xref: /spdk/lib/vhost/vhost_scsi.c (revision 712a3f69d32632bf6c862f00200f7f437d3f7529)
1 /*-
2  *   BSD LICENSE
3  *
4  *   Copyright(c) Intel Corporation. All rights reserved.
5  *   All rights reserved.
6  *
7  *   Redistribution and use in source and binary forms, with or without
8  *   modification, are permitted provided that the following conditions
9  *   are met:
10  *
11  *     * Redistributions of source code must retain the above copyright
12  *       notice, this list of conditions and the following disclaimer.
13  *     * Redistributions in binary form must reproduce the above copyright
14  *       notice, this list of conditions and the following disclaimer in
15  *       the documentation and/or other materials provided with the
16  *       distribution.
17  *     * Neither the name of Intel Corporation nor the names of its
18  *       contributors may be used to endorse or promote products derived
19  *       from this software without specific prior written permission.
20  *
21  *   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
22  *   "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
23  *   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
24  *   A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
25  *   OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
26  *   SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
27  *   LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
28  *   DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
29  *   THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
30  *   (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
31  *   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
32  */
33 
34 #include "spdk/stdinc.h"
35 
36 #include <linux/virtio_scsi.h>
37 
38 #include "spdk/env.h"
39 #include "spdk/thread.h"
40 #include "spdk/scsi.h"
41 #include "spdk/scsi_spec.h"
42 #include "spdk/conf.h"
43 #include "spdk/event.h"
44 #include "spdk/util.h"
45 #include "spdk/likely.h"
46 
47 #include "spdk/vhost.h"
48 #include "vhost_internal.h"
49 
50 /* Features supported by SPDK VHOST lib. */
51 #define SPDK_VHOST_SCSI_FEATURES	(SPDK_VHOST_FEATURES | \
52 					(1ULL << VIRTIO_SCSI_F_INOUT) | \
53 					(1ULL << VIRTIO_SCSI_F_HOTPLUG) | \
54 					(1ULL << VIRTIO_SCSI_F_CHANGE ) | \
55 					(1ULL << VIRTIO_SCSI_F_T10_PI ))
56 
57 /* Features that are specified in VIRTIO SCSI but currently not supported:
58  * - Live migration not supported yet
59  * - T10 PI
60  */
61 #define SPDK_VHOST_SCSI_DISABLED_FEATURES	(SPDK_VHOST_DISABLED_FEATURES | \
62 						(1ULL << VIRTIO_SCSI_F_T10_PI ))
63 
64 #define MGMT_POLL_PERIOD_US (1000 * 5)
65 
66 #define VIRTIO_SCSI_CONTROLQ   0
67 #define VIRTIO_SCSI_EVENTQ   1
68 #define VIRTIO_SCSI_REQUESTQ   2
69 
70 enum spdk_scsi_dev_vhost_status {
71 	/* Target ID is empty. */
72 	VHOST_SCSI_DEV_EMPTY,
73 
74 	/* Target is still being added. */
75 	VHOST_SCSI_DEV_ADDING,
76 
77 	/* Target ID occupied. */
78 	VHOST_SCSI_DEV_PRESENT,
79 
80 	/* Target ID is occupied but removal is in progress. */
81 	VHOST_SCSI_DEV_REMOVING,
82 
83 	/* In session - device (SCSI target) seen but removed. */
84 	VHOST_SCSI_DEV_REMOVED,
85 };
86 
87 /** Context for a SCSI target in a vhost device */
88 struct spdk_scsi_dev_vhost_state {
89 	struct spdk_scsi_dev *dev;
90 	enum spdk_scsi_dev_vhost_status status;
91 	spdk_vhost_event_fn remove_cb;
92 	void *remove_ctx;
93 };
94 
95 struct spdk_vhost_scsi_dev {
96 	int ref;
97 	bool registered;
98 	struct spdk_vhost_dev vdev;
99 	struct spdk_scsi_dev_vhost_state scsi_dev_state[SPDK_VHOST_SCSI_CTRLR_MAX_DEVS];
100 
101 	/* The poll group for all active vhost sessions of this device */
102 	struct vhost_poll_group *poll_group;
103 };
104 
105 /** Context for a SCSI target in a vhost session */
106 struct spdk_scsi_dev_session_state {
107 	struct spdk_scsi_dev *dev;
108 	enum spdk_scsi_dev_vhost_status status;
109 };
110 
111 struct spdk_vhost_scsi_session {
112 	struct spdk_vhost_session vsession;
113 
114 	struct spdk_vhost_scsi_dev *svdev;
115 	/** Local copy of the device state */
116 	struct spdk_scsi_dev_session_state scsi_dev_state[SPDK_VHOST_SCSI_CTRLR_MAX_DEVS];
117 	struct spdk_poller *requestq_poller;
118 	struct spdk_poller *mgmt_poller;
119 	struct spdk_poller *stop_poller;
120 };
121 
122 struct spdk_vhost_scsi_task {
123 	struct spdk_scsi_task	scsi;
124 	struct iovec iovs[SPDK_VHOST_IOVS_MAX];
125 
126 	union {
127 		struct virtio_scsi_cmd_resp *resp;
128 		struct virtio_scsi_ctrl_tmf_resp *tmf_resp;
129 	};
130 
131 	struct spdk_vhost_scsi_session *svsession;
132 	struct spdk_scsi_dev *scsi_dev;
133 
134 	/** Number of bytes that were written. */
135 	uint32_t used_len;
136 
137 	int req_idx;
138 
139 	/* If set, the task is currently used for I/O processing. */
140 	bool used;
141 
142 	struct spdk_vhost_virtqueue *vq;
143 };
144 
145 static int vhost_scsi_start(struct spdk_vhost_session *vsession);
146 static int vhost_scsi_stop(struct spdk_vhost_session *vsession);
147 static void vhost_scsi_dump_info_json(struct spdk_vhost_dev *vdev,
148 				      struct spdk_json_write_ctx *w);
149 static void vhost_scsi_write_config_json(struct spdk_vhost_dev *vdev,
150 		struct spdk_json_write_ctx *w);
151 static int vhost_scsi_dev_remove(struct spdk_vhost_dev *vdev);
152 
153 const struct spdk_vhost_dev_backend spdk_vhost_scsi_device_backend = {
154 	.session_ctx_size = sizeof(struct spdk_vhost_scsi_session) - sizeof(struct spdk_vhost_session),
155 	.start_session =  vhost_scsi_start,
156 	.stop_session = vhost_scsi_stop,
157 	.dump_info_json = vhost_scsi_dump_info_json,
158 	.write_config_json = vhost_scsi_write_config_json,
159 	.remove_device = vhost_scsi_dev_remove,
160 };
161 
162 static void
163 vhost_scsi_task_put(struct spdk_vhost_scsi_task *task)
164 {
165 	spdk_scsi_task_put(&task->scsi);
166 }
167 
168 static void
169 vhost_scsi_task_free_cb(struct spdk_scsi_task *scsi_task)
170 {
171 	struct spdk_vhost_scsi_task *task = SPDK_CONTAINEROF(scsi_task, struct spdk_vhost_scsi_task, scsi);
172 	struct spdk_vhost_session *vsession = &task->svsession->vsession;
173 
174 	assert(vsession->task_cnt > 0);
175 	vsession->task_cnt--;
176 	task->used = false;
177 }
178 
179 static void
180 remove_scsi_tgt(struct spdk_vhost_scsi_dev *svdev,
181 		unsigned scsi_tgt_num)
182 {
183 	struct spdk_scsi_dev_vhost_state *state;
184 	struct spdk_scsi_dev *dev;
185 
186 	state = &svdev->scsi_dev_state[scsi_tgt_num];
187 	dev = state->dev;
188 	state->dev = NULL;
189 	assert(state->status == VHOST_SCSI_DEV_REMOVING);
190 	state->status = VHOST_SCSI_DEV_EMPTY;
191 	spdk_scsi_dev_destruct(dev, NULL, NULL);
192 	if (state->remove_cb) {
193 		state->remove_cb(&svdev->vdev, state->remove_ctx);
194 		state->remove_cb = NULL;
195 	}
196 	SPDK_INFOLOG(SPDK_LOG_VHOST, "%s: removed target 'Target %u'\n",
197 		     svdev->vdev.name, scsi_tgt_num);
198 
199 	if (--svdev->ref == 0 && svdev->registered == false) {
200 		free(svdev);
201 	}
202 }
203 
204 static void
205 vhost_scsi_dev_process_removed_cpl_cb(struct spdk_vhost_dev *vdev, void *ctx)
206 {
207 	unsigned scsi_tgt_num = (unsigned)(uintptr_t)ctx;
208 	struct spdk_vhost_scsi_dev *svdev = SPDK_CONTAINEROF(vdev,
