From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id BCED01FF09B for ; Mon, 12 Oct 2026 12:53:03 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 2EC662159D; Mon, 12 Oct 2026 12:53:00 +0200 (CEST) From: Fiona Ebner To: pve-devel@lists.proxmox.com Subject: [PATCH qemu 1/2] update submodule and patches to QEMU 11.1.2 Date: Mon, 12 Oct 2026 12:51:42 +0200 Message-ID: <20261012105232.146528-2-f.ebner@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20261012105232.146528-1-f.ebner@proxmox.com> References: <20261012105232.146528-1-f.ebner@proxmox.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1791802368049 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.318 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) KAM_LOTSOFHASH 0.25 Emails with lots of hash-like gibberish RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: V33TK3ZODEOK6AUNE7UTFQCNDOY2ACM3 X-Message-ID-Hash: V33TK3ZODEOK6AUNE7UTFQCNDOY2ACM3 X-MailFrom: f.ebner@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Picking up fixes for x86 and ARM emulation, QXL display, USB emulation, IDE emulation, VirtIO and VirtIO-net. Signed-off-by: Fiona Ebner --- ...d-support-for-sync-bitmap-mode-never.patch | 6 +- ...alidate-primary-surface-stride-again.patch | 81 --------- ...5a-gracefully-handle-re-entrant-DMA.patch} | 0 ...ix-text-mode-OOB-write-after-a-graph.patch | 164 ------------------ ...-fix-out-of-bound-read-in-WRITE-SAME.patch | 71 -------- ...ELECT-block-size-change-behind-a-qui.patch | 89 ---------- ...-the-VAPIC-region-to-0xc0000.0xe0000.patch | 75 -------- ...-MemoryRegion-if-vapic_map_rom_writa.patch | 36 ---- ...t-do-not-treat-a-zero-length-write-a.patch | 54 ------ ...virtio-balloon-improve-query-balloon.patch | 4 +- ...async-for-background-state-snapshots.patch | 4 +- ...add-the-zeroinit-block-driver-filter.patch | 6 +- ...le-posix-make-locking-optiono-on-cre.patch | 6 +- ...-Backup-add-backup-dump-block-driver.patch | 2 +- ...d-sequential-job-transaction-support.patch | 6 +- ...ckup-Proxmox-backup-patches-for-QEMU.patch | 2 +- ...k-driver-to-map-backup-archives-into.patch | 8 +- ...igrate-dirty-bitmap-state-via-savevm.patch | 2 +- ...dirty-bitmap-migrate-other-bitmaps-e.patch | 2 +- .../0035-block-add-alloc-track-driver.patch | 8 +- .../0036-PVE-backup-add-fleecing-option.patch | 2 +- ...ment-backup-access-setup-and-teardow.patch | 2 +- debian/patches/series | 9 +- qemu | 2 +- 24 files changed, 32 insertions(+), 609 deletions(-) delete mode 100644 debian/patches/extra/0004-hw-display-qxl-validate-primary-surface-stride-again.patch rename debian/patches/extra/{0005-hw-scsi-lsi53c895a-gracefully-handle-re-entrant-DMA.patch => 0004-hw-scsi-lsi53c895a-gracefully-handle-re-entrant-DMA.patch} (100%) delete mode 100644 debian/patches/extra/0006-hw-display-vga-fix-text-mode-OOB-write-after-a-graph.patch delete mode 100644 debian/patches/extra/0007-scsi-disk-fix-out-of-bound-read-in-WRITE-SAME.patch delete mode 100644 debian/patches/extra/0008-scsi-hide-MODE-SELECT-block-size-change-behind-a-qui.patch delete mode 100644 debian/patches/extra/0009-vapic-confine-the-VAPIC-region-to-0xc0000.0xe0000.patch delete mode 100644 debian/patches/extra/0010-i386-vapic-unref-MemoryRegion-if-vapic_map_rom_writa.patch delete mode 100644 debian/patches/extra/0011-io-channel-socket-do-not-treat-a-zero-length-write-a.patch diff --git a/debian/patches/bitmap-mirror/0001-drive-mirror-add-support-for-sync-bitmap-mode-never.patch b/debian/patches/bitmap-mirror/0001-drive-mirror-add-support-for-sync-bitmap-mode-never.patch index 40ec9887d7..8b0740a093 100644 --- a/debian/patches/bitmap-mirror/0001-drive-mirror-add-support-for-sync-bitmap-mode-never.patch +++ b/debian/patches/bitmap-mirror/0001-drive-mirror-add-support-for-sync-bitmap-mode-never.patch @@ -333,7 +333,7 @@ index e7c8f1a856..d5aa68caeb 100644 BlockdevOnError on_source_error, BlockdevOnError on_target_error, diff --git a/qapi/block-core.json b/qapi/block-core.json -index 1f87b07850..c2f6139dea 100644 +index 199efc1e00..28d9c1e98e 100644 --- a/qapi/block-core.json +++ b/qapi/block-core.json @@ -2280,6 +2280,15 @@ @@ -363,7 +363,7 @@ index 1f87b07850..c2f6139dea 100644 '*speed': 'int', '*granularity': 'uint32', '*buf-size': 'int', '*on-source-error': 'BlockdevOnError', '*on-target-error': 'BlockdevOnError', -@@ -2598,6 +2609,15 @@ +@@ -2600,6 +2611,15 @@ # destination (all the disk, only the sectors allocated in the # topmost image, or only new I/O). # @@ -379,7 +379,7 @@ index 1f87b07850..c2f6139dea 100644 # @granularity: granularity of the dirty bitmap, default is 64K if the # image format doesn't have clusters, 4K if the clusters are # smaller than that, else the cluster size. Must be a power of 2 -@@ -2650,7 +2670,8 @@ +@@ -2652,7 +2672,8 @@ { 'command': 'blockdev-mirror', 'data': { '*job-id': 'str', 'device': 'str', 'target': 'str', '*replaces': 'str', diff --git a/debian/patches/extra/0004-hw-display-qxl-validate-primary-surface-stride-again.patch b/debian/patches/extra/0004-hw-display-qxl-validate-primary-surface-stride-again.patch deleted file mode 100644 index 299927cb83..0000000000 --- a/debian/patches/extra/0004-hw-display-qxl-validate-primary-surface-stride-again.patch +++ /dev/null @@ -1,81 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= -Date: Mon, 