xref: /spdk/lib/vhost/vhost_scsi.c (revision b78e763c1af2ace4c19d2932065a43357e3f5d3e)
1 /*-
2  *   BSD LICENSE
3  *
4  *   Copyright(c) Intel Corporation. All rights reserved.
5  *   All rights reserved.
6  *
7  *   Redistribution and use in source and binary forms, with or without
8  *   modification, are permitted provided that the following conditions
9  *   are met:
10  *
11  *     * Redistributions of source code must retain the above copyright
12  *       notice, this list of conditions and the following disclaimer.
13  *     * Redistributions in binary form must reproduce the above copyright
14  *       notice, this list of conditions and the following disclaimer in
15  *       the documentation and/or other materials provided with the
16  *       distribution.
17  *     * Neither the name of Intel Corporation nor the names of its
18  *       contributors may be used to endorse or promote products derived
19  *       from this software without specific prior written permission.
20  *
21  *   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
22  *   "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
23  *   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
24  *   A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
25  *   OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
26  *   SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
27  *   LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
28  *   DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
29  *   THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
30  *   (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
31  *   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
32  */
33 
34 #include "spdk/stdinc.h"
35 
36 #include <linux/virtio_scsi.h>
37 
38 #include "spdk/env.h"
39 #include "spdk/thread.h"
40 #include "spdk/scsi.h"
41 #include "spdk/scsi_spec.h"
42 #include "spdk/conf.h"
43 #include "spdk/event.h"
44 #include "spdk/util.h"
45 #include "spdk/likely.h"
46 
47 #include "spdk/vhost.h"
48 #include "vhost_internal.h"
49 
50 /* Features supported by SPDK VHOST lib. */
51 #define SPDK_VHOST_SCSI_FEATURES	(SPDK_VHOST_FEATURES | \
52 					(1ULL << VIRTIO_SCSI_F_INOUT) | \
53 					(1ULL << VIRTIO_SCSI_F_HOTPLUG) | \
54 					(1ULL << VIRTIO_SCSI_F_CHANGE ) | \
55 					(1ULL << VIRTIO_SCSI_F_T10_PI ))
56 
57 /* Features that are specified in VIRTIO SCSI but currently not supported:
58  * - Live migration not supported yet
59  * - T10 PI
60  */
61 #define SPDK_VHOST_SCSI_DISABLED_FEATURES	(SPDK_VHOST_DISABLED_FEATURES | \
62 						(1ULL << VIRTIO_SCSI_F_T10_PI ))
63 
64 #define MGMT_POLL_PERIOD_US (1000 * 5)
65 
66 #define VIRTIO_SCSI_CONTROLQ   0
67 #define VIRTIO_SCSI_EVENTQ   1
68 #define VIRTIO_SCSI_REQUESTQ   2
69 
70 struct spdk_scsi_dev_vhost_state {
71 	struct spdk_scsi_dev *dev;
72 	bool removed;
73 	spdk_vhost_event_fn remove_cb;
74 	void *remove_ctx;
75 };
76 
77 struct spdk_vhost_scsi_dev {
78 	struct spdk_vhost_dev vdev;
79 	struct spdk_scsi_dev_vhost_state scsi_dev_state[SPDK_VHOST_SCSI_CTRLR_MAX_DEVS];
80 
81 	/* The CPU chosen to poll I/O of all active vhost sessions */
82 	int32_t lcore;
83 } __rte_cache_aligned;
84 
85 struct spdk_vhost_scsi_session {
86 	struct spdk_vhost_session vsession;
87 
88 	struct spdk_vhost_scsi_dev *svdev;
89 	/** Local copy of the device state */
90 	struct spdk_scsi_dev_vhost_state scsi_dev_state[SPDK_VHOST_SCSI_CTRLR_MAX_DEVS];
91 	struct spdk_poller *requestq_poller;
92 	struct spdk_poller *mgmt_poller;
93 	struct spdk_vhost_dev_destroy_ctx destroy_ctx;
94 };
95 
96 struct spdk_vhost_scsi_task {
97 	struct spdk_scsi_task	scsi;
98 	struct iovec iovs[SPDK_VHOST_IOVS_MAX];
99 
100 	union {
101 		struct virtio_scsi_cmd_resp *resp;
102 		struct virtio_scsi_ctrl_tmf_resp *tmf_resp;
103 	};
104 
105 	struct spdk_vhost_scsi_session *svsession;
106 	struct spdk_scsi_dev *scsi_dev;
107 
108 	/** Number of bytes that were written. */
109 	uint32_t used_len;
110 
111 	int req_idx;
112 
113 	/* If set, the task is currently used for I/O processing. */
114 	bool used;
115 
116 	struct spdk_vhost_virtqueue *vq;
117 };
118 
119 static int spdk_vhost_scsi_start(struct spdk_vhost_session *vsession);
120 static int spdk_vhost_scsi_stop(struct spdk_vhost_session *vsession);
121 static void spdk_vhost_scsi_dump_info_json(struct spdk_vhost_dev *vdev,
122 		struct spdk_json_write_ctx *w);
123 static void spdk_vhost_scsi_write_config_json(struct spdk_vhost_dev *vdev,
124 		struct spdk_json_write_ctx *w);
125 static int spdk_vhost_scsi_dev_remove(struct spdk_vhost_dev *vdev);
126 
127 const struct spdk_vhost_dev_backend spdk_vhost_scsi_device_backend = {
128 	.virtio_features = SPDK_VHOST_SCSI_FEATURES,
129 	.disabled_features = SPDK_VHOST_SCSI_DISABLED_FEATURES,
130 	.session_ctx_size = sizeof(struct spdk_vhost_scsi_session) - sizeof(struct spdk_vhost_session),
131 	.start_session =  spdk_vhost_scsi_start,
132 	.stop_session = spdk_vhost_scsi_stop,
133 	.dump_info_json = spdk_vhost_scsi_dump_info_json,
134 	.write_config_json = spdk_vhost_scsi_write_config_json,
135 	.remove_device = spdk_vhost_scsi_dev_remove,
136 };
137 
138 static void
139 spdk_vhost_scsi_task_put(struct spdk_vhost_scsi_task *task)
140 {
141 	spdk_scsi_task_put(&task->scsi);
142 }
143 
144 static void
145 spdk_vhost_scsi_task_free_cb(struct spdk_scsi_task *scsi_task)
146 {
147 	struct spdk_vhost_scsi_task *task = SPDK_CONTAINEROF(scsi_task, struct spdk_vhost_scsi_task, scsi);
148 	struct spdk_vhost_session *vsession = &task->svsession->vsession;
149 
150 	assert(vsession->task_cnt > 0);
151 	vsession->task_cnt--;
152 	task->used = false;
153 }
154 
155 static int
156 remove_scsi_tgt(struct spdk_vhost_scsi_dev *svdev,
157 		unsigned scsi_tgt_num)
158 {
159 	struct spdk_scsi_dev_vhost_state *state;
160 	struct spdk_scsi_dev *dev;
161 
162 	state = &svdev->scsi_dev_state[scsi_tgt_num];
163 	if (state->dev == NULL) {
164 		/* we've been already removed in the meantime */
165 		return 0;
166 	}
167 
168 	dev = state->dev;
169 	state->dev = NULL;
170 	spdk_scsi_dev_destruct(dev);
171 	if (state->remove_cb) {
172 		state->remove_cb(&svdev->vdev, state->remove_ctx);
173 		state->remove_cb = NULL;
174 	}
175 	SPDK_INFOLOG(SPDK_LOG_VHOST, "%s: removed target 'Target %u'\n",
176 		     svdev->vdev.name, scsi_tgt_num);
177 	return 0;
178 }
179 
180 static int
181 spdk_vhost_scsi_session_process_removed(struct spdk_vhost_dev *vdev,
182 					struct spdk_vhost_session *vsession, void *ctx)
183 {
184 	unsigned scsi_tgt_num = (unsigned)(uintptr_t)ctx;
185 	struct spdk_vhost_scsi_session *svsession;
186 	struct spdk_scsi_dev_vhost_state *state;
187 
188 	if (vsession == NULL) {
189 		/* all sessions have already detached the device */
190 		struct spdk_vhost_scsi_dev *svdev = SPDK_CONTAINEROF(vdev,
191 						    struct spdk_vhost_scsi_dev, vdev);
192 
193 		return remove_scsi_tgt(svdev, scsi_tgt_num);