209 					    struct spdk_vhost_scsi_dev, vdev);
210 
211 	/* all sessions have already detached the device */
212 	if (svdev->scsi_dev_state[scsi_tgt_num].status != VHOST_SCSI_DEV_REMOVING) {
213 		/* device was already removed in the meantime */
214 		return;
215 	}
216 
217 	remove_scsi_tgt(svdev, scsi_tgt_num);
218 }
219 
220 static int
221 vhost_scsi_session_process_removed(struct spdk_vhost_dev *vdev,
222 				   struct spdk_vhost_session *vsession, void *ctx)
223 {
224 	unsigned scsi_tgt_num = (unsigned)(uintptr_t)ctx;
225 	struct spdk_vhost_scsi_session *svsession = (struct spdk_vhost_scsi_session *)vsession;
226 	struct spdk_scsi_dev_session_state *state = &svsession->scsi_dev_state[scsi_tgt_num];
227 
228 	if (state->dev != NULL) {
229 		/* there's still a session that references this device,
230 		 * so abort our foreach chain here. We'll be called
231 		 * again from this session's management poller after it
232 		 * is removed in there
233 		 */
234 		return -1;
235 	}
236 
237 	return 0;
238 }
239 
240 static void
241 process_removed_devs(struct spdk_vhost_scsi_session *svsession)
242 {
243 	struct spdk_scsi_dev *dev;
244 	struct spdk_scsi_dev_session_state *state;
245 	int i;
246 
247 	for (i = 0; i < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS; ++i) {
248 		state = &svsession->scsi_dev_state[i];
249 		dev = state->dev;
250 
251 		if (dev && state->status == VHOST_SCSI_DEV_REMOVING &&
252 		    !spdk_scsi_dev_has_pending_tasks(dev, NULL)) {
253 			/* detach the device from this session */
254 			spdk_scsi_dev_free_io_channels(dev);
255 			state->dev = NULL;
256 			state->status = VHOST_SCSI_DEV_REMOVED;
257 			/* try to detach it globally */
258 			spdk_vhost_lock();
259 			vhost_dev_foreach_session(&svsession->svdev->vdev,
260 						  vhost_scsi_session_process_removed,
261 						  vhost_scsi_dev_process_removed_cpl_cb,
262 						  (void *)(uintptr_t)i);
263 			spdk_vhost_unlock();
264 		}
265 	}
266 }
267 
268 static void
269 eventq_enqueue(struct spdk_vhost_scsi_session *svsession, unsigned scsi_dev_num,
270 	       uint32_t event, uint32_t reason)
271 {
272 	struct spdk_vhost_session *vsession = &svsession->vsession;
273 	struct spdk_vhost_virtqueue *vq;
274 	struct vring_desc *desc, *desc_table;
275 	struct virtio_scsi_event *desc_ev;
276 	uint32_t desc_table_size, req_size = 0;
277 	uint16_t req;
278 	int rc;
279 
280 	assert(scsi_dev_num < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS);
281 	vq = &vsession->virtqueue[VIRTIO_SCSI_EVENTQ];
282 
283 	if (vq->vring.desc == NULL || vhost_vq_avail_ring_get(vq, &req, 1) != 1) {
284 		SPDK_ERRLOG("%s: failed to send virtio event (no avail ring entries?).\n",
285 			    vsession->name);
286 		return;
287 	}
288 
289 	rc = vhost_vq_get_desc(vsession, vq, req, &desc, &desc_table, &desc_table_size);
290 	if (rc != 0 || desc->len < sizeof(*desc_ev)) {
291 		SPDK_ERRLOG("%s: invalid eventq descriptor at index %"PRIu16".\n",
292 			    vsession->name, req);
293 		goto out;
294 	}
295 
296 	desc_ev = vhost_gpa_to_vva(vsession, desc->addr, sizeof(*desc_ev));
297 	if (desc_ev == NULL) {
298 		SPDK_ERRLOG("%s: eventq descriptor at index %"PRIu16" points "
299 			    "to unmapped guest memory address %p.\n",
300 			    vsession->name, req, (void *)(uintptr_t)desc->addr);
301 		goto out;
302 	}
303 
304 	desc_ev->event = event;
305 	desc_ev->lun[0] = 1;
306 	desc_ev->lun[1] = scsi_dev_num;
307 	/* virtio LUN id 0 can refer either to the entire device
308 	 * or actual LUN 0 (the only supported by vhost for now)
309 	 */
310 	desc_ev->lun[2] = 0 >> 8;
311 	desc_ev->lun[3] = 0 & 0xFF;
312 	/* virtio doesn't specify any strict format for LUN id (bytes 2 and 3)
313 	 * current implementation relies on linux kernel sources
314 	 */
315 	memset(&desc_ev->lun[4], 0, 4);
316 	desc_ev->reason = reason;
317 	req_size = sizeof(*desc_ev);
318 
319 out:
320 	vhost_vq_used_ring_enqueue(vsession, vq, req, req_size);
321 }
322 
323 static void
324 submit_completion(struct spdk_vhost_scsi_task *task)
325 {
326 	struct spdk_vhost_session *vsession = &task->svsession->vsession;
327 
328 	vhost_vq_used_ring_enqueue(vsession, task->vq, task->req_idx,
329 				   task->used_len);
330 	SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI, "Finished task (%p) req_idx=%d\n", task, task->req_idx);
331 
332 	vhost_scsi_task_put(task);
333 }
334 
335 static void
336 vhost_scsi_task_mgmt_cpl(struct spdk_scsi_task *scsi_task)
337 {
338 	struct spdk_vhost_scsi_task *task = SPDK_CONTAINEROF(scsi_task, struct spdk_vhost_scsi_task, scsi);
339 
340 	submit_completion(task);
341 }
342 
343 static void
344 vhost_scsi_task_cpl(struct spdk_scsi_task *scsi_task)
345 {
346 	struct spdk_vhost_scsi_task *task = SPDK_CONTAINEROF(scsi_task, struct spdk_vhost_scsi_task, scsi);
347 
348 	/* The SCSI task has completed.  Do final processing and then post
349 	   notification to the virtqueue's "used" ring.
350 	 */
351 	task->resp->status = task->scsi.status;
352 
353 	if (task->scsi.status != SPDK_SCSI_STATUS_GOOD) {
354 		memcpy(task->resp->sense, task->scsi.sense_data, task->scsi.sense_data_len);
355 		task->resp->sense_len = task->scsi.sense_data_len;
356 		SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI, "Task (%p) req_idx=%d failed - status=%u\n", task, task->req_idx,
357 			      task->scsi.status);
358 	}
359 	assert(task->scsi.transfer_len == task->scsi.length);
360 	task->resp->resid = task->scsi.length - task->scsi.data_transferred;
361 
362 	submit_completion(task);
363 }
364 
365 static void
366 task_submit(struct spdk_vhost_scsi_task *task)
367 {
368 	task->resp->response = VIRTIO_SCSI_S_OK;
369 	spdk_scsi_dev_queue_task(task->scsi_dev, &task->scsi);
370 }
371 
372 static void
373 mgmt_task_submit(struct spdk_vhost_scsi_task *task, enum spdk_scsi_task_func func)
374 {
375 	task->tmf_resp->response = VIRTIO_SCSI_S_OK;
376 	task->scsi.function = func;
377 	spdk_scsi_dev_queue_mgmt_task(task->scsi_dev, &task->scsi);
378 }
379 
380 static void
381 invalid_request(struct spdk_vhost_scsi_task *task)
382 {
383 	struct spdk_vhost_session *vsession = &task->svsession->vsession;
384 
385 	vhost_vq_used_ring_enqueue(vsession, task->vq, task->req_idx,
386 				   task->used_len);
387 	vhost_scsi_task_put(task);
388 
389 	SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI, "Invalid request (status=%" PRIu8")\n",
390 		      task->resp ? task->resp->response : -1);
391 }
392 
393 static int
394 vhost_scsi_task_init_target(struct spdk_vhost_scsi_task *task, const __u8 *lun)
395 {
396 	struct spdk_vhost_scsi_session *svsession = task->svsession;
397 	struct spdk_scsi_dev_session_state *state;
398 	uint16_t lun_id = (((uint16_t)lun[2] << 8) | lun[3]) & 0x3FFF;
399 
400 	SPDK_LOGDUMP(SPDK_LOG_VHOST_SCSI_QUEUE, "LUN", lun, 8);
401 
402 	/* First byte must be 1 and second is target */
403 	if (lun[0] != 1 || lun[1] >= SPDK_VHOST_SCSI_CTRLR_MAX_DEVS) {
404 		return -1;
405 	}
406 
407 	state = &svsession->scsi_dev_state[lun[1]];
408 	task->scsi_dev = state->dev;
409 	if (state->dev == NULL || state->status != VHOST_SCSI_DEV_PRESENT) {
410 		/* If dev has been hotdetached, return 0 to allow sending
411 		 * additional hotremove event via sense codes.
