xref: /spdk/lib/vhost/vhost_scsi.c (revision 3aa204fb3138c43e63b868e488277f13b098cef1)
1 /*-
2  *   BSD LICENSE
3  *
4  *   Copyright(c) Intel Corporation. All rights reserved.
5  *   All rights reserved.
6  *
7  *   Redistribution and use in source and binary forms, with or without
8  *   modification, are permitted provided that the following conditions
9  *   are met:
10  *
11  *     * Redistributions of source code must retain the above copyright
12  *       notice, this list of conditions and the following disclaimer.
13  *     * Redistributions in binary form must reproduce the above copyright
14  *       notice, this list of conditions and the following disclaimer in
15  *       the documentation and/or other materials provided with the
16  *       distribution.
17  *     * Neither the name of Intel Corporation nor the names of its
18  *       contributors may be used to endorse or promote products derived
19  *       from this software without specific prior written permission.
20  *
21  *   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
22  *   "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
23  *   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
24  *   A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
25  *   OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
26  *   SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
27  *   LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
28  *   DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
29  *   THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
30  *   (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
31  *   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
32  */
33 
34 #include "spdk/stdinc.h"
35 
36 #include <linux/virtio_scsi.h>
37 
38 #include "spdk/env.h"
39 #include "spdk/thread.h"
40 #include "spdk/scsi.h"
41 #include "spdk/scsi_spec.h"
42 #include "spdk/conf.h"
43 #include "spdk/event.h"
44 #include "spdk/util.h"
45 #include "spdk/likely.h"
46 
47 #include "spdk/vhost.h"
48 #include "vhost_internal.h"
49 
50 /* Features supported by SPDK VHOST lib. */
51 #define SPDK_VHOST_SCSI_FEATURES	(SPDK_VHOST_FEATURES | \
52 					(1ULL << VIRTIO_SCSI_F_INOUT) | \
53 					(1ULL << VIRTIO_SCSI_F_HOTPLUG) | \
54 					(1ULL << VIRTIO_SCSI_F_CHANGE ) | \
55 					(1ULL << VIRTIO_SCSI_F_T10_PI ))
56 
57 /* Features that are specified in VIRTIO SCSI but currently not supported:
58  * - Live migration not supported yet
59  * - T10 PI
60  */
61 #define SPDK_VHOST_SCSI_DISABLED_FEATURES	(SPDK_VHOST_DISABLED_FEATURES | \
62 						(1ULL << VIRTIO_SCSI_F_T10_PI ))
63 
64 #define MGMT_POLL_PERIOD_US (1000 * 5)
65 
66 #define VIRTIO_SCSI_CONTROLQ   0
67 #define VIRTIO_SCSI_EVENTQ   1
68 #define VIRTIO_SCSI_REQUESTQ   2
69 
70 enum spdk_scsi_dev_vhost_status {
71 	/* Target ID is empty. */
72 	VHOST_SCSI_DEV_EMPTY,
73 
74 	/* Target ID occupied. */
75 	VHOST_SCSI_DEV_PRESENT,
76 
77 	/* Target ID is occupied but removal is in progress. */
78 	VHOST_SCSI_DEV_REMOVING,
79 
80 	/* In session - device (SCSI target) seen but removed. */
81 	VHOST_SCSI_DEV_REMOVED,
82 };
83 
84 struct spdk_scsi_dev_vhost_state {
85 	struct spdk_scsi_dev *dev;
86 	enum spdk_scsi_dev_vhost_status status;
87 	spdk_vhost_event_fn remove_cb;
88 	void *remove_ctx;
89 };
90 
91 struct spdk_vhost_scsi_dev {
92 	struct spdk_vhost_dev vdev;
93 	struct spdk_scsi_dev_vhost_state scsi_dev_state[SPDK_VHOST_SCSI_CTRLR_MAX_DEVS];
94 
95 	/* The CPU chosen to poll I/O of all active vhost sessions */
96 	int32_t lcore;
97 } __rte_cache_aligned;
98 
99 struct spdk_vhost_scsi_session {
100 	struct spdk_vhost_session vsession;
101 
102 	struct spdk_vhost_scsi_dev *svdev;
103 	/** Local copy of the device state */
104 	struct spdk_scsi_dev_vhost_state scsi_dev_state[SPDK_VHOST_SCSI_CTRLR_MAX_DEVS];
105 	struct spdk_poller *requestq_poller;
106 	struct spdk_poller *mgmt_poller;
107 	struct spdk_poller *stop_poller;
108 };
109 
110 struct spdk_vhost_scsi_task {
111 	struct spdk_scsi_task	scsi;
112 	struct iovec iovs[SPDK_VHOST_IOVS_MAX];
113 
114 	union {
115 		struct virtio_scsi_cmd_resp *resp;
116 		struct virtio_scsi_ctrl_tmf_resp *tmf_resp;
117 	};
118 
119 	struct spdk_vhost_scsi_session *svsession;
120 	struct spdk_scsi_dev *scsi_dev;
121 
122 	/** Number of bytes that were written. */
123 	uint32_t used_len;
124 
125 	int req_idx;
126 
127 	/* If set, the task is currently used for I/O processing. */
128 	bool used;
129 
130 	struct spdk_vhost_virtqueue *vq;
131 };
132 
133 static int spdk_vhost_scsi_start(struct spdk_vhost_session *vsession);
134 static int spdk_vhost_scsi_stop(struct spdk_vhost_session *vsession);
135 static void spdk_vhost_scsi_dump_info_json(struct spdk_vhost_dev *vdev,
136 		struct spdk_json_write_ctx *w);
137 static void spdk_vhost_scsi_write_config_json(struct spdk_vhost_dev *vdev,
138 		struct spdk_json_write_ctx *w);
139 static int spdk_vhost_scsi_dev_remove(struct spdk_vhost_dev *vdev);
140 
141 const struct spdk_vhost_dev_backend spdk_vhost_scsi_device_backend = {
142 	.virtio_features = SPDK_VHOST_SCSI_FEATURES,
143 	.disabled_features = SPDK_VHOST_SCSI_DISABLED_FEATURES,
144 	.session_ctx_size = sizeof(struct spdk_vhost_scsi_session) - sizeof(struct spdk_vhost_session),
145 	.start_session =  spdk_vhost_scsi_start,
146 	.stop_session = spdk_vhost_scsi_stop,
147 	.dump_info_json = spdk_vhost_scsi_dump_info_json,
148 	.write_config_json = spdk_vhost_scsi_write_config_json,
149 	.remove_device = spdk_vhost_scsi_dev_remove,
150 };
151 
152 static void
153 spdk_vhost_scsi_task_put(struct spdk_vhost_scsi_task *task)
154 {
155 	spdk_scsi_task_put(&task->scsi);
156 }
157 
158 static void
159 spdk_vhost_scsi_task_free_cb(struct spdk_scsi_task *scsi_task)
160 {
161 	struct spdk_vhost_scsi_task *task = SPDK_CONTAINEROF(scsi_task, struct spdk_vhost_scsi_task, scsi);
162 	struct spdk_vhost_session *vsession = &task->svsession->vsession;
163 
164 	assert(vsession->task_cnt > 0);
165 	vsession->task_cnt--;
166 	task->used = false;
167 }
168 
169 static int
170 remove_scsi_tgt(struct spdk_vhost_scsi_dev *svdev,
171 		unsigned scsi_tgt_num)
172 {
173 	struct spdk_scsi_dev_vhost_state *state;
174 	struct spdk_scsi_dev *dev;
175 
176 	state = &svdev->scsi_dev_state[scsi_tgt_num];
177 	if (state->dev == NULL) {
178 		/* we've been already removed in the meantime */
179 		return 0;
180 	}
181 
182 	dev = state->dev;
183 	state->dev = NULL;
184 	assert(state->status == VHOST_SCSI_DEV_REMOVING);
185 	state->status = VHOST_SCSI_DEV_EMPTY;
186 	spdk_scsi_dev_destruct(dev);
187 	if (state->remove_cb) {
188 		state->remove_cb(&svdev->vdev, state->remove_ctx);
189 		state->remove_cb = NULL;
190 	}
191 	SPDK_INFOLOG(SPDK_LOG_VHOST, "%s: removed target 'Target %u'\n",
192 		     svdev->vdev.name, scsi_tgt_num);
193 	return 0;
194 }
195 
196 static int
197 spdk_vhost_scsi_session_process_removed(struct spdk_vhost_dev *vdev,
198 					struct spdk_vhost_session *vsession, void *ctx)
199 {
200 	unsigned scsi_tgt_num = (unsigned)(uintptr_t)ctx;
