Merge ~paelzer/ubuntu/+source/qemu:focal-SRU-august2020-1890154-1883984-1891203-1891877 into ubuntu/+source/qemu:ubuntu/focal-devel

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

PPA: https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/4215/+packages

PPA that contains version 6.4 https://launchpad.net/~ubuntu-security-proposed/+archive/ubuntu/ppa
I'll rebase it once 6.4 is released and got imported - but the content won't change.

SRU templates in the bug added and other than review + regression test good to go IMHO.

[Rafael David Tinoco (rafaeldtinoco)]

From the beginning

c33d65deb29 - security update 4.2-3ubuntu6.4 (to be released)

----

5c4fe018c0 nbd/server: Avoid long error message assertions CVE-2020-10761
fa70c2871f sm501: Optimize small overlapping blits
84ec3f9402 sm501: Fix bounds checks
4decaad9d2 sm501: Drop unneded variable
f018edc358 sm501: Do not allow guest to set invalid format
299778d5af sm501: Introduce variable for commonly used value for better readability
9982c605a7 sm501: Fix and optimize overlap check
e29da77e5f sm501: Convert printf + abort to qemu_log_mask
6f8183b5dc sm501: Shorten long variable names in sm501_2d_operation
2824809b7f sm501: Use BIT(x) macro to shorten constant
3d0b096298 sm501: Clean up local variables in sm501_2d_operation
b15a22bbcb sm501: Replace hand written implementation with pixman where possible
790762e548 hw/sd/sdcard: Do not switch to ReceivingData if address is invalid
369ff955a8 es1370: check total frame count against current frame
f50ab86a26 megasas: use unsigned type for reply_queue_head and check index
fd69185567 megasas: avoid NULL pointer dereference
2b151297e4 megasas: use unsigned type for positive numeric fields
77f55eac6c exec: set map length to zero when returning NULL
5d971f9e67 memory: Revert "memory: accept mismatching sizes in memory_region_access_valid"
dba04c3488 acpi: accept byte and word access to core ACPI registers
a98610c429 ati-vga: check mm_index before recursive call (CVE-2020-13800)
7a4ede0047 audio/oss: fix buffer pos calculation
5519724a13 hw/net/xgmac: Fix buffer overflow in xgmac_enet_send()
035e69b063 hw/net/net_tx_pkt: fix assertion failure in net_tx_pkt_add_raw_fragment()

----

So, all the CVE fixes look ok, but I think we might be missing a fix for a regression caused by:

5d971f9e67 memory: Revert "memory: accept mismatching sizes in memory_region_access_valid"

which is:

commit 70b78d4e71 (MISSING)
Author: Alistair Francis <email address hidden>
Date: Tue Jun 30 17:12:11 2020

    hw/riscv: Allow 64 bit access to SiFive CLINT

    Commit 5d971f9e672507210e77d020d89e0e89165c8fc9
    "memory: Revert "memory: accept mismatching sizes in
    memory_region_access_valid"" broke most RISC-V boards as they do 64 bit
    accesses to the CLINT and QEMU would trigger a fault. Fix this failure
    by allowing 8 byte accesses.

    Signed-off-by: Alistair Francis <email address hidden>
    Reviewed-by: LIU Zhiwei<email address hidden>
    Message-Id: <122b78825b077e4dfd39b444d3a46fe894a7804c<email address hidden>>

[Rafael David Tinoco (rafaeldtinoco)]

For...

ab9f0cb1d27 further stabilize by importing patches of qemu v4.2.1

----
stable/lp-1891877-9p-Lock-directory-streams-with-a-CoMutex.patch
stable/lp-1891877-9p-local-always-return-1-on-error-in-local_unlinkat_.patch
stable/lp-1891877-9p-proxy-Fix-export_flags.patch
stable/lp-1891877-9pfs-include-linux-limits.h-for-XATTR_SIZE_MAX.patch
stable/lp-1891877-9pfs-local-Fix-possible-memory-leak-in-local_link.patch
stable/lp-1891877-9pfs-local-ignore-O_NOATIME-if-we-don-t-have-permiss.patch
stable/lp-1891877-Fix-double-free-issue-in-qemu_set_log_filename.patch
stable/lp-1891877-Fix-tulip-breakage.patch
stable/lp-1891877-Revert-qemu-options.hx-Update-for-reboot-timeout-par.patch
stable/lp-1891877-Revert-vnc-allow-fall-back-to-RAW-encoding.patch
stable/lp-1891877-Update-version-for-4.2.1-release.patch
stable/lp-1891877-blkdebug-Allow-taking-unsharing-permissions.patch
stable/lp-1891877-block-Add-bdrv_qapi_perm_to_blk_perm.patch
stable/lp-1891877-block-Avoid-memleak-on-qcow2-image-info-failure.patch
stable/lp-1891877-block-Call-attention-to-truncation-of-long-NBD-expor.patch
stable/lp-1891877-block-Fix-VM-size-field-width-in-snapshot-dump.patch
stable/lp-1891877-block-backup-fix-memory-leak-in-bdrv_backup_top_appe.patch
stable/lp-1891877-block-bdrv_set_backing_bs-fix-use-after-free.patch
stable/lp-1891877-block-fix-memleaks-in-bdrv_refresh_filename.patch
stable/lp-1891877-compat-disable-edid-on-correct-virtio-gpu-device.patch
stable/lp-1891877-display-bochs-display-fix-memory-leak.patch
stable/lp-1891877-dp8393x-Always-update-RRA-pointers-and-sequence-numb.patch
stable/lp-1891877-dp8393x-Always-use-32-bit-accesses.patch
stable/lp-1891877-dp8393x-Clean-up-endianness-hacks.patch
stable/lp-1891877-dp8393x-Clear-RRRA-command-register-bit-only-when-ap.patch
stable/lp-1891877-dp8393x-Clear-descriptor-in_use-field-to-release-pac.patch
stable/lp-1891877-dp8393x-Don-t-clobber-packet-checksum.patch
stable/lp-1891877-dp8393x-Don-t-reset-Silicon-Revision-register.patch
stable/lp-1891877-dp8393x-Don-t-stop-reception-upon-RBE-interrupt-asse.patch
stable/lp-1891877-dp8393x-Have-dp8393x_receive-return-the-packet-size.patch
stable/lp-1891877-dp8393x-Implement-packet-size-limit-and-RBAE-interru.patch
stable/lp-1891877-dp8393x-Mask-EOL-bit-from-descriptor-addresses.patch
stable/lp-1891877-dp8393x-Pad-frames-to-word-or-long-word-boundary.patch
stable/lp-1891877-dp8393x-Update-LLFA-and-CRDA-registers-from-rx-descr.patch
stable/lp-1891877-dp8393x-Use-long-word-aligned-RRA-pointers-in-32-bit.patch
stable/lp-1891877-dump-Fix-writing-of-ELF-section.patch
stable/lp-1891877-hmp-vnc-Fix-info-vnc-list-leak.patch
stable/lp-1891877-hostmem-don-t-use-mbind-if-host-nodes-is-empty.patch
stable/lp-1891877-hw-arm-cubieboard-use-ARM-Cortex-A8-as-the-default-C.patch
stable/lp-1891877-hw-arm-smmuv3-Align-stream-table-base-address-to-tab.patch
stable/lp-1891877-hw-arm-smmuv3-Apply-address-mask-to-linear-strtab-ba.patch
stable/lp-1891877-hw-arm-smmuv3-Check-stream-IDs-against-actual-table-.patch
stable/lp-1891877-hw-arm-smmuv3-Correct-SMMU_BASE_ADDR_MASK-value.patch
stable/lp-1891877-hw-arm-smmuv3-Report-F_STE_FETCH-fault-address-in-co.patch
stable/lp-1891877-hw-arm-smmuv3-Use-correct-b...

[Rafael David Tinoco (rafaeldtinoco)]

All other patches (single SRUs) look okay to me.

I'm +1 on this (and already approving) as long as you check:

commit 70b78d4e71 (MISSING)
Author: Alistair Francis <email address hidden>
Date: Tue Jun 30 17:12:11 2020

    hw/riscv: Allow 64 bit access to SiFive CLINT

as being a fix (or not) to regression cause by:

5d971f9e67 memory: Revert "memory: accept mismatching sizes in memory_region_access_valid"

All the rest look good SRUs, cases have templates, patches apply cleanly, etc.

review: Approve

[Christian Ehrhardt  (paelzer)]

commit 5d971f9e672507210e77d020d89e0e89165c8fc9
Author: Michael S. Tsirkin <email address hidden>
Date: Wed Jun 10 09:47:49 2020 -0400

    memory: Revert "memory: accept mismatching sizes in memory_region_access_valid"

Was added by/in
  debian/patches/ubuntu/CVE-2020-13754-1.patch:

As part of the former security upload.

And I agree this patch should be added as well.

Ok so it was not missing on my stable patches but actually broken on the security release before it. Great catch and great that you are ok with the rest.

Also the security update got released tonight so I can rebase onto the new import and upload.

Note: this fix you identified also needs to go on top of groovy (there added by security upload in 1:5.0-5ubuntu3) which I'll do right away.

[Christian Ehrhardt  (paelzer)]

Hmm no, despite being a 5.1 patch in groovy
  debian/patches/riscv-allow-64-bit-access-to-SiFive-CLINT.patch
was added by me when doing the security fixes in 1:5.0-5ubuntu3

So groovy is good already, adding the patch to Focal as discussed.

[Christian Ehrhardt  (paelzer)]

I have pinged security as they backported this to X&B as well - not sure how reasonable riscv emu was these days, but I thought they should know.

The Focal upload is prepared as reviewed plus the fix that was identified.

To ssh://git.launchpad.net/~usd-import-team/ubuntu/+source/qemu
 * [new tag] upload/1%4.2-3ubuntu6.5 -> upload/1%4.2-3ubuntu6.5

Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading qemu_4.2-3ubuntu6.5.dsc: done.
  Uploading qemu_4.2-3ubuntu6.5.debian.tar.xz: done.
  Uploading qemu_4.2-3ubuntu6.5_source.buildinfo: done.
  Uploading qemu_4.2-3ubuntu6.5_source.changes: done.
Successfully uploaded packages.

[Christian Ehrhardt  (paelzer)]

SRU released

diff --git a/debian/changelog b/debian/changelog
index cc2f33a..0124b2c 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,89 @@
+qemu (1:4.2-3ubuntu6.5) focal; urgency=medium
+
+  * further stabilize qemu by importing patches of qemu v4.2.1
+    Fixes (LP: #1891203) and (LP: #1891877)
+    - d/p/stable/lp-1891877-*
+  * fix s390x SQXBR emulation (LP: #1883984)
+    - d/p/ubuntu/lp-1883984-target-s390x-Fix-SQXBR.patch
+  * fix -no-reboot for s390x protvirt guests (LP: #1890154)
+    - d/p/ubuntu/lp-1890154-s390x-protvirt-allow-to-IPL-secure-guests-with-*
+
+ -- Christian Ehrhardt <[e-mail]>  Wed, 19 Aug 2020 13:40:49 +0200
+
+qemu (1:4.2-3ubuntu6.4) focal-security; urgency=medium
+
+  * SECURITY UPDATE: assert failure in nbd
+    - debian/patches/ubuntu/CVE-2020-10761.patch: avoid long error message
+      assertions in nbd/server.c, tests/qemu-iotests/143,
+      tests/qemu-iotests/143.out.
+    - CVE-2020-10761
+  * SECURITY UPDATE: out-of-bounds read and write in sm501
+    - debian/patches/ubuntu/CVE-2020-12829-pre1.patch: convert printf +
+      abort to qemu_log_mask.
+    - debian/patches/ubuntu/CVE-2020-12829-pre2.patch: shorten long
+      variable names in sm501_2d_operation.
+    - debian/patches/ubuntu/CVE-2020-12829-pre3.patch: use BIT(x) macro to
+      shorten constant.
+    - debian/patches/ubuntu/CVE-2020-12829-pre4.patch: clean up local
+      variables in sm501_2d_operation.
+    - debian/patches/ubuntu/CVE-2020-12829.patch: replace hand written
+      implementation with pixman where possible.
+    - debian/patches/ubuntu/CVE-2020-12829-2.patch: optimize small
+      overlapping blits.
+    - debian/patches/ubuntu/CVE-2020-12829-3.patch: fix bounds checks.
+    - debian/patches/ubuntu/CVE-2020-12829-4.patch: drop unneded variable.
+    - debian/patches/ubuntu/CVE-2020-12829-5.patch: do not allow guest to
+      set invalid format.
+    - debian/patches/ubuntu/CVE-2020-12829-6.patch: introduce variable for
+      commonly used value for better readability.
+    - debian/patches/ubuntu/CVE-2020-12829-7.patch: fix and optimize
+      overlap check.
+    - CVE-2020-12829
+  * SECURITY UPDATE: out-of-bounds read during sdhci_write() operations
+    - debian/patches/ubuntu/CVE-2020-13253.patch: do not switch to
+      ReceivingData if address is invalid in hw/sd/sd.c.
+    - CVE-2020-13253
+  * SECURITY UPDATE: out-of-bounds access during es1370_write() operation
+    - debian/patches/ubuntu/CVE-2020-13361.patch: check total frame count
+      against current frame in hw/audio/es1370.c.
+    - CVE-2020-13361
+  * SECURITY UPDATE: out-of-bounds read via crafted reply_queue_head
+    - debian/patches/ubuntu/CVE-2020-13362-1.patch: use unsigned type for
+      reply_queue_head and check index in hw/scsi/megasas.c.
+    - debian/patches/ubuntu/CVE-2020-13362-2.patch: avoid NULL pointer
+      dereference in hw/scsi/megasas.c.
+    - debian/patches/ubuntu/CVE-2020-13362-3.patch: use unsigned type for
+      positive numeric fields in hw/scsi/megasas.c.
+    - CVE-2020-13362
+  * SECURITY UPDATE: NULL pointer dereference related to BounceBuffer
+    - debian/patches/ubuntu/CVE-2020-13659.patch: set map length to zero
+      when returning NULL in exec.c, include/exec/memory.h.
+    - CVE-2020-13659
+  * SECURITY UPDATE: out-of-bounds access via msi-x mmio operation
+    - debian/patches/ubuntu/CVE-2020-13754-1.patch: revert accepting
+      mismatching sizes in memory_region_access_valid in memory.c.
+    - debian/patches/ubuntu/CVE-2020-13754-2.patch: accept byte and word
+      access to core ACPI registers in hw/acpi/core.c.
+    - CVE-2020-13754
+  * SECURITY UPDATE: infinite recursion in ati-vga
+    - debian/patches/ubuntu/CVE-2020-13800.patch: check mm_index before
+      recursive call in hw/display/ati.c.
+    - CVE-2020-13800
+  * SECURITY UPDATE: division by zero in oss_write()
+    - debian/patches/ubuntu/CVE-2020-14415.patch: fix buffer pos
+      calculation in audio/ossaudio.c.
+    - CVE-2020-14415
+  * SECURITY UPDATE: buffer overflow in XGMAC Ethernet controller
+    - debian/patches/ubuntu/CVE-2020-15863.patch: check bounds in
+      hw/net/xgmac.c.
+    - CVE-2020-15863
+  * SECURITY UPDATE: reachable assertion failure
+    - debian/patches/ubuntu/CVE-2020-16092.patch: fix assertion failure in
+      hw/net/net_tx_pkt.c.
+    - CVE-2020-16092
+
+ -- Marc Deslauriers <[e-mail]>  Tue, 11 Aug 2020 12:30:06 -0400
+
 qemu (1:4.2-3ubuntu6.3) focal; urgency=medium
 