412 		 */
413 		return state->status != VHOST_SCSI_DEV_EMPTY ? 0 : -1;
414 	}
415 
416 	task->scsi.target_port = spdk_scsi_dev_find_port_by_id(task->scsi_dev, 0);
417 	task->scsi.lun = spdk_scsi_dev_get_lun(state->dev, lun_id);
418 	return 0;
419 }
420 
421 static void
422 process_ctrl_request(struct spdk_vhost_scsi_task *task)
423 {
424 	struct spdk_vhost_session *vsession = &task->svsession->vsession;
425 	struct vring_desc *desc, *desc_table;
426 	struct virtio_scsi_ctrl_tmf_req *ctrl_req;
427 	struct virtio_scsi_ctrl_an_resp *an_resp;
428 	uint32_t desc_table_size, used_len = 0;
429 	int rc;
430 
431 	spdk_scsi_task_construct(&task->scsi, vhost_scsi_task_mgmt_cpl, vhost_scsi_task_free_cb);
432 	rc = vhost_vq_get_desc(vsession, task->vq, task->req_idx, &desc, &desc_table,
433 			       &desc_table_size);
434 	if (spdk_unlikely(rc != 0)) {
435 		SPDK_ERRLOG("%s: invalid controlq descriptor at index %d.\n",
436 			    vsession->name, task->req_idx);
437 		goto out;
438 	}
439 
440 	ctrl_req = vhost_gpa_to_vva(vsession, desc->addr, sizeof(*ctrl_req));
441 	if (ctrl_req == NULL) {
442 		SPDK_ERRLOG("%s: invalid task management request at index %d.\n",
443 			    vsession->name, task->req_idx);
444 		goto out;
445 	}
446 
447 	SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI_QUEUE,
448 		      "Processing controlq descriptor: desc %d/%p, desc_addr %p, len %d, flags %d, last_used_idx %d; kickfd %d; size %d\n",
449 		      task->req_idx, desc, (void *)desc->addr, desc->len, desc->flags, task->vq->last_used_idx,
450 		      task->vq->vring.kickfd, task->vq->vring.size);
451 	SPDK_LOGDUMP(SPDK_LOG_VHOST_SCSI_QUEUE, "Request descriptor", (uint8_t *)ctrl_req, desc->len);
452 
453 	vhost_scsi_task_init_target(task, ctrl_req->lun);
454 
455 	vhost_vring_desc_get_next(&desc, desc_table, desc_table_size);
456 	if (spdk_unlikely(desc == NULL)) {
457 		SPDK_ERRLOG("%s: no response descriptor for controlq request %d.\n",
458 			    vsession->name, task->req_idx);
459 		goto out;
460 	}
461 
462 	/* Process the TMF request */
463 	switch (ctrl_req->type) {
464 	case VIRTIO_SCSI_T_TMF:
465 		task->tmf_resp = vhost_gpa_to_vva(vsession, desc->addr, sizeof(*task->tmf_resp));
466 		if (spdk_unlikely(desc->len < sizeof(struct virtio_scsi_ctrl_tmf_resp) || task->tmf_resp == NULL)) {
467 			SPDK_ERRLOG("%s: TMF response descriptor at index %d points to invalid guest memory region\n",
468 				    vsession->name, task->req_idx);
469 			goto out;
470 		}
471 
472 		/* Check if we are processing a valid request */
473 		if (task->scsi_dev == NULL) {
474 			task->tmf_resp->response = VIRTIO_SCSI_S_BAD_TARGET;
475 			break;
476 		}
477 
478 		switch (ctrl_req->subtype) {
479 		case VIRTIO_SCSI_T_TMF_LOGICAL_UNIT_RESET:
480 			/* Handle LUN reset */
481 			SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI_QUEUE, "%s: LUN reset\n", vsession->name);
482 
483 			mgmt_task_submit(task, SPDK_SCSI_TASK_FUNC_LUN_RESET);
484 			return;
485 		default:
486 			task->tmf_resp->response = VIRTIO_SCSI_S_ABORTED;
487 			/* Unsupported command */
488 			SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI_QUEUE, "%s: unsupported TMF command %x\n",
489 				      vsession->name, ctrl_req->subtype);
490 			break;
491 		}
492 		break;
493 	case VIRTIO_SCSI_T_AN_QUERY:
494 	case VIRTIO_SCSI_T_AN_SUBSCRIBE: {
495 		an_resp = vhost_gpa_to_vva(vsession, desc->addr, sizeof(*an_resp));
496 		if (spdk_unlikely(desc->len < sizeof(struct virtio_scsi_ctrl_an_resp) || an_resp == NULL)) {
497 			SPDK_WARNLOG("%s: asynchronous response descriptor points to invalid guest memory region\n",
498 				     vsession->name);
499 			goto out;
500 		}
501 
502 		an_resp->response = VIRTIO_SCSI_S_ABORTED;
503 		break;
504 	}
505 	default:
506 		SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI_QUEUE, "%s: Unsupported control command %x\n",
507 			      vsession->name, ctrl_req->type);
508 		break;
509 	}
510 
511 	used_len = sizeof(struct virtio_scsi_ctrl_tmf_resp);
512 out:
513 	vhost_vq_used_ring_enqueue(vsession, task->vq, task->req_idx, used_len);
514 	vhost_scsi_task_put(task);
515 }
516 
517 /*
518  * Process task's descriptor chain and setup data related fields.
519  * Return
520  *   -1 if request is invalid and must be aborted,
521  *    0 if all data are set.
522  */
523 static int
524 task_data_setup(struct spdk_vhost_scsi_task *task,
525 		struct virtio_scsi_cmd_req **req)
526 {
527 	struct spdk_vhost_session *vsession = &task->svsession->vsession;
528 	struct vring_desc *desc, *desc_table;
529 	struct iovec *iovs = task->iovs;
530 	uint16_t iovcnt = 0;
531 	uint32_t desc_table_len, len = 0;
532 	int rc;
533 
534 	spdk_scsi_task_construct(&task->scsi, vhost_scsi_task_cpl, vhost_scsi_task_free_cb);
535 
536 	rc = vhost_vq_get_desc(vsession, task->vq, task->req_idx, &desc, &desc_table, &desc_table_len);
537 	/* First descriptor must be readable */
538 	if (spdk_unlikely(rc != 0  || vhost_vring_desc_is_wr(desc) ||
539 			  desc->len < sizeof(struct virtio_scsi_cmd_req))) {
540 		SPDK_WARNLOG("%s: invalid first request descriptor at index %"PRIu16".\n",
541 			     vsession->name, task->req_idx);
542 		goto invalid_task;
543 	}
544 
545 	*req = vhost_gpa_to_vva(vsession, desc->addr, sizeof(**req));
546 	if (spdk_unlikely(*req == NULL)) {
547 		SPDK_WARNLOG("%s: request descriptor at index %d points to invalid guest memory region\n",
548 			     vsession->name, task->req_idx);
549 		goto invalid_task;
550 	}
551 
552 	/* Each request must have at least 2 descriptors (e.g. request and response) */
553 	vhost_vring_desc_get_next(&desc, desc_table, desc_table_len);
554 	if (desc == NULL) {
555 		SPDK_WARNLOG("%s: descriptor chain at index %d contains neither payload nor response buffer.\n",
556 			     vsession->name, task->req_idx);
557 		goto invalid_task;
558 	}
559 	task->scsi.dxfer_dir = vhost_vring_desc_is_wr(desc) ? SPDK_SCSI_DIR_FROM_DEV :
560 			       SPDK_SCSI_DIR_TO_DEV;
561 	task->scsi.iovs = iovs;
562 
563 	if (task->scsi.dxfer_dir == SPDK_SCSI_DIR_FROM_DEV) {
564 		/*
565 		 * FROM_DEV (READ): [RD_req][WR_resp][WR_buf0]...[WR_bufN]
566 		 */
567 		task->resp = vhost_gpa_to_vva(vsession, desc->addr, sizeof(*task->resp));
568 		if (spdk_unlikely(desc->len < sizeof(struct virtio_scsi_cmd_resp) || task->resp == NULL)) {
569 			SPDK_WARNLOG("%s: response descriptor at index %d points to invalid guest memory region\n",
570 				     vsession->name, task->req_idx);
571 			goto invalid_task;
572 		}
573 		rc = vhost_vring_desc_get_next(&desc, desc_table, desc_table_len);
574 		if (spdk_unlikely(rc != 0)) {
575 			SPDK_WARNLOG("%s: invalid descriptor chain at request index %d (descriptor id overflow?).\n",
576 				     vsession->name, task->req_idx);
577 			goto invalid_task;
578 		}
579 
580 		if (desc == NULL) {
581 			/*
582 			 * TEST UNIT READY command and some others might not contain any payload and this is not an error.
