck in D%d",
diff --git a/debian/patches/extra/0025-vfio-pci-reject-invalid-PCI_INTERRUPT_PIN-values.patch b/debian/patches/extra/0025-vfio-pci-reject-invalid-PCI_INTERRUPT_PIN-values.patch
deleted file mode 100644
index ce8685437e..0000000000
--- a/debian/patches/extra/0025-vfio-pci-reject-invalid-PCI_INTERRUPT_PIN-values.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: "Denis V. Lunev" <den@openvz.org>
-Date: Fri, 17 Jul 2026 14:22:30 +0200
-Subject: [PATCH] vfio/pci: reject invalid PCI_INTERRUPT_PIN values
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-qemu-kvm aborts a few seconds after starting a VM with a
-passed-through GPU whose PCI_INTERRUPT_PIN comes back as an
-out-of-range value: vfio_intx_enable() only guards against pin == 0
-and stores vdev->intx.pin = pin - 1 with no upper-bound check. That
-value later reaches pci_irq_handler()'s
-assert(0 <= irq_num && irq_num < PCI_NUM_PINS) via
-pci_irq_deassert() -> pci_set_irq(), aborting the process.
-
-Legal PCI_INTERRUPT_PIN values are 0 (no legacy interrupt) or
-1-PCI_NUM_PINS (INTA-INTD); reject anything else before it reaches
-vdev->intx.pin, whether the out-of-range value came from a read
-failure (now caught by the previous commit) or was handed back as
-data by the device itself.
-
-Signed-off-by: Denis V. Lunev <den@openvz.org>
-CC: Alex Williamson <alex@shazbot.org>
-CC: Cédric Le Goater <clg@redhat.com>
-Link: https://lore.kernel.org/qemu-devel/20260717122232.468955-3-den@openvz.org
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 86abb10256a58d50513d1f9c65652b7b6b7faafc)
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- hw/vfio/pci.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
-index 721e92f8ff..ca3b3f9d8a 100644
---- a/hw/vfio/pci.c
-+++ b/hw/vfio/pci.c
-@@ -346,6 +346,11 @@ static bool vfio_intx_enable(VFIOPCIDevice *vdev, Error **errp)
- return true;
- }
-
-+ if (pin > PCI_NUM_PINS) {
-+ error_setg(errp, "invalid PCI interrupt pin %d", pin);
-+ return false;
-+ }
-+
- /*
- * Do not alter interrupt state during vfio_realize and cpr load.
- * The incoming state is cleared thereafter.
diff --git a/debian/patches/pve/0001-PVE-Config-block-file-change-locking-default-to-off.patch b/debian/patches/pve/0001-PVE-Config-block-file-change-locking-default-to-off.patch
index 88c77994b6..3bb79c2ec0 100644
--- a/debian/patches/pve/0001-PVE-Config-block-file-change-locking-default-to-off.patch
+++ b/debian/patches/pve/0001-PVE-Config-block-file-change-locking-default-to-off.patch
@@ -14,10 +14,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/block/file-posix.c b/block/file-posix.c
-index e49b13d6ab..328ddaa3bd 100644
+index 3c985da94f..e5b942b6e4 100644
--- a/block/file-posix.c
+++ b/block/file-posix.c
-@@ -588,7 +588,7 @@ static QemuOptsList raw_runtime_opts = {
+@@ -581,7 +581,7 @@ static QemuOptsList raw_runtime_opts = {
{
.name = "locking",
.type = QEMU_OPT_STRING,
@@ -26,7 +26,7 @@ index e49b13d6ab..328ddaa3bd 100644
},
{
.name = "pr-manager",
-@@ -688,7 +688,7 @@ static int raw_open_common(BlockDriverState *bs, QDict *options,
+@@ -681,7 +681,7 @@ static int raw_open_common(BlockDriverState *bs, QDict *options,
s->use_lock = false;
break;
case ON_OFF_AUTO_AUTO:
diff --git a/debian/patches/pve/0003-PVE-Config-set-the-CPU-model-to-kvm64-32-instead-of-.patch b/debian/patches/pve/0003-PVE-Config-set-the-CPU-model-to-kvm64-32-instead-of-.patch
index 5601901764..80d650b214 100644
--- a/debian/patches/pve/0003-PVE-Config-set-the-CPU-model-to-kvm64-32-instead-of-.patch
+++ b/debian/patches/pve/0003-PVE-Config-set-the-CPU-model-to-kvm64-32-instead-of-.patch
@@ -10,10 +10,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
-index 0b539155c4..f5925df672 100644
+index e6a197602d..0e09893d35 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
-@@ -2786,9 +2786,9 @@ uint64_t cpu_get_tsc(CPUX86State *env);
+@@ -2792,9 +2792,9 @@ uint64_t cpu_get_tsc(CPUX86State *env);
#define CPU_RESOLVING_TYPE TYPE_X86_CPU
#ifdef TARGET_X86_64
diff --git a/debian/patches/pve/0004-PVE-Config-ui-spice-default-to-pve-certificates.patch b/debian/patches/pve/0004-PVE-Config-ui-spice-default-to-pve-certificates.patch
index a96976151c..4c1345d8ef 100644
--- a/debian/patches/pve/0004-PVE-Config-ui-spice-default-to-pve-certificates.patch
+++ b/debian/patches/pve/0004-PVE-Config-ui-spice-default-to-pve-certificates.patch
@@ -9,10 +9,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
1 file changed, 9 insertions(+), 6 deletions(-)
diff --git a/ui/spice-core.c b/ui/spice-core.c
-index ef1c00134f..6d6560ae80 100644
+index 1d2315f0b6..e30f7d2a51 100644
--- a/ui/spice-core.c
+++ b/ui/spice-core.c
-@@ -697,32 +697,35 @@ static void qemu_spice_init(void)
+@@ -700,32 +700,35 @@ static void qemu_spice_init(void)
if (tls_port) {
x509_dir = qemu_opt_get(opts, "x509-dir");
diff --git a/debian/patches/pve/0005-PVE-Config-glusterfs-no-default-logfile-if-daemonize.patch b/debian/patches/pve/0005-PVE-Config-glusterfs-no-default-logfile-if-daemonize.patch
deleted file mode 100644
index 45feb82357..0000000000
--- a/debian/patches/pve/0005-PVE-Config-glusterfs-no-default-logfile-if-daemonize.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Wolfgang Bumiller <w.bumiller@proxmox.com>
-Date: Mon, 6 Apr 2020 12:16:35 +0200
-Subject: [PATCH] PVE: [Config] glusterfs: no default logfile if daemonized
-
-Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
----
- block/gluster.c | 15 +++++++++++----
- 1 file changed, 11 insertions(+), 4 deletions(-)
-
-diff --git a/block/gluster.c b/block/gluster.c
-index 4fb25b2c6d..542cc8da4a 100644
---- a/block/gluster.c
-+++ b/block/gluster.c
-@@ -42,7 +42,7 @@
- #define GLUSTER_DEBUG_DEFAULT 4
- #define GLUSTER_DEBUG_MAX 9
- #define GLUSTER_OPT_LOGFILE "logfile"
--#define GLUSTER_LOGFILE_DEFAULT "-" /* handled in libgfapi as /dev/stderr */
-+#define GLUSTER_LOGFILE_DEFAULT NULL
- /*
- * Several versions of GlusterFS (3.12? -> 6.0.1) fail when the transfer size
- * is greater or equal to 1024 MiB, so we are limiting the transfer size to 512
-@@ -420,6 +420,7 @@ static struct glfs *qemu_gluster_glfs_init(BlockdevOptionsGluster *gconf,
- int old_errno;
- SocketAddressList *server;
- uint64_t port;
-+ const char *logfile;
-
- glfs = glfs_find_preopened(gconf->volume);
- if (glfs) {
-@@ -462,9 +463,15 @@ static struct glfs *qemu_gluster_glfs_init(BlockdevOptionsGluster *gconf,
- }
- }
-
-- ret = glfs_set_logging(glfs, gconf->logfile, gconf->debug);
-- if (ret < 0) {
-- goto out;
-+ logfile = gconf->logfile;
-+ if (!logfile && !is_daemonized()) {
-+ logfile = "-";
-+ }
-+ if (logfile) {
-+ ret = glfs_set_logging(glfs, logfile, gconf->debug);
-+ if (ret < 0) {
-+ goto out;
-+ }
- }
-
- ret = glfs_init(glfs);
diff --git a/debian/patches/pve/0006-PVE-Config-rbd-block-rbd-disable-rbd_cache_writethro.patch b/debian/patches/pve/0005-PVE-Config-rbd-block-rbd-disable-rbd_cache_writethro.patch
similarity index 100%
rename from debian/patches/pve/0006-PVE-Config-rbd-block-rbd-disable-rbd_cache_writethro.patch
rename to debian/patches/pve/0005-PVE-Config-rbd-block-rbd-disable-rbd_cache_writethro.patch
diff --git a/debian/patches/pve/0008-PVE-Up-qemu-img-return-success-on-info-without-snaps.patch b/debian/patches/pve/0006-PVE-Up-qemu-img-return-success-on-info-without-snaps.patch
similarity index 88%
rename from debian/patches/pve/0008-PVE-Up-qemu-img-return-success-on-info-without-snaps.patch
rename to debian/patches/pve/0006-PVE-Up-qemu-img-return-success-on-info-without-snaps.patch
index eb01c677d6..e872eb361d 100644
--- a/debian/patches/pve/0008-PVE-Up-qemu-img-return-success-on-info-without-snaps.patch
+++ b/debian/patches/pve/0006-PVE-Up-qemu-img-return-success-on-info-without-snaps.patch
@@ -9,10 +9,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/qemu-img.c b/qemu-img.c
-index c42dd4e995..616eebc42b 100644
+index 2f63d31141..2f9e8e77b8 100644
--- a/qemu-img.c
+++ b/qemu-img.c
-@@ -3184,7 +3184,8 @@ static int img_info(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -3185,7 +3185,8 @@ static int img_info(const img_cmd_t *ccmd, int argc, char **argv)
list = collect_image_info_list(image_opts, filename, fmt, cache, chain,
limits, force_share);
if (!list) {
diff --git a/debian/patches/pve/0007-PVE-Up-glusterfs-allow-partial-reads.patch b/debian/patches/pve/0007-PVE-Up-glusterfs-allow-partial-reads.patch
deleted file mode 100644
index 8b946172e9..0000000000
--- a/debian/patches/pve/0007-PVE-Up-glusterfs-allow-partial-reads.patch
+++ /dev/null
@@ -1,79 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Wolfgang Bumiller <w.bumiller@proxmox.com>
-Date: Mon, 6 Apr 2020 12:16:38 +0200
-Subject: [PATCH] PVE: [Up] glusterfs: allow partial reads
-
-This should deal with qemu bug #1644754 until upstream
-decides which way to go. The general direction seems to be
-away from sector based block APIs and with that in mind, and
-when comparing to other network block backends (eg. nfs)
-treating partial reads as errors doesn't seem to make much
-sense.
-
-Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
-[FE: rebase for 10.2.0]
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- block/gluster.c | 10 +++++++++-
- 1 file changed, 9 insertions(+), 1 deletion(-)
-
-diff --git a/block/gluster.c b/block/gluster.c
-index 542cc8da4a..ba0f92ce52 100644
---- a/block/gluster.c
-+++ b/block/gluster.c
-@@ -56,6 +56,7 @@ typedef struct GlusterAIOCB {
- int64_t size;
- int ret;
- Coroutine *coroutine;
-+ bool is_write;
- } GlusterAIOCB;
-
- typedef struct BDRVGlusterState {
-@@ -745,8 +746,10 @@ static void gluster_finish_aiocb(struct glfs_fd *fd, ssize_t ret,
- acb->ret = 0; /* Success */
- } else if (ret < 0) {
- acb->ret = -errno; /* Read/Write failed */
-+ } else if (acb->is_write) {
-+ acb->ret = -EIO; /* Partial write - fail it */
- } else {
-- acb->ret = -EIO; /* Partial read/write - fail it */
-+ acb->ret = 0; /* Success */
- }
-
- /*
-@@ -1022,6 +1025,7 @@ static coroutine_fn int qemu_gluster_co_pwrite_zeroes(BlockDriverState *bs,
- acb.size = bytes;
- acb.ret = 0;
- acb.coroutine = qemu_coroutine_self();
-+ acb.is_write = true;
-
- ret = glfs_zerofill_async(s->fd, offset, bytes, gluster_finish_aiocb, &acb);
- if (ret < 0) {
-@@ -1201,9 +1205,11 @@ static coroutine_fn int qemu_gluster_co_rw(BlockDriverState *bs,
- acb.coroutine = qemu_coroutine_self();
-
- if (write) {
-+ acb.is_write = true;
- ret = glfs_pwritev_async(s->fd, qiov->iov, qiov->niov, offset, 0,
- gluster_finish_aiocb, &acb);
- } else {
-+ acb.is_write = false;
- ret = glfs_preadv_async(s->fd, qiov->iov, qiov->niov, offset, 0,
- gluster_finish_aiocb, &acb);
- }
-@@ -1265,6 +1271,7 @@ static coroutine_fn int qemu_gluster_co_flush_to_disk(BlockDriverState *bs)
- acb.size = 0;
- acb.ret = 0;
- acb.coroutine = qemu_coroutine_self();
-+ acb.is_write = true;
-
- ret = glfs_fsync_async(s->fd, gluster_finish_aiocb, &acb);
- if (ret < 0) {
-@@ -1312,6 +1319,7 @@ static coroutine_fn int qemu_gluster_co_pdiscard(BlockDriverState *bs,
- acb.size = 0;
- acb.ret = 0;
- acb.coroutine = qemu_coroutine_self();
-+ acb.is_write = true;
-
- ret = glfs_discard_async(s->fd, offset, bytes, gluster_finish_aiocb, &acb);
- if (ret < 0) {
diff --git a/debian/patches/pve/0009-PVE-Up-qemu-img-dd-add-osize-and-read-from-to-stdin-.patch b/debian/patches/pve/0007-PVE-Up-qemu-img-dd-add-osize-and-read-from-to-stdin-.patch
similarity index 96%
rename from debian/patches/pve/0009-PVE-Up-qemu-img-dd-add-osize-and-read-from-to-stdin-.patch
rename to debian/patches/pve/0007-PVE-Up-qemu-img-dd-add-osize-and-read-from-to-stdin-.patch
index 7b31e4b598..9184458394 100644
--- a/debian/patches/pve/0009-PVE-Up-qemu-img-dd-add-osize-and-read-from-to-stdin-.patch
+++ b/debian/patches/pve/0007-PVE-Up-qemu-img-dd-add-osize-and-read-from-to-stdin-.patch
@@ -55,10 +55,10 @@ index 6bc8265cfb..85458ea2d8 100644
DEF("info", img_info,
diff --git a/qemu-img.c b/qemu-img.c
-index 616eebc42b..bf7c637d48 100644
+index 2f9e8e77b8..dad04c865e 100644
--- a/qemu-img.c
+++ b/qemu-img.c
-@@ -5279,10 +5279,12 @@ static int img_bitmap(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5320,10 +5320,12 @@ static int img_bitmap(const img_cmd_t *ccmd, int argc, char **argv)
#define C_IF 04
#define C_OF 010
#define C_SKIP 020
@@ -71,7 +71,7 @@ index 616eebc42b..bf7c637d48 100644
};
struct DdIo {
-@@ -5358,6 +5360,19 @@ static int img_dd_skip(const char *arg,
+@@ -5399,6 +5401,19 @@ static int img_dd_skip(const char *arg,
return 0;
}
@@ -91,7 +91,7 @@ index 616eebc42b..bf7c637d48 100644
static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
{
int ret = 0;
-@@ -5398,6 +5413,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5439,6 +5454,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
{ "if", img_dd_if, C_IF },
{ "of", img_dd_of, C_OF },
{ "skip", img_dd_skip, C_SKIP },
@@ -99,7 +99,7 @@ index 616eebc42b..bf7c637d48 100644
{ NULL, NULL, 0 }
};
const struct option long_options[] = {
-@@ -5495,91 +5511,112 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5536,91 +5552,112 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
arg = NULL;
}
@@ -276,7 +276,7 @@ index 616eebc42b..bf7c637d48 100644
}
if (dd.flags & C_SKIP && (in.offset > INT64_MAX / in.bsz ||
-@@ -5596,20 +5633,43 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5637,20 +5674,43 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
in.buf = g_new(uint8_t, in.bsz);
for (out_pos = 0; in_pos < size; ) {
diff --git a/debian/patches/pve/0010-PVE-Up-qemu-img-dd-add-isize-parameter.patch b/debian/patches/pve/0008-PVE-Up-qemu-img-dd-add-isize-parameter.patch
similarity index 87%
rename from debian/patches/pve/0010-PVE-Up-qemu-img-dd-add-isize-parameter.patch
rename to debian/patches/pve/0008-PVE-Up-qemu-img-dd-add-isize-parameter.patch
index a6bd8d8d4b..db3a1bfaa8 100644
--- a/debian/patches/pve/0010-PVE-Up-qemu-img-dd-add-isize-parameter.patch
+++ b/debian/patches/pve/0008-PVE-Up-qemu-img-dd-add-isize-parameter.patch
@@ -17,10 +17,10 @@ Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
1 file changed, 25 insertions(+), 3 deletions(-)
diff --git a/qemu-img.c b/qemu-img.c
-index bf7c637d48..84fd7d5470 100644
+index dad04c865e..f64a8cb3d3 100644
--- a/qemu-img.c
+++ b/qemu-img.c
-@@ -5280,11 +5280,13 @@ static int img_bitmap(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5321,11 +5321,13 @@ static int img_bitmap(const img_cmd_t *ccmd, int argc, char **argv)
#define C_OF 010
#define C_SKIP 020
#define C_OSIZE 040
@@ -34,7 +34,7 @@ index bf7c637d48..84fd7d5470 100644
};
struct DdIo {
-@@ -5373,6 +5375,19 @@ static int img_dd_osize(const char *arg,
+@@ -5414,6 +5416,19 @@ static int img_dd_osize(const char *arg,
return 0;
}
@@ -54,7 +54,7 @@ index bf7c637d48..84fd7d5470 100644
static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
{
int ret = 0;
-@@ -5387,12 +5402,14 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5428,12 +5443,14 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
int c, i;
const char *out_fmt = "raw";
const char *fmt = NULL;
@@ -70,7 +70,7 @@ index bf7c637d48..84fd7d5470 100644
};
struct DdIo in = {
.bsz = 512, /* Block size is by default 512 bytes */
-@@ -5414,6 +5431,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5455,6 +5472,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
{ "of", img_dd_of, C_OF },
{ "skip", img_dd_skip, C_SKIP },
{ "osize", img_dd_osize, C_OSIZE },
@@ -78,7 +78,7 @@ index bf7c637d48..84fd7d5470 100644
{ NULL, NULL, 0 }
};
const struct option long_options[] = {
-@@ -5632,9 +5650,10 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5673,9 +5691,10 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
in.buf = g_new(uint8_t, in.bsz);
@@ -91,7 +91,7 @@ index bf7c637d48..84fd7d5470 100644
if (blk1) {
in_ret = blk_pread(blk1, in_pos, bytes, in.buf, 0);
if (in_ret == 0) {
-@@ -5643,6 +5662,9 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5684,6 +5703,9 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
} else {
in_ret = read(STDIN_FILENO, in.buf, bytes);
if (in_ret == 0) {
diff --git a/debian/patches/pve/0011-PVE-Up-qemu-img-dd-add-n-skip_create.patch b/debian/patches/pve/0009-PVE-Up-qemu-img-dd-add-n-skip_create.patch
similarity index 91%
rename from debian/patches/pve/0011-PVE-Up-qemu-img-dd-add-n-skip_create.patch
rename to debian/patches/pve/0009-PVE-Up-qemu-img-dd-add-n-skip_create.patch
index 856505c7b2..5684d3c819 100644
--- a/debian/patches/pve/0011-PVE-Up-qemu-img-dd-add-n-skip_create.patch
+++ b/debian/patches/pve/0009-PVE-Up-qemu-img-dd-add-n-skip_create.patch
@@ -14,7 +14,7 @@ Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
3 files changed, 26 insertions(+), 12 deletions(-)
diff --git a/docs/tools/qemu-img.rst b/docs/tools/qemu-img.rst
-index 558b0eb84d..c3fefaab07 100644
+index b0c798b77a..3ad23f6261 100644
--- a/docs/tools/qemu-img.rst
+++ b/docs/tools/qemu-img.rst
@@ -212,6 +212,10 @@ Parameters to convert subcommand:
@@ -28,7 +28,7 @@ index 558b0eb84d..c3fefaab07 100644
.. program:: qemu-img-dd
.. option:: bs=BLOCK_SIZE
-@@ -492,7 +496,7 @@ Command description:
+@@ -496,7 +500,7 @@ Command description:
it doesn't need to be specified separately in this case.
@@ -37,7 +37,7 @@ index 558b0eb84d..c3fefaab07 100644
dd copies from *INPUT* file to *OUTPUT* file converting it from
*FMT* format to *OUTPUT_FMT* format.
-@@ -503,6 +507,11 @@ Command description:
+@@ -507,6 +511,11 @@ Command description:
The size syntax is similar to :manpage:`dd(1)`'s size syntax.