201 	struct spdk_vhost_scsi_session *svsession;
202 	struct spdk_scsi_dev_vhost_state *state;
203 
204 	if (vsession == NULL) {
205 		/* all sessions have already detached the device */
206 		struct spdk_vhost_scsi_dev *svdev = SPDK_CONTAINEROF(vdev,
207 						    struct spdk_vhost_scsi_dev, vdev);
208 
209 		return remove_scsi_tgt(svdev, scsi_tgt_num);
210 	}
211 
212 	svsession = (struct spdk_vhost_scsi_session *)vsession;
213 	state = &svsession->scsi_dev_state[scsi_tgt_num];
214 
215 	if (state->dev != NULL) {
216 		/* there's still a session that references this device,
217 		 * so abort our foreach chain here. We'll be called
218 		 * again from this session's management poller after it
219 		 * is removed in there
220 		 */
221 		return -1;
222 	}
223 
224 	return 0;
225 }
226 
227 static void
228 process_removed_devs(struct spdk_vhost_scsi_session *svsession)
229 {
230 	struct spdk_scsi_dev *dev;
231 	struct spdk_scsi_dev_vhost_state *state;
232 	int i;
233 
234 	for (i = 0; i < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS; ++i) {
235 		state = &svsession->scsi_dev_state[i];
236 		dev = state->dev;
237 
238 		if (dev && state->status == VHOST_SCSI_DEV_REMOVING && !spdk_scsi_dev_has_pending_tasks(dev)) {
239 			/* detach the device from this session */
240 			spdk_scsi_dev_free_io_channels(dev);
241 			state->dev = NULL;
242 			state->status = VHOST_SCSI_DEV_REMOVED;
243 			/* try to detach it globally */
244 			spdk_vhost_lock();
245 			spdk_vhost_dev_foreach_session(&svsession->svdev->vdev,
246 						       spdk_vhost_scsi_session_process_removed,
247 						       (void *)(uintptr_t)i);
248 			spdk_vhost_unlock();
249 		}
250 	}
251 }
252 
253 static void
254 eventq_enqueue(struct spdk_vhost_scsi_session *svsession, unsigned scsi_dev_num,
255 	       uint32_t event, uint32_t reason)
256 {
257 	struct spdk_vhost_session *vsession = &svsession->vsession;
258 	struct spdk_vhost_dev *vdev = vsession->vdev;
259 	struct spdk_vhost_virtqueue *vq;
260 	struct vring_desc *desc, *desc_table;
261 	struct virtio_scsi_event *desc_ev;
262 	uint32_t desc_table_size, req_size = 0;
263 	uint16_t req;
264 	int rc;
265 
266 	assert(scsi_dev_num < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS);
267 	vq = &vsession->virtqueue[VIRTIO_SCSI_EVENTQ];
268 
269 	if (spdk_vhost_vq_avail_ring_get(vq, &req, 1) != 1) {
270 		SPDK_ERRLOG("Controller %s: Failed to send virtio event (no avail ring entries?).\n",
271 			    vdev->name);
272 		return;
273 	}
274 
275 	rc = spdk_vhost_vq_get_desc(vsession, vq, req, &desc, &desc_table, &desc_table_size);
276 	if (rc != 0 || desc->len < sizeof(*desc_ev)) {
277 		SPDK_ERRLOG("Controller %s: Invalid eventq descriptor at index %"PRIu16".\n",
278 			    vdev->name, req);
279 		goto out;
280 	}
281 
282 	desc_ev = spdk_vhost_gpa_to_vva(vsession, desc->addr, sizeof(*desc_ev));
283 	if (desc_ev == NULL) {
284 		SPDK_ERRLOG("Controller %s: Eventq descriptor at index %"PRIu16" points to unmapped guest memory address %p.\n",
285 			    vdev->name, req, (void *)(uintptr_t)desc->addr);
286 		goto out;
287 	}
288 
289 	desc_ev->event = event;
290 	desc_ev->lun[0] = 1;
291 	desc_ev->lun[1] = scsi_dev_num;
292 	/* virtio LUN id 0 can refer either to the entire device
293 	 * or actual LUN 0 (the only supported by vhost for now)
294 	 */
295 	desc_ev->lun[2] = 0 >> 8;
296 	desc_ev->lun[3] = 0 & 0xFF;
297 	/* virtio doesn't specify any strict format for LUN id (bytes 2 and 3)
298 	 * current implementation relies on linux kernel sources
299 	 */
300 	memset(&desc_ev->lun[4], 0, 4);
301 	desc_ev->reason = reason;
302 	req_size = sizeof(*desc_ev);
303 
304 out:
305 	spdk_vhost_vq_used_ring_enqueue(vsession, vq, req, req_size);
306 }
307 
308 static void
309 submit_completion(struct spdk_vhost_scsi_task *task)
310 {
311 	struct spdk_vhost_session *vsession = &task->svsession->vsession;
312 
313 	spdk_vhost_vq_used_ring_enqueue(vsession, task->vq, task->req_idx,
314 					task->used_len);
315 	SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI, "Finished task (%p) req_idx=%d\n", task, task->req_idx);
316 
317 	spdk_vhost_scsi_task_put(task);
318 }
319 
320 static void
321 spdk_vhost_scsi_task_mgmt_cpl(struct spdk_scsi_task *scsi_task)
322 {
323 	struct spdk_vhost_scsi_task *task = SPDK_CONTAINEROF(scsi_task, struct spdk_vhost_scsi_task, scsi);
324 
325 	submit_completion(task);
326 }
327 
328 static void
329 spdk_vhost_scsi_task_cpl(struct spdk_scsi_task *scsi_task)
330 {
331 	struct spdk_vhost_scsi_task *task = SPDK_CONTAINEROF(scsi_task, struct spdk_vhost_scsi_task, scsi);
332 
333 	/* The SCSI task has completed.  Do final processing and then post
334 	   notification to the virtqueue's "used" ring.
335 	 */
336 	task->resp->status = task->scsi.status;
337 
338 	if (task->scsi.status != SPDK_SCSI_STATUS_GOOD) {
339 		memcpy(task->resp->sense, task->scsi.sense_data, task->scsi.sense_data_len);
340 		task->resp->sense_len = task->scsi.sense_data_len;
341 		SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI, "Task (%p) req_idx=%d failed - status=%u\n", task, task->req_idx,
342 			      task->scsi.status);
343 	}
344 	assert(task->scsi.transfer_len == task->scsi.length);
345 	task->resp->resid = task->scsi.length - task->scsi.data_transferred;
346 
347 	submit_completion(task);
348 }
349 
350 static void
351 task_submit(struct spdk_vhost_scsi_task *task)
352 {
353 	task->resp->response = VIRTIO_SCSI_S_OK;
354 	spdk_scsi_dev_queue_task(task->scsi_dev, &task->scsi);
355 }
356 
357 static void
358 mgmt_task_submit(struct spdk_vhost_scsi_task *task, enum spdk_scsi_task_func func)
359 {
360 	task->tmf_resp->response = VIRTIO_SCSI_S_OK;
361 	task->scsi.function = func;
362 	spdk_scsi_dev_queue_mgmt_task(task->scsi_dev, &task->scsi);
363 }
364 
365 static void
366 invalid_request(struct spdk_vhost_scsi_task *task)
367 {
368 	struct spdk_vhost_session *vsession = &task->svsession->vsession;
369 
370 	spdk_vhost_vq_used_ring_enqueue(vsession, task->vq, task->req_idx,
371 					task->used_len);
372 	spdk_vhost_scsi_task_put(task);
373 
374 	SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI, "Invalid request (status=%" PRIu8")\n",
375 		      task->resp ? task->resp->response : -1);
376 }
377 
378 static int
379 spdk_vhost_scsi_task_init_target(struct spdk_vhost_scsi_task *task, const __u8 *lun)
380 {
381 	struct spdk_vhost_scsi_session *svsession = task->svsession;
382 	struct spdk_scsi_dev_vhost_state *state;
383 	uint16_t lun_id = (((uint16_t)lun[2] << 8) | lun[3]) & 0x3FFF;
384 
385 	SPDK_LOGDUMP(SPDK_LOG_VHOST_SCSI_QUEUE, "LUN", lun, 8);
386 
387 	/* First byte must be 1 and second is target */
388 	if (lun[0] != 1 || lun[1] >= SPDK_VHOST_SCSI_CTRLR_MAX_DEVS) {
389 		return -1;
390 	}
391 
392 	state = &svsession->scsi_dev_state[lun[1]];
393 	task->scsi_dev = state->dev;
394 	if (state->dev == NULL || state->status != VHOST_SCSI_DEV_PRESENT) {
395 		/* If dev has been hotdetached, return 0 to allow sending
396 		 * additional hotremove event via sense codes.
