xref: /spdk/lib/vhost/vhost_scsi.c (revision eb05cbd677aede19b5e52e6d91dbfb0d617fae54)
1 /*-
2  *   BSD LICENSE
3  *
4  *   Copyright(c) Intel Corporation. All rights reserved.
5  *   All rights reserved.
6  *
7  *   Redistribution and use in source and binary forms, with or without
8  *   modification, are permitted provided that the following conditions
9  *   are met:
10  *
11  *     * Redistributions of source code must retain the above copyright
12  *       notice, this list of conditions and the following disclaimer.
13  *     * Redistributions in binary form must reproduce the above copyright
14  *       notice, this list of conditions and the following disclaimer in
15  *       the documentation and/or other materials provided with the
16  *       distribution.
17  *     * Neither the name of Intel Corporation nor the names of its
18  *       contributors may be used to endorse or promote products derived
19  *       from this software without specific prior written permission.
20  *
21  *   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
22  *   "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
23  *   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
24  *   A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
25  *   OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
26  *   SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
27  *   LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
28  *   DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
29  *   THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
30  *   (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
31  *   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
32  */
33 
34 #include "spdk/stdinc.h"
35 
36 #include <linux/virtio_scsi.h>
37 
38 #include "spdk/env.h"
39 #include "spdk/thread.h"
40 #include "spdk/scsi.h"
41 #include "spdk/scsi_spec.h"
42 #include "spdk/conf.h"
43 #include "spdk/util.h"
44 #include "spdk/likely.h"
45 
46 #include "spdk/vhost.h"
47 #include "vhost_internal.h"
48 
49 /* Features supported by SPDK VHOST lib. */
50 #define SPDK_VHOST_SCSI_FEATURES	(SPDK_VHOST_FEATURES | \
51 					(1ULL << VIRTIO_SCSI_F_INOUT) | \
52 					(1ULL << VIRTIO_SCSI_F_HOTPLUG) | \
53 					(1ULL << VIRTIO_SCSI_F_CHANGE ) | \
54 					(1ULL << VIRTIO_SCSI_F_T10_PI ))
55 
56 /* Features that are specified in VIRTIO SCSI but currently not supported:
57  * - Live migration not supported yet
58  * - T10 PI
59  */
60 #define SPDK_VHOST_SCSI_DISABLED_FEATURES	(SPDK_VHOST_DISABLED_FEATURES | \
61 						(1ULL << VIRTIO_SCSI_F_T10_PI ))
62 
63 #define MGMT_POLL_PERIOD_US (1000 * 5)
64 
65 #define VIRTIO_SCSI_CONTROLQ   0
66 #define VIRTIO_SCSI_EVENTQ   1
67 #define VIRTIO_SCSI_REQUESTQ   2
68 
69 enum spdk_scsi_dev_vhost_status {
70 	/* Target ID is empty. */
71 	VHOST_SCSI_DEV_EMPTY,
72 
73 	/* Target is still being added. */
74 	VHOST_SCSI_DEV_ADDING,
75 
76 	/* Target ID occupied. */
77 	VHOST_SCSI_DEV_PRESENT,
78 
79 	/* Target ID is occupied but removal is in progress. */
80 	VHOST_SCSI_DEV_REMOVING,
81 
82 	/* In session - device (SCSI target) seen but removed. */
83 	VHOST_SCSI_DEV_REMOVED,
84 };
85 
86 /** Context for a SCSI target in a vhost device */
87 struct spdk_scsi_dev_vhost_state {
88 	struct spdk_scsi_dev *dev;
89 	enum spdk_scsi_dev_vhost_status status;
90 	spdk_vhost_event_fn remove_cb;
91 	void *remove_ctx;
92 };
93 
94 struct spdk_vhost_scsi_dev {
95 	int ref;
96 	bool registered;
97 	struct spdk_vhost_dev vdev;
98 	struct spdk_scsi_dev_vhost_state scsi_dev_state[SPDK_VHOST_SCSI_CTRLR_MAX_DEVS];
99 };
100 
101 /** Context for a SCSI target in a vhost session */
102 struct spdk_scsi_dev_session_state {
103 	struct spdk_scsi_dev *dev;
104 	enum spdk_scsi_dev_vhost_status status;
105 };
106 
107 struct spdk_vhost_scsi_session {
108 	struct spdk_vhost_session vsession;
109 
110 	struct spdk_vhost_scsi_dev *svdev;
111 	/** Local copy of the device state */
112 	struct spdk_scsi_dev_session_state scsi_dev_state[SPDK_VHOST_SCSI_CTRLR_MAX_DEVS];
113 	struct spdk_poller *requestq_poller;
114 	struct spdk_poller *mgmt_poller;
115 	struct spdk_poller *stop_poller;
116 };
117 
118 struct spdk_vhost_scsi_task {
119 	struct spdk_scsi_task	scsi;
120 	struct iovec iovs[SPDK_VHOST_IOVS_MAX];
121 
122 	union {
123 		struct virtio_scsi_cmd_resp *resp;
124 		struct virtio_scsi_ctrl_tmf_resp *tmf_resp;
125 	};
126 
127 	struct spdk_vhost_scsi_session *svsession;
128 	struct spdk_scsi_dev *scsi_dev;
129 
130 	/** Number of bytes that were written. */
131 	uint32_t used_len;
132 
133 	int req_idx;
134 
135 	/* If set, the task is currently used for I/O processing. */
136 	bool used;
137 
138 	struct spdk_vhost_virtqueue *vq;
139 };
140 
141 static int vhost_scsi_start(struct spdk_vhost_session *vsession);
142 static int vhost_scsi_stop(struct spdk_vhost_session *vsession);
143 static void vhost_scsi_dump_info_json(struct spdk_vhost_dev *vdev,
144 				      struct spdk_json_write_ctx *w);
145 static void vhost_scsi_write_config_json(struct spdk_vhost_dev *vdev,
146 		struct spdk_json_write_ctx *w);
147 static int vhost_scsi_dev_remove(struct spdk_vhost_dev *vdev);
148 
149 static const struct spdk_vhost_dev_backend spdk_vhost_scsi_device_backend = {
150 	.session_ctx_size = sizeof(struct spdk_vhost_scsi_session) - sizeof(struct spdk_vhost_session),
151 	.start_session =  vhost_scsi_start,
152 	.stop_session = vhost_scsi_stop,
153 	.dump_info_json = vhost_scsi_dump_info_json,
154 	.write_config_json = vhost_scsi_write_config_json,
155 	.remove_device = vhost_scsi_dev_remove,
156 };
157 
158 static inline void
159 scsi_task_init(struct spdk_vhost_scsi_task *task)
160 {
161 	memset(&task->scsi, 0, sizeof(task->scsi));
162 	/* Tmf_resp pointer and resp pointer are in a union.
163 	 * Here means task->tmf_resp = task->resp = NULL.
