diff --git a/0001-sgx-stub-fix.patch b/0001-sgx-stub-fix.patch
deleted file mode 100644
index ff31973..0000000
--- a/0001-sgx-stub-fix.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From 509b6078631ad2437e1a452f749831e401fb8afb Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Tue, 1 Feb 2022 20:09:37 +0100
-Subject: [PATCH] target/i386: the sgx_epc_get_section stub is reachable
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The sgx_epc_get_section stub is reachable from cpu_x86_cpuid. It
-should not assert, instead it should just return true just like
-the "real" sgx_epc_get_section does when SGX is disabled.
-
-Reported-by: Vladimír Beneš <vbenes@redhat.com>
-Cc: qemu-stable@nongnu.org
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-
-diff --git a/hw/i386/sgx-stub.c b/hw/i386/sgx-stub.c
-index 26833eb233..16b1dfd90b 100644
---- a/hw/i386/sgx-stub.c
-+++ b/hw/i386/sgx-stub.c
-@@ -34,5 +34,5 @@ void pc_machine_init_sgx_epc(PCMachineState *pcms)
-
- bool sgx_epc_get_section(int section_nr, uint64_t *addr, uint64_t *size)
- {
-- g_assert_not_reached();
-+ return true;
- }
diff --git a/0001-target-i386-the-sgx_epc_get_section-stub-is-reachabl.patch b/0001-target-i386-the-sgx_epc_get_section-stub-is-reachabl.patch
new file mode 100644
index 0000000..cc5ada9
--- /dev/null
+++ b/0001-target-i386-the-sgx_epc_get_section-stub-is-reachabl.patch
@@ -0,0 +1,30 @@
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Tue, 1 Feb 2022 20:09:37 +0100
+Subject: [PATCH] target/i386: the sgx_epc_get_section stub is reachable
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Content-type: text/plain
+
+The sgx_epc_get_section stub is reachable from cpu_x86_cpuid. It
+should not assert, instead it should just return true just like
+the "real" sgx_epc_get_section does when SGX is disabled.
+
+Reported-by: Vladimír Beneš <vbenes@redhat.com>
+Cc: qemu-stable@nongnu.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ hw/i386/sgx-stub.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/hw/i386/sgx-stub.c b/hw/i386/sgx-stub.c
+index 26833eb233..16b1dfd90b 100644
+--- a/hw/i386/sgx-stub.c
++++ b/hw/i386/sgx-stub.c
+@@ -34,5 +34,5 @@ void pc_machine_init_sgx_epc(PCMachineState *pcms)
+
+ bool sgx_epc_get_section(int section_nr, uint64_t *addr, uint64_t *size)
+ {
+- g_assert_not_reached();
++ return true;
+ }
diff --git a/0002-virtio-scsi-fix-ctrl-and-event-handler-functions-in-.patch b/0002-virtio-scsi-fix-ctrl-and-event-handler-functions-in-.patch
new file mode 100644
index 0000000..32c90a1
--- /dev/null
+++ b/0002-virtio-scsi-fix-ctrl-and-event-handler-functions-in-.patch
@@ -0,0 +1,108 @@
+From: Stefan Hajnoczi <stefanha@redhat.com>
+Date: Wed, 27 Apr 2022 15:35:36 +0100
+Subject: [PATCH] virtio-scsi: fix ctrl and event handler functions in
+ dataplane mode
+Content-type: text/plain
+
+Commit f34e8d8b8d48d73f36a67b6d5e492ef9784b5012 ("virtio-scsi: prepare
+virtio_scsi_handle_cmd for dataplane") prepared the virtio-scsi cmd
+virtqueue handler function to be used in both the dataplane and
+non-datpalane code paths.
+
+It failed to convert the ctrl and event virtqueue handler functions,
+which are not designed to be called from the dataplane code path but
+will be since the ioeventfd is set up for those virtqueues when
+dataplane starts.
+
+Convert the ctrl and event virtqueue handler functions now so they
+operate correctly when called from the dataplane code path. Avoid code
+duplication by extracting this code into a helper function.