194 	}
195 
196 	svsession = (struct spdk_vhost_scsi_session *)vsession;
197 	state = &svsession->scsi_dev_state[scsi_tgt_num];
198 
199 	if (state->dev != NULL) {
200 		/* there's still a session that references this device,
201 		 * so abort our foreach chain here. We'll be called
202 		 * again from this session's management poller after it
203 		 * is removed in there
204 		 */
205 		return -1;
206 	}
207 
208 	return 0;
209 }
210 
211 static int
212 spdk_vhost_scsi_dev_process_removed(struct spdk_vhost_dev *vdev, void *arg)
213 {
214 	spdk_vhost_dev_foreach_session(vdev,
215 				       spdk_vhost_scsi_session_process_removed,
216 				       arg);
217 	return 0;
218 }
219 
220 static void
221 process_removed_devs(struct spdk_vhost_scsi_session *svsession)
222 {
223 	struct spdk_scsi_dev *dev;
224 	struct spdk_scsi_dev_vhost_state *state;
225 	int i;
226 
227 	for (i = 0; i < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS; ++i) {
228 		state = &svsession->scsi_dev_state[i];
229 		dev = state->dev;
230 
231 		if (dev && state->removed && !spdk_scsi_dev_has_pending_tasks(dev)) {
232 			/* detach the device from this session */
233 			spdk_scsi_dev_free_io_channels(dev);
234 			state->dev = NULL;
235 			/* try to detach it globally. we need a lock in order to modify
236 			 * the vdev, so use an external event */
237 			spdk_vhost_call_external_event(svsession->svdev->vdev.name,
238 						       spdk_vhost_scsi_dev_process_removed,
239 						       (void *)(uintptr_t)i);
240 		}
241 	}
242 }
243 
244 static void
245 eventq_enqueue(struct spdk_vhost_scsi_session *svsession, unsigned scsi_dev_num,
246 	       uint32_t event, uint32_t reason)
247 {
248 	struct spdk_vhost_session *vsession = &svsession->vsession;
249 	struct spdk_vhost_dev *vdev = vsession->vdev;
250 	struct spdk_vhost_virtqueue *vq;
251 	struct vring_desc *desc, *desc_table;
252 	struct virtio_scsi_event *desc_ev;
253 	uint32_t desc_table_size, req_size = 0;
254 	uint16_t req;
255 	int rc;
256 
257 	assert(scsi_dev_num < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS);
258 	vq = &vsession->virtqueue[VIRTIO_SCSI_EVENTQ];
259 
260 	if (spdk_vhost_vq_avail_ring_get(vq, &req, 1) != 1) {
261 		SPDK_ERRLOG("Controller %s: Failed to send virtio event (no avail ring entries?).\n",
262 			    vdev->name);
263 		return;
264 	}
265 
266 	rc = spdk_vhost_vq_get_desc(vsession, vq, req, &desc, &desc_table, &desc_table_size);
267 	if (rc != 0 || desc->len < sizeof(*desc_ev)) {
268 		SPDK_ERRLOG("Controller %s: Invalid eventq descriptor at index %"PRIu16".\n",
269 			    vdev->name, req);
270 		goto out;
271 	}
272 
273 	desc_ev = spdk_vhost_gpa_to_vva(vsession, desc->addr, sizeof(*desc_ev));
274 	if (desc_ev == NULL) {
275 		SPDK_ERRLOG("Controller %s: Eventq descriptor at index %"PRIu16" points to unmapped guest memory address %p.\n",
276 			    vdev->name, req, (void *)(uintptr_t)desc->addr);
277 		goto out;
278 	}
279 
280 	desc_ev->event = event;
281 	desc_ev->lun[0] = 1;
282 	desc_ev->lun[1] = scsi_dev_num;
283 	/* virtio LUN id 0 can refer either to the entire device
284 	 * or actual LUN 0 (the only supported by vhost for now)
285 	 */
286 	desc_ev->lun[2] = 0 >> 8;
287 	desc_ev->lun[3] = 0 & 0xFF;
288 	/* virtio doesn't specify any strict format for LUN id (bytes 2 and 3)
289 	 * current implementation relies on linux kernel sources
290 	 */
291 	memset(&desc_ev->lun[4], 0, 4);
292 	desc_ev->reason = reason;
293 	req_size = sizeof(*desc_ev);
294 
295 out:
296 	spdk_vhost_vq_used_ring_enqueue(vsession, vq, req, req_size);
297 }
298 
299 static void
300 submit_completion(struct spdk_vhost_scsi_task *task)
301 {
302 	struct spdk_vhost_session *vsession = &task->svsession->vsession;
303 
304 	spdk_vhost_vq_used_ring_enqueue(vsession, task->vq, task->req_idx,
305 					task->used_len);
306 	SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI, "Finished task (%p) req_idx=%d\n", task, task->req_idx);
307 
308 	spdk_vhost_scsi_task_put(task);
309 }
310 
311 static void
312 spdk_vhost_scsi_task_mgmt_cpl(struct spdk_scsi_task *scsi_task)
313 {
314 	struct spdk_vhost_scsi_task *task = SPDK_CONTAINEROF(scsi_task, struct spdk_vhost_scsi_task, scsi);
315 
316 	submit_completion(task);
317 }
318 
319 static void
320 spdk_vhost_scsi_task_cpl(struct spdk_scsi_task *scsi_task)
321 {
322 	struct spdk_vhost_scsi_task *task = SPDK_CONTAINEROF(scsi_task, struct spdk_vhost_scsi_task, scsi);
323 
324 	/* The SCSI task has completed.  Do final processing and then post
325 	   notification to the virtqueue's "used" ring.
326 	 */
327 	task->resp->status = task->scsi.status;
328 
329 	if (task->scsi.status != SPDK_SCSI_STATUS_GOOD) {
330 		memcpy(task->resp->sense, task->scsi.sense_data, task->scsi.sense_data_len);
331 		task->resp->sense_len = task->scsi.sense_data_len;
332 		SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI, "Task (%p) req_idx=%d failed - status=%u\n", task, task->req_idx,
333 			      task->scsi.status);
334 	}
335 	assert(task->scsi.transfer_len == task->scsi.length);
336 	task->resp->resid = task->scsi.length - task->scsi.data_transferred;
337 
338 	submit_completion(task);
339 }
340 
341 static void
342 task_submit(struct spdk_vhost_scsi_task *task)
343 {
344 	task->resp->response = VIRTIO_SCSI_S_OK;
345 	spdk_scsi_dev_queue_task(task->scsi_dev, &task->scsi);
346 }
347 
348 static void
349 mgmt_task_submit(struct spdk_vhost_scsi_task *task, enum spdk_scsi_task_func func)
350 {
351 	task->tmf_resp->response = VIRTIO_SCSI_S_OK;
352 	task->scsi.function = func;
353 	spdk_scsi_dev_queue_mgmt_task(task->scsi_dev, &task->scsi);
354 }
355 
356 static void
357 invalid_request(struct spdk_vhost_scsi_task *task)
358 {
359 	struct spdk_vhost_session *vsession = &task->svsession->vsession;
360 
361 	spdk_vhost_vq_used_ring_enqueue(vsession, task->vq, task->req_idx,
362 					task->used_len);
363 	spdk_vhost_scsi_task_put(task);
364 
365 	SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI, "Invalid request (status=%" PRIu8")\n",
366 		      task->resp ? task->resp->response : -1);
367 }
368 
369 static int
370 spdk_vhost_scsi_task_init_target(struct spdk_vhost_scsi_task *task, const __u8 *lun)
371 {
372 	struct spdk_vhost_scsi_session *svsession = task->svsession;
373 	struct spdk_scsi_dev_vhost_state *state;
374 	uint16_t lun_id = (((uint16_t)lun[2] << 8) | lun[3]) & 0x3FFF;
375 
376 	SPDK_LOGDUMP(SPDK_LOG_VHOST_SCSI_QUEUE, "LUN", lun, 8);
377 
378 	/* First byte must be 1 and second is target */
379 	if (lun[0] != 1 || lun[1] >= SPDK_VHOST_SCSI_CTRLR_MAX_DEVS) {
380 		return -1;
381 	}
382 
383 	state = &svsession->scsi_dev_state[lun[1]];
384 	task->scsi_dev = state->dev;
385 	if (state->dev == NULL || svsession->scsi_dev_state[lun[1]].removed) {
386 		/* If dev has been hotdetached, return 0 to allow sending
387 		 * additional hotremove event via sense codes.
