?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
hw/nvme: fix endianess conversion and add controller list
[qemu/rayw.git] / hw / nvme / ctrl.c
blob541c0819d5b08daa7cffcd0ea131a9b5bd84d1a7
1 /*
2 * QEMU NVM Express Controller
3 *
4 * Copyright (c) 2012, Intel Corporation
5 *
6 * Written by Keith Busch <keith.busch@intel.com>
7 *
8 * This code is licensed under the GNU GPL v2 or later.
9 */
10
11 /**
12 * Reference Specs: http://www.nvmexpress.org, 1.4, 1.3, 1.2, 1.1, 1.0e
13 *
14 * https://nvmexpress.org/developers/nvme-specification/
15 *
16 *
17 * Notes on coding style
18 * ---------------------
19 * While QEMU coding style prefers lowercase hexadecimals in constants, the
20 * NVMe subsystem use thes format from the NVMe specifications in the comments
21 * (i.e. 'h' suffix instead of '0x' prefix).
22 *
23 * Usage
24 * -----
25 * See docs/system/nvme.rst for extensive documentation.
26 *
27 * Add options:
28 * -drive file=<file>,if=none,id=<drive_id>
29 * -device nvme-subsys,id=<subsys_id>,nqn=<nqn_id>
30 * -device nvme,serial=<serial>,id=<bus_name>, \
31 * cmb_size_mb=<cmb_size_mb[optional]>, \
32 * [pmrdev=<mem_backend_file_id>,] \
33 * max_ioqpairs=<N[optional]>, \
34 * aerl=<N[optional]>,aer_max_queued=<N[optional]>, \
35 * mdts=<N[optional]>,vsl=<N[optional]>, \
36 * zoned.zasl=<N[optional]>, \
37 * zoned.auto_transition=<on|off[optional]>, \
38 * subsys=<subsys_id>
39 * -device nvme-ns,drive=<drive_id>,bus=<bus_name>,nsid=<nsid>,\
40 * zoned=<true|false[optional]>, \
41 * subsys=<subsys_id>,detached=<true|false[optional]>
42 *
43 * Note cmb_size_mb denotes size of CMB in MB. CMB is assumed to be at
44 * offset 0 in BAR2 and supports only WDS, RDS and SQS for now. By default, the
45 * device will use the "v1.4 CMB scheme" - use the `legacy-cmb` parameter to
46 * always enable the CMBLOC and CMBSZ registers (v1.3 behavior).
47 *
48 * Enabling pmr emulation can be achieved by pointing to memory-backend-file.
49 * For example:
50 * -object memory-backend-file,id=<mem_id>,share=on,mem-path=<file_path>, \
51 * size=<size> .... -device nvme,...,pmrdev=<mem_id>
52 *
53 * The PMR will use BAR 4/5 exclusively.
54 *
55 * To place controller(s) and namespace(s) to a subsystem, then provide
56 * nvme-subsys device as above.
57 *
58 * nvme subsystem device parameters
59 * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
60 * - `nqn`
61 * This parameter provides the `<nqn_id>` part of the string
62 * `nqn.2019-08.org.qemu:<nqn_id>` which will be reported in the SUBNQN field
63 * of subsystem controllers. Note that `<nqn_id>` should be unique per
64 * subsystem, but this is not enforced by QEMU. If not specified, it will
65 * default to the value of the `id` parameter (`<subsys_id>`).
66 *
67 * nvme device parameters
68 * ~~~~~~~~~~~~~~~~~~~~~~
69 * - `subsys`
70 * Specifying this parameter attaches the controller to the subsystem and
71 * the SUBNQN field in the controller will report the NQN of the subsystem
72 * device. This also enables multi controller capability represented in
73 * Identify Controller data structure in CMIC (Controller Multi-path I/O and
74 * Namesapce Sharing Capabilities).
75 *
76 * - `aerl`
77 * The Asynchronous Event Request Limit (AERL). Indicates the maximum number
78 * of concurrently outstanding Asynchronous Event Request commands support
79 * by the controller. This is a 0's based value.
80 *
81 * - `aer_max_queued`
82 * This is the maximum number of events that the device will enqueue for
83 * completion when there are no outstanding AERs. When the maximum number of
84 * enqueued events are reached, subsequent events will be dropped.
85 *
86 * - `mdts`
87 * Indicates the maximum data transfer size for a command that transfers data
88 * between host-accessible memory and the controller. The value is specified
89 * as a power of two (2^n) and is in units of the minimum memory page size
90 * (CAP.MPSMIN). The default value is 7 (i.e. 512 KiB).
91 *
92 * - `vsl`
93 * Indicates the maximum data size limit for the Verify command. Like `mdts`,
94 * this value is specified as a power of two (2^n) and is in units of the
95 * minimum memory page size (CAP.MPSMIN). The default value is 7 (i.e. 512
96 * KiB).
97 *
98 * - `zoned.zasl`
99 * Indicates the maximum data transfer size for the Zone Append command. Like
100 * `mdts`, the value is specified as a power of two (2^n) and is in units of
101 * the minimum memory page size (CAP.MPSMIN). The default value is 0 (i.e.
102 * defaulting to the value of `mdts`).
103 *
104 * - `zoned.auto_transition`
105 * Indicates if zones in zone state implicitly opened can be automatically
106 * transitioned to zone state closed for resource management purposes.
107 * Defaults to 'on'.
108 *
109 * nvme namespace device parameters
110 * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
111 * - `shared`
112 * When the parent nvme device (as defined explicitly by the 'bus' parameter
113 * or implicitly by the most recently defined NvmeBus) is linked to an
114 * nvme-subsys device, the namespace will be attached to all controllers in
115 * the subsystem. If set to 'off' (the default), the namespace will remain a
116 * private namespace and may only be attached to a single controller at a
117 * time.
118 *
119 * - `detached`
120 * This parameter is only valid together with the `subsys` parameter. If left
121 * at the default value (`false/off`), the namespace will be attached to all
122 * controllers in the NVMe subsystem at boot-up. If set to `true/on`, the
123 * namespace will be be available in the subsystem not not attached to any
124 * controllers.
125 *
126 * Setting `zoned` to true selects Zoned Command Set at the namespace.
127 * In this case, the following namespace properties are available to configure
128 * zoned operation:
129 * zoned.zone_size=<zone size in bytes, default: 128MiB>
130 * The number may be followed by K, M, G as in kilo-, mega- or giga-.
131 *
132 * zoned.zone_capacity=<zone capacity in bytes, default: zone size>
133 * The value 0 (default) forces zone capacity to be the same as zone
134 * size. The value of this property may not exceed zone size.
135 *
136 * zoned.descr_ext_size=<zone descriptor extension size, default 0>
137 * This value needs to be specified in 64B units. If it is zero,
138 * namespace(s) will not support zone descriptor extensions.
139 *
140 * zoned.max_active=<Maximum Active Resources (zones), default: 0>
141 * The default value means there is no limit to the number of
142 * concurrently active zones.
143 *
144 * zoned.max_open=<Maximum Open Resources (zones), default: 0>
145 * The default value means there is no limit to the number of
146 * concurrently open zones.
147 *
148 * zoned.cross_read=<enable RAZB, default: false>
149 * Setting this property to true enables Read Across Zone Boundaries.
150 */
151
152 #include "qemu/osdep.h"
153 #include "qemu/cutils.h"
154 #include "qemu/error-report.h"
155 #include "qemu/log.h"
156 #include "qemu/units.h"
157 #include "qapi/error.h"
158 #include "qapi/visitor.h"
159 #include "sysemu/sysemu.h"
160 #include "sysemu/block-backend.h"
161 #include "sysemu/hostmem.h"
162 #include "hw/pci/msix.h"
163 #include "migration/vmstate.h"
164
165 #include "nvme.h"
166 #include "trace.h"
167
168 #define NVME_MAX_IOQPAIRS 0xffff
169 #define NVME_DB_SIZE 4
170 #define NVME_SPEC_VER 0x00010400
171 #define NVME_CMB_BIR 2
172 #define NVME_PMR_BIR 4
173 #define NVME_TEMPERATURE 0x143
174 #define NVME_TEMPERATURE_WARNING 0x157
175 #define NVME_TEMPERATURE_CRITICAL 0x175
176 #define NVME_NUM_FW_SLOTS 1
177 #define NVME_DEFAULT_MAX_ZA_SIZE (128 * KiB)
178
179 #define NVME_GUEST_ERR(trace, fmt, ...) \
180 do { \
181 (trace_##trace)(__VA_ARGS__); \
182 qemu_log_mask(LOG_GUEST_ERROR, #trace \
183 " in %s: " fmt "\n", __func__, ## __VA_ARGS__); \
184 } while (0)
185
186 static const bool nvme_feature_support[NVME_FID_MAX] = {
187 [NVME_ARBITRATION] = true,
188 [NVME_POWER_MANAGEMENT] = true,
189 [NVME_TEMPERATURE_THRESHOLD] = true,
190 [NVME_ERROR_RECOVERY] = true,
191 [NVME_VOLATILE_WRITE_CACHE] = true,
192 [NVME_NUMBER_OF_QUEUES] = true,
193 [NVME_INTERRUPT_COALESCING] = true,
194 [NVME_INTERRUPT_VECTOR_CONF] = true,
195 [NVME_WRITE_ATOMICITY] = true,
196 [NVME_ASYNCHRONOUS_EVENT_CONF] = true,
197 [NVME_TIMESTAMP] = true,
198 [NVME_COMMAND_SET_PROFILE] = true,
199 };
200
201 static const uint32_t nvme_feature_cap[NVME_FID_MAX] = {
202 [NVME_TEMPERATURE_THRESHOLD] = NVME_FEAT_CAP_CHANGE,
203 [NVME_ERROR_RECOVERY] = NVME_FEAT_CAP_CHANGE | NVME_FEAT_CAP_NS,
204 [NVME_VOLATILE_WRITE_CACHE] = NVME_FEAT_CAP_CHANGE,
205 [NVME_NUMBER_OF_QUEUES] = NVME_FEAT_CAP_CHANGE,
206 [NVME_ASYNCHRONOUS_EVENT_CONF] = NVME_FEAT_CAP_CHANGE,
207 [NVME_TIMESTAMP] = NVME_FEAT_CAP_CHANGE,
208 [NVME_COMMAND_SET_PROFILE] = NVME_FEAT_CAP_CHANGE,
209 };
210
211 static const uint32_t nvme_cse_acs[256] = {
212 [NVME_ADM_CMD_DELETE_SQ] = NVME_CMD_EFF_CSUPP,
213 [NVME_ADM_CMD_CREATE_SQ] = NVME_CMD_EFF_CSUPP,
214 [NVME_ADM_CMD_GET_LOG_PAGE] = NVME_CMD_EFF_CSUPP,
215 [NVME_ADM_CMD_DELETE_CQ] = NVME_CMD_EFF_CSUPP,
216 [NVME_ADM_CMD_CREATE_CQ] = NVME_CMD_EFF_CSUPP,
217 [NVME_ADM_CMD_IDENTIFY] = NVME_CMD_EFF_CSUPP,
218 [NVME_ADM_CMD_ABORT] = NVME_CMD_EFF_CSUPP,
219 [NVME_ADM_CMD_SET_FEATURES] = NVME_CMD_EFF_CSUPP,
220 [NVME_ADM_CMD_GET_FEATURES] = NVME_CMD_EFF_CSUPP,
221 [NVME_ADM_CMD_ASYNC_EV_REQ] = NVME_CMD_EFF_CSUPP,
222 [NVME_ADM_CMD_NS_ATTACHMENT] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_NIC,
223 [NVME_ADM_CMD_FORMAT_NVM] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
224 };
225
226 static const uint32_t nvme_cse_iocs_none[256];
227
228 static const uint32_t nvme_cse_iocs_nvm[256] = {
229 [NVME_CMD_FLUSH] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
230 [NVME_CMD_WRITE_ZEROES] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
231 [NVME_CMD_WRITE] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
232 [NVME_CMD_READ] = NVME_CMD_EFF_CSUPP,
233 [NVME_CMD_DSM] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
234 [NVME_CMD_VERIFY] = NVME_CMD_EFF_CSUPP,
235 [NVME_CMD_COPY] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
236 [NVME_CMD_COMPARE] = NVME_CMD_EFF_CSUPP,
237 };
238
239 static const uint32_t nvme_cse_iocs_zoned[256] = {
240 [NVME_CMD_FLUSH] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
241 [NVME_CMD_WRITE_ZEROES] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
242 [NVME_CMD_WRITE] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
243 [NVME_CMD_READ] = NVME_CMD_EFF_CSUPP,
244 [NVME_CMD_DSM] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
245 [NVME_CMD_VERIFY] = NVME_CMD_EFF_CSUPP,
246 [NVME_CMD_COPY] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
247 [NVME_CMD_COMPARE] = NVME_CMD_EFF_CSUPP,
248 [NVME_CMD_ZONE_APPEND] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
249 [NVME_CMD_ZONE_MGMT_SEND] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
250 [NVME_CMD_ZONE_MGMT_RECV] = NVME_CMD_EFF_CSUPP,
251 };
252
253 static void nvme_process_sq(void *opaque);
254
255 static uint16_t nvme_sqid(NvmeRequest *req)
256 {
257 return le16_to_cpu(req->sq->sqid);
258 }
259
260 static void nvme_assign_zone_state(NvmeNamespace *ns, NvmeZone *zone,
261 NvmeZoneState state)
262 {
263 if (QTAILQ_IN_USE(zone, entry)) {
264 switch (nvme_get_zone_state(zone)) {
265 case NVME_ZONE_STATE_EXPLICITLY_OPEN:
266 QTAILQ_REMOVE(&ns->exp_open_zones, zone, entry);
267 break;
268 case NVME_ZONE_STATE_IMPLICITLY_OPEN:
269 QTAILQ_REMOVE(&ns->imp_open_zones, zone, entry);
270 break;
271 case NVME_ZONE_STATE_CLOSED:
272 QTAILQ_REMOVE(&ns->closed_zones, zone, entry);
273 break;
274 case NVME_ZONE_STATE_FULL:
275 QTAILQ_REMOVE(&ns->full_zones, zone, entry);
276 default:
277 ;
278 }
279 }
280
281 nvme_set_zone_state(zone, state);
282
283 switch (state) {
284 case NVME_ZONE_STATE_EXPLICITLY_OPEN:
285 QTAILQ_INSERT_TAIL(&ns->exp_open_zones, zone, entry);
286 break;
287 case NVME_ZONE_STATE_IMPLICITLY_OPEN:
288 QTAILQ_INSERT_TAIL(&ns->imp_open_zones, zone, entry);
289 break;
290 case NVME_ZONE_STATE_CLOSED:
291 QTAILQ_INSERT_TAIL(&ns->closed_zones, zone, entry);
292 break;
293 case NVME_ZONE_STATE_FULL:
294 QTAILQ_INSERT_TAIL(&ns->full_zones, zone, entry);
295 case NVME_ZONE_STATE_READ_ONLY:
296 break;
297 default:
298 zone->d.za = 0;
299 }
300 }
301
302 /*
303 * Check if we can open a zone without exceeding open/active limits.
304 * AOR stands for "Active and Open Resources" (see TP 4053 section 2.5).
305 */
306 static int nvme_aor_check(NvmeNamespace *ns, uint32_t act, uint32_t opn)
307 {
308 if (ns->params.max_active_zones != 0 &&
309 ns->nr_active_zones + act > ns->params.max_active_zones) {
310 trace_pci_nvme_err_insuff_active_res(ns->params.max_active_zones);
311 return NVME_ZONE_TOO_MANY_ACTIVE | NVME_DNR;
312 }
313 if (ns->params.max_open_zones != 0 &&
314 ns->nr_open_zones + opn > ns->params.max_open_zones) {
315 trace_pci_nvme_err_insuff_open_res(ns->params.max_open_zones);
316 return NVME_ZONE_TOO_MANY_OPEN | NVME_DNR;
317 }
318
319 return NVME_SUCCESS;
320 }
321
322 static bool nvme_addr_is_cmb(NvmeCtrl *n, hwaddr addr)
323 {
324 hwaddr hi, lo;
325
326 if (!n->cmb.cmse) {
327 return false;
328 }
329
330 lo = n->params.legacy_cmb ? n->cmb.mem.addr : n->cmb.cba;
331 hi = lo + int128_get64(n->cmb.mem.size);
332
333 return addr >= lo && addr < hi;
334 }
335
336 static inline void *nvme_addr_to_cmb(NvmeCtrl *n, hwaddr addr)
337 {
338 hwaddr base = n->params.legacy_cmb ? n->cmb.mem.addr : n->cmb.cba;
339 return &n->cmb.buf[addr - base];
340 }
341
342 static bool nvme_addr_is_pmr(NvmeCtrl *n, hwaddr addr)
343 {
344 hwaddr hi;
345
346 if (!n->pmr.cmse) {
347 return false;
348 }
349
350 hi = n->pmr.cba + int128_get64(n->pmr.dev->mr.size);
351
352 return addr >= n->pmr.cba && addr < hi;
353 }
354
355 static inline void *nvme_addr_to_pmr(NvmeCtrl *n, hwaddr addr)
356 {
357 return memory_region_get_ram_ptr(&n->pmr.dev->mr) + (addr - n->pmr.cba);
358 }
359
360 static int nvme_addr_read(NvmeCtrl *n, hwaddr addr, void *buf, int size)
361 {
362 hwaddr hi = addr + size - 1;
363 if (hi < addr) {
364 return 1;
365 }
366
367 if (n->bar.cmbsz && nvme_addr_is_cmb(n, addr) && nvme_addr_is_cmb(n, hi)) {
368 memcpy(buf, nvme_addr_to_cmb(n, addr), size);
369 return 0;
370 }
371
372 if (nvme_addr_is_pmr(n, addr) && nvme_addr_is_pmr(n, hi)) {
373 memcpy(buf, nvme_addr_to_pmr(n, addr), size);
374 return 0;
375 }
376
377 return pci_dma_read(&n->parent_obj, addr, buf, size);
378 }
379
380 static int nvme_addr_write(NvmeCtrl *n, hwaddr addr, void *buf, int size)
381 {
382 hwaddr hi = addr + size - 1;
383 if (hi < addr) {
384 return 1;
385 }
386
387 if (n->bar.cmbsz && nvme_addr_is_cmb(n, addr) && nvme_addr_is_cmb(n, hi)) {
388 memcpy(nvme_addr_to_cmb(n, addr), buf, size);
389 return 0;
390 }
391
392 if (nvme_addr_is_pmr(n, addr) && nvme_addr_is_pmr(n, hi)) {
393 memcpy(nvme_addr_to_pmr(n, addr), buf, size);
394 return 0;
395 }
396
397 return pci_dma_write(&n->parent_obj, addr, buf, size);
398 }
399
400 static bool nvme_nsid_valid(NvmeCtrl *n, uint32_t nsid)
401 {
402 return nsid &&
403 (nsid == NVME_NSID_BROADCAST || nsid <= NVME_MAX_NAMESPACES);
404 }
405
406 static int nvme_check_sqid(NvmeCtrl *n, uint16_t sqid)
407 {
408 return sqid < n->params.max_ioqpairs + 1 && n->sq[sqid] != NULL ? 0 : -1;
409 }
410
411 static int nvme_check_cqid(NvmeCtrl *n, uint16_t cqid)
412 {
413 return cqid < n->params.max_ioqpairs + 1 && n->cq[cqid] != NULL ? 0 : -1;
414 }
415
416 static void nvme_inc_cq_tail(NvmeCQueue *cq)
417 {
418 cq->tail++;
419 if (cq->tail >= cq->size) {
420 cq->tail = 0;
421 cq->phase = !cq->phase;
422 }
423 }
424
425 static void nvme_inc_sq_head(NvmeSQueue *sq)
426 {
427 sq->head = (sq->head + 1) % sq->size;
428 }
429
430 static uint8_t nvme_cq_full(NvmeCQueue *cq)
431 {
432 return (cq->tail + 1) % cq->size == cq->head;
433 }
434
435 static uint8_t nvme_sq_empty(NvmeSQueue *sq)
436 {
437 return sq->head == sq->tail;
438 }
439
440 static void nvme_irq_check(NvmeCtrl *n)
441 {
442 if (msix_enabled(&(n->parent_obj))) {
443 return;
444 }
445 if (~n->bar.intms & n->irq_status) {
446 pci_irq_assert(&n->parent_obj);
447 } else {
448 pci_irq_deassert(&n->parent_obj);
449 }
450 }
451
452 static void nvme_irq_assert(NvmeCtrl *n, NvmeCQueue *cq)
453 {
454 if (cq->irq_enabled) {
455 if (msix_enabled(&(n->parent_obj))) {
456 trace_pci_nvme_irq_msix(cq->vector);
457 msix_notify(&(n->parent_obj), cq->vector);
458 } else {
459 trace_pci_nvme_irq_pin();
460 assert(cq->vector < 32);
461 n->irq_status |= 1 << cq->vector;
462 nvme_irq_check(n);
463 }
464 } else {
465 trace_pci_nvme_irq_masked();
466 }
467 }
468
469 static void nvme_irq_deassert(NvmeCtrl *n, NvmeCQueue *cq)
470 {
471 if (cq->irq_enabled) {
472 if (msix_enabled(&(n->parent_obj))) {
473 return;
474 } else {
475 assert(cq->vector < 32);
476 n->irq_status &= ~(1 << cq->vector);
477 nvme_irq_check(n);
478 }
479 }
480 }
481
482 static void nvme_req_clear(NvmeRequest *req)
483 {
484 req->ns = NULL;
485 req->opaque = NULL;
486 req->aiocb = NULL;
487 memset(&req->cqe, 0x0, sizeof(req->cqe));
488 req->status = NVME_SUCCESS;
489 }
490
491 static inline void nvme_sg_init(NvmeCtrl *n, NvmeSg *sg, bool dma)
492 {
493 if (dma) {
494 pci_dma_sglist_init(&sg->qsg, &n->parent_obj, 0);
495 sg->flags = NVME_SG_DMA;
496 } else {
497 qemu_iovec_init(&sg->iov, 0);
498 }
499
500 sg->flags |= NVME_SG_ALLOC;
501 }
502
503 static inline void nvme_sg_unmap(NvmeSg *sg)
504 {
505 if (!(sg->flags & NVME_SG_ALLOC)) {
506 return;
507 }
508
509 if (sg->flags & NVME_SG_DMA) {
510 qemu_sglist_destroy(&sg->qsg);
511 } else {
512 qemu_iovec_destroy(&sg->iov);
513 }
514
515 memset(sg, 0x0, sizeof(*sg));
516 }
517
518 /*
519 * When metadata is transfered as extended LBAs, the DPTR mapped into `sg`
520 * holds both data and metadata. This function splits the data and metadata
521 * into two separate QSG/IOVs.
522 */
523 static void nvme_sg_split(NvmeSg *sg, NvmeNamespace *ns, NvmeSg *data,
524 NvmeSg *mdata)
525 {
526 NvmeSg *dst = data;
527 uint32_t trans_len, count = ns->lbasz;
528 uint64_t offset = 0;
529 bool dma = sg->flags & NVME_SG_DMA;
530 size_t sge_len;
531 size_t sg_len = dma ? sg->qsg.size : sg->iov.size;
532 int sg_idx = 0;
533
534 assert(sg->flags & NVME_SG_ALLOC);
535
536 while (sg_len) {
537 sge_len = dma ? sg->qsg.sg[sg_idx].len : sg->iov.iov[sg_idx].iov_len;
538
539 trans_len = MIN(sg_len, count);
540 trans_len = MIN(trans_len, sge_len - offset);
541
542 if (dst) {
543 if (dma) {
544 qemu_sglist_add(&dst->qsg, sg->qsg.sg[sg_idx].base + offset,
545 trans_len);
546 } else {
547 qemu_iovec_add(&dst->iov,
548 sg->iov.iov[sg_idx].iov_base + offset,
549 trans_len);
550 }
551 }
552
553 sg_len -= trans_len;
554 count -= trans_len;
555 offset += trans_len;
556
557 if (count == 0) {
558 dst = (dst == data) ? mdata : data;
559 count = (dst == data) ? ns->lbasz : ns->lbaf.ms;
560 }
561
562 if (sge_len == offset) {
563 offset = 0;
564 sg_idx++;
565 }
566 }
567 }
568
569 static uint16_t nvme_map_addr_cmb(NvmeCtrl *n, QEMUIOVector *iov, hwaddr addr,
570 size_t len)
571 {
572 if (!len) {
573 return NVME_SUCCESS;
574 }
575
576 trace_pci_nvme_map_addr_cmb(addr, len);
577
578 if (!nvme_addr_is_cmb(n, addr) || !nvme_addr_is_cmb(n, addr + len - 1)) {
579 return NVME_DATA_TRAS_ERROR;
580 }
581
582 qemu_iovec_add(iov, nvme_addr_to_cmb(n, addr), len);
583
584 return NVME_SUCCESS;
585 }
586
587 static uint16_t nvme_map_addr_pmr(NvmeCtrl *n, QEMUIOVector *iov, hwaddr addr,
588 size_t len)
589 {
590 if (!len) {
591 return NVME_SUCCESS;
592 }
593
594 if (!nvme_addr_is_pmr(n, addr) || !nvme_addr_is_pmr(n, addr + len - 1)) {
595 return NVME_DATA_TRAS_ERROR;
596 }
597
598 qemu_iovec_add(iov, nvme_addr_to_pmr(n, addr), len);
599
600 return NVME_SUCCESS;
601 }
602
603 static uint16_t nvme_map_addr(NvmeCtrl *n, NvmeSg *sg, hwaddr addr, size_t len)
604 {
605 bool cmb = false, pmr = false;
606
607 if (!len) {
608 return NVME_SUCCESS;
609 }
610
611 trace_pci_nvme_map_addr(addr, len);
612
613 if (nvme_addr_is_cmb(n, addr)) {
614 cmb = true;
615 } else if (nvme_addr_is_pmr(n, addr)) {
616 pmr = true;
617 }
618
619 if (cmb || pmr) {
620 if (sg->flags & NVME_SG_DMA) {
621 return NVME_INVALID_USE_OF_CMB | NVME_DNR;
622 }
623
624 if (cmb) {
625 return nvme_map_addr_cmb(n, &sg->iov, addr, len);
626 } else {
627 return nvme_map_addr_pmr(n, &sg->iov, addr, len);
628 }
629 }
630
631 if (!(sg->flags & NVME_SG_DMA)) {
632 return NVME_INVALID_USE_OF_CMB | NVME_DNR;
633 }
634
635 qemu_sglist_add(&sg->qsg, addr, len);
636
637 return NVME_SUCCESS;
638 }
639
640 static inline bool nvme_addr_is_dma(NvmeCtrl *n, hwaddr addr)
641 {
642 return !(nvme_addr_is_cmb(n, addr) || nvme_addr_is_pmr(n, addr));
643 }
644
645 static uint16_t nvme_map_prp(NvmeCtrl *n, NvmeSg *sg, uint64_t prp1,
646 uint64_t prp2, uint32_t len)
647 {
648 hwaddr trans_len = n->page_size - (prp1 % n->page_size);
649 trans_len = MIN(len, trans_len);
650 int num_prps = (len >> n->page_bits) + 1;
651 uint16_t status;
652 int ret;
653
654 trace_pci_nvme_map_prp(trans_len, len, prp1, prp2, num_prps);
655
656 nvme_sg_init(n, sg, nvme_addr_is_dma(n, prp1));
657
658 status = nvme_map_addr(n, sg, prp1, trans_len);
659 if (status) {
660 goto unmap;
661 }
662
663 len -= trans_len;
664 if (len) {
665 if (len > n->page_size) {
666 uint64_t prp_list[n->max_prp_ents];
667 uint32_t nents, prp_trans;
668 int i = 0;
669
670 /*
671 * The first PRP list entry, pointed to by PRP2 may contain offset.
672 * Hence, we need to calculate the number of entries in based on
673 * that offset.
674 */
675 nents = (n->page_size - (prp2 & (n->page_size - 1))) >> 3;
676 prp_trans = MIN(n->max_prp_ents, nents) * sizeof(uint64_t);
677 ret = nvme_addr_read(n, prp2, (void *)prp_list, prp_trans);
678 if (ret) {
679 trace_pci_nvme_err_addr_read(prp2);
680 status = NVME_DATA_TRAS_ERROR;
681 goto unmap;
682 }
683 while (len != 0) {
684 uint64_t prp_ent = le64_to_cpu(prp_list[i]);
685
686 if (i == nents - 1 && len > n->page_size) {
687 if (unlikely(prp_ent & (n->page_size - 1))) {
688 trace_pci_nvme_err_invalid_prplist_ent(prp_ent);
689 status = NVME_INVALID_PRP_OFFSET | NVME_DNR;
690 goto unmap;
691 }
692
693 i = 0;
694 nents = (len + n->page_size - 1) >> n->page_bits;
695 nents = MIN(nents, n->max_prp_ents);
696 prp_trans = nents * sizeof(uint64_t);
697 ret = nvme_addr_read(n, prp_ent, (void *)prp_list,
698 prp_trans);
699 if (ret) {
700 trace_pci_nvme_err_addr_read(prp_ent);
701 status = NVME_DATA_TRAS_ERROR;
702 goto unmap;
703 }
704 prp_ent = le64_to_cpu(prp_list[i]);
705 }
706
707 if (unlikely(prp_ent & (n->page_size - 1))) {
708 trace_pci_nvme_err_invalid_prplist_ent(prp_ent);
709 status = NVME_INVALID_PRP_OFFSET | NVME_DNR;
710 goto unmap;
711 }
712
713 trans_len = MIN(len, n->page_size);
714 status = nvme_map_addr(n, sg, prp_ent, trans_len);
715 if (status) {
716 goto unmap;
717 }
718
719 len -= trans_len;
720 i++;
721 }
722 } else {
723 if (unlikely(prp2 & (n->page_size - 1))) {
724 trace_pci_nvme_err_invalid_prp2_align(prp2);
725 status = NVME_INVALID_PRP_OFFSET | NVME_DNR;
726 goto unmap;
727 }
728 status = nvme_map_addr(n, sg, prp2, len);
729 if (status) {
730 goto unmap;
731 }
732 }
733 }
734
735 return NVME_SUCCESS;
736
737 unmap:
738 nvme_sg_unmap(sg);
739 return status;
740 }
741
742 /*
743 * Map 'nsgld' data descriptors from 'segment'. The function will subtract the
744 * number of bytes mapped in len.
745 */
746 static uint16_t nvme_map_sgl_data(NvmeCtrl *n, NvmeSg *sg,
747 NvmeSglDescriptor *segment, uint64_t nsgld,
748 size_t *len, NvmeCmd *cmd)
749 {
750 dma_addr_t addr, trans_len;
751 uint32_t dlen;
752 uint16_t status;
753
754 for (int i = 0; i < nsgld; i++) {
755 uint8_t type = NVME_SGL_TYPE(segment[i].type);
756
757 switch (type) {
758 case NVME_SGL_DESCR_TYPE_BIT_BUCKET:
759 if (cmd->opcode == NVME_CMD_WRITE) {
760 continue;
761 }
762 case NVME_SGL_DESCR_TYPE_DATA_BLOCK:
763 break;
764 case NVME_SGL_DESCR_TYPE_SEGMENT:
765 case NVME_SGL_DESCR_TYPE_LAST_SEGMENT:
766 return NVME_INVALID_NUM_SGL_DESCRS | NVME_DNR;
767 default:
768 return NVME_SGL_DESCR_TYPE_INVALID | NVME_DNR;
769 }
770
771 dlen = le32_to_cpu(segment[i].len);
772
773 if (!dlen) {
774 continue;
775 }
776
777 if (*len == 0) {
778 /*
779 * All data has been mapped, but the SGL contains additional
780 * segments and/or descriptors. The controller might accept
781 * ignoring the rest of the SGL.
782 */
783 uint32_t sgls = le32_to_cpu(n->id_ctrl.sgls);
784 if (sgls & NVME_CTRL_SGLS_EXCESS_LENGTH) {
785 break;
786 }
787
788 trace_pci_nvme_err_invalid_sgl_excess_length(dlen);
789 return NVME_DATA_SGL_LEN_INVALID | NVME_DNR;
790 }
791
792 trans_len = MIN(*len, dlen);
793
794 if (type == NVME_SGL_DESCR_TYPE_BIT_BUCKET) {
795 goto next;
796 }
797
798 addr = le64_to_cpu(segment[i].addr);
799
800 if (UINT64_MAX - addr < dlen) {
801 return NVME_DATA_SGL_LEN_INVALID | NVME_DNR;
802 }
803
804 status = nvme_map_addr(n, sg, addr, trans_len);
805 if (status) {
806 return status;
807 }
808
809 next:
810 *len -= trans_len;
811 }
812
813 return NVME_SUCCESS;
814 }
815
816 static uint16_t nvme_map_sgl(NvmeCtrl *n, NvmeSg *sg, NvmeSglDescriptor sgl,
817 size_t len, NvmeCmd *cmd)
818 {
819 /*
820 * Read the segment in chunks of 256 descriptors (one 4k page) to avoid
821 * dynamically allocating a potentially huge SGL. The spec allows the SGL
822 * to be larger (as in number of bytes required to describe the SGL
823 * descriptors and segment chain) than the command transfer size, so it is
824 * not bounded by MDTS.