164 	 */
165 	task->resp = NULL;
166 	task->used = true;
167 	task->used_len = 0;
168 }
169 
170 static void
171 vhost_scsi_task_put(struct spdk_vhost_scsi_task *task)
172 {
173 	spdk_scsi_task_put(&task->scsi);
174 }
175 
176 static void
177 vhost_scsi_task_free_cb(struct spdk_scsi_task *scsi_task)
178 {
179 	struct spdk_vhost_scsi_task *task = SPDK_CONTAINEROF(scsi_task, struct spdk_vhost_scsi_task, scsi);
180 	struct spdk_vhost_session *vsession = &task->svsession->vsession;
181 
182 	assert(vsession->task_cnt > 0);
183 	vsession->task_cnt--;
184 	task->used = false;
185 }
186 
187 static void
188 remove_scsi_tgt(struct spdk_vhost_scsi_dev *svdev,
189 		unsigned scsi_tgt_num)
190 {
191 	struct spdk_scsi_dev_vhost_state *state;
192 	struct spdk_scsi_dev *dev;
193 
194 	state = &svdev->scsi_dev_state[scsi_tgt_num];
195 	dev = state->dev;
196 	state->dev = NULL;
197 	assert(state->status == VHOST_SCSI_DEV_REMOVING);
198 	state->status = VHOST_SCSI_DEV_EMPTY;
199 	spdk_scsi_dev_destruct(dev, NULL, NULL);
200 	if (state->remove_cb) {
201 		state->remove_cb(&svdev->vdev, state->remove_ctx);
202 		state->remove_cb = NULL;
203 	}
204 	SPDK_INFOLOG(SPDK_LOG_VHOST, "%s: removed target 'Target %u'\n",
205 		     svdev->vdev.name, scsi_tgt_num);
206 
207 	if (--svdev->ref == 0 && svdev->registered == false) {
208 		free(svdev);
209 	}
210 }
211 
212 static void
213 vhost_scsi_dev_process_removed_cpl_cb(struct spdk_vhost_dev *vdev, void *ctx)
214 {
215 	unsigned scsi_tgt_num = (unsigned)(uintptr_t)ctx;
216 	struct spdk_vhost_scsi_dev *svdev = SPDK_CONTAINEROF(vdev,
217 					    struct spdk_vhost_scsi_dev, vdev);
218 
219 	/* all sessions have already detached the device */
220 	if (svdev->scsi_dev_state[scsi_tgt_num].status != VHOST_SCSI_DEV_REMOVING) {
221 		/* device was already removed in the meantime */
222 		return;
223 	}
224 
225 	remove_scsi_tgt(svdev, scsi_tgt_num);
226 }
227 
228 static int
229 vhost_scsi_session_process_removed(struct spdk_vhost_dev *vdev,
230 				   struct spdk_vhost_session *vsession, void *ctx)
231 {
232 	unsigned scsi_tgt_num = (unsigned)(uintptr_t)ctx;
233 	struct spdk_vhost_scsi_session *svsession = (struct spdk_vhost_scsi_session *)vsession;
234 	struct spdk_scsi_dev_session_state *state = &svsession->scsi_dev_state[scsi_tgt_num];
235 
236 	if (state->dev != NULL) {
237 		/* there's still a session that references this device,
238 		 * so abort our foreach chain here. We'll be called
239 		 * again from this session's management poller after it
240 		 * is removed in there
241 		 */
242 		return -1;
243 	}
244 
245 	return 0;
246 }
247 
248 static void
249 process_removed_devs(struct spdk_vhost_scsi_session *svsession)
250 {
251 	struct spdk_scsi_dev *dev;
252 	struct spdk_scsi_dev_session_state *state;
253 	int i;
254 
255 	for (i = 0; i < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS; ++i) {
256 		state = &svsession->scsi_dev_state[i];
257 		dev = state->dev;
258 
259 		if (dev && state->status == VHOST_SCSI_DEV_REMOVING &&
260 		    !spdk_scsi_dev_has_pending_tasks(dev, NULL)) {
261 			/* detach the device from this session */
262 			spdk_scsi_dev_free_io_channels(dev);
263 			state->dev = NULL;
264 			state->status = VHOST_SCSI_DEV_REMOVED;
265 			/* try to detach it globally */
266 			spdk_vhost_lock();
267 			vhost_dev_foreach_session(&svsession->svdev->vdev,
268 						  vhost_scsi_session_process_removed,
269 						  vhost_scsi_dev_process_removed_cpl_cb,
270 						  (void *)(uintptr_t)i);
271 			spdk_vhost_unlock();
272 		}
273 	}
274 }
275 
276 static void
277 eventq_enqueue(struct spdk_vhost_scsi_session *svsession, unsigned scsi_dev_num,
278 	       uint32_t event, uint32_t reason)
279 {
280 	struct spdk_vhost_session *vsession = &svsession->vsession;
281 	struct spdk_vhost_virtqueue *vq;
282 	struct vring_desc *desc, *desc_table;
283 	struct virtio_scsi_event *desc_ev;
284 	uint32_t desc_table_size, req_size = 0;
285 	uint16_t req;
286 	int rc;
287 
288 	assert(scsi_dev_num < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS);
289 	vq = &vsession->virtqueue[VIRTIO_SCSI_EVENTQ];
290 
291 	if (vq->vring.desc == NULL || vhost_vq_avail_ring_get(vq, &req, 1) != 1) {
292 		SPDK_ERRLOG("%s: failed to send virtio event (no avail ring entries?).\n",
293 			    vsession->name);
294 		return;
295 	}
296 
297 	rc = vhost_vq_get_desc(vsession, vq, req, &desc, &desc_table, &desc_table_size);
298 	if (rc != 0 || desc->len < sizeof(*desc_ev)) {
299 		SPDK_ERRLOG("%s: invalid eventq descriptor at index %"PRIu16".\n",
300 			    vsession->name, req);
301 		goto out;
302 	}
303 
304 	desc_ev = vhost_gpa_to_vva(vsession, desc->addr, sizeof(*desc_ev));
305 	if (desc_ev == NULL) {
306 		SPDK_ERRLOG("%s: eventq descriptor at index %"PRIu16" points "
307 			    "to unmapped guest memory address %p.\n",
308 			    vsession->name, req, (void *)(uintptr_t)desc->addr);
309 		goto out;
310 	}
311 
312 	desc_ev->event = event;
313 	desc_ev->lun[0] = 1;
314 	desc_ev->lun[1] = scsi_dev_num;
315 	/* virtio LUN id 0 can refer either to the entire device
316 	 * or actual LUN 0 (the only supported by vhost for now)
317 	 */
318 	desc_ev->lun[2] = 0 >> 8;
319 	desc_ev->lun[3] = 0 & 0xFF;
320 	/* virtio doesn't specify any strict format for LUN id (bytes 2 and 3)
321 	 * current implementation relies on linux kernel sources
322 	 */
323 	memset(&desc_ev->lun[4], 0, 4);
324 	desc_ev->reason = reason;
325 	req_size = sizeof(*desc_ev);
326 
327 out:
328 	vhost_vq_used_ring_enqueue(vsession, vq, req, req_size);
329 }
330 
331 static void
332 submit_completion(struct spdk_vhost_scsi_task *task)
333 {
334 	struct spdk_vhost_session *vsession = &task->svsession->vsession;
335 
336 	vhost_vq_used_ring_enqueue(vsession, task->vq, task->req_idx,
337 				   task->used_len);
338 	SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI, "Finished task (%p) req_idx=%d\n", task, task->req_idx);
339 
340 	vhost_scsi_task_put(task);
341 }
342 
343 static void
344 vhost_scsi_task_mgmt_cpl(struct spdk_scsi_task *scsi_task)
345 {
346 	struct spdk_vhost_scsi_task *task = SPDK_CONTAINEROF(scsi_task, struct spdk_vhost_scsi_task, scsi);
347 
348 	submit_completion(task);
349 }
350 
351 static void
352 vhost_scsi_task_cpl(struct spdk_scsi_task *scsi_task)
353 {
354 	struct spdk_vhost_scsi_task *task = SPDK_CONTAINEROF(scsi_task, struct spdk_vhost_scsi_task, scsi);
355 
356 	/* The SCSI task has completed.  Do final processing and then post
357 	   notification to the virtqueue's "used" ring.
358 	 */
359 	task->resp->status = task->scsi.status;
360 
361 	if (task->scsi.status != SPDK_SCSI_STATUS_GOOD) {
362 		memcpy(task->resp->sense, task->scsi.sense_data, task->scsi.sense_data_len);
363 		task->resp->sense_len = task->scsi.sense_data_len;
364 		SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI, "Task (%p) req_idx=%d failed - status=%u\n", task, task->req_idx,
365 			      task->scsi.status);
366 	}
367 	assert(task->scsi.transfer_len == task->scsi.length);
368 	task->resp->resid = task->scsi.length - task->scsi.data_transferred;
369 
370 	submit_completion(task);
371 }
372 
373 static void
374 task_submit(struct spdk_vhost_scsi_task *task)
375 {
376 	task->resp->response = VIRTIO_SCSI_S_OK;
377 	spdk_scsi_dev_queue_task(task->scsi_dev, &task->scsi);
378 }
379 
380 static void
381 mgmt_task_submit(struct spdk_vhost_scsi_task *task, enum spdk_scsi_task_func func)
382 {
383 	task->tmf_resp->response = VIRTIO_SCSI_S_OK;
384 	task->scsi.function = func;
385 	spdk_scsi_dev_queue_mgmt_task(task->scsi_dev, &task->scsi);
386 }
387 
388 static void
389 invalid_request(struct spdk_vhost_scsi_task *task)
390 {
391 	struct spdk_vhost_session *vsession = &task->svsession->vsession;
392 
393 	vhost_vq_used_ring_enqueue(vsession, task->vq, task->req_idx,
394 				   task->used_len);
395 	vhost_scsi_task_put(task);
396 
397 	SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI, "Invalid request (status=%" PRIu8")\n",
398 		      task->resp ? task->resp->response : -1);
399 }
400 
401 static int
402 vhost_scsi_task_init_target(struct spdk_vhost_scsi_task *task, const __u8 *lun)
403 {
404 	struct spdk_vhost_scsi_session *svsession = task->svsession;
405 	struct spdk_scsi_dev_session_state *state;
406 	uint16_t lun_id = (((uint16_t)lun[2] << 8) | lun[3]) & 0x3FFF;
407 
408 	SPDK_LOGDUMP(SPDK_LOG_VHOST_SCSI_QUEUE, "LUN", lun, 8);
409 
410 	/* First byte must be 1 and second is target */
411 	if (lun[0] != 1 || lun[1] >= SPDK_VHOST_SCSI_CTRLR_MAX_DEVS) {
412 		return -1;
413 	}
414 
415 	state = &svsession->scsi_dev_state[lun[1]];
416 	task->scsi_dev = state->dev;
417 	if (state->dev == NULL || state->status != VHOST_SCSI_DEV_PRESENT) {
418 		/* If dev has been hotdetached, return 0 to allow sending
419 		 * additional hotremove event via sense codes.