388 		 */
389 		return svsession->scsi_dev_state[lun[1]].removed ? 0 : -1;
390 	}
391 
392 	task->scsi.target_port = spdk_scsi_dev_find_port_by_id(task->scsi_dev, 0);
393 	task->scsi.lun = spdk_scsi_dev_get_lun(state->dev, lun_id);
394 	return 0;
395 }
396 
397 static void
398 process_ctrl_request(struct spdk_vhost_scsi_task *task)
399 {
400 	struct spdk_vhost_session *vsession = &task->svsession->vsession;
401 	struct spdk_vhost_dev *vdev = vsession->vdev;
402 	struct vring_desc *desc, *desc_table;
403 	struct virtio_scsi_ctrl_tmf_req *ctrl_req;
404 	struct virtio_scsi_ctrl_an_resp *an_resp;
405 	uint32_t desc_table_size, used_len = 0;
406 	int rc;
407 
408 	spdk_scsi_task_construct(&task->scsi, spdk_vhost_scsi_task_mgmt_cpl, spdk_vhost_scsi_task_free_cb);
409 	rc = spdk_vhost_vq_get_desc(vsession, task->vq, task->req_idx, &desc, &desc_table,
410 				    &desc_table_size);
411 	if (spdk_unlikely(rc != 0)) {
412 		SPDK_ERRLOG("%s: Invalid controlq descriptor at index %d.\n",
413 			    vdev->name, task->req_idx);
414 		goto out;
415 	}
416 
417 	ctrl_req = spdk_vhost_gpa_to_vva(vsession, desc->addr, sizeof(*ctrl_req));
418 	if (ctrl_req == NULL) {
419 		SPDK_ERRLOG("%s: Invalid task management request at index %d.\n",
420 			    vdev->name, task->req_idx);
421 		goto out;
422 	}
423 
424 	SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI_QUEUE,
425 		      "Processing controlq descriptor: desc %d/%p, desc_addr %p, len %d, flags %d, last_used_idx %d; kickfd %d; size %d\n",
426 		      task->req_idx, desc, (void *)desc->addr, desc->len, desc->flags, task->vq->vring.last_used_idx,
427 		      task->vq->vring.kickfd, task->vq->vring.size);
428 	SPDK_LOGDUMP(SPDK_LOG_VHOST_SCSI_QUEUE, "Request descriptor", (uint8_t *)ctrl_req, desc->len);
429 
430 	spdk_vhost_scsi_task_init_target(task, ctrl_req->lun);
431 
432 	spdk_vhost_vring_desc_get_next(&desc, desc_table, desc_table_size);
433 	if (spdk_unlikely(desc == NULL)) {
434 		SPDK_ERRLOG("%s: No response descriptor for controlq request %d.\n",
435 			    vdev->name, task->req_idx);
436 		goto out;
437 	}
438 
439 	/* Process the TMF request */
440 	switch (ctrl_req->type) {
441 	case VIRTIO_SCSI_T_TMF:
442 		task->tmf_resp = spdk_vhost_gpa_to_vva(vsession, desc->addr, sizeof(*task->tmf_resp));
443 		if (spdk_unlikely(desc->len < sizeof(struct virtio_scsi_ctrl_tmf_resp) || task->tmf_resp == NULL)) {
444 			SPDK_ERRLOG("%s: TMF response descriptor at index %d points to invalid guest memory region\n",
445 				    vdev->name, task->req_idx);
446 			goto out;
447 		}
448 
449 		/* Check if we are processing a valid request */
450 		if (task->scsi_dev == NULL) {
451 			task->tmf_resp->response = VIRTIO_SCSI_S_BAD_TARGET;
452 			break;
453 		}
454 
455 		switch (ctrl_req->subtype) {
456 		case VIRTIO_SCSI_T_TMF_LOGICAL_UNIT_RESET:
457 			/* Handle LUN reset */
458 			SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI_QUEUE, "LUN reset\n");
459 
460 			mgmt_task_submit(task, SPDK_SCSI_TASK_FUNC_LUN_RESET);
461 			return;
462 		default:
463 			task->tmf_resp->response = VIRTIO_SCSI_S_ABORTED;
464 			/* Unsupported command */
465 			SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI_QUEUE, "Unsupported TMF command %x\n", ctrl_req->subtype);
466 			break;
467 		}
468 		break;
469 	case VIRTIO_SCSI_T_AN_QUERY:
470 	case VIRTIO_SCSI_T_AN_SUBSCRIBE: {
471 		an_resp = spdk_vhost_gpa_to_vva(vsession, desc->addr, sizeof(*an_resp));
472 		if (spdk_unlikely(desc->len < sizeof(struct virtio_scsi_ctrl_an_resp) || an_resp == NULL)) {
473 			SPDK_WARNLOG("%s: Asynchronous response descriptor points to invalid guest memory region\n",
474 				     vdev->name);
475 			goto out;
476 		}
477 
478 		an_resp->response = VIRTIO_SCSI_S_ABORTED;
479 		break;
480 	}
481 	default:
482 		SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI_QUEUE, "Unsupported control command %x\n", ctrl_req->type);
483 		break;
484 	}
485 
486 	used_len = sizeof(struct virtio_scsi_ctrl_tmf_resp);
487 out:
488 	spdk_vhost_vq_used_ring_enqueue(vsession, task->vq, task->req_idx, used_len);
489 	spdk_vhost_scsi_task_put(task);
490 }
491 
492 /*
493  * Process task's descriptor chain and setup data related fields.
494  * Return
495  *   -1 if request is invalid and must be aborted,
496  *    0 if all data are set.
497  */
498 static int
499 task_data_setup(struct spdk_vhost_scsi_task *task,
500 		struct virtio_scsi_cmd_req **req)
501 {
502 	struct spdk_vhost_session *vsession = &task->svsession->vsession;
503 	struct spdk_vhost_dev *vdev = vsession->vdev;
504 	struct vring_desc *desc, *desc_table;
505 	struct iovec *iovs = task->iovs;
506 	uint16_t iovcnt = 0;
507 	uint32_t desc_table_len, len = 0;
508 	int rc;
509 
510 	spdk_scsi_task_construct(&task->scsi, spdk_vhost_scsi_task_cpl, spdk_vhost_scsi_task_free_cb);
511 
512 	rc = spdk_vhost_vq_get_desc(vsession, task->vq, task->req_idx, &desc, &desc_table, &desc_table_len);
513 	/* First descriptor must be readable */
514 	if (spdk_unlikely(rc != 0  || spdk_vhost_vring_desc_is_wr(desc) ||
515 			  desc->len < sizeof(struct virtio_scsi_cmd_req))) {
516 		SPDK_WARNLOG("%s: invalid first (request) descriptor at index %"PRIu16".\n",
517 			     vdev->name, task->req_idx);
518 		goto invalid_task;
519 	}
520 
521 	*req = spdk_vhost_gpa_to_vva(vsession, desc->addr, sizeof(**req));
522 	if (spdk_unlikely(*req == NULL)) {
523 		SPDK_WARNLOG("%s: Request descriptor at index %d points to invalid guest memory region\n",
524 			     vdev->name, task->req_idx);
525 		goto invalid_task;
526 	}
527 
528 	/* Each request must have at least 2 descriptors (e.g. request and response) */
529 	spdk_vhost_vring_desc_get_next(&desc, desc_table, desc_table_len);
530 	if (desc == NULL) {
531 		SPDK_WARNLOG("%s: Descriptor chain at index %d contains neither payload nor response buffer.\n",
532 			     vdev->name, task->req_idx);
533 		goto invalid_task;
534 	}
535 	task->scsi.dxfer_dir = spdk_vhost_vring_desc_is_wr(desc) ? SPDK_SCSI_DIR_FROM_DEV :
536 			       SPDK_SCSI_DIR_TO_DEV;
537 	task->scsi.iovs = iovs;
538 
539 	if (task->scsi.dxfer_dir == SPDK_SCSI_DIR_FROM_DEV) {
540 		/*
541 		 * FROM_DEV (READ): [RD_req][WR_resp][WR_buf0]...[WR_bufN]
542 		 */
543 		task->resp = spdk_vhost_gpa_to_vva(vsession, desc->addr, sizeof(*task->resp));
544 		if (spdk_unlikely(desc->len < sizeof(struct virtio_scsi_cmd_resp) || task->resp == NULL)) {
545 			SPDK_WARNLOG("%s: Response descriptor at index %d points to invalid guest memory region\n",
546 				     vdev->name, task->req_idx);
547 			goto invalid_task;
548 		}
549 		rc = spdk_vhost_vring_desc_get_next(&desc, desc_table, desc_table_len);
550 		if (spdk_unlikely(rc != 0)) {
551 			SPDK_WARNLOG("%s: invalid descriptor chain at request index %d (descriptor id overflow?).\n",
552 				     vdev->name, task->req_idx);
553 			goto invalid_task;
554 		}
555 
556 		if (desc == NULL) {
557 			/*
558 			 * TEST UNIT READY command and some others might not contain any payload and this is not an error.
