* [PATCH-SERIES qemu v3 0/2] stable fixes for QEMU 11.1
@ 2026-10-28 15:08 Fiona Ebner
2026-10-28 15:08 ` [PATCH qemu v3 1/2] update submodule and patches to QEMU 11.1.3 Fiona Ebner
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Fiona Ebner @ 2026-10-28 15:08 UTC (permalink / raw)
To: pve-devel
Changes in v3:
* Use 11.1.3 as a base. Almost all changes in v2's 2/2 are now already
included there.
Changes in v2:
* Pick up fix for crash when querying info for VirtIO via QMP/HMP.
* Pick up hardendings for KVM and a fix for TDX.
Update to QEMU 11.1.3 and pick up some additional fixes from
qemu-devel.
*** BLURB HERE ***
Fiona Ebner (2):
update submodule and patches to QEMU 11.1.3
fix crash when querying VirtIO information via QMP/HMP
...d-support-for-sync-bitmap-mode-never.patch | 6 +-
...alidate-primary-surface-stride-again.patch | 81 ---------
...5a-gracefully-handle-re-entrant-DMA.patch} | 0
...ore-backend-features-in-x-query-virt.patch | 41 +++++
...ix-text-mode-OOB-write-after-a-graph.patch | 164 ------------------
...dle-missing-vhost-user-protocol-feat.patch | 74 ++++++++
...-fix-out-of-bound-read-in-WRITE-SAME.patch | 71 --------
...ELECT-block-size-change-behind-a-qui.patch | 89 ----------
...-the-VAPIC-region-to-0xc0000.0xe0000.patch | 75 --------
...-MemoryRegion-if-vapic_map_rom_writa.patch | 36 ----
...t-do-not-treat-a-zero-length-write-a.patch | 54 ------
...k-file-change-locking-default-to-off.patch | 6 +-
...he-CPU-model-to-kvm64-32-instead-of-.patch | 4 +-
...return-success-on-info-without-snaps.patch | 4 +-
...dd-add-osize-and-read-from-to-stdin-.patch | 12 +-
...E-Up-qemu-img-dd-add-isize-parameter.patch | 14 +-
...PVE-Up-qemu-img-dd-add-n-skip_create.patch | 10 +-
...-add-l-option-for-loading-a-snapshot.patch | 14 +-
...virtio-balloon-improve-query-balloon.patch | 4 +-
...async-for-background-state-snapshots.patch | 4 +-
...add-optional-buffer-size-to-QEMUFile.patch | 2 +-
...add-the-zeroinit-block-driver-filter.patch | 6 +-
...le-posix-make-locking-optiono-on-cre.patch | 20 +--
...-Backup-add-backup-dump-block-driver.patch | 4 +-
...d-sequential-job-transaction-support.patch | 6 +-
...ckup-Proxmox-backup-patches-for-QEMU.patch | 2 +-
...k-driver-to-map-backup-archives-into.patch | 8 +-
...igrate-dirty-bitmap-state-via-savevm.patch | 2 +-
...dirty-bitmap-migrate-other-bitmaps-e.patch | 4 +-
.../0035-block-add-alloc-track-driver.patch | 8 +-
.../0036-PVE-backup-add-fleecing-option.patch | 2 +-
...ment-backup-access-setup-and-teardow.patch | 8 +-
debian/patches/series | 11 +-
qemu | 2 +-
34 files changed, 194 insertions(+), 654 deletions(-)
delete mode 100644 debian/patches/extra/0004-hw-display-qxl-validate-primary-surface-stride-again.patch
rename debian/patches/extra/{0005-hw-scsi-lsi53c895a-gracefully-handle-re-entrant-DMA.patch => 0004-hw-scsi-lsi53c895a-gracefully-handle-re-entrant-DMA.patch} (100%)
create mode 100644 debian/patches/extra/0005-qapi-virtio-Restore-backend-features-in-x-query-virt.patch
delete mode 100644 debian/patches/extra/0006-hw-display-vga-fix-text-mode-OOB-write-after-a-graph.patch
create mode 100644 debian/patches/extra/0006-qapi-monitor-Handle-missing-vhost-user-protocol-feat.patch
delete mode 100644 debian/patches/extra/0007-scsi-disk-fix-out-of-bound-read-in-WRITE-SAME.patch
delete mode 100644 debian/patches/extra/0008-scsi-hide-MODE-SELECT-block-size-change-behind-a-qui.patch
delete mode 100644 debian/patches/extra/0009-vapic-confine-the-VAPIC-region-to-0xc0000.0xe0000.patch
delete mode 100644 debian/patches/extra/0010-i386-vapic-unref-MemoryRegion-if-vapic_map_rom_writa.patch
delete mode 100644 debian/patches/extra/0011-io-channel-socket-do-not-treat-a-zero-length-write-a.patch
--
2.47.3
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH qemu v3 1/2] update submodule and patches to QEMU 11.1.3
2026-10-28 15:08 [PATCH-SERIES qemu v3 0/2] stable fixes for QEMU 11.1 Fiona Ebner
@ 2026-10-28 15:08 ` Fiona Ebner
2026-10-28 15:08 ` [PATCH qemu v3 2/2] fix crash when querying VirtIO information via QMP/HMP Fiona Ebner
2026-10-28 15:38 ` applied: [PATCH-SERIES qemu v3 0/2] stable fixes for QEMU 11.1 Thomas Lamprecht
2 siblings, 0 replies; 4+ messages in thread
From: Fiona Ebner @ 2026-10-28 15:08 UTC (permalink / raw)
To: pve-devel
Picking up fixes for KVM, x86 and ARM emulation, QXL display, USB
emulation, IDE emulation, NBD, VirtIO, VirtIO-GPU and VirtIO-net.
For the block layer, a corruption fix, fixes to improve flush error
reporting upon close and for qemu-img, and a fix for iterating block
nodes.
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---
Changes in v3:
* Use 11.1.3 as a base.
...d-support-for-sync-bitmap-mode-never.patch | 6 +-
...alidate-primary-surface-stride-again.patch | 81 ---------
...5a-gracefully-handle-re-entrant-DMA.patch} | 0
...ix-text-mode-OOB-write-after-a-graph.patch | 164 ------------------
...-fix-out-of-bound-read-in-WRITE-SAME.patch | 71 --------
...ELECT-block-size-change-behind-a-qui.patch | 89 ----------
...-the-VAPIC-region-to-0xc0000.0xe0000.patch | 75 --------
...-MemoryRegion-if-vapic_map_rom_writa.patch | 36 ----
...t-do-not-treat-a-zero-length-write-a.patch | 54 ------
...k-file-change-locking-default-to-off.patch | 6 +-
...he-CPU-model-to-kvm64-32-instead-of-.patch | 4 +-
...return-success-on-info-without-snaps.patch | 4 +-
...dd-add-osize-and-read-from-to-stdin-.patch | 12 +-
...E-Up-qemu-img-dd-add-isize-parameter.patch | 14 +-
...PVE-Up-qemu-img-dd-add-n-skip_create.patch | 10 +-
...-add-l-option-for-loading-a-snapshot.patch | 14 +-
...virtio-balloon-improve-query-balloon.patch | 4 +-
...async-for-background-state-snapshots.patch | 4 +-
...add-optional-buffer-size-to-QEMUFile.patch | 2 +-
...add-the-zeroinit-block-driver-filter.patch | 6 +-
...le-posix-make-locking-optiono-on-cre.patch | 20 +--
...-Backup-add-backup-dump-block-driver.patch | 4 +-
...d-sequential-job-transaction-support.patch | 6 +-
...ckup-Proxmox-backup-patches-for-QEMU.patch | 2 +-
...k-driver-to-map-backup-archives-into.patch | 8 +-
...igrate-dirty-bitmap-state-via-savevm.patch | 2 +-
...dirty-bitmap-migrate-other-bitmaps-e.patch | 4 +-
.../0035-block-add-alloc-track-driver.patch | 8 +-
.../0036-PVE-backup-add-fleecing-option.patch | 2 +-
...ment-backup-access-setup-and-teardow.patch | 8 +-
debian/patches/series | 9 +-
qemu | 2 +-
32 files changed, 77 insertions(+), 654 deletions(-)
delete mode 100644 debian/patches/extra/0004-hw-display-qxl-validate-primary-surface-stride-again.patch
rename debian/patches/extra/{0005-hw-scsi-lsi53c895a-gracefully-handle-re-entrant-DMA.patch => 0004-hw-scsi-lsi53c895a-gracefully-handle-re-entrant-DMA.patch} (100%)
delete mode 100644 debian/patches/extra/0006-hw-display-vga-fix-text-mode-OOB-write-after-a-graph.patch
delete mode 100644 debian/patches/extra/0007-scsi-disk-fix-out-of-bound-read-in-WRITE-SAME.patch
delete mode 100644 debian/patches/extra/0008-scsi-hide-MODE-SELECT-block-size-change-behind-a-qui.patch
delete mode 100644 debian/patches/extra/0009-vapic-confine-the-VAPIC-region-to-0xc0000.0xe0000.patch
delete mode 100644 debian/patches/extra/0010-i386-vapic-unref-MemoryRegion-if-vapic_map_rom_writa.patch
delete mode 100644 debian/patches/extra/0011-io-channel-socket-do-not-treat-a-zero-length-write-a.patch
diff --git a/debian/patches/bitmap-mirror/0001-drive-mirror-add-support-for-sync-bitmap-mode-never.patch b/debian/patches/bitmap-mirror/0001-drive-mirror-add-support-for-sync-bitmap-mode-never.patch
index 40ec9887d7..8b0740a093 100644
--- a/debian/patches/bitmap-mirror/0001-drive-mirror-add-support-for-sync-bitmap-mode-never.patch
+++ b/debian/patches/bitmap-mirror/0001-drive-mirror-add-support-for-sync-bitmap-mode-never.patch
@@ -333,7 +333,7 @@ index e7c8f1a856..d5aa68caeb 100644
BlockdevOnError on_source_error,
BlockdevOnError on_target_error,
diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 1f87b07850..c2f6139dea 100644
+index 199efc1e00..28d9c1e98e 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -2280,6 +2280,15 @@
@@ -363,7 +363,7 @@ index 1f87b07850..c2f6139dea 100644
'*speed': 'int', '*granularity': 'uint32',
'*buf-size': 'int', '*on-source-error': 'BlockdevOnError',
'*on-target-error': 'BlockdevOnError',
-@@ -2598,6 +2609,15 @@
+@@ -2600,6 +2611,15 @@
# destination (all the disk, only the sectors allocated in the
# topmost image, or only new I/O).
#
@@ -379,7 +379,7 @@ index 1f87b07850..c2f6139dea 100644
# @granularity: granularity of the dirty bitmap, default is 64K if the
# image format doesn't have clusters, 4K if the clusters are
# smaller than that, else the cluster size. Must be a power of 2
-@@ -2650,7 +2670,8 @@
+@@ -2652,7 +2672,8 @@
{ 'command': 'blockdev-mirror',
'data': { '*job-id': 'str', 'device': 'str', 'target': 'str',
'*replaces': 'str',
diff --git a/debian/patches/extra/0004-hw-display-qxl-validate-primary-surface-stride-again.patch b/debian/patches/extra/0004-hw-display-qxl-validate-primary-surface-stride-again.patch
deleted file mode 100644
index 299927cb83..0000000000
--- a/debian/patches/extra/0004-hw-display-qxl-validate-primary-surface-stride-again.patch
+++ /dev/null
@@ -1,81 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
-Date: Mon, 20 Jul 2026 15:45:13 +0400
-Subject: [PATCH] hw/display/qxl: validate primary surface stride against width
-
-The existing validation in qxl_create_guest_primary() checks that
-abs(stride) * height fits in vgamem_size and that stride is 4-byte
-aligned, but never checks that abs(stride) is large enough to hold one
-row of pixels for the declared width and format.