420 		 */
421 		return state->status != VHOST_SCSI_DEV_EMPTY ? 0 : -1;
422 	}
423 
424 	task->scsi.target_port = spdk_scsi_dev_find_port_by_id(task->scsi_dev, 0);
425 	task->scsi.lun = spdk_scsi_dev_get_lun(state->dev, lun_id);
426 	return 0;
427 }
428 
429 static void
430 process_ctrl_request(struct spdk_vhost_scsi_task *task)
431 {
432 	struct spdk_vhost_session *vsession = &task->svsession->vsession;
433 	struct vring_desc *desc, *desc_table;
434 	struct virtio_scsi_ctrl_tmf_req *ctrl_req;
435 	struct virtio_scsi_ctrl_an_resp *an_resp;
436 	uint32_t desc_table_size, used_len = 0;
437 	int rc;
438 
439 	spdk_scsi_task_construct(&task->scsi, vhost_scsi_task_mgmt_cpl, vhost_scsi_task_free_cb);
440 	rc = vhost_vq_get_desc(vsession, task->vq, task->req_idx, &desc, &desc_table,
441 			       &desc_table_size);
442 	if (spdk_unlikely(rc != 0)) {
443 		SPDK_ERRLOG("%s: invalid controlq descriptor at index %d.\n",
444 			    vsession->name, task->req_idx);
445 		goto out;
446 	}
447 
448 	ctrl_req = vhost_gpa_to_vva(vsession, desc->addr, sizeof(*ctrl_req));
449 	if (ctrl_req == NULL) {
450 		SPDK_ERRLOG("%s: invalid task management request at index %d.\n",
451 			    vsession->name, task->req_idx);
452 		goto out;
453 	}
454 
455 	SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI_QUEUE,
456 		      "Processing controlq descriptor: desc %d/%p, desc_addr %p, len %d, flags %d, last_used_idx %d; kickfd %d; size %d\n",
457 		      task->req_idx, desc, (void *)desc->addr, desc->len, desc->flags, task->vq->last_used_idx,
458 		      task->vq->vring.kickfd, task->vq->vring.size);
459 	SPDK_LOGDUMP(SPDK_LOG_VHOST_SCSI_QUEUE, "Request descriptor", (uint8_t *)ctrl_req, desc->len);
460 
461 	vhost_scsi_task_init_target(task, ctrl_req->lun);
462 
463 	vhost_vring_desc_get_next(&desc, desc_table, desc_table_size);
464 	if (spdk_unlikely(desc == NULL)) {
465 		SPDK_ERRLOG("%s: no response descriptor for controlq request %d.\n",
466 			    vsession->name, task->req_idx);
467 		goto out;
468 	}
469 
470 	/* Process the TMF request */
471 	switch (ctrl_req->type) {
472 	case VIRTIO_SCSI_T_TMF:
473 		task->tmf_resp = vhost_gpa_to_vva(vsession, desc->addr, sizeof(*task->tmf_resp));
474 		if (spdk_unlikely(desc->len < sizeof(struct virtio_scsi_ctrl_tmf_resp) || task->tmf_resp == NULL)) {
475 			SPDK_ERRLOG("%s: TMF response descriptor at index %d points to invalid guest memory region\n",
476 				    vsession->name, task->req_idx);
477 			goto out;
478 		}
479 
480 		/* Check if we are processing a valid request */
481 		if (task->scsi_dev == NULL) {
482 			task->tmf_resp->response = VIRTIO_SCSI_S_BAD_TARGET;
483 			break;
484 		}
485 
486 		switch (ctrl_req->subtype) {
487 		case VIRTIO_SCSI_T_TMF_LOGICAL_UNIT_RESET:
488 			/* Handle LUN reset */
489 			SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI_QUEUE, "%s: LUN reset\n", vsession->name);
490 
491 			mgmt_task_submit(task, SPDK_SCSI_TASK_FUNC_LUN_RESET);
492 			return;
493 		default:
494 			task->tmf_resp->response = VIRTIO_SCSI_S_ABORTED;
495 			/* Unsupported command */
496 			SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI_QUEUE, "%s: unsupported TMF command %x\n",
497 				      vsession->name, ctrl_req->subtype);
498 			break;
499 		}
500 		break;
501 	case VIRTIO_SCSI_T_AN_QUERY:
502 	case VIRTIO_SCSI_T_AN_SUBSCRIBE: {
503 		an_resp = vhost_gpa_to_vva(vsession, desc->addr, sizeof(*an_resp));
504 		if (spdk_unlikely(desc->len < sizeof(struct virtio_scsi_ctrl_an_resp) || an_resp == NULL)) {
505 			SPDK_WARNLOG("%s: asynchronous response descriptor points to invalid guest memory region\n",
506 				     vsession->name);
507 			goto out;
508 		}
509 
510 		an_resp->response = VIRTIO_SCSI_S_ABORTED;
511 		break;
512 	}
513 	default:
514 		SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI_QUEUE, "%s: Unsupported control command %x\n",
515 			      vsession->name, ctrl_req->type);
516 		break;
517 	}
518 
519 	used_len = sizeof(struct virtio_scsi_ctrl_tmf_resp);
520 out:
521 	vhost_vq_used_ring_enqueue(vsession, task->vq, task->req_idx, used_len);
522 	vhost_scsi_task_put(task);
523 }
524 
525 /*
526  * Process task's descriptor chain and setup data related fields.
527  * Return
528  *   -1 if request is invalid and must be aborted,
529  *    0 if all data are set.
530  */
531 static int
532 task_data_setup(struct spdk_vhost_scsi_task *task,
533 		struct virtio_scsi_cmd_req **req)
534 {
535 	struct spdk_vhost_session *vsession = &task->svsession->vsession;
536 	struct vring_desc *desc, *desc_table;
537 	struct iovec *iovs = task->iovs;
538 	uint16_t iovcnt = 0;
539 	uint32_t desc_table_len, len = 0;
540 	int rc;
541 
542 	spdk_scsi_task_construct(&task->scsi, vhost_scsi_task_cpl, vhost_scsi_task_free_cb);
543 
544 	rc = vhost_vq_get_desc(vsession, task->vq, task->req_idx, &desc, &desc_table, &desc_table_len);
545 	/* First descriptor must be readable */
546 	if (spdk_unlikely(rc != 0  || vhost_vring_desc_is_wr(desc) ||
547 			  desc->len < sizeof(struct virtio_scsi_cmd_req))) {
548 		SPDK_WARNLOG("%s: invalid first request descriptor at index %"PRIu16".\n",
549 			     vsession->name, task->req_idx);
550 		goto invalid_task;
551 	}
552 
553 	*req = vhost_gpa_to_vva(vsession, desc->addr, sizeof(**req));
554 	if (spdk_unlikely(*req == NULL)) {
555 		SPDK_WARNLOG("%s: request descriptor at index %d points to invalid guest memory region\n",
556 			     vsession->name, task->req_idx);
557 		goto invalid_task;
558 	}
559 
560 	/* Each request must have at least 2 descriptors (e.g. request and response) */
561 	vhost_vring_desc_get_next(&desc, desc_table, desc_table_len);
562 	if (desc == NULL) {
563 		SPDK_WARNLOG("%s: descriptor chain at index %d contains neither payload nor response buffer.\n",
564 			     vsession->name, task->req_idx);
565 		goto invalid_task;
566 	}
567 	task->scsi.dxfer_dir = vhost_vring_desc_is_wr(desc) ? SPDK_SCSI_DIR_FROM_DEV :
568 			       SPDK_SCSI_DIR_TO_DEV;
569 	task->scsi.iovs = iovs;
570 
571 	if (task->scsi.dxfer_dir == SPDK_SCSI_DIR_FROM_DEV) {
572 		/*
573 		 * FROM_DEV (READ): [RD_req][WR_resp][WR_buf0]...[WR_bufN]
574 		 */
575 		task->resp = vhost_gpa_to_vva(vsession, desc->addr, sizeof(*task->resp));
576 		if (spdk_unlikely(desc->len < sizeof(struct virtio_scsi_cmd_resp) || task->resp == NULL)) {
577 			SPDK_WARNLOG("%s: response descriptor at index %d points to invalid guest memory region\n",
578 				     vsession->name, task->req_idx);
579 			goto invalid_task;
580 		}
581 		rc = vhost_vring_desc_get_next(&desc, desc_table, desc_table_len);
582 		if (spdk_unlikely(rc != 0)) {
583 			SPDK_WARNLOG("%s: invalid descriptor chain at request index %d (descriptor id overflow?).\n",
584 				     vsession->name, task->req_idx);
585 			goto invalid_task;
586 		}
587 
588 		if (desc == NULL) {
589 			/*
590 			 * TEST UNIT READY command and some others might not contain any payload and this is not an error.
