Merge ~paelzer/ubuntu/+source/qemu:lp-1867519-stabilize-4.2 into ubuntu/+source/qemu:ubuntu/focal-devel

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

We know qemu had git-ubuntu import errors recently.
Probably it is best to just look at my proposed branch - that has a proper upload/1%4.2-3ubuntu2 in history and this MP is only for the coming upload/1%4.2-3ubuntu3.

[Andreas Hasenack (ahasenack)]

Holy 33 patches, batman :)

I wonder if qemu shouldn't do more point releases, more often :)

+1 from a packaging viewpoint, and I don't think this warrants an FFe.

review: Approve

[Christian Ehrhardt  (paelzer)]

Thanks I did some quick checks (given it is only minor fixes).
But we accrued enough changes that after the next coming known big qmeu change I'll do a full virt-regression-test again ...

To ssh://git.launchpad.net/~usd-import-team/ubuntu/+source/qemu
 * [new tag] upload/1%4.2-3ubuntu3 -> upload/1%4.2-3ubuntu3

Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading qemu_4.2-3ubuntu3.dsc: done.
  Uploading qemu_4.2-3ubuntu3.debian.tar.xz: done.
  Uploading qemu_4.2-3ubuntu3_source.buildinfo: done.
  Uploading qemu_4.2-3ubuntu3_source.changes: done.
Successfully uploaded packages.

diff --git a/debian/changelog b/debian/changelog
index 89089bb..11efbaa 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,24 @@
+qemu (1:4.2-3ubuntu3) focal; urgency=medium
+
+  * d/p/stable/lp-1867519-*: Stabilize qemu 4.2 with upstream
+    patches @qemu-stable (LP: #1867519)
+
+ -- Christian Ehrhardt <[e-mail]>  Wed, 18 Mar 2020 13:57:57 +0100
+
+qemu (1:4.2-3ubuntu2) focal; urgency=medium
+
+  * allow qemu to load old modules post upgrade (LP: #1847361)
+    - d/p/ubuntu/lp-1847361-modules-load-upgrade.patch: to fallback module
+      load to a versioned path
+    - d/qemu-block-extra.*.in, d/qemu-system-gui.*.in: save shared objects on
+      upgrade
+    - d/rules: generate maintainer scripts matching package version on build
+    - d/rules: enable --enable-module-upgrades where --enable-modules is set
+  * d/p/ubuntu/lp-1847361-vhost-correctly-turn-on-VIRTIO_F_IOMMU_PLATFORM.patch:
+    avoid unnecessary IOTLB transactions (LP: #1866207)
+
+ -- Christian Ehrhardt <[e-mail]>  Mon, 02 Mar 2020 15:21:27 +0100
+
 qemu (1:4.2-3ubuntu1) focal; urgency=medium
 
