public inbox for pve-devel@lists.proxmox.com
 help / color / mirror / Atom feed
From: Fiona Ebner <f.ebner@proxmox.com>
To: pve-devel@lists.proxmox.com
Subject: [PATCH qemu 1/2] update submodule and patches to QEMU 10.2.1
Date: Thu, 12 Mar 2026 12:44:02 +0100	[thread overview]
Message-ID: <20260312114417.82984-2-f.ebner@proxmox.com> (raw)
In-Reply-To: <20260312114417.82984-1-f.ebner@proxmox.com>

Notable changes:

The io_uring handling was rewritten, so patch "block/io_uring: avoid
potentially getting stuck after resubmit at the end of ioq_submit()"
is not required anymore.

savevm-async needed to adapt to commit 9535435795 ("migration: push
Error **errp into qemu_loadvm_state()").

QAPI docs enforce strict formatting now, requiring quite a few
adaptations.

Add the cortex-a78ae CPU model for ARM.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---
 debian/cpu-models-aarch64.json                |   1 +
 ...d-support-for-sync-bitmap-mode-never.patch |  38 +--
 ...check-for-bitmap-mode-without-bitmap.patch |   4 +-
 .../0006-mirror-move-some-checks-to-qmp.patch |   4 +-
 ...race-with-clients-disconnecting-earl.patch |   4 +-
 ...ial-deadlock-when-draining-during-tr.patch |   2 +-
 ...k-range-when-setting-zero-bitmap-fo.patch} |   0
 .../extra/0003-tcg-arm-Fix-tgen_deposit.patch |  37 ---
 ...-to-bounce-buffer-if-BLKZEROOUT-is-.patch} |   2 +-
 ...quirks-when-IGD-is-not-the-primary-d.patch |  79 ------
 ...adlock-upon-TMF-request-cancelling-w.patch |  83 ------
 ...-rename-field-to-num_initial_regions.patch | 245 ------------------
 ...region-info-cache-for-initial-region.patch |  75 ------
 ...vdagent-fix-windows-agent-regression.patch | 105 --------
 ...six-populate-pwrite_zeroes_alignment.patch |  49 ----
 ..._zeroes_alignment-when-writing-first.patch |  86 ------
 ...void-potentially-getting-stuck-after.patch | 153 -----------
 ...k-file-change-locking-default-to-off.patch |   2 +-
 ...djust-network-script-path-to-etc-kvm.patch |   4 +-
 ...he-CPU-model-to-kvm64-32-instead-of-.patch |   4 +-
 ...ui-spice-default-to-pve-certificates.patch |   4 +-
 ...erfs-no-default-logfile-if-daemonize.patch |   6 +-
 ...lock-rbd-disable-rbd_cache_writethro.patch |   4 +-
 ...PVE-Up-glusterfs-allow-partial-reads.patch |  28 +-
 ...return-success-on-info-without-snaps.patch |   8 +-
 ...dd-add-osize-and-read-from-to-stdin-.patch |  14 +-
 ...E-Up-qemu-img-dd-add-isize-parameter.patch |  14 +-
 ...PVE-Up-qemu-img-dd-add-n-skip_create.patch |  18 +-
 ...-add-l-option-for-loading-a-snapshot.patch |  18 +-
 ...virtio-balloon-improve-query-balloon.patch |  10 +-
 .../0014-PVE-qapi-modify-query-machines.patch |   6 +-
 .../0015-PVE-qapi-modify-spice-query.patch    |   6 +-
 ...nnel-implementation-for-savevm-async.patch |   4 +-
 ...async-for-background-state-snapshots.patch |  61 +++--
 ...add-optional-buffer-size-to-QEMUFile.patch |  30 +--
 ...add-the-zeroinit-block-driver-filter.patch |   6 +-
 ...-Add-dummy-id-command-line-parameter.patch |  10 +-
 ...t-target-i386-disable-LINT0-after-re.patch |   8 +-
 ...le-posix-make-locking-optiono-on-cre.patch |  20 +-
 ...3-PVE-monitor-disable-oob-capability.patch |   2 +-
 ...sed-balloon-qemu-4-0-config-size-fal.patch |   4 +-
 ...E-Allow-version-code-in-machine-type.patch |  24 +-
 ...VE-Backup-add-vma-backup-format-code.patch |   6 +-
 ...-Backup-add-backup-dump-block-driver.patch |   2 +-
 ...ckup-Proxmox-backup-patches-for-QEMU.patch | 115 ++++----
 ...estore-new-command-to-restore-from-p.patch |   4 +-
 ...k-driver-to-map-backup-archives-into.patch |  12 +-
 ...ct-stderr-to-journal-when-daemonized.patch |   6 +-
 ...igrate-dirty-bitmap-state-via-savevm.patch |  36 +--
 ...all-back-to-open-iscsi-initiatorname.patch |   4 +-
 .../0038-block-add-alloc-track-driver.patch   |   8 +-
 .../0039-PVE-backup-add-fleecing-option.patch |  30 +--
 ...e-version-deprecation-for-Proxmox-VE.patch |  10 +-
 ...ment-backup-access-setup-and-teardow.patch |  76 +++---
 ...se-migration-blocker-check-for-snaps.patch |  18 +-
 debian/patches/series                         |  13 +-
 qemu                                          |   2 +-
 57 files changed, 364 insertions(+), 1260 deletions(-)
 rename debian/patches/extra/{0012-block-mirror-check-range-when-setting-zero-bitmap-fo.patch => 0003-block-mirror-check-range-when-setting-zero-bitmap-fo.patch} (100%)
 delete mode 100644 debian/patches/extra/0003-tcg-arm-Fix-tgen_deposit.patch
 rename debian/patches/extra/{0013-block-io-fallback-to-bounce-buffer-if-BLKZEROOUT-is-.patch => 0004-block-io-fallback-to-bounce-buffer-if-BLKZEROOUT-is-.patch} (97%)
 delete mode 100644 debian/patches/extra/0004-vfio-igd-Enable-quirks-when-IGD-is-not-the-primary-d.patch
 delete mode 100644 debian/patches/extra/0005-hw-scsi-avoid-deadlock-upon-TMF-request-cancelling-w.patch
 delete mode 100644 debian/patches/extra/0006-vfio-rename-field-to-num_initial_regions.patch
 delete mode 100644 debian/patches/extra/0007-vfio-only-check-region-info-cache-for-initial-region.patch
 delete mode 100644 debian/patches/extra/0008-ui-vdagent-fix-windows-agent-regression.patch
 delete mode 100644 debian/patches/extra/0009-file-posix-populate-pwrite_zeroes_alignment.patch
 delete mode 100644 debian/patches/extra/0010-block-use-pwrite_zeroes_alignment-when-writing-first.patch
 delete mode 100644 debian/patches/extra/0011-block-io_uring-avoid-potentially-getting-stuck-after.patch

diff --git a/debian/cpu-models-aarch64.json b/debian/cpu-models-aarch64.json
index 5f1f498..5b39073 100644
--- a/debian/cpu-models-aarch64.json
+++ b/debian/cpu-models-aarch64.json
@@ -7,6 +7,7 @@
    "cortex-a710" : "ARM",
    "cortex-a72" : "ARM",
    "cortex-a76" : "ARM",
+   "cortex-a78ae" : "ARM",
    "max" : "default",
    "neoverse-n1" : "ARM",
    "neoverse-n2" : "ARM",
diff --git a/debian/patches/bitmap-mirror/0001-drive-mirror-add-support-for-sync-bitmap-mode-never.patch b/debian/patches/bitmap-mirror/0001-drive-mirror-add-support-for-sync-bitmap-mode-never.patch
index 6e93d4f..b3906bd 100644
--- a/debian/patches/bitmap-mirror/0001-drive-mirror-add-support-for-sync-bitmap-mode-never.patch
+++ b/debian/patches/bitmap-mirror/0001-drive-mirror-add-support-for-sync-bitmap-mode-never.patch
@@ -229,10 +229,10 @@ index bc982cb99a..99805e7a9d 100644
                       base_read_only, errp);
      if (!job) {
 diff --git a/blockdev.c b/blockdev.c
-index b451fee6e1..5855e9cac2 100644
+index 6e86c6262f..b68dfef260 100644
 --- a/blockdev.c
 +++ b/blockdev.c
-@@ -2857,6 +2857,9 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
+@@ -2859,6 +2859,9 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
                                     BlockDriverState *target,
                                     const char *replaces,
                                     enum MirrorSyncMode sync,
@@ -242,7 +242,7 @@ index b451fee6e1..5855e9cac2 100644
                                     BlockMirrorBackingMode backing_mode,
                                     bool target_is_zero,
                                     bool has_speed, int64_t speed,
-@@ -2875,6 +2878,7 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
+@@ -2877,6 +2880,7 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
  {
      BlockDriverState *unfiltered_bs;
      int job_flags = JOB_DEFAULT;
@@ -250,7 +250,7 @@ index b451fee6e1..5855e9cac2 100644
  
      GLOBAL_STATE_CODE();
      GRAPH_RDLOCK_GUARD_MAINLOOP();
-@@ -2925,6 +2929,29 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
+@@ -2927,6 +2931,29 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
          return;
      }
  
@@ -280,7 +280,7 @@ index b451fee6e1..5855e9cac2 100644
      if (!replaces) {
          /* We want to mirror from @bs, but keep implicit filters on top */
          unfiltered_bs = bdrv_skip_implicit_filters(bs);
-@@ -2966,7 +2993,7 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
+@@ -2968,7 +2995,7 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
       * and will allow to check whether the node still exist at mirror completion
       */
      mirror_start(job_id, bs, target, replaces, job_flags,
@@ -289,7 +289,7 @@ index b451fee6e1..5855e9cac2 100644
                   target_is_zero, on_source_error, on_target_error, unmap,
                   filter_node_name, copy_mode, errp);
  }
-@@ -3109,6 +3136,8 @@ void qmp_drive_mirror(DriveMirror *arg, Error **errp)
+@@ -3111,6 +3138,8 @@ void qmp_drive_mirror(DriveMirror *arg, Error **errp)
  
      blockdev_mirror_common(arg->job_id, bs, target_bs,
                             arg->replaces, arg->sync,
@@ -298,7 +298,7 @@ index b451fee6e1..5855e9cac2 100644
                             backing_mode, target_is_zero,
                             arg->has_speed, arg->speed,
                             arg->has_granularity, arg->granularity,
-@@ -3128,6 +3157,8 @@ void qmp_blockdev_mirror(const char *job_id,
+@@ -3130,6 +3159,8 @@ void qmp_blockdev_mirror(const char *job_id,
                           const char *device, const char *target,
                           const char *replaces,
                           MirrorSyncMode sync,
@@ -307,7 +307,7 @@ index b451fee6e1..5855e9cac2 100644
                           bool has_speed, int64_t speed,
                           bool has_granularity, uint32_t granularity,
                           bool has_buf_size, int64_t buf_size,
-@@ -3166,7 +3197,8 @@ void qmp_blockdev_mirror(const char *job_id,
+@@ -3168,7 +3199,8 @@ void qmp_blockdev_mirror(const char *job_id,
      }
  
      blockdev_mirror_common(job_id, bs, target_bs,
@@ -333,26 +333,26 @@ index e7c8f1a856..d5aa68caeb 100644
                    BlockdevOnError on_source_error,
                    BlockdevOnError on_target_error,
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index dc6eb4ae23..7d281ab7ae 100644
+index b82af74256..64f2befdf5 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -2205,6 +2205,15 @@
+@@ -2275,6 +2275,15 @@
  #     destination (all the disk, only the sectors allocated in the
  #     topmost image, or only new I/O).
  #
-+# @bitmap: The name of a bitmap to use for sync=bitmap mode. This
++# @bitmap: The name of a bitmap to use for sync=bitmap mode.  This
 +#     argument must be present for bitmap mode and absent otherwise.
 +#     The bitmap's granularity is used instead of @granularity (Since
 +#     4.1).
 +#
 +# @bitmap-mode: Specifies the type of data the bitmap should contain
-+#     after the operation concludes. Must be present if sync is
-+#     "bitmap". Must NOT be present otherwise. (Since 4.1)
++#     after the operation concludes.  Must be present if sync is
++#     "bitmap".  Must NOT be present otherwise.  (Since 4.1)
 +#
  # @granularity: granularity of the dirty bitmap, default is 64K if the
  #     image format doesn't have clusters, 4K if the clusters are
  #     smaller than that, else the cluster size.  Must be a power of 2
-@@ -2246,7 +2255,9 @@
+@@ -2316,7 +2325,9 @@
  { 'struct': 'DriveMirror',
    'data': { '*job-id': 'str', 'device': 'str', 'target': 'str',
              '*format': 'str', '*node-name': 'str', '*replaces': 'str',
@@ -363,23 +363,23 @@ index dc6eb4ae23..7d281ab7ae 100644
              '*speed': 'int', '*granularity': 'uint32',
              '*buf-size': 'int', '*on-source-error': 'BlockdevOnError',
              '*on-target-error': 'BlockdevOnError',
-@@ -2522,6 +2533,15 @@
+@@ -2593,6 +2604,15 @@
  #     destination (all the disk, only the sectors allocated in the
  #     topmost image, or only new I/O).
  #
-+# @bitmap: The name of a bitmap to use for sync=bitmap mode. This
++# @bitmap: The name of a bitmap to use for sync=bitmap mode.  This
 +#     argument must be present for bitmap mode and absent otherwise.
 +#     The bitmap's granularity is used instead of @granularity (since
 +#     4.1).
 +#
 +# @bitmap-mode: Specifies the type of data the bitmap should contain
-+#     after the operation concludes. Must be present if sync is
-+#     "bitmap". Must NOT be present otherwise. (Since 4.1)
++#     after the operation concludes.  Must be present if sync is
++#     "bitmap".  Must NOT be present otherwise.  (Since 4.1)
 +#
  # @granularity: granularity of the dirty bitmap, default is 64K if the
  #     image format doesn't have clusters, 4K if the clusters are
  #     smaller than that, else the cluster size.  Must be a power of 2
-@@ -2574,7 +2594,8 @@
+@@ -2645,7 +2665,8 @@
  { 'command': 'blockdev-mirror',
    'data': { '*job-id': 'str', 'device': 'str', 'target': 'str',
              '*replaces': 'str',
diff --git a/debian/patches/bitmap-mirror/0003-mirror-add-check-for-bitmap-mode-without-bitmap.patch b/debian/patches/bitmap-mirror/0003-mirror-add-check-for-bitmap-mode-without-bitmap.patch
index c2d4d9e..dadb0e6 100644
--- a/debian/patches/bitmap-mirror/0003-mirror-add-check-for-bitmap-mode-without-bitmap.patch
+++ b/debian/patches/bitmap-mirror/0003-mirror-add-check-for-bitmap-mode-without-bitmap.patch
@@ -16,10 +16,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 3 insertions(+)
 
 diff --git a/blockdev.c b/blockdev.c
-index 5855e9cac2..f132b4985b 100644
+index b68dfef260..878e47a321 100644
 --- a/blockdev.c
 +++ b/blockdev.c
-@@ -2950,6 +2950,9 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
+@@ -2952,6 +2952,9 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
          if (bdrv_dirty_bitmap_check(bitmap, BDRV_BITMAP_ALLOW_RO, errp)) {
              return;
          }
diff --git a/debian/patches/bitmap-mirror/0006-mirror-move-some-checks-to-qmp.patch b/debian/patches/bitmap-mirror/0006-mirror-move-some-checks-to-qmp.patch
index 238f47b..687a256 100644
--- a/debian/patches/bitmap-mirror/0006-mirror-move-some-checks-to-qmp.patch
+++ b/debian/patches/bitmap-mirror/0006-mirror-move-some-checks-to-qmp.patch
@@ -62,10 +62,10 @@ index 0f96c8b5ce..5340a695b1 100644
  
          if (bitmap_mode != BITMAP_SYNC_MODE_NEVER) {
 diff --git a/blockdev.c b/blockdev.c
-index f132b4985b..782cc5dd75 100644
+index 878e47a321..d9575c8367 100644
 --- a/blockdev.c
 +++ b/blockdev.c
-@@ -2929,7 +2929,36 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
+@@ -2931,7 +2931,36 @@ static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
          return;
      }
  
diff --git a/debian/patches/extra/0001-monitor-qmp-fix-race-with-clients-disconnecting-earl.patch b/debian/patches/extra/0001-monitor-qmp-fix-race-with-clients-disconnecting-earl.patch
index 1029ef5..1ac5cb6 100644
--- a/debian/patches/extra/0001-monitor-qmp-fix-race-with-clients-disconnecting-earl.patch
+++ b/debian/patches/extra/0001-monitor-qmp-fix-race-with-clients-disconnecting-earl.patch
@@ -60,7 +60,7 @@ index c3740ec616..7f38ce6b8b 100644
  void monitor_init_globals(void);
  void monitor_init_globals_core(void);
 diff --git a/monitor/monitor-internal.h b/monitor/monitor-internal.h
-index 5676eb334e..4c452a6aeb 100644
+index 7735c73108..43ac8c87be 100644
 --- a/monitor/monitor-internal.h
 +++ b/monitor/monitor-internal.h
 @@ -151,6 +151,13 @@ typedef struct {
@@ -104,7 +104,7 @@ index c5a5d30877..07775784d4 100644
   * Is @mon is using readline?
   * Note: not all HMP monitors use readline, e.g., gdbserver has a
 diff --git a/monitor/qmp.c b/monitor/qmp.c
-index cb99a12d94..170fef4531 100644
+index 7ae070dc8d..16c20305d2 100644
 --- a/monitor/qmp.c
 +++ b/monitor/qmp.c
 @@ -165,6 +165,8 @@ static void monitor_qmp_dispatch(MonitorQMP *mon, QObject *req)
diff --git a/debian/patches/extra/0002-ide-avoid-potential-deadlock-when-draining-during-tr.patch b/debian/patches/extra/0002-ide-avoid-potential-deadlock-when-draining-during-tr.patch
index aca8620..b068179 100644
--- a/debian/patches/extra/0002-ide-avoid-potential-deadlock-when-draining-during-tr.patch
+++ b/debian/patches/extra/0002-ide-avoid-potential-deadlock-when-draining-during-tr.patch
@@ -55,7 +55,7 @@ Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
  1 file changed, 6 insertions(+), 6 deletions(-)
 