+
+Fixes: f34e8d8b8d48d73f36a67b6d5e492ef9784b5012 ("virtio-scsi: prepare virtio_scsi_handle_cmd for dataplane")
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
+Message-id: 20220427143541.119567-2-stefanha@redhat.com
+[Fixed s/by used/be used/ typo pointed out by Michael Tokarev
+<mjt@tls.msk.ru>.
+--Stefan]
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+(cherry picked from commit 2f743ef6366c2df4ef51ef3ae318138cdc0125ab)
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ hw/scsi/virtio-scsi.c | 42 +++++++++++++++++++++++++++---------------
+ 1 file changed, 27 insertions(+), 15 deletions(-)
+
+diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
+index 34a968ecfb..417fbc71d6 100644
+--- a/hw/scsi/virtio-scsi.c
++++ b/hw/scsi/virtio-scsi.c
+@@ -472,16 +472,32 @@ bool virtio_scsi_handle_ctrl_vq(VirtIOSCSI *s, VirtQueue *vq)
+ return progress;
+ }
+
++/*
++ * If dataplane is configured but not yet started, do so now and return true on
++ * success.
++ *
++ * Dataplane is started by the core virtio code but virtqueue handler functions
++ * can also be invoked when a guest kicks before DRIVER_OK, so this helper
++ * function helps us deal with manually starting ioeventfd in that case.
++ */
++static bool virtio_scsi_defer_to_dataplane(VirtIOSCSI *s)
++{
++ if (!s->ctx || s->dataplane_started) {
++ return false;
++ }
++
++ virtio_device_start_ioeventfd(&s->parent_obj.parent_obj);
++ return !s->dataplane_fenced;
++}
++
+ static void virtio_scsi_handle_ctrl(VirtIODevice *vdev, VirtQueue *vq)
+ {
+ VirtIOSCSI *s = (VirtIOSCSI *)vdev;
+
+- if (s->ctx) {
+- virtio_device_start_ioeventfd(vdev);
+- if (!s->dataplane_fenced) {
+- return;
+- }
++ if (virtio_scsi_defer_to_dataplane(s)) {
++ return;
+ }
++
+ virtio_scsi_acquire(s);
+ virtio_scsi_handle_ctrl_vq(s, vq);
+ virtio_scsi_release(s);
+@@ -720,12 +736,10 @@ static void virtio_scsi_handle_cmd(VirtIODevice *vdev, VirtQueue *vq)
+ /* use non-QOM casts in the data path */
+ VirtIOSCSI *s = (VirtIOSCSI *)vdev;
+
+- if (s->ctx && !s->dataplane_started) {
+- virtio_device_start_ioeventfd(vdev);
+- if (!s->dataplane_fenced) {
+- return;
+- }
++ if (virtio_scsi_defer_to_dataplane(s)) {
++ return;
+ }
++
+ virtio_scsi_acquire(s);
+ virtio_scsi_handle_cmd_vq(s, vq);
+ virtio_scsi_release(s);
+@@ -855,12 +869,10 @@ static void virtio_scsi_handle_event(VirtIODevice *vdev, VirtQueue *vq)
+ {
+ VirtIOSCSI *s = VIRTIO_SCSI(vdev);
+
+- if (s->ctx) {
+- virtio_device_start_ioeventfd(vdev);
+- if (!s->dataplane_fenced) {
+- return;
+- }
++ if (virtio_scsi_defer_to_dataplane(s)) {
++ return;
+ }
++
+ virtio_scsi_acquire(s);
+ virtio_scsi_handle_event_vq(s, vq);
+ virtio_scsi_release(s);
diff --git a/0003-virtio-scsi-don-t-waste-CPU-polling-the-event-virtqu.patch b/0003-virtio-scsi-don-t-waste-CPU-polling-the-event-virtqu.patch
new file mode 100644
index 0000000..03acef6
--- /dev/null
+++ b/0003-virtio-scsi-don-t-waste-CPU-polling-the-event-virtqu.patch
@@ -0,0 +1,91 @@
+From: Stefan Hajnoczi <stefanha@redhat.com>
+Date: Tue, 17 May 2022 09:27:45 +0100
+Subject: [PATCH] virtio-scsi: don't waste CPU polling the event virtqueue
+Content-type: text/plain
+
+The virtio-scsi event virtqueue is not emptied by its handler function.
