xref: /spdk/lib/vhost/vhost_scsi.c (revision cfb65ba61180ae80899756239e08f4656866beb3)
1 /*-
2  *   BSD LICENSE
3  *
4  *   Copyright(c) Intel Corporation. All rights reserved.
5  *   All rights reserved.
6  *
7  *   Redistribution and use in source and binary forms, with or without
8  *   modification, are permitted provided that the following conditions
9  *   are met:
10  *
11  *     * Redistributions of source code must retain the above copyright
12  *       notice, this list of conditions and the following disclaimer.
13  *     * Redistributions in binary form must reproduce the above copyright
14  *       notice, this list of conditions and the following disclaimer in
15  *       the documentation and/or other materials provided with the
16  *       distribution.
17  *     * Neither the name of Intel Corporation nor the names of its
18  *       contributors may be used to endorse or promote products derived
19  *       from this software without specific prior written permission.
20  *
21  *   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
22  *   "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
23  *   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
24  *   A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
25  *   OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
26  *   SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
27  *   LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
28  *   DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
29  *   THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
30  *   (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
31  *   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
32  */
33 
34 #include "spdk/stdinc.h"
35 
36 #include <linux/virtio_scsi.h>
37 
38 #include "spdk/env.h"
39 #include "spdk/thread.h"
40 #include "spdk/scsi.h"
41 #include "spdk/scsi_spec.h"
42 #include "spdk/conf.h"
43 #include "spdk/event.h"
44 #include "spdk/util.h"
45 #include "spdk/likely.h"
46 
47 #include "spdk/vhost.h"
48 #include "vhost_internal.h"
49 
50 /* Features supported by SPDK VHOST lib. */
51 #define SPDK_VHOST_SCSI_FEATURES	(SPDK_VHOST_FEATURES | \
52 					(1ULL << VIRTIO_SCSI_F_INOUT) | \
53 					(1ULL << VIRTIO_SCSI_F_HOTPLUG) | \
54 					(1ULL << VIRTIO_SCSI_F_CHANGE ) | \
55 					(1ULL << VIRTIO_SCSI_F_T10_PI ))
56 
57 /* Features that are specified in VIRTIO SCSI but currently not supported:
58  * - Live migration not supported yet
59  * - T10 PI
60  */
61 #define SPDK_VHOST_SCSI_DISABLED_FEATURES	(SPDK_VHOST_DISABLED_FEATURES | \
62 						(1ULL << VIRTIO_SCSI_F_T10_PI ))
63 
64 #define MGMT_POLL_PERIOD_US (1000 * 5)
65 
66 #define VIRTIO_SCSI_CONTROLQ   0
67 #define VIRTIO_SCSI_EVENTQ   1
68 #define VIRTIO_SCSI_REQUESTQ   2
69 
70 enum spdk_scsi_dev_vhost_status {
71 	/* Target ID is empty. */
72 	VHOST_SCSI_DEV_EMPTY,
73 
74 	/* Target is still being added. */
75 	VHOST_SCSI_DEV_ADDING,
76 
77 	/* Target ID occupied. */
78 	VHOST_SCSI_DEV_PRESENT,
79 
80 	/* Target ID is occupied but removal is in progress. */
81 	VHOST_SCSI_DEV_REMOVING,
82 
83 	/* In session - device (SCSI target) seen but removed. */
84 	VHOST_SCSI_DEV_REMOVED,
85 };
86 
87 /** Context for a SCSI target in a vhost device */
88 struct spdk_scsi_dev_vhost_state {
89 	struct spdk_scsi_dev *dev;
90 	enum spdk_scsi_dev_vhost_status status;
91 	spdk_vhost_event_fn remove_cb;
92 	void *remove_ctx;
93 };
94 
95 struct spdk_vhost_scsi_dev {
96 	int ref;
97 	bool registered;
98 	struct spdk_vhost_dev vdev;
99 	struct spdk_scsi_dev_vhost_state scsi_dev_state[SPDK_VHOST_SCSI_CTRLR_MAX_DEVS];
100 };
101 
102 /** Context for a SCSI target in a vhost session */
103 struct spdk_scsi_dev_session_state {
104 	struct spdk_scsi_dev *dev;
105 	enum spdk_scsi_dev_vhost_status status;
106 };
107 
108 struct spdk_vhost_scsi_session {
109 	struct spdk_vhost_session vsession;
110 
111 	struct spdk_vhost_scsi_dev *svdev;
112 	/** Local copy of the device state */
113 	struct spdk_scsi_dev_session_state scsi_dev_state[SPDK_VHOST_SCSI_CTRLR_MAX_DEVS];
114 	struct spdk_poller *requestq_poller;
115 	struct spdk_poller *mgmt_poller;
116 	struct spdk_poller *stop_poller;
117 };
118 
119 struct spdk_vhost_scsi_task {
120 	struct spdk_scsi_task	scsi;
121 	struct iovec iovs[SPDK_VHOST_IOVS_MAX];
122 
123 	union {
124 		struct virtio_scsi_cmd_resp *resp;
125 		struct virtio_scsi_ctrl_tmf_resp *tmf_resp;
126 	};
127 
128 	struct spdk_vhost_scsi_session *svsession;
129 	struct spdk_scsi_dev *scsi_dev;
130 
131 	/** Number of bytes that were written. */
132 	uint32_t used_len;
133 
134 	int req_idx;
135 
136 	/* If set, the task is currently used for I/O processing. */
137 	bool used;
138 
139 	struct spdk_vhost_virtqueue *vq;
140 };
141 
142 static int vhost_scsi_start(struct spdk_vhost_session *vsession);
143 static int vhost_scsi_stop(struct spdk_vhost_session *vsession);
144 static void vhost_scsi_dump_info_json(struct spdk_vhost_dev *vdev,
145 				      struct spdk_json_write_ctx *w);
146 static void vhost_scsi_write_config_json(struct spdk_vhost_dev *vdev,
147 		struct spdk_json_write_ctx *w);
148 static int vhost_scsi_dev_remove(struct spdk_vhost_dev *vdev);
149 
150 const struct spdk_vhost_dev_backend spdk_vhost_scsi_device_backend = {
151 	.session_ctx_size = sizeof(struct spdk_vhost_scsi_session) - sizeof(struct spdk_vhost_session),
152 	.start_session =  vhost_scsi_start,
153 	.stop_session = vhost_scsi_stop,
154 	.dump_info_json = vhost_scsi_dump_info_json,
155 	.write_config_json = vhost_scsi_write_config_json,
156 	.remove_device = vhost_scsi_dev_remove,
157 };
158 
159 static inline void
160 scsi_task_init(struct spdk_vhost_scsi_task *task)
161 {
162 	memset(&task->scsi, 0, sizeof(task->scsi));
163 	/* Tmf_resp pointer and resp pointer are in a union.
164 	 * Here means task->tmf_resp = task->resp = NULL.
