?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Merge remote-tracking branch 'remotes/dgilbert-gitlab/tags/pull-migration-20210726a...
[qemu/armbru.git] / hw / nvme / ctrl.c
blob629b0d38c2a2e5807a7144d3ed7a8ecfed7e98a5
1 /*
2 * QEMU NVM Express Controller
3 *
4 * Copyright (c) 2012, Intel Corporation
5 *
6 * Written by Keith Busch <keith.busch@intel.com>
7 *
8 * This code is licensed under the GNU GPL v2 or later.
9 */
10
11 /**
12 * Reference Specs: http://www.nvmexpress.org, 1.4, 1.3, 1.2, 1.1, 1.0e
13 *
14 * https://nvmexpress.org/developers/nvme-specification/
15 *
16 *
17 * Notes on coding style
18 * ---------------------
19 * While QEMU coding style prefers lowercase hexadecimals in constants, the
20 * NVMe subsystem use thes format from the NVMe specifications in the comments
21 * (i.e. 'h' suffix instead of '0x' prefix).
22 *
23 * Usage
24 * -----
25 * See docs/system/nvme.rst for extensive documentation.
26 *
27 * Add options:
28 * -drive file=<file>,if=none,id=<drive_id>
29 * -device nvme-subsys,id=<subsys_id>,nqn=<nqn_id>
30 * -device nvme,serial=<serial>,id=<bus_name>, \
31 * cmb_size_mb=<cmb_size_mb[optional]>, \
32 * [pmrdev=<mem_backend_file_id>,] \
33 * max_ioqpairs=<N[optional]>, \
34 * aerl=<N[optional]>,aer_max_queued=<N[optional]>, \
35 * mdts=<N[optional]>,vsl=<N[optional]>, \
36 * zoned.zasl=<N[optional]>, \
37 * zoned.auto_transition=<on|off[optional]>, \
38 * subsys=<subsys_id>
39 * -device nvme-ns,drive=<drive_id>,bus=<bus_name>,nsid=<nsid>,\
40 * zoned=<true|false[optional]>, \
41 * subsys=<subsys_id>,detached=<true|false[optional]>
42 *
43 * Note cmb_size_mb denotes size of CMB in MB. CMB is assumed to be at
44 * offset 0 in BAR2 and supports only WDS, RDS and SQS for now. By default, the
45 * device will use the "v1.4 CMB scheme" - use the `legacy-cmb` parameter to
46 * always enable the CMBLOC and CMBSZ registers (v1.3 behavior).
47 *
48 * Enabling pmr emulation can be achieved by pointing to memory-backend-file.
49 * For example:
50 * -object memory-backend-file,id=<mem_id>,share=on,mem-path=<file_path>, \
51 * size=<size> .... -device nvme,...,pmrdev=<mem_id>
52 *
53 * The PMR will use BAR 4/5 exclusively.
54 *
55 * To place controller(s) and namespace(s) to a subsystem, then provide
56 * nvme-subsys device as above.
57 *
58 * nvme subsystem device parameters
59 * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
60 * - `nqn`
61 * This parameter provides the `<nqn_id>` part of the string
62 * `nqn.2019-08.org.qemu:<nqn_id>` which will be reported in the SUBNQN field
63 * of subsystem controllers. Note that `<nqn_id>` should be unique per
64 * subsystem, but this is not enforced by QEMU. If not specified, it will
65 * default to the value of the `id` parameter (`<subsys_id>`).
66 *
67 * nvme device parameters
68 * ~~~~~~~~~~~~~~~~~~~~~~
69 * - `subsys`
70 * Specifying this parameter attaches the controller to the subsystem and
71 * the SUBNQN field in the controller will report the NQN of the subsystem
72 * device. This also enables multi controller capability represented in
73 * Identify Controller data structure in CMIC (Controller Multi-path I/O and
74 * Namesapce Sharing Capabilities).
75 *
76 * - `aerl`
77 * The Asynchronous Event Request Limit (AERL). Indicates the maximum number
78 * of concurrently outstanding Asynchronous Event Request commands support
79 * by the controller. This is a 0's based value.
80 *
81 * - `aer_max_queued`
82 * This is the maximum number of events that the device will enqueue for
83 * completion when there are no outstanding AERs. When the maximum number of
84 * enqueued events are reached, subsequent events will be dropped.
85 *
86 * - `mdts`
87 * Indicates the maximum data transfer size for a command that transfers data
88 * between host-accessible memory and the controller. The value is specified
89 * as a power of two (2^n) and is in units of the minimum memory page size
90 * (CAP.MPSMIN). The default value is 7 (i.e. 512 KiB).
91 *
92 * - `vsl`
93 * Indicates the maximum data size limit for the Verify command. Like `mdts`,
94 * this value is specified as a power of two (2^n) and is in units of the
95 * minimum memory page size (CAP.MPSMIN). The default value is 7 (i.e. 512
96 * KiB).
97 *
98 * - `zoned.zasl`
99 * Indicates the maximum data transfer size for the Zone Append command. Like
100 * `mdts`, the value is specified as a power of two (2^n) and is in units of
101 * the minimum memory page size (CAP.MPSMIN). The default value is 0 (i.e.
102 * defaulting to the value of `mdts`).
103 *
104 * - `zoned.auto_transition`
105 * Indicates if zones in zone state implicitly opened can be automatically
106 * transitioned to zone state closed for resource management purposes.
107 * Defaults to 'on'.
108 *
109 * nvme namespace device parameters
110 * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
111 * - `shared`
112 * When the parent nvme device (as defined explicitly by the 'bus' parameter
113 * or implicitly by the most recently defined NvmeBus) is linked to an
114 * nvme-subsys device, the namespace will be attached to all controllers in
115 * the subsystem. If set to 'off' (the default), the namespace will remain a
116 * private namespace and may only be attached to a single controller at a
117 * time.
118 *
119 * - `detached`
120 * This parameter is only valid together with the `subsys` parameter. If left
121 * at the default value (`false/off`), the namespace will be attached to all
122 * controllers in the NVMe subsystem at boot-up. If set to `true/on`, the
123 * namespace will be available in the subsystem but not attached to any
124 * controllers.
125 *
126 * Setting `zoned` to true selects Zoned Command Set at the namespace.
127 * In this case, the following namespace properties are available to configure
128 * zoned operation:
129 * zoned.zone_size=<zone size in bytes, default: 128MiB>
130 * The number may be followed by K, M, G as in kilo-, mega- or giga-.
131 *
132 * zoned.zone_capacity=<zone capacity in bytes, default: zone size>
133 * The value 0 (default) forces zone capacity to be the same as zone
134 * size. The value of this property may not exceed zone size.
135 *
136 * zoned.descr_ext_size=<zone descriptor extension size, default 0>
137 * This value needs to be specified in 64B units. If it is zero,
138 * namespace(s) will not support zone descriptor extensions.
139 *
140 * zoned.max_active=<Maximum Active Resources (zones), default: 0>
141 * The default value means there is no limit to the number of
142 * concurrently active zones.
143 *
144 * zoned.max_open=<Maximum Open Resources (zones), default: 0>
145 * The default value means there is no limit to the number of
146 * concurrently open zones.
147 *
148 * zoned.cross_read=<enable RAZB, default: false>
149 * Setting this property to true enables Read Across Zone Boundaries.
150 */
151
152 #include "qemu/osdep.h"
153 #include "qemu/cutils.h"
154 #include "qemu/error-report.h"
155 #include "qemu/log.h"
156 #include "qemu/units.h"
157 #include "qapi/error.h"
158 #include "qapi/visitor.h"
159 #include "sysemu/sysemu.h"
160 #include "sysemu/block-backend.h"
161 #include "sysemu/hostmem.h"
162 #include "hw/pci/msix.h"
163 #include "migration/vmstate.h"
164
165 #include "nvme.h"
166 #include "trace.h"
167
168 #define NVME_MAX_IOQPAIRS 0xffff
169 #define NVME_DB_SIZE 4
170 #define NVME_SPEC_VER 0x00010400
171 #define NVME_CMB_BIR 2
172 #define NVME_PMR_BIR 4
173 #define NVME_TEMPERATURE 0x143
174 #define NVME_TEMPERATURE_WARNING 0x157
175 #define NVME_TEMPERATURE_CRITICAL 0x175
176 #define NVME_NUM_FW_SLOTS 1
177 #define NVME_DEFAULT_MAX_ZA_SIZE (128 * KiB)
178
179 #define NVME_GUEST_ERR(trace, fmt, ...) \
180 do { \
181 (trace_##trace)(__VA_ARGS__); \
182 qemu_log_mask(LOG_GUEST_ERROR, #trace \
183 " in %s: " fmt "\n", __func__, ## __VA_ARGS__); \
184 } while (0)
185
186 static const bool nvme_feature_support[NVME_FID_MAX] = {
187 [NVME_ARBITRATION] = true,
188 [NVME_POWER_MANAGEMENT] = true,
189 [NVME_TEMPERATURE_THRESHOLD] = true,
190 [NVME_ERROR_RECOVERY] = true,
191 [NVME_VOLATILE_WRITE_CACHE] = true,
192 [NVME_NUMBER_OF_QUEUES] = true,
193 [NVME_INTERRUPT_COALESCING] = true,
194 [NVME_INTERRUPT_VECTOR_CONF] = true,
195 [NVME_WRITE_ATOMICITY] = true,
196 [NVME_ASYNCHRONOUS_EVENT_CONF] = true,
197 [NVME_TIMESTAMP] = true,
198 [NVME_COMMAND_SET_PROFILE] = true,
199 };
200
201 static const uint32_t nvme_feature_cap[NVME_FID_MAX] = {
202 [NVME_TEMPERATURE_THRESHOLD] = NVME_FEAT_CAP_CHANGE,
203 [NVME_ERROR_RECOVERY] = NVME_FEAT_CAP_CHANGE | NVME_FEAT_CAP_NS,
204 [NVME_VOLATILE_WRITE_CACHE] = NVME_FEAT_CAP_CHANGE,
205 [NVME_NUMBER_OF_QUEUES] = NVME_FEAT_CAP_CHANGE,
206 [NVME_ASYNCHRONOUS_EVENT_CONF] = NVME_FEAT_CAP_CHANGE,
207 [NVME_TIMESTAMP] = NVME_FEAT_CAP_CHANGE,
208 [NVME_COMMAND_SET_PROFILE] = NVME_FEAT_CAP_CHANGE,
209 };
210
211 static const uint32_t nvme_cse_acs[256] = {
212 [NVME_ADM_CMD_DELETE_SQ] = NVME_CMD_EFF_CSUPP,
213 [NVME_ADM_CMD_CREATE_SQ] = NVME_CMD_EFF_CSUPP,
214 [NVME_ADM_CMD_GET_LOG_PAGE] = NVME_CMD_EFF_CSUPP,
215 [NVME_ADM_CMD_DELETE_CQ] = NVME_CMD_EFF_CSUPP,
216 [NVME_ADM_CMD_CREATE_CQ] = NVME_CMD_EFF_CSUPP,
217 [NVME_ADM_CMD_IDENTIFY] = NVME_CMD_EFF_CSUPP,
218 [NVME_ADM_CMD_ABORT] = NVME_CMD_EFF_CSUPP,
219 [NVME_ADM_CMD_SET_FEATURES] = NVME_CMD_EFF_CSUPP,
220 [NVME_ADM_CMD_GET_FEATURES] = NVME_CMD_EFF_CSUPP,
221 [NVME_ADM_CMD_ASYNC_EV_REQ] = NVME_CMD_EFF_CSUPP,
222 [NVME_ADM_CMD_NS_ATTACHMENT] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_NIC,
223 [NVME_ADM_CMD_FORMAT_NVM] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
224 };
225
226 static const uint32_t nvme_cse_iocs_none[256];
227
228 static const uint32_t nvme_cse_iocs_nvm[256] = {
229 [NVME_CMD_FLUSH] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
230 [NVME_CMD_WRITE_ZEROES] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
231 [NVME_CMD_WRITE] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
232 [NVME_CMD_READ] = NVME_CMD_EFF_CSUPP,
233 [NVME_CMD_DSM] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
234 [NVME_CMD_VERIFY] = NVME_CMD_EFF_CSUPP,
235 [NVME_CMD_COPY] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
236 [NVME_CMD_COMPARE] = NVME_CMD_EFF_CSUPP,
237 };
238
239 static const uint32_t nvme_cse_iocs_zoned[256] = {
240 [NVME_CMD_FLUSH] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
241 [NVME_CMD_WRITE_ZEROES] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
242 [NVME_CMD_WRITE] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
243 [NVME_CMD_READ] = NVME_CMD_EFF_CSUPP,
244 [NVME_CMD_DSM] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
245 [NVME_CMD_VERIFY] = NVME_CMD_EFF_CSUPP,
246 [NVME_CMD_COPY] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
247 [NVME_CMD_COMPARE] = NVME_CMD_EFF_CSUPP,
248 [NVME_CMD_ZONE_APPEND] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
249 [NVME_CMD_ZONE_MGMT_SEND] = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
250 [NVME_CMD_ZONE_MGMT_RECV] = NVME_CMD_EFF_CSUPP,
251 };
252
253 static void nvme_process_sq(void *opaque);
254
255 static uint16_t nvme_sqid(NvmeRequest *req)
256 {
257 return le16_to_cpu(req->sq->sqid);
258 }
259
260 static void nvme_assign_zone_state(NvmeNamespace *ns, NvmeZone *zone,
261 NvmeZoneState state)
262 {
263 if (QTAILQ_IN_USE(zone, entry)) {
264 switch (nvme_get_zone_state(zone)) {
265 case NVME_ZONE_STATE_EXPLICITLY_OPEN:
266 QTAILQ_REMOVE(&ns->exp_open_zones, zone, entry);
267 break;
268 case NVME_ZONE_STATE_IMPLICITLY_OPEN:
269 QTAILQ_REMOVE(&ns->imp_open_zones, zone, entry);
270 break;
271 case NVME_ZONE_STATE_CLOSED:
272 QTAILQ_REMOVE(&ns->closed_zones, zone, entry);
273 break;
274 case NVME_ZONE_STATE_FULL:
275 QTAILQ_REMOVE(&ns->full_zones, zone, entry);
276 default:
277 ;
278 }
279 }
280
281 nvme_set_zone_state(zone, state);
282
283 switch (state) {
284 case NVME_ZONE_STATE_EXPLICITLY_OPEN:
285 QTAILQ_INSERT_TAIL(&ns->exp_open_zones, zone, entry);
286 break;
287 case NVME_ZONE_STATE_IMPLICITLY_OPEN:
288 QTAILQ_INSERT_TAIL(&ns->imp_open_zones, zone, entry);
289 break;
290 case NVME_ZONE_STATE_CLOSED:
291 QTAILQ_INSERT_TAIL(&ns->closed_zones, zone, entry);
292 break;
293 case NVME_ZONE_STATE_FULL:
294 QTAILQ_INSERT_TAIL(&ns->full_zones, zone, entry);
295 case NVME_ZONE_STATE_READ_ONLY:
296 break;
297 default:
298 zone->d.za = 0;
299 }
300 }
301
302 /*
303 * Check if we can open a zone without exceeding open/active limits.
304 * AOR stands for "Active and Open Resources" (see TP 4053 section 2.5).
305 */
306 static int nvme_aor_check(NvmeNamespace *ns, uint32_t act, uint32_t opn)
307 {
308 if (ns->params.max_active_zones != 0 &&
309 ns->nr_active_zones + act > ns->params.max_active_zones) {
310 trace_pci_nvme_err_insuff_active_res(ns->params.max_active_zones);
311 return NVME_ZONE_TOO_MANY_ACTIVE | NVME_DNR;
312 }
313 if (ns->params.max_open_zones != 0 &&
314 ns->nr_open_zones + opn > ns->params.max_open_zones) {
315 trace_pci_nvme_err_insuff_open_res(ns->params.max_open_zones);
316 return NVME_ZONE_TOO_MANY_OPEN | NVME_DNR;
317 }
318
319 return NVME_SUCCESS;
320 }
321
322 static bool nvme_addr_is_cmb(NvmeCtrl *n, hwaddr addr)
323 {
324 hwaddr hi, lo;
325
326 if (!n->cmb.cmse) {
327 return false;
328 }
329
330 lo = n->params.legacy_cmb ? n->cmb.mem.addr : n->cmb.cba;
331 hi = lo + int128_get64(n->cmb.mem.size);
332
333 return addr >= lo && addr < hi;
334 }
335
336 static inline void *nvme_addr_to_cmb(NvmeCtrl *n, hwaddr addr)
337 {
338 hwaddr base = n->params.legacy_cmb ? n->cmb.mem.addr : n->cmb.cba;
339 return &n->cmb.buf[addr - base];
340 }
341
342 static bool nvme_addr_is_pmr(NvmeCtrl *n, hwaddr addr)
343 {
344 hwaddr hi;
345
346 if (!n->pmr.cmse) {
347 return false;
348 }
349
350 hi = n->pmr.cba + int128_get64(n->pmr.dev->mr.size);
351
352 return addr >= n->pmr.cba && addr < hi;
353 }
354
355 static inline void *nvme_addr_to_pmr(NvmeCtrl *n, hwaddr addr)
356 {
357 return memory_region_get_ram_ptr(&n->pmr.dev->mr) + (addr - n->pmr.cba);
358 }
359
360 static int nvme_addr_read(NvmeCtrl *n, hwaddr addr, void *buf, int size)
361 {
362 hwaddr hi = addr + size - 1;
363 if (hi < addr) {
364 return 1;
365 }
366
367 if (n->bar.cmbsz && nvme_addr_is_cmb(n, addr) && nvme_addr_is_cmb(n, hi)) {
368 memcpy(buf, nvme_addr_to_cmb(n, addr), size);
369 return 0;
370 }
371
372 if (nvme_addr_is_pmr(n, addr) && nvme_addr_is_pmr(n, hi)) {
373 memcpy(buf, nvme_addr_to_pmr(n, addr), size);
374 return 0;
375 }
376
377 return pci_dma_read(&n->parent_obj, addr, buf, size);
378 }
379
380 static int nvme_addr_write(NvmeCtrl *n, hwaddr addr, void *buf, int size)
381 {
382 hwaddr hi = addr + size - 1;
383 if (hi < addr) {
384 return 1;
385 }
386
387 if (n->bar.cmbsz && nvme_addr_is_cmb(n, addr) && nvme_addr_is_cmb(n, hi)) {
388 memcpy(nvme_addr_to_cmb(n, addr), buf, size);
389 return 0;
390 }
391
392 if (nvme_addr_is_pmr(n, addr) && nvme_addr_is_pmr(n, hi)) {
393 memcpy(nvme_addr_to_pmr(n, addr), buf, size);
394 return 0;
395 }
396
397 return pci_dma_write(&n->parent_obj, addr, buf, size);
398 }
399
400 static bool nvme_nsid_valid(NvmeCtrl *n, uint32_t nsid)
401 {
402 return nsid &&
403 (nsid == NVME_NSID_BROADCAST || nsid <= NVME_MAX_NAMESPACES);
404 }
405
406 static int nvme_check_sqid(NvmeCtrl *n, uint16_t sqid)
407 {
408 return sqid < n->params.max_ioqpairs + 1 && n->sq[sqid] != NULL ? 0 : -1;
409 }
410
411 static int nvme_check_cqid(NvmeCtrl *n, uint16_t cqid)
412 {
413 return cqid < n->params.max_ioqpairs + 1 && n->cq[cqid] != NULL ? 0 : -1;
414 }
415
416 static void nvme_inc_cq_tail(NvmeCQueue *cq)
417 {
418 cq->tail++;
419 if (cq->tail >= cq->size) {
420 cq->tail = 0;
421 cq->phase = !cq->phase;
422 }
423 }
424
425 static void nvme_inc_sq_head(NvmeSQueue *sq)
426 {
427 sq->head = (sq->head + 1) % sq->size;
428 }
429
430 static uint8_t nvme_cq_full(NvmeCQueue *cq)
431 {
432 return (cq->tail + 1) % cq->size == cq->head;
433 }
434
435 static uint8_t nvme_sq_empty(NvmeSQueue *sq)
436 {
437 return sq->head == sq->tail;
438 }
439
440 static void nvme_irq_check(NvmeCtrl *n)
441 {
442 if (msix_enabled(&(n->parent_obj))) {
443 return;
444 }
445 if (~n->bar.intms & n->irq_status) {
446 pci_irq_assert(&n->parent_obj);
447 } else {
448 pci_irq_deassert(&n->parent_obj);
449 }
450 }
451
452 static void nvme_irq_assert(NvmeCtrl *n, NvmeCQueue *cq)
453 {
454 if (cq->irq_enabled) {
455 if (msix_enabled(&(n->parent_obj))) {
456 trace_pci_nvme_irq_msix(cq->vector);
457 msix_notify(&(n->parent_obj), cq->vector);
458 } else {
459 trace_pci_nvme_irq_pin();
460 assert(cq->vector < 32);
461 n->irq_status |= 1 << cq->vector;
462 nvme_irq_check(n);
463 }
464 } else {
465 trace_pci_nvme_irq_masked();
466 }
467 }
468
469 static void nvme_irq_deassert(NvmeCtrl *n, NvmeCQueue *cq)
470 {
471 if (cq->irq_enabled) {
472 if (msix_enabled(&(n->parent_obj))) {
473 return;
474 } else {
475 assert(cq->vector < 32);
476 if (!n->cq_pending) {
477 n->irq_status &= ~(1 << cq->vector);
478 }
479 nvme_irq_check(n);
480 }
481 }
482 }
483
484 static void nvme_req_clear(NvmeRequest *req)
485 {
486 req->ns = NULL;
487 req->opaque = NULL;
488 req->aiocb = NULL;
489 memset(&req->cqe, 0x0, sizeof(req->cqe));
490 req->status = NVME_SUCCESS;
491 }
492
493 static inline void nvme_sg_init(NvmeCtrl *n, NvmeSg *sg, bool dma)
494 {
495 if (dma) {
496 pci_dma_sglist_init(&sg->qsg, &n->parent_obj, 0);
497 sg->flags = NVME_SG_DMA;
498 } else {
499 qemu_iovec_init(&sg->iov, 0);
500 }
501
502 sg->flags |= NVME_SG_ALLOC;
503 }
504
505 static inline void nvme_sg_unmap(NvmeSg *sg)
506 {
507 if (!(sg->flags & NVME_SG_ALLOC)) {
508 return;
509 }
510
511 if (sg->flags & NVME_SG_DMA) {
512 qemu_sglist_destroy(&sg->qsg);
513 } else {
514 qemu_iovec_destroy(&sg->iov);
515 }
516
517 memset(sg, 0x0, sizeof(*sg));
518 }
519
520 /*
521 * When metadata is transfered as extended LBAs, the DPTR mapped into `sg`
522 * holds both data and metadata. This function splits the data and metadata
523 * into two separate QSG/IOVs.
524 */
525 static void nvme_sg_split(NvmeSg *sg, NvmeNamespace *ns, NvmeSg *data,
526 NvmeSg *mdata)
527 {
528 NvmeSg *dst = data;
529 uint32_t trans_len, count = ns->lbasz;
530 uint64_t offset = 0;
531 bool dma = sg->flags & NVME_SG_DMA;
532 size_t sge_len;
533 size_t sg_len = dma ? sg->qsg.size : sg->iov.size;
534 int sg_idx = 0;
535
536 assert(sg->flags & NVME_SG_ALLOC);
537
538 while (sg_len) {
539 sge_len = dma ? sg->qsg.sg[sg_idx].len : sg->iov.iov[sg_idx].iov_len;
540
541 trans_len = MIN(sg_len, count);
542 trans_len = MIN(trans_len, sge_len - offset);
543
544 if (dst) {
545 if (dma) {
546 qemu_sglist_add(&dst->qsg, sg->qsg.sg[sg_idx].base + offset,
547 trans_len);
548 } else {
549 qemu_iovec_add(&dst->iov,
550 sg->iov.iov[sg_idx].iov_base + offset,
551 trans_len);
552 }
553 }
554
555 sg_len -= trans_len;
556 count -= trans_len;
557 offset += trans_len;
558
559 if (count == 0) {
560 dst = (dst == data) ? mdata : data;
561 count = (dst == data) ? ns->lbasz : ns->lbaf.ms;
562 }
563
564 if (sge_len == offset) {
565 offset = 0;
566 sg_idx++;
567 }
568 }
569 }
570
571 static uint16_t nvme_map_addr_cmb(NvmeCtrl *n, QEMUIOVector *iov, hwaddr addr,
572 size_t len)
573 {
574 if (!len) {
575 return NVME_SUCCESS;
576 }
577
578 trace_pci_nvme_map_addr_cmb(addr, len);
579
580 if (!nvme_addr_is_cmb(n, addr) || !nvme_addr_is_cmb(n, addr + len - 1)) {
581 return NVME_DATA_TRAS_ERROR;
582 }
583
584 qemu_iovec_add(iov, nvme_addr_to_cmb(n, addr), len);
585
586 return NVME_SUCCESS;
587 }
588
589 static uint16_t nvme_map_addr_pmr(NvmeCtrl *n, QEMUIOVector *iov, hwaddr addr,
590 size_t len)
591 {
592 if (!len) {
593 return NVME_SUCCESS;
594 }
595
596 if (!nvme_addr_is_pmr(n, addr) || !nvme_addr_is_pmr(n, addr + len - 1)) {
597 return NVME_DATA_TRAS_ERROR;
598 }
599
600 qemu_iovec_add(iov, nvme_addr_to_pmr(n, addr), len);
601
602 return NVME_SUCCESS;
603 }
604
605 static uint16_t nvme_map_addr(NvmeCtrl *n, NvmeSg *sg, hwaddr addr, size_t len)
606 {
607 bool cmb = false, pmr = false;
608
609 if (!len) {
610 return NVME_SUCCESS;
611 }
612
613 trace_pci_nvme_map_addr(addr, len);
614
615 if (nvme_addr_is_cmb(n, addr)) {
616 cmb = true;
617 } else if (nvme_addr_is_pmr(n, addr)) {
618 pmr = true;
619 }
620
621 if (cmb || pmr) {
622 if (sg->flags & NVME_SG_DMA) {
623 return NVME_INVALID_USE_OF_CMB | NVME_DNR;
624 }
625
626 if (cmb) {
627 return nvme_map_addr_cmb(n, &sg->iov, addr, len);
628 } else {
629 return nvme_map_addr_pmr(n, &sg->iov, addr, len);
630 }
631 }
632
633 if (!(sg->flags & NVME_SG_DMA)) {
634 return NVME_INVALID_USE_OF_CMB | NVME_DNR;
635 }
636
637 qemu_sglist_add(&sg->qsg, addr, len);
638
639 return NVME_SUCCESS;
640 }
641
642 static inline bool nvme_addr_is_dma(NvmeCtrl *n, hwaddr addr)
643 {
644 return !(nvme_addr_is_cmb(n, addr) || nvme_addr_is_pmr(n, addr));
645 }
646
647 static uint16_t nvme_map_prp(NvmeCtrl *n, NvmeSg *sg, uint64_t prp1,
648 uint64_t prp2, uint32_t len)
649 {
650 hwaddr trans_len = n->page_size - (prp1 % n->page_size);
651 trans_len = MIN(len, trans_len);
652 int num_prps = (len >> n->page_bits) + 1;
653 uint16_t status;
654 int ret;
655
656 trace_pci_nvme_map_prp(trans_len, len, prp1, prp2, num_prps);
657
658 nvme_sg_init(n, sg, nvme_addr_is_dma(n, prp1));
659
660 status = nvme_map_addr(n, sg, prp1, trans_len);
661 if (status) {
662 goto unmap;
663 }
664
665 len -= trans_len;
666 if (len) {
667 if (len > n->page_size) {
668 uint64_t prp_list[n->max_prp_ents];
669 uint32_t nents, prp_trans;
670 int i = 0;
671
672 /*
673 * The first PRP list entry, pointed to by PRP2 may contain offset.
674 * Hence, we need to calculate the number of entries in based on
675 * that offset.
676 */
677 nents = (n->page_size - (prp2 & (n->page_size - 1))) >> 3;
678 prp_trans = MIN(n->max_prp_ents, nents) * sizeof(uint64_t);
679 ret = nvme_addr_read(n, prp2, (void *)prp_list, prp_trans);
680 if (ret) {
681 trace_pci_nvme_err_addr_read(prp2);
682 status = NVME_DATA_TRAS_ERROR;
683 goto unmap;
684 }
685 while (len != 0) {
686 uint64_t prp_ent = le64_to_cpu(prp_list[i]);
687
688 if (i == nents - 1 && len > n->page_size) {
689 if (unlikely(prp_ent & (n->page_size - 1))) {
690 trace_pci_nvme_err_invalid_prplist_ent(prp_ent);
691 status = NVME_INVALID_PRP_OFFSET | NVME_DNR;
692 goto unmap;
693 }
694
695 i = 0;
696 nents = (len + n->page_size - 1) >> n->page_bits;
697 nents = MIN(nents, n->max_prp_ents);
698 prp_trans = nents * sizeof(uint64_t);
699 ret = nvme_addr_read(n, prp_ent, (void *)prp_list,
700 prp_trans);
701 if (ret) {
702 trace_pci_nvme_err_addr_read(prp_ent);
703 status = NVME_DATA_TRAS_ERROR;
704 goto unmap;
705 }
706 prp_ent = le64_to_cpu(prp_list[i]);
707 }
708
709 if (unlikely(prp_ent & (n->page_size - 1))) {
710 trace_pci_nvme_err_invalid_prplist_ent(prp_ent);
711 status = NVME_INVALID_PRP_OFFSET | NVME_DNR;
712 goto unmap;
713 }
714
715 trans_len = MIN(len, n->page_size);
716 status = nvme_map_addr(n, sg, prp_ent, trans_len);
717 if (status) {
718 goto unmap;
719 }
720
721 len -= trans_len;
722 i++;
723 }
724 } else {
725 if (unlikely(prp2 & (n->page_size - 1))) {
726 trace_pci_nvme_err_invalid_prp2_align(prp2);
727 status = NVME_INVALID_PRP_OFFSET | NVME_DNR;
728 goto unmap;
729 }
730 status = nvme_map_addr(n, sg, prp2, len);
731 if (status) {
732 goto unmap;
733 }
734 }
735 }
736
737 return NVME_SUCCESS;
738
739 unmap:
740 nvme_sg_unmap(sg);
741 return status;
742 }
743
744 /*
745 * Map 'nsgld' data descriptors from 'segment'. The function will subtract the
746 * number of bytes mapped in len.
747 */
748 static uint16_t nvme_map_sgl_data(NvmeCtrl *n, NvmeSg *sg,
749 NvmeSglDescriptor *segment, uint64_t nsgld,
750 size_t *len, NvmeCmd *cmd)
751 {
752 dma_addr_t addr, trans_len;
753 uint32_t dlen;
754 uint16_t status;
755
756 for (int i = 0; i < nsgld; i++) {
757 uint8_t type = NVME_SGL_TYPE(segment[i].type);
758
759 switch (type) {
760 case NVME_SGL_DESCR_TYPE_BIT_BUCKET:
761 if (cmd->opcode == NVME_CMD_WRITE) {
762 continue;
763 }
764 case NVME_SGL_DESCR_TYPE_DATA_BLOCK:
765 break;
766 case NVME_SGL_DESCR_TYPE_SEGMENT:
767 case NVME_SGL_DESCR_TYPE_LAST_SEGMENT:
768 return NVME_INVALID_NUM_SGL_DESCRS | NVME_DNR;
769 default:
770 return NVME_SGL_DESCR_TYPE_INVALID | NVME_DNR;
771 }
772
773 dlen = le32_to_cpu(segment[i].len);
774
775 if (!dlen) {
776 continue;
777 }
778
779 if (*len == 0) {
780 /*
781 * All data has been mapped, but the SGL contains additional
782 * segments and/or descriptors. The controller might accept
783 * ignoring the rest of the SGL.
784 */
785 uint32_t sgls = le32_to_cpu(n->id_ctrl.sgls);
786 if (sgls & NVME_CTRL_SGLS_EXCESS_LENGTH) {
787 break;
788 }
789
790 trace_pci_nvme_err_invalid_sgl_excess_length(dlen);
791 return NVME_DATA_SGL_LEN_INVALID | NVME_DNR;
792 }
793
794 trans_len = MIN(*len, dlen);
795
796 if (type == NVME_SGL_DESCR_TYPE_BIT_BUCKET) {
797 goto next;
798 }
799
800 addr = le64_to_cpu(segment[i].addr);
801
802 if (UINT64_MAX - addr < dlen) {
803 return NVME_DATA_SGL_LEN_INVALID | NVME_DNR;
804 }
805
806 status = nvme_map_addr(n, sg, addr, trans_len);
807 if (status) {
808 return status;
809 }
810
811 next:
812 *len -= trans_len;
813 }
814
815 return NVME_SUCCESS;
816 }
817
818 static uint16_t nvme_map_sgl(NvmeCtrl *n, NvmeSg *sg, NvmeSglDescriptor sgl,
819 size_t len, NvmeCmd *cmd)
820 {
821 /*
822 * Read the segment in chunks of 256 descriptors (one 4k page) to avoid
823 * dynamically allocating a potentially huge SGL. The spec allows the SGL
824 * to be larger (as in number of bytes required to describe the SGL
825 * descriptors and segment chain) than the command transfer size, so it is
826 * not bounded by MDTS.