591 			 */
592 			SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI_DATA,
593 				      "No payload descriptors for FROM DEV command req_idx=%"PRIu16".\n", task->req_idx);
594 			SPDK_LOGDUMP(SPDK_LOG_VHOST_SCSI_DATA, "CDB=", (*req)->cdb, VIRTIO_SCSI_CDB_SIZE);
595 			task->used_len = sizeof(struct virtio_scsi_cmd_resp);
596 			task->scsi.iovcnt = 1;
597 			task->scsi.iovs[0].iov_len = 0;
598 			task->scsi.length = 0;
599 			task->scsi.transfer_len = 0;
600 			return 0;
601 		}
602 
603 		/* All remaining descriptors are data. */
604 		while (desc) {
605 			if (spdk_unlikely(!vhost_vring_desc_is_wr(desc))) {
606 				SPDK_WARNLOG("%s: FROM DEV cmd: descriptor nr %" PRIu16" in payload chain is read only.\n",
607 					     vsession->name, iovcnt);
608 				goto invalid_task;
609 			}
610 
611 			if (spdk_unlikely(vhost_vring_desc_to_iov(vsession, iovs, &iovcnt, desc))) {
612 				goto invalid_task;
613 			}
614 			len += desc->len;
615 
616 			rc = vhost_vring_desc_get_next(&desc, desc_table, desc_table_len);
617 			if (spdk_unlikely(rc != 0)) {
618 				SPDK_WARNLOG("%s: invalid payload in descriptor chain starting at index %d.\n",
619 					     vsession->name, task->req_idx);
620 				goto invalid_task;
621 			}
622 		}
623 
624 		task->used_len = sizeof(struct virtio_scsi_cmd_resp) + len;
625 	} else {
626 		SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI_DATA, "TO DEV");
627 		/*
628 		 * TO_DEV (WRITE):[RD_req][RD_buf0]...[RD_bufN][WR_resp]
629 		 * No need to check descriptor WR flag as this is done while setting scsi.dxfer_dir.
630 		 */
631 
632 		/* Process descriptors up to response. */
633 		while (!vhost_vring_desc_is_wr(desc)) {
634 			if (spdk_unlikely(vhost_vring_desc_to_iov(vsession, iovs, &iovcnt, desc))) {
635 				goto invalid_task;
636 			}
637 			len += desc->len;
638 
639 			vhost_vring_desc_get_next(&desc, desc_table, desc_table_len);
640 			if (spdk_unlikely(desc == NULL)) {
641 				SPDK_WARNLOG("%s: TO_DEV cmd: no response descriptor.\n", vsession->name);
642 				goto invalid_task;
643 			}
644 		}
645 
646 		task->resp = vhost_gpa_to_vva(vsession, desc->addr, sizeof(*task->resp));
647 		if (spdk_unlikely(desc->len < sizeof(struct virtio_scsi_cmd_resp) || task->resp == NULL)) {
648 			SPDK_WARNLOG("%s: response descriptor at index %d points to invalid guest memory region\n",
649 				     vsession->name, task->req_idx);
650 			goto invalid_task;
651 		}
652 
653 		task->used_len = sizeof(struct virtio_scsi_cmd_resp);
654 	}
655 
656 	task->scsi.iovcnt = iovcnt;
657 	task->scsi.length = len;
658 	task->scsi.transfer_len = len;
659 	return 0;
660 
661 invalid_task:
662 	SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI_DATA, "%s: Invalid task at index %"PRIu16".\n",
663 		      vsession->name, task->req_idx);
664 	return -1;
665 }
666 
667 static int
668 process_request(struct spdk_vhost_scsi_task *task)
669 {
670 	struct virtio_scsi_cmd_req *req;
671 	int result;
672 
673 	result = task_data_setup(task, &req);
674 	if (result) {
675 		return result;
676 	}
677 
678 	result = vhost_scsi_task_init_target(task, req->lun);
679 	if (spdk_unlikely(result != 0)) {
680 		task->resp->response = VIRTIO_SCSI_S_BAD_TARGET;
681 		return -1;
682 	}
683 
684 	task->scsi.cdb = req->cdb;
685 	SPDK_LOGDUMP(SPDK_LOG_VHOST_SCSI_DATA, "request CDB", req->cdb, VIRTIO_SCSI_CDB_SIZE);
686 
687 	if (spdk_unlikely(task->scsi.lun == NULL)) {
688 		spdk_scsi_task_process_null_lun(&task->scsi);
689 		task->resp->response = VIRTIO_SCSI_S_OK;
690 		return 1;
691 	}
692 
693 	return 0;
694 }
695 
696 static void
697 process_scsi_task(struct spdk_vhost_session *vsession,
698 		  struct spdk_vhost_virtqueue *vq,
699 		  uint16_t req_idx)
700 {
701 	struct spdk_vhost_scsi_task *task;
702 	int result;
703 
704 	task = &((struct spdk_vhost_scsi_task *)vq->tasks)[req_idx];
705 	if (spdk_unlikely(task->used)) {
706 		SPDK_ERRLOG("%s: request with idx '%"PRIu16"' is already pending.\n",
707 			    vsession->name, req_idx);
708 		vhost_vq_used_ring_enqueue(vsession, vq, req_idx, 0);
709 		return;
710 	}
711 
712 	vsession->task_cnt++;
713 	scsi_task_init(task);
714 
715 	if (spdk_unlikely(vq->vring_idx == VIRTIO_SCSI_CONTROLQ)) {
716 		process_ctrl_request(task);
717 	} else {
718 		result = process_request(task);
719 		if (likely(result == 0)) {
720 			task_submit(task);
721 			SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI, "====== Task %p req_idx %d submitted ======\n", task,
722 				      task->req_idx);
723 		} else if (result > 0) {
724 			vhost_scsi_task_cpl(&task->scsi);
725 			SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI, "====== Task %p req_idx %d finished early ======\n", task,
726 				      task->req_idx);
727 		} else {
728 			invalid_request(task);
729 			SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI, "====== Task %p req_idx %d failed ======\n", task,
730 				      task->req_idx);
731 		}
732 	}
733 }
734 
735 static void
736 process_vq(struct spdk_vhost_scsi_session *svsession, struct spdk_vhost_virtqueue *vq)
737 {
738 	struct spdk_vhost_session *vsession = &svsession->vsession;
739 	uint16_t reqs[32];
740 	uint16_t reqs_cnt, i;
741 
742 	reqs_cnt = vhost_vq_avail_ring_get(vq, reqs, SPDK_COUNTOF(reqs));
743 	assert(reqs_cnt <= 32);
744 
745 	for (i = 0; i < reqs_cnt; i++) {
746 		SPDK_DEBUGLOG(SPDK_LOG_VHOST_SCSI, "====== Starting processing request idx %"PRIu16"======\n",
747 			      reqs[i]);
748 
749 		if (spdk_unlikely(reqs[i] >= vq->vring.size)) {
750 			SPDK_ERRLOG("%s: request idx '%"PRIu16"' exceeds virtqueue size (%"PRIu16").\n",
751 				    vsession->name, reqs[i], vq->vring.size);
752 			vhost_vq_used_ring_enqueue(vsession, vq, reqs[i], 0);
753 			continue;
754 		}
755 
756 		process_scsi_task(vsession, vq, reqs[i]);
757 	}
758 }
759 
760 static int
761 vdev_mgmt_worker(void *arg)
762 {
763 	struct spdk_vhost_scsi_session *svsession = arg;
764 	struct spdk_vhost_session *vsession = &svsession->vsession;
765 
766 	process_removed_devs(svsession);
767 	vhost_vq_used_signal(vsession, &vsession->virtqueue[VIRTIO_SCSI_EVENTQ]);
768 
769 	process_vq(svsession, &vsession->virtqueue[VIRTIO_SCSI_CONTROLQ]);
