Merge ~paelzer/ubuntu/+source/qemu:lp-1835546-s390x-protvirt-final into ubuntu/+source/qemu:ubuntu/focal-devel

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

Notes:
- qemu recently has import issues, so ignore the LP diff - check out the branch itself and compare things changes since the last version there
- once upstream accepted I'll update the origin links, until then it is already pointing to a git that reflects the changes as backported by IBM

FFE still ongoing in bug 1866866

PPA: https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/3985/+packages
Bug: 1835546

[Rafael David Tinoco (rafaeldtinoco)]

I'll review this one.

947abf0... by Christian Ehrhardt  on 2020-03-24

d/p/ubuntu/expose-vmx_qemu64cpu.patch: Stop adding VMX to qemu64 to avoid broken nesting (LP: #1868692)

Signed-off-by: Christian Ehrhardt <email address hidden>

8173c35... by Christian Ehrhardt  on 2020-03-24

changelog: Stop adding VMX to qemu64 to avoid broken nesting (LP: #1868692)

Signed-off-by: Christian Ehrhardt <email address hidden>

[Christian Ehrhardt  (paelzer)]

Added a fix for bug 1868692 to the MP

[Rafael David Tinoco (rafaeldtinoco)]

TL;DR => Jump to my last commits for conclusions.

1:1 mapping with IBM repo:

 patches/ubuntu/expose-vmx_qemu64cpu.patch - ok
        upstream - 0723cc8a5558c94388db75ae1f4991314914edd3 target/i386: add VMX features to named CPU models

 patches/ubuntu/lp-1835546-Sync-pv.patch
        ibm - 5081c651c9e12d519597fc2ee6e6162e52051122 Sync pv

 patches/ubuntu/lp-1835546-pc-bios-s390x-Save-iplb-location-in-lowcore.patch
        ibm - 6c657fba3b138ad43b72e54a3c43a87e170ce615 pc-bios: s390x: Save iplb location in lowcore

 patches/ubuntu/lp-1835546-s390x-Add-SIDA-memory-ops.patch
        ibm - 7d1c3eddae6fa68ba72d869adf4c37ff0b4bf031 s390x: Add SIDA memory ops

 patches/ubuntu/lp-1835546-s390x-Add-missing-vcpu-reset-functions.patch
        ibm - cdb7c92623442b8a4052011d20ac46dbc17ab064 s390x: Add missing vcpu reset functions

 patches/ubuntu/lp-1835546-s390x-Add-unpack-facility-feature-to-GA1.patch
        6ddcd74b5c6158c0a389f8588616884518d86f2c (borntraeger/pv42_v12) s390x: Add unpack facility feature to GA1

 patches/ubuntu/lp-1835546-s390x-Beautify-diag308-handling.patch
        4fb238b4b0ba7ba6d42d5d7e1f3da27e619e872c s390x: Beautify diag308 handling

 patches/ubuntu/lp-1835546-s390x-Don-t-do-a-normal-reset-on-the-initial-cpu.patch
        c300ee105ad5458eb9f8d302e54d8f3cc70963fd s390x: Don't do a normal reset on the initial cpu

 patches/ubuntu/lp-1835546-s390x-Move-clear-reset.patch
        af3f6e479284aa297ad2a85bb3eab305376d138a s390x: Move clear reset

 patches/ubuntu/lp-1835546-s390x-Move-diagnose-308-subcodes-and-rcs-into-ipl.h.patch
        f0869bee7c19767fff70794d64f400bb201e82e3 s390x: Move diagnose 308 subcodes and rcs into ipl.h

 patches/ubuntu/lp-1835546-s390x-Move-initial-reset.patch
        57b68b74dcb355eee7b1543c70a427d26e04700f s390x: Move initial reset

 patches/ubuntu/lp-1835546-s390x-Move-reset-normal-to-shared-reset-handler.patch
        bae87d827e0f158900ef25fb6015fa8d535a6c94 s390x: Move reset normal to shared reset handler

 patches/ubuntu/lp-1835546-s390x-ipl-Consolidate-iplb-validity-check-into-one-f.patch
        2321dddc5f92eea17caed784c960d3c57088fd41 s390x: ipl: Consolidate iplb validity check into one function

 patches/ubuntu/lp-1835546-s390x-kvm-Make-kvm_sclp_service_call-void.patch
        3915257d71c9e64fd4dcd4406996650a7b29baba s390x: kvm: Make kvm_sclp_service_call void

 patches/ubuntu/lp-1835546-s390x-protvirt-Add-migration-blocker.patch
        cdfe6c35aaa15192338c2da88eeaff169070f8ce s390x: protvirt: Add migration blocker

 patches/ubuntu/lp-1835546-s390x-protvirt-Disable-address-checks-for-PV-guest-I.patch
        73e4feac9b6892a441a7564a6ed8a8e3ec4e9277 s390x: protvirt: Disable address checks for PV guest IO emulation

 patches/ubuntu/lp-1835546-s390x-protvirt-Handle-SIGP-store-status-correctly.patch
        7dfa61e878ff1c743f6828898c7012d8e00dfb13 s390x: protvirt: Handle SIGP store status correctly

 patches/ubuntu/lp-1835546-s390x-protvirt-Inhibit-balloon-when-switching-to-pro.patch
        c4f98ebc0d691578fd19ef291b33920bcc27d64e s390x: protvirt: Inhibit balloon when switching to protected mode

 patches/ubuntu/lp-1835546-s390x-protvirt-KVM-intercept-changes.patch
        1b822af8262a06442c6e04dc...

[Rafael David Tinoco (rafaeldtinoco)]

STATUS: +1 (after information on topics 1-4 as they're not blockers)

# checklist for fixes
----------------------------

 [.] changelog entry correct, targeted to correct codename
 [.] update-maintainer has been run previously
 ----
 [x] changes forwarded upstream/debian (if appropriate)
 [.] patches match what was proposed upstream
 ----
 [.] patches correctly included in debian/patches/series?
 [?] patches have correct DEP3 metadata
 ----
 [-] verified dpkg-buildpackage -S and -b
 [-] autopkgtest against PPA or built package passes
 ----
 [-] testcase provided
 [-] was able to reproduce
 [-] fix solved provided testcase

----------------------------
 [.] = ok
 [x] = not ok
 [?] = question
 [!] = note
 [-] = n/a

----------------------------

Observations:

(1)
- For all commits coming from borntraeger/pv42_v12 I would add "Forwarded" flag
and point where each of those were forwarded to. Based on DEP3 guidelines, when
patch is vendor specific DEP3 Forwarded flag becomes obligatory => this will
help me out when reducing the delta.

(2)
- For the same set of commits, I'm afraid the "cherry-picked from commit XXXX",
from both Cornelia and Christian, means nothing to external - to s390x -
repositories and confuses whoever is trying to find origin. Can/Should we just
get rid of those ?

(3)
- What about these patches coming from the same IBM s390 patchset:

3c664ea0a6d4196fbc2912e4c8a4ecd1764ac862 vhost: correctly turn on VIRTIO_F_IOMMU_PLATFORM
ae150759a9de200eb261c06502bc8e3276ff8344 s390/sclp: improve special wait psw logic
9da000ea0ae75fbdf14f6e7dc49ad324ba3fe190 rebuild bios

just checking you saw those and are ignoring them deliberately... is that so ?

(4)
- Your debian/patches/series has, at the end:

...
# LP 1867519 s390x protvirt
lp-1867519-block-nbd-extract-the-common-cleanup-code.patch
ubuntu/lp-1835546-s390x-Don-t-do-a-normal-reset-on-the-initial-cpu.patch
ubuntu/lp-1835546-s390x-Move-reset-normal-to-shared-reset-handler.patch
ubuntu/lp-1835546-s390x-Move-initial-reset.patch
ubuntu/lp-1835546-s390x-Move-clear-reset.patch
...

protvirt feature is being added in LP: #1835546 and FFe is in LP: #1866866. LP:
#1867519 is about seg faults on VFIO detach as it looks like.

Putting things the way I understand:

LP: #1868692 - qemu64 cpu type VMX feature adverstise fix
LP: #1835546 - s390x protvirt feature

and that seems correctly informed in changelog for 1:4.2-3ubuntu4.

It seems you should put line:

lp-1867519-block-nbd-extract-the-common-cleanup-code.patch

in the previous block of patches.

review: Needs Information

[Rafael David Tinoco (rafaeldtinoco)]

After information on previous comment, consider this a +1.

review: Approve

a1641f6... by Christian Ehrhardt  on 2020-03-25

Fixup protvirt patches

Signed-off-by: Christian Ehrhardt <email address hidden>

e86627e... by Christian Ehrhardt  on 2020-03-25

fix stable patch file names for 1867519

Signed-off-by: Christian Ehrhardt <email address hidden>

57d22cf... by Christian Ehrhardt  on 2020-03-25

d/p/ubuntu/lp-1835546-*: backport the s390x protvirt feature (LP: #1835546)

Signed-off-by: Christian Ehrhardt <email address hidden>

[Christian Ehrhardt  (paelzer)]

>
> (1)
> - For all commits coming from borntraeger/pv42_v12 I would add "Forwarded"
> flag
> and point where each of those were forwarded to. Based on DEP3 guidelines,
> when
> patch is vendor specific DEP3 Forwarded flag becomes obligatory => this
> will
> help me out when reducing the delta.
>

Agreed, that will be better - I added this to all of them.
v12 exists only internally atm.
Forwarded:
https://lists.gnu.org/archive/html/qemu-devel/2020-03/msg06247.html

> (2)
> - For the same set of commits, I'm afraid the "cherry-picked from commit
> XXXX",
> from both Cornelia and Christian, means nothing to external - to s390x -
> repositories and confuses whoever is trying to find origin. Can/Should we
> just
> get rid of those ?
>

While the "cherry picked" isn't confusing to mee I can see what you mean,
removed.
The important bit is the Origin tag and in those I have correct entries
already in all headers, like

 Origin: backport, https://github.com/borntraeger/qemu/commit/6c657fba3b

(3)
> - What about these patches coming from the same IBM s390 patchset:
>
> 3c664ea0a6d4196fbc2912e4c8a4ecd1764ac862 vhost: correctly turn on
> VIRTIO_F_IOMMU_PLATFORM
> ae150759a9de200eb261c06502bc8e3276ff8344 s390/sclp: improve special wait
> psw logic
> 9da000ea0ae75fbdf14f6e7dc49ad324ba3fe190 rebuild bios
>
> just checking you saw those and are ignoring them deliberately... is that
> so ?
>

Yes it is intentional and ok, I explained to IBM why on:
https://bugs.launchpad.net/ubuntu/+source/qemu/+bug/1835546/comments/15

> (4)
> - Your debian/patches/series has, at the end:
>
> ...
> # LP 1867519 s390x protvirt
> lp-1867519-block-nbd-extract-the-common-cleanup-code.patch
> ubuntu/lp-1835546-s390x-Don-t-do-a-normal-reset-on-the-initial-cpu.patch
> ubuntu/lp-1835546-s390x-Move-reset-normal-to-shared-reset-handler.patch
> ubuntu/lp-1835546-s390x-Move-initial-reset.patch
> ubuntu/lp-1835546-s390x-Move-clear-reset.patch
> ...
>
> protvirt feature is being added in LP: #1835546 and FFe is in LP:
> #1866866. LP:
> #1867519 is about seg faults on VFIO detach as it looks like.
>
> Putting things the way I understand:
>
> LP: #1868692 - qemu64 cpu type VMX feature adverstise fix
> LP: #1835546 - s390x protvirt feature
>
> and that seems correctly informed in changelog for 1:4.2-3ubuntu4.
>
> It seems you should put line:
>
> lp-1867519-block-nbd-extract-the-common-cleanup-code.patch
>
> in the previous block of patches.
>

Agreed, it also needs a rename to have the stable prefix dir.
Done

Thanks for the review!

[Christian Ehrhardt  (paelzer)]

Replied via email to the review, thanks.

I pushed the updated branch and consider this approved.
Just waiting for the FFe now (and maybe that upstream accepts it as I'd prefer that before upload).

[Christian Ehrhardt  (paelzer)]

I have re-pushed the branch and asked Rafael to re-review the bits for bug 1868692.
Comment #4 and later in that bug will explain why and the pro/cons.

[Rafael David Tinoco (rafaeldtinoco)]

+1 again on my side.

[Christian Ehrhardt  (paelzer)]

Thank you, tests are good as well and the FFe is in.
I think we did as much as we can upfront, can upload before the Beta freeze happens and worst case fix hopefully minor things later.

[Christian Ehrhardt  (paelzer)]

To ssh://git.launchpad.net/~usd-import-team/ubuntu/+source/qemu
 * [new tag] upload/1%4.2-3ubuntu4 -> upload/1%4.2-3ubuntu4

Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading qemu_4.2-3ubuntu4.dsc: done.
  Uploading qemu_4.2-3ubuntu4.debian.tar.xz: done.
  Uploading qemu_4.2-3ubuntu4_source.buildinfo: done.
  Uploading qemu_4.2-3ubuntu4_source.changes: done.
Successfully uploaded packages.

diff --git a/debian/changelog b/debian/changelog
index 89089bb..4338791 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,32 @@
+qemu (1:4.2-3ubuntu4) focal; urgency=medium
+
+  * d/p/ubuntu/lp-1835546-*: backport the s390x protvirt feature (LP: #1835546)
+  * remove d/p/ubuntu/expose-vmx_qemu64cpu.patch: Stop adding VMX to qemu64
+    to avoid broken nesting (LP: #1868692)
+
+ -- Christian Ehrhardt <[e-mail]>  Fri, 20 Mar 2020 08:02:16 +0100
+
+qemu (1:4.2-3ubuntu3) focal; urgency=medium
+
+  * d/p/stable/lp-1867519-*: Stabilize qemu 4.2 with upstream
+    patches @qemu-stable (LP: #1867519)
+
+ -- Christian Ehrhardt <[e-mail]>  Wed, 18 Mar 2020 13:57:57 +0100
+
+qemu (1:4.2-3ubuntu2) focal; urgency=medium
+
+  * allow qemu to load old modules post upgrade (LP: #1847361)
+    - d/p/ubuntu/lp-1847361-modules-load-upgrade.patch: to fallback module
+      load to a versioned path
+    - d/qemu-block-extra.*.in, d/qemu-system-gui.*.in: save shared objects on
+      upgrade
+    - d/rules: generate maintainer scripts matching package version on build
+    - d/rules: enable --enable-module-upgrades where --enable-modules is set
+  * d/p/ubuntu/lp-1847361-vhost-correctly-turn-on-VIRTIO_F_IOMMU_PLATFORM.patch:
+    avoid unnecessary IOTLB transactions (LP: #1866207)
+
+ -- Christian Ehrhardt <[e-mail]>  Mon, 02 Mar 2020 15:21:27 +0100
+
 qemu (1:4.2-3ubuntu1) focal; urgency=medium
 
   * Merge with Debian testing, remaining changes:
diff --git a/debian/patches/series b/debian/patches/series
index c9fce99..5e9c946 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -4,7 +4,6 @@ qboot-no-jump-tables.diff
 iscsi-cap-block-count-from-GET-LBA-STATUS-CVE-2020-1711.patch
 