583 			 */
584 			SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI_DATA,
585 				      "No payload descriptors for FROM DEV command req_idx=%"PRIu16".\n", task->req_idx);
586 			SPDK_LOGDUMP(SPDK_LOG_VHOST_SCSI_DATA, "CDB=", (*req)->cdb, VIRTIO_SCSI_CDB_SIZE);
587 			task->used_len = sizeof(struct virtio_scsi_cmd_resp);
588 			task->scsi.iovcnt = 1;
589 			task->scsi.iovs[0].iov_len = 0;
590 			task->scsi.length = 0;
591 			task->scsi.transfer_len = 0;
592 			return 0;
593 		}
594 
595 		/* All remaining descriptors are data. */
596 		while (desc) {
597 			if (spdk_unlikely(!vhost_vring_desc_is_wr(desc))) {
598 				SPDK_WARNLOG("%s: FROM DEV cmd: descriptor nr %" PRIu16" in payload chain is read only.\n",
599 					     vsession->name, iovcnt);
600 				goto invalid_task;
601 			}
602 
603 			if (spdk_unlikely(vhost_vring_desc_to_iov(vsession, iovs, &iovcnt, desc))) {
604 				goto invalid_task;
605 			}
606 			len += desc->len;
607 
608 			rc = vhost_vring_desc_get_next(&desc, desc_table, desc_table_len);
609 			if (spdk_unlikely(rc != 0)) {
610 				SPDK_WARNLOG("%s: invalid payload in descriptor chain starting at index %d.\n",
611 					     vsession->name, task->req_idx);
612 				goto invalid_task;
613 			}
614 		}
615 
616 		task->used_len = sizeof(struct virtio_scsi_cmd_resp) + len;
617 	} else {
618 		SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI_DATA, "TO DEV");
619 		/*
620 		 * TO_DEV (WRITE):[RD_req][RD_buf0]...[RD_bufN][WR_resp]
621 		 * No need to check descriptor WR flag as this is done while setting scsi.dxfer_dir.
622 		 */
623 
624 		/* Process descriptors up to response. */
625 		while (!vhost_vring_desc_is_wr(desc)) {
626 			if (spdk_unlikely(vhost_vring_desc_to_iov(vsession, iovs, &iovcnt, desc))) {
627 				goto invalid_task;
628 			}
629 			len += desc->len;
630 
631 			vhost_vring_desc_get_next(&desc, desc_table, desc_table_len);
632 			if (spdk_unlikely(desc == NULL)) {
633 				SPDK_WARNLOG("%s: TO_DEV cmd: no response descriptor.\n", vsession->name);
634 				goto invalid_task;
635 			}
636 		}
637 
638 		task->resp = vhost_gpa_to_vva(vsession, desc->addr, sizeof(*task->resp));
639 		if (spdk_unlikely(desc->len < sizeof(struct virtio_scsi_cmd_resp) || task->resp == NULL)) {
640 			SPDK_WARNLOG("%s: response descriptor at index %d points to invalid guest memory region\n",
641 				     vsession->name, task->req_idx);
642 			goto invalid_task;
643 		}
644 
645 		task->used_len = sizeof(struct virtio_scsi_cmd_resp);
646 	}
647 
648 	task->scsi.iovcnt = iovcnt;
649 	task->scsi.length = len;
650 	task->scsi.transfer_len = len;
651 	return 0;
652 
653 invalid_task:
654 	SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI_DATA, "%s: Invalid task at index %"PRIu16".\n",
655 		      vsession->name, task->req_idx);
656 	return -1;
657 }
658 
659 static int
660 process_request(struct spdk_vhost_scsi_task *task)
661 {
662 	struct virtio_scsi_cmd_req *req;
663 	int result;
664 
665 	result = task_data_setup(task, &req);
666 	if (result) {
667 		return result;
668 	}
669 
670 	result = vhost_scsi_task_init_target(task, req->lun);
671 	if (spdk_unlikely(result != 0)) {
672 		task->resp->response = VIRTIO_SCSI_S_BAD_TARGET;
673 		return -1;
674 	}
675 
676 	task->scsi.cdb = req->cdb;
677 	SPDK_LOGDUMP(SPDK_LOG_VHOST_SCSI_DATA, "request CDB", req->cdb, VIRTIO_SCSI_CDB_SIZE);
678 
679 	if (spdk_unlikely(task->scsi.lun == NULL)) {
680 		spdk_scsi_task_process_null_lun(&task->scsi);
681 		task->resp->response = VIRTIO_SCSI_S_OK;
682 		return 1;
683 	}
684 
685 	return 0;
686 }
687 
688 static void
689 process_controlq(struct spdk_vhost_scsi_session *svsession, struct spdk_vhost_virtqueue *vq)
690 {
691 	struct spdk_vhost_session *vsession = &svsession->vsession;
692 	struct spdk_vhost_scsi_task *task;
693 	uint16_t reqs[32];
694 	uint16_t reqs_cnt, i;
695 
696 	reqs_cnt = vhost_vq_avail_ring_get(vq, reqs, SPDK_COUNTOF(reqs));
697 	for (i = 0; i < reqs_cnt; i++) {
698 		if (spdk_unlikely(reqs[i] >= vq->vring.size)) {
699 			SPDK_ERRLOG("%s: invalid entry in avail ring. Buffer '%"PRIu16"' exceeds virtqueue size (%"PRIu16")\n",
700 				    vsession->name, reqs[i], vq->vring.size);
701 			vhost_vq_used_ring_enqueue(vsession, vq, reqs[i], 0);
702 			continue;
703 		}
704 
705 		task = &((struct spdk_vhost_scsi_task *)vq->tasks)[reqs[i]];
706 		if (spdk_unlikely(task->used)) {
707 			SPDK_ERRLOG("%s: invalid entry in avail ring. Buffer '%"PRIu16"' is still in use!\n",
708 				    vsession->name, reqs[i]);
709 			vhost_vq_used_ring_enqueue(vsession, vq, reqs[i], 0);
710 			continue;
711 		}
712 
713 		vsession->task_cnt++;
714 		memset(&task->scsi, 0, sizeof(task->scsi));
715 		task->tmf_resp = NULL;
716 		task->used = true;
717 		process_ctrl_request(task);
718 	}
719 }
720 
721 static void
722 process_requestq(struct spdk_vhost_scsi_session *svsession, struct spdk_vhost_virtqueue *vq)
723 {
724 	struct spdk_vhost_session *vsession = &svsession->vsession;
725 	struct spdk_vhost_scsi_task *task;
726 	uint16_t reqs[32];
727 	uint16_t reqs_cnt, i;
728 	int result;
729 
730 	reqs_cnt = vhost_vq_avail_ring_get(vq, reqs, SPDK_COUNTOF(reqs));
731 	assert(reqs_cnt <= 32);
732 
733 	for (i = 0; i < reqs_cnt; i++) {
734 		SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI, "====== Starting processing request idx %"PRIu16"======\n",
735 			      reqs[i]);
736 
737 		if (spdk_unlikely(reqs[i] >= vq->vring.size)) {
738 			SPDK_ERRLOG("%s: request idx '%"PRIu16"' exceeds virtqueue size (%"PRIu16").\n",
739 				    vsession->name, reqs[i], vq->vring.size);
740 			vhost_vq_used_ring_enqueue(vsession, vq, reqs[i], 0);
741 			continue;
742 		}
743 
744 		task = &((struct spdk_vhost_scsi_task *)vq->tasks)[reqs[i]];
745 		if (spdk_unlikely(task->used)) {
746 			SPDK_ERRLOG("%s: request with idx '%"PRIu16"' is already pending.\n",
747 				    vsession->name, reqs[i]);
748 			vhost_vq_used_ring_enqueue(vsession, vq, reqs[i], 0);
749 			continue;
750 		}
751 
752 		vsession->task_cnt++;
753 		memset(&task->scsi, 0, sizeof(task->scsi));
754 		task->resp = NULL;
755 		task->used = true;
756 		task->used_len = 0;
757 		result = process_request(task);
758 		if (likely(result == 0)) {
759 			task_submit(task);
760 			SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI, "====== Task %p req_idx %d submitted ======\n", task,
761 				      task->req_idx);
762 		} else if (result > 0) {
763 			vhost_scsi_task_cpl(&task->scsi);
764 			SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI, "====== Task %p req_idx %d finished early ======\n", task,
765 				      task->req_idx);
766 		} else {
767 			invalid_request(task);
