Merge ~paelzer/ubuntu/+source/qemu:groovy-merge-pick-5.0-14 into ubuntu/+source/qemu:ubuntu/groovy-devel

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

PPA: https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/4175/+packages

Minor, but worthwile fixes for groovy (one CVE, one follow up to the further modularization).

[Christian Ehrhardt  (paelzer)]

Adding one more fix for our minimal xen delta in a minute ...

38edad2... by Christian Ehrhardt  on 2020-08-03

d/rules: xen: compat links (LP: #1890005)

libxen-dev reports where to find the qemu binaries as if they
would have been built with xen. Obviously this isn't the case
but tools like libvirt will rely on the output of libxen-dev.

To avoid users having to modify the guest defaults provide a
symlink from the expected place to where qemu packaging
places it.

Note: we can't just place the binary there as that would kill
plenty of apparmor assumptions in libvirt.

Signed-off-by: Christian Ehrhardt <email address hidden>

6cf35f5... by Christian Ehrhardt  on 2020-08-03

d/p/ubuntu/lp-1883984-target-s390x-Fix-SQXBR.patch: avoid crash on SQXBR (LP: #1883984)

Signed-off-by: Christian Ehrhardt <email address hidden>

[Christian Ehrhardt  (paelzer)]

And a breakage on s390x - this doesn't seem to stop ...

[Christian Ehrhardt  (paelzer)]

Forgot to mention here.
The module fix isn't needed for us since it is only needed after "1f9685e build all modules since there are modules anyway, no need to hack them in d/rules" which I have postponed to 21.04 for reasons just like that.

Taken the commit out of the presented MR

[Rafael David Tinoco (rafaeldtinoco)]

# CHECKLIST
----------------------------
 [.] changelog entry correct
 [.] targeted to correct codename
 [.] version number is correct
 [.] update-maintainer has been run before
 ----
 [.] changes forwarded upstream/debian (if appropriate)
 [.] patches match what was proposed upstream
 ----
 [.] patches correctly included in debian/patches/series?
 [!] patches have correct DEP3 metadata
 - small typo in commit 15b2a2e318:
   - "...xen sepcific qemu binary in the qemu-default"
 ----
 [.] relying on PPA only for build check ?
 [.] if relying on PPA, did it install correctly ?
 ----
 [-] was autopkgtest tested ?
 ----
 [-] is this a SRU ?
 [-] if a SRU, does the public bug have a template ?
 [-] is this a bundle of fixes ?
 [-] is this a single fix ?
 ----
 [-] if single fix, was testcase provided ?
 [-] if single fix, and testcase provided, could I reproduce it ?
 [-] if single fix, and testcase provided, did it work ?
 ----
 [.] is this a MERGE ?
 [.] if MERGE, is there a public bug referred ?
 [.] if MERGE, does it add/remove existing packages ?
 [.] if MERGE, does it bump library SONAME ?
----------------------------
 [.] = ok | [x] = not ok | [?] = question | [!] = note | [-] = n/a
----------------------------

# comments:

dab4e218ab changelog: xen and s390x-emu fixes for groovy (LP: #1890005) (LP: #1883984)
5a51f1f398 d/p/ubuntu/lp-1883984-target-s390x-Fix-SQXBR.patch: avoid crash on SQXBR (LP: #1883984)
15b2a2e318 xen: place binary in the path xen-devel & libvirt expect it

# changelog:

qemu (1:5.0-5ubuntu4) groovy; urgency=medium

  * xen: place binary in the path xen-devel and libvirt expect it
    (LP: #1890005)
  * d/p/ubuntu/lp-1883984-target-s390x-Fix-SQXBR.patch: avoid crash on
    SQXBR (LP: #1883984)

# files touched:

$ git log -3 -p | diffstat
 changelog | 9 +++++++++
 control | 1 -
 control-in | 1 -
 patches/series | 1 +
 patches/ubuntu/lp-1883984-target-s390x-Fix-SQXBR.patch | 37 +++++++++++++++++++++++++++++++++++++
 rules | 13 ++++++-------
 6 files changed, 53 insertions(+), 9 deletions(-)

review: Approve

[Rafael David Tinoco (rafaeldtinoco)]

+1 after minimum typo fix in patch git log desc.

[Christian Ehrhardt  (paelzer)]

I also did a full upgrade on my xen host and tried xen with virt-manager without the former symlink workaround in place.

The new qemu-system-x86-xen slots into place nicely:.

ubuntu@ubuntu:~$ virsh capabilities | grep emu
      <emulator>/usr/lib/xen-4.11/bin/qemu-system-i386</emulator>
      <emulator>/usr/lib/xen-4.11/bin/qemu-system-i386</emulator>
      <emulator>/usr/lib/xen-4.11/bin/qemu-system-i386</emulator>
      <emulator>/usr/lib/xen-4.11/bin/qemu-system-i386</emulator>
      <emulator>/usr/lib/xen-4.11/bin/qemu-system-i386</emulator>
      <emulator>/usr/lib/xen-4.11/bin/qemu-system-i386</emulator>
ubuntu@ubuntu:~$ ll /usr/lib/xen-4.11/bin/qemu-system-i386
-rwxr-xr-x 1 root root 15355976 Aug 3 05:15 /usr/lib/xen-4.11/bin/qemu-system-i386*

But - then all of the apparmor isolation will fall apart.
As it will not allow this path to be executed.

Aug 04 06:31:13 ubuntu audit[115176]: AVC apparmor="DENIED" operation="exec" profile="libvirtd" name="/usr/lib/xen-4.11/bin/qemu-system-i386" pid=115176 comm="libvirtd" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Aug 04 06:31:13 ubuntu kernel: audit: type=1400 audit(1596522673.656:146): apparmor="DENIED" operation="exec" profile="libvirtd" name="/usr/lib/xen-4.11/bin/qemu-system-i386" pid=115176 comm="libvirtd" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Aug 04 06:31:13 ubuntu libvirtd[85510]: internal error: Child process (/usr/lib/xen-4.11/bin/qemu-system-i386 -help) unexpected exit status 126: libvirt: error : cannot execute binary /usr/lib/xen-4.11/bin/qemu-system-i386: Permission denied

So we want to keep things much more than they already are - but with a symlink in place (as my manual workaround was).

4d0ba8d... by Christian Ehrhardt  on 2020-08-05

d/p/lp-1890154-*: fix -no-reboot on s390x secure boot (LP: #1890154)

Signed-off-by: Christian Ehrhardt <email address hidden>

1dea878... by Christian Ehrhardt  on 2020-08-05

changelog: fix -no-reboot on s390x secure boot (LP: #1890154)

Signed-off-by: Christian Ehrhardt <email address hidden>

[Christian Ehrhardt  (paelzer)]

And another fix for s390x - clean fix directly form IBM.
This week keeps on giving ...

[Christian Ehrhardt  (paelzer)]

ubuntu@ubuntu:~$ ll /usr/lib/xen-4.11/bin/qemu-system-*
lrwxrwxrwx 1 root root 29 Aug 3 05:15 /usr/lib/xen-4.11/bin/qemu-system-i386 -> ../../../bin/qemu-system-i386*
lrwxrwxrwx 1 root root 31 Aug 3 05:15 /usr/lib/xen-4.11/bin/qemu-system-x86_64 -> ../../../bin/qemu-system-x86_64*

Working well now:
ubuntu@ubuntu:~$ virsh dumpxml ubuntu20.04 | grep emul
    <emulator>/usr/lib/xen-4.11/bin/qemu-system-i386</emulator>

ubuntu@ubuntu:~$ virsh start ubuntu20.04
Domain ubuntu20.04 started

So the xen cleanup to match the expected defaults are good.
Builds are also good and the other patches are small and work fine.

[Christian Ehrhardt  (paelzer)]

To ssh://git.launchpad.net/~usd-import-team/ubuntu/+source/qemu
 * [new tag] upload/1%5.0-5ubuntu4 -> upload/1%5.0-5ubuntu4

Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading qemu_5.0-5ubuntu4.dsc: done.
  Uploading qemu_5.0-5ubuntu4.debian.tar.xz: done.
  Uploading qemu_5.0-5ubuntu4_source.buildinfo: done.
  Uploading qemu_5.0-5ubuntu4_source.changes: done.
Successfully uploaded packages.