825 */
826 const int SEG_CHUNK_SIZE = 256;
827
828 NvmeSglDescriptor segment[SEG_CHUNK_SIZE], *sgld, *last_sgld;
829 uint64_t nsgld;
830 uint32_t seg_len;
831 uint16_t status;
832 hwaddr addr;
833 int ret;
834
835 sgld = &sgl;
836 addr = le64_to_cpu(sgl.addr);
837
838 trace_pci_nvme_map_sgl(NVME_SGL_TYPE(sgl.type), len);
839
840 nvme_sg_init(n, sg, nvme_addr_is_dma(n, addr));
841
842 /*
843 * If the entire transfer can be described with a single data block it can
844 * be mapped directly.
845 */
846 if (NVME_SGL_TYPE(sgl.type) == NVME_SGL_DESCR_TYPE_DATA_BLOCK) {
847 status = nvme_map_sgl_data(n, sg, sgld, 1, &len, cmd);
848 if (status) {
849 goto unmap;
850 }
851
852 goto out;
853 }
854
855 for (;;) {
856 switch (NVME_SGL_TYPE(sgld->type)) {
857 case NVME_SGL_DESCR_TYPE_SEGMENT:
858 case NVME_SGL_DESCR_TYPE_LAST_SEGMENT:
859 break;
860 default:
861 return NVME_INVALID_SGL_SEG_DESCR | NVME_DNR;
862 }
863
864 seg_len = le32_to_cpu(sgld->len);
865
866 /* check the length of the (Last) Segment descriptor */
867 if ((!seg_len || seg_len & 0xf) &&
868 (NVME_SGL_TYPE(sgld->type) != NVME_SGL_DESCR_TYPE_BIT_BUCKET)) {
869 return NVME_INVALID_SGL_SEG_DESCR | NVME_DNR;
870 }
871
872 if (UINT64_MAX - addr < seg_len) {
873 return NVME_DATA_SGL_LEN_INVALID | NVME_DNR;
874 }
875
876 nsgld = seg_len / sizeof(NvmeSglDescriptor);
877
878 while (nsgld > SEG_CHUNK_SIZE) {
879 if (nvme_addr_read(n, addr, segment, sizeof(segment))) {
880 trace_pci_nvme_err_addr_read(addr);
881 status = NVME_DATA_TRAS_ERROR;
882 goto unmap;
883 }
884
885 status = nvme_map_sgl_data(n, sg, segment, SEG_CHUNK_SIZE,
886 &len, cmd);
887 if (status) {
888 goto unmap;
889 }
890
891 nsgld -= SEG_CHUNK_SIZE;
892 addr += SEG_CHUNK_SIZE * sizeof(NvmeSglDescriptor);
893 }
894
895 ret = nvme_addr_read(n, addr, segment, nsgld *
896 sizeof(NvmeSglDescriptor));
897 if (ret) {
898 trace_pci_nvme_err_addr_read(addr);
899 status = NVME_DATA_TRAS_ERROR;
900 goto unmap;
901 }
902
903 last_sgld = &segment[nsgld - 1];
904
905 /*
906 * If the segment ends with a Data Block or Bit Bucket Descriptor Type,
907 * then we are done.
908 */
909 switch (NVME_SGL_TYPE(last_sgld->type)) {
910 case NVME_SGL_DESCR_TYPE_DATA_BLOCK:
911 case NVME_SGL_DESCR_TYPE_BIT_BUCKET:
912 status = nvme_map_sgl_data(n, sg, segment, nsgld, &len, cmd);
913 if (status) {
914 goto unmap;
915 }
916
917 goto out;
918
919 default:
920 break;
921 }
922
923 /*
924 * If the last descriptor was not a Data Block or Bit Bucket, then the
925 * current segment must not be a Last Segment.
926 */
927 if (NVME_SGL_TYPE(sgld->type) == NVME_SGL_DESCR_TYPE_LAST_SEGMENT) {
928 status = NVME_INVALID_SGL_SEG_DESCR | NVME_DNR;
929 goto unmap;
930 }
931
932 sgld = last_sgld;
933 addr = le64_to_cpu(sgld->addr);
934
935 /*
936 * Do not map the last descriptor; it will be a Segment or Last Segment
937 * descriptor and is handled by the next iteration.
938 */
939 status = nvme_map_sgl_data(n, sg, segment, nsgld - 1, &len, cmd);
940 if (status) {
941 goto unmap;
942 }
943 }
944
945 out:
946 /* if there is any residual left in len, the SGL was too short */
947 if (len) {
948 status = NVME_DATA_SGL_LEN_INVALID | NVME_DNR;
949 goto unmap;
950 }
951
952 return NVME_SUCCESS;
953
954 unmap:
955 nvme_sg_unmap(sg);
956 return status;
957 }
958
959 uint16_t nvme_map_dptr(NvmeCtrl *n, NvmeSg *sg, size_t len,
960 NvmeCmd *cmd)
961 {
962 uint64_t prp1, prp2;
963
964 switch (NVME_CMD_FLAGS_PSDT(cmd->flags)) {
965 case NVME_PSDT_PRP:
966 prp1 = le64_to_cpu(cmd->dptr.prp1);
967 prp2 = le64_to_cpu(cmd->dptr.prp2);
968
969 return nvme_map_prp(n, sg, prp1, prp2, len);
970 case NVME_PSDT_SGL_MPTR_CONTIGUOUS:
971 case NVME_PSDT_SGL_MPTR_SGL:
972 return nvme_map_sgl(n, sg, cmd->dptr.sgl, len, cmd);
973 default:
974 return NVME_INVALID_FIELD;
975 }
976 }
977
978 static uint16_t nvme_map_mptr(NvmeCtrl *n, NvmeSg *sg, size_t len,
979 NvmeCmd *cmd)
980 {
981 int psdt = NVME_CMD_FLAGS_PSDT(cmd->flags);
982 hwaddr mptr = le64_to_cpu(cmd->mptr);
983 uint16_t status;
984
985 if (psdt == NVME_PSDT_SGL_MPTR_SGL) {
986 NvmeSglDescriptor sgl;
987
988 if (nvme_addr_read(n, mptr, &sgl, sizeof(sgl))) {
989 return NVME_DATA_TRAS_ERROR;
990 }
991
992 status = nvme_map_sgl(n, sg, sgl, len, cmd);
993 if (status && (status & 0x7ff) == NVME_DATA_SGL_LEN_INVALID) {
994 status = NVME_MD_SGL_LEN_INVALID | NVME_DNR;
995 }
996
997 return status;
998 }
999
1000 nvme_sg_init(n, sg, nvme_addr_is_dma(n, mptr));
1001 status = nvme_map_addr(n, sg, mptr, len);
1002 if (status) {
1003 nvme_sg_unmap(sg);
1004 }
1005
1006 return status;
1007 }
1008
1009 static uint16_t nvme_map_data(NvmeCtrl *n, uint32_t nlb, NvmeRequest *req)
1010 {
1011 NvmeNamespace *ns = req->ns;
1012 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd;
1013 bool pi = !!NVME_ID_NS_DPS_TYPE(ns->id_ns.dps);
1014 bool pract = !!(le16_to_cpu(rw->control) & NVME_RW_PRINFO_PRACT);
1015 size_t len = nvme_l2b(ns, nlb);
1016 uint16_t status;
1017
1018 if (nvme_ns_ext(ns) && !(pi && pract && ns->lbaf.ms == 8)) {
1019 NvmeSg sg;
1020
1021 len += nvme_m2b(ns, nlb);
1022
1023 status = nvme_map_dptr(n, &sg, len, &req->cmd);
1024 if (status) {
1025 return status;
1026 }
1027
1028 nvme_sg_init(n, &req->sg, sg.flags & NVME_SG_DMA);
1029 nvme_sg_split(&sg, ns, &req->sg, NULL);
1030 nvme_sg_unmap(&sg);
1031
1032 return NVME_SUCCESS;
1033 }
1034
1035 return nvme_map_dptr(n, &req->sg, len, &req->cmd);
1036 }
1037
1038 static uint16_t nvme_map_mdata(NvmeCtrl *n, uint32_t nlb, NvmeRequest *req)
1039 {
1040 NvmeNamespace *ns = req->ns;
1041 size_t len = nvme_m2b(ns, nlb);
1042 uint16_t status;
1043
1044 if (nvme_ns_ext(ns)) {
1045 NvmeSg sg;
1046
1047 len += nvme_l2b(ns, nlb);
1048
1049 status = nvme_map_dptr(n, &sg, len, &req->cmd);
1050 if (status) {
1051 return status;
1052 }
1053
1054 nvme_sg_init(n, &req->sg, sg.flags & NVME_SG_DMA);
1055 nvme_sg_split(&sg, ns, NULL, &req->sg);
1056 nvme_sg_unmap(&sg);
1057
1058 return NVME_SUCCESS;
1059 }
1060
1061 return nvme_map_mptr(n, &req->sg, len, &req->cmd);
1062 }
1063
1064 static uint16_t nvme_tx_interleaved(NvmeCtrl *n, NvmeSg *sg, uint8_t *ptr,
1065 uint32_t len, uint32_t bytes,
1066 int32_t skip_bytes, int64_t offset,
1067 NvmeTxDirection dir)
1068 {
1069 hwaddr addr;
1070 uint32_t trans_len, count = bytes;
1071 bool dma = sg->flags & NVME_SG_DMA;
1072 int64_t sge_len;
1073 int sg_idx = 0;
1074 int ret;
1075
1076 assert(sg->flags & NVME_SG_ALLOC);
1077
1078 while (len) {
1079 sge_len = dma ? sg->qsg.sg[sg_idx].len : sg->iov.iov[sg_idx].iov_len;
1080
1081 if (sge_len - offset < 0) {
1082 offset -= sge_len;
1083 sg_idx++;
1084 continue;
1085 }
1086
1087 if (sge_len == offset) {
1088 offset = 0;
1089 sg_idx++;
1090 continue;
1091 }
1092
1093 trans_len = MIN(len, count);
1094 trans_len = MIN(trans_len, sge_len - offset);
1095
1096 if (dma) {
1097 addr = sg->qsg.sg[sg_idx].base + offset;
1098 } else {
1099 addr = (hwaddr)(uintptr_t)sg->iov.iov[sg_idx].iov_base + offset;
1100 }
1101
1102 if (dir == NVME_TX_DIRECTION_TO_DEVICE) {
1103 ret = nvme_addr_read(n, addr, ptr, trans_len);
1104 } else {
1105 ret = nvme_addr_write(n, addr, ptr, trans_len);
1106 }
1107
1108 if (ret) {
1109 return NVME_DATA_TRAS_ERROR;
1110 }
1111
1112 ptr += trans_len;
1113 len -= trans_len;
1114 count -= trans_len;
1115 offset += trans_len;
1116
1117 if (count == 0) {
1118 count = bytes;
1119 offset += skip_bytes;
1120 }
1121 }
1122
1123 return NVME_SUCCESS;
1124 }
1125
1126 static uint16_t nvme_tx(NvmeCtrl *n, NvmeSg *sg, uint8_t *ptr, uint32_t len,
1127 NvmeTxDirection dir)
1128 {
1129 assert(sg->flags & NVME_SG_ALLOC);
1130
1131 if (sg->flags & NVME_SG_DMA) {
1132 uint64_t residual;
1133
1134 if (dir == NVME_TX_DIRECTION_TO_DEVICE) {
1135 residual = dma_buf_write(ptr, len, &sg->qsg);
1136 } else {
1137 residual = dma_buf_read(ptr, len, &sg->qsg);
1138 }
1139
1140 if (unlikely(residual)) {
1141 trace_pci_nvme_err_invalid_dma();
1142 return NVME_INVALID_FIELD | NVME_DNR;
1143 }
1144 } else {
1145 size_t bytes;
1146
1147 if (dir == NVME_TX_DIRECTION_TO_DEVICE) {
1148 bytes = qemu_iovec_to_buf(&sg->iov, 0, ptr, len);
1149 } else {
1150 bytes = qemu_iovec_from_buf(&sg->iov, 0, ptr, len);
1151 }
1152
1153 if (unlikely(bytes != len)) {
1154 trace_pci_nvme_err_invalid_dma();
1155 return NVME_INVALID_FIELD | NVME_DNR;
1156 }
1157 }
1158
1159 return NVME_SUCCESS;
1160 }
1161
1162 static inline uint16_t nvme_c2h(NvmeCtrl *n, uint8_t *ptr, uint32_t len,
1163 NvmeRequest *req)
1164 {
1165 uint16_t status;
1166
1167 status = nvme_map_dptr(n, &req->sg, len, &req->cmd);
1168 if (status) {
1169 return status;
1170 }
1171
1172 return nvme_tx(n, &req->sg, ptr, len, NVME_TX_DIRECTION_FROM_DEVICE);
1173 }
1174
1175 static inline uint16_t nvme_h2c(NvmeCtrl *n, uint8_t *ptr, uint32_t len,
1176 NvmeRequest *req)
1177 {
1178 uint16_t status;
1179
1180 status = nvme_map_dptr(n, &req->sg, len, &req->cmd);
1181 if (status) {
1182 return status;
1183 }
1184
1185 return nvme_tx(n, &req->sg, ptr, len, NVME_TX_DIRECTION_TO_DEVICE);
1186 }
1187
1188 uint16_t nvme_bounce_data(NvmeCtrl *n, uint8_t *ptr, uint32_t len,
1189 NvmeTxDirection dir, NvmeRequest *req)
1190 {
1191 NvmeNamespace *ns = req->ns;
1192 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd;
1193 bool pi = !!NVME_ID_NS_DPS_TYPE(ns->id_ns.dps);
1194 bool pract = !!(le16_to_cpu(rw->control) & NVME_RW_PRINFO_PRACT);
1195
1196 if (nvme_ns_ext(ns) && !(pi && pract && ns->lbaf.ms == 8)) {
1197 return nvme_tx_interleaved(n, &req->sg, ptr, len, ns->lbasz,
1198 ns->lbaf.ms, 0, dir);
1199 }
1200
1201 return nvme_tx(n, &req->sg, ptr, len, dir);
1202 }
1203
1204 uint16_t nvme_bounce_mdata(NvmeCtrl *n, uint8_t *ptr, uint32_t len,
1205 NvmeTxDirection dir, NvmeRequest *req)
1206 {
1207 NvmeNamespace *ns = req->ns;
1208 uint16_t status;
1209
1210 if (nvme_ns_ext(ns)) {
1211 return nvme_tx_interleaved(n, &req->sg, ptr, len, ns->lbaf.ms,
1212 ns->lbasz, ns->lbasz, dir);
1213 }
1214
1215 nvme_sg_unmap(&req->sg);
1216
1217 status = nvme_map_mptr(n, &req->sg, len, &req->cmd);
1218 if (status) {
1219 return status;
1220 }
1221
1222 return nvme_tx(n, &req->sg, ptr, len, dir);
1223 }
1224
1225 static inline void nvme_blk_read(BlockBackend *blk, int64_t offset,
1226 BlockCompletionFunc *cb, NvmeRequest *req)
1227 {
1228 assert(req->sg.flags & NVME_SG_ALLOC);
1229
1230 if (req->sg.flags & NVME_SG_DMA) {
1231 req->aiocb = dma_blk_read(blk, &req->sg.qsg, offset, BDRV_SECTOR_SIZE,
1232 cb, req);
1233 } else {
1234 req->aiocb = blk_aio_preadv(blk, offset, &req->sg.iov, 0, cb, req);
1235 }
1236 }
1237
1238 static inline void nvme_blk_write(BlockBackend *blk, int64_t offset,
1239 BlockCompletionFunc *cb, NvmeRequest *req)
1240 {
1241 assert(req->sg.flags & NVME_SG_ALLOC);
1242
1243 if (req->sg.flags & NVME_SG_DMA) {
1244 req->aiocb = dma_blk_write(blk, &req->sg.qsg, offset, BDRV_SECTOR_SIZE,
1245 cb, req);
1246 } else {
1247 req->aiocb = blk_aio_pwritev(blk, offset, &req->sg.iov, 0, cb, req);
1248 }
1249 }
1250
1251 static void nvme_post_cqes(void *opaque)
1252 {
1253 NvmeCQueue *cq = opaque;
1254 NvmeCtrl *n = cq->ctrl;
1255 NvmeRequest *req, *next;
1256 int ret;
1257
1258 QTAILQ_FOREACH_SAFE(req, &cq->req_list, entry, next) {
1259 NvmeSQueue *sq;
1260 hwaddr addr;
1261
1262 if (nvme_cq_full(cq)) {
1263 break;
1264 }
1265
1266 sq = req->sq;
1267 req->cqe.status = cpu_to_le16((req->status << 1) | cq->phase);
1268 req->cqe.sq_id = cpu_to_le16(sq->sqid);
1269 req->cqe.sq_head = cpu_to_le16(sq->head);
1270 addr = cq->dma_addr + cq->tail * n->cqe_size;
1271 ret = pci_dma_write(&n->parent_obj, addr, (void *)&req->cqe,
1272 sizeof(req->cqe));
1273 if (ret) {
1274 trace_pci_nvme_err_addr_write(addr);
1275 trace_pci_nvme_err_cfs();
1276 n->bar.csts = NVME_CSTS_FAILED;
1277 break;
1278 }
1279 QTAILQ_REMOVE(&cq->req_list, req, entry);
1280 nvme_inc_cq_tail(cq);
1281 nvme_sg_unmap(&req->sg);
1282 QTAILQ_INSERT_TAIL(&sq->req_list, req, entry);
1283 }
1284 if (cq->tail != cq->head) {
1285 nvme_irq_assert(n, cq);
1286 }
1287 }
1288
1289 static void nvme_enqueue_req_completion(NvmeCQueue *cq, NvmeRequest *req)
1290 {
1291 assert(cq->cqid == req->sq->cqid);
1292 trace_pci_nvme_enqueue_req_completion(nvme_cid(req), cq->cqid,
1293 le32_to_cpu(req->cqe.result),
1294 le32_to_cpu(req->cqe.dw1),
1295 req->status);
1296
1297 if (req->status) {
1298 trace_pci_nvme_err_req_status(nvme_cid(req), nvme_nsid(req->ns),
1299 req->status, req->cmd.opcode);
1300 }
1301
1302 QTAILQ_REMOVE(&req->sq->out_req_list, req, entry);
1303 QTAILQ_INSERT_TAIL(&cq->req_list, req, entry);
1304 timer_mod(cq->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 500);
1305 }
1306
1307 static void nvme_process_aers(void *opaque)
1308 {
1309 NvmeCtrl *n = opaque;
1310 NvmeAsyncEvent *event, *next;
1311
1312 trace_pci_nvme_process_aers(n->aer_queued);
1313
1314 QTAILQ_FOREACH_SAFE(event, &n->aer_queue, entry, next) {
1315 NvmeRequest *req;
1316 NvmeAerResult *result;
1317
1318 /* can't post cqe if there is nothing to complete */
1319 if (!n->outstanding_aers) {
1320 trace_pci_nvme_no_outstanding_aers();
1321 break;
1322 }
1323
1324 /* ignore if masked (cqe posted, but event not cleared) */
1325 if (n->aer_mask & (1 << event->result.event_type)) {
1326 trace_pci_nvme_aer_masked(event->result.event_type, n->aer_mask);
1327 continue;
1328 }
1329
1330 QTAILQ_REMOVE(&n->aer_queue, event, entry);
1331 n->aer_queued--;
1332
1333 n->aer_mask |= 1 << event->result.event_type;
1334 n->outstanding_aers--;
1335
1336 req = n->aer_reqs[n->outstanding_aers];
1337
1338 result = (NvmeAerResult *) &req->cqe.result;
1339 result->event_type = event->result.event_type;
1340 result->event_info = event->result.event_info;
1341 result->log_page = event->result.log_page;
1342 g_free(event);
1343
1344 trace_pci_nvme_aer_post_cqe(result->event_type, result->event_info,
1345 result->log_page);
1346
1347 nvme_enqueue_req_completion(&n->admin_cq, req);
1348 }
1349 }
1350
1351 static void nvme_enqueue_event(NvmeCtrl *n, uint8_t event_type,
1352 uint8_t event_info, uint8_t log_page)
1353 {
1354 NvmeAsyncEvent *event;
1355
1356 trace_pci_nvme_enqueue_event(event_type, event_info, log_page);
1357
1358 if (n->aer_queued == n->params.aer_max_queued) {
1359 trace_pci_nvme_enqueue_event_noqueue(n->aer_queued);
1360 return;
1361 }
1362
1363 event = g_new(NvmeAsyncEvent, 1);
1364 event->result = (NvmeAerResult) {
1365 .event_type = event_type,
1366 .event_info = event_info,
1367 .log_page = log_page,
1368 };
1369
1370 QTAILQ_INSERT_TAIL(&n->aer_queue, event, entry);
1371 n->aer_queued++;
1372
1373 nvme_process_aers(n);
1374 }
1375
1376 static void nvme_smart_event(NvmeCtrl *n, uint8_t event)
1377 {
1378 uint8_t aer_info;
1379
1380 /* Ref SPEC <Asynchronous Event Information 0x2013 SMART / Health Status> */
1381 if (!(NVME_AEC_SMART(n->features.async_config) & event)) {
1382 return;
1383 }
1384
1385 switch (event) {
1386 case NVME_SMART_SPARE:
1387 aer_info = NVME_AER_INFO_SMART_SPARE_THRESH;
1388 break;
1389 case NVME_SMART_TEMPERATURE:
1390 aer_info = NVME_AER_INFO_SMART_TEMP_THRESH;
1391 break;
1392 case NVME_SMART_RELIABILITY:
1393 case NVME_SMART_MEDIA_READ_ONLY:
1394 case NVME_SMART_FAILED_VOLATILE_MEDIA:
1395 case NVME_SMART_PMR_UNRELIABLE:
1396 aer_info = NVME_AER_INFO_SMART_RELIABILITY;
1397 break;
1398 default:
1399 return;
1400 }
1401
1402 nvme_enqueue_event(n, NVME_AER_TYPE_SMART, aer_info, NVME_LOG_SMART_INFO);
1403 }
1404
1405 static void nvme_clear_events(NvmeCtrl *n, uint8_t event_type)
1406 {
1407 n->aer_mask &= ~(1 << event_type);
1408 if (!QTAILQ_EMPTY(&n->aer_queue)) {
1409 nvme_process_aers(n);
1410 }
1411 }
1412
1413 static inline uint16_t nvme_check_mdts(NvmeCtrl *n, size_t len)
1414 {
1415 uint8_t mdts = n->params.mdts;
1416
1417 if (mdts && len > n->page_size << mdts) {
1418 trace_pci_nvme_err_mdts(len);
1419 return NVME_INVALID_FIELD | NVME_DNR;
1420 }
1421
1422 return NVME_SUCCESS;
1423 }
1424
1425 static inline uint16_t nvme_check_bounds(NvmeNamespace *ns, uint64_t slba,
1426 uint32_t nlb)
1427 {
1428 uint64_t nsze = le64_to_cpu(ns->id_ns.nsze);
1429
1430 if (unlikely(UINT64_MAX - slba < nlb || slba + nlb > nsze)) {
1431 trace_pci_nvme_err_invalid_lba_range(slba, nlb, nsze);
1432 return NVME_LBA_RANGE | NVME_DNR;
1433 }
1434
1435 return NVME_SUCCESS;
1436 }
1437
1438 static int nvme_block_status_all(NvmeNamespace *ns, uint64_t slba,
1439 uint32_t nlb, int flags)
1440 {
1441 BlockDriverState *bs = blk_bs(ns->blkconf.blk);
1442
1443 int64_t pnum = 0, bytes = nvme_l2b(ns, nlb);
1444 int64_t offset = nvme_l2b(ns, slba);
1445 int ret;
1446
1447 /*
1448 * `pnum` holds the number of bytes after offset that shares the same
1449 * allocation status as the byte at offset. If `pnum` is different from
1450 * `bytes`, we should check the allocation status of the next range and
1451 * continue this until all bytes have been checked.
1452 */
1453 do {
1454 bytes -= pnum;
1455
1456 ret = bdrv_block_status(bs, offset, bytes, &pnum, NULL, NULL);
1457 if (ret < 0) {
1458 return ret;
1459 }
1460
1461
1462 trace_pci_nvme_block_status(offset, bytes, pnum, ret,
1463 !!(ret & BDRV_BLOCK_ZERO));
1464
1465 if (!(ret & flags)) {
1466 return 1;
1467 }
1468
1469 offset += pnum;
1470 } while (pnum != bytes);
1471
1472 return 0;
1473 }
1474
1475 static uint16_t nvme_check_dulbe(NvmeNamespace *ns, uint64_t slba,
1476 uint32_t nlb)
1477 {
1478 int ret;
1479 Error *err = NULL;
1480
1481 ret = nvme_block_status_all(ns, slba, nlb, BDRV_BLOCK_DATA);
1482 if (ret) {
1483 if (ret < 0) {
1484 error_setg_errno(&err, -ret, "unable to get block status");
1485 error_report_err(err);
1486
1487 return NVME_INTERNAL_DEV_ERROR;
1488 }
1489
1490 return NVME_DULB;
1491 }
1492
1493 return NVME_SUCCESS;
1494 }
1495
1496 static void nvme_aio_err(NvmeRequest *req, int ret)
1497 {
1498 uint16_t status = NVME_SUCCESS;
1499 Error *local_err = NULL;
1500
1501 switch (req->cmd.opcode) {
1502 case NVME_CMD_READ:
1503 status = NVME_UNRECOVERED_READ;
1504 break;
1505 case NVME_CMD_FLUSH:
1506 case NVME_CMD_WRITE:
1507 case NVME_CMD_WRITE_ZEROES:
1508 case NVME_CMD_ZONE_APPEND:
1509 status = NVME_WRITE_FAULT;
1510 break;
1511 default:
1512 status = NVME_INTERNAL_DEV_ERROR;
1513 break;
1514 }
1515
1516 trace_pci_nvme_err_aio(nvme_cid(req), strerror(-ret), status);
1517
1518 error_setg_errno(&local_err, -ret, "aio failed");
1519 error_report_err(local_err);
1520
1521 /*
1522 * Set the command status code to the first encountered error but allow a
1523 * subsequent Internal Device Error to trump it.
1524 */
1525 if (req->status && status != NVME_INTERNAL_DEV_ERROR) {
1526 return;
1527 }
1528
1529 req->status = status;
1530 }
1531
1532 static inline uint32_t nvme_zone_idx(NvmeNamespace *ns, uint64_t slba)
1533 {
1534 return ns->zone_size_log2 > 0 ? slba >> ns->zone_size_log2 :
1535 slba / ns->zone_size;
1536 }
1537
1538 static inline NvmeZone *nvme_get_zone_by_slba(NvmeNamespace *ns, uint64_t slba)
1539 {
1540 uint32_t zone_idx = nvme_zone_idx(ns, slba);
1541
1542 if (zone_idx >= ns->num_zones) {
1543 return NULL;
1544 }
1545
1546 return &ns->zone_array[zone_idx];
1547 }
1548
1549 static uint16_t nvme_check_zone_state_for_write(NvmeZone *zone)
1550 {
1551 uint64_t zslba = zone->d.zslba;
1552
1553 switch (nvme_get_zone_state(zone)) {
1554 case NVME_ZONE_STATE_EMPTY:
1555 case NVME_ZONE_STATE_IMPLICITLY_OPEN:
1556 case NVME_ZONE_STATE_EXPLICITLY_OPEN:
1557 case NVME_ZONE_STATE_CLOSED:
1558 return NVME_SUCCESS;
1559 case NVME_ZONE_STATE_FULL:
1560 trace_pci_nvme_err_zone_is_full(zslba);
1561 return NVME_ZONE_FULL;
1562 case NVME_ZONE_STATE_OFFLINE:
1563 trace_pci_nvme_err_zone_is_offline(zslba);
1564 return NVME_ZONE_OFFLINE;
1565 case NVME_ZONE_STATE_READ_ONLY:
1566 trace_pci_nvme_err_zone_is_read_only(zslba);
1567 return NVME_ZONE_READ_ONLY;
1568 default:
1569 assert(false);
1570 }
1571
1572 return NVME_INTERNAL_DEV_ERROR;
1573 }
1574
1575 static uint16_t nvme_check_zone_write(NvmeNamespace *ns, NvmeZone *zone,
1576 uint64_t slba, uint32_t nlb)
1577 {
1578 uint64_t zcap = nvme_zone_wr_boundary(zone);
1579 uint16_t status;
1580
1581 status = nvme_check_zone_state_for_write(zone);
1582 if (status) {
1583 return status;
1584 }
1585
1586 if (unlikely(slba != zone->w_ptr)) {
1587 trace_pci_nvme_err_write_not_at_wp(slba, zone->d.zslba, zone->w_ptr);
1588 return NVME_ZONE_INVALID_WRITE;
1589 }
1590
1591 if (unlikely((slba + nlb) > zcap)) {
1592 trace_pci_nvme_err_zone_boundary(slba, nlb, zcap);
1593 return NVME_ZONE_BOUNDARY_ERROR;
1594 }
1595
1596 return NVME_SUCCESS;
1597 }
1598
1599 static uint16_t nvme_check_zone_state_for_read(NvmeZone *zone)
1600 {
1601 switch (nvme_get_zone_state(zone)) {
1602 case NVME_ZONE_STATE_EMPTY:
1603 case NVME_ZONE_STATE_IMPLICITLY_OPEN:
1604 case NVME_ZONE_STATE_EXPLICITLY_OPEN:
1605 case NVME_ZONE_STATE_FULL:
1606 case NVME_ZONE_STATE_CLOSED:
1607 case NVME_ZONE_STATE_READ_ONLY:
1608 return NVME_SUCCESS;
1609 case NVME_ZONE_STATE_OFFLINE:
1610 trace_pci_nvme_err_zone_is_offline(zone->d.zslba);
1611 return NVME_ZONE_OFFLINE;
1612 default:
1613 assert(false);
1614 }
1615
1616 return NVME_INTERNAL_DEV_ERROR;
1617 }
1618
1619 static uint16_t nvme_check_zone_read(NvmeNamespace *ns, uint64_t slba,
1620 uint32_t nlb)
1621 {
1622 NvmeZone *zone;
1623 uint64_t bndry, end;
1624 uint16_t status;
1625
1626 zone = nvme_get_zone_by_slba(ns, slba);
1627 assert(zone);
1628
1629 bndry = nvme_zone_rd_boundary(ns, zone);
1630 end = slba + nlb;
1631
1632 status = nvme_check_zone_state_for_read(zone);
1633 if (status) {
1634 ;
1635 } else if (unlikely(end > bndry)) {
1636 if (!ns->params.cross_zone_read) {
1637 status = NVME_ZONE_BOUNDARY_ERROR;
1638 } else {
1639 /*
1640 * Read across zone boundary - check that all subsequent
1641 * zones that are being read have an appropriate state.
1642 */
1643 do {
1644 zone++;
1645 status = nvme_check_zone_state_for_read(zone);
1646 if (status) {
1647 break;
1648 }
1649 } while (end > nvme_zone_rd_boundary(ns, zone));
1650 }
1651 }
1652
1653 return status;
1654 }
1655
1656 static uint16_t nvme_zrm_finish(NvmeNamespace *ns, NvmeZone *zone)
1657 {
1658 switch (nvme_get_zone_state(zone)) {
1659 case NVME_ZONE_STATE_FULL:
1660 return NVME_SUCCESS;
1661
1662 case NVME_ZONE_STATE_IMPLICITLY_OPEN:
1663 case NVME_ZONE_STATE_EXPLICITLY_OPEN:
1664 nvme_aor_dec_open(ns);
1665 /* fallthrough */
1666 case NVME_ZONE_STATE_CLOSED:
1667 nvme_aor_dec_active(ns);
1668 /* fallthrough */
1669 case NVME_ZONE_STATE_EMPTY:
1670 nvme_assign_zone_state(ns, zone, NVME_ZONE_STATE_FULL);
1671 return NVME_SUCCESS;
1672
1673 default:
1674 return NVME_ZONE_INVAL_TRANSITION;
1675 }
1676 }
1677
1678 static uint16_t nvme_zrm_close(NvmeNamespace *ns, NvmeZone *zone)
1679 {
1680 switch (nvme_get_zone_state(zone)) {
1681 case NVME_ZONE_STATE_EXPLICITLY_OPEN:
1682 case NVME_ZONE_STATE_IMPLICITLY_OPEN:
1683 nvme_aor_dec_open(ns);
1684 nvme_assign_zone_state(ns, zone, NVME_ZONE_STATE_CLOSED);
1685 /* fall through */
1686 case NVME_ZONE_STATE_CLOSED:
1687 return NVME_SUCCESS;
1688
1689 default:
1690 return NVME_ZONE_INVAL_TRANSITION;
1691 }
1692 }
1693
1694 static uint16_t nvme_zrm_reset(NvmeNamespace *ns, NvmeZone *zone)
1695 {
1696 switch (nvme_get_zone_state(zone)) {
1697 case NVME_ZONE_STATE_EXPLICITLY_OPEN:
1698 case NVME_ZONE_STATE_IMPLICITLY_OPEN:
1699 nvme_aor_dec_open(ns);
1700 /* fallthrough */
1701 case NVME_ZONE_STATE_CLOSED:
1702 nvme_aor_dec_active(ns);
1703 /* fallthrough */
1704 case NVME_ZONE_STATE_FULL:
1705 zone->w_ptr = zone->d.zslba;
1706 zone->d.wp = zone->w_ptr;
1707 nvme_assign_zone_state(ns, zone, NVME_ZONE_STATE_EMPTY);
1708 /* fallthrough */
1709 case NVME_ZONE_STATE_EMPTY:
1710 return NVME_SUCCESS;
1711
1712 default:
1713 return NVME_ZONE_INVAL_TRANSITION;
1714 }
1715 }
1716
1717 static void nvme_zrm_auto_transition_zone(NvmeNamespace *ns)
1718 {
1719 NvmeZone *zone;
1720
1721 if (ns->params.max_open_zones &&
1722 ns->nr_open_zones == ns->params.max_open_zones) {
1723 zone = QTAILQ_FIRST(&ns->imp_open_zones);
1724 if (zone) {
1725 /*
1726 * Automatically close this implicitly open zone.