20 Jul 2026 15:45:13 +0400 -Subject: [PATCH] hw/display/qxl: validate primary surface stride against width - -The existing validation in qxl_create_guest_primary() checks that -abs(stride) * height fits in vgamem_size and that stride is 4-byte -aligned, but never checks that abs(stride) is large enough to hold one -row of pixels for the declared width and format. - -A malicious guest can create a primary surface with a stride much -smaller than width * bytes_per_pixel (e.g. stride=4 for a 64-wide 32bpp -surface). The spice server rejects this via red_validate_surface(), but -the return is void and QEMU unconditionally proceeds to set up the local -rendering state. On the next display refresh, VNC or SDL reads width * -byptes_pp per scanline from a region backed by only stride bytes per -row, causing a host-side out-of-bounds read. - -Add three checks before creating the surface: - - reject unknown surface formats - - reject zero width or height - - reject surfaces where abs(stride) < width * bytes_per_pixel - -Fixes: CVE-2026-16271 -Fixes: 3761abb16784 ("hw/display/qxl: fix signed to unsigned comparison") -Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3637 -Signed-off-by: Marc-Andre Lureau -Link: https://lore.kernel.org/qemu-devel/20260720114513.2500370-1-marcandre.lureau@redhat.com -(picked from qemu-devel) -Signed-off-by: Fiona Ebner ---- - hw/display/qxl.c | 29 +++++++++++++++++++++++++++++ - 1 file changed, 29 insertions(+) - -diff --git a/hw/display/qxl.c b/hw/display/qxl.c -index b7d871b9ee..41673c369b 100644 ---- a/hw/display/qxl.c -+++ b/hw/display/qxl.c -@@ -1496,6 +1496,7 @@ static void qxl_create_guest_primary(PCIQXLDevice *qxl, int loadvm, - QXLSurfaceCreate *sc = &qxl->guest_primary.surface; - uint32_t requested_height = le32_to_cpu(sc->height); - int requested_stride = le32_to_cpu(sc->stride); -+ uint32_t bytes_pp; - - if (requested_stride == INT32_MIN || - abs(requested_stride) * (uint64_t)requested_height -@@ -1532,6 +1533,34 @@ static void qxl_create_guest_primary(PCIQXLDevice *qxl, int loadvm, - return; - } - -+ switch (surface.format) { -+ case SPICE_SURFACE_FMT_16_555: -+ case SPICE_SURFACE_FMT_16_565: -+ bytes_pp = 2; -+ break; -+ case SPICE_SURFACE_FMT_32_xRGB: -+ case SPICE_SURFACE_FMT_32_ARGB: -+ bytes_pp = 4; -+ break; -+ default: -+ qxl_set_guest_bug(qxl, "%s: unhandled format %d", -+ __func__, surface.format); -+ return; -+ } -+ -+ if (surface.width == 0 || surface.height == 0) { -+ qxl_set_guest_bug(qxl, "%s: zero dimension %ux%u", -+ __func__, surface.width, surface.height); -+ return; -+ } -+ -+ if ((uint64_t)surface.width * bytes_pp > abs(surface.stride)) { -+ qxl_set_guest_bug(qxl, "%s: stride too small for width:" -+ " stride %d width %u bpp %u", -+ __func__, surface.stride, surface.width, bytes_pp); -+ return; -+ } -+ - surface.mouse_mode = true; - surface.group_id = MEMSLOT_GROUP_GUEST; - if (loadvm) { diff --git a/debian/patches/extra/0005-hw-scsi-lsi53c895a-gracefully-handle-re-entrant-DMA.patch b/debian/patches/extra/0004-hw-scsi-lsi53c895a-gracefully-handle-re-entrant-DMA.patch similarity index 100% rename from debian/patches/extra/0005-hw-scsi-lsi53c895a-gracefully-handle-re-entrant-DMA.patch rename to debian/patches/extra/0004-hw-scsi-lsi53c895a-gracefully-handle-re-entrant-DMA.patch diff --git a/debian/patches/extra/0006-hw-display-vga-fix-text-mode-OOB-write-after-a-graph.patch b/debian/patches/extra/0006-hw-display-vga-fix-text-mode-OOB-write-after-a-graph.patch deleted file mode 100644 index 9c7c7f6d32..0000000000 --- a/debian/patches/extra/0006-hw-display-vga-fix-text-mode-OOB-write-after-a-graph.patch +++ /dev/null @@ -1,164 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Warisjeet Singh -Date: Mon, 24 Aug 2026 12:47:26 -0400 -Subject: [PATCH] hw/display/vga: fix text-mode OOB write after a graphics - surface switch - -vga_draw_text() decides whether the console surface needs a resize from -its geometry cache, but none of the cache terms observe the graphics -renderer having replaced the console surface in between: - -- last_width/last_height are shared with vga_draw_graphic(), which - stores them in pixels while the text path stores characters; -- last_depth stays 0 for legacy (non-VBE) graphics modes, because - vga_get_bpp() only reports a depth when VBE is enabled, so the - "s->last_depth" term that normally forces a resize after a graphics - frame does not fire. - -So a graphics frame that shrinks the console surface (e.g. 80x25 -pixels) followed by a text frame with matching character geometry -(80x25 chars) skips the resize, and the glyph loop then paints -width*cw x height*cheight pixels into the smaller surface, out of -bounds, with guest-controlled (DAC palette) values, on every display -refresh. - -Separate the geometry cache per renderer: text paths (vga_draw_text, -vga_update_text, and the text handling in vga_invalidate_display / -vga_common_reset) now only manipulate last_text_{width,height}, in -characters; last_{width,height} become graphics-only, in pixels. -Additionally, make the text path compare the pixel size it is about -to paint against the console surface's actual dimensions. The -surface check is the load-bearing term: caches in either unit cannot -see the other renderer swapping the surface, the surface