@@ -66,10 +66,10 @@ index 85458ea2d8..f97c2fa396 100644
DEF("info", img_info,
diff --git a/qemu-img.c b/qemu-img.c
-index 84fd7d5470..c484479fc5 100644
+index f64a8cb3d3..e8e2b0eb68 100644
--- a/qemu-img.c
+++ b/qemu-img.c
-@@ -5404,7 +5404,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5445,7 +5445,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
const char *fmt = NULL;
int64_t size = 0, readsize = 0;
int64_t out_pos, in_pos;
@@ -78,7 +78,7 @@ index 84fd7d5470..c484479fc5 100644
struct DdInfo dd = {
.flags = 0,
.count = 0,
-@@ -5444,7 +5444,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5485,7 +5485,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
{ 0, 0, 0, 0 }
};
@@ -87,7 +87,7 @@ index 84fd7d5470..c484479fc5 100644
if (c == EOF) {
break;
}
-@@ -5485,6 +5485,9 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5526,6 +5526,9 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
case 'O':
out_fmt = optarg;
break;
@@ -97,7 +97,7 @@ index 84fd7d5470..c484479fc5 100644
case 'U':
force_share = true;
break;
-@@ -5614,13 +5617,15 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5655,13 +5658,15 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
size - in.bsz * in.offset, &error_abort);
}
diff --git a/debian/patches/pve/0012-qemu-img-dd-add-l-option-for-loading-a-snapshot.patch b/debian/patches/pve/0010-qemu-img-dd-add-l-option-for-loading-a-snapshot.patch
similarity index 90%
rename from debian/patches/pve/0012-qemu-img-dd-add-l-option-for-loading-a-snapshot.patch
rename to debian/patches/pve/0010-qemu-img-dd-add-l-option-for-loading-a-snapshot.patch
index 6b1731abea..f3bd76dd6a 100644
--- a/debian/patches/pve/0012-qemu-img-dd-add-l-option-for-loading-a-snapshot.patch
+++ b/debian/patches/pve/0010-qemu-img-dd-add-l-option-for-loading-a-snapshot.patch
@@ -14,10 +14,10 @@ Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
3 files changed, 36 insertions(+), 7 deletions(-)
diff --git a/docs/tools/qemu-img.rst b/docs/tools/qemu-img.rst
-index c3fefaab07..9da1e526fb 100644
+index 3ad23f6261..9f84a85e41 100644
--- a/docs/tools/qemu-img.rst
+++ b/docs/tools/qemu-img.rst
-@@ -496,10 +496,10 @@ Command description:
+@@ -500,10 +500,10 @@ Command description:
it doesn't need to be specified separately in this case.
@@ -48,10 +48,10 @@ index f97c2fa396..206ca7381c 100644
DEF("info", img_info,
diff --git a/qemu-img.c b/qemu-img.c
-index c484479fc5..d738ea5185 100644
+index e8e2b0eb68..8da92a63c0 100644
--- a/qemu-img.c
+++ b/qemu-img.c
-@@ -5396,6 +5396,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5437,6 +5437,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
BlockDriver *drv = NULL, *proto_drv = NULL;
BlockBackend *blk1 = NULL, *blk2 = NULL;
QemuOpts *opts = NULL;
@@ -59,7 +59,7 @@ index c484479fc5..d738ea5185 100644
QemuOptsList *create_opts = NULL;
Error *local_err = NULL;
bool image_opts = false;
-@@ -5405,6 +5406,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5446,6 +5447,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
int64_t size = 0, readsize = 0;
int64_t out_pos, in_pos;
bool force_share = false, skip_create = false;
@@ -67,7 +67,7 @@ index c484479fc5..d738ea5185 100644
struct DdInfo dd = {
.flags = 0,
.count = 0,
-@@ -5444,7 +5446,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5485,7 +5487,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
{ 0, 0, 0, 0 }
};
@@ -76,7 +76,7 @@ index c484479fc5..d738ea5185 100644
if (c == EOF) {
break;
}
-@@ -5488,6 +5490,19 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5529,6 +5531,19 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
case 'n':
skip_create = true;
break;
@@ -96,7 +96,7 @@ index c484479fc5..d738ea5185 100644
case 'U':
force_share = true;
break;
-@@ -5546,11 +5561,24 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5587,11 +5602,24 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
if (dd.flags & C_IF) {
blk1 = img_open(image_opts, in.filename, fmt, 0, false, false,
force_share);
@@ -122,7 +122,7 @@ index c484479fc5..d738ea5185 100644
}
if (dd.flags & C_OSIZE) {
-@@ -5705,6 +5733,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5746,6 +5774,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
out:
g_free(arg);
qemu_opts_del(opts);
diff --git a/debian/patches/pve/0013-PVE-virtio-balloon-improve-query-balloon.patch b/debian/patches/pve/0011-PVE-virtio-balloon-improve-query-balloon.patch
similarity index 98%
rename from debian/patches/pve/0013-PVE-virtio-balloon-improve-query-balloon.patch
rename to debian/patches/pve/0011-PVE-virtio-balloon-improve-query-balloon.patch
index bea81dcb61..c0e337a613 100644
--- a/debian/patches/pve/0013-PVE-virtio-balloon-improve-query-balloon.patch
+++ b/debian/patches/pve/0011-PVE-virtio-balloon-improve-query-balloon.patch
@@ -18,7 +18,7 @@ Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
4 files changed, 82 insertions(+), 4 deletions(-)
diff --git a/hw/core/machine-hmp-cmds.c b/hw/core/machine-hmp-cmds.c
-index 46846f741a..004b7fa772 100644
+index 686304bafa..474afba207 100644
--- a/hw/core/machine-hmp-cmds.c
+++ b/hw/core/machine-hmp-cmds.c
@@ -200,7 +200,35 @@ void hmp_info_balloon(Monitor *mon, const QDict *qdict)
@@ -103,7 +103,7 @@ index 4c5f486ba2..58fa33fb4a 100644
static void virtio_balloon_to_target(void *opaque, ram_addr_t target)
diff --git a/qapi/machine.json b/qapi/machine.json
-index 685e4e29b8..30ab4a3b01 100644
+index 9b2248038f..51b6f5ef02 100644
--- a/qapi/machine.json
+++ b/qapi/machine.json
@@ -1127,9 +1127,29 @@
diff --git a/debian/patches/pve/0014-PVE-qapi-modify-query-machines.patch b/debian/patches/pve/0012-PVE-qapi-modify-query-machines.patch
similarity index 98%
rename from debian/patches/pve/0014-PVE-qapi-modify-query-machines.patch
rename to debian/patches/pve/0012-PVE-qapi-modify-query-machines.patch
index b914cd48d4..3da050c0b3 100644
--- a/debian/patches/pve/0014-PVE-qapi-modify-query-machines.patch
+++ b/debian/patches/pve/0012-PVE-qapi-modify-query-machines.patch
@@ -30,7 +30,7 @@ index e62cb4ec88..f4bd0f1616 100644
info->default_cpu_type = g_strdup(default_cpu_type);
}
diff --git a/qapi/machine.json b/qapi/machine.json
-index 30ab4a3b01..5e4a82bdbd 100644
+index 51b6f5ef02..63536462bd 100644
--- a/qapi/machine.json
+++ b/qapi/machine.json
@@ -172,6 +172,8 @@
diff --git a/debian/patches/pve/0015-PVE-qapi-modify-spice-query.patch b/debian/patches/pve/0013-PVE-qapi-modify-spice-query.patch
similarity index 95%
rename from debian/patches/pve/0015-PVE-qapi-modify-spice-query.patch
rename to debian/patches/pve/0013-PVE-qapi-modify-spice-query.patch
index 60b98f3281..f4b6bedeb4 100644
--- a/debian/patches/pve/0015-PVE-qapi-modify-spice-query.patch
+++ b/debian/patches/pve/0013-PVE-qapi-modify-spice-query.patch
@@ -14,7 +14,7 @@ Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
2 files changed, 7 insertions(+)
diff --git a/qapi/ui.json b/qapi/ui.json
-index e3da77632a..cf58718ece 100644
+index b2c42a7f57..614621ad34 100644
--- a/qapi/ui.json
+++ b/qapi/ui.json
@@ -315,11 +315,14 @@
@@ -33,7 +33,7 @@ index e3da77632a..cf58718ece 100644
'if': 'CONFIG_SPICE' }
diff --git a/ui/spice-core.c b/ui/spice-core.c
-index 6d6560ae80..2e1de49de4 100644
+index e30f7d2a51..a0393e4ba8 100644
--- a/ui/spice-core.c
+++ b/ui/spice-core.c
@@ -556,6 +556,10 @@ static SpiceInfo *qmp_query_spice_real(Error **errp)
diff --git a/debian/patches/pve/0016-PVE-add-IOChannel-implementation-for-savevm-async.patch b/debian/patches/pve/0014-PVE-add-IOChannel-implementation-for-savevm-async.patch
similarity index 99%
rename from debian/patches/pve/0016-PVE-add-IOChannel-implementation-for-savevm-async.patch
rename to debian/patches/pve/0014-PVE-add-IOChannel-implementation-for-savevm-async.patch
index 7489d31f64..6def7d7d18 100644
--- a/debian/patches/pve/0016-PVE-add-IOChannel-implementation-for-savevm-async.patch
+++ b/debian/patches/pve/0014-PVE-add-IOChannel-implementation-for-savevm-async.patch
@@ -271,7 +271,7 @@ index 0000000000..17ae2cb261
+
+#endif /* QIO_CHANNEL_SAVEVM_ASYNC_H */
diff --git a/migration/meson.build b/migration/meson.build
-index c9f0f5f9f2..0222d5ea6e 100644
+index 0a9a5d0d37..a9d0c9cc36 100644
--- a/migration/meson.build
+++ b/migration/meson.build
@@ -14,6 +14,7 @@ system_ss.add(files(
diff --git a/debian/patches/pve/0017-PVE-add-savevm-async-for-background-state-snapshots.patch b/debian/patches/pve/0015-PVE-add-savevm-async-for-background-state-snapshots.patch
similarity index 91%
rename from debian/patches/pve/0017-PVE-add-savevm-async-for-background-state-snapshots.patch
rename to debian/patches/pve/0015-PVE-add-savevm-async-for-background-state-snapshots.patch
index f252236de5..f04bc2896a 100644
--- a/debian/patches/pve/0017-PVE-add-savevm-async-for-background-state-snapshots.patch
+++ b/debian/patches/pve/0015-PVE-add-savevm-async-for-background-state-snapshots.patch
@@ -35,30 +35,30 @@ Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
improve runstate preservation
use dedicated iothread for state file to avoid deadlock, bug #6262
add parameter to skip vm start to be used for hibernation
- rebase for 11.0.0]
+ rebase for 11.1.0]
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
[EF: drop QIOChannel reference]
Signed-off-by: Erik Fastermann <e.fastermann@proxmox.com>
---
hmp-commands-info.hx | 13 +
- hmp-commands.hx | 17 +
+ hmp-commands.hx | 27 ++
include/migration/snapshot.h | 2 +
include/monitor/hmp.h | 3 +
migration/meson.build | 1 +
- migration/savevm-async.c | 600 +++++++++++++++++++++++++++++++++++
+ migration/savevm-async.c | 615 +++++++++++++++++++++++++++++++++++
monitor/hmp-cmds.c | 38 +++
qapi/migration.json | 34 ++
qapi/misc.json | 25 ++
qemu-options.hx | 12 +
system/vl.c | 10 +
- 11 files changed, 755 insertions(+)
+ 11 files changed, 780 insertions(+)
create mode 100644 migration/savevm-async.c
diff --git a/hmp-commands-info.hx b/hmp-commands-info.hx
-index 74c741f80e..723f799ff2 100644
+index 82134eb6c2..6f5eb8afb5 100644
--- a/hmp-commands-info.hx
+++ b/hmp-commands-info.hx
-@@ -530,6 +530,19 @@ SRST
+@@ -519,6 +519,19 @@ SRST
Show current migration parameters.
ERST
@@ -79,14 +79,13 @@ index 74c741f80e..723f799ff2 100644
.name = "balloon",
.args_type = "",
diff --git a/hmp-commands.hx b/hmp-commands.hx
-index 5cc4788f12..eda6225ef1 100644
+index 7ae2468a3d..b75491337f 100644
--- a/hmp-commands.hx
+++ b/hmp-commands.hx
-@@ -1867,3 +1867,20 @@ SRST
+@@ -1865,6 +1865,33 @@ SRST
List event channels in the guest
ERST
- #endif
-+
+
+ {
+ .name = "savevm-start",
+ .args_type = "statefile:s?",
@@ -95,6 +94,11 @@ index 5cc4788f12..eda6225ef1 100644
+ .cmd = hmp_savevm_start,
+ },
+
++SRST
++``savevm-start``
++ Prepare for snapshot and halt VM. Optionally, save VM state to statefile.
++ERST
++
+ {
+ .name = "savevm-end",
+ .args_type = "",
@@ -103,6 +107,15 @@ index 5cc4788f12..eda6225ef1 100644
+ .cmd = hmp_savevm_end,
+ .coroutine = true,
+ },
++
++SRST
++``savevm-end``
++ Resume VM after snaphot.
++ERST
++
+ HXCOMM *** MUST BE LAST ENTRY **
+ {
+ .name = "info",
diff --git a/include/migration/snapshot.h b/include/migration/snapshot.h
index 9e4dcaaa75..2581730d74 100644
--- a/include/migration/snapshot.h
@@ -115,10 +128,10 @@ index 9e4dcaaa75..2581730d74 100644
+
#endif
diff --git a/include/monitor/hmp.h b/include/monitor/hmp.h
-index e222bea60c..abebfea0e2 100644
+index 9258a049bf..acd7be848d 100644
--- a/include/monitor/hmp.h
+++ b/include/monitor/hmp.h
-@@ -29,6 +29,7 @@ void hmp_info_status(Monitor *mon, const QDict *qdict);
+@@ -45,6 +45,7 @@ void hmp_info_status(Monitor *mon, const QDict *qdict);
void hmp_info_uuid(Monitor *mon, const QDict *qdict);
void hmp_info_chardev(Monitor *mon, const QDict *qdict);
void hmp_info_mice(Monitor *mon, const QDict *qdict);
@@ -126,7 +139,7 @@ index e222bea60c..abebfea0e2 100644
void hmp_info_migrate(Monitor *mon, const QDict *qdict);
void hmp_info_migrate_capabilities(Monitor *mon, const QDict *qdict);
void hmp_info_migrate_parameters(Monitor *mon, const QDict *qdict);
-@@ -93,6 +94,8 @@ void hmp_closefd(Monitor *mon, const QDict *qdict);
+@@ -108,6 +109,8 @@ void hmp_closefd(Monitor *mon, const QDict *qdict);
void hmp_mouse_move(Monitor *mon, const QDict *qdict);
void hmp_mouse_button(Monitor *mon, const QDict *qdict);
void hmp_mouse_set(Monitor *mon, const QDict *qdict);
@@ -136,10 +149,10 @@ index e222bea60c..abebfea0e2 100644
void coroutine_fn hmp_screendump(Monitor *mon, const QDict *qdict);
void hmp_chardev_add(Monitor *mon, const QDict *qdict);
diff --git a/migration/meson.build b/migration/meson.build
-index 0222d5ea6e..90d62d5723 100644
+index a9d0c9cc36..1ae3779e39 100644
--- a/migration/meson.build
+++ b/migration/meson.build
-@@ -35,6 +35,7 @@ system_ss.add(files(
+@@ -34,6 +34,7 @@ system_ss.add(files(
'postcopy-ram.c',
'ram.c',
'savevm.c',
@@ -149,10 +162,10 @@ index 0222d5ea6e..90d62d5723 100644
), gnutls, zlib)
diff --git a/migration/savevm-async.c b/migration/savevm-async.c
new file mode 100644
-index 0000000000..cab08643ad
+index 0000000000..de69350763
--- /dev/null
+++ b/migration/savevm-async.c
-@@ -0,0 +1,600 @@
+@@ -0,0 +1,615 @@
+#include "qemu/osdep.h"
+#include "migration/channel-savevm-async.h"
+#include "migration/migration.h"
@@ -323,6 +336,8 @@ index 0000000000..cab08643ad
+{
+ int ret;
+ MigrationState *ms = migrate_get_current();
++ MigPendingData pending = {};
++ Error *local_err = NULL;
+
+ bool aborted = savevm_aborted();
+
@@ -346,12 +361,25 @@ index 0000000000..cab08643ad
+ save_snapshot_error("vm_stop_force_state error %d", ret);
+ }
+
-+ if (!aborted) {
++ /*
++ * Need a final query to collect the latest state before calling
++ * qemu_savevm_state_complete_precopy(). The migration code does this in
++ * migration_switchover_start().
++ */
++ if (!qemu_savevm_query_pending_final(ms, &pending, &local_err)) {
++ ret = -1;
++ save_snapshot_error("qemu_savevm_query_pending_final error: %s",
++ error_get_pretty(local_err));
++ error_free(local_err);
++ local_err = NULL;
++ } else if (!aborted) {
+ /* skip state saving if we aborted, snapshot will be invalid anyway */
-+ (void)qemu_savevm_state_complete_precopy(ms);
-+ ret = qemu_file_get_error(snap_state.file);
-+ if (ret < 0) {
-+ save_snapshot_error("qemu_savevm_state_complete_precopy error %d", ret);
++ if (!qemu_savevm_state_complete_precopy(ms, &local_err)) {
++ ret = -1;
++ save_snapshot_error("qemu_savevm_state_complete_precopy error: %s",
++ error_get_pretty(local_err));
++ error_free(local_err);
++ local_err = NULL;
+ }
+ }
+
@@ -404,6 +432,7 @@ index 0000000000..cab08643ad
+ int64_t maxlen;
+ BdrvNextIterator it;
+ BlockDriverState *bs = NULL;
++ MigrationState *ms = migrate_get_current();
+
+#ifdef DEBUG_SAVEVM_STATE
+ int64_t start_time = qemu_clock_get_ms(QEMU_CLOCK_REALTIME);
@@ -416,18 +445,17 @@ index 0000000000..cab08643ad
+ }
+
+ while (snap_state.state == SAVE_STATE_ACTIVE) {
-+ uint64_t pending_size, pend_precopy, pend_postcopy;
++ MigPendingData pending = { };
+ uint64_t threshold = 400 * 1000;
+
+ /*
+ * Similar to what is done in migration.c, call the exact variant only
-+ * once pend_precopy in the estimate is below the threshold.
++ * once pending.precopy_bytes in the estimate is below the threshold.