397 		 */
398 		return state->status != VHOST_SCSI_DEV_EMPTY ? 0 : -1;
399 	}
400 
401 	task->scsi.target_port = spdk_scsi_dev_find_port_by_id(task->scsi_dev, 0);
402 	task->scsi.lun = spdk_scsi_dev_get_lun(state->dev, lun_id);
403 	return 0;
404 }
405 
406 static void
407 process_ctrl_request(struct spdk_vhost_scsi_task *task)
408 {
409 	struct spdk_vhost_session *vsession = &task->svsession->vsession;
410 	struct spdk_vhost_dev *vdev = vsession->vdev;
411 	struct vring_desc *desc, *desc_table;
412 	struct virtio_scsi_ctrl_tmf_req *ctrl_req;
413 	struct virtio_scsi_ctrl_an_resp *an_resp;
414 	uint32_t desc_table_size, used_len = 0;
415 	int rc;
416 
417 	spdk_scsi_task_construct(&task->scsi, spdk_vhost_scsi_task_mgmt_cpl, spdk_vhost_scsi_task_free_cb);
418 	rc = spdk_vhost_vq_get_desc(vsession, task->vq, task->req_idx, &desc, &desc_table,
419 				    &desc_table_size);
420 	if (spdk_unlikely(rc != 0)) {
421 		SPDK_ERRLOG("%s: Invalid controlq descriptor at index %d.\n",
422 			    vdev->name, task->req_idx);
423 		goto out;
424 	}
425 
426 	ctrl_req = spdk_vhost_gpa_to_vva(vsession, desc->addr, sizeof(*ctrl_req));
427 	if (ctrl_req == NULL) {
428 		SPDK_ERRLOG("%s: Invalid task management request at index %d.\n",
429 			    vdev->name, task->req_idx);
430 		goto out;
431 	}
432 
433 	SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI_QUEUE,
434 		      "Processing controlq descriptor: desc %d/%p, desc_addr %p, len %d, flags %d, last_used_idx %d; kickfd %d; size %d\n",
435 		      task->req_idx, desc, (void *)desc->addr, desc->len, desc->flags, task->vq->last_used_idx,
436 		      task->vq->vring.kickfd, task->vq->vring.size);
437 	SPDK_LOGDUMP(SPDK_LOG_VHOST_SCSI_QUEUE, "Request descriptor", (uint8_t *)ctrl_req, desc->len);
438 
439 	spdk_vhost_scsi_task_init_target(task, ctrl_req->lun);
440 
441 	spdk_vhost_vring_desc_get_next(&desc, desc_table, desc_table_size);
442 	if (spdk_unlikely(desc == NULL)) {
443 		SPDK_ERRLOG("%s: No response descriptor for controlq request %d.\n",
444 			    vdev->name, task->req_idx);
445 		goto out;
446 	}
447 
448 	/* Process the TMF request */
449 	switch (ctrl_req->type) {
450 	case VIRTIO_SCSI_T_TMF:
451 		task->tmf_resp = spdk_vhost_gpa_to_vva(vsession, desc->addr, sizeof(*task->tmf_resp));
452 		if (spdk_unlikely(desc->len < sizeof(struct virtio_scsi_ctrl_tmf_resp) || task->tmf_resp == NULL)) {
453 			SPDK_ERRLOG("%s: TMF response descriptor at index %d points to invalid guest memory region\n",
454 				    vdev->name, task->req_idx);
455 			goto out;
456 		}
457 
458 		/* Check if we are processing a valid request */
459 		if (task->scsi_dev == NULL) {
460 			task->tmf_resp->response = VIRTIO_SCSI_S_BAD_TARGET;
461 			break;
462 		}
463 
464 		switch (ctrl_req->subtype) {
465 		case VIRTIO_SCSI_T_TMF_LOGICAL_UNIT_RESET:
466 			/* Handle LUN reset */
467 			SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI_QUEUE, "LUN reset\n");
468 
469 			mgmt_task_submit(task, SPDK_SCSI_TASK_FUNC_LUN_RESET);
470 			return;
471 		default:
472 			task->tmf_resp->response = VIRTIO_SCSI_S_ABORTED;
473 			/* Unsupported command */
474 			SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI_QUEUE, "Unsupported TMF command %x\n", ctrl_req->subtype);
475 			break;
476 		}
477 		break;
478 	case VIRTIO_SCSI_T_AN_QUERY:
479 	case VIRTIO_SCSI_T_AN_SUBSCRIBE: {
480 		an_resp = spdk_vhost_gpa_to_vva(vsession, desc->addr, sizeof(*an_resp));
481 		if (spdk_unlikely(desc->len < sizeof(struct virtio_scsi_ctrl_an_resp) || an_resp == NULL)) {
482 			SPDK_WARNLOG("%s: Asynchronous response descriptor points to invalid guest memory region\n",
483 				     vdev->name);
484 			goto out;
485 		}
486 
487 		an_resp->response = VIRTIO_SCSI_S_ABORTED;
488 		break;
489 	}
490 	default:
491 		SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI_QUEUE, "Unsupported control command %x\n", ctrl_req->type);
492 		break;
493 	}
494 
495 	used_len = sizeof(struct virtio_scsi_ctrl_tmf_resp);
496 out:
497 	spdk_vhost_vq_used_ring_enqueue(vsession, task->vq, task->req_idx, used_len);
498 	spdk_vhost_scsi_task_put(task);
499 }
500 
501 /*
502  * Process task's descriptor chain and setup data related fields.
503  * Return
504  *   -1 if request is invalid and must be aborted,
505  *    0 if all data are set.
506  */
507 static int
508 task_data_setup(struct spdk_vhost_scsi_task *task,
509 		struct virtio_scsi_cmd_req **req)
510 {
511 	struct spdk_vhost_session *vsession = &task->svsession->vsession;
512 	struct spdk_vhost_dev *vdev = vsession->vdev;
513 	struct vring_desc *desc, *desc_table;
514 	struct iovec *iovs = task->iovs;
515 	uint16_t iovcnt = 0;
516 	uint32_t desc_table_len, len = 0;
517 	int rc;
518 
519 	spdk_scsi_task_construct(&task->scsi, spdk_vhost_scsi_task_cpl, spdk_vhost_scsi_task_free_cb);
520 
521 	rc = spdk_vhost_vq_get_desc(vsession, task->vq, task->req_idx, &desc, &desc_table, &desc_table_len);
522 	/* First descriptor must be readable */
523 	if (spdk_unlikely(rc != 0  || spdk_vhost_vring_desc_is_wr(desc) ||
524 			  desc->len < sizeof(struct virtio_scsi_cmd_req))) {
525 		SPDK_WARNLOG("%s: invalid first (request) descriptor at index %"PRIu16".\n",
526 			     vdev->name, task->req_idx);
527 		goto invalid_task;
528 	}
529 
530 	*req = spdk_vhost_gpa_to_vva(vsession, desc->addr, sizeof(**req));
531 	if (spdk_unlikely(*req == NULL)) {
532 		SPDK_WARNLOG("%s: Request descriptor at index %d points to invalid guest memory region\n",
533 			     vdev->name, task->req_idx);
534 		goto invalid_task;
535 	}
536 
537 	/* Each request must have at least 2 descriptors (e.g. request and response) */
538 	spdk_vhost_vring_desc_get_next(&desc, desc_table, desc_table_len);
539 	if (desc == NULL) {
540 		SPDK_WARNLOG("%s: Descriptor chain at index %d contains neither payload nor response buffer.\n",
541 			     vdev->name, task->req_idx);
542 		goto invalid_task;
543 	}
544 	task->scsi.dxfer_dir = spdk_vhost_vring_desc_is_wr(desc) ? SPDK_SCSI_DIR_FROM_DEV :
545 			       SPDK_SCSI_DIR_TO_DEV;
546 	task->scsi.iovs = iovs;
547 
548 	if (task->scsi.dxfer_dir == SPDK_SCSI_DIR_FROM_DEV) {
549 		/*
550 		 * FROM_DEV (READ): [RD_req][WR_resp][WR_buf0]...[WR_bufN]
551 		 */
552 		task->resp = spdk_vhost_gpa_to_vva(vsession, desc->addr, sizeof(*task->resp));
553 		if (spdk_unlikely(desc->len < sizeof(struct virtio_scsi_cmd_resp) || task->resp == NULL)) {
554 			SPDK_WARNLOG("%s: Response descriptor at index %d points to invalid guest memory region\n",
555 				     vdev->name, task->req_idx);
556 			goto invalid_task;
557 		}
558 		rc = spdk_vhost_vring_desc_get_next(&desc, desc_table, desc_table_len);
559 		if (spdk_unlikely(rc != 0)) {
560 			SPDK_WARNLOG("%s: invalid descriptor chain at request index %d (descriptor id overflow?).\n",
561 				     vdev->name, task->req_idx);
562 			goto invalid_task;
563 		}
564 
565 		if (desc == NULL) {
566 			/*
567 			 * TEST UNIT READY command and some others might not contain any payload and this is not an error.
