]> Pileus Git - ~andy/linux/blobdiff - drivers/vhost/tcm_vhost.c
tcm_vhost: document inflight ref-counting use
[~andy/linux] / drivers / vhost / tcm_vhost.c
index 957a0b98a5d90f689c68fb92ba76e60c72f89944..96d3b47c82cd0c8750f519545a97b1958e2802ab 100644 (file)
@@ -66,11 +66,35 @@ enum {
  * TODO: debug and remove the workaround.
  */
 enum {
-       VHOST_SCSI_FEATURES = VHOST_FEATURES & (~VIRTIO_RING_F_EVENT_IDX)
+       VHOST_SCSI_FEATURES = (VHOST_FEATURES & (~VIRTIO_RING_F_EVENT_IDX)) |
+                             (1ULL << VIRTIO_SCSI_F_HOTPLUG)
 };
 
 #define VHOST_SCSI_MAX_TARGET  256
 #define VHOST_SCSI_MAX_VQ      128
+#define VHOST_SCSI_MAX_EVENT   128
+
+struct vhost_scsi_inflight {
+       /* Wait for the flush operation to finish */
+       struct completion comp;
+       /* Refcount for the inflight reqs */
+       struct kref kref;
+};
+
+struct vhost_scsi_virtqueue {
+       struct vhost_virtqueue vq;
+       /*
+        * Reference counting for inflight reqs, used for flush operation. At
+        * each time, one reference tracks new commands submitted, while we
+        * wait for another one to reach 0.
+        */
+       struct vhost_scsi_inflight inflights[2];
+       /*
+        * Indicate current inflight in use, protected by vq->mutex.
+        * Writers must also take dev mutex and flush under it.
+        */
+       int inflight_idx;
+};
 
 struct vhost_scsi {
        /* Protected by vhost_scsi->dev.mutex */
@@ -78,10 +102,16 @@ struct vhost_scsi {
        char vs_vhost_wwpn[TRANSPORT_IQN_LEN];
 
        struct vhost_dev dev;
-       struct vhost_virtqueue vqs[VHOST_SCSI_MAX_VQ];
+       struct vhost_scsi_virtqueue vqs[VHOST_SCSI_MAX_VQ];
 
        struct vhost_work vs_completion_work; /* cmd completion work item */
        struct llist_head vs_completion_list; /* cmd completion queue */
+
+       struct vhost_work vs_event_work; /* evt injection work item */
+       struct llist_head vs_event_list; /* evt injection queue */
+
+       bool vs_events_missed; /* any missed events, protected by vq->mutex */
+       int vs_events_nr; /* num of pending events, protected by vq->mutex */
 };
 
 /* Local pointer to allocated TCM configfs fabric module */
@@ -99,6 +129,59 @@ static int iov_num_pages(struct iovec *iov)
               ((unsigned long)iov->iov_base & PAGE_MASK)) >> PAGE_SHIFT;
 }
 
+void tcm_vhost_done_inflight(struct kref *kref)
+{
+       struct vhost_scsi_inflight *inflight;
+
+       inflight = container_of(kref, struct vhost_scsi_inflight, kref);
+       complete(&inflight->comp);
+}
+
+static void tcm_vhost_init_inflight(struct vhost_scsi *vs,
+                                   struct vhost_scsi_inflight *old_inflight[])
+{
+       struct vhost_scsi_inflight *new_inflight;
+       struct vhost_virtqueue *vq;
+       int idx, i;
+
+       for (i = 0; i < VHOST_SCSI_MAX_VQ; i++) {
+               vq = &vs->vqs[i].vq;
+
+               mutex_lock(&vq->mutex);
+
+               /* store old infight */
+               idx = vs->vqs[i].inflight_idx;
+               if (old_inflight)
+                       old_inflight[i] = &vs->vqs[i].inflights[idx];
+
+               /* setup new infight */
+               vs->vqs[i].inflight_idx = idx ^ 1;
+               new_inflight = &vs->vqs[i].inflights[idx ^ 1];
+               kref_init(&new_inflight->kref);
+               init_completion(&new_inflight->comp);
+
+               mutex_unlock(&vq->mutex);
+       }
+}
+
+static struct vhost_scsi_inflight *
+tcm_vhost_get_inflight(struct vhost_virtqueue *vq)
+{
+       struct vhost_scsi_inflight *inflight;
+       struct vhost_scsi_virtqueue *svq;
+
+       svq = container_of(vq, struct vhost_scsi_virtqueue, vq);
+       inflight = &svq->inflights[svq->inflight_idx];
+       kref_get(&inflight->kref);
+
+       return inflight;
+}
+
+static void tcm_vhost_put_inflight(struct vhost_scsi_inflight *inflight)
+{
+       kref_put(&inflight->kref, tcm_vhost_done_inflight);
+}
+
 static int tcm_vhost_check_true(struct se_portal_group *se_tpg)
 {
        return 1;
@@ -349,6 +432,37 @@ static int tcm_vhost_queue_tm_rsp(struct se_cmd *se_cmd)
        return 0;
 }
 