1727 */
1728 QTAILQ_REMOVE(&ns->imp_open_zones, zone, entry);
1729 nvme_zrm_close(ns, zone);
1730 }
1731 }
1732 }
1733
1734 enum {
1735 NVME_ZRM_AUTO = 1 << 0,
1736 };
1737
1738 static uint16_t nvme_zrm_open_flags(NvmeCtrl *n, NvmeNamespace *ns,
1739 NvmeZone *zone, int flags)
1740 {
1741 int act = 0;
1742 uint16_t status;
1743
1744 switch (nvme_get_zone_state(zone)) {
1745 case NVME_ZONE_STATE_EMPTY:
1746 act = 1;
1747
1748 /* fallthrough */
1749
1750 case NVME_ZONE_STATE_CLOSED:
1751 if (n->params.auto_transition_zones) {
1752 nvme_zrm_auto_transition_zone(ns);
1753 }
1754 status = nvme_aor_check(ns, act, 1);
1755 if (status) {
1756 return status;
1757 }
1758
1759 if (act) {
1760 nvme_aor_inc_active(ns);
1761 }
1762
1763 nvme_aor_inc_open(ns);
1764
1765 if (flags & NVME_ZRM_AUTO) {
1766 nvme_assign_zone_state(ns, zone, NVME_ZONE_STATE_IMPLICITLY_OPEN);
1767 return NVME_SUCCESS;
1768 }
1769
1770 /* fallthrough */
1771
1772 case NVME_ZONE_STATE_IMPLICITLY_OPEN:
1773 if (flags & NVME_ZRM_AUTO) {
1774 return NVME_SUCCESS;
1775 }
1776
1777 nvme_assign_zone_state(ns, zone, NVME_ZONE_STATE_EXPLICITLY_OPEN);
1778
1779 /* fallthrough */
1780
1781 case NVME_ZONE_STATE_EXPLICITLY_OPEN:
1782 return NVME_SUCCESS;
1783
1784 default:
1785 return NVME_ZONE_INVAL_TRANSITION;
1786 }
1787 }
1788
1789 static inline uint16_t nvme_zrm_auto(NvmeCtrl *n, NvmeNamespace *ns,
1790 NvmeZone *zone)
1791 {
1792 return nvme_zrm_open_flags(n, ns, zone, NVME_ZRM_AUTO);
1793 }
1794
1795 static inline uint16_t nvme_zrm_open(NvmeCtrl *n, NvmeNamespace *ns,
1796 NvmeZone *zone)
1797 {
1798 return nvme_zrm_open_flags(n, ns, zone, 0);
1799 }
1800
1801 static void nvme_advance_zone_wp(NvmeNamespace *ns, NvmeZone *zone,
1802 uint32_t nlb)
1803 {
1804 zone->d.wp += nlb;
1805
1806 if (zone->d.wp == nvme_zone_wr_boundary(zone)) {
1807 nvme_zrm_finish(ns, zone);
1808 }
1809 }
1810
1811 static void nvme_finalize_zoned_write(NvmeNamespace *ns, NvmeRequest *req)
1812 {
1813 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd;
1814 NvmeZone *zone;
1815 uint64_t slba;
1816 uint32_t nlb;
1817
1818 slba = le64_to_cpu(rw->slba);
1819 nlb = le16_to_cpu(rw->nlb) + 1;
1820 zone = nvme_get_zone_by_slba(ns, slba);
1821 assert(zone);
1822
1823 nvme_advance_zone_wp(ns, zone, nlb);
1824 }
1825
1826 static inline bool nvme_is_write(NvmeRequest *req)
1827 {
1828 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd;
1829
1830 return rw->opcode == NVME_CMD_WRITE ||
1831 rw->opcode == NVME_CMD_ZONE_APPEND ||
1832 rw->opcode == NVME_CMD_WRITE_ZEROES;
1833 }
1834
1835 static AioContext *nvme_get_aio_context(BlockAIOCB *acb)
1836 {
1837 return qemu_get_aio_context();
1838 }
1839
1840 static void nvme_misc_cb(void *opaque, int ret)
1841 {
1842 NvmeRequest *req = opaque;
1843
1844 trace_pci_nvme_misc_cb(nvme_cid(req));
1845
1846 if (ret) {
1847 nvme_aio_err(req, ret);
1848 }
1849
1850 nvme_enqueue_req_completion(nvme_cq(req), req);
1851 }
1852
1853 void nvme_rw_complete_cb(void *opaque, int ret)
1854 {
1855 NvmeRequest *req = opaque;
1856 NvmeNamespace *ns = req->ns;
1857 BlockBackend *blk = ns->blkconf.blk;
1858 BlockAcctCookie *acct = &req->acct;
1859 BlockAcctStats *stats = blk_get_stats(blk);
1860
1861 trace_pci_nvme_rw_complete_cb(nvme_cid(req), blk_name(blk));
1862
1863 if (ret) {
1864 block_acct_failed(stats, acct);
1865 nvme_aio_err(req, ret);
1866 } else {
1867 block_acct_done(stats, acct);
1868 }
1869
1870 if (ns->params.zoned && nvme_is_write(req)) {
1871 nvme_finalize_zoned_write(ns, req);
1872 }
1873
1874 nvme_enqueue_req_completion(nvme_cq(req), req);
1875 }
1876
1877 static void nvme_rw_cb(void *opaque, int ret)
1878 {
1879 NvmeRequest *req = opaque;
1880 NvmeNamespace *ns = req->ns;
1881
1882 BlockBackend *blk = ns->blkconf.blk;
1883
1884 trace_pci_nvme_rw_cb(nvme_cid(req), blk_name(blk));
1885
1886 if (ret) {
1887 goto out;
1888 }
1889
1890 if (ns->lbaf.ms) {
1891 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd;
1892 uint64_t slba = le64_to_cpu(rw->slba);
1893 uint32_t nlb = (uint32_t)le16_to_cpu(rw->nlb) + 1;
1894 uint64_t offset = nvme_moff(ns, slba);
1895
1896 if (req->cmd.opcode == NVME_CMD_WRITE_ZEROES) {
1897 size_t mlen = nvme_m2b(ns, nlb);
1898
1899 req->aiocb = blk_aio_pwrite_zeroes(blk, offset, mlen,
1900 BDRV_REQ_MAY_UNMAP,
1901 nvme_rw_complete_cb, req);
1902 return;
1903 }
1904
1905 if (nvme_ns_ext(ns) || req->cmd.mptr) {
1906 uint16_t status;
1907
1908 nvme_sg_unmap(&req->sg);
1909 status = nvme_map_mdata(nvme_ctrl(req), nlb, req);
1910 if (status) {
1911 ret = -EFAULT;
1912 goto out;
1913 }
1914
1915 if (req->cmd.opcode == NVME_CMD_READ) {
1916 return nvme_blk_read(blk, offset, nvme_rw_complete_cb, req);
1917 }
1918
1919 return nvme_blk_write(blk, offset, nvme_rw_complete_cb, req);
1920 }
1921 }
1922
1923 out:
1924 nvme_rw_complete_cb(req, ret);
1925 }
1926
1927 static void nvme_verify_cb(void *opaque, int ret)
1928 {
1929 NvmeBounceContext *ctx = opaque;
1930 NvmeRequest *req = ctx->req;
1931 NvmeNamespace *ns = req->ns;
1932 BlockBackend *blk = ns->blkconf.blk;
1933 BlockAcctCookie *acct = &req->acct;
1934 BlockAcctStats *stats = blk_get_stats(blk);
1935 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd;
1936 uint64_t slba = le64_to_cpu(rw->slba);
1937 uint8_t prinfo = NVME_RW_PRINFO(le16_to_cpu(rw->control));
1938 uint16_t apptag = le16_to_cpu(rw->apptag);
1939 uint16_t appmask = le16_to_cpu(rw->appmask);
1940 uint32_t reftag = le32_to_cpu(rw->reftag);
1941 uint16_t status;
1942
1943 trace_pci_nvme_verify_cb(nvme_cid(req), prinfo, apptag, appmask, reftag);
1944
1945 if (ret) {
1946 block_acct_failed(stats, acct);
1947 nvme_aio_err(req, ret);
1948 goto out;
1949 }
1950
1951 block_acct_done(stats, acct);
1952
1953 if (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps)) {
1954 status = nvme_dif_mangle_mdata(ns, ctx->mdata.bounce,
1955 ctx->mdata.iov.size, slba);
1956 if (status) {
1957 req->status = status;
1958 goto out;
1959 }
1960
1961 req->status = nvme_dif_check(ns, ctx->data.bounce, ctx->data.iov.size,
1962 ctx->mdata.bounce, ctx->mdata.iov.size,
1963 prinfo, slba, apptag, appmask, &reftag);
1964 }
1965
1966 out:
1967 qemu_iovec_destroy(&ctx->data.iov);
1968 g_free(ctx->data.bounce);
1969
1970 qemu_iovec_destroy(&ctx->mdata.iov);
1971 g_free(ctx->mdata.bounce);
1972
1973 g_free(ctx);
1974
1975 nvme_enqueue_req_completion(nvme_cq(req), req);
1976 }
1977
1978
1979 static void nvme_verify_mdata_in_cb(void *opaque, int ret)
1980 {
1981 NvmeBounceContext *ctx = opaque;
1982 NvmeRequest *req = ctx->req;
1983 NvmeNamespace *ns = req->ns;
1984 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd;
1985 uint64_t slba = le64_to_cpu(rw->slba);
1986 uint32_t nlb = le16_to_cpu(rw->nlb) + 1;
1987 size_t mlen = nvme_m2b(ns, nlb);
1988 uint64_t offset = nvme_moff(ns, slba);
1989 BlockBackend *blk = ns->blkconf.blk;
1990
1991 trace_pci_nvme_verify_mdata_in_cb(nvme_cid(req), blk_name(blk));
1992
1993 if (ret) {
1994 goto out;
1995 }
1996
1997 ctx->mdata.bounce = g_malloc(mlen);
1998
1999 qemu_iovec_reset(&ctx->mdata.iov);
2000 qemu_iovec_add(&ctx->mdata.iov, ctx->mdata.bounce, mlen);
2001
2002 req->aiocb = blk_aio_preadv(blk, offset, &ctx->mdata.iov, 0,
2003 nvme_verify_cb, ctx);
2004 return;
2005
2006 out:
2007 nvme_verify_cb(ctx, ret);
2008 }
2009
2010 struct nvme_compare_ctx {
2011 struct {
2012 QEMUIOVector iov;
2013 uint8_t *bounce;
2014 } data;
2015
2016 struct {
2017 QEMUIOVector iov;
2018 uint8_t *bounce;
2019 } mdata;
2020 };
2021
2022 static void nvme_compare_mdata_cb(void *opaque, int ret)
2023 {
2024 NvmeRequest *req = opaque;
2025 NvmeNamespace *ns = req->ns;
2026 NvmeCtrl *n = nvme_ctrl(req);
2027 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd;
2028 uint8_t prinfo = NVME_RW_PRINFO(le16_to_cpu(rw->control));
2029 uint16_t apptag = le16_to_cpu(rw->apptag);
2030 uint16_t appmask = le16_to_cpu(rw->appmask);
2031 uint32_t reftag = le32_to_cpu(rw->reftag);
2032 struct nvme_compare_ctx *ctx = req->opaque;
2033 g_autofree uint8_t *buf = NULL;
2034 BlockBackend *blk = ns->blkconf.blk;
2035 BlockAcctCookie *acct = &req->acct;
2036 BlockAcctStats *stats = blk_get_stats(blk);
2037 uint16_t status = NVME_SUCCESS;
2038
2039 trace_pci_nvme_compare_mdata_cb(nvme_cid(req));
2040
2041 if (ret) {
2042 block_acct_failed(stats, acct);
2043 nvme_aio_err(req, ret);
2044 goto out;
2045 }
2046
2047 buf = g_malloc(ctx->mdata.iov.size);
2048
2049 status = nvme_bounce_mdata(n, buf, ctx->mdata.iov.size,
2050 NVME_TX_DIRECTION_TO_DEVICE, req);
2051 if (status) {
2052 req->status = status;
2053 goto out;
2054 }
2055
2056 if (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps)) {
2057 uint64_t slba = le64_to_cpu(rw->slba);
2058 uint8_t *bufp;
2059 uint8_t *mbufp = ctx->mdata.bounce;
2060 uint8_t *end = mbufp + ctx->mdata.iov.size;
2061 int16_t pil = 0;
2062
2063 status = nvme_dif_check(ns, ctx->data.bounce, ctx->data.iov.size,
2064 ctx->mdata.bounce, ctx->mdata.iov.size, prinfo,
2065 slba, apptag, appmask, &reftag);
2066 if (status) {
2067 req->status = status;
2068 goto out;
2069 }
2070
2071 /*
2072 * When formatted with protection information, do not compare the DIF
2073 * tuple.
2074 */
2075 if (!(ns->id_ns.dps & NVME_ID_NS_DPS_FIRST_EIGHT)) {
2076 pil = ns->lbaf.ms - sizeof(NvmeDifTuple);
2077 }
2078
2079 for (bufp = buf; mbufp < end; bufp += ns->lbaf.ms, mbufp += ns->lbaf.ms) {
2080 if (memcmp(bufp + pil, mbufp + pil, ns->lbaf.ms - pil)) {
2081 req->status = NVME_CMP_FAILURE;
2082 goto out;
2083 }
2084 }
2085
2086 goto out;
2087 }
2088
2089 if (memcmp(buf, ctx->mdata.bounce, ctx->mdata.iov.size)) {
2090 req->status = NVME_CMP_FAILURE;
2091 goto out;
2092 }
2093
2094 block_acct_done(stats, acct);
2095
2096 out:
2097 qemu_iovec_destroy(&ctx->data.iov);
2098 g_free(ctx->data.bounce);
2099
2100 qemu_iovec_destroy(&ctx->mdata.iov);
2101 g_free(ctx->mdata.bounce);
2102
2103 g_free(ctx);
2104
2105 nvme_enqueue_req_completion(nvme_cq(req), req);
2106 }
2107
2108 static void nvme_compare_data_cb(void *opaque, int ret)
2109 {
2110 NvmeRequest *req = opaque;
2111 NvmeCtrl *n = nvme_ctrl(req);
2112 NvmeNamespace *ns = req->ns;
2113 BlockBackend *blk = ns->blkconf.blk;
2114 BlockAcctCookie *acct = &req->acct;
2115 BlockAcctStats *stats = blk_get_stats(blk);
2116
2117 struct nvme_compare_ctx *ctx = req->opaque;
2118 g_autofree uint8_t *buf = NULL;
2119 uint16_t status;
2120
2121 trace_pci_nvme_compare_data_cb(nvme_cid(req));
2122
2123 if (ret) {
2124 block_acct_failed(stats, acct);
2125 nvme_aio_err(req, ret);
2126 goto out;
2127 }
2128
2129 buf = g_malloc(ctx->data.iov.size);
2130
2131 status = nvme_bounce_data(n, buf, ctx->data.iov.size,
2132 NVME_TX_DIRECTION_TO_DEVICE, req);
2133 if (status) {
2134 req->status = status;
2135 goto out;
2136 }
2137
2138 if (memcmp(buf, ctx->data.bounce, ctx->data.iov.size)) {
2139 req->status = NVME_CMP_FAILURE;
2140 goto out;
2141 }
2142
2143 if (ns->lbaf.ms) {
2144 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd;
2145 uint64_t slba = le64_to_cpu(rw->slba);
2146 uint32_t nlb = le16_to_cpu(rw->nlb) + 1;
2147 size_t mlen = nvme_m2b(ns, nlb);
2148 uint64_t offset = nvme_moff(ns, slba);
2149
2150 ctx->mdata.bounce = g_malloc(mlen);
2151
2152 qemu_iovec_init(&ctx->mdata.iov, 1);
2153 qemu_iovec_add(&ctx->mdata.iov, ctx->mdata.bounce, mlen);
2154
2155 req->aiocb = blk_aio_preadv(blk, offset, &ctx->mdata.iov, 0,
2156 nvme_compare_mdata_cb, req);
2157 return;
2158 }
2159
2160 block_acct_done(stats, acct);
2161
2162 out:
2163 qemu_iovec_destroy(&ctx->data.iov);
2164 g_free(ctx->data.bounce);
2165 g_free(ctx);
2166
2167 nvme_enqueue_req_completion(nvme_cq(req), req);
2168 }
2169
2170 typedef struct NvmeDSMAIOCB {
2171 BlockAIOCB common;
2172 BlockAIOCB *aiocb;
2173 NvmeRequest *req;
2174 QEMUBH *bh;
2175 int ret;
2176
2177 NvmeDsmRange *range;
2178 unsigned int nr;
2179 unsigned int idx;
2180 } NvmeDSMAIOCB;
2181
2182 static void nvme_dsm_cancel(BlockAIOCB *aiocb)
2183 {
2184 NvmeDSMAIOCB *iocb = container_of(aiocb, NvmeDSMAIOCB, common);
2185
2186 /* break nvme_dsm_cb loop */
2187 iocb->idx = iocb->nr;
2188 iocb->ret = -ECANCELED;
2189
2190 if (iocb->aiocb) {
2191 blk_aio_cancel_async(iocb->aiocb);
2192 iocb->aiocb = NULL;
2193 } else {
2194 /*
2195 * We only reach this if nvme_dsm_cancel() has already been called or
2196 * the command ran to completion and nvme_dsm_bh is scheduled to run.
2197 */
2198 assert(iocb->idx == iocb->nr);
2199 }
2200 }
2201
2202 static const AIOCBInfo nvme_dsm_aiocb_info = {
2203 .aiocb_size = sizeof(NvmeDSMAIOCB),
2204 .cancel_async = nvme_dsm_cancel,
2205 };
2206
2207 static void nvme_dsm_bh(void *opaque)
2208 {
2209 NvmeDSMAIOCB *iocb = opaque;
2210
2211 iocb->common.cb(iocb->common.opaque, iocb->ret);
2212
2213 qemu_bh_delete(iocb->bh);
2214 iocb->bh = NULL;
2215 qemu_aio_unref(iocb);
2216 }
2217
2218 static void nvme_dsm_cb(void *opaque, int ret);
2219
2220 static void nvme_dsm_md_cb(void *opaque, int ret)
2221 {
2222 NvmeDSMAIOCB *iocb = opaque;
2223 NvmeRequest *req = iocb->req;
2224 NvmeNamespace *ns = req->ns;
2225 NvmeDsmRange *range;
2226 uint64_t slba;
2227 uint32_t nlb;
2228
2229 if (ret < 0) {
2230 iocb->ret = ret;
2231 goto done;
2232 }
2233
2234 if (!ns->lbaf.ms) {
2235 nvme_dsm_cb(iocb, 0);
2236 return;
2237 }
2238
2239 range = &iocb->range[iocb->idx - 1];
2240 slba = le64_to_cpu(range->slba);
2241 nlb = le32_to_cpu(range->nlb);
2242
2243 /*
2244 * Check that all block were discarded (zeroed); otherwise we do not zero
2245 * the metadata.
2246 */
2247
2248 ret = nvme_block_status_all(ns, slba, nlb, BDRV_BLOCK_ZERO);
2249 if (ret) {
2250 if (ret < 0) {
2251 iocb->ret = ret;
2252 goto done;
2253 }
2254
2255 nvme_dsm_cb(iocb, 0);
2256 }
2257
2258 iocb->aiocb = blk_aio_pwrite_zeroes(ns->blkconf.blk, nvme_moff(ns, slba),
2259 nvme_m2b(ns, nlb), BDRV_REQ_MAY_UNMAP,
2260 nvme_dsm_cb, iocb);
2261 return;
2262
2263 done:
2264 iocb->aiocb = NULL;
2265 qemu_bh_schedule(iocb->bh);
2266 }
2267
2268 static void nvme_dsm_cb(void *opaque, int ret)
2269 {
2270 NvmeDSMAIOCB *iocb = opaque;
2271 NvmeRequest *req = iocb->req;
2272 NvmeCtrl *n = nvme_ctrl(req);
2273 NvmeNamespace *ns = req->ns;
2274 NvmeDsmRange *range;
2275 uint64_t slba;
2276 uint32_t nlb;
2277
2278 if (ret < 0) {
2279 iocb->ret = ret;
2280 goto done;
2281 }
2282
2283 next:
2284 if (iocb->idx == iocb->nr) {
2285 goto done;
2286 }
2287
2288 range = &iocb->range[iocb->idx++];
2289 slba = le64_to_cpu(range->slba);
2290 nlb = le32_to_cpu(range->nlb);
2291
2292 trace_pci_nvme_dsm_deallocate(slba, nlb);
2293
2294 if (nlb > n->dmrsl) {
2295 trace_pci_nvme_dsm_single_range_limit_exceeded(nlb, n->dmrsl);
2296 goto next;
2297 }
2298
2299 if (nvme_check_bounds(ns, slba, nlb)) {
2300 trace_pci_nvme_err_invalid_lba_range(slba, nlb,
2301 ns->id_ns.nsze);
2302 goto next;
2303 }
2304
2305 iocb->aiocb = blk_aio_pdiscard(ns->blkconf.blk, nvme_l2b(ns, slba),
2306 nvme_l2b(ns, nlb),
2307 nvme_dsm_md_cb, iocb);
2308 return;
2309
2310 done:
2311 iocb->aiocb = NULL;
2312 qemu_bh_schedule(iocb->bh);
2313 }
2314
2315 static uint16_t nvme_dsm(NvmeCtrl *n, NvmeRequest *req)
2316 {
2317 NvmeNamespace *ns = req->ns;
2318 NvmeDsmCmd *dsm = (NvmeDsmCmd *) &req->cmd;
2319 uint32_t attr = le32_to_cpu(dsm->attributes);
2320 uint32_t nr = (le32_to_cpu(dsm->nr) & 0xff) + 1;
2321 uint16_t status = NVME_SUCCESS;
2322
2323 trace_pci_nvme_dsm(nr, attr);
2324
2325 if (attr & NVME_DSMGMT_AD) {
2326 NvmeDSMAIOCB *iocb = blk_aio_get(&nvme_dsm_aiocb_info, ns->blkconf.blk,
2327 nvme_misc_cb, req);
2328
2329 iocb->req = req;
2330 iocb->bh = qemu_bh_new(nvme_dsm_bh, iocb);
2331 iocb->ret = 0;
2332 iocb->range = g_new(NvmeDsmRange, nr);
2333 iocb->nr = nr;
2334 iocb->idx = 0;
2335
2336 status = nvme_h2c(n, (uint8_t *)iocb->range, sizeof(NvmeDsmRange) * nr,
2337 req);
2338 if (status) {
2339 return status;
2340 }
2341
2342 req->aiocb = &iocb->common;
2343 nvme_dsm_cb(iocb, 0);
2344
2345 return NVME_NO_COMPLETE;
2346 }
2347
2348 return status;
2349 }
2350
2351 static uint16_t nvme_verify(NvmeCtrl *n, NvmeRequest *req)
2352 {
2353 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd;
2354 NvmeNamespace *ns = req->ns;
2355 BlockBackend *blk = ns->blkconf.blk;
2356 uint64_t slba = le64_to_cpu(rw->slba);
2357 uint32_t nlb = le16_to_cpu(rw->nlb) + 1;
2358 size_t len = nvme_l2b(ns, nlb);
2359 int64_t offset = nvme_l2b(ns, slba);
2360 uint8_t prinfo = NVME_RW_PRINFO(le16_to_cpu(rw->control));
2361 uint32_t reftag = le32_to_cpu(rw->reftag);
2362 NvmeBounceContext *ctx = NULL;
2363 uint16_t status;
2364
2365 trace_pci_nvme_verify(nvme_cid(req), nvme_nsid(ns), slba, nlb);
2366
2367 if (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps)) {
2368 status = nvme_check_prinfo(ns, prinfo, slba, reftag);
2369 if (status) {
2370 return status;
2371 }
2372
2373 if (prinfo & NVME_PRINFO_PRACT) {
2374 return NVME_INVALID_PROT_INFO | NVME_DNR;
2375 }
2376 }
2377
2378 if (len > n->page_size << n->params.vsl) {
2379 return NVME_INVALID_FIELD | NVME_DNR;
2380 }
2381
2382 status = nvme_check_bounds(ns, slba, nlb);
2383 if (status) {
2384 return status;
2385 }
2386
2387 if (NVME_ERR_REC_DULBE(ns->features.err_rec)) {
2388 status = nvme_check_dulbe(ns, slba, nlb);
2389 if (status) {
2390 return status;
2391 }
2392 }
2393
2394 ctx = g_new0(NvmeBounceContext, 1);
2395 ctx->req = req;
2396
2397 ctx->data.bounce = g_malloc(len);
2398
2399 qemu_iovec_init(&ctx->data.iov, 1);
2400 qemu_iovec_add(&ctx->data.iov, ctx->data.bounce, len);
2401
2402 block_acct_start(blk_get_stats(blk), &req->acct, ctx->data.iov.size,
2403 BLOCK_ACCT_READ);
2404
2405 req->aiocb = blk_aio_preadv(ns->blkconf.blk, offset, &ctx->data.iov, 0,
2406 nvme_verify_mdata_in_cb, ctx);
2407 return NVME_NO_COMPLETE;
2408 }
2409
2410 typedef struct NvmeCopyAIOCB {
2411 BlockAIOCB common;
2412 BlockAIOCB *aiocb;
2413 NvmeRequest *req;
2414 QEMUBH *bh;
2415 int ret;
2416
2417 NvmeCopySourceRange *ranges;
2418 int nr;
2419 int idx;
2420
2421 uint8_t *bounce;
2422 QEMUIOVector iov;
2423 struct {
2424 BlockAcctCookie read;
2425 BlockAcctCookie write;
2426 } acct;
2427
2428 uint32_t reftag;
2429 uint64_t slba;
2430
2431 NvmeZone *zone;
2432 } NvmeCopyAIOCB;
2433
2434 static void nvme_copy_cancel(BlockAIOCB *aiocb)
2435 {
2436 NvmeCopyAIOCB *iocb = container_of(aiocb, NvmeCopyAIOCB, common);
2437
2438 iocb->ret = -ECANCELED;
2439
2440 if (iocb->aiocb) {
2441 blk_aio_cancel_async(iocb->aiocb);
2442 iocb->aiocb = NULL;
2443 }
2444 }
2445
2446 static const AIOCBInfo nvme_copy_aiocb_info = {
2447 .aiocb_size = sizeof(NvmeCopyAIOCB),
2448 .cancel_async = nvme_copy_cancel,
2449 };
2450
2451 static void nvme_copy_bh(void *opaque)
2452 {
2453 NvmeCopyAIOCB *iocb = opaque;
2454 NvmeRequest *req = iocb->req;
2455 NvmeNamespace *ns = req->ns;
2456 BlockAcctStats *stats = blk_get_stats(ns->blkconf.blk);
2457
2458 if (iocb->idx != iocb->nr) {
2459 req->cqe.result = cpu_to_le32(iocb->idx);
2460 }
2461
2462 qemu_iovec_destroy(&iocb->iov);
2463 g_free(iocb->bounce);
2464
2465 qemu_bh_delete(iocb->bh);
2466 iocb->bh = NULL;
2467
2468 if (iocb->ret < 0) {
2469 block_acct_failed(stats, &iocb->acct.read);
2470 block_acct_failed(stats, &iocb->acct.write);
2471 } else {
2472 block_acct_done(stats, &iocb->acct.read);
2473 block_acct_done(stats, &iocb->acct.write);
2474 }
2475
2476 iocb->common.cb(iocb->common.opaque, iocb->ret);
2477 qemu_aio_unref(iocb);
2478 }
2479
2480 static void nvme_copy_cb(void *opaque, int ret);
2481
2482 static void nvme_copy_out_completed_cb(void *opaque, int ret)
2483 {
2484 NvmeCopyAIOCB *iocb = opaque;
2485 NvmeRequest *req = iocb->req;
2486 NvmeNamespace *ns = req->ns;
2487 NvmeCopySourceRange *range = &iocb->ranges[iocb->idx];
2488 uint32_t nlb = le32_to_cpu(range->nlb) + 1;
2489
2490 if (ret < 0) {
2491 iocb->ret = ret;
2492 goto out;
2493 } else if (iocb->ret < 0) {
2494 goto out;
2495 }
2496
2497 if (ns->params.zoned) {
2498 nvme_advance_zone_wp(ns, iocb->zone, nlb);
2499 }
2500
2501 iocb->idx++;
2502 iocb->slba += nlb;
2503 out:
2504 nvme_copy_cb(iocb, iocb->ret);
2505 }
2506
2507 static void nvme_copy_out_cb(void *opaque, int ret)
2508 {
2509 NvmeCopyAIOCB *iocb = opaque;
2510 NvmeRequest *req = iocb->req;
2511 NvmeNamespace *ns = req->ns;
2512 NvmeCopySourceRange *range;
2513 uint32_t nlb;
2514 size_t mlen;
2515 uint8_t *mbounce;
2516
2517 if (ret < 0) {
2518 iocb->ret = ret;
2519 goto out;
2520 } else if (iocb->ret < 0) {
2521 goto out;
2522 }
2523
2524 if (!ns->lbaf.ms) {
2525 nvme_copy_out_completed_cb(iocb, 0);
2526 return;
2527 }
2528
2529 range = &iocb->ranges[iocb->idx];
2530 nlb = le32_to_cpu(range->nlb) + 1;
2531
2532 mlen = nvme_m2b(ns, nlb);
2533 mbounce = iocb->bounce + nvme_l2b(ns, nlb);
2534
2535 qemu_iovec_reset(&iocb->iov);
2536 qemu_iovec_add(&iocb->iov, mbounce, mlen);
2537
2538 iocb->aiocb = blk_aio_pwritev(ns->blkconf.blk, nvme_moff(ns, iocb->slba),
2539 &iocb->iov, 0, nvme_copy_out_completed_cb,
2540 iocb);
2541
2542 return;
2543
2544 out:
2545 nvme_copy_cb(iocb, ret);
2546 }
2547
2548 static void nvme_copy_in_completed_cb(void *opaque, int ret)
2549 {
2550 NvmeCopyAIOCB *iocb = opaque;
2551 NvmeRequest *req = iocb->req;
2552 NvmeNamespace *ns = req->ns;
2553 NvmeCopySourceRange *range;
2554 uint32_t nlb;
2555 size_t len;
2556 uint16_t status;
2557
2558 if (ret < 0) {
2559 iocb->ret = ret;
2560 goto out;
2561 } else if (iocb->ret < 0) {
2562 goto out;
2563 }
2564
2565 range = &iocb->ranges[iocb->idx];
2566 nlb = le32_to_cpu(range->nlb) + 1;
2567 len = nvme_l2b(ns, nlb);
2568
2569 trace_pci_nvme_copy_out(iocb->slba, nlb);
2570
2571 if (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps)) {
2572 NvmeCopyCmd *copy = (NvmeCopyCmd *)&req->cmd;
2573
2574 uint16_t prinfor = ((copy->control[0] >> 4) & 0xf);
2575 uint16_t prinfow = ((copy->control[2] >> 2) & 0xf);
2576
2577 uint16_t apptag = le16_to_cpu(range->apptag);
2578 uint16_t appmask = le16_to_cpu(range->appmask);
2579 uint32_t reftag = le32_to_cpu(range->reftag);
2580
2581 uint64_t slba = le64_to_cpu(range->slba);
2582 size_t mlen = nvme_m2b(ns, nlb);
2583 uint8_t *mbounce = iocb->bounce + nvme_l2b(ns, nlb);
2584
2585 status = nvme_dif_check(ns, iocb->bounce, len, mbounce, mlen, prinfor,
2586 slba, apptag, appmask, &reftag);
2587 if (status) {
2588 goto invalid;
2589 }
2590
2591 apptag = le16_to_cpu(copy->apptag);
2592 appmask = le16_to_cpu(copy->appmask);
2593
2594 if (prinfow & NVME_PRINFO_PRACT) {
2595 status = nvme_check_prinfo(ns, prinfow, iocb->slba, iocb->reftag);
2596 if (status) {
2597 goto invalid;
2598 }
2599
2600 nvme_dif_pract_generate_dif(ns, iocb->bounce, len, mbounce, mlen,
2601 apptag, &iocb->reftag);
2602 } else {
2603 status = nvme_dif_check(ns, iocb->bounce, len, mbounce, mlen,
2604 prinfow, iocb->slba, apptag, appmask,
2605 &iocb->reftag);
2606 if (status) {
2607 goto invalid;
2608 }
2609 }
2610 }
2611
2612 status = nvme_check_bounds(ns, iocb->slba, nlb);
2613 if (status) {
2614 goto invalid;
2615 }
2616
2617 if (ns->params.zoned) {
2618 status = nvme_check_zone_write(ns, iocb->zone, iocb->slba, nlb);
2619 if (status) {
2620 goto invalid;
2621 }
2622
2623 iocb->zone->w_ptr += nlb;
2624 }
2625
2626 qemu_iovec_reset(&iocb->iov);
2627 qemu_iovec_add(&iocb->iov, iocb->bounce, len);
2628
2629 iocb->aiocb = blk_aio_pwritev(ns->blkconf.blk, nvme_l2b(ns, iocb->slba),
2630 &iocb->iov, 0, nvme_copy_out_cb, iocb);
2631
2632 return;
2633
2634 invalid:
2635 req->status = status;
2636 iocb->aiocb = NULL;
2637 if (iocb->bh) {
2638 qemu_bh_schedule(iocb->bh);
2639 }
2640
2641 return;
2642
2643 out:
2644 nvme_copy_cb(iocb, ret);
2645 }
2646
2647 static void nvme_copy_in_cb(void *opaque, int ret)
2648 {
2649 NvmeCopyAIOCB *iocb = opaque;
2650 NvmeRequest *req = iocb->req;
2651 NvmeNamespace *ns = req->ns;
2652 NvmeCopySourceRange *range;