+This is typical for rx virtqueues where the device uses buffers when
+some event occurs (e.g. a packet is received, an error condition
+happens, etc).
+
+Polling non-empty virtqueues wastes CPU cycles. We are not waiting for
+new buffers to become available, we are waiting for an event to occur,
+so it's a misuse of CPU resources to poll for buffers.
+
+Introduce the new virtio_queue_aio_attach_host_notifier_no_poll() API,
+which is identical to virtio_queue_aio_attach_host_notifier() except
+that it does not poll the virtqueue.
+
+Before this patch the following command-line consumed 100% CPU in the
+IOThread polling and calling virtio_scsi_handle_event():
+
+ $ qemu-system-x86_64 -M accel=kvm -m 1G -cpu host \
+ --object iothread,id=iothread0 \
+ --device virtio-scsi-pci,iothread=iothread0 \
+ --blockdev file,filename=test.img,aio=native,cache.direct=on,node-name=drive0 \
+ --device scsi-hd,drive=drive0
+
+After this patch CPU is no longer wasted.
+
+Reported-by: Nir Soffer <nsoffer@redhat.com>
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Tested-by: Nir Soffer <nsoffer@redhat.com>
+Message-id: 20220427143541.119567-3-stefanha@redhat.com
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+(cherry picked from commit 38738f7dbbda90fbc161757b7f4be35b52205552)
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ hw/scsi/virtio-scsi-dataplane.c | 2 +-
+ hw/virtio/virtio.c | 13 +++++++++++++
+ include/hw/virtio/virtio.h | 1 +
+ 3 files changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/hw/scsi/virtio-scsi-dataplane.c b/hw/scsi/virtio-scsi-dataplane.c
+index 29575cbaf6..8bb6e6acfc 100644
+--- a/hw/scsi/virtio-scsi-dataplane.c
++++ b/hw/scsi/virtio-scsi-dataplane.c
+@@ -138,7 +138,7 @@ int virtio_scsi_dataplane_start(VirtIODevice *vdev)
+
+ aio_context_acquire(s->ctx);
+ virtio_queue_aio_attach_host_notifier(vs->ctrl_vq, s->ctx);
+- virtio_queue_aio_attach_host_notifier(vs->event_vq, s->ctx);
++ virtio_queue_aio_attach_host_notifier_no_poll(vs->event_vq, s->ctx);
+
+ for (i = 0; i < vs->conf.num_queues; i++) {
+ virtio_queue_aio_attach_host_notifier(vs->cmd_vqs[i], s->ctx);
+diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
+index 9d637e043e..67a873f54a 100644
+--- a/hw/virtio/virtio.c
++++ b/hw/virtio/virtio.c
+@@ -3534,6 +3534,19 @@ void virtio_queue_aio_attach_host_notifier(VirtQueue *vq, AioContext *ctx)
+ virtio_queue_host_notifier_aio_poll_end);
+ }
+
++/*
++ * Same as virtio_queue_aio_attach_host_notifier() but without polling. Use
++ * this for rx virtqueues and similar cases where the virtqueue handler
++ * function does not pop all elements. When the virtqueue is left non-empty
++ * polling consumes CPU cycles and should not be used.