   * debian/patches/ubuntu/lp-1878973-*: fix assert in qemu-guest-agent that
diff --git a/debian/patches/series b/debian/patches/series
index dd6cb95..b9c1506 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -39,7 +39,6 @@ stable/lp-1867519-target-arm-Set-ISSIs16Bit-in-make_issinfo.patch
 stable/lp-1867519-target-i386-kvm-initialize-feature-MSRs-very-early.patch
 stable/lp-1867519-tpm-ppi-page-align-PPI-RAM.patch
 stable/lp-1867519-block-backup-top-fix-failure-path.patch
-stable/lp-1867519-iotests-add-test-for-backup-top-failure-on-permissio.patch
 stable/lp-1867519-block-fix-crash-on-zero-length-unaligned-write-and-r.patch
 stable/lp-1867519-qemu-img-Fix-convert-n-B-for-backing-less-targets.patch
 stable/lp-1867519-plugins-core-add-missing-break-in-cb_to_tcg_flags.patch
@@ -93,3 +92,134 @@ ubuntu/lp-1872945-target-openrisc-Fix-FPCSR-mask-to-allow-setting-DZF.patch
 ubuntu/CVE-2020-11869.patch
 ubuntu/lp-1878973-fix-assert-regression.patch
 lp-1882774-target-i386-do-not-set-unsupported-VMX-secondary-exe.patch
+ubuntu/CVE-2020-10761.patch
+ubuntu/CVE-2020-12829-pre1.patch
+ubuntu/CVE-2020-12829-pre2.patch
+ubuntu/CVE-2020-12829-pre3.patch
+ubuntu/CVE-2020-12829-pre4.patch
+ubuntu/CVE-2020-12829.patch
+ubuntu/CVE-2020-12829-2.patch
+ubuntu/CVE-2020-12829-3.patch
+ubuntu/CVE-2020-12829-4.patch
+ubuntu/CVE-2020-12829-5.patch
+ubuntu/CVE-2020-12829-6.patch
+ubuntu/CVE-2020-12829-7.patch
+ubuntu/CVE-2020-13253.patch
+ubuntu/CVE-2020-13361.patch
+ubuntu/CVE-2020-13362-1.patch
+ubuntu/CVE-2020-13362-2.patch
+ubuntu/CVE-2020-13362-3.patch
+ubuntu/CVE-2020-13659.patch
+ubuntu/CVE-2020-13754-1.patch
+ubuntu/CVE-2020-13754-2.patch
+ubuntu/CVE-2020-13800.patch
+ubuntu/CVE-2020-14415.patch
+ubuntu/CVE-2020-15863.patch
+ubuntu/CVE-2020-16092.patch
+stable/lp-1891877-i386-Resolve-CPU-models-to-v1-by-default.patch
+stable/lp-1891877-qapi-better-document-NVMe-blockdev-device-parameter.patch
+stable/lp-1891877-numa-remove-not-needed-check.patch
+stable/lp-1891877-numa-properly-check-if-numa-is-supported.patch
+stable/lp-1891877-tests-ide-test-Create-a-single-unit-test-covering-mo.patch
+stable/lp-1891877-ide-Fix-incorrect-handling-of-some-PRDTs-in-ide_dma_.patch
+stable/lp-1891877-virtio-add-ability-to-delete-vq-through-a-pointer.patch
+stable/lp-1891877-virtio-make-virtio_delete_queue-idempotent.patch
+stable/lp-1891877-virtio-reset-region-cache-when-on-queue-deletion.patch
+stable/lp-1891877-dp8393x-Mask-EOL-bit-from-descriptor-addresses.patch
+stable/lp-1891877-dp8393x-Always-use-32-bit-accesses.patch
+stable/lp-1891877-dp8393x-Clean-up-endianness-hacks.patch
+stable/lp-1891877-dp8393x-Have-dp8393x_receive-return-the-packet-size.patch
+stable/lp-1891877-dp8393x-Update-LLFA-and-CRDA-registers-from-rx-descr.patch
+stable/lp-1891877-dp8393x-Clear-RRRA-command-register-bit-only-when-ap.patch
+stable/lp-1891877-dp8393x-Implement-packet-size-limit-and-RBAE-interru.patch
+stable/lp-1891877-dp8393x-Don-t-clobber-packet-checksum.patch
+stable/lp-1891877-dp8393x-Use-long-word-aligned-RRA-pointers-in-32-bit.patch
+stable/lp-1891877-dp8393x-Pad-frames-to-word-or-long-word-boundary.patch
+stable/lp-1891877-dp8393x-Clear-descriptor-in_use-field-to-release-pac.patch
+stable/lp-1891877-dp8393x-Always-update-RRA-pointers-and-sequence-numb.patch
+stable/lp-1891877-dp8393x-Don-t-reset-Silicon-Revision-register.patch
+stable/lp-1891877-dp8393x-Don-t-stop-reception-upon-RBE-interrupt-asse.patch
+stable/lp-1891877-qcow2-update_refcount-Reset-old_table_index-after-qc.patch
+stable/lp-1891877-iotests-Test-copy-offloading-with-external-data-file.patch
+stable/lp-1891877-iotests-026-Test-EIO-on-preallocated-zero-cluster.patch
+stable/lp-1891877-iotests-026-Test-EIO-on-allocation-in-a-data-file.patch
+stable/lp-1891877-scsi-qemu-pr-helper-Fix-out-of-bounds-access-to-trnp.patch
+stable/lp-1891877-target-ppc-Fix-rlwinm-on-ppc64.patch
+stable/lp-1891877-compat-disable-edid-on-correct-virtio-gpu-device.patch
+stable/lp-1891877-qga-Installer-Wait-for-installation-to-finish.patch
+stable/lp-1891877-qga-win-Handle-VSS_E_PROVIDER_ALREADY_REGISTERED-err.patch
+stable/lp-1891877-qga-win-prevent-crash-when-executing-guest-file-read.patch
+stable/lp-1891877-qga-Fix-undefined-C-behavior.patch
+stable/lp-1891877-qemu-ga-document-vsock-listen-in-the-man-page.patch
+stable/lp-1891877-hw-i386-amd_iommu.c-Fix-corruption-of-log-events-pas.patch
+stable/lp-1891877-tcg-i386-Fix-INDEX_op_dup2_vec.patch
+stable/lp-1891877-dump-Fix-writing-of-ELF-section.patch
+stable/lp-1891877-xen-block-Fix-double-qlist-remove-and-request-leak.patch
+stable/lp-1891877-vhost-user-gpu-Release-memory-returned-by-vu_queue_p.patch
+stable/lp-1891877-target-ppc-Fix-mtmsr-d-L-1-variant-that-loses-interr.patch
+stable/lp-1891877-hostmem-don-t-use-mbind-if-host-nodes-is-empty.patch
+stable/lp-1891877-target-arm-Clear-tail-in-gvec_fmul_idx_-gvec_fmla_id.patch
+stable/lp-1891877-qemu-nbd-Close-inherited-stderr.patch
+stable/lp-1891877-9p-Lock-directory-streams-with-a-CoMutex.patch
+stable/lp-1891877-net-Do-not-include-a-newline-in-the-id-of-nic-device.patch
+stable/lp-1891877-virtio-balloon-fix-free-page-hinting-without-an-ioth.patch
+stable/lp-1891877-virtio-balloon-fix-free-page-hinting-check-on-unreal.patch
+stable/lp-1891877-virtio-balloon-unref-the-iothread-when-unrealizing.patch
+stable/lp-1891877-block-Call-attention-to-truncation-of-long-NBD-expor.patch
+stable/lp-1891877-9pfs-local-Fix-possible-memory-leak-in-local_link.patch
+stable/lp-1891877-9p-local-always-return-1-on-error-in-local_unlinkat_.patch
+stable/lp-1891877-virtio-9p-device-fix-memleak-in-virtio_9p_device_unr.patch
+stable/lp-1891877-9p-proxy-Fix-export_flags.patch
+stable/lp-1891877-9pfs-local-ignore-O_NOATIME-if-we-don-t-have-permiss.patch
+stable/lp-1891877-9pfs-include-linux-limits.h-for-XATTR_SIZE_MAX.patch
+stable/lp-1891877-xen-9pfs-yield-when-there-isn-t-enough-room-on-the-r.patch
+stable/lp-1891877-tests-fix-modules-test-duplicate-test-case-error.patch
+stable/lp-1891877-iotests-026-Move-v3-exclusive-test-to-new-file.patch
+stable/lp-1891877-Revert-qemu-options.hx-Update-for-reboot-timeout-par.patch
+stable/lp-1891877-Fix-double-free-issue-in-qemu_set_log_filename.patch
+stable/lp-1891877-iotests-Fix-IMGOPTSSYNTAX-for-nbd.patch
+stable/lp-1891877-display-bochs-display-fix-memory-leak.patch
+stable/lp-1891877-hw-arm-smmuv3-Apply-address-mask-to-linear-strtab-ba.patch
+stable/lp-1891877-hw-arm-smmuv3-Correct-SMMU_BASE_ADDR_MASK-value.patch
+stable/lp-1891877-hw-arm-smmuv3-Check-stream-IDs-against-actual-table-.patch
+stable/lp-1891877-hw-arm-smmuv3-Align-stream-table-base-address-to-tab.patch
+stable/lp-1891877-hw-arm-smmuv3-Use-correct-bit-positions-in-EVT_SET_A.patch
+stable/lp-1891877-hw-arm-smmuv3-Report-F_STE_FETCH-fault-address-in-co.patch
+stable/lp-1891877-block-Add-bdrv_qapi_perm_to_blk_perm.patch
+stable/lp-1891877-blkdebug-Allow-taking-unsharing-permissions.patch
+stable/lp-1891877-migration-test-ppc64-fix-FORTH-test-program.patch
+stable/lp-1891877-runstate-ignore-finishmigrate-prelaunch-transition.patch
+stable/lp-1891877-migration-Rate-limit-inside-host-pages.patch
+stable/lp-1891877-Revert-vnc-allow-fall-back-to-RAW-encoding.patch
+stable/lp-1891877-m68k-Fix-regression-causing-Single-Step-via-GDB-RSP-.patch
+stable/lp-1891877-s390x-adapter-routes-error-handling.patch
+stable/lp-1891877-block-backup-fix-memory-leak-in-bdrv_backup_top_appe.patch
+stable/lp-1891877-hw-intc-arm_gicv3_kvm-Stop-wrongly-programming-GICR_.patch
+stable/lp-1891877-target-arm-fix-TCG-leak-for-fcvt-half-double.patch
+stable/lp-1891877-block-fix-memleaks-in-bdrv_refresh_filename.patch
+stable/lp-1891877-iotests-add-test-for-backup-top-failure-on-permissio.patch
+stable/lp-1891877-target-arm-monitor-query-cpu-model-expansion-crashed.patch
+stable/lp-1891877-block-Fix-VM-size-field-width-in-snapshot-dump.patch
+stable/lp-1891877-target-arm-Correct-definition-of-PMCRDP.patch
+stable/lp-1891877-virtio-pmem-do-delete-rq_vq-in-virtio_pmem_unrealize.patch
+stable/lp-1891877-virtio-crypto-do-delete-ctrl_vq-in-virtio_crypto_dev.patch
+stable/lp-1891877-vhost-user-blk-delete-virtioqueues-in-unrealize-to-f.patch
+stable/lp-1891877-hw-arm-cubieboard-use-ARM-Cortex-A8-as-the-default-C.patch
+stable/lp-1891877-iotests-Fix-nonportable-use-of-od-endian.patch
+stable/lp-1891877-ppc-ppc405_boards-Remove-unnecessary-NULL-check.patch
+stable/lp-1891877-block-Avoid-memleak-on-qcow2-image-info-failure.patch
+stable/lp-1891877-block-bdrv_set_backing_bs-fix-use-after-free.patch
+stable/lp-1891877-hmp-vnc-Fix-info-vnc-list-leak.patch
+stable/lp-1891877-migration-colo-fix-use-after-free-of-local_err.patch
+stable/lp-1891877-migration-ram-fix-use-after-free-of-local_err.patch
+stable/lp-1891877-qcow2-List-autoclear-bit-names-in-header.patch
+stable/lp-1891877-sheepdog-Consistently-set-bdrv_has_zero_init_truncat.patch
+stable/lp-1891877-spapr-Fix-failure-path-for-attempting-to-hot-unplug-.patch
+stable/lp-1891877-vpc-Don-t-round-up-already-aligned-BAT-sizes.patch
+stable/lp-1891877-target-xtensa-fix-pasto-in-pfwait.r-opcode-name.patch
+stable/lp-1891877-tcg-mips-mips-sync-encode-error.patch
+stable/lp-1891877-Fix-tulip-breakage.patch
+stable/lp-1891877-iotests-283-Use-consistent-size-for-source-and-targe.patch
+stable/lp-1891877-Update-version-for-4.2.1-release.patch
+ubuntu/lp-1883984-target-s390x-Fix-SQXBR.patch
+ubuntu/lp-1890154-s390x-protvirt-allow-to-IPL-secure-guests-with-no-re.patch
diff --git a/debian/patches/stable/lp-1891877-9p-Lock-directory-streams-with-a-CoMutex.patch b/debian/patches/stable/lp-1891877-9p-Lock-directory-streams-with-a-CoMutex.patch
 new file mode 100644
index 0000000..f32c223
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-9p-Lock-directory-streams-with-a-CoMutex.patch
@@ -0,0 +1,74 @@
+From dad6d5e7e613e51b2584c447378a044ccc2fdc81 Mon Sep 17 00:00:00 2001
+From: Greg Kurz <[e-mail]>
+Date: Mon, 25 May 2020 10:38:03 +0200
+Subject: [PATCH] 9p: Lock directory streams with a CoMutex
+
+Locking was introduced in QEMU 2.7 to address the deprecation of
+readdir_r(3) in glibc 2.24. It turns out that the frontend code is
+the worst place to handle a critical section with a pthread mutex:
+the code runs in a coroutine on behalf of the QEMU mainloop and then
+yields control, waiting for the fsdev backend to process the request
+in a worker thread. If the client resends another readdir request for
+the same fid before the previous one finally unlocked the mutex, we're
+deadlocked.
+
+This never bit us because the linux client serializes readdir requests
+for the same fid, but it is quite easy to demonstrate with a custom
+client.
+
+A good solution could be to narrow the critical section in the worker
+thread code and to return a copy of the dirent to the frontend, but
+this causes quite some changes in both 9p.c and codir.c. So, instead
+of that, in order for people to easily backport the fix to older QEMU
+versions, let's simply use a CoMutex since all the users for this
+sit in coroutines.
+
+Fixes: 7cde47d4a89d ("9p: add locking to V9fsDir")
+Reviewed-by: Christian Schoenebeck <[e-mail]>
+Message-Id: <[e-mail]>
+Signed-off-by: Greg Kurz <[e-mail]>
+(cherry picked from commit ed463454efd0ac3042ff772bfe1b1d846dc281a5)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=dad6d5e7e6
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ hw/9pfs/9p.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/hw/9pfs/9p.h b/hw/9pfs/9p.h
+index 3904f82901..069c86333f 100644
+--- a/hw/9pfs/9p.h
++++ b/hw/9pfs/9p.h
+@@ -186,22 +186,22 @@ typedef struct V9fsXattr
+ 
+ typedef struct V9fsDir {
+     DIR *stream;
+-    QemuMutex readdir_mutex;
++    CoMutex readdir_mutex;
+ } V9fsDir;
+ 
+ static inline void v9fs_readdir_lock(V9fsDir *dir)
+ {
+-    qemu_mutex_lock(&dir->readdir_mutex);
++    qemu_co_mutex_lock(&dir->readdir_mutex);
+ }
+ 
+ static inline void v9fs_readdir_unlock(V9fsDir *dir)
+ {
+-    qemu_mutex_unlock(&dir->readdir_mutex);
++    qemu_co_mutex_unlock(&dir->readdir_mutex);
+ }
+ 
+ static inline void v9fs_readdir_init(V9fsDir *dir)
+ {
+-    qemu_mutex_init(&dir->readdir_mutex);
++    qemu_co_mutex_init(&dir->readdir_mutex);
+ }
+ 
+ /*
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-9p-local-always-return-1-on-error-in-local_unlinkat_.patch b/debian/patches/stable/lp-1891877-9p-local-always-return-1-on-error-in-local_unlinkat_.patch
 new file mode 100644
index 0000000..f2efe0b
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-9p-local-always-return-1-on-error-in-local_unlinkat_.patch
@@ -0,0 +1,91 @@
+From 03afe9c035884c5901258967cf906de64eff25de Mon Sep 17 00:00:00 2001
+From: Daniel Henrique Barboza <[e-mail]>
+Date: Mon, 20 Jan 2020 15:11:39 +0100
+Subject: [PATCH] 9p: local: always return -1 on error in local_unlinkat_common
+
+local_unlinkat_common() is supposed to always return -1 on error.
+This is being done by jumps to the 'err_out' label, which is
+a 'return ret' call, and 'ret' is initialized with -1.
+
+Unfortunately there is a condition in which the function will
+return 0 on error: in a case where flags == AT_REMOVEDIR, 'ret'
+will be 0 when reaching
+
+map_dirfd = openat_dir(...)
+
+And, if map_dirfd == -1 and errno != ENOENT, the existing 'err_out'
+jump will execute 'return ret', when ret is still set to zero
+at that point.
+
+This patch fixes it by changing all 'err_out' labels by
+'return -1' calls, ensuring that the function will always
+return -1 on error conditions. 'ret' can be left unintialized
+since it's now being used just to store the result of 'unlinkat'
+calls.
+
+CC: Greg Kurz <[e-mail]>
+Signed-off-by: Daniel Henrique Barboza <[e-mail]>
+[groug: changed prefix in title to be "9p: local:"]
+Signed-off-by: Greg Kurz <[e-mail]>
+(cherry picked from commit 846cf408a4c8055063f4a5a71ccf7ed030cdad30)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=03afe9c035
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ hw/9pfs/9p-local.c | 14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/hw/9pfs/9p-local.c b/hw/9pfs/9p-local.c
+index 491b08aee8..b3b826b01f 100644
+--- a/hw/9pfs/9p-local.c
++++ b/hw/9pfs/9p-local.c
+@@ -1076,7 +1076,7 @@ out:
+ static int local_unlinkat_common(FsContext *ctx, int dirfd, const char *name,
+                                  int flags)
+ {
+-    int ret = -1;
++    int ret;
+ 
+     if (ctx->export_flags & V9FS_SM_MAPPED_FILE) {
+         int map_dirfd;
+@@ -1094,12 +1094,12 @@ static int local_unlinkat_common(FsContext *ctx, int dirfd, const char *name,
+ 
+             fd = openat_dir(dirfd, name);
+             if (fd == -1) {
+-                goto err_out;
++                return -1;
+             }
+             ret = unlinkat(fd, VIRTFS_META_DIR, AT_REMOVEDIR);
+             close_preserve_errno(fd);
+             if (ret < 0 && errno != ENOENT) {
+-                goto err_out;
++                return -1;
+             }
+         }
+         map_dirfd = openat_dir(dirfd, VIRTFS_META_DIR);
+@@ -1107,16 +1107,14 @@ static int local_unlinkat_common(FsContext *ctx, int dirfd, const char *name,
+             ret = unlinkat(map_dirfd, name, 0);
+             close_preserve_errno(map_dirfd);
+             if (ret < 0 && errno != ENOENT) {
+-                goto err_out;
++                return -1;
+             }
+         } else if (errno != ENOENT) {
+-            goto err_out;
++            return -1;
+         }
+     }
+ 
+-    ret = unlinkat(dirfd, name, flags);
+-err_out:
+-    return ret;
++    return unlinkat(dirfd, name, flags);
+ }
+ 
+ static int local_remove(FsContext *ctx, const char *path)
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-9p-proxy-Fix-export_flags.patch b/debian/patches/stable/lp-1891877-9p-proxy-Fix-export_flags.patch
 new file mode 100644
index 0000000..8784844
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-9p-proxy-Fix-export_flags.patch
@@ -0,0 +1,49 @@
+From 410252fc5b2aaef65b793edd37289284c1a4eb91 Mon Sep 17 00:00:00 2001
+From: Greg Kurz <[e-mail]>
+Date: Tue, 10 Mar 2020 16:12:49 +0100
+Subject: [PATCH] 9p/proxy: Fix export_flags
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The common fsdev options are set by qemu_fsdev_add() before it calls
+the backend specific option parsing code. In the case of "proxy" this
+means "writeout" or "readonly" were simply ignored. This has been
+broken from the beginning.
+
+Reported-by: Stéphane Graber <[e-mail]>
+Signed-off-by: Greg Kurz <[e-mail]>
+Reviewed-by: Philippe Mathieu-Daudé <[e-mail]>
+Reviewed-by: Christian Schoenebeck <[e-mail]>
+Message-Id: <[e-mail]>
+(cherry picked from commit 659f1953281bcfa5ac217e42877d7d3c32eeea38)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=410252fc5b
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ hw/9pfs/9p-proxy.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/hw/9pfs/9p-proxy.c b/hw/9pfs/9p-proxy.c
+index 97ab9c58a5..3b885b96b5 100644
+--- a/hw/9pfs/9p-proxy.c
++++ b/hw/9pfs/9p-proxy.c
+@@ -1139,10 +1139,10 @@ static int proxy_parse_opts(QemuOpts *opts, FsDriverEntry *fs, Error **errp)
+     }
+     if (socket) {
+         fs->path = g_strdup(socket);
+-        fs->export_flags = V9FS_PROXY_SOCK_NAME;
++        fs->export_flags |= V9FS_PROXY_SOCK_NAME;
+     } else {
+         fs->path = g_strdup(sock_fd);
+-        fs->export_flags = V9FS_PROXY_SOCK_FD;
++        fs->export_flags |= V9FS_PROXY_SOCK_FD;
+     }
+     return 0;
+ }
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-9pfs-include-linux-limits.h-for-XATTR_SIZE_MAX.patch b/debian/patches/stable/lp-1891877-9pfs-include-linux-limits.h-for-XATTR_SIZE_MAX.patch
 new file mode 100644
index 0000000..8f0bcb5
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-9pfs-include-linux-limits.h-for-XATTR_SIZE_MAX.patch
@@ -0,0 +1,43 @@
+From 0c6499ff2b1f9614195f31a24f1cf3888ce5d079 Mon Sep 17 00:00:00 2001
+From: Dan Robertson <[e-mail]>
+Date: Mon, 25 May 2020 10:38:03 +0200
+Subject: [PATCH] 9pfs: include linux/limits.h for XATTR_SIZE_MAX
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+linux/limits.h should be included for the XATTR_SIZE_MAX definition used
+by v9fs_xattrcreate.
+
+Fixes: 3b79ef2cf488 ("9pfs: limit xattr size in xattrcreate")
+Signed-off-by: Dan Robertson <[e-mail]>
+Reviewed-by: Philippe Mathieu-Daudé <[e-mail]>
+Reviewed-by: Christian Schoenebeck <[e-mail]>
+Message-Id: <[e-mail]>
+Signed-off-by: Greg Kurz <[e-mail]>
+(cherry picked from commit 03556ea920b23c466ce7c1283199033de33ee671)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=0c6499ff2b
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ hw/9pfs/9p.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c
+index 520177f40c..37e43d3f85 100644
+--- a/hw/9pfs/9p.c
++++ b/hw/9pfs/9p.c
+@@ -28,6 +28,7 @@
+ #include "sysemu/qtest.h"
+ #include "qemu/xxhash.h"
+ #include <math.h>
++#include <linux/limits.h>
+ 
+ int open_fd_hw;
+ int total_open_fd;
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-9pfs-local-Fix-possible-memory-leak-in-local_link.patch b/debian/patches/stable/lp-1891877-9pfs-local-Fix-possible-memory-leak-in-local_link.patch
 new file mode 100644
index 0000000..3e0996b
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-9pfs-local-Fix-possible-memory-leak-in-local_link.patch
@@ -0,0 +1,44 @@
+From 18f6b13e085fdb81f5385bffce35364ab8535303 Mon Sep 17 00:00:00 2001
+From: Jiajun Chen <[e-mail]>
+Date: Mon, 20 Jan 2020 15:11:39 +0100
+Subject: [PATCH] 9pfs: local: Fix possible memory leak in local_link()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+There is a possible memory leak while local_link return -1 without free
+odirpath and oname.
+
+Reported-by: Euler Robot <[e-mail]>
+Signed-off-by: Jaijun Chen <[e-mail]>
+Signed-off-by: Xiang Zheng <[e-mail]>
+Reviewed-by: Christian Schoenebeck <[e-mail]>
+Reviewed-by: Philippe Mathieu-Daudé <[e-mail]>
+Signed-off-by: Greg Kurz <[e-mail]>
+(cherry picked from commit 841b8d099c462cd4282c4ced8c2a6512899fd8d9)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=18f6b13e08
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ hw/9pfs/9p-local.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/hw/9pfs/9p-local.c b/hw/9pfs/9p-local.c
+index 4708c0bd89..491b08aee8 100644
+--- a/hw/9pfs/9p-local.c
++++ b/hw/9pfs/9p-local.c
+@@ -947,7 +947,7 @@ static int local_link(FsContext *ctx, V9fsPath *oldpath,
+     if (ctx->export_flags & V9FS_SM_MAPPED_FILE &&
+         local_is_mapped_file_metadata(ctx, name)) {
+         errno = EINVAL;
+-        return -1;
++        goto out;
+     }
+ 
+     odirfd = local_opendir_nofollow(ctx, odirpath);
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-9pfs-local-ignore-O_NOATIME-if-we-don-t-have-permiss.patch b/debian/patches/stable/lp-1891877-9pfs-local-ignore-O_NOATIME-if-we-don-t-have-permiss.patch
 new file mode 100644
index 0000000..59acbb2
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-9pfs-local-ignore-O_NOATIME-if-we-don-t-have-permiss.patch
@@ -0,0 +1,67 @@
+From 17216bc04494825600b58ebb8a3a6fe0d8052125 Mon Sep 17 00:00:00 2001
+From: Omar Sandoval <[e-mail]>
+Date: Thu, 14 May 2020 08:06:43 +0200
+Subject: [PATCH] 9pfs: local: ignore O_NOATIME if we don't have permissions
+
+QEMU's local 9pfs server passes through O_NOATIME from the client. If
+the QEMU process doesn't have permissions to use O_NOATIME (namely, it
+does not own the file nor have the CAP_FOWNER capability), the open will
+fail. This causes issues when from the client's point of view, it
+believes it has permissions to use O_NOATIME (e.g., a process running as
+root in the virtual machine). Additionally, overlayfs on Linux opens
+files on the lower layer using O_NOATIME, so in this case a 9pfs mount
+can't be used as a lower layer for overlayfs (cf.
+https://github.com/osandov/drgn/blob/dabfe1971951701da13863dbe6d8a1d172ad9650/vmtest/onoatimehack.c
+and https://github.com/NixOS/nixpkgs/issues/54509).
+
+Luckily, O_NOATIME is effectively a hint, and is often ignored by, e.g.,
+network filesystems. open(2) notes that O_NOATIME "may not be effective
+on all filesystems. One example is NFS, where the server maintains the
+access time." This means that we can honor it when possible but fall
+back to ignoring it.
+
+Acked-by: Christian Schoenebeck <[e-mail]>
+Signed-off-by: Omar Sandoval <[e-mail]>
+Message-Id: <[e-mail]>
+Signed-off-by: Greg Kurz <[e-mail]>
+(cherry picked from commit a5804fcf7b22fc7d1f9ec794dd284c7d504bd16b)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=17216bc044
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ hw/9pfs/9p-util.h | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/hw/9pfs/9p-util.h b/hw/9pfs/9p-util.h
+index 79ed6b233e..546f46dc7d 100644
+--- a/hw/9pfs/9p-util.h
++++ b/hw/9pfs/9p-util.h
+@@ -37,9 +37,22 @@ static inline int openat_file(int dirfd, const char *name, int flags,
+ {
+     int fd, serrno, ret;
+ 
++again:
+     fd = openat(dirfd, name, flags | O_NOFOLLOW | O_NOCTTY | O_NONBLOCK,
+                 mode);
+     if (fd == -1) {
++        if (errno == EPERM && (flags & O_NOATIME)) {
++            /*
++             * The client passed O_NOATIME but we lack permissions to honor it.
++             * Rather than failing the open, fall back without O_NOATIME. This
++             * doesn't break the semantics on the client side, as the Linux
++             * open(2) man page notes that O_NOATIME "may not be effective on
++             * all filesystems". In particular, NFS and other network
++             * filesystems ignore it entirely.
++             */
++            flags &= ~O_NOATIME;
++            goto again;
++        }
+         return -1;
+     }
+ 
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-Fix-double-free-issue-in-qemu_set_log_filename.patch b/debian/patches/stable/lp-1891877-Fix-double-free-issue-in-qemu_set_log_filename.patch
 new file mode 100644
index 0000000..c6c78e1
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-Fix-double-free-issue-in-qemu_set_log_filename.patch
@@ -0,0 +1,41 @@
+From 45b65bf8dfb46a03ff67c36424986e2450c5203e Mon Sep 17 00:00:00 2001
+From: Robert Foley <[e-mail]>
+Date: Mon, 18 Nov 2019 16:15:23 -0500
+Subject: [PATCH] Fix double free issue in qemu_set_log_filename().
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+After freeing the logfilename, we set logfilename to NULL, in case of an
+error which returns without setting logfilename.
+
+Signed-off-by: Robert Foley <[e-mail]>
+Reviewed-by: Alex Bennée <[e-mail]>
+Signed-off-by: Alex Bennée <[e-mail]>
+Message-Id: <[e-mail]>
+(cherry picked from commit 0f516ca4767042aec8716369d6d62436fa10593a)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=45b65bf8df
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ util/log.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/util/log.c b/util/log.c
+index 1ca13059ee..4316fe74ee 100644
+--- a/util/log.c
++++ b/util/log.c
+@@ -113,6 +113,7 @@ void qemu_set_log_filename(const char *filename, Error **errp)
+ {
+     char *pidstr;
+     g_free(logfilename);
++    logfilename = NULL;
+ 
+     pidstr = strstr(filename, "%");
+     if (pidstr) {
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-Fix-tulip-breakage.patch b/debian/patches/stable/lp-1891877-Fix-tulip-breakage.patch
 new file mode 100644
index 0000000..ed4a09c
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-Fix-tulip-breakage.patch
@@ -0,0 +1,65 @@
+From 0664ffac4be2673c1c962bb9d010dc964d080ee7 Mon Sep 17 00:00:00 2001
+From: Helge Deller <[e-mail]>
+Date: Sun, 26 Apr 2020 12:55:39 +0200
+Subject: [PATCH] Fix tulip breakage
+
+The tulip network driver in a qemu-system-hppa emulation is broken in
+the sense that bigger network packages aren't received any longer and
+thus even running e.g. "apt update" inside the VM fails.
+
+The breakage was introduced by commit 8ffb7265af ("check frame size and
+r/w data length") which added checks to prevent accesses outside of the
+rx/tx buffers.
+
+But the new checks were implemented wrong. The variable rx_frame_len
+counts backwards, from rx_frame_size down to zero, and the variable len
+is never bigger than rx_frame_len, so accesses just can't happen and the
+checks are unnecessary.
+On the contrary the checks now prevented bigger packages to be moved
+into the rx buffers.
+
+This patch reverts the wrong checks and were sucessfully tested with a
+qemu-system-hppa emulation.
+
+Fixes: 8ffb7265af ("check frame size and r/w data length")
+Buglink: https://bugs.launchpad.net/bugs/1874539
+Signed-off-by: Helge Deller <[e-mail]>
+Signed-off-by: Jason Wang <[e-mail]>
+(cherry picked from commit d9b69640391618045949f7c500b87fc129f862ed)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=0664ffac4b
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ hw/net/tulip.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/hw/net/tulip.c b/hw/net/tulip.c
+index 1167c1bb07..c6654a98a9 100644
+--- a/hw/net/tulip.c
++++ b/hw/net/tulip.c
+@@ -171,9 +171,6 @@ static void tulip_copy_rx_bytes(TULIPState *s, struct tulip_descriptor *desc)
+             len = s->rx_frame_len;
+         }
+ 
+-        if (s->rx_frame_len + len > sizeof(s->rx_frame)) {
+-            return;
+-        }
+         pci_dma_write(&s->dev, desc->buf_addr1, s->rx_frame +
+             (s->rx_frame_size - s->rx_frame_len), len);
+         s->rx_frame_len -= len;
+@@ -186,9 +183,6 @@ static void tulip_copy_rx_bytes(TULIPState *s, struct tulip_descriptor *desc)
+             len = s->rx_frame_len;
+         }
+ 
+-        if (s->rx_frame_len + len > sizeof(s->rx_frame)) {
+-            return;
+-        }
+         pci_dma_write(&s->dev, desc->buf_addr2, s->rx_frame +
+             (s->rx_frame_size - s->rx_frame_len), len);
+         s->rx_frame_len -= len;
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-Revert-qemu-options.hx-Update-for-reboot-timeout-par.patch b/debian/patches/stable/lp-1891877-Revert-qemu-options.hx-Update-for-reboot-timeout-par.patch
 new file mode 100644
index 0000000..a667e04
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-Revert-qemu-options.hx-Update-for-reboot-timeout-par.patch
@@ -0,0 +1,43 @@
+From aea7a50fb5e38ccfda741848286a548b72877dfa Mon Sep 17 00:00:00 2001
+From: Han Han <[e-mail]>
+Date: Thu, 5 Dec 2019 10:48:21 +0800
+Subject: [PATCH] Revert "qemu-options.hx: Update for reboot-timeout parameter"
+
+This reverts commit bbd9e6985ff342cbe15b9cb7eb30e842796fbbe8.
+
+In 20a1922032 we allowed reboot-timeout=-1 again, so update the doc
+accordingly.
+
+Signed-off-by: Han Han <[e-mail]>
+Reviewed-by: Markus Armbruster <[e-mail]>
+Message-Id: <[e-mail]>
+Signed-off-by: Laurent Vivier <[e-mail]>
+(cherry picked from commit 8937a39da22e5d5689c516a2d4ce4f2bb6a378fc)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=aea7a50fb5
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ qemu-options.hx | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/qemu-options.hx b/qemu-options.hx
+index 65c9473b73..e14d88e9b2 100644
+--- a/qemu-options.hx
++++ b/qemu-options.hx
+@@ -327,8 +327,8 @@ format(true color). The resolution should be supported by the SVGA mode, so
+ the recommended is 320x240, 640x480, 800x640.
+ 
+ A timeout could be passed to bios, guest will pause for @var{rb_timeout} ms
+-when boot failed, then reboot. If @option{reboot-timeout} is not set,