   * Merge with Debian testing, remaining changes:
diff --git a/debian/patches/lp-1867519-block-nbd-extract-the-common-cleanup-code.patch b/debian/patches/lp-1867519-block-nbd-extract-the-common-cleanup-code.patch
 new file mode 100644
index 0000000..8dc2409
--- /dev/null
+++ b/debian/patches/lp-1867519-block-nbd-extract-the-common-cleanup-code.patch
@@ -0,0 +1,78 @@
+From 7f493662be4045146a8f45119d8834c9088a0ad6 Mon Sep 17 00:00:00 2001
+From: Pan Nengyuan <[e-mail]>
+Date: Thu, 5 Dec 2019 11:45:27 +0800
+Subject: [PATCH] block/nbd: extract the common cleanup code
+
+The BDRVNBDState cleanup code is common in two places, add
+nbd_clear_bdrvstate() function to do these cleanups.
+
+Suggested-by: Stefano Garzarella <[e-mail]>
+Signed-off-by: Pan Nengyuan <[e-mail]>
+Reviewed-by: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Message-Id: <[e-mail]>
+Reviewed-by: Eric Blake <[e-mail]>
+[eblake: fix compilation error and commit message]
+Signed-off-by: Eric Blake <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=7f493662be4045146a8f45119d8834c9088a0ad6
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ block/nbd.c | 26 +++++++++++++++-----------
+ 1 file changed, 15 insertions(+), 11 deletions(-)
+
+diff --git a/block/nbd.c b/block/nbd.c
+index f69e61e68a..ed0f93ab27 100644
+--- a/block/nbd.c
++++ b/block/nbd.c
+@@ -95,6 +95,19 @@ typedef struct BDRVNBDState {
+ 
+ static int nbd_client_connect(BlockDriverState *bs, Error **errp);
+ 
++static void nbd_clear_bdrvstate(BDRVNBDState *s)
++{
++    object_unref(OBJECT(s->tlscreds));
++    qapi_free_SocketAddress(s->saddr);
++    s->saddr = NULL;
++    g_free(s->export);
++    s->export = NULL;
++    g_free(s->tlscredsid);
++    s->tlscredsid = NULL;
++    g_free(s->x_dirty_bitmap);
++    s->x_dirty_bitmap = NULL;
++}
++
+ static void nbd_channel_error(BDRVNBDState *s, int ret)
+ {
+     if (ret == -EIO) {
+@@ -1879,11 +1892,7 @@ static int nbd_process_options(BlockDriverState *bs, QDict *options,
+ 
+  error:
+     if (ret < 0) {
+-        object_unref(OBJECT(s->tlscreds));
+-        qapi_free_SocketAddress(s->saddr);
+-        g_free(s->export);
+-        g_free(s->tlscredsid);
+-        g_free(s->x_dirty_bitmap);
++        nbd_clear_bdrvstate(s);
+     }
+     qemu_opts_del(opts);
+     return ret;
+@@ -1962,12 +1971,7 @@ static void nbd_close(BlockDriverState *bs)
+     BDRVNBDState *s = bs->opaque;
+ 
+     nbd_client_close(bs);
+-
+-    object_unref(OBJECT(s->tlscreds));
+-    qapi_free_SocketAddress(s->saddr);
+-    g_free(s->export);
+-    g_free(s->tlscredsid);
+-    g_free(s->x_dirty_bitmap);
++    nbd_clear_bdrvstate(s);
+ }
+ 
+ static int64_t nbd_getlength(BlockDriverState *bs)
+-- 
+2.25.1
+
diff --git a/debian/patches/series b/debian/patches/series
index c9fce99..f01fa16 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -13,3 +13,41 @@ ubuntu/lp-1857033-i386-Add-macro-for-stibp.patch
 ubuntu/lp-1857033-i386-Add-new-CPU-model-Cooperlake.patch
 lp-1859527-virtio-blk-fix-out-of-bounds-access-to-bitmap-in-not.patch
 ubuntu/vhost-user-gpu-Drop-trailing-json-comma.patch
+ubuntu/lp-1847361-modules-load-upgrade.patch
+ubuntu/lp-1847361-vhost-correctly-turn-on-VIRTIO_F_IOMMU_PLATFORM.patch
+
+# stabilize 4.2 with patches sent to qemu-stable since 4.2 released
+stable/lp-1867519-arm-arm-powerctl-set-NSACR.-CP11-CP10-bits-in-arm_se.patch
+stable/lp-1867519-target-arm-ensure-we-use-current-exception-state-aft.patch
+stable/lp-1867519-block-Activate-recursively-even-for-already-active-n.patch
+stable/lp-1867519-arm-arm-powerctl-rebuild-hflags-after-setting-CP15-b.patch
+stable/lp-1867519-virtio-update-queue-size-on-guest-write.patch
+stable/lp-1867519-qcow2-bitmaps-fix-qcow2_can_store_new_dirty_bitmap.patch
+stable/lp-1867519-backup-top-Begin-drain-earlier.patch
+stable/lp-1867519-virtio-mmio-update-queue-size-on-guest-write.patch
+stable/lp-1867519-virtio-net-delete-also-control-queue-when-TX-RX-dele.patch
+stable/lp-1867519-intel_iommu-a-fix-to-vtd_find_as_from_bus_num.patch
+stable/lp-1867519-intel_iommu-add-present-bit-check-for-pasid-table-en.patch
+stable/lp-1867519-vfio-pci-Don-t-remove-irqchip-notifier-if-not-regist.patch
+stable/lp-1867519-hw-i386-pc-fix-regression-in-parsing-vga-cmdline-par.patch
+stable/lp-1867519-target-arm-arm-semi-fix-SYS_OPEN-to-return-nonzero-f.patch
+stable/lp-1867519-target-arm-Return-correct-IL-bit-in-merge_syn_data_a.patch
+stable/lp-1867519-target-arm-Set-ISSIs16Bit-in-make_issinfo.patch
+stable/lp-1867519-target-i386-kvm-initialize-feature-MSRs-very-early.patch
+stable/lp-1867519-tpm-ppi-page-align-PPI-RAM.patch
+stable/lp-1867519-block-backup-top-fix-failure-path.patch
+stable/lp-1867519-iotests-add-test-for-backup-top-failure-on-permissio.patch
+stable/lp-1867519-block-fix-crash-on-zero-length-unaligned-write-and-r.patch
+stable/lp-1867519-qemu-img-Fix-convert-n-B-for-backing-less-targets.patch
+stable/lp-1867519-plugins-core-add-missing-break-in-cb_to_tcg_flags.patch
+stable/lp-1867519-tcg-save-vaddr-temp-for-plugin-usage.patch
+stable/lp-1867519-s390-sclp-improve-special-wait-psw-logic.patch
+stable/lp-1867519-block-nbd-fix-memory-leak-in-nbd_open.patch
+stable/lp-1867519-virtio-gracefully-handle-invalid-region-caches.patch
+stable/lp-1867519-qcow2-Fix-qcow2_alloc_cluster_abort-for-external-dat.patch
+stable/lp-1867519-qcow2-Fix-alloc_cluster_abort-for-pre-existing-clust.patch
+stable/lp-1867519-block-qcow2-threads-fix-qcow2_decompress.patch
+stable/lp-1867519-job-refactor-progress-to-separate-object.patch
+stable/lp-1867519-block-block-copy-fix-progress-calculation.patch
+stable/lp-1867519-block-io-fix-bdrv_co_do_copy_on_readv.patch
+lp-1867519-block-nbd-extract-the-common-cleanup-code.patch
diff --git a/debian/patches/stable/lp-1867519-arm-arm-powerctl-rebuild-hflags-after-setting-CP15-b.patch b/debian/patches/stable/lp-1867519-arm-arm-powerctl-rebuild-hflags-after-setting-CP15-b.patch
 new file mode 100644
index 0000000..c980ed6
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-arm-arm-powerctl-rebuild-hflags-after-setting-CP15-b.patch
@@ -0,0 +1,48 @@
+From c8fa6079eb35888587f1be27c1590da4edcc5098 Mon Sep 17 00:00:00 2001
+From: Niek Linnenbank <[e-mail]>
+Date: Fri, 20 Dec 2019 14:03:00 +0000
+Subject: [PATCH] arm/arm-powerctl: rebuild hflags after setting CP15 bits in
+ arm_set_cpu_on()
+
+After setting CP15 bits in arm_set_cpu_on() the cached hflags must
+be rebuild to reflect the changed processor state. Without rebuilding,
+the cached hflags would be inconsistent until the next call to
+arm_rebuild_hflags(). When QEMU is compiled with debugging enabled
+(--enable-debug), this problem is captured shortly after the first
+call to arm_set_cpu_on() for CPUs running in ARM 32-bit non-secure mode:
+
+  qemu-system-arm: target/arm/helper.c:11359: cpu_get_tb_cpu_state:
+  Assertion `flags == rebuild_hflags_internal(env)' failed.
+  Aborted (core dumped)
+
+Fixes: 0c7f8c43daf65
+Cc: [e-mail]
+Signed-off-by: Niek Linnenbank <[e-mail]>
+Reviewed-by: Richard Henderson <[e-mail]>
+Signed-off-by: Peter Maydell <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=c8fa6079eb35888587f1be27c1590da4edcc5098
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ target/arm/arm-powerctl.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/target/arm/arm-powerctl.c b/target/arm/arm-powerctl.c
+index b064513d44..b75f813b40 100644
+--- a/target/arm/arm-powerctl.c
++++ b/target/arm/arm-powerctl.c
+@@ -127,6 +127,9 @@ static void arm_set_cpu_on_async_work(CPUState *target_cpu_state,
+         target_cpu->env.regs[0] = info->context_id;
+     }
+ 
++    /* CP15 update requires rebuilding hflags */
++    arm_rebuild_hflags(&target_cpu->env);
++
+     /* Start the new CPU at the requested address */
+     cpu_set_pc(target_cpu_state, info->entry);
+ 
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-arm-arm-powerctl-set-NSACR.-CP11-CP10-bits-in-arm_se.patch b/debian/patches/stable/lp-1867519-arm-arm-powerctl-set-NSACR.-CP11-CP10-bits-in-arm_se.patch
 new file mode 100644
index 0000000..b2fa47c
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-arm-arm-powerctl-set-NSACR.-CP11-CP10-bits-in-arm_se.patch
@@ -0,0 +1,49 @@
+From 0c7f8c43daf6556078e51de98aa13f069e505985 Mon Sep 17 00:00:00 2001
+From: Niek Linnenbank <[e-mail]>
+Date: Mon, 2 Dec 2019 22:09:43 +0100
+Subject: [PATCH] arm/arm-powerctl: set NSACR.{CP11, CP10} bits in
+ arm_set_cpu_on()
+
+This change ensures that the FPU can be accessed in Non-Secure mode
+when the CPU core is reset using the arm_set_cpu_on() function call.
+The NSACR.{CP11,CP10} bits define the exception level required to
+access the FPU in Non-Secure mode. Without these bits set, the CPU
+will give an undefined exception trap on the first FPU access for the
+secondary cores under Linux.
+
+This is necessary because in this power-control codepath QEMU
+is effectively emulating a bit of EL3 firmware, and has to set
+the CPU up as the EL3 firmware would.
+
+Fixes: fc1120a7f5
+Cc: [e-mail]
+Signed-off-by: Niek Linnenbank <[e-mail]>
+[PMM: added clarifying para to commit message]
+Reviewed-by: Peter Maydell <[e-mail]>
+Signed-off-by: Peter Maydell <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=0c7f8c43daf6556078e51de98aa13f069e505985
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ target/arm/arm-powerctl.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/target/arm/arm-powerctl.c b/target/arm/arm-powerctl.c
+index f77a950db6..b064513d44 100644
+--- a/target/arm/arm-powerctl.c
++++ b/target/arm/arm-powerctl.c
+@@ -104,6 +104,9 @@ static void arm_set_cpu_on_async_work(CPUState *target_cpu_state,
+         /* Processor is not in secure mode */
+         target_cpu->env.cp15.scr_el3 |= SCR_NS;
+ 
++        /* Set NSACR.{CP11,CP10} so NS can access the FPU */
++        target_cpu->env.cp15.nsacr |= 3 << 10;
++
+         /*
+          * If QEMU is providing the equivalent of EL3 firmware, then we need
+          * to make sure a CPU targeting EL2 comes out of reset with a
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-backup-top-Begin-drain-earlier.patch b/debian/patches/stable/lp-1867519-backup-top-Begin-drain-earlier.patch
 new file mode 100644
index 0000000..d534297
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-backup-top-Begin-drain-earlier.patch
@@ -0,0 +1,46 @@
+From 503ca1262bab2c11c533a4816d1ff4297d4f58a6 Mon Sep 17 00:00:00 2001
+From: Max Reitz <[e-mail]>
+Date: Thu, 19 Dec 2019 19:26:38 +0100
+Subject: [PATCH] backup-top: Begin drain earlier
+
+When dropping backup-top, we need to drain the node before freeing the
+BlockCopyState.  Otherwise, requests may still be in flight and then the
+assertion in shres_destroy() will fail.
+
+(This becomes visible in intermittent failure of 056.)
+
+Cc: [e-mail]
+Signed-off-by: Max Reitz <[e-mail]>
+Message-id: [e-mail]
+Signed-off-by: Max Reitz <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=503ca1262bab2c11c533a4816d1ff4297d4f58a6
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ block/backup-top.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/block/backup-top.c b/block/backup-top.c
+index 7cdb1f8eba..818d3f26b4 100644
+--- a/block/backup-top.c
++++ b/block/backup-top.c
+@@ -257,12 +257,12 @@ void bdrv_backup_top_drop(BlockDriverState *bs)
+     BDRVBackupTopState *s = bs->opaque;
+     AioContext *aio_context = bdrv_get_aio_context(bs);
+ 
+-    block_copy_state_free(s->bcs);
+-
+     aio_context_acquire(aio_context);
+ 
+     bdrv_drained_begin(bs);
+ 
++    block_copy_state_free(s->bcs);
++
+     s->active = false;
+     bdrv_child_refresh_perms(bs, bs->backing, &error_abort);
+     bdrv_replace_node(bs, backing_bs(bs), &error_abort);
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-block-Activate-recursively-even-for-already-active-n.patch b/debian/patches/stable/lp-1867519-block-Activate-recursively-even-for-already-active-n.patch
 new file mode 100644
index 0000000..0a9d490
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-block-Activate-recursively-even-for-already-active-n.patch
@@ -0,0 +1,108 @@
+From 7bb4941ace471fc7dd6ded4749b95b9622baa6ed Mon Sep 17 00:00:00 2001
+From: Kevin Wolf <[e-mail]>
+Date: Tue, 17 Dec 2019 15:06:38 +0100
+Subject: [PATCH] block: Activate recursively even for already active nodes
+
+bdrv_invalidate_cache_all() assumes that all nodes in a given subtree
+are either active or inactive when it starts. Therefore, as soon as it
+arrives at an already active node, it stops.
+
+However, this assumption is wrong. For example, it's possible to take a
+snapshot of an inactive node, which results in an active overlay over an
+inactive backing file. The active overlay is probably also the root node
+of an inactive BlockBackend (blk->disable_perm == true).
+
+In this case, bdrv_invalidate_cache_all() does not need to do anything
+to activate the overlay node, but it still needs to recurse into the
+children and the parents to make sure that after returning success,
+really everything is activated.
+
+Cc: [e-mail]
+Signed-off-by: Kevin Wolf <[e-mail]>
+Reviewed-by: Max Reitz <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=7bb4941ace471fc7dd6ded4749b95b9622baa6ed
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ block.c | 50 ++++++++++++++++++++++++--------------------------
+ 1 file changed, 24 insertions(+), 26 deletions(-)
+
+diff --git a/block.c b/block.c
+index 73029fad64..1b6f7c86e8 100644
+--- a/block.c
++++ b/block.c
+@@ -5335,10 +5335,6 @@ static void coroutine_fn bdrv_co_invalidate_cache(BlockDriverState *bs,
+         return;
+     }
+ 
+-    if (!(bs->open_flags & BDRV_O_INACTIVE)) {
+-        return;
+-    }
+-
+     QLIST_FOREACH(child, &bs->children, next) {
+         bdrv_co_invalidate_cache(child->bs, &local_err);
+         if (local_err) {
+@@ -5360,34 +5356,36 @@ static void coroutine_fn bdrv_co_invalidate_cache(BlockDriverState *bs,
+      * just keep the extended permissions for the next time that an activation
+      * of the image is tried.
+      */
+-    bs->open_flags &= ~BDRV_O_INACTIVE;
+-    bdrv_get_cumulative_perm(bs, &perm, &shared_perm);
+-    ret = bdrv_check_perm(bs, NULL, perm, shared_perm, NULL, NULL, &local_err);
+-    if (ret < 0) {
+-        bs->open_flags |= BDRV_O_INACTIVE;
+-        error_propagate(errp, local_err);
+-        return;
+-    }
+-    bdrv_set_perm(bs, perm, shared_perm);
+-
+-    if (bs->drv->bdrv_co_invalidate_cache) {
+-        bs->drv->bdrv_co_invalidate_cache(bs, &local_err);
+-        if (local_err) {
++    if (bs->open_flags & BDRV_O_INACTIVE) {
++        bs->open_flags &= ~BDRV_O_INACTIVE;
++        bdrv_get_cumulative_perm(bs, &perm, &shared_perm);
++        ret = bdrv_check_perm(bs, NULL, perm, shared_perm, NULL, NULL, &local_err);
++        if (ret < 0) {
+             bs->open_flags |= BDRV_O_INACTIVE;
+             error_propagate(errp, local_err);
+             return;
+         }
+-    }
++        bdrv_set_perm(bs, perm, shared_perm);
+ 
+-    FOR_EACH_DIRTY_BITMAP(bs, bm) {
+-        bdrv_dirty_bitmap_skip_store(bm, false);
+-    }
++        if (bs->drv->bdrv_co_invalidate_cache) {
++            bs->drv->bdrv_co_invalidate_cache(bs, &local_err);
++            if (local_err) {
++                bs->open_flags |= BDRV_O_INACTIVE;
++                error_propagate(errp, local_err);
++                return;
++            }
++        }
+ 
+-    ret = refresh_total_sectors(bs, bs->total_sectors);
+-    if (ret < 0) {
+-        bs->open_flags |= BDRV_O_INACTIVE;
+-        error_setg_errno(errp, -ret, "Could not refresh total sector count");
+-        return;
++        FOR_EACH_DIRTY_BITMAP(bs, bm) {
++            bdrv_dirty_bitmap_skip_store(bm, false);
++        }
++
++        ret = refresh_total_sectors(bs, bs->total_sectors);
++        if (ret < 0) {
++            bs->open_flags |= BDRV_O_INACTIVE;
++            error_setg_errno(errp, -ret, "Could not refresh total sector count");
++            return;
++        }
+     }
+ 
+     QLIST_FOREACH(parent, &bs->parents, next_parent) {
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-block-backup-top-fix-failure-path.patch b/debian/patches/stable/lp-1867519-block-backup-top-fix-failure-path.patch
 new file mode 100644
index 0000000..0ea91e8
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-block-backup-top-fix-failure-path.patch
@@ -0,0 +1,97 @@
+From 0df62f45c1de6c020f1e6fba4eeafd248209b003 Mon Sep 17 00:00:00 2001
+From: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Date: Tue, 21 Jan 2020 17:28:01 +0300
+Subject: [PATCH] block/backup-top: fix failure path
+
+We can't access top after call bdrv_backup_top_drop, as it is already
+freed at this time.
+
+Also, no needs to unref target child by hand, it will be unrefed on
+bdrv_close() automatically.
+
+So, just do bdrv_backup_top_drop if append succeed and one bdrv_unref
+otherwise.
+
+Note, that in !appended case bdrv_unref(top) moved into drained section
+on source. It doesn't really matter, but just for code simplicity.
+
+Fixes: 7df7868b96404
+Cc: [e-mail] # v4.2.0
+Signed-off-by: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Reviewed-by: Max Reitz <[e-mail]>
+Message-id: [e-mail]
+Signed-off-by: Max Reitz <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=0df62f45c1de6c020f1e6fba4eeafd248209b003
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ block/backup-top.c | 21 ++++++++++++---------
+ 1 file changed, 12 insertions(+), 9 deletions(-)
+
+diff --git a/block/backup-top.c b/block/backup-top.c
+index 9aed2eb4c0..fa78f3256d 100644
+--- a/block/backup-top.c
++++ b/block/backup-top.c
+@@ -190,6 +190,7 @@ BlockDriverState *bdrv_backup_top_append(BlockDriverState *source,
+     BlockDriverState *top = bdrv_new_open_driver(&bdrv_backup_top_filter,
+                                                  filter_node_name,
+                                                  BDRV_O_RDWR, errp);
++    bool appended = false;
+ 
+     if (!top) {
+         return NULL;
+@@ -212,8 +213,9 @@ BlockDriverState *bdrv_backup_top_append(BlockDriverState *source,
+     bdrv_append(top, source, &local_err);
+     if (local_err) {
+         error_prepend(&local_err, "Cannot append backup-top filter: ");
+-        goto append_failed;
++        goto fail;
+     }
++    appended = true;
+ 
+     /*
+      * bdrv_append() finished successfully, now we can require permissions
+@@ -224,14 +226,14 @@ BlockDriverState *bdrv_backup_top_append(BlockDriverState *source,
+     if (local_err) {
+         error_prepend(&local_err,
+                       "Cannot set permissions for backup-top filter: ");
+-        goto failed_after_append;
++        goto fail;
+     }
+ 
+     state->bcs = block_copy_state_new(top->backing, state->target,
+                                       cluster_size, write_flags, &local_err);
+     if (local_err) {
+         error_prepend(&local_err, "Cannot create block-copy-state: ");
+-        goto failed_after_append;
++        goto fail;
+     }
+     *bcs = state->bcs;
+ 
+@@ -239,14 +241,15 @@ BlockDriverState *bdrv_backup_top_append(BlockDriverState *source,
+ 
+     return top;
+ 
+-failed_after_append:
+-    state->active = false;
+-    bdrv_backup_top_drop(top);
++fail:
++    if (appended) {
++        state->active = false;
++        bdrv_backup_top_drop(top);
++    } else {
++        bdrv_unref(top);
++    }
+ 
+-append_failed:
+     bdrv_drained_end(source);
+-    bdrv_unref_child(top, state->target);
+-    bdrv_unref(top);
+     error_propagate(errp, local_err);
+ 
+     return NULL;
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-block-block-copy-fix-progress-calculation.patch b/debian/patches/stable/lp-1867519-block-block-copy-fix-progress-calculation.patch
 new file mode 100644
index 0000000..6eb7652
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-block-block-copy-fix-progress-calculation.patch
@@ -0,0 +1,201 @@
+From d0ebeca14a585f352938062ef8ddde47fe4d39f9 Mon Sep 17 00:00:00 2001
+From: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Date: Wed, 11 Mar 2020 13:29:57 +0300
+Subject: [PATCH] block/block-copy: fix progress calculation
+
+Assume we have two regions, A and B, and region B is in-flight now,
+region A is not yet touched, but it is unallocated and should be
+skipped.
+
+Correspondingly, as progress we have
+
+  total = A + B
+  current = 0
+
+If we reset unallocated region A and call progress_reset_callback,
+it will calculate 0 bytes dirty in the bitmap and call
+job_progress_set_remaining, which will set
+
+   total = current + 0 = 0 + 0 = 0
+
+So, B bytes are actually removed from total accounting. When job
+finishes we'll have
+
+   total = 0
+   current = B
+
+, which doesn't sound good.
+
+This is because we didn't considered in-flight bytes, actually when
+calculating remaining, we should have set (in_flight + dirty_bytes)
+as remaining, not only dirty_bytes.
+
+To fix it, let's refactor progress calculation, moving it to block-copy
+itself instead of fixing callback. And, of course, track in_flight
+bytes count.
+
+We still have to keep one callback, to maintain backup job bytes_read
+calculation, but it will go on soon, when we turn the whole backup
+process into one block_copy call.
+
+Cc: [e-mail]
+Signed-off-by: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Reviewed-by: Andrey Shinkevich <[e-mail]>
+Message-Id: <[e-mail]>
+Signed-off-by: Max Reitz <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=d0ebeca14a585f352938062ef8ddde47fe4d39f9
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ block/backup.c             | 13 ++-----------
+ block/block-copy.c         | 16 ++++++++++++----
+ include/block/block-copy.h | 15 +++++----------
+ 3 files changed, 19 insertions(+), 25 deletions(-)
+
+diff --git a/block/backup.c b/block/backup.c
+index 1383e219f5..8694e0394b 100644
+--- a/block/backup.c
++++ b/block/backup.c
+@@ -57,15 +57,6 @@ static void backup_progress_bytes_callback(int64_t bytes, void *opaque)
+     BackupBlockJob *s = opaque;
+ 
+     s->bytes_read += bytes;
+-    job_progress_update(&s->common.job, bytes);
+-}
+-
+-static void backup_progress_reset_callback(void *opaque)
+-{
+-    BackupBlockJob *s = opaque;
+-    uint64_t estimate = bdrv_get_dirty_count(s->bcs->copy_bitmap);
+-
+-    job_progress_set_remaining(&s->common.job, estimate);
+ }
+ 
+ static int coroutine_fn backup_do_cow(BackupBlockJob *job,
+@@ -464,8 +455,8 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
+     job->cluster_size = cluster_size;
+     job->len = len;
+ 