827 */
828 const int SEG_CHUNK_SIZE = 256;
829
830 NvmeSglDescriptor segment[SEG_CHUNK_SIZE], *sgld, *last_sgld;
831 uint64_t nsgld;
832 uint32_t seg_len;
833 uint16_t status;
834 hwaddr addr;
835 int ret;
836
837 sgld = &sgl;
838 addr = le64_to_cpu(sgl.addr);
839
840 trace_pci_nvme_map_sgl(NVME_SGL_TYPE(sgl.type), len);
841
842 nvme_sg_init(n, sg, nvme_addr_is_dma(n, addr));
843
844 /*
845 * If the entire transfer can be described with a single data block it can
846 * be mapped directly.
847 */
848 if (NVME_SGL_TYPE(sgl.type) == NVME_SGL_DESCR_TYPE_DATA_BLOCK) {
849 status = nvme_map_sgl_data(n, sg, sgld, 1, &len, cmd);
850 if (status) {
851 goto unmap;
852 }
853
854 goto out;
855 }
856
857 for (;;) {
858 switch (NVME_SGL_TYPE(sgld->type)) {
859 case NVME_SGL_DESCR_TYPE_SEGMENT:
860 case NVME_SGL_DESCR_TYPE_LAST_SEGMENT:
861 break;
862 default:
863 return NVME_INVALID_SGL_SEG_DESCR | NVME_DNR;
864 }
865
866 seg_len = le32_to_cpu(sgld->len);
867
868 /* check the length of the (Last) Segment descriptor */
869 if ((!seg_len || seg_len & 0xf) &&
870 (NVME_SGL_TYPE(sgld->type) != NVME_SGL_DESCR_TYPE_BIT_BUCKET)) {
871 return NVME_INVALID_SGL_SEG_DESCR | NVME_DNR;
872 }
873
874 if (UINT64_MAX - addr < seg_len) {
875 return NVME_DATA_SGL_LEN_INVALID | NVME_DNR;
876 }
877
878 nsgld = seg_len / sizeof(NvmeSglDescriptor);
879
880 while (nsgld > SEG_CHUNK_SIZE) {
881 if (nvme_addr_read(n, addr, segment, sizeof(segment))) {
882 trace_pci_nvme_err_addr_read(addr);
883 status = NVME_DATA_TRAS_ERROR;
884 goto unmap;
885 }
886
887 status = nvme_map_sgl_data(n, sg, segment, SEG_CHUNK_SIZE,
888 &len, cmd);
889 if (status) {
890 goto unmap;
891 }
892
893 nsgld -= SEG_CHUNK_SIZE;
894 addr += SEG_CHUNK_SIZE * sizeof(NvmeSglDescriptor);
895 }
896
897 ret = nvme_addr_read(n, addr, segment, nsgld *
898 sizeof(NvmeSglDescriptor));
899 if (ret) {
900 trace_pci_nvme_err_addr_read(addr);
901 status = NVME_DATA_TRAS_ERROR;
902 goto unmap;
903 }
904
905 last_sgld = &segment[nsgld - 1];
906
907 /*
908 * If the segment ends with a Data Block or Bit Bucket Descriptor Type,
909 * then we are done.
910 */
911 switch (NVME_SGL_TYPE(last_sgld->type)) {
912 case NVME_SGL_DESCR_TYPE_DATA_BLOCK:
913 case NVME_SGL_DESCR_TYPE_BIT_BUCKET:
914 status = nvme_map_sgl_data(n, sg, segment, nsgld, &len, cmd);
915 if (status) {
916 goto unmap;
917 }
918
919 goto out;
920
921 default:
922 break;
923 }
924
925 /*
926 * If the last descriptor was not a Data Block or Bit Bucket, then the
927 * current segment must not be a Last Segment.
928 */
929 if (NVME_SGL_TYPE(sgld->type) == NVME_SGL_DESCR_TYPE_LAST_SEGMENT) {
930 status = NVME_INVALID_SGL_SEG_DESCR | NVME_DNR;
931 goto unmap;
932 }
933
934 sgld = last_sgld;
935 addr = le64_to_cpu(sgld->addr);
936
937 /*
938 * Do not map the last descriptor; it will be a Segment or Last Segment
939 * descriptor and is handled by the next iteration.
940 */
941 status = nvme_map_sgl_data(n, sg, segment, nsgld - 1, &len, cmd);
942 if (status) {
943 goto unmap;
944 }
945 }
946
947 out:
948 /* if there is any residual left in len, the SGL was too short */
949 if (len) {
950 status = NVME_DATA_SGL_LEN_INVALID | NVME_DNR;
951 goto unmap;
952 }
953
954 return NVME_SUCCESS;
955
956 unmap:
957 nvme_sg_unmap(sg);
958 return status;
959 }
960
961 uint16_t nvme_map_dptr(NvmeCtrl *n, NvmeSg *sg, size_t len,
962 NvmeCmd *cmd)
963 {
964 uint64_t prp1, prp2;
965
966 switch (NVME_CMD_FLAGS_PSDT(cmd->flags)) {
967 case NVME_PSDT_PRP:
968 prp1 = le64_to_cpu(cmd->dptr.prp1);
969 prp2 = le64_to_cpu(cmd->dptr.prp2);
970
971 return nvme_map_prp(n, sg, prp1, prp2, len);
972 case NVME_PSDT_SGL_MPTR_CONTIGUOUS:
973 case NVME_PSDT_SGL_MPTR_SGL:
974 return nvme_map_sgl(n, sg, cmd->dptr.sgl, len, cmd);
975 default:
976 return NVME_INVALID_FIELD;
977 }
978 }
979
980 static uint16_t nvme_map_mptr(NvmeCtrl *n, NvmeSg *sg, size_t len,
981 NvmeCmd *cmd)
982 {
983 int psdt = NVME_CMD_FLAGS_PSDT(cmd->flags);
984 hwaddr mptr = le64_to_cpu(cmd->mptr);
985 uint16_t status;
986
987 if (psdt == NVME_PSDT_SGL_MPTR_SGL) {
988 NvmeSglDescriptor sgl;
989
990 if (nvme_addr_read(n, mptr, &sgl, sizeof(sgl))) {
991 return NVME_DATA_TRAS_ERROR;
992 }
993
994 status = nvme_map_sgl(n, sg, sgl, len, cmd);
995 if (status && (status & 0x7ff) == NVME_DATA_SGL_LEN_INVALID) {
996 status = NVME_MD_SGL_LEN_INVALID | NVME_DNR;
997 }
998
999 return status;
1000 }
1001
1002 nvme_sg_init(n, sg, nvme_addr_is_dma(n, mptr));
1003 status = nvme_map_addr(n, sg, mptr, len);
1004 if (status) {
1005 nvme_sg_unmap(sg);
1006 }
1007
1008 return status;
1009 }
1010
1011 static uint16_t nvme_map_data(NvmeCtrl *n, uint32_t nlb, NvmeRequest *req)
1012 {
1013 NvmeNamespace *ns = req->ns;
1014 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd;
1015 bool pi = !!NVME_ID_NS_DPS_TYPE(ns->id_ns.dps);
1016 bool pract = !!(le16_to_cpu(rw->control) & NVME_RW_PRINFO_PRACT);
1017 size_t len = nvme_l2b(ns, nlb);
1018 uint16_t status;
1019
1020 if (nvme_ns_ext(ns) && !(pi && pract && ns->lbaf.ms == 8)) {
1021 NvmeSg sg;
1022
1023 len += nvme_m2b(ns, nlb);
1024
1025 status = nvme_map_dptr(n, &sg, len, &req->cmd);
1026 if (status) {
1027 return status;
1028 }
1029
1030 nvme_sg_init(n, &req->sg, sg.flags & NVME_SG_DMA);
1031 nvme_sg_split(&sg, ns, &req->sg, NULL);
1032 nvme_sg_unmap(&sg);
1033
1034 return NVME_SUCCESS;
1035 }
1036
1037 return nvme_map_dptr(n, &req->sg, len, &req->cmd);
1038 }
1039
1040 static uint16_t nvme_map_mdata(NvmeCtrl *n, uint32_t nlb, NvmeRequest *req)
1041 {
1042 NvmeNamespace *ns = req->ns;
1043 size_t len = nvme_m2b(ns, nlb);
1044 uint16_t status;
1045
1046 if (nvme_ns_ext(ns)) {
1047 NvmeSg sg;
1048
1049 len += nvme_l2b(ns, nlb);
1050
1051 status = nvme_map_dptr(n, &sg, len, &req->cmd);
1052 if (status) {
1053 return status;
1054 }
1055
1056 nvme_sg_init(n, &req->sg, sg.flags & NVME_SG_DMA);
1057 nvme_sg_split(&sg, ns, NULL, &req->sg);
1058 nvme_sg_unmap(&sg);
1059
1060 return NVME_SUCCESS;
1061 }
1062
1063 return nvme_map_mptr(n, &req->sg, len, &req->cmd);
1064 }
1065
1066 static uint16_t nvme_tx_interleaved(NvmeCtrl *n, NvmeSg *sg, uint8_t *ptr,
1067 uint32_t len, uint32_t bytes,
1068 int32_t skip_bytes, int64_t offset,
1069 NvmeTxDirection dir)
1070 {
1071 hwaddr addr;
1072 uint32_t trans_len, count = bytes;
1073 bool dma = sg->flags & NVME_SG_DMA;
1074 int64_t sge_len;
1075 int sg_idx = 0;
1076 int ret;
1077
1078 assert(sg->flags & NVME_SG_ALLOC);
1079
1080 while (len) {
1081 sge_len = dma ? sg->qsg.sg[sg_idx].len : sg->iov.iov[sg_idx].iov_len;
1082
1083 if (sge_len - offset < 0) {
1084 offset -= sge_len;
1085 sg_idx++;
1086 continue;
1087 }
1088
1089 if (sge_len == offset) {
1090 offset = 0;
1091 sg_idx++;
1092 continue;
1093 }
1094
1095 trans_len = MIN(len, count);
1096 trans_len = MIN(trans_len, sge_len - offset);
1097
1098 if (dma) {
1099 addr = sg->qsg.sg[sg_idx].base + offset;
1100 } else {
1101 addr = (hwaddr)(uintptr_t)sg->iov.iov[sg_idx].iov_base + offset;
1102 }
1103
1104 if (dir == NVME_TX_DIRECTION_TO_DEVICE) {
1105 ret = nvme_addr_read(n, addr, ptr, trans_len);
1106 } else {
1107 ret = nvme_addr_write(n, addr, ptr, trans_len);
1108 }
1109
1110 if (ret) {
1111 return NVME_DATA_TRAS_ERROR;
1112 }
1113
1114 ptr += trans_len;
1115 len -= trans_len;
1116 count -= trans_len;
1117 offset += trans_len;
1118
1119 if (count == 0) {
1120 count = bytes;
1121 offset += skip_bytes;
1122 }
1123 }
1124
1125 return NVME_SUCCESS;
1126 }
1127
1128 static uint16_t nvme_tx(NvmeCtrl *n, NvmeSg *sg, uint8_t *ptr, uint32_t len,
1129 NvmeTxDirection dir)
1130 {
1131 assert(sg->flags & NVME_SG_ALLOC);
1132
1133 if (sg->flags & NVME_SG_DMA) {
1134 uint64_t residual;
1135
1136 if (dir == NVME_TX_DIRECTION_TO_DEVICE) {
1137 residual = dma_buf_write(ptr, len, &sg->qsg);
1138 } else {
1139 residual = dma_buf_read(ptr, len, &sg->qsg);
1140 }
1141
1142 if (unlikely(residual)) {
1143 trace_pci_nvme_err_invalid_dma();
1144 return NVME_INVALID_FIELD | NVME_DNR;
1145 }
1146 } else {
1147 size_t bytes;
1148
1149 if (dir == NVME_TX_DIRECTION_TO_DEVICE) {
1150 bytes = qemu_iovec_to_buf(&sg->iov, 0, ptr, len);
1151 } else {
1152 bytes = qemu_iovec_from_buf(&sg->iov, 0, ptr, len);
1153 }
1154
1155 if (unlikely(bytes != len)) {
1156 trace_pci_nvme_err_invalid_dma();
1157 return NVME_INVALID_FIELD | NVME_DNR;
1158 }
1159 }
1160
1161 return NVME_SUCCESS;
1162 }
1163
1164 static inline uint16_t nvme_c2h(NvmeCtrl *n, uint8_t *ptr, uint32_t len,
1165 NvmeRequest *req)
1166 {
1167 uint16_t status;
1168
1169 status = nvme_map_dptr(n, &req->sg, len, &req->cmd);
1170 if (status) {
1171 return status;
1172 }
1173
1174 return nvme_tx(n, &req->sg, ptr, len, NVME_TX_DIRECTION_FROM_DEVICE);
1175 }
1176
1177 static inline uint16_t nvme_h2c(NvmeCtrl *n, uint8_t *ptr, uint32_t len,
1178 NvmeRequest *req)
1179 {
1180 uint16_t status;
1181
1182 status = nvme_map_dptr(n, &req->sg, len, &req->cmd);
1183 if (status) {
1184 return status;
1185 }
1186
1187 return nvme_tx(n, &req->sg, ptr, len, NVME_TX_DIRECTION_TO_DEVICE);
1188 }
1189
1190 uint16_t nvme_bounce_data(NvmeCtrl *n, uint8_t *ptr, uint32_t len,
1191 NvmeTxDirection dir, NvmeRequest *req)
1192 {
1193 NvmeNamespace *ns = req->ns;
1194 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd;
1195 bool pi = !!NVME_ID_NS_DPS_TYPE(ns->id_ns.dps);
1196 bool pract = !!(le16_to_cpu(rw->control) & NVME_RW_PRINFO_PRACT);
1197
1198 if (nvme_ns_ext(ns) && !(pi && pract && ns->lbaf.ms == 8)) {
1199 return nvme_tx_interleaved(n, &req->sg, ptr, len, ns->lbasz,
1200 ns->lbaf.ms, 0, dir);
1201 }
1202
1203 return nvme_tx(n, &req->sg, ptr, len, dir);
1204 }
1205
1206 uint16_t nvme_bounce_mdata(NvmeCtrl *n, uint8_t *ptr, uint32_t len,
1207 NvmeTxDirection dir, NvmeRequest *req)
1208 {
1209 NvmeNamespace *ns = req->ns;
1210 uint16_t status;
1211
1212 if (nvme_ns_ext(ns)) {
1213 return nvme_tx_interleaved(n, &req->sg, ptr, len, ns->lbaf.ms,
1214 ns->lbasz, ns->lbasz, dir);
1215 }
1216
1217 nvme_sg_unmap(&req->sg);
1218
1219 status = nvme_map_mptr(n, &req->sg, len, &req->cmd);
1220 if (status) {
1221 return status;
1222 }
1223
1224 return nvme_tx(n, &req->sg, ptr, len, dir);
1225 }
1226
1227 static inline void nvme_blk_read(BlockBackend *blk, int64_t offset,
1228 BlockCompletionFunc *cb, NvmeRequest *req)
1229 {
1230 assert(req->sg.flags & NVME_SG_ALLOC);
1231
1232 if (req->sg.flags & NVME_SG_DMA) {
1233 req->aiocb = dma_blk_read(blk, &req->sg.qsg, offset, BDRV_SECTOR_SIZE,
1234 cb, req);
1235 } else {
1236 req->aiocb = blk_aio_preadv(blk, offset, &req->sg.iov, 0, cb, req);
1237 }
1238 }
1239
1240 static inline void nvme_blk_write(BlockBackend *blk, int64_t offset,
1241 BlockCompletionFunc *cb, NvmeRequest *req)
1242 {
1243 assert(req->sg.flags & NVME_SG_ALLOC);
1244
1245 if (req->sg.flags & NVME_SG_DMA) {
1246 req->aiocb = dma_blk_write(blk, &req->sg.qsg, offset, BDRV_SECTOR_SIZE,
1247 cb, req);
1248 } else {
1249 req->aiocb = blk_aio_pwritev(blk, offset, &req->sg.iov, 0, cb, req);
1250 }
1251 }
1252
1253 static void nvme_post_cqes(void *opaque)
1254 {
1255 NvmeCQueue *cq = opaque;
1256 NvmeCtrl *n = cq->ctrl;
1257 NvmeRequest *req, *next;
1258 bool pending = cq->head != cq->tail;
1259 int ret;
1260
1261 QTAILQ_FOREACH_SAFE(req, &cq->req_list, entry, next) {
1262 NvmeSQueue *sq;
1263 hwaddr addr;
1264
1265 if (nvme_cq_full(cq)) {
1266 break;
1267 }
1268
1269 sq = req->sq;
1270 req->cqe.status = cpu_to_le16((req->status << 1) | cq->phase);
1271 req->cqe.sq_id = cpu_to_le16(sq->sqid);
1272 req->cqe.sq_head = cpu_to_le16(sq->head);
1273 addr = cq->dma_addr + cq->tail * n->cqe_size;
1274 ret = pci_dma_write(&n->parent_obj, addr, (void *)&req->cqe,
1275 sizeof(req->cqe));
1276 if (ret) {
1277 trace_pci_nvme_err_addr_write(addr);
1278 trace_pci_nvme_err_cfs();
1279 n->bar.csts = NVME_CSTS_FAILED;
1280 break;
1281 }
1282 QTAILQ_REMOVE(&cq->req_list, req, entry);
1283 nvme_inc_cq_tail(cq);
1284 nvme_sg_unmap(&req->sg);
1285 QTAILQ_INSERT_TAIL(&sq->req_list, req, entry);
1286 }
1287 if (cq->tail != cq->head) {
1288 if (cq->irq_enabled && !pending) {
1289 n->cq_pending++;
1290 }
1291
1292 nvme_irq_assert(n, cq);
1293 }
1294 }
1295
1296 static void nvme_enqueue_req_completion(NvmeCQueue *cq, NvmeRequest *req)
1297 {
1298 assert(cq->cqid == req->sq->cqid);
1299 trace_pci_nvme_enqueue_req_completion(nvme_cid(req), cq->cqid,
1300 le32_to_cpu(req->cqe.result),
1301 le32_to_cpu(req->cqe.dw1),
1302 req->status);
1303
1304 if (req->status) {
1305 trace_pci_nvme_err_req_status(nvme_cid(req), nvme_nsid(req->ns),
1306 req->status, req->cmd.opcode);
1307 }
1308
1309 QTAILQ_REMOVE(&req->sq->out_req_list, req, entry);
1310 QTAILQ_INSERT_TAIL(&cq->req_list, req, entry);
1311 timer_mod(cq->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 500);
1312 }
1313
1314 static void nvme_process_aers(void *opaque)
1315 {
1316 NvmeCtrl *n = opaque;
1317 NvmeAsyncEvent *event, *next;
1318
1319 trace_pci_nvme_process_aers(n->aer_queued);
1320
1321 QTAILQ_FOREACH_SAFE(event, &n->aer_queue, entry, next) {
1322 NvmeRequest *req;
1323 NvmeAerResult *result;
1324
1325 /* can't post cqe if there is nothing to complete */
1326 if (!n->outstanding_aers) {
1327 trace_pci_nvme_no_outstanding_aers();
1328 break;
1329 }
1330
1331 /* ignore if masked (cqe posted, but event not cleared) */
1332 if (n->aer_mask & (1 << event->result.event_type)) {
1333 trace_pci_nvme_aer_masked(event->result.event_type, n->aer_mask);
1334 continue;
1335 }
1336
1337 QTAILQ_REMOVE(&n->aer_queue, event, entry);
1338 n->aer_queued--;
1339
1340 n->aer_mask |= 1 << event->result.event_type;
1341 n->outstanding_aers--;
1342
1343 req = n->aer_reqs[n->outstanding_aers];
1344
1345 result = (NvmeAerResult *) &req->cqe.result;
1346 result->event_type = event->result.event_type;
1347 result->event_info = event->result.event_info;
1348 result->log_page = event->result.log_page;
1349 g_free(event);
1350
1351 trace_pci_nvme_aer_post_cqe(result->event_type, result->event_info,
1352 result->log_page);
1353
1354 nvme_enqueue_req_completion(&n->admin_cq, req);
1355 }
1356 }
1357
1358 static void nvme_enqueue_event(NvmeCtrl *n, uint8_t event_type,
1359 uint8_t event_info, uint8_t log_page)
1360 {
1361 NvmeAsyncEvent *event;
1362
1363 trace_pci_nvme_enqueue_event(event_type, event_info, log_page);
1364
1365 if (n->aer_queued == n->params.aer_max_queued) {
1366 trace_pci_nvme_enqueue_event_noqueue(n->aer_queued);
1367 return;
1368 }
1369
1370 event = g_new(NvmeAsyncEvent, 1);
1371 event->result = (NvmeAerResult) {
1372 .event_type = event_type,
1373 .event_info = event_info,
1374 .log_page = log_page,
1375 };
1376
1377 QTAILQ_INSERT_TAIL(&n->aer_queue, event, entry);
1378 n->aer_queued++;
1379
1380 nvme_process_aers(n);
1381 }
1382
1383 static void nvme_smart_event(NvmeCtrl *n, uint8_t event)
1384 {
1385 uint8_t aer_info;
1386
1387 /* Ref SPEC <Asynchronous Event Information 0x2013 SMART / Health Status> */
1388 if (!(NVME_AEC_SMART(n->features.async_config) & event)) {
1389 return;
1390 }
1391
1392 switch (event) {
1393 case NVME_SMART_SPARE:
1394 aer_info = NVME_AER_INFO_SMART_SPARE_THRESH;
1395 break;
1396 case NVME_SMART_TEMPERATURE:
1397 aer_info = NVME_AER_INFO_SMART_TEMP_THRESH;
1398 break;
1399 case NVME_SMART_RELIABILITY:
1400 case NVME_SMART_MEDIA_READ_ONLY:
1401 case NVME_SMART_FAILED_VOLATILE_MEDIA:
1402 case NVME_SMART_PMR_UNRELIABLE:
1403 aer_info = NVME_AER_INFO_SMART_RELIABILITY;
1404 break;
1405 default:
1406 return;
1407 }
1408
1409 nvme_enqueue_event(n, NVME_AER_TYPE_SMART, aer_info, NVME_LOG_SMART_INFO);
1410 }
1411
1412 static void nvme_clear_events(NvmeCtrl *n, uint8_t event_type)
1413 {
1414 n->aer_mask &= ~(1 << event_type);
1415 if (!QTAILQ_EMPTY(&n->aer_queue)) {
1416 nvme_process_aers(n);
1417 }
1418 }
1419
1420 static inline uint16_t nvme_check_mdts(NvmeCtrl *n, size_t len)
1421 {
1422 uint8_t mdts = n->params.mdts;
1423
1424 if (mdts && len > n->page_size << mdts) {
1425 trace_pci_nvme_err_mdts(len);
1426 return NVME_INVALID_FIELD | NVME_DNR;
1427 }
1428
1429 return NVME_SUCCESS;
1430 }
1431
1432 static inline uint16_t nvme_check_bounds(NvmeNamespace *ns, uint64_t slba,
1433 uint32_t nlb)
1434 {
1435 uint64_t nsze = le64_to_cpu(ns->id_ns.nsze);
1436
1437 if (unlikely(UINT64_MAX - slba < nlb || slba + nlb > nsze)) {
1438 trace_pci_nvme_err_invalid_lba_range(slba, nlb, nsze);
1439 return NVME_LBA_RANGE | NVME_DNR;
1440 }
1441
1442 return NVME_SUCCESS;
1443 }
1444
1445 static int nvme_block_status_all(NvmeNamespace *ns, uint64_t slba,
1446 uint32_t nlb, int flags)
1447 {
1448 BlockDriverState *bs = blk_bs(ns->blkconf.blk);
1449
1450 int64_t pnum = 0, bytes = nvme_l2b(ns, nlb);
1451 int64_t offset = nvme_l2b(ns, slba);
1452 int ret;
1453
1454 /*
1455 * `pnum` holds the number of bytes after offset that shares the same
1456 * allocation status as the byte at offset. If `pnum` is different from
1457 * `bytes`, we should check the allocation status of the next range and
1458 * continue this until all bytes have been checked.
1459 */
1460 do {
1461 bytes -= pnum;
1462
1463 ret = bdrv_block_status(bs, offset, bytes, &pnum, NULL, NULL);
1464 if (ret < 0) {
1465 return ret;
1466 }
1467
1468
1469 trace_pci_nvme_block_status(offset, bytes, pnum, ret,
1470 !!(ret & BDRV_BLOCK_ZERO));
1471
1472 if (!(ret & flags)) {
1473 return 1;
1474 }
1475
1476 offset += pnum;
1477 } while (pnum != bytes);
1478
1479 return 0;
1480 }
1481
1482 static uint16_t nvme_check_dulbe(NvmeNamespace *ns, uint64_t slba,
1483 uint32_t nlb)
1484 {
1485 int ret;
1486 Error *err = NULL;
1487
1488 ret = nvme_block_status_all(ns, slba, nlb, BDRV_BLOCK_DATA);
1489 if (ret) {
1490 if (ret < 0) {
1491 error_setg_errno(&err, -ret, "unable to get block status");
1492 error_report_err(err);
1493
1494 return NVME_INTERNAL_DEV_ERROR;
1495 }
1496
1497 return NVME_DULB;
1498 }
1499
1500 return NVME_SUCCESS;
1501 }
1502
1503 static void nvme_aio_err(NvmeRequest *req, int ret)
1504 {
1505 uint16_t status = NVME_SUCCESS;
1506 Error *local_err = NULL;
1507
1508 switch (req->cmd.opcode) {
1509 case NVME_CMD_READ:
1510 status = NVME_UNRECOVERED_READ;
1511 break;
1512 case NVME_CMD_FLUSH:
1513 case NVME_CMD_WRITE:
1514 case NVME_CMD_WRITE_ZEROES:
1515 case NVME_CMD_ZONE_APPEND:
1516 status = NVME_WRITE_FAULT;
1517 break;
1518 default:
1519 status = NVME_INTERNAL_DEV_ERROR;
1520 break;
1521 }
1522
1523 trace_pci_nvme_err_aio(nvme_cid(req), strerror(-ret), status);
1524
1525 error_setg_errno(&local_err, -ret, "aio failed");
1526 error_report_err(local_err);
1527
1528 /*
1529 * Set the command status code to the first encountered error but allow a
1530 * subsequent Internal Device Error to trump it.
1531 */
1532 if (req->status && status != NVME_INTERNAL_DEV_ERROR) {
1533 return;
1534 }
1535
1536 req->status = status;
1537 }
1538
1539 static inline uint32_t nvme_zone_idx(NvmeNamespace *ns, uint64_t slba)
1540 {
1541 return ns->zone_size_log2 > 0 ? slba >> ns->zone_size_log2 :
1542 slba / ns->zone_size;
1543 }
1544
1545 static inline NvmeZone *nvme_get_zone_by_slba(NvmeNamespace *ns, uint64_t slba)
1546 {
1547 uint32_t zone_idx = nvme_zone_idx(ns, slba);
1548
1549 if (zone_idx >= ns->num_zones) {
1550 return NULL;
1551 }
1552
1553 return &ns->zone_array[zone_idx];
1554 }
1555
1556 static uint16_t nvme_check_zone_state_for_write(NvmeZone *zone)
1557 {
1558 uint64_t zslba = zone->d.zslba;
1559
1560 switch (nvme_get_zone_state(zone)) {
1561 case NVME_ZONE_STATE_EMPTY:
1562 case NVME_ZONE_STATE_IMPLICITLY_OPEN:
1563 case NVME_ZONE_STATE_EXPLICITLY_OPEN:
1564 case NVME_ZONE_STATE_CLOSED:
1565 return NVME_SUCCESS;
1566 case NVME_ZONE_STATE_FULL:
1567 trace_pci_nvme_err_zone_is_full(zslba);
1568 return NVME_ZONE_FULL;
1569 case NVME_ZONE_STATE_OFFLINE:
1570 trace_pci_nvme_err_zone_is_offline(zslba);
1571 return NVME_ZONE_OFFLINE;
1572 case NVME_ZONE_STATE_READ_ONLY:
1573 trace_pci_nvme_err_zone_is_read_only(zslba);
1574 return NVME_ZONE_READ_ONLY;
1575 default:
1576 assert(false);
1577 }
1578
1579 return NVME_INTERNAL_DEV_ERROR;
1580 }
1581
1582 static uint16_t nvme_check_zone_write(NvmeNamespace *ns, NvmeZone *zone,
1583 uint64_t slba, uint32_t nlb)
1584 {
1585 uint64_t zcap = nvme_zone_wr_boundary(zone);
1586 uint16_t status;
1587
1588 status = nvme_check_zone_state_for_write(zone);
1589 if (status) {
1590 return status;
1591 }
1592
1593 if (unlikely(slba != zone->w_ptr)) {
1594 trace_pci_nvme_err_write_not_at_wp(slba, zone->d.zslba, zone->w_ptr);
1595 return NVME_ZONE_INVALID_WRITE;
1596 }
1597
1598 if (unlikely((slba + nlb) > zcap)) {
1599 trace_pci_nvme_err_zone_boundary(slba, nlb, zcap);
1600 return NVME_ZONE_BOUNDARY_ERROR;
1601 }
1602
1603 return NVME_SUCCESS;
1604 }
1605
1606 static uint16_t nvme_check_zone_state_for_read(NvmeZone *zone)
1607 {
1608 switch (nvme_get_zone_state(zone)) {
1609 case NVME_ZONE_STATE_EMPTY:
1610 case NVME_ZONE_STATE_IMPLICITLY_OPEN:
1611 case NVME_ZONE_STATE_EXPLICITLY_OPEN:
1612 case NVME_ZONE_STATE_FULL:
1613 case NVME_ZONE_STATE_CLOSED:
1614 case NVME_ZONE_STATE_READ_ONLY:
1615 return NVME_SUCCESS;
1616 case NVME_ZONE_STATE_OFFLINE:
1617 trace_pci_nvme_err_zone_is_offline(zone->d.zslba);
1618 return NVME_ZONE_OFFLINE;
1619 default:
1620 assert(false);
1621 }
1622
1623 return NVME_INTERNAL_DEV_ERROR;
1624 }
1625
1626 static uint16_t nvme_check_zone_read(NvmeNamespace *ns, uint64_t slba,
1627 uint32_t nlb)
1628 {
1629 NvmeZone *zone;
1630 uint64_t bndry, end;
1631 uint16_t status;
1632
1633 zone = nvme_get_zone_by_slba(ns, slba);
1634 assert(zone);
1635
1636 bndry = nvme_zone_rd_boundary(ns, zone);
1637 end = slba + nlb;
1638
1639 status = nvme_check_zone_state_for_read(zone);
1640 if (status) {
1641 ;
1642 } else if (unlikely(end > bndry)) {
1643 if (!ns->params.cross_zone_read) {
1644 status = NVME_ZONE_BOUNDARY_ERROR;
1645 } else {
1646 /*
1647 * Read across zone boundary - check that all subsequent
1648 * zones that are being read have an appropriate state.
1649 */
1650 do {
1651 zone++;
1652 status = nvme_check_zone_state_for_read(zone);
1653 if (status) {
1654 break;
1655 }
1656 } while (end > nvme_zone_rd_boundary(ns, zone));
1657 }
1658 }
1659
1660 return status;
1661 }
1662
1663 static uint16_t nvme_zrm_finish(NvmeNamespace *ns, NvmeZone *zone)
1664 {
1665 switch (nvme_get_zone_state(zone)) {
1666 case NVME_ZONE_STATE_FULL:
1667 return NVME_SUCCESS;
1668
1669 case NVME_ZONE_STATE_IMPLICITLY_OPEN:
1670 case NVME_ZONE_STATE_EXPLICITLY_OPEN:
1671 nvme_aor_dec_open(ns);
1672 /* fallthrough */
1673 case NVME_ZONE_STATE_CLOSED:
1674 nvme_aor_dec_active(ns);
1675 /* fallthrough */
1676 case NVME_ZONE_STATE_EMPTY:
1677 nvme_assign_zone_state(ns, zone, NVME_ZONE_STATE_FULL);
1678 return NVME_SUCCESS;
1679
1680 default:
1681 return NVME_ZONE_INVAL_TRANSITION;
1682 }
1683 }
1684
1685 static uint16_t nvme_zrm_close(NvmeNamespace *ns, NvmeZone *zone)
1686 {
1687 switch (nvme_get_zone_state(zone)) {
1688 case NVME_ZONE_STATE_EXPLICITLY_OPEN:
1689 case NVME_ZONE_STATE_IMPLICITLY_OPEN:
1690 nvme_aor_dec_open(ns);
1691 nvme_assign_zone_state(ns, zone, NVME_ZONE_STATE_CLOSED);
1692 /* fall through */
1693 case NVME_ZONE_STATE_CLOSED:
1694 return NVME_SUCCESS;
1695
1696 default:
1697 return NVME_ZONE_INVAL_TRANSITION;
1698 }
1699 }
1700
1701 static uint16_t nvme_zrm_reset(NvmeNamespace *ns, NvmeZone *zone)
1702 {
1703 switch (nvme_get_zone_state(zone)) {
1704 case NVME_ZONE_STATE_EXPLICITLY_OPEN:
1705 case NVME_ZONE_STATE_IMPLICITLY_OPEN:
1706 nvme_aor_dec_open(ns);
1707 /* fallthrough */
1708 case NVME_ZONE_STATE_CLOSED:
1709 nvme_aor_dec_active(ns);
1710 /* fallthrough */
1711 case NVME_ZONE_STATE_FULL:
1712 zone->w_ptr = zone->d.zslba;
1713 zone->d.wp = zone->w_ptr;
1714 nvme_assign_zone_state(ns, zone, NVME_ZONE_STATE_EMPTY);
1715 /* fallthrough */
1716 case NVME_ZONE_STATE_EMPTY:
1717 return NVME_SUCCESS;
1718
1719 default:
1720 return NVME_ZONE_INVAL_TRANSITION;
1721 }
1722 }
1723
1724 static void nvme_zrm_auto_transition_zone(NvmeNamespace *ns)
1725 {
1726 NvmeZone *zone;
1727
1728 if (ns->params.max_open_zones &&
1729 ns->nr_open_zones == ns->params.max_open_zones) {
1730 zone = QTAILQ_FIRST(&ns->imp_open_zones);
1731 if (zone) {
1732 /*
1733 * Automatically close this implicitly open zone.