-
-A malicious guest can create a primary surface with a stride much
-smaller than width * bytes_per_pixel (e.g. stride=4 for a 64-wide 32bpp
-surface). The spice server rejects this via red_validate_surface(), but
-the return is void and QEMU unconditionally proceeds to set up the local
-rendering state. On the next display refresh, VNC or SDL reads width *
-byptes_pp per scanline from a region backed by only stride bytes per
-row, causing a host-side out-of-bounds read.
-
-Add three checks before creating the surface:
- - reject unknown surface formats
- - reject zero width or height
- - reject surfaces where abs(stride) < width * bytes_per_pixel
-
-Fixes: CVE-2026-16271
-Fixes: 3761abb16784 ("hw/display/qxl: fix signed to unsigned comparison")
-Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3637
-Signed-off-by: Marc-Andre Lureau <marcandre.lureau@redhat.com>
-Link: https://lore.kernel.org/qemu-devel/20260720114513.2500370-1-marcandre.lureau@redhat.com
-(picked from qemu-devel)
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- hw/display/qxl.c | 29 +++++++++++++++++++++++++++++
- 1 file changed, 29 insertions(+)
-
-diff --git a/hw/display/qxl.c b/hw/display/qxl.c
-index b7d871b9ee..41673c369b 100644
---- a/hw/display/qxl.c
-+++ b/hw/display/qxl.c
-@@ -1496,6 +1496,7 @@ static void qxl_create_guest_primary(PCIQXLDevice *qxl, int loadvm,
- QXLSurfaceCreate *sc = &qxl->guest_primary.surface;
- uint32_t requested_height = le32_to_cpu(sc->height);
- int requested_stride = le32_to_cpu(sc->stride);
-+ uint32_t bytes_pp;
-
- if (requested_stride == INT32_MIN ||
- abs(requested_stride) * (uint64_t)requested_height
-@@ -1532,6 +1533,34 @@ static void qxl_create_guest_primary(PCIQXLDevice *qxl, int loadvm,
- return;
- }
-
-+ switch (surface.format) {
-+ case SPICE_SURFACE_FMT_16_555:
-+ case SPICE_SURFACE_FMT_16_565:
-+ bytes_pp = 2;
-+ break;
-+ case SPICE_SURFACE_FMT_32_xRGB:
-+ case SPICE_SURFACE_FMT_32_ARGB:
-+ bytes_pp = 4;
-+ break;
-+ default:
-+ qxl_set_guest_bug(qxl, "%s: unhandled format %d",
-+ __func__, surface.format);
-+ return;
-+ }
-+
-+ if (surface.width == 0 || surface.height == 0) {
-+ qxl_set_guest_bug(qxl, "%s: zero dimension %ux%u",
-+ __func__, surface.width, surface.height);
-+ return;
-+ }
-+
-+ if ((uint64_t)surface.width * bytes_pp > abs(surface.stride)) {
-+ qxl_set_guest_bug(qxl, "%s: stride too small for width:"
-+ " stride %d width %u bpp %u",
-+ __func__, surface.stride, surface.width, bytes_pp);
-+ return;
-+ }
-+
- surface.mouse_mode = true;
- surface.group_id = MEMSLOT_GROUP_GUEST;
- if (loadvm) {
diff --git a/debian/patches/extra/0005-hw-scsi-lsi53c895a-gracefully-handle-re-entrant-DMA.patch b/debian/patches/extra/0004-hw-scsi-lsi53c895a-gracefully-handle-re-entrant-DMA.patch
similarity index 100%
rename from debian/patches/extra/0005-hw-scsi-lsi53c895a-gracefully-handle-re-entrant-DMA.patch
rename to debian/patches/extra/0004-hw-scsi-lsi53c895a-gracefully-handle-re-entrant-DMA.patch
diff --git a/debian/patches/extra/0006-hw-display-vga-fix-text-mode-OOB-write-after-a-graph.patch b/debian/patches/extra/0006-hw-display-vga-fix-text-mode-OOB-write-after-a-graph.patch
deleted file mode 100644
index 9c7c7f6d32..0000000000
--- a/debian/patches/extra/0006-hw-display-vga-fix-text-mode-OOB-write-after-a-graph.patch
+++ /dev/null
@@ -1,164 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Warisjeet Singh <sinxx198@gmail.com>
-Date: Mon, 24 Aug 2026 12:47:26 -0400
-Subject: [PATCH] hw/display/vga: fix text-mode OOB write after a graphics
- surface switch
-
-vga_draw_text() decides whether the console surface needs a resize from
-its geometry cache, but none of the cache terms observe the graphics
-renderer having replaced the console surface in between:
-
-- last_width/last_height are shared with vga_draw_graphic(), which
- stores them in pixels while the text path stores characters;
-- last_depth stays 0 for legacy (non-VBE) graphics modes, because
- vga_get_bpp() only reports a depth when VBE is enabled, so the
- "s->last_depth" term that normally forces a resize after a graphics
- frame does not fire.
-
-So a graphics frame that shrinks the console surface (e.g. 80x25
-pixels) followed by a text frame with matching character geometry
-(80x25 chars) skips the resize, and the glyph loop then paints
-width*cw x height*cheight pixels into the smaller surface, out of
-bounds, with guest-controlled (DAC palette) values, on every display
-refresh.
-
-Separate the geometry cache per renderer: text paths (vga_draw_text,
-vga_update_text, and the text handling in vga_invalidate_display /
-vga_common_reset) now only manipulate last_text_{width,height}, in
-characters; last_{width,height} become graphics-only, in pixels.
-Additionally, make the text path compare the pixel size it is about
-to paint against the console surface's actual dimensions. The
-surface check is the load-bearing term: caches in either unit cannot
-see the other renderer swapping the surface, the surface can.
-
-Fixes: CVE-2026-77913
-Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4215
-Cc: qemu-stable@nongnu.org
-Signed-off-by: Warisjeet Singh (sin99xx) <sinxx198@gmail.com>
-Message-ID: <vga-v3-20260824.sinxx198@gmail.com>
-(cherry picked from commit 418396be8013386a81f8d8d89ac0effcf03a64b6)
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- hw/display/vga.c | 37 ++++++++++++++++++++++---------------
- hw/display/vga_int.h | 3 ++-
- 2 files changed, 24 insertions(+), 16 deletions(-)
-
-diff --git a/hw/display/vga.c b/hw/display/vga.c
-index da0c331486..cb0e28b79b 100644
---- a/hw/display/vga.c
-+++ b/hw/display/vga.c
-@@ -1241,7 +1241,10 @@ static void vga_draw_text(VGACommonState *s, int full_update)
- return;
- }
-
-- if (width != s->last_width || height != s->last_height ||
-+ if (surface == NULL ||
-+ surface_width(surface) != width * cw ||
-+ surface_height(surface) != height * cheight ||
-+ width != s->last_text_width || height != s->last_text_height ||
- cw != s->last_cw || cheight != s->last_ch || s->last_depth) {
- s->last_scr_width = width * cw;
- s->last_scr_height = height * cheight;
-@@ -1249,8 +1252,8 @@ static void vga_draw_text(VGACommonState *s, int full_update)
- surface = qemu_console_surface(s->con);
- qemu_console_text_resize(s->con, width, height);
- s->last_depth = 0;
-- s->last_width = width;
-- s->last_height = height;
-+ s->last_text_width = width;
-+ s->last_text_height = height;
- s->last_ch = cheight;
- s->last_cw = cw;
- full_update = 1;
-@@ -1845,6 +1848,8 @@ static void vga_invalidate_display(void *opaque)
-
- s->last_width = -1;
- s->last_height = -1;
-+ s->last_text_width = -1;
-+ s->last_text_height = -1;
- }
-
- void vga_common_reset(VGACommonState *s)
-@@ -1887,6 +1892,8 @@ void vga_common_reset(VGACommonState *s)
- s->last_ch = 0;
- s->last_width = 0;
- s->last_height = 0;
-+ s->last_text_width = 0;
-+ s->last_text_height = 0;
- s->last_scr_width = 0;
- s->last_scr_height = 0;
- s->cursor_start = 0;
-@@ -1938,8 +1945,8 @@ static void vga_update_text(void *opaque, uint32_t *chardata)
- s->graphic_mode = graphic_mode;
- full_update = 1;
- }
-- if (s->last_width == -1) {
-- s->last_width = 0;
-+ if (s->last_text_width == -1) {
-+ s->last_text_width = 0;
- full_update = 1;
- }
-
-@@ -1978,15 +1985,15 @@ static void vga_update_text(void *opaque, uint32_t *chardata)
- break;
- }
-
-- if (width != s->last_width || height != s->last_height ||
-+ if (width != s->last_text_width || height != s->last_text_height ||
- cw != s->last_cw || cheight != s->last_ch) {
- s->last_scr_width = width * cw;
- s->last_scr_height = height * cheight;
- qemu_console_resize(s->con, s->last_scr_width, s->last_scr_height);
- qemu_console_text_resize(s->con, width, height);
- s->last_depth = 0;
-- s->last_width = width;
-- s->last_height = height;
-+ s->last_text_width = width;
-+ s->last_text_height = height;
- s->last_ch = cheight;
- s->last_cw = cw;
- full_update = 1;
-@@ -2071,22 +2078,22 @@ static void vga_update_text(void *opaque, uint32_t *chardata)
- }
-
- /* Display a message */
-- s->last_width = 60;
-- s->last_height = height = 3;
-+ s->last_text_width = 60;
-+ s->last_text_height = height = 3;
- qemu_console_text_set_cursor(s->con, -1, -1);
-- qemu_console_text_resize(s->con, s->last_width, height);
-+ qemu_console_text_resize(s->con, s->last_text_width, height);
-
-- for (dst = chardata, i = 0; i < s->last_width * height; i ++)
-+ for (dst = chardata, i = 0; i < s->last_text_width * height; i ++)
- *dst++ = ' ';
-
- size = strlen(msg_buffer);
-- width = (s->last_width - size) / 2;
-- dst = chardata + s->last_width + width;
-+ width = (s->last_text_width - size) / 2;
-+ dst = chardata + s->last_text_width + width;
- for (i = 0; i < size; i ++)
- *dst++ = ATTR2CHTYPE(msg_buffer[i], QEMU_COLOR_BLUE,
- QEMU_COLOR_BLACK, 1);
-
-- qemu_console_text_update(s->con, 0, 0, s->last_width, height);
-+ qemu_console_text_update(s->con, 0, 0, s->last_text_width, height);
- }
-
- static uint64_t vga_mem_read(void *opaque, hwaddr addr,
-diff --git a/hw/display/vga_int.h b/hw/display/vga_int.h
-index 5664317ecd..ca69ae9815 100644
---- a/hw/display/vga_int.h
-+++ b/hw/display/vga_int.h
-@@ -122,7 +122,8 @@ typedef struct VGACommonState {
- uint32_t plane_updated;
- uint32_t last_line_offset;
- uint8_t last_cw, last_ch;
-- uint32_t last_width, last_height; /* in chars or pixels */
-+ uint32_t last_width, last_height; /* in pixels (graphics renderer) */
-+ uint32_t last_text_width, last_text_height; /* in chars (text renderer) */
- uint32_t last_scr_width, last_scr_height; /* in pixels */
- uint32_t last_depth; /* in bits */
- bool last_byteswap;
diff --git a/debian/patches/extra/0007-scsi-disk-fix-out-of-bound-read-in-WRITE-SAME.patch b/debian/patches/extra/0007-scsi-disk-fix-out-of-bound-read-in-WRITE-SAME.patch
deleted file mode 100644
index ffab5481da..0000000000
--- a/debian/patches/extra/0007-scsi-disk-fix-out-of-bound-read-in-WRITE-SAME.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Wed, 26 Aug 2026 19:22:41 +0200
-Subject: [PATCH] scsi-disk: fix out-of-bound read in WRITE SAME
-
-A guest with an attached scsi-hd can force QEMU's SCSI disk emulation
-to read roughly 60 KiB past the end of a heap buffer, copying that out
-of bounds host memory into the guest's own disk image.