+-    block_copy_set_callbacks(bcs, backup_progress_bytes_callback,
+-                             backup_progress_reset_callback, job);
++    block_copy_set_progress_callback(bcs, backup_progress_bytes_callback, job);
++    block_copy_set_progress_meter(bcs, &job->common.job.progress);
+ 
+     /* Required permissions are already taken by backup-top target */
+     block_job_add_bdrv(&job->common, "target", target, 0, BLK_PERM_ALL,
+diff --git a/block/block-copy.c b/block/block-copy.c
+index 79798a1567..e2d7b3b887 100644
+--- a/block/block-copy.c
++++ b/block/block-copy.c
+@@ -127,17 +127,20 @@ BlockCopyState *block_copy_state_new(BdrvChild *source, BdrvChild *target,
+     return s;
+ }
+ 
+-void block_copy_set_callbacks(
++void block_copy_set_progress_callback(
+         BlockCopyState *s,
+         ProgressBytesCallbackFunc progress_bytes_callback,
+-        ProgressResetCallbackFunc progress_reset_callback,
+         void *progress_opaque)
+ {
+     s->progress_bytes_callback = progress_bytes_callback;
+-    s->progress_reset_callback = progress_reset_callback;
+     s->progress_opaque = progress_opaque;
+ }
+ 
++void block_copy_set_progress_meter(BlockCopyState *s, ProgressMeter *pm)
++{
++    s->progress = pm;
++}
++
+ /*
+  * block_copy_do_copy
+  *
+@@ -269,7 +272,9 @@ int64_t block_copy_reset_unallocated(BlockCopyState *s,
+ 
+     if (!ret) {
+         bdrv_reset_dirty_bitmap(s->copy_bitmap, offset, bytes);
+-        s->progress_reset_callback(s->progress_opaque);
++        progress_set_remaining(s->progress,
++                               bdrv_get_dirty_count(s->copy_bitmap) +
++                               s->in_flight_bytes);
+     }
+ 
+     *count = bytes;
+@@ -331,15 +336,18 @@ int coroutine_fn block_copy(BlockCopyState *s,
+         trace_block_copy_process(s, start);
+ 
+         bdrv_reset_dirty_bitmap(s->copy_bitmap, start, chunk_end - start);
++        s->in_flight_bytes += chunk_end - start;
+ 
+         co_get_from_shres(s->mem, chunk_end - start);
+         ret = block_copy_do_copy(s, start, chunk_end, error_is_read);
+         co_put_to_shres(s->mem, chunk_end - start);
++        s->in_flight_bytes -= chunk_end - start;
+         if (ret < 0) {
+             bdrv_set_dirty_bitmap(s->copy_bitmap, start, chunk_end - start);
+             break;
+         }
+ 
++        progress_work_done(s->progress, chunk_end - start);
+         s->progress_bytes_callback(chunk_end - start, s->progress_opaque);
+         start = chunk_end;
+         ret = 0;
+diff --git a/include/block/block-copy.h b/include/block/block-copy.h
+index 0a161724d7..9def00068c 100644
+--- a/include/block/block-copy.h
++++ b/include/block/block-copy.h
+@@ -26,7 +26,6 @@ typedef struct BlockCopyInFlightReq {
+ } BlockCopyInFlightReq;
+ 
+ typedef void (*ProgressBytesCallbackFunc)(int64_t bytes, void *opaque);
+-typedef void (*ProgressResetCallbackFunc)(void *opaque);
+ typedef struct BlockCopyState {
+     /*
+      * BdrvChild objects are not owned or managed by block-copy. They are
+@@ -36,6 +35,7 @@ typedef struct BlockCopyState {
+     BdrvChild *source;
+     BdrvChild *target;
+     BdrvDirtyBitmap *copy_bitmap;
++    int64_t in_flight_bytes;
+     int64_t cluster_size;
+     bool use_copy_range;
+     int64_t copy_size;
+@@ -60,15 +60,9 @@ typedef struct BlockCopyState {
+      */
+     bool skip_unallocated;
+ 
++    ProgressMeter *progress;
+     /* progress_bytes_callback: called when some copying progress is done. */
+     ProgressBytesCallbackFunc progress_bytes_callback;
+-
+-    /*
+-     * progress_reset_callback: called when some bytes reset from copy_bitmap
+-     * (see @skip_unallocated above). The callee is assumed to recalculate how
+-     * many bytes remain based on the dirty bit count of copy_bitmap.
+-     */
+-    ProgressResetCallbackFunc progress_reset_callback;
+     void *progress_opaque;
+ 
+     SharedResource *mem;
+@@ -79,12 +73,13 @@ BlockCopyState *block_copy_state_new(BdrvChild *source, BdrvChild *target,
+                                      BdrvRequestFlags write_flags,
+                                      Error **errp);
+ 
+-void block_copy_set_callbacks(
++void block_copy_set_progress_callback(
+         BlockCopyState *s,
+         ProgressBytesCallbackFunc progress_bytes_callback,
+-        ProgressResetCallbackFunc progress_reset_callback,
+         void *progress_opaque);
+ 
++void block_copy_set_progress_meter(BlockCopyState *s, ProgressMeter *pm);
++
+ void block_copy_state_free(BlockCopyState *s);
+ 
+ int64_t block_copy_reset_unallocated(BlockCopyState *s,
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-block-fix-crash-on-zero-length-unaligned-write-and-r.patch b/debian/patches/stable/lp-1867519-block-fix-crash-on-zero-length-unaligned-write-and-r.patch
 new file mode 100644
index 0000000..a84fdd7
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-block-fix-crash-on-zero-length-unaligned-write-and-r.patch
@@ -0,0 +1,107 @@
+From ac9d00bf7b47acae6b0e42910d9ed55fef3af5b8 Mon Sep 17 00:00:00 2001
+From: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Date: Thu, 6 Feb 2020 19:42:45 +0300
+Subject: [PATCH] block: fix crash on zero-length unaligned write and read
+
+Commit 7a3f542fbd "block/io: refactor padding" occasionally dropped
+aligning for zero-length request: bdrv_init_padding() blindly return
+false if bytes == 0, like there is nothing to align.
+
+This leads the following command to crash:
+
+./qemu-io --image-opts -c 'write 1 0' \
+  driver=blkdebug,align=512,image.driver=null-co,image.size=512
+
+>> qemu-io: block/io.c:1955: bdrv_aligned_pwritev: Assertion
+    `(offset & (align - 1)) == 0' failed.
+>> Aborted (core dumped)
+
+Prior to 7a3f542fbd we does aligning of such zero requests. Instead of
+recovering this behavior let's just do nothing on such requests as it
+is useless.
+
+Note that driver may have special meaning of zero-length reqeusts, like
+qcow2_co_pwritev_compressed_part, so we can't skip any zero-length
+operation. But for unaligned ones, we can't pass it to driver anyway.
+
+This commit also fixes crash in iotest 80 running with -nocache:
+
+./check -nocache -qcow2 80
+
+which crashes on same assertion due to trying to read empty extra data
+in qcow2_do_read_snapshots().
+
+Cc: [e-mail] # v4.2
+Fixes: 7a3f542fbd
+Signed-off-by: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Reviewed-by: Max Reitz <[e-mail]>
+Message-id: [e-mail]
+Signed-off-by: Stefan Hajnoczi <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=ac9d00bf7b47acae6b0e42910d9ed55fef3af5b8
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ block/io.c | 28 +++++++++++++++++++++++++++-
+ 1 file changed, 27 insertions(+), 1 deletion(-)
+
+diff --git a/block/io.c b/block/io.c
+index 1eb2b2bddc..7e4cb74cf4 100644
+--- a/block/io.c
++++ b/block/io.c
+@@ -1565,10 +1565,12 @@ static bool bdrv_init_padding(BlockDriverState *bs,
+         pad->tail = align - pad->tail;
+     }
+ 
+-    if ((!pad->head && !pad->tail) || !bytes) {
++    if (!pad->head && !pad->tail) {
+         return false;
+     }
+ 
++    assert(bytes); /* Nothing good in aligning zero-length requests */
++
+     sum = pad->head + bytes + pad->tail;
+     pad->buf_len = (sum > align && pad->head && pad->tail) ? 2 * align : align;
+     pad->buf = qemu_blockalign(bs, pad->buf_len);
+@@ -1706,6 +1708,18 @@ int coroutine_fn bdrv_co_preadv_part(BdrvChild *child,
+         return ret;
+     }
+ 
++    if (bytes == 0 && !QEMU_IS_ALIGNED(offset, bs->bl.request_alignment)) {
++        /*
++         * Aligning zero request is nonsense. Even if driver has special meaning
++         * of zero-length (like qcow2_co_pwritev_compressed_part), we can't pass
++         * it to driver due to request_alignment.
++         *
++         * Still, no reason to return an error if someone do unaligned
++         * zero-length read occasionally.
++         */
++        return 0;
++    }
++
+     bdrv_inc_in_flight(bs);
+ 
+     /* Don't do copy-on-read if we read data before write operation */
+@@ -2116,6 +2130,18 @@ int coroutine_fn bdrv_co_pwritev_part(BdrvChild *child,
+         return -ENOTSUP;
+     }
+ 
++    if (bytes == 0 && !QEMU_IS_ALIGNED(offset, bs->bl.request_alignment)) {
++        /*
++         * Aligning zero request is nonsense. Even if driver has special meaning
++         * of zero-length (like qcow2_co_pwritev_compressed_part), we can't pass
++         * it to driver due to request_alignment.
++         *
++         * Still, no reason to return an error if someone do unaligned
++         * zero-length write occasionally.
++         */
++        return 0;
++    }
++
+     bdrv_inc_in_flight(bs);
+     /*
+      * Align write if necessary by performing a read-modify-write cycle.
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-block-io-fix-bdrv_co_do_copy_on_readv.patch b/debian/patches/stable/lp-1867519-block-io-fix-bdrv_co_do_copy_on_readv.patch
 new file mode 100644
index 0000000..84335eb
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-block-io-fix-bdrv_co_do_copy_on_readv.patch
@@ -0,0 +1,44 @@
+From 4ab78b19189a81038e744728ed949d09aa477550 Mon Sep 17 00:00:00 2001
+From: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Date: Thu, 12 Mar 2020 11:19:49 +0300
+Subject: [PATCH] block/io: fix bdrv_co_do_copy_on_readv
+
+Prior to 1143ec5ebf4 it was OK to qemu_iovec_from_buf() from aligned-up
+buffer to original qiov, as qemu_iovec_from_buf() will stop at qiov end
+anyway.
+
+But after 1143ec5ebf4 we assume that bdrv_co_do_copy_on_readv works on
+part of original qiov, defined by qiov_offset and bytes. So we must not
+touch qiov behind qiov_offset+bytes bound. Fix it.
+
+Cc: [e-mail] # v4.2
+Fixes: 1143ec5ebf4
+Signed-off-by: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Reviewed-by: John Snow <[e-mail]>
+Message-id: [e-mail]
+Signed-off-by: Stefan Hajnoczi <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=4ab78b19189a81038e744728ed949d09aa477550
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ block/io.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/block/io.c b/block/io.c
+index 7e4cb74cf4..aba67f66b9 100644
+--- a/block/io.c
++++ b/block/io.c
+@@ -1399,7 +1399,7 @@ static int coroutine_fn bdrv_co_do_copy_on_readv(BdrvChild *child,
+             if (!(flags & BDRV_REQ_PREFETCH)) {
+                 qemu_iovec_from_buf(qiov, qiov_offset + progress,
+                                     bounce_buffer + skip_bytes,
+-                                    pnum - skip_bytes);
++                                    MIN(pnum - skip_bytes, bytes - progress));
+             }
+         } else if (!(flags & BDRV_REQ_PREFETCH)) {
+             /* Read directly into the destination */
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-block-nbd-fix-memory-leak-in-nbd_open.patch b/debian/patches/stable/lp-1867519-block-nbd-fix-memory-leak-in-nbd_open.patch
 new file mode 100644
index 0000000..dde008d
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-block-nbd-fix-memory-leak-in-nbd_open.patch
@@ -0,0 +1,76 @@
+From 8198cf5ef0ef98118b4176970d1cd998d93ec849 Mon Sep 17 00:00:00 2001
+From: Pan Nengyuan <[e-mail]>
+Date: Thu, 5 Dec 2019 11:45:28 +0800
+Subject: [PATCH] block/nbd: fix memory leak in nbd_open()
+
+In currently implementation there will be a memory leak when
+nbd_client_connect() returns error status. Here is an easy way to
+reproduce:
+
+1. run qemu-iotests as follow and check the result with asan:
+    ./check -raw 143
+
+Following is the asan output backtrack:
+Direct leak of 40 byte(s) in 1 object(s) allocated from:
+    #0 0x7f629688a560 in calloc (/usr/lib64/libasan.so.3+0xc7560)
+    #1 0x7f6295e7e015 in g_malloc0  (/usr/lib64/libglib-2.0.so.0+0x50015)
+    #2 0x56281dab4642 in qobject_input_start_struct  /mnt/sdb/qemu-4.2.0-rc0/qapi/qobject-input-visitor.c:295
+    #3 0x56281dab1a04 in visit_start_struct  /mnt/sdb/qemu-4.2.0-rc0/qapi/qapi-visit-core.c:49
+    #4 0x56281dad1827 in visit_type_SocketAddress  qapi/qapi-visit-sockets.c:386
+    #5 0x56281da8062f in nbd_config   /mnt/sdb/qemu-4.2.0-rc0/block/nbd.c:1716
+    #6 0x56281da8062f in nbd_process_options /mnt/sdb/qemu-4.2.0-rc0/block/nbd.c:1829
+    #7 0x56281da8062f in nbd_open /mnt/sdb/qemu-4.2.0-rc0/block/nbd.c:1873
+
+Direct leak of 15 byte(s) in 1 object(s) allocated from:
+    #0 0x7f629688a3a0 in malloc (/usr/lib64/libasan.so.3+0xc73a0)
+    #1 0x7f6295e7dfbd in g_malloc (/usr/lib64/libglib-2.0.so.0+0x4ffbd)
+    #2 0x7f6295e96ace in g_strdup (/usr/lib64/libglib-2.0.so.0+0x68ace)
+    #3 0x56281da804ac in nbd_process_options /mnt/sdb/qemu-4.2.0-rc0/block/nbd.c:1834
+    #4 0x56281da804ac in nbd_open /mnt/sdb/qemu-4.2.0-rc0/block/nbd.c:1873
+
+Indirect leak of 24 byte(s) in 1 object(s) allocated from:
+    #0 0x7f629688a3a0 in malloc (/usr/lib64/libasan.so.3+0xc73a0)
+    #1 0x7f6295e7dfbd in g_malloc (/usr/lib64/libglib-2.0.so.0+0x4ffbd)
+    #2 0x7f6295e96ace in g_strdup (/usr/lib64/libglib-2.0.so.0+0x68ace)
+    #3 0x56281dab41a3 in qobject_input_type_str_keyval /mnt/sdb/qemu-4.2.0-rc0/qapi/qobject-input-visitor.c:536
+    #4 0x56281dab2ee9 in visit_type_str /mnt/sdb/qemu-4.2.0-rc0/qapi/qapi-visit-core.c:297
+    #5 0x56281dad0fa1 in visit_type_UnixSocketAddress_members qapi/qapi-visit-sockets.c:141
+    #6 0x56281dad17b6 in visit_type_SocketAddress_members qapi/qapi-visit-sockets.c:366
+    #7 0x56281dad186a in visit_type_SocketAddress qapi/qapi-visit-sockets.c:393
+    #8 0x56281da8062f in nbd_config /mnt/sdb/qemu-4.2.0-rc0/block/nbd.c:1716
+    #9 0x56281da8062f in nbd_process_options /mnt/sdb/qemu-4.2.0-rc0/block/nbd.c:1829
+    #10 0x56281da8062f in nbd_open /mnt/sdb/qemu-4.2.0-rc0/block/nbd.c:1873
+
+Fixes: 8f071c9db506e03ab
+Reported-by: Euler Robot <[e-mail]>
+Signed-off-by: Pan Nengyuan <[e-mail]>
+Reviewed-by: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Cc: qemu-stable <[e-mail]>
+Cc: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Message-Id: <[e-mail]>
+Reviewed-by: Stefano Garzarella <[e-mail]>
+Signed-off-by: Eric Blake <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=8198cf5ef0ef98118b4176970d1cd998d93ec849
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ block/nbd.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/block/nbd.c b/block/nbd.c
+index ed0f93ab27..976be76647 100644
+--- a/block/nbd.c
++++ b/block/nbd.c
+@@ -1915,6 +1915,7 @@ static int nbd_open(BlockDriverState *bs, QDict *options, int flags,
+ 
+     ret = nbd_client_connect(bs, errp);
+     if (ret < 0) {
++        nbd_clear_bdrvstate(s);
+         return ret;
+     }
+     /* successfully connected */
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-block-qcow2-threads-fix-qcow2_decompress.patch b/debian/patches/stable/lp-1867519-block-qcow2-threads-fix-qcow2_decompress.patch
 new file mode 100644
index 0000000..bf4169e
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-block-qcow2-threads-fix-qcow2_decompress.patch
@@ -0,0 +1,79 @@
+From e7266570f2cf7b3ca2a156c677ee0a59d563458b Mon Sep 17 00:00:00 2001
+From: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Date: Mon, 2 Mar 2020 18:09:30 +0300
+Subject: [PATCH] block/qcow2-threads: fix qcow2_decompress
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+On success path we return what inflate() returns instead of 0. And it
+most probably works for Z_STREAM_END as it is positive, but is
+definitely broken for Z_BUF_ERROR.
+
+While being here, switch to errno return code, to be closer to
+qcow2_compress API (and usual expectations).
+
+Revert condition in if to be more positive. Drop dead initialization of
+ret.
+
+Cc: [e-mail] # v4.0
+Fixes: 341926ab83e2b
+Signed-off-by: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Message-Id: <[e-mail]>
+Reviewed-by: Alberto Garcia <[e-mail]>
+Reviewed-by: Ján Tomko <[e-mail]>
+Signed-off-by: Max Reitz <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=e7266570f2cf7b3ca2a156c677ee0a59d563458b
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ block/qcow2-threads.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/block/qcow2-threads.c b/block/qcow2-threads.c
+index 77bb578cdf..a68126f291 100644
+--- a/block/qcow2-threads.c
++++ b/block/qcow2-threads.c
+@@ -128,12 +128,12 @@ static ssize_t qcow2_compress(void *dest, size_t dest_size,
+  * @src - source buffer, @src_size bytes
+  *
+  * Returns: 0 on success
+- *          -1 on fail
++ *          -EIO on fail
+  */
+ static ssize_t qcow2_decompress(void *dest, size_t dest_size,
+                                 const void *src, size_t src_size)
+ {
+-    int ret = 0;
++    int ret;
+     z_stream strm;
+ 
+     memset(&strm, 0, sizeof(strm));
+@@ -144,17 +144,19 @@ static ssize_t qcow2_decompress(void *dest, size_t dest_size,
+ 
+     ret = inflateInit2(&strm, -12);
+     if (ret != Z_OK) {
+-        return -1;
++        return -EIO;
+     }
+ 
+     ret = inflate(&strm, Z_FINISH);
+-    if ((ret != Z_STREAM_END && ret != Z_BUF_ERROR) || strm.avail_out != 0) {
++    if ((ret == Z_STREAM_END || ret == Z_BUF_ERROR) && strm.avail_out == 0) {
+         /*
+          * We approve Z_BUF_ERROR because we need @dest buffer to be filled, but
+          * @src buffer may be processed partly (because in qcow2 we know size of
+          * compressed data with precision of one sector)
+          */
+-        ret = -1;
++        ret = 0;
++    } else {
++        ret = -EIO;
+     }
+ 
+     inflateEnd(&strm);
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-hw-i386-pc-fix-regression-in-parsing-vga-cmdline-par.patch b/debian/patches/stable/lp-1867519-hw-i386-pc-fix-regression-in-parsing-vga-cmdline-par.patch
 new file mode 100644
index 0000000..c6aa3a3
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-hw-i386-pc-fix-regression-in-parsing-vga-cmdline-par.patch
@@ -0,0 +1,58 @@
+From a88c40f02ace88f09b2a85a64831b277b2ebc88c Mon Sep 17 00:00:00 2001
+From: Peter Wu <[e-mail]>
+Date: Sat, 21 Dec 2019 17:21:24 +0100
+Subject: [PATCH] hw/i386/pc: fix regression in parsing vga cmdline parameter
+
+When the 'vga=' parameter is succeeded by another parameter, QEMU 4.2.0
+would refuse to start with a rather cryptic message:
+
+    $ qemu-system-x86_64 -kernel /boot/vmlinuz-linux -append 'vga=792 quiet'
+    qemu: can't parse 'vga' parameter: Invalid argument
+
+It was not clear whether this applied to the '-vga std' parameter or the
+'-append' one. Fix the parsing regression and clarify the error.
+
+Fixes: 133ef074bd ("hw/i386/pc: replace use of strtol with qemu_strtoui in x86_load_linux()")
+Cc: Sergio Lopez <[e-mail]>
+Signed-off-by: Peter Wu <[e-mail]>
+Message-Id: <[e-mail]>
+Cc: [e-mail]
+Signed-off-by: Paolo Bonzini <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=a88c40f02ace88f09b2a85a64831b277b2ebc88c
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ hw/i386/x86.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/hw/i386/x86.c b/hw/i386/x86.c
+index d8bb5c2a96..9b9a4d5837 100644
+--- a/hw/i386/x86.c
++++ b/hw/i386/x86.c
+@@ -612,6 +612,7 @@ void x86_load_linux(X86MachineState *x86ms,
+     vmode = strstr(kernel_cmdline, "vga=");
+     if (vmode) {
+         unsigned int video_mode;
++        const char *end;
+         int ret;
+         /* skip "vga=" */
+         vmode += 4;
+@@ -622,10 +623,9 @@ void x86_load_linux(X86MachineState *x86ms,
+         } else if (!strncmp(vmode, "ask", 3)) {
+             video_mode = 0xfffd;
+         } else {
+-            ret = qemu_strtoui(vmode, NULL, 0, &video_mode);
+-            if (ret != 0) {
+-                fprintf(stderr, "qemu: can't parse 'vga' parameter: %s\n",
+-                        strerror(-ret));
++            ret = qemu_strtoui(vmode, &end, 0, &video_mode);
++            if (ret != 0 || (*end && *end != ' ')) {
++                fprintf(stderr, "qemu: invalid 'vga=' kernel parameter.\n");
+                 exit(1);
+             }
+         }
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-intel_iommu-a-fix-to-vtd_find_as_from_bus_num.patch b/debian/patches/stable/lp-1867519-intel_iommu-a-fix-to-vtd_find_as_from_bus_num.patch
 new file mode 100644
index 0000000..4d13d20
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-intel_iommu-a-fix-to-vtd_find_as_from_bus_num.patch
@@ -0,0 +1,44 @@
+From a2e1cd41ccfe796529abfd1b6aeb1dd4393762a2 Mon Sep 17 00:00:00 2001
+From: Liu Yi L <[e-mail]>
+Date: Fri, 3 Jan 2020 21:28:05 +0800
+Subject: [PATCH] intel_iommu: a fix to vtd_find_as_from_bus_num()
+
+Ensure the return value of vtd_find_as_from_bus_num() is NULL by
+enforcing vtd_bus=NULL. This would help caller of vtd_find_as_from_bus_num()
+to decide if any further operation on the returned vtd_bus.
+
+Cc: [e-mail]
+Cc: Kevin Tian <[e-mail]>
+Cc: Jacob Pan <[e-mail]>
+Cc: Peter Xu <[e-mail]>
+Cc: Yi Sun <[e-mail]>
+Signed-off-by: Liu Yi L <[e-mail]>
+Signed-off-by: Yi Sun <[e-mail]>
+Message-Id: <[e-mail]>
+Reviewed-by: Peter Xu <[e-mail]>
+Reviewed-by: Michael S. Tsirkin <[e-mail]>
+Signed-off-by: Michael S. Tsirkin <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=a2e1cd41ccfe796529abfd1b6aeb1dd4393762a2
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ hw/i386/intel_iommu.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
+index ee06993675..609b80750a 100644
+--- a/hw/i386/intel_iommu.c
++++ b/hw/i386/intel_iommu.c
+@@ -948,6 +948,7 @@ static VTDBus *vtd_find_as_from_bus_num(IntelIOMMUState *s, uint8_t bus_num)
+                 return vtd_bus;
+             }
+         }
++        vtd_bus = NULL;
+     }
+     return vtd_bus;
+ }
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-intel_iommu-add-present-bit-check-for-pasid-table-en.patch b/debian/patches/stable/lp-1867519-intel_iommu-add-present-bit-check-for-pasid-table-en.patch
 new file mode 100644
index 0000000..02548a2
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-intel_iommu-add-present-bit-check-for-pasid-table-en.patch
@@ -0,0 +1,202 @@
+From 56fc1e6ac6bde95bc0369d358587f2234d4dddad Mon Sep 17 00:00:00 2001
+From: Liu Yi L <[e-mail]>
+Date: Fri, 3 Jan 2020 21:28:06 +0800
+Subject: [PATCH] intel_iommu: add present bit check for pasid table entries
+
+The present bit check for pasid entry (pe) and pasid directory
+entry (pdire) were missed in previous commits as fpd bit check
+doesn't require present bit as "Set". This patch adds the present
+bit check for callers which wants to get a valid pe/pdire.
+
+Cc: [e-mail]
+Cc: Kevin Tian <[e-mail]>
+Cc: Jacob Pan <[e-mail]>
+Cc: Peter Xu <[e-mail]>
+Cc: Yi Sun <[e-mail]>
+Reviewed-by: Peter Xu <[e-mail]>
+Signed-off-by: Liu Yi L <[e-mail]>