165 	 */
166 	task->resp = NULL;
167 	task->used = true;
168 	task->used_len = 0;
169 }
170 
171 static void
172 vhost_scsi_task_put(struct spdk_vhost_scsi_task *task)
173 {
174 	spdk_scsi_task_put(&task->scsi);
175 }
176 
177 static void
178 vhost_scsi_task_free_cb(struct spdk_scsi_task *scsi_task)
179 {
180 	struct spdk_vhost_scsi_task *task = SPDK_CONTAINEROF(scsi_task, struct spdk_vhost_scsi_task, scsi);
181 	struct spdk_vhost_session *vsession = &task->svsession->vsession;
182 
183 	assert(vsession->task_cnt > 0);
184 	vsession->task_cnt--;
185 	task->used = false;
186 }
187 
188 static void
189 remove_scsi_tgt(struct spdk_vhost_scsi_dev *svdev,
190 		unsigned scsi_tgt_num)
191 {
192 	struct spdk_scsi_dev_vhost_state *state;
193 	struct spdk_scsi_dev *dev;
194 
195 	state = &svdev->scsi_dev_state[scsi_tgt_num];
196 	dev = state->dev;
197 	state->dev = NULL;
198 	assert(state->status == VHOST_SCSI_DEV_REMOVING);
199 	state->status = VHOST_SCSI_DEV_EMPTY;
200 	spdk_scsi_dev_destruct(dev, NULL, NULL);
201 	if (state->remove_cb) {
202 		state->remove_cb(&svdev->vdev, state->remove_ctx);
203 		state->remove_cb = NULL;
204 	}
205 	SPDK_INFOLOG(SPDK_LOG_VHOST, "%s: removed target 'Target %u'\n",
206 		     svdev->vdev.name, scsi_tgt_num);
207 
208 	if (--svdev->ref == 0 && svdev->registered == false) {
209 		free(svdev);
210 	}
211 }
212 
213 static void
214 vhost_scsi_dev_process_removed_cpl_cb(struct spdk_vhost_dev *vdev, void *ctx)
215 {
216 	unsigned scsi_tgt_num = (unsigned)(uintptr_t)ctx;
217 	struct spdk_vhost_scsi_dev *svdev = SPDK_CONTAINEROF(vdev,
218 					    struct spdk_vhost_scsi_dev, vdev);
219 
220 	/* all sessions have already detached the device */
221 	if (svdev->scsi_dev_state[scsi_tgt_num].status != VHOST_SCSI_DEV_REMOVING) {
222 		/* device was already removed in the meantime */
223 		return;
224 	}
225 
226 	remove_scsi_tgt(svdev, scsi_tgt_num);
227 }
228 
229 static int
230 vhost_scsi_session_process_removed(struct spdk_vhost_dev *vdev,
231 				   struct spdk_vhost_session *vsession, void *ctx)
232 {
233 	unsigned scsi_tgt_num = (unsigned)(uintptr_t)ctx;
234 	struct spdk_vhost_scsi_session *svsession = (struct spdk_vhost_scsi_session *)vsession;
235 	struct spdk_scsi_dev_session_state *state = &svsession->scsi_dev_state[scsi_tgt_num];
236 
237 	if (state->dev != NULL) {
238 		/* there's still a session that references this device,
239 		 * so abort our foreach chain here. We'll be called
240 		 * again from this session's management poller after it
241 		 * is removed in there
242 		 */
243 		return -1;
244 	}
245 
246 	return 0;
247 }
248 
249 static void
250 process_removed_devs(struct spdk_vhost_scsi_session *svsession)
251 {
252 	struct spdk_scsi_dev *dev;
253 	struct spdk_scsi_dev_session_state *state;
254 	int i;
255 
256 	for (i = 0; i < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS; ++i) {
257 		state = &svsession->scsi_dev_state[i];
258 		dev = state->dev;
259 
260 		if (dev && state->status == VHOST_SCSI_DEV_REMOVING &&
261 		    !spdk_scsi_dev_has_pending_tasks(dev, NULL)) {
262 			/* detach the device from this session */
263 			spdk_scsi_dev_free_io_channels(dev);
264 			state->dev = NULL;
265 			state->status = VHOST_SCSI_DEV_REMOVED;
266 			/* try to detach it globally */
267 			spdk_vhost_lock();
268 			vhost_dev_foreach_session(&svsession->svdev->vdev,
269 						  vhost_scsi_session_process_removed,
270 						  vhost_scsi_dev_process_removed_cpl_cb,
271 						  (void *)(uintptr_t)i);
272 			spdk_vhost_unlock();
273 		}
274 	}
275 }
276 
277 static void
278 eventq_enqueue(struct spdk_vhost_scsi_session *svsession, unsigned scsi_dev_num,
279 	       uint32_t event, uint32_t reason)
280 {
281 	struct spdk_vhost_session *vsession = &svsession->vsession;
282 	struct spdk_vhost_virtqueue *vq;
283 	struct vring_desc *desc, *desc_table;
284 	struct virtio_scsi_event *desc_ev;
285 	uint32_t desc_table_size, req_size = 0;
286 	uint16_t req;
287 	int rc;
288 
289 	assert(scsi_dev_num < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS);
290 	vq = &vsession->virtqueue[VIRTIO_SCSI_EVENTQ];
291 
292 	if (vq->vring.desc == NULL || vhost_vq_avail_ring_get(vq, &req, 1) != 1) {
293 		SPDK_ERRLOG("%s: failed to send virtio event (no avail ring entries?).\n",
294 			    vsession->name);
295 		return;
296 	}
297 
298 	rc = vhost_vq_get_desc(vsession, vq, req, &desc, &desc_table, &desc_table_size);
299 	if (rc != 0 || desc->len < sizeof(*desc_ev)) {
300 		SPDK_ERRLOG("%s: invalid eventq descriptor at index %"PRIu16".\n",
301 			    vsession->name, req);
302 		goto out;
303 	}
304 
305 	desc_ev = vhost_gpa_to_vva(vsession, desc->addr, sizeof(*desc_ev));
306 	if (desc_ev == NULL) {
307 		SPDK_ERRLOG("%s: eventq descriptor at index %"PRIu16" points "
308 			    "to unmapped guest memory address %p.\n",
309 			    vsession->name, req, (void *)(uintptr_t)desc->addr);
310 		goto out;
311 	}
312 
313 	desc_ev->event = event;
314 	desc_ev->lun[0] = 1;
315 	desc_ev->lun[1] = scsi_dev_num;
316 	/* virtio LUN id 0 can refer either to the entire device
317 	 * or actual LUN 0 (the only supported by vhost for now)
318 	 */
319 	desc_ev->lun[2] = 0 >> 8;
320 	desc_ev->lun[3] = 0 & 0xFF;
321 	/* virtio doesn't specify any strict format for LUN id (bytes 2 and 3)
322 	 * current implementation relies on linux kernel sources
323 	 */
324 	memset(&desc_ev->lun[4], 0, 4);
325 	desc_ev->reason = reason;
326 	req_size = sizeof(*desc_ev);
327 
328 out:
329 	vhost_vq_used_ring_enqueue(vsession, vq, req, req_size);
330 }
331 
332 static void
333 submit_completion(struct spdk_vhost_scsi_task *task)
334 {
335 	struct spdk_vhost_session *vsession = &task->svsession->vsession;
336 
337 	vhost_vq_used_ring_enqueue(vsession, task->vq, task->req_idx,
338 				   task->used_len);
339 	SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI, "Finished task (%p) req_idx=%d\n", task, task->req_idx);
340 
341 	vhost_scsi_task_put(task);
342 }
343 
344 static void
345 vhost_scsi_task_mgmt_cpl(struct spdk_scsi_task *scsi_task)
346 {
347 	struct spdk_vhost_scsi_task *task = SPDK_CONTAINEROF(scsi_task, struct spdk_vhost_scsi_task, scsi);
348 
349 	submit_completion(task);
350 }
351 
352 static void
353 vhost_scsi_task_cpl(struct spdk_scsi_task *scsi_task)
354 {
355 	struct spdk_vhost_scsi_task *task = SPDK_CONTAINEROF(scsi_task, struct spdk_vhost_scsi_task, scsi);
356 
357 	/* The SCSI task has completed.  Do final processing and then post
358 	   notification to the virtqueue's "used" ring.
359 	 */
360 	task->resp->status = task->scsi.status;
361 
362 	if (task->scsi.status != SPDK_SCSI_STATUS_GOOD) {
363 		memcpy(task->resp->sense, task->scsi.sense_data, task->scsi.sense_data_len);
364 		task->resp->sense_len = task->scsi.sense_data_len;
365 		SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI, "Task (%p) req_idx=%d failed - status=%u\n", task, task->req_idx,
366 			      task->scsi.status);
367 	}
368 	assert(task->scsi.transfer_len == task->scsi.length);
369 	task->resp->resid = task->scsi.length - task->scsi.data_transferred;
370 
371 	submit_completion(task);
372 }
373 
374 static void
375 task_submit(struct spdk_vhost_scsi_task *task)
376 {
377 	task->resp->response = VIRTIO_SCSI_S_OK;
378 	spdk_scsi_dev_queue_task(task->scsi_dev, &task->scsi);
379 }
380 
381 static void
382 mgmt_task_submit(struct spdk_vhost_scsi_task *task, enum spdk_scsi_task_func func)
383 {
384 	task->tmf_resp->response = VIRTIO_SCSI_S_OK;
385 	task->scsi.function = func;
386 	spdk_scsi_dev_queue_mgmt_task(task->scsi_dev, &task->scsi);
387 }
388 
389 static void
390 invalid_request(struct spdk_vhost_scsi_task *task)
391 {
392 	struct spdk_vhost_session *vsession = &task->svsession->vsession;
393 
394 	vhost_vq_used_ring_enqueue(vsession, task->vq, task->req_idx,
395 				   task->used_len);
396 	vhost_scsi_task_put(task);
397 
398 	SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI, "Invalid request (status=%" PRIu8")\n",
399 		      task->resp ? task->resp->response : -1);
400 }
401 
402 static int
403 vhost_scsi_task_init_target(struct spdk_vhost_scsi_task *task, const __u8 *lun)
404 {
405 	struct spdk_vhost_scsi_session *svsession = task->svsession;
406 	struct spdk_scsi_dev_session_state *state;
407 	uint16_t lun_id = (((uint16_t)lun[2] << 8) | lun[3]) & 0x3FFF;
408 
409 	SPDK_LOGDUMP(SPDK_LOG_VHOST_SCSI_QUEUE, "LUN", lun, 8);
410 
411 	/* First byte must be 1 and second is target */
412 	if (lun[0] != 1 || lun[1] >= SPDK_VHOST_SCSI_CTRLR_MAX_DEVS) {
413 		return -1;
414 	}
415 
416 	state = &svsession->scsi_dev_state[lun[1]];
417 	task->scsi_dev = state->dev;
418 	if (state->dev == NULL || state->status != VHOST_SCSI_DEV_PRESENT) {
419 		/* If dev has been hotdetached, return 0 to allow sending
420 		 * additional hotremove event via sense codes.