++ */
++void virtio_queue_aio_attach_host_notifier_no_poll(VirtQueue *vq, AioContext *ctx)
++{
++ aio_set_event_notifier(ctx, &vq->host_notifier, true,
++ virtio_queue_host_notifier_read,
++ NULL, NULL);
++}
++
+ void virtio_queue_aio_detach_host_notifier(VirtQueue *vq, AioContext *ctx)
+ {
+ aio_set_event_notifier(ctx, &vq->host_notifier, true, NULL, NULL, NULL);
+diff --git a/include/hw/virtio/virtio.h b/include/hw/virtio/virtio.h
+index b31c4507f5..b62a35fdca 100644
+--- a/include/hw/virtio/virtio.h
++++ b/include/hw/virtio/virtio.h
+@@ -317,6 +317,7 @@ EventNotifier *virtio_queue_get_host_notifier(VirtQueue *vq);
+ void virtio_queue_set_host_notifier_enabled(VirtQueue *vq, bool enabled);
+ void virtio_queue_host_notifier_read(EventNotifier *n);
+ void virtio_queue_aio_attach_host_notifier(VirtQueue *vq, AioContext *ctx);
++void virtio_queue_aio_attach_host_notifier_no_poll(VirtQueue *vq, AioContext *ctx);
+ void virtio_queue_aio_detach_host_notifier(VirtQueue *vq, AioContext *ctx);
+ VirtQueue *virtio_vector_first_queue(VirtIODevice *vdev, uint16_t vector);
+ VirtQueue *virtio_vector_next_queue(VirtQueue *vq);
diff --git a/0004-virtio-scsi-clean-up-virtio_scsi_handle_event_vq.patch b/0004-virtio-scsi-clean-up-virtio_scsi_handle_event_vq.patch
new file mode 100644
index 0000000..d3eff90
--- /dev/null
+++ b/0004-virtio-scsi-clean-up-virtio_scsi_handle_event_vq.patch
@@ -0,0 +1,51 @@
+From: Stefan Hajnoczi <stefanha@redhat.com>
+Date: Tue, 17 May 2022 09:28:06 +0100
+Subject: [PATCH] virtio-scsi: clean up virtio_scsi_handle_event_vq()
+Content-type: text/plain
+
+virtio_scsi_handle_event_vq() is only called from hw/scsi/virtio-scsi.c
+now and its return value is no longer used. Remove the function
+prototype from virtio-scsi.h and drop the return value.
+
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
+Message-id: 20220427143541.119567-4-stefanha@redhat.com
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+(cherry picked from commit 37ce2de95169dacab3fb53d11bd4509b9c2e3a4c)
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ hw/scsi/virtio-scsi.c | 4 +---
+ include/hw/virtio/virtio-scsi.h | 1 -
+ 2 files changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
+index 417fbc71d6..aa03a713d8 100644
+--- a/hw/scsi/virtio-scsi.c
++++ b/hw/scsi/virtio-scsi.c
+@@ -856,13 +856,11 @@ void virtio_scsi_push_event(VirtIOSCSI *s, SCSIDevice *dev,
+ virtio_scsi_complete_req(req);
+ }
+
+-bool virtio_scsi_handle_event_vq(VirtIOSCSI *s, VirtQueue *vq)
++static void virtio_scsi_handle_event_vq(VirtIOSCSI *s, VirtQueue *vq)
+ {
+ if (s->events_dropped) {
+ virtio_scsi_push_event(s, NULL, VIRTIO_SCSI_T_NO_EVENT, 0);
+- return true;
+ }
+- return false;
+ }
+
+ static void virtio_scsi_handle_event(VirtIODevice *vdev, VirtQueue *vq)
+diff --git a/include/hw/virtio/virtio-scsi.h b/include/hw/virtio/virtio-scsi.h
+index 543681bc18..5957597825 100644
+--- a/include/hw/virtio/virtio-scsi.h
++++ b/include/hw/virtio/virtio-scsi.h
+@@ -151,7 +151,6 @@ void virtio_scsi_common_realize(DeviceState *dev,
+ Error **errp);
+
+ void virtio_scsi_common_unrealize(DeviceState *dev);
+-bool virtio_scsi_handle_event_vq(VirtIOSCSI *s, VirtQueue *vq);
+ bool virtio_scsi_handle_cmd_vq(VirtIOSCSI *s, VirtQueue *vq);
+ bool virtio_scsi_handle_ctrl_vq(VirtIOSCSI *s, VirtQueue *vq);
+ void virtio_scsi_init_req(VirtIOSCSI *s, VirtQueue *vq, VirtIOSCSIReq *req);
diff --git a/0005-virtio-scsi-clean-up-virtio_scsi_handle_ctrl_vq.patch b/0005-virtio-scsi-clean-up-virtio_scsi_handle_ctrl_vq.patch
new file mode 100644
index 0000000..bde9298
--- /dev/null
+++ b/0005-virtio-scsi-clean-up-virtio_scsi_handle_ctrl_vq.patch
@@ -0,0 +1,54 @@
+From: Stefan Hajnoczi <stefanha@redhat.com>
+Date: Tue, 17 May 2022 09:28:12 +0100
+Subject: [PATCH] virtio-scsi: clean up virtio_scsi_handle_ctrl_vq()
+Content-type: text/plain
+
+virtio_scsi_handle_ctrl_vq() is only called from hw/scsi/virtio-scsi.c
+now and its return value is no longer used. Remove the function
+prototype from virtio-scsi.h and drop the return value.