2653 uint64_t slba;
2654 uint32_t nlb;
2655
2656 if (ret < 0) {
2657 iocb->ret = ret;
2658 goto out;
2659 } else if (iocb->ret < 0) {
2660 goto out;
2661 }
2662
2663 if (!ns->lbaf.ms) {
2664 nvme_copy_in_completed_cb(iocb, 0);
2665 return;
2666 }
2667
2668 range = &iocb->ranges[iocb->idx];
2669 slba = le64_to_cpu(range->slba);
2670 nlb = le32_to_cpu(range->nlb) + 1;
2671
2672 qemu_iovec_reset(&iocb->iov);
2673 qemu_iovec_add(&iocb->iov, iocb->bounce + nvme_l2b(ns, nlb),
2674 nvme_m2b(ns, nlb));
2675
2676 iocb->aiocb = blk_aio_preadv(ns->blkconf.blk, nvme_moff(ns, slba),
2677 &iocb->iov, 0, nvme_copy_in_completed_cb,
2678 iocb);
2679 return;
2680
2681 out:
2682 nvme_copy_cb(iocb, iocb->ret);
2683 }
2684
2685 static void nvme_copy_cb(void *opaque, int ret)
2686 {
2687 NvmeCopyAIOCB *iocb = opaque;
2688 NvmeRequest *req = iocb->req;
2689 NvmeNamespace *ns = req->ns;
2690 NvmeCopySourceRange *range;
2691 uint64_t slba;
2692 uint32_t nlb;
2693 size_t len;
2694 uint16_t status;
2695
2696 if (ret < 0) {
2697 iocb->ret = ret;
2698 goto done;
2699 } else if (iocb->ret < 0) {
2700 goto done;
2701 }
2702
2703 if (iocb->idx == iocb->nr) {
2704 goto done;
2705 }
2706
2707 range = &iocb->ranges[iocb->idx];
2708 slba = le64_to_cpu(range->slba);
2709 nlb = le32_to_cpu(range->nlb) + 1;
2710 len = nvme_l2b(ns, nlb);
2711
2712 trace_pci_nvme_copy_source_range(slba, nlb);
2713
2714 if (nlb > le16_to_cpu(ns->id_ns.mssrl)) {
2715 status = NVME_CMD_SIZE_LIMIT | NVME_DNR;
2716 goto invalid;
2717 }
2718
2719 status = nvme_check_bounds(ns, slba, nlb);
2720 if (status) {
2721 goto invalid;
2722 }
2723
2724 if (NVME_ERR_REC_DULBE(ns->features.err_rec)) {
2725 status = nvme_check_dulbe(ns, slba, nlb);
2726 if (status) {
2727 goto invalid;
2728 }
2729 }
2730
2731 if (ns->params.zoned) {
2732 status = nvme_check_zone_read(ns, slba, nlb);
2733 if (status) {
2734 goto invalid;
2735 }
2736 }
2737
2738 qemu_iovec_reset(&iocb->iov);
2739 qemu_iovec_add(&iocb->iov, iocb->bounce, len);
2740
2741 iocb->aiocb = blk_aio_preadv(ns->blkconf.blk, nvme_l2b(ns, slba),
2742 &iocb->iov, 0, nvme_copy_in_cb, iocb);
2743 return;
2744
2745 invalid:
2746 req->status = status;
2747 done:
2748 iocb->aiocb = NULL;
2749 if (iocb->bh) {
2750 qemu_bh_schedule(iocb->bh);
2751 }
2752 }
2753
2754
2755 static uint16_t nvme_copy(NvmeCtrl *n, NvmeRequest *req)
2756 {
2757 NvmeNamespace *ns = req->ns;
2758 NvmeCopyCmd *copy = (NvmeCopyCmd *)&req->cmd;
2759 NvmeCopyAIOCB *iocb = blk_aio_get(&nvme_copy_aiocb_info, ns->blkconf.blk,
2760 nvme_misc_cb, req);
2761 uint16_t nr = copy->nr + 1;
2762 uint8_t format = copy->control[0] & 0xf;
2763 uint16_t prinfor = ((copy->control[0] >> 4) & 0xf);
2764 uint16_t prinfow = ((copy->control[2] >> 2) & 0xf);
2765
2766 uint16_t status;
2767
2768 trace_pci_nvme_copy(nvme_cid(req), nvme_nsid(ns), nr, format);
2769
2770 iocb->ranges = NULL;
2771 iocb->zone = NULL;
2772
2773 if (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps) &&
2774 ((prinfor & NVME_PRINFO_PRACT) != (prinfow & NVME_PRINFO_PRACT))) {
2775 status = NVME_INVALID_FIELD | NVME_DNR;
2776 goto invalid;
2777 }
2778
2779 if (!(n->id_ctrl.ocfs & (1 << format))) {
2780 trace_pci_nvme_err_copy_invalid_format(format);
2781 status = NVME_INVALID_FIELD | NVME_DNR;
2782 goto invalid;
2783 }
2784
2785 if (nr > ns->id_ns.msrc + 1) {
2786 status = NVME_CMD_SIZE_LIMIT | NVME_DNR;
2787 goto invalid;
2788 }
2789
2790 iocb->ranges = g_new(NvmeCopySourceRange, nr);
2791
2792 status = nvme_h2c(n, (uint8_t *)iocb->ranges,
2793 sizeof(NvmeCopySourceRange) * nr, req);
2794 if (status) {
2795 goto invalid;
2796 }
2797
2798 iocb->slba = le64_to_cpu(copy->sdlba);
2799
2800 if (ns->params.zoned) {
2801 iocb->zone = nvme_get_zone_by_slba(ns, iocb->slba);
2802 if (!iocb->zone) {
2803 status = NVME_LBA_RANGE | NVME_DNR;
2804 goto invalid;
2805 }
2806
2807 status = nvme_zrm_auto(n, ns, iocb->zone);
2808 if (status) {
2809 goto invalid;
2810 }
2811 }
2812
2813 iocb->req = req;
2814 iocb->bh = qemu_bh_new(nvme_copy_bh, iocb);
2815 iocb->ret = 0;
2816 iocb->nr = nr;
2817 iocb->idx = 0;
2818 iocb->reftag = le32_to_cpu(copy->reftag);
2819 iocb->bounce = g_malloc_n(le16_to_cpu(ns->id_ns.mssrl),
2820 ns->lbasz + ns->lbaf.ms);
2821
2822 qemu_iovec_init(&iocb->iov, 1);
2823
2824 block_acct_start(blk_get_stats(ns->blkconf.blk), &iocb->acct.read, 0,
2825 BLOCK_ACCT_READ);
2826 block_acct_start(blk_get_stats(ns->blkconf.blk), &iocb->acct.write, 0,
2827 BLOCK_ACCT_WRITE);
2828
2829 req->aiocb = &iocb->common;
2830 nvme_copy_cb(iocb, 0);
2831
2832 return NVME_NO_COMPLETE;
2833
2834 invalid:
2835 g_free(iocb->ranges);
2836 qemu_aio_unref(iocb);
2837 return status;
2838 }
2839
2840 static uint16_t nvme_compare(NvmeCtrl *n, NvmeRequest *req)
2841 {
2842 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd;
2843 NvmeNamespace *ns = req->ns;
2844 BlockBackend *blk = ns->blkconf.blk;
2845 uint64_t slba = le64_to_cpu(rw->slba);
2846 uint32_t nlb = le16_to_cpu(rw->nlb) + 1;
2847 uint8_t prinfo = NVME_RW_PRINFO(le16_to_cpu(rw->control));
2848 size_t data_len = nvme_l2b(ns, nlb);
2849 size_t len = data_len;
2850 int64_t offset = nvme_l2b(ns, slba);
2851 struct nvme_compare_ctx *ctx = NULL;
2852 uint16_t status;
2853
2854 trace_pci_nvme_compare(nvme_cid(req), nvme_nsid(ns), slba, nlb);
2855
2856 if (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps) && (prinfo & NVME_PRINFO_PRACT)) {
2857 return NVME_INVALID_PROT_INFO | NVME_DNR;
2858 }
2859
2860 if (nvme_ns_ext(ns)) {
2861 len += nvme_m2b(ns, nlb);
2862 }
2863
2864 status = nvme_check_mdts(n, len);
2865 if (status) {
2866 return status;
2867 }
2868
2869 status = nvme_check_bounds(ns, slba, nlb);
2870 if (status) {
2871 return status;
2872 }
2873
2874 if (NVME_ERR_REC_DULBE(ns->features.err_rec)) {
2875 status = nvme_check_dulbe(ns, slba, nlb);
2876 if (status) {
2877 return status;
2878 }
2879 }
2880
2881 status = nvme_map_dptr(n, &req->sg, len, &req->cmd);
2882 if (status) {
2883 return status;
2884 }
2885
2886 ctx = g_new(struct nvme_compare_ctx, 1);
2887 ctx->data.bounce = g_malloc(data_len);
2888
2889 req->opaque = ctx;
2890
2891 qemu_iovec_init(&ctx->data.iov, 1);
2892 qemu_iovec_add(&ctx->data.iov, ctx->data.bounce, data_len);
2893
2894 block_acct_start(blk_get_stats(blk), &req->acct, data_len,
2895 BLOCK_ACCT_READ);
2896 req->aiocb = blk_aio_preadv(blk, offset, &ctx->data.iov, 0,
2897 nvme_compare_data_cb, req);
2898
2899 return NVME_NO_COMPLETE;
2900 }
2901
2902 typedef struct NvmeFlushAIOCB {
2903 BlockAIOCB common;
2904 BlockAIOCB *aiocb;
2905 NvmeRequest *req;
2906 QEMUBH *bh;
2907 int ret;
2908
2909 NvmeNamespace *ns;
2910 uint32_t nsid;
2911 bool broadcast;
2912 } NvmeFlushAIOCB;
2913
2914 static void nvme_flush_cancel(BlockAIOCB *acb)
2915 {
2916 NvmeFlushAIOCB *iocb = container_of(acb, NvmeFlushAIOCB, common);
2917
2918 iocb->ret = -ECANCELED;
2919
2920 if (iocb->aiocb) {
2921 blk_aio_cancel_async(iocb->aiocb);
2922 }
2923 }
2924
2925 static const AIOCBInfo nvme_flush_aiocb_info = {
2926 .aiocb_size = sizeof(NvmeFlushAIOCB),
2927 .cancel_async = nvme_flush_cancel,
2928 .get_aio_context = nvme_get_aio_context,
2929 };
2930
2931 static void nvme_flush_ns_cb(void *opaque, int ret)
2932 {
2933 NvmeFlushAIOCB *iocb = opaque;
2934 NvmeNamespace *ns = iocb->ns;
2935
2936 if (ret < 0) {
2937 iocb->ret = ret;
2938 goto out;
2939 } else if (iocb->ret < 0) {
2940 goto out;
2941 }
2942
2943 if (ns) {
2944 trace_pci_nvme_flush_ns(iocb->nsid);
2945
2946 iocb->ns = NULL;
2947 iocb->aiocb = blk_aio_flush(ns->blkconf.blk, nvme_flush_ns_cb, iocb);
2948 return;
2949 }
2950
2951 out:
2952 iocb->aiocb = NULL;
2953 qemu_bh_schedule(iocb->bh);
2954 }
2955
2956 static void nvme_flush_bh(void *opaque)
2957 {
2958 NvmeFlushAIOCB *iocb = opaque;
2959 NvmeRequest *req = iocb->req;
2960 NvmeCtrl *n = nvme_ctrl(req);
2961 int i;
2962
2963 if (iocb->ret < 0) {
2964 goto done;
2965 }
2966
2967 if (iocb->broadcast) {
2968 for (i = iocb->nsid + 1; i <= NVME_MAX_NAMESPACES; i++) {
2969 iocb->ns = nvme_ns(n, i);
2970 if (iocb->ns) {
2971 iocb->nsid = i;
2972 break;
2973 }
2974 }
2975 }
2976
2977 if (!iocb->ns) {
2978 goto done;
2979 }
2980
2981 nvme_flush_ns_cb(iocb, 0);
2982 return;
2983
2984 done:
2985 qemu_bh_delete(iocb->bh);
2986 iocb->bh = NULL;
2987
2988 iocb->common.cb(iocb->common.opaque, iocb->ret);
2989
2990 qemu_aio_unref(iocb);
2991
2992 return;
2993 }
2994
2995 static uint16_t nvme_flush(NvmeCtrl *n, NvmeRequest *req)
2996 {
2997 NvmeFlushAIOCB *iocb;
2998 uint32_t nsid = le32_to_cpu(req->cmd.nsid);
2999 uint16_t status;
3000
3001 iocb = qemu_aio_get(&nvme_flush_aiocb_info, NULL, nvme_misc_cb, req);
3002
3003 iocb->req = req;
3004 iocb->bh = qemu_bh_new(nvme_flush_bh, iocb);
3005 iocb->ret = 0;
3006 iocb->ns = NULL;
3007 iocb->nsid = 0;
3008 iocb->broadcast = (nsid == NVME_NSID_BROADCAST);
3009
3010 if (!iocb->broadcast) {
3011 if (!nvme_nsid_valid(n, nsid)) {
3012 status = NVME_INVALID_NSID | NVME_DNR;
3013 goto out;
3014 }
3015
3016 iocb->ns = nvme_ns(n, nsid);
3017 if (!iocb->ns) {
3018 status = NVME_INVALID_FIELD | NVME_DNR;
3019 goto out;
3020 }
3021
3022 iocb->nsid = nsid;
3023 }
3024
3025 req->aiocb = &iocb->common;
3026 qemu_bh_schedule(iocb->bh);
3027
3028 return NVME_NO_COMPLETE;
3029
3030 out:
3031 qemu_bh_delete(iocb->bh);
3032 iocb->bh = NULL;
3033 qemu_aio_unref(iocb);
3034
3035 return status;
3036 }
3037
3038 static uint16_t nvme_read(NvmeCtrl *n, NvmeRequest *req)
3039 {
3040 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd;
3041 NvmeNamespace *ns = req->ns;
3042 uint64_t slba = le64_to_cpu(rw->slba);
3043 uint32_t nlb = (uint32_t)le16_to_cpu(rw->nlb) + 1;
3044 uint8_t prinfo = NVME_RW_PRINFO(le16_to_cpu(rw->control));
3045 uint64_t data_size = nvme_l2b(ns, nlb);
3046 uint64_t mapped_size = data_size;
3047 uint64_t data_offset;
3048 BlockBackend *blk = ns->blkconf.blk;
3049 uint16_t status;
3050
3051 if (nvme_ns_ext(ns)) {
3052 mapped_size += nvme_m2b(ns, nlb);
3053
3054 if (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps)) {
3055 bool pract = prinfo & NVME_PRINFO_PRACT;
3056
3057 if (pract && ns->lbaf.ms == 8) {
3058 mapped_size = data_size;
3059 }
3060 }
3061 }
3062
3063 trace_pci_nvme_read(nvme_cid(req), nvme_nsid(ns), nlb, mapped_size, slba);
3064
3065 status = nvme_check_mdts(n, mapped_size);
3066 if (status) {
3067 goto invalid;
3068 }
3069
3070 status = nvme_check_bounds(ns, slba, nlb);
3071 if (status) {
3072 goto invalid;
3073 }
3074
3075 if (ns->params.zoned) {
3076 status = nvme_check_zone_read(ns, slba, nlb);
3077 if (status) {
3078 trace_pci_nvme_err_zone_read_not_ok(slba, nlb, status);
3079 goto invalid;
3080 }
3081 }
3082
3083 if (NVME_ERR_REC_DULBE(ns->features.err_rec)) {
3084 status = nvme_check_dulbe(ns, slba, nlb);
3085 if (status) {
3086 goto invalid;
3087 }
3088 }
3089
3090 if (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps)) {
3091 return nvme_dif_rw(n, req);
3092 }
3093
3094 status = nvme_map_data(n, nlb, req);
3095 if (status) {
3096 goto invalid;
3097 }
3098
3099 data_offset = nvme_l2b(ns, slba);
3100
3101 block_acct_start(blk_get_stats(blk), &req->acct, data_size,
3102 BLOCK_ACCT_READ);
3103 nvme_blk_read(blk, data_offset, nvme_rw_cb, req);
3104 return NVME_NO_COMPLETE;
3105
3106 invalid:
3107 block_acct_invalid(blk_get_stats(blk), BLOCK_ACCT_READ);
3108 return status | NVME_DNR;
3109 }
3110
3111 static uint16_t nvme_do_write(NvmeCtrl *n, NvmeRequest *req, bool append,
3112 bool wrz)
3113 {
3114 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd;
3115 NvmeNamespace *ns = req->ns;
3116 uint64_t slba = le64_to_cpu(rw->slba);
3117 uint32_t nlb = (uint32_t)le16_to_cpu(rw->nlb) + 1;
3118 uint16_t ctrl = le16_to_cpu(rw->control);
3119 uint8_t prinfo = NVME_RW_PRINFO(ctrl);
3120 uint64_t data_size = nvme_l2b(ns, nlb);
3121 uint64_t mapped_size = data_size;
3122 uint64_t data_offset;
3123 NvmeZone *zone;
3124 NvmeZonedResult *res = (NvmeZonedResult *)&req->cqe;
3125 BlockBackend *blk = ns->blkconf.blk;
3126 uint16_t status;
3127
3128 if (nvme_ns_ext(ns)) {
3129 mapped_size += nvme_m2b(ns, nlb);
3130
3131 if (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps)) {
3132 bool pract = prinfo & NVME_PRINFO_PRACT;
3133
3134 if (pract && ns->lbaf.ms == 8) {
3135 mapped_size -= nvme_m2b(ns, nlb);
3136 }
3137 }
3138 }
3139
3140 trace_pci_nvme_write(nvme_cid(req), nvme_io_opc_str(rw->opcode),
3141 nvme_nsid(ns), nlb, mapped_size, slba);
3142
3143 if (!wrz) {
3144 status = nvme_check_mdts(n, mapped_size);
3145 if (status) {
3146 goto invalid;
3147 }
3148 }
3149
3150 status = nvme_check_bounds(ns, slba, nlb);
3151 if (status) {
3152 goto invalid;
3153 }
3154
3155 if (ns->params.zoned) {
3156 zone = nvme_get_zone_by_slba(ns, slba);
3157 assert(zone);
3158
3159 if (append) {
3160 bool piremap = !!(ctrl & NVME_RW_PIREMAP);
3161
3162 if (unlikely(slba != zone->d.zslba)) {
3163 trace_pci_nvme_err_append_not_at_start(slba, zone->d.zslba);
3164 status = NVME_INVALID_FIELD;
3165 goto invalid;
3166 }
3167
3168 if (n->params.zasl &&
3169 data_size > (uint64_t)n->page_size << n->params.zasl) {
3170 trace_pci_nvme_err_zasl(data_size);
3171 return NVME_INVALID_FIELD | NVME_DNR;
3172 }
3173
3174 slba = zone->w_ptr;
3175 rw->slba = cpu_to_le64(slba);
3176 res->slba = cpu_to_le64(slba);
3177
3178 switch (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps)) {
3179 case NVME_ID_NS_DPS_TYPE_1:
3180 if (!piremap) {
3181 return NVME_INVALID_PROT_INFO | NVME_DNR;
3182 }
3183
3184 /* fallthrough */
3185
3186 case NVME_ID_NS_DPS_TYPE_2:
3187 if (piremap) {
3188 uint32_t reftag = le32_to_cpu(rw->reftag);
3189 rw->reftag = cpu_to_le32(reftag + (slba - zone->d.zslba));
3190 }
3191
3192 break;
3193
3194 case NVME_ID_NS_DPS_TYPE_3:
3195 if (piremap) {
3196 return NVME_INVALID_PROT_INFO | NVME_DNR;
3197 }
3198
3199 break;
3200 }
3201 }
3202
3203 status = nvme_check_zone_write(ns, zone, slba, nlb);
3204 if (status) {
3205 goto invalid;
3206 }
3207
3208 status = nvme_zrm_auto(n, ns, zone);
3209 if (status) {
3210 goto invalid;
3211 }
3212
3213 zone->w_ptr += nlb;
3214 }
3215
3216 data_offset = nvme_l2b(ns, slba);
3217
3218 if (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps)) {
3219 return nvme_dif_rw(n, req);
3220 }
3221
3222 if (!wrz) {
3223 status = nvme_map_data(n, nlb, req);
3224 if (status) {
3225 goto invalid;
3226 }
3227
3228 block_acct_start(blk_get_stats(blk), &req->acct, data_size,
3229 BLOCK_ACCT_WRITE);
3230 nvme_blk_write(blk, data_offset, nvme_rw_cb, req);
3231 } else {
3232 req->aiocb = blk_aio_pwrite_zeroes(blk, data_offset, data_size,
3233 BDRV_REQ_MAY_UNMAP, nvme_rw_cb,
3234 req);
3235 }
3236
3237 return NVME_NO_COMPLETE;
3238
3239 invalid:
3240 block_acct_invalid(blk_get_stats(blk), BLOCK_ACCT_WRITE);
3241 return status | NVME_DNR;
3242 }
3243
3244 static inline uint16_t nvme_write(NvmeCtrl *n, NvmeRequest *req)
3245 {
3246 return nvme_do_write(n, req, false, false);
3247 }
3248
3249 static inline uint16_t nvme_write_zeroes(NvmeCtrl *n, NvmeRequest *req)
3250 {
3251 return nvme_do_write(n, req, false, true);
3252 }
3253
3254 static inline uint16_t nvme_zone_append(NvmeCtrl *n, NvmeRequest *req)
3255 {
3256 return nvme_do_write(n, req, true, false);
3257 }
3258
3259 static uint16_t nvme_get_mgmt_zone_slba_idx(NvmeNamespace *ns, NvmeCmd *c,
3260 uint64_t *slba, uint32_t *zone_idx)
3261 {
3262 uint32_t dw10 = le32_to_cpu(c->cdw10);
3263 uint32_t dw11 = le32_to_cpu(c->cdw11);
3264
3265 if (!ns->params.zoned) {
3266 trace_pci_nvme_err_invalid_opc(c->opcode);
3267 return NVME_INVALID_OPCODE | NVME_DNR;
3268 }
3269
3270 *slba = ((uint64_t)dw11) << 32 | dw10;
3271 if (unlikely(*slba >= ns->id_ns.nsze)) {
3272 trace_pci_nvme_err_invalid_lba_range(*slba, 0, ns->id_ns.nsze);
3273 *slba = 0;
3274 return NVME_LBA_RANGE | NVME_DNR;
3275 }
3276
3277 *zone_idx = nvme_zone_idx(ns, *slba);
3278 assert(*zone_idx < ns->num_zones);
3279
3280 return NVME_SUCCESS;
3281 }
3282
3283 typedef uint16_t (*op_handler_t)(NvmeNamespace *, NvmeZone *, NvmeZoneState,
3284 NvmeRequest *);
3285
3286 enum NvmeZoneProcessingMask {
3287 NVME_PROC_CURRENT_ZONE = 0,
3288 NVME_PROC_OPENED_ZONES = 1 << 0,
3289 NVME_PROC_CLOSED_ZONES = 1 << 1,
3290 NVME_PROC_READ_ONLY_ZONES = 1 << 2,
3291 NVME_PROC_FULL_ZONES = 1 << 3,
3292 };
3293
3294 static uint16_t nvme_open_zone(NvmeNamespace *ns, NvmeZone *zone,
3295 NvmeZoneState state, NvmeRequest *req)
3296 {
3297 return nvme_zrm_open(nvme_ctrl(req), ns, zone);
3298 }
3299
3300 static uint16_t nvme_close_zone(NvmeNamespace *ns, NvmeZone *zone,
3301 NvmeZoneState state, NvmeRequest *req)
3302 {
3303 return nvme_zrm_close(ns, zone);
3304 }
3305
3306 static uint16_t nvme_finish_zone(NvmeNamespace *ns, NvmeZone *zone,
3307 NvmeZoneState state, NvmeRequest *req)
3308 {
3309 return nvme_zrm_finish(ns, zone);
3310 }
3311
3312 static uint16_t nvme_offline_zone(NvmeNamespace *ns, NvmeZone *zone,
3313 NvmeZoneState state, NvmeRequest *req)
3314 {
3315 switch (state) {
3316 case NVME_ZONE_STATE_READ_ONLY:
3317 nvme_assign_zone_state(ns, zone, NVME_ZONE_STATE_OFFLINE);
3318 /* fall through */
3319 case NVME_ZONE_STATE_OFFLINE:
3320 return NVME_SUCCESS;
3321 default:
3322 return NVME_ZONE_INVAL_TRANSITION;
3323 }
3324 }
3325
3326 static uint16_t nvme_set_zd_ext(NvmeNamespace *ns, NvmeZone *zone)
3327 {
3328 uint16_t status;
3329 uint8_t state = nvme_get_zone_state(zone);
3330
3331 if (state == NVME_ZONE_STATE_EMPTY) {
3332 status = nvme_aor_check(ns, 1, 0);
3333 if (status) {
3334 return status;
3335 }
3336 nvme_aor_inc_active(ns);
3337 zone->d.za |= NVME_ZA_ZD_EXT_VALID;
3338 nvme_assign_zone_state(ns, zone, NVME_ZONE_STATE_CLOSED);
3339 return NVME_SUCCESS;
3340 }
3341
3342 return NVME_ZONE_INVAL_TRANSITION;
3343 }
3344
3345 static uint16_t nvme_bulk_proc_zone(NvmeNamespace *ns, NvmeZone *zone,
3346 enum NvmeZoneProcessingMask proc_mask,
3347 op_handler_t op_hndlr, NvmeRequest *req)
3348 {
3349 uint16_t status = NVME_SUCCESS;
3350 NvmeZoneState zs = nvme_get_zone_state(zone);
3351 bool proc_zone;
3352
3353 switch (zs) {
3354 case NVME_ZONE_STATE_IMPLICITLY_OPEN:
3355 case NVME_ZONE_STATE_EXPLICITLY_OPEN:
3356 proc_zone = proc_mask & NVME_PROC_OPENED_ZONES;
3357 break;
3358 case NVME_ZONE_STATE_CLOSED:
3359 proc_zone = proc_mask & NVME_PROC_CLOSED_ZONES;
3360 break;
3361 case NVME_ZONE_STATE_READ_ONLY:
3362 proc_zone = proc_mask & NVME_PROC_READ_ONLY_ZONES;
3363 break;
3364 case NVME_ZONE_STATE_FULL:
3365 proc_zone = proc_mask & NVME_PROC_FULL_ZONES;
3366 break;
3367 default:
3368 proc_zone = false;
3369 }
3370
3371 if (proc_zone) {
3372 status = op_hndlr(ns, zone, zs, req);
3373 }
3374
3375 return status;
3376 }
3377
3378 static uint16_t nvme_do_zone_op(NvmeNamespace *ns, NvmeZone *zone,
3379 enum NvmeZoneProcessingMask proc_mask,
3380 op_handler_t op_hndlr, NvmeRequest *req)
3381 {
3382 NvmeZone *next;
3383 uint16_t status = NVME_SUCCESS;
3384 int i;
3385
3386 if (!proc_mask) {
3387 status = op_hndlr(ns, zone, nvme_get_zone_state(zone), req);
3388 } else {
3389 if (proc_mask & NVME_PROC_CLOSED_ZONES) {
3390 QTAILQ_FOREACH_SAFE(zone, &ns->closed_zones, entry, next) {
3391 status = nvme_bulk_proc_zone(ns, zone, proc_mask, op_hndlr,
3392 req);
3393 if (status && status != NVME_NO_COMPLETE) {
3394 goto out;
3395 }
3396 }
3397 }
3398 if (proc_mask & NVME_PROC_OPENED_ZONES) {
3399 QTAILQ_FOREACH_SAFE(zone, &ns->imp_open_zones, entry, next) {
3400 status = nvme_bulk_proc_zone(ns, zone, proc_mask, op_hndlr,
3401 req);
3402 if (status && status != NVME_NO_COMPLETE) {
3403 goto out;
3404 }
3405 }
3406
3407 QTAILQ_FOREACH_SAFE(zone, &ns->exp_open_zones, entry, next) {
3408 status = nvme_bulk_proc_zone(ns, zone, proc_mask, op_hndlr,
3409 req);
3410 if (status && status != NVME_NO_COMPLETE) {
3411 goto out;
3412 }
3413 }
3414 }
3415 if (proc_mask & NVME_PROC_FULL_ZONES) {
3416 QTAILQ_FOREACH_SAFE(zone, &ns->full_zones, entry, next) {
3417 status = nvme_bulk_proc_zone(ns, zone, proc_mask, op_hndlr,
3418 req);
3419 if (status && status != NVME_NO_COMPLETE) {
3420 goto out;
3421 }
3422 }
3423 }
3424
3425 if (proc_mask & NVME_PROC_READ_ONLY_ZONES) {
3426 for (i = 0; i < ns->num_zones; i++, zone++) {
3427 status = nvme_bulk_proc_zone(ns, zone, proc_mask, op_hndlr,
3428 req);
3429 if (status && status != NVME_NO_COMPLETE) {
3430 goto out;
3431 }
3432 }
3433 }
3434 }
3435
3436 out:
3437 return status;
3438 }
3439
3440 typedef struct NvmeZoneResetAIOCB {
3441 BlockAIOCB common;
3442 BlockAIOCB *aiocb;
3443 NvmeRequest *req;
3444 QEMUBH *bh;
3445 int ret;
3446
3447 bool all;
3448 int idx;
3449 NvmeZone *zone;
3450 } NvmeZoneResetAIOCB;
3451
3452 static void nvme_zone_reset_cancel(BlockAIOCB *aiocb)
3453 {
3454 NvmeZoneResetAIOCB *iocb = container_of(aiocb, NvmeZoneResetAIOCB, common);
3455 NvmeRequest *req = iocb->req;
3456 NvmeNamespace *ns = req->ns;
3457
3458 iocb->idx = ns->num_zones;
3459
3460 iocb->ret = -ECANCELED;
3461
3462 if (iocb->aiocb) {
3463 blk_aio_cancel_async(iocb->aiocb);
3464 iocb->aiocb = NULL;
3465 }
3466 }
3467
3468 static const AIOCBInfo nvme_zone_reset_aiocb_info = {
3469 .aiocb_size = sizeof(NvmeZoneResetAIOCB),
3470 .cancel_async = nvme_zone_reset_cancel,
3471 };
3472
3473 static void nvme_zone_reset_bh(void *opaque)
3474 {
3475 NvmeZoneResetAIOCB *iocb = opaque;
3476
3477 iocb->common.cb(iocb->common.opaque, iocb->ret);
3478
3479 qemu_bh_delete(iocb->bh);
3480 iocb->bh = NULL;
3481 qemu_aio_unref(iocb);
3482 }
3483
3484 static void nvme_zone_reset_cb(void *opaque, int ret);
3485
3486 static void nvme_zone_reset_epilogue_cb(void *opaque, int ret)
3487 {
3488 NvmeZoneResetAIOCB *iocb = opaque;
3489 NvmeRequest *req = iocb->req;
3490 NvmeNamespace *ns = req->ns;
3491 int64_t moff;
3492 int count;
3493
3494 if (ret < 0) {
3495 nvme_zone_reset_cb(iocb, ret);
3496 return;
3497 }
3498
3499 if (!ns->lbaf.ms) {
3500 nvme_zone_reset_cb(iocb, 0);
3501 return;
3502 }
3503
3504 moff = nvme_moff(ns, iocb->zone->d.zslba);
3505 count = nvme_m2b(ns, ns->zone_size);
3506
3507 iocb->aiocb = blk_aio_pwrite_zeroes(ns->blkconf.blk, moff, count,
3508 BDRV_REQ_MAY_UNMAP,
3509 nvme_zone_reset_cb, iocb);
3510 return;
3511 }
3512
3513 static void nvme_zone_reset_cb(void *opaque, int ret)
3514 {
3515 NvmeZoneResetAIOCB *iocb = opaque;
3516 NvmeRequest *req = iocb->req;
3517 NvmeNamespace *ns = req->ns;
3518
3519 if (ret < 0) {
3520 iocb->ret = ret;
3521 goto done;
3522 }
3523
3524 if (iocb->zone) {
3525 nvme_zrm_reset(ns, iocb->zone);
3526
3527 if (!iocb->all) {
3528 goto done;
3529 }
3530 }
3531
3532 while (iocb->idx < ns->num_zones) {
3533 NvmeZone *zone = &ns->zone_array[iocb->idx++];
3534
3535 switch (nvme_get_zone_state(zone)) {
3536 case NVME_ZONE_STATE_EMPTY:
3537 if (!iocb->all) {
3538 goto done;
3539 }
3540
3541 continue;
3542
3543 case NVME_ZONE_STATE_EXPLICITLY_OPEN:
3544 case NVME_ZONE_STATE_IMPLICITLY_OPEN:
3545 case NVME_ZONE_STATE_CLOSED:
3546 case NVME_ZONE_STATE_FULL:
3547 iocb->zone = zone;
3548 break;
3549
3550 default:
3551 continue;
3552 }
3553
3554 trace_pci_nvme_zns_zone_reset(zone->d.zslba);
3555
3556 iocb->aiocb = blk_aio_pwrite_zeroes(ns->blkconf.blk,
3557 nvme_l2b(ns, zone->d.zslba),
3558 nvme_l2b(ns, ns->zone_size),
3559 BDRV_REQ_MAY_UNMAP,
3560 nvme_zone_reset_epilogue_cb,
3561 iocb);
3562 return;
3563 }
3564
3565 done:
3566 iocb->aiocb = NULL;
3567 if (iocb->bh) {
3568 qemu_bh_schedule(iocb->bh);
3569 }
3570 }
3571
3572 static uint16_t nvme_zone_mgmt_send(NvmeCtrl *n, NvmeRequest *req)
3573 {
3574 NvmeCmd *cmd = (NvmeCmd *)&req->cmd;
3575 NvmeNamespace *ns = req->ns;
3576 NvmeZone *zone;
3577 NvmeZoneResetAIOCB *iocb;
3578 uint8_t *zd_ext;
3579 uint32_t dw13 = le32_to_cpu(cmd->cdw13);
3580 uint64_t slba = 0;
3581 uint32_t zone_idx = 0;
3582 uint16_t status;
3583 uint8_t action;
3584 bool all;