568 			 */
569 			SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI_DATA,
570 				      "No payload descriptors for FROM DEV command req_idx=%"PRIu16".\n", task->req_idx);
571 			SPDK_LOGDUMP(SPDK_LOG_VHOST_SCSI_DATA, "CDB=", (*req)->cdb, VIRTIO_SCSI_CDB_SIZE);
572 			task->used_len = sizeof(struct virtio_scsi_cmd_resp);
573 			task->scsi.iovcnt = 1;
574 			task->scsi.iovs[0].iov_len = 0;
575 			task->scsi.length = 0;
576 			task->scsi.transfer_len = 0;
577 			return 0;
578 		}
579 
580 		/* All remaining descriptors are data. */
581 		while (desc) {
582 			if (spdk_unlikely(!spdk_vhost_vring_desc_is_wr(desc))) {
583 				SPDK_WARNLOG("FROM DEV cmd: descriptor nr %" PRIu16" in payload chain is read only.\n", iovcnt);
584 				goto invalid_task;
585 			}
586 
587 			if (spdk_unlikely(spdk_vhost_vring_desc_to_iov(vsession, iovs, &iovcnt, desc))) {
588 				goto invalid_task;
589 			}
590 			len += desc->len;
591 
592 			rc = spdk_vhost_vring_desc_get_next(&desc, desc_table, desc_table_len);
593 			if (spdk_unlikely(rc != 0)) {
594 				SPDK_WARNLOG("%s: invalid payload in descriptor chain starting at index %d.\n",
595 					     vdev->name, task->req_idx);
596 				goto invalid_task;
597 			}
598 		}
599 
600 		task->used_len = sizeof(struct virtio_scsi_cmd_resp) + len;
601 	} else {
602 		SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI_DATA, "TO DEV");
603 		/*
604 		 * TO_DEV (WRITE):[RD_req][RD_buf0]...[RD_bufN][WR_resp]
605 		 * No need to check descriptor WR flag as this is done while setting scsi.dxfer_dir.
606 		 */
607 
608 		/* Process descriptors up to response. */
609 		while (!spdk_vhost_vring_desc_is_wr(desc)) {
610 			if (spdk_unlikely(spdk_vhost_vring_desc_to_iov(vsession, iovs, &iovcnt, desc))) {
611 				goto invalid_task;
612 			}
613 			len += desc->len;
614 
615 			spdk_vhost_vring_desc_get_next(&desc, desc_table, desc_table_len);
616 			if (spdk_unlikely(desc == NULL)) {
617 				SPDK_WARNLOG("TO_DEV cmd: no response descriptor.\n");
618 				goto invalid_task;
619 			}
620 		}
621 
622 		task->resp = spdk_vhost_gpa_to_vva(vsession, desc->addr, sizeof(*task->resp));
623 		if (spdk_unlikely(desc->len < sizeof(struct virtio_scsi_cmd_resp) || task->resp == NULL)) {
624 			SPDK_WARNLOG("%s: Response descriptor at index %d points to invalid guest memory region\n",
625 				     vdev->name, task->req_idx);
626 			goto invalid_task;
627 		}
628 
629 		task->used_len = sizeof(struct virtio_scsi_cmd_resp);
630 	}
631 
632 	task->scsi.iovcnt = iovcnt;
633 	task->scsi.length = len;
634 	task->scsi.transfer_len = len;
635 	return 0;
636 
637 invalid_task:
638 	SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI_DATA, "%s: Invalid task at index %"PRIu16".\n",
639 		      vdev->name, task->req_idx);
640 	return -1;
641 }
642 
643 static int
644 process_request(struct spdk_vhost_scsi_task *task)
645 {
646 	struct virtio_scsi_cmd_req *req;
647 	int result;
648 
649 	result = task_data_setup(task, &req);
650 	if (result) {
651 		return result;
652 	}
653 
654 	result = spdk_vhost_scsi_task_init_target(task, req->lun);
655 	if (spdk_unlikely(result != 0)) {
656 		task->resp->response = VIRTIO_SCSI_S_BAD_TARGET;
657 		return -1;
658 	}
659 
660 	task->scsi.cdb = req->cdb;
661 	SPDK_LOGDUMP(SPDK_LOG_VHOST_SCSI_DATA, "request CDB", req->cdb, VIRTIO_SCSI_CDB_SIZE);
662 
663 	if (spdk_unlikely(task->scsi.lun == NULL)) {
664 		spdk_scsi_task_process_null_lun(&task->scsi);
665 		task->resp->response = VIRTIO_SCSI_S_OK;
666 		return 1;
667 	}
668 
669 	return 0;
670 }
671 
672 static void
673 process_controlq(struct spdk_vhost_scsi_session *svsession, struct spdk_vhost_virtqueue *vq)
674 {
675 	struct spdk_vhost_scsi_dev *svdev = svsession->svdev;
676 	struct spdk_vhost_session *vsession = &svsession->vsession;
677 	struct spdk_vhost_scsi_task *task;
678 	uint16_t reqs[32];
679 	uint16_t reqs_cnt, i;
680 
681 	reqs_cnt = spdk_vhost_vq_avail_ring_get(vq, reqs, SPDK_COUNTOF(reqs));
682 	for (i = 0; i < reqs_cnt; i++) {
683 		if (spdk_unlikely(reqs[i] >= vq->vring.size)) {
684 			SPDK_ERRLOG("%s: invalid entry in avail ring. Buffer '%"PRIu16"' exceeds virtqueue size (%"PRIu16")\n",
685 				    svdev->vdev.name, reqs[i], vq->vring.size);
686 			spdk_vhost_vq_used_ring_enqueue(vsession, vq, reqs[i], 0);
687 			continue;
688 		}
689 
690 		task = &((struct spdk_vhost_scsi_task *)vq->tasks)[reqs[i]];
691 		if (spdk_unlikely(task->used)) {
692 			SPDK_ERRLOG("%s: invalid entry in avail ring. Buffer '%"PRIu16"' is still in use!\n",
693 				    svdev->vdev.name, reqs[i]);
694 			spdk_vhost_vq_used_ring_enqueue(vsession, vq, reqs[i], 0);
695 			continue;
696 		}
697 
698 		vsession->task_cnt++;
699 		memset(&task->scsi, 0, sizeof(task->scsi));
700 		task->tmf_resp = NULL;
701 		task->used = true;
702 		process_ctrl_request(task);
703 	}
704 }
705 
706 static void
707 process_requestq(struct spdk_vhost_scsi_session *svsession, struct spdk_vhost_virtqueue *vq)
708 {
709 	struct spdk_vhost_session *vsession = &svsession->vsession;
710 	struct spdk_vhost_dev *vdev = vsession->vdev;
711 	struct spdk_vhost_scsi_task *task;
712 	uint16_t reqs[32];
713 	uint16_t reqs_cnt, i;
714 	int result;
715 
716 	reqs_cnt = spdk_vhost_vq_avail_ring_get(vq, reqs, SPDK_COUNTOF(reqs));
717 	assert(reqs_cnt <= 32);
718 
719 	for (i = 0; i < reqs_cnt; i++) {
720 		SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI, "====== Starting processing request idx %"PRIu16"======\n",
721 			      reqs[i]);
722 
723 		if (spdk_unlikely(reqs[i] >= vq->vring.size)) {
724 			SPDK_ERRLOG("%s: request idx '%"PRIu16"' exceeds virtqueue size (%"PRIu16").\n",
725 				    vdev->name, reqs[i], vq->vring.size);
726 			spdk_vhost_vq_used_ring_enqueue(vsession, vq, reqs[i], 0);
727 			continue;
728 		}
729 
730 		task = &((struct spdk_vhost_scsi_task *)vq->tasks)[reqs[i]];
731 		if (spdk_unlikely(task->used)) {
732 			SPDK_ERRLOG("%s: request with idx '%"PRIu16"' is already pending.\n",
733 				    vdev->name, reqs[i]);
734 			spdk_vhost_vq_used_ring_enqueue(vsession, vq, reqs[i], 0);
735 			continue;
736 		}
737 
738 		vsession->task_cnt++;
739 		memset(&task->scsi, 0, sizeof(task->scsi));
740 		task->resp = NULL;
741 		task->used = true;
742 		task->used_len = 0;