768 			SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI, "====== Task %p req_idx %d failed ======\n", task,
769 				      task->req_idx);
770 		}
771 	}
772 }
773 
774 static int
775 vdev_mgmt_worker(void *arg)
776 {
777 	struct spdk_vhost_scsi_session *svsession = arg;
778 	struct spdk_vhost_session *vsession = &svsession->vsession;
779 
780 	process_removed_devs(svsession);
781 	vhost_vq_used_signal(vsession, &vsession->virtqueue[VIRTIO_SCSI_EVENTQ]);
782 
783 	process_controlq(svsession, &vsession->virtqueue[VIRTIO_SCSI_CONTROLQ]);
784 	vhost_vq_used_signal(vsession, &vsession->virtqueue[VIRTIO_SCSI_CONTROLQ]);
785 
786 	return -1;
787 }
788 
789 static int
790 vdev_worker(void *arg)
791 {
792 	struct spdk_vhost_scsi_session *svsession = arg;
793 	struct spdk_vhost_session *vsession = &svsession->vsession;
794 	uint32_t q_idx;
795 
796 	for (q_idx = VIRTIO_SCSI_REQUESTQ; q_idx < vsession->max_queues; q_idx++) {
797 		process_requestq(svsession, &vsession->virtqueue[q_idx]);
798 	}
799 
800 	vhost_session_used_signal(vsession);
801 
802 	return -1;
803 }
804 
805 static struct spdk_vhost_scsi_dev *
806 to_scsi_dev(struct spdk_vhost_dev *ctrlr)
807 {
808 	if (ctrlr == NULL) {
809 		return NULL;
810 	}
811 
812 	if (ctrlr->backend != &spdk_vhost_scsi_device_backend) {
813 		SPDK_ERRLOG("%s: not a vhost-scsi device.\n", ctrlr->name);
814 		return NULL;
815 	}
816 
817 	return SPDK_CONTAINEROF(ctrlr, struct spdk_vhost_scsi_dev, vdev);
818 }
819 
820 static struct spdk_vhost_scsi_session *
821 to_scsi_session(struct spdk_vhost_session *vsession)
822 {
823 	assert(vsession->vdev->backend == &spdk_vhost_scsi_device_backend);
824 	return (struct spdk_vhost_scsi_session *)vsession;
825 }
826 
827 int
828 spdk_vhost_scsi_dev_construct(const char *name, const char *cpumask)
829 {
830 	struct spdk_vhost_scsi_dev *svdev = calloc(1, sizeof(*svdev));
831 	int rc;
832 
833 	if (svdev == NULL) {
834 		return -ENOMEM;
835 	}
836 
837 	svdev->vdev.virtio_features = SPDK_VHOST_SCSI_FEATURES;
838 	svdev->vdev.disabled_features = SPDK_VHOST_SCSI_DISABLED_FEATURES;
839 
840 	spdk_vhost_lock();
841 	rc = vhost_dev_register(&svdev->vdev, name, cpumask,
842 				&spdk_vhost_scsi_device_backend);
843 
844 	if (rc) {
845 		free(svdev);
846 		spdk_vhost_unlock();
847 		return rc;
848 	}
849 
850 	svdev->registered = true;
851 
852 	spdk_vhost_unlock();
853 	return rc;
854 }
855 
856 static int
857 vhost_scsi_dev_remove(struct spdk_vhost_dev *vdev)
858 {
859 	struct spdk_vhost_scsi_dev *svdev = to_scsi_dev(vdev);
860 	int rc, i;
861 
862 	assert(svdev != NULL);
863 	for (i = 0; i < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS; ++i) {
864 		if (svdev->scsi_dev_state[i].dev) {
865 			if (vdev->registered) {
866 				SPDK_ERRLOG("%s: SCSI target %d is still present.\n", vdev->name, i);
867 				return -EBUSY;
868 			}
869 
870 			rc = spdk_vhost_scsi_dev_remove_tgt(vdev, i, NULL, NULL);
871 			if (rc != 0) {
872 				SPDK_ERRLOG("%s: failed to force-remove target %d\n", vdev->name, i);
873 				return rc;
874 			}
875 		}
876 	}
877 
878 	rc = vhost_dev_unregister(vdev);
879 	if (rc != 0) {
880 		return rc;
881 	}
882 	svdev->registered = false;
883 
884 	if (svdev->ref == 0) {
885 		free(svdev);
886 	}
887 
888 	return 0;
889 }
890 
891 struct spdk_scsi_dev *
892 spdk_vhost_scsi_dev_get_tgt(struct spdk_vhost_dev *vdev, uint8_t num)
893 {
894 	struct spdk_vhost_scsi_dev *svdev;
895 
896 	assert(num < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS);
897 	svdev = to_scsi_dev(vdev);
898 	assert(svdev != NULL);
899 	if (svdev->scsi_dev_state[num].status != VHOST_SCSI_DEV_PRESENT) {
900 		return NULL;
901 	}
902 
903 	assert(svdev->scsi_dev_state[num].dev != NULL);
904 	return svdev->scsi_dev_state[num].dev;
905 }
906 
907 static void
908 vhost_scsi_lun_hotremove(const struct spdk_scsi_lun *lun, void *arg)
909 {
910 	struct spdk_vhost_scsi_dev *svdev = arg;
911 	const struct spdk_scsi_dev *scsi_dev;
912 	unsigned scsi_dev_num;
913 
914 	assert(lun != NULL);
915 	assert(svdev != NULL);
916 	scsi_dev = spdk_scsi_lun_get_dev(lun);
917 	for (scsi_dev_num = 0; scsi_dev_num < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS; scsi_dev_num++) {
918 		if (svdev->scsi_dev_state[scsi_dev_num].dev == scsi_dev) {
919 			break;
920 		}
921 	}
922 
923 	if (scsi_dev_num == SPDK_VHOST_SCSI_CTRLR_MAX_DEVS) {
924 		/* The entire device has been already removed. */
925 		return;
926 	}
927 
928 	/* remove entire device */
929 	spdk_vhost_scsi_dev_remove_tgt(&svdev->vdev, scsi_dev_num, NULL, NULL);
930 }
931 
932 static void
933 vhost_scsi_dev_add_tgt_cpl_cb(struct spdk_vhost_dev *vdev, void *ctx)
934 {
935 	unsigned scsi_tgt_num = (unsigned)(uintptr_t)ctx;
936 	struct spdk_vhost_scsi_dev *svdev = SPDK_CONTAINEROF(vdev,
937 					    struct spdk_vhost_scsi_dev, vdev);
938 	struct spdk_scsi_dev_vhost_state *vhost_sdev;
939 
940 	vhost_sdev = &svdev->scsi_dev_state[scsi_tgt_num];
941 
942 	/* All sessions have added the target */
943 	assert(vhost_sdev->status == VHOST_SCSI_DEV_ADDING);
944 	vhost_sdev->status = VHOST_SCSI_DEV_PRESENT;
945 	svdev->ref++;
946 }
947 
948 static int
949 vhost_scsi_session_add_tgt(struct spdk_vhost_dev *vdev,
950 			   struct spdk_vhost_session *vsession, void *ctx)
951 {
952 	unsigned scsi_tgt_num = (unsigned)(uintptr_t)ctx;
953 	struct spdk_vhost_scsi_session *svsession = (struct spdk_vhost_scsi_session *)vsession;
954 	struct spdk_scsi_dev_session_state *session_sdev = &svsession->scsi_dev_state[scsi_tgt_num];
955 	struct spdk_scsi_dev_vhost_state *vhost_sdev;
956 	int rc;
957 
958 	if (!vsession->started || session_sdev->dev != NULL) {
959 		/* Nothing to do. */
960 		return 0;
961 	}
962 
963 	vhost_sdev = &svsession->svdev->scsi_dev_state[scsi_tgt_num];
964 	session_sdev->dev = vhost_sdev->dev;
965 	session_sdev->status = VHOST_SCSI_DEV_PRESENT;
966 
967 	rc = spdk_scsi_dev_allocate_io_channels(svsession->scsi_dev_state[scsi_tgt_num].dev);
968 	if (rc != 0) {
969 		SPDK_ERRLOG("%s: Couldn't allocate io channnel for SCSI target %u.\n",
970 			    vsession->name, scsi_tgt_num);
971 
972 		/* unset the SCSI target so that all I/O to it will be rejected */
973 		session_sdev->dev = NULL;
974 		/* Set status to EMPTY so that we won't reply with SCSI hotremove
975 		 * sense codes - the device hasn't ever been added.
976 		 */
977 		session_sdev->status = VHOST_SCSI_DEV_EMPTY;
978 
979 		/* Return with no error. We'll continue allocating io_channels for
980 		 * other sessions on this device in hopes they succeed. The sessions
981 		 * that failed to allocate io_channels simply won't be able to
982 		 * detect the SCSI target, nor do any I/O to it.
