* origin/main:
Temporarily switch to a hash file for download verification

The signing key still uses SHA1, which is rejected by sequoia-sq. Switch
to hash file until the ...

Some of them were already backported, but there are few more relevant
fixes. This may also ease ...

See patch description

Drop patches included upstream already, refresh SOURCE_DATE_EPOCH patch
to resolve conflict.

Running qemu upstream in stubdomain missed one hvmloader setting, fix it
now.

QubesOS/qubes-iss...

QubesOS/qubes-issues#6834

* origin/pr/171:
Disable annobin for the hypervisor build

Related to QubesOS/qubes-issues#8737

Fixes QubesOS/qubes-issues#8111

The .annobin.notes section gets placed at the start of xen.efi, which
(for unclear reasons) brea...

* msix:
Apply patches for MSI-X support with stubdomain

* origin/pr/169:
Compress old console logs

And avoid sending a comment as an input for ldconfig.

Fixes QubesOS/qubes-issues#4799
Fixes QubesOS/qubes-issues#7057
Fixes QubesOS/qubes-issues#7052

They may grow quite big in some cases, and are very compressible.

Fixes QubesOS/qubes-issues#8502

Temporarily use a git snapshot, until upstream provides proper tarballs.

And drop those already included upstream.

Microcode update is available only for some models at this moment, so
include the workaround pat...

Replace custom patch with proper upstream implementation.

It isn't used anymore, VMs use distribution-native Xen packages fully.

Backport serial console fix, and a build fix with GCC 13 (relevant for
Archlinux).

Drop patches included upstream already, update context of some existing
patches.
Include also XS...

* origin/pr/161:
Drop extra ELF notes

Technically it doesn't affect Qubes OS, as it has smt=0. But still apply
the patch for the sake ...

The ELF notes on multiboot binary are broken, remove them to unbreak
booting from Heads (via kex...

* origin/pr/159:
Recover some performance from unneeded speculative workarounds

* origin/pr/157:
Backport workaround for broken CET-SS on some parts

* origin/pr/158:
Include support for Intel HWP

Tell guest kernel what fixes are already available in the hardware, so
it can turn off some of t...

Hardware-managed P-states (when supported) results significantly smaller
power consumption accor...

It was erroneously removed during spec file refresh.

See patches description for detail.

* origin/pr/156:
Add patch for Python >= 3.10 support

QubesOS/qubes-issues#6982

See patch for details.

* origin/pr/151:
xen backport: prevent overflow with high frequency TSC

* origin/pr/154:
Do not override stub grub.cfg on EFI partition

* origin/pr/153:
gitlab-ci: don't build for Debian
Remove build for CentOS
Support for Fed...

We will try to have upstream build in EPEL or on COPR.

- Sync spec file with upstream

Grub2 in R4.2 is made to include grub.cfg from primary /boot partition,
even on EFI systems - so...

Intel CPUs ignore the high bit in a PAT entry when accessing GPU memory.
With Xen’s PAT, this ca...

requirement to fix https://github.com/QubesOS/qubes-issues/issues/7856

* origin/pr/147:
Relocate the ESRT when booting via multiboot2
Validate EFI memory descriptors

They are prerequisites for subsequent PAT changes that Qubes might also
want to backport, and (u...

This was missed in the initial patchset. The patch sent upstream is
larger and involves signifi...

It turns out that these can be invalid in various ways. Based on code
Ard Biesheuvel contribute...

And refresh patch

Use upstream Debian packages directly.

- bash-completion filename changed
- make libexec symlink relative
- add new files
- use `@VERSI...

qemu is not necessary in dom0, so don't build it at all.
This includes also dropping xen-qemu-to...

QubesOS/qubes-issues#7340