1734 */
1735 QTAILQ_REMOVE(&ns->imp_open_zones, zone, entry);
1736 nvme_zrm_close(ns, zone);
1737 }
1738 }
1739 }
1740
1741 enum {
1742 NVME_ZRM_AUTO = 1 << 0,
1743 };
1744
1745 static uint16_t nvme_zrm_open_flags(NvmeCtrl *n, NvmeNamespace *ns,
1746 NvmeZone *zone, int flags)
1747 {
1748 int act = 0;
1749 uint16_t status;
1750
1751 switch (nvme_get_zone_state(zone)) {
1752 case NVME_ZONE_STATE_EMPTY:
1753 act = 1;
1754
1755 /* fallthrough */
1756
1757 case NVME_ZONE_STATE_CLOSED:
1758 if (n->params.auto_transition_zones) {
1759 nvme_zrm_auto_transition_zone(ns);
1760 }
1761 status = nvme_aor_check(ns, act, 1);
1762 if (status) {
1763 return status;
1764 }
1765
1766 if (act) {
1767 nvme_aor_inc_active(ns);
1768 }
1769
1770 nvme_aor_inc_open(ns);
1771
1772 if (flags & NVME_ZRM_AUTO) {
1773 nvme_assign_zone_state(ns, zone, NVME_ZONE_STATE_IMPLICITLY_OPEN);
1774 return NVME_SUCCESS;
1775 }
1776
1777 /* fallthrough */
1778
1779 case NVME_ZONE_STATE_IMPLICITLY_OPEN:
1780 if (flags & NVME_ZRM_AUTO) {
1781 return NVME_SUCCESS;
1782 }
1783
1784 nvme_assign_zone_state(ns, zone, NVME_ZONE_STATE_EXPLICITLY_OPEN);
1785
1786 /* fallthrough */
1787
1788 case NVME_ZONE_STATE_EXPLICITLY_OPEN:
1789 return NVME_SUCCESS;
1790
1791 default:
1792 return NVME_ZONE_INVAL_TRANSITION;
1793 }
1794 }
1795
1796 static inline uint16_t nvme_zrm_auto(NvmeCtrl *n, NvmeNamespace *ns,
1797 NvmeZone *zone)
1798 {
1799 return nvme_zrm_open_flags(n, ns, zone, NVME_ZRM_AUTO);
1800 }
1801
1802 static inline uint16_t nvme_zrm_open(NvmeCtrl *n, NvmeNamespace *ns,
1803 NvmeZone *zone)
1804 {
1805 return nvme_zrm_open_flags(n, ns, zone, 0);
1806 }
1807
1808 static void nvme_advance_zone_wp(NvmeNamespace *ns, NvmeZone *zone,
1809 uint32_t nlb)
1810 {
1811 zone->d.wp += nlb;
1812
1813 if (zone->d.wp == nvme_zone_wr_boundary(zone)) {
1814 nvme_zrm_finish(ns, zone);
1815 }
1816 }
1817
1818 static void nvme_finalize_zoned_write(NvmeNamespace *ns, NvmeRequest *req)
1819 {
1820 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd;
1821 NvmeZone *zone;
1822 uint64_t slba;
1823 uint32_t nlb;
1824
1825 slba = le64_to_cpu(rw->slba);
1826 nlb = le16_to_cpu(rw->nlb) + 1;
1827 zone = nvme_get_zone_by_slba(ns, slba);
1828 assert(zone);
1829
1830 nvme_advance_zone_wp(ns, zone, nlb);
1831 }
1832
1833 static inline bool nvme_is_write(NvmeRequest *req)
1834 {
1835 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd;
1836
1837 return rw->opcode == NVME_CMD_WRITE ||
1838 rw->opcode == NVME_CMD_ZONE_APPEND ||
1839 rw->opcode == NVME_CMD_WRITE_ZEROES;
1840 }
1841
1842 static AioContext *nvme_get_aio_context(BlockAIOCB *acb)
1843 {
1844 return qemu_get_aio_context();
1845 }
1846
1847 static void nvme_misc_cb(void *opaque, int ret)
1848 {
1849 NvmeRequest *req = opaque;
1850
1851 trace_pci_nvme_misc_cb(nvme_cid(req));
1852
1853 if (ret) {
1854 nvme_aio_err(req, ret);
1855 }
1856
1857 nvme_enqueue_req_completion(nvme_cq(req), req);
1858 }
1859
1860 void nvme_rw_complete_cb(void *opaque, int ret)
1861 {
1862 NvmeRequest *req = opaque;
1863 NvmeNamespace *ns = req->ns;
1864 BlockBackend *blk = ns->blkconf.blk;
1865 BlockAcctCookie *acct = &req->acct;
1866 BlockAcctStats *stats = blk_get_stats(blk);
1867
1868 trace_pci_nvme_rw_complete_cb(nvme_cid(req), blk_name(blk));
1869
1870 if (ret) {
1871 block_acct_failed(stats, acct);
1872 nvme_aio_err(req, ret);
1873 } else {
1874 block_acct_done(stats, acct);
1875 }
1876
1877 if (ns->params.zoned && nvme_is_write(req)) {
1878 nvme_finalize_zoned_write(ns, req);
1879 }
1880
1881 nvme_enqueue_req_completion(nvme_cq(req), req);
1882 }
1883
1884 static void nvme_rw_cb(void *opaque, int ret)
1885 {
1886 NvmeRequest *req = opaque;
1887 NvmeNamespace *ns = req->ns;
1888
1889 BlockBackend *blk = ns->blkconf.blk;
1890
1891 trace_pci_nvme_rw_cb(nvme_cid(req), blk_name(blk));
1892
1893 if (ret) {
1894 goto out;
1895 }
1896
1897 if (ns->lbaf.ms) {
1898 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd;
1899 uint64_t slba = le64_to_cpu(rw->slba);
1900 uint32_t nlb = (uint32_t)le16_to_cpu(rw->nlb) + 1;
1901 uint64_t offset = nvme_moff(ns, slba);
1902
1903 if (req->cmd.opcode == NVME_CMD_WRITE_ZEROES) {
1904 size_t mlen = nvme_m2b(ns, nlb);
1905
1906 req->aiocb = blk_aio_pwrite_zeroes(blk, offset, mlen,
1907 BDRV_REQ_MAY_UNMAP,
1908 nvme_rw_complete_cb, req);
1909 return;
1910 }
1911
1912 if (nvme_ns_ext(ns) || req->cmd.mptr) {
1913 uint16_t status;
1914
1915 nvme_sg_unmap(&req->sg);
1916 status = nvme_map_mdata(nvme_ctrl(req), nlb, req);
1917 if (status) {
1918 ret = -EFAULT;
1919 goto out;
1920 }
1921
1922 if (req->cmd.opcode == NVME_CMD_READ) {
1923 return nvme_blk_read(blk, offset, nvme_rw_complete_cb, req);
1924 }
1925
1926 return nvme_blk_write(blk, offset, nvme_rw_complete_cb, req);
1927 }
1928 }
1929
1930 out:
1931 nvme_rw_complete_cb(req, ret);
1932 }
1933
1934 static void nvme_verify_cb(void *opaque, int ret)
1935 {
1936 NvmeBounceContext *ctx = opaque;
1937 NvmeRequest *req = ctx->req;
1938 NvmeNamespace *ns = req->ns;
1939 BlockBackend *blk = ns->blkconf.blk;
1940 BlockAcctCookie *acct = &req->acct;
1941 BlockAcctStats *stats = blk_get_stats(blk);
1942 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd;
1943 uint64_t slba = le64_to_cpu(rw->slba);
1944 uint8_t prinfo = NVME_RW_PRINFO(le16_to_cpu(rw->control));
1945 uint16_t apptag = le16_to_cpu(rw->apptag);
1946 uint16_t appmask = le16_to_cpu(rw->appmask);
1947 uint32_t reftag = le32_to_cpu(rw->reftag);
1948 uint16_t status;
1949
1950 trace_pci_nvme_verify_cb(nvme_cid(req), prinfo, apptag, appmask, reftag);
1951
1952 if (ret) {
1953 block_acct_failed(stats, acct);
1954 nvme_aio_err(req, ret);
1955 goto out;
1956 }
1957
1958 block_acct_done(stats, acct);
1959
1960 if (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps)) {
1961 status = nvme_dif_mangle_mdata(ns, ctx->mdata.bounce,
1962 ctx->mdata.iov.size, slba);
1963 if (status) {
1964 req->status = status;
1965 goto out;
1966 }
1967
1968 req->status = nvme_dif_check(ns, ctx->data.bounce, ctx->data.iov.size,
1969 ctx->mdata.bounce, ctx->mdata.iov.size,
1970 prinfo, slba, apptag, appmask, &reftag);
1971 }
1972
1973 out:
1974 qemu_iovec_destroy(&ctx->data.iov);
1975 g_free(ctx->data.bounce);
1976
1977 qemu_iovec_destroy(&ctx->mdata.iov);
1978 g_free(ctx->mdata.bounce);
1979
1980 g_free(ctx);
1981
1982 nvme_enqueue_req_completion(nvme_cq(req), req);
1983 }
1984
1985
1986 static void nvme_verify_mdata_in_cb(void *opaque, int ret)
1987 {
1988 NvmeBounceContext *ctx = opaque;
1989 NvmeRequest *req = ctx->req;
1990 NvmeNamespace *ns = req->ns;
1991 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd;
1992 uint64_t slba = le64_to_cpu(rw->slba);
1993 uint32_t nlb = le16_to_cpu(rw->nlb) + 1;
1994 size_t mlen = nvme_m2b(ns, nlb);
1995 uint64_t offset = nvme_moff(ns, slba);
1996 BlockBackend *blk = ns->blkconf.blk;
1997
1998 trace_pci_nvme_verify_mdata_in_cb(nvme_cid(req), blk_name(blk));
1999
2000 if (ret) {
2001 goto out;
2002 }
2003
2004 ctx->mdata.bounce = g_malloc(mlen);
2005
2006 qemu_iovec_reset(&ctx->mdata.iov);
2007 qemu_iovec_add(&ctx->mdata.iov, ctx->mdata.bounce, mlen);
2008
2009 req->aiocb = blk_aio_preadv(blk, offset, &ctx->mdata.iov, 0,
2010 nvme_verify_cb, ctx);
2011 return;
2012
2013 out:
2014 nvme_verify_cb(ctx, ret);
2015 }
2016
2017 struct nvme_compare_ctx {
2018 struct {
2019 QEMUIOVector iov;
2020 uint8_t *bounce;
2021 } data;
2022
2023 struct {
2024 QEMUIOVector iov;
2025 uint8_t *bounce;
2026 } mdata;
2027 };
2028
2029 static void nvme_compare_mdata_cb(void *opaque, int ret)
2030 {
2031 NvmeRequest *req = opaque;
2032 NvmeNamespace *ns = req->ns;
2033 NvmeCtrl *n = nvme_ctrl(req);
2034 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd;
2035 uint8_t prinfo = NVME_RW_PRINFO(le16_to_cpu(rw->control));
2036 uint16_t apptag = le16_to_cpu(rw->apptag);
2037 uint16_t appmask = le16_to_cpu(rw->appmask);
2038 uint32_t reftag = le32_to_cpu(rw->reftag);
2039 struct nvme_compare_ctx *ctx = req->opaque;
2040 g_autofree uint8_t *buf = NULL;
2041 BlockBackend *blk = ns->blkconf.blk;
2042 BlockAcctCookie *acct = &req->acct;
2043 BlockAcctStats *stats = blk_get_stats(blk);
2044 uint16_t status = NVME_SUCCESS;
2045
2046 trace_pci_nvme_compare_mdata_cb(nvme_cid(req));
2047
2048 if (ret) {
2049 block_acct_failed(stats, acct);
2050 nvme_aio_err(req, ret);
2051 goto out;
2052 }
2053
2054 buf = g_malloc(ctx->mdata.iov.size);
2055
2056 status = nvme_bounce_mdata(n, buf, ctx->mdata.iov.size,
2057 NVME_TX_DIRECTION_TO_DEVICE, req);
2058 if (status) {
2059 req->status = status;
2060 goto out;
2061 }
2062
2063 if (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps)) {
2064 uint64_t slba = le64_to_cpu(rw->slba);
2065 uint8_t *bufp;
2066 uint8_t *mbufp = ctx->mdata.bounce;
2067 uint8_t *end = mbufp + ctx->mdata.iov.size;
2068 int16_t pil = 0;
2069
2070 status = nvme_dif_check(ns, ctx->data.bounce, ctx->data.iov.size,
2071 ctx->mdata.bounce, ctx->mdata.iov.size, prinfo,
2072 slba, apptag, appmask, &reftag);
2073 if (status) {
2074 req->status = status;
2075 goto out;
2076 }
2077
2078 /*
2079 * When formatted with protection information, do not compare the DIF
2080 * tuple.
2081 */
2082 if (!(ns->id_ns.dps & NVME_ID_NS_DPS_FIRST_EIGHT)) {
2083 pil = ns->lbaf.ms - sizeof(NvmeDifTuple);
2084 }
2085
2086 for (bufp = buf; mbufp < end; bufp += ns->lbaf.ms, mbufp += ns->lbaf.ms) {
2087 if (memcmp(bufp + pil, mbufp + pil, ns->lbaf.ms - pil)) {
2088 req->status = NVME_CMP_FAILURE;
2089 goto out;
2090 }
2091 }
2092
2093 goto out;
2094 }
2095
2096 if (memcmp(buf, ctx->mdata.bounce, ctx->mdata.iov.size)) {
2097 req->status = NVME_CMP_FAILURE;
2098 goto out;
2099 }
2100
2101 block_acct_done(stats, acct);
2102
2103 out:
2104 qemu_iovec_destroy(&ctx->data.iov);
2105 g_free(ctx->data.bounce);
2106
2107 qemu_iovec_destroy(&ctx->mdata.iov);
2108 g_free(ctx->mdata.bounce);
2109
2110 g_free(ctx);
2111
2112 nvme_enqueue_req_completion(nvme_cq(req), req);
2113 }
2114
2115 static void nvme_compare_data_cb(void *opaque, int ret)
2116 {
2117 NvmeRequest *req = opaque;
2118 NvmeCtrl *n = nvme_ctrl(req);
2119 NvmeNamespace *ns = req->ns;
2120 BlockBackend *blk = ns->blkconf.blk;
2121 BlockAcctCookie *acct = &req->acct;
2122 BlockAcctStats *stats = blk_get_stats(blk);
2123
2124 struct nvme_compare_ctx *ctx = req->opaque;
2125 g_autofree uint8_t *buf = NULL;
2126 uint16_t status;
2127
2128 trace_pci_nvme_compare_data_cb(nvme_cid(req));
2129
2130 if (ret) {
2131 block_acct_failed(stats, acct);
2132 nvme_aio_err(req, ret);
2133 goto out;
2134 }
2135
2136 buf = g_malloc(ctx->data.iov.size);
2137
2138 status = nvme_bounce_data(n, buf, ctx->data.iov.size,
2139 NVME_TX_DIRECTION_TO_DEVICE, req);
2140 if (status) {
2141 req->status = status;
2142 goto out;
2143 }
2144
2145 if (memcmp(buf, ctx->data.bounce, ctx->data.iov.size)) {
2146 req->status = NVME_CMP_FAILURE;
2147 goto out;
2148 }
2149
2150 if (ns->lbaf.ms) {
2151 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd;
2152 uint64_t slba = le64_to_cpu(rw->slba);
2153 uint32_t nlb = le16_to_cpu(rw->nlb) + 1;
2154 size_t mlen = nvme_m2b(ns, nlb);
2155 uint64_t offset = nvme_moff(ns, slba);
2156
2157 ctx->mdata.bounce = g_malloc(mlen);
2158
2159 qemu_iovec_init(&ctx->mdata.iov, 1);
2160 qemu_iovec_add(&ctx->mdata.iov, ctx->mdata.bounce, mlen);
2161
2162 req->aiocb = blk_aio_preadv(blk, offset, &ctx->mdata.iov, 0,
2163 nvme_compare_mdata_cb, req);
2164 return;
2165 }
2166
2167 block_acct_done(stats, acct);
2168
2169 out:
2170 qemu_iovec_destroy(&ctx->data.iov);
2171 g_free(ctx->data.bounce);
2172 g_free(ctx);
2173
2174 nvme_enqueue_req_completion(nvme_cq(req), req);
2175 }
2176
2177 typedef struct NvmeDSMAIOCB {
2178 BlockAIOCB common;
2179 BlockAIOCB *aiocb;
2180 NvmeRequest *req;
2181 QEMUBH *bh;
2182 int ret;
2183
2184 NvmeDsmRange *range;
2185 unsigned int nr;
2186 unsigned int idx;
2187 } NvmeDSMAIOCB;
2188
2189 static void nvme_dsm_cancel(BlockAIOCB *aiocb)
2190 {
2191 NvmeDSMAIOCB *iocb = container_of(aiocb, NvmeDSMAIOCB, common);
2192
2193 /* break nvme_dsm_cb loop */
2194 iocb->idx = iocb->nr;
2195 iocb->ret = -ECANCELED;
2196
2197 if (iocb->aiocb) {
2198 blk_aio_cancel_async(iocb->aiocb);
2199 iocb->aiocb = NULL;
2200 } else {
2201 /*
2202 * We only reach this if nvme_dsm_cancel() has already been called or
2203 * the command ran to completion and nvme_dsm_bh is scheduled to run.
2204 */
2205 assert(iocb->idx == iocb->nr);
2206 }
2207 }
2208
2209 static const AIOCBInfo nvme_dsm_aiocb_info = {
2210 .aiocb_size = sizeof(NvmeDSMAIOCB),
2211 .cancel_async = nvme_dsm_cancel,
2212 };
2213
2214 static void nvme_dsm_bh(void *opaque)
2215 {
2216 NvmeDSMAIOCB *iocb = opaque;
2217
2218 iocb->common.cb(iocb->common.opaque, iocb->ret);
2219
2220 qemu_bh_delete(iocb->bh);
2221 iocb->bh = NULL;
2222 qemu_aio_unref(iocb);
2223 }
2224
2225 static void nvme_dsm_cb(void *opaque, int ret);
2226
2227 static void nvme_dsm_md_cb(void *opaque, int ret)
2228 {
2229 NvmeDSMAIOCB *iocb = opaque;
2230 NvmeRequest *req = iocb->req;
2231 NvmeNamespace *ns = req->ns;
2232 NvmeDsmRange *range;
2233 uint64_t slba;
2234 uint32_t nlb;
2235
2236 if (ret < 0) {
2237 iocb->ret = ret;
2238 goto done;
2239 }
2240
2241 if (!ns->lbaf.ms) {
2242 nvme_dsm_cb(iocb, 0);
2243 return;
2244 }
2245
2246 range = &iocb->range[iocb->idx - 1];
2247 slba = le64_to_cpu(range->slba);
2248 nlb = le32_to_cpu(range->nlb);
2249
2250 /*
2251 * Check that all block were discarded (zeroed); otherwise we do not zero
2252 * the metadata.
2253 */
2254
2255 ret = nvme_block_status_all(ns, slba, nlb, BDRV_BLOCK_ZERO);
2256 if (ret) {
2257 if (ret < 0) {
2258 iocb->ret = ret;
2259 goto done;
2260 }
2261
2262 nvme_dsm_cb(iocb, 0);
2263 }
2264
2265 iocb->aiocb = blk_aio_pwrite_zeroes(ns->blkconf.blk, nvme_moff(ns, slba),
2266 nvme_m2b(ns, nlb), BDRV_REQ_MAY_UNMAP,
2267 nvme_dsm_cb, iocb);
2268 return;
2269
2270 done:
2271 iocb->aiocb = NULL;
2272 qemu_bh_schedule(iocb->bh);
2273 }
2274
2275 static void nvme_dsm_cb(void *opaque, int ret)
2276 {
2277 NvmeDSMAIOCB *iocb = opaque;
2278 NvmeRequest *req = iocb->req;
2279 NvmeCtrl *n = nvme_ctrl(req);
2280 NvmeNamespace *ns = req->ns;
2281 NvmeDsmRange *range;
2282 uint64_t slba;
2283 uint32_t nlb;
2284
2285 if (ret < 0) {
2286 iocb->ret = ret;
2287 goto done;
2288 }
2289
2290 next:
2291 if (iocb->idx == iocb->nr) {
2292 goto done;
2293 }
2294
2295 range = &iocb->range[iocb->idx++];
2296 slba = le64_to_cpu(range->slba);
2297 nlb = le32_to_cpu(range->nlb);
2298
2299 trace_pci_nvme_dsm_deallocate(slba, nlb);
2300
2301 if (nlb > n->dmrsl) {
2302 trace_pci_nvme_dsm_single_range_limit_exceeded(nlb, n->dmrsl);
2303 goto next;
2304 }
2305
2306 if (nvme_check_bounds(ns, slba, nlb)) {
2307 trace_pci_nvme_err_invalid_lba_range(slba, nlb,
2308 ns->id_ns.nsze);
2309 goto next;
2310 }
2311
2312 iocb->aiocb = blk_aio_pdiscard(ns->blkconf.blk, nvme_l2b(ns, slba),
2313 nvme_l2b(ns, nlb),
2314 nvme_dsm_md_cb, iocb);
2315 return;
2316
2317 done:
2318 iocb->aiocb = NULL;
2319 qemu_bh_schedule(iocb->bh);
2320 }
2321
2322 static uint16_t nvme_dsm(NvmeCtrl *n, NvmeRequest *req)
2323 {
2324 NvmeNamespace *ns = req->ns;
2325 NvmeDsmCmd *dsm = (NvmeDsmCmd *) &req->cmd;
2326 uint32_t attr = le32_to_cpu(dsm->attributes);
2327 uint32_t nr = (le32_to_cpu(dsm->nr) & 0xff) + 1;
2328 uint16_t status = NVME_SUCCESS;
2329
2330 trace_pci_nvme_dsm(nr, attr);
2331
2332 if (attr & NVME_DSMGMT_AD) {
2333 NvmeDSMAIOCB *iocb = blk_aio_get(&nvme_dsm_aiocb_info, ns->blkconf.blk,
2334 nvme_misc_cb, req);
2335
2336 iocb->req = req;
2337 iocb->bh = qemu_bh_new(nvme_dsm_bh, iocb);
2338 iocb->ret = 0;
2339 iocb->range = g_new(NvmeDsmRange, nr);
2340 iocb->nr = nr;
2341 iocb->idx = 0;
2342
2343 status = nvme_h2c(n, (uint8_t *)iocb->range, sizeof(NvmeDsmRange) * nr,
2344 req);
2345 if (status) {
2346 return status;
2347 }
2348
2349 req->aiocb = &iocb->common;
2350 nvme_dsm_cb(iocb, 0);
2351
2352 return NVME_NO_COMPLETE;
2353 }
2354
2355 return status;
2356 }
2357
2358 static uint16_t nvme_verify(NvmeCtrl *n, NvmeRequest *req)
2359 {
2360 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd;
2361 NvmeNamespace *ns = req->ns;
2362 BlockBackend *blk = ns->blkconf.blk;
2363 uint64_t slba = le64_to_cpu(rw->slba);
2364 uint32_t nlb = le16_to_cpu(rw->nlb) + 1;
2365 size_t len = nvme_l2b(ns, nlb);
2366 int64_t offset = nvme_l2b(ns, slba);
2367 uint8_t prinfo = NVME_RW_PRINFO(le16_to_cpu(rw->control));
2368 uint32_t reftag = le32_to_cpu(rw->reftag);
2369 NvmeBounceContext *ctx = NULL;
2370 uint16_t status;
2371
2372 trace_pci_nvme_verify(nvme_cid(req), nvme_nsid(ns), slba, nlb);
2373
2374 if (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps)) {
2375 status = nvme_check_prinfo(ns, prinfo, slba, reftag);
2376 if (status) {
2377 return status;
2378 }
2379
2380 if (prinfo & NVME_PRINFO_PRACT) {
2381 return NVME_INVALID_PROT_INFO | NVME_DNR;
2382 }
2383 }
2384
2385 if (len > n->page_size << n->params.vsl) {
2386 return NVME_INVALID_FIELD | NVME_DNR;
2387 }
2388
2389 status = nvme_check_bounds(ns, slba, nlb);
2390 if (status) {
2391 return status;
2392 }
2393
2394 if (NVME_ERR_REC_DULBE(ns->features.err_rec)) {
2395 status = nvme_check_dulbe(ns, slba, nlb);
2396 if (status) {
2397 return status;
2398 }
2399 }
2400
2401 ctx = g_new0(NvmeBounceContext, 1);
2402 ctx->req = req;
2403
2404 ctx->data.bounce = g_malloc(len);
2405
2406 qemu_iovec_init(&ctx->data.iov, 1);
2407 qemu_iovec_add(&ctx->data.iov, ctx->data.bounce, len);
2408
2409 block_acct_start(blk_get_stats(blk), &req->acct, ctx->data.iov.size,
2410 BLOCK_ACCT_READ);
2411
2412 req->aiocb = blk_aio_preadv(ns->blkconf.blk, offset, &ctx->data.iov, 0,
2413 nvme_verify_mdata_in_cb, ctx);
2414 return NVME_NO_COMPLETE;
2415 }
2416
2417 typedef struct NvmeCopyAIOCB {
2418 BlockAIOCB common;
2419 BlockAIOCB *aiocb;
2420 NvmeRequest *req;
2421 QEMUBH *bh;
2422 int ret;
2423
2424 NvmeCopySourceRange *ranges;
2425 int nr;
2426 int idx;
2427
2428 uint8_t *bounce;
2429 QEMUIOVector iov;
2430 struct {
2431 BlockAcctCookie read;
2432 BlockAcctCookie write;
2433 } acct;
2434
2435 uint32_t reftag;
2436 uint64_t slba;
2437
2438 NvmeZone *zone;
2439 } NvmeCopyAIOCB;
2440
2441 static void nvme_copy_cancel(BlockAIOCB *aiocb)
2442 {
2443 NvmeCopyAIOCB *iocb = container_of(aiocb, NvmeCopyAIOCB, common);
2444
2445 iocb->ret = -ECANCELED;
2446
2447 if (iocb->aiocb) {
2448 blk_aio_cancel_async(iocb->aiocb);
2449 iocb->aiocb = NULL;
2450 }
2451 }
2452
2453 static const AIOCBInfo nvme_copy_aiocb_info = {
2454 .aiocb_size = sizeof(NvmeCopyAIOCB),
2455 .cancel_async = nvme_copy_cancel,
2456 };
2457
2458 static void nvme_copy_bh(void *opaque)
2459 {
2460 NvmeCopyAIOCB *iocb = opaque;
2461 NvmeRequest *req = iocb->req;
2462 NvmeNamespace *ns = req->ns;
2463 BlockAcctStats *stats = blk_get_stats(ns->blkconf.blk);
2464
2465 if (iocb->idx != iocb->nr) {
2466 req->cqe.result = cpu_to_le32(iocb->idx);
2467 }
2468
2469 qemu_iovec_destroy(&iocb->iov);
2470 g_free(iocb->bounce);
2471
2472 qemu_bh_delete(iocb->bh);
2473 iocb->bh = NULL;
2474
2475 if (iocb->ret < 0) {
2476 block_acct_failed(stats, &iocb->acct.read);
2477 block_acct_failed(stats, &iocb->acct.write);
2478 } else {
2479 block_acct_done(stats, &iocb->acct.read);
2480 block_acct_done(stats, &iocb->acct.write);
2481 }
2482
2483 iocb->common.cb(iocb->common.opaque, iocb->ret);
2484 qemu_aio_unref(iocb);
2485 }
2486
2487 static void nvme_copy_cb(void *opaque, int ret);
2488
2489 static void nvme_copy_out_completed_cb(void *opaque, int ret)
2490 {
2491 NvmeCopyAIOCB *iocb = opaque;
2492 NvmeRequest *req = iocb->req;
2493 NvmeNamespace *ns = req->ns;
2494 NvmeCopySourceRange *range = &iocb->ranges[iocb->idx];
2495 uint32_t nlb = le32_to_cpu(range->nlb) + 1;
2496
2497 if (ret < 0) {
2498 iocb->ret = ret;
2499 goto out;
2500 } else if (iocb->ret < 0) {
2501 goto out;
2502 }
2503
2504 if (ns->params.zoned) {
2505 nvme_advance_zone_wp(ns, iocb->zone, nlb);
2506 }
2507
2508 iocb->idx++;
2509 iocb->slba += nlb;
2510 out:
2511 nvme_copy_cb(iocb, iocb->ret);
2512 }
2513
2514 static void nvme_copy_out_cb(void *opaque, int ret)
2515 {
2516 NvmeCopyAIOCB *iocb = opaque;
2517 NvmeRequest *req = iocb->req;
2518 NvmeNamespace *ns = req->ns;
2519 NvmeCopySourceRange *range;
2520 uint32_t nlb;
2521 size_t mlen;
2522 uint8_t *mbounce;
2523
2524 if (ret < 0) {
2525 iocb->ret = ret;
2526 goto out;
2527 } else if (iocb->ret < 0) {
2528 goto out;
2529 }
2530
2531 if (!ns->lbaf.ms) {
2532 nvme_copy_out_completed_cb(iocb, 0);
2533 return;
2534 }
2535
2536 range = &iocb->ranges[iocb->idx];
2537 nlb = le32_to_cpu(range->nlb) + 1;
2538
2539 mlen = nvme_m2b(ns, nlb);
2540 mbounce = iocb->bounce + nvme_l2b(ns, nlb);
2541
2542 qemu_iovec_reset(&iocb->iov);
2543 qemu_iovec_add(&iocb->iov, mbounce, mlen);
2544
2545 iocb->aiocb = blk_aio_pwritev(ns->blkconf.blk, nvme_moff(ns, iocb->slba),
2546 &iocb->iov, 0, nvme_copy_out_completed_cb,
2547 iocb);
2548
2549 return;
2550
2551 out:
2552 nvme_copy_cb(iocb, ret);
2553 }
2554
2555 static void nvme_copy_in_completed_cb(void *opaque, int ret)
2556 {
2557 NvmeCopyAIOCB *iocb = opaque;
2558 NvmeRequest *req = iocb->req;
2559 NvmeNamespace *ns = req->ns;
2560 NvmeCopySourceRange *range;
2561 uint32_t nlb;
2562 size_t len;
2563 uint16_t status;
2564
2565 if (ret < 0) {
2566 iocb->ret = ret;
2567 goto out;
2568 } else if (iocb->ret < 0) {
2569 goto out;
2570 }
2571
2572 range = &iocb->ranges[iocb->idx];
2573 nlb = le32_to_cpu(range->nlb) + 1;
2574 len = nvme_l2b(ns, nlb);
2575
2576 trace_pci_nvme_copy_out(iocb->slba, nlb);
2577
2578 if (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps)) {
2579 NvmeCopyCmd *copy = (NvmeCopyCmd *)&req->cmd;
2580
2581 uint16_t prinfor = ((copy->control[0] >> 4) & 0xf);
2582 uint16_t prinfow = ((copy->control[2] >> 2) & 0xf);
2583
2584 uint16_t apptag = le16_to_cpu(range->apptag);
2585 uint16_t appmask = le16_to_cpu(range->appmask);
2586 uint32_t reftag = le32_to_cpu(range->reftag);
2587
2588 uint64_t slba = le64_to_cpu(range->slba);
2589 size_t mlen = nvme_m2b(ns, nlb);
2590 uint8_t *mbounce = iocb->bounce + nvme_l2b(ns, nlb);
2591
2592 status = nvme_dif_check(ns, iocb->bounce, len, mbounce, mlen, prinfor,
2593 slba, apptag, appmask, &reftag);
2594 if (status) {
2595 goto invalid;
2596 }
2597
2598 apptag = le16_to_cpu(copy->apptag);
2599 appmask = le16_to_cpu(copy->appmask);
2600
2601 if (prinfow & NVME_PRINFO_PRACT) {
2602 status = nvme_check_prinfo(ns, prinfow, iocb->slba, iocb->reftag);
2603 if (status) {
2604 goto invalid;
2605 }
2606
2607 nvme_dif_pract_generate_dif(ns, iocb->bounce, len, mbounce, mlen,
2608 apptag, &iocb->reftag);
2609 } else {
2610 status = nvme_dif_check(ns, iocb->bounce, len, mbounce, mlen,
2611 prinfow, iocb->slba, apptag, appmask,
2612 &iocb->reftag);
2613 if (status) {
2614 goto invalid;
2615 }
2616 }
2617 }
2618
2619 status = nvme_check_bounds(ns, iocb->slba, nlb);
2620 if (status) {
2621 goto invalid;
2622 }
2623
2624 if (ns->params.zoned) {
2625 status = nvme_check_zone_write(ns, iocb->zone, iocb->slba, nlb);
2626 if (status) {
2627 goto invalid;
2628 }
2629
2630 iocb->zone->w_ptr += nlb;
2631 }
2632
2633 qemu_iovec_reset(&iocb->iov);
2634 qemu_iovec_add(&iocb->iov, iocb->bounce, len);
2635
2636 iocb->aiocb = blk_aio_pwritev(ns->blkconf.blk, nvme_l2b(ns, iocb->slba),
2637 &iocb->iov, 0, nvme_copy_out_cb, iocb);
2638
2639 return;
2640
2641 invalid:
2642 req->status = status;
2643 iocb->aiocb = NULL;
2644 if (iocb->bh) {
2645 qemu_bh_schedule(iocb->bh);
2646 }
2647
2648 return;
2649
2650 out:
2651 nvme_copy_cb(iocb, ret);
2652 }
2653
2654 static void nvme_copy_in_cb(void *opaque, int ret)
2655 {
2656 NvmeCopyAIOCB *iocb = opaque;
2657 NvmeRequest *req = iocb->req;
2658 NvmeNamespace *ns = req->ns;
2659 NvmeCopySourceRange *range;
2660 uint64_t slba;