983 		 */
984 		return 0;
985 	}
986 
987 	if (vhost_dev_has_feature(vsession, VIRTIO_SCSI_F_HOTPLUG)) {
988 		eventq_enqueue(svsession, scsi_tgt_num,
989 			       VIRTIO_SCSI_T_TRANSPORT_RESET, VIRTIO_SCSI_EVT_RESET_RESCAN);
990 	} else {
991 		SPDK_NOTICELOG("%s: driver does not support hotplug. "
992 			       "Please restart it or perform a rescan.\n",
993 			       vsession->name);
994 	}
995 
996 	return 0;
997 }
998 
999 int
1000 spdk_vhost_scsi_dev_add_tgt(struct spdk_vhost_dev *vdev, int scsi_tgt_num,
1001 			    const char *bdev_name)
1002 {
1003 	struct spdk_vhost_scsi_dev *svdev;
1004 	struct spdk_scsi_dev_vhost_state *state;
1005 	char target_name[SPDK_SCSI_DEV_MAX_NAME];
1006 	int lun_id_list[1];
1007 	const char *bdev_names_list[1];
1008 
1009 	svdev = to_scsi_dev(vdev);
1010 	assert(svdev != NULL);
1011 	if (scsi_tgt_num < 0) {
1012 		for (scsi_tgt_num = 0; scsi_tgt_num < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS; scsi_tgt_num++) {
1013 			if (svdev->scsi_dev_state[scsi_tgt_num].dev == NULL) {
1014 				break;
1015 			}
1016 		}
1017 
1018 		if (scsi_tgt_num == SPDK_VHOST_SCSI_CTRLR_MAX_DEVS) {
1019 			SPDK_ERRLOG("%s: all SCSI target slots are already in use.\n", vdev->name);
1020 			return -ENOSPC;
1021 		}
1022 	} else {
1023 		if (scsi_tgt_num >= SPDK_VHOST_SCSI_CTRLR_MAX_DEVS) {
1024 			SPDK_ERRLOG("%s: SCSI target number is too big (got %d, max %d)\n",
1025 				    vdev->name, scsi_tgt_num, SPDK_VHOST_SCSI_CTRLR_MAX_DEVS);
1026 			return -EINVAL;
1027 		}
1028 	}
1029 
1030 	if (bdev_name == NULL) {
1031 		SPDK_ERRLOG("No lun name specified\n");
1032 		return -EINVAL;
1033 	}
1034 
1035 	state = &svdev->scsi_dev_state[scsi_tgt_num];
1036 	if (state->dev != NULL) {
1037 		SPDK_ERRLOG("%s: SCSI target %u already occupied\n", vdev->name, scsi_tgt_num);
1038 		return -EEXIST;
1039 	}
1040 
1041 	/*
1042 	 * At this stage only one LUN per target
1043 	 */
1044 	snprintf(target_name, sizeof(target_name), "Target %u", scsi_tgt_num);
1045 	lun_id_list[0] = 0;
1046 	bdev_names_list[0] = (char *)bdev_name;
1047 
1048 	state->status = VHOST_SCSI_DEV_ADDING;
1049 	state->dev = spdk_scsi_dev_construct(target_name, bdev_names_list, lun_id_list, 1,
1050 					     SPDK_SPC_PROTOCOL_IDENTIFIER_SAS,
1051 					     vhost_scsi_lun_hotremove, svdev);
1052 
1053 	if (state->dev == NULL) {
1054 		state->status = VHOST_SCSI_DEV_EMPTY;
1055 		SPDK_ERRLOG("%s: couldn't create SCSI target %u using bdev '%s'\n",
1056 			    vdev->name, scsi_tgt_num, bdev_name);
1057 		return -EINVAL;
1058 	}
1059 	spdk_scsi_dev_add_port(state->dev, 0, "vhost");
1060 
1061 	SPDK_INFOLOG(SPDK_LOG_VHOST, "%s: added SCSI target %u using bdev '%s'\n",
1062 		     vdev->name, scsi_tgt_num, bdev_name);
1063 
1064 	vhost_dev_foreach_session(vdev, vhost_scsi_session_add_tgt,
1065 				  vhost_scsi_dev_add_tgt_cpl_cb,
1066 				  (void *)(uintptr_t)scsi_tgt_num);
1067 	return scsi_tgt_num;
1068 }
1069 
1070 struct scsi_tgt_hotplug_ctx {
1071 	unsigned scsi_tgt_num;
1072 	bool async_fini;
1073 };
1074 
1075 static void
1076 vhost_scsi_dev_remove_tgt_cpl_cb(struct spdk_vhost_dev *vdev, void *_ctx)
1077 {
1078 	struct scsi_tgt_hotplug_ctx *ctx = _ctx;
1079 	struct spdk_vhost_scsi_dev *svdev = SPDK_CONTAINEROF(vdev,
1080 					    struct spdk_vhost_scsi_dev, vdev);
1081 
1082 	if (!ctx->async_fini) {
1083 		/* there aren't any active sessions, so remove the dev and exit */
1084 		remove_scsi_tgt(svdev, ctx->scsi_tgt_num);
1085 	}
1086 
1087 	free(ctx);
1088 }
1089 
1090 static int
1091 vhost_scsi_session_remove_tgt(struct spdk_vhost_dev *vdev,
1092 			      struct spdk_vhost_session *vsession, void *_ctx)
1093 {
1094 	struct scsi_tgt_hotplug_ctx *ctx = _ctx;
1095 	unsigned scsi_tgt_num = ctx->scsi_tgt_num;
1096 	struct spdk_vhost_scsi_session *svsession = (struct spdk_vhost_scsi_session *)vsession;
1097 	struct spdk_scsi_dev_session_state *state = &svsession->scsi_dev_state[scsi_tgt_num];
1098 
1099 	if (!vsession->started || state->dev == NULL) {
1100 		/* Nothing to do */
1101 		return 0;
1102 	}
1103 
1104 	/* Mark the target for removal */
1105 	assert(state->status == VHOST_SCSI_DEV_PRESENT);
1106 	state->status = VHOST_SCSI_DEV_REMOVING;
1107 
1108 	/* Send a hotremove Virtio event */
1109 	if (vhost_dev_has_feature(vsession, VIRTIO_SCSI_F_HOTPLUG)) {
1110 		eventq_enqueue(svsession, scsi_tgt_num,
1111 			       VIRTIO_SCSI_T_TRANSPORT_RESET, VIRTIO_SCSI_EVT_RESET_REMOVED);
1112 	}
1113 
1114 	/* Wait for the session's management poller to remove the target after
1115 	 * all its pending I/O has finished.