+-guest will not reboot by default. Currently Seabios for X86
++when boot failed, then reboot. If @var{rb_timeout} is '-1', guest will not
++reboot, qemu passes '-1' to bios by default. Currently Seabios for X86
+ system support it.
+ 
+ Do strict boot via @option{strict=on} as far as firmware/BIOS
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-Revert-vnc-allow-fall-back-to-RAW-encoding.patch b/debian/patches/stable/lp-1891877-Revert-vnc-allow-fall-back-to-RAW-encoding.patch
 new file mode 100644
index 0000000..8319291
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-Revert-vnc-allow-fall-back-to-RAW-encoding.patch
@@ -0,0 +1,77 @@
+From b5ba361d8f8908ab37a104b0110910926d94d57f Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <[e-mail]>
+Date: Tue, 21 Jan 2020 07:02:10 +0100
+Subject: [PATCH] Revert "vnc: allow fall back to RAW encoding"
+
+This reverts commit de3f7de7f4e257ce44cdabb90f5f17ee99624557.
+
+Remove VNC optimization to reencode framebuffer update as raw if it's
+smaller than the default encoding.
+
+QEMU's implementation was naive and didn't account for the ZLIB z_stream
+mutating with each compression.  Because of the mutation, simply
+resetting the output buffer's offset wasn't sufficient to "rewind" the
+operation.  The mutated z_stream would generate future zlib blocks which
+referred to symbols in past blocks which weren't sent.  This would lead
+to artifacting.
+
+Considering that ZRLE is never larger than raw and even though ZLIB can
+occasionally be fractionally larger than raw, the overhead of
+implementing this optimization correctly isn't worth it.
+
+Signed-off-by: Cameron Esfahani <[e-mail]>
+Signed-off-by: Gerd Hoffmann <[e-mail]>
+(cherry picked from commit 0780ec7be82dd4781e9fd216b5d99a125882ff5a)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=b5ba361d8f
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ ui/vnc.c | 20 ++------------------
+ 1 file changed, 2 insertions(+), 18 deletions(-)
+
+diff --git a/ui/vnc.c b/ui/vnc.c
+index 87b8045afe..f94b3a257e 100644
+--- a/ui/vnc.c
++++ b/ui/vnc.c
+@@ -898,8 +898,6 @@ int vnc_raw_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
+ int vnc_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
+ {
+     int n = 0;
+-    bool encode_raw = false;
+-    size_t saved_offs = vs->output.offset;
+ 
+     switch(vs->vnc_encoding) {
+         case VNC_ENCODING_ZLIB:
+@@ -922,24 +920,10 @@ int vnc_send_framebuffer_update(VncState *vs, int x, int y, int w, int h)
+             n = vnc_zywrle_send_framebuffer_update(vs, x, y, w, h);
+             break;
+         default:
+-            encode_raw = true;
++            vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_RAW);
++            n = vnc_raw_send_framebuffer_update(vs, x, y, w, h);
+             break;
+     }
+-
+-    /* If the client has the same pixel format as our internal buffer and
+-     * a RAW encoding would need less space fall back to RAW encoding to
+-     * save bandwidth and processing power in the client. */
+-    if (!encode_raw && vs->write_pixels == vnc_write_pixels_copy &&
+-        12 + h * w * VNC_SERVER_FB_BYTES <= (vs->output.offset - saved_offs)) {
+-        vs->output.offset = saved_offs;
+-        encode_raw = true;
+-    }
+-
+-    if (encode_raw) {
+-        vnc_framebuffer_update(vs, x, y, w, h, VNC_ENCODING_RAW);
+-        n = vnc_raw_send_framebuffer_update(vs, x, y, w, h);
+-    }
+-
+     return n;
+ }
+ 
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-Update-version-for-4.2.1-release.patch b/debian/patches/stable/lp-1891877-Update-version-for-4.2.1-release.patch
 new file mode 100644
index 0000000..15a9277
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-Update-version-for-4.2.1-release.patch
@@ -0,0 +1,24 @@
+From 6cdf8c4efa073eac7d5f9894329e2d07743c2955 Mon Sep 17 00:00:00 2001
+From: Michael Roth <[e-mail]>
+Date: Thu, 25 Jun 2020 13:08:54 -0500
+Subject: [PATCH] Update version for 4.2.1 release
+
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=6cdf8c4efa
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ VERSION | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/VERSION b/VERSION
+index 6aba2b245a..fae6e3d04b 100644
+--- a/VERSION
++++ b/VERSION
+@@ -1 +1 @@
+-4.2.0
++4.2.1
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-blkdebug-Allow-taking-unsharing-permissions.patch b/debian/patches/stable/lp-1891877-blkdebug-Allow-taking-unsharing-permissions.patch
 new file mode 100644
index 0000000..108b9bf
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-blkdebug-Allow-taking-unsharing-permissions.patch
@@ -0,0 +1,209 @@
+From 9a30621d3d5de76f865dc804a1dd16cc517461b6 Mon Sep 17 00:00:00 2001
+From: Max Reitz <[e-mail]>
+Date: Fri, 8 Nov 2019 13:34:53 +0100
+Subject: [PATCH] blkdebug: Allow taking/unsharing permissions
+
+Sometimes it is useful to be able to add a node to the block graph that
+takes or unshare a certain set of permissions for debugging purposes.
+This patch adds this capability to blkdebug.
+
+(Note that you cannot make blkdebug release or share permissions that it
+needs to take or cannot share, because this might result in assertion
+failures in the block layer.  But if the blkdebug node has no parents,
+it will not take any permissions and share everything by default, so you
+can then freely choose what permissions to take and share.)
+
+Signed-off-by: Max Reitz <[e-mail]>
+Message-id: [e-mail]
+Reviewed-by: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Signed-off-by: Max Reitz <[e-mail]>
+(cherry picked from commit 69c6449ff10fe4e3219e960549307096d5366bd0)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=9a30621d3d
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ block/blkdebug.c     | 93 +++++++++++++++++++++++++++++++++++++++++++-
+ qapi/block-core.json | 14 ++++++-
+ 2 files changed, 105 insertions(+), 2 deletions(-)
+
+diff --git a/block/blkdebug.c b/block/blkdebug.c
+index 5ae96c52b0..af44aa973f 100644
+--- a/block/blkdebug.c
++++ b/block/blkdebug.c
+@@ -28,10 +28,14 @@
+ #include "qemu/cutils.h"
+ #include "qemu/config-file.h"
+ #include "block/block_int.h"
++#include "block/qdict.h"
+ #include "qemu/module.h"
+ #include "qemu/option.h"
++#include "qapi/qapi-visit-block-core.h"
+ #include "qapi/qmp/qdict.h"
++#include "qapi/qmp/qlist.h"
+ #include "qapi/qmp/qstring.h"
++#include "qapi/qobject-input-visitor.h"
+ #include "sysemu/qtest.h"
+ 
+ typedef struct BDRVBlkdebugState {
+@@ -44,6 +48,9 @@ typedef struct BDRVBlkdebugState {
+     uint64_t opt_discard;
+     uint64_t max_discard;
+ 
++    uint64_t take_child_perms;
++    uint64_t unshare_child_perms;
++
+     /* For blkdebug_refresh_filename() */
+     char *config_file;
+ 
+@@ -344,6 +351,69 @@ static void blkdebug_parse_filename(const char *filename, QDict *options,
+     qdict_put_str(options, "x-image", filename);
+ }
+ 
++static int blkdebug_parse_perm_list(uint64_t *dest, QDict *options,
++                                    const char *prefix, Error **errp)
++{
++    int ret = 0;
++    QDict *subqdict = NULL;
++    QObject *crumpled_subqdict = NULL;
++    Visitor *v = NULL;
++    BlockPermissionList *perm_list = NULL, *element;
++    Error *local_err = NULL;
++
++    *dest = 0;
++
++    qdict_extract_subqdict(options, &subqdict, prefix);
++    if (!qdict_size(subqdict)) {
++        goto out;
++    }
++
++    crumpled_subqdict = qdict_crumple(subqdict, errp);
++    if (!crumpled_subqdict) {
++        ret = -EINVAL;
++        goto out;
++    }
++
++    v = qobject_input_visitor_new(crumpled_subqdict);
++    visit_type_BlockPermissionList(v, NULL, &perm_list, &local_err);
++    if (local_err) {
++        error_propagate(errp, local_err);
++        ret = -EINVAL;
++        goto out;
++    }
++
++    for (element = perm_list; element; element = element->next) {
++        *dest |= bdrv_qapi_perm_to_blk_perm(element->value);
++    }
++
++out:
++    qapi_free_BlockPermissionList(perm_list);
++    visit_free(v);
++    qobject_unref(subqdict);
++    qobject_unref(crumpled_subqdict);
++    return ret;
++}
++
++static int blkdebug_parse_perms(BDRVBlkdebugState *s, QDict *options,
++                                Error **errp)
++{
++    int ret;
++
++    ret = blkdebug_parse_perm_list(&s->take_child_perms, options,
++                                   "take-child-perms.", errp);
++    if (ret < 0) {
++        return ret;
++    }
++
++    ret = blkdebug_parse_perm_list(&s->unshare_child_perms, options,
++                                   "unshare-child-perms.", errp);
++    if (ret < 0) {
++        return ret;
++    }
++
++    return 0;
++}
++
+ static QemuOptsList runtime_opts = {
+     .name = "blkdebug",
+     .head = QTAILQ_HEAD_INITIALIZER(runtime_opts.head),
+@@ -419,6 +489,12 @@ static int blkdebug_open(BlockDriverState *bs, QDict *options, int flags,
+     /* Set initial state */
+     s->state = 1;
+ 
++    /* Parse permissions modifiers before opening the image file */
++    ret = blkdebug_parse_perms(s, options, errp);
++    if (ret < 0) {
++        goto out;
++    }
++
+     /* Open the image file */
+     bs->file = bdrv_open_child(qemu_opt_get(opts, "x-image"), options, "image",
+                                bs, &child_file, false, &local_err);
+@@ -916,6 +992,21 @@ static int blkdebug_reopen_prepare(BDRVReopenState *reopen_state,
+     return 0;
+ }
+ 
++static void blkdebug_child_perm(BlockDriverState *bs, BdrvChild *c,
++                                const BdrvChildRole *role,
++                                BlockReopenQueue *reopen_queue,
++                                uint64_t perm, uint64_t shared,
++                                uint64_t *nperm, uint64_t *nshared)
++{
++    BDRVBlkdebugState *s = bs->opaque;
++
++    bdrv_filter_default_perms(bs, c, role, reopen_queue, perm, shared,
++                              nperm, nshared);
++
++    *nperm |= s->take_child_perms;
++    *nshared &= ~s->unshare_child_perms;
++}
++
+ static const char *const blkdebug_strong_runtime_opts[] = {
+     "config",
+     "inject-error.",
+@@ -940,7 +1031,7 @@ static BlockDriver bdrv_blkdebug = {
+     .bdrv_file_open         = blkdebug_open,
+     .bdrv_close             = blkdebug_close,
+     .bdrv_reopen_prepare    = blkdebug_reopen_prepare,
+-    .bdrv_child_perm        = bdrv_filter_default_perms,
++    .bdrv_child_perm        = blkdebug_child_perm,
+ 
+     .bdrv_getlength         = blkdebug_getlength,
+     .bdrv_refresh_filename  = blkdebug_refresh_filename,
+diff --git a/qapi/block-core.json b/qapi/block-core.json
+index fcb52ec24f..839b10b3f0 100644
+--- a/qapi/block-core.json
++++ b/qapi/block-core.json
+@@ -3454,6 +3454,16 @@
+ #
+ # @set-state:       array of state-change descriptions
+ #
++# @take-child-perms: Permissions to take on @image in addition to what
++#                    is necessary anyway (which depends on how the
++#                    blkdebug node is used).  Defaults to none.
++#                    (since 5.0)
++#
++# @unshare-child-perms: Permissions not to share on @image in addition
++#                       to what cannot be shared anyway (which depends
++#                       on how the blkdebug node is used).  Defaults
++#                       to none.  (since 5.0)
++#
+ # Since: 2.9
+ ##
+ { 'struct': 'BlockdevOptionsBlkdebug',
+@@ -3463,7 +3473,9 @@
+             '*opt-write-zero': 'int32', '*max-write-zero': 'int32',
+             '*opt-discard': 'int32', '*max-discard': 'int32',
+             '*inject-error': ['BlkdebugInjectErrorOptions'],
+-            '*set-state': ['BlkdebugSetStateOptions'] } }
++            '*set-state': ['BlkdebugSetStateOptions'],
++            '*take-child-perms': ['BlockPermission'],
++            '*unshare-child-perms': ['BlockPermission'] } }
+ 
+ ##
+ # @BlockdevOptionsBlklogwrites:
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-block-Add-bdrv_qapi_perm_to_blk_perm.patch b/debian/patches/stable/lp-1891877-block-Add-bdrv_qapi_perm_to_blk_perm.patch
 new file mode 100644
index 0000000..0faa557
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-block-Add-bdrv_qapi_perm_to_blk_perm.patch
@@ -0,0 +1,87 @@
+From 0972fbf353e436088bbc4180bc13e93245cd7add Mon Sep 17 00:00:00 2001
+From: Max Reitz <[e-mail]>
+Date: Fri, 8 Nov 2019 13:34:51 +0100
+Subject: [PATCH] block: Add bdrv_qapi_perm_to_blk_perm()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+We need some way to correlate QAPI BlockPermission values with
+BLK_PERM_* flags.  We could:
+
+(1) have the same order in the QAPI definition as the the BLK_PERM_*
+    flags are in LSb-first order.  However, then there is no guarantee
+    that they actually match (e.g. when someone modifies the QAPI schema
+    without thinking of the BLK_PERM_* definitions).
+    We could add static assertions, but these would break what’s good
+    about this solution, namely its simplicity.
+
+(2) define the BLK_PERM_* flags based on the BlockPermission values.
+    But this way whenever someone were to modify the QAPI order
+    (perfectly sensible in theory), the BLK_PERM_* values would change.
+    Because these values are used for file locking, this might break
+    file locking between different qemu versions.
+
+Therefore, go the slightly more cumbersome way: Add a function to
+translate from the QAPI constants to the BLK_PERM_* flags.
+
+Signed-off-by: Max Reitz <[e-mail]>
+Message-id: [e-mail]
+Reviewed-by: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Signed-off-by: Max Reitz <[e-mail]>
+(cherry picked from commit 7b1d9c4df0603fbc526226a9c5ef91118aa6c957)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=0972fbf353
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ block.c               | 18 ++++++++++++++++++
+ include/block/block.h |  1 +
+ 2 files changed, 19 insertions(+)
+
+diff --git a/block.c b/block.c
+index 19c25da305..863cf34d45 100644
+--- a/block.c
++++ b/block.c
+@@ -2227,6 +2227,24 @@ void bdrv_format_default_perms(BlockDriverState *bs, BdrvChild *c,
+     *nshared = shared;
+ }
+ 
++uint64_t bdrv_qapi_perm_to_blk_perm(BlockPermission qapi_perm)
++{
++    static const uint64_t permissions[] = {
++        [BLOCK_PERMISSION_CONSISTENT_READ]  = BLK_PERM_CONSISTENT_READ,
++        [BLOCK_PERMISSION_WRITE]            = BLK_PERM_WRITE,
++        [BLOCK_PERMISSION_WRITE_UNCHANGED]  = BLK_PERM_WRITE_UNCHANGED,
++        [BLOCK_PERMISSION_RESIZE]           = BLK_PERM_RESIZE,
++        [BLOCK_PERMISSION_GRAPH_MOD]        = BLK_PERM_GRAPH_MOD,
++    };
++
++    QEMU_BUILD_BUG_ON(ARRAY_SIZE(permissions) != BLOCK_PERMISSION__MAX);
++    QEMU_BUILD_BUG_ON(1UL << ARRAY_SIZE(permissions) != BLK_PERM_ALL + 1);
++
++    assert(qapi_perm < BLOCK_PERMISSION__MAX);
++
++    return permissions[qapi_perm];
++}
++
+ static void bdrv_replace_child_noperm(BdrvChild *child,
+                                       BlockDriverState *new_bs)
+ {
+diff --git a/include/block/block.h b/include/block/block.h
+index 1df9848e74..e9dcfef7fa 100644
+--- a/include/block/block.h
++++ b/include/block/block.h
+@@ -280,6 +280,7 @@ enum {
+ };
+ 
+ char *bdrv_perm_names(uint64_t perm);
++uint64_t bdrv_qapi_perm_to_blk_perm(BlockPermission qapi_perm);
+ 
+ /* disk I/O throttling */
+ void bdrv_init(void);
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-block-Avoid-memleak-on-qcow2-image-info-failure.patch b/debian/patches/stable/lp-1891877-block-Avoid-memleak-on-qcow2-image-info-failure.patch
 new file mode 100644
index 0000000..3a3a104
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-block-Avoid-memleak-on-qcow2-image-info-failure.patch
@@ -0,0 +1,41 @@
+From 47e0fa74799c23dc29ff0adb356d82425b166231 Mon Sep 17 00:00:00 2001
+From: Eric Blake <[e-mail]>
+Date: Fri, 20 Mar 2020 13:36:20 -0500
+Subject: [PATCH] block: Avoid memleak on qcow2 image info failure
+
+If we fail to get bitmap info, we must not leak the encryption info.
+
+Fixes: b8968c875f403
+Fixes: Coverity CID 1421894
+Signed-off-by: Eric Blake <[e-mail]>
+Message-Id: <[e-mail]>
+Reviewed-by: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Reviewed-by: Andrey Shinkevich <[e-mail]>
+Tested-by: Andrey Shinkevich <[e-mail]>
+Signed-off-by: Max Reitz <[e-mail]>
+(cherry picked from commit 71eaec2e8c7c8d266137b5c5f42da0bd6d6b5eb7)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=47e0fa7479
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ block/qcow2.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/block/qcow2.c b/block/qcow2.c
+index 7c18721741..13e118e16f 100644
+--- a/block/qcow2.c
++++ b/block/qcow2.c
+@@ -4800,6 +4800,7 @@ static ImageInfoSpecific *qcow2_get_specific_info(BlockDriverState *bs,
+         if (local_err) {
+             error_propagate(errp, local_err);
+             qapi_free_ImageInfoSpecific(spec_info);
++            qapi_free_QCryptoBlockInfo(encrypt_info);
+             return NULL;
+         }
+         *spec_info->u.qcow2.data = (ImageInfoSpecificQCow2){
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-block-Call-attention-to-truncation-of-long-NBD-expor.patch b/debian/patches/stable/lp-1891877-block-Call-attention-to-truncation-of-long-NBD-expor.patch
 new file mode 100644
index 0000000..008a0c3
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-block-Call-attention-to-truncation-of-long-NBD-expor.patch
@@ -0,0 +1,100 @@
+From 6c75ddf4a9f317f038a4d94da1b2989fef5dd93b Mon Sep 17 00:00:00 2001
+From: Eric Blake <[e-mail]>
+Date: Mon, 8 Jun 2020 13:26:38 -0500
+Subject: [PATCH] block: Call attention to truncation of long NBD exports
+
+Commit 93676c88 relaxed our NBD client code to request export names up
+to the NBD protocol maximum of 4096 bytes without NUL terminator, even
+though the block layer can't store anything longer than 4096 bytes
+including NUL terminator for display to the user.  Since this means
+there are some export names where we have to truncate things, we can
+at least try to make the truncation a bit more obvious for the user.
+Note that in spite of the truncated display name, we can still
+communicate with an NBD server using such a long export name; this was
+deemed nicer than refusing to even connect to such a server (since the
+server may not be under our control, and since determining our actual
+length limits gets tricky when nbd://host:port/export and
+nbd+unix:///export?socket=/path are themselves variable-length
+expansions beyond the export name but count towards the block layer
+name length).
+
+Reported-by: Xueqiang Wei <[e-mail]>
+Fixes: https://bugzilla.redhat.com/1843684
+Signed-off-by: Eric Blake <[e-mail]>
+Reviewed-by: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Message-Id: <[e-mail]>
+(cherry picked from commit 5c86bdf1208916ece0b87e1151c9b48ee54faa3e)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=6c75ddf4a9
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ block.c     |  7 +++++--
+ block/nbd.c | 21 +++++++++++++--------
+ 2 files changed, 18 insertions(+), 10 deletions(-)
+
+diff --git a/block.c b/block.c
+index 2e5e8b639a..19c25da305 100644
+--- a/block.c
++++ b/block.c
+@@ -6486,8 +6486,11 @@ void bdrv_refresh_filename(BlockDriverState *bs)
+         pstrcpy(bs->filename, sizeof(bs->filename), bs->exact_filename);
+     } else {
+         QString *json = qobject_to_json(QOBJECT(bs->full_open_options));
+-        snprintf(bs->filename, sizeof(bs->filename), "json:%s",
+-                 qstring_get_str(json));
++        if (snprintf(bs->filename, sizeof(bs->filename), "json:%s",
++                     qstring_get_str(json)) >= sizeof(bs->filename)) {
++            /* Give user a hint if we truncated things. */
++            strcpy(bs->filename + sizeof(bs->filename) - 4, "...");
++        }
+         qobject_unref(json);
+     }
+ }
+diff --git a/block/nbd.c b/block/nbd.c
+index 3d369fc8eb..eb380102c0 100644
+--- a/block/nbd.c
++++ b/block/nbd.c
+@@ -1971,6 +1971,7 @@ static void nbd_refresh_filename(BlockDriverState *bs)
+ {
+     BDRVNBDState *s = bs->opaque;
+     const char *host = NULL, *port = NULL, *path = NULL;
++    size_t len = 0;
+ 
+     if (s->saddr->type == SOCKET_ADDRESS_TYPE_INET) {
+         const InetSocketAddress *inet = &s->saddr->u.inet;
+@@ -1983,17 +1984,21 @@ static void nbd_refresh_filename(BlockDriverState *bs)
+     } /* else can't represent as pseudo-filename */
+ 
+     if (path && s->export) {
+-        snprintf(bs->exact_filename, sizeof(bs->exact_filename),
+-                 "nbd+unix:///%s?socket=%s", s->export, path);
++        len = snprintf(bs->exact_filename, sizeof(bs->exact_filename),
++                       "nbd+unix:///%s?socket=%s", s->export, path);
+     } else if (path && !s->export) {
+-        snprintf(bs->exact_filename, sizeof(bs->exact_filename),
+-                 "nbd+unix://?socket=%s", path);
++        len = snprintf(bs->exact_filename, sizeof(bs->exact_filename),
++                       "nbd+unix://?socket=%s", path);
+     } else if (host && s->export) {
+-        snprintf(bs->exact_filename, sizeof(bs->exact_filename),
+-                 "nbd://%s:%s/%s", host, port, s->export);
++        len = snprintf(bs->exact_filename, sizeof(bs->exact_filename),
++                       "nbd://%s:%s/%s", host, port, s->export);
+     } else if (host && !s->export) {
+-        snprintf(bs->exact_filename, sizeof(bs->exact_filename),
+-                 "nbd://%s:%s", host, port);
++        len = snprintf(bs->exact_filename, sizeof(bs->exact_filename),
++                       "nbd://%s:%s", host, port);
++    }
++    if (len > sizeof(bs->exact_filename)) {
++        /* Name is too long to represent exactly, so leave it empty. */
++        bs->exact_filename[0] = '\0';
+     }
+ }
+ 
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-block-Fix-VM-size-field-width-in-snapshot-dump.patch b/debian/patches/stable/lp-1891877-block-Fix-VM-size-field-width-in-snapshot-dump.patch
 new file mode 100644
index 0000000..dadc759
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-block-Fix-VM-size-field-width-in-snapshot-dump.patch
@@ -0,0 +1,58 @@
+From 0b487ea66409be1984ed55d3de71000ac363644f Mon Sep 17 00:00:00 2001
+From: Max Reitz <[e-mail]>
+Date: Fri, 17 Jan 2020 11:58:58 +0100
+Subject: [PATCH] block: Fix VM size field width in snapshot dump
+
+When printing the snapshot list (e.g. with qemu-img snapshot -l), the VM
+size field is only seven characters wide.  As of de38b5005e9, this is
+not necessarily sufficient: We generally print three digits, and this
+may require a decimal point.  Also, the unit field grew from something
+as plain as "M" to " MiB".  This means that number and unit may take up
+eight characters in total; but we also want spaces in front.
+
+Considering previously the maximum width was four characters and the
+field width was chosen to be three characters wider, let us adjust the
+field width to be eleven now.
+
+Fixes: de38b5005e946aa3714963ea4c501e279e7d3666
+Buglink: https://bugs.launchpad.net/qemu/+bug/1859989
+Signed-off-by: Max Reitz <[e-mail]>
+Message-Id: <[e-mail]>
+Reviewed-by: Eric Blake <[e-mail]>
+Signed-off-by: Max Reitz <[e-mail]>
+(cherry picked from commit 804359b8b90f76d9d8fbe8d85a6544b68f107f10)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=0b487ea664
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ block/qapi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/block/qapi.c b/block/qapi.c
+index 9a5d0c9b27..ffa539250d 100644
+--- a/block/qapi.c
++++ b/block/qapi.c
+@@ -657,7 +657,7 @@ void bdrv_snapshot_dump(QEMUSnapshotInfo *sn)
+     char *sizing = NULL;
+ 
+     if (!sn) {
+-        qemu_printf("%-10s%-20s%7s%20s%15s",
++        qemu_printf("%-10s%-20s%11s%20s%15s",
+                     "ID", "TAG", "VM SIZE", "DATE", "VM CLOCK");
+     } else {
+         ti = sn->date_sec;
+@@ -672,7 +672,7 @@ void bdrv_snapshot_dump(QEMUSnapshotInfo *sn)
+                  (int)(secs % 60),
+                  (int)((sn->vm_clock_nsec / 1000000) % 1000));
+         sizing = size_to_str(sn->vm_state_size);
+-        qemu_printf("%-10s%-20s%7s%20s%15s",
++        qemu_printf("%-10s%-20s%11s%20s%15s",
+                     sn->id_str, sn->name,
+                     sizing,
+                     date_buf,
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-block-backup-fix-memory-leak-in-bdrv_backup_top_appe.patch b/debian/patches/stable/lp-1891877-block-backup-fix-memory-leak-in-bdrv_backup_top_appe.patch
 new file mode 100644
index 0000000..31648ce
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-block-backup-fix-memory-leak-in-bdrv_backup_top_appe.patch
@@ -0,0 +1,55 @@
+From dc6bdba433246e55c930fad38c1267242fae888c Mon Sep 17 00:00:00 2001
+From: Eiichi Tsukata <[e-mail]>
+Date: Mon, 23 Dec 2019 18:06:32 +0900
+Subject: [PATCH] block/backup: fix memory leak in bdrv_backup_top_append()
+
+bdrv_open_driver() allocates bs->opaque according to drv->instance_size.
+There is no need to allocate it and overwrite opaque in
+bdrv_backup_top_append().
+
+Reproducer:
+
+  $ QTEST_QEMU_BINARY=./x86_64-softmmu/qemu-system-x86_64 valgrind -q --leak-check=full tests/test-replication -p /replication/secondary/start
+  ==29792== 24 bytes in 1 blocks are definitely lost in loss record 52 of 226
+  ==29792==    at 0x483AB1A: calloc (vg_replace_malloc.c:762)
+  ==29792==    by 0x4B07CE0: g_malloc0 (in /usr/lib64/libglib-2.0.so.0.6000.7)
+  ==29792==    by 0x12BAB9: bdrv_open_driver (block.c:1289)
+  ==29792==    by 0x12BEA9: bdrv_new_open_driver (block.c:1359)
+  ==29792==    by 0x1D15CB: bdrv_backup_top_append (backup-top.c:190)
+  ==29792==    by 0x1CC11A: backup_job_create (backup.c:439)
+  ==29792==    by 0x1CD542: replication_start (replication.c:544)
+  ==29792==    by 0x1401B9: replication_start_all (replication.c:52)
+  ==29792==    by 0x128B50: test_secondary_start (test-replication.c:427)
+  ...
+
+Fixes: 7df7868b9640 ("block: introduce backup-top filter driver")
+Signed-off-by: Eiichi Tsukata <[e-mail]>
+Reviewed-by: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Signed-off-by: Kevin Wolf <[e-mail]>
+(cherry picked from commit fb574de81bfdd71fdb0315105a3a7761efb68395)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=dc6bdba433
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ block/backup-top.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/block/backup-top.c b/block/backup-top.c
+index 818d3f26b4..64e9e4f576 100644
+--- a/block/backup-top.c
++++ b/block/backup-top.c
+@@ -196,7 +196,7 @@ BlockDriverState *bdrv_backup_top_append(BlockDriverState *source,
+     }
+ 
+     top->total_sectors = source->total_sectors;
+-    top->opaque = state = g_new0(BDRVBackupTopState, 1);
++    state = top->opaque;
+ 
+     bdrv_ref(target);
+     state->target = bdrv_attach_child(top, target, "target", &child_file, errp);
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-block-bdrv_set_backing_bs-fix-use-after-free.patch b/debian/patches/stable/lp-1891877-block-bdrv_set_backing_bs-fix-use-after-free.patch
 new file mode 100644
index 0000000..4ca9cb9
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-block-bdrv_set_backing_bs-fix-use-after-free.patch
@@ -0,0 +1,122 @@
+From 5ff78dc9bcf2a81f097f1137e58f9a0759347d91 Mon Sep 17 00:00:00 2001
+From: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Date: Mon, 16 Mar 2020 09:06:30 +0300
+Subject: [PATCH] block: bdrv_set_backing_bs: fix use-after-free
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+There is a use-after-free possible: bdrv_unref_child() leaves
+bs->backing freed but not NULL. bdrv_attach_child may produce nested
+polling loop due to drain, than access of freed pointer is possible.
+
+I've produced the following crash on 30 iotest with modified code. It
+does not reproduce on master, but still seems possible:
+
+    #0  __strcmp_avx2 () at /lib64/libc.so.6
+    #1  bdrv_backing_overridden (bs=0x55c9d3cc2060) at block.c:6350
+    #2  bdrv_refresh_filename (bs=0x55c9d3cc2060) at block.c:6404
+    #3  bdrv_backing_attach (c=0x55c9d48e5520) at block.c:1063
+    #4  bdrv_replace_child_noperm
+        (child=child@entry=0x55c9d48e5520,
+        new_bs=new_bs@entry=0x55c9d3cc2060) at block.c:2290
+    #5  bdrv_replace_child
+        (child=child@entry=0x55c9d48e5520,
+        new_bs=new_bs@entry=0x55c9d3cc2060) at block.c:2320
+    #6  bdrv_root_attach_child
+        (child_bs=child_bs@entry=0x55c9d3cc2060,
+        child_name=child_name@entry=0x55c9d241d478 "backing",
+        child_role=child_role@entry=0x55c9d26ecee0 <child_backing>,
+        ctx=<optimized out>, perm=<optimized out>, shared_perm=21,
+        opaque=0x55c9d3c5a3d0, errp=0x7ffd117108e0) at block.c:2424
+    #7  bdrv_attach_child
+        (parent_bs=parent_bs@entry=0x55c9d3c5a3d0,
+        child_bs=child_bs@entry=0x55c9d3cc2060,
+        child_name=child_name@entry=0x55c9d241d478 "backing",
+        child_role=child_role@entry=0x55c9d26ecee0 <child_backing>,
+        errp=errp@entry=0x7ffd117108e0) at block.c:5876
+    #8  in bdrv_set_backing_hd
+        (bs=bs@entry=0x55c9d3c5a3d0,
+        backing_hd=backing_hd@entry=0x55c9d3cc2060,
+        errp=errp@entry=0x7ffd117108e0)
+        at block.c:2576
+    #9  stream_prepare (job=0x55c9d49d84a0) at block/stream.c:150
+    #10 job_prepare (job=0x55c9d49d84a0) at job.c:761