+ */
-+ qemu_savevm_state_pending_estimate(&pend_precopy, &pend_postcopy);
-+ if (pend_precopy <= threshold) {
-+ qemu_savevm_state_pending_exact(&pend_precopy, &pend_postcopy);
++ qemu_savevm_query_pending_iter(ms, &pending, false);
++ if (pending.precopy_bytes <= threshold) {
++ qemu_savevm_query_pending_iter(ms, &pending, true);
+ }
-+ pending_size = pend_precopy + pend_postcopy;
+
+ /*
+ * A guest reaching this cutoff is dirtying lots of RAM. It should be
@@ -437,14 +465,14 @@ index 0000000000..cab08643ad
+ */
+ maxlen = blk_getlength(snap_state.target) - 100*1024*1024;
+
-+ /* Note that there is no progress for pend_postcopy when iterating */
-+ if (pend_precopy > threshold && snap_state.bs_pos + pending_size < maxlen) {
++ /* Note that there is no progress for {post,stop}copy_bytes when iterating */
++ if (pending.precopy_bytes > threshold && snap_state.bs_pos + pending.total_bytes < maxlen) {
+ ret = qemu_savevm_state_iterate(snap_state.file, false);
+ if (ret < 0) {
+ save_snapshot_error("qemu_savevm_state_iterate error %d", ret);
+ break;
+ }
-+ DPRINTF("savevm iterate pending size %lu ret %d\n", pending_size, ret);
++ DPRINTF("savevm iterate pending size %lu ret %d\n", pending.total_bytes, ret);
+ } else {
+ qemu_system_wakeup_request(QEMU_WAKEUP_REASON_OTHER, NULL);
+ global_state_store();
@@ -548,7 +576,7 @@ index 0000000000..cab08643ad
+ warn_report("iothread for snapshot already exists - re-using");
+ } else {
+ snap_state.iothread =
-+ iothread_create("__proxmox_savevm_async_iothread__", &local_err);
++ iothread_create("proxmox_savevm_async_iothread__", &local_err);
+ if (!snap_state.iothread) {
+ error_setg(errp, "creating iothread failed: %s",
+ local_err ? error_get_pretty(local_err) : "unknown error");
@@ -754,18 +782,18 @@ index 0000000000..cab08643ad
+ return ret;
+}
diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
-index bc26b39d70..e7afe15e97 100644
+index e9fb8d827a..cbea739580 100644
--- a/monitor/hmp-cmds.c
+++ b/monitor/hmp-cmds.c
-@@ -27,6 +27,7 @@
+@@ -29,6 +29,7 @@
#include "qapi/error.h"
#include "qapi/qapi-commands-control.h"
#include "qapi/qapi-commands-machine.h"
+#include "qapi/qapi-commands-migration.h"
#include "qapi/qapi-commands-misc.h"
+ #include "block/block-hmp-cmds.h"
#include "qobject/qdict.h"
- #include "qemu/cutils.h"
-@@ -442,6 +443,43 @@ void hmp_dumpdtb(Monitor *mon, const QDict *qdict)
+@@ -496,6 +497,43 @@ void hmp_dumpdtb(Monitor *mon, const QDict *qdict)
}
#endif
@@ -810,10 +838,10 @@ index bc26b39d70..e7afe15e97 100644
int monitor_set_cpu(Monitor *mon, int cpu_index)
{
diff --git a/qapi/migration.json b/qapi/migration.json
-index 7134d4ce47..8dc8d52b23 100644
+index b1eaf7b054..0794a3a7a3 100644
--- a/qapi/migration.json
+++ b/qapi/migration.json
-@@ -333,6 +333,40 @@
+@@ -337,6 +337,40 @@
'*dirty-limit-throttle-time-per-round': 'uint64',
'*dirty-limit-ring-full-time': 'uint64'} }
@@ -855,10 +883,10 @@ index 7134d4ce47..8dc8d52b23 100644
# @query-migrate:
#
diff --git a/qapi/misc.json b/qapi/misc.json
-index 28c641fe2f..cfa10c849b 100644
+index 22b7afed9f..786aeb4d3c 100644
--- a/qapi/misc.json
+++ b/qapi/misc.json
-@@ -449,6 +449,31 @@
+@@ -455,6 +455,31 @@
##
{ 'command': 'query-fdsets', 'returns': ['FdsetInfo'] }
@@ -891,10 +919,10 @@ index 28c641fe2f..cfa10c849b 100644
# @CommandLineParameterType:
#
diff --git a/qemu-options.hx b/qemu-options.hx
-index df6d841eea..2d63c8565a 100644
+index 34970fffc9..dcc9ab6bf4 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
-@@ -5181,6 +5181,18 @@ SRST
+@@ -5259,6 +5259,18 @@ SRST
Start right away with a saved state (``loadvm`` in monitor)
ERST
@@ -914,10 +942,10 @@ index df6d841eea..2d63c8565a 100644
DEF("daemonize", 0, QEMU_OPTION_daemonize, \
"-daemonize daemonize QEMU after initializing\n", QEMU_ARCH_ALL)
diff --git a/system/vl.c b/system/vl.c
-index 806327bd39..1825609c8f 100644
+index 061cbdf860..45c01fa53d 100644
--- a/system/vl.c
+++ b/system/vl.c
-@@ -173,6 +173,7 @@ static const char *accelerators;
+@@ -176,6 +176,7 @@ static const char *accelerators;
static bool have_custom_ram_size;
static const char *ram_memdev_id;
static QDict *machine_opts_dict;
@@ -925,7 +953,7 @@ index 806327bd39..1825609c8f 100644
static QTAILQ_HEAD(, ObjectOption) object_opts = QTAILQ_HEAD_INITIALIZER(object_opts);
static QTAILQ_HEAD(, DeviceOption) device_opts = QTAILQ_HEAD_INITIALIZER(device_opts);
static int display_remote;
-@@ -2814,6 +2815,12 @@ void qmp_x_exit_preconfig(Error **errp)
+@@ -2828,6 +2829,12 @@ void qmp_x_exit_preconfig(Error **errp)
RunState state = autostart ? RUN_STATE_RUNNING : runstate_get();
load_snapshot(loadvm, NULL, false, NULL, &error_fatal);
load_snapshot_resume(state);
@@ -938,7 +966,7 @@ index 806327bd39..1825609c8f 100644
}
if (replay_mode != REPLAY_MODE_NONE) {
replay_vmstate_init();
-@@ -3363,6 +3370,9 @@ void qemu_init(int argc, char **argv)
+@@ -3376,6 +3383,9 @@ void qemu_init(int argc, char **argv)
case QEMU_OPTION_loadvm:
loadvm = optarg;
break;
diff --git a/debian/patches/pve/0018-PVE-add-optional-buffer-size-to-QEMUFile.patch b/debian/patches/pve/0016-PVE-add-optional-buffer-size-to-QEMUFile.patch
similarity index 93%
rename from debian/patches/pve/0018-PVE-add-optional-buffer-size-to-QEMUFile.patch
rename to debian/patches/pve/0016-PVE-add-optional-buffer-size-to-QEMUFile.patch
index 39cacf76cd..40ef2dcd26 100644
--- a/debian/patches/pve/0018-PVE-add-optional-buffer-size-to-QEMUFile.patch
+++ b/debian/patches/pve/0016-PVE-add-optional-buffer-size-to-QEMUFile.patch
@@ -21,7 +21,7 @@ Signed-off-by: Erik Fastermann <e.fastermann@proxmox.com>
3 files changed, 37 insertions(+), 17 deletions(-)
diff --git a/migration/qemu-file.c b/migration/qemu-file.c
-index 9cf7dc3bd5..b1b7aa453e 100644
+index f30e13c66d..98acebce80 100644
--- a/migration/qemu-file.c
+++ b/migration/qemu-file.c
@@ -34,8 +34,8 @@
@@ -133,7 +133,7 @@ index 9cf7dc3bd5..b1b7aa453e 100644
if (l > size) {
l = size;
}
-@@ -661,8 +679,8 @@ size_t coroutine_mixed_fn qemu_peek_buffer(QEMUFile *f, uint8_t **buf, size_t si
+@@ -632,8 +650,8 @@ size_t coroutine_mixed_fn qemu_peek_buffer(QEMUFile *f, uint8_t **buf, size_t si
size_t index;
assert(!qemu_file_is_writable(f));
@@ -144,7 +144,7 @@ index 9cf7dc3bd5..b1b7aa453e 100644
/* The 1st byte to read from */
index = f->buf_index + offset;
-@@ -712,7 +730,7 @@ size_t coroutine_mixed_fn qemu_get_buffer(QEMUFile *f, uint8_t *buf, size_t size
+@@ -683,7 +701,7 @@ size_t coroutine_mixed_fn qemu_get_buffer(QEMUFile *f, uint8_t *buf, size_t size
size_t res;
uint8_t *src;
@@ -153,7 +153,7 @@ index 9cf7dc3bd5..b1b7aa453e 100644
if (res == 0) {
return done;
}
-@@ -746,7 +764,7 @@ size_t coroutine_mixed_fn qemu_get_buffer(QEMUFile *f, uint8_t *buf, size_t size
+@@ -717,7 +735,7 @@ size_t coroutine_mixed_fn qemu_get_buffer(QEMUFile *f, uint8_t *buf, size_t size
*/
size_t coroutine_mixed_fn qemu_get_buffer_in_place(QEMUFile *f, uint8_t **buf, size_t size)
{
@@ -162,7 +162,7 @@ index 9cf7dc3bd5..b1b7aa453e 100644
size_t res;
uint8_t *src = NULL;
-@@ -771,7 +789,7 @@ int coroutine_mixed_fn qemu_peek_byte(QEMUFile *f, int offset)
+@@ -742,7 +760,7 @@ int coroutine_mixed_fn qemu_peek_byte(QEMUFile *f, int offset)
int index = f->buf_index + offset;
assert(!qemu_file_is_writable(f));
@@ -172,7 +172,7 @@ index 9cf7dc3bd5..b1b7aa453e 100644
if (index >= f->buf_size) {
qemu_fill_buffer(f);
diff --git a/migration/qemu-file.h b/migration/qemu-file.h
-index a390554208..eda093b16a 100644
+index 8f824c124d..0ffcb13921 100644
--- a/migration/qemu-file.h
+++ b/migration/qemu-file.h
@@ -29,7 +29,9 @@
@@ -186,10 +186,10 @@ index a390554208..eda093b16a 100644
G_DEFINE_AUTOPTR_CLEANUP_FUNC(QEMUFile, qemu_fclose)
diff --git a/migration/savevm-async.c b/migration/savevm-async.c
-index cab08643ad..f9eaf3b8e6 100644
+index de69350763..67b69bf3ac 100644
--- a/migration/savevm-async.c
+++ b/migration/savevm-async.c
-@@ -418,7 +418,7 @@ void qmp_savevm_start(const char *statefile, bool has_skip_vm_start,
+@@ -433,7 +433,7 @@ void qmp_savevm_start(const char *statefile, bool has_skip_vm_start,
QIOChannel *ioc = QIO_CHANNEL(qio_channel_savevm_async_new(snap_state.target,
&snap_state.bs_pos));
@@ -198,7 +198,7 @@ index cab08643ad..f9eaf3b8e6 100644
object_unref(ioc);
if (!snap_state.file) {
-@@ -557,7 +557,7 @@ int load_snapshot_from_blockdev(const char *filename, Error **errp)
+@@ -572,7 +572,7 @@ int load_snapshot_from_blockdev(const char *filename, Error **errp)
/* restore the VM state */
QIOChannel *ioc = QIO_CHANNEL(qio_channel_savevm_async_new(be, &bs_pos));
diff --git a/debian/patches/pve/0019-PVE-block-add-the-zeroinit-block-driver-filter.patch b/debian/patches/pve/0017-PVE-block-add-the-zeroinit-block-driver-filter.patch
similarity index 98%
rename from debian/patches/pve/0019-PVE-block-add-the-zeroinit-block-driver-filter.patch
rename to debian/patches/pve/0017-PVE-block-add-the-zeroinit-block-driver-filter.patch
index 52e7ed9c50..93f0c8d78e 100644
--- a/debian/patches/pve/0019-PVE-block-add-the-zeroinit-block-driver-filter.patch
+++ b/debian/patches/pve/0017-PVE-block-add-the-zeroinit-block-driver-filter.patch
@@ -16,7 +16,7 @@ Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
create mode 100644 block/zeroinit.c
diff --git a/block/meson.build b/block/meson.build
-index 34b1b2a306..a21d9a5411 100644
+index bc419aebf0..f78a97c52a 100644
--- a/block/meson.build
+++ b/block/meson.build
@@ -39,6 +39,7 @@ block_ss.add(files(
@@ -247,10 +247,10 @@ index 0000000000..036edb17f5
+
+block_init(bdrv_zeroinit_init);
diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 50a0af3569..4e8bc65bdb 100644
+index c2f6139dea..c3204f5739 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
-@@ -3381,7 +3381,7 @@
+@@ -3375,7 +3375,7 @@
{ 'name': 'virtio-blk-vfio-pci', 'if': 'CONFIG_BLKIO' },
{ 'name': 'virtio-blk-vhost-user', 'if': 'CONFIG_BLKIO' },
{ 'name': 'virtio-blk-vhost-vdpa', 'if': 'CONFIG_BLKIO' },
@@ -259,7 +259,7 @@ index 50a0af3569..4e8bc65bdb 100644
##
# @BlockdevOptionsFile:
-@@ -4940,7 +4940,8 @@
+@@ -4909,7 +4909,8 @@
'if': 'CONFIG_BLKIO' },
'vmdk': 'BlockdevOptionsGenericCOWFormat',
'vpc': 'BlockdevOptionsGenericFormat',
diff --git a/debian/patches/pve/0020-PVE-Add-dummy-id-command-line-parameter.patch b/debian/patches/pve/0018-PVE-Add-dummy-id-command-line-parameter.patch
similarity index 87%
rename from debian/patches/pve/0020-PVE-Add-dummy-id-command-line-parameter.patch
rename to debian/patches/pve/0018-PVE-Add-dummy-id-command-line-parameter.patch
index 3b1140d7e3..67a6d67a99 100644
--- a/debian/patches/pve/0020-PVE-Add-dummy-id-command-line-parameter.patch
+++ b/debian/patches/pve/0018-PVE-Add-dummy-id-command-line-parameter.patch
@@ -14,10 +14,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2 files changed, 11 insertions(+)
diff --git a/qemu-options.hx b/qemu-options.hx
-index 2d63c8565a..e05fd83ed0 100644
+index dcc9ab6bf4..7dda9be8e4 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
-@@ -1393,6 +1393,9 @@ legacy PC, they are not recommended for modern configurations.
+@@ -1419,6 +1419,9 @@ legacy PC, they are not recommended for modern configurations.
ERST
@@ -28,10 +28,10 @@ index 2d63c8565a..e05fd83ed0 100644
"-fda/-fdb file use 'file' as floppy disk 0/1 image\n", QEMU_ARCH_ALL)
DEF("fdb", HAS_ARG, QEMU_OPTION_fdb, "", QEMU_ARCH_ALL)
diff --git a/system/vl.c b/system/vl.c
-index 1825609c8f..ac9255909f 100644
+index 45c01fa53d..6994dcc9f0 100644
--- a/system/vl.c
+++ b/system/vl.c
-@@ -2854,6 +2854,7 @@ void qemu_init(int argc, char **argv)
+@@ -2867,6 +2867,7 @@ void qemu_init(int argc, char **argv)
MachineClass *machine_class;
bool userconfig = true;
FILE *vmstate_dump_file = NULL;
@@ -39,7 +39,7 @@ index 1825609c8f..ac9255909f 100644
qemu_add_opts(&qemu_drive_opts);
qemu_add_drive_opts(&qemu_legacy_drive_opts);
-@@ -3475,6 +3476,13 @@ void qemu_init(int argc, char **argv)
+@@ -3487,6 +3488,13 @@ void qemu_init(int argc, char **argv)
machine_parse_property_opt(qemu_find_opts("smp-opts"),
"smp", optarg);
break;
diff --git a/debian/patches/pve/0021-PVE-Config-Revert-target-i386-disable-LINT0-after-re.patch b/debian/patches/pve/0019-PVE-Config-Revert-target-i386-disable-LINT0-after-re.patch
similarity index 96%
rename from debian/patches/pve/0021-PVE-Config-Revert-target-i386-disable-LINT0-after-re.patch
rename to debian/patches/pve/0019-PVE-Config-Revert-target-i386-disable-LINT0-after-re.patch
index dfad07e181..a00599732d 100644
--- a/debian/patches/pve/0021-PVE-Config-Revert-target-i386-disable-LINT0-after-re.patch
+++ b/debian/patches/pve/0019-PVE-Config-Revert-target-i386-disable-LINT0-after-re.patch
@@ -13,7 +13,7 @@ Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
1 file changed, 9 insertions(+)
diff --git a/hw/intc/apic_common.c b/hw/intc/apic_common.c
-index bf4abc21d7..3acb881e26 100644
+index 49c03a5bce..2e94f576c6 100644
--- a/hw/intc/apic_common.c
+++ b/hw/intc/apic_common.c
@@ -245,6 +245,15 @@ static void apic_reset_common(DeviceState *dev)
diff --git a/debian/patches/pve/0022-PVE-Up-Config-file-posix-make-locking-optiono-on-cre.patch b/debian/patches/pve/0020-PVE-Up-Config-file-posix-make-locking-optiono-on-cre.patch
similarity index 90%
rename from debian/patches/pve/0022-PVE-Up-Config-file-posix-make-locking-optiono-on-cre.patch
rename to debian/patches/pve/0020-PVE-Up-Config-file-posix-make-locking-optiono-on-cre.patch
index f63cc7b27b..c52036cfcc 100644
--- a/debian/patches/pve/0022-PVE-Up-Config-file-posix-make-locking-optiono-on-cre.patch
+++ b/debian/patches/pve/0020-PVE-Up-Config-file-posix-make-locking-optiono-on-cre.patch
@@ -13,10 +13,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2 files changed, 46 insertions(+), 20 deletions(-)
diff --git a/block/file-posix.c b/block/file-posix.c
-index 328ddaa3bd..5fd49844af 100644
+index e5b942b6e4..adf9557428 100644
--- a/block/file-posix.c
+++ b/block/file-posix.c
-@@ -2966,6 +2966,7 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
+@@ -2959,6 +2959,7 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
int fd;
uint64_t perm, shared;
int result = 0;
@@ -24,7 +24,7 @@ index 328ddaa3bd..5fd49844af 100644
/* Validate options and set default values */
assert(options->driver == BLOCKDEV_DRIVER_FILE);
-@@ -3006,19 +3007,22 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
+@@ -2999,19 +3000,22 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
perm = BLK_PERM_WRITE | BLK_PERM_RESIZE;
shared = BLK_PERM_ALL & ~BLK_PERM_RESIZE;
@@ -59,7 +59,7 @@ index 328ddaa3bd..5fd49844af 100644
}
/* Clear the file by truncating it to 0 */
-@@ -3072,13 +3076,15 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
+@@ -3065,13 +3069,15 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
}
out_unlock:
@@ -82,7 +82,7 @@ index 328ddaa3bd..5fd49844af 100644
}
out_close:
-@@ -3102,6 +3108,7 @@ raw_co_create_opts(BlockDriver *drv, const char *filename,
+@@ -3095,6 +3101,7 @@ raw_co_create_opts(BlockDriver *drv, const char *filename,
PreallocMode prealloc;
char *buf = NULL;
Error *local_err = NULL;
@@ -90,7 +90,7 @@ index 328ddaa3bd..5fd49844af 100644
/* Skip file: protocol prefix */
strstart(filename, "file:", &filename);
-@@ -3124,6 +3131,18 @@ raw_co_create_opts(BlockDriver *drv, const char *filename,
+@@ -3117,6 +3124,18 @@ raw_co_create_opts(BlockDriver *drv, const char *filename,
return -EINVAL;
}
@@ -109,7 +109,7 @@ index 328ddaa3bd..5fd49844af 100644
options = (BlockdevCreateOptions) {
.driver = BLOCKDEV_DRIVER_FILE,
.u.file = {
-@@ -3135,6 +3154,8 @@ raw_co_create_opts(BlockDriver *drv, const char *filename,
+@@ -3128,6 +3147,8 @@ raw_co_create_opts(BlockDriver *drv, const char *filename,
.nocow = nocow,
.has_extent_size_hint = has_extent_size_hint,
.extent_size_hint = extent_size_hint,
@@ -119,10 +119,10 @@ index 328ddaa3bd..5fd49844af 100644
};
return raw_co_create(&options, errp);
diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 4e8bc65bdb..d5a2bbcff1 100644
+index c3204f5739..338675b98a 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
-@@ -5159,6 +5159,10 @@
+@@ -5128,6 +5128,10 @@
# @extent-size-hint: Extent size hint to add to the image file; 0 for
# not adding an extent size hint (default: 1 MB, since 5.1)
#
@@ -133,7 +133,7 @@ index 4e8bc65bdb..d5a2bbcff1 100644
# Since: 2.12
##
{ 'struct': 'BlockdevCreateOptionsFile',
-@@ -5166,7 +5170,8 @@
+@@ -5135,7 +5139,8 @@
'size': 'size',
'*preallocation': 'PreallocMode',
'*nocow': 'bool',
@@ -142,4 +142,4 @@ index 4e8bc65bdb..d5a2bbcff1 100644
+ '*locking': 'OnOffAuto' } }
##
- # @BlockdevCreateOptionsGluster:
+ # @BlockdevCreateOptionsLUKS:
diff --git a/debian/patches/pve/0023-PVE-monitor-disable-oob-capability.patch b/debian/patches/pve/0021-PVE-monitor-disable-oob-capability.patch
similarity index 65%
rename from debian/patches/pve/0023-PVE-monitor-disable-oob-capability.patch
rename to debian/patches/pve/0021-PVE-monitor-disable-oob-capability.patch
index 7e57cd7653..2c8e6ddbdb 100644
--- a/debian/patches/pve/0023-PVE-monitor-disable-oob-capability.patch
+++ b/debian/patches/pve/0021-PVE-monitor-disable-oob-capability.patch
@@ -13,21 +13,23 @@ disable oob, so we can get a functioning qemu out...
