?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
hw/nvme: error handling for too many mappings
[qemu/kevin.git] / hw / nvme / ctrl.c
blobead7531bde5efd3c30d88fd3135acf382d0e8419
1 /*
2 * QEMU NVM Express Controller
3 *
4 * Copyright (c) 2012, Intel Corporation
5 *
6 * Written by Keith Busch <keith.busch@intel.com>
7 *
8 * This code is licensed under the GNU GPL v2 or later.
9 */
10
11 /**
12 * Reference Specs: http://www.nvmexpress.org, 1.4, 1.3, 1.2, 1.1, 1.0e
13 *
14 * https://nvmexpress.org/developers/nvme-specification/
15 *
16 *
17 * Notes on coding style
18 * ---------------------
19 * While QEMU coding style prefers lowercase hexadecimals in constants, the
20 * NVMe subsystem use thes format from the NVMe specifications in the comments
21 * (i.e. 'h' suffix instead of '0x' prefix).
22 *
23 * Usage
24 * -----
25 * See docs/system/nvme.rst for extensive documentation.
26 *
27 * Add options:
28 * -drive file=<file>,if=none,id=<drive_id>
29 * -device nvme-subsys,id=<subsys_id>,nqn=<nqn_id>
30 * -device nvme,serial=<serial>,id=<bus_name>, \
31 * cmb_size_mb=<cmb_size_mb[optional]>, \
32 * [pmrdev=<mem_backend_file_id>,] \
33 * max_ioqpairs=<N[optional]>, \
34 * aerl=<N[optional]>,aer_max_queued=<N[optional]>, \
35 * mdts=<N[optional]>,vsl=<N[optional]>, \
36 * zoned.zasl=<N[optional]>, \
37 * zoned.auto_transition=<on|off[optional]>, \
38 * subsys=<subsys_id>
39 * -device nvme-ns,drive=<drive_id>,bus=<bus_name>,nsid=<nsid>,\
40 * zoned=<true|false[optional]>, \
41 * subsys=<subsys_id>,detached=<true|false[optional]>
42 *
43 * Note cmb_size_mb denotes size of CMB in MB. CMB is assumed to be at
44 * offset 0 in BAR2 and supports only WDS, RDS and SQS for now. By default, the
45 * device will use the "v1.4 CMB scheme" - use the `legacy-cmb` parameter to
46 * always enable the CMBLOC and CMBSZ registers (v1.3 behavior).
47 *
48 * Enabling pmr emulation can be achieved by pointing to memory-backend-file.
49 * For example:
50 * -object memory-backend-file,id=<mem_id>,share=on,mem-path=<file_path>, \
51 * size=<size> .... -device nvme,...,pmrdev=<mem_id>
52 *
53 * The PMR will use BAR 4/5 exclusively.
54 *
55 * To place controller(s) and namespace(s) to a subsystem, then provide
56 * nvme-subsys device as above.
57 *
58 * nvme subsystem device parameters
59 * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
60 * - `nqn`
61 * This parameter provides the `<nqn_id>` part of the string
62 * `nqn.2019-08.org.qemu:<nqn_id>` which will be reported in the SUBNQN field
63 * of subsystem controllers. Note that `<nqn_id>` should be unique per
64 * subsystem, but this is not enforced by QEMU. If not specified, it will
65 * default to the value of the `id` parameter (`<subsys_id>`).
66 *
67 * nvme device parameters
68 * ~~~~~~~~~~~~~~~~~~~~~~
69 * - `subsys`
70 * Specifying this parameter attaches the controller to the subsystem and
71 * the SUBNQN field in the controller will report the NQN of the subsystem
72 * device. This also enables multi controller capability represented in
73 * Identify Controller data structure in CMIC (Controller Multi-path I/O and
74 * Namesapce Sharing Capabilities).
75 *
76 * - `aerl`
77 * The Asynchronous Event Request Limit (AERL). Indicates the maximum number
78 * of concurrently outstanding Asynchronous Event Request commands support
79 * by the controller. This is a 0's based value.
80 *
81 * - `aer_max_queued`
82 * This is the maximum number of events that the device will enqueue for
83 * completion when there are no outstanding AERs. When the maximum number of
84 * enqueued events are reached, subsequent events will be dropped.
85 *
86 * - `mdts`
87 * Indicates the maximum data transfer size for a command that transfers data
88 * between host-accessible memory and the controller. The value is specified
89 * as a power of two (2^n) and is in units of the minimum memory page size
90 * (CAP.MPSMIN). The default value is 7 (i.e. 512 KiB).
91 *
92 * - `vsl`
93 * Indicates the maximum data size limit for the Verify command. Like `mdts`,
94 * this value is specified as a power of two (2^n) and is in units of the
95 * minimum memory page size (CAP.MPSMIN). The default value is 7 (i.e. 512
96 * KiB).
97 *
98 * - `zoned.zasl`
99 * Indicates the maximum data transfer size for the Zone Append command. Like
100 * `mdts`, the value is specified as a power of two (2^n) and is in units of
101 * the minimum memory page size (CAP.MPSMIN). The default value is 0 (i.e.
102 * defaulting to the value of `mdts`).
103 *
104 * - `zoned.auto_transition`
105 * Indicates if zones in zone state implicitly opened can be automatically
106 * transitioned to zone state closed for resource management purposes.
107 * Defaults to 'on'.
108 *
109 * nvme namespace device parameters
110 * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
111 * - `shared`
112 * When the parent nvme device (as defined explicitly by the 'bus' parameter
113 * or implicitly by the most recently defined NvmeBus) is linked to an
114 * nvme-subsys device, the namespace will be attached to all controllers in
115 * the subsystem. If set to 'off' (the default), the namespace will remain a
116 * private namespace and may only be attached to a single controller at a
117 * time.
118 *
119 * - `detached`
120 * This parameter is only valid together with the `subsys` parameter. If left
121 * at the default value (`false/off`), the namespace will be attached to all
122 * controllers in the NVMe subsystem at boot-up. If set to `true/on`, the
123 * namespace will be available in the subsystem but not attached to any
124 * controllers.
125 *
126 * Setting `zoned` to true selects Zoned Command Set at the namespace.
127 * In this case, the following namespace properties are available to configure
128 * zoned operation:
129 * zoned.zone_size=<zone size in bytes, default: 128MiB>
130 * The number may be followed by K, M, G as in kilo-, mega- or giga-.
131 *
132 * zoned.zone_capacity=<zone capacity in bytes, default: zone size>
133 * The value 0 (default) forces zone capacity to be the same as zone
134 * size. The value of this property may not exceed zone size.
135 *
136 * zoned.descr_ext_size=<zone descriptor extension size, default 0>
137 * This value needs to be specified in 64B units. If it is zero,
138 * namespace(s) will not support zone descriptor extensions.
139 *
140 * zoned.max_active=<Maximum Active Resources (zones), default: 0>
141 * The default value means there is no limit to the number of
142 * concurrently active zones.
143 *
144 * zoned.max_open=<Maximum Open Resources (zones), default: 0>
145 * The default value means there is no limit to the number of
146 * concurrently open zones.
147 *
148 * zoned.cross_read=<enable RAZB, default: false>
149 * Setting this property to true enables Read Across Zone Boundaries.
150 */
151
152 #include "qemu/osdep.h"
153 #include "qemu/cutils.h"
154 #include "qemu/error-report.h"
155 #include "qemu/log.h"
156 #include "qemu/units.h"
157 #include "qapi/error.h"
158 #include "qapi/visitor.h"
159 #include "sysemu/sysemu.h"
160 #include "sysemu/block-backend.h"
161 #include "sysemu/hostmem.h"
162 #include "hw/pci/msix.h"
163 #include "migration/vmstate.h"
164
165 #include "nvme.h"
166 #include "trace.h"
167
168 #define NVME_MAX_IOQPAIRS 0xffff
169 #define NVME_DB_SIZE 4
170 #define NVME_SPEC_VER 0x00010400
171 #define NVME_CMB_BIR 2
172 #define NVME_PMR_BIR 4
173 #define NVME_TEMPERATURE 0x143
174 #define NVME_TEMPERATURE_WARNING 0x157
175 #define NVME_TEMPERATURE_CRITICAL 0x175
176 #define NVME_NUM_FW_SLOTS 1
177 #define NVME_DEFAULT_MAX_ZA_SIZE (128 * KiB)
178
179 #define NVME_GUEST_ERR(trace, fmt, ...) \
180 do { \
181 (trace_##trace)(__VA_ARGS__); \
182 qemu_log_mask(LOG_GUEST_ERROR, #trace \
183 " in %s: " fmt "\n", __func__, ## __VA_ARGS__); \
184 } while (0)
185
186 static const bool nvme_feature_support[NVME_FID_MAX] = {
187 [NVME_ARBITRATION] = true,
188 [NVME_POWER_MANAGEMENT] = true,
189 [NVME_TEMPERATURE_THRESHOLD] = true,
190 [NVME_ERROR_RECOVERY] = true,
191 [NVME_VOLATILE_WRITE_CACHE] = true,
192 [NVME_NUMBER_OF_QUEUES] = true,
193 [NVME_INTERRUPT_COALESCING] = true,
194 [NVME_INTERRUPT_VECTOR_CONF] = true,
195 [NVME_WRITE_ATOMICITY] = true,
196 [NVME_ASYNCHRONOUS_EVENT_CONF] = true,
197 [NVME_TIMESTAMP] = true,
198 [NVME_COMMAND_SET_PROFILE] = true,
199 };
200
201 static const uint32_t nvme_feature_cap[NVME_FID_MAX] = {
202 [NVME_TEMPERATURE_THRESHOLD] = NVME_FEAT_CAP_CHANGE,
203 [NVME_ERROR_RECOVERY] = NVME_FEAT_CAP_CHANGE | NVME_FEAT_CAP_NS,
204 [NVME_VOLATILE_WRITE_CACHE] = NVME_FEAT_CAP_CHANGE,
205 [NVME_NUMBER_OF_QUEUES] = NVME_FEAT_CAP_CHANGE,
206 [NVME_ASYNCHRONOUS_EVENT_CONF] = NVME_FEAT_CAP_CHANGE,
207 [NVME_TIMESTAMP] = NVME_FEAT_CAP_CHANGE,
208 [NVME_COMMAND_SET_PROFILE] = NVME_FEAT_CAP_CHANGE,
209 };
210
211 static const uint32_t nvme_cse_acs[256] = {
212 [NVME_ADM_CMD_DELETE_SQ] = NVME_CMD_EFF_CSUPP,
213 [NVME_ADM_CMD_CREATE_SQ] = NVME_CMD_EFF_CSUPP,
214 [NVME_ADM_CMD_GET_LOG_PAGE] = NVME_CMD_EFF_CSUPP,
215 [NVME_ADM_CMD_DELETE_CQ] = NVME_CMD_EFF_CSUPP,
216 [NVME_ADM_CMD_CREATE_CQ] = NVME_CMD_EFF_CSUPP,
217 [NVME_ADM_CMD_IDENTIFY] = NVME_CMD_EFF_CSUPP,
218 [NVME_ADM_CMD_ABORT] = NVME_CMD_EFF_CSUPP,
219 [NVME_ADM_CMD_SET_FEATURES] = NVME_CMD_EFF_CSUPP,
220 [NVME_ADM_CMD_GET_FEATURES] = NVME_CMD_EFF_CSUPP,
221 [NVME_ADM_CMD_ASYNC_EV_REQ] = NVME_CMD_EFF_CSUPP,
222 [NVME_ADM_CMD_NS_ATTACHMENT] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_NIC,
223 [NVME_ADM_CMD_FORMAT_NVM] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
224 };
225
226 static const uint32_t nvme_cse_iocs_none[256];
227
228 static const uint32_t nvme_cse_iocs_nvm[256] = {
229 [NVME_CMD_FLUSH] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
230 [NVME_CMD_WRITE_ZEROES] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
231 [NVME_CMD_WRITE] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
232 [NVME_CMD_READ] = NVME_CMD_EFF_CSUPP,
233 [NVME_CMD_DSM] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
234 [NVME_CMD_VERIFY] = NVME_CMD_EFF_CSUPP,
235 [NVME_CMD_COPY] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
236 [NVME_CMD_COMPARE] = NVME_CMD_EFF_CSUPP,
237 };
238
239 static const uint32_t nvme_cse_iocs_zoned[256] = {
240 [NVME_CMD_FLUSH] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
241 [NVME_CMD_WRITE_ZEROES] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
242 [NVME_CMD_WRITE] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
243 [NVME_CMD_READ] = NVME_CMD_EFF_CSUPP,
244 [NVME_CMD_DSM] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
245 [NVME_CMD_VERIFY] = NVME_CMD_EFF_CSUPP,
246 [NVME_CMD_COPY] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
247 [NVME_CMD_COMPARE] = NVME_CMD_EFF_CSUPP,
248 [NVME_CMD_ZONE_APPEND] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
249 [NVME_CMD_ZONE_MGMT_SEND] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
250 [NVME_CMD_ZONE_MGMT_RECV] = NVME_CMD_EFF_CSUPP,
251 };
252
253 static void nvme_process_sq(void *opaque);
254
255 static uint16_t nvme_sqid(NvmeRequest *req)
256 {
257 return le16_to_cpu(req->sq->sqid);
258 }
259
260 static void nvme_assign_zone_state(NvmeNamespace *ns, NvmeZone *zone,
261 NvmeZoneState state)
262 {
263 if (QTAILQ_IN_USE(zone, entry)) {
264 switch (nvme_get_zone_state(zone)) {
265 case NVME_ZONE_STATE_EXPLICITLY_OPEN:
266 QTAILQ_REMOVE(&ns->exp_open_zones, zone, entry);
267 break;
268 case NVME_ZONE_STATE_IMPLICITLY_OPEN:
269 QTAILQ_REMOVE(&ns->imp_open_zones, zone, entry);
270 break;
271 case NVME_ZONE_STATE_CLOSED:
272 QTAILQ_REMOVE(&ns->closed_zones, zone, entry);
273 break;
274 case NVME_ZONE_STATE_FULL:
275 QTAILQ_REMOVE(&ns->full_zones, zone, entry);
276 default:
277 ;
278 }
279 }
280
281 nvme_set_zone_state(zone, state);
282
283 switch (state) {
284 case NVME_ZONE_STATE_EXPLICITLY_OPEN:
285 QTAILQ_INSERT_TAIL(&ns->exp_open_zones, zone, entry);
286 break;
287 case NVME_ZONE_STATE_IMPLICITLY_OPEN:
288 QTAILQ_INSERT_TAIL(&ns->imp_open_zones, zone, entry);
289 break;
290 case NVME_ZONE_STATE_CLOSED:
291 QTAILQ_INSERT_TAIL(&ns->closed_zones, zone, entry);
292 break;
293 case NVME_ZONE_STATE_FULL:
294 QTAILQ_INSERT_TAIL(&ns->full_zones, zone, entry);
295 case NVME_ZONE_STATE_READ_ONLY:
296 break;
297 default:
298 zone->d.za = 0;
299 }
300 }
301
302 /*
303 * Check if we can open a zone without exceeding open/active limits.
304 * AOR stands for "Active and Open Resources" (see TP 4053 section 2.5).
305 */
306 static int nvme_aor_check(NvmeNamespace *ns, uint32_t act, uint32_t opn)
307 {
308 if (ns->params.max_active_zones != 0 &&
309 ns->nr_active_zones + act > ns->params.max_active_zones) {
310 trace_pci_nvme_err_insuff_active_res(ns->params.max_active_zones);
311 return NVME_ZONE_TOO_MANY_ACTIVE | NVME_DNR;
312 }
313 if (ns->params.max_open_zones != 0 &&
314 ns->nr_open_zones + opn > ns->params.max_open_zones) {
315 trace_pci_nvme_err_insuff_open_res(ns->params.max_open_zones);
316 return NVME_ZONE_TOO_MANY_OPEN | NVME_DNR;
317 }
318
319 return NVME_SUCCESS;
320 }
321
322 static bool nvme_addr_is_cmb(NvmeCtrl *n, hwaddr addr)
323 {
324 hwaddr hi, lo;
325
326 if (!n->cmb.cmse) {
327 return false;
328 }
329
330 lo = n->params.legacy_cmb ? n->cmb.mem.addr : n->cmb.cba;
331 hi = lo + int128_get64(n->cmb.mem.size);
332
333 return addr >= lo && addr < hi;
334 }
335
336 static inline void *nvme_addr_to_cmb(NvmeCtrl *n, hwaddr addr)
337 {
338 hwaddr base = n->params.legacy_cmb ? n->cmb.mem.addr : n->cmb.cba;
339 return &n->cmb.buf[addr - base];
340 }
341
342 static bool nvme_addr_is_pmr(NvmeCtrl *n, hwaddr addr)
343 {
344 hwaddr hi;
345
346 if (!n->pmr.cmse) {
347 return false;
348 }
349
350 hi = n->pmr.cba + int128_get64(n->pmr.dev->mr.size);
351
352 return addr >= n->pmr.cba && addr < hi;
353 }
354
355 static inline void *nvme_addr_to_pmr(NvmeCtrl *n, hwaddr addr)
356 {
357 return memory_region_get_ram_ptr(&n->pmr.dev->mr) + (addr - n->pmr.cba);
358 }
359
360 static int nvme_addr_read(NvmeCtrl *n, hwaddr addr, void *buf, int size)
361 {
362 hwaddr hi = addr + size - 1;
363 if (hi < addr) {
364 return 1;
365 }
366
367 if (n->bar.cmbsz && nvme_addr_is_cmb(n, addr) && nvme_addr_is_cmb(n, hi)) {
368 memcpy(buf, nvme_addr_to_cmb(n, addr), size);
369 return 0;
370 }
371
372 if (nvme_addr_is_pmr(n, addr) && nvme_addr_is_pmr(n, hi)) {
373 memcpy(buf, nvme_addr_to_pmr(n, addr), size);
374 return 0;
375 }
376
377 return pci_dma_read(&n->parent_obj, addr, buf, size);
378 }
379
380 static int nvme_addr_write(NvmeCtrl *n, hwaddr addr, void *buf, int size)
381 {
382 hwaddr hi = addr + size - 1;
383 if (hi < addr) {
384 return 1;
385 }
386
387 if (n->bar.cmbsz && nvme_addr_is_cmb(n, addr) && nvme_addr_is_cmb(n, hi)) {
388 memcpy(nvme_addr_to_cmb(n, addr), buf, size);
389 return 0;
390 }
391
392 if (nvme_addr_is_pmr(n, addr) && nvme_addr_is_pmr(n, hi)) {
393 memcpy(nvme_addr_to_pmr(n, addr), buf, size);
394 return 0;
395 }
396
397 return pci_dma_write(&n->parent_obj, addr, buf, size);
398 }
399
400 static bool nvme_nsid_valid(NvmeCtrl *n, uint32_t nsid)
401 {
402 return nsid &&
403 (nsid == NVME_NSID_BROADCAST || nsid <= NVME_MAX_NAMESPACES);
404 }
405
406 static int nvme_check_sqid(NvmeCtrl *n, uint16_t sqid)
407 {
408 return sqid < n->params.max_ioqpairs + 1 && n->sq[sqid] != NULL ? 0 : -1;
409 }
410
411 static int nvme_check_cqid(NvmeCtrl *n, uint16_t cqid)
412 {
413 return cqid < n->params.max_ioqpairs + 1 && n->cq[cqid] != NULL ? 0 : -1;
414 }
415
416 static void nvme_inc_cq_tail(NvmeCQueue *cq)
417 {
418 cq->tail++;
419 if (cq->tail >= cq->size) {
420 cq->tail = 0;
421 cq->phase = !cq->phase;
422 }
423 }
424
425 static void nvme_inc_sq_head(NvmeSQueue *sq)
426 {
427 sq->head = (sq->head + 1) % sq->size;
428 }
429
430 static uint8_t nvme_cq_full(NvmeCQueue *cq)
431 {
432 return (cq->tail + 1) % cq->size == cq->head;
433 }
434
435 static uint8_t nvme_sq_empty(NvmeSQueue *sq)
436 {
437 return sq->head == sq->tail;
438 }
439
440 static void nvme_irq_check(NvmeCtrl *n)
441 {
442 if (msix_enabled(&(n->parent_obj))) {
443 return;
444 }
445 if (~n->bar.intms & n->irq_status) {
446 pci_irq_assert(&n->parent_obj);
447 } else {
448 pci_irq_deassert(&n->parent_obj);
449 }
450 }
451
452 static void nvme_irq_assert(NvmeCtrl *n, NvmeCQueue *cq)
453 {
454 if (cq->irq_enabled) {
455 if (msix_enabled(&(n->parent_obj))) {
456 trace_pci_nvme_irq_msix(cq->vector);
457 msix_notify(&(n->parent_obj), cq->vector);
458 } else {
459 trace_pci_nvme_irq_pin();
460 assert(cq->vector < 32);
461 n->irq_status |= 1 << cq->vector;
462 nvme_irq_check(n);
463 }
464 } else {
465 trace_pci_nvme_irq_masked();
466 }
467 }
468
469 static void nvme_irq_deassert(NvmeCtrl *n, NvmeCQueue *cq)
470 {
471 if (cq->irq_enabled) {
472 if (msix_enabled(&(n->parent_obj))) {
473 return;
474 } else {
475 assert(cq->vector < 32);
476 if (!n->cq_pending) {
477 n->irq_status &= ~(1 << cq->vector);
478 }
479 nvme_irq_check(n);
480 }
481 }
482 }
483
484 static void nvme_req_clear(NvmeRequest *req)
485 {
486 req->ns = NULL;
487 req->opaque = NULL;
488 req->aiocb = NULL;
489 memset(&req->cqe, 0x0, sizeof(req->cqe));
490 req->status = NVME_SUCCESS;
491 }
492
493 static inline void nvme_sg_init(NvmeCtrl *n, NvmeSg *sg, bool dma)
494 {
495 if (dma) {
496 pci_dma_sglist_init(&sg->qsg, &n->parent_obj, 0);
497 sg->flags = NVME_SG_DMA;
498 } else {
499 qemu_iovec_init(&sg->iov, 0);
500 }
501
502 sg->flags |= NVME_SG_ALLOC;
503 }
504
505 static inline void nvme_sg_unmap(NvmeSg *sg)
506 {
507 if (!(sg->flags & NVME_SG_ALLOC)) {
508 return;
509 }
510
511 if (sg->flags & NVME_SG_DMA) {
512 qemu_sglist_destroy(&sg->qsg);
513 } else {
514 qemu_iovec_destroy(&sg->iov);
515 }
516
517 memset(sg, 0x0, sizeof(*sg));
518 }
519
520 /*
521 * When metadata is transfered as extended LBAs, the DPTR mapped into `sg`
522 * holds both data and metadata. This function splits the data and metadata
523 * into two separate QSG/IOVs.
524 */
525 static void nvme_sg_split(NvmeSg *sg, NvmeNamespace *ns, NvmeSg *data,
526 NvmeSg *mdata)
527 {
528 NvmeSg *dst = data;
529 uint32_t trans_len, count = ns->lbasz;
530 uint64_t offset = 0;
531 bool dma = sg->flags & NVME_SG_DMA;
532 size_t sge_len;
533 size_t sg_len = dma ? sg->qsg.size : sg->iov.size;
534 int sg_idx = 0;
535
536 assert(sg->flags & NVME_SG_ALLOC);
537
538 while (sg_len) {
539 sge_len = dma ? sg->qsg.sg[sg_idx].len : sg->iov.iov[sg_idx].iov_len;
540
541 trans_len = MIN(sg_len, count);
542 trans_len = MIN(trans_len, sge_len - offset);
543
544 if (dst) {
545 if (dma) {
546 qemu_sglist_add(&dst->qsg, sg->qsg.sg[sg_idx].base + offset,
547 trans_len);
548 } else {
549 qemu_iovec_add(&dst->iov,
550 sg->iov.iov[sg_idx].iov_base + offset,
551 trans_len);
552 }
553 }
554
555 sg_len -= trans_len;
556 count -= trans_len;
557 offset += trans_len;
558
559 if (count == 0) {
560 dst = (dst == data) ? mdata : data;
561 count = (dst == data) ? ns->lbasz : ns->lbaf.ms;
562 }
563
564 if (sge_len == offset) {
565 offset = 0;
566 sg_idx++;
567 }
568 }
569 }
570
571 static uint16_t nvme_map_addr_cmb(NvmeCtrl *n, QEMUIOVector *iov, hwaddr addr,
572 size_t len)
573 {
574 if (!len) {
575 return NVME_SUCCESS;
576 }
577
578 trace_pci_nvme_map_addr_cmb(addr, len);
579
580 if (!nvme_addr_is_cmb(n, addr) || !nvme_addr_is_cmb(n, addr + len - 1)) {
581 return NVME_DATA_TRAS_ERROR;
582 }
583
584 qemu_iovec_add(iov, nvme_addr_to_cmb(n, addr), len);
585
586 return NVME_SUCCESS;
587 }
588
589 static uint16_t nvme_map_addr_pmr(NvmeCtrl *n, QEMUIOVector *iov, hwaddr addr,
590 size_t len)
591 {
592 if (!len) {
593 return NVME_SUCCESS;
594 }
595
596 if (!nvme_addr_is_pmr(n, addr) || !nvme_addr_is_pmr(n, addr + len - 1)) {
597 return NVME_DATA_TRAS_ERROR;
598 }
599
600 qemu_iovec_add(iov, nvme_addr_to_pmr(n, addr), len);
601
602 return NVME_SUCCESS;
603 }
604
605 static uint16_t nvme_map_addr(NvmeCtrl *n, NvmeSg *sg, hwaddr addr, size_t len)
606 {
607 bool cmb = false, pmr = false;
608
609 if (!len) {
610 return NVME_SUCCESS;
611 }
612
613 trace_pci_nvme_map_addr(addr, len);
614
615 if (nvme_addr_is_cmb(n, addr)) {
616 cmb = true;
617 } else if (nvme_addr_is_pmr(n, addr)) {
618 pmr = true;
619 }
620
621 if (cmb || pmr) {
622 if (sg->flags & NVME_SG_DMA) {
623 return NVME_INVALID_USE_OF_CMB | NVME_DNR;
624 }
625
626 if (sg->iov.niov + 1 > IOV_MAX) {
627 goto max_mappings_exceeded;
628 }
629
630 if (cmb) {
631 return nvme_map_addr_cmb(n, &sg->iov, addr, len);
632 } else {
633 return nvme_map_addr_pmr(n, &sg->iov, addr, len);
634 }
635 }
636
637 if (!(sg->flags & NVME_SG_DMA)) {
638 return NVME_INVALID_USE_OF_CMB | NVME_DNR;
639 }
640
641 if (sg->qsg.nsg + 1 > IOV_MAX) {
642 goto max_mappings_exceeded;
643 }
644
645 qemu_sglist_add(&sg->qsg, addr, len);
646
647 return NVME_SUCCESS;
648
649 max_mappings_exceeded:
650 NVME_GUEST_ERR(pci_nvme_ub_too_many_mappings,
651 "number of mappings exceed 1024");
652 return NVME_INTERNAL_DEV_ERROR | NVME_DNR;
653 }
654
655 static inline bool nvme_addr_is_dma(NvmeCtrl *n, hwaddr addr)
656 {
657 return !(nvme_addr_is_cmb(n, addr) || nvme_addr_is_pmr(n, addr));
658 }
659
660 static uint16_t nvme_map_prp(NvmeCtrl *n, NvmeSg *sg, uint64_t prp1,
661 uint64_t prp2, uint32_t len)
662 {
663 hwaddr trans_len = n->page_size - (prp1 % n->page_size);
664 trans_len = MIN(len, trans_len);
665 int num_prps = (len >> n->page_bits) + 1;
666 uint16_t status;
667 int ret;
668
669 trace_pci_nvme_map_prp(trans_len, len, prp1, prp2, num_prps);
670
671 nvme_sg_init(n, sg, nvme_addr_is_dma(n, prp1));
672
673 status = nvme_map_addr(n, sg, prp1, trans_len);
674 if (status) {
675 goto unmap;
676 }
677
678 len -= trans_len;
679 if (len) {
680 if (len > n->page_size) {
681 uint64_t prp_list[n->max_prp_ents];
682 uint32_t nents, prp_trans;
683 int i = 0;
684
685 /*
686 * The first PRP list entry, pointed to by PRP2 may contain offset.
687 * Hence, we need to calculate the number of entries in based on
688 * that offset.
689 */
690 nents = (n->page_size - (prp2 & (n->page_size - 1))) >> 3;
691 prp_trans = MIN(n->max_prp_ents, nents) * sizeof(uint64_t);
692 ret = nvme_addr_read(n, prp2, (void *)prp_list, prp_trans);
693 if (ret) {
694 trace_pci_nvme_err_addr_read(prp2);
695 status = NVME_DATA_TRAS_ERROR;
696 goto unmap;
697 }
698 while (len != 0) {
699 uint64_t prp_ent = le64_to_cpu(prp_list[i]);
700
701 if (i == nents - 1 && len > n->page_size) {
702 if (unlikely(prp_ent & (n->page_size - 1))) {
703 trace_pci_nvme_err_invalid_prplist_ent(prp_ent);
704 status = NVME_INVALID_PRP_OFFSET | NVME_DNR;
705 goto unmap;
706 }
707
708 i = 0;
709 nents = (len + n->page_size - 1) >> n->page_bits;
710 nents = MIN(nents, n->max_prp_ents);
711 prp_trans = nents * sizeof(uint64_t);
712 ret = nvme_addr_read(n, prp_ent, (void *)prp_list,
713 prp_trans);
714 if (ret) {
715 trace_pci_nvme_err_addr_read(prp_ent);
716 status = NVME_DATA_TRAS_ERROR;
717 goto unmap;
718 }
719 prp_ent = le64_to_cpu(prp_list[i]);
720 }
721
722 if (unlikely(prp_ent & (n->page_size - 1))) {
723 trace_pci_nvme_err_invalid_prplist_ent(prp_ent);
724 status = NVME_INVALID_PRP_OFFSET | NVME_DNR;
725 goto unmap;
726 }
727
728 trans_len = MIN(len, n->page_size);
729 status = nvme_map_addr(n, sg, prp_ent, trans_len);
730 if (status) {
731 goto unmap;
732 }
733
734 len -= trans_len;
735 i++;
736 }
737 } else {
738 if (unlikely(prp2 & (n->page_size - 1))) {
739 trace_pci_nvme_err_invalid_prp2_align(prp2);
740 status = NVME_INVALID_PRP_OFFSET | NVME_DNR;
741 goto unmap;
742 }
743 status = nvme_map_addr(n, sg, prp2, len);
744 if (status) {
745 goto unmap;
746 }
747 }
748 }
749
750 return NVME_SUCCESS;
751
752 unmap:
753 nvme_sg_unmap(sg);
754 return status;
755 }
756
757 /*
758 * Map 'nsgld' data descriptors from 'segment'. The function will subtract the
759 * number of bytes mapped in len.
760 */
761 static uint16_t nvme_map_sgl_data(NvmeCtrl *n, NvmeSg *sg,
762 NvmeSglDescriptor *segment, uint64_t nsgld,
763 size_t *len, NvmeCmd *cmd)
764 {
765 dma_addr_t addr, trans_len;
766 uint32_t dlen;
767 uint16_t status;
768
769 for (int i = 0; i < nsgld; i++) {
770 uint8_t type = NVME_SGL_TYPE(segment[i].type);
771
772 switch (type) {
773 case NVME_SGL_DESCR_TYPE_BIT_BUCKET:
774 if (cmd->opcode == NVME_CMD_WRITE) {
775 continue;
776 }
777 case NVME_SGL_DESCR_TYPE_DATA_BLOCK:
778 break;
779 case NVME_SGL_DESCR_TYPE_SEGMENT:
780 case NVME_SGL_DESCR_TYPE_LAST_SEGMENT:
781 return NVME_INVALID_NUM_SGL_DESCRS | NVME_DNR;
782 default:
783 return NVME_SGL_DESCR_TYPE_INVALID | NVME_DNR;
784 }
785
786 dlen = le32_to_cpu(segment[i].len);
787
788 if (!dlen) {
789 continue;
790 }
791
792 if (*len == 0) {
793 /*
794 * All data has been mapped, but the SGL contains additional
795 * segments and/or descriptors. The controller might accept
796 * ignoring the rest of the SGL.
797 */
798 uint32_t sgls = le32_to_cpu(n->id_ctrl.sgls);
799 if (sgls & NVME_CTRL_SGLS_EXCESS_LENGTH) {
800 break;
801 }
802
803 trace_pci_nvme_err_invalid_sgl_excess_length(dlen);
804 return NVME_DATA_SGL_LEN_INVALID | NVME_DNR;
805 }
806
807 trans_len = MIN(*len, dlen);
808
809 if (type == NVME_SGL_DESCR_TYPE_BIT_BUCKET) {
810 goto next;
811 }
812
813 addr = le64_to_cpu(segment[i].addr);
814
815 if (UINT64_MAX - addr < dlen) {
816 return NVME_DATA_SGL_LEN_INVALID | NVME_DNR;
817 }
818
819 status = nvme_map_addr(n, sg, addr, trans_len);
820 if (status) {
821 return status;
822 }
823
824 next:
825 *len -= trans_len;
826 }
827
828 return NVME_SUCCESS;
829 }
830
831 static uint16_t nvme_map_sgl(NvmeCtrl *n, NvmeSg *sg, NvmeSglDescriptor sgl,
832 size_t len, NvmeCmd *cmd)
833 {
834 /*
835 * Read the segment in chunks of 256 descriptors (one 4k page) to avoid
836 * dynamically allocating a potentially huge SGL. The spec allows the SGL
837 * to be larger (as in number of bytes required to describe the SGL
838 * descriptors and segment chain) than the command transfer size, so it is
839 * not bounded by MDTS.