can. - -Fixes: CVE-2026-77913 -Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4215 -Cc: qemu-stable@nongnu.org -Signed-off-by: Warisjeet Singh (sin99xx) -Message-ID: -(cherry picked from commit 418396be8013386a81f8d8d89ac0effcf03a64b6) -Signed-off-by: Fiona Ebner ---- - hw/display/vga.c | 37 ++++++++++++++++++++++--------------- - hw/display/vga_int.h | 3 ++- - 2 files changed, 24 insertions(+), 16 deletions(-) - -diff --git a/hw/display/vga.c b/hw/display/vga.c -index da0c331486..cb0e28b79b 100644 ---- a/hw/display/vga.c -+++ b/hw/display/vga.c -@@ -1241,7 +1241,10 @@ static void vga_draw_text(VGACommonState *s, int full_update) - return; - } - -- if (width != s->last_width || height != s->last_height || -+ if (surface == NULL || -+ surface_width(surface) != width * cw || -+ surface_height(surface) != height * cheight || -+ width != s->last_text_width || height != s->last_text_height || - cw != s->last_cw || cheight != s->last_ch || s->last_depth) { - s->last_scr_width = width * cw; - s->last_scr_height = height * cheight; -@@ -1249,8 +1252,8 @@ static void vga_draw_text(VGACommonState *s, int full_update) - surface = qemu_console_surface(s->con); - qemu_console_text_resize(s->con, width, height); - s->last_depth = 0; -- s->last_width = width; -- s->last_height = height; -+ s->last_text_width = width; -+ s->last_text_height = height; - s->last_ch = cheight; - s->last_cw = cw; - full_update = 1; -@@ -1845,6 +1848,8 @@ static void vga_invalidate_display(void *opaque) - - s->last_width = -1; - s->last_height = -1; -+ s->last_text_width = -1; -+ s->last_text_height = -1; - } - - void vga_common_reset(VGACommonState *s) -@@ -1887,6 +1892,8 @@ void vga_common_reset(VGACommonState *s) - s->last_ch = 0; - s->last_width = 0; - s->last_height = 0; -+ s->last_text_width = 0; -+ s->last_text_height = 0; - s->last_scr_width = 0; - s->last_scr_height = 0; - s->cursor_start = 0; -@@ -1938,8 +1945,8 @@ static void vga_update_text(void *opaque, uint32_t *chardata) - s->graphic_mode = graphic_mode; - full_update = 1; - } -- if (s->last_width == -1) { -- s->last_width = 0; -+ if (s->last_text_width == -1) { -+ s->last_text_width = 0; - full_update = 1; - } - -@@ -1978,15 +1985,15 @@ static void vga_update_text(void *opaque, uint32_t *chardata) - break; - } - -- if (width != s->last_width || height != s->last_height || -+ if (width != s->last_text_width || height != s->last_text_height || - cw != s->last_cw || cheight != s->last_ch) { - s->last_scr_width = width * cw; - s->last_scr_height = height * cheight; - qemu_console_resize(s->con, s->last_scr_width, s->last_scr_height); - qemu_console_text_resize(s->con, width, height); - s->last_depth = 0; -- s->last_width = width; -- s->last_height = height; -+ s->last_text_width = width; -+ s->last_text_height = height; - s->last_ch = cheight; - s->last_cw = cw; - full_update = 1; -@@ -2071,22 +2078,22 @@ static void vga_update_text(void *opaque, uint32_t *chardata) - } - - /* Display a message */ -- s->last_width = 60; -- s->last_height = height = 3; -+ s->last_text_width = 60; -+ s->last_text_height = height = 3; - qemu_console_text_set_cursor(s->con, -1, -1); -- qemu_console_text_resize(s->con, s->last_width, height); -+ qemu_console_text_resize(s->con, s->last_text_width, height); - -- for (dst = chardata, i = 0; i < s->last_width * height; i ++) -+ for (dst = chardata, i = 0; i < s->last_text_width * height; i ++) - *dst++ = ' '; - - size = strlen(msg_buffer); -- width = (s->last_width - size) / 2; -- dst = chardata + s->last_width + width; -+ width = (s->last_text_width - size) / 2; -+ dst = chardata + s->last_text_width + width; - for (i = 0; i < size; i ++) - *dst++ = ATTR2CHTYPE(msg_buffer[i], QEMU_COLOR_BLUE, - QEMU_COLOR_BLACK, 1); - -- qemu_console_text_update(s->con, 0, 0, s->last_width, height); -+ qemu_console_text_update(s->con, 0, 0, s->last_text_width, height); - } - - static uint64_t vga_mem_read(void *opaque, hwaddr addr, -diff --git a/hw/display/vga_int.h b/hw/display/vga_int.h -index 5664317ecd..ca69ae9815 100644 ---- a/hw/display/vga_int.h -+++ b/hw/display/vga_int.h -@@ -122,7 +122,8 @@ typedef struct VGACommonState { - uint32_t plane_updated; - uint32_t last_line_offset; - uint8_t last_cw, last_ch; -- uint32_t last_width, last_height; /* in chars or pixels */ -+ uint32_t last_width, last_height; /* in pixels (graphics renderer) */ -+ uint32_t last_text_width, last_text_height; /* in chars (text renderer) */ - uint32_t last_scr_width, last_scr_height; /* in pixels */ - uint32_t last_depth; /* in bits */ - bool last_byteswap; diff --git a/debian/patches/extra/0007-scsi-disk-fix-out-of-bound-read-in-WRITE-SAME.patch b/debian/patches/extra/0007-scsi-disk-fix-out-of-bound-read-in-WRITE-SAME.patch deleted file mode 100644 index ffab5481da..0000000000 --- a/debian/patches/extra/0007-scsi-disk-fix-out-of-bound-read-in-WRITE-SAME.patch +++ /dev/null @@ -1,71 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Paolo Bonzini -Date: Wed, 26 Aug 2026 19:22:41 +0200 -Subject: [PATCH] scsi-disk: fix out-of-bound read in WRITE SAME - -A guest with an attached scsi-hd can force QEMU's SCSI disk emulation -to read roughly 60 KiB past the end of a heap buffer, copying that out -of bounds host memory into the guest's own disk image. - -WRITE SAME computes the