 diff --git a/hw/ide/core.c b/hw/ide/core.c
-index b14983ec54..41c543e627 100644
+index 8c380abf7c..054d80cce8 100644
 --- a/hw/ide/core.c
 +++ b/hw/ide/core.c
 @@ -456,7 +456,7 @@ static void ide_trim_bh_cb(void *opaque)
diff --git a/debian/patches/extra/0012-block-mirror-check-range-when-setting-zero-bitmap-fo.patch b/debian/patches/extra/0003-block-mirror-check-range-when-setting-zero-bitmap-fo.patch
similarity index 100%
rename from debian/patches/extra/0012-block-mirror-check-range-when-setting-zero-bitmap-fo.patch
rename to debian/patches/extra/0003-block-mirror-check-range-when-setting-zero-bitmap-fo.patch
diff --git a/debian/patches/extra/0003-tcg-arm-Fix-tgen_deposit.patch b/debian/patches/extra/0003-tcg-arm-Fix-tgen_deposit.patch
deleted file mode 100644
index ca01088..0000000
--- a/debian/patches/extra/0003-tcg-arm-Fix-tgen_deposit.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Richard Henderson <richard.henderson@linaro.org>
-Date: Fri, 29 Aug 2025 13:49:06 +0000
-Subject: [PATCH] tcg/arm: Fix tgen_deposit
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-When converting from tcg_out_deposit, the arguments were not
-shuffled properly.
-
-Cc: qemu-stable@nongnu.org
-Fixes: cf4905c03135f1181e8 ("tcg: Convert deposit to TCGOutOpDeposit")
-Reported-by: Michael Tokarev <mjt@tls.msk.ru>
-Tested-by: Michael Tokarev <mjt@tls.msk.ru>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-(cherry picked from commit 27ea28a0b369b4b14a485a5d6f045e0dc1db4e38)
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- tcg/arm/tcg-target.c.inc | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
-index 836894b16a..338c57b061 100644
---- a/tcg/arm/tcg-target.c.inc
-+++ b/tcg/arm/tcg-target.c.inc
-@@ -975,7 +975,8 @@ static void tgen_deposit(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,
-                          TCGReg a2, unsigned ofs, unsigned len)
- {
-     /* bfi/bfc */
--    tcg_out32(s, 0x07c00010 | (COND_AL << 28) | (a0 << 12) | a1
-+    tcg_debug_assert(a0 == a1);
-+    tcg_out32(s, 0x07c00010 | (COND_AL << 28) | (a0 << 12) | a2
-               | (ofs << 7) | ((ofs + len - 1) << 16));
- }
- 
diff --git a/debian/patches/extra/0013-block-io-fallback-to-bounce-buffer-if-BLKZEROOUT-is-.patch b/debian/patches/extra/0004-block-io-fallback-to-bounce-buffer-if-BLKZEROOUT-is-.patch
similarity index 97%
rename from debian/patches/extra/0013-block-io-fallback-to-bounce-buffer-if-BLKZEROOUT-is-.patch
rename to debian/patches/extra/0004-block-io-fallback-to-bounce-buffer-if-BLKZEROOUT-is-.patch
index f71f5d2..d9a50a8 100644
--- a/debian/patches/extra/0013-block-io-fallback-to-bounce-buffer-if-BLKZEROOUT-is-.patch
+++ b/debian/patches/extra/0004-block-io-fallback-to-bounce-buffer-if-BLKZEROOUT-is-.patch
@@ -21,7 +21,7 @@ Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/block/io.c b/block/io.c
-index 9bd8ba8431..7b1ad0996a 100644
+index c4a4301321..1865f226d5 100644
 --- a/block/io.c
 +++ b/block/io.c
 @@ -1917,7 +1917,8 @@ bdrv_co_do_pwrite_zeroes(BlockDriverState *bs, int64_t offset, int64_t bytes,
diff --git a/debian/patches/extra/0004-vfio-igd-Enable-quirks-when-IGD-is-not-the-primary-d.patch b/debian/patches/extra/0004-vfio-igd-Enable-quirks-when-IGD-is-not-the-primary-d.patch
deleted file mode 100644
index 98f5e9b..0000000
--- a/debian/patches/extra/0004-vfio-igd-Enable-quirks-when-IGD-is-not-the-primary-d.patch
+++ /dev/null
@@ -1,79 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Tomita Moeko <tomitamoeko@gmail.com>
-Date: Thu, 14 Aug 2025 00:05:10 +0800
-Subject: [PATCH] vfio/igd: Enable quirks when IGD is not the primary display
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Since linux 6.15, commit 41112160ca87 ("vfio/pci: match IGD devices in
-display controller class"), IGD related regions are also exposed when
-IGD is not primary display (device class is Display controller).
-
-Allow IGD quirks to be enabled in this configuration so that guests can
-have display output on IGD when it is not the primary display.
-
-Signed-off-by: Tomita Moeko <tomitamoeko@gmail.com>
-Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
-Link: https://lore.kernel.org/qemu-devel/20250813160510.23553-1-tomitamoeko@gmail.com
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 432ca3dfa3d57a7bf1e427576fcfca4ab0079a50)
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- hw/vfio/igd.c | 7 ++++---
- hw/vfio/pci.h | 5 +++++
- 2 files changed, 9 insertions(+), 3 deletions(-)
-
-diff --git a/hw/vfio/igd.c b/hw/vfio/igd.c
-index ee0767b0b8..f116c40ccd 100644
---- a/hw/vfio/igd.c
-+++ b/hw/vfio/igd.c
-@@ -460,7 +460,7 @@ void vfio_probe_igd_bar0_quirk(VFIOPCIDevice *vdev, int nr)
-     int gen;
- 
-     if (!vfio_pci_is(vdev, PCI_VENDOR_ID_INTEL, PCI_ANY_ID) ||
--        !vfio_is_vga(vdev) || nr != 0) {
-+        !vfio_is_base_display(vdev) || nr != 0) {
-         return;
-     }
- 
-@@ -518,7 +518,7 @@ static bool vfio_pci_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
-     Error *err = NULL;
- 
-     if (!vfio_pci_is(vdev, PCI_VENDOR_ID_INTEL, PCI_ANY_ID) ||
--        !vfio_is_vga(vdev)) {
-+        !vfio_is_base_display(vdev)) {
-         return true;
-     }
- 
-@@ -534,12 +534,13 @@ static bool vfio_pci_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
-     /*
-      * For backward compatibility, enable legacy mode when
-      * - Device geneation is 6 to 9 (including both)
--     * - IGD claims VGA cycles on host
-+     * - IGD exposes itself as VGA controller and claims VGA cycles on host
-      * - Machine type is i440fx (pc_piix)
-      * - IGD device is at guest BDF 00:02.0
-      * - Not manually disabled by x-igd-legacy-mode=off
-      */
-     if ((vdev->igd_legacy_mode != ON_OFF_AUTO_OFF) &&
-+        vfio_is_vga(vdev) &&
-         (gen >= 6 && gen <= 9) &&
-         !(gmch & IGD_GMCH_VGA_DISABLE) &&
-         !strcmp(MACHINE_GET_CLASS(qdev_get_machine())->family, "pc_piix") &&
-diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
-index 810a842f4a..923cf9c2f7 100644
---- a/hw/vfio/pci.h
-+++ b/hw/vfio/pci.h
-@@ -203,6 +203,11 @@ static inline bool vfio_is_vga(VFIOPCIDevice *vdev)
-     return (vdev->class_code >> 8) == PCI_CLASS_DISPLAY_VGA;
- }
- 
-+static inline bool vfio_is_base_display(VFIOPCIDevice *vdev)
-+{
-+    return (vdev->class_code >> 16) == PCI_BASE_CLASS_DISPLAY;
-+}
-+
- /* MSI/MSI-X/INTx */
- void vfio_pci_vector_init(VFIOPCIDevice *vdev, int nr);
- void vfio_pci_add_kvm_msi_virq(VFIOPCIDevice *vdev, VFIOMSIVector *vector,
diff --git a/debian/patches/extra/0005-hw-scsi-avoid-deadlock-upon-TMF-request-cancelling-w.patch b/debian/patches/extra/0005-hw-scsi-avoid-deadlock-upon-TMF-request-cancelling-w.patch
deleted file mode 100644
index 4c7441e..0000000
--- a/debian/patches/extra/0005-hw-scsi-avoid-deadlock-upon-TMF-request-cancelling-w.patch
+++ /dev/null
@@ -1,83 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Fiona Ebner <f.ebner@proxmox.com>
-Date: Fri, 17 Oct 2025 11:43:30 +0200
-Subject: [PATCH] hw/scsi: avoid deadlock upon TMF request cancelling with
- VirtIO
-
-When scsi_req_dequeue() is reached via
-scsi_req_cancel_async()
-virtio_scsi_tmf_cancel_req()
-virtio_scsi_do_tmf_aio_context(),
-there is a deadlock when trying to acquire the SCSI device's requests
-lock, because it was already acquired in
-virtio_scsi_do_tmf_aio_context().
-
-In particular, the issue happens with a FreeBSD guest (13, 14, 15,
-maybe more), when it cancels SCSI requests, because of timeout.
-
-This is a regression caused by commit da6eebb33b ("virtio-scsi:
-perform TMFs in appropriate AioContexts") and the introduction of the
-requests_lock earlier.
-
-To fix the issue, only cancel the requests after releasing the
-requests_lock. For this, the SCSI device's requests are iterated while
-holding the requests_lock and the requests to be cancelled are
-collected in a list. Then, the collected requests are cancelled
-one by one while not holding the requests_lock. This is safe, because
-only requests from the current AioContext are collected and acted
-upon.
-
-Originally reported by Proxmox VE users:
-https://bugzilla.proxmox.com/show_bug.cgi?id=6810
-https://forum.proxmox.com/threads/173914/
-
-Fixes: da6eebb33b ("virtio-scsi: perform TMFs in appropriate AioContexts")
-Suggested-by: Stefan Hajnoczi <stefanha@redhat.com>
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
-Message-id: 20251017094518.328905-1-f.ebner@proxmox.com
-[Changed g_list_append() to g_list_prepend() to avoid traversing the
-list each time.
---Stefan]
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-(cherry picked from commit 7d80d6d82db4c73e335f9e738d7a5778124df35e
- from https://gitlab.com/stefanha/qemu/-/tree/block)
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- hw/scsi/virtio-scsi.c | 14 +++++++++++++-
- 1 file changed, 13 insertions(+), 1 deletion(-)
-
-diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
-index 34ae14f7bf..3b635053b5 100644
---- a/hw/scsi/virtio-scsi.c
-+++ b/hw/scsi/virtio-scsi.c
-@@ -343,6 +343,7 @@ static void virtio_scsi_do_tmf_aio_context(void *opaque)
-     SCSIDevice *d = virtio_scsi_device_get(s, tmf->req.tmf.lun);
-     SCSIRequest *r;
-     bool match_tag;
-+    g_autoptr(GList) reqs = NULL;
- 
-     if (!d) {
-         tmf->resp.tmf.response = VIRTIO_SCSI_S_BAD_TARGET;
-@@ -378,10 +379,21 @@ static void virtio_scsi_do_tmf_aio_context(void *opaque)
-             if (match_tag && cmd_req->req.cmd.tag != tmf->req.tmf.tag) {
-                 continue;
-             }
--            virtio_scsi_tmf_cancel_req(tmf, r);
-+            /*
-+             * Cannot cancel directly, because scsi_req_dequeue() would deadlock
-+             * when attempting to acquire the request_lock a second time. Taking
-+             * a reference here is paired with an unref after cancelling below.
-+             */
-+            scsi_req_ref(r);
-+            reqs = g_list_prepend(reqs, r);
-         }
-     }
- 
-+    for (GList *elem = g_list_first(reqs); elem; elem = g_list_next(elem)) {
-+        virtio_scsi_tmf_cancel_req(tmf, elem->data);
-+        scsi_req_unref(elem->data);
-+    }
-+
-     /* Incremented by virtio_scsi_do_tmf() */
-     virtio_scsi_tmf_dec_remaining(tmf);
- 
diff --git a/debian/patches/extra/0006-vfio-rename-field-to-num_initial_regions.patch b/debian/patches/extra/0006-vfio-rename-field-to-num_initial_regions.patch
deleted file mode 100644
index 3662f1d..0000000
--- a/debian/patches/extra/0006-vfio-rename-field-to-num_initial_regions.patch
+++ /dev/null
@@ -1,245 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: John Levon <john.levon@nutanix.com>
-Date: Tue, 14 Oct 2025 17:12:26 +0200
-Subject: [PATCH] vfio: rename field to "num_initial_regions"
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-We set VFIODevice::num_regions at initialization time, and do not
-otherwise refresh it. As it is valid in theory for a VFIO device to
-later increase the number of supported regions, rename the field to
-"num_initial_regions" to better reflect its semantics.
-
-Signed-off-by: John Levon <john.levon@nutanix.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Reviewed-by: Alex Williamson <alex@shazbot.org>
-Link: https://lore.kernel.org/qemu-devel/20251014151227.2298892-2-john.levon@nutanix.com
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit d5176a39405f0e0d20dff173e58255a7d5099411
- from https://gitlab.com/legoater/qemu/-/tree/vfio-next)
-[FE: also rename in hw/vfio/platform.c and hw/core/sysbus-fdt.c
- where affected code got dropped in master, but is still in v10.1]
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- hw/core/sysbus-fdt.c          | 14 +++++++-------
- hw/vfio-user/device.c         |  2 +-
- hw/vfio/ccw.c                 |  4 ++--
- hw/vfio/device.c              | 12 ++++++------
- hw/vfio/iommufd.c             |  3 ++-
- hw/vfio/pci.c                 |  4 ++--
- hw/vfio/platform.c            | 10 +++++-----
- include/hw/vfio/vfio-device.h |  2 +-
- 8 files changed, 26 insertions(+), 25 deletions(-)
-
-diff --git a/hw/core/sysbus-fdt.c b/hw/core/sysbus-fdt.c
-index c339a27875..1e1966813f 100644
---- a/hw/core/sysbus-fdt.c
-+++ b/hw/core/sysbus-fdt.c
-@@ -236,15 +236,15 @@ static int add_calxeda_midway_xgmac_fdt_node(SysBusDevice *sbdev, void *opaque)
- 
-     qemu_fdt_setprop(fdt, nodename, "dma-coherent", "", 0);
- 
--    reg_attr = g_new(uint32_t, vbasedev->num_regions * 2);
--    for (i = 0; i < vbasedev->num_regions; i++) {
-+    reg_attr = g_new(uint32_t, vbasedev->num_initial_regions * 2);
-+    for (i = 0; i < vbasedev->num_initial_regions; i++) {
-         mmio_base = platform_bus_get_mmio_addr(pbus, sbdev, i);
-         reg_attr[2 * i] = cpu_to_be32(mmio_base);
-         reg_attr[2 * i + 1] = cpu_to_be32(
-                                 memory_region_size(vdev->regions[i]->mem));
-     }
-     qemu_fdt_setprop(fdt, nodename, "reg", reg_attr,
--                     vbasedev->num_regions * 2 * sizeof(uint32_t));
-+                     vbasedev->num_initial_regions * 2 * sizeof(uint32_t));
- 
-     irq_attr = g_new(uint32_t, vbasedev->num_irqs * 3);
-     for (i = 0; i < vbasedev->num_irqs; i++) {
-@@ -330,7 +330,7 @@ static int add_amd_xgbe_fdt_node(SysBusDevice *sbdev, void *opaque)
- 
-     g_free(dt_name);
- 
--    if (vbasedev->num_regions != 5) {
-+    if (vbasedev->num_initial_regions != 5) {
-         error_report("%s Does the host dt node combine XGBE/PHY?", __func__);
-         exit(1);
-     }
-@@ -374,15 +374,15 @@ static int add_amd_xgbe_fdt_node(SysBusDevice *sbdev, void *opaque)
-                            guest_clock_phandles[0],
-                            guest_clock_phandles[1]);
- 
--    reg_attr = g_new(uint32_t, vbasedev->num_regions * 2);
--    for (i = 0; i < vbasedev->num_regions; i++) {
-+    reg_attr = g_new(uint32_t, vbasedev->num_initial_regions * 2);
-+    for (i = 0; i < vbasedev->num_initial_regions; i++) {
-         mmio_base = platform_bus_get_mmio_addr(pbus, sbdev, i);
-         reg_attr[2 * i] = cpu_to_be32(mmio_base);
-         reg_attr[2 * i + 1] = cpu_to_be32(
-                                 memory_region_size(vdev->regions[i]->mem));
-     }
-     qemu_fdt_setprop(guest_fdt, nodename, "reg", reg_attr,
--                     vbasedev->num_regions * 2 * sizeof(uint32_t));
-+                     vbasedev->num_initial_regions * 2 * sizeof(uint32_t));
- 
-     irq_attr = g_new(uint32_t, vbasedev->num_irqs * 3);
-     for (i = 0; i < vbasedev->num_irqs; i++) {
-diff --git a/hw/vfio-user/device.c b/hw/vfio-user/device.c
-index 0609a7dc25..64ef35b320 100644
---- a/hw/vfio-user/device.c
-+++ b/hw/vfio-user/device.c
-@@ -134,7 +134,7 @@ static int vfio_user_device_io_get_region_info(VFIODevice *vbasedev,
-     VFIOUserFDs fds = { 0, 1, fd};
-     int ret;
- 
--    if (info->index > vbasedev->num_regions) {
-+    if (info->index > vbasedev->num_initial_regions) {
-         return -EINVAL;
-     }
- 
-diff --git a/hw/vfio/ccw.c b/hw/vfio/ccw.c
-index 9560b8d851..4d9588e7aa 100644
---- a/hw/vfio/ccw.c
-+++ b/hw/vfio/ccw.c
-@@ -484,9 +484,9 @@ static bool vfio_ccw_get_region(VFIOCCWDevice *vcdev, Error **errp)
-      * We always expect at least the I/O region to be present. We also
-      * may have a variable number of regions governed by capabilities.
-      */
--    if (vdev->num_regions < VFIO_CCW_CONFIG_REGION_INDEX + 1) {
-+    if (vdev->num_initial_regions < VFIO_CCW_CONFIG_REGION_INDEX + 1) {
-         error_setg(errp, "vfio: too few regions (%u), expected at least %u",
--                   vdev->num_regions, VFIO_CCW_CONFIG_REGION_INDEX + 1);
-+                   vdev->num_initial_regions, VFIO_CCW_CONFIG_REGION_INDEX + 1);
-         return false;
-     }
- 
-diff --git a/hw/vfio/device.c b/hw/vfio/device.c
-index 52a1996dc4..0b459c0f7c 100644
---- a/hw/vfio/device.c
-+++ b/hw/vfio/device.c
-@@ -257,7 +257,7 @@ int vfio_device_get_region_info_type(VFIODevice *vbasedev, uint32_t type,
- {
-     int i;
- 
--    for (i = 0; i < vbasedev->num_regions; i++) {
-+    for (i = 0; i < vbasedev->num_initial_regions; i++) {
-         struct vfio_info_cap_header *hdr;
-         struct vfio_region_info_cap_type *cap_type;
- 
-@@ -466,7 +466,7 @@ void vfio_device_prepare(VFIODevice *vbasedev, VFIOContainerBase *bcontainer,
-     int i;
- 
-     vbasedev->num_irqs = info->num_irqs;
--    vbasedev->num_regions = info->num_regions;
-+    vbasedev->num_initial_regions = info->num_regions;
-     vbasedev->flags = info->flags;
-     vbasedev->reset_works = !!(info->flags & VFIO_DEVICE_FLAGS_RESET);
- 
-@@ -476,10 +476,10 @@ void vfio_device_prepare(VFIODevice *vbasedev, VFIOContainerBase *bcontainer,
-     QLIST_INSERT_HEAD(&vfio_device_list, vbasedev, global_next);
- 
-     vbasedev->reginfo = g_new0(struct vfio_region_info *,
--                               vbasedev->num_regions);
-+                               vbasedev->num_initial_regions);
-     if (vbasedev->use_region_fds) {
--        vbasedev->region_fds = g_new0(int, vbasedev->num_regions);
--        for (i = 0; i < vbasedev->num_regions; i++) {
-+        vbasedev->region_fds = g_new0(int, vbasedev->num_initial_regions);
-+        for (i = 0; i < vbasedev->num_initial_regions; i++) {
-             vbasedev->region_fds[i] = -1;
-         }
-     }
-@@ -489,7 +489,7 @@ void vfio_device_unprepare(VFIODevice *vbasedev)
- {
-     int i;
- 
--    for (i = 0; i < vbasedev->num_regions; i++) {
-+    for (i = 0; i < vbasedev->num_initial_regions; i++) {
-         g_free(vbasedev->reginfo[i]);
-         if (vbasedev->region_fds != NULL && vbasedev->region_fds[i] != -1) {
-             close(vbasedev->region_fds[i]);
-diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
-index 48c590b6a9..dbcd861b27 100644
---- a/hw/vfio/iommufd.c
-+++ b/hw/vfio/iommufd.c
-@@ -668,7 +668,8 @@ found_container:
-     vfio_iommufd_cpr_register_device(vbasedev);
- 
-     trace_iommufd_cdev_device_info(vbasedev->name, devfd, vbasedev->num_irqs,
--                                   vbasedev->num_regions, vbasedev->flags);
-+                                   vbasedev->num_initial_regions,
-+                                   vbasedev->flags);
-     return true;
- 
- err_listener_register:
-diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
-index 07257d0fa0..1e69055c7c 100644
---- a/hw/vfio/pci.c
-+++ b/hw/vfio/pci.c
-@@ -2930,9 +2930,9 @@ bool vfio_pci_populate_device(VFIOPCIDevice *vdev, Error **errp)
-         return false;
-     }
- 
--    if (vbasedev->num_regions < VFIO_PCI_CONFIG_REGION_INDEX + 1) {
-+    if (vbasedev->num_initial_regions < VFIO_PCI_CONFIG_REGION_INDEX + 1) {
-         error_setg(errp, "unexpected number of io regions %u",
--                   vbasedev->num_regions);
-+                   vbasedev->num_initial_regions);
-         return false;
-     }
- 
-diff --git a/hw/vfio/platform.c b/hw/vfio/platform.c
-index 5c1795a26f..c9349ba7b7 100644
---- a/hw/vfio/platform.c
-+++ b/hw/vfio/platform.c
-@@ -148,7 +148,7 @@ static void vfio_mmap_set_enabled(VFIOPlatformDevice *vdev, bool enabled)
- {
-     int i;
- 
--    for (i = 0; i < vdev->vbasedev.num_regions; i++) {
-+    for (i = 0; i < vdev->vbasedev.num_initial_regions; i++) {
-         vfio_region_mmaps_set_enabled(vdev->regions[i], enabled);
-     }
- }
-@@ -453,9 +453,9 @@ static bool vfio_populate_device(VFIODevice *vbasedev, Error **errp)
-         return false;
-     }
- 
--    vdev->regions = g_new0(VFIORegion *, vbasedev->num_regions);
-+    vdev->regions = g_new0(VFIORegion *, vbasedev->num_initial_regions);
- 
--    for (i = 0; i < vbasedev->num_regions; i++) {
-+    for (i = 0; i < vbasedev->num_initial_regions; i++) {
-         char *name = g_strdup_printf("VFIO %s region %d\n", vbasedev->name, i);
- 
-         vdev->regions[i] = g_new0(VFIORegion, 1);
-@@ -499,7 +499,7 @@ irq_err:
-         g_free(intp);
-     }
- reg_error:
--    for (i = 0; i < vbasedev->num_regions; i++) {
-+    for (i = 0; i < vbasedev->num_initial_regions; i++) {
-         if (vdev->regions[i]) {
-             vfio_region_finalize(vdev->regions[i]);
-         }
-@@ -608,7 +608,7 @@ static void vfio_platform_realize(DeviceState *dev, Error **errp)
-         }
-     }
- 
--    for (i = 0; i < vbasedev->num_regions; i++) {
-+    for (i = 0; i < vbasedev->num_initial_regions; i++) {
-         if (vfio_region_mmap(vdev->regions[i])) {
-             warn_report("%s mmap unsupported, performance may be slow",
-                         memory_region_name(vdev->regions[i]->mem));
-diff --git a/include/hw/vfio/vfio-device.h b/include/hw/vfio/vfio-device.h
-index 6e4d5ccdac..10024730a1 100644
---- a/include/hw/vfio/vfio-device.h
-+++ b/include/hw/vfio/vfio-device.h
-@@ -74,7 +74,7 @@ typedef struct VFIODevice {
-     VFIODeviceOps *ops;
-     VFIODeviceIOOps *io_ops;
-     unsigned int num_irqs;
--    unsigned int num_regions;
-+    unsigned int num_initial_regions;
-     unsigned int flags;
-     VFIOMigration *migration;
-     Error *migration_blocker;