+    #11 job_txn_apply (txn=<optimized out>, fn=<optimized out>) at
+        job.c:145
+    #12 job_do_finalize (job=0x55c9d49d84a0) at job.c:778
+    #13 job_completed_txn_success (job=0x55c9d49d84a0) at job.c:832
+    #14 job_completed (job=0x55c9d49d84a0) at job.c:845
+    #15 job_completed (job=0x55c9d49d84a0) at job.c:836
+    #16 job_exit (opaque=0x55c9d49d84a0) at job.c:864
+    #17 aio_bh_call (bh=0x55c9d471a160) at util/async.c:117
+    #18 aio_bh_poll (ctx=ctx@entry=0x55c9d3c46720) at util/async.c:117
+    #19 aio_poll (ctx=ctx@entry=0x55c9d3c46720,
+        blocking=blocking@entry=true)
+        at util/aio-posix.c:728
+    #20 bdrv_parent_drained_begin_single (poll=true, c=0x55c9d3d558f0)
+        at block/io.c:121
+    #21 bdrv_parent_drained_begin_single (c=c@entry=0x55c9d3d558f0,
+        poll=poll@entry=true)
+        at block/io.c:114
+    #22 bdrv_replace_child_noperm
+        (child=child@entry=0x55c9d3d558f0,
+        new_bs=new_bs@entry=0x55c9d3d27300) at block.c:2258
+    #23 bdrv_replace_child
+        (child=child@entry=0x55c9d3d558f0,
+        new_bs=new_bs@entry=0x55c9d3d27300) at block.c:2320
+    #24 bdrv_root_attach_child
+        (child_bs=child_bs@entry=0x55c9d3d27300,
+        child_name=child_name@entry=0x55c9d241d478 "backing",
+        child_role=child_role@entry=0x55c9d26ecee0 <child_backing>,
+        ctx=<optimized out>, perm=<optimized out>, shared_perm=21,
+        opaque=0x55c9d3cc2060, errp=0x7ffd11710c60) at block.c:2424
+    #25 bdrv_attach_child
+        (parent_bs=parent_bs@entry=0x55c9d3cc2060,
+        child_bs=child_bs@entry=0x55c9d3d27300,
+        child_name=child_name@entry=0x55c9d241d478 "backing",
+        child_role=child_role@entry=0x55c9d26ecee0 <child_backing>,
+        errp=errp@entry=0x7ffd11710c60) at block.c:5876
+    #26 bdrv_set_backing_hd
+        (bs=bs@entry=0x55c9d3cc2060,
+        backing_hd=backing_hd@entry=0x55c9d3d27300,
+        errp=errp@entry=0x7ffd11710c60)
+        at block.c:2576
+    #27 stream_prepare (job=0x55c9d495ead0) at block/stream.c:150
+    ...
+
+Signed-off-by: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Message-Id: <[e-mail]>
+Reviewed-by: Philippe Mathieu-Daudé <[e-mail]>
+Reviewed-by: John Snow <[e-mail]>
+Signed-off-by: Max Reitz <[e-mail]>
+(cherry picked from commit 6e57963a77df1e275a73dab4c6a7ec9a9d3468d4)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=5ff78dc9bc
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ block.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/block.c b/block.c
+index 4916252444..1cb1cd7a37 100644
+--- a/block.c
++++ b/block.c
+@@ -2577,10 +2577,10 @@ void bdrv_set_backing_hd(BlockDriverState *bs, BlockDriverState *backing_hd,
+ 
+     if (bs->backing) {
+         bdrv_unref_child(bs, bs->backing);
++        bs->backing = NULL;
+     }
+ 
+     if (!backing_hd) {
+-        bs->backing = NULL;
+         goto out;
+     }
+ 
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-block-fix-memleaks-in-bdrv_refresh_filename.patch b/debian/patches/stable/lp-1891877-block-fix-memleaks-in-bdrv_refresh_filename.patch
 new file mode 100644
index 0000000..8b916a8
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-block-fix-memleaks-in-bdrv_refresh_filename.patch
@@ -0,0 +1,68 @@
+From a967e75f3a65ccfca3e793e4cb8223449f20a9c5 Mon Sep 17 00:00:00 2001
+From: Pan Nengyuan <[e-mail]>
+Date: Thu, 16 Jan 2020 16:56:00 +0800
+Subject: [PATCH] block: fix memleaks in bdrv_refresh_filename
+
+If we call the qmp 'query-block' while qemu is working on
+'block-commit', it will cause memleaks, the memory leak stack is as
+follow:
+
+Indirect leak of 12360 byte(s) in 3 object(s) allocated from:
+    #0 0x7f80f0b6d970 in __interceptor_calloc (/lib64/libasan.so.5+0xef970)
+    #1 0x7f80ee86049d in g_malloc0 (/lib64/libglib-2.0.so.0+0x5249d)
+    #2 0x55ea95b5bb67 in qdict_new /mnt/sdb/qemu-4.2.0-rc0/qobject/qdict.c:29
+    #3 0x55ea956cd043 in bdrv_refresh_filename /mnt/sdb/qemu-4.2.0-rc0/block.c:6427
+    #4 0x55ea956cc950 in bdrv_refresh_filename /mnt/sdb/qemu-4.2.0-rc0/block.c:6399
+    #5 0x55ea956cc950 in bdrv_refresh_filename /mnt/sdb/qemu-4.2.0-rc0/block.c:6399
+    #6 0x55ea956cc950 in bdrv_refresh_filename /mnt/sdb/qemu-4.2.0-rc0/block.c:6399
+    #7 0x55ea958818ea in bdrv_block_device_info /mnt/sdb/qemu-4.2.0-rc0/block/qapi.c:56
+    #8 0x55ea958879de in bdrv_query_info /mnt/sdb/qemu-4.2.0-rc0/block/qapi.c:392
+    #9 0x55ea9588b58f in qmp_query_block /mnt/sdb/qemu-4.2.0-rc0/block/qapi.c:578
+    #10 0x55ea95567392 in qmp_marshal_query_block qapi/qapi-commands-block-core.c:95
+
+Indirect leak of 4120 byte(s) in 1 object(s) allocated from:
+    #0 0x7f80f0b6d970 in __interceptor_calloc (/lib64/libasan.so.5+0xef970)
+    #1 0x7f80ee86049d in g_malloc0 (/lib64/libglib-2.0.so.0+0x5249d)
+    #2 0x55ea95b5bb67 in qdict_new /mnt/sdb/qemu-4.2.0-rc0/qobject/qdict.c:29
+    #3 0x55ea956cd043 in bdrv_refresh_filename /mnt/sdb/qemu-4.2.0-rc0/block.c:6427
+    #4 0x55ea956cc950 in bdrv_refresh_filename /mnt/sdb/qemu-4.2.0-rc0/block.c:6399
+    #5 0x55ea956cc950 in bdrv_refresh_filename /mnt/sdb/qemu-4.2.0-rc0/block.c:6399
+    #6 0x55ea9569f301 in bdrv_backing_attach /mnt/sdb/qemu-4.2.0-rc0/block.c:1064
+    #7 0x55ea956a99dd in bdrv_replace_child_noperm /mnt/sdb/qemu-4.2.0-rc0/block.c:2283
+    #8 0x55ea956b9b53 in bdrv_replace_node /mnt/sdb/qemu-4.2.0-rc0/block.c:4196
+    #9 0x55ea956b9e49 in bdrv_append /mnt/sdb/qemu-4.2.0-rc0/block.c:4236
+    #10 0x55ea958c3472 in commit_start /mnt/sdb/qemu-4.2.0-rc0/block/commit.c:306
+    #11 0x55ea94b68ab0 in qmp_block_commit /mnt/sdb/qemu-4.2.0-rc0/blockdev.c:3459
+    #12 0x55ea9556a7a7 in qmp_marshal_block_commit qapi/qapi-commands-block-core.c:407
+
+Fixes: bb808d5f5c0978828a974d547e6032402c339555
+Reported-by: Euler Robot <[e-mail]>
+Signed-off-by: Pan Nengyuan <[e-mail]>
+Message-id: [e-mail]
+Signed-off-by: Max Reitz <[e-mail]>
+(cherry picked from commit cb8956144ccaccf23d5cc4167677e2c84fa5a9f8)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=a967e75f3a
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ block.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/block.c b/block.c
+index 863cf34d45..4916252444 100644
+--- a/block.c
++++ b/block.c
+@@ -6426,6 +6426,7 @@ void bdrv_refresh_filename(BlockDriverState *bs)
+                 child->bs->exact_filename);
+         pstrcpy(bs->filename, sizeof(bs->filename), child->bs->filename);
+ 
++        qobject_unref(bs->full_open_options);
+         bs->full_open_options = qobject_ref(child->bs->full_open_options);
+ 
+         return;
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-compat-disable-edid-on-correct-virtio-gpu-device.patch b/debian/patches/stable/lp-1891877-compat-disable-edid-on-correct-virtio-gpu-device.patch
 new file mode 100644
index 0000000..2e76b86
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-compat-disable-edid-on-correct-virtio-gpu-device.patch
@@ -0,0 +1,49 @@
+From 219362f9655859056e8f15cf96fc3169d4dc80de Mon Sep 17 00:00:00 2001
+From: Cornelia Huck <[e-mail]>
+Date: Wed, 18 Mar 2020 10:39:19 +0100
+Subject: [PATCH] compat: disable edid on correct virtio-gpu device
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Commit bb15791166c1 ("compat: disable edid on virtio-gpu base
+device") tried to disable 'edid' on the virtio-gpu base device.
+However, that device is not 'virtio-gpu', but 'virtio-gpu-device'.
+Fix it.
+
+Fixes: bb15791166c1 ("compat: disable edid on virtio-gpu base device")
+Reported-by: Lukáš Doktor <[e-mail]>
+Tested-by: Lukáš Doktor <[e-mail]>
+Reviewed-by: Philippe Mathieu-Daudé <[e-mail]>
+Signed-off-by: Cornelia Huck <[e-mail]>
+Message-id: [e-mail]
+Cc: [e-mail]
+Signed-off-by: Cornelia Huck <[e-mail]>
+Signed-off-by: Gerd Hoffmann <[e-mail]>
+(cherry picked from commit 02501fc39381c4dabaf6becdd12c2a4754c3847c)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=219362f965
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ hw/core/machine.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/hw/core/machine.c b/hw/core/machine.c
+index aa63231f31..1872263bf0 100644
+--- a/hw/core/machine.c
++++ b/hw/core/machine.c
+@@ -37,7 +37,7 @@ GlobalProperty hw_compat_4_0[] = {
+     { "secondary-vga",  "edid", "false" },
+     { "bochs-display",  "edid", "false" },
+     { "virtio-vga",     "edid", "false" },
+-    { "virtio-gpu",     "edid", "false" },
++    { "virtio-gpu-device", "edid", "false" },
+     { "virtio-device", "use-started", "false" },
+     { "virtio-balloon-device", "qemu-4-0-config-size", "true" },
+     { "pl031", "migrate-tick-offset", "false" },
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-display-bochs-display-fix-memory-leak.patch b/debian/patches/stable/lp-1891877-display-bochs-display-fix-memory-leak.patch
 new file mode 100644
index 0000000..6196cbc
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-display-bochs-display-fix-memory-leak.patch
@@ -0,0 +1,42 @@
+From 7e1bc51f3f606e758b2600555ddc99f643a3697d Mon Sep 17 00:00:00 2001
+From: Cameron Esfahani <[e-mail]>
+Date: Tue, 10 Dec 2019 13:27:54 -0800
+Subject: [PATCH] display/bochs-display: fix memory leak
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Fix memory leak in bochs_display_update().  Leaks 304 bytes per frame.
+
+Fixes: 33ebad54056
+Signed-off-by: Cameron Esfahani <[e-mail]>
+Message-Id: <[e-mail]>
+Reviewed-by: Philippe Mathieu-Daudé <[e-mail]>
+Signed-off-by: Gerd Hoffmann <[e-mail]>
+(cherry picked from commit 0d82411d0e38a0de7829f97d04406765c8d2210d)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=7e1bc51f3f
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ hw/display/bochs-display.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/hw/display/bochs-display.c b/hw/display/bochs-display.c
+index dc1bd1641d..215db9a231 100644
+--- a/hw/display/bochs-display.c
++++ b/hw/display/bochs-display.c
+@@ -252,6 +252,8 @@ static void bochs_display_update(void *opaque)
+             dpy_gfx_update(s->con, 0, ys,
+                            mode.width, y - ys);
+         }
++
++        g_free(snap);
+     }
+ }
+ 
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-dp8393x-Always-update-RRA-pointers-and-sequence-numb.patch b/debian/patches/stable/lp-1891877-dp8393x-Always-update-RRA-pointers-and-sequence-numb.patch
 new file mode 100644
index 0000000..3d85936
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-dp8393x-Always-update-RRA-pointers-and-sequence-numb.patch
@@ -0,0 +1,52 @@
+From 1190026fe415ce29605bdadbb68956a3315714e8 Mon Sep 17 00:00:00 2001
+From: Finn Thain <[e-mail]>
+Date: Wed, 29 Jan 2020 20:27:49 +1100
+Subject: [PATCH] dp8393x: Always update RRA pointers and sequence numbers
+
+These operations need to take place regardless of whether or not
+rx descriptors have been used up (that is, EOL flag was observed).
+
+The algorithm is now the same for a packet that was withheld as for
+a packet that was not.
+
+Signed-off-by: Finn Thain <[e-mail]>
+Tested-by: Laurent Vivier <[e-mail]>
+Signed-off-by: Jason Wang <[e-mail]>
+(cherry picked from commit 80b60673ea598869050c66d95d8339480e4cefd0)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=1190026fe4
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ hw/net/dp8393x.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c
+index 4ce2ef818b..aa7bd785f3 100644
+--- a/hw/net/dp8393x.c
++++ b/hw/net/dp8393x.c
+@@ -897,12 +897,14 @@ static ssize_t dp8393x_receive(NetClientState *nc, const uint8_t * buf,
+         /* Move to next descriptor */
+         s->regs[SONIC_CRDA] = s->regs[SONIC_LLFA];
+         s->regs[SONIC_ISR] |= SONIC_ISR_PKTRX;
+-        s->regs[SONIC_RSC] = (s->regs[SONIC_RSC] & 0xff00) | (((s->regs[SONIC_RSC] & 0x00ff) + 1) & 0x00ff);
++    }
+ 
+-        if (s->regs[SONIC_RCR] & SONIC_RCR_LPKT) {
+-            /* Read next RRA */
+-            dp8393x_do_read_rra(s);
+-        }
++    s->regs[SONIC_RSC] = (s->regs[SONIC_RSC] & 0xff00) |
++                         ((s->regs[SONIC_RSC] + 1) & 0x00ff);
++
++    if (s->regs[SONIC_RCR] & SONIC_RCR_LPKT) {
++        /* Read next RRA */
++        dp8393x_do_read_rra(s);
+     }
+ 
+     /* Done */
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-dp8393x-Always-use-32-bit-accesses.patch b/debian/patches/stable/lp-1891877-dp8393x-Always-use-32-bit-accesses.patch
 new file mode 100644
index 0000000..ff2540a
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-dp8393x-Always-use-32-bit-accesses.patch
@@ -0,0 +1,167 @@
+From 956e1b2d977f8743d58c97994c27d6c848ae3b7d Mon Sep 17 00:00:00 2001
+From: Finn Thain <[e-mail]>
+Date: Wed, 29 Jan 2020 20:27:49 +1100
+Subject: [PATCH] dp8393x: Always use 32-bit accesses
+
+The DP83932 and DP83934 have 32 data lines. The datasheet says,
+
+    Data Bus: These bidirectional lines are used to transfer data on the
+    system bus. When the SONIC is a bus master, 16-bit data is transferred
+    on D15-D0 and 32-bit data is transferred on D31-D0. When the SONIC is
+    accessed as a slave, register data is driven onto lines D15-D0.
+    D31-D16 are held TRI-STATE if SONIC is in 16-bit mode. If SONIC is in
+    32-bit mode, they are driven, but invalid.
+
+Always use 32-bit accesses both as bus master and bus slave.
+
+Force the MSW to zero in bus master mode.
+
+This gets the Linux 'jazzsonic' driver working, and avoids the need for
+prior hacks to make the NetBSD 'sn' driver work.
+
+Signed-off-by: Finn Thain <[e-mail]>
+Tested-by: Laurent Vivier <[e-mail]>
+Signed-off-by: Jason Wang <[e-mail]>
+(cherry picked from commit 3fe9a838ec3eae1374ced16b63bf56894b2ffbe6)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=956e1b2d97
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ hw/net/dp8393x.c | 47 +++++++++++++++++++++++++++++------------------
+ 1 file changed, 29 insertions(+), 18 deletions(-)
+
+diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c
+index 7ca6a6dd46..49c304ee20 100644
+--- a/hw/net/dp8393x.c
++++ b/hw/net/dp8393x.c
+@@ -246,9 +246,19 @@ static void dp8393x_put(dp8393xState *s, int width, int offset,
+                         uint16_t val)
+ {
+     if (s->big_endian) {
+-        s->data[offset * width + width - 1] = cpu_to_be16(val);
++        if (width == 2) {
++            s->data[offset * 2] = 0;
++            s->data[offset * 2 + 1] = cpu_to_be16(val);
++        } else {
++            s->data[offset] = cpu_to_be16(val);
++        }
+     } else {
+-        s->data[offset * width] = cpu_to_le16(val);
++        if (width == 2) {
++            s->data[offset * 2] = cpu_to_le16(val);
++            s->data[offset * 2 + 1] = 0;
++        } else {
++            s->data[offset] = cpu_to_le16(val);
++        }
+     }
+ }
+ 
+@@ -588,7 +598,7 @@ static uint64_t dp8393x_read(void *opaque, hwaddr addr, unsigned int size)
+ 
+     DPRINTF("read 0x%04x from reg %s\n", val, reg_names[reg]);
+ 
+-    return val;
++    return s->big_endian ? val << 16 : val;
+ }
+ 
+ static void dp8393x_write(void *opaque, hwaddr addr, uint64_t data,
+@@ -596,13 +606,14 @@ static void dp8393x_write(void *opaque, hwaddr addr, uint64_t data,
+ {
+     dp8393xState *s = opaque;
+     int reg = addr >> s->it_shift;
++    uint32_t val = s->big_endian ? data >> 16 : data;
+ 
+-    DPRINTF("write 0x%04x to reg %s\n", (uint16_t)data, reg_names[reg]);
++    DPRINTF("write 0x%04x to reg %s\n", (uint16_t)val, reg_names[reg]);
+ 
+     switch (reg) {
+         /* Command register */
+         case SONIC_CR:
+-            dp8393x_do_command(s, data);
++            dp8393x_do_command(s, val);
+             break;
+         /* Prevent write to read-only registers */
+         case SONIC_CAP2:
+@@ -615,36 +626,36 @@ static void dp8393x_write(void *opaque, hwaddr addr, uint64_t data,
+         /* Accept write to some registers only when in reset mode */
+         case SONIC_DCR:
+             if (s->regs[SONIC_CR] & SONIC_CR_RST) {
+-                s->regs[reg] = data & 0xbfff;
++                s->regs[reg] = val & 0xbfff;
+             } else {
+                 DPRINTF("writing to DCR invalid\n");
+             }
+             break;
+         case SONIC_DCR2:
+             if (s->regs[SONIC_CR] & SONIC_CR_RST) {
+-                s->regs[reg] = data & 0xf017;
++                s->regs[reg] = val & 0xf017;
+             } else {
+                 DPRINTF("writing to DCR2 invalid\n");
+             }
+             break;
+         /* 12 lower bytes are Read Only */
+         case SONIC_TCR:
+-            s->regs[reg] = data & 0xf000;
++            s->regs[reg] = val & 0xf000;
+             break;
+         /* 9 lower bytes are Read Only */
+         case SONIC_RCR:
+-            s->regs[reg] = data & 0xffe0;
++            s->regs[reg] = val & 0xffe0;
+             break;
+         /* Ignore most significant bit */
+         case SONIC_IMR:
+-            s->regs[reg] = data & 0x7fff;
++            s->regs[reg] = val & 0x7fff;
+             dp8393x_update_irq(s);
+             break;
+         /* Clear bits by writing 1 to them */
+         case SONIC_ISR:
+-            data &= s->regs[reg];
+-            s->regs[reg] &= ~data;
+-            if (data & SONIC_ISR_RBE) {
++            val &= s->regs[reg];
++            s->regs[reg] &= ~val;
++            if (val & SONIC_ISR_RBE) {
+                 dp8393x_do_read_rra(s);
+             }
+             dp8393x_update_irq(s);
+@@ -657,17 +668,17 @@ static void dp8393x_write(void *opaque, hwaddr addr, uint64_t data,
+         case SONIC_REA:
+         case SONIC_RRP:
+         case SONIC_RWP:
+-            s->regs[reg] = data & 0xfffe;
++            s->regs[reg] = val & 0xfffe;
+             break;
+         /* Invert written value for some registers */
+         case SONIC_CRCT:
+         case SONIC_FAET:
+         case SONIC_MPT:
+-            s->regs[reg] = data ^ 0xffff;
++            s->regs[reg] = val ^ 0xffff;
+             break;
+         /* All other registers have no special contrainst */
+         default:
+-            s->regs[reg] = data;
++            s->regs[reg] = val;
+     }
+ 
+     if (reg == SONIC_WT0 || reg == SONIC_WT1) {
+@@ -678,8 +689,8 @@ static void dp8393x_write(void *opaque, hwaddr addr, uint64_t data,
+ static const MemoryRegionOps dp8393x_ops = {
+     .read = dp8393x_read,
+     .write = dp8393x_write,
+-    .impl.min_access_size = 2,
+-    .impl.max_access_size = 2,
++    .impl.min_access_size = 4,
++    .impl.max_access_size = 4,
+     .endianness = DEVICE_NATIVE_ENDIAN,
+ };
+ 
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-dp8393x-Clean-up-endianness-hacks.patch b/debian/patches/stable/lp-1891877-dp8393x-Clean-up-endianness-hacks.patch
 new file mode 100644
index 0000000..8d4a682
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-dp8393x-Clean-up-endianness-hacks.patch
@@ -0,0 +1,71 @@
+From bf3f12ac8c34e4856f48c5f7ee7d23c042097797 Mon Sep 17 00:00:00 2001
+From: Finn Thain <[e-mail]>
+Date: Wed, 29 Jan 2020 20:27:49 +1100
+Subject: [PATCH] dp8393x: Clean up endianness hacks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+According to the datasheet, section 3.4.4, "in 32-bit mode ... the SONIC
+always writes long words".
+
+Therefore, use the same technique for the 'in_use' field that is used
+everywhere else, and write the full long word.
+
+Signed-off-by: Finn Thain <[e-mail]>
+Tested-by: Laurent Vivier <[e-mail]>
+Reviewed-by: Philippe Mathieu-Daudé <[e-mail]>
+Signed-off-by: Jason Wang <[e-mail]>
+(cherry picked from commit 46ffee9ad43185cbee4182c208bbd534814086ca)
+ Conflicts:
+	hw/net/dp8393x.c
+*roll in local dependencies on b7cbebf2b9d
+*drop functional dep. on 19f70347731
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=bf3f12ac8c
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ hw/net/dp8393x.c | 17 ++++++-----------
+ 1 file changed, 6 insertions(+), 11 deletions(-)
+
+diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c
+index 49c304ee20..f89f4c7ba3 100644
+--- a/hw/net/dp8393x.c
++++ b/hw/net/dp8393x.c
+@@ -776,8 +776,6 @@ static ssize_t dp8393x_receive(NetClientState *nc, const uint8_t * buf,
+         return -1;
+     }
+ 
+-    /* XXX: Check byte ordering */
+-
+     /* Check for EOL */
+     if (s->regs[SONIC_LLFA] & SONIC_DESC_EOL) {
+         /* Are we still in resource exhaustion? */
+@@ -847,15 +845,12 @@ static ssize_t dp8393x_receive(NetClientState *nc, const uint8_t * buf,
+         /* EOL detected */
+         s->regs[SONIC_ISR] |= SONIC_ISR_RDE;
+     } else {
+-        /* Clear in_use, but it is always 16bit wide */
+-        int offset = dp8393x_crda(s) + sizeof(uint16_t) * 6 * width;
+-        if (s->big_endian && width == 2) {
+-            /* we need to adjust the offset of the 16bit field */
+-            offset += sizeof(uint16_t);
+-        }
+-        s->data[0] = 0;
+-        address_space_rw(&s->as, offset, MEMTXATTRS_UNSPECIFIED,
+-                         (uint8_t *)s->data, sizeof(uint16_t), 1);
++        /* Clear in_use */
++        size = sizeof(uint16_t) * width;
++        address = dp8393x_crda(s) + sizeof(uint16_t) * 6 * width;
++        dp8393x_put(s, width, 0, 0);
++        address_space_rw(&s->as, address, MEMTXATTRS_UNSPECIFIED,
++                         (uint8_t *)s->data, size, true);
+         s->regs[SONIC_CRDA] = s->regs[SONIC_LLFA];
+         s->regs[SONIC_ISR] |= SONIC_ISR_PKTRX;
+         s->regs[SONIC_RSC] = (s->regs[SONIC_RSC] & 0xff00) | (((s->regs[SONIC_RSC] & 0x00ff) + 1) & 0x00ff);
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-dp8393x-Clear-RRRA-command-register-bit-only-when-ap.patch b/debian/patches/stable/lp-1891877-dp8393x-Clear-RRRA-command-register-bit-only-when-ap.patch
 new file mode 100644
index 0000000..017873d
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-dp8393x-Clear-RRRA-command-register-bit-only-when-ap.patch
@@ -0,0 +1,56 @@
+From 5f08c382caee86109585111b240c36371738b00d Mon Sep 17 00:00:00 2001
+From: Finn Thain <[e-mail]>
+Date: Wed, 29 Jan 2020 20:27:49 +1100
+Subject: [PATCH] dp8393x: Clear RRRA command register bit only when
+ appropriate
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+It doesn't make sense to clear the command register bit unless the
+command was actually issued.
+
+Signed-off-by: Finn Thain <[e-mail]>
+Reviewed-by: Philippe Mathieu-Daudé <[e-mail]>
+Tested-by: Laurent Vivier <[e-mail]>
+Signed-off-by: Jason Wang <[e-mail]>
+(cherry picked from commit a3cce2825a0b12bb717a5106daaca245557cc9ae)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=5f08c382ca
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ hw/net/dp8393x.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c
+index 8dd6bf032c..04f58ee4e1 100644
+--- a/hw/net/dp8393x.c
++++ b/hw/net/dp8393x.c
+@@ -352,9 +352,6 @@ static void dp8393x_do_read_rra(dp8393xState *s)
+         s->regs[SONIC_ISR] |= SONIC_ISR_RBE;
+         dp8393x_update_irq(s);
+     }
+-
+-    /* Done */
+-    s->regs[SONIC_CR] &= ~SONIC_CR_RRRA;
+ }
+ 
+ static void dp8393x_do_software_reset(dp8393xState *s)
+@@ -563,8 +560,10 @@ static void dp8393x_do_command(dp8393xState *s, uint16_t command)
+         dp8393x_do_start_timer(s);
+     if (command & SONIC_CR_RST)
+         dp8393x_do_software_reset(s);
+-    if (command & SONIC_CR_RRRA)
++    if (command & SONIC_CR_RRRA) {
+         dp8393x_do_read_rra(s);
++        s->regs[SONIC_CR] &= ~SONIC_CR_RRRA;
++    }
+     if (command & SONIC_CR_LCAM)
+         dp8393x_do_load_cam(s);
+ }
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-dp8393x-Clear-descriptor-in_use-field-to-release-pac.patch b/debian/patches/stable/lp-1891877-dp8393x-Clear-descriptor-in_use-field-to-release-pac.patch
 new file mode 100644
index 0000000..2227684
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-dp8393x-Clear-descriptor-in_use-field-to-release-pac.patch
@@ -0,0 +1,55 @@
+From 8d61b1e2c4e2ad8310ca957decf26b0b82d37148 Mon Sep 17 00:00:00 2001
+From: Finn Thain <[e-mail]>
+Date: Wed, 29 Jan 2020 20:27:49 +1100
+Subject: [PATCH] dp8393x: Clear descriptor in_use field to release packet
+
+When the SONIC receives a packet into the last available descriptor, it
+retains ownership of that descriptor for as long as necessary.
+
+Section 3.4.7 of the datasheet says,
+
+    When the system appends more descriptors, the SONIC releases ownership
+    of the descriptor after writing 0000h to the RXpkt.in_use field.
+
+The packet can now be processed by the host, so raise a PKTRX interrupt,
+just like the normal case.
+
+Signed-off-by: Finn Thain <[e-mail]>
+Tested-by: Laurent Vivier <[e-mail]>
+Signed-off-by: Jason Wang <[e-mail]>
+(cherry picked from commit d9fae13196a31716f45dcddcdd958fbb8e59b35a)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=8d61b1e2c4
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ hw/net/dp8393x.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c
+index 0e9061d831..4ce2ef818b 100644
+--- a/hw/net/dp8393x.c
++++ b/hw/net/dp8393x.c
+@@ -809,7 +809,17 @@ static ssize_t dp8393x_receive(NetClientState *nc, const uint8_t * buf,
+             return -1;
+         }
+         /* Link has been updated by host */
++
++        /* Clear in_use */
++        size = sizeof(uint16_t) * width;
++        address = dp8393x_crda(s) + sizeof(uint16_t) * 6 * width;
++        dp8393x_put(s, width, 0, 0);
++        address_space_rw(&s->as, address, MEMTXATTRS_UNSPECIFIED,
++                         (uint8_t *)s->data, size, 1);
++
++        /* Move to next descriptor */
+         s->regs[SONIC_CRDA] = s->regs[SONIC_LLFA];
++        s->regs[SONIC_ISR] |= SONIC_ISR_PKTRX;
+     }
+ 
+     /* Save current position */
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-dp8393x-Don-t-clobber-packet-checksum.patch b/debian/patches/stable/lp-1891877-dp8393x-Don-t-clobber-packet-checksum.patch
 new file mode 100644
index 0000000..4682953
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-dp8393x-Don-t-clobber-packet-checksum.patch
@@ -0,0 +1,45 @@
+From d50aa8acbc6f4bd83d0d0b5958d49ac6baf254a5 Mon Sep 17 00:00:00 2001
+From: Finn Thain <[e-mail]>
+Date: Wed, 29 Jan 2020 20:27:49 +1100
+Subject: [PATCH] dp8393x: Don't clobber packet checksum
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+A received packet consumes pkt_size bytes in the buffer and the frame
+checksum that's appended to it consumes another 4 bytes. The Receive
+Buffer Address register takes the former quantity into account but
+not the latter. So the next packet written to the buffer overwrites
+the frame checksum. Fix this.
+
+Signed-off-by: Finn Thain <[e-mail]>
+Reviewed-by: Philippe Mathieu-Daudé <[e-mail]>
+Tested-by: Laurent Vivier <[e-mail]>
+Signed-off-by: Jason Wang <[e-mail]>
+(cherry picked from commit bae112b80c9c42cea21ee7623c283668c3451c2e)
+*drop context dep. on 19f70347731
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=d50aa8acbc
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ hw/net/dp8393x.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c
+index ca8088c839..315b4ad844 100644
+--- a/hw/net/dp8393x.c
++++ b/hw/net/dp8393x.c
+@@ -816,6 +816,7 @@ static ssize_t dp8393x_receive(NetClientState *nc, const uint8_t * buf,
+     address += rx_len;
+     address_space_rw(&s->as, address,
+         MEMTXATTRS_UNSPECIFIED, (uint8_t *)&checksum, 4, 1);
++    address += 4;
+     rx_len += 4;
+     s->regs[SONIC_CRBA1] = address >> 16;
+     s->regs[SONIC_CRBA0] = address & 0xffff;
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-dp8393x-Don-t-reset-Silicon-Revision-register.patch b/debian/patches/stable/lp-1891877-dp8393x-Don-t-reset-Silicon-Revision-register.patch
 new file mode 100644
index 0000000..71593d3
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-dp8393x-Don-t-reset-Silicon-Revision-register.patch
@@ -0,0 +1,51 @@
+From 735cd8ddab7d2e8b3cb693295067d2c8a9098f86 Mon Sep 17 00:00:00 2001
+From: Finn Thain <[e-mail]>
+Date: Wed, 29 Jan 2020 20:27:49 +1100
+Subject: [PATCH] dp8393x: Don't reset Silicon Revision register
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The jazzsonic driver in Linux uses the Silicon Revision register value
+to probe the chip. The driver fails unless the SR register contains 4.
+Unfortunately, reading this register in QEMU usually returns 0 because
+the s->regs[] array gets wiped after a software reset.
+
+Fixes: bd8f1ebce4 ("net/dp8393x: fix hardware reset")
+Suggested-by: Philippe Mathieu-Daudé <[e-mail]>
+Signed-off-by: Finn Thain <[e-mail]>
+Signed-off-by: Jason Wang <[e-mail]>
+(cherry picked from commit 083e21bbdde7dbd326baf29d21f49fc3f5614496)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=735cd8ddab
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ hw/net/dp8393x.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c
+index aa7bd785f3..d33f21bd0b 100644
+--- a/hw/net/dp8393x.c
++++ b/hw/net/dp8393x.c
+@@ -919,6 +919,7 @@ static void dp8393x_reset(DeviceState *dev)
+     timer_del(s->watchdog);
+ 
+     memset(s->regs, 0, sizeof(s->regs));
++    s->regs[SONIC_SR] = 0x0004; /* only revision recognized by Linux/mips */
+     s->regs[SONIC_CR] = SONIC_CR_RST | SONIC_CR_STP | SONIC_CR_RXDIS;
+     s->regs[SONIC_DCR] &= ~(SONIC_DCR_EXBUS | SONIC_DCR_LBR);
+     s->regs[SONIC_RCR] &= ~(SONIC_RCR_LB0 | SONIC_RCR_LB1 | SONIC_RCR_BRD | SONIC_RCR_RNT);
+@@ -971,7 +972,6 @@ static void dp8393x_realize(DeviceState *dev, Error **errp)