2661 uint32_t nlb;
2662
2663 if (ret < 0) {
2664 iocb->ret = ret;
2665 goto out;
2666 } else if (iocb->ret < 0) {
2667 goto out;
2668 }
2669
2670 if (!ns->lbaf.ms) {
2671 nvme_copy_in_completed_cb(iocb, 0);
2672 return;
2673 }
2674
2675 range = &iocb->ranges[iocb->idx];
2676 slba = le64_to_cpu(range->slba);
2677 nlb = le32_to_cpu(range->nlb) + 1;
2678
2679 qemu_iovec_reset(&iocb->iov);
2680 qemu_iovec_add(&iocb->iov, iocb->bounce + nvme_l2b(ns, nlb),
2681 nvme_m2b(ns, nlb));
2682
2683 iocb->aiocb = blk_aio_preadv(ns->blkconf.blk, nvme_moff(ns, slba),
2684 &iocb->iov, 0, nvme_copy_in_completed_cb,
2685 iocb);
2686 return;
2687
2688 out:
2689 nvme_copy_cb(iocb, iocb->ret);
2690 }
2691
2692 static void nvme_copy_cb(void *opaque, int ret)
2693 {
2694 NvmeCopyAIOCB *iocb = opaque;
2695 NvmeRequest *req = iocb->req;
2696 NvmeNamespace *ns = req->ns;
2697 NvmeCopySourceRange *range;
2698 uint64_t slba;
2699 uint32_t nlb;
2700 size_t len;
2701 uint16_t status;
2702
2703 if (ret < 0) {
2704 iocb->ret = ret;
2705 goto done;
2706 } else if (iocb->ret < 0) {
2707 goto done;
2708 }
2709
2710 if (iocb->idx == iocb->nr) {
2711 goto done;
2712 }
2713
2714 range = &iocb->ranges[iocb->idx];
2715 slba = le64_to_cpu(range->slba);
2716 nlb = le32_to_cpu(range->nlb) + 1;
2717 len = nvme_l2b(ns, nlb);
2718
2719 trace_pci_nvme_copy_source_range(slba, nlb);
2720
2721 if (nlb > le16_to_cpu(ns->id_ns.mssrl)) {
2722 status = NVME_CMD_SIZE_LIMIT | NVME_DNR;
2723 goto invalid;
2724 }
2725
2726 status = nvme_check_bounds(ns, slba, nlb);
2727 if (status) {
2728 goto invalid;
2729 }
2730
2731 if (NVME_ERR_REC_DULBE(ns->features.err_rec)) {
2732 status = nvme_check_dulbe(ns, slba, nlb);
2733 if (status) {
2734 goto invalid;
2735 }
2736 }
2737
2738 if (ns->params.zoned) {
2739 status = nvme_check_zone_read(ns, slba, nlb);
2740 if (status) {
2741 goto invalid;
2742 }
2743 }
2744
2745 qemu_iovec_reset(&iocb->iov);
2746 qemu_iovec_add(&iocb->iov, iocb->bounce, len);
2747
2748 iocb->aiocb = blk_aio_preadv(ns->blkconf.blk, nvme_l2b(ns, slba),
2749 &iocb->iov, 0, nvme_copy_in_cb, iocb);
2750 return;
2751
2752 invalid:
2753 req->status = status;
2754 done:
2755 iocb->aiocb = NULL;
2756 if (iocb->bh) {
2757 qemu_bh_schedule(iocb->bh);
2758 }
2759 }
2760
2761
2762 static uint16_t nvme_copy(NvmeCtrl *n, NvmeRequest *req)
2763 {
2764 NvmeNamespace *ns = req->ns;
2765 NvmeCopyCmd *copy = (NvmeCopyCmd *)&req->cmd;
2766 NvmeCopyAIOCB *iocb = blk_aio_get(&nvme_copy_aiocb_info, ns->blkconf.blk,
2767 nvme_misc_cb, req);
2768 uint16_t nr = copy->nr + 1;
2769 uint8_t format = copy->control[0] & 0xf;
2770 uint16_t prinfor = ((copy->control[0] >> 4) & 0xf);
2771 uint16_t prinfow = ((copy->control[2] >> 2) & 0xf);
2772
2773 uint16_t status;
2774
2775 trace_pci_nvme_copy(nvme_cid(req), nvme_nsid(ns), nr, format);
2776
2777 iocb->ranges = NULL;
2778 iocb->zone = NULL;
2779
2780 if (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps) &&
2781 ((prinfor & NVME_PRINFO_PRACT) != (prinfow & NVME_PRINFO_PRACT))) {
2782 status = NVME_INVALID_FIELD | NVME_DNR;
2783 goto invalid;
2784 }
2785
2786 if (!(n->id_ctrl.ocfs & (1 << format))) {
2787 trace_pci_nvme_err_copy_invalid_format(format);
2788 status = NVME_INVALID_FIELD | NVME_DNR;
2789 goto invalid;
2790 }
2791
2792 if (nr > ns->id_ns.msrc + 1) {
2793 status = NVME_CMD_SIZE_LIMIT | NVME_DNR;
2794 goto invalid;
2795 }
2796
2797 iocb->ranges = g_new(NvmeCopySourceRange, nr);
2798
2799 status = nvme_h2c(n, (uint8_t *)iocb->ranges,
2800 sizeof(NvmeCopySourceRange) * nr, req);
2801 if (status) {
2802 goto invalid;
2803 }
2804
2805 iocb->slba = le64_to_cpu(copy->sdlba);
2806
2807 if (ns->params.zoned) {
2808 iocb->zone = nvme_get_zone_by_slba(ns, iocb->slba);
2809 if (!iocb->zone) {
2810 status = NVME_LBA_RANGE | NVME_DNR;
2811 goto invalid;
2812 }
2813
2814 status = nvme_zrm_auto(n, ns, iocb->zone);
2815 if (status) {
2816 goto invalid;
2817 }
2818 }
2819
2820 iocb->req = req;
2821 iocb->bh = qemu_bh_new(nvme_copy_bh, iocb);
2822 iocb->ret = 0;
2823 iocb->nr = nr;
2824 iocb->idx = 0;
2825 iocb->reftag = le32_to_cpu(copy->reftag);
2826 iocb->bounce = g_malloc_n(le16_to_cpu(ns->id_ns.mssrl),
2827 ns->lbasz + ns->lbaf.ms);
2828
2829 qemu_iovec_init(&iocb->iov, 1);
2830
2831 block_acct_start(blk_get_stats(ns->blkconf.blk), &iocb->acct.read, 0,
2832 BLOCK_ACCT_READ);
2833 block_acct_start(blk_get_stats(ns->blkconf.blk), &iocb->acct.write, 0,
2834 BLOCK_ACCT_WRITE);
2835
2836 req->aiocb = &iocb->common;
2837 nvme_copy_cb(iocb, 0);
2838
2839 return NVME_NO_COMPLETE;
2840
2841 invalid:
2842 g_free(iocb->ranges);
2843 qemu_aio_unref(iocb);
2844 return status;
2845 }
2846
2847 static uint16_t nvme_compare(NvmeCtrl *n, NvmeRequest *req)
2848 {
2849 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd;
2850 NvmeNamespace *ns = req->ns;
2851 BlockBackend *blk = ns->blkconf.blk;
2852 uint64_t slba = le64_to_cpu(rw->slba);
2853 uint32_t nlb = le16_to_cpu(rw->nlb) + 1;
2854 uint8_t prinfo = NVME_RW_PRINFO(le16_to_cpu(rw->control));
2855 size_t data_len = nvme_l2b(ns, nlb);
2856 size_t len = data_len;
2857 int64_t offset = nvme_l2b(ns, slba);
2858 struct nvme_compare_ctx *ctx = NULL;
2859 uint16_t status;
2860
2861 trace_pci_nvme_compare(nvme_cid(req), nvme_nsid(ns), slba, nlb);
2862
2863 if (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps) && (prinfo & NVME_PRINFO_PRACT)) {
2864 return NVME_INVALID_PROT_INFO | NVME_DNR;
2865 }
2866
2867 if (nvme_ns_ext(ns)) {
2868 len += nvme_m2b(ns, nlb);
2869 }
2870
2871 status = nvme_check_mdts(n, len);
2872 if (status) {
2873 return status;
2874 }
2875
2876 status = nvme_check_bounds(ns, slba, nlb);
2877 if (status) {
2878 return status;
2879 }
2880
2881 if (NVME_ERR_REC_DULBE(ns->features.err_rec)) {
2882 status = nvme_check_dulbe(ns, slba, nlb);
2883 if (status) {
2884 return status;
2885 }
2886 }
2887
2888 status = nvme_map_dptr(n, &req->sg, len, &req->cmd);
2889 if (status) {
2890 return status;
2891 }
2892
2893 ctx = g_new(struct nvme_compare_ctx, 1);
2894 ctx->data.bounce = g_malloc(data_len);
2895
2896 req->opaque = ctx;
2897
2898 qemu_iovec_init(&ctx->data.iov, 1);
2899 qemu_iovec_add(&ctx->data.iov, ctx->data.bounce, data_len);
2900
2901 block_acct_start(blk_get_stats(blk), &req->acct, data_len,
2902 BLOCK_ACCT_READ);
2903 req->aiocb = blk_aio_preadv(blk, offset, &ctx->data.iov, 0,
2904 nvme_compare_data_cb, req);
2905
2906 return NVME_NO_COMPLETE;
2907 }
2908
2909 typedef struct NvmeFlushAIOCB {
2910 BlockAIOCB common;
2911 BlockAIOCB *aiocb;
2912 NvmeRequest *req;
2913 QEMUBH *bh;
2914 int ret;
2915
2916 NvmeNamespace *ns;
2917 uint32_t nsid;
2918 bool broadcast;
2919 } NvmeFlushAIOCB;
2920
2921 static void nvme_flush_cancel(BlockAIOCB *acb)
2922 {
2923 NvmeFlushAIOCB *iocb = container_of(acb, NvmeFlushAIOCB, common);
2924
2925 iocb->ret = -ECANCELED;
2926
2927 if (iocb->aiocb) {
2928 blk_aio_cancel_async(iocb->aiocb);
2929 }
2930 }
2931
2932 static const AIOCBInfo nvme_flush_aiocb_info = {
2933 .aiocb_size = sizeof(NvmeFlushAIOCB),
2934 .cancel_async = nvme_flush_cancel,
2935 .get_aio_context = nvme_get_aio_context,
2936 };
2937
2938 static void nvme_flush_ns_cb(void *opaque, int ret)
2939 {
2940 NvmeFlushAIOCB *iocb = opaque;
2941 NvmeNamespace *ns = iocb->ns;
2942
2943 if (ret < 0) {
2944 iocb->ret = ret;
2945 goto out;
2946 } else if (iocb->ret < 0) {
2947 goto out;
2948 }
2949
2950 if (ns) {
2951 trace_pci_nvme_flush_ns(iocb->nsid);
2952
2953 iocb->ns = NULL;
2954 iocb->aiocb = blk_aio_flush(ns->blkconf.blk, nvme_flush_ns_cb, iocb);
2955 return;
2956 }
2957
2958 out:
2959 iocb->aiocb = NULL;
2960 qemu_bh_schedule(iocb->bh);
2961 }
2962
2963 static void nvme_flush_bh(void *opaque)
2964 {
2965 NvmeFlushAIOCB *iocb = opaque;
2966 NvmeRequest *req = iocb->req;
2967 NvmeCtrl *n = nvme_ctrl(req);
2968 int i;
2969
2970 if (iocb->ret < 0) {
2971 goto done;
2972 }
2973
2974 if (iocb->broadcast) {
2975 for (i = iocb->nsid + 1; i <= NVME_MAX_NAMESPACES; i++) {
2976 iocb->ns = nvme_ns(n, i);
2977 if (iocb->ns) {
2978 iocb->nsid = i;
2979 break;
2980 }
2981 }
2982 }
2983
2984 if (!iocb->ns) {
2985 goto done;
2986 }
2987
2988 nvme_flush_ns_cb(iocb, 0);
2989 return;
2990
2991 done:
2992 qemu_bh_delete(iocb->bh);
2993 iocb->bh = NULL;
2994
2995 iocb->common.cb(iocb->common.opaque, iocb->ret);
2996
2997 qemu_aio_unref(iocb);
2998
2999 return;
3000 }
3001
3002 static uint16_t nvme_flush(NvmeCtrl *n, NvmeRequest *req)
3003 {
3004 NvmeFlushAIOCB *iocb;
3005 uint32_t nsid = le32_to_cpu(req->cmd.nsid);
3006 uint16_t status;
3007
3008 iocb = qemu_aio_get(&nvme_flush_aiocb_info, NULL, nvme_misc_cb, req);
3009
3010 iocb->req = req;
3011 iocb->bh = qemu_bh_new(nvme_flush_bh, iocb);
3012 iocb->ret = 0;
3013 iocb->ns = NULL;
3014 iocb->nsid = 0;
3015 iocb->broadcast = (nsid == NVME_NSID_BROADCAST);
3016
3017 if (!iocb->broadcast) {
3018 if (!nvme_nsid_valid(n, nsid)) {
3019 status = NVME_INVALID_NSID | NVME_DNR;
3020 goto out;
3021 }
3022
3023 iocb->ns = nvme_ns(n, nsid);
3024 if (!iocb->ns) {
3025 status = NVME_INVALID_FIELD | NVME_DNR;
3026 goto out;
3027 }
3028
3029 iocb->nsid = nsid;
3030 }
3031
3032 req->aiocb = &iocb->common;
3033 qemu_bh_schedule(iocb->bh);
3034
3035 return NVME_NO_COMPLETE;
3036
3037 out:
3038 qemu_bh_delete(iocb->bh);
3039 iocb->bh = NULL;
3040 qemu_aio_unref(iocb);
3041
3042 return status;
3043 }
3044
3045 static uint16_t nvme_read(NvmeCtrl *n, NvmeRequest *req)
3046 {
3047 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd;
3048 NvmeNamespace *ns = req->ns;
3049 uint64_t slba = le64_to_cpu(rw->slba);
3050 uint32_t nlb = (uint32_t)le16_to_cpu(rw->nlb) + 1;
3051 uint8_t prinfo = NVME_RW_PRINFO(le16_to_cpu(rw->control));
3052 uint64_t data_size = nvme_l2b(ns, nlb);
3053 uint64_t mapped_size = data_size;
3054 uint64_t data_offset;
3055 BlockBackend *blk = ns->blkconf.blk;
3056 uint16_t status;
3057
3058 if (nvme_ns_ext(ns)) {
3059 mapped_size += nvme_m2b(ns, nlb);
3060
3061 if (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps)) {
3062 bool pract = prinfo & NVME_PRINFO_PRACT;
3063
3064 if (pract && ns->lbaf.ms == 8) {
3065 mapped_size = data_size;
3066 }
3067 }
3068 }
3069
3070 trace_pci_nvme_read(nvme_cid(req), nvme_nsid(ns), nlb, mapped_size, slba);
3071
3072 status = nvme_check_mdts(n, mapped_size);
3073 if (status) {
3074 goto invalid;
3075 }
3076
3077 status = nvme_check_bounds(ns, slba, nlb);
3078 if (status) {
3079 goto invalid;
3080 }
3081
3082 if (ns->params.zoned) {
3083 status = nvme_check_zone_read(ns, slba, nlb);
3084 if (status) {
3085 trace_pci_nvme_err_zone_read_not_ok(slba, nlb, status);
3086 goto invalid;
3087 }
3088 }
3089
3090 if (NVME_ERR_REC_DULBE(ns->features.err_rec)) {
3091 status = nvme_check_dulbe(ns, slba, nlb);
3092 if (status) {
3093 goto invalid;
3094 }
3095 }
3096
3097 if (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps)) {
3098 return nvme_dif_rw(n, req);
3099 }
3100
3101 status = nvme_map_data(n, nlb, req);
3102 if (status) {
3103 goto invalid;
3104 }
3105
3106 data_offset = nvme_l2b(ns, slba);
3107
3108 block_acct_start(blk_get_stats(blk), &req->acct, data_size,
3109 BLOCK_ACCT_READ);
3110 nvme_blk_read(blk, data_offset, nvme_rw_cb, req);
3111 return NVME_NO_COMPLETE;
3112
3113 invalid:
3114 block_acct_invalid(blk_get_stats(blk), BLOCK_ACCT_READ);
3115 return status | NVME_DNR;
3116 }
3117
3118 static uint16_t nvme_do_write(NvmeCtrl *n, NvmeRequest *req, bool append,
3119 bool wrz)
3120 {
3121 NvmeRwCmd *rw = (NvmeRwCmd *)&req->cmd;
3122 NvmeNamespace *ns = req->ns;
3123 uint64_t slba = le64_to_cpu(rw->slba);
3124 uint32_t nlb = (uint32_t)le16_to_cpu(rw->nlb) + 1;
3125 uint16_t ctrl = le16_to_cpu(rw->control);
3126 uint8_t prinfo = NVME_RW_PRINFO(ctrl);
3127 uint64_t data_size = nvme_l2b(ns, nlb);
3128 uint64_t mapped_size = data_size;
3129 uint64_t data_offset;
3130 NvmeZone *zone;
3131 NvmeZonedResult *res = (NvmeZonedResult *)&req->cqe;
3132 BlockBackend *blk = ns->blkconf.blk;
3133 uint16_t status;
3134
3135 if (nvme_ns_ext(ns)) {
3136 mapped_size += nvme_m2b(ns, nlb);
3137
3138 if (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps)) {
3139 bool pract = prinfo & NVME_PRINFO_PRACT;
3140
3141 if (pract && ns->lbaf.ms == 8) {
3142 mapped_size -= nvme_m2b(ns, nlb);
3143 }
3144 }
3145 }
3146
3147 trace_pci_nvme_write(nvme_cid(req), nvme_io_opc_str(rw->opcode),
3148 nvme_nsid(ns), nlb, mapped_size, slba);
3149
3150 if (!wrz) {
3151 status = nvme_check_mdts(n, mapped_size);
3152 if (status) {
3153 goto invalid;
3154 }
3155 }
3156
3157 status = nvme_check_bounds(ns, slba, nlb);
3158 if (status) {
3159 goto invalid;
3160 }
3161
3162 if (ns->params.zoned) {
3163 zone = nvme_get_zone_by_slba(ns, slba);
3164 assert(zone);
3165
3166 if (append) {
3167 bool piremap = !!(ctrl & NVME_RW_PIREMAP);
3168
3169 if (unlikely(slba != zone->d.zslba)) {
3170 trace_pci_nvme_err_append_not_at_start(slba, zone->d.zslba);
3171 status = NVME_INVALID_FIELD;
3172 goto invalid;
3173 }
3174
3175 if (n->params.zasl &&
3176 data_size > (uint64_t)n->page_size << n->params.zasl) {
3177 trace_pci_nvme_err_zasl(data_size);
3178 return NVME_INVALID_FIELD | NVME_DNR;
3179 }
3180
3181 slba = zone->w_ptr;
3182 rw->slba = cpu_to_le64(slba);
3183 res->slba = cpu_to_le64(slba);
3184
3185 switch (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps)) {
3186 case NVME_ID_NS_DPS_TYPE_1:
3187 if (!piremap) {
3188 return NVME_INVALID_PROT_INFO | NVME_DNR;
3189 }
3190
3191 /* fallthrough */
3192
3193 case NVME_ID_NS_DPS_TYPE_2:
3194 if (piremap) {
3195 uint32_t reftag = le32_to_cpu(rw->reftag);
3196 rw->reftag = cpu_to_le32(reftag + (slba - zone->d.zslba));
3197 }
3198
3199 break;
3200
3201 case NVME_ID_NS_DPS_TYPE_3:
3202 if (piremap) {
3203 return NVME_INVALID_PROT_INFO | NVME_DNR;
3204 }
3205
3206 break;
3207 }
3208 }
3209
3210 status = nvme_check_zone_write(ns, zone, slba, nlb);
3211 if (status) {
3212 goto invalid;
3213 }
3214
3215 status = nvme_zrm_auto(n, ns, zone);
3216 if (status) {
3217 goto invalid;
3218 }
3219
3220 zone->w_ptr += nlb;
3221 }
3222
3223 data_offset = nvme_l2b(ns, slba);
3224
3225 if (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps)) {
3226 return nvme_dif_rw(n, req);
3227 }
3228
3229 if (!wrz) {
3230 status = nvme_map_data(n, nlb, req);
3231 if (status) {
3232 goto invalid;
3233 }
3234
3235 block_acct_start(blk_get_stats(blk), &req->acct, data_size,
3236 BLOCK_ACCT_WRITE);
3237 nvme_blk_write(blk, data_offset, nvme_rw_cb, req);
3238 } else {
3239 req->aiocb = blk_aio_pwrite_zeroes(blk, data_offset, data_size,
3240 BDRV_REQ_MAY_UNMAP, nvme_rw_cb,
3241 req);
3242 }
3243
3244 return NVME_NO_COMPLETE;
3245
3246 invalid:
3247 block_acct_invalid(blk_get_stats(blk), BLOCK_ACCT_WRITE);
3248 return status | NVME_DNR;
3249 }
3250
3251 static inline uint16_t nvme_write(NvmeCtrl *n, NvmeRequest *req)
3252 {
3253 return nvme_do_write(n, req, false, false);
3254 }
3255
3256 static inline uint16_t nvme_write_zeroes(NvmeCtrl *n, NvmeRequest *req)
3257 {
3258 return nvme_do_write(n, req, false, true);
3259 }
3260
3261 static inline uint16_t nvme_zone_append(NvmeCtrl *n, NvmeRequest *req)
3262 {
3263 return nvme_do_write(n, req, true, false);
3264 }
3265
3266 static uint16_t nvme_get_mgmt_zone_slba_idx(NvmeNamespace *ns, NvmeCmd *c,
3267 uint64_t *slba, uint32_t *zone_idx)
3268 {
3269 uint32_t dw10 = le32_to_cpu(c->cdw10);
3270 uint32_t dw11 = le32_to_cpu(c->cdw11);
3271
3272 if (!ns->params.zoned) {
3273 trace_pci_nvme_err_invalid_opc(c->opcode);
3274 return NVME_INVALID_OPCODE | NVME_DNR;
3275 }
3276
3277 *slba = ((uint64_t)dw11) << 32 | dw10;
3278 if (unlikely(*slba >= ns->id_ns.nsze)) {
3279 trace_pci_nvme_err_invalid_lba_range(*slba, 0, ns->id_ns.nsze);
3280 *slba = 0;
3281 return NVME_LBA_RANGE | NVME_DNR;
3282 }
3283
3284 *zone_idx = nvme_zone_idx(ns, *slba);
3285 assert(*zone_idx < ns->num_zones);
3286
3287 return NVME_SUCCESS;
3288 }
3289
3290 typedef uint16_t (*op_handler_t)(NvmeNamespace *, NvmeZone *, NvmeZoneState,
3291 NvmeRequest *);
3292
3293 enum NvmeZoneProcessingMask {
3294 NVME_PROC_CURRENT_ZONE = 0,
3295 NVME_PROC_OPENED_ZONES = 1 << 0,
3296 NVME_PROC_CLOSED_ZONES = 1 << 1,
3297 NVME_PROC_READ_ONLY_ZONES = 1 << 2,
3298 NVME_PROC_FULL_ZONES = 1 << 3,
3299 };
3300
3301 static uint16_t nvme_open_zone(NvmeNamespace *ns, NvmeZone *zone,
3302 NvmeZoneState state, NvmeRequest *req)
3303 {
3304 return nvme_zrm_open(nvme_ctrl(req), ns, zone);
3305 }
3306
3307 static uint16_t nvme_close_zone(NvmeNamespace *ns, NvmeZone *zone,
3308 NvmeZoneState state, NvmeRequest *req)
3309 {
3310 return nvme_zrm_close(ns, zone);
3311 }
3312
3313 static uint16_t nvme_finish_zone(NvmeNamespace *ns, NvmeZone *zone,
3314 NvmeZoneState state, NvmeRequest *req)
3315 {
3316 return nvme_zrm_finish(ns, zone);
3317 }
3318
3319 static uint16_t nvme_offline_zone(NvmeNamespace *ns, NvmeZone *zone,
3320 NvmeZoneState state, NvmeRequest *req)
3321 {
3322 switch (state) {
3323 case NVME_ZONE_STATE_READ_ONLY:
3324 nvme_assign_zone_state(ns, zone, NVME_ZONE_STATE_OFFLINE);
3325 /* fall through */
3326 case NVME_ZONE_STATE_OFFLINE:
3327 return NVME_SUCCESS;
3328 default:
3329 return NVME_ZONE_INVAL_TRANSITION;
3330 }
3331 }
3332
3333 static uint16_t nvme_set_zd_ext(NvmeNamespace *ns, NvmeZone *zone)
3334 {
3335 uint16_t status;
3336 uint8_t state = nvme_get_zone_state(zone);
3337
3338 if (state == NVME_ZONE_STATE_EMPTY) {
3339 status = nvme_aor_check(ns, 1, 0);
3340 if (status) {
3341 return status;
3342 }
3343 nvme_aor_inc_active(ns);
3344 zone->d.za |= NVME_ZA_ZD_EXT_VALID;
3345 nvme_assign_zone_state(ns, zone, NVME_ZONE_STATE_CLOSED);
3346 return NVME_SUCCESS;
3347 }
3348
3349 return NVME_ZONE_INVAL_TRANSITION;
3350 }
3351
3352 static uint16_t nvme_bulk_proc_zone(NvmeNamespace *ns, NvmeZone *zone,
3353 enum NvmeZoneProcessingMask proc_mask,
3354 op_handler_t op_hndlr, NvmeRequest *req)
3355 {
3356 uint16_t status = NVME_SUCCESS;
3357 NvmeZoneState zs = nvme_get_zone_state(zone);
3358 bool proc_zone;
3359
3360 switch (zs) {
3361 case NVME_ZONE_STATE_IMPLICITLY_OPEN:
3362 case NVME_ZONE_STATE_EXPLICITLY_OPEN:
3363 proc_zone = proc_mask & NVME_PROC_OPENED_ZONES;
3364 break;
3365 case NVME_ZONE_STATE_CLOSED:
3366 proc_zone = proc_mask & NVME_PROC_CLOSED_ZONES;
3367 break;
3368 case NVME_ZONE_STATE_READ_ONLY:
3369 proc_zone = proc_mask & NVME_PROC_READ_ONLY_ZONES;
3370 break;
3371 case NVME_ZONE_STATE_FULL:
3372 proc_zone = proc_mask & NVME_PROC_FULL_ZONES;
3373 break;
3374 default:
3375 proc_zone = false;
3376 }
3377
3378 if (proc_zone) {
3379 status = op_hndlr(ns, zone, zs, req);
3380 }
3381
3382 return status;
3383 }
3384
3385 static uint16_t nvme_do_zone_op(NvmeNamespace *ns, NvmeZone *zone,
3386 enum NvmeZoneProcessingMask proc_mask,
3387 op_handler_t op_hndlr, NvmeRequest *req)
3388 {
3389 NvmeZone *next;
3390 uint16_t status = NVME_SUCCESS;
3391 int i;
3392
3393 if (!proc_mask) {
3394 status = op_hndlr(ns, zone, nvme_get_zone_state(zone), req);
3395 } else {
3396 if (proc_mask & NVME_PROC_CLOSED_ZONES) {
3397 QTAILQ_FOREACH_SAFE(zone, &ns->closed_zones, entry, next) {
3398 status = nvme_bulk_proc_zone(ns, zone, proc_mask, op_hndlr,
3399 req);
3400 if (status && status != NVME_NO_COMPLETE) {
3401 goto out;
3402 }
3403 }
3404 }
3405 if (proc_mask & NVME_PROC_OPENED_ZONES) {
3406 QTAILQ_FOREACH_SAFE(zone, &ns->imp_open_zones, entry, next) {
3407 status = nvme_bulk_proc_zone(ns, zone, proc_mask, op_hndlr,
3408 req);
3409 if (status && status != NVME_NO_COMPLETE) {
3410 goto out;
3411 }
3412 }
3413
3414 QTAILQ_FOREACH_SAFE(zone, &ns->exp_open_zones, entry, next) {
3415 status = nvme_bulk_proc_zone(ns, zone, proc_mask, op_hndlr,
3416 req);
3417 if (status && status != NVME_NO_COMPLETE) {
3418 goto out;
3419 }
3420 }
3421 }
3422 if (proc_mask & NVME_PROC_FULL_ZONES) {
3423 QTAILQ_FOREACH_SAFE(zone, &ns->full_zones, entry, next) {
3424 status = nvme_bulk_proc_zone(ns, zone, proc_mask, op_hndlr,
3425 req);
3426 if (status && status != NVME_NO_COMPLETE) {
3427 goto out;
3428 }
3429 }
3430 }
3431
3432 if (proc_mask & NVME_PROC_READ_ONLY_ZONES) {
3433 for (i = 0; i < ns->num_zones; i++, zone++) {
3434 status = nvme_bulk_proc_zone(ns, zone, proc_mask, op_hndlr,
3435 req);
3436 if (status && status != NVME_NO_COMPLETE) {
3437 goto out;
3438 }
3439 }
3440 }
3441 }
3442
3443 out:
3444 return status;
3445 }
3446
3447 typedef struct NvmeZoneResetAIOCB {
3448 BlockAIOCB common;
3449 BlockAIOCB *aiocb;
3450 NvmeRequest *req;
3451 QEMUBH *bh;
3452 int ret;
3453
3454 bool all;
3455 int idx;
3456 NvmeZone *zone;
3457 } NvmeZoneResetAIOCB;
3458
3459 static void nvme_zone_reset_cancel(BlockAIOCB *aiocb)
3460 {
3461 NvmeZoneResetAIOCB *iocb = container_of(aiocb, NvmeZoneResetAIOCB, common);
3462 NvmeRequest *req = iocb->req;
3463 NvmeNamespace *ns = req->ns;
3464
3465 iocb->idx = ns->num_zones;
3466
3467 iocb->ret = -ECANCELED;
3468
3469 if (iocb->aiocb) {
3470 blk_aio_cancel_async(iocb->aiocb);
3471 iocb->aiocb = NULL;
3472 }
3473 }
3474
3475 static const AIOCBInfo nvme_zone_reset_aiocb_info = {
3476 .aiocb_size = sizeof(NvmeZoneResetAIOCB),
3477 .cancel_async = nvme_zone_reset_cancel,
3478 };
3479
3480 static void nvme_zone_reset_bh(void *opaque)
3481 {
3482 NvmeZoneResetAIOCB *iocb = opaque;
3483
3484 iocb->common.cb(iocb->common.opaque, iocb->ret);
3485
3486 qemu_bh_delete(iocb->bh);
3487 iocb->bh = NULL;
3488 qemu_aio_unref(iocb);
3489 }
3490
3491 static void nvme_zone_reset_cb(void *opaque, int ret);
3492
3493 static void nvme_zone_reset_epilogue_cb(void *opaque, int ret)
3494 {
3495 NvmeZoneResetAIOCB *iocb = opaque;
3496 NvmeRequest *req = iocb->req;
3497 NvmeNamespace *ns = req->ns;
3498 int64_t moff;
3499 int count;
3500
3501 if (ret < 0) {
3502 nvme_zone_reset_cb(iocb, ret);
3503 return;
3504 }
3505
3506 if (!ns->lbaf.ms) {
3507 nvme_zone_reset_cb(iocb, 0);
3508 return;
3509 }
3510
3511 moff = nvme_moff(ns, iocb->zone->d.zslba);
3512 count = nvme_m2b(ns, ns->zone_size);
3513
3514 iocb->aiocb = blk_aio_pwrite_zeroes(ns->blkconf.blk, moff, count,
3515 BDRV_REQ_MAY_UNMAP,
3516 nvme_zone_reset_cb, iocb);
3517 return;
3518 }
3519
3520 static void nvme_zone_reset_cb(void *opaque, int ret)
3521 {
3522 NvmeZoneResetAIOCB *iocb = opaque;
3523 NvmeRequest *req = iocb->req;
3524 NvmeNamespace *ns = req->ns;
3525
3526 if (ret < 0) {
3527 iocb->ret = ret;
3528 goto done;
3529 }
3530
3531 if (iocb->zone) {
3532 nvme_zrm_reset(ns, iocb->zone);
3533
3534 if (!iocb->all) {
3535 goto done;
3536 }
3537 }
3538
3539 while (iocb->idx < ns->num_zones) {
3540 NvmeZone *zone = &ns->zone_array[iocb->idx++];
3541
3542 switch (nvme_get_zone_state(zone)) {
3543 case NVME_ZONE_STATE_EMPTY:
3544 if (!iocb->all) {
3545 goto done;
3546 }
3547
3548 continue;
3549
3550 case NVME_ZONE_STATE_EXPLICITLY_OPEN:
3551 case NVME_ZONE_STATE_IMPLICITLY_OPEN:
3552 case NVME_ZONE_STATE_CLOSED:
3553 case NVME_ZONE_STATE_FULL:
3554 iocb->zone = zone;
3555 break;
3556
3557 default:
3558 continue;
3559 }
3560
3561 trace_pci_nvme_zns_zone_reset(zone->d.zslba);
3562
3563 iocb->aiocb = blk_aio_pwrite_zeroes(ns->blkconf.blk,
3564 nvme_l2b(ns, zone->d.zslba),
3565 nvme_l2b(ns, ns->zone_size),
3566 BDRV_REQ_MAY_UNMAP,
3567 nvme_zone_reset_epilogue_cb,
3568 iocb);
3569 return;
3570 }
3571
3572 done:
3573 iocb->aiocb = NULL;
3574 if (iocb->bh) {
3575 qemu_bh_schedule(iocb->bh);
3576 }
3577 }
3578
3579 static uint16_t nvme_zone_mgmt_send(NvmeCtrl *n, NvmeRequest *req)
3580 {
3581 NvmeCmd *cmd = (NvmeCmd *)&req->cmd;
3582 NvmeNamespace *ns = req->ns;
3583 NvmeZone *zone;
3584 NvmeZoneResetAIOCB *iocb;
3585 uint8_t *zd_ext;
3586 uint32_t dw13 = le32_to_cpu(cmd->cdw13);
3587 uint64_t slba = 0;
3588 uint32_t zone_idx = 0;
3589 uint16_t status;
3590 uint8_t action;
3591 bool all;
3592 enum NvmeZoneProcessingMask proc_mask = NVME_PROC_CURRENT_ZONE;