+Message-Id: <[e-mail]>
+Reviewed-by: Peter Xu <[e-mail]>
+Reviewed-by: Michael S. Tsirkin <[e-mail]>
+Signed-off-by: Michael S. Tsirkin <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=56fc1e6ac6bde95bc0369d358587f2234d4dddad
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ hw/i386/intel_iommu.c          | 92 +++++++++++++++++++++++++++-------
+ hw/i386/intel_iommu_internal.h |  1 +
+ 2 files changed, 74 insertions(+), 19 deletions(-)
+
+diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
+index 609b80750a..a523ef0e65 100644
+--- a/hw/i386/intel_iommu.c
++++ b/hw/i386/intel_iommu.c
+@@ -686,9 +686,18 @@ static inline bool vtd_pe_type_check(X86IOMMUState *x86_iommu,
+     return true;
+ }
+ 
+-static int vtd_get_pasid_dire(dma_addr_t pasid_dir_base,
+-                              uint32_t pasid,
+-                              VTDPASIDDirEntry *pdire)
++static inline bool vtd_pdire_present(VTDPASIDDirEntry *pdire)
++{
++    return pdire->val & 1;
++}
++
++/**
++ * Caller of this function should check present bit if wants
++ * to use pdir entry for futher usage except for fpd bit check.
++ */
++static int vtd_get_pdire_from_pdir_table(dma_addr_t pasid_dir_base,
++                                         uint32_t pasid,
++                                         VTDPASIDDirEntry *pdire)
+ {
+     uint32_t index;
+     dma_addr_t addr, entry_size;
+@@ -703,18 +712,22 @@ static int vtd_get_pasid_dire(dma_addr_t pasid_dir_base,
+     return 0;
+ }
+ 
+-static int vtd_get_pasid_entry(IntelIOMMUState *s,
+-                               uint32_t pasid,
+-                               VTDPASIDDirEntry *pdire,
+-                               VTDPASIDEntry *pe)
++static inline bool vtd_pe_present(VTDPASIDEntry *pe)
++{
++    return pe->val[0] & VTD_PASID_ENTRY_P;
++}
++
++static int vtd_get_pe_in_pasid_leaf_table(IntelIOMMUState *s,
++                                          uint32_t pasid,
++                                          dma_addr_t addr,
++                                          VTDPASIDEntry *pe)
+ {
+     uint32_t index;
+-    dma_addr_t addr, entry_size;
++    dma_addr_t entry_size;
+     X86IOMMUState *x86_iommu = X86_IOMMU_DEVICE(s);
+ 
+     index = VTD_PASID_TABLE_INDEX(pasid);
+     entry_size = VTD_PASID_ENTRY_SIZE;
+-    addr = pdire->val & VTD_PASID_TABLE_BASE_ADDR_MASK;
+     addr = addr + index * entry_size;
+     if (dma_memory_read(&address_space_memory, addr, pe, entry_size)) {
+         return -VTD_FR_PASID_TABLE_INV;
+@@ -732,25 +745,54 @@ static int vtd_get_pasid_entry(IntelIOMMUState *s,
+     return 0;
+ }
+ 
+-static int vtd_get_pasid_entry_from_pasid(IntelIOMMUState *s,
+-                                          dma_addr_t pasid_dir_base,
+-                                          uint32_t pasid,
+-                                          VTDPASIDEntry *pe)
++/**
++ * Caller of this function should check present bit if wants
++ * to use pasid entry for futher usage except for fpd bit check.
++ */
++static int vtd_get_pe_from_pdire(IntelIOMMUState *s,
++                                 uint32_t pasid,
++                                 VTDPASIDDirEntry *pdire,
++                                 VTDPASIDEntry *pe)
++{
++    dma_addr_t addr = pdire->val & VTD_PASID_TABLE_BASE_ADDR_MASK;
++
++    return vtd_get_pe_in_pasid_leaf_table(s, pasid, addr, pe);
++}
++
++/**
++ * This function gets a pasid entry from a specified pasid
++ * table (includes dir and leaf table) with a specified pasid.
++ * Sanity check should be done to ensure return a present
++ * pasid entry to caller.
++ */
++static int vtd_get_pe_from_pasid_table(IntelIOMMUState *s,
++                                       dma_addr_t pasid_dir_base,
++                                       uint32_t pasid,
++                                       VTDPASIDEntry *pe)
+ {
+     int ret;
+     VTDPASIDDirEntry pdire;
+ 
+-    ret = vtd_get_pasid_dire(pasid_dir_base, pasid, &pdire);
++    ret = vtd_get_pdire_from_pdir_table(pasid_dir_base,
++                                        pasid, &pdire);
+     if (ret) {
+         return ret;
+     }
+ 
+-    ret = vtd_get_pasid_entry(s, pasid, &pdire, pe);
++    if (!vtd_pdire_present(&pdire)) {
++        return -VTD_FR_PASID_TABLE_INV;
++    }
++
++    ret = vtd_get_pe_from_pdire(s, pasid, &pdire, pe);
+     if (ret) {
+         return ret;
+     }
+ 
+-    return ret;
++    if (!vtd_pe_present(pe)) {
++        return -VTD_FR_PASID_TABLE_INV;
++    }
++
++    return 0;
+ }
+ 
+ static int vtd_ce_get_rid2pasid_entry(IntelIOMMUState *s,
+@@ -763,7 +805,7 @@ static int vtd_ce_get_rid2pasid_entry(IntelIOMMUState *s,
+ 
+     pasid = VTD_CE_GET_RID2PASID(ce);
+     pasid_dir_base = VTD_CE_GET_PASID_DIR_TABLE(ce);
+-    ret = vtd_get_pasid_entry_from_pasid(s, pasid_dir_base, pasid, pe);
++    ret = vtd_get_pe_from_pasid_table(s, pasid_dir_base, pasid, pe);
+ 
+     return ret;
+ }
+@@ -781,7 +823,11 @@ static int vtd_ce_get_pasid_fpd(IntelIOMMUState *s,
+     pasid = VTD_CE_GET_RID2PASID(ce);
+     pasid_dir_base = VTD_CE_GET_PASID_DIR_TABLE(ce);
+ 
+-    ret = vtd_get_pasid_dire(pasid_dir_base, pasid, &pdire);
++    /*
++     * No present bit check since fpd is meaningful even
++     * if the present bit is clear.
++     */
++    ret = vtd_get_pdire_from_pdir_table(pasid_dir_base, pasid, &pdire);
+     if (ret) {
+         return ret;
+     }
+@@ -791,7 +837,15 @@ static int vtd_ce_get_pasid_fpd(IntelIOMMUState *s,
+         return 0;
+     }
+ 
+-    ret = vtd_get_pasid_entry(s, pasid, &pdire, &pe);
++    if (!vtd_pdire_present(&pdire)) {
++        return -VTD_FR_PASID_TABLE_INV;
++    }
++
++    /*
++     * No present bit check since fpd is meaningful even
++     * if the present bit is clear.
++     */
++    ret = vtd_get_pe_from_pdire(s, pasid, &pdire, &pe);
+     if (ret) {
+         return ret;
+     }
+diff --git a/hw/i386/intel_iommu_internal.h b/hw/i386/intel_iommu_internal.h
+index edcf9fc9bb..862033ebe6 100644
+--- a/hw/i386/intel_iommu_internal.h
++++ b/hw/i386/intel_iommu_internal.h
+@@ -479,6 +479,7 @@ typedef struct VTDRootEntry VTDRootEntry;
+ #define VTD_PASID_ENTRY_FPD           (1ULL << 1) /* Fault Processing Disable */
+ 
+ /* PASID Granular Translation Type Mask */
++#define VTD_PASID_ENTRY_P              1ULL
+ #define VTD_SM_PASID_ENTRY_PGTT        (7ULL << 6)
+ #define VTD_SM_PASID_ENTRY_FLT         (1ULL << 6)
+ #define VTD_SM_PASID_ENTRY_SLT         (2ULL << 6)
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-iotests-add-test-for-backup-top-failure-on-permissio.patch b/debian/patches/stable/lp-1867519-iotests-add-test-for-backup-top-failure-on-permissio.patch
 new file mode 100644
index 0000000..790c5d4
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-iotests-add-test-for-backup-top-failure-on-permissio.patch
@@ -0,0 +1,138 @@
+From a541fcc27c98b96da187c7d4573f3270f3ddd283 Mon Sep 17 00:00:00 2001
+From: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Date: Tue, 21 Jan 2020 17:28:02 +0300
+Subject: [PATCH] iotests: add test for backup-top failure on permission
+ activation
+
+This test checks that bug is really fixed by previous commit.
+
+Cc: [e-mail] # v4.2.0
+Signed-off-by: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Message-id: [e-mail]
+Signed-off-by: Max Reitz <[e-mail]>
+
+Origin: backport, https://git.qemu.org/?p=qemu.git;a=commit;h=a541fcc27c98b96da187c7d4573f3270f3ddd283
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ tests/qemu-iotests/283     | 92 ++++++++++++++++++++++++++++++++++++++
+ tests/qemu-iotests/283.out |  8 ++++
+ tests/qemu-iotests/group   |  1 +
+ 3 files changed, 101 insertions(+)
+ create mode 100644 tests/qemu-iotests/283
+ create mode 100644 tests/qemu-iotests/283.out
+
+--- /dev/null
++++ b/tests/qemu-iotests/283
+@@ -0,0 +1,92 @@
++#!/usr/bin/env python
++#
++# Test for backup-top filter permission activation failure
++#
++# Copyright (c) 2019 Virtuozzo International GmbH.
++#
++# This program is free software; you can redistribute it and/or modify
++# it under the terms of the GNU General Public License as published by
++# the Free Software Foundation; either version 2 of the License, or
++# (at your option) any later version.
++#
++# This program is distributed in the hope that it will be useful,
++# but WITHOUT ANY WARRANTY; without even the implied warranty of
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++# GNU General Public License for more details.
++#
++# You should have received a copy of the GNU General Public License
++# along with this program.  If not, see <http://www.gnu.org/licenses/>.
++#
++
++import iotests
++
++# The test is unrelated to formats, restrict it to qcow2 to avoid extra runs
++iotests.verify_image_format(supported_fmts=['qcow2'])
++
++size = 1024 * 1024
++
++""" Test description
++
++When performing a backup, all writes on the source subtree must go through the
++backup-top filter so it can copy all data to the target before it is changed.
++backup-top filter is appended above source node, to achieve this thing, so all
++parents of source node are handled. A configuration with side parents of source
++sub-tree with write permission is unsupported (we'd have append several
++backup-top filter like nodes to handle such parents). The test create an
++example of such configuration and checks that a backup is then not allowed
++(blockdev-backup command should fail).
++
++The configuration:
++
++    ┌────────┐  target  ┌─────────────┐
++    │ target │ ◀─────── │ backup_top  │
++    └────────┘          └─────────────┘
++                            │
++                            │ backing
++                            ▼
++                        ┌─────────────┐
++                        │   source    │
++                        └─────────────┘
++                            │
++                            │ file
++                            ▼
++                        ┌─────────────┐  write perm   ┌───────┐
++                        │    base     │ ◀──────────── │ other │
++                        └─────────────┘               └───────┘
++
++On activation (see .active field of backup-top state in block/backup-top.c),
++backup-top is going to unshare write permission on its source child. Write
++unsharing will be propagated to the "source->base" link and will conflict with
++other node write permission. So permission update will fail and backup job will
++not be started.
++
++Note, that the only thing which prevents backup of running on such
++configuration is default permission propagation scheme. It may be altered by
++different block drivers, so backup will run in invalid configuration. But
++something is better than nothing. Also, before the previous commit (commit
++preceding this test creation), starting backup on such configuration led to
++crash, so current "something" is a lot better, and this test actual goal is
++to check that crash is fixed :)
++"""
++
++vm = iotests.VM()
++vm.launch()
++
++vm.qmp_log('blockdev-add', **{'node-name': 'target', 'driver': 'null-co'})
++
++vm.qmp_log('blockdev-add', **{
++    'node-name': 'source',
++    'driver': 'blkdebug',
++    'image': {'node-name': 'base', 'driver': 'null-co', 'size': size}
++})
++
++vm.qmp_log('blockdev-add', **{
++    'node-name': 'other',
++    'driver': 'blkdebug',
++    'image': 'base',
++    'take-child-perms': ['write']
++})
++
++vm.qmp_log('blockdev-backup', sync='full', device='source', target='target')
++
++vm.shutdown()
+--- /dev/null
++++ b/tests/qemu-iotests/283.out
+@@ -0,0 +1,8 @@
++{"execute": "blockdev-add", "arguments": {"driver": "null-co", "node-name": "target"}}
++{"return": {}}
++{"execute": "blockdev-add", "arguments": {"driver": "blkdebug", "image": {"driver": "null-co", "node-name": "base", "size": 1048576}, "node-name": "source"}}
++{"return": {}}
++{"execute": "blockdev-add", "arguments": {"driver": "blkdebug", "image": "base", "node-name": "other", "take-child-perms": ["write"]}}
++{"return": {}}
++{"execute": "blockdev-backup", "arguments": {"device": "source", "sync": "full", "target": "target"}}
++{"error": {"class": "GenericError", "desc": "Cannot set permissions for backup-top filter: Conflicts with use by other as 'image', which uses 'write' on base"}}
+--- a/tests/qemu-iotests/group
++++ b/tests/qemu-iotests/group
+@@ -286,3 +286,4 @@
+ 272 rw
+ 273 backing quick
+ 277 rw quick
++283 auto quick
diff --git a/debian/patches/stable/lp-1867519-job-refactor-progress-to-separate-object.patch b/debian/patches/stable/lp-1867519-job-refactor-progress-to-separate-object.patch
 new file mode 100644
index 0000000..a31cf9f
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-job-refactor-progress-to-separate-object.patch
@@ -0,0 +1,230 @@
+From 01fe1ca945345d3dc420d70c69488143dc0451b1 Mon Sep 17 00:00:00 2001
+From: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Date: Wed, 11 Mar 2020 13:29:56 +0300
+Subject: [PATCH] job: refactor progress to separate object
+
+We need it in separate to pass to the block-copy object in the next
+commit.
+
+Cc: [e-mail]
+Signed-off-by: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Reviewed-by: Andrey Shinkevich <[e-mail]>
+Reviewed-by: Max Reitz <[e-mail]>
+Message-Id: <[e-mail]>
+Signed-off-by: Max Reitz <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=01fe1ca945345d3dc420d70c69488143dc0451b1
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ blockjob.c                    | 16 +++++-----
+ include/qemu/job.h            | 11 ++-----
+ include/qemu/progress_meter.h | 58 +++++++++++++++++++++++++++++++++++
+ job-qmp.c                     |  4 +--
+ job.c                         |  6 ++--
+ qemu-img.c                    |  6 ++--
+ 6 files changed, 76 insertions(+), 25 deletions(-)
+ create mode 100644 include/qemu/progress_meter.h
+
+diff --git a/blockjob.c b/blockjob.c
+index 5d63b1e89d..fc850312c1 100644
+--- a/blockjob.c
++++ b/blockjob.c
+@@ -299,8 +299,8 @@ BlockJobInfo *block_job_query(BlockJob *job, Error **errp)
+     info->device    = g_strdup(job->job.id);
+     info->busy      = atomic_read(&job->job.busy);
+     info->paused    = job->job.pause_count > 0;
+-    info->offset    = job->job.progress_current;
+-    info->len       = job->job.progress_total;
++    info->offset    = job->job.progress.current;
++    info->len       = job->job.progress.total;
+     info->speed     = job->speed;
+     info->io_status = job->iostatus;
+     info->ready     = job_is_ready(&job->job),
+@@ -330,8 +330,8 @@ static void block_job_event_cancelled(Notifier *n, void *opaque)
+ 
+     qapi_event_send_block_job_cancelled(job_type(&job->job),
+                                         job->job.id,
+-                                        job->job.progress_total,
+-                                        job->job.progress_current,
++                                        job->job.progress.total,
++                                        job->job.progress.current,
+                                         job->speed);
+ }
+ 
+@@ -350,8 +350,8 @@ static void block_job_event_completed(Notifier *n, void *opaque)
+ 
+     qapi_event_send_block_job_completed(job_type(&job->job),
+                                         job->job.id,
+-                                        job->job.progress_total,
+-                                        job->job.progress_current,
++                                        job->job.progress.total,
++                                        job->job.progress.current,
+                                         job->speed,
+                                         !!msg,
+                                         msg);
+@@ -379,8 +379,8 @@ static void block_job_event_ready(Notifier *n, void *opaque)
+ 
+     qapi_event_send_block_job_ready(job_type(&job->job),
+                                     job->job.id,
+-                                    job->job.progress_total,
+-                                    job->job.progress_current,
++                                    job->job.progress.total,
++                                    job->job.progress.current,
+                                     job->speed);
+ }
+ 
+diff --git a/include/qemu/job.h b/include/qemu/job.h
+index bd59cd8944..32aabb1c60 100644
+--- a/include/qemu/job.h
++++ b/include/qemu/job.h
+@@ -28,6 +28,7 @@
+ 
+ #include "qapi/qapi-types-job.h"
+ #include "qemu/queue.h"
++#include "qemu/progress_meter.h"
+ #include "qemu/coroutine.h"
+ #include "block/aio.h"
+ 
+@@ -117,15 +118,7 @@ typedef struct Job {
+     /** True if this job should automatically dismiss itself */
+     bool auto_dismiss;
+ 
+-    /**
+-     * Current progress. The unit is arbitrary as long as the ratio between
+-     * progress_current and progress_total represents the estimated percentage
+-     * of work already done.
+-     */
+-    int64_t progress_current;
+-
+-    /** Estimated progress_current value at the completion of the job */
+-    int64_t progress_total;
++    ProgressMeter progress;
+ 
+     /**
+      * Return code from @run and/or @prepare callback(s).
+diff --git a/include/qemu/progress_meter.h b/include/qemu/progress_meter.h
+new file mode 100644
+index 0000000000..9a23ff071c
+--- /dev/null
++++ b/include/qemu/progress_meter.h
+@@ -0,0 +1,58 @@
++/*
++ * Helper functionality for some process progress tracking.
++ *
++ * Copyright (c) 2011 IBM Corp.
++ * Copyright (c) 2012, 2018 Red Hat, Inc.
++ * Copyright (c) 2020 Virtuozzo International GmbH
++ *
++ * Permission is hereby granted, free of charge, to any person obtaining a copy
++ * of this software and associated documentation files (the "Software"), to deal
++ * in the Software without restriction, including without limitation the rights
++ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
++ * copies of the Software, and to permit persons to whom the Software is
++ * furnished to do so, subject to the following conditions:
++ *
++ * The above copyright notice and this permission notice shall be included in
++ * all copies or substantial portions of the Software.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
++ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
++ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
++ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
++ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
++ * THE SOFTWARE.
++ */
++
++#ifndef QEMU_PROGRESS_METER_H
++#define QEMU_PROGRESS_METER_H
++
++typedef struct ProgressMeter {
++    /**
++     * Current progress. The unit is arbitrary as long as the ratio between
++     * current and total represents the estimated percentage
++     * of work already done.
++     */
++    uint64_t current;
++
++    /** Estimated current value at the completion of the process */
++    uint64_t total;
++} ProgressMeter;
++
++static inline void progress_work_done(ProgressMeter *pm, uint64_t done)
++{
++    pm->current += done;
++}
++
++static inline void progress_set_remaining(ProgressMeter *pm, uint64_t remaining)
++{
++    pm->total = pm->current + remaining;
++}
++
++static inline void progress_increase_remaining(ProgressMeter *pm,
++                                               uint64_t delta)
++{
++    pm->total += delta;
++}
++
++#endif /* QEMU_PROGRESS_METER_H */
+diff --git a/job-qmp.c b/job-qmp.c
+index fbfed25a00..fecc939ebd 100644
+--- a/job-qmp.c
++++ b/job-qmp.c
+@@ -143,8 +143,8 @@ static JobInfo *job_query_single(Job *job, Error **errp)
+         .id                 = g_strdup(job->id),
+         .type               = job_type(job),
+         .status             = job->status,
+-        .current_progress   = job->progress_current,
+-        .total_progress     = job->progress_total,
++        .current_progress   = job->progress.current,
++        .total_progress     = job->progress.total,
+         .has_error          = !!job->err,
+         .error              = job->err ? \
+                               g_strdup(error_get_pretty(job->err)) : NULL,
+diff --git a/job.c b/job.c
+index 04409b40aa..134a07b92e 100644
+--- a/job.c
++++ b/job.c
+@@ -369,17 +369,17 @@ void job_unref(Job *job)
+ 
+ void job_progress_update(Job *job, uint64_t done)
+ {
+-    job->progress_current += done;
++    progress_work_done(&job->progress, done);
+ }
+ 
+ void job_progress_set_remaining(Job *job, uint64_t remaining)
+ {
+-    job->progress_total = job->progress_current + remaining;
++    progress_set_remaining(&job->progress, remaining);
+ }
+ 
+ void job_progress_increase_remaining(Job *job, uint64_t delta)
+ {
+-    job->progress_total += delta;
++    progress_increase_remaining(&job->progress, delta);
+ }
+ 
+ void job_event_cancelled(Job *job)
+diff --git a/qemu-img.c b/qemu-img.c
+index 7b7087dd60..afddf33f08 100644
+--- a/qemu-img.c
++++ b/qemu-img.c
+@@ -884,9 +884,9 @@ static void run_block_job(BlockJob *job, Error **errp)
+     do {
+         float progress = 0.0f;
+         aio_poll(aio_context, true);
+-        if (job->job.progress_total) {
+-            progress = (float)job->job.progress_current /
+-                       job->job.progress_total * 100.f;
++        if (job->job.progress.total) {
++            progress = (float)job->job.progress.current /
++                       job->job.progress.total * 100.f;
+         }
+         qemu_progress_print(progress, 0);
+     } while (!job_is_ready(&job->job) && !job_is_completed(&job->job));
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-plugins-core-add-missing-break-in-cb_to_tcg_flags.patch b/debian/patches/stable/lp-1867519-plugins-core-add-missing-break-in-cb_to_tcg_flags.patch
 new file mode 100644
index 0000000..5047c62
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-plugins-core-add-missing-break-in-cb_to_tcg_flags.patch
@@ -0,0 +1,41 @@
+From dcc474c69e6a59044b9bb54624bd636cbfd98aa9 Mon Sep 17 00:00:00 2001
+From: "Emilio G. Cota" <[e-mail]>
+Date: Tue, 25 Feb 2020 12:47:02 +0000
+Subject: [PATCH] plugins/core: add missing break in cb_to_tcg_flags
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Fixes: 54cb65d8588
+Reported-by: Robert Henry <[e-mail]>
+Signed-off-by: Emilio G. Cota <[e-mail]>
+Signed-off-by: Alex Bennée <[e-mail]>
+Reviewed-by: Richard Henderson <[e-mail]>
+Reviewed-by: Philippe Mathieu-Daudé <[e-mail]>
+Message-Id: <[e-mail]>
+Cc: [e-mail]
+Message-Id: <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=dcc474c69e6a59044b9bb54624bd636cbfd98aa9
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ plugins/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/plugins/core.c b/plugins/core.c