559 			 */
560 			SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI_DATA,
561 				      "No payload descriptors for FROM DEV command req_idx=%"PRIu16".\n", task->req_idx);
562 			SPDK_LOGDUMP(SPDK_LOG_VHOST_SCSI_DATA, "CDB=", (*req)->cdb, VIRTIO_SCSI_CDB_SIZE);
563 			task->used_len = sizeof(struct virtio_scsi_cmd_resp);
564 			task->scsi.iovcnt = 1;
565 			task->scsi.iovs[0].iov_len = 0;
566 			task->scsi.length = 0;
567 			task->scsi.transfer_len = 0;
568 			return 0;
569 		}
570 
571 		/* All remaining descriptors are data. */
572 		while (desc) {
573 			if (spdk_unlikely(!spdk_vhost_vring_desc_is_wr(desc))) {
574 				SPDK_WARNLOG("FROM DEV cmd: descriptor nr %" PRIu16" in payload chain is read only.\n", iovcnt);
575 				goto invalid_task;
576 			}
577 
578 			if (spdk_unlikely(spdk_vhost_vring_desc_to_iov(vsession, iovs, &iovcnt, desc))) {
579 				goto invalid_task;
580 			}
581 			len += desc->len;
582 
583 			rc = spdk_vhost_vring_desc_get_next(&desc, desc_table, desc_table_len);
584 			if (spdk_unlikely(rc != 0)) {
585 				SPDK_WARNLOG("%s: invalid payload in descriptor chain starting at index %d.\n",
586 					     vdev->name, task->req_idx);
587 				goto invalid_task;
588 			}
589 		}
590 
591 		task->used_len = sizeof(struct virtio_scsi_cmd_resp) + len;
592 	} else {
593 		SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI_DATA, "TO DEV");
594 		/*
595 		 * TO_DEV (WRITE):[RD_req][RD_buf0]...[RD_bufN][WR_resp]
596 		 * No need to check descriptor WR flag as this is done while setting scsi.dxfer_dir.
597 		 */
598 
599 		/* Process descriptors up to response. */
600 		while (!spdk_vhost_vring_desc_is_wr(desc)) {
601 			if (spdk_unlikely(spdk_vhost_vring_desc_to_iov(vsession, iovs, &iovcnt, desc))) {
602 				goto invalid_task;
603 			}
604 			len += desc->len;
605 
606 			spdk_vhost_vring_desc_get_next(&desc, desc_table, desc_table_len);
607 			if (spdk_unlikely(desc == NULL)) {
608 				SPDK_WARNLOG("TO_DEV cmd: no response descriptor.\n");
609 				goto invalid_task;
610 			}
611 		}
612 
613 		task->resp = spdk_vhost_gpa_to_vva(vsession, desc->addr, sizeof(*task->resp));
614 		if (spdk_unlikely(desc->len < sizeof(struct virtio_scsi_cmd_resp) || task->resp == NULL)) {
615 			SPDK_WARNLOG("%s: Response descriptor at index %d points to invalid guest memory region\n",
616 				     vdev->name, task->req_idx);
617 			goto invalid_task;
618 		}
619 
620 		task->used_len = sizeof(struct virtio_scsi_cmd_resp);
621 	}
622 
623 	task->scsi.iovcnt = iovcnt;
624 	task->scsi.length = len;
625 	task->scsi.transfer_len = len;
626 	return 0;
627 
628 invalid_task:
629 	SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI_DATA, "%s: Invalid task at index %"PRIu16".\n",
630 		      vdev->name, task->req_idx);
631 	return -1;
632 }
633 
634 static int
635 process_request(struct spdk_vhost_scsi_task *task)
636 {
637 	struct virtio_scsi_cmd_req *req;
638 	int result;
639 
640 	result = task_data_setup(task, &req);
641 	if (result) {
642 		return result;
643 	}
644 
645 	result = spdk_vhost_scsi_task_init_target(task, req->lun);
646 	if (spdk_unlikely(result != 0)) {
647 		task->resp->response = VIRTIO_SCSI_S_BAD_TARGET;
648 		return -1;
649 	}
650 
651 	task->scsi.cdb = req->cdb;
652 	SPDK_LOGDUMP(SPDK_LOG_VHOST_SCSI_DATA, "request CDB", req->cdb, VIRTIO_SCSI_CDB_SIZE);
653 
654 	if (spdk_unlikely(task->scsi.lun == NULL)) {
655 		spdk_scsi_task_process_null_lun(&task->scsi);
656 		task->resp->response = VIRTIO_SCSI_S_OK;
657 		return 1;
658 	}
659 
660 	return 0;
661 }
662 
663 static void
664 process_controlq(struct spdk_vhost_scsi_session *svsession, struct spdk_vhost_virtqueue *vq)
665 {
666 	struct spdk_vhost_scsi_dev *svdev = svsession->svdev;
667 	struct spdk_vhost_session *vsession = &svsession->vsession;
668 	struct spdk_vhost_scsi_task *task;
669 	uint16_t reqs[32];
670 	uint16_t reqs_cnt, i;
671 
672 	reqs_cnt = spdk_vhost_vq_avail_ring_get(vq, reqs, SPDK_COUNTOF(reqs));
673 	for (i = 0; i < reqs_cnt; i++) {
674 		if (spdk_unlikely(reqs[i] >= vq->vring.size)) {
675 			SPDK_ERRLOG("%s: invalid entry in avail ring. Buffer '%"PRIu16"' exceeds virtqueue size (%"PRIu16")\n",
676 				    svdev->vdev.name, reqs[i], vq->vring.size);
677 			spdk_vhost_vq_used_ring_enqueue(vsession, vq, reqs[i], 0);
678 			continue;
679 		}
680 
681 		task = &((struct spdk_vhost_scsi_task *)vq->tasks)[reqs[i]];
682 		if (spdk_unlikely(task->used)) {
683 			SPDK_ERRLOG("%s: invalid entry in avail ring. Buffer '%"PRIu16"' is still in use!\n",
684 				    svdev->vdev.name, reqs[i]);
685 			spdk_vhost_vq_used_ring_enqueue(vsession, vq, reqs[i], 0);
686 			continue;
687 		}
688 
689 		vsession->task_cnt++;
690 		memset(&task->scsi, 0, sizeof(task->scsi));
691 		task->tmf_resp = NULL;
692 		task->used = true;
693 		process_ctrl_request(task);
694 	}
695 }
696 
697 static void
698 process_requestq(struct spdk_vhost_scsi_session *svsession, struct spdk_vhost_virtqueue *vq)
699 {
700 	struct spdk_vhost_session *vsession = &svsession->vsession;
701 	struct spdk_vhost_dev *vdev = vsession->vdev;
702 	struct spdk_vhost_scsi_task *task;
703 	uint16_t reqs[32];
704 	uint16_t reqs_cnt, i;
705 	int result;
706 
707 	reqs_cnt = spdk_vhost_vq_avail_ring_get(vq, reqs, SPDK_COUNTOF(reqs));
708 	assert(reqs_cnt <= 32);
709 
710 	for (i = 0; i < reqs_cnt; i++) {
711 		SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI, "====== Starting processing request idx %"PRIu16"======\n",
712 			      reqs[i]);
713 
714 		if (spdk_unlikely(reqs[i] >= vq->vring.size)) {
715 			SPDK_ERRLOG("%s: request idx '%"PRIu16"' exceeds virtqueue size (%"PRIu16").\n",
716 				    vdev->name, reqs[i], vq->vring.size);
717 			spdk_vhost_vq_used_ring_enqueue(vsession, vq, reqs[i], 0);
718 			continue;
719 		}
720 
721 		task = &((struct spdk_vhost_scsi_task *)vq->tasks)[reqs[i]];
722 		if (spdk_unlikely(task->used)) {