 # ubuntu patches
-ubuntu/expose-vmx_qemu64cpu.patch
 ubuntu/enable-svm-by-default.patch
 ubuntu/define-ubuntu-machine-types.patch
 ubuntu/pre-bionic-256k-ipxe-efi-roms.patch
@@ -13,3 +12,67 @@ ubuntu/lp-1857033-i386-Add-macro-for-stibp.patch
 ubuntu/lp-1857033-i386-Add-new-CPU-model-Cooperlake.patch
 lp-1859527-virtio-blk-fix-out-of-bounds-access-to-bitmap-in-not.patch
 ubuntu/vhost-user-gpu-Drop-trailing-json-comma.patch
+ubuntu/lp-1847361-modules-load-upgrade.patch
+ubuntu/lp-1847361-vhost-correctly-turn-on-VIRTIO_F_IOMMU_PLATFORM.patch
+
+# stabilize 4.2 with patches sent to qemu-stable since 4.2 released
+stable/lp-1867519-arm-arm-powerctl-set-NSACR.-CP11-CP10-bits-in-arm_se.patch
+stable/lp-1867519-target-arm-ensure-we-use-current-exception-state-aft.patch
+stable/lp-1867519-block-Activate-recursively-even-for-already-active-n.patch
+stable/lp-1867519-arm-arm-powerctl-rebuild-hflags-after-setting-CP15-b.patch
+stable/lp-1867519-virtio-update-queue-size-on-guest-write.patch
+stable/lp-1867519-qcow2-bitmaps-fix-qcow2_can_store_new_dirty_bitmap.patch
+stable/lp-1867519-backup-top-Begin-drain-earlier.patch
+stable/lp-1867519-virtio-mmio-update-queue-size-on-guest-write.patch
+stable/lp-1867519-virtio-net-delete-also-control-queue-when-TX-RX-dele.patch
+stable/lp-1867519-intel_iommu-a-fix-to-vtd_find_as_from_bus_num.patch
+stable/lp-1867519-intel_iommu-add-present-bit-check-for-pasid-table-en.patch
+stable/lp-1867519-vfio-pci-Don-t-remove-irqchip-notifier-if-not-regist.patch
+stable/lp-1867519-hw-i386-pc-fix-regression-in-parsing-vga-cmdline-par.patch
+stable/lp-1867519-target-arm-arm-semi-fix-SYS_OPEN-to-return-nonzero-f.patch
+stable/lp-1867519-target-arm-Return-correct-IL-bit-in-merge_syn_data_a.patch
+stable/lp-1867519-target-arm-Set-ISSIs16Bit-in-make_issinfo.patch
+stable/lp-1867519-target-i386-kvm-initialize-feature-MSRs-very-early.patch
+stable/lp-1867519-tpm-ppi-page-align-PPI-RAM.patch
+stable/lp-1867519-block-backup-top-fix-failure-path.patch
+stable/lp-1867519-iotests-add-test-for-backup-top-failure-on-permissio.patch
+stable/lp-1867519-block-fix-crash-on-zero-length-unaligned-write-and-r.patch
+stable/lp-1867519-qemu-img-Fix-convert-n-B-for-backing-less-targets.patch
+stable/lp-1867519-plugins-core-add-missing-break-in-cb_to_tcg_flags.patch
+stable/lp-1867519-tcg-save-vaddr-temp-for-plugin-usage.patch
+stable/lp-1867519-s390-sclp-improve-special-wait-psw-logic.patch
+stable/lp-1867519-block-nbd-fix-memory-leak-in-nbd_open.patch
+stable/lp-1867519-virtio-gracefully-handle-invalid-region-caches.patch
+stable/lp-1867519-qcow2-Fix-qcow2_alloc_cluster_abort-for-external-dat.patch
+stable/lp-1867519-qcow2-Fix-alloc_cluster_abort-for-pre-existing-clust.patch
+stable/lp-1867519-block-qcow2-threads-fix-qcow2_decompress.patch
+stable/lp-1867519-job-refactor-progress-to-separate-object.patch
+stable/lp-1867519-block-block-copy-fix-progress-calculation.patch
+stable/lp-1867519-block-io-fix-bdrv_co_do_copy_on_readv.patch
+stable/lp-1867519-block-nbd-extract-the-common-cleanup-code.patch
+
+# LP 1867519 s390x protvirt
+ubuntu/lp-1835546-s390x-Don-t-do-a-normal-reset-on-the-initial-cpu.patch
+ubuntu/lp-1835546-s390x-Move-reset-normal-to-shared-reset-handler.patch
+ubuntu/lp-1835546-s390x-Move-initial-reset.patch
+ubuntu/lp-1835546-s390x-Move-clear-reset.patch
+ubuntu/lp-1835546-s390x-kvm-Make-kvm_sclp_service_call-void.patch
+ubuntu/lp-1835546-s390x-ipl-Consolidate-iplb-validity-check-into-one-f.patch
+ubuntu/lp-1835546-s390x-Beautify-diag308-handling.patch
+ubuntu/lp-1835546-s390x-Add-missing-vcpu-reset-functions.patch
+ubuntu/lp-1835546-pc-bios-s390x-Save-iplb-location-in-lowcore.patch
+ubuntu/lp-1835546-s390x-Move-diagnose-308-subcodes-and-rcs-into-ipl.h.patch
+ubuntu/lp-1835546-Sync-pv.patch
+ubuntu/lp-1835546-s390x-protvirt-Support-unpack-facility.patch
+ubuntu/lp-1835546-s390x-protvirt-Add-migration-blocker.patch
+ubuntu/lp-1835546-s390x-protvirt-Inhibit-balloon-when-switching-to-pro.patch
+ubuntu/lp-1835546-s390x-protvirt-KVM-intercept-changes.patch
+ubuntu/lp-1835546-s390x-Add-SIDA-memory-ops.patch
+ubuntu/lp-1835546-s390x-protvirt-Move-STSI-data-over-SIDAD.patch
+ubuntu/lp-1835546-s390x-protvirt-SCLP-interpretation.patch
+ubuntu/lp-1835546-s390x-protvirt-Set-guest-IPL-PSW.patch
+ubuntu/lp-1835546-s390x-protvirt-Move-diag-308-data-over-SIDA.patch
+ubuntu/lp-1835546-s390x-protvirt-Disable-address-checks-for-PV-guest-I.patch
+ubuntu/lp-1835546-s390x-protvirt-Move-IO-control-structures-over-SIDA.patch
+ubuntu/lp-1835546-s390x-protvirt-Handle-SIGP-store-status-correctly.patch
+ubuntu/lp-1835546-s390x-Add-unpack-facility-feature-to-GA1.patch
diff --git a/debian/patches/stable/lp-1867519-arm-arm-powerctl-rebuild-hflags-after-setting-CP15-b.patch b/debian/patches/stable/lp-1867519-arm-arm-powerctl-rebuild-hflags-after-setting-CP15-b.patch
new file mode 100644
index 0000000..c980ed6
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-arm-arm-powerctl-rebuild-hflags-after-setting-CP15-b.patch
@@ -0,0 +1,48 @@
+From c8fa6079eb35888587f1be27c1590da4edcc5098 Mon Sep 17 00:00:00 2001
+From: Niek Linnenbank <[e-mail]>
+Date: Fri, 20 Dec 2019 14:03:00 +0000
+Subject: [PATCH] arm/arm-powerctl: rebuild hflags after setting CP15 bits in
+ arm_set_cpu_on()
+
+After setting CP15 bits in arm_set_cpu_on() the cached hflags must
+be rebuild to reflect the changed processor state. Without rebuilding,
+the cached hflags would be inconsistent until the next call to
+arm_rebuild_hflags(). When QEMU is compiled with debugging enabled
+(--enable-debug), this problem is captured shortly after the first
+call to arm_set_cpu_on() for CPUs running in ARM 32-bit non-secure mode:
+
+  qemu-system-arm: target/arm/helper.c:11359: cpu_get_tb_cpu_state:
+  Assertion `flags == rebuild_hflags_internal(env)' failed.
+  Aborted (core dumped)
+
+Fixes: 0c7f8c43daf65
+Cc: [e-mail]
+Signed-off-by: Niek Linnenbank <[e-mail]>
+Reviewed-by: Richard Henderson <[e-mail]>
+Signed-off-by: Peter Maydell <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=c8fa6079eb35888587f1be27c1590da4edcc5098
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ target/arm/arm-powerctl.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/target/arm/arm-powerctl.c b/target/arm/arm-powerctl.c
+index b064513d44..b75f813b40 100644
+--- a/target/arm/arm-powerctl.c
++++ b/target/arm/arm-powerctl.c
+@@ -127,6 +127,9 @@ static void arm_set_cpu_on_async_work(CPUState *target_cpu_state,
+         target_cpu->env.regs[0] = info->context_id;
+     }
+ 
++    /* CP15 update requires rebuilding hflags */
++    arm_rebuild_hflags(&target_cpu->env);
++
+     /* Start the new CPU at the requested address */
+     cpu_set_pc(target_cpu_state, info->entry);
+ 
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-arm-arm-powerctl-set-NSACR.-CP11-CP10-bits-in-arm_se.patch b/debian/patches/stable/lp-1867519-arm-arm-powerctl-set-NSACR.-CP11-CP10-bits-in-arm_se.patch
new file mode 100644
index 0000000..b2fa47c
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-arm-arm-powerctl-set-NSACR.-CP11-CP10-bits-in-arm_se.patch
@@ -0,0 +1,49 @@
+From 0c7f8c43daf6556078e51de98aa13f069e505985 Mon Sep 17 00:00:00 2001
+From: Niek Linnenbank <[e-mail]>
+Date: Mon, 2 Dec 2019 22:09:43 +0100
+Subject: [PATCH] arm/arm-powerctl: set NSACR.{CP11, CP10} bits in
+ arm_set_cpu_on()
+
+This change ensures that the FPU can be accessed in Non-Secure mode
+when the CPU core is reset using the arm_set_cpu_on() function call.
+The NSACR.{CP11,CP10} bits define the exception level required to
+access the FPU in Non-Secure mode. Without these bits set, the CPU
+will give an undefined exception trap on the first FPU access for the
+secondary cores under Linux.
+
+This is necessary because in this power-control codepath QEMU
+is effectively emulating a bit of EL3 firmware, and has to set
+the CPU up as the EL3 firmware would.
+
+Fixes: fc1120a7f5
+Cc: [e-mail]
+Signed-off-by: Niek Linnenbank <[e-mail]>
+[PMM: added clarifying para to commit message]
+Reviewed-by: Peter Maydell <[e-mail]>
+Signed-off-by: Peter Maydell <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=0c7f8c43daf6556078e51de98aa13f069e505985
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ target/arm/arm-powerctl.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/target/arm/arm-powerctl.c b/target/arm/arm-powerctl.c
+index f77a950db6..b064513d44 100644
+--- a/target/arm/arm-powerctl.c
++++ b/target/arm/arm-powerctl.c
+@@ -104,6 +104,9 @@ static void arm_set_cpu_on_async_work(CPUState *target_cpu_state,
+         /* Processor is not in secure mode */
+         target_cpu->env.cp15.scr_el3 |= SCR_NS;
+ 
++        /* Set NSACR.{CP11,CP10} so NS can access the FPU */
++        target_cpu->env.cp15.nsacr |= 3 << 10;
++
+         /*
+          * If QEMU is providing the equivalent of EL3 firmware, then we need
+          * to make sure a CPU targeting EL2 comes out of reset with a
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-backup-top-Begin-drain-earlier.patch b/debian/patches/stable/lp-1867519-backup-top-Begin-drain-earlier.patch
new file mode 100644
index 0000000..d534297
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-backup-top-Begin-drain-earlier.patch
@@ -0,0 +1,46 @@
+From 503ca1262bab2c11c533a4816d1ff4297d4f58a6 Mon Sep 17 00:00:00 2001
+From: Max Reitz <[e-mail]>
+Date: Thu, 19 Dec 2019 19:26:38 +0100
+Subject: [PATCH] backup-top: Begin drain earlier
+
+When dropping backup-top, we need to drain the node before freeing the
+BlockCopyState.  Otherwise, requests may still be in flight and then the
+assertion in shres_destroy() will fail.
+
+(This becomes visible in intermittent failure of 056.)
+
+Cc: [e-mail]
+Signed-off-by: Max Reitz <[e-mail]>
+Message-id: [e-mail]
+Signed-off-by: Max Reitz <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=503ca1262bab2c11c533a4816d1ff4297d4f58a6
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ block/backup-top.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/block/backup-top.c b/block/backup-top.c
+index 7cdb1f8eba..818d3f26b4 100644
+--- a/block/backup-top.c
++++ b/block/backup-top.c
+@@ -257,12 +257,12 @@ void bdrv_backup_top_drop(BlockDriverState *bs)
+     BDRVBackupTopState *s = bs->opaque;
+     AioContext *aio_context = bdrv_get_aio_context(bs);
+ 
+-    block_copy_state_free(s->bcs);
+-
+     aio_context_acquire(aio_context);
+ 
+     bdrv_drained_begin(bs);
+ 
++    block_copy_state_free(s->bcs);
++
+     s->active = false;
+     bdrv_child_refresh_perms(bs, bs->backing, &error_abort);
+     bdrv_replace_node(bs, backing_bs(bs), &error_abort);
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-block-Activate-recursively-even-for-already-active-n.patch b/debian/patches/stable/lp-1867519-block-Activate-recursively-even-for-already-active-n.patch
new file mode 100644
index 0000000..0a9d490
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-block-Activate-recursively-even-for-already-active-n.patch
@@ -0,0 +1,108 @@
+From 7bb4941ace471fc7dd6ded4749b95b9622baa6ed Mon Sep 17 00:00:00 2001
+From: Kevin Wolf <[e-mail]>
+Date: Tue, 17 Dec 2019 15:06:38 +0100
+Subject: [PATCH] block: Activate recursively even for already active nodes
+
+bdrv_invalidate_cache_all() assumes that all nodes in a given subtree
+are either active or inactive when it starts. Therefore, as soon as it
+arrives at an already active node, it stops.
+
+However, this assumption is wrong. For example, it's possible to take a
+snapshot of an inactive node, which results in an active overlay over an
+inactive backing file. The active overlay is probably also the root node
+of an inactive BlockBackend (blk->disable_perm == true).
+
+In this case, bdrv_invalidate_cache_all() does not need to do anything
+to activate the overlay node, but it still needs to recurse into the
+children and the parents to make sure that after returning success,
+really everything is activated.
+
+Cc: [e-mail]
+Signed-off-by: Kevin Wolf <[e-mail]>
+Reviewed-by: Max Reitz <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=7bb4941ace471fc7dd6ded4749b95b9622baa6ed
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ block.c | 50 ++++++++++++++++++++++++--------------------------
+ 1 file changed, 24 insertions(+), 26 deletions(-)
+
+diff --git a/block.c b/block.c
+index 73029fad64..1b6f7c86e8 100644
+--- a/block.c
++++ b/block.c
+@@ -5335,10 +5335,6 @@ static void coroutine_fn bdrv_co_invalidate_cache(BlockDriverState *bs,
+         return;
+     }
+ 
+-    if (!(bs->open_flags & BDRV_O_INACTIVE)) {
+-        return;
+-    }
+-
+     QLIST_FOREACH(child, &bs->children, next) {
+         bdrv_co_invalidate_cache(child->bs, &local_err);
+         if (local_err) {
+@@ -5360,34 +5356,36 @@ static void coroutine_fn bdrv_co_invalidate_cache(BlockDriverState *bs,
+      * just keep the extended permissions for the next time that an activation
+      * of the image is tried.
+      */
+-    bs->open_flags &= ~BDRV_O_INACTIVE;
+-    bdrv_get_cumulative_perm(bs, &perm, &shared_perm);
+-    ret = bdrv_check_perm(bs, NULL, perm, shared_perm, NULL, NULL, &local_err);
+-    if (ret < 0) {
+-        bs->open_flags |= BDRV_O_INACTIVE;
+-        error_propagate(errp, local_err);
+-        return;
+-    }
+-    bdrv_set_perm(bs, perm, shared_perm);
+-
+-    if (bs->drv->bdrv_co_invalidate_cache) {
+-        bs->drv->bdrv_co_invalidate_cache(bs, &local_err);
+-        if (local_err) {
++    if (bs->open_flags & BDRV_O_INACTIVE) {
++        bs->open_flags &= ~BDRV_O_INACTIVE;
++        bdrv_get_cumulative_perm(bs, &perm, &shared_perm);
++        ret = bdrv_check_perm(bs, NULL, perm, shared_perm, NULL, NULL, &local_err);
++        if (ret < 0) {
+             bs->open_flags |= BDRV_O_INACTIVE;
+             error_propagate(errp, local_err);
+             return;
+         }
+-    }
++        bdrv_set_perm(bs, perm, shared_perm);
+ 
+-    FOR_EACH_DIRTY_BITMAP(bs, bm) {
+-        bdrv_dirty_bitmap_skip_store(bm, false);
+-    }
++        if (bs->drv->bdrv_co_invalidate_cache) {
++            bs->drv->bdrv_co_invalidate_cache(bs, &local_err);
++            if (local_err) {
++                bs->open_flags |= BDRV_O_INACTIVE;
++                error_propagate(errp, local_err);
++                return;
++            }
++        }
+ 
+-    ret = refresh_total_sectors(bs, bs->total_sectors);
+-    if (ret < 0) {
+-        bs->open_flags |= BDRV_O_INACTIVE;
+-        error_setg_errno(errp, -ret, "Could not refresh total sector count");
+-        return;
++        FOR_EACH_DIRTY_BITMAP(bs, bm) {
++            bdrv_dirty_bitmap_skip_store(bm, false);
++        }
++
++        ret = refresh_total_sectors(bs, bs->total_sectors);
++        if (ret < 0) {
++            bs->open_flags |= BDRV_O_INACTIVE;
++            error_setg_errno(errp, -ret, "Could not refresh total sector count");
++            return;
++        }
+     }
+ 
+     QLIST_FOREACH(parent, &bs->parents, next_parent) {
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-block-backup-top-fix-failure-path.patch b/debian/patches/stable/lp-1867519-block-backup-top-fix-failure-path.patch
new file mode 100644
index 0000000..0ea91e8
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-block-backup-top-fix-failure-path.patch
@@ -0,0 +1,97 @@
+From 0df62f45c1de6c020f1e6fba4eeafd248209b003 Mon Sep 17 00:00:00 2001
+From: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Date: Tue, 21 Jan 2020 17:28:01 +0300
+Subject: [PATCH] block/backup-top: fix failure path
+
+We can't access top after call bdrv_backup_top_drop, as it is already
+freed at this time.
+
+Also, no needs to unref target child by hand, it will be unrefed on
+bdrv_close() automatically.
+
+So, just do bdrv_backup_top_drop if append succeed and one bdrv_unref
+otherwise.
+
+Note, that in !appended case bdrv_unref(top) moved into drained section
+on source. It doesn't really matter, but just for code simplicity.
+
+Fixes: 7df7868b96404
+Cc: [e-mail] # v4.2.0
+Signed-off-by: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Reviewed-by: Max Reitz <[e-mail]>
+Message-id: [e-mail]
+Signed-off-by: Max Reitz <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=0df62f45c1de6c020f1e6fba4eeafd248209b003
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ block/backup-top.c | 21 ++++++++++++---------
+ 1 file changed, 12 insertions(+), 9 deletions(-)
+
+diff --git a/block/backup-top.c b/block/backup-top.c
+index 9aed2eb4c0..fa78f3256d 100644
+--- a/block/backup-top.c
++++ b/block/backup-top.c
+@@ -190,6 +190,7 @@ BlockDriverState *bdrv_backup_top_append(BlockDriverState *source,
+     BlockDriverState *top = bdrv_new_open_driver(&bdrv_backup_top_filter,
+                                                  filter_node_name,
+                                                  BDRV_O_RDWR, errp);
++    bool appended = false;
+ 
+     if (!top) {
+         return NULL;
+@@ -212,8 +213,9 @@ BlockDriverState *bdrv_backup_top_append(BlockDriverState *source,
+     bdrv_append(top, source, &local_err);
+     if (local_err) {
+         error_prepend(&local_err, "Cannot append backup-top filter: ");
+-        goto append_failed;
++        goto fail;
+     }
++    appended = true;
+ 
+     /*
+      * bdrv_append() finished successfully, now we can require permissions
+@@ -224,14 +226,14 @@ BlockDriverState *bdrv_backup_top_append(BlockDriverState *source,
+     if (local_err) {
+         error_prepend(&local_err,
+                       "Cannot set permissions for backup-top filter: ");
+-        goto failed_after_append;
++        goto fail;
+     }
+ 
+     state->bcs = block_copy_state_new(top->backing, state->target,
+                                       cluster_size, write_flags, &local_err);
+     if (local_err) {
+         error_prepend(&local_err, "Cannot create block-copy-state: ");
+-        goto failed_after_append;
++        goto fail;
+     }
+     *bcs = state->bcs;
+ 
+@@ -239,14 +241,15 @@ BlockDriverState *bdrv_backup_top_append(BlockDriverState *source,
+ 
+     return top;
+ 
+-failed_after_append:
+-    state->active = false;
+-    bdrv_backup_top_drop(top);
++fail:
++    if (appended) {
++        state->active = false;
++        bdrv_backup_top_drop(top);
++    } else {
++        bdrv_unref(top);
++    }
+ 
+-append_failed:
+     bdrv_drained_end(source);
+-    bdrv_unref_child(top, state->target);
+-    bdrv_unref(top);
+     error_propagate(errp, local_err);
+ 
+     return NULL;
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-block-block-copy-fix-progress-calculation.patch b/debian/patches/stable/lp-1867519-block-block-copy-fix-progress-calculation.patch
new file mode 100644
index 0000000..6eb7652
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-block-block-copy-fix-progress-calculation.patch
@@ -0,0 +1,201 @@
+From d0ebeca14a585f352938062ef8ddde47fe4d39f9 Mon Sep 17 00:00:00 2001
+From: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Date: Wed, 11 Mar 2020 13:29:57 +0300
+Subject: [PATCH] block/block-copy: fix progress calculation
+
+Assume we have two regions, A and B, and region B is in-flight now,
+region A is not yet touched, but it is unallocated and should be
+skipped.
+
+Correspondingly, as progress we have
+
+  total = A + B
+  current = 0
+
+If we reset unallocated region A and call progress_reset_callback,
+it will calculate 0 bytes dirty in the bitmap and call
+job_progress_set_remaining, which will set
+
+   total = current + 0 = 0 + 0 = 0
+
+So, B bytes are actually removed from total accounting. When job
+finishes we'll have
+
+   total = 0
+   current = B
+
+, which doesn't sound good.
+
+This is because we didn't considered in-flight bytes, actually when
+calculating remaining, we should have set (in_flight + dirty_bytes)
+as remaining, not only dirty_bytes.
+
+To fix it, let's refactor progress calculation, moving it to block-copy
+itself instead of fixing callback. And, of course, track in_flight
+bytes count.
+
+We still have to keep one callback, to maintain backup job bytes_read
+calculation, but it will go on soon, when we turn the whole backup
+process into one block_copy call.
+
+Cc: [e-mail]
+Signed-off-by: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Reviewed-by: Andrey Shinkevich <[e-mail]>
+Message-Id: <[e-mail]>
+Signed-off-by: Max Reitz <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=d0ebeca14a585f352938062ef8ddde47fe4d39f9
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ block/backup.c             | 13 ++-----------
+ block/block-copy.c         | 16 ++++++++++++----
+ include/block/block-copy.h | 15 +++++----------
+ 3 files changed, 19 insertions(+), 25 deletions(-)
+
+diff --git a/block/backup.c b/block/backup.c
+index 1383e219f5..8694e0394b 100644
+--- a/block/backup.c
++++ b/block/backup.c
+@@ -57,15 +57,6 @@ static void backup_progress_bytes_callback(int64_t bytes, void *opaque)
+     BackupBlockJob *s = opaque;
+ 
+     s->bytes_read += bytes;
+-    job_progress_update(&s->common.job, bytes);
+-}
+-
+-static void backup_progress_reset_callback(void *opaque)
+-{
+-    BackupBlockJob *s = opaque;
+-    uint64_t estimate = bdrv_get_dirty_count(s->bcs->copy_bitmap);
+-
+-    job_progress_set_remaining(&s->common.job, estimate);
+ }
+ 
+ static int coroutine_fn backup_do_cow(BackupBlockJob *job,
+@@ -464,8 +455,8 @@ BlockJob *backup_job_create(const char *job_id, BlockDriverState *bs,
+     job->cluster_size = cluster_size;
+     job->len = len;
+ 
+-    block_copy_set_callbacks(bcs, backup_progress_bytes_callback,
+-                             backup_progress_reset_callback, job);
++    block_copy_set_progress_callback(bcs, backup_progress_bytes_callback, job);
++    block_copy_set_progress_meter(bcs, &job->common.job.progress);
+ 
+     /* Required permissions are already taken by backup-top target */
+     block_job_add_bdrv(&job->common, "target", target, 0, BLK_PERM_ALL,
+diff --git a/block/block-copy.c b/block/block-copy.c
+index 79798a1567..e2d7b3b887 100644
+--- a/block/block-copy.c
++++ b/block/block-copy.c
+@@ -127,17 +127,20 @@ BlockCopyState *block_copy_state_new(BdrvChild *source, BdrvChild *target,
+     return s;
+ }
+ 
+-void block_copy_set_callbacks(
++void block_copy_set_progress_callback(
+         BlockCopyState *s,
+         ProgressBytesCallbackFunc progress_bytes_callback,
+-        ProgressResetCallbackFunc progress_reset_callback,
+         void *progress_opaque)
+ {
+     s->progress_bytes_callback = progress_bytes_callback;
+-    s->progress_reset_callback = progress_reset_callback;
+     s->progress_opaque = progress_opaque;
+ }
+ 
++void block_copy_set_progress_meter(BlockCopyState *s, ProgressMeter *pm)
++{
++    s->progress = pm;
++}
++
+ /*
+  * block_copy_do_copy
+  *
+@@ -269,7 +272,9 @@ int64_t block_copy_reset_unallocated(BlockCopyState *s,
+ 
+     if (!ret) {
+         bdrv_reset_dirty_bitmap(s->copy_bitmap, offset, bytes);
+-        s->progress_reset_callback(s->progress_opaque);
++        progress_set_remaining(s->progress,
++                               bdrv_get_dirty_count(s->copy_bitmap) +
++                               s->in_flight_bytes);
+     }
+ 
+     *count = bytes;
+@@ -331,15 +336,18 @@ int coroutine_fn block_copy(BlockCopyState *s,
+         trace_block_copy_process(s, start);
+ 
+         bdrv_reset_dirty_bitmap(s->copy_bitmap, start, chunk_end - start);
++        s->in_flight_bytes += chunk_end - start;
+ 
+         co_get_from_shres(s->mem, chunk_end - start);
+         ret = block_copy_do_copy(s, start, chunk_end, error_is_read);
+         co_put_to_shres(s->mem, chunk_end - start);
++        s->in_flight_bytes -= chunk_end - start;
+         if (ret < 0) {
+             bdrv_set_dirty_bitmap(s->copy_bitmap, start, chunk_end - start);
+             break;
+         }
+ 
++        progress_work_done(s->progress, chunk_end - start);
+         s->progress_bytes_callback(chunk_end - start, s->progress_opaque);
+         start = chunk_end;
+         ret = 0;
+diff --git a/include/block/block-copy.h b/include/block/block-copy.h
+index 0a161724d7..9def00068c 100644
+--- a/include/block/block-copy.h
++++ b/include/block/block-copy.h
+@@ -26,7 +26,6 @@ typedef struct BlockCopyInFlightReq {
+ } BlockCopyInFlightReq;
+ 
+ typedef void (*ProgressBytesCallbackFunc)(int64_t bytes, void *opaque);
+-typedef void (*ProgressResetCallbackFunc)(void *opaque);
+ typedef struct BlockCopyState {
+     /*
+      * BdrvChild objects are not owned or managed by block-copy. They are
+@@ -36,6 +35,7 @@ typedef struct BlockCopyState {
+     BdrvChild *source;
+     BdrvChild *target;
+     BdrvDirtyBitmap *copy_bitmap;
++    int64_t in_flight_bytes;
+     int64_t cluster_size;
+     bool use_copy_range;
+     int64_t copy_size;
+@@ -60,15 +60,9 @@ typedef struct BlockCopyState {
+      */
+     bool skip_unallocated;
+ 
++    ProgressMeter *progress;
+     /* progress_bytes_callback: called when some copying progress is done. */
+     ProgressBytesCallbackFunc progress_bytes_callback;
+-
+-    /*
+-     * progress_reset_callback: called when some bytes reset from copy_bitmap
+-     * (see @skip_unallocated above). The callee is assumed to recalculate how
+-     * many bytes remain based on the dirty bit count of copy_bitmap.
+-     */
+-    ProgressResetCallbackFunc progress_reset_callback;
+     void *progress_opaque;
+ 
+     SharedResource *mem;
+@@ -79,12 +73,13 @@ BlockCopyState *block_copy_state_new(BdrvChild *source, BdrvChild *target,
+                                      BdrvRequestFlags write_flags,
+                                      Error **errp);
+ 
+-void block_copy_set_callbacks(
++void block_copy_set_progress_callback(
+         BlockCopyState *s,
+         ProgressBytesCallbackFunc progress_bytes_callback,
+-        ProgressResetCallbackFunc progress_reset_callback,
+         void *progress_opaque);
+ 
++void block_copy_set_progress_meter(BlockCopyState *s, ProgressMeter *pm);
++
+ void block_copy_state_free(BlockCopyState *s);
+ 
+ int64_t block_copy_reset_unallocated(BlockCopyState *s,
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-block-fix-crash-on-zero-length-unaligned-write-and-r.patch b/debian/patches/stable/lp-1867519-block-fix-crash-on-zero-length-unaligned-write-and-r.patch