+index 9e1b9e7a91..ed863011ba 100644
+--- a/plugins/core.c
++++ b/plugins/core.c
+@@ -286,6 +286,7 @@ static inline uint32_t cb_to_tcg_flags(enum qemu_plugin_cb_flags flags)
+     switch (flags) {
+     case QEMU_PLUGIN_CB_RW_REGS:
+         ret = 0;
++        break;
+     case QEMU_PLUGIN_CB_R_REGS:
+         ret = TCG_CALL_NO_WG;
+         break;
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-qcow2-Fix-alloc_cluster_abort-for-pre-existing-clust.patch b/debian/patches/stable/lp-1867519-qcow2-Fix-alloc_cluster_abort-for-pre-existing-clust.patch
 new file mode 100644
index 0000000..ed7560a
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-qcow2-Fix-alloc_cluster_abort-for-pre-existing-clust.patch
@@ -0,0 +1,39 @@
+From 3ede935fdbbd5f7b24b4724bbfb8938acb5956d8 Mon Sep 17 00:00:00 2001
+From: Max Reitz <[e-mail]>
+Date: Tue, 25 Feb 2020 15:31:28 +0100
+Subject: [PATCH] qcow2: Fix alloc_cluster_abort() for pre-existing clusters
+
+handle_alloc() reuses preallocated zero clusters.  If anything goes
+wrong during the data write, we do not change their L2 entry, so we
+must not let qcow2_alloc_cluster_abort() free them.
+
+Fixes: 8b24cd141549b5b264baeddd4e72902cfb5de23b
+Cc: [e-mail]
+Signed-off-by: Max Reitz <[e-mail]>
+Message-Id: <[e-mail]>
+Signed-off-by: Kevin Wolf <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=3ede935fdbbd5f7b24b4724bbfb8938acb5956d8
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ block/qcow2-cluster.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c
+index 78c95dfa16..17f1363279 100644
+--- a/block/qcow2-cluster.c
++++ b/block/qcow2-cluster.c
+@@ -1026,7 +1026,7 @@ err:
+ void qcow2_alloc_cluster_abort(BlockDriverState *bs, QCowL2Meta *m)
+ {
+     BDRVQcow2State *s = bs->opaque;
+-    if (!has_data_file(bs)) {
++    if (!has_data_file(bs) && !m->keep_old_clusters) {
+         qcow2_free_clusters(bs, m->alloc_offset,
+                             m->nb_clusters << s->cluster_bits,
+                             QCOW2_DISCARD_NEVER);
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-qcow2-Fix-qcow2_alloc_cluster_abort-for-external-dat.patch b/debian/patches/stable/lp-1867519-qcow2-Fix-qcow2_alloc_cluster_abort-for-external-dat.patch
 new file mode 100644
index 0000000..b7acd5b
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-qcow2-Fix-qcow2_alloc_cluster_abort-for-external-dat.patch
@@ -0,0 +1,44 @@
+From c3b6658c1a5a3fb24d6c27b2594cf86146f75b22 Mon Sep 17 00:00:00 2001
+From: Kevin Wolf <[e-mail]>
+Date: Tue, 11 Feb 2020 10:48:59 +0100
+Subject: [PATCH] qcow2: Fix qcow2_alloc_cluster_abort() for external data file
+
+For external data file, cluster allocations return an offset in the data
+file and are not refcounted. In this case, there is nothing to do for
+qcow2_alloc_cluster_abort(). Freeing the same offset in the qcow2 file
+is wrong and causes crashes in the better case or image corruption in
+the worse case.
+
+Signed-off-by: Kevin Wolf <[e-mail]>
+Message-Id: <[e-mail]>
+Signed-off-by: Kevin Wolf <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=c3b6658c1a5a3fb24d6c27b2594cf86146f75b22
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ block/qcow2-cluster.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c
+index 1947f13a2d..78c95dfa16 100644
+--- a/block/qcow2-cluster.c
++++ b/block/qcow2-cluster.c
+@@ -1026,8 +1026,11 @@ err:
+ void qcow2_alloc_cluster_abort(BlockDriverState *bs, QCowL2Meta *m)
+ {
+     BDRVQcow2State *s = bs->opaque;
+-    qcow2_free_clusters(bs, m->alloc_offset, m->nb_clusters << s->cluster_bits,
+-                        QCOW2_DISCARD_NEVER);
++    if (!has_data_file(bs)) {
++        qcow2_free_clusters(bs, m->alloc_offset,
++                            m->nb_clusters << s->cluster_bits,
++                            QCOW2_DISCARD_NEVER);
++    }
+ }
+ 
+ /*
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-qcow2-bitmaps-fix-qcow2_can_store_new_dirty_bitmap.patch b/debian/patches/stable/lp-1867519-qcow2-bitmaps-fix-qcow2_can_store_new_dirty_bitmap.patch
 new file mode 100644
index 0000000..b1b1869
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-qcow2-bitmaps-fix-qcow2_can_store_new_dirty_bitmap.patch
@@ -0,0 +1,102 @@
+From a1db8733d28d615bc0daeada6c406a6dd5c5d5ef Mon Sep 17 00:00:00 2001
+From: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Date: Mon, 14 Oct 2019 14:51:25 +0300
+Subject: [PATCH] qcow2-bitmaps: fix qcow2_can_store_new_dirty_bitmap
+
+qcow2_can_store_new_dirty_bitmap works wrong, as it considers only
+bitmaps already stored in the qcow2 image and ignores persistent
+BdrvDirtyBitmap objects.
+
+So, let's instead count persistent BdrvDirtyBitmaps. We load all qcow2
+bitmaps on open, so there should not be any bitmap in the image for
+which we don't have BdrvDirtyBitmaps version. If it is - it's a kind of
+corruption, and no reason to check for corruptions here (open() and
+close() are better places for it).
+
+Signed-off-by: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Message-id: [e-mail]
+Reviewed-by: Max Reitz <[e-mail]>
+Cc: [e-mail]
+Signed-off-by: Max Reitz <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=a1db8733d28d615bc0daeada6c406a6dd5c5d5ef
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ block/qcow2-bitmap.c | 41 ++++++++++++++++++-----------------------
+ 1 file changed, 18 insertions(+), 23 deletions(-)
+
+diff --git a/block/qcow2-bitmap.c b/block/qcow2-bitmap.c
+index c6c8ebbe89..d41f5d049b 100644
+--- a/block/qcow2-bitmap.c
++++ b/block/qcow2-bitmap.c
+@@ -1703,8 +1703,14 @@ bool coroutine_fn qcow2_co_can_store_new_dirty_bitmap(BlockDriverState *bs,
+                                                       Error **errp)
+ {
+     BDRVQcow2State *s = bs->opaque;
+-    bool found;
+-    Qcow2BitmapList *bm_list;
++    BdrvDirtyBitmap *bitmap;
++    uint64_t bitmap_directory_size = 0;
++    uint32_t nb_bitmaps = 0;
++
++    if (bdrv_find_dirty_bitmap(bs, name)) {
++        error_setg(errp, "Bitmap already exists: %s", name);
++        return false;
++    }
+ 
+     if (s->qcow_version < 3) {
+         /* Without autoclear_features, we would always have to assume
+@@ -1720,38 +1726,27 @@ bool coroutine_fn qcow2_co_can_store_new_dirty_bitmap(BlockDriverState *bs,
+         goto fail;
+     }
+ 
+-    if (s->nb_bitmaps == 0) {
+-        return true;
++    FOR_EACH_DIRTY_BITMAP(bs, bitmap) {
++        if (bdrv_dirty_bitmap_get_persistence(bitmap)) {
++            nb_bitmaps++;
++            bitmap_directory_size +=
++                calc_dir_entry_size(strlen(bdrv_dirty_bitmap_name(bitmap)), 0);
++        }
+     }
++    nb_bitmaps++;
++    bitmap_directory_size += calc_dir_entry_size(strlen(name), 0);
+ 
+-    if (s->nb_bitmaps >= QCOW2_MAX_BITMAPS) {
++    if (nb_bitmaps > QCOW2_MAX_BITMAPS) {
+         error_setg(errp,
+                    "Maximum number of persistent bitmaps is already reached");
+         goto fail;
+     }
+ 
+-    if (s->bitmap_directory_size + calc_dir_entry_size(strlen(name), 0) >
+-        QCOW2_MAX_BITMAP_DIRECTORY_SIZE)
+-    {
++    if (bitmap_directory_size > QCOW2_MAX_BITMAP_DIRECTORY_SIZE) {
+         error_setg(errp, "Not enough space in the bitmap directory");
+         goto fail;
+     }
+ 
+-    qemu_co_mutex_lock(&s->lock);
+-    bm_list = bitmap_list_load(bs, s->bitmap_directory_offset,
+-                               s->bitmap_directory_size, errp);
+-    qemu_co_mutex_unlock(&s->lock);
+-    if (bm_list == NULL) {
+-        goto fail;
+-    }
+-
+-    found = find_bitmap_by_name(bm_list, name);
+-    bitmap_list_free(bm_list);
+-    if (found) {
+-        error_setg(errp, "Bitmap with the same name is already stored");
+-        goto fail;
+-    }
+-
+     return true;
+ 
+ fail:
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-qemu-img-Fix-convert-n-B-for-backing-less-targets.patch b/debian/patches/stable/lp-1867519-qemu-img-Fix-convert-n-B-for-backing-less-targets.patch
 new file mode 100644
index 0000000..ed8ab96
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-qemu-img-Fix-convert-n-B-for-backing-less-targets.patch
@@ -0,0 +1,54 @@
+From c69291e712ae4ef95f628424db6586473da61d43 Mon Sep 17 00:00:00 2001
+From: Max Reitz <[e-mail]>
+Date: Tue, 21 Jan 2020 16:59:14 +0100
+Subject: [PATCH] qemu-img: Fix convert -n -B for backing-less targets
+
+s.target_has_backing does not reflect whether the target BDS has a
+backing file; it only tells whether we should use a backing file during
+conversion (specified by -B).
+
+As such, if you use convert -n, the target does not necessarily actually
+have a backing file, and then dereferencing out_bs->backing fails here.
+
+When converting to an existing file, we should set
+target_backing_sectors to a negative value, because first, as the
+comment explains, this value is only used for optimization, so it is
+always fine to do that.
+
+Second, we use this value to determine where the target must be
+initialized to zeroes (overlays are initialized to zero after the end of
+their backing file).  When converting to an existing file, we cannot
+assume that to be true.
+
+Cc: [e-mail]
+Fixes: 351c8efff9ad809c822d55620df54d575d536f68
+       ("qemu-img: Special post-backing convert handling")
+Signed-off-by: Max Reitz <[e-mail]>
+Message-Id: <[e-mail]>
+Reviewed-by: John Snow <[e-mail]>
+Signed-off-by: Max Reitz <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=c69291e712ae4ef95f628424db6586473da61d43
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ qemu-img.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/qemu-img.c b/qemu-img.c
+index 0faf2cd2f5..804630a368 100644
+--- a/qemu-img.c
++++ b/qemu-img.c
+@@ -2523,7 +2523,7 @@ static int img_convert(int argc, char **argv)
+         }
+     }
+ 
+-    if (s.target_has_backing) {
++    if (s.target_has_backing && s.target_is_new) {
+         /* Errors are treated as "backing length unknown" (which means
+          * s.target_backing_sectors has to be negative, which it will
+          * be automatically).  The backing file length is used only
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-s390-sclp-improve-special-wait-psw-logic.patch b/debian/patches/stable/lp-1867519-s390-sclp-improve-special-wait-psw-logic.patch
 new file mode 100644
index 0000000..fb21432
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-s390-sclp-improve-special-wait-psw-logic.patch
@@ -0,0 +1,40 @@
+From 8b51c0961cc13e55b26bb6665ec3a341abdc7658 Mon Sep 17 00:00:00 2001
+From: Christian Borntraeger <[e-mail]>
+Date: Thu, 20 Feb 2020 14:16:22 +0100
+Subject: [PATCH] s390/sclp: improve special wait psw logic
+
+There is a special quiesce PSW that we check for "shutdown". Otherwise disabled
+wait is detected as "crashed". Architecturally we must only check PSW bits
+116-127. Fix this.
+
+Cc: [e-mail]
+Signed-off-by: Christian Borntraeger <[e-mail]>
+Message-Id: <[e-mail]>
+Reviewed-by: David Hildenbrand <[e-mail]>
+Acked-by: Janosch Frank <[e-mail]>
+Signed-off-by: Cornelia Huck <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=8b51c0961cc13e55b26bb6665ec3a341abdc7658
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ target/s390x/helper.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/target/s390x/helper.c b/target/s390x/helper.c
+index b810ad431e..ed72684911 100644
+--- a/target/s390x/helper.c
++++ b/target/s390x/helper.c
+@@ -89,7 +89,7 @@ hwaddr s390_cpu_get_phys_addr_debug(CPUState *cs, vaddr vaddr)
+ static inline bool is_special_wait_psw(uint64_t psw_addr)
+ {
+     /* signal quiesce */
+-    return psw_addr == 0xfffUL;
++    return (psw_addr & 0xfffUL) == 0xfffUL;
+ }
+ 
+ void s390_handle_wait(S390CPU *cpu)
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-target-arm-Return-correct-IL-bit-in-merge_syn_data_a.patch b/debian/patches/stable/lp-1867519-target-arm-Return-correct-IL-bit-in-merge_syn_data_a.patch
 new file mode 100644
index 0000000..6c4bce9
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-target-arm-Return-correct-IL-bit-in-merge_syn_data_a.patch
@@ -0,0 +1,46 @@
+From 30d544839e278dc76017b9a42990c41e84a34377 Mon Sep 17 00:00:00 2001
+From: Jeff Kubascik <[e-mail]>
+Date: Fri, 17 Jan 2020 14:09:31 +0000
+Subject: [PATCH] target/arm: Return correct IL bit in merge_syn_data_abort
+
+The IL bit is set for 32-bit instructions, thus passing false
+with the is_16bit parameter to syn_data_abort_with_iss() makes
+a syn mask that always has the IL bit set.
+
+Pass is_16bit as true to make the initial syn mask have IL=0,
+so that the final IL value comes from or'ing template_syn.
+
+Cc: [e-mail]
+Fixes: aaa1f954d4ca ("target-arm: A64: Create Instruction Syndromes for Data Aborts")
+Signed-off-by: Jeff Kubascik <[e-mail]>
+Signed-off-by: Richard Henderson <[e-mail]>
+Message-id: [e-mail]
+[rth: Extracted this as a self-contained bug fix from a larger patch]
+Signed-off-by: Richard Henderson <[e-mail]>
+Reviewed-by: Peter Maydell <[e-mail]>
+Signed-off-by: Peter Maydell <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=30d544839e278dc76017b9a42990c41e84a34377
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ target/arm/tlb_helper.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/target/arm/tlb_helper.c b/target/arm/tlb_helper.c
+index 5feb312941..e63f8bda29 100644
+--- a/target/arm/tlb_helper.c
++++ b/target/arm/tlb_helper.c
+@@ -44,7 +44,7 @@ static inline uint32_t merge_syn_data_abort(uint32_t template_syn,
+         syn = syn_data_abort_with_iss(same_el,
+                                       0, 0, 0, 0, 0,
+                                       ea, 0, s1ptw, is_write, fsc,
+-                                      false);
++                                      true);
+         /* Merge the runtime syndrome with the template syndrome.  */
+         syn |= template_syn;
+     }
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-target-arm-Set-ISSIs16Bit-in-make_issinfo.patch b/debian/patches/stable/lp-1867519-target-arm-Set-ISSIs16Bit-in-make_issinfo.patch
 new file mode 100644
index 0000000..46f0f6d
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-target-arm-Set-ISSIs16Bit-in-make_issinfo.patch
@@ -0,0 +1,42 @@
+From 1a1fbc6cbb34c26d43d8360c66c1d21681af14a9 Mon Sep 17 00:00:00 2001
+From: Richard Henderson <[e-mail]>
+Date: Fri, 17 Jan 2020 14:09:31 +0000
+Subject: [PATCH] target/arm: Set ISSIs16Bit in make_issinfo
+
+During the conversion to decodetree, the setting of
+ISSIs16Bit got lost.  This causes the guest os to
+incorrectly adjust trapping memory operations.
+
+Cc: [e-mail]
+Fixes: 46beb58efbb8a2a32 ("target/arm: Convert T16, load (literal)")
+Reported-by: Jeff Kubascik <[e-mail]>
+Signed-off-by: Richard Henderson <[e-mail]>
+Message-id: [e-mail]
+Reviewed-by: Peter Maydell <[e-mail]>
+Signed-off-by: Peter Maydell <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=1a1fbc6cbb34c26d43d8360c66c1d21681af14a9
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ target/arm/translate.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index 0c8624fb42..2f4aea927f 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -8556,6 +8556,9 @@ static ISSInfo make_issinfo(DisasContext *s, int rd, bool p, bool w)
+     /* ISS not valid if writeback */
+     if (p && !w) {
+         ret = rd;
++        if (s->base.pc_next - s->pc_curr == 2) {
++            ret |= ISSIs16Bit;
++        }
+     } else {
+         ret = ISSInvalid;
+     }
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-target-arm-arm-semi-fix-SYS_OPEN-to-return-nonzero-f.patch b/debian/patches/stable/lp-1867519-target-arm-arm-semi-fix-SYS_OPEN-to-return-nonzero-f.patch
 new file mode 100644
index 0000000..4f7a731
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-target-arm-arm-semi-fix-SYS_OPEN-to-return-nonzero-f.patch
@@ -0,0 +1,79 @@
+From 21bf9b06cb6d07c6cc437dfd47b47b28c2bb79db Mon Sep 17 00:00:00 2001
+From: Masahiro Yamada <[e-mail]>
+Date: Fri, 17 Jan 2020 14:09:30 +0000
+Subject: [PATCH] target/arm/arm-semi: fix SYS_OPEN to return nonzero
+ filehandle
+
+According to the specification "Semihosting for AArch32 and Aarch64",
+the SYS_OPEN operation should return:
+
+ - A nonzero handle if the call is successful
+ - -1 if the call is not successful
+
+So, it should never return 0.
+
+Prior to commit 35e9a0a8ce4b ("target/arm/arm-semi: Make semihosting
+code hand out its own file descriptors"), the guest fd matched to the
+host fd. It returned a nonzero handle on success since the fd 0 is
+already used for stdin.
+
+Now that the guest fd is the index of guestfd_array, it starts from 0.
+
+I noticed this issue particularly because Trusted Firmware-A built with
+PLAT=qemu is no longer working. Its io_semihosting driver only handles
+a positive return value as a valid filehandle.
+
+Basically, there are two ways to fix this:
+
+  - Use (guestfd - 1) as the index of guestfs_arrary. We need to insert
+    increment/decrement to convert the guestfd and the array index back
+    and forth.
+
+  - Keep using guestfd as the index of guestfs_array. The first entry
+    of guestfs_array is left unused.
+
+I thought the latter is simpler. We end up with wasting a small piece
+of memory for the unused first entry of guestfd_array, but this is
+probably not a big deal.
+
+Fixes: 35e9a0a8ce4b ("target/arm/arm-semi: Make semihosting code hand out its own file descriptors")
+Cc: [e-mail]
+Signed-off-by: Masahiro Yamada <[e-mail]>
+Reviewed-by: Richard Henderson <[e-mail]>
+Message-id: [e-mail]
+Signed-off-by: Peter Maydell <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=21bf9b06cb6d07c6cc437dfd47b47b28c2bb79db
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ target/arm/arm-semi.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
+index 47d61f6fe1..788fe61b51 100644
+--- a/target/arm/arm-semi.c
++++ b/target/arm/arm-semi.c
+@@ -144,7 +144,8 @@ static int alloc_guestfd(void)
+         guestfd_array = g_array_new(FALSE, TRUE, sizeof(GuestFD));
+     }
+ 
+-    for (i = 0; i < guestfd_array->len; i++) {
++    /* SYS_OPEN should return nonzero handle on success. Start guestfd from 1 */
++    for (i = 1; i < guestfd_array->len; i++) {
+         GuestFD *gf = &g_array_index(guestfd_array, GuestFD, i);
+ 
+         if (gf->type == GuestFDUnused) {
+@@ -168,7 +169,7 @@ static GuestFD *do_get_guestfd(int guestfd)
+         return NULL;
+     }
+ 
+-    if (guestfd < 0 || guestfd >= guestfd_array->len) {
++    if (guestfd <= 0 || guestfd >= guestfd_array->len) {
+         return NULL;
+     }
+ 
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-target-arm-ensure-we-use-current-exception-state-aft.patch b/debian/patches/stable/lp-1867519-target-arm-ensure-we-use-current-exception-state-aft.patch
 new file mode 100644
index 0000000..896de43
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-target-arm-ensure-we-use-current-exception-state-aft.patch
@@ -0,0 +1,127 @@
+From f80741d107673f162e3b097fc76a1590036cc9d1 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <[e-mail]>
+Date: Thu, 12 Dec 2019 11:47:34 +0000
+Subject: [PATCH] target/arm: ensure we use current exception state after SCR
+ update
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+A write to the SCR can change the effective EL by droppping the system
+from secure to non-secure mode. However if we use a cached current_el
+from before the change we'll rebuild the flags incorrectly. To fix
+this we introduce the ARM_CP_NEWEL CP flag to indicate the new EL
+should be used when recomputing the flags.
+
+Signed-off-by: Alex Bennée <[e-mail]>
+Tested-by: Philippe Mathieu-Daudé <[e-mail]>
+Reviewed-by: Richard Henderson <[e-mail]>
+Message-id: [e-mail]
+Cc: Richard Henderson <[e-mail]>
+Message-Id: <[e-mail]>
+Cc: [e-mail]
+Signed-off-by: Peter Maydell <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=f80741d107673f162e3b097fc76a1590036cc9d1
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ target/arm/cpu.h       |  8 ++++++--
+ target/arm/helper.c    | 14 +++++++++++++-
+ target/arm/helper.h    |  1 +
+ target/arm/translate.c |  6 +++++-
+ 4 files changed, 25 insertions(+), 4 deletions(-)
+
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index 4106e4ae59..5f70e9e043 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -2238,6 +2238,9 @@ static inline uint64_t cpreg_to_kvm_id(uint32_t cpregid)
+  * RAISES_EXC is for when the read or write hook might raise an exception;
+  * the generated code will synchronize the CPU state before calling the hook
+  * so that it is safe for the hook to call raise_exception().
++ * NEWEL is for writes to registers that might change the exception
++ * level - typically on older ARM chips. For those cases we need to
++ * re-read the new el when recomputing the translation flags.
+  */
+ #define ARM_CP_SPECIAL           0x0001
+ #define ARM_CP_CONST             0x0002
+@@ -2257,10 +2260,11 @@ static inline uint64_t cpreg_to_kvm_id(uint32_t cpregid)
+ #define ARM_CP_SVE               0x2000
+ #define ARM_CP_NO_GDB            0x4000
+ #define ARM_CP_RAISES_EXC        0x8000
++#define ARM_CP_NEWEL             0x10000
+ /* Used only as a terminator for ARMCPRegInfo lists */
+-#define ARM_CP_SENTINEL          0xffff
++#define ARM_CP_SENTINEL          0xfffff
+ /* Mask of only the flag bits in a type field */
+-#define ARM_CP_FLAG_MASK         0xf0ff
++#define ARM_CP_FLAG_MASK         0x1f0ff
+ 
+ /* Valid values for ARMCPRegInfo state field, indicating which of
+  * the AArch32 and AArch64 execution states this register is visible in.
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index 3a93844a3b..5074b5f69c 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -5133,7 +5133,7 @@ static const ARMCPRegInfo el3_cp_reginfo[] = {
+       .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 0,
+       .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.scr_el3),
+       .resetvalue = 0, .writefn = scr_write },
+-    { .name = "SCR",  .type = ARM_CP_ALIAS,
++    { .name = "SCR",  .type = ARM_CP_ALIAS | ARM_CP_NEWEL,
+       .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 0,
+       .access = PL1_RW, .accessfn = access_trap_aa32s_el1,
+       .fieldoffset = offsetoflow32(CPUARMState, cp15.scr_el3),
+@@ -11472,6 +11472,18 @@ void HELPER(rebuild_hflags_m32)(CPUARMState *env, int el)
+     env->hflags = rebuild_hflags_m32(env, fp_el, mmu_idx);
+ }
+ 
++/*
++ * If we have triggered a EL state change we can't rely on the
++ * translator having passed it too us, we need to recompute.
++ */
++void HELPER(rebuild_hflags_a32_newel)(CPUARMState *env)
++{