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+[FE: rebase for 11.1.0]
+Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---
monitor/qmp.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/monitor/qmp.c b/monitor/qmp.c
-index e2ab70de77..1a22110850 100644
+index 681533715f..31f866a4f6 100644
--- a/monitor/qmp.c
+++ b/monitor/qmp.c
-@@ -537,8 +537,7 @@ void monitor_init_qmp(Chardev *chr, bool pretty, Error **errp)
- qemu_chr_fe_set_echo(&mon->common.chr, true);
+@@ -174,8 +174,7 @@ static void monitor_qmp_emit_event(Monitor *mon, QAPIEvent event, QDict *qdict)
- /* Note: we run QMP monitor in I/O thread when @chr supports that */
-- monitor_data_init(&mon->common, true, false,
-- qemu_chr_has_feature(chr, QEMU_CHAR_FEATURE_GCONTEXT));
-+ monitor_data_init(&mon->common, true, false, false);
-
- mon->pretty = pretty;
+ static bool monitor_qmp_requires_iothread(const Monitor *mon)
+ {
+- return qemu_chr_has_feature(mon->chr.chr,
+- QEMU_CHAR_FEATURE_GCONTEXT);
++ return false;
+ }
+ static bool qmp_oob_enabled(MonitorQMP *mon)
diff --git a/debian/patches/pve/0024-PVE-Allow-version-code-in-machine-type.patch b/debian/patches/pve/0022-PVE-Allow-version-code-in-machine-type.patch
similarity index 93%
rename from debian/patches/pve/0024-PVE-Allow-version-code-in-machine-type.patch
rename to debian/patches/pve/0022-PVE-Allow-version-code-in-machine-type.patch
index fa728d5137..c94e558827 100644
--- a/debian/patches/pve/0024-PVE-Allow-version-code-in-machine-type.patch
+++ b/debian/patches/pve/0022-PVE-Allow-version-code-in-machine-type.patch
@@ -37,10 +37,10 @@ index f4bd0f1616..47cbe16d46 100644
if (default_cpu_type) {
diff --git a/include/hw/core/boards.h b/include/hw/core/boards.h
-index b8dad0a107..6c65576c71 100644
+index 29c68931d8..b5b3844562 100644
--- a/include/hw/core/boards.h
+++ b/include/hw/core/boards.h
-@@ -268,6 +268,8 @@ struct MachineClass {
+@@ -274,6 +274,8 @@ struct MachineClass {
const char *desc;
const char *deprecation_reason;
@@ -50,7 +50,7 @@ index b8dad0a107..6c65576c71 100644
void (*reset)(MachineState *state, ResetType type);
void (*wakeup)(MachineState *state);
diff --git a/qapi/machine.json b/qapi/machine.json
-index 5e4a82bdbd..acc635aa1d 100644
+index 63536462bd..d17f841a5a 100644
--- a/qapi/machine.json
+++ b/qapi/machine.json
@@ -194,6 +194,8 @@
@@ -71,10 +71,10 @@ index 5e4a82bdbd..acc635aa1d 100644
'features': ['unstable'] } } }
diff --git a/system/vl.c b/system/vl.c
-index ac9255909f..1d4130bedb 100644
+index 6994dcc9f0..5a9ac766ce 100644
--- a/system/vl.c
+++ b/system/vl.c
-@@ -1679,6 +1679,7 @@ static MachineClass *select_machine(QDict *qdict, Error **errp)
+@@ -1683,6 +1683,7 @@ static MachineClass *select_machine(QDict *qdict, Error **errp)
{
ERRP_GUARD();
const char *machine_type = qdict_get_try_str(qdict, "type");
@@ -82,7 +82,7 @@ index ac9255909f..1d4130bedb 100644
g_autoptr(GSList) machines = object_class_get_list(target_machine_typename(),
false);
MachineClass *machine_class = NULL;
-@@ -1699,7 +1700,11 @@ static MachineClass *select_machine(QDict *qdict, Error **errp)
+@@ -1703,7 +1704,11 @@ static MachineClass *select_machine(QDict *qdict, Error **errp)
if (!machine_class) {
error_append_hint(errp,
"Use -machine help to list supported machines\n");
@@ -94,7 +94,7 @@ index ac9255909f..1d4130bedb 100644
return machine_class;
}
-@@ -3417,12 +3422,31 @@ void qemu_init(int argc, char **argv)
+@@ -3429,12 +3434,31 @@ void qemu_init(int argc, char **argv)
case QEMU_OPTION_machine:
{
bool help;
diff --git a/debian/patches/pve/0025-block-backup-move-bcs-bitmap-initialization-to-job-c.patch b/debian/patches/pve/0023-block-backup-move-bcs-bitmap-initialization-to-job-c.patch
similarity index 100%
rename from debian/patches/pve/0025-block-backup-move-bcs-bitmap-initialization-to-job-c.patch
rename to debian/patches/pve/0023-block-backup-move-bcs-bitmap-initialization-to-job-c.patch
diff --git a/debian/patches/pve/0026-PVE-Backup-add-vma-backup-format-code.patch b/debian/patches/pve/0024-PVE-Backup-add-vma-backup-format-code.patch
similarity index 99%
rename from debian/patches/pve/0026-PVE-Backup-add-vma-backup-format-code.patch
rename to debian/patches/pve/0024-PVE-Backup-add-vma-backup-format-code.patch
index 1574e2b73b..8e2d20aa73 100644
--- a/debian/patches/pve/0026-PVE-Backup-add-vma-backup-format-code.patch
+++ b/debian/patches/pve/0024-PVE-Backup-add-vma-backup-format-code.patch
@@ -27,7 +27,7 @@ Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
create mode 100644 vma.h
diff --git a/block/meson.build b/block/meson.build
-index a21d9a5411..1373612c10 100644
+index f78a97c52a..83f858669f 100644
--- a/block/meson.build
+++ b/block/meson.build
@@ -42,6 +42,8 @@ block_ss.add(files(
@@ -40,10 +40,10 @@ index a21d9a5411..1373612c10 100644
system_ss.add(files('block-ram-registrar.c'))
diff --git a/meson.build b/meson.build
-index c55f601d68..dd3ca2bcbc 100644
+index 40e3f4ec44..27e5dafe95 100644
--- a/meson.build
+++ b/meson.build
-@@ -2155,6 +2155,8 @@ endif
+@@ -2130,6 +2130,8 @@ endif
has_gettid = cc.has_function('gettid')
@@ -52,7 +52,7 @@ index c55f601d68..dd3ca2bcbc 100644
# libselinux
selinux = dependency('libselinux',
required: get_option('selinux'),
-@@ -4524,6 +4526,9 @@ if have_tools
+@@ -4525,6 +4527,9 @@ if have_tools
dependencies: [blockdev, qemuutil, selinux],
install: true)
diff --git a/debian/patches/pve/0027-PVE-Backup-add-backup-dump-block-driver.patch b/debian/patches/pve/0025-PVE-Backup-add-backup-dump-block-driver.patch
similarity index 99%
rename from debian/patches/pve/0027-PVE-Backup-add-backup-dump-block-driver.patch
rename to debian/patches/pve/0025-PVE-Backup-add-backup-dump-block-driver.patch
index 688ec5f7fa..98e5c0eee7 100644
--- a/debian/patches/pve/0027-PVE-Backup-add-backup-dump-block-driver.patch
+++ b/debian/patches/pve/0025-PVE-Backup-add-backup-dump-block-driver.patch
@@ -247,7 +247,7 @@ index 9189f64ebc..f6a2d19793 100644
if (perf->max_chunk && perf->max_chunk < cluster_size) {
error_setg(errp, "Required max-chunk (%" PRIi64 ") is less than backup "
diff --git a/block/meson.build b/block/meson.build
-index 1373612c10..6278c4af0f 100644
+index 83f858669f..d7ab3cb78f 100644
--- a/block/meson.build
+++ b/block/meson.build
@@ -4,6 +4,7 @@ block_ss.add(files(
diff --git a/debian/patches/pve/0028-PVE-Add-sequential-job-transaction-support.patch b/debian/patches/pve/0026-PVE-Add-sequential-job-transaction-support.patch
similarity index 100%
rename from debian/patches/pve/0028-PVE-Add-sequential-job-transaction-support.patch
rename to debian/patches/pve/0026-PVE-Add-sequential-job-transaction-support.patch
diff --git a/debian/patches/pve/0029-PVE-Backup-Proxmox-backup-patches-for-QEMU.patch b/debian/patches/pve/0027-PVE-Backup-Proxmox-backup-patches-for-QEMU.patch
similarity index 98%
rename from debian/patches/pve/0029-PVE-Backup-Proxmox-backup-patches-for-QEMU.patch
rename to debian/patches/pve/0027-PVE-Backup-Proxmox-backup-patches-for-QEMU.patch
index 186932fcbf..67bb0c2f10 100644
--- a/debian/patches/pve/0029-PVE-Backup-Proxmox-backup-patches-for-QEMU.patch
+++ b/debian/patches/pve/0027-PVE-Backup-Proxmox-backup-patches-for-QEMU.patch
@@ -102,7 +102,7 @@ Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
create mode 100644 pve-backup.c
diff --git a/block/meson.build b/block/meson.build
-index 6278c4af0f..d1b16e40e9 100644
+index d7ab3cb78f..e984f5e506 100644
--- a/block/meson.build
+++ b/block/meson.build
@@ -44,6 +44,11 @@ block_ss.add(files(
@@ -118,10 +118,10 @@ index 6278c4af0f..d1b16e40e9 100644
system_ss.add(when: 'CONFIG_TCG', if_true: files('blkreplay.c'))
system_ss.add(files('block-ram-registrar.c'))
diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
-index 1fd28d59eb..c5c1fcd583 100644
+index 69ade0534f..77abc58cb1 100644
--- a/block/monitor/block-hmp-cmds.c
+++ b/block/monitor/block-hmp-cmds.c
-@@ -1016,3 +1016,42 @@ void hmp_change_medium(Monitor *mon, const char *device, const char *target,
+@@ -1014,3 +1014,42 @@ void hmp_change_medium(Monitor *mon, const char *device, const char *target,
qmp_blockdev_change_medium(device, NULL, target, arg, true, force,
!!read_only, read_only_mode, errp);
}
@@ -177,10 +177,10 @@ index d9575c8367..38e24e12bd 100644
#include "monitor/monitor.h"
#include "qemu/error-report.h"
diff --git a/hmp-commands-info.hx b/hmp-commands-info.hx
-index 723f799ff2..6d27814f3a 100644
+index 6f5eb8afb5..48fe86eced 100644
--- a/hmp-commands-info.hx
+++ b/hmp-commands-info.hx
-@@ -476,6 +476,20 @@ SRST
+@@ -465,6 +465,20 @@ SRST
Show the current VM UUID.
ERST
@@ -202,10 +202,10 @@ index 723f799ff2..6d27814f3a 100644
{
.name = "usernet",
diff --git a/hmp-commands.hx b/hmp-commands.hx
-index eda6225ef1..f02681a157 100644
+index b75491337f..9cdb84da98 100644
--- a/hmp-commands.hx
+++ b/hmp-commands.hx
-@@ -101,6 +101,35 @@ ERST
+@@ -115,6 +115,35 @@ ERST
SRST
``block_stream``
Copy data from a backing file into a block device.
@@ -242,10 +242,10 @@ index eda6225ef1..f02681a157 100644
{
diff --git a/include/monitor/hmp.h b/include/monitor/hmp.h
-index abebfea0e2..bc727a3a6a 100644
+index acd7be848d..0ae9c27083 100644
--- a/include/monitor/hmp.h
+++ b/include/monitor/hmp.h
-@@ -33,6 +33,7 @@ void hmp_info_savevm(Monitor *mon, const QDict *qdict);
+@@ -49,6 +49,7 @@ void hmp_info_savevm(Monitor *mon, const QDict *qdict);
void hmp_info_migrate(Monitor *mon, const QDict *qdict);
void hmp_info_migrate_capabilities(Monitor *mon, const QDict *qdict);
void hmp_info_migrate_parameters(Monitor *mon, const QDict *qdict);
@@ -253,7 +253,7 @@ index abebfea0e2..bc727a3a6a 100644
void hmp_info_cpus(Monitor *mon, const QDict *qdict);
void hmp_info_vnc(Monitor *mon, const QDict *qdict);
void hmp_info_spice(Monitor *mon, const QDict *qdict);
-@@ -83,6 +84,8 @@ void hmp_change_vnc(Monitor *mon, const char *device, const char *target,
+@@ -98,6 +99,8 @@ void hmp_change_vnc(Monitor *mon, const char *device, const char *target,
void hmp_change_medium(Monitor *mon, const char *device, const char *target,
const char *arg, const char *read_only, bool force,
Error **errp);
@@ -263,10 +263,10 @@ index abebfea0e2..bc727a3a6a 100644
void hmp_device_add(Monitor *mon, const QDict *qdict);
void hmp_device_del(Monitor *mon, const QDict *qdict);
diff --git a/meson.build b/meson.build
-index dd3ca2bcbc..1eee80f7d8 100644
+index 27e5dafe95..2520f871ad 100644
--- a/meson.build
+++ b/meson.build
-@@ -2156,6 +2156,7 @@ endif
+@@ -2131,6 +2131,7 @@ endif
has_gettid = cc.has_function('gettid')
libuuid = cc.find_library('uuid', required: true)
@@ -275,18 +275,18 @@ index dd3ca2bcbc..1eee80f7d8 100644
# libselinux
selinux = dependency('libselinux',
diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
-index e7afe15e97..ce374de2ec 100644
+index cbea739580..543172d89d 100644
--- a/monitor/hmp-cmds.c
+++ b/monitor/hmp-cmds.c
-@@ -25,6 +25,7 @@
- #include "monitor/hmp-target.h"
+@@ -27,6 +27,7 @@
#include "monitor/monitor-internal.h"
+ #include "monitor/qdev.h"
#include "qapi/error.h"
+#include "qapi/qapi-commands-block-core.h"
#include "qapi/qapi-commands-control.h"
#include "qapi/qapi-commands-machine.h"
#include "qapi/qapi-commands-migration.h"
-@@ -125,6 +126,77 @@ void hmp_sync_profile(Monitor *mon, const QDict *qdict)
+@@ -167,6 +168,77 @@ void hmp_sync_profile(Monitor *mon, const QDict *qdict)
}
}
@@ -1685,7 +1685,7 @@ index 0000000000..177fb851b4
+ return ret;
+}
diff --git a/qapi/block-core.json b/qapi/block-core.json
-index d5a2bbcff1..7f1daf42fe 100644
+index 338675b98a..2a0cc0fd2a 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -952,6 +952,248 @@
@@ -1960,7 +1960,7 @@ index af7e3d618a..dc9ab77310 100644
+##
+{ 'struct': 'UuidInfo', 'data': {'UUID': 'str'} }
diff --git a/qapi/machine.json b/qapi/machine.json
-index acc635aa1d..697edcd31d 100644
+index d17f841a5a..ccdfb039ca 100644
--- a/qapi/machine.json
+++ b/qapi/machine.json
@@ -4,6 +4,8 @@
diff --git a/debian/patches/pve/0030-PVE-Backup-pbs-restore-new-command-to-restore-from-p.patch b/debian/patches/pve/0028-PVE-Backup-pbs-restore-new-command-to-restore-from-p.patch
similarity index 99%
rename from debian/patches/pve/0030-PVE-Backup-pbs-restore-new-command-to-restore-from-p.patch
rename to debian/patches/pve/0028-PVE-Backup-pbs-restore-new-command-to-restore-from-p.patch
index bd116623c8..5a0d710f16 100644
--- a/debian/patches/pve/0030-PVE-Backup-pbs-restore-new-command-to-restore-from-p.patch
+++ b/debian/patches/pve/0028-PVE-Backup-pbs-restore-new-command-to-restore-from-p.patch
@@ -16,10 +16,10 @@ Signed-off-by: Erik Fastermann <e.fastermann@proxmox.com>
create mode 100644 pbs-restore.c
diff --git a/meson.build b/meson.build
-index 1eee80f7d8..b7a8702711 100644
+index 2520f871ad..91de400570 100644
--- a/meson.build
+++ b/meson.build
-@@ -4530,6 +4530,10 @@ if have_tools
+@@ -4531,6 +4531,10 @@ if have_tools
vma = executable('vma', files('vma.c', 'vma-reader.c') + genh,
dependencies: [authz, block, crypto, io, qemuutil, qom], install: true)
diff --git a/debian/patches/pve/0031-PVE-Add-PBS-block-driver-to-map-backup-archives-into.patch b/debian/patches/pve/0029-PVE-Add-PBS-block-driver-to-map-backup-archives-into.patch
similarity index 98%
rename from debian/patches/pve/0031-PVE-Add-PBS-block-driver-to-map-backup-archives-into.patch
rename to debian/patches/pve/0029-PVE-Add-PBS-block-driver-to-map-backup-archives-into.patch
index 709da27d7e..1af35e10b7 100644
--- a/debian/patches/pve/0031-PVE-Add-PBS-block-driver-to-map-backup-archives-into.patch
+++ b/debian/patches/pve/0029-PVE-Add-PBS-block-driver-to-map-backup-archives-into.patch
@@ -23,7 +23,7 @@ Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
create mode 100644 block/pbs.c
diff --git a/block/meson.build b/block/meson.build
-index d1b16e40e9..d243372c41 100644
+index e984f5e506..50faf2300a 100644
--- a/block/meson.build
+++ b/block/meson.build
@@ -49,6 +49,8 @@ block_ss.add(files(
@@ -348,10 +348,10 @@ index 0000000000..3e41421716
+
+block_init(bdrv_pbs_init);
diff --git a/meson.build b/meson.build
-index b7a8702711..4a2c4e981f 100644
+index 91de400570..b1cbaa100e 100644
--- a/meson.build
+++ b/meson.build
-@@ -5004,7 +5004,7 @@ summary_info += {'Query Processing Library support': qpl}
+@@ -5010,7 +5010,7 @@ summary_info += {'Query Processing Library support': qpl}
summary_info += {'UADK Library support': uadk}
summary_info += {'qatzip support': qatzip}
summary_info += {'NUMA host support': numa}
@@ -361,10 +361,10 @@ index b7a8702711..4a2c4e981f 100644
summary_info += {'libdaxctl support': libdaxctl}
summary_info += {'libcbor support': libcbor}
diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 7f1daf42fe..e1c659310d 100644
+index 2a0cc0fd2a..d3349661ba 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
-@@ -3619,6 +3619,7 @@
+@@ -3613,6 +3613,7 @@
'parallels', 'preallocate', 'qcow', 'qcow2', 'qed', 'quorum',
'raw', 'rbd',
{ 'name': 'replication', 'if': 'CONFIG_REPLICATION' },
@@ -372,7 +372,7 @@ index 7f1daf42fe..e1c659310d 100644
'ssh', 'throttle', 'vdi', 'vhdx',
{ 'name': 'virtio-blk-vfio-pci', 'if': 'CONFIG_BLKIO' },
{ 'name': 'virtio-blk-vhost-user', 'if': 'CONFIG_BLKIO' },
-@@ -3705,6 +3706,33 @@
+@@ -3699,6 +3700,33 @@
{ 'struct': 'BlockdevOptionsNull',
'data': { '*size': 'int', '*latency-ns': 'uint64', '*read-zeroes': 'bool' } }
@@ -406,7 +406,7 @@ index 7f1daf42fe..e1c659310d 100644
##
# @BlockdevOptionsNVMe:
#
-@@ -5153,6 +5181,7 @@
+@@ -5122,6 +5150,7 @@
'nfs': 'BlockdevOptionsNfs',
'null-aio': 'BlockdevOptionsNull',
'null-co': 'BlockdevOptionsNull',
diff --git a/debian/patches/pve/0032-PVE-redirect-stderr-to-journal-when-daemonized.patch b/debian/patches/pve/0030-PVE-redirect-stderr-to-journal-when-daemonized.patch
similarity index 94%
rename from debian/patches/pve/0032-PVE-redirect-stderr-to-journal-when-daemonized.patch
rename to debian/patches/pve/0030-PVE-redirect-stderr-to-journal-when-daemonized.patch
index fe23727997..9cb5ac9a2a 100644
--- a/debian/patches/pve/0032-PVE-redirect-stderr-to-journal-when-daemonized.patch
+++ b/debian/patches/pve/0030-PVE-redirect-stderr-to-journal-when-daemonized.patch
@@ -14,10 +14,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2 files changed, 7 insertions(+), 3 deletions(-)
diff --git a/meson.build b/meson.build
-index 4a2c4e981f..652138ca4b 100644
+index b1cbaa100e..398a73c3ce 100644
--- a/meson.build
+++ b/meson.build
-@@ -2156,6 +2156,7 @@ endif
+@@ -2131,6 +2131,7 @@ endif
has_gettid = cc.has_function('gettid')
libuuid = cc.find_library('uuid', required: true)
@@ -25,7 +25,7 @@ index 4a2c4e981f..652138ca4b 100644
libproxmox_backup_qemu = cc.find_library('proxmox_backup_qemu', required: true)
# libselinux
-@@ -3846,7 +3847,7 @@ if have_block
+@@ -3840,7 +3841,7 @@ if have_block
elif host_os == 'emscripten'
blockdev_ss.add(files('os-wasm.c'))
else
diff --git a/debian/patches/pve/0033-PVE-Migrate-dirty-bitmap-state-via-savevm.patch b/debian/patches/pve/0031-PVE-Migrate-dirty-bitmap-state-via-savevm.patch
similarity index 88%
rename from debian/patches/pve/0033-PVE-Migrate-dirty-bitmap-state-via-savevm.patch
rename to debian/patches/pve/0031-PVE-Migrate-dirty-bitmap-state-via-savevm.patch
index 4ce1d8c0e5..407c9a7e2e 100644
--- a/debian/patches/pve/0033-PVE-Migrate-dirty-bitmap-state-via-savevm.patch
+++ b/debian/patches/pve/0031-PVE-Migrate-dirty-bitmap-state-via-savevm.patch
@@ -13,7 +13,7 @@ safe migration is possible and makes sense.
Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
-[FE: split up state_pending for 8.0]
+[FE: rebase for 11.1.0]
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
[EF: check allocation of incoming state buffer]
Signed-off-by: Erik Fastermann <e.fastermann@proxmox.com>
@@ -21,26 +21,26 @@ Signed-off-by: Erik Fastermann <e.fastermann@proxmox.com>
include/migration/misc.h | 3 ++
migration/meson.build | 2 +
migration/migration.c | 1 +
- migration/pbs-state.c | 111 +++++++++++++++++++++++++++++++++++++++
+ migration/pbs-state.c | 110 +++++++++++++++++++++++++++++++++++++++
pve-backup.c | 1 +
qapi/block-core.json | 6 +++
- 6 files changed, 124 insertions(+)
+ 6 files changed, 123 insertions(+)
create mode 100644 migration/pbs-state.c
diff --git a/include/migration/misc.h b/include/migration/misc.h
-index 3159a5e53c..b7162b1fca 100644
+index 2b2fbb59a4..ce1e724c20 100644
--- a/include/migration/misc.h
+++ b/include/migration/misc.h
-@@ -156,4 +156,7 @@ bool multifd_device_state_save_thread_should_exit(void);
- void multifd_abort_device_state_save_threads(void);
- bool multifd_join_device_state_save_threads(void);
+@@ -161,4 +161,7 @@ bool multifd_join_device_state_save_threads(void);
+
+ void migration_request_switchover_ack_legacy(const char *requester);
+/* migration/pbs-state.c */
+void pbs_state_mig_init(void);
+
#endif
diff --git a/migration/meson.build b/migration/meson.build
-index 90d62d5723..6010ccaef0 100644
+index 1ae3779e39..a9997f52bf 100644
--- a/migration/meson.build
+++ b/migration/meson.build
@@ -8,6 +8,7 @@ migration_files = files(
@@ -51,7 +51,7 @@ index 90d62d5723..6010ccaef0 100644
system_ss.add(files(
'block-dirty-bitmap.c',
-@@ -32,6 +33,7 @@ system_ss.add(files(
+@@ -31,6 +32,7 @@ system_ss.add(files(
'multifd-zlib.c',
'multifd-zero-page.c',
'options.c',
@@ -60,10 +60,10 @@ index 90d62d5723..6010ccaef0 100644
'ram.c',
'savevm.c',
diff --git a/migration/migration.c b/migration/migration.c
-index dfc60372cf..f415448689 100644
+index 9df6da131c..2d8149e651 100644
--- a/migration/migration.c
+++ b/migration/migration.c
-@@ -329,6 +329,7 @@ void migration_object_init(void)
+@@ -330,6 +330,7 @@ void migration_object_init(void)
/* Initialize cpu throttle timers */
cpu_throttle_init();
@@ -73,10 +73,10 @@ index dfc60372cf..f415448689 100644
typedef struct {
diff --git a/migration/pbs-state.c b/migration/pbs-state.c
new file mode 100644
-index 0000000000..c0c7f2ff6f
+index 0000000000..da83bd26f2
--- /dev/null
+++ b/migration/pbs-state.c
-@@ -0,0 +1,111 @@
+@@ -0,0 +1,110 @@
+/*
+ * PBS (dirty-bitmap) state migration
+ */
@@ -95,8 +95,8 @@ index 0000000000..c0c7f2ff6f
+/* state is accessed via this static variable directly, 'opaque' is NULL */
+static PBSState pbs_state;
+
-+static void pbs_state_pending(void *opaque, uint64_t *must_precopy,
-+ uint64_t *can_postcopy)
++static void pbs_state_pending(void *opaque, MigPendingData *data, bool exact,
++ bool final)
+{
+ /* we send everything in save_setup, so nothing is ever pending */
+}
@@ -173,8 +173,7 @@ index 0000000000..c0c7f2ff6f
+static SaveVMHandlers savevm_pbs_state_handlers = {
+ .save_setup = pbs_state_save_setup,
+ .has_postcopy = pbs_state_has_postcopy,
-+ .state_pending_exact = pbs_state_pending,
-+ .state_pending_estimate = pbs_state_pending,
++ .save_query_pending = pbs_state_pending,
+ .is_active_iterate = pbs_state_is_active_iterate,
+ .load_state = pbs_state_load,
+ .is_active = pbs_state_is_active,
@@ -201,7 +200,7 @@ index 177fb851b4..7575abab7c 100644
ret->pbs_masterkey = true;
ret->backup_max_workers = true;
diff --git a/qapi/block-core.json b/qapi/block-core.json
-index e1c659310d..b314192e30 100644
+index d3349661ba..5965a3c1f3 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -1112,6 +1112,11 @@
diff --git a/debian/patches/pve/0034-migration-block-dirty-bitmap-migrate-other-bitmaps-e.patch b/debian/patches/pve/0032-migration-block-dirty-bitmap-migrate-other-bitmaps-e.patch
similarity index 97%
rename from debian/patches/pve/0034-migration-block-dirty-bitmap-migrate-other-bitmaps-e.patch
rename to debian/patches/pve/0032-migration-block-dirty-bitmap-migrate-other-bitmaps-e.patch
index 34f34c3302..d331b20701 100644
--- a/debian/patches/pve/0034-migration-block-dirty-bitmap-migrate-other-bitmaps-e.patch
+++ b/debian/patches/pve/0032-migration-block-dirty-bitmap-migrate-other-bitmaps-e.patch
@@ -19,7 +19,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/migration/block-dirty-bitmap.c b/migration/block-dirty-bitmap.c
-index a061aad817..d5fca0b96a 100644
+index cba54e25cd..23eb5f40b3 100644
--- a/migration/block-dirty-bitmap.c
+++ b/migration/block-dirty-bitmap.c
@@ -539,7 +539,11 @@ static int add_bitmaps_to_list(DBMSaveState *s, BlockDriverState *bs,
diff --git a/debian/patches/pve/0035-PVE-fall-back-to-open-iscsi-initiatorname.patch b/debian/patches/pve/0033-PVE-fall-back-to-open-iscsi-initiatorname.patch
similarity index 100%
rename from debian/patches/pve/0035-PVE-fall-back-to-open-iscsi-initiatorname.patch
rename to debian/patches/pve/0033-PVE-fall-back-to-open-iscsi-initiatorname.patch
diff --git a/debian/patches/pve/0036-PVE-block-stream-increase-chunk-size.patch b/debian/patches/pve/0034-PVE-block-stream-increase-chunk-size.patch
similarity index 100%
rename from debian/patches/pve/0036-PVE-block-stream-increase-chunk-size.patch
rename to debian/patches/pve/0034-PVE-block-stream-increase-chunk-size.patch
diff --git a/debian/patches/pve/0037-block-add-alloc-track-driver.patch b/debian/patches/pve/0035-block-add-alloc-track-driver.patch
similarity index 98%
rename from debian/patches/pve/0037-block-add-alloc-track-driver.patch
rename to debian/patches/pve/0035-block-add-alloc-track-driver.patch
index ed5e2f5d31..1f566747f8 100644
--- a/debian/patches/pve/0037-block-add-alloc-track-driver.patch
+++ b/debian/patches/pve/0035-block-add-alloc-track-driver.patch
@@ -392,7 +392,7 @@ index 0000000000..02ff45b624
+
+block_init(bdrv_alloc_track_init);
diff --git a/block/meson.build b/block/meson.build
-index d243372c41..9b45b5256d 100644
+index 50faf2300a..391be3ef74 100644
--- a/block/meson.build
+++ b/block/meson.build
@@ -2,6 +2,7 @@ block_ss.add(genh)
@@ -449,10 +449,10 @@ index d023753091..a777c8079c 100644
out:
diff --git a/qapi/block-core.json b/qapi/block-core.json
-index b314192e30..a8a7d227a8 100644
+index 5965a3c1f3..5a9ab23d5d 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
-@@ -3611,7 +3611,8 @@
+@@ -3606,7 +3606,8 @@
# Since: 2.9
##
{ 'enum': 'BlockdevDriver',
@@ -461,8 +461,8 @@ index b314192e30..a8a7d227a8 100644
+ 'blkdebug', 'blklogwrites', 'blkreplay', 'blkverify', 'bochs',
'cloop', 'compress', 'copy-before-write', 'copy-on-read', 'dmg',
'file', 'snapshot-access', 'ftp', 'ftps',
- {'name': 'gluster', 'features': [ 'deprecated' ] },
-@@ -3712,6 +3713,21 @@
+ {'name': 'host_cdrom', 'if': 'HAVE_HOST_BLOCK_DEVICE' },
+@@ -3706,6 +3707,21 @@
{ 'struct': 'BlockdevOptionsNull',
'data': { '*size': 'int', '*latency-ns': 'uint64', '*read-zeroes': 'bool' } }
@@ -484,7 +484,7 @@ index b314192e30..a8a7d227a8 100644
##
# @BlockdevOptionsPbs:
#
-@@ -5159,6 +5175,7 @@
+@@ -5129,6 +5145,7 @@
'*detect-zeroes': 'BlockdevDetectZeroesOptions' },
'discriminator': 'driver',
'data': {
diff --git a/debian/patches/pve/0038-PVE-backup-add-fleecing-option.patch b/debian/patches/pve/0036-PVE-backup-add-fleecing-option.patch
similarity index 99%
rename from debian/patches/pve/0038-PVE-backup-add-fleecing-option.patch
rename to debian/patches/pve/0036-PVE-backup-add-fleecing-option.patch
index 5e6a4d9791..0368018156 100644
--- a/debian/patches/pve/0038-PVE-backup-add-fleecing-option.patch
+++ b/debian/patches/pve/0036-PVE-backup-add-fleecing-option.patch
@@ -147,10 +147,10 @@ index eb93364e85..6a6dbf90f5 100644
#endif /* COPY_BEFORE_WRITE_H */
diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
-index c5c1fcd583..3b9c3d223e 100644
+index 77abc58cb1..d1a2d73243 100644
--- a/block/monitor/block-hmp-cmds.c
+++ b/block/monitor/block-hmp-cmds.c
-@@ -1051,6 +1051,7 @@ void coroutine_fn hmp_backup(Monitor *mon, const QDict *qdict)
+@@ -1049,6 +1049,7 @@ void coroutine_fn hmp_backup(Monitor *mon, const QDict *qdict)
NULL, NULL,
devlist, qdict_haskey(qdict, "speed"), speed,
false, 0, // BackupPerf max-workers
@@ -429,7 +429,7 @@ index 7575abab7c..8b83465ebd 100644
return ret;
}
diff --git a/qapi/block-core.json b/qapi/block-core.json
-index a8a7d227a8..977daf0191 100644
+index 5a9ab23d5d..2dd422aa03 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -1054,6 +1054,10 @@
diff --git a/debian/patches/pve/0039-adapt-machine-version-deprecation-for-Proxmox-VE.patch b/debian/patches/pve/0037-adapt-machine-version-deprecation-for-Proxmox-VE.patch
similarity index 97%
rename from debian/patches/pve/0039-adapt-machine-version-deprecation-for-Proxmox-VE.patch
rename to debian/patches/pve/0037-adapt-machine-version-deprecation-for-Proxmox-VE.patch
index 4538aa14b5..237fb1dea1 100644
--- a/debian/patches/pve/0039-adapt-machine-version-deprecation-for-Proxmox-VE.patch
+++ b/debian/patches/pve/0037-adapt-machine-version-deprecation-for-Proxmox-VE.patch
@@ -22,10 +22,10 @@ Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
1 file changed, 58 insertions(+), 41 deletions(-)
diff --git a/include/hw/core/boards.h b/include/hw/core/boards.h
-index 6c65576c71..04665f0c53 100644
+index b5b3844562..905fcc045d 100644
--- a/include/hw/core/boards.h
+++ b/include/hw/core/boards.h
-@@ -672,40 +672,57 @@ struct MachineState {
+@@ -679,40 +679,57 @@ struct MachineState {
/*
@@ -106,7 +106,7 @@ index 6c65576c71..04665f0c53 100644
/*
* - The first check applies to formal releases
-@@ -720,29 +737,29 @@ struct MachineState {
+@@ -727,29 +744,29 @@ struct MachineState {
* and dev snapshots / release candidates are numbered with micro >= 50
* If this ever changes the logic below will need modifying....
*/
@@ -152,7 +152,7 @@ index 6c65576c71..04665f0c53 100644
/*
* Evaluates true when a machine type with (major, minor)
-@@ -751,7 +768,7 @@ struct MachineState {
+@@ -758,7 +775,7 @@ struct MachineState {
* lifecycle rules
*/
#define MACHINE_VER_IS_DEPRECATED(...) \
@@ -161,7 +161,7 @@ index 6c65576c71..04665f0c53 100644
/*
* Evaluates true when a machine type with (major, minor)
-@@ -760,7 +777,7 @@ struct MachineState {
+@@ -767,7 +784,7 @@ struct MachineState {
* lifecycle rules
*/
#define MACHINE_VER_SHOULD_DELETE(...) \
diff --git a/debian/patches/pve/0040-PVE-backup-factor-out-helper-to-clear-backup-state-s.patch b/debian/patches/pve/0038-PVE-backup-factor-out-helper-to-clear-backup-state-s.patch
similarity index 100%
rename from debian/patches/pve/0040-PVE-backup-factor-out-helper-to-clear-backup-state-s.patch
rename to debian/patches/pve/0038-PVE-backup-factor-out-helper-to-clear-backup-state-s.patch
diff --git a/debian/patches/pve/0041-PVE-backup-factor-out-helper-to-initialize-backup-st.patch b/debian/patches/pve/0039-PVE-backup-factor-out-helper-to-initialize-backup-st.patch
similarity index 100%
rename from debian/patches/pve/0041-PVE-backup-factor-out-helper-to-initialize-backup-st.patch
rename to debian/patches/pve/0039-PVE-backup-factor-out-helper-to-initialize-backup-st.patch
diff --git a/debian/patches/pve/0042-PVE-backup-add-target-ID-in-backup-state.patch b/debian/patches/pve/0040-PVE-backup-add-target-ID-in-backup-state.patch
similarity index 100%
rename from debian/patches/pve/0042-PVE-backup-add-target-ID-in-backup-state.patch
rename to debian/patches/pve/0040-PVE-backup-add-target-ID-in-backup-state.patch
diff --git a/debian/patches/pve/0043-PVE-backup-get-device-info-allow-caller-to-specify-f.patch b/debian/patches/pve/0041-PVE-backup-get-device-info-allow-caller-to-specify-f.patch
similarity index 100%
rename from debian/patches/pve/0043-PVE-backup-get-device-info-allow-caller-to-specify-f.patch
rename to debian/patches/pve/0041-PVE-backup-get-device-info-allow-caller-to-specify-f.patch
diff --git a/debian/patches/pve/0044-PVE-backup-implement-backup-access-setup-and-teardow.patch b/debian/patches/pve/0042-PVE-backup-implement-backup-access-setup-and-teardow.patch
similarity index 99%
rename from debian/patches/pve/0044-PVE-backup-implement-backup-access-setup-and-teardow.patch
rename to debian/patches/pve/0042-PVE-backup-implement-backup-access-setup-and-teardow.patch
index 031eeba6b6..f74e82017a 100644
--- a/debian/patches/pve/0044-PVE-backup-implement-backup-access-setup-and-teardow.patch
+++ b/debian/patches/pve/0042-PVE-backup-implement-backup-access-setup-and-teardow.patch
@@ -740,7 +740,7 @@ index 0000000000..9ebeef7c8f
+
+#endif /* PVE_BACKUP_H */
diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 977daf0191..ed37a4a22f 100644
+index 2dd422aa03..7ef1dd337c 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -1128,6 +1128,9 @@
@@ -879,18 +879,18 @@ index 977daf0191..ed37a4a22f 100644
# @BlockDeviceTimedStats:
#
diff --git a/system/runstate.c b/system/runstate.c
-index 2d4e95a216..49a6d5f268 100644
+index 08acf801b0..22306e66bf 100644
--- a/system/runstate.c
+++ b/system/runstate.c
-@@ -62,6 +62,7 @@
- #include "system/system.h"
- #include "system/tpm.h"
+@@ -64,6 +64,7 @@
+ #include "ui/console.h"
+
#include "trace.h"
+#include "pve-backup.h"
static NotifierList exit_notifiers =
NOTIFIER_LIST_INITIALIZER(exit_notifiers);
-@@ -1031,6 +1032,11 @@ void qemu_cleanup(int status)
+@@ -1036,6 +1037,11 @@ void qemu_cleanup(int status)
* requests happening from here on anyway.
*/
bdrv_drain_all_begin();
diff --git a/debian/patches/pve/0045-PVE-backup-prepare-for-the-switch-to-using-blockdev-.patch b/debian/patches/pve/0043-PVE-backup-prepare-for-the-switch-to-using-blockdev-.patch
similarity index 100%
rename from debian/patches/pve/0045-PVE-backup-prepare-for-the-switch-to-using-blockdev-.patch
rename to debian/patches/pve/0043-PVE-backup-prepare-for-the-switch-to-using-blockdev-.patch
diff --git a/debian/patches/pve/0046-savevm-async-reuse-migration-blocker-check-for-snaps.patch b/debian/patches/pve/0044-savevm-async-reuse-migration-blocker-check-for-snaps.patch
similarity index 94%
rename from debian/patches/pve/0046-savevm-async-reuse-migration-blocker-check-for-snaps.patch
rename to debian/patches/pve/0044-savevm-async-reuse-migration-blocker-check-for-snaps.patch
index 5cc3893b82..76b4c23e6b 100644
--- a/debian/patches/pve/0046-savevm-async-reuse-migration-blocker-check-for-snaps.patch
+++ b/debian/patches/pve/0044-savevm-async-reuse-migration-blocker-check-for-snaps.patch
@@ -89,10 +89,10 @@ index 80b75ad5cb..f8417347a1 100644
* @migrate_add_blocker - prevent all modes of migration from proceeding
*
diff --git a/migration/migration.c b/migration/migration.c
-index f415448689..979fc7050e 100644
+index 2d8149e651..d15f524eaf 100644
--- a/migration/migration.c
+++ b/migration/migration.c
-@@ -1886,6 +1886,30 @@ bool migration_is_blocked(Error **errp)
+@@ -1953,6 +1953,30 @@ bool migration_is_blocked(Error **errp)
return false;
}
@@ -124,10 +124,10 @@ index f415448689..979fc7050e 100644
static bool migrate_prepare(MigrationState *s, bool resume, Error **errp)
{
diff --git a/migration/migration.h b/migration/migration.h
-index b6888daced..80eb0dcd1f 100644
+index 631421c784..1d07f71a24 100644
--- a/migration/migration.h
+++ b/migration/migration.h
-@@ -542,6 +542,7 @@ int migration_call_notifiers(MigrationEventType type, Error **errp);
+@@ -564,6 +564,7 @@ int migration_call_notifiers(MigrationEventType type, Error **errp);
int migrate_init(MigrationState *s, Error **errp);
bool migration_is_blocked(Error **errp);
@@ -136,10 +136,10 @@ index b6888daced..80eb0dcd1f 100644
bool migration_in_postcopy(void);
bool migration_postcopy_is_alive(MigrationStatus state);
diff --git a/migration/savevm-async.c b/migration/savevm-async.c
-index f9eaf3b8e6..51340c5dcd 100644
+index 67b69bf3ac..3ab0bd4539 100644
--- a/migration/savevm-async.c
+++ b/migration/savevm-async.c
-@@ -384,7 +384,7 @@ void qmp_savevm_start(const char *statefile, bool has_skip_vm_start,
+@@ -399,7 +399,7 @@ void qmp_savevm_start(const char *statefile, bool has_skip_vm_start,
return;
}
diff --git a/debian/patches/pve/0047-pbs-restore-add-no-cache-flag-to-skip-host-page-cach.patch b/debian/patches/pve/0045-pbs-restore-add-no-cache-flag-to-skip-host-page-cach.patch
similarity index 100%
rename from debian/patches/pve/0047-pbs-restore-add-no-cache-flag-to-skip-host-page-cach.patch
rename to debian/patches/pve/0045-pbs-restore-add-no-cache-flag-to-skip-host-page-cach.patch
diff --git a/debian/patches/series b/debian/patches/series
index 6ef37f4bb8..310ad44595 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,29 +1,8 @@