request transfer length at dev->blocksize -when the request is prepared and sets cmd->xfer from dev->blocksize. -scsi_disk_emulate_command() then uses cmd->xfer as the size of the -request buffer. - -However, MODE SELECT can race with the WRITE SAME command and guest raise -the logical block size to any value whose low bits fit 0xfe00, up to 65024. -In the presence of this race, scsi_disk_emulate_write_same() will read -from memory as many bytes as indicated by the *new* dev->blocksize, -and write it to disk. - -The read length in WRITE SAME must be bounded by the buffer that was -actually allocated, not by the mutable s->qdev.blocksize, so clamp the -length used against inbuf to r->buflen. Re-validating req->cmd.xfer -against the current block size would not work because the race is -intrinsic in the SCSI protocol. - -I am not sure if this is exploitable with virtio-scsi and other SG-capable -HBAs, because it should process the WRITE SAME input immediately, -without letting the MODE SELECT command race with it. - -Fixes: 356c4c441ec ("scsi-disk: allow MODE SELECT block descriptor to set the block size", 2022-07-13) -Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4365 -Cc: qemu-stable@nongnu.org -Reviewed-by: Stefan Hajnoczi -Signed-off-by: Paolo Bonzini -(cherry picked from commit d30254aec93141d6b89262986a62764b2ae07177) -Signed-off-by: Fiona Ebner ---- - hw/scsi/scsi-disk.c | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c -index 1b0cce128c..5bb7a974d6 100644 ---- a/hw/scsi/scsi-disk.c -+++ b/hw/scsi/scsi-disk.c -@@ -1911,6 +1911,7 @@ static void scsi_disk_emulate_write_same(SCSIDiskReq *r, uint8_t *inbuf) - SCSIRequest *req = &r->req; - SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev); - uint32_t nb_sectors = scsi_data_cdb_xfer(r->req.cmd.buf); -+ uint32_t buflen = MIN(s->qdev.blocksize, r->buflen); - WriteSameCBData *data; - uint8_t *buf; - int i, l; -@@ -1930,7 +1931,7 @@ static void scsi_disk_emulate_write_same(SCSIDiskReq *r, uint8_t *inbuf) - return; - } - -- if ((req->cmd.buf[1] & 0x1) || buffer_is_zero(inbuf, s->qdev.blocksize)) { -+ if ((req->cmd.buf[1] & 0x1) || buffer_is_zero(inbuf, buflen)) { - int flags = (req->cmd.buf[1] & 0x8) ? BDRV_REQ_MAY_UNMAP : 0; - - /* The request is used as the AIO opaque value, so add a ref. */ -@@ -1956,7 +1957,7 @@ static void scsi_disk_emulate_write_same(SCSIDiskReq *r, uint8_t *inbuf) - qemu_iovec_init_external(&data->qiov, &data->iov, 1); - - for (i = 0; i < data->iov.iov_len; i += l) { -- l = MIN(s->qdev.blocksize, data->iov.iov_len - i); -+ l = MIN(buflen, data->iov.iov_len - i); - memcpy(&buf[i], inbuf, l); - } - diff --git a/debian/patches/extra/0008-scsi-hide-MODE-SELECT-block-size-change-behind-a-qui.patch b/debian/patches/extra/0008-scsi-hide-MODE-SELECT-block-size-change-behind-a-qui.patch deleted file mode 100644 index 28b60a97d2..0000000000 --- a/debian/patches/extra/0008-scsi-hide-MODE-SELECT-block-size-change-behind-a-qui.patch +++ /dev/null @@ -1,89 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Paolo Bonzini -Date: Wed, 26 Aug 2026 19:53:31 +0200 -Subject: [PATCH] scsi: hide MODE SELECT block size change behind a quirk - -This is a dangerous operation in that the block size is not -protected by a lock, but it can be written concurrently if -you have a multi-queue virtio-scsi HBA. Put it behind a quirk -that is only enabled by the Q800 machine, since the MODE -SELECT feature was added for A/UX. - -Cc: qemu-stable@nongnu.org -Reviewed-by: Stefan Hajnoczi -Signed-off-by: Paolo Bonzini -(cherry picked from commit 0f410adf6b0dead1f09938054da639954bda3bc1) -Signed-off-by: Fiona Ebner ---- - hw/m68k/q800.c | 2 ++ - hw/scsi/scsi-disk.c | 12 ++++++++++-- - include/hw/scsi/scsi.h | 1 + - 3 files changed, 13 insertions(+), 2 deletions(-) - -diff --git a/hw/m68k/q800.c b/hw/m68k/q800.c -index ab64250c47..1ad3f93b29 100644 ---- a/hw/m68k/q800.c -+++ b/hw/m68k/q800.c -@@ -710,12 +710,14 @@ static void q800_init(Object *obj) - - static GlobalProperty hw_compat_q800[] = { - { "scsi-hd", "quirk_mode_page_vendor_specific_apple", "on" }, -+ { "scsi-hd", "quirk_mode_page_set_block_size", "on" }, - { "scsi-hd", "vendor", " SEAGATE" }, - { "scsi-hd", "product", " ST225N" }, - { "scsi-hd", "ver", "1.0 " }, - { "scsi-cd", "quirk_mode_page_apple_vendor", "on" }, - { "scsi-cd", "quirk_mode_sense_rom_use_dbd", "on" }, - { "scsi-cd", "quirk_mode_page_vendor_specific_apple", "on" }, -+ { "scsi-cd", "quirk_mode_page_set_block_size", "on" }, - { "scsi-cd", "quirk_mode_page_truncated", "on" }, - { "scsi-cd", "vendor", "MATSHITA" }, - { "scsi-cd", "product", "CD-ROM CR-8005" }, -diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c -index 5bb7a974d6..a42f7d8e77 100644 ---- a/hw/scsi/scsi-disk.c -+++ b/hw/scsi/scsi-disk.c -@@ -1673,8 +1673,12 @@ static void scsi_disk_emulate_mode_select(SCSIDiskReq *r, uint8_t *inbuf) - goto invalid_param; - } - -- /* Allow changing the block size */ -- if (bd_len) { -+ /* -+ * Allow changing the block size only if the quirk is enabled for it. -+ * Writing s->qdev.blocksize is not thread safe! -+ */ -+ if (bd_len && (s->quirks & -+ (1 << SCSI_DISK_QUIRK_MODE_PAGE_SET_BLOCK_SIZE))) { - bs = p[5] << 16 | p[6] << 8 | p[7]; - - /* -@@ -3247,6 +3251,8 @@ static const Property