Merge ~paelzer/ubuntu/+source/qemu:bug-1887490-EPYC-v3-1849644-websocket-1896751-migratereboot into ubuntu/+source/qemu:ubuntu/focal-devel

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

SRU Templates ready, PPA at https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/4161

[Robie Basak (racb)]

review: Approve (sru)

[Christian Ehrhardt  (paelzer)]

To ssh://git.launchpad.net/~usd-import-team/ubuntu/+source/qemu
 * [new tag] upload/1%4.2-3ubuntu6.7 -> upload/1%4.2-3ubuntu6.7

Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading qemu_4.2-3ubuntu6.7.dsc: done.
  Uploading qemu_4.2-3ubuntu6.7.debian.tar.xz: done.
  Uploading qemu_4.2-3ubuntu6.7_source.buildinfo: done.
  Uploading qemu_4.2-3ubuntu6.7_source.changes: done.
Successfully uploaded packages.

diff --git a/debian/changelog b/debian/changelog
index be7e622..39477a0 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,13 @@
+qemu (1:4.2-3ubuntu6.7) focal; urgency=medium
+
+  * d/p/ubuntu/lp-1882774-*: add newer EPYC processor types (LP: #1887490)
+  * d/p/u/lp-1896751-exec-rom_reset-Free-rom-data-during-inmigrate-skip.patch:
+    fix reboot after migration (LP: #1896751)
+  * d/p/u/lp-1849644-io-channel-websock-treat-binary-and-no-sub-protocol-.patch:
+    fix websocket compatibility with newer versions of noVNC (LP: #1849644)
+
+ -- Christian Ehrhardt <[e-mail]>  Mon, 27 Jul 2020 11:45:26 +0200
+
 qemu (1:4.2-3ubuntu6.6) focal-security; urgency=medium
 
   * SECURITY UPDATE: out-of-bounds read/write in USB emulator
diff --git a/debian/patches/series b/debian/patches/series
index 456dc1f..4e3be76 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -225,3 +225,7 @@ ubuntu/lp-1883984-target-s390x-Fix-SQXBR.patch
 ubuntu/lp-1890154-s390x-protvirt-allow-to-IPL-secure-guests-with-no-re.patch
 ubuntu/hw-riscv-Allow-64-bit-access-to-SiFive-CLINT.patch
 ubuntu/CVE-2020-14364.patch
+ubuntu/lp-1882774-i386-Add-missing-cpu-feature-bits-in-EPYC-model.patch
+ubuntu/lp-1882774-i386-Add-2nd-Generation-AMD-EPYC-processors.patch
+ubuntu/lp-1896751-exec-rom_reset-Free-rom-data-during-inmigrate-skip.patch
+ubuntu/lp-1849644-io-channel-websock-treat-binary-and-no-sub-protocol-.patch
diff --git a/debian/patches/ubuntu/lp-1849644-io-channel-websock-treat-binary-and-no-sub-protocol-.patch b/debian/patches/ubuntu/lp-1849644-io-channel-websock-treat-binary-and-no-sub-protocol-.patch
new file mode 100644
index 0000000..979c67f
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1849644-io-channel-websock-treat-binary-and-no-sub-protocol-.patch
@@ -0,0 +1,127 @@
+From c64e1e75381d0cb53f9fc8f93245a933b12c68a6 Mon Sep 17 00:00:00 2001
+From: Yu-Chen Lin <[e-mail]>
+Date: Sat, 23 Nov 2019 11:43:06 +0800
+Subject: [PATCH] io/channel-websock: treat 'binary' and no sub-protocol as the
+ same
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+noVNC doesn't use 'binary' protocol by default after
+commit c912230309806aacbae4295faf7ad6406da97617.
+
+It will cause qemu return 400 when handshaking.
+
+To overcome this problem and remain compatibility of
+older noVNC client.
+
+We treat 'binary' and no sub-protocol as the same
+so that we can support different version of noVNC
+client.
+
+Tested on noVNC before c912230 and after c912230.
+
+Buglink: https://bugs.launchpad.net/qemu/+bug/1849644
+
+Signed-off-by: Yu-Chen Lin <[e-mail]>
+Signed-off-by: Daniel P. Berrangé <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=c64e1e75381d
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1849644
+Last-Update: 2020-09-24
+
+---
+ io/channel-websock.c | 36 ++++++++++++++++++++++++------------
+ 1 file changed, 24 insertions(+), 12 deletions(-)
+
+diff --git a/io/channel-websock.c b/io/channel-websock.c
+index fc36d44eba..47a0e941d9 100644
+--- a/io/channel-websock.c
++++ b/io/channel-websock.c
+@@ -49,13 +49,20 @@
+     "Server: QEMU VNC\r\n"                       \
+     "Date: %s\r\n"
+ 
++#define QIO_CHANNEL_WEBSOCK_HANDSHAKE_WITH_PROTO_RES_OK \
++    "HTTP/1.1 101 Switching Protocols\r\n"              \
++    QIO_CHANNEL_WEBSOCK_HANDSHAKE_RES_COMMON            \
++    "Upgrade: websocket\r\n"                            \
++    "Connection: Upgrade\r\n"                           \
++    "Sec-WebSocket-Accept: %s\r\n"                      \
++    "Sec-WebSocket-Protocol: binary\r\n"                \
++    "\r\n"
+ #define QIO_CHANNEL_WEBSOCK_HANDSHAKE_RES_OK    \
+     "HTTP/1.1 101 Switching Protocols\r\n"      \
+     QIO_CHANNEL_WEBSOCK_HANDSHAKE_RES_COMMON    \
+     "Upgrade: websocket\r\n"                    \
+     "Connection: Upgrade\r\n"                   \
+     "Sec-WebSocket-Accept: %s\r\n"              \
+-    "Sec-WebSocket-Protocol: binary\r\n"        \
+     "\r\n"
+ #define QIO_CHANNEL_WEBSOCK_HANDSHAKE_RES_NOT_FOUND \
+     "HTTP/1.1 404 Not Found\r\n"                    \
+@@ -336,6 +343,7 @@ qio_channel_websock_find_header(QIOChannelWebsockHTTPHeader *hdrs,
+ 
+ static void qio_channel_websock_handshake_send_res_ok(QIOChannelWebsock *ioc,
+                                                       const char *key,
++                                                      const bool use_protocols,
+                                                       Error **errp)
+ {
+     char combined_key[QIO_CHANNEL_WEBSOCK_CLIENT_KEY_LEN +
+@@ -361,8 +369,14 @@ static void qio_channel_websock_handshake_send_res_ok(QIOChannelWebsock *ioc,
+     }
+ 
+     date = qio_channel_websock_date_str();
+-    qio_channel_websock_handshake_send_res(
+-        ioc, QIO_CHANNEL_WEBSOCK_HANDSHAKE_RES_OK, date, accept);
++    if (use_protocols) {
++            qio_channel_websock_handshake_send_res(
++                ioc, QIO_CHANNEL_WEBSOCK_HANDSHAKE_WITH_PROTO_RES_OK,
++                date, accept);
++    } else {
++            qio_channel_websock_handshake_send_res(
++                ioc, QIO_CHANNEL_WEBSOCK_HANDSHAKE_RES_OK, date, accept);
++    }
+ 
+     g_free(date);
+     g_free(accept);
+@@ -387,10 +401,6 @@ static void qio_channel_websock_handshake_process(QIOChannelWebsock *ioc,
+ 
+     protocols = qio_channel_websock_find_header(
+         hdrs, nhdrs, QIO_CHANNEL_WEBSOCK_HEADER_PROTOCOL);
+-    if (!protocols) {
+-        error_setg(errp, "Missing websocket protocol header data");
+-        goto bad_request;
+-    }
+ 
+     version = qio_channel_websock_find_header(
+         hdrs, nhdrs, QIO_CHANNEL_WEBSOCK_HEADER_VERSION);
+@@ -430,10 +440,12 @@ static void qio_channel_websock_handshake_process(QIOChannelWebsock *ioc,
+     trace_qio_channel_websock_http_request(ioc, protocols, version,
+                                            host, connection, upgrade, key);
+ 
+-    if (!g_strrstr(protocols, QIO_CHANNEL_WEBSOCK_PROTOCOL_BINARY)) {
+-        error_setg(errp, "No '%s' protocol is supported by client '%s'",
+-                   QIO_CHANNEL_WEBSOCK_PROTOCOL_BINARY, protocols);
+-        goto bad_request;
++    if (protocols) {
++            if (!g_strrstr(protocols, QIO_CHANNEL_WEBSOCK_PROTOCOL_BINARY)) {
++                error_setg(errp, "No '%s' protocol is supported by client '%s'",
++                           QIO_CHANNEL_WEBSOCK_PROTOCOL_BINARY, protocols);
++                goto bad_request;
++            }
+     }
+ 
+     if (!g_str_equal(version, QIO_CHANNEL_WEBSOCK_SUPPORTED_VERSION)) {
+@@ -467,7 +479,7 @@ static void qio_channel_websock_handshake_process(QIOChannelWebsock *ioc,
+         goto bad_request;
+     }
+ 
+-    qio_channel_websock_handshake_send_res_ok(ioc, key, errp);
++    qio_channel_websock_handshake_send_res_ok(ioc, key, !!protocols, errp);
+     return;
+ 
+  bad_request:
+-- 
+2.28.0
+
diff --git a/debian/patches/ubuntu/lp-1882774-i386-Add-2nd-Generation-AMD-EPYC-processors.patch b/debian/patches/ubuntu/lp-1882774-i386-Add-2nd-Generation-AMD-EPYC-processors.patch
new file mode 100644
index 0000000..2b2328d
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1882774-i386-Add-2nd-Generation-AMD-EPYC-processors.patch
@@ -0,0 +1,191 @@
+From 143c30d4d346831a09e59e9af45afdca0331e819 Mon Sep 17 00:00:00 2001
+From: "Moger, Babu" <[e-mail]>
+Date: Thu, 7 Nov 2019 18:01:04 +0000
+Subject: [PATCH] i386: Add 2nd Generation AMD EPYC processors
+
+Adds the support for 2nd Gen AMD EPYC Processors. The model display
+name will be EPYC-Rome.
+
+Adds the following new feature bits on top of the feature bits from the
+first generation EPYC models.
+perfctr-core : core performance counter extensions support. Enables the VM to
+               use extended performance counter support. It enables six
+               programmable counters instead of four counters.
+clzero       : instruction zeroes out the 64 byte cache line specified in RAX.
+xsaveerptr   : XSAVE, XSAVE, FXSAVEOPT, XSAVEC, XSAVES always save error
+               pointers and FXRSTOR, XRSTOR, XRSTORS always restore error
+               pointers.
+wbnoinvd     : Write back and do not invalidate cache
+ibpb         : Indirect Branch Prediction Barrier
+amd-stibp    : Single Thread Indirect Branch Predictor
+clwb         : Cache Line Write Back and Retain
+xsaves       : XSAVES, XRSTORS and IA32_XSS support
+rdpid        : Read Processor ID instruction support
+umip         : User-Mode Instruction Prevention support
+
+The  Reference documents are available at
+https://developer.amd.com/wp-content/resources/55803_0.54-PUB.pdf
+https://www.amd.com/system/files/TechDocs/24594.pdf
+
+Depends on following kernel commits:
+40bc47b08b6e ("kvm: x86: Enumerate support for CLZERO instruction")
+504ce1954fba ("KVM: x86: Expose XSAVEERPTR to the guest")
+6d61e3c32248 ("kvm: x86: Expose RDPID in KVM_GET_SUPPORTED_CPUID")
[phone]d ("kvm: svm: Update svm_xsaves_supported")
+
+Signed-off-by: Babu Moger <[e-mail]>
+Message-Id: <[e-mail]>
+Signed-off-by: Eduardo Habkost <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=143c30d4d346831a09e59e9af45afdca0331e819
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1882774
+Last-Update: 2020-07-27
+
+---
+ target/i386/cpu.c | 102 +++++++++++++++++++++++++++++++++++++++++++++-
+ target/i386/cpu.h |   2 +
+ 2 files changed, 103 insertions(+), 1 deletion(-)
+
+diff --git a/target/i386/cpu.c b/target/i386/cpu.c
+index 54f42dcd25..350b51b346 100644
+--- a/target/i386/cpu.c
++++ b/target/i386/cpu.c
+@@ -1133,7 +1133,7 @@ static FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
+             "clzero", NULL, "xsaveerptr", NULL,
+             NULL, NULL, NULL, NULL,
+             NULL, "wbnoinvd", NULL, NULL,
+-            "ibpb", NULL, NULL, NULL,
++            "ibpb", NULL, NULL, "amd-stibp",
+             NULL, NULL, NULL, NULL,
+             NULL, NULL, NULL, NULL,
+             "amd-ssbd", "virt-ssbd", "amd-no-ssb", NULL,
+@@ -1798,6 +1798,56 @@ static CPUCaches epyc_cache_info = {
+     },
+ };
+ 
++static CPUCaches epyc_rome_cache_info = {
++    .l1d_cache = &(CPUCacheInfo) {
++        .type = DATA_CACHE,
++        .level = 1,
++        .size = 32 * KiB,
++        .line_size = 64,
++        .associativity = 8,
++        .partitions = 1,
++        .sets = 64,
++        .lines_per_tag = 1,
++        .self_init = 1,
++        .no_invd_sharing = true,
++    },
++    .l1i_cache = &(CPUCacheInfo) {
++        .type = INSTRUCTION_CACHE,
++        .level = 1,
++        .size = 32 * KiB,
++        .line_size = 64,
++        .associativity = 8,
++        .partitions = 1,
++        .sets = 64,
++        .lines_per_tag = 1,
++        .self_init = 1,
++        .no_invd_sharing = true,
++    },
++    .l2_cache = &(CPUCacheInfo) {
++        .type = UNIFIED_CACHE,
++        .level = 2,
++        .size = 512 * KiB,
++        .line_size = 64,
++        .associativity = 8,
++        .partitions = 1,
++        .sets = 1024,
++        .lines_per_tag = 1,
++    },
++    .l3_cache = &(CPUCacheInfo) {
++        .type = UNIFIED_CACHE,
++        .level = 3,
++        .size = 16 * MiB,
++        .line_size = 64,
++        .associativity = 16,
++        .partitions = 1,
++        .sets = 16384,
++        .lines_per_tag = 1,
++        .self_init = true,
++        .inclusive = true,
++        .complex_indexing = true,
++    },
++};
++
+ /* The following VMX features are not supported by KVM and are left out in the
+  * CPU definitions:
+  *
+@@ -4030,6 +4080,56 @@ static X86CPUDefinition builtin_x86_defs[] = {
+         .model_id = "Hygon Dhyana Processor",
+         .cache_info = &epyc_cache_info,
+     },
++    {
++        .name = "EPYC-Rome",
++        .level = 0xd,
++        .vendor = CPUID_VENDOR_AMD,
++        .family = 23,
++        .model = 49,
++        .stepping = 0,
++        .features[FEAT_1_EDX] =
++            CPUID_SSE2 | CPUID_SSE | CPUID_FXSR | CPUID_MMX | CPUID_CLFLUSH |
++            CPUID_PSE36 | CPUID_PAT | CPUID_CMOV | CPUID_MCA | CPUID_PGE |
++            CPUID_MTRR | CPUID_SEP | CPUID_APIC | CPUID_CX8 | CPUID_MCE |
++            CPUID_PAE | CPUID_MSR | CPUID_TSC | CPUID_PSE | CPUID_DE |
++            CPUID_VME | CPUID_FP87,
++        .features[FEAT_1_ECX] =
++            CPUID_EXT_RDRAND | CPUID_EXT_F16C | CPUID_EXT_AVX |
++            CPUID_EXT_XSAVE | CPUID_EXT_AES |  CPUID_EXT_POPCNT |
++            CPUID_EXT_MOVBE | CPUID_EXT_SSE42 | CPUID_EXT_SSE41 |
++            CPUID_EXT_CX16 | CPUID_EXT_FMA | CPUID_EXT_SSSE3 |
++            CPUID_EXT_MONITOR | CPUID_EXT_PCLMULQDQ | CPUID_EXT_SSE3,
++        .features[FEAT_8000_0001_EDX] =
++            CPUID_EXT2_LM | CPUID_EXT2_RDTSCP | CPUID_EXT2_PDPE1GB |
++            CPUID_EXT2_FFXSR | CPUID_EXT2_MMXEXT | CPUID_EXT2_NX |
++            CPUID_EXT2_SYSCALL,
++        .features[FEAT_8000_0001_ECX] =
++            CPUID_EXT3_OSVW | CPUID_EXT3_3DNOWPREFETCH |
++            CPUID_EXT3_MISALIGNSSE | CPUID_EXT3_SSE4A | CPUID_EXT3_ABM |
++            CPUID_EXT3_CR8LEG | CPUID_EXT3_SVM | CPUID_EXT3_LAHF_LM |
++            CPUID_EXT3_TOPOEXT | CPUID_EXT3_PERFCORE,
++        .features[FEAT_8000_0008_EBX] =
++            CPUID_8000_0008_EBX_CLZERO | CPUID_8000_0008_EBX_XSAVEERPTR |
++            CPUID_8000_0008_EBX_WBNOINVD | CPUID_8000_0008_EBX_IBPB |
++            CPUID_8000_0008_EBX_STIBP,
++        .features[FEAT_7_0_EBX] =
++            CPUID_7_0_EBX_FSGSBASE | CPUID_7_0_EBX_BMI1 | CPUID_7_0_EBX_AVX2 |
++            CPUID_7_0_EBX_SMEP | CPUID_7_0_EBX_BMI2 | CPUID_7_0_EBX_RDSEED |
++            CPUID_7_0_EBX_ADX | CPUID_7_0_EBX_SMAP | CPUID_7_0_EBX_CLFLUSHOPT |
++            CPUID_7_0_EBX_SHA_NI | CPUID_7_0_EBX_CLWB,
++        .features[FEAT_7_0_ECX] =
++            CPUID_7_0_ECX_UMIP | CPUID_7_0_ECX_RDPID,
++        .features[FEAT_XSAVE] =
++            CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XSAVEC |
++            CPUID_XSAVE_XGETBV1 | CPUID_XSAVE_XSAVES,
++        .features[FEAT_6_EAX] =
++            CPUID_6_EAX_ARAT,
++        .features[FEAT_SVM] =
++            CPUID_SVM_NPT | CPUID_SVM_NRIPSAVE,
++        .xlevel = 0x8000001E,
++        .model_id = "AMD EPYC-Rome Processor",
++        .cache_info = &epyc_rome_cache_info,
++    },
+ };
+ 
+ /* KVM-specific features that are automatically added/removed
+diff --git a/target/i386/cpu.h b/target/i386/cpu.h
+index 576f309bbf..68b186d258 100644
+--- a/target/i386/cpu.h
++++ b/target/i386/cpu.h
+@@ -792,6 +792,8 @@ typedef uint64_t FeatureWordArray[FEATURE_WORDS];
+ #define CPUID_8000_0008_EBX_WBNOINVD    (1U << 9)
+ /* Indirect Branch Prediction Barrier */
+ #define CPUID_8000_0008_EBX_IBPB        (1U << 12)
++/* Single Thread Indirect Branch Predictors */
++#define CPUID_8000_0008_EBX_STIBP       (1U << 15)
+ 
+ #define CPUID_XSAVE_XSAVEOPT   (1U << 0)
+ #define CPUID_XSAVE_XSAVEC     (1U << 1)
+-- 
+2.27.0
+
diff --git a/debian/patches/ubuntu/lp-1882774-i386-Add-missing-cpu-feature-bits-in-EPYC-model.patch b/debian/patches/ubuntu/lp-1882774-i386-Add-missing-cpu-feature-bits-in-EPYC-model.patch
new file mode 100644
index 0000000..db0b681
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1882774-i386-Add-missing-cpu-feature-bits-in-EPYC-model.patch
@@ -0,0 +1,76 @@
+From a16e8dbc043720abcb37fc7dca313e720b4e0f0c Mon Sep 17 00:00:00 2001
+From: "Moger, Babu" <[e-mail]>
+Date: Thu, 7 Nov 2019 18:00:57 +0000
+Subject: [PATCH] i386: Add missing cpu feature bits in EPYC model
+
+Adds the following missing CPUID bits:
+perfctr-core : core performance counter extensions support. Enables the VM
+               to use extended performance counter support. It enables six
+               programmable counters instead of 4 counters.
+clzero       : instruction zeroes out the 64 byte cache line specified in RAX.
+xsaveerptr   : XSAVE, XSAVE, FXSAVEOPT, XSAVEC, XSAVES always save error
+               pointers and FXRSTOR, XRSTOR, XRSTORS always restore error
+               pointers.
+ibpb         : Indirect Branch Prediction Barrie.
+xsaves       : XSAVES, XRSTORS and IA32_XSS supported.
+
+Depends on following kernel commits:
+40bc47b08b6e ("kvm: x86: Enumerate support for CLZERO instruction")
+504ce1954fba ("KVM: x86: Expose XSAVEERPTR to the guest")
[phone]d ("kvm: svm: Update svm_xsaves_supported")
+
+These new features will be added in EPYC-v3. The -cpu help output after the change.
+x86 EPYC-v1               AMD EPYC Processor
+x86 EPYC-v2               AMD EPYC Processor (with IBPB)
+x86 EPYC-v3               AMD EPYC Processor
+
+Signed-off-by: Babu Moger <[e-mail]>
+Message-Id: <[e-mail]>
+Signed-off-by: Eduardo Habkost <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=a16e8dbc043720abcb37fc7dca313e720b4e0f0c
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1882774
+Last-Update: 2020-07-27
+
+---
+ target/i386/cpu.c | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+diff --git a/target/i386/cpu.c b/target/i386/cpu.c
+index dc78494167..54f42dcd25 100644
+--- a/target/i386/cpu.c
++++ b/target/i386/cpu.c
+@@ -3942,10 +3942,6 @@ static X86CPUDefinition builtin_x86_defs[] = {
+             CPUID_7_0_EBX_SMEP | CPUID_7_0_EBX_BMI2 | CPUID_7_0_EBX_RDSEED |
+             CPUID_7_0_EBX_ADX | CPUID_7_0_EBX_SMAP | CPUID_7_0_EBX_CLFLUSHOPT |
+             CPUID_7_0_EBX_SHA_NI,
+-        /* Missing: XSAVES (not supported by some Linux versions,
+-         * including v4.1 to v4.12).
+-         * KVM doesn't yet expose any XSAVES state save component.
+-         */
+         .features[FEAT_XSAVE] =
+             CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XSAVEC |
+             CPUID_XSAVE_XGETBV1,
+@@ -3968,6 +3964,19 @@ static X86CPUDefinition builtin_x86_defs[] = {
+                     { /* end of list */ }
+                 }
+             },
++            {
++                .version = 3,
++                .props = (PropValue[]) {
++                    { "ibpb", "on" },
++                    { "perfctr-core", "on" },
++                    { "clzero", "on" },
++                    { "xsaveerptr", "on" },
++                    { "xsaves", "on" },
++                    { "model-id",
++                      "AMD EPYC Processor" },
++                    { /* end of list */ }
++                }
++            },
+             { /* end of list */ }
+         }
+     },
+-- 
+2.27.0
+
diff --git a/debian/patches/ubuntu/lp-1896751-exec-rom_reset-Free-rom-data-during-inmigrate-skip.patch b/debian/patches/ubuntu/lp-1896751-exec-rom_reset-Free-rom-data-during-inmigrate-skip.patch
new file mode 100644
index 0000000..75f4cff
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1896751-exec-rom_reset-Free-rom-data-during-inmigrate-skip.patch
@@ -0,0 +1,72 @@
+From 5073b5d3ea303d37f4a8e2ea451d7a2eb1817448 Mon Sep 17 00:00:00 2001
+From: "Dr. David Alan Gilbert" <[e-mail]>
+Date: Fri, 13 Mar 2020 15:59:39 +0000
+Subject: [PATCH] exec/rom_reset: Free rom data during inmigrate skip
+
+Commit 355477f8c73e9 skips rom reset when we're an incoming migration
+so as not to overwrite shared ram in the ignore-shared migration
+optimisation.
+However, it's got an unexpected side effect that because it skips
+freeing the ROM data, when rom_reset gets called later on, after
+migration (e.g. during a reboot), the ROM does get reset to the original
+file contents.  Because of seabios/x86's weird reboot process
+this confuses a reboot into hanging after a migration.
+
+Fixes: 355477f8c73e9 ("migration: do not rom_reset() during incoming migration")
+https://bugzilla.redhat.com/show_bug.cgi?id=1809380
+
+Signed-off-by: Dr. David Alan Gilbert <[e-mail]>
+Reviewed-by: Peter Maydell <[e-mail]>
+Signed-off-by: Paolo Bonzini <[e-mail]>
+
+Origin: upstream, https://git.qemu.org/?p=qemu.git;a=commit;h=5073b5d3ea303d37
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1896751
+Last-Update: 2020-09-24
+
+---
+ hw/core/loader.c | 25 ++++++++++++++++---------
+ 1 file changed, 16 insertions(+), 9 deletions(-)
+
+diff --git a/hw/core/loader.c b/hw/core/loader.c
+index d1b78f60cd..eeef6da9a1 100644
+--- a/hw/core/loader.c
++++ b/hw/core/loader.c
+@@ -1119,19 +1119,26 @@ static void rom_reset(void *unused)
+ {
+     Rom *rom;
+ 
+-    /*
+-     * We don't need to fill in the RAM with ROM data because we'll fill
+-     * the data in during the next incoming migration in all cases.  Note
+-     * that some of those RAMs can actually be modified by the guest on ARM
+-     * so this is probably the only right thing to do here.
+-     */
+-    if (runstate_check(RUN_STATE_INMIGRATE))
+-        return;
+-
+     QTAILQ_FOREACH(rom, &roms, next) {
+         if (rom->fw_file) {
+             continue;
+         }
++        /*
++         * We don't need to fill in the RAM with ROM data because we'll fill
++         * the data in during the next incoming migration in all cases.  Note
++         * that some of those RAMs can actually be modified by the guest.
++         */
++        if (runstate_check(RUN_STATE_INMIGRATE)) {
++            if (rom->data && rom->isrom) {
++                /*
++                 * Free it so that a rom_reset after migration doesn't
++                 * overwrite a potentially modified 'rom'.
++                 */
++                rom_free_data(rom);
++            }
++            continue;
++        }
++
+         if (rom->data == NULL) {
+             continue;
+         }
+-- 
+2.28.0
+