+static void tcm_vhost_free_evt(struct vhost_scsi *vs, struct tcm_vhost_evt *evt)
+{
+       vs->vs_events_nr--;
+       kfree(evt);
+}
+
+static struct tcm_vhost_evt *tcm_vhost_allocate_evt(struct vhost_scsi *vs,
+       u32 event, u32 reason)
+{
+       struct vhost_virtqueue *vq = &vs->vqs[VHOST_SCSI_VQ_EVT].vq;
+       struct tcm_vhost_evt *evt;
+
+       if (vs->vs_events_nr > VHOST_SCSI_MAX_EVENT) {
+               vs->vs_events_missed = true;
+               return NULL;
+       }
+
+       evt = kzalloc(sizeof(*evt), GFP_KERNEL);
+       if (!evt) {
+               vq_err(vq, "Failed to allocate tcm_vhost_evt\n");
+               vs->vs_events_missed = true;
+               return NULL;
+       }
+
+       evt->event.event = event;
+       evt->event.reason = reason;
+       vs->vs_events_nr++;
+
+       return evt;
+}
+
 static void vhost_scsi_free_cmd(struct tcm_vhost_cmd *tv_cmd)
 {
        struct se_cmd *se_cmd = &tv_cmd->tvc_se_cmd;
@@ -364,9 +478,80 @@ static void vhost_scsi_free_cmd(struct tcm_vhost_cmd *tv_cmd)
                kfree(tv_cmd->tvc_sgl);
        }
 