840 */
841 const int SEG_CHUNK_SIZE = 256;
842
843 NvmeSglDescriptor segment[SEG_CHUNK_SIZE], *sgld, *last_sgld;
844 uint64_t nsgld;
845 uint32_t seg_len;
846 uint16_t status;
847 hwaddr addr;
848 int ret;
849
850 sgld = &sgl;
851 addr = le64_to_cpu(sgl.addr);
852
853 trace_pci_nvme_map_sgl(NVME_SGL_TYPE(sgl.type), len);
854
855 nvme_sg_init(n, sg, nvme_addr_is_dma(n, addr));
856
857 /*
858 * If the entire transfer can be described with a single data block it can
859 * be mapped directly.
860 */
861 if (NVME_SGL_TYPE(sgl.type) == NVME_SGL_DESCR_TYPE_DATA_BLOCK) {
862 status = nvme_map_sgl_data(n, sg, sgld, 1, &len, cmd);
863 if (status) {
864 goto unmap;
865 }
866
867 goto out;
868 }
869
870 for (;;) {
871 switch (NVME_SGL_TYPE(sgld->type)) {
872 case NVME_SGL_DESCR_TYPE_SEGMENT:
873 case NVME_SGL_DESCR_TYPE_LAST_SEGMENT:
874 break;
875 default:
876 return NVME_INVALID_SGL_SEG_DESCR | NVME_DNR;
877 }
878
879 seg_len = le32_to_cpu(sgld->len);
880
881 /* check the length of the (Last) Segment descriptor */
882 if ((!seg_len || seg_len & 0xf) &&
883 (NVME_SGL_TYPE(sgld->type) != NVME_SGL_DESCR_TYPE_BIT_BUCKET)) {
884 return NVME_INVALID_SGL_SEG_DESCR | NVME_DNR;
885 }
886
887 if (UINT64_MAX - addr < seg_len) {
888 return NVME_DATA_SGL_LEN_INVALID | NVME_DNR;
889 }
890
891 nsgld = seg_len / sizeof(NvmeSglDescriptor);
892
893 while (nsgld > SEG_CHUNK_SIZE) {
894 if (nvme_addr_read(n, addr, segment, sizeof(segment))) {
895 trace_pci_nvme_err_addr_read(addr);
896 status = NVME_DATA_TRAS_ERROR;
897 goto unmap;
898 }
899
900 status = nvme_map_sgl_data(n, sg, segment, SEG_CHUNK_SIZE,
901 &len, cmd);
902 if (status) {
903 goto unmap;
904 }
905
906 nsgld -= SEG_CHUNK_SIZE;
907 addr += SEG_CHUNK_SIZE * sizeof(NvmeSglDescriptor);
908 }
909
910 ret = nvme_addr_read(n, addr, segment, nsgld *
911 sizeof(NvmeSglDescriptor));
912 if (ret) {
913 trace_pci_nvme_err_addr_read(addr);
914 status = NVME_DATA_TRAS_ERROR;
915 goto unmap;
916 }
917
918 last_sgld = &segment[nsgld - 1];
919
920 /*
921 * If the segment ends with a Data Block or Bit Bucket Descriptor Type,
922 * then we are done.
923 */
924 switch (NVME_SGL_TYPE(last_sgld->type)) {
925 case NVME_SGL_DESCR_TYPE_DATA_BLOCK:
926 case NVME_SGL_DESCR_TYPE_BIT_BUCKET:
927 status = nvme_map_sgl_data(n, sg, segment, nsgld, &len, cmd);
928 if (status) {
929 goto unmap;
930 }
931
932 goto out;
933
934 default:
935 break;
936 }
937
938 /*
939 * If the last descriptor was not a Data Block or Bit Bucket, then the
940 * current segment must not be a Last Segment.
941 */
942 if (NVME_SGL_TYPE(sgld->type) == NVME_SGL_DESCR_TYPE_LAST_SEGMENT) {
943 status = NVME_INVALID_SGL_SEG_DESCR | NVME_DNR;
944 goto unmap;
945 }
946
947 sgld = last_sgld;
948 addr = le64_to_cpu(sgld->addr);
949
950 /*
951 * Do not map the last descriptor; it will be a Segment or Last Segment
952 * descriptor and is handled by the next iteration.
953 */
954 status = nvme_map_sgl_data(n, sg, segment, nsgld - 1, &len, cmd);
955 if (status) {
956 goto unmap;
957 }
958 }
959
960 out:
961 /* if there is any residual left in len, the SGL was too short */
962 if (len) {
963 status = NVME_DATA_SGL_LEN_INVALID | NVME_DNR;
964 goto unmap;
965 }
966
967 return NVME_SUCCESS;
968
969 unmap:
970 nvme_sg_unmap(sg);
971 return status;
972 }
973
974 uint16_t nvme_map_dptr(NvmeCtrl *n, NvmeSg *sg, size_t len,
975 NvmeCmd *cmd)
976 {
977 uint64_t prp1, prp2;
978
979 switch (NVME_CMD_FLAGS_PSDT(cmd->flags)) {
980 case NVME_PSDT_PRP:
981 prp1 = le64_to_cpu(cmd->dptr.prp1);
982 prp2 = le64_to_cpu(cmd->dptr.prp2);
983
984 return nvme_map_prp(n, sg, prp1, prp2, len);
985 case NVME_PSDT_SGL_MPTR_CONTIGUOUS:
986 case NVME_PSDT_SGL_MPTR_SGL:
987 return nvme_map_sgl(n, sg, cmd->dptr.sgl, len, cmd);
988 default:
989 return NVME_INVALID_FIELD;
990 }
991 }
992
993 static uint16_t nvme_map_mptr(NvmeCtrl *n, NvmeSg *sg, size_t len,
994 NvmeCmd *cmd)
995 {
996 int psdt = NVME_CMD_FLAGS_PSDT(cmd->flags);
997 hwaddr mptr = le64_to_cpu(cmd->mptr);
998 uint16_t status;
999
1000 if (psdt == NVME_PSDT_SGL_MPTR_SGL) {
1001 NvmeSglDescriptor sgl;
1002
1003 if (nvme_addr_read(n, mptr, &sgl, sizeof(sgl))) {
1004 return NVME_DATA_TRAS_ERROR;
1005 }
1006
1007 status = nvme_map_sgl(n, sg, sgl, len, cmd);
1008 if (status && (status & 0x7ff) == NVME_DATA_SGL_LEN_INVALID) {
1009 status = NVME_MD_SGL_LEN_INVALID | NVME_DNR;
1010 }
1011
1012 return status;
1013 }
1014
1015 nvme_sg_init(n, sg, nvme_addr_is_dma(n, mptr));
1016 status = nvme_map_addr(n, sg, mptr, len);
1017 if (status) {
1018 nvme_sg_unmap(sg);
1019 }
1020
1021 return status;
1022 }
1023
1024 static uint16_t nvme_map_data(NvmeCtrl *n, uint32_t nlb, NvmeRequest *req)
1025 {
1026 NvmeNamespace *ns = req->ns;
1027 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd;
1028 bool pi = !!NVME_ID_NS_DPS_TYPE(ns->id_ns.dps);
1029 bool pract = !!(le16_to_cpu(rw->control) & NVME_RW_PRINFO_PRACT);
1030 size_t len = nvme_l2b(ns, nlb);
1031 uint16_t status;
1032
1033 if (nvme_ns_ext(ns) && !(pi && pract && ns->lbaf.ms == 8)) {
1034 NvmeSg sg;
1035
1036 len += nvme_m2b(ns, nlb);
1037
1038 status = nvme_map_dptr(n, &sg, len, &req->cmd);
1039 if (status) {
1040 return status;
1041 }
1042
1043 nvme_sg_init(n, &req->sg, sg.flags & NVME_SG_DMA);
1044 nvme_sg_split(&sg, ns, &req->sg, NULL);
1045 nvme_sg_unmap(&sg);
1046
1047 return NVME_SUCCESS;
1048 }
1049
1050 return nvme_map_dptr(n, &req->sg, len, &req->cmd);
1051 }
1052
1053 static uint16_t nvme_map_mdata(NvmeCtrl *n, uint32_t nlb, NvmeRequest *req)
1054 {
1055 NvmeNamespace *ns = req->ns;
1056 size_t len = nvme_m2b(ns, nlb);
1057 uint16_t status;
1058
1059 if (nvme_ns_ext(ns)) {
1060 NvmeSg sg;
1061
1062 len += nvme_l2b(ns, nlb);
1063
1064 status = nvme_map_dptr(n, &sg, len, &req->cmd);
1065 if (status) {
1066 return status;
1067 }
1068
1069 nvme_sg_init(n, &req->sg, sg.flags & NVME_SG_DMA);
1070 nvme_sg_split(&sg, ns, NULL, &req->sg);
1071 nvme_sg_unmap(&sg);
1072
1073 return NVME_SUCCESS;
1074 }
1075
1076 return nvme_map_mptr(n, &req->sg, len, &req->cmd);
1077 }
1078
1079 static uint16_t nvme_tx_interleaved(NvmeCtrl *n, NvmeSg *sg, uint8_t *ptr,
1080 uint32_t len, uint32_t bytes,
1081 int32_t skip_bytes, int64_t offset,
1082 NvmeTxDirection dir)
1083 {
1084 hwaddr addr;
1085 uint32_t trans_len, count = bytes;
1086 bool dma = sg->flags & NVME_SG_DMA;
1087 int64_t sge_len;
1088 int sg_idx = 0;
1089 int ret;
1090
1091 assert(sg->flags & NVME_SG_ALLOC);
1092
1093 while (len) {
1094 sge_len = dma ? sg->qsg.sg[sg_idx].len : sg->iov.iov[sg_idx].iov_len;
1095
1096 if (sge_len - offset < 0) {
1097 offset -= sge_len;
1098 sg_idx++;
1099 continue;
1100 }
1101
1102 if (sge_len == offset) {
1103 offset = 0;
1104 sg_idx++;
1105 continue;
1106 }
1107
1108 trans_len = MIN(len, count);
1109 trans_len = MIN(trans_len, sge_len - offset);
1110
1111 if (dma) {
1112 addr = sg->qsg.sg[sg_idx].base + offset;
1113 } else {
1114 addr = (hwaddr)(uintptr_t)sg->iov.iov[sg_idx].iov_base + offset;
1115 }
1116
1117 if (dir == NVME_TX_DIRECTION_TO_DEVICE) {
1118 ret = nvme_addr_read(n, addr, ptr, trans_len);
1119 } else {
1120 ret = nvme_addr_write(n, addr, ptr, trans_len);
1121 }
1122
1123 if (ret) {
1124 return NVME_DATA_TRAS_ERROR;
1125 }
1126
1127 ptr += trans_len;
1128 len -= trans_len;
1129 count -= trans_len;
1130 offset += trans_len;
1131
1132 if (count == 0) {
1133 count = bytes;
1134 offset += skip_bytes;
1135 }
1136 }
1137
1138 return NVME_SUCCESS;
1139 }
1140
1141 static uint16_t nvme_tx(NvmeCtrl *n, NvmeSg *sg, uint8_t *ptr, uint32_t len,
1142 NvmeTxDirection dir)
1143 {
1144 assert(sg->flags & NVME_SG_ALLOC);
1145
1146 if (sg->flags & NVME_SG_DMA) {
1147 uint64_t residual;
1148
1149 if (dir == NVME_TX_DIRECTION_TO_DEVICE) {
1150 residual = dma_buf_write(ptr, len, &sg->qsg);
1151 } else {
1152 residual = dma_buf_read(ptr, len, &sg->qsg);
1153 }
1154
1155 if (unlikely(residual)) {
1156 trace_pci_nvme_err_invalid_dma();
1157 return NVME_INVALID_FIELD | NVME_DNR;
1158 }
1159 } else {
1160 size_t bytes;
1161
1162 if (dir == NVME_TX_DIRECTION_TO_DEVICE) {
1163 bytes = qemu_iovec_to_buf(&sg->iov, 0, ptr, len);
1164 } else {
1165 bytes = qemu_iovec_from_buf(&sg->iov, 0, ptr, len);
1166 }
1167
1168 if (unlikely(bytes != len)) {
1169 trace_pci_nvme_err_invalid_dma();
1170 return NVME_INVALID_FIELD | NVME_DNR;
1171 }
1172 }
1173
1174 return NVME_SUCCESS;
1175 }
1176
1177 static inline uint16_t nvme_c2h(NvmeCtrl *n, uint8_t *ptr, uint32_t len,
1178 NvmeRequest *req)
1179 {
1180 uint16_t status;
1181
1182 status = nvme_map_dptr(n, &req->sg, len, &req->cmd);
1183 if (status) {
1184 return status;
1185 }
1186
1187 return nvme_tx(n, &req->sg, ptr, len, NVME_TX_DIRECTION_FROM_DEVICE);
1188 }
1189
1190 static inline uint16_t nvme_h2c(NvmeCtrl *n, uint8_t *ptr, uint32_t len,
1191 NvmeRequest *req)
1192 {
1193 uint16_t status;
1194
1195 status = nvme_map_dptr(n, &req->sg, len, &req->cmd);
1196 if (status) {
1197 return status;
1198 }
1199
1200 return nvme_tx(n, &req->sg, ptr, len, NVME_TX_DIRECTION_TO_DEVICE);
1201 }
1202
1203 uint16_t nvme_bounce_data(NvmeCtrl *n, uint8_t *ptr, uint32_t len,
1204 NvmeTxDirection dir, NvmeRequest *req)
1205 {
1206 NvmeNamespace *ns = req->ns;
1207 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd;
1208 bool pi = !!NVME_ID_NS_DPS_TYPE(ns->id_ns.dps);
1209 bool pract = !!(le16_to_cpu(rw->control) & NVME_RW_PRINFO_PRACT);
1210
1211 if (nvme_ns_ext(ns) && !(pi && pract && ns->lbaf.ms == 8)) {
1212 return nvme_tx_interleaved(n, &req->sg, ptr, len, ns->lbasz,
1213 ns->lbaf.ms, 0, dir);
1214 }
1215
1216 return nvme_tx(n, &req->sg, ptr, len, dir);
1217 }
1218
1219 uint16_t nvme_bounce_mdata(NvmeCtrl *n, uint8_t *ptr, uint32_t len,
1220 NvmeTxDirection dir, NvmeRequest *req)
1221 {
1222 NvmeNamespace *ns = req->ns;
1223 uint16_t status;
1224
1225 if (nvme_ns_ext(ns)) {
1226 return nvme_tx_interleaved(n, &req->sg, ptr, len, ns->lbaf.ms,
1227 ns->lbasz, ns->lbasz, dir);
1228 }
1229
1230 nvme_sg_unmap(&req->sg);
1231
1232 status = nvme_map_mptr(n, &req->sg, len, &req->cmd);
1233 if (status) {
1234 return status;
1235 }
1236
1237 return nvme_tx(n, &req->sg, ptr, len, dir);
1238 }
1239
1240 static inline void nvme_blk_read(BlockBackend *blk, int64_t offset,
1241 BlockCompletionFunc *cb, NvmeRequest *req)
1242 {
1243 assert(req->sg.flags & NVME_SG_ALLOC);
1244
1245 if (req->sg.flags & NVME_SG_DMA) {
1246 req->aiocb = dma_blk_read(blk, &req->sg.qsg, offset, BDRV_SECTOR_SIZE,
1247 cb, req);
1248 } else {
1249 req->aiocb = blk_aio_preadv(blk, offset, &req->sg.iov, 0, cb, req);
1250 }
1251 }
1252
1253 static inline void nvme_blk_write(BlockBackend *blk, int64_t offset,
1254 BlockCompletionFunc *cb, NvmeRequest *req)
1255 {
1256 assert(req->sg.flags & NVME_SG_ALLOC);
1257
1258 if (req->sg.flags & NVME_SG_DMA) {
1259 req->aiocb = dma_blk_write(blk, &req->sg.qsg, offset, BDRV_SECTOR_SIZE,
1260 cb, req);
1261 } else {
1262 req->aiocb = blk_aio_pwritev(blk, offset, &req->sg.iov, 0, cb, req);
1263 }
1264 }
1265
1266 static void nvme_post_cqes(void *opaque)
1267 {
1268 NvmeCQueue *cq = opaque;
1269 NvmeCtrl *n = cq->ctrl;
1270 NvmeRequest *req, *next;
1271 bool pending = cq->head != cq->tail;
1272 int ret;
1273
1274 QTAILQ_FOREACH_SAFE(req, &cq->req_list, entry, next) {
1275 NvmeSQueue *sq;
1276 hwaddr addr;
1277
1278 if (nvme_cq_full(cq)) {
1279 break;
1280 }
1281
1282 sq = req->sq;
1283 req->cqe.status = cpu_to_le16((req->status << 1) | cq->phase);
1284 req->cqe.sq_id = cpu_to_le16(sq->sqid);
1285 req->cqe.sq_head = cpu_to_le16(sq->head);
1286 addr = cq->dma_addr + cq->tail * n->cqe_size;
1287 ret = pci_dma_write(&n->parent_obj, addr, (void *)&req->cqe,
1288 sizeof(req->cqe));
1289 if (ret) {
1290 trace_pci_nvme_err_addr_write(addr);
1291 trace_pci_nvme_err_cfs();
1292 n->bar.csts = NVME_CSTS_FAILED;
1293 break;
1294 }
1295 QTAILQ_REMOVE(&cq->req_list, req, entry);
1296 nvme_inc_cq_tail(cq);
1297 nvme_sg_unmap(&req->sg);
1298 QTAILQ_INSERT_TAIL(&sq->req_list, req, entry);
1299 }
1300 if (cq->tail != cq->head) {
1301 if (cq->irq_enabled && !pending) {
1302 n->cq_pending++;
1303 }
1304
1305 nvme_irq_assert(n, cq);
1306 }
1307 }
1308
1309 static void nvme_enqueue_req_completion(NvmeCQueue *cq, NvmeRequest *req)
1310 {
1311 assert(cq->cqid == req->sq->cqid);
1312 trace_pci_nvme_enqueue_req_completion(nvme_cid(req), cq->cqid,
1313 le32_to_cpu(req->cqe.result),
1314 le32_to_cpu(req->cqe.dw1),
1315 req->status);
1316
1317 if (req->status) {
1318 trace_pci_nvme_err_req_status(nvme_cid(req), nvme_nsid(req->ns),
1319 req->status, req->cmd.opcode);
1320 }
1321
1322 QTAILQ_REMOVE(&req->sq->out_req_list, req, entry);
1323 QTAILQ_INSERT_TAIL(&cq->req_list, req, entry);
1324 timer_mod(cq->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 500);
1325 }
1326
1327 static void nvme_process_aers(void *opaque)
1328 {
1329 NvmeCtrl *n = opaque;
1330 NvmeAsyncEvent *event, *next;
1331
1332 trace_pci_nvme_process_aers(n->aer_queued);
1333
1334 QTAILQ_FOREACH_SAFE(event, &n->aer_queue, entry, next) {
1335 NvmeRequest *req;
1336 NvmeAerResult *result;
1337
1338 /* can't post cqe if there is nothing to complete */
1339 if (!n->outstanding_aers) {
1340 trace_pci_nvme_no_outstanding_aers();
1341 break;
1342 }
1343
1344 /* ignore if masked (cqe posted, but event not cleared) */
1345 if (n->aer_mask & (1 << event->result.event_type)) {
1346 trace_pci_nvme_aer_masked(event->result.event_type, n->aer_mask);
1347 continue;
1348 }
1349
1350 QTAILQ_REMOVE(&n->aer_queue, event, entry);
1351 n->aer_queued--;
1352
1353 n->aer_mask |= 1 << event->result.event_type;
1354 n->outstanding_aers--;
1355
1356 req = n->aer_reqs[n->outstanding_aers];
1357
1358 result = (NvmeAerResult *) &req->cqe.result;
1359 result->event_type = event->result.event_type;
1360 result->event_info = event->result.event_info;
1361 result->log_page = event->result.log_page;
1362 g_free(event);
1363
1364 trace_pci_nvme_aer_post_cqe(result->event_type, result->event_info,
1365 result->log_page);
1366
1367 nvme_enqueue_req_completion(&n->admin_cq, req);
1368 }
1369 }
1370
1371 static void nvme_enqueue_event(NvmeCtrl *n, uint8_t event_type,
1372 uint8_t event_info, uint8_t log_page)
1373 {
1374 NvmeAsyncEvent *event;
1375
1376 trace_pci_nvme_enqueue_event(event_type, event_info, log_page);
1377
1378 if (n->aer_queued == n->params.aer_max_queued) {
1379 trace_pci_nvme_enqueue_event_noqueue(n->aer_queued);
1380 return;
1381 }
1382
1383 event = g_new(NvmeAsyncEvent, 1);
1384 event->result = (NvmeAerResult) {
1385 .event_type = event_type,
1386 .event_info = event_info,
1387 .log_page = log_page,
1388 };
1389
1390 QTAILQ_INSERT_TAIL(&n->aer_queue, event, entry);
1391 n->aer_queued++;
1392
1393 nvme_process_aers(n);
1394 }
1395
1396 static void nvme_smart_event(NvmeCtrl *n, uint8_t event)
1397 {
1398 uint8_t aer_info;
1399
1400 /* Ref SPEC <Asynchronous Event Information 0x2013 SMART / Health Status> */
1401 if (!(NVME_AEC_SMART(n->features.async_config) & event)) {
1402 return;
1403 }
1404
1405 switch (event) {
1406 case NVME_SMART_SPARE:
1407 aer_info = NVME_AER_INFO_SMART_SPARE_THRESH;
1408 break;
1409 case NVME_SMART_TEMPERATURE:
1410 aer_info = NVME_AER_INFO_SMART_TEMP_THRESH;
1411 break;
1412 case NVME_SMART_RELIABILITY:
1413 case NVME_SMART_MEDIA_READ_ONLY:
1414 case NVME_SMART_FAILED_VOLATILE_MEDIA:
1415 case NVME_SMART_PMR_UNRELIABLE:
1416 aer_info = NVME_AER_INFO_SMART_RELIABILITY;
1417 break;
1418 default:
1419 return;
1420 }
1421
1422 nvme_enqueue_event(n, NVME_AER_TYPE_SMART, aer_info, NVME_LOG_SMART_INFO);
1423 }
1424
1425 static void nvme_clear_events(NvmeCtrl *n, uint8_t event_type)
1426 {
1427 n->aer_mask &= ~(1 << event_type);
1428 if (!QTAILQ_EMPTY(&n->aer_queue)) {
1429 nvme_process_aers(n);
1430 }
1431 }
1432
1433 static inline uint16_t nvme_check_mdts(NvmeCtrl *n, size_t len)
1434 {
1435 uint8_t mdts = n->params.mdts;
1436
1437 if (mdts && len > n->page_size << mdts) {
1438 trace_pci_nvme_err_mdts(len);
1439 return NVME_INVALID_FIELD | NVME_DNR;
1440 }
1441
1442 return NVME_SUCCESS;
1443 }
1444
1445 static inline uint16_t nvme_check_bounds(NvmeNamespace *ns, uint64_t slba,
1446 uint32_t nlb)
1447 {
1448 uint64_t nsze = le64_to_cpu(ns->id_ns.nsze);
1449
1450 if (unlikely(UINT64_MAX - slba < nlb || slba + nlb > nsze)) {
1451 trace_pci_nvme_err_invalid_lba_range(slba, nlb, nsze);
1452 return NVME_LBA_RANGE | NVME_DNR;
1453 }
1454
1455 return NVME_SUCCESS;
1456 }
1457
1458 static int nvme_block_status_all(NvmeNamespace *ns, uint64_t slba,
1459 uint32_t nlb, int flags)
1460 {
1461 BlockDriverState *bs = blk_bs(ns->blkconf.blk);
1462
1463 int64_t pnum = 0, bytes = nvme_l2b(ns, nlb);
1464 int64_t offset = nvme_l2b(ns, slba);
1465 int ret;
1466
1467 /*
1468 * `pnum` holds the number of bytes after offset that shares the same
1469 * allocation status as the byte at offset. If `pnum` is different from
1470 * `bytes`, we should check the allocation status of the next range and
1471 * continue this until all bytes have been checked.
1472 */
1473 do {
1474 bytes -= pnum;
1475
1476 ret = bdrv_block_status(bs, offset, bytes, &pnum, NULL, NULL);
1477 if (ret < 0) {
1478 return ret;
1479 }
1480
1481
1482 trace_pci_nvme_block_status(offset, bytes, pnum, ret,
1483 !!(ret & BDRV_BLOCK_ZERO));
1484
1485 if (!(ret & flags)) {
1486 return 1;
1487 }
1488
1489 offset += pnum;
1490 } while (pnum != bytes);
1491
1492 return 0;
1493 }
1494
1495 static uint16_t nvme_check_dulbe(NvmeNamespace *ns, uint64_t slba,
1496 uint32_t nlb)
1497 {
1498 int ret;
1499 Error *err = NULL;
1500
1501 ret = nvme_block_status_all(ns, slba, nlb, BDRV_BLOCK_DATA);
1502 if (ret) {
1503 if (ret < 0) {
1504 error_setg_errno(&err, -ret, "unable to get block status");
1505 error_report_err(err);
1506
1507 return NVME_INTERNAL_DEV_ERROR;
1508 }
1509
1510 return NVME_DULB;
1511 }
1512
1513 return NVME_SUCCESS;
1514 }
1515
1516 static void nvme_aio_err(NvmeRequest *req, int ret)
1517 {
1518 uint16_t status = NVME_SUCCESS;
1519 Error *local_err = NULL;
1520
1521 switch (req->cmd.opcode) {
1522 case NVME_CMD_READ:
1523 status = NVME_UNRECOVERED_READ;
1524 break;
1525 case NVME_CMD_FLUSH:
1526 case NVME_CMD_WRITE:
1527 case NVME_CMD_WRITE_ZEROES:
1528 case NVME_CMD_ZONE_APPEND:
1529 status = NVME_WRITE_FAULT;
1530 break;
1531 default:
1532 status = NVME_INTERNAL_DEV_ERROR;
1533 break;
1534 }
1535
1536 trace_pci_nvme_err_aio(nvme_cid(req), strerror(-ret), status);
1537
1538 error_setg_errno(&local_err, -ret, "aio failed");
1539 error_report_err(local_err);
1540
1541 /*
1542 * Set the command status code to the first encountered error but allow a
1543 * subsequent Internal Device Error to trump it.
1544 */
1545 if (req->status && status != NVME_INTERNAL_DEV_ERROR) {
1546 return;
1547 }
1548
1549 req->status = status;
1550 }
1551
1552 static inline uint32_t nvme_zone_idx(NvmeNamespace *ns, uint64_t slba)
1553 {
1554 return ns->zone_size_log2 > 0 ? slba >> ns->zone_size_log2 :
1555 slba / ns->zone_size;
1556 }
1557
1558 static inline NvmeZone *nvme_get_zone_by_slba(NvmeNamespace *ns, uint64_t slba)
1559 {
1560 uint32_t zone_idx = nvme_zone_idx(ns, slba);
1561
1562 if (zone_idx >= ns->num_zones) {
1563 return NULL;
1564 }
1565
1566 return &ns->zone_array[zone_idx];
1567 }
1568
1569 static uint16_t nvme_check_zone_state_for_write(NvmeZone *zone)
1570 {
1571 uint64_t zslba = zone->d.zslba;
1572
1573 switch (nvme_get_zone_state(zone)) {
1574 case NVME_ZONE_STATE_EMPTY:
1575 case NVME_ZONE_STATE_IMPLICITLY_OPEN:
1576 case NVME_ZONE_STATE_EXPLICITLY_OPEN:
1577 case NVME_ZONE_STATE_CLOSED:
1578 return NVME_SUCCESS;
1579 case NVME_ZONE_STATE_FULL:
1580 trace_pci_nvme_err_zone_is_full(zslba);
1581 return NVME_ZONE_FULL;
1582 case NVME_ZONE_STATE_OFFLINE:
1583 trace_pci_nvme_err_zone_is_offline(zslba);
1584 return NVME_ZONE_OFFLINE;
1585 case NVME_ZONE_STATE_READ_ONLY:
1586 trace_pci_nvme_err_zone_is_read_only(zslba);
1587 return NVME_ZONE_READ_ONLY;
1588 default:
1589 assert(false);
1590 }
1591
1592 return NVME_INTERNAL_DEV_ERROR;
1593 }
1594
1595 static uint16_t nvme_check_zone_write(NvmeNamespace *ns, NvmeZone *zone,
1596 uint64_t slba, uint32_t nlb)
1597 {
1598 uint64_t zcap = nvme_zone_wr_boundary(zone);
1599 uint16_t status;
1600
1601 status = nvme_check_zone_state_for_write(zone);
1602 if (status) {
1603 return status;
1604 }
1605
1606 if (unlikely(slba != zone->w_ptr)) {
1607 trace_pci_nvme_err_write_not_at_wp(slba, zone->d.zslba, zone->w_ptr);
1608 return NVME_ZONE_INVALID_WRITE;
1609 }
1610
1611 if (unlikely((slba + nlb) > zcap)) {
1612 trace_pci_nvme_err_zone_boundary(slba, nlb, zcap);
1613 return NVME_ZONE_BOUNDARY_ERROR;
1614 }
1615
1616 return NVME_SUCCESS;
1617 }
1618
1619 static uint16_t nvme_check_zone_state_for_read(NvmeZone *zone)
1620 {
1621 switch (nvme_get_zone_state(zone)) {
1622 case NVME_ZONE_STATE_EMPTY:
1623 case NVME_ZONE_STATE_IMPLICITLY_OPEN:
1624 case NVME_ZONE_STATE_EXPLICITLY_OPEN:
1625 case NVME_ZONE_STATE_FULL:
1626 case NVME_ZONE_STATE_CLOSED:
1627 case NVME_ZONE_STATE_READ_ONLY:
1628 return NVME_SUCCESS;
1629 case NVME_ZONE_STATE_OFFLINE:
1630 trace_pci_nvme_err_zone_is_offline(zone->d.zslba);
1631 return NVME_ZONE_OFFLINE;
1632 default:
1633 assert(false);
1634 }
1635
1636 return NVME_INTERNAL_DEV_ERROR;
1637 }
1638
1639 static uint16_t nvme_check_zone_read(NvmeNamespace *ns, uint64_t slba,
1640 uint32_t nlb)
1641 {
1642 NvmeZone *zone;
1643 uint64_t bndry, end;
1644 uint16_t status;
1645
1646 zone = nvme_get_zone_by_slba(ns, slba);
1647 assert(zone);
1648
1649 bndry = nvme_zone_rd_boundary(ns, zone);
1650 end = slba + nlb;
1651
1652 status = nvme_check_zone_state_for_read(zone);
1653 if (status) {
1654 ;
1655 } else if (unlikely(end > bndry)) {
1656 if (!ns->params.cross_zone_read) {
1657 status = NVME_ZONE_BOUNDARY_ERROR;
1658 } else {
1659 /*
1660 * Read across zone boundary - check that all subsequent
1661 * zones that are being read have an appropriate state.