3593
3594 action = dw13 & 0xff;
3595 all = !!(dw13 & 0x100);
3596
3597 req->status = NVME_SUCCESS;
3598
3599 if (!all) {
3600 status = nvme_get_mgmt_zone_slba_idx(ns, cmd, &slba, &zone_idx);
3601 if (status) {
3602 return status;
3603 }
3604 }
3605
3606 zone = &ns->zone_array[zone_idx];
3607 if (slba != zone->d.zslba) {
3608 trace_pci_nvme_err_unaligned_zone_cmd(action, slba, zone->d.zslba);
3609 return NVME_INVALID_FIELD | NVME_DNR;
3610 }
3611
3612 switch (action) {
3613
3614 case NVME_ZONE_ACTION_OPEN:
3615 if (all) {
3616 proc_mask = NVME_PROC_CLOSED_ZONES;
3617 }
3618 trace_pci_nvme_open_zone(slba, zone_idx, all);
3619 status = nvme_do_zone_op(ns, zone, proc_mask, nvme_open_zone, req);
3620 break;
3621
3622 case NVME_ZONE_ACTION_CLOSE:
3623 if (all) {
3624 proc_mask = NVME_PROC_OPENED_ZONES;
3625 }
3626 trace_pci_nvme_close_zone(slba, zone_idx, all);
3627 status = nvme_do_zone_op(ns, zone, proc_mask, nvme_close_zone, req);
3628 break;
3629
3630 case NVME_ZONE_ACTION_FINISH:
3631 if (all) {
3632 proc_mask = NVME_PROC_OPENED_ZONES | NVME_PROC_CLOSED_ZONES;
3633 }
3634 trace_pci_nvme_finish_zone(slba, zone_idx, all);
3635 status = nvme_do_zone_op(ns, zone, proc_mask, nvme_finish_zone, req);
3636 break;
3637
3638 case NVME_ZONE_ACTION_RESET:
3639 trace_pci_nvme_reset_zone(slba, zone_idx, all);
3640
3641 iocb = blk_aio_get(&nvme_zone_reset_aiocb_info, ns->blkconf.blk,
3642 nvme_misc_cb, req);
3643
3644 iocb->req = req;
3645 iocb->bh = qemu_bh_new(nvme_zone_reset_bh, iocb);
3646 iocb->ret = 0;
3647 iocb->all = all;
3648 iocb->idx = zone_idx;
3649 iocb->zone = NULL;
3650
3651 req->aiocb = &iocb->common;
3652 nvme_zone_reset_cb(iocb, 0);
3653
3654 return NVME_NO_COMPLETE;
3655
3656 case NVME_ZONE_ACTION_OFFLINE:
3657 if (all) {
3658 proc_mask = NVME_PROC_READ_ONLY_ZONES;
3659 }
3660 trace_pci_nvme_offline_zone(slba, zone_idx, all);
3661 status = nvme_do_zone_op(ns, zone, proc_mask, nvme_offline_zone, req);
3662 break;
3663
3664 case NVME_ZONE_ACTION_SET_ZD_EXT:
3665 trace_pci_nvme_set_descriptor_extension(slba, zone_idx);
3666 if (all || !ns->params.zd_extension_size) {
3667 return NVME_INVALID_FIELD | NVME_DNR;
3668 }
3669 zd_ext = nvme_get_zd_extension(ns, zone_idx);
3670 status = nvme_h2c(n, zd_ext, ns->params.zd_extension_size, req);
3671 if (status) {
3672 trace_pci_nvme_err_zd_extension_map_error(zone_idx);
3673 return status;
3674 }
3675
3676 status = nvme_set_zd_ext(ns, zone);
3677 if (status == NVME_SUCCESS) {
3678 trace_pci_nvme_zd_extension_set(zone_idx);
3679 return status;
3680 }
3681 break;
3682
3683 default:
3684 trace_pci_nvme_err_invalid_mgmt_action(action);
3685 status = NVME_INVALID_FIELD;
3686 }
3687
3688 if (status == NVME_ZONE_INVAL_TRANSITION) {
3689 trace_pci_nvme_err_invalid_zone_state_transition(action, slba,
3690 zone->d.za);
3691 }
3692 if (status) {
3693 status |= NVME_DNR;
3694 }
3695
3696 return status;
3697 }
3698
3699 static bool nvme_zone_matches_filter(uint32_t zafs, NvmeZone *zl)
3700 {
3701 NvmeZoneState zs = nvme_get_zone_state(zl);
3702
3703 switch (zafs) {
3704 case NVME_ZONE_REPORT_ALL:
3705 return true;
3706 case NVME_ZONE_REPORT_EMPTY:
3707 return zs == NVME_ZONE_STATE_EMPTY;
3708 case NVME_ZONE_REPORT_IMPLICITLY_OPEN:
3709 return zs == NVME_ZONE_STATE_IMPLICITLY_OPEN;
3710 case NVME_ZONE_REPORT_EXPLICITLY_OPEN:
3711 return zs == NVME_ZONE_STATE_EXPLICITLY_OPEN;
3712 case NVME_ZONE_REPORT_CLOSED:
3713 return zs == NVME_ZONE_STATE_CLOSED;
3714 case NVME_ZONE_REPORT_FULL:
3715 return zs == NVME_ZONE_STATE_FULL;
3716 case NVME_ZONE_REPORT_READ_ONLY:
3717 return zs == NVME_ZONE_STATE_READ_ONLY;
3718 case NVME_ZONE_REPORT_OFFLINE:
3719 return zs == NVME_ZONE_STATE_OFFLINE;
3720 default:
3721 return false;
3722 }
3723 }
3724
3725 static uint16_t nvme_zone_mgmt_recv(NvmeCtrl *n, NvmeRequest *req)
3726 {
3727 NvmeCmd *cmd = (NvmeCmd *)&req->cmd;
3728 NvmeNamespace *ns = req->ns;
3729 /* cdw12 is zero-based number of dwords to return. Convert to bytes */
3730 uint32_t data_size = (le32_to_cpu(cmd->cdw12) + 1) << 2;
3731 uint32_t dw13 = le32_to_cpu(cmd->cdw13);
3732 uint32_t zone_idx, zra, zrasf, partial;
3733 uint64_t max_zones, nr_zones = 0;
3734 uint16_t status;
3735 uint64_t slba;
3736 NvmeZoneDescr *z;
3737 NvmeZone *zone;
3738 NvmeZoneReportHeader *header;
3739 void *buf, *buf_p;
3740 size_t zone_entry_sz;
3741 int i;
3742
3743 req->status = NVME_SUCCESS;
3744
3745 status = nvme_get_mgmt_zone_slba_idx(ns, cmd, &slba, &zone_idx);
3746 if (status) {
3747 return status;
3748 }
3749
3750 zra = dw13 & 0xff;
3751 if (zra != NVME_ZONE_REPORT && zra != NVME_ZONE_REPORT_EXTENDED) {
3752 return NVME_INVALID_FIELD | NVME_DNR;
3753 }
3754 if (zra == NVME_ZONE_REPORT_EXTENDED && !ns->params.zd_extension_size) {
3755 return NVME_INVALID_FIELD | NVME_DNR;
3756 }
3757
3758 zrasf = (dw13 >> 8) & 0xff;
3759 if (zrasf > NVME_ZONE_REPORT_OFFLINE) {
3760 return NVME_INVALID_FIELD | NVME_DNR;
3761 }
3762
3763 if (data_size < sizeof(NvmeZoneReportHeader)) {
3764 return NVME_INVALID_FIELD | NVME_DNR;
3765 }
3766
3767 status = nvme_check_mdts(n, data_size);
3768 if (status) {
3769 return status;
3770 }
3771
3772 partial = (dw13 >> 16) & 0x01;
3773
3774 zone_entry_sz = sizeof(NvmeZoneDescr);
3775 if (zra == NVME_ZONE_REPORT_EXTENDED) {
3776 zone_entry_sz += ns->params.zd_extension_size;
3777 }
3778
3779 max_zones = (data_size - sizeof(NvmeZoneReportHeader)) / zone_entry_sz;
3780 buf = g_malloc0(data_size);
3781
3782 zone = &ns->zone_array[zone_idx];
3783 for (i = zone_idx; i < ns->num_zones; i++) {
3784 if (partial && nr_zones >= max_zones) {
3785 break;
3786 }
3787 if (nvme_zone_matches_filter(zrasf, zone++)) {
3788 nr_zones++;
3789 }
3790 }
3791 header = (NvmeZoneReportHeader *)buf;
3792 header->nr_zones = cpu_to_le64(nr_zones);
3793
3794 buf_p = buf + sizeof(NvmeZoneReportHeader);
3795 for (; zone_idx < ns->num_zones && max_zones > 0; zone_idx++) {
3796 zone = &ns->zone_array[zone_idx];
3797 if (nvme_zone_matches_filter(zrasf, zone)) {
3798 z = (NvmeZoneDescr *)buf_p;
3799 buf_p += sizeof(NvmeZoneDescr);
3800
3801 z->zt = zone->d.zt;
3802 z->zs = zone->d.zs;
3803 z->zcap = cpu_to_le64(zone->d.zcap);
3804 z->zslba = cpu_to_le64(zone->d.zslba);
3805 z->za = zone->d.za;
3806
3807 if (nvme_wp_is_valid(zone)) {
3808 z->wp = cpu_to_le64(zone->d.wp);
3809 } else {
3810 z->wp = cpu_to_le64(~0ULL);
3811 }
3812
3813 if (zra == NVME_ZONE_REPORT_EXTENDED) {
3814 if (zone->d.za & NVME_ZA_ZD_EXT_VALID) {
3815 memcpy(buf_p, nvme_get_zd_extension(ns, zone_idx),
3816 ns->params.zd_extension_size);
3817 }
3818 buf_p += ns->params.zd_extension_size;
3819 }
3820
3821 max_zones--;
3822 }
3823 }
3824
3825 status = nvme_c2h(n, (uint8_t *)buf, data_size, req);
3826
3827 g_free(buf);
3828
3829 return status;
3830 }
3831
3832 static uint16_t nvme_io_cmd(NvmeCtrl *n, NvmeRequest *req)
3833 {
3834 NvmeNamespace *ns;
3835 uint32_t nsid = le32_to_cpu(req->cmd.nsid);
3836
3837 trace_pci_nvme_io_cmd(nvme_cid(req), nsid, nvme_sqid(req),
3838 req->cmd.opcode, nvme_io_opc_str(req->cmd.opcode));
3839
3840 if (!nvme_nsid_valid(n, nsid)) {
3841 return NVME_INVALID_NSID | NVME_DNR;
3842 }
3843
3844 /*
3845 * In the base NVM command set, Flush may apply to all namespaces
3846 * (indicated by NSID being set to FFFFFFFFh). But if that feature is used
3847 * along with TP 4056 (Namespace Types), it may be pretty screwed up.
3848 *
3849 * If NSID is indeed set to FFFFFFFFh, we simply cannot associate the
3850 * opcode with a specific command since we cannot determine a unique I/O
3851 * command set. Opcode 0h could have any other meaning than something
3852 * equivalent to flushing and say it DOES have completely different
3853 * semantics in some other command set - does an NSID of FFFFFFFFh then
3854 * mean "for all namespaces, apply whatever command set specific command
3855 * that uses the 0h opcode?" Or does it mean "for all namespaces, apply
3856 * whatever command that uses the 0h opcode if, and only if, it allows NSID
3857 * to be FFFFFFFFh"?
3858 *
3859 * Anyway (and luckily), for now, we do not care about this since the
3860 * device only supports namespace types that includes the NVM Flush command
3861 * (NVM and Zoned), so always do an NVM Flush.
3862 */
3863 if (req->cmd.opcode == NVME_CMD_FLUSH) {
3864 return nvme_flush(n, req);
3865 }
3866
3867 ns = nvme_ns(n, nsid);
3868 if (unlikely(!ns)) {
3869 return NVME_INVALID_FIELD | NVME_DNR;
3870 }
3871
3872 if (!(ns->iocs[req->cmd.opcode] & NVME_CMD_EFF_CSUPP)) {
3873 trace_pci_nvme_err_invalid_opc(req->cmd.opcode);
3874 return NVME_INVALID_OPCODE | NVME_DNR;
3875 }
3876
3877 if (ns->status) {
3878 return ns->status;
3879 }
3880
3881 req->ns = ns;
3882
3883 switch (req->cmd.opcode) {
3884 case NVME_CMD_WRITE_ZEROES:
3885 return nvme_write_zeroes(n, req);
3886 case NVME_CMD_ZONE_APPEND:
3887 return nvme_zone_append(n, req);
3888 case NVME_CMD_WRITE:
3889 return nvme_write(n, req);
3890 case NVME_CMD_READ:
3891 return nvme_read(n, req);
3892 case NVME_CMD_COMPARE:
3893 return nvme_compare(n, req);
3894 case NVME_CMD_DSM:
3895 return nvme_dsm(n, req);
3896 case NVME_CMD_VERIFY:
3897 return nvme_verify(n, req);
3898 case NVME_CMD_COPY:
3899 return nvme_copy(n, req);
3900 case NVME_CMD_ZONE_MGMT_SEND:
3901 return nvme_zone_mgmt_send(n, req);
3902 case NVME_CMD_ZONE_MGMT_RECV:
3903 return nvme_zone_mgmt_recv(n, req);
3904 default:
3905 assert(false);
3906 }
3907
3908 return NVME_INVALID_OPCODE | NVME_DNR;
3909 }
3910
3911 static void nvme_free_sq(NvmeSQueue *sq, NvmeCtrl *n)
3912 {
3913 n->sq[sq->sqid] = NULL;
3914 timer_free(sq->timer);
3915 g_free(sq->io_req);
3916 if (sq->sqid) {
3917 g_free(sq);
3918 }
3919 }
3920
3921 static uint16_t nvme_del_sq(NvmeCtrl *n, NvmeRequest *req)
3922 {
3923 NvmeDeleteQ *c = (NvmeDeleteQ *)&req->cmd;
3924 NvmeRequest *r, *next;
3925 NvmeSQueue *sq;
3926 NvmeCQueue *cq;
3927 uint16_t qid = le16_to_cpu(c->qid);
3928
3929 if (unlikely(!qid || nvme_check_sqid(n, qid))) {
3930 trace_pci_nvme_err_invalid_del_sq(qid);
3931 return NVME_INVALID_QID | NVME_DNR;
3932 }
3933
3934 trace_pci_nvme_del_sq(qid);
3935
3936 sq = n->sq[qid];
3937 while (!QTAILQ_EMPTY(&sq->out_req_list)) {
3938 r = QTAILQ_FIRST(&sq->out_req_list);
3939 assert(r->aiocb);
3940 blk_aio_cancel(r->aiocb);
3941 }
3942
3943 assert(QTAILQ_EMPTY(&sq->out_req_list));
3944
3945 if (!nvme_check_cqid(n, sq->cqid)) {
3946 cq = n->cq[sq->cqid];
3947 QTAILQ_REMOVE(&cq->sq_list, sq, entry);
3948
3949 nvme_post_cqes(cq);
3950 QTAILQ_FOREACH_SAFE(r, &cq->req_list, entry, next) {
3951 if (r->sq == sq) {
3952 QTAILQ_REMOVE(&cq->req_list, r, entry);
3953 QTAILQ_INSERT_TAIL(&sq->req_list, r, entry);
3954 }
3955 }
3956 }
3957
3958 nvme_free_sq(sq, n);
3959 return NVME_SUCCESS;
3960 }
3961
3962 static void nvme_init_sq(NvmeSQueue *sq, NvmeCtrl *n, uint64_t dma_addr,
3963 uint16_t sqid, uint16_t cqid, uint16_t size)
3964 {
3965 int i;
3966 NvmeCQueue *cq;
3967
3968 sq->ctrl = n;
3969 sq->dma_addr = dma_addr;
3970 sq->sqid = sqid;
3971 sq->size = size;
3972 sq->cqid = cqid;
3973 sq->head = sq->tail = 0;
3974 sq->io_req = g_new0(NvmeRequest, sq->size);
3975
3976 QTAILQ_INIT(&sq->req_list);
3977 QTAILQ_INIT(&sq->out_req_list);
3978 for (i = 0; i < sq->size; i++) {
3979 sq->io_req[i].sq = sq;
3980 QTAILQ_INSERT_TAIL(&(sq->req_list), &sq->io_req[i], entry);
3981 }
3982 sq->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, nvme_process_sq, sq);
3983
3984 assert(n->cq[cqid]);
3985 cq = n->cq[cqid];
3986 QTAILQ_INSERT_TAIL(&(cq->sq_list), sq, entry);
3987 n->sq[sqid] = sq;
3988 }
3989
3990 static uint16_t nvme_create_sq(NvmeCtrl *n, NvmeRequest *req)
3991 {
3992 NvmeSQueue *sq;
3993 NvmeCreateSq *c = (NvmeCreateSq *)&req->cmd;
3994
3995 uint16_t cqid = le16_to_cpu(c->cqid);
3996 uint16_t sqid = le16_to_cpu(c->sqid);
3997 uint16_t qsize = le16_to_cpu(c->qsize);
3998 uint16_t qflags = le16_to_cpu(c->sq_flags);
3999 uint64_t prp1 = le64_to_cpu(c->prp1);
4000
4001 trace_pci_nvme_create_sq(prp1, sqid, cqid, qsize, qflags);
4002
4003 if (unlikely(!cqid || nvme_check_cqid(n, cqid))) {
4004 trace_pci_nvme_err_invalid_create_sq_cqid(cqid);
4005 return NVME_INVALID_CQID | NVME_DNR;
4006 }
4007 if (unlikely(!sqid || sqid > n->params.max_ioqpairs ||
4008 n->sq[sqid] != NULL)) {
4009 trace_pci_nvme_err_invalid_create_sq_sqid(sqid);
4010 return NVME_INVALID_QID | NVME_DNR;
4011 }
4012 if (unlikely(!qsize || qsize > NVME_CAP_MQES(n->bar.cap))) {
4013 trace_pci_nvme_err_invalid_create_sq_size(qsize);
4014 return NVME_MAX_QSIZE_EXCEEDED | NVME_DNR;
4015 }
4016 if (unlikely(prp1 & (n->page_size - 1))) {
4017 trace_pci_nvme_err_invalid_create_sq_addr(prp1);
4018 return NVME_INVALID_PRP_OFFSET | NVME_DNR;
4019 }
4020 if (unlikely(!(NVME_SQ_FLAGS_PC(qflags)))) {
4021 trace_pci_nvme_err_invalid_create_sq_qflags(NVME_SQ_FLAGS_PC(qflags));
4022 return NVME_INVALID_FIELD | NVME_DNR;
4023 }
4024 sq = g_malloc0(sizeof(*sq));
4025 nvme_init_sq(sq, n, prp1, sqid, cqid, qsize + 1);
4026 return NVME_SUCCESS;
4027 }
4028
4029 struct nvme_stats {
4030 uint64_t units_read;
4031 uint64_t units_written;
4032 uint64_t read_commands;
4033 uint64_t write_commands;
4034 };
4035
4036 static void nvme_set_blk_stats(NvmeNamespace *ns, struct nvme_stats *stats)
4037 {
4038 BlockAcctStats *s = blk_get_stats(ns->blkconf.blk);
4039
4040 stats->units_read += s->nr_bytes[BLOCK_ACCT_READ] >> BDRV_SECTOR_BITS;
4041 stats->units_written += s->nr_bytes[BLOCK_ACCT_WRITE] >> BDRV_SECTOR_BITS;
4042 stats->read_commands += s->nr_ops[BLOCK_ACCT_READ];
4043 stats->write_commands += s->nr_ops[BLOCK_ACCT_WRITE];
4044 }
4045
4046 static uint16_t nvme_smart_info(NvmeCtrl *n, uint8_t rae, uint32_t buf_len,
4047 uint64_t off, NvmeRequest *req)
4048 {
4049 uint32_t nsid = le32_to_cpu(req->cmd.nsid);
4050 struct nvme_stats stats = { 0 };
4051 NvmeSmartLog smart = { 0 };
4052 uint32_t trans_len;
4053 NvmeNamespace *ns;
4054 time_t current_ms;
4055
4056 if (off >= sizeof(smart)) {
4057 return NVME_INVALID_FIELD | NVME_DNR;
4058 }
4059
4060 if (nsid != 0xffffffff) {
4061 ns = nvme_ns(n, nsid);
4062 if (!ns) {
4063 return NVME_INVALID_NSID | NVME_DNR;
4064 }
4065 nvme_set_blk_stats(ns, &stats);
4066 } else {
4067 int i;
4068
4069 for (i = 1; i <= NVME_MAX_NAMESPACES; i++) {
4070 ns = nvme_ns(n, i);
4071 if (!ns) {
4072 continue;
4073 }
4074 nvme_set_blk_stats(ns, &stats);
4075 }
4076 }
4077
4078 trans_len = MIN(sizeof(smart) - off, buf_len);
4079 smart.critical_warning = n->smart_critical_warning;
4080
4081 smart.data_units_read[0] = cpu_to_le64(DIV_ROUND_UP(stats.units_read,
4082 1000));
4083 smart.data_units_written[0] = cpu_to_le64(DIV_ROUND_UP(stats.units_written,
4084 1000));
4085 smart.host_read_commands[0] = cpu_to_le64(stats.read_commands);
4086 smart.host_write_commands[0] = cpu_to_le64(stats.write_commands);
4087
4088 smart.temperature = cpu_to_le16(n->temperature);
4089
4090 if ((n->temperature >= n->features.temp_thresh_hi) ||
4091 (n->temperature <= n->features.temp_thresh_low)) {
4092 smart.critical_warning |= NVME_SMART_TEMPERATURE;
4093 }
4094
4095 current_ms = qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL);
4096 smart.power_on_hours[0] =
4097 cpu_to_le64((((current_ms - n->starttime_ms) / 1000) / 60) / 60);
4098
4099 if (!rae) {
4100 nvme_clear_events(n, NVME_AER_TYPE_SMART);
4101 }
4102
4103 return nvme_c2h(n, (uint8_t *) &smart + off, trans_len, req);
4104 }
4105
4106 static uint16_t nvme_fw_log_info(NvmeCtrl *n, uint32_t buf_len, uint64_t off,
4107 NvmeRequest *req)
4108 {
4109 uint32_t trans_len;
4110 NvmeFwSlotInfoLog fw_log = {
4111 .afi = 0x1,
4112 };
4113
4114 if (off >= sizeof(fw_log)) {
4115 return NVME_INVALID_FIELD | NVME_DNR;
4116 }
4117
4118 strpadcpy((char *)&fw_log.frs1, sizeof(fw_log.frs1), "1.0", ' ');
4119 trans_len = MIN(sizeof(fw_log) - off, buf_len);
4120
4121 return nvme_c2h(n, (uint8_t *) &fw_log + off, trans_len, req);
4122 }
4123
4124 static uint16_t nvme_error_info(NvmeCtrl *n, uint8_t rae, uint32_t buf_len,
4125 uint64_t off, NvmeRequest *req)
4126 {
4127 uint32_t trans_len;
4128 NvmeErrorLog errlog;
4129
4130 if (off >= sizeof(errlog)) {
4131 return NVME_INVALID_FIELD | NVME_DNR;
4132 }
4133
4134 if (!rae) {
4135 nvme_clear_events(n, NVME_AER_TYPE_ERROR);
4136 }
4137
4138 memset(&errlog, 0x0, sizeof(errlog));
4139 trans_len = MIN(sizeof(errlog) - off, buf_len);
4140
4141 return nvme_c2h(n, (uint8_t *)&errlog, trans_len, req);
4142 }
4143
4144 static uint16_t nvme_changed_nslist(NvmeCtrl *n, uint8_t rae, uint32_t buf_len,
4145 uint64_t off, NvmeRequest *req)
4146 {
4147 uint32_t nslist[1024];
4148 uint32_t trans_len;
4149 int i = 0;
4150 uint32_t nsid;
4151
4152 memset(nslist, 0x0, sizeof(nslist));
4153 trans_len = MIN(sizeof(nslist) - off, buf_len);
4154
4155 while ((nsid = find_first_bit(n->changed_nsids, NVME_CHANGED_NSID_SIZE)) !=
4156 NVME_CHANGED_NSID_SIZE) {
4157 /*
4158 * If more than 1024 namespaces, the first entry in the log page should
4159 * be set to FFFFFFFFh and the others to 0 as spec.
4160 */
4161 if (i == ARRAY_SIZE(nslist)) {
4162 memset(nslist, 0x0, sizeof(nslist));
4163 nslist[0] = 0xffffffff;
4164 break;
4165 }
4166
4167 nslist[i++] = nsid;
4168 clear_bit(nsid, n->changed_nsids);
4169 }
4170
4171 /*
4172 * Remove all the remaining list entries in case returns directly due to
4173 * more than 1024 namespaces.
4174 */
4175 if (nslist[0] == 0xffffffff) {
4176 bitmap_zero(n->changed_nsids, NVME_CHANGED_NSID_SIZE);
4177 }
4178
4179 if (!rae) {
4180 nvme_clear_events(n, NVME_AER_TYPE_NOTICE);
4181 }
4182
4183 return nvme_c2h(n, ((uint8_t *)nslist) + off, trans_len, req);
4184 }
4185
4186 static uint16_t nvme_cmd_effects(NvmeCtrl *n, uint8_t csi, uint32_t buf_len,
4187 uint64_t off, NvmeRequest *req)
4188 {
4189 NvmeEffectsLog log = {};
4190 const uint32_t *src_iocs = NULL;
4191 uint32_t trans_len;
4192
4193 if (off >= sizeof(log)) {
4194 trace_pci_nvme_err_invalid_log_page_offset(off, sizeof(log));
4195 return NVME_INVALID_FIELD | NVME_DNR;
4196 }
4197
4198 switch (NVME_CC_CSS(n->bar.cc)) {
4199 case NVME_CC_CSS_NVM:
4200 src_iocs = nvme_cse_iocs_nvm;
4201 /* fall through */
4202 case NVME_CC_CSS_ADMIN_ONLY:
4203 break;
4204 case NVME_CC_CSS_CSI:
4205 switch (csi) {
4206 case NVME_CSI_NVM:
4207 src_iocs = nvme_cse_iocs_nvm;
4208 break;
4209 case NVME_CSI_ZONED:
4210 src_iocs = nvme_cse_iocs_zoned;
4211 break;
4212 }
4213 }
4214
4215 memcpy(log.acs, nvme_cse_acs, sizeof(nvme_cse_acs));
4216
4217 if (src_iocs) {
4218 memcpy(log.iocs, src_iocs, sizeof(log.iocs));
4219 }
4220
4221 trans_len = MIN(sizeof(log) - off, buf_len);
4222
4223 return nvme_c2h(n, ((uint8_t *)&log) + off, trans_len, req);
4224 }
4225
4226 static uint16_t nvme_get_log(NvmeCtrl *n, NvmeRequest *req)
4227 {
4228 NvmeCmd *cmd = &req->cmd;
4229
4230 uint32_t dw10 = le32_to_cpu(cmd->cdw10);
4231 uint32_t dw11 = le32_to_cpu(cmd->cdw11);
4232 uint32_t dw12 = le32_to_cpu(cmd->cdw12);
4233 uint32_t dw13 = le32_to_cpu(cmd->cdw13);
4234 uint8_t lid = dw10 & 0xff;
4235 uint8_t lsp = (dw10 >> 8) & 0xf;
4236 uint8_t rae = (dw10 >> 15) & 0x1;
4237 uint8_t csi = le32_to_cpu(cmd->cdw14) >> 24;
4238 uint32_t numdl, numdu;
4239 uint64_t off, lpol, lpou;
4240 size_t len;
4241 uint16_t status;
4242
4243 numdl = (dw10 >> 16);
4244 numdu = (dw11 & 0xffff);
4245 lpol = dw12;
4246 lpou = dw13;
4247
4248 len = (((numdu << 16) | numdl) + 1) << 2;
4249 off = (lpou << 32ULL) | lpol;
4250
4251 if (off & 0x3) {
4252 return NVME_INVALID_FIELD | NVME_DNR;
4253 }
4254
4255 trace_pci_nvme_get_log(nvme_cid(req), lid, lsp, rae, len, off);
4256
4257 status = nvme_check_mdts(n, len);
4258 if (status) {
4259 return status;
4260 }
4261
4262 switch (lid) {
4263 case NVME_LOG_ERROR_INFO:
4264 return nvme_error_info(n, rae, len, off, req);
4265 case NVME_LOG_SMART_INFO:
4266 return nvme_smart_info(n, rae, len, off, req);
4267 case NVME_LOG_FW_SLOT_INFO:
4268 return nvme_fw_log_info(n, len, off, req);
4269 case NVME_LOG_CHANGED_NSLIST:
4270 return nvme_changed_nslist(n, rae, len, off, req);
4271 case NVME_LOG_CMD_EFFECTS:
4272 return nvme_cmd_effects(n, csi, len, off, req);
4273 default:
4274 trace_pci_nvme_err_invalid_log_page(nvme_cid(req), lid);
4275 return NVME_INVALID_FIELD | NVME_DNR;
4276 }
4277 }
4278
4279 static void nvme_free_cq(NvmeCQueue *cq, NvmeCtrl *n)
4280 {
4281 n->cq[cq->cqid] = NULL;
4282 timer_free(cq->timer);
4283 if (msix_enabled(&n->parent_obj)) {
4284 msix_vector_unuse(&n->parent_obj, cq->vector);
4285 }
4286 if (cq->cqid) {
4287 g_free(cq);
4288 }
4289 }
4290
4291 static uint16_t nvme_del_cq(NvmeCtrl *n, NvmeRequest *req)
4292 {
4293 NvmeDeleteQ *c = (NvmeDeleteQ *)&req->cmd;
4294 NvmeCQueue *cq;
4295 uint16_t qid = le16_to_cpu(c->qid);
4296
4297 if (unlikely(!qid || nvme_check_cqid(n, qid))) {
4298 trace_pci_nvme_err_invalid_del_cq_cqid(qid);
4299 return NVME_INVALID_CQID | NVME_DNR;
4300 }
4301
4302 cq = n->cq[qid];
4303 if (unlikely(!QTAILQ_EMPTY(&cq->sq_list))) {
4304 trace_pci_nvme_err_invalid_del_cq_notempty(qid);
4305 return NVME_INVALID_QUEUE_DEL;
4306 }
4307
4308 if (cq->irq_enabled && cq->tail != cq->head) {
4309 n->cq_pending--;
4310 }
4311
4312 nvme_irq_deassert(n, cq);
4313 trace_pci_nvme_del_cq(qid);
4314 nvme_free_cq(cq, n);
4315 return NVME_SUCCESS;
4316 }
4317
4318 static void nvme_init_cq(NvmeCQueue *cq, NvmeCtrl *n, uint64_t dma_addr,
4319 uint16_t cqid, uint16_t vector, uint16_t size,
4320 uint16_t irq_enabled)
4321 {
4322 int ret;
4323
4324 if (msix_enabled(&n->parent_obj)) {
4325 ret = msix_vector_use(&n->parent_obj, vector);
4326 assert(ret == 0);
4327 }
4328 cq->ctrl = n;
4329 cq->cqid = cqid;
4330 cq->size = size;
4331 cq->dma_addr = dma_addr;
4332 cq->phase = 1;
4333 cq->irq_enabled = irq_enabled;
4334 cq->vector = vector;
4335 cq->head = cq->tail = 0;
4336 QTAILQ_INIT(&cq->req_list);
4337 QTAILQ_INIT(&cq->sq_list);
4338 n->cq[cqid] = cq;
4339 cq->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, nvme_post_cqes, cq);
4340 }
4341
4342 static uint16_t nvme_create_cq(NvmeCtrl *n, NvmeRequest *req)
4343 {
4344 NvmeCQueue *cq;
4345 NvmeCreateCq *c = (NvmeCreateCq *)&req->cmd;
4346 uint16_t cqid = le16_to_cpu(c->cqid);
4347 uint16_t vector = le16_to_cpu(c->irq_vector);
4348 uint16_t qsize = le16_to_cpu(c->qsize);
4349 uint16_t qflags = le16_to_cpu(c->cq_flags);
4350 uint64_t prp1 = le64_to_cpu(c->prp1);
4351
4352 trace_pci_nvme_create_cq(prp1, cqid, vector, qsize, qflags,
4353 NVME_CQ_FLAGS_IEN(qflags) != 0);
4354
4355 if (unlikely(!cqid || cqid > n->params.max_ioqpairs ||
4356 n->cq[cqid] != NULL)) {
4357 trace_pci_nvme_err_invalid_create_cq_cqid(cqid);
4358 return NVME_INVALID_QID | NVME_DNR;
4359 }
4360 if (unlikely(!qsize || qsize > NVME_CAP_MQES(n->bar.cap))) {
4361 trace_pci_nvme_err_invalid_create_cq_size(qsize);
4362 return NVME_MAX_QSIZE_EXCEEDED | NVME_DNR;
4363 }
4364 if (unlikely(prp1 & (n->page_size - 1))) {
4365 trace_pci_nvme_err_invalid_create_cq_addr(prp1);
4366 return NVME_INVALID_PRP_OFFSET | NVME_DNR;
4367 }
4368 if (unlikely(!msix_enabled(&n->parent_obj) && vector)) {
4369 trace_pci_nvme_err_invalid_create_cq_vector(vector);
4370 return NVME_INVALID_IRQ_VECTOR | NVME_DNR;
4371 }
4372 if (unlikely(vector >= n->params.msix_qsize)) {
4373 trace_pci_nvme_err_invalid_create_cq_vector(vector);
4374 return NVME_INVALID_IRQ_VECTOR | NVME_DNR;
4375 }
4376 if (unlikely(!(NVME_CQ_FLAGS_PC(qflags)))) {
4377 trace_pci_nvme_err_invalid_create_cq_qflags(NVME_CQ_FLAGS_PC(qflags));
4378 return NVME_INVALID_FIELD | NVME_DNR;
4379 }
4380
4381 cq = g_malloc0(sizeof(*cq));
4382 nvme_init_cq(cq, n, prp1, cqid, vector, qsize + 1,
4383 NVME_CQ_FLAGS_IEN(qflags));
4384
4385 /*
4386 * It is only required to set qs_created when creating a completion queue;
4387 * creating a submission queue without a matching completion queue will
4388 * fail.