1116 	 */
1117 	ctx->async_fini = true;
1118 	return 0;
1119 }
1120 
1121 int
1122 spdk_vhost_scsi_dev_remove_tgt(struct spdk_vhost_dev *vdev, unsigned scsi_tgt_num,
1123 			       spdk_vhost_event_fn cb_fn, void *cb_arg)
1124 {
1125 	struct spdk_vhost_scsi_dev *svdev;
1126 	struct spdk_scsi_dev_vhost_state *scsi_dev_state;
1127 	struct scsi_tgt_hotplug_ctx *ctx;
1128 
1129 	if (scsi_tgt_num >= SPDK_VHOST_SCSI_CTRLR_MAX_DEVS) {
1130 		SPDK_ERRLOG("%s: invalid SCSI target number %d\n", vdev->name, scsi_tgt_num);
1131 		return -EINVAL;
1132 	}
1133 
1134 	svdev = to_scsi_dev(vdev);
1135 	assert(svdev != NULL);
1136 	scsi_dev_state = &svdev->scsi_dev_state[scsi_tgt_num];
1137 	if (scsi_dev_state->dev == NULL || scsi_dev_state->status == VHOST_SCSI_DEV_ADDING) {
1138 		SPDK_ERRLOG("%s: SCSI target %u is not occupied\n", vdev->name, scsi_tgt_num);
1139 		return -ENODEV;
1140 	}
1141 
1142 	assert(scsi_dev_state->status != VHOST_SCSI_DEV_EMPTY);
1143 	if (scsi_dev_state->status != VHOST_SCSI_DEV_PRESENT) {
1144 		SPDK_WARNLOG("%s: SCSI target %u has been already marked for hotremoval.\n",
1145 			     vdev->name, scsi_tgt_num);
1146 		return -EBUSY;
1147 	}
1148 
1149 	ctx = calloc(1, sizeof(*ctx));
1150 	if (ctx == NULL) {
1151 		SPDK_ERRLOG("calloc failed\n");
1152 		return -ENOMEM;
1153 	}
1154 
1155 	ctx->scsi_tgt_num = scsi_tgt_num;
1156 	ctx->async_fini = false;
1157 
1158 	scsi_dev_state->remove_cb = cb_fn;
1159 	scsi_dev_state->remove_ctx = cb_arg;
1160 	scsi_dev_state->status = VHOST_SCSI_DEV_REMOVING;
1161 
1162 	vhost_dev_foreach_session(vdev, vhost_scsi_session_remove_tgt,
1163 				  vhost_scsi_dev_remove_tgt_cpl_cb, ctx);
1164 	return 0;
1165 }
1166 
1167 int
1168 vhost_scsi_controller_construct(void)
1169 {
1170 	struct spdk_conf_section *sp = spdk_conf_first_section(NULL);
1171 	struct spdk_vhost_dev *vdev;
1172 	int i, dev_num;
1173 	unsigned ctrlr_num = 0;
1174 	char *bdev_name, *tgt_num_str;
1175 	char *cpumask;
1176 	char *name;
1177 	char *tgt = NULL;
1178 
1179 	while (sp != NULL) {
1180 		if (!spdk_conf_section_match_prefix(sp, "VhostScsi")) {
1181 			sp = spdk_conf_next_section(sp);
1182 			continue;
1183 		}
1184 
1185 		if (sscanf(spdk_conf_section_get_name(sp), "VhostScsi%u", &ctrlr_num) != 1) {
1186 			SPDK_ERRLOG("Section '%s' has non-numeric suffix.\n",
1187 				    spdk_conf_section_get_name(sp));
1188 			return -1;
1189 		}
1190 
1191 		name =  spdk_conf_section_get_val(sp, "Name");
1192 		cpumask = spdk_conf_section_get_val(sp, "Cpumask");
1193 
1194 		if (spdk_vhost_scsi_dev_construct(name, cpumask) < 0) {
1195 			return -1;
1196 		}
1197 
1198 		vdev = spdk_vhost_dev_find(name);
1199 		assert(vdev);
1200 
1201 		for (i = 0; ; i++) {
1202 
1203 			tgt = spdk_conf_section_get_nval(sp, "Target", i);
1204 			if (tgt == NULL) {
1205 				break;
1206 			}
1207 
1208 			tgt_num_str = spdk_conf_section_get_nmval(sp, "Target", i, 0);
1209 			if (tgt_num_str == NULL) {
1210 				SPDK_ERRLOG("%s: invalid or missing SCSI target number\n", name);
1211 				return -1;
1212 			}
1213 
1214 			dev_num = (int)strtol(tgt_num_str, NULL, 10);
1215 			bdev_name = spdk_conf_section_get_nmval(sp, "Target", i, 1);
1216 			if (bdev_name == NULL) {
1217 				SPDK_ERRLOG("%s: invalid or missing bdev name for SCSI target %d\n", name, dev_num);
1218 				return -1;
1219 			} else if (spdk_conf_section_get_nmval(sp, "Target", i, 2)) {
1220 				SPDK_ERRLOG("%s: only one LUN per SCSI target is supported\n", name);
1221 				return -1;
1222 			}
1223 
1224 			if (spdk_vhost_scsi_dev_add_tgt(vdev, dev_num, bdev_name) < 0) {
1225 				return -1;
1226 			}
1227 		}
1228 
1229 		sp = spdk_conf_next_section(sp);
1230 	}
1231 
1232 	return 0;
1233 }
1234 
1235 static void
1236 free_task_pool(struct spdk_vhost_scsi_session *svsession)
1237 {
1238 	struct spdk_vhost_session *vsession = &svsession->vsession;
1239 	struct spdk_vhost_virtqueue *vq;
1240 	uint16_t i;
1241 
1242 	for (i = 0; i < vsession->max_queues; i++) {
1243 		vq = &vsession->virtqueue[i];
1244 		if (vq->tasks == NULL) {
1245 			continue;
1246 		}
1247 
1248 		spdk_free(vq->tasks);
1249 		vq->tasks = NULL;
1250 	}
1251 }
1252 
1253 static int
1254 alloc_task_pool(struct spdk_vhost_scsi_session *svsession)
1255 {
1256 	struct spdk_vhost_session *vsession = &svsession->vsession;
1257 	struct spdk_vhost_virtqueue *vq;
1258 	struct spdk_vhost_scsi_task *task;
1259 	uint32_t task_cnt;
1260 	uint16_t i;
1261 	uint32_t j;
1262 
1263 	for (i = 0; i < vsession->max_queues; i++) {
1264 		vq = &vsession->virtqueue[i];
1265 		if (vq->vring.desc == NULL) {
1266 			continue;
1267 		}
1268 
1269 		task_cnt = vq->vring.size;
1270 		if (task_cnt > SPDK_VHOST_MAX_VQ_SIZE) {
1271 			/* sanity check */
1272 			SPDK_ERRLOG("%s: virtuque %"PRIu16" is too big. (size = %"PRIu32", max = %"PRIu32")\n",
1273 				    vsession->name, i, task_cnt, SPDK_VHOST_MAX_VQ_SIZE);
1274 			free_task_pool(svsession);
1275 			return -1;
1276 		}
1277 		vq->tasks = spdk_zmalloc(sizeof(struct spdk_vhost_scsi_task) * task_cnt,
1278 					 SPDK_CACHE_LINE_SIZE, NULL,
1279 					 SPDK_ENV_LCORE_ID_ANY, SPDK_MALLOC_DMA);
1280 		if (vq->tasks == NULL) {
1281 			SPDK_ERRLOG("%s: failed to allocate %"PRIu32" tasks for virtqueue %"PRIu16"\n",
1282 				    vsession->name, task_cnt, i);
1283 			free_task_pool(svsession);
1284 			return -1;
1285 		}
1286 
1287 		for (j = 0; j < task_cnt; j++) {
1288 			task = &((struct spdk_vhost_scsi_task *)vq->tasks)[j];
1289 			task->svsession = svsession;
1290 			task->vq = vq;
1291 			task->req_idx = j;
1292 		}
1293 	}
1294 
1295 	return 0;
1296 }
1297 
1298 static int
1299 vhost_scsi_start_cb(struct spdk_vhost_dev *vdev,
1300 		    struct spdk_vhost_session *vsession, void *unused)
1301 {
1302 	struct spdk_vhost_scsi_session *svsession = to_scsi_session(vsession);
1303 	struct spdk_vhost_scsi_dev *svdev = svsession->svdev;
1304 	struct spdk_scsi_dev_vhost_state *state;
1305 	uint32_t i;
1306 	int rc;
1307 
1308 	/* validate all I/O queues are in a contiguous index range */
1309 	for (i = VIRTIO_SCSI_REQUESTQ; i < vsession->max_queues; i++) {
1310 		if (vsession->virtqueue[i].vring.desc == NULL) {
1311 			SPDK_ERRLOG("%s: queue %"PRIu32" is empty\n", vsession->name, i);
1312 			rc = -1;
1313 			goto out;
1314 		}
1315 	}
1316 
1317 	rc = alloc_task_pool(svsession);
1318 	if (rc != 0) {
1319 		SPDK_ERRLOG("%s: failed to alloc task pool.\n", vsession->name);
1320 		goto out;
1321 	}
1322 
1323 	for (i = 0; i < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS; i++) {
1324 		state = &svdev->scsi_dev_state[i];
1325 		if (state->dev == NULL || state->status == VHOST_SCSI_DEV_REMOVING) {
1326 			continue;
1327 		}
1328 
1329 		assert(svsession->scsi_dev_state[i].status == VHOST_SCSI_DEV_EMPTY);
1330 		svsession->scsi_dev_state[i].dev = state->dev;
1331 		svsession->scsi_dev_state[i].status = VHOST_SCSI_DEV_PRESENT;
1332 		rc = spdk_scsi_dev_allocate_io_channels(state->dev);
1333 		if (rc != 0) {
1334 			SPDK_ERRLOG("%s: failed to alloc io_channel for SCSI target %"PRIu32"\n",
1335 				    vsession->name, i);
1336 			/* unset the SCSI target so that all I/O to it will be rejected */
1337 			svsession->scsi_dev_state[i].dev = NULL;
1338 			/* set EMPTY state so that we won't reply with SCSI hotremove
1339 			 * sense codes - the device hasn't ever been added.