1662 */
1663 do {
1664 zone++;
1665 status = nvme_check_zone_state_for_read(zone);
1666 if (status) {
1667 break;
1668 }
1669 } while (end > nvme_zone_rd_boundary(ns, zone));
1670 }
1671 }
1672
1673 return status;
1674 }
1675
1676 static uint16_t nvme_zrm_finish(NvmeNamespace *ns, NvmeZone *zone)
1677 {
1678 switch (nvme_get_zone_state(zone)) {
1679 case NVME_ZONE_STATE_FULL:
1680 return NVME_SUCCESS;
1681
1682 case NVME_ZONE_STATE_IMPLICITLY_OPEN:
1683 case NVME_ZONE_STATE_EXPLICITLY_OPEN:
1684 nvme_aor_dec_open(ns);
1685 /* fallthrough */
1686 case NVME_ZONE_STATE_CLOSED:
1687 nvme_aor_dec_active(ns);
1688 /* fallthrough */
1689 case NVME_ZONE_STATE_EMPTY:
1690 nvme_assign_zone_state(ns, zone, NVME_ZONE_STATE_FULL);
1691 return NVME_SUCCESS;
1692
1693 default:
1694 return NVME_ZONE_INVAL_TRANSITION;
1695 }
1696 }
1697
1698 static uint16_t nvme_zrm_close(NvmeNamespace *ns, NvmeZone *zone)
1699 {
1700 switch (nvme_get_zone_state(zone)) {
1701 case NVME_ZONE_STATE_EXPLICITLY_OPEN:
1702 case NVME_ZONE_STATE_IMPLICITLY_OPEN:
1703 nvme_aor_dec_open(ns);
1704 nvme_assign_zone_state(ns, zone, NVME_ZONE_STATE_CLOSED);
1705 /* fall through */
1706 case NVME_ZONE_STATE_CLOSED:
1707 return NVME_SUCCESS;
1708
1709 default:
1710 return NVME_ZONE_INVAL_TRANSITION;
1711 }
1712 }
1713
1714 static uint16_t nvme_zrm_reset(NvmeNamespace *ns, NvmeZone *zone)
1715 {
1716 switch (nvme_get_zone_state(zone)) {
1717 case NVME_ZONE_STATE_EXPLICITLY_OPEN:
1718 case NVME_ZONE_STATE_IMPLICITLY_OPEN:
1719 nvme_aor_dec_open(ns);
1720 /* fallthrough */
1721 case NVME_ZONE_STATE_CLOSED:
1722 nvme_aor_dec_active(ns);
1723 /* fallthrough */
1724 case NVME_ZONE_STATE_FULL:
1725 zone->w_ptr = zone->d.zslba;
1726 zone->d.wp = zone->w_ptr;
1727 nvme_assign_zone_state(ns, zone, NVME_ZONE_STATE_EMPTY);
1728 /* fallthrough */
1729 case NVME_ZONE_STATE_EMPTY:
1730 return NVME_SUCCESS;
1731
1732 default:
1733 return NVME_ZONE_INVAL_TRANSITION;
1734 }
1735 }
1736
1737 static void nvme_zrm_auto_transition_zone(NvmeNamespace *ns)
1738 {
1739 NvmeZone *zone;
1740
1741 if (ns->params.max_open_zones &&
1742 ns->nr_open_zones == ns->params.max_open_zones) {
1743 zone = QTAILQ_FIRST(&ns->imp_open_zones);
1744 if (zone) {
1745 /*
1746 * Automatically close this implicitly open zone.
1747 */
1748 QTAILQ_REMOVE(&ns->imp_open_zones, zone, entry);
1749 nvme_zrm_close(ns, zone);
1750 }
1751 }
1752 }
1753
1754 enum {
1755 NVME_ZRM_AUTO = 1 << 0,
1756 };
1757
1758 static uint16_t nvme_zrm_open_flags(NvmeCtrl *n, NvmeNamespace *ns,
1759 NvmeZone *zone, int flags)
1760 {
1761 int act = 0;
1762 uint16_t status;
1763
1764 switch (nvme_get_zone_state(zone)) {
1765 case NVME_ZONE_STATE_EMPTY:
1766 act = 1;
1767
1768 /* fallthrough */
1769
1770 case NVME_ZONE_STATE_CLOSED:
1771 if (n->params.auto_transition_zones) {
1772 nvme_zrm_auto_transition_zone(ns);
1773 }
1774 status = nvme_aor_check(ns, act, 1);
1775 if (status) {
1776 return status;
1777 }
1778
1779 if (act) {
1780 nvme_aor_inc_active(ns);
1781 }
1782
1783 nvme_aor_inc_open(ns);
1784
1785 if (flags & NVME_ZRM_AUTO) {
1786 nvme_assign_zone_state(ns, zone, NVME_ZONE_STATE_IMPLICITLY_OPEN);
1787 return NVME_SUCCESS;
1788 }
1789
1790 /* fallthrough */
1791
1792 case NVME_ZONE_STATE_IMPLICITLY_OPEN:
1793 if (flags & NVME_ZRM_AUTO) {
1794 return NVME_SUCCESS;
1795 }
1796
1797 nvme_assign_zone_state(ns, zone, NVME_ZONE_STATE_EXPLICITLY_OPEN);
1798
1799 /* fallthrough */
1800
1801 case NVME_ZONE_STATE_EXPLICITLY_OPEN:
1802 return NVME_SUCCESS;
1803
1804 default:
1805 return NVME_ZONE_INVAL_TRANSITION;
1806 }
1807 }
1808
1809 static inline uint16_t nvme_zrm_auto(NvmeCtrl *n, NvmeNamespace *ns,
1810 NvmeZone *zone)
1811 {
1812 return nvme_zrm_open_flags(n, ns, zone, NVME_ZRM_AUTO);
1813 }
1814
1815 static inline uint16_t nvme_zrm_open(NvmeCtrl *n, NvmeNamespace *ns,
1816 NvmeZone *zone)
1817 {
1818 return nvme_zrm_open_flags(n, ns, zone, 0);
1819 }
1820
1821 static void nvme_advance_zone_wp(NvmeNamespace *ns, NvmeZone *zone,
1822 uint32_t nlb)
1823 {
1824 zone->d.wp += nlb;
1825
1826 if (zone->d.wp == nvme_zone_wr_boundary(zone)) {
1827 nvme_zrm_finish(ns, zone);
1828 }
1829 }
1830
1831 static void nvme_finalize_zoned_write(NvmeNamespace *ns, NvmeRequest *req)
1832 {
1833 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd;
1834 NvmeZone *zone;
1835 uint64_t slba;
1836 uint32_t nlb;
1837
1838 slba = le64_to_cpu(rw->slba);
1839 nlb = le16_to_cpu(rw->nlb) + 1;
1840 zone = nvme_get_zone_by_slba(ns, slba);
1841 assert(zone);
1842
1843 nvme_advance_zone_wp(ns, zone, nlb);
1844 }
1845
1846 static inline bool nvme_is_write(NvmeRequest *req)
1847 {
1848 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd;
1849
1850 return rw->opcode == NVME_CMD_WRITE ||
1851 rw->opcode == NVME_CMD_ZONE_APPEND ||
1852 rw->opcode == NVME_CMD_WRITE_ZEROES;
1853 }
1854
1855 static AioContext *nvme_get_aio_context(BlockAIOCB *acb)
1856 {
1857 return qemu_get_aio_context();
1858 }
1859
1860 static void nvme_misc_cb(void *opaque, int ret)
1861 {
1862 NvmeRequest *req = opaque;
1863
1864 trace_pci_nvme_misc_cb(nvme_cid(req));
1865
1866 if (ret) {
1867 nvme_aio_err(req, ret);
1868 }
1869
1870 nvme_enqueue_req_completion(nvme_cq(req), req);
1871 }
1872
1873 void nvme_rw_complete_cb(void *opaque, int ret)
1874 {
1875 NvmeRequest *req = opaque;
1876 NvmeNamespace *ns = req->ns;
1877 BlockBackend *blk = ns->blkconf.blk;
1878 BlockAcctCookie *acct = &req->acct;
1879 BlockAcctStats *stats = blk_get_stats(blk);
1880
1881 trace_pci_nvme_rw_complete_cb(nvme_cid(req), blk_name(blk));
1882
1883 if (ret) {
1884 block_acct_failed(stats, acct);
1885 nvme_aio_err(req, ret);
1886 } else {
1887 block_acct_done(stats, acct);
1888 }
1889
1890 if (ns->params.zoned && nvme_is_write(req)) {
1891 nvme_finalize_zoned_write(ns, req);
1892 }
1893
1894 nvme_enqueue_req_completion(nvme_cq(req), req);
1895 }
1896
1897 static void nvme_rw_cb(void *opaque, int ret)
1898 {
1899 NvmeRequest *req = opaque;
1900 NvmeNamespace *ns = req->ns;
1901
1902 BlockBackend *blk = ns->blkconf.blk;
1903
1904 trace_pci_nvme_rw_cb(nvme_cid(req), blk_name(blk));
1905
1906 if (ret) {
1907 goto out;
1908 }
1909
1910 if (ns->lbaf.ms) {
1911 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd;
1912 uint64_t slba = le64_to_cpu(rw->slba);
1913 uint32_t nlb = (uint32_t)le16_to_cpu(rw->nlb) + 1;
1914 uint64_t offset = nvme_moff(ns, slba);
1915
1916 if (req->cmd.opcode == NVME_CMD_WRITE_ZEROES) {
1917 size_t mlen = nvme_m2b(ns, nlb);
1918
1919 req->aiocb = blk_aio_pwrite_zeroes(blk, offset, mlen,
1920 BDRV_REQ_MAY_UNMAP,
1921 nvme_rw_complete_cb, req);
1922 return;
1923 }
1924
1925 if (nvme_ns_ext(ns) || req->cmd.mptr) {
1926 uint16_t status;
1927
1928 nvme_sg_unmap(&req->sg);
1929 status = nvme_map_mdata(nvme_ctrl(req), nlb, req);
1930 if (status) {
1931 ret = -EFAULT;
1932 goto out;
1933 }
1934
1935 if (req->cmd.opcode == NVME_CMD_READ) {
1936 return nvme_blk_read(blk, offset, nvme_rw_complete_cb, req);
1937 }
1938
1939 return nvme_blk_write(blk, offset, nvme_rw_complete_cb, req);
1940 }
1941 }
1942
1943 out:
1944 nvme_rw_complete_cb(req, ret);
1945 }
1946
1947 static void nvme_verify_cb(void *opaque, int ret)
1948 {
1949 NvmeBounceContext *ctx = opaque;
1950 NvmeRequest *req = ctx->req;
1951 NvmeNamespace *ns = req->ns;
1952 BlockBackend *blk = ns->blkconf.blk;
1953 BlockAcctCookie *acct = &req->acct;
1954 BlockAcctStats *stats = blk_get_stats(blk);
1955 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd;
1956 uint64_t slba = le64_to_cpu(rw->slba);
1957 uint8_t prinfo = NVME_RW_PRINFO(le16_to_cpu(rw->control));
1958 uint16_t apptag = le16_to_cpu(rw->apptag);
1959 uint16_t appmask = le16_to_cpu(rw->appmask);
1960 uint32_t reftag = le32_to_cpu(rw->reftag);
1961 uint16_t status;
1962
1963 trace_pci_nvme_verify_cb(nvme_cid(req), prinfo, apptag, appmask, reftag);
1964
1965 if (ret) {
1966 block_acct_failed(stats, acct);
1967 nvme_aio_err(req, ret);
1968 goto out;
1969 }
1970
1971 block_acct_done(stats, acct);
1972
1973 if (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps)) {
1974 status = nvme_dif_mangle_mdata(ns, ctx->mdata.bounce,
1975 ctx->mdata.iov.size, slba);
1976 if (status) {
1977 req->status = status;
1978 goto out;
1979 }
1980
1981 req->status = nvme_dif_check(ns, ctx->data.bounce, ctx->data.iov.size,
1982 ctx->mdata.bounce, ctx->mdata.iov.size,
1983 prinfo, slba, apptag, appmask, &reftag);
1984 }
1985
1986 out:
1987 qemu_iovec_destroy(&ctx->data.iov);
1988 g_free(ctx->data.bounce);
1989
1990 qemu_iovec_destroy(&ctx->mdata.iov);
1991 g_free(ctx->mdata.bounce);
1992
1993 g_free(ctx);
1994
1995 nvme_enqueue_req_completion(nvme_cq(req), req);
1996 }
1997
1998
1999 static void nvme_verify_mdata_in_cb(void *opaque, int ret)
2000 {
2001 NvmeBounceContext *ctx = opaque;
2002 NvmeRequest *req = ctx->req;
2003 NvmeNamespace *ns = req->ns;
2004 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd;
2005 uint64_t slba = le64_to_cpu(rw->slba);
2006 uint32_t nlb = le16_to_cpu(rw->nlb) + 1;
2007 size_t mlen = nvme_m2b(ns, nlb);
2008 uint64_t offset = nvme_moff(ns, slba);
2009 BlockBackend *blk = ns->blkconf.blk;
2010
2011 trace_pci_nvme_verify_mdata_in_cb(nvme_cid(req), blk_name(blk));
2012
2013 if (ret) {
2014 goto out;
2015 }
2016
2017 ctx->mdata.bounce = g_malloc(mlen);
2018
2019 qemu_iovec_reset(&ctx->mdata.iov);
2020 qemu_iovec_add(&ctx->mdata.iov, ctx->mdata.bounce, mlen);
2021
2022 req->aiocb = blk_aio_preadv(blk, offset, &ctx->mdata.iov, 0,
2023 nvme_verify_cb, ctx);
2024 return;
2025
2026 out:
2027 nvme_verify_cb(ctx, ret);
2028 }
2029
2030 struct nvme_compare_ctx {
2031 struct {
2032 QEMUIOVector iov;
2033 uint8_t *bounce;
2034 } data;
2035
2036 struct {
2037 QEMUIOVector iov;
2038 uint8_t *bounce;
2039 } mdata;
2040 };
2041
2042 static void nvme_compare_mdata_cb(void *opaque, int ret)
2043 {
2044 NvmeRequest *req = opaque;
2045 NvmeNamespace *ns = req->ns;
2046 NvmeCtrl *n = nvme_ctrl(req);
2047 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd;
2048 uint8_t prinfo = NVME_RW_PRINFO(le16_to_cpu(rw->control));
2049 uint16_t apptag = le16_to_cpu(rw->apptag);
2050 uint16_t appmask = le16_to_cpu(rw->appmask);
2051 uint32_t reftag = le32_to_cpu(rw->reftag);
2052 struct nvme_compare_ctx *ctx = req->opaque;
2053 g_autofree uint8_t *buf = NULL;
2054 BlockBackend *blk = ns->blkconf.blk;
2055 BlockAcctCookie *acct = &req->acct;
2056 BlockAcctStats *stats = blk_get_stats(blk);
2057 uint16_t status = NVME_SUCCESS;
2058
2059 trace_pci_nvme_compare_mdata_cb(nvme_cid(req));
2060
2061 if (ret) {
2062 block_acct_failed(stats, acct);
2063 nvme_aio_err(req, ret);
2064 goto out;
2065 }
2066
2067 buf = g_malloc(ctx->mdata.iov.size);
2068
2069 status = nvme_bounce_mdata(n, buf, ctx->mdata.iov.size,
2070 NVME_TX_DIRECTION_TO_DEVICE, req);
2071 if (status) {
2072 req->status = status;
2073 goto out;
2074 }
2075
2076 if (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps)) {
2077 uint64_t slba = le64_to_cpu(rw->slba);
2078 uint8_t *bufp;
2079 uint8_t *mbufp = ctx->mdata.bounce;
2080 uint8_t *end = mbufp + ctx->mdata.iov.size;
2081 int16_t pil = 0;
2082
2083 status = nvme_dif_check(ns, ctx->data.bounce, ctx->data.iov.size,
2084 ctx->mdata.bounce, ctx->mdata.iov.size, prinfo,
2085 slba, apptag, appmask, &reftag);
2086 if (status) {
2087 req->status = status;
2088 goto out;
2089 }
2090
2091 /*
2092 * When formatted with protection information, do not compare the DIF
2093 * tuple.
2094 */
2095 if (!(ns->id_ns.dps & NVME_ID_NS_DPS_FIRST_EIGHT)) {
2096 pil = ns->lbaf.ms - sizeof(NvmeDifTuple);
2097 }
2098
2099 for (bufp = buf; mbufp < end; bufp += ns->lbaf.ms, mbufp += ns->lbaf.ms) {
2100 if (memcmp(bufp + pil, mbufp + pil, ns->lbaf.ms - pil)) {
2101 req->status = NVME_CMP_FAILURE;
2102 goto out;
2103 }
2104 }
2105
2106 goto out;
2107 }
2108
2109 if (memcmp(buf, ctx->mdata.bounce, ctx->mdata.iov.size)) {
2110 req->status = NVME_CMP_FAILURE;
2111 goto out;
2112 }
2113
2114 block_acct_done(stats, acct);
2115
2116 out:
2117 qemu_iovec_destroy(&ctx->data.iov);
2118 g_free(ctx->data.bounce);
2119
2120 qemu_iovec_destroy(&ctx->mdata.iov);
2121 g_free(ctx->mdata.bounce);
2122
2123 g_free(ctx);
2124
2125 nvme_enqueue_req_completion(nvme_cq(req), req);
2126 }
2127
2128 static void nvme_compare_data_cb(void *opaque, int ret)
2129 {
2130 NvmeRequest *req = opaque;
2131 NvmeCtrl *n = nvme_ctrl(req);
2132 NvmeNamespace *ns = req->ns;
2133 BlockBackend *blk = ns->blkconf.blk;
2134 BlockAcctCookie *acct = &req->acct;
2135 BlockAcctStats *stats = blk_get_stats(blk);
2136
2137 struct nvme_compare_ctx *ctx = req->opaque;
2138 g_autofree uint8_t *buf = NULL;
2139 uint16_t status;
2140
2141 trace_pci_nvme_compare_data_cb(nvme_cid(req));
2142
2143 if (ret) {
2144 block_acct_failed(stats, acct);
2145 nvme_aio_err(req, ret);
2146 goto out;
2147 }
2148
2149 buf = g_malloc(ctx->data.iov.size);
2150
2151 status = nvme_bounce_data(n, buf, ctx->data.iov.size,
2152 NVME_TX_DIRECTION_TO_DEVICE, req);
2153 if (status) {
2154 req->status = status;
2155 goto out;
2156 }
2157
2158 if (memcmp(buf, ctx->data.bounce, ctx->data.iov.size)) {
2159 req->status = NVME_CMP_FAILURE;
2160 goto out;
2161 }
2162
2163 if (ns->lbaf.ms) {
2164 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd;
2165 uint64_t slba = le64_to_cpu(rw->slba);
2166 uint32_t nlb = le16_to_cpu(rw->nlb) + 1;
2167 size_t mlen = nvme_m2b(ns, nlb);
2168 uint64_t offset = nvme_moff(ns, slba);
2169
2170 ctx->mdata.bounce = g_malloc(mlen);
2171
2172 qemu_iovec_init(&ctx->mdata.iov, 1);
2173 qemu_iovec_add(&ctx->mdata.iov, ctx->mdata.bounce, mlen);
2174
2175 req->aiocb = blk_aio_preadv(blk, offset, &ctx->mdata.iov, 0,
2176 nvme_compare_mdata_cb, req);
2177 return;
2178 }
2179
2180 block_acct_done(stats, acct);
2181
2182 out:
2183 qemu_iovec_destroy(&ctx->data.iov);
2184 g_free(ctx->data.bounce);
2185 g_free(ctx);
2186
2187 nvme_enqueue_req_completion(nvme_cq(req), req);
2188 }
2189
2190 typedef struct NvmeDSMAIOCB {
2191 BlockAIOCB common;
2192 BlockAIOCB *aiocb;
2193 NvmeRequest *req;
2194 QEMUBH *bh;
2195 int ret;
2196
2197 NvmeDsmRange *range;
2198 unsigned int nr;
2199 unsigned int idx;
2200 } NvmeDSMAIOCB;
2201
2202 static void nvme_dsm_cancel(BlockAIOCB *aiocb)
2203 {
2204 NvmeDSMAIOCB *iocb = container_of(aiocb, NvmeDSMAIOCB, common);
2205
2206 /* break nvme_dsm_cb loop */
2207 iocb->idx = iocb->nr;
2208 iocb->ret = -ECANCELED;
2209
2210 if (iocb->aiocb) {
2211 blk_aio_cancel_async(iocb->aiocb);
2212 iocb->aiocb = NULL;
2213 } else {
2214 /*
2215 * We only reach this if nvme_dsm_cancel() has already been called or
2216 * the command ran to completion and nvme_dsm_bh is scheduled to run.
2217 */
2218 assert(iocb->idx == iocb->nr);
2219 }
2220 }
2221
2222 static const AIOCBInfo nvme_dsm_aiocb_info = {
2223 .aiocb_size = sizeof(NvmeDSMAIOCB),
2224 .cancel_async = nvme_dsm_cancel,
2225 };
2226
2227 static void nvme_dsm_bh(void *opaque)
2228 {
2229 NvmeDSMAIOCB *iocb = opaque;
2230
2231 iocb->common.cb(iocb->common.opaque, iocb->ret);
2232
2233 qemu_bh_delete(iocb->bh);
2234 iocb->bh = NULL;
2235 qemu_aio_unref(iocb);
2236 }
2237
2238 static void nvme_dsm_cb(void *opaque, int ret);
2239
2240 static void nvme_dsm_md_cb(void *opaque, int ret)
2241 {
2242 NvmeDSMAIOCB *iocb = opaque;
2243 NvmeRequest *req = iocb->req;
2244 NvmeNamespace *ns = req->ns;
2245 NvmeDsmRange *range;
2246 uint64_t slba;
2247 uint32_t nlb;
2248
2249 if (ret < 0) {
2250 iocb->ret = ret;
2251 goto done;
2252 }
2253
2254 if (!ns->lbaf.ms) {
2255 nvme_dsm_cb(iocb, 0);
2256 return;
2257 }
2258
2259 range = &iocb->range[iocb->idx - 1];
2260 slba = le64_to_cpu(range->slba);
2261 nlb = le32_to_cpu(range->nlb);
2262
2263 /*
2264 * Check that all block were discarded (zeroed); otherwise we do not zero
2265 * the metadata.
2266 */
2267
2268 ret = nvme_block_status_all(ns, slba, nlb, BDRV_BLOCK_ZERO);
2269 if (ret) {
2270 if (ret < 0) {
2271 iocb->ret = ret;
2272 goto done;
2273 }
2274
2275 nvme_dsm_cb(iocb, 0);
2276 }
2277
2278 iocb->aiocb = blk_aio_pwrite_zeroes(ns->blkconf.blk, nvme_moff(ns, slba),
2279 nvme_m2b(ns, nlb), BDRV_REQ_MAY_UNMAP,
2280 nvme_dsm_cb, iocb);
2281 return;
2282
2283 done:
2284 iocb->aiocb = NULL;
2285 qemu_bh_schedule(iocb->bh);
2286 }
2287
2288 static void nvme_dsm_cb(void *opaque, int ret)
2289 {
2290 NvmeDSMAIOCB *iocb = opaque;
2291 NvmeRequest *req = iocb->req;
2292 NvmeCtrl *n = nvme_ctrl(req);
2293 NvmeNamespace *ns = req->ns;
2294 NvmeDsmRange *range;
2295 uint64_t slba;
2296 uint32_t nlb;
2297
2298 if (ret < 0) {
2299 iocb->ret = ret;
2300 goto done;
2301 }
2302
2303 next:
2304 if (iocb->idx == iocb->nr) {
2305 goto done;
2306 }
2307
2308 range = &iocb->range[iocb->idx++];
2309 slba = le64_to_cpu(range->slba);
2310 nlb = le32_to_cpu(range->nlb);
2311
2312 trace_pci_nvme_dsm_deallocate(slba, nlb);
2313
2314 if (nlb > n->dmrsl) {
2315 trace_pci_nvme_dsm_single_range_limit_exceeded(nlb, n->dmrsl);
2316 goto next;
2317 }
2318
2319 if (nvme_check_bounds(ns, slba, nlb)) {
2320 trace_pci_nvme_err_invalid_lba_range(slba, nlb,
2321 ns->id_ns.nsze);
2322 goto next;
2323 }
2324
2325 iocb->aiocb = blk_aio_pdiscard(ns->blkconf.blk, nvme_l2b(ns, slba),
2326 nvme_l2b(ns, nlb),
2327 nvme_dsm_md_cb, iocb);
2328 return;
2329
2330 done:
2331 iocb->aiocb = NULL;
2332 qemu_bh_schedule(iocb->bh);
2333 }
2334
2335 static uint16_t nvme_dsm(NvmeCtrl *n, NvmeRequest *req)
2336 {
2337 NvmeNamespace *ns = req->ns;
2338 NvmeDsmCmd *dsm = (NvmeDsmCmd *) &req->cmd;
2339 uint32_t attr = le32_to_cpu(dsm->attributes);
2340 uint32_t nr = (le32_to_cpu(dsm->nr) & 0xff) + 1;
2341 uint16_t status = NVME_SUCCESS;
2342
2343 trace_pci_nvme_dsm(nr, attr);
2344
2345 if (attr & NVME_DSMGMT_AD) {
2346 NvmeDSMAIOCB *iocb = blk_aio_get(&nvme_dsm_aiocb_info, ns->blkconf.blk,
2347 nvme_misc_cb, req);
2348
2349 iocb->req = req;
2350 iocb->bh = qemu_bh_new(nvme_dsm_bh, iocb);
2351 iocb->ret = 0;
2352 iocb->range = g_new(NvmeDsmRange, nr);
2353 iocb->nr = nr;
2354 iocb->idx = 0;
2355
2356 status = nvme_h2c(n, (uint8_t *)iocb->range, sizeof(NvmeDsmRange) * nr,
2357 req);
2358 if (status) {
2359 return status;
2360 }
2361
2362 req->aiocb = &iocb->common;
2363 nvme_dsm_cb(iocb, 0);
2364
2365 return NVME_NO_COMPLETE;
2366 }
2367
2368 return status;
2369 }
2370
2371 static uint16_t nvme_verify(NvmeCtrl *n, NvmeRequest *req)
2372 {
2373 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd;
2374 NvmeNamespace *ns = req->ns;
2375 BlockBackend *blk = ns->blkconf.blk;
2376 uint64_t slba = le64_to_cpu(rw->slba);
2377 uint32_t nlb = le16_to_cpu(rw->nlb) + 1;
2378 size_t len = nvme_l2b(ns, nlb);
2379 int64_t offset = nvme_l2b(ns, slba);
2380 uint8_t prinfo = NVME_RW_PRINFO(le16_to_cpu(rw->control));
2381 uint32_t reftag = le32_to_cpu(rw->reftag);
2382 NvmeBounceContext *ctx = NULL;
2383 uint16_t status;
2384
2385 trace_pci_nvme_verify(nvme_cid(req), nvme_nsid(ns), slba, nlb);
2386
2387 if (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps)) {
2388 status = nvme_check_prinfo(ns, prinfo, slba, reftag);
2389 if (status) {
2390 return status;
2391 }
2392
2393 if (prinfo & NVME_PRINFO_PRACT) {
2394 return NVME_INVALID_PROT_INFO | NVME_DNR;
2395 }
2396 }
2397
2398 if (len > n->page_size << n->params.vsl) {
2399 return NVME_INVALID_FIELD | NVME_DNR;
2400 }
2401
2402 status = nvme_check_bounds(ns, slba, nlb);
2403 if (status) {
2404 return status;
2405 }
2406
2407 if (NVME_ERR_REC_DULBE(ns->features.err_rec)) {
2408 status = nvme_check_dulbe(ns, slba, nlb);
2409 if (status) {
2410 return status;
2411 }
2412 }
2413
2414 ctx = g_new0(NvmeBounceContext, 1);
2415 ctx->req = req;
2416
2417 ctx->data.bounce = g_malloc(len);
2418
2419 qemu_iovec_init(&ctx->data.iov, 1);
2420 qemu_iovec_add(&ctx->data.iov, ctx->data.bounce, len);
2421
2422 block_acct_start(blk_get_stats(blk), &req->acct, ctx->data.iov.size,
2423 BLOCK_ACCT_READ);
2424
2425 req->aiocb = blk_aio_preadv(ns->blkconf.blk, offset, &ctx->data.iov, 0,
2426 nvme_verify_mdata_in_cb, ctx);
2427 return NVME_NO_COMPLETE;
2428 }
2429
2430 typedef struct NvmeCopyAIOCB {
2431 BlockAIOCB common;
2432 BlockAIOCB *aiocb;
2433 NvmeRequest *req;
2434 QEMUBH *bh;
2435 int ret;
2436
2437 NvmeCopySourceRange *ranges;
2438 int nr;
2439 int idx;
2440
2441 uint8_t *bounce;
2442 QEMUIOVector iov;
2443 struct {
2444 BlockAcctCookie read;
2445 BlockAcctCookie write;
2446 } acct;
2447
2448 uint32_t reftag;
2449 uint64_t slba;
2450
2451 NvmeZone *zone;
2452 } NvmeCopyAIOCB;
2453
2454 static void nvme_copy_cancel(BlockAIOCB *aiocb)
2455 {
2456 NvmeCopyAIOCB *iocb = container_of(aiocb, NvmeCopyAIOCB, common);
2457
2458 iocb->ret = -ECANCELED;
2459
2460 if (iocb->aiocb) {
2461 blk_aio_cancel_async(iocb->aiocb);
2462 iocb->aiocb = NULL;
2463 }
2464 }
2465
2466 static const AIOCBInfo nvme_copy_aiocb_info = {
2467 .aiocb_size = sizeof(NvmeCopyAIOCB),
2468 .cancel_async = nvme_copy_cancel,
2469 };
2470
2471 static void nvme_copy_bh(void *opaque)
2472 {
2473 NvmeCopyAIOCB *iocb = opaque;
2474 NvmeRequest *req = iocb->req;
2475 NvmeNamespace *ns = req->ns;
2476 BlockAcctStats *stats = blk_get_stats(ns->blkconf.blk);
2477
2478 if (iocb->idx != iocb->nr) {
2479 req->cqe.result = cpu_to_le32(iocb->idx);
2480 }
2481
2482 qemu_iovec_destroy(&iocb->iov);
2483 g_free(iocb->bounce);
2484
2485 qemu_bh_delete(iocb->bh);
2486 iocb->bh = NULL;
2487
2488 if (iocb->ret < 0) {
2489 block_acct_failed(stats, &iocb->acct.read);
2490 block_acct_failed(stats, &iocb->acct.write);
2491 } else {
2492 block_acct_done(stats, &iocb->acct.read);
2493 block_acct_done(stats, &iocb->acct.write);
2494 }
2495
2496 iocb->common.cb(iocb->common.opaque, iocb->ret);
2497 qemu_aio_unref(iocb);
2498 }
2499
2500 static void nvme_copy_cb(void *opaque, int ret);
2501
2502 static void nvme_copy_out_completed_cb(void *opaque, int ret)
2503 {
2504 NvmeCopyAIOCB *iocb = opaque;
2505 NvmeRequest *req = iocb->req;
2506 NvmeNamespace *ns = req->ns;
2507 NvmeCopySourceRange *range = &iocb->ranges[iocb->idx];
2508 uint32_t nlb = le32_to_cpu(range->nlb) + 1;
2509
2510 if (ret < 0) {
2511 iocb->ret = ret;
2512 goto out;
2513 } else if (iocb->ret < 0) {
2514 goto out;
2515 }
2516
2517 if (ns->params.zoned) {
2518 nvme_advance_zone_wp(ns, iocb->zone, nlb);
2519 }
2520
2521 iocb->idx++;
2522 iocb->slba += nlb;
2523 out:
2524 nvme_copy_cb(iocb, iocb->ret);
2525 }
2526
2527 static void nvme_copy_out_cb(void *opaque, int ret)
2528 {
2529 NvmeCopyAIOCB *iocb = opaque;
2530 NvmeRequest *req = iocb->req;
2531 NvmeNamespace *ns = req->ns;
2532 NvmeCopySourceRange *range;
2533 uint32_t nlb;
2534 size_t mlen;
2535 uint8_t *mbounce;
2536
2537 if (ret < 0) {
2538 iocb->ret = ret;
2539 goto out;
2540 } else if (iocb->ret < 0) {
2541 goto out;
2542 }
2543
2544 if (!ns->lbaf.ms) {
2545 nvme_copy_out_completed_cb(iocb, 0);
2546 return;
2547 }
2548
2549 range = &iocb->ranges[iocb->idx];
2550 nlb = le32_to_cpu(range->nlb) + 1;
2551
2552 mlen = nvme_m2b(ns, nlb);
2553 mbounce = iocb->bounce + nvme_l2b(ns, nlb);
2554
2555 qemu_iovec_reset(&iocb->iov);
2556 qemu_iovec_add(&iocb->iov, mbounce, mlen);
2557
2558 iocb->aiocb = blk_aio_pwritev(ns->blkconf.blk, nvme_moff(ns, iocb->slba),
2559 &iocb->iov, 0, nvme_copy_out_completed_cb,
2560 iocb);
2561
2562 return;
2563
2564 out:
2565 nvme_copy_cb(iocb, ret);
2566 }
2567
2568 static void nvme_copy_in_completed_cb(void *opaque, int ret)
2569 {
2570 NvmeCopyAIOCB *iocb = opaque;
2571 NvmeRequest *req = iocb->req;
2572 NvmeNamespace *ns = req->ns;
2573 NvmeCopySourceRange *range;
2574 uint32_t nlb;
2575 size_t len;
2576 uint16_t status;
2577
2578 if (ret < 0) {
2579 iocb->ret = ret;
2580 goto out;
2581 } else if (iocb->ret < 0) {
2582 goto out;
2583 }
2584
2585 range = &iocb->ranges[iocb->idx];
2586 nlb = le32_to_cpu(range->nlb) + 1;
2587 len = nvme_l2b(ns, nlb);
2588
2589 trace_pci_nvme_copy_out(iocb->slba, nlb);
2590
2591 if (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps)) {
2592 NvmeCopyCmd *copy = (NvmeCopyCmd *)&req->cmd;
2593
2594 uint16_t prinfor = ((copy->control[0] >> 4) & 0xf);
2595 uint16_t prinfow = ((copy->control[2] >> 2) & 0xf);
2596
2597 uint16_t apptag = le16_to_cpu(range->apptag);
2598 uint16_t appmask = le16_to_cpu(range->appmask);
2599 uint32_t reftag = le32_to_cpu(range->reftag);
2600
2601 uint64_t slba = le64_to_cpu(range->slba);
2602 size_t mlen = nvme_m2b(ns, nlb);
2603 uint8_t *mbounce = iocb->bounce + nvme_l2b(ns, nlb);
2604
2605 status = nvme_dif_check(ns, iocb->bounce, len, mbounce, mlen, prinfor,
2606 slba, apptag, appmask, &reftag);
2607 if (status) {
2608 goto invalid;
2609 }
2610