+       tcm_vhost_put_inflight(tv_cmd->inflight);
+
        kfree(tv_cmd);
 }
 
+static void tcm_vhost_do_evt_work(struct vhost_scsi *vs,
+       struct tcm_vhost_evt *evt)
+{
+       struct vhost_virtqueue *vq = &vs->vqs[VHOST_SCSI_VQ_EVT].vq;
+       struct virtio_scsi_event *event = &evt->event;
+       struct virtio_scsi_event __user *eventp;
+       unsigned out, in;
+       int head, ret;
+
+       if (!vq->private_data) {
+               vs->vs_events_missed = true;
+               return;
+       }
+
+again:
+       vhost_disable_notify(&vs->dev, vq);
+       head = vhost_get_vq_desc(&vs->dev, vq, vq->iov,
+                       ARRAY_SIZE(vq->iov), &out, &in,
+                       NULL, NULL);
+       if (head < 0) {
+               vs->vs_events_missed = true;
+               return;
+       }
+       if (head == vq->num) {
+               if (vhost_enable_notify(&vs->dev, vq))
+                       goto again;
+               vs->vs_events_missed = true;
+               return;
+       }
+
+       if ((vq->iov[out].iov_len != sizeof(struct virtio_scsi_event))) {
+               vq_err(vq, "Expecting virtio_scsi_event, got %zu bytes\n",
+                               vq->iov[out].iov_len);
+               vs->vs_events_missed = true;
+               return;
+       }
+
+       if (vs->vs_events_missed) {
+               event->event |= VIRTIO_SCSI_T_EVENTS_MISSED;
+               vs->vs_events_missed = false;
+       }
+
+       eventp = vq->iov[out].iov_base;
+       ret = __copy_to_user(eventp, event, sizeof(*event));
+       if (!ret)
+               vhost_add_used_and_signal(&vs->dev, vq, head, 0);
+       else
+               vq_err(vq, "Faulted on tcm_vhost_send_event\n");
+}
+
+static void tcm_vhost_evt_work(struct vhost_work *work)
+{
+       struct vhost_scsi *vs = container_of(work, struct vhost_scsi,
+                                       vs_event_work);
+       struct vhost_virtqueue *vq = &vs->vqs[VHOST_SCSI_VQ_EVT].vq;
+       struct tcm_vhost_evt *evt;
+       struct llist_node *llnode;
+
+       mutex_lock(&vq->mutex);
+       llnode = llist_del_all(&vs->vs_event_list);
+       while (llnode) {
+               evt = llist_entry(llnode, struct tcm_vhost_evt, list);
+               llnode = llist_next(llnode);
+               tcm_vhost_do_evt_work(vs, evt);
+               tcm_vhost_free_evt(vs, evt);
+       }
+       mutex_unlock(&vq->mutex);
+}
+
 /* Fill in status and signal that we are done processing this command
  *
  * This is scheduled in the vhost work queue so we are called with the owner
@@ -403,8 +588,10 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work)
                       v_rsp.sense_len);
                ret = copy_to_user(tv_cmd->tvc_resp, &v_rsp, sizeof(v_rsp));
                if (likely(ret == 0)) {
+                       struct vhost_scsi_virtqueue *q;
                        vhost_add_used(tv_cmd->tvc_vq, tv_cmd->tvc_vq_desc, 0);
-                       vq = tv_cmd->tvc_vq - vs->vqs;
+                       q = container_of(tv_cmd->tvc_vq, struct vhost_scsi_virtqueue, vq);
+                       vq = q - vs->vqs;
                        __set_bit(vq, signal);
                } else
                        pr_err("Faulted on virtio_scsi_cmd_resp\n");
@@ -415,10 +602,11 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work)
        vq = -1;
        while ((vq = find_next_bit(signal, VHOST_SCSI_MAX_VQ, vq + 1))
                < VHOST_SCSI_MAX_VQ)
-               vhost_signal(&vs->dev, &vs->vqs[vq]);
+               vhost_signal(&vs->dev, &vs->vqs[vq].vq);
 }
 
 static struct tcm_vhost_cmd *vhost_scsi_allocate_cmd(
+       struct vhost_virtqueue *vq,
        struct tcm_vhost_tpg *tv_tpg,
        struct virtio_scsi_cmd_req *v_req,
        u32 exp_data_len,
@@ -443,6 +631,7 @@ static struct tcm_vhost_cmd *vhost_scsi_allocate_cmd(
        tv_cmd->tvc_exp_data_len = exp_data_len;
        tv_cmd->tvc_data_direction = data_direction;
        tv_cmd->tvc_nexus = tv_nexus;
+       tv_cmd->inflight = tcm_vhost_get_inflight(vq);
 
        return tv_cmd;
 }
@@ -698,7 +887,7 @@ static void vhost_scsi_handle_vq(struct vhost_scsi *vs,
                for (i = 0; i < data_num; i++)
                        exp_data_len += vq->iov[data_first + i].iov_len;
 
-               tv_cmd = vhost_scsi_allocate_cmd(tv_tpg, &v_req,
+               tv_cmd = vhost_scsi_allocate_cmd(vq, tv_tpg, &v_req,
                                        exp_data_len, data_direction);
                if (IS_ERR(tv_cmd)) {
                        vq_err(vq, "vhost_scsi_allocate_cmd failed %ld\n",
@@ -777,9 +966,46 @@ static void vhost_scsi_ctl_handle_kick(struct vhost_work *work)
        pr_debug("%s: The handling func for control queue.\n", __func__);
 }
 