diff --git a/debian/patches/extra/0007-vfio-only-check-region-info-cache-for-initial-region.patch b/debian/patches/extra/0007-vfio-only-check-region-info-cache-for-initial-region.patch
deleted file mode 100644
index b239cb4..0000000
--- a/debian/patches/extra/0007-vfio-only-check-region-info-cache-for-initial-region.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: John Levon <john.levon@nutanix.com>
-Date: Tue, 14 Oct 2025 17:12:27 +0200
-Subject: [PATCH] vfio: only check region info cache for initial regions
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-It is semantically valid for a VFIO device to increase the number of
-regions after initialization. In this case, we'd attempt to check for
-cached region info past the size of the ->reginfo array. Check for the
-region index and skip the cache in these cases.
-
-This also works around some VGPU use cases which appear to be a bug,
-where VFIO_DEVICE_QUERY_GFX_PLANE returns a region index beyond the
-reported ->num_regions.
-
-Fixes: 95cdb024 ("vfio: add region info cache")
-Signed-off-by: John Levon <john.levon@nutanix.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Reviewed-by: Alex Williamson <alex@shazbot.org>
-Link: https://lore.kernel.org/qemu-devel/20251014151227.2298892-3-john.levon@nutanix.com
-Signed-off-by: Cédric Le Goater <clg@redhat.com>
-(cherry picked from commit 5bdcf2df64bf7e4be58524ef1442836b6d41282e
- from https://gitlab.com/legoater/qemu/-/tree/vfio-next)
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- hw/vfio/device.c | 27 +++++++++++++++++++--------
- 1 file changed, 19 insertions(+), 8 deletions(-)
-
-diff --git a/hw/vfio/device.c b/hw/vfio/device.c
-index 0b459c0f7c..7ebf41c95e 100644
---- a/hw/vfio/device.c
-+++ b/hw/vfio/device.c
-@@ -205,10 +205,19 @@ int vfio_device_get_region_info(VFIODevice *vbasedev, int index,
-     int fd = -1;
-     int ret;
- 
--    /* check cache */
--    if (vbasedev->reginfo[index] != NULL) {
--        *info = vbasedev->reginfo[index];
--        return 0;
-+    /*
-+     * We only set up the region info cache for the initial number of regions.
-+     *
-+     * Since a VFIO device may later increase the number of regions then use
-+     * such regions with an index past ->num_initial_regions, don't attempt to
-+     * use the info cache in those cases.
-+     */
-+    if (index < vbasedev->num_initial_regions) {
-+        /* check cache */
-+        if (vbasedev->reginfo[index] != NULL) {
-+            *info = vbasedev->reginfo[index];
-+            return 0;
-+        }
-     }
- 
-     *info = g_malloc0(argsz);
-@@ -236,10 +245,12 @@ retry:
-         goto retry;
-     }
- 
--    /* fill cache */
--    vbasedev->reginfo[index] = *info;
--    if (vbasedev->region_fds != NULL) {
--        vbasedev->region_fds[index] = fd;
-+    if (index < vbasedev->num_initial_regions) {
-+        /* fill cache */
-+        vbasedev->reginfo[index] = *info;
-+        if (vbasedev->region_fds != NULL) {
-+            vbasedev->region_fds[index] = fd;
-+        }
-     }
- 
-     return 0;
diff --git a/debian/patches/extra/0008-ui-vdagent-fix-windows-agent-regression.patch b/debian/patches/extra/0008-ui-vdagent-fix-windows-agent-regression.patch
deleted file mode 100644
index dbb0141..0000000
--- a/debian/patches/extra/0008-ui-vdagent-fix-windows-agent-regression.patch
+++ /dev/null
@@ -1,105 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
-Date: Mon, 27 Oct 2025 17:07:44 +0400
-Subject: [PATCH] ui/vdagent: fix windows agent regression
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Since commit f626116f ("ui/vdagent: factor out clipboard peer
-registration"), the QEMU clipboard serial is reset whenever the vdagent
-chardev receives the guest caps. This triggers a CHR_EVENT_CLOSED which
-is handled by virtio_serial_close() to notify the guest.
-
-The "reconnection logic" is there to reset the agent when a
-client (dbus, spice etc) reconnects, or the agent is restarted.
-It is required to sync the clipboard serials and to prevent races or
-loops due to clipboard managers on both ends (but this is not
-implemented by windows vdagent).
-
-The Unix agent has been reconnecting without resending caps, thus
-working with this approach.
-
-However, the Windows agent does not seem to have a way to handle
-VIRTIO_CONSOLE_PORT_OPEN=0 event and do not receive further data...
-
-Let's not trigger this disconnection/reset logic if the agent does not
-support VD_AGENT_CAP_CLIPBOARD_GRAB_SERIAL.
-
-Fixes: f626116f ("ui/vdagent: factor out clipboard peer registration")
-Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
-Reported-by: Lucas Kornicki <lucas.kornicki@nutanix.com>
-Tested-by: Lucas Kornicki <lucas.kornicki@nutanix.com>
-Link: https://lore.kernel.org/all/20251027130744.2714610-1-marcandre.lureau@redhat.com/
-[FE: picked from qemu-devel]
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- ui/vdagent.c | 20 ++++++++++++++------
- 1 file changed, 14 insertions(+), 6 deletions(-)
-
-diff --git a/ui/vdagent.c b/ui/vdagent.c
-index c0746fe5b1..a7c959e8ab 100644
---- a/ui/vdagent.c
-+++ b/ui/vdagent.c
-@@ -316,6 +316,15 @@ static bool have_selection(VDAgentChardev *vd)
-     return vd->caps & (1 << VD_AGENT_CAP_CLIPBOARD_SELECTION);
- }
- 
-+static bool have_clipboard_serial(VDAgentChardev *vd)
-+{
-+#if CHECK_SPICE_PROTOCOL_VERSION(0, 14, 1)
-+    return vd->caps & (1 << VD_AGENT_CAP_CLIPBOARD_GRAB_SERIAL);
-+#else
-+    return false;
-+#endif
-+}
-+
- static uint32_t type_qemu_to_vdagent(enum QemuClipboardType type)
- {
-     switch (type) {
-@@ -345,8 +354,7 @@ static void vdagent_send_clipboard_grab(VDAgentChardev *vd,
-         return;
-     }
- 
--#if CHECK_SPICE_PROTOCOL_VERSION(0, 14, 1)
--    if (vd->caps & (1 << VD_AGENT_CAP_CLIPBOARD_GRAB_SERIAL)) {
-+    if (have_clipboard_serial(vd)) {
-         if (!info->has_serial) {
-             /* client should win */
-             info->serial = vd->last_serial[info->selection]++;
-@@ -356,7 +364,6 @@ static void vdagent_send_clipboard_grab(VDAgentChardev *vd,
-         data++;
-         msg->size += sizeof(uint32_t);
-     }
--#endif
- 
-     for (q = 0; q < QEMU_CLIPBOARD_TYPE__COUNT; q++) {
-         type = type_qemu_to_vdagent(q);
-@@ -464,6 +471,9 @@ static void vdagent_clipboard_reset_serial(VDAgentChardev *vd)
- {
-     Chardev *chr = CHARDEV(vd);
- 
-+    if (!have_clipboard_serial(vd)) {
-+        return;
-+    }
-     /* reopen the agent connection to reset the serial state */
-     qemu_chr_be_event(chr, CHR_EVENT_CLOSED);
-     /* OPENED again after the guest disconnected, see set_fe_open */
-@@ -518,8 +528,7 @@ static void vdagent_clipboard_recv_grab(VDAgentChardev *vd, uint8_t s, uint32_t
- 
-     trace_vdagent_cb_grab_selection(GET_NAME(sel_name, s));
-     info = qemu_clipboard_info_new(&vd->cbpeer, s);
--#if CHECK_SPICE_PROTOCOL_VERSION(0, 14, 1)
--    if (vd->caps & (1 << VD_AGENT_CAP_CLIPBOARD_GRAB_SERIAL)) {
-+    if (have_clipboard_serial(vd)) {
-         if (size < sizeof(uint32_t)) {
-             /* this shouldn't happen! */
-             return;
-@@ -537,7 +546,6 @@ static void vdagent_clipboard_recv_grab(VDAgentChardev *vd, uint8_t s, uint32_t
-         data += sizeof(uint32_t);
-         size -= sizeof(uint32_t);
-     }
--#endif
-     if (size > sizeof(uint32_t) * 10) {
-         /*
-          * spice has 6 types as of 2021. Limiting to 10 entries
diff --git a/debian/patches/extra/0009-file-posix-populate-pwrite_zeroes_alignment.patch b/debian/patches/extra/0009-file-posix-populate-pwrite_zeroes_alignment.patch
deleted file mode 100644
index 7e9f4b5..0000000
--- a/debian/patches/extra/0009-file-posix-populate-pwrite_zeroes_alignment.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Tue, 7 Oct 2025 10:16:58 -0400
-Subject: [PATCH] file-posix: populate pwrite_zeroes_alignment
-
-Linux block devices require write zeroes alignment whereas files do not.
-
-It may come as a surprise that block devices opened in buffered I/O mode
-require the alignment for write zeroes requests although normal
-read/write requests do not.
-
-Therefore it is necessary to populate the pwrite_zeroes_alignment field.
-
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
-Link: https://lore.kernel.org/20251007141700.71891-2-stefanha@redhat.com
-[FE: picked from qemu-devel]
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- block/file-posix.c | 16 ++++++++++++++++
- 1 file changed, 16 insertions(+)
-
-diff --git a/block/file-posix.c b/block/file-posix.c
-index 8c738674ce..827ffa77a5 100644
---- a/block/file-posix.c
-+++ b/block/file-posix.c
-@@ -1602,6 +1602,22 @@ static void raw_refresh_limits(BlockDriverState *bs, Error **errp)
- 
-             bs->bl.pdiscard_alignment = dalign;
-         }
-+
-+#ifdef __linux__
-+        /*
-+         * Linux requires logical block size alignment for write zeroes even
-+         * when normal reads/writes do not require alignment.
-+         */
-+        if (!s->needs_alignment) {
-+            ret = probe_logical_blocksize(s->fd,
-+                                          &bs->bl.pwrite_zeroes_alignment);
-+            if (ret < 0) {
-+                error_setg_errno(errp, -ret,
-+                                 "Failed to probe logical block size");
-+                return;
-+            }
-+        }
-+#endif /* __linux__ */
-     }
- 
-     raw_refresh_zoned_limits(bs, &st, errp);
diff --git a/debian/patches/extra/0010-block-use-pwrite_zeroes_alignment-when-writing-first.patch b/debian/patches/extra/0010-block-use-pwrite_zeroes_alignment-when-writing-first.patch
deleted file mode 100644
index be61982..0000000
--- a/debian/patches/extra/0010-block-use-pwrite_zeroes_alignment-when-writing-first.patch
+++ /dev/null
@@ -1,86 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Stefan Hajnoczi <stefanha@redhat.com>
-Date: Tue, 7 Oct 2025 10:16:59 -0400
-Subject: [PATCH] block: use pwrite_zeroes_alignment when writing first sector
-
-Since commit 5634622bcb33 ("file-posix: allow BLKZEROOUT with -t
-writeback"), qemu-img create errors out on a Linux loop block device
-with a 4 KB sector size:
-
-  # dd if=/dev/zero of=blockfile bs=1M count=1024
-  # losetup --sector-size 4096 /dev/loop0 blockfile
-  # qemu-img create -f raw /dev/loop0 1G
-  Formatting '/dev/loop0', fmt=raw size=1073741824
-  qemu-img: /dev/loop0: Failed to clear the new image's first sector: Invalid argument
-
-Use the pwrite_zeroes_alignment block limit to avoid misaligned
-fallocate(2) or ioctl(BLKZEROOUT) in the block/file-posix.c block
-driver.
-
-Fixes: 5634622bcb33 ("file-posix: allow BLKZEROOUT with -t writeback")
-Reported-by: Jean-Louis Dupond <jean-louis@dupond.be>
-Buglink: https://gitlab.com/qemu-project/qemu/-/issues/3127
-Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Link: https://lore.kernel.org/20251007141700.71891-3-stefanha@redhat.com
-[FE: picked from qemu-devel]
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- block.c                           |  3 ++-
- block/block-backend.c             | 11 +++++++++++
- include/system/block-backend-io.h |  1 +
- 3 files changed, 14 insertions(+), 1 deletion(-)
-
-diff --git a/block.c b/block.c
-index 8848e9a7ed..be77e03904 100644
---- a/block.c
-+++ b/block.c
-@@ -606,12 +606,13 @@ create_file_fallback_zero_first_sector(BlockBackend *blk,
-                                        int64_t current_size,
-                                        Error **errp)
- {
-+    uint32_t alignment = blk_get_pwrite_zeroes_alignment(blk);
-     int64_t bytes_to_clear;
-     int ret;
- 
-     GLOBAL_STATE_CODE();
- 
--    bytes_to_clear = MIN(current_size, BDRV_SECTOR_SIZE);
-+    bytes_to_clear = MIN(current_size, MAX(BDRV_SECTOR_SIZE, alignment));
-     if (bytes_to_clear) {
-         ret = blk_co_pwrite_zeroes(blk, 0, bytes_to_clear, BDRV_REQ_MAY_UNMAP);
-         if (ret < 0) {
-diff --git a/block/block-backend.c b/block/block-backend.c
-index f8d6ba65c1..239d6eca37 100644
---- a/block/block-backend.c
-+++ b/block/block-backend.c
-@@ -2305,6 +2305,17 @@ uint32_t blk_get_request_alignment(BlockBackend *blk)
-     return bs ? bs->bl.request_alignment : BDRV_SECTOR_SIZE;
- }
- 
-+/* Returns the optimal write zeroes alignment, in bytes; guaranteed nonzero */
-+uint32_t blk_get_pwrite_zeroes_alignment(BlockBackend *blk)
-+{
-+    BlockDriverState *bs = blk_bs(blk);
-+    IO_CODE();
-+    if (!bs) {
-+        return BDRV_SECTOR_SIZE;
-+    }
-+    return bs->bl.pwrite_zeroes_alignment ?: bs->bl.request_alignment;
-+}
-+
- /* Returns the maximum hardware transfer length, in bytes; guaranteed nonzero */
- uint64_t blk_get_max_hw_transfer(BlockBackend *blk)
- {
-diff --git a/include/system/block-backend-io.h b/include/system/block-backend-io.h
-index ba8dfcc7d0..6d5ac476fc 100644
---- a/include/system/block-backend-io.h
-+++ b/include/system/block-backend-io.h
-@@ -116,6 +116,7 @@ BlockAIOCB *blk_abort_aio_request(BlockBackend *blk,
-                                   void *opaque, int ret);
- 
- uint32_t blk_get_request_alignment(BlockBackend *blk);
-+uint32_t blk_get_pwrite_zeroes_alignment(BlockBackend *blk);
- uint32_t blk_get_max_transfer(BlockBackend *blk);
- uint64_t blk_get_max_hw_transfer(BlockBackend *blk);
- 
diff --git a/debian/patches/extra/0011-block-io_uring-avoid-potentially-getting-stuck-after.patch b/debian/patches/extra/0011-block-io_uring-avoid-potentially-getting-stuck-after.patch
deleted file mode 100644
index 372ecad..0000000
--- a/debian/patches/extra/0011-block-io_uring-avoid-potentially-getting-stuck-after.patch
+++ /dev/null
@@ -1,153 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Fiona Ebner <f.ebner@proxmox.com>
-Date: Mon, 24 Nov 2025 15:28:27 +0100
-Subject: [PATCH] block/io_uring: avoid potentially getting stuck after
- resubmit at the end of ioq_submit()
-
-Note that this issue seems already fixed as a consequence of the large
-io_uring rework with 047dabef97 ("block/io_uring: use aio_add_sqe()")
-in current master, so this is purely for QEMU stable branches.
-
-At the end of ioq_submit(), there is an opportunistic call to
-luring_process_completions(). This is the single caller of
-luring_process_completions() that doesn't use the
-luring_process_completions_and_submit() wrapper.
-
-Other callers use the wrapper, because luring_process_completions()
-might require a subsequent call to ioq_submit() after resubmitting a
-request. As noted for luring_resubmit():
-
-> Resubmit a request by appending it to submit_queue.  The caller must ensure
-> that ioq_submit() is called later so that submit_queue requests are started.
-
-So the caller at the end of ioq_submit() violates the contract and can
-in fact be problematic if no other requests come in later. In such a
-case, the request intended to be resubmitted will never be actually be
-submitted via io_uring_submit().
-
-A reproducer exposing this issue is [0], which is based on user
-reports from [1]. Another reproducer is iotest 109 with '-i io_uring'.
-
-I had the most success to trigger the issue with [0] when using a
-BTRFS RAID 1 storage. With tmpfs, it can take quite a few iterations,
-but also triggers eventually on my machine. With iotest 109 with '-i
-io_uring' the issue triggers reliably on my ext4 file system.
-
-Have ioq_submit() submit any resubmitted requests after calling
-luring_process_completions(). The return value from io_uring_submit()
-is checked to be non-negative before the opportunistic processing of
-completions and going for the new resubmit logic, to ensure that a
-failure of io_uring_submit() is not missed. Also note that the return
-value already was not necessarily the total number of submissions,
-since the loop might've been iterated more than once even before the
-current change.
-
-Only trigger the resubmission logic if it is actually necessary to
-avoid changing behavior more than necessary. For example iotest 109
-would produce more 'mirror ready' events if always resubmitting after
-luring_process_completions() at the end of ioq_submit().
-
-Note iotest 109 still does not pass as is when run with '-i io_uring',
-because of two offset values for BLOCK_JOB_COMPLETED events being zero
-instead of non-zero as in the expected output. Note that the two
-affected test cases are expected failures and still fail, so they just
-fail "faster". The test cases are actually not triggering the resubmit
-logic, so the reason seems to be different ordering of requests and
-completions of the current aio=io_uring implementation versus
-aio=threads.
-
-[0]:
-
-> #!/bin/bash -e
-> #file=/mnt/btrfs/disk.raw
-> file=/tmp/disk.raw
-> filesize=256
-> readsize=512
-> rm -f $file
-> truncate -s $filesize $file
-> ./qemu-system-x86_64 --trace '*uring*' --qmp stdio \
-> --blockdev raw,node-name=node0,file.driver=file,file.cache.direct=off,file.filename=$file,file.aio=io_uring \
-> <<EOF
-> {"execute": "qmp_capabilities"}
-> {"execute": "human-monitor-command", "arguments": { "command-line": "qemu-io node0 \"read 0 $readsize \"" }}
-> {"execute": "quit"}
-> EOF
-
-[1]: https://forum.proxmox.com/threads/170045/
-
-Cc: qemu-stable@nongnu.org
-Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
----
- block/io_uring.c | 16 +++++++++++++---
- 1 file changed, 13 insertions(+), 3 deletions(-)
-
-diff --git a/block/io_uring.c b/block/io_uring.c
-index dd4f304910..5dbafc8f7b 100644
---- a/block/io_uring.c
-+++ b/block/io_uring.c
-@@ -120,11 +120,14 @@ static void luring_resubmit_short_read(LuringState *s, LuringAIOCB *luringcb,
-  * event loop.  When there are no events left  to complete the BH is being
-  * canceled.
-  *
-+ * Returns whether ioq_submit() must be called again afterwards since requests
-+ * were resubmitted via luring_resubmit().
-  */
--static void luring_process_completions(LuringState *s)
-+static bool luring_process_completions(LuringState *s)
- {
-     struct io_uring_cqe *cqes;
-     int total_bytes;
-+    bool resubmit = false;
- 
-     defer_call_begin();
- 
-@@ -182,6 +185,7 @@ static void luring_process_completions(LuringState *s)
-              */
-             if (ret == -EINTR || ret == -EAGAIN) {
-                 luring_resubmit(s, luringcb);
-+                resubmit = true;
-                 continue;
-             }
-         } else if (!luringcb->qiov) {
-@@ -194,6 +198,7 @@ static void luring_process_completions(LuringState *s)
-             if (luringcb->is_read) {
-                 if (ret > 0) {
-                     luring_resubmit_short_read(s, luringcb, ret);
-+                    resubmit = true;
-                     continue;
-                 } else {
-                     /* Pad with zeroes */
-@@ -224,6 +229,8 @@ end:
-     qemu_bh_cancel(s->completion_bh);
- 
-     defer_call_end();
-+
-+    return resubmit;
- }
- 
- static int ioq_submit(LuringState *s)
-@@ -231,6 +238,7 @@ static int ioq_submit(LuringState *s)
-     int ret = 0;
-     LuringAIOCB *luringcb, *luringcb_next;
- 
-+resubmit:
-     while (s->io_q.in_queue > 0) {
-         /*
-          * Try to fetch sqes from the ring for requests waiting in
-@@ -260,12 +268,14 @@ static int ioq_submit(LuringState *s)
-     }
-     s->io_q.blocked = (s->io_q.in_queue > 0);
- 
--    if (s->io_q.in_flight) {
-+    if (ret >= 0 && s->io_q.in_flight) {
-         /*
-          * We can try to complete something just right away if there are
-          * still requests in-flight.
-          */
--        luring_process_completions(s);
-+        if (luring_process_completions(s)) {
-+            goto resubmit;
-+        }
-     }
-     return ret;
- }
diff --git a/debian/patches/pve/0001-PVE-Config-block-file-change-locking-default-to-off.patch b/debian/patches/pve/0001-PVE-Config-block-file-change-locking-default-to-off.patch
index df81614..3294086 100644
--- a/debian/patches/pve/0001-PVE-Config-block-file-change-locking-default-to-off.patch
+++ b/debian/patches/pve/0001-PVE-Config-block-file-change-locking-default-to-off.patch
@@ -14,7 +14,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/block/file-posix.c b/block/file-posix.c
-index 827ffa77a5..baac7653db 100644
+index 6265d2e248..41ac3f222f 100644
 --- a/block/file-posix.c
 +++ b/block/file-posix.c
 @@ -588,7 +588,7 @@ static QemuOptsList raw_runtime_opts = {
diff --git a/debian/patches/pve/0002-PVE-Config-Adjust-network-script-path-to-etc-kvm.patch b/debian/patches/pve/0002-PVE-Config-Adjust-network-script-path-to-etc-kvm.patch
index 9582fc1..5a51af1 100644
--- a/debian/patches/pve/0002-PVE-Config-Adjust-network-script-path-to-etc-kvm.patch
+++ b/debian/patches/pve/0002-PVE-Config-Adjust-network-script-path-to-etc-kvm.patch
@@ -9,10 +9,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/include/net/net.h b/include/net/net.h
-index 84ee18e0f9..d42d935db5 100644
+index 72b476ee1d..f257fc7401 100644
 --- a/include/net/net.h
 +++ b/include/net/net.h
-@@ -311,8 +311,8 @@ void netdev_add(QemuOpts *opts, Error **errp);
+@@ -325,8 +325,8 @@ void netdev_add(QemuOpts *opts, Error **errp);
  