2611 apptag = le16_to_cpu(copy->apptag);
2612 appmask = le16_to_cpu(copy->appmask);
2613
2614 if (prinfow & NVME_PRINFO_PRACT) {
2615 status = nvme_check_prinfo(ns, prinfow, iocb->slba, iocb->reftag);
2616 if (status) {
2617 goto invalid;
2618 }
2619
2620 nvme_dif_pract_generate_dif(ns, iocb->bounce, len, mbounce, mlen,
2621 apptag, &iocb->reftag);
2622 } else {
2623 status = nvme_dif_check(ns, iocb->bounce, len, mbounce, mlen,
2624 prinfow, iocb->slba, apptag, appmask,
2625 &iocb->reftag);
2626 if (status) {
2627 goto invalid;
2628 }
2629 }
2630 }
2631
2632 status = nvme_check_bounds(ns, iocb->slba, nlb);
2633 if (status) {
2634 goto invalid;
2635 }
2636
2637 if (ns->params.zoned) {
2638 status = nvme_check_zone_write(ns, iocb->zone, iocb->slba, nlb);
2639 if (status) {
2640 goto invalid;
2641 }
2642
2643 iocb->zone->w_ptr += nlb;
2644 }
2645
2646 qemu_iovec_reset(&iocb->iov);
2647 qemu_iovec_add(&iocb->iov, iocb->bounce, len);
2648
2649 iocb->aiocb = blk_aio_pwritev(ns->blkconf.blk, nvme_l2b(ns, iocb->slba),
2650 &iocb->iov, 0, nvme_copy_out_cb, iocb);
2651
2652 return;
2653
2654 invalid:
2655 req->status = status;
2656 iocb->aiocb = NULL;
2657 if (iocb->bh) {
2658 qemu_bh_schedule(iocb->bh);
2659 }
2660
2661 return;
2662
2663 out:
2664 nvme_copy_cb(iocb, ret);
2665 }
2666
2667 static void nvme_copy_in_cb(void *opaque, int ret)
2668 {
2669 NvmeCopyAIOCB *iocb = opaque;
2670 NvmeRequest *req = iocb->req;
2671 NvmeNamespace *ns = req->ns;
2672 NvmeCopySourceRange *range;
2673 uint64_t slba;
2674 uint32_t nlb;
2675
2676 if (ret < 0) {
2677 iocb->ret = ret;
2678 goto out;
2679 } else if (iocb->ret < 0) {
2680 goto out;
2681 }
2682
2683 if (!ns->lbaf.ms) {
2684 nvme_copy_in_completed_cb(iocb, 0);
2685 return;
2686 }
2687
2688 range = &iocb->ranges[iocb->idx];
2689 slba = le64_to_cpu(range->slba);
2690 nlb = le32_to_cpu(range->nlb) + 1;
2691
2692 qemu_iovec_reset(&iocb->iov);
2693 qemu_iovec_add(&iocb->iov, iocb->bounce + nvme_l2b(ns, nlb),
2694 nvme_m2b(ns, nlb));
2695
2696 iocb->aiocb = blk_aio_preadv(ns->blkconf.blk, nvme_moff(ns, slba),
2697 &iocb->iov, 0, nvme_copy_in_completed_cb,
2698 iocb);
2699 return;
2700
2701 out:
2702 nvme_copy_cb(iocb, iocb->ret);
2703 }
2704
2705 static void nvme_copy_cb(void *opaque, int ret)
2706 {
2707 NvmeCopyAIOCB *iocb = opaque;
2708 NvmeRequest *req = iocb->req;
2709 NvmeNamespace *ns = req->ns;
2710 NvmeCopySourceRange *range;
2711 uint64_t slba;
2712 uint32_t nlb;
2713 size_t len;
2714 uint16_t status;
2715
2716 if (ret < 0) {
2717 iocb->ret = ret;
2718 goto done;
2719 } else if (iocb->ret < 0) {
2720 goto done;
2721 }
2722
2723 if (iocb->idx == iocb->nr) {
2724 goto done;
2725 }
2726
2727 range = &iocb->ranges[iocb->idx];
2728 slba = le64_to_cpu(range->slba);
2729 nlb = le32_to_cpu(range->nlb) + 1;
2730 len = nvme_l2b(ns, nlb);
2731
2732 trace_pci_nvme_copy_source_range(slba, nlb);
2733
2734 if (nlb > le16_to_cpu(ns->id_ns.mssrl)) {
2735 status = NVME_CMD_SIZE_LIMIT | NVME_DNR;
2736 goto invalid;
2737 }
2738
2739 status = nvme_check_bounds(ns, slba, nlb);
2740 if (status) {
2741 goto invalid;
2742 }
2743
2744 if (NVME_ERR_REC_DULBE(ns->features.err_rec)) {
2745 status = nvme_check_dulbe(ns, slba, nlb);
2746 if (status) {
2747 goto invalid;
2748 }
2749 }
2750
2751 if (ns->params.zoned) {
2752 status = nvme_check_zone_read(ns, slba, nlb);
2753 if (status) {
2754 goto invalid;
2755 }
2756 }
2757
2758 qemu_iovec_reset(&iocb->iov);
2759 qemu_iovec_add(&iocb->iov, iocb->bounce, len);
2760
2761 iocb->aiocb = blk_aio_preadv(ns->blkconf.blk, nvme_l2b(ns, slba),
2762 &iocb->iov, 0, nvme_copy_in_cb, iocb);
2763 return;
2764
2765 invalid:
2766 req->status = status;
2767 done:
2768 iocb->aiocb = NULL;
2769 if (iocb->bh) {
2770 qemu_bh_schedule(iocb->bh);
2771 }
2772 }
2773
2774
2775 static uint16_t nvme_copy(NvmeCtrl *n, NvmeRequest *req)
2776 {
2777 NvmeNamespace *ns = req->ns;
2778 NvmeCopyCmd *copy = (NvmeCopyCmd *)&req->cmd;
2779 NvmeCopyAIOCB *iocb = blk_aio_get(&nvme_copy_aiocb_info, ns->blkconf.blk,
2780 nvme_misc_cb, req);
2781 uint16_t nr = copy->nr + 1;
2782 uint8_t format = copy->control[0] & 0xf;
2783 uint16_t prinfor = ((copy->control[0] >> 4) & 0xf);
2784 uint16_t prinfow = ((copy->control[2] >> 2) & 0xf);
2785
2786 uint16_t status;
2787
2788 trace_pci_nvme_copy(nvme_cid(req), nvme_nsid(ns), nr, format);
2789
2790 iocb->ranges = NULL;
2791 iocb->zone = NULL;
2792
2793 if (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps) &&
2794 ((prinfor & NVME_PRINFO_PRACT) != (prinfow & NVME_PRINFO_PRACT))) {
2795 status = NVME_INVALID_FIELD | NVME_DNR;
2796 goto invalid;
2797 }
2798
2799 if (!(n->id_ctrl.ocfs & (1 << format))) {
2800 trace_pci_nvme_err_copy_invalid_format(format);
2801 status = NVME_INVALID_FIELD | NVME_DNR;
2802 goto invalid;
2803 }
2804
2805 if (nr > ns->id_ns.msrc + 1) {
2806 status = NVME_CMD_SIZE_LIMIT | NVME_DNR;
2807 goto invalid;
2808 }
2809
2810 iocb->ranges = g_new(NvmeCopySourceRange, nr);
2811
2812 status = nvme_h2c(n, (uint8_t *)iocb->ranges,
2813 sizeof(NvmeCopySourceRange) * nr, req);
2814 if (status) {
2815 goto invalid;
2816 }
2817
2818 iocb->slba = le64_to_cpu(copy->sdlba);
2819
2820 if (ns->params.zoned) {
2821 iocb->zone = nvme_get_zone_by_slba(ns, iocb->slba);
2822 if (!iocb->zone) {
2823 status = NVME_LBA_RANGE | NVME_DNR;
2824 goto invalid;
2825 }
2826
2827 status = nvme_zrm_auto(n, ns, iocb->zone);
2828 if (status) {
2829 goto invalid;
2830 }
2831 }
2832
2833 iocb->req = req;
2834 iocb->bh = qemu_bh_new(nvme_copy_bh, iocb);
2835 iocb->ret = 0;
2836 iocb->nr = nr;
2837 iocb->idx = 0;
2838 iocb->reftag = le32_to_cpu(copy->reftag);
2839 iocb->bounce = g_malloc_n(le16_to_cpu(ns->id_ns.mssrl),
2840 ns->lbasz + ns->lbaf.ms);
2841
2842 qemu_iovec_init(&iocb->iov, 1);
2843
2844 block_acct_start(blk_get_stats(ns->blkconf.blk), &iocb->acct.read, 0,
2845 BLOCK_ACCT_READ);
2846 block_acct_start(blk_get_stats(ns->blkconf.blk), &iocb->acct.write, 0,
2847 BLOCK_ACCT_WRITE);
2848
2849 req->aiocb = &iocb->common;
2850 nvme_copy_cb(iocb, 0);
2851
2852 return NVME_NO_COMPLETE;
2853
2854 invalid:
2855 g_free(iocb->ranges);
2856 qemu_aio_unref(iocb);
2857 return status;
2858 }
2859
2860 static uint16_t nvme_compare(NvmeCtrl *n, NvmeRequest *req)
2861 {
2862 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd;
2863 NvmeNamespace *ns = req->ns;
2864 BlockBackend *blk = ns->blkconf.blk;
2865 uint64_t slba = le64_to_cpu(rw->slba);
2866 uint32_t nlb = le16_to_cpu(rw->nlb) + 1;
2867 uint8_t prinfo = NVME_RW_PRINFO(le16_to_cpu(rw->control));
2868 size_t data_len = nvme_l2b(ns, nlb);
2869 size_t len = data_len;
2870 int64_t offset = nvme_l2b(ns, slba);
2871 struct nvme_compare_ctx *ctx = NULL;
2872 uint16_t status;
2873
2874 trace_pci_nvme_compare(nvme_cid(req), nvme_nsid(ns), slba, nlb);
2875
2876 if (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps) && (prinfo & NVME_PRINFO_PRACT)) {
2877 return NVME_INVALID_PROT_INFO | NVME_DNR;
2878 }
2879
2880 if (nvme_ns_ext(ns)) {
2881 len += nvme_m2b(ns, nlb);
2882 }
2883
2884 status = nvme_check_mdts(n, len);
2885 if (status) {
2886 return status;
2887 }
2888
2889 status = nvme_check_bounds(ns, slba, nlb);
2890 if (status) {
2891 return status;
2892 }
2893
2894 if (NVME_ERR_REC_DULBE(ns->features.err_rec)) {
2895 status = nvme_check_dulbe(ns, slba, nlb);
2896 if (status) {
2897 return status;
2898 }
2899 }
2900
2901 status = nvme_map_dptr(n, &req->sg, len, &req->cmd);
2902 if (status) {
2903 return status;
2904 }
2905
2906 ctx = g_new(struct nvme_compare_ctx, 1);
2907 ctx->data.bounce = g_malloc(data_len);
2908
2909 req->opaque = ctx;
2910
2911 qemu_iovec_init(&ctx->data.iov, 1);
2912 qemu_iovec_add(&ctx->data.iov, ctx->data.bounce, data_len);
2913
2914 block_acct_start(blk_get_stats(blk), &req->acct, data_len,
2915 BLOCK_ACCT_READ);
2916 req->aiocb = blk_aio_preadv(blk, offset, &ctx->data.iov, 0,
2917 nvme_compare_data_cb, req);
2918
2919 return NVME_NO_COMPLETE;
2920 }
2921
2922 typedef struct NvmeFlushAIOCB {
2923 BlockAIOCB common;
2924 BlockAIOCB *aiocb;
2925 NvmeRequest *req;
2926 QEMUBH *bh;
2927 int ret;
2928
2929 NvmeNamespace *ns;
2930 uint32_t nsid;
2931 bool broadcast;
2932 } NvmeFlushAIOCB;
2933
2934 static void nvme_flush_cancel(BlockAIOCB *acb)
2935 {
2936 NvmeFlushAIOCB *iocb = container_of(acb, NvmeFlushAIOCB, common);
2937
2938 iocb->ret = -ECANCELED;
2939
2940 if (iocb->aiocb) {
2941 blk_aio_cancel_async(iocb->aiocb);
2942 }
2943 }
2944
2945 static const AIOCBInfo nvme_flush_aiocb_info = {
2946 .aiocb_size = sizeof(NvmeFlushAIOCB),
2947 .cancel_async = nvme_flush_cancel,
2948 .get_aio_context = nvme_get_aio_context,
2949 };
2950
2951 static void nvme_flush_ns_cb(void *opaque, int ret)
2952 {
2953 NvmeFlushAIOCB *iocb = opaque;
2954 NvmeNamespace *ns = iocb->ns;
2955
2956 if (ret < 0) {
2957 iocb->ret = ret;
2958 goto out;
2959 } else if (iocb->ret < 0) {
2960 goto out;
2961 }
2962
2963 if (ns) {
2964 trace_pci_nvme_flush_ns(iocb->nsid);
2965
2966 iocb->ns = NULL;
2967 iocb->aiocb = blk_aio_flush(ns->blkconf.blk, nvme_flush_ns_cb, iocb);
2968 return;
2969 }
2970
2971 out:
2972 iocb->aiocb = NULL;
2973 qemu_bh_schedule(iocb->bh);
2974 }
2975
2976 static void nvme_flush_bh(void *opaque)
2977 {
2978 NvmeFlushAIOCB *iocb = opaque;
2979 NvmeRequest *req = iocb->req;
2980 NvmeCtrl *n = nvme_ctrl(req);
2981 int i;
2982
2983 if (iocb->ret < 0) {
2984 goto done;
2985 }
2986
2987 if (iocb->broadcast) {
2988 for (i = iocb->nsid + 1; i <= NVME_MAX_NAMESPACES; i++) {
2989 iocb->ns = nvme_ns(n, i);
2990 if (iocb->ns) {
2991 iocb->nsid = i;
2992 break;
2993 }
2994 }
2995 }
2996
2997 if (!iocb->ns) {
2998 goto done;
2999 }
3000
3001 nvme_flush_ns_cb(iocb, 0);
3002 return;
3003
3004 done:
3005 qemu_bh_delete(iocb->bh);
3006 iocb->bh = NULL;
3007
3008 iocb->common.cb(iocb->common.opaque, iocb->ret);
3009
3010 qemu_aio_unref(iocb);
3011
3012 return;
3013 }
3014
3015 static uint16_t nvme_flush(NvmeCtrl *n, NvmeRequest *req)
3016 {
3017 NvmeFlushAIOCB *iocb;
3018 uint32_t nsid = le32_to_cpu(req->cmd.nsid);
3019 uint16_t status;
3020
3021 iocb = qemu_aio_get(&nvme_flush_aiocb_info, NULL, nvme_misc_cb, req);
3022
3023 iocb->req = req;
3024 iocb->bh = qemu_bh_new(nvme_flush_bh, iocb);
3025 iocb->ret = 0;
3026 iocb->ns = NULL;
3027 iocb->nsid = 0;
3028 iocb->broadcast = (nsid == NVME_NSID_BROADCAST);
3029
3030 if (!iocb->broadcast) {
3031 if (!nvme_nsid_valid(n, nsid)) {
3032 status = NVME_INVALID_NSID | NVME_DNR;
3033 goto out;
3034 }
3035
3036 iocb->ns = nvme_ns(n, nsid);
3037 if (!iocb->ns) {
3038 status = NVME_INVALID_FIELD | NVME_DNR;
3039 goto out;
3040 }
3041
3042 iocb->nsid = nsid;
3043 }
3044
3045 req->aiocb = &iocb->common;
3046 qemu_bh_schedule(iocb->bh);
3047
3048 return NVME_NO_COMPLETE;
3049
3050 out:
3051 qemu_bh_delete(iocb->bh);
3052 iocb->bh = NULL;
3053 qemu_aio_unref(iocb);
3054
3055 return status;
3056 }
3057
3058 static uint16_t nvme_read(NvmeCtrl *n, NvmeRequest *req)
3059 {
3060 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd;
3061 NvmeNamespace *ns = req->ns;
3062 uint64_t slba = le64_to_cpu(rw->slba);
3063 uint32_t nlb = (uint32_t)le16_to_cpu(rw->nlb) + 1;
3064 uint8_t prinfo = NVME_RW_PRINFO(le16_to_cpu(rw->control));
3065 uint64_t data_size = nvme_l2b(ns, nlb);
3066 uint64_t mapped_size = data_size;
3067 uint64_t data_offset;
3068 BlockBackend *blk = ns->blkconf.blk;
3069 uint16_t status;
3070
3071 if (nvme_ns_ext(ns)) {
3072 mapped_size += nvme_m2b(ns, nlb);
3073
3074 if (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps)) {
3075 bool pract = prinfo & NVME_PRINFO_PRACT;
3076
3077 if (pract && ns->lbaf.ms == 8) {
3078 mapped_size = data_size;
3079 }
3080 }
3081 }
3082
3083 trace_pci_nvme_read(nvme_cid(req), nvme_nsid(ns), nlb, mapped_size, slba);
3084
3085 status = nvme_check_mdts(n, mapped_size);
3086 if (status) {
3087 goto invalid;
3088 }
3089
3090 status = nvme_check_bounds(ns, slba, nlb);
3091 if (status) {
3092 goto invalid;
3093 }
3094
3095 if (ns->params.zoned) {
3096 status = nvme_check_zone_read(ns, slba, nlb);
3097 if (status) {
3098 trace_pci_nvme_err_zone_read_not_ok(slba, nlb, status);
3099 goto invalid;
3100 }
3101 }
3102
3103 if (NVME_ERR_REC_DULBE(ns->features.err_rec)) {
3104 status = nvme_check_dulbe(ns, slba, nlb);
3105 if (status) {
3106 goto invalid;
3107 }
3108 }
3109
3110 if (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps)) {
3111 return nvme_dif_rw(n, req);
3112 }
3113
3114 status = nvme_map_data(n, nlb, req);
3115 if (status) {
3116 goto invalid;
3117 }
3118
3119 data_offset = nvme_l2b(ns, slba);
3120
3121 block_acct_start(blk_get_stats(blk), &req->acct, data_size,
3122 BLOCK_ACCT_READ);
3123 nvme_blk_read(blk, data_offset, nvme_rw_cb, req);
3124 return NVME_NO_COMPLETE;
3125
3126 invalid:
3127 block_acct_invalid(blk_get_stats(blk), BLOCK_ACCT_READ);
3128 return status | NVME_DNR;
3129 }
3130
3131 static uint16_t nvme_do_write(NvmeCtrl *n, NvmeRequest *req, bool append,
3132 bool wrz)
3133 {
3134 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd;
3135 NvmeNamespace *ns = req->ns;
3136 uint64_t slba = le64_to_cpu(rw->slba);
3137 uint32_t nlb = (uint32_t)le16_to_cpu(rw->nlb) + 1;
3138 uint16_t ctrl = le16_to_cpu(rw->control);
3139 uint8_t prinfo = NVME_RW_PRINFO(ctrl);
3140 uint64_t data_size = nvme_l2b(ns, nlb);
3141 uint64_t mapped_size = data_size;
3142 uint64_t data_offset;
3143 NvmeZone *zone;
3144 NvmeZonedResult *res = (NvmeZonedResult *)&req->cqe;
3145 BlockBackend *blk = ns->blkconf.blk;
3146 uint16_t status;
3147
3148 if (nvme_ns_ext(ns)) {
3149 mapped_size += nvme_m2b(ns, nlb);
3150
3151 if (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps)) {
3152 bool pract = prinfo & NVME_PRINFO_PRACT;
3153
3154 if (pract && ns->lbaf.ms == 8) {
3155 mapped_size -= nvme_m2b(ns, nlb);
3156 }
3157 }
3158 }
3159
3160 trace_pci_nvme_write(nvme_cid(req), nvme_io_opc_str(rw->opcode),
3161 nvme_nsid(ns), nlb, mapped_size, slba);
3162
3163 if (!wrz) {
3164 status = nvme_check_mdts(n, mapped_size);
3165 if (status) {
3166 goto invalid;
3167 }
3168 }
3169
3170 status = nvme_check_bounds(ns, slba, nlb);
3171 if (status) {
3172 goto invalid;
3173 }
3174
3175 if (ns->params.zoned) {
3176 zone = nvme_get_zone_by_slba(ns, slba);
3177 assert(zone);
3178
3179 if (append) {
3180 bool piremap = !!(ctrl & NVME_RW_PIREMAP);
3181
3182 if (unlikely(slba != zone->d.zslba)) {
3183 trace_pci_nvme_err_append_not_at_start(slba, zone->d.zslba);
3184 status = NVME_INVALID_FIELD;
3185 goto invalid;
3186 }
3187
3188 if (n->params.zasl &&
3189 data_size > (uint64_t)n->page_size << n->params.zasl) {
3190 trace_pci_nvme_err_zasl(data_size);
3191 return NVME_INVALID_FIELD | NVME_DNR;
3192 }
3193
3194 slba = zone->w_ptr;
3195 rw->slba = cpu_to_le64(slba);
3196 res->slba = cpu_to_le64(slba);
3197
3198 switch (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps)) {
3199 case NVME_ID_NS_DPS_TYPE_1:
3200 if (!piremap) {
3201 return NVME_INVALID_PROT_INFO | NVME_DNR;
3202 }
3203
3204 /* fallthrough */
3205
3206 case NVME_ID_NS_DPS_TYPE_2:
3207 if (piremap) {
3208 uint32_t reftag = le32_to_cpu(rw->reftag);
3209 rw->reftag = cpu_to_le32(reftag + (slba - zone->d.zslba));
3210 }
3211
3212 break;
3213
3214 case NVME_ID_NS_DPS_TYPE_3:
3215 if (piremap) {
3216 return NVME_INVALID_PROT_INFO | NVME_DNR;
3217 }
3218
3219 break;
3220 }
3221 }
3222
3223 status = nvme_check_zone_write(ns, zone, slba, nlb);
3224 if (status) {
3225 goto invalid;
3226 }
3227
3228 status = nvme_zrm_auto(n, ns, zone);
3229 if (status) {
3230 goto invalid;
3231 }
3232
3233 zone->w_ptr += nlb;
3234 }
3235
3236 data_offset = nvme_l2b(ns, slba);
3237
3238 if (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps)) {
3239 return nvme_dif_rw(n, req);
3240 }
3241
3242 if (!wrz) {
3243 status = nvme_map_data(n, nlb, req);
3244 if (status) {
3245 goto invalid;
3246 }
3247
3248 block_acct_start(blk_get_stats(blk), &req->acct, data_size,
3249 BLOCK_ACCT_WRITE);
3250 nvme_blk_write(blk, data_offset, nvme_rw_cb, req);
3251 } else {
3252 req->aiocb = blk_aio_pwrite_zeroes(blk, data_offset, data_size,
3253 BDRV_REQ_MAY_UNMAP, nvme_rw_cb,
3254 req);
3255 }
3256
3257 return NVME_NO_COMPLETE;
3258
3259 invalid:
3260 block_acct_invalid(blk_get_stats(blk), BLOCK_ACCT_WRITE);
3261 return status | NVME_DNR;
3262 }
3263
3264 static inline uint16_t nvme_write(NvmeCtrl *n, NvmeRequest *req)
3265 {
3266 return nvme_do_write(n, req, false, false);
3267 }
3268
3269 static inline uint16_t nvme_write_zeroes(NvmeCtrl *n, NvmeRequest *req)
3270 {
3271 return nvme_do_write(n, req, false, true);
3272 }
3273
3274 static inline uint16_t nvme_zone_append(NvmeCtrl *n, NvmeRequest *req)
3275 {
3276 return nvme_do_write(n, req, true, false);
3277 }
3278
3279 static uint16_t nvme_get_mgmt_zone_slba_idx(NvmeNamespace *ns, NvmeCmd *c,
3280 uint64_t *slba, uint32_t *zone_idx)
3281 {
3282 uint32_t dw10 = le32_to_cpu(c->cdw10);
3283 uint32_t dw11 = le32_to_cpu(c->cdw11);
3284
3285 if (!ns->params.zoned) {
3286 trace_pci_nvme_err_invalid_opc(c->opcode);
3287 return NVME_INVALID_OPCODE | NVME_DNR;
3288 }
3289
3290 *slba = ((uint64_t)dw11) << 32 | dw10;
3291 if (unlikely(*slba >= ns->id_ns.nsze)) {
3292 trace_pci_nvme_err_invalid_lba_range(*slba, 0, ns->id_ns.nsze);
3293 *slba = 0;
3294 return NVME_LBA_RANGE | NVME_DNR;
3295 }
3296
3297 *zone_idx = nvme_zone_idx(ns, *slba);
3298 assert(*zone_idx < ns->num_zones);
3299
3300 return NVME_SUCCESS;
3301 }
3302
3303 typedef uint16_t (*op_handler_t)(NvmeNamespace *, NvmeZone *, NvmeZoneState,
3304 NvmeRequest *);
3305
3306 enum NvmeZoneProcessingMask {
3307 NVME_PROC_CURRENT_ZONE = 0,
3308 NVME_PROC_OPENED_ZONES = 1 << 0,
3309 NVME_PROC_CLOSED_ZONES = 1 << 1,
3310 NVME_PROC_READ_ONLY_ZONES = 1 << 2,
3311 NVME_PROC_FULL_ZONES = 1 << 3,
3312 };
3313
3314 static uint16_t nvme_open_zone(NvmeNamespace *ns, NvmeZone *zone,
3315 NvmeZoneState state, NvmeRequest *req)
3316 {
3317 return nvme_zrm_open(nvme_ctrl(req), ns, zone);
3318 }
3319
3320 static uint16_t nvme_close_zone(NvmeNamespace *ns, NvmeZone *zone,
3321 NvmeZoneState state, NvmeRequest *req)
3322 {
3323 return nvme_zrm_close(ns, zone);
3324 }
3325
3326 static uint16_t nvme_finish_zone(NvmeNamespace *ns, NvmeZone *zone,
3327 NvmeZoneState state, NvmeRequest *req)
3328 {
3329 return nvme_zrm_finish(ns, zone);
3330 }
3331
3332 static uint16_t nvme_offline_zone(NvmeNamespace *ns, NvmeZone *zone,
3333 NvmeZoneState state, NvmeRequest *req)
3334 {
3335 switch (state) {
3336 case NVME_ZONE_STATE_READ_ONLY:
3337 nvme_assign_zone_state(ns, zone, NVME_ZONE_STATE_OFFLINE);
3338 /* fall through */
3339 case NVME_ZONE_STATE_OFFLINE:
3340 return NVME_SUCCESS;
3341 default:
3342 return NVME_ZONE_INVAL_TRANSITION;
3343 }
3344 }
3345
3346 static uint16_t nvme_set_zd_ext(NvmeNamespace *ns, NvmeZone *zone)
3347 {
3348 uint16_t status;
3349 uint8_t state = nvme_get_zone_state(zone);
3350
3351 if (state == NVME_ZONE_STATE_EMPTY) {
3352 status = nvme_aor_check(ns, 1, 0);
3353 if (status) {
3354 return status;
3355 }
3356 nvme_aor_inc_active(ns);
3357 zone->d.za |= NVME_ZA_ZD_EXT_VALID;
3358 nvme_assign_zone_state(ns, zone, NVME_ZONE_STATE_CLOSED);
3359 return NVME_SUCCESS;
3360 }
3361
3362 return NVME_ZONE_INVAL_TRANSITION;
3363 }
3364
3365 static uint16_t nvme_bulk_proc_zone(NvmeNamespace *ns, NvmeZone *zone,
3366 enum NvmeZoneProcessingMask proc_mask,
3367 op_handler_t op_hndlr, NvmeRequest *req)
3368 {
3369 uint16_t status = NVME_SUCCESS;
3370 NvmeZoneState zs = nvme_get_zone_state(zone);
3371 bool proc_zone;
3372
3373 switch (zs) {
3374 case NVME_ZONE_STATE_IMPLICITLY_OPEN:
3375 case NVME_ZONE_STATE_EXPLICITLY_OPEN:
3376 proc_zone = proc_mask & NVME_PROC_OPENED_ZONES;
3377 break;
3378 case NVME_ZONE_STATE_CLOSED:
3379 proc_zone = proc_mask & NVME_PROC_CLOSED_ZONES;
3380 break;
3381 case NVME_ZONE_STATE_READ_ONLY:
3382 proc_zone = proc_mask & NVME_PROC_READ_ONLY_ZONES;
3383 break;
3384 case NVME_ZONE_STATE_FULL:
3385 proc_zone = proc_mask & NVME_PROC_FULL_ZONES;
3386 break;
3387 default:
3388 proc_zone = false;
3389 }
3390
3391 if (proc_zone) {
3392 status = op_hndlr(ns, zone, zs, req);
3393 }
3394
3395 return status;
3396 }
3397
3398 static uint16_t nvme_do_zone_op(NvmeNamespace *ns, NvmeZone *zone,
3399 enum NvmeZoneProcessingMask proc_mask,
3400 op_handler_t op_hndlr, NvmeRequest *req)
3401 {
3402 NvmeZone *next;
3403 uint16_t status = NVME_SUCCESS;
3404 int i;
3405
3406 if (!proc_mask) {
3407 status = op_hndlr(ns, zone, nvme_get_zone_state(zone), req);
3408 } else {
3409 if (proc_mask & NVME_PROC_CLOSED_ZONES) {
3410 QTAILQ_FOREACH_SAFE(zone, &ns->closed_zones, entry, next) {
3411 status = nvme_bulk_proc_zone(ns, zone, proc_mask, op_hndlr,
3412 req);
3413 if (status && status != NVME_NO_COMPLETE) {
3414 goto out;
3415 }
3416 }
3417 }
3418 if (proc_mask & NVME_PROC_OPENED_ZONES) {
3419 QTAILQ_FOREACH_SAFE(zone, &ns->imp_open_zones, entry, next) {
3420 status = nvme_bulk_proc_zone(ns, zone, proc_mask, op_hndlr,
3421 req);
3422 if (status && status != NVME_NO_COMPLETE) {
3423 goto out;
3424 }
3425 }
3426
3427 QTAILQ_FOREACH_SAFE(zone, &ns->exp_open_zones, entry, next) {
3428 status = nvme_bulk_proc_zone(ns, zone, proc_mask, op_hndlr,
3429 req);
3430 if (status && status != NVME_NO_COMPLETE) {
3431 goto out;
3432 }
3433 }
3434 }
3435 if (proc_mask & NVME_PROC_FULL_ZONES) {
3436 QTAILQ_FOREACH_SAFE(zone, &ns->full_zones, entry, next) {
3437 status = nvme_bulk_proc_zone(ns, zone, proc_mask, op_hndlr,
3438 req);
3439 if (status && status != NVME_NO_COMPLETE) {
3440 goto out;
3441 }
3442 }
3443 }
3444
3445 if (proc_mask & NVME_PROC_READ_ONLY_ZONES) {
3446 for (i = 0; i < ns->num_zones; i++, zone++) {
3447 status = nvme_bulk_proc_zone(ns, zone, proc_mask, op_hndlr,
3448 req);
3449 if (status && status != NVME_NO_COMPLETE) {
3450 goto out;
3451 }
3452 }
3453 }
3454 }
3455
3456 out:
3457 return status;
3458 }
3459
3460 typedef struct NvmeZoneResetAIOCB {
3461 BlockAIOCB common;
3462 BlockAIOCB *aiocb;
3463 NvmeRequest *req;
3464 QEMUBH *bh;
3465 int ret;
3466
3467 bool all;
3468 int idx;
3469 NvmeZone *zone;
3470 } NvmeZoneResetAIOCB;
3471
3472 static void nvme_zone_reset_cancel(BlockAIOCB *aiocb)
3473 {
3474 NvmeZoneResetAIOCB *iocb = container_of(aiocb, NvmeZoneResetAIOCB, common);
3475 NvmeRequest *req = iocb->req;
3476 NvmeNamespace *ns = req->ns;
3477
3478 iocb->idx = ns->num_zones;
3479
3480 iocb->ret = -ECANCELED;
3481
3482 if (iocb->aiocb) {
3483 blk_aio_cancel_async(iocb->aiocb);
3484 iocb->aiocb = NULL;
3485 }
3486 }
3487
3488 static const AIOCBInfo nvme_zone_reset_aiocb_info = {
3489 .aiocb_size = sizeof(NvmeZoneResetAIOCB),
3490 .cancel_async = nvme_zone_reset_cancel,
3491 };
3492
3493 static void nvme_zone_reset_bh(void *opaque)
3494 {
3495 NvmeZoneResetAIOCB *iocb = opaque;
3496
3497 iocb->common.cb(iocb->common.opaque, iocb->ret);
3498
3499 qemu_bh_delete(iocb->bh);
3500 iocb->bh = NULL;
3501 qemu_aio_unref(iocb);
3502 }
3503
3504 static void nvme_zone_reset_cb(void *opaque, int ret);
3505
3506 static void nvme_zone_reset_epilogue_cb(void *opaque, int ret)
3507 {
3508 NvmeZoneResetAIOCB *iocb = opaque;
3509 NvmeRequest *req = iocb->req;
3510 NvmeNamespace *ns = req->ns;
3511 int64_t moff;
3512 int count;
3513
3514 if (ret < 0) {
3515 nvme_zone_reset_cb(iocb, ret);
3516 return;
3517 }
3518
3519 if (!ns->lbaf.ms) {
3520 nvme_zone_reset_cb(iocb, 0);
3521 return;
3522 }
3523
3524 moff = nvme_moff(ns, iocb->zone->d.zslba);
3525 count = nvme_m2b(ns, ns->zone_size);
3526
3527 iocb->aiocb = blk_aio_pwrite_zeroes(ns->blkconf.blk, moff, count,
3528 BDRV_REQ_MAY_UNMAP,
3529 nvme_zone_reset_cb, iocb);
3530 return;
3531 }
3532
3533 static void nvme_zone_reset_cb(void *opaque, int ret)
3534 {
3535 NvmeZoneResetAIOCB *iocb = opaque;
3536 NvmeRequest *req = iocb->req;
3537 NvmeNamespace *ns = req->ns;
3538
3539 if (ret < 0) {
3540 iocb->ret = ret;
3541 goto done;
3542 }
3543
3544 if (iocb->zone) {
3545 nvme_zrm_reset(ns, iocb->zone);
3546
3547 if (!iocb->all) {
3548 goto done;
3549 }
3550 }
3551
3552 while (iocb->idx < ns->num_zones) {
3553 NvmeZone *zone = &ns->zone_array[iocb->idx++];
3554
3555 switch (nvme_get_zone_state(zone)) {
3556 case NVME_ZONE_STATE_EMPTY:
3557 if (!iocb->all) {
3558 goto done;
3559 }
3560
3561 continue;
3562
3563 case NVME_ZONE_STATE_EXPLICITLY_OPEN:
3564 case NVME_ZONE_STATE_IMPLICITLY_OPEN:
3565 case NVME_ZONE_STATE_CLOSED:
3566 case NVME_ZONE_STATE_FULL:
3567 iocb->zone = zone;
3568 break;
3569
3570 default:
3571 continue;
3572 }
3573
3574 trace_pci_nvme_zns_zone_reset(zone->d.zslba);
3575