scsi_hd_properties[] = { - DEFINE_PROP_BIT("quirk_mode_page_vendor_specific_apple", SCSIDiskState, - quirks, SCSI_DISK_QUIRK_MODE_PAGE_VENDOR_SPECIFIC_APPLE, - 0), -+ DEFINE_PROP_BIT("quirk_mode_page_set_block_size", SCSIDiskState, -+ quirks, SCSI_DISK_QUIRK_MODE_PAGE_SET_BLOCK_SIZE, 0), - DEFINE_BLOCK_CHS_PROPERTIES(SCSIDiskState, qdev.conf), - }; - -@@ -3352,6 +3358,8 @@ static const Property scsi_cd_properties[] = { - 0), - DEFINE_PROP_BIT("quirk_mode_page_truncated", SCSIDiskState, quirks, - SCSI_DISK_QUIRK_MODE_PAGE_TRUNCATED, 0), -+ DEFINE_PROP_BIT("quirk_mode_page_set_block_size", SCSIDiskState, -+ quirks, SCSI_DISK_QUIRK_MODE_PAGE_SET_BLOCK_SIZE, 0), - }; - - static void scsi_cd_class_initfn(ObjectClass *klass, const void *data) -diff --git a/include/hw/scsi/scsi.h b/include/hw/scsi/scsi.h -index c60c6e8810..3eab339b0d 100644 ---- a/include/hw/scsi/scsi.h -+++ b/include/hw/scsi/scsi.h -@@ -262,5 +262,6 @@ bool scsi_generic_pr_state_preempt(SCSIDevice *s, Error **errp); - #define SCSI_DISK_QUIRK_MODE_SENSE_ROM_USE_DBD 1 - #define SCSI_DISK_QUIRK_MODE_PAGE_VENDOR_SPECIFIC_APPLE 2 - #define SCSI_DISK_QUIRK_MODE_PAGE_TRUNCATED 3 -+#define SCSI_DISK_QUIRK_MODE_PAGE_SET_BLOCK_SIZE 4 - - #endif diff --git a/debian/patches/extra/0009-vapic-confine-the-VAPIC-region-to-0xc0000.0xe0000.patch b/debian/patches/extra/0009-vapic-confine-the-VAPIC-region-to-0xc0000.0xe0000.patch deleted file mode 100644 index c0b17c6339..0000000000 --- a/debian/patches/extra/0009-vapic-confine-the-VAPIC-region-to-0xc0000.0xe0000.patch +++ /dev/null @@ -1,75 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Paolo Bonzini -Date: Wed, 26 Aug 2026 20:02:56 +0200 -Subject: [PATCH] vapic: confine the VAPIC region to 0xc0000..0xe0000 -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -The VAPIC region is mapped as writable RAM, at very high priority, -above existing memory. If the guest is allowed to map it everywhere, -it can overlap PCI BARs or even SMRAM. Ensure that the whole -region first in the 128K of low memory that are reserved to -option ROMs. - -Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4206 -Reported-by: Artem Dinaburg -Cc: qemu-stable@nongnu.org -Reviewed-by: Philippe Mathieu-Daudé -Signed-off-by: Paolo Bonzini -(cherry picked from commit d61c8a6fb7388486353aa267ba0d75b098f16662) -Signed-off-by: Fiona Ebner ---- - hw/i386/vapic.c | 16 +++++++++++++++- - 1 file changed, 15 insertions(+), 1 deletion(-) - -diff --git a/hw/i386/vapic.c b/hw/i386/vapic.c -index 8dd9188d96..9adce17262 100644 ---- a/hw/i386/vapic.c -+++ b/hw/i386/vapic.c -@@ -34,6 +34,10 @@ - #define ROM_BLOCK_SIZE 512 - #define ROM_BLOCK_MASK (~(ROM_BLOCK_SIZE - 1)) - -+/* Option ROM window on PC/Q35 machines; the vapic ROM must live in here. */ -+#define OPTION_ROM_START 0xc0000 -+#define OPTION_ROM_END 0xe0000 -+ - typedef enum VAPICMode { - VAPIC_INACTIVE = 0, - VAPIC_ACTIVE = 1, -@@ -592,6 +596,14 @@ static int vapic_map_rom_writable(VAPICROMState *s) - size_t rom_size; - uint8_t *ram; - -+ /* -+ * The VAPIC region should be mapped in place, refuse mapping it -+ * outside of the option ROM window. -+ */ -+ if (rom_paddr < OPTION_ROM_START || rom_paddr >= OPTION_ROM_END) { -+ return -1; -+ } -+ - if (s->rom_mapped_writable) { - memory_region_del_subregion(mr, &s->rom); - object_unparent(OBJECT(&s->rom)); -@@ -606,9 +618,10 @@ static int vapic_map_rom_writable(VAPICROMState *s) - } - ram = memory_region_get_ram_ptr(section.mr); - rom_size = ram[rom_paddr + 2] * ROM_BLOCK_SIZE; -- if (rom_size == 0) { -+ if (rom_size == 0 || rom_size > OPTION_ROM_END - rom_paddr) { - return -1; - } -+ - s->rom_size = rom_size; - - /* We need to round to avoid creating subpages -@@ -616,6 +629,7 @@ static int vapic_map_rom_writable(VAPICROMState *s) - rom_size += rom_paddr & ~TARGET_PAGE_MASK; - rom_paddr &= TARGET_PAGE_MASK; - rom_size = TARGET_PAGE_ALIGN(rom_size); -+ assert(rom_paddr >= OPTION_ROM_START && rom_paddr + rom_size <= OPTION_ROM_END); - - memory_region_init_alias(&s->rom, OBJECT(s), "kvmvapic-rom", section.mr, - rom_paddr, rom_size); diff --git a/debian/patches/extra/0010-i386-vapic-unref-MemoryRegion-if-vapic_map_rom_writa.patch b/debian/patches/extra/0010-i386-vapic-unref-MemoryRegion-if-vapic_map_rom_writa.patch deleted file mode 100644 index c232e80930..0000000000 --- a/debian/patches/extra/0010-i386-vapic-unref-MemoryRegion-if-vapic_map_rom_writa.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Paolo Bonzini -Date: Wed, 26 Aug 2026 19:47:32 +0200 -Subject: [PATCH] i386/vapic: unref MemoryRegion if vapic_map_rom_writable - fails - -memory_region_find returns the memory region with an elevated -reference count. Drop the reference count also if the memory -region cannot be mapped writable. - -Cc: qemu-stable@nongnu.org -Signed-off-by: Paolo Bonzini -(cherry picked from commit cfa6e2c52ca8f756461fe41f4ce40e61a82fd914) -Signed-off-by: Fiona Ebner ---- - hw/i386/vapic.