++    int el = arm_current_el(env);
++    int fp_el = fp_exception_el(env, el);
++    ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el);
++    env->hflags = rebuild_hflags_a32(env, fp_el, mmu_idx);
++}
++
+ void HELPER(rebuild_hflags_a32)(CPUARMState *env, int el)
+ {
+     int fp_el = fp_exception_el(env, el);
+diff --git a/target/arm/helper.h b/target/arm/helper.h
+index 7ce5169afb..aa3d8cd08f 100644
+--- a/target/arm/helper.h
++++ b/target/arm/helper.h
+@@ -91,6 +91,7 @@ DEF_HELPER_2(get_user_reg, i32, env, i32)
+ DEF_HELPER_3(set_user_reg, void, env, i32, i32)
+ 
+ DEF_HELPER_FLAGS_2(rebuild_hflags_m32, TCG_CALL_NO_RWG, void, env, int)
++DEF_HELPER_FLAGS_1(rebuild_hflags_a32_newel, TCG_CALL_NO_RWG, void, env)
+ DEF_HELPER_FLAGS_2(rebuild_hflags_a32, TCG_CALL_NO_RWG, void, env, int)
+ DEF_HELPER_FLAGS_2(rebuild_hflags_a64, TCG_CALL_NO_RWG, void, env, int)
+ 
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index f162be8434..2b6c1f91bf 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -7083,7 +7083,11 @@ static int disas_coproc_insn(DisasContext *s, uint32_t insn)
+             if (arm_dc_feature(s, ARM_FEATURE_M)) {
+                 gen_helper_rebuild_hflags_m32(cpu_env, tcg_el);
+             } else {
+-                gen_helper_rebuild_hflags_a32(cpu_env, tcg_el);
++                if (ri->type & ARM_CP_NEWEL) {
++                    gen_helper_rebuild_hflags_a32_newel(cpu_env);
++                } else {
++                    gen_helper_rebuild_hflags_a32(cpu_env, tcg_el);
++                }
+             }
+             tcg_temp_free_i32(tcg_el);
+             /*
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-target-i386-kvm-initialize-feature-MSRs-very-early.patch b/debian/patches/stable/lp-1867519-target-i386-kvm-initialize-feature-MSRs-very-early.patch
 new file mode 100644
index 0000000..9316575
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-target-i386-kvm-initialize-feature-MSRs-very-early.patch
@@ -0,0 +1,169 @@
+From 420ae1fc51c99abfd03b1c590f55617edd2a2bed Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <[e-mail]>
+Date: Mon, 20 Jan 2020 19:21:42 +0100
+Subject: [PATCH] target/i386: kvm: initialize feature MSRs very early
+
+Some read-only MSRs affect the behavior of ioctls such as
+KVM_SET_NESTED_STATE.  We can initialize them once and for all
+right after the CPU is realized, since they will never be modified
+by the guest.
+
+Reported-by: Qingua Cheng <[e-mail]>
+Cc: [e-mail]
+Signed-off-by: Paolo Bonzini <[e-mail]>
+Message-Id: <[e-mail]>
+Signed-off-by: Paolo Bonzini <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=420ae1fc51c99abfd03b1c590f55617edd2a2bed
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ target/i386/kvm.c      | 81 +++++++++++++++++++++++++-----------------
+ target/i386/kvm_i386.h |  1 +
+ 2 files changed, 49 insertions(+), 33 deletions(-)
+
+diff --git a/target/i386/kvm.c b/target/i386/kvm.c
+index 7ee3202634..f6dd6b790e 100644
+--- a/target/i386/kvm.c
++++ b/target/i386/kvm.c
+@@ -67,6 +67,8 @@
+  * 255 kvm_msr_entry structs */
+ #define MSR_BUF_SIZE 4096
+ 
++static void kvm_init_msrs(X86CPU *cpu);
++
+ const KVMCapabilityInfo kvm_arch_required_capabilities[] = {
+     KVM_CAP_INFO(SET_TSS_ADDR),
+     KVM_CAP_INFO(EXT_CPUID),
+@@ -1842,6 +1844,8 @@ int kvm_arch_init_vcpu(CPUState *cs)
+         has_msr_tsc_aux = false;
+     }
+ 
++    kvm_init_msrs(cpu);
++
+     r = hyperv_init_vcpu(cpu);
+     if (r) {
+         goto fail;
+@@ -2660,11 +2664,53 @@ static void kvm_msr_entry_add_vmx(X86CPU *cpu, FeatureWordArray f)
+                       VMCS12_MAX_FIELD_INDEX << 1);
+ }
+ 
++static int kvm_buf_set_msrs(X86CPU *cpu)
++{
++    int ret = kvm_vcpu_ioctl(CPU(cpu), KVM_SET_MSRS, cpu->kvm_msr_buf);
++    if (ret < 0) {
++        return ret;
++    }
++
++    if (ret < cpu->kvm_msr_buf->nmsrs) {
++        struct kvm_msr_entry *e = &cpu->kvm_msr_buf->entries[ret];
++        error_report("error: failed to set MSR 0x%" PRIx32 " to 0x%" PRIx64,
++                     (uint32_t)e->index, (uint64_t)e->data);
++    }
++
++    assert(ret == cpu->kvm_msr_buf->nmsrs);
++    return 0;
++}
++
++static void kvm_init_msrs(X86CPU *cpu)
++{
++    CPUX86State *env = &cpu->env;
++
++    kvm_msr_buf_reset(cpu);
++    if (has_msr_arch_capabs) {
++        kvm_msr_entry_add(cpu, MSR_IA32_ARCH_CAPABILITIES,
++                          env->features[FEAT_ARCH_CAPABILITIES]);
++    }
++
++    if (has_msr_core_capabs) {
++        kvm_msr_entry_add(cpu, MSR_IA32_CORE_CAPABILITY,
++                          env->features[FEAT_CORE_CAPABILITY]);
++    }
++
++    /*
++     * Older kernels do not include VMX MSRs in KVM_GET_MSR_INDEX_LIST, but
++     * all kernels with MSR features should have them.
++     */
++    if (kvm_feature_msrs && cpu_has_vmx(env)) {
++        kvm_msr_entry_add_vmx(cpu, env->features);
++    }
++
++    assert(kvm_buf_set_msrs(cpu) == 0);
++}
++
+ static int kvm_put_msrs(X86CPU *cpu, int level)
+ {
+     CPUX86State *env = &cpu->env;
+     int i;
+-    int ret;
+ 
+     kvm_msr_buf_reset(cpu);
+ 
+@@ -2722,17 +2768,6 @@ static int kvm_put_msrs(X86CPU *cpu, int level)
+     }
+ #endif
+ 
+-    /* If host supports feature MSR, write down. */
+-    if (has_msr_arch_capabs) {
+-        kvm_msr_entry_add(cpu, MSR_IA32_ARCH_CAPABILITIES,
+-                          env->features[FEAT_ARCH_CAPABILITIES]);
+-    }
+-
+-    if (has_msr_core_capabs) {
+-        kvm_msr_entry_add(cpu, MSR_IA32_CORE_CAPABILITY,
+-                          env->features[FEAT_CORE_CAPABILITY]);
+-    }
+-
+     /*
+      * The following MSRs have side effects on the guest or are too heavy
+      * for normal writeback. Limit them to reset or full state updates.
+@@ -2910,14 +2945,6 @@ static int kvm_put_msrs(X86CPU *cpu, int level)
+ 
+         /* Note: MSR_IA32_FEATURE_CONTROL is written separately, see
+          *       kvm_put_msr_feature_control. */
+-
+-        /*
+-         * Older kernels do not include VMX MSRs in KVM_GET_MSR_INDEX_LIST, but
+-         * all kernels with MSR features should have them.
+-         */
+-        if (kvm_feature_msrs && cpu_has_vmx(env)) {
+-            kvm_msr_entry_add_vmx(cpu, env->features);
+-        }
+     }
+ 
+     if (env->mcg_cap) {
+@@ -2933,19 +2960,7 @@ static int kvm_put_msrs(X86CPU *cpu, int level)
+         }
+     }
+ 
+-    ret = kvm_vcpu_ioctl(CPU(cpu), KVM_SET_MSRS, cpu->kvm_msr_buf);
+-    if (ret < 0) {
+-        return ret;
+-    }
+-
+-    if (ret < cpu->kvm_msr_buf->nmsrs) {
+-        struct kvm_msr_entry *e = &cpu->kvm_msr_buf->entries[ret];
+-        error_report("error: failed to set MSR 0x%" PRIx32 " to 0x%" PRIx64,
+-                     (uint32_t)e->index, (uint64_t)e->data);
+-    }
+-
+-    assert(ret == cpu->kvm_msr_buf->nmsrs);
+-    return 0;
++    return kvm_buf_set_msrs(cpu);
+ }
+ 
+ 
+diff --git a/target/i386/kvm_i386.h b/target/i386/kvm_i386.h
+index 7d0242f5fb..00bde7acaf 100644
+--- a/target/i386/kvm_i386.h
++++ b/target/i386/kvm_i386.h
+@@ -46,4 +46,5 @@ bool kvm_enable_x2apic(void);
+ bool kvm_has_x2apic_api(void);
+ 
+ bool kvm_hv_vpindex_settable(void);
++
+ #endif
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-tcg-save-vaddr-temp-for-plugin-usage.patch b/debian/patches/stable/lp-1867519-tcg-save-vaddr-temp-for-plugin-usage.patch
 new file mode 100644
index 0000000..5d0bbf2
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-tcg-save-vaddr-temp-for-plugin-usage.patch
@@ -0,0 +1,98 @@
+From fcc54ab5c7ca84ae72e8bf3781c33c9193a911aa Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <[e-mail]>
+Date: Tue, 25 Feb 2020 17:49:08 +0000
+Subject: [PATCH] tcg: save vaddr temp for plugin usage
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+While do_gen_mem_cb does copy (via extu_tl_i64) vaddr into a new temp
+this won't help if the vaddr temp gets clobbered by the actual
+load/store op. To avoid this clobbering we explicitly copy vaddr
+before the op to ensure it is live my the time we do the
+instrumentation.
+
+Suggested-by: Richard Henderson <[e-mail]>
+Signed-off-by: Alex Bennée <[e-mail]>
+Reviewed-by: Richard Henderson <[e-mail]>
+Reviewed-by: Emilio G. Cota <[e-mail]>
+Cc: [e-mail]
+Message-Id: <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=fcc54ab5c7ca84ae72e8bf3781c33c9193a911aa
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ tcg/tcg-op.c | 23 ++++++++++++++++++++---
+ 1 file changed, 20 insertions(+), 3 deletions(-)
+
+diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
+index 7d782002e3..e2e25ebf7d 100644
+--- a/tcg/tcg-op.c
++++ b/tcg/tcg-op.c
+@@ -2794,13 +2794,26 @@ static void tcg_gen_req_mo(TCGBar type)
+     }
+ }
+ 
++static inline TCGv plugin_prep_mem_callbacks(TCGv vaddr)
++{
++#ifdef CONFIG_PLUGIN
++    if (tcg_ctx->plugin_insn != NULL) {
++        /* Save a copy of the vaddr for use after a load.  */
++        TCGv temp = tcg_temp_new();
++        tcg_gen_mov_tl(temp, vaddr);
++        return temp;
++    }
++#endif
++    return vaddr;
++}
++
+ static inline void plugin_gen_mem_callbacks(TCGv vaddr, uint16_t info)
+ {
+ #ifdef CONFIG_PLUGIN
+-    if (tcg_ctx->plugin_insn == NULL) {
+-        return;
++    if (tcg_ctx->plugin_insn != NULL) {
++        plugin_gen_empty_mem_callback(vaddr, info);
++        tcg_temp_free(vaddr);
+     }
+-    plugin_gen_empty_mem_callback(vaddr, info);
+ #endif
+ }
+ 
+@@ -2822,6 +2835,7 @@ void tcg_gen_qemu_ld_i32(TCGv_i32 val, TCGv addr, TCGArg idx, MemOp memop)
+         }
+     }
+ 
++    addr = plugin_prep_mem_callbacks(addr);
+     gen_ldst_i32(INDEX_op_qemu_ld_i32, val, addr, memop, idx);
+     plugin_gen_mem_callbacks(addr, info);
+ 
+@@ -2868,6 +2882,7 @@ void tcg_gen_qemu_st_i32(TCGv_i32 val, TCGv addr, TCGArg idx, MemOp memop)
+         memop &= ~MO_BSWAP;
+     }
+ 
++    addr = plugin_prep_mem_callbacks(addr);
+     gen_ldst_i32(INDEX_op_qemu_st_i32, val, addr, memop, idx);
+     plugin_gen_mem_callbacks(addr, info);
+ 
+@@ -2905,6 +2920,7 @@ void tcg_gen_qemu_ld_i64(TCGv_i64 val, TCGv addr, TCGArg idx, MemOp memop)
+         }
+     }
+ 
++    addr = plugin_prep_mem_callbacks(addr);
+     gen_ldst_i64(INDEX_op_qemu_ld_i64, val, addr, memop, idx);
+     plugin_gen_mem_callbacks(addr, info);
+ 
+@@ -2967,6 +2983,7 @@ void tcg_gen_qemu_st_i64(TCGv_i64 val, TCGv addr, TCGArg idx, MemOp memop)
+         memop &= ~MO_BSWAP;
+     }
+ 
++    addr = plugin_prep_mem_callbacks(addr);
+     gen_ldst_i64(INDEX_op_qemu_st_i64, val, addr, memop, idx);
+     plugin_gen_mem_callbacks(addr, info);
+ 
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-tpm-ppi-page-align-PPI-RAM.patch b/debian/patches/stable/lp-1867519-tpm-ppi-page-align-PPI-RAM.patch
 new file mode 100644
index 0000000..209bd3e
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-tpm-ppi-page-align-PPI-RAM.patch
@@ -0,0 +1,47 @@
+From 71e415c8a75c130875f14d6b2136825789feb297 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <[e-mail]>
+Date: Fri, 3 Jan 2020 11:39:59 +0400
+Subject: [PATCH] tpm-ppi: page-align PPI RAM
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+post-copy migration fails on destination with error such as:
[phone]T10:22:44.714644Z qemu-kvm: ram_block_discard_range:
+Unaligned start address: 0x559d2afae9a0
+
+Use qemu_memalign() to constrain the PPI RAM memory alignment.
+
+Cc: [e-mail]
+Signed-off-by: Marc-André Lureau <[e-mail]>
+Reviewed-by: Philippe Mathieu-Daudé <[e-mail]>
+Reviewed-by: Dr. David Alan Gilbert <[e-mail]>
+Reviewed-by: Stefan Berger <[e-mail]>
+Signed-off-by: Stefan Berger <[e-mail]>
+Message-id: [e-mail]
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=71e415c8a75c130875f14d6b2136825789feb297
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ hw/tpm/tpm_ppi.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/hw/tpm/tpm_ppi.c b/hw/tpm/tpm_ppi.c
+index ff314592b4..6d9c1a3e40 100644
+--- a/hw/tpm/tpm_ppi.c
++++ b/hw/tpm/tpm_ppi.c
+@@ -43,7 +43,8 @@ void tpm_ppi_reset(TPMPPI *tpmppi)
+ void tpm_ppi_init(TPMPPI *tpmppi, struct MemoryRegion *m,
+                   hwaddr addr, Object *obj)
+ {
+-    tpmppi->buf = g_malloc0(HOST_PAGE_ALIGN(TPM_PPI_ADDR_SIZE));
++    tpmppi->buf = qemu_memalign(qemu_real_host_page_size,
++                                HOST_PAGE_ALIGN(TPM_PPI_ADDR_SIZE));
+     memory_region_init_ram_device_ptr(&tpmppi->ram, obj, "tpm-ppi",
+                                       TPM_PPI_ADDR_SIZE, tpmppi->buf);
+     vmstate_register_ram(&tpmppi->ram, DEVICE(obj));
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-vfio-pci-Don-t-remove-irqchip-notifier-if-not-regist.patch b/debian/patches/stable/lp-1867519-vfio-pci-Don-t-remove-irqchip-notifier-if-not-regist.patch
 new file mode 100644
index 0000000..f52b1bd
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-vfio-pci-Don-t-remove-irqchip-notifier-if-not-regist.patch
@@ -0,0 +1,50 @@
+From 0446f8121723b134ca1d1ed0b73e96d4a0a8689d Mon Sep 17 00:00:00 2001
+From: Peter Xu <[e-mail]>
+Date: Mon, 6 Jan 2020 13:34:45 -0700
+Subject: [PATCH] vfio/pci: Don't remove irqchip notifier if not registered
+
+The kvm irqchip notifier is only registered if the device supports
+INTx, however it's unconditionally removed.  If the assigned device
+does not support INTx, this will cause QEMU to crash when unplugging
+the device from the system.  Change it to conditionally remove the
+notifier only if the notify hook is setup.
+
+CC: Eduardo Habkost <[e-mail]>
+CC: David Gibson <[e-mail]>
+CC: Alex Williamson <[e-mail]>
+Cc: [e-mail] # v4.2
+Reported-by: [e-mail]
+Debugged-by: Eduardo Habkost <[e-mail]>
+Fixes: c5478fea27ac ("vfio/pci: Respond to KVM irqchip change notifier")
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1782678
+Signed-off-by: Peter Xu <[e-mail]>
+Reviewed-by: David Gibson <[e-mail]>
+Reviewed-by: Greg Kurz <[e-mail]>
+Signed-off-by: Alex Williamson <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=0446f8121723b134ca1d1ed0b73e96d4a0a8689d
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ hw/vfio/pci.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
+index 2d40b396f2..337a173ce7 100644
+--- a/hw/vfio/pci.c
++++ b/hw/vfio/pci.c
+@@ -3076,7 +3076,9 @@ static void vfio_exitfn(PCIDevice *pdev)
+     vfio_unregister_req_notifier(vdev);
+     vfio_unregister_err_notifier(vdev);
+     pci_device_set_intx_routing_notifier(&vdev->pdev, NULL);
+-    kvm_irqchip_remove_change_notifier(&vdev->irqchip_change_notifier);
++    if (vdev->irqchip_change_notifier.notify) {
++        kvm_irqchip_remove_change_notifier(&vdev->irqchip_change_notifier);
++    }
+     vfio_disable_interrupts(vdev);
+     if (vdev->intx.mmap_timer) {
+         timer_free(vdev->intx.mmap_timer);
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-virtio-gracefully-handle-invalid-region-caches.patch b/debian/patches/stable/lp-1867519-virtio-gracefully-handle-invalid-region-caches.patch
 new file mode 100644
index 0000000..177cafe
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-virtio-gracefully-handle-invalid-region-caches.patch
@@ -0,0 +1,331 @@
+From abdd16f4681cc4d6bf84990227b5c9b98e869ccd Mon Sep 17 00:00:00 2001
+From: Stefan Hajnoczi <[e-mail]>
+Date: Fri, 7 Feb 2020 10:46:19 +0000
+Subject: [PATCH] virtio: gracefully handle invalid region caches
+
+The virtqueue code sets up MemoryRegionCaches to access the virtqueue
+guest RAM data structures.  The code currently assumes that
+VRingMemoryRegionCaches is initialized before device emulation code
+accesses the virtqueue.  An assertion will fail in
+vring_get_region_caches() when this is not true.  Device fuzzing found a
+case where this assumption is false (see below).
+
+Virtqueue guest RAM addresses can also be changed from a vCPU thread
+while an IOThread is accessing the virtqueue.  This breaks the same
+assumption but this time the caches could become invalid partway through
+the virtqueue code.  The code fetches the caches RCU pointer multiple
+times so we will need to validate the pointer every time it is fetched.
+
+Add checks each time we call vring_get_region_caches() and treat invalid
+caches as a nop: memory stores are ignored and memory reads return 0.
+
+The fuzz test failure is as follows:
+
+  $ qemu -M pc -device virtio-blk-pci,id=drv0,drive=drive0,addr=4.0 \
+         -drive if=none,id=drive0,file=null-co://,format=raw,auto-read-only=off \
+         -drive if=none,id=drive1,file=null-co://,file.read-zeroes=on,format=raw \
+         -display none \
+         -qtest stdio
+  endianness
+  outl 0xcf8 0x80002020
+  outl 0xcfc 0xe0000000
+  outl 0xcf8 0x80002004
+  outw 0xcfc 0x7
+  write 0xe0000000 0x24 0x00ffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffab5cffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffab0000000001
+  inb 0x4
+  writew 0xe000001c 0x1
+  write 0xe0000014 0x1 0x0d
+
+The following error message is produced:
+
+  qemu-system-x86_64: /home/stefanha/qemu/hw/virtio/virtio.c:286: vring_get_region_caches: Assertion `caches != NULL' failed.
+
+The backtrace looks like this:
+
+  #0  0x00007ffff5520625 in raise () at /lib64/libc.so.6
+  #1  0x00007ffff55098d9 in abort () at /lib64/libc.so.6
+  #2  0x00007ffff55097a9 in _nl_load_domain.cold () at /lib64/libc.so.6
+  #3  0x00007ffff5518a66 in annobin_assert.c_end () at /lib64/libc.so.6
+  #4  0x00005555559073da in vring_get_region_caches (vq=<optimized out>) at qemu/hw/virtio/virtio.c:286
+  #5  vring_get_region_caches (vq=<optimized out>) at qemu/hw/virtio/virtio.c:283
+  #6  0x000055555590818d in vring_used_flags_set_bit (mask=1, vq=0x5555575ceea0) at qemu/hw/virtio/virtio.c:398
+  #7  virtio_queue_split_set_notification (enable=0, vq=0x5555575ceea0) at qemu/hw/virtio/virtio.c:398
+  #8  virtio_queue_set_notification (vq=vq@entry=0x5555575ceea0, enable=enable@entry=0) at qemu/hw/virtio/virtio.c:451
+  #9  0x0000555555908512 in virtio_queue_set_notification (vq=vq@entry=0x5555575ceea0, enable=enable@entry=0) at qemu/hw/virtio/virtio.c:444
+  #10 0x00005555558c697a in virtio_blk_handle_vq (s=0x5555575c57e0, vq=0x5555575ceea0) at qemu/hw/block/virtio-blk.c:775
+  #11 0x0000555555907836 in virtio_queue_notify_aio_vq (vq=0x5555575ceea0) at qemu/hw/virtio/virtio.c:2244
+  #12 0x0000555555cb5dd7 in aio_dispatch_handlers (ctx=ctx@entry=0x55555671a420) at util/aio-posix.c:429
+  #13 0x0000555555cb67a8 in aio_dispatch (ctx=0x55555671a420) at util/aio-posix.c:460
+  #14 0x0000555555cb307e in aio_ctx_dispatch (source=<optimized out>, callback=<optimized out>, user_data=<optimized out>) at util/async.c:260
+  #15 0x00007ffff7bbc510 in g_main_context_dispatch () at /lib64/libglib-2.0.so.0
+  #16 0x0000555555cb5848 in glib_pollfds_poll () at util/main-loop.c:219
+  #17 os_host_main_loop_wait (timeout=<optimized out>) at util/main-loop.c:242
+  #18 main_loop_wait (nonblocking=<optimized out>) at util/main-loop.c:518
+  #19 0x00005555559b20c9 in main_loop () at vl.c:1683
+  #20 0x0000555555838115 in main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at vl.c:4441
+
+Reported-by: Alexander Bulekov <[e-mail]>
+Cc: Michael Tsirkin <[e-mail]>
+Cc: Cornelia Huck <[e-mail]>
+Cc: Paolo Bonzini <[e-mail]>
+Cc: [e-mail]
+Signed-off-by: Stefan Hajnoczi <[e-mail]>
+Message-Id: <[e-mail]>
+Reviewed-by: Michael S. Tsirkin <[e-mail]>
+Signed-off-by: Michael S. Tsirkin <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=abdd16f4681cc4d6bf84990227b5c9b98e869ccd
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ hw/virtio/virtio.c | 99 ++++++++++++++++++++++++++++++++++++++++++----
+ 1 file changed, 91 insertions(+), 8 deletions(-)
+
+diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
+index 2c5410e981..00d444699d 100644
+--- a/hw/virtio/virtio.c
++++ b/hw/virtio/virtio.c
+@@ -282,15 +282,19 @@ static void vring_packed_flags_write(VirtIODevice *vdev,
+ /* Called within rcu_read_lock().  */
+ static VRingMemoryRegionCaches *vring_get_region_caches(struct VirtQueue *vq)
+ {
+-    VRingMemoryRegionCaches *caches = atomic_rcu_read(&vq->vring.caches);
+-    assert(caches != NULL);
+-    return caches;
++    return atomic_rcu_read(&vq->vring.caches);
+ }
++
+ /* Called within rcu_read_lock().  */
+ static inline uint16_t vring_avail_flags(VirtQueue *vq)
+ {
+     VRingMemoryRegionCaches *caches = vring_get_region_caches(vq);
+     hwaddr pa = offsetof(VRingAvail, flags);
++
++    if (!caches) {
++        return 0;
++    }
++
+     return virtio_lduw_phys_cached(vq->vdev, &caches->avail, pa);
+ }
+ 
+@@ -299,6 +303,11 @@ static inline uint16_t vring_avail_idx(VirtQueue *vq)
+ {
+     VRingMemoryRegionCaches *caches = vring_get_region_caches(vq);
+     hwaddr pa = offsetof(VRingAvail, idx);
++
++    if (!caches) {
++        return 0;
++    }
++
+     vq->shadow_avail_idx = virtio_lduw_phys_cached(vq->vdev, &caches->avail, pa);
+     return vq->shadow_avail_idx;
+ }
+@@ -308,6 +317,11 @@ static inline uint16_t vring_avail_ring(VirtQueue *vq, int i)
+ {
+     VRingMemoryRegionCaches *caches = vring_get_region_caches(vq);
+     hwaddr pa = offsetof(VRingAvail, ring[i]);
++
++    if (!caches) {
++        return 0;
++    }
++
+     return virtio_lduw_phys_cached(vq->vdev, &caches->avail, pa);
+ }
+ 
+@@ -323,6 +337,11 @@ static inline void vring_used_write(VirtQueue *vq, VRingUsedElem *uelem,
+ {
+     VRingMemoryRegionCaches *caches = vring_get_region_caches(vq);
+     hwaddr pa = offsetof(VRingUsed, ring[i]);
++
++    if (!caches) {
++        return;
++    }
++
+     virtio_tswap32s(vq->vdev, &uelem->id);
+     virtio_tswap32s(vq->vdev, &uelem->len);
+     address_space_write_cached(&caches->used, pa, uelem, sizeof(VRingUsedElem));
+@@ -334,6 +353,11 @@ static uint16_t vring_used_idx(VirtQueue *vq)
+ {
+     VRingMemoryRegionCaches *caches = vring_get_region_caches(vq);
+     hwaddr pa = offsetof(VRingUsed, idx);
++
++    if (!caches) {
++        return 0;
++    }
++
+     return virtio_lduw_phys_cached(vq->vdev, &caches->used, pa);
+ }
+ 
+@@ -342,8 +366,12 @@ static inline void vring_used_idx_set(VirtQueue *vq, uint16_t val)
+ {
+     VRingMemoryRegionCaches *caches = vring_get_region_caches(vq);
+     hwaddr pa = offsetof(VRingUsed, idx);
+-    virtio_stw_phys_cached(vq->vdev, &caches->used, pa, val);
+-    address_space_cache_invalidate(&caches->used, pa, sizeof(val));
++
++    if (caches) {
++        virtio_stw_phys_cached(vq->vdev, &caches->used, pa, val);
++        address_space_cache_invalidate(&caches->used, pa, sizeof(val));
++    }
++
+     vq->used_idx = val;
+ }
+ 
+@@ -353,8 +381,13 @@ static inline void vring_used_flags_set_bit(VirtQueue *vq, int mask)