3576 iocb->aiocb = blk_aio_pwrite_zeroes(ns->blkconf.blk,
3577 nvme_l2b(ns, zone->d.zslba),
3578 nvme_l2b(ns, ns->zone_size),
3579 BDRV_REQ_MAY_UNMAP,
3580 nvme_zone_reset_epilogue_cb,
3581 iocb);
3582 return;
3583 }
3584
3585 done:
3586 iocb->aiocb = NULL;
3587 if (iocb->bh) {
3588 qemu_bh_schedule(iocb->bh);
3589 }
3590 }
3591
3592 static uint16_t nvme_zone_mgmt_send(NvmeCtrl *n, NvmeRequest *req)
3593 {
3594 NvmeCmd *cmd = (NvmeCmd *)&req->cmd;
3595 NvmeNamespace *ns = req->ns;
3596 NvmeZone *zone;
3597 NvmeZoneResetAIOCB *iocb;
3598 uint8_t *zd_ext;
3599 uint32_t dw13 = le32_to_cpu(cmd->cdw13);
3600 uint64_t slba = 0;
3601 uint32_t zone_idx = 0;
3602 uint16_t status;
3603 uint8_t action;
3604 bool all;
3605 enum NvmeZoneProcessingMask proc_mask = NVME_PROC_CURRENT_ZONE;
3606
3607 action = dw13 & 0xff;
3608 all = !!(dw13 & 0x100);
3609
3610 req->status = NVME_SUCCESS;
3611
3612 if (!all) {
3613 status = nvme_get_mgmt_zone_slba_idx(ns, cmd, &slba, &zone_idx);
3614 if (status) {
3615 return status;
3616 }
3617 }
3618
3619 zone = &ns->zone_array[zone_idx];
3620 if (slba != zone->d.zslba) {
3621 trace_pci_nvme_err_unaligned_zone_cmd(action, slba, zone->d.zslba);
3622 return NVME_INVALID_FIELD | NVME_DNR;
3623 }
3624
3625 switch (action) {
3626
3627 case NVME_ZONE_ACTION_OPEN:
3628 if (all) {
3629 proc_mask = NVME_PROC_CLOSED_ZONES;
3630 }
3631 trace_pci_nvme_open_zone(slba, zone_idx, all);
3632 status = nvme_do_zone_op(ns, zone, proc_mask, nvme_open_zone, req);
3633 break;
3634
3635 case NVME_ZONE_ACTION_CLOSE:
3636 if (all) {
3637 proc_mask = NVME_PROC_OPENED_ZONES;
3638 }
3639 trace_pci_nvme_close_zone(slba, zone_idx, all);
3640 status = nvme_do_zone_op(ns, zone, proc_mask, nvme_close_zone, req);
3641 break;
3642
3643 case NVME_ZONE_ACTION_FINISH:
3644 if (all) {
3645 proc_mask = NVME_PROC_OPENED_ZONES | NVME_PROC_CLOSED_ZONES;
3646 }
3647 trace_pci_nvme_finish_zone(slba, zone_idx, all);
3648 status = nvme_do_zone_op(ns, zone, proc_mask, nvme_finish_zone, req);
3649 break;
3650
3651 case NVME_ZONE_ACTION_RESET:
3652 trace_pci_nvme_reset_zone(slba, zone_idx, all);
3653
3654 iocb = blk_aio_get(&nvme_zone_reset_aiocb_info, ns->blkconf.blk,
3655 nvme_misc_cb, req);
3656
3657 iocb->req = req;
3658 iocb->bh = qemu_bh_new(nvme_zone_reset_bh, iocb);
3659 iocb->ret = 0;
3660 iocb->all = all;
3661 iocb->idx = zone_idx;
3662 iocb->zone = NULL;
3663
3664 req->aiocb = &iocb->common;
3665 nvme_zone_reset_cb(iocb, 0);
3666
3667 return NVME_NO_COMPLETE;
3668
3669 case NVME_ZONE_ACTION_OFFLINE:
3670 if (all) {
3671 proc_mask = NVME_PROC_READ_ONLY_ZONES;
3672 }
3673 trace_pci_nvme_offline_zone(slba, zone_idx, all);
3674 status = nvme_do_zone_op(ns, zone, proc_mask, nvme_offline_zone, req);
3675 break;
3676
3677 case NVME_ZONE_ACTION_SET_ZD_EXT:
3678 trace_pci_nvme_set_descriptor_extension(slba, zone_idx);
3679 if (all || !ns->params.zd_extension_size) {
3680 return NVME_INVALID_FIELD | NVME_DNR;
3681 }
3682 zd_ext = nvme_get_zd_extension(ns, zone_idx);
3683 status = nvme_h2c(n, zd_ext, ns->params.zd_extension_size, req);
3684 if (status) {
3685 trace_pci_nvme_err_zd_extension_map_error(zone_idx);
3686 return status;
3687 }
3688
3689 status = nvme_set_zd_ext(ns, zone);
3690 if (status == NVME_SUCCESS) {
3691 trace_pci_nvme_zd_extension_set(zone_idx);
3692 return status;
3693 }
3694 break;
3695
3696 default:
3697 trace_pci_nvme_err_invalid_mgmt_action(action);
3698 status = NVME_INVALID_FIELD;
3699 }
3700
3701 if (status == NVME_ZONE_INVAL_TRANSITION) {
3702 trace_pci_nvme_err_invalid_zone_state_transition(action, slba,
3703 zone->d.za);
3704 }
3705 if (status) {
3706 status |= NVME_DNR;
3707 }
3708
3709 return status;
3710 }
3711
3712 static bool nvme_zone_matches_filter(uint32_t zafs, NvmeZone *zl)
3713 {
3714 NvmeZoneState zs = nvme_get_zone_state(zl);
3715
3716 switch (zafs) {
3717 case NVME_ZONE_REPORT_ALL:
3718 return true;
3719 case NVME_ZONE_REPORT_EMPTY:
3720 return zs == NVME_ZONE_STATE_EMPTY;
3721 case NVME_ZONE_REPORT_IMPLICITLY_OPEN:
3722 return zs == NVME_ZONE_STATE_IMPLICITLY_OPEN;
3723 case NVME_ZONE_REPORT_EXPLICITLY_OPEN:
3724 return zs == NVME_ZONE_STATE_EXPLICITLY_OPEN;
3725 case NVME_ZONE_REPORT_CLOSED:
3726 return zs == NVME_ZONE_STATE_CLOSED;
3727 case NVME_ZONE_REPORT_FULL:
3728 return zs == NVME_ZONE_STATE_FULL;
3729 case NVME_ZONE_REPORT_READ_ONLY:
3730 return zs == NVME_ZONE_STATE_READ_ONLY;
3731 case NVME_ZONE_REPORT_OFFLINE:
3732 return zs == NVME_ZONE_STATE_OFFLINE;
3733 default:
3734 return false;
3735 }
3736 }
3737
3738 static uint16_t nvme_zone_mgmt_recv(NvmeCtrl *n, NvmeRequest *req)
3739 {
3740 NvmeCmd *cmd = (NvmeCmd *)&req->cmd;
3741 NvmeNamespace *ns = req->ns;
3742 /* cdw12 is zero-based number of dwords to return. Convert to bytes */
3743 uint32_t data_size = (le32_to_cpu(cmd->cdw12) + 1) << 2;
3744 uint32_t dw13 = le32_to_cpu(cmd->cdw13);
3745 uint32_t zone_idx, zra, zrasf, partial;
3746 uint64_t max_zones, nr_zones = 0;
3747 uint16_t status;
3748 uint64_t slba;
3749 NvmeZoneDescr *z;
3750 NvmeZone *zone;
3751 NvmeZoneReportHeader *header;
3752 void *buf, *buf_p;
3753 size_t zone_entry_sz;
3754 int i;
3755
3756 req->status = NVME_SUCCESS;
3757
3758 status = nvme_get_mgmt_zone_slba_idx(ns, cmd, &slba, &zone_idx);
3759 if (status) {
3760 return status;
3761 }
3762
3763 zra = dw13 & 0xff;
3764 if (zra != NVME_ZONE_REPORT && zra != NVME_ZONE_REPORT_EXTENDED) {
3765 return NVME_INVALID_FIELD | NVME_DNR;
3766 }
3767 if (zra == NVME_ZONE_REPORT_EXTENDED && !ns->params.zd_extension_size) {
3768 return NVME_INVALID_FIELD | NVME_DNR;
3769 }
3770
3771 zrasf = (dw13 >> 8) & 0xff;
3772 if (zrasf > NVME_ZONE_REPORT_OFFLINE) {
3773 return NVME_INVALID_FIELD | NVME_DNR;
3774 }
3775
3776 if (data_size < sizeof(NvmeZoneReportHeader)) {
3777 return NVME_INVALID_FIELD | NVME_DNR;
3778 }
3779
3780 status = nvme_check_mdts(n, data_size);
3781 if (status) {
3782 return status;
3783 }
3784
3785 partial = (dw13 >> 16) & 0x01;
3786
3787 zone_entry_sz = sizeof(NvmeZoneDescr);
3788 if (zra == NVME_ZONE_REPORT_EXTENDED) {
3789 zone_entry_sz += ns->params.zd_extension_size;
3790 }
3791
3792 max_zones = (data_size - sizeof(NvmeZoneReportHeader)) / zone_entry_sz;
3793 buf = g_malloc0(data_size);
3794
3795 zone = &ns->zone_array[zone_idx];
3796 for (i = zone_idx; i < ns->num_zones; i++) {
3797 if (partial && nr_zones >= max_zones) {
3798 break;
3799 }
3800 if (nvme_zone_matches_filter(zrasf, zone++)) {
3801 nr_zones++;
3802 }
3803 }
3804 header = (NvmeZoneReportHeader *)buf;
3805 header->nr_zones = cpu_to_le64(nr_zones);
3806
3807 buf_p = buf + sizeof(NvmeZoneReportHeader);
3808 for (; zone_idx < ns->num_zones && max_zones > 0; zone_idx++) {
3809 zone = &ns->zone_array[zone_idx];
3810 if (nvme_zone_matches_filter(zrasf, zone)) {
3811 z = (NvmeZoneDescr *)buf_p;
3812 buf_p += sizeof(NvmeZoneDescr);
3813
3814 z->zt = zone->d.zt;
3815 z->zs = zone->d.zs;
3816 z->zcap = cpu_to_le64(zone->d.zcap);
3817 z->zslba = cpu_to_le64(zone->d.zslba);
3818 z->za = zone->d.za;
3819
3820 if (nvme_wp_is_valid(zone)) {
3821 z->wp = cpu_to_le64(zone->d.wp);
3822 } else {
3823 z->wp = cpu_to_le64(~0ULL);
3824 }
3825
3826 if (zra == NVME_ZONE_REPORT_EXTENDED) {
3827 if (zone->d.za & NVME_ZA_ZD_EXT_VALID) {
3828 memcpy(buf_p, nvme_get_zd_extension(ns, zone_idx),
3829 ns->params.zd_extension_size);
3830 }
3831 buf_p += ns->params.zd_extension_size;
3832 }
3833
3834 max_zones--;
3835 }
3836 }
3837
3838 status = nvme_c2h(n, (uint8_t *)buf, data_size, req);
3839
3840 g_free(buf);
3841
3842 return status;
3843 }
3844
3845 static uint16_t nvme_io_cmd(NvmeCtrl *n, NvmeRequest *req)
3846 {
3847 NvmeNamespace *ns;
3848 uint32_t nsid = le32_to_cpu(req->cmd.nsid);
3849
3850 trace_pci_nvme_io_cmd(nvme_cid(req), nsid, nvme_sqid(req),
3851 req->cmd.opcode, nvme_io_opc_str(req->cmd.opcode));
3852
3853 if (!nvme_nsid_valid(n, nsid)) {
3854 return NVME_INVALID_NSID | NVME_DNR;
3855 }
3856
3857 /*
3858 * In the base NVM command set, Flush may apply to all namespaces
3859 * (indicated by NSID being set to FFFFFFFFh). But if that feature is used
3860 * along with TP 4056 (Namespace Types), it may be pretty screwed up.
3861 *
3862 * If NSID is indeed set to FFFFFFFFh, we simply cannot associate the
3863 * opcode with a specific command since we cannot determine a unique I/O
3864 * command set. Opcode 0h could have any other meaning than something
3865 * equivalent to flushing and say it DOES have completely different
3866 * semantics in some other command set - does an NSID of FFFFFFFFh then
3867 * mean "for all namespaces, apply whatever command set specific command
3868 * that uses the 0h opcode?" Or does it mean "for all namespaces, apply
3869 * whatever command that uses the 0h opcode if, and only if, it allows NSID
3870 * to be FFFFFFFFh"?
3871 *
3872 * Anyway (and luckily), for now, we do not care about this since the
3873 * device only supports namespace types that includes the NVM Flush command
3874 * (NVM and Zoned), so always do an NVM Flush.
3875 */
3876 if (req->cmd.opcode == NVME_CMD_FLUSH) {
3877 return nvme_flush(n, req);
3878 }
3879
3880 ns = nvme_ns(n, nsid);
3881 if (unlikely(!ns)) {
3882 return NVME_INVALID_FIELD | NVME_DNR;
3883 }
3884
3885 if (!(ns->iocs[req->cmd.opcode] & NVME_CMD_EFF_CSUPP)) {
3886 trace_pci_nvme_err_invalid_opc(req->cmd.opcode);
3887 return NVME_INVALID_OPCODE | NVME_DNR;
3888 }
3889
3890 if (ns->status) {
3891 return ns->status;
3892 }
3893
3894 req->ns = ns;
3895
3896 switch (req->cmd.opcode) {
3897 case NVME_CMD_WRITE_ZEROES:
3898 return nvme_write_zeroes(n, req);
3899 case NVME_CMD_ZONE_APPEND:
3900 return nvme_zone_append(n, req);
3901 case NVME_CMD_WRITE:
3902 return nvme_write(n, req);
3903 case NVME_CMD_READ:
3904 return nvme_read(n, req);
3905 case NVME_CMD_COMPARE:
3906 return nvme_compare(n, req);
3907 case NVME_CMD_DSM:
3908 return nvme_dsm(n, req);
3909 case NVME_CMD_VERIFY:
3910 return nvme_verify(n, req);
3911 case NVME_CMD_COPY:
3912 return nvme_copy(n, req);
3913 case NVME_CMD_ZONE_MGMT_SEND:
3914 return nvme_zone_mgmt_send(n, req);
3915 case NVME_CMD_ZONE_MGMT_RECV:
3916 return nvme_zone_mgmt_recv(n, req);
3917 default:
3918 assert(false);
3919 }
3920
3921 return NVME_INVALID_OPCODE | NVME_DNR;
3922 }
3923
3924 static void nvme_free_sq(NvmeSQueue *sq, NvmeCtrl *n)
3925 {
3926 n->sq[sq->sqid] = NULL;
3927 timer_free(sq->timer);
3928 g_free(sq->io_req);
3929 if (sq->sqid) {
3930 g_free(sq);
3931 }
3932 }
3933
3934 static uint16_t nvme_del_sq(NvmeCtrl *n, NvmeRequest *req)
3935 {
3936 NvmeDeleteQ *c = (NvmeDeleteQ *)&req->cmd;
3937 NvmeRequest *r, *next;
3938 NvmeSQueue *sq;
3939 NvmeCQueue *cq;
3940 uint16_t qid = le16_to_cpu(c->qid);
3941
3942 if (unlikely(!qid || nvme_check_sqid(n, qid))) {
3943 trace_pci_nvme_err_invalid_del_sq(qid);
3944 return NVME_INVALID_QID | NVME_DNR;
3945 }
3946
3947 trace_pci_nvme_del_sq(qid);
3948
3949 sq = n->sq[qid];
3950 while (!QTAILQ_EMPTY(&sq->out_req_list)) {
3951 r = QTAILQ_FIRST(&sq->out_req_list);
3952 assert(r->aiocb);
3953 blk_aio_cancel(r->aiocb);
3954 }
3955
3956 assert(QTAILQ_EMPTY(&sq->out_req_list));
3957
3958 if (!nvme_check_cqid(n, sq->cqid)) {
3959 cq = n->cq[sq->cqid];
3960 QTAILQ_REMOVE(&cq->sq_list, sq, entry);
3961
3962 nvme_post_cqes(cq);
3963 QTAILQ_FOREACH_SAFE(r, &cq->req_list, entry, next) {
3964 if (r->sq == sq) {
3965 QTAILQ_REMOVE(&cq->req_list, r, entry);
3966 QTAILQ_INSERT_TAIL(&sq->req_list, r, entry);
3967 }
3968 }
3969 }
3970
3971 nvme_free_sq(sq, n);
3972 return NVME_SUCCESS;
3973 }
3974
3975 static void nvme_init_sq(NvmeSQueue *sq, NvmeCtrl *n, uint64_t dma_addr,
3976 uint16_t sqid, uint16_t cqid, uint16_t size)
3977 {
3978 int i;
3979 NvmeCQueue *cq;
3980
3981 sq->ctrl = n;
3982 sq->dma_addr = dma_addr;
3983 sq->sqid = sqid;
3984 sq->size = size;
3985 sq->cqid = cqid;
3986 sq->head = sq->tail = 0;
3987 sq->io_req = g_new0(NvmeRequest, sq->size);
3988
3989 QTAILQ_INIT(&sq->req_list);
3990 QTAILQ_INIT(&sq->out_req_list);
3991 for (i = 0; i < sq->size; i++) {
3992 sq->io_req[i].sq = sq;
3993 QTAILQ_INSERT_TAIL(&(sq->req_list), &sq->io_req[i], entry);
3994 }
3995 sq->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, nvme_process_sq, sq);
3996
3997 assert(n->cq[cqid]);
3998 cq = n->cq[cqid];
3999 QTAILQ_INSERT_TAIL(&(cq->sq_list), sq, entry);
4000 n->sq[sqid] = sq;
4001 }
4002
4003 static uint16_t nvme_create_sq(NvmeCtrl *n, NvmeRequest *req)
4004 {
4005 NvmeSQueue *sq;
4006 NvmeCreateSq *c = (NvmeCreateSq *)&req->cmd;
4007
4008 uint16_t cqid = le16_to_cpu(c->cqid);
4009 uint16_t sqid = le16_to_cpu(c->sqid);
4010 uint16_t qsize = le16_to_cpu(c->qsize);
4011 uint16_t qflags = le16_to_cpu(c->sq_flags);
4012 uint64_t prp1 = le64_to_cpu(c->prp1);
4013
4014 trace_pci_nvme_create_sq(prp1, sqid, cqid, qsize, qflags);
4015
4016 if (unlikely(!cqid || nvme_check_cqid(n, cqid))) {
4017 trace_pci_nvme_err_invalid_create_sq_cqid(cqid);
4018 return NVME_INVALID_CQID | NVME_DNR;
4019 }
4020 if (unlikely(!sqid || sqid > n->params.max_ioqpairs ||
4021 n->sq[sqid] != NULL)) {
4022 trace_pci_nvme_err_invalid_create_sq_sqid(sqid);
4023 return NVME_INVALID_QID | NVME_DNR;
4024 }
4025 if (unlikely(!qsize || qsize > NVME_CAP_MQES(n->bar.cap))) {
4026 trace_pci_nvme_err_invalid_create_sq_size(qsize);
4027 return NVME_MAX_QSIZE_EXCEEDED | NVME_DNR;
4028 }
4029 if (unlikely(prp1 & (n->page_size - 1))) {
4030 trace_pci_nvme_err_invalid_create_sq_addr(prp1);
4031 return NVME_INVALID_PRP_OFFSET | NVME_DNR;
4032 }
4033 if (unlikely(!(NVME_SQ_FLAGS_PC(qflags)))) {
4034 trace_pci_nvme_err_invalid_create_sq_qflags(NVME_SQ_FLAGS_PC(qflags));
4035 return NVME_INVALID_FIELD | NVME_DNR;
4036 }
4037 sq = g_malloc0(sizeof(*sq));
4038 nvme_init_sq(sq, n, prp1, sqid, cqid, qsize + 1);
4039 return NVME_SUCCESS;
4040 }
4041
4042 struct nvme_stats {
4043 uint64_t units_read;
4044 uint64_t units_written;
4045 uint64_t read_commands;
4046 uint64_t write_commands;
4047 };
4048
4049 static void nvme_set_blk_stats(NvmeNamespace *ns, struct nvme_stats *stats)
4050 {
4051 BlockAcctStats *s = blk_get_stats(ns->blkconf.blk);
4052
4053 stats->units_read += s->nr_bytes[BLOCK_ACCT_READ] >> BDRV_SECTOR_BITS;
4054 stats->units_written += s->nr_bytes[BLOCK_ACCT_WRITE] >> BDRV_SECTOR_BITS;
4055 stats->read_commands += s->nr_ops[BLOCK_ACCT_READ];
4056 stats->write_commands += s->nr_ops[BLOCK_ACCT_WRITE];
4057 }
4058
4059 static uint16_t nvme_smart_info(NvmeCtrl *n, uint8_t rae, uint32_t buf_len,
4060 uint64_t off, NvmeRequest *req)
4061 {
4062 uint32_t nsid = le32_to_cpu(req->cmd.nsid);
4063 struct nvme_stats stats = { 0 };
4064 NvmeSmartLog smart = { 0 };
4065 uint32_t trans_len;
4066 NvmeNamespace *ns;
4067 time_t current_ms;
4068
4069 if (off >= sizeof(smart)) {
4070 return NVME_INVALID_FIELD | NVME_DNR;
4071 }
4072
4073 if (nsid != 0xffffffff) {
4074 ns = nvme_ns(n, nsid);
4075 if (!ns) {
4076 return NVME_INVALID_NSID | NVME_DNR;
4077 }
4078 nvme_set_blk_stats(ns, &stats);
4079 } else {
4080 int i;
4081
4082 for (i = 1; i <= NVME_MAX_NAMESPACES; i++) {
4083 ns = nvme_ns(n, i);
4084 if (!ns) {
4085 continue;
4086 }
4087 nvme_set_blk_stats(ns, &stats);
4088 }
4089 }
4090
4091 trans_len = MIN(sizeof(smart) - off, buf_len);
4092 smart.critical_warning = n->smart_critical_warning;
4093
4094 smart.data_units_read[0] = cpu_to_le64(DIV_ROUND_UP(stats.units_read,
4095 1000));
4096 smart.data_units_written[0] = cpu_to_le64(DIV_ROUND_UP(stats.units_written,
4097 1000));
4098 smart.host_read_commands[0] = cpu_to_le64(stats.read_commands);
4099 smart.host_write_commands[0] = cpu_to_le64(stats.write_commands);
4100
4101 smart.temperature = cpu_to_le16(n->temperature);
4102
4103 if ((n->temperature >= n->features.temp_thresh_hi) ||
4104 (n->temperature <= n->features.temp_thresh_low)) {
4105 smart.critical_warning |= NVME_SMART_TEMPERATURE;
4106 }
4107
4108 current_ms = qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL);
4109 smart.power_on_hours[0] =
4110 cpu_to_le64((((current_ms - n->starttime_ms) / 1000) / 60) / 60);
4111
4112 if (!rae) {
4113 nvme_clear_events(n, NVME_AER_TYPE_SMART);
4114 }
4115
4116 return nvme_c2h(n, (uint8_t *) &smart + off, trans_len, req);
4117 }
4118
4119 static uint16_t nvme_fw_log_info(NvmeCtrl *n, uint32_t buf_len, uint64_t off,
4120 NvmeRequest *req)
4121 {
4122 uint32_t trans_len;
4123 NvmeFwSlotInfoLog fw_log = {
4124 .afi = 0x1,
4125 };
4126
4127 if (off >= sizeof(fw_log)) {
4128 return NVME_INVALID_FIELD | NVME_DNR;
4129 }
4130
4131 strpadcpy((char *)&fw_log.frs1, sizeof(fw_log.frs1), "1.0", ' ');
4132 trans_len = MIN(sizeof(fw_log) - off, buf_len);
4133
4134 return nvme_c2h(n, (uint8_t *) &fw_log + off, trans_len, req);
4135 }
4136
4137 static uint16_t nvme_error_info(NvmeCtrl *n, uint8_t rae, uint32_t buf_len,
4138 uint64_t off, NvmeRequest *req)
4139 {
4140 uint32_t trans_len;
4141 NvmeErrorLog errlog;
4142
4143 if (off >= sizeof(errlog)) {
4144 return NVME_INVALID_FIELD | NVME_DNR;
4145 }
4146
4147 if (!rae) {
4148 nvme_clear_events(n, NVME_AER_TYPE_ERROR);
4149 }
4150
4151 memset(&errlog, 0x0, sizeof(errlog));
4152 trans_len = MIN(sizeof(errlog) - off, buf_len);
4153
4154 return nvme_c2h(n, (uint8_t *)&errlog, trans_len, req);
4155 }
4156
4157 static uint16_t nvme_changed_nslist(NvmeCtrl *n, uint8_t rae, uint32_t buf_len,
4158 uint64_t off, NvmeRequest *req)
4159 {
4160 uint32_t nslist[1024];
4161 uint32_t trans_len;
4162 int i = 0;
4163 uint32_t nsid;
4164
4165 memset(nslist, 0x0, sizeof(nslist));
4166 trans_len = MIN(sizeof(nslist) - off, buf_len);
4167
4168 while ((nsid = find_first_bit(n->changed_nsids, NVME_CHANGED_NSID_SIZE)) !=
4169 NVME_CHANGED_NSID_SIZE) {
4170 /*
4171 * If more than 1024 namespaces, the first entry in the log page should
4172 * be set to FFFFFFFFh and the others to 0 as spec.
4173 */
4174 if (i == ARRAY_SIZE(nslist)) {
4175 memset(nslist, 0x0, sizeof(nslist));
4176 nslist[0] = 0xffffffff;
4177 break;
4178 }
4179
4180 nslist[i++] = nsid;
4181 clear_bit(nsid, n->changed_nsids);
4182 }
4183
4184 /*
4185 * Remove all the remaining list entries in case returns directly due to
4186 * more than 1024 namespaces.
4187 */
4188 if (nslist[0] == 0xffffffff) {
4189 bitmap_zero(n->changed_nsids, NVME_CHANGED_NSID_SIZE);
4190 }
4191
4192 if (!rae) {
4193 nvme_clear_events(n, NVME_AER_TYPE_NOTICE);
4194 }
4195
4196 return nvme_c2h(n, ((uint8_t *)nslist) + off, trans_len, req);
4197 }
4198
4199 static uint16_t nvme_cmd_effects(NvmeCtrl *n, uint8_t csi, uint32_t buf_len,
4200 uint64_t off, NvmeRequest *req)
4201 {
4202 NvmeEffectsLog log = {};
4203 const uint32_t *src_iocs = NULL;
4204 uint32_t trans_len;
4205
4206 if (off >= sizeof(log)) {
4207 trace_pci_nvme_err_invalid_log_page_offset(off, sizeof(log));
4208 return NVME_INVALID_FIELD | NVME_DNR;
4209 }
4210
4211 switch (NVME_CC_CSS(n->bar.cc)) {
4212 case NVME_CC_CSS_NVM:
4213 src_iocs = nvme_cse_iocs_nvm;
4214 /* fall through */
4215 case NVME_CC_CSS_ADMIN_ONLY:
4216 break;
4217 case NVME_CC_CSS_CSI:
4218 switch (csi) {
4219 case NVME_CSI_NVM:
4220 src_iocs = nvme_cse_iocs_nvm;
4221 break;
4222 case NVME_CSI_ZONED:
4223 src_iocs = nvme_cse_iocs_zoned;
4224 break;
4225 }
4226 }
4227
4228 memcpy(log.acs, nvme_cse_acs, sizeof(nvme_cse_acs));
4229
4230 if (src_iocs) {
4231 memcpy(log.iocs, src_iocs, sizeof(log.iocs));
4232 }
4233
4234 trans_len = MIN(sizeof(log) - off, buf_len);
4235
4236 return nvme_c2h(n, ((uint8_t *)&log) + off, trans_len, req);
4237 }
4238
4239 static uint16_t nvme_get_log(NvmeCtrl *n, NvmeRequest *req)
4240 {
4241 NvmeCmd *cmd = &req->cmd;
4242
4243 uint32_t dw10 = le32_to_cpu(cmd->cdw10);
4244 uint32_t dw11 = le32_to_cpu(cmd->cdw11);
4245 uint32_t dw12 = le32_to_cpu(cmd->cdw12);
4246 uint32_t dw13 = le32_to_cpu(cmd->cdw13);
4247 uint8_t lid = dw10 & 0xff;
4248 uint8_t lsp = (dw10 >> 8) & 0xf;
4249 uint8_t rae = (dw10 >> 15) & 0x1;
4250 uint8_t csi = le32_to_cpu(cmd->cdw14) >> 24;
4251 uint32_t numdl, numdu;
4252 uint64_t off, lpol, lpou;
4253 size_t len;
4254 uint16_t status;
4255
4256 numdl = (dw10 >> 16);
4257 numdu = (dw11 & 0xffff);
4258 lpol = dw12;
4259 lpou = dw13;
4260
4261 len = (((numdu << 16) | numdl) + 1) << 2;
4262 off = (lpou << 32ULL) | lpol;
4263
4264 if (off & 0x3) {
4265 return NVME_INVALID_FIELD | NVME_DNR;
4266 }
4267
4268 trace_pci_nvme_get_log(nvme_cid(req), lid, lsp, rae, len, off);
4269
4270 status = nvme_check_mdts(n, len);
4271 if (status) {
4272 return status;
4273 }
4274
4275 switch (lid) {
4276 case NVME_LOG_ERROR_INFO:
4277 return nvme_error_info(n, rae, len, off, req);
4278 case NVME_LOG_SMART_INFO:
4279 return nvme_smart_info(n, rae, len, off, req);
4280 case NVME_LOG_FW_SLOT_INFO:
4281 return nvme_fw_log_info(n, len, off, req);
4282 case NVME_LOG_CHANGED_NSLIST:
4283 return nvme_changed_nslist(n, rae, len, off, req);
4284 case NVME_LOG_CMD_EFFECTS:
4285 return nvme_cmd_effects(n, csi, len, off, req);
4286 default:
4287 trace_pci_nvme_err_invalid_log_page(nvme_cid(req), lid);
4288 return NVME_INVALID_FIELD | NVME_DNR;
4289 }
4290 }
4291
4292 static void nvme_free_cq(NvmeCQueue *cq, NvmeCtrl *n)
4293 {
4294 n->cq[cq->cqid] = NULL;
4295 timer_free(cq->timer);
4296 if (msix_enabled(&n->parent_obj)) {
4297 msix_vector_unuse(&n->parent_obj, cq->vector);
4298 }
4299 if (cq->cqid) {
4300 g_free(cq);
4301 }
4302 }
4303
4304 static uint16_t nvme_del_cq(NvmeCtrl *n, NvmeRequest *req)
4305 {
4306 NvmeDeleteQ *c = (NvmeDeleteQ *)&req->cmd;
4307 NvmeCQueue *cq;
4308 uint16_t qid = le16_to_cpu(c->qid);
4309
4310 if (unlikely(!qid || nvme_check_cqid(n, qid))) {
4311 trace_pci_nvme_err_invalid_del_cq_cqid(qid);
4312 return NVME_INVALID_CQID | NVME_DNR;
4313 }
4314
4315 cq = n->cq[qid];
4316 if (unlikely(!QTAILQ_EMPTY(&cq->sq_list))) {
4317 trace_pci_nvme_err_invalid_del_cq_notempty(qid);
4318 return NVME_INVALID_QUEUE_DEL;
4319 }
4320
4321 if (cq->irq_enabled && cq->tail != cq->head) {
4322 n->cq_pending--;
4323 }
4324
4325 nvme_irq_deassert(n, cq);
4326 trace_pci_nvme_del_cq(qid);
4327 nvme_free_cq(cq, n);
4328 return NVME_SUCCESS;
4329 }
4330
4331 static void nvme_init_cq(NvmeCQueue *cq, NvmeCtrl *n, uint64_t dma_addr,
4332 uint16_t cqid, uint16_t vector, uint16_t size,
4333 uint16_t irq_enabled)
4334 {
4335 int ret;
4336
4337 if (msix_enabled(&n->parent_obj)) {
4338 ret = msix_vector_use(&n->parent_obj, vector);
4339 assert(ret == 0);
4340 }
4341 cq->ctrl = n;
4342 cq->cqid = cqid;
4343 cq->size = size;
4344 cq->dma_addr = dma_addr;
4345 cq->phase = 1;
4346 cq->irq_enabled = irq_enabled;
4347 cq->vector = vector;
4348 cq->head = cq->tail = 0;
4349 QTAILQ_INIT(&cq->req_list);
4350 QTAILQ_INIT(&cq->sq_list);
4351 n->cq[cqid] = cq;
4352 cq->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, nvme_post_cqes, cq);
4353 }
4354
4355 static uint16_t nvme_create_cq(NvmeCtrl *n, NvmeRequest *req)
4356 {
4357 NvmeCQueue *cq;
4358 NvmeCreateCq *c = (NvmeCreateCq *)&req->cmd;
4359 uint16_t cqid = le16_to_cpu(c->cqid);
4360 uint16_t vector = le16_to_cpu(c->irq_vector);
4361 uint16_t qsize = le16_to_cpu(c->qsize);
4362 uint16_t qflags = le16_to_cpu(c->cq_flags);
4363 uint64_t prp1 = le64_to_cpu(c->prp1);
4364
4365 trace_pci_nvme_create_cq(prp1, cqid, vector, qsize, qflags,
4366 NVME_CQ_FLAGS_IEN(qflags) != 0);
4367
4368 if (unlikely(!cqid || cqid > n->params.max_ioqpairs ||
4369 n->cq[cqid] != NULL)) {
4370 trace_pci_nvme_err_invalid_create_cq_cqid(cqid);
4371 return NVME_INVALID_QID | NVME_DNR;
4372 }
4373 if (unlikely(!qsize || qsize > NVME_CAP_MQES(n->bar.cap))) {
4374 trace_pci_nvme_err_invalid_create_cq_size(qsize);
4375 return NVME_MAX_QSIZE_EXCEEDED | NVME_DNR;
4376 }
4377 if (unlikely(prp1 & (n->page_size - 1))) {
4378 trace_pci_nvme_err_invalid_create_cq_addr(prp1);
4379 return NVME_INVALID_PRP_OFFSET | NVME_DNR;
4380 }
4381 if (unlikely(!msix_enabled(&n->parent_obj) && vector)) {
4382 trace_pci_nvme_err_invalid_create_cq_vector(vector);
4383 return NVME_INVALID_IRQ_VECTOR | NVME_DNR;
4384 }
4385 if (unlikely(vector >= n->params.msix_qsize)) {
4386 trace_pci_nvme_err_invalid_create_cq_vector(vector);
4387 return NVME_INVALID_IRQ_VECTOR | NVME_DNR;
4388 }
4389 if (unlikely(!(NVME_CQ_FLAGS_PC(qflags)))) {
4390 trace_pci_nvme_err_invalid_create_cq_qflags(NVME_CQ_FLAGS_PC(qflags));
4391 return NVME_INVALID_FIELD | NVME_DNR;
4392 }
4393
4394 cq = g_malloc0(sizeof(*cq));
4395 nvme_init_cq(cq, n, prp1, cqid, vector, qsize + 1,
4396 NVME_CQ_FLAGS_IEN(qflags));
4397
4398 /*
4399 * It is only required to set qs_created when creating a completion queue;
4400 * creating a submission queue without a matching completion queue will
4401 * fail.