extra/0001-monitor-qmp-fix-race-with-clients-disconnecting-earl.patch
extra/0002-fdmon-io_uring-avoid-idle-event-loop-being-accounted.patch
-extra/0003-block-export-fuse-fix-regression-with-block-device-e.patch
-extra/0004-block-vmdk-tolerate-known-seSparse-reserved1-bit.patch
-extra/0005-ui-vnc-use-RFB-wire-types-for-client-message-handler.patch
-extra/0006-hw-display-qxl-validate-primary-surface-stride-again.patch
-extra/0007-hw-display-virtio-gpu-validate-stride-against-width-.patch
-extra/0008-hw-display-virtio-gpu-Remove-the-bytes_pp-field.patch
-extra/0009-hw-display-virtio-gpu-reject-strides-exceeding-INT_M.patch
-extra/0010-intel_iommu-fix-guest-triggerable-abort-on-oversized.patch
-extra/0011-backends-rng-cap-request-size-to-avoid-oversized-all.patch
-extra/0012-hw-ide-replace-assert-with-proper-error-handling.patch
-extra/0013-hw-virtio-reject-zero-length-packed-indirect-descrip.patch
-extra/0014-hw-net-virtio-net-Protect-from-DMA-re-entrancy-bugs.patch
-extra/0015-hw-display-qxl-unregister-vm_change_state-handler-an.patch
-extra/0016-hw-ide-core-Fix-possible-crash-via-NULL-pointer-in-i.patch
-extra/0017-hw-usb-core-Avoid-possible-assert-in-do_parameter-us.patch
-extra/0018-hw-usb-hcd-xhci-Check-return-value-of-xhci_xfer_crea.patch
-extra/0019-hw-display-vmware_vga-Don-t-allow-guest-to-trigger-l.patch
-extra/0020-scsi-disk-fix-off-by-one-in-assertion.patch
-extra/0021-target-i386-helper_sysret-Check-that-RCX-contains-a-.patch
-extra/0022-hw-9pfs-fix-O_TRUNC-bypass-on-read-only-export.patch
-extra/0023-hw-9pfs-virtio-drain-in-flight-PDUs-before-virtio-9p.patch
-extra/0024-vfio-pci-don-t-narrow-a-failed-config-read-to-a-plau.patch
-extra/0025-vfio-pci-reject-invalid-PCI_INTERRUPT_PIN-values.patch
-extra/0026-hw-scsi-lsi53c895a-gracefully-handle-re-entrant-DMA.patch
+extra/0003-block-vmdk-tolerate-known-seSparse-reserved1-bit.patch
+extra/0004-hw-display-qxl-validate-primary-surface-stride-again.patch
+extra/0005-hw-scsi-lsi53c895a-gracefully-handle-re-entrant-DMA.patch
bitmap-mirror/0001-drive-mirror-add-support-for-sync-bitmap-mode-never.patch
bitmap-mirror/0002-drive-mirror-add-support-for-conditional-and-always-.patch
bitmap-mirror/0003-mirror-add-check-for-bitmap-mode-without-bitmap.patch
@@ -34,46 +13,44 @@ pve/0001-PVE-Config-block-file-change-locking-default-to-off.patch
pve/0002-PVE-Config-Adjust-network-script-path-to-etc-kvm.patch
pve/0003-PVE-Config-set-the-CPU-model-to-kvm64-32-instead-of-.patch
pve/0004-PVE-Config-ui-spice-default-to-pve-certificates.patch
-pve/0005-PVE-Config-glusterfs-no-default-logfile-if-daemonize.patch
-pve/0006-PVE-Config-rbd-block-rbd-disable-rbd_cache_writethro.patch
-pve/0007-PVE-Up-glusterfs-allow-partial-reads.patch
-pve/0008-PVE-Up-qemu-img-return-success-on-info-without-snaps.patch
-pve/0009-PVE-Up-qemu-img-dd-add-osize-and-read-from-to-stdin-.patch
-pve/0010-PVE-Up-qemu-img-dd-add-isize-parameter.patch
-pve/0011-PVE-Up-qemu-img-dd-add-n-skip_create.patch
-pve/0012-qemu-img-dd-add-l-option-for-loading-a-snapshot.patch
-pve/0013-PVE-virtio-balloon-improve-query-balloon.patch
-pve/0014-PVE-qapi-modify-query-machines.patch
-pve/0015-PVE-qapi-modify-spice-query.patch
-pve/0016-PVE-add-IOChannel-implementation-for-savevm-async.patch
-pve/0017-PVE-add-savevm-async-for-background-state-snapshots.patch
-pve/0018-PVE-add-optional-buffer-size-to-QEMUFile.patch
-pve/0019-PVE-block-add-the-zeroinit-block-driver-filter.patch
-pve/0020-PVE-Add-dummy-id-command-line-parameter.patch
-pve/0021-PVE-Config-Revert-target-i386-disable-LINT0-after-re.patch
-pve/0022-PVE-Up-Config-file-posix-make-locking-optiono-on-cre.patch
-pve/0023-PVE-monitor-disable-oob-capability.patch
-pve/0024-PVE-Allow-version-code-in-machine-type.patch
-pve/0025-block-backup-move-bcs-bitmap-initialization-to-job-c.patch
-pve/0026-PVE-Backup-add-vma-backup-format-code.patch
-pve/0027-PVE-Backup-add-backup-dump-block-driver.patch
-pve/0028-PVE-Add-sequential-job-transaction-support.patch
-pve/0029-PVE-Backup-Proxmox-backup-patches-for-QEMU.patch
-pve/0030-PVE-Backup-pbs-restore-new-command-to-restore-from-p.patch
-pve/0031-PVE-Add-PBS-block-driver-to-map-backup-archives-into.patch
-pve/0032-PVE-redirect-stderr-to-journal-when-daemonized.patch
-pve/0033-PVE-Migrate-dirty-bitmap-state-via-savevm.patch
-pve/0034-migration-block-dirty-bitmap-migrate-other-bitmaps-e.patch
-pve/0035-PVE-fall-back-to-open-iscsi-initiatorname.patch
-pve/0036-PVE-block-stream-increase-chunk-size.patch
-pve/0037-block-add-alloc-track-driver.patch
-pve/0038-PVE-backup-add-fleecing-option.patch
-pve/0039-adapt-machine-version-deprecation-for-Proxmox-VE.patch
-pve/0040-PVE-backup-factor-out-helper-to-clear-backup-state-s.patch
-pve/0041-PVE-backup-factor-out-helper-to-initialize-backup-st.patch
-pve/0042-PVE-backup-add-target-ID-in-backup-state.patch
-pve/0043-PVE-backup-get-device-info-allow-caller-to-specify-f.patch
-pve/0044-PVE-backup-implement-backup-access-setup-and-teardow.patch
-pve/0045-PVE-backup-prepare-for-the-switch-to-using-blockdev-.patch
-pve/0046-savevm-async-reuse-migration-blocker-check-for-snaps.patch
-pve/0047-pbs-restore-add-no-cache-flag-to-skip-host-page-cach.patch
+pve/0005-PVE-Config-rbd-block-rbd-disable-rbd_cache_writethro.patch
+pve/0006-PVE-Up-qemu-img-return-success-on-info-without-snaps.patch
+pve/0007-PVE-Up-qemu-img-dd-add-osize-and-read-from-to-stdin-.patch
+pve/0008-PVE-Up-qemu-img-dd-add-isize-parameter.patch
+pve/0009-PVE-Up-qemu-img-dd-add-n-skip_create.patch
+pve/0010-qemu-img-dd-add-l-option-for-loading-a-snapshot.patch
+pve/0011-PVE-virtio-balloon-improve-query-balloon.patch
+pve/0012-PVE-qapi-modify-query-machines.patch
+pve/0013-PVE-qapi-modify-spice-query.patch
+pve/0014-PVE-add-IOChannel-implementation-for-savevm-async.patch
+pve/0015-PVE-add-savevm-async-for-background-state-snapshots.patch
+pve/0016-PVE-add-optional-buffer-size-to-QEMUFile.patch
+pve/0017-PVE-block-add-the-zeroinit-block-driver-filter.patch
+pve/0018-PVE-Add-dummy-id-command-line-parameter.patch
+pve/0019-PVE-Config-Revert-target-i386-disable-LINT0-after-re.patch
+pve/0020-PVE-Up-Config-file-posix-make-locking-optiono-on-cre.patch
+pve/0021-PVE-monitor-disable-oob-capability.patch
+pve/0022-PVE-Allow-version-code-in-machine-type.patch
+pve/0023-block-backup-move-bcs-bitmap-initialization-to-job-c.patch
+pve/0024-PVE-Backup-add-vma-backup-format-code.patch
+pve/0025-PVE-Backup-add-backup-dump-block-driver.patch
+pve/0026-PVE-Add-sequential-job-transaction-support.patch
+pve/0027-PVE-Backup-Proxmox-backup-patches-for-QEMU.patch
+pve/0028-PVE-Backup-pbs-restore-new-command-to-restore-from-p.patch
+pve/0029-PVE-Add-PBS-block-driver-to-map-backup-archives-into.patch
+pve/0030-PVE-redirect-stderr-to-journal-when-daemonized.patch
+pve/0031-PVE-Migrate-dirty-bitmap-state-via-savevm.patch
+pve/0032-migration-block-dirty-bitmap-migrate-other-bitmaps-e.patch
+pve/0033-PVE-fall-back-to-open-iscsi-initiatorname.patch
+pve/0034-PVE-block-stream-increase-chunk-size.patch
+pve/0035-block-add-alloc-track-driver.patch
+pve/0036-PVE-backup-add-fleecing-option.patch
+pve/0037-adapt-machine-version-deprecation-for-Proxmox-VE.patch
+pve/0038-PVE-backup-factor-out-helper-to-clear-backup-state-s.patch
+pve/0039-PVE-backup-factor-out-helper-to-initialize-backup-st.patch
+pve/0040-PVE-backup-add-target-ID-in-backup-state.patch
+pve/0041-PVE-backup-get-device-info-allow-caller-to-specify-f.patch
+pve/0042-PVE-backup-implement-backup-access-setup-and-teardow.patch
+pve/0043-PVE-backup-prepare-for-the-switch-to-using-blockdev-.patch
+pve/0044-savevm-async-reuse-migration-blocker-check-for-snaps.patch
+pve/0045-pbs-restore-add-no-cache-flag-to-skip-host-page-cach.patch
diff --git a/qemu b/qemu
index aeec49e817..c3d48b7d1e 160000
--- a/qemu
+++ b/qemu
@@ -1 +1 @@
-Subproject commit aeec49e8170de7846f476124602cf7acd400c3df
+Subproject commit c3d48b7d1e89604920e5b81b91140c2ad39a1943
--
2.47.3
^ permalink raw reply related [flat|nested] 8+ messages in thread* [PATCH qemu-server v2 6/7] monitor: use new QOM syntax on the QEMU commandline for monitor objects
2026-09-09 14:52 [PATCH-SERIES qemu/qemu-server v2 0/7] QEMU 11.1.1 Fiona Ebner
` (4 preceding siblings ...)
2026-09-09 14:52 ` [PATCH qemu-server v2 5/7] test: cfg2cmd: add simple test case using an 11.0 binary Fiona Ebner
@ 2026-09-09 14:52 ` Fiona Ebner
2026-09-09 14:52 ` [PATCH qemu-server v2 7/7] d/control: bump versioned build dependency for pve-qemu-kvm Fiona Ebner
6 siblings, 0 replies; 8+ messages in thread
From: Fiona Ebner @ 2026-09-09 14:52 UTC (permalink / raw)
To: pve-devel
To avoid a deprecation warning, use the new QEMU object model syntax
when specifying a monitor object on the QEMU commandline. Note that
'mode=control' is what made it a QMP monitor rather than an HMP
monitor before, so that parameter is gone now. Additionally an ID is
required, where "monitor-$chardev_id" is chosen.
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---
Changes in v2:
* Rebase on current master.
src/PVE/QemuServer.pm | 8 ++++----
src/PVE/QemuServer/Monitor.pm | 11 +++++++++++
src/test/cfg2cmd/aarch64/simple-arm-host.conf.cmd | 4 ++--
src/test/cfg2cmd/aarch64/simple-arm.conf.cmd | 4 ++--
.../cfg2cmd/aarch64/simple-x86-on-arm-host.conf.cmd | 4 ++--
src/test/cfg2cmd/aio.conf.cmd | 4 ++--
src/test/cfg2cmd/bootorder-empty.conf.cmd | 4 ++--
src/test/cfg2cmd/bootorder-legacy.conf.cmd | 4 ++--
src/test/cfg2cmd/bootorder.conf.cmd | 4 ++--
src/test/cfg2cmd/cpu-level.conf.cmd | 4 ++--
.../cputype-icelake-client-deprecation.conf.cmd | 4 ++--
src/test/cfg2cmd/custom-cpu-model-defaults.conf.cmd | 4 ++--
.../cfg2cmd/custom-cpu-model-host-phys-bits.conf.cmd | 4 ++--
src/test/cfg2cmd/custom-cpu-model.conf.cmd | 4 ++--
src/test/cfg2cmd/efi-ovmf-without-efidisk.conf.cmd | 4 ++--
src/test/cfg2cmd/efi-raw-old.conf.cmd | 4 ++--
src/test/cfg2cmd/efi-raw-template.conf.cmd | 4 ++--
src/test/cfg2cmd/efi-raw.conf.cmd | 4 ++--
src/test/cfg2cmd/efi-secboot-and-tpm-q35.conf.cmd | 4 ++--
src/test/cfg2cmd/efi-secboot-and-tpm.conf.cmd | 4 ++--
src/test/cfg2cmd/efidisk-on-rbd.conf.cmd | 4 ++--
src/test/cfg2cmd/i440fx-viommu-virtio.conf.cmd | 4 ++--
src/test/cfg2cmd/i440fx-win10-hostpci.conf.cmd | 4 ++--
src/test/cfg2cmd/ide.conf.cmd | 4 ++--
src/test/cfg2cmd/linux-hostpci-legacy-igd.conf.cmd | 4 ++--
src/test/cfg2cmd/memory-hotplug-hugepages.conf.cmd | 4 ++--
src/test/cfg2cmd/memory-hotplug.conf.cmd | 4 ++--
src/test/cfg2cmd/memory-hugepages-1g.conf.cmd | 4 ++--
src/test/cfg2cmd/memory-hugepages-2m.conf.cmd | 4 ++--
src/test/cfg2cmd/minimal-defaults.conf.cmd | 4 ++--
src/test/cfg2cmd/netdev-7.0-multiqueues.conf.cmd | 4 ++--
src/test/cfg2cmd/netdev-7.1-multiqueues.conf.cmd | 4 ++--
src/test/cfg2cmd/netdev-7.1.conf.cmd | 4 ++--
src/test/cfg2cmd/netdev.conf.cmd | 4 ++--
src/test/cfg2cmd/netdev_vxlan.conf.cmd | 4 ++--
src/test/cfg2cmd/os-l24.conf.cmd | 4 ++--
src/test/cfg2cmd/os-other.conf.cmd | 4 ++--
src/test/cfg2cmd/os-solaris.conf.cmd | 4 ++--
src/test/cfg2cmd/pinned-version-pxe-pve.conf.cmd | 4 ++--
src/test/cfg2cmd/pinned-version-pxe.conf.cmd | 4 ++--
src/test/cfg2cmd/pinned-version.conf.cmd | 4 ++--
src/test/cfg2cmd/q35-ide.conf.cmd | 4 ++--
.../cfg2cmd/q35-linux-hostpci-driver-keep.conf.cmd | 4 ++--
src/test/cfg2cmd/q35-linux-hostpci-mapping.conf.cmd | 4 ++--
.../cfg2cmd/q35-linux-hostpci-multifunction.conf.cmd | 4 ++--
src/test/cfg2cmd/q35-linux-hostpci-template.conf.cmd | 4 ++--
.../q35-linux-hostpci-x-pci-overrides.conf.cmd | 4 ++--
src/test/cfg2cmd/q35-linux-hostpci.conf.cmd | 4 ++--
src/test/cfg2cmd/q35-scsihw2.conf.cmd | 4 ++--
src/test/cfg2cmd/q35-simple-6.0.conf.cmd | 4 ++--
src/test/cfg2cmd/q35-simple-7.0.conf.cmd | 4 ++--
src/test/cfg2cmd/q35-simple-pinned-6.1.conf.cmd | 4 ++--
src/test/cfg2cmd/q35-simple.conf.cmd | 4 ++--
src/test/cfg2cmd/q35-usb2.conf.cmd | 4 ++--
src/test/cfg2cmd/q35-usb3.conf.cmd | 4 ++--
src/test/cfg2cmd/q35-viommu-intel-aw-bits.conf.cmd | 4 ++--
.../cfg2cmd/q35-viommu-intel-guest-phys-bits.conf.cmd | 4 ++--
src/test/cfg2cmd/q35-viommu-intel.conf.cmd | 4 ++--
src/test/cfg2cmd/q35-viommu-virtio-aw-bits.conf.cmd | 4 ++--
src/test/cfg2cmd/q35-viommu-virtio.conf.cmd | 4 ++--
src/test/cfg2cmd/q35-win10-hostpci.conf.cmd | 4 ++--
src/test/cfg2cmd/q35-windows-pinning.conf.cmd | 4 ++--
src/test/cfg2cmd/qemu-xhci-7.1.conf.cmd | 4 ++--
src/test/cfg2cmd/qemu-xhci-q35-7.1.conf.cmd | 4 ++--
src/test/cfg2cmd/qga-fs-freeze-backup-legacy.conf.cmd | 4 ++--
src/test/cfg2cmd/qga-fs-freeze.conf.cmd | 4 ++--
src/test/cfg2cmd/qga-minimal.conf.cmd | 4 ++--
src/test/cfg2cmd/scsiblk.conf.cmd | 4 ++--
src/test/cfg2cmd/scsihw-lsi.conf.cmd | 4 ++--
src/test/cfg2cmd/scsihw-lsi53c810.conf.cmd | 4 ++--
src/test/cfg2cmd/scsihw-megasas.conf.cmd | 4 ++--
src/test/cfg2cmd/scsihw-pvscsi.conf.cmd | 4 ++--
src/test/cfg2cmd/scsihw-virtio-scsi-single.conf.cmd | 4 ++--
src/test/cfg2cmd/seabios_serial.conf.cmd | 4 ++--
src/test/cfg2cmd/sev-es.conf.cmd | 4 ++--
src/test/cfg2cmd/sev-snp.conf.cmd | 4 ++--
src/test/cfg2cmd/sev-std.conf.cmd | 4 ++--
src/test/cfg2cmd/simple-backingchain.conf.cmd | 4 ++--
.../simple-balloon-free-page-reporting.conf.cmd | 4 ++--
src/test/cfg2cmd/simple-btrfs.conf.cmd | 4 ++--
src/test/cfg2cmd/simple-cifs.conf.cmd | 4 ++--
src/test/cfg2cmd/simple-disk-passthrough.conf.cmd | 4 ++--
src/test/cfg2cmd/simple-lvm.conf.cmd | 4 ++--
src/test/cfg2cmd/simple-lvmthin.conf.cmd | 4 ++--
src/test/cfg2cmd/simple-rbd.conf.cmd | 4 ++--
src/test/cfg2cmd/simple-virtio-blk.conf.cmd | 4 ++--
src/test/cfg2cmd/simple-zfs-over-iscsi.conf.cmd | 4 ++--
src/test/cfg2cmd/simple1-template.conf.cmd | 4 ++--
src/test/cfg2cmd/simple1.conf.cmd | 4 ++--
src/test/cfg2cmd/spice-enhancments.conf.cmd | 4 ++--
src/test/cfg2cmd/spice-linux-4.1.conf.cmd | 4 ++--
src/test/cfg2cmd/spice-usb3.conf.cmd | 4 ++--
src/test/cfg2cmd/spice-win.conf.cmd | 4 ++--
src/test/cfg2cmd/startdate-l26.conf.cmd | 4 ++--
src/test/cfg2cmd/startdate-win11.conf.cmd | 4 ++--
src/test/cfg2cmd/vnc-clipboard-spice.conf.cmd | 4 ++--
src/test/cfg2cmd/vnc-clipboard-std.conf.cmd | 4 ++--
src/test/cfg2cmd/win11-amd-host-11.0+pve2.conf.cmd | 4 ++--
src/test/cfg2cmd/win11-host-11.0+pve2.conf.cmd | 4 ++--
99 files changed, 209 insertions(+), 198 deletions(-)
diff --git a/src/PVE/QemuServer.pm b/src/PVE/QemuServer.pm
index 149f17be..7e7ba965 100644
--- a/src/PVE/QemuServer.pm
+++ b/src/PVE/QemuServer.pm
@@ -2989,6 +2989,7 @@ sub query_supported_cpu_flags {
my $kvm_supported = defined(kvm_version()) && $arch eq $host_arch;
my $qemu_cmd = PVE::QemuServer::Helpers::get_command_for_arch($arch);
+ my $qemu_binary_version = kvm_user_version($qemu_cmd);
my $fakevmid = -1;
my $pidfile = PVE::QemuServer::Helpers::vm_pidfile_name($fakevmid);
@@ -3005,8 +3006,7 @@ sub query_supported_cpu_flags {
'none',
'-chardev',
"socket,id=qmp,path=/var/run/qemu-server/$fakevmid.qmp,server=on,wait=off",
- '-mon',
- 'chardev=qmp,mode=control',
+ PVE::QemuServer::Monitor::object_commandline($qemu_binary_version, 'qmp')->@*,
'-pidfile',
$pidfile,
'-S',
@@ -3222,7 +3222,7 @@ sub config_to_command {
my $qmpsocket = PVE::QemuServer::Helpers::qmp_socket(vm_qmp_peer($vmid));
push @$cmd, '-chardev', "socket,id=qmp,path=$qmpsocket,server=on,wait=off";
- push @$cmd, '-mon', "chardev=qmp,mode=control";
+ push @$cmd, PVE::QemuServer::Monitor::object_commandline($kvmver, 'qmp')->@*;
if (min_version($machine_version, 2, 12)) {
# QEMU 9.2 introduced a new 'reconnect-ms' option while deprecating the 'reconnect' option
@@ -3231,7 +3231,7 @@ sub config_to_command {
$reconnect_param = "reconnect-ms=5000";
}
push @$cmd, '-chardev', "socket,id=qmp-event,path=/var/run/qmeventd.sock,$reconnect_param";
- push @$cmd, '-mon', "chardev=qmp-event,mode=control";
+ push @$cmd, PVE::QemuServer::Monitor::object_commandline($kvmver, 'qmp-event')->@*;
}
push @$cmd, '-pidfile', PVE::QemuServer::Helpers::vm_pidfile_name($vmid);
diff --git a/src/PVE/QemuServer/Monitor.pm b/src/PVE/QemuServer/Monitor.pm
index c6e7193c..d8735c92 100644
--- a/src/PVE/QemuServer/Monitor.pm
+++ b/src/PVE/QemuServer/Monitor.pm
@@ -140,4 +140,15 @@ sub hmp_cmd {
);
}
+sub object_commandline {
+ my ($qemu_binary_version, $chardev) = @_;
+
+ if (PVE::QemuServer::Helpers::min_version($qemu_binary_version, 11, 1)) {
+ # use new style to avoid deprecation warning
+ return ['-object', "monitor-qmp,chardev=${chardev},id=monitor-${chardev}"];
+ }
+
+ return ['-mon', "chardev=${chardev},mode=control"];
+}
+
1;
diff --git a/src/test/cfg2cmd/aarch64/simple-arm-host.conf.cmd b/src/test/cfg2cmd/aarch64/simple-arm-host.conf.cmd
index fd4f58e2..3ce92dec 100644