4389 */
4390 n->qs_created = true;
4391 return NVME_SUCCESS;
4392 }
4393
4394 static uint16_t nvme_rpt_empty_id_struct(NvmeCtrl *n, NvmeRequest *req)
4395 {
4396 uint8_t id[NVME_IDENTIFY_DATA_SIZE] = {};
4397
4398 return nvme_c2h(n, id, sizeof(id), req);
4399 }
4400
4401 static uint16_t nvme_identify_ctrl(NvmeCtrl *n, NvmeRequest *req)
4402 {
4403 trace_pci_nvme_identify_ctrl();
4404
4405 return nvme_c2h(n, (uint8_t *)&n->id_ctrl, sizeof(n->id_ctrl), req);
4406 }
4407
4408 static uint16_t nvme_identify_ctrl_csi(NvmeCtrl *n, NvmeRequest *req)
4409 {
4410 NvmeIdentify *c = (NvmeIdentify *)&req->cmd;
4411 uint8_t id[NVME_IDENTIFY_DATA_SIZE] = {};
4412 NvmeIdCtrlNvm *id_nvm = (NvmeIdCtrlNvm *)&id;
4413
4414 trace_pci_nvme_identify_ctrl_csi(c->csi);
4415
4416 switch (c->csi) {
4417 case NVME_CSI_NVM:
4418 id_nvm->vsl = n->params.vsl;
4419 id_nvm->dmrsl = cpu_to_le32(n->dmrsl);
4420 break;
4421
4422 case NVME_CSI_ZONED:
4423 ((NvmeIdCtrlZoned *)&id)->zasl = n->params.zasl;
4424 break;
4425
4426 default:
4427 return NVME_INVALID_FIELD | NVME_DNR;
4428 }
4429
4430 return nvme_c2h(n, id, sizeof(id), req);
4431 }
4432
4433 static uint16_t nvme_identify_ns(NvmeCtrl *n, NvmeRequest *req, bool active)
4434 {
4435 NvmeNamespace *ns;
4436 NvmeIdentify *c = (NvmeIdentify *)&req->cmd;
4437 uint32_t nsid = le32_to_cpu(c->nsid);
4438
4439 trace_pci_nvme_identify_ns(nsid);
4440
4441 if (!nvme_nsid_valid(n, nsid) || nsid == NVME_NSID_BROADCAST) {
4442 return NVME_INVALID_NSID | NVME_DNR;
4443 }
4444
4445 ns = nvme_ns(n, nsid);
4446 if (unlikely(!ns)) {
4447 if (!active) {
4448 ns = nvme_subsys_ns(n->subsys, nsid);
4449 if (!ns) {
4450 return nvme_rpt_empty_id_struct(n, req);
4451 }
4452 } else {
4453 return nvme_rpt_empty_id_struct(n, req);
4454 }
4455 }
4456
4457 if (active || ns->csi == NVME_CSI_NVM) {
4458 return nvme_c2h(n, (uint8_t *)&ns->id_ns, sizeof(NvmeIdNs), req);
4459 }
4460
4461 return NVME_INVALID_CMD_SET | NVME_DNR;
4462 }
4463
4464 static uint16_t nvme_identify_ctrl_list(NvmeCtrl *n, NvmeRequest *req,
4465 bool attached)
4466 {
4467 NvmeIdentify *c = (NvmeIdentify *)&req->cmd;
4468 uint32_t nsid = le32_to_cpu(c->nsid);
4469 uint16_t min_id = le16_to_cpu(c->ctrlid);
4470 uint16_t list[NVME_CONTROLLER_LIST_SIZE] = {};
4471 uint16_t *ids = &list[1];
4472 NvmeNamespace *ns;
4473 NvmeCtrl *ctrl;
4474 int cntlid, nr_ids = 0;
4475
4476 trace_pci_nvme_identify_ctrl_list(c->cns, min_id);
4477
4478 if (!n->subsys) {
4479 return NVME_INVALID_FIELD | NVME_DNR;
4480 }
4481
4482 if (attached) {
4483 if (nsid == NVME_NSID_BROADCAST) {
4484 return NVME_INVALID_FIELD | NVME_DNR;
4485 }
4486
4487 ns = nvme_subsys_ns(n->subsys, nsid);
4488 if (!ns) {
4489 return NVME_INVALID_FIELD | NVME_DNR;
4490 }
4491 }
4492
4493 for (cntlid = min_id; cntlid < ARRAY_SIZE(n->subsys->ctrls); cntlid++) {
4494 ctrl = nvme_subsys_ctrl(n->subsys, cntlid);
4495 if (!ctrl) {
4496 continue;
4497 }
4498
4499 if (attached && !nvme_ns(ctrl, nsid)) {
4500 continue;
4501 }
4502
4503 ids[nr_ids++] = cntlid;
4504 }
4505
4506 list[0] = nr_ids;
4507
4508 return nvme_c2h(n, (uint8_t *)list, sizeof(list), req);
4509 }
4510
4511 static uint16_t nvme_identify_ns_csi(NvmeCtrl *n, NvmeRequest *req,
4512 bool active)
4513 {
4514 NvmeNamespace *ns;
4515 NvmeIdentify *c = (NvmeIdentify *)&req->cmd;
4516 uint32_t nsid = le32_to_cpu(c->nsid);
4517
4518 trace_pci_nvme_identify_ns_csi(nsid, c->csi);
4519
4520 if (!nvme_nsid_valid(n, nsid) || nsid == NVME_NSID_BROADCAST) {
4521 return NVME_INVALID_NSID | NVME_DNR;
4522 }
4523
4524 ns = nvme_ns(n, nsid);
4525 if (unlikely(!ns)) {
4526 if (!active) {
4527 ns = nvme_subsys_ns(n->subsys, nsid);
4528 if (!ns) {
4529 return nvme_rpt_empty_id_struct(n, req);
4530 }
4531 } else {
4532 return nvme_rpt_empty_id_struct(n, req);
4533 }
4534 }
4535
4536 if (c->csi == NVME_CSI_NVM) {
4537 return nvme_rpt_empty_id_struct(n, req);
4538 } else if (c->csi == NVME_CSI_ZONED && ns->csi == NVME_CSI_ZONED) {
4539 return nvme_c2h(n, (uint8_t *)ns->id_ns_zoned, sizeof(NvmeIdNsZoned),
4540 req);
4541 }
4542
4543 return NVME_INVALID_FIELD | NVME_DNR;
4544 }
4545
4546 static uint16_t nvme_identify_nslist(NvmeCtrl *n, NvmeRequest *req,
4547 bool active)
4548 {
4549 NvmeNamespace *ns;
4550 NvmeIdentify *c = (NvmeIdentify *)&req->cmd;
4551 uint32_t min_nsid = le32_to_cpu(c->nsid);
4552 uint8_t list[NVME_IDENTIFY_DATA_SIZE] = {};
4553 static const int data_len = sizeof(list);
4554 uint32_t *list_ptr = (uint32_t *)list;
4555 int i, j = 0;
4556
4557 trace_pci_nvme_identify_nslist(min_nsid);
4558
4559 /*
4560 * Both FFFFFFFFh (NVME_NSID_BROADCAST) and FFFFFFFFEh are invalid values
4561 * since the Active Namespace ID List should return namespaces with ids
4562 * *higher* than the NSID specified in the command. This is also specified
4563 * in the spec (NVM Express v1.3d, Section 5.15.4).
4564 */
4565 if (min_nsid >= NVME_NSID_BROADCAST - 1) {
4566 return NVME_INVALID_NSID | NVME_DNR;
4567 }
4568
4569 for (i = 1; i <= NVME_MAX_NAMESPACES; i++) {
4570 ns = nvme_ns(n, i);
4571 if (!ns) {
4572 if (!active) {
4573 ns = nvme_subsys_ns(n->subsys, i);
4574 if (!ns) {
4575 continue;
4576 }
4577 } else {
4578 continue;
4579 }
4580 }
4581 if (ns->params.nsid <= min_nsid) {
4582 continue;
4583 }
4584 list_ptr[j++] = cpu_to_le32(ns->params.nsid);
4585 if (j == data_len / sizeof(uint32_t)) {
4586 break;
4587 }
4588 }
4589
4590 return nvme_c2h(n, list, data_len, req);
4591 }
4592
4593 static uint16_t nvme_identify_nslist_csi(NvmeCtrl *n, NvmeRequest *req,
4594 bool active)
4595 {
4596 NvmeNamespace *ns;
4597 NvmeIdentify *c = (NvmeIdentify *)&req->cmd;
4598 uint32_t min_nsid = le32_to_cpu(c->nsid);
4599 uint8_t list[NVME_IDENTIFY_DATA_SIZE] = {};
4600 static const int data_len = sizeof(list);
4601 uint32_t *list_ptr = (uint32_t *)list;
4602 int i, j = 0;
4603
4604 trace_pci_nvme_identify_nslist_csi(min_nsid, c->csi);
4605
4606 /*
4607 * Same as in nvme_identify_nslist(), FFFFFFFFh/FFFFFFFFEh are invalid.
4608 */
4609 if (min_nsid >= NVME_NSID_BROADCAST - 1) {
4610 return NVME_INVALID_NSID | NVME_DNR;
4611 }
4612
4613 if (c->csi != NVME_CSI_NVM && c->csi != NVME_CSI_ZONED) {
4614 return NVME_INVALID_FIELD | NVME_DNR;
4615 }
4616
4617 for (i = 1; i <= NVME_MAX_NAMESPACES; i++) {
4618 ns = nvme_ns(n, i);
4619 if (!ns) {
4620 if (!active) {
4621 ns = nvme_subsys_ns(n->subsys, i);
4622 if (!ns) {
4623 continue;
4624 }
4625 } else {
4626 continue;
4627 }
4628 }
4629 if (ns->params.nsid <= min_nsid || c->csi != ns->csi) {
4630 continue;
4631 }
4632 list_ptr[j++] = cpu_to_le32(ns->params.nsid);
4633 if (j == data_len / sizeof(uint32_t)) {
4634 break;
4635 }
4636 }
4637
4638 return nvme_c2h(n, list, data_len, req);
4639 }
4640
4641 static uint16_t nvme_identify_ns_descr_list(NvmeCtrl *n, NvmeRequest *req)
4642 {
4643 NvmeNamespace *ns;
4644 NvmeIdentify *c = (NvmeIdentify *)&req->cmd;
4645 uint32_t nsid = le32_to_cpu(c->nsid);
4646 uint8_t list[NVME_IDENTIFY_DATA_SIZE] = {};
4647 uint8_t *pos = list;
4648 struct {
4649 NvmeIdNsDescr hdr;
4650 uint8_t v[NVME_NIDL_UUID];
4651 } QEMU_PACKED uuid;
4652 struct {
4653 NvmeIdNsDescr hdr;
4654 uint64_t v;
4655 } QEMU_PACKED eui64;
4656 struct {
4657 NvmeIdNsDescr hdr;
4658 uint8_t v;
4659 } QEMU_PACKED csi;
4660
4661 trace_pci_nvme_identify_ns_descr_list(nsid);
4662
4663 if (!nvme_nsid_valid(n, nsid) || nsid == NVME_NSID_BROADCAST) {
4664 return NVME_INVALID_NSID | NVME_DNR;
4665 }
4666
4667 ns = nvme_ns(n, nsid);
4668 if (unlikely(!ns)) {
4669 return NVME_INVALID_FIELD | NVME_DNR;
4670 }
4671
4672 /*
4673 * If the EUI-64 field is 0 and the NGUID field is 0, the namespace must
4674 * provide a valid Namespace UUID in the Namespace Identification Descriptor
4675 * data structure. QEMU does not yet support setting NGUID.
4676 */
4677 uuid.hdr.nidt = NVME_NIDT_UUID;
4678 uuid.hdr.nidl = NVME_NIDL_UUID;
4679 memcpy(uuid.v, ns->params.uuid.data, NVME_NIDL_UUID);
4680 memcpy(pos, &uuid, sizeof(uuid));
4681 pos += sizeof(uuid);
4682
4683 if (ns->params.eui64) {
4684 eui64.hdr.nidt = NVME_NIDT_EUI64;
4685 eui64.hdr.nidl = NVME_NIDL_EUI64;
4686 eui64.v = cpu_to_be64(ns->params.eui64);
4687 memcpy(pos, &eui64, sizeof(eui64));
4688 pos += sizeof(eui64);
4689 }
4690
4691 csi.hdr.nidt = NVME_NIDT_CSI;
4692 csi.hdr.nidl = NVME_NIDL_CSI;
4693 csi.v = ns->csi;
4694 memcpy(pos, &csi, sizeof(csi));
4695 pos += sizeof(csi);
4696
4697 return nvme_c2h(n, list, sizeof(list), req);
4698 }
4699
4700 static uint16_t nvme_identify_cmd_set(NvmeCtrl *n, NvmeRequest *req)
4701 {
4702 uint8_t list[NVME_IDENTIFY_DATA_SIZE] = {};
4703 static const int data_len = sizeof(list);
4704
4705 trace_pci_nvme_identify_cmd_set();
4706
4707 NVME_SET_CSI(*list, NVME_CSI_NVM);
4708 NVME_SET_CSI(*list, NVME_CSI_ZONED);
4709
4710 return nvme_c2h(n, list, data_len, req);
4711 }
4712
4713 static uint16_t nvme_identify(NvmeCtrl *n, NvmeRequest *req)
4714 {
4715 NvmeIdentify *c = (NvmeIdentify *)&req->cmd;
4716
4717 trace_pci_nvme_identify(nvme_cid(req), c->cns, le16_to_cpu(c->ctrlid),
4718 c->csi);
4719
4720 switch (c->cns) {
4721 case NVME_ID_CNS_NS:
4722 return nvme_identify_ns(n, req, true);
4723 case NVME_ID_CNS_NS_PRESENT:
4724 return nvme_identify_ns(n, req, false);
4725 case NVME_ID_CNS_NS_ATTACHED_CTRL_LIST:
4726 return nvme_identify_ctrl_list(n, req, true);
4727 case NVME_ID_CNS_CTRL_LIST:
4728 return nvme_identify_ctrl_list(n, req, false);
4729 case NVME_ID_CNS_CS_NS:
4730 return nvme_identify_ns_csi(n, req, true);
4731 case NVME_ID_CNS_CS_NS_PRESENT:
4732 return nvme_identify_ns_csi(n, req, false);
4733 case NVME_ID_CNS_CTRL:
4734 return nvme_identify_ctrl(n, req);
4735 case NVME_ID_CNS_CS_CTRL:
4736 return nvme_identify_ctrl_csi(n, req);
4737 case NVME_ID_CNS_NS_ACTIVE_LIST:
4738 return nvme_identify_nslist(n, req, true);
4739 case NVME_ID_CNS_NS_PRESENT_LIST:
4740 return nvme_identify_nslist(n, req, false);
4741 case NVME_ID_CNS_CS_NS_ACTIVE_LIST:
4742 return nvme_identify_nslist_csi(n, req, true);
4743 case NVME_ID_CNS_CS_NS_PRESENT_LIST:
4744 return nvme_identify_nslist_csi(n, req, false);
4745 case NVME_ID_CNS_NS_DESCR_LIST:
4746 return nvme_identify_ns_descr_list(n, req);
4747 case NVME_ID_CNS_IO_COMMAND_SET:
4748 return nvme_identify_cmd_set(n, req);
4749 default:
4750 trace_pci_nvme_err_invalid_identify_cns(le32_to_cpu(c->cns));
4751 return NVME_INVALID_FIELD | NVME_DNR;
4752 }
4753 }
4754
4755 static uint16_t nvme_abort(NvmeCtrl *n, NvmeRequest *req)
4756 {
4757 uint16_t sqid = le32_to_cpu(req->cmd.cdw10) & 0xffff;
4758
4759 req->cqe.result = 1;
4760 if (nvme_check_sqid(n, sqid)) {
4761 return NVME_INVALID_FIELD | NVME_DNR;
4762 }
4763
4764 return NVME_SUCCESS;
4765 }
4766
4767 static inline void nvme_set_timestamp(NvmeCtrl *n, uint64_t ts)
4768 {
4769 trace_pci_nvme_setfeat_timestamp(ts);
4770
4771 n->host_timestamp = le64_to_cpu(ts);
4772 n->timestamp_set_qemu_clock_ms = qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL);
4773 }
4774
4775 static inline uint64_t nvme_get_timestamp(const NvmeCtrl *n)
4776 {
4777 uint64_t current_time = qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL);
4778 uint64_t elapsed_time = current_time - n->timestamp_set_qemu_clock_ms;
4779
4780 union nvme_timestamp {
4781 struct {
4782 uint64_t timestamp:48;
4783 uint64_t sync:1;
4784 uint64_t origin:3;
4785 uint64_t rsvd1:12;
4786 };
4787 uint64_t all;
4788 };
4789
4790 union nvme_timestamp ts;
4791 ts.all = 0;
4792 ts.timestamp = n->host_timestamp + elapsed_time;
4793
4794 /* If the host timestamp is non-zero, set the timestamp origin */
4795 ts.origin = n->host_timestamp ? 0x01 : 0x00;
4796
4797 trace_pci_nvme_getfeat_timestamp(ts.all);
4798
4799 return cpu_to_le64(ts.all);
4800 }
4801
4802 static uint16_t nvme_get_feature_timestamp(NvmeCtrl *n, NvmeRequest *req)
4803 {
4804 uint64_t timestamp = nvme_get_timestamp(n);
4805
4806 return nvme_c2h(n, (uint8_t *)&timestamp, sizeof(timestamp), req);
4807 }
4808
4809 static uint16_t nvme_get_feature(NvmeCtrl *n, NvmeRequest *req)
4810 {
4811 NvmeCmd *cmd = &req->cmd;
4812 uint32_t dw10 = le32_to_cpu(cmd->cdw10);
4813 uint32_t dw11 = le32_to_cpu(cmd->cdw11);
4814 uint32_t nsid = le32_to_cpu(cmd->nsid);
4815 uint32_t result;
4816 uint8_t fid = NVME_GETSETFEAT_FID(dw10);
4817 NvmeGetFeatureSelect sel = NVME_GETFEAT_SELECT(dw10);
4818 uint16_t iv;
4819 NvmeNamespace *ns;
4820 int i;
4821
4822 static const uint32_t nvme_feature_default[NVME_FID_MAX] = {
4823 [NVME_ARBITRATION] = NVME_ARB_AB_NOLIMIT,
4824 };
4825
4826 trace_pci_nvme_getfeat(nvme_cid(req), nsid, fid, sel, dw11);
4827
4828 if (!nvme_feature_support[fid]) {
4829 return NVME_INVALID_FIELD | NVME_DNR;
4830 }
4831
4832 if (nvme_feature_cap[fid] & NVME_FEAT_CAP_NS) {
4833 if (!nvme_nsid_valid(n, nsid) || nsid == NVME_NSID_BROADCAST) {
4834 /*
4835 * The Reservation Notification Mask and Reservation Persistence
4836 * features require a status code of Invalid Field in Command when
4837 * NSID is FFFFFFFFh. Since the device does not support those
4838 * features we can always return Invalid Namespace or Format as we
4839 * should do for all other features.
4840 */
4841 return NVME_INVALID_NSID | NVME_DNR;
4842 }
4843
4844 if (!nvme_ns(n, nsid)) {
4845 return NVME_INVALID_FIELD | NVME_DNR;
4846 }
4847 }
4848
4849 switch (sel) {
4850 case NVME_GETFEAT_SELECT_CURRENT:
4851 break;
4852 case NVME_GETFEAT_SELECT_SAVED:
4853 /* no features are saveable by the controller; fallthrough */
4854 case NVME_GETFEAT_SELECT_DEFAULT:
4855 goto defaults;
4856 case NVME_GETFEAT_SELECT_CAP:
4857 result = nvme_feature_cap[fid];
4858 goto out;
4859 }
4860
4861 switch (fid) {
4862 case NVME_TEMPERATURE_THRESHOLD:
4863 result = 0;
4864
4865 /*
4866 * The controller only implements the Composite Temperature sensor, so
4867 * return 0 for all other sensors.
4868 */
4869 if (NVME_TEMP_TMPSEL(dw11) != NVME_TEMP_TMPSEL_COMPOSITE) {
4870 goto out;
4871 }
4872
4873 switch (NVME_TEMP_THSEL(dw11)) {
4874 case NVME_TEMP_THSEL_OVER:
4875 result = n->features.temp_thresh_hi;
4876 goto out;
4877 case NVME_TEMP_THSEL_UNDER:
4878 result = n->features.temp_thresh_low;
4879 goto out;
4880 }
4881
4882 return NVME_INVALID_FIELD | NVME_DNR;
4883 case NVME_ERROR_RECOVERY:
4884 if (!nvme_nsid_valid(n, nsid)) {
4885 return NVME_INVALID_NSID | NVME_DNR;
4886 }
4887
4888 ns = nvme_ns(n, nsid);
4889 if (unlikely(!ns)) {
4890 return NVME_INVALID_FIELD | NVME_DNR;
4891 }
4892
4893 result = ns->features.err_rec;
4894 goto out;
4895 case NVME_VOLATILE_WRITE_CACHE:
4896 result = 0;
4897 for (i = 1; i <= NVME_MAX_NAMESPACES; i++) {
4898 ns = nvme_ns(n, i);
4899 if (!ns) {
4900 continue;
4901 }
4902
4903 result = blk_enable_write_cache(ns->blkconf.blk);
4904 if (result) {
4905 break;
4906 }
4907 }
4908 trace_pci_nvme_getfeat_vwcache(result ? "enabled" : "disabled");
4909 goto out;
4910 case NVME_ASYNCHRONOUS_EVENT_CONF:
4911 result = n->features.async_config;
4912 goto out;
4913 case NVME_TIMESTAMP:
4914 return nvme_get_feature_timestamp(n, req);
4915 default:
4916 break;
4917 }
4918
4919 defaults:
4920 switch (fid) {
4921 case NVME_TEMPERATURE_THRESHOLD:
4922 result = 0;
4923
4924 if (NVME_TEMP_TMPSEL(dw11) != NVME_TEMP_TMPSEL_COMPOSITE) {
4925 break;
4926 }
4927
4928 if (NVME_TEMP_THSEL(dw11) == NVME_TEMP_THSEL_OVER) {
4929 result = NVME_TEMPERATURE_WARNING;
4930 }
4931
4932 break;
4933 case NVME_NUMBER_OF_QUEUES:
4934 result = (n->params.max_ioqpairs - 1) |
4935 ((n->params.max_ioqpairs - 1) << 16);
4936 trace_pci_nvme_getfeat_numq(result);
4937 break;
4938 case NVME_INTERRUPT_VECTOR_CONF:
4939 iv = dw11 & 0xffff;
4940 if (iv >= n->params.max_ioqpairs + 1) {
4941 return NVME_INVALID_FIELD | NVME_DNR;
4942 }
4943
4944 result = iv;
4945 if (iv == n->admin_cq.vector) {
4946 result |= NVME_INTVC_NOCOALESCING;
4947 }
4948 break;
4949 default:
4950 result = nvme_feature_default[fid];
4951 break;
4952 }
4953
4954 out:
4955 req->cqe.result = cpu_to_le32(result);
4956 return NVME_SUCCESS;
4957 }
4958
4959 static uint16_t nvme_set_feature_timestamp(NvmeCtrl *n, NvmeRequest *req)
4960 {
4961 uint16_t ret;
4962 uint64_t timestamp;
4963
4964 ret = nvme_h2c(n, (uint8_t *)&timestamp, sizeof(timestamp), req);
4965 if (ret) {
4966 return ret;
4967 }
4968
4969 nvme_set_timestamp(n, timestamp);
4970
4971 return NVME_SUCCESS;
4972 }
4973
4974 static uint16_t nvme_set_feature(NvmeCtrl *n, NvmeRequest *req)
4975 {
4976 NvmeNamespace *ns = NULL;
4977
4978 NvmeCmd *cmd = &req->cmd;
4979 uint32_t dw10 = le32_to_cpu(cmd->cdw10);
4980 uint32_t dw11 = le32_to_cpu(cmd->cdw11);
4981 uint32_t nsid = le32_to_cpu(cmd->nsid);
4982 uint8_t fid = NVME_GETSETFEAT_FID(dw10);
4983 uint8_t save = NVME_SETFEAT_SAVE(dw10);
4984 int i;
4985
4986 trace_pci_nvme_setfeat(nvme_cid(req), nsid, fid, save, dw11);
4987
4988 if (save && !(nvme_feature_cap[fid] & NVME_FEAT_CAP_SAVE)) {
4989 return NVME_FID_NOT_SAVEABLE | NVME_DNR;
4990 }
4991
4992 if (!nvme_feature_support[fid]) {
4993 return NVME_INVALID_FIELD | NVME_DNR;
4994 }
4995
4996 if (nvme_feature_cap[fid] & NVME_FEAT_CAP_NS) {
4997 if (nsid != NVME_NSID_BROADCAST) {
4998 if (!nvme_nsid_valid(n, nsid)) {
4999 return NVME_INVALID_NSID | NVME_DNR;
5000 }
5001
5002 ns = nvme_ns(n, nsid);
5003 if (unlikely(!ns)) {
5004 return NVME_INVALID_FIELD | NVME_DNR;
5005 }
5006 }
5007 } else if (nsid && nsid != NVME_NSID_BROADCAST) {
5008 if (!nvme_nsid_valid(n, nsid)) {
5009 return NVME_INVALID_NSID | NVME_DNR;
5010 }
5011
5012 return NVME_FEAT_NOT_NS_SPEC | NVME_DNR;
5013 }
5014
5015 if (!(nvme_feature_cap[fid] & NVME_FEAT_CAP_CHANGE)) {
5016 return NVME_FEAT_NOT_CHANGEABLE | NVME_DNR;
5017 }
5018
5019 switch (fid) {
5020 case NVME_TEMPERATURE_THRESHOLD:
5021 if (NVME_TEMP_TMPSEL(dw11) != NVME_TEMP_TMPSEL_COMPOSITE) {
5022 break;
5023 }
5024
5025 switch (NVME_TEMP_THSEL(dw11)) {
5026 case NVME_TEMP_THSEL_OVER:
5027 n->features.temp_thresh_hi = NVME_TEMP_TMPTH(dw11);
5028 break;
5029 case NVME_TEMP_THSEL_UNDER:
5030 n->features.temp_thresh_low = NVME_TEMP_TMPTH(dw11);
5031 break;
5032 default:
5033 return NVME_INVALID_FIELD | NVME_DNR;
5034 }
5035
5036 if ((n->temperature >= n->features.temp_thresh_hi) ||
5037 (n->temperature <= n->features.temp_thresh_low)) {
5038 nvme_smart_event(n, NVME_AER_INFO_SMART_TEMP_THRESH);
5039 }
5040
5041 break;
5042 case NVME_ERROR_RECOVERY:
5043 if (nsid == NVME_NSID_BROADCAST) {
5044 for (i = 1; i <= NVME_MAX_NAMESPACES; i++) {
5045 ns = nvme_ns(n, i);
5046
5047 if (!ns) {
5048 continue;
5049 }
5050
5051 if (NVME_ID_NS_NSFEAT_DULBE(ns->id_ns.nsfeat)) {
5052 ns->features.err_rec = dw11;
5053 }
5054 }
5055
5056 break;
5057 }
5058
5059 assert(ns);
5060 if (NVME_ID_NS_NSFEAT_DULBE(ns->id_ns.nsfeat)) {
5061 ns->features.err_rec = dw11;
5062 }
5063 break;
5064 case NVME_VOLATILE_WRITE_CACHE:
5065 for (i = 1; i <= NVME_MAX_NAMESPACES; i++) {
5066 ns = nvme_ns(n, i);
5067 if (!ns) {
5068 continue;
5069 }
5070
5071 if (!(dw11 & 0x1) && blk_enable_write_cache(ns->blkconf.blk)) {
5072 blk_flush(ns->blkconf.blk);
5073 }
5074
5075 blk_set_enable_write_cache(ns->blkconf.blk, dw11 & 1);
5076 }
5077
5078 break;
5079
5080 case NVME_NUMBER_OF_QUEUES:
5081 if (n->qs_created) {
5082 return NVME_CMD_SEQ_ERROR | NVME_DNR;
5083 }
5084
5085 /*
5086 * NVMe v1.3, Section 5.21.1.7: FFFFh is not an allowed value for NCQR
5087 * and NSQR.