1340 			 */
1341 			svsession->scsi_dev_state[i].status = VHOST_SCSI_DEV_EMPTY;
1342 			continue;
1343 		}
1344 	}
1345 	SPDK_INFOLOG(SPDK_LOG_VHOST, "%s: started poller on lcore %d\n",
1346 		     vsession->name, spdk_env_get_current_core());
1347 
1348 	svsession->requestq_poller = spdk_poller_register(vdev_worker, svsession, 0);
1349 	if (vsession->virtqueue[VIRTIO_SCSI_CONTROLQ].vring.desc &&
1350 	    vsession->virtqueue[VIRTIO_SCSI_EVENTQ].vring.desc) {
1351 		svsession->mgmt_poller = spdk_poller_register(vdev_mgmt_worker, svsession,
1352 					 MGMT_POLL_PERIOD_US);
1353 	}
1354 out:
1355 	vhost_session_start_done(vsession, rc);
1356 	return rc;
1357 }
1358 
1359 static int
1360 vhost_scsi_start(struct spdk_vhost_session *vsession)
1361 {
1362 	struct spdk_vhost_scsi_session *svsession = to_scsi_session(vsession);
1363 	struct spdk_vhost_scsi_dev *svdev;
1364 
1365 	svdev = to_scsi_dev(vsession->vdev);
1366 	assert(svdev != NULL);
1367 	svsession->svdev = svdev;
1368 
1369 	if (svdev->vdev.active_session_num == 0) {
1370 		svdev->poll_group = vhost_get_poll_group(&svdev->vdev.cpumask);
1371 	}
1372 
1373 	return vhost_session_send_event(svdev->poll_group, vsession,
1374 					vhost_scsi_start_cb, 3, "start session");
1375 }
1376 
1377 static int
1378 destroy_session_poller_cb(void *arg)
1379 {
1380 	struct spdk_vhost_scsi_session *svsession = arg;
1381 	struct spdk_vhost_session *vsession = &svsession->vsession;
1382 	struct spdk_scsi_dev_session_state *state;
1383 	uint32_t i;
1384 
1385 	if (vsession->task_cnt > 0) {
1386 		return -1;
1387 	}
1388 
1389 	if (spdk_vhost_trylock() != 0) {
1390 		return -1;
1391 	}
1392 
1393 	for (i = 0; i < vsession->max_queues; i++) {
1394 		vhost_vq_used_signal(vsession, &vsession->virtqueue[i]);
1395 	}
1396 
1397 	for (i = 0; i < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS; i++) {
1398 		enum spdk_scsi_dev_vhost_status prev_status;
1399 
1400 		state = &svsession->scsi_dev_state[i];
1401 		/* clear the REMOVED status so that we won't send hotremove events anymore */
1402 		prev_status = state->status;
1403 		state->status = VHOST_SCSI_DEV_EMPTY;
1404 		if (state->dev == NULL) {
1405 			continue;
1406 		}
1407 
1408 		spdk_scsi_dev_free_io_channels(state->dev);
1409 
1410 		state->dev = NULL;
1411 
1412 		if (prev_status == VHOST_SCSI_DEV_REMOVING) {
1413 			/* try to detach it globally */
1414 			vhost_dev_foreach_session(vsession->vdev,
1415 						  vhost_scsi_session_process_removed,
1416 						  vhost_scsi_dev_process_removed_cpl_cb,
1417 						  (void *)(uintptr_t)i);
1418 		}
1419 	}
1420 
1421 	SPDK_INFOLOG(SPDK_LOG_VHOST, "%s: stopping poller on lcore %d\n",
1422 		     vsession->name, spdk_env_get_current_core());
1423 
1424 	free_task_pool(svsession);
1425 
1426 	spdk_poller_unregister(&svsession->stop_poller);
1427 	vhost_session_stop_done(vsession, 0);
1428 
1429 	spdk_vhost_unlock();
1430 	return -1;
1431 }
1432 
1433 static int
1434 vhost_scsi_stop_cb(struct spdk_vhost_dev *vdev,
1435 		   struct spdk_vhost_session *vsession, void *unused)
1436 {
1437 	struct spdk_vhost_scsi_session *svsession = to_scsi_session(vsession);
1438 
1439 	/* Stop receiving new I/O requests */
1440 	spdk_poller_unregister(&svsession->requestq_poller);
1441 
1442 	/* Stop receiving controlq requests, also stop processing the
1443 	 * asynchronous hotremove events. All the remaining events
1444 	 * will be finalized by the stop_poller below.
1445 	 */
1446 	spdk_poller_unregister(&svsession->mgmt_poller);
1447 
1448 	/* Wait for all pending I/Os to complete, then process all the
1449 	 * remaining hotremove events one last time.
1450 	 */
1451 	svsession->stop_poller = spdk_poller_register(destroy_session_poller_cb,
1452 				 svsession, 1000);
1453 
1454 	return 0;
1455 }
1456 
1457 static int
1458 vhost_scsi_stop(struct spdk_vhost_session *vsession)
1459 {
1460 	return vhost_session_send_event(vsession->poll_group, vsession,
1461 					vhost_scsi_stop_cb, 3, "stop session");
1462 }
1463 
1464 static void
1465 vhost_scsi_dump_info_json(struct spdk_vhost_dev *vdev, struct spdk_json_write_ctx *w)
1466 {
1467 	struct spdk_scsi_dev *sdev;
1468 	struct spdk_scsi_lun *lun;
1469 	uint32_t dev_idx;
1470 	uint32_t lun_idx;
1471 
1472 	assert(vdev != NULL);
1473 	spdk_json_write_named_array_begin(w, "scsi");
1474 	for (dev_idx = 0; dev_idx < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS; dev_idx++) {
1475 		sdev = spdk_vhost_scsi_dev_get_tgt(vdev, dev_idx);
1476 		if (!sdev) {
1477 			continue;
1478 		}
1479 
1480 		spdk_json_write_object_begin(w);
1481 
1482 		spdk_json_write_named_uint32(w, "scsi_dev_num", dev_idx);
1483 
1484 		spdk_json_write_named_uint32(w, "id", spdk_scsi_dev_get_id(sdev));
1485 
1486 		spdk_json_write_named_string(w, "target_name", spdk_scsi_dev_get_name(sdev));
1487 
1488 		spdk_json_write_named_array_begin(w, "luns");
1489 
1490 		for (lun_idx = 0; lun_idx < SPDK_SCSI_DEV_MAX_LUN; lun_idx++) {
1491 			lun = spdk_scsi_dev_get_lun(sdev, lun_idx);
1492 			if (!lun) {
1493 				continue;
1494 			}
1495 
1496 			spdk_json_write_object_begin(w);
1497 
1498 			spdk_json_write_named_int32(w, "id", spdk_scsi_lun_get_id(lun));
1499 
1500 			spdk_json_write_named_string(w, "bdev_name", spdk_scsi_lun_get_bdev_name(lun));
1501 
1502 			spdk_json_write_object_end(w);
1503 		}
1504 
1505 		spdk_json_write_array_end(w);
1506 		spdk_json_write_object_end(w);
1507 	}
1508 
1509 	spdk_json_write_array_end(w);
1510 }
1511 
1512 static void
1513 vhost_scsi_write_config_json(struct spdk_vhost_dev *vdev, struct spdk_json_write_ctx *w)
1514 {
1515 	struct spdk_scsi_dev *scsi_dev;
1516 	struct spdk_scsi_lun *lun;
1517 	uint32_t i;
1518 
1519 	spdk_json_write_object_begin(w);
1520 	spdk_json_write_named_string(w, "method", "vhost_create_scsi_controller");
1521 
1522 	spdk_json_write_named_object_begin(w, "params");
1523 	spdk_json_write_named_string(w, "ctrlr", vdev->name);
1524 	spdk_json_write_named_string(w, "cpumask", spdk_cpuset_fmt(&vdev->cpumask));
1525 	spdk_json_write_object_end(w);
1526 
1527 	spdk_json_write_object_end(w);
1528 
1529 	for (i = 0; i < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS; i++) {
1530 		scsi_dev = spdk_vhost_scsi_dev_get_tgt(vdev, i);
1531 		if (scsi_dev == NULL) {
1532 			continue;
1533 		}
1534 
1535 		lun = spdk_scsi_dev_get_lun(scsi_dev, 0);
1536 
1537 		spdk_json_write_object_begin(w);
1538 		spdk_json_write_named_string(w, "method", "vhost_scsi_controller_add_target");
1539 
1540 		spdk_json_write_named_object_begin(w, "params");
1541 		spdk_json_write_named_string(w, "ctrlr", vdev->name);
1542 		spdk_json_write_named_uint32(w, "scsi_target_num", i);
1543 
1544 		spdk_json_write_named_string(w, "bdev_name", spdk_scsi_lun_get_bdev_name(lun));
1545 		spdk_json_write_object_end(w);
1546 
1547 		spdk_json_write_object_end(w);
1548 	}
1549 }
1550 
1551 SPDK_LOG_REGISTER_COMPONENT("vhost_scsi", SPDK_LOG_VHOST_SCSI)
1552 SPDK_LOG_REGISTER_COMPONENT("vhost_scsi_queue", SPDK_LOG_VHOST_SCSI_QUEUE)
1553 SPDK_LOG_REGISTER_COMPONENT("vhost_scsi_data", SPDK_LOG_VHOST_SCSI_DATA)
1554