421 		 */
422 		return state->status != VHOST_SCSI_DEV_EMPTY ? 0 : -1;
423 	}
424 
425 	task->scsi.target_port = spdk_scsi_dev_find_port_by_id(task->scsi_dev, 0);
426 	task->scsi.lun = spdk_scsi_dev_get_lun(state->dev, lun_id);
427 	return 0;
428 }
429 
430 static void
431 process_ctrl_request(struct spdk_vhost_scsi_task *task)
432 {
433 	struct spdk_vhost_session *vsession = &task->svsession->vsession;
434 	struct vring_desc *desc, *desc_table;
435 	struct virtio_scsi_ctrl_tmf_req *ctrl_req;
436 	struct virtio_scsi_ctrl_an_resp *an_resp;
437 	uint32_t desc_table_size, used_len = 0;
438 	int rc;
439 
440 	spdk_scsi_task_construct(&task->scsi, vhost_scsi_task_mgmt_cpl, vhost_scsi_task_free_cb);
441 	rc = vhost_vq_get_desc(vsession, task->vq, task->req_idx, &desc, &desc_table,
442 			       &desc_table_size);
443 	if (spdk_unlikely(rc != 0)) {
444 		SPDK_ERRLOG("%s: invalid controlq descriptor at index %d.\n",
445 			    vsession->name, task->req_idx);
446 		goto out;
447 	}
448 
449 	ctrl_req = vhost_gpa_to_vva(vsession, desc->addr, sizeof(*ctrl_req));
450 	if (ctrl_req == NULL) {
451 		SPDK_ERRLOG("%s: invalid task management request at index %d.\n",
452 			    vsession->name, task->req_idx);
453 		goto out;
454 	}
455 
456 	SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI_QUEUE,
457 		      "Processing controlq descriptor: desc %d/%p, desc_addr %p, len %d, flags %d, last_used_idx %d; kickfd %d; size %d\n",
458 		      task->req_idx, desc, (void *)desc->addr, desc->len, desc->flags, task->vq->last_used_idx,
459 		      task->vq->vring.kickfd, task->vq->vring.size);
460 	SPDK_LOGDUMP(SPDK_LOG_VHOST_SCSI_QUEUE, "Request descriptor", (uint8_t *)ctrl_req, desc->len);
461 
462 	vhost_scsi_task_init_target(task, ctrl_req->lun);
463 
464 	vhost_vring_desc_get_next(&desc, desc_table, desc_table_size);
465 	if (spdk_unlikely(desc == NULL)) {
466 		SPDK_ERRLOG("%s: no response descriptor for controlq request %d.\n",
467 			    vsession->name, task->req_idx);
468 		goto out;
469 	}
470 
471 	/* Process the TMF request */
472 	switch (ctrl_req->type) {
473 	case VIRTIO_SCSI_T_TMF:
474 		task->tmf_resp = vhost_gpa_to_vva(vsession, desc->addr, sizeof(*task->tmf_resp));
475 		if (spdk_unlikely(desc->len < sizeof(struct virtio_scsi_ctrl_tmf_resp) || task->tmf_resp == NULL)) {
476 			SPDK_ERRLOG("%s: TMF response descriptor at index %d points to invalid guest memory region\n",
477 				    vsession->name, task->req_idx);
478 			goto out;
479 		}
480 
481 		/* Check if we are processing a valid request */
482 		if (task->scsi_dev == NULL) {
483 			task->tmf_resp->response = VIRTIO_SCSI_S_BAD_TARGET;
484 			break;
485 		}
486 
487 		switch (ctrl_req->subtype) {
488 		case VIRTIO_SCSI_T_TMF_LOGICAL_UNIT_RESET:
489 			/* Handle LUN reset */
490 			SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI_QUEUE, "%s: LUN reset\n", vsession->name);
491 
492 			mgmt_task_submit(task, SPDK_SCSI_TASK_FUNC_LUN_RESET);
493 			return;
494 		default:
495 			task->tmf_resp->response = VIRTIO_SCSI_S_ABORTED;
496 			/* Unsupported command */
497 			SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI_QUEUE, "%s: unsupported TMF command %x\n",
498 				      vsession->name, ctrl_req->subtype);
499 			break;
500 		}
501 		break;
502 	case VIRTIO_SCSI_T_AN_QUERY:
503 	case VIRTIO_SCSI_T_AN_SUBSCRIBE: {
504 		an_resp = vhost_gpa_to_vva(vsession, desc->addr, sizeof(*an_resp));
505 		if (spdk_unlikely(desc->len < sizeof(struct virtio_scsi_ctrl_an_resp) || an_resp == NULL)) {
506 			SPDK_WARNLOG("%s: asynchronous response descriptor points to invalid guest memory region\n",
507 				     vsession->name);
508 			goto out;
509 		}
510 
511 		an_resp->response = VIRTIO_SCSI_S_ABORTED;
512 		break;
513 	}
514 	default:
515 		SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI_QUEUE, "%s: Unsupported control command %x\n",
516 			      vsession->name, ctrl_req->type);
517 		break;
518 	}
519 
520 	used_len = sizeof(struct virtio_scsi_ctrl_tmf_resp);
521 out:
522 	vhost_vq_used_ring_enqueue(vsession, task->vq, task->req_idx, used_len);
523 	vhost_scsi_task_put(task);
524 }
525 
526 /*
527  * Process task's descriptor chain and setup data related fields.
528  * Return
529  *   -1 if request is invalid and must be aborted,
530  *    0 if all data are set.
531  */
532 static int
533 task_data_setup(struct spdk_vhost_scsi_task *task,
534 		struct virtio_scsi_cmd_req **req)
535 {
536 	struct spdk_vhost_session *vsession = &task->svsession->vsession;
537 	struct vring_desc *desc, *desc_table;
538 	struct iovec *iovs = task->iovs;
539 	uint16_t iovcnt = 0;
540 	uint32_t desc_table_len, len = 0;
541 	int rc;
542 
543 	spdk_scsi_task_construct(&task->scsi, vhost_scsi_task_cpl, vhost_scsi_task_free_cb);
544 
545 	rc = vhost_vq_get_desc(vsession, task->vq, task->req_idx, &desc, &desc_table, &desc_table_len);
546 	/* First descriptor must be readable */
547 	if (spdk_unlikely(rc != 0  || vhost_vring_desc_is_wr(desc) ||
548 			  desc->len < sizeof(struct virtio_scsi_cmd_req))) {
549 		SPDK_WARNLOG("%s: invalid first request descriptor at index %"PRIu16".\n",
550 			     vsession->name, task->req_idx);
551 		goto invalid_task;
552 	}
553 
554 	*req = vhost_gpa_to_vva(vsession, desc->addr, sizeof(**req));
555 	if (spdk_unlikely(*req == NULL)) {
556 		SPDK_WARNLOG("%s: request descriptor at index %d points to invalid guest memory region\n",
557 			     vsession->name, task->req_idx);
558 		goto invalid_task;
559 	}
560 
561 	/* Each request must have at least 2 descriptors (e.g. request and response) */
562 	vhost_vring_desc_get_next(&desc, desc_table, desc_table_len);
563 	if (desc == NULL) {
564 		SPDK_WARNLOG("%s: descriptor chain at index %d contains neither payload nor response buffer.\n",
565 			     vsession->name, task->req_idx);
566 		goto invalid_task;
567 	}
568 	task->scsi.dxfer_dir = vhost_vring_desc_is_wr(desc) ? SPDK_SCSI_DIR_FROM_DEV :
569 			       SPDK_SCSI_DIR_TO_DEV;
570 	task->scsi.iovs = iovs;
571 
572 	if (task->scsi.dxfer_dir == SPDK_SCSI_DIR_FROM_DEV) {
573 		/*
574 		 * FROM_DEV (READ): [RD_req][WR_resp][WR_buf0]...[WR_bufN]
575 		 */
576 		task->resp = vhost_gpa_to_vva(vsession, desc->addr, sizeof(*task->resp));
577 		if (spdk_unlikely(desc->len < sizeof(struct virtio_scsi_cmd_resp) || task->resp == NULL)) {
578 			SPDK_WARNLOG("%s: response descriptor at index %d points to invalid guest memory region\n",
579 				     vsession->name, task->req_idx);
580 			goto invalid_task;
581 		}
582 		rc = vhost_vring_desc_get_next(&desc, desc_table, desc_table_len);
583 		if (spdk_unlikely(rc != 0)) {
584 			SPDK_WARNLOG("%s: invalid descriptor chain at request index %d (descriptor id overflow?).\n",
585 				     vsession->name, task->req_idx);
586 			goto invalid_task;
587 		}
588 
589 		if (desc == NULL) {
590 			/*
591 			 * TEST UNIT READY command and some others might not contain any payload and this is not an error.