+     qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
+ 
+     s->watchdog = timer_new_ns(QEMU_CLOCK_VIRTUAL, dp8393x_watchdog, s);
+-    s->regs[SONIC_SR] = 0x0004; /* only revision recognized by Linux */
+ 
+     memory_region_init_ram(&s->prom, OBJECT(dev),
+                            "dp8393x-prom", SONIC_PROM_SIZE, &local_err);
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-dp8393x-Don-t-stop-reception-upon-RBE-interrupt-asse.patch b/debian/patches/stable/lp-1891877-dp8393x-Don-t-stop-reception-upon-RBE-interrupt-asse.patch
 new file mode 100644
index 0000000..40495e4
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-dp8393x-Don-t-stop-reception-upon-RBE-interrupt-asse.patch
@@ -0,0 +1,137 @@
+From 3e1d95301e8c00d8a8a2ec03ed941f019c8fd2b3 Mon Sep 17 00:00:00 2001
+From: Finn Thain <[e-mail]>
+Date: Wed, 29 Jan 2020 20:27:49 +1100
+Subject: [PATCH] dp8393x: Don't stop reception upon RBE interrupt assertion
+
+Section 3.4.7 of the datasheet explains that,
+
+    The RBE bit in the Interrupt Status register is set when the
+    SONIC finishes using the second to last receive buffer and reads
+    the last RRA descriptor. Actually, the SONIC is not truly out of
+    resources, but gives the system an early warning of an impending
+    out of resources condition.
+
+RBE does not mean actual receive buffer exhaustion, and reception should
+not be stopped. This is important because Linux will not check and clear
+the RBE interrupt until it receives another packet. But that won't
+happen if can_receive returns false. This bug causes the SONIC to become
+deaf (until reset).
+
+Fix this with a new flag to indicate actual receive buffer exhaustion.
+
+Signed-off-by: Finn Thain <[e-mail]>
+Tested-by: Laurent Vivier <[e-mail]>
+Signed-off-by: Jason Wang <[e-mail]>
+(cherry picked from commit c2279bd0a19b35057f2e4c3b4df9a915717d1142)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=3e1d95301e
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ hw/net/dp8393x.c | 35 ++++++++++++++++++++++-------------
+ 1 file changed, 22 insertions(+), 13 deletions(-)
+
+diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c
+index d33f21bd0b..44f77c5d3c 100644
+--- a/hw/net/dp8393x.c
++++ b/hw/net/dp8393x.c
+@@ -158,6 +158,7 @@ typedef struct dp8393xState {
+     /* Hardware */
+     uint8_t it_shift;
+     bool big_endian;
++    bool last_rba_is_full;
+     qemu_irq irq;
+ #ifdef DEBUG_SONIC
+     int irq_level;
+@@ -347,12 +348,15 @@ static void dp8393x_do_read_rra(dp8393xState *s)
+         s->regs[SONIC_RRP] = s->regs[SONIC_RSA];
+     }
+ 
+-    /* Check resource exhaustion */
++    /* Warn the host if CRBA now has the last available resource */
+     if (s->regs[SONIC_RRP] == s->regs[SONIC_RWP])
+     {
+         s->regs[SONIC_ISR] |= SONIC_ISR_RBE;
+         dp8393x_update_irq(s);
+     }
++
++    /* Allow packet reception */
++    s->last_rba_is_full = false;
+ }
+ 
+ static void dp8393x_do_software_reset(dp8393xState *s)
+@@ -659,9 +663,6 @@ static void dp8393x_write(void *opaque, hwaddr addr, uint64_t data,
+                 dp8393x_do_read_rra(s);
+             }
+             dp8393x_update_irq(s);
+-            if (dp8393x_can_receive(s->nic->ncs)) {
+-                qemu_flush_queued_packets(qemu_get_queue(s->nic));
+-            }
+             break;
+         /* The guest is required to store aligned pointers here */
+         case SONIC_RSA:
+@@ -721,8 +722,6 @@ static int dp8393x_can_receive(NetClientState *nc)
+ 
+     if (!(s->regs[SONIC_CR] & SONIC_CR_RXEN))
+         return 0;
+-    if (s->regs[SONIC_ISR] & SONIC_ISR_RBE)
+-        return 0;
+     return 1;
+ }
+ 
+@@ -773,6 +772,10 @@ static ssize_t dp8393x_receive(NetClientState *nc, const uint8_t * buf,
+     s->regs[SONIC_RCR] &= ~(SONIC_RCR_PRX | SONIC_RCR_LBK | SONIC_RCR_FAER |
+         SONIC_RCR_CRCR | SONIC_RCR_LPKT | SONIC_RCR_BC | SONIC_RCR_MC);
+ 
++    if (s->last_rba_is_full) {
++        return pkt_size;
++    }
++
+     rx_len = pkt_size + sizeof(checksum);
+     if (s->regs[SONIC_DCR] & SONIC_DCR_DW) {
+         width = 2;
+@@ -786,8 +789,8 @@ static ssize_t dp8393x_receive(NetClientState *nc, const uint8_t * buf,
+         DPRINTF("oversize packet, pkt_size is %d\n", pkt_size);
+         s->regs[SONIC_ISR] |= SONIC_ISR_RBAE;
+         dp8393x_update_irq(s);
+-        dp8393x_do_read_rra(s);
+-        return pkt_size;
++        s->regs[SONIC_RCR] |= SONIC_RCR_LPKT;
++        goto done;
+     }
+ 
+     packet_type = dp8393x_receive_filter(s, buf, pkt_size);
+@@ -899,17 +902,23 @@ static ssize_t dp8393x_receive(NetClientState *nc, const uint8_t * buf,
+         s->regs[SONIC_ISR] |= SONIC_ISR_PKTRX;
+     }
+ 
++    dp8393x_update_irq(s);
++
+     s->regs[SONIC_RSC] = (s->regs[SONIC_RSC] & 0xff00) |
+                          ((s->regs[SONIC_RSC] + 1) & 0x00ff);
+ 
++done:
++
+     if (s->regs[SONIC_RCR] & SONIC_RCR_LPKT) {
+-        /* Read next RRA */
+-        dp8393x_do_read_rra(s);
++        if (s->regs[SONIC_RRP] == s->regs[SONIC_RWP]) {
++            /* Stop packet reception */
++            s->last_rba_is_full = true;
++        } else {
++            /* Read next resource */
++            dp8393x_do_read_rra(s);
++        }
+     }
+ 
+-    /* Done */
+-    dp8393x_update_irq(s);
+-
+     return pkt_size;
+ }
+ 
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-dp8393x-Have-dp8393x_receive-return-the-packet-size.patch b/debian/patches/stable/lp-1891877-dp8393x-Have-dp8393x_receive-return-the-packet-size.patch
 new file mode 100644
index 0000000..8a4e085
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-dp8393x-Have-dp8393x_receive-return-the-packet-size.patch
@@ -0,0 +1,68 @@
+From 153c3320e77cfcafc5a44d01d6fb7905121a8fd7 Mon Sep 17 00:00:00 2001
+From: Finn Thain <[e-mail]>
+Date: Wed, 29 Jan 2020 20:27:49 +1100
+Subject: [PATCH] dp8393x: Have dp8393x_receive() return the packet size
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This function re-uses its 'size' argument as a scratch variable.
+Instead, declare a local 'size' variable for that purpose so that the
+function result doesn't get messed up.
+
+Signed-off-by: Finn Thain <[e-mail]>
+Reviewed-by: Philippe Mathieu-Daudé <[e-mail]>
+Tested-by: Laurent Vivier <[e-mail]>
+Signed-off-by: Jason Wang <[e-mail]>
+(cherry picked from commit 9e3cd456d85ad45e72bdba99203302342ce29b3b)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=153c3320e7
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ hw/net/dp8393x.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c
+index f89f4c7ba3..a696485a55 100644
+--- a/hw/net/dp8393x.c
++++ b/hw/net/dp8393x.c
+@@ -757,20 +757,21 @@ static int dp8393x_receive_filter(dp8393xState *s, const uint8_t * buf,
+ }
+ 
+ static ssize_t dp8393x_receive(NetClientState *nc, const uint8_t * buf,
+-                               size_t size)
++                               size_t pkt_size)
+ {
+     dp8393xState *s = qemu_get_nic_opaque(nc);
+     int packet_type;
+     uint32_t available, address;
+-    int width, rx_len = size;
++    int width, rx_len = pkt_size;
+     uint32_t checksum;
++    int size;
+ 
+     width = (s->regs[SONIC_DCR] & SONIC_DCR_DW) ? 2 : 1;
+ 
+     s->regs[SONIC_RCR] &= ~(SONIC_RCR_PRX | SONIC_RCR_LBK | SONIC_RCR_FAER |
+         SONIC_RCR_CRCR | SONIC_RCR_LPKT | SONIC_RCR_BC | SONIC_RCR_MC);
+ 
+-    packet_type = dp8393x_receive_filter(s, buf, size);
++    packet_type = dp8393x_receive_filter(s, buf, pkt_size);
+     if (packet_type < 0) {
+         DPRINTF("packet not for netcard\n");
+         return -1;
+@@ -864,7 +865,7 @@ static ssize_t dp8393x_receive(NetClientState *nc, const uint8_t * buf,
+     /* Done */
+     dp8393x_update_irq(s);
+ 
+-    return size;
++    return pkt_size;
+ }
+ 
+ static void dp8393x_reset(DeviceState *dev)
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-dp8393x-Implement-packet-size-limit-and-RBAE-interru.patch b/debian/patches/stable/lp-1891877-dp8393x-Implement-packet-size-limit-and-RBAE-interru.patch
 new file mode 100644
index 0000000..fcdb4ca
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-dp8393x-Implement-packet-size-limit-and-RBAE-interru.patch
@@ -0,0 +1,57 @@
+From 3a8068f4ebb9f9500cf3d1805f5cfbd42e15ab12 Mon Sep 17 00:00:00 2001
+From: Finn Thain <[e-mail]>
+Date: Wed, 29 Jan 2020 20:27:49 +1100
+Subject: [PATCH] dp8393x: Implement packet size limit and RBAE interrupt
+
+Add a bounds check to prevent a large packet from causing a buffer
+overflow. This is defensive programming -- I haven't actually tried
+sending an oversized packet or a jumbo ethernet frame.
+
+The SONIC handles packets that are too big for the buffer by raising
+the RBAE interrupt and dropping them. Linux uses that interrupt to
+count dropped packets.
+
+Signed-off-by: Finn Thain <[e-mail]>
+Tested-by: Laurent Vivier <[e-mail]>
+Signed-off-by: Jason Wang <[e-mail]>
+(cherry picked from commit ada74315270d1dcabf4c9d4fece19df7ef5b9577)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=3a8068f4eb
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ hw/net/dp8393x.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c
+index 04f58ee4e1..ca8088c839 100644
+--- a/hw/net/dp8393x.c
++++ b/hw/net/dp8393x.c
+@@ -137,6 +137,7 @@ do { printf("sonic ERROR: %s: " fmt, __func__ , ## __VA_ARGS__); } while (0)
+ #define SONIC_TCR_CRCI   0x2000
+ #define SONIC_TCR_PINT   0x8000
+ 
++#define SONIC_ISR_RBAE   0x0010
+ #define SONIC_ISR_RBE    0x0020
+ #define SONIC_ISR_RDE    0x0040
+ #define SONIC_ISR_TC     0x0080
+@@ -770,6 +771,14 @@ static ssize_t dp8393x_receive(NetClientState *nc, const uint8_t * buf,
+     s->regs[SONIC_RCR] &= ~(SONIC_RCR_PRX | SONIC_RCR_LBK | SONIC_RCR_FAER |
+         SONIC_RCR_CRCR | SONIC_RCR_LPKT | SONIC_RCR_BC | SONIC_RCR_MC);
+ 
++    if (pkt_size + 4 > dp8393x_rbwc(s) * 2) {
++        DPRINTF("oversize packet, pkt_size is %d\n", pkt_size);
++        s->regs[SONIC_ISR] |= SONIC_ISR_RBAE;
++        dp8393x_update_irq(s);
++        dp8393x_do_read_rra(s);
++        return pkt_size;
++    }
++
+     packet_type = dp8393x_receive_filter(s, buf, pkt_size);
+     if (packet_type < 0) {
+         DPRINTF("packet not for netcard\n");
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-dp8393x-Mask-EOL-bit-from-descriptor-addresses.patch b/debian/patches/stable/lp-1891877-dp8393x-Mask-EOL-bit-from-descriptor-addresses.patch
 new file mode 100644
index 0000000..9514b07
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-dp8393x-Mask-EOL-bit-from-descriptor-addresses.patch
@@ -0,0 +1,98 @@
+From eb54a2f9cee10cf1c7832a3536a8d5980ec313e9 Mon Sep 17 00:00:00 2001
+From: Finn Thain <[e-mail]>
+Date: Mon, 20 Jan 2020 09:59:21 +1100
+Subject: [PATCH] dp8393x: Mask EOL bit from descriptor addresses
+
+The Least Significant bit of a descriptor address register is used as
+an EOL flag. It has to be masked when the register value is to be used
+as an actual address for copying memory around. But when the registers
+are to be updated the EOL bit should not be masked.
+
+Signed-off-by: Finn Thain <[e-mail]>
+Tested-by: Laurent Vivier <[e-mail]>
+Signed-off-by: Jason Wang <[e-mail]>
+(cherry picked from commit 88f632fbb1b3d31d5b6978d28f8735a6ed18b8f5)
+ Conflicts:
+	hw/net/dp8393x.c
+*drop context dep. on 19f70347731
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=eb54a2f9ce
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ hw/net/dp8393x.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c
+index 3d991af163..7ca6a6dd46 100644
+--- a/hw/net/dp8393x.c
++++ b/hw/net/dp8393x.c
+@@ -145,6 +145,9 @@ do { printf("sonic ERROR: %s: " fmt, __func__ , ## __VA_ARGS__); } while (0)
+ #define SONIC_ISR_PINT   0x0800
+ #define SONIC_ISR_LCD    0x1000
+ 
++#define SONIC_DESC_EOL   0x0001
++#define SONIC_DESC_ADDR  0xFFFE
++
+ #define TYPE_DP8393X "dp8393x"
+ #define DP8393X(obj) OBJECT_CHECK(dp8393xState, (obj), TYPE_DP8393X)
+ 
+@@ -197,7 +200,8 @@ static uint32_t dp8393x_crba(dp8393xState *s)
+ 
+ static uint32_t dp8393x_crda(dp8393xState *s)
+ {
+-    return (s->regs[SONIC_URDA] << 16) | s->regs[SONIC_CRDA];
++    return (s->regs[SONIC_URDA] << 16) |
++           (s->regs[SONIC_CRDA] & SONIC_DESC_ADDR);
+ }
+ 
+ static uint32_t dp8393x_rbwc(dp8393xState *s)
+@@ -217,7 +221,8 @@ static uint32_t dp8393x_tsa(dp8393xState *s)
+ 
+ static uint32_t dp8393x_ttda(dp8393xState *s)
+ {
+-    return (s->regs[SONIC_UTDA] << 16) | s->regs[SONIC_TTDA];
++    return (s->regs[SONIC_UTDA] << 16) |
++           (s->regs[SONIC_TTDA] & SONIC_DESC_ADDR);
+ }
+ 
+ static uint32_t dp8393x_wt(dp8393xState *s)
+@@ -507,7 +512,7 @@ static void dp8393x_do_transmit_packets(dp8393xState *s)
+                              (4 + 3 * s->regs[SONIC_TFC]) * width,
+                 MEMTXATTRS_UNSPECIFIED, (uint8_t *)s->data, size, 0);
+             s->regs[SONIC_CTDA] = dp8393x_get(s, width, 0) & ~0x1;
+-            if (dp8393x_get(s, width, 0) & 0x1) {
++            if (dp8393x_get(s, width, 0) & SONIC_DESC_EOL) {
+                 /* EOL detected */
+                 break;
+             }
+@@ -763,13 +768,13 @@ static ssize_t dp8393x_receive(NetClientState *nc, const uint8_t * buf,
+     /* XXX: Check byte ordering */
+ 
+     /* Check for EOL */
+-    if (s->regs[SONIC_LLFA] & 0x1) {
++    if (s->regs[SONIC_LLFA] & SONIC_DESC_EOL) {
+         /* Are we still in resource exhaustion? */
+         size = sizeof(uint16_t) * 1 * width;
+         address = dp8393x_crda(s) + sizeof(uint16_t) * 5 * width;
+         address_space_rw(&s->as, address, MEMTXATTRS_UNSPECIFIED,
+                          (uint8_t *)s->data, size, 0);
+-        if (dp8393x_get(s, width, 0) & 0x1) {
++        if (dp8393x_get(s, width, 0) & SONIC_DESC_EOL) {
+             /* Still EOL ; stop reception */
+             return -1;
+         } else {
+@@ -827,7 +832,7 @@ static ssize_t dp8393x_receive(NetClientState *nc, const uint8_t * buf,
+     address_space_rw(&s->as, dp8393x_crda(s) + sizeof(uint16_t) * 5 * width,
+         MEMTXATTRS_UNSPECIFIED, (uint8_t *)s->data, size, 0);
+     s->regs[SONIC_LLFA] = dp8393x_get(s, width, 0);
+-    if (s->regs[SONIC_LLFA] & 0x1) {
++    if (s->regs[SONIC_LLFA] & SONIC_DESC_EOL) {
+         /* EOL detected */
+         s->regs[SONIC_ISR] |= SONIC_ISR_RDE;
+     } else {
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-dp8393x-Pad-frames-to-word-or-long-word-boundary.patch b/debian/patches/stable/lp-1891877-dp8393x-Pad-frames-to-word-or-long-word-boundary.patch
 new file mode 100644
index 0000000..9eea6ff
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-dp8393x-Pad-frames-to-word-or-long-word-boundary.patch
@@ -0,0 +1,113 @@
+From cbc8277051f76f8131f5d4c787862a16a5fa1707 Mon Sep 17 00:00:00 2001
+From: Finn Thain <[e-mail]>
+Date: Wed, 29 Jan 2020 20:27:49 +1100
+Subject: [PATCH] dp8393x: Pad frames to word or long word boundary
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The existing code has a bug where the Remaining Buffer Word Count (RBWC)
+is calculated with a truncating division, which gives the wrong result
+for odd-sized packets.
+
+Section 1.4.1 of the datasheet says,
+
+    Once the end of the packet has been reached, the serializer will
+    fill out the last word (16-bit mode) or long word (32-bit mode)
+    if the last byte did not end on a word or long word boundary
+    respectively. The fill byte will be 0FFh.
+
+Implement buffer padding so that buffer limits are correctly enforced.
+
+Signed-off-by: Finn Thain <[e-mail]>
+Tested-by: Laurent Vivier <[e-mail]>
+Reviewed-by: Philippe Mathieu-Daudé <[e-mail]>
+Signed-off-by: Jason Wang <[e-mail]>
+(cherry picked from commit 350e7d9a77d3b9ac74d240e4b232db1ebe5c05bc)
+*drop context dependencies from b7cbebf2b9d, 1ccda935d4f, and
+ 19f70347731
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=cbc8277051
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ hw/net/dp8393x.c | 39 ++++++++++++++++++++++++++++-----------
+ 1 file changed, 28 insertions(+), 11 deletions(-)
+
+diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c
+index 40e3a029b6..0e9061d831 100644
+--- a/hw/net/dp8393x.c
++++ b/hw/net/dp8393x.c
+@@ -766,16 +766,23 @@ static ssize_t dp8393x_receive(NetClientState *nc, const uint8_t * buf,
+     dp8393xState *s = qemu_get_nic_opaque(nc);
+     int packet_type;
+     uint32_t available, address;
+-    int width, rx_len = pkt_size;
++    int width, rx_len, padded_len;
+     uint32_t checksum;
+     int size;
+ 
+-    width = (s->regs[SONIC_DCR] & SONIC_DCR_DW) ? 2 : 1;
+-
+     s->regs[SONIC_RCR] &= ~(SONIC_RCR_PRX | SONIC_RCR_LBK | SONIC_RCR_FAER |
+         SONIC_RCR_CRCR | SONIC_RCR_LPKT | SONIC_RCR_BC | SONIC_RCR_MC);
+ 
+-    if (pkt_size + 4 > dp8393x_rbwc(s) * 2) {
++    rx_len = pkt_size + sizeof(checksum);
++    if (s->regs[SONIC_DCR] & SONIC_DCR_DW) {
++        width = 2;
++        padded_len = ((rx_len - 1) | 3) + 1;
++    } else {
++        width = 1;
++        padded_len = ((rx_len - 1) | 1) + 1;
++    }
++
++    if (padded_len > dp8393x_rbwc(s) * 2) {
+         DPRINTF("oversize packet, pkt_size is %d\n", pkt_size);
+         s->regs[SONIC_ISR] |= SONIC_ISR_RBAE;
+         dp8393x_update_irq(s);
+@@ -810,22 +817,32 @@ static ssize_t dp8393x_receive(NetClientState *nc, const uint8_t * buf,
+     s->regs[SONIC_TRBA0] = s->regs[SONIC_CRBA0];
+ 
+     /* Calculate the ethernet checksum */
+-    checksum = cpu_to_le32(crc32(0, buf, rx_len));
++    checksum = cpu_to_le32(crc32(0, buf, pkt_size));
+ 
+     /* Put packet into RBA */
+     DPRINTF("Receive packet at %08x\n", dp8393x_crba(s));
+     address = dp8393x_crba(s);
+     address_space_rw(&s->as, address,
+-        MEMTXATTRS_UNSPECIFIED, (uint8_t *)buf, rx_len, 1);
+-    address += rx_len;
++        MEMTXATTRS_UNSPECIFIED, (uint8_t *)buf, pkt_size, 1);
++    address += pkt_size;
++
++    /* Put frame checksum into RBA */
+     address_space_rw(&s->as, address,
+-        MEMTXATTRS_UNSPECIFIED, (uint8_t *)&checksum, 4, 1);
+-    address += 4;
+-    rx_len += 4;
++        MEMTXATTRS_UNSPECIFIED, (uint8_t *)&checksum, sizeof(checksum), 1);
++    address += sizeof(checksum);
++
++    /* Pad short packets to keep pointers aligned */
++    if (rx_len < padded_len) {
++        size = padded_len - rx_len;
++        address_space_rw(&s->as, address, MEMTXATTRS_UNSPECIFIED,
++            (uint8_t *)"\xFF\xFF\xFF", size, 1);
++        address += size;
++    }
++
+     s->regs[SONIC_CRBA1] = address >> 16;
+     s->regs[SONIC_CRBA0] = address & 0xffff;
+     available = dp8393x_rbwc(s);
+-    available -= rx_len / 2;
++    available -= padded_len >> 1;
+     s->regs[SONIC_RBWC1] = available >> 16;
+     s->regs[SONIC_RBWC0] = available & 0xffff;
+ 
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-dp8393x-Update-LLFA-and-CRDA-registers-from-rx-descr.patch b/debian/patches/stable/lp-1891877-dp8393x-Update-LLFA-and-CRDA-registers-from-rx-descr.patch
 new file mode 100644
index 0000000..d150124
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-dp8393x-Update-LLFA-and-CRDA-registers-from-rx-descr.patch
@@ -0,0 +1,75 @@
+From edd67a61f499982bcc2098962c8e04c5210f2f80 Mon Sep 17 00:00:00 2001
+From: Finn Thain <[e-mail]>
+Date: Wed, 29 Jan 2020 20:27:49 +1100
+Subject: [PATCH] dp8393x: Update LLFA and CRDA registers from rx descriptor
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Follow the algorithm given in the National Semiconductor DP83932C
+datasheet in section 3.4.7:
+
+    At the next reception, the SONIC re-reads the last RXpkt.link field,
+    and updates its CRDA register to point to the next descriptor.
+
+The chip is designed to allow the host to provide a new list of
+descriptors in this way.
+
+Signed-off-by: Finn Thain <[e-mail]>
+Tested-by: Laurent Vivier <[e-mail]>
+Reviewed-by: Philippe Mathieu-Daudé <[e-mail]>
+Signed-off-by: Jason Wang <[e-mail]>
+(cherry picked from commit 5b0c98fcb7ac006bd8efe0e0fecba52c43a9d028)
+*drop context dep on 19f70347731
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=edd67a61f4
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ hw/net/dp8393x.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c
+index a696485a55..8dd6bf032c 100644
+--- a/hw/net/dp8393x.c
++++ b/hw/net/dp8393x.c
+@@ -784,12 +784,13 @@ static ssize_t dp8393x_receive(NetClientState *nc, const uint8_t * buf,
+         address = dp8393x_crda(s) + sizeof(uint16_t) * 5 * width;
+         address_space_rw(&s->as, address, MEMTXATTRS_UNSPECIFIED,
+                          (uint8_t *)s->data, size, 0);
+-        if (dp8393x_get(s, width, 0) & SONIC_DESC_EOL) {
++        s->regs[SONIC_LLFA] = dp8393x_get(s, width, 0);
++        if (s->regs[SONIC_LLFA] & SONIC_DESC_EOL) {
+             /* Still EOL ; stop reception */
+             return -1;
+-        } else {
+-            s->regs[SONIC_CRDA] = s->regs[SONIC_LLFA];
+         }
++        /* Link has been updated by host */
++        s->regs[SONIC_CRDA] = s->regs[SONIC_LLFA];
+     }
+ 
+     /* Save current position */
+@@ -837,7 +838,7 @@ static ssize_t dp8393x_receive(NetClientState *nc, const uint8_t * buf,
+     address_space_rw(&s->as, dp8393x_crda(s),
+         MEMTXATTRS_UNSPECIFIED, (uint8_t *)s->data, size, 1);
+ 
+-    /* Move to next descriptor */
++    /* Check link field */
+     size = sizeof(uint16_t) * width;
+     address_space_rw(&s->as, dp8393x_crda(s) + sizeof(uint16_t) * 5 * width,
+         MEMTXATTRS_UNSPECIFIED, (uint8_t *)s->data, size, 0);
+@@ -852,6 +853,8 @@ static ssize_t dp8393x_receive(NetClientState *nc, const uint8_t * buf,
+         dp8393x_put(s, width, 0, 0);
+         address_space_rw(&s->as, address, MEMTXATTRS_UNSPECIFIED,
+                          (uint8_t *)s->data, size, true);
++
++        /* Move to next descriptor */
+         s->regs[SONIC_CRDA] = s->regs[SONIC_LLFA];
+         s->regs[SONIC_ISR] |= SONIC_ISR_PKTRX;
+         s->regs[SONIC_RSC] = (s->regs[SONIC_RSC] & 0xff00) | (((s->regs[SONIC_RSC] & 0x00ff) + 1) & 0x00ff);
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-dp8393x-Use-long-word-aligned-RRA-pointers-in-32-bit.patch b/debian/patches/stable/lp-1891877-dp8393x-Use-long-word-aligned-RRA-pointers-in-32-bit.patch
 new file mode 100644
index 0000000..6026297
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-dp8393x-Use-long-word-aligned-RRA-pointers-in-32-bit.patch
@@ -0,0 +1,60 @@
+From e7cad754fd0bf00c671a1509acc2981f11736ee8 Mon Sep 17 00:00:00 2001
+From: Finn Thain <[e-mail]>
+Date: Wed, 29 Jan 2020 20:27:49 +1100
+Subject: [PATCH] dp8393x: Use long-word-aligned RRA pointers in 32-bit mode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Section 3.4.1 of the datasheet says,
+
+    The alignment of the RRA is confined to either word or long word
+    boundaries, depending upon the data width mode. In 16-bit mode,
+    the RRA must be aligned to a word boundary (A0 is always zero)
+    and in 32-bit mode, the RRA is aligned to a long word boundary
+    (A0 and A1 are always zero).
+
+This constraint has been implemented for 16-bit mode; implement it
+for 32-bit mode too.
+
+Signed-off-by: Finn Thain <[e-mail]>
+Tested-by: Laurent Vivier <[e-mail]>
+Reviewed-by: Philippe Mathieu-Daudé <[e-mail]>
+Signed-off-by: Jason Wang <[e-mail]>
+(cherry picked from commit ea2270279bc2e1635cb6e909e22e17e630198773)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=e7cad754fd
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ hw/net/dp8393x.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c
+index 315b4ad844..40e3a029b6 100644
+--- a/hw/net/dp8393x.c
++++ b/hw/net/dp8393x.c
+@@ -663,12 +663,16 @@ static void dp8393x_write(void *opaque, hwaddr addr, uint64_t data,
+                 qemu_flush_queued_packets(qemu_get_queue(s->nic));
+             }
+             break;
+-        /* Ignore least significant bit */
++        /* The guest is required to store aligned pointers here */
+         case SONIC_RSA:
+         case SONIC_REA:
+         case SONIC_RRP:
+         case SONIC_RWP:
+-            s->regs[reg] = val & 0xfffe;
++            if (s->regs[SONIC_DCR] & SONIC_DCR_DW) {
++                s->regs[reg] = val & 0xfffc;
++            } else {
++                s->regs[reg] = val & 0xfffe;
++            }
+             break;
+         /* Invert written value for some registers */
+         case SONIC_CRCT:
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-dump-Fix-writing-of-ELF-section.patch b/debian/patches/stable/lp-1891877-dump-Fix-writing-of-ELF-section.patch
 new file mode 100644
index 0000000..41bf056
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-dump-Fix-writing-of-ELF-section.patch
@@ -0,0 +1,51 @@
+From 25fcaed9a366314c21793e14624c89db75224b50 Mon Sep 17 00:00:00 2001
+From: Peter Maydell <[e-mail]>
+Date: Tue, 24 Mar 2020 17:36:30 +0000
+Subject: [PATCH] dump: Fix writing of ELF section
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+In write_elf_section() we set the 'shdr' pointer to point to local
+structures shdr32 or shdr64, which we fill in to be written out to
+the ELF dump.  Unfortunately the address we pass to fd_write_vmcore()
+has a spurious '&' operator, so instead of writing out the section
+header we write out the literal pointer value followed by whatever is
+on the stack after the 'shdr' local variable.
+
+Pass the correct address into fd_write_vmcore().
+
+Spotted by Coverity: CID 1421970.
+
+Cc: [e-mail]
+Signed-off-by: Peter Maydell <[e-mail]>
+Reviewed-by: Marc-André Lureau <[e-mail]>
+Reviewed-by: Philippe Mathieu-Daudé <[e-mail]>
+Message-id: [e-mail]
+(cherry picked from commit 174d2d6856bf435f4f58e9303ba30dd0e1279d3f)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=25fcaed9a3
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ dump/dump.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/dump/dump.c b/dump/dump.c
+index 6fb6e1245a..22ed1d3b0d 100644
+--- a/dump/dump.c
++++ b/dump/dump.c
+@@ -364,7 +364,7 @@ static void write_elf_section(DumpState *s, int type, Error **errp)
+         shdr = &shdr64;
+     }
+ 
+-    ret = fd_write_vmcore(&shdr, shdr_size, s);
++    ret = fd_write_vmcore(shdr, shdr_size, s);
+     if (ret < 0) {
+         error_setg_errno(errp, -ret,
+                          "dump: failed to write section header table");
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-hmp-vnc-Fix-info-vnc-list-leak.patch b/debian/patches/stable/lp-1891877-hmp-vnc-Fix-info-vnc-list-leak.patch
 new file mode 100644
index 0000000..1193bf2
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-hmp-vnc-Fix-info-vnc-list-leak.patch
@@ -0,0 +1,54 @@
+From 674d3822250a8830fb8e9720ce499f2e8cef6a88 Mon Sep 17 00:00:00 2001
+From: "Dr. David Alan Gilbert" <[e-mail]>
+Date: Mon, 23 Mar 2020 12:08:22 +0000
+Subject: [PATCH] hmp/vnc: Fix info vnc list leak
+
+We're iterating the list, and then freeing the iteration pointer rather
+than the list head.
+
+Fixes: 0a9667ecdb6d ("hmp: Update info vnc")
+Reported-by: Coverity (CID 1421932)
+Signed-off-by: Dr. David Alan Gilbert <[e-mail]>
+Message-Id: <[e-mail]>
+Reviewed-by: Peter Maydell <[e-mail]>
+Signed-off-by: Dr. David Alan Gilbert <[e-mail]>
+(cherry picked from commit d4ff109373ce871928c7e9ef648973eba642b484)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=674d382225
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ monitor/hmp-cmds.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
+index b2551c16d1..2fdc84ec99 100644
+--- a/monitor/hmp-cmds.c
++++ b/monitor/hmp-cmds.c
+@@ -729,10 +729,11 @@ static void hmp_info_vnc_servers(Monitor *mon, VncServerInfo2List *server)
+ 
+ void hmp_info_vnc(Monitor *mon, const QDict *qdict)
+ {
+-    VncInfo2List *info2l;
++    VncInfo2List *info2l, *info2l_head;
+     Error *err = NULL;
+ 
+     info2l = qmp_query_vnc_servers(&err);
++    info2l_head = info2l;
+     if (err) {
+         hmp_handle_error(mon, &err);
+         return;
+@@ -761,7 +762,7 @@ void hmp_info_vnc(Monitor *mon, const QDict *qdict)
+         info2l = info2l->next;
+     }
+ 
+-    qapi_free_VncInfo2List(info2l);
++    qapi_free_VncInfo2List(info2l_head);
+ 
+ }
+ #endif
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-hostmem-don-t-use-mbind-if-host-nodes-is-empty.patch b/debian/patches/stable/lp-1891877-hostmem-don-t-use-mbind-if-host-nodes-is-empty.patch
 new file mode 100644
index 0000000..27298fa
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-hostmem-don-t-use-mbind-if-host-nodes-is-empty.patch
@@ -0,0 +1,61 @@
+From 34c78a4100c967cc385fcfd4c2295b2b0ebd8786 Mon Sep 17 00:00:00 2001
+From: Igor Mammedov <[e-mail]>
+Date: Thu, 30 Apr 2020 11:46:06 -0400
+Subject: [PATCH] hostmem: don't use mbind() if host-nodes is empty
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Since 5.0 QEMU uses hostmem backend for allocating main guest RAM.
+The backend however calls mbind() which is typically NOP
+in case of default policy/absent host-nodes bitmap.
+However when runing in container with black-listed mbind()
+syscall, QEMU fails to start with error
+ "cannot bind memory to host NUMA nodes: Operation not permitted"
+even when user hasn't provided host-nodes to pin to explictly
+(which is the case with -m option)
+
+To fix issue, call mbind() only in case when user has provided