723 			SPDK_ERRLOG("%s: request with idx '%"PRIu16"' is already pending.\n",
724 				    vdev->name, reqs[i]);
725 			spdk_vhost_vq_used_ring_enqueue(vsession, vq, reqs[i], 0);
726 			continue;
727 		}
728 
729 		vsession->task_cnt++;
730 		memset(&task->scsi, 0, sizeof(task->scsi));
731 		task->resp = NULL;
732 		task->used = true;
733 		task->used_len = 0;
734 		result = process_request(task);
735 		if (likely(result == 0)) {
736 			task_submit(task);
737 			SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI, "====== Task %p req_idx %d submitted ======\n", task,
738 				      task->req_idx);
739 		} else if (result > 0) {
740 			spdk_vhost_scsi_task_cpl(&task->scsi);
741 			SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI, "====== Task %p req_idx %d finished early ======\n", task,
742 				      task->req_idx);
743 		} else {
744 			invalid_request(task);
745 			SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI, "====== Task %p req_idx %d failed ======\n", task,
746 				      task->req_idx);
747 		}
748 	}
749 }
750 
751 static int
752 vdev_mgmt_worker(void *arg)
753 {
754 	struct spdk_vhost_scsi_session *svsession = arg;
755 	struct spdk_vhost_session *vsession = &svsession->vsession;
756 
757 	process_removed_devs(svsession);
758 	spdk_vhost_vq_used_signal(vsession, &vsession->virtqueue[VIRTIO_SCSI_EVENTQ]);
759 
760 	process_controlq(svsession, &vsession->virtqueue[VIRTIO_SCSI_CONTROLQ]);
761 	spdk_vhost_vq_used_signal(vsession, &vsession->virtqueue[VIRTIO_SCSI_CONTROLQ]);
762 
763 	return -1;
764 }
765 
766 static int
767 vdev_worker(void *arg)
768 {
769 	struct spdk_vhost_scsi_session *svsession = arg;
770 	struct spdk_vhost_session *vsession = &svsession->vsession;
771 	uint32_t q_idx;
772 
773 	for (q_idx = VIRTIO_SCSI_REQUESTQ; q_idx < vsession->max_queues; q_idx++) {
774 		process_requestq(svsession, &vsession->virtqueue[q_idx]);
775 	}
776 
777 	spdk_vhost_session_used_signal(vsession);
778 
779 	return -1;
780 }
781 
782 static struct spdk_vhost_scsi_dev *
783 to_scsi_dev(struct spdk_vhost_dev *ctrlr)
784 {
785 	if (ctrlr == NULL) {
786 		return NULL;
787 	}
788 
789 	if (ctrlr->backend != &spdk_vhost_scsi_device_backend) {
790 		SPDK_ERRLOG("%s: not a vhost-scsi device.\n", ctrlr->name);
791 		return NULL;
792 	}
793 
794 	return SPDK_CONTAINEROF(ctrlr, struct spdk_vhost_scsi_dev, vdev);
795 }
796 
797 static struct spdk_vhost_scsi_session *
798 to_scsi_session(struct spdk_vhost_session *vsession)
799 {
800 	if (vsession == NULL) {
801 		return NULL;
802 	}
803 
804 	if (vsession->vdev->backend != &spdk_vhost_scsi_device_backend) {
805 		SPDK_ERRLOG("%s: not a vhost-scsi device.\n", vsession->vdev->name);
806 		return NULL;
807 	}
808 
809 	return (struct spdk_vhost_scsi_session *)vsession;
810 }
811 
812 int
813 spdk_vhost_scsi_dev_construct(const char *name, const char *cpumask)
814 {
815 	struct spdk_vhost_scsi_dev *svdev = spdk_dma_zmalloc(sizeof(struct spdk_vhost_scsi_dev),
816 					    SPDK_CACHE_LINE_SIZE, NULL);
817 	int rc;
818 
819 	if (svdev == NULL) {
820 		return -ENOMEM;
821 	}
822 
823 	spdk_vhost_lock();
824 	rc = spdk_vhost_dev_register(&svdev->vdev, name, cpumask,
825 				     &spdk_vhost_scsi_device_backend);
826 
827 	if (rc) {
828 		spdk_dma_free(svdev);
829 	}
830 
831 	spdk_vhost_unlock();
832 	return rc;
833 }
834 
835 static int
836 spdk_vhost_scsi_dev_remove(struct spdk_vhost_dev *vdev)
837 {
838 	struct spdk_vhost_scsi_dev *svdev = to_scsi_dev(vdev);
839 	int rc, i;
840 
841 	if (svdev == NULL) {
842 		return -EINVAL;
843 	}
844 
845 	for (i = 0; i < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS; ++i) {
846 		if (svdev->scsi_dev_state[i].dev) {
847 			if (vdev->registered) {
848 				SPDK_ERRLOG("Trying to remove non-empty controller: %s.\n", vdev->name);
849 				return -EBUSY;
850 			}
851 
852 			rc = spdk_vhost_scsi_dev_remove_tgt(vdev, i, NULL, NULL);
853 			if (rc != 0) {
854 				SPDK_ERRLOG("%s: failed to force-remove target %d\n", vdev->name, i);
855 				return rc;
856 			}
857 		}
858 	}
859 
860 	rc = spdk_vhost_dev_unregister(vdev);
861 	if (rc != 0) {
862 		return rc;
863 	}
864 
865 	spdk_dma_free(svdev);
866 	return 0;
867 }
868 
869 struct spdk_scsi_dev *
870 spdk_vhost_scsi_dev_get_tgt(struct spdk_vhost_dev *vdev, uint8_t num)
871 {
872 	struct spdk_vhost_scsi_dev *svdev;
873 
874 	assert(num < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS);
875 	svdev = to_scsi_dev(vdev);
876 
877 	return svdev ? svdev->scsi_dev_state[num].dev : NULL;
878 }
879 
880 static void
881 spdk_vhost_scsi_lun_hotremove(const struct spdk_scsi_lun *lun, void *arg)
882 {
883 	struct spdk_vhost_scsi_dev *svdev = arg;
884 	const struct spdk_scsi_dev *scsi_dev;
885 	unsigned scsi_dev_num;
886 
887 	assert(lun != NULL);
888 	assert(svdev != NULL);
889 	scsi_dev = spdk_scsi_lun_get_dev(lun);
890 	for (scsi_dev_num = 0; scsi_dev_num < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS; scsi_dev_num++) {
891 		if (svdev->scsi_dev_state[scsi_dev_num].dev == scsi_dev) {
892 			break;
893 		}
894 	}
895 
896 	if (scsi_dev_num == SPDK_VHOST_SCSI_CTRLR_MAX_DEVS) {
897 		/* The entire device has been already removed. */
898 		return;
899 	}
900 
901 	/* remove entire device */
902 	spdk_vhost_scsi_dev_remove_tgt(&svdev->vdev, scsi_dev_num, NULL, NULL);
903 }
904 
905 static int
906 spdk_vhost_scsi_session_add_tgt(struct spdk_vhost_dev *vdev,
907 				struct spdk_vhost_session *vsession, void *ctx)
908 {
909 	unsigned scsi_tgt_num = (unsigned)(uintptr_t)ctx;
910 	struct spdk_vhost_scsi_session *svsession;
911 
912 	if (vsession == NULL) {
913 		/* Nothing more to do */
914 		return 0;
915 	}
916 
917 	svsession = (struct spdk_vhost_scsi_session *)vsession;;
918 	/* copy the entire device state */
919 	svsession->scsi_dev_state[scsi_tgt_num] = svsession->svdev->scsi_dev_state[scsi_tgt_num];
920 
921 	if (vsession->lcore == -1) {