+     VRingMemoryRegionCaches *caches = vring_get_region_caches(vq);
+     VirtIODevice *vdev = vq->vdev;
+     hwaddr pa = offsetof(VRingUsed, flags);
+-    uint16_t flags = virtio_lduw_phys_cached(vq->vdev, &caches->used, pa);
++    uint16_t flags;
+ 
++    if (!caches) {
++        return;
++    }
++
++    flags = virtio_lduw_phys_cached(vq->vdev, &caches->used, pa);
+     virtio_stw_phys_cached(vdev, &caches->used, pa, flags | mask);
+     address_space_cache_invalidate(&caches->used, pa, sizeof(flags));
+ }
+@@ -365,8 +398,13 @@ static inline void vring_used_flags_unset_bit(VirtQueue *vq, int mask)
+     VRingMemoryRegionCaches *caches = vring_get_region_caches(vq);
+     VirtIODevice *vdev = vq->vdev;
+     hwaddr pa = offsetof(VRingUsed, flags);
+-    uint16_t flags = virtio_lduw_phys_cached(vq->vdev, &caches->used, pa);
++    uint16_t flags;
+ 
++    if (!caches) {
++        return;
++    }
++
++    flags = virtio_lduw_phys_cached(vq->vdev, &caches->used, pa);
+     virtio_stw_phys_cached(vdev, &caches->used, pa, flags & ~mask);
+     address_space_cache_invalidate(&caches->used, pa, sizeof(flags));
+ }
+@@ -381,6 +419,10 @@ static inline void vring_set_avail_event(VirtQueue *vq, uint16_t val)
+     }
+ 
+     caches = vring_get_region_caches(vq);
++    if (!caches) {
++        return;
++    }
++
+     pa = offsetof(VRingUsed, ring[vq->vring.num]);
+     virtio_stw_phys_cached(vq->vdev, &caches->used, pa, val);
+     address_space_cache_invalidate(&caches->used, pa, sizeof(val));
+@@ -410,7 +452,11 @@ static void virtio_queue_packed_set_notification(VirtQueue *vq, int enable)
+     VRingMemoryRegionCaches *caches;
+ 
+     RCU_READ_LOCK_GUARD();
+-    caches  = vring_get_region_caches(vq);
++    caches = vring_get_region_caches(vq);
++    if (!caches) {
++        return;
++    }
++
+     vring_packed_event_read(vq->vdev, &caches->used, &e);
+ 
+     if (!enable) {
+@@ -597,6 +643,10 @@ static int virtio_queue_packed_empty_rcu(VirtQueue *vq)
+     }
+ 
+     cache = vring_get_region_caches(vq);
++    if (!cache) {
++        return 1;
++    }
++
+     vring_packed_desc_read_flags(vq->vdev, &desc.flags, &cache->desc,
+                                  vq->last_avail_idx);
+ 
+@@ -777,6 +827,10 @@ static void virtqueue_packed_fill_desc(VirtQueue *vq,
+     }
+ 
+     caches = vring_get_region_caches(vq);
++    if (!caches) {
++        return;
++    }
++
+     vring_packed_desc_write(vq->vdev, &desc, &caches->desc, head, strict_order);
+ }
+ 
+@@ -949,6 +1003,10 @@ static void virtqueue_split_get_avail_bytes(VirtQueue *vq,
+ 
+     max = vq->vring.num;
+     caches = vring_get_region_caches(vq);
++    if (!caches) {
++        goto err;
++    }
++
+     while ((rc = virtqueue_num_heads(vq, idx)) > 0) {
+         MemoryRegionCache *desc_cache = &caches->desc;
+         unsigned int num_bufs;
+@@ -1089,6 +1147,9 @@ static void virtqueue_packed_get_avail_bytes(VirtQueue *vq,
+ 
+     max = vq->vring.num;
+     caches = vring_get_region_caches(vq);
++    if (!caches) {
++        goto err;
++    }
+ 
+     for (;;) {
+         unsigned int num_bufs = total_bufs;
+@@ -1194,6 +1255,10 @@ void virtqueue_get_avail_bytes(VirtQueue *vq, unsigned int *in_bytes,
+     }
+ 
+     caches = vring_get_region_caches(vq);
++    if (!caches) {
++        goto err;
++    }
++
+     desc_size = virtio_vdev_has_feature(vq->vdev, VIRTIO_F_RING_PACKED) ?
+                                 sizeof(VRingPackedDesc) : sizeof(VRingDesc);
+     if (caches->desc.len < vq->vring.num * desc_size) {
+@@ -1387,6 +1452,11 @@ static void *virtqueue_split_pop(VirtQueue *vq, size_t sz)
+     i = head;
+ 
+     caches = vring_get_region_caches(vq);
++    if (!caches) {
++        virtio_error(vdev, "Region caches not initialized");
++        goto done;
++    }
++
+     if (caches->desc.len < max * sizeof(VRingDesc)) {
+         virtio_error(vdev, "Cannot map descriptor ring");
+         goto done;
+@@ -1509,6 +1579,11 @@ static void *virtqueue_packed_pop(VirtQueue *vq, size_t sz)
+     i = vq->last_avail_idx;
+ 
+     caches = vring_get_region_caches(vq);
++    if (!caches) {
++        virtio_error(vdev, "Region caches not initialized");
++        goto done;
++    }
++
+     if (caches->desc.len < max * sizeof(VRingDesc)) {
+         virtio_error(vdev, "Cannot map descriptor ring");
+         goto done;
+@@ -1628,6 +1703,10 @@ static unsigned int virtqueue_packed_drop_all(VirtQueue *vq)
+     VRingPackedDesc desc;
+ 
+     caches = vring_get_region_caches(vq);
++    if (!caches) {
++        return 0;
++    }
++
+     desc_cache = &caches->desc;
+ 
+     virtio_queue_set_notification(vq, 0);
+@@ -2412,6 +2491,10 @@ static bool virtio_packed_should_notify(VirtIODevice *vdev, VirtQueue *vq)
+     VRingMemoryRegionCaches *caches;
+ 
+     caches = vring_get_region_caches(vq);
++    if (!caches) {
++        return false;
++    }
++
+     vring_packed_event_read(vdev, &caches->avail, &e);
+ 
+     old = vq->signalled_used;
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-virtio-mmio-update-queue-size-on-guest-write.patch b/debian/patches/stable/lp-1867519-virtio-mmio-update-queue-size-on-guest-write.patch
 new file mode 100644
index 0000000..d18b0ee
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-virtio-mmio-update-queue-size-on-guest-write.patch
@@ -0,0 +1,40 @@
+From 1049f4c62c4070618cc5defc9963c6a17ae7a5ae Mon Sep 17 00:00:00 2001
+From: Denis Plotnikov <[e-mail]>
+Date: Tue, 24 Dec 2019 11:14:46 +0300
+Subject: [PATCH] virtio-mmio: update queue size on guest write
+
+Some guests read back queue size after writing it.
+Always update the on size write otherwise they might be confused.
+
+Cc: [e-mail]
+Signed-off-by: Denis Plotnikov <[e-mail]>
+Message-Id: <[e-mail]>
+Reviewed-by: Michael S. Tsirkin <[e-mail]>
+Signed-off-by: Michael S. Tsirkin <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=1049f4c62c4070618cc5defc9963c6a17ae7a5ae
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ hw/virtio/virtio-mmio.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/hw/virtio/virtio-mmio.c b/hw/virtio/virtio-mmio.c
+index ef40b7a9b2..872f2cd237 100644
+--- a/hw/virtio/virtio-mmio.c
++++ b/hw/virtio/virtio-mmio.c
+@@ -308,8 +308,9 @@ static void virtio_mmio_write(void *opaque, hwaddr offset, uint64_t value,
+         break;
+     case VIRTIO_MMIO_QUEUE_NUM:
+         trace_virtio_mmio_queue_write(value, VIRTQUEUE_MAX_SIZE);
++        virtio_queue_set_num(vdev, vdev->queue_sel, value);
++
+         if (proxy->legacy) {
+-            virtio_queue_set_num(vdev, vdev->queue_sel, value);
+             virtio_queue_update_rings(vdev, vdev->queue_sel);
+         } else {
+             proxy->vqs[vdev->queue_sel].num = value;
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-virtio-net-delete-also-control-queue-when-TX-RX-dele.patch b/debian/patches/stable/lp-1867519-virtio-net-delete-also-control-queue-when-TX-RX-dele.patch
 new file mode 100644
index 0000000..1db89ff
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-virtio-net-delete-also-control-queue-when-TX-RX-dele.patch
@@ -0,0 +1,41 @@
+From d945d9f1731244ef341f74ede93120fc9de35913 Mon Sep 17 00:00:00 2001
+From: Yuri Benditovich <[e-mail]>
+Date: Thu, 26 Dec 2019 06:36:49 +0200
+Subject: [PATCH] virtio-net: delete also control queue when TX/RX deleted
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1708480
+If the control queue is not deleted together with TX/RX, it
+later will be ignored in freeing cache resources and hot
+unplug will not be completed.
+
+Cc: [e-mail]
+Signed-off-by: Yuri Benditovich <[e-mail]>
+Message-Id: <[e-mail]>
+Reviewed-by: Michael S. Tsirkin <[e-mail]>
+Signed-off-by: Michael S. Tsirkin <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=d945d9f1731244ef341f74ede93120fc9de35913
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ hw/net/virtio-net.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
+index db3d7c38e6..f325440d01 100644
+--- a/hw/net/virtio-net.c
++++ b/hw/net/virtio-net.c
+@@ -3101,7 +3101,8 @@ static void virtio_net_device_unrealize(DeviceState *dev, Error **errp)
+     for (i = 0; i < max_queues; i++) {
+         virtio_net_del_queue(n, i);
+     }
+-
++    /* delete also control vq */
++    virtio_del_queue(vdev, max_queues * 2);
+     qemu_announce_timer_del(&n->announce_timer, false);
+     g_free(n->vqs);
+     qemu_del_nic(n->nic);
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-virtio-update-queue-size-on-guest-write.patch b/debian/patches/stable/lp-1867519-virtio-update-queue-size-on-guest-write.patch
 new file mode 100644
index 0000000..da81c2c
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-virtio-update-queue-size-on-guest-write.patch
@@ -0,0 +1,40 @@
+From d0c5f643383b9e84316f148affff368ac33d75b9 Mon Sep 17 00:00:00 2001
+From: "Michael S. Tsirkin" <[e-mail]>
+Date: Fri, 13 Dec 2019 09:22:48 -0500
+Subject: [PATCH] virtio: update queue size on guest write
+
+Some guests read back queue size after writing it.
+Update the size immediatly upon write otherwise
+they get confused.
+
+In particular this is the case for seabios.
+
+Reported-by: Roman Kagan <[e-mail]>
+Suggested-by: Denis Plotnikov <[e-mail]>
+Cc: [e-mail]
+Signed-off-by: Michael S. Tsirkin <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=d0c5f643383b9e84316f148affff368ac33d75b9
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ hw/virtio/virtio-pci.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
+index c6b47a9c73..e5c759e19e 100644
+--- a/hw/virtio/virtio-pci.c
++++ b/hw/virtio/virtio-pci.c
+@@ -1256,6 +1256,8 @@ static void virtio_pci_common_write(void *opaque, hwaddr addr,
+         break;
+     case VIRTIO_PCI_COMMON_Q_SIZE:
+         proxy->vqs[vdev->queue_sel].num = val;
++        virtio_queue_set_num(vdev, vdev->queue_sel,
++                             proxy->vqs[vdev->queue_sel].num);
+         break;
+     case VIRTIO_PCI_COMMON_Q_MSIX:
+         msix_vector_unuse(&proxy->pci_dev,
+-- 
+2.25.1
+
diff --git a/debian/patches/ubuntu/lp-1847361-modules-load-upgrade.patch b/debian/patches/ubuntu/lp-1847361-modules-load-upgrade.patch
 new file mode 100644
index 0000000..056f2e0
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1847361-modules-load-upgrade.patch
@@ -0,0 +1,125 @@
+From ab7e28b0905b1e2daeb5d582cf0f0ce33ea47317 Mon Sep 17 00:00:00 2001
+From: Christian Ehrhardt <[e-mail]>
+Date: Mon, 2 Mar 2020 15:12:53 +0100
+Subject: [PATCH] modules: load modules from versioned /var/run dir
+
+On upgrades the old .so files usually are replaced. But on the other
+hand since a qemu process represents a guest instance it is usually kept
+around.
+
+That makes late addition of dynamic features e.g. 'hot-attach of a ceph
+disk' fail by trying to load a new version of e.f. block-rbd.so into an
+old still running qemu binary.
+
+This adds a fallback to also load modules from a versioned directory in the
+temporary /var/run path. That way qemu is providing a way for packaging
+to store modules of an upgraded qemu package as needed until the next reboot.
+
+Fixes: https://bugs.launchpad.net/ubuntu/+source/qemu/+bug/1847361
+Signed-off-by: Christian Ehrhardt <[e-mail]>
+
+Forwarded: yes, https://lists.nongnu.org/archive/html/qemu-devel/2020-03/msg01593.html
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1847361
+Last-Update: 2020-03-02
+
+---
+ configure     | 15 +++++++++++++++
+ util/module.c | 14 ++++++++++++++
+ 2 files changed, 29 insertions(+)
+
+--- a/configure
++++ b/configure
+@@ -404,6 +404,7 @@ EXESUF=""
+ DSOSUF=".so"
+ LDFLAGS_SHARED="-shared"
+ modules="no"
++module_upgrades="no"
+ prefix="/usr/local"
+ mandir="\${prefix}/share/man"
+ datadir="\${prefix}/share"
+@@ -995,6 +996,10 @@ for opt do
+   --disable-modules)
+       modules="no"
+   ;;
++  --disable-module-upgrades) module_upgrades="no"
++  ;;
++  --enable-module-upgrades) module_upgrades="yes"
++  ;;
+   --cpu=*)
+   ;;
+   --target-list=*) target_list="$optarg"
+@@ -1735,6 +1740,7 @@ disabled with --disable-FEATURE, default
+   guest-agent-msi build guest agent Windows MSI installation package
+   pie             Position Independent Executables
+   modules         modules support (non-Windows)
++  module-upgrades try to load modules from alternate paths for upgrades
+   debug-tcg       TCG debugging (default is disabled)
+   debug-info      debugging information
+   sparse          sparse checker
+@@ -1995,6 +2001,11 @@ if test "$modules" = "yes" && test "$min
+   error_exit "Modules are not available for Windows"
+ fi
+ 
++# module_upgrades is only reasonable if modules are enabled
++if test "$modules" = "no" && test "$module_upgrades" = "yes" ; then
++  error_exit "Can't enable module-upgrades as Modules are not enabled"
++fi
++
+ # Static linking is not possible with modules or PIE
+ if test "$static" = "yes" ; then
+   if test "$modules" = "yes" ; then
+@@ -6457,6 +6468,7 @@ if test "$slirp" != "no" ; then
+     echo "smbd              $smbd"
+ fi
+ echo "module support    $modules"
++echo "alt path mod load $module_upgrades"
+ echo "host CPU          $cpu"
+ echo "host big endian   $bigendian"
+ echo "target list       $target_list"
+@@ -6814,6 +6826,9 @@ if test "$modules" = "yes"; then
+   echo "CONFIG_STAMP=_$( (echo $qemu_version; echo $pkgversion; cat $0) | $shacmd - | cut -f1 -d\ )" >> $config_host_mak
+   echo "CONFIG_MODULES=y" >> $config_host_mak
+ fi
++if test "$module_upgrades" = "yes"; then
++  echo "CONFIG_MODULE_UPGRADES=y" >> $config_host_mak
++fi
+ if test "$have_x11" = "yes" && test "$need_x11" = "yes"; then
+   echo "CONFIG_X11=y" >> $config_host_mak
+   echo "X11_CFLAGS=$x11_cflags" >> $config_host_mak
+--- a/util/module.c
++++ b/util/module.c
+@@ -19,6 +19,9 @@
+ #endif
+ #include "qemu/queue.h"
+ #include "qemu/module.h"
++#ifdef CONFIG_MODULE_UPGRADES
++#include "qemu-version.h"
++#endif
+ 
+ typedef struct ModuleEntry
+ {
+@@ -163,6 +166,9 @@ bool module_load_one(const char *prefix,
+ #ifdef CONFIG_MODULES
+     char *fname = NULL;
+     char *exec_dir;
++#ifdef CONFIG_MODULE_UPGRADES
++    char *version_dir;
++#endif
+     const char *search_dir;
+     char *dirs[4];
+     char *module_name;
+@@ -194,6 +200,14 @@ bool module_load_one(const char *prefix,
+     dirs[n_dirs++] = g_strdup_printf("%s", CONFIG_QEMU_MODDIR);
+     dirs[n_dirs++] = g_strdup_printf("%s/..", exec_dir ? : "");
+     dirs[n_dirs++] = g_strdup_printf("%s", exec_dir ? : "");
++
++#ifdef CONFIG_MODULE_UPGRADES
++    version_dir = g_strcanon(g_strdup(QEMU_PKGVERSION),
++                             G_CSET_A_2_Z G_CSET_a_2_z G_CSET_DIGITS "+-.~",
++                             '_');
++    dirs[n_dirs++] = g_strdup_printf("/var/run/qemu/%s", version_dir);
++#endif
++
+     assert(n_dirs <= ARRAY_SIZE(dirs));
+ 
+     g_free(exec_dir);
diff --git a/debian/patches/ubuntu/lp-1847361-vhost-correctly-turn-on-VIRTIO_F_IOMMU_PLATFORM.patch b/debian/patches/ubuntu/lp-1847361-vhost-correctly-turn-on-VIRTIO_F_IOMMU_PLATFORM.patch
 new file mode 100644
index 0000000..6ef5d49
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1847361-vhost-correctly-turn-on-VIRTIO_F_IOMMU_PLATFORM.patch
@@ -0,0 +1,61 @@
+From f7ef7e6e3ba6e994e070cc609eb154339d1c4a11 Mon Sep 17 00:00:00 2001
+From: Jason Wang <[e-mail]>
+Date: Mon, 2 Mar 2020 12:24:54 +0800
+Subject: [PATCH] vhost: correctly turn on VIRTIO_F_IOMMU_PLATFORM
+
+We turn on device IOTLB via VIRTIO_F_IOMMU_PLATFORM unconditionally on
+platform without IOMMU support. This can lead unnecessary IOTLB
+transactions which will damage the performance.
+
+Fixing this by check whether the device is backed by IOMMU and disable
+device IOTLB.
+
+Reported-by: Halil Pasic <[e-mail]>
+Tested-by: Halil Pasic <[e-mail]>
+Reviewed-by: Halil Pasic <[e-mail]>
+Signed-off-by: Jason Wang <[e-mail]>
+Message-Id: <[e-mail]>
+Reviewed-by: Michael S. Tsirkin <[e-mail]>
+Signed-off-by: Michael S. Tsirkin <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=f7ef7e6e3ba6e994e070cc609eb154339d1c4a11
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1847361
+Last-Update: 2020-03-13
+
+---
+ hw/virtio/vhost.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
+index 0d226dae10..01ebe12f28 100644
+--- a/hw/virtio/vhost.c
++++ b/hw/virtio/vhost.c
+@@ -290,7 +290,14 @@ static int vhost_dev_has_iommu(struct vhost_dev *dev)
+ {
+     VirtIODevice *vdev = dev->vdev;
+ 
+-    return virtio_host_has_feature(vdev, VIRTIO_F_IOMMU_PLATFORM);
++    /*
++     * For vhost, VIRTIO_F_IOMMU_PLATFORM means the backend support
++     * incremental memory mapping API via IOTLB API. For platform that
++     * does not have IOMMU, there's no need to enable this feature
++     * which may cause unnecessary IOTLB miss/update trnasactions.
++     */
++    return vdev->dma_as != &address_space_memory &&
++           virtio_host_has_feature(vdev, VIRTIO_F_IOMMU_PLATFORM);
+ }
+ 
+ static void *vhost_memory_map(struct vhost_dev *dev, hwaddr addr,
+@@ -765,6 +772,9 @@ static int vhost_dev_set_features(struct vhost_dev *dev,
+     if (enable_log) {
+         features |= 0x1ULL << VHOST_F_LOG_ALL;
+     }
++    if (!vhost_dev_has_iommu(dev)) {
++        features &= ~(0x1ULL << VIRTIO_F_IOMMU_PLATFORM);
++    }
+     r = dev->vhost_ops->vhost_set_features(dev, features);
+     if (r < 0) {
+         VHOST_OPS_DEBUG("vhost_set_features failed");
+-- 
+2.25.1
+
diff --git a/debian/qemu-block-extra.postrm.in b/debian/qemu-block-extra.postrm.in
 new file mode 100644
index 0000000..ef2126a
--- /dev/null
+++ b/debian/qemu-block-extra.postrm.in
@@ -0,0 +1,43 @@
+#!/bin/sh
+# postrm script for brrr
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <postrm> `remove'
+#        * <postrm> `purge'
+#        * <old-postrm> `upgrade' <new-version>
+#        * <new-postrm> `failed-upgrade' <old-version>
+#        * <new-postrm> `abort-install'
+#        * <new-postrm> `abort-install' <old-version>
+#        * <new-postrm> `abort-upgrade' <old-version>
+#        * <disappearer's-postrm> `disappear' <overwriter>
+#          <overwriter-version>
+# for details, see https://www.debian.org/doc/debian-policy/ or
+# the debian-policy package
+
+
+case "$1" in
+    purge|remove)
+        # remove .so files for still running qemu instances in /var/run
+        # for details see bug LP: #1847361
+        rm -f /var/run/qemu/@PKGVERSION@/block-*.so
+    ;;
+
+    upgrade|failed-upgrade|abort-install|abort-upgrade|disappear)
+    ;;
+
+    *)
+        echo "postrm called with unknown argument \`$1'" >&2
+        exit 1
+    ;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
diff --git a/debian/qemu-block-extra.prerm.in b/debian/qemu-block-extra.prerm.in
 new file mode 100644
index 0000000..dee25a8
--- /dev/null
+++ b/debian/qemu-block-extra.prerm.in
@@ -0,0 +1,45 @@
+#!/bin/sh
+# prerm script for qemu-block-extra
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <prerm> `remove'
+#        * <old-prerm> `upgrade' <new-version>
+#        * <new-prerm> `failed-upgrade' <old-version>
+#        * <conflictor's-prerm> `remove' `in-favour' <package> <new-version>
+#        * <deconfigured's-prerm> `deconfigure' `in-favour'
+#          <package-being-installed> <version> `removing'
+#          <conflicting-package> <version>
+# for details, see https://www.debian.org/doc/debian-policy/ or
+# the debian-policy package
+
+
+case "$1" in
+    remove)
+    ;;
+
+    upgrade|deconfigure)
+        # retain .so files for still running qemu instances in /var/run
+        # for details see bug LP: #1847361
+        mkdir -p /var/run/qemu/@PKGVERSION@
+        cp /usr/lib/@ARCH@/qemu/block-*.so /var/run/qemu/@PKGVERSION@/
+    ;;
+
+    failed-upgrade)
+    ;;
+
+    *)
+        echo "prerm called with unknown argument \`$1'" >&2
+        exit 1
+    ;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
diff --git a/debian/qemu-system-gui.postrm.in b/debian/qemu-system-gui.postrm.in
 new file mode 100644
index 0000000..48c740a
--- /dev/null
+++ b/debian/qemu-system-gui.postrm.in
@@ -0,0 +1,44 @@
+#!/bin/sh
+# postrm script for brrr
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <postrm> `remove'
+#        * <postrm> `purge'
+#        * <old-postrm> `upgrade' <new-version>
+#        * <new-postrm> `failed-upgrade' <old-version>
+#        * <new-postrm> `abort-install'
+#        * <new-postrm> `abort-install' <old-version>
+#        * <new-postrm> `abort-upgrade' <old-version>
+#        * <disappearer's-postrm> `disappear' <overwriter>
+#          <overwriter-version>
+# for details, see https://www.debian.org/doc/debian-policy/ or
+# the debian-policy package
+
+
+case "$1" in
+    purge|remove)
+        # remove .so files for still running qemu instances in /var/run
+        # for details see bug LP: #1847361
+        rm -f /var/run/qemu/@PKGVERSION@/ui-gtk.so
+        rm -f /var/run/qemu/@PKGVERSION@/audio-*.so
+    ;;
+
+    upgrade|failed-upgrade|abort-install|abort-upgrade|disappear)
+    ;;
+
+    *)
+        echo "postrm called with unknown argument \`$1'" >&2
+        exit 1
+    ;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
diff --git a/debian/qemu-system-gui.prerm.in b/debian/qemu-system-gui.prerm.in
 new file mode 100644
index 0000000..3624362
--- /dev/null
+++ b/debian/qemu-system-gui.prerm.in
@@ -0,0 +1,46 @@
+#!/bin/sh
+# prerm script for qemu-system-gui
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <prerm> `remove'
+#        * <old-prerm> `upgrade' <new-version>
+#        * <new-prerm> `failed-upgrade' <old-version>
+#        * <conflictor's-prerm> `remove' `in-favour' <package> <new-version>
+#        * <deconfigured's-prerm> `deconfigure' `in-favour'
+#          <package-being-installed> <version> `removing'
+#          <conflicting-package> <version>
+# for details, see https://www.debian.org/doc/debian-policy/ or
+# the debian-policy package
+
+
+case "$1" in
+    remove)
+    ;;
+
+    upgrade|deconfigure)
+        # retain .so files for still running qemu instances in /var/run
+        # for details see bug LP: #1847361
+        mkdir -p /var/run/qemu/@PKGVERSION@
+        cp /usr/lib/@ARCH@/qemu/ui-gtk.so /var/run/qemu/@PKGVERSION@/
+        cp /usr/lib/@ARCH@/qemu/audio-*.so /var/run/qemu/@PKGVERSION@/
+    ;;
+
+    failed-upgrade)
+    ;;
+
+    *)
+        echo "prerm called with unknown argument \`$1'" >&2
+        exit 1
+    ;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
diff --git a/debian/rules b/debian/rules
index 1604d33..58ed6ea 100755
--- a/debian/rules
+++ b/debian/rules
@@ -15,6 +15,9 @@ else
 VENDOR := DEBIAN
 endif
 