592 			 */
593 			SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI_DATA,
594 				      "No payload descriptors for FROM DEV command req_idx=%"PRIu16".\n", task->req_idx);
595 			SPDK_LOGDUMP(SPDK_LOG_VHOST_SCSI_DATA, "CDB=", (*req)->cdb, VIRTIO_SCSI_CDB_SIZE);
596 			task->used_len = sizeof(struct virtio_scsi_cmd_resp);
597 			task->scsi.iovcnt = 1;
598 			task->scsi.iovs[0].iov_len = 0;
599 			task->scsi.length = 0;
600 			task->scsi.transfer_len = 0;
601 			return 0;
602 		}
603 
604 		/* All remaining descriptors are data. */
605 		while (desc) {
606 			if (spdk_unlikely(!vhost_vring_desc_is_wr(desc))) {
607 				SPDK_WARNLOG("%s: FROM DEV cmd: descriptor nr %" PRIu16" in payload chain is read only.\n",
608 					     vsession->name, iovcnt);
609 				goto invalid_task;
610 			}
611 
612 			if (spdk_unlikely(vhost_vring_desc_to_iov(vsession, iovs, &iovcnt, desc))) {
613 				goto invalid_task;
614 			}
615 			len += desc->len;
616 
617 			rc = vhost_vring_desc_get_next(&desc, desc_table, desc_table_len);
618 			if (spdk_unlikely(rc != 0)) {
619 				SPDK_WARNLOG("%s: invalid payload in descriptor chain starting at index %d.\n",
620 					     vsession->name, task->req_idx);
621 				goto invalid_task;
622 			}
623 		}
624 
625 		task->used_len = sizeof(struct virtio_scsi_cmd_resp) + len;
626 	} else {
627 		SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI_DATA, "TO DEV");
628 		/*
629 		 * TO_DEV (WRITE):[RD_req][RD_buf0]...[RD_bufN][WR_resp]
630 		 * No need to check descriptor WR flag as this is done while setting scsi.dxfer_dir.
631 		 */
632 
633 		/* Process descriptors up to response. */
634 		while (!vhost_vring_desc_is_wr(desc)) {
635 			if (spdk_unlikely(vhost_vring_desc_to_iov(vsession, iovs, &iovcnt, desc))) {
636 				goto invalid_task;
637 			}
638 			len += desc->len;
639 
640 			vhost_vring_desc_get_next(&desc, desc_table, desc_table_len);
641 			if (spdk_unlikely(desc == NULL)) {
642 				SPDK_WARNLOG("%s: TO_DEV cmd: no response descriptor.\n", vsession->name);
643 				goto invalid_task;
644 			}
645 		}
646 
647 		task->resp = vhost_gpa_to_vva(vsession, desc->addr, sizeof(*task->resp));
648 		if (spdk_unlikely(desc->len < sizeof(struct virtio_scsi_cmd_resp) || task->resp == NULL)) {
649 			SPDK_WARNLOG("%s: response descriptor at index %d points to invalid guest memory region\n",
650 				     vsession->name, task->req_idx);
651 			goto invalid_task;
652 		}
653 
654 		task->used_len = sizeof(struct virtio_scsi_cmd_resp);
655 	}
656 
657 	task->scsi.iovcnt = iovcnt;
658 	task->scsi.length = len;
659 	task->scsi.transfer_len = len;
660 	return 0;
661 
662 invalid_task:
663 	SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI_DATA, "%s: Invalid task at index %"PRIu16".\n",
664 		      vsession->name, task->req_idx);
665 	return -1;
666 }
667 
668 static int
669 process_request(struct spdk_vhost_scsi_task *task)
670 {
671 	struct virtio_scsi_cmd_req *req;
672 	int result;
673 
674 	result = task_data_setup(task, &req);
675 	if (result) {
676 		return result;
677 	}
678 
679 	result = vhost_scsi_task_init_target(task, req->lun);
680 	if (spdk_unlikely(result != 0)) {
681 		task->resp->response = VIRTIO_SCSI_S_BAD_TARGET;
682 		return -1;
683 	}
684 
685 	task->scsi.cdb = req->cdb;
686 	SPDK_LOGDUMP(SPDK_LOG_VHOST_SCSI_DATA, "request CDB", req->cdb, VIRTIO_SCSI_CDB_SIZE);
687 
688 	if (spdk_unlikely(task->scsi.lun == NULL)) {
689 		spdk_scsi_task_process_null_lun(&task->scsi);
690 		task->resp->response = VIRTIO_SCSI_S_OK;
691 		return 1;
692 	}
693 
694 	return 0;
695 }
696 
697 static void
698 process_scsi_task(struct spdk_vhost_session *vsession,
699 		  struct spdk_vhost_virtqueue *vq,
700 		  uint16_t req_idx)
701 {
702 	struct spdk_vhost_scsi_task *task;
703 	int result;
704 
705 	task = &((struct spdk_vhost_scsi_task *)vq->tasks)[req_idx];
706 	if (spdk_unlikely(task->used)) {
707 		SPDK_ERRLOG("%s: request with idx '%"PRIu16"' is already pending.\n",
708 			    vsession->name, req_idx);
709 		vhost_vq_used_ring_enqueue(vsession, vq, req_idx, 0);
710 		return;
711 	}
712 
713 	vsession->task_cnt++;
714 	scsi_task_init(task);
715 
716 	if (spdk_unlikely(vq->vring_idx == VIRTIO_SCSI_CONTROLQ)) {
717 		process_ctrl_request(task);
718 	} else {
719 		result = process_request(task);
720 		if (likely(result == 0)) {
721 			task_submit(task);
722 			SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI, "====== Task %p req_idx %d submitted ======\n", task,
723 				      task->req_idx);
724 		} else if (result > 0) {
725 			vhost_scsi_task_cpl(&task->scsi);
726 			SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI, "====== Task %p req_idx %d finished early ======\n", task,
727 				      task->req_idx);
728 		} else {
729 			invalid_request(task);
730 			SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI, "====== Task %p req_idx %d failed ======\n", task,
731 				      task->req_idx);
732 		}
733 	}
734 }
735 
736 static void
737 process_vq(struct spdk_vhost_scsi_session *svsession, struct spdk_vhost_virtqueue *vq)
738 {
739 	struct spdk_vhost_session *vsession = &svsession->vsession;
740 	uint16_t reqs[32];
741 	uint16_t reqs_cnt, i;
742 
743 	reqs_cnt = vhost_vq_avail_ring_get(vq, reqs, SPDK_COUNTOF(reqs));
744 	assert(reqs_cnt <= 32);
745 
746 	for (i = 0; i < reqs_cnt; i++) {
747 		SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI, "====== Starting processing request idx %"PRIu16"======\n",
748 			      reqs[i]);
749 
750 		if (spdk_unlikely(reqs[i] >= vq->vring.size)) {
751 			SPDK_ERRLOG("%s: request idx '%"PRIu16"' exceeds virtqueue size (%"PRIu16").\n",
752 				    vsession->name, reqs[i], vq->vring.size);
753 			vhost_vq_used_ring_enqueue(vsession, vq, reqs[i], 0);
754 			continue;
755 		}
756 
757 		process_scsi_task(vsession, vq, reqs[i]);
758 	}
759 }
760 
761 static int
762 vdev_mgmt_worker(void *arg)
763 {
764 	struct spdk_vhost_scsi_session *svsession = arg;
765 	struct spdk_vhost_session *vsession = &svsession->vsession;
766 
767 	process_removed_devs(svsession);
768 	vhost_vq_used_signal(vsession, &vsession->virtqueue[VIRTIO_SCSI_EVENTQ]);
769 