3585 enum NvmeZoneProcessingMask proc_mask = NVME_PROC_CURRENT_ZONE;
3586
3587 action = dw13 & 0xff;
3588 all = !!(dw13 & 0x100);
3589
3590 req->status = NVME_SUCCESS;
3591
3592 if (!all) {
3593 status = nvme_get_mgmt_zone_slba_idx(ns, cmd, &slba, &zone_idx);
3594 if (status) {
3595 return status;
3596 }
3597 }
3598
3599 zone = &ns->zone_array[zone_idx];
3600 if (slba != zone->d.zslba) {
3601 trace_pci_nvme_err_unaligned_zone_cmd(action, slba, zone->d.zslba);
3602 return NVME_INVALID_FIELD | NVME_DNR;
3603 }
3604
3605 switch (action) {
3606
3607 case NVME_ZONE_ACTION_OPEN:
3608 if (all) {
3609 proc_mask = NVME_PROC_CLOSED_ZONES;
3610 }
3611 trace_pci_nvme_open_zone(slba, zone_idx, all);
3612 status = nvme_do_zone_op(ns, zone, proc_mask, nvme_open_zone, req);
3613 break;
3614
3615 case NVME_ZONE_ACTION_CLOSE:
3616 if (all) {
3617 proc_mask = NVME_PROC_OPENED_ZONES;
3618 }
3619 trace_pci_nvme_close_zone(slba, zone_idx, all);
3620 status = nvme_do_zone_op(ns, zone, proc_mask, nvme_close_zone, req);
3621 break;
3622
3623 case NVME_ZONE_ACTION_FINISH:
3624 if (all) {
3625 proc_mask = NVME_PROC_OPENED_ZONES | NVME_PROC_CLOSED_ZONES;
3626 }
3627 trace_pci_nvme_finish_zone(slba, zone_idx, all);
3628 status = nvme_do_zone_op(ns, zone, proc_mask, nvme_finish_zone, req);
3629 break;
3630
3631 case NVME_ZONE_ACTION_RESET:
3632 trace_pci_nvme_reset_zone(slba, zone_idx, all);
3633
3634 iocb = blk_aio_get(&nvme_zone_reset_aiocb_info, ns->blkconf.blk,
3635 nvme_misc_cb, req);
3636
3637 iocb->req = req;
3638 iocb->bh = qemu_bh_new(nvme_zone_reset_bh, iocb);
3639 iocb->ret = 0;
3640 iocb->all = all;
3641 iocb->idx = zone_idx;
3642 iocb->zone = NULL;
3643
3644 req->aiocb = &iocb->common;
3645 nvme_zone_reset_cb(iocb, 0);
3646
3647 return NVME_NO_COMPLETE;
3648
3649 case NVME_ZONE_ACTION_OFFLINE:
3650 if (all) {
3651 proc_mask = NVME_PROC_READ_ONLY_ZONES;
3652 }
3653 trace_pci_nvme_offline_zone(slba, zone_idx, all);
3654 status = nvme_do_zone_op(ns, zone, proc_mask, nvme_offline_zone, req);
3655 break;
3656
3657 case NVME_ZONE_ACTION_SET_ZD_EXT:
3658 trace_pci_nvme_set_descriptor_extension(slba, zone_idx);
3659 if (all || !ns->params.zd_extension_size) {
3660 return NVME_INVALID_FIELD | NVME_DNR;
3661 }
3662 zd_ext = nvme_get_zd_extension(ns, zone_idx);
3663 status = nvme_h2c(n, zd_ext, ns->params.zd_extension_size, req);
3664 if (status) {
3665 trace_pci_nvme_err_zd_extension_map_error(zone_idx);
3666 return status;
3667 }
3668
3669 status = nvme_set_zd_ext(ns, zone);
3670 if (status == NVME_SUCCESS) {
3671 trace_pci_nvme_zd_extension_set(zone_idx);
3672 return status;
3673 }
3674 break;
3675
3676 default:
3677 trace_pci_nvme_err_invalid_mgmt_action(action);
3678 status = NVME_INVALID_FIELD;
3679 }
3680
3681 if (status == NVME_ZONE_INVAL_TRANSITION) {
3682 trace_pci_nvme_err_invalid_zone_state_transition(action, slba,
3683 zone->d.za);
3684 }
3685 if (status) {
3686 status |= NVME_DNR;
3687 }
3688
3689 return status;
3690 }
3691
3692 static bool nvme_zone_matches_filter(uint32_t zafs, NvmeZone *zl)
3693 {
3694 NvmeZoneState zs = nvme_get_zone_state(zl);
3695
3696 switch (zafs) {
3697 case NVME_ZONE_REPORT_ALL:
3698 return true;
3699 case NVME_ZONE_REPORT_EMPTY:
3700 return zs == NVME_ZONE_STATE_EMPTY;
3701 case NVME_ZONE_REPORT_IMPLICITLY_OPEN:
3702 return zs == NVME_ZONE_STATE_IMPLICITLY_OPEN;
3703 case NVME_ZONE_REPORT_EXPLICITLY_OPEN:
3704 return zs == NVME_ZONE_STATE_EXPLICITLY_OPEN;
3705 case NVME_ZONE_REPORT_CLOSED:
3706 return zs == NVME_ZONE_STATE_CLOSED;
3707 case NVME_ZONE_REPORT_FULL:
3708 return zs == NVME_ZONE_STATE_FULL;
3709 case NVME_ZONE_REPORT_READ_ONLY:
3710 return zs == NVME_ZONE_STATE_READ_ONLY;
3711 case NVME_ZONE_REPORT_OFFLINE:
3712 return zs == NVME_ZONE_STATE_OFFLINE;
3713 default:
3714 return false;
3715 }
3716 }
3717
3718 static uint16_t nvme_zone_mgmt_recv(NvmeCtrl *n, NvmeRequest *req)
3719 {
3720 NvmeCmd *cmd = (NvmeCmd *)&req->cmd;
3721 NvmeNamespace *ns = req->ns;
3722 /* cdw12 is zero-based number of dwords to return. Convert to bytes */
3723 uint32_t data_size = (le32_to_cpu(cmd->cdw12) + 1) << 2;
3724 uint32_t dw13 = le32_to_cpu(cmd->cdw13);
3725 uint32_t zone_idx, zra, zrasf, partial;
3726 uint64_t max_zones, nr_zones = 0;
3727 uint16_t status;
3728 uint64_t slba;
3729 NvmeZoneDescr *z;
3730 NvmeZone *zone;
3731 NvmeZoneReportHeader *header;
3732 void *buf, *buf_p;
3733 size_t zone_entry_sz;
3734 int i;
3735
3736 req->status = NVME_SUCCESS;
3737
3738 status = nvme_get_mgmt_zone_slba_idx(ns, cmd, &slba, &zone_idx);
3739 if (status) {
3740 return status;
3741 }
3742
3743 zra = dw13 & 0xff;
3744 if (zra != NVME_ZONE_REPORT && zra != NVME_ZONE_REPORT_EXTENDED) {
3745 return NVME_INVALID_FIELD | NVME_DNR;
3746 }
3747 if (zra == NVME_ZONE_REPORT_EXTENDED && !ns->params.zd_extension_size) {
3748 return NVME_INVALID_FIELD | NVME_DNR;
3749 }
3750
3751 zrasf = (dw13 >> 8) & 0xff;
3752 if (zrasf > NVME_ZONE_REPORT_OFFLINE) {
3753 return NVME_INVALID_FIELD | NVME_DNR;
3754 }
3755
3756 if (data_size < sizeof(NvmeZoneReportHeader)) {
3757 return NVME_INVALID_FIELD | NVME_DNR;
3758 }
3759
3760 status = nvme_check_mdts(n, data_size);
3761 if (status) {
3762 return status;
3763 }
3764
3765 partial = (dw13 >> 16) & 0x01;
3766
3767 zone_entry_sz = sizeof(NvmeZoneDescr);
3768 if (zra == NVME_ZONE_REPORT_EXTENDED) {
3769 zone_entry_sz += ns->params.zd_extension_size;
3770 }
3771
3772 max_zones = (data_size - sizeof(NvmeZoneReportHeader)) / zone_entry_sz;
3773 buf = g_malloc0(data_size);
3774
3775 zone = &ns->zone_array[zone_idx];
3776 for (i = zone_idx; i < ns->num_zones; i++) {
3777 if (partial && nr_zones >= max_zones) {
3778 break;
3779 }
3780 if (nvme_zone_matches_filter(zrasf, zone++)) {
3781 nr_zones++;
3782 }
3783 }
3784 header = (NvmeZoneReportHeader *)buf;
3785 header->nr_zones = cpu_to_le64(nr_zones);
3786
3787 buf_p = buf + sizeof(NvmeZoneReportHeader);
3788 for (; zone_idx < ns->num_zones && max_zones > 0; zone_idx++) {
3789 zone = &ns->zone_array[zone_idx];
3790 if (nvme_zone_matches_filter(zrasf, zone)) {
3791 z = (NvmeZoneDescr *)buf_p;
3792 buf_p += sizeof(NvmeZoneDescr);
3793
3794 z->zt = zone->d.zt;
3795 z->zs = zone->d.zs;
3796 z->zcap = cpu_to_le64(zone->d.zcap);
3797 z->zslba = cpu_to_le64(zone->d.zslba);
3798 z->za = zone->d.za;
3799
3800 if (nvme_wp_is_valid(zone)) {
3801 z->wp = cpu_to_le64(zone->d.wp);
3802 } else {
3803 z->wp = cpu_to_le64(~0ULL);
3804 }
3805
3806 if (zra == NVME_ZONE_REPORT_EXTENDED) {
3807 if (zone->d.za & NVME_ZA_ZD_EXT_VALID) {
3808 memcpy(buf_p, nvme_get_zd_extension(ns, zone_idx),
3809 ns->params.zd_extension_size);
3810 }
3811 buf_p += ns->params.zd_extension_size;
3812 }
3813
3814 max_zones--;
3815 }
3816 }
3817
3818 status = nvme_c2h(n, (uint8_t *)buf, data_size, req);
3819
3820 g_free(buf);
3821
3822 return status;
3823 }
3824
3825 static uint16_t nvme_io_cmd(NvmeCtrl *n, NvmeRequest *req)
3826 {
3827 NvmeNamespace *ns;
3828 uint32_t nsid = le32_to_cpu(req->cmd.nsid);
3829
3830 trace_pci_nvme_io_cmd(nvme_cid(req), nsid, nvme_sqid(req),
3831 req->cmd.opcode, nvme_io_opc_str(req->cmd.opcode));
3832
3833 if (!nvme_nsid_valid(n, nsid)) {
3834 return NVME_INVALID_NSID | NVME_DNR;
3835 }
3836
3837 /*
3838 * In the base NVM command set, Flush may apply to all namespaces
3839 * (indicated by NSID being set to FFFFFFFFh). But if that feature is used
3840 * along with TP 4056 (Namespace Types), it may be pretty screwed up.
3841 *
3842 * If NSID is indeed set to FFFFFFFFh, we simply cannot associate the
3843 * opcode with a specific command since we cannot determine a unique I/O
3844 * command set. Opcode 0h could have any other meaning than something
3845 * equivalent to flushing and say it DOES have completely different
3846 * semantics in some other command set - does an NSID of FFFFFFFFh then
3847 * mean "for all namespaces, apply whatever command set specific command
3848 * that uses the 0h opcode?" Or does it mean "for all namespaces, apply
3849 * whatever command that uses the 0h opcode if, and only if, it allows NSID
3850 * to be FFFFFFFFh"?
3851 *
3852 * Anyway (and luckily), for now, we do not care about this since the
3853 * device only supports namespace types that includes the NVM Flush command
3854 * (NVM and Zoned), so always do an NVM Flush.
3855 */
3856 if (req->cmd.opcode == NVME_CMD_FLUSH) {
3857 return nvme_flush(n, req);
3858 }
3859
3860 ns = nvme_ns(n, nsid);
3861 if (unlikely(!ns)) {
3862 return NVME_INVALID_FIELD | NVME_DNR;
3863 }
3864
3865 if (!(ns->iocs[req->cmd.opcode] & NVME_CMD_EFF_CSUPP)) {
3866 trace_pci_nvme_err_invalid_opc(req->cmd.opcode);
3867 return NVME_INVALID_OPCODE | NVME_DNR;
3868 }
3869
3870 if (ns->status) {
3871 return ns->status;
3872 }
3873
3874 req->ns = ns;
3875
3876 switch (req->cmd.opcode) {
3877 case NVME_CMD_WRITE_ZEROES:
3878 return nvme_write_zeroes(n, req);
3879 case NVME_CMD_ZONE_APPEND:
3880 return nvme_zone_append(n, req);
3881 case NVME_CMD_WRITE:
3882 return nvme_write(n, req);
3883 case NVME_CMD_READ:
3884 return nvme_read(n, req);
3885 case NVME_CMD_COMPARE:
3886 return nvme_compare(n, req);
3887 case NVME_CMD_DSM:
3888 return nvme_dsm(n, req);
3889 case NVME_CMD_VERIFY:
3890 return nvme_verify(n, req);
3891 case NVME_CMD_COPY:
3892 return nvme_copy(n, req);
3893 case NVME_CMD_ZONE_MGMT_SEND:
3894 return nvme_zone_mgmt_send(n, req);
3895 case NVME_CMD_ZONE_MGMT_RECV:
3896 return nvme_zone_mgmt_recv(n, req);
3897 default:
3898 assert(false);
3899 }
3900
3901 return NVME_INVALID_OPCODE | NVME_DNR;
3902 }
3903
3904 static void nvme_free_sq(NvmeSQueue *sq, NvmeCtrl *n)
3905 {
3906 n->sq[sq->sqid] = NULL;
3907 timer_free(sq->timer);
3908 g_free(sq->io_req);
3909 if (sq->sqid) {
3910 g_free(sq);
3911 }
3912 }
3913
3914 static uint16_t nvme_del_sq(NvmeCtrl *n, NvmeRequest *req)
3915 {
3916 NvmeDeleteQ *c = (NvmeDeleteQ *)&req->cmd;
3917 NvmeRequest *r, *next;
3918 NvmeSQueue *sq;
3919 NvmeCQueue *cq;
3920 uint16_t qid = le16_to_cpu(c->qid);
3921
3922 if (unlikely(!qid || nvme_check_sqid(n, qid))) {
3923 trace_pci_nvme_err_invalid_del_sq(qid);
3924 return NVME_INVALID_QID | NVME_DNR;
3925 }
3926
3927 trace_pci_nvme_del_sq(qid);
3928
3929 sq = n->sq[qid];
3930 while (!QTAILQ_EMPTY(&sq->out_req_list)) {
3931 r = QTAILQ_FIRST(&sq->out_req_list);
3932 assert(r->aiocb);
3933 blk_aio_cancel(r->aiocb);
3934 }
3935
3936 assert(QTAILQ_EMPTY(&sq->out_req_list));
3937
3938 if (!nvme_check_cqid(n, sq->cqid)) {
3939 cq = n->cq[sq->cqid];
3940 QTAILQ_REMOVE(&cq->sq_list, sq, entry);
3941
3942 nvme_post_cqes(cq);
3943 QTAILQ_FOREACH_SAFE(r, &cq->req_list, entry, next) {
3944 if (r->sq == sq) {
3945 QTAILQ_REMOVE(&cq->req_list, r, entry);
3946 QTAILQ_INSERT_TAIL(&sq->req_list, r, entry);
3947 }
3948 }
3949 }
3950
3951 nvme_free_sq(sq, n);
3952 return NVME_SUCCESS;
3953 }
3954
3955 static void nvme_init_sq(NvmeSQueue *sq, NvmeCtrl *n, uint64_t dma_addr,
3956 uint16_t sqid, uint16_t cqid, uint16_t size)
3957 {
3958 int i;
3959 NvmeCQueue *cq;
3960
3961 sq->ctrl = n;
3962 sq->dma_addr = dma_addr;
3963 sq->sqid = sqid;
3964 sq->size = size;
3965 sq->cqid = cqid;
3966 sq->head = sq->tail = 0;
3967 sq->io_req = g_new0(NvmeRequest, sq->size);
3968
3969 QTAILQ_INIT(&sq->req_list);
3970 QTAILQ_INIT(&sq->out_req_list);
3971 for (i = 0; i < sq->size; i++) {
3972 sq->io_req[i].sq = sq;
3973 QTAILQ_INSERT_TAIL(&(sq->req_list), &sq->io_req[i], entry);
3974 }
3975 sq->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, nvme_process_sq, sq);
3976
3977 assert(n->cq[cqid]);
3978 cq = n->cq[cqid];
3979 QTAILQ_INSERT_TAIL(&(cq->sq_list), sq, entry);
3980 n->sq[sqid] = sq;
3981 }
3982
3983 static uint16_t nvme_create_sq(NvmeCtrl *n, NvmeRequest *req)
3984 {
3985 NvmeSQueue *sq;
3986 NvmeCreateSq *c = (NvmeCreateSq *)&req->cmd;
3987
3988 uint16_t cqid = le16_to_cpu(c->cqid);
3989 uint16_t sqid = le16_to_cpu(c->sqid);
3990 uint16_t qsize = le16_to_cpu(c->qsize);
3991 uint16_t qflags = le16_to_cpu(c->sq_flags);
3992 uint64_t prp1 = le64_to_cpu(c->prp1);
3993
3994 trace_pci_nvme_create_sq(prp1, sqid, cqid, qsize, qflags);
3995
3996 if (unlikely(!cqid || nvme_check_cqid(n, cqid))) {
3997 trace_pci_nvme_err_invalid_create_sq_cqid(cqid);
3998 return NVME_INVALID_CQID | NVME_DNR;
3999 }
4000 if (unlikely(!sqid || sqid > n->params.max_ioqpairs ||
4001 n->sq[sqid] != NULL)) {
4002 trace_pci_nvme_err_invalid_create_sq_sqid(sqid);
4003 return NVME_INVALID_QID | NVME_DNR;
4004 }
4005 if (unlikely(!qsize || qsize > NVME_CAP_MQES(n->bar.cap))) {
4006 trace_pci_nvme_err_invalid_create_sq_size(qsize);
4007 return NVME_MAX_QSIZE_EXCEEDED | NVME_DNR;
4008 }
4009 if (unlikely(prp1 & (n->page_size - 1))) {
4010 trace_pci_nvme_err_invalid_create_sq_addr(prp1);
4011 return NVME_INVALID_PRP_OFFSET | NVME_DNR;
4012 }
4013 if (unlikely(!(NVME_SQ_FLAGS_PC(qflags)))) {
4014 trace_pci_nvme_err_invalid_create_sq_qflags(NVME_SQ_FLAGS_PC(qflags));
4015 return NVME_INVALID_FIELD | NVME_DNR;
4016 }
4017 sq = g_malloc0(sizeof(*sq));
4018 nvme_init_sq(sq, n, prp1, sqid, cqid, qsize + 1);
4019 return NVME_SUCCESS;
4020 }
4021
4022 struct nvme_stats {
4023 uint64_t units_read;
4024 uint64_t units_written;
4025 uint64_t read_commands;
4026 uint64_t write_commands;
4027 };
4028
4029 static void nvme_set_blk_stats(NvmeNamespace *ns, struct nvme_stats *stats)
4030 {
4031 BlockAcctStats *s = blk_get_stats(ns->blkconf.blk);
4032
4033 stats->units_read += s->nr_bytes[BLOCK_ACCT_READ] >> BDRV_SECTOR_BITS;
4034 stats->units_written += s->nr_bytes[BLOCK_ACCT_WRITE] >> BDRV_SECTOR_BITS;
4035 stats->read_commands += s->nr_ops[BLOCK_ACCT_READ];
4036 stats->write_commands += s->nr_ops[BLOCK_ACCT_WRITE];
4037 }
4038
4039 static uint16_t nvme_smart_info(NvmeCtrl *n, uint8_t rae, uint32_t buf_len,
4040 uint64_t off, NvmeRequest *req)
4041 {
4042 uint32_t nsid = le32_to_cpu(req->cmd.nsid);
4043 struct nvme_stats stats = { 0 };
4044 NvmeSmartLog smart = { 0 };
4045 uint32_t trans_len;
4046 NvmeNamespace *ns;
4047 time_t current_ms;
4048
4049 if (off >= sizeof(smart)) {
4050 return NVME_INVALID_FIELD | NVME_DNR;
4051 }
4052
4053 if (nsid != 0xffffffff) {
4054 ns = nvme_ns(n, nsid);
4055 if (!ns) {
4056 return NVME_INVALID_NSID | NVME_DNR;
4057 }
4058 nvme_set_blk_stats(ns, &stats);
4059 } else {
4060 int i;
4061
4062 for (i = 1; i <= NVME_MAX_NAMESPACES; i++) {
4063 ns = nvme_ns(n, i);
4064 if (!ns) {
4065 continue;
4066 }
4067 nvme_set_blk_stats(ns, &stats);
4068 }
4069 }
4070
4071 trans_len = MIN(sizeof(smart) - off, buf_len);
4072 smart.critical_warning = n->smart_critical_warning;
4073
4074 smart.data_units_read[0] = cpu_to_le64(DIV_ROUND_UP(stats.units_read,
4075 1000));
4076 smart.data_units_written[0] = cpu_to_le64(DIV_ROUND_UP(stats.units_written,
4077 1000));
4078 smart.host_read_commands[0] = cpu_to_le64(stats.read_commands);
4079 smart.host_write_commands[0] = cpu_to_le64(stats.write_commands);
4080
4081 smart.temperature = cpu_to_le16(n->temperature);
4082
4083 if ((n->temperature >= n->features.temp_thresh_hi) ||
4084 (n->temperature <= n->features.temp_thresh_low)) {
4085 smart.critical_warning |= NVME_SMART_TEMPERATURE;
4086 }
4087
4088 current_ms = qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL);
4089 smart.power_on_hours[0] =
4090 cpu_to_le64((((current_ms - n->starttime_ms) / 1000) / 60) / 60);
4091
4092 if (!rae) {
4093 nvme_clear_events(n, NVME_AER_TYPE_SMART);
4094 }
4095
4096 return nvme_c2h(n, (uint8_t *) &smart + off, trans_len, req);
4097 }
4098
4099 static uint16_t nvme_fw_log_info(NvmeCtrl *n, uint32_t buf_len, uint64_t off,
4100 NvmeRequest *req)
4101 {
4102 uint32_t trans_len;
4103 NvmeFwSlotInfoLog fw_log = {
4104 .afi = 0x1,
4105 };
4106
4107 if (off >= sizeof(fw_log)) {
4108 return NVME_INVALID_FIELD | NVME_DNR;
4109 }
4110
4111 strpadcpy((char *)&fw_log.frs1, sizeof(fw_log.frs1), "1.0", ' ');
4112 trans_len = MIN(sizeof(fw_log) - off, buf_len);
4113
4114 return nvme_c2h(n, (uint8_t *) &fw_log + off, trans_len, req);
4115 }
4116
4117 static uint16_t nvme_error_info(NvmeCtrl *n, uint8_t rae, uint32_t buf_len,
4118 uint64_t off, NvmeRequest *req)
4119 {
4120 uint32_t trans_len;
4121 NvmeErrorLog errlog;
4122
4123 if (off >= sizeof(errlog)) {
4124 return NVME_INVALID_FIELD | NVME_DNR;
4125 }
4126
4127 if (!rae) {
4128 nvme_clear_events(n, NVME_AER_TYPE_ERROR);
4129 }
4130
4131 memset(&errlog, 0x0, sizeof(errlog));
4132 trans_len = MIN(sizeof(errlog) - off, buf_len);
4133
4134 return nvme_c2h(n, (uint8_t *)&errlog, trans_len, req);
4135 }
4136
4137 static uint16_t nvme_changed_nslist(NvmeCtrl *n, uint8_t rae, uint32_t buf_len,
4138 uint64_t off, NvmeRequest *req)
4139 {
4140 uint32_t nslist[1024];
4141 uint32_t trans_len;
4142 int i = 0;
4143 uint32_t nsid;
4144
4145 memset(nslist, 0x0, sizeof(nslist));
4146 trans_len = MIN(sizeof(nslist) - off, buf_len);
4147
4148 while ((nsid = find_first_bit(n->changed_nsids, NVME_CHANGED_NSID_SIZE)) !=
4149 NVME_CHANGED_NSID_SIZE) {
4150 /*
4151 * If more than 1024 namespaces, the first entry in the log page should
4152 * be set to FFFFFFFFh and the others to 0 as spec.
4153 */
4154 if (i == ARRAY_SIZE(nslist)) {
4155 memset(nslist, 0x0, sizeof(nslist));
4156 nslist[0] = 0xffffffff;
4157 break;
4158 }
4159
4160 nslist[i++] = nsid;
4161 clear_bit(nsid, n->changed_nsids);
4162 }
4163
4164 /*
4165 * Remove all the remaining list entries in case returns directly due to
4166 * more than 1024 namespaces.
4167 */
4168 if (nslist[0] == 0xffffffff) {
4169 bitmap_zero(n->changed_nsids, NVME_CHANGED_NSID_SIZE);
4170 }
4171
4172 if (!rae) {
4173 nvme_clear_events(n, NVME_AER_TYPE_NOTICE);
4174 }
4175
4176 return nvme_c2h(n, ((uint8_t *)nslist) + off, trans_len, req);
4177 }
4178
4179 static uint16_t nvme_cmd_effects(NvmeCtrl *n, uint8_t csi, uint32_t buf_len,
4180 uint64_t off, NvmeRequest *req)
4181 {
4182 NvmeEffectsLog log = {};
4183 const uint32_t *src_iocs = NULL;
4184 uint32_t trans_len;
4185
4186 if (off >= sizeof(log)) {
4187 trace_pci_nvme_err_invalid_log_page_offset(off, sizeof(log));
4188 return NVME_INVALID_FIELD | NVME_DNR;
4189 }
4190
4191 switch (NVME_CC_CSS(n->bar.cc)) {
4192 case NVME_CC_CSS_NVM:
4193 src_iocs = nvme_cse_iocs_nvm;
4194 /* fall through */
4195 case NVME_CC_CSS_ADMIN_ONLY:
4196 break;
4197 case NVME_CC_CSS_CSI:
4198 switch (csi) {
4199 case NVME_CSI_NVM:
4200 src_iocs = nvme_cse_iocs_nvm;
4201 break;
4202 case NVME_CSI_ZONED:
4203 src_iocs = nvme_cse_iocs_zoned;
4204 break;
4205 }
4206 }
4207
4208 memcpy(log.acs, nvme_cse_acs, sizeof(nvme_cse_acs));
4209
4210 if (src_iocs) {
4211 memcpy(log.iocs, src_iocs, sizeof(log.iocs));
4212 }
4213
4214 trans_len = MIN(sizeof(log) - off, buf_len);
4215
4216 return nvme_c2h(n, ((uint8_t *)&log) + off, trans_len, req);
4217 }
4218
4219 static uint16_t nvme_get_log(NvmeCtrl *n, NvmeRequest *req)
4220 {
4221 NvmeCmd *cmd = &req->cmd;
4222
4223 uint32_t dw10 = le32_to_cpu(cmd->cdw10);
4224 uint32_t dw11 = le32_to_cpu(cmd->cdw11);
4225 uint32_t dw12 = le32_to_cpu(cmd->cdw12);
4226 uint32_t dw13 = le32_to_cpu(cmd->cdw13);
4227 uint8_t lid = dw10 & 0xff;
4228 uint8_t lsp = (dw10 >> 8) & 0xf;
4229 uint8_t rae = (dw10 >> 15) & 0x1;
4230 uint8_t csi = le32_to_cpu(cmd->cdw14) >> 24;
4231 uint32_t numdl, numdu;
4232 uint64_t off, lpol, lpou;
4233 size_t len;
4234 uint16_t status;
4235
4236 numdl = (dw10 >> 16);
4237 numdu = (dw11 & 0xffff);
4238 lpol = dw12;
4239 lpou = dw13;
4240
4241 len = (((numdu << 16) | numdl) + 1) << 2;
4242 off = (lpou << 32ULL) | lpol;
4243
4244 if (off & 0x3) {
4245 return NVME_INVALID_FIELD | NVME_DNR;
4246 }
4247
4248 trace_pci_nvme_get_log(nvme_cid(req), lid, lsp, rae, len, off);
4249
4250 status = nvme_check_mdts(n, len);
4251 if (status) {
4252 return status;
4253 }
4254
4255 switch (lid) {
4256 case NVME_LOG_ERROR_INFO:
4257 return nvme_error_info(n, rae, len, off, req);
4258 case NVME_LOG_SMART_INFO:
4259 return nvme_smart_info(n, rae, len, off, req);
4260 case NVME_LOG_FW_SLOT_INFO:
4261 return nvme_fw_log_info(n, len, off, req);
4262 case NVME_LOG_CHANGED_NSLIST:
4263 return nvme_changed_nslist(n, rae, len, off, req);
4264 case NVME_LOG_CMD_EFFECTS:
4265 return nvme_cmd_effects(n, csi, len, off, req);
4266 default:
4267 trace_pci_nvme_err_invalid_log_page(nvme_cid(req), lid);
4268 return NVME_INVALID_FIELD | NVME_DNR;
4269 }
4270 }
4271
4272 static void nvme_free_cq(NvmeCQueue *cq, NvmeCtrl *n)
4273 {
4274 n->cq[cq->cqid] = NULL;
4275 timer_free(cq->timer);
4276 if (msix_enabled(&n->parent_obj)) {
4277 msix_vector_unuse(&n->parent_obj, cq->vector);
4278 }
4279 if (cq->cqid) {
4280 g_free(cq);
4281 }
4282 }
4283
4284 static uint16_t nvme_del_cq(NvmeCtrl *n, NvmeRequest *req)
4285 {
4286 NvmeDeleteQ *c = (NvmeDeleteQ *)&req->cmd;
4287 NvmeCQueue *cq;
4288 uint16_t qid = le16_to_cpu(c->qid);
4289
4290 if (unlikely(!qid || nvme_check_cqid(n, qid))) {
4291 trace_pci_nvme_err_invalid_del_cq_cqid(qid);
4292 return NVME_INVALID_CQID | NVME_DNR;
4293 }
4294
4295 cq = n->cq[qid];
4296 if (unlikely(!QTAILQ_EMPTY(&cq->sq_list))) {
4297 trace_pci_nvme_err_invalid_del_cq_notempty(qid);
4298 return NVME_INVALID_QUEUE_DEL;
4299 }
4300 nvme_irq_deassert(n, cq);
4301 trace_pci_nvme_del_cq(qid);
4302 nvme_free_cq(cq, n);
4303 return NVME_SUCCESS;
4304 }
4305
4306 static void nvme_init_cq(NvmeCQueue *cq, NvmeCtrl *n, uint64_t dma_addr,
4307 uint16_t cqid, uint16_t vector, uint16_t size,
4308 uint16_t irq_enabled)
4309 {
4310 int ret;
4311
4312 if (msix_enabled(&n->parent_obj)) {
4313 ret = msix_vector_use(&n->parent_obj, vector);
4314 assert(ret == 0);
4315 }
4316 cq->ctrl = n;
4317 cq->cqid = cqid;
4318 cq->size = size;
4319 cq->dma_addr = dma_addr;
4320 cq->phase = 1;
4321 cq->irq_enabled = irq_enabled;
4322 cq->vector = vector;
4323 cq->head = cq->tail = 0;
4324 QTAILQ_INIT(&cq->req_list);
4325 QTAILQ_INIT(&cq->sq_list);
4326 n->cq[cqid] = cq;
4327 cq->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, nvme_post_cqes, cq);
4328 }
4329
4330 static uint16_t nvme_create_cq(NvmeCtrl *n, NvmeRequest *req)
4331 {
4332 NvmeCQueue *cq;
4333 NvmeCreateCq *c = (NvmeCreateCq *)&req->cmd;
4334 uint16_t cqid = le16_to_cpu(c->cqid);
4335 uint16_t vector = le16_to_cpu(c->irq_vector);
4336 uint16_t qsize = le16_to_cpu(c->qsize);
4337 uint16_t qflags = le16_to_cpu(c->cq_flags);
4338 uint64_t prp1 = le64_to_cpu(c->prp1);
4339
4340 trace_pci_nvme_create_cq(prp1, cqid, vector, qsize, qflags,
4341 NVME_CQ_FLAGS_IEN(qflags) != 0);
4342
4343 if (unlikely(!cqid || cqid > n->params.max_ioqpairs ||
4344 n->cq[cqid] != NULL)) {
4345 trace_pci_nvme_err_invalid_create_cq_cqid(cqid);
4346 return NVME_INVALID_QID | NVME_DNR;
4347 }
4348 if (unlikely(!qsize || qsize > NVME_CAP_MQES(n->bar.cap))) {
4349 trace_pci_nvme_err_invalid_create_cq_size(qsize);
4350 return NVME_MAX_QSIZE_EXCEEDED | NVME_DNR;
4351 }
4352 if (unlikely(prp1 & (n->page_size - 1))) {
4353 trace_pci_nvme_err_invalid_create_cq_addr(prp1);
4354 return NVME_INVALID_PRP_OFFSET | NVME_DNR;
4355 }
4356 if (unlikely(!msix_enabled(&n->parent_obj) && vector)) {
4357 trace_pci_nvme_err_invalid_create_cq_vector(vector);
4358 return NVME_INVALID_IRQ_VECTOR | NVME_DNR;
4359 }
4360 if (unlikely(vector >= n->params.msix_qsize)) {
4361 trace_pci_nvme_err_invalid_create_cq_vector(vector);
4362 return NVME_INVALID_IRQ_VECTOR | NVME_DNR;
4363 }
4364 if (unlikely(!(NVME_CQ_FLAGS_PC(qflags)))) {
4365 trace_pci_nvme_err_invalid_create_cq_qflags(NVME_CQ_FLAGS_PC(qflags));
4366 return NVME_INVALID_FIELD | NVME_DNR;
4367 }
4368
4369 cq = g_malloc0(sizeof(*cq));
4370 nvme_init_cq(cq, n, prp1, cqid, vector, qsize + 1,
4371 NVME_CQ_FLAGS_IEN(qflags));
4372
4373 /*
4374 * It is only required to set qs_created when creating a completion queue;
4375 * creating a submission queue without a matching completion queue will
4376 * fail.