+host-nodes explicitly (i.e. host_nodes bitmap is not empty).
+That should allow to run QEMU in containers with black-listed
+mbind() without memory pinning. If QEMU provided memory-pinning
+is required user still has to white-list mbind() in container
+configuration.
+
+Reported-by: Manuel Hohmann <[e-mail]>
+Signed-off-by: Igor Mammedov <[e-mail]>
+Message-Id: <[e-mail]>
+Tested-by: Philippe Mathieu-Daudé <[e-mail]>
+Cc: [e-mail]
+Signed-off-by: Eduardo Habkost <[e-mail]>
+(cherry picked from commit 70b6d525dfb51d5e523d568d1139fc051bc223c5)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=34c78a4100
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ backends/hostmem.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/backends/hostmem.c b/backends/hostmem.c
+index e773bdfa6e..21b1993e49 100644
+--- a/backends/hostmem.c
++++ b/backends/hostmem.c
+@@ -363,8 +363,10 @@ host_memory_backend_memory_complete(UserCreatable *uc, Error **errp)
+         assert(sizeof(backend->host_nodes) >=
+                BITS_TO_LONGS(MAX_NODES + 1) * sizeof(unsigned long));
+         assert(maxnode <= MAX_NODES);
+-        if (mbind(ptr, sz, backend->policy,
+-                  maxnode ? backend->host_nodes : NULL, maxnode + 1, flags)) {
++
++        if (maxnode &&
++            mbind(ptr, sz, backend->policy, backend->host_nodes, maxnode + 1,
++                  flags)) {
+             if (backend->policy != MPOL_DEFAULT || errno != ENOSYS) {
+                 error_setg_errno(errp, errno,
+                                  "cannot bind memory to host NUMA nodes");
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-hw-arm-cubieboard-use-ARM-Cortex-A8-as-the-default-C.patch b/debian/patches/stable/lp-1891877-hw-arm-cubieboard-use-ARM-Cortex-A8-as-the-default-C.patch
 new file mode 100644
index 0000000..7690bd7
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-hw-arm-cubieboard-use-ARM-Cortex-A8-as-the-default-C.patch
@@ -0,0 +1,59 @@
+From 9dd68ac26b5a413dc948efe9bbf414702bc200da Mon Sep 17 00:00:00 2001
+From: Niek Linnenbank <[e-mail]>
+Date: Thu, 5 Mar 2020 16:09:19 +0000
+Subject: [PATCH] hw/arm/cubieboard: use ARM Cortex-A8 as the default CPU in
+ machine definition
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The Cubieboard is a singleboard computer with an Allwinner A10 System-on-Chip [1].
+As documented in the Allwinner A10 User Manual V1.5 [2], the SoC has an ARM
+Cortex-A8 processor. Currently the Cubieboard machine definition specifies the
+ARM Cortex-A9 in its description and as the default CPU.
+
+This patch corrects the Cubieboard machine definition to use the ARM Cortex-A8.
+
+The only user-visible effect is that our textual description of the
+machine was wrong, because hw/arm/allwinner-a10.c always creates a
+Cortex-A8 CPU regardless of the default value in the MachineClass struct.
+
+ [1] http://docs.cubieboard.org/products/start#cubieboard1
+ [2] https://linux-sunxi.org/File:Allwinner_A10_User_manual_V1.5.pdf
+
+Fixes: 8a863c8120994981a099
+Signed-off-by: Niek Linnenbank <[e-mail]>
+Message-id: [e-mail]
+Reviewed-by: Philippe Mathieu-Daudé <[e-mail]>
+Reviewed-by: Peter Maydell <[e-mail]>
+[note in commit message that the bug didn't have much visible effect]
+Signed-off-by: Peter Maydell <[e-mail]>
+(cherry picked from commit 2104df2a1fbf44b2564427aa72fd58d66ce290a7)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=9dd68ac26b
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ hw/arm/cubieboard.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/hw/arm/cubieboard.c b/hw/arm/cubieboard.c
+index 6dc2f1d6b6..d8e8919e79 100644
+--- a/hw/arm/cubieboard.c
++++ b/hw/arm/cubieboard.c
+@@ -78,8 +78,8 @@ static void cubieboard_init(MachineState *machine)
+ 
+ static void cubieboard_machine_init(MachineClass *mc)
+ {
+-    mc->desc = "cubietech cubieboard (Cortex-A9)";
+-    mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a9");
++    mc->desc = "cubietech cubieboard (Cortex-A8)";
++    mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a8");
+     mc->init = cubieboard_init;
+     mc->block_default_type = IF_IDE;
+     mc->units_per_default_bus = 1;
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-hw-arm-smmuv3-Align-stream-table-base-address-to-tab.patch b/debian/patches/stable/lp-1891877-hw-arm-smmuv3-Align-stream-table-base-address-to-tab.patch
 new file mode 100644
index 0000000..eb50555
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-hw-arm-smmuv3-Align-stream-table-base-address-to-tab.patch
@@ -0,0 +1,83 @@
+From 65fad28d85f137edd895ac90a83b42bb36aad481 Mon Sep 17 00:00:00 2001
+From: Simon Veith <[e-mail]>
+Date: Fri, 20 Dec 2019 14:03:00 +0000
+Subject: [PATCH] hw/arm/smmuv3: Align stream table base address to table size
+
+Per the specification, and as observed in hardware, the SMMUv3 aligns
+the SMMU_STRTAB_BASE address to the size of the table by masking out the
+respective least significant bits in the ADDR field.
+
+Apply this masking logic to our smmu_find_ste() lookup function per the
+specification.
+
+ref. ARM IHI 0070C, section 6.3.23.
+
+Signed-off-by: Simon Veith <[e-mail]>
+Acked-by: Eric Auger <[e-mail]>
+Tested-by: Eric Auger <[e-mail]>
+Message-id: [e-mail]
+Cc: Eric Auger <[e-mail]>
+Cc: [e-mail]
+Cc: [e-mail]
+Reviewed-by: Peter Maydell <[e-mail]>
+Signed-off-by: Peter Maydell <[e-mail]>
+(cherry picked from commit 41678c33aac61261522b74f08595ccf2221a430a)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=65fad28d85
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ hw/arm/smmuv3.c | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
+index 727558bcfa..31ac3ca32e 100644
+--- a/hw/arm/smmuv3.c
++++ b/hw/arm/smmuv3.c
+@@ -376,8 +376,9 @@ bad_ste:
+ static int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste,
+                          SMMUEventInfo *event)
+ {
+-    dma_addr_t addr;
++    dma_addr_t addr, strtab_base;
+     uint32_t log2size;
++    int strtab_size_shift;
+     int ret;
+ 
+     trace_smmuv3_find_ste(sid, s->features, s->sid_split);
+@@ -391,10 +392,16 @@ static int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste,
+     }
+     if (s->features & SMMU_FEATURE_2LVL_STE) {
+         int l1_ste_offset, l2_ste_offset, max_l2_ste, span;
+-        dma_addr_t strtab_base, l1ptr, l2ptr;
++        dma_addr_t l1ptr, l2ptr;
+         STEDesc l1std;
+ 
+-        strtab_base = s->strtab_base & SMMU_BASE_ADDR_MASK;
++        /*
++         * Align strtab base address to table size. For this purpose, assume it
++         * is not bounded by SMMU_IDR1_SIDSIZE.
++         */
++        strtab_size_shift = MAX(5, (int)log2size - s->sid_split - 1 + 3);
++        strtab_base = s->strtab_base & SMMU_BASE_ADDR_MASK &
++                      ~MAKE_64BIT_MASK(0, strtab_size_shift);
+         l1_ste_offset = sid >> s->sid_split;
+         l2_ste_offset = sid & ((1 << s->sid_split) - 1);
+         l1ptr = (dma_addr_t)(strtab_base + l1_ste_offset * sizeof(l1std));
+@@ -433,7 +440,10 @@ static int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste,
+         }
+         addr = l2ptr + l2_ste_offset * sizeof(*ste);
+     } else {
+-        addr = (s->strtab_base & SMMU_BASE_ADDR_MASK) + sid * sizeof(*ste);
++        strtab_size_shift = log2size + 5;
++        strtab_base = s->strtab_base & SMMU_BASE_ADDR_MASK &
++                      ~MAKE_64BIT_MASK(0, strtab_size_shift);
++        addr = strtab_base + sid * sizeof(*ste);
+     }
+ 
+     if (smmu_get_ste(s, addr, ste, event)) {
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-hw-arm-smmuv3-Apply-address-mask-to-linear-strtab-ba.patch b/debian/patches/stable/lp-1891877-hw-arm-smmuv3-Apply-address-mask-to-linear-strtab-ba.patch
 new file mode 100644
index 0000000..c88cb54
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-hw-arm-smmuv3-Apply-address-mask-to-linear-strtab-ba.patch
@@ -0,0 +1,59 @@
+From e8ae3a4e2bb72ae636ecbf201b0f74d4bf7d5aeb Mon Sep 17 00:00:00 2001
+From: Simon Veith <[e-mail]>
+Date: Fri, 20 Dec 2019 14:03:00 +0000
+Subject: [PATCH] hw/arm/smmuv3: Apply address mask to linear strtab base
+ address
+
+In the SMMU_STRTAB_BASE register, the stream table base address only
+occupies bits [51:6]. Other bits, such as RA (bit [62]), must be masked
+out to obtain the base address.
+
+The branch for 2-level stream tables correctly applies this mask by way
+of SMMU_BASE_ADDR_MASK, but the one for linear stream tables does not.
+
+Apply the missing mask in that case as well so that the correct stream
+base address is used by guests which configure a linear stream table.
+
+Linux guests are unaffected by this change because they choose a 2-level
+stream table layout for the QEMU SMMUv3, based on the size of its stream
+ID space.
+
+ref. ARM IHI 0070C, section 6.3.23.
+
+Signed-off-by: Simon Veith <[e-mail]>
+Acked-by: Eric Auger <[e-mail]>
+Tested-by: Eric Auger <[e-mail]>
+Message-id: [e-mail]
+Cc: Eric Auger <[e-mail]>
+Cc: [e-mail]
+Cc: [e-mail]
+Acked-by: Eric Auger <[e-mail]>
+Reviewed-by: Peter Maydell <[e-mail]>
+Signed-off-by: Peter Maydell <[e-mail]>
+(cherry picked from commit 3d44c60500785f18bb469c9de0aeba7415c0f28f)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=e8ae3a4e2b
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ hw/arm/smmuv3.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
+index e2fbb8357e..eef9a18d70 100644
+--- a/hw/arm/smmuv3.c
++++ b/hw/arm/smmuv3.c
+@@ -429,7 +429,7 @@ static int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste,
+         }
+         addr = l2ptr + l2_ste_offset * sizeof(*ste);
+     } else {
+-        addr = s->strtab_base + sid * sizeof(*ste);
++        addr = (s->strtab_base & SMMU_BASE_ADDR_MASK) + sid * sizeof(*ste);
+     }
+ 
+     if (smmu_get_ste(s, addr, ste, event)) {
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-hw-arm-smmuv3-Check-stream-IDs-against-actual-table-.patch b/debian/patches/stable/lp-1891877-hw-arm-smmuv3-Check-stream-IDs-against-actual-table-.patch
 new file mode 100644
index 0000000..90f85c4
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-hw-arm-smmuv3-Check-stream-IDs-against-actual-table-.patch
@@ -0,0 +1,63 @@
+From 256ecc06eb534e7d851fcdf667132a8721b5ad61 Mon Sep 17 00:00:00 2001
+From: Simon Veith <[e-mail]>
+Date: Fri, 20 Dec 2019 14:03:00 +0000
+Subject: [PATCH] hw/arm/smmuv3: Check stream IDs against actual table LOG2SIZE
+
+When checking whether a stream ID is in range of the stream table, we
+have so far been only checking it against our implementation limit
+(SMMU_IDR1_SIDSIZE). However, the guest can program the
+STRTAB_BASE_CFG.LOG2SIZE field to a size that is smaller than this
+limit.
+
+Check the stream ID against this limit as well to match the hardware
+behavior of raising C_BAD_STREAMID events in case the limit is exceeded.
+Also, ensure that we do not go one entry beyond the end of the table by
+checking that its index is strictly smaller than the table size.
+
+ref. ARM IHI 0070C, section 6.3.24.
+
+Signed-off-by: Simon Veith <[e-mail]>
+Acked-by: Eric Auger <[e-mail]>
+Tested-by: Eric Auger <[e-mail]>
+Message-id: [e-mail]
+Cc: Eric Auger <[e-mail]>
+Cc: [e-mail]
+Cc: [e-mail]
+Reviewed-by: Peter Maydell <[e-mail]>
+Signed-off-by: Peter Maydell <[e-mail]>
+(cherry picked from commit 05ff2fb80ce4ca85d8a39d48ff8156de739b4f51)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=256ecc06eb
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ hw/arm/smmuv3.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
+index eef9a18d70..727558bcfa 100644
+--- a/hw/arm/smmuv3.c
++++ b/hw/arm/smmuv3.c
+@@ -377,11 +377,15 @@ static int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste,
+                          SMMUEventInfo *event)
+ {
+     dma_addr_t addr;
++    uint32_t log2size;
+     int ret;
+ 
+     trace_smmuv3_find_ste(sid, s->features, s->sid_split);
+-    /* Check SID range */
+-    if (sid > (1 << SMMU_IDR1_SIDSIZE)) {
++    log2size = FIELD_EX32(s->strtab_base_cfg, STRTAB_BASE_CFG, LOG2SIZE);
++    /*
++     * Check SID range against both guest-configured and implementation limits
++     */
++    if (sid >= (1 << MIN(log2size, SMMU_IDR1_SIDSIZE))) {
+         event->type = SMMU_EVT_C_BAD_STREAMID;
+         return -EINVAL;
+     }
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-hw-arm-smmuv3-Correct-SMMU_BASE_ADDR_MASK-value.patch b/debian/patches/stable/lp-1891877-hw-arm-smmuv3-Correct-SMMU_BASE_ADDR_MASK-value.patch
 new file mode 100644
index 0000000..11865de
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-hw-arm-smmuv3-Correct-SMMU_BASE_ADDR_MASK-value.patch
@@ -0,0 +1,52 @@
+From 606a6bf788d37a524c89e2627a44693afb5cb6a1 Mon Sep 17 00:00:00 2001
+From: Simon Veith <[e-mail]>
+Date: Fri, 20 Dec 2019 14:03:00 +0000
+Subject: [PATCH] hw/arm/smmuv3: Correct SMMU_BASE_ADDR_MASK value
+
+There are two issues with the current value of SMMU_BASE_ADDR_MASK:
+
+- At the lower end, we are clearing bits [4:0]. Per the SMMUv3 spec,
+  we should also be treating bit 5 as zero in the base address.
+- At the upper end, we are clearing bits [63:48]. Per the SMMUv3 spec,
+  only bits [63:52] must be explicitly treated as zero.
+
+Update the SMMU_BASE_ADDR_MASK value to mask out bits [63:52] and [5:0].
+
+ref. ARM IHI 0070C, section 6.3.23.
+
+Signed-off-by: Simon Veith <[e-mail]>
+Acked-by: Eric Auger <[e-mail]>
+Tested-by: Eric Auger <[e-mail]>
+Message-id: [e-mail]
+Cc: Eric Auger <[e-mail]>
+Cc: [e-mail]
+Cc: [e-mail]
+Reviewed-by: Peter Maydell <[e-mail]>
+Signed-off-by: Peter Maydell <[e-mail]>
+(cherry picked from commit 3293b9f514a413e019b7dbc9d543458075b4849e)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=606a6bf788
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ hw/arm/smmuv3-internal.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
+index d190181ef1..042b435808 100644
+--- a/hw/arm/smmuv3-internal.h
++++ b/hw/arm/smmuv3-internal.h
+@@ -99,7 +99,7 @@ REG32(GERROR_IRQ_CFG2, 0x74)
+ 
+ #define A_STRTAB_BASE      0x80 /* 64b */
+ 
+-#define SMMU_BASE_ADDR_MASK 0xffffffffffe0
++#define SMMU_BASE_ADDR_MASK 0xfffffffffffc0
+ 
+ REG32(STRTAB_BASE_CFG,     0x88)
+     FIELD(STRTAB_BASE_CFG, FMT,      16, 2)
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-hw-arm-smmuv3-Report-F_STE_FETCH-fault-address-in-co.patch b/debian/patches/stable/lp-1891877-hw-arm-smmuv3-Report-F_STE_FETCH-fault-address-in-co.patch
 new file mode 100644
index 0000000..b7cc26c
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-hw-arm-smmuv3-Report-F_STE_FETCH-fault-address-in-co.patch
@@ -0,0 +1,55 @@
+From 9b59fdf47822acb6f2f6be5629829f27ffb08d41 Mon Sep 17 00:00:00 2001
+From: Simon Veith <[e-mail]>
+Date: Fri, 20 Dec 2019 14:03:00 +0000
+Subject: [PATCH] hw/arm/smmuv3: Report F_STE_FETCH fault address in correct
+ word position
+
+The smmuv3_record_event() function that generates the F_STE_FETCH error
+uses the EVT_SET_ADDR macro to record the fetch address, placing it in
+32-bit words 4 and 5.
+
+The correct position for this address is in words 6 and 7, per the
+SMMUv3 Architecture Specification.
+
+Update the function to use the EVT_SET_ADDR2 macro instead, which is the
+macro intended for writing to these words.
+
+ref. ARM IHI 0070C, section 7.3.4.
+
+Signed-off-by: Simon Veith <[e-mail]>
+Acked-by: Eric Auger <[e-mail]>
+Tested-by: Eric Auger <[e-mail]>
+Message-id: [e-mail]
+Cc: Eric Auger <[e-mail]>
+Cc: [e-mail]
+Cc: [e-mail]
+Acked-by: Eric Auger <[e-mail]>
+Reviewed-by: Peter Maydell <[e-mail]>
+Signed-off-by: Peter Maydell <[e-mail]>
+(cherry picked from commit b255cafb59578d16716186ed955717bc8f87bdb7)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=9b59fdf478
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ hw/arm/smmuv3.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
+index 31ac3ca32e..8b5f157dc7 100644
+--- a/hw/arm/smmuv3.c
++++ b/hw/arm/smmuv3.c
+@@ -172,7 +172,7 @@ void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *info)
+     case SMMU_EVT_F_STE_FETCH:
+         EVT_SET_SSID(&evt, info->u.f_ste_fetch.ssid);
+         EVT_SET_SSV(&evt,  info->u.f_ste_fetch.ssv);
+-        EVT_SET_ADDR(&evt, info->u.f_ste_fetch.addr);
++        EVT_SET_ADDR2(&evt, info->u.f_ste_fetch.addr);
+         break;
+     case SMMU_EVT_C_BAD_STE:
+         EVT_SET_SSID(&evt, info->u.c_bad_ste.ssid);
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-hw-arm-smmuv3-Use-correct-bit-positions-in-EVT_SET_A.patch b/debian/patches/stable/lp-1891877-hw-arm-smmuv3-Use-correct-bit-positions-in-EVT_SET_A.patch
 new file mode 100644
index 0000000..5a9a3b0
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-hw-arm-smmuv3-Use-correct-bit-positions-in-EVT_SET_A.patch
@@ -0,0 +1,58 @@
+From ec3bd881e2e5942f835094b2da06ca415f7b27b3 Mon Sep 17 00:00:00 2001
+From: Simon Veith <[e-mail]>
+Date: Fri, 20 Dec 2019 14:03:00 +0000
+Subject: [PATCH] hw/arm/smmuv3: Use correct bit positions in EVT_SET_ADDR2
+ macro
+
+The bit offsets in the EVT_SET_ADDR2 macro do not match those specified
+in the ARM SMMUv3 Architecture Specification. In all events that use
+this macro, e.g. F_WALK_EABT, the faulting fetch address or IPA actually
+occupies the 32-bit words 6 and 7 in the event record contiguously, with
+the upper and lower unused bits clear due to alignment or maximum
+supported address bits. How many bits are clear depends on the
+individual event type.
+
+Update the macro to write to the correct words in the event record so
+that guest drivers can obtain accurate address information on events.
+
+ref. ARM IHI 0070C, sections 7.3.12 through 7.3.16.
+
+Signed-off-by: Simon Veith <[e-mail]>
+Acked-by: Eric Auger <[e-mail]>
+Tested-by: Eric Auger <[e-mail]>
+Message-id: [e-mail]
+Cc: Eric Auger <[e-mail]>
+Cc: [e-mail]
+Cc: [e-mail]
+Acked-by: Eric Auger <[e-mail]>
+Reviewed-by: Peter Maydell <[e-mail]>
+Signed-off-by: Peter Maydell <[e-mail]>
+(cherry picked from commit a7f65ceb851af5a5b639c6e30801076d848db2c2)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=ec3bd881e2
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ hw/arm/smmuv3-internal.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
+index 042b435808..4112394129 100644
+--- a/hw/arm/smmuv3-internal.h
++++ b/hw/arm/smmuv3-internal.h
+@@ -461,8 +461,8 @@ typedef struct SMMUEventInfo {
+     } while (0)
+ #define EVT_SET_ADDR2(x, addr)                            \
+     do {                                                  \
+-            (x)->word[7] = deposit32((x)->word[7], 3, 29, addr >> 16);   \
+-            (x)->word[7] = deposit32((x)->word[7], 0, 16, addr & 0xffff);\
++            (x)->word[7] = (uint32_t)(addr >> 32);        \
++            (x)->word[6] = (uint32_t)(addr & 0xffffffff); \
+     } while (0)
+ 
+ void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *event);
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-hw-i386-amd_iommu.c-Fix-corruption-of-log-events-pas.patch b/debian/patches/stable/lp-1891877-hw-i386-amd_iommu.c-Fix-corruption-of-log-events-pas.patch
 new file mode 100644
index 0000000..ef32c14
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-hw-i386-amd_iommu.c-Fix-corruption-of-log-events-pas.patch
@@ -0,0 +1,49 @@
+From 33be7aa9b6bea692e7ba615db1c97820051dc435 Mon Sep 17 00:00:00 2001
+From: Peter Maydell <[e-mail]>
+Date: Thu, 26 Mar 2020 10:53:49 +0000
+Subject: [PATCH] hw/i386/amd_iommu.c: Fix corruption of log events passed to
+ guest
+
+In the function amdvi_log_event(), we write an event log buffer
+entry into guest ram, whose contents are passed to the function
+via the "uint64_t *evt" argument. Unfortunately, a spurious
+'&' in the call to dma_memory_write() meant that instead of
+writing the event to the guest we would write the literal value
+of the pointer, plus whatever was in the following 8 bytes
+on the stack. This error was spotted by Coverity.
+
+Fix the bug by removing the '&'.
+
+Fixes: CID 1421945
+Cc: [e-mail]
+Signed-off-by: Peter Maydell <[e-mail]>
+Message-Id: <[e-mail]>
+Reviewed-by: Michael S. Tsirkin <[e-mail]>
+Signed-off-by: Michael S. Tsirkin <[e-mail]>
+(cherry picked from commit 32a2d6b1f6b4405f0fc20c031e61d5d48e3d9cd1)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=33be7aa9b6
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ hw/i386/amd_iommu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
+index d55dbf07fc..ac5f2fddc5 100644
+--- a/hw/i386/amd_iommu.c
++++ b/hw/i386/amd_iommu.c
+@@ -181,7 +181,7 @@ static void amdvi_log_event(AMDVIState *s, uint64_t *evt)
+     }
+ 
+     if (dma_memory_write(&address_space_memory, s->evtlog + s->evtlog_tail,
+-        &evt, AMDVI_EVENT_LEN)) {
++                         evt, AMDVI_EVENT_LEN)) {
+         trace_amdvi_evntlog_fail(s->evtlog, s->evtlog_tail);
+     }
+ 
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-hw-intc-arm_gicv3_kvm-Stop-wrongly-programming-GICR_.patch b/debian/patches/stable/lp-1891877-hw-intc-arm_gicv3_kvm-Stop-wrongly-programming-GICR_.patch
 new file mode 100644
index 0000000..9c219c9
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-hw-intc-arm_gicv3_kvm-Stop-wrongly-programming-GICR_.patch
@@ -0,0 +1,66 @@
+From 9adb6569bf71808e76a7b71766e73a6da103741e Mon Sep 17 00:00:00 2001
+From: Zenghui Yu <[e-mail]>
+Date: Thu, 30 Jan 2020 16:02:05 +0000
+Subject: [PATCH] hw/intc/arm_gicv3_kvm: Stop wrongly programming
+ GICR_PENDBASER.PTZ bit
+
+If LPIs are disabled, KVM will just ignore the GICR_PENDBASER.PTZ bit when
+restoring GICR_CTLR.  Setting PTZ here makes littlt sense in "reduce GIC
+initialization time".
+
+And what's worse, PTZ is generally programmed by guest to indicate to the
+Redistributor whether the LPI Pending table is zero when enabling LPIs.
+If migration is triggered when the PTZ has just been cleared by guest (and
+before enabling LPIs), we will see PTZ==1 on the destination side, which
+is not as expected.  Let's just drop this hackish userspace behavior.
+
+Also take this chance to refine the comment a bit.
+
+Fixes: 367b9f527bec ("hw/intc/arm_gicv3_kvm: Implement get/put functions")
+Signed-off-by: Zenghui Yu <[e-mail]>
+Message-id: [e-mail]
+Reviewed-by: Peter Maydell <[e-mail]>
+Signed-off-by: Peter Maydell <[e-mail]>
+(cherry picked from commit 618bacabd3c8c3360be795cd8763bacdf5bec101)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=9adb6569bf
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ hw/intc/arm_gicv3_kvm.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c
+index 9c7f4ab871..49304ca589 100644
+--- a/hw/intc/arm_gicv3_kvm.c
++++ b/hw/intc/arm_gicv3_kvm.c
+@@ -336,7 +336,10 @@ static void kvm_arm_gicv3_put(GICv3State *s)
+     kvm_gicd_access(s, GICD_CTLR, &reg, true);
+ 
+     if (redist_typer & GICR_TYPER_PLPIS) {
+-        /* Set base addresses before LPIs are enabled by GICR_CTLR write */
++        /*
++         * Restore base addresses before LPIs are potentially enabled by
++         * GICR_CTLR write
++         */
+         for (ncpu = 0; ncpu < s->num_cpu; ncpu++) {
+             GICv3CPUState *c = &s->cpu[ncpu];
+ 
+@@ -347,12 +350,6 @@ static void kvm_arm_gicv3_put(GICv3State *s)
+             kvm_gicr_access(s, GICR_PROPBASER + 4, ncpu, &regh, true);
+ 
+             reg64 = c->gicr_pendbaser;
+-            if (!(c->gicr_ctlr & GICR_CTLR_ENABLE_LPIS)) {
+-                /* Setting PTZ is advised if LPIs are disabled, to reduce
+-                 * GIC initialization time.
+-                 */
+-                reg64 |= GICR_PENDBASER_PTZ;
+-            }
+             regl = (uint32_t)reg64;
+             kvm_gicr_access(s, GICR_PENDBASER, ncpu, &regl, true);
+             regh = (uint32_t)(reg64 >> 32);
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-i386-Resolve-CPU-models-to-v1-by-default.patch b/debian/patches/stable/lp-1891877-i386-Resolve-CPU-models-to-v1-by-default.patch
 new file mode 100644
index 0000000..4bccfa5
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-i386-Resolve-CPU-models-to-v1-by-default.patch
@@ -0,0 +1,91 @@
+From bed590f2b849ad548d659942771d824c288c6a50 Mon Sep 17 00:00:00 2001
+From: Eduardo Habkost <[e-mail]>
+Date: Thu, 5 Dec 2019 19:33:39 -0300
+Subject: [PATCH] i386: Resolve CPU models to v1 by default
+
+When using `query-cpu-definitions` using `-machine none`,
+QEMU is resolving all CPU models to their latest versions.  The
+actual CPU model version being used by another machine type (e.g.
+`pc-q35-4.0`) might be different.
+
+In theory, this was OK because the correct CPU model
+version is returned when using the correct `-machine` argument.
+
+Except that in practice, this breaks libvirt expectations:
+libvirt always use `-machine none` when checking if a CPU model
+is runnable, because runnability is not expected to be affected
+when the machine type is changed.
+
+For example, when running on a Haswell host without TSX,
+Haswell-v4 is runnable, but Haswell-v1 is not.  On those hosts,
+`query-cpu-definitions` says Haswell is runnable if using
+`-machine none`, but Haswell is actually not runnable using any
+of the `pc-*` machine types (because they resolve Haswell to
+Haswell-v1).  In other words, we're breaking the "runnability
+guarantee" we promised to not break for a few releases (see
+qemu-deprecated.texi).
+
+To address this issue, change the default CPU model version to v1
+on all machine types, so we make `query-cpu-definitions` output
+when using `-machine none` match the results when using `pc-*`.
+This will change in the future (the plan is to always return the
+latest CPU model version if using `-machine none`), but only
+after giving libvirt the opportunity to adapt.
+
+Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1779078
+Signed-off-by: Eduardo Habkost <[e-mail]>
+Message-Id: <[e-mail]>
+Signed-off-by: Eduardo Habkost <[e-mail]>
+(cherry picked from commit ad18392892c04637fb56956d997f4bc600224356)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=bed590f2b8
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ qemu-deprecated.texi | 8 ++++++++
+ target/i386/cpu.c    | 8 +++++++-
+ 2 files changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/qemu-deprecated.texi b/qemu-deprecated.texi
+index 4b4b7425ac..b42d8b3c5f 100644
+--- a/qemu-deprecated.texi
++++ b/qemu-deprecated.texi
+@@ -374,6 +374,14 @@ guarantees must resolve the CPU model aliases using te
+ ``alias-of'' field returned by the ``query-cpu-definitions'' QMP
+ command.
+ 
++While those guarantees are kept, the return value of
++``query-cpu-definitions'' will have existing CPU model aliases
++point to a version that doesn't break runnability guarantees
++(specifically, version 1 of those CPU models).  In future QEMU
++versions, aliases will point to newer CPU model versions
++depending on the machine type, so management software must
++resolve CPU model aliases before starting a virtual machine.
++
+ 
+ @node Recently removed features
+ @appendix Recently removed features
+diff --git a/target/i386/cpu.c b/target/i386/cpu.c
+index 69f518a21a..54e7f18a09 100644
+--- a/target/i386/cpu.c
++++ b/target/i386/cpu.c
+@@ -3924,7 +3924,13 @@ static PropValue tcg_default_props[] = {
+ };
+ 
+ 
+-X86CPUVersion default_cpu_version = CPU_VERSION_LATEST;
++/*
++ * We resolve CPU model aliases using -v1 when using "-machine
++ * none", but this is just for compatibility while libvirt isn't
++ * adapted to resolve CPU model versions before creating VMs.
++ * See "Runnability guarantee of CPU models" at * qemu-deprecated.texi.
++ */
++X86CPUVersion default_cpu_version = 1;
+ 
+ void x86_cpu_set_default_version(X86CPUVersion version)
+ {
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-ide-Fix-incorrect-handling-of-some-PRDTs-in-ide_dma_.patch b/debian/patches/stable/lp-1891877-ide-Fix-incorrect-handling-of-some-PRDTs-in-ide_dma_.patch
 new file mode 100644
index 0000000..c42f271
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-ide-Fix-incorrect-handling-of-some-PRDTs-in-ide_dma_.patch
@@ -0,0 +1,99 @@
+From 4412cb3bcaf5b0cccf88f881c18be5dfd395e934 Mon Sep 17 00:00:00 2001
+From: Alexander Popov <[e-mail]>
+Date: Mon, 23 Dec 2019 20:51:16 +0300
+Subject: [PATCH] ide: Fix incorrect handling of some PRDTs in ide_dma_cb()
+
+The commit a718978ed58a from July 2015 introduced the assertion which
+implies that the size of successful DMA transfers handled in ide_dma_cb()
+should be multiple of 512 (the size of a sector). But guest systems can
+initiate DMA transfers that don't fit this requirement.
+
+For fixing that let's check the number of bytes prepared for the transfer
+by the prepare_buf() handler. The code in ide_dma_cb() must behave
+according to the Programming Interface for Bus Master IDE Controller
+(Revision 1.0 5/16/94):
+1. If PRDs specified a smaller size than the IDE transfer
+   size, then the Interrupt and Active bits in the Controller
+   status register are not set (Error Condition).
+2. If the size of the physical memory regions was equal to
+   the IDE device transfer size, the Interrupt bit in the
+   Controller status register is set to 1, Active bit is set to 0.
+3. If PRDs specified a larger size than the IDE transfer size,
+   the Interrupt and Active bits in the Controller status register
+   are both set to 1.
+
+Signed-off-by: Alexander Popov <[e-mail]>
+Reviewed-by: Kevin Wolf <[e-mail]>
+Message-id: [e-mail]