-
-WRITE SAME computes the request transfer length at dev->blocksize
-when the request is prepared and sets cmd->xfer from dev->blocksize.
-scsi_disk_emulate_command() then uses cmd->xfer as the size of the
-request buffer.
-
-However, MODE SELECT can race with the WRITE SAME command and guest raise
-the logical block size to any value whose low bits fit 0xfe00, up to 65024.
-In the presence of this race, scsi_disk_emulate_write_same() will read
-from memory as many bytes as indicated by the *new* dev->blocksize,
-and write it to disk.
-
-The read length in WRITE SAME must be bounded by the buffer that was
-actually allocated, not by the mutable s->qdev.blocksize, so clamp the
-length used against inbuf to r->buflen. Re-validating req->cmd.xfer
-against the current block size would not work because the race is
-intrinsic in the SCSI protocol.
-
-I am not sure if this is exploitable with virtio-scsi and other SG-capable
-HBAs, because it should process the WRITE SAME input immediately,
-without letting the MODE SELECT command race with it.
-
-Fixes: 356c4c441ec ("scsi-disk: allow MODE SELECT block descriptor to set the block size", 2022-07-13)
-Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4365
-Cc: qemu-stable@nongnu.org
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit d30254aec93141d6b89262986a62764b2ae07177)
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- hw/scsi/scsi-disk.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
-index 1b0cce128c..5bb7a974d6 100644
---- a/hw/scsi/scsi-disk.c
-+++ b/hw/scsi/scsi-disk.c
-@@ -1911,6 +1911,7 @@ static void scsi_disk_emulate_write_same(SCSIDiskReq *r, uint8_t *inbuf)
- SCSIRequest *req = &r->req;
- SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev);
- uint32_t nb_sectors = scsi_data_cdb_xfer(r->req.cmd.buf);
-+ uint32_t buflen = MIN(s->qdev.blocksize, r->buflen);
- WriteSameCBData *data;
- uint8_t *buf;
- int i, l;
-@@ -1930,7 +1931,7 @@ static void scsi_disk_emulate_write_same(SCSIDiskReq *r, uint8_t *inbuf)
- return;
- }
-
-- if ((req->cmd.buf[1] & 0x1) || buffer_is_zero(inbuf, s->qdev.blocksize)) {
-+ if ((req->cmd.buf[1] & 0x1) || buffer_is_zero(inbuf, buflen)) {
- int flags = (req->cmd.buf[1] & 0x8) ? BDRV_REQ_MAY_UNMAP : 0;
-
- /* The request is used as the AIO opaque value, so add a ref. */
-@@ -1956,7 +1957,7 @@ static void scsi_disk_emulate_write_same(SCSIDiskReq *r, uint8_t *inbuf)
- qemu_iovec_init_external(&data->qiov, &data->iov, 1);
-
- for (i = 0; i < data->iov.iov_len; i += l) {
-- l = MIN(s->qdev.blocksize, data->iov.iov_len - i);
-+ l = MIN(buflen, data->iov.iov_len - i);
- memcpy(&buf[i], inbuf, l);
- }
-
diff --git a/debian/patches/extra/0008-scsi-hide-MODE-SELECT-block-size-change-behind-a-qui.patch b/debian/patches/extra/0008-scsi-hide-MODE-SELECT-block-size-change-behind-a-qui.patch
deleted file mode 100644
index 28b60a97d2..0000000000
--- a/debian/patches/extra/0008-scsi-hide-MODE-SELECT-block-size-change-behind-a-qui.patch
+++ /dev/null
@@ -1,89 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Wed, 26 Aug 2026 19:53:31 +0200
-Subject: [PATCH] scsi: hide MODE SELECT block size change behind a quirk
-
-This is a dangerous operation in that the block size is not
-protected by a lock, but it can be written concurrently if
-you have a multi-queue virtio-scsi HBA. Put it behind a quirk
-that is only enabled by the Q800 machine, since the MODE
-SELECT feature was added for A/UX.
-
-Cc: qemu-stable@nongnu.org
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit 0f410adf6b0dead1f09938054da639954bda3bc1)
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- hw/m68k/q800.c | 2 ++
- hw/scsi/scsi-disk.c | 12 ++++++++++--
- include/hw/scsi/scsi.h | 1 +
- 3 files changed, 13 insertions(+), 2 deletions(-)
-
-diff --git a/hw/m68k/q800.c b/hw/m68k/q800.c
-index ab64250c47..1ad3f93b29 100644
---- a/hw/m68k/q800.c
-+++ b/hw/m68k/q800.c
-@@ -710,12 +710,14 @@ static void q800_init(Object *obj)
-
- static GlobalProperty hw_compat_q800[] = {
- { "scsi-hd", "quirk_mode_page_vendor_specific_apple", "on" },
-+ { "scsi-hd", "quirk_mode_page_set_block_size", "on" },
- { "scsi-hd", "vendor", " SEAGATE" },
- { "scsi-hd", "product", " ST225N" },
- { "scsi-hd", "ver", "1.0 " },
- { "scsi-cd", "quirk_mode_page_apple_vendor", "on" },
- { "scsi-cd", "quirk_mode_sense_rom_use_dbd", "on" },
- { "scsi-cd", "quirk_mode_page_vendor_specific_apple", "on" },
-+ { "scsi-cd", "quirk_mode_page_set_block_size", "on" },
- { "scsi-cd", "quirk_mode_page_truncated", "on" },
- { "scsi-cd", "vendor", "MATSHITA" },
- { "scsi-cd", "product", "CD-ROM CR-8005" },
-diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
-index 5bb7a974d6..a42f7d8e77 100644
---- a/hw/scsi/scsi-disk.c
-+++ b/hw/scsi/scsi-disk.c
-@@ -1673,8 +1673,12 @@ static void scsi_disk_emulate_mode_select(SCSIDiskReq *r, uint8_t *inbuf)
- goto invalid_param;
- }
-
-- /* Allow changing the block size */
-- if (bd_len) {
-+ /*
-+ * Allow changing the block size only if the quirk is enabled for it.
-+ * Writing s->qdev.blocksize is not thread safe!
-+ */
-+ if (bd_len && (s->quirks &
-+ (1 << SCSI_DISK_QUIRK_MODE_PAGE_SET_BLOCK_SIZE))) {
- bs = p[5] << 16 | p[6] << 8 | p[7];
-
- /*
-@@ -3247,6 +3251,8 @@ static const Property scsi_hd_properties[] = {
- DEFINE_PROP_BIT("quirk_mode_page_vendor_specific_apple", SCSIDiskState,
- quirks, SCSI_DISK_QUIRK_MODE_PAGE_VENDOR_SPECIFIC_APPLE,
- 0),
-+ DEFINE_PROP_BIT("quirk_mode_page_set_block_size", SCSIDiskState,
-+ quirks, SCSI_DISK_QUIRK_MODE_PAGE_SET_BLOCK_SIZE, 0),
- DEFINE_BLOCK_CHS_PROPERTIES(SCSIDiskState, qdev.conf),
- };
-
-@@ -3352,6 +3358,8 @@ static const Property scsi_cd_properties[] = {
- 0),
- DEFINE_PROP_BIT("quirk_mode_page_truncated", SCSIDiskState, quirks,
- SCSI_DISK_QUIRK_MODE_PAGE_TRUNCATED, 0),
-+ DEFINE_PROP_BIT("quirk_mode_page_set_block_size", SCSIDiskState,
-+ quirks, SCSI_DISK_QUIRK_MODE_PAGE_SET_BLOCK_SIZE, 0),
- };
-
- static void scsi_cd_class_initfn(ObjectClass *klass, const void *data)
-diff --git a/include/hw/scsi/scsi.h b/include/hw/scsi/scsi.h
-index c60c6e8810..3eab339b0d 100644
---- a/include/hw/scsi/scsi.h
-+++ b/include/hw/scsi/scsi.h
-@@ -262,5 +262,6 @@ bool scsi_generic_pr_state_preempt(SCSIDevice *s, Error **errp);
- #define SCSI_DISK_QUIRK_MODE_SENSE_ROM_USE_DBD 1
- #define SCSI_DISK_QUIRK_MODE_PAGE_VENDOR_SPECIFIC_APPLE 2
- #define SCSI_DISK_QUIRK_MODE_PAGE_TRUNCATED 3
-+#define SCSI_DISK_QUIRK_MODE_PAGE_SET_BLOCK_SIZE 4
-
- #endif
diff --git a/debian/patches/extra/0009-vapic-confine-the-VAPIC-region-to-0xc0000.0xe0000.patch b/debian/patches/extra/0009-vapic-confine-the-VAPIC-region-to-0xc0000.0xe0000.patch
deleted file mode 100644
index c0b17c6339..0000000000
--- a/debian/patches/extra/0009-vapic-confine-the-VAPIC-region-to-0xc0000.0xe0000.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Wed, 26 Aug 2026 20:02:56 +0200
-Subject: [PATCH] vapic: confine the VAPIC region to 0xc0000..0xe0000
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The VAPIC region is mapped as writable RAM, at very high priority,
-above existing memory. If the guest is allowed to map it everywhere,
-it can overlap PCI BARs or even SMRAM. Ensure that the whole
-region first in the 128K of low memory that are reserved to
-option ROMs.