4402 */
4403 n->qs_created = true;
4404 return NVME_SUCCESS;
4405 }
4406
4407 static uint16_t nvme_rpt_empty_id_struct(NvmeCtrl *n, NvmeRequest *req)
4408 {
4409 uint8_t id[NVME_IDENTIFY_DATA_SIZE] = {};
4410
4411 return nvme_c2h(n, id, sizeof(id), req);
4412 }
4413
4414 static uint16_t nvme_identify_ctrl(NvmeCtrl *n, NvmeRequest *req)
4415 {
4416 trace_pci_nvme_identify_ctrl();
4417
4418 return nvme_c2h(n, (uint8_t *)&n->id_ctrl, sizeof(n->id_ctrl), req);
4419 }
4420
4421 static uint16_t nvme_identify_ctrl_csi(NvmeCtrl *n, NvmeRequest *req)
4422 {
4423 NvmeIdentify *c = (NvmeIdentify *)&req->cmd;
4424 uint8_t id[NVME_IDENTIFY_DATA_SIZE] = {};
4425 NvmeIdCtrlNvm *id_nvm = (NvmeIdCtrlNvm *)&id;
4426
4427 trace_pci_nvme_identify_ctrl_csi(c->csi);
4428
4429 switch (c->csi) {
4430 case NVME_CSI_NVM:
4431 id_nvm->vsl = n->params.vsl;
4432 id_nvm->dmrsl = cpu_to_le32(n->dmrsl);
4433 break;
4434
4435 case NVME_CSI_ZONED:
4436 ((NvmeIdCtrlZoned *)&id)->zasl = n->params.zasl;
4437 break;
4438
4439 default:
4440 return NVME_INVALID_FIELD | NVME_DNR;
4441 }
4442
4443 return nvme_c2h(n, id, sizeof(id), req);
4444 }
4445
4446 static uint16_t nvme_identify_ns(NvmeCtrl *n, NvmeRequest *req, bool active)
4447 {
4448 NvmeNamespace *ns;
4449 NvmeIdentify *c = (NvmeIdentify *)&req->cmd;
4450 uint32_t nsid = le32_to_cpu(c->nsid);
4451
4452 trace_pci_nvme_identify_ns(nsid);
4453
4454 if (!nvme_nsid_valid(n, nsid) || nsid == NVME_NSID_BROADCAST) {
4455 return NVME_INVALID_NSID | NVME_DNR;
4456 }
4457
4458 ns = nvme_ns(n, nsid);
4459 if (unlikely(!ns)) {
4460 if (!active) {
4461 ns = nvme_subsys_ns(n->subsys, nsid);
4462 if (!ns) {
4463 return nvme_rpt_empty_id_struct(n, req);
4464 }
4465 } else {
4466 return nvme_rpt_empty_id_struct(n, req);
4467 }
4468 }
4469
4470 if (active || ns->csi == NVME_CSI_NVM) {
4471 return nvme_c2h(n, (uint8_t *)&ns->id_ns, sizeof(NvmeIdNs), req);
4472 }
4473
4474 return NVME_INVALID_CMD_SET | NVME_DNR;
4475 }
4476
4477 static uint16_t nvme_identify_ctrl_list(NvmeCtrl *n, NvmeRequest *req,
4478 bool attached)
4479 {
4480 NvmeIdentify *c = (NvmeIdentify *)&req->cmd;
4481 uint32_t nsid = le32_to_cpu(c->nsid);
4482 uint16_t min_id = le16_to_cpu(c->ctrlid);
4483 uint16_t list[NVME_CONTROLLER_LIST_SIZE] = {};
4484 uint16_t *ids = &list[1];
4485 NvmeNamespace *ns;
4486 NvmeCtrl *ctrl;
4487 int cntlid, nr_ids = 0;
4488
4489 trace_pci_nvme_identify_ctrl_list(c->cns, min_id);
4490
4491 if (!n->subsys) {
4492 return NVME_INVALID_FIELD | NVME_DNR;
4493 }
4494
4495 if (attached) {
4496 if (nsid == NVME_NSID_BROADCAST) {
4497 return NVME_INVALID_FIELD | NVME_DNR;
4498 }
4499
4500 ns = nvme_subsys_ns(n->subsys, nsid);
4501 if (!ns) {
4502 return NVME_INVALID_FIELD | NVME_DNR;
4503 }
4504 }
4505
4506 for (cntlid = min_id; cntlid < ARRAY_SIZE(n->subsys->ctrls); cntlid++) {
4507 ctrl = nvme_subsys_ctrl(n->subsys, cntlid);
4508 if (!ctrl) {
4509 continue;
4510 }
4511
4512 if (attached && !nvme_ns(ctrl, nsid)) {
4513 continue;
4514 }
4515
4516 ids[nr_ids++] = cntlid;
4517 }
4518
4519 list[0] = nr_ids;
4520
4521 return nvme_c2h(n, (uint8_t *)list, sizeof(list), req);
4522 }
4523
4524 static uint16_t nvme_identify_ns_csi(NvmeCtrl *n, NvmeRequest *req,
4525 bool active)
4526 {
4527 NvmeNamespace *ns;
4528 NvmeIdentify *c = (NvmeIdentify *)&req->cmd;
4529 uint32_t nsid = le32_to_cpu(c->nsid);
4530
4531 trace_pci_nvme_identify_ns_csi(nsid, c->csi);
4532
4533 if (!nvme_nsid_valid(n, nsid) || nsid == NVME_NSID_BROADCAST) {
4534 return NVME_INVALID_NSID | NVME_DNR;
4535 }
4536
4537 ns = nvme_ns(n, nsid);
4538 if (unlikely(!ns)) {
4539 if (!active) {
4540 ns = nvme_subsys_ns(n->subsys, nsid);
4541 if (!ns) {
4542 return nvme_rpt_empty_id_struct(n, req);
4543 }
4544 } else {
4545 return nvme_rpt_empty_id_struct(n, req);
4546 }
4547 }
4548
4549 if (c->csi == NVME_CSI_NVM) {
4550 return nvme_rpt_empty_id_struct(n, req);
4551 } else if (c->csi == NVME_CSI_ZONED && ns->csi == NVME_CSI_ZONED) {
4552 return nvme_c2h(n, (uint8_t *)ns->id_ns_zoned, sizeof(NvmeIdNsZoned),
4553 req);
4554 }
4555
4556 return NVME_INVALID_FIELD | NVME_DNR;
4557 }
4558
4559 static uint16_t nvme_identify_nslist(NvmeCtrl *n, NvmeRequest *req,
4560 bool active)
4561 {
4562 NvmeNamespace *ns;
4563 NvmeIdentify *c = (NvmeIdentify *)&req->cmd;
4564 uint32_t min_nsid = le32_to_cpu(c->nsid);
4565 uint8_t list[NVME_IDENTIFY_DATA_SIZE] = {};
4566 static const int data_len = sizeof(list);
4567 uint32_t *list_ptr = (uint32_t *)list;
4568 int i, j = 0;
4569
4570 trace_pci_nvme_identify_nslist(min_nsid);
4571
4572 /*
4573 * Both FFFFFFFFh (NVME_NSID_BROADCAST) and FFFFFFFFEh are invalid values
4574 * since the Active Namespace ID List should return namespaces with ids
4575 * *higher* than the NSID specified in the command. This is also specified
4576 * in the spec (NVM Express v1.3d, Section 5.15.4).
4577 */
4578 if (min_nsid >= NVME_NSID_BROADCAST - 1) {
4579 return NVME_INVALID_NSID | NVME_DNR;
4580 }
4581
4582 for (i = 1; i <= NVME_MAX_NAMESPACES; i++) {
4583 ns = nvme_ns(n, i);
4584 if (!ns) {
4585 if (!active) {
4586 ns = nvme_subsys_ns(n->subsys, i);
4587 if (!ns) {
4588 continue;
4589 }
4590 } else {
4591 continue;
4592 }
4593 }
4594 if (ns->params.nsid <= min_nsid) {
4595 continue;
4596 }
4597 list_ptr[j++] = cpu_to_le32(ns->params.nsid);
4598 if (j == data_len / sizeof(uint32_t)) {
4599 break;
4600 }
4601 }
4602
4603 return nvme_c2h(n, list, data_len, req);
4604 }
4605
4606 static uint16_t nvme_identify_nslist_csi(NvmeCtrl *n, NvmeRequest *req,
4607 bool active)
4608 {
4609 NvmeNamespace *ns;
4610 NvmeIdentify *c = (NvmeIdentify *)&req->cmd;
4611 uint32_t min_nsid = le32_to_cpu(c->nsid);
4612 uint8_t list[NVME_IDENTIFY_DATA_SIZE] = {};
4613 static const int data_len = sizeof(list);
4614 uint32_t *list_ptr = (uint32_t *)list;
4615 int i, j = 0;
4616
4617 trace_pci_nvme_identify_nslist_csi(min_nsid, c->csi);
4618
4619 /*
4620 * Same as in nvme_identify_nslist(), FFFFFFFFh/FFFFFFFFEh are invalid.
4621 */
4622 if (min_nsid >= NVME_NSID_BROADCAST - 1) {
4623 return NVME_INVALID_NSID | NVME_DNR;
4624 }
4625
4626 if (c->csi != NVME_CSI_NVM && c->csi != NVME_CSI_ZONED) {
4627 return NVME_INVALID_FIELD | NVME_DNR;
4628 }
4629
4630 for (i = 1; i <= NVME_MAX_NAMESPACES; i++) {
4631 ns = nvme_ns(n, i);
4632 if (!ns) {
4633 if (!active) {
4634 ns = nvme_subsys_ns(n->subsys, i);
4635 if (!ns) {
4636 continue;
4637 }
4638 } else {
4639 continue;
4640 }
4641 }
4642 if (ns->params.nsid <= min_nsid || c->csi != ns->csi) {
4643 continue;
4644 }
4645 list_ptr[j++] = cpu_to_le32(ns->params.nsid);
4646 if (j == data_len / sizeof(uint32_t)) {
4647 break;
4648 }
4649 }
4650
4651 return nvme_c2h(n, list, data_len, req);
4652 }
4653
4654 static uint16_t nvme_identify_ns_descr_list(NvmeCtrl *n, NvmeRequest *req)
4655 {
4656 NvmeNamespace *ns;
4657 NvmeIdentify *c = (NvmeIdentify *)&req->cmd;
4658 uint32_t nsid = le32_to_cpu(c->nsid);
4659 uint8_t list[NVME_IDENTIFY_DATA_SIZE] = {};
4660 uint8_t *pos = list;
4661 struct {
4662 NvmeIdNsDescr hdr;
4663 uint8_t v[NVME_NIDL_UUID];
4664 } QEMU_PACKED uuid;
4665 struct {
4666 NvmeIdNsDescr hdr;
4667 uint64_t v;
4668 } QEMU_PACKED eui64;
4669 struct {
4670 NvmeIdNsDescr hdr;
4671 uint8_t v;
4672 } QEMU_PACKED csi;
4673
4674 trace_pci_nvme_identify_ns_descr_list(nsid);
4675
4676 if (!nvme_nsid_valid(n, nsid) || nsid == NVME_NSID_BROADCAST) {
4677 return NVME_INVALID_NSID | NVME_DNR;
4678 }
4679
4680 ns = nvme_ns(n, nsid);
4681 if (unlikely(!ns)) {
4682 return NVME_INVALID_FIELD | NVME_DNR;
4683 }
4684
4685 /*
4686 * If the EUI-64 field is 0 and the NGUID field is 0, the namespace must
4687 * provide a valid Namespace UUID in the Namespace Identification Descriptor
4688 * data structure. QEMU does not yet support setting NGUID.
4689 */
4690 uuid.hdr.nidt = NVME_NIDT_UUID;
4691 uuid.hdr.nidl = NVME_NIDL_UUID;
4692 memcpy(uuid.v, ns->params.uuid.data, NVME_NIDL_UUID);
4693 memcpy(pos, &uuid, sizeof(uuid));
4694 pos += sizeof(uuid);
4695
4696 if (ns->params.eui64) {
4697 eui64.hdr.nidt = NVME_NIDT_EUI64;
4698 eui64.hdr.nidl = NVME_NIDL_EUI64;
4699 eui64.v = cpu_to_be64(ns->params.eui64);
4700 memcpy(pos, &eui64, sizeof(eui64));
4701 pos += sizeof(eui64);
4702 }
4703
4704 csi.hdr.nidt = NVME_NIDT_CSI;
4705 csi.hdr.nidl = NVME_NIDL_CSI;
4706 csi.v = ns->csi;
4707 memcpy(pos, &csi, sizeof(csi));
4708 pos += sizeof(csi);
4709
4710 return nvme_c2h(n, list, sizeof(list), req);
4711 }
4712
4713 static uint16_t nvme_identify_cmd_set(NvmeCtrl *n, NvmeRequest *req)
4714 {
4715 uint8_t list[NVME_IDENTIFY_DATA_SIZE] = {};
4716 static const int data_len = sizeof(list);
4717
4718 trace_pci_nvme_identify_cmd_set();
4719
4720 NVME_SET_CSI(*list, NVME_CSI_NVM);
4721 NVME_SET_CSI(*list, NVME_CSI_ZONED);
4722
4723 return nvme_c2h(n, list, data_len, req);
4724 }
4725
4726 static uint16_t nvme_identify(NvmeCtrl *n, NvmeRequest *req)
4727 {
4728 NvmeIdentify *c = (NvmeIdentify *)&req->cmd;
4729
4730 trace_pci_nvme_identify(nvme_cid(req), c->cns, le16_to_cpu(c->ctrlid),
4731 c->csi);
4732
4733 switch (c->cns) {
4734 case NVME_ID_CNS_NS:
4735 return nvme_identify_ns(n, req, true);
4736 case NVME_ID_CNS_NS_PRESENT:
4737 return nvme_identify_ns(n, req, false);
4738 case NVME_ID_CNS_NS_ATTACHED_CTRL_LIST:
4739 return nvme_identify_ctrl_list(n, req, true);
4740 case NVME_ID_CNS_CTRL_LIST:
4741 return nvme_identify_ctrl_list(n, req, false);
4742 case NVME_ID_CNS_CS_NS:
4743 return nvme_identify_ns_csi(n, req, true);
4744 case NVME_ID_CNS_CS_NS_PRESENT:
4745 return nvme_identify_ns_csi(n, req, false);
4746 case NVME_ID_CNS_CTRL:
4747 return nvme_identify_ctrl(n, req);
4748 case NVME_ID_CNS_CS_CTRL:
4749 return nvme_identify_ctrl_csi(n, req);
4750 case NVME_ID_CNS_NS_ACTIVE_LIST:
4751 return nvme_identify_nslist(n, req, true);
4752 case NVME_ID_CNS_NS_PRESENT_LIST:
4753 return nvme_identify_nslist(n, req, false);
4754 case NVME_ID_CNS_CS_NS_ACTIVE_LIST:
4755 return nvme_identify_nslist_csi(n, req, true);
4756 case NVME_ID_CNS_CS_NS_PRESENT_LIST:
4757 return nvme_identify_nslist_csi(n, req, false);
4758 case NVME_ID_CNS_NS_DESCR_LIST:
4759 return nvme_identify_ns_descr_list(n, req);
4760 case NVME_ID_CNS_IO_COMMAND_SET:
4761 return nvme_identify_cmd_set(n, req);
4762 default:
4763 trace_pci_nvme_err_invalid_identify_cns(le32_to_cpu(c->cns));
4764 return NVME_INVALID_FIELD | NVME_DNR;
4765 }
4766 }
4767
4768 static uint16_t nvme_abort(NvmeCtrl *n, NvmeRequest *req)
4769 {
4770 uint16_t sqid = le32_to_cpu(req->cmd.cdw10) & 0xffff;
4771
4772 req->cqe.result = 1;
4773 if (nvme_check_sqid(n, sqid)) {
4774 return NVME_INVALID_FIELD | NVME_DNR;
4775 }
4776
4777 return NVME_SUCCESS;
4778 }
4779
4780 static inline void nvme_set_timestamp(NvmeCtrl *n, uint64_t ts)
4781 {
4782 trace_pci_nvme_setfeat_timestamp(ts);
4783
4784 n->host_timestamp = le64_to_cpu(ts);
4785 n->timestamp_set_qemu_clock_ms = qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL);
4786 }
4787
4788 static inline uint64_t nvme_get_timestamp(const NvmeCtrl *n)
4789 {
4790 uint64_t current_time = qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL);
4791 uint64_t elapsed_time = current_time - n->timestamp_set_qemu_clock_ms;
4792
4793 union nvme_timestamp {
4794 struct {
4795 uint64_t timestamp:48;
4796 uint64_t sync:1;
4797 uint64_t origin:3;
4798 uint64_t rsvd1:12;
4799 };
4800 uint64_t all;
4801 };
4802
4803 union nvme_timestamp ts;
4804 ts.all = 0;
4805 ts.timestamp = n->host_timestamp + elapsed_time;
4806
4807 /* If the host timestamp is non-zero, set the timestamp origin */
4808 ts.origin = n->host_timestamp ? 0x01 : 0x00;
4809
4810 trace_pci_nvme_getfeat_timestamp(ts.all);
4811
4812 return cpu_to_le64(ts.all);
4813 }
4814
4815 static uint16_t nvme_get_feature_timestamp(NvmeCtrl *n, NvmeRequest *req)
4816 {
4817 uint64_t timestamp = nvme_get_timestamp(n);
4818
4819 return nvme_c2h(n, (uint8_t *)&timestamp, sizeof(timestamp), req);
4820 }
4821
4822 static uint16_t nvme_get_feature(NvmeCtrl *n, NvmeRequest *req)
4823 {
4824 NvmeCmd *cmd = &req->cmd;
4825 uint32_t dw10 = le32_to_cpu(cmd->cdw10);
4826 uint32_t dw11 = le32_to_cpu(cmd->cdw11);
4827 uint32_t nsid = le32_to_cpu(cmd->nsid);
4828 uint32_t result;
4829 uint8_t fid = NVME_GETSETFEAT_FID(dw10);
4830 NvmeGetFeatureSelect sel = NVME_GETFEAT_SELECT(dw10);
4831 uint16_t iv;
4832 NvmeNamespace *ns;
4833 int i;
4834
4835 static const uint32_t nvme_feature_default[NVME_FID_MAX] = {
4836 [NVME_ARBITRATION] = NVME_ARB_AB_NOLIMIT,
4837 };
4838
4839 trace_pci_nvme_getfeat(nvme_cid(req), nsid, fid, sel, dw11);
4840
4841 if (!nvme_feature_support[fid]) {
4842 return NVME_INVALID_FIELD | NVME_DNR;
4843 }
4844
4845 if (nvme_feature_cap[fid] & NVME_FEAT_CAP_NS) {
4846 if (!nvme_nsid_valid(n, nsid) || nsid == NVME_NSID_BROADCAST) {
4847 /*
4848 * The Reservation Notification Mask and Reservation Persistence
4849 * features require a status code of Invalid Field in Command when
4850 * NSID is FFFFFFFFh. Since the device does not support those
4851 * features we can always return Invalid Namespace or Format as we
4852 * should do for all other features.
4853 */
4854 return NVME_INVALID_NSID | NVME_DNR;
4855 }
4856
4857 if (!nvme_ns(n, nsid)) {
4858 return NVME_INVALID_FIELD | NVME_DNR;
4859 }
4860 }
4861
4862 switch (sel) {
4863 case NVME_GETFEAT_SELECT_CURRENT:
4864 break;
4865 case NVME_GETFEAT_SELECT_SAVED:
4866 /* no features are saveable by the controller; fallthrough */
4867 case NVME_GETFEAT_SELECT_DEFAULT:
4868 goto defaults;
4869 case NVME_GETFEAT_SELECT_CAP:
4870 result = nvme_feature_cap[fid];
4871 goto out;
4872 }
4873
4874 switch (fid) {
4875 case NVME_TEMPERATURE_THRESHOLD:
4876 result = 0;
4877
4878 /*
4879 * The controller only implements the Composite Temperature sensor, so
4880 * return 0 for all other sensors.
4881 */
4882 if (NVME_TEMP_TMPSEL(dw11) != NVME_TEMP_TMPSEL_COMPOSITE) {
4883 goto out;
4884 }
4885
4886 switch (NVME_TEMP_THSEL(dw11)) {
4887 case NVME_TEMP_THSEL_OVER:
4888 result = n->features.temp_thresh_hi;
4889 goto out;
4890 case NVME_TEMP_THSEL_UNDER:
4891 result = n->features.temp_thresh_low;
4892 goto out;
4893 }
4894
4895 return NVME_INVALID_FIELD | NVME_DNR;
4896 case NVME_ERROR_RECOVERY:
4897 if (!nvme_nsid_valid(n, nsid)) {
4898 return NVME_INVALID_NSID | NVME_DNR;
4899 }
4900
4901 ns = nvme_ns(n, nsid);
4902 if (unlikely(!ns)) {
4903 return NVME_INVALID_FIELD | NVME_DNR;
4904 }
4905
4906 result = ns->features.err_rec;
4907 goto out;
4908 case NVME_VOLATILE_WRITE_CACHE:
4909 result = 0;
4910 for (i = 1; i <= NVME_MAX_NAMESPACES; i++) {
4911 ns = nvme_ns(n, i);
4912 if (!ns) {
4913 continue;
4914 }
4915
4916 result = blk_enable_write_cache(ns->blkconf.blk);
4917 if (result) {
4918 break;
4919 }
4920 }
4921 trace_pci_nvme_getfeat_vwcache(result ? "enabled" : "disabled");
4922 goto out;
4923 case NVME_ASYNCHRONOUS_EVENT_CONF:
4924 result = n->features.async_config;
4925 goto out;
4926 case NVME_TIMESTAMP:
4927 return nvme_get_feature_timestamp(n, req);
4928 default:
4929 break;
4930 }
4931
4932 defaults:
4933 switch (fid) {
4934 case NVME_TEMPERATURE_THRESHOLD:
4935 result = 0;
4936
4937 if (NVME_TEMP_TMPSEL(dw11) != NVME_TEMP_TMPSEL_COMPOSITE) {
4938 break;
4939 }
4940
4941 if (NVME_TEMP_THSEL(dw11) == NVME_TEMP_THSEL_OVER) {
4942 result = NVME_TEMPERATURE_WARNING;
4943 }
4944
4945 break;
4946 case NVME_NUMBER_OF_QUEUES:
4947 result = (n->params.max_ioqpairs - 1) |
4948 ((n->params.max_ioqpairs - 1) << 16);
4949 trace_pci_nvme_getfeat_numq(result);
4950 break;
4951 case NVME_INTERRUPT_VECTOR_CONF:
4952 iv = dw11 & 0xffff;
4953 if (iv >= n->params.max_ioqpairs + 1) {
4954 return NVME_INVALID_FIELD | NVME_DNR;
4955 }
4956
4957 result = iv;
4958 if (iv == n->admin_cq.vector) {
4959 result |= NVME_INTVC_NOCOALESCING;
4960 }
4961 break;
4962 default:
4963 result = nvme_feature_default[fid];
4964 break;
4965 }
4966
4967 out:
4968 req->cqe.result = cpu_to_le32(result);
4969 return NVME_SUCCESS;
4970 }
4971
4972 static uint16_t nvme_set_feature_timestamp(NvmeCtrl *n, NvmeRequest *req)
4973 {
4974 uint16_t ret;
4975 uint64_t timestamp;
4976
4977 ret = nvme_h2c(n, (uint8_t *)&timestamp, sizeof(timestamp), req);
4978 if (ret) {
4979 return ret;
4980 }
4981
4982 nvme_set_timestamp(n, timestamp);
4983
4984 return NVME_SUCCESS;
4985 }
4986
4987 static uint16_t nvme_set_feature(NvmeCtrl *n, NvmeRequest *req)
4988 {
4989 NvmeNamespace *ns = NULL;
4990
4991 NvmeCmd *cmd = &req->cmd;
4992 uint32_t dw10 = le32_to_cpu(cmd->cdw10);
4993 uint32_t dw11 = le32_to_cpu(cmd->cdw11);
4994 uint32_t nsid = le32_to_cpu(cmd->nsid);
4995 uint8_t fid = NVME_GETSETFEAT_FID(dw10);
4996 uint8_t save = NVME_SETFEAT_SAVE(dw10);
4997 int i;
4998
4999 trace_pci_nvme_setfeat(nvme_cid(req), nsid, fid, save, dw11);
5000
5001 if (save && !(nvme_feature_cap[fid] & NVME_FEAT_CAP_SAVE)) {
5002 return NVME_FID_NOT_SAVEABLE | NVME_DNR;
5003 }
5004
5005 if (!nvme_feature_support[fid]) {
5006 return NVME_INVALID_FIELD | NVME_DNR;
5007 }
5008
5009 if (nvme_feature_cap[fid] & NVME_FEAT_CAP_NS) {
5010 if (nsid != NVME_NSID_BROADCAST) {
5011 if (!nvme_nsid_valid(n, nsid)) {
5012 return NVME_INVALID_NSID | NVME_DNR;
5013 }
5014
5015 ns = nvme_ns(n, nsid);
5016 if (unlikely(!ns)) {
5017 return NVME_INVALID_FIELD | NVME_DNR;
5018 }
5019 }
5020 } else if (nsid && nsid != NVME_NSID_BROADCAST) {
5021 if (!nvme_nsid_valid(n, nsid)) {
5022 return NVME_INVALID_NSID | NVME_DNR;
5023 }
5024
5025 return NVME_FEAT_NOT_NS_SPEC | NVME_DNR;
5026 }
5027
5028 if (!(nvme_feature_cap[fid] & NVME_FEAT_CAP_CHANGE)) {
5029 return NVME_FEAT_NOT_CHANGEABLE | NVME_DNR;
5030 }
5031
5032 switch (fid) {
5033 case NVME_TEMPERATURE_THRESHOLD:
5034 if (NVME_TEMP_TMPSEL(dw11) != NVME_TEMP_TMPSEL_COMPOSITE) {
5035 break;
5036 }
5037
5038 switch (NVME_TEMP_THSEL(dw11)) {
5039 case NVME_TEMP_THSEL_OVER:
5040 n->features.temp_thresh_hi = NVME_TEMP_TMPTH(dw11);
5041 break;
5042 case NVME_TEMP_THSEL_UNDER:
5043 n->features.temp_thresh_low = NVME_TEMP_TMPTH(dw11);
5044 break;
5045 default:
5046 return NVME_INVALID_FIELD | NVME_DNR;
5047 }
5048
5049 if ((n->temperature >= n->features.temp_thresh_hi) ||
5050 (n->temperature <= n->features.temp_thresh_low)) {
5051 nvme_smart_event(n, NVME_AER_INFO_SMART_TEMP_THRESH);
5052 }
5053
5054 break;
5055 case NVME_ERROR_RECOVERY:
5056 if (nsid == NVME_NSID_BROADCAST) {
5057 for (i = 1; i <= NVME_MAX_NAMESPACES; i++) {
5058 ns = nvme_ns(n, i);
5059
5060 if (!ns) {
5061 continue;
5062 }
5063
5064 if (NVME_ID_NS_NSFEAT_DULBE(ns->id_ns.nsfeat)) {
5065 ns->features.err_rec = dw11;
5066 }
5067 }
5068
5069 break;
5070 }
5071
5072 assert(ns);
5073 if (NVME_ID_NS_NSFEAT_DULBE(ns->id_ns.nsfeat)) {
5074 ns->features.err_rec = dw11;
5075 }
5076 break;
5077 case NVME_VOLATILE_WRITE_CACHE:
5078 for (i = 1; i <= NVME_MAX_NAMESPACES; i++) {
5079 ns = nvme_ns(n, i);
5080 if (!ns) {
5081 continue;
5082 }
5083
5084 if (!(dw11 & 0x1) && blk_enable_write_cache(ns->blkconf.blk)) {
5085 blk_flush(ns->blkconf.blk);
5086 }
5087
5088 blk_set_enable_write_cache(ns->blkconf.blk, dw11 & 1);
5089 }
5090
5091 break;
5092
5093 case NVME_NUMBER_OF_QUEUES:
5094 if (n->qs_created) {
5095 return NVME_CMD_SEQ_ERROR | NVME_DNR;
5096 }
5097
5098 /*
5099 * NVMe v1.3, Section 5.21.1.7: FFFFh is not an allowed value for NCQR
5100 * and NSQR.