+Signed-off-by: John Snow <[e-mail]>
+(cherry picked from commit ed78352a59ea7acf7520d4d47a96b9911bae7fc3)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=4412cb3bca
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ hw/ide/core.c | 30 ++++++++++++++++++++++--------
+ 1 file changed, 22 insertions(+), 8 deletions(-)
+
+diff --git a/hw/ide/core.c b/hw/ide/core.c
+index 754ff4dc34..80000eb766 100644
+--- a/hw/ide/core.c
++++ b/hw/ide/core.c
+@@ -849,6 +849,7 @@ static void ide_dma_cb(void *opaque, int ret)
+     int64_t sector_num;
+     uint64_t offset;
+     bool stay_active = false;
++    int32_t prep_size = 0;
+ 
+     if (ret == -EINVAL) {
+         ide_dma_error(s);
+@@ -863,13 +864,15 @@ static void ide_dma_cb(void *opaque, int ret)
+         }
+     }
+ 
+-    n = s->io_buffer_size >> 9;
+-    if (n > s->nsector) {
+-        /* The PRDs were longer than needed for this request. Shorten them so
+-         * we don't get a negative remainder. The Active bit must remain set
+-         * after the request completes. */
++    if (s->io_buffer_size > s->nsector * 512) {
++        /*
++         * The PRDs were longer than needed for this request.
++         * The Active bit must remain set after the request completes.
++         */
+         n = s->nsector;
+         stay_active = true;
++    } else {
++        n = s->io_buffer_size >> 9;
+     }
+ 
+     sector_num = ide_get_sector(s);
+@@ -892,9 +895,20 @@ static void ide_dma_cb(void *opaque, int ret)
+     n = s->nsector;
+     s->io_buffer_index = 0;
+     s->io_buffer_size = n * 512;
+-    if (s->bus->dma->ops->prepare_buf(s->bus->dma, s->io_buffer_size) < 512) {
+-        /* The PRDs were too short. Reset the Active bit, but don't raise an
+-         * interrupt. */
++    prep_size = s->bus->dma->ops->prepare_buf(s->bus->dma, s->io_buffer_size);
++    /* prepare_buf() must succeed and respect the limit */
++    assert(prep_size >= 0 && prep_size <= n * 512);
++
++    /*
++     * Now prep_size stores the number of bytes in the sglist, and
++     * s->io_buffer_size stores the number of bytes described by the PRDs.
++     */
++
++    if (prep_size < n * 512) {
++        /*
++         * The PRDs are too short for this request. Error condition!
++         * Reset the Active bit and don't raise the interrupt.
++         */
+         s->status = READY_STAT | SEEK_STAT;
+         dma_buf_commit(s, 0);
+         goto eot;
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-iotests-026-Move-v3-exclusive-test-to-new-file.patch b/debian/patches/stable/lp-1891877-iotests-026-Move-v3-exclusive-test-to-new-file.patch
 new file mode 100644
index 0000000..8684d31
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-iotests-026-Move-v3-exclusive-test-to-new-file.patch
@@ -0,0 +1,232 @@
+From 2f7597fbc2727eeb4f16c579c9dc0b115a8e5e93 Mon Sep 17 00:00:00 2001
+From: Max Reitz <[e-mail]>
+Date: Wed, 11 Mar 2020 15:07:07 +0100
+Subject: [PATCH] iotests/026: Move v3-exclusive test to new file
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+data_file does not work with v2, and we probably want 026 to keep
+working for v2 images.  Thus, open a new file for v3-exclusive error
+path test cases.
+
+Fixes: 81311255f217859413c94f2cd9cebf2684bbda94
+       (“iotests/026: Test EIO on allocation in a data-file”)
+Signed-off-by: Max Reitz <[e-mail]>
+Message-Id: <[e-mail]>
+Reviewed-by: John Snow <[e-mail]>
+Tested-by: John Snow <[e-mail]>
+Signed-off-by: Max Reitz <[e-mail]>
+(cherry picked from commit c264e5d2f9f5d73977eac8e5d084f727b3d07ea9)
+ Conflicts:
+	tests/qemu-iotests/group
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=2f7597fbc2
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ tests/qemu-iotests/026             | 31 -----------
+ tests/qemu-iotests/026.out         |  6 --
+ tests/qemu-iotests/026.out.nocache |  6 --
+ tests/qemu-iotests/289             | 89 ++++++++++++++++++++++++++++++
+ tests/qemu-iotests/289.out         |  8 +++
+ tests/qemu-iotests/group           |  1 +
+ 6 files changed, 98 insertions(+), 43 deletions(-)
+ create mode 100755 tests/qemu-iotests/289
+ create mode 100644 tests/qemu-iotests/289.out
+
+diff --git a/tests/qemu-iotests/026 b/tests/qemu-iotests/026
+index c1c96a41d9..3afd708863 100755
+--- a/tests/qemu-iotests/026
++++ b/tests/qemu-iotests/026
+@@ -237,37 +237,6 @@ $QEMU_IO -c "write 0 $CLUSTER_SIZE" "$BLKDBG_TEST_IMG" | _filter_qemu_io
+ 
+ _check_test_img
+ 
+-echo
+-echo === Avoid freeing external data clusters on failure ===
+-echo
+-
+-# Similar test as the last one, except we test what happens when there
+-# is an error when writing to an external data file instead of when
+-# writing to a preallocated zero cluster
+-_make_test_img -o "data_file=$TEST_IMG.data_file" $CLUSTER_SIZE
+-
+-# Put blkdebug above the data-file, and a raw node on top of that so
+-# that blkdebug will see a write_aio event and emit an error
+-$QEMU_IO -c "write 0 $CLUSTER_SIZE" \
+-    "json:{
+-         'driver': 'qcow2',
+-         'file': { 'driver': 'file', 'filename': '$TEST_IMG' },
+-         'data-file': {
+-             'driver': 'raw',
+-             'file': {
+-                 'driver': 'blkdebug',
+-                 'config': '$TEST_DIR/blkdebug.conf',
+-                 'image': {
+-                     'driver': 'file',
+-                     'filename': '$TEST_IMG.data_file'
+-                 }
+-             }
+-         }
+-     }" \
+-    | _filter_qemu_io
+-
+-_check_test_img
+-
+ # success, all done
+ echo "*** done"
+ rm -f $seq.full
+diff --git a/tests/qemu-iotests/026.out b/tests/qemu-iotests/026.out
+index c1b3b58482..83989996ff 100644
+--- a/tests/qemu-iotests/026.out
++++ b/tests/qemu-iotests/026.out
+@@ -653,10 +653,4 @@ wrote 1024/1024 bytes at offset 0
+ 1 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+ write failed: Input/output error
+ No errors were found on the image.
+-
+-=== Avoid freeing external data clusters on failure ===
+-
+-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1024 data_file=TEST_DIR/t.IMGFMT.data_file
+-write failed: Input/output error
+-No errors were found on the image.
+ *** done
+diff --git a/tests/qemu-iotests/026.out.nocache b/tests/qemu-iotests/026.out.nocache
+index 8d5001648a..9359d26d7e 100644
+--- a/tests/qemu-iotests/026.out.nocache
++++ b/tests/qemu-iotests/026.out.nocache
+@@ -661,10 +661,4 @@ wrote 1024/1024 bytes at offset 0
+ 1 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+ write failed: Input/output error
+ No errors were found on the image.
+-
+-=== Avoid freeing external data clusters on failure ===
+-
+-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1024 data_file=TEST_DIR/t.IMGFMT.data_file
+-write failed: Input/output error
+-No errors were found on the image.
+ *** done
+diff --git a/tests/qemu-iotests/289 b/tests/qemu-iotests/289
+new file mode 100755
+index 0000000000..1c11d4030e
+--- /dev/null
++++ b/tests/qemu-iotests/289
+@@ -0,0 +1,89 @@
++#!/usr/bin/env bash
++#
++# qcow2 v3-exclusive error path testing
++# (026 tests paths common to v2 and v3)
++#
++# Copyright (C) 2020 Red Hat, Inc.
++#
++# This program is free software; you can redistribute it and/or modify
++# it under the terms of the GNU General Public License as published by
++# the Free Software Foundation; either version 2 of the License, or
++# (at your option) any later version.
++#
++# This program is distributed in the hope that it will be useful,
++# but WITHOUT ANY WARRANTY; without even the implied warranty of
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++# GNU General Public License for more details.
++#
++# You should have received a copy of the GNU General Public License
++# along with this program.  If not, see <http://www.gnu.org/licenses/>.
++#
++
++seq=$(basename $0)
++echo "QA output created by $seq"
++
++status=1	# failure is the default!
++
++_cleanup()
++{
++    _cleanup_test_img
++    rm "$TEST_DIR/blkdebug.conf"
++    rm -f "$TEST_IMG.data_file"
++}
++trap "_cleanup; exit \$status" 0 1 2 3 15
++
++# get standard environment, filters and checks
++. ./common.rc
++. ./common.filter
++. ./common.pattern
++
++_supported_fmt qcow2
++_supported_proto file
++# This is a v3-exclusive test;
++# As for data_file, error paths often very much depend on whether
++# there is an external data file or not; so we create one exactly when
++# we want to test it
++_unsupported_imgopts 'compat=0.10' data_file
++
++echo
++echo === Avoid freeing external data clusters on failure ===
++echo
++
++cat > "$TEST_DIR/blkdebug.conf" <<EOF
++[inject-error]
++event = "write_aio"
++errno = "5"
++once = "on"
++EOF
++
++# Test what happens when there is an error when writing to an external
++# data file instead of when writing to a preallocated zero cluster
++_make_test_img -o "data_file=$TEST_IMG.data_file" 64k
++
++# Put blkdebug above the data-file, and a raw node on top of that so
++# that blkdebug will see a write_aio event and emit an error.  This
++# will then trigger the alloc abort code, which we want to test here.
++$QEMU_IO -c "write 0 64k" \
++    "json:{
++         'driver': 'qcow2',
++         'file': { 'driver': 'file', 'filename': '$TEST_IMG' },
++         'data-file': {
++             'driver': 'raw',
++             'file': {
++                 'driver': 'blkdebug',
++                 'config': '$TEST_DIR/blkdebug.conf',
++                 'image': {
++                     'driver': 'file',
++                     'filename': '$TEST_IMG.data_file'
++                 }
++             }
++         }
++     }" \
++    | _filter_qemu_io
++
++_check_test_img
++
++# success, all done
++echo "*** done"
++rm -f $seq.full
++status=0
+diff --git a/tests/qemu-iotests/289.out b/tests/qemu-iotests/289.out
+new file mode 100644
+index 0000000000..e54e2629d4
+--- /dev/null
++++ b/tests/qemu-iotests/289.out
+@@ -0,0 +1,8 @@
++QA output created by 289
++
++=== Avoid freeing external data clusters on failure ===
++
++Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=65536 data_file=TEST_DIR/t.IMGFMT.data_file
++write failed: Input/output error
++No errors were found on the image.
++*** done
+diff --git a/tests/qemu-iotests/group b/tests/qemu-iotests/group
+index 6b10a6a762..2dc8a6e572 100644
+--- a/tests/qemu-iotests/group
++++ b/tests/qemu-iotests/group
+@@ -286,3 +286,4 @@
+ 272 rw
+ 273 backing quick
+ 277 rw quick
++289 rw quick
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-iotests-026-Test-EIO-on-allocation-in-a-data-file.patch b/debian/patches/stable/lp-1891877-iotests-026-Test-EIO-on-allocation-in-a-data-file.patch
 new file mode 100644
index 0000000..76e486b
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-iotests-026-Test-EIO-on-allocation-in-a-data-file.patch
@@ -0,0 +1,107 @@
+From 4540aa4a8d2c59ec42af0ea58ca1794124ce47dd Mon Sep 17 00:00:00 2001
+From: Max Reitz <[e-mail]>
+Date: Tue, 25 Feb 2020 15:31:30 +0100
+Subject: [PATCH] iotests/026: Test EIO on allocation in a data-file
+
+Test what happens when writing data to an external data file, where the
+write requires an L2 entry to be allocated, but the data write fails.
+
+Signed-off-by: Max Reitz <[e-mail]>
+Message-Id: <[e-mail]>
+Signed-off-by: Kevin Wolf <[e-mail]>
+(cherry picked from commit 81311255f217859413c94f2cd9cebf2684bbda94)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=4540aa4a8d
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ tests/qemu-iotests/026             | 32 ++++++++++++++++++++++++++++++
+ tests/qemu-iotests/026.out         |  6 ++++++
+ tests/qemu-iotests/026.out.nocache |  6 ++++++
+ 3 files changed, 44 insertions(+)
+
+diff --git a/tests/qemu-iotests/026 b/tests/qemu-iotests/026
+index d89729697f..c1c96a41d9 100755
+--- a/tests/qemu-iotests/026
++++ b/tests/qemu-iotests/026
+@@ -30,6 +30,7 @@ _cleanup()
+ {
+ 	_cleanup_test_img
+     rm "$TEST_DIR/blkdebug.conf"
++    rm -f "$TEST_IMG.data_file"
+ }
+ trap "_cleanup; exit \$status" 0 1 2 3 15
+ 
+@@ -236,6 +237,37 @@ $QEMU_IO -c "write 0 $CLUSTER_SIZE" "$BLKDBG_TEST_IMG" | _filter_qemu_io
+ 
+ _check_test_img
+ 
++echo
++echo === Avoid freeing external data clusters on failure ===
++echo
++
++# Similar test as the last one, except we test what happens when there
++# is an error when writing to an external data file instead of when
++# writing to a preallocated zero cluster
++_make_test_img -o "data_file=$TEST_IMG.data_file" $CLUSTER_SIZE
++
++# Put blkdebug above the data-file, and a raw node on top of that so
++# that blkdebug will see a write_aio event and emit an error
++$QEMU_IO -c "write 0 $CLUSTER_SIZE" \
++    "json:{
++         'driver': 'qcow2',
++         'file': { 'driver': 'file', 'filename': '$TEST_IMG' },
++         'data-file': {
++             'driver': 'raw',
++             'file': {
++                 'driver': 'blkdebug',
++                 'config': '$TEST_DIR/blkdebug.conf',
++                 'image': {
++                     'driver': 'file',
++                     'filename': '$TEST_IMG.data_file'
++                 }
++             }
++         }
++     }" \
++    | _filter_qemu_io
++
++_check_test_img
++
+ # success, all done
+ echo "*** done"
+ rm -f $seq.full
+diff --git a/tests/qemu-iotests/026.out b/tests/qemu-iotests/026.out
+index 83989996ff..c1b3b58482 100644
+--- a/tests/qemu-iotests/026.out
++++ b/tests/qemu-iotests/026.out
+@@ -653,4 +653,10 @@ wrote 1024/1024 bytes at offset 0
+ 1 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+ write failed: Input/output error
+ No errors were found on the image.
++
++=== Avoid freeing external data clusters on failure ===
++
++Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1024 data_file=TEST_DIR/t.IMGFMT.data_file
++write failed: Input/output error
++No errors were found on the image.
+ *** done
+diff --git a/tests/qemu-iotests/026.out.nocache b/tests/qemu-iotests/026.out.nocache
+index 9359d26d7e..8d5001648a 100644
+--- a/tests/qemu-iotests/026.out.nocache
++++ b/tests/qemu-iotests/026.out.nocache
+@@ -661,4 +661,10 @@ wrote 1024/1024 bytes at offset 0
+ 1 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+ write failed: Input/output error
+ No errors were found on the image.
++
++=== Avoid freeing external data clusters on failure ===
++
++Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1024 data_file=TEST_DIR/t.IMGFMT.data_file
++write failed: Input/output error
++No errors were found on the image.
+ *** done
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-iotests-026-Test-EIO-on-preallocated-zero-cluster.patch b/debian/patches/stable/lp-1891877-iotests-026-Test-EIO-on-preallocated-zero-cluster.patch
 new file mode 100644
index 0000000..5295272
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-iotests-026-Test-EIO-on-preallocated-zero-cluster.patch
@@ -0,0 +1,97 @@
+From 30aa0ea6c578b51a71d8cbb9578cc7f7bfeb56aa Mon Sep 17 00:00:00 2001
+From: Max Reitz <[e-mail]>
+Date: Tue, 25 Feb 2020 15:31:29 +0100
+Subject: [PATCH] iotests/026: Test EIO on preallocated zero cluster
+
+Test what happens when writing data to a preallocated zero cluster, but
+the data write fails.
+
+Signed-off-by: Max Reitz <[e-mail]>
+Message-Id: <[e-mail]>
+Signed-off-by: Kevin Wolf <[e-mail]>
+(cherry picked from commit 31ab00f3747c00fdbb9027cea644b40dd1405480)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=30aa0ea6c5
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ tests/qemu-iotests/026             | 21 +++++++++++++++++++++
+ tests/qemu-iotests/026.out         | 10 ++++++++++
+ tests/qemu-iotests/026.out.nocache | 10 ++++++++++
+ 3 files changed, 41 insertions(+)
+
+diff --git a/tests/qemu-iotests/026 b/tests/qemu-iotests/026
+index 3430029ed6..d89729697f 100755
+--- a/tests/qemu-iotests/026
++++ b/tests/qemu-iotests/026
+@@ -215,6 +215,27 @@ _make_test_img 64M
+ $QEMU_IO -c "write 0 1M" -c "write 0 1M" "$BLKDBG_TEST_IMG" | _filter_qemu_io
+ _check_test_img
+ 
++echo
++echo === Avoid freeing preallocated zero clusters on failure ===
++echo
++
++cat > "$TEST_DIR/blkdebug.conf" <<EOF
++[inject-error]
++event = "write_aio"
++errno = "5"
++once = "on"
++EOF
++
++_make_test_img $CLUSTER_SIZE
++# Create a preallocated zero cluster
++$QEMU_IO -c "write 0 $CLUSTER_SIZE" -c "write -z 0 $CLUSTER_SIZE" "$TEST_IMG" \
++    | _filter_qemu_io
++# Try to overwrite it (prompting an I/O error from blkdebug), thus
++# triggering the alloc abort code
++$QEMU_IO -c "write 0 $CLUSTER_SIZE" "$BLKDBG_TEST_IMG" | _filter_qemu_io
++
++_check_test_img
++
+ # success, all done
+ echo "*** done"
+ rm -f $seq.full
+diff --git a/tests/qemu-iotests/026.out b/tests/qemu-iotests/026.out
+index ff0817b6f2..83989996ff 100644
+--- a/tests/qemu-iotests/026.out
++++ b/tests/qemu-iotests/026.out
+@@ -643,4 +643,14 @@ write failed: Input/output error
+ wrote 1048576/1048576 bytes at offset 0
+ 1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+ No errors were found on the image.
++
++=== Avoid freeing preallocated zero clusters on failure ===
++
++Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1024
++wrote 1024/1024 bytes at offset 0
++1 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
++wrote 1024/1024 bytes at offset 0
++1 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
++write failed: Input/output error
++No errors were found on the image.
+ *** done
+diff --git a/tests/qemu-iotests/026.out.nocache b/tests/qemu-iotests/026.out.nocache
+index 495d013007..9359d26d7e 100644
+--- a/tests/qemu-iotests/026.out.nocache
++++ b/tests/qemu-iotests/026.out.nocache
+@@ -651,4 +651,14 @@ write failed: Input/output error
+ wrote 1048576/1048576 bytes at offset 0
+ 1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+ No errors were found on the image.
++
++=== Avoid freeing preallocated zero clusters on failure ===
++
++Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1024
++wrote 1024/1024 bytes at offset 0
++1 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
++wrote 1024/1024 bytes at offset 0
++1 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
++write failed: Input/output error
++No errors were found on the image.
+ *** done
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-iotests-283-Use-consistent-size-for-source-and-targe.patch b/debian/patches/stable/lp-1891877-iotests-283-Use-consistent-size-for-source-and-targe.patch
 new file mode 100644
index 0000000..d479c09
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-iotests-283-Use-consistent-size-for-source-and-targe.patch
@@ -0,0 +1,57 @@
+From 4a0db6ba7d5c524cbbcc684d7448e01e11eacbbd Mon Sep 17 00:00:00 2001
+From: Kevin Wolf <[e-mail]>
+Date: Thu, 30 Apr 2020 16:27:52 +0200
+Subject: [PATCH] iotests/283: Use consistent size for source and target
+
+The test case forgot to specify the null-co size for the target node.
+When adding a check to backup that both sizes match, this would fail
+because of the size mismatch and not the behaviour that the test really
+wanted to test.
+
+Fixes: a541fcc27c98b96da187c7d4573f3270f3ddd283
+Signed-off-by: Kevin Wolf <[e-mail]>
+Message-Id: <[e-mail]>
+Reviewed-by: Vladimir Sementsov-Ogievskiy <[e-mail]>
+Signed-off-by: Kevin Wolf <[e-mail]>
+(cherry picked from commit 813cc2545b82409fd504509f0ba2e96fab6edb9e)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=4a0db6ba7d
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ tests/qemu-iotests/283     | 6 +++++-
+ tests/qemu-iotests/283.out | 2 +-
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/tests/qemu-iotests/283 b/tests/qemu-iotests/283
+index 293e557bd9..a82e3c8164 100644
+--- a/tests/qemu-iotests/283
++++ b/tests/qemu-iotests/283
+@@ -72,7 +72,11 @@ to check that crash is fixed :)
+ vm = iotests.VM()
+ vm.launch()
+ 
+-vm.qmp_log('blockdev-add', **{'node-name': 'target', 'driver': 'null-co'})
++vm.qmp_log('blockdev-add', **{
++    'node-name': 'target',
++    'driver': 'null-co',
++    'size': size,
++})
+ 
+ vm.qmp_log('blockdev-add', **{
+     'node-name': 'source',
+diff --git a/tests/qemu-iotests/283.out b/tests/qemu-iotests/283.out
+index daaf5828c1..d8cff22cc1 100644
+--- a/tests/qemu-iotests/283.out
++++ b/tests/qemu-iotests/283.out
+@@ -1,4 +1,4 @@
+-{"execute": "blockdev-add", "arguments": {"driver": "null-co", "node-name": "target"}}
++{"execute": "blockdev-add", "arguments": {"driver": "null-co", "node-name": "target", "size": 1048576}}
+ {"return": {}}
+ {"execute": "blockdev-add", "arguments": {"driver": "blkdebug", "image": {"driver": "null-co", "node-name": "base", "size": 1048576}, "node-name": "source"}}
+ {"return": {}}
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-iotests-Fix-IMGOPTSSYNTAX-for-nbd.patch b/debian/patches/stable/lp-1891877-iotests-Fix-IMGOPTSSYNTAX-for-nbd.patch
 new file mode 100644
index 0000000..5bb67e9
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-iotests-Fix-IMGOPTSSYNTAX-for-nbd.patch
@@ -0,0 +1,42 @@
+From 6772bba8a45cda8ab96f124bb148c3ec1f7a4234 Mon Sep 17 00:00:00 2001
+From: Max Reitz <[e-mail]>
+Date: Wed, 18 Dec 2019 11:48:55 +0100
+Subject: [PATCH] iotests: Fix IMGOPTSSYNTAX for nbd
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+There is no $SOCKDIR, only $SOCK_DIR.
+
+Fixes: f3923a72f199b2c63747a7032db74730546f55c6
+Signed-off-by: Max Reitz <[e-mail]>
+Reviewed-by: Philippe Mathieu-Daudé <[e-mail]>
+Signed-off-by: Kevin Wolf <[e-mail]>
+(cherry picked from commit eb4ea9aaa0051054b3c148ad8631be7510851681)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=6772bba8a4
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ tests/qemu-iotests/common.rc | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/tests/qemu-iotests/common.rc b/tests/qemu-iotests/common.rc
+index 0cc8acc9ed..d3bf92031f 100644
+--- a/tests/qemu-iotests/common.rc
++++ b/tests/qemu-iotests/common.rc
+@@ -217,7 +217,8 @@ if [ "$IMGOPTSSYNTAX" = "true" ]; then
+         TEST_IMG="$DRIVER,file.filename=$TEST_DIR/t.$IMGFMT"
+     elif [ "$IMGPROTO" = "nbd" ]; then
+         TEST_IMG_FILE=$TEST_DIR/t.$IMGFMT
+-        TEST_IMG="$DRIVER,file.driver=nbd,file.type=unix,file.path=$SOCKDIR/nbd"
++        TEST_IMG="$DRIVER,file.driver=nbd,file.type=unix"
++        TEST_IMG="$TEST_IMG,file.path=$SOCK_DIR/nbd"
+     elif [ "$IMGPROTO" = "ssh" ]; then
+         TEST_IMG_FILE=$TEST_DIR/t.$IMGFMT
+         TEST_IMG="$DRIVER,file.driver=ssh,file.host=127.0.0.1,file.path=$TEST_IMG_FILE"
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-iotests-Fix-nonportable-use-of-od-endian.patch b/debian/patches/stable/lp-1891877-iotests-Fix-nonportable-use-of-od-endian.patch
 new file mode 100644
index 0000000..720412c
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-iotests-Fix-nonportable-use-of-od-endian.patch
@@ -0,0 +1,69 @@
+From c6decabc4a30b841e031a838206286db6ad343bc Mon Sep 17 00:00:00 2001
+From: Eric Blake <[e-mail]>
+Date: Wed, 26 Feb 2020 06:54:24 -0600
+Subject: [PATCH] iotests: Fix nonportable use of od --endian
+
+Tests 261 and 272 fail on RHEL 7 with coreutils 8.22, since od
+--endian was not added until coreutils 8.23.  Fix this by manually
+constructing the final value one byte at a time.
+
+Fixes: fc8ba423
+Reported-by: Andrey Shinkevich <[e-mail]>
+Signed-off-by: Eric Blake <[e-mail]>
+Reviewed-by: Max Reitz <[e-mail]>
+Message-Id: <[e-mail]>
+Signed-off-by: Max Reitz <[e-mail]>
+(cherry picked from commit 69135eb30b9c3fca583737a96df015174dc8e6dd)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=c6decabc4a
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ tests/qemu-iotests/common.rc | 22 +++++++++++++++++-----
+ 1 file changed, 17 insertions(+), 5 deletions(-)
+
+diff --git a/tests/qemu-iotests/common.rc b/tests/qemu-iotests/common.rc
+index d3bf92031f..538eb349e6 100644
+--- a/tests/qemu-iotests/common.rc
++++ b/tests/qemu-iotests/common.rc
+@@ -56,18 +56,30 @@ poke_file()
+ # peek_file_le 'test.img' 512 2 => 65534
+ peek_file_le()
+ {
+-    # Wrap in echo $() to strip spaces
+-    echo $(od -j"$2" -N"$3" --endian=little -An -vtu"$3" "$1")
++    local val=0 shift=0 byte
++
++    # coreutils' od --endian is not portable, so manually assemble bytes.
++    for byte in $(od -j"$2" -N"$3" -An -v -tu1 "$1"); do
++        val=$(( val | (byte << shift) ))
++        shift=$((shift + 8))
++    done
++    printf %llu $val
+ }
+ 
+ # peek_file_be 'test.img' 512 2 => 65279
+ peek_file_be()
+ {
+-    # Wrap in echo $() to strip spaces
+-    echo $(od -j"$2" -N"$3" --endian=big -An -vtu"$3" "$1")
++    local val=0 byte
++
++    # coreutils' od --endian is not portable, so manually assemble bytes.
++    for byte in $(od -j"$2" -N"$3" -An -v -tu1 "$1"); do
++        val=$(( (val << 8) | byte ))
++    done
++    printf %llu $val
+ }
+ 
+-# peek_file_raw 'test.img' 512 2 => '\xff\xfe'
++# peek_file_raw 'test.img' 512 2 => '\xff\xfe'. Do not use if the raw data
++# is likely to contain \0 or trailing \n.
+ peek_file_raw()
+ {
+     dd if="$1" bs=1 skip="$2" count="$3" status=none
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-iotests-Test-copy-offloading-with-external-data-file.patch b/debian/patches/stable/lp-1891877-iotests-Test-copy-offloading-with-external-data-file.patch
 new file mode 100644
index 0000000..7f2bb10
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-iotests-Test-copy-offloading-with-external-data-file.patch
@@ -0,0 +1,71 @@
+From 373fd948ab33b6e74b227cd62d4ccc4c17417473 Mon Sep 17 00:00:00 2001
+From: Kevin Wolf <[e-mail]>
+Date: Tue, 11 Feb 2020 10:49:00 +0100
+Subject: [PATCH] iotests: Test copy offloading with external data file
+
+This adds a test for 'qemu-img convert' with copy offloading where the
+target image has an external data file. If the test hosts supports it,
+it tests both the case where copy offloading is supported and the case
+where it isn't (otherwise we just test unsupported twice).
+
+More specifically, the case with unsupported copy offloading tests
+qcow2_alloc_cluster_abort() with external data files.
+
+Signed-off-by: Kevin Wolf <[e-mail]>
+Message-Id: <[e-mail]>
+Signed-off-by: Kevin Wolf <[e-mail]>
+(cherry picked from commit a0cf8daf77548786ced84d773f06fc70571c5d38)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=373fd948ab
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ tests/qemu-iotests/244     | 14 ++++++++++++++
+ tests/qemu-iotests/244.out |  6 ++++++
+ 2 files changed, 20 insertions(+)
+
+diff --git a/tests/qemu-iotests/244 b/tests/qemu-iotests/244
+index 13978f93d2..2f5dfb9edd 100755
+--- a/tests/qemu-iotests/244
++++ b/tests/qemu-iotests/244
+@@ -194,6 +194,20 @@ $QEMU_IO -c 'read -P 0x11 0 1M' -f $IMGFMT "$TEST_IMG" | _filter_qemu_io
+ $QEMU_IMG map --output=human "$TEST_IMG" | _filter_testdir
+ $QEMU_IMG map --output=json "$TEST_IMG"
+ 
++echo
++echo "=== Copy offloading ==="
++echo
++
++# Make use of copy offloading if the test host can provide it
++_make_test_img -o "data_file=$TEST_IMG.data" 64M
++$QEMU_IMG convert -f $IMGFMT -O $IMGFMT -n -C "$TEST_IMG.src" "$TEST_IMG"
++$QEMU_IMG compare -f $IMGFMT -F $IMGFMT "$TEST_IMG.src" "$TEST_IMG"
++
++# blkdebug doesn't support copy offloading, so this tests the error path
++$QEMU_IMG amend -f $IMGFMT -o "data_file=blkdebug::$TEST_IMG.data" "$TEST_IMG"
++$QEMU_IMG convert -f $IMGFMT -O $IMGFMT -n -C "$TEST_IMG.src" "$TEST_IMG"
++$QEMU_IMG compare -f $IMGFMT -F $IMGFMT "$TEST_IMG.src" "$TEST_IMG"
++
+ # success, all done
+ echo "*** done"
+ rm -f $seq.full
+diff --git a/tests/qemu-iotests/244.out b/tests/qemu-iotests/244.out
+index 6a3d0067cc..e6f4dc7993 100644
+--- a/tests/qemu-iotests/244.out
++++ b/tests/qemu-iotests/244.out
+@@ -122,4 +122,10 @@ Offset          Length          Mapped to       File
+ 0               0x100000        0               TEST_DIR/t.qcow2.data
+ [{ "start": 0, "length": 1048576, "depth": 0, "zero": false, "data": true, "offset": 0},
+ { "start": 1048576, "length": 66060288, "depth": 0, "zero": true, "data": false}]
++
++=== Copy offloading ===
++
++Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 data_file=TEST_DIR/t.IMGFMT.data
++Images are identical.
++Images are identical.
+ *** done
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1867519-iotests-add-test-for-backup-top-failure-on-permissio.patch b/debian/patches/stable/lp-1891877-iotests-add-test-for-backup-top-failure-on-permissio.patch
 similarity index 85%
 rename from debian/patches/stable/lp-1867519-iotests-add-test-for-backup-top-failure-on-permissio.patch
 rename to debian/patches/stable/lp-1891877-iotests-add-test-for-backup-top-failure-on-permissio.patch
index 790c5d4..8aa1367 100644
--- a/debian/patches/stable/lp-1867519-iotests-add-test-for-backup-top-failure-on-permissio.patch
+++ b/debian/patches/stable/lp-1891877-iotests-add-test-for-backup-top-failure-on-permissio.patch
@@ -1,4 +1,4 @@
-From a541fcc27c98b96da187c7d4573f3270f3ddd283 Mon Sep 17 00:00:00 2001
+From 8952da32c36b8d457d0ebe28c252a7eeab68f127 Mon Sep 17 00:00:00 2001
 From: Vladimir Sementsov-Ogievskiy <[e-mail]>
 Date: Tue, 21 Jan 2020 17:28:02 +0300
 Subject: [PATCH] iotests: add test for backup-top failure on permission
@@ -10,10 +10,12 @@ Cc: [e-mail] # v4.2.0
 Signed-off-by: Vladimir Sementsov-Ogievskiy <[e-mail]>
 Message-id: [e-mail]
 Signed-off-by: Max Reitz <[e-mail]>
+(cherry picked from commit a541fcc27c98b96da187c7d4573f3270f3ddd283)
+Signed-off-by: Michael Roth <[e-mail]>
 