-
-Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4206
-Reported-by: Artem Dinaburg <https://gitlab.com/artem35>
-Cc: qemu-stable@nongnu.org
-Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit d61c8a6fb7388486353aa267ba0d75b098f16662)
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- hw/i386/vapic.c | 16 +++++++++++++++-
- 1 file changed, 15 insertions(+), 1 deletion(-)
-
-diff --git a/hw/i386/vapic.c b/hw/i386/vapic.c
-index 8dd9188d96..9adce17262 100644
---- a/hw/i386/vapic.c
-+++ b/hw/i386/vapic.c
-@@ -34,6 +34,10 @@
- #define ROM_BLOCK_SIZE 512
- #define ROM_BLOCK_MASK (~(ROM_BLOCK_SIZE - 1))
-
-+/* Option ROM window on PC/Q35 machines; the vapic ROM must live in here. */
-+#define OPTION_ROM_START 0xc0000
-+#define OPTION_ROM_END 0xe0000
-+
- typedef enum VAPICMode {
- VAPIC_INACTIVE = 0,
- VAPIC_ACTIVE = 1,
-@@ -592,6 +596,14 @@ static int vapic_map_rom_writable(VAPICROMState *s)
- size_t rom_size;
- uint8_t *ram;
-
-+ /*
-+ * The VAPIC region should be mapped in place, refuse mapping it
-+ * outside of the option ROM window.
-+ */
-+ if (rom_paddr < OPTION_ROM_START || rom_paddr >= OPTION_ROM_END) {
-+ return -1;
-+ }
-+
- if (s->rom_mapped_writable) {
- memory_region_del_subregion(mr, &s->rom);
- object_unparent(OBJECT(&s->rom));
-@@ -606,9 +618,10 @@ static int vapic_map_rom_writable(VAPICROMState *s)
- }
- ram = memory_region_get_ram_ptr(section.mr);
- rom_size = ram[rom_paddr + 2] * ROM_BLOCK_SIZE;
-- if (rom_size == 0) {
-+ if (rom_size == 0 || rom_size > OPTION_ROM_END - rom_paddr) {
- return -1;
- }
-+
- s->rom_size = rom_size;
-
- /* We need to round to avoid creating subpages
-@@ -616,6 +629,7 @@ static int vapic_map_rom_writable(VAPICROMState *s)
- rom_size += rom_paddr & ~TARGET_PAGE_MASK;
- rom_paddr &= TARGET_PAGE_MASK;
- rom_size = TARGET_PAGE_ALIGN(rom_size);
-+ assert(rom_paddr >= OPTION_ROM_START && rom_paddr + rom_size <= OPTION_ROM_END);
-
- memory_region_init_alias(&s->rom, OBJECT(s), "kvmvapic-rom", section.mr,
- rom_paddr, rom_size);
diff --git a/debian/patches/extra/0010-i386-vapic-unref-MemoryRegion-if-vapic_map_rom_writa.patch b/debian/patches/extra/0010-i386-vapic-unref-MemoryRegion-if-vapic_map_rom_writa.patch
deleted file mode 100644
index c232e80930..0000000000
--- a/debian/patches/extra/0010-i386-vapic-unref-MemoryRegion-if-vapic_map_rom_writa.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Wed, 26 Aug 2026 19:47:32 +0200
-Subject: [PATCH] i386/vapic: unref MemoryRegion if vapic_map_rom_writable
- fails
-
-memory_region_find returns the memory region with an elevated
-reference count. Drop the reference count also if the memory
-region cannot be mapped writable.
-
-Cc: qemu-stable@nongnu.org
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(cherry picked from commit cfa6e2c52ca8f756461fe41f4ce40e61a82fd914)
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- hw/i386/vapic.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/hw/i386/vapic.c b/hw/i386/vapic.c
-index 9adce17262..5c3911cf9c 100644
---- a/hw/i386/vapic.c
-+++ b/hw/i386/vapic.c
-@@ -614,11 +614,13 @@ static int vapic_map_rom_writable(VAPICROMState *s)
-
- /* read ROM size from RAM region */
- if (rom_paddr + 2 >= memory_region_size(section.mr)) {
-+ memory_region_unref(section.mr);
- return -1;
- }
- ram = memory_region_get_ram_ptr(section.mr);
- rom_size = ram[rom_paddr + 2] * ROM_BLOCK_SIZE;
- if (rom_size == 0 || rom_size > OPTION_ROM_END - rom_paddr) {
-+ memory_region_unref(section.mr);
- return -1;
- }
-
diff --git a/debian/patches/extra/0011-io-channel-socket-do-not-treat-a-zero-length-write-a.patch b/debian/patches/extra/0011-io-channel-socket-do-not-treat-a-zero-length-write-a.patch
deleted file mode 100644
index 24834b364c..0000000000
--- a/debian/patches/extra/0011-io-channel-socket-do-not-treat-a-zero-length-write-a.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: "Denis V. Lunev" <den@openvz.org>
-Date: Mon, 31 Aug 2026 12:01:46 +0200
-Subject: [PATCH] io/channel-socket: do not treat a zero length write as an
- error
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-qio_channel_socket_writev() checks "ret <= 0" after sendmsg(). A zero
-length iovec is written successfully and returns 0, so the success
-falls into the errno switch, which acts on whatever the last failing
-syscall left in errno. A stale EAGAIN turns it into
-QIO_CHANNEL_ERR_BLOCK with errp untouched, and a caller which treats
-every negative return as fatal then passes a NULL Error to
-error_get_pretty(). The websocket handshake does exactly that, so an
-unauthenticated client crashes QEMU during the greeting.
-
-Returning 0 is safe for callers which loop until everything is
-written. qio_channel_writev_full_all() has no zero progress guard, but
-iov_copy() yields no entries for a zero length write, so that loop is
-never entered. A connected stream socket returns 0 only when there is
-nothing to send.
-
-The WIN32 implementation in the same file uses "ret < 0".
-
-Fixes: CVE-2026-84788
-Fixes: 559607ea173a ("io: add QIOChannelSocket class")
-Cc: qemu-stable@nongnu.org
-Cc: Daniel P. Berrangé <berrange@redhat.com>
-Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
-Signed-off-by: Denis V. Lunev <den@openvz.org>
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-(cherry picked from commit a3de21bfa5d0c33110942d407ff5c7903965d3ad)
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- io/channel-socket.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/io/channel-socket.c b/io/channel-socket.c
-index 12773b832c..7920cee639 100644
---- a/io/channel-socket.c
-+++ b/io/channel-socket.c
-@@ -667,7 +667,7 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
-
- retry:
- ret = sendmsg(sioc->fd, &msg, sflags);
-- if (ret <= 0) {
-+ if (ret < 0) {
- switch (errno) {
- case EAGAIN:
- return QIO_CHANNEL_ERR_BLOCK;
diff --git a/debian/patches/pve/0001-PVE-Config-block-file-change-locking-default-to-off.patch b/debian/patches/pve/0001-PVE-Config-block-file-change-locking-default-to-off.patch
index 3bb79c2ec0..cd951fb1a7 100644
--- a/debian/patches/pve/0001-PVE-Config-block-file-change-locking-default-to-off.patch
+++ b/debian/patches/pve/0001-PVE-Config-block-file-change-locking-default-to-off.patch
@@ -14,10 +14,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/block/file-posix.c b/block/file-posix.c
-index 3c985da94f..e5b942b6e4 100644
+index 90c086f1f8..2c29ee7819 100644
--- a/block/file-posix.c
+++ b/block/file-posix.c
-@@ -581,7 +581,7 @@ static QemuOptsList raw_runtime_opts = {
+@@ -601,7 +601,7 @@ static QemuOptsList raw_runtime_opts = {
{
.name = "locking",
.type = QEMU_OPT_STRING,
@@ -26,7 +26,7 @@ index 3c985da94f..e5b942b6e4 100644
},
{
.name = "pr-manager",
-@@ -681,7 +681,7 @@ static int raw_open_common(BlockDriverState *bs, QDict *options,
+@@ -701,7 +701,7 @@ static int raw_open_common(BlockDriverState *bs, QDict *options,
s->use_lock = false;
break;
case ON_OFF_AUTO_AUTO:
diff --git a/debian/patches/pve/0003-PVE-Config-set-the-CPU-model-to-kvm64-32-instead-of-.patch b/debian/patches/pve/0003-PVE-Config-set-the-CPU-model-to-kvm64-32-instead-of-.patch
index 80d650b214..098945b4a6 100644
--- a/debian/patches/pve/0003-PVE-Config-set-the-CPU-model-to-kvm64-32-instead-of-.patch
+++ b/debian/patches/pve/0003-PVE-Config-set-the-CPU-model-to-kvm64-32-instead-of-.patch
@@ -10,10 +10,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
-index e6a197602d..0e09893d35 100644
+index 04ab0c84a3..e581fee334 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
-@@ -2792,9 +2792,9 @@ uint64_t cpu_get_tsc(CPUX86State *env);
+@@ -2791,9 +2791,9 @@ uint64_t cpu_get_tsc(CPUX86State *env);
#define CPU_RESOLVING_TYPE TYPE_X86_CPU
#ifdef TARGET_X86_64
diff --git a/debian/patches/pve/0006-PVE-Up-qemu-img-return-success-on-info-without-snaps.patch b/debian/patches/pve/0006-PVE-Up-qemu-img-return-success-on-info-without-snaps.patch
index e872eb361d..0c61285b6f 100644
--- a/debian/patches/pve/0006-PVE-Up-qemu-img-return-success-on-info-without-snaps.patch
+++ b/debian/patches/pve/0006-PVE-Up-qemu-img-return-success-on-info-without-snaps.patch
@@ -9,10 +9,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/qemu-img.c b/qemu-img.c
-index 2f63d31141..2f9e8e77b8 100644
+index edf75e43ab..43f86aa773 100644
--- a/qemu-img.c
+++ b/qemu-img.c