4377 */
4378 n->qs_created = true;
4379 return NVME_SUCCESS;
4380 }
4381
4382 static uint16_t nvme_rpt_empty_id_struct(NvmeCtrl *n, NvmeRequest *req)
4383 {
4384 uint8_t id[NVME_IDENTIFY_DATA_SIZE] = {};
4385
4386 return nvme_c2h(n, id, sizeof(id), req);
4387 }
4388
4389 static uint16_t nvme_identify_ctrl(NvmeCtrl *n, NvmeRequest *req)
4390 {
4391 trace_pci_nvme_identify_ctrl();
4392
4393 return nvme_c2h(n, (uint8_t *)&n->id_ctrl, sizeof(n->id_ctrl), req);
4394 }
4395
4396 static uint16_t nvme_identify_ctrl_csi(NvmeCtrl *n, NvmeRequest *req)
4397 {
4398 NvmeIdentify *c = (NvmeIdentify *)&req->cmd;
4399 uint8_t id[NVME_IDENTIFY_DATA_SIZE] = {};
4400 NvmeIdCtrlNvm *id_nvm = (NvmeIdCtrlNvm *)&id;
4401
4402 trace_pci_nvme_identify_ctrl_csi(c->csi);
4403
4404 switch (c->csi) {
4405 case NVME_CSI_NVM:
4406 id_nvm->vsl = n->params.vsl;
4407 id_nvm->dmrsl = cpu_to_le32(n->dmrsl);
4408 break;
4409
4410 case NVME_CSI_ZONED:
4411 ((NvmeIdCtrlZoned *)&id)->zasl = n->params.zasl;
4412 break;
4413
4414 default:
4415 return NVME_INVALID_FIELD | NVME_DNR;
4416 }
4417
4418 return nvme_c2h(n, id, sizeof(id), req);
4419 }
4420
4421 static uint16_t nvme_identify_ns(NvmeCtrl *n, NvmeRequest *req, bool active)
4422 {
4423 NvmeNamespace *ns;
4424 NvmeIdentify *c = (NvmeIdentify *)&req->cmd;
4425 uint32_t nsid = le32_to_cpu(c->nsid);
4426
4427 trace_pci_nvme_identify_ns(nsid);
4428
4429 if (!nvme_nsid_valid(n, nsid) || nsid == NVME_NSID_BROADCAST) {
4430 return NVME_INVALID_NSID | NVME_DNR;
4431 }
4432
4433 ns = nvme_ns(n, nsid);
4434 if (unlikely(!ns)) {
4435 if (!active) {
4436 ns = nvme_subsys_ns(n->subsys, nsid);
4437 if (!ns) {
4438 return nvme_rpt_empty_id_struct(n, req);
4439 }
4440 } else {
4441 return nvme_rpt_empty_id_struct(n, req);
4442 }
4443 }
4444
4445 if (active || ns->csi == NVME_CSI_NVM) {
4446 return nvme_c2h(n, (uint8_t *)&ns->id_ns, sizeof(NvmeIdNs), req);
4447 }
4448
4449 return NVME_INVALID_CMD_SET | NVME_DNR;
4450 }
4451
4452 static uint16_t nvme_identify_ctrl_list(NvmeCtrl *n, NvmeRequest *req,
4453 bool attached)
4454 {
4455 NvmeIdentify *c = (NvmeIdentify *)&req->cmd;
4456 uint32_t nsid = le32_to_cpu(c->nsid);
4457 uint16_t min_id = le16_to_cpu(c->ctrlid);
4458 uint16_t list[NVME_CONTROLLER_LIST_SIZE] = {};
4459 uint16_t *ids = &list[1];
4460 NvmeNamespace *ns;
4461 NvmeCtrl *ctrl;
4462 int cntlid, nr_ids = 0;
4463
4464 trace_pci_nvme_identify_ctrl_list(c->cns, min_id);
4465
4466 if (!n->subsys) {
4467 return NVME_INVALID_FIELD | NVME_DNR;
4468 }
4469
4470 if (attached) {
4471 if (nsid == NVME_NSID_BROADCAST) {
4472 return NVME_INVALID_FIELD | NVME_DNR;
4473 }
4474
4475 ns = nvme_subsys_ns(n->subsys, nsid);
4476 if (!ns) {
4477 return NVME_INVALID_FIELD | NVME_DNR;
4478 }
4479 }
4480
4481 for (cntlid = min_id; cntlid < ARRAY_SIZE(n->subsys->ctrls); cntlid++) {
4482 ctrl = nvme_subsys_ctrl(n->subsys, cntlid);
4483 if (!ctrl) {
4484 continue;
4485 }
4486
4487 if (attached && !nvme_ns(ctrl, nsid)) {
4488 continue;
4489 }
4490
4491 ids[nr_ids++] = cntlid;
4492 }
4493
4494 list[0] = nr_ids;
4495
4496 return nvme_c2h(n, (uint8_t *)list, sizeof(list), req);
4497 }
4498
4499 static uint16_t nvme_identify_ns_csi(NvmeCtrl *n, NvmeRequest *req,
4500 bool active)
4501 {
4502 NvmeNamespace *ns;
4503 NvmeIdentify *c = (NvmeIdentify *)&req->cmd;
4504 uint32_t nsid = le32_to_cpu(c->nsid);
4505
4506 trace_pci_nvme_identify_ns_csi(nsid, c->csi);
4507
4508 if (!nvme_nsid_valid(n, nsid) || nsid == NVME_NSID_BROADCAST) {
4509 return NVME_INVALID_NSID | NVME_DNR;
4510 }
4511
4512 ns = nvme_ns(n, nsid);
4513 if (unlikely(!ns)) {
4514 if (!active) {
4515 ns = nvme_subsys_ns(n->subsys, nsid);
4516 if (!ns) {
4517 return nvme_rpt_empty_id_struct(n, req);
4518 }
4519 } else {
4520 return nvme_rpt_empty_id_struct(n, req);
4521 }
4522 }
4523
4524 if (c->csi == NVME_CSI_NVM) {
4525 return nvme_rpt_empty_id_struct(n, req);
4526 } else if (c->csi == NVME_CSI_ZONED && ns->csi == NVME_CSI_ZONED) {
4527 return nvme_c2h(n, (uint8_t *)ns->id_ns_zoned, sizeof(NvmeIdNsZoned),
4528 req);
4529 }
4530
4531 return NVME_INVALID_FIELD | NVME_DNR;
4532 }
4533
4534 static uint16_t nvme_identify_nslist(NvmeCtrl *n, NvmeRequest *req,
4535 bool active)
4536 {
4537 NvmeNamespace *ns;
4538 NvmeIdentify *c = (NvmeIdentify *)&req->cmd;
4539 uint32_t min_nsid = le32_to_cpu(c->nsid);
4540 uint8_t list[NVME_IDENTIFY_DATA_SIZE] = {};
4541 static const int data_len = sizeof(list);
4542 uint32_t *list_ptr = (uint32_t *)list;
4543 int i, j = 0;
4544
4545 trace_pci_nvme_identify_nslist(min_nsid);
4546
4547 /*
4548 * Both FFFFFFFFh (NVME_NSID_BROADCAST) and FFFFFFFFEh are invalid values
4549 * since the Active Namespace ID List should return namespaces with ids
4550 * *higher* than the NSID specified in the command. This is also specified
4551 * in the spec (NVM Express v1.3d, Section 5.15.4).
4552 */
4553 if (min_nsid >= NVME_NSID_BROADCAST - 1) {
4554 return NVME_INVALID_NSID | NVME_DNR;
4555 }
4556
4557 for (i = 1; i <= NVME_MAX_NAMESPACES; i++) {
4558 ns = nvme_ns(n, i);
4559 if (!ns) {
4560 if (!active) {
4561 ns = nvme_subsys_ns(n->subsys, i);
4562 if (!ns) {
4563 continue;
4564 }
4565 } else {
4566 continue;
4567 }
4568 }
4569 if (ns->params.nsid <= min_nsid) {
4570 continue;
4571 }
4572 list_ptr[j++] = cpu_to_le32(ns->params.nsid);
4573 if (j == data_len / sizeof(uint32_t)) {
4574 break;
4575 }
4576 }
4577
4578 return nvme_c2h(n, list, data_len, req);
4579 }
4580
4581 static uint16_t nvme_identify_nslist_csi(NvmeCtrl *n, NvmeRequest *req,
4582 bool active)
4583 {
4584 NvmeNamespace *ns;
4585 NvmeIdentify *c = (NvmeIdentify *)&req->cmd;
4586 uint32_t min_nsid = le32_to_cpu(c->nsid);
4587 uint8_t list[NVME_IDENTIFY_DATA_SIZE] = {};
4588 static const int data_len = sizeof(list);
4589 uint32_t *list_ptr = (uint32_t *)list;
4590 int i, j = 0;
4591
4592 trace_pci_nvme_identify_nslist_csi(min_nsid, c->csi);
4593
4594 /*
4595 * Same as in nvme_identify_nslist(), FFFFFFFFh/FFFFFFFFEh are invalid.
4596 */
4597 if (min_nsid >= NVME_NSID_BROADCAST - 1) {
4598 return NVME_INVALID_NSID | NVME_DNR;
4599 }
4600
4601 if (c->csi != NVME_CSI_NVM && c->csi != NVME_CSI_ZONED) {
4602 return NVME_INVALID_FIELD | NVME_DNR;
4603 }
4604
4605 for (i = 1; i <= NVME_MAX_NAMESPACES; i++) {
4606 ns = nvme_ns(n, i);
4607 if (!ns) {
4608 if (!active) {
4609 ns = nvme_subsys_ns(n->subsys, i);
4610 if (!ns) {
4611 continue;
4612 }
4613 } else {
4614 continue;
4615 }
4616 }
4617 if (ns->params.nsid <= min_nsid || c->csi != ns->csi) {
4618 continue;
4619 }
4620 list_ptr[j++] = cpu_to_le32(ns->params.nsid);
4621 if (j == data_len / sizeof(uint32_t)) {
4622 break;
4623 }
4624 }
4625
4626 return nvme_c2h(n, list, data_len, req);
4627 }
4628
4629 static uint16_t nvme_identify_ns_descr_list(NvmeCtrl *n, NvmeRequest *req)
4630 {
4631 NvmeNamespace *ns;
4632 NvmeIdentify *c = (NvmeIdentify *)&req->cmd;
4633 uint32_t nsid = le32_to_cpu(c->nsid);
4634 uint8_t list[NVME_IDENTIFY_DATA_SIZE] = {};
4635 uint8_t *pos = list;
4636 struct {
4637 NvmeIdNsDescr hdr;
4638 uint8_t v[NVME_NIDL_UUID];
4639 } QEMU_PACKED uuid;
4640 struct {
4641 NvmeIdNsDescr hdr;
4642 uint64_t v;
4643 } QEMU_PACKED eui64;
4644 struct {
4645 NvmeIdNsDescr hdr;
4646 uint8_t v;
4647 } QEMU_PACKED csi;
4648
4649 trace_pci_nvme_identify_ns_descr_list(nsid);
4650
4651 if (!nvme_nsid_valid(n, nsid) || nsid == NVME_NSID_BROADCAST) {
4652 return NVME_INVALID_NSID | NVME_DNR;
4653 }
4654
4655 ns = nvme_ns(n, nsid);
4656 if (unlikely(!ns)) {
4657 return NVME_INVALID_FIELD | NVME_DNR;
4658 }
4659
4660 /*
4661 * If the EUI-64 field is 0 and the NGUID field is 0, the namespace must
4662 * provide a valid Namespace UUID in the Namespace Identification Descriptor
4663 * data structure. QEMU does not yet support setting NGUID.
4664 */
4665 uuid.hdr.nidt = NVME_NIDT_UUID;
4666 uuid.hdr.nidl = NVME_NIDL_UUID;
4667 memcpy(uuid.v, ns->params.uuid.data, NVME_NIDL_UUID);
4668 memcpy(pos, &uuid, sizeof(uuid));
4669 pos += sizeof(uuid);
4670
4671 if (ns->params.eui64) {
4672 eui64.hdr.nidt = NVME_NIDT_EUI64;
4673 eui64.hdr.nidl = NVME_NIDL_EUI64;
4674 eui64.v = cpu_to_be64(ns->params.eui64);
4675 memcpy(pos, &eui64, sizeof(eui64));
4676 pos += sizeof(eui64);
4677 }
4678
4679 csi.hdr.nidt = NVME_NIDT_CSI;
4680 csi.hdr.nidl = NVME_NIDL_CSI;
4681 csi.v = ns->csi;
4682 memcpy(pos, &csi, sizeof(csi));
4683 pos += sizeof(csi);
4684
4685 return nvme_c2h(n, list, sizeof(list), req);
4686 }
4687
4688 static uint16_t nvme_identify_cmd_set(NvmeCtrl *n, NvmeRequest *req)
4689 {
4690 uint8_t list[NVME_IDENTIFY_DATA_SIZE] = {};
4691 static const int data_len = sizeof(list);
4692
4693 trace_pci_nvme_identify_cmd_set();
4694
4695 NVME_SET_CSI(*list, NVME_CSI_NVM);
4696 NVME_SET_CSI(*list, NVME_CSI_ZONED);
4697
4698 return nvme_c2h(n, list, data_len, req);
4699 }
4700
4701 static uint16_t nvme_identify(NvmeCtrl *n, NvmeRequest *req)
4702 {
4703 NvmeIdentify *c = (NvmeIdentify *)&req->cmd;
4704
4705 trace_pci_nvme_identify(nvme_cid(req), c->cns, le16_to_cpu(c->ctrlid),
4706 c->csi);
4707
4708 switch (c->cns) {
4709 case NVME_ID_CNS_NS:
4710 return nvme_identify_ns(n, req, true);
4711 case NVME_ID_CNS_NS_PRESENT:
4712 return nvme_identify_ns(n, req, false);
4713 case NVME_ID_CNS_NS_ATTACHED_CTRL_LIST:
4714 return nvme_identify_ctrl_list(n, req, true);
4715 case NVME_ID_CNS_CTRL_LIST:
4716 return nvme_identify_ctrl_list(n, req, false);
4717 case NVME_ID_CNS_CS_NS:
4718 return nvme_identify_ns_csi(n, req, true);
4719 case NVME_ID_CNS_CS_NS_PRESENT:
4720 return nvme_identify_ns_csi(n, req, false);
4721 case NVME_ID_CNS_CTRL:
4722 return nvme_identify_ctrl(n, req);
4723 case NVME_ID_CNS_CS_CTRL:
4724 return nvme_identify_ctrl_csi(n, req);
4725 case NVME_ID_CNS_NS_ACTIVE_LIST:
4726 return nvme_identify_nslist(n, req, true);
4727 case NVME_ID_CNS_NS_PRESENT_LIST:
4728 return nvme_identify_nslist(n, req, false);
4729 case NVME_ID_CNS_CS_NS_ACTIVE_LIST:
4730 return nvme_identify_nslist_csi(n, req, true);
4731 case NVME_ID_CNS_CS_NS_PRESENT_LIST:
4732 return nvme_identify_nslist_csi(n, req, false);
4733 case NVME_ID_CNS_NS_DESCR_LIST:
4734 return nvme_identify_ns_descr_list(n, req);
4735 case NVME_ID_CNS_IO_COMMAND_SET:
4736 return nvme_identify_cmd_set(n, req);
4737 default:
4738 trace_pci_nvme_err_invalid_identify_cns(le32_to_cpu(c->cns));
4739 return NVME_INVALID_FIELD | NVME_DNR;
4740 }
4741 }
4742
4743 static uint16_t nvme_abort(NvmeCtrl *n, NvmeRequest *req)
4744 {
4745 uint16_t sqid = le32_to_cpu(req->cmd.cdw10) & 0xffff;
4746
4747 req->cqe.result = 1;
4748 if (nvme_check_sqid(n, sqid)) {
4749 return NVME_INVALID_FIELD | NVME_DNR;
4750 }
4751
4752 return NVME_SUCCESS;
4753 }
4754
4755 static inline void nvme_set_timestamp(NvmeCtrl *n, uint64_t ts)
4756 {
4757 trace_pci_nvme_setfeat_timestamp(ts);
4758
4759 n->host_timestamp = le64_to_cpu(ts);
4760 n->timestamp_set_qemu_clock_ms = qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL);
4761 }
4762
4763 static inline uint64_t nvme_get_timestamp(const NvmeCtrl *n)
4764 {
4765 uint64_t current_time = qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL);
4766 uint64_t elapsed_time = current_time - n->timestamp_set_qemu_clock_ms;
4767
4768 union nvme_timestamp {
4769 struct {
4770 uint64_t timestamp:48;
4771 uint64_t sync:1;
4772 uint64_t origin:3;
4773 uint64_t rsvd1:12;
4774 };
4775 uint64_t all;
4776 };
4777
4778 union nvme_timestamp ts;
4779 ts.all = 0;
4780 ts.timestamp = n->host_timestamp + elapsed_time;
4781
4782 /* If the host timestamp is non-zero, set the timestamp origin */
4783 ts.origin = n->host_timestamp ? 0x01 : 0x00;
4784
4785 trace_pci_nvme_getfeat_timestamp(ts.all);
4786
4787 return cpu_to_le64(ts.all);
4788 }
4789
4790 static uint16_t nvme_get_feature_timestamp(NvmeCtrl *n, NvmeRequest *req)
4791 {
4792 uint64_t timestamp = nvme_get_timestamp(n);
4793
4794 return nvme_c2h(n, (uint8_t *)&timestamp, sizeof(timestamp), req);
4795 }
4796
4797 static uint16_t nvme_get_feature(NvmeCtrl *n, NvmeRequest *req)
4798 {
4799 NvmeCmd *cmd = &req->cmd;
4800 uint32_t dw10 = le32_to_cpu(cmd->cdw10);
4801 uint32_t dw11 = le32_to_cpu(cmd->cdw11);
4802 uint32_t nsid = le32_to_cpu(cmd->nsid);
4803 uint32_t result;
4804 uint8_t fid = NVME_GETSETFEAT_FID(dw10);
4805 NvmeGetFeatureSelect sel = NVME_GETFEAT_SELECT(dw10);
4806 uint16_t iv;
4807 NvmeNamespace *ns;
4808 int i;
4809
4810 static const uint32_t nvme_feature_default[NVME_FID_MAX] = {
4811 [NVME_ARBITRATION] = NVME_ARB_AB_NOLIMIT,
4812 };
4813
4814 trace_pci_nvme_getfeat(nvme_cid(req), nsid, fid, sel, dw11);
4815
4816 if (!nvme_feature_support[fid]) {
4817 return NVME_INVALID_FIELD | NVME_DNR;
4818 }
4819
4820 if (nvme_feature_cap[fid] & NVME_FEAT_CAP_NS) {
4821 if (!nvme_nsid_valid(n, nsid) || nsid == NVME_NSID_BROADCAST) {
4822 /*
4823 * The Reservation Notification Mask and Reservation Persistence
4824 * features require a status code of Invalid Field in Command when
4825 * NSID is FFFFFFFFh. Since the device does not support those
4826 * features we can always return Invalid Namespace or Format as we
4827 * should do for all other features.
4828 */
4829 return NVME_INVALID_NSID | NVME_DNR;
4830 }
4831
4832 if (!nvme_ns(n, nsid)) {
4833 return NVME_INVALID_FIELD | NVME_DNR;
4834 }
4835 }
4836
4837 switch (sel) {
4838 case NVME_GETFEAT_SELECT_CURRENT:
4839 break;
4840 case NVME_GETFEAT_SELECT_SAVED:
4841 /* no features are saveable by the controller; fallthrough */
4842 case NVME_GETFEAT_SELECT_DEFAULT:
4843 goto defaults;
4844 case NVME_GETFEAT_SELECT_CAP:
4845 result = nvme_feature_cap[fid];
4846 goto out;
4847 }
4848
4849 switch (fid) {
4850 case NVME_TEMPERATURE_THRESHOLD:
4851 result = 0;
4852
4853 /*
4854 * The controller only implements the Composite Temperature sensor, so
4855 * return 0 for all other sensors.
4856 */
4857 if (NVME_TEMP_TMPSEL(dw11) != NVME_TEMP_TMPSEL_COMPOSITE) {
4858 goto out;
4859 }
4860
4861 switch (NVME_TEMP_THSEL(dw11)) {
4862 case NVME_TEMP_THSEL_OVER:
4863 result = n->features.temp_thresh_hi;
4864 goto out;
4865 case NVME_TEMP_THSEL_UNDER:
4866 result = n->features.temp_thresh_low;
4867 goto out;
4868 }
4869
4870 return NVME_INVALID_FIELD | NVME_DNR;
4871 case NVME_ERROR_RECOVERY:
4872 if (!nvme_nsid_valid(n, nsid)) {
4873 return NVME_INVALID_NSID | NVME_DNR;
4874 }
4875
4876 ns = nvme_ns(n, nsid);
4877 if (unlikely(!ns)) {
4878 return NVME_INVALID_FIELD | NVME_DNR;
4879 }
4880
4881 result = ns->features.err_rec;
4882 goto out;
4883 case NVME_VOLATILE_WRITE_CACHE:
4884 result = 0;
4885 for (i = 1; i <= NVME_MAX_NAMESPACES; i++) {
4886 ns = nvme_ns(n, i);
4887 if (!ns) {
4888 continue;
4889 }
4890
4891 result = blk_enable_write_cache(ns->blkconf.blk);
4892 if (result) {
4893 break;
4894 }
4895 }
4896 trace_pci_nvme_getfeat_vwcache(result ? "enabled" : "disabled");
4897 goto out;
4898 case NVME_ASYNCHRONOUS_EVENT_CONF:
4899 result = n->features.async_config;
4900 goto out;
4901 case NVME_TIMESTAMP:
4902 return nvme_get_feature_timestamp(n, req);
4903 default:
4904 break;
4905 }
4906
4907 defaults:
4908 switch (fid) {
4909 case NVME_TEMPERATURE_THRESHOLD:
4910 result = 0;
4911
4912 if (NVME_TEMP_TMPSEL(dw11) != NVME_TEMP_TMPSEL_COMPOSITE) {
4913 break;
4914 }
4915
4916 if (NVME_TEMP_THSEL(dw11) == NVME_TEMP_THSEL_OVER) {
4917 result = NVME_TEMPERATURE_WARNING;
4918 }
4919
4920 break;
4921 case NVME_NUMBER_OF_QUEUES:
4922 result = (n->params.max_ioqpairs - 1) |
4923 ((n->params.max_ioqpairs - 1) << 16);
4924 trace_pci_nvme_getfeat_numq(result);
4925 break;
4926 case NVME_INTERRUPT_VECTOR_CONF:
4927 iv = dw11 & 0xffff;
4928 if (iv >= n->params.max_ioqpairs + 1) {
4929 return NVME_INVALID_FIELD | NVME_DNR;
4930 }
4931
4932 result = iv;
4933 if (iv == n->admin_cq.vector) {
4934 result |= NVME_INTVC_NOCOALESCING;
4935 }
4936 break;
4937 default:
4938 result = nvme_feature_default[fid];
4939 break;
4940 }
4941
4942 out:
4943 req->cqe.result = cpu_to_le32(result);
4944 return NVME_SUCCESS;
4945 }
4946
4947 static uint16_t nvme_set_feature_timestamp(NvmeCtrl *n, NvmeRequest *req)
4948 {
4949 uint16_t ret;
4950 uint64_t timestamp;
4951
4952 ret = nvme_h2c(n, (uint8_t *)&timestamp, sizeof(timestamp), req);
4953 if (ret) {
4954 return ret;
4955 }
4956
4957 nvme_set_timestamp(n, timestamp);
4958
4959 return NVME_SUCCESS;
4960 }
4961
4962 static uint16_t nvme_set_feature(NvmeCtrl *n, NvmeRequest *req)
4963 {
4964 NvmeNamespace *ns = NULL;
4965
4966 NvmeCmd *cmd = &req->cmd;
4967 uint32_t dw10 = le32_to_cpu(cmd->cdw10);
4968 uint32_t dw11 = le32_to_cpu(cmd->cdw11);
4969 uint32_t nsid = le32_to_cpu(cmd->nsid);
4970 uint8_t fid = NVME_GETSETFEAT_FID(dw10);
4971 uint8_t save = NVME_SETFEAT_SAVE(dw10);
4972 int i;
4973
4974 trace_pci_nvme_setfeat(nvme_cid(req), nsid, fid, save, dw11);
4975
4976 if (save && !(nvme_feature_cap[fid] & NVME_FEAT_CAP_SAVE)) {
4977 return NVME_FID_NOT_SAVEABLE | NVME_DNR;
4978 }
4979
4980 if (!nvme_feature_support[fid]) {
4981 return NVME_INVALID_FIELD | NVME_DNR;
4982 }
4983
4984 if (nvme_feature_cap[fid] & NVME_FEAT_CAP_NS) {
4985 if (nsid != NVME_NSID_BROADCAST) {
4986 if (!nvme_nsid_valid(n, nsid)) {
4987 return NVME_INVALID_NSID | NVME_DNR;
4988 }
4989
4990 ns = nvme_ns(n, nsid);
4991 if (unlikely(!ns)) {
4992 return NVME_INVALID_FIELD | NVME_DNR;
4993 }
4994 }
4995 } else if (nsid && nsid != NVME_NSID_BROADCAST) {
4996 if (!nvme_nsid_valid(n, nsid)) {
4997 return NVME_INVALID_NSID | NVME_DNR;
4998 }
4999
5000 return NVME_FEAT_NOT_NS_SPEC | NVME_DNR;
5001 }
5002
5003 if (!(nvme_feature_cap[fid] & NVME_FEAT_CAP_CHANGE)) {
5004 return NVME_FEAT_NOT_CHANGEABLE | NVME_DNR;
5005 }
5006
5007 switch (fid) {
5008 case NVME_TEMPERATURE_THRESHOLD:
5009 if (NVME_TEMP_TMPSEL(dw11) != NVME_TEMP_TMPSEL_COMPOSITE) {
5010 break;
5011 }
5012
5013 switch (NVME_TEMP_THSEL(dw11)) {
5014 case NVME_TEMP_THSEL_OVER:
5015 n->features.temp_thresh_hi = NVME_TEMP_TMPTH(dw11);
5016 break;
5017 case NVME_TEMP_THSEL_UNDER:
5018 n->features.temp_thresh_low = NVME_TEMP_TMPTH(dw11);
5019 break;
5020 default:
5021 return NVME_INVALID_FIELD | NVME_DNR;
5022 }
5023
5024 if ((n->temperature >= n->features.temp_thresh_hi) ||
5025 (n->temperature <= n->features.temp_thresh_low)) {
5026 nvme_smart_event(n, NVME_AER_INFO_SMART_TEMP_THRESH);
5027 }
5028
5029 break;
5030 case NVME_ERROR_RECOVERY:
5031 if (nsid == NVME_NSID_BROADCAST) {
5032 for (i = 1; i <= NVME_MAX_NAMESPACES; i++) {
5033 ns = nvme_ns(n, i);
5034
5035 if (!ns) {
5036 continue;
5037 }
5038
5039 if (NVME_ID_NS_NSFEAT_DULBE(ns->id_ns.nsfeat)) {
5040 ns->features.err_rec = dw11;
5041 }
5042 }
5043
5044 break;
5045 }
5046
5047 assert(ns);
5048 if (NVME_ID_NS_NSFEAT_DULBE(ns->id_ns.nsfeat)) {
5049 ns->features.err_rec = dw11;
5050 }
5051 break;
5052 case NVME_VOLATILE_WRITE_CACHE:
5053 for (i = 1; i <= NVME_MAX_NAMESPACES; i++) {
5054 ns = nvme_ns(n, i);
5055 if (!ns) {
5056 continue;
5057 }
5058
5059 if (!(dw11 & 0x1) && blk_enable_write_cache(ns->blkconf.blk)) {
5060 blk_flush(ns->blkconf.blk);
5061 }
5062
5063 blk_set_enable_write_cache(ns->blkconf.blk, dw11 & 1);
5064 }
5065
5066 break;
5067
5068 case NVME_NUMBER_OF_QUEUES:
5069 if (n->qs_created) {
5070 return NVME_CMD_SEQ_ERROR | NVME_DNR;
5071 }
5072
5073 /*
5074 * NVMe v1.3, Section 5.21.1.7: FFFFh is not an allowed value for NCQR
5075 * and NSQR.