5088 */
5089 if ((dw11 & 0xffff) == 0xffff || ((dw11 >> 16) & 0xffff) == 0xffff) {
5090 return NVME_INVALID_FIELD | NVME_DNR;
5091 }
5092
5093 trace_pci_nvme_setfeat_numq((dw11 & 0xffff) + 1,
5094 ((dw11 >> 16) & 0xffff) + 1,
5095 n->params.max_ioqpairs,
5096 n->params.max_ioqpairs);
5097 req->cqe.result = cpu_to_le32((n->params.max_ioqpairs - 1) |
5098 ((n->params.max_ioqpairs - 1) << 16));
5099 break;
5100 case NVME_ASYNCHRONOUS_EVENT_CONF:
5101 n->features.async_config = dw11;
5102 break;
5103 case NVME_TIMESTAMP:
5104 return nvme_set_feature_timestamp(n, req);
5105 case NVME_COMMAND_SET_PROFILE:
5106 if (dw11 & 0x1ff) {
5107 trace_pci_nvme_err_invalid_iocsci(dw11 & 0x1ff);
5108 return NVME_CMD_SET_CMB_REJECTED | NVME_DNR;
5109 }
5110 break;
5111 default:
5112 return NVME_FEAT_NOT_CHANGEABLE | NVME_DNR;
5113 }
5114 return NVME_SUCCESS;
5115 }
5116
5117 static uint16_t nvme_aer(NvmeCtrl *n, NvmeRequest *req)
5118 {
5119 trace_pci_nvme_aer(nvme_cid(req));
5120
5121 if (n->outstanding_aers > n->params.aerl) {
5122 trace_pci_nvme_aer_aerl_exceeded();
5123 return NVME_AER_LIMIT_EXCEEDED;
5124 }
5125
5126 n->aer_reqs[n->outstanding_aers] = req;
5127 n->outstanding_aers++;
5128
5129 if (!QTAILQ_EMPTY(&n->aer_queue)) {
5130 nvme_process_aers(n);
5131 }
5132
5133 return NVME_NO_COMPLETE;
5134 }
5135
5136 static void nvme_update_dmrsl(NvmeCtrl *n)
5137 {
5138 int nsid;
5139
5140 for (nsid = 1; nsid <= NVME_MAX_NAMESPACES; nsid++) {
5141 NvmeNamespace *ns = nvme_ns(n, nsid);
5142 if (!ns) {
5143 continue;
5144 }
5145
5146 n->dmrsl = MIN_NON_ZERO(n->dmrsl,
5147 BDRV_REQUEST_MAX_BYTES / nvme_l2b(ns, 1));
5148 }
5149 }
5150
5151 static void nvme_select_iocs_ns(NvmeCtrl *n, NvmeNamespace *ns)
5152 {
5153 ns->iocs = nvme_cse_iocs_none;
5154 switch (ns->csi) {
5155 case NVME_CSI_NVM:
5156 if (NVME_CC_CSS(n->bar.cc) != NVME_CC_CSS_ADMIN_ONLY) {
5157 ns->iocs = nvme_cse_iocs_nvm;
5158 }
5159 break;
5160 case NVME_CSI_ZONED:
5161 if (NVME_CC_CSS(n->bar.cc) == NVME_CC_CSS_CSI) {
5162 ns->iocs = nvme_cse_iocs_zoned;
5163 } else if (NVME_CC_CSS(n->bar.cc) == NVME_CC_CSS_NVM) {
5164 ns->iocs = nvme_cse_iocs_nvm;
5165 }
5166 break;
5167 }
5168 }
5169
5170 static uint16_t nvme_ns_attachment(NvmeCtrl *n, NvmeRequest *req)
5171 {
5172 NvmeNamespace *ns;
5173 NvmeCtrl *ctrl;
5174 uint16_t list[NVME_CONTROLLER_LIST_SIZE] = {};
5175 uint32_t nsid = le32_to_cpu(req->cmd.nsid);
5176 uint32_t dw10 = le32_to_cpu(req->cmd.cdw10);
5177 bool attach = !(dw10 & 0xf);
5178 uint16_t *nr_ids = &list[0];
5179 uint16_t *ids = &list[1];
5180 uint16_t ret;
5181 int i;
5182
5183 trace_pci_nvme_ns_attachment(nvme_cid(req), dw10 & 0xf);
5184
5185 if (!nvme_nsid_valid(n, nsid)) {
5186 return NVME_INVALID_NSID | NVME_DNR;
5187 }
5188
5189 ns = nvme_subsys_ns(n->subsys, nsid);
5190 if (!ns) {
5191 return NVME_INVALID_FIELD | NVME_DNR;
5192 }
5193
5194 ret = nvme_h2c(n, (uint8_t *)list, 4096, req);
5195 if (ret) {
5196 return ret;
5197 }
5198
5199 if (!*nr_ids) {
5200 return NVME_NS_CTRL_LIST_INVALID | NVME_DNR;
5201 }
5202
5203 *nr_ids = MIN(*nr_ids, NVME_CONTROLLER_LIST_SIZE - 1);
5204 for (i = 0; i < *nr_ids; i++) {
5205 ctrl = nvme_subsys_ctrl(n->subsys, ids[i]);
5206 if (!ctrl) {
5207 return NVME_NS_CTRL_LIST_INVALID | NVME_DNR;
5208 }
5209
5210 if (attach) {
5211 if (nvme_ns(ctrl, nsid)) {
5212 return NVME_NS_ALREADY_ATTACHED | NVME_DNR;
5213 }
5214
5215 if (ns->attached && !ns->params.shared) {
5216 return NVME_NS_PRIVATE | NVME_DNR;
5217 }
5218
5219 nvme_attach_ns(ctrl, ns);
5220 nvme_select_iocs_ns(ctrl, ns);
5221 } else {
5222 if (!nvme_ns(ctrl, nsid)) {
5223 return NVME_NS_NOT_ATTACHED | NVME_DNR;
5224 }
5225
5226 ctrl->namespaces[nsid] = NULL;
5227 ns->attached--;
5228
5229 nvme_update_dmrsl(ctrl);
5230 }
5231
5232 /*
5233 * Add namespace id to the changed namespace id list for event clearing
5234 * via Get Log Page command.
5235 */
5236 if (!test_and_set_bit(nsid, ctrl->changed_nsids)) {
5237 nvme_enqueue_event(ctrl, NVME_AER_TYPE_NOTICE,
5238 NVME_AER_INFO_NOTICE_NS_ATTR_CHANGED,
5239 NVME_LOG_CHANGED_NSLIST);
5240 }
5241 }
5242
5243 return NVME_SUCCESS;
5244 }
5245
5246 typedef struct NvmeFormatAIOCB {
5247 BlockAIOCB common;
5248 BlockAIOCB *aiocb;
5249 QEMUBH *bh;
5250 NvmeRequest *req;
5251 int ret;
5252
5253 NvmeNamespace *ns;
5254 uint32_t nsid;
5255 bool broadcast;
5256 int64_t offset;
5257 } NvmeFormatAIOCB;
5258
5259 static void nvme_format_bh(void *opaque);
5260
5261 static void nvme_format_cancel(BlockAIOCB *aiocb)
5262 {
5263 NvmeFormatAIOCB *iocb = container_of(aiocb, NvmeFormatAIOCB, common);
5264
5265 if (iocb->aiocb) {
5266 blk_aio_cancel_async(iocb->aiocb);
5267 }
5268 }
5269
5270 static const AIOCBInfo nvme_format_aiocb_info = {
5271 .aiocb_size = sizeof(NvmeFormatAIOCB),
5272 .cancel_async = nvme_format_cancel,
5273 .get_aio_context = nvme_get_aio_context,
5274 };
5275
5276 static void nvme_format_set(NvmeNamespace *ns, NvmeCmd *cmd)
5277 {
5278 uint32_t dw10 = le32_to_cpu(cmd->cdw10);
5279 uint8_t lbaf = dw10 & 0xf;
5280 uint8_t pi = (dw10 >> 5) & 0x7;
5281 uint8_t mset = (dw10 >> 4) & 0x1;
5282 uint8_t pil = (dw10 >> 8) & 0x1;
5283
5284 trace_pci_nvme_format_set(ns->params.nsid, lbaf, mset, pi, pil);
5285
5286 ns->id_ns.dps = (pil << 3) | pi;
5287 ns->id_ns.flbas = lbaf | (mset << 4);
5288
5289 nvme_ns_init_format(ns);
5290 }
5291
5292 static void nvme_format_ns_cb(void *opaque, int ret)
5293 {
5294 NvmeFormatAIOCB *iocb = opaque;
5295 NvmeRequest *req = iocb->req;
5296 NvmeNamespace *ns = iocb->ns;
5297 int bytes;
5298
5299 if (ret < 0) {
5300 iocb->ret = ret;
5301 goto done;
5302 }
5303
5304 assert(ns);
5305
5306 if (iocb->offset < ns->size) {
5307 bytes = MIN(BDRV_REQUEST_MAX_BYTES, ns->size - iocb->offset);
5308
5309 iocb->aiocb = blk_aio_pwrite_zeroes(ns->blkconf.blk, iocb->offset,
5310 bytes, BDRV_REQ_MAY_UNMAP,
5311 nvme_format_ns_cb, iocb);
5312
5313 iocb->offset += bytes;
5314 return;
5315 }
5316
5317 nvme_format_set(ns, &req->cmd);
5318 ns->status = 0x0;
5319 iocb->ns = NULL;
5320 iocb->offset = 0;
5321
5322 done:
5323 iocb->aiocb = NULL;
5324 qemu_bh_schedule(iocb->bh);
5325 }
5326
5327 static uint16_t nvme_format_check(NvmeNamespace *ns, uint8_t lbaf, uint8_t pi)
5328 {
5329 if (ns->params.zoned) {
5330 return NVME_INVALID_FORMAT | NVME_DNR;
5331 }
5332
5333 if (lbaf > ns->id_ns.nlbaf) {
5334 return NVME_INVALID_FORMAT | NVME_DNR;
5335 }
5336
5337 if (pi && (ns->id_ns.lbaf[lbaf].ms < sizeof(NvmeDifTuple))) {
5338 return NVME_INVALID_FORMAT | NVME_DNR;
5339 }
5340
5341 if (pi && pi > NVME_ID_NS_DPS_TYPE_3) {
5342 return NVME_INVALID_FIELD | NVME_DNR;
5343 }
5344
5345 return NVME_SUCCESS;
5346 }
5347
5348 static void nvme_format_bh(void *opaque)
5349 {
5350 NvmeFormatAIOCB *iocb = opaque;
5351 NvmeRequest *req = iocb->req;
5352 NvmeCtrl *n = nvme_ctrl(req);
5353 uint32_t dw10 = le32_to_cpu(req->cmd.cdw10);
5354 uint8_t lbaf = dw10 & 0xf;
5355 uint8_t pi = (dw10 >> 5) & 0x7;
5356 uint16_t status;
5357 int i;
5358
5359 if (iocb->ret < 0) {
5360 goto done;
5361 }
5362
5363 if (iocb->broadcast) {
5364 for (i = iocb->nsid + 1; i <= NVME_MAX_NAMESPACES; i++) {
5365 iocb->ns = nvme_ns(n, i);
5366 if (iocb->ns) {
5367 iocb->nsid = i;
5368 break;
5369 }
5370 }
5371 }
5372
5373 if (!iocb->ns) {
5374 goto done;
5375 }
5376
5377 status = nvme_format_check(iocb->ns, lbaf, pi);
5378 if (status) {
5379 req->status = status;
5380 goto done;
5381 }
5382
5383 iocb->ns->status = NVME_FORMAT_IN_PROGRESS;
5384 nvme_format_ns_cb(iocb, 0);
5385 return;
5386
5387 done:
5388 qemu_bh_delete(iocb->bh);
5389 iocb->bh = NULL;
5390
5391 iocb->common.cb(iocb->common.opaque, iocb->ret);
5392
5393 qemu_aio_unref(iocb);
5394 }
5395
5396 static uint16_t nvme_format(NvmeCtrl *n, NvmeRequest *req)
5397 {
5398 NvmeFormatAIOCB *iocb;
5399 uint32_t nsid = le32_to_cpu(req->cmd.nsid);
5400 uint16_t status;
5401
5402 iocb = qemu_aio_get(&nvme_format_aiocb_info, NULL, nvme_misc_cb, req);
5403
5404 iocb->req = req;
5405 iocb->bh = qemu_bh_new(nvme_format_bh, iocb);
5406 iocb->ret = 0;
5407 iocb->ns = NULL;
5408 iocb->nsid = 0;
5409 iocb->broadcast = (nsid == NVME_NSID_BROADCAST);
5410 iocb->offset = 0;
5411
5412 if (!iocb->broadcast) {
5413 if (!nvme_nsid_valid(n, nsid)) {
5414 status = NVME_INVALID_NSID | NVME_DNR;
5415 goto out;
5416 }
5417
5418 iocb->ns = nvme_ns(n, nsid);
5419 if (!iocb->ns) {
5420 status = NVME_INVALID_FIELD | NVME_DNR;
5421 goto out;
5422 }
5423 }
5424
5425 req->aiocb = &iocb->common;
5426 qemu_bh_schedule(iocb->bh);
5427
5428 return NVME_NO_COMPLETE;
5429
5430 out:
5431 qemu_bh_delete(iocb->bh);
5432 iocb->bh = NULL;
5433 qemu_aio_unref(iocb);
5434 return status;
5435 }
5436
5437 static uint16_t nvme_admin_cmd(NvmeCtrl *n, NvmeRequest *req)
5438 {
5439 trace_pci_nvme_admin_cmd(nvme_cid(req), nvme_sqid(req), req->cmd.opcode,
5440 nvme_adm_opc_str(req->cmd.opcode));
5441
5442 if (!(nvme_cse_acs[req->cmd.opcode] & NVME_CMD_EFF_CSUPP)) {
5443 trace_pci_nvme_err_invalid_admin_opc(req->cmd.opcode);
5444 return NVME_INVALID_OPCODE | NVME_DNR;
5445 }
5446
5447 /* SGLs shall not be used for Admin commands in NVMe over PCIe */
5448 if (NVME_CMD_FLAGS_PSDT(req->cmd.flags) != NVME_PSDT_PRP) {
5449 return NVME_INVALID_FIELD | NVME_DNR;
5450 }
5451
5452 switch (req->cmd.opcode) {
5453 case NVME_ADM_CMD_DELETE_SQ:
5454 return nvme_del_sq(n, req);
5455 case NVME_ADM_CMD_CREATE_SQ:
5456 return nvme_create_sq(n, req);
5457 case NVME_ADM_CMD_GET_LOG_PAGE:
5458 return nvme_get_log(n, req);
5459 case NVME_ADM_CMD_DELETE_CQ:
5460 return nvme_del_cq(n, req);
5461 case NVME_ADM_CMD_CREATE_CQ:
5462 return nvme_create_cq(n, req);
5463 case NVME_ADM_CMD_IDENTIFY:
5464 return nvme_identify(n, req);
5465 case NVME_ADM_CMD_ABORT:
5466 return nvme_abort(n, req);
5467 case NVME_ADM_CMD_SET_FEATURES:
5468 return nvme_set_feature(n, req);
5469 case NVME_ADM_CMD_GET_FEATURES:
5470 return nvme_get_feature(n, req);
5471 case NVME_ADM_CMD_ASYNC_EV_REQ:
5472 return nvme_aer(n, req);
5473 case NVME_ADM_CMD_NS_ATTACHMENT:
5474 return nvme_ns_attachment(n, req);
5475 case NVME_ADM_CMD_FORMAT_NVM:
5476 return nvme_format(n, req);
5477 default:
5478 assert(false);
5479 }
5480
5481 return NVME_INVALID_OPCODE | NVME_DNR;
5482 }
5483
5484 static void nvme_process_sq(void *opaque)
5485 {
5486 NvmeSQueue *sq = opaque;
5487 NvmeCtrl *n = sq->ctrl;
5488 NvmeCQueue *cq = n->cq[sq->cqid];
5489
5490 uint16_t status;
5491 hwaddr addr;
5492 NvmeCmd cmd;
5493 NvmeRequest *req;
5494
5495 while (!(nvme_sq_empty(sq) || QTAILQ_EMPTY(&sq->req_list))) {
5496 addr = sq->dma_addr + sq->head * n->sqe_size;
5497 if (nvme_addr_read(n, addr, (void *)&cmd, sizeof(cmd))) {
5498 trace_pci_nvme_err_addr_read(addr);
5499 trace_pci_nvme_err_cfs();
5500 n->bar.csts = NVME_CSTS_FAILED;
5501 break;
5502 }
5503 nvme_inc_sq_head(sq);
5504
5505 req = QTAILQ_FIRST(&sq->req_list);
5506 QTAILQ_REMOVE(&sq->req_list, req, entry);
5507 QTAILQ_INSERT_TAIL(&sq->out_req_list, req, entry);
5508 nvme_req_clear(req);
5509 req->cqe.cid = cmd.cid;
5510 memcpy(&req->cmd, &cmd, sizeof(NvmeCmd));
5511
5512 status = sq->sqid ? nvme_io_cmd(n, req) :
5513 nvme_admin_cmd(n, req);
5514 if (status != NVME_NO_COMPLETE) {
5515 req->status = status;
5516 nvme_enqueue_req_completion(cq, req);
5517 }
5518 }
5519 }
5520
5521 static void nvme_ctrl_reset(NvmeCtrl *n)
5522 {
5523 NvmeNamespace *ns;
5524 int i;
5525
5526 for (i = 1; i <= NVME_MAX_NAMESPACES; i++) {
5527 ns = nvme_ns(n, i);
5528 if (!ns) {
5529 continue;
5530 }
5531
5532 nvme_ns_drain(ns);
5533 }
5534
5535 for (i = 0; i < n->params.max_ioqpairs + 1; i++) {
5536 if (n->sq[i] != NULL) {
5537 nvme_free_sq(n->sq[i], n);
5538 }
5539 }
5540 for (i = 0; i < n->params.max_ioqpairs + 1; i++) {
5541 if (n->cq[i] != NULL) {
5542 nvme_free_cq(n->cq[i], n);
5543 }
5544 }
5545
5546 while (!QTAILQ_EMPTY(&n->aer_queue)) {
5547 NvmeAsyncEvent *event = QTAILQ_FIRST(&n->aer_queue);
5548 QTAILQ_REMOVE(&n->aer_queue, event, entry);
5549 g_free(event);
5550 }
5551
5552 n->aer_queued = 0;
5553 n->outstanding_aers = 0;
5554 n->qs_created = false;
5555
5556 n->bar.cc = 0;
5557 }
5558
5559 static void nvme_ctrl_shutdown(NvmeCtrl *n)
5560 {
5561 NvmeNamespace *ns;
5562 int i;
5563
5564 if (n->pmr.dev) {
5565 memory_region_msync(&n->pmr.dev->mr, 0, n->pmr.dev->size);
5566 }
5567
5568 for (i = 1; i <= NVME_MAX_NAMESPACES; i++) {
5569 ns = nvme_ns(n, i);
5570 if (!ns) {
5571 continue;
5572 }
5573
5574 nvme_ns_shutdown(ns);
5575 }
5576 }
5577
5578 static void nvme_select_iocs(NvmeCtrl *n)
5579 {
5580 NvmeNamespace *ns;
5581 int i;
5582
5583 for (i = 1; i <= NVME_MAX_NAMESPACES; i++) {
5584 ns = nvme_ns(n, i);
5585 if (!ns) {
5586 continue;
5587 }
5588
5589 nvme_select_iocs_ns(n, ns);
5590 }
5591 }
5592
5593 static int nvme_start_ctrl(NvmeCtrl *n)
5594 {
5595 uint32_t page_bits = NVME_CC_MPS(n->bar.cc) + 12;
5596 uint32_t page_size = 1 << page_bits;
5597
5598 if (unlikely(n->cq[0])) {
5599 trace_pci_nvme_err_startfail_cq();
5600 return -1;
5601 }
5602 if (unlikely(n->sq[0])) {
5603 trace_pci_nvme_err_startfail_sq();
5604 return -1;
5605 }
5606 if (unlikely(!n->bar.asq)) {
5607 trace_pci_nvme_err_startfail_nbarasq();
5608 return -1;
5609 }
5610 if (unlikely(!n->bar.acq)) {
5611 trace_pci_nvme_err_startfail_nbaracq();
5612 return -1;
5613 }
5614 if (unlikely(n->bar.asq & (page_size - 1))) {
5615 trace_pci_nvme_err_startfail_asq_misaligned(n->bar.asq);
5616 return -1;
5617 }
5618 if (unlikely(n->bar.acq & (page_size - 1))) {
5619 trace_pci_nvme_err_startfail_acq_misaligned(n->bar.acq);
5620 return -1;
5621 }
5622 if (unlikely(!(NVME_CAP_CSS(n->bar.cap) & (1 << NVME_CC_CSS(n->bar.cc))))) {
5623 trace_pci_nvme_err_startfail_css(NVME_CC_CSS(n->bar.cc));
5624 return -1;
5625 }
5626 if (unlikely(NVME_CC_MPS(n->bar.cc) <
5627 NVME_CAP_MPSMIN(n->bar.cap))) {
5628 trace_pci_nvme_err_startfail_page_too_small(
5629 NVME_CC_MPS(n->bar.cc),
5630 NVME_CAP_MPSMIN(n->bar.cap));
5631 return -1;
5632 }
5633 if (unlikely(NVME_CC_MPS(n->bar.cc) >
5634 NVME_CAP_MPSMAX(n->bar.cap))) {
5635 trace_pci_nvme_err_startfail_page_too_large(
5636 NVME_CC_MPS(n->bar.cc),
5637 NVME_CAP_MPSMAX(n->bar.cap));
5638 return -1;
5639 }
5640 if (unlikely(NVME_CC_IOCQES(n->bar.cc) <
5641 NVME_CTRL_CQES_MIN(n->id_ctrl.cqes))) {
5642 trace_pci_nvme_err_startfail_cqent_too_small(
5643 NVME_CC_IOCQES(n->bar.cc),
5644 NVME_CTRL_CQES_MIN(n->bar.cap));
5645 return -1;
5646 }
5647 if (unlikely(NVME_CC_IOCQES(n->bar.cc) >
5648 NVME_CTRL_CQES_MAX(n->id_ctrl.cqes))) {
5649 trace_pci_nvme_err_startfail_cqent_too_large(
5650 NVME_CC_IOCQES(n->bar.cc),
5651 NVME_CTRL_CQES_MAX(n->bar.cap));
5652 return -1;
5653 }
5654 if (unlikely(NVME_CC_IOSQES(n->bar.cc) <
5655 NVME_CTRL_SQES_MIN(n->id_ctrl.sqes))) {
5656 trace_pci_nvme_err_startfail_sqent_too_small(
5657 NVME_CC_IOSQES(n->bar.cc),
5658 NVME_CTRL_SQES_MIN(n->bar.cap));
5659 return -1;
5660 }
5661 if (unlikely(NVME_CC_IOSQES(n->bar.cc) >
5662 NVME_CTRL_SQES_MAX(n->id_ctrl.sqes))) {
5663 trace_pci_nvme_err_startfail_sqent_too_large(
5664 NVME_CC_IOSQES(n->bar.cc),
5665 NVME_CTRL_SQES_MAX(n->bar.cap));
5666 return -1;
5667 }
5668 if (unlikely(!NVME_AQA_ASQS(n->bar.aqa))) {
5669 trace_pci_nvme_err_startfail_asqent_sz_zero();
5670 return -1;
5671 }
5672 if (unlikely(!NVME_AQA_ACQS(n->bar.aqa))) {
5673 trace_pci_nvme_err_startfail_acqent_sz_zero();
5674 return -1;
5675 }
5676
5677 n->page_bits = page_bits;
5678 n->page_size = page_size;
5679 n->max_prp_ents = n->page_size / sizeof(uint64_t);
5680 n->cqe_size = 1 << NVME_CC_IOCQES(n->bar.cc);
5681 n->sqe_size = 1 << NVME_CC_IOSQES(n->bar.cc);
5682 nvme_init_cq(&n->admin_cq, n, n->bar.acq, 0, 0,
5683 NVME_AQA_ACQS(n->bar.aqa) + 1, 1);
5684 nvme_init_sq(&n->admin_sq, n, n->bar.asq, 0, 0,
5685 NVME_AQA_ASQS(n->bar.aqa) + 1);
5686
5687 nvme_set_timestamp(n, 0ULL);
5688
5689 QTAILQ_INIT(&n->aer_queue);
5690
5691 nvme_select_iocs(n);
5692
5693 return 0;
5694 }
5695
5696 static void nvme_cmb_enable_regs(NvmeCtrl *n)
5697 {
5698 NVME_CMBLOC_SET_CDPCILS(n->bar.cmbloc, 1);
5699 NVME_CMBLOC_SET_CDPMLS(n->bar.cmbloc, 1);
5700 NVME_CMBLOC_SET_BIR(n->bar.cmbloc, NVME_CMB_BIR);
5701
5702 NVME_CMBSZ_SET_SQS(n->bar.cmbsz, 1);
5703 NVME_CMBSZ_SET_CQS(n->bar.cmbsz, 0);
5704 NVME_CMBSZ_SET_LISTS(n->bar.cmbsz, 1);
5705 NVME_CMBSZ_SET_RDS(n->bar.cmbsz, 1);
5706 NVME_CMBSZ_SET_WDS(n->bar.cmbsz, 1);
5707 NVME_CMBSZ_SET_SZU(n->bar.cmbsz, 2); /* MBs */
5708 NVME_CMBSZ_SET_SZ(n->bar.cmbsz, n->params.cmb_size_mb);
5709 }
5710
5711 static void nvme_write_bar(NvmeCtrl *n, hwaddr offset, uint64_t data,
5712 unsigned size)
5713 {
5714 if (unlikely(offset & (sizeof(uint32_t) - 1))) {
5715 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_misaligned32,
5716 "MMIO write not 32-bit aligned,"
5717 " offset=0x%"PRIx64"", offset);
5718 /* should be ignored, fall through for now */
5719 }
5720
5721 if (unlikely(size < sizeof(uint32_t))) {
5722 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_toosmall,
5723 "MMIO write smaller than 32-bits,"
5724 " offset=0x%"PRIx64", size=%u",
5725 offset, size);
5726 /* should be ignored, fall through for now */
5727 }
5728
5729 switch (offset) {
5730 case 0xc: /* INTMS */
5731 if (unlikely(msix_enabled(&(n->parent_obj)))) {
5732 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_intmask_with_msix,
5733 "undefined access to interrupt mask set"
5734 " when MSI-X is enabled");
5735 /* should be ignored, fall through for now */
5736 }
5737 n->bar.intms |= data & 0xffffffff;
5738 n->bar.intmc = n->bar.intms;
5739 trace_pci_nvme_mmio_intm_set(data & 0xffffffff, n->bar.intmc);
5740 nvme_irq_check(n);
5741 break;
5742 case 0x10: /* INTMC */
5743 if (unlikely(msix_enabled(&(n->parent_obj)))) {
5744 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_intmask_with_msix,
5745 "undefined access to interrupt mask clr"
5746 " when MSI-X is enabled");
5747 /* should be ignored, fall through for now */
5748 }
5749 n->bar.intms &= ~(data & 0xffffffff);
5750 n->bar.intmc = n->bar.intms;
5751 trace_pci_nvme_mmio_intm_clr(data & 0xffffffff, n->bar.intmc);
5752 nvme_irq_check(n);
5753 break;
5754 case 0x14: /* CC */
5755 trace_pci_nvme_mmio_cfg(data & 0xffffffff);
5756 /* Windows first sends data, then sends enable bit */
5757 if (!NVME_CC_EN(data) && !NVME_CC_EN(n->bar.cc) &&
5758 !NVME_CC_SHN(data) && !NVME_CC_SHN(n->bar.cc))
5759 {
5760 n->bar.cc = data;
5761 }
5762
5763 if (NVME_CC_EN(data) && !NVME_CC_EN(n->bar.cc)) {
5764 n->bar.cc = data;
5765 if (unlikely(nvme_start_ctrl(n))) {
5766 trace_pci_nvme_err_startfail();
5767 n->bar.csts = NVME_CSTS_FAILED;
5768 } else {
5769 trace_pci_nvme_mmio_start_success();
5770 n->bar.csts = NVME_CSTS_READY;
5771 }
5772 } else if (!NVME_CC_EN(data) && NVME_CC_EN(n->bar.cc)) {
5773 trace_pci_nvme_mmio_stopped();
5774 nvme_ctrl_reset(n);
5775 n->bar.csts &= ~NVME_CSTS_READY;
5776 }
5777 if (NVME_CC_SHN(data) && !(NVME_CC_SHN(n->bar.cc))) {
5778 trace_pci_nvme_mmio_shutdown_set();
5779 nvme_ctrl_shutdown(n);
5780 n->bar.cc = data;
5781 n->bar.csts |= NVME_CSTS_SHST_COMPLETE;
5782 } else if (!NVME_CC_SHN(data) && NVME_CC_SHN(n->bar.cc)) {
5783 trace_pci_nvme_mmio_shutdown_cleared();
5784 n->bar.csts &= ~NVME_CSTS_SHST_COMPLETE;
5785 n->bar.cc = data;
5786 }
5787 break;
5788 case 0x1c: /* CSTS */
5789 if (data & (1 << 4)) {
5790 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_ssreset_w1c_unsupported,
5791 "attempted to W1C CSTS.NSSRO"
5792 " but CAP.NSSRS is zero (not supported)");
5793 } else if (data != 0) {
5794 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_ro_csts,
5795 "attempted to set a read only bit"
5796 " of controller status");
5797 }
5798 break;
5799 case 0x20: /* NSSR */
5800 if (data == 0x4e564d65) {
5801 trace_pci_nvme_ub_mmiowr_ssreset_unsupported();
5802 } else {
5803 /* The spec says that writes of other values have no effect */
5804 return;
5805 }
5806 break;
5807 case 0x24: /* AQA */
5808 n->bar.aqa = data & 0xffffffff;
5809 trace_pci_nvme_mmio_aqattr(data & 0xffffffff);
5810 break;
5811 case 0x28: /* ASQ */
5812 n->bar.asq = size == 8 ? data :
5813 (n->bar.asq & ~0xffffffffULL) | (data & 0xffffffff);
5814 trace_pci_nvme_mmio_asqaddr(data);
5815 break;
5816 case 0x2c: /* ASQ hi */
5817 n->bar.asq = (n->bar.asq & 0xffffffff) | (data << 32);
5818 trace_pci_nvme_mmio_asqaddr_hi(data, n->bar.asq);
5819 break;
5820 case 0x30: /* ACQ */
5821 trace_pci_nvme_mmio_acqaddr(data);
5822 n->bar.acq = size == 8 ? data :
5823 (n->bar.acq & ~0xffffffffULL) | (data & 0xffffffff);
5824 break;
5825 case 0x34: /* ACQ hi */
5826 n->bar.acq = (n->bar.acq & 0xffffffff) | (data << 32);
5827 trace_pci_nvme_mmio_acqaddr_hi(data, n->bar.acq);
5828 break;
5829 case 0x38: /* CMBLOC */
5830 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_cmbloc_reserved,
5831 "invalid write to reserved CMBLOC"
5832 " when CMBSZ is zero, ignored");
5833 return;
5834 case 0x3C: /* CMBSZ */
5835 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_cmbsz_readonly,
5836 "invalid write to read only CMBSZ, ignored");
5837 return;
5838 case 0x50: /* CMBMSC */
5839 if (!NVME_CAP_CMBS(n->bar.cap)) {
5840 return;
5841 }
5842
5843 n->bar.cmbmsc = size == 8 ? data :
5844 (n->bar.cmbmsc & ~0xffffffff) | (data & 0xffffffff);
5845 n->cmb.cmse = false;
5846
5847 if (NVME_CMBMSC_CRE(data)) {
5848 nvme_cmb_enable_regs(n);
5849
5850 if (NVME_CMBMSC_CMSE(data)) {
5851 hwaddr cba = NVME_CMBMSC_CBA(data) << CMBMSC_CBA_SHIFT;
5852 if (cba + int128_get64(n->cmb.mem.size) < cba) {
5853 NVME_CMBSTS_SET_CBAI(n->bar.cmbsts, 1);
5854 return;
5855 }
5856
5857 n->cmb.cba = cba;
5858 n->cmb.cmse = true;
5859 }
5860 } else {
5861 n->bar.cmbsz = 0;
5862 n->bar.cmbloc = 0;
5863 }
5864
5865 return;
5866 case 0x54: /* CMBMSC hi */
5867 n->bar.cmbmsc = (n->bar.cmbmsc & 0xffffffff) | (data << 32);
5868 return;
5869
5870 case 0xe00: /* PMRCAP */
5871 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_pmrcap_readonly,
5872 "invalid write to PMRCAP register, ignored");
5873 return;
5874 case 0xe04: /* PMRCTL */
5875 if (!NVME_CAP_PMRS(n->bar.cap)) {
5876 return;
5877 }
5878
5879 n->bar.pmrctl = data;
5880 if (NVME_PMRCTL_EN(data)) {
5881 memory_region_set_enabled(&n->pmr.dev->mr, true);
5882 n->bar.pmrsts = 0;
5883 } else {
5884 memory_region_set_enabled(&n->pmr.dev->mr, false);
5885 NVME_PMRSTS_SET_NRDY(n->bar.pmrsts, 1);
5886 n->pmr.cmse = false;
5887 }
5888 return;
5889 case 0xe08: /* PMRSTS */
5890 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_pmrsts_readonly,
5891 "invalid write to PMRSTS register, ignored");
5892 return;
5893 case 0xe0C: /* PMREBS */
5894 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_pmrebs_readonly,
5895 "invalid write to PMREBS register, ignored");
5896 return;
5897 case 0xe10: /* PMRSWTP */
5898 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_pmrswtp_readonly,
5899 "invalid write to PMRSWTP register, ignored");
5900 return;
5901 case 0xe14: /* PMRMSCL */
5902 if (!NVME_CAP_PMRS(n->bar.cap)) {
5903 return;
5904 }
5905
5906 n->bar.pmrmsc = (n->bar.pmrmsc & ~0xffffffff) | (data & 0xffffffff);
5907 n->pmr.cmse = false;
5908
5909 if (NVME_PMRMSC_CMSE(n->bar.pmrmsc)) {
5910 hwaddr cba = NVME_PMRMSC_CBA(n->bar.pmrmsc) << PMRMSC_CBA_SHIFT;
5911 if (cba + int128_get64(n->pmr.dev->mr.size) < cba) {
5912 NVME_PMRSTS_SET_CBAI(n->bar.pmrsts, 1);
5913 return;
5914 }
5915
5916 n->pmr.cmse = true;
5917 n->pmr.cba = cba;
5918 }
5919
5920 return;
5921 case 0xe18: /* PMRMSCU */
5922 if (!NVME_CAP_PMRS(n->bar.cap)) {
5923 return;
5924 }
5925
5926 n->bar.pmrmsc = (n->bar.pmrmsc & 0xffffffff) | (data << 32);
5927 return;
5928 default:
5929 NVME_GUEST_ERR(pci_nvme_ub_mmiowr_invalid,
5930 "invalid MMIO write,"
5931 " offset=0x%"PRIx64", data=%"PRIx64"",
5932 offset, data);
5933 break;
5934 }
5935 }
5936
5937 static uint64_t nvme_mmio_read(void *opaque, hwaddr addr, unsigned size)
5938 {
5939 NvmeCtrl *n = (NvmeCtrl *)opaque;
5940 uint8_t *ptr = (uint8_t *)&n->bar;
5941 uint64_t val = 0;
5942
5943 trace_pci_nvme_mmio_read(addr, size);
5944
5945 if (unlikely(addr & (sizeof(uint32_t) - 1))) {
5946 NVME_GUEST_ERR(pci_nvme_ub_mmiord_misaligned32,
5947 "MMIO read not 32-bit aligned,"
5948 " offset=0x%"PRIx64"", addr);
5949 /* should RAZ, fall through for now */
5950 } else if (unlikely(size < sizeof(uint32_t))) {
5951 NVME_GUEST_ERR(pci_nvme_ub_mmiord_toosmall,
5952 "MMIO read smaller than 32-bits,"
5953 " offset=0x%"PRIx64"", addr);
5954 /* should RAZ, fall through for now */
5955 }
5956
5957 if (addr < sizeof(n->bar)) {
5958 /*
5959 * When PMRWBM bit 1 is set then read from
5960 * from PMRSTS should ensure prior writes
5961 * made it to persistent media
5962 */
5963 if (addr == 0xe08 &&
5964 (NVME_PMRCAP_PMRWBM(n->bar.pmrcap) & 0x02)) {
5965 memory_region_msync(&n->pmr.dev->mr, 0, n->pmr.dev->size);
5966 }
5967 memcpy(&val, ptr + addr, size);
5968 } else {
5969 NVME_GUEST_ERR(pci_nvme_ub_mmiord_invalid_ofs,
5970 "MMIO read beyond last register,"
5971 " offset=0x%"PRIx64", returning 0", addr);
5972 }
5973
5974 return val;
5975 }
5976
5977 static void nvme_process_db(NvmeCtrl *n, hwaddr addr, int val)
5978 {
5979 uint32_t qid;
5980
5981 if (unlikely(addr & ((1 << 2) - 1))) {
5982 NVME_GUEST_ERR(pci_nvme_ub_db_wr_misaligned,
5983 "doorbell write not 32-bit aligned,"
5984 " offset=0x%"PRIx64", ignoring", addr);
5985 return;
5986 }
5987
5988 if (((addr - 0x1000) >> 2) & 1) {
5989 /* Completion queue doorbell write */
5990
5991 uint16_t new_head = val & 0xffff;
5992 int start_sqs;
5993 NvmeCQueue *cq;
5994
5995 qid = (addr - (0x1000 + (1 << 2))) >> 3;
5996 if (unlikely(nvme_check_cqid(n, qid))) {
5997 NVME_GUEST_ERR(pci_nvme_ub_db_wr_invalid_cq,
5998 "completion queue doorbell write"
5999 " for nonexistent queue,"
6000 " sqid=%"PRIu32", ignoring", qid);
6001
6002 /*
6003 * NVM Express v1.3d, Section 4.1 state: "If host software writes
6004 * an invalid value to the Submission Queue Tail Doorbell or
6005 * Completion Queue Head Doorbell regiter and an Asynchronous Event
6006 * Request command is outstanding, then an asynchronous event is
6007 * posted to the Admin Completion Queue with a status code of
6008 * Invalid Doorbell Write Value."