-@@ -3185,7 +3185,8 @@ static int img_info(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -3191,7 +3191,8 @@ static int img_info(const img_cmd_t *ccmd, int argc, char **argv)
list = collect_image_info_list(image_opts, filename, fmt, cache, chain,
limits, force_share);
if (!list) {
diff --git a/debian/patches/pve/0007-PVE-Up-qemu-img-dd-add-osize-and-read-from-to-stdin-.patch b/debian/patches/pve/0007-PVE-Up-qemu-img-dd-add-osize-and-read-from-to-stdin-.patch
index 9184458394..355c333078 100644
--- a/debian/patches/pve/0007-PVE-Up-qemu-img-dd-add-osize-and-read-from-to-stdin-.patch
+++ b/debian/patches/pve/0007-PVE-Up-qemu-img-dd-add-osize-and-read-from-to-stdin-.patch
@@ -55,10 +55,10 @@ index 6bc8265cfb..85458ea2d8 100644
DEF("info", img_info,
diff --git a/qemu-img.c b/qemu-img.c
-index 2f9e8e77b8..dad04c865e 100644
+index 43f86aa773..82856a38a8 100644
--- a/qemu-img.c
+++ b/qemu-img.c
-@@ -5320,10 +5320,12 @@ static int img_bitmap(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5326,10 +5326,12 @@ static int img_bitmap(const img_cmd_t *ccmd, int argc, char **argv)
#define C_IF 04
#define C_OF 010
#define C_SKIP 020
@@ -71,7 +71,7 @@ index 2f9e8e77b8..dad04c865e 100644
};
struct DdIo {
-@@ -5399,6 +5401,19 @@ static int img_dd_skip(const char *arg,
+@@ -5405,6 +5407,19 @@ static int img_dd_skip(const char *arg,
return 0;
}
@@ -91,7 +91,7 @@ index 2f9e8e77b8..dad04c865e 100644
static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
{
int ret = 0;
-@@ -5439,6 +5454,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5445,6 +5460,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
{ "if", img_dd_if, C_IF },
{ "of", img_dd_of, C_OF },
{ "skip", img_dd_skip, C_SKIP },
@@ -99,7 +99,7 @@ index 2f9e8e77b8..dad04c865e 100644
{ NULL, NULL, 0 }
};
const struct option long_options[] = {
-@@ -5536,91 +5552,112 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5542,91 +5558,112 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
arg = NULL;
}
@@ -276,7 +276,7 @@ index 2f9e8e77b8..dad04c865e 100644
}
if (dd.flags & C_SKIP && (in.offset > INT64_MAX / in.bsz ||
-@@ -5637,20 +5674,43 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5643,20 +5680,43 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
in.buf = g_new(uint8_t, in.bsz);
for (out_pos = 0; in_pos < size; ) {
diff --git a/debian/patches/pve/0008-PVE-Up-qemu-img-dd-add-isize-parameter.patch b/debian/patches/pve/0008-PVE-Up-qemu-img-dd-add-isize-parameter.patch
index db3a1bfaa8..72dbb64ab3 100644
--- a/debian/patches/pve/0008-PVE-Up-qemu-img-dd-add-isize-parameter.patch
+++ b/debian/patches/pve/0008-PVE-Up-qemu-img-dd-add-isize-parameter.patch
@@ -17,10 +17,10 @@ Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
1 file changed, 25 insertions(+), 3 deletions(-)
diff --git a/qemu-img.c b/qemu-img.c
-index dad04c865e..f64a8cb3d3 100644
+index 82856a38a8..eaa143fe48 100644
--- a/qemu-img.c
+++ b/qemu-img.c
-@@ -5321,11 +5321,13 @@ static int img_bitmap(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5327,11 +5327,13 @@ static int img_bitmap(const img_cmd_t *ccmd, int argc, char **argv)
#define C_OF 010
#define C_SKIP 020
#define C_OSIZE 040
@@ -34,7 +34,7 @@ index dad04c865e..f64a8cb3d3 100644
};
struct DdIo {
-@@ -5414,6 +5416,19 @@ static int img_dd_osize(const char *arg,
+@@ -5420,6 +5422,19 @@ static int img_dd_osize(const char *arg,
return 0;
}
@@ -54,7 +54,7 @@ index dad04c865e..f64a8cb3d3 100644
static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
{
int ret = 0;
-@@ -5428,12 +5443,14 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5434,12 +5449,14 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
int c, i;
const char *out_fmt = "raw";
const char *fmt = NULL;
@@ -70,7 +70,7 @@ index dad04c865e..f64a8cb3d3 100644
};
struct DdIo in = {
.bsz = 512, /* Block size is by default 512 bytes */
-@@ -5455,6 +5472,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5461,6 +5478,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
{ "of", img_dd_of, C_OF },
{ "skip", img_dd_skip, C_SKIP },
{ "osize", img_dd_osize, C_OSIZE },
@@ -78,7 +78,7 @@ index dad04c865e..f64a8cb3d3 100644
{ NULL, NULL, 0 }
};
const struct option long_options[] = {
-@@ -5673,9 +5691,10 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5679,9 +5697,10 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
in.buf = g_new(uint8_t, in.bsz);
@@ -91,7 +91,7 @@ index dad04c865e..f64a8cb3d3 100644
if (blk1) {
in_ret = blk_pread(blk1, in_pos, bytes, in.buf, 0);
if (in_ret == 0) {
-@@ -5684,6 +5703,9 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5690,6 +5709,9 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
} else {
in_ret = read(STDIN_FILENO, in.buf, bytes);
if (in_ret == 0) {
diff --git a/debian/patches/pve/0009-PVE-Up-qemu-img-dd-add-n-skip_create.patch b/debian/patches/pve/0009-PVE-Up-qemu-img-dd-add-n-skip_create.patch
index 5684d3c819..d42e207565 100644
--- a/debian/patches/pve/0009-PVE-Up-qemu-img-dd-add-n-skip_create.patch
+++ b/debian/patches/pve/0009-PVE-Up-qemu-img-dd-add-n-skip_create.patch
@@ -66,10 +66,10 @@ index 85458ea2d8..f97c2fa396 100644
DEF("info", img_info,
diff --git a/qemu-img.c b/qemu-img.c
-index f64a8cb3d3..e8e2b0eb68 100644
+index eaa143fe48..25cf0babe4 100644
--- a/qemu-img.c
+++ b/qemu-img.c
-@@ -5445,7 +5445,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5451,7 +5451,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
const char *fmt = NULL;
int64_t size = 0, readsize = 0;
int64_t out_pos, in_pos;
@@ -78,7 +78,7 @@ index f64a8cb3d3..e8e2b0eb68 100644
struct DdInfo dd = {
.flags = 0,
.count = 0,
-@@ -5485,7 +5485,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5491,7 +5491,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
{ 0, 0, 0, 0 }
};
@@ -87,7 +87,7 @@ index f64a8cb3d3..e8e2b0eb68 100644
if (c == EOF) {
break;
}
-@@ -5526,6 +5526,9 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5532,6 +5532,9 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
case 'O':
out_fmt = optarg;
break;
@@ -97,7 +97,7 @@ index f64a8cb3d3..e8e2b0eb68 100644
case 'U':
force_share = true;
break;
-@@ -5655,13 +5658,15 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5661,13 +5664,15 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
size - in.bsz * in.offset, &error_abort);
}
diff --git a/debian/patches/pve/0010-qemu-img-dd-add-l-option-for-loading-a-snapshot.patch b/debian/patches/pve/0010-qemu-img-dd-add-l-option-for-loading-a-snapshot.patch
index f3bd76dd6a..00a77964b6 100644
--- a/debian/patches/pve/0010-qemu-img-dd-add-l-option-for-loading-a-snapshot.patch
+++ b/debian/patches/pve/0010-qemu-img-dd-add-l-option-for-loading-a-snapshot.patch
@@ -48,10 +48,10 @@ index f97c2fa396..206ca7381c 100644
DEF("info", img_info,
diff --git a/qemu-img.c b/qemu-img.c
-index e8e2b0eb68..8da92a63c0 100644
+index 25cf0babe4..21ec5615e2 100644
--- a/qemu-img.c
+++ b/qemu-img.c
-@@ -5437,6 +5437,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5443,6 +5443,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
BlockDriver *drv = NULL, *proto_drv = NULL;
BlockBackend *blk1 = NULL, *blk2 = NULL;
QemuOpts *opts = NULL;
@@ -59,7 +59,7 @@ index e8e2b0eb68..8da92a63c0 100644
QemuOptsList *create_opts = NULL;
Error *local_err = NULL;
bool image_opts = false;
-@@ -5446,6 +5447,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5452,6 +5453,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
int64_t size = 0, readsize = 0;
int64_t out_pos, in_pos;
bool force_share = false, skip_create = false;
@@ -67,7 +67,7 @@ index e8e2b0eb68..8da92a63c0 100644
struct DdInfo dd = {
.flags = 0,
.count = 0,
-@@ -5485,7 +5487,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5491,7 +5493,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
{ 0, 0, 0, 0 }
};
@@ -76,7 +76,7 @@ index e8e2b0eb68..8da92a63c0 100644
if (c == EOF) {
break;
}
-@@ -5529,6 +5531,19 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5535,6 +5537,19 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
case 'n':
skip_create = true;
break;
@@ -96,7 +96,7 @@ index e8e2b0eb68..8da92a63c0 100644
case 'U':
force_share = true;
break;
-@@ -5587,11 +5602,24 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5593,11 +5608,24 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
if (dd.flags & C_IF) {
blk1 = img_open(image_opts, in.filename, fmt, 0, false, false,
force_share);
@@ -122,7 +122,7 @@ index e8e2b0eb68..8da92a63c0 100644
}