743 		result = process_request(task);
744 		if (likely(result == 0)) {
745 			task_submit(task);
746 			SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI, "====== Task %p req_idx %d submitted ======\n", task,
747 				      task->req_idx);
748 		} else if (result > 0) {
749 			spdk_vhost_scsi_task_cpl(&task->scsi);
750 			SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI, "====== Task %p req_idx %d finished early ======\n", task,
751 				      task->req_idx);
752 		} else {
753 			invalid_request(task);
754 			SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI, "====== Task %p req_idx %d failed ======\n", task,
755 				      task->req_idx);
756 		}
757 	}
758 }
759 
760 static int
761 vdev_mgmt_worker(void *arg)
762 {
763 	struct spdk_vhost_scsi_session *svsession = arg;
764 	struct spdk_vhost_session *vsession = &svsession->vsession;
765 
766 	process_removed_devs(svsession);
767 	spdk_vhost_vq_used_signal(vsession, &vsession->virtqueue[VIRTIO_SCSI_EVENTQ]);
768 
769 	process_controlq(svsession, &vsession->virtqueue[VIRTIO_SCSI_CONTROLQ]);
770 	spdk_vhost_vq_used_signal(vsession, &vsession->virtqueue[VIRTIO_SCSI_CONTROLQ]);
771 
772 	return -1;
773 }
774 
775 static int
776 vdev_worker(void *arg)
777 {
778 	struct spdk_vhost_scsi_session *svsession = arg;
779 	struct spdk_vhost_session *vsession = &svsession->vsession;
780 	uint32_t q_idx;
781 
782 	for (q_idx = VIRTIO_SCSI_REQUESTQ; q_idx < vsession->max_queues; q_idx++) {
783 		process_requestq(svsession, &vsession->virtqueue[q_idx]);
784 	}
785 
786 	spdk_vhost_session_used_signal(vsession);
787 
788 	return -1;
789 }
790 
791 static struct spdk_vhost_scsi_dev *
792 to_scsi_dev(struct spdk_vhost_dev *ctrlr)
793 {
794 	if (ctrlr == NULL) {
795 		return NULL;
796 	}
797 
798 	if (ctrlr->backend != &spdk_vhost_scsi_device_backend) {
799 		SPDK_ERRLOG("%s: not a vhost-scsi device.\n", ctrlr->name);
800 		return NULL;
801 	}
802 
803 	return SPDK_CONTAINEROF(ctrlr, struct spdk_vhost_scsi_dev, vdev);
804 }
805 
806 static struct spdk_vhost_scsi_session *
807 to_scsi_session(struct spdk_vhost_session *vsession)
808 {
809 	if (vsession == NULL) {
810 		return NULL;
811 	}
812 
813 	if (vsession->vdev->backend != &spdk_vhost_scsi_device_backend) {
814 		SPDK_ERRLOG("%s: not a vhost-scsi device.\n", vsession->vdev->name);
815 		return NULL;
816 	}
817 
818 	return (struct spdk_vhost_scsi_session *)vsession;
819 }
820 
821 int
822 spdk_vhost_scsi_dev_construct(const char *name, const char *cpumask)
823 {
824 	struct spdk_vhost_scsi_dev *svdev = spdk_dma_zmalloc(sizeof(struct spdk_vhost_scsi_dev),
825 					    SPDK_CACHE_LINE_SIZE, NULL);
826 	int rc;
827 
828 	if (svdev == NULL) {
829 		return -ENOMEM;
830 	}
831 
832 	spdk_vhost_lock();
833 	rc = spdk_vhost_dev_register(&svdev->vdev, name, cpumask,
834 				     &spdk_vhost_scsi_device_backend);
835 
836 	if (rc) {
837 		spdk_dma_free(svdev);
838 	}
839 
840 	spdk_vhost_unlock();
841 	return rc;
842 }
843 
844 static int
845 spdk_vhost_scsi_dev_remove(struct spdk_vhost_dev *vdev)
846 {
847 	struct spdk_vhost_scsi_dev *svdev = to_scsi_dev(vdev);
848 	int rc, i;
849 
850 	if (svdev == NULL) {
851 		return -EINVAL;
852 	}
853 
854 	for (i = 0; i < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS; ++i) {
855 		if (svdev->scsi_dev_state[i].dev) {
856 			if (vdev->registered) {
857 				SPDK_ERRLOG("Trying to remove non-empty controller: %s.\n", vdev->name);
858 				return -EBUSY;
859 			}
860 
861 			rc = spdk_vhost_scsi_dev_remove_tgt(vdev, i, NULL, NULL);
862 			if (rc != 0) {
863 				SPDK_ERRLOG("%s: failed to force-remove target %d\n", vdev->name, i);
864 				return rc;
865 			}
866 		}
867 	}
868 
869 	rc = spdk_vhost_dev_unregister(vdev);
870 	if (rc != 0) {
871 		return rc;
872 	}
873 
874 	spdk_dma_free(svdev);
875 	return 0;
876 }
877 
878 struct spdk_scsi_dev *
879 spdk_vhost_scsi_dev_get_tgt(struct spdk_vhost_dev *vdev, uint8_t num)
880 {
881 	struct spdk_vhost_scsi_dev *svdev;
882 
883 	assert(num < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS);
884 	svdev = to_scsi_dev(vdev);
885 	if (svdev == NULL || svdev->scsi_dev_state[num].status != VHOST_SCSI_DEV_PRESENT) {
886 		return NULL;
887 	}
888 
889 	assert(svdev->scsi_dev_state[num].dev != NULL);
890 	return svdev->scsi_dev_state[num].dev;
891 }
892 
893 static void
894 spdk_vhost_scsi_lun_hotremove(const struct spdk_scsi_lun *lun, void *arg)
895 {
896 	struct spdk_vhost_scsi_dev *svdev = arg;
897 	const struct spdk_scsi_dev *scsi_dev;
898 	unsigned scsi_dev_num;
899 
900 	assert(lun != NULL);
901 	assert(svdev != NULL);
902 	scsi_dev = spdk_scsi_lun_get_dev(lun);
903 	for (scsi_dev_num = 0; scsi_dev_num < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS; scsi_dev_num++) {
904 		if (svdev->scsi_dev_state[scsi_dev_num].dev == scsi_dev) {
905 			break;
906 		}
907 	}
908 
909 	if (scsi_dev_num == SPDK_VHOST_SCSI_CTRLR_MAX_DEVS) {
910 		/* The entire device has been already removed. */
911 		return;
912 	}
913 
914 	/* remove entire device */
915 	spdk_vhost_scsi_dev_remove_tgt(&svdev->vdev, scsi_dev_num, NULL, NULL);
916 }
917 
918 static int
919 spdk_vhost_scsi_session_add_tgt(struct spdk_vhost_dev *vdev,
920 				struct spdk_vhost_session *vsession, void *ctx)
921 {
922 	unsigned scsi_tgt_num = (unsigned)(uintptr_t)ctx;
923 	struct spdk_vhost_scsi_session *svsession;
924 	int rc;
925 
926 	if (vsession == NULL) {
927 		/* Nothing more to do */
928 		return 0;
929 	}
930 
931 	svsession = (struct spdk_vhost_scsi_session *)vsession;
932 	/* copy the entire device state */
933 	svsession->scsi_dev_state[scsi_tgt_num] = svsession->svdev->scsi_dev_state[scsi_tgt_num];
934 
935 	if (vsession->lcore == -1) {
936 		/* All done. */
937 		return 0;
938 	}
939 
940 	rc = spdk_scsi_dev_allocate_io_channels(svsession->scsi_dev_state[scsi_tgt_num].dev);
941 	if (rc != 0) {
942 		SPDK_ERRLOG("Couldn't allocate io channnel for SCSI target %u in device %s\n",
943 			    scsi_tgt_num, vdev->name);
944 
945 		/* unset the SCSI target so that all I/O to it will be rejected */
946 		svsession->scsi_dev_state[scsi_tgt_num].dev = NULL;
947 		/* Set status to EMPTY so that we won't reply with SCSI hotremove
948 		 * sense codes - the device hasn't ever been added.