770 	vhost_vq_used_signal(vsession, &vsession->virtqueue[VIRTIO_SCSI_CONTROLQ]);
771 
772 	return SPDK_POLLER_BUSY;
773 }
774 
775 static int
776 vdev_worker(void *arg)
777 {
778 	struct spdk_vhost_scsi_session *svsession = arg;
779 	struct spdk_vhost_session *vsession = &svsession->vsession;
780 	uint32_t q_idx;
781 
782 	for (q_idx = VIRTIO_SCSI_REQUESTQ; q_idx < vsession->max_queues; q_idx++) {
783 		process_vq(svsession, &vsession->virtqueue[q_idx]);
784 	}
785 
786 	vhost_session_used_signal(vsession);
787 
788 	return SPDK_POLLER_BUSY;
789 }
790 
791 static struct spdk_vhost_scsi_dev *
792 to_scsi_dev(struct spdk_vhost_dev *ctrlr)
793 {
794 	if (ctrlr == NULL) {
795 		return NULL;
796 	}
797 
798 	if (ctrlr->backend != &spdk_vhost_scsi_device_backend) {
799 		SPDK_ERRLOG("%s: not a vhost-scsi device.\n", ctrlr->name);
800 		return NULL;
801 	}
802 
803 	return SPDK_CONTAINEROF(ctrlr, struct spdk_vhost_scsi_dev, vdev);
804 }
805 
806 static struct spdk_vhost_scsi_session *
807 to_scsi_session(struct spdk_vhost_session *vsession)
808 {
809 	assert(vsession->vdev->backend == &spdk_vhost_scsi_device_backend);
810 	return (struct spdk_vhost_scsi_session *)vsession;
811 }
812 
813 int
814 spdk_vhost_scsi_dev_construct(const char *name, const char *cpumask)
815 {
816 	struct spdk_vhost_scsi_dev *svdev = calloc(1, sizeof(*svdev));
817 	int rc;
818 
819 	if (svdev == NULL) {
820 		return -ENOMEM;
821 	}
822 
823 	svdev->vdev.virtio_features = SPDK_VHOST_SCSI_FEATURES;
824 	svdev->vdev.disabled_features = SPDK_VHOST_SCSI_DISABLED_FEATURES;
825 
826 	spdk_vhost_lock();
827 	rc = vhost_dev_register(&svdev->vdev, name, cpumask,
828 				&spdk_vhost_scsi_device_backend);
829 
830 	if (rc) {
831 		free(svdev);
832 		spdk_vhost_unlock();
833 		return rc;
834 	}
835 
836 	svdev->registered = true;
837 
838 	spdk_vhost_unlock();
839 	return rc;
840 }
841 
842 static int
843 vhost_scsi_dev_remove(struct spdk_vhost_dev *vdev)
844 {
845 	struct spdk_vhost_scsi_dev *svdev = to_scsi_dev(vdev);
846 	int rc, i;
847 
848 	assert(svdev != NULL);
849 	for (i = 0; i < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS; ++i) {
850 		if (svdev->scsi_dev_state[i].dev) {
851 			if (vdev->registered) {
852 				SPDK_ERRLOG("%s: SCSI target %d is still present.\n", vdev->name, i);
853 				return -EBUSY;
854 			}
855 
856 			rc = spdk_vhost_scsi_dev_remove_tgt(vdev, i, NULL, NULL);
857 			if (rc != 0) {
858 				SPDK_ERRLOG("%s: failed to force-remove target %d\n", vdev->name, i);
859 				return rc;
860 			}
861 		}
862 	}
863 
864 	rc = vhost_dev_unregister(vdev);
865 	if (rc != 0) {
866 		return rc;
867 	}
868 	svdev->registered = false;
869 
870 	if (svdev->ref == 0) {
871 		free(svdev);
872 	}
873 
874 	return 0;
875 }
876 
877 struct spdk_scsi_dev *
878 spdk_vhost_scsi_dev_get_tgt(struct spdk_vhost_dev *vdev, uint8_t num)
879 {
880 	struct spdk_vhost_scsi_dev *svdev;
881 
882 	assert(num < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS);
883 	svdev = to_scsi_dev(vdev);
884 	assert(svdev != NULL);
885 	if (svdev->scsi_dev_state[num].status != VHOST_SCSI_DEV_PRESENT) {
886 		return NULL;
887 	}
888 
889 	assert(svdev->scsi_dev_state[num].dev != NULL);
890 	return svdev->scsi_dev_state[num].dev;
891 }
892 
893 static void
894 vhost_scsi_lun_hotremove(const struct spdk_scsi_lun *lun, void *arg)
895 {
896 	struct spdk_vhost_scsi_dev *svdev = arg;
897 	const struct spdk_scsi_dev *scsi_dev;
898 	unsigned scsi_dev_num;
899 
900 	assert(lun != NULL);
901 	assert(svdev != NULL);
902 	scsi_dev = spdk_scsi_lun_get_dev(lun);
903 	for (scsi_dev_num = 0; scsi_dev_num < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS; scsi_dev_num++) {
904 		if (svdev->scsi_dev_state[scsi_dev_num].dev == scsi_dev) {
905 			break;
906 		}
907 	}
908 
909 	if (scsi_dev_num == SPDK_VHOST_SCSI_CTRLR_MAX_DEVS) {
910 		/* The entire device has been already removed. */
911 		return;
912 	}
913 
914 	/* remove entire device */
915 	spdk_vhost_scsi_dev_remove_tgt(&svdev->vdev, scsi_dev_num, NULL, NULL);
916 }
917 
918 static void
919 vhost_scsi_dev_add_tgt_cpl_cb(struct spdk_vhost_dev *vdev, void *ctx)
920 {
921 	unsigned scsi_tgt_num = (unsigned)(uintptr_t)ctx;
922 	struct spdk_vhost_scsi_dev *svdev = SPDK_CONTAINEROF(vdev,
923 					    struct spdk_vhost_scsi_dev, vdev);
924 	struct spdk_scsi_dev_vhost_state *vhost_sdev;
925 
926 	vhost_sdev = &svdev->scsi_dev_state[scsi_tgt_num];
927 
928 	/* All sessions have added the target */
929 	assert(vhost_sdev->status == VHOST_SCSI_DEV_ADDING);
930 	vhost_sdev->status = VHOST_SCSI_DEV_PRESENT;
931 	svdev->ref++;
932 }
933 
934 static int
935 vhost_scsi_session_add_tgt(struct spdk_vhost_dev *vdev,
936 			   struct spdk_vhost_session *vsession, void *ctx)
937 {
938 	unsigned scsi_tgt_num = (unsigned)(uintptr_t)ctx;
939 	struct spdk_vhost_scsi_session *svsession = (struct spdk_vhost_scsi_session *)vsession;
940 	struct spdk_scsi_dev_session_state *session_sdev = &svsession->scsi_dev_state[scsi_tgt_num];
941 	struct spdk_scsi_dev_vhost_state *vhost_sdev;
942 	int rc;
943 
944 	if (!vsession->started || session_sdev->dev != NULL) {
945 		/* Nothing to do. */
946 		return 0;
947 	}
948 
949 	vhost_sdev = &svsession->svdev->scsi_dev_state[scsi_tgt_num];
950 	session_sdev->dev = vhost_sdev->dev;
951 	session_sdev->status = VHOST_SCSI_DEV_PRESENT;
952 
953 	rc = spdk_scsi_dev_allocate_io_channels(svsession->scsi_dev_state[scsi_tgt_num].dev);
954 	if (rc != 0) {
955 		SPDK_ERRLOG("%s: Couldn't allocate io channnel for SCSI target %u.\n",
956 			    vsession->name, scsi_tgt_num);
957 
958 		/* unset the SCSI target so that all I/O to it will be rejected */
959 		session_sdev->dev = NULL;
960 		/* Set status to EMPTY so that we won't reply with SCSI hotremove
961 		 * sense codes - the device hasn't ever been added.
962 		 */
963 		session_sdev->status = VHOST_SCSI_DEV_EMPTY;
964 
965 		/* Return with no error. We'll continue allocating io_channels for
966 		 * other sessions on this device in hopes they succeed. The sessions
967 		 * that failed to allocate io_channels simply won't be able to
968 		 * detect the SCSI target, nor do any I/O to it.