  int net_hub_id_for_client(NetClientState *nc, int *id);
  
diff --git a/debian/patches/pve/0003-PVE-Config-set-the-CPU-model-to-kvm64-32-instead-of-.patch b/debian/patches/pve/0003-PVE-Config-set-the-CPU-model-to-kvm64-32-instead-of-.patch
index cd2e07a..b4e1b2f 100644
--- a/debian/patches/pve/0003-PVE-Config-set-the-CPU-model-to-kvm64-32-instead-of-.patch
+++ b/debian/patches/pve/0003-PVE-Config-set-the-CPU-model-to-kvm64-32-instead-of-.patch
@@ -10,10 +10,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/target/i386/cpu.h b/target/i386/cpu.h
-index 42168f1d6d..4f63100453 100644
+index cee1f692a1..6f49be3796 100644
 --- a/target/i386/cpu.h
 +++ b/target/i386/cpu.h
-@@ -2630,9 +2630,9 @@ uint64_t cpu_get_tsc(CPUX86State *env);
+@@ -2641,9 +2641,9 @@ uint64_t cpu_get_tsc(CPUX86State *env);
  #define CPU_RESOLVING_TYPE TYPE_X86_CPU
  
  #ifdef TARGET_X86_64
diff --git a/debian/patches/pve/0004-PVE-Config-ui-spice-default-to-pve-certificates.patch b/debian/patches/pve/0004-PVE-Config-ui-spice-default-to-pve-certificates.patch
index 8fe7b5d..9c6c696 100644
--- a/debian/patches/pve/0004-PVE-Config-ui-spice-default-to-pve-certificates.patch
+++ b/debian/patches/pve/0004-PVE-Config-ui-spice-default-to-pve-certificates.patch
@@ -9,10 +9,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 9 insertions(+), 6 deletions(-)
 
 diff --git a/ui/spice-core.c b/ui/spice-core.c
-index 2645e96ef6..a8b34d3bf5 100644
+index 8a6050f4ae..25e891e4ba 100644
 --- a/ui/spice-core.c
 +++ b/ui/spice-core.c
-@@ -694,32 +694,35 @@ static void qemu_spice_init(void)
+@@ -696,32 +696,35 @@ static void qemu_spice_init(void)
  
      if (tls_port) {
          x509_dir = qemu_opt_get(opts, "x509-dir");
diff --git a/debian/patches/pve/0005-PVE-Config-glusterfs-no-default-logfile-if-daemonize.patch b/debian/patches/pve/0005-PVE-Config-glusterfs-no-default-logfile-if-daemonize.patch
index aaf2050..45feb82 100644
--- a/debian/patches/pve/0005-PVE-Config-glusterfs-no-default-logfile-if-daemonize.patch
+++ b/debian/patches/pve/0005-PVE-Config-glusterfs-no-default-logfile-if-daemonize.patch
@@ -9,7 +9,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 11 insertions(+), 4 deletions(-)
 
 diff --git a/block/gluster.c b/block/gluster.c
-index 89abd40f31..d3f2e56229 100644
+index 4fb25b2c6d..542cc8da4a 100644
 --- a/block/gluster.c
 +++ b/block/gluster.c
 @@ -42,7 +42,7 @@
@@ -21,7 +21,7 @@ index 89abd40f31..d3f2e56229 100644
  /*
   * Several versions of GlusterFS (3.12? -> 6.0.1) fail when the transfer size
   * is greater or equal to 1024 MiB, so we are limiting the transfer size to 512
-@@ -421,6 +421,7 @@ static struct glfs *qemu_gluster_glfs_init(BlockdevOptionsGluster *gconf,
+@@ -420,6 +420,7 @@ static struct glfs *qemu_gluster_glfs_init(BlockdevOptionsGluster *gconf,
      int old_errno;
      SocketAddressList *server;
      uint64_t port;
@@ -29,7 +29,7 @@ index 89abd40f31..d3f2e56229 100644
  
      glfs = glfs_find_preopened(gconf->volume);
      if (glfs) {
-@@ -463,9 +464,15 @@ static struct glfs *qemu_gluster_glfs_init(BlockdevOptionsGluster *gconf,
+@@ -462,9 +463,15 @@ static struct glfs *qemu_gluster_glfs_init(BlockdevOptionsGluster *gconf,
          }
      }
  
diff --git a/debian/patches/pve/0006-PVE-Config-rbd-block-rbd-disable-rbd_cache_writethro.patch b/debian/patches/pve/0006-PVE-Config-rbd-block-rbd-disable-rbd_cache_writethro.patch
index 573d26a..7100ae1 100644
--- a/debian/patches/pve/0006-PVE-Config-rbd-block-rbd-disable-rbd_cache_writethro.patch
+++ b/debian/patches/pve/0006-PVE-Config-rbd-block-rbd-disable-rbd_cache_writethro.patch
@@ -18,10 +18,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 2 insertions(+)
 
 diff --git a/block/rbd.c b/block/rbd.c
-index 3611dc81cf..d114119671 100644
+index 2a70b5a983..c0da22ed7b 100644
 --- a/block/rbd.c
 +++ b/block/rbd.c
-@@ -1017,6 +1017,8 @@ static int qemu_rbd_connect(rados_t *cluster, rados_ioctx_t *io_ctx,
+@@ -1015,6 +1015,8 @@ static int qemu_rbd_connect(rados_t *cluster, rados_ioctx_t *io_ctx,
          rados_conf_set(*cluster, "rbd_cache", "false");
      }
  
diff --git a/debian/patches/pve/0007-PVE-Up-glusterfs-allow-partial-reads.patch b/debian/patches/pve/0007-PVE-Up-glusterfs-allow-partial-reads.patch
index dd3b92f..8b94617 100644
--- a/debian/patches/pve/0007-PVE-Up-glusterfs-allow-partial-reads.patch
+++ b/debian/patches/pve/0007-PVE-Up-glusterfs-allow-partial-reads.patch
@@ -11,23 +11,25 @@ treating partial reads as errors doesn't seem to make much
 sense.
 
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+[FE: rebase for 10.2.0]
+Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
  block/gluster.c | 10 +++++++++-
  1 file changed, 9 insertions(+), 1 deletion(-)
 
 diff --git a/block/gluster.c b/block/gluster.c
-index d3f2e56229..de0fb4cf68 100644
+index 542cc8da4a..ba0f92ce52 100644
 --- a/block/gluster.c
 +++ b/block/gluster.c
-@@ -57,6 +57,7 @@ typedef struct GlusterAIOCB {
+@@ -56,6 +56,7 @@ typedef struct GlusterAIOCB {
+     int64_t size;
      int ret;
      Coroutine *coroutine;
-     AioContext *aio_context;
 +    bool is_write;
  } GlusterAIOCB;
  
  typedef struct BDRVGlusterState {
-@@ -746,8 +747,10 @@ static void gluster_finish_aiocb(struct glfs_fd *fd, ssize_t ret,
+@@ -745,8 +746,10 @@ static void gluster_finish_aiocb(struct glfs_fd *fd, ssize_t ret,
          acb->ret = 0; /* Success */
      } else if (ret < 0) {
          acb->ret = -errno; /* Read/Write failed */
@@ -38,17 +40,17 @@ index d3f2e56229..de0fb4cf68 100644
 +        acb->ret = 0; /* Success */
      }
  
-     aio_co_schedule(acb->aio_context, acb->coroutine);
-@@ -1014,6 +1017,7 @@ static coroutine_fn int qemu_gluster_co_pwrite_zeroes(BlockDriverState *bs,
+     /*
+@@ -1022,6 +1025,7 @@ static coroutine_fn int qemu_gluster_co_pwrite_zeroes(BlockDriverState *bs,
+     acb.size = bytes;
      acb.ret = 0;
      acb.coroutine = qemu_coroutine_self();
-     acb.aio_context = bdrv_get_aio_context(bs);
 +    acb.is_write = true;
  
      ret = glfs_zerofill_async(s->fd, offset, bytes, gluster_finish_aiocb, &acb);
      if (ret < 0) {
-@@ -1194,9 +1198,11 @@ static coroutine_fn int qemu_gluster_co_rw(BlockDriverState *bs,
-     acb.aio_context = bdrv_get_aio_context(bs);
+@@ -1201,9 +1205,11 @@ static coroutine_fn int qemu_gluster_co_rw(BlockDriverState *bs,
+     acb.coroutine = qemu_coroutine_self();
  
      if (write) {
 +        acb.is_write = true;
@@ -59,18 +61,18 @@ index d3f2e56229..de0fb4cf68 100644
          ret = glfs_preadv_async(s->fd, qiov->iov, qiov->niov, offset, 0,
                                  gluster_finish_aiocb, &acb);
      }
-@@ -1259,6 +1265,7 @@ static coroutine_fn int qemu_gluster_co_flush_to_disk(BlockDriverState *bs)
+@@ -1265,6 +1271,7 @@ static coroutine_fn int qemu_gluster_co_flush_to_disk(BlockDriverState *bs)
+     acb.size = 0;
      acb.ret = 0;
      acb.coroutine = qemu_coroutine_self();
-     acb.aio_context = bdrv_get_aio_context(bs);
 +    acb.is_write = true;
  
      ret = glfs_fsync_async(s->fd, gluster_finish_aiocb, &acb);
      if (ret < 0) {
-@@ -1307,6 +1314,7 @@ static coroutine_fn int qemu_gluster_co_pdiscard(BlockDriverState *bs,
+@@ -1312,6 +1319,7 @@ static coroutine_fn int qemu_gluster_co_pdiscard(BlockDriverState *bs,
+     acb.size = 0;
      acb.ret = 0;
      acb.coroutine = qemu_coroutine_self();
-     acb.aio_context = bdrv_get_aio_context(bs);
 +    acb.is_write = true;
  
      ret = glfs_discard_async(s->fd, offset, bytes, gluster_finish_aiocb, &acb);
diff --git a/debian/patches/pve/0008-PVE-Up-qemu-img-return-success-on-info-without-snaps.patch b/debian/patches/pve/0008-PVE-Up-qemu-img-return-success-on-info-without-snaps.patch
index 7710b06..eb01c67 100644
--- a/debian/patches/pve/0008-PVE-Up-qemu-img-return-success-on-info-without-snaps.patch
+++ b/debian/patches/pve/0008-PVE-Up-qemu-img-return-success-on-info-without-snaps.patch
@@ -9,12 +9,12 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/qemu-img.c b/qemu-img.c
-index 7a162fdc08..0bed551960 100644
+index c42dd4e995..616eebc42b 100644
 --- a/qemu-img.c
 +++ b/qemu-img.c
-@@ -3158,7 +3158,8 @@ static int img_info(const img_cmd_t *ccmd, int argc, char **argv)
-     list = collect_image_info_list(image_opts, filename, fmt, chain,
-                                    force_share);
+@@ -3184,7 +3184,8 @@ static int img_info(const img_cmd_t *ccmd, int argc, char **argv)
+     list = collect_image_info_list(image_opts, filename, fmt, cache, chain,
+                                    limits, force_share);
      if (!list) {
 -        return 1;
 + 	// return success if snapshot does not exist
diff --git a/debian/patches/pve/0009-PVE-Up-qemu-img-dd-add-osize-and-read-from-to-stdin-.patch b/debian/patches/pve/0009-PVE-Up-qemu-img-dd-add-osize-and-read-from-to-stdin-.patch
index c9e1f34..7b31e4b 100644
--- a/debian/patches/pve/0009-PVE-Up-qemu-img-dd-add-osize-and-read-from-to-stdin-.patch
+++ b/debian/patches/pve/0009-PVE-Up-qemu-img-dd-add-osize-and-read-from-to-stdin-.patch
@@ -39,7 +39,7 @@ Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
  2 files changed, 133 insertions(+), 73 deletions(-)
 
 diff --git a/qemu-img-cmds.hx b/qemu-img-cmds.hx
-index 2c5a8a28f9..a6de1434a3 100644
+index 6bc8265cfb..85458ea2d8 100644
 --- a/qemu-img-cmds.hx
 +++ b/qemu-img-cmds.hx
 @@ -60,9 +60,9 @@ SRST
@@ -55,10 +55,10 @@ index 2c5a8a28f9..a6de1434a3 100644
  
  DEF("info", img_info,
 diff --git a/qemu-img.c b/qemu-img.c
-index 0bed551960..0a0ca0cec7 100644
+index 616eebc42b..bf7c637d48 100644
 --- a/qemu-img.c
 +++ b/qemu-img.c
-@@ -5253,10 +5253,12 @@ static int img_bitmap(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5279,10 +5279,12 @@ static int img_bitmap(const img_cmd_t *ccmd, int argc, char **argv)
  #define C_IF      04
  #define C_OF      010
  #define C_SKIP    020
@@ -71,7 +71,7 @@ index 0bed551960..0a0ca0cec7 100644
  };
  
  struct DdIo {
-@@ -5332,6 +5334,19 @@ static int img_dd_skip(const char *arg,
+@@ -5358,6 +5360,19 @@ static int img_dd_skip(const char *arg,
      return 0;
  }
  
@@ -91,7 +91,7 @@ index 0bed551960..0a0ca0cec7 100644
  static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
  {
      int ret = 0;
-@@ -5372,6 +5387,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5398,6 +5413,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
          { "if", img_dd_if, C_IF },
          { "of", img_dd_of, C_OF },
          { "skip", img_dd_skip, C_SKIP },
@@ -99,7 +99,7 @@ index 0bed551960..0a0ca0cec7 100644
          { NULL, NULL, 0 }
      };
      const struct option long_options[] = {
-@@ -5469,91 +5485,112 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5495,91 +5511,112 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
          arg = NULL;
      }
  
@@ -276,7 +276,7 @@ index 0bed551960..0a0ca0cec7 100644
      }
  
      if (dd.flags & C_SKIP && (in.offset > INT64_MAX / in.bsz ||
-@@ -5570,20 +5607,43 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5596,20 +5633,43 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
      in.buf = g_new(uint8_t, in.bsz);
  
      for (out_pos = 0; in_pos < size; ) {
diff --git a/debian/patches/pve/0010-PVE-Up-qemu-img-dd-add-isize-parameter.patch b/debian/patches/pve/0010-PVE-Up-qemu-img-dd-add-isize-parameter.patch
index fbf92a1..a6bd8d8 100644
--- a/debian/patches/pve/0010-PVE-Up-qemu-img-dd-add-isize-parameter.patch
+++ b/debian/patches/pve/0010-PVE-Up-qemu-img-dd-add-isize-parameter.patch
@@ -17,10 +17,10 @@ Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
  1 file changed, 25 insertions(+), 3 deletions(-)
 
 diff --git a/qemu-img.c b/qemu-img.c
-index 0a0ca0cec7..89ef74ae07 100644
+index bf7c637d48..84fd7d5470 100644
 --- a/qemu-img.c
 +++ b/qemu-img.c
-@@ -5254,11 +5254,13 @@ static int img_bitmap(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5280,11 +5280,13 @@ static int img_bitmap(const img_cmd_t *ccmd, int argc, char **argv)
  #define C_OF      010
  #define C_SKIP    020
  #define C_OSIZE   040
@@ -34,7 +34,7 @@ index 0a0ca0cec7..89ef74ae07 100644
  };
  
  struct DdIo {
-@@ -5347,6 +5349,19 @@ static int img_dd_osize(const char *arg,
+@@ -5373,6 +5375,19 @@ static int img_dd_osize(const char *arg,
      return 0;
  }
  
@@ -54,7 +54,7 @@ index 0a0ca0cec7..89ef74ae07 100644
  static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
  {
      int ret = 0;
-@@ -5361,12 +5376,14 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5387,12 +5402,14 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
      int c, i;
      const char *out_fmt = "raw";
      const char *fmt = NULL;
@@ -70,7 +70,7 @@ index 0a0ca0cec7..89ef74ae07 100644
      };
      struct DdIo in = {
          .bsz = 512, /* Block size is by default 512 bytes */
-@@ -5388,6 +5405,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5414,6 +5431,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
          { "of", img_dd_of, C_OF },
          { "skip", img_dd_skip, C_SKIP },
          { "osize", img_dd_osize, C_OSIZE },
@@ -78,7 +78,7 @@ index 0a0ca0cec7..89ef74ae07 100644
          { NULL, NULL, 0 }
      };
      const struct option long_options[] = {
-@@ -5606,9 +5624,10 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5632,9 +5650,10 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
  
      in.buf = g_new(uint8_t, in.bsz);
  
@@ -91,7 +91,7 @@ index 0a0ca0cec7..89ef74ae07 100644
          if (blk1) {
              in_ret = blk_pread(blk1, in_pos, bytes, in.buf, 0);
              if (in_ret == 0) {
-@@ -5617,6 +5636,9 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5643,6 +5662,9 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
          } else {
              in_ret = read(STDIN_FILENO, in.buf, bytes);
              if (in_ret == 0) {
diff --git a/debian/patches/pve/0011-PVE-Up-qemu-img-dd-add-n-skip_create.patch b/debian/patches/pve/0011-PVE-Up-qemu-img-dd-add-n-skip_create.patch
index ee936c5..856505c 100644
--- a/debian/patches/pve/0011-PVE-Up-qemu-img-dd-add-n-skip_create.patch
+++ b/debian/patches/pve/0011-PVE-Up-qemu-img-dd-add-n-skip_create.patch
@@ -5,7 +5,7 @@ Subject: [PATCH] PVE: [Up] qemu-img dd: add -n skip_create
 
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 [FE: fix getopt-string + add documentation
-     rebase for 10.1.0]
+     rebase for 10.2.0]
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
  docs/tools/qemu-img.rst | 11 ++++++++++-
@@ -14,7 +14,7 @@ Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
  3 files changed, 26 insertions(+), 12 deletions(-)
 
 diff --git a/docs/tools/qemu-img.rst b/docs/tools/qemu-img.rst
-index 5e7b85079d..6249e01da9 100644
+index 558b0eb84d..c3fefaab07 100644
 --- a/docs/tools/qemu-img.rst
 +++ b/docs/tools/qemu-img.rst
 @@ -212,6 +212,10 @@ Parameters to convert subcommand:
@@ -46,11 +46,11 @@ index 5e7b85079d..6249e01da9 100644
 +  volume has already been created with site specific options that cannot
 +  be supplied through ``qemu-img``.
 +
- .. option:: info [--object OBJECTDEF] [--image-opts] [-f FMT] [--output=OFMT] [--backing-chain] [-U] FILENAME
+ .. option:: info [--object OBJECTDEF] [--image-opts] [-f FMT] [--output=OFMT] [--backing-chain] [--limits] [-t CACHE] [-U] FILENAME
  
    Give information about the disk image *FILENAME*. Use it in
 diff --git a/qemu-img-cmds.hx b/qemu-img-cmds.hx
-index a6de1434a3..d584624f8e 100644
+index 85458ea2d8..f97c2fa396 100644
 --- a/qemu-img-cmds.hx
 +++ b/qemu-img-cmds.hx
 @@ -60,9 +60,9 @@ SRST
@@ -66,10 +66,10 @@ index a6de1434a3..d584624f8e 100644
  
  DEF("info", img_info,
 diff --git a/qemu-img.c b/qemu-img.c
-index 89ef74ae07..6e92a70254 100644
+index 84fd7d5470..c484479fc5 100644
 --- a/qemu-img.c
 +++ b/qemu-img.c
-@@ -5378,7 +5378,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5404,7 +5404,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
      const char *fmt = NULL;
      int64_t size = 0, readsize = 0;
      int64_t out_pos, in_pos;
@@ -78,7 +78,7 @@ index 89ef74ae07..6e92a70254 100644
      struct DdInfo dd = {
          .flags = 0,
          .count = 0,
-@@ -5418,7 +5418,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5444,7 +5444,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
          { 0, 0, 0, 0 }
      };
  
@@ -87,7 +87,7 @@ index 89ef74ae07..6e92a70254 100644
          if (c == EOF) {
              break;
          }
-@@ -5459,6 +5459,9 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5485,6 +5485,9 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
          case 'O':
              out_fmt = optarg;
              break;
@@ -97,7 +97,7 @@ index 89ef74ae07..6e92a70254 100644
          case 'U':
              force_share = true;
              break;
-@@ -5588,13 +5591,15 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5614,13 +5617,15 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
                                  size - in.bsz * in.offset, &error_abort);
          }
  
diff --git a/debian/patches/pve/0012-qemu-img-dd-add-l-option-for-loading-a-snapshot.patch b/debian/patches/pve/0012-qemu-img-dd-add-l-option-for-loading-a-snapshot.patch
index edea617..6b1731a 100644
--- a/debian/patches/pve/0012-qemu-img-dd-add-l-option-for-loading-a-snapshot.patch
+++ b/debian/patches/pve/0012-qemu-img-dd-add-l-option-for-loading-a-snapshot.patch
@@ -14,7 +14,7 @@ Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
  3 files changed, 36 insertions(+), 7 deletions(-)
 
 diff --git a/docs/tools/qemu-img.rst b/docs/tools/qemu-img.rst
-index 6249e01da9..0ea21e061f 100644
+index c3fefaab07..9da1e526fb 100644
 --- a/docs/tools/qemu-img.rst
 +++ b/docs/tools/qemu-img.rst
 @@ -496,10 +496,10 @@ Command description:
@@ -32,7 +32,7 @@ index 6249e01da9..0ea21e061f 100644
    The data is by default read and written using blocks of 512 bytes but can be
    modified by specifying *BLOCK_SIZE*. If count=\ *BLOCKS* is specified
 diff --git a/qemu-img-cmds.hx b/qemu-img-cmds.hx
-index d584624f8e..be30905374 100644
+index f97c2fa396..206ca7381c 100644
 --- a/qemu-img-cmds.hx
 +++ b/qemu-img-cmds.hx
 @@ -60,9 +60,9 @@ SRST
@@ -48,10 +48,10 @@ index d584624f8e..be30905374 100644
  