if (dd.flags & C_OSIZE) {
-@@ -5746,6 +5774,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5752,6 +5780,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
out:
g_free(arg);
qemu_opts_del(opts);
diff --git a/debian/patches/pve/0011-PVE-virtio-balloon-improve-query-balloon.patch b/debian/patches/pve/0011-PVE-virtio-balloon-improve-query-balloon.patch
index c0e337a613..de48b8fe25 100644
--- a/debian/patches/pve/0011-PVE-virtio-balloon-improve-query-balloon.patch
+++ b/debian/patches/pve/0011-PVE-virtio-balloon-improve-query-balloon.patch
@@ -59,10 +59,10 @@ index 686304bafa..474afba207 100644
qapi_free_BalloonInfo(info);
}
diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
-index 4c5f486ba2..58fa33fb4a 100644
+index 07d519cf6d..55c775bfe2 100644
--- a/hw/virtio/virtio-balloon.c
+++ b/hw/virtio/virtio-balloon.c
-@@ -793,8 +793,37 @@ static uint64_t virtio_balloon_get_features(VirtIODevice *vdev, uint64_t f,
+@@ -797,8 +797,37 @@ static uint64_t virtio_balloon_get_features(VirtIODevice *vdev, uint64_t f,
static void virtio_balloon_stat(void *opaque, BalloonInfo *info)
{
VirtIOBalloon *dev = opaque;
diff --git a/debian/patches/pve/0015-PVE-add-savevm-async-for-background-state-snapshots.patch b/debian/patches/pve/0015-PVE-add-savevm-async-for-background-state-snapshots.patch
index f04bc2896a..4bc6855b2e 100644
--- a/debian/patches/pve/0015-PVE-add-savevm-async-for-background-state-snapshots.patch
+++ b/debian/patches/pve/0015-PVE-add-savevm-async-for-background-state-snapshots.patch
@@ -883,10 +883,10 @@ index b1eaf7b054..0794a3a7a3 100644
# @query-migrate:
#
diff --git a/qapi/misc.json b/qapi/misc.json
-index 22b7afed9f..786aeb4d3c 100644
+index c71a5fe657..48359a8992 100644
--- a/qapi/misc.json
+++ b/qapi/misc.json
-@@ -455,6 +455,31 @@
+@@ -463,6 +463,31 @@
##
{ 'command': 'query-fdsets', 'returns': ['FdsetInfo'] }
diff --git a/debian/patches/pve/0016-PVE-add-optional-buffer-size-to-QEMUFile.patch b/debian/patches/pve/0016-PVE-add-optional-buffer-size-to-QEMUFile.patch
index 40ef2dcd26..fe00188373 100644
--- a/debian/patches/pve/0016-PVE-add-optional-buffer-size-to-QEMUFile.patch
+++ b/debian/patches/pve/0016-PVE-add-optional-buffer-size-to-QEMUFile.patch
@@ -21,7 +21,7 @@ Signed-off-by: Erik Fastermann <e.fastermann@proxmox.com>
3 files changed, 37 insertions(+), 17 deletions(-)
diff --git a/migration/qemu-file.c b/migration/qemu-file.c
-index f30e13c66d..98acebce80 100644
+index eb0d63d54b..6a65f40bd6 100644
--- a/migration/qemu-file.c
+++ b/migration/qemu-file.c
@@ -34,8 +34,8 @@
diff --git a/debian/patches/pve/0017-PVE-block-add-the-zeroinit-block-driver-filter.patch b/debian/patches/pve/0017-PVE-block-add-the-zeroinit-block-driver-filter.patch
index 93f0c8d78e..c88df54d03 100644
--- a/debian/patches/pve/0017-PVE-block-add-the-zeroinit-block-driver-filter.patch
+++ b/debian/patches/pve/0017-PVE-block-add-the-zeroinit-block-driver-filter.patch
@@ -247,10 +247,10 @@ index 0000000000..036edb17f5
+
+block_init(bdrv_zeroinit_init);
diff --git a/qapi/block-core.json b/qapi/block-core.json
-index c2f6139dea..c3204f5739 100644
+index 28d9c1e98e..07d16c4a04 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
-@@ -3375,7 +3375,7 @@
+@@ -3377,7 +3377,7 @@
{ 'name': 'virtio-blk-vfio-pci', 'if': 'CONFIG_BLKIO' },
{ 'name': 'virtio-blk-vhost-user', 'if': 'CONFIG_BLKIO' },
{ 'name': 'virtio-blk-vhost-vdpa', 'if': 'CONFIG_BLKIO' },
@@ -259,7 +259,7 @@ index c2f6139dea..c3204f5739 100644
##
# @BlockdevOptionsFile:
-@@ -4909,7 +4909,8 @@
+@@ -4911,7 +4911,8 @@
'if': 'CONFIG_BLKIO' },
'vmdk': 'BlockdevOptionsGenericCOWFormat',
'vpc': 'BlockdevOptionsGenericFormat',
diff --git a/debian/patches/pve/0020-PVE-Up-Config-file-posix-make-locking-optiono-on-cre.patch b/debian/patches/pve/0020-PVE-Up-Config-file-posix-make-locking-optiono-on-cre.patch
index c52036cfcc..a6a1076be7 100644
--- a/debian/patches/pve/0020-PVE-Up-Config-file-posix-make-locking-optiono-on-cre.patch
+++ b/debian/patches/pve/0020-PVE-Up-Config-file-posix-make-locking-optiono-on-cre.patch
@@ -13,10 +13,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
2 files changed, 46 insertions(+), 20 deletions(-)
diff --git a/block/file-posix.c b/block/file-posix.c
-index e5b942b6e4..adf9557428 100644
+index 2c29ee7819..73e7eb3cd2 100644
--- a/block/file-posix.c
+++ b/block/file-posix.c
-@@ -2959,6 +2959,7 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
+@@ -2979,6 +2979,7 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
int fd;
uint64_t perm, shared;
int result = 0;
@@ -24,7 +24,7 @@ index e5b942b6e4..adf9557428 100644
/* Validate options and set default values */
assert(options->driver == BLOCKDEV_DRIVER_FILE);
-@@ -2999,19 +3000,22 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
+@@ -3019,19 +3020,22 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
perm = BLK_PERM_WRITE | BLK_PERM_RESIZE;
shared = BLK_PERM_ALL & ~BLK_PERM_RESIZE;
@@ -59,7 +59,7 @@ index e5b942b6e4..adf9557428 100644
}
/* Clear the file by truncating it to 0 */
-@@ -3065,13 +3069,15 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
+@@ -3085,13 +3089,15 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
}
out_unlock:
@@ -82,7 +82,7 @@ index e5b942b6e4..adf9557428 100644
}
out_close:
-@@ -3095,6 +3101,7 @@ raw_co_create_opts(BlockDriver *drv, const char *filename,
+@@ -3115,6 +3121,7 @@ raw_co_create_opts(BlockDriver *drv, const char *filename,
PreallocMode prealloc;
char *buf = NULL;
Error *local_err = NULL;
@@ -90,7 +90,7 @@ index e5b942b6e4..adf9557428 100644
/* Skip file: protocol prefix */
strstart(filename, "file:", &filename);
-@@ -3117,6 +3124,18 @@ raw_co_create_opts(BlockDriver *drv, const char *filename,
+@@ -3137,6 +3144,18 @@ raw_co_create_opts(BlockDriver *drv, const char *filename,
return -EINVAL;
}
@@ -109,7 +109,7 @@ index e5b942b6e4..adf9557428 100644
options = (BlockdevCreateOptions) {
.driver = BLOCKDEV_DRIVER_FILE,
.u.file = {
-@@ -3128,6 +3147,8 @@ raw_co_create_opts(BlockDriver *drv, const char *filename,
+@@ -3148,6 +3167,8 @@ raw_co_create_opts(BlockDriver *drv, const char *filename,
.nocow = nocow,
.has_extent_size_hint = has_extent_size_hint,
.extent_size_hint = extent_size_hint,
@@ -119,10 +119,10 @@ index e5b942b6e4..adf9557428 100644
};
return raw_co_create(&options, errp);
diff --git a/qapi/block-core.json b/qapi/block-core.json
-index c3204f5739..338675b98a 100644
+index 07d16c4a04..a12a1a2747 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
-@@ -5128,6 +5128,10 @@
+@@ -5130,6 +5130,10 @@
# @extent-size-hint: Extent size hint to add to the image file; 0 for
# not adding an extent size hint (default: 1 MB, since 5.1)
#
@@ -133,7 +133,7 @@ index c3204f5739..338675b98a 100644
# Since: 2.12
##
{ 'struct': 'BlockdevCreateOptionsFile',
-@@ -5135,7 +5139,8 @@
+@@ -5137,7 +5141,8 @@
'size': 'size',
'*preallocation': 'PreallocMode',
'*nocow': 'bool',
diff --git a/debian/patches/pve/0025-PVE-Backup-add-backup-dump-block-driver.patch b/debian/patches/pve/0025-PVE-Backup-add-backup-dump-block-driver.patch
index 98e5c0eee7..ba7324d481 100644
--- a/debian/patches/pve/0025-PVE-Backup-add-backup-dump-block-driver.patch
+++ b/debian/patches/pve/0025-PVE-Backup-add-backup-dump-block-driver.patch
@@ -259,7 +259,7 @@ index 83f858669f..d7ab3cb78f 100644
'blklogwrites.c',
'blkverify.c',
diff --git a/include/block/block_int-common.h b/include/block/block_int-common.h
-index 147c08155f..41c82fc1ab 100644
+index 46428b034d..94b1dd347d 100644
--- a/include/block/block_int-common.h
+++ b/include/block/block_int-common.h
@@ -25,6 +25,7 @@
@@ -312,7 +312,7 @@ index 147c08155f..41c82fc1ab 100644
BDRV_TRACKED_READ,
BDRV_TRACKED_WRITE,
diff --git a/job.c b/job.c
-index e747908472..5120a01265 100644
+index d7220aaf30..40dd820fba 100644
--- a/job.c
+++ b/job.c
@@ -337,7 +337,8 @@ static bool job_started_locked(Job *job)
diff --git a/debian/patches/pve/0026-PVE-Add-sequential-job-transaction-support.patch b/debian/patches/pve/0026-PVE-Add-sequential-job-transaction-support.patch
index 8f1b20151c..2f1c31a750 100644
--- a/debian/patches/pve/0026-PVE-Add-sequential-job-transaction-support.patch
+++ b/debian/patches/pve/0026-PVE-Add-sequential-job-transaction-support.patch
@@ -34,7 +34,7 @@ index 0e40e8b457..f4fff5fa0d 100644
* Release a reference that was previously acquired with job_txn_add_job or
* job_txn_new. If it's the last reference to the object, it will be freed.