[Christian Ehrhardt  (paelzer)]

this migrated

diff --git a/debian/changelog b/debian/changelog
index d2f09cf..ea3bc89 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,13 @@
+qemu (1:5.0-5ubuntu4) groovy; urgency=medium
+
+  * xen: provide compat links to what libxen-dev reports where to find
+    the binaries (LP: #1890005)
+  * d/p/ubuntu/lp-1883984-target-s390x-Fix-SQXBR.patch: avoid crash on
+    SQXBR (LP: #1883984)
+  * d/p/lp-1890154-*: fix -no-reboot on s390x secure boot (LP: #1890154)
+
+ -- Christian Ehrhardt <[e-mail]>  Mon, 03 Aug 2020 07:15:28 +0200
+
 qemu (1:5.0-5ubuntu3) groovy; urgency=medium
 
   * d/p/ubuntu/lp-1887763-*: fix TCG sizing that OOMed many small CI
diff --git a/debian/patches/lp-1890154-s390x-protvirt-allow-to-IPL-secure-guests-with-no-re.patch b/debian/patches/lp-1890154-s390x-protvirt-allow-to-IPL-secure-guests-with-no-re.patch
 new file mode 100644
index 0000000..0f25ca9
--- /dev/null
+++ b/debian/patches/lp-1890154-s390x-protvirt-allow-to-IPL-secure-guests-with-no-re.patch
@@ -0,0 +1,52 @@
+From d1bb69db4ceb6897ef6a17bf263146b53a123632 Mon Sep 17 00:00:00 2001
+From: Christian Borntraeger <[e-mail]>
+Date: Tue, 21 Jul 2020 06:32:02 -0400
+Subject: [PATCH] s390x/protvirt: allow to IPL secure guests with -no-reboot
+
+Right now, -no-reboot prevents secure guests from running. This is
+correct from an implementation point of view, as we have modeled the
+transition from non-secure to secure as a program directed IPL. From
+a user perspective, this is not the behavior of least surprise.
+
+We should implement the IPL into protected mode similar to the
+functions that we use for kdump/kexec. In other words, we do not stop
+here when -no-reboot is specified on the command line. Like function 0
+or function 1, function 10 is not a classic reboot. For example, it
+can only be called once. Before calling it a second time, a real
+reboot/reset must happen in-between. So function code 10 is more or
+less a state transition reset, but not a "standard" reset or reboot.
+
+Fixes: 4d226deafc44 ("s390x: protvirt: Support unpack facility")
+Signed-off-by: Christian Borntraeger <[e-mail]>
+Reviewed-by: Janosch Frank <[e-mail]>
+Reviewed-by: David Hildenbrand <[e-mail]>
+Acked-by: Viktor Mihajlovski <[e-mail]>
+Message-Id: <[e-mail]>
+[CH: tweaked description]
+Signed-off-by: Cornelia Huck <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=d1bb69db4ceb6897ef6a17bf263146b53a123632
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1890154
+Last-Update: 2020-08-05
+
+---
+ hw/s390x/ipl.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
+index d46b1f094f..3d2652d75a 100644
+--- a/hw/s390x/ipl.c
++++ b/hw/s390x/ipl.c
+@@ -630,7 +630,8 @@ void s390_ipl_reset_request(CPUState *cs, enum s390_reset reset_type)
+         }
+     }
+     if (reset_type == S390_RESET_MODIFIED_CLEAR ||
+-        reset_type == S390_RESET_LOAD_NORMAL) {
++        reset_type == S390_RESET_LOAD_NORMAL ||
++        reset_type == S390_RESET_PV) {
+         /* ignore -no-reboot, send no event  */
+         qemu_system_reset_request(SHUTDOWN_CAUSE_SUBSYSTEM_RESET);
+     } else {
+-- 
+2.27.0
+
diff --git a/debian/patches/series b/debian/patches/series