969 		 */
970 		return 0;
971 	}
972 
973 	if (vhost_dev_has_feature(vsession, VIRTIO_SCSI_F_HOTPLUG)) {
974 		eventq_enqueue(svsession, scsi_tgt_num,
975 			       VIRTIO_SCSI_T_TRANSPORT_RESET, VIRTIO_SCSI_EVT_RESET_RESCAN);
976 	} else {
977 		SPDK_NOTICELOG("%s: driver does not support hotplug. "
978 			       "Please restart it or perform a rescan.\n",
979 			       vsession->name);
980 	}
981 
982 	return 0;
983 }
984 
985 int
986 spdk_vhost_scsi_dev_add_tgt(struct spdk_vhost_dev *vdev, int scsi_tgt_num,
987 			    const char *bdev_name)
988 {
989 	struct spdk_vhost_scsi_dev *svdev;
990 	struct spdk_scsi_dev_vhost_state *state;
991 	char target_name[SPDK_SCSI_DEV_MAX_NAME];
992 	int lun_id_list[1];
993 	const char *bdev_names_list[1];
994 
995 	svdev = to_scsi_dev(vdev);
996 	assert(svdev != NULL);
997 	if (scsi_tgt_num < 0) {
998 		for (scsi_tgt_num = 0; scsi_tgt_num < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS; scsi_tgt_num++) {
999 			if (svdev->scsi_dev_state[scsi_tgt_num].dev == NULL) {
1000 				break;
1001 			}
1002 		}
1003 
1004 		if (scsi_tgt_num == SPDK_VHOST_SCSI_CTRLR_MAX_DEVS) {
1005 			SPDK_ERRLOG("%s: all SCSI target slots are already in use.\n", vdev->name);
1006 			return -ENOSPC;
1007 		}
1008 	} else {
1009 		if (scsi_tgt_num >= SPDK_VHOST_SCSI_CTRLR_MAX_DEVS) {
1010 			SPDK_ERRLOG("%s: SCSI target number is too big (got %d, max %d)\n",
1011 				    vdev->name, scsi_tgt_num, SPDK_VHOST_SCSI_CTRLR_MAX_DEVS);
1012 			return -EINVAL;
1013 		}
1014 	}
1015 
1016 	if (bdev_name == NULL) {
1017 		SPDK_ERRLOG("No lun name specified\n");
1018 		return -EINVAL;
1019 	}
1020 
1021 	state = &svdev->scsi_dev_state[scsi_tgt_num];
1022 	if (state->dev != NULL) {
1023 		SPDK_ERRLOG("%s: SCSI target %u already occupied\n", vdev->name, scsi_tgt_num);
1024 		return -EEXIST;
1025 	}
1026 
1027 	/*
1028 	 * At this stage only one LUN per target
1029 	 */
1030 	snprintf(target_name, sizeof(target_name), "Target %u", scsi_tgt_num);
1031 	lun_id_list[0] = 0;
1032 	bdev_names_list[0] = (char *)bdev_name;
1033 
1034 	state->status = VHOST_SCSI_DEV_ADDING;
1035 	state->dev = spdk_scsi_dev_construct(target_name, bdev_names_list, lun_id_list, 1,
1036 					     SPDK_SPC_PROTOCOL_IDENTIFIER_SAS,
1037 					     vhost_scsi_lun_hotremove, svdev);
1038 
1039 	if (state->dev == NULL) {
1040 		state->status = VHOST_SCSI_DEV_EMPTY;
1041 		SPDK_ERRLOG("%s: couldn't create SCSI target %u using bdev '%s'\n",
1042 			    vdev->name, scsi_tgt_num, bdev_name);
1043 		return -EINVAL;
1044 	}
1045 	spdk_scsi_dev_add_port(state->dev, 0, "vhost");
1046 
1047 	SPDK_INFOLOG(SPDK_LOG_VHOST, "%s: added SCSI target %u using bdev '%s'\n",
1048 		     vdev->name, scsi_tgt_num, bdev_name);
1049 
1050 	vhost_dev_foreach_session(vdev, vhost_scsi_session_add_tgt,
1051 				  vhost_scsi_dev_add_tgt_cpl_cb,
1052 				  (void *)(uintptr_t)scsi_tgt_num);
1053 	return scsi_tgt_num;
1054 }
1055 
1056 struct scsi_tgt_hotplug_ctx {
1057 	unsigned scsi_tgt_num;
1058 	bool async_fini;
1059 };
1060 
1061 static void
1062 vhost_scsi_dev_remove_tgt_cpl_cb(struct spdk_vhost_dev *vdev, void *_ctx)
1063 {
1064 	struct scsi_tgt_hotplug_ctx *ctx = _ctx;
1065 	struct spdk_vhost_scsi_dev *svdev = SPDK_CONTAINEROF(vdev,
1066 					    struct spdk_vhost_scsi_dev, vdev);
1067 
1068 	if (!ctx->async_fini) {
1069 		/* there aren't any active sessions, so remove the dev and exit */
1070 		remove_scsi_tgt(svdev, ctx->scsi_tgt_num);
1071 	}
1072 
1073 	free(ctx);
1074 }
1075 
1076 static int
1077 vhost_scsi_session_remove_tgt(struct spdk_vhost_dev *vdev,
1078 			      struct spdk_vhost_session *vsession, void *_ctx)
1079 {
1080 	struct scsi_tgt_hotplug_ctx *ctx = _ctx;
1081 	unsigned scsi_tgt_num = ctx->scsi_tgt_num;
1082 	struct spdk_vhost_scsi_session *svsession = (struct spdk_vhost_scsi_session *)vsession;
1083 	struct spdk_scsi_dev_session_state *state = &svsession->scsi_dev_state[scsi_tgt_num];
1084 
1085 	if (!vsession->started || state->dev == NULL) {
1086 		/* Nothing to do */
1087 		return 0;
1088 	}
1089 
1090 	/* Mark the target for removal */
1091 	assert(state->status == VHOST_SCSI_DEV_PRESENT);
1092 	state->status = VHOST_SCSI_DEV_REMOVING;
1093 
1094 	/* Send a hotremove Virtio event */
1095 	if (vhost_dev_has_feature(vsession, VIRTIO_SCSI_F_HOTPLUG)) {
1096 		eventq_enqueue(svsession, scsi_tgt_num,
1097 			       VIRTIO_SCSI_T_TRANSPORT_RESET, VIRTIO_SCSI_EVT_RESET_REMOVED);
1098 	}
1099 
1100 	/* Wait for the session's management poller to remove the target after
1101 	 * all its pending I/O has finished.