--- a/src/test/cfg2cmd/aarch64/simple-arm-host.conf.cmd
+++ b/src/test/cfg2cmd/aarch64/simple-arm-host.conf.cmd
@@ -3,9 +3,9 @@
-name simple \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=7b10d7af-b932-4c66-b2c3-3996152ec465' \
diff --git a/src/test/cfg2cmd/aarch64/simple-arm.conf.cmd b/src/test/cfg2cmd/aarch64/simple-arm.conf.cmd
index 67bbe72a..f1d779b5 100644
--- a/src/test/cfg2cmd/aarch64/simple-arm.conf.cmd
+++ b/src/test/cfg2cmd/aarch64/simple-arm.conf.cmd
@@ -3,9 +3,9 @@
-name simple \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=7b10d7af-b932-4c66-b2c3-3996152ec465' \
diff --git a/src/test/cfg2cmd/aarch64/simple-x86-on-arm-host.conf.cmd b/src/test/cfg2cmd/aarch64/simple-x86-on-arm-host.conf.cmd
index 9e932d6b..aeff3089 100644
--- a/src/test/cfg2cmd/aarch64/simple-x86-on-arm-host.conf.cmd
+++ b/src/test/cfg2cmd/aarch64/simple-x86-on-arm-host.conf.cmd
@@ -3,9 +3,9 @@
-name simple \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=7b10d7af-b932-4c66-b2c3-3996152ec465' \
diff --git a/src/test/cfg2cmd/aio.conf.cmd b/src/test/cfg2cmd/aio.conf.cmd
index 2e275f6d..a9724880 100644
--- a/src/test/cfg2cmd/aio.conf.cmd
+++ b/src/test/cfg2cmd/aio.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smp '1,sockets=1,cores=1,maxcpus=1' \
diff --git a/src/test/cfg2cmd/bootorder-empty.conf.cmd b/src/test/cfg2cmd/bootorder-empty.conf.cmd
index d6a56e79..dceb4170 100644
--- a/src/test/cfg2cmd/bootorder-empty.conf.cmd
+++ b/src/test/cfg2cmd/bootorder-empty.conf.cmd
@@ -3,9 +3,9 @@
-name simple \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=7b10d7af-b932-4c66-b2c3-3996152ec465' \
diff --git a/src/test/cfg2cmd/bootorder-legacy.conf.cmd b/src/test/cfg2cmd/bootorder-legacy.conf.cmd
index b03e1193..f854c226 100644
--- a/src/test/cfg2cmd/bootorder-legacy.conf.cmd
+++ b/src/test/cfg2cmd/bootorder-legacy.conf.cmd
@@ -3,9 +3,9 @@
-name simple \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=7b10d7af-b932-4c66-b2c3-3996152ec465' \
diff --git a/src/test/cfg2cmd/bootorder.conf.cmd b/src/test/cfg2cmd/bootorder.conf.cmd
index 70203ff9..0e9f3ada 100644
--- a/src/test/cfg2cmd/bootorder.conf.cmd
+++ b/src/test/cfg2cmd/bootorder.conf.cmd
@@ -3,9 +3,9 @@
-name simple \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=7b10d7af-b932-4c66-b2c3-3996152ec465' \
diff --git a/src/test/cfg2cmd/cpu-level.conf.cmd b/src/test/cfg2cmd/cpu-level.conf.cmd
index 5d5f760d..5e824135 100644
--- a/src/test/cfg2cmd/cpu-level.conf.cmd
+++ b/src/test/cfg2cmd/cpu-level.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smp '1,sockets=1,cores=1,maxcpus=1' \
diff --git a/src/test/cfg2cmd/cputype-icelake-client-deprecation.conf.cmd b/src/test/cfg2cmd/cputype-icelake-client-deprecation.conf.cmd
index c223929e..c151735c 100644
--- a/src/test/cfg2cmd/cputype-icelake-client-deprecation.conf.cmd
+++ b/src/test/cfg2cmd/cputype-icelake-client-deprecation.conf.cmd
@@ -3,9 +3,9 @@
-name simple \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=7b10d7af-b932-4c66-b2c3-3996152ec465' \
diff --git a/src/test/cfg2cmd/custom-cpu-model-defaults.conf.cmd b/src/test/cfg2cmd/custom-cpu-model-defaults.conf.cmd
index 7b43d8e0..dcbf054c 100644
--- a/src/test/cfg2cmd/custom-cpu-model-defaults.conf.cmd
+++ b/src/test/cfg2cmd/custom-cpu-model-defaults.conf.cmd
@@ -3,9 +3,9 @@
-name customcpu-defaults \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=2ea3f676-dfa5-11e9-ae82-c721e12f3fce' \
diff --git a/src/test/cfg2cmd/custom-cpu-model-host-phys-bits.conf.cmd b/src/test/cfg2cmd/custom-cpu-model-host-phys-bits.conf.cmd
index 665e05d7..8a193572 100644
--- a/src/test/cfg2cmd/custom-cpu-model-host-phys-bits.conf.cmd
+++ b/src/test/cfg2cmd/custom-cpu-model-host-phys-bits.conf.cmd
@@ -3,9 +3,9 @@
-name customcpu \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=2ea3f676-dfa5-11e9-ae82-c721e12f3fcf' \
diff --git a/src/test/cfg2cmd/custom-cpu-model.conf.cmd b/src/test/cfg2cmd/custom-cpu-model.conf.cmd
index 40c7787e..2035f54a 100644
--- a/src/test/cfg2cmd/custom-cpu-model.conf.cmd
+++ b/src/test/cfg2cmd/custom-cpu-model.conf.cmd
@@ -3,9 +3,9 @@
-name customcpu \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=2ea3f676-dfa5-11e9-ae82-c721e12f3fcf' \
diff --git a/src/test/cfg2cmd/efi-ovmf-without-efidisk.conf.cmd b/src/test/cfg2cmd/efi-ovmf-without-efidisk.conf.cmd
index bab304dc..336011bf 100644
--- a/src/test/cfg2cmd/efi-ovmf-without-efidisk.conf.cmd
+++ b/src/test/cfg2cmd/efi-ovmf-without-efidisk.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=7b10d7af-b932-4c66-b2c3-3996152ec465' \
diff --git a/src/test/cfg2cmd/efi-raw-old.conf.cmd b/src/test/cfg2cmd/efi-raw-old.conf.cmd
index 774607e6..939f339c 100644
--- a/src/test/cfg2cmd/efi-raw-old.conf.cmd
+++ b/src/test/cfg2cmd/efi-raw-old.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=7b10d7af-b932-4c66-b2c3-3996152ec465' \
diff --git a/src/test/cfg2cmd/efi-raw-template.conf.cmd b/src/test/cfg2cmd/efi-raw-template.conf.cmd
index 34d509cb..5b66b1c3 100644
--- a/src/test/cfg2cmd/efi-raw-template.conf.cmd
+++ b/src/test/cfg2cmd/efi-raw-template.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-object '{"id":"throttle-drive-efidisk0","limits":{},"qom-type":"throttle-group"}' \
diff --git a/src/test/cfg2cmd/efi-raw.conf.cmd b/src/test/cfg2cmd/efi-raw.conf.cmd
index bf35f1d6..1c510b7d 100644
--- a/src/test/cfg2cmd/efi-raw.conf.cmd
+++ b/src/test/cfg2cmd/efi-raw.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=7b10d7af-b932-4c66-b2c3-3996152ec465' \
diff --git a/src/test/cfg2cmd/efi-secboot-and-tpm-q35.conf.cmd b/src/test/cfg2cmd/efi-secboot-and-tpm-q35.conf.cmd
index 4d12b034..99ff1781 100644
--- a/src/test/cfg2cmd/efi-secboot-and-tpm-q35.conf.cmd
+++ b/src/test/cfg2cmd/efi-secboot-and-tpm-q35.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=7b10d7af-b932-4c66-b2c3-3996152ec465' \
diff --git a/src/test/cfg2cmd/efi-secboot-and-tpm.conf.cmd b/src/test/cfg2cmd/efi-secboot-and-tpm.conf.cmd
index 84721318..2fbb8b27 100644
--- a/src/test/cfg2cmd/efi-secboot-and-tpm.conf.cmd
+++ b/src/test/cfg2cmd/efi-secboot-and-tpm.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=7b10d7af-b932-4c66-b2c3-3996152ec465' \
diff --git a/src/test/cfg2cmd/efidisk-on-rbd.conf.cmd b/src/test/cfg2cmd/efidisk-on-rbd.conf.cmd
index 6a1cae98..45c6bfff 100644
--- a/src/test/cfg2cmd/efidisk-on-rbd.conf.cmd
+++ b/src/test/cfg2cmd/efidisk-on-rbd.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=3dd750ce-d910-44d0-9493-525c0be4e688' \
diff --git a/src/test/cfg2cmd/i440fx-viommu-virtio.conf.cmd b/src/test/cfg2cmd/i440fx-viommu-virtio.conf.cmd
index d90c7ad6..93e3ebea 100644
--- a/src/test/cfg2cmd/i440fx-viommu-virtio.conf.cmd
+++ b/src/test/cfg2cmd/i440fx-viommu-virtio.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smp '1,sockets=1,cores=1,maxcpus=1' \
diff --git a/src/test/cfg2cmd/i440fx-win10-hostpci.conf.cmd b/src/test/cfg2cmd/i440fx-win10-hostpci.conf.cmd
index 2c19c1c7..78d5223e 100644
--- a/src/test/cfg2cmd/i440fx-win10-hostpci.conf.cmd
+++ b/src/test/cfg2cmd/i440fx-win10-hostpci.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=3dd750ce-d910-44d0-9493-525c0be4e687' \
diff --git a/src/test/cfg2cmd/ide.conf.cmd b/src/test/cfg2cmd/ide.conf.cmd
index 4354d427..0fa3c84c 100644
--- a/src/test/cfg2cmd/ide.conf.cmd
+++ b/src/test/cfg2cmd/ide.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=3dd750ce-d910-44d0-9493-525c0be4e687' \
diff --git a/src/test/cfg2cmd/linux-hostpci-legacy-igd.conf.cmd b/src/test/cfg2cmd/linux-hostpci-legacy-igd.conf.cmd
index 21dd22ef..42dc0323 100644
--- a/src/test/cfg2cmd/linux-hostpci-legacy-igd.conf.cmd
+++ b/src/test/cfg2cmd/linux-hostpci-legacy-igd.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=3dd750ce-d910-44d0-9493-525c0be4e687' \
diff --git a/src/test/cfg2cmd/memory-hotplug-hugepages.conf.cmd b/src/test/cfg2cmd/memory-hotplug-hugepages.conf.cmd
index af56796a..d02baa1b 100644
--- a/src/test/cfg2cmd/memory-hotplug-hugepages.conf.cmd
+++ b/src/test/cfg2cmd/memory-hotplug-hugepages.conf.cmd
@@ -3,9 +3,9 @@
-name simple \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=7b10d7af-b932-4c66-b2c3-3996152ec465' \
diff --git a/src/test/cfg2cmd/memory-hotplug.conf.cmd b/src/test/cfg2cmd/memory-hotplug.conf.cmd
index adb1531a..df50a3c7 100644
--- a/src/test/cfg2cmd/memory-hotplug.conf.cmd
+++ b/src/test/cfg2cmd/memory-hotplug.conf.cmd
@@ -3,9 +3,9 @@
-name simple \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=7b10d7af-b932-4c66-b2c3-3996152ec465' \
diff --git a/src/test/cfg2cmd/memory-hugepages-1g.conf.cmd b/src/test/cfg2cmd/memory-hugepages-1g.conf.cmd
index 34aa09ea..93bd2b96 100644
--- a/src/test/cfg2cmd/memory-hugepages-1g.conf.cmd
+++ b/src/test/cfg2cmd/memory-hugepages-1g.conf.cmd
@@ -3,9 +3,9 @@
-name simple \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=7b10d7af-b932-4c66-b2c3-3996152ec465' \
diff --git a/src/test/cfg2cmd/memory-hugepages-2m.conf.cmd b/src/test/cfg2cmd/memory-hugepages-2m.conf.cmd
index 98a3b26b..27a375d1 100644
--- a/src/test/cfg2cmd/memory-hugepages-2m.conf.cmd
+++ b/src/test/cfg2cmd/memory-hugepages-2m.conf.cmd
@@ -3,9 +3,9 @@
-name simple \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=7b10d7af-b932-4c66-b2c3-3996152ec465' \
diff --git a/src/test/cfg2cmd/minimal-defaults.conf.cmd b/src/test/cfg2cmd/minimal-defaults.conf.cmd
index f10276ba..333770c6 100644
--- a/src/test/cfg2cmd/minimal-defaults.conf.cmd
+++ b/src/test/cfg2cmd/minimal-defaults.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=6cf17dc3-8341-4ecc-aebd-7503f2583fb3' \
diff --git a/src/test/cfg2cmd/netdev-7.0-multiqueues.conf.cmd b/src/test/cfg2cmd/netdev-7.0-multiqueues.conf.cmd
index 89226c72..53f00fd3 100644
--- a/src/test/cfg2cmd/netdev-7.0-multiqueues.conf.cmd
+++ b/src/test/cfg2cmd/netdev-7.0-multiqueues.conf.cmd
@@ -3,9 +3,9 @@
-name netdev-multiq \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=7b10d7af-b932-4c66-b2c3-3996152ec465' \
diff --git a/src/test/cfg2cmd/netdev-7.1-multiqueues.conf.cmd b/src/test/cfg2cmd/netdev-7.1-multiqueues.conf.cmd
index f803b0d5..dc07ac85 100644
--- a/src/test/cfg2cmd/netdev-7.1-multiqueues.conf.cmd
+++ b/src/test/cfg2cmd/netdev-7.1-multiqueues.conf.cmd
@@ -3,9 +3,9 @@
-name netdev \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smp '3,sockets=1,cores=3,maxcpus=3' \
diff --git a/src/test/cfg2cmd/netdev-7.1.conf.cmd b/src/test/cfg2cmd/netdev-7.1.conf.cmd
index 99d72f28..4c40cf77 100644
--- a/src/test/cfg2cmd/netdev-7.1.conf.cmd
+++ b/src/test/cfg2cmd/netdev-7.1.conf.cmd
@@ -3,9 +3,9 @@
-name netdev \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smp '3,sockets=1,cores=3,maxcpus=3' \
diff --git a/src/test/cfg2cmd/netdev.conf.cmd b/src/test/cfg2cmd/netdev.conf.cmd
index 2a35d7e8..2b3e2d2f 100644
--- a/src/test/cfg2cmd/netdev.conf.cmd
+++ b/src/test/cfg2cmd/netdev.conf.cmd
@@ -3,9 +3,9 @@
-name netdev \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smp '3,sockets=1,cores=3,maxcpus=3' \
diff --git a/src/test/cfg2cmd/netdev_vxlan.conf.cmd b/src/test/cfg2cmd/netdev_vxlan.conf.cmd
index 7d353f3d..ee34f1cd 100644
--- a/src/test/cfg2cmd/netdev_vxlan.conf.cmd
+++ b/src/test/cfg2cmd/netdev_vxlan.conf.cmd
@@ -3,9 +3,9 @@
-name netdev \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smp '3,sockets=1,cores=3,maxcpus=3' \
diff --git a/src/test/cfg2cmd/os-l24.conf.cmd b/src/test/cfg2cmd/os-l24.conf.cmd
index 3f299166..c5fb0d0e 100644
--- a/src/test/cfg2cmd/os-l24.conf.cmd
+++ b/src/test/cfg2cmd/os-l24.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smp '1,sockets=1,cores=1,maxcpus=1' \
diff --git a/src/test/cfg2cmd/os-other.conf.cmd b/src/test/cfg2cmd/os-other.conf.cmd
index 6ca9f464..4a579f93 100644
--- a/src/test/cfg2cmd/os-other.conf.cmd
+++ b/src/test/cfg2cmd/os-other.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smp '1,sockets=1,cores=1,maxcpus=1' \
diff --git a/src/test/cfg2cmd/os-solaris.conf.cmd b/src/test/cfg2cmd/os-solaris.conf.cmd
index a7174ec3..e268465b 100644
--- a/src/test/cfg2cmd/os-solaris.conf.cmd
+++ b/src/test/cfg2cmd/os-solaris.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smp '1,sockets=1,cores=1,maxcpus=1' \
diff --git a/src/test/cfg2cmd/pinned-version-pxe-pve.conf.cmd b/src/test/cfg2cmd/pinned-version-pxe-pve.conf.cmd
index 41360544..3e2f9239 100644
--- a/src/test/cfg2cmd/pinned-version-pxe-pve.conf.cmd
+++ b/src/test/cfg2cmd/pinned-version-pxe-pve.conf.cmd
@@ -3,9 +3,9 @@
-name pinned \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=c7fdd046-fefc-11e9-832e-770e1d5636a0' \
diff --git a/src/test/cfg2cmd/pinned-version-pxe.conf.cmd b/src/test/cfg2cmd/pinned-version-pxe.conf.cmd
index 098b12fa..416cc243 100644
--- a/src/test/cfg2cmd/pinned-version-pxe.conf.cmd
+++ b/src/test/cfg2cmd/pinned-version-pxe.conf.cmd
@@ -3,9 +3,9 @@
-name pinned \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=c7fdd046-fefc-11e9-832e-770e1d5636a0' \
diff --git a/src/test/cfg2cmd/pinned-version.conf.cmd b/src/test/cfg2cmd/pinned-version.conf.cmd
index e26b35c6..5a7cf0f8 100644
--- a/src/test/cfg2cmd/pinned-version.conf.cmd
+++ b/src/test/cfg2cmd/pinned-version.conf.cmd
@@ -3,9 +3,9 @@
-name pinned \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=c7fdd046-fefc-11e9-832e-770e1d5636a0' \
diff --git a/src/test/cfg2cmd/q35-ide.conf.cmd b/src/test/cfg2cmd/q35-ide.conf.cmd
index ef818519..f5fbb523 100644
--- a/src/test/cfg2cmd/q35-ide.conf.cmd
+++ b/src/test/cfg2cmd/q35-ide.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=3dd750ce-d910-44d0-9493-525c0be4e687' \
diff --git a/src/test/cfg2cmd/q35-linux-hostpci-driver-keep.conf.cmd b/src/test/cfg2cmd/q35-linux-hostpci-driver-keep.conf.cmd
index 3039662f..9a1ee865 100644
--- a/src/test/cfg2cmd/q35-linux-hostpci-driver-keep.conf.cmd
+++ b/src/test/cfg2cmd/q35-linux-hostpci-driver-keep.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=3dd750ce-d910-44d0-9493-525c0be4e687' \
diff --git a/src/test/cfg2cmd/q35-linux-hostpci-mapping.conf.cmd b/src/test/cfg2cmd/q35-linux-hostpci-mapping.conf.cmd
index 81aa6cff..c7026b5a 100644
--- a/src/test/cfg2cmd/q35-linux-hostpci-mapping.conf.cmd
+++ b/src/test/cfg2cmd/q35-linux-hostpci-mapping.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=3dd750ce-d910-44d0-9493-525c0be4e687' \
diff --git a/src/test/cfg2cmd/q35-linux-hostpci-multifunction.conf.cmd b/src/test/cfg2cmd/q35-linux-hostpci-multifunction.conf.cmd
index 255f2b01..f757769c 100644
--- a/src/test/cfg2cmd/q35-linux-hostpci-multifunction.conf.cmd
+++ b/src/test/cfg2cmd/q35-linux-hostpci-multifunction.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=3dd750ce-d910-44d0-9493-525c0be4e687' \
diff --git a/src/test/cfg2cmd/q35-linux-hostpci-template.conf.cmd b/src/test/cfg2cmd/q35-linux-hostpci-template.conf.cmd
index 021dd2a3..1c3463f3 100644
--- a/src/test/cfg2cmd/q35-linux-hostpci-template.conf.cmd
+++ b/src/test/cfg2cmd/q35-linux-hostpci-template.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-object '{"id":"throttle-drive-efidisk0","limits":{},"qom-type":"throttle-group"}' \
diff --git a/src/test/cfg2cmd/q35-linux-hostpci-x-pci-overrides.conf.cmd b/src/test/cfg2cmd/q35-linux-hostpci-x-pci-overrides.conf.cmd
index d0e25609..c321a046 100644
--- a/src/test/cfg2cmd/q35-linux-hostpci-x-pci-overrides.conf.cmd
+++ b/src/test/cfg2cmd/q35-linux-hostpci-x-pci-overrides.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=3dd750ce-d910-44d0-9493-525c0be4e687' \
diff --git a/src/test/cfg2cmd/q35-linux-hostpci.conf.cmd b/src/test/cfg2cmd/q35-linux-hostpci.conf.cmd
index 3039662f..9a1ee865 100644
--- a/src/test/cfg2cmd/q35-linux-hostpci.conf.cmd
+++ b/src/test/cfg2cmd/q35-linux-hostpci.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=3dd750ce-d910-44d0-9493-525c0be4e687' \
diff --git a/src/test/cfg2cmd/q35-scsihw2.conf.cmd b/src/test/cfg2cmd/q35-scsihw2.conf.cmd
index 169539a1..da1a251a 100644
--- a/src/test/cfg2cmd/q35-scsihw2.conf.cmd
+++ b/src/test/cfg2cmd/q35-scsihw2.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=3dd750ce-d910-44d0-9493-525c0be4e687' \
diff --git a/src/test/cfg2cmd/q35-simple-6.0.conf.cmd b/src/test/cfg2cmd/q35-simple-6.0.conf.cmd
index a362c005..fe6a7fcc 100644
--- a/src/test/cfg2cmd/q35-simple-6.0.conf.cmd
+++ b/src/test/cfg2cmd/q35-simple-6.0.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=3dd750ce-d910-44d0-9493-525c0be4e687' \
diff --git a/src/test/cfg2cmd/q35-simple-7.0.conf.cmd b/src/test/cfg2cmd/q35-simple-7.0.conf.cmd
index 04fe0e67..739b911d 100644
--- a/src/test/cfg2cmd/q35-simple-7.0.conf.cmd
+++ b/src/test/cfg2cmd/q35-simple-7.0.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=3dd750ce-d910-44d0-9493-525c0be4e687' \