index 58c5039..c1c26c4 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -71,3 +71,5 @@ ubuntu/lp-1835546-s390x-pv-Fix-KVM_PV_PREP_RESET-command-wrapper-name.patch
 ubuntu/virtio-net-fix-rsc_ext-compat-handling.patch
 ubuntu/lp-1887763-util-add-qemu_get_host_physmem-utility-function.patch
 ubuntu/lp-1887763-accel-tcg-better-handle-memory-constrained-systems.patch
+ubuntu/lp-1883984-target-s390x-Fix-SQXBR.patch
+lp-1890154-s390x-protvirt-allow-to-IPL-secure-guests-with-no-re.patch
diff --git a/debian/patches/ubuntu/lp-1883984-target-s390x-Fix-SQXBR.patch b/debian/patches/ubuntu/lp-1883984-target-s390x-Fix-SQXBR.patch
 new file mode 100644
index 0000000..34fb95c
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1883984-target-s390x-Fix-SQXBR.patch
@@ -0,0 +1,37 @@
+From 9bf728a09bf7509b27543664f9cca6f4f337f608 Mon Sep 17 00:00:00 2001
+From: Richard Henderson <[e-mail]>
+Date: Fri, 19 Jun 2020 21:21:40 -0700
+Subject: [PATCH] target/s390x: Fix SQXBR
+
+The output is 128-bit, and thus requires a pair of 64-bit temps.
+
+Signed-off-by: Richard Henderson <[e-mail]>
+Reviewed-by: David Hildenbrand <[e-mail]>
+Buglink: https://bugs.launchpad.net/bugs/1883984
+Message-Id: <[e-mail]>
+Signed-off-by: Cornelia Huck <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=9bf728a09bf7509b27543664f9cca6f4f337f608
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1883984
+Last-Update: 2020-08-03
+
+---
+ target/s390x/insn-data.def | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/target/s390x/insn-data.def b/target/s390x/insn-data.def
+index 91ddaedd84..d79ae9e3f1 100644
+--- a/target/s390x/insn-data.def
++++ b/target/s390x/insn-data.def
+@@ -798,7 +798,7 @@
+ /* SQUARE ROOT */
+     F(0xb314, SQEBR,   RRE,   Z,   0, e2, new, e1, sqeb, 0, IF_BFP)
+     F(0xb315, SQDBR,   RRE,   Z,   0, f2, new, f1, sqdb, 0, IF_BFP)
+-    F(0xb316, SQXBR,   RRE,   Z,   x2h, x2l, new, x1, sqxb, 0, IF_BFP)
++    F(0xb316, SQXBR,   RRE,   Z,   x2h, x2l, new_P, x1, sqxb, 0, IF_BFP)
+     F(0xed14, SQEB,    RXE,   Z,   0, m2_32u, new, e1, sqeb, 0, IF_BFP)
+     F(0xed15, SQDB,    RXE,   Z,   0, m2_64, new, f1, sqdb, 0, IF_BFP)
+ 
+-- 
+2.27.0
+
diff --git a/debian/rules b/debian/rules
index 0fa1f5b..87afc09 100755
--- a/debian/rules
+++ b/debian/rules
@@ -17,6 +17,7 @@ libdir = /usr/lib/${DEB_HOST_MULTIARCH}
 ifeq ($(shell dpkg-vendor --derives-from Ubuntu && echo yes),yes)
 VENDOR := UBUNTU
 DEB_BUILD_PARALLEL = yes
+XENBINPATH := $(shell pkg-config --variable libexec_bin xenlight)
 else
 VENDOR := DEBIAN
 endif
@@ -299,6 +300,9 @@ ifneq ($(filter $(DEB_HOST_ARCH),amd64 i386),)
 	echo ".so man1/qemu-system.1" > debian/qemu-system-x86-xen/usr/share/man/man1/qemu-system-x86_64.1
 	echo ".so man1/qemu-system.1" > debian/qemu-system-x86-xen/usr/share/man/man1/qemu-system-i386.1
 	dh_link -pqemu-system-x86-xen usr/share/doc/qemu-system-common usr/share/doc/qemu-system-x86-xen/common
+	# compat links to what libxen-dev reports where to find the binaries
+	dh_link -pqemu-system-x86-xen /usr/bin/qemu-system-i386 ${XENBINPATH}/qemu-system-i386
+	dh_link -pqemu-system-x86-xen /usr/bin/qemu-system-x86_64 ${XENBINPATH}/qemu-system-x86_64
 endif
 endif