+
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
+Message-id: 20220427143541.119567-5-stefanha@redhat.com
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+(cherry picked from commit 73b3b49f1880f236b4d0ffd7efb00280c05a5fab)
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ hw/scsi/virtio-scsi.c | 5 +----
+ include/hw/virtio/virtio-scsi.h | 1 -
+ 2 files changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
+index aa03a713d8..eefda16e4b 100644
+--- a/hw/scsi/virtio-scsi.c
++++ b/hw/scsi/virtio-scsi.c
+@@ -460,16 +460,13 @@ static void virtio_scsi_handle_ctrl_req(VirtIOSCSI *s, VirtIOSCSIReq *req)
+ }
+ }
+
+-bool virtio_scsi_handle_ctrl_vq(VirtIOSCSI *s, VirtQueue *vq)
++static void virtio_scsi_handle_ctrl_vq(VirtIOSCSI *s, VirtQueue *vq)
+ {
+ VirtIOSCSIReq *req;
+- bool progress = false;
+
+ while ((req = virtio_scsi_pop_req(s, vq))) {
+- progress = true;
+ virtio_scsi_handle_ctrl_req(s, req);
+ }
+- return progress;
+ }
+
+ /*
+diff --git a/include/hw/virtio/virtio-scsi.h b/include/hw/virtio/virtio-scsi.h
+index 5957597825..44dc3b81ec 100644
+--- a/include/hw/virtio/virtio-scsi.h
++++ b/include/hw/virtio/virtio-scsi.h
+@@ -152,7 +152,6 @@ void virtio_scsi_common_realize(DeviceState *dev,
+
+ void virtio_scsi_common_unrealize(DeviceState *dev);
+ bool virtio_scsi_handle_cmd_vq(VirtIOSCSI *s, VirtQueue *vq);
+-bool virtio_scsi_handle_ctrl_vq(VirtIOSCSI *s, VirtQueue *vq);
+ void virtio_scsi_init_req(VirtIOSCSI *s, VirtQueue *vq, VirtIOSCSIReq *req);
+ void virtio_scsi_free_req(VirtIOSCSIReq *req);
+ void virtio_scsi_push_event(VirtIOSCSI *s, SCSIDevice *dev,
diff --git a/0006-virtio-scsi-clean-up-virtio_scsi_handle_cmd_vq.patch b/0006-virtio-scsi-clean-up-virtio_scsi_handle_cmd_vq.patch
new file mode 100644
index 0000000..89c5e58
--- /dev/null
+++ b/0006-virtio-scsi-clean-up-virtio_scsi_handle_cmd_vq.patch
@@ -0,0 +1,66 @@
+From: Stefan Hajnoczi <stefanha@redhat.com>
+Date: Tue, 17 May 2022 09:28:19 +0100
+Subject: [PATCH] virtio-scsi: clean up virtio_scsi_handle_cmd_vq()
+Content-type: text/plain
+
+virtio_scsi_handle_cmd_vq() is only called from hw/scsi/virtio-scsi.c
+now and its return value is no longer used. Remove the function
+prototype from virtio-scsi.h and drop the return value.