5076 */
5077 if ((dw11 & 0xffff) == 0xffff || ((dw11 >> 16) & 0xffff) == 0xffff) {
5078 return NVME_INVALID_FIELD | NVME_DNR;
5079 }
5080
5081 trace_pci_nvme_setfeat_numq((dw11 & 0xffff) + 1,
5082 ((dw11 >> 16) & 0xffff) + 1,
5083 n->params.max_ioqpairs,
5084 n->params.max_ioqpairs);
5085 req->cqe.result = cpu_to_le32((n->params.max_ioqpairs - 1) |
5086 ((n->params.max_ioqpairs - 1) << 16));
5087 break;
5088 case NVME_ASYNCHRONOUS_EVENT_CONF:
5089 n->features.async_config = dw11;
5090 break;
5091 case NVME_TIMESTAMP:
5092 return nvme_set_feature_timestamp(n, req);
5093 case NVME_COMMAND_SET_PROFILE:
5094 if (dw11 & 0x1ff) {
5095 trace_pci_nvme_err_invalid_iocsci(dw11 & 0x1ff);
5096 return NVME_CMD_SET_CMB_REJECTED | NVME_DNR;
5097 }
5098 break;
5099 default:
5100 return NVME_FEAT_NOT_CHANGEABLE | NVME_DNR;
5101 }
5102 return NVME_SUCCESS;
5103 }
5104
5105 static uint16_t nvme_aer(NvmeCtrl *n, NvmeRequest *req)
5106 {
5107 trace_pci_nvme_aer(nvme_cid(req));
5108
5109 if (n->outstanding_aers > n->params.aerl) {
5110 trace_pci_nvme_aer_aerl_exceeded();
5111 return NVME_AER_LIMIT_EXCEEDED;
5112 }
5113
5114 n->aer_reqs[n->outstanding_aers] = req;
5115 n->outstanding_aers++;
5116
5117 if (!QTAILQ_EMPTY(&n->aer_queue)) {
5118 nvme_process_aers(n);
5119 }
5120
5121 return NVME_NO_COMPLETE;
5122 }
5123
5124 static void nvme_update_dmrsl(NvmeCtrl *n)
5125 {
5126 int nsid;
5127
5128 for (nsid = 1; nsid <= NVME_MAX_NAMESPACES; nsid++) {
5129 NvmeNamespace *ns = nvme_ns(n, nsid);
5130 if (!ns) {
5131 continue;
5132 }
5133
5134 n->dmrsl = MIN_NON_ZERO(n->dmrsl,
5135 BDRV_REQUEST_MAX_BYTES / nvme_l2b(ns, 1));
5136 }
5137 }
5138
5139 static void nvme_select_iocs_ns(NvmeCtrl *n, NvmeNamespace *ns)
5140 {
5141 ns->iocs = nvme_cse_iocs_none;
5142 switch (ns->csi) {
5143 case NVME_CSI_NVM:
5144 if (NVME_CC_CSS(n->bar.cc) != NVME_CC_CSS_ADMIN_ONLY) {
5145 ns->iocs = nvme_cse_iocs_nvm;
5146 }
5147 break;
5148 case NVME_CSI_ZONED:
5149 if (NVME_CC_CSS(n->bar.cc) == NVME_CC_CSS_CSI) {
5150 ns->iocs = nvme_cse_iocs_zoned;
5151 } else if (NVME_CC_CSS(n->bar.cc) == NVME_CC_CSS_NVM) {
5152 ns->iocs = nvme_cse_iocs_nvm;
5153 }
5154 break;
5155 }
5156 }
5157
5158 static uint16_t nvme_ns_attachment(NvmeCtrl *n, NvmeRequest *req)
5159 {
5160 NvmeNamespace *ns;
5161 NvmeCtrl *ctrl;
5162 uint16_t list[NVME_CONTROLLER_LIST_SIZE] = {};
5163 uint32_t nsid = le32_to_cpu(req->cmd.nsid);
5164 uint32_t dw10 = le32_to_cpu(req->cmd.cdw10);
5165 bool attach = !(dw10 & 0xf);
5166 uint16_t *nr_ids = &list[0];
5167 uint16_t *ids = &list[1];
5168 uint16_t ret;
5169 int i;
5170
5171 trace_pci_nvme_ns_attachment(nvme_cid(req), dw10 & 0xf);
5172
5173 if (!nvme_nsid_valid(n, nsid)) {
5174 return NVME_INVALID_NSID | NVME_DNR;
5175 }
5176
5177 ns = nvme_subsys_ns(n->subsys, nsid);
5178 if (!ns) {
5179 return NVME_INVALID_FIELD | NVME_DNR;
5180 }
5181
5182 ret = nvme_h2c(n, (uint8_t *)list, 4096, req);
5183 if (ret) {
5184 return ret;
5185 }
5186
5187 if (!*nr_ids) {
5188 return NVME_NS_CTRL_LIST_INVALID | NVME_DNR;
5189 }
5190
5191 *nr_ids = MIN(*nr_ids, NVME_CONTROLLER_LIST_SIZE - 1);
5192 for (i = 0; i < *nr_ids; i++) {
5193 ctrl = nvme_subsys_ctrl(n->subsys, ids[i]);
5194 if (!ctrl) {
5195 return NVME_NS_CTRL_LIST_INVALID | NVME_DNR;
5196 }
5197
5198 if (attach) {
5199 if (nvme_ns(ctrl, nsid)) {
5200 return NVME_NS_ALREADY_ATTACHED | NVME_DNR;
5201 }
5202
5203 if (ns->attached && !ns->params.shared) {
5204 return NVME_NS_PRIVATE | NVME_DNR;
5205 }
5206
5207 nvme_attach_ns(ctrl, ns);
5208 nvme_select_iocs_ns(ctrl, ns);
5209 } else {
5210 if (!nvme_ns(ctrl, nsid)) {
5211 return NVME_NS_NOT_ATTACHED | NVME_DNR;
5212 }
5213
5214 ctrl->namespaces[nsid] = NULL;
5215 ns->attached--;
5216
5217 nvme_update_dmrsl(ctrl);
5218 }
5219
5220 /*
5221 * Add namespace id to the changed namespace id list for event clearing
5222 * via Get Log Page command.
5223 */
5224 if (!test_and_set_bit(nsid, ctrl->changed_nsids)) {
5225 nvme_enqueue_event(ctrl, NVME_AER_TYPE_NOTICE,
5226 NVME_AER_INFO_NOTICE_NS_ATTR_CHANGED,
5227 NVME_LOG_CHANGED_NSLIST);
5228 }
5229 }
5230
5231 return NVME_SUCCESS;
5232 }
5233
5234 typedef struct NvmeFormatAIOCB {
5235 BlockAIOCB common;
5236 BlockAIOCB *aiocb;
5237 QEMUBH *bh;
5238 NvmeRequest *req;
5239 int ret;
5240
5241 NvmeNamespace *ns;
5242 uint32_t nsid;
5243 bool broadcast;
5244 int64_t offset;
5245 } NvmeFormatAIOCB;
5246
5247 static void nvme_format_bh(void *opaque);
5248
5249 static void nvme_format_cancel(BlockAIOCB *aiocb)
5250 {
5251 NvmeFormatAIOCB *iocb = container_of(aiocb, NvmeFormatAIOCB, common);
5252
5253 if (iocb->aiocb) {
5254 blk_aio_cancel_async(iocb->aiocb);
5255 }
5256 }
5257
5258 static const AIOCBInfo nvme_format_aiocb_info = {
5259 .aiocb_size = sizeof(NvmeFormatAIOCB),
5260 .cancel_async = nvme_format_cancel,
5261 .get_aio_context = nvme_get_aio_context,
5262 };
5263
5264 static void nvme_format_set(NvmeNamespace *ns, NvmeCmd *cmd)
5265 {
5266 uint32_t dw10 = le32_to_cpu(cmd->cdw10);
5267 uint8_t lbaf = dw10 & 0xf;
5268 uint8_t pi = (dw10 >> 5) & 0x7;
5269 uint8_t mset = (dw10 >> 4) & 0x1;
5270 uint8_t pil = (dw10 >> 8) & 0x1;
5271
5272 trace_pci_nvme_format_set(ns->params.nsid, lbaf, mset, pi, pil);
5273
5274 ns->id_ns.dps = (pil << 3) | pi;
5275 ns->id_ns.flbas = lbaf | (mset << 4);
5276
5277 nvme_ns_init_format(ns);
5278 }
5279
5280 static void nvme_format_ns_cb(void *opaque, int ret)
5281 {
5282 NvmeFormatAIOCB *iocb = opaque;
5283 NvmeRequest *req = iocb->req;
5284 NvmeNamespace *ns = iocb->ns;
5285 int bytes;
5286
5287 if (ret < 0) {
5288 iocb->ret = ret;
5289 goto done;
5290 }
5291
5292 assert(ns);
5293
5294 if (iocb->offset < ns->size) {
5295 bytes = MIN(BDRV_REQUEST_MAX_BYTES, ns->size - iocb->offset);
5296
5297 iocb->aiocb = blk_aio_pwrite_zeroes(ns->blkconf.blk, iocb->offset,
5298 bytes, BDRV_REQ_MAY_UNMAP,
5299 nvme_format_ns_cb, iocb);
5300
5301 iocb->offset += bytes;
5302 return;
5303 }
5304
5305 nvme_format_set(ns, &req->cmd);
5306 ns->status = 0x0;
5307 iocb->ns = NULL;
5308 iocb->offset = 0;
5309
5310 done:
5311 iocb->aiocb = NULL;
5312 qemu_bh_schedule(iocb->bh);
5313 }
5314
5315 static uint16_t nvme_format_check(NvmeNamespace *ns, uint8_t lbaf, uint8_t pi)
5316 {
5317 if (ns->params.zoned) {
5318 return NVME_INVALID_FORMAT | NVME_DNR;
5319 }
5320
5321 if (lbaf > ns->id_ns.nlbaf) {
5322 return NVME_INVALID_FORMAT | NVME_DNR;
5323 }
5324
5325 if (pi && (ns->id_ns.lbaf[lbaf].ms < sizeof(NvmeDifTuple))) {
5326 return NVME_INVALID_FORMAT | NVME_DNR;
5327 }
5328
5329 if (pi && pi > NVME_ID_NS_DPS_TYPE_3) {
5330 return NVME_INVALID_FIELD | NVME_DNR;
5331 }
5332
5333 return NVME_SUCCESS;
5334 }
5335
5336 static void nvme_format_bh(void *opaque)
5337 {
5338 NvmeFormatAIOCB *iocb = opaque;
5339 NvmeRequest *req = iocb->req;
5340 NvmeCtrl *n = nvme_ctrl(req);
5341 uint32_t dw10 = le32_to_cpu(req->cmd.cdw10);
5342 uint8_t lbaf = dw10 & 0xf;
5343 uint8_t pi = (dw10 >> 5) & 0x7;
5344 uint16_t status;
5345 int i;
5346
5347 if (iocb->ret < 0) {
5348 goto done;
5349 }
5350
5351 if (iocb->broadcast) {
5352 for (i = iocb->nsid + 1; i <= NVME_MAX_NAMESPACES; i++) {
5353 iocb->ns = nvme_ns(n, i);
5354 if (iocb->ns) {
5355 iocb->nsid = i;
5356 break;
5357 }
5358 }
5359 }
5360
5361 if (!iocb->ns) {
5362 goto done;
5363 }
5364
5365 status = nvme_format_check(iocb->ns, lbaf, pi);
5366 if (status) {
5367 req->status = status;
5368 goto done;
5369 }
5370
5371 iocb->ns->status = NVME_FORMAT_IN_PROGRESS;
5372 nvme_format_ns_cb(iocb, 0);
5373 return;
5374
5375 done:
5376 qemu_bh_delete(iocb->bh);
5377 iocb->bh = NULL;
5378
5379 iocb->common.cb(iocb->common.opaque, iocb->ret);
5380
5381 qemu_aio_unref(iocb);
5382 }
5383
5384 static uint16_t nvme_format(NvmeCtrl *n, NvmeRequest *req)
5385 {
5386 NvmeFormatAIOCB *iocb;
5387 uint32_t nsid = le32_to_cpu(req->cmd.nsid);
5388 uint16_t status;
5389
5390 iocb = qemu_aio_get(&nvme_format_aiocb_info, NULL, nvme_misc_cb, req);
5391
5392 iocb->req = req;
5393 iocb->bh = qemu_bh_new(nvme_format_bh, iocb);
5394 iocb->ret = 0;
5395 iocb->ns = NULL;
5396 iocb->nsid = 0;
5397 iocb->broadcast = (nsid == NVME_NSID_BROADCAST);
5398 iocb->offset = 0;
5399
5400 if (!iocb->broadcast) {
5401 if (!nvme_nsid_valid(n, nsid)) {
5402 status = NVME_INVALID_NSID | NVME_DNR;
5403 goto out;
5404 }
5405
5406 iocb->ns = nvme_ns(n, nsid);
5407 if (!iocb->ns) {
5408 status = NVME_INVALID_FIELD | NVME_DNR;
5409 goto out;
5410 }
5411 }
5412
5413 req->aiocb = &iocb->common;
5414 qemu_bh_schedule(iocb->bh);
5415
5416 return NVME_NO_COMPLETE;
5417
5418 out:
5419 qemu_bh_delete(iocb->bh);
5420 iocb->bh = NULL;
5421 qemu_aio_unref(iocb);
5422 return status;
5423 }
5424
5425 static uint16_t nvme_admin_cmd(NvmeCtrl *n, NvmeRequest *req)
5426 {
5427 trace_pci_nvme_admin_cmd(nvme_cid(req), nvme_sqid(req), req->cmd.opcode,
5428 nvme_adm_opc_str(req->cmd.opcode));
5429
5430 if (!(nvme_cse_acs[req->cmd.opcode] & NVME_CMD_EFF_CSUPP)) {
5431 trace_pci_nvme_err_invalid_admin_opc(req->cmd.opcode);
5432 return NVME_INVALID_OPCODE | NVME_DNR;
5433 }
5434
5435 /* SGLs shall not be used for Admin commands in NVMe over PCIe */
5436 if (NVME_CMD_FLAGS_PSDT(req->cmd.flags) != NVME_PSDT_PRP) {
5437 return NVME_INVALID_FIELD | NVME_DNR;
5438 }
5439
5440 switch (req->cmd.opcode) {
5441 case NVME_ADM_CMD_DELETE_SQ:
5442 return nvme_del_sq(n, req);
5443 case NVME_ADM_CMD_CREATE_SQ:
5444 return nvme_create_sq(n, req);
5445 case NVME_ADM_CMD_GET_LOG_PAGE:
5446 return nvme_get_log(n, req);
5447 case NVME_ADM_CMD_DELETE_CQ:
5448 return nvme_del_cq(n, req);
5449 case NVME_ADM_CMD_CREATE_CQ:
5450 return nvme_create_cq(n, req);
5451 case NVME_ADM_CMD_IDENTIFY:
5452 return nvme_identify(n, req);
5453 case NVME_ADM_CMD_ABORT:
5454 return nvme_abort(n, req);
5455 case NVME_ADM_CMD_SET_FEATURES:
5456 return nvme_set_feature(n, req);
5457 case NVME_ADM_CMD_GET_FEATURES:
5458 return nvme_get_feature(n, req);
5459 case NVME_ADM_CMD_ASYNC_EV_REQ:
5460 return nvme_aer(n, req);
5461 case NVME_ADM_CMD_NS_ATTACHMENT:
5462 return nvme_ns_attachment(n, req);
5463 case NVME_ADM_CMD_FORMAT_NVM:
5464 return nvme_format(n, req);
5465 default:
5466 assert(false);
5467 }
5468
5469 return NVME_INVALID_OPCODE | NVME_DNR;
5470 }
5471
5472 static void nvme_process_sq(void *opaque)
5473 {
5474 NvmeSQueue *sq = opaque;
5475 NvmeCtrl *n = sq->ctrl;
5476 NvmeCQueue *cq = n->cq[sq->cqid];
5477
5478 uint16_t status;
5479 hwaddr addr;
5480 NvmeCmd cmd;
5481 NvmeRequest *req;
5482
5483 while (!(nvme_sq_empty(sq) || QTAILQ_EMPTY(&sq->req_list))) {
5484 addr = sq->dma_addr + sq->head * n->sqe_size;
5485 if (nvme_addr_read(n, addr, (void *)&cmd, sizeof(cmd))) {
5486 trace_pci_nvme_err_addr_read(addr);
5487 trace_pci_nvme_err_cfs();
5488 n->bar.csts = NVME_CSTS_FAILED;
5489 break;
5490 }
5491 nvme_inc_sq_head(sq);
5492
5493 req = QTAILQ_FIRST(&sq->req_list);
5494 QTAILQ_REMOVE(&sq->req_list, req, entry);
5495 QTAILQ_INSERT_TAIL(&sq->out_req_list, req, entry);
5496 nvme_req_clear(req);
5497 req->cqe.cid = cmd.cid;
5498 memcpy(&req->cmd, &cmd, sizeof(NvmeCmd));
5499
5500 status = sq->sqid ? nvme_io_cmd(n, req) :
5501 nvme_admin_cmd(n, req);
5502 if (status != NVME_NO_COMPLETE) {
5503 req->status = status;
5504 nvme_enqueue_req_completion(cq, req);
5505 }
5506 }
5507 }
5508
5509 static void nvme_ctrl_reset(NvmeCtrl *n)
5510 {
5511 NvmeNamespace *ns;
5512 int i;
5513
5514 for (i = 1; i <= NVME_MAX_NAMESPACES; i++) {
5515 ns = nvme_ns(n, i);
5516 if (!ns) {
5517 continue;
5518 }
5519
5520 nvme_ns_drain(ns);
5521 }
5522
5523 for (i = 0; i < n->params.max_ioqpairs + 1; i++) {
5524 if (n->sq[i] != NULL) {
5525 nvme_free_sq(n->sq[i], n);
5526 }
5527 }
5528 for (i = 0; i < n->params.max_ioqpairs + 1; i++) {
5529 if (n->cq[i] != NULL) {
5530 nvme_free_cq(n->cq[i], n);
5531 }
5532 }
5533
5534 while (!QTAILQ_EMPTY(&n->aer_queue)) {
5535 NvmeAsyncEvent *event = QTAILQ_FIRST(&n->aer_queue);
5536 QTAILQ_REMOVE(&n->aer_queue, event, entry);
5537 g_free(event);
5538 }
5539
5540 n->aer_queued = 0;
5541 n->outstanding_aers = 0;
5542 n->qs_created = false;
5543
5544 n->bar.cc = 0;
5545 }
5546
5547 static void nvme_ctrl_shutdown(NvmeCtrl *n)
5548 {
5549 NvmeNamespace *ns;
5550 int i;
5551
5552 if (n->pmr.dev) {
5553 memory_region_msync(&n->pmr.dev->mr, 0, n->pmr.dev->size);
5554 }
5555
5556 for (i = 1; i <= NVME_MAX_NAMESPACES; i++) {
5557 ns = nvme_ns(n, i);
5558 if (!ns) {
5559 continue;
5560 }
5561
5562 nvme_ns_shutdown(ns);
5563 }
5564 }
5565
5566 static void nvme_select_iocs(NvmeCtrl *n)
5567 {
5568 NvmeNamespace *ns;
5569 int i;
5570
5571 for (i = 1; i <= NVME_MAX_NAMESPACES; i++) {
5572 ns = nvme_ns(n, i);
5573 if (!ns) {
5574 continue;
5575 }
5576
5577 nvme_select_iocs_ns(n, ns);
5578 }
5579 }
5580
5581 static int nvme_start_ctrl(NvmeCtrl *n)
5582 {
5583 uint32_t page_bits = NVME_CC_MPS(n->bar.cc) + 12;
5584 uint32_t page_size = 1 << page_bits;
5585
5586 if (unlikely(n->cq[0])) {
5587 trace_pci_nvme_err_startfail_cq();
5588 return -1;
5589 }
5590 if (unlikely(n->sq[0])) {
5591 trace_pci_nvme_err_startfail_sq();
5592 return -1;
5593 }
5594 if (unlikely(!n->bar.asq)) {
5595 trace_pci_nvme_err_startfail_nbarasq();
5596 return -1;
5597 }
5598 if (unlikely(!n->bar.acq)) {
5599 trace_pci_nvme_err_startfail_nbaracq();
5600 return -1;
5601 }
5602 if (unlikely(n->bar.asq & (page_size - 1))) {
5603 trace_pci_nvme_err_startfail_asq_misaligned(n->bar.asq);
5604 return -1;
5605 }
5606 if (unlikely(n->bar.acq & (page_size - 1))) {
5607 trace_pci_nvme_err_startfail_acq_misaligned(n->bar.acq);
5608 return -1;
5609 }
5610 if (unlikely(!(NVME_CAP_CSS(n->bar.cap) & (1 << NVME_CC_CSS(n->bar.cc))))) {
5611 trace_pci_nvme_err_startfail_css(NVME_CC_CSS(n->bar.cc));
5612 return -1;
5613 }
5614 if (unlikely(NVME_CC_MPS(n->bar.cc) <
5615 NVME_CAP_MPSMIN(n->bar.cap))) {
5616 trace_pci_nvme_err_startfail_page_too_small(
5617 NVME_CC_MPS(n->bar.cc),
5618 NVME_CAP_MPSMIN(n->bar.cap));
5619 return -1;
5620 }
5621 if (unlikely(NVME_CC_MPS(n->bar.cc) >
5622 NVME_CAP_MPSMAX(n->bar.cap))) {
5623 trace_pci_nvme_err_startfail_page_too_large(
5624 NVME_CC_MPS(n->bar.cc),
5625 NVME_CAP_MPSMAX(n->bar.cap));
5626 return -1;
5627 }
5628 if (unlikely(NVME_CC_IOCQES(n->bar.cc) <
5629 NVME_CTRL_CQES_MIN(n->id_ctrl.cqes))) {
5630 trace_pci_nvme_err_startfail_cqent_too_small(
5631 NVME_CC_IOCQES(n->bar.cc),
5632 NVME_CTRL_CQES_MIN(n->bar.cap));
5633 return -1;
5634 }
5635 if (unlikely(NVME_CC_IOCQES(n->bar.cc) >
5636 NVME_CTRL_CQES_MAX(n->id_ctrl.cqes))) {
5637 trace_pci_nvme_err_startfail_cqent_too_large(
5638 NVME_CC_IOCQES(n->bar.cc),
5639 NVME_CTRL_CQES_MAX(n->bar.cap));
5640 return -1;
5641 }
5642 if (unlikely(NVME_CC_IOSQES(n->bar.cc) <
5643 NVME_CTRL_SQES_MIN(n->id_ctrl.sqes))) {
5644 trace_pci_nvme_err_startfail_sqent_too_small(
5645 NVME_CC_IOSQES(n->bar.cc),
5646 NVME_CTRL_SQES_MIN(n->bar.cap));
5647 return -1;
5648 }
5649 if (unlikely(NVME_CC_IOSQES(n->bar.cc) >
5650 NVME_CTRL_SQES_MAX(n->id_ctrl.sqes))) {
5651 trace_pci_nvme_err_startfail_sqent_too_large(
5652 NVME_CC_IOSQES(n->bar.cc),
5653 NVME_CTRL_SQES_MAX(n->bar.cap));
5654 return -1;
5655 }
5656 if (unlikely(!NVME_AQA_ASQS(n->bar.aqa))) {
5657 trace_pci_nvme_err_startfail_asqent_sz_zero();
5658 return -1;
5659 }
5660 if (unlikely(!NVME_AQA_ACQS(n->bar.aqa))) {
5661 trace_pci_nvme_err_startfail_acqent_sz_zero();
5662 return -1;
5663 }
5664
5665 n->page_bits = page_bits;
5666 n->page_size = page_size;
5667 n->max_prp_ents = n->page_size / sizeof(uint64_t);
5668 n->cqe_size = 1 << NVME_CC_IOCQES(n->bar.cc);
5669 n->sqe_size = 1 << NVME_CC_IOSQES(n->bar.cc);
5670 nvme_init_cq(&n->admin_cq, n, n->bar.acq, 0, 0,
5671 NVME_AQA_ACQS(n->bar.aqa) + 1, 1);
5672 nvme_init_sq(&n->admin_sq, n, n->bar.asq, 0, 0,
5673 NVME_AQA_ASQS(n->bar.aqa) + 1);
5674
5675 nvme_set_timestamp(n, 0ULL);
5676
5677 QTAILQ_INIT(&n->aer_queue);
5678
5679 nvme_select_iocs(n);
5680
5681 return 0;
5682 }
5683
5684 static void nvme_cmb_enable_regs(NvmeCtrl *n)
5685 {
5686 NVME_CMBLOC_SET_CDPCILS(n->bar.cmbloc, 1);
5687 NVME_CMBLOC_SET_CDPMLS(n->bar.cmbloc, 1);
5688 NVME_CMBLOC_SET_BIR(n->bar.cmbloc, NVME_CMB_BIR);
5689
5690 NVME_CMBSZ_SET_SQS(n->bar.cmbsz, 1);
5691 NVME_CMBSZ_SET_CQS(n->bar.cmbsz, 0);
5692 NVME_CMBSZ_SET_LISTS(n->bar.cmbsz, 1);
5693 NVME_CMBSZ_SET_RDS(n->bar.cmbsz, 1);
5694 NVME_CMBSZ_SET_WDS(n->bar.cmbsz, 1);
5695 NVME_CMBSZ_SET_SZU(n->bar.cmbsz, 2); /* MBs */
5696 NVME_CMBSZ_SET_SZ(n->bar.cmbsz, n->params.cmb_size_mb);
5697 }
5698
5699 static void nvme_write_bar(NvmeCtrl *n, hwaddr offset, uint64_t data,
5700 unsigned size)
5701 {
5702 if (unlikely(offset & (sizeof(uint32_t) - 1))) {
5703 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_misaligned32,
5704 "MMIO write not 32-bit aligned,"
5705 " offset=0x%"PRIx64"", offset);
5706 /* should be ignored, fall through for now */
5707 }
5708
5709 if (unlikely(size < sizeof(uint32_t))) {
5710 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_toosmall,
5711 "MMIO write smaller than 32-bits,"
5712 " offset=0x%"PRIx64", size=%u",
5713 offset, size);
5714 /* should be ignored, fall through for now */
5715 }
5716
5717 switch (offset) {
5718 case 0xc: /* INTMS */
5719 if (unlikely(msix_enabled(&(n->parent_obj)))) {
5720 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_intmask_with_msix,
5721 "undefined access to interrupt mask set"
5722 " when MSI-X is enabled");
5723 /* should be ignored, fall through for now */
5724 }
5725 n->bar.intms |= data & 0xffffffff;
5726 n->bar.intmc = n->bar.intms;
5727 trace_pci_nvme_mmio_intm_set(data & 0xffffffff, n->bar.intmc);
5728 nvme_irq_check(n);
5729 break;
5730 case 0x10: /* INTMC */
5731 if (unlikely(msix_enabled(&(n->parent_obj)))) {
5732 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_intmask_with_msix,
5733 "undefined access to interrupt mask clr"
5734 " when MSI-X is enabled");
5735 /* should be ignored, fall through for now */
5736 }
5737 n->bar.intms &= ~(data & 0xffffffff);
5738 n->bar.intmc = n->bar.intms;
5739 trace_pci_nvme_mmio_intm_clr(data & 0xffffffff, n->bar.intmc);
5740 nvme_irq_check(n);
5741 break;
5742 case 0x14: /* CC */
5743 trace_pci_nvme_mmio_cfg(data & 0xffffffff);
5744 /* Windows first sends data, then sends enable bit */
5745 if (!NVME_CC_EN(data) && !NVME_CC_EN(n->bar.cc) &&
5746 !NVME_CC_SHN(data) && !NVME_CC_SHN(n->bar.cc))
5747 {
5748 n->bar.cc = data;
5749 }
5750
5751 if (NVME_CC_EN(data) && !NVME_CC_EN(n->bar.cc)) {
5752 n->bar.cc = data;
5753 if (unlikely(nvme_start_ctrl(n))) {
5754 trace_pci_nvme_err_startfail();
5755 n->bar.csts = NVME_CSTS_FAILED;
5756 } else {
5757 trace_pci_nvme_mmio_start_success();
5758 n->bar.csts = NVME_CSTS_READY;
5759 }
5760 } else if (!NVME_CC_EN(data) && NVME_CC_EN(n->bar.cc)) {
5761 trace_pci_nvme_mmio_stopped();
5762 nvme_ctrl_reset(n);
5763 n->bar.csts &= ~NVME_CSTS_READY;
5764 }
5765 if (NVME_CC_SHN(data) && !(NVME_CC_SHN(n->bar.cc))) {
5766 trace_pci_nvme_mmio_shutdown_set();
5767 nvme_ctrl_shutdown(n);
5768 n->bar.cc = data;
5769 n->bar.csts |= NVME_CSTS_SHST_COMPLETE;
5770 } else if (!NVME_CC_SHN(data) && NVME_CC_SHN(n->bar.cc)) {
5771 trace_pci_nvme_mmio_shutdown_cleared();
5772 n->bar.csts &= ~NVME_CSTS_SHST_COMPLETE;
5773 n->bar.cc = data;
5774 }
5775 break;
5776 case 0x1c: /* CSTS */
5777 if (data & (1 << 4)) {
5778 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_ssreset_w1c_unsupported,
5779 "attempted to W1C CSTS.NSSRO"
5780 " but CAP.NSSRS is zero (not supported)");
5781 } else if (data != 0) {
5782 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_ro_csts,
5783 "attempted to set a read only bit"
5784 " of controller status");
5785 }
5786 break;
5787 case 0x20: /* NSSR */
5788 if (data == 0x4e564d65) {
5789 trace_pci_nvme_ub_mmiowr_ssreset_unsupported();
5790 } else {
5791 /* The spec says that writes of other values have no effect */
5792 return;
5793 }
5794 break;
5795 case 0x24: /* AQA */
5796 n->bar.aqa = data & 0xffffffff;
5797 trace_pci_nvme_mmio_aqattr(data & 0xffffffff);
5798 break;
5799 case 0x28: /* ASQ */
5800 n->bar.asq = size == 8 ? data :
5801 (n->bar.asq & ~0xffffffffULL) | (data & 0xffffffff);
5802 trace_pci_nvme_mmio_asqaddr(data);
5803 break;
5804 case 0x2c: /* ASQ hi */
5805 n->bar.asq = (n->bar.asq & 0xffffffff) | (data << 32);
5806 trace_pci_nvme_mmio_asqaddr_hi(data, n->bar.asq);
5807 break;
5808 case 0x30: /* ACQ */
5809 trace_pci_nvme_mmio_acqaddr(data);
5810 n->bar.acq = size == 8 ? data :
5811 (n->bar.acq & ~0xffffffffULL) | (data & 0xffffffff);
5812 break;
5813 case 0x34: /* ACQ hi */
5814 n->bar.acq = (n->bar.acq & 0xffffffff) | (data << 32);
5815 trace_pci_nvme_mmio_acqaddr_hi(data, n->bar.acq);
5816 break;
5817 case 0x38: /* CMBLOC */
5818 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_cmbloc_reserved,
5819 "invalid write to reserved CMBLOC"
5820 " when CMBSZ is zero, ignored");
5821 return;
5822 case 0x3C: /* CMBSZ */
5823 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_cmbsz_readonly,
5824 "invalid write to read only CMBSZ, ignored");
5825 return;
5826 case 0x50: /* CMBMSC */
5827 if (!NVME_CAP_CMBS(n->bar.cap)) {
5828 return;
5829 }
5830
5831 n->bar.cmbmsc = size == 8 ? data :
5832 (n->bar.cmbmsc & ~0xffffffff) | (data & 0xffffffff);
5833 n->cmb.cmse = false;
5834
5835 if (NVME_CMBMSC_CRE(data)) {
5836 nvme_cmb_enable_regs(n);
5837
5838 if (NVME_CMBMSC_CMSE(data)) {
5839 hwaddr cba = NVME_CMBMSC_CBA(data) << CMBMSC_CBA_SHIFT;
5840 if (cba + int128_get64(n->cmb.mem.size) < cba) {
5841 NVME_CMBSTS_SET_CBAI(n->bar.cmbsts, 1);
5842 return;
5843 }
5844
5845 n->cmb.cba = cba;
5846 n->cmb.cmse = true;
5847 }
5848 } else {
5849 n->bar.cmbsz = 0;
5850 n->bar.cmbloc = 0;
5851 }
5852
5853 return;
5854 case 0x54: /* CMBMSC hi */
5855 n->bar.cmbmsc = (n->bar.cmbmsc & 0xffffffff) | (data << 32);
5856 return;
5857
5858 case 0xe00: /* PMRCAP */
5859 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_pmrcap_readonly,
5860 "invalid write to PMRCAP register, ignored");
5861 return;
5862 case 0xe04: /* PMRCTL */
5863 n->bar.pmrctl = data;
5864 if (NVME_PMRCTL_EN(data)) {
5865 memory_region_set_enabled(&n->pmr.dev->mr, true);
5866 n->bar.pmrsts = 0;
5867 } else {
5868 memory_region_set_enabled(&n->pmr.dev->mr, false);
5869 NVME_PMRSTS_SET_NRDY(n->bar.pmrsts, 1);
5870 n->pmr.cmse = false;
5871 }
5872 return;
5873 case 0xe08: /* PMRSTS */
5874 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_pmrsts_readonly,
5875 "invalid write to PMRSTS register, ignored");
5876 return;
5877 case 0xe0C: /* PMREBS */
5878 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_pmrebs_readonly,
5879 "invalid write to PMREBS register, ignored");
5880 return;
5881 case 0xe10: /* PMRSWTP */
5882 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_pmrswtp_readonly,
5883 "invalid write to PMRSWTP register, ignored");
5884 return;
5885 case 0xe14: /* PMRMSCL */
5886 if (!NVME_CAP_PMRS(n->bar.cap)) {
5887 return;
5888 }
5889
5890 n->bar.pmrmsc = (n->bar.pmrmsc & ~0xffffffff) | (data & 0xffffffff);
5891 n->pmr.cmse = false;
5892
5893 if (NVME_PMRMSC_CMSE(n->bar.pmrmsc)) {
5894 hwaddr cba = NVME_PMRMSC_CBA(n->bar.pmrmsc) << PMRMSC_CBA_SHIFT;
5895 if (cba + int128_get64(n->pmr.dev->mr.size) < cba) {
5896 NVME_PMRSTS_SET_CBAI(n->bar.pmrsts, 1);
5897 return;
5898 }
5899
5900 n->pmr.cmse = true;
5901 n->pmr.cba = cba;
5902 }
5903
5904 return;
5905 case 0xe18: /* PMRMSCU */
5906 if (!NVME_CAP_PMRS(n->bar.cap)) {
5907 return;
5908 }
5909
5910 n->bar.pmrmsc = (n->bar.pmrmsc & 0xffffffff) | (data << 32);
5911 return;
5912 default:
5913 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_invalid,
5914 "invalid MMIO write,"
5915 " offset=0x%"PRIx64", data=%"PRIx64"",
5916 offset, data);
5917 break;
5918 }
5919 }
5920
5921 static uint64_t nvme_mmio_read(void *opaque, hwaddr addr, unsigned size)
5922 {
5923 NvmeCtrl *n = (NvmeCtrl *)opaque;
5924 uint8_t *ptr = (uint8_t *)&n->bar;
5925 uint64_t val = 0;
5926
5927 trace_pci_nvme_mmio_read(addr, size);
5928
5929 if (unlikely(addr & (sizeof(uint32_t) - 1))) {
5930 NVME_GUEST_ERR(pci_nvme_ub_mmiord_misaligned32,
5931 "MMIO read not 32-bit aligned,"
5932 " offset=0x%"PRIx64"", addr);
5933 /* should RAZ, fall through for now */
5934 } else if (unlikely(size < sizeof(uint32_t))) {
5935 NVME_GUEST_ERR(pci_nvme_ub_mmiord_toosmall,
5936 "MMIO read smaller than 32-bits,"
5937 " offset=0x%"PRIx64"", addr);
5938 /* should RAZ, fall through for now */
5939 }
5940
5941 if (addr < sizeof(n->bar)) {
5942 /*
5943 * When PMRWBM bit 1 is set then read from
5944 * from PMRSTS should ensure prior writes
5945 * made it to persistent media
5946 */
5947 if (addr == 0xe08 &&
5948 (NVME_PMRCAP_PMRWBM(n->bar.pmrcap) & 0x02)) {
5949 memory_region_msync(&n->pmr.dev->mr, 0, n->pmr.dev->size);
5950 }
5951 memcpy(&val, ptr + addr, size);
5952 } else {
5953 NVME_GUEST_ERR(pci_nvme_ub_mmiord_invalid_ofs,
5954 "MMIO read beyond last register,"
5955 " offset=0x%"PRIx64", returning 0", addr);
5956 }
5957
5958 return val;
5959 }
5960
5961 static void nvme_process_db(NvmeCtrl *n, hwaddr addr, int val)
5962 {
5963 uint32_t qid;
5964
5965 if (unlikely(addr & ((1 << 2) - 1))) {
5966 NVME_GUEST_ERR(pci_nvme_ub_db_wr_misaligned,
5967 "doorbell write not 32-bit aligned,"
5968 " offset=0x%"PRIx64", ignoring", addr);
5969 return;
5970 }
5971
5972 if (((addr - 0x1000) >> 2) & 1) {
5973 /* Completion queue doorbell write */
5974
5975 uint16_t new_head = val & 0xffff;
5976 int start_sqs;
5977 NvmeCQueue *cq;
5978
5979 qid = (addr - (0x1000 + (1 << 2))) >> 3;
5980 if (unlikely(nvme_check_cqid(n, qid))) {
5981 NVME_GUEST_ERR(pci_nvme_ub_db_wr_invalid_cq,
5982 "completion queue doorbell write"
5983 " for nonexistent queue,"
5984 " sqid=%"PRIu32", ignoring", qid);
5985
5986 /*
5987 * NVM Express v1.3d, Section 4.1 state: "If host software writes
5988 * an invalid value to the Submission Queue Tail Doorbell or
5989 * Completion Queue Head Doorbell regiter and an Asynchronous Event
5990 * Request command is outstanding, then an asynchronous event is
5991 * posted to the Admin Completion Queue with a status code of
5992 * Invalid Doorbell Write Value."