+static void tcm_vhost_send_evt(struct vhost_scsi *vs, struct tcm_vhost_tpg *tpg,
+       struct se_lun *lun, u32 event, u32 reason)
+{
+       struct tcm_vhost_evt *evt;
+
+       evt = tcm_vhost_allocate_evt(vs, event, reason);
+       if (!evt)
+               return;
+
+       if (tpg && lun) {
+               /* TODO: share lun setup code with virtio-scsi.ko */
+               /*
+                * Note: evt->event is zeroed when we allocate it and
+                * lun[4-7] need to be zero according to virtio-scsi spec.
+                */
+               evt->event.lun[0] = 0x01;
+               evt->event.lun[1] = tpg->tport_tpgt & 0xFF;
+               if (lun->unpacked_lun >= 256)
+                       evt->event.lun[2] = lun->unpacked_lun >> 8 | 0x40 ;
+               evt->event.lun[3] = lun->unpacked_lun & 0xFF;
+       }
+
+       llist_add(&evt->list, &vs->vs_event_list);
+       vhost_work_queue(&vs->dev, &vs->vs_event_work);
+}
+
 static void vhost_scsi_evt_handle_kick(struct vhost_work *work)
 {
-       pr_debug("%s: The handling func for event queue.\n", __func__);
+       struct vhost_virtqueue *vq = container_of(work, struct vhost_virtqueue,
+                                               poll.work);
+       struct vhost_scsi *vs = container_of(vq->dev, struct vhost_scsi, dev);
+
+       mutex_lock(&vq->mutex);
+       if (!vq->private_data)
+               goto out;
+
+       if (vs->vs_events_missed)
+               tcm_vhost_send_evt(vs, NULL, NULL, VIRTIO_SCSI_T_NO_EVENT, 0);
+out:
+       mutex_unlock(&vq->mutex);
 }
 
 static void vhost_scsi_handle_kick(struct vhost_work *work)
@@ -793,21 +1019,43 @@ static void vhost_scsi_handle_kick(struct vhost_work *work)
 
 static void vhost_scsi_flush_vq(struct vhost_scsi *vs, int index)
 {
-       vhost_poll_flush(&vs->dev.vqs[index].poll);
+       vhost_poll_flush(&vs->vqs[index].vq.poll);
 }
 
+/* Callers must hold dev mutex */
 static void vhost_scsi_flush(struct vhost_scsi *vs)
 {
+       struct vhost_scsi_inflight *old_inflight[VHOST_SCSI_MAX_VQ];
        int i;
 
+       /* Init new inflight and remember the old inflight */
+       tcm_vhost_init_inflight(vs, old_inflight);
+
+       /*
+        * The inflight->kref was initialized to 1. We decrement it here to
+        * indicate the start of the flush operation so that it will reach 0
+        * when all the reqs are finished.
+        */
+       for (i = 0; i < VHOST_SCSI_MAX_VQ; i++)
+               kref_put(&old_inflight[i]->kref, tcm_vhost_done_inflight);
+
+       /* Flush both the vhost poll and vhost work */
        for (i = 0; i < VHOST_SCSI_MAX_VQ; i++)
                vhost_scsi_flush_vq(vs, i);
        vhost_work_flush(&vs->dev, &vs->vs_completion_work);
+       vhost_work_flush(&vs->dev, &vs->vs_event_work);
+
+       /* Wait for all reqs issued before the flush to be finished */
+       for (i = 0; i < VHOST_SCSI_MAX_VQ; i++)
+               wait_for_completion(&old_inflight[i]->comp);
 }
 
 /*
  * Called from vhost_scsi_ioctl() context to walk the list of available
  * tcm_vhost_tpg with an active struct tcm_vhost_nexus
+ *
+ *  The lock nesting rule is:
+ *    tcm_vhost_mutex -> vs->dev.mutex -> tpg->tv_tpg_mutex -> vq->mutex
  */
 static int vhost_scsi_set_endpoint(
        struct vhost_scsi *vs,
@@ -820,26 +1068,27 @@ static int vhost_scsi_set_endpoint(
        int index, ret, i, len;
        bool match = false;
 
+       mutex_lock(&tcm_vhost_mutex);
        mutex_lock(&vs->dev.mutex);
+
        /* Verify that ring has been setup correctly. */
        for (index = 0; index < vs->dev.nvqs; ++index) {
                /* Verify that ring has been setup correctly. */
-               if (!vhost_vq_access_ok(&vs->vqs[index])) {
-                       mutex_unlock(&vs->dev.mutex);
-                       return -EFAULT;
+               if (!vhost_vq_access_ok(&vs->vqs[index].vq)) {
+                       ret = -EFAULT;
+                       goto out;
                }
        }
 
        len = sizeof(vs_tpg[0]) * VHOST_SCSI_MAX_TARGET;
        vs_tpg = kzalloc(len, GFP_KERNEL);
        if (!vs_tpg) {
-               mutex_unlock(&vs->dev.mutex);
-               return -ENOMEM;
+               ret = -ENOMEM;
+               goto out;
        }
        if (vs->vs_tpg)
                memcpy(vs_tpg, vs->vs_tpg, len);
 