  DEF("info", img_info,
 diff --git a/qemu-img.c b/qemu-img.c
-index 6e92a70254..e38317a445 100644
+index c484479fc5..d738ea5185 100644
 --- a/qemu-img.c
 +++ b/qemu-img.c
-@@ -5370,6 +5370,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5396,6 +5396,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
      BlockDriver *drv = NULL, *proto_drv = NULL;
      BlockBackend *blk1 = NULL, *blk2 = NULL;
      QemuOpts *opts = NULL;
@@ -59,7 +59,7 @@ index 6e92a70254..e38317a445 100644
      QemuOptsList *create_opts = NULL;
      Error *local_err = NULL;
      bool image_opts = false;
-@@ -5379,6 +5380,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5405,6 +5406,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
      int64_t size = 0, readsize = 0;
      int64_t out_pos, in_pos;
      bool force_share = false, skip_create = false;
@@ -67,7 +67,7 @@ index 6e92a70254..e38317a445 100644
      struct DdInfo dd = {
          .flags = 0,
          .count = 0,
-@@ -5418,7 +5420,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5444,7 +5446,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
          { 0, 0, 0, 0 }
      };
  
@@ -76,7 +76,7 @@ index 6e92a70254..e38317a445 100644
          if (c == EOF) {
              break;
          }
-@@ -5462,6 +5464,19 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5488,6 +5490,19 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
          case 'n':
              skip_create = true;
              break;
@@ -96,7 +96,7 @@ index 6e92a70254..e38317a445 100644
          case 'U':
              force_share = true;
              break;
-@@ -5520,11 +5535,24 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5546,11 +5561,24 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
      if (dd.flags & C_IF) {
          blk1 = img_open(image_opts, in.filename, fmt, 0, false, false,
                          force_share);
@@ -122,7 +122,7 @@ index 6e92a70254..e38317a445 100644
      }
  
      if (dd.flags & C_OSIZE) {
-@@ -5679,6 +5707,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
+@@ -5705,6 +5733,7 @@ static int img_dd(const img_cmd_t *ccmd, int argc, char **argv)
  out:
      g_free(arg);
      qemu_opts_del(opts);
diff --git a/debian/patches/pve/0013-PVE-virtio-balloon-improve-query-balloon.patch b/debian/patches/pve/0013-PVE-virtio-balloon-improve-query-balloon.patch
index d440dbb..b098ca9 100644
--- a/debian/patches/pve/0013-PVE-virtio-balloon-improve-query-balloon.patch
+++ b/debian/patches/pve/0013-PVE-virtio-balloon-improve-query-balloon.patch
@@ -18,10 +18,10 @@ Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
  4 files changed, 82 insertions(+), 4 deletions(-)
 
 diff --git a/hw/core/machine-hmp-cmds.c b/hw/core/machine-hmp-cmds.c
-index 3a612e2232..036d87cc90 100644
+index 74a56600be..fe4ad00c16 100644
 --- a/hw/core/machine-hmp-cmds.c
 +++ b/hw/core/machine-hmp-cmds.c
-@@ -182,7 +182,35 @@ void hmp_info_balloon(Monitor *mon, const QDict *qdict)
+@@ -200,7 +200,35 @@ void hmp_info_balloon(Monitor *mon, const QDict *qdict)
          return;
      }
  
@@ -59,10 +59,10 @@ index 3a612e2232..036d87cc90 100644
      qapi_free_BalloonInfo(info);
  }
 diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
-index db787d00b3..26ebf3a5ce 100644
+index 02cdd807d7..a49cf294e4 100644
 --- a/hw/virtio/virtio-balloon.c
 +++ b/hw/virtio/virtio-balloon.c
-@@ -795,8 +795,37 @@ static uint64_t virtio_balloon_get_features(VirtIODevice *vdev, uint64_t f,
+@@ -796,8 +796,37 @@ static uint64_t virtio_balloon_get_features(VirtIODevice *vdev, uint64_t f,
  static void virtio_balloon_stat(void *opaque, BalloonInfo *info)
  {
      VirtIOBalloon *dev = opaque;
@@ -103,7 +103,7 @@ index db787d00b3..26ebf3a5ce 100644
  
  static void virtio_balloon_to_target(void *opaque, ram_addr_t target)
 diff --git a/qapi/machine.json b/qapi/machine.json
-index 038eab281c..5f172ece18 100644
+index 907cb25f75..0eaf36b0fe 100644
 --- a/qapi/machine.json
 +++ b/qapi/machine.json
 @@ -1125,9 +1125,29 @@
diff --git a/debian/patches/pve/0014-PVE-qapi-modify-query-machines.patch b/debian/patches/pve/0014-PVE-qapi-modify-query-machines.patch
index a131d2b..eb13f82 100644
--- a/debian/patches/pve/0014-PVE-qapi-modify-query-machines.patch
+++ b/debian/patches/pve/0014-PVE-qapi-modify-query-machines.patch
@@ -13,10 +13,10 @@ Signed-off-by: Dietmar Maurer <dietmar@proxmox.com>
  2 files changed, 9 insertions(+), 1 deletion(-)
 
 diff --git a/hw/core/machine-qmp-cmds.c b/hw/core/machine-qmp-cmds.c
-index 6aca1a626e..934cdb886d 100644
+index 28dfd3e15b..55e4550cd4 100644
 --- a/hw/core/machine-qmp-cmds.c
 +++ b/hw/core/machine-qmp-cmds.c
-@@ -94,6 +94,12 @@ MachineInfoList *qmp_query_machines(bool has_compat_props, bool compat_props,
+@@ -120,6 +120,12 @@ MachineInfoList *qmp_query_machines(bool has_compat_props, bool compat_props,
          info->numa_mem_supported = mc->numa_mem_supported;
          info->deprecated = !!mc->deprecation_reason;
          info->acpi = !!object_class_property_find(OBJECT_CLASS(mc), "acpi");
@@ -30,7 +30,7 @@ index 6aca1a626e..934cdb886d 100644
              info->default_cpu_type = g_strdup(default_cpu_type);
          }
 diff --git a/qapi/machine.json b/qapi/machine.json
-index 5f172ece18..47ac68a3b5 100644
+index 0eaf36b0fe..e981da9fbb 100644
 --- a/qapi/machine.json
 +++ b/qapi/machine.json
 @@ -170,6 +170,8 @@
diff --git a/debian/patches/pve/0015-PVE-qapi-modify-spice-query.patch b/debian/patches/pve/0015-PVE-qapi-modify-spice-query.patch
index 02ec05b..cf1993a 100644
--- a/debian/patches/pve/0015-PVE-qapi-modify-spice-query.patch
+++ b/debian/patches/pve/0015-PVE-qapi-modify-spice-query.patch
@@ -14,7 +14,7 @@ Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
  2 files changed, 7 insertions(+)
 
 diff --git a/qapi/ui.json b/qapi/ui.json
-index 1b2f4a4769..c9982e1bcc 100644
+index e3da77632a..cf58718ece 100644
 --- a/qapi/ui.json
 +++ b/qapi/ui.json
 @@ -315,11 +315,14 @@
@@ -33,10 +33,10 @@ index 1b2f4a4769..c9982e1bcc 100644
    'if': 'CONFIG_SPICE' }
  
 diff --git a/ui/spice-core.c b/ui/spice-core.c
-index a8b34d3bf5..994079ec87 100644
+index 25e891e4ba..daad8a7f1f 100644
 --- a/ui/spice-core.c
 +++ b/ui/spice-core.c
-@@ -554,6 +554,10 @@ static SpiceInfo *qmp_query_spice_real(Error **errp)
+@@ -556,6 +556,10 @@ static SpiceInfo *qmp_query_spice_real(Error **errp)
      micro = SPICE_SERVER_VERSION & 0xff;
      info->compiled_version = g_strdup_printf("%d.%d.%d", major, minor, micro);
  
diff --git a/debian/patches/pve/0016-PVE-add-IOChannel-implementation-for-savevm-async.patch b/debian/patches/pve/0016-PVE-add-IOChannel-implementation-for-savevm-async.patch
index 4e84027..cdc7811 100644
--- a/debian/patches/pve/0016-PVE-add-IOChannel-implementation-for-savevm-async.patch
+++ b/debian/patches/pve/0016-PVE-add-IOChannel-implementation-for-savevm-async.patch
@@ -271,7 +271,7 @@ index 0000000000..17ae2cb261
 +
 +#endif /* QIO_CHANNEL_SAVEVM_ASYNC_H */
 diff --git a/migration/meson.build b/migration/meson.build
-index 276da3be5a..1d32185fff 100644
+index 16909d54c5..e79f95bb6c 100644
 --- a/migration/meson.build
 +++ b/migration/meson.build
 @@ -14,6 +14,7 @@ system_ss.add(files(
@@ -281,4 +281,4 @@ index 276da3be5a..1d32185fff 100644
 +  'channel-savevm-async.c',
    'cpr.c',
    'cpr-transfer.c',
-   'cpu-throttle.c',
+   'cpr-exec.c',
diff --git a/debian/patches/pve/0017-PVE-add-savevm-async-for-background-state-snapshots.patch b/debian/patches/pve/0017-PVE-add-savevm-async-for-background-state-snapshots.patch
index 9401690..7ca1e70 100644
--- a/debian/patches/pve/0017-PVE-add-savevm-async-for-background-state-snapshots.patch
+++ b/debian/patches/pve/0017-PVE-add-savevm-async-for-background-state-snapshots.patch
@@ -42,20 +42,20 @@ Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
  include/migration/snapshot.h |   2 +
  include/monitor/hmp.h        |   3 +
  migration/meson.build        |   1 +
- migration/savevm-async.c     | 581 +++++++++++++++++++++++++++++++++++
+ migration/savevm-async.c     | 586 +++++++++++++++++++++++++++++++++++
  monitor/hmp-cmds.c           |  38 +++
  qapi/migration.json          |  34 ++
  qapi/misc.json               |  18 ++
  qemu-options.hx              |  12 +
  system/vl.c                  |  10 +
- 11 files changed, 729 insertions(+)
+ 11 files changed, 734 insertions(+)
  create mode 100644 migration/savevm-async.c
 
 diff --git a/hmp-commands-info.hx b/hmp-commands-info.hx
-index 6142f60e7b..3e15458335 100644
+index 41674dcbe1..9b6cc87127 100644
 --- a/hmp-commands-info.hx
 +++ b/hmp-commands-info.hx
-@@ -510,6 +510,19 @@ SRST
+@@ -530,6 +530,19 @@ SRST
      Show current migration parameters.
  ERST
  
@@ -76,10 +76,10 @@ index 6142f60e7b..3e15458335 100644
          .name       = "balloon",
          .args_type  = "",
 diff --git a/hmp-commands.hx b/hmp-commands.hx
-index d0e4f35a30..0d9241db9e 100644
+index 5cc4788f12..eda6225ef1 100644
 --- a/hmp-commands.hx
 +++ b/hmp-commands.hx
-@@ -1862,3 +1862,20 @@ SRST
+@@ -1867,3 +1867,20 @@ SRST
    List event channels in the guest
  ERST
  #endif
@@ -112,10 +112,10 @@ index 9e4dcaaa75..2581730d74 100644
 +
  #endif
 diff --git a/include/monitor/hmp.h b/include/monitor/hmp.h
-index ae116d9804..2596cc2426 100644
+index 83721b5ffc..f05423ceda 100644
 --- a/include/monitor/hmp.h
 +++ b/include/monitor/hmp.h
-@@ -28,6 +28,7 @@ void hmp_info_status(Monitor *mon, const QDict *qdict);
+@@ -29,6 +29,7 @@ void hmp_info_status(Monitor *mon, const QDict *qdict);
  void hmp_info_uuid(Monitor *mon, const QDict *qdict);
  void hmp_info_chardev(Monitor *mon, const QDict *qdict);
  void hmp_info_mice(Monitor *mon, const QDict *qdict);
@@ -123,7 +123,7 @@ index ae116d9804..2596cc2426 100644
  void hmp_info_migrate(Monitor *mon, const QDict *qdict);
  void hmp_info_migrate_capabilities(Monitor *mon, const QDict *qdict);
  void hmp_info_migrate_parameters(Monitor *mon, const QDict *qdict);
-@@ -92,6 +93,8 @@ void hmp_closefd(Monitor *mon, const QDict *qdict);
+@@ -93,6 +94,8 @@ void hmp_closefd(Monitor *mon, const QDict *qdict);
  void hmp_mouse_move(Monitor *mon, const QDict *qdict);
  void hmp_mouse_button(Monitor *mon, const QDict *qdict);
  void hmp_mouse_set(Monitor *mon, const QDict *qdict);
@@ -133,12 +133,12 @@ index ae116d9804..2596cc2426 100644
  void coroutine_fn hmp_screendump(Monitor *mon, const QDict *qdict);
  void hmp_chardev_add(Monitor *mon, const QDict *qdict);
 diff --git a/migration/meson.build b/migration/meson.build
-index 1d32185fff..409b748980 100644
+index e79f95bb6c..140264b477 100644
 --- a/migration/meson.build
 +++ b/migration/meson.build
-@@ -33,6 +33,7 @@ system_ss.add(files(
-   'options.c',
+@@ -35,6 +35,7 @@ system_ss.add(files(
    'postcopy-ram.c',
+   'ram.c',
    'savevm.c',
 +  'savevm-async.c',
    'socket.c',
@@ -146,10 +146,10 @@ index 1d32185fff..409b748980 100644
    'threadinfo.c',
 diff --git a/migration/savevm-async.c b/migration/savevm-async.c
 new file mode 100644
-index 0000000000..56e0fa6c69
+index 0000000000..5c22c29b9a
 --- /dev/null
 +++ b/migration/savevm-async.c
-@@ -0,0 +1,581 @@
+@@ -0,0 +1,586 @@
 +#include "qemu/osdep.h"
 +#include "migration/channel-savevm-async.h"
 +#include "migration/migration.h"
@@ -703,7 +703,7 @@ index 0000000000..56e0fa6c69
 +    }
 +
 +    qemu_system_reset(SHUTDOWN_CAUSE_NONE);
-+    ret = qemu_loadvm_state(f);
++    ret = qemu_loadvm_state(f, &local_err);
 +
 +    /* dirty bitmap migration has a special case we need to trigger manually */
 +    dirty_bitmap_mig_before_vm_start();
@@ -715,7 +715,12 @@ index 0000000000..56e0fa6c69
 +
 +    migration_incoming_state_destroy();
 +    if (ret < 0) {
-+        error_setg_errno(errp, -ret, "Error while loading VM state");
++        if (local_err) {
++            error_setg_errno(errp, -ret, "Error while loading VM state - %s",
++                             error_get_pretty(local_err));
++        } else {
++            error_setg_errno(errp, -ret, "Error while loading VM state");
++        }
 +        goto the_end;
 +    }
 +
@@ -732,7 +737,7 @@ index 0000000000..56e0fa6c69
 +    return ret;
 +}
 diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
-index 74a0f56566..1e66bff724 100644
+index 33a88ce205..7af9fed7ea 100644
 --- a/monitor/hmp-cmds.c
 +++ b/monitor/hmp-cmds.c
 @@ -24,6 +24,7 @@
@@ -743,7 +748,7 @@ index 74a0f56566..1e66bff724 100644
  #include "qapi/qapi-commands-misc.h"
  #include "qobject/qdict.h"
  #include "qemu/cutils.h"
-@@ -434,3 +435,40 @@ void hmp_dumpdtb(Monitor *mon, const QDict *qdict)
+@@ -435,3 +436,40 @@ void hmp_dumpdtb(Monitor *mon, const QDict *qdict)
      monitor_printf(mon, "DTB dumped to '%s'\n", filename);
  }
  #endif
@@ -785,10 +790,10 @@ index 74a0f56566..1e66bff724 100644
 +    }
 +}
 diff --git a/qapi/migration.json b/qapi/migration.json
-index 2387c21e9c..c1d962b4ed 100644
+index cf023bd29d..f21d06c5a4 100644
 --- a/qapi/migration.json
 +++ b/qapi/migration.json
-@@ -319,6 +319,40 @@
+@@ -330,6 +330,40 @@
             '*dirty-limit-throttle-time-per-round': 'uint64',
             '*dirty-limit-ring-full-time': 'uint64'} }
  
@@ -830,7 +835,7 @@ index 2387c21e9c..c1d962b4ed 100644
  # @query-migrate:
  #
 diff --git a/qapi/misc.json b/qapi/misc.json
-index 28c641fe2f..51d907b2b8 100644
+index 28c641fe2f..5d2f12259a 100644
 --- a/qapi/misc.json
 +++ b/qapi/misc.json
 @@ -449,6 +449,24 @@
@@ -840,7 +845,7 @@ index 28c641fe2f..51d907b2b8 100644
 +##
 +# @savevm-start:
 +#
-+# Prepare for snapshot and halt VM. Save VM state to statefile.
++# Prepare for snapshot and halt VM.  Save VM state to statefile.
 +#
 +# @statefile: target file that state should be written to.
 +#
@@ -859,10 +864,10 @@ index 28c641fe2f..51d907b2b8 100644
  # @CommandLineParameterType:
  #
 diff --git a/qemu-options.hx b/qemu-options.hx
-index ab23f14d21..3ec9e52d31 100644
+index fca2b7bc74..99c04c5ab9 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
-@@ -5048,6 +5048,18 @@ SRST
+@@ -5085,6 +5085,18 @@ SRST
      Start right away with a saved state (``loadvm`` in monitor)
  ERST
  
@@ -882,10 +887,10 @@ index ab23f14d21..3ec9e52d31 100644
  DEF("daemonize", 0, QEMU_OPTION_daemonize, \
      "-daemonize      daemonize QEMU after initializing\n", QEMU_ARCH_ALL)
 diff --git a/system/vl.c b/system/vl.c
-index 3b7057e6c6..28a7d74f5b 100644
+index 5091fe52d9..ab845eb634 100644
 --- a/system/vl.c
 +++ b/system/vl.c
-@@ -173,6 +173,7 @@ static const char *accelerators;
+@@ -174,6 +174,7 @@ static const char *accelerators;
  static bool have_custom_ram_size;
  static const char *ram_memdev_id;
  static QDict *machine_opts_dict;
@@ -893,7 +898,7 @@ index 3b7057e6c6..28a7d74f5b 100644
  static QTAILQ_HEAD(, ObjectOption) object_opts = QTAILQ_HEAD_INITIALIZER(object_opts);
  static QTAILQ_HEAD(, DeviceOption) device_opts = QTAILQ_HEAD_INITIALIZER(device_opts);
  static int display_remote;
-@@ -2811,6 +2812,12 @@ void qmp_x_exit_preconfig(Error **errp)
+@@ -2817,6 +2818,12 @@ void qmp_x_exit_preconfig(Error **errp)
          RunState state = autostart ? RUN_STATE_RUNNING : runstate_get();
          load_snapshot(loadvm, NULL, false, NULL, &error_fatal);
          load_snapshot_resume(state);
@@ -906,7 +911,7 @@ index 3b7057e6c6..28a7d74f5b 100644
      }
      if (replay_mode != REPLAY_MODE_NONE) {
          replay_vmstate_init();
-@@ -3357,6 +3364,9 @@ void qemu_init(int argc, char **argv)
+@@ -3363,6 +3370,9 @@ void qemu_init(int argc, char **argv)
              case QEMU_OPTION_loadvm:
                  loadvm = optarg;
                  break;
diff --git a/debian/patches/pve/0018-PVE-add-optional-buffer-size-to-QEMUFile.patch b/debian/patches/pve/0018-PVE-add-optional-buffer-size-to-QEMUFile.patch
index 9a60ee8..36b6b81 100644
--- a/debian/patches/pve/0018-PVE-add-optional-buffer-size-to-QEMUFile.patch
+++ b/debian/patches/pve/0018-PVE-add-optional-buffer-size-to-QEMUFile.patch
@@ -10,7 +10,7 @@ Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
 [increase max IOV count in QEMUFile to actually write more data]
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
-[FE: adapt to removal of QEMUFileOps]
+[FE: rebase for 10.2.0]
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
  migration/qemu-file.c    | 48 +++++++++++++++++++++++++++-------------
@@ -19,7 +19,7 @@ Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
  3 files changed, 38 insertions(+), 17 deletions(-)
 
 diff --git a/migration/qemu-file.c b/migration/qemu-file.c
-index b6ac190034..46d899edb0 100644
+index 4b5a409a80..5e5e4627e9 100644
 --- a/migration/qemu-file.c
 +++ b/migration/qemu-file.c
 @@ -34,8 +34,8 @@
@@ -63,7 +63,7 @@ index b6ac190034..46d899edb0 100644
  
      return f;
  }
-@@ -129,17 +134,27 @@ static QEMUFile *qemu_file_new_impl(QIOChannel *ioc, bool is_writable)
+@@ -128,17 +133,27 @@ static QEMUFile *qemu_file_new_impl(QIOChannel *ioc, bool is_writable)
   */
  QEMUFile *qemu_file_get_return_path(QEMUFile *f)
  {
@@ -94,16 +94,16 @@ index b6ac190034..46d899edb0 100644
  }
  
  /*
-@@ -339,7 +354,7 @@ static ssize_t coroutine_mixed_fn qemu_fill_buffer(QEMUFile *f)
+@@ -338,7 +353,7 @@ static ssize_t coroutine_mixed_fn qemu_fill_buffer(QEMUFile *f)
      }
  
      do {
 -        struct iovec iov = { f->buf + pending, IO_BUF_SIZE - pending };
 +        struct iovec iov = { f->buf + pending, f->buf_allocated_size - pending };
-         len = qio_channel_readv_full(f->ioc, &iov, 1, pfds, pnfd, 0,
+         len = qio_channel_readv_full(f->ioc, &iov, 1, pfds, pnfd,
+                                      QIO_CHANNEL_READ_FLAG_FD_PRESERVE_BLOCKING,
                                       &local_error);
-         if (len == QIO_CHANNEL_ERR_BLOCK) {
-@@ -443,6 +458,9 @@ int qemu_fclose(QEMUFile *f)
+@@ -435,6 +450,9 @@ int qemu_fclose(QEMUFile *f)
          g_free(fde);
      }
      g_clear_pointer(&f->ioc, object_unref);
@@ -113,7 +113,7 @@ index b6ac190034..46d899edb0 100644
      error_free(f->last_error_obj);
      g_free(f);
      trace_qemu_file_fclose();
-@@ -491,7 +509,7 @@ static void add_buf_to_iovec(QEMUFile *f, size_t len)
+@@ -483,7 +501,7 @@ static void add_buf_to_iovec(QEMUFile *f, size_t len)
  {
      if (!add_to_iovec(f, f->buf + f->buf_index, len, false)) {
          f->buf_index += len;
@@ -122,7 +122,7 @@ index b6ac190034..46d899edb0 100644
              qemu_fflush(f);
          }
      }
-@@ -516,7 +534,7 @@ void qemu_put_buffer(QEMUFile *f, const uint8_t *buf, size_t size)
+@@ -508,7 +526,7 @@ void qemu_put_buffer(QEMUFile *f, const uint8_t *buf, size_t size)
      }
  
      while (size > 0) {
@@ -131,7 +131,7 @@ index b6ac190034..46d899edb0 100644
          if (l > size) {
              l = size;
          }
-@@ -660,8 +678,8 @@ size_t coroutine_mixed_fn qemu_peek_buffer(QEMUFile *f, uint8_t **buf, size_t si
+@@ -652,8 +670,8 @@ size_t coroutine_mixed_fn qemu_peek_buffer(QEMUFile *f, uint8_t **buf, size_t si
      size_t index;
  
      assert(!qemu_file_is_writable(f));
@@ -142,7 +142,7 @@ index b6ac190034..46d899edb0 100644
  