-Origin: backport, https://git.qemu.org/?p=qemu.git;a=commit;h=a541fcc27c98b96da187c7d4573f3270f3ddd283
-Bug-Ubuntu: https://bugs.launchpad.net/bugs/1867519
-Last-Update: 2020-03-18
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=8952da32c3
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
 
 ---
  tests/qemu-iotests/283     | 92 ++++++++++++++++++++++++++++++++++++++
@@ -23,6 +25,9 @@ Last-Update: 2020-03-18
  create mode 100644 tests/qemu-iotests/283
  create mode 100644 tests/qemu-iotests/283.out
 
+diff --git a/tests/qemu-iotests/283 b/tests/qemu-iotests/283
+new file mode 100644
+index 0000000000..293e557bd9
 --- /dev/null
 +++ b/tests/qemu-iotests/283
 @@ -0,0 +1,92 @@
@@ -118,6 +123,9 @@ Last-Update: 2020-03-18
 +vm.qmp_log('blockdev-backup', sync='full', device='source', target='target')
 +
 +vm.shutdown()
+diff --git a/tests/qemu-iotests/283.out b/tests/qemu-iotests/283.out
+new file mode 100644
+index 0000000000..daaf5828c1
 --- /dev/null
 +++ b/tests/qemu-iotests/283.out
 @@ -0,0 +1,8 @@
@@ -129,10 +137,15 @@ Last-Update: 2020-03-18
 +{"return": {}}
 +{"execute": "blockdev-backup", "arguments": {"device": "source", "sync": "full", "target": "target"}}
 +{"error": {"class": "GenericError", "desc": "Cannot set permissions for backup-top filter: Conflicts with use by other as 'image', which uses 'write' on base"}}
+diff --git a/tests/qemu-iotests/group b/tests/qemu-iotests/group
+index 2dc8a6e572..f5e0bf86ce 100644
 --- a/tests/qemu-iotests/group
 +++ b/tests/qemu-iotests/group
-@@ -286,3 +286,4 @@
- 272 rw
+@@ -287,3 +287,4 @@
  273 backing quick
  277 rw quick
+ 289 rw quick
 +283 auto quick
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-m68k-Fix-regression-causing-Single-Step-via-GDB-RSP-.patch b/debian/patches/stable/lp-1891877-m68k-Fix-regression-causing-Single-Step-via-GDB-RSP-.patch
 new file mode 100644
index 0000000..1fa7179
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-m68k-Fix-regression-causing-Single-Step-via-GDB-RSP-.patch
@@ -0,0 +1,108 @@
+From c44015c50c741ebc267e022542fc110ea97197a0 Mon Sep 17 00:00:00 2001
+From: Laurent Vivier <[e-mail]>
+Date: Thu, 16 Jan 2020 17:54:54 +0100
+Subject: [PATCH] m68k: Fix regression causing Single-Step via GDB/RSP to not
+ single step
+
+A regression that was introduced, with the refactor to TranslatorOps,
+drops two lines that update the PC when single-stepping is being performed.
+
+Fixes: 11ab74b01e0a ("target/m68k: Convert to TranslatorOps")
+Reported-by: Lucien Murray-Pitts <[e-mail]>
+Suggested-by: Lucien Murray-Pitts <[e-mail]>
+Suggested-by: Richard Henderson <[e-mail]>
+Reviewed-by: Richard Henderson <[e-mail]>
+Signed-off-by: Laurent Vivier <[e-mail]>
+Message-Id: <[e-mail]>
+(cherry picked from commit 322f244aaa80a5208090d41481c1c09c6face66b)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=c44015c50c
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ target/m68k/translate.c | 42 ++++++++++++++++++++++++++---------------
+ 1 file changed, 27 insertions(+), 15 deletions(-)
+
+diff --git a/target/m68k/translate.c b/target/m68k/translate.c
+index fcdb7bc8e4..16fae5ac9e 100644
+--- a/target/m68k/translate.c
++++ b/target/m68k/translate.c
+@@ -289,16 +289,21 @@ static void gen_jmp(DisasContext *s, TCGv dest)
+     s->base.is_jmp = DISAS_JUMP;
+ }
+ 
+-static void gen_exception(DisasContext *s, uint32_t dest, int nr)
++static void gen_raise_exception(int nr)
+ {
+     TCGv_i32 tmp;
+ 
+-    update_cc_op(s);
+-    tcg_gen_movi_i32(QREG_PC, dest);
+-
+     tmp = tcg_const_i32(nr);
+     gen_helper_raise_exception(cpu_env, tmp);
+     tcg_temp_free_i32(tmp);
++}
++
++static void gen_exception(DisasContext *s, uint32_t dest, int nr)
++{
++    update_cc_op(s);
++    tcg_gen_movi_i32(QREG_PC, dest);
++
++    gen_raise_exception(nr);
+ 
+     s->base.is_jmp = DISAS_NORETURN;
+ }
+@@ -6198,29 +6203,36 @@ static void m68k_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
+ {
+     DisasContext *dc = container_of(dcbase, DisasContext, base);
+ 
+-    if (dc->base.is_jmp == DISAS_NORETURN) {
+-        return;
+-    }
+-    if (dc->base.singlestep_enabled) {
+-        gen_helper_raise_exception(cpu_env, tcg_const_i32(EXCP_DEBUG));
+-        return;
+-    }
+-
+     switch (dc->base.is_jmp) {
++    case DISAS_NORETURN:
++        break;
+     case DISAS_TOO_MANY:
+         update_cc_op(dc);
+-        gen_jmp_tb(dc, 0, dc->pc);
++        if (dc->base.singlestep_enabled) {
++            tcg_gen_movi_i32(QREG_PC, dc->pc);
++            gen_raise_exception(EXCP_DEBUG);
++        } else {
++            gen_jmp_tb(dc, 0, dc->pc);
++        }
+         break;
+     case DISAS_JUMP:
+         /* We updated CC_OP and PC in gen_jmp/gen_jmp_im.  */
+-        tcg_gen_lookup_and_goto_ptr();
++        if (dc->base.singlestep_enabled) {
++            gen_raise_exception(EXCP_DEBUG);
++        } else {
++            tcg_gen_lookup_and_goto_ptr();
++        }
+         break;
+     case DISAS_EXIT:
+         /*
+          * We updated CC_OP and PC in gen_exit_tb, but also modified
+          * other state that may require returning to the main loop.
+          */
+-        tcg_gen_exit_tb(NULL, 0);
++        if (dc->base.singlestep_enabled) {
++            gen_raise_exception(EXCP_DEBUG);
++        } else {
++            tcg_gen_exit_tb(NULL, 0);
++        }
+         break;
+     default:
+         g_assert_not_reached();
+-- 
+2.28.0
+
diff --git a/debian/patches/stable/lp-1891877-migration-Rate-limit-inside-host-pages.patch b/debian/patches/stable/lp-1891877-migration-Rate-limit-inside-host-pages.patch
 new file mode 100644
index 0000000..06e962f
--- /dev/null
+++ b/debian/patches/stable/lp-1891877-migration-Rate-limit-inside-host-pages.patch
@@ -0,0 +1,157 @@
+From 52771abbfa6775db8843f2ee365d45be169887cd Mon Sep 17 00:00:00 2001
+From: "Dr. David Alan Gilbert" <[e-mail]>
+Date: Thu, 5 Dec 2019 10:29:18 +0000
+Subject: [PATCH] migration: Rate limit inside host pages
+
+When using hugepages, rate limiting is necessary within each huge
+page, since a 1G huge page can take a significant time to send, so
+you end up with bursty behaviour.
+
+Fixes: 4c011c37ecb3 ("postcopy: Send whole huge pages")
+Reported-by: Lin Ma <[e-mail]>
+Signed-off-by: Dr. David Alan Gilbert <[e-mail]>
+Reviewed-by: Juan Quintela <[e-mail]>
+Reviewed-by: Peter Xu <[e-mail]>
+Signed-off-by: Juan Quintela <[e-mail]>
+(cherry picked from commit 97e1e06780e70f6e98a0d2df881e0c0927d3aeb6)
+Signed-off-by: Michael Roth <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=52771abbfa
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1891877
+Last-Update: 2020-08-19
+
+---
+ migration/migration.c  | 57 ++++++++++++++++++++++++------------------
+ migration/migration.h  |  1 +
+ migration/ram.c        |  2 ++
+ migration/trace-events |  4 +--
+ 4 files changed, 37 insertions(+), 27 deletions(-)
+
+diff --git a/migration/migration.c b/migration/migration.c
+index 354ad072fa..27500d09a9 100644
+--- a/migration/migration.c
++++ b/migration/migration.c
+@@ -3224,6 +3224,37 @@ void migration_consume_urgent_request(void)
+     qemu_sem_wait(&migrate_get_current()->rate_limit_sem);
+ }
+ 
++/* Returns true if the rate limiting was broken by an urgent request */
++bool migration_rate_limit(void)
++{
++    int64_t now = qemu_clock_get_ms(QEMU_CLOCK_REALTIME);
++    MigrationState *s = migrate_get_current();
++
++    bool urgent = false;
++    migration_update_counters(s, now);
++    if (qemu_file_rate_limit(s->to_dst_file)) {
++        /*
++         * Wait for a delay to do rate limiting OR
++         * something urgent to post the semaphore.
++         */
++        int ms = s->iteration_start_time + BUFFER_DELAY - now;
++        trace_migration_rate_limit_pre(ms);
++        if (qemu_sem_timedwait(&s->rate_limit_sem, ms) == 0) {
++            /*
++             * We were woken by one or more urgent things but
++             * the timedwait will have consumed one of them.
++             * The service routine for the urgent wake will dec
++             * the semaphore itself for each item it consumes,
++             * so add this one we just eat back.
++             */
++            qemu_sem_post(&s->rate_limit_sem);
++            urgent = true;
++        }
++        trace_migration_rate_limit_post(urgent);
++    }
++    return urgent;
++}
++
+ /*
+  * Master migration thread on the source VM.
+  * It drives the migration and pumps the data down the outgoing channel.
+@@ -3290,8 +3321,6 @@ static void *migration_thread(void *opaque)
+     trace_migration_thread_setup_complete();
+ 
+     while (migration_is_active(s)) {
+-        int64_t current_time;
+-
+         if (urgent || !qemu_file_rate_limit(s->to_dst_file)) {
+             MigIterateState iter_state = migration_iteration_run(s);
+             if (iter_state == MIG_ITERATE_SKIP) {
+@@ -3318,29 +3347,7 @@ static void *migration_thread(void *opaque)
+             update_iteration_initial_status(s);
+         }
+ 
+-        current_time = qemu_clock_get_ms(QEMU_CLOCK_REALTIME);
+-
+-        migration_update_counters(s, current_time);
+-
+-        urgent = false;
+-        if (qemu_file_rate_limit(s->to_dst_file)) {
+-            /* Wait for a delay to do rate limiting OR
+-             * something urgent to post the semaphore.
+-             */
+-            int ms = s->iteration_start_time + BUFFER_DELAY - current_time;
+-            trace_migration_thread_ratelimit_pre(ms);
+-            if (qemu_sem_timedwait(&s->rate_limit_sem, ms) == 0) {
+-                /* We were worken by one or more urgent things but
+-                 * the timedwait will have consumed one of them.
+-                 * The service routine for the urgent wake will dec
+-                 * the semaphore itself for each item it consumes,
+-                 * so add this one we just eat back.
+-                 */
+-                qemu_sem_post(&s->rate_limit_sem);
+-                urgent = true;
+-            }
+-            trace_migration_thread_ratelimit_post(urgent);
+-        }