-       mutex_lock(&tcm_vhost_mutex);
        list_for_each_entry(tv_tpg, &tcm_vhost_list, tv_tpg_list) {
                mutex_lock(&tv_tpg->tv_tpg_mutex);
                if (!tv_tpg->tpg_nexus) {
@@ -854,26 +1103,25 @@ static int vhost_scsi_set_endpoint(
 
                if (!strcmp(tv_tport->tport_name, t->vhost_wwpn)) {
                        if (vs->vs_tpg && vs->vs_tpg[tv_tpg->tport_tpgt]) {
-                               mutex_unlock(&tv_tpg->tv_tpg_mutex);
-                               mutex_unlock(&tcm_vhost_mutex);
-                               mutex_unlock(&vs->dev.mutex);
                                kfree(vs_tpg);
-                               return -EEXIST;
+                               mutex_unlock(&tv_tpg->tv_tpg_mutex);
+                               ret = -EEXIST;
+                               goto out;
                        }
                        tv_tpg->tv_tpg_vhost_count++;
+                       tv_tpg->vhost_scsi = vs;
                        vs_tpg[tv_tpg->tport_tpgt] = tv_tpg;
                        smp_mb__after_atomic_inc();
                        match = true;
                }
                mutex_unlock(&tv_tpg->tv_tpg_mutex);
        }
-       mutex_unlock(&tcm_vhost_mutex);
 
        if (match) {
                memcpy(vs->vs_vhost_wwpn, t->vhost_wwpn,
                       sizeof(vs->vs_vhost_wwpn));
                for (i = 0; i < VHOST_SCSI_MAX_VQ; i++) {
-                       vq = &vs->vqs[i];
+                       vq = &vs->vqs[i].vq;
                        /* Flushing the vhost_work acts as synchronize_rcu */
                        mutex_lock(&vq->mutex);
                        rcu_assign_pointer(vq->private_data, vs_tpg);
@@ -893,7 +1141,9 @@ static int vhost_scsi_set_endpoint(
        kfree(vs->vs_tpg);
        vs->vs_tpg = vs_tpg;
 
+out:
        mutex_unlock(&vs->dev.mutex);
+       mutex_unlock(&tcm_vhost_mutex);
        return ret;
 }
 
@@ -908,18 +1158,19 @@ static int vhost_scsi_clear_endpoint(
        int index, ret, i;
        u8 target;
 
+       mutex_lock(&tcm_vhost_mutex);
        mutex_lock(&vs->dev.mutex);
        /* Verify that ring has been setup correctly. */
        for (index = 0; index < vs->dev.nvqs; ++index) {
-               if (!vhost_vq_access_ok(&vs->vqs[index])) {
+               if (!vhost_vq_access_ok(&vs->vqs[index].vq)) {
                        ret = -EFAULT;
                        goto err_dev;
                }
        }
 
        if (!vs->vs_tpg) {
-               mutex_unlock(&vs->dev.mutex);
-               return 0;
+               ret = 0;
+               goto err_dev;
        }
 
        for (i = 0; i < VHOST_SCSI_MAX_TARGET; i++) {
@@ -944,13 +1195,14 @@ static int vhost_scsi_clear_endpoint(
                        goto err_tpg;
                }
                tv_tpg->tv_tpg_vhost_count--;
+               tv_tpg->vhost_scsi = NULL;
                vs->vs_tpg[target] = NULL;
                match = true;
                mutex_unlock(&tv_tpg->tv_tpg_mutex);
        }
        if (match) {
                for (i = 0; i < VHOST_SCSI_MAX_VQ; i++) {
-                       vq = &vs->vqs[i];
+                       vq = &vs->vqs[i].vq;
                        /* Flushing the vhost_work acts as synchronize_rcu */
                        mutex_lock(&vq->mutex);
                        rcu_assign_pointer(vq->private_data, NULL);
@@ -964,14 +1216,16 @@ static int vhost_scsi_clear_endpoint(
        vhost_scsi_flush(vs);
        kfree(vs->vs_tpg);
        vs->vs_tpg = NULL;
+       WARN_ON(vs->vs_events_nr);
        mutex_unlock(&vs->dev.mutex);
-
+       mutex_unlock(&tcm_vhost_mutex);
        return 0;
 
 err_tpg:
        mutex_unlock(&tv_tpg->tv_tpg_mutex);
 err_dev:
        mutex_unlock(&vs->dev.mutex);
+       mutex_unlock(&tcm_vhost_mutex);
        return ret;
 }
 