new file mode 100644
index 0000000..a84fdd7
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-block-fix-crash-on-zero-length-unaligned-write-and-r.patch
@@ -0,0 +1,107 @@
+From ac9d00bf7b47acae6b0e42910d9ed55fef3af5b8 Mon Sep 17 00:00:00 2001
+From: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Date: Thu, 6 Feb 2020 19:42:45 +0300
+Subject: [PATCH] block: fix crash on zero-length unaligned write and read
+
+Commit 7a3f542fbd "block/io: refactor padding" occasionally dropped
+aligning for zero-length request: bdrv_init_padding() blindly return
+false if bytes == 0, like there is nothing to align.
+
+This leads the following command to crash:
+
+./qemu-io --image-opts -c 'write 1 0' \
+  driver=blkdebug,align=512,image.driver=null-co,image.size=512
+
+>> qemu-io: block/io.c:1955: bdrv_aligned_pwritev: Assertion
+    `(offset & (align - 1)) == 0' failed.
+>> Aborted (core dumped)
+
+Prior to 7a3f542fbd we does aligning of such zero requests. Instead of
+recovering this behavior let's just do nothing on such requests as it
+is useless.
+
+Note that driver may have special meaning of zero-length reqeusts, like
+qcow2_co_pwritev_compressed_part, so we can't skip any zero-length
+operation. But for unaligned ones, we can't pass it to driver anyway.
+
+This commit also fixes crash in iotest 80 running with -nocache:
+
+./check -nocache -qcow2 80
+
+which crashes on same assertion due to trying to read empty extra data
+in qcow2_do_read_snapshots().
+
+Cc: [e-mail] # v4.2
+Fixes: 7a3f542fbd
+Signed-off-by: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Reviewed-by: Max Reitz <[e-mail]>
+Message-id: [e-mail]
+Signed-off-by: Stefan Hajnoczi <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=ac9d00bf7b47acae6b0e42910d9ed55fef3af5b8
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ block/io.c | 28 +++++++++++++++++++++++++++-
+ 1 file changed, 27 insertions(+), 1 deletion(-)
+
+diff --git a/block/io.c b/block/io.c
+index 1eb2b2bddc..7e4cb74cf4 100644
+--- a/block/io.c
++++ b/block/io.c
+@@ -1565,10 +1565,12 @@ static bool bdrv_init_padding(BlockDriverState *bs,
+         pad->tail = align - pad->tail;
+     }
+ 
+-    if ((!pad->head && !pad->tail) || !bytes) {
++    if (!pad->head && !pad->tail) {
+         return false;
+     }
+ 
++    assert(bytes); /* Nothing good in aligning zero-length requests */
++
+     sum = pad->head + bytes + pad->tail;
+     pad->buf_len = (sum > align && pad->head && pad->tail) ? 2 * align : align;
+     pad->buf = qemu_blockalign(bs, pad->buf_len);
+@@ -1706,6 +1708,18 @@ int coroutine_fn bdrv_co_preadv_part(BdrvChild *child,
+         return ret;
+     }
+ 
++    if (bytes == 0 && !QEMU_IS_ALIGNED(offset, bs->bl.request_alignment)) {
++        /*
++         * Aligning zero request is nonsense. Even if driver has special meaning
++         * of zero-length (like qcow2_co_pwritev_compressed_part), we can't pass
++         * it to driver due to request_alignment.
++         *
++         * Still, no reason to return an error if someone do unaligned
++         * zero-length read occasionally.
++         */
++        return 0;
++    }
++
+     bdrv_inc_in_flight(bs);
+ 
+     /* Don't do copy-on-read if we read data before write operation */
+@@ -2116,6 +2130,18 @@ int coroutine_fn bdrv_co_pwritev_part(BdrvChild *child,
+         return -ENOTSUP;
+     }
+ 
++    if (bytes == 0 && !QEMU_IS_ALIGNED(offset, bs->bl.request_alignment)) {
++        /*
++         * Aligning zero request is nonsense. Even if driver has special meaning
++         * of zero-length (like qcow2_co_pwritev_compressed_part), we can't pass
++         * it to driver due to request_alignment.
++         *
++         * Still, no reason to return an error if someone do unaligned
++         * zero-length write occasionally.
++         */
++        return 0;
++    }
++
+     bdrv_inc_in_flight(bs);
+     /*
+      * Align write if necessary by performing a read-modify-write cycle.
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-block-io-fix-bdrv_co_do_copy_on_readv.patch b/debian/patches/stable/lp-1867519-block-io-fix-bdrv_co_do_copy_on_readv.patch
new file mode 100644
index 0000000..84335eb
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-block-io-fix-bdrv_co_do_copy_on_readv.patch
@@ -0,0 +1,44 @@
+From 4ab78b19189a81038e744728ed949d09aa477550 Mon Sep 17 00:00:00 2001
+From: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Date: Thu, 12 Mar 2020 11:19:49 +0300
+Subject: [PATCH] block/io: fix bdrv_co_do_copy_on_readv
+
+Prior to 1143ec5ebf4 it was OK to qemu_iovec_from_buf() from aligned-up
+buffer to original qiov, as qemu_iovec_from_buf() will stop at qiov end
+anyway.
+
+But after 1143ec5ebf4 we assume that bdrv_co_do_copy_on_readv works on
+part of original qiov, defined by qiov_offset and bytes. So we must not
+touch qiov behind qiov_offset+bytes bound. Fix it.
+
+Cc: [e-mail] # v4.2
+Fixes: 1143ec5ebf4
+Signed-off-by: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Reviewed-by: John Snow <[e-mail]>
+Message-id: [e-mail]
+Signed-off-by: Stefan Hajnoczi <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=4ab78b19189a81038e744728ed949d09aa477550
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ block/io.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/block/io.c b/block/io.c
+index 7e4cb74cf4..aba67f66b9 100644
+--- a/block/io.c
++++ b/block/io.c
+@@ -1399,7 +1399,7 @@ static int coroutine_fn bdrv_co_do_copy_on_readv(BdrvChild *child,
+             if (!(flags & BDRV_REQ_PREFETCH)) {
+                 qemu_iovec_from_buf(qiov, qiov_offset + progress,
+                                     bounce_buffer + skip_bytes,
+-                                    pnum - skip_bytes);
++                                    MIN(pnum - skip_bytes, bytes - progress));
+             }
+         } else if (!(flags & BDRV_REQ_PREFETCH)) {
+             /* Read directly into the destination */
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-block-nbd-extract-the-common-cleanup-code.patch b/debian/patches/stable/lp-1867519-block-nbd-extract-the-common-cleanup-code.patch
new file mode 100644
index 0000000..8dc2409
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-block-nbd-extract-the-common-cleanup-code.patch
@@ -0,0 +1,78 @@
+From 7f493662be4045146a8f45119d8834c9088a0ad6 Mon Sep 17 00:00:00 2001
+From: Pan Nengyuan <[e-mail]>
+Date: Thu, 5 Dec 2019 11:45:27 +0800
+Subject: [PATCH] block/nbd: extract the common cleanup code
+
+The BDRVNBDState cleanup code is common in two places, add
+nbd_clear_bdrvstate() function to do these cleanups.
+
+Suggested-by: Stefano Garzarella <[e-mail]>
+Signed-off-by: Pan Nengyuan <[e-mail]>
+Reviewed-by: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Message-Id: <[e-mail]>
+Reviewed-by: Eric Blake <[e-mail]>
+[eblake: fix compilation error and commit message]
+Signed-off-by: Eric Blake <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=7f493662be4045146a8f45119d8834c9088a0ad6
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ block/nbd.c | 26 +++++++++++++++-----------
+ 1 file changed, 15 insertions(+), 11 deletions(-)
+
+diff --git a/block/nbd.c b/block/nbd.c
+index f69e61e68a..ed0f93ab27 100644
+--- a/block/nbd.c
++++ b/block/nbd.c
+@@ -95,6 +95,19 @@ typedef struct BDRVNBDState {
+ 
+ static int nbd_client_connect(BlockDriverState *bs, Error **errp);
+ 
++static void nbd_clear_bdrvstate(BDRVNBDState *s)
++{
++    object_unref(OBJECT(s->tlscreds));
++    qapi_free_SocketAddress(s->saddr);
++    s->saddr = NULL;
++    g_free(s->export);
++    s->export = NULL;
++    g_free(s->tlscredsid);
++    s->tlscredsid = NULL;
++    g_free(s->x_dirty_bitmap);
++    s->x_dirty_bitmap = NULL;
++}
++
+ static void nbd_channel_error(BDRVNBDState *s, int ret)
+ {
+     if (ret == -EIO) {
+@@ -1879,11 +1892,7 @@ static int nbd_process_options(BlockDriverState *bs, QDict *options,
+ 
+  error:
+     if (ret < 0) {
+-        object_unref(OBJECT(s->tlscreds));
+-        qapi_free_SocketAddress(s->saddr);
+-        g_free(s->export);
+-        g_free(s->tlscredsid);
+-        g_free(s->x_dirty_bitmap);
++        nbd_clear_bdrvstate(s);
+     }
+     qemu_opts_del(opts);
+     return ret;
+@@ -1962,12 +1971,7 @@ static void nbd_close(BlockDriverState *bs)
+     BDRVNBDState *s = bs->opaque;
+ 
+     nbd_client_close(bs);
+-
+-    object_unref(OBJECT(s->tlscreds));
+-    qapi_free_SocketAddress(s->saddr);
+-    g_free(s->export);
+-    g_free(s->tlscredsid);
+-    g_free(s->x_dirty_bitmap);
++    nbd_clear_bdrvstate(s);
+ }
+ 
+ static int64_t nbd_getlength(BlockDriverState *bs)
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-block-nbd-fix-memory-leak-in-nbd_open.patch b/debian/patches/stable/lp-1867519-block-nbd-fix-memory-leak-in-nbd_open.patch
new file mode 100644
index 0000000..dde008d
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-block-nbd-fix-memory-leak-in-nbd_open.patch
@@ -0,0 +1,76 @@
+From 8198cf5ef0ef98118b4176970d1cd998d93ec849 Mon Sep 17 00:00:00 2001
+From: Pan Nengyuan <[e-mail]>
+Date: Thu, 5 Dec 2019 11:45:28 +0800
+Subject: [PATCH] block/nbd: fix memory leak in nbd_open()
+
+In currently implementation there will be a memory leak when
+nbd_client_connect() returns error status. Here is an easy way to
+reproduce:
+
+1. run qemu-iotests as follow and check the result with asan:
+    ./check -raw 143
+
+Following is the asan output backtrack:
+Direct leak of 40 byte(s) in 1 object(s) allocated from:
+    #0 0x7f629688a560 in calloc (/usr/lib64/libasan.so.3+0xc7560)
+    #1 0x7f6295e7e015 in g_malloc0  (/usr/lib64/libglib-2.0.so.0+0x50015)
+    #2 0x56281dab4642 in qobject_input_start_struct  /mnt/sdb/qemu-4.2.0-rc0/qapi/qobject-input-visitor.c:295
+    #3 0x56281dab1a04 in visit_start_struct  /mnt/sdb/qemu-4.2.0-rc0/qapi/qapi-visit-core.c:49
+    #4 0x56281dad1827 in visit_type_SocketAddress  qapi/qapi-visit-sockets.c:386
+    #5 0x56281da8062f in nbd_config   /mnt/sdb/qemu-4.2.0-rc0/block/nbd.c:1716
+    #6 0x56281da8062f in nbd_process_options /mnt/sdb/qemu-4.2.0-rc0/block/nbd.c:1829
+    #7 0x56281da8062f in nbd_open /mnt/sdb/qemu-4.2.0-rc0/block/nbd.c:1873
+
+Direct leak of 15 byte(s) in 1 object(s) allocated from:
+    #0 0x7f629688a3a0 in malloc (/usr/lib64/libasan.so.3+0xc73a0)
+    #1 0x7f6295e7dfbd in g_malloc (/usr/lib64/libglib-2.0.so.0+0x4ffbd)
+    #2 0x7f6295e96ace in g_strdup (/usr/lib64/libglib-2.0.so.0+0x68ace)
+    #3 0x56281da804ac in nbd_process_options /mnt/sdb/qemu-4.2.0-rc0/block/nbd.c:1834
+    #4 0x56281da804ac in nbd_open /mnt/sdb/qemu-4.2.0-rc0/block/nbd.c:1873
+
+Indirect leak of 24 byte(s) in 1 object(s) allocated from:
+    #0 0x7f629688a3a0 in malloc (/usr/lib64/libasan.so.3+0xc73a0)
+    #1 0x7f6295e7dfbd in g_malloc (/usr/lib64/libglib-2.0.so.0+0x4ffbd)
+    #2 0x7f6295e96ace in g_strdup (/usr/lib64/libglib-2.0.so.0+0x68ace)
+    #3 0x56281dab41a3 in qobject_input_type_str_keyval /mnt/sdb/qemu-4.2.0-rc0/qapi/qobject-input-visitor.c:536
+    #4 0x56281dab2ee9 in visit_type_str /mnt/sdb/qemu-4.2.0-rc0/qapi/qapi-visit-core.c:297
+    #5 0x56281dad0fa1 in visit_type_UnixSocketAddress_members qapi/qapi-visit-sockets.c:141
+    #6 0x56281dad17b6 in visit_type_SocketAddress_members qapi/qapi-visit-sockets.c:366
+    #7 0x56281dad186a in visit_type_SocketAddress qapi/qapi-visit-sockets.c:393
+    #8 0x56281da8062f in nbd_config /mnt/sdb/qemu-4.2.0-rc0/block/nbd.c:1716
+    #9 0x56281da8062f in nbd_process_options /mnt/sdb/qemu-4.2.0-rc0/block/nbd.c:1829
+    #10 0x56281da8062f in nbd_open /mnt/sdb/qemu-4.2.0-rc0/block/nbd.c:1873
+
+Fixes: 8f071c9db506e03ab
+Reported-by: Euler Robot <[e-mail]>
+Signed-off-by: Pan Nengyuan <[e-mail]>
+Reviewed-by: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Cc: qemu-stable <[e-mail]>
+Cc: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Message-Id: <[e-mail]>
+Reviewed-by: Stefano Garzarella <[e-mail]>
+Signed-off-by: Eric Blake <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=8198cf5ef0ef98118b4176970d1cd998d93ec849
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ block/nbd.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/block/nbd.c b/block/nbd.c
+index ed0f93ab27..976be76647 100644
+--- a/block/nbd.c
++++ b/block/nbd.c
+@@ -1915,6 +1915,7 @@ static int nbd_open(BlockDriverState *bs, QDict *options, int flags,
+ 
+     ret = nbd_client_connect(bs, errp);
+     if (ret < 0) {
++        nbd_clear_bdrvstate(s);
+         return ret;
+     }
+     /* successfully connected */
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-block-qcow2-threads-fix-qcow2_decompress.patch b/debian/patches/stable/lp-1867519-block-qcow2-threads-fix-qcow2_decompress.patch
new file mode 100644
index 0000000..bf4169e
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-block-qcow2-threads-fix-qcow2_decompress.patch
@@ -0,0 +1,79 @@
+From e7266570f2cf7b3ca2a156c677ee0a59d563458b Mon Sep 17 00:00:00 2001
+From: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Date: Mon, 2 Mar 2020 18:09:30 +0300
+Subject: [PATCH] block/qcow2-threads: fix qcow2_decompress
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+On success path we return what inflate() returns instead of 0. And it
+most probably works for Z_STREAM_END as it is positive, but is
+definitely broken for Z_BUF_ERROR.
+
+While being here, switch to errno return code, to be closer to
+qcow2_compress API (and usual expectations).
+
+Revert condition in if to be more positive. Drop dead initialization of
+ret.
+
+Cc: [e-mail] # v4.0
+Fixes: 341926ab83e2b
+Signed-off-by: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Message-Id: <[e-mail]>
+Reviewed-by: Alberto Garcia <[e-mail]>
+Reviewed-by: Ján Tomko <[e-mail]>
+Signed-off-by: Max Reitz <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=e7266570f2cf7b3ca2a156c677ee0a59d563458b
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ block/qcow2-threads.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/block/qcow2-threads.c b/block/qcow2-threads.c
+index 77bb578cdf..a68126f291 100644
+--- a/block/qcow2-threads.c
++++ b/block/qcow2-threads.c
+@@ -128,12 +128,12 @@ static ssize_t qcow2_compress(void *dest, size_t dest_size,
+  * @src - source buffer, @src_size bytes
+  *
+  * Returns: 0 on success
+- *          -1 on fail
++ *          -EIO on fail
+  */
+ static ssize_t qcow2_decompress(void *dest, size_t dest_size,
+                                 const void *src, size_t src_size)
+ {
+-    int ret = 0;
++    int ret;
+     z_stream strm;
+ 
+     memset(&strm, 0, sizeof(strm));
+@@ -144,17 +144,19 @@ static ssize_t qcow2_decompress(void *dest, size_t dest_size,
+ 
+     ret = inflateInit2(&strm, -12);
+     if (ret != Z_OK) {
+-        return -1;
++        return -EIO;
+     }
+ 
+     ret = inflate(&strm, Z_FINISH);
+-    if ((ret != Z_STREAM_END && ret != Z_BUF_ERROR) || strm.avail_out != 0) {
++    if ((ret == Z_STREAM_END || ret == Z_BUF_ERROR) && strm.avail_out == 0) {
+         /*
+          * We approve Z_BUF_ERROR because we need @dest buffer to be filled, but
+          * @src buffer may be processed partly (because in qcow2 we know size of
+          * compressed data with precision of one sector)
+          */
+-        ret = -1;
++        ret = 0;
++    } else {
++        ret = -EIO;
+     }
+ 
+     inflateEnd(&strm);
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-hw-i386-pc-fix-regression-in-parsing-vga-cmdline-par.patch b/debian/patches/stable/lp-1867519-hw-i386-pc-fix-regression-in-parsing-vga-cmdline-par.patch
new file mode 100644
index 0000000..c6aa3a3
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-hw-i386-pc-fix-regression-in-parsing-vga-cmdline-par.patch
@@ -0,0 +1,58 @@
+From a88c40f02ace88f09b2a85a64831b277b2ebc88c Mon Sep 17 00:00:00 2001
+From: Peter Wu <[e-mail]>
+Date: Sat, 21 Dec 2019 17:21:24 +0100
+Subject: [PATCH] hw/i386/pc: fix regression in parsing vga cmdline parameter
+
+When the 'vga=' parameter is succeeded by another parameter, QEMU 4.2.0
+would refuse to start with a rather cryptic message:
+
+    $ qemu-system-x86_64 -kernel /boot/vmlinuz-linux -append 'vga=792 quiet'
+    qemu: can't parse 'vga' parameter: Invalid argument
+
+It was not clear whether this applied to the '-vga std' parameter or the
+'-append' one. Fix the parsing regression and clarify the error.
+
+Fixes: 133ef074bd ("hw/i386/pc: replace use of strtol with qemu_strtoui in x86_load_linux()")
+Cc: Sergio Lopez <[e-mail]>
+Signed-off-by: Peter Wu <[e-mail]>
+Message-Id: <[e-mail]>
+Cc: [e-mail]
+Signed-off-by: Paolo Bonzini <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=a88c40f02ace88f09b2a85a64831b277b2ebc88c
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ hw/i386/x86.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/hw/i386/x86.c b/hw/i386/x86.c
+index d8bb5c2a96..9b9a4d5837 100644
+--- a/hw/i386/x86.c
++++ b/hw/i386/x86.c
+@@ -612,6 +612,7 @@ void x86_load_linux(X86MachineState *x86ms,
+     vmode = strstr(kernel_cmdline, "vga=");
+     if (vmode) {
+         unsigned int video_mode;
++        const char *end;
+         int ret;
+         /* skip "vga=" */
+         vmode += 4;
+@@ -622,10 +623,9 @@ void x86_load_linux(X86MachineState *x86ms,
+         } else if (!strncmp(vmode, "ask", 3)) {
+             video_mode = 0xfffd;
+         } else {
+-            ret = qemu_strtoui(vmode, NULL, 0, &video_mode);
+-            if (ret != 0) {
+-                fprintf(stderr, "qemu: can't parse 'vga' parameter: %s\n",
+-                        strerror(-ret));
++            ret = qemu_strtoui(vmode, &end, 0, &video_mode);
++            if (ret != 0 || (*end && *end != ' ')) {
++                fprintf(stderr, "qemu: invalid 'vga=' kernel parameter.\n");
+                 exit(1);
+             }
+         }
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-intel_iommu-a-fix-to-vtd_find_as_from_bus_num.patch b/debian/patches/stable/lp-1867519-intel_iommu-a-fix-to-vtd_find_as_from_bus_num.patch
new file mode 100644
index 0000000..4d13d20
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-intel_iommu-a-fix-to-vtd_find_as_from_bus_num.patch
@@ -0,0 +1,44 @@
+From a2e1cd41ccfe796529abfd1b6aeb1dd4393762a2 Mon Sep 17 00:00:00 2001
+From: Liu Yi L <[e-mail]>
+Date: Fri, 3 Jan 2020 21:28:05 +0800
+Subject: [PATCH] intel_iommu: a fix to vtd_find_as_from_bus_num()
+
+Ensure the return value of vtd_find_as_from_bus_num() is NULL by
+enforcing vtd_bus=NULL. This would help caller of vtd_find_as_from_bus_num()
+to decide if any further operation on the returned vtd_bus.
+
+Cc: [e-mail]
+Cc: Kevin Tian <[e-mail]>
+Cc: Jacob Pan <[e-mail]>
+Cc: Peter Xu <[e-mail]>
+Cc: Yi Sun <[e-mail]>
+Signed-off-by: Liu Yi L <[e-mail]>
+Signed-off-by: Yi Sun <[e-mail]>
+Message-Id: <[e-mail]>
+Reviewed-by: Peter Xu <[e-mail]>
+Reviewed-by: Michael S. Tsirkin <[e-mail]>
+Signed-off-by: Michael S. Tsirkin <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=a2e1cd41ccfe796529abfd1b6aeb1dd4393762a2
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ hw/i386/intel_iommu.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
+index ee06993675..609b80750a 100644
+--- a/hw/i386/intel_iommu.c
++++ b/hw/i386/intel_iommu.c
+@@ -948,6 +948,7 @@ static VTDBus *vtd_find_as_from_bus_num(IntelIOMMUState *s, uint8_t bus_num)
+                 return vtd_bus;
+             }
+         }
++        vtd_bus = NULL;
+     }
+     return vtd_bus;
+ }
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-intel_iommu-add-present-bit-check-for-pasid-table-en.patch b/debian/patches/stable/lp-1867519-intel_iommu-add-present-bit-check-for-pasid-table-en.patch
new file mode 100644
index 0000000..02548a2
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-intel_iommu-add-present-bit-check-for-pasid-table-en.patch
@@ -0,0 +1,202 @@
+From 56fc1e6ac6bde95bc0369d358587f2234d4dddad Mon Sep 17 00:00:00 2001
+From: Liu Yi L <[e-mail]>
+Date: Fri, 3 Jan 2020 21:28:06 +0800
+Subject: [PATCH] intel_iommu: add present bit check for pasid table entries
+
+The present bit check for pasid entry (pe) and pasid directory
+entry (pdire) were missed in previous commits as fpd bit check
+doesn't require present bit as "Set". This patch adds the present
+bit check for callers which wants to get a valid pe/pdire.
+
+Cc: [e-mail]
+Cc: Kevin Tian <[e-mail]>
+Cc: Jacob Pan <[e-mail]>
+Cc: Peter Xu <[e-mail]>
+Cc: Yi Sun <[e-mail]>
+Reviewed-by: Peter Xu <[e-mail]>
+Signed-off-by: Liu Yi L <[e-mail]>
+Message-Id: <[e-mail]>
+Reviewed-by: Peter Xu <[e-mail]>
+Reviewed-by: Michael S. Tsirkin <[e-mail]>
+Signed-off-by: Michael S. Tsirkin <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=56fc1e6ac6bde95bc0369d358587f2234d4dddad
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ hw/i386/intel_iommu.c          | 92 +++++++++++++++++++++++++++-------
+ hw/i386/intel_iommu_internal.h |  1 +
+ 2 files changed, 74 insertions(+), 19 deletions(-)
+
+diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
+index 609b80750a..a523ef0e65 100644
+--- a/hw/i386/intel_iommu.c
++++ b/hw/i386/intel_iommu.c
+@@ -686,9 +686,18 @@ static inline bool vtd_pe_type_check(X86IOMMUState *x86_iommu,
+     return true;
+ }
+ 
+-static int vtd_get_pasid_dire(dma_addr_t pasid_dir_base,
+-                              uint32_t pasid,
+-                              VTDPASIDDirEntry *pdire)
++static inline bool vtd_pdire_present(VTDPASIDDirEntry *pdire)
++{
++    return pdire->val & 1;
++}
++
++/**
++ * Caller of this function should check present bit if wants
++ * to use pdir entry for futher usage except for fpd bit check.
++ */
++static int vtd_get_pdire_from_pdir_table(dma_addr_t pasid_dir_base,
++                                         uint32_t pasid,
++                                         VTDPASIDDirEntry *pdire)
+ {
+     uint32_t index;
+     dma_addr_t addr, entry_size;
+@@ -703,18 +712,22 @@ static int vtd_get_pasid_dire(dma_addr_t pasid_dir_base,
+     return 0;
+ }
+ 
+-static int vtd_get_pasid_entry(IntelIOMMUState *s,
+-                               uint32_t pasid,
+-                               VTDPASIDDirEntry *pdire,
+-                               VTDPASIDEntry *pe)
++static inline bool vtd_pe_present(VTDPASIDEntry *pe)
++{
++    return pe->val[0] & VTD_PASID_ENTRY_P;
++}
++
++static int vtd_get_pe_in_pasid_leaf_table(IntelIOMMUState *s,
++                                          uint32_t pasid,
++                                          dma_addr_t addr,
++                                          VTDPASIDEntry *pe)
+ {
+     uint32_t index;
+-    dma_addr_t addr, entry_size;
++    dma_addr_t entry_size;
+     X86IOMMUState *x86_iommu = X86_IOMMU_DEVICE(s);
+ 
+     index = VTD_PASID_TABLE_INDEX(pasid);
+     entry_size = VTD_PASID_ENTRY_SIZE;
+-    addr = pdire->val & VTD_PASID_TABLE_BASE_ADDR_MASK;
+     addr = addr + index * entry_size;
+     if (dma_memory_read(&address_space_memory, addr, pe, entry_size)) {
+         return -VTD_FR_PASID_TABLE_INV;
+@@ -732,25 +745,54 @@ static int vtd_get_pasid_entry(IntelIOMMUState *s,
+     return 0;
+ }
+ 
+-static int vtd_get_pasid_entry_from_pasid(IntelIOMMUState *s,
+-                                          dma_addr_t pasid_dir_base,
+-                                          uint32_t pasid,
+-                                          VTDPASIDEntry *pe)
++/**
++ * Caller of this function should check present bit if wants
++ * to use pasid entry for futher usage except for fpd bit check.
++ */
++static int vtd_get_pe_from_pdire(IntelIOMMUState *s,
++                                 uint32_t pasid,
++                                 VTDPASIDDirEntry *pdire,
++                                 VTDPASIDEntry *pe)
++{
++    dma_addr_t addr = pdire->val & VTD_PASID_TABLE_BASE_ADDR_MASK;
++
++    return vtd_get_pe_in_pasid_leaf_table(s, pasid, addr, pe);
++}
++
++/**
++ * This function gets a pasid entry from a specified pasid
++ * table (includes dir and leaf table) with a specified pasid.
++ * Sanity check should be done to ensure return a present
++ * pasid entry to caller.
++ */
++static int vtd_get_pe_from_pasid_table(IntelIOMMUState *s,
++                                       dma_addr_t pasid_dir_base,
++                                       uint32_t pasid,
++                                       VTDPASIDEntry *pe)
+ {
+     int ret;
+     VTDPASIDDirEntry pdire;
+ 
+-    ret = vtd_get_pasid_dire(pasid_dir_base, pasid, &pdire);
++    ret = vtd_get_pdire_from_pdir_table(pasid_dir_base,
++                                        pasid, &pdire);
+     if (ret) {
+         return ret;
+     }
+ 
+-    ret = vtd_get_pasid_entry(s, pasid, &pdire, pe);
++    if (!vtd_pdire_present(&pdire)) {
++        return -VTD_FR_PASID_TABLE_INV;
++    }
++
++    ret = vtd_get_pe_from_pdire(s, pasid, &pdire, pe);
+     if (ret) {
+         return ret;
+     }
+ 
+-    return ret;
++    if (!vtd_pe_present(pe)) {
++        return -VTD_FR_PASID_TABLE_INV;
++    }
++
++    return 0;
+ }
+ 
+ static int vtd_ce_get_rid2pasid_entry(IntelIOMMUState *s,
+@@ -763,7 +805,7 @@ static int vtd_ce_get_rid2pasid_entry(IntelIOMMUState *s,
+ 
+     pasid = VTD_CE_GET_RID2PASID(ce);
+     pasid_dir_base = VTD_CE_GET_PASID_DIR_TABLE(ce);
+-    ret = vtd_get_pasid_entry_from_pasid(s, pasid_dir_base, pasid, pe);
++    ret = vtd_get_pe_from_pasid_table(s, pasid_dir_base, pasid, pe);
+ 
+     return ret;
+ }
+@@ -781,7 +823,11 @@ static int vtd_ce_get_pasid_fpd(IntelIOMMUState *s,
+     pasid = VTD_CE_GET_RID2PASID(ce);
+     pasid_dir_base = VTD_CE_GET_PASID_DIR_TABLE(ce);
+ 
+-    ret = vtd_get_pasid_dire(pasid_dir_base, pasid, &pdire);
++    /*
++     * No present bit check since fpd is meaningful even
++     * if the present bit is clear.
++     */
++    ret = vtd_get_pdire_from_pdir_table(pasid_dir_base, pasid, &pdire);
+     if (ret) {
+         return ret;
+     }
+@@ -791,7 +837,15 @@ static int vtd_ce_get_pasid_fpd(IntelIOMMUState *s,
+         return 0;
+     }
+ 
+-    ret = vtd_get_pasid_entry(s, pasid, &pdire, &pe);
++    if (!vtd_pdire_present(&pdire)) {
++        return -VTD_FR_PASID_TABLE_INV;
++    }
++
++    /*
