Comment 26 for bug 1815910

vhost_scsi would be like:

#1 making the module available:
  $ sudo modprobe vhost_scsi
#2 some prework to set things up [1]

My disk:
/dev/disk/by-path/ccw-0.0.e000-fc-0x50050763060b16b6-lun-0x4024400a00000000

$ sudo targetcli
targetcli shell version 2.1.fb48
Copyright 2011-2013 by Datera, Inc and others.
For help on commands, type 'help'.

/> backstores/block create name=disk1 dev=/dev/disk/by-path/ccw-0.0.e000-fc-0x50050763060b16b6-lun-0x4024400a00000000
Created block storage object disk1 using /dev/disk/by-path/ccw-0.0.e000-fc-0x50050763060b16b6-lun-0x4024400a00000000.
/> vhost/ create
Created target naa.50014054d8284df8.
Created TPG 1.
/> vhost/naa.50014054d8284df8/tpg1/luns create /backstores/block/disk1
Created LUN 0.

Then in libvirt:
    <hostdev mode='subsystem' type='scsi_host' managed='no'>
      <source protocol='vhost' wwpn='naa.50014054d8284df8'/>
    </hostdev>

This again is mediated by libvirt and passed as FD
  -device vhost-scsi-ccw,wwpn=naa.50014054d8284df8,vhostfd=28,id=hostdev0,devno=fe.0.0007
  -netdev tap,fd=26,id=hostnet0,vhost=on,vhostfd=27

Works without a rule:
$ sudo lsof -p 14118 +fg | grep vhost
qemu-syst 14118 libvirt-qemu 18u CHR RW,LG 10,241 0t0 503 /dev/vhost-vsock
qemu-syst 14118 libvirt-qemu 27u CHR RW,ND,LG 10,238 0t0 502 /dev/vhost-net
qemu-syst 14118 libvirt-qemu 28u CHR RW,LG 10,47 0t0 586 /dev/vhost-scsi

[1]: https://wiki.libvirt.org/page/Vhost-scsi_target