1102 	 */
1103 	ctx->async_fini = true;
1104 	return 0;
1105 }
1106 
1107 int
1108 spdk_vhost_scsi_dev_remove_tgt(struct spdk_vhost_dev *vdev, unsigned scsi_tgt_num,
1109 			       spdk_vhost_event_fn cb_fn, void *cb_arg)
1110 {
1111 	struct spdk_vhost_scsi_dev *svdev;
1112 	struct spdk_scsi_dev_vhost_state *scsi_dev_state;
1113 	struct scsi_tgt_hotplug_ctx *ctx;
1114 
1115 	if (scsi_tgt_num >= SPDK_VHOST_SCSI_CTRLR_MAX_DEVS) {
1116 		SPDK_ERRLOG("%s: invalid SCSI target number %d\n", vdev->name, scsi_tgt_num);
1117 		return -EINVAL;
1118 	}
1119 
1120 	svdev = to_scsi_dev(vdev);
1121 	assert(svdev != NULL);
1122 	scsi_dev_state = &svdev->scsi_dev_state[scsi_tgt_num];
1123 
1124 	if (scsi_dev_state->status != VHOST_SCSI_DEV_PRESENT) {
1125 		return -EBUSY;
1126 	}
1127 
1128 	if (scsi_dev_state->dev == NULL || scsi_dev_state->status == VHOST_SCSI_DEV_ADDING) {
1129 		SPDK_ERRLOG("%s: SCSI target %u is not occupied\n", vdev->name, scsi_tgt_num);
1130 		return -ENODEV;
1131 	}
1132 
1133 	assert(scsi_dev_state->status != VHOST_SCSI_DEV_EMPTY);
1134 	ctx = calloc(1, sizeof(*ctx));
1135 	if (ctx == NULL) {
1136 		SPDK_ERRLOG("calloc failed\n");
1137 		return -ENOMEM;
1138 	}
1139 
1140 	ctx->scsi_tgt_num = scsi_tgt_num;
1141 	ctx->async_fini = false;
1142 
1143 	scsi_dev_state->remove_cb = cb_fn;
1144 	scsi_dev_state->remove_ctx = cb_arg;
1145 	scsi_dev_state->status = VHOST_SCSI_DEV_REMOVING;
1146 
1147 	vhost_dev_foreach_session(vdev, vhost_scsi_session_remove_tgt,
1148 				  vhost_scsi_dev_remove_tgt_cpl_cb, ctx);
1149 	return 0;
1150 }
1151 
1152 int
1153 vhost_scsi_controller_construct(void)
1154 {
1155 	struct spdk_conf_section *sp = spdk_conf_first_section(NULL);
1156 	struct spdk_vhost_dev *vdev;
1157 	int i, dev_num;
1158 	unsigned ctrlr_num = 0;
1159 	char *bdev_name, *tgt_num_str;
1160 	char *cpumask;
1161 	char *name;
1162 	char *tgt = NULL;
1163 
1164 	while (sp != NULL) {
1165 		if (!spdk_conf_section_match_prefix(sp, "VhostScsi")) {
1166 			sp = spdk_conf_next_section(sp);
1167 			continue;
1168 		}
1169 
1170 		if (sscanf(spdk_conf_section_get_name(sp), "VhostScsi%u", &ctrlr_num) != 1) {
1171 			SPDK_ERRLOG("Section '%s' has non-numeric suffix.\n",
1172 				    spdk_conf_section_get_name(sp));
1173 			return -1;
1174 		}
1175 
1176 		name =  spdk_conf_section_get_val(sp, "Name");
1177 		cpumask = spdk_conf_section_get_val(sp, "Cpumask");
1178 
1179 		if (spdk_vhost_scsi_dev_construct(name, cpumask) < 0) {
1180 			return -1;
1181 		}
1182 
1183 		vdev = spdk_vhost_dev_find(name);
1184 		assert(vdev);
1185 
1186 		for (i = 0; ; i++) {
1187 
1188 			tgt = spdk_conf_section_get_nval(sp, "Target", i);
1189 			if (tgt == NULL) {
1190 				break;
1191 			}
1192 
1193 			tgt_num_str = spdk_conf_section_get_nmval(sp, "Target", i, 0);
1194 			if (tgt_num_str == NULL) {
1195 				SPDK_ERRLOG("%s: invalid or missing SCSI target number\n", name);
1196 				return -1;
1197 			}
1198 
1199 			dev_num = (int)strtol(tgt_num_str, NULL, 10);
1200 			bdev_name = spdk_conf_section_get_nmval(sp, "Target", i, 1);
1201 			if (bdev_name == NULL) {
1202 				SPDK_ERRLOG("%s: invalid or missing bdev name for SCSI target %d\n", name, dev_num);
1203 				return -1;
1204 			} else if (spdk_conf_section_get_nmval(sp, "Target", i, 2)) {
1205 				SPDK_ERRLOG("%s: only one LUN per SCSI target is supported\n", name);
1206 				return -1;
1207 			}
1208 
1209 			if (spdk_vhost_scsi_dev_add_tgt(vdev, dev_num, bdev_name) < 0) {
1210 				return -1;
1211 			}
1212 		}
1213 
1214 		sp = spdk_conf_next_section(sp);
1215 	}
1216 
1217 	return 0;
1218 }
1219 
1220 static void
1221 free_task_pool(struct spdk_vhost_scsi_session *svsession)
1222 {
1223 	struct spdk_vhost_session *vsession = &svsession->vsession;
1224 	struct spdk_vhost_virtqueue *vq;
1225 	uint16_t i;
1226 
1227 	for (i = 0; i < vsession->max_queues; i++) {
1228 		vq = &vsession->virtqueue[i];
1229 		if (vq->tasks == NULL) {
1230 			continue;
1231 		}
1232 
1233 		spdk_free(vq->tasks);
1234 		vq->tasks = NULL;
1235 	}
1236 }
1237 
1238 static int
1239 alloc_task_pool(struct spdk_vhost_scsi_session *svsession)
1240 {
1241 	struct spdk_vhost_session *vsession = &svsession->vsession;
1242 	struct spdk_vhost_virtqueue *vq;
1243 	struct spdk_vhost_scsi_task *task;
1244 	uint32_t task_cnt;
1245 	uint16_t i;
1246 	uint32_t j;
1247 
1248 	for (i = 0; i < vsession->max_queues; i++) {
1249 		vq = &vsession->virtqueue[i];
1250 		if (vq->vring.desc == NULL) {
1251 			continue;
1252 		}
1253 
1254 		task_cnt = vq->vring.size;
1255 		if (task_cnt > SPDK_VHOST_MAX_VQ_SIZE) {
1256 			/* sanity check */
1257 			SPDK_ERRLOG("%s: virtuque %"PRIu16" is too big. (size = %"PRIu32", max = %"PRIu32")\n",
1258 				    vsession->name, i, task_cnt, SPDK_VHOST_MAX_VQ_SIZE);
1259 			free_task_pool(svsession);
1260 			return -1;
1261 		}
1262 		vq->tasks = spdk_zmalloc(sizeof(struct spdk_vhost_scsi_task) * task_cnt,
1263 					 SPDK_CACHE_LINE_SIZE, NULL,
1264 					 SPDK_ENV_LCORE_ID_ANY, SPDK_MALLOC_DMA);
1265 		if (vq->tasks == NULL) {
1266 			SPDK_ERRLOG("%s: failed to allocate %"PRIu32" tasks for virtqueue %"PRIu16"\n",
1267 				    vsession->name, task_cnt, i);
1268 			free_task_pool(svsession);
1269 			return -1;
1270 		}
1271 
1272 		for (j = 0; j < task_cnt; j++) {
1273 			task = &((struct spdk_vhost_scsi_task *)vq->tasks)[j];
1274 			task->svsession = svsession;
1275 			task->vq = vq;
1276 			task->req_idx = j;
1277 		}
1278 	}
1279 
1280 	return 0;
1281 }
1282 
1283 static int
1284 vhost_scsi_start_cb(struct spdk_vhost_dev *vdev,
1285 		    struct spdk_vhost_session *vsession, void *unused)
1286 {
1287 	struct spdk_vhost_scsi_session *svsession = to_scsi_session(vsession);
1288 	struct spdk_vhost_scsi_dev *svdev = svsession->svdev;
1289 	struct spdk_scsi_dev_vhost_state *state;
1290 	uint32_t i;
1291 	int rc;
1292 
1293 	/* validate all I/O queues are in a contiguous index range */
1294 	for (i = VIRTIO_SCSI_REQUESTQ; i < vsession->max_queues; i++) {
1295 		if (vsession->virtqueue[i].vring.desc == NULL) {
1296 			SPDK_ERRLOG("%s: queue %"PRIu32" is empty\n", vsession->name, i);
1297 			rc = -1;
1298 			goto out;
1299 		}
1300 	}
1301 
1302 	rc = alloc_task_pool(svsession);
1303 	if (rc != 0) {
1304 		SPDK_ERRLOG("%s: failed to alloc task pool.\n", vsession->name);
1305 		goto out;
1306 	}
1307 
1308 	for (i = 0; i < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS; i++) {
1309 		state = &svdev->scsi_dev_state[i];
1310 		if (state->dev == NULL || state->status == VHOST_SCSI_DEV_REMOVING) {
1311 			continue;
1312 		}
1313 
1314 		assert(svsession->scsi_dev_state[i].status == VHOST_SCSI_DEV_EMPTY);
1315 		svsession->scsi_dev_state[i].dev = state->dev;
1316 		svsession->scsi_dev_state[i].status = VHOST_SCSI_DEV_PRESENT;
1317 		rc = spdk_scsi_dev_allocate_io_channels(state->dev);
1318 		if (rc != 0) {
1319 			SPDK_ERRLOG("%s: failed to alloc io_channel for SCSI target %"PRIu32"\n",
1320 				    vsession->name, i);
1321 			/* unset the SCSI target so that all I/O to it will be rejected */
1322 			svsession->scsi_dev_state[i].dev = NULL;
1323 			/* set EMPTY state so that we won't reply with SCSI hotremove
1324 			 * sense codes - the device hasn't ever been added.