949 		 */
950 		svsession->scsi_dev_state[scsi_tgt_num].status = VHOST_SCSI_DEV_EMPTY;
951 
952 		/* Return with no error. We'll continue allocating io_channels for
953 		 * other sessions on this device in hopes they succeed. The sessions
954 		 * that failed to allocate io_channels simply won't be able to
955 		 * detect the SCSI target, nor do any I/O to it.
956 		 */
957 		return 0;
958 	}
959 
960 	if (spdk_vhost_dev_has_feature(vsession, VIRTIO_SCSI_F_HOTPLUG)) {
961 		eventq_enqueue(svsession, scsi_tgt_num,
962 			       VIRTIO_SCSI_T_TRANSPORT_RESET, VIRTIO_SCSI_EVT_RESET_RESCAN);
963 	} else {
964 		SPDK_NOTICELOG("Device %s does not support hotplug. "
965 			       "Please restart the driver or perform a rescan.\n",
966 			       vdev->name);
967 	}
968 
969 	return 0;
970 }
971 
972 int
973 spdk_vhost_scsi_dev_add_tgt(struct spdk_vhost_dev *vdev, int scsi_tgt_num,
974 			    const char *bdev_name)
975 {
976 	struct spdk_vhost_scsi_dev *svdev;
977 	struct spdk_scsi_dev_vhost_state *state;
978 	char target_name[SPDK_SCSI_DEV_MAX_NAME];
979 	int lun_id_list[1];
980 	const char *bdev_names_list[1];
981 
982 	svdev = to_scsi_dev(vdev);
983 	if (svdev == NULL) {
984 		return -EINVAL;
985 	}
986 
987 	if (scsi_tgt_num < 0) {
988 		for (scsi_tgt_num = 0; scsi_tgt_num < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS; scsi_tgt_num++) {
989 			if (svdev->scsi_dev_state[scsi_tgt_num].dev == NULL) {
990 				break;
991 			}
992 		}
993 
994 		if (scsi_tgt_num == SPDK_VHOST_SCSI_CTRLR_MAX_DEVS) {
995 			SPDK_ERRLOG("Controller %s - all targets already in use.\n", vdev->name);
996 			return -ENOSPC;
997 		}
998 	} else {
999 		if (scsi_tgt_num >= SPDK_VHOST_SCSI_CTRLR_MAX_DEVS) {
1000 			SPDK_ERRLOG("Controller %s target %d number too big (max %d)\n", vdev->name, scsi_tgt_num,
1001 				    SPDK_VHOST_SCSI_CTRLR_MAX_DEVS);
1002 			return -EINVAL;
1003 		}
1004 	}
1005 
1006 	if (bdev_name == NULL) {
1007 		SPDK_ERRLOG("No lun name specified\n");
1008 		return -EINVAL;
1009 	}
1010 
1011 	state = &svdev->scsi_dev_state[scsi_tgt_num];
1012 	if (state->dev != NULL) {
1013 		SPDK_ERRLOG("Controller %s target %u already occupied\n", vdev->name, scsi_tgt_num);
1014 		return -EEXIST;
1015 	}
1016 
1017 	/*
1018 	 * At this stage only one LUN per target
1019 	 */
1020 	snprintf(target_name, sizeof(target_name), "Target %u", scsi_tgt_num);
1021 	lun_id_list[0] = 0;
1022 	bdev_names_list[0] = (char *)bdev_name;
1023 
1024 	state->status = VHOST_SCSI_DEV_PRESENT;
1025 	state->dev = spdk_scsi_dev_construct(target_name, bdev_names_list, lun_id_list, 1,
1026 					     SPDK_SPC_PROTOCOL_IDENTIFIER_SAS,
1027 					     spdk_vhost_scsi_lun_hotremove, svdev);
1028 
1029 	if (state->dev == NULL) {
1030 		state->status = VHOST_SCSI_DEV_EMPTY;
1031 		SPDK_ERRLOG("Couldn't create spdk SCSI target '%s' using bdev '%s' in controller: %s\n",
1032 			    target_name, bdev_name, vdev->name);
1033 		return -EINVAL;
1034 	}
1035 	spdk_scsi_dev_add_port(state->dev, 0, "vhost");
1036 
1037 	SPDK_INFOLOG(SPDK_LOG_VHOST, "Controller %s: defined target '%s' using bdev '%s'\n",
1038 		     vdev->name, target_name, bdev_name);
1039 
1040 	spdk_vhost_dev_foreach_session(vdev, spdk_vhost_scsi_session_add_tgt,
1041 				       (void *)(uintptr_t)scsi_tgt_num);
1042 	return scsi_tgt_num;
1043 }
1044 
1045 static int
1046 spdk_vhost_scsi_session_remove_tgt(struct spdk_vhost_dev *vdev,
1047 				   struct spdk_vhost_session *vsession, void *ctx)
1048 {
1049 	unsigned scsi_tgt_num = (unsigned)(uintptr_t)ctx;
1050 	struct spdk_vhost_scsi_session *svsession;
1051 	struct spdk_scsi_dev_vhost_state *state;
1052 	int rc = 0;
1053 
1054 	if (vsession == NULL) {
1055 		struct spdk_vhost_scsi_dev *svdev = SPDK_CONTAINEROF(vdev,
1056 						    struct spdk_vhost_scsi_dev, vdev);
1057 
1058 		if (vdev->active_session_num == 0) {
1059 			/* there aren't any active sessions, so remove the dev and exit */
1060 			rc = remove_scsi_tgt(svdev, scsi_tgt_num);
1061 		}
1062 		return rc;
1063 	}
1064 
1065 	/* Mark the target for removal */
1066 	svsession = (struct spdk_vhost_scsi_session *)vsession;
1067 	state = &svsession->scsi_dev_state[scsi_tgt_num];
1068 	assert(state->status == VHOST_SCSI_DEV_PRESENT);
1069 	state->status = VHOST_SCSI_DEV_REMOVING;
1070 
1071 	/* If the session isn't currently polled, unset the dev straight away */
1072 	if (vsession->lcore == -1) {
1073 		state->dev = NULL;
1074 		return 0;
1075 	}
1076 
1077 	/* Otherwise, send a hotremove Virtio event and wait for the session's
1078 	 * management poller to remove the target after all its pending I/O
1079 	 * has finished.