770 	process_vq(svsession, &vsession->virtqueue[VIRTIO_SCSI_CONTROLQ]);
771 	vhost_vq_used_signal(vsession, &vsession->virtqueue[VIRTIO_SCSI_CONTROLQ]);
772 
773 	return -1;
774 }
775 
776 static int
777 vdev_worker(void *arg)
778 {
779 	struct spdk_vhost_scsi_session *svsession = arg;
780 	struct spdk_vhost_session *vsession = &svsession->vsession;
781 	uint32_t q_idx;
782 
783 	for (q_idx = VIRTIO_SCSI_REQUESTQ; q_idx < vsession->max_queues; q_idx++) {
784 		process_vq(svsession, &vsession->virtqueue[q_idx]);
785 	}
786 
787 	vhost_session_used_signal(vsession);
788 
789 	return -1;
790 }
791 
792 static struct spdk_vhost_scsi_dev *
793 to_scsi_dev(struct spdk_vhost_dev *ctrlr)
794 {
795 	if (ctrlr == NULL) {
796 		return NULL;
797 	}
798 
799 	if (ctrlr->backend != &spdk_vhost_scsi_device_backend) {
800 		SPDK_ERRLOG("%s: not a vhost-scsi device.\n", ctrlr->name);
801 		return NULL;
802 	}
803 
804 	return SPDK_CONTAINEROF(ctrlr, struct spdk_vhost_scsi_dev, vdev);
805 }
806 
807 static struct spdk_vhost_scsi_session *
808 to_scsi_session(struct spdk_vhost_session *vsession)
809 {
810 	assert(vsession->vdev->backend == &spdk_vhost_scsi_device_backend);
811 	return (struct spdk_vhost_scsi_session *)vsession;
812 }
813 
814 int
815 spdk_vhost_scsi_dev_construct(const char *name, const char *cpumask)
816 {
817 	struct spdk_vhost_scsi_dev *svdev = calloc(1, sizeof(*svdev));
818 	int rc;
819 
820 	if (svdev == NULL) {
821 		return -ENOMEM;
822 	}
823 
824 	svdev->vdev.virtio_features = SPDK_VHOST_SCSI_FEATURES;
825 	svdev->vdev.disabled_features = SPDK_VHOST_SCSI_DISABLED_FEATURES;
826 
827 	spdk_vhost_lock();
828 	rc = vhost_dev_register(&svdev->vdev, name, cpumask,
829 				&spdk_vhost_scsi_device_backend);
830 
831 	if (rc) {
832 		free(svdev);
833 		spdk_vhost_unlock();
834 		return rc;
835 	}
836 
837 	svdev->registered = true;
838 
839 	spdk_vhost_unlock();
840 	return rc;
841 }
842 
843 static int
844 vhost_scsi_dev_remove(struct spdk_vhost_dev *vdev)
845 {
846 	struct spdk_vhost_scsi_dev *svdev = to_scsi_dev(vdev);
847 	int rc, i;
848 
849 	assert(svdev != NULL);
850 	for (i = 0; i < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS; ++i) {
851 		if (svdev->scsi_dev_state[i].dev) {
852 			if (vdev->registered) {
853 				SPDK_ERRLOG("%s: SCSI target %d is still present.\n", vdev->name, i);
854 				return -EBUSY;
855 			}
856 
857 			rc = spdk_vhost_scsi_dev_remove_tgt(vdev, i, NULL, NULL);
858 			if (rc != 0) {
859 				SPDK_ERRLOG("%s: failed to force-remove target %d\n", vdev->name, i);
860 				return rc;
861 			}
862 		}
863 	}
864 
865 	rc = vhost_dev_unregister(vdev);
866 	if (rc != 0) {
867 		return rc;
868 	}
869 	svdev->registered = false;
870 
871 	if (svdev->ref == 0) {
872 		free(svdev);
873 	}
874 
875 	return 0;
876 }
877 
878 struct spdk_scsi_dev *
879 spdk_vhost_scsi_dev_get_tgt(struct spdk_vhost_dev *vdev, uint8_t num)
880 {
881 	struct spdk_vhost_scsi_dev *svdev;
882 
883 	assert(num < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS);
884 	svdev = to_scsi_dev(vdev);
885 	assert(svdev != NULL);
886 	if (svdev->scsi_dev_state[num].status != VHOST_SCSI_DEV_PRESENT) {
887 		return NULL;
888 	}
889 
890 	assert(svdev->scsi_dev_state[num].dev != NULL);
891 	return svdev->scsi_dev_state[num].dev;
892 }
893 
894 static void
895 vhost_scsi_lun_hotremove(const struct spdk_scsi_lun *lun, void *arg)
896 {
897 	struct spdk_vhost_scsi_dev *svdev = arg;
898 	const struct spdk_scsi_dev *scsi_dev;
899 	unsigned scsi_dev_num;
900 
901 	assert(lun != NULL);
902 	assert(svdev != NULL);
903 	scsi_dev = spdk_scsi_lun_get_dev(lun);
904 	for (scsi_dev_num = 0; scsi_dev_num < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS; scsi_dev_num++) {
905 		if (svdev->scsi_dev_state[scsi_dev_num].dev == scsi_dev) {
906 			break;
907 		}
908 	}
909 
910 	if (scsi_dev_num == SPDK_VHOST_SCSI_CTRLR_MAX_DEVS) {
911 		/* The entire device has been already removed. */
912 		return;
913 	}
914 
915 	/* remove entire device */
916 	spdk_vhost_scsi_dev_remove_tgt(&svdev->vdev, scsi_dev_num, NULL, NULL);
917 }
918 
919 static void
920 vhost_scsi_dev_add_tgt_cpl_cb(struct spdk_vhost_dev *vdev, void *ctx)
921 {
922 	unsigned scsi_tgt_num = (unsigned)(uintptr_t)ctx;
923 	struct spdk_vhost_scsi_dev *svdev = SPDK_CONTAINEROF(vdev,
924 					    struct spdk_vhost_scsi_dev, vdev);
925 	struct spdk_scsi_dev_vhost_state *vhost_sdev;
926 
927 	vhost_sdev = &svdev->scsi_dev_state[scsi_tgt_num];
928 
929 	/* All sessions have added the target */
930 	assert(vhost_sdev->status == VHOST_SCSI_DEV_ADDING);
931 	vhost_sdev->status = VHOST_SCSI_DEV_PRESENT;
932 	svdev->ref++;
933 }
934 
935 static int
936 vhost_scsi_session_add_tgt(struct spdk_vhost_dev *vdev,
937 			   struct spdk_vhost_session *vsession, void *ctx)
938 {
939 	unsigned scsi_tgt_num = (unsigned)(uintptr_t)ctx;
940 	struct spdk_vhost_scsi_session *svsession = (struct spdk_vhost_scsi_session *)vsession;
941 	struct spdk_scsi_dev_session_state *session_sdev = &svsession->scsi_dev_state[scsi_tgt_num];
942 	struct spdk_scsi_dev_vhost_state *vhost_sdev;
943 	int rc;
944 
945 	if (!vsession->started || session_sdev->dev != NULL) {
946 		/* Nothing to do. */
947 		return 0;
948 	}
949 
950 	vhost_sdev = &svsession->svdev->scsi_dev_state[scsi_tgt_num];
951 	session_sdev->dev = vhost_sdev->dev;
952 	session_sdev->status = VHOST_SCSI_DEV_PRESENT;
953 
954 	rc = spdk_scsi_dev_allocate_io_channels(svsession->scsi_dev_state[scsi_tgt_num].dev);
955 	if (rc != 0) {
956 		SPDK_ERRLOG("%s: Couldn't allocate io channnel for SCSI target %u.\n",
957 			    vsession->name, scsi_tgt_num);
958 
959 		/* unset the SCSI target so that all I/O to it will be rejected */
960 		session_sdev->dev = NULL;
961 		/* Set status to EMPTY so that we won't reply with SCSI hotremove
962 		 * sense codes - the device hasn't ever been added.
963 		 */
964 		session_sdev->status = VHOST_SCSI_DEV_EMPTY;
965 
966 		/* Return with no error. We'll continue allocating io_channels for
967 		 * other sessions on this device in hopes they succeed. The sessions
968 		 * that failed to allocate io_channels simply won't be able to
969 		 * detect the SCSI target, nor do any I/O to it.