1325 			 */
1326 			svsession->scsi_dev_state[i].status = VHOST_SCSI_DEV_EMPTY;
1327 			continue;
1328 		}
1329 	}
1330 	SPDK_INFOLOG(SPDK_LOG_VHOST, "%s: started poller on lcore %d\n",
1331 		     vsession->name, spdk_env_get_current_core());
1332 
1333 	svsession->requestq_poller = SPDK_POLLER_REGISTER(vdev_worker, svsession, 0);
1334 	if (vsession->virtqueue[VIRTIO_SCSI_CONTROLQ].vring.desc &&
1335 	    vsession->virtqueue[VIRTIO_SCSI_EVENTQ].vring.desc) {
1336 		svsession->mgmt_poller = SPDK_POLLER_REGISTER(vdev_mgmt_worker, svsession,
1337 					 MGMT_POLL_PERIOD_US);
1338 	}
1339 out:
1340 	vhost_session_start_done(vsession, rc);
1341 	return rc;
1342 }
1343 
1344 static int
1345 vhost_scsi_start(struct spdk_vhost_session *vsession)
1346 {
1347 	struct spdk_vhost_scsi_session *svsession = to_scsi_session(vsession);
1348 	struct spdk_vhost_scsi_dev *svdev;
1349 
1350 	svdev = to_scsi_dev(vsession->vdev);
1351 	assert(svdev != NULL);
1352 	svsession->svdev = svdev;
1353 
1354 	return vhost_session_send_event(vsession, vhost_scsi_start_cb,
1355 					3, "start session");
1356 }
1357 
1358 static int
1359 destroy_session_poller_cb(void *arg)
1360 {
1361 	struct spdk_vhost_scsi_session *svsession = arg;
1362 	struct spdk_vhost_session *vsession = &svsession->vsession;
1363 	struct spdk_scsi_dev_session_state *state;
1364 	uint32_t i;
1365 
1366 	if (vsession->task_cnt > 0) {
1367 		return SPDK_POLLER_BUSY;
1368 	}
1369 
1370 	if (spdk_vhost_trylock() != 0) {
1371 		return SPDK_POLLER_BUSY;
1372 	}
1373 
1374 	for (i = 0; i < vsession->max_queues; i++) {
1375 		vhost_vq_used_signal(vsession, &vsession->virtqueue[i]);
1376 	}
1377 
1378 	for (i = 0; i < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS; i++) {
1379 		enum spdk_scsi_dev_vhost_status prev_status;
1380 
1381 		state = &svsession->scsi_dev_state[i];
1382 		/* clear the REMOVED status so that we won't send hotremove events anymore */
1383 		prev_status = state->status;
1384 		state->status = VHOST_SCSI_DEV_EMPTY;
1385 		if (state->dev == NULL) {
1386 			continue;
1387 		}
1388 
1389 		spdk_scsi_dev_free_io_channels(state->dev);
1390 
1391 		state->dev = NULL;
1392 
1393 		if (prev_status == VHOST_SCSI_DEV_REMOVING) {
1394 			/* try to detach it globally */
1395 			vhost_dev_foreach_session(vsession->vdev,
1396 						  vhost_scsi_session_process_removed,
1397 						  vhost_scsi_dev_process_removed_cpl_cb,
1398 						  (void *)(uintptr_t)i);
1399 		}
1400 	}
1401 
1402 	SPDK_INFOLOG(SPDK_LOG_VHOST, "%s: stopping poller on lcore %d\n",
1403 		     vsession->name, spdk_env_get_current_core());
1404 
1405 	free_task_pool(svsession);
1406 
1407 	spdk_poller_unregister(&svsession->stop_poller);
1408 	vhost_session_stop_done(vsession, 0);
1409 
1410 	spdk_vhost_unlock();
1411 	return SPDK_POLLER_BUSY;
1412 }
1413 
1414 static int
1415 vhost_scsi_stop_cb(struct spdk_vhost_dev *vdev,
1416 		   struct spdk_vhost_session *vsession, void *unused)
1417 {
1418 	struct spdk_vhost_scsi_session *svsession = to_scsi_session(vsession);
1419 
1420 	/* Stop receiving new I/O requests */
1421 	spdk_poller_unregister(&svsession->requestq_poller);
1422 
1423 	/* Stop receiving controlq requests, also stop processing the
1424 	 * asynchronous hotremove events. All the remaining events
1425 	 * will be finalized by the stop_poller below.
1426 	 */
1427 	spdk_poller_unregister(&svsession->mgmt_poller);
1428 
1429 	/* Wait for all pending I/Os to complete, then process all the
1430 	 * remaining hotremove events one last time.
1431 	 */
1432 	svsession->stop_poller = SPDK_POLLER_REGISTER(destroy_session_poller_cb,
1433 				 svsession, 1000);
1434 
1435 	return 0;
1436 }
1437 
1438 static int
1439 vhost_scsi_stop(struct spdk_vhost_session *vsession)
1440 {
1441 	return vhost_session_send_event(vsession, vhost_scsi_stop_cb,
1442 					3, "stop session");
1443 }
1444 
1445 static void
1446 vhost_scsi_dump_info_json(struct spdk_vhost_dev *vdev, struct spdk_json_write_ctx *w)
1447 {
1448 	struct spdk_scsi_dev *sdev;
1449 	struct spdk_scsi_lun *lun;
1450 	uint32_t dev_idx;
1451 	uint32_t lun_idx;
1452 
1453 	assert(vdev != NULL);
1454 	spdk_json_write_named_array_begin(w, "scsi");
1455 	for (dev_idx = 0; dev_idx < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS; dev_idx++) {
1456 		sdev = spdk_vhost_scsi_dev_get_tgt(vdev, dev_idx);
1457 		if (!sdev) {
1458 			continue;
1459 		}
1460 
1461 		spdk_json_write_object_begin(w);
1462 
1463 		spdk_json_write_named_uint32(w, "scsi_dev_num", dev_idx);
1464 
1465 		spdk_json_write_named_uint32(w, "id", spdk_scsi_dev_get_id(sdev));
1466 
1467 		spdk_json_write_named_string(w, "target_name", spdk_scsi_dev_get_name(sdev));
1468 
1469 		spdk_json_write_named_array_begin(w, "luns");
1470 
1471 		for (lun_idx = 0; lun_idx < SPDK_SCSI_DEV_MAX_LUN; lun_idx++) {
1472 			lun = spdk_scsi_dev_get_lun(sdev, lun_idx);
1473 			if (!lun) {
1474 				continue;
1475 			}
1476 
1477 			spdk_json_write_object_begin(w);
1478 
1479 			spdk_json_write_named_int32(w, "id", spdk_scsi_lun_get_id(lun));
1480 
1481 			spdk_json_write_named_string(w, "bdev_name", spdk_scsi_lun_get_bdev_name(lun));
1482 
1483 			spdk_json_write_object_end(w);
1484 		}
1485 
1486 		spdk_json_write_array_end(w);
1487 		spdk_json_write_object_end(w);
1488 	}
1489 
1490 	spdk_json_write_array_end(w);
1491 }
1492 
1493 static void
1494 vhost_scsi_write_config_json(struct spdk_vhost_dev *vdev, struct spdk_json_write_ctx *w)
1495 {
1496 	struct spdk_scsi_dev *scsi_dev;
1497 	struct spdk_scsi_lun *lun;
1498 	uint32_t i;
1499 
1500 	spdk_json_write_object_begin(w);
1501 	spdk_json_write_named_string(w, "method", "vhost_create_scsi_controller");
1502 
1503 	spdk_json_write_named_object_begin(w, "params");
1504 	spdk_json_write_named_string(w, "ctrlr", vdev->name);
1505 	spdk_json_write_named_string(w, "cpumask",
1506 				     spdk_cpuset_fmt(spdk_thread_get_cpumask(vdev->thread)));
1507 	spdk_json_write_object_end(w);
1508 
1509 	spdk_json_write_object_end(w);
1510 
1511 	for (i = 0; i < SPDK_VHOST_SCSI_CTRLR_MAX_DEVS; i++) {
1512 		scsi_dev = spdk_vhost_scsi_dev_get_tgt(vdev, i);
1513 		if (scsi_dev == NULL) {
1514 			continue;
1515 		}
1516 
1517 		lun = spdk_scsi_dev_get_lun(scsi_dev, 0);
1518 		assert(lun != NULL);
1519 
1520 		spdk_json_write_object_begin(w);
1521 		spdk_json_write_named_string(w, "method", "vhost_scsi_controller_add_target");
1522 
1523 		spdk_json_write_named_object_begin(w, "params");
1524 		spdk_json_write_named_string(w, "ctrlr", vdev->name);
1525 		spdk_json_write_named_uint32(w, "scsi_target_num", i);
1526 
1527 		spdk_json_write_named_string(w, "bdev_name", spdk_scsi_lun_get_bdev_name(lun));
1528 		spdk_json_write_object_end(w);
1529 
1530 		spdk_json_write_object_end(w);
1531 	}
1532 }
1533 
1534 SPDK_LOG_REGISTER_COMPONENT("vhost_scsi", SPDK_LOG_VHOST_SCSI)
1535 SPDK_LOG_REGISTER_COMPONENT("vhost_scsi_queue", SPDK_LOG_VHOST_SCSI_QUEUE)
1536 SPDK_LOG_REGISTER_COMPONENT("vhost_scsi_data", SPDK_LOG_VHOST_SCSI_DATA)
1537