6009 *
6010 * Also note that the spec includes the "Invalid Doorbell Register"
6011 * status code, but nowhere does it specify when to use it.
6012 * However, it seems reasonable to use it here in a similar
6013 * fashion.
6014 */
6015 if (n->outstanding_aers) {
6016 nvme_enqueue_event(n, NVME_AER_TYPE_ERROR,
6017 NVME_AER_INFO_ERR_INVALID_DB_REGISTER,
6018 NVME_LOG_ERROR_INFO);
6019 }
6020
6021 return;
6022 }
6023
6024 cq = n->cq[qid];
6025 if (unlikely(new_head >= cq->size)) {
6026 NVME_GUEST_ERR(pci_nvme_ub_db_wr_invalid_cqhead,
6027 "completion queue doorbell write value"
6028 " beyond queue size, sqid=%"PRIu32","
6029 " new_head=%"PRIu16", ignoring",
6030 qid, new_head);
6031
6032 if (n->outstanding_aers) {
6033 nvme_enqueue_event(n, NVME_AER_TYPE_ERROR,
6034 NVME_AER_INFO_ERR_INVALID_DB_VALUE,
6035 NVME_LOG_ERROR_INFO);
6036 }
6037
6038 return;
6039 }
6040
6041 trace_pci_nvme_mmio_doorbell_cq(cq->cqid, new_head);
6042
6043 start_sqs = nvme_cq_full(cq) ? 1 : 0;
6044 cq->head = new_head;
6045 if (start_sqs) {
6046 NvmeSQueue *sq;
6047 QTAILQ_FOREACH(sq, &cq->sq_list, entry) {
6048 timer_mod(sq->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 500);
6049 }
6050 timer_mod(cq->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 500);
6051 }
6052
6053 if (cq->tail == cq->head) {
6054 if (cq->irq_enabled) {
6055 n->cq_pending--;
6056 }
6057
6058 nvme_irq_deassert(n, cq);
6059 }
6060 } else {
6061 /* Submission queue doorbell write */
6062
6063 uint16_t new_tail = val & 0xffff;
6064 NvmeSQueue *sq;
6065
6066 qid = (addr - 0x1000) >> 3;
6067 if (unlikely(nvme_check_sqid(n, qid))) {
6068 NVME_GUEST_ERR(pci_nvme_ub_db_wr_invalid_sq,
6069 "submission queue doorbell write"
6070 " for nonexistent queue,"
6071 " sqid=%"PRIu32", ignoring", qid);
6072
6073 if (n->outstanding_aers) {
6074 nvme_enqueue_event(n, NVME_AER_TYPE_ERROR,
6075 NVME_AER_INFO_ERR_INVALID_DB_REGISTER,
6076 NVME_LOG_ERROR_INFO);
6077 }
6078
6079 return;
6080 }
6081
6082 sq = n->sq[qid];
6083 if (unlikely(new_tail >= sq->size)) {
6084 NVME_GUEST_ERR(pci_nvme_ub_db_wr_invalid_sqtail,
6085 "submission queue doorbell write value"
6086 " beyond queue size, sqid=%"PRIu32","
6087 " new_tail=%"PRIu16", ignoring",
6088 qid, new_tail);
6089
6090 if (n->outstanding_aers) {
6091 nvme_enqueue_event(n, NVME_AER_TYPE_ERROR,
6092 NVME_AER_INFO_ERR_INVALID_DB_VALUE,
6093 NVME_LOG_ERROR_INFO);
6094 }
6095
6096 return;
6097 }
6098
6099 trace_pci_nvme_mmio_doorbell_sq(sq->sqid, new_tail);
6100
6101 sq->tail = new_tail;
6102 timer_mod(sq->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 500);
6103 }
6104 }
6105
6106 static void nvme_mmio_write(void *opaque, hwaddr addr, uint64_t data,
6107 unsigned size)
6108 {
6109 NvmeCtrl *n = (NvmeCtrl *)opaque;
6110
6111 trace_pci_nvme_mmio_write(addr, data, size);
6112
6113 if (addr < sizeof(n->bar)) {
6114 nvme_write_bar(n, addr, data, size);
6115 } else {
6116 nvme_process_db(n, addr, data);
6117 }
6118 }
6119
6120 static const MemoryRegionOps nvme_mmio_ops = {
6121 .read = nvme_mmio_read,
6122 .write = nvme_mmio_write,
6123 .endianness = DEVICE_LITTLE_ENDIAN,
6124 .impl = {
6125 .min_access_size = 2,
6126 .max_access_size = 8,
6127 },
6128 };
6129
6130 static void nvme_cmb_write(void *opaque, hwaddr addr, uint64_t data,
6131 unsigned size)
6132 {
6133 NvmeCtrl *n = (NvmeCtrl *)opaque;
6134 stn_le_p(&n->cmb.buf[addr], size, data);
6135 }
6136
6137 static uint64_t nvme_cmb_read(void *opaque, hwaddr addr, unsigned size)
6138 {
6139 NvmeCtrl *n = (NvmeCtrl *)opaque;
6140 return ldn_le_p(&n->cmb.buf[addr], size);
6141 }
6142
6143 static const MemoryRegionOps nvme_cmb_ops = {
6144 .read = nvme_cmb_read,
6145 .write = nvme_cmb_write,
6146 .endianness = DEVICE_LITTLE_ENDIAN,
6147 .impl = {
6148 .min_access_size = 1,
6149 .max_access_size = 8,
6150 },
6151 };
6152
6153 static void nvme_check_constraints(NvmeCtrl *n, Error **errp)
6154 {
6155 NvmeParams *params = &n->params;
6156
6157 if (params->num_queues) {
6158 warn_report("num_queues is deprecated; please use max_ioqpairs "
6159 "instead");
6160
6161 params->max_ioqpairs = params->num_queues - 1;
6162 }
6163
6164 if (n->namespace.blkconf.blk && n->subsys) {
6165 error_setg(errp, "subsystem support is unavailable with legacy "
6166 "namespace ('drive' property)");
6167 return;
6168 }
6169
6170 if (params->max_ioqpairs < 1 ||
6171 params->max_ioqpairs > NVME_MAX_IOQPAIRS) {
6172 error_setg(errp, "max_ioqpairs must be between 1 and %d",
6173 NVME_MAX_IOQPAIRS);
6174 return;
6175 }
6176
6177 if (params->msix_qsize < 1 ||
6178 params->msix_qsize > PCI_MSIX_FLAGS_QSIZE + 1) {
6179 error_setg(errp, "msix_qsize must be between 1 and %d",
6180 PCI_MSIX_FLAGS_QSIZE + 1);
6181 return;
6182 }
6183
6184 if (!params->serial) {
6185 error_setg(errp, "serial property not set");
6186 return;
6187 }
6188
6189 if (n->pmr.dev) {
6190 if (host_memory_backend_is_mapped(n->pmr.dev)) {
6191 error_setg(errp, "can't use already busy memdev: %s",
6192 object_get_canonical_path_component(OBJECT(n->pmr.dev)));
6193 return;
6194 }
6195
6196 if (!is_power_of_2(n->pmr.dev->size)) {
6197 error_setg(errp, "pmr backend size needs to be power of 2 in size");
6198 return;
6199 }
6200
6201 host_memory_backend_set_mapped(n->pmr.dev, true);
6202 }
6203
6204 if (n->params.zasl > n->params.mdts) {
6205 error_setg(errp, "zoned.zasl (Zone Append Size Limit) must be less "
6206 "than or equal to mdts (Maximum Data Transfer Size)");
6207 return;
6208 }
6209
6210 if (!n->params.vsl) {
6211 error_setg(errp, "vsl must be non-zero");
6212 return;
6213 }
6214 }
6215
6216 static void nvme_init_state(NvmeCtrl *n)
6217 {
6218 /* add one to max_ioqpairs to account for the admin queue pair */
6219 n->reg_size = pow2ceil(sizeof(NvmeBar) +
6220 2 * (n->params.max_ioqpairs + 1) * NVME_DB_SIZE);
6221 n->sq = g_new0(NvmeSQueue *, n->params.max_ioqpairs + 1);
6222 n->cq = g_new0(NvmeCQueue *, n->params.max_ioqpairs + 1);
6223 n->temperature = NVME_TEMPERATURE;
6224 n->features.temp_thresh_hi = NVME_TEMPERATURE_WARNING;
6225 n->starttime_ms = qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL);
6226 n->aer_reqs = g_new0(NvmeRequest *, n->params.aerl + 1);
6227 }
6228
6229 static void nvme_init_cmb(NvmeCtrl *n, PCIDevice *pci_dev)
6230 {
6231 uint64_t cmb_size = n->params.cmb_size_mb * MiB;
6232
6233 n->cmb.buf = g_malloc0(cmb_size);
6234 memory_region_init_io(&n->cmb.mem, OBJECT(n), &nvme_cmb_ops, n,
6235 "nvme-cmb", cmb_size);
6236 pci_register_bar(pci_dev, NVME_CMB_BIR,
6237 PCI_BASE_ADDRESS_SPACE_MEMORY |
6238 PCI_BASE_ADDRESS_MEM_TYPE_64 |
6239 PCI_BASE_ADDRESS_MEM_PREFETCH, &n->cmb.mem);
6240
6241 NVME_CAP_SET_CMBS(n->bar.cap, 1);
6242
6243 if (n->params.legacy_cmb) {
6244 nvme_cmb_enable_regs(n);
6245 n->cmb.cmse = true;
6246 }
6247 }
6248
6249 static void nvme_init_pmr(NvmeCtrl *n, PCIDevice *pci_dev)
6250 {
6251 NVME_PMRCAP_SET_RDS(n->bar.pmrcap, 1);
6252 NVME_PMRCAP_SET_WDS(n->bar.pmrcap, 1);
6253 NVME_PMRCAP_SET_BIR(n->bar.pmrcap, NVME_PMR_BIR);
6254 /* Turn on bit 1 support */
6255 NVME_PMRCAP_SET_PMRWBM(n->bar.pmrcap, 0x02);
6256 NVME_PMRCAP_SET_CMSS(n->bar.pmrcap, 1);
6257
6258 pci_register_bar(pci_dev, NVME_PMRCAP_BIR(n->bar.pmrcap),
6259 PCI_BASE_ADDRESS_SPACE_MEMORY |
6260 PCI_BASE_ADDRESS_MEM_TYPE_64 |
6261 PCI_BASE_ADDRESS_MEM_PREFETCH, &n->pmr.dev->mr);
6262
6263 memory_region_set_enabled(&n->pmr.dev->mr, false);
6264 }
6265
6266 static int nvme_init_pci(NvmeCtrl *n, PCIDevice *pci_dev, Error **errp)
6267 {
6268 uint8_t *pci_conf = pci_dev->config;
6269 uint64_t bar_size, msix_table_size, msix_pba_size;
6270 unsigned msix_table_offset, msix_pba_offset;
6271 int ret;
6272
6273 Error *err = NULL;
6274
6275 pci_conf[PCI_INTERRUPT_PIN] = 1;
6276 pci_config_set_prog_interface(pci_conf, 0x2);
6277
6278 if (n->params.use_intel_id) {
6279 pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_INTEL);
6280 pci_config_set_device_id(pci_conf, 0x5845);
6281 } else {
6282 pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_REDHAT);
6283 pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_REDHAT_NVME);
6284 }
6285
6286 pci_config_set_class(pci_conf, PCI_CLASS_STORAGE_EXPRESS);
6287 pcie_endpoint_cap_init(pci_dev, 0x80);
6288
6289 bar_size = QEMU_ALIGN_UP(n->reg_size, 4 * KiB);
6290 msix_table_offset = bar_size;
6291 msix_table_size = PCI_MSIX_ENTRY_SIZE * n->params.msix_qsize;
6292
6293 bar_size += msix_table_size;
6294 bar_size = QEMU_ALIGN_UP(bar_size, 4 * KiB);
6295 msix_pba_offset = bar_size;
6296 msix_pba_size = QEMU_ALIGN_UP(n->params.msix_qsize, 64) / 8;
6297
6298 bar_size += msix_pba_size;
6299 bar_size = pow2ceil(bar_size);
6300
6301 memory_region_init(&n->bar0, OBJECT(n), "nvme-bar0", bar_size);
6302 memory_region_init_io(&n->iomem, OBJECT(n), &nvme_mmio_ops, n, "nvme",
6303 n->reg_size);
6304 memory_region_add_subregion(&n->bar0, 0, &n->iomem);
6305
6306 pci_register_bar(pci_dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY |
6307 PCI_BASE_ADDRESS_MEM_TYPE_64, &n->bar0);
6308 ret = msix_init(pci_dev, n->params.msix_qsize,
6309 &n->bar0, 0, msix_table_offset,
6310 &n->bar0, 0, msix_pba_offset, 0, &err);
6311 if (ret < 0) {
6312 if (ret == -ENOTSUP) {
6313 warn_report_err(err);
6314 } else {
6315 error_propagate(errp, err);
6316 return ret;
6317 }
6318 }
6319
6320 if (n->params.cmb_size_mb) {
6321 nvme_init_cmb(n, pci_dev);
6322 }
6323
6324 if (n->pmr.dev) {
6325 nvme_init_pmr(n, pci_dev);
6326 }
6327
6328 return 0;
6329 }
6330
6331 static void nvme_init_subnqn(NvmeCtrl *n)
6332 {
6333 NvmeSubsystem *subsys = n->subsys;
6334 NvmeIdCtrl *id = &n->id_ctrl;
6335
6336 if (!subsys) {
6337 snprintf((char *)id->subnqn, sizeof(id->subnqn),
6338 "nqn.2019-08.org.qemu:%s", n->params.serial);
6339 } else {
6340 pstrcpy((char *)id->subnqn, sizeof(id->subnqn), (char*)subsys->subnqn);
6341 }
6342 }
6343
6344 static void nvme_init_ctrl(NvmeCtrl *n, PCIDevice *pci_dev)
6345 {
6346 NvmeIdCtrl *id = &n->id_ctrl;
6347 uint8_t *pci_conf = pci_dev->config;
6348
6349 id->vid = cpu_to_le16(pci_get_word(pci_conf + PCI_VENDOR_ID));
6350 id->ssvid = cpu_to_le16(pci_get_word(pci_conf + PCI_SUBSYSTEM_VENDOR_ID));
6351 strpadcpy((char *)id->mn, sizeof(id->mn), "QEMU NVMe Ctrl", ' ');
6352 strpadcpy((char *)id->fr, sizeof(id->fr), "1.0", ' ');
6353 strpadcpy((char *)id->sn, sizeof(id->sn), n->params.serial, ' ');
6354
6355 id->cntlid = cpu_to_le16(n->cntlid);
6356
6357 id->oaes = cpu_to_le32(NVME_OAES_NS_ATTR);
6358
6359 id->rab = 6;
6360
6361 if (n->params.use_intel_id) {
6362 id->ieee[0] = 0xb3;
6363 id->ieee[1] = 0x02;
6364 id->ieee[2] = 0x00;
6365 } else {
6366 id->ieee[0] = 0x00;
6367 id->ieee[1] = 0x54;
6368 id->ieee[2] = 0x52;
6369 }
6370
6371 id->mdts = n->params.mdts;
6372 id->ver = cpu_to_le32(NVME_SPEC_VER);
6373 id->oacs = cpu_to_le16(NVME_OACS_NS_MGMT | NVME_OACS_FORMAT);
6374 id->cntrltype = 0x1;
6375
6376 /*
6377 * Because the controller always completes the Abort command immediately,
6378 * there can never be more than one concurrently executing Abort command,
6379 * so this value is never used for anything. Note that there can easily be
6380 * many Abort commands in the queues, but they are not considered
6381 * "executing" until processed by nvme_abort.
6382 *
6383 * The specification recommends a value of 3 for Abort Command Limit (four
6384 * concurrently outstanding Abort commands), so lets use that though it is
6385 * inconsequential.
6386 */
6387 id->acl = 3;
6388 id->aerl = n->params.aerl;
6389 id->frmw = (NVME_NUM_FW_SLOTS << 1) | NVME_FRMW_SLOT1_RO;
6390 id->lpa = NVME_LPA_NS_SMART | NVME_LPA_CSE | NVME_LPA_EXTENDED;
6391
6392 /* recommended default value (~70 C) */
6393 id->wctemp = cpu_to_le16(NVME_TEMPERATURE_WARNING);
6394 id->cctemp = cpu_to_le16(NVME_TEMPERATURE_CRITICAL);
6395
6396 id->sqes = (0x6 << 4) | 0x6;
6397 id->cqes = (0x4 << 4) | 0x4;
6398 id->nn = cpu_to_le32(NVME_MAX_NAMESPACES);
6399 id->oncs = cpu_to_le16(NVME_ONCS_WRITE_ZEROES | NVME_ONCS_TIMESTAMP |
6400 NVME_ONCS_FEATURES | NVME_ONCS_DSM |
6401 NVME_ONCS_COMPARE | NVME_ONCS_COPY);
6402
6403 /*
6404 * NOTE: If this device ever supports a command set that does NOT use 0x0
6405 * as a Flush-equivalent operation, support for the broadcast NSID in Flush
6406 * should probably be removed.
6407 *
6408 * See comment in nvme_io_cmd.
6409 */
6410 id->vwc = NVME_VWC_NSID_BROADCAST_SUPPORT | NVME_VWC_PRESENT;
6411
6412 id->ocfs = cpu_to_le16(NVME_OCFS_COPY_FORMAT_0);
6413 id->sgls = cpu_to_le32(NVME_CTRL_SGLS_SUPPORT_NO_ALIGN |
6414 NVME_CTRL_SGLS_BITBUCKET);
6415
6416 nvme_init_subnqn(n);
6417
6418 id->psd[0].mp = cpu_to_le16(0x9c4);
6419 id->psd[0].enlat = cpu_to_le32(0x10);
6420 id->psd[0].exlat = cpu_to_le32(0x4);
6421
6422 if (n->subsys) {
6423 id->cmic |= NVME_CMIC_MULTI_CTRL;
6424 }
6425
6426 NVME_CAP_SET_MQES(n->bar.cap, 0x7ff);
6427 NVME_CAP_SET_CQR(n->bar.cap, 1);
6428 NVME_CAP_SET_TO(n->bar.cap, 0xf);
6429 NVME_CAP_SET_CSS(n->bar.cap, NVME_CAP_CSS_NVM);
6430 NVME_CAP_SET_CSS(n->bar.cap, NVME_CAP_CSS_CSI_SUPP);
6431 NVME_CAP_SET_CSS(n->bar.cap, NVME_CAP_CSS_ADMIN_ONLY);
6432 NVME_CAP_SET_MPSMAX(n->bar.cap, 4);
6433 NVME_CAP_SET_CMBS(n->bar.cap, n->params.cmb_size_mb ? 1 : 0);
6434 NVME_CAP_SET_PMRS(n->bar.cap, n->pmr.dev ? 1 : 0);
6435
6436 n->bar.vs = NVME_SPEC_VER;
6437 n->bar.intmc = n->bar.intms = 0;
6438 }
6439
6440 static int nvme_init_subsys(NvmeCtrl *n, Error **errp)
6441 {
6442 int cntlid;
6443
6444 if (!n->subsys) {
6445 return 0;
6446 }
6447
6448 cntlid = nvme_subsys_register_ctrl(n, errp);
6449 if (cntlid < 0) {
6450 return -1;
6451 }
6452
6453 n->cntlid = cntlid;
6454
6455 return 0;
6456 }
6457
6458 void nvme_attach_ns(NvmeCtrl *n, NvmeNamespace *ns)
6459 {
6460 uint32_t nsid = ns->params.nsid;
6461 assert(nsid && nsid <= NVME_MAX_NAMESPACES);
6462
6463 n->namespaces[nsid] = ns;
6464 ns->attached++;
6465
6466 n->dmrsl = MIN_NON_ZERO(n->dmrsl,
6467 BDRV_REQUEST_MAX_BYTES / nvme_l2b(ns, 1));
6468 }
6469
6470 static void nvme_realize(PCIDevice *pci_dev, Error **errp)
6471 {
6472 NvmeCtrl *n = NVME(pci_dev);
6473 NvmeNamespace *ns;
6474 Error *local_err = NULL;
6475
6476 nvme_check_constraints(n, &local_err);
6477 if (local_err) {
6478 error_propagate(errp, local_err);
6479 return;
6480 }
6481
6482 qbus_create_inplace(&n->bus, sizeof(NvmeBus), TYPE_NVME_BUS,
6483 &pci_dev->qdev, n->parent_obj.qdev.id);
6484
6485 nvme_init_state(n);
6486 if (nvme_init_pci(n, pci_dev, errp)) {
6487 return;
6488 }
6489
6490 if (nvme_init_subsys(n, errp)) {
6491 error_propagate(errp, local_err);
6492 return;
6493 }
6494 nvme_init_ctrl(n, pci_dev);
6495
6496 /* setup a namespace if the controller drive property was given */
6497 if (n->namespace.blkconf.blk) {
6498 ns = &n->namespace;
6499 ns->params.nsid = 1;
6500
6501 if (nvme_ns_setup(n, ns, errp)) {
6502 return;
6503 }
6504
6505 nvme_attach_ns(n, ns);
6506 }
6507 }
6508
6509 static void nvme_exit(PCIDevice *pci_dev)
6510 {
6511 NvmeCtrl *n = NVME(pci_dev);
6512 NvmeNamespace *ns;
6513 int i;
6514
6515 nvme_ctrl_reset(n);
6516
6517 for (i = 1; i <= NVME_MAX_NAMESPACES; i++) {
6518 ns = nvme_ns(n, i);
6519 if (!ns) {
6520 continue;
6521 }
6522
6523 nvme_ns_cleanup(ns);
6524 }
6525
6526 g_free(n->cq);
6527 g_free(n->sq);
6528 g_free(n->aer_reqs);
6529
6530 if (n->params.cmb_size_mb) {
6531 g_free(n->cmb.buf);
6532 }
6533
6534 if (n->pmr.dev) {
6535 host_memory_backend_set_mapped(n->pmr.dev, false);
6536 }
6537 msix_uninit(pci_dev, &n->bar0, &n->bar0);
6538 memory_region_del_subregion(&n->bar0, &n->iomem);
6539 }
6540
6541 static Property nvme_props[] = {
6542 DEFINE_BLOCK_PROPERTIES(NvmeCtrl, namespace.blkconf),
6543 DEFINE_PROP_LINK("pmrdev", NvmeCtrl, pmr.dev, TYPE_MEMORY_BACKEND,
6544 HostMemoryBackend *),
6545 DEFINE_PROP_LINK("subsys", NvmeCtrl, subsys, TYPE_NVME_SUBSYS,
6546 NvmeSubsystem *),
6547 DEFINE_PROP_STRING("serial", NvmeCtrl, params.serial),
6548 DEFINE_PROP_UINT32("cmb_size_mb", NvmeCtrl, params.cmb_size_mb, 0),
6549 DEFINE_PROP_UINT32("num_queues", NvmeCtrl, params.num_queues, 0),
6550 DEFINE_PROP_UINT32("max_ioqpairs", NvmeCtrl, params.max_ioqpairs, 64),
6551 DEFINE_PROP_UINT16("msix_qsize", NvmeCtrl, params.msix_qsize, 65),
6552 DEFINE_PROP_UINT8("aerl", NvmeCtrl, params.aerl, 3),
6553 DEFINE_PROP_UINT32("aer_max_queued", NvmeCtrl, params.aer_max_queued, 64),
6554 DEFINE_PROP_UINT8("mdts", NvmeCtrl, params.mdts, 7),
6555 DEFINE_PROP_UINT8("vsl", NvmeCtrl, params.vsl, 7),
6556 DEFINE_PROP_BOOL("use-intel-id", NvmeCtrl, params.use_intel_id, false),
6557 DEFINE_PROP_BOOL("legacy-cmb", NvmeCtrl, params.legacy_cmb, false),
6558 DEFINE_PROP_UINT8("zoned.zasl", NvmeCtrl, params.zasl, 0),
6559 DEFINE_PROP_BOOL("zoned.auto_transition", NvmeCtrl,
6560 params.auto_transition_zones, true),
6561 DEFINE_PROP_END_OF_LIST(),
6562 };
6563
6564 static void nvme_get_smart_warning(Object *obj, Visitor *v, const char *name,
6565 void *opaque, Error **errp)
6566 {
6567 NvmeCtrl *n = NVME(obj);
6568 uint8_t value = n->smart_critical_warning;
6569
6570 visit_type_uint8(v, name, &value, errp);
6571 }
6572
6573 static void nvme_set_smart_warning(Object *obj, Visitor *v, const char *name,
6574 void *opaque, Error **errp)
6575 {
6576 NvmeCtrl *n = NVME(obj);
6577 uint8_t value, old_value, cap = 0, index, event;
6578
6579 if (!visit_type_uint8(v, name, &value, errp)) {
6580 return;
6581 }
6582
6583 cap = NVME_SMART_SPARE | NVME_SMART_TEMPERATURE | NVME_SMART_RELIABILITY
6584 | NVME_SMART_MEDIA_READ_ONLY | NVME_SMART_FAILED_VOLATILE_MEDIA;
6585 if (NVME_CAP_PMRS(n->bar.cap)) {
6586 cap |= NVME_SMART_PMR_UNRELIABLE;
6587 }
6588
6589 if ((value & cap) != value) {
6590 error_setg(errp, "unsupported smart critical warning bits: 0x%x",
6591 value & ~cap);
6592 return;
6593 }
6594
6595 old_value = n->smart_critical_warning;
6596 n->smart_critical_warning = value;
6597
6598 /* only inject new bits of smart critical warning */
6599 for (index = 0; index < NVME_SMART_WARN_MAX; index++) {
6600 event = 1 << index;
6601 if (value & ~old_value & event)
6602 nvme_smart_event(n, event);
6603 }
6604 }
6605
6606 static const VMStateDescription nvme_vmstate = {
6607 .name = "nvme",
6608 .unmigratable = 1,
6609 };
6610
6611 static void nvme_class_init(ObjectClass *oc, void *data)
6612 {
6613 DeviceClass *dc = DEVICE_CLASS(oc);
6614 PCIDeviceClass *pc = PCI_DEVICE_CLASS(oc);
6615
6616 pc->realize = nvme_realize;
6617 pc->exit = nvme_exit;
6618 pc->class_id = PCI_CLASS_STORAGE_EXPRESS;
6619 pc->revision = 2;
6620
6621 set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
6622 dc->desc = "Non-Volatile Memory Express";
6623 device_class_set_props(dc, nvme_props);
6624 dc->vmsd = &nvme_vmstate;
6625 }
6626
6627 static void nvme_instance_init(Object *obj)
6628 {
6629 NvmeCtrl *n = NVME(obj);
6630
6631 device_add_bootindex_property(obj, &n->namespace.blkconf.bootindex,
6632 "bootindex", "/namespace@1,0",
6633 DEVICE(obj));
6634
6635 object_property_add(obj, "smart_critical_warning", "uint8",
6636 nvme_get_smart_warning,
6637 nvme_set_smart_warning, NULL, NULL);
6638 }
6639
6640 static const TypeInfo nvme_info = {
6641 .name = TYPE_NVME,
6642 .parent = TYPE_PCI_DEVICE,
6643 .instance_size = sizeof(NvmeCtrl),
6644 .instance_init = nvme_instance_init,
6645 .class_init = nvme_class_init,
6646 .interfaces = (InterfaceInfo[]) {
6647 { INTERFACE_PCIE_DEVICE },
6648 { }
6649 },
6650 };
6651
6652 static const TypeInfo nvme_bus_info = {
6653 .name = TYPE_NVME_BUS,
6654 .parent = TYPE_BUS,
6655 .instance_size = sizeof(NvmeBus),
6656 };
6657
6658 static void nvme_register_types(void)
6659 {
6660 type_register_static(&nvme_info);
6661 type_register_static(&nvme_bus_info);
6662 }
6663
6664 type_init(nvme_register_types)
armbru's QEMU hackery