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/hw/i386/vapic.c b/hw/i386/vapic.c -index 9adce17262..5c3911cf9c 100644 ---- a/hw/i386/vapic.c -+++ b/hw/i386/vapic.c -@@ -614,11 +614,13 @@ static int vapic_map_rom_writable(VAPICROMState *s) - - /* read ROM size from RAM region */ - if (rom_paddr + 2 >= memory_region_size(section.mr)) { -+ memory_region_unref(section.mr); - return -1; - } - ram = memory_region_get_ram_ptr(section.mr); - rom_size = ram[rom_paddr + 2] * ROM_BLOCK_SIZE; - if (rom_size == 0 || rom_size > OPTION_ROM_END - rom_paddr) { -+ memory_region_unref(section.mr); - return -1; - } - diff --git a/debian/patches/extra/0011-io-channel-socket-do-not-treat-a-zero-length-write-a.patch b/debian/patches/extra/0011-io-channel-socket-do-not-treat-a-zero-length-write-a.patch deleted file mode 100644 index 24834b364c..0000000000 --- a/debian/patches/extra/0011-io-channel-socket-do-not-treat-a-zero-length-write-a.patch +++ /dev/null @@ -1,54 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: "Denis V. Lunev" -Date: Mon, 31 Aug 2026 12:01:46 +0200 -Subject: [PATCH] io/channel-socket: do not treat a zero length write as an - error -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -qio_channel_socket_writev() checks "ret <= 0" after sendmsg(). A zero -length iovec is written successfully and returns 0, so the success -falls into the errno switch, which acts on whatever the last failing -syscall left in errno. A stale EAGAIN turns it into -QIO_CHANNEL_ERR_BLOCK with errp untouched, and a caller which treats -every negative return as fatal then passes a NULL Error to -error_get_pretty(). The websocket handshake does exactly that, so an -unauthenticated client crashes QEMU during the greeting. - -Returning 0 is safe for callers which loop until everything is -written. qio_channel_writev_full_all() has no zero progress guard, but -iov_copy() yields no entries for a zero length write, so that loop is -never entered. A connected stream socket returns 0 only when there is -nothing to send. - -The WIN32 implementation in the same file uses "ret < 0". - -Fixes: CVE-2026-84788 -Fixes: 559607ea173a ("io: add QIOChannelSocket class") -Cc: qemu-stable@nongnu.org -Cc: Daniel P. Berrangé -Cc: Marc-André Lureau -Reviewed-by: Daniel P. Berrangé -Reviewed-by: Marc-André Lureau -Signed-off-by: Denis V. Lunev -Signed-off-by: Daniel P. Berrangé -(cherry picked from commit a3de21bfa5d0c33110942d407ff5c7903965d3ad) -Signed-off-by: Fiona Ebner ---- - io/channel-socket.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/io/channel-socket.c b/io/channel-socket.c -index 12773b832c..7920cee639 100644 ---- a/io/channel-socket.c -+++ b/io/channel-socket.c -@@ -667,7 +667,7 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc, - - retry: - ret = sendmsg(sioc->fd, &msg, sflags); -- if (ret <= 0) { -+ if (ret < 0) { - switch (errno) { - case EAGAIN: - return QIO_CHANNEL_ERR_BLOCK; diff --git a/debian/patches/pve/0011-PVE-virtio-balloon-improve-query-balloon.patch b/debian/patches/pve/0011-PVE-virtio-balloon-improve-query-balloon.patch index c0e337a613..de48b8fe25 100644 --- a/debian/patches/pve/0011-PVE-virtio-balloon-improve-query-balloon.patch +++ b/debian/patches/pve/0011-PVE-virtio-balloon-improve-query-balloon.patch @@ -59,10 +59,10 @@ index 686304bafa..474afba207 100644 qapi_free_BalloonInfo(info); } diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c -index 4c5f486ba2..58fa33fb4a 100644 +index 07d519cf6d..55c775bfe2 100644 --- a/hw/virtio/virtio-balloon.c +++ b/hw/virtio/virtio-balloon.c -@@ -793,8 +793,37 @@ static uint64_t virtio_balloon_get_features(VirtIODevice *vdev, uint64_t f, +@@ -797,8 +797,37 @@ static uint64_t virtio_balloon_get_features(VirtIODevice *vdev, uint64_t f, static void virtio_balloon_stat(void *opaque, BalloonInfo *info) { VirtIOBalloon *dev = opaque; diff --git a/debian/patches/pve/0015-PVE-add-savevm-async-for-background-state-snapshots.patch b/debian/patches/pve/0015-PVE-add-savevm-async-for-background-state-snapshots.patch index f04bc2896a..4bc6855b2e 100644 --- a/debian/patches/pve/0015-PVE-add-savevm-async-for-background-state-snapshots.patch +++ b/debian/patches/pve/0015-PVE-add-savevm-async-for-background-state-snapshots.patch @@ -883,10 +883,10 @@ index b1eaf7b054..0794a3a7a3 100644 # @query-migrate: # diff --git a/qapi/misc.json b/qapi/misc.json -index 22b7afed9f..786aeb4d3c 100644 +index c71a5fe657..48359a8992 100644 --- a/qapi/misc.json +++ b/qapi/misc.json -@@ -455,6 +455,31 @@ +@@ -463,6 +463,31 @@ ## { 'command': 'query-fdsets', 'returns': ['FdsetInfo'] } diff --git a/debian/patches/pve/0017-PVE-block-add-the-zeroinit-block-driver-filter.patch b/debian/patches/pve/0017-PVE-block-add-the-zeroinit-block-driver-filter.patch index 93f0c8d78e..c88df54d03 100644 --- a/debian/patches/pve/0017-PVE-block-add-the-zeroinit-block-driver-filter.patch +++ b/debian/patches/pve/0017-PVE-block-add-the-zeroinit-block-driver-filter.patch @@ -247,10 +247,10 @@ index 0000000000..036edb17f5 + +block_init(bdrv_zeroinit_init); diff --git a/qapi/block-core.json b/qapi/block-core.json -index c2f6139dea..c3204f5739 100644 +index 28d9c1e98e..07d16c4a04 100644 --- a/qapi/block-core.json +++ b/qapi/block-core.json -@@ -3375,7 +3375,7 @@ +@@ -3377,7 +3377,7 @@ { 'name': 'virtio-blk-vfio-pci', 'if': 'CONFIG_BLKIO' }, { 'name': 'virtio-blk-vhost-user', 'if': 'CONFIG_BLKIO' }, { 'name': 'virtio-blk-vhost-vdpa', 'if': 'CONFIG_BLKIO' }, @@ -259,7 +259,7 @@ index c2f6139dea..c3204f5739 100644 ## # @BlockdevOptionsFile: -@@ -4909,7 +4909,8 @@ +@@ -4911,7 +4911,8 @@ 'if': 'CONFIG_BLKIO' }, 'vmdk': 'BlockdevOptionsGenericCOWFormat', 'vpc': 'BlockdevOptionsGenericFormat', diff --git