5101 */
5102 if ((dw11 & 0xffff) == 0xffff || ((dw11 >> 16) & 0xffff) == 0xffff) {
5103 return NVME_INVALID_FIELD | NVME_DNR;
5104 }
5105
5106 trace_pci_nvme_setfeat_numq((dw11 & 0xffff) + 1,
5107 ((dw11 >> 16) & 0xffff) + 1,
5108 n->params.max_ioqpairs,
5109 n->params.max_ioqpairs);
5110 req->cqe.result = cpu_to_le32((n->params.max_ioqpairs - 1) |
5111 ((n->params.max_ioqpairs - 1) << 16));
5112 break;
5113 case NVME_ASYNCHRONOUS_EVENT_CONF:
5114 n->features.async_config = dw11;
5115 break;
5116 case NVME_TIMESTAMP:
5117 return nvme_set_feature_timestamp(n, req);
5118 case NVME_COMMAND_SET_PROFILE:
5119 if (dw11 & 0x1ff) {
5120 trace_pci_nvme_err_invalid_iocsci(dw11 & 0x1ff);
5121 return NVME_CMD_SET_CMB_REJECTED | NVME_DNR;
5122 }
5123 break;
5124 default:
5125 return NVME_FEAT_NOT_CHANGEABLE | NVME_DNR;
5126 }
5127 return NVME_SUCCESS;
5128 }
5129
5130 static uint16_t nvme_aer(NvmeCtrl *n, NvmeRequest *req)
5131 {
5132 trace_pci_nvme_aer(nvme_cid(req));
5133
5134 if (n->outstanding_aers > n->params.aerl) {
5135 trace_pci_nvme_aer_aerl_exceeded();
5136 return NVME_AER_LIMIT_EXCEEDED;
5137 }
5138
5139 n->aer_reqs[n->outstanding_aers] = req;
5140 n->outstanding_aers++;
5141
5142 if (!QTAILQ_EMPTY(&n->aer_queue)) {
5143 nvme_process_aers(n);
5144 }
5145
5146 return NVME_NO_COMPLETE;
5147 }
5148
5149 static void nvme_update_dmrsl(NvmeCtrl *n)
5150 {
5151 int nsid;
5152
5153 for (nsid = 1; nsid <= NVME_MAX_NAMESPACES; nsid++) {
5154 NvmeNamespace *ns = nvme_ns(n, nsid);
5155 if (!ns) {
5156 continue;
5157 }
5158
5159 n->dmrsl = MIN_NON_ZERO(n->dmrsl,
5160 BDRV_REQUEST_MAX_BYTES / nvme_l2b(ns, 1));
5161 }
5162 }
5163
5164 static void nvme_select_iocs_ns(NvmeCtrl *n, NvmeNamespace *ns)
5165 {
5166 ns->iocs = nvme_cse_iocs_none;
5167 switch (ns->csi) {
5168 case NVME_CSI_NVM:
5169 if (NVME_CC_CSS(n->bar.cc) != NVME_CC_CSS_ADMIN_ONLY) {
5170 ns->iocs = nvme_cse_iocs_nvm;
5171 }
5172 break;
5173 case NVME_CSI_ZONED:
5174 if (NVME_CC_CSS(n->bar.cc) == NVME_CC_CSS_CSI) {
5175 ns->iocs = nvme_cse_iocs_zoned;
5176 } else if (NVME_CC_CSS(n->bar.cc) == NVME_CC_CSS_NVM) {
5177 ns->iocs = nvme_cse_iocs_nvm;
5178 }
5179 break;
5180 }
5181 }
5182
5183 static uint16_t nvme_ns_attachment(NvmeCtrl *n, NvmeRequest *req)
5184 {
5185 NvmeNamespace *ns;
5186 NvmeCtrl *ctrl;
5187 uint16_t list[NVME_CONTROLLER_LIST_SIZE] = {};
5188 uint32_t nsid = le32_to_cpu(req->cmd.nsid);
5189 uint32_t dw10 = le32_to_cpu(req->cmd.cdw10);
5190 bool attach = !(dw10 & 0xf);
5191 uint16_t *nr_ids = &list[0];
5192 uint16_t *ids = &list[1];
5193 uint16_t ret;
5194 int i;
5195
5196 trace_pci_nvme_ns_attachment(nvme_cid(req), dw10 & 0xf);
5197
5198 if (!nvme_nsid_valid(n, nsid)) {
5199 return NVME_INVALID_NSID | NVME_DNR;
5200 }
5201
5202 ns = nvme_subsys_ns(n->subsys, nsid);
5203 if (!ns) {
5204 return NVME_INVALID_FIELD | NVME_DNR;
5205 }
5206
5207 ret = nvme_h2c(n, (uint8_t *)list, 4096, req);
5208 if (ret) {
5209 return ret;
5210 }
5211
5212 if (!*nr_ids) {
5213 return NVME_NS_CTRL_LIST_INVALID | NVME_DNR;
5214 }
5215
5216 *nr_ids = MIN(*nr_ids, NVME_CONTROLLER_LIST_SIZE - 1);
5217 for (i = 0; i < *nr_ids; i++) {
5218 ctrl = nvme_subsys_ctrl(n->subsys, ids[i]);
5219 if (!ctrl) {
5220 return NVME_NS_CTRL_LIST_INVALID | NVME_DNR;
5221 }
5222
5223 if (attach) {
5224 if (nvme_ns(ctrl, nsid)) {
5225 return NVME_NS_ALREADY_ATTACHED | NVME_DNR;
5226 }
5227
5228 if (ns->attached && !ns->params.shared) {
5229 return NVME_NS_PRIVATE | NVME_DNR;
5230 }
5231
5232 nvme_attach_ns(ctrl, ns);
5233 nvme_select_iocs_ns(ctrl, ns);
5234 } else {
5235 if (!nvme_ns(ctrl, nsid)) {
5236 return NVME_NS_NOT_ATTACHED | NVME_DNR;
5237 }
5238
5239 ctrl->namespaces[nsid] = NULL;
5240 ns->attached--;
5241
5242 nvme_update_dmrsl(ctrl);
5243 }
5244
5245 /*
5246 * Add namespace id to the changed namespace id list for event clearing
5247 * via Get Log Page command.
5248 */
5249 if (!test_and_set_bit(nsid, ctrl->changed_nsids)) {
5250 nvme_enqueue_event(ctrl, NVME_AER_TYPE_NOTICE,
5251 NVME_AER_INFO_NOTICE_NS_ATTR_CHANGED,
5252 NVME_LOG_CHANGED_NSLIST);
5253 }
5254 }
5255
5256 return NVME_SUCCESS;
5257 }
5258
5259 typedef struct NvmeFormatAIOCB {
5260 BlockAIOCB common;
5261 BlockAIOCB *aiocb;
5262 QEMUBH *bh;
5263 NvmeRequest *req;
5264 int ret;
5265
5266 NvmeNamespace *ns;
5267 uint32_t nsid;
5268 bool broadcast;
5269 int64_t offset;
5270 } NvmeFormatAIOCB;
5271
5272 static void nvme_format_bh(void *opaque);
5273
5274 static void nvme_format_cancel(BlockAIOCB *aiocb)
5275 {
5276 NvmeFormatAIOCB *iocb = container_of(aiocb, NvmeFormatAIOCB, common);
5277
5278 if (iocb->aiocb) {
5279 blk_aio_cancel_async(iocb->aiocb);
5280 }
5281 }
5282
5283 static const AIOCBInfo nvme_format_aiocb_info = {
5284 .aiocb_size = sizeof(NvmeFormatAIOCB),
5285 .cancel_async = nvme_format_cancel,
5286 .get_aio_context = nvme_get_aio_context,
5287 };
5288
5289 static void nvme_format_set(NvmeNamespace *ns, NvmeCmd *cmd)
5290 {
5291 uint32_t dw10 = le32_to_cpu(cmd->cdw10);
5292 uint8_t lbaf = dw10 & 0xf;
5293 uint8_t pi = (dw10 >> 5) & 0x7;
5294 uint8_t mset = (dw10 >> 4) & 0x1;
5295 uint8_t pil = (dw10 >> 8) & 0x1;
5296
5297 trace_pci_nvme_format_set(ns->params.nsid, lbaf, mset, pi, pil);
5298
5299 ns->id_ns.dps = (pil << 3) | pi;
5300 ns->id_ns.flbas = lbaf | (mset << 4);
5301
5302 nvme_ns_init_format(ns);
5303 }
5304
5305 static void nvme_format_ns_cb(void *opaque, int ret)
5306 {
5307 NvmeFormatAIOCB *iocb = opaque;
5308 NvmeRequest *req = iocb->req;
5309 NvmeNamespace *ns = iocb->ns;
5310 int bytes;
5311
5312 if (ret < 0) {
5313 iocb->ret = ret;
5314 goto done;
5315 }
5316
5317 assert(ns);
5318
5319 if (iocb->offset < ns->size) {
5320 bytes = MIN(BDRV_REQUEST_MAX_BYTES, ns->size - iocb->offset);
5321
5322 iocb->aiocb = blk_aio_pwrite_zeroes(ns->blkconf.blk, iocb->offset,
5323 bytes, BDRV_REQ_MAY_UNMAP,
5324 nvme_format_ns_cb, iocb);
5325
5326 iocb->offset += bytes;
5327 return;
5328 }
5329
5330 nvme_format_set(ns, &req->cmd);
5331 ns->status = 0x0;
5332 iocb->ns = NULL;
5333 iocb->offset = 0;
5334
5335 done:
5336 iocb->aiocb = NULL;
5337 qemu_bh_schedule(iocb->bh);
5338 }
5339
5340 static uint16_t nvme_format_check(NvmeNamespace *ns, uint8_t lbaf, uint8_t pi)
5341 {
5342 if (ns->params.zoned) {
5343 return NVME_INVALID_FORMAT | NVME_DNR;
5344 }
5345
5346 if (lbaf > ns->id_ns.nlbaf) {
5347 return NVME_INVALID_FORMAT | NVME_DNR;
5348 }
5349
5350 if (pi && (ns->id_ns.lbaf[lbaf].ms < sizeof(NvmeDifTuple))) {
5351 return NVME_INVALID_FORMAT | NVME_DNR;
5352 }
5353
5354 if (pi && pi > NVME_ID_NS_DPS_TYPE_3) {
5355 return NVME_INVALID_FIELD | NVME_DNR;
5356 }
5357
5358 return NVME_SUCCESS;
5359 }
5360
5361 static void nvme_format_bh(void *opaque)
5362 {
5363 NvmeFormatAIOCB *iocb = opaque;
5364 NvmeRequest *req = iocb->req;
5365 NvmeCtrl *n = nvme_ctrl(req);
5366 uint32_t dw10 = le32_to_cpu(req->cmd.cdw10);
5367 uint8_t lbaf = dw10 & 0xf;
5368 uint8_t pi = (dw10 >> 5) & 0x7;
5369 uint16_t status;
5370 int i;
5371
5372 if (iocb->ret < 0) {
5373 goto done;
5374 }
5375
5376 if (iocb->broadcast) {
5377 for (i = iocb->nsid + 1; i <= NVME_MAX_NAMESPACES; i++) {
5378 iocb->ns = nvme_ns(n, i);
5379 if (iocb->ns) {
5380 iocb->nsid = i;
5381 break;
5382 }
5383 }
5384 }
5385
5386 if (!iocb->ns) {
5387 goto done;
5388 }
5389
5390 status = nvme_format_check(iocb->ns, lbaf, pi);
5391 if (status) {
5392 req->status = status;
5393 goto done;
5394 }
5395
5396 iocb->ns->status = NVME_FORMAT_IN_PROGRESS;
5397 nvme_format_ns_cb(iocb, 0);
5398 return;
5399
5400 done:
5401 qemu_bh_delete(iocb->bh);
5402 iocb->bh = NULL;
5403
5404 iocb->common.cb(iocb->common.opaque, iocb->ret);
5405
5406 qemu_aio_unref(iocb);
5407 }
5408
5409 static uint16_t nvme_format(NvmeCtrl *n, NvmeRequest *req)
5410 {
5411 NvmeFormatAIOCB *iocb;
5412 uint32_t nsid = le32_to_cpu(req->cmd.nsid);
5413 uint16_t status;
5414
5415 iocb = qemu_aio_get(&nvme_format_aiocb_info, NULL, nvme_misc_cb, req);
5416
5417 iocb->req = req;
5418 iocb->bh = qemu_bh_new(nvme_format_bh, iocb);
5419 iocb->ret = 0;
5420 iocb->ns = NULL;
5421 iocb->nsid = 0;
5422 iocb->broadcast = (nsid == NVME_NSID_BROADCAST);
5423 iocb->offset = 0;
5424
5425 if (!iocb->broadcast) {
5426 if (!nvme_nsid_valid(n, nsid)) {
5427 status = NVME_INVALID_NSID | NVME_DNR;
5428 goto out;
5429 }
5430
5431 iocb->ns = nvme_ns(n, nsid);
5432 if (!iocb->ns) {
5433 status = NVME_INVALID_FIELD | NVME_DNR;
5434 goto out;
5435 }
5436 }
5437
5438 req->aiocb = &iocb->common;
5439 qemu_bh_schedule(iocb->bh);
5440
5441 return NVME_NO_COMPLETE;
5442
5443 out:
5444 qemu_bh_delete(iocb->bh);
5445 iocb->bh = NULL;
5446 qemu_aio_unref(iocb);
5447 return status;
5448 }
5449
5450 static uint16_t nvme_admin_cmd(NvmeCtrl *n, NvmeRequest *req)
5451 {
5452 trace_pci_nvme_admin_cmd(nvme_cid(req), nvme_sqid(req), req->cmd.opcode,
5453 nvme_adm_opc_str(req->cmd.opcode));
5454
5455 if (!(nvme_cse_acs[req->cmd.opcode] & NVME_CMD_EFF_CSUPP)) {
5456 trace_pci_nvme_err_invalid_admin_opc(req->cmd.opcode);
5457 return NVME_INVALID_OPCODE | NVME_DNR;
5458 }
5459
5460 /* SGLs shall not be used for Admin commands in NVMe over PCIe */
5461 if (NVME_CMD_FLAGS_PSDT(req->cmd.flags) != NVME_PSDT_PRP) {
5462 return NVME_INVALID_FIELD | NVME_DNR;
5463 }
5464
5465 switch (req->cmd.opcode) {
5466 case NVME_ADM_CMD_DELETE_SQ:
5467 return nvme_del_sq(n, req);
5468 case NVME_ADM_CMD_CREATE_SQ:
5469 return nvme_create_sq(n, req);
5470 case NVME_ADM_CMD_GET_LOG_PAGE:
5471 return nvme_get_log(n, req);
5472 case NVME_ADM_CMD_DELETE_CQ:
5473 return nvme_del_cq(n, req);
5474 case NVME_ADM_CMD_CREATE_CQ:
5475 return nvme_create_cq(n, req);
5476 case NVME_ADM_CMD_IDENTIFY:
5477 return nvme_identify(n, req);
5478 case NVME_ADM_CMD_ABORT:
5479 return nvme_abort(n, req);
5480 case NVME_ADM_CMD_SET_FEATURES:
5481 return nvme_set_feature(n, req);
5482 case NVME_ADM_CMD_GET_FEATURES:
5483 return nvme_get_feature(n, req);
5484 case NVME_ADM_CMD_ASYNC_EV_REQ:
5485 return nvme_aer(n, req);
5486 case NVME_ADM_CMD_NS_ATTACHMENT:
5487 return nvme_ns_attachment(n, req);
5488 case NVME_ADM_CMD_FORMAT_NVM:
5489 return nvme_format(n, req);
5490 default:
5491 assert(false);
5492 }
5493
5494 return NVME_INVALID_OPCODE | NVME_DNR;
5495 }
5496
5497 static void nvme_process_sq(void *opaque)
5498 {
5499 NvmeSQueue *sq = opaque;
5500 NvmeCtrl *n = sq->ctrl;
5501 NvmeCQueue *cq = n->cq[sq->cqid];
5502
5503 uint16_t status;
5504 hwaddr addr;
5505 NvmeCmd cmd;
5506 NvmeRequest *req;
5507
5508 while (!(nvme_sq_empty(sq) || QTAILQ_EMPTY(&sq->req_list))) {
5509 addr = sq->dma_addr + sq->head * n->sqe_size;
5510 if (nvme_addr_read(n, addr, (void *)&cmd, sizeof(cmd))) {
5511 trace_pci_nvme_err_addr_read(addr);
5512 trace_pci_nvme_err_cfs();
5513 n->bar.csts = NVME_CSTS_FAILED;
5514 break;
5515 }
5516 nvme_inc_sq_head(sq);
5517
5518 req = QTAILQ_FIRST(&sq->req_list);
5519 QTAILQ_REMOVE(&sq->req_list, req, entry);
5520 QTAILQ_INSERT_TAIL(&sq->out_req_list, req, entry);
5521 nvme_req_clear(req);
5522 req->cqe.cid = cmd.cid;
5523 memcpy(&req->cmd, &cmd, sizeof(NvmeCmd));
5524
5525 status = sq->sqid ? nvme_io_cmd(n, req) :
5526 nvme_admin_cmd(n, req);
5527 if (status != NVME_NO_COMPLETE) {
5528 req->status = status;
5529 nvme_enqueue_req_completion(cq, req);
5530 }
5531 }
5532 }
5533
5534 static void nvme_ctrl_reset(NvmeCtrl *n)
5535 {
5536 NvmeNamespace *ns;
5537 int i;
5538
5539 for (i = 1; i <= NVME_MAX_NAMESPACES; i++) {
5540 ns = nvme_ns(n, i);
5541 if (!ns) {
5542 continue;
5543 }
5544
5545 nvme_ns_drain(ns);
5546 }
5547
5548 for (i = 0; i < n->params.max_ioqpairs + 1; i++) {
5549 if (n->sq[i] != NULL) {
5550 nvme_free_sq(n->sq[i], n);
5551 }
5552 }
5553 for (i = 0; i < n->params.max_ioqpairs + 1; i++) {
5554 if (n->cq[i] != NULL) {
5555 nvme_free_cq(n->cq[i], n);
5556 }
5557 }
5558
5559 while (!QTAILQ_EMPTY(&n->aer_queue)) {
5560 NvmeAsyncEvent *event = QTAILQ_FIRST(&n->aer_queue);
5561 QTAILQ_REMOVE(&n->aer_queue, event, entry);
5562 g_free(event);
5563 }
5564
5565 n->aer_queued = 0;
5566 n->outstanding_aers = 0;
5567 n->qs_created = false;
5568
5569 n->bar.cc = 0;
5570 }
5571
5572 static void nvme_ctrl_shutdown(NvmeCtrl *n)
5573 {
5574 NvmeNamespace *ns;
5575 int i;
5576
5577 if (n->pmr.dev) {
5578 memory_region_msync(&n->pmr.dev->mr, 0, n->pmr.dev->size);
5579 }
5580
5581 for (i = 1; i <= NVME_MAX_NAMESPACES; i++) {
5582 ns = nvme_ns(n, i);
5583 if (!ns) {
5584 continue;
5585 }
5586
5587 nvme_ns_shutdown(ns);
5588 }
5589 }
5590
5591 static void nvme_select_iocs(NvmeCtrl *n)
5592 {
5593 NvmeNamespace *ns;
5594 int i;
5595
5596 for (i = 1; i <= NVME_MAX_NAMESPACES; i++) {
5597 ns = nvme_ns(n, i);
5598 if (!ns) {
5599 continue;
5600 }
5601
5602 nvme_select_iocs_ns(n, ns);
5603 }
5604 }
5605
5606 static int nvme_start_ctrl(NvmeCtrl *n)
5607 {
5608 uint32_t page_bits = NVME_CC_MPS(n->bar.cc) + 12;
5609 uint32_t page_size = 1 << page_bits;
5610
5611 if (unlikely(n->cq[0])) {
5612 trace_pci_nvme_err_startfail_cq();
5613 return -1;
5614 }
5615 if (unlikely(n->sq[0])) {
5616 trace_pci_nvme_err_startfail_sq();
5617 return -1;
5618 }
5619 if (unlikely(!n->bar.asq)) {
5620 trace_pci_nvme_err_startfail_nbarasq();
5621 return -1;
5622 }
5623 if (unlikely(!n->bar.acq)) {
5624 trace_pci_nvme_err_startfail_nbaracq();
5625 return -1;
5626 }
5627 if (unlikely(n->bar.asq & (page_size - 1))) {
5628 trace_pci_nvme_err_startfail_asq_misaligned(n->bar.asq);
5629 return -1;
5630 }
5631 if (unlikely(n->bar.acq & (page_size - 1))) {
5632 trace_pci_nvme_err_startfail_acq_misaligned(n->bar.acq);
5633 return -1;
5634 }
5635 if (unlikely(!(NVME_CAP_CSS(n->bar.cap) & (1 << NVME_CC_CSS(n->bar.cc))))) {
5636 trace_pci_nvme_err_startfail_css(NVME_CC_CSS(n->bar.cc));
5637 return -1;
5638 }
5639 if (unlikely(NVME_CC_MPS(n->bar.cc) <
5640 NVME_CAP_MPSMIN(n->bar.cap))) {
5641 trace_pci_nvme_err_startfail_page_too_small(
5642 NVME_CC_MPS(n->bar.cc),
5643 NVME_CAP_MPSMIN(n->bar.cap));
5644 return -1;
5645 }
5646 if (unlikely(NVME_CC_MPS(n->bar.cc) >
5647 NVME_CAP_MPSMAX(n->bar.cap))) {
5648 trace_pci_nvme_err_startfail_page_too_large(
5649 NVME_CC_MPS(n->bar.cc),
5650 NVME_CAP_MPSMAX(n->bar.cap));
5651 return -1;
5652 }
5653 if (unlikely(NVME_CC_IOCQES(n->bar.cc) <
5654 NVME_CTRL_CQES_MIN(n->id_ctrl.cqes))) {
5655 trace_pci_nvme_err_startfail_cqent_too_small(
5656 NVME_CC_IOCQES(n->bar.cc),
5657 NVME_CTRL_CQES_MIN(n->bar.cap));
5658 return -1;
5659 }
5660 if (unlikely(NVME_CC_IOCQES(n->bar.cc) >
5661 NVME_CTRL_CQES_MAX(n->id_ctrl.cqes))) {
5662 trace_pci_nvme_err_startfail_cqent_too_large(
5663 NVME_CC_IOCQES(n->bar.cc),
5664 NVME_CTRL_CQES_MAX(n->bar.cap));
5665 return -1;
5666 }
5667 if (unlikely(NVME_CC_IOSQES(n->bar.cc) <
5668 NVME_CTRL_SQES_MIN(n->id_ctrl.sqes))) {
5669 trace_pci_nvme_err_startfail_sqent_too_small(
5670 NVME_CC_IOSQES(n->bar.cc),
5671 NVME_CTRL_SQES_MIN(n->bar.cap));
5672 return -1;
5673 }
5674 if (unlikely(NVME_CC_IOSQES(n->bar.cc) >
5675 NVME_CTRL_SQES_MAX(n->id_ctrl.sqes))) {
5676 trace_pci_nvme_err_startfail_sqent_too_large(
5677 NVME_CC_IOSQES(n->bar.cc),
5678 NVME_CTRL_SQES_MAX(n->bar.cap));
5679 return -1;
5680 }
5681 if (unlikely(!NVME_AQA_ASQS(n->bar.aqa))) {
5682 trace_pci_nvme_err_startfail_asqent_sz_zero();
5683 return -1;
5684 }
5685 if (unlikely(!NVME_AQA_ACQS(n->bar.aqa))) {
5686 trace_pci_nvme_err_startfail_acqent_sz_zero();
5687 return -1;
5688 }
5689
5690 n->page_bits = page_bits;
5691 n->page_size = page_size;
5692 n->max_prp_ents = n->page_size / sizeof(uint64_t);
5693 n->cqe_size = 1 << NVME_CC_IOCQES(n->bar.cc);
5694 n->sqe_size = 1 << NVME_CC_IOSQES(n->bar.cc);
5695 nvme_init_cq(&n->admin_cq, n, n->bar.acq, 0, 0,
5696 NVME_AQA_ACQS(n->bar.aqa) + 1, 1);
5697 nvme_init_sq(&n->admin_sq, n, n->bar.asq, 0, 0,
5698 NVME_AQA_ASQS(n->bar.aqa) + 1);
5699
5700 nvme_set_timestamp(n, 0ULL);
5701
5702 QTAILQ_INIT(&n->aer_queue);
5703
5704 nvme_select_iocs(n);
5705
5706 return 0;
5707 }
5708
5709 static void nvme_cmb_enable_regs(NvmeCtrl *n)
5710 {
5711 NVME_CMBLOC_SET_CDPCILS(n->bar.cmbloc, 1);
5712 NVME_CMBLOC_SET_CDPMLS(n->bar.cmbloc, 1);
5713 NVME_CMBLOC_SET_BIR(n->bar.cmbloc, NVME_CMB_BIR);
5714
5715 NVME_CMBSZ_SET_SQS(n->bar.cmbsz, 1);
5716 NVME_CMBSZ_SET_CQS(n->bar.cmbsz, 0);
5717 NVME_CMBSZ_SET_LISTS(n->bar.cmbsz, 1);
5718 NVME_CMBSZ_SET_RDS(n->bar.cmbsz, 1);
5719 NVME_CMBSZ_SET_WDS(n->bar.cmbsz, 1);
5720 NVME_CMBSZ_SET_SZU(n->bar.cmbsz, 2); /* MBs */
5721 NVME_CMBSZ_SET_SZ(n->bar.cmbsz, n->params.cmb_size_mb);
5722 }
5723
5724 static void nvme_write_bar(NvmeCtrl *n, hwaddr offset, uint64_t data,
5725 unsigned size)
5726 {
5727 if (unlikely(offset & (sizeof(uint32_t) - 1))) {
5728 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_misaligned32,
5729 "MMIO write not 32-bit aligned,"
5730 " offset=0x%"PRIx64"", offset);
5731 /* should be ignored, fall through for now */
5732 }
5733
5734 if (unlikely(size < sizeof(uint32_t))) {
5735 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_toosmall,
5736 "MMIO write smaller than 32-bits,"
5737 " offset=0x%"PRIx64", size=%u",
5738 offset, size);
5739 /* should be ignored, fall through for now */
5740 }
5741
5742 switch (offset) {
5743 case 0xc: /* INTMS */
5744 if (unlikely(msix_enabled(&(n->parent_obj)))) {
5745 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_intmask_with_msix,
5746 "undefined access to interrupt mask set"
5747 " when MSI-X is enabled");
5748 /* should be ignored, fall through for now */
5749 }
5750 n->bar.intms |= data & 0xffffffff;
5751 n->bar.intmc = n->bar.intms;
5752 trace_pci_nvme_mmio_intm_set(data & 0xffffffff, n->bar.intmc);
5753 nvme_irq_check(n);
5754 break;
5755 case 0x10: /* INTMC */
5756 if (unlikely(msix_enabled(&(n->parent_obj)))) {
5757 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_intmask_with_msix,
5758 "undefined access to interrupt mask clr"
5759 " when MSI-X is enabled");
5760 /* should be ignored, fall through for now */
5761 }
5762 n->bar.intms &= ~(data & 0xffffffff);
5763 n->bar.intmc = n->bar.intms;
5764 trace_pci_nvme_mmio_intm_clr(data & 0xffffffff, n->bar.intmc);
5765 nvme_irq_check(n);
5766 break;
5767 case 0x14: /* CC */
5768 trace_pci_nvme_mmio_cfg(data & 0xffffffff);
5769 /* Windows first sends data, then sends enable bit */
5770 if (!NVME_CC_EN(data) && !NVME_CC_EN(n->bar.cc) &&
5771 !NVME_CC_SHN(data) && !NVME_CC_SHN(n->bar.cc))
5772 {
5773 n->bar.cc = data;
5774 }
5775
5776 if (NVME_CC_EN(data) && !NVME_CC_EN(n->bar.cc)) {
5777 n->bar.cc = data;
5778 if (unlikely(nvme_start_ctrl(n))) {
5779 trace_pci_nvme_err_startfail();
5780 n->bar.csts = NVME_CSTS_FAILED;
5781 } else {
5782 trace_pci_nvme_mmio_start_success();
5783 n->bar.csts = NVME_CSTS_READY;
5784 }
5785 } else if (!NVME_CC_EN(data) && NVME_CC_EN(n->bar.cc)) {
5786 trace_pci_nvme_mmio_stopped();
5787 nvme_ctrl_reset(n);
5788 n->bar.csts &= ~NVME_CSTS_READY;
5789 }
5790 if (NVME_CC_SHN(data) && !(NVME_CC_SHN(n->bar.cc))) {
5791 trace_pci_nvme_mmio_shutdown_set();
5792 nvme_ctrl_shutdown(n);
5793 n->bar.cc = data;
5794 n->bar.csts |= NVME_CSTS_SHST_COMPLETE;
5795 } else if (!NVME_CC_SHN(data) && NVME_CC_SHN(n->bar.cc)) {
5796 trace_pci_nvme_mmio_shutdown_cleared();
5797 n->bar.csts &= ~NVME_CSTS_SHST_COMPLETE;
5798 n->bar.cc = data;
5799 }
5800 break;
5801 case 0x1c: /* CSTS */
5802 if (data & (1 << 4)) {
5803 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_ssreset_w1c_unsupported,
5804 "attempted to W1C CSTS.NSSRO"
5805 " but CAP.NSSRS is zero (not supported)");
5806 } else if (data != 0) {
5807 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_ro_csts,
5808 "attempted to set a read only bit"
5809 " of controller status");
5810 }
5811 break;
5812 case 0x20: /* NSSR */
5813 if (data == 0x4e564d65) {
5814 trace_pci_nvme_ub_mmiowr_ssreset_unsupported();
5815 } else {
5816 /* The spec says that writes of other values have no effect */
5817 return;
5818 }
5819 break;
5820 case 0x24: /* AQA */
5821 n->bar.aqa = data & 0xffffffff;
5822 trace_pci_nvme_mmio_aqattr(data & 0xffffffff);
5823 break;
5824 case 0x28: /* ASQ */
5825 n->bar.asq = size == 8 ? data :
5826 (n->bar.asq & ~0xffffffffULL) | (data & 0xffffffff);
5827 trace_pci_nvme_mmio_asqaddr(data);
5828 break;
5829 case 0x2c: /* ASQ hi */
5830 n->bar.asq = (n->bar.asq & 0xffffffff) | (data << 32);
5831 trace_pci_nvme_mmio_asqaddr_hi(data, n->bar.asq);
5832 break;
5833 case 0x30: /* ACQ */
5834 trace_pci_nvme_mmio_acqaddr(data);
5835 n->bar.acq = size == 8 ? data :
5836 (n->bar.acq & ~0xffffffffULL) | (data & 0xffffffff);
5837 break;
5838 case 0x34: /* ACQ hi */
5839 n->bar.acq = (n->bar.acq & 0xffffffff) | (data << 32);
5840 trace_pci_nvme_mmio_acqaddr_hi(data, n->bar.acq);
5841 break;
5842 case 0x38: /* CMBLOC */
5843 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_cmbloc_reserved,
5844 "invalid write to reserved CMBLOC"
5845 " when CMBSZ is zero, ignored");
5846 return;
5847 case 0x3C: /* CMBSZ */
5848 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_cmbsz_readonly,
5849 "invalid write to read only CMBSZ, ignored");
5850 return;
5851 case 0x50: /* CMBMSC */
5852 if (!NVME_CAP_CMBS(n->bar.cap)) {
5853 return;
5854 }
5855
5856 n->bar.cmbmsc = size == 8 ? data :
5857 (n->bar.cmbmsc & ~0xffffffff) | (data & 0xffffffff);
5858 n->cmb.cmse = false;
5859
5860 if (NVME_CMBMSC_CRE(data)) {
5861 nvme_cmb_enable_regs(n);
5862
5863 if (NVME_CMBMSC_CMSE(data)) {
5864 hwaddr cba = NVME_CMBMSC_CBA(data) << CMBMSC_CBA_SHIFT;
5865 if (cba + int128_get64(n->cmb.mem.size) < cba) {
5866 NVME_CMBSTS_SET_CBAI(n->bar.cmbsts, 1);
5867 return;
5868 }
5869
5870 n->cmb.cba = cba;
5871 n->cmb.cmse = true;
5872 }
5873 } else {
5874 n->bar.cmbsz = 0;
5875 n->bar.cmbloc = 0;
5876 }
5877
5878 return;
5879 case 0x54: /* CMBMSC hi */
5880 n->bar.cmbmsc = (n->bar.cmbmsc & 0xffffffff) | (data << 32);
5881 return;
5882
5883 case 0xe00: /* PMRCAP */
5884 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_pmrcap_readonly,
5885 "invalid write to PMRCAP register, ignored");
5886 return;
5887 case 0xe04: /* PMRCTL */
5888 if (!NVME_CAP_PMRS(n->bar.cap)) {
5889 return;
5890 }
5891
5892 n->bar.pmrctl = data;
5893 if (NVME_PMRCTL_EN(data)) {
5894 memory_region_set_enabled(&n->pmr.dev->mr, true);
5895 n->bar.pmrsts = 0;
5896 } else {
5897 memory_region_set_enabled(&n->pmr.dev->mr, false);
5898 NVME_PMRSTS_SET_NRDY(n->bar.pmrsts, 1);
5899 n->pmr.cmse = false;
5900 }
5901 return;
5902 case 0xe08: /* PMRSTS */
5903 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_pmrsts_readonly,
5904 "invalid write to PMRSTS register, ignored");
5905 return;
5906 case 0xe0C: /* PMREBS */
5907 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_pmrebs_readonly,
5908 "invalid write to PMREBS register, ignored");
5909 return;
5910 case 0xe10: /* PMRSWTP */
5911 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_pmrswtp_readonly,
5912 "invalid write to PMRSWTP register, ignored");
5913 return;
5914 case 0xe14: /* PMRMSCL */
5915 if (!NVME_CAP_PMRS(n->bar.cap)) {
5916 return;
5917 }
5918
5919 n->bar.pmrmsc = (n->bar.pmrmsc & ~0xffffffff) | (data & 0xffffffff);
5920 n->pmr.cmse = false;
5921
5922 if (NVME_PMRMSC_CMSE(n->bar.pmrmsc)) {
5923 hwaddr cba = NVME_PMRMSC_CBA(n->bar.pmrmsc) << PMRMSC_CBA_SHIFT;
5924 if (cba + int128_get64(n->pmr.dev->mr.size) < cba) {
5925 NVME_PMRSTS_SET_CBAI(n->bar.pmrsts, 1);
5926 return;
5927 }
5928
5929 n->pmr.cmse = true;
5930 n->pmr.cba = cba;
5931 }
5932
5933 return;
5934 case 0xe18: /* PMRMSCU */
5935 if (!NVME_CAP_PMRS(n->bar.cap)) {
5936 return;
5937 }
5938
5939 n->bar.pmrmsc = (n->bar.pmrmsc & 0xffffffff) | (data << 32);
5940 return;
5941 default:
5942 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_invalid,
5943 "invalid MMIO write,"
5944 " offset=0x%"PRIx64", data=%"PRIx64"",
5945 offset, data);
5946 break;
5947 }
5948 }
5949
5950 static uint64_t nvme_mmio_read(void *opaque, hwaddr addr, unsigned size)
5951 {
5952 NvmeCtrl *n = (NvmeCtrl *)opaque;
5953 uint8_t *ptr = (uint8_t *)&n->bar;
5954 uint64_t val = 0;
5955
5956 trace_pci_nvme_mmio_read(addr, size);
5957
5958 if (unlikely(addr & (sizeof(uint32_t) - 1))) {
5959 NVME_GUEST_ERR(pci_nvme_ub_mmiord_misaligned32,
5960 "MMIO read not 32-bit aligned,"
5961 " offset=0x%"PRIx64"", addr);
5962 /* should RAZ, fall through for now */
5963 } else if (unlikely(size < sizeof(uint32_t))) {
5964 NVME_GUEST_ERR(pci_nvme_ub_mmiord_toosmall,
5965 "MMIO read smaller than 32-bits,"
5966 " offset=0x%"PRIx64"", addr);
5967 /* should RAZ, fall through for now */
5968 }
5969
5970 if (addr < sizeof(n->bar)) {
5971 /*
5972 * When PMRWBM bit 1 is set then read from
5973 * from PMRSTS should ensure prior writes
5974 * made it to persistent media
5975 */
5976 if (addr == 0xe08 &&
5977 (NVME_PMRCAP_PMRWBM(n->bar.pmrcap) & 0x02)) {
5978 memory_region_msync(&n->pmr.dev->mr, 0, n->pmr.dev->size);
5979 }
5980 memcpy(&val, ptr + addr, size);
5981 } else {
5982 NVME_GUEST_ERR(pci_nvme_ub_mmiord_invalid_ofs,
5983 "MMIO read beyond last register,"
5984 " offset=0x%"PRIx64", returning 0", addr);
5985 }
5986
5987 return val;
5988 }
5989
5990 static void nvme_process_db(NvmeCtrl *n, hwaddr addr, int val)
5991 {
5992 uint32_t qid;
5993
5994 if (unlikely(addr & ((1 << 2) - 1))) {
5995 NVME_GUEST_ERR(pci_nvme_ub_db_wr_misaligned,
5996 "doorbell write not 32-bit aligned,"
5997 " offset=0x%"PRIx64", ignoring", addr);
5998 return;
5999 }
6000
6001 if (((addr - 0x1000) >> 2) & 1) {
6002 /* Completion queue doorbell write */
6003
6004 uint16_t new_head = val & 0xffff;
6005 int start_sqs;
6006 NvmeCQueue *cq;
6007
6008 qid = (addr - (0x1000 + (1 << 2))) >> 3;
6009 if (unlikely(nvme_check_cqid(n, qid))) {
6010 NVME_GUEST_ERR(pci_nvme_ub_db_wr_invalid_cq,
6011 "completion queue doorbell write"
6012 " for nonexistent queue,"
6013 " sqid=%"PRIu32", ignoring", qid);
6014
6015 /*
6016 * NVM Express v1.3d, Section 4.1 state: "If host software writes
6017 * an invalid value to the Submission Queue Tail Doorbell or
6018 * Completion Queue Head Doorbell regiter and an Asynchronous Event
6019 * Request command is outstanding, then an asynchronous event is
6020 * posted to the Admin Completion Queue with a status code of
6021 * Invalid Doorbell Write Value."