5993 *
5994 * Also note that the spec includes the "Invalid Doorbell Register"
5995 * status code, but nowhere does it specify when to use it.
5996 * However, it seems reasonable to use it here in a similar
5997 * fashion.
5998 */
5999 if (n->outstanding_aers) {
6000 nvme_enqueue_event(n, NVME_AER_TYPE_ERROR,
6001 NVME_AER_INFO_ERR_INVALID_DB_REGISTER,
6002 NVME_LOG_ERROR_INFO);
6003 }
6004
6005 return;
6006 }
6007
6008 cq = n->cq[qid];
6009 if (unlikely(new_head >= cq->size)) {
6010 NVME_GUEST_ERR(pci_nvme_ub_db_wr_invalid_cqhead,
6011 "completion queue doorbell write value"
6012 " beyond queue size, sqid=%"PRIu32","
6013 " new_head=%"PRIu16", ignoring",
6014 qid, new_head);
6015
6016 if (n->outstanding_aers) {
6017 nvme_enqueue_event(n, NVME_AER_TYPE_ERROR,
6018 NVME_AER_INFO_ERR_INVALID_DB_VALUE,
6019 NVME_LOG_ERROR_INFO);
6020 }
6021
6022 return;
6023 }
6024
6025 trace_pci_nvme_mmio_doorbell_cq(cq->cqid, new_head);
6026
6027 start_sqs = nvme_cq_full(cq) ? 1 : 0;
6028 cq->head = new_head;
6029 if (start_sqs) {
6030 NvmeSQueue *sq;
6031 QTAILQ_FOREACH(sq, &cq->sq_list, entry) {
6032 timer_mod(sq->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 500);
6033 }
6034 timer_mod(cq->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 500);
6035 }
6036
6037 if (cq->tail == cq->head) {
6038 nvme_irq_deassert(n, cq);
6039 }
6040 } else {
6041 /* Submission queue doorbell write */
6042
6043 uint16_t new_tail = val & 0xffff;
6044 NvmeSQueue *sq;
6045
6046 qid = (addr - 0x1000) >> 3;
6047 if (unlikely(nvme_check_sqid(n, qid))) {
6048 NVME_GUEST_ERR(pci_nvme_ub_db_wr_invalid_sq,
6049 "submission queue doorbell write"
6050 " for nonexistent queue,"
6051 " sqid=%"PRIu32", ignoring", qid);
6052
6053 if (n->outstanding_aers) {
6054 nvme_enqueue_event(n, NVME_AER_TYPE_ERROR,
6055 NVME_AER_INFO_ERR_INVALID_DB_REGISTER,
6056 NVME_LOG_ERROR_INFO);
6057 }
6058
6059 return;
6060 }
6061
6062 sq = n->sq[qid];
6063 if (unlikely(new_tail >= sq->size)) {
6064 NVME_GUEST_ERR(pci_nvme_ub_db_wr_invalid_sqtail,
6065 "submission queue doorbell write value"
6066 " beyond queue size, sqid=%"PRIu32","
6067 " new_tail=%"PRIu16", ignoring",
6068 qid, new_tail);
6069
6070 if (n->outstanding_aers) {
6071 nvme_enqueue_event(n, NVME_AER_TYPE_ERROR,
6072 NVME_AER_INFO_ERR_INVALID_DB_VALUE,
6073 NVME_LOG_ERROR_INFO);
6074 }
6075
6076 return;
6077 }
6078
6079 trace_pci_nvme_mmio_doorbell_sq(sq->sqid, new_tail);
6080
6081 sq->tail = new_tail;
6082 timer_mod(sq->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 500);
6083 }
6084 }
6085
6086 static void nvme_mmio_write(void *opaque, hwaddr addr, uint64_t data,
6087 unsigned size)
6088 {
6089 NvmeCtrl *n = (NvmeCtrl *)opaque;
6090
6091 trace_pci_nvme_mmio_write(addr, data, size);
6092
6093 if (addr < sizeof(n->bar)) {
6094 nvme_write_bar(n, addr, data, size);
6095 } else {
6096 nvme_process_db(n, addr, data);
6097 }
6098 }
6099
6100 static const MemoryRegionOps nvme_mmio_ops = {
6101 .read = nvme_mmio_read,
6102 .write = nvme_mmio_write,
6103 .endianness = DEVICE_LITTLE_ENDIAN,
6104 .impl = {
6105 .min_access_size = 2,
6106 .max_access_size = 8,
6107 },
6108 };
6109
6110 static void nvme_cmb_write(void *opaque, hwaddr addr, uint64_t data,
6111 unsigned size)
6112 {
6113 NvmeCtrl *n = (NvmeCtrl *)opaque;
6114 stn_le_p(&n->cmb.buf[addr], size, data);
6115 }
6116
6117 static uint64_t nvme_cmb_read(void *opaque, hwaddr addr, unsigned size)
6118 {
6119 NvmeCtrl *n = (NvmeCtrl *)opaque;
6120 return ldn_le_p(&n->cmb.buf[addr], size);
6121 }
6122
6123 static const MemoryRegionOps nvme_cmb_ops = {
6124 .read = nvme_cmb_read,
6125 .write = nvme_cmb_write,
6126 .endianness = DEVICE_LITTLE_ENDIAN,
6127 .impl = {
6128 .min_access_size = 1,
6129 .max_access_size = 8,
6130 },
6131 };
6132
6133 static void nvme_check_constraints(NvmeCtrl *n, Error **errp)
6134 {
6135 NvmeParams *params = &n->params;
6136
6137 if (params->num_queues) {
6138 warn_report("num_queues is deprecated; please use max_ioqpairs "
6139 "instead");
6140
6141 params->max_ioqpairs = params->num_queues - 1;
6142 }
6143
6144 if (n->namespace.blkconf.blk && n->subsys) {
6145 error_setg(errp, "subsystem support is unavailable with legacy "
6146 "namespace ('drive' property)");
6147 return;
6148 }
6149
6150 if (params->max_ioqpairs < 1 ||
6151 params->max_ioqpairs > NVME_MAX_IOQPAIRS) {
6152 error_setg(errp, "max_ioqpairs must be between 1 and %d",
6153 NVME_MAX_IOQPAIRS);
6154 return;
6155 }
6156
6157 if (params->msix_qsize < 1 ||
6158 params->msix_qsize > PCI_MSIX_FLAGS_QSIZE + 1) {
6159 error_setg(errp, "msix_qsize must be between 1 and %d",
6160 PCI_MSIX_FLAGS_QSIZE + 1);
6161 return;
6162 }
6163
6164 if (!params->serial) {
6165 error_setg(errp, "serial property not set");
6166 return;
6167 }
6168
6169 if (n->pmr.dev) {
6170 if (host_memory_backend_is_mapped(n->pmr.dev)) {
6171 error_setg(errp, "can't use already busy memdev: %s",
6172 object_get_canonical_path_component(OBJECT(n->pmr.dev)));
6173 return;
6174 }
6175
6176 if (!is_power_of_2(n->pmr.dev->size)) {
6177 error_setg(errp, "pmr backend size needs to be power of 2 in size");
6178 return;
6179 }
6180
6181 host_memory_backend_set_mapped(n->pmr.dev, true);
6182 }
6183
6184 if (n->params.zasl > n->params.mdts) {
6185 error_setg(errp, "zoned.zasl (Zone Append Size Limit) must be less "
6186 "than or equal to mdts (Maximum Data Transfer Size)");
6187 return;
6188 }
6189
6190 if (!n->params.vsl) {
6191 error_setg(errp, "vsl must be non-zero");
6192 return;
6193 }
6194 }
6195
6196 static void nvme_init_state(NvmeCtrl *n)
6197 {
6198 /* add one to max_ioqpairs to account for the admin queue pair */
6199 n->reg_size = pow2ceil(sizeof(NvmeBar) +
6200 2 * (n->params.max_ioqpairs + 1) * NVME_DB_SIZE);
6201 n->sq = g_new0(NvmeSQueue *, n->params.max_ioqpairs + 1);
6202 n->cq = g_new0(NvmeCQueue *, n->params.max_ioqpairs + 1);
6203 n->temperature = NVME_TEMPERATURE;
6204 n->features.temp_thresh_hi = NVME_TEMPERATURE_WARNING;
6205 n->starttime_ms = qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL);
6206 n->aer_reqs = g_new0(NvmeRequest *, n->params.aerl + 1);
6207 }
6208
6209 static void nvme_init_cmb(NvmeCtrl *n, PCIDevice *pci_dev)
6210 {
6211 uint64_t cmb_size = n->params.cmb_size_mb * MiB;
6212
6213 n->cmb.buf = g_malloc0(cmb_size);
6214 memory_region_init_io(&n->cmb.mem, OBJECT(n), &nvme_cmb_ops, n,
6215 "nvme-cmb", cmb_size);
6216 pci_register_bar(pci_dev, NVME_CMB_BIR,
6217 PCI_BASE_ADDRESS_SPACE_MEMORY |
6218 PCI_BASE_ADDRESS_MEM_TYPE_64 |
6219 PCI_BASE_ADDRESS_MEM_PREFETCH, &n->cmb.mem);
6220
6221 NVME_CAP_SET_CMBS(n->bar.cap, 1);
6222
6223 if (n->params.legacy_cmb) {
6224 nvme_cmb_enable_regs(n);
6225 n->cmb.cmse = true;
6226 }
6227 }
6228
6229 static void nvme_init_pmr(NvmeCtrl *n, PCIDevice *pci_dev)
6230 {
6231 NVME_PMRCAP_SET_RDS(n->bar.pmrcap, 1);
6232 NVME_PMRCAP_SET_WDS(n->bar.pmrcap, 1);
6233 NVME_PMRCAP_SET_BIR(n->bar.pmrcap, NVME_PMR_BIR);
6234 /* Turn on bit 1 support */
6235 NVME_PMRCAP_SET_PMRWBM(n->bar.pmrcap, 0x02);
6236 NVME_PMRCAP_SET_CMSS(n->bar.pmrcap, 1);
6237
6238 pci_register_bar(pci_dev, NVME_PMRCAP_BIR(n->bar.pmrcap),
6239 PCI_BASE_ADDRESS_SPACE_MEMORY |
6240 PCI_BASE_ADDRESS_MEM_TYPE_64 |
6241 PCI_BASE_ADDRESS_MEM_PREFETCH, &n->pmr.dev->mr);
6242
6243 memory_region_set_enabled(&n->pmr.dev->mr, false);
6244 }
6245
6246 static int nvme_init_pci(NvmeCtrl *n, PCIDevice *pci_dev, Error **errp)
6247 {
6248 uint8_t *pci_conf = pci_dev->config;
6249 uint64_t bar_size, msix_table_size, msix_pba_size;
6250 unsigned msix_table_offset, msix_pba_offset;
6251 int ret;
6252
6253 Error *err = NULL;
6254
6255 pci_conf[PCI_INTERRUPT_PIN] = 1;
6256 pci_config_set_prog_interface(pci_conf, 0x2);
6257
6258 if (n->params.use_intel_id) {
6259 pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_INTEL);
6260 pci_config_set_device_id(pci_conf, 0x5845);
6261 } else {
6262 pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_REDHAT);
6263 pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_REDHAT_NVME);
6264 }
6265
6266 pci_config_set_class(pci_conf, PCI_CLASS_STORAGE_EXPRESS);
6267 pcie_endpoint_cap_init(pci_dev, 0x80);
6268
6269 bar_size = QEMU_ALIGN_UP(n->reg_size, 4 * KiB);
6270 msix_table_offset = bar_size;
6271 msix_table_size = PCI_MSIX_ENTRY_SIZE * n->params.msix_qsize;
6272
6273 bar_size += msix_table_size;
6274 bar_size = QEMU_ALIGN_UP(bar_size, 4 * KiB);
6275 msix_pba_offset = bar_size;
6276 msix_pba_size = QEMU_ALIGN_UP(n->params.msix_qsize, 64) / 8;
6277
6278 bar_size += msix_pba_size;
6279 bar_size = pow2ceil(bar_size);
6280
6281 memory_region_init(&n->bar0, OBJECT(n), "nvme-bar0", bar_size);
6282 memory_region_init_io(&n->iomem, OBJECT(n), &nvme_mmio_ops, n, "nvme",
6283 n->reg_size);
6284 memory_region_add_subregion(&n->bar0, 0, &n->iomem);
6285
6286 pci_register_bar(pci_dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY |
6287 PCI_BASE_ADDRESS_MEM_TYPE_64, &n->bar0);
6288 ret = msix_init(pci_dev, n->params.msix_qsize,
6289 &n->bar0, 0, msix_table_offset,
6290 &n->bar0, 0, msix_pba_offset, 0, &err);
6291 if (ret < 0) {
6292 if (ret == -ENOTSUP) {
6293 warn_report_err(err);
6294 } else {
6295 error_propagate(errp, err);
6296 return ret;
6297 }
6298 }
6299
6300 if (n->params.cmb_size_mb) {
6301 nvme_init_cmb(n, pci_dev);
6302 }
6303
6304 if (n->pmr.dev) {
6305 nvme_init_pmr(n, pci_dev);
6306 }
6307
6308 return 0;
6309 }
6310
6311 static void nvme_init_subnqn(NvmeCtrl *n)
6312 {
6313 NvmeSubsystem *subsys = n->subsys;
6314 NvmeIdCtrl *id = &n->id_ctrl;
6315
6316 if (!subsys) {
6317 snprintf((char *)id->subnqn, sizeof(id->subnqn),
6318 "nqn.2019-08.org.qemu:%s", n->params.serial);
6319 } else {
6320 pstrcpy((char *)id->subnqn, sizeof(id->subnqn), (char*)subsys->subnqn);
6321 }
6322 }
6323
6324 static void nvme_init_ctrl(NvmeCtrl *n, PCIDevice *pci_dev)
6325 {
6326 NvmeIdCtrl *id = &n->id_ctrl;
6327 uint8_t *pci_conf = pci_dev->config;
6328
6329 id->vid = cpu_to_le16(pci_get_word(pci_conf + PCI_VENDOR_ID));
6330 id->ssvid = cpu_to_le16(pci_get_word(pci_conf + PCI_SUBSYSTEM_VENDOR_ID));
6331 strpadcpy((char *)id->mn, sizeof(id->mn), "QEMU NVMe Ctrl", ' ');
6332 strpadcpy((char *)id->fr, sizeof(id->fr), "1.0", ' ');
6333 strpadcpy((char *)id->sn, sizeof(id->sn), n->params.serial, ' ');
6334
6335 id->cntlid = cpu_to_le16(n->cntlid);
6336
6337 id->oaes = cpu_to_le32(NVME_OAES_NS_ATTR);
6338
6339 id->rab = 6;
6340
6341 if (n->params.use_intel_id) {
6342 id->ieee[0] = 0xb3;
6343 id->ieee[1] = 0x02;
6344 id->ieee[2] = 0x00;
6345 } else {
6346 id->ieee[0] = 0x00;
6347 id->ieee[1] = 0x54;
6348 id->ieee[2] = 0x52;
6349 }
6350
6351 id->mdts = n->params.mdts;
6352 id->ver = cpu_to_le32(NVME_SPEC_VER);
6353 id->oacs = cpu_to_le16(NVME_OACS_NS_MGMT | NVME_OACS_FORMAT);
6354 id->cntrltype = 0x1;
6355
6356 /*
6357 * Because the controller always completes the Abort command immediately,
6358 * there can never be more than one concurrently executing Abort command,
6359 * so this value is never used for anything. Note that there can easily be
6360 * many Abort commands in the queues, but they are not considered
6361 * "executing" until processed by nvme_abort.
6362 *
6363 * The specification recommends a value of 3 for Abort Command Limit (four
6364 * concurrently outstanding Abort commands), so lets use that though it is
6365 * inconsequential.
6366 */
6367 id->acl = 3;
6368 id->aerl = n->params.aerl;
6369 id->frmw = (NVME_NUM_FW_SLOTS << 1) | NVME_FRMW_SLOT1_RO;
6370 id->lpa = NVME_LPA_NS_SMART | NVME_LPA_CSE | NVME_LPA_EXTENDED;
6371
6372 /* recommended default value (~70 C) */
6373 id->wctemp = cpu_to_le16(NVME_TEMPERATURE_WARNING);
6374 id->cctemp = cpu_to_le16(NVME_TEMPERATURE_CRITICAL);
6375
6376 id->sqes = (0x6 << 4) | 0x6;
6377 id->cqes = (0x4 << 4) | 0x4;
6378 id->nn = cpu_to_le32(NVME_MAX_NAMESPACES);
6379 id->oncs = cpu_to_le16(NVME_ONCS_WRITE_ZEROES | NVME_ONCS_TIMESTAMP |
6380 NVME_ONCS_FEATURES | NVME_ONCS_DSM |
6381 NVME_ONCS_COMPARE | NVME_ONCS_COPY);
6382
6383 /*
6384 * NOTE: If this device ever supports a command set that does NOT use 0x0
6385 * as a Flush-equivalent operation, support for the broadcast NSID in Flush
6386 * should probably be removed.
6387 *
6388 * See comment in nvme_io_cmd.
6389 */
6390 id->vwc = NVME_VWC_NSID_BROADCAST_SUPPORT | NVME_VWC_PRESENT;
6391
6392 id->ocfs = cpu_to_le16(NVME_OCFS_COPY_FORMAT_0);
6393 id->sgls = cpu_to_le32(NVME_CTRL_SGLS_SUPPORT_NO_ALIGN |
6394 NVME_CTRL_SGLS_BITBUCKET);
6395
6396 nvme_init_subnqn(n);
6397
6398 id->psd[0].mp = cpu_to_le16(0x9c4);
6399 id->psd[0].enlat = cpu_to_le32(0x10);
6400 id->psd[0].exlat = cpu_to_le32(0x4);
6401
6402 if (n->subsys) {
6403 id->cmic |= NVME_CMIC_MULTI_CTRL;
6404 }
6405
6406 NVME_CAP_SET_MQES(n->bar.cap, 0x7ff);
6407 NVME_CAP_SET_CQR(n->bar.cap, 1);
6408 NVME_CAP_SET_TO(n->bar.cap, 0xf);
6409 NVME_CAP_SET_CSS(n->bar.cap, NVME_CAP_CSS_NVM);
6410 NVME_CAP_SET_CSS(n->bar.cap, NVME_CAP_CSS_CSI_SUPP);
6411 NVME_CAP_SET_CSS(n->bar.cap, NVME_CAP_CSS_ADMIN_ONLY);
6412 NVME_CAP_SET_MPSMAX(n->bar.cap, 4);
6413 NVME_CAP_SET_CMBS(n->bar.cap, n->params.cmb_size_mb ? 1 : 0);
6414 NVME_CAP_SET_PMRS(n->bar.cap, n->pmr.dev ? 1 : 0);
6415
6416 n->bar.vs = NVME_SPEC_VER;
6417 n->bar.intmc = n->bar.intms = 0;
6418 }
6419
6420 static int nvme_init_subsys(NvmeCtrl *n, Error **errp)
6421 {
6422 int cntlid;
6423
6424 if (!n->subsys) {
6425 return 0;
6426 }
6427
6428 cntlid = nvme_subsys_register_ctrl(n, errp);
6429 if (cntlid < 0) {
6430 return -1;
6431 }
6432
6433 n->cntlid = cntlid;
6434
6435 return 0;
6436 }
6437
6438 void nvme_attach_ns(NvmeCtrl *n, NvmeNamespace *ns)
6439 {
6440 uint32_t nsid = ns->params.nsid;
6441 assert(nsid && nsid <= NVME_MAX_NAMESPACES);
6442
6443 n->namespaces[nsid] = ns;
6444 ns->attached++;
6445
6446 n->dmrsl = MIN_NON_ZERO(n->dmrsl,
6447 BDRV_REQUEST_MAX_BYTES / nvme_l2b(ns, 1));
6448 }
6449
6450 static void nvme_realize(PCIDevice *pci_dev, Error **errp)
6451 {
6452 NvmeCtrl *n = NVME(pci_dev);
6453 NvmeNamespace *ns;
6454 Error *local_err = NULL;
6455
6456 nvme_check_constraints(n, &local_err);
6457 if (local_err) {
6458 error_propagate(errp, local_err);
6459 return;
6460 }
6461
6462 qbus_create_inplace(&n->bus, sizeof(NvmeBus), TYPE_NVME_BUS,
6463 &pci_dev->qdev, n->parent_obj.qdev.id);
6464
6465 nvme_init_state(n);
6466 if (nvme_init_pci(n, pci_dev, errp)) {
6467 return;
6468 }
6469
6470 if (nvme_init_subsys(n, errp)) {
6471 error_propagate(errp, local_err);
6472 return;
6473 }
6474 nvme_init_ctrl(n, pci_dev);
6475
6476 /* setup a namespace if the controller drive property was given */
6477 if (n->namespace.blkconf.blk) {
6478 ns = &n->namespace;
6479 ns->params.nsid = 1;
6480
6481 if (nvme_ns_setup(n, ns, errp)) {
6482 return;
6483 }
6484
6485 nvme_attach_ns(n, ns);
6486 }
6487 }
6488
6489 static void nvme_exit(PCIDevice *pci_dev)
6490 {
6491 NvmeCtrl *n = NVME(pci_dev);
6492 NvmeNamespace *ns;
6493 int i;
6494
6495 nvme_ctrl_reset(n);
6496
6497 for (i = 1; i <= NVME_MAX_NAMESPACES; i++) {
6498 ns = nvme_ns(n, i);
6499 if (!ns) {
6500 continue;
6501 }
6502
6503 nvme_ns_cleanup(ns);
6504 }
6505
6506 g_free(n->cq);
6507 g_free(n->sq);
6508 g_free(n->aer_reqs);
6509
6510 if (n->params.cmb_size_mb) {
6511 g_free(n->cmb.buf);
6512 }
6513
6514 if (n->pmr.dev) {
6515 host_memory_backend_set_mapped(n->pmr.dev, false);
6516 }
6517 msix_uninit(pci_dev, &n->bar0, &n->bar0);
6518 memory_region_del_subregion(&n->bar0, &n->iomem);
6519 }
6520
6521 static Property nvme_props[] = {
6522 DEFINE_BLOCK_PROPERTIES(NvmeCtrl, namespace.blkconf),
6523 DEFINE_PROP_LINK("pmrdev", NvmeCtrl, pmr.dev, TYPE_MEMORY_BACKEND,
6524 HostMemoryBackend *),
6525 DEFINE_PROP_LINK("subsys", NvmeCtrl, subsys, TYPE_NVME_SUBSYS,
6526 NvmeSubsystem *),
6527 DEFINE_PROP_STRING("serial", NvmeCtrl, params.serial),
6528 DEFINE_PROP_UINT32("cmb_size_mb", NvmeCtrl, params.cmb_size_mb, 0),
6529 DEFINE_PROP_UINT32("num_queues", NvmeCtrl, params.num_queues, 0),
6530 DEFINE_PROP_UINT32("max_ioqpairs", NvmeCtrl, params.max_ioqpairs, 64),
6531 DEFINE_PROP_UINT16("msix_qsize", NvmeCtrl, params.msix_qsize, 65),
6532 DEFINE_PROP_UINT8("aerl", NvmeCtrl, params.aerl, 3),
6533 DEFINE_PROP_UINT32("aer_max_queued", NvmeCtrl, params.aer_max_queued, 64),
6534 DEFINE_PROP_UINT8("mdts", NvmeCtrl, params.mdts, 7),
6535 DEFINE_PROP_UINT8("vsl", NvmeCtrl, params.vsl, 7),
6536 DEFINE_PROP_BOOL("use-intel-id", NvmeCtrl, params.use_intel_id, false),
6537 DEFINE_PROP_BOOL("legacy-cmb", NvmeCtrl, params.legacy_cmb, false),
6538 DEFINE_PROP_UINT8("zoned.zasl", NvmeCtrl, params.zasl, 0),
6539 DEFINE_PROP_BOOL("zoned.auto_transition", NvmeCtrl,
6540 params.auto_transition_zones, true),
6541 DEFINE_PROP_END_OF_LIST(),
6542 };
6543
6544 static void nvme_get_smart_warning(Object *obj, Visitor *v, const char *name,
6545 void *opaque, Error **errp)
6546 {
6547 NvmeCtrl *n = NVME(obj);
6548 uint8_t value = n->smart_critical_warning;
6549
6550 visit_type_uint8(v, name, &value, errp);
6551 }
6552
6553 static void nvme_set_smart_warning(Object *obj, Visitor *v, const char *name,
6554 void *opaque, Error **errp)
6555 {
6556 NvmeCtrl *n = NVME(obj);
6557 uint8_t value, old_value, cap = 0, index, event;
6558
6559 if (!visit_type_uint8(v, name, &value, errp)) {
6560 return;
6561 }
6562
6563 cap = NVME_SMART_SPARE | NVME_SMART_TEMPERATURE | NVME_SMART_RELIABILITY
6564 | NVME_SMART_MEDIA_READ_ONLY | NVME_SMART_FAILED_VOLATILE_MEDIA;
6565 if (NVME_CAP_PMRS(n->bar.cap)) {
6566 cap |= NVME_SMART_PMR_UNRELIABLE;
6567 }
6568
6569 if ((value & cap) != value) {
6570 error_setg(errp, "unsupported smart critical warning bits: 0x%x",
6571 value & ~cap);
6572 return;
6573 }
6574
6575 old_value = n->smart_critical_warning;
6576 n->smart_critical_warning = value;
6577
6578 /* only inject new bits of smart critical warning */
6579 for (index = 0; index < NVME_SMART_WARN_MAX; index++) {
6580 event = 1 << index;
6581 if (value & ~old_value & event)
6582 nvme_smart_event(n, event);
6583 }
6584 }
6585
6586 static const VMStateDescription nvme_vmstate = {
6587 .name = "nvme",
6588 .unmigratable = 1,
6589 };
6590
6591 static void nvme_class_init(ObjectClass *oc, void *data)
6592 {
6593 DeviceClass *dc = DEVICE_CLASS(oc);
6594 PCIDeviceClass *pc = PCI_DEVICE_CLASS(oc);
6595
6596 pc->realize = nvme_realize;
6597 pc->exit = nvme_exit;
6598 pc->class_id = PCI_CLASS_STORAGE_EXPRESS;
6599 pc->revision = 2;
6600
6601 set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
6602 dc->desc = "Non-Volatile Memory Express";
6603 device_class_set_props(dc, nvme_props);
6604 dc->vmsd = &nvme_vmstate;
6605 }
6606
6607 static void nvme_instance_init(Object *obj)
6608 {
6609 NvmeCtrl *n = NVME(obj);
6610
6611 device_add_bootindex_property(obj, &n->namespace.blkconf.bootindex,
6612 "bootindex", "/namespace@1,0",
6613 DEVICE(obj));
6614
6615 object_property_add(obj, "smart_critical_warning", "uint8",
6616 nvme_get_smart_warning,
6617 nvme_set_smart_warning, NULL, NULL);
6618 }
6619
6620 static const TypeInfo nvme_info = {
6621 .name = TYPE_NVME,
6622 .parent = TYPE_PCI_DEVICE,
6623 .instance_size = sizeof(NvmeCtrl),
6624 .instance_init = nvme_instance_init,
6625 .class_init = nvme_class_init,
6626 .interfaces = (InterfaceInfo[]) {
6627 { INTERFACE_PCIE_DEVICE },
6628 { }
6629 },
6630 };
6631
6632 static const TypeInfo nvme_bus_info = {
6633 .name = TYPE_NVME_BUS,
6634 .parent = TYPE_BUS,
6635 .instance_size = sizeof(NvmeBus),
6636 };
6637
6638 static void nvme_register_types(void)
6639 {
6640 type_register_static(&nvme_info);
6641 type_register_static(&nvme_bus_info);
6642 }
6643
6644 type_init(nvme_register_types)
Ray Wang's QEMU Repository