+
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
+Message-id: 20220427143541.119567-6-stefanha@redhat.com
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+(cherry picked from commit ad482b57ef841b2d4883c5079d20ba44ff5e4b3e)
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ hw/scsi/virtio-scsi.c | 5 +----
+ include/hw/virtio/virtio-scsi.h | 1 -
+ 2 files changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
+index eefda16e4b..12c6a21202 100644
+--- a/hw/scsi/virtio-scsi.c
++++ b/hw/scsi/virtio-scsi.c
+@@ -685,12 +685,11 @@ static void virtio_scsi_handle_cmd_req_submit(VirtIOSCSI *s, VirtIOSCSIReq *req)
+ scsi_req_unref(sreq);
+ }
+
+-bool virtio_scsi_handle_cmd_vq(VirtIOSCSI *s, VirtQueue *vq)
++static void virtio_scsi_handle_cmd_vq(VirtIOSCSI *s, VirtQueue *vq)
+ {
+ VirtIOSCSIReq *req, *next;
+ int ret = 0;
+ bool suppress_notifications = virtio_queue_get_notification(vq);
+- bool progress = false;
+
+ QTAILQ_HEAD(, VirtIOSCSIReq) reqs = QTAILQ_HEAD_INITIALIZER(reqs);
+
+@@ -700,7 +699,6 @@ bool virtio_scsi_handle_cmd_vq(VirtIOSCSI *s, VirtQueue *vq)
+ }
+
+ while ((req = virtio_scsi_pop_req(s, vq))) {
+- progress = true;
+ ret = virtio_scsi_handle_cmd_req_prepare(s, req);
+ if (!ret) {
+ QTAILQ_INSERT_TAIL(&reqs, req, next);
+@@ -725,7 +723,6 @@ bool virtio_scsi_handle_cmd_vq(VirtIOSCSI *s, VirtQueue *vq)
+ QTAILQ_FOREACH_SAFE(req, &reqs, next, next) {
+ virtio_scsi_handle_cmd_req_submit(s, req);
+ }
+- return progress;
+ }
+
+ static void virtio_scsi_handle_cmd(VirtIODevice *vdev, VirtQueue *vq)
+diff --git a/include/hw/virtio/virtio-scsi.h b/include/hw/virtio/virtio-scsi.h
+index 44dc3b81ec..2497530064 100644
+--- a/include/hw/virtio/virtio-scsi.h
++++ b/include/hw/virtio/virtio-scsi.h
+@@ -151,7 +151,6 @@ void virtio_scsi_common_realize(DeviceState *dev,
+ Error **errp);
+
+ void virtio_scsi_common_unrealize(DeviceState *dev);
+-bool virtio_scsi_handle_cmd_vq(VirtIOSCSI *s, VirtQueue *vq);
+ void virtio_scsi_init_req(VirtIOSCSI *s, VirtQueue *vq, VirtIOSCSIReq *req);
+ void virtio_scsi_free_req(VirtIOSCSIReq *req);
+ void virtio_scsi_push_event(VirtIOSCSI *s, SCSIDevice *dev,
diff --git a/0007-virtio-scsi-move-request-related-items-from-.h-to-.c.patch b/0007-virtio-scsi-move-request-related-items-from-.h-to-.c.patch
new file mode 100644
index 0000000..89377c8
--- /dev/null
+++ b/0007-virtio-scsi-move-request-related-items-from-.h-to-.c.patch
@@ -0,0 +1,157 @@
+From: Stefan Hajnoczi <stefanha@redhat.com>
+Date: Tue, 17 May 2022 09:28:26 +0100
+Subject: [PATCH] virtio-scsi: move request-related items from .h to .c
+Content-type: text/plain
+
+There is no longer a need to expose the request and related APIs in
+virtio-scsi.h since there are no callers outside virtio-scsi.c.
+
+Note the block comment in VirtIOSCSIReq has been adjusted to meet the
+coding style.