970 		 */
971 		return 0;
972 	}
973 
974 	if (vhost_dev_has_feature(vsession, VIRTIO_SCSI_F_HOTPLUG)) {
975 		eventq_enqueue(svsession, scsi_tgt_num,
976 			       VIRTIO_SCSI_T_TRANSPORT_RESET, VIRTIO_SCSI_EVT_RESET_RESCAN);
977 	} else {
978 		SPDK_NOTICELOG("%s: driver does not support hotplug. "
979 			       "Please restart it or perform a rescan.\n",
980 			       vsession->name);
981 	}
982 
983 	return 0;
984 }
985 
986 int
987 spdk_vhost_scsi_dev_add_tgt(struct spdk_vhost_dev *vdev, int scsi_tgt_num,
988 			    const char *bdev_name)
989 {
990 	struct spdk_vhost_scsi_dev *svdev;
991 	struct spdk_scsi_dev_vhost_state *state;
992 	char target_name[SPDK_SCSI_DEV_MAX_NAME];
993 	int lun_id_list[1];
994 	const char *bdev_names_list[1];
995 
996 	svdev = to_scsi_dev(vdev);
997 	assert(svdev != NULL);
998 	if (scsi_tgt_num < 0) {
999 		for (scsi_tgt_num = 0; scsi_tgt_num < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS; scsi_tgt_num++) {
1000 			if (svdev->scsi_dev_state[scsi_tgt_num].dev == NULL) {
1001 				break;
1002 			}
1003 		}
1004 
1005 		if (scsi_tgt_num == SPDK_VHOST_SCSI_CTRLR_MAX_DEVS) {
1006 			SPDK_ERRLOG("%s: all SCSI target slots are already in use.\n", vdev->name);
1007 			return -ENOSPC;
1008 		}
1009 	} else {
1010 		if (scsi_tgt_num >= SPDK_VHOST_SCSI_CTRLR_MAX_DEVS) {
1011 			SPDK_ERRLOG("%s: SCSI target number is too big (got %d, max %d)\n",
1012 				    vdev->name, scsi_tgt_num, SPDK_VHOST_SCSI_CTRLR_MAX_DEVS);
1013 			return -EINVAL;
1014 		}
1015 	}
1016 
1017 	if (bdev_name == NULL) {
1018 		SPDK_ERRLOG("No lun name specified\n");
1019 		return -EINVAL;
1020 	}
1021 
1022 	state = &svdev->scsi_dev_state[scsi_tgt_num];
1023 	if (state->dev != NULL) {
1024 		SPDK_ERRLOG("%s: SCSI target %u already occupied\n", vdev->name, scsi_tgt_num);
1025 		return -EEXIST;
1026 	}
1027 
1028 	/*
1029 	 * At this stage only one LUN per target
1030 	 */
1031 	snprintf(target_name, sizeof(target_name), "Target %u", scsi_tgt_num);
1032 	lun_id_list[0] = 0;
1033 	bdev_names_list[0] = (char *)bdev_name;
1034 
1035 	state->status = VHOST_SCSI_DEV_ADDING;
1036 	state->dev = spdk_scsi_dev_construct(target_name, bdev_names_list, lun_id_list, 1,
1037 					     SPDK_SPC_PROTOCOL_IDENTIFIER_SAS,
1038 					     vhost_scsi_lun_hotremove, svdev);
1039 
1040 	if (state->dev == NULL) {
1041 		state->status = VHOST_SCSI_DEV_EMPTY;
1042 		SPDK_ERRLOG("%s: couldn't create SCSI target %u using bdev '%s'\n",
1043 			    vdev->name, scsi_tgt_num, bdev_name);
1044 		return -EINVAL;
1045 	}
1046 	spdk_scsi_dev_add_port(state->dev, 0, "vhost");
1047 
1048 	SPDK_INFOLOG(SPDK_LOG_VHOST, "%s: added SCSI target %u using bdev '%s'\n",
1049 		     vdev->name, scsi_tgt_num, bdev_name);
1050 
1051 	vhost_dev_foreach_session(vdev, vhost_scsi_session_add_tgt,
1052 				  vhost_scsi_dev_add_tgt_cpl_cb,
1053 				  (void *)(uintptr_t)scsi_tgt_num);
1054 	return scsi_tgt_num;
1055 }
1056 
1057 struct scsi_tgt_hotplug_ctx {
1058 	unsigned scsi_tgt_num;
1059 	bool async_fini;
1060 };
1061 
1062 static void
1063 vhost_scsi_dev_remove_tgt_cpl_cb(struct spdk_vhost_dev *vdev, void *_ctx)
1064 {
1065 	struct scsi_tgt_hotplug_ctx *ctx = _ctx;
1066 	struct spdk_vhost_scsi_dev *svdev = SPDK_CONTAINEROF(vdev,
1067 					    struct spdk_vhost_scsi_dev, vdev);
1068 
1069 	if (!ctx->async_fini) {
1070 		/* there aren't any active sessions, so remove the dev and exit */
1071 		remove_scsi_tgt(svdev, ctx->scsi_tgt_num);
1072 	}
1073 
1074 	free(ctx);
1075 }
1076 
1077 static int
1078 vhost_scsi_session_remove_tgt(struct spdk_vhost_dev *vdev,
1079 			      struct spdk_vhost_session *vsession, void *_ctx)
1080 {
1081 	struct scsi_tgt_hotplug_ctx *ctx = _ctx;
1082 	unsigned scsi_tgt_num = ctx->scsi_tgt_num;
1083 	struct spdk_vhost_scsi_session *svsession = (struct spdk_vhost_scsi_session *)vsession;
1084 	struct spdk_scsi_dev_session_state *state = &svsession->scsi_dev_state[scsi_tgt_num];
1085 
1086 	if (!vsession->started || state->dev == NULL) {
1087 		/* Nothing to do */
1088 		return 0;
1089 	}
1090 
1091 	/* Mark the target for removal */
1092 	assert(state->status == VHOST_SCSI_DEV_PRESENT);
1093 	state->status = VHOST_SCSI_DEV_REMOVING;
1094 
1095 	/* Send a hotremove Virtio event */
1096 	if (vhost_dev_has_feature(vsession, VIRTIO_SCSI_F_HOTPLUG)) {
1097 		eventq_enqueue(svsession, scsi_tgt_num,
1098 			       VIRTIO_SCSI_T_TRANSPORT_RESET, VIRTIO_SCSI_EVT_RESET_REMOVED);
1099 	}
1100 
1101 	/* Wait for the session's management poller to remove the target after
1102 	 * all its pending I/O has finished.