922 		/* All done. */
923 		return 0;
924 	}
925 
926 	spdk_scsi_dev_allocate_io_channels(svsession->scsi_dev_state[scsi_tgt_num].dev);
927 
928 	if (spdk_vhost_dev_has_feature(vsession, VIRTIO_SCSI_F_HOTPLUG)) {
929 		eventq_enqueue(svsession, scsi_tgt_num,
930 			       VIRTIO_SCSI_T_TRANSPORT_RESET, VIRTIO_SCSI_EVT_RESET_RESCAN);
931 	} else {
932 		SPDK_NOTICELOG("Device %s does not support hotplug. "
933 			       "Please restart the driver or perform a rescan.\n",
934 			       vdev->name);
935 	}
936 
937 	return 0;
938 }
939 
940 int
941 spdk_vhost_scsi_dev_add_tgt(struct spdk_vhost_dev *vdev, unsigned scsi_tgt_num,
942 			    const char *bdev_name)
943 {
944 	struct spdk_vhost_scsi_dev *svdev;
945 	struct spdk_scsi_dev_vhost_state *state;
946 	char target_name[SPDK_SCSI_DEV_MAX_NAME];
947 	int lun_id_list[1];
948 	const char *bdev_names_list[1];
949 
950 	svdev = to_scsi_dev(vdev);
951 	if (svdev == NULL) {
952 		return -EINVAL;
953 	}
954 
955 	if (scsi_tgt_num >= SPDK_VHOST_SCSI_CTRLR_MAX_DEVS) {
956 		SPDK_ERRLOG("Controller %d target number too big (max %d)\n", scsi_tgt_num,
957 			    SPDK_VHOST_SCSI_CTRLR_MAX_DEVS);
958 		return -EINVAL;
959 	}
960 
961 	if (bdev_name == NULL) {
962 		SPDK_ERRLOG("No lun name specified\n");
963 		return -EINVAL;
964 	}
965 
966 	state = &svdev->scsi_dev_state[scsi_tgt_num];
967 	if (state->dev != NULL) {
968 		SPDK_ERRLOG("Controller %s target %u already occupied\n", vdev->name, scsi_tgt_num);
969 		return -EEXIST;
970 	}
971 
972 	/*
973 	 * At this stage only one LUN per target
974 	 */
975 	snprintf(target_name, sizeof(target_name), "Target %u", scsi_tgt_num);
976 	lun_id_list[0] = 0;
977 	bdev_names_list[0] = (char *)bdev_name;
978 
979 	state->removed = false;
980 	state->dev = spdk_scsi_dev_construct(target_name, bdev_names_list, lun_id_list, 1,
981 					     SPDK_SPC_PROTOCOL_IDENTIFIER_SAS,
982 					     spdk_vhost_scsi_lun_hotremove, svdev);
983 
984 	if (state->dev == NULL) {
985 		SPDK_ERRLOG("Couldn't create spdk SCSI target '%s' using bdev '%s' in controller: %s\n",
986 			    target_name, bdev_name, vdev->name);
987 		return -EINVAL;
988 	}
989 	spdk_scsi_dev_add_port(state->dev, 0, "vhost");
990 
991 	SPDK_INFOLOG(SPDK_LOG_VHOST, "Controller %s: defined target '%s' using bdev '%s'\n",
992 		     vdev->name, target_name, bdev_name);
993 
994 	spdk_vhost_dev_foreach_session(vdev, spdk_vhost_scsi_session_add_tgt,
995 				       (void *)(uintptr_t)scsi_tgt_num);
996 	return 0;
997 }
998 
999 static int
1000 spdk_vhost_scsi_session_remove_tgt(struct spdk_vhost_dev *vdev,
1001 				   struct spdk_vhost_session *vsession, void *ctx)
1002 {
1003 	unsigned scsi_tgt_num = (unsigned)(uintptr_t)ctx;
1004 	struct spdk_vhost_scsi_session *svsession;
1005 	struct spdk_scsi_dev_vhost_state *state;
1006 	int rc = 0;
1007 
1008 	if (vsession == NULL) {
1009 		struct spdk_vhost_scsi_dev *svdev = SPDK_CONTAINEROF(vdev,
1010 						    struct spdk_vhost_scsi_dev, vdev);
1011 
1012 		if (vdev->active_session_num == 0) {
1013 			/* there aren't any active sessions, so remove the dev and exit */
1014 			rc = remove_scsi_tgt(svdev, scsi_tgt_num);
1015 		}
1016 		return rc;
1017 	}
1018 
1019 	/* Mark the target for removal */
1020 	svsession = (struct spdk_vhost_scsi_session *)vsession;
1021 	state = &svsession->scsi_dev_state[scsi_tgt_num];
1022 	assert(!state->removed);
1023 	state->removed = true;
1024 
1025 	/* If the session isn't currently polled, unset the dev straight away */
1026 	if (vsession->lcore == -1) {
1027 		state->dev = NULL;
1028 		return 0;
1029 	}
1030 
1031 	/* Otherwise, send a hotremove Virtio event and wait for the session's
1032 	 * management poller to remove the target after all its pending I/O
1033 	 * has finished.
1034 	 */
1035 	if (spdk_vhost_dev_has_feature(vsession, VIRTIO_SCSI_F_HOTPLUG)) {
1036 		eventq_enqueue(svsession, scsi_tgt_num,
1037 			       VIRTIO_SCSI_T_TRANSPORT_RESET, VIRTIO_SCSI_EVT_RESET_REMOVED);
1038 	}
1039 
1040 	return 0;
1041 }
1042 
1043 int
1044 spdk_vhost_scsi_dev_remove_tgt(struct spdk_vhost_dev *vdev, unsigned scsi_tgt_num,
1045 			       spdk_vhost_event_fn cb_fn, void *cb_arg)
1046 {
1047 	struct spdk_vhost_scsi_dev *svdev;
1048 	struct spdk_scsi_dev_vhost_state *scsi_dev_state;
1049 
1050 	if (scsi_tgt_num >= SPDK_VHOST_SCSI_CTRLR_MAX_DEVS) {
1051 		SPDK_ERRLOG("%s: invalid target number %d\n", vdev->name, scsi_tgt_num);
1052 		return -EINVAL;
1053 	}
1054 
1055 	svdev = to_scsi_dev(vdev);
1056 	if (svdev == NULL) {
1057 		return -ENODEV;
1058 	}
1059 
1060 	scsi_dev_state = &svdev->scsi_dev_state[scsi_tgt_num];
1061 	if (scsi_dev_state->dev == NULL) {
1062 		SPDK_ERRLOG("Controller %s target %u is not occupied\n", vdev->name, scsi_tgt_num);
1063 		return -ENODEV;
1064 	}
1065 
1066 	if (scsi_dev_state->removed) {
1067 		SPDK_WARNLOG("%s: 'Target %u' has been already marked to hotremove.\n",
1068 			     vdev->name, scsi_tgt_num);
1069 		return -EBUSY;
1070 	}
1071 
1072 	scsi_dev_state->remove_cb = cb_fn;
1073 	scsi_dev_state->remove_ctx = cb_arg;
1074 	scsi_dev_state->removed = true;
1075 
1076 	spdk_vhost_dev_foreach_session(vdev, spdk_vhost_scsi_session_remove_tgt,
1077 				       (void *)(uintptr_t)scsi_tgt_num);
1078 	return 0;
1079 }
1080 
1081 int
1082 spdk_vhost_scsi_controller_construct(void)
1083 {
1084 	struct spdk_conf_section *sp = spdk_conf_first_section(NULL);
1085 	struct spdk_vhost_dev *vdev;
1086 	int i, dev_num;
1087 	unsigned ctrlr_num = 0;
1088 	char *bdev_name, *tgt_num_str;
1089 	char *cpumask;
1090 	char *name;
1091 	char *tgt = NULL;
1092 
1093 	while (sp != NULL) {
1094 		if (!spdk_conf_section_match_prefix(sp, "VhostScsi")) {
1095 			sp = spdk_conf_next_section(sp);
1096 			continue;
1097 		}
1098 
1099 		if (sscanf(spdk_conf_section_get_name(sp), "VhostScsi%u", &ctrlr_num) != 1) {
1100 			SPDK_ERRLOG("Section '%s' has non-numeric suffix.\n",