+
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
+Message-id: 20220427143541.119567-7-stefanha@redhat.com
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+(cherry picked from commit 3dc584abeef0e1277c2de8c1c1974cb49444eb0a)
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ hw/scsi/virtio-scsi.c | 45 ++++++++++++++++++++++++++++++---
+ include/hw/virtio/virtio-scsi.h | 40 -----------------------------
+ 2 files changed, 41 insertions(+), 44 deletions(-)
+
+diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
+index 12c6a21202..db54d104be 100644
+--- a/hw/scsi/virtio-scsi.c
++++ b/hw/scsi/virtio-scsi.c
+@@ -29,6 +29,43 @@
+ #include "hw/virtio/virtio-access.h"
+ #include "trace.h"
+
++typedef struct VirtIOSCSIReq {
++ /*
++ * Note:
++ * - fields up to resp_iov are initialized by virtio_scsi_init_req;
++ * - fields starting at vring are zeroed by virtio_scsi_init_req.
++ */
++ VirtQueueElement elem;
++
++ VirtIOSCSI *dev;
++ VirtQueue *vq;
++ QEMUSGList qsgl;
++ QEMUIOVector resp_iov;
++
++ union {
++ /* Used for two-stage request submission */
++ QTAILQ_ENTRY(VirtIOSCSIReq) next;
++
++ /* Used for cancellation of request during TMFs */
++ int remaining;
++ };
++
++ SCSIRequest *sreq;
++ size_t resp_size;
++ enum SCSIXferMode mode;
++ union {
++ VirtIOSCSICmdResp cmd;
++ VirtIOSCSICtrlTMFResp tmf;
++ VirtIOSCSICtrlANResp an;
++ VirtIOSCSIEvent event;
++ } resp;
++ union {
++ VirtIOSCSICmdReq cmd;
++ VirtIOSCSICtrlTMFReq tmf;
++ VirtIOSCSICtrlANReq an;
++ } req;
++} VirtIOSCSIReq;
++
+ static inline int virtio_scsi_get_lun(uint8_t *lun)
+ {
+ return ((lun[2] << 8) | lun[3]) & 0x3FFF;
+@@ -45,7 +82,7 @@ static inline SCSIDevice *virtio_scsi_device_get(VirtIOSCSI *s, uint8_t *lun)
+ return scsi_device_get(&s->bus, 0, lun[1], virtio_scsi_get_lun(lun));
+ }
+
+-void virtio_scsi_init_req(VirtIOSCSI *s, VirtQueue *vq, VirtIOSCSIReq *req)
++static void virtio_scsi_init_req(VirtIOSCSI *s, VirtQueue *vq, VirtIOSCSIReq *req)
+ {
+ VirtIODevice *vdev = VIRTIO_DEVICE(s);
+ const size_t zero_skip =
+@@ -58,7 +95,7 @@ void virtio_scsi_init_req(VirtIOSCSI *s, VirtQueue *vq, VirtIOSCSIReq *req)
+ memset((uint8_t *)req + zero_skip, 0, sizeof(*req) - zero_skip);
+ }
+
+-void virtio_scsi_free_req(VirtIOSCSIReq *req)
++static void virtio_scsi_free_req(VirtIOSCSIReq *req)
+ {
+ qemu_iovec_destroy(&req->resp_iov);
+ qemu_sglist_destroy(&req->qsgl);
+@@ -801,8 +838,8 @@ static void virtio_scsi_reset(VirtIODevice *vdev)
+ s->events_dropped = false;
+ }
+
+-void virtio_scsi_push_event(VirtIOSCSI *s, SCSIDevice *dev,
+- uint32_t event, uint32_t reason)
++static void virtio_scsi_push_event(VirtIOSCSI *s, SCSIDevice *dev,
++ uint32_t event, uint32_t reason)
+ {
+ VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(s);
+ VirtIOSCSIReq *req;
+diff --git a/include/hw/virtio/virtio-scsi.h b/include/hw/virtio/virtio-scsi.h
+index 2497530064..abdda2cbd0 100644
+--- a/include/hw/virtio/virtio-scsi.h
++++ b/include/hw/virtio/virtio-scsi.h
+@@ -94,42 +94,6 @@ struct VirtIOSCSI {
+ uint32_t host_features;
+ };
+
+-typedef struct VirtIOSCSIReq {
+- /* Note:
+- * - fields up to resp_iov are initialized by virtio_scsi_init_req;
+- * - fields starting at vring are zeroed by virtio_scsi_init_req.