a/debian/patches/pve/0020-PVE-Up-Config-file-posix-make-locking-optiono-on-cre.patch b/debian/patches/pve/0020-PVE-Up-Config-file-posix-make-locking-optiono-on-cre.patch index c52036cfcc..19a9952b75 100644 --- a/debian/patches/pve/0020-PVE-Up-Config-file-posix-make-locking-optiono-on-cre.patch +++ b/debian/patches/pve/0020-PVE-Up-Config-file-posix-make-locking-optiono-on-cre.patch @@ -119,10 +119,10 @@ index e5b942b6e4..adf9557428 100644 }; return raw_co_create(&options, errp); diff --git a/qapi/block-core.json b/qapi/block-core.json -index c3204f5739..338675b98a 100644 +index 07d16c4a04..a12a1a2747 100644 --- a/qapi/block-core.json +++ b/qapi/block-core.json -@@ -5128,6 +5128,10 @@ +@@ -5130,6 +5130,10 @@ # @extent-size-hint: Extent size hint to add to the image file; 0 for # not adding an extent size hint (default: 1 MB, since 5.1) # @@ -133,7 +133,7 @@ index c3204f5739..338675b98a 100644 # Since: 2.12 ## { 'struct': 'BlockdevCreateOptionsFile', -@@ -5135,7 +5139,8 @@ +@@ -5137,7 +5141,8 @@ 'size': 'size', '*preallocation': 'PreallocMode', '*nocow': 'bool', diff --git a/debian/patches/pve/0025-PVE-Backup-add-backup-dump-block-driver.patch b/debian/patches/pve/0025-PVE-Backup-add-backup-dump-block-driver.patch index 98e5c0eee7..e23026c00b 100644 --- a/debian/patches/pve/0025-PVE-Backup-add-backup-dump-block-driver.patch +++ b/debian/patches/pve/0025-PVE-Backup-add-backup-dump-block-driver.patch @@ -312,7 +312,7 @@ index 147c08155f..41c82fc1ab 100644 BDRV_TRACKED_READ, BDRV_TRACKED_WRITE, diff --git a/job.c b/job.c -index e747908472..5120a01265 100644 +index d7220aaf30..40dd820fba 100644 --- a/job.c +++ b/job.c @@ -337,7 +337,8 @@ static bool job_started_locked(Job *job) diff --git a/debian/patches/pve/0026-PVE-Add-sequential-job-transaction-support.patch b/debian/patches/pve/0026-PVE-Add-sequential-job-transaction-support.patch index 8f1b20151c..2f1c31a750 100644 --- a/debian/patches/pve/0026-PVE-Add-sequential-job-transaction-support.patch +++ b/debian/patches/pve/0026-PVE-Add-sequential-job-transaction-support.patch @@ -34,7 +34,7 @@ index 0e40e8b457..f4fff5fa0d 100644 * Release a reference that was previously acquired with job_txn_add_job or * job_txn_new. If it's the last reference to the object, it will be freed. diff --git a/job.c b/job.c -index 5120a01265..353a0216cd 100644 +index 40dd820fba..6de4c7cfdb 100644 --- a/job.c +++ b/job.c @@ -94,6 +94,8 @@ struct JobTxn { @@ -72,7 +72,7 @@ index 5120a01265..353a0216cd 100644 /* Called with job_mutex held. */ static void job_txn_ref_locked(JobTxn *txn) { -@@ -1048,6 +1069,12 @@ static void job_completed_txn_success_locked(Job *job) +@@ -1055,6 +1076,12 @@ static void job_completed_txn_success_locked(Job *job) */ QLIST_FOREACH(other_job, &txn->jobs, txn_list) { if (!job_is_completed_locked(other_job)) { @@ -85,7 +85,7 @@ index 5120a01265..353a0216cd 100644 return; } assert(other_job->ret == 0); -@@ -1259,6 +1286,13 @@ int job_finish_sync_locked(Job *job, +@@ -1266,6 +1293,13 @@ int job_finish_sync_locked(Job *job, return -EBUSY; } diff --git a/debian/patches/pve/0027-PVE-Backup-Proxmox-backup-patches-for-QEMU.patch b/debian/patches/pve/0027-PVE-Backup-Proxmox-backup-patches-for-QEMU.patch index 67bb0c2f10..e5d76c54c0 100644 --- a/debian/patches/pve/0027-PVE-Backup-Proxmox-backup-patches-for-QEMU.patch +++ b/debian/patches/pve/0027-PVE-Backup-Proxmox-backup-patches-for-QEMU.patch @@ -1685,7 +1685,7 @@ index 0000000000..177fb851b4 + return ret; +} diff --git a/qapi/block-core.json b/qapi/block-core.json -index 338675b98a..2a0cc0fd2a 100644 +index a12a1a2747..e66c455f6e 100644 --- a/qapi/block-core.json +++ b/qapi/block-core.json @@ -952,6 +952,248 @@ diff --git a/debian/patches/pve/0029-PVE-Add-PBS-block-driver-to-map-backup-archives-into.patch b/debian/patches/pve/0029-PVE-Add-PBS-block-driver-to-map-backup-archives-into.patch index 1af35e10b7..0dbc77f807 100644 --- a/debian/patches/pve/0029-PVE-Add-PBS-block-driver-to-map-backup-archives-into.patch +++ b/debian/patches/pve/0029-PVE-Add-PBS-block-driver-to-map-backup-archives-into.patch @@ -361,10 +361,10 @@ index 91de400570..b1cbaa100e 100644 summary_info += {'libdaxctl support': libdaxctl} summary_info += {'libcbor support': libcbor} diff --git a/qapi/block-core.json b/qapi/block-core.json -index 2a0cc0fd2a..d3349661ba 100644 +index e66c455f6e..ca18144902 100644 --- a/qapi/block-core.json +++ b/qapi/block-core.json -@@ -3613,6 +3613,7 @@ +@@ -3615,6 +3615,7 @@ 'parallels', 'preallocate', 'qcow', 'qcow2', 'qed', 'quorum', 'raw', 'rbd', { 'name': 'replication', 'if': 'CONFIG_REPLICATION' }, @@ -372,7 +372,7 @@ index 2a0cc0fd2a..d3349661ba 100644 'ssh', 'throttle', 'vdi', 'vhdx', { 'name': 'virtio-blk-vfio-pci', 'if': 'CONFIG_BLKIO' }, { 'name': 'virtio-blk-vhost-user', 'if': 'CONFIG_BLKIO' }, -@@ -3699,6 +3700,33 @@ +@@ -3701,6 +3702,33 @@ { 'struct': 'BlockdevOptionsNull', 'data': { '*size': 'int', '*latency-ns': 'uint64', '*read-zeroes': 'bool' } } @@ -406,7 +406,7 @@ index 2a0cc0fd2a..d3349661ba 100644 ## # @BlockdevOptionsNVMe: # -@@ -5122,6 +5150,7 @@ +@@ -5124,6 +5152,7 @@ 'nfs': 'BlockdevOptionsNfs', 'null-aio': 'BlockdevOptionsNull', 'null-co': 'BlockdevOptionsNull', diff --git a/debian/patches/pve/0031-PVE-Migrate-dirty-bitmap-state-via-savevm.patch b/debian/patches/pve/0031-PVE-Migrate-dirty-bitmap-state-via-savevm.patch