@@ -996,20 +1250,39 @@ static int vhost_scsi_set_features(struct vhost_scsi *vs, u64 features)
 static int vhost_scsi_open(struct inode *inode, struct file *f)
 {
        struct vhost_scsi *s;
+       struct vhost_virtqueue **vqs;
        int r, i;
 
        s = kzalloc(sizeof(*s), GFP_KERNEL);
        if (!s)
                return -ENOMEM;
 
+       vqs = kmalloc(VHOST_SCSI_MAX_VQ * sizeof(*vqs), GFP_KERNEL);
+       if (!vqs) {
+               kfree(s);
+               return -ENOMEM;
+       }
+
        vhost_work_init(&s->vs_completion_work, vhost_scsi_complete_cmd_work);
+       vhost_work_init(&s->vs_event_work, tcm_vhost_evt_work);
+
+       s->vs_events_nr = 0;
+       s->vs_events_missed = false;
+
+       vqs[VHOST_SCSI_VQ_CTL] = &s->vqs[VHOST_SCSI_VQ_CTL].vq;
+       vqs[VHOST_SCSI_VQ_EVT] = &s->vqs[VHOST_SCSI_VQ_EVT].vq;
+       s->vqs[VHOST_SCSI_VQ_CTL].vq.handle_kick = vhost_scsi_ctl_handle_kick;
+       s->vqs[VHOST_SCSI_VQ_EVT].vq.handle_kick = vhost_scsi_evt_handle_kick;
+       for (i = VHOST_SCSI_VQ_IO; i < VHOST_SCSI_MAX_VQ; i++) {
+               vqs[i] = &s->vqs[i].vq;
+               s->vqs[i].vq.handle_kick = vhost_scsi_handle_kick;
+       }
+       r = vhost_dev_init(&s->dev, vqs, VHOST_SCSI_MAX_VQ);
+
+       tcm_vhost_init_inflight(s, NULL);
 
-       s->vqs[VHOST_SCSI_VQ_CTL].handle_kick = vhost_scsi_ctl_handle_kick;
-       s->vqs[VHOST_SCSI_VQ_EVT].handle_kick = vhost_scsi_evt_handle_kick;
-       for (i = VHOST_SCSI_VQ_IO; i < VHOST_SCSI_MAX_VQ; i++)
-               s->vqs[i].handle_kick = vhost_scsi_handle_kick;
-       r = vhost_dev_init(&s->dev, s->vqs, VHOST_SCSI_MAX_VQ);
        if (r < 0) {
+               kfree(vqs);
                kfree(s);
                return r;
        }
@@ -1029,6 +1302,9 @@ static int vhost_scsi_release(struct inode *inode, struct file *f)
        vhost_scsi_clear_endpoint(s, &t);
        vhost_dev_stop(&s->dev);
        vhost_dev_cleanup(&s->dev, false);
+       /* Jobs can re-queue themselves in evt kick handler. Do extra flush. */
+       vhost_scsi_flush(s);
+       kfree(s->dev.vqs);
        kfree(s);
        return 0;
 }
@@ -1040,8 +1316,11 @@ static long vhost_scsi_ioctl(struct file *f, unsigned int ioctl,
        struct vhost_scsi_target backend;
        void __user *argp = (void __user *)arg;
        u64 __user *featurep = argp;
+       u32 __user *eventsp = argp;
+       u32 events_missed;
        u64 features;
        int r, abi_version = VHOST_SCSI_ABI_VERSION;
+       struct vhost_virtqueue *vq = &vs->vqs[VHOST_SCSI_VQ_EVT].vq;
 