diff --git a/job.c b/job.c
-index 5120a01265..353a0216cd 100644
+index 40dd820fba..6de4c7cfdb 100644
--- a/job.c
+++ b/job.c
@@ -94,6 +94,8 @@ struct JobTxn {
@@ -72,7 +72,7 @@ index 5120a01265..353a0216cd 100644
/* Called with job_mutex held. */
static void job_txn_ref_locked(JobTxn *txn)
{
-@@ -1048,6 +1069,12 @@ static void job_completed_txn_success_locked(Job *job)
+@@ -1055,6 +1076,12 @@ static void job_completed_txn_success_locked(Job *job)
*/
QLIST_FOREACH(other_job, &txn->jobs, txn_list) {
if (!job_is_completed_locked(other_job)) {
@@ -85,7 +85,7 @@ index 5120a01265..353a0216cd 100644
return;
}
assert(other_job->ret == 0);
-@@ -1259,6 +1286,13 @@ int job_finish_sync_locked(Job *job,
+@@ -1266,6 +1293,13 @@ int job_finish_sync_locked(Job *job,
return -EBUSY;
}
diff --git a/debian/patches/pve/0027-PVE-Backup-Proxmox-backup-patches-for-QEMU.patch b/debian/patches/pve/0027-PVE-Backup-Proxmox-backup-patches-for-QEMU.patch
index 67bb0c2f10..e5d76c54c0 100644
--- a/debian/patches/pve/0027-PVE-Backup-Proxmox-backup-patches-for-QEMU.patch
+++ b/debian/patches/pve/0027-PVE-Backup-Proxmox-backup-patches-for-QEMU.patch
@@ -1685,7 +1685,7 @@ index 0000000000..177fb851b4
+ return ret;
+}
diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 338675b98a..2a0cc0fd2a 100644
+index a12a1a2747..e66c455f6e 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -952,6 +952,248 @@
diff --git a/debian/patches/pve/0029-PVE-Add-PBS-block-driver-to-map-backup-archives-into.patch b/debian/patches/pve/0029-PVE-Add-PBS-block-driver-to-map-backup-archives-into.patch
index 1af35e10b7..0dbc77f807 100644
--- a/debian/patches/pve/0029-PVE-Add-PBS-block-driver-to-map-backup-archives-into.patch
+++ b/debian/patches/pve/0029-PVE-Add-PBS-block-driver-to-map-backup-archives-into.patch
@@ -361,10 +361,10 @@ index 91de400570..b1cbaa100e 100644
summary_info += {'libdaxctl support': libdaxctl}
summary_info += {'libcbor support': libcbor}
diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 2a0cc0fd2a..d3349661ba 100644
+index e66c455f6e..ca18144902 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
-@@ -3613,6 +3613,7 @@
+@@ -3615,6 +3615,7 @@
'parallels', 'preallocate', 'qcow', 'qcow2', 'qed', 'quorum',
'raw', 'rbd',
{ 'name': 'replication', 'if': 'CONFIG_REPLICATION' },
@@ -372,7 +372,7 @@ index 2a0cc0fd2a..d3349661ba 100644
'ssh', 'throttle', 'vdi', 'vhdx',
{ 'name': 'virtio-blk-vfio-pci', 'if': 'CONFIG_BLKIO' },
{ 'name': 'virtio-blk-vhost-user', 'if': 'CONFIG_BLKIO' },
-@@ -3699,6 +3700,33 @@
+@@ -3701,6 +3702,33 @@
{ 'struct': 'BlockdevOptionsNull',
'data': { '*size': 'int', '*latency-ns': 'uint64', '*read-zeroes': 'bool' } }
@@ -406,7 +406,7 @@ index 2a0cc0fd2a..d3349661ba 100644
##
# @BlockdevOptionsNVMe:
#
-@@ -5122,6 +5150,7 @@
+@@ -5124,6 +5152,7 @@
'nfs': 'BlockdevOptionsNfs',
'null-aio': 'BlockdevOptionsNull',
'null-co': 'BlockdevOptionsNull',
diff --git a/debian/patches/pve/0031-PVE-Migrate-dirty-bitmap-state-via-savevm.patch b/debian/patches/pve/0031-PVE-Migrate-dirty-bitmap-state-via-savevm.patch
index 407c9a7e2e..f14c756faa 100644
--- a/debian/patches/pve/0031-PVE-Migrate-dirty-bitmap-state-via-savevm.patch
+++ b/debian/patches/pve/0031-PVE-Migrate-dirty-bitmap-state-via-savevm.patch
@@ -200,7 +200,7 @@ index 177fb851b4..7575abab7c 100644
ret->pbs_masterkey = true;
ret->backup_max_workers = true;
diff --git a/qapi/block-core.json b/qapi/block-core.json
-index d3349661ba..5965a3c1f3 100644
+index ca18144902..91efb9922e 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -1112,6 +1112,11 @@
diff --git a/debian/patches/pve/0032-migration-block-dirty-bitmap-migrate-other-bitmaps-e.patch b/debian/patches/pve/0032-migration-block-dirty-bitmap-migrate-other-bitmaps-e.patch
index d331b20701..837568d3f3 100644
--- a/debian/patches/pve/0032-migration-block-dirty-bitmap-migrate-other-bitmaps-e.patch
+++ b/debian/patches/pve/0032-migration-block-dirty-bitmap-migrate-other-bitmaps-e.patch
@@ -19,10 +19,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/migration/block-dirty-bitmap.c b/migration/block-dirty-bitmap.c
-index cba54e25cd..23eb5f40b3 100644
+index 35623379eb..fb41949fe5 100644
--- a/migration/block-dirty-bitmap.c
+++ b/migration/block-dirty-bitmap.c
-@@ -539,7 +539,11 @@ static int add_bitmaps_to_list(DBMSaveState *s, BlockDriverState *bs,
+@@ -540,7 +540,11 @@ static int add_bitmaps_to_list(DBMSaveState *s, BlockDriverState *bs,
}
if (bdrv_dirty_bitmap_check(bitmap, BDRV_BITMAP_DEFAULT, errp)) {
diff --git a/debian/patches/pve/0035-block-add-alloc-track-driver.patch b/debian/patches/pve/0035-block-add-alloc-track-driver.patch
index 1f566747f8..b54317dd3e 100644
--- a/debian/patches/pve/0035-block-add-alloc-track-driver.patch
+++ b/debian/patches/pve/0035-block-add-alloc-track-driver.patch
@@ -449,10 +449,10 @@ index d023753091..a777c8079c 100644
out:
diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 5965a3c1f3..5a9ab23d5d 100644
+index 91efb9922e..80ffcc0547 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
-@@ -3606,7 +3606,8 @@
+@@ -3608,7 +3608,8 @@
# Since: 2.9
##
{ 'enum': 'BlockdevDriver',
@@ -462,7 +462,7 @@ index 5965a3c1f3..5a9ab23d5d 100644
'cloop', 'compress', 'copy-before-write', 'copy-on-read', 'dmg',
'file', 'snapshot-access', 'ftp', 'ftps',
{'name': 'host_cdrom', 'if': 'HAVE_HOST_BLOCK_DEVICE' },
-@@ -3706,6 +3707,21 @@
+@@ -3708,6 +3709,21 @@
{ 'struct': 'BlockdevOptionsNull',
'data': { '*size': 'int', '*latency-ns': 'uint64', '*read-zeroes': 'bool' } }
@@ -484,7 +484,7 @@ index 5965a3c1f3..5a9ab23d5d 100644
##
# @BlockdevOptionsPbs:
#
-@@ -5129,6 +5145,7 @@
+@@ -5131,6 +5147,7 @@
'*detect-zeroes': 'BlockdevDetectZeroesOptions' },
'discriminator': 'driver',
'data': {
diff --git a/debian/patches/pve/0036-PVE-backup-add-fleecing-option.patch b/debian/patches/pve/0036-PVE-backup-add-fleecing-option.patch
index 0368018156..dbcf3bb65f 100644
--- a/debian/patches/pve/0036-PVE-backup-add-fleecing-option.patch
+++ b/debian/patches/pve/0036-PVE-backup-add-fleecing-option.patch
@@ -429,7 +429,7 @@ index 7575abab7c..8b83465ebd 100644
return ret;
}
diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 5a9ab23d5d..2dd422aa03 100644
+index 80ffcc0547..62d7fb4e7a 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -1054,6 +1054,10 @@
diff --git a/debian/patches/pve/0042-PVE-backup-implement-backup-access-setup-and-teardow.patch b/debian/patches/pve/0042-PVE-backup-implement-backup-access-setup-and-teardow.patch
index f74e82017a..ddd7b1ca3e 100644
--- a/debian/patches/pve/0042-PVE-backup-implement-backup-access-setup-and-teardow.patch
+++ b/debian/patches/pve/0042-PVE-backup-implement-backup-access-setup-and-teardow.patch
@@ -740,7 +740,7 @@ index 0000000000..9ebeef7c8f
+
+#endif /* PVE_BACKUP_H */
diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 2dd422aa03..7ef1dd337c 100644
+index 62d7fb4e7a..5e50776664 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -1128,6 +1128,9 @@
@@ -879,10 +879,10 @@ index 2dd422aa03..7ef1dd337c 100644
# @BlockDeviceTimedStats:
#
diff --git a/system/runstate.c b/system/runstate.c
-index 08acf801b0..22306e66bf 100644
+index 3c8693ccf3..b917da82e9 100644
--- a/system/runstate.c
+++ b/system/runstate.c
-@@ -64,6 +64,7 @@
+@@ -65,6 +65,7 @@
#include "ui/console.h"
#include "trace.h"
@@ -890,7 +890,7 @@ index 08acf801b0..22306e66bf 100644
static NotifierList exit_notifiers =
NOTIFIER_LIST_INITIALIZER(exit_notifiers);
-@@ -1036,6 +1037,11 @@ void qemu_cleanup(int status)
+@@ -1014,6 +1015,11 @@ void qemu_cleanup(int status)
* requests happening from here on anyway.
*/
bdrv_drain_all_begin();
diff --git a/debian/patches/series b/debian/patches/series
index a13019354d..3140ed6230 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,14 +1,7 @@
extra/0001-monitor-qmp-fix-race-with-clients-disconnecting-earl.patch
extra/0002-fdmon-io_uring-avoid-idle-event-loop-being-accounted.patch
extra/0003-block-vmdk-tolerate-known-seSparse-reserved1-bit.patch
-extra/0004-hw-display-qxl-validate-primary-surface-stride-again.patch
-extra/0005-hw-scsi-lsi53c895a-gracefully-handle-re-entrant-DMA.patch
-extra/0006-hw-display-vga-fix-text-mode-OOB-write-after-a-graph.patch
-extra/0007-scsi-disk-fix-out-of-bound-read-in-WRITE-SAME.patch
-extra/0008-scsi-hide-MODE-SELECT-block-size-change-behind-a-qui.patch
-extra/0009-vapic-confine-the-VAPIC-region-to-0xc0000.0xe0000.patch
-extra/0010-i386-vapic-unref-MemoryRegion-if-vapic_map_rom_writa.patch
-extra/0011-io-channel-socket-do-not-treat-a-zero-length-write-a.patch
+extra/0004-hw-scsi-lsi53c895a-gracefully-handle-re-entrant-DMA.patch
bitmap-mirror/0001-drive-mirror-add-support-for-sync-bitmap-mode-never.patch
bitmap-mirror/0002-drive-mirror-add-support-for-conditional-and-always-.patch
bitmap-mirror/0003-mirror-add-check-for-bitmap-mode-without-bitmap.patch
diff --git a/qemu b/qemu
index c3d48b7d1e..005c61c0ef 160000
--- a/qemu
+++ b/qemu
@@ -1 +1 @@
-Subproject commit c3d48b7d1e89604920e5b81b91140c2ad39a1943
+Subproject commit 005c61c0ef6f6ae615283440b4bb7be51b2c6ddd
--
2.47.3
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH qemu v3 2/2] fix crash when querying VirtIO information via QMP/HMP
2026-10-28 15:08 [PATCH-SERIES qemu v3 0/2] stable fixes for QEMU 11.1 Fiona Ebner
2026-10-28 15:08 ` [PATCH qemu v3 1/2] update submodule and patches to QEMU 11.1.3 Fiona Ebner
@ 2026-10-28 15:08 ` Fiona Ebner
2026-10-28 15:38 ` applied: [PATCH-SERIES qemu v3 0/2] stable fixes for QEMU 11.1 Thomas Lamprecht
2 siblings, 0 replies; 4+ messages in thread
From: Fiona Ebner @ 2026-10-28 15:08 UTC (permalink / raw)
To: pve-devel
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---
Changes in v3:
* Use 11.1.3 as a base. Almost all changes from this patch in its v2
version are now already included there.