++     * No present bit check since fpd is meaningful even
++     * if the present bit is clear.
++     */
++    ret = vtd_get_pe_from_pdire(s, pasid, &pdire, &pe);
+     if (ret) {
+         return ret;
+     }
+diff --git a/hw/i386/intel_iommu_internal.h b/hw/i386/intel_iommu_internal.h
+index edcf9fc9bb..862033ebe6 100644
+--- a/hw/i386/intel_iommu_internal.h
++++ b/hw/i386/intel_iommu_internal.h
+@@ -479,6 +479,7 @@ typedef struct VTDRootEntry VTDRootEntry;
+ #define VTD_PASID_ENTRY_FPD           (1ULL << 1) /* Fault Processing Disable */
+ 
+ /* PASID Granular Translation Type Mask */
++#define VTD_PASID_ENTRY_P              1ULL
+ #define VTD_SM_PASID_ENTRY_PGTT        (7ULL << 6)
+ #define VTD_SM_PASID_ENTRY_FLT         (1ULL << 6)
+ #define VTD_SM_PASID_ENTRY_SLT         (2ULL << 6)
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-iotests-add-test-for-backup-top-failure-on-permissio.patch b/debian/patches/stable/lp-1867519-iotests-add-test-for-backup-top-failure-on-permissio.patch
new file mode 100644
index 0000000..790c5d4
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-iotests-add-test-for-backup-top-failure-on-permissio.patch
@@ -0,0 +1,138 @@
+From a541fcc27c98b96da187c7d4573f3270f3ddd283 Mon Sep 17 00:00:00 2001
+From: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Date: Tue, 21 Jan 2020 17:28:02 +0300
+Subject: [PATCH] iotests: add test for backup-top failure on permission
+ activation
+
+This test checks that bug is really fixed by previous commit.
+
+Cc: [e-mail] # v4.2.0
+Signed-off-by: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Message-id: [e-mail]
+Signed-off-by: Max Reitz <[e-mail]>
+
+Origin: backport, https://git.qemu.org/?p=qemu.git;a=commit;h=a541fcc27c98b96da187c7d4573f3270f3ddd283
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ tests/qemu-iotests/283     | 92 ++++++++++++++++++++++++++++++++++++++
+ tests/qemu-iotests/283.out |  8 ++++
+ tests/qemu-iotests/group   |  1 +
+ 3 files changed, 101 insertions(+)
+ create mode 100644 tests/qemu-iotests/283
+ create mode 100644 tests/qemu-iotests/283.out
+
+--- /dev/null
++++ b/tests/qemu-iotests/283
+@@ -0,0 +1,92 @@
++#!/usr/bin/env python
++#
++# Test for backup-top filter permission activation failure
++#
++# Copyright (c) 2019 Virtuozzo International GmbH.
++#
++# This program is free software; you can redistribute it and/or modify
++# it under the terms of the GNU General Public License as published by
++# the Free Software Foundation; either version 2 of the License, or
++# (at your option) any later version.
++#
++# This program is distributed in the hope that it will be useful,
++# but WITHOUT ANY WARRANTY; without even the implied warranty of
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++# GNU General Public License for more details.
++#
++# You should have received a copy of the GNU General Public License
++# along with this program.  If not, see <http://www.gnu.org/licenses/>.
++#
++
++import iotests
++
++# The test is unrelated to formats, restrict it to qcow2 to avoid extra runs
++iotests.verify_image_format(supported_fmts=['qcow2'])
++
++size = 1024 * 1024
++
++""" Test description
++
++When performing a backup, all writes on the source subtree must go through the
++backup-top filter so it can copy all data to the target before it is changed.
++backup-top filter is appended above source node, to achieve this thing, so all
++parents of source node are handled. A configuration with side parents of source
++sub-tree with write permission is unsupported (we'd have append several
++backup-top filter like nodes to handle such parents). The test create an
++example of such configuration and checks that a backup is then not allowed
++(blockdev-backup command should fail).
++
++The configuration:
++
++    ┌────────┐  target  ┌─────────────┐
++    │ target │ ◀─────── │ backup_top  │
++    └────────┘          └─────────────┘
++                            │
++                            │ backing
++                            ▼
++                        ┌─────────────┐
++                        │   source    │
++                        └─────────────┘
++                            │
++                            │ file
++                            ▼
++                        ┌─────────────┐  write perm   ┌───────┐
++                        │    base     │ ◀──────────── │ other │
++                        └─────────────┘               └───────┘
++
++On activation (see .active field of backup-top state in block/backup-top.c),
++backup-top is going to unshare write permission on its source child. Write
++unsharing will be propagated to the "source->base" link and will conflict with
++other node write permission. So permission update will fail and backup job will
++not be started.
++
++Note, that the only thing which prevents backup of running on such
++configuration is default permission propagation scheme. It may be altered by
++different block drivers, so backup will run in invalid configuration. But
++something is better than nothing. Also, before the previous commit (commit
++preceding this test creation), starting backup on such configuration led to
++crash, so current "something" is a lot better, and this test actual goal is
++to check that crash is fixed :)
++"""
++
++vm = iotests.VM()
++vm.launch()
++
++vm.qmp_log('blockdev-add', **{'node-name': 'target', 'driver': 'null-co'})
++
++vm.qmp_log('blockdev-add', **{
++    'node-name': 'source',
++    'driver': 'blkdebug',
++    'image': {'node-name': 'base', 'driver': 'null-co', 'size': size}
++})
++
++vm.qmp_log('blockdev-add', **{
++    'node-name': 'other',
++    'driver': 'blkdebug',
++    'image': 'base',
++    'take-child-perms': ['write']
++})
++
++vm.qmp_log('blockdev-backup', sync='full', device='source', target='target')
++
++vm.shutdown()
+--- /dev/null
++++ b/tests/qemu-iotests/283.out
+@@ -0,0 +1,8 @@
++{"execute": "blockdev-add", "arguments": {"driver": "null-co", "node-name": "target"}}
++{"return": {}}
++{"execute": "blockdev-add", "arguments": {"driver": "blkdebug", "image": {"driver": "null-co", "node-name": "base", "size": 1048576}, "node-name": "source"}}
++{"return": {}}
++{"execute": "blockdev-add", "arguments": {"driver": "blkdebug", "image": "base", "node-name": "other", "take-child-perms": ["write"]}}
++{"return": {}}
++{"execute": "blockdev-backup", "arguments": {"device": "source", "sync": "full", "target": "target"}}
++{"error": {"class": "GenericError", "desc": "Cannot set permissions for backup-top filter: Conflicts with use by other as 'image', which uses 'write' on base"}}
+--- a/tests/qemu-iotests/group
++++ b/tests/qemu-iotests/group
+@@ -286,3 +286,4 @@
+ 272 rw
+ 273 backing quick
+ 277 rw quick
++283 auto quick
diff --git a/debian/patches/stable/lp-1867519-job-refactor-progress-to-separate-object.patch b/debian/patches/stable/lp-1867519-job-refactor-progress-to-separate-object.patch
new file mode 100644
index 0000000..a31cf9f
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-job-refactor-progress-to-separate-object.patch
@@ -0,0 +1,230 @@
+From 01fe1ca945345d3dc420d70c69488143dc0451b1 Mon Sep 17 00:00:00 2001
+From: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Date: Wed, 11 Mar 2020 13:29:56 +0300
+Subject: [PATCH] job: refactor progress to separate object
+
+We need it in separate to pass to the block-copy object in the next
+commit.
+
+Cc: [e-mail]
+Signed-off-by: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Reviewed-by: Andrey Shinkevich <[e-mail]>
+Reviewed-by: Max Reitz <[e-mail]>
+Message-Id: <[e-mail]>
+Signed-off-by: Max Reitz <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=01fe1ca945345d3dc420d70c69488143dc0451b1
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ blockjob.c                    | 16 +++++-----
+ include/qemu/job.h            | 11 ++-----
+ include/qemu/progress_meter.h | 58 +++++++++++++++++++++++++++++++++++
+ job-qmp.c                     |  4 +--
+ job.c                         |  6 ++--
+ qemu-img.c                    |  6 ++--
+ 6 files changed, 76 insertions(+), 25 deletions(-)
+ create mode 100644 include/qemu/progress_meter.h
+
+diff --git a/blockjob.c b/blockjob.c
+index 5d63b1e89d..fc850312c1 100644
+--- a/blockjob.c
++++ b/blockjob.c
+@@ -299,8 +299,8 @@ BlockJobInfo *block_job_query(BlockJob *job, Error **errp)
+     info->device    = g_strdup(job->job.id);
+     info->busy      = atomic_read(&job->job.busy);
+     info->paused    = job->job.pause_count > 0;
+-    info->offset    = job->job.progress_current;
+-    info->len       = job->job.progress_total;
++    info->offset    = job->job.progress.current;
++    info->len       = job->job.progress.total;
+     info->speed     = job->speed;
+     info->io_status = job->iostatus;
+     info->ready     = job_is_ready(&job->job),
+@@ -330,8 +330,8 @@ static void block_job_event_cancelled(Notifier *n, void *opaque)
+ 
+     qapi_event_send_block_job_cancelled(job_type(&job->job),
+                                         job->job.id,
+-                                        job->job.progress_total,
+-                                        job->job.progress_current,
++                                        job->job.progress.total,
++                                        job->job.progress.current,
+                                         job->speed);
+ }
+ 
+@@ -350,8 +350,8 @@ static void block_job_event_completed(Notifier *n, void *opaque)
+ 
+     qapi_event_send_block_job_completed(job_type(&job->job),
+                                         job->job.id,
+-                                        job->job.progress_total,
+-                                        job->job.progress_current,
++                                        job->job.progress.total,
++                                        job->job.progress.current,
+                                         job->speed,
+                                         !!msg,
+                                         msg);
+@@ -379,8 +379,8 @@ static void block_job_event_ready(Notifier *n, void *opaque)
+ 
+     qapi_event_send_block_job_ready(job_type(&job->job),
+                                     job->job.id,
+-                                    job->job.progress_total,
+-                                    job->job.progress_current,
++                                    job->job.progress.total,
++                                    job->job.progress.current,
+                                     job->speed);
+ }
+ 
+diff --git a/include/qemu/job.h b/include/qemu/job.h
+index bd59cd8944..32aabb1c60 100644
+--- a/include/qemu/job.h
++++ b/include/qemu/job.h
+@@ -28,6 +28,7 @@
+ 
+ #include "qapi/qapi-types-job.h"
+ #include "qemu/queue.h"
++#include "qemu/progress_meter.h"
+ #include "qemu/coroutine.h"
+ #include "block/aio.h"
+ 
+@@ -117,15 +118,7 @@ typedef struct Job {
+     /** True if this job should automatically dismiss itself */
+     bool auto_dismiss;
+ 
+-    /**
+-     * Current progress. The unit is arbitrary as long as the ratio between
+-     * progress_current and progress_total represents the estimated percentage
+-     * of work already done.
+-     */
+-    int64_t progress_current;
+-
+-    /** Estimated progress_current value at the completion of the job */
+-    int64_t progress_total;
++    ProgressMeter progress;
+ 
+     /**
+      * Return code from @run and/or @prepare callback(s).
+diff --git a/include/qemu/progress_meter.h b/include/qemu/progress_meter.h
+new file mode 100644
+index 0000000000..9a23ff071c
+--- /dev/null
++++ b/include/qemu/progress_meter.h
+@@ -0,0 +1,58 @@
++/*
++ * Helper functionality for some process progress tracking.
++ *
++ * Copyright (c) 2011 IBM Corp.
++ * Copyright (c) 2012, 2018 Red Hat, Inc.
++ * Copyright (c) 2020 Virtuozzo International GmbH
++ *
++ * Permission is hereby granted, free of charge, to any person obtaining a copy
++ * of this software and associated documentation files (the "Software"), to deal
++ * in the Software without restriction, including without limitation the rights
++ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
++ * copies of the Software, and to permit persons to whom the Software is
++ * furnished to do so, subject to the following conditions:
++ *
++ * The above copyright notice and this permission notice shall be included in
++ * all copies or substantial portions of the Software.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
++ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
++ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
++ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
++ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
++ * THE SOFTWARE.
++ */
++
++#ifndef QEMU_PROGRESS_METER_H
++#define QEMU_PROGRESS_METER_H
++
++typedef struct ProgressMeter {
++    /**
++     * Current progress. The unit is arbitrary as long as the ratio between
++     * current and total represents the estimated percentage
++     * of work already done.
++     */
++    uint64_t current;
++
++    /** Estimated current value at the completion of the process */
++    uint64_t total;
++} ProgressMeter;
++
++static inline void progress_work_done(ProgressMeter *pm, uint64_t done)
++{
++    pm->current += done;
++}
++
++static inline void progress_set_remaining(ProgressMeter *pm, uint64_t remaining)
++{
++    pm->total = pm->current + remaining;
++}
++
++static inline void progress_increase_remaining(ProgressMeter *pm,
++                                               uint64_t delta)
++{
++    pm->total += delta;
++}
++
++#endif /* QEMU_PROGRESS_METER_H */
+diff --git a/job-qmp.c b/job-qmp.c
+index fbfed25a00..fecc939ebd 100644
+--- a/job-qmp.c
++++ b/job-qmp.c
+@@ -143,8 +143,8 @@ static JobInfo *job_query_single(Job *job, Error **errp)
+         .id                 = g_strdup(job->id),
+         .type               = job_type(job),
+         .status             = job->status,
+-        .current_progress   = job->progress_current,
+-        .total_progress     = job->progress_total,
++        .current_progress   = job->progress.current,
++        .total_progress     = job->progress.total,
+         .has_error          = !!job->err,
+         .error              = job->err ? \
+                               g_strdup(error_get_pretty(job->err)) : NULL,
+diff --git a/job.c b/job.c
+index 04409b40aa..134a07b92e 100644
+--- a/job.c
++++ b/job.c
+@@ -369,17 +369,17 @@ void job_unref(Job *job)
+ 
+ void job_progress_update(Job *job, uint64_t done)
+ {
+-    job->progress_current += done;
++    progress_work_done(&job->progress, done);
+ }
+ 
+ void job_progress_set_remaining(Job *job, uint64_t remaining)
+ {
+-    job->progress_total = job->progress_current + remaining;
++    progress_set_remaining(&job->progress, remaining);
+ }
+ 
+ void job_progress_increase_remaining(Job *job, uint64_t delta)
+ {
+-    job->progress_total += delta;
++    progress_increase_remaining(&job->progress, delta);
+ }
+ 
+ void job_event_cancelled(Job *job)
+diff --git a/qemu-img.c b/qemu-img.c
+index 7b7087dd60..afddf33f08 100644
+--- a/qemu-img.c
++++ b/qemu-img.c
+@@ -884,9 +884,9 @@ static void run_block_job(BlockJob *job, Error **errp)
+     do {
+         float progress = 0.0f;
+         aio_poll(aio_context, true);
+-        if (job->job.progress_total) {
+-            progress = (float)job->job.progress_current /
+-                       job->job.progress_total * 100.f;
++        if (job->job.progress.total) {
++            progress = (float)job->job.progress.current /
++                       job->job.progress.total * 100.f;
+         }
+         qemu_progress_print(progress, 0);
+     } while (!job_is_ready(&job->job) && !job_is_completed(&job->job));
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-plugins-core-add-missing-break-in-cb_to_tcg_flags.patch b/debian/patches/stable/lp-1867519-plugins-core-add-missing-break-in-cb_to_tcg_flags.patch
new file mode 100644
index 0000000..5047c62
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-plugins-core-add-missing-break-in-cb_to_tcg_flags.patch
@@ -0,0 +1,41 @@
+From dcc474c69e6a59044b9bb54624bd636cbfd98aa9 Mon Sep 17 00:00:00 2001
+From: "Emilio G. Cota" <[e-mail]>
+Date: Tue, 25 Feb 2020 12:47:02 +0000
+Subject: [PATCH] plugins/core: add missing break in cb_to_tcg_flags
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Fixes: 54cb65d8588
+Reported-by: Robert Henry <[e-mail]>
+Signed-off-by: Emilio G. Cota <[e-mail]>
+Signed-off-by: Alex Bennée <[e-mail]>
+Reviewed-by: Richard Henderson <[e-mail]>
+Reviewed-by: Philippe Mathieu-Daudé <[e-mail]>
+Message-Id: <[e-mail]>
+Cc: [e-mail]
+Message-Id: <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=dcc474c69e6a59044b9bb54624bd636cbfd98aa9
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ plugins/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/plugins/core.c b/plugins/core.c
+index 9e1b9e7a91..ed863011ba 100644
+--- a/plugins/core.c
++++ b/plugins/core.c
+@@ -286,6 +286,7 @@ static inline uint32_t cb_to_tcg_flags(enum qemu_plugin_cb_flags flags)
+     switch (flags) {
+     case QEMU_PLUGIN_CB_RW_REGS:
+         ret = 0;
++        break;
+     case QEMU_PLUGIN_CB_R_REGS:
+         ret = TCG_CALL_NO_WG;
+         break;
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-qcow2-Fix-alloc_cluster_abort-for-pre-existing-clust.patch b/debian/patches/stable/lp-1867519-qcow2-Fix-alloc_cluster_abort-for-pre-existing-clust.patch
new file mode 100644
index 0000000..ed7560a
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-qcow2-Fix-alloc_cluster_abort-for-pre-existing-clust.patch
@@ -0,0 +1,39 @@
+From 3ede935fdbbd5f7b24b4724bbfb8938acb5956d8 Mon Sep 17 00:00:00 2001
+From: Max Reitz <[e-mail]>
+Date: Tue, 25 Feb 2020 15:31:28 +0100
+Subject: [PATCH] qcow2: Fix alloc_cluster_abort() for pre-existing clusters
+
+handle_alloc() reuses preallocated zero clusters.  If anything goes
+wrong during the data write, we do not change their L2 entry, so we
+must not let qcow2_alloc_cluster_abort() free them.
+
+Fixes: 8b24cd141549b5b264baeddd4e72902cfb5de23b
+Cc: [e-mail]
+Signed-off-by: Max Reitz <[e-mail]>
+Message-Id: <[e-mail]>
+Signed-off-by: Kevin Wolf <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=3ede935fdbbd5f7b24b4724bbfb8938acb5956d8
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ block/qcow2-cluster.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c
+index 78c95dfa16..17f1363279 100644
+--- a/block/qcow2-cluster.c
++++ b/block/qcow2-cluster.c
+@@ -1026,7 +1026,7 @@ err:
+ void qcow2_alloc_cluster_abort(BlockDriverState *bs, QCowL2Meta *m)
+ {
+     BDRVQcow2State *s = bs->opaque;
+-    if (!has_data_file(bs)) {
++    if (!has_data_file(bs) && !m->keep_old_clusters) {
+         qcow2_free_clusters(bs, m->alloc_offset,
+                             m->nb_clusters << s->cluster_bits,
+                             QCOW2_DISCARD_NEVER);
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-qcow2-Fix-qcow2_alloc_cluster_abort-for-external-dat.patch b/debian/patches/stable/lp-1867519-qcow2-Fix-qcow2_alloc_cluster_abort-for-external-dat.patch
new file mode 100644
index 0000000..b7acd5b
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-qcow2-Fix-qcow2_alloc_cluster_abort-for-external-dat.patch
@@ -0,0 +1,44 @@
+From c3b6658c1a5a3fb24d6c27b2594cf86146f75b22 Mon Sep 17 00:00:00 2001
+From: Kevin Wolf <[e-mail]>
+Date: Tue, 11 Feb 2020 10:48:59 +0100
+Subject: [PATCH] qcow2: Fix qcow2_alloc_cluster_abort() for external data file
+
+For external data file, cluster allocations return an offset in the data
+file and are not refcounted. In this case, there is nothing to do for
+qcow2_alloc_cluster_abort(). Freeing the same offset in the qcow2 file
+is wrong and causes crashes in the better case or image corruption in
+the worse case.
+
+Signed-off-by: Kevin Wolf <[e-mail]>
+Message-Id: <[e-mail]>
+Signed-off-by: Kevin Wolf <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=c3b6658c1a5a3fb24d6c27b2594cf86146f75b22
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ block/qcow2-cluster.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c
+index 1947f13a2d..78c95dfa16 100644
+--- a/block/qcow2-cluster.c
++++ b/block/qcow2-cluster.c
+@@ -1026,8 +1026,11 @@ err:
+ void qcow2_alloc_cluster_abort(BlockDriverState *bs, QCowL2Meta *m)
+ {
+     BDRVQcow2State *s = bs->opaque;
+-    qcow2_free_clusters(bs, m->alloc_offset, m->nb_clusters << s->cluster_bits,
+-                        QCOW2_DISCARD_NEVER);
++    if (!has_data_file(bs)) {
++        qcow2_free_clusters(bs, m->alloc_offset,
++                            m->nb_clusters << s->cluster_bits,
++                            QCOW2_DISCARD_NEVER);
++    }
+ }
+ 
+ /*
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-qcow2-bitmaps-fix-qcow2_can_store_new_dirty_bitmap.patch b/debian/patches/stable/lp-1867519-qcow2-bitmaps-fix-qcow2_can_store_new_dirty_bitmap.patch
new file mode 100644
index 0000000..b1b1869
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-qcow2-bitmaps-fix-qcow2_can_store_new_dirty_bitmap.patch
@@ -0,0 +1,102 @@
+From a1db8733d28d615bc0daeada6c406a6dd5c5d5ef Mon Sep 17 00:00:00 2001
+From: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Date: Mon, 14 Oct 2019 14:51:25 +0300
+Subject: [PATCH] qcow2-bitmaps: fix qcow2_can_store_new_dirty_bitmap
+
+qcow2_can_store_new_dirty_bitmap works wrong, as it considers only
+bitmaps already stored in the qcow2 image and ignores persistent
+BdrvDirtyBitmap objects.
+
+So, let's instead count persistent BdrvDirtyBitmaps. We load all qcow2
+bitmaps on open, so there should not be any bitmap in the image for
+which we don't have BdrvDirtyBitmaps version. If it is - it's a kind of
+corruption, and no reason to check for corruptions here (open() and
+close() are better places for it).
+
+Signed-off-by: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Message-id: [e-mail]
+Reviewed-by: Max Reitz <[e-mail]>
+Cc: [e-mail]
+Signed-off-by: Max Reitz <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=a1db8733d28d615bc0daeada6c406a6dd5c5d5ef
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ block/qcow2-bitmap.c | 41 ++++++++++++++++++-----------------------
+ 1 file changed, 18 insertions(+), 23 deletions(-)
+
+diff --git a/block/qcow2-bitmap.c b/block/qcow2-bitmap.c
+index c6c8ebbe89..d41f5d049b 100644
+--- a/block/qcow2-bitmap.c
++++ b/block/qcow2-bitmap.c
+@@ -1703,8 +1703,14 @@ bool coroutine_fn qcow2_co_can_store_new_dirty_bitmap(BlockDriverState *bs,
+                                                       Error **errp)
+ {
+     BDRVQcow2State *s = bs->opaque;
+-    bool found;
+-    Qcow2BitmapList *bm_list;
++    BdrvDirtyBitmap *bitmap;
++    uint64_t bitmap_directory_size = 0;
++    uint32_t nb_bitmaps = 0;
++
++    if (bdrv_find_dirty_bitmap(bs, name)) {
++        error_setg(errp, "Bitmap already exists: %s", name);
++        return false;
++    }
+ 
+     if (s->qcow_version < 3) {
+         /* Without autoclear_features, we would always have to assume
+@@ -1720,38 +1726,27 @@ bool coroutine_fn qcow2_co_can_store_new_dirty_bitmap(BlockDriverState *bs,
+         goto fail;
+     }
+ 
+-    if (s->nb_bitmaps == 0) {
+-        return true;
++    FOR_EACH_DIRTY_BITMAP(bs, bitmap) {
++        if (bdrv_dirty_bitmap_get_persistence(bitmap)) {
++            nb_bitmaps++;
++            bitmap_directory_size +=
++                calc_dir_entry_size(strlen(bdrv_dirty_bitmap_name(bitmap)), 0);
++        }
+     }
++    nb_bitmaps++;
++    bitmap_directory_size += calc_dir_entry_size(strlen(name), 0);
+ 
+-    if (s->nb_bitmaps >= QCOW2_MAX_BITMAPS) {
++    if (nb_bitmaps > QCOW2_MAX_BITMAPS) {
+         error_setg(errp,
+                    "Maximum number of persistent bitmaps is already reached");
+         goto fail;
+     }
+ 
+-    if (s->bitmap_directory_size + calc_dir_entry_size(strlen(name), 0) >
+-        QCOW2_MAX_BITMAP_DIRECTORY_SIZE)
+-    {
++    if (bitmap_directory_size > QCOW2_MAX_BITMAP_DIRECTORY_SIZE) {
+         error_setg(errp, "Not enough space in the bitmap directory");
+         goto fail;
+     }
+ 
+-    qemu_co_mutex_lock(&s->lock);
+-    bm_list = bitmap_list_load(bs, s->bitmap_directory_offset,
+-                               s->bitmap_directory_size, errp);
+-    qemu_co_mutex_unlock(&s->lock);
+-    if (bm_list == NULL) {
+-        goto fail;
+-    }
+-
+-    found = find_bitmap_by_name(bm_list, name);
+-    bitmap_list_free(bm_list);
+-    if (found) {
+-        error_setg(errp, "Bitmap with the same name is already stored");
+-        goto fail;
+-    }
+-
+     return true;
+ 
+ fail:
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-qemu-img-Fix-convert-n-B-for-backing-less-targets.patch b/debian/patches/stable/lp-1867519-qemu-img-Fix-convert-n-B-for-backing-less-targets.patch
new file mode 100644
index 0000000..ed8ab96
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-qemu-img-Fix-convert-n-B-for-backing-less-targets.patch
@@ -0,0 +1,54 @@
+From c69291e712ae4ef95f628424db6586473da61d43 Mon Sep 17 00:00:00 2001
+From: Max Reitz <[e-mail]>
+Date: Tue, 21 Jan 2020 16:59:14 +0100
+Subject: [PATCH] qemu-img: Fix convert -n -B for backing-less targets
+
+s.target_has_backing does not reflect whether the target BDS has a
+backing file; it only tells whether we should use a backing file during
+conversion (specified by -B).
+
+As such, if you use convert -n, the target does not necessarily actually
+have a backing file, and then dereferencing out_bs->backing fails here.
+
+When converting to an existing file, we should set
+target_backing_sectors to a negative value, because first, as the
+comment explains, this value is only used for optimization, so it is
+always fine to do that.
+
+Second, we use this value to determine where the target must be
+initialized to zeroes (overlays are initialized to zero after the end of
+their backing file).  When converting to an existing file, we cannot
+assume that to be true.
+
+Cc: [e-mail]
+Fixes: 351c8efff9ad809c822d55620df54d575d536f68
+       ("qemu-img: Special post-backing convert handling")
+Signed-off-by: Max Reitz <[e-mail]>
+Message-Id: <[e-mail]>
+Reviewed-by: John Snow <[e-mail]>