        switch (ioctl) {
        case VHOST_SCSI_SET_ENDPOINT:
@@ -1062,6 +1341,20 @@ static long vhost_scsi_ioctl(struct file *f, unsigned int ioctl,
                if (copy_to_user(argp, &abi_version, sizeof abi_version))
                        return -EFAULT;
                return 0;
+       case VHOST_SCSI_SET_EVENTS_MISSED:
+               if (get_user(events_missed, eventsp))
+                       return -EFAULT;
+               mutex_lock(&vq->mutex);
+               vs->vs_events_missed = events_missed;
+               mutex_unlock(&vq->mutex);
+               return 0;
+       case VHOST_SCSI_GET_EVENTS_MISSED:
+               mutex_lock(&vq->mutex);
+               events_missed = vs->vs_events_missed;
+               mutex_unlock(&vq->mutex);
+               if (put_user(events_missed, eventsp))
+                       return -EFAULT;
+               return 0;
        case VHOST_GET_FEATURES:
                features = VHOST_SCSI_FEATURES;
                if (copy_to_user(featurep, &features, sizeof features))
@@ -1133,28 +1426,80 @@ static char *tcm_vhost_dump_proto_id(struct tcm_vhost_tport *tport)
        return "Unknown";
 }
 
+static void tcm_vhost_do_plug(struct tcm_vhost_tpg *tpg,
+       struct se_lun *lun, bool plug)
+{
+
+       struct vhost_scsi *vs = tpg->vhost_scsi;
+       struct vhost_virtqueue *vq;
+       u32 reason;
+
+       if (!vs)
+               return;
+
+       mutex_lock(&vs->dev.mutex);
+       if (!vhost_has_feature(&vs->dev, VIRTIO_SCSI_F_HOTPLUG)) {
+               mutex_unlock(&vs->dev.mutex);
+               return;
+       }
+
+       if (plug)
+               reason = VIRTIO_SCSI_EVT_RESET_RESCAN;
+       else
+               reason = VIRTIO_SCSI_EVT_RESET_REMOVED;
+
+       vq = &vs->vqs[VHOST_SCSI_VQ_EVT].vq;
+       mutex_lock(&vq->mutex);
+       tcm_vhost_send_evt(vs, tpg, lun,
+                       VIRTIO_SCSI_T_TRANSPORT_RESET, reason);
+       mutex_unlock(&vq->mutex);
+       mutex_unlock(&vs->dev.mutex);
+}
+
+static void tcm_vhost_hotplug(struct tcm_vhost_tpg *tpg, struct se_lun *lun)
+{
+       tcm_vhost_do_plug(tpg, lun, true);
+}
+
+static void tcm_vhost_hotunplug(struct tcm_vhost_tpg *tpg, struct se_lun *lun)
+{
+       tcm_vhost_do_plug(tpg, lun, false);
+}
+
 static int tcm_vhost_port_link(struct se_portal_group *se_tpg,
        struct se_lun *lun)
 {
        struct tcm_vhost_tpg *tv_tpg = container_of(se_tpg,
                                struct tcm_vhost_tpg, se_tpg);
 
+       mutex_lock(&tcm_vhost_mutex);
+
        mutex_lock(&tv_tpg->tv_tpg_mutex);
        tv_tpg->tv_tpg_port_count++;
        mutex_unlock(&tv_tpg->tv_tpg_mutex);
 
+       tcm_vhost_hotplug(tv_tpg, lun);
+
+       mutex_unlock(&tcm_vhost_mutex);
+
        return 0;
 }
 
 static void tcm_vhost_port_unlink(struct se_portal_group *se_tpg,
-       struct se_lun *se_lun)
+       struct se_lun *lun)
 {
        struct tcm_vhost_tpg *tv_tpg = container_of(se_tpg,
                                struct tcm_vhost_tpg, se_tpg);
 
+       mutex_lock(&tcm_vhost_mutex);
+
        mutex_lock(&tv_tpg->tv_tpg_mutex);
        tv_tpg->tv_tpg_port_count--;
        mutex_unlock(&tv_tpg->tv_tpg_mutex);
+
+       tcm_vhost_hotunplug(tv_tpg, lun);
+
+       mutex_unlock(&tcm_vhost_mutex);
 }
 
 static struct se_node_acl *tcm_vhost_make_nodeacl(