1101 				    spdk_conf_section_get_name(sp));
1102 			return -1;
1103 		}
1104 
1105 		name =  spdk_conf_section_get_val(sp, "Name");
1106 		cpumask = spdk_conf_section_get_val(sp, "Cpumask");
1107 
1108 		if (spdk_vhost_scsi_dev_construct(name, cpumask) < 0) {
1109 			return -1;
1110 		}
1111 
1112 		vdev = spdk_vhost_dev_find(name);
1113 		assert(vdev);
1114 
1115 		for (i = 0; ; i++) {
1116 
1117 			tgt = spdk_conf_section_get_nval(sp, "Target", i);
1118 			if (tgt == NULL) {
1119 				break;
1120 			}
1121 
1122 			tgt_num_str = spdk_conf_section_get_nmval(sp, "Target", i, 0);
1123 			if (tgt_num_str == NULL) {
1124 				SPDK_ERRLOG("%s: Invalid or missing target number\n", name);
1125 				return -1;
1126 			}
1127 
1128 			dev_num = (int)strtol(tgt_num_str, NULL, 10);
1129 			bdev_name = spdk_conf_section_get_nmval(sp, "Target", i, 1);
1130 			if (bdev_name == NULL) {
1131 				SPDK_ERRLOG("%s: Invalid or missing bdev name for target %d\n", name, dev_num);
1132 				return -1;
1133 			} else if (spdk_conf_section_get_nmval(sp, "Target", i, 2)) {
1134 				SPDK_ERRLOG("%s: Only one LUN per vhost SCSI device supported\n", name);
1135 				return -1;
1136 			}
1137 
1138 			if (spdk_vhost_scsi_dev_add_tgt(vdev, dev_num, bdev_name) < 0) {
1139 				return -1;
1140 			}
1141 		}
1142 
1143 		sp = spdk_conf_next_section(sp);
1144 	}
1145 
1146 	return 0;
1147 }
1148 
1149 static void
1150 free_task_pool(struct spdk_vhost_scsi_session *svsession)
1151 {
1152 	struct spdk_vhost_session *vsession = &svsession->vsession;
1153 	struct spdk_vhost_virtqueue *vq;
1154 	uint16_t i;
1155 
1156 	for (i = 0; i < vsession->max_queues; i++) {
1157 		vq = &vsession->virtqueue[i];
1158 		if (vq->tasks == NULL) {
1159 			continue;
1160 		}
1161 
1162 		spdk_dma_free(vq->tasks);
1163 		vq->tasks = NULL;
1164 	}
1165 }
1166 
1167 static int
1168 alloc_task_pool(struct spdk_vhost_scsi_session *svsession)
1169 {
1170 	struct spdk_vhost_session *vsession = &svsession->vsession;
1171 	struct spdk_vhost_scsi_dev *svdev = svsession->svdev;
1172 	struct spdk_vhost_virtqueue *vq;
1173 	struct spdk_vhost_scsi_task *task;
1174 	uint32_t task_cnt;
1175 	uint16_t i;
1176 	uint32_t j;
1177 
1178 	for (i = 0; i < vsession->max_queues; i++) {
1179 		vq = &vsession->virtqueue[i];
1180 		if (vq->vring.desc == NULL) {
1181 			continue;
1182 		}
1183 
1184 		task_cnt = vq->vring.size;
1185 		if (task_cnt > SPDK_VHOST_MAX_VQ_SIZE) {
1186 			/* sanity check */
1187 			SPDK_ERRLOG("Controller %s: virtuque %"PRIu16" is too big. (size = %"PRIu32", max = %"PRIu32")\n",
1188 				    svdev->vdev.name, i, task_cnt, SPDK_VHOST_MAX_VQ_SIZE);
1189 			free_task_pool(svsession);
1190 			return -1;
1191 		}
1192 		vq->tasks = spdk_dma_zmalloc(sizeof(struct spdk_vhost_scsi_task) * task_cnt,
1193 					     SPDK_CACHE_LINE_SIZE, NULL);
1194 		if (vq->tasks == NULL) {
1195 			SPDK_ERRLOG("Controller %s: failed to allocate %"PRIu32" tasks for virtqueue %"PRIu16"\n",
1196 				    svdev->vdev.name, task_cnt, i);
1197 			free_task_pool(svsession);
1198 			return -1;
1199 		}
1200 
1201 		for (j = 0; j < task_cnt; j++) {
1202 			task = &((struct spdk_vhost_scsi_task *)vq->tasks)[j];
1203 			task->svsession = svsession;
1204 			task->vq = vq;
1205 			task->req_idx = j;
1206 		}
1207 	}
1208 
1209 	return 0;
1210 }
1211 
1212 static int
1213 spdk_vhost_scsi_start_cb(struct spdk_vhost_dev *vdev,
1214 			 struct spdk_vhost_session *vsession, void *event_ctx)
1215 {
1216 	struct spdk_vhost_scsi_dev *svdev;
1217 	struct spdk_vhost_scsi_session *svsession;
1218 	struct spdk_scsi_dev_vhost_state *state;
1219 	uint32_t i;
1220 	int rc;
1221 
1222 	svsession = to_scsi_session(vsession);
1223 	assert(svsession != NULL);
1224 	svdev = svsession->svdev;
1225 
1226 	/* validate all I/O queues are in a contiguous index range */
1227 	for (i = VIRTIO_SCSI_REQUESTQ; i < vsession->max_queues; i++) {
1228 		if (vsession->virtqueue[i].vring.desc == NULL) {
1229 			SPDK_ERRLOG("%s: queue %"PRIu32" is empty\n", vsession->vdev->name, i);
1230 			rc = -1;
1231 			goto out;
1232 		}
1233 	}
1234 
1235 	rc = alloc_task_pool(svsession);
1236 	if (rc != 0) {
1237 		SPDK_ERRLOG("%s: failed to alloc task pool.\n", vdev->name);
1238 		goto out;
1239 	}
1240 
1241 	for (i = 0; i < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS; i++) {
1242 		state = &svdev->scsi_dev_state[i];
1243 		if (state->dev == NULL) {
1244 			continue;
1245 		}
1246 		svsession->scsi_dev_state[i] = *state;
1247 		spdk_scsi_dev_allocate_io_channels(state->dev);
1248 	}
1249 	SPDK_INFOLOG(SPDK_LOG_VHOST, "Started poller for vhost controller %s on lcore %d\n",
1250 		     vdev->name, vsession->lcore);
1251 
1252 	svsession->requestq_poller = spdk_poller_register(vdev_worker, svsession, 0);
1253 	if (vsession->virtqueue[VIRTIO_SCSI_CONTROLQ].vring.desc &&
1254 	    vsession->virtqueue[VIRTIO_SCSI_EVENTQ].vring.desc) {
1255 		svsession->mgmt_poller = spdk_poller_register(vdev_mgmt_worker, svsession,
1256 					 MGMT_POLL_PERIOD_US);
1257 	}
1258 out:
1259 	spdk_vhost_session_event_done(event_ctx, rc);
1260 	return rc;
1261 }
1262 
1263 static int
1264 spdk_vhost_scsi_start(struct spdk_vhost_session *vsession)
1265 {
1266 	struct spdk_vhost_scsi_session *svsession;
1267 	struct spdk_vhost_scsi_dev *svdev;
1268 	int rc;
1269 
1270 	svsession = to_scsi_session(vsession);
1271 	if (svsession == NULL) {
1272 		SPDK_ERRLOG("Trying to start non-scsi session as a scsi one.\n");
1273 		return -1;
1274 	}
1275 
1276 	svdev = to_scsi_dev(vsession->vdev);
1277 	assert(svdev != NULL);
1278 	svsession->svdev = svdev;
1279 
1280 	if (svdev->vdev.active_session_num == 0) {
1281 		svdev->lcore = spdk_vhost_allocate_reactor(svdev->vdev.cpumask);
1282 	}
1283 
1284 	vsession->lcore = svdev->lcore;
1285 	rc = spdk_vhost_session_send_event(vsession, spdk_vhost_scsi_start_cb,
1286 					   3, "start session");
1287 	if (rc != 0) {