1103 	 */
1104 	ctx->async_fini = true;
1105 	return 0;
1106 }
1107 
1108 int
1109 spdk_vhost_scsi_dev_remove_tgt(struct spdk_vhost_dev *vdev, unsigned scsi_tgt_num,
1110 			       spdk_vhost_event_fn cb_fn, void *cb_arg)
1111 {
1112 	struct spdk_vhost_scsi_dev *svdev;
1113 	struct spdk_scsi_dev_vhost_state *scsi_dev_state;
1114 	struct scsi_tgt_hotplug_ctx *ctx;
1115 
1116 	if (scsi_tgt_num >= SPDK_VHOST_SCSI_CTRLR_MAX_DEVS) {
1117 		SPDK_ERRLOG("%s: invalid SCSI target number %d\n", vdev->name, scsi_tgt_num);
1118 		return -EINVAL;
1119 	}
1120 
1121 	svdev = to_scsi_dev(vdev);
1122 	assert(svdev != NULL);
1123 	scsi_dev_state = &svdev->scsi_dev_state[scsi_tgt_num];
1124 
1125 	if (scsi_dev_state->status != VHOST_SCSI_DEV_PRESENT) {
1126 		return -EBUSY;
1127 	}
1128 
1129 	if (scsi_dev_state->dev == NULL || scsi_dev_state->status == VHOST_SCSI_DEV_ADDING) {
1130 		SPDK_ERRLOG("%s: SCSI target %u is not occupied\n", vdev->name, scsi_tgt_num);
1131 		return -ENODEV;
1132 	}
1133 
1134 	assert(scsi_dev_state->status != VHOST_SCSI_DEV_EMPTY);
1135 	ctx = calloc(1, sizeof(*ctx));
1136 	if (ctx == NULL) {
1137 		SPDK_ERRLOG("calloc failed\n");
1138 		return -ENOMEM;
1139 	}
1140 
1141 	ctx->scsi_tgt_num = scsi_tgt_num;
1142 	ctx->async_fini = false;
1143 
1144 	scsi_dev_state->remove_cb = cb_fn;
1145 	scsi_dev_state->remove_ctx = cb_arg;
1146 	scsi_dev_state->status = VHOST_SCSI_DEV_REMOVING;
1147 
1148 	vhost_dev_foreach_session(vdev, vhost_scsi_session_remove_tgt,
1149 				  vhost_scsi_dev_remove_tgt_cpl_cb, ctx);
1150 	return 0;
1151 }
1152 
1153 int
1154 vhost_scsi_controller_construct(void)
1155 {
1156 	struct spdk_conf_section *sp = spdk_conf_first_section(NULL);
1157 	struct spdk_vhost_dev *vdev;
1158 	int i, dev_num;
1159 	unsigned ctrlr_num = 0;
1160 	char *bdev_name, *tgt_num_str;
1161 	char *cpumask;
1162 	char *name;
1163 	char *tgt = NULL;
1164 
1165 	while (sp != NULL) {
1166 		if (!spdk_conf_section_match_prefix(sp, "VhostScsi")) {
1167 			sp = spdk_conf_next_section(sp);
1168 			continue;
1169 		}
1170 
1171 		if (sscanf(spdk_conf_section_get_name(sp), "VhostScsi%u", &ctrlr_num) != 1) {
1172 			SPDK_ERRLOG("Section '%s' has non-numeric suffix.\n",
1173 				    spdk_conf_section_get_name(sp));
1174 			return -1;
1175 		}
1176 
1177 		name =  spdk_conf_section_get_val(sp, "Name");
1178 		cpumask = spdk_conf_section_get_val(sp, "Cpumask");
1179 
1180 		if (spdk_vhost_scsi_dev_construct(name, cpumask) < 0) {
1181 			return -1;
1182 		}
1183 
1184 		vdev = spdk_vhost_dev_find(name);
1185 		assert(vdev);
1186 
1187 		for (i = 0; ; i++) {
1188 
1189 			tgt = spdk_conf_section_get_nval(sp, "Target", i);
1190 			if (tgt == NULL) {
1191 				break;
1192 			}
1193 
1194 			tgt_num_str = spdk_conf_section_get_nmval(sp, "Target", i, 0);
1195 			if (tgt_num_str == NULL) {
1196 				SPDK_ERRLOG("%s: invalid or missing SCSI target number\n", name);
1197 				return -1;
1198 			}
1199 
1200 			dev_num = (int)strtol(tgt_num_str, NULL, 10);
1201 			bdev_name = spdk_conf_section_get_nmval(sp, "Target", i, 1);
1202 			if (bdev_name == NULL) {
1203 				SPDK_ERRLOG("%s: invalid or missing bdev name for SCSI target %d\n", name, dev_num);
1204 				return -1;
1205 			} else if (spdk_conf_section_get_nmval(sp, "Target", i, 2)) {
1206 				SPDK_ERRLOG("%s: only one LUN per SCSI target is supported\n", name);
1207 				return -1;
1208 			}
1209 
1210 			if (spdk_vhost_scsi_dev_add_tgt(vdev, dev_num, bdev_name) < 0) {
1211 				return -1;
1212 			}
1213 		}
1214 
1215 		sp = spdk_conf_next_section(sp);
1216 	}
1217 
1218 	return 0;
1219 }
1220 
1221 static void
1222 free_task_pool(struct spdk_vhost_scsi_session *svsession)
1223 {
1224 	struct spdk_vhost_session *vsession = &svsession->vsession;
1225 	struct spdk_vhost_virtqueue *vq;
1226 	uint16_t i;
1227 
1228 	for (i = 0; i < vsession->max_queues; i++) {
1229 		vq = &vsession->virtqueue[i];
1230 		if (vq->tasks == NULL) {
1231 			continue;
1232 		}
1233 
1234 		spdk_free(vq->tasks);
1235 		vq->tasks = NULL;
1236 	}
1237 }
1238 
1239 static int
1240 alloc_task_pool(struct spdk_vhost_scsi_session *svsession)
1241 {
1242 	struct spdk_vhost_session *vsession = &svsession->vsession;
1243 	struct spdk_vhost_virtqueue *vq;
1244 	struct spdk_vhost_scsi_task *task;
1245 	uint32_t task_cnt;
1246 	uint16_t i;
1247 	uint32_t j;
1248 
1249 	for (i = 0; i < vsession->max_queues; i++) {
1250 		vq = &vsession->virtqueue[i];
1251 		if (vq->vring.desc == NULL) {
1252 			continue;
1253 		}
1254 
1255 		task_cnt = vq->vring.size;
1256 		if (task_cnt > SPDK_VHOST_MAX_VQ_SIZE) {
1257 			/* sanity check */
1258 			SPDK_ERRLOG("%s: virtuque %"PRIu16" is too big. (size = %"PRIu32", max = %"PRIu32")\n",
1259 				    vsession->name, i, task_cnt, SPDK_VHOST_MAX_VQ_SIZE);
1260 			free_task_pool(svsession);
1261 			return -1;
1262 		}
1263 		vq->tasks = spdk_zmalloc(sizeof(struct spdk_vhost_scsi_task) * task_cnt,
1264 					 SPDK_CACHE_LINE_SIZE, NULL,
1265 					 SPDK_ENV_LCORE_ID_ANY, SPDK_MALLOC_DMA);
1266 		if (vq->tasks == NULL) {
1267 			SPDK_ERRLOG("%s: failed to allocate %"PRIu32" tasks for virtqueue %"PRIu16"\n",
1268 				    vsession->name, task_cnt, i);
1269 			free_task_pool(svsession);
1270 			return -1;
1271 		}
1272 
1273 		for (j = 0; j < task_cnt; j++) {
1274 			task = &((struct spdk_vhost_scsi_task *)vq->tasks)[j];
1275 			task->svsession = svsession;
1276 			task->vq = vq;
1277 			task->req_idx = j;
1278 		}
1279 	}
1280 
1281 	return 0;
1282 }
1283 
1284 static int
1285 vhost_scsi_start_cb(struct spdk_vhost_dev *vdev,
1286 		    struct spdk_vhost_session *vsession, void *unused)
1287 {
1288 	struct spdk_vhost_scsi_session *svsession = to_scsi_session(vsession);
1289 	struct spdk_vhost_scsi_dev *svdev = svsession->svdev;
1290 	struct spdk_scsi_dev_vhost_state *state;
1291 	uint32_t i;
1292 	int rc;
1293 
1294 	/* validate all I/O queues are in a contiguous index range */
1295 	for (i = VIRTIO_SCSI_REQUESTQ; i < vsession->max_queues; i++) {
1296 		if (vsession->virtqueue[i].vring.desc == NULL) {
1297 			SPDK_ERRLOG("%s: queue %"PRIu32" is empty\n", vsession->name, i);
1298 			rc = -1;
1299 			goto out;
1300 		}
1301 	}
1302 
1303 	rc = alloc_task_pool(svsession);
1304 	if (rc != 0) {
1305 		SPDK_ERRLOG("%s: failed to alloc task pool.\n", vsession->name);
1306 		goto out;
1307 	}
1308 
1309 	for (i = 0; i < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS; i++) {
1310 		state = &svdev->scsi_dev_state[i];
1311 		if (state->dev == NULL || state->status == VHOST_SCSI_DEV_REMOVING) {
1312 			continue;
1313 		}
1314 
1315 		assert(svsession->scsi_dev_state[i].status == VHOST_SCSI_DEV_EMPTY);
1316 		svsession->scsi_dev_state[i].dev = state->dev;
1317 		svsession->scsi_dev_state[i].status = VHOST_SCSI_DEV_PRESENT;
1318 		rc = spdk_scsi_dev_allocate_io_channels(state->dev);
1319 		if (rc != 0) {
1320 			SPDK_ERRLOG("%s: failed to alloc io_channel for SCSI target %"PRIu32"\n",
1321 				    vsession->name, i);
1322 			/* unset the SCSI target so that all I/O to it will be rejected */
1323 			svsession->scsi_dev_state[i].dev = NULL;
1324 			/* set EMPTY state so that we won't reply with SCSI hotremove
1325 			 * sense codes - the device hasn't ever been added.