+Signed-off-by: Max Reitz <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=c69291e712ae4ef95f628424db6586473da61d43
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ qemu-img.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/qemu-img.c b/qemu-img.c
+index 0faf2cd2f5..804630a368 100644
+--- a/qemu-img.c
++++ b/qemu-img.c
+@@ -2523,7 +2523,7 @@ static int img_convert(int argc, char **argv)
+         }
+     }
+ 
+-    if (s.target_has_backing) {
++    if (s.target_has_backing && s.target_is_new) {
+         /* Errors are treated as "backing length unknown" (which means
+          * s.target_backing_sectors has to be negative, which it will
+          * be automatically).  The backing file length is used only
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-s390-sclp-improve-special-wait-psw-logic.patch b/debian/patches/stable/lp-1867519-s390-sclp-improve-special-wait-psw-logic.patch
new file mode 100644
index 0000000..fb21432
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-s390-sclp-improve-special-wait-psw-logic.patch
@@ -0,0 +1,40 @@
+From 8b51c0961cc13e55b26bb6665ec3a341abdc7658 Mon Sep 17 00:00:00 2001
+From: Christian Borntraeger <[e-mail]>
+Date: Thu, 20 Feb 2020 14:16:22 +0100
+Subject: [PATCH] s390/sclp: improve special wait psw logic
+
+There is a special quiesce PSW that we check for "shutdown". Otherwise disabled
+wait is detected as "crashed". Architecturally we must only check PSW bits
+116-127. Fix this.
+
+Cc: [e-mail]
+Signed-off-by: Christian Borntraeger <[e-mail]>
+Message-Id: <[e-mail]>
+Reviewed-by: David Hildenbrand <[e-mail]>
+Acked-by: Janosch Frank <[e-mail]>
+Signed-off-by: Cornelia Huck <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=8b51c0961cc13e55b26bb6665ec3a341abdc7658
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ target/s390x/helper.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/target/s390x/helper.c b/target/s390x/helper.c
+index b810ad431e..ed72684911 100644
+--- a/target/s390x/helper.c
++++ b/target/s390x/helper.c
+@@ -89,7 +89,7 @@ hwaddr s390_cpu_get_phys_addr_debug(CPUState *cs, vaddr vaddr)
+ static inline bool is_special_wait_psw(uint64_t psw_addr)
+ {
+     /* signal quiesce */
+-    return psw_addr == 0xfffUL;
++    return (psw_addr & 0xfffUL) == 0xfffUL;
+ }
+ 
+ void s390_handle_wait(S390CPU *cpu)
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-target-arm-Return-correct-IL-bit-in-merge_syn_data_a.patch b/debian/patches/stable/lp-1867519-target-arm-Return-correct-IL-bit-in-merge_syn_data_a.patch
new file mode 100644
index 0000000..6c4bce9
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-target-arm-Return-correct-IL-bit-in-merge_syn_data_a.patch
@@ -0,0 +1,46 @@
+From 30d544839e278dc76017b9a42990c41e84a34377 Mon Sep 17 00:00:00 2001
+From: Jeff Kubascik <[e-mail]>
+Date: Fri, 17 Jan 2020 14:09:31 +0000
+Subject: [PATCH] target/arm: Return correct IL bit in merge_syn_data_abort
+
+The IL bit is set for 32-bit instructions, thus passing false
+with the is_16bit parameter to syn_data_abort_with_iss() makes
+a syn mask that always has the IL bit set.
+
+Pass is_16bit as true to make the initial syn mask have IL=0,
+so that the final IL value comes from or'ing template_syn.
+
+Cc: [e-mail]
+Fixes: aaa1f954d4ca ("target-arm: A64: Create Instruction Syndromes for Data Aborts")
+Signed-off-by: Jeff Kubascik <[e-mail]>
+Signed-off-by: Richard Henderson <[e-mail]>
+Message-id: [e-mail]
+[rth: Extracted this as a self-contained bug fix from a larger patch]
+Signed-off-by: Richard Henderson <[e-mail]>
+Reviewed-by: Peter Maydell <[e-mail]>
+Signed-off-by: Peter Maydell <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=30d544839e278dc76017b9a42990c41e84a34377
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ target/arm/tlb_helper.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/target/arm/tlb_helper.c b/target/arm/tlb_helper.c
+index 5feb312941..e63f8bda29 100644
+--- a/target/arm/tlb_helper.c
++++ b/target/arm/tlb_helper.c
+@@ -44,7 +44,7 @@ static inline uint32_t merge_syn_data_abort(uint32_t template_syn,
+         syn = syn_data_abort_with_iss(same_el,
+                                       0, 0, 0, 0, 0,
+                                       ea, 0, s1ptw, is_write, fsc,
+-                                      false);
++                                      true);
+         /* Merge the runtime syndrome with the template syndrome.  */
+         syn |= template_syn;
+     }
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-target-arm-Set-ISSIs16Bit-in-make_issinfo.patch b/debian/patches/stable/lp-1867519-target-arm-Set-ISSIs16Bit-in-make_issinfo.patch
new file mode 100644
index 0000000..46f0f6d
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-target-arm-Set-ISSIs16Bit-in-make_issinfo.patch
@@ -0,0 +1,42 @@
+From 1a1fbc6cbb34c26d43d8360c66c1d21681af14a9 Mon Sep 17 00:00:00 2001
+From: Richard Henderson <[e-mail]>
+Date: Fri, 17 Jan 2020 14:09:31 +0000
+Subject: [PATCH] target/arm: Set ISSIs16Bit in make_issinfo
+
+During the conversion to decodetree, the setting of
+ISSIs16Bit got lost.  This causes the guest os to
+incorrectly adjust trapping memory operations.
+
+Cc: [e-mail]
+Fixes: 46beb58efbb8a2a32 ("target/arm: Convert T16, load (literal)")
+Reported-by: Jeff Kubascik <[e-mail]>
+Signed-off-by: Richard Henderson <[e-mail]>
+Message-id: [e-mail]
+Reviewed-by: Peter Maydell <[e-mail]>
+Signed-off-by: Peter Maydell <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=1a1fbc6cbb34c26d43d8360c66c1d21681af14a9
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ target/arm/translate.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index 0c8624fb42..2f4aea927f 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -8556,6 +8556,9 @@ static ISSInfo make_issinfo(DisasContext *s, int rd, bool p, bool w)
+     /* ISS not valid if writeback */
+     if (p && !w) {
+         ret = rd;
++        if (s->base.pc_next - s->pc_curr == 2) {
++            ret |= ISSIs16Bit;
++        }
+     } else {
+         ret = ISSInvalid;
+     }
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-target-arm-arm-semi-fix-SYS_OPEN-to-return-nonzero-f.patch b/debian/patches/stable/lp-1867519-target-arm-arm-semi-fix-SYS_OPEN-to-return-nonzero-f.patch
new file mode 100644
index 0000000..4f7a731
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-target-arm-arm-semi-fix-SYS_OPEN-to-return-nonzero-f.patch
@@ -0,0 +1,79 @@
+From 21bf9b06cb6d07c6cc437dfd47b47b28c2bb79db Mon Sep 17 00:00:00 2001
+From: Masahiro Yamada <[e-mail]>
+Date: Fri, 17 Jan 2020 14:09:30 +0000
+Subject: [PATCH] target/arm/arm-semi: fix SYS_OPEN to return nonzero
+ filehandle
+
+According to the specification "Semihosting for AArch32 and Aarch64",
+the SYS_OPEN operation should return:
+
+ - A nonzero handle if the call is successful
+ - -1 if the call is not successful
+
+So, it should never return 0.
+
+Prior to commit 35e9a0a8ce4b ("target/arm/arm-semi: Make semihosting
+code hand out its own file descriptors"), the guest fd matched to the
+host fd. It returned a nonzero handle on success since the fd 0 is
+already used for stdin.
+
+Now that the guest fd is the index of guestfd_array, it starts from 0.
+
+I noticed this issue particularly because Trusted Firmware-A built with
+PLAT=qemu is no longer working. Its io_semihosting driver only handles
+a positive return value as a valid filehandle.
+
+Basically, there are two ways to fix this:
+
+  - Use (guestfd - 1) as the index of guestfs_arrary. We need to insert
+    increment/decrement to convert the guestfd and the array index back
+    and forth.
+
+  - Keep using guestfd as the index of guestfs_array. The first entry
+    of guestfs_array is left unused.
+
+I thought the latter is simpler. We end up with wasting a small piece
+of memory for the unused first entry of guestfd_array, but this is
+probably not a big deal.
+
+Fixes: 35e9a0a8ce4b ("target/arm/arm-semi: Make semihosting code hand out its own file descriptors")
+Cc: [e-mail]
+Signed-off-by: Masahiro Yamada <[e-mail]>
+Reviewed-by: Richard Henderson <[e-mail]>
+Message-id: [e-mail]
+Signed-off-by: Peter Maydell <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=21bf9b06cb6d07c6cc437dfd47b47b28c2bb79db
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ target/arm/arm-semi.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
+index 47d61f6fe1..788fe61b51 100644
+--- a/target/arm/arm-semi.c
++++ b/target/arm/arm-semi.c
+@@ -144,7 +144,8 @@ static int alloc_guestfd(void)
+         guestfd_array = g_array_new(FALSE, TRUE, sizeof(GuestFD));
+     }
+ 
+-    for (i = 0; i < guestfd_array->len; i++) {
++    /* SYS_OPEN should return nonzero handle on success. Start guestfd from 1 */
++    for (i = 1; i < guestfd_array->len; i++) {
+         GuestFD *gf = &g_array_index(guestfd_array, GuestFD, i);
+ 
+         if (gf->type == GuestFDUnused) {
+@@ -168,7 +169,7 @@ static GuestFD *do_get_guestfd(int guestfd)
+         return NULL;
+     }
+ 
+-    if (guestfd < 0 || guestfd >= guestfd_array->len) {
++    if (guestfd <= 0 || guestfd >= guestfd_array->len) {
+         return NULL;
+     }
+ 
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-target-arm-ensure-we-use-current-exception-state-aft.patch b/debian/patches/stable/lp-1867519-target-arm-ensure-we-use-current-exception-state-aft.patch
new file mode 100644
index 0000000..896de43
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-target-arm-ensure-we-use-current-exception-state-aft.patch
@@ -0,0 +1,127 @@
+From f80741d107673f162e3b097fc76a1590036cc9d1 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <[e-mail]>
+Date: Thu, 12 Dec 2019 11:47:34 +0000
+Subject: [PATCH] target/arm: ensure we use current exception state after SCR
+ update
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+A write to the SCR can change the effective EL by droppping the system
+from secure to non-secure mode. However if we use a cached current_el
+from before the change we'll rebuild the flags incorrectly. To fix
+this we introduce the ARM_CP_NEWEL CP flag to indicate the new EL
+should be used when recomputing the flags.
+
+Signed-off-by: Alex Bennée <[e-mail]>
+Tested-by: Philippe Mathieu-Daudé <[e-mail]>
+Reviewed-by: Richard Henderson <[e-mail]>
+Message-id: [e-mail]
+Cc: Richard Henderson <[e-mail]>
+Message-Id: <[e-mail]>
+Cc: [e-mail]
+Signed-off-by: Peter Maydell <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=f80741d107673f162e3b097fc76a1590036cc9d1
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ target/arm/cpu.h       |  8 ++++++--
+ target/arm/helper.c    | 14 +++++++++++++-
+ target/arm/helper.h    |  1 +
+ target/arm/translate.c |  6 +++++-
+ 4 files changed, 25 insertions(+), 4 deletions(-)
+
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index 4106e4ae59..5f70e9e043 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -2238,6 +2238,9 @@ static inline uint64_t cpreg_to_kvm_id(uint32_t cpregid)
+  * RAISES_EXC is for when the read or write hook might raise an exception;
+  * the generated code will synchronize the CPU state before calling the hook
+  * so that it is safe for the hook to call raise_exception().
++ * NEWEL is for writes to registers that might change the exception
++ * level - typically on older ARM chips. For those cases we need to
++ * re-read the new el when recomputing the translation flags.
+  */
+ #define ARM_CP_SPECIAL           0x0001
+ #define ARM_CP_CONST             0x0002
+@@ -2257,10 +2260,11 @@ static inline uint64_t cpreg_to_kvm_id(uint32_t cpregid)
+ #define ARM_CP_SVE               0x2000
+ #define ARM_CP_NO_GDB            0x4000
+ #define ARM_CP_RAISES_EXC        0x8000
++#define ARM_CP_NEWEL             0x10000
+ /* Used only as a terminator for ARMCPRegInfo lists */
+-#define ARM_CP_SENTINEL          0xffff
++#define ARM_CP_SENTINEL          0xfffff
+ /* Mask of only the flag bits in a type field */
+-#define ARM_CP_FLAG_MASK         0xf0ff
++#define ARM_CP_FLAG_MASK         0x1f0ff
+ 
+ /* Valid values for ARMCPRegInfo state field, indicating which of
+  * the AArch32 and AArch64 execution states this register is visible in.
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index 3a93844a3b..5074b5f69c 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -5133,7 +5133,7 @@ static const ARMCPRegInfo el3_cp_reginfo[] = {
+       .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 1, .opc2 = 0,
+       .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.scr_el3),
+       .resetvalue = 0, .writefn = scr_write },
+-    { .name = "SCR",  .type = ARM_CP_ALIAS,
++    { .name = "SCR",  .type = ARM_CP_ALIAS | ARM_CP_NEWEL,
+       .cp = 15, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 0,
+       .access = PL1_RW, .accessfn = access_trap_aa32s_el1,
+       .fieldoffset = offsetoflow32(CPUARMState, cp15.scr_el3),
+@@ -11472,6 +11472,18 @@ void HELPER(rebuild_hflags_m32)(CPUARMState *env, int el)
+     env->hflags = rebuild_hflags_m32(env, fp_el, mmu_idx);
+ }
+ 
++/*
++ * If we have triggered a EL state change we can't rely on the
++ * translator having passed it too us, we need to recompute.
++ */
++void HELPER(rebuild_hflags_a32_newel)(CPUARMState *env)
++{
++    int el = arm_current_el(env);
++    int fp_el = fp_exception_el(env, el);
++    ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, el);
++    env->hflags = rebuild_hflags_a32(env, fp_el, mmu_idx);
++}
++
+ void HELPER(rebuild_hflags_a32)(CPUARMState *env, int el)
+ {
+     int fp_el = fp_exception_el(env, el);
+diff --git a/target/arm/helper.h b/target/arm/helper.h
+index 7ce5169afb..aa3d8cd08f 100644
+--- a/target/arm/helper.h
++++ b/target/arm/helper.h
+@@ -91,6 +91,7 @@ DEF_HELPER_2(get_user_reg, i32, env, i32)
+ DEF_HELPER_3(set_user_reg, void, env, i32, i32)
+ 
+ DEF_HELPER_FLAGS_2(rebuild_hflags_m32, TCG_CALL_NO_RWG, void, env, int)
++DEF_HELPER_FLAGS_1(rebuild_hflags_a32_newel, TCG_CALL_NO_RWG, void, env)
+ DEF_HELPER_FLAGS_2(rebuild_hflags_a32, TCG_CALL_NO_RWG, void, env, int)
+ DEF_HELPER_FLAGS_2(rebuild_hflags_a64, TCG_CALL_NO_RWG, void, env, int)
+ 
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index f162be8434..2b6c1f91bf 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -7083,7 +7083,11 @@ static int disas_coproc_insn(DisasContext *s, uint32_t insn)
+             if (arm_dc_feature(s, ARM_FEATURE_M)) {
+                 gen_helper_rebuild_hflags_m32(cpu_env, tcg_el);
+             } else {
+-                gen_helper_rebuild_hflags_a32(cpu_env, tcg_el);
++                if (ri->type & ARM_CP_NEWEL) {
++                    gen_helper_rebuild_hflags_a32_newel(cpu_env);
++                } else {
++                    gen_helper_rebuild_hflags_a32(cpu_env, tcg_el);
++                }
+             }
+             tcg_temp_free_i32(tcg_el);
+             /*
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-target-i386-kvm-initialize-feature-MSRs-very-early.patch b/debian/patches/stable/lp-1867519-target-i386-kvm-initialize-feature-MSRs-very-early.patch
new file mode 100644
index 0000000..9316575
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-target-i386-kvm-initialize-feature-MSRs-very-early.patch
@@ -0,0 +1,169 @@
+From 420ae1fc51c99abfd03b1c590f55617edd2a2bed Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <[e-mail]>
+Date: Mon, 20 Jan 2020 19:21:42 +0100
+Subject: [PATCH] target/i386: kvm: initialize feature MSRs very early
+
+Some read-only MSRs affect the behavior of ioctls such as
+KVM_SET_NESTED_STATE.  We can initialize them once and for all
+right after the CPU is realized, since they will never be modified
+by the guest.
+
+Reported-by: Qingua Cheng <[e-mail]>
+Cc: [e-mail]
+Signed-off-by: Paolo Bonzini <[e-mail]>
+Message-Id: <[e-mail]>
+Signed-off-by: Paolo Bonzini <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=420ae1fc51c99abfd03b1c590f55617edd2a2bed
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ target/i386/kvm.c      | 81 +++++++++++++++++++++++++-----------------
+ target/i386/kvm_i386.h |  1 +
+ 2 files changed, 49 insertions(+), 33 deletions(-)
+
+diff --git a/target/i386/kvm.c b/target/i386/kvm.c
+index 7ee3202634..f6dd6b790e 100644
+--- a/target/i386/kvm.c
++++ b/target/i386/kvm.c
+@@ -67,6 +67,8 @@
+  * 255 kvm_msr_entry structs */
+ #define MSR_BUF_SIZE 4096
+ 
++static void kvm_init_msrs(X86CPU *cpu);
++
+ const KVMCapabilityInfo kvm_arch_required_capabilities[] = {
+     KVM_CAP_INFO(SET_TSS_ADDR),
+     KVM_CAP_INFO(EXT_CPUID),
+@@ -1842,6 +1844,8 @@ int kvm_arch_init_vcpu(CPUState *cs)
+         has_msr_tsc_aux = false;
+     }
+ 
++    kvm_init_msrs(cpu);
++
+     r = hyperv_init_vcpu(cpu);
+     if (r) {
+         goto fail;
+@@ -2660,11 +2664,53 @@ static void kvm_msr_entry_add_vmx(X86CPU *cpu, FeatureWordArray f)
+                       VMCS12_MAX_FIELD_INDEX << 1);
+ }
+ 
++static int kvm_buf_set_msrs(X86CPU *cpu)
++{
++    int ret = kvm_vcpu_ioctl(CPU(cpu), KVM_SET_MSRS, cpu->kvm_msr_buf);
++    if (ret < 0) {
++        return ret;
++    }
++
++    if (ret < cpu->kvm_msr_buf->nmsrs) {
++        struct kvm_msr_entry *e = &cpu->kvm_msr_buf->entries[ret];
++        error_report("error: failed to set MSR 0x%" PRIx32 " to 0x%" PRIx64,
++                     (uint32_t)e->index, (uint64_t)e->data);
++    }
++
++    assert(ret == cpu->kvm_msr_buf->nmsrs);
++    return 0;
++}
++
++static void kvm_init_msrs(X86CPU *cpu)
++{
++    CPUX86State *env = &cpu->env;
++
++    kvm_msr_buf_reset(cpu);
++    if (has_msr_arch_capabs) {
++        kvm_msr_entry_add(cpu, MSR_IA32_ARCH_CAPABILITIES,
++                          env->features[FEAT_ARCH_CAPABILITIES]);
++    }
++
++    if (has_msr_core_capabs) {
++        kvm_msr_entry_add(cpu, MSR_IA32_CORE_CAPABILITY,
++                          env->features[FEAT_CORE_CAPABILITY]);
++    }
++
++    /*
++     * Older kernels do not include VMX MSRs in KVM_GET_MSR_INDEX_LIST, but
++     * all kernels with MSR features should have them.
++     */
++    if (kvm_feature_msrs && cpu_has_vmx(env)) {
++        kvm_msr_entry_add_vmx(cpu, env->features);
++    }
++
++    assert(kvm_buf_set_msrs(cpu) == 0);
++}
++
+ static int kvm_put_msrs(X86CPU *cpu, int level)
+ {
+     CPUX86State *env = &cpu->env;
+     int i;
+-    int ret;
+ 
+     kvm_msr_buf_reset(cpu);
+ 
+@@ -2722,17 +2768,6 @@ static int kvm_put_msrs(X86CPU *cpu, int level)
+     }
+ #endif
+ 
+-    /* If host supports feature MSR, write down. */
+-    if (has_msr_arch_capabs) {
+-        kvm_msr_entry_add(cpu, MSR_IA32_ARCH_CAPABILITIES,
+-                          env->features[FEAT_ARCH_CAPABILITIES]);
+-    }
+-
+-    if (has_msr_core_capabs) {
+-        kvm_msr_entry_add(cpu, MSR_IA32_CORE_CAPABILITY,
+-                          env->features[FEAT_CORE_CAPABILITY]);
+-    }
+-
+     /*
+      * The following MSRs have side effects on the guest or are too heavy
+      * for normal writeback. Limit them to reset or full state updates.
+@@ -2910,14 +2945,6 @@ static int kvm_put_msrs(X86CPU *cpu, int level)
+ 
+         /* Note: MSR_IA32_FEATURE_CONTROL is written separately, see
+          *       kvm_put_msr_feature_control. */
+-
+-        /*
+-         * Older kernels do not include VMX MSRs in KVM_GET_MSR_INDEX_LIST, but
+-         * all kernels with MSR features should have them.
+-         */
+-        if (kvm_feature_msrs && cpu_has_vmx(env)) {
+-            kvm_msr_entry_add_vmx(cpu, env->features);
+-        }
+     }
+ 
+     if (env->mcg_cap) {
+@@ -2933,19 +2960,7 @@ static int kvm_put_msrs(X86CPU *cpu, int level)
+         }
+     }
+ 
+-    ret = kvm_vcpu_ioctl(CPU(cpu), KVM_SET_MSRS, cpu->kvm_msr_buf);
+-    if (ret < 0) {
+-        return ret;
+-    }
+-
+-    if (ret < cpu->kvm_msr_buf->nmsrs) {
+-        struct kvm_msr_entry *e = &cpu->kvm_msr_buf->entries[ret];
+-        error_report("error: failed to set MSR 0x%" PRIx32 " to 0x%" PRIx64,
+-                     (uint32_t)e->index, (uint64_t)e->data);
+-    }
+-
+-    assert(ret == cpu->kvm_msr_buf->nmsrs);
+-    return 0;
++    return kvm_buf_set_msrs(cpu);
+ }
+ 
+ 
+diff --git a/target/i386/kvm_i386.h b/target/i386/kvm_i386.h
+index 7d0242f5fb..00bde7acaf 100644
+--- a/target/i386/kvm_i386.h
++++ b/target/i386/kvm_i386.h
+@@ -46,4 +46,5 @@ bool kvm_enable_x2apic(void);
+ bool kvm_has_x2apic_api(void);
+ 
+ bool kvm_hv_vpindex_settable(void);
++
+ #endif
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-tcg-save-vaddr-temp-for-plugin-usage.patch b/debian/patches/stable/lp-1867519-tcg-save-vaddr-temp-for-plugin-usage.patch
new file mode 100644
index 0000000..5d0bbf2
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-tcg-save-vaddr-temp-for-plugin-usage.patch
@@ -0,0 +1,98 @@
+From fcc54ab5c7ca84ae72e8bf3781c33c9193a911aa Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <[e-mail]>
+Date: Tue, 25 Feb 2020 17:49:08 +0000
+Subject: [PATCH] tcg: save vaddr temp for plugin usage
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+While do_gen_mem_cb does copy (via extu_tl_i64) vaddr into a new temp
+this won't help if the vaddr temp gets clobbered by the actual
+load/store op. To avoid this clobbering we explicitly copy vaddr
+before the op to ensure it is live my the time we do the
+instrumentation.
+
+Suggested-by: Richard Henderson <[e-mail]>
+Signed-off-by: Alex Bennée <[e-mail]>
+Reviewed-by: Richard Henderson <[e-mail]>
+Reviewed-by: Emilio G. Cota <[e-mail]>
+Cc: [e-mail]
+Message-Id: <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=fcc54ab5c7ca84ae72e8bf3781c33c9193a911aa
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ tcg/tcg-op.c | 23 ++++++++++++++++++++---
+ 1 file changed, 20 insertions(+), 3 deletions(-)
+
+diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
+index 7d782002e3..e2e25ebf7d 100644
+--- a/tcg/tcg-op.c
++++ b/tcg/tcg-op.c
+@@ -2794,13 +2794,26 @@ static void tcg_gen_req_mo(TCGBar type)
+     }
+ }
+ 
++static inline TCGv plugin_prep_mem_callbacks(TCGv vaddr)
++{
++#ifdef CONFIG_PLUGIN
++    if (tcg_ctx->plugin_insn != NULL) {
++        /* Save a copy of the vaddr for use after a load.  */
++        TCGv temp = tcg_temp_new();
++        tcg_gen_mov_tl(temp, vaddr);
++        return temp;
++    }
++#endif
++    return vaddr;
++}
++
+ static inline void plugin_gen_mem_callbacks(TCGv vaddr, uint16_t info)
+ {
+ #ifdef CONFIG_PLUGIN
+-    if (tcg_ctx->plugin_insn == NULL) {
+-        return;
++    if (tcg_ctx->plugin_insn != NULL) {
++        plugin_gen_empty_mem_callback(vaddr, info);
++        tcg_temp_free(vaddr);
+     }
+-    plugin_gen_empty_mem_callback(vaddr, info);
+ #endif
+ }
+ 
+@@ -2822,6 +2835,7 @@ void tcg_gen_qemu_ld_i32(TCGv_i32 val, TCGv addr, TCGArg idx, MemOp memop)
+         }
+     }
+ 
++    addr = plugin_prep_mem_callbacks(addr);
+     gen_ldst_i32(INDEX_op_qemu_ld_i32, val, addr, memop, idx);
+     plugin_gen_mem_callbacks(addr, info);
+ 
+@@ -2868,6 +2882,7 @@ void tcg_gen_qemu_st_i32(TCGv_i32 val, TCGv addr, TCGArg idx, MemOp memop)
+         memop &= ~MO_BSWAP;
+     }
+ 
++    addr = plugin_prep_mem_callbacks(addr);
+     gen_ldst_i32(INDEX_op_qemu_st_i32, val, addr, memop, idx);
+     plugin_gen_mem_callbacks(addr, info);
+ 
+@@ -2905,6 +2920,7 @@ void tcg_gen_qemu_ld_i64(TCGv_i64 val, TCGv addr, TCGArg idx, MemOp memop)
+         }
+     }
+ 
++    addr = plugin_prep_mem_callbacks(addr);
+     gen_ldst_i64(INDEX_op_qemu_ld_i64, val, addr, memop, idx);
+     plugin_gen_mem_callbacks(addr, info);
+ 
+@@ -2967,6 +2983,7 @@ void tcg_gen_qemu_st_i64(TCGv_i64 val, TCGv addr, TCGArg idx, MemOp memop)
+         memop &= ~MO_BSWAP;
+     }
+ 
++    addr = plugin_prep_mem_callbacks(addr);
+     gen_ldst_i64(INDEX_op_qemu_st_i64, val, addr, memop, idx);
+     plugin_gen_mem_callbacks(addr, info);
+ 
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-tpm-ppi-page-align-PPI-RAM.patch b/debian/patches/stable/lp-1867519-tpm-ppi-page-align-PPI-RAM.patch
new file mode 100644
index 0000000..209bd3e
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-tpm-ppi-page-align-PPI-RAM.patch
@@ -0,0 +1,47 @@
+From 71e415c8a75c130875f14d6b2136825789feb297 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <[e-mail]>
+Date: Fri, 3 Jan 2020 11:39:59 +0400
+Subject: [PATCH] tpm-ppi: page-align PPI RAM
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+post-copy migration fails on destination with error such as:
[phone]T10:22:44.714644Z qemu-kvm: ram_block_discard_range:
+Unaligned start address: 0x559d2afae9a0
+
+Use qemu_memalign() to constrain the PPI RAM memory alignment.
+
+Cc: [e-mail]
+Signed-off-by: Marc-André Lureau <[e-mail]>
+Reviewed-by: Philippe Mathieu-Daudé <[e-mail]>
+Reviewed-by: Dr. David Alan Gilbert <[e-mail]>
+Reviewed-by: Stefan Berger <[e-mail]>
+Signed-off-by: Stefan Berger <[e-mail]>
+Message-id: [e-mail]
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=71e415c8a75c130875f14d6b2136825789feb297
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ hw/tpm/tpm_ppi.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/hw/tpm/tpm_ppi.c b/hw/tpm/tpm_ppi.c
+index ff314592b4..6d9c1a3e40 100644
+--- a/hw/tpm/tpm_ppi.c
++++ b/hw/tpm/tpm_ppi.c
+@@ -43,7 +43,8 @@ void tpm_ppi_reset(TPMPPI *tpmppi)
+ void tpm_ppi_init(TPMPPI *tpmppi, struct MemoryRegion *m,
+                   hwaddr addr, Object *obj)
+ {
+-    tpmppi->buf = g_malloc0(HOST_PAGE_ALIGN(TPM_PPI_ADDR_SIZE));
++    tpmppi->buf = qemu_memalign(qemu_real_host_page_size,
++                                HOST_PAGE_ALIGN(TPM_PPI_ADDR_SIZE));
+     memory_region_init_ram_device_ptr(&tpmppi->ram, obj, "tpm-ppi",
+                                       TPM_PPI_ADDR_SIZE, tpmppi->buf);
+     vmstate_register_ram(&tpmppi->ram, DEVICE(obj));
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-vfio-pci-Don-t-remove-irqchip-notifier-if-not-regist.patch b/debian/patches/stable/lp-1867519-vfio-pci-Don-t-remove-irqchip-notifier-if-not-regist.patch
new file mode 100644
index 0000000..f52b1bd
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-vfio-pci-Don-t-remove-irqchip-notifier-if-not-regist.patch
@@ -0,0 +1,50 @@
+From 0446f8121723b134ca1d1ed0b73e96d4a0a8689d Mon Sep 17 00:00:00 2001
+From: Peter Xu <[e-mail]>
+Date: Mon, 6 Jan 2020 13:34:45 -0700