1080 	 */
1081 	if (spdk_vhost_dev_has_feature(vsession, VIRTIO_SCSI_F_HOTPLUG)) {
1082 		eventq_enqueue(svsession, scsi_tgt_num,
1083 			       VIRTIO_SCSI_T_TRANSPORT_RESET, VIRTIO_SCSI_EVT_RESET_REMOVED);
1084 	}
1085 
1086 	return 0;
1087 }
1088 
1089 int
1090 spdk_vhost_scsi_dev_remove_tgt(struct spdk_vhost_dev *vdev, unsigned scsi_tgt_num,
1091 			       spdk_vhost_event_fn cb_fn, void *cb_arg)
1092 {
1093 	struct spdk_vhost_scsi_dev *svdev;
1094 	struct spdk_scsi_dev_vhost_state *scsi_dev_state;
1095 
1096 	if (scsi_tgt_num >= SPDK_VHOST_SCSI_CTRLR_MAX_DEVS) {
1097 		SPDK_ERRLOG("%s: invalid target number %d\n", vdev->name, scsi_tgt_num);
1098 		return -EINVAL;
1099 	}
1100 
1101 	svdev = to_scsi_dev(vdev);
1102 	if (svdev == NULL) {
1103 		return -ENODEV;
1104 	}
1105 
1106 	scsi_dev_state = &svdev->scsi_dev_state[scsi_tgt_num];
1107 	if (scsi_dev_state->dev == NULL) {
1108 		SPDK_ERRLOG("Controller %s target %u is not occupied\n", vdev->name, scsi_tgt_num);
1109 		return -ENODEV;
1110 	}
1111 
1112 	assert(scsi_dev_state->status != VHOST_SCSI_DEV_EMPTY);
1113 	if (scsi_dev_state->status != VHOST_SCSI_DEV_PRESENT) {
1114 		SPDK_WARNLOG("%s: 'Target %u' has been already marked to hotremove.\n",
1115 			     vdev->name, scsi_tgt_num);
1116 		return -EBUSY;
1117 	}
1118 
1119 	scsi_dev_state->remove_cb = cb_fn;
1120 	scsi_dev_state->remove_ctx = cb_arg;
1121 	scsi_dev_state->status = VHOST_SCSI_DEV_REMOVING;
1122 
1123 	spdk_vhost_dev_foreach_session(vdev, spdk_vhost_scsi_session_remove_tgt,
1124 				       (void *)(uintptr_t)scsi_tgt_num);
1125 	return 0;
1126 }
1127 
1128 int
1129 spdk_vhost_scsi_controller_construct(void)
1130 {
1131 	struct spdk_conf_section *sp = spdk_conf_first_section(NULL);
1132 	struct spdk_vhost_dev *vdev;
1133 	int i, dev_num;
1134 	unsigned ctrlr_num = 0;
1135 	char *bdev_name, *tgt_num_str;
1136 	char *cpumask;
1137 	char *name;
1138 	char *tgt = NULL;
1139 
1140 	while (sp != NULL) {
1141 		if (!spdk_conf_section_match_prefix(sp, "VhostScsi")) {
1142 			sp = spdk_conf_next_section(sp);
1143 			continue;
1144 		}
1145 
1146 		if (sscanf(spdk_conf_section_get_name(sp), "VhostScsi%u", &ctrlr_num) != 1) {
1147 			SPDK_ERRLOG("Section '%s' has non-numeric suffix.\n",
1148 				    spdk_conf_section_get_name(sp));
1149 			return -1;
1150 		}
1151 
1152 		name =  spdk_conf_section_get_val(sp, "Name");
1153 		cpumask = spdk_conf_section_get_val(sp, "Cpumask");
1154 
1155 		if (spdk_vhost_scsi_dev_construct(name, cpumask) < 0) {
1156 			return -1;
1157 		}
1158 
1159 		vdev = spdk_vhost_dev_find(name);
1160 		assert(vdev);
1161 
1162 		for (i = 0; ; i++) {
1163 
1164 			tgt = spdk_conf_section_get_nval(sp, "Target", i);
1165 			if (tgt == NULL) {
1166 				break;
1167 			}
1168 
1169 			tgt_num_str = spdk_conf_section_get_nmval(sp, "Target", i, 0);
1170 			if (tgt_num_str == NULL) {
1171 				SPDK_ERRLOG("%s: Invalid or missing target number\n", name);
1172 				return -1;
1173 			}
1174 
1175 			dev_num = (int)strtol(tgt_num_str, NULL, 10);
1176 			bdev_name = spdk_conf_section_get_nmval(sp, "Target", i, 1);
1177 			if (bdev_name == NULL) {
1178 				SPDK_ERRLOG("%s: Invalid or missing bdev name for target %d\n", name, dev_num);
1179 				return -1;
1180 			} else if (spdk_conf_section_get_nmval(sp, "Target", i, 2)) {
1181 				SPDK_ERRLOG("%s: Only one LUN per vhost SCSI device supported\n", name);
1182 				return -1;
1183 			}
1184 
1185 			if (spdk_vhost_scsi_dev_add_tgt(vdev, dev_num, bdev_name) < 0) {
1186 				return -1;
1187 			}
1188 		}
1189 
1190 		sp = spdk_conf_next_section(sp);
1191 	}
1192 
1193 	return 0;
1194 }
1195 
1196 static void
1197 free_task_pool(struct spdk_vhost_scsi_session *svsession)
1198 {
1199 	struct spdk_vhost_session *vsession = &svsession->vsession;
1200 	struct spdk_vhost_virtqueue *vq;
1201 	uint16_t i;
1202 
1203 	for (i = 0; i < vsession->max_queues; i++) {
1204 		vq = &vsession->virtqueue[i];
1205 		if (vq->tasks == NULL) {
1206 			continue;
1207 		}
1208 
1209 		spdk_dma_free(vq->tasks);
1210 		vq->tasks = NULL;
1211 	}
1212 }
1213 
1214 static int
1215 alloc_task_pool(struct spdk_vhost_scsi_session *svsession)
1216 {
1217 	struct spdk_vhost_session *vsession = &svsession->vsession;
1218 	struct spdk_vhost_scsi_dev *svdev = svsession->svdev;
1219 	struct spdk_vhost_virtqueue *vq;
1220 	struct spdk_vhost_scsi_task *task;
1221 	uint32_t task_cnt;
1222 	uint16_t i;
1223 	uint32_t j;
1224 
1225 	for (i = 0; i < vsession->max_queues; i++) {
1226 		vq = &vsession->virtqueue[i];
1227 		if (vq->vring.desc == NULL) {
1228 			continue;
1229 		}
1230 
1231 		task_cnt = vq->vring.size;
1232 		if (task_cnt > SPDK_VHOST_MAX_VQ_SIZE) {
1233 			/* sanity check */
1234 			SPDK_ERRLOG("Controller %s: virtuque %"PRIu16" is too big. (size = %"PRIu32", max = %"PRIu32")\n",
1235 				    svdev->vdev.name, i, task_cnt, SPDK_VHOST_MAX_VQ_SIZE);
1236 			free_task_pool(svsession);
1237 			return -1;
1238 		}
1239 		vq->tasks = spdk_dma_zmalloc(sizeof(struct spdk_vhost_scsi_task) * task_cnt,
1240 					     SPDK_CACHE_LINE_SIZE, NULL);
1241 		if (vq->tasks == NULL) {
1242 			SPDK_ERRLOG("Controller %s: failed to allocate %"PRIu32" tasks for virtqueue %"PRIu16"\n",
1243 				    svdev->vdev.name, task_cnt, i);
1244 			free_task_pool(svsession);
1245 			return -1;
1246 		}
1247 
1248 		for (j = 0; j < task_cnt; j++) {
1249 			task = &((struct spdk_vhost_scsi_task *)vq->tasks)[j];
1250 			task->svsession = svsession;
1251 			task->vq = vq;
1252 			task->req_idx = j;
1253 		}
1254 	}
1255 
1256 	return 0;
1257 }
1258 
1259 static int
1260 spdk_vhost_scsi_start_cb(struct spdk_vhost_dev *vdev,
1261 			 struct spdk_vhost_session *vsession, void *unused)
1262 {
1263 	struct spdk_vhost_scsi_dev *svdev;
1264 	struct spdk_vhost_scsi_session *svsession;
1265 	struct spdk_scsi_dev_vhost_state *state;
1266 	uint32_t i;
1267 	int rc;
1268 
1269 	svsession = to_scsi_session(vsession);
1270 	assert(svsession != NULL);
1271 	svdev = svsession->svdev;
1272 
1273 	/* validate all I/O queues are in a contiguous index range */
1274 	for (i = VIRTIO_SCSI_REQUESTQ; i < vsession->max_queues; i++) {
1275 		if (vsession->virtqueue[i].vring.desc == NULL) {
1276 			SPDK_ERRLOG("%s: queue %"PRIu32" is empty\n", vsession->vdev->name, i);
1277 			rc = -1;
1278 			goto out;
1279 		}
1280 	}
1281 
1282 	rc = alloc_task_pool(svsession);
1283 	if (rc != 0) {
1284 		SPDK_ERRLOG("%s: failed to alloc task pool.\n", vdev->name);
1285 		goto out;
1286 	}
1287 
1288 	for (i = 0; i < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS; i++) {
1289 		state = &svdev->scsi_dev_state[i];
1290 		if (state->dev == NULL) {
1291 			continue;
1292 		}
1293 		svsession->scsi_dev_state[i] = *state;
1294 		rc = spdk_scsi_dev_allocate_io_channels(state->dev);
1295 		if (rc != 0) {
1296 			SPDK_ERRLOG("%s: failed to alloc io_channel for SCSI target %"PRIu32"\n", vdev->name, i);
1297 			/* unset the SCSI target so that all I/O to it will be rejected */
1298 			svsession->scsi_dev_state[i].dev = NULL;
1299 			/* set EMPTY state so that we won't reply with SCSI hotremove
1300 			 * sense codes - the device hasn't ever been added.