      /* The 1st byte to read from */
      index = f->buf_index + offset;
-@@ -711,7 +729,7 @@ size_t coroutine_mixed_fn qemu_get_buffer(QEMUFile *f, uint8_t *buf, size_t size
+@@ -703,7 +721,7 @@ size_t coroutine_mixed_fn qemu_get_buffer(QEMUFile *f, uint8_t *buf, size_t size
          size_t res;
          uint8_t *src;
  
@@ -151,7 +151,7 @@ index b6ac190034..46d899edb0 100644
          if (res == 0) {
              return done;
          }
-@@ -745,7 +763,7 @@ size_t coroutine_mixed_fn qemu_get_buffer(QEMUFile *f, uint8_t *buf, size_t size
+@@ -737,7 +755,7 @@ size_t coroutine_mixed_fn qemu_get_buffer(QEMUFile *f, uint8_t *buf, size_t size
   */
  size_t coroutine_mixed_fn qemu_get_buffer_in_place(QEMUFile *f, uint8_t **buf, size_t size)
  {
@@ -160,7 +160,7 @@ index b6ac190034..46d899edb0 100644
          size_t res;
          uint8_t *src = NULL;
  
-@@ -770,7 +788,7 @@ int coroutine_mixed_fn qemu_peek_byte(QEMUFile *f, int offset)
+@@ -762,7 +780,7 @@ int coroutine_mixed_fn qemu_peek_byte(QEMUFile *f, int offset)
      int index = f->buf_index + offset;
  
      assert(!qemu_file_is_writable(f));
@@ -170,7 +170,7 @@ index b6ac190034..46d899edb0 100644
      if (index >= f->buf_size) {
          qemu_fill_buffer(f);
 diff --git a/migration/qemu-file.h b/migration/qemu-file.h
-index f5b9f430e0..0179b90698 100644
+index c13c967167..4ab142034f 100644
 --- a/migration/qemu-file.h
 +++ b/migration/qemu-file.h
 @@ -30,7 +30,9 @@
@@ -184,7 +184,7 @@ index f5b9f430e0..0179b90698 100644
  
  G_DEFINE_AUTOPTR_CLEANUP_FUNC(QEMUFile, qemu_fclose)
 diff --git a/migration/savevm-async.c b/migration/savevm-async.c
-index 56e0fa6c69..730b815494 100644
+index 5c22c29b9a..9942557455 100644
 --- a/migration/savevm-async.c
 +++ b/migration/savevm-async.c
 @@ -409,7 +409,7 @@ void qmp_savevm_start(const char *statefile, Error **errp)
diff --git a/debian/patches/pve/0019-PVE-block-add-the-zeroinit-block-driver-filter.patch b/debian/patches/pve/0019-PVE-block-add-the-zeroinit-block-driver-filter.patch
index 79bd6b1..b353177 100644
--- a/debian/patches/pve/0019-PVE-block-add-the-zeroinit-block-driver-filter.patch
+++ b/debian/patches/pve/0019-PVE-block-add-the-zeroinit-block-driver-filter.patch
@@ -247,10 +247,10 @@ index 0000000000..036edb17f5
 +
 +block_init(bdrv_zeroinit_init);
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 7d281ab7ae..aa1dba4284 100644
+index 64f2befdf5..19b60e3a96 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -3305,7 +3305,7 @@
+@@ -3376,7 +3376,7 @@
              { 'name': 'virtio-blk-vfio-pci', 'if': 'CONFIG_BLKIO' },
              { 'name': 'virtio-blk-vhost-user', 'if': 'CONFIG_BLKIO' },
              { 'name': 'virtio-blk-vhost-vdpa', 'if': 'CONFIG_BLKIO' },
@@ -259,7 +259,7 @@ index 7d281ab7ae..aa1dba4284 100644
  
  ##
  # @BlockdevOptionsFile:
-@@ -4863,7 +4863,8 @@
+@@ -4934,7 +4934,8 @@
                        'if': 'CONFIG_BLKIO' },
        'vmdk':       'BlockdevOptionsGenericCOWFormat',
        'vpc':        'BlockdevOptionsGenericFormat',
diff --git a/debian/patches/pve/0020-PVE-Add-dummy-id-command-line-parameter.patch b/debian/patches/pve/0020-PVE-Add-dummy-id-command-line-parameter.patch
index a469996..0194a4b 100644
--- a/debian/patches/pve/0020-PVE-Add-dummy-id-command-line-parameter.patch
+++ b/debian/patches/pve/0020-PVE-Add-dummy-id-command-line-parameter.patch
@@ -14,10 +14,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  2 files changed, 11 insertions(+)
 
 diff --git a/qemu-options.hx b/qemu-options.hx
-index 3ec9e52d31..bb41239111 100644
+index 99c04c5ab9..d0799b80b3 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
-@@ -1285,6 +1285,9 @@ legacy PC, they are not recommended for modern configurations.
+@@ -1315,6 +1315,9 @@ legacy PC, they are not recommended for modern configurations.
  
  ERST
  
@@ -28,10 +28,10 @@ index 3ec9e52d31..bb41239111 100644
      "-fda/-fdb file  use 'file' as floppy disk 0/1 image\n", QEMU_ARCH_ALL)
  DEF("fdb", HAS_ARG, QEMU_OPTION_fdb, "", QEMU_ARCH_ALL)
 diff --git a/system/vl.c b/system/vl.c
-index 28a7d74f5b..56f8900451 100644
+index ab845eb634..6bd8704c82 100644
 --- a/system/vl.c
 +++ b/system/vl.c
-@@ -2851,6 +2851,7 @@ void qemu_init(int argc, char **argv)
+@@ -2857,6 +2857,7 @@ void qemu_init(int argc, char **argv)
      MachineClass *machine_class;
      bool userconfig = true;
      FILE *vmstate_dump_file = NULL;
@@ -39,7 +39,7 @@ index 28a7d74f5b..56f8900451 100644
  
      qemu_add_opts(&qemu_drive_opts);
      qemu_add_drive_opts(&qemu_legacy_drive_opts);
-@@ -3469,6 +3470,13 @@ void qemu_init(int argc, char **argv)
+@@ -3475,6 +3476,13 @@ void qemu_init(int argc, char **argv)
                  machine_parse_property_opt(qemu_find_opts("smp-opts"),
                                             "smp", optarg);
                  break;
diff --git a/debian/patches/pve/0021-PVE-Config-Revert-target-i386-disable-LINT0-after-re.patch b/debian/patches/pve/0021-PVE-Config-Revert-target-i386-disable-LINT0-after-re.patch
index 4316412..8c08d70 100644
--- a/debian/patches/pve/0021-PVE-Config-Revert-target-i386-disable-LINT0-after-re.patch
+++ b/debian/patches/pve/0021-PVE-Config-Revert-target-i386-disable-LINT0-after-re.patch
@@ -6,18 +6,20 @@ Subject: [PATCH] PVE: [Config] Revert "target-i386: disable LINT0 after reset"
 This reverts commit b8eb5512fd8a115f164edbbe897cdf8884920ccb.
 
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+[FE: rebase for 10.2.0]
+Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
  hw/intc/apic_common.c | 9 +++++++++
  1 file changed, 9 insertions(+)
 
 diff --git a/hw/intc/apic_common.c b/hw/intc/apic_common.c
-index 37a7a7019d..444136c665 100644
+index ec9e978b0b..f4e7072fc4 100644
 --- a/hw/intc/apic_common.c
 +++ b/hw/intc/apic_common.c
-@@ -263,6 +263,15 @@ static void apic_reset_common(DeviceState *dev)
+@@ -245,6 +245,15 @@ static void apic_reset_common(DeviceState *dev)
      info->vapic_base_update(s);
  
-     apic_init_reset(dev);
+     apic_init_reset(s);
 +
 +    if (bsp) {
 +        /*
diff --git a/debian/patches/pve/0022-PVE-Up-Config-file-posix-make-locking-optiono-on-cre.patch b/debian/patches/pve/0022-PVE-Up-Config-file-posix-make-locking-optiono-on-cre.patch
index 989695e..2f70373 100644
--- a/debian/patches/pve/0022-PVE-Up-Config-file-posix-make-locking-optiono-on-cre.patch
+++ b/debian/patches/pve/0022-PVE-Up-Config-file-posix-make-locking-optiono-on-cre.patch
@@ -13,10 +13,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  2 files changed, 46 insertions(+), 20 deletions(-)
 
 diff --git a/block/file-posix.c b/block/file-posix.c
-index baac7653db..fc5cf223bc 100644
+index 41ac3f222f..612942a222 100644
 --- a/block/file-posix.c
 +++ b/block/file-posix.c
-@@ -2993,6 +2993,7 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
+@@ -2981,6 +2981,7 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
      int fd;
      uint64_t perm, shared;
      int result = 0;
@@ -24,7 +24,7 @@ index baac7653db..fc5cf223bc 100644
  
      /* Validate options and set default values */
      assert(options->driver == BLOCKDEV_DRIVER_FILE);
-@@ -3033,19 +3034,22 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
+@@ -3021,19 +3022,22 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
      perm = BLK_PERM_WRITE | BLK_PERM_RESIZE;
      shared = BLK_PERM_ALL & ~BLK_PERM_RESIZE;
  
@@ -59,7 +59,7 @@ index baac7653db..fc5cf223bc 100644
      }
  
      /* Clear the file by truncating it to 0 */
-@@ -3099,13 +3103,15 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
+@@ -3087,13 +3091,15 @@ raw_co_create(BlockdevCreateOptions *options, Error **errp)
      }
  
  out_unlock:
@@ -82,7 +82,7 @@ index baac7653db..fc5cf223bc 100644
      }
  
  out_close:
-@@ -3129,6 +3135,7 @@ raw_co_create_opts(BlockDriver *drv, const char *filename,
+@@ -3117,6 +3123,7 @@ raw_co_create_opts(BlockDriver *drv, const char *filename,
      PreallocMode prealloc;
      char *buf = NULL;
      Error *local_err = NULL;
@@ -90,7 +90,7 @@ index baac7653db..fc5cf223bc 100644
  
      /* Skip file: protocol prefix */
      strstart(filename, "file:", &filename);
-@@ -3151,6 +3158,18 @@ raw_co_create_opts(BlockDriver *drv, const char *filename,
+@@ -3139,6 +3146,18 @@ raw_co_create_opts(BlockDriver *drv, const char *filename,
          return -EINVAL;
      }
  
@@ -109,7 +109,7 @@ index baac7653db..fc5cf223bc 100644
      options = (BlockdevCreateOptions) {
          .driver     = BLOCKDEV_DRIVER_FILE,
          .u.file     = {
-@@ -3162,6 +3181,8 @@ raw_co_create_opts(BlockDriver *drv, const char *filename,
+@@ -3150,6 +3169,8 @@ raw_co_create_opts(BlockDriver *drv, const char *filename,
              .nocow              = nocow,
              .has_extent_size_hint = has_extent_size_hint,
              .extent_size_hint   = extent_size_hint,
@@ -119,10 +119,10 @@ index baac7653db..fc5cf223bc 100644
      };
      return raw_co_create(&options, errp);
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index aa1dba4284..e17ef6abdf 100644
+index 19b60e3a96..029b8f2b51 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -5081,6 +5081,10 @@
+@@ -5153,6 +5153,10 @@
  # @extent-size-hint: Extent size hint to add to the image file; 0 for
  #     not adding an extent size hint (default: 1 MB, since 5.1)
  #
@@ -133,7 +133,7 @@ index aa1dba4284..e17ef6abdf 100644
  # Since: 2.12
  ##
  { 'struct': 'BlockdevCreateOptionsFile',
-@@ -5088,7 +5092,8 @@
+@@ -5160,7 +5164,8 @@
              'size':                 'size',
              '*preallocation':       'PreallocMode',
              '*nocow':               'bool',
diff --git a/debian/patches/pve/0023-PVE-monitor-disable-oob-capability.patch b/debian/patches/pve/0023-PVE-monitor-disable-oob-capability.patch
index 4830740..2595faf 100644
--- a/debian/patches/pve/0023-PVE-monitor-disable-oob-capability.patch
+++ b/debian/patches/pve/0023-PVE-monitor-disable-oob-capability.patch
@@ -18,7 +18,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 1 insertion(+), 2 deletions(-)
 
 diff --git a/monitor/qmp.c b/monitor/qmp.c
-index 170fef4531..448403b45b 100644
+index 16c20305d2..707c9cd419 100644
 --- a/monitor/qmp.c
 +++ b/monitor/qmp.c
 @@ -535,8 +535,7 @@ void monitor_init_qmp(Chardev *chr, bool pretty, Error **errp)
diff --git a/debian/patches/pve/0024-PVE-Compat-4.0-used-balloon-qemu-4-0-config-size-fal.patch b/debian/patches/pve/0024-PVE-Compat-4.0-used-balloon-qemu-4-0-config-size-fal.patch
index d59e085..376c97d 100644
--- a/debian/patches/pve/0024-PVE-Compat-4.0-used-balloon-qemu-4-0-config-size-fal.patch
+++ b/debian/patches/pve/0024-PVE-Compat-4.0-used-balloon-qemu-4-0-config-size-fal.patch
@@ -26,10 +26,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/hw/core/machine.c b/hw/core/machine.c
-index bd47527479..e59b12d9f0 100644
+index 27372bb01e..24ac725adf 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
-@@ -201,7 +201,8 @@ GlobalProperty hw_compat_4_0[] = {
+@@ -211,7 +211,8 @@ GlobalProperty hw_compat_4_0[] = {
      { "virtio-vga",     "edid", "false" },
      { "virtio-gpu-device", "edid", "false" },
      { "virtio-device", "use-started", "false" },
diff --git a/debian/patches/pve/0025-PVE-Allow-version-code-in-machine-type.patch b/debian/patches/pve/0025-PVE-Allow-version-code-in-machine-type.patch
index 74421a1..8d2cc03 100644
--- a/debian/patches/pve/0025-PVE-Allow-version-code-in-machine-type.patch
+++ b/debian/patches/pve/0025-PVE-Allow-version-code-in-machine-type.patch
@@ -11,7 +11,7 @@ and only if 'is-current').
 
 Signed-off-by: Stefan Reiter <s.reiter@proxmox.com>
 Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
-[FE: adapt to QAPI changes]
+[FE: rebase for 10.2.0]
 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
 ---
  hw/core/machine-qmp-cmds.c |  5 +++++
@@ -21,10 +21,10 @@ Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
  4 files changed, 34 insertions(+)
 
 diff --git a/hw/core/machine-qmp-cmds.c b/hw/core/machine-qmp-cmds.c
-index 934cdb886d..124000b771 100644
+index 55e4550cd4..6404fba525 100644
 --- a/hw/core/machine-qmp-cmds.c
 +++ b/hw/core/machine-qmp-cmds.c
-@@ -98,6 +98,11 @@ MachineInfoList *qmp_query_machines(bool has_compat_props, bool compat_props,
+@@ -124,6 +124,11 @@ MachineInfoList *qmp_query_machines(bool has_compat_props, bool compat_props,
          if (strcmp(mc->name, MACHINE_GET_CLASS(current_machine)->name) == 0) {
              info->has_is_current = true;
              info->is_current = true;
@@ -37,10 +37,10 @@ index 934cdb886d..124000b771 100644
  
          if (default_cpu_type) {
 diff --git a/include/hw/boards.h b/include/hw/boards.h
-index f94713e6e2..7a389f6998 100644
+index a48ed4f86a..dfa1dc0bb7 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
-@@ -271,6 +271,8 @@ struct MachineClass {
+@@ -273,6 +273,8 @@ struct MachineClass {
      const char *desc;
      const char *deprecation_reason;
  
@@ -50,7 +50,7 @@ index f94713e6e2..7a389f6998 100644
      void (*reset)(MachineState *state, ResetType type);
      void (*wakeup)(MachineState *state);
 diff --git a/qapi/machine.json b/qapi/machine.json
-index 47ac68a3b5..957ff0f4dd 100644
+index e981da9fbb..992900fe77 100644
 --- a/qapi/machine.json
 +++ b/qapi/machine.json
 @@ -192,6 +192,8 @@
@@ -71,18 +71,18 @@ index 47ac68a3b5..957ff0f4dd 100644
                                 'features': ['unstable'] } } }
  
 diff --git a/system/vl.c b/system/vl.c
-index 56f8900451..4d583d60b1 100644
+index 6bd8704c82..587956b30d 100644
 --- a/system/vl.c
 +++ b/system/vl.c
-@@ -1673,6 +1673,7 @@ static MachineClass *select_machine(QDict *qdict, Error **errp)
+@@ -1678,6 +1678,7 @@ static MachineClass *select_machine(QDict *qdict, Error **errp)
  {
      ERRP_GUARD();
      const char *machine_type = qdict_get_try_str(qdict, "type");
 +    const char *pvever = qdict_get_try_str(qdict, "pvever");
-     g_autoptr(GSList) machines = object_class_get_list(TYPE_MACHINE, false);
+     g_autoptr(GSList) machines = object_class_get_list(target_machine_typename(),
+                                                        false);
      MachineClass *machine_class = NULL;
- 
-@@ -1692,7 +1693,11 @@ static MachineClass *select_machine(QDict *qdict, Error **errp)
+@@ -1698,7 +1699,11 @@ static MachineClass *select_machine(QDict *qdict, Error **errp)
      if (!machine_class) {
          error_append_hint(errp,
                            "Use -machine help to list supported machines\n");
@@ -94,7 +94,7 @@ index 56f8900451..4d583d60b1 100644
      return machine_class;
  }
  
-@@ -3411,12 +3416,31 @@ void qemu_init(int argc, char **argv)
+@@ -3417,12 +3422,31 @@ void qemu_init(int argc, char **argv)
              case QEMU_OPTION_machine:
                  {
                      bool help;
diff --git a/debian/patches/pve/0027-PVE-Backup-add-vma-backup-format-code.patch b/debian/patches/pve/0027-PVE-Backup-add-vma-backup-format-code.patch
index 369f5ad..60fd4d0 100644
--- a/debian/patches/pve/0027-PVE-Backup-add-vma-backup-format-code.patch
+++ b/debian/patches/pve/0027-PVE-Backup-add-vma-backup-format-code.patch
@@ -40,10 +40,10 @@ index a21d9a5411..1373612c10 100644
  system_ss.add(files('block-ram-registrar.c'))
  
 diff --git a/meson.build b/meson.build
-index b7db736bbf..fe7b7a88fd 100644
+index d9293294d8..7089bfcb54 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -2199,6 +2199,8 @@ endif
+@@ -2160,6 +2160,8 @@ endif
  
  has_gettid = cc.has_function('gettid')
  
@@ -52,7 +52,7 @@ index b7db736bbf..fe7b7a88fd 100644
  # libselinux
  selinux = dependency('libselinux',
                       required: get_option('selinux'),
-@@ -4532,6 +4534,9 @@ if have_tools
+@@ -4510,6 +4512,9 @@ if have_tools
                 dependencies: [blockdev, qemuutil, selinux],
                 install: true)
  
diff --git a/debian/patches/pve/0028-PVE-Backup-add-backup-dump-block-driver.patch b/debian/patches/pve/0028-PVE-Backup-add-backup-dump-block-driver.patch
index 740e076..fa1db0b 100644
--- a/debian/patches/pve/0028-PVE-Backup-add-backup-dump-block-driver.patch
+++ b/debian/patches/pve/0028-PVE-Backup-add-backup-dump-block-driver.patch
@@ -259,7 +259,7 @@ index 1373612c10..6278c4af0f 100644
    'blklogwrites.c',
    'blkverify.c',
 diff --git a/include/block/block_int-common.h b/include/block/block_int-common.h
-index 034c0634c8..5688ced531 100644
+index cb0143ea77..a5e85cff46 100644
 --- a/include/block/block_int-common.h
 +++ b/include/block/block_int-common.h
 @@ -26,6 +26,7 @@
diff --git a/debian/patches/pve/0030-PVE-Backup-Proxmox-backup-patches-for-QEMU.patch b/debian/patches/pve/0030-PVE-Backup-Proxmox-backup-patches-for-QEMU.patch
index 3c0e64c..a56fc83 100644
--- a/debian/patches/pve/0030-PVE-Backup-Proxmox-backup-patches-for-QEMU.patch
+++ b/debian/patches/pve/0030-PVE-Backup-Proxmox-backup-patches-for-QEMU.patch
@@ -96,10 +96,10 @@ Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
  proxmox-backup-client.c        |  146 +++++
  proxmox-backup-client.h        |   60 ++
  pve-backup.c                   | 1096 ++++++++++++++++++++++++++++++++
- qapi/block-core.json           |  233 +++++++
+ qapi/block-core.json           |  242 +++++++
  qapi/common.json               |   14 +
  qapi/machine.json              |   16 +-
- 14 files changed, 1715 insertions(+), 14 deletions(-)
+ 14 files changed, 1724 insertions(+), 14 deletions(-)
  create mode 100644 proxmox-backup-client.c
  create mode 100644 proxmox-backup-client.h
  create mode 100644 pve-backup.c
@@ -121,10 +121,10 @@ index 6278c4af0f..d1b16e40e9 100644
  system_ss.add(when: 'CONFIG_TCG', if_true: files('blkreplay.c'))
  system_ss.add(files('block-ram-registrar.c'))
 diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
-index 282d1c386e..bbb08ecabd 100644
+index 3640d1f3dc..b7668139de 100644
 --- a/block/monitor/block-hmp-cmds.c
 +++ b/block/monitor/block-hmp-cmds.c
-@@ -1015,3 +1015,42 @@ void hmp_change_medium(Monitor *mon, const char *device, const char *target,
+@@ -1016,3 +1016,42 @@ void hmp_change_medium(Monitor *mon, const char *device, const char *target,
      qmp_blockdev_change_medium(device, NULL, target, arg, true, force,
                                 !!read_only, read_only_mode, errp);
  }
@@ -168,7 +168,7 @@ index 282d1c386e..bbb08ecabd 100644
 +    hmp_handle_error(mon, error);
 +}
 diff --git a/blockdev.c b/blockdev.c
-index 782cc5dd75..2505f9040a 100644
+index d9575c8367..38e24e12bd 100644
 --- a/blockdev.c
 +++ b/blockdev.c
 @@ -37,6 +37,7 @@
@@ -180,10 +180,10 @@ index 782cc5dd75..2505f9040a 100644
  #include "monitor/monitor.h"
  #include "qemu/error-report.h"
 diff --git a/hmp-commands-info.hx b/hmp-commands-info.hx
-index 3e15458335..7dffd5f68c 100644
+index 9b6cc87127..a2944aba8d 100644
 --- a/hmp-commands-info.hx
 +++ b/hmp-commands-info.hx
-@@ -456,6 +456,20 @@ SRST
+@@ -476,6 +476,20 @@ SRST
      Show the current VM UUID.
  ERST
  