6022 *
6023 * Also note that the spec includes the "Invalid Doorbell Register"
6024 * status code, but nowhere does it specify when to use it.
6025 * However, it seems reasonable to use it here in a similar
6026 * fashion.
6027 */
6028 if (n->outstanding_aers) {
6029 nvme_enqueue_event(n, NVME_AER_TYPE_ERROR,
6030 NVME_AER_INFO_ERR_INVALID_DB_REGISTER,
6031 NVME_LOG_ERROR_INFO);
6032 }
6033
6034 return;
6035 }
6036
6037 cq = n->cq[qid];
6038 if (unlikely(new_head >= cq->size)) {
6039 NVME_GUEST_ERR(pci_nvme_ub_db_wr_invalid_cqhead,
6040 "completion queue doorbell write value"
6041 " beyond queue size, sqid=%"PRIu32","
6042 " new_head=%"PRIu16", ignoring",
6043 qid, new_head);
6044
6045 if (n->outstanding_aers) {
6046 nvme_enqueue_event(n, NVME_AER_TYPE_ERROR,
6047 NVME_AER_INFO_ERR_INVALID_DB_VALUE,
6048 NVME_LOG_ERROR_INFO);
6049 }
6050
6051 return;
6052 }
6053
6054 trace_pci_nvme_mmio_doorbell_cq(cq->cqid, new_head);
6055
6056 start_sqs = nvme_cq_full(cq) ? 1 : 0;
6057 cq->head = new_head;
6058 if (start_sqs) {
6059 NvmeSQueue *sq;
6060 QTAILQ_FOREACH(sq, &cq->sq_list, entry) {
6061 timer_mod(sq->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 500);
6062 }
6063 timer_mod(cq->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 500);
6064 }
6065
6066 if (cq->tail == cq->head) {
6067 if (cq->irq_enabled) {
6068 n->cq_pending--;
6069 }
6070
6071 nvme_irq_deassert(n, cq);
6072 }
6073 } else {
6074 /* Submission queue doorbell write */
6075
6076 uint16_t new_tail = val & 0xffff;
6077 NvmeSQueue *sq;
6078
6079 qid = (addr - 0x1000) >> 3;
6080 if (unlikely(nvme_check_sqid(n, qid))) {
6081 NVME_GUEST_ERR(pci_nvme_ub_db_wr_invalid_sq,
6082 "submission queue doorbell write"
6083 " for nonexistent queue,"
6084 " sqid=%"PRIu32", ignoring", qid);
6085
6086 if (n->outstanding_aers) {
6087 nvme_enqueue_event(n, NVME_AER_TYPE_ERROR,
6088 NVME_AER_INFO_ERR_INVALID_DB_REGISTER,
6089 NVME_LOG_ERROR_INFO);
6090 }
6091
6092 return;
6093 }
6094
6095 sq = n->sq[qid];
6096 if (unlikely(new_tail >= sq->size)) {
6097 NVME_GUEST_ERR(pci_nvme_ub_db_wr_invalid_sqtail,
6098 "submission queue doorbell write value"
6099 " beyond queue size, sqid=%"PRIu32","
6100 " new_tail=%"PRIu16", ignoring",
6101 qid, new_tail);
6102
6103 if (n->outstanding_aers) {
6104 nvme_enqueue_event(n, NVME_AER_TYPE_ERROR,
6105 NVME_AER_INFO_ERR_INVALID_DB_VALUE,
6106 NVME_LOG_ERROR_INFO);
6107 }
6108
6109 return;
6110 }
6111
6112 trace_pci_nvme_mmio_doorbell_sq(sq->sqid, new_tail);
6113
6114 sq->tail = new_tail;
6115 timer_mod(sq->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 500);
6116 }
6117 }
6118
6119 static void nvme_mmio_write(void *opaque, hwaddr addr, uint64_t data,
6120 unsigned size)
6121 {
6122 NvmeCtrl *n = (NvmeCtrl *)opaque;
6123
6124 trace_pci_nvme_mmio_write(addr, data, size);
6125
6126 if (addr < sizeof(n->bar)) {
6127 nvme_write_bar(n, addr, data, size);
6128 } else {
6129 nvme_process_db(n, addr, data);
6130 }
6131 }
6132
6133 static const MemoryRegionOps nvme_mmio_ops = {
6134 .read = nvme_mmio_read,
6135 .write = nvme_mmio_write,
6136 .endianness = DEVICE_LITTLE_ENDIAN,
6137 .impl = {
6138 .min_access_size = 2,
6139 .max_access_size = 8,
6140 },
6141 };
6142
6143 static void nvme_cmb_write(void *opaque, hwaddr addr, uint64_t data,
6144 unsigned size)
6145 {
6146 NvmeCtrl *n = (NvmeCtrl *)opaque;
6147 stn_le_p(&n->cmb.buf[addr], size, data);
6148 }
6149
6150 static uint64_t nvme_cmb_read(void *opaque, hwaddr addr, unsigned size)
6151 {
6152 NvmeCtrl *n = (NvmeCtrl *)opaque;
6153 return ldn_le_p(&n->cmb.buf[addr], size);
6154 }
6155
6156 static const MemoryRegionOps nvme_cmb_ops = {
6157 .read = nvme_cmb_read,
6158 .write = nvme_cmb_write,
6159 .endianness = DEVICE_LITTLE_ENDIAN,
6160 .impl = {
6161 .min_access_size = 1,
6162 .max_access_size = 8,
6163 },
6164 };
6165
6166 static void nvme_check_constraints(NvmeCtrl *n, Error **errp)
6167 {
6168 NvmeParams *params = &n->params;
6169
6170 if (params->num_queues) {
6171 warn_report("num_queues is deprecated; please use max_ioqpairs "
6172 "instead");
6173
6174 params->max_ioqpairs = params->num_queues - 1;
6175 }
6176
6177 if (n->namespace.blkconf.blk && n->subsys) {
6178 error_setg(errp, "subsystem support is unavailable with legacy "
6179 "namespace ('drive' property)");
6180 return;
6181 }
6182
6183 if (params->max_ioqpairs < 1 ||
6184 params->max_ioqpairs > NVME_MAX_IOQPAIRS) {
6185 error_setg(errp, "max_ioqpairs must be between 1 and %d",
6186 NVME_MAX_IOQPAIRS);
6187 return;
6188 }
6189
6190 if (params->msix_qsize < 1 ||
6191 params->msix_qsize > PCI_MSIX_FLAGS_QSIZE + 1) {
6192 error_setg(errp, "msix_qsize must be between 1 and %d",
6193 PCI_MSIX_FLAGS_QSIZE + 1);
6194 return;
6195 }
6196
6197 if (!params->serial) {
6198 error_setg(errp, "serial property not set");
6199 return;
6200 }
6201
6202 if (n->pmr.dev) {
6203 if (host_memory_backend_is_mapped(n->pmr.dev)) {
6204 error_setg(errp, "can't use already busy memdev: %s",
6205 object_get_canonical_path_component(OBJECT(n->pmr.dev)));
6206 return;
6207 }
6208
6209 if (!is_power_of_2(n->pmr.dev->size)) {
6210 error_setg(errp, "pmr backend size needs to be power of 2 in size");
6211 return;
6212 }
6213
6214 host_memory_backend_set_mapped(n->pmr.dev, true);
6215 }
6216
6217 if (n->params.zasl > n->params.mdts) {
6218 error_setg(errp, "zoned.zasl (Zone Append Size Limit) must be less "
6219 "than or equal to mdts (Maximum Data Transfer Size)");
6220 return;
6221 }
6222
6223 if (!n->params.vsl) {
6224 error_setg(errp, "vsl must be non-zero");
6225 return;
6226 }
6227 }
6228
6229 static void nvme_init_state(NvmeCtrl *n)
6230 {
6231 /* add one to max_ioqpairs to account for the admin queue pair */
6232 n->reg_size = pow2ceil(sizeof(NvmeBar) +
6233 2 * (n->params.max_ioqpairs + 1) * NVME_DB_SIZE);
6234 n->sq = g_new0(NvmeSQueue *, n->params.max_ioqpairs + 1);
6235 n->cq = g_new0(NvmeCQueue *, n->params.max_ioqpairs + 1);
6236 n->temperature = NVME_TEMPERATURE;
6237 n->features.temp_thresh_hi = NVME_TEMPERATURE_WARNING;
6238 n->starttime_ms = qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL);
6239 n->aer_reqs = g_new0(NvmeRequest *, n->params.aerl + 1);
6240 }
6241
6242 static void nvme_init_cmb(NvmeCtrl *n, PCIDevice *pci_dev)
6243 {
6244 uint64_t cmb_size = n->params.cmb_size_mb * MiB;
6245
6246 n->cmb.buf = g_malloc0(cmb_size);
6247 memory_region_init_io(&n->cmb.mem, OBJECT(n), &nvme_cmb_ops, n,
6248 "nvme-cmb", cmb_size);
6249 pci_register_bar(pci_dev, NVME_CMB_BIR,
6250 PCI_BASE_ADDRESS_SPACE_MEMORY |
6251 PCI_BASE_ADDRESS_MEM_TYPE_64 |
6252 PCI_BASE_ADDRESS_MEM_PREFETCH, &n->cmb.mem);
6253
6254 NVME_CAP_SET_CMBS(n->bar.cap, 1);
6255
6256 if (n->params.legacy_cmb) {
6257 nvme_cmb_enable_regs(n);
6258 n->cmb.cmse = true;
6259 }
6260 }
6261
6262 static void nvme_init_pmr(NvmeCtrl *n, PCIDevice *pci_dev)
6263 {
6264 NVME_PMRCAP_SET_RDS(n->bar.pmrcap, 1);
6265 NVME_PMRCAP_SET_WDS(n->bar.pmrcap, 1);
6266 NVME_PMRCAP_SET_BIR(n->bar.pmrcap, NVME_PMR_BIR);
6267 /* Turn on bit 1 support */
6268 NVME_PMRCAP_SET_PMRWBM(n->bar.pmrcap, 0x02);
6269 NVME_PMRCAP_SET_CMSS(n->bar.pmrcap, 1);
6270
6271 pci_register_bar(pci_dev, NVME_PMRCAP_BIR(n->bar.pmrcap),
6272 PCI_BASE_ADDRESS_SPACE_MEMORY |
6273 PCI_BASE_ADDRESS_MEM_TYPE_64 |
6274 PCI_BASE_ADDRESS_MEM_PREFETCH, &n->pmr.dev->mr);
6275
6276 memory_region_set_enabled(&n->pmr.dev->mr, false);
6277 }
6278
6279 static int nvme_init_pci(NvmeCtrl *n, PCIDevice *pci_dev, Error **errp)
6280 {
6281 uint8_t *pci_conf = pci_dev->config;
6282 uint64_t bar_size, msix_table_size, msix_pba_size;
6283 unsigned msix_table_offset, msix_pba_offset;
6284 int ret;
6285
6286 Error *err = NULL;
6287
6288 pci_conf[PCI_INTERRUPT_PIN] = 1;
6289 pci_config_set_prog_interface(pci_conf, 0x2);
6290
6291 if (n->params.use_intel_id) {
6292 pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_INTEL);
6293 pci_config_set_device_id(pci_conf, 0x5845);
6294 } else {
6295 pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_REDHAT);
6296 pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_REDHAT_NVME);
6297 }
6298
6299 pci_config_set_class(pci_conf, PCI_CLASS_STORAGE_EXPRESS);
6300 pcie_endpoint_cap_init(pci_dev, 0x80);
6301
6302 bar_size = QEMU_ALIGN_UP(n->reg_size, 4 * KiB);
6303 msix_table_offset = bar_size;
6304 msix_table_size = PCI_MSIX_ENTRY_SIZE * n->params.msix_qsize;
6305
6306 bar_size += msix_table_size;
6307 bar_size = QEMU_ALIGN_UP(bar_size, 4 * KiB);
6308 msix_pba_offset = bar_size;
6309 msix_pba_size = QEMU_ALIGN_UP(n->params.msix_qsize, 64) / 8;
6310
6311 bar_size += msix_pba_size;
6312 bar_size = pow2ceil(bar_size);
6313
6314 memory_region_init(&n->bar0, OBJECT(n), "nvme-bar0", bar_size);
6315 memory_region_init_io(&n->iomem, OBJECT(n), &nvme_mmio_ops, n, "nvme",
6316 n->reg_size);
6317 memory_region_add_subregion(&n->bar0, 0, &n->iomem);
6318
6319 pci_register_bar(pci_dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY |
6320 PCI_BASE_ADDRESS_MEM_TYPE_64, &n->bar0);
6321 ret = msix_init(pci_dev, n->params.msix_qsize,
6322 &n->bar0, 0, msix_table_offset,
6323 &n->bar0, 0, msix_pba_offset, 0, &err);
6324 if (ret < 0) {
6325 if (ret == -ENOTSUP) {
6326 warn_report_err(err);
6327 } else {
6328 error_propagate(errp, err);
6329 return ret;
6330 }
6331 }
6332
6333 if (n->params.cmb_size_mb) {
6334 nvme_init_cmb(n, pci_dev);
6335 }
6336
6337 if (n->pmr.dev) {
6338 nvme_init_pmr(n, pci_dev);
6339 }
6340
6341 return 0;
6342 }
6343
6344 static void nvme_init_subnqn(NvmeCtrl *n)
6345 {
6346 NvmeSubsystem *subsys = n->subsys;
6347 NvmeIdCtrl *id = &n->id_ctrl;
6348
6349 if (!subsys) {
6350 snprintf((char *)id->subnqn, sizeof(id->subnqn),
6351 "nqn.2019-08.org.qemu:%s", n->params.serial);
6352 } else {
6353 pstrcpy((char *)id->subnqn, sizeof(id->subnqn), (char*)subsys->subnqn);
6354 }
6355 }
6356
6357 static void nvme_init_ctrl(NvmeCtrl *n, PCIDevice *pci_dev)
6358 {
6359 NvmeIdCtrl *id = &n->id_ctrl;
6360 uint8_t *pci_conf = pci_dev->config;
6361
6362 id->vid = cpu_to_le16(pci_get_word(pci_conf + PCI_VENDOR_ID));
6363 id->ssvid = cpu_to_le16(pci_get_word(pci_conf + PCI_SUBSYSTEM_VENDOR_ID));
6364 strpadcpy((char *)id->mn, sizeof(id->mn), "QEMU NVMe Ctrl", ' ');
6365 strpadcpy((char *)id->fr, sizeof(id->fr), "1.0", ' ');
6366 strpadcpy((char *)id->sn, sizeof(id->sn), n->params.serial, ' ');
6367
6368 id->cntlid = cpu_to_le16(n->cntlid);
6369
6370 id->oaes = cpu_to_le32(NVME_OAES_NS_ATTR);
6371
6372 id->rab = 6;
6373
6374 if (n->params.use_intel_id) {
6375 id->ieee[0] = 0xb3;
6376 id->ieee[1] = 0x02;
6377 id->ieee[2] = 0x00;
6378 } else {
6379 id->ieee[0] = 0x00;
6380 id->ieee[1] = 0x54;
6381 id->ieee[2] = 0x52;
6382 }
6383
6384 id->mdts = n->params.mdts;
6385 id->ver = cpu_to_le32(NVME_SPEC_VER);
6386 id->oacs = cpu_to_le16(NVME_OACS_NS_MGMT | NVME_OACS_FORMAT);
6387 id->cntrltype = 0x1;
6388
6389 /*
6390 * Because the controller always completes the Abort command immediately,
6391 * there can never be more than one concurrently executing Abort command,
6392 * so this value is never used for anything. Note that there can easily be
6393 * many Abort commands in the queues, but they are not considered
6394 * "executing" until processed by nvme_abort.
6395 *
6396 * The specification recommends a value of 3 for Abort Command Limit (four
6397 * concurrently outstanding Abort commands), so lets use that though it is
6398 * inconsequential.
6399 */
6400 id->acl = 3;
6401 id->aerl = n->params.aerl;
6402 id->frmw = (NVME_NUM_FW_SLOTS << 1) | NVME_FRMW_SLOT1_RO;
6403 id->lpa = NVME_LPA_NS_SMART | NVME_LPA_CSE | NVME_LPA_EXTENDED;
6404
6405 /* recommended default value (~70 C) */
6406 id->wctemp = cpu_to_le16(NVME_TEMPERATURE_WARNING);
6407 id->cctemp = cpu_to_le16(NVME_TEMPERATURE_CRITICAL);
6408
6409 id->sqes = (0x6 << 4) | 0x6;
6410 id->cqes = (0x4 << 4) | 0x4;
6411 id->nn = cpu_to_le32(NVME_MAX_NAMESPACES);
6412 id->oncs = cpu_to_le16(NVME_ONCS_WRITE_ZEROES | NVME_ONCS_TIMESTAMP |
6413 NVME_ONCS_FEATURES | NVME_ONCS_DSM |
6414 NVME_ONCS_COMPARE | NVME_ONCS_COPY);
6415
6416 /*
6417 * NOTE: If this device ever supports a command set that does NOT use 0x0
6418 * as a Flush-equivalent operation, support for the broadcast NSID in Flush
6419 * should probably be removed.
6420 *
6421 * See comment in nvme_io_cmd.
6422 */
6423 id->vwc = NVME_VWC_NSID_BROADCAST_SUPPORT | NVME_VWC_PRESENT;
6424
6425 id->ocfs = cpu_to_le16(NVME_OCFS_COPY_FORMAT_0);
6426 id->sgls = cpu_to_le32(NVME_CTRL_SGLS_SUPPORT_NO_ALIGN |
6427 NVME_CTRL_SGLS_BITBUCKET);
6428
6429 nvme_init_subnqn(n);
6430
6431 id->psd[0].mp = cpu_to_le16(0x9c4);
6432 id->psd[0].enlat = cpu_to_le32(0x10);
6433 id->psd[0].exlat = cpu_to_le32(0x4);
6434
6435 if (n->subsys) {
6436 id->cmic |= NVME_CMIC_MULTI_CTRL;
6437 }
6438
6439 NVME_CAP_SET_MQES(n->bar.cap, 0x7ff);
6440 NVME_CAP_SET_CQR(n->bar.cap, 1);
6441 NVME_CAP_SET_TO(n->bar.cap, 0xf);
6442 NVME_CAP_SET_CSS(n->bar.cap, NVME_CAP_CSS_NVM);
6443 NVME_CAP_SET_CSS(n->bar.cap, NVME_CAP_CSS_CSI_SUPP);
6444 NVME_CAP_SET_CSS(n->bar.cap, NVME_CAP_CSS_ADMIN_ONLY);
6445 NVME_CAP_SET_MPSMAX(n->bar.cap, 4);
6446 NVME_CAP_SET_CMBS(n->bar.cap, n->params.cmb_size_mb ? 1 : 0);
6447 NVME_CAP_SET_PMRS(n->bar.cap, n->pmr.dev ? 1 : 0);
6448
6449 n->bar.vs = NVME_SPEC_VER;
6450 n->bar.intmc = n->bar.intms = 0;
6451 }
6452
6453 static int nvme_init_subsys(NvmeCtrl *n, Error **errp)
6454 {
6455 int cntlid;
6456
6457 if (!n->subsys) {
6458 return 0;
6459 }
6460
6461 cntlid = nvme_subsys_register_ctrl(n, errp);
6462 if (cntlid < 0) {
6463 return -1;
6464 }
6465
6466 n->cntlid = cntlid;
6467
6468 return 0;
6469 }
6470
6471 void nvme_attach_ns(NvmeCtrl *n, NvmeNamespace *ns)
6472 {
6473 uint32_t nsid = ns->params.nsid;
6474 assert(nsid && nsid <= NVME_MAX_NAMESPACES);
6475
6476 n->namespaces[nsid] = ns;
6477 ns->attached++;
6478
6479 n->dmrsl = MIN_NON_ZERO(n->dmrsl,
6480 BDRV_REQUEST_MAX_BYTES / nvme_l2b(ns, 1));
6481 }
6482
6483 static void nvme_realize(PCIDevice *pci_dev, Error **errp)
6484 {
6485 NvmeCtrl *n = NVME(pci_dev);
6486 NvmeNamespace *ns;
6487 Error *local_err = NULL;
6488
6489 nvme_check_constraints(n, &local_err);
6490 if (local_err) {
6491 error_propagate(errp, local_err);
6492 return;
6493 }
6494
6495 qbus_create_inplace(&n->bus, sizeof(NvmeBus), TYPE_NVME_BUS,
6496 &pci_dev->qdev, n->parent_obj.qdev.id);
6497
6498 nvme_init_state(n);
6499 if (nvme_init_pci(n, pci_dev, errp)) {
6500 return;
6501 }
6502
6503 if (nvme_init_subsys(n, errp)) {
6504 error_propagate(errp, local_err);
6505 return;
6506 }
6507 nvme_init_ctrl(n, pci_dev);
6508
6509 /* setup a namespace if the controller drive property was given */
6510 if (n->namespace.blkconf.blk) {
6511 ns = &n->namespace;
6512 ns->params.nsid = 1;
6513
6514 if (nvme_ns_setup(ns, errp)) {
6515 return;
6516 }
6517
6518 nvme_attach_ns(n, ns);
6519 }
6520 }
6521
6522 static void nvme_exit(PCIDevice *pci_dev)
6523 {
6524 NvmeCtrl *n = NVME(pci_dev);
6525 NvmeNamespace *ns;
6526 int i;
6527
6528 nvme_ctrl_reset(n);
6529
6530 for (i = 1; i <= NVME_MAX_NAMESPACES; i++) {
6531 ns = nvme_ns(n, i);
6532 if (!ns) {
6533 continue;
6534 }
6535
6536 nvme_ns_cleanup(ns);
6537 }
6538
6539 if (n->subsys) {
6540 nvme_subsys_unregister_ctrl(n->subsys, n);
6541 }
6542
6543 g_free(n->cq);
6544 g_free(n->sq);
6545 g_free(n->aer_reqs);
6546
6547 if (n->params.cmb_size_mb) {
6548 g_free(n->cmb.buf);
6549 }
6550
6551 if (n->pmr.dev) {
6552 host_memory_backend_set_mapped(n->pmr.dev, false);
6553 }
6554 msix_uninit(pci_dev, &n->bar0, &n->bar0);
6555 memory_region_del_subregion(&n->bar0, &n->iomem);
6556 }
6557
6558 static Property nvme_props[] = {
6559 DEFINE_BLOCK_PROPERTIES(NvmeCtrl, namespace.blkconf),
6560 DEFINE_PROP_LINK("pmrdev", NvmeCtrl, pmr.dev, TYPE_MEMORY_BACKEND,
6561 HostMemoryBackend *),
6562 DEFINE_PROP_LINK("subsys", NvmeCtrl, subsys, TYPE_NVME_SUBSYS,
6563 NvmeSubsystem *),
6564 DEFINE_PROP_STRING("serial", NvmeCtrl, params.serial),
6565 DEFINE_PROP_UINT32("cmb_size_mb", NvmeCtrl, params.cmb_size_mb, 0),
6566 DEFINE_PROP_UINT32("num_queues", NvmeCtrl, params.num_queues, 0),
6567 DEFINE_PROP_UINT32("max_ioqpairs", NvmeCtrl, params.max_ioqpairs, 64),
6568 DEFINE_PROP_UINT16("msix_qsize", NvmeCtrl, params.msix_qsize, 65),
6569 DEFINE_PROP_UINT8("aerl", NvmeCtrl, params.aerl, 3),
6570 DEFINE_PROP_UINT32("aer_max_queued", NvmeCtrl, params.aer_max_queued, 64),
6571 DEFINE_PROP_UINT8("mdts", NvmeCtrl, params.mdts, 7),
6572 DEFINE_PROP_UINT8("vsl", NvmeCtrl, params.vsl, 7),
6573 DEFINE_PROP_BOOL("use-intel-id", NvmeCtrl, params.use_intel_id, false),
6574 DEFINE_PROP_BOOL("legacy-cmb", NvmeCtrl, params.legacy_cmb, false),
6575 DEFINE_PROP_UINT8("zoned.zasl", NvmeCtrl, params.zasl, 0),
6576 DEFINE_PROP_BOOL("zoned.auto_transition", NvmeCtrl,
6577 params.auto_transition_zones, true),
6578 DEFINE_PROP_END_OF_LIST(),
6579 };
6580
6581 static void nvme_get_smart_warning(Object *obj, Visitor *v, const char *name,
6582 void *opaque, Error **errp)
6583 {
6584 NvmeCtrl *n = NVME(obj);
6585 uint8_t value = n->smart_critical_warning;
6586
6587 visit_type_uint8(v, name, &value, errp);
6588 }
6589
6590 static void nvme_set_smart_warning(Object *obj, Visitor *v, const char *name,
6591 void *opaque, Error **errp)
6592 {
6593 NvmeCtrl *n = NVME(obj);
6594 uint8_t value, old_value, cap = 0, index, event;
6595
6596 if (!visit_type_uint8(v, name, &value, errp)) {
6597 return;
6598 }
6599
6600 cap = NVME_SMART_SPARE | NVME_SMART_TEMPERATURE | NVME_SMART_RELIABILITY
6601 | NVME_SMART_MEDIA_READ_ONLY | NVME_SMART_FAILED_VOLATILE_MEDIA;
6602 if (NVME_CAP_PMRS(n->bar.cap)) {
6603 cap |= NVME_SMART_PMR_UNRELIABLE;
6604 }
6605
6606 if ((value & cap) != value) {
6607 error_setg(errp, "unsupported smart critical warning bits: 0x%x",
6608 value & ~cap);
6609 return;
6610 }
6611
6612 old_value = n->smart_critical_warning;
6613 n->smart_critical_warning = value;
6614
6615 /* only inject new bits of smart critical warning */
6616 for (index = 0; index < NVME_SMART_WARN_MAX; index++) {
6617 event = 1 << index;
6618 if (value & ~old_value & event)
6619 nvme_smart_event(n, event);
6620 }
6621 }
6622
6623 static const VMStateDescription nvme_vmstate = {
6624 .name = "nvme",
6625 .unmigratable = 1,
6626 };
6627
6628 static void nvme_class_init(ObjectClass *oc, void *data)
6629 {
6630 DeviceClass *dc = DEVICE_CLASS(oc);
6631 PCIDeviceClass *pc = PCI_DEVICE_CLASS(oc);
6632
6633 pc->realize = nvme_realize;
6634 pc->exit = nvme_exit;
6635 pc->class_id = PCI_CLASS_STORAGE_EXPRESS;
6636 pc->revision = 2;
6637
6638 set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
6639 dc->desc = "Non-Volatile Memory Express";
6640 device_class_set_props(dc, nvme_props);
6641 dc->vmsd = &nvme_vmstate;
6642 }
6643
6644 static void nvme_instance_init(Object *obj)
6645 {
6646 NvmeCtrl *n = NVME(obj);
6647
6648 device_add_bootindex_property(obj, &n->namespace.blkconf.bootindex,
6649 "bootindex", "/namespace@1,0",
6650 DEVICE(obj));
6651
6652 object_property_add(obj, "smart_critical_warning", "uint8",
6653 nvme_get_smart_warning,
6654 nvme_set_smart_warning, NULL, NULL);
6655 }
6656
6657 static const TypeInfo nvme_info = {
6658 .name = TYPE_NVME,
6659 .parent = TYPE_PCI_DEVICE,
6660 .instance_size = sizeof(NvmeCtrl),
6661 .instance_init = nvme_instance_init,
6662 .class_init = nvme_class_init,
6663 .interfaces = (InterfaceInfo[]) {
6664 { INTERFACE_PCIE_DEVICE },
6665 { }
6666 },
6667 };
6668
6669 static const TypeInfo nvme_bus_info = {
6670 .name = TYPE_NVME_BUS,
6671 .parent = TYPE_BUS,
6672 .instance_size = sizeof(NvmeBus),
6673 };
6674
6675 static void nvme_register_types(void)
6676 {
6677 type_register_static(&nvme_info);
6678 type_register_static(&nvme_bus_info);
6679 }
6680
6681 type_init(nvme_register_types)
Random patches