+AUTOGENERATED:= qemu-block-extra.prerm qemu-block-extra.postrm qemu-system-gui.prerm qemu-system-gui.postrm
+PKGVERSION := $(shell printf "Debian ${DEB_VERSION}" | tr --complement '[:alnum:]+-.~' '_')
+
 # support parallel build using DEB_BUILD_OPTIONS=parallel=N
 ifneq (,$(filter parallel=%,$(DEB_BUILD_OPTIONS)))
   MAKEFLAGS += -j$(patsubst parallel=%,%,$(filter parallel=%,$(DEB_BUILD_OPTIONS)))
@@ -103,6 +106,12 @@ endif	# enable_linux_user
 b/configure-stamp: configure
 	dh_testdir
 
+	for f in ${AUTOGENERATED} ; do \
+        sed -e 's%@ARCH@%${DEB_HOST_MULTIARCH}%g' \
+	        -e 's%@PKGVERSION@%${PKGVERSION}%g' \
+			< debian/$$f.in  > debian/$$f ; \
+    done
+
 	# system build
 	rm -rf b/qemu; mkdir -p b/qemu
 	cd b/qemu && \
@@ -111,6 +120,7 @@ b/configure-stamp: configure
 		--${enable_linux_user}-linux-user \
 		--disable-xen \
 		--enable-modules \
+		--enable-module-upgrades \
 		$(shell sh debian/extract-config-opts \
 		    $(DEB_HOST_ARCH_OS)-$(DEB_HOST_ARCH) debian/control) \
 		$(QEMU_CONFIGURE_OPTIONS) || \
@@ -137,6 +147,7 @@ ifneq ($(filter $(DEB_HOST_ARCH),amd64 i386),)
 		--enable-xen \
 		--target-list="aarch64-softmmu arm-softmmu i386-softmmu x86_64-softmmu"
 		--enable-modules \
+		--enable-module-upgrades \
 		$(shell sh debian/extract-config-opts \
 		    $(DEB_HOST_ARCH_OS)-$(DEB_HOST_ARCH) debian/control) \
 		$(QEMU_CONFIGURE_OPTIONS) || \
@@ -489,6 +500,7 @@ clean:	debian/control
 	rm -rf b
 	find scripts/ -name '*.pyc' -delete || :
 	rm -f debian/qemu-user.1
+	rm -f $(patsubst %, debian/%, ${AUTOGENERATED})
 	dh_clean
 
 .PHONY: build clean binary-arch binary-indep binary build-arch build-indep build