1326 			 */
1327 			svsession->scsi_dev_state[i].status = VHOST_SCSI_DEV_EMPTY;
1328 			continue;
1329 		}
1330 	}
1331 	SPDK_INFOLOG(SPDK_LOG_VHOST, "%s: started poller on lcore %d\n",
1332 		     vsession->name, spdk_env_get_current_core());
1333 
1334 	svsession->requestq_poller = SPDK_POLLER_REGISTER(vdev_worker, svsession, 0);
1335 	if (vsession->virtqueue[VIRTIO_SCSI_CONTROLQ].vring.desc &&
1336 	    vsession->virtqueue[VIRTIO_SCSI_EVENTQ].vring.desc) {
1337 		svsession->mgmt_poller = SPDK_POLLER_REGISTER(vdev_mgmt_worker, svsession,
1338 					 MGMT_POLL_PERIOD_US);
1339 	}
1340 out:
1341 	vhost_session_start_done(vsession, rc);
1342 	return rc;
1343 }
1344 
1345 static int
1346 vhost_scsi_start(struct spdk_vhost_session *vsession)
1347 {
1348 	struct spdk_vhost_scsi_session *svsession = to_scsi_session(vsession);
1349 	struct spdk_vhost_scsi_dev *svdev;
1350 
1351 	svdev = to_scsi_dev(vsession->vdev);
1352 	assert(svdev != NULL);
1353 	svsession->svdev = svdev;
1354 
1355 	return vhost_session_send_event(vsession, vhost_scsi_start_cb,
1356 					3, "start session");
1357 }
1358 
1359 static int
1360 destroy_session_poller_cb(void *arg)
1361 {
1362 	struct spdk_vhost_scsi_session *svsession = arg;
1363 	struct spdk_vhost_session *vsession = &svsession->vsession;
1364 	struct spdk_scsi_dev_session_state *state;
1365 	uint32_t i;
1366 
1367 	if (vsession->task_cnt > 0) {
1368 		return -1;
1369 	}
1370 
1371 	if (spdk_vhost_trylock() != 0) {
1372 		return -1;
1373 	}
1374 
1375 	for (i = 0; i < vsession->max_queues; i++) {
1376 		vhost_vq_used_signal(vsession, &vsession->virtqueue[i]);
1377 	}
1378 
1379 	for (i = 0; i < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS; i++) {
1380 		enum spdk_scsi_dev_vhost_status prev_status;
1381 
1382 		state = &svsession->scsi_dev_state[i];
1383 		/* clear the REMOVED status so that we won't send hotremove events anymore */
1384 		prev_status = state->status;
1385 		state->status = VHOST_SCSI_DEV_EMPTY;
1386 		if (state->dev == NULL) {
1387 			continue;
1388 		}
1389 
1390 		spdk_scsi_dev_free_io_channels(state->dev);
1391 
1392 		state->dev = NULL;
1393 
1394 		if (prev_status == VHOST_SCSI_DEV_REMOVING) {
1395 			/* try to detach it globally */
1396 			vhost_dev_foreach_session(vsession->vdev,
1397 						  vhost_scsi_session_process_removed,
1398 						  vhost_scsi_dev_process_removed_cpl_cb,
1399 						  (void *)(uintptr_t)i);
1400 		}
1401 	}
1402 
1403 	SPDK_INFOLOG(SPDK_LOG_VHOST, "%s: stopping poller on lcore %d\n",
1404 		     vsession->name, spdk_env_get_current_core());
1405 
1406 	free_task_pool(svsession);
1407 
1408 	spdk_poller_unregister(&svsession->stop_poller);
1409 	vhost_session_stop_done(vsession, 0);
1410 
1411 	spdk_vhost_unlock();
1412 	return -1;
1413 }
1414 
1415 static int
1416 vhost_scsi_stop_cb(struct spdk_vhost_dev *vdev,
1417 		   struct spdk_vhost_session *vsession, void *unused)
1418 {
1419 	struct spdk_vhost_scsi_session *svsession = to_scsi_session(vsession);
1420 
1421 	/* Stop receiving new I/O requests */
1422 	spdk_poller_unregister(&svsession->requestq_poller);
1423 
1424 	/* Stop receiving controlq requests, also stop processing the
1425 	 * asynchronous hotremove events. All the remaining events
1426 	 * will be finalized by the stop_poller below.
1427 	 */
1428 	spdk_poller_unregister(&svsession->mgmt_poller);
1429 
1430 	/* Wait for all pending I/Os to complete, then process all the
1431 	 * remaining hotremove events one last time.
1432 	 */
1433 	svsession->stop_poller = SPDK_POLLER_REGISTER(destroy_session_poller_cb,
1434 				 svsession, 1000);
1435 
1436 	return 0;
1437 }
1438 
1439 static int
1440 vhost_scsi_stop(struct spdk_vhost_session *vsession)
1441 {
1442 	return vhost_session_send_event(vsession, vhost_scsi_stop_cb,
1443 					3, "stop session");
1444 }
1445 
1446 static void
1447 vhost_scsi_dump_info_json(struct spdk_vhost_dev *vdev, struct spdk_json_write_ctx *w)
1448 {
1449 	struct spdk_scsi_dev *sdev;
1450 	struct spdk_scsi_lun *lun;
1451 	uint32_t dev_idx;
1452 	uint32_t lun_idx;
1453 
1454 	assert(vdev != NULL);
1455 	spdk_json_write_named_array_begin(w, "scsi");
1456 	for (dev_idx = 0; dev_idx < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS; dev_idx++) {
1457 		sdev = spdk_vhost_scsi_dev_get_tgt(vdev, dev_idx);
1458 		if (!sdev) {
1459 			continue;
1460 		}
1461 
1462 		spdk_json_write_object_begin(w);
1463 
1464 		spdk_json_write_named_uint32(w, "scsi_dev_num", dev_idx);
1465 
1466 		spdk_json_write_named_uint32(w, "id", spdk_scsi_dev_get_id(sdev));
1467 
1468 		spdk_json_write_named_string(w, "target_name", spdk_scsi_dev_get_name(sdev));
1469 
1470 		spdk_json_write_named_array_begin(w, "luns");
1471 
1472 		for (lun_idx = 0; lun_idx < SPDK_SCSI_DEV_MAX_LUN; lun_idx++) {
1473 			lun = spdk_scsi_dev_get_lun(sdev, lun_idx);
1474 			if (!lun) {
1475 				continue;
1476 			}
1477 
1478 			spdk_json_write_object_begin(w);
1479 
1480 			spdk_json_write_named_int32(w, "id", spdk_scsi_lun_get_id(lun));
1481 
1482 			spdk_json_write_named_string(w, "bdev_name", spdk_scsi_lun_get_bdev_name(lun));
1483 
1484 			spdk_json_write_object_end(w);
1485 		}
1486 
1487 		spdk_json_write_array_end(w);
1488 		spdk_json_write_object_end(w);
1489 	}
1490 
1491 	spdk_json_write_array_end(w);
1492 }
1493 
1494 static void
1495 vhost_scsi_write_config_json(struct spdk_vhost_dev *vdev, struct spdk_json_write_ctx *w)
1496 {
1497 	struct spdk_scsi_dev *scsi_dev;
1498 	struct spdk_scsi_lun *lun;
1499 	uint32_t i;
1500 
1501 	spdk_json_write_object_begin(w);
1502 	spdk_json_write_named_string(w, "method", "vhost_create_scsi_controller");
1503 
1504 	spdk_json_write_named_object_begin(w, "params");
1505 	spdk_json_write_named_string(w, "ctrlr", vdev->name);
1506 	spdk_json_write_named_string(w, "cpumask",
1507 				     spdk_cpuset_fmt(spdk_thread_get_cpumask(vdev->thread)));
1508 	spdk_json_write_object_end(w);
1509 
1510 	spdk_json_write_object_end(w);
1511 
1512 	for (i = 0; i < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS; i++) {
1513 		scsi_dev = spdk_vhost_scsi_dev_get_tgt(vdev, i);
1514 		if (scsi_dev == NULL) {
1515 			continue;
1516 		}
1517 
1518 		lun = spdk_scsi_dev_get_lun(scsi_dev, 0);
1519 		assert(lun != NULL);
1520 
1521 		spdk_json_write_object_begin(w);
1522 		spdk_json_write_named_string(w, "method", "vhost_scsi_controller_add_target");
1523 
1524 		spdk_json_write_named_object_begin(w, "params");
1525 		spdk_json_write_named_string(w, "ctrlr", vdev->name);
1526 		spdk_json_write_named_uint32(w, "scsi_target_num", i);
1527 
1528 		spdk_json_write_named_string(w, "bdev_name", spdk_scsi_lun_get_bdev_name(lun));
1529 		spdk_json_write_object_end(w);
1530 
1531 		spdk_json_write_object_end(w);
1532 	}
1533 }
1534 
1535 SPDK_LOG_REGISTER_COMPONENT("vhost_scsi", SPDK_LOG_VHOST_SCSI)
1536 SPDK_LOG_REGISTER_COMPONENT("vhost_scsi_queue", SPDK_LOG_VHOST_SCSI_QUEUE)
1537 SPDK_LOG_REGISTER_COMPONENT("vhost_scsi_data", SPDK_LOG_VHOST_SCSI_DATA)
1538