@@ -205,7 +205,7 @@ index 3e15458335..7dffd5f68c 100644
      {
          .name       = "usernet",
 diff --git a/hmp-commands.hx b/hmp-commands.hx
-index 0d9241db9e..5f88b8dfaa 100644
+index eda6225ef1..f02681a157 100644
 --- a/hmp-commands.hx
 +++ b/hmp-commands.hx
 @@ -101,6 +101,35 @@ ERST
@@ -245,10 +245,10 @@ index 0d9241db9e..5f88b8dfaa 100644
  
      {
 diff --git a/include/monitor/hmp.h b/include/monitor/hmp.h
-index 2596cc2426..9dda91d65a 100644
+index f05423ceda..5a4bb5dbe6 100644
 --- a/include/monitor/hmp.h
 +++ b/include/monitor/hmp.h
-@@ -32,6 +32,7 @@ void hmp_info_savevm(Monitor *mon, const QDict *qdict);
+@@ -33,6 +33,7 @@ void hmp_info_savevm(Monitor *mon, const QDict *qdict);
  void hmp_info_migrate(Monitor *mon, const QDict *qdict);
  void hmp_info_migrate_capabilities(Monitor *mon, const QDict *qdict);
  void hmp_info_migrate_parameters(Monitor *mon, const QDict *qdict);
@@ -256,7 +256,7 @@ index 2596cc2426..9dda91d65a 100644
  void hmp_info_cpus(Monitor *mon, const QDict *qdict);
  void hmp_info_vnc(Monitor *mon, const QDict *qdict);
  void hmp_info_spice(Monitor *mon, const QDict *qdict);
-@@ -82,6 +83,8 @@ void hmp_change_vnc(Monitor *mon, const char *device, const char *target,
+@@ -83,6 +84,8 @@ void hmp_change_vnc(Monitor *mon, const char *device, const char *target,
  void hmp_change_medium(Monitor *mon, const char *device, const char *target,
                         const char *arg, const char *read_only, bool force,
                         Error **errp);
@@ -266,10 +266,10 @@ index 2596cc2426..9dda91d65a 100644
  void hmp_device_add(Monitor *mon, const QDict *qdict);
  void hmp_device_del(Monitor *mon, const QDict *qdict);
 diff --git a/meson.build b/meson.build
-index fe7b7a88fd..3bb206ce4d 100644
+index 7089bfcb54..06b0312a12 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -2200,6 +2200,7 @@ endif
+@@ -2161,6 +2161,7 @@ endif
  has_gettid = cc.has_function('gettid')
  
  libuuid = cc.find_library('uuid', required: true)
@@ -278,7 +278,7 @@ index fe7b7a88fd..3bb206ce4d 100644
  # libselinux
  selinux = dependency('libselinux',
 diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
-index 1e66bff724..d2fc956c18 100644
+index 7af9fed7ea..6abe0f2c8e 100644
 --- a/monitor/hmp-cmds.c
 +++ b/monitor/hmp-cmds.c
 @@ -22,6 +22,7 @@
@@ -1688,10 +1688,10 @@ index 0000000000..177fb851b4
 +    return ret;
 +}
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index e17ef6abdf..a54390d9ad 100644
+index 029b8f2b51..75406f4215 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -879,6 +879,239 @@
+@@ -947,6 +947,248 @@
  { 'command': 'query-block', 'returns': ['BlockInfo'],
    'allow-preconfig': true }
  
@@ -1701,15 +1701,15 @@ index e17ef6abdf..a54390d9ad 100644
 +# Detailed backup status.
 +#
 +# @status: string describing the current backup status.
-+#          This can be 'active', 'done', 'error'. If this field is not
-+#          returned, no backup process has been initiated
++#          This can be 'active', 'done', 'error'.  If this field is
++#          not returned, no backup process has been initiated
 +#
 +# @errmsg: error message (only returned if status is 'error')
 +#
 +# @total: total amount of bytes involved in the backup process
 +#
-+# @dirty: with incremental mode (PBS) this is the amount of bytes involved
-+#         in the backup process which are marked dirty.
++# @dirty: with incremental mode (PBS) this is the amount of bytes
++#         involved in the backup process which are marked dirty.
 +#
 +# @transferred: amount of bytes already backed up.
 +#
@@ -1725,8 +1725,8 @@ index e17ef6abdf..a54390d9ad 100644
 +#
 +# @uuid: uuid for this backup job
 +#
-+# @finishing: if status='active' and finishing=true, then the backup process is
-+#             waiting for the target to finish.
++# @finishing: if status='active' and finishing=true, then the backup
++#             process is waiting for the target to finish.
 +#
 +##
 +{ 'struct': 'BackupStatus',
@@ -1760,13 +1760,13 @@ index e17ef6abdf..a54390d9ad 100644
 +# @config-file: a configuration file to include into
 +#               the backup archive.
 +#
-+# @firewall-file: a firewall configuration file to include into the backup
-+#     archive.
++# @firewall-file: a firewall configuration file to include into the
++#     backup archive.
 +#
 +# @speed: the maximum speed, in bytes per second
 +#
-+# @devlist: list of block device names (separated by ',', ';'
-+#           or ':'). By default the backup includes all writable block devices.
++# @devlist: list of block device names (separated by ',', ';' or ':').
++#     By default the backup includes all writable block devices.
 +#
 +# @password: backup server passsword (required for format 'pbs')
 +#
@@ -1774,7 +1774,8 @@ index e17ef6abdf..a54390d9ad 100644
 +#
 +# @key-password: password for keyfile (optional for format 'pbs')
 +#
-+# @master-keyfile: PEM-formatted master public keyfile (optional for format 'pbs')
++# @master-keyfile: PEM-formatted master public keyfile (optional for
++#     format 'pbs')
 +#
 +# @fingerprint: server cert fingerprint (optional for format 'pbs')
 +#
@@ -1782,15 +1783,19 @@ index e17ef6abdf..a54390d9ad 100644
 +#
 +# @backup-id: backup ID (required for format 'pbs')
 +#
-+# @backup-time: backup timestamp (Unix epoch, required for format 'pbs')
++# @backup-time: backup timestamp (Unix epoch, required for format
++#     'pbs')
 +#
-+# @use-dirty-bitmap: use dirty bitmap to detect incremental changes since last job (optional for format 'pbs')
++# @use-dirty-bitmap: use dirty bitmap to detect incremental changes
++#     since last job (optional for format 'pbs')
 +#
-+# @compress: use compression (optional for format 'pbs', defaults to true)
++# @compress: use compression (optional for format 'pbs', defaults to
++#     true)
 +#
-+# @encrypt: use encryption ((optional for format 'pbs', defaults to true if there is a keyfile)
++# @encrypt: use encryption ((optional for format 'pbs', defaults to
++#     true if there is a keyfile)
 +#
-+# @max-workers: see @BackupPerf for details. Default 16.
++# @max-workers: see @BackupPerf for details.  Default 16.
 +#
 +# Returns: the uuid of the backup job
 +#
@@ -1830,7 +1835,8 @@ index e17ef6abdf..a54390d9ad 100644
 +#
 +# Cancel the current executing backup process.
 +#
-+# .. note:: This command succeeds even if there is no backup process running.
++# .. note:: This command succeeds even if there is no backup process
++#     running.
 +#
 +##
 +{ 'command': 'backup-cancel', 'coroutine': true }
@@ -1840,21 +1846,23 @@ index e17ef6abdf..a54390d9ad 100644
 +#
 +# Contains info about supported features added by Proxmox.
 +#
-+# @pbs-dirty-bitmap: True if dirty-bitmap-incremental backups to PBS are
-+#                    supported.
++# @pbs-dirty-bitmap: True if dirty-bitmap-incremental backups to PBS
++#     are supported.
 +#
-+# @query-bitmap-info: True if the 'query-pbs-bitmap-info' QMP call is supported.
++# @query-bitmap-info: True if the 'query-pbs-bitmap-info' QMP call is
++#     supported.
 +#
-+# @pbs-dirty-bitmap-savevm: True if 'dirty-bitmaps' migration capability can
-+#                           safely be set for savevm-async.
++# @pbs-dirty-bitmap-savevm: True if 'dirty-bitmaps' migration
++#     capability can safely be set for savevm-async.
 +#
-+# @pbs-masterkey: True if the QMP backup call supports the 'master_keyfile'
-+#                 parameter.
++# @pbs-masterkey: True if the QMP backup call supports the
++#     'master_keyfile' parameter.
 +#
-+# @pbs-library-version: Running version of libproxmox-backup-qemu0 library.
++# @pbs-library-version: Running version of libproxmox-backup-qemu0
++#     library.
 +#
-+# @backup-max-workers: Whether the 'max-workers' @BackupPerf setting is
-+#     supported or not.
++# @backup-max-workers: Whether the 'max-workers' @BackupPerf setting
++#     is supported or not.
 +#
 +##
 +{ 'struct': 'ProxmoxSupportStatus',
@@ -1889,9 +1897,9 @@ index e17ef6abdf..a54390d9ad 100644
 +#
 +# @used: An existing bitmap will be used to only backup changed data.
 +#
-+# @invalid: A bitmap existed, but had to be cleared since it's associated
-+#           base snapshot did not match the base given for the current job or
-+#           the crypt mode has changed.
++# @invalid: A bitmap existed, but had to be cleared since it's
++#     associated base snapshot did not match the base given for the
++#     current job or the crypt mode has changed.
 +#
 +##
 +{ 'enum': 'PBSBitmapAction',
@@ -1900,7 +1908,8 @@ index e17ef6abdf..a54390d9ad 100644
 +##
 +# @PBSBitmapInfo:
 +#
-+# Contains information about dirty bitmaps used for each drive in a PBS backup.
++# Contains information about dirty bitmaps used for each drive in a
++# PBS backup.
 +#
 +# @drive: The underlying drive.
 +#
@@ -1908,8 +1917,8 @@ index e17ef6abdf..a54390d9ad 100644
 +#
 +# @size: The total size of the drive.
 +#
-+# @dirty: How much of the drive is considered dirty and will be backed up,
-+#         or 'size' if everything will be.
++# @dirty: How much of the drive is considered dirty and will be backed
++#     up, or 'size' if everything will be.
 +#
 +##
 +{ 'struct': 'PBSBitmapInfo',
@@ -1919,9 +1928,9 @@ index e17ef6abdf..a54390d9ad 100644
 +##
 +# @query-pbs-bitmap-info:
 +#
-+# Returns information about dirty bitmaps used on the most recently started
-+# backup. Returns nothing when the last backup was not using PBS or if no
-+# backup occured in this session.
++# Returns information about dirty bitmaps used on the most recently
++# started backup.  Returns nothing when the last backup was not using
++# PBS or if no backup occured in this session.
 +#
 +# Returns: @PBSBitmapInfo
 +#
@@ -1954,7 +1963,7 @@ index af7e3d618a..dc9ab77310 100644
 +##
 +{ 'struct': 'UuidInfo', 'data': {'UUID': 'str'} }
 diff --git a/qapi/machine.json b/qapi/machine.json
-index 957ff0f4dd..5628cf4be4 100644
+index 992900fe77..71c19284c7 100644
 --- a/qapi/machine.json
 +++ b/qapi/machine.json
 @@ -4,6 +4,8 @@
diff --git a/debian/patches/pve/0031-PVE-Backup-pbs-restore-new-command-to-restore-from-p.patch b/debian/patches/pve/0031-PVE-Backup-pbs-restore-new-command-to-restore-from-p.patch
index 2f63bd1..33deac2 100644
--- a/debian/patches/pve/0031-PVE-Backup-pbs-restore-new-command-to-restore-from-p.patch
+++ b/debian/patches/pve/0031-PVE-Backup-pbs-restore-new-command-to-restore-from-p.patch
@@ -14,10 +14,10 @@ Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
  create mode 100644 pbs-restore.c
 
 diff --git a/meson.build b/meson.build
-index 3bb206ce4d..9eba919450 100644
+index 06b0312a12..73f6e2e93b 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -4538,6 +4538,10 @@ if have_tools
+@@ -4516,6 +4516,10 @@ if have_tools
    vma = executable('vma', files('vma.c', 'vma-reader.c') + genh,
                     dependencies: [authz, block, crypto, io, qemuutil, qom], install: true)
  
diff --git a/debian/patches/pve/0032-PVE-Add-PBS-block-driver-to-map-backup-archives-into.patch b/debian/patches/pve/0032-PVE-Add-PBS-block-driver-to-map-backup-archives-into.patch
index 41626ce..00fef7e 100644
--- a/debian/patches/pve/0032-PVE-Add-PBS-block-driver-to-map-backup-archives-into.patch
+++ b/debian/patches/pve/0032-PVE-Add-PBS-block-driver-to-map-backup-archives-into.patch
@@ -348,10 +348,10 @@ index 0000000000..3e41421716
 +
 +block_init(bdrv_pbs_init);
 diff --git a/meson.build b/meson.build
-index 9eba919450..4861b69412 100644
+index 73f6e2e93b..b717cad2f9 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -5011,7 +5011,7 @@ summary_info += {'Query Processing Library support': qpl}
+@@ -4986,7 +4986,7 @@ summary_info += {'Query Processing Library support': qpl}
  summary_info += {'UADK Library support': uadk}
  summary_info += {'qatzip support':    qatzip}
  summary_info += {'NUMA host support': numa}
@@ -361,10 +361,10 @@ index 9eba919450..4861b69412 100644
  summary_info += {'libdaxctl support': libdaxctl}
  summary_info += {'libcbor support':   libcbor}
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index a54390d9ad..e6b8ba49b2 100644
+index 75406f4215..f998aafc49 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -3534,6 +3534,7 @@
+@@ -3614,6 +3614,7 @@
              'parallels', 'preallocate', 'qcow', 'qcow2', 'qed', 'quorum',
              'raw', 'rbd',
              { 'name': 'replication', 'if': 'CONFIG_REPLICATION' },
@@ -372,7 +372,7 @@ index a54390d9ad..e6b8ba49b2 100644
              'ssh', 'throttle', 'vdi', 'vhdx',
              { 'name': 'virtio-blk-vfio-pci', 'if': 'CONFIG_BLKIO' },
              { 'name': 'virtio-blk-vhost-user', 'if': 'CONFIG_BLKIO' },
-@@ -3620,6 +3621,33 @@
+@@ -3700,6 +3701,33 @@
  { 'struct': 'BlockdevOptionsNull',
    'data': { '*size': 'int', '*latency-ns': 'uint64', '*read-zeroes': 'bool' } }
  
@@ -406,7 +406,7 @@ index a54390d9ad..e6b8ba49b2 100644
  ##
  # @BlockdevOptionsNVMe:
  #
-@@ -5067,6 +5095,7 @@
+@@ -5147,6 +5175,7 @@
        'nfs':        'BlockdevOptionsNfs',
        'null-aio':   'BlockdevOptionsNull',
        'null-co':    'BlockdevOptionsNull',
diff --git a/debian/patches/pve/0033-PVE-redirect-stderr-to-journal-when-daemonized.patch b/debian/patches/pve/0033-PVE-redirect-stderr-to-journal-when-daemonized.patch
index b007793..f53a108 100644
--- a/debian/patches/pve/0033-PVE-redirect-stderr-to-journal-when-daemonized.patch
+++ b/debian/patches/pve/0033-PVE-redirect-stderr-to-journal-when-daemonized.patch
@@ -14,10 +14,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  2 files changed, 7 insertions(+), 3 deletions(-)
 
 diff --git a/meson.build b/meson.build
-index 4861b69412..7e1935d43f 100644
+index b717cad2f9..0b28d2ec39 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -2200,6 +2200,7 @@ endif
+@@ -2161,6 +2161,7 @@ endif
  has_gettid = cc.has_function('gettid')
  
  libuuid = cc.find_library('uuid', required: true)
@@ -25,7 +25,7 @@ index 4861b69412..7e1935d43f 100644
  libproxmox_backup_qemu = cc.find_library('proxmox_backup_qemu', required: true)
  
  # libselinux
-@@ -3875,7 +3876,7 @@ if have_block
+@@ -3836,7 +3837,7 @@ if have_block
    elif host_os == 'emscripten'
      blockdev_ss.add(files('os-wasm.c'))
    else
diff --git a/debian/patches/pve/0034-PVE-Migrate-dirty-bitmap-state-via-savevm.patch b/debian/patches/pve/0034-PVE-Migrate-dirty-bitmap-state-via-savevm.patch
index c581f29..2c3c25f 100644
--- a/debian/patches/pve/0034-PVE-Migrate-dirty-bitmap-state-via-savevm.patch
+++ b/debian/patches/pve/0034-PVE-Migrate-dirty-bitmap-state-via-savevm.patch
@@ -26,10 +26,10 @@ Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
  create mode 100644 migration/pbs-state.c
 
 diff --git a/include/migration/misc.h b/include/migration/misc.h
-index a261f99d89..e8c6a87305 100644
+index e26d418a6e..551898d7bf 100644
 --- a/include/migration/misc.h
 +++ b/include/migration/misc.h
-@@ -140,4 +140,7 @@ bool multifd_device_state_save_thread_should_exit(void);
+@@ -152,4 +152,7 @@ bool multifd_device_state_save_thread_should_exit(void);
  void multifd_abort_device_state_save_threads(void);
  bool multifd_join_device_state_save_threads(void);
  
@@ -38,7 +38,7 @@ index a261f99d89..e8c6a87305 100644
 +
  #endif
 diff --git a/migration/meson.build b/migration/meson.build
-index 409b748980..ca94e7e17b 100644
+index 140264b477..23aa5b3caa 100644
 --- a/migration/meson.build
 +++ b/migration/meson.build
 @@ -8,6 +8,7 @@ migration_files = files(
@@ -49,19 +49,19 @@ index 409b748980..ca94e7e17b 100644
  
  system_ss.add(files(
    'block-dirty-bitmap.c',
-@@ -31,6 +32,7 @@ system_ss.add(files(
+@@ -32,6 +33,7 @@ system_ss.add(files(
    'multifd-zlib.c',
    'multifd-zero-page.c',
    'options.c',
 +  'pbs-state.c',
    'postcopy-ram.c',
+   'ram.c',
    'savevm.c',
-   'savevm-async.c',
 diff --git a/migration/migration.c b/migration/migration.c
-index 32b8ce5613..60464d43c3 100644
+index b316ee01ab..1eae33bc73 100644
 --- a/migration/migration.c
 +++ b/migration/migration.c
-@@ -340,6 +340,7 @@ void migration_object_init(void)
+@@ -337,6 +337,7 @@ void migration_object_init(void)
  