...ore-backend-features-in-x-query-virt.patch | 41 ++++++++++
...dle-missing-vhost-user-protocol-feat.patch | 74 +++++++++++++++++++
debian/patches/series | 2 +
3 files changed, 117 insertions(+)
create mode 100644 debian/patches/extra/0005-qapi-virtio-Restore-backend-features-in-x-query-virt.patch
create mode 100644 debian/patches/extra/0006-qapi-monitor-Handle-missing-vhost-user-protocol-feat.patch
diff --git a/debian/patches/extra/0005-qapi-virtio-Restore-backend-features-in-x-query-virt.patch b/debian/patches/extra/0005-qapi-virtio-Restore-backend-features-in-x-query-virt.patch
new file mode 100644
index 0000000000..cbee94c9fc
--- /dev/null
+++ b/debian/patches/extra/0005-qapi-virtio-Restore-backend-features-in-x-query-virt.patch
@@ -0,0 +1,41 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
+Date: Wed, 23 Sep 2026 00:32:09 +0300
+Subject: [PATCH] qapi/virtio: Restore backend features in
+ x-query-virtio-status
+
+Commit 1ee0bc0c9bf0 removed vhost_dev.backend_features and its
+representation in VhostStatus. It also removed the assignment to
+VirtioStatus.backend_features, although both that field and its source,
+VirtIODevice.backend_features_ex, still exist.
+
+The resulting NULL pointer causes HMP info virtio-status and QMP
+x-query-virtio-status to crash. This affects virtio devices even without
+an active vhost backend.
+
+Restore the assignment from VirtIODevice.backend_features_ex and
+enable corresponding test, which becomes fixed.
+
+Fixes: 1ee0bc0c9bf0 ("vhost: drop backend_features field")
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
+Link: https://lore.kernel.org/qemu-devel/20260922213210.1429435-3-vsementsov@yandex-team.ru
+(pick from qemu-devel)
+[FE: drop test that would require multiple prerequisite cherry-picks]
+Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
+---
+ hw/virtio/virtio-qmp.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/hw/virtio/virtio-qmp.c b/hw/virtio/virtio-qmp.c
+index 57cc03828c..36907180f7 100644
+--- a/hw/virtio/virtio-qmp.c
++++ b/hw/virtio/virtio-qmp.c
+@@ -713,6 +713,8 @@ VirtioStatus *qmp_x_query_virtio_status(const char *path, Error **errp)
+ vdev->guest_features_ex);
+ status->host_features = qmp_decode_features(vdev->device_id,
+ vdev->host_features_ex);
++ status->backend_features = qmp_decode_features(vdev->device_id,
++ vdev->backend_features_ex);
+
+ switch (vdev->device_endian) {
+ case VIRTIO_DEVICE_ENDIAN_LITTLE:
diff --git a/debian/patches/extra/0006-qapi-monitor-Handle-missing-vhost-user-protocol-feat.patch b/debian/patches/extra/0006-qapi-monitor-Handle-missing-vhost-user-protocol-feat.patch
new file mode 100644
index 0000000000..ce3c49cce0
--- /dev/null
+++ b/debian/patches/extra/0006-qapi-monitor-Handle-missing-vhost-user-protocol-feat.patch
@@ -0,0 +1,74 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
+Date: Wed, 23 Sep 2026 00:32:10 +0300
+Subject: [PATCH] qapi/monitor: Handle missing vhost-user protocol features
+
+Commit f9a8f5812607 moved protocol_features to the vhost-user backend.
+As a result, VhostStatus.protocol_features is only populated for
+vhost-user devices.
+
+For an active kernel vhost device, HMP info virtio-status and QMP
+x-query-virtio-status crashes now because of unset protocol-features.
+
+Make protocol-features optional in VhostStatus and skip dumping a
+missing object in HMP.
+
+For QMP we can change the x-query-virtio-status command semantics
+because it is unstable.
+
+Enable corresponding test, it works now.
+
+Fixes: f9a8f5812607 ("vhost: move protocol_features to vhost_user")
+Co-authored-by: Nikolay Kuratov <kniv@yandex-team.ru>
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
+Reviewed-by: Markus Armbruster <armbru@redhat.com>
+Link: https://lore.kernel.org/qemu-devel/20260922213210.1429435-4-vsementsov@yandex-team.ru
+(pick from qemu-devel)
+[FE: backport adapting to missing monitor_hmp_printf refactor
+ drop test would require multiple prerequisite cherry-picks]
+Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
+---
+ hw/virtio/virtio-hmp-cmds.c | 6 ++++--
+ qapi/virtio.json | 5 +++--
+ 2 files changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/hw/virtio/virtio-hmp-cmds.c b/hw/virtio/virtio-hmp-cmds.c
+index a91bb7dbed..c4adb6eb7b 100644
+--- a/hw/virtio/virtio-hmp-cmds.c
++++ b/hw/virtio/virtio-hmp-cmds.c
+@@ -176,8 +176,10 @@ void hmp_virtio_status(Monitor *mon, const QDict *qdict)
+ hmp_virtio_dump_features(mon, s->vhost_dev->features);
+ monitor_printf(mon, " Acked features:\n");
+ hmp_virtio_dump_features(mon, s->vhost_dev->acked_features);
+- monitor_printf(mon, " Protocol features:\n");
+- hmp_virtio_dump_protocols(mon, s->vhost_dev->protocol_features);
++ if (s->vhost_dev->protocol_features) {
++ monitor_printf(mon, " Protocol features:\n");
++ hmp_virtio_dump_protocols(mon, s->vhost_dev->protocol_features);
++ }
+ }
+
+ qapi_free_VirtioStatus(s);
+diff --git a/qapi/virtio.json b/qapi/virtio.json
+index 1fc4e38a44..f8e699a0e4 100644
+--- a/qapi/virtio.json
++++ b/qapi/virtio.json
+@@ -85,7 +85,8 @@
+ #
+ # @acked-features: vhost_dev acked_features
+ #
+-# @protocol-features: vhost_dev protocol_features
++# @protocol-features: vhost-user protocol features. Present only for
++# vhost-user devices.
+ #
+ # @max-queues: vhost_dev max_queues
+ #
+@@ -104,7 +105,7 @@
+ 'vq-index': 'int',
+ 'features': 'VirtioDeviceFeatures',
+ 'acked-features': 'VirtioDeviceFeatures',
+- 'protocol-features': 'VhostDeviceProtocols',
++ '*protocol-features': 'VhostDeviceProtocols',
+ 'max-queues': 'uint64',
+ 'backend-cap': 'uint64',
+ 'log-enabled': 'bool',
diff --git a/debian/patches/series b/debian/patches/series
index 3140ed6230..1828cca017 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -2,6 +2,8 @@ extra/0001-monitor-qmp-fix-race-with-clients-disconnecting-earl.patch
extra/0002-fdmon-io_uring-avoid-idle-event-loop-being-accounted.patch
extra/0003-block-vmdk-tolerate-known-seSparse-reserved1-bit.patch
extra/0004-hw-scsi-lsi53c895a-gracefully-handle-re-entrant-DMA.patch
+extra/0005-qapi-virtio-Restore-backend-features-in-x-query-virt.patch
+extra/0006-qapi-monitor-Handle-missing-vhost-user-protocol-feat.patch
bitmap-mirror/0001-drive-mirror-add-support-for-sync-bitmap-mode-never.patch
bitmap-mirror/0002-drive-mirror-add-support-for-conditional-and-always-.patch
bitmap-mirror/0003-mirror-add-check-for-bitmap-mode-without-bitmap.patch
--
2.47.3
^ permalink raw reply related [flat|nested] 4+ messages in thread
* applied: [PATCH-SERIES qemu v3 0/2] stable fixes for QEMU 11.1
2026-10-28 15:08 [PATCH-SERIES qemu v3 0/2] stable fixes for QEMU 11.1 Fiona Ebner
2026-10-28 15:08 ` [PATCH qemu v3 1/2] update submodule and patches to QEMU 11.1.3 Fiona Ebner
2026-10-28 15:08 ` [PATCH qemu v3 2/2] fix crash when querying VirtIO information via QMP/HMP Fiona Ebner
@ 2026-10-28 15:38 ` Thomas Lamprecht
2 siblings, 0 replies; 4+ messages in thread
From: Thomas Lamprecht @ 2026-10-28 15:38 UTC (permalink / raw)
To: pve-devel, Fiona Ebner
On Wed, 28 Oct 2026 16:08:17 +0100, Fiona Ebner wrote:
> Changes in v3:
> * Use 11.1.3 as a base. Almost all changes in v2's 2/2 are now already
> included there.
>
> Changes in v2:
> * Pick up fix for crash when querying info for VirtIO via QMP/HMP.
> * Pick up hardendings for KVM and a fix for TDX.
>
> [...]
Applied, thanks!
[1/2] update submodule and patches to QEMU 11.1.3
commit: ff67e09ac51aef3688c5c2651212cc1b0be37045
[2/2] fix crash when querying VirtIO information via QMP/HMP
commit: d6e6b4fd7c9c5a0a4fb54def7919ad5a015fb8a1
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-10-28 15:39 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-28 15:08 [PATCH-SERIES qemu v3 0/2] stable fixes for QEMU 11.1 Fiona Ebner
2026-10-28 15:08 ` [PATCH qemu v3 1/2] update submodule and patches to QEMU 11.1.3 Fiona Ebner
2026-10-28 15:08 ` [PATCH qemu v3 2/2] fix crash when querying VirtIO information via QMP/HMP Fiona Ebner
2026-10-28 15:38 ` applied: [PATCH-SERIES qemu v3 0/2] stable fixes for QEMU 11.1 Thomas Lamprecht
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox