Merge ~paelzer/ubuntu/+source/qemu:merge-6.0-2exp-impish into ubuntu/+source/qemu:ubuntu/devel

[Christian Ehrhardt ]

Unmerged commits

5abe357... by Christian Ehrhardt  on 2021-08-12

changelog: 1:6.0+dfsg-2expubuntu1

Signed-off-by: Christian Ehrhardt <email address hidden>

d461655... by Christian Ehrhardt  on 2021-08-16

d/p/u/lp-1932175-s390x-cpumodel-add-3931-and-3932.patch: add new 3931 and 3932 machines (LP: #1932175)

Signed-off-by: Christian Ehrhardt <email address hidden>

be207da... by Christian Ehrhardt  on 2021-08-16

d/optionrom.mak, d/p/u/avoid-fcf-clashing-with-i486.patch: fix
-fcf-protection being unavailble on -march=i486 (LP: #1940029)

Note: Can be dropped once fixed in the compiler toolchain.

Signed-off-by: Christian Ehrhardt <email address hidden>

a75600c... by Christian Ehrhardt  on 2021-08-12

d/control: regenerated from d/control-in

Signed-off-by: Christian Ehrhardt <email address hidden>

1315416... by Christian Ehrhardt  on 2021-06-15

merge-changelogs

Signed-off-by: Christian Ehrhardt <email address hidden>

fea132d... by Christian Ehrhardt  on 2021-06-21

debian/qemu-block-extra.postinst: enable mount unit on install/upgrade

Note: this default-on behavior might stay Ubuntu-only as Debian would
prefer an opt-in, while we'd like it to work out of the box.

Signed-off-by: Christian Ehrhardt <email address hidden>

e58e184... by Christian Ehrhardt  on 2021-06-15

d/p/ubuntu/lp-1929926-target-s390x-Fix-translation-exception-on-illegal-in.patch: avoid segfaults by uretprobes (LP: #1929926)

Signed-off-by: Christian Ehrhardt <email address hidden>

8a24cc3... by Christian Ehrhardt  on 2021-06-15

d/p/ubuntu/define-ubuntu-machine-types.patch: add ubuntu machine types for v6.0

Signed-off-by: Christian Ehrhardt <email address hidden>

bba6c7b... by Christian Ehrhardt  on 2021-06-15

d/p/ubuntu/enable-svm-by-default.patch: update to match v6.0

Signed-off-by: Christian Ehrhardt <email address hidden>

0b0596c... by Christian Ehrhardt  on 2020-06-17

d/control.in: Make qemu-system-x86-microvm a transitional package (drop after 22.04)

Signed-off-by: Christian Ehrhardt <email address hidden>

diff --git a/debian/changelog b/debian/changelog
index 244f19a..32b8162 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,109 @@
+<<<<<<< debian/changelog
+=======
+qemu (1:6.0+dfsg-2expubuntu1) impish; urgency=medium
+
+  * Merge with Debian experimental, remaining changes:
+    - qemu-kvm to systemd unit
+      - d/qemu-kvm-init: script for QEMU KVM preparation modules, ksm,
+        hugepages and architecture specifics
+      - d/qemu-system-common.qemu-kvm.service: systemd unit to call
+        qemu-kvm-init
+      - d/qemu-system-common.install: install helper script
+      - d/qemu-system-common.qemu-kvm.default: defaults for
+        /etc/default/qemu-kvm
+      - d/rules: call dh_installinit and dh_installsystemd for qemu-kvm
+    - Distribution specific machine type
+      (LP: 1304107 1621042 1776189 1761372 1761372 1776189)
+      - d/p/ubuntu/define-ubuntu-machine-types.patch: define distro machine
+        types containing release versioned machine attributes
+      - d/qemu-system-x86.NEWS Info on fixed machine type defintions
+        for host-phys-bits=true
+      - Add an info about -hpb machine type in debian/qemu-system-x86.NEWS
+      - ubuntu-q35 alias added to auto-select the most recent q35 ubuntu type
+    - Enable nesting by default
+      - d/p/ubuntu/enable-svm-by-default.patch: Enable nested svm by default
+        in qemu64 on amd
+        [ No more strictly needed, but required for backward compatibility ]
+    - improved dependencies
+      - Make qemu-system-common depend on qemu-block-extra
+      - Make qemu-utils depend on qemu-block-extra
+    - tolerate ipxe size change on migrations to >=18.04 (LP: 1713490)
+      - d/p/ubuntu/pre-bionic-256k-ipxe-efi-roms.patch: old machine types
+        reference 256k path
+      - d/control-in: depend on ipxe-qemu-256k-compat-efi-roms to be able to
+        handle incoming migrations from former releases.
+    - d/qemu-system-x86.README.Debian: add info about updated nesting changes
+    - d/control*, d/rules: disable xen by default, but provide universe
+      package qemu-system-x86-xen as alternative
+      [includes compat links changes of 5.0-5ubuntu4]
+    - d/p/ubuntu/enable-svm-by-default.patch: update to match v6.0
+    - d/p/ubuntu/define-ubuntu-machine-types.patch: add ubuntu machine types
+      for v6.0
+    - d/p/ubuntu/lp-1929926-*: avoid segfaults by uretprobes (LP 1929926)
+    - Ease the use of module retention on upgrades (LP 1913421)
+      - debian/qemu-block-extra.postinst: enable mount unit on install/upgrade
+  * Dropped Changes [in 1:6.0+dfsg-2exp]:
+    - d/control-in: Disable capstone disassembler library support (universe)
+    - Disable fuse export (universe dependency)
+    - Ease the use of module retention on upgrades (LP 1913421)
+      - d/run-qemu.mount, d/rules: provide run-qemu.mount in qemu-block-extra
+      - d/rules: only save modules if /run/qemu isn't noexec
+      - d/rules: clear all (current and former) modules on purge
+    - d/control: qemu 6.0 broke libvirt <7.2 add a breaks to avoid partial
+      upgrade issues (LP 1932264)
+    - Enable SDL as secondary UI backend (LP 1256185)
+      - d/control: add build dependency libsdl2-dev
+      - d/control: enable sdl graphics on build
+      - d/qemu-system-gui.install: add ui-sdl.so
+      - d/control: add runtime dependency to libgl1
+  * Dropped Changes [no more needed]
+    - let qemu-utils recommend sharutils
+  * Added changes:
+    - d/optionrom.mak, d/p/u/avoid-fcf-clashing-with-i486.patch: fix
+      -fcf-protection being unavailble on -march=i486 (LP: #1940029)
+    - d/p/u/lp-1932175-s390x-cpumodel-add-3931-and-3932.patch: add new 3931
+      and 3932 machines (LP: #1932175)
+
+ -- Christian Ehrhardt <[e-mail]>  Thu, 12 Aug 2021 15:35:12 +0200
+
+qemu (1:6.0+dfsg-2exp) experimental; urgency=medium
+
+  [ Christian Ehrhardt ]
+  * qemu 6.0 broke libvirt <7.2, add a Breaks
+    to avoid partial upgrade issues (LP: #1932264)
+  * enable SDL as secondary UI backend (LP: #1256185)
+  * clear all (current and former) modules on purge
+  * only save modules if /run/qemu isn't noexec
+  * provide run-qemu.mount in qemu-block-extra
+    (disabled in debian for now)
+  * Disable capstone disassembler library support in ubuntu (universe)
+
+  [ Michael Tokarev ]
+  * qemu does not ship Changelog file anymore
+  * drop version from libfuse-dev build-depends (noticed by Ville Skyttä)
+  * a few patches from upstream stable:
+   - target-ppc-fix-load-endianness-for-lxvwsx-lxvdsx.patch
+     fix various crashes in ppc system emulation.
+     Thanks to Christian Ehrhardt for pointing this out
+   - pvrdma-fix-possible-mremap-overflow-in-pvrdma-device-CVE-2021-3582.patch
+     (Closes: #990565, CVE-2021-3582)
+   - pvrdma-ensure-correct-input-on-ring-init-CVE-2021-3607.patch
+     (Closes: #990564, CVE-2021-3607)
+   - pvrdma-fix-the-ring-init-error-flow-CVE-2021-3608.patch
+     (Closes: #990563, CVE-2021-3608)
+   - usb-limit-combined-packets-to-1-MiB-CVE-2021-3527.patch
+     usb-redir-avoid-dynamic-stack-allocation-CVE-2021-3527.patch
+     (Closes: #988157, CVE-2021-3527)
+  * mention closing of 3 bugs in am53c974 (ESP) device emulation by 6.0
+    (Closes: #979679, CVE-2020-35504)
+    (Closes: #984455, CVE-2020-35505)
+    (Closes: #984454, CVE-2020-35506)
+  * make fuse debian-only, since libfuse3 in ubuntu is in universe
+  * fix microvm default machine type for a new build system (LP: #1936894)
+
+ -- Michael Tokarev <[e-mail]>  Wed, 21 Jul 2021 19:43:37 +0300
+
+>>>>>>> debian/changelog
 qemu (1:6.0+dfsg-1~ubuntu3) impish; urgency=medium
 
   * d/p/u/lp-1935617-target-ppc-Fix-load-endianness-for-lxvwsx-lxvdsx.patch:
@@ -99,6 +205,9 @@ qemu (1:6.0+dfsg-1~ubuntu1) impish; urgency=medium
 qemu (1:6.0+dfsg-1~exp0) experimental; urgency=medium
 
   * new upstream release
+    Closes: #979679, CVE-2020-35504
+    Closes: #984455, CVE-2020-35505
+    Closes: #984454, CVE-2020-35506
   * remove obsolete patches, refresh use-fixed-data-path.patch
   * use libncurses-dev, not old libncursesw5-dev
   * enable fuse export (and build-depend on libfuse3-dev)
diff --git a/debian/control b/debian/control
index 28a2e35..638cfe8 100644
--- a/debian/control
+++ b/debian/control
@@ -18,6 +18,10 @@ Build-Depends: debhelper-compat (= 12),
  texinfo, python3-sphinx,
 # iasl (from acpica-tools) is used only in a single test these days, not for building
 # acpica-tools,
+<<<<<<< debian/control
+=======
+# libcapstone is in universe in ubuntu
+>>>>>>> debian/control
 # --enable-linux-aio	linux-*
  libaio-dev [linux-any],
 # --audio-drv-list=pa,alsa,oss,sdl	linux-*
@@ -37,6 +41,10 @@ Build-Depends: debhelper-compat (= 12),
 # --enable-fdt
 # libfdt #931046
  libfdt-dev (>> 1.5.0-2~),
+<<<<<<< debian/control
+=======
+# in ubuntu libfuse3 is in universe
+>>>>>>> debian/control
 # --enable-gnutls
  gnutls-dev,
 # --enable-gtk --enable-vte
@@ -460,7 +468,10 @@ Multi-Arch: foreign
 Breaks: qemu-system-common (<< 1:3.1+dfsg-3~)
 Depends: ${shlibs:Depends}, ${misc:Depends},
  qemu-block-extra (= ${binary:Version})
+<<<<<<< debian/control
 Recommends: sharutils
+=======
+>>>>>>> debian/control
 Suggests: debootstrap,
 Description: QEMU utilities
  QEMU is a fast processor emulator: currently the package supports
diff --git a/debian/control-in b/debian/control-in
index 9dcf5bb..ceb03ab 100644
--- a/debian/control-in
+++ b/debian/control-in
@@ -18,6 +18,10 @@ Build-Depends: debhelper-compat (= 12),
  texinfo, python3-sphinx,
 # iasl (from acpica-tools) is used only in a single test these days, not for building
 # acpica-tools,
+<<<<<<< debian/control-in
+=======
+# libcapstone is in universe in ubuntu
+>>>>>>> debian/control-in
 :debian:# --enable-capstone=system
 :debian: libcapstone-dev (>> 4.0.2~),
 # --enable-linux-aio	linux-*
@@ -39,6 +43,12 @@ Build-Depends: debhelper-compat (= 12),
 # --enable-fdt
 # libfdt #931046
  libfdt-dev (>> 1.5.0-2~),
+<<<<<<< debian/control-in
+=======
+# in ubuntu libfuse3 is in universe
+:debian:# --enable-fuse
+:debian: libfuse3-dev,
+>>>>>>> debian/control-in
 # --enable-gnutls
  gnutls-dev,
 # --enable-gtk --enable-vte
@@ -471,7 +481,10 @@ Multi-Arch: foreign
 Breaks: qemu-system-common (<< 1:3.1+dfsg-3~)
 Depends: ${shlibs:Depends}, ${misc:Depends},
 :ubuntu: qemu-block-extra (= ${binary:Version})
+<<<<<<< debian/control-in
 :ubuntu:Recommends: sharutils
+=======
+>>>>>>> debian/control-in
 Suggests: debootstrap,
 :debian: qemu-block-extra (= ${binary:Version}),
 Description: QEMU utilities
diff --git a/debian/optionrom.mak b/debian/optionrom.mak
index 4d45238..204caa0 100644
--- a/debian/optionrom.mak
+++ b/debian/optionrom.mak
@@ -1,7 +1,7 @@
 LD = ld
 OBJCOPY = objcopy
 CC = cc
-CFLAGS = -O2 -m16 -Wa,-32 -march=i486 \
+CFLAGS = -O2 -m16 -Wa,-32 -march=i486 -fcf-protection=none \
 	-ffreestanding -fno-stack-protector -fno-pie \
 	-I${SRC_PATH}/include
 VPATH = ${SRC_PATH}/pc-bios/optionrom
diff --git a/debian/patches/pvrdma-ensure-correct-input-on-ring-init-CVE-2021-3607.patch b/debian/patches/pvrdma-ensure-correct-input-on-ring-init-CVE-2021-3607.patch
new file mode 100644
index 0000000..888301a
--- /dev/null
+++ b/debian/patches/pvrdma-ensure-correct-input-on-ring-init-CVE-2021-3607.patch
@@ -0,0 +1,40 @@
+Commit-ID: 32e5703cfea07c91e6e84bcb0313f633bb146534
+From: Marcel Apfelbaum <[e-mail]>
+Date: Wed, 30 Jun 2021 14:46:34 +0300
+Subject: pvrdma: Ensure correct input on ring init (CVE-2021-3607)
+Bug-Debian: https://bugs.debian.org/990564
+
+Check the guest passed a non zero page count
+for pvrdma device ring buffers.
+
+Fixes: CVE-2021-3607
+Reported-by: VictorV (Kunlun Lab) <[e-mail]>
+Reviewed-by: VictorV (Kunlun Lab) <[e-mail]>
+Signed-off-by: Marcel Apfelbaum <[e-mail]>
+Message-Id: <[e-mail]>
+Reviewed-by: Yuval Shaia <[e-mail]>
+Tested-by: Yuval Shaia <[e-mail]>
+Signed-off-by: Marcel Apfelbaum <[e-mail]>
+---
+ hw/rdma/vmw/pvrdma_main.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/hw/rdma/vmw/pvrdma_main.c b/hw/rdma/vmw/pvrdma_main.c
+index 84ae8024fc..7c0c3551a8 100644
+--- a/hw/rdma/vmw/pvrdma_main.c
++++ b/hw/rdma/vmw/pvrdma_main.c
+@@ -92,6 +92,11 @@ static int init_dev_ring(PvrdmaRing *ring, PvrdmaRingState **ring_state,
+     uint64_t *dir, *tbl;
+     int rc = 0;
+ 
++    if (!num_pages) {
++        rdma_error_report("Ring pages count must be strictly positive");
++        return -EINVAL;
++    }
++
+     dir = rdma_pci_dma_map(pci_dev, dir_addr, TARGET_PAGE_SIZE);
+     if (!dir) {
+         rdma_error_report("Failed to map to page directory (ring %s)", name);
+-- 
+2.30.2
+
diff --git a/debian/patches/pvrdma-fix-possible-mremap-overflow-in-pvrdma-device-CVE-2021-3582.patch b/debian/patches/pvrdma-fix-possible-mremap-overflow-in-pvrdma-device-CVE-2021-3582.patch
new file mode 100644
index 0000000..bd450ff
--- /dev/null
+++ b/debian/patches/pvrdma-fix-possible-mremap-overflow-in-pvrdma-device-CVE-2021-3582.patch
@@ -0,0 +1,43 @@
+Commit-Id: 284f191b4abad213aed04cb0458e1600fd18d7c4
+From: Marcel Apfelbaum <[e-mail]>
+Date: Wed, 16 Jun 2021 14:06:00 +0300
+Subject: hw/rdma: Fix possible mremap overflow in the pvrdma device (CVE-2021-3582)
+Bug-Debian: https://bugs.debian.org/990565
+
+Ensure mremap boundaries not trusting the guest kernel to
+pass the correct buffer length.
+
+Fixes: CVE-2021-3582
+Reported-by: VictorV (Kunlun Lab) <[e-mail]>
+Tested-by: VictorV (Kunlun Lab) <[e-mail]>
+Signed-off-by: Marcel Apfelbaum <[e-mail]>
+Message-Id: <[e-mail]>
+Reviewed-by: Yuval Shaia <[e-mail]>
+Tested-by: Yuval Shaia <[e-mail]>
+Reviewed-by: Prasad J Pandit <[e-mail]>
+Signed-off-by: Marcel Apfelbaum <[e-mail]>
+---
+ hw/rdma/vmw/pvrdma_cmd.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/hw/rdma/vmw/pvrdma_cmd.c b/hw/rdma/vmw/pvrdma_cmd.c
+index f59879e257..da7ddfa548 100644
+--- a/hw/rdma/vmw/pvrdma_cmd.c
++++ b/hw/rdma/vmw/pvrdma_cmd.c
+@@ -38,6 +38,13 @@ static void *pvrdma_map_to_pdir(PCIDevice *pdev, uint64_t pdir_dma,
+         return NULL;
+     }
+ 
++    length = ROUND_UP(length, TARGET_PAGE_SIZE);
++    if (nchunks * TARGET_PAGE_SIZE != length) {
++        rdma_error_report("Invalid nchunks/length (%u, %lu)", nchunks,
++                          (unsigned long)length);
++        return NULL;
++    }
++
+     dir = rdma_pci_dma_map(pdev, pdir_dma, TARGET_PAGE_SIZE);
+     if (!dir) {
+         rdma_error_report("Failed to map to page directory");
+-- 
+2.30.2
+
diff --git a/debian/patches/pvrdma-fix-the-ring-init-error-flow-CVE-2021-3608.patch b/debian/patches/pvrdma-fix-the-ring-init-error-flow-CVE-2021-3608.patch
new file mode 100644
index 0000000..abaab08
--- /dev/null
+++ b/debian/patches/pvrdma-fix-the-ring-init-error-flow-CVE-2021-3608.patch
@@ -0,0 +1,40 @@
+Commit-Id: 66ae37d8cc313f89272e711174a846a229bcdbd3
+From: Marcel Apfelbaum <[e-mail]>
+Date: Wed, 30 Jun 2021 14:52:46 +0300
+Subject: pvrdma: Fix the ring init error flow (CVE-2021-3608)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Bug-Debian: https://bugs.debian.org/990563
+
+Do not unmap uninitialized dma addresses.
+
+Fixes: CVE-2021-3608
+Reviewed-by: VictorV (Kunlun Lab) <[e-mail]>
+Tested-by: VictorV (Kunlun Lab) <[e-mail]>
+Signed-off-by: Marcel Apfelbaum <[e-mail]>
+Message-Id: <[e-mail]>
+Tested-by: Yuval Shaia <[e-mail]>
+Reviewed-by: Yuval Shaia <[e-mail]>
+Reviewed-by: Philippe Mathieu-Daudé <[e-mail]>
+Signed-off-by: Marcel Apfelbaum <[e-mail]>
+---
+ hw/rdma/vmw/pvrdma_dev_ring.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/hw/rdma/vmw/pvrdma_dev_ring.c b/hw/rdma/vmw/pvrdma_dev_ring.c
+index 074ac59b84..42130667a7 100644
+--- a/hw/rdma/vmw/pvrdma_dev_ring.c
++++ b/hw/rdma/vmw/pvrdma_dev_ring.c
+@@ -41,7 +41,7 @@ int pvrdma_ring_init(PvrdmaRing *ring, const char *name, PCIDevice *dev,
+     qatomic_set(&ring->ring_state->cons_head, 0);
+     */
+     ring->npages = npages;
+-    ring->pages = g_malloc(npages * sizeof(void *));
++    ring->pages = g_malloc0(npages * sizeof(void *));
+ 
+     for (i = 0; i < npages; i++) {
+         if (!tbl[i]) {
+-- 
+2.30.2
+
diff --git a/debian/patches/series b/debian/patches/series
index 32d6bad..e2e69fd 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -11,10 +11,24 @@ slof-remove-user-and-host-from-release-version.patch
 slof-ensure-ld-is-called-with-C-locale.patch
 vnc-spelling.patch
 spelling-addtional.patch
+<<<<<<< debian/patches/series
+=======
+target-ppc-fix-load-endianness-for-lxvwsx-lxvdsx.patch
+pvrdma-fix-possible-mremap-overflow-in-pvrdma-device-CVE-2021-3582.patch
+pvrdma-ensure-correct-input-on-ring-init-CVE-2021-3607.patch
+pvrdma-fix-the-ring-init-error-flow-CVE-2021-3608.patch
+usb-limit-combined-packets-to-1-MiB-CVE-2021-3527.patch
+usb-redir-avoid-dynamic-stack-allocation-CVE-2021-3527.patch
+>>>>>>> debian/patches/series
 
 # ubuntu patches
 ubuntu/enable-svm-by-default.patch
 ubuntu/define-ubuntu-machine-types.patch
 ubuntu/pre-bionic-256k-ipxe-efi-roms.patch
 ubuntu/lp-1929926-target-s390x-Fix-translation-exception-on-illegal-in.patch
+<<<<<<< debian/patches/series
 ubuntu/lp-1935617-target-ppc-Fix-load-endianness-for-lxvwsx-lxvdsx.patch
+=======
+ubuntu/avoid-fcf-clashing-with-i486.patch
+ubuntu/lp-1932175-s390x-cpumodel-add-3931-and-3932.patch
+>>>>>>> debian/patches/series
diff --git a/debian/patches/target-ppc-fix-load-endianness-for-lxvwsx-lxvdsx.patch b/debian/patches/target-ppc-fix-load-endianness-for-lxvwsx-lxvdsx.patch
new file mode 100644
index 0000000..2adc1a2
--- /dev/null
+++ b/debian/patches/target-ppc-fix-load-endianness-for-lxvwsx-lxvdsx.patch
@@ -0,0 +1,45 @@
+Commit-Id: 861f10fd528263a507476b8c4dda93a9588dfa5c
+From: Giuseppe Musacchio <[e-mail]>
+Date: Tue, 18 May 2021 15:30:20 +0200
+Subject: target/ppc: Fix load endianness for lxvwsx/lxvdsx
+
+TARGET_WORDS_BIGENDIAN may not match the machine endianness if that's a
+runtime-configurable parameter.
+
+Fixes: bcb0b7b1a1c05707304f80ca6f523d557816f85c
+Fixes: afae37d98ae991c0792c867dbd9f32f988044318
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/212
+
+Signed-off-by: Giuseppe Musacchio <[e-mail]>
+Message-Id: <[e-mail]>
+Tested-by: Paul A. Clarke <[e-mail]>
+Signed-off-by: David Gibson <[e-mail]>
+---
+ target/ppc/translate/vsx-impl.c.inc | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/target/ppc/translate/vsx-impl.c.inc b/target/ppc/translate/vsx-impl.c.inc
+index b817d31260..57a7f73bba 100644
+--- a/target/ppc/translate/vsx-impl.c.inc
++++ b/target/ppc/translate/vsx-impl.c.inc
+@@ -139,7 +139,7 @@ static void gen_lxvwsx(DisasContext *ctx)
+     gen_addr_reg_index(ctx, EA);
+ 
+     data = tcg_temp_new_i32();
+-    tcg_gen_qemu_ld_i32(data, EA, ctx->mem_idx, MO_TEUL);
++    tcg_gen_qemu_ld_i32(data, EA, ctx->mem_idx, DEF_MEMOP(MO_UL));
+     tcg_gen_gvec_dup_i32(MO_UL, vsr_full_offset(xT(ctx->opcode)), 16, 16, data);
+ 
+     tcg_temp_free(EA);
+@@ -162,7 +162,7 @@ static void gen_lxvdsx(DisasContext *ctx)
+     gen_addr_reg_index(ctx, EA);
+ 
+     data = tcg_temp_new_i64();
+-    tcg_gen_qemu_ld_i64(data, EA, ctx->mem_idx, MO_TEQ);
++    tcg_gen_qemu_ld_i64(data, EA, ctx->mem_idx, DEF_MEMOP(MO_Q));
+     tcg_gen_gvec_dup_i64(MO_Q, vsr_full_offset(xT(ctx->opcode)), 16, 16, data);
+ 
+     tcg_temp_free(EA);
+-- 
+2.30.2
+
diff --git a/debian/patches/ubuntu/avoid-fcf-clashing-with-i486.patch b/debian/patches/ubuntu/avoid-fcf-clashing-with-i486.patch
new file mode 100644
index 0000000..8af232f
--- /dev/null
+++ b/debian/patches/ubuntu/avoid-fcf-clashing-with-i486.patch
@@ -0,0 +1,23 @@
+Description: Disable fcf protection in i486 rom builds
+ Some of the qemu roms build really old coe with -march=i486 -m16, but
+ in this more -fcf-protection isn't available, but recently enabled.
+ That causes:
+  cc1: error: ‘-fcf-protection’ is not compatible with this target
+ Avoid that by disabling the feature in these compile calls until the
+ problem is resolved on the toolchain level.
+Forwarded: no
+X-Not-Forwarded-Reason: Only a problem of the Ubuntu compiler defaults
+Author: Christian Ehrhardt <[e-mail]>
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1940029
+Last-Update: 2021-08-16
+--- a/pc-bios/optionrom/Makefile
++++ b/pc-bios/optionrom/Makefile
+@@ -13,7 +13,7 @@ CFLAGS = -O2 -g
+ quiet-command = $(if $(V),$1,$(if $(2),@printf "  %-7s %s\n" $2 $3 && $1, @$1))
+ cc-option = $(if $(shell $(CC) $1 -c -o /dev/null -xc /dev/null >/dev/null 2>&1 && echo OK), $1, $2)
+ 
+-override CFLAGS += -march=i486 -Wall
++override CFLAGS += -march=i486 -Wall -fcf-protection=none
+ 
+ # Flags for dependency generation
+ override CPPFLAGS += -MMD -MP -MT $@ -MF $(@D)/$(*F).d
diff --git a/debian/patches/ubuntu/lp-1932175-s390x-cpumodel-add-3931-and-3932.patch b/debian/patches/ubuntu/lp-1932175-s390x-cpumodel-add-3931-and-3932.patch
new file mode 100644
index 0000000..6c82066
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1932175-s390x-cpumodel-add-3931-and-3932.patch
@@ -0,0 +1,119 @@
+From fb4a08121695a88acefcbcd86f1376df079eefee Mon Sep 17 00:00:00 2001
+From: Christian Borntraeger <[e-mail]>
+Date: Tue, 22 Jun 2021 22:19:23 +0200
+Subject: [PATCH] s390x/cpumodel: add 3931 and 3932
+
+This defines 5 new facilities and the new 3931 and 3932 machines.
+As before the name is not yet known and we do use gen16a and gen16b.
+The new features are part of the full model.
+
+The default model is still empty (same as z15) and will be added
+in a separate patch at a later point in time.
+
+Also add the dependencies of new facilities and as a fix for z15 add
+a dependency from S390_FEAT_VECTOR_PACKED_DECIMAL_ENH to
+S390_VECTOR_PACKED_DECIMAL.
+
+[merged <[e-mail]>]
+Signed-off-by: Christian Borntraeger <[e-mail]>
+Message-Id: <[e-mail]>
+Reviewed-by: David Hildenbrand <[e-mail]>
+Signed-off-by: Cornelia Huck <[e-mail]>
+
+Origin: backport, https://git.qemu.org/?p=qemu.git;a=commit;h=fb4a081216
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1932175
+Last-Update: 2021-08-16
+
+---
+ target/s390x/cpu_features_def.h.inc |  5 +++++
+ target/s390x/cpu_models.c           |  6 ++++++
+ target/s390x/gen-features.c         | 14 ++++++++++++++
+ 3 files changed, 25 insertions(+)
+
+--- a/target/s390x/cpu_features_def.h.inc
++++ b/target/s390x/cpu_features_def.h.inc
+@@ -109,6 +109,11 @@ DEF_FEAT(VECTOR_PACKED_DECIMAL_ENH, "vxp
+ DEF_FEAT(MSA_EXT_9, "msa9-base", STFL, 155, "Message-security-assist-extension-9 facility (excluding subfunctions)")
+ DEF_FEAT(ETOKEN, "etoken", STFL, 156, "Etoken facility")
+ DEF_FEAT(UNPACK, "unpack", STFL, 161, "Unpack facility")
++DEF_FEAT(NNPA, "nnpa", STFL, 165, "NNPA facility")
++DEF_FEAT(VECTOR_PACKED_DECIMAL_ENH2, "vxpdeh2", STFL, 192, "Vector-Packed-Decimal-Enhancement facility 2")
++DEF_FEAT(BEAR_ENH, "beareh", STFL, 193, "BEAR-enhancement facility")
++DEF_FEAT(RDP, "rdp", STFL, 194, "Reset-DAT-protection facility")
++DEF_FEAT(PAI, "pai", STFL, 196, "Processor-Activity-Instrumentation facility")
+ 
+ /* Features exposed via SCLP SCCB Byte 80 - 98  (bit numbers relative to byte-80) */
+ DEF_FEAT(SIE_GSLS, "gsls", SCLP_CONF_CHAR, 40, "SIE: Guest-storage-limit-suppression facility")
+--- a/target/s390x/cpu_models.c
++++ b/target/s390x/cpu_models.c
+@@ -88,6 +88,8 @@ static S390CPUDef s390_cpu_defs[] = {
+     CPUDEF_INIT(0x3907, 14, 1, 47, 0x08000000U, "z14ZR1", "IBM z14 Model ZR1 GA1"),
+     CPUDEF_INIT(0x8561, 15, 1, 47, 0x08000000U, "gen15a", "IBM z15 T01 GA1"),
+     CPUDEF_INIT(0x8562, 15, 1, 47, 0x08000000U, "gen15b", "IBM z15 T02 GA1"),
++    CPUDEF_INIT(0x3931, 16, 1, 47, 0x08000000U, "gen16a", "IBM 3931 GA1"),
++    CPUDEF_INIT(0x3932, 16, 1, 47, 0x08000000U, "gen16b", "IBM 3932 GA1"),
+ };
+ 
+ #define QEMU_MAX_CPU_TYPE 0x2964
+@@ -812,6 +814,8 @@ static void check_consistency(const S390
+         { S390_FEAT_MSA_EXT_9, S390_FEAT_MSA_EXT_4 },
+         { S390_FEAT_MULTIPLE_EPOCH, S390_FEAT_TOD_CLOCK_STEERING },
+         { S390_FEAT_VECTOR_PACKED_DECIMAL, S390_FEAT_VECTOR },
++        { S390_FEAT_VECTOR_PACKED_DECIMAL_ENH, S390_FEAT_VECTOR_PACKED_DECIMAL },
++        { S390_FEAT_VECTOR_PACKED_DECIMAL_ENH2, S390_FEAT_VECTOR_PACKED_DECIMAL_ENH },
+         { S390_FEAT_VECTOR_ENH, S390_FEAT_VECTOR },
+         { S390_FEAT_INSTRUCTION_EXEC_PROT, S390_FEAT_SIDE_EFFECT_ACCESS_ESOP2 },
+         { S390_FEAT_SIDE_EFFECT_ACCESS_ESOP2, S390_FEAT_ESOP },
+@@ -843,6 +847,8 @@ static void check_consistency(const S390
+         { S390_FEAT_PTFF_STOUE, S390_FEAT_MULTIPLE_EPOCH },
+         { S390_FEAT_AP_QUEUE_INTERRUPT_CONTROL, S390_FEAT_AP },
+         { S390_FEAT_DIAG_318, S390_FEAT_EXTENDED_LENGTH_SCCB },
++        { S390_FEAT_NNPA, S390_FEAT_VECTOR },
++        { S390_FEAT_RDP, S390_FEAT_LOCAL_TLB_CLEARING },
+     };
+     int i;
+ 
+--- a/target/s390x/gen-features.c
++++ b/target/s390x/gen-features.c
+@@ -424,6 +424,8 @@ static uint16_t base_GEN15_GA1[] = {
+     S390_FEAT_MISC_INSTRUCTION_EXT3,
+ };
+ 
++#define base_GEN16_GA1 EmptyFeat
++
+ /* Full features (in order of release)
+  * Automatically includes corresponding base features.
+  * Full features are all features this hardware supports even if kvm/QEMU do not
+@@ -567,6 +569,15 @@ static uint16_t full_GEN15_GA1[] = {
+     S390_FEAT_UNPACK,
+ };
+ 
++static uint16_t full_GEN16_GA1[] = {
++    S390_FEAT_NNPA,
++    S390_FEAT_VECTOR_PACKED_DECIMAL_ENH2,
++    S390_FEAT_BEAR_ENH,
++    S390_FEAT_RDP,
++    S390_FEAT_PAI,
++};
++
++
+ /* Default features (in order of release)
+  * Automatically includes corresponding base features.
+  * Default features are all features this version of QEMU supports for this
+@@ -652,6 +663,8 @@ static uint16_t default_GEN15_GA1[] = {
+     S390_FEAT_ETOKEN,
+ };
+ 
++#define default_GEN16_GA1 EmptyFeat
++
+ /* QEMU (CPU model) features */
+ 
+ static uint16_t qemu_V2_11[] = {
+@@ -782,6 +795,7 @@ static CpuFeatDefSpec CpuFeatDef[] = {
+     CPU_FEAT_INITIALIZER(GEN14_GA1),
+     CPU_FEAT_INITIALIZER(GEN14_GA2),
+     CPU_FEAT_INITIALIZER(GEN15_GA1),
++    CPU_FEAT_INITIALIZER(GEN16_GA1),
+ };
+ 
+ #define FEAT_GROUP_INITIALIZER(_name)                  \
diff --git a/debian/patches/usb-limit-combined-packets-to-1-MiB-CVE-2021-3527.patch b/debian/patches/usb-limit-combined-packets-to-1-MiB-CVE-2021-3527.patch
new file mode 100644
index 0000000..9212ada
--- /dev/null
+++ b/debian/patches/usb-limit-combined-packets-to-1-MiB-CVE-2021-3527.patch
@@ -0,0 +1,37 @@
+Commit-Id: 05a40b172e4d691371534828078be47e7fff524c
+From: Gerd Hoffmann <[e-mail]>
+Date: Mon, 3 May 2021 15:29:15 +0200
+Subject: usb: limit combined packets to 1 MiB (CVE-2021-3527)
+Bug-Debian: https://bugs.debian.org/988157
+
+usb-host and usb-redirect try to batch bulk transfers by combining many
+small usb packets into a single, large transfer request, to reduce the
+overhead and improve performance.
+
+This patch adds a size limit of 1 MiB for those combined packets to
+restrict the host resources the guest can bind that way.
+
+Signed-off-by: Gerd Hoffmann <[e-mail]>
+Message-Id: <[e-mail]>
+---
+ hw/usb/combined-packet.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/hw/usb/combined-packet.c b/hw/usb/combined-packet.c
+index 5d57e883dc..e56802f89a 100644
+--- a/hw/usb/combined-packet.c
++++ b/hw/usb/combined-packet.c
+@@ -171,7 +171,9 @@ void usb_ep_combine_input_packets(USBEndpoint *ep)
+         if ((p->iov.size % ep->max_packet_size) != 0 || !p->short_not_ok ||
+                 next == NULL ||
+                 /* Work around for Linux usbfs bulk splitting + migration */
+-                (totalsize == (16 * KiB - 36) && p->int_req)) {
++                (totalsize == (16 * KiB - 36) && p->int_req) ||
++                /* Next package may grow combined package over 1MiB */
++                totalsize > 1 * MiB - ep->max_packet_size) {
+             usb_device_handle_data(ep->dev, first);
+             assert(first->status == USB_RET_ASYNC);
+             if (first->combined) {
+-- 
+2.30.2
+
diff --git a/debian/patches/usb-redir-avoid-dynamic-stack-allocation-CVE-2021-3527.patch b/debian/patches/usb-redir-avoid-dynamic-stack-allocation-CVE-2021-3527.patch
new file mode 100644
index 0000000..4725d63
--- /dev/null
+++ b/debian/patches/usb-redir-avoid-dynamic-stack-allocation-CVE-2021-3527.patch
@@ -0,0 +1,54 @@
+Commit-Id: 7ec54f9eb62b5d177e30eb8b1cad795a5f8d8986
+From: Gerd Hoffmann <[e-mail]>
+Date: Mon, 3 May 2021 15:29:12 +0200
+Subject: usb/redir: avoid dynamic stack allocation (CVE-2021-3527)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Bug-Debian: https://bugs.debian.org/988157
+
+Use autofree heap allocation instead.
+
+Fixes: 4f4321c11ff ("usb: use iovecs in USBPacket")
+Reviewed-by: Philippe Mathieu-Daudé <[e-mail]>
+Signed-off-by: Gerd Hoffmann <[e-mail]>
+Tested-by: Philippe Mathieu-Daudé <[e-mail]>
+Message-Id: <[e-mail]>
+---
+ hw/usb/redirect.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
+index 17f06f3417..6a75b0dc4a 100644
+--- a/hw/usb/redirect.c
++++ b/hw/usb/redirect.c
+@@ -620,7 +620,7 @@ static void usbredir_handle_iso_data(USBRedirDevice *dev, USBPacket *p,
+                 .endpoint = ep,
+                 .length = p->iov.size
+             };
+-            uint8_t buf[p->iov.size];
++            g_autofree uint8_t *buf = g_malloc(p->iov.size);
+             /* No id, we look at the ep when receiving a status back */
+             usb_packet_copy(p, buf, p->iov.size);
+             usbredirparser_send_iso_packet(dev->parser, 0, &iso_packet,
+@@ -818,7 +818,7 @@ static void usbredir_handle_bulk_data(USBRedirDevice *dev, USBPacket *p,
+         usbredirparser_send_bulk_packet(dev->parser, p->id,
+                                         &bulk_packet, NULL, 0);
+     } else {
+-        uint8_t buf[size];
++        g_autofree uint8_t *buf = g_malloc(size);
+         usb_packet_copy(p, buf, size);
+         usbredir_log_data(dev, "bulk data out:", buf, size);
+         usbredirparser_send_bulk_packet(dev->parser, p->id,
+@@ -923,7 +923,7 @@ static void usbredir_handle_interrupt_out_data(USBRedirDevice *dev,
+                                                USBPacket *p, uint8_t ep)
+ {
+     struct usb_redir_interrupt_packet_header interrupt_packet;
+-    uint8_t buf[p->iov.size];
++    g_autofree uint8_t *buf = g_malloc(p->iov.size);
+ 
+     DPRINTF("interrupt-out ep %02X len %zd id %"PRIu64"\n", ep,
+             p->iov.size, p->id);
+-- 
+2.30.2
+
diff --git a/debian/rules b/debian/rules
index ab302ed..7b8f6cb 100755
--- a/debian/rules
+++ b/debian/rules
@@ -128,8 +128,9 @@ ifneq ($(filter $(DEB_HOST_ARCH),amd64),)
 	# microvm system
 	rm -rf b/qemu-microvm; mkdir -p b/qemu-microvm
 	cd b/qemu-microvm && \
-		../../configure ${common_configure_opts} --disable-user \
-		--enable-system --enable-kvm \
+		../../configure ${common_configure_opts} \
+		--extra-cflags="$(CFLAGS) $(CPPFLAGS) -DCONFIG_MICROVM_DEFAULT=1" \
+		--disable-user --enable-system --enable-kvm \
 		--disable-linux-user --disable-modules --disable-docs \
 		--disable-libssh --disable-tcmalloc --disable-glusterfs \
 		--disable-seccomp --disable-bzip2 --disable-slirp --disable-vde \
@@ -155,7 +156,30 @@ ifneq ($(filter $(DEB_HOST_ARCH),amd64),)
 		--without-default-devices \
 		$(QEMU_CONFIGURE_OPTIONS) || \
 	 { echo ===== CONFIGURE FAILED ===; tail -n 50 config.log; exit 1; }
-	echo "#define CONFIG_MICROVM_DEFAULT 1" >> b/qemu-microvm/x86_64-softmmu/config-target.h
+endif
+
+ifeq ($(VENDOR),UBUNTU)
+ifneq ($(filter $(DEB_HOST_ARCH),amd64 i386),)
+# like above but with:
+#  --enable-xen
+#  --disable-linux-user (not needed for this binary)
+#  reduced --target-list as needed for xen
+#  xen can only be configured on x86, so skip other build architectures
+	# system build for qemu-system-x86-xen
+	rm -rf b/qemu-xen; mkdir -p b/qemu-xen
+	cd b/qemu-xen && \
+	    ../../configure ${common_configure_opts} --disable-user \
+		--${enable_system}-system \
+		--disable-linux-user \
+		--enable-xen \
+		--target-list="aarch64-softmmu arm-softmmu i386-softmmu x86_64-softmmu"
+		--enable-modules \
+		--enable-module-upgrades \
+		$(shell sh debian/extract-config-opts \
+		    $(DEB_HOST_ARCH_OS)-$(DEB_HOST_ARCH) debian/control) \
+		$(QEMU_CONFIGURE_OPTIONS) || \
+	 { echo ===== CONFIGURE FAILED ===; tail -n 50 config.log; exit 1; }
+endif
 endif
 
 ifeq ($(VENDOR),UBUNTU)
@@ -402,7 +426,7 @@ endif	# enable_linux_user
 	dh_install -a
 	dh_missing --list-missing
 	dh_installdocs -a -Nqemu-user-binfmt
-	dh_installchangelogs -a -Nqemu-user-binfmt -XChangelog
+	dh_installchangelogs -a -Nqemu-user-binfmt
 	dh_installdocs -a -pqemu-user-binfmt --link-doc=qemu-user
 	dh_installman -a
 	dh_installudev -a
@@ -417,7 +441,11 @@ endif
 	dh_installsystemd -a -pqemu-system-common --no-restart-on-upgrade --name=qemu-kvm
 	dh_installinit -a -pqemu-guest-agent
 	dh_installsystemd -a -pqemu-guest-agent --no-start --no-enable
+<<<<<<< debian/rules
 	dh_installsystemd -a -pqemu-block-extra --no-restart-on-upgrade --name=run-qemu.mount
+=======
+	dh_installsystemd -a -pqemu-block-extra --no-start --no-enable --no-restart-on-upgrade --name=run-qemu.mount
+>>>>>>> debian/rules
 	dh_link -a
 	dh_lintian -a
 	dh_strip -a