diff --git a/src/test/cfg2cmd/q35-simple-pinned-6.1.conf.cmd b/src/test/cfg2cmd/q35-simple-pinned-6.1.conf.cmd
index 78bbbe30..8f48a63a 100644
--- a/src/test/cfg2cmd/q35-simple-pinned-6.1.conf.cmd
+++ b/src/test/cfg2cmd/q35-simple-pinned-6.1.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=3dd750ce-d910-44d0-9493-525c0be4e687' \
diff --git a/src/test/cfg2cmd/q35-simple.conf.cmd b/src/test/cfg2cmd/q35-simple.conf.cmd
index 7a3bc4d6..62e91480 100644
--- a/src/test/cfg2cmd/q35-simple.conf.cmd
+++ b/src/test/cfg2cmd/q35-simple.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=3dd750ce-d910-44d0-9493-525c0be4e687' \
diff --git a/src/test/cfg2cmd/q35-usb2.conf.cmd b/src/test/cfg2cmd/q35-usb2.conf.cmd
index 915e7008..659c8fbe 100644
--- a/src/test/cfg2cmd/q35-usb2.conf.cmd
+++ b/src/test/cfg2cmd/q35-usb2.conf.cmd
@@ -3,9 +3,9 @@
-name q35-usb2 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=7b10d7af-b932-4c66-b2c3-3996152ec465' \
diff --git a/src/test/cfg2cmd/q35-usb3.conf.cmd b/src/test/cfg2cmd/q35-usb3.conf.cmd
index 0fe6f8cb..a89cd61f 100644
--- a/src/test/cfg2cmd/q35-usb3.conf.cmd
+++ b/src/test/cfg2cmd/q35-usb3.conf.cmd
@@ -3,9 +3,9 @@
-name q35-usb3 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=7b10d7af-b932-4c66-b2c3-3996152ec465' \
diff --git a/src/test/cfg2cmd/q35-viommu-intel-aw-bits.conf.cmd b/src/test/cfg2cmd/q35-viommu-intel-aw-bits.conf.cmd
index c4b5de15..94ee29d7 100644
--- a/src/test/cfg2cmd/q35-viommu-intel-aw-bits.conf.cmd
+++ b/src/test/cfg2cmd/q35-viommu-intel-aw-bits.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smp '1,sockets=1,cores=1,maxcpus=1' \
diff --git a/src/test/cfg2cmd/q35-viommu-intel-guest-phys-bits.conf.cmd b/src/test/cfg2cmd/q35-viommu-intel-guest-phys-bits.conf.cmd
index dc8c45b9..a3401e06 100644
--- a/src/test/cfg2cmd/q35-viommu-intel-guest-phys-bits.conf.cmd
+++ b/src/test/cfg2cmd/q35-viommu-intel-guest-phys-bits.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smp '1,sockets=1,cores=1,maxcpus=1' \
diff --git a/src/test/cfg2cmd/q35-viommu-intel.conf.cmd b/src/test/cfg2cmd/q35-viommu-intel.conf.cmd
index f2a9201a..84e3eefa 100644
--- a/src/test/cfg2cmd/q35-viommu-intel.conf.cmd
+++ b/src/test/cfg2cmd/q35-viommu-intel.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smp '1,sockets=1,cores=1,maxcpus=1' \
diff --git a/src/test/cfg2cmd/q35-viommu-virtio-aw-bits.conf.cmd b/src/test/cfg2cmd/q35-viommu-virtio-aw-bits.conf.cmd
index e85b27e4..c6f7415c 100644
--- a/src/test/cfg2cmd/q35-viommu-virtio-aw-bits.conf.cmd
+++ b/src/test/cfg2cmd/q35-viommu-virtio-aw-bits.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smp '1,sockets=1,cores=1,maxcpus=1' \
diff --git a/src/test/cfg2cmd/q35-viommu-virtio.conf.cmd b/src/test/cfg2cmd/q35-viommu-virtio.conf.cmd
index 367ce692..e0379e7f 100644
--- a/src/test/cfg2cmd/q35-viommu-virtio.conf.cmd
+++ b/src/test/cfg2cmd/q35-viommu-virtio.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smp '1,sockets=1,cores=1,maxcpus=1' \
diff --git a/src/test/cfg2cmd/q35-win10-hostpci.conf.cmd b/src/test/cfg2cmd/q35-win10-hostpci.conf.cmd
index ccc0fb7e..bc7d1120 100644
--- a/src/test/cfg2cmd/q35-win10-hostpci.conf.cmd
+++ b/src/test/cfg2cmd/q35-win10-hostpci.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=3dd750ce-d910-44d0-9493-525c0be4e687' \
diff --git a/src/test/cfg2cmd/q35-windows-pinning.conf.cmd b/src/test/cfg2cmd/q35-windows-pinning.conf.cmd
index f51f51a9..d8394a01 100644
--- a/src/test/cfg2cmd/q35-windows-pinning.conf.cmd
+++ b/src/test/cfg2cmd/q35-windows-pinning.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smp '1,sockets=1,cores=1,maxcpus=1' \
diff --git a/src/test/cfg2cmd/qemu-xhci-7.1.conf.cmd b/src/test/cfg2cmd/qemu-xhci-7.1.conf.cmd
index d51256f8..a4ad9cd5 100644
--- a/src/test/cfg2cmd/qemu-xhci-7.1.conf.cmd
+++ b/src/test/cfg2cmd/qemu-xhci-7.1.conf.cmd
@@ -3,9 +3,9 @@
-name spiceusb3 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=7b10d7af-b932-4c66-b2c3-3996152ec465' \
diff --git a/src/test/cfg2cmd/qemu-xhci-q35-7.1.conf.cmd b/src/test/cfg2cmd/qemu-xhci-q35-7.1.conf.cmd
index 60ae074c..453d2dbd 100644
--- a/src/test/cfg2cmd/qemu-xhci-q35-7.1.conf.cmd
+++ b/src/test/cfg2cmd/qemu-xhci-q35-7.1.conf.cmd
@@ -3,9 +3,9 @@
-name q35-qemu-xhci \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=7b10d7af-b932-4c66-b2c3-3996152ec465' \
diff --git a/src/test/cfg2cmd/qga-fs-freeze-backup-legacy.conf.cmd b/src/test/cfg2cmd/qga-fs-freeze-backup-legacy.conf.cmd
index a53511b4..c80b64db 100644
--- a/src/test/cfg2cmd/qga-fs-freeze-backup-legacy.conf.cmd
+++ b/src/test/cfg2cmd/qga-fs-freeze-backup-legacy.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smp '1,sockets=1,cores=1,maxcpus=1' \
diff --git a/src/test/cfg2cmd/qga-fs-freeze.conf.cmd b/src/test/cfg2cmd/qga-fs-freeze.conf.cmd
index a53511b4..c80b64db 100644
--- a/src/test/cfg2cmd/qga-fs-freeze.conf.cmd
+++ b/src/test/cfg2cmd/qga-fs-freeze.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smp '1,sockets=1,cores=1,maxcpus=1' \
diff --git a/src/test/cfg2cmd/qga-minimal.conf.cmd b/src/test/cfg2cmd/qga-minimal.conf.cmd
index a53511b4..c80b64db 100644
--- a/src/test/cfg2cmd/qga-minimal.conf.cmd
+++ b/src/test/cfg2cmd/qga-minimal.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smp '1,sockets=1,cores=1,maxcpus=1' \
diff --git a/src/test/cfg2cmd/scsiblk.conf.cmd b/src/test/cfg2cmd/scsiblk.conf.cmd
index 74c2d868..b59211d4 100644
--- a/src/test/cfg2cmd/scsiblk.conf.cmd
+++ b/src/test/cfg2cmd/scsiblk.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=d47e2d5c-7068-46d4-9733-ff94083e28f6' \
diff --git a/src/test/cfg2cmd/scsihw-lsi.conf.cmd b/src/test/cfg2cmd/scsihw-lsi.conf.cmd
index 5adb5d32..da715368 100644
--- a/src/test/cfg2cmd/scsihw-lsi.conf.cmd
+++ b/src/test/cfg2cmd/scsihw-lsi.conf.cmd
@@ -3,9 +3,9 @@
-name simple \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smp '1,sockets=1,cores=1,maxcpus=1' \
diff --git a/src/test/cfg2cmd/scsihw-lsi53c810.conf.cmd b/src/test/cfg2cmd/scsihw-lsi53c810.conf.cmd
index c5204eed..e712a5c5 100644
--- a/src/test/cfg2cmd/scsihw-lsi53c810.conf.cmd
+++ b/src/test/cfg2cmd/scsihw-lsi53c810.conf.cmd
@@ -3,9 +3,9 @@
-name simple \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smp '1,sockets=1,cores=1,maxcpus=1' \
diff --git a/src/test/cfg2cmd/scsihw-megasas.conf.cmd b/src/test/cfg2cmd/scsihw-megasas.conf.cmd
index abb14167..c1dd627e 100644
--- a/src/test/cfg2cmd/scsihw-megasas.conf.cmd
+++ b/src/test/cfg2cmd/scsihw-megasas.conf.cmd
@@ -3,9 +3,9 @@
-name simple \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smp '1,sockets=1,cores=1,maxcpus=1' \
diff --git a/src/test/cfg2cmd/scsihw-pvscsi.conf.cmd b/src/test/cfg2cmd/scsihw-pvscsi.conf.cmd
index 68afe634..e529e3ee 100644
--- a/src/test/cfg2cmd/scsihw-pvscsi.conf.cmd
+++ b/src/test/cfg2cmd/scsihw-pvscsi.conf.cmd
@@ -3,9 +3,9 @@
-name simple \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smp '1,sockets=1,cores=1,maxcpus=1' \
diff --git a/src/test/cfg2cmd/scsihw-virtio-scsi-single.conf.cmd b/src/test/cfg2cmd/scsihw-virtio-scsi-single.conf.cmd
index 3e01028c..75a690d1 100644
--- a/src/test/cfg2cmd/scsihw-virtio-scsi-single.conf.cmd
+++ b/src/test/cfg2cmd/scsihw-virtio-scsi-single.conf.cmd
@@ -3,9 +3,9 @@
-name simple \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smp '1,sockets=1,cores=1,maxcpus=1' \
diff --git a/src/test/cfg2cmd/seabios_serial.conf.cmd b/src/test/cfg2cmd/seabios_serial.conf.cmd
index 7a7df5bb..457e9f20 100644
--- a/src/test/cfg2cmd/seabios_serial.conf.cmd
+++ b/src/test/cfg2cmd/seabios_serial.conf.cmd
@@ -3,9 +3,9 @@
-name seabiosserial \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=7b10d7af-b932-4c66-b2c3-3996152ec465' \
diff --git a/src/test/cfg2cmd/sev-es.conf.cmd b/src/test/cfg2cmd/sev-es.conf.cmd
index d41619ec..b181ff87 100644
--- a/src/test/cfg2cmd/sev-es.conf.cmd
+++ b/src/test/cfg2cmd/sev-es.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=7b10d7af-b932-4c66-b2c3-3996152ec465' \
diff --git a/src/test/cfg2cmd/sev-snp.conf.cmd b/src/test/cfg2cmd/sev-snp.conf.cmd
index 045ec5ce..ccaf3c33 100644
--- a/src/test/cfg2cmd/sev-snp.conf.cmd
+++ b/src/test/cfg2cmd/sev-snp.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=7b10d7af-b932-4c66-b2c3-3996152ec465' \
diff --git a/src/test/cfg2cmd/sev-std.conf.cmd b/src/test/cfg2cmd/sev-std.conf.cmd
index 277b61fc..928af4a3 100644
--- a/src/test/cfg2cmd/sev-std.conf.cmd
+++ b/src/test/cfg2cmd/sev-std.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=7b10d7af-b932-4c66-b2c3-3996152ec465' \
diff --git a/src/test/cfg2cmd/simple-backingchain.conf.cmd b/src/test/cfg2cmd/simple-backingchain.conf.cmd
index c2cec31b..5ed0023f 100644
--- a/src/test/cfg2cmd/simple-backingchain.conf.cmd
+++ b/src/test/cfg2cmd/simple-backingchain.conf.cmd
@@ -3,9 +3,9 @@
-name simple \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smp '1,sockets=1,cores=1,maxcpus=1' \
diff --git a/src/test/cfg2cmd/simple-balloon-free-page-reporting.conf.cmd b/src/test/cfg2cmd/simple-balloon-free-page-reporting.conf.cmd
index 4a9e65cb..36aa6d21 100644
--- a/src/test/cfg2cmd/simple-balloon-free-page-reporting.conf.cmd
+++ b/src/test/cfg2cmd/simple-balloon-free-page-reporting.conf.cmd
@@ -3,9 +3,9 @@
-name simple \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=7b10d7af-b932-4c66-b2c3-3996152ec465' \
diff --git a/src/test/cfg2cmd/simple-btrfs.conf.cmd b/src/test/cfg2cmd/simple-btrfs.conf.cmd
index ab2e2567..8d376a7f 100644
--- a/src/test/cfg2cmd/simple-btrfs.conf.cmd
+++ b/src/test/cfg2cmd/simple-btrfs.conf.cmd
@@ -3,9 +3,9 @@
-name simple \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=7b10d7af-b932-4c66-b2c3-3996152ec465' \
diff --git a/src/test/cfg2cmd/simple-cifs.conf.cmd b/src/test/cfg2cmd/simple-cifs.conf.cmd
index ea9cd98f..54031848 100644
--- a/src/test/cfg2cmd/simple-cifs.conf.cmd
+++ b/src/test/cfg2cmd/simple-cifs.conf.cmd
@@ -3,9 +3,9 @@
-name simple \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smp '1,sockets=1,cores=1,maxcpus=1' \
diff --git a/src/test/cfg2cmd/simple-disk-passthrough.conf.cmd b/src/test/cfg2cmd/simple-disk-passthrough.conf.cmd
index e294a576..ca7f811b 100644
--- a/src/test/cfg2cmd/simple-disk-passthrough.conf.cmd
+++ b/src/test/cfg2cmd/simple-disk-passthrough.conf.cmd
@@ -3,9 +3,9 @@
-name simple \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=7b10d7af-b932-4c66-b2c3-3996152ec465' \
diff --git a/src/test/cfg2cmd/simple-lvm.conf.cmd b/src/test/cfg2cmd/simple-lvm.conf.cmd
index c4ae13b8..35da904c 100644
--- a/src/test/cfg2cmd/simple-lvm.conf.cmd
+++ b/src/test/cfg2cmd/simple-lvm.conf.cmd
@@ -3,9 +3,9 @@
-name simple \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smp '1,sockets=1,cores=1,maxcpus=1' \
diff --git a/src/test/cfg2cmd/simple-lvmthin.conf.cmd b/src/test/cfg2cmd/simple-lvmthin.conf.cmd
index 64c56a5b..308fd487 100644
--- a/src/test/cfg2cmd/simple-lvmthin.conf.cmd
+++ b/src/test/cfg2cmd/simple-lvmthin.conf.cmd
@@ -3,9 +3,9 @@
-name simple \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smp '1,sockets=1,cores=1,maxcpus=1' \
diff --git a/src/test/cfg2cmd/simple-rbd.conf.cmd b/src/test/cfg2cmd/simple-rbd.conf.cmd
index 57d8a881..4bbc2218 100644
--- a/src/test/cfg2cmd/simple-rbd.conf.cmd
+++ b/src/test/cfg2cmd/simple-rbd.conf.cmd
@@ -3,9 +3,9 @@
-name simple \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=7b10d7af-b932-4c66-b2c3-3996152ec465' \
diff --git a/src/test/cfg2cmd/simple-virtio-blk.conf.cmd b/src/test/cfg2cmd/simple-virtio-blk.conf.cmd
index f0370bdb..1e9ee0ae 100644
--- a/src/test/cfg2cmd/simple-virtio-blk.conf.cmd
+++ b/src/test/cfg2cmd/simple-virtio-blk.conf.cmd
@@ -3,9 +3,9 @@
-name simple \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=7b10d7af-b932-4c66-b2c3-3996152ec465' \
diff --git a/src/test/cfg2cmd/simple-zfs-over-iscsi.conf.cmd b/src/test/cfg2cmd/simple-zfs-over-iscsi.conf.cmd
index 04a20eda..51b5a10e 100644
--- a/src/test/cfg2cmd/simple-zfs-over-iscsi.conf.cmd
+++ b/src/test/cfg2cmd/simple-zfs-over-iscsi.conf.cmd
@@ -3,9 +3,9 @@
-name simple \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=7b10d7af-b932-4c66-b2c3-3996152ec465' \
diff --git a/src/test/cfg2cmd/simple1-template.conf.cmd b/src/test/cfg2cmd/simple1-template.conf.cmd
index ff5d75d6..08842c77 100644
--- a/src/test/cfg2cmd/simple1-template.conf.cmd
+++ b/src/test/cfg2cmd/simple1-template.conf.cmd
@@ -3,9 +3,9 @@
-name simple \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smp '1,sockets=1,cores=1,maxcpus=1' \
diff --git a/src/test/cfg2cmd/simple1.conf.cmd b/src/test/cfg2cmd/simple1.conf.cmd
index 924d8041..50820d9f 100644
--- a/src/test/cfg2cmd/simple1.conf.cmd
+++ b/src/test/cfg2cmd/simple1.conf.cmd
@@ -3,9 +3,9 @@
-name simple \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=7b10d7af-b932-4c66-b2c3-3996152ec465' \
diff --git a/src/test/cfg2cmd/spice-enhancments.conf.cmd b/src/test/cfg2cmd/spice-enhancments.conf.cmd
index 6043488d..c7313e42 100644
--- a/src/test/cfg2cmd/spice-enhancments.conf.cmd
+++ b/src/test/cfg2cmd/spice-enhancments.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=363a6126-5f48-43e1-811f-013294a946a0' \
diff --git a/src/test/cfg2cmd/spice-linux-4.1.conf.cmd b/src/test/cfg2cmd/spice-linux-4.1.conf.cmd
index 2d2b8055..c34fff23 100644
--- a/src/test/cfg2cmd/spice-linux-4.1.conf.cmd
+++ b/src/test/cfg2cmd/spice-linux-4.1.conf.cmd
@@ -3,9 +3,9 @@
-name spicelinux \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=7b10d7af-b932-4c66-b2c3-3996152ec465' \
diff --git a/src/test/cfg2cmd/spice-usb3.conf.cmd b/src/test/cfg2cmd/spice-usb3.conf.cmd
index 2df589f4..7c4679dd 100644
--- a/src/test/cfg2cmd/spice-usb3.conf.cmd
+++ b/src/test/cfg2cmd/spice-usb3.conf.cmd
@@ -3,9 +3,9 @@
-name spiceusb3 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=7b10d7af-b932-4c66-b2c3-3996152ec465' \
diff --git a/src/test/cfg2cmd/spice-win.conf.cmd b/src/test/cfg2cmd/spice-win.conf.cmd
index a2885b2e..081e0dd8 100644
--- a/src/test/cfg2cmd/spice-win.conf.cmd
+++ b/src/test/cfg2cmd/spice-win.conf.cmd
@@ -3,9 +3,9 @@
-name spiceusb3 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smbios 'type=1,uuid=7b10d7af-b932-4c66-b2c3-3996152ec461' \
diff --git a/src/test/cfg2cmd/startdate-l26.conf.cmd b/src/test/cfg2cmd/startdate-l26.conf.cmd
index 6897de3c..b16110ad 100644
--- a/src/test/cfg2cmd/startdate-l26.conf.cmd
+++ b/src/test/cfg2cmd/startdate-l26.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smp '1,sockets=1,cores=1,maxcpus=1' \
diff --git a/src/test/cfg2cmd/startdate-win11.conf.cmd b/src/test/cfg2cmd/startdate-win11.conf.cmd
index 93efeeae..74b1c9e1 100644
--- a/src/test/cfg2cmd/startdate-win11.conf.cmd
+++ b/src/test/cfg2cmd/startdate-win11.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smp '1,sockets=1,cores=1,maxcpus=1' \
diff --git a/src/test/cfg2cmd/vnc-clipboard-spice.conf.cmd b/src/test/cfg2cmd/vnc-clipboard-spice.conf.cmd
index 7ae3d722..d36519e9 100644
--- a/src/test/cfg2cmd/vnc-clipboard-spice.conf.cmd
+++ b/src/test/cfg2cmd/vnc-clipboard-spice.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smp '1,sockets=1,cores=1,maxcpus=1' \
diff --git a/src/test/cfg2cmd/vnc-clipboard-std.conf.cmd b/src/test/cfg2cmd/vnc-clipboard-std.conf.cmd
index bfb40655..4114986a 100644
--- a/src/test/cfg2cmd/vnc-clipboard-std.conf.cmd
+++ b/src/test/cfg2cmd/vnc-clipboard-std.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smp '1,sockets=1,cores=1,maxcpus=1' \
diff --git a/src/test/cfg2cmd/win11-amd-host-11.0+pve2.conf.cmd b/src/test/cfg2cmd/win11-amd-host-11.0+pve2.conf.cmd
index c2b6657f..d67862de 100644
--- a/src/test/cfg2cmd/win11-amd-host-11.0+pve2.conf.cmd
+++ b/src/test/cfg2cmd/win11-amd-host-11.0+pve2.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smp '1,sockets=1,cores=1,maxcpus=1' \
diff --git a/src/test/cfg2cmd/win11-host-11.0+pve2.conf.cmd b/src/test/cfg2cmd/win11-host-11.0+pve2.conf.cmd
index b1949836..43eb4e94 100644
--- a/src/test/cfg2cmd/win11-host-11.0+pve2.conf.cmd
+++ b/src/test/cfg2cmd/win11-host-11.0+pve2.conf.cmd
@@ -3,9 +3,9 @@
-name vm8006 \
-no-shutdown \
-chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
- -mon 'chardev=qmp,mode=control' \
+ -object 'monitor-qmp,chardev=qmp,id=monitor-qmp' \
-chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
- -mon 'chardev=qmp-event,mode=control' \
+ -object 'monitor-qmp,chardev=qmp-event,id=monitor-qmp-event' \
-pidfile /var/run/qemu-server/8006.pid \
-daemonize \
-smp '1,sockets=1,cores=1,maxcpus=1' \
--
2.47.3
^ permalink raw reply related [flat|nested] 8+ messages in thread