index 407c9a7e2e..f14c756faa 100644 --- a/debian/patches/pve/0031-PVE-Migrate-dirty-bitmap-state-via-savevm.patch +++ b/debian/patches/pve/0031-PVE-Migrate-dirty-bitmap-state-via-savevm.patch @@ -200,7 +200,7 @@ index 177fb851b4..7575abab7c 100644 ret->pbs_masterkey = true; ret->backup_max_workers = true; diff --git a/qapi/block-core.json b/qapi/block-core.json -index d3349661ba..5965a3c1f3 100644 +index ca18144902..91efb9922e 100644 --- a/qapi/block-core.json +++ b/qapi/block-core.json @@ -1112,6 +1112,11 @@ diff --git a/debian/patches/pve/0032-migration-block-dirty-bitmap-migrate-other-bitmaps-e.patch b/debian/patches/pve/0032-migration-block-dirty-bitmap-migrate-other-bitmaps-e.patch index d331b20701..b5394a53b0 100644 --- a/debian/patches/pve/0032-migration-block-dirty-bitmap-migrate-other-bitmaps-e.patch +++ b/debian/patches/pve/0032-migration-block-dirty-bitmap-migrate-other-bitmaps-e.patch @@ -19,7 +19,7 @@ Signed-off-by: Thomas Lamprecht 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/migration/block-dirty-bitmap.c b/migration/block-dirty-bitmap.c -index cba54e25cd..23eb5f40b3 100644 +index 1b8f39c12b..00e35179e6 100644 --- a/migration/block-dirty-bitmap.c +++ b/migration/block-dirty-bitmap.c @@ -539,7 +539,11 @@ static int add_bitmaps_to_list(DBMSaveState *s, BlockDriverState *bs, diff --git a/debian/patches/pve/0035-block-add-alloc-track-driver.patch b/debian/patches/pve/0035-block-add-alloc-track-driver.patch index 1f566747f8..b54317dd3e 100644 --- a/debian/patches/pve/0035-block-add-alloc-track-driver.patch +++ b/debian/patches/pve/0035-block-add-alloc-track-driver.patch @@ -449,10 +449,10 @@ index d023753091..a777c8079c 100644 out: diff --git a/qapi/block-core.json b/qapi/block-core.json -index 5965a3c1f3..5a9ab23d5d 100644 +index 91efb9922e..80ffcc0547 100644 --- a/qapi/block-core.json +++ b/qapi/block-core.json -@@ -3606,7 +3606,8 @@ +@@ -3608,7 +3608,8 @@ # Since: 2.9 ## { 'enum': 'BlockdevDriver', @@ -462,7 +462,7 @@ index 5965a3c1f3..5a9ab23d5d 100644 'cloop', 'compress', 'copy-before-write', 'copy-on-read', 'dmg', 'file', 'snapshot-access', 'ftp', 'ftps', {'name': 'host_cdrom', 'if': 'HAVE_HOST_BLOCK_DEVICE' }, -@@ -3706,6 +3707,21 @@ +@@ -3708,6 +3709,21 @@ { 'struct': 'BlockdevOptionsNull', 'data': { '*size': 'int', '*latency-ns': 'uint64', '*read-zeroes': 'bool' } } @@ -484,7 +484,7 @@ index 5965a3c1f3..5a9ab23d5d 100644 ## # @BlockdevOptionsPbs: # -@@ -5129,6 +5145,7 @@ +@@ -5131,6 +5147,7 @@ '*detect-zeroes': 'BlockdevDetectZeroesOptions' }, 'discriminator': 'driver', 'data': { diff --git a/debian/patches/pve/0036-PVE-backup-add-fleecing-option.patch b/debian/patches/pve/0036-PVE-backup-add-fleecing-option.patch index 0368018156..dbcf3bb65f 100644 --- a/debian/patches/pve/0036-PVE-backup-add-fleecing-option.patch +++ b/debian/patches/pve/0036-PVE-backup-add-fleecing-option.patch @@ -429,7 +429,7 @@ index 7575abab7c..8b83465ebd 100644 return ret; } diff --git a/qapi/block-core.json b/qapi/block-core.json -index 5a9ab23d5d..2dd422aa03 100644 +index 80ffcc0547..62d7fb4e7a 100644 --- a/qapi/block-core.json +++ b/qapi/block-core.json @@ -1054,6 +1054,10 @@ diff --git a/debian/patches/pve/0042-PVE-backup-implement-backup-access-setup-and-teardow.patch b/debian/patches/pve/0042-PVE-backup-implement-backup-access-setup-and-teardow.patch index f74e82017a..598ed3e441 100644 --- a/debian/patches/pve/0042-PVE-backup-implement-backup-access-setup-and-teardow.patch +++ b/debian/patches/pve/0042-PVE-backup-implement-backup-access-setup-and-teardow.patch @@ -740,7 +740,7 @@ index 0000000000..9ebeef7c8f + +#endif /* PVE_BACKUP_H */ diff --git a/qapi/block-core.json b/qapi/block-core.json -index 2dd422aa03..7ef1dd337c 100644 +index 62d7fb4e7a..5e50776664 100644 --- a/qapi/block-core.json +++ b/qapi/block-core.json @@ -1128,6 +1128,9 @@ diff --git a/debian/patches/series b/debian/patches/series index a13019354d..3140ed6230 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -1,14 +1,7 @@ extra/0001-monitor-qmp-fix-race-with-clients-disconnecting-earl.patch extra/0002-fdmon-io_uring-avoid-idle-event-loop-being-accounted.patch extra/0003-block-vmdk-tolerate-known-seSparse-reserved1-bit.patch -extra/0004-hw-display-qxl-validate-primary-surface-stride-again.patch -extra/0005-hw-scsi-lsi53c895a-gracefully-handle-re-entrant-DMA.patch -extra/0006-hw-display-vga-fix-text-mode-OOB-write-after-a-graph.patch -extra/0007-scsi-disk-fix-out-of-bound-read-in-WRITE-SAME.patch -extra/0008-scsi-hide-MODE-SELECT-block-size-change-behind-a-qui.patch -extra/0009-vapic-confine-the-VAPIC-region-to-0xc0000.0xe0000.patch -extra/0010-i386-vapic-unref-MemoryRegion-if-vapic_map_rom_writa.patch -extra/0011-io-channel-socket-do-not-treat-a-zero-length-write-a.patch +extra/0004-hw-scsi-lsi53c895a-gracefully-handle-re-entrant-DMA.patch bitmap-mirror/0001-drive-mirror-add-support-for-sync-bitmap-mode-never.patch bitmap-mirror/0002-drive-mirror-add-support-for-conditional-and-always-.patch bitmap-mirror/0003-mirror-add-check-for-bitmap-mode-without-bitmap.patch diff --git a/qemu b/qemu index c3d48b7d1e..4fc49f46dc 160000 --- a/qemu +++ b/qemu @@ -1 +1 @@ -Subproject commit c3d48b7d1e89604920e5b81b91140c2ad39a1943 +Subproject commit 4fc49f46dc95d4a27de2509e7fceb2931e91faeb -- 2.47.3