+Subject: [PATCH] vfio/pci: Don't remove irqchip notifier if not registered
+
+The kvm irqchip notifier is only registered if the device supports
+INTx, however it's unconditionally removed.  If the assigned device
+does not support INTx, this will cause QEMU to crash when unplugging
+the device from the system.  Change it to conditionally remove the
+notifier only if the notify hook is setup.
+
+CC: Eduardo Habkost <[e-mail]>
+CC: David Gibson <[e-mail]>
+CC: Alex Williamson <[e-mail]>
+Cc: [e-mail] # v4.2
+Reported-by: [e-mail]
+Debugged-by: Eduardo Habkost <[e-mail]>
+Fixes: c5478fea27ac ("vfio/pci: Respond to KVM irqchip change notifier")
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1782678
+Signed-off-by: Peter Xu <[e-mail]>
+Reviewed-by: David Gibson <[e-mail]>
+Reviewed-by: Greg Kurz <[e-mail]>
+Signed-off-by: Alex Williamson <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=0446f8121723b134ca1d1ed0b73e96d4a0a8689d
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ hw/vfio/pci.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
+index 2d40b396f2..337a173ce7 100644
+--- a/hw/vfio/pci.c
++++ b/hw/vfio/pci.c
+@@ -3076,7 +3076,9 @@ static void vfio_exitfn(PCIDevice *pdev)
+     vfio_unregister_req_notifier(vdev);
+     vfio_unregister_err_notifier(vdev);
+     pci_device_set_intx_routing_notifier(&vdev->pdev, NULL);
+-    kvm_irqchip_remove_change_notifier(&vdev->irqchip_change_notifier);
++    if (vdev->irqchip_change_notifier.notify) {
++        kvm_irqchip_remove_change_notifier(&vdev->irqchip_change_notifier);
++    }
+     vfio_disable_interrupts(vdev);
+     if (vdev->intx.mmap_timer) {
+         timer_free(vdev->intx.mmap_timer);
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-virtio-gracefully-handle-invalid-region-caches.patch b/debian/patches/stable/lp-1867519-virtio-gracefully-handle-invalid-region-caches.patch
new file mode 100644
index 0000000..177cafe
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-virtio-gracefully-handle-invalid-region-caches.patch
@@ -0,0 +1,331 @@
+From abdd16f4681cc4d6bf84990227b5c9b98e869ccd Mon Sep 17 00:00:00 2001
+From: Stefan Hajnoczi <[e-mail]>
+Date: Fri, 7 Feb 2020 10:46:19 +0000
+Subject: [PATCH] virtio: gracefully handle invalid region caches
+
+The virtqueue code sets up MemoryRegionCaches to access the virtqueue
+guest RAM data structures.  The code currently assumes that
+VRingMemoryRegionCaches is initialized before device emulation code
+accesses the virtqueue.  An assertion will fail in
+vring_get_region_caches() when this is not true.  Device fuzzing found a
+case where this assumption is false (see below).
+
+Virtqueue guest RAM addresses can also be changed from a vCPU thread
+while an IOThread is accessing the virtqueue.  This breaks the same
+assumption but this time the caches could become invalid partway through
+the virtqueue code.  The code fetches the caches RCU pointer multiple
+times so we will need to validate the pointer every time it is fetched.
+
+Add checks each time we call vring_get_region_caches() and treat invalid
+caches as a nop: memory stores are ignored and memory reads return 0.
+
+The fuzz test failure is as follows:
+
+  $ qemu -M pc -device virtio-blk-pci,id=drv0,drive=drive0,addr=4.0 \
+         -drive if=none,id=drive0,file=null-co://,format=raw,auto-read-only=off \
+         -drive if=none,id=drive1,file=null-co://,file.read-zeroes=on,format=raw \
+         -display none \
+         -qtest stdio
+  endianness
+  outl 0xcf8 0x80002020
+  outl 0xcfc 0xe0000000
+  outl 0xcf8 0x80002004
+  outw 0xcfc 0x7
+  write 0xe0000000 0x24 0x00ffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffab5cffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffabffffffab0000000001
+  inb 0x4
+  writew 0xe000001c 0x1
+  write 0xe0000014 0x1 0x0d
+
+The following error message is produced:
+
+  qemu-system-x86_64: /home/stefanha/qemu/hw/virtio/virtio.c:286: vring_get_region_caches: Assertion `caches != NULL' failed.
+
+The backtrace looks like this:
+
+  #0  0x00007ffff5520625 in raise () at /lib64/libc.so.6
+  #1  0x00007ffff55098d9 in abort () at /lib64/libc.so.6
+  #2  0x00007ffff55097a9 in _nl_load_domain.cold () at /lib64/libc.so.6
+  #3  0x00007ffff5518a66 in annobin_assert.c_end () at /lib64/libc.so.6
+  #4  0x00005555559073da in vring_get_region_caches (vq=<optimized out>) at qemu/hw/virtio/virtio.c:286
+  #5  vring_get_region_caches (vq=<optimized out>) at qemu/hw/virtio/virtio.c:283
+  #6  0x000055555590818d in vring_used_flags_set_bit (mask=1, vq=0x5555575ceea0) at qemu/hw/virtio/virtio.c:398
+  #7  virtio_queue_split_set_notification (enable=0, vq=0x5555575ceea0) at qemu/hw/virtio/virtio.c:398
+  #8  virtio_queue_set_notification (vq=vq@entry=0x5555575ceea0, enable=enable@entry=0) at qemu/hw/virtio/virtio.c:451
+  #9  0x0000555555908512 in virtio_queue_set_notification (vq=vq@entry=0x5555575ceea0, enable=enable@entry=0) at qemu/hw/virtio/virtio.c:444
+  #10 0x00005555558c697a in virtio_blk_handle_vq (s=0x5555575c57e0, vq=0x5555575ceea0) at qemu/hw/block/virtio-blk.c:775
+  #11 0x0000555555907836 in virtio_queue_notify_aio_vq (vq=0x5555575ceea0) at qemu/hw/virtio/virtio.c:2244
+  #12 0x0000555555cb5dd7 in aio_dispatch_handlers (ctx=ctx@entry=0x55555671a420) at util/aio-posix.c:429
+  #13 0x0000555555cb67a8 in aio_dispatch (ctx=0x55555671a420) at util/aio-posix.c:460
+  #14 0x0000555555cb307e in aio_ctx_dispatch (source=<optimized out>, callback=<optimized out>, user_data=<optimized out>) at util/async.c:260
+  #15 0x00007ffff7bbc510 in g_main_context_dispatch () at /lib64/libglib-2.0.so.0
+  #16 0x0000555555cb5848 in glib_pollfds_poll () at util/main-loop.c:219
+  #17 os_host_main_loop_wait (timeout=<optimized out>) at util/main-loop.c:242
+  #18 main_loop_wait (nonblocking=<optimized out>) at util/main-loop.c:518
+  #19 0x00005555559b20c9 in main_loop () at vl.c:1683
+  #20 0x0000555555838115 in main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at vl.c:4441
+
+Reported-by: Alexander Bulekov <[e-mail]>
+Cc: Michael Tsirkin <[e-mail]>
+Cc: Cornelia Huck <[e-mail]>
+Cc: Paolo Bonzini <[e-mail]>
+Cc: [e-mail]
+Signed-off-by: Stefan Hajnoczi <[e-mail]>
+Message-Id: <[e-mail]>
+Reviewed-by: Michael S. Tsirkin <[e-mail]>
+Signed-off-by: Michael S. Tsirkin <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=abdd16f4681cc4d6bf84990227b5c9b98e869ccd
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ hw/virtio/virtio.c | 99 ++++++++++++++++++++++++++++++++++++++++++----
+ 1 file changed, 91 insertions(+), 8 deletions(-)
+
+diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
+index 2c5410e981..00d444699d 100644
+--- a/hw/virtio/virtio.c
++++ b/hw/virtio/virtio.c
+@@ -282,15 +282,19 @@ static void vring_packed_flags_write(VirtIODevice *vdev,
+ /* Called within rcu_read_lock().  */
+ static VRingMemoryRegionCaches *vring_get_region_caches(struct VirtQueue *vq)
+ {
+-    VRingMemoryRegionCaches *caches = atomic_rcu_read(&vq->vring.caches);
+-    assert(caches != NULL);
+-    return caches;
++    return atomic_rcu_read(&vq->vring.caches);
+ }
++
+ /* Called within rcu_read_lock().  */
+ static inline uint16_t vring_avail_flags(VirtQueue *vq)
+ {
+     VRingMemoryRegionCaches *caches = vring_get_region_caches(vq);
+     hwaddr pa = offsetof(VRingAvail, flags);
++
++    if (!caches) {
++        return 0;
++    }
++
+     return virtio_lduw_phys_cached(vq->vdev, &caches->avail, pa);
+ }
+ 
+@@ -299,6 +303,11 @@ static inline uint16_t vring_avail_idx(VirtQueue *vq)
+ {
+     VRingMemoryRegionCaches *caches = vring_get_region_caches(vq);
+     hwaddr pa = offsetof(VRingAvail, idx);
++
++    if (!caches) {
++        return 0;
++    }
++
+     vq->shadow_avail_idx = virtio_lduw_phys_cached(vq->vdev, &caches->avail, pa);
+     return vq->shadow_avail_idx;
+ }
+@@ -308,6 +317,11 @@ static inline uint16_t vring_avail_ring(VirtQueue *vq, int i)
+ {
+     VRingMemoryRegionCaches *caches = vring_get_region_caches(vq);
+     hwaddr pa = offsetof(VRingAvail, ring[i]);
++
++    if (!caches) {
++        return 0;
++    }
++
+     return virtio_lduw_phys_cached(vq->vdev, &caches->avail, pa);
+ }
+ 
+@@ -323,6 +337,11 @@ static inline void vring_used_write(VirtQueue *vq, VRingUsedElem *uelem,
+ {
+     VRingMemoryRegionCaches *caches = vring_get_region_caches(vq);
+     hwaddr pa = offsetof(VRingUsed, ring[i]);
++
++    if (!caches) {
++        return;
++    }
++
+     virtio_tswap32s(vq->vdev, &uelem->id);
+     virtio_tswap32s(vq->vdev, &uelem->len);
+     address_space_write_cached(&caches->used, pa, uelem, sizeof(VRingUsedElem));
+@@ -334,6 +353,11 @@ static uint16_t vring_used_idx(VirtQueue *vq)
+ {
+     VRingMemoryRegionCaches *caches = vring_get_region_caches(vq);
+     hwaddr pa = offsetof(VRingUsed, idx);
++
++    if (!caches) {
++        return 0;
++    }
++
+     return virtio_lduw_phys_cached(vq->vdev, &caches->used, pa);
+ }
+ 
+@@ -342,8 +366,12 @@ static inline void vring_used_idx_set(VirtQueue *vq, uint16_t val)
+ {
+     VRingMemoryRegionCaches *caches = vring_get_region_caches(vq);
+     hwaddr pa = offsetof(VRingUsed, idx);
+-    virtio_stw_phys_cached(vq->vdev, &caches->used, pa, val);
+-    address_space_cache_invalidate(&caches->used, pa, sizeof(val));
++
++    if (caches) {
++        virtio_stw_phys_cached(vq->vdev, &caches->used, pa, val);
++        address_space_cache_invalidate(&caches->used, pa, sizeof(val));
++    }
++
+     vq->used_idx = val;
+ }
+ 
+@@ -353,8 +381,13 @@ static inline void vring_used_flags_set_bit(VirtQueue *vq, int mask)
+     VRingMemoryRegionCaches *caches = vring_get_region_caches(vq);
+     VirtIODevice *vdev = vq->vdev;
+     hwaddr pa = offsetof(VRingUsed, flags);
+-    uint16_t flags = virtio_lduw_phys_cached(vq->vdev, &caches->used, pa);
++    uint16_t flags;
+ 
++    if (!caches) {
++        return;
++    }
++
++    flags = virtio_lduw_phys_cached(vq->vdev, &caches->used, pa);
+     virtio_stw_phys_cached(vdev, &caches->used, pa, flags | mask);
+     address_space_cache_invalidate(&caches->used, pa, sizeof(flags));
+ }
+@@ -365,8 +398,13 @@ static inline void vring_used_flags_unset_bit(VirtQueue *vq, int mask)
+     VRingMemoryRegionCaches *caches = vring_get_region_caches(vq);
+     VirtIODevice *vdev = vq->vdev;
+     hwaddr pa = offsetof(VRingUsed, flags);
+-    uint16_t flags = virtio_lduw_phys_cached(vq->vdev, &caches->used, pa);
++    uint16_t flags;
+ 
++    if (!caches) {
++        return;
++    }
++
++    flags = virtio_lduw_phys_cached(vq->vdev, &caches->used, pa);
+     virtio_stw_phys_cached(vdev, &caches->used, pa, flags & ~mask);
+     address_space_cache_invalidate(&caches->used, pa, sizeof(flags));
+ }
+@@ -381,6 +419,10 @@ static inline void vring_set_avail_event(VirtQueue *vq, uint16_t val)
+     }
+ 
+     caches = vring_get_region_caches(vq);
++    if (!caches) {
++        return;
++    }
++
+     pa = offsetof(VRingUsed, ring[vq->vring.num]);
+     virtio_stw_phys_cached(vq->vdev, &caches->used, pa, val);
+     address_space_cache_invalidate(&caches->used, pa, sizeof(val));
+@@ -410,7 +452,11 @@ static void virtio_queue_packed_set_notification(VirtQueue *vq, int enable)
+     VRingMemoryRegionCaches *caches;
+ 
+     RCU_READ_LOCK_GUARD();
+-    caches  = vring_get_region_caches(vq);
++    caches = vring_get_region_caches(vq);
++    if (!caches) {
++        return;
++    }
++
+     vring_packed_event_read(vq->vdev, &caches->used, &e);
+ 
+     if (!enable) {
+@@ -597,6 +643,10 @@ static int virtio_queue_packed_empty_rcu(VirtQueue *vq)
+     }
+ 
+     cache = vring_get_region_caches(vq);
++    if (!cache) {
++        return 1;
++    }
++
+     vring_packed_desc_read_flags(vq->vdev, &desc.flags, &cache->desc,
+                                  vq->last_avail_idx);
+ 
+@@ -777,6 +827,10 @@ static void virtqueue_packed_fill_desc(VirtQueue *vq,
+     }
+ 
+     caches = vring_get_region_caches(vq);
++    if (!caches) {
++        return;
++    }
++
+     vring_packed_desc_write(vq->vdev, &desc, &caches->desc, head, strict_order);
+ }
+ 
+@@ -949,6 +1003,10 @@ static void virtqueue_split_get_avail_bytes(VirtQueue *vq,
+ 
+     max = vq->vring.num;
+     caches = vring_get_region_caches(vq);
++    if (!caches) {
++        goto err;
++    }
++
+     while ((rc = virtqueue_num_heads(vq, idx)) > 0) {
+         MemoryRegionCache *desc_cache = &caches->desc;
+         unsigned int num_bufs;
+@@ -1089,6 +1147,9 @@ static void virtqueue_packed_get_avail_bytes(VirtQueue *vq,
+ 
+     max = vq->vring.num;
+     caches = vring_get_region_caches(vq);
++    if (!caches) {
++        goto err;
++    }
+ 
+     for (;;) {
+         unsigned int num_bufs = total_bufs;
+@@ -1194,6 +1255,10 @@ void virtqueue_get_avail_bytes(VirtQueue *vq, unsigned int *in_bytes,
+     }
+ 
+     caches = vring_get_region_caches(vq);
++    if (!caches) {
++        goto err;
++    }
++
+     desc_size = virtio_vdev_has_feature(vq->vdev, VIRTIO_F_RING_PACKED) ?
+                                 sizeof(VRingPackedDesc) : sizeof(VRingDesc);
+     if (caches->desc.len < vq->vring.num * desc_size) {
+@@ -1387,6 +1452,11 @@ static void *virtqueue_split_pop(VirtQueue *vq, size_t sz)
+     i = head;
+ 
+     caches = vring_get_region_caches(vq);
++    if (!caches) {
++        virtio_error(vdev, "Region caches not initialized");
++        goto done;
++    }
++
+     if (caches->desc.len < max * sizeof(VRingDesc)) {
+         virtio_error(vdev, "Cannot map descriptor ring");
+         goto done;
+@@ -1509,6 +1579,11 @@ static void *virtqueue_packed_pop(VirtQueue *vq, size_t sz)
+     i = vq->last_avail_idx;
+ 
+     caches = vring_get_region_caches(vq);
++    if (!caches) {
++        virtio_error(vdev, "Region caches not initialized");
++        goto done;
++    }
++
+     if (caches->desc.len < max * sizeof(VRingDesc)) {
+         virtio_error(vdev, "Cannot map descriptor ring");
+         goto done;
+@@ -1628,6 +1703,10 @@ static unsigned int virtqueue_packed_drop_all(VirtQueue *vq)
+     VRingPackedDesc desc;
+ 
+     caches = vring_get_region_caches(vq);
++    if (!caches) {
++        return 0;
++    }
++
+     desc_cache = &caches->desc;
+ 
+     virtio_queue_set_notification(vq, 0);
+@@ -2412,6 +2491,10 @@ static bool virtio_packed_should_notify(VirtIODevice *vdev, VirtQueue *vq)
+     VRingMemoryRegionCaches *caches;
+ 
+     caches = vring_get_region_caches(vq);
++    if (!caches) {
++        return false;
++    }
++
+     vring_packed_event_read(vdev, &caches->avail, &e);
+ 
+     old = vq->signalled_used;
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-virtio-mmio-update-queue-size-on-guest-write.patch b/debian/patches/stable/lp-1867519-virtio-mmio-update-queue-size-on-guest-write.patch
new file mode 100644
index 0000000..d18b0ee
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-virtio-mmio-update-queue-size-on-guest-write.patch
@@ -0,0 +1,40 @@
+From 1049f4c62c4070618cc5defc9963c6a17ae7a5ae Mon Sep 17 00:00:00 2001
+From: Denis Plotnikov <[e-mail]>
+Date: Tue, 24 Dec 2019 11:14:46 +0300
+Subject: [PATCH] virtio-mmio: update queue size on guest write
+
+Some guests read back queue size after writing it.
+Always update the on size write otherwise they might be confused.
+
+Cc: [e-mail]
+Signed-off-by: Denis Plotnikov <[e-mail]>
+Message-Id: <[e-mail]>
+Reviewed-by: Michael S. Tsirkin <[e-mail]>
+Signed-off-by: Michael S. Tsirkin <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=1049f4c62c4070618cc5defc9963c6a17ae7a5ae
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ hw/virtio/virtio-mmio.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/hw/virtio/virtio-mmio.c b/hw/virtio/virtio-mmio.c
+index ef40b7a9b2..872f2cd237 100644
+--- a/hw/virtio/virtio-mmio.c
++++ b/hw/virtio/virtio-mmio.c
+@@ -308,8 +308,9 @@ static void virtio_mmio_write(void *opaque, hwaddr offset, uint64_t value,
+         break;
+     case VIRTIO_MMIO_QUEUE_NUM:
+         trace_virtio_mmio_queue_write(value, VIRTQUEUE_MAX_SIZE);
++        virtio_queue_set_num(vdev, vdev->queue_sel, value);
++
+         if (proxy->legacy) {
+-            virtio_queue_set_num(vdev, vdev->queue_sel, value);
+             virtio_queue_update_rings(vdev, vdev->queue_sel);
+         } else {
+             proxy->vqs[vdev->queue_sel].num = value;
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-virtio-net-delete-also-control-queue-when-TX-RX-dele.patch b/debian/patches/stable/lp-1867519-virtio-net-delete-also-control-queue-when-TX-RX-dele.patch
new file mode 100644
index 0000000..1db89ff
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-virtio-net-delete-also-control-queue-when-TX-RX-dele.patch
@@ -0,0 +1,41 @@
+From d945d9f1731244ef341f74ede93120fc9de35913 Mon Sep 17 00:00:00 2001
+From: Yuri Benditovich <[e-mail]>
+Date: Thu, 26 Dec 2019 06:36:49 +0200
+Subject: [PATCH] virtio-net: delete also control queue when TX/RX deleted
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1708480
+If the control queue is not deleted together with TX/RX, it
+later will be ignored in freeing cache resources and hot
+unplug will not be completed.
+
+Cc: [e-mail]
+Signed-off-by: Yuri Benditovich <[e-mail]>
+Message-Id: <[e-mail]>
+Reviewed-by: Michael S. Tsirkin <[e-mail]>
+Signed-off-by: Michael S. Tsirkin <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=d945d9f1731244ef341f74ede93120fc9de35913
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ hw/net/virtio-net.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
+index db3d7c38e6..f325440d01 100644
+--- a/hw/net/virtio-net.c
++++ b/hw/net/virtio-net.c
+@@ -3101,7 +3101,8 @@ static void virtio_net_device_unrealize(DeviceState *dev, Error **errp)
+     for (i = 0; i < max_queues; i++) {
+         virtio_net_del_queue(n, i);
+     }
+-
++    /* delete also control vq */
++    virtio_del_queue(vdev, max_queues * 2);
+     qemu_announce_timer_del(&n->announce_timer, false);
+     g_free(n->vqs);
+     qemu_del_nic(n->nic);
+-- 
+2.25.1
+
diff --git a/debian/patches/stable/lp-1867519-virtio-update-queue-size-on-guest-write.patch b/debian/patches/stable/lp-1867519-virtio-update-queue-size-on-guest-write.patch
new file mode 100644
index 0000000..da81c2c
--- /dev/null
+++ b/debian/patches/stable/lp-1867519-virtio-update-queue-size-on-guest-write.patch
@@ -0,0 +1,40 @@
+From d0c5f643383b9e84316f148affff368ac33d75b9 Mon Sep 17 00:00:00 2001
+From: "Michael S. Tsirkin" <[e-mail]>
+Date: Fri, 13 Dec 2019 09:22:48 -0500
+Subject: [PATCH] virtio: update queue size on guest write
+
+Some guests read back queue size after writing it.
+Update the size immediatly upon write otherwise
+they get confused.
+
+In particular this is the case for seabios.
+
+Reported-by: Roman Kagan <[e-mail]>
+Suggested-by: Denis Plotnikov <[e-mail]>
+Cc: [e-mail]
+Signed-off-by: Michael S. Tsirkin <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=d0c5f643383b9e84316f148affff368ac33d75b9
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
+Last-Update: 2020-03-18
+
+---
+ hw/virtio/virtio-pci.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
+index c6b47a9c73..e5c759e19e 100644
+--- a/hw/virtio/virtio-pci.c
++++ b/hw/virtio/virtio-pci.c
+@@ -1256,6 +1256,8 @@ static void virtio_pci_common_write(void *opaque, hwaddr addr,
+         break;
+     case VIRTIO_PCI_COMMON_Q_SIZE:
+         proxy->vqs[vdev->queue_sel].num = val;
++        virtio_queue_set_num(vdev, vdev->queue_sel,
++                             proxy->vqs[vdev->queue_sel].num);
+         break;
+     case VIRTIO_PCI_COMMON_Q_MSIX:
+         msix_vector_unuse(&proxy->pci_dev,
+-- 
+2.25.1
+
diff --git a/debian/patches/ubuntu/expose-vmx_qemu64cpu.patch b/debian/patches/ubuntu/expose-vmx_qemu64cpu.patch
deleted file mode 100644
index 5694cd4..0000000
--- a/debian/patches/ubuntu/expose-vmx_qemu64cpu.patch
+++ /dev/null
@@ -1,17 +0,0 @@
-Description: Expose VMX cpuid feature to the default "qemu64" CPU type,
- supporting Intel compatible VMX nested virtualization.
-Author: Dave Walker (Daviey) <[e-mail]>
-
-Index: qemu/target/i386/cpu.c
-===================================================================
---- qemu.orig/target/i386/cpu.c
-+++ qemu/target/i386/cpu.c
-@@ -673,7 +673,7 @@ static X86CPUDefinition builtin_x86_defs
-             CPUID_MTRR | CPUID_CLFLUSH | CPUID_MCA |
-             CPUID_PSE36,
-         .features[FEAT_1_ECX] =
--            CPUID_EXT_SSE3 | CPUID_EXT_CX16,
-+            CPUID_EXT_SSE3 | CPUID_EXT_CX16 | CPUID_EXT_VMX,
-         .features[FEAT_8000_0001_EDX] =
-             CPUID_EXT2_LM | CPUID_EXT2_SYSCALL | CPUID_EXT2_NX,
-         .features[FEAT_8000_0001_ECX] =
diff --git a/debian/patches/ubuntu/lp-1835546-Sync-pv.patch b/debian/patches/ubuntu/lp-1835546-Sync-pv.patch
new file mode 100644
index 0000000..0324a8c
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1835546-Sync-pv.patch
@@ -0,0 +1,98 @@
+From 5081c651c9e12d519597fc2ee6e6162e52051122 Mon Sep 17 00:00:00 2001
+From: Janosch Frank <[e-mail]>
+Date: Tue, 25 Feb 2020 06:09:23 -0500
+Subject: [PATCH] Sync pv
+
+Signed-off-by: Janosch Frank <[e-mail]>
+
+Forwarded: https://lists.gnu.org/archive/html/qemu-devel/2020-03/msg06247.html
+Origin: backport, https://github.com/borntraeger/qemu/commit/5081c651c9
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1835546
+Last-Update: 2020-03-20
+
+---
+ linux-headers/linux/kvm.h | 50 +++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 48 insertions(+), 2 deletions(-)
+
+diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h
+index 3d9b18f7f8..18c636070e 100644
+--- a/linux-headers/linux/kvm.h
++++ b/linux-headers/linux/kvm.h
+@@ -468,12 +468,17 @@ struct kvm_s390_mem_op {
+ 	__u32 size;		/* amount of bytes */
+ 	__u32 op;		/* type of operation */
+ 	__u64 buf;		/* buffer in userspace */
+-	__u8 ar;		/* the access register number */
+-	__u8 reserved[31];	/* should be set to 0 */
++	union {
++		__u8 ar;	/* the access register number */
++		__u32 sida_offset; /* offset into the sida */
++		__u8 reserved[32]; /* should be set to 0 */
++	};
+ };
+ /* types for kvm_s390_mem_op->op */
+ #define KVM_S390_MEMOP_LOGICAL_READ	0
+ #define KVM_S390_MEMOP_LOGICAL_WRITE	1
++#define KVM_S390_MEMOP_SIDA_READ	2
++#define KVM_S390_MEMOP_SIDA_WRITE	3
+ /* flags for kvm_s390_mem_op->flags */
+ #define KVM_S390_MEMOP_F_CHECK_ONLY		(1ULL << 0)
+ #define KVM_S390_MEMOP_F_INJECT_EXCEPTION	(1ULL << 1)
+@@ -1000,6 +1005,8 @@ struct kvm_ppc_resize_hpt {
+ #define KVM_CAP_PMU_EVENT_FILTER 173
+ #define KVM_CAP_ARM_IRQ_LINE_LAYOUT_2 174
+ #define KVM_CAP_HYPERV_DIRECT_TLBFLUSH 175
++#define KVM_CAP_S390_VCPU_RESETS 179
++#define KVM_CAP_S390_PROTECTED 180
+ 
+ #ifdef KVM_CAP_IRQ_ROUTING
+ 
+@@ -1461,6 +1468,45 @@ struct kvm_enc_region {
+ /* Available with KVM_CAP_ARM_SVE */
+ #define KVM_ARM_VCPU_FINALIZE	  _IOW(KVMIO,  0xc2, int)
+ 
++/* Available with  KVM_CAP_S390_VCPU_RESETS */
++#define KVM_S390_NORMAL_RESET	_IO(KVMIO,   0xc3)
++#define KVM_S390_CLEAR_RESET	_IO(KVMIO,   0xc4)
++
++struct kvm_s390_pv_sec_parm {
++	__u64 origin;
++	__u64 length;
++};
++
++struct kvm_s390_pv_unp {
++	__u64 addr;
++	__u64 size;
++	__u64 tweak;
++};
++
++enum pv_cmd_id {
++	KVM_PV_ENABLE,
++	KVM_PV_DISABLE,
++	KVM_PV_VM_SET_SEC_PARMS,
++	KVM_PV_VM_UNPACK,
++	KVM_PV_VM_VERIFY,
++	KVM_PV_VM_PREP_RESET,
++	KVM_PV_VM_UNSHARE_ALL,
++	KVM_PV_VCPU_CREATE,
++	KVM_PV_VCPU_DESTROY,
++};
++
++struct kvm_pv_cmd {
++	__u32 cmd;	/* Command to be executed */
++	__u16 rc;	/* Ultravisor return code */
++	__u16 rrc;	/* Ultravisor return reason code */
++	__u64 data;	/* Data or address */
++	__u32 flags;    /* flags for future extensions. Must be 0 for now */
++	__u32 reserved[3];
++};
++
++/* Available with KVM_CAP_S390_PROTECTED */
++#define KVM_S390_PV_COMMAND		_IOWR(KVMIO, 0xc5, struct kvm_pv_cmd)
++
+ /* Secure Encrypted Virtualization command */
+ enum sev_cmd_id {
+ 	/* Guest initialization commands */
+-- 
+2.25.1
+
diff --git a/debian/patches/ubuntu/lp-1835546-pc-bios-s390x-Save-iplb-location-in-lowcore.patch b/debian/patches/ubuntu/lp-1835546-pc-bios-s390x-Save-iplb-location-in-lowcore.patch
new file mode 100644
index 0000000..d95587f
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1835546-pc-bios-s390x-Save-iplb-location-in-lowcore.patch
@@ -0,0 +1,138 @@
+From 6c657fba3b138ad43b72e54a3c43a87e170ce615 Mon Sep 17 00:00:00 2001
+From: Janosch Frank <[e-mail]>
+Date: Wed, 4 Mar 2020 06:42:31 -0500
+Subject: [PATCH] pc-bios: s390x: Save iplb location in lowcore
+
+The POP states that for a list directed IPL the IPLB is stored into
+memory by the machine loader and its address is stored at offset 0x14
+of the lowcore.
+
+ZIPL currently uses the address in offset 0x14 to access the IPLB and
+acquire flags about secure boot. If the IPLB address points into
+memory which has an unsupported mix of flags set, ZIPL will panic
+instead of booting the OS.
+
+As the lowcore can have quite a high entropy for a guest that did drop
+out of protected mode (i.e. rebooted) we encountered the ZIPL panic
+quite often.
+
+Signed-off-by: Janosch Frank <[e-mail]>
+Tested-by: Marc Hartmayer <[e-mail]>
+Message-Id: <[e-mail]>
+Reviewed-by: Christian Borntraeger <[e-mail]>
+Reviewed-by: David Hildenbrand <[e-mail]>
+Signed-off-by: Christian Borntraeger <[e-mail]>
+
+Forwarded: https://lists.gnu.org/archive/html/qemu-devel/2020-03/msg06247.html
+Origin: backport, https://github.com/borntraeger/qemu/commit/6c657fba3b
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1835546
+Last-Update: 2020-03-20
+
+---
+ pc-bios/s390-ccw/jump2ipl.c  |  1 +
+ pc-bios/s390-ccw/main.c      |  8 +++++++-
+ pc-bios/s390-ccw/netmain.c   |  1 +
+ pc-bios/s390-ccw/s390-arch.h | 10 ++++++++--
+ pc-bios/s390-ccw/s390-ccw.h  |  1 +
+ 5 files changed, 18 insertions(+), 3 deletions(-)
+
+diff --git a/pc-bios/s390-ccw/jump2ipl.c b/pc-bios/s390-ccw/jump2ipl.c
+index 266f1502b9..1489e5043c 100644
+--- a/pc-bios/s390-ccw/jump2ipl.c
++++ b/pc-bios/s390-ccw/jump2ipl.c
+@@ -35,6 +35,7 @@ void jump_to_IPL_code(uint64_t address)
+ {
+     /* store the subsystem information _after_ the bootmap was loaded */
+     write_subsystem_identification();
++    write_iplb_location();
+ 
+     /* prevent unknown IPL types in the guest */