1288 		vsession->lcore = -1;
1289 
1290 		if (svdev->vdev.active_session_num == 0) {
1291 			spdk_vhost_free_reactor(svdev->lcore);
1292 			svdev->lcore = -1;
1293 		}
1294 	}
1295 
1296 	return rc;
1297 }
1298 
1299 static int
1300 destroy_session_poller_cb(void *arg)
1301 {
1302 	struct spdk_vhost_scsi_session *svsession = arg;
1303 	struct spdk_vhost_session *vsession = &svsession->vsession;
1304 	uint32_t i;
1305 
1306 	if (vsession->task_cnt > 0) {
1307 		return -1;
1308 	}
1309 
1310 
1311 	for (i = 0; i < vsession->max_queues; i++) {
1312 		spdk_vhost_vq_used_signal(vsession, &vsession->virtqueue[i]);
1313 	}
1314 
1315 	for (i = 0; i < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS; i++) {
1316 		if (svsession->scsi_dev_state[i].dev == NULL) {
1317 			continue;
1318 		}
1319 
1320 		spdk_scsi_dev_free_io_channels(svsession->scsi_dev_state[i].dev);
1321 	}
1322 
1323 	SPDK_INFOLOG(SPDK_LOG_VHOST, "Stopping poller for vhost controller %s\n",
1324 		     svsession->svdev->vdev.name);
1325 
1326 	free_task_pool(svsession);
1327 
1328 	spdk_poller_unregister(&svsession->destroy_ctx.poller);
1329 	spdk_vhost_session_event_done(svsession->destroy_ctx.event_ctx, 0);
1330 
1331 	return -1;
1332 }
1333 
1334 static int
1335 spdk_vhost_scsi_stop_cb(struct spdk_vhost_dev *vdev,
1336 			struct spdk_vhost_session *vsession, void *event_ctx)
1337 {
1338 	struct spdk_vhost_scsi_session *svsession;
1339 
1340 	svsession = to_scsi_session(vsession);
1341 	assert(svsession != NULL);
1342 	svsession->destroy_ctx.event_ctx = event_ctx;
1343 	spdk_poller_unregister(&svsession->requestq_poller);
1344 	spdk_poller_unregister(&svsession->mgmt_poller);
1345 	svsession->destroy_ctx.poller = spdk_poller_register(destroy_session_poller_cb,
1346 					svsession, 1000);
1347 
1348 	return 0;
1349 }
1350 
1351 static int
1352 spdk_vhost_scsi_stop(struct spdk_vhost_session *vsession)
1353 {
1354 	struct spdk_vhost_scsi_session *svsession;
1355 	int rc;
1356 
1357 	svsession = to_scsi_session(vsession);
1358 	if (svsession == NULL) {
1359 		SPDK_ERRLOG("Trying to stop non-scsi session as a scsi one.\n");
1360 		return -1;
1361 	}
1362 	rc = spdk_vhost_session_send_event(vsession, spdk_vhost_scsi_stop_cb,
1363 					   3, "stop session");
1364 	if (rc != 0) {
1365 		return rc;
1366 	}
1367 
1368 	vsession->lcore = -1;
1369 	if (vsession->vdev->active_session_num == 1) {
1370 		spdk_vhost_free_reactor(svsession->svdev->lcore);
1371 		svsession->svdev->lcore = -1;
1372 	}
1373 	return 0;
1374 }
1375 
1376 static void
1377 spdk_vhost_scsi_dump_info_json(struct spdk_vhost_dev *vdev, struct spdk_json_write_ctx *w)
1378 {
1379 	struct spdk_scsi_dev *sdev;
1380 	struct spdk_scsi_lun *lun;
1381 	uint32_t dev_idx;
1382 	uint32_t lun_idx;
1383 
1384 	assert(vdev != NULL);
1385 	spdk_json_write_name(w, "scsi");
1386 	spdk_json_write_array_begin(w);
1387 	for (dev_idx = 0; dev_idx < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS; dev_idx++) {
1388 		sdev = spdk_vhost_scsi_dev_get_tgt(vdev, dev_idx);
1389 		if (!sdev) {
1390 			continue;
1391 		}
1392 
1393 		spdk_json_write_object_begin(w);
1394 
1395 		spdk_json_write_name(w, "scsi_dev_num");
1396 		spdk_json_write_uint32(w, dev_idx);
1397 
1398 		spdk_json_write_name(w, "id");
1399 		spdk_json_write_int32(w, spdk_scsi_dev_get_id(sdev));
1400 
1401 		spdk_json_write_name(w, "target_name");
1402 		spdk_json_write_string(w, spdk_scsi_dev_get_name(sdev));
1403 
1404 		spdk_json_write_name(w, "luns");
1405 		spdk_json_write_array_begin(w);
1406 
1407 		for (lun_idx = 0; lun_idx < SPDK_SCSI_DEV_MAX_LUN; lun_idx++) {
1408 			lun = spdk_scsi_dev_get_lun(sdev, lun_idx);
1409 			if (!lun) {
1410 				continue;
1411 			}
1412 
1413 			spdk_json_write_object_begin(w);
1414 
1415 			spdk_json_write_name(w, "id");
1416 			spdk_json_write_int32(w, spdk_scsi_lun_get_id(lun));
1417 
1418 			spdk_json_write_name(w, "bdev_name");
1419 			spdk_json_write_string(w, spdk_scsi_lun_get_bdev_name(lun));
1420 
1421 			spdk_json_write_object_end(w);
1422 		}
1423 
1424 		spdk_json_write_array_end(w);
1425 		spdk_json_write_object_end(w);
1426 	}
1427 
1428 	spdk_json_write_array_end(w);
1429 }
1430 
1431 static void
1432 spdk_vhost_scsi_write_config_json(struct spdk_vhost_dev *vdev, struct spdk_json_write_ctx *w)
1433 {
1434 	struct spdk_vhost_scsi_dev *svdev;
1435 	struct spdk_scsi_lun *lun;
1436 	uint32_t i;
1437 
1438 	svdev = to_scsi_dev(vdev);
1439 	if (!svdev) {
1440 		return;
1441 	}
1442 
1443 	spdk_json_write_object_begin(w);
1444 	spdk_json_write_named_string(w, "method", "construct_vhost_scsi_controller");
1445 
1446 	spdk_json_write_named_object_begin(w, "params");
1447 	spdk_json_write_named_string(w, "ctrlr", vdev->name);
1448 	spdk_json_write_named_string(w, "cpumask", spdk_cpuset_fmt(vdev->cpumask));
1449 	spdk_json_write_object_end(w);
1450 
1451 	spdk_json_write_object_end(w);
1452 
1453 	for (i = 0; i < SPDK_COUNTOF(svdev->scsi_dev_state); i++) {
1454 		if (svdev->scsi_dev_state[i].dev == NULL || svdev->scsi_dev_state[i].removed) {
1455 			continue;
1456 		}
1457 
1458 		lun = spdk_scsi_dev_get_lun(svdev->scsi_dev_state[i].dev, 0);
1459 
1460 		spdk_json_write_object_begin(w);
1461 		spdk_json_write_named_string(w, "method", "add_vhost_scsi_lun");
1462 
1463 		spdk_json_write_named_object_begin(w, "params");
1464 		spdk_json_write_named_string(w, "ctrlr", vdev->name);
1465 		spdk_json_write_named_uint32(w, "scsi_target_num", i);
1466 
1467 		spdk_json_write_named_string(w, "bdev_name", spdk_scsi_lun_get_bdev_name(lun));
1468 		spdk_json_write_object_end(w);
1469 
1470 		spdk_json_write_object_end(w);
1471 	}
1472 }
1473 
1474 SPDK_LOG_REGISTER_COMPONENT("vhost_scsi", SPDK_LOG_VHOST_SCSI)
1475 SPDK_LOG_REGISTER_COMPONENT("vhost_scsi_queue", SPDK_LOG_VHOST_SCSI_QUEUE)
1476 SPDK_LOG_REGISTER_COMPONENT("vhost_scsi_data", SPDK_LOG_VHOST_SCSI_DATA)
1477