+- * */
+- VirtQueueElement elem;
+-
+- VirtIOSCSI *dev;
+- VirtQueue *vq;
+- QEMUSGList qsgl;
+- QEMUIOVector resp_iov;
+-
+- union {
+- /* Used for two-stage request submission */
+- QTAILQ_ENTRY(VirtIOSCSIReq) next;
+-
+- /* Used for cancellation of request during TMFs */
+- int remaining;
+- };
+-
+- SCSIRequest *sreq;
+- size_t resp_size;
+- enum SCSIXferMode mode;
+- union {
+- VirtIOSCSICmdResp cmd;
+- VirtIOSCSICtrlTMFResp tmf;
+- VirtIOSCSICtrlANResp an;
+- VirtIOSCSIEvent event;
+- } resp;
+- union {
+- VirtIOSCSICmdReq cmd;
+- VirtIOSCSICtrlTMFReq tmf;
+- VirtIOSCSICtrlANReq an;
+- } req;
+-} VirtIOSCSIReq;
+-
+ static inline void virtio_scsi_acquire(VirtIOSCSI *s)
+ {
+ if (s->ctx) {
+@@ -151,10 +115,6 @@ void virtio_scsi_common_realize(DeviceState *dev,
+ Error **errp);
+
+ void virtio_scsi_common_unrealize(DeviceState *dev);
+-void virtio_scsi_init_req(VirtIOSCSI *s, VirtQueue *vq, VirtIOSCSIReq *req);
+-void virtio_scsi_free_req(VirtIOSCSIReq *req);
+-void virtio_scsi_push_event(VirtIOSCSI *s, SCSIDevice *dev,
+- uint32_t event, uint32_t reason);
+
+ void virtio_scsi_dataplane_setup(VirtIOSCSI *s, Error **errp);
+ int virtio_scsi_dataplane_start(VirtIODevice *s);
diff --git a/qemu.spec b/qemu.spec
index c181fdf..b7ada84 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -310,7 +310,7 @@ Obsoletes: %{name}-system-unicore32-core <= %{epoch}:%{version}-%{release}
%endif
# To prevent rpmdev-bumpspec breakage
-%global baserelease 3
+%global baserelease 4
Summary: QEMU is a FAST! processor emulator
Name: qemu
@@ -333,7 +333,15 @@ Source30: kvm-s390x.conf
Source31: kvm-x86.conf
Source36: README.tests
-Patch0001: 0001-sgx-stub-fix.patch
+# Fix SGX assert
+Patch0001: 0001-target-i386-the-sgx_epc_get_section-stub-is-reachabl.patch
+# Fix virtio-scsi hang (bz #2079347)
+Patch0002: 0002-virtio-scsi-fix-ctrl-and-event-handler-functions-in-.patch
+Patch0003: 0003-virtio-scsi-don-t-waste-CPU-polling-the-event-virtqu.patch
+Patch0004: 0004-virtio-scsi-clean-up-virtio_scsi_handle_event_vq.patch
+Patch0005: 0005-virtio-scsi-clean-up-virtio_scsi_handle_ctrl_vq.patch
+Patch0006: 0006-virtio-scsi-clean-up-virtio_scsi_handle_cmd_vq.patch
+Patch0007: 0007-virtio-scsi-move-request-related-items-from-.h-to-.c.patch
BuildRequires: meson >= %{meson_version}
BuildRequires: zlib-devel
@@ -2326,6 +2334,10 @@ useradd -r -u 107 -g qemu -G kvm -d / -s /sbin/nologin \
%changelog
+* Thu Jun 02 2022 Cole Robinson <crobinso@redhat.com> - 7.0.0-4
+- Fix virtio-scsi hang (bz #2079347)
+- Add dep on virtio-gpu-ccw (bz #2091964)
+
* Tue May 17 2022 Cole Robinson <crobinso@redhat.com> - 7.0.0-3
- Make qemu-common own /usr/share/qemu/vhost-user (bz 2086836)
- Add virtiofsd to qemu-system-* deps (bz 2083155)