+     if (iplb.pbt == S390_IPL_TYPE_QEMU_SCSI) {
+diff --git a/pc-bios/s390-ccw/main.c b/pc-bios/s390-ccw/main.c
+index a21b386280..4e65b411e1 100644
+--- a/pc-bios/s390-ccw/main.c
++++ b/pc-bios/s390-ccw/main.c
+@@ -9,6 +9,7 @@
+  */
+ 
+ #include "libc.h"
++#include "helper.h"
+ #include "s390-arch.h"
+ #include "s390-ccw.h"
+ #include "cio.h"
+@@ -22,7 +23,7 @@ QemuIplParameters qipl;
+ IplParameterBlock iplb __attribute__((__aligned__(PAGE_SIZE)));
+ static bool have_iplb;
+ static uint16_t cutype;
+-LowCore const *lowcore; /* Yes, this *is* a pointer to address 0 */
++LowCore *lowcore; /* Yes, this *is* a pointer to address 0 */
+ 
+ #define LOADPARM_PROMPT "PROMPT  "
+ #define LOADPARM_EMPTY  "        "
+@@ -42,6 +43,11 @@ void write_subsystem_identification(void)
+     *zeroes = 0;
+ }
+ 
++void write_iplb_location(void)
++{
++    lowcore->ptr_iplb = ptr2u32(&iplb);
++}
++
+ void panic(const char *string)
+ {
+     sclp_print(string);
+diff --git a/pc-bios/s390-ccw/netmain.c b/pc-bios/s390-ccw/netmain.c
+index f2dcc01e27..309ffa30d9 100644
+--- a/pc-bios/s390-ccw/netmain.c
++++ b/pc-bios/s390-ccw/netmain.c
+@@ -40,6 +40,7 @@
+ #define DEFAULT_TFTP_RETRIES 20
+ 
+ extern char _start[];
++void write_iplb_location(void) {}
+ 
+ #define KERNEL_ADDR             ((void *)0L)
+ #define KERNEL_MAX_SIZE         ((long)_start)
+diff --git a/pc-bios/s390-ccw/s390-arch.h b/pc-bios/s390-ccw/s390-arch.h
+index 504fc7c2f0..5f36361c02 100644
+--- a/pc-bios/s390-ccw/s390-arch.h
++++ b/pc-bios/s390-ccw/s390-arch.h
+@@ -36,7 +36,13 @@ typedef struct LowCore {
+     /* prefix area: defined by architecture */
+     PSWLegacy       ipl_psw;                  /* 0x000 */
+     uint32_t        ccw1[2];                  /* 0x008 */
+-    uint32_t        ccw2[2];                  /* 0x010 */
++    union {
++        uint32_t        ccw2[2];                  /* 0x010 */
++        struct {
++            uint32_t reserved10;
++            uint32_t ptr_iplb;
++        };
++    };
+     uint8_t         pad1[0x80 - 0x18];        /* 0x018 */
+     uint32_t        ext_params;               /* 0x080 */
+     uint16_t        cpu_addr;                 /* 0x084 */
+@@ -85,7 +91,7 @@ typedef struct LowCore {
+     PSW             io_new_psw;               /* 0x1f0 */
+ } __attribute__((packed, aligned(8192))) LowCore;
+ 
+-extern LowCore const *lowcore;
++extern LowCore *lowcore;
+ 
+ static inline void set_prefix(uint32_t address)
+ {
+diff --git a/pc-bios/s390-ccw/s390-ccw.h b/pc-bios/s390-ccw/s390-ccw.h
+index 11bce7d73c..21f27e7990 100644
+--- a/pc-bios/s390-ccw/s390-ccw.h
++++ b/pc-bios/s390-ccw/s390-ccw.h
+@@ -57,6 +57,7 @@ void consume_io_int(void);
+ /* main.c */
+ void panic(const char *string);
+ void write_subsystem_identification(void);
++void write_iplb_location(void);
+ extern char stack[PAGE_SIZE * 8] __attribute__((__aligned__(PAGE_SIZE)));
+ unsigned int get_loadparm_index(void);
+ 
+-- 
+2.25.1
+
diff --git a/debian/patches/ubuntu/lp-1835546-s390x-Add-SIDA-memory-ops.patch b/debian/patches/ubuntu/lp-1835546-s390x-Add-SIDA-memory-ops.patch
new file mode 100644
index 0000000..ba58e8a
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1835546-s390x-Add-SIDA-memory-ops.patch
@@ -0,0 +1,141 @@
+From f3673a4cba21dae20c2a87bd6639a2e03ef7ff39 Mon Sep 17 00:00:00 2001
+From: Janosch Frank <[e-mail]>
+Date: Wed, 5 Feb 2020 06:57:35 -0500
+Subject: [PATCH] s390x: Add SIDA memory ops
+
+Protected guests save the instruction control blocks in the SIDA
+instead of QEMU/KVM directly accessing the guest's memory.
+
+Let's introduce new functions to access the SIDA.
+
+The memops for doing so are available with KVM_CAP_S390_PROTECTED, so
+let's check for that.
+
+Signed-off-by: Janosch Frank <[e-mail]>
+Reviewed-by: David Hildenbrand <[e-mail]>
+Reviewed-by: Christian Borntraeger <[e-mail]>
+Reviewed-by: Claudio Imbrenda <[e-mail]>
+Reviewed-by: Cornelia Huck <[e-mail]>
+
+Forwarded: https://lists.gnu.org/archive/html/qemu-devel/2020-03/msg06247.html
+Origin: backport, https://github.com/borntraeger/qemu/commit/f3673a4cba
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1835546
+Last-Update: 2020-03-20
+
+---
+ target/s390x/cpu.h        |  7 ++++++-
+ target/s390x/kvm.c        | 26 ++++++++++++++++++++++++++
+ target/s390x/kvm_s390x.h  |  2 ++
+ target/s390x/mmu_helper.c | 14 ++++++++++++++
+ 4 files changed, 48 insertions(+), 1 deletion(-)
+
+diff --git a/target/s390x/cpu.h b/target/s390x/cpu.h
+index d2af13b345..2ec0f78b48 100644
+--- a/target/s390x/cpu.h
++++ b/target/s390x/cpu.h
+@@ -821,7 +821,12 @@ int s390_cpu_virt_mem_rw(S390CPU *cpu, vaddr laddr, uint8_t ar, void *hostbuf,
+ #define s390_cpu_virt_mem_check_write(cpu, laddr, ar, len)   \
+         s390_cpu_virt_mem_rw(cpu, laddr, ar, NULL, len, true)
+ void s390_cpu_virt_mem_handle_exc(S390CPU *cpu, uintptr_t ra);
+-
++int s390_cpu_pv_mem_rw(S390CPU *cpu, unsigned int offset, void *hostbuf,
++                       int len, bool is_write);
++#define s390_cpu_pv_mem_read(cpu, offset, dest, len)    \
++        s390_cpu_pv_mem_rw(cpu, offset, dest, len, false)
++#define s390_cpu_pv_mem_write(cpu, offset, dest, len)       \
++        s390_cpu_pv_mem_rw(cpu, offset, dest, len, true)
+ 
+ /* sigp.c */
+ int s390_cpu_restart(S390CPU *cpu);
+diff --git a/target/s390x/kvm.c b/target/s390x/kvm.c
+index abeeaaa674..941e4df630 100644
+--- a/target/s390x/kvm.c
++++ b/target/s390x/kvm.c
+@@ -154,6 +154,7 @@ static int cap_ri;
+ static int cap_gs;
+ static int cap_hpage_1m;
+ static int cap_vcpu_resets;
++static int cap_protected;
+ 
+ static int active_cmma;
+ 
+@@ -351,6 +352,7 @@ int kvm_arch_init(MachineState *ms, KVMState *s)
+     cap_mem_op = kvm_check_extension(s, KVM_CAP_S390_MEM_OP);
+     cap_s390_irq = kvm_check_extension(s, KVM_CAP_S390_INJECT_IRQ);
+     cap_vcpu_resets = kvm_check_extension(s, KVM_CAP_S390_VCPU_RESETS);
++    cap_protected = kvm_check_extension(s, KVM_CAP_S390_PROTECTED);
+ 
+     if (!kvm_check_extension(s, KVM_CAP_S390_GMAP)
+         || !kvm_check_extension(s, KVM_CAP_S390_COW)) {
+@@ -848,6 +850,30 @@ int kvm_s390_mem_op(S390CPU *cpu, vaddr addr, uint8_t ar, void *hostbuf,
+     return ret;
+ }
+ 
++int kvm_s390_mem_op_pv(S390CPU *cpu, uint64_t offset, void *hostbuf,
++                       int len, bool is_write)
++{
++    struct kvm_s390_mem_op mem_op = {
++        .sida_offset = offset,
++        .size = len,
++        .op = is_write ? KVM_S390_MEMOP_SIDA_WRITE
++                       : KVM_S390_MEMOP_SIDA_READ,
++        .buf = (uint64_t)hostbuf,
++    };
++    int ret;
++
++    if (!cap_mem_op || !cap_protected) {
++        return -ENOSYS;
++    }
++
++    ret = kvm_vcpu_ioctl(CPU(cpu), KVM_S390_MEM_OP, &mem_op);
++    if (ret < 0) {
++        error_report("KVM_S390_MEM_OP failed: %s", strerror(-ret));
++        abort();
++    }
++    return ret;
++}
++
+ /*
+  * Legacy layout for s390:
+  * Older S390 KVM requires the topmost vma of the RAM to be
+diff --git a/target/s390x/kvm_s390x.h b/target/s390x/kvm_s390x.h
+index dea813f450..6ab17c81b7 100644
+--- a/target/s390x/kvm_s390x.h
++++ b/target/s390x/kvm_s390x.h
+@@ -19,6 +19,8 @@ void kvm_s390_vcpu_interrupt(S390CPU *cpu, struct kvm_s390_irq *irq);
+ void kvm_s390_access_exception(S390CPU *cpu, uint16_t code, uint64_t te_code);
+ int kvm_s390_mem_op(S390CPU *cpu, vaddr addr, uint8_t ar, void *hostbuf,
+                     int len, bool is_write);
++int kvm_s390_mem_op_pv(S390CPU *cpu, vaddr addr, void *hostbuf, int len,
++                       bool is_write);
+ void kvm_s390_program_interrupt(S390CPU *cpu, uint16_t code);
+ int kvm_s390_set_cpu_state(S390CPU *cpu, uint8_t cpu_state);
+ void kvm_s390_vcpu_interrupt_pre_save(S390CPU *cpu);
+diff --git a/target/s390x/mmu_helper.c b/target/s390x/mmu_helper.c
+index c9f3f34750..ec8befbdc8 100644
+--- a/target/s390x/mmu_helper.c
++++ b/target/s390x/mmu_helper.c
+@@ -474,6 +474,20 @@ static int translate_pages(S390CPU *cpu, vaddr addr, int nr_pages,
+     return 0;
+ }
+ 
++int s390_cpu_pv_mem_rw(S390CPU *cpu, unsigned int offset, void *hostbuf,
++                       int len, bool is_write)
++{
++    int ret;
++
++    if (kvm_enabled()) {
++        ret = kvm_s390_mem_op_pv(cpu, offset, hostbuf, len, is_write);
++    } else {
++        /* Protected Virtualization is a KVM/Hardware only feature */
++        g_assert_not_reached();
++    }
++    return ret;
++}
++
+ /**
+  * s390_cpu_virt_mem_rw:
+  * @laddr:     the logical start address
+-- 
+2.25.1
+
diff --git a/debian/patches/ubuntu/lp-1835546-s390x-Add-missing-vcpu-reset-functions.patch b/debian/patches/ubuntu/lp-1835546-s390x-Add-missing-vcpu-reset-functions.patch
new file mode 100644
index 0000000..41595f0
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1835546-s390x-Add-missing-vcpu-reset-functions.patch
@@ -0,0 +1,165 @@
+From cdb7c92623442b8a4052011d20ac46dbc17ab064 Mon Sep 17 00:00:00 2001
+From: Janosch Frank <[e-mail]>
+Date: Fri, 14 Feb 2020 10:16:21 -0500
+Subject: [PATCH] s390x: Add missing vcpu reset functions
+
+Up to now we only had an ioctl to reset vcpu data QEMU couldn't reach
+for the initial reset, which was also called for the clear reset. To
+be architecture compliant, we also need to clear local interrupts on a
+normal reset.
+
+Because of this and the upcoming protvirt support we need to add
+ioctls for the missing clear and normal resets.
+
+Signed-off-by: Janosch Frank <[e-mail]>
+Reviewed-by: Thomas Huth <[e-mail]>
+Acked-by: David Hildenbrand <[e-mail]>
+Message-Id: <[e-mail]>
+Signed-off-by: Cornelia Huck <[e-mail]>
+
+Forwarded: https://lists.gnu.org/archive/html/qemu-devel/2020-03/msg06247.html
+Origin: backport, https://github.com/borntraeger/qemu/commit/cdb7c92623
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1835546
+Last-Update: 2020-03-20
+
+---
+ target/s390x/cpu.c       | 14 ++++++++++++--
+ target/s390x/kvm-stub.c  | 10 +++++++++-
+ target/s390x/kvm.c       | 42 ++++++++++++++++++++++++++++++++--------
+ target/s390x/kvm_s390x.h |  4 +++-
+ 4 files changed, 58 insertions(+), 12 deletions(-)
+
+diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
+index bd39cb54b7..52fefa1586 100644
+--- a/target/s390x/cpu.c
++++ b/target/s390x/cpu.c
+@@ -131,8 +131,18 @@ static void s390_cpu_reset(CPUState *s, cpu_reset_type type)
+     }
+ 
+     /* Reset state inside the kernel that we cannot access yet from QEMU. */
+-    if (kvm_enabled() && type != S390_CPU_RESET_NORMAL) {
+-        kvm_s390_reset_vcpu(cpu);
++    if (kvm_enabled()) {
++        switch (type) {
++        case S390_CPU_RESET_CLEAR:
++            kvm_s390_reset_vcpu_clear(cpu);
++            break;
++        case S390_CPU_RESET_INITIAL:
++            kvm_s390_reset_vcpu_initial(cpu);
++            break;
++        case S390_CPU_RESET_NORMAL:
++            kvm_s390_reset_vcpu_normal(cpu);
++            break;
++        }
+     }
+ }
+ 
+diff --git a/target/s390x/kvm-stub.c b/target/s390x/kvm-stub.c
+index 5152e2bdf1..c4cd497f85 100644
+--- a/target/s390x/kvm-stub.c
++++ b/target/s390x/kvm-stub.c
+@@ -83,7 +83,15 @@ void kvm_s390_cmma_reset(void)
+ {
+ }
+ 
+-void kvm_s390_reset_vcpu(S390CPU *cpu)
++void kvm_s390_reset_vcpu_initial(S390CPU *cpu)
++{
++}
++
++void kvm_s390_reset_vcpu_clear(S390CPU *cpu)
++{
++}
++
++void kvm_s390_reset_vcpu_normal(S390CPU *cpu)
+ {
+ }
+ 
+diff --git a/target/s390x/kvm.c b/target/s390x/kvm.c
+index ad6e38c876..f633472980 100644
+--- a/target/s390x/kvm.c
++++ b/target/s390x/kvm.c
+@@ -151,6 +151,7 @@ static int cap_s390_irq;
+ static int cap_ri;
+ static int cap_gs;
+ static int cap_hpage_1m;
++static int cap_vcpu_resets;
+ 
+ static int active_cmma;
+ 
+@@ -342,6 +343,7 @@ int kvm_arch_init(MachineState *ms, KVMState *s)
+     cap_async_pf = kvm_check_extension(s, KVM_CAP_ASYNC_PF);
+     cap_mem_op = kvm_check_extension(s, KVM_CAP_S390_MEM_OP);
+     cap_s390_irq = kvm_check_extension(s, KVM_CAP_S390_INJECT_IRQ);
++    cap_vcpu_resets = kvm_check_extension(s, KVM_CAP_S390_VCPU_RESETS);
+ 
+     if (!kvm_check_extension(s, KVM_CAP_S390_GMAP)
+         || !kvm_check_extension(s, KVM_CAP_S390_COW)) {
+@@ -403,17 +405,41 @@ int kvm_arch_destroy_vcpu(CPUState *cs)
+     return 0;
+ }
+ 
+-void kvm_s390_reset_vcpu(S390CPU *cpu)
++static void kvm_s390_reset_vcpu(S390CPU *cpu, unsigned long type)
+ {
+     CPUState *cs = CPU(cpu);
+ 
+-    /* The initial reset call is needed here to reset in-kernel
+-     * vcpu data that we can't access directly from QEMU
+-     * (i.e. with older kernels which don't support sync_regs/ONE_REG).
+-     * Before this ioctl cpu_synchronize_state() is called in common kvm
+-     * code (kvm-all) */
+-    if (kvm_vcpu_ioctl(cs, KVM_S390_INITIAL_RESET, NULL)) {
+-        error_report("Initial CPU reset failed on CPU %i", cs->cpu_index);
++    /*
++     * The reset call is needed here to reset in-kernel vcpu data that
++     * we can't access directly from QEMU (i.e. with older kernels
++     * which don't support sync_regs/ONE_REG).  Before this ioctl
++     * cpu_synchronize_state() is called in common kvm code
++     * (kvm-all).
++     */
++    if (kvm_vcpu_ioctl(cs, type)) {
++        error_report("CPU reset failed on CPU %i type %lx",
++                     cs->cpu_index, type);
++    }
++}
++
++void kvm_s390_reset_vcpu_initial(S390CPU *cpu)
++{
++    kvm_s390_reset_vcpu(cpu, KVM_S390_INITIAL_RESET);
++}
++
++void kvm_s390_reset_vcpu_clear(S390CPU *cpu)
++{
++    if (cap_vcpu_resets) {
++        kvm_s390_reset_vcpu(cpu, KVM_S390_CLEAR_RESET);
++    } else {
++        kvm_s390_reset_vcpu(cpu, KVM_S390_INITIAL_RESET);
++    }
++}
++
++void kvm_s390_reset_vcpu_normal(S390CPU *cpu)
++{
++    if (cap_vcpu_resets) {
++        kvm_s390_reset_vcpu(cpu, KVM_S390_NORMAL_RESET);
+     }
+ }
+ 
+diff --git a/target/s390x/kvm_s390x.h b/target/s390x/kvm_s390x.h
+index caf985955b..0b21789796 100644
+--- a/target/s390x/kvm_s390x.h
++++ b/target/s390x/kvm_s390x.h
+@@ -34,7 +34,9 @@ int kvm_s390_assign_subch_ioeventfd(EventNotifier *notifier, uint32_t sch,
+                                     int vq, bool assign);
+ int kvm_s390_cmma_active(void);
+ void kvm_s390_cmma_reset(void);
+-void kvm_s390_reset_vcpu(S390CPU *cpu);
++void kvm_s390_reset_vcpu_clear(S390CPU *cpu);
++void kvm_s390_reset_vcpu_normal(S390CPU *cpu);
++void kvm_s390_reset_vcpu_initial(S390CPU *cpu);
+ int kvm_s390_set_mem_limit(uint64_t new_limit, uint64_t *hw_limit);
+ void kvm_s390_set_max_pagesize(uint64_t pagesize, Error **errp);
+ void kvm_s390_crypto_reset(void);
+-- 
+2.25.1
+
diff --git a/debian/patches/ubuntu/lp-1835546-s390x-Add-unpack-facility-feature-to-GA1.patch b/debian/patches/ubuntu/lp-1835546-s390x-Add-unpack-facility-feature-to-GA1.patch
new file mode 100644
index 0000000..d77477d
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1835546-s390x-Add-unpack-facility-feature-to-GA1.patch
@@ -0,0 +1,67 @@
+From 8c284a11c5dd980fd2cea00306c18ea644c0754d Mon Sep 17 00:00:00 2001
+From: Christian Borntraeger <[e-mail]>
+Date: Tue, 25 Feb 2020 06:28:51 -0500
+Subject: [PATCH] s390x: Add unpack facility feature to GA1
+
+The unpack facility is an indication that diagnose 308 subcodes 8-10
+are available to the guest. That means, that the guest can put itself
+into protected mode.
+
+Once it is in protected mode, the hardware stops any attempt of VM
+introspection by the hypervisor.
+
+Some features are currently not supported in protected mode:
+     * vfio devices
+     * Migration
+     * Huge page backings
+
+Signed-off-by: Christian Borntraeger <[e-mail]>
+Reviewed-by: David Hildenbrand <[e-mail]>
+Reviewed-by: Claudio Imbrenda <[e-mail]>
+Reviewed-by: Cornelia Huck <[e-mail]>
+Signed-off-by: Janosch Frank <[e-mail]>
+
+Forwarded: https://lists.gnu.org/archive/html/qemu-devel/2020-03/msg06247.html
+Origin: backport, https://github.com/borntraeger/qemu/commit/8c284a11c5
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1835546
+Last-Update: 2020-03-20
+
+---
+ target/s390x/gen-features.c | 1 +
+ target/s390x/kvm.c          | 8 ++++++++
+ 2 files changed, 9 insertions(+)
+
+diff --git a/target/s390x/gen-features.c b/target/s390x/gen-features.c
+index 6278845b12..8ddeebc544 100644
+--- a/target/s390x/gen-features.c
++++ b/target/s390x/gen-features.c
+@@ -562,6 +562,7 @@ static uint16_t full_GEN15_GA1[] = {
+     S390_FEAT_GROUP_MSA_EXT_9,
+     S390_FEAT_GROUP_MSA_EXT_9_PCKMO,
+     S390_FEAT_ETOKEN,
++    S390_FEAT_UNPACK,
+ };
+ 
+ /* Default features (in order of release)
+diff --git a/target/s390x/kvm.c b/target/s390x/kvm.c
+index d94b915da4..8b82e4c93d 100644
+--- a/target/s390x/kvm.c
++++ b/target/s390x/kvm.c
+@@ -2407,6 +2407,14 @@ void kvm_s390_get_host_cpu_model(S390CPUModel *model, Error **errp)
+         clear_bit(S390_FEAT_BPB, model->features);
+     }
+ 
++    /*
++     * If we have support for protected virtualization, indicate
++     * the protected virtualization IPL unpack facility.
++     */
++    if (cap_protected) {
++        set_bit(S390_FEAT_UNPACK, model->features);
++    }
++
+     /* We emulate a zPCI bus and AEN, therefore we don't need HW support */
+     set_bit(S390_FEAT_ZPCI, model->features);
+     set_bit(S390_FEAT_ADAPTER_EVENT_NOTIFICATION, model->features);
+-- 
+2.25.1
+
diff --git a/debian/patches/ubuntu/lp-1835546-s390x-Beautify-diag308-handling.patch b/debian/patches/ubuntu/lp-1835546-s390x-Beautify-diag308-handling.patch
new file mode 100644
index 0000000..ab401a1
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1835546-s390x-Beautify-diag308-handling.patch
@@ -0,0 +1,119 @@
+From 4fb238b4b0ba7ba6d42d5d7e1f3da27e619e872c Mon Sep 17 00:00:00 2001
+From: Janosch Frank <[e-mail]>
+Date: Wed, 27 Nov 2019 12:50:45 -0500
+Subject: [PATCH] s390x: Beautify diag308 handling
+
+Let's improve readability by:
+* Using constants for the subcodes
+* Moving parameter checking into a function
+* Removing subcode > 6 check as the default case catches that
+
+Signed-off-by: Janosch Frank <[e-mail]>
+Reviewed-by: Cornelia Huck <[e-mail]>
+Reviewed-by: Thomas Huth <[e-mail]>
+Reviewed-by: David Hildenbrand <[e-mail]>
+Message-Id: <[e-mail]>
+Signed-off-by: Cornelia Huck <[e-mail]>
+
+Forwarded: https://lists.gnu.org/archive/html/qemu-devel/2020-03/msg06247.html
+Origin: backport, https://github.com/borntraeger/qemu/commit/4fb238b4b0
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1835546
+Last-Update: 2020-03-20
+
+---
+ target/s390x/diag.c | 54 +++++++++++++++++++++++++++------------------
+ 1 file changed, 32 insertions(+), 22 deletions(-)
+
+diff --git a/target/s390x/diag.c b/target/s390x/diag.c
+index 0c81d8e1ef..54e5670b3f 100644
+--- a/target/s390x/diag.c
++++ b/target/s390x/diag.c
+@@ -53,6 +53,29 @@ int handle_diag_288(CPUS390XState *env, uint64_t r1, uint64_t r3)
+ #define DIAG_308_RC_NO_CONF         0x0102
+ #define DIAG_308_RC_INVALID         0x0402
+ 
++#define DIAG308_RESET_MOD_CLR       0
++#define DIAG308_RESET_LOAD_NORM     1
++#define DIAG308_LOAD_CLEAR          3
++#define DIAG308_LOAD_NORMAL_DUMP    4
++#define DIAG308_SET                 5
++#define DIAG308_STORE               6
++
++static int diag308_parm_check(CPUS390XState *env, uint64_t r1, uint64_t addr,
++                              uintptr_t ra, bool write)
++{
++    if ((r1 & 1) || (addr & ~TARGET_PAGE_MASK)) {
++        s390_program_interrupt(env, PGM_SPECIFICATION, ra);
++        return -1;
++    }
++    if (!address_space_access_valid(&address_space_memory, addr,
++                                    sizeof(IplParameterBlock), write,
++                                    MEMTXATTRS_UNSPECIFIED)) {
++        s390_program_interrupt(env, PGM_ADDRESSING, ra);
++        return -1;
++    }
++    return 0;
++}
++
+ void handle_diag_308(CPUS390XState *env, uint64_t r1, uint64_t r3, uintptr_t ra)
+ {
+     CPUState *cs = env_cpu(env);
+@@ -65,30 +88,24 @@ void handle_diag_308(CPUS390XState *env, uint64_t r1, uint64_t r3, uintptr_t ra)
+         return;
+     }
+ 
+-    if ((subcode & ~0x0ffffULL) || (subcode > 6)) {
++    if (subcode & ~0x0ffffULL) {
+         s390_program_interrupt(env, PGM_SPECIFICATION, ra);
+         return;
+     }
+ 
+     switch (subcode) {
+-    case 0:
++    case DIAG308_RESET_MOD_CLR:
+         s390_ipl_reset_request(cs, S390_RESET_MODIFIED_CLEAR);
+         break;
+-    case 1:
++    case DIAG308_RESET_LOAD_NORM:
+         s390_ipl_reset_request(cs, S390_RESET_LOAD_NORMAL);
+         break;
+-    case 3:
++    case DIAG308_LOAD_CLEAR:
++        /* Well we still lack the clearing bit... */
+         s390_ipl_reset_request(cs, S390_RESET_REIPL);
+         break;
+-    case 5:
+-        if ((r1 & 1) || (addr & 0x0fffULL)) {
+-            s390_program_interrupt(env, PGM_SPECIFICATION, ra);
+-            return;
+-        }
+-        if (!address_space_access_valid(&address_space_memory, addr,
+-                                        sizeof(IplParameterBlock), false,
+-                                        MEMTXATTRS_UNSPECIFIED)) {
+-            s390_program_interrupt(env, PGM_ADDRESSING, ra);
++    case DIAG308_SET:
++        if (diag308_parm_check(env, r1, addr, ra, false)) {
+             return;
+         }
+         iplb = g_new0(IplParameterBlock, 1);
+@@ -110,15 +127,8 @@ void handle_diag_308(CPUS390XState *env, uint64_t r1, uint64_t r3, uintptr_t ra)
+ out:
+         g_free(iplb);
+         return;
+-    case 6:
+-        if ((r1 & 1) || (addr & 0x0fffULL)) {
+-            s390_program_interrupt(env, PGM_SPECIFICATION, ra);
+-            return;
+-        }
+-        if (!address_space_access_valid(&address_space_memory, addr,
+-                                        sizeof(IplParameterBlock), true,
+-                                        MEMTXATTRS_UNSPECIFIED)) {
+-            s390_program_interrupt(env, PGM_ADDRESSING, ra);
++    case DIAG308_STORE:
++        if (diag308_parm_check(env, r1, addr, ra, true)) {
+             return;
+         }
+         iplb = s390_ipl_get_iplb();
+-- 
+2.25.1
+
diff --git a/debian/patches/ubuntu/lp-1835546-s390x-Don-t-do-a-normal-reset-on-the-initial-cpu.patch b/debian/patches/ubuntu/lp-1835546-s390x-Don-t-do-a-normal-reset-on-the-initial-cpu.patch
new file mode 100644
index 0000000..0f0d987
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1835546-s390x-Don-t-do-a-normal-reset-on-the-initial-cpu.patch
@@ -0,0 +1,41 @@
+From c300ee105ad5458eb9f8d302e54d8f3cc70963fd Mon Sep 17 00:00:00 2001
+From: Janosch Frank <[e-mail]>
+Date: Wed, 27 Nov 2019 12:50:41 -0500
+Subject: [PATCH] s390x: Don't do a normal reset on the initial cpu
+
+The initiating cpu needs to be reset with an initial reset. While
+doing a normal reset followed by a initial reset is not wrong per se,
+the Ultravisor will only allow the correct reset to be performed.
+
+Signed-off-by: Janosch Frank <[e-mail]>
+Reviewed-by: David Hildenbrand <[e-mail]>
+Reviewed-by: Cornelia Huck <[e-mail]>
+Message-Id: <[e-mail]>
+Signed-off-by: Cornelia Huck <[e-mail]>
+
+Forwarded: https://lists.gnu.org/archive/html/qemu-devel/2020-03/msg06247.html
+Origin: backport, https://github.com/borntraeger/qemu/commit/c300ee105a
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1835546
+Last-Update: 2020-03-20
+
+---
+ hw/s390x/s390-virtio-ccw.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
+index d3edeef0ad..c1d1440272 100644
+--- a/hw/s390x/s390-virtio-ccw.c
++++ b/hw/s390x/s390-virtio-ccw.c
+@@ -348,6 +348,9 @@ static void s390_machine_reset(MachineState *machine)
+         break;
+     case S390_RESET_LOAD_NORMAL:
+         CPU_FOREACH(t) {
++            if (t == cs) {
++                continue;
++            }
+             run_on_cpu(t, s390_do_cpu_reset, RUN_ON_CPU_NULL);
+         }
+         subsystem_reset();
+-- 
+2.25.1
+
diff --git a/debian/patches/ubuntu/lp-1835546-s390x-Move-clear-reset.patch b/debian/patches/ubuntu/lp-1835546-s390x-Move-clear-reset.patch
new file mode 100644
index 0000000..ac56ad5
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1835546-s390x-Move-clear-reset.patch
@@ -0,0 +1,135 @@
+From af3f6e479284aa297ad2a85bb3eab305376d138a Mon Sep 17 00:00:00 2001
+From: Janosch Frank <[e-mail]>
+Date: Wed, 27 Nov 2019 12:50:44 -0500
+Subject: [PATCH] s390x: Move clear reset
+
+Let's also move the clear reset function into the reset handler.
+
+Signed-off-by: Janosch Frank <[e-mail]>
+Message-Id: <[e-mail]>
+Reviewed-by: David Hildenbrand <[e-mail]>
+Reviewed-by: Thomas Huth <[e-mail]>
+Signed-off-by: Cornelia Huck <[e-mail]>
+
+Forwarded: https://lists.gnu.org/archive/html/qemu-devel/2020-03/msg06247.html
+Origin: backport, https://github.com/borntraeger/qemu/commit/af3f6e4792
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1835546
+Last-Update: 2020-03-20
+
+---
+ target/s390x/cpu-qom.h |  1 +
+ target/s390x/cpu.c     | 58 +++++++++++++-----------------------------
+ 2 files changed, 18 insertions(+), 41 deletions(-)
+
+diff --git a/target/s390x/cpu-qom.h b/target/s390x/cpu-qom.h
+index 6f0a12042e..dbe5346ec9 100644
+--- a/target/s390x/cpu-qom.h
++++ b/target/s390x/cpu-qom.h
+@@ -37,6 +37,7 @@ typedef struct S390CPUDef S390CPUDef;
+ typedef enum cpu_reset_type {
+     S390_CPU_RESET_NORMAL,
+     S390_CPU_RESET_INITIAL,
++    S390_CPU_RESET_CLEAR,
+ } cpu_reset_type;
+ 
+ /**
+diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
+index ca62fe7685..bd39cb54b7 100644
+--- a/target/s390x/cpu.c
++++ b/target/s390x/cpu.c
+@@ -94,6 +94,9 @@ static void s390_cpu_reset(CPUState *s, cpu_reset_type type)
+     s390_cpu_set_state(S390_CPU_STATE_STOPPED, cpu);
+ 
+     switch (type) {
++    case S390_CPU_RESET_CLEAR:
++        memset(env, 0, offsetof(CPUS390XState, start_initial_reset_fields));
++        /* fall through */
+     case S390_CPU_RESET_INITIAL:
+         /* initial reset does not clear everything! */
+         memset(&env->start_initial_reset_fields, 0,
+@@ -107,6 +110,14 @@ static void s390_cpu_reset(CPUState *s, cpu_reset_type type)
+         env->cregs[0] = CR0_RESET;
+         env->cregs[14] = CR14_RESET;
+ 
++#if defined(CONFIG_USER_ONLY)
++        /* user mode should always be allowed to use the full FPU */
++        env->cregs[0] |= CR0_AFP;
++        if (s390_has_feat(S390_FEAT_VECTOR)) {
++            env->cregs[0] |= CR0_VECTOR;