1301 			 */
1302 			svsession->scsi_dev_state[i].status = VHOST_SCSI_DEV_EMPTY;
1303 			continue;
1304 		}
1305 	}
1306 	SPDK_INFOLOG(SPDK_LOG_VHOST, "Started poller for vhost controller %s on lcore %d\n",
1307 		     vdev->name, vsession->lcore);
1308 
1309 	svsession->requestq_poller = spdk_poller_register(vdev_worker, svsession, 0);
1310 	if (vsession->virtqueue[VIRTIO_SCSI_CONTROLQ].vring.desc &&
1311 	    vsession->virtqueue[VIRTIO_SCSI_EVENTQ].vring.desc) {
1312 		svsession->mgmt_poller = spdk_poller_register(vdev_mgmt_worker, svsession,
1313 					 MGMT_POLL_PERIOD_US);
1314 	}
1315 out:
1316 	spdk_vhost_session_event_done(vsession, rc);
1317 	return rc;
1318 }
1319 
1320 static int
1321 spdk_vhost_scsi_start(struct spdk_vhost_session *vsession)
1322 {
1323 	struct spdk_vhost_scsi_session *svsession;
1324 	struct spdk_vhost_scsi_dev *svdev;
1325 	int rc;
1326 
1327 	svsession = to_scsi_session(vsession);
1328 	if (svsession == NULL) {
1329 		SPDK_ERRLOG("Trying to start non-scsi session as a scsi one.\n");
1330 		return -1;
1331 	}
1332 
1333 	svdev = to_scsi_dev(vsession->vdev);
1334 	assert(svdev != NULL);
1335 	svsession->svdev = svdev;
1336 
1337 	if (svdev->vdev.active_session_num == 0) {
1338 		svdev->lcore = spdk_vhost_allocate_reactor(svdev->vdev.cpumask);
1339 	}
1340 
1341 	vsession->lcore = svdev->lcore;
1342 	rc = spdk_vhost_session_send_event(vsession, spdk_vhost_scsi_start_cb,
1343 					   3, "start session");
1344 	if (rc != 0) {
1345 		vsession->lcore = -1;
1346 
1347 		if (svdev->vdev.active_session_num == 0) {
1348 			spdk_vhost_free_reactor(svdev->lcore);
1349 			svdev->lcore = -1;
1350 		}
1351 	}
1352 
1353 	return rc;
1354 }
1355 
1356 static int
1357 destroy_session_poller_cb(void *arg)
1358 {
1359 	struct spdk_vhost_scsi_session *svsession = arg;
1360 	struct spdk_vhost_session *vsession = &svsession->vsession;
1361 	uint32_t i;
1362 
1363 	if (vsession->task_cnt > 0) {
1364 		return -1;
1365 	}
1366 
1367 
1368 	for (i = 0; i < vsession->max_queues; i++) {
1369 		spdk_vhost_vq_used_signal(vsession, &vsession->virtqueue[i]);
1370 	}
1371 
1372 	for (i = 0; i < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS; i++) {
1373 		if (svsession->scsi_dev_state[i].dev == NULL) {
1374 			continue;
1375 		}
1376 
1377 		spdk_scsi_dev_free_io_channels(svsession->scsi_dev_state[i].dev);
1378 	}
1379 
1380 	SPDK_INFOLOG(SPDK_LOG_VHOST, "Stopping poller for vhost controller %s\n",
1381 		     svsession->svdev->vdev.name);
1382 
1383 	free_task_pool(svsession);
1384 
1385 	spdk_poller_unregister(&svsession->stop_poller);
1386 	spdk_vhost_session_event_done(vsession, 0);
1387 
1388 	return -1;
1389 }
1390 
1391 static int
1392 spdk_vhost_scsi_stop_cb(struct spdk_vhost_dev *vdev,
1393 			struct spdk_vhost_session *vsession, void *unused)
1394 {
1395 	struct spdk_vhost_scsi_session *svsession;
1396 
1397 	svsession = to_scsi_session(vsession);
1398 	assert(svsession != NULL);
1399 	spdk_poller_unregister(&svsession->requestq_poller);
1400 	spdk_poller_unregister(&svsession->mgmt_poller);
1401 	svsession->stop_poller = spdk_poller_register(destroy_session_poller_cb,
1402 				 svsession, 1000);
1403 
1404 	return 0;
1405 }
1406 
1407 static int
1408 spdk_vhost_scsi_stop(struct spdk_vhost_session *vsession)
1409 {
1410 	struct spdk_vhost_scsi_session *svsession;
1411 	int rc;
1412 
1413 	svsession = to_scsi_session(vsession);
1414 	if (svsession == NULL) {
1415 		SPDK_ERRLOG("Trying to stop non-scsi session as a scsi one.\n");
1416 		return -1;
1417 	}
1418 	rc = spdk_vhost_session_send_event(vsession, spdk_vhost_scsi_stop_cb,
1419 					   3, "stop session");
1420 	if (rc != 0) {
1421 		return rc;
1422 	}
1423 
1424 	vsession->lcore = -1;
1425 	if (vsession->vdev->active_session_num == 1) {
1426 		spdk_vhost_free_reactor(svsession->svdev->lcore);
1427 		svsession->svdev->lcore = -1;
1428 	}
1429 	return 0;
1430 }
1431 
1432 static void
1433 spdk_vhost_scsi_dump_info_json(struct spdk_vhost_dev *vdev, struct spdk_json_write_ctx *w)
1434 {
1435 	struct spdk_scsi_dev *sdev;
1436 	struct spdk_scsi_lun *lun;
1437 	uint32_t dev_idx;
1438 	uint32_t lun_idx;
1439 
1440 	assert(vdev != NULL);
1441 	spdk_json_write_named_array_begin(w, "scsi");
1442 	for (dev_idx = 0; dev_idx < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS; dev_idx++) {
1443 		sdev = spdk_vhost_scsi_dev_get_tgt(vdev, dev_idx);
1444 		if (!sdev) {
1445 			continue;
1446 		}
1447 
1448 		spdk_json_write_object_begin(w);
1449 
1450 		spdk_json_write_named_uint32(w, "scsi_dev_num", dev_idx);
1451 
1452 		spdk_json_write_named_uint32(w, "id", spdk_scsi_dev_get_id(sdev));
1453 
1454 		spdk_json_write_named_string(w, "target_name", spdk_scsi_dev_get_name(sdev));
1455 
1456 		spdk_json_write_named_array_begin(w, "luns");
1457 
1458 		for (lun_idx = 0; lun_idx < SPDK_SCSI_DEV_MAX_LUN; lun_idx++) {
1459 			lun = spdk_scsi_dev_get_lun(sdev, lun_idx);
1460 			if (!lun) {
1461 				continue;
1462 			}
1463 
1464 			spdk_json_write_object_begin(w);
1465 
1466 			spdk_json_write_named_int32(w, "id", spdk_scsi_lun_get_id(lun));
1467 
1468 			spdk_json_write_named_string(w, "bdev_name", spdk_scsi_lun_get_bdev_name(lun));
1469 
1470 			spdk_json_write_object_end(w);
1471 		}
1472 
1473 		spdk_json_write_array_end(w);
1474 		spdk_json_write_object_end(w);
1475 	}
1476 
1477 	spdk_json_write_array_end(w);
1478 }
1479 
1480 static void
1481 spdk_vhost_scsi_write_config_json(struct spdk_vhost_dev *vdev, struct spdk_json_write_ctx *w)
1482 {
1483 	struct spdk_scsi_dev *scsi_dev;
1484 	struct spdk_scsi_lun *lun;
1485 	uint32_t i;
1486 
1487 	if (to_scsi_dev(vdev) == NULL) {
1488 		return;
1489 	}
1490 
1491 	spdk_json_write_object_begin(w);
1492 	spdk_json_write_named_string(w, "method", "construct_vhost_scsi_controller");
1493 
1494 	spdk_json_write_named_object_begin(w, "params");
1495 	spdk_json_write_named_string(w, "ctrlr", vdev->name);
1496 	spdk_json_write_named_string(w, "cpumask", spdk_cpuset_fmt(vdev->cpumask));
1497 	spdk_json_write_object_end(w);
1498 
1499 	spdk_json_write_object_end(w);
1500 
1501 	for (i = 0; i < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS; i++) {
1502 		scsi_dev = spdk_vhost_scsi_dev_get_tgt(vdev, i);
1503 		if (scsi_dev == NULL) {
1504 			continue;
1505 		}
1506 
1507 		lun = spdk_scsi_dev_get_lun(scsi_dev, 0);
1508 
1509 		spdk_json_write_object_begin(w);
1510 		spdk_json_write_named_string(w, "method", "add_vhost_scsi_lun");
1511 
1512 		spdk_json_write_named_object_begin(w, "params");
1513 		spdk_json_write_named_string(w, "ctrlr", vdev->name);
1514 		spdk_json_write_named_uint32(w, "scsi_target_num", i);
1515 
1516 		spdk_json_write_named_string(w, "bdev_name", spdk_scsi_lun_get_bdev_name(lun));
1517 		spdk_json_write_object_end(w);
1518 
1519 		spdk_json_write_object_end(w);
1520 	}
1521 }
1522 
1523 SPDK_LOG_REGISTER_COMPONENT("vhost_scsi", SPDK_LOG_VHOST_SCSI)
1524 SPDK_LOG_REGISTER_COMPONENT("vhost_scsi_queue", SPDK_LOG_VHOST_SCSI_QUEUE)
1525 SPDK_LOG_REGISTER_COMPONENT("vhost_scsi_data", SPDK_LOG_VHOST_SCSI_DATA)
1526