      /* Initialize cpu throttle timers */
      cpu_throttle_init();
@@ -192,22 +192,22 @@ index 177fb851b4..7575abab7c 100644
      ret->pbs_masterkey = true;
      ret->backup_max_workers = true;
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index e6b8ba49b2..be6bf25219 100644
+index f998aafc49..5b3bb3c19e 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -1032,6 +1032,11 @@
- # @pbs-dirty-bitmap-savevm: True if 'dirty-bitmaps' migration capability can
- #                           safely be set for savevm-async.
+@@ -1107,6 +1107,11 @@
+ # @pbs-dirty-bitmap-savevm: True if 'dirty-bitmaps' migration
+ #     capability can safely be set for savevm-async.
  #
-+# @pbs-dirty-bitmap-migration: True if safe migration of dirty-bitmaps including
-+#                              PBS state is supported. Enabling 'dirty-bitmaps'
-+#                              migration cap if this is false/unset may lead
-+#                              to crashes on migration!
++# @pbs-dirty-bitmap-migration: True if safe migration of dirty-bitmaps
++#     including PBS state is supported.  Enabling 'dirty-bitmaps'
++#     migration cap if this is false/unset may lead to crashes on
++#     migration!
 +#
- # @pbs-masterkey: True if the QMP backup call supports the 'master_keyfile'
- #                 parameter.
+ # @pbs-masterkey: True if the QMP backup call supports the
+ #     'master_keyfile' parameter.
  #
-@@ -1045,6 +1050,7 @@
+@@ -1121,6 +1126,7 @@
    'data': { 'pbs-dirty-bitmap': 'bool',
              'query-bitmap-info': 'bool',
              'pbs-dirty-bitmap-savevm': 'bool',
diff --git a/debian/patches/pve/0036-PVE-fall-back-to-open-iscsi-initiatorname.patch b/debian/patches/pve/0036-PVE-fall-back-to-open-iscsi-initiatorname.patch
index a187b0d..9efe1a3 100644
--- a/debian/patches/pve/0036-PVE-fall-back-to-open-iscsi-initiatorname.patch
+++ b/debian/patches/pve/0036-PVE-fall-back-to-open-iscsi-initiatorname.patch
@@ -21,10 +21,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
  1 file changed, 30 insertions(+)
 
 diff --git a/block/iscsi.c b/block/iscsi.c
-index 15b96ee880..5aa4b602b1 100644
+index 7d6bf185ea..e8b7671f72 100644
 --- a/block/iscsi.c
 +++ b/block/iscsi.c
-@@ -1392,12 +1392,42 @@ static char *get_initiator_name(QemuOpts *opts)
+@@ -1380,12 +1380,42 @@ static char *get_initiator_name(QemuOpts *opts)
      const char *name;
      char *iscsi_name;
      UuidInfo *uuid_info;
diff --git a/debian/patches/pve/0038-block-add-alloc-track-driver.patch b/debian/patches/pve/0038-block-add-alloc-track-driver.patch
index 3ff3f6c..de886e2 100644
--- a/debian/patches/pve/0038-block-add-alloc-track-driver.patch
+++ b/debian/patches/pve/0038-block-add-alloc-track-driver.patch
@@ -449,10 +449,10 @@ index d023753091..a777c8079c 100644
  
  out:
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index be6bf25219..cbefc6d0d3 100644
+index 5b3bb3c19e..1d98f0a406 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -3526,7 +3526,8 @@
+@@ -3606,7 +3606,8 @@
  # Since: 2.9
  ##
  { 'enum': 'BlockdevDriver',
@@ -462,7 +462,7 @@ index be6bf25219..cbefc6d0d3 100644
              'cloop', 'compress', 'copy-before-write', 'copy-on-read', 'dmg',
              'file', 'snapshot-access', 'ftp', 'ftps',
              {'name': 'gluster', 'features': [ 'deprecated' ] },
-@@ -3627,6 +3628,21 @@
+@@ -3707,6 +3708,21 @@
  { 'struct': 'BlockdevOptionsNull',
    'data': { '*size': 'int', '*latency-ns': 'uint64', '*read-zeroes': 'bool' } }
  
@@ -484,7 +484,7 @@ index be6bf25219..cbefc6d0d3 100644
  ##
  # @BlockdevOptionsPbs:
  #
-@@ -5073,6 +5089,7 @@
+@@ -5153,6 +5169,7 @@
              '*detect-zeroes': 'BlockdevDetectZeroesOptions' },
    'discriminator': 'driver',
    'data': {
diff --git a/debian/patches/pve/0039-PVE-backup-add-fleecing-option.patch b/debian/patches/pve/0039-PVE-backup-add-fleecing-option.patch
index 3edb41d..50021c5 100644
--- a/debian/patches/pve/0039-PVE-backup-add-fleecing-option.patch
+++ b/debian/patches/pve/0039-PVE-backup-add-fleecing-option.patch
@@ -147,10 +147,10 @@ index eb93364e85..6a6dbf90f5 100644
  
  #endif /* COPY_BEFORE_WRITE_H */
 diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
-index bbb08ecabd..d8771ce8fc 100644
+index b7668139de..9e84ba164d 100644
 --- a/block/monitor/block-hmp-cmds.c
 +++ b/block/monitor/block-hmp-cmds.c
-@@ -1050,6 +1050,7 @@ void coroutine_fn hmp_backup(Monitor *mon, const QDict *qdict)
+@@ -1051,6 +1051,7 @@ void coroutine_fn hmp_backup(Monitor *mon, const QDict *qdict)
          NULL, NULL,
          devlist, qdict_haskey(qdict, "speed"), speed,
          false, 0, // BackupPerf max-workers
@@ -429,21 +429,21 @@ index 7575abab7c..8b83465ebd 100644
      return ret;
  }
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index cbefc6d0d3..7cafc96616 100644
+index 1d98f0a406..db0a5a1266 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -976,6 +976,10 @@
+@@ -1049,6 +1049,10 @@
  #
- # @max-workers: see @BackupPerf for details. Default 16.
+ # @max-workers: see @BackupPerf for details.  Default 16.
  #
-+# @fleecing: perform a backup with fleecing. For each device in @devlist, a
-+#            corresponing '-fleecing' device with the same size already needs to
-+#            be present.
++# @fleecing: perform a backup with fleecing.  For each device in
++#     @devlist, a corresponing '-fleecing' device with the same size
++#     already needs to be present.
 +#
  # Returns: the uuid of the backup job
  #
  ##
-@@ -996,7 +1000,8 @@
+@@ -1069,7 +1073,8 @@
                                      '*firewall-file': 'str',
                                      '*devlist': 'str',
                                      '*speed': 'int',
@@ -453,16 +453,16 @@ index cbefc6d0d3..7cafc96616 100644
    'returns': 'UuidInfo', 'coroutine': true }
  
  ##
-@@ -1042,6 +1047,8 @@
- #
- # @pbs-library-version: Running version of libproxmox-backup-qemu0 library.
+@@ -1118,6 +1123,8 @@
+ # @pbs-library-version: Running version of libproxmox-backup-qemu0
+ #     library.
  #
 +# @backup-fleecing: Whether backup fleecing is supported or not.
 +#
- # @backup-max-workers: Whether the 'max-workers' @BackupPerf setting is
- #     supported or not.
+ # @backup-max-workers: Whether the 'max-workers' @BackupPerf setting
+ #     is supported or not.
  #
-@@ -1053,6 +1060,7 @@
+@@ -1129,6 +1136,7 @@
              'pbs-dirty-bitmap-migration': 'bool',
              'pbs-masterkey': 'bool',
              'pbs-library-version': 'str',
diff --git a/debian/patches/pve/0040-adapt-machine-version-deprecation-for-Proxmox-VE.patch b/debian/patches/pve/0040-adapt-machine-version-deprecation-for-Proxmox-VE.patch
index 5701668..412fd18 100644
--- a/debian/patches/pve/0040-adapt-machine-version-deprecation-for-Proxmox-VE.patch
+++ b/debian/patches/pve/0040-adapt-machine-version-deprecation-for-Proxmox-VE.patch
@@ -22,10 +22,10 @@ Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
  1 file changed, 58 insertions(+), 41 deletions(-)
 
 diff --git a/include/hw/boards.h b/include/hw/boards.h
-index 7a389f6998..0595a569d2 100644
+index dfa1dc0bb7..ca5c7ed0b9 100644
 --- a/include/hw/boards.h
 +++ b/include/hw/boards.h
-@@ -636,40 +636,57 @@ struct MachineState {
+@@ -672,40 +672,57 @@ struct MachineState {
  
  
  /*
@@ -106,7 +106,7 @@ index 7a389f6998..0595a569d2 100644
  
  /*
   * - The first check applies to formal releases
-@@ -684,29 +701,29 @@ struct MachineState {
+@@ -720,29 +737,29 @@ struct MachineState {
   * and dev snapshots / release candidates are numbered with micro >= 50
   * If this ever changes the logic below will need modifying....
   */
@@ -152,7 +152,7 @@ index 7a389f6998..0595a569d2 100644
  
  /*
   * Evaluates true when a machine type with (major, minor)
-@@ -715,7 +732,7 @@ struct MachineState {
+@@ -751,7 +768,7 @@ struct MachineState {
   * lifecycle rules
   */
  #define MACHINE_VER_IS_DEPRECATED(...) \
@@ -161,7 +161,7 @@ index 7a389f6998..0595a569d2 100644
  
  /*
   * Evaluates true when a machine type with (major, minor)
-@@ -724,7 +741,7 @@ struct MachineState {
+@@ -760,7 +777,7 @@ struct MachineState {
   * lifecycle rules
   */
  #define MACHINE_VER_SHOULD_DELETE(...) \
diff --git a/debian/patches/pve/0045-PVE-backup-implement-backup-access-setup-and-teardow.patch b/debian/patches/pve/0045-PVE-backup-implement-backup-access-setup-and-teardow.patch
index b8f3632..8bdbf11 100644
--- a/debian/patches/pve/0045-PVE-backup-implement-backup-access-setup-and-teardow.patch
+++ b/debian/patches/pve/0045-PVE-backup-implement-backup-access-setup-and-teardow.patch
@@ -84,9 +84,9 @@ Reviewed-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
 ---
  pve-backup.c         | 519 +++++++++++++++++++++++++++++++++++++++----
  pve-backup.h         |  16 ++
- qapi/block-core.json |  99 ++++++++-
+ qapi/block-core.json | 105 ++++++++-
  system/runstate.c    |   6 +
- 4 files changed, 596 insertions(+), 44 deletions(-)
+ 4 files changed, 602 insertions(+), 44 deletions(-)
  create mode 100644 pve-backup.h
 
 diff --git a/pve-backup.c b/pve-backup.c
@@ -740,20 +740,20 @@ index 0000000000..9ebeef7c8f
 +
 +#endif /* PVE_BACKUP_H */
 diff --git a/qapi/block-core.json b/qapi/block-core.json
-index 7cafc96616..adb94bebb4 100644
+index db0a5a1266..94296c0bc9 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
-@@ -1047,6 +1047,9 @@
+@@ -1123,6 +1123,9 @@
+ # @pbs-library-version: Running version of libproxmox-backup-qemu0
+ #     library.
  #
- # @pbs-library-version: Running version of libproxmox-backup-qemu0 library.
- #
-+# @backup-access-api: Whether backup access API for external providers is
-+#     supported or not.
++# @backup-access-api: Whether backup access API for external providers
++#     is supported or not.
 +#
  # @backup-fleecing: Whether backup fleecing is supported or not.
  #
- # @backup-max-workers: Whether the 'max-workers' @BackupPerf setting is
-@@ -1060,6 +1063,7 @@
+ # @backup-max-workers: Whether the 'max-workers' @BackupPerf setting
+@@ -1136,6 +1139,7 @@
              'pbs-dirty-bitmap-migration': 'bool',
              'pbs-masterkey': 'bool',
              'pbs-library-version': 'str',
@@ -761,15 +761,15 @@ index 7cafc96616..adb94bebb4 100644
              'backup-fleecing': 'bool',
              'backup-max-workers': 'bool' } }
  
-@@ -1091,9 +1095,16 @@
- #           base snapshot did not match the base given for the current job or
- #           the crypt mode has changed.
+@@ -1167,9 +1171,16 @@
+ #     associated base snapshot did not match the base given for the
+ #     current job or the crypt mode has changed.
  #
-+# @missing-recreated: A bitmap for incremental backup was expected to be
-+#     present, but was missing and thus got recreated. For example, this can
-+#     happen if the drive was re-attached or if the bitmap was deleted for some
-+#     other reason. PBS does not currently keep track of this; the backup-access
-+#     mechanism does.
++# @missing-recreated: A bitmap for incremental backup was expected to
++#     be present, but was missing and thus got recreated.  For
++#     example, this can happen if the drive was re-attached or if the
++#     bitmap was deleted for some other reason.  PBS does not
++#     currently keep track of this; the backup-access mechanism does.
 +#
  ##
  { 'enum': 'PBSBitmapAction',
@@ -779,15 +779,15 @@ index 7cafc96616..adb94bebb4 100644
  
  ##
  # @PBSBitmapInfo:
-@@ -1126,6 +1137,92 @@
+@@ -1203,6 +1214,98 @@
  ##
  { 'command': 'query-pbs-bitmap-info', 'returns': ['PBSBitmapInfo'] }
  
 +##
 +# @BackupAccessInfo:
 +#
-+# Info associated to a snapshot access for backup.  For more information about
-+# the bitmap see @BackupAccessBitmapMode.
++# Info associated to a snapshot access for backup.  For more
++# information about the bitmap see @BackupAccessBitmapMode.
 +#
 +# @node-name: the block node name of the snapshot-access node.
 +#
@@ -795,9 +795,11 @@ index 7cafc96616..adb94bebb4 100644
 +#
 +# @size: the size of the block device in bytes.
 +#
-+# @bitmap-node-name: the block node name the dirty bitmap is associated to.
++# @bitmap-node-name: the block node name the dirty bitmap is
++#     associated to.
 +#
-+# @bitmap-name: the name of the dirty bitmap associated to the backup access.
++# @bitmap-name: the name of the dirty bitmap associated to the backup
++#     access.
 +#
 +# @bitmap-action: the action taken on the dirty bitmap.
 +#
@@ -815,7 +817,7 @@ index 7cafc96616..adb94bebb4 100644
 +# @device: the block device name.
 +#
 +# @bitmap-mode: used to control whether the bitmap should be reused or
-+#     recreated or not used. Default is not using a bitmap.
++#     recreated or not used.  Default is not using a bitmap.
 +#
 +##
 +{ 'struct': 'BackupAccessSourceDevice',
@@ -826,11 +828,12 @@ index 7cafc96616..adb94bebb4 100644
 +#
 +# How to setup a bitmap for a device for @backup-access-setup.
 +#
-+# @none: do not use a bitmap. Removes an existing bitmap if present.
++# @none: do not use a bitmap.  Removes an existing bitmap if present.
 +#
 +# @new: create and use a new bitmap.
 +#
-+# @use: try to re-use an existing bitmap. Create a new one if it doesn't exist.
++# @use: try to re-use an existing bitmap.  Create a new one if it
++#     doesn't exist.
 +##
 +{ 'enum': 'BackupAccessSetupBitmapMode',
 +  'data': ['none', 'new', 'use' ] }
@@ -838,15 +841,17 @@ index 7cafc96616..adb94bebb4 100644
 +##
 +# @backup-access-setup:
 +#
-+# Set up snapshot access to VM drives for an external backup provider.  No other
-+# backup or backup access can be done before tearing down the backup access.
++# Set up snapshot access to VM drives for an external backup provider.
++# No other backup or backup access can be done before tearing down the
++# backup access.
 +#
 +# @target-id: the unique ID of the backup target.
 +#
-+# @devices: list of devices for which to create the backup access.  Also
-+#     controls whether to use/create a bitmap for the device.  Check the
-+#     @bitmap-action in the result to see what action was actually taken for the
-+#     bitmap.  Each target controls its own bitmaps.
++# @devices: list of devices for which to create the backup access.
++#     Also controls whether to use/create a bitmap for the device.
++#     Check the @bitmap-action in the result to see what action was
++#     actually taken for the bitmap.  Each target controls its own
++#     bitmaps.
 +#
 +# Returns: a list of @BackupAccessInfo, one for each device.
 +#
@@ -862,7 +867,8 @@ index 7cafc96616..adb94bebb4 100644
 +#
 +# @target-id: the ID of the backup target.
 +#
-+# @success: whether the backup done by the external provider was successful.
++# @success: whether the backup done by the external provider was
++#     successful.
 +#
 +##
 +{ 'command': 'backup-access-teardown',
@@ -873,7 +879,7 @@ index 7cafc96616..adb94bebb4 100644
  # @BlockDeviceTimedStats:
  #
 diff --git a/system/runstate.c b/system/runstate.c
-index 6178b0091a..5f370ddb60 100644
+index e3ec16ab74..d471fbece9 100644
 --- a/system/runstate.c
 +++ b/system/runstate.c
 @@ -60,6 +60,7 @@
@@ -884,7 +890,7 @@ index 6178b0091a..5f370ddb60 100644
  
  static NotifierList exit_notifiers =
      NOTIFIER_LIST_INITIALIZER(exit_notifiers);
-@@ -991,6 +992,11 @@ void qemu_cleanup(int status)
+@@ -989,6 +990,11 @@ void qemu_cleanup(int status)
       * requests happening from here on anyway.
       */
      bdrv_drain_all_begin();
diff --git a/debian/patches/pve/0047-savevm-async-reuse-migration-blocker-check-for-snaps.patch b/debian/patches/pve/0047-savevm-async-reuse-migration-blocker-check-for-snaps.patch
index a269f01..18db6fa 100644
--- a/debian/patches/pve/0047-savevm-async-reuse-migration-blocker-check-for-snaps.patch
+++ b/debian/patches/pve/0047-savevm-async-reuse-migration-blocker-check-for-snaps.patch
@@ -61,7 +61,7 @@ Message-ID: <20250618102531.57444-1-f.ebner@proxmox.com>
  5 files changed, 29 insertions(+), 4 deletions(-)
 
 diff --git a/block/vmdk.c b/block/vmdk.c
-index 7b98debc2b..2af32f3d5d 100644
+index 89e89cd10e..06df10a799 100644
 --- a/block/vmdk.c
 +++ b/block/vmdk.c
 @@ -1404,9 +1404,7 @@ static int vmdk_open(BlockDriverState *bs, QDict *options, int flags,
@@ -76,12 +76,12 @@ index 7b98debc2b..2af32f3d5d 100644
      if (ret < 0) {
          goto fail;
 diff --git a/include/migration/blocker.h b/include/migration/blocker.h
-index a687ac0efe..f36bfb2df1 100644
+index 80b75ad5cb..f8417347a1 100644
 --- a/include/migration/blocker.h
 +++ b/include/migration/blocker.h
-@@ -18,6 +18,8 @@
+@@ -16,6 +16,8 @@
  
- #define MIG_MODE_ALL MIG_MODE__MAX
+ #include "qapi/qapi-types-migration.h"
  
 +#define MIGRATION_BLOCKER_VMDK "The vmdk format used by a disk does not support live migration"
 +
@@ -89,10 +89,10 @@ index a687ac0efe..f36bfb2df1 100644
   * @migrate_add_blocker - prevent all modes of migration from proceeding
   *
 diff --git a/migration/migration.c b/migration/migration.c
-index 60464d43c3..998a7f87b8 100644
+index 1eae33bc73..979ebac75e 100644
 --- a/migration/migration.c
 +++ b/migration/migration.c
-@@ -2055,6 +2055,30 @@ bool migration_is_blocked(Error **errp)
+@@ -2063,6 +2063,30 @@ bool migration_is_blocked(Error **errp)
      return false;
  }
  
@@ -124,10 +124,10 @@ index 60464d43c3..998a7f87b8 100644
  static bool migrate_prepare(MigrationState *s, bool resume, Error **errp)
  {
 diff --git a/migration/migration.h b/migration/migration.h
-index 01329bf824..a805e98a30 100644
+index 213b33fe6e..c95eca727e 100644
 --- a/migration/migration.h
 +++ b/migration/migration.h
-@@ -531,6 +531,7 @@ int migration_call_notifiers(MigrationState *s, MigrationEventType type,
+@@ -535,6 +535,7 @@ int migration_call_notifiers(MigrationState *s, MigrationEventType type,
  
  int migrate_init(MigrationState *s, Error **errp);
  bool migration_is_blocked(Error **errp);
@@ -136,7 +136,7 @@ index 01329bf824..a805e98a30 100644
  bool migration_in_postcopy(void);
  bool migration_postcopy_is_alive(MigrationStatus state);
 diff --git a/migration/savevm-async.c b/migration/savevm-async.c
-index 730b815494..6cb91dca27 100644
+index 9942557455..8f498151bd 100644
 --- a/migration/savevm-async.c
 +++ b/migration/savevm-async.c
 @@ -375,7 +375,7 @@ void qmp_savevm_start(const char *statefile, Error **errp)
diff --git a/debian/patches/series b/debian/patches/series
index 88cfb9b..7c8e26c 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,16 +1,7 @@
 extra/0001-monitor-qmp-fix-race-with-clients-disconnecting-earl.patch
 extra/0002-ide-avoid-potential-deadlock-when-draining-during-tr.patch
-extra/0003-tcg-arm-Fix-tgen_deposit.patch
-extra/0004-vfio-igd-Enable-quirks-when-IGD-is-not-the-primary-d.patch
-extra/0005-hw-scsi-avoid-deadlock-upon-TMF-request-cancelling-w.patch
-extra/0006-vfio-rename-field-to-num_initial_regions.patch
-extra/0007-vfio-only-check-region-info-cache-for-initial-region.patch
-extra/0008-ui-vdagent-fix-windows-agent-regression.patch
-extra/0009-file-posix-populate-pwrite_zeroes_alignment.patch
-extra/0010-block-use-pwrite_zeroes_alignment-when-writing-first.patch
-extra/0011-block-io_uring-avoid-potentially-getting-stuck-after.patch
-extra/0012-block-mirror-check-range-when-setting-zero-bitmap-fo.patch
-extra/0013-block-io-fallback-to-bounce-buffer-if-BLKZEROOUT-is-.patch
+extra/0003-block-mirror-check-range-when-setting-zero-bitmap-fo.patch
+extra/0004-block-io-fallback-to-bounce-buffer-if-BLKZEROOUT-is-.patch
 bitmap-mirror/0001-drive-mirror-add-support-for-sync-bitmap-mode-never.patch
 bitmap-mirror/0002-drive-mirror-add-support-for-conditional-and-always-.patch
 bitmap-mirror/0003-mirror-add-check-for-bitmap-mode-without-bitmap.patch
diff --git a/qemu b/qemu
index ccaea6b..2d3df8a 160000
--- a/qemu
+++ b/qemu
@@ -1 +1 @@
-Subproject commit ccaea6b2656ec6eab966585f7b16438208f98de7
+Subproject commit 2d3df8abca265c9bcc9e438d691d561592060998
-- 
2.47.3





  reply	other threads:[~2026-03-12 12:13 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-03-12 11:44 [PATCH-SERIES qemu 0/2] " Fiona Ebner
2026-03-12 11:44 ` Fiona Ebner [this message]
2026-03-12 11:44 ` [PATCH qemu 2/2] stable fixes for " Fiona Ebner

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260312114417.82984-2-f.ebner@proxmox.com \
    --to=f.ebner@proxmox.com \
    --cc=pve-devel@lists.proxmox.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Service provided by Proxmox Server Solutions GmbH | Privacy | Legal