++        }
++#endif
++
+         /* tininess for underflow is detected before rounding */
+         set_float_detect_tininess(float_tininess_before_rounding,
+                                   &env->fpu_status);
+@@ -125,46 +136,6 @@ static void s390_cpu_reset(CPUState *s, cpu_reset_type type)
+     }
+ }
+ 
+-/* CPUClass:reset() */
+-static void s390_cpu_full_reset(CPUState *s)
+-{
+-    S390CPU *cpu = S390_CPU(s);
+-    S390CPUClass *scc = S390_CPU_GET_CLASS(cpu);
+-    CPUS390XState *env = &cpu->env;
+-
+-    scc->parent_reset(s);
+-    cpu->env.sigp_order = 0;
+-    s390_cpu_set_state(S390_CPU_STATE_STOPPED, cpu);
+-
+-    memset(env, 0, offsetof(CPUS390XState, end_reset_fields));
+-
+-    /* architectured initial values for CR 0 and 14 */
+-    env->cregs[0] = CR0_RESET;
+-    env->cregs[14] = CR14_RESET;
+-
+-#if defined(CONFIG_USER_ONLY)
+-    /* user mode should always be allowed to use the full FPU */
+-    env->cregs[0] |= CR0_AFP;
+-    if (s390_has_feat(S390_FEAT_VECTOR)) {
+-        env->cregs[0] |= CR0_VECTOR;
+-    }
+-#endif
+-
+-    /* architectured initial value for Breaking-Event-Address register */
+-    env->gbea = 1;
+-
+-    env->pfault_token = -1UL;
+-
+-    /* tininess for underflow is detected before rounding */
+-    set_float_detect_tininess(float_tininess_before_rounding,
+-                              &env->fpu_status);
+-
+-    /* Reset state inside the kernel that we cannot access yet from QEMU. */
+-    if (kvm_enabled()) {
+-        kvm_s390_reset_vcpu(cpu);
+-    }
+-}
+-
+ #if !defined(CONFIG_USER_ONLY)
+ static void s390_cpu_machine_reset_cb(void *opaque)
+ {
+@@ -456,6 +427,11 @@ static Property s390x_cpu_properties[] = {
+     DEFINE_PROP_END_OF_LIST()
+ };
+ 
++static void s390_cpu_reset_full(CPUState *s)
++{
++    return s390_cpu_reset(s, S390_CPU_RESET_CLEAR);
++}
++
+ static void s390_cpu_class_init(ObjectClass *oc, void *data)
+ {
+     S390CPUClass *scc = S390_CPU_CLASS(oc);
+@@ -472,7 +448,7 @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
+     scc->load_normal = s390_cpu_load_normal;
+ #endif
+     scc->reset = s390_cpu_reset;
+-    cc->reset = s390_cpu_full_reset;
++    cc->reset = s390_cpu_reset_full;
+     cc->class_by_name = s390_cpu_class_by_name,
+     cc->has_work = s390_cpu_has_work;
+ #ifdef CONFIG_TCG
+-- 
+2.25.1
+
diff --git a/debian/patches/ubuntu/lp-1835546-s390x-Move-diagnose-308-subcodes-and-rcs-into-ipl.h.patch b/debian/patches/ubuntu/lp-1835546-s390x-Move-diagnose-308-subcodes-and-rcs-into-ipl.h.patch
new file mode 100644
index 0000000..0bee0cb
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1835546-s390x-Move-diagnose-308-subcodes-and-rcs-into-ipl.h.patch
@@ -0,0 +1,67 @@
+From f0869bee7c19767fff70794d64f400bb201e82e3 Mon Sep 17 00:00:00 2001
+From: Janosch Frank <[e-mail]>
+Date: Fri, 13 Mar 2020 10:35:02 -0400
+Subject: [PATCH] s390x: Move diagnose 308 subcodes and rcs into ipl.h
+
+They are part of the IPL process, so let's put them into the ipl
+header.
+
+Signed-off-by: Janosch Frank <[e-mail]>
+
+Forwarded: https://lists.gnu.org/archive/html/qemu-devel/2020-03/msg06247.html
+Origin: backport, https://github.com/borntraeger/qemu/commit/f0869bee7c
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1835546
+Last-Update: 2020-03-20
+
+---
+ hw/s390x/ipl.h      | 11 +++++++++++
+ target/s390x/diag.c | 11 -----------
+ 2 files changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/hw/s390x/ipl.h b/hw/s390x/ipl.h
+index 3e44abe1c6..a5665e6bfd 100644
+--- a/hw/s390x/ipl.h
++++ b/hw/s390x/ipl.h
+@@ -159,6 +159,17 @@ struct S390IPLState {
+ typedef struct S390IPLState S390IPLState;
+ QEMU_BUILD_BUG_MSG(offsetof(S390IPLState, iplb) & 3, "alignment of iplb wrong");
+ 
++#define DIAG_308_RC_OK              0x0001
++#define DIAG_308_RC_NO_CONF         0x0102
++#define DIAG_308_RC_INVALID         0x0402
++
++#define DIAG308_RESET_MOD_CLR       0
++#define DIAG308_RESET_LOAD_NORM     1
++#define DIAG308_LOAD_CLEAR          3
++#define DIAG308_LOAD_NORMAL_DUMP    4
++#define DIAG308_SET                 5
++#define DIAG308_STORE               6
++
+ #define S390_IPL_TYPE_FCP 0x00
+ #define S390_IPL_TYPE_CCW 0x02
+ #define S390_IPL_TYPE_QEMU_SCSI 0xff
+diff --git a/target/s390x/diag.c b/target/s390x/diag.c
+index 54e5670b3f..8aba6341f9 100644
+--- a/target/s390x/diag.c
++++ b/target/s390x/diag.c
+@@ -49,17 +49,6 @@ int handle_diag_288(CPUS390XState *env, uint64_t r1, uint64_t r3)
+     return diag288_class->handle_timer(diag288, func, timeout);
+ }
+ 
+-#define DIAG_308_RC_OK              0x0001
+-#define DIAG_308_RC_NO_CONF         0x0102
+-#define DIAG_308_RC_INVALID         0x0402
+-
+-#define DIAG308_RESET_MOD_CLR       0
+-#define DIAG308_RESET_LOAD_NORM     1
+-#define DIAG308_LOAD_CLEAR          3
+-#define DIAG308_LOAD_NORMAL_DUMP    4
+-#define DIAG308_SET                 5
+-#define DIAG308_STORE               6
+-
+ static int diag308_parm_check(CPUS390XState *env, uint64_t r1, uint64_t addr,
+                               uintptr_t ra, bool write)
+ {
+-- 
+2.25.1
+
diff --git a/debian/patches/ubuntu/lp-1835546-s390x-Move-initial-reset.patch b/debian/patches/ubuntu/lp-1835546-s390x-Move-initial-reset.patch
new file mode 100644
index 0000000..05da572
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1835546-s390x-Move-initial-reset.patch
@@ -0,0 +1,148 @@
+From 57b68b74dcb355eee7b1543c70a427d26e04700f Mon Sep 17 00:00:00 2001
+From: Janosch Frank <[e-mail]>
+Date: Thu, 28 Nov 2019 03:37:23 -0500
+Subject: [PATCH] s390x: Move initial reset
+
+Let's move the intial reset into the reset handler and cleanup
+afterwards.
+
+Signed-off-by: Janosch Frank <[e-mail]>
+Reviewed-by: David Hildenbrand <[e-mail]>
+Message-Id: <[e-mail]>
+Reviewed-by: Thomas Huth <[e-mail]>
+Signed-off-by: Cornelia Huck <[e-mail]>
+
+Forwarded: https://lists.gnu.org/archive/html/qemu-devel/2020-03/msg06247.html
+Origin: backport, https://github.com/borntraeger/qemu/commit/57b68b74dc
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1835546
+Last-Update: 2020-03-20
+
+---
+ target/s390x/cpu-qom.h |  2 +-
+ target/s390x/cpu.c     | 46 +++++++++++++++++-------------------------
+ target/s390x/cpu.h     |  2 +-
+ target/s390x/sigp.c    |  2 +-
+ 4 files changed, 21 insertions(+), 31 deletions(-)
+
+diff --git a/target/s390x/cpu-qom.h b/target/s390x/cpu-qom.h
+index f3b71bac67..6f0a12042e 100644
+--- a/target/s390x/cpu-qom.h
++++ b/target/s390x/cpu-qom.h
+@@ -36,6 +36,7 @@ typedef struct S390CPUDef S390CPUDef;
+ 
+ typedef enum cpu_reset_type {
+     S390_CPU_RESET_NORMAL,
++    S390_CPU_RESET_INITIAL,
+ } cpu_reset_type;
+ 
+ /**
+@@ -62,7 +63,6 @@ typedef struct S390CPUClass {
+     void (*parent_reset)(CPUState *cpu);
+     void (*load_normal)(CPUState *cpu);
+     void (*reset)(CPUState *cpu, cpu_reset_type type);
+-    void (*initial_cpu_reset)(CPUState *cpu);
+ } S390CPUClass;
+ 
+ typedef struct S390CPU S390CPU;
+diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
+index 67d6fbfa44..ca62fe7685 100644
+--- a/target/s390x/cpu.c
++++ b/target/s390x/cpu.c
+@@ -94,6 +94,23 @@ static void s390_cpu_reset(CPUState *s, cpu_reset_type type)
+     s390_cpu_set_state(S390_CPU_STATE_STOPPED, cpu);
+ 
+     switch (type) {
++    case S390_CPU_RESET_INITIAL:
++        /* initial reset does not clear everything! */
++        memset(&env->start_initial_reset_fields, 0,
++               offsetof(CPUS390XState, end_reset_fields) -
++               offsetof(CPUS390XState, start_initial_reset_fields));
++
++        /* architectured initial value for Breaking-Event-Address register */
++        env->gbea = 1;
++
++        /* architectured initial values for CR 0 and 14 */
++        env->cregs[0] = CR0_RESET;
++        env->cregs[14] = CR14_RESET;
++
++        /* tininess for underflow is detected before rounding */
++        set_float_detect_tininess(float_tininess_before_rounding,
++                                  &env->fpu_status);
++       /* fall through */
+     case S390_CPU_RESET_NORMAL:
+         env->pfault_token = -1UL;
+         env->bpbc = false;
+@@ -101,35 +118,9 @@ static void s390_cpu_reset(CPUState *s, cpu_reset_type type)
+     default:
+         g_assert_not_reached();
+     }
+-}
+-
+-/* S390CPUClass::initial_reset() */
+-static void s390_cpu_initial_reset(CPUState *s)
+-{
+-    S390CPU *cpu = S390_CPU(s);
+-    CPUS390XState *env = &cpu->env;
+-
+-    s390_cpu_reset(s, S390_CPU_RESET_NORMAL);
+-    /* initial reset does not clear everything! */
+-    memset(&env->start_initial_reset_fields, 0,
+-        offsetof(CPUS390XState, end_reset_fields) -
+-        offsetof(CPUS390XState, start_initial_reset_fields));
+-
+-    /* architectured initial values for CR 0 and 14 */
+-    env->cregs[0] = CR0_RESET;
+-    env->cregs[14] = CR14_RESET;
+-
+-    /* architectured initial value for Breaking-Event-Address register */
+-    env->gbea = 1;
+-
+-    env->pfault_token = -1UL;
+-
+-    /* tininess for underflow is detected before rounding */
+-    set_float_detect_tininess(float_tininess_before_rounding,
+-                              &env->fpu_status);
+ 
+     /* Reset state inside the kernel that we cannot access yet from QEMU. */
+-    if (kvm_enabled()) {
++    if (kvm_enabled() && type != S390_CPU_RESET_NORMAL) {
+         kvm_s390_reset_vcpu(cpu);
+     }
+ }
+@@ -481,7 +472,6 @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
+     scc->load_normal = s390_cpu_load_normal;
+ #endif
+     scc->reset = s390_cpu_reset;
+-    scc->initial_cpu_reset = s390_cpu_initial_reset;
+     cc->reset = s390_cpu_full_reset;
+     cc->class_by_name = s390_cpu_class_by_name,
+     cc->has_work = s390_cpu_has_work;
+diff --git a/target/s390x/cpu.h b/target/s390x/cpu.h
+index 18123dfd5b..d2af13b345 100644
+--- a/target/s390x/cpu.h
++++ b/target/s390x/cpu.h
+@@ -748,7 +748,7 @@ static inline void s390_do_cpu_initial_reset(CPUState *cs, run_on_cpu_data arg)
+ {
+     S390CPUClass *scc = S390_CPU_GET_CLASS(cs);
+ 
+-    scc->initial_cpu_reset(cs);
++    scc->reset(cs, S390_CPU_RESET_INITIAL);
+ }
+ 
+ static inline void s390_do_cpu_load_normal(CPUState *cs, run_on_cpu_data arg)
+diff --git a/target/s390x/sigp.c b/target/s390x/sigp.c
+index 850139b9cd..727875bb4a 100644
+--- a/target/s390x/sigp.c
++++ b/target/s390x/sigp.c
+@@ -254,7 +254,7 @@ static void sigp_initial_cpu_reset(CPUState *cs, run_on_cpu_data arg)
+     SigpInfo *si = arg.host_ptr;
+ 
+     cpu_synchronize_state(cs);
+-    scc->initial_cpu_reset(cs);
++    scc->reset(cs, S390_CPU_RESET_INITIAL);
+     cpu_synchronize_post_reset(cs);
+     si->cc = SIGP_CC_ORDER_CODE_ACCEPTED;
+ }
+-- 
+2.25.1
+
diff --git a/debian/patches/ubuntu/lp-1835546-s390x-Move-reset-normal-to-shared-reset-handler.patch b/debian/patches/ubuntu/lp-1835546-s390x-Move-reset-normal-to-shared-reset-handler.patch
new file mode 100644
index 0000000..daed72a
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1835546-s390x-Move-reset-normal-to-shared-reset-handler.patch
@@ -0,0 +1,134 @@
+From bae87d827e0f158900ef25fb6015fa8d535a6c94 Mon Sep 17 00:00:00 2001
+From: Janosch Frank <[e-mail]>
+Date: Wed, 27 Nov 2019 12:50:42 -0500
+Subject: [PATCH] s390x: Move reset normal to shared reset handler
+
+Let's start moving the cpu reset functions into a single function with
+a switch/case, so we can later use fallthroughs and share more code
+between resets.
+
+This patch introduces the reset function by renaming cpu_reset().
+
+Signed-off-by: Janosch Frank <[e-mail]>
+Reviewed-by: David Hildenbrand <[e-mail]>
+Message-Id: <[e-mail]>
+Reviewed-by: Thomas Huth <[e-mail]>
+Signed-off-by: Cornelia Huck <[e-mail]>
+
+Forwarded: https://lists.gnu.org/archive/html/qemu-devel/2020-03/msg06247.html
+Origin: backport, https://github.com/borntraeger/qemu/commit/bae87d827e
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1835546
+Last-Update: 2020-03-20
+
+---
+ target/s390x/cpu-qom.h |  6 +++++-
+ target/s390x/cpu.c     | 19 +++++++++++++------
+ target/s390x/cpu.h     |  2 +-
+ target/s390x/sigp.c    |  2 +-
+ 4 files changed, 20 insertions(+), 9 deletions(-)
+
+diff --git a/target/s390x/cpu-qom.h b/target/s390x/cpu-qom.h
+index b809ec8418..f3b71bac67 100644
+--- a/target/s390x/cpu-qom.h
++++ b/target/s390x/cpu-qom.h
+@@ -34,6 +34,10 @@
+ typedef struct S390CPUModel S390CPUModel;
+ typedef struct S390CPUDef S390CPUDef;
+ 
++typedef enum cpu_reset_type {
++    S390_CPU_RESET_NORMAL,
++} cpu_reset_type;
++
+ /**
+  * S390CPUClass:
+  * @parent_realize: The parent class' realize handler.
+@@ -57,7 +61,7 @@ typedef struct S390CPUClass {
+     DeviceRealize parent_realize;
+     void (*parent_reset)(CPUState *cpu);
+     void (*load_normal)(CPUState *cpu);
+-    void (*cpu_reset)(CPUState *cpu);
++    void (*reset)(CPUState *cpu, cpu_reset_type type);
+     void (*initial_cpu_reset)(CPUState *cpu);
+ } S390CPUClass;
+ 
+diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
+index 3abe7e80fd..67d6fbfa44 100644
+--- a/target/s390x/cpu.c
++++ b/target/s390x/cpu.c
+@@ -82,18 +82,25 @@ static void s390_cpu_load_normal(CPUState *s)
+ }
+ #endif
+ 
+-/* S390CPUClass::cpu_reset() */
+-static void s390_cpu_reset(CPUState *s)
++/* S390CPUClass::reset() */
++static void s390_cpu_reset(CPUState *s, cpu_reset_type type)
+ {
+     S390CPU *cpu = S390_CPU(s);
+     S390CPUClass *scc = S390_CPU_GET_CLASS(cpu);
+     CPUS390XState *env = &cpu->env;
+ 
+-    env->pfault_token = -1UL;
+-    env->bpbc = false;
+     scc->parent_reset(s);
+     cpu->env.sigp_order = 0;
+     s390_cpu_set_state(S390_CPU_STATE_STOPPED, cpu);
++
++    switch (type) {
++    case S390_CPU_RESET_NORMAL:
++        env->pfault_token = -1UL;
++        env->bpbc = false;
++        break;
++    default:
++        g_assert_not_reached();
++    }
+ }
+ 
+ /* S390CPUClass::initial_reset() */
+@@ -102,7 +109,7 @@ static void s390_cpu_initial_reset(CPUState *s)
+     S390CPU *cpu = S390_CPU(s);
+     CPUS390XState *env = &cpu->env;
+ 
+-    s390_cpu_reset(s);
++    s390_cpu_reset(s, S390_CPU_RESET_NORMAL);
+     /* initial reset does not clear everything! */
+     memset(&env->start_initial_reset_fields, 0,
+         offsetof(CPUS390XState, end_reset_fields) -
+@@ -473,7 +480,7 @@ static void s390_cpu_class_init(ObjectClass *oc, void *data)
+ #if !defined(CONFIG_USER_ONLY)
+     scc->load_normal = s390_cpu_load_normal;
+ #endif
+-    scc->cpu_reset = s390_cpu_reset;
++    scc->reset = s390_cpu_reset;
+     scc->initial_cpu_reset = s390_cpu_initial_reset;
+     cc->reset = s390_cpu_full_reset;
+     cc->class_by_name = s390_cpu_class_by_name,
+diff --git a/target/s390x/cpu.h b/target/s390x/cpu.h
+index 17460ed7b3..18123dfd5b 100644
+--- a/target/s390x/cpu.h
++++ b/target/s390x/cpu.h
+@@ -741,7 +741,7 @@ static inline void s390_do_cpu_reset(CPUState *cs, run_on_cpu_data arg)
+ {
+     S390CPUClass *scc = S390_CPU_GET_CLASS(cs);
+ 
+-    scc->cpu_reset(cs);
++    scc->reset(cs, S390_CPU_RESET_NORMAL);
+ }
+ 
+ static inline void s390_do_cpu_initial_reset(CPUState *cs, run_on_cpu_data arg)
+diff --git a/target/s390x/sigp.c b/target/s390x/sigp.c
+index 2ce22d4dc1..850139b9cd 100644
+--- a/target/s390x/sigp.c
++++ b/target/s390x/sigp.c
+@@ -266,7 +266,7 @@ static void sigp_cpu_reset(CPUState *cs, run_on_cpu_data arg)
+     SigpInfo *si = arg.host_ptr;
+ 
+     cpu_synchronize_state(cs);
+-    scc->cpu_reset(cs);
++    scc->reset(cs, S390_CPU_RESET_NORMAL);
+     cpu_synchronize_post_reset(cs);
+     si->cc = SIGP_CC_ORDER_CODE_ACCEPTED;
+ }
+-- 
+2.25.1
+
diff --git a/debian/patches/ubuntu/lp-1835546-s390x-ipl-Consolidate-iplb-validity-check-into-one-f.patch b/debian/patches/ubuntu/lp-1835546-s390x-ipl-Consolidate-iplb-validity-check-into-one-f.patch
new file mode 100644
index 0000000..59ee3d6
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1835546-s390x-ipl-Consolidate-iplb-validity-check-into-one-f.patch
@@ -0,0 +1,70 @@
+From 2321dddc5f92eea17caed784c960d3c57088fd41 Mon Sep 17 00:00:00 2001
+From: Janosch Frank <[e-mail]>
+Date: Tue, 10 Mar 2020 05:09:50 -0400
+Subject: [PATCH] s390x: ipl: Consolidate iplb validity check into one function
+
+It's nicer to just call one function than calling a function for each
+possible iplb type.
+
+Signed-off-by: Janosch Frank <[e-mail]>
+Reviewed-by: David Hildenbrand <[e-mail]>
+Message-Id: <[e-mail]>
+Reviewed-by: Christian Borntraeger <[e-mail]>
+Signed-off-by: Christian Borntraeger <[e-mail]>
+
+Forwarded: https://lists.gnu.org/archive/html/qemu-devel/2020-03/msg06247.html
+Origin: backport, https://github.com/borntraeger/qemu/commit/2321dddc5f
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1835546
+Last-Update: 2020-03-20
+
+---
+ hw/s390x/ipl.h      | 18 +++++++++---------
+ target/s390x/diag.c |  2 +-
+ 2 files changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/hw/s390x/ipl.h b/hw/s390x/ipl.h
+index d4813105db..3e44abe1c6 100644
+--- a/hw/s390x/ipl.h
++++ b/hw/s390x/ipl.h
+@@ -173,16 +173,16 @@ static inline bool iplb_valid_len(IplParameterBlock *iplb)
+     return be32_to_cpu(iplb->len) <= sizeof(IplParameterBlock);
+ }
+ 
+-static inline bool iplb_valid_ccw(IplParameterBlock *iplb)
++static inline bool iplb_valid(IplParameterBlock *iplb)
+ {
+-    return be32_to_cpu(iplb->len) >= S390_IPLB_MIN_CCW_LEN &&
+-           iplb->pbt == S390_IPL_TYPE_CCW;
+-}
+-
+-static inline bool iplb_valid_fcp(IplParameterBlock *iplb)
+-{
+-    return be32_to_cpu(iplb->len) >= S390_IPLB_MIN_FCP_LEN &&
+-           iplb->pbt == S390_IPL_TYPE_FCP;
++    switch (iplb->pbt) {
++    case S390_IPL_TYPE_FCP:
++        return be32_to_cpu(iplb->len) >= S390_IPLB_MIN_FCP_LEN;
++    case S390_IPL_TYPE_CCW:
++        return be32_to_cpu(iplb->len) >= S390_IPLB_MIN_CCW_LEN;
++    default:
++        return false;
++    }
+ }
+ 
+ #endif
+diff --git a/target/s390x/diag.c b/target/s390x/diag.c
+index 53c2f81f2a..0c81d8e1ef 100644
+--- a/target/s390x/diag.c
++++ b/target/s390x/diag.c
+@@ -100,7 +100,7 @@ void handle_diag_308(CPUS390XState *env, uint64_t r1, uint64_t r3, uintptr_t ra)
+ 
+         cpu_physical_memory_read(addr, iplb, be32_to_cpu(iplb->len));
+ 
+-        if (!iplb_valid_ccw(iplb) && !iplb_valid_fcp(iplb)) {
++        if (!iplb_valid(iplb)) {
+             env->regs[r1 + 1] = DIAG_308_RC_INVALID;
+             goto out;
+         }
+-- 
+2.25.1
+
diff --git a/debian/patches/ubuntu/lp-1835546-s390x-kvm-Make-kvm_sclp_service_call-void.patch b/debian/patches/ubuntu/lp-1835546-s390x-kvm-Make-kvm_sclp_service_call-void.patch
new file mode 100644
index 0000000..55c2974
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1835546-s390x-kvm-Make-kvm_sclp_service_call-void.patch
@@ -0,0 +1,72 @@
+From 3915257d71c9e64fd4dcd4406996650a7b29baba Mon Sep 17 00:00:00 2001
+From: Janosch Frank <[e-mail]>
+Date: Fri, 29 Nov 2019 04:17:13 -0500
+Subject: [PATCH] s390x: kvm: Make kvm_sclp_service_call void
+
+It defaults to returning 0 anyway and that return value is not
+necessary, as 0 is also the default rc that the caller would return.
+
+While doing that we can simplify the logic a bit and return early if
+we inject a PGM exception.
+
+Signed-off-by: Janosch Frank <[e-mail]>
+Reviewed-by: Thomas Huth <[e-mail]>
+Message-Id: <[e-mail]>
+Reviewed-by: David Hildenbrand <[e-mail]>
+Signed-off-by: Cornelia Huck <[e-mail]>
+
+Forwarded: https://lists.gnu.org/archive/html/qemu-devel/2020-03/msg06247.html
+Origin: backport, https://github.com/borntraeger/qemu/commit/3915257d71
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1835546
+Last-Update: 2020-03-20
+
+---
+ target/s390x/kvm.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/target/s390x/kvm.c b/target/s390x/kvm.c
+index 0c9d14b4b1..ad6e38c876 100644
+--- a/target/s390x/kvm.c
++++ b/target/s390x/kvm.c
+@@ -1159,13 +1159,13 @@ void kvm_s390_access_exception(S390CPU *cpu, uint16_t code, uint64_t te_code)
+     kvm_s390_vcpu_interrupt(cpu, &irq);
+ }
+ 
+-static int kvm_sclp_service_call(S390CPU *cpu, struct kvm_run *run,
++static void kvm_sclp_service_call(S390CPU *cpu, struct kvm_run *run,
+                                  uint16_t ipbh0)
+ {
+     CPUS390XState *env = &cpu->env;
+     uint64_t sccb;
+     uint32_t code;
+-    int r = 0;
++    int r;
+ 
+     sccb = env->regs[ipbh0 & 0xf];
+     code = env->regs[(ipbh0 & 0xf0) >> 4];
+@@ -1173,11 +1173,9 @@ static int kvm_sclp_service_call(S390CPU *cpu, struct kvm_run *run,
+     r = sclp_service_call(env, sccb, code);
+     if (r < 0) {
+         kvm_s390_program_interrupt(cpu, -r);
+-    } else {
+-        setcc(cpu, r);
++        return;
+     }
+-
+-    return 0;
++    setcc(cpu, r);
+ }
+ 
+ static int handle_b2(S390CPU *cpu, struct kvm_run *run, uint8_t ipa1)
+@@ -1240,7 +1238,7 @@ static int handle_b2(S390CPU *cpu, struct kvm_run *run, uint8_t ipa1)
+         setcc(cpu, 3);
+         break;
+     case PRIV_B2_SCLP_CALL:
+-        rc = kvm_sclp_service_call(cpu, run, ipbh0);
++        kvm_sclp_service_call(cpu, run, ipbh0);
+         break;
+     default:
+         rc = -1;
+-- 
+2.25.1
+
diff --git a/debian/patches/ubuntu/lp-1835546-s390x-protvirt-Add-migration-blocker.patch b/debian/patches/ubuntu/lp-1835546-s390x-protvirt-Add-migration-blocker.patch
new file mode 100644
index 0000000..9909233
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1835546-s390x-protvirt-Add-migration-blocker.patch
@@ -0,0 +1,70 @@
+From 617d3f7be6434962614dc5ee381f3d67aca85578 Mon Sep 17 00:00:00 2001
+From: Janosch Frank <[e-mail]>
+Date: Fri, 6 Mar 2020 06:40:13 -0500
+Subject: [PATCH] s390x: protvirt: Add migration blocker
+
+Migration is not yet supported.
+
+Signed-off-by: Janosch Frank <[e-mail]>
+Reviewed-by: David Hildenbrand <[e-mail]>
+Reviewed-by: Christian Borntraeger <[e-mail]>
+Reviewed-by: Claudio Imbrenda <[e-mail]>
+Reviewed-by: Cornelia Huck <[e-mail]>
+
+Forwarded: https://lists.gnu.org/archive/html/qemu-devel/2020-03/msg06247.html
+Origin: backport, https://github.com/borntraeger/qemu/commit/617d3f7be6
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1835546
+Last-Update: 2020-03-20
+
+---
+ hw/s390x/s390-virtio-ccw.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
+index 5149030d22..ed910a0996 100644
+--- a/hw/s390x/s390-virtio-ccw.c
++++ b/hw/s390x/s390-virtio-ccw.c
+@@ -44,6 +44,9 @@
+ #include "sysemu/sysemu.h"
+ #include "hw/s390x/pv.h"
+ #include <linux/kvm.h>
++#include "migration/blocker.h"
++
++static Error *pv_mig_blocker;
+ 
+ S390CPU *s390_cpu_addr2state(uint16_t cpu_addr)
+ {
+@@ -325,15 +328,30 @@ static void s390_machine_unprotect(S390CcwMachineState *ms)
+ {
+     s390_pv_vm_disable();
+     ms->pv = false;
++    migrate_del_blocker(pv_mig_blocker);
++    error_free_or_abort(&pv_mig_blocker);
+ }
+ 
+ static int s390_machine_protect(S390CcwMachineState *ms)
+ {
++    Error *local_err = NULL;
+     int rc;
+ 
++    error_setg(&pv_mig_blocker,
++               "protected VMs are currently not migrateable.");
++    rc = migrate_add_blocker(pv_mig_blocker, &local_err);
++    if (rc) {
++        error_report_err(local_err);
++        error_free_or_abort(&pv_mig_blocker);
++        return rc;
++    }
++
+     /* Create SE VM */
+     rc = s390_pv_vm_enable();
+     if (rc) {
++        error_report_err(local_err);
++        migrate_del_blocker(pv_mig_blocker);
++        error_free_or_abort(&pv_mig_blocker);
+         return rc;
+     }
+ 
+-- 
+2.25.1
+
diff --git a/debian/patches/ubuntu/lp-1835546-s390x-protvirt-Disable-address-checks-for-PV-guest-I.patch b/debian/patches/ubuntu/lp-1835546-s390x-protvirt-Disable-address-checks-for-PV-guest-I.patch
new file mode 100644
index 0000000..99b5c6f
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1835546-s390x-protvirt-Disable-address-checks-for-PV-guest-I.patch
@@ -0,0 +1,126 @@
+From ec052c4f954d5a33d06c94d46058c623f65883bb Mon Sep 17 00:00:00 2001
+From: Janosch Frank <[e-mail]>
+Date: Fri, 29 Nov 2019 04:22:41 -0500
+Subject: [PATCH] s390x: protvirt: Disable address checks for PV guest IO
+ emulation
+
+IO instruction data is routed through SIDAD for protected guests, so
+adresses do not need to be checked, as this is kernel memory which is
+always available.
+
+Also the instruction data always starts at offset 0 of the SIDAD.
+
+Signed-off-by: Janosch Frank <[e-mail]>
+Reviewed-by: Thomas Huth <[e-mail]>
+Reviewed-by: David Hildenbrand <[e-mail]>
+Reviewed-by: Christian Borntraeger <[e-mail]>
+Reviewed-by: Claudio Imbrenda <[e-mail]>
+Reviewed-by: Cornelia Huck <[e-mail]>
+
+Forwarded: https://lists.gnu.org/archive/html/qemu-devel/2020-03/msg06247.html
+Origin: backport, https://github.com/borntraeger/qemu/commit/ec052c4f95
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1835546
+Last-Update: 2020-03-20
+
+---
+ target/s390x/ioinst.c | 35 ++++++++++++++++++++++++++++-------
+ 1 file changed, 28 insertions(+), 7 deletions(-)
+
+diff --git a/target/s390x/ioinst.c b/target/s390x/ioinst.c
+index c437a1d8c6..bbcccf6be2 100644
+--- a/target/s390x/ioinst.c
++++ b/target/s390x/ioinst.c
+@@ -16,6 +16,25 @@
+ #include "hw/s390x/ioinst.h"
+ #include "trace.h"
+ #include "hw/s390x/s390-pci-bus.h"
++#include "hw/s390x/pv.h"
++
++/* All I/O instructions but chsc use the s format */
++static uint64_t get_address_from_regs(CPUS390XState *env, uint32_t ipb,
++                                      uint8_t *ar)
++{
++    /*
++     * Addresses for protected guests are all offsets into the
++     * satellite block which holds the IO control structures. Those
++     * control structures are always starting at offset 0 and are
++     * always aligned and accessible. So we can return 0 here which
++     * will pass the following address checks.
++     */
++    if (s390_is_pv()) {
++        *ar = 0;
++        return 0;
++    }
++    return decode_basedisp_s(env, ipb, ar);
++}
+ 
+ int ioinst_disassemble_sch_ident(uint32_t value, int *m, int *cssid, int *ssid,
+                                  int *schid)
+@@ -114,7 +133,7 @@ void ioinst_handle_msch(S390CPU *cpu, uint64_t reg1, uint32_t ipb, uintptr_t ra)
+     CPUS390XState *env = &cpu->env;
+     uint8_t ar;
+ 
+-    addr = decode_basedisp_s(env, ipb, &ar);
++    addr = get_address_from_regs(env, ipb, &ar);
+     if (addr & 3) {
+         s390_